xmrig | 2b48d21c17f37253b6ee315fc2f872ceb8090a3f7b05b9ce6e0a6cba63764c34

Analysis

max time kernel
141s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
22-12-2024 20:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2b48d21c17f37253b6ee315fc2f872ceb8090a3f7b05b9ce6e0a6cba63764c34.exe
Size

1.7MB
MD5

1ac6328c04432375559089b1545dc1ad
SHA1

eb6a5a8a02b044066b092531aade509e93aace38
SHA256

2b48d21c17f37253b6ee315fc2f872ceb8090a3f7b05b9ce6e0a6cba63764c34
SHA512

efbfa993c2647498054b073117f4b62d03c4d5268bea6958f111ac23417e65f28f0ef3a4124e0ef9b2cd554419eeaca94d37cbbae0378a4c02a05e1e9a0e78d6
SSDEEP

49152:GezaTF8FcNkNdfE0pZ9ozttwIRRR/1fGkv+iht:GemTLkNdfE0pZyd

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 33 IoCs

miner

resource	yara_rule
behavioral2/files/0x0009000000023c86-4.dat	xmrig
behavioral2/files/0x0007000000023c93-8.dat	xmrig
behavioral2/files/0x0008000000023c8a-9.dat	xmrig
behavioral2/files/0x0007000000023c95-23.dat	xmrig
behavioral2/files/0x0007000000023c97-34.dat	xmrig
behavioral2/files/0x0007000000023c98-39.dat	xmrig
behavioral2/files/0x0007000000023c96-32.dat	xmrig
behavioral2/files/0x0007000000023c94-20.dat	xmrig
behavioral2/files/0x0009000000023c87-49.dat	xmrig
behavioral2/files/0x0007000000023c9c-57.dat	xmrig
behavioral2/files/0x0007000000023c9d-65.dat	xmrig
behavioral2/files/0x0007000000023c9e-69.dat	xmrig
behavioral2/files/0x0007000000023c9f-78.dat	xmrig
behavioral2/files/0x0007000000023ca1-88.dat	xmrig
behavioral2/files/0x0007000000023ca8-125.dat	xmrig
behavioral2/files/0x0007000000023cb1-162.dat	xmrig
behavioral2/files/0x0007000000023caf-160.dat	xmrig
behavioral2/files/0x0007000000023cb0-157.dat	xmrig
behavioral2/files/0x0007000000023cae-155.dat	xmrig
behavioral2/files/0x0007000000023cad-150.dat	xmrig
behavioral2/files/0x0007000000023cac-145.dat	xmrig
behavioral2/files/0x0007000000023cab-140.dat	xmrig
behavioral2/files/0x0007000000023caa-135.dat	xmrig
behavioral2/files/0x0007000000023ca9-130.dat	xmrig
behavioral2/files/0x0007000000023ca7-120.dat	xmrig
behavioral2/files/0x0007000000023ca6-115.dat	xmrig
behavioral2/files/0x0007000000023ca5-107.dat	xmrig
behavioral2/files/0x0007000000023ca4-103.dat	xmrig
behavioral2/files/0x0007000000023ca3-97.dat	xmrig
behavioral2/files/0x0007000000023ca2-93.dat	xmrig
behavioral2/files/0x0007000000023ca0-83.dat	xmrig
behavioral2/files/0x0007000000023c9b-58.dat	xmrig
behavioral2/files/0x0007000000023c99-47.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
3560	JJmULOd.exe
3928	JEuElFU.exe
2020	fqUsMED.exe
5008	YYcOhBO.exe
3212	JJWHiow.exe
4908	dbciVaZ.exe
1956	kNjZRGw.exe
4928	SERPqaP.exe
3380	NJaRXSY.exe
3224	furIFvM.exe
1740	ErXJHvG.exe
4548	SJebxcR.exe
632	AlzHMEW.exe
3020	IUziQRk.exe
2872	cobvZAz.exe
3760	xehuQtR.exe
1276	ZswGGOr.exe
4244	gcIWDfG.exe
2484	fNFHgIA.exe
1220	XGcoBIA.exe
4060	WjZlvQu.exe
2888	gpmrsSQ.exe
1920	DgLSzWK.exe
964	sRAyxzF.exe
1216	hLtGvpv.exe
4076	mlnYgqO.exe
508	UBkzuqI.exe
2444	cTzaNqf.exe
3192	YfvcKwI.exe
3584	ccJTvVg.exe
912	mAgfBWX.exe
4508	cFvADZg.exe
3956	IQADXDl.exe
1780	hZoUlkP.exe
4568	TUCSHil.exe
1176	tsWwsWb.exe
2588	PZigppZ.exe
1868	quCGvTc.exe
392	zURUzwF.exe
1080	MokjUQT.exe
1996	nGwkynA.exe
844	ZDkwBWa.exe
2340	UUSMItN.exe
4804	IRDuAAK.exe
5064	ePKzpkZ.exe
2844	mJbCKaG.exe
2352	RTTVzEO.exe
3340	olBUBXE.exe
552	BdWGjSw.exe
4068	tTLnyOb.exe
4856	oGabTGg.exe
4132	zNwUdUL.exe
1016	aScPKcC.exe
4368	AKlACGB.exe
3420	nQxLQOj.exe
4360	jzAaKtu.exe
4340	VQwojgV.exe
4612	ljqsngt.exe
836	dSAFXeG.exe
3312	ArOBNSJ.exe
2436	Xjcuuih.exe
1152	HqklZFp.exe
1480	lvJnQAL.exe
804	Zbxdcyu.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\eZGFhkl.exe	2b48d21c17f37253b6ee315fc2f872ceb8090a3f7b05b9ce6e0a6cba63764c34.exe
File created	C:\Windows\System\ckHunsW.exe	2b48d21c17f37253b6ee315fc2f872ceb8090a3f7b05b9ce6e0a6cba63764c34.exe
File created	C:\Windows\System\UNdwgaK.exe	2b48d21c17f37253b6ee315fc2f872ceb8090a3f7b05b9ce6e0a6cba63764c34.exe
File created	C:\Windows\System\OHEUuXa.exe	2b48d21c17f37253b6ee315fc2f872ceb8090a3f7b05b9ce6e0a6cba63764c34.exe
File created	C:\Windows\System\oKdUMJk.exe	2b48d21c17f37253b6ee315fc2f872ceb8090a3f7b05b9ce6e0a6cba63764c34.exe
File created	C:\Windows\System\AcmCtnw.exe	2b48d21c17f37253b6ee315fc2f872ceb8090a3f7b05b9ce6e0a6cba63764c34.exe
File created	C:\Windows\System\MniUbVY.exe	2b48d21c17f37253b6ee315fc2f872ceb8090a3f7b05b9ce6e0a6cba63764c34.exe
File created	C:\Windows\System\updZyqD.exe	2b48d21c17f37253b6ee315fc2f872ceb8090a3f7b05b9ce6e0a6cba63764c34.exe
File created	C:\Windows\System\odbJgUv.exe	2b48d21c17f37253b6ee315fc2f872ceb8090a3f7b05b9ce6e0a6cba63764c34.exe
File created	C:\Windows\System\coZIcde.exe	2b48d21c17f37253b6ee315fc2f872ceb8090a3f7b05b9ce6e0a6cba63764c34.exe
File created	C:\Windows\System\NQsFHae.exe	2b48d21c17f37253b6ee315fc2f872ceb8090a3f7b05b9ce6e0a6cba63764c34.exe
File created	C:\Windows\System\HzVuwsv.exe	2b48d21c17f37253b6ee315fc2f872ceb8090a3f7b05b9ce6e0a6cba63764c34.exe
File created	C:\Windows\System\ZxzlXiX.exe	2b48d21c17f37253b6ee315fc2f872ceb8090a3f7b05b9ce6e0a6cba63764c34.exe
File created	C:\Windows\System\bhryzPp.exe	2b48d21c17f37253b6ee315fc2f872ceb8090a3f7b05b9ce6e0a6cba63764c34.exe
File created	C:\Windows\System\JaMIOXF.exe	2b48d21c17f37253b6ee315fc2f872ceb8090a3f7b05b9ce6e0a6cba63764c34.exe
File created	C:\Windows\System\inczYwG.exe	2b48d21c17f37253b6ee315fc2f872ceb8090a3f7b05b9ce6e0a6cba63764c34.exe
File created	C:\Windows\System\exNXHat.exe	2b48d21c17f37253b6ee315fc2f872ceb8090a3f7b05b9ce6e0a6cba63764c34.exe
File created	C:\Windows\System\FJeWiRl.exe	2b48d21c17f37253b6ee315fc2f872ceb8090a3f7b05b9ce6e0a6cba63764c34.exe
File created	C:\Windows\System\tcVzKdF.exe	2b48d21c17f37253b6ee315fc2f872ceb8090a3f7b05b9ce6e0a6cba63764c34.exe
File created	C:\Windows\System\tTLnyOb.exe	2b48d21c17f37253b6ee315fc2f872ceb8090a3f7b05b9ce6e0a6cba63764c34.exe
File created	C:\Windows\System\zNwUdUL.exe	2b48d21c17f37253b6ee315fc2f872ceb8090a3f7b05b9ce6e0a6cba63764c34.exe
File created	C:\Windows\System\bxDHmAF.exe	2b48d21c17f37253b6ee315fc2f872ceb8090a3f7b05b9ce6e0a6cba63764c34.exe
File created	C:\Windows\System\dYRGLtr.exe	2b48d21c17f37253b6ee315fc2f872ceb8090a3f7b05b9ce6e0a6cba63764c34.exe
File created	C:\Windows\System\vCQFXZC.exe	2b48d21c17f37253b6ee315fc2f872ceb8090a3f7b05b9ce6e0a6cba63764c34.exe
File created	C:\Windows\System\zUzxnIy.exe	2b48d21c17f37253b6ee315fc2f872ceb8090a3f7b05b9ce6e0a6cba63764c34.exe
File created	C:\Windows\System\yvfEcWk.exe	2b48d21c17f37253b6ee315fc2f872ceb8090a3f7b05b9ce6e0a6cba63764c34.exe
File created	C:\Windows\System\yIFmrkp.exe	2b48d21c17f37253b6ee315fc2f872ceb8090a3f7b05b9ce6e0a6cba63764c34.exe
File created	C:\Windows\System\Cxuyvhh.exe	2b48d21c17f37253b6ee315fc2f872ceb8090a3f7b05b9ce6e0a6cba63764c34.exe
File created	C:\Windows\System\GXBVMDB.exe	2b48d21c17f37253b6ee315fc2f872ceb8090a3f7b05b9ce6e0a6cba63764c34.exe
File created	C:\Windows\System\UUSMItN.exe	2b48d21c17f37253b6ee315fc2f872ceb8090a3f7b05b9ce6e0a6cba63764c34.exe
File created	C:\Windows\System\fcpDMdv.exe	2b48d21c17f37253b6ee315fc2f872ceb8090a3f7b05b9ce6e0a6cba63764c34.exe
File created	C:\Windows\System\sqqFMsF.exe	2b48d21c17f37253b6ee315fc2f872ceb8090a3f7b05b9ce6e0a6cba63764c34.exe
File created	C:\Windows\System\xUXwpAr.exe	2b48d21c17f37253b6ee315fc2f872ceb8090a3f7b05b9ce6e0a6cba63764c34.exe
File created	C:\Windows\System\PURBFfs.exe	2b48d21c17f37253b6ee315fc2f872ceb8090a3f7b05b9ce6e0a6cba63764c34.exe
File created	C:\Windows\System\wcxhMRI.exe	2b48d21c17f37253b6ee315fc2f872ceb8090a3f7b05b9ce6e0a6cba63764c34.exe
File created	C:\Windows\System\AnPfLlI.exe	2b48d21c17f37253b6ee315fc2f872ceb8090a3f7b05b9ce6e0a6cba63764c34.exe
File created	C:\Windows\System\woZePMP.exe	2b48d21c17f37253b6ee315fc2f872ceb8090a3f7b05b9ce6e0a6cba63764c34.exe
File created	C:\Windows\System\QasAnVc.exe	2b48d21c17f37253b6ee315fc2f872ceb8090a3f7b05b9ce6e0a6cba63764c34.exe
File created	C:\Windows\System\wRTsebX.exe	2b48d21c17f37253b6ee315fc2f872ceb8090a3f7b05b9ce6e0a6cba63764c34.exe
File created	C:\Windows\System\ftqllbL.exe	2b48d21c17f37253b6ee315fc2f872ceb8090a3f7b05b9ce6e0a6cba63764c34.exe
File created	C:\Windows\System\NJaRXSY.exe	2b48d21c17f37253b6ee315fc2f872ceb8090a3f7b05b9ce6e0a6cba63764c34.exe
File created	C:\Windows\System\fNFHgIA.exe	2b48d21c17f37253b6ee315fc2f872ceb8090a3f7b05b9ce6e0a6cba63764c34.exe
File created	C:\Windows\System\NMVLRtG.exe	2b48d21c17f37253b6ee315fc2f872ceb8090a3f7b05b9ce6e0a6cba63764c34.exe
File created	C:\Windows\System\FSnXCKq.exe	2b48d21c17f37253b6ee315fc2f872ceb8090a3f7b05b9ce6e0a6cba63764c34.exe
File created	C:\Windows\System\sgUQIPm.exe	2b48d21c17f37253b6ee315fc2f872ceb8090a3f7b05b9ce6e0a6cba63764c34.exe
File created	C:\Windows\System\pbaCpfE.exe	2b48d21c17f37253b6ee315fc2f872ceb8090a3f7b05b9ce6e0a6cba63764c34.exe
File created	C:\Windows\System\BHTufUA.exe	2b48d21c17f37253b6ee315fc2f872ceb8090a3f7b05b9ce6e0a6cba63764c34.exe
File created	C:\Windows\System\vfyVeeG.exe	2b48d21c17f37253b6ee315fc2f872ceb8090a3f7b05b9ce6e0a6cba63764c34.exe
File created	C:\Windows\System\pbUdHDs.exe	2b48d21c17f37253b6ee315fc2f872ceb8090a3f7b05b9ce6e0a6cba63764c34.exe
File created	C:\Windows\System\ZDkwBWa.exe	2b48d21c17f37253b6ee315fc2f872ceb8090a3f7b05b9ce6e0a6cba63764c34.exe
File created	C:\Windows\System\hYkLqlU.exe	2b48d21c17f37253b6ee315fc2f872ceb8090a3f7b05b9ce6e0a6cba63764c34.exe
File created	C:\Windows\System\tWceNra.exe	2b48d21c17f37253b6ee315fc2f872ceb8090a3f7b05b9ce6e0a6cba63764c34.exe
File created	C:\Windows\System\hONFmpY.exe	2b48d21c17f37253b6ee315fc2f872ceb8090a3f7b05b9ce6e0a6cba63764c34.exe
File created	C:\Windows\System\qoidjXt.exe	2b48d21c17f37253b6ee315fc2f872ceb8090a3f7b05b9ce6e0a6cba63764c34.exe
File created	C:\Windows\System\efInNUU.exe	2b48d21c17f37253b6ee315fc2f872ceb8090a3f7b05b9ce6e0a6cba63764c34.exe
File created	C:\Windows\System\LTNTuRI.exe	2b48d21c17f37253b6ee315fc2f872ceb8090a3f7b05b9ce6e0a6cba63764c34.exe
File created	C:\Windows\System\VtCXkxi.exe	2b48d21c17f37253b6ee315fc2f872ceb8090a3f7b05b9ce6e0a6cba63764c34.exe
File created	C:\Windows\System\bKHEgba.exe	2b48d21c17f37253b6ee315fc2f872ceb8090a3f7b05b9ce6e0a6cba63764c34.exe
File created	C:\Windows\System\TUCSHil.exe	2b48d21c17f37253b6ee315fc2f872ceb8090a3f7b05b9ce6e0a6cba63764c34.exe
File created	C:\Windows\System\hqxUvAk.exe	2b48d21c17f37253b6ee315fc2f872ceb8090a3f7b05b9ce6e0a6cba63764c34.exe
File created	C:\Windows\System\NwcYAXV.exe	2b48d21c17f37253b6ee315fc2f872ceb8090a3f7b05b9ce6e0a6cba63764c34.exe
File created	C:\Windows\System\VmrtRBS.exe	2b48d21c17f37253b6ee315fc2f872ceb8090a3f7b05b9ce6e0a6cba63764c34.exe
File created	C:\Windows\System\aPNuYvo.exe	2b48d21c17f37253b6ee315fc2f872ceb8090a3f7b05b9ce6e0a6cba63764c34.exe
File created	C:\Windows\System\PvcufJY.exe	2b48d21c17f37253b6ee315fc2f872ceb8090a3f7b05b9ce6e0a6cba63764c34.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	17336	dwm.exe
Token: SeChangeNotifyPrivilege	17336	dwm.exe
Token: 33	17336	dwm.exe
Token: SeIncBasePriorityPrivilege	17336	dwm.exe
Token: SeShutdownPrivilege	17336	dwm.exe
Token: SeCreatePagefilePrivilege	17336	dwm.exe
Token: SeShutdownPrivilege	17336	dwm.exe
Token: SeCreatePagefilePrivilege	17336	dwm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3032 wrote to memory of 3560	3032	2b48d21c17f37253b6ee315fc2f872ceb8090a3f7b05b9ce6e0a6cba63764c34.exe	84
PID 3032 wrote to memory of 3560	3032	2b48d21c17f37253b6ee315fc2f872ceb8090a3f7b05b9ce6e0a6cba63764c34.exe	84
PID 3032 wrote to memory of 3928	3032	2b48d21c17f37253b6ee315fc2f872ceb8090a3f7b05b9ce6e0a6cba63764c34.exe	85
PID 3032 wrote to memory of 3928	3032	2b48d21c17f37253b6ee315fc2f872ceb8090a3f7b05b9ce6e0a6cba63764c34.exe	85
PID 3032 wrote to memory of 2020	3032	2b48d21c17f37253b6ee315fc2f872ceb8090a3f7b05b9ce6e0a6cba63764c34.exe	86
PID 3032 wrote to memory of 2020	3032	2b48d21c17f37253b6ee315fc2f872ceb8090a3f7b05b9ce6e0a6cba63764c34.exe	86
PID 3032 wrote to memory of 5008	3032	2b48d21c17f37253b6ee315fc2f872ceb8090a3f7b05b9ce6e0a6cba63764c34.exe	87
PID 3032 wrote to memory of 5008	3032	2b48d21c17f37253b6ee315fc2f872ceb8090a3f7b05b9ce6e0a6cba63764c34.exe	87
PID 3032 wrote to memory of 3212	3032	2b48d21c17f37253b6ee315fc2f872ceb8090a3f7b05b9ce6e0a6cba63764c34.exe	88
PID 3032 wrote to memory of 3212	3032	2b48d21c17f37253b6ee315fc2f872ceb8090a3f7b05b9ce6e0a6cba63764c34.exe	88
PID 3032 wrote to memory of 4908	3032	2b48d21c17f37253b6ee315fc2f872ceb8090a3f7b05b9ce6e0a6cba63764c34.exe	89
PID 3032 wrote to memory of 4908	3032	2b48d21c17f37253b6ee315fc2f872ceb8090a3f7b05b9ce6e0a6cba63764c34.exe	89
PID 3032 wrote to memory of 1956	3032	2b48d21c17f37253b6ee315fc2f872ceb8090a3f7b05b9ce6e0a6cba63764c34.exe	90
PID 3032 wrote to memory of 1956	3032	2b48d21c17f37253b6ee315fc2f872ceb8090a3f7b05b9ce6e0a6cba63764c34.exe	90
PID 3032 wrote to memory of 4928	3032	2b48d21c17f37253b6ee315fc2f872ceb8090a3f7b05b9ce6e0a6cba63764c34.exe	91
PID 3032 wrote to memory of 4928	3032	2b48d21c17f37253b6ee315fc2f872ceb8090a3f7b05b9ce6e0a6cba63764c34.exe	91
PID 3032 wrote to memory of 3380	3032	2b48d21c17f37253b6ee315fc2f872ceb8090a3f7b05b9ce6e0a6cba63764c34.exe	92
PID 3032 wrote to memory of 3380	3032	2b48d21c17f37253b6ee315fc2f872ceb8090a3f7b05b9ce6e0a6cba63764c34.exe	92
PID 3032 wrote to memory of 3224	3032	2b48d21c17f37253b6ee315fc2f872ceb8090a3f7b05b9ce6e0a6cba63764c34.exe	93
PID 3032 wrote to memory of 3224	3032	2b48d21c17f37253b6ee315fc2f872ceb8090a3f7b05b9ce6e0a6cba63764c34.exe	93
PID 3032 wrote to memory of 1740	3032	2b48d21c17f37253b6ee315fc2f872ceb8090a3f7b05b9ce6e0a6cba63764c34.exe	94
PID 3032 wrote to memory of 1740	3032	2b48d21c17f37253b6ee315fc2f872ceb8090a3f7b05b9ce6e0a6cba63764c34.exe	94
PID 3032 wrote to memory of 4548	3032	2b48d21c17f37253b6ee315fc2f872ceb8090a3f7b05b9ce6e0a6cba63764c34.exe	95
PID 3032 wrote to memory of 4548	3032	2b48d21c17f37253b6ee315fc2f872ceb8090a3f7b05b9ce6e0a6cba63764c34.exe	95
PID 3032 wrote to memory of 632	3032	2b48d21c17f37253b6ee315fc2f872ceb8090a3f7b05b9ce6e0a6cba63764c34.exe	96
PID 3032 wrote to memory of 632	3032	2b48d21c17f37253b6ee315fc2f872ceb8090a3f7b05b9ce6e0a6cba63764c34.exe	96
PID 3032 wrote to memory of 3020	3032	2b48d21c17f37253b6ee315fc2f872ceb8090a3f7b05b9ce6e0a6cba63764c34.exe	97
PID 3032 wrote to memory of 3020	3032	2b48d21c17f37253b6ee315fc2f872ceb8090a3f7b05b9ce6e0a6cba63764c34.exe	97
PID 3032 wrote to memory of 2872	3032	2b48d21c17f37253b6ee315fc2f872ceb8090a3f7b05b9ce6e0a6cba63764c34.exe	98
PID 3032 wrote to memory of 2872	3032	2b48d21c17f37253b6ee315fc2f872ceb8090a3f7b05b9ce6e0a6cba63764c34.exe	98
PID 3032 wrote to memory of 3760	3032	2b48d21c17f37253b6ee315fc2f872ceb8090a3f7b05b9ce6e0a6cba63764c34.exe	99
PID 3032 wrote to memory of 3760	3032	2b48d21c17f37253b6ee315fc2f872ceb8090a3f7b05b9ce6e0a6cba63764c34.exe	99
PID 3032 wrote to memory of 1276	3032	2b48d21c17f37253b6ee315fc2f872ceb8090a3f7b05b9ce6e0a6cba63764c34.exe	100
PID 3032 wrote to memory of 1276	3032	2b48d21c17f37253b6ee315fc2f872ceb8090a3f7b05b9ce6e0a6cba63764c34.exe	100
PID 3032 wrote to memory of 4244	3032	2b48d21c17f37253b6ee315fc2f872ceb8090a3f7b05b9ce6e0a6cba63764c34.exe	101
PID 3032 wrote to memory of 4244	3032	2b48d21c17f37253b6ee315fc2f872ceb8090a3f7b05b9ce6e0a6cba63764c34.exe	101
PID 3032 wrote to memory of 2484	3032	2b48d21c17f37253b6ee315fc2f872ceb8090a3f7b05b9ce6e0a6cba63764c34.exe	102
PID 3032 wrote to memory of 2484	3032	2b48d21c17f37253b6ee315fc2f872ceb8090a3f7b05b9ce6e0a6cba63764c34.exe	102
PID 3032 wrote to memory of 1220	3032	2b48d21c17f37253b6ee315fc2f872ceb8090a3f7b05b9ce6e0a6cba63764c34.exe	103
PID 3032 wrote to memory of 1220	3032	2b48d21c17f37253b6ee315fc2f872ceb8090a3f7b05b9ce6e0a6cba63764c34.exe	103
PID 3032 wrote to memory of 4060	3032	2b48d21c17f37253b6ee315fc2f872ceb8090a3f7b05b9ce6e0a6cba63764c34.exe	104
PID 3032 wrote to memory of 4060	3032	2b48d21c17f37253b6ee315fc2f872ceb8090a3f7b05b9ce6e0a6cba63764c34.exe	104
PID 3032 wrote to memory of 2888	3032	2b48d21c17f37253b6ee315fc2f872ceb8090a3f7b05b9ce6e0a6cba63764c34.exe	105
PID 3032 wrote to memory of 2888	3032	2b48d21c17f37253b6ee315fc2f872ceb8090a3f7b05b9ce6e0a6cba63764c34.exe	105
PID 3032 wrote to memory of 1920	3032	2b48d21c17f37253b6ee315fc2f872ceb8090a3f7b05b9ce6e0a6cba63764c34.exe	106
PID 3032 wrote to memory of 1920	3032	2b48d21c17f37253b6ee315fc2f872ceb8090a3f7b05b9ce6e0a6cba63764c34.exe	106
PID 3032 wrote to memory of 964	3032	2b48d21c17f37253b6ee315fc2f872ceb8090a3f7b05b9ce6e0a6cba63764c34.exe	107
PID 3032 wrote to memory of 964	3032	2b48d21c17f37253b6ee315fc2f872ceb8090a3f7b05b9ce6e0a6cba63764c34.exe	107
PID 3032 wrote to memory of 1216	3032	2b48d21c17f37253b6ee315fc2f872ceb8090a3f7b05b9ce6e0a6cba63764c34.exe	108
PID 3032 wrote to memory of 1216	3032	2b48d21c17f37253b6ee315fc2f872ceb8090a3f7b05b9ce6e0a6cba63764c34.exe	108
PID 3032 wrote to memory of 4076	3032	2b48d21c17f37253b6ee315fc2f872ceb8090a3f7b05b9ce6e0a6cba63764c34.exe	109
PID 3032 wrote to memory of 4076	3032	2b48d21c17f37253b6ee315fc2f872ceb8090a3f7b05b9ce6e0a6cba63764c34.exe	109
PID 3032 wrote to memory of 508	3032	2b48d21c17f37253b6ee315fc2f872ceb8090a3f7b05b9ce6e0a6cba63764c34.exe	110
PID 3032 wrote to memory of 508	3032	2b48d21c17f37253b6ee315fc2f872ceb8090a3f7b05b9ce6e0a6cba63764c34.exe	110
PID 3032 wrote to memory of 2444	3032	2b48d21c17f37253b6ee315fc2f872ceb8090a3f7b05b9ce6e0a6cba63764c34.exe	111
PID 3032 wrote to memory of 2444	3032	2b48d21c17f37253b6ee315fc2f872ceb8090a3f7b05b9ce6e0a6cba63764c34.exe	111
PID 3032 wrote to memory of 3192	3032	2b48d21c17f37253b6ee315fc2f872ceb8090a3f7b05b9ce6e0a6cba63764c34.exe	112
PID 3032 wrote to memory of 3192	3032	2b48d21c17f37253b6ee315fc2f872ceb8090a3f7b05b9ce6e0a6cba63764c34.exe	112
PID 3032 wrote to memory of 3584	3032	2b48d21c17f37253b6ee315fc2f872ceb8090a3f7b05b9ce6e0a6cba63764c34.exe	113
PID 3032 wrote to memory of 3584	3032	2b48d21c17f37253b6ee315fc2f872ceb8090a3f7b05b9ce6e0a6cba63764c34.exe	113
PID 3032 wrote to memory of 912	3032	2b48d21c17f37253b6ee315fc2f872ceb8090a3f7b05b9ce6e0a6cba63764c34.exe	114
PID 3032 wrote to memory of 912	3032	2b48d21c17f37253b6ee315fc2f872ceb8090a3f7b05b9ce6e0a6cba63764c34.exe	114
PID 3032 wrote to memory of 4508	3032	2b48d21c17f37253b6ee315fc2f872ceb8090a3f7b05b9ce6e0a6cba63764c34.exe	115
PID 3032 wrote to memory of 4508	3032	2b48d21c17f37253b6ee315fc2f872ceb8090a3f7b05b9ce6e0a6cba63764c34.exe	115

C:\Users\Admin\AppData\Local\Temp\2b48d21c17f37253b6ee315fc2f872ceb8090a3f7b05b9ce6e0a6cba63764c34.exe
"C:\Users\Admin\AppData\Local\Temp\2b48d21c17f37253b6ee315fc2f872ceb8090a3f7b05b9ce6e0a6cba63764c34.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3032
- C:\Windows\System\JJmULOd.exe
  C:\Windows\System\JJmULOd.exe
  2⤵
  - Executes dropped EXE
  PID:3560
- C:\Windows\System\JEuElFU.exe
  C:\Windows\System\JEuElFU.exe
  2⤵
  - Executes dropped EXE
  PID:3928
- C:\Windows\System\fqUsMED.exe
  C:\Windows\System\fqUsMED.exe
  2⤵
  - Executes dropped EXE
  PID:2020
- C:\Windows\System\YYcOhBO.exe
  C:\Windows\System\YYcOhBO.exe
  2⤵
  - Executes dropped EXE
  PID:5008
- C:\Windows\System\JJWHiow.exe
  C:\Windows\System\JJWHiow.exe
  2⤵
  - Executes dropped EXE
  PID:3212
- C:\Windows\System\dbciVaZ.exe
  C:\Windows\System\dbciVaZ.exe
  2⤵
  - Executes dropped EXE
  PID:4908
- C:\Windows\System\kNjZRGw.exe
  C:\Windows\System\kNjZRGw.exe
  2⤵
  - Executes dropped EXE
  PID:1956
- C:\Windows\System\SERPqaP.exe
  C:\Windows\System\SERPqaP.exe
  2⤵
  - Executes dropped EXE
  PID:4928
- C:\Windows\System\NJaRXSY.exe
  C:\Windows\System\NJaRXSY.exe
  2⤵
  - Executes dropped EXE
  PID:3380
- C:\Windows\System\furIFvM.exe
  C:\Windows\System\furIFvM.exe
  2⤵
  - Executes dropped EXE
  PID:3224
- C:\Windows\System\ErXJHvG.exe
  C:\Windows\System\ErXJHvG.exe
  2⤵
  - Executes dropped EXE
  PID:1740
- C:\Windows\System\SJebxcR.exe
  C:\Windows\System\SJebxcR.exe
  2⤵
  - Executes dropped EXE
  PID:4548
- C:\Windows\System\AlzHMEW.exe
  C:\Windows\System\AlzHMEW.exe
  2⤵
  - Executes dropped EXE
  PID:632
- C:\Windows\System\IUziQRk.exe
  C:\Windows\System\IUziQRk.exe
  2⤵
  - Executes dropped EXE
  PID:3020
- C:\Windows\System\cobvZAz.exe
  C:\Windows\System\cobvZAz.exe
  2⤵
  - Executes dropped EXE
  PID:2872
- C:\Windows\System\xehuQtR.exe
  C:\Windows\System\xehuQtR.exe
  2⤵
  - Executes dropped EXE
  PID:3760
- C:\Windows\System\ZswGGOr.exe
  C:\Windows\System\ZswGGOr.exe
  2⤵
  - Executes dropped EXE
  PID:1276
- C:\Windows\System\gcIWDfG.exe
  C:\Windows\System\gcIWDfG.exe
  2⤵
  - Executes dropped EXE
  PID:4244
- C:\Windows\System\fNFHgIA.exe
  C:\Windows\System\fNFHgIA.exe
  2⤵
  - Executes dropped EXE
  PID:2484
- C:\Windows\System\XGcoBIA.exe
  C:\Windows\System\XGcoBIA.exe
  2⤵
  - Executes dropped EXE
  PID:1220
- C:\Windows\System\WjZlvQu.exe
  C:\Windows\System\WjZlvQu.exe
  2⤵
  - Executes dropped EXE
  PID:4060
- C:\Windows\System\gpmrsSQ.exe
  C:\Windows\System\gpmrsSQ.exe
  2⤵
  - Executes dropped EXE
  PID:2888
- C:\Windows\System\DgLSzWK.exe
  C:\Windows\System\DgLSzWK.exe
  2⤵
  - Executes dropped EXE
  PID:1920
- C:\Windows\System\sRAyxzF.exe
  C:\Windows\System\sRAyxzF.exe
  2⤵
  - Executes dropped EXE
  PID:964
- C:\Windows\System\hLtGvpv.exe
  C:\Windows\System\hLtGvpv.exe
  2⤵
  - Executes dropped EXE
  PID:1216
- C:\Windows\System\mlnYgqO.exe
  C:\Windows\System\mlnYgqO.exe
  2⤵
  - Executes dropped EXE
  PID:4076
- C:\Windows\System\UBkzuqI.exe
  C:\Windows\System\UBkzuqI.exe
  2⤵
  - Executes dropped EXE
  PID:508
- C:\Windows\System\cTzaNqf.exe
  C:\Windows\System\cTzaNqf.exe
  2⤵
  - Executes dropped EXE
  PID:2444
- C:\Windows\System\YfvcKwI.exe
  C:\Windows\System\YfvcKwI.exe
  2⤵
  - Executes dropped EXE
  PID:3192
- C:\Windows\System\ccJTvVg.exe
  C:\Windows\System\ccJTvVg.exe
  2⤵
  - Executes dropped EXE
  PID:3584
- C:\Windows\System\mAgfBWX.exe
  C:\Windows\System\mAgfBWX.exe
  2⤵
  - Executes dropped EXE
  PID:912
- C:\Windows\System\cFvADZg.exe
  C:\Windows\System\cFvADZg.exe
  2⤵
  - Executes dropped EXE
  PID:4508
- C:\Windows\System\IQADXDl.exe
  C:\Windows\System\IQADXDl.exe
  2⤵
  - Executes dropped EXE
  PID:3956
- C:\Windows\System\hZoUlkP.exe
  C:\Windows\System\hZoUlkP.exe
  2⤵
  - Executes dropped EXE
  PID:1780
- C:\Windows\System\TUCSHil.exe
  C:\Windows\System\TUCSHil.exe
  2⤵
  - Executes dropped EXE
  PID:4568
- C:\Windows\System\tsWwsWb.exe
  C:\Windows\System\tsWwsWb.exe
  2⤵
  - Executes dropped EXE
  PID:1176
- C:\Windows\System\PZigppZ.exe
  C:\Windows\System\PZigppZ.exe
  2⤵
  - Executes dropped EXE
  PID:2588
- C:\Windows\System\quCGvTc.exe
  C:\Windows\System\quCGvTc.exe
  2⤵
  - Executes dropped EXE
  PID:1868
- C:\Windows\System\zURUzwF.exe
  C:\Windows\System\zURUzwF.exe
  2⤵
  - Executes dropped EXE
  PID:392
- C:\Windows\System\MokjUQT.exe
  C:\Windows\System\MokjUQT.exe
  2⤵
  - Executes dropped EXE
  PID:1080
- C:\Windows\System\nGwkynA.exe
  C:\Windows\System\nGwkynA.exe
  2⤵
  - Executes dropped EXE
  PID:1996
- C:\Windows\System\ZDkwBWa.exe
  C:\Windows\System\ZDkwBWa.exe
  2⤵
  - Executes dropped EXE
  PID:844
- C:\Windows\System\UUSMItN.exe
  C:\Windows\System\UUSMItN.exe
  2⤵
  - Executes dropped EXE
  PID:2340
- C:\Windows\System\IRDuAAK.exe
  C:\Windows\System\IRDuAAK.exe
  2⤵
  - Executes dropped EXE
  PID:4804
- C:\Windows\System\ePKzpkZ.exe
  C:\Windows\System\ePKzpkZ.exe
  2⤵
  - Executes dropped EXE
  PID:5064
- C:\Windows\System\mJbCKaG.exe
  C:\Windows\System\mJbCKaG.exe
  2⤵
  - Executes dropped EXE
  PID:2844
- C:\Windows\System\RTTVzEO.exe
  C:\Windows\System\RTTVzEO.exe
  2⤵
  - Executes dropped EXE
  PID:2352
- C:\Windows\System\olBUBXE.exe
  C:\Windows\System\olBUBXE.exe
  2⤵
  - Executes dropped EXE
  PID:3340
- C:\Windows\System\BdWGjSw.exe
  C:\Windows\System\BdWGjSw.exe
  2⤵
  - Executes dropped EXE
  PID:552
- C:\Windows\System\tTLnyOb.exe
  C:\Windows\System\tTLnyOb.exe
  2⤵
  - Executes dropped EXE
  PID:4068
- C:\Windows\System\oGabTGg.exe
  C:\Windows\System\oGabTGg.exe
  2⤵
  - Executes dropped EXE
  PID:4856
- C:\Windows\System\zNwUdUL.exe
  C:\Windows\System\zNwUdUL.exe
  2⤵
  - Executes dropped EXE
  PID:4132
- C:\Windows\System\aScPKcC.exe
  C:\Windows\System\aScPKcC.exe
  2⤵
  - Executes dropped EXE
  PID:1016
- C:\Windows\System\AKlACGB.exe
  C:\Windows\System\AKlACGB.exe
  2⤵
  - Executes dropped EXE
  PID:4368
- C:\Windows\System\nQxLQOj.exe
  C:\Windows\System\nQxLQOj.exe
  2⤵
  - Executes dropped EXE
  PID:3420
- C:\Windows\System\jzAaKtu.exe
  C:\Windows\System\jzAaKtu.exe
  2⤵
  - Executes dropped EXE
  PID:4360
- C:\Windows\System\VQwojgV.exe
  C:\Windows\System\VQwojgV.exe
  2⤵
  - Executes dropped EXE
  PID:4340
- C:\Windows\System\ljqsngt.exe
  C:\Windows\System\ljqsngt.exe
  2⤵
  - Executes dropped EXE
  PID:4612
- C:\Windows\System\dSAFXeG.exe
  C:\Windows\System\dSAFXeG.exe
  2⤵
  - Executes dropped EXE
  PID:836
- C:\Windows\System\ArOBNSJ.exe
  C:\Windows\System\ArOBNSJ.exe
  2⤵
  - Executes dropped EXE
  PID:3312
- C:\Windows\System\Xjcuuih.exe
  C:\Windows\System\Xjcuuih.exe
  2⤵
  - Executes dropped EXE
  PID:2436
- C:\Windows\System\HqklZFp.exe
  C:\Windows\System\HqklZFp.exe
  2⤵
  - Executes dropped EXE
  PID:1152
- C:\Windows\System\lvJnQAL.exe
  C:\Windows\System\lvJnQAL.exe
  2⤵
  - Executes dropped EXE
  PID:1480
- C:\Windows\System\Zbxdcyu.exe
  C:\Windows\System\Zbxdcyu.exe
  2⤵
  - Executes dropped EXE
  PID:804
- C:\Windows\System\XDVEljp.exe
  C:\Windows\System\XDVEljp.exe
  2⤵
  PID:3908
- C:\Windows\System\CHdPIMa.exe
  C:\Windows\System\CHdPIMa.exe
  2⤵
  PID:448
- C:\Windows\System\svYaSIr.exe
  C:\Windows\System\svYaSIr.exe
  2⤵
  PID:4800
- C:\Windows\System\zQrtesn.exe
  C:\Windows\System\zQrtesn.exe
  2⤵
  PID:4992
- C:\Windows\System\eyEzOKp.exe
  C:\Windows\System\eyEzOKp.exe
  2⤵
  PID:4592
- C:\Windows\System\FxLBXWg.exe
  C:\Windows\System\FxLBXWg.exe
  2⤵
  PID:1224
- C:\Windows\System\eGVOCXE.exe
  C:\Windows\System\eGVOCXE.exe
  2⤵
  PID:2700
- C:\Windows\System\OrYWTJN.exe
  C:\Windows\System\OrYWTJN.exe
  2⤵
  PID:3920
- C:\Windows\System\LkNngUA.exe
  C:\Windows\System\LkNngUA.exe
  2⤵
  PID:4748
- C:\Windows\System\GOyUQfc.exe
  C:\Windows\System\GOyUQfc.exe
  2⤵
  PID:3160
- C:\Windows\System\VIzzTlQ.exe
  C:\Windows\System\VIzzTlQ.exe
  2⤵
  PID:4104
- C:\Windows\System\SwPPtEE.exe
  C:\Windows\System\SwPPtEE.exe
  2⤵
  PID:3444
- C:\Windows\System\fHaKxXR.exe
  C:\Windows\System\fHaKxXR.exe
  2⤵
  PID:3964
- C:\Windows\System\bJengmD.exe
  C:\Windows\System\bJengmD.exe
  2⤵
  PID:2284
- C:\Windows\System\pKoleUC.exe
  C:\Windows\System\pKoleUC.exe
  2⤵
  PID:3876
- C:\Windows\System\TMMwSzX.exe
  C:\Windows\System\TMMwSzX.exe
  2⤵
  PID:1460
- C:\Windows\System\dLKnsSq.exe
  C:\Windows\System\dLKnsSq.exe
  2⤵
  PID:4080
- C:\Windows\System\JaMIOXF.exe
  C:\Windows\System\JaMIOXF.exe
  2⤵
  PID:4048
- C:\Windows\System\NiIeTyO.exe
  C:\Windows\System\NiIeTyO.exe
  2⤵
  PID:1324
- C:\Windows\System\GcJuCrH.exe
  C:\Windows\System\GcJuCrH.exe
  2⤵
  PID:4720
- C:\Windows\System\CGevpFS.exe
  C:\Windows\System\CGevpFS.exe
  2⤵
  PID:4324
- C:\Windows\System\nDoTVeE.exe
  C:\Windows\System\nDoTVeE.exe
  2⤵
  PID:1140
- C:\Windows\System\tFyhIOM.exe
  C:\Windows\System\tFyhIOM.exe
  2⤵
  PID:3496
- C:\Windows\System\kHroqGM.exe
  C:\Windows\System\kHroqGM.exe
  2⤵
  PID:4540
- C:\Windows\System\rGRpojN.exe
  C:\Windows\System\rGRpojN.exe
  2⤵
  PID:4828
- C:\Windows\System\mZolwBX.exe
  C:\Windows\System\mZolwBX.exe
  2⤵
  PID:4488
- C:\Windows\System\tCQeHGE.exe
  C:\Windows\System\tCQeHGE.exe
  2⤵
  PID:1852
- C:\Windows\System\IHxIJZD.exe
  C:\Windows\System\IHxIJZD.exe
  2⤵
  PID:3236
- C:\Windows\System\HffDOzk.exe
  C:\Windows\System\HffDOzk.exe
  2⤵
  PID:2180
- C:\Windows\System\PORJLZh.exe
  C:\Windows\System\PORJLZh.exe
  2⤵
  PID:4988
- C:\Windows\System\ZiRdNov.exe
  C:\Windows\System\ZiRdNov.exe
  2⤵
  PID:2348
- C:\Windows\System\EpuPbbT.exe
  C:\Windows\System\EpuPbbT.exe
  2⤵
  PID:1652
- C:\Windows\System\BRFlOUr.exe
  C:\Windows\System\BRFlOUr.exe
  2⤵
  PID:1912
- C:\Windows\System\uDRspzt.exe
  C:\Windows\System\uDRspzt.exe
  2⤵
  PID:2172
- C:\Windows\System\AjaXOWU.exe
  C:\Windows\System\AjaXOWU.exe
  2⤵
  PID:5140
- C:\Windows\System\nGbuxYu.exe
  C:\Windows\System\nGbuxYu.exe
  2⤵
  PID:5168
- C:\Windows\System\CYIyMRA.exe
  C:\Windows\System\CYIyMRA.exe
  2⤵
  PID:5196
- C:\Windows\System\WPKMtbW.exe
  C:\Windows\System\WPKMtbW.exe
  2⤵
  PID:5224
- C:\Windows\System\vhPXKqR.exe
  C:\Windows\System\vhPXKqR.exe
  2⤵
  PID:5248
- C:\Windows\System\kaeRvDV.exe
  C:\Windows\System\kaeRvDV.exe
  2⤵
  PID:5280
- C:\Windows\System\mlXjVzx.exe
  C:\Windows\System\mlXjVzx.exe
  2⤵
  PID:5304
- C:\Windows\System\fcpDMdv.exe
  C:\Windows\System\fcpDMdv.exe
  2⤵
  PID:5336
- C:\Windows\System\LKusTwd.exe
  C:\Windows\System\LKusTwd.exe
  2⤵
  PID:5364
- C:\Windows\System\lwAXvwl.exe
  C:\Windows\System\lwAXvwl.exe
  2⤵
  PID:5392
- C:\Windows\System\OrAuzuI.exe
  C:\Windows\System\OrAuzuI.exe
  2⤵
  PID:5420
- C:\Windows\System\vWdnIMd.exe
  C:\Windows\System\vWdnIMd.exe
  2⤵
  PID:5448
- C:\Windows\System\FXtOJfM.exe
  C:\Windows\System\FXtOJfM.exe
  2⤵
  PID:5476
- C:\Windows\System\AEBCOAY.exe
  C:\Windows\System\AEBCOAY.exe
  2⤵
  PID:5504
- C:\Windows\System\VmrtRBS.exe
  C:\Windows\System\VmrtRBS.exe
  2⤵
  PID:5532
- C:\Windows\System\hYFJShm.exe
  C:\Windows\System\hYFJShm.exe
  2⤵
  PID:5560
- C:\Windows\System\vKopMFG.exe
  C:\Windows\System\vKopMFG.exe
  2⤵
  PID:5588
- C:\Windows\System\mQXQfCF.exe
  C:\Windows\System\mQXQfCF.exe
  2⤵
  PID:5616
- C:\Windows\System\suOWUsA.exe
  C:\Windows\System\suOWUsA.exe
  2⤵
  PID:5640
- C:\Windows\System\CqVfQZI.exe
  C:\Windows\System\CqVfQZI.exe
  2⤵
  PID:5672
- C:\Windows\System\KeEbbId.exe
  C:\Windows\System\KeEbbId.exe
  2⤵
  PID:5700
- C:\Windows\System\yoeDZEp.exe
  C:\Windows\System\yoeDZEp.exe
  2⤵
  PID:5728
- C:\Windows\System\gHEMSLn.exe
  C:\Windows\System\gHEMSLn.exe
  2⤵
  PID:5756
- C:\Windows\System\LoAOGdI.exe
  C:\Windows\System\LoAOGdI.exe
  2⤵
  PID:5784
- C:\Windows\System\VYBRmLQ.exe
  C:\Windows\System\VYBRmLQ.exe
  2⤵
  PID:5812
- C:\Windows\System\abXHYau.exe
  C:\Windows\System\abXHYau.exe
  2⤵
  PID:5840
- C:\Windows\System\HaXTjqd.exe
  C:\Windows\System\HaXTjqd.exe
  2⤵
  PID:5868
- C:\Windows\System\AkDETie.exe
  C:\Windows\System\AkDETie.exe
  2⤵
  PID:5896
- C:\Windows\System\gfQrBmq.exe
  C:\Windows\System\gfQrBmq.exe
  2⤵
  PID:5924
- C:\Windows\System\EAxCovG.exe
  C:\Windows\System\EAxCovG.exe
  2⤵
  PID:5952
- C:\Windows\System\oGzdsGp.exe
  C:\Windows\System\oGzdsGp.exe
  2⤵
  PID:5976
- C:\Windows\System\UdROqeX.exe
  C:\Windows\System\UdROqeX.exe
  2⤵
  PID:6004
- C:\Windows\System\mpvOmXq.exe
  C:\Windows\System\mpvOmXq.exe
  2⤵
  PID:6032
- C:\Windows\System\YDZlKFN.exe
  C:\Windows\System\YDZlKFN.exe
  2⤵
  PID:6068
- C:\Windows\System\zuHNkwd.exe
  C:\Windows\System\zuHNkwd.exe
  2⤵
  PID:6092
- C:\Windows\System\sIBOWds.exe
  C:\Windows\System\sIBOWds.exe
  2⤵
  PID:6120
- C:\Windows\System\UODhUCl.exe
  C:\Windows\System\UODhUCl.exe
  2⤵
  PID:464
- C:\Windows\System\alVgYDv.exe
  C:\Windows\System\alVgYDv.exe
  2⤵
  PID:636
- C:\Windows\System\IaoeVEO.exe
  C:\Windows\System\IaoeVEO.exe
  2⤵
  PID:3408
- C:\Windows\System\uJIErov.exe
  C:\Windows\System\uJIErov.exe
  2⤵
  PID:1792
- C:\Windows\System\nEsRhWm.exe
  C:\Windows\System\nEsRhWm.exe
  2⤵
  PID:1616
- C:\Windows\System\pDMZqZp.exe
  C:\Windows\System\pDMZqZp.exe
  2⤵
  PID:5152
- C:\Windows\System\YaaAomn.exe
  C:\Windows\System\YaaAomn.exe
  2⤵
  PID:5212
- C:\Windows\System\qSgsshw.exe
  C:\Windows\System\qSgsshw.exe
  2⤵
  PID:5272
- C:\Windows\System\ZgUAwSf.exe
  C:\Windows\System\ZgUAwSf.exe
  2⤵
  PID:5352
- C:\Windows\System\twFgetV.exe
  C:\Windows\System\twFgetV.exe
  2⤵
  PID:5412
- C:\Windows\System\MWlQCYD.exe
  C:\Windows\System\MWlQCYD.exe
  2⤵
  PID:5488
- C:\Windows\System\aSwinGQ.exe
  C:\Windows\System\aSwinGQ.exe
  2⤵
  PID:5548
- C:\Windows\System\IlRnlVE.exe
  C:\Windows\System\IlRnlVE.exe
  2⤵
  PID:5608
- C:\Windows\System\oKdUMJk.exe
  C:\Windows\System\oKdUMJk.exe
  2⤵
  PID:5684
- C:\Windows\System\tIpzqrP.exe
  C:\Windows\System\tIpzqrP.exe
  2⤵
  PID:5740
- C:\Windows\System\BKnkjTB.exe
  C:\Windows\System\BKnkjTB.exe
  2⤵
  PID:5800
- C:\Windows\System\eKJhWEX.exe
  C:\Windows\System\eKJhWEX.exe
  2⤵
  PID:5880
- C:\Windows\System\jjwcmSC.exe
  C:\Windows\System\jjwcmSC.exe
  2⤵
  PID:5912
- C:\Windows\System\LCBadPo.exe
  C:\Windows\System\LCBadPo.exe
  2⤵
  PID:5972
- C:\Windows\System\eMeAzAo.exe
  C:\Windows\System\eMeAzAo.exe
  2⤵
  PID:6056
- C:\Windows\System\LETLGlk.exe
  C:\Windows\System\LETLGlk.exe
  2⤵
  PID:4796
- C:\Windows\System\qnaLeqx.exe
  C:\Windows\System\qnaLeqx.exe
  2⤵
  PID:3316
- C:\Windows\System\epYgxjr.exe
  C:\Windows\System\epYgxjr.exe
  2⤵
  PID:3260
- C:\Windows\System\xMHosHf.exe
  C:\Windows\System\xMHosHf.exe
  2⤵
  PID:1524
- C:\Windows\System\cwmcvxk.exe
  C:\Windows\System\cwmcvxk.exe
  2⤵
  PID:5188
- C:\Windows\System\VvySGVt.exe
  C:\Windows\System\VvySGVt.exe
  2⤵
  PID:5324
- C:\Windows\System\FuhRZKj.exe
  C:\Windows\System\FuhRZKj.exe
  2⤵
  PID:5600
- C:\Windows\System\dQBSEWG.exe
  C:\Windows\System\dQBSEWG.exe
  2⤵
  PID:5712
- C:\Windows\System\HBrnAVz.exe
  C:\Windows\System\HBrnAVz.exe
  2⤵
  PID:5772
- C:\Windows\System\XwHkKAn.exe
  C:\Windows\System\XwHkKAn.exe
  2⤵
  PID:5856
- C:\Windows\System\KpYaOxK.exe
  C:\Windows\System\KpYaOxK.exe
  2⤵
  PID:5964
- C:\Windows\System\QPKkAdq.exe
  C:\Windows\System\QPKkAdq.exe
  2⤵
  PID:1964
- C:\Windows\System\hxNmeGI.exe
  C:\Windows\System\hxNmeGI.exe
  2⤵
  PID:2968
- C:\Windows\System\xrpCBqe.exe
  C:\Windows\System\xrpCBqe.exe
  2⤵
  PID:4808
- C:\Windows\System\YDGmFcD.exe
  C:\Windows\System\YDGmFcD.exe
  2⤵
  PID:2744
- C:\Windows\System\xUXwpAr.exe
  C:\Windows\System\xUXwpAr.exe
  2⤵
  PID:228
- C:\Windows\System\ECkqdod.exe
  C:\Windows\System\ECkqdod.exe
  2⤵
  PID:5320
- C:\Windows\System\KfJdijz.exe
  C:\Windows\System\KfJdijz.exe
  2⤵
  PID:2268
- C:\Windows\System\PKsQntu.exe
  C:\Windows\System\PKsQntu.exe
  2⤵
  PID:4484
- C:\Windows\System\jryGjMf.exe
  C:\Windows\System\jryGjMf.exe
  2⤵
  PID:5832
- C:\Windows\System\gTYvMwr.exe
  C:\Windows\System\gTYvMwr.exe
  2⤵
  PID:972
- C:\Windows\System\lOnMyAs.exe
  C:\Windows\System\lOnMyAs.exe
  2⤵
  PID:372
- C:\Windows\System\kPDhbme.exe
  C:\Windows\System\kPDhbme.exe
  2⤵
  PID:1528
- C:\Windows\System\jcZuRVI.exe
  C:\Windows\System\jcZuRVI.exe
  2⤵
  PID:5464
- C:\Windows\System\mUcmTYo.exe
  C:\Windows\System\mUcmTYo.exe
  2⤵
  PID:4660
- C:\Windows\System\PURBFfs.exe
  C:\Windows\System\PURBFfs.exe
  2⤵
  PID:6160
- C:\Windows\System\yIZsgMf.exe
  C:\Windows\System\yIZsgMf.exe
  2⤵
  PID:6200
- C:\Windows\System\LTNTuRI.exe
  C:\Windows\System\LTNTuRI.exe
  2⤵
  PID:6228
- C:\Windows\System\drmbMfR.exe
  C:\Windows\System\drmbMfR.exe
  2⤵
  PID:6248
- C:\Windows\System\SXazWYb.exe
  C:\Windows\System\SXazWYb.exe
  2⤵
  PID:6280
- C:\Windows\System\GjQFWwD.exe
  C:\Windows\System\GjQFWwD.exe
  2⤵
  PID:6304
- C:\Windows\System\WjLzNqb.exe
  C:\Windows\System\WjLzNqb.exe
  2⤵
  PID:6340
- C:\Windows\System\NMVLRtG.exe
  C:\Windows\System\NMVLRtG.exe
  2⤵
  PID:6368
- C:\Windows\System\xrJrHwg.exe
  C:\Windows\System\xrJrHwg.exe
  2⤵
  PID:6396
- C:\Windows\System\yvfEcWk.exe
  C:\Windows\System\yvfEcWk.exe
  2⤵
  PID:6412
- C:\Windows\System\bKmrBuB.exe
  C:\Windows\System\bKmrBuB.exe
  2⤵
  PID:6428
- C:\Windows\System\BHatHNJ.exe
  C:\Windows\System\BHatHNJ.exe
  2⤵
  PID:6444
- C:\Windows\System\XeKuini.exe
  C:\Windows\System\XeKuini.exe
  2⤵
  PID:6464
- C:\Windows\System\nxyAQbE.exe
  C:\Windows\System\nxyAQbE.exe
  2⤵
  PID:6492
- C:\Windows\System\DNDbClt.exe
  C:\Windows\System\DNDbClt.exe
  2⤵
  PID:6520
- C:\Windows\System\pqPqtTB.exe
  C:\Windows\System\pqPqtTB.exe
  2⤵
  PID:6552
- C:\Windows\System\EfELwJh.exe
  C:\Windows\System\EfELwJh.exe
  2⤵
  PID:6588
- C:\Windows\System\aIYPRyO.exe
  C:\Windows\System\aIYPRyO.exe
  2⤵
  PID:6616
- C:\Windows\System\WKvgRaL.exe
  C:\Windows\System\WKvgRaL.exe
  2⤵
  PID:6652
- C:\Windows\System\YuRxybp.exe
  C:\Windows\System\YuRxybp.exe
  2⤵
  PID:6684
- C:\Windows\System\UBnFKSk.exe
  C:\Windows\System\UBnFKSk.exe
  2⤵
  PID:6716
- C:\Windows\System\DNPOfCJ.exe
  C:\Windows\System\DNPOfCJ.exe
  2⤵
  PID:6736
- C:\Windows\System\LKXbvxx.exe
  C:\Windows\System\LKXbvxx.exe
  2⤵
  PID:6760
- C:\Windows\System\pJWZmQn.exe
  C:\Windows\System\pJWZmQn.exe
  2⤵
  PID:6792
- C:\Windows\System\jmUsLpD.exe
  C:\Windows\System\jmUsLpD.exe
  2⤵
  PID:6820
- C:\Windows\System\tzdWCYx.exe
  C:\Windows\System\tzdWCYx.exe
  2⤵
  PID:6856
- C:\Windows\System\qgNHdqO.exe
  C:\Windows\System\qgNHdqO.exe
  2⤵
  PID:6876
- C:\Windows\System\nmczrKV.exe
  C:\Windows\System\nmczrKV.exe
  2⤵
  PID:6908
- C:\Windows\System\wSATFAT.exe
  C:\Windows\System\wSATFAT.exe
  2⤵
  PID:6944
- C:\Windows\System\qpHCxUi.exe
  C:\Windows\System\qpHCxUi.exe
  2⤵
  PID:6960
- C:\Windows\System\oJvyXau.exe
  C:\Windows\System\oJvyXau.exe
  2⤵
  PID:6976
- C:\Windows\System\kWIESEa.exe
  C:\Windows\System\kWIESEa.exe
  2⤵
  PID:6996
- C:\Windows\System\psFAXde.exe
  C:\Windows\System\psFAXde.exe
  2⤵
  PID:7024
- C:\Windows\System\WnlPdRj.exe
  C:\Windows\System\WnlPdRj.exe
  2⤵
  PID:7040
- C:\Windows\System\hwAjqfI.exe
  C:\Windows\System\hwAjqfI.exe
  2⤵
  PID:7064
- C:\Windows\System\qUXatBb.exe
  C:\Windows\System\qUXatBb.exe
  2⤵
  PID:7088
- C:\Windows\System\kVDUZis.exe
  C:\Windows\System\kVDUZis.exe
  2⤵
  PID:7120
- C:\Windows\System\apZXrtN.exe
  C:\Windows\System\apZXrtN.exe
  2⤵
  PID:7156
- C:\Windows\System\LQLHUnB.exe
  C:\Windows\System\LQLHUnB.exe
  2⤵
  PID:3552
- C:\Windows\System\SJrLDZk.exe
  C:\Windows\System\SJrLDZk.exe
  2⤵
  PID:6172
- C:\Windows\System\TXPbPdE.exe
  C:\Windows\System\TXPbPdE.exe
  2⤵
  PID:6240
- C:\Windows\System\LZLgfvC.exe
  C:\Windows\System\LZLgfvC.exe
  2⤵
  PID:6328
- C:\Windows\System\dqWMEAq.exe
  C:\Windows\System\dqWMEAq.exe
  2⤵
  PID:6404
- C:\Windows\System\oaeVprW.exe
  C:\Windows\System\oaeVprW.exe
  2⤵
  PID:6452
- C:\Windows\System\inczYwG.exe
  C:\Windows\System\inczYwG.exe
  2⤵
  PID:6536
- C:\Windows\System\DftmxWE.exe
  C:\Windows\System\DftmxWE.exe
  2⤵
  PID:6628
- C:\Windows\System\XPZHmMr.exe
  C:\Windows\System\XPZHmMr.exe
  2⤵
  PID:6704
- C:\Windows\System\VtCXkxi.exe
  C:\Windows\System\VtCXkxi.exe
  2⤵
  PID:6776
- C:\Windows\System\bKHEgba.exe
  C:\Windows\System\bKHEgba.exe
  2⤵
  PID:6848
- C:\Windows\System\XkmxyVQ.exe
  C:\Windows\System\XkmxyVQ.exe
  2⤵
  PID:6904
- C:\Windows\System\VoSIcxX.exe
  C:\Windows\System\VoSIcxX.exe
  2⤵
  PID:6968
- C:\Windows\System\rByvTog.exe
  C:\Windows\System\rByvTog.exe
  2⤵
  PID:7012
- C:\Windows\System\myajtlz.exe
  C:\Windows\System\myajtlz.exe
  2⤵
  PID:7132
- C:\Windows\System\FidzlTY.exe
  C:\Windows\System\FidzlTY.exe
  2⤵
  PID:7144
- C:\Windows\System\IWLEBzs.exe
  C:\Windows\System\IWLEBzs.exe
  2⤵
  PID:6268
- C:\Windows\System\sEnVZTA.exe
  C:\Windows\System\sEnVZTA.exe
  2⤵
  PID:6512
- C:\Windows\System\smlNNUm.exe
  C:\Windows\System\smlNNUm.exe
  2⤵
  PID:6784
- C:\Windows\System\ReRdDIE.exe
  C:\Windows\System\ReRdDIE.exe
  2⤵
  PID:6868
- C:\Windows\System\hgkhCuC.exe
  C:\Windows\System\hgkhCuC.exe
  2⤵
  PID:7108
- C:\Windows\System\ZXGdjfQ.exe
  C:\Windows\System\ZXGdjfQ.exe
  2⤵
  PID:6480
- C:\Windows\System\HxyJktf.exe
  C:\Windows\System\HxyJktf.exe
  2⤵
  PID:6668
- C:\Windows\System\lsXGjJM.exe
  C:\Windows\System\lsXGjJM.exe
  2⤵
  PID:7056
- C:\Windows\System\NpSaCpW.exe
  C:\Windows\System\NpSaCpW.exe
  2⤵
  PID:6500
- C:\Windows\System\KItapLi.exe
  C:\Windows\System\KItapLi.exe
  2⤵
  PID:6148
- C:\Windows\System\fkeMcWN.exe
  C:\Windows\System\fkeMcWN.exe
  2⤵
  PID:7188
- C:\Windows\System\NliNKgJ.exe
  C:\Windows\System\NliNKgJ.exe
  2⤵
  PID:7216
- C:\Windows\System\DTYYRkN.exe
  C:\Windows\System\DTYYRkN.exe
  2⤵
  PID:7244
- C:\Windows\System\qEYRFNi.exe
  C:\Windows\System\qEYRFNi.exe
  2⤵
  PID:7264
- C:\Windows\System\bxDHmAF.exe
  C:\Windows\System\bxDHmAF.exe
  2⤵
  PID:7288
- C:\Windows\System\eWsrifV.exe
  C:\Windows\System\eWsrifV.exe
  2⤵
  PID:7320
- C:\Windows\System\tBFMVLx.exe
  C:\Windows\System\tBFMVLx.exe
  2⤵
  PID:7336
- C:\Windows\System\qlWVlzn.exe
  C:\Windows\System\qlWVlzn.exe
  2⤵
  PID:7356
- C:\Windows\System\ULusTtR.exe
  C:\Windows\System\ULusTtR.exe
  2⤵
  PID:7380
- C:\Windows\System\nygAOeO.exe
  C:\Windows\System\nygAOeO.exe
  2⤵
  PID:7404
- C:\Windows\System\lccgdzW.exe
  C:\Windows\System\lccgdzW.exe
  2⤵
  PID:7460
- C:\Windows\System\RzUARbD.exe
  C:\Windows\System\RzUARbD.exe
  2⤵
  PID:7492
- C:\Windows\System\KXNJLMC.exe
  C:\Windows\System\KXNJLMC.exe
  2⤵
  PID:7520
- C:\Windows\System\RoXTMDQ.exe
  C:\Windows\System\RoXTMDQ.exe
  2⤵
  PID:7552
- C:\Windows\System\uzHkxMG.exe
  C:\Windows\System\uzHkxMG.exe
  2⤵
  PID:7576
- C:\Windows\System\AtBNmnr.exe
  C:\Windows\System\AtBNmnr.exe
  2⤵
  PID:7608
- C:\Windows\System\vHRtmaq.exe
  C:\Windows\System\vHRtmaq.exe
  2⤵
  PID:7632
- C:\Windows\System\MIaIwsZ.exe
  C:\Windows\System\MIaIwsZ.exe
  2⤵
  PID:7656
- C:\Windows\System\mdYDZOr.exe
  C:\Windows\System\mdYDZOr.exe
  2⤵
  PID:7696
- C:\Windows\System\yTmXJWa.exe
  C:\Windows\System\yTmXJWa.exe
  2⤵
  PID:7724
- C:\Windows\System\tDDRchc.exe
  C:\Windows\System\tDDRchc.exe
  2⤵
  PID:7760
- C:\Windows\System\pDWQqbm.exe
  C:\Windows\System\pDWQqbm.exe
  2⤵
  PID:7792
- C:\Windows\System\ZxzlXiX.exe
  C:\Windows\System\ZxzlXiX.exe
  2⤵
  PID:7816
- C:\Windows\System\EInROSA.exe
  C:\Windows\System\EInROSA.exe
  2⤵
  PID:7848
- C:\Windows\System\flogRfz.exe
  C:\Windows\System\flogRfz.exe
  2⤵
  PID:7872
- C:\Windows\System\mnRSGLX.exe
  C:\Windows\System\mnRSGLX.exe
  2⤵
  PID:7908
- C:\Windows\System\eVaDaNq.exe
  C:\Windows\System\eVaDaNq.exe
  2⤵
  PID:7936
- C:\Windows\System\TFcdukZ.exe
  C:\Windows\System\TFcdukZ.exe
  2⤵
  PID:7972
- C:\Windows\System\oDAyTHh.exe
  C:\Windows\System\oDAyTHh.exe
  2⤵
  PID:8000
- C:\Windows\System\bMEiECn.exe
  C:\Windows\System\bMEiECn.exe
  2⤵
  PID:8020
- C:\Windows\System\yZKOBKw.exe
  C:\Windows\System\yZKOBKw.exe
  2⤵
  PID:8060
- C:\Windows\System\FWUUtXD.exe
  C:\Windows\System\FWUUtXD.exe
  2⤵
  PID:8076
- C:\Windows\System\ICddWvO.exe
  C:\Windows\System\ICddWvO.exe
  2⤵
  PID:8100
- C:\Windows\System\rhHSLgH.exe
  C:\Windows\System\rhHSLgH.exe
  2⤵
  PID:8144
- C:\Windows\System\YXymNxg.exe
  C:\Windows\System\YXymNxg.exe
  2⤵
  PID:8160
- C:\Windows\System\wZNsogu.exe
  C:\Windows\System\wZNsogu.exe
  2⤵
  PID:8188
- C:\Windows\System\FSnXCKq.exe
  C:\Windows\System\FSnXCKq.exe
  2⤵
  PID:7228
- C:\Windows\System\DhYKeVb.exe
  C:\Windows\System\DhYKeVb.exe
  2⤵
  PID:7260
- C:\Windows\System\NWVhoGF.exe
  C:\Windows\System\NWVhoGF.exe
  2⤵
  PID:7344
- C:\Windows\System\dYRGLtr.exe
  C:\Windows\System\dYRGLtr.exe
  2⤵
  PID:7388
- C:\Windows\System\jLQwJzC.exe
  C:\Windows\System\jLQwJzC.exe
  2⤵
  PID:7424
- C:\Windows\System\fbjAbXB.exe
  C:\Windows\System\fbjAbXB.exe
  2⤵
  PID:7536
- C:\Windows\System\UNEGino.exe
  C:\Windows\System\UNEGino.exe
  2⤵
  PID:7592
- C:\Windows\System\woZePMP.exe
  C:\Windows\System\woZePMP.exe
  2⤵
  PID:7652
- C:\Windows\System\MYQrUbw.exe
  C:\Windows\System\MYQrUbw.exe
  2⤵
  PID:7748
- C:\Windows\System\xYUMGRn.exe
  C:\Windows\System\xYUMGRn.exe
  2⤵
  PID:7776
- C:\Windows\System\PoErCjA.exe
  C:\Windows\System\PoErCjA.exe
  2⤵
  PID:7832
- C:\Windows\System\dPfJXNE.exe
  C:\Windows\System\dPfJXNE.exe
  2⤵
  PID:7920
- C:\Windows\System\UQSFuHu.exe
  C:\Windows\System\UQSFuHu.exe
  2⤵
  PID:7964
- C:\Windows\System\UNdwgaK.exe
  C:\Windows\System\UNdwgaK.exe
  2⤵
  PID:8072
- C:\Windows\System\NhtiRbe.exe
  C:\Windows\System\NhtiRbe.exe
  2⤵
  PID:8120
- C:\Windows\System\HyfUUMa.exe
  C:\Windows\System\HyfUUMa.exe
  2⤵
  PID:8172
- C:\Windows\System\JHBygMM.exe
  C:\Windows\System\JHBygMM.exe
  2⤵
  PID:7368
- C:\Windows\System\odDFORJ.exe
  C:\Windows\System\odDFORJ.exe
  2⤵
  PID:7484
- C:\Windows\System\IScsoac.exe
  C:\Windows\System\IScsoac.exe
  2⤵
  PID:7644
- C:\Windows\System\mxVConD.exe
  C:\Windows\System\mxVConD.exe
  2⤵
  PID:7736
- C:\Windows\System\SisZtXH.exe
  C:\Windows\System\SisZtXH.exe
  2⤵
  PID:7928
- C:\Windows\System\fxMJBzl.exe
  C:\Windows\System\fxMJBzl.exe
  2⤵
  PID:8016
- C:\Windows\System\xGZuRrf.exe
  C:\Windows\System\xGZuRrf.exe
  2⤵
  PID:7212
- C:\Windows\System\FrHNyUT.exe
  C:\Windows\System\FrHNyUT.exe
  2⤵
  PID:7476
- C:\Windows\System\xrDWpGX.exe
  C:\Windows\System\xrDWpGX.exe
  2⤵
  PID:7800
- C:\Windows\System\hxSceOP.exe
  C:\Windows\System\hxSceOP.exe
  2⤵
  PID:7200
- C:\Windows\System\TxRBqZE.exe
  C:\Windows\System\TxRBqZE.exe
  2⤵
  PID:6816
- C:\Windows\System\bzEdaCv.exe
  C:\Windows\System\bzEdaCv.exe
  2⤵
  PID:8216
- C:\Windows\System\lUgvULQ.exe
  C:\Windows\System\lUgvULQ.exe
  2⤵
  PID:8248
- C:\Windows\System\YTtlIom.exe
  C:\Windows\System\YTtlIom.exe
  2⤵
  PID:8284
- C:\Windows\System\lEYSpRE.exe
  C:\Windows\System\lEYSpRE.exe
  2⤵
  PID:8312
- C:\Windows\System\dCiouNF.exe
  C:\Windows\System\dCiouNF.exe
  2⤵
  PID:8340
- C:\Windows\System\VgeZlcO.exe
  C:\Windows\System\VgeZlcO.exe
  2⤵
  PID:8360
- C:\Windows\System\tmHePcc.exe
  C:\Windows\System\tmHePcc.exe
  2⤵
  PID:8396
- C:\Windows\System\NtbHVML.exe
  C:\Windows\System\NtbHVML.exe
  2⤵
  PID:8412
- C:\Windows\System\fpQStIc.exe
  C:\Windows\System\fpQStIc.exe
  2⤵
  PID:8440
- C:\Windows\System\hMyVbPz.exe
  C:\Windows\System\hMyVbPz.exe
  2⤵
  PID:8468
- C:\Windows\System\onnLsCd.exe
  C:\Windows\System\onnLsCd.exe
  2⤵
  PID:8504
- C:\Windows\System\pbaCpfE.exe
  C:\Windows\System\pbaCpfE.exe
  2⤵
  PID:8528
- C:\Windows\System\UsejUjS.exe
  C:\Windows\System\UsejUjS.exe
  2⤵
  PID:8556
- C:\Windows\System\SmxLGtF.exe
  C:\Windows\System\SmxLGtF.exe
  2⤵
  PID:8576
- C:\Windows\System\mDdkpht.exe
  C:\Windows\System\mDdkpht.exe
  2⤵
  PID:8604
- C:\Windows\System\OHEUuXa.exe
  C:\Windows\System\OHEUuXa.exe
  2⤵
  PID:8640
- C:\Windows\System\oSNrSYh.exe
  C:\Windows\System\oSNrSYh.exe
  2⤵
  PID:8656
- C:\Windows\System\YjexgKN.exe
  C:\Windows\System\YjexgKN.exe
  2⤵
  PID:8692
- C:\Windows\System\oyDkaWJ.exe
  C:\Windows\System\oyDkaWJ.exe
  2⤵
  PID:8724
- C:\Windows\System\xwZYuDU.exe
  C:\Windows\System\xwZYuDU.exe
  2⤵
  PID:8752
- C:\Windows\System\snaFZjg.exe
  C:\Windows\System\snaFZjg.exe
  2⤵
  PID:8792
- C:\Windows\System\UrkMEMV.exe
  C:\Windows\System\UrkMEMV.exe
  2⤵
  PID:8820
- C:\Windows\System\qWIyVhZ.exe
  C:\Windows\System\qWIyVhZ.exe
  2⤵
  PID:8848
- C:\Windows\System\bSduloV.exe
  C:\Windows\System\bSduloV.exe
  2⤵
  PID:8876
- C:\Windows\System\AOtwIst.exe
  C:\Windows\System\AOtwIst.exe
  2⤵
  PID:8904
- C:\Windows\System\KkHVTfw.exe
  C:\Windows\System\KkHVTfw.exe
  2⤵
  PID:8932
- C:\Windows\System\BgySxKc.exe
  C:\Windows\System\BgySxKc.exe
  2⤵
  PID:8960
- C:\Windows\System\ovvUMac.exe
  C:\Windows\System\ovvUMac.exe
  2⤵
  PID:8976
- C:\Windows\System\LHMjygO.exe
  C:\Windows\System\LHMjygO.exe
  2⤵
  PID:9004
- C:\Windows\System\QdygTeG.exe
  C:\Windows\System\QdygTeG.exe
  2⤵
  PID:9028
- C:\Windows\System\entbZet.exe
  C:\Windows\System\entbZet.exe
  2⤵
  PID:9072
- C:\Windows\System\NQsFHae.exe
  C:\Windows\System\NQsFHae.exe
  2⤵
  PID:9096
- C:\Windows\System\WXOjTCc.exe
  C:\Windows\System\WXOjTCc.exe
  2⤵
  PID:9128
- C:\Windows\System\ikEuqPP.exe
  C:\Windows\System\ikEuqPP.exe
  2⤵
  PID:9156
- C:\Windows\System\oIXQQKu.exe
  C:\Windows\System\oIXQQKu.exe
  2⤵
  PID:9184
- C:\Windows\System\FWTiRky.exe
  C:\Windows\System\FWTiRky.exe
  2⤵
  PID:9212
- C:\Windows\System\FnnwEht.exe
  C:\Windows\System\FnnwEht.exe
  2⤵
  PID:8256
- C:\Windows\System\KodRqSj.exe
  C:\Windows\System\KodRqSj.exe
  2⤵
  PID:8268
- C:\Windows\System\wdPpOrz.exe
  C:\Windows\System\wdPpOrz.exe
  2⤵
  PID:8348
- C:\Windows\System\PvcufJY.exe
  C:\Windows\System\PvcufJY.exe
  2⤵
  PID:8380
- C:\Windows\System\RBslqhp.exe
  C:\Windows\System\RBslqhp.exe
  2⤵
  PID:8496
- C:\Windows\System\RswXIid.exe
  C:\Windows\System\RswXIid.exe
  2⤵
  PID:8552
- C:\Windows\System\hvBqOLz.exe
  C:\Windows\System\hvBqOLz.exe
  2⤵
  PID:8572
- C:\Windows\System\KzmccwX.exe
  C:\Windows\System\KzmccwX.exe
  2⤵
  PID:8668
- C:\Windows\System\GupcWzk.exe
  C:\Windows\System\GupcWzk.exe
  2⤵
  PID:8716
- C:\Windows\System\exNXHat.exe
  C:\Windows\System\exNXHat.exe
  2⤵
  PID:8784
- C:\Windows\System\IxkbHSf.exe
  C:\Windows\System\IxkbHSf.exe
  2⤵
  PID:8868
- C:\Windows\System\PnYHBeE.exe
  C:\Windows\System\PnYHBeE.exe
  2⤵
  PID:8944
- C:\Windows\System\FrRvIOW.exe
  C:\Windows\System\FrRvIOW.exe
  2⤵
  PID:8992
- C:\Windows\System\VelHxSE.exe
  C:\Windows\System\VelHxSE.exe
  2⤵
  PID:9024
- C:\Windows\System\hkmiOyr.exe
  C:\Windows\System\hkmiOyr.exe
  2⤵
  PID:9148
- C:\Windows\System\XZoZWEq.exe
  C:\Windows\System\XZoZWEq.exe
  2⤵
  PID:9168
- C:\Windows\System\tSYfWLl.exe
  C:\Windows\System\tSYfWLl.exe
  2⤵
  PID:8200
- C:\Windows\System\fWFRRjs.exe
  C:\Windows\System\fWFRRjs.exe
  2⤵
  PID:8432
- C:\Windows\System\GERALlV.exe
  C:\Windows\System\GERALlV.exe
  2⤵
  PID:8520
- C:\Windows\System\VQjbJmX.exe
  C:\Windows\System\VQjbJmX.exe
  2⤵
  PID:8680
- C:\Windows\System\QLHWuDa.exe
  C:\Windows\System\QLHWuDa.exe
  2⤵
  PID:8900
- C:\Windows\System\eVUzGAt.exe
  C:\Windows\System\eVUzGAt.exe
  2⤵
  PID:9048
- C:\Windows\System\FKwBJmG.exe
  C:\Windows\System\FKwBJmG.exe
  2⤵
  PID:9208
- C:\Windows\System\NPFrORx.exe
  C:\Windows\System\NPFrORx.exe
  2⤵
  PID:8464
- C:\Windows\System\YoNGTov.exe
  C:\Windows\System\YoNGTov.exe
  2⤵
  PID:8844
- C:\Windows\System\zGuJpzJ.exe
  C:\Windows\System\zGuJpzJ.exe
  2⤵
  PID:9144
- C:\Windows\System\DutPXVs.exe
  C:\Windows\System\DutPXVs.exe
  2⤵
  PID:8328
- C:\Windows\System\DGxsYBl.exe
  C:\Windows\System\DGxsYBl.exe
  2⤵
  PID:8888
- C:\Windows\System\onhIRNg.exe
  C:\Windows\System\onhIRNg.exe
  2⤵
  PID:9240
- C:\Windows\System\akJfACc.exe
  C:\Windows\System\akJfACc.exe
  2⤵
  PID:9280
- C:\Windows\System\wcxhMRI.exe
  C:\Windows\System\wcxhMRI.exe
  2⤵
  PID:9308
- C:\Windows\System\eZGFhkl.exe
  C:\Windows\System\eZGFhkl.exe
  2⤵
  PID:9340
- C:\Windows\System\sgUQIPm.exe
  C:\Windows\System\sgUQIPm.exe
  2⤵
  PID:9368
- C:\Windows\System\PWzmqor.exe
  C:\Windows\System\PWzmqor.exe
  2⤵
  PID:9384
- C:\Windows\System\PGKatHh.exe
  C:\Windows\System\PGKatHh.exe
  2⤵
  PID:9424
- C:\Windows\System\WOstbhl.exe
  C:\Windows\System\WOstbhl.exe
  2⤵
  PID:9452
- C:\Windows\System\uQEmjKc.exe
  C:\Windows\System\uQEmjKc.exe
  2⤵
  PID:9472
- C:\Windows\System\ZIjAIsH.exe
  C:\Windows\System\ZIjAIsH.exe
  2⤵
  PID:9496
- C:\Windows\System\CCEVsej.exe
  C:\Windows\System\CCEVsej.exe
  2⤵
  PID:9516
- C:\Windows\System\YOrJRdI.exe
  C:\Windows\System\YOrJRdI.exe
  2⤵
  PID:9540
- C:\Windows\System\VETcjVe.exe
  C:\Windows\System\VETcjVe.exe
  2⤵
  PID:9572
- C:\Windows\System\PPowJmb.exe
  C:\Windows\System\PPowJmb.exe
  2⤵
  PID:9596
- C:\Windows\System\pWSZvEV.exe
  C:\Windows\System\pWSZvEV.exe
  2⤵
  PID:9632
- C:\Windows\System\eVzHqOy.exe
  C:\Windows\System\eVzHqOy.exe
  2⤵
  PID:9668
- C:\Windows\System\gpCJVwb.exe
  C:\Windows\System\gpCJVwb.exe
  2⤵
  PID:9700
- C:\Windows\System\YjbRcbi.exe
  C:\Windows\System\YjbRcbi.exe
  2⤵
  PID:9724
- C:\Windows\System\QasAnVc.exe
  C:\Windows\System\QasAnVc.exe
  2⤵
  PID:9752
- C:\Windows\System\GaWVbig.exe
  C:\Windows\System\GaWVbig.exe
  2⤵
  PID:9772
- C:\Windows\System\EEvMxnw.exe
  C:\Windows\System\EEvMxnw.exe
  2⤵
  PID:9800
- C:\Windows\System\bhryzPp.exe
  C:\Windows\System\bhryzPp.exe
  2⤵
  PID:9824
- C:\Windows\System\tBdONaR.exe
  C:\Windows\System\tBdONaR.exe
  2⤵
  PID:9872
- C:\Windows\System\mpByOtu.exe
  C:\Windows\System\mpByOtu.exe
  2⤵
  PID:9904
- C:\Windows\System\wpYldGa.exe
  C:\Windows\System\wpYldGa.exe
  2⤵
  PID:9932
- C:\Windows\System\bAGHSdE.exe
  C:\Windows\System\bAGHSdE.exe
  2⤵
  PID:9960
- C:\Windows\System\kgxBrql.exe
  C:\Windows\System\kgxBrql.exe
  2⤵
  PID:9988
- C:\Windows\System\UYALDSj.exe
  C:\Windows\System\UYALDSj.exe
  2⤵
  PID:10004
- C:\Windows\System\lBfirzF.exe
  C:\Windows\System\lBfirzF.exe
  2⤵
  PID:10032
- C:\Windows\System\tOehSZC.exe
  C:\Windows\System\tOehSZC.exe
  2⤵
  PID:10060
- C:\Windows\System\sGKlVMo.exe
  C:\Windows\System\sGKlVMo.exe
  2⤵
  PID:10100
- C:\Windows\System\ZxDjGif.exe
  C:\Windows\System\ZxDjGif.exe
  2⤵
  PID:10116
- C:\Windows\System\XvNtnyR.exe
  C:\Windows\System\XvNtnyR.exe
  2⤵
  PID:10144
- C:\Windows\System\CSDlyBC.exe
  C:\Windows\System\CSDlyBC.exe
  2⤵
  PID:10172
- C:\Windows\System\vCQFXZC.exe
  C:\Windows\System\vCQFXZC.exe
  2⤵
  PID:10200
- C:\Windows\System\WxfUJSC.exe
  C:\Windows\System\WxfUJSC.exe
  2⤵
  PID:10228
- C:\Windows\System\dpUhocn.exe
  C:\Windows\System\dpUhocn.exe
  2⤵
  PID:9232
- C:\Windows\System\ZdpCkGc.exe
  C:\Windows\System\ZdpCkGc.exe
  2⤵
  PID:9304
- C:\Windows\System\bJiSarN.exe
  C:\Windows\System\bJiSarN.exe
  2⤵
  PID:9352
- C:\Windows\System\yuNKIVE.exe
  C:\Windows\System\yuNKIVE.exe
  2⤵
  PID:9420
- C:\Windows\System\FgdnYJw.exe
  C:\Windows\System\FgdnYJw.exe
  2⤵
  PID:9492
- C:\Windows\System\yIFmrkp.exe
  C:\Windows\System\yIFmrkp.exe
  2⤵
  PID:9564
- C:\Windows\System\zZlULrV.exe
  C:\Windows\System\zZlULrV.exe
  2⤵
  PID:9664
- C:\Windows\System\Suzcrzr.exe
  C:\Windows\System\Suzcrzr.exe
  2⤵
  PID:9720
- C:\Windows\System\CBwcGQk.exe
  C:\Windows\System\CBwcGQk.exe
  2⤵
  PID:9788
- C:\Windows\System\tHIdQJR.exe
  C:\Windows\System\tHIdQJR.exe
  2⤵
  PID:9860
- C:\Windows\System\beiHFlx.exe
  C:\Windows\System\beiHFlx.exe
  2⤵
  PID:9920
- C:\Windows\System\AxhmiGg.exe
  C:\Windows\System\AxhmiGg.exe
  2⤵
  PID:9996
- C:\Windows\System\WRtMYiv.exe
  C:\Windows\System\WRtMYiv.exe
  2⤵
  PID:10076
- C:\Windows\System\YMcHFiP.exe
  C:\Windows\System\YMcHFiP.exe
  2⤵
  PID:10108
- C:\Windows\System\opReqHc.exe
  C:\Windows\System\opReqHc.exe
  2⤵
  PID:10188
- C:\Windows\System\MSzNrKo.exe
  C:\Windows\System\MSzNrKo.exe
  2⤵
  PID:9224
- C:\Windows\System\XTAfJfC.exe
  C:\Windows\System\XTAfJfC.exe
  2⤵
  PID:9376
- C:\Windows\System\LnHTpCT.exe
  C:\Windows\System\LnHTpCT.exe
  2⤵
  PID:9480
- C:\Windows\System\CzOoaKq.exe
  C:\Windows\System\CzOoaKq.exe
  2⤵
  PID:9688
- C:\Windows\System\SFvRqFf.exe
  C:\Windows\System\SFvRqFf.exe
  2⤵
  PID:9796
- C:\Windows\System\mYAqWTA.exe
  C:\Windows\System\mYAqWTA.exe
  2⤵
  PID:9916
- C:\Windows\System\xtXVEzB.exe
  C:\Windows\System\xtXVEzB.exe
  2⤵
  PID:10024
- C:\Windows\System\AEGHYZv.exe
  C:\Windows\System\AEGHYZv.exe
  2⤵
  PID:10128
- C:\Windows\System\Cxuyvhh.exe
  C:\Windows\System\Cxuyvhh.exe
  2⤵
  PID:9380
- C:\Windows\System\xIWvAFB.exe
  C:\Windows\System\xIWvAFB.exe
  2⤵
  PID:9948
- C:\Windows\System\KUWzfkQ.exe
  C:\Windows\System\KUWzfkQ.exe
  2⤵
  PID:10220
- C:\Windows\System\wvAYcKi.exe
  C:\Windows\System\wvAYcKi.exe
  2⤵
  PID:9488
- C:\Windows\System\HybVJtO.exe
  C:\Windows\System\HybVJtO.exe
  2⤵
  PID:10264
- C:\Windows\System\eSbtGog.exe
  C:\Windows\System\eSbtGog.exe
  2⤵
  PID:10292
- C:\Windows\System\qRdBZXm.exe
  C:\Windows\System\qRdBZXm.exe
  2⤵
  PID:10340
- C:\Windows\System\AnPfLlI.exe
  C:\Windows\System\AnPfLlI.exe
  2⤵
  PID:10368
- C:\Windows\System\hONFmpY.exe
  C:\Windows\System\hONFmpY.exe
  2⤵
  PID:10396
- C:\Windows\System\pxJFvPw.exe
  C:\Windows\System\pxJFvPw.exe
  2⤵
  PID:10432
- C:\Windows\System\tVpnNEI.exe
  C:\Windows\System\tVpnNEI.exe
  2⤵
  PID:10452
- C:\Windows\System\HmUoTUD.exe
  C:\Windows\System\HmUoTUD.exe
  2⤵
  PID:10476
- C:\Windows\System\XyijwbS.exe
  C:\Windows\System\XyijwbS.exe
  2⤵
  PID:10516
- C:\Windows\System\sUyaMpY.exe
  C:\Windows\System\sUyaMpY.exe
  2⤵
  PID:10544
- C:\Windows\System\rFWcVSc.exe
  C:\Windows\System\rFWcVSc.exe
  2⤵
  PID:10568
- C:\Windows\System\Qgfizqg.exe
  C:\Windows\System\Qgfizqg.exe
  2⤵
  PID:10588
- C:\Windows\System\pIUVmVR.exe
  C:\Windows\System\pIUVmVR.exe
  2⤵
  PID:10620
- C:\Windows\System\FREHTpd.exe
  C:\Windows\System\FREHTpd.exe
  2⤵
  PID:10648
- C:\Windows\System\gjPYhDO.exe
  C:\Windows\System\gjPYhDO.exe
  2⤵
  PID:10676
- C:\Windows\System\KRigZCl.exe
  C:\Windows\System\KRigZCl.exe
  2⤵
  PID:10704
- C:\Windows\System\LGTCZNi.exe
  C:\Windows\System\LGTCZNi.exe
  2⤵
  PID:10732
- C:\Windows\System\xCUdCwI.exe
  C:\Windows\System\xCUdCwI.exe
  2⤵
  PID:10748
- C:\Windows\System\uIwPMHE.exe
  C:\Windows\System\uIwPMHE.exe
  2⤵
  PID:10788
- C:\Windows\System\BlYeGHH.exe
  C:\Windows\System\BlYeGHH.exe
  2⤵
  PID:10828
- C:\Windows\System\ryeAxcR.exe
  C:\Windows\System\ryeAxcR.exe
  2⤵
  PID:10856
- C:\Windows\System\OBHReQK.exe
  C:\Windows\System\OBHReQK.exe
  2⤵
  PID:10884
- C:\Windows\System\PBoXQjk.exe
  C:\Windows\System\PBoXQjk.exe
  2⤵
  PID:10908
- C:\Windows\System\TIXCBxX.exe
  C:\Windows\System\TIXCBxX.exe
  2⤵
  PID:10928
- C:\Windows\System\hPyyNWX.exe
  C:\Windows\System\hPyyNWX.exe
  2⤵
  PID:10968
- C:\Windows\System\FLRmwMy.exe
  C:\Windows\System\FLRmwMy.exe
  2⤵
  PID:10984
- C:\Windows\System\XHVWOtE.exe
  C:\Windows\System\XHVWOtE.exe
  2⤵
  PID:11008
- C:\Windows\System\HWCnYpd.exe
  C:\Windows\System\HWCnYpd.exe
  2⤵
  PID:11040
- C:\Windows\System\bKYaKnw.exe
  C:\Windows\System\bKYaKnw.exe
  2⤵
  PID:11060
- C:\Windows\System\mIJeIsi.exe
  C:\Windows\System\mIJeIsi.exe
  2⤵
  PID:11080
- C:\Windows\System\zUzxnIy.exe
  C:\Windows\System\zUzxnIy.exe
  2⤵
  PID:11136
- C:\Windows\System\YJrYjsF.exe
  C:\Windows\System\YJrYjsF.exe
  2⤵
  PID:11152
- C:\Windows\System\ZzkIhCj.exe
  C:\Windows\System\ZzkIhCj.exe
  2⤵
  PID:11180
- C:\Windows\System\FJeWiRl.exe
  C:\Windows\System\FJeWiRl.exe
  2⤵
  PID:11216
- C:\Windows\System\VAVOfZz.exe
  C:\Windows\System\VAVOfZz.exe
  2⤵
  PID:11236
- C:\Windows\System\RaftxHU.exe
  C:\Windows\System\RaftxHU.exe
  2⤵
  PID:9880
- C:\Windows\System\sQHfaOT.exe
  C:\Windows\System\sQHfaOT.exe
  2⤵
  PID:10280
- C:\Windows\System\XeJGpte.exe
  C:\Windows\System\XeJGpte.exe
  2⤵
  PID:10320
- C:\Windows\System\AcmCtnw.exe
  C:\Windows\System\AcmCtnw.exe
  2⤵
  PID:10404
- C:\Windows\System\oRYoaCg.exe
  C:\Windows\System\oRYoaCg.exe
  2⤵
  PID:10460
- C:\Windows\System\efolwgD.exe
  C:\Windows\System\efolwgD.exe
  2⤵
  PID:10532
- C:\Windows\System\uOHfMte.exe
  C:\Windows\System\uOHfMte.exe
  2⤵
  PID:10600
- C:\Windows\System\ihoKfcP.exe
  C:\Windows\System\ihoKfcP.exe
  2⤵
  PID:10668
- C:\Windows\System\GyqFbwW.exe
  C:\Windows\System\GyqFbwW.exe
  2⤵
  PID:10744
- C:\Windows\System\JtQsjEF.exe
  C:\Windows\System\JtQsjEF.exe
  2⤵
  PID:10808
- C:\Windows\System\ucuoDrN.exe
  C:\Windows\System\ucuoDrN.exe
  2⤵
  PID:10876
- C:\Windows\System\ZfxPokB.exe
  C:\Windows\System\ZfxPokB.exe
  2⤵
  PID:10924
- C:\Windows\System\UzdoTVZ.exe
  C:\Windows\System\UzdoTVZ.exe
  2⤵
  PID:11016
- C:\Windows\System\hYkLqlU.exe
  C:\Windows\System\hYkLqlU.exe
  2⤵
  PID:11028
- C:\Windows\System\npXsPWt.exe
  C:\Windows\System\npXsPWt.exe
  2⤵
  PID:11072
- C:\Windows\System\GObzBVY.exe
  C:\Windows\System\GObzBVY.exe
  2⤵
  PID:11172
- C:\Windows\System\rZRqAXV.exe
  C:\Windows\System\rZRqAXV.exe
  2⤵
  PID:11256
- C:\Windows\System\vIRCCnE.exe
  C:\Windows\System\vIRCCnE.exe
  2⤵
  PID:10304
- C:\Windows\System\HwwUwCE.exe
  C:\Windows\System\HwwUwCE.exe
  2⤵
  PID:10392
- C:\Windows\System\ruaYAKz.exe
  C:\Windows\System\ruaYAKz.exe
  2⤵
  PID:10608
- C:\Windows\System\GWTZJyA.exe
  C:\Windows\System\GWTZJyA.exe
  2⤵
  PID:10700
- C:\Windows\System\XXKKYdZ.exe
  C:\Windows\System\XXKKYdZ.exe
  2⤵
  PID:10904
- C:\Windows\System\JDSwcgu.exe
  C:\Windows\System\JDSwcgu.exe
  2⤵
  PID:11032
- C:\Windows\System\GwdRGMC.exe
  C:\Windows\System\GwdRGMC.exe
  2⤵
  PID:11192
- C:\Windows\System\wViVSJr.exe
  C:\Windows\System\wViVSJr.exe
  2⤵
  PID:10512
- C:\Windows\System\HzVuwsv.exe
  C:\Windows\System\HzVuwsv.exe
  2⤵
  PID:10664
- C:\Windows\System\NJCephp.exe
  C:\Windows\System\NJCephp.exe
  2⤵
  PID:10956
- C:\Windows\System\ecQRUZe.exe
  C:\Windows\System\ecQRUZe.exe
  2⤵
  PID:11276
- C:\Windows\System\YIeNqCe.exe
  C:\Windows\System\YIeNqCe.exe
  2⤵
  PID:11300
- C:\Windows\System\HUfCZhL.exe
  C:\Windows\System\HUfCZhL.exe
  2⤵
  PID:11320
- C:\Windows\System\BHTufUA.exe
  C:\Windows\System\BHTufUA.exe
  2⤵
  PID:11348
- C:\Windows\System\MRCUqLt.exe
  C:\Windows\System\MRCUqLt.exe
  2⤵
  PID:11364
- C:\Windows\System\iwTBwOl.exe
  C:\Windows\System\iwTBwOl.exe
  2⤵
  PID:11396
- C:\Windows\System\zrfuHcw.exe
  C:\Windows\System\zrfuHcw.exe
  2⤵
  PID:11432
- C:\Windows\System\MniUbVY.exe
  C:\Windows\System\MniUbVY.exe
  2⤵
  PID:11484
- C:\Windows\System\MLVnIBw.exe
  C:\Windows\System\MLVnIBw.exe
  2⤵
  PID:11512
- C:\Windows\System\iiSCykX.exe
  C:\Windows\System\iiSCykX.exe
  2⤵
  PID:11540
- C:\Windows\System\tMpIDdC.exe
  C:\Windows\System\tMpIDdC.exe
  2⤵
  PID:11556
- C:\Windows\System\gGhEHPE.exe
  C:\Windows\System\gGhEHPE.exe
  2⤵
  PID:11596
- C:\Windows\System\wRGRwPj.exe
  C:\Windows\System\wRGRwPj.exe
  2⤵
  PID:11616
- C:\Windows\System\LDXLYDK.exe
  C:\Windows\System\LDXLYDK.exe
  2⤵
  PID:11644
- C:\Windows\System\aPNuYvo.exe
  C:\Windows\System\aPNuYvo.exe
  2⤵
  PID:11672
- C:\Windows\System\ENkqszR.exe
  C:\Windows\System\ENkqszR.exe
  2⤵
  PID:11700
- C:\Windows\System\bsZPFwo.exe
  C:\Windows\System\bsZPFwo.exe
  2⤵
  PID:11728
- C:\Windows\System\XNSYEKU.exe
  C:\Windows\System\XNSYEKU.exe
  2⤵
  PID:11756
- C:\Windows\System\NktTjES.exe
  C:\Windows\System\NktTjES.exe
  2⤵
  PID:11772
- C:\Windows\System\rmFMSll.exe
  C:\Windows\System\rmFMSll.exe
  2⤵
  PID:11816
- C:\Windows\System\TUMeMBY.exe
  C:\Windows\System\TUMeMBY.exe
  2⤵
  PID:11840
- C:\Windows\System\uJtEMCN.exe
  C:\Windows\System\uJtEMCN.exe
  2⤵
  PID:11868
- C:\Windows\System\xFGPQwf.exe
  C:\Windows\System\xFGPQwf.exe
  2⤵
  PID:11896
- C:\Windows\System\XqOegol.exe
  C:\Windows\System\XqOegol.exe
  2⤵
  PID:11912
- C:\Windows\System\LrOcsaX.exe
  C:\Windows\System\LrOcsaX.exe
  2⤵
  PID:11932
- C:\Windows\System\jToYTmi.exe
  C:\Windows\System\jToYTmi.exe
  2⤵
  PID:11964
- C:\Windows\System\hqxUvAk.exe
  C:\Windows\System\hqxUvAk.exe
  2⤵
  PID:12020
- C:\Windows\System\fPsDemV.exe
  C:\Windows\System\fPsDemV.exe
  2⤵
  PID:12048
- C:\Windows\System\hPLmucL.exe
  C:\Windows\System\hPLmucL.exe
  2⤵
  PID:12076
- C:\Windows\System\HeZInMR.exe
  C:\Windows\System\HeZInMR.exe
  2⤵
  PID:12104
- C:\Windows\System\BMbryfa.exe
  C:\Windows\System\BMbryfa.exe
  2⤵
  PID:12132
- C:\Windows\System\dXkcGOw.exe
  C:\Windows\System\dXkcGOw.exe
  2⤵
  PID:12156
- C:\Windows\System\VBOsofm.exe
  C:\Windows\System\VBOsofm.exe
  2⤵
  PID:12180
- C:\Windows\System\fNTkRDM.exe
  C:\Windows\System\fNTkRDM.exe
  2⤵
  PID:12204
- C:\Windows\System\qkbcebY.exe
  C:\Windows\System\qkbcebY.exe
  2⤵
  PID:12224
- C:\Windows\System\INFKsZx.exe
  C:\Windows\System\INFKsZx.exe
  2⤵
  PID:12252
- C:\Windows\System\PTHvVkh.exe
  C:\Windows\System\PTHvVkh.exe
  2⤵
  PID:12280
- C:\Windows\System\xgnEaWH.exe
  C:\Windows\System\xgnEaWH.exe
  2⤵
  PID:9684
- C:\Windows\System\qTvHoNS.exe
  C:\Windows\System\qTvHoNS.exe
  2⤵
  PID:11332
- C:\Windows\System\McyNbcf.exe
  C:\Windows\System\McyNbcf.exe
  2⤵
  PID:10616
- C:\Windows\System\bcQtlfk.exe
  C:\Windows\System\bcQtlfk.exe
  2⤵
  PID:11392
- C:\Windows\System\gZSHkyZ.exe
  C:\Windows\System\gZSHkyZ.exe
  2⤵
  PID:11460
- C:\Windows\System\OOdjfMJ.exe
  C:\Windows\System\OOdjfMJ.exe
  2⤵
  PID:11528
- C:\Windows\System\kZwbndv.exe
  C:\Windows\System\kZwbndv.exe
  2⤵
  PID:11588
- C:\Windows\System\wybcHyH.exe
  C:\Windows\System\wybcHyH.exe
  2⤵
  PID:11692
- C:\Windows\System\RsdxSor.exe
  C:\Windows\System\RsdxSor.exe
  2⤵
  PID:11748
- C:\Windows\System\nsAerfp.exe
  C:\Windows\System\nsAerfp.exe
  2⤵
  PID:11832
- C:\Windows\System\kmBGssE.exe
  C:\Windows\System\kmBGssE.exe
  2⤵
  PID:11860
- C:\Windows\System\RBbwvDF.exe
  C:\Windows\System\RBbwvDF.exe
  2⤵
  PID:11908
- C:\Windows\System\HNTzilG.exe
  C:\Windows\System\HNTzilG.exe
  2⤵
  PID:12008
- C:\Windows\System\HWZoJYP.exe
  C:\Windows\System\HWZoJYP.exe
  2⤵
  PID:12120
- C:\Windows\System\JIajwvt.exe
  C:\Windows\System\JIajwvt.exe
  2⤵
  PID:12168
- C:\Windows\System\updZyqD.exe
  C:\Windows\System\updZyqD.exe
  2⤵
  PID:12260
- C:\Windows\System\OSPReMZ.exe
  C:\Windows\System\OSPReMZ.exe
  2⤵
  PID:11168
- C:\Windows\System\dhXcsyB.exe
  C:\Windows\System\dhXcsyB.exe
  2⤵
  PID:11416
- C:\Windows\System\BFbPMTI.exe
  C:\Windows\System\BFbPMTI.exe
  2⤵
  PID:11424
- C:\Windows\System\UgDoRNO.exe
  C:\Windows\System\UgDoRNO.exe
  2⤵
  PID:11552
- C:\Windows\System\zBInEch.exe
  C:\Windows\System\zBInEch.exe
  2⤵
  PID:11792
- C:\Windows\System\mwhytgs.exe
  C:\Windows\System\mwhytgs.exe
  2⤵
  PID:11984
- C:\Windows\System\hAJaWQr.exe
  C:\Windows\System\hAJaWQr.exe
  2⤵
  PID:12128
- C:\Windows\System\GQTGocZ.exe
  C:\Windows\System\GQTGocZ.exe
  2⤵
  PID:10488
- C:\Windows\System\pYHuSsf.exe
  C:\Windows\System\pYHuSsf.exe
  2⤵
  PID:11500
- C:\Windows\System\eFBzzNO.exe
  C:\Windows\System\eFBzzNO.exe
  2⤵
  PID:11884
- C:\Windows\System\YCyTgjy.exe
  C:\Windows\System\YCyTgjy.exe
  2⤵
  PID:11572
- C:\Windows\System\ziQeHOM.exe
  C:\Windows\System\ziQeHOM.exe
  2⤵
  PID:12032
- C:\Windows\System\SmcQovA.exe
  C:\Windows\System\SmcQovA.exe
  2⤵
  PID:12292
- C:\Windows\System\wgIGTGP.exe
  C:\Windows\System\wgIGTGP.exe
  2⤵
  PID:12316
- C:\Windows\System\UWluOnA.exe
  C:\Windows\System\UWluOnA.exe
  2⤵
  PID:12360
- C:\Windows\System\VOqvAkr.exe
  C:\Windows\System\VOqvAkr.exe
  2⤵
  PID:12388
- C:\Windows\System\HfgugPB.exe
  C:\Windows\System\HfgugPB.exe
  2⤵
  PID:12404
- C:\Windows\System\YYFZldW.exe
  C:\Windows\System\YYFZldW.exe
  2⤵
  PID:12436
- C:\Windows\System\SFuTPZe.exe
  C:\Windows\System\SFuTPZe.exe
  2⤵
  PID:12472
- C:\Windows\System\sXzlZxI.exe
  C:\Windows\System\sXzlZxI.exe
  2⤵
  PID:12496
- C:\Windows\System\DvEKWlN.exe
  C:\Windows\System\DvEKWlN.exe
  2⤵
  PID:12528
- C:\Windows\System\oMKAhef.exe
  C:\Windows\System\oMKAhef.exe
  2⤵
  PID:12556
- C:\Windows\System\MPuKBBL.exe
  C:\Windows\System\MPuKBBL.exe
  2⤵
  PID:12580
- C:\Windows\System\faxjOSv.exe
  C:\Windows\System\faxjOSv.exe
  2⤵
  PID:12596
- C:\Windows\System\XtoionG.exe
  C:\Windows\System\XtoionG.exe
  2⤵
  PID:12620
- C:\Windows\System\IiFZmvB.exe
  C:\Windows\System\IiFZmvB.exe
  2⤵
  PID:12640
- C:\Windows\System\tWceNra.exe
  C:\Windows\System\tWceNra.exe
  2⤵
  PID:12668
- C:\Windows\System\ZDIOvNd.exe
  C:\Windows\System\ZDIOvNd.exe
  2⤵
  PID:12744
- C:\Windows\System\WAuVjks.exe
  C:\Windows\System\WAuVjks.exe
  2⤵
  PID:12772
- C:\Windows\System\nplIPgt.exe
  C:\Windows\System\nplIPgt.exe
  2⤵
  PID:12788
- C:\Windows\System\SfzPRpu.exe
  C:\Windows\System\SfzPRpu.exe
  2⤵
  PID:12816
- C:\Windows\System\jxYqVxR.exe
  C:\Windows\System\jxYqVxR.exe
  2⤵
  PID:12844
- C:\Windows\System\skDIRBD.exe
  C:\Windows\System\skDIRBD.exe
  2⤵
  PID:12884
- C:\Windows\System\DISIblz.exe
  C:\Windows\System\DISIblz.exe
  2⤵
  PID:12912
- C:\Windows\System\vfyVeeG.exe
  C:\Windows\System\vfyVeeG.exe
  2⤵
  PID:12932
- C:\Windows\System\woWcvSi.exe
  C:\Windows\System\woWcvSi.exe
  2⤵
  PID:12956
- C:\Windows\System\qbwDAlv.exe
  C:\Windows\System\qbwDAlv.exe
  2⤵
  PID:12984
- C:\Windows\System\isOuwqQ.exe
  C:\Windows\System\isOuwqQ.exe
  2⤵
  PID:13004
- C:\Windows\System\RFpWTBo.exe
  C:\Windows\System\RFpWTBo.exe
  2⤵
  PID:13036
- C:\Windows\System\XrBMHEf.exe
  C:\Windows\System\XrBMHEf.exe
  2⤵
  PID:13080
- C:\Windows\System\AYxJIwl.exe
  C:\Windows\System\AYxJIwl.exe
  2⤵
  PID:13108
- C:\Windows\System\qyPgPhi.exe
  C:\Windows\System\qyPgPhi.exe
  2⤵
  PID:13132
- C:\Windows\System\PuaDNPo.exe
  C:\Windows\System\PuaDNPo.exe
  2⤵
  PID:13152
- C:\Windows\System\gMCyeai.exe
  C:\Windows\System\gMCyeai.exe
  2⤵
  PID:13192
- C:\Windows\System\ZsLJfcV.exe
  C:\Windows\System\ZsLJfcV.exe
  2⤵
  PID:13220
- C:\Windows\System\zgvnVLQ.exe
  C:\Windows\System\zgvnVLQ.exe
  2⤵
  PID:13248
- C:\Windows\System\wfCOYkI.exe
  C:\Windows\System\wfCOYkI.exe
  2⤵
  PID:13276
- C:\Windows\System\jVFBzUl.exe
  C:\Windows\System\jVFBzUl.exe
  2⤵
  PID:13304
- C:\Windows\System\hglvlVk.exe
  C:\Windows\System\hglvlVk.exe
  2⤵
  PID:11768
- C:\Windows\System\eCTQLlK.exe
  C:\Windows\System\eCTQLlK.exe
  2⤵
  PID:12344
- C:\Windows\System\DGmhmBN.exe
  C:\Windows\System\DGmhmBN.exe
  2⤵
  PID:12400
- C:\Windows\System\LzhsHEI.exe
  C:\Windows\System\LzhsHEI.exe
  2⤵
  PID:12424
- C:\Windows\System\furnCFf.exe
  C:\Windows\System\furnCFf.exe
  2⤵
  PID:12524
- C:\Windows\System\TPjtYcz.exe
  C:\Windows\System\TPjtYcz.exe
  2⤵
  PID:12612
- C:\Windows\System\anxGYmI.exe
  C:\Windows\System\anxGYmI.exe
  2⤵
  PID:12652
- C:\Windows\System\hOOzZyY.exe
  C:\Windows\System\hOOzZyY.exe
  2⤵
  PID:12684
- C:\Windows\System\RdhkvlA.exe
  C:\Windows\System\RdhkvlA.exe
  2⤵
  PID:12764
- C:\Windows\System\vbNNHIn.exe
  C:\Windows\System\vbNNHIn.exe
  2⤵
  PID:12800
- C:\Windows\System\YpHtRgA.exe
  C:\Windows\System\YpHtRgA.exe
  2⤵
  PID:12904
- C:\Windows\System\eqncYqs.exe
  C:\Windows\System\eqncYqs.exe
  2⤵
  PID:12940
- C:\Windows\System\qTgqqOJ.exe
  C:\Windows\System\qTgqqOJ.exe
  2⤵
  PID:12992
- C:\Windows\System\mVMgPQq.exe
  C:\Windows\System\mVMgPQq.exe
  2⤵
  PID:13096
- C:\Windows\System\wAHhAsq.exe
  C:\Windows\System\wAHhAsq.exe
  2⤵
  PID:13164
- C:\Windows\System\hnObDJP.exe
  C:\Windows\System\hnObDJP.exe
  2⤵
  PID:13236
- C:\Windows\System\HuyEuhR.exe
  C:\Windows\System\HuyEuhR.exe
  2⤵
  PID:13296
- C:\Windows\System\aqAXoOE.exe
  C:\Windows\System\aqAXoOE.exe
  2⤵
  PID:12376
- C:\Windows\System\GmSmNqm.exe
  C:\Windows\System\GmSmNqm.exe
  2⤵
  PID:12636
- C:\Windows\System\ZbOLVps.exe
  C:\Windows\System\ZbOLVps.exe
  2⤵
  PID:12704
- C:\Windows\System\kYsTEpT.exe
  C:\Windows\System\kYsTEpT.exe
  2⤵
  PID:12840
- C:\Windows\System\ZCDZNsu.exe
  C:\Windows\System\ZCDZNsu.exe
  2⤵
  PID:12952
- C:\Windows\System\ynOvCgA.exe
  C:\Windows\System\ynOvCgA.exe
  2⤵
  PID:13212
- C:\Windows\System\coZIcde.exe
  C:\Windows\System\coZIcde.exe
  2⤵
  PID:13264
- C:\Windows\System\OuSplAv.exe
  C:\Windows\System\OuSplAv.exe
  2⤵
  PID:12572
- C:\Windows\System\sbkaWMj.exe
  C:\Windows\System\sbkaWMj.exe
  2⤵
  PID:13028
- C:\Windows\System\FjWMKDI.exe
  C:\Windows\System\FjWMKDI.exe
  2⤵
  PID:12332
- C:\Windows\System\QqhRhjh.exe
  C:\Windows\System\QqhRhjh.exe
  2⤵
  PID:13064
- C:\Windows\System\fQSkrvr.exe
  C:\Windows\System\fQSkrvr.exe
  2⤵
  PID:12564
- C:\Windows\System\eSPUEyj.exe
  C:\Windows\System\eSPUEyj.exe
  2⤵
  PID:13340
- C:\Windows\System\QrkZTfT.exe
  C:\Windows\System\QrkZTfT.exe
  2⤵
  PID:13372
- C:\Windows\System\dmtsrMR.exe
  C:\Windows\System\dmtsrMR.exe
  2⤵
  PID:13392
- C:\Windows\System\KcHmuox.exe
  C:\Windows\System\KcHmuox.exe
  2⤵
  PID:13428
- C:\Windows\System\juuYMkN.exe
  C:\Windows\System\juuYMkN.exe
  2⤵
  PID:13448
- C:\Windows\System\TYqgzYB.exe
  C:\Windows\System\TYqgzYB.exe
  2⤵
  PID:13468
- C:\Windows\System\VlqPwGH.exe
  C:\Windows\System\VlqPwGH.exe
  2⤵
  PID:13516
- C:\Windows\System\DTNnyVk.exe
  C:\Windows\System\DTNnyVk.exe
  2⤵
  PID:13532
- C:\Windows\System\TCFvxwn.exe
  C:\Windows\System\TCFvxwn.exe
  2⤵
  PID:13572
- C:\Windows\System\YVVKagK.exe
  C:\Windows\System\YVVKagK.exe
  2⤵
  PID:13612
- C:\Windows\System\mfUDura.exe
  C:\Windows\System\mfUDura.exe
  2⤵
  PID:13636
- C:\Windows\System\ThsVvMz.exe
  C:\Windows\System\ThsVvMz.exe
  2⤵
  PID:13656
- C:\Windows\System\CGeMuyf.exe
  C:\Windows\System\CGeMuyf.exe
  2⤵
  PID:13692
- C:\Windows\System\xfIwbeB.exe
  C:\Windows\System\xfIwbeB.exe
  2⤵
  PID:13724
- C:\Windows\System\YtsrErL.exe
  C:\Windows\System\YtsrErL.exe
  2⤵
  PID:13748
- C:\Windows\System\LMmrPNO.exe
  C:\Windows\System\LMmrPNO.exe
  2⤵
  PID:13768
- C:\Windows\System\qvSPZYr.exe
  C:\Windows\System\qvSPZYr.exe
  2⤵
  PID:13808
- C:\Windows\System\cfaluKi.exe
  C:\Windows\System\cfaluKi.exe
  2⤵
  PID:13824
- C:\Windows\System\tFTonPx.exe
  C:\Windows\System\tFTonPx.exe
  2⤵
  PID:13876
- C:\Windows\System\bdbsoYR.exe
  C:\Windows\System\bdbsoYR.exe
  2⤵
  PID:13892
- C:\Windows\System\fvFWfNl.exe
  C:\Windows\System\fvFWfNl.exe
  2⤵
  PID:13908
- C:\Windows\System\CEFZNed.exe
  C:\Windows\System\CEFZNed.exe
  2⤵
  PID:13940
- C:\Windows\System\eTgOcKN.exe
  C:\Windows\System\eTgOcKN.exe
  2⤵
  PID:13976
- C:\Windows\System\EGAbLLa.exe
  C:\Windows\System\EGAbLLa.exe
  2⤵
  PID:13992
- C:\Windows\System\nYQnjkQ.exe
  C:\Windows\System\nYQnjkQ.exe
  2⤵
  PID:14016
- C:\Windows\System\wRTsebX.exe
  C:\Windows\System\wRTsebX.exe
  2⤵
  PID:14052
- C:\Windows\System\XfrSNbU.exe
  C:\Windows\System\XfrSNbU.exe
  2⤵
  PID:14076
- C:\Windows\System\GgOwUgc.exe
  C:\Windows\System\GgOwUgc.exe
  2⤵
  PID:14104
- C:\Windows\System\dgFbIJQ.exe
  C:\Windows\System\dgFbIJQ.exe
  2⤵
  PID:14132
- C:\Windows\System\LJHycGm.exe
  C:\Windows\System\LJHycGm.exe
  2⤵
  PID:14160
- C:\Windows\System\XqAQICh.exe
  C:\Windows\System\XqAQICh.exe
  2⤵
  PID:14180
- C:\Windows\System\BQmsauD.exe
  C:\Windows\System\BQmsauD.exe
  2⤵
  PID:14204
- C:\Windows\System\VVgVgob.exe
  C:\Windows\System\VVgVgob.exe
  2⤵
  PID:14228
- C:\Windows\System\szwMHUP.exe
  C:\Windows\System\szwMHUP.exe
  2⤵
  PID:14272
- C:\Windows\System\CwCVyXj.exe
  C:\Windows\System\CwCVyXj.exe
  2⤵
  PID:14312
- C:\Windows\System\eeVYLQC.exe
  C:\Windows\System\eeVYLQC.exe
  2⤵
  PID:14332
- C:\Windows\System\VOyeqvR.exe
  C:\Windows\System\VOyeqvR.exe
  2⤵
  PID:13332
- C:\Windows\System\dpCDhBp.exe
  C:\Windows\System\dpCDhBp.exe
  2⤵
  PID:13416
- C:\Windows\System\odbJgUv.exe
  C:\Windows\System\odbJgUv.exe
  2⤵
  PID:13464
- C:\Windows\System\syAckiX.exe
  C:\Windows\System\syAckiX.exe
  2⤵
  PID:13528
- C:\Windows\System\sqqFMsF.exe
  C:\Windows\System\sqqFMsF.exe
  2⤵
  PID:13604
- C:\Windows\System\JaNxAGJ.exe
  C:\Windows\System\JaNxAGJ.exe
  2⤵
  PID:13676
- C:\Windows\System\FzJfCQz.exe
  C:\Windows\System\FzJfCQz.exe
  2⤵
  PID:13740
- C:\Windows\System\lYLSjtI.exe
  C:\Windows\System\lYLSjtI.exe
  2⤵
  PID:13780
- C:\Windows\System\uOIVFMS.exe
  C:\Windows\System\uOIVFMS.exe
  2⤵
  PID:13872
- C:\Windows\System\zEERcBu.exe
  C:\Windows\System\zEERcBu.exe
  2⤵
  PID:13900
- C:\Windows\System\gJgPYGv.exe
  C:\Windows\System\gJgPYGv.exe
  2⤵
  PID:13984
- C:\Windows\System\rkOjPli.exe
  C:\Windows\System\rkOjPli.exe
  2⤵
  PID:14068
- C:\Windows\System\BHQsiDt.exe
  C:\Windows\System\BHQsiDt.exe
  2⤵
  PID:14144
- C:\Windows\System\fvROrRe.exe
  C:\Windows\System\fvROrRe.exe
  2⤵
  PID:14172
- C:\Windows\System\HiTXhWV.exe
  C:\Windows\System\HiTXhWV.exe
  2⤵
  PID:14260
- C:\Windows\System\QcrlcaE.exe
  C:\Windows\System\QcrlcaE.exe
  2⤵
  PID:14308
- C:\Windows\System\JwJwsdF.exe
  C:\Windows\System\JwJwsdF.exe
  2⤵
  PID:13324
- C:\Windows\System\SMNiSry.exe
  C:\Windows\System\SMNiSry.exe
  2⤵
  PID:13648
- C:\Windows\System\zxvxcQH.exe
  C:\Windows\System\zxvxcQH.exe
  2⤵
  PID:13848
- C:\Windows\System\zMwvZnG.exe
  C:\Windows\System\zMwvZnG.exe
  2⤵
  PID:14012
- C:\Windows\System\cHybAUI.exe
  C:\Windows\System\cHybAUI.exe
  2⤵
  PID:14048
- C:\Windows\System\zEZvUdh.exe
  C:\Windows\System\zEZvUdh.exe
  2⤵
  PID:14216
- C:\Windows\System\JUHbkpx.exe
  C:\Windows\System\JUHbkpx.exe
  2⤵
  PID:13360
- C:\Windows\System\fpSovcm.exe
  C:\Windows\System\fpSovcm.exe
  2⤵
  PID:13820
- C:\Windows\System\ACfVdBB.exe
  C:\Windows\System\ACfVdBB.exe
  2⤵
  PID:13424
- C:\Windows\System\pUpKOtB.exe
  C:\Windows\System\pUpKOtB.exe
  2⤵
  PID:14060
- C:\Windows\System\CgscShi.exe
  C:\Windows\System\CgscShi.exe
  2⤵
  PID:13584
- C:\Windows\System\rhrByJw.exe
  C:\Windows\System\rhrByJw.exe
  2⤵
  PID:14348
- C:\Windows\System\oXHKIfy.exe
  C:\Windows\System\oXHKIfy.exe
  2⤵
  PID:14388
- C:\Windows\System\MGtHPDi.exe
  C:\Windows\System\MGtHPDi.exe
  2⤵
  PID:14408
- C:\Windows\System\DPEWCJu.exe
  C:\Windows\System\DPEWCJu.exe
  2⤵
  PID:14428
- C:\Windows\System\tjHNftI.exe
  C:\Windows\System\tjHNftI.exe
  2⤵
  PID:14456
- C:\Windows\System\RPfZDae.exe
  C:\Windows\System\RPfZDae.exe
  2⤵
  PID:14496
- C:\Windows\System\OStOZwW.exe
  C:\Windows\System\OStOZwW.exe
  2⤵
  PID:14540
- C:\Windows\System\OarJfXH.exe
  C:\Windows\System\OarJfXH.exe
  2⤵
  PID:14556
- C:\Windows\System\qoidjXt.exe
  C:\Windows\System\qoidjXt.exe
  2⤵
  PID:14580
- C:\Windows\System\WfGhVKa.exe
  C:\Windows\System\WfGhVKa.exe
  2⤵
  PID:14624
- C:\Windows\System\GaZetid.exe
  C:\Windows\System\GaZetid.exe
  2⤵
  PID:14652
- C:\Windows\System\CUWfWrV.exe
  C:\Windows\System\CUWfWrV.exe
  2⤵
  PID:14668
- C:\Windows\System\gSsnERP.exe
  C:\Windows\System\gSsnERP.exe
  2⤵
  PID:14720
- C:\Windows\System\mdBhpyT.exe
  C:\Windows\System\mdBhpyT.exe
  2⤵
  PID:14736
- C:\Windows\System\jgbeSSK.exe
  C:\Windows\System\jgbeSSK.exe
  2⤵
  PID:14756
- C:\Windows\System\oZnUXUb.exe
  C:\Windows\System\oZnUXUb.exe
  2⤵
  PID:14780
- C:\Windows\System\MQdicbR.exe
  C:\Windows\System\MQdicbR.exe
  2⤵
  PID:14808
- C:\Windows\System\CglWubi.exe
  C:\Windows\System\CglWubi.exe
  2⤵
  PID:14848
- C:\Windows\System\MVLKevW.exe
  C:\Windows\System\MVLKevW.exe
  2⤵
  PID:14876
- C:\Windows\System\yGmCujR.exe
  C:\Windows\System\yGmCujR.exe
  2⤵
  PID:14896
- C:\Windows\System\eURbeHO.exe
  C:\Windows\System\eURbeHO.exe
  2⤵
  PID:14932
- C:\Windows\System\pbUdHDs.exe
  C:\Windows\System\pbUdHDs.exe
  2⤵
  PID:14952
- C:\Windows\System\PhHyQAR.exe
  C:\Windows\System\PhHyQAR.exe
  2⤵
  PID:14972
- C:\Windows\System\szzwkFn.exe
  C:\Windows\System\szzwkFn.exe
  2⤵
  PID:15020
- C:\Windows\System\EmsUKmO.exe
  C:\Windows\System\EmsUKmO.exe
  2⤵
  PID:15048
- C:\Windows\System\BtEiVGM.exe
  C:\Windows\System\BtEiVGM.exe
  2⤵
  PID:15076
- C:\Windows\System\PsmmoWS.exe
  C:\Windows\System\PsmmoWS.exe
  2⤵
  PID:15104
- C:\Windows\System\ljAyvgb.exe
  C:\Windows\System\ljAyvgb.exe
  2⤵
  PID:15132
- C:\Windows\System\cHyTboP.exe
  C:\Windows\System\cHyTboP.exe
  2⤵
  PID:15148
- C:\Windows\System\nTovKvb.exe
  C:\Windows\System\nTovKvb.exe
  2⤵
  PID:15188
- C:\Windows\System\OEsvMjZ.exe
  C:\Windows\System\OEsvMjZ.exe
  2⤵
  PID:15208
- C:\Windows\System\rZsQYVg.exe
  C:\Windows\System\rZsQYVg.exe
  2⤵
  PID:15232
- C:\Windows\System\MsNzSbv.exe
  C:\Windows\System\MsNzSbv.exe
  2⤵
  PID:15260
- C:\Windows\System\QMwThEb.exe
  C:\Windows\System\QMwThEb.exe
  2⤵
  PID:15284
- C:\Windows\System\VZbGtgS.exe
  C:\Windows\System\VZbGtgS.exe
  2⤵
  PID:15316
- C:\Windows\System\ALfVeXa.exe
  C:\Windows\System\ALfVeXa.exe
  2⤵
  PID:15336
- C:\Windows\System\fzSZbnT.exe
  C:\Windows\System\fzSZbnT.exe
  2⤵
  PID:14340
- C:\Windows\System\OeJBhEY.exe
  C:\Windows\System\OeJBhEY.exe
  2⤵
  PID:14440
- C:\Windows\System\ynltkfT.exe
  C:\Windows\System\ynltkfT.exe
  2⤵
  PID:14480
- C:\Windows\System\xYiCkJu.exe
  C:\Windows\System\xYiCkJu.exe
  2⤵
  PID:14572
- C:\Windows\System\czhrPhV.exe
  C:\Windows\System\czhrPhV.exe
  2⤵
  PID:14612
- C:\Windows\System\WILpfEL.exe
  C:\Windows\System\WILpfEL.exe
  2⤵
  PID:14692
- C:\Windows\System\NImSbbm.exe
  C:\Windows\System\NImSbbm.exe
  2⤵
  PID:14324
- C:\Windows\System\vNDgZkg.exe
  C:\Windows\System\vNDgZkg.exe
  2⤵
  PID:14800
- C:\Windows\System\rhnTpOY.exe
  C:\Windows\System\rhnTpOY.exe
  2⤵
  PID:14864
- C:\Windows\System\LmgSLBH.exe
  C:\Windows\System\LmgSLBH.exe
  2⤵
  PID:14940
- C:\Windows\System\NbVWrFp.exe
  C:\Windows\System\NbVWrFp.exe
  2⤵
  PID:14980
- C:\Windows\System\iaXiXSq.exe
  C:\Windows\System\iaXiXSq.exe
  2⤵
  PID:15016
- C:\Windows\System\iynhACg.exe
  C:\Windows\System\iynhACg.exe
  2⤵
  PID:15096
- C:\Windows\System\FXSmVvX.exe
  C:\Windows\System\FXSmVvX.exe
  2⤵
  PID:13792
- C:\Windows\System\HUBHUmd.exe
  C:\Windows\System\HUBHUmd.exe
  2⤵
  PID:15184
- C:\Windows\System\zRMkQel.exe
  C:\Windows\System\zRMkQel.exe
  2⤵
  PID:15220
- C:\Windows\System\VgGJlzv.exe
  C:\Windows\System\VgGJlzv.exe
  2⤵
  PID:15300
- C:\Windows\System\ftqllbL.exe
  C:\Windows\System\ftqllbL.exe
  2⤵
  PID:15332
- C:\Windows\System\MhfYMer.exe
  C:\Windows\System\MhfYMer.exe
  2⤵
  PID:14372
- C:\Windows\System\FJtnNUY.exe
  C:\Windows\System\FJtnNUY.exe
  2⤵
  PID:14568
- C:\Windows\System\QkMluHT.exe
  C:\Windows\System\QkMluHT.exe
  2⤵
  PID:14792
- C:\Windows\System\oiHNJcV.exe
  C:\Windows\System\oiHNJcV.exe
  2⤵
  PID:14744
- C:\Windows\System\NDeiKut.exe
  C:\Windows\System\NDeiKut.exe
  2⤵
  PID:14884
- C:\Windows\System\NwcYAXV.exe
  C:\Windows\System\NwcYAXV.exe
  2⤵
  PID:15180
- C:\Windows\System\WSlTfol.exe
  C:\Windows\System\WSlTfol.exe
  2⤵
  PID:15204
- C:\Windows\System\vgdJhwV.exe
  C:\Windows\System\vgdJhwV.exe
  2⤵
  PID:15144
- C:\Windows\System\DtImGdz.exe
  C:\Windows\System\DtImGdz.exe
  2⤵
  PID:14472
- C:\Windows\System\AAEaNne.exe
  C:\Windows\System\AAEaNne.exe
  2⤵
  PID:14424
- C:\Windows\System\ZXEfiZH.exe
  C:\Windows\System\ZXEfiZH.exe
  2⤵
  PID:15376
- C:\Windows\System\fZRvyYB.exe
  C:\Windows\System\fZRvyYB.exe
  2⤵
  PID:15404
- C:\Windows\System\JkLMGvs.exe
  C:\Windows\System\JkLMGvs.exe
  2⤵
  PID:15432
- C:\Windows\System\wEbGCdA.exe
  C:\Windows\System\wEbGCdA.exe
  2⤵
  PID:15460
- C:\Windows\System\ZpRbXOf.exe
  C:\Windows\System\ZpRbXOf.exe
  2⤵
  PID:15496
- C:\Windows\System\uZbvjeM.exe
  C:\Windows\System\uZbvjeM.exe
  2⤵
  PID:15520
- C:\Windows\System\BQlobfM.exe
  C:\Windows\System\BQlobfM.exe
  2⤵
  PID:15548
- C:\Windows\System\vExxfst.exe
  C:\Windows\System\vExxfst.exe
  2⤵
  PID:15572
- C:\Windows\System\nkOklXL.exe
  C:\Windows\System\nkOklXL.exe
  2⤵
  PID:15596
- C:\Windows\System\nlYCqYG.exe
  C:\Windows\System\nlYCqYG.exe
  2⤵
  PID:15620
- C:\Windows\System\ndjJXlX.exe
  C:\Windows\System\ndjJXlX.exe
  2⤵
  PID:15648
- C:\Windows\System\CFgJfQr.exe
  C:\Windows\System\CFgJfQr.exe
  2⤵
  PID:15684
- C:\Windows\System\uKLfEKT.exe
  C:\Windows\System\uKLfEKT.exe
  2⤵
  PID:15712
- C:\Windows\System\JQMaZFN.exe
  C:\Windows\System\JQMaZFN.exe
  2⤵
  PID:15740
- C:\Windows\System\MBKSZRY.exe
  C:\Windows\System\MBKSZRY.exe
  2⤵
  PID:15780
- C:\Windows\System\pHWUVWA.exe
  C:\Windows\System\pHWUVWA.exe
  2⤵
  PID:15804
- C:\Windows\System\ekPHhDa.exe
  C:\Windows\System\ekPHhDa.exe
  2⤵
  PID:15824
- C:\Windows\System\KnGUqvo.exe
  C:\Windows\System\KnGUqvo.exe
  2⤵
  PID:15852
- C:\Windows\System\IseqZsB.exe
  C:\Windows\System\IseqZsB.exe
  2⤵
  PID:15868
- C:\Windows\System\hjNqlSM.exe
  C:\Windows\System\hjNqlSM.exe
  2⤵
  PID:15884
- C:\Windows\System\eJlJmGX.exe
  C:\Windows\System\eJlJmGX.exe
  2⤵
  PID:15900
- C:\Windows\System\rDuZBTJ.exe
  C:\Windows\System\rDuZBTJ.exe
  2⤵
  PID:15932
- C:\Windows\System\mftQEgP.exe
  C:\Windows\System\mftQEgP.exe
  2⤵
  PID:15960
- C:\Windows\System\jmkBrxs.exe
  C:\Windows\System\jmkBrxs.exe
  2⤵
  PID:15988
- C:\Windows\System\DNHuGfQ.exe
  C:\Windows\System\DNHuGfQ.exe
  2⤵
  PID:16016
- C:\Windows\System\DppVRcD.exe
  C:\Windows\System\DppVRcD.exe
  2⤵
  PID:16048
- C:\Windows\System\DwAqphk.exe
  C:\Windows\System\DwAqphk.exe
  2⤵
  PID:16068
- C:\Windows\System\qfBTGLo.exe
  C:\Windows\System\qfBTGLo.exe
  2⤵
  PID:16100
- C:\Windows\System\eDnQRAW.exe
  C:\Windows\System\eDnQRAW.exe
  2⤵
  PID:16128
- C:\Windows\System\ntKsEDE.exe
  C:\Windows\System\ntKsEDE.exe
  2⤵
  PID:16152
- C:\Windows\System\YDdJAOG.exe
  C:\Windows\System\YDdJAOG.exe
  2⤵
  PID:16176
- C:\Windows\System\UmlcuRG.exe
  C:\Windows\System\UmlcuRG.exe
  2⤵
  PID:16192
- C:\Windows\System\hQgUXmI.exe
  C:\Windows\System\hQgUXmI.exe
  2⤵
  PID:16228
- C:\Windows\System\vmFsoNN.exe
  C:\Windows\System\vmFsoNN.exe
  2⤵
  PID:16256
- C:\Windows\System\eSUHpUp.exe
  C:\Windows\System\eSUHpUp.exe
  2⤵
  PID:16280
- C:\Windows\System\geIbKGX.exe
  C:\Windows\System\geIbKGX.exe
  2⤵
  PID:16320
- C:\Windows\System\xllFnqE.exe
  C:\Windows\System\xllFnqE.exe
  2⤵
  PID:16344
- C:\Windows\System\GJzudbu.exe
  C:\Windows\System\GJzudbu.exe
  2⤵
  PID:16372
- C:\Windows\System\uqAgAam.exe
  C:\Windows\System\uqAgAam.exe
  2⤵
  PID:15032
- C:\Windows\System\wpcSWih.exe
  C:\Windows\System\wpcSWih.exe
  2⤵
  PID:15388
- C:\Windows\System\HwdCvGc.exe
  C:\Windows\System\HwdCvGc.exe
  2⤵
  PID:15368
- C:\Windows\System\xLWIEYQ.exe
  C:\Windows\System\xLWIEYQ.exe
  2⤵
  PID:15532
- C:\Windows\System\FgVGQga.exe
  C:\Windows\System\FgVGQga.exe
  2⤵
  PID:15608
- C:\Windows\System\IytyIeG.exe
  C:\Windows\System\IytyIeG.exe
  2⤵
  PID:15632
- C:\Windows\System\ZYsQTnL.exe
  C:\Windows\System\ZYsQTnL.exe
  2⤵
  PID:15680
- C:\Windows\System\jBXdxhR.exe
  C:\Windows\System\jBXdxhR.exe
  2⤵
  PID:15564
- C:\Windows\System\ezydabP.exe
  C:\Windows\System\ezydabP.exe
  2⤵
  PID:15860
- C:\Windows\System\lsInIBo.exe
  C:\Windows\System\lsInIBo.exe
  2⤵
  PID:15720
- C:\Windows\System\cwXYBWc.exe
  C:\Windows\System\cwXYBWc.exe
  2⤵
  PID:15816
- C:\Windows\System\NRBbCzJ.exe
  C:\Windows\System\NRBbCzJ.exe
  2⤵
  PID:15980
- C:\Windows\System\IfDiADN.exe
  C:\Windows\System\IfDiADN.exe
  2⤵
  PID:16024
- C:\Windows\System\WEJeHDm.exe
  C:\Windows\System\WEJeHDm.exe
  2⤵
  PID:16040
- C:\Windows\System\fOSlpge.exe
  C:\Windows\System\fOSlpge.exe
  2⤵
  PID:16264
- C:\Windows\System\MbOoGeP.exe
  C:\Windows\System\MbOoGeP.exe
  2⤵
  PID:16268
- C:\Windows\System\VqxryXZ.exe
  C:\Windows\System\VqxryXZ.exe
  2⤵
  PID:16292
- C:\Windows\System\RbcPJUC.exe
  C:\Windows\System\RbcPJUC.exe
  2⤵
  PID:16224
- C:\Windows\System\VHzEcuG.exe
  C:\Windows\System\VHzEcuG.exe
  2⤵
  PID:16380
- C:\Windows\System\BLxZBMS.exe
  C:\Windows\System\BLxZBMS.exe
  2⤵
  PID:15644
- C:\Windows\System\HNoUGbZ.exe
  C:\Windows\System\HNoUGbZ.exe
  2⤵
  PID:4652
- C:\Windows\System\YQAdBzK.exe
  C:\Windows\System\YQAdBzK.exe
  2⤵
  PID:15948
- C:\Windows\System\lmMkKIf.exe
  C:\Windows\System\lmMkKIf.exe
  2⤵
  PID:15612
- C:\Windows\System\ZqXHiZf.exe
  C:\Windows\System\ZqXHiZf.exe
  2⤵
  PID:15768
- C:\Windows\System\MCnuPHa.exe
  C:\Windows\System\MCnuPHa.exe
  2⤵
  PID:15896
- C:\Windows\System\PPasXIL.exe
  C:\Windows\System\PPasXIL.exe
  2⤵
  PID:16204
- C:\Windows\System\GRkCrbD.exe
  C:\Windows\System\GRkCrbD.exe
  2⤵
  PID:16080
- C:\Windows\System\HGdYftA.exe
  C:\Windows\System\HGdYftA.exe
  2⤵
  PID:16404
- C:\Windows\System\XLjBovL.exe
  C:\Windows\System\XLjBovL.exe
  2⤵
  PID:16440
- C:\Windows\System\QRRGaXv.exe
  C:\Windows\System\QRRGaXv.exe
  2⤵
  PID:16480
- C:\Windows\System\tgBFCje.exe
  C:\Windows\System\tgBFCje.exe
  2⤵
  PID:16496
- C:\Windows\System\lPkGYfN.exe
  C:\Windows\System\lPkGYfN.exe
  2⤵
  PID:16512
- C:\Windows\System\dbfwpsw.exe
  C:\Windows\System\dbfwpsw.exe
  2⤵
  PID:16532
- C:\Windows\System\SYBArNE.exe
  C:\Windows\System\SYBArNE.exe
  2⤵
  PID:16548
- C:\Windows\System\jVqkDhA.exe
  C:\Windows\System\jVqkDhA.exe
  2⤵
  PID:16572
- C:\Windows\System\EOXqfGw.exe
  C:\Windows\System\EOXqfGw.exe
  2⤵
  PID:16592
- C:\Windows\System\mSHLMAF.exe
  C:\Windows\System\mSHLMAF.exe
  2⤵
  PID:16624
- C:\Windows\System\waOfsba.exe
  C:\Windows\System\waOfsba.exe
  2⤵
  PID:16648
- C:\Windows\System\pXtUtoc.exe
  C:\Windows\System\pXtUtoc.exe
  2⤵
  PID:16940
- C:\Windows\System\wqUUiMf.exe
  C:\Windows\System\wqUUiMf.exe
  2⤵
  PID:16968
- C:\Windows\System\bLFZDhX.exe
  C:\Windows\System\bLFZDhX.exe
  2⤵
  PID:16984
- C:\Windows\System\zznTgBH.exe
  C:\Windows\System\zznTgBH.exe
  2⤵
  PID:17084
- C:\Windows\System\EKNAigN.exe
  C:\Windows\System\EKNAigN.exe
  2⤵
  PID:17160

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:17336

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\AlzHMEW.exe

Filesize
1.7MB

MD5
30d89dd94a611f5f4b5bd466821a6edf

SHA1
0026227c59e2bef2725840671ec2a381c520f3a1

SHA256
f4dd7019acce7907136299833b178a96e01fa90c5be6199a8d6c09c0f0947ed8

SHA512
ba28794df9407dd83c311203274d1ecabc1afff7030b2aca33751097069854861fa2e2c3f02407f53a4f7f372b072215cdf493946e1076a9194d3a14d146b594

Download Submit
C:\Windows\System\DgLSzWK.exe

Filesize
1.7MB

MD5
d967174450b7754fdd345416ca6d1272

SHA1
8a9852e143682c94de4e0a3b2e0a770319e03c52

SHA256
85c3b9d6797aee1535d69248568c8d40e8d1ccc0293193c0e7e153e74ad69838

SHA512
51b3c349ce231d3f62bb06876a82d3e06f5c44c500164bc9cc4e84c0e10bed4e95ef58c0423ca00c7ce73a769ff0f33f4faf7eb23cb820990a1d11f76a12fc21

Download Submit
C:\Windows\System\ErXJHvG.exe

Filesize
1.7MB

MD5
2add23f8058e2258589a2a5e0c91cc4e

SHA1
d2a836f8317733ed72acfea5dea3bd56ca57079f

SHA256
9c542e79ef68b22e0698dffe493c4bdd33bdf5185814faf4bcb7ebeb327bd2cc

SHA512
da3f457794798d4f4d5a984b0842b68a3065604068eb2e96917a230447ff4c77c74b1a1b02a62f40de6a1840793824a0f9cdc231af973788bb94b3b8872c46f3

Download Submit
C:\Windows\System\IQADXDl.exe

Filesize
1.7MB

MD5
7fbc4613af55f1837c268f5cd5ed0bd7

SHA1
efc1d5fd1ec0639797ce711cdaf0f9c138729e22

SHA256
75a8469d3609400e4a019f66049ef156fc04aae9588872f67b36065ce701fed9

SHA512
092d9ebf1f290f410d44daadbb603be8c57e7d62ee1fc3364e88253df3ff3a78f38d38877a03ff4ad1c7c553a11e59f1e6b775013c1b483aa762454ee80fd168

Download Submit
C:\Windows\System\IUziQRk.exe

Filesize
1.7MB

MD5
347392611210a5c6d77416cdf6d11354

SHA1
5be587dd02e0330d53803515116549cdbf421e9c

SHA256
eac6fca8709014717e7c28d2f4882af59e8869d89464c13f5779a4263f7c67ac

SHA512
a339138e061ac3e6905be9e17988a34929af6db65abc926d87bb845910c4400779de1d460e1340da8830c23962fbd0e6867ae1217d356815f6aca6f4f8009b7b

Download Submit
C:\Windows\System\JEuElFU.exe

Filesize
1.7MB

MD5
5df5228aeb554f18fa0a81c12f739979

SHA1
01f95f8bd4539076bb27a08f14b7dafda814bae4

SHA256
76f4a343d0d0c8c968e02b23a21ea4298cf531a75502985ed8a736f66cd963b6

SHA512
4885473bc45f1d7a03bb0d4e8bccc2c1dbd312806c79cb9e473716ec65aa0efdf3dd9ef3c21d18279c2d6a052d0a7f8d3f8662fe083ed01a71b29b16a5a3c7b7

Download Submit
C:\Windows\System\JJWHiow.exe

Filesize
1.7MB

MD5
4028ad8429df838a28a5f81087bad943

SHA1
274504b6fa64e1d59b00794dcf4958a23c7155ca

SHA256
9d03858b79383b79670c0519826c6d685b42690dd861b5d104504fbda0f325d2

SHA512
5f3f92bc0e1517550bd7d690c1b465368d0b08123cb485d9fa6297be6276ad55208fd39b0fc000953de5a7d69650379ddec63c4d17554a37d0e9a04c0cf25496

Download Submit
C:\Windows\System\JJmULOd.exe

Filesize
1.7MB

MD5
f05f0a48c73c34d8f31a25eda6f3a997

SHA1
5ddfc7a933a068141a95aebc25e4e6b7000ccba6

SHA256
d77fbca887452aee88e70321ab15962f3ea5409d53f969c0e228f6a6db3e2d7c

SHA512
23f92da3a4df2b87893bd7e67d14499ffd0e194ddfa35c966f7a72255b96ff228c2d8203602f4e99b2ebeb192865f43488da0d776a5ec22380d2ca1064c78210

Download Submit
C:\Windows\System\NJaRXSY.exe

Filesize
1.7MB

MD5
51652b6978ced2793e3e911b65ed7cd0

SHA1
54a37511dbc4d6ca7d20ceb5e8f7cedf53deb84f

SHA256
d69c8563a580d583aa1a241de62b7c0bed96a7cbad60a00f8222a2cbdd13b0e9

SHA512
bcc60fcf9107cf76c5bff692cbadccfb1115e8d2c25b1a3ce73fe222c1c3ee7db2763182a32a46d2f43ba7ed0d8eb4572845dcbc11c94df80c377136fa3e4cd6

Download Submit
C:\Windows\System\SERPqaP.exe

Filesize
1.7MB

MD5
d5631fd7c3af80029a625ac1e9f6c988

SHA1
98803afe05fd6ca9b7ee76f238c7da251819f1c6

SHA256
765bd5d5b26bea9d246c0d63c8e63285111bbdfe217c3a123f1d4788659fd10f

SHA512
62a88358511091de93495a5fbefa6b35f34a0fcc32d51e2b3210b5fd6ffb9e88f7580dc91c360607af1222c11ae7f18bddec055b5f16eabb181932b788570b40

Download Submit
C:\Windows\System\SJebxcR.exe

Filesize
1.7MB

MD5
fd98449ea7559c772114fc58b347be2b

SHA1
6ace40cb3687e5d643ea5430a06599a521725661

SHA256
0ce8a2ed73a67a7a1bff95378f427e50435e3470e59a2ec1a95d3949b76b64f8

SHA512
f220f97f3e8f30303c987d24cc437dd56c392f92ce4cf75cdcfe2c6bd58027845bbe4190612173c7b5b68bc85de1d400e2bba055f1c081ee85f673a832fa0985

Download Submit
C:\Windows\System\UBkzuqI.exe

Filesize
1.7MB

MD5
13c437849aa1bae439ebd3e6aea6667b

SHA1
b9ef6a1916eeacba840b8029f43eb2b68b7b25ce

SHA256
e2bc5d844798df29a08242bdc2011ae2e214679af24d652e26a41898db2e5554

SHA512
678025211cc82fd22170ba7444956b9477e1e419b656a47a43e85d4160e0c9980b7446781781af8a4f7408f12583aaf5deb2618e435c00173d4e997cd579746b

Download Submit
C:\Windows\System\WjZlvQu.exe

Filesize
1.7MB

MD5
93d547bd75434489f10ab5dd06da02cf

SHA1
2c32a7c971fce1d71d8b9a713234aa0f56130f5e

SHA256
a683377975fe9ce25fb2b2d9c390c3c6e7067bde3741a54058880eac66757bed

SHA512
dc7fb9cafbb9684c7cdbc880ac33124a82272ffd24104cdc734d330fe7af2f80282cd4cd00c7340a2ed15bf5812f5b0a72b106261192821c48459b508d3118fa

Download Submit
C:\Windows\System\XGcoBIA.exe

Filesize
1.7MB

MD5
f9c4c44704a90122b41533ce2cf0acb8

SHA1
c85a45fd09c55eeca5ecff0ed2031e44b30ca55b

SHA256
d9967ee3e82c05f1f41c915778e9f29c0f2012f219febac2fd8f701ea8745bd2

SHA512
0a10cb9c07ec99c9796fc1a473e4dea7c7e12ac615eb580dd5bb04e974a08b45d31319d2adf35461c51f5861553d5bbcb75c8e568ee977ca5021217814dd0b34

Download Submit
C:\Windows\System\YYcOhBO.exe

Filesize
1.7MB

MD5
50477c6eb6ae621c6574a8d0be6c3df9

SHA1
02a4ba85f6b5f428a72945120fbdaf6d9ed1178d

SHA256
8cfd42e81e28645a28024006253760a1e1dc6971d70afc0a565ae4886b41ef38

SHA512
00f1f371614fc00ca7032b13eb872e5b3ddf6834caf5a219ab00741413541db421d2f6110109bb11fe195436c3b6f82bda864f29ad20c30065b646b93510d09f

Download Submit
C:\Windows\System\YfvcKwI.exe

Filesize
1.7MB

MD5
d09ee7c07eda07431d02172924b98f98

SHA1
fcc4c523579becd927043d3001be96cf8e863e8c

SHA256
52949f46c0ebda37b0241b51db3411632ee32fc65318fa3febc29ee939ec40c7

SHA512
dbb130cb33993f5f27a9a3ec4ce2dcaaa610dd76b0d77ea19948b3b37567d2d17cab74b32b9677b1c0a8f87aefb500c9aaf62f28b6627bc003087d9e100e22d0

Download Submit
C:\Windows\System\ZswGGOr.exe

Filesize
1.7MB

MD5
e1e87408b5368b05f38d80b9928bc3a5

SHA1
7698d1ed4793322b227b377c2ef209a12c8bfe72

SHA256
dd867e4b891435121c021f0cc0946c0f27dc3d147b059131b78d5b1105efc818

SHA512
60b927cb24e5c8fd99bb02793b5da6d80542565d86ea2631a3f4fc4a11680e46850950d791ec57bd6186af9946adfe69e34d1b6758b245a9e9dcd3017843fdef

Download Submit
C:\Windows\System\cFvADZg.exe

Filesize
1.7MB

MD5
582e19bd64524693d09a28adc1eb09c8

SHA1
5e38dbbae95163a6dab66312b7cf6613c1bfee07

SHA256
eb7fac09b75278b43804f91bd9d167135ae08e51bf667d5f329a5ff2102533ca

SHA512
24cef4f2cdbfb56f10497ebcc66321c666e1a198c12d6030703de36837fe7ade47b16a32003c2274d5525a2cccb6ef6097e0b0f1b2ee05c5d0625b26a7ea9cdd

Download Submit
C:\Windows\System\cTzaNqf.exe

Filesize
1.7MB

MD5
c220a84a4ab289019ac23e9375bc8ec9

SHA1
d01c85ee012fc611b8c2b4bfc79bf7dbca0d1f10

SHA256
6da6626e9620a04fe99e17f7fbeb576da8288e1c1e0b90b5425be3b44577c367

SHA512
319935e3b6fc036b2e75f3cd537897bd446535021f7798154786b09e016526f503be0c0278243b5b8135c810086bf217d3b7aa3fffeaadb569057c7b993be302

Download Submit
C:\Windows\System\ccJTvVg.exe

Filesize
1.7MB

MD5
8fdaac32de9a8383f9879ec3ceefa0f1

SHA1
0a77b3c6d05318970eccb6874b4d93fe6a2ffeff

SHA256
3a77990f57d626b9f8dc3686936155635aaacfc61e2ddf41f7cbf7b5a5bc71d4

SHA512
553a2b677ef072be980ad1961b444ee69ac5693319a5e3853bac729025613a53a0fac9c4316679e9511fca1d2bd19e78f3bd1bddae663f2b7f8de79da8fd6a23

Download Submit
C:\Windows\System\cobvZAz.exe

Filesize
1.7MB

MD5
49611372617da784a899502624aaee95

SHA1
c700b16a9101a50f382a3471a91fd247a9fc83bf

SHA256
060ee167b6860c9b73e41f87c39586ff41712165e3d7ee610125353750096cfb

SHA512
93d95f4bd011a3a188108e78944ca69b18d6340dfadc8e21890cc8859b854b13986efc3d0b1fc8716b56add1fc39a18dcbed71256bf4c409594557d170cf854e

Download Submit
C:\Windows\System\dbciVaZ.exe

Filesize
1.7MB

MD5
df6aa9923fd2a55de95f8b318de62081

SHA1
7ad93ba2c5335b8ee3c1a78ac068823db58d76a5

SHA256
f9979ae454a938db57ee7008b69123da6c35e9bd07448bc73451f1833ee277a4

SHA512
10ff7c4edaaea1a7251d6214be4a7bb2852582a68bbf6df470b7e5b5ed18ec7476b2182d9c59313556fc52bd3dfc341b92defb6066486fdeb32aa88df64a6386

Download Submit
C:\Windows\System\fNFHgIA.exe

Filesize
1.7MB

MD5
7d77c9b9a61dda8189ae9e76296ceffd

SHA1
393d9c221c11b86563ec585efeeeab3cba66a0e0

SHA256
8d5447b146692e73f09a79048ea5aa25ffc5f62d2ab04e54599849c20247ffa2

SHA512
aece0f03fb1402ba18b2e587f8391edb74b6e55768e6bf623a8c9188bcc265bcf65b211a0e6203c3d183cffcb567884fae242a67b462259a414a7bf4e3182759

Download Submit
C:\Windows\System\fqUsMED.exe

Filesize
1.7MB

MD5
6265c01847910657e6475a3d22e5b21d

SHA1
a28d460cb00f130702e3a806b562c891bf6170e0

SHA256
223f2530b9a4c31ed3d1a0072dcd856567a5eecaa4be8ae21c52e1b6e37ed3a5

SHA512
3f4f96ed3575471dc788ebdb12678e4934bec9de1e6f42d23ae917c408be2fe7fa29dc4e72c094d079bfc144fc375ec4ea3c71bb71f60480954a674a429e81b2

Download Submit
C:\Windows\System\furIFvM.exe

Filesize
1.7MB

MD5
6f3649d40fa03a8b9b4a1bffed90a9c1

SHA1
7d21f8ced476d93d14c473d3d2bda09c2eb828fe

SHA256
71fe2566f1c70c9064c88d28e7e555f16bdfa0c2805c9204e5973b796bd4fe03

SHA512
649e7636c813ffb61d4ea6513d34d606fbed8242137232c8ac3501cc6f4d7bbf75fd310c985a92d15507fac1fb4486193d10140a6efd949caf6e7fc9e912f3b1

Download Submit
C:\Windows\System\gcIWDfG.exe

Filesize
1.7MB

MD5
9a6109aa26d7675ab6115456d8568ec2

SHA1
5b4df9eb3b05a16a5e88ca4bfc985de88a7f1a76

SHA256
946556ccc6ef630f649fd3b3aada3ce0c60c3e0bf2a8c4ac784b6993dc589561

SHA512
c9dfc9f138c73a8fb0bae7c32beb749aead60e49de7fabe8ed89c14b31ba2d020a32fe6adb8630391af3e573953d153b657216466398185e6b520dd61651129e

Download Submit
C:\Windows\System\gpmrsSQ.exe

Filesize
1.7MB

MD5
df253ca8e835fa4df9701e635b7c4019

SHA1
0875fdd0d073d81808597463805cb588f85a135c

SHA256
14033ae4e45a6dd3e90da8c76180629ffbdde51ed2866fe8d95c82d57a6c9e66

SHA512
fc5dbbd7c68a8874d7b731fef6d169a98c13d473ede94978285865a30839fb2528659b859af8557cb5645e05931713edc4c7bb8b1b1420ad9ca670fec36a7af6

Download Submit
C:\Windows\System\hLtGvpv.exe

Filesize
1.7MB

MD5
1a04f7c2caaa4b1ef25aac2844cc4877

SHA1
678a01774019317a6079787412efd18a522a698b

SHA256
7bdf6b65b0411cc20f6edcff5a8430af7824caae65922d8e7a560d68b6c594f0

SHA512
7ea86e64bf01dd74995607d5d6a2875b3d944f9f5553e9e379e3fa661fada34d365da3fcf229766201d5e90c25afcedeecd6c3e09fb02021a9b8fd2c53dff0e1

Download Submit
C:\Windows\System\kNjZRGw.exe

Filesize
1.7MB

MD5
4e1a52db3fb92df52921a66ef5219898

SHA1
0c9b3eb0a32708c6e073004b3864376b2ffc3b25

SHA256
cd0e03a7fe5b7c7a216dac9cc983c043288475427d87c102c4c3597f180bdcb4

SHA512
6a306124268865cacd1473ecd9c33773b0681794861aa8bf40edf112134ef3f82a532c8a9d6f678a0c3c3ce6edd19a260e19e34c93ba3f0ad5dda57b0ccf1dcb

Download Submit
C:\Windows\System\mAgfBWX.exe

Filesize
1.7MB

MD5
a1aeb1589ca056f4037315a4728edb91

SHA1
2068c8b1680457545eb33ba05d09d3eb14232c61

SHA256
21124d33e603501afc7133e243f30be528e922522c2784d997dd163c3ab78a99

SHA512
438047e94f1ac33399d013e506feea0e316a7de915d83c93be9585a3048e6593e9ed1b34711dcaf7441bb609e5506ba34be49034fe4fd3d68a6efae79624f7c9

Download Submit
C:\Windows\System\mlnYgqO.exe

Filesize
1.7MB

MD5
0f5ce1f06fa782cb5b989bca7b1cdcee

SHA1
39bd12ddd998ce60f4638ea3ee30f3ecbd53aa3c

SHA256
022b2f4fdca003254867541049f1c3e2fe0d7838b29662eb51ffe54d460e1063

SHA512
a6754d68e10608ccb61149daffece30156ad6e7b0dc0e58ef2abeaa7ebecc221927bb293408fbc38f42055f0dd874cc4ee1ee8466ba8f2197b34c0efde0afab0

Download Submit
C:\Windows\System\sRAyxzF.exe

Filesize
1.7MB

MD5
2652160f2fec5841d561f27a5fb0af11

SHA1
c8d89f05d0a0eec46ea69de15b727dfcbdb167dc

SHA256
0a6210b6cc8e8de5c2dae409628643b18b827e0a653acc0c47a59cf3fd36e936

SHA512
25a8611b820073b25b5fad4aecec7e439460878526777004f1e7c1e239fc43111f62cabb7b5abcbbfb2d09f958b3fbc0e335ed33e29fd28af7fd697245ae0270

Download Submit
C:\Windows\System\xehuQtR.exe

Filesize
1.7MB

MD5
dbd6804cee6c2d8025bdd54f616e4f78

SHA1
14539eb44c2deeb229344244548ac41f2237a97c

SHA256
37a3a32a009022c1aa2c93adec9baf9e687e9a834d4b36726781537c6c1dfd92

SHA512
6084a8744486efc2e74ff861ef86c71919be7e446709cdc2789c03a0b3c10c44b53e550d21a9514a53d4b890ca8a456a08654409e951dc74a2b1c0b58c1707f4

Download Submit
memory/3032-0-0x00000254E8110000-0x00000254E8120000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads