xmrig | 5df10dd4c78546aab1ae33588593b467dc9fb3a20a262a72b35c6473bdaff5fe

Analysis

max time kernel
124s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
23-12-2024 21:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5df10dd4c78546aab1ae33588593b467dc9fb3a20a262a72b35c6473bdaff5fe.exe
Size

1.8MB
MD5

992c2c4d313ff9159a277d30ae79f878
SHA1

ae12d8b3ef09814899bebb248d32071fb0adf891
SHA256

5df10dd4c78546aab1ae33588593b467dc9fb3a20a262a72b35c6473bdaff5fe
SHA512

7d0bc2d09664b0caf4153cfb5920d1538aaf9701899e3569adbbc7570c13eeffeab602a627b41d38f40f33d7f6d0f3af4b3f030df13fc0bc155ac59b4c24695e
SSDEEP

49152:GezaTF8FcNkNdfE0pZ9ozttwIRxj4c5yOBZnQmnVwYsG:GemTLkNdfE0pZyT

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 33 IoCs

miner

resource	yara_rule
behavioral2/files/0x000c000000023b1e-4.dat	xmrig
behavioral2/files/0x000a000000023b75-8.dat	xmrig
behavioral2/files/0x000b000000023b71-10.dat	xmrig
behavioral2/files/0x0031000000023b76-19.dat	xmrig
behavioral2/files/0x000a000000023b7a-43.dat	xmrig
behavioral2/files/0x000a000000023b7c-49.dat	xmrig
behavioral2/files/0x000a000000023b83-88.dat	xmrig
behavioral2/files/0x000a000000023b8a-119.dat	xmrig
behavioral2/files/0x000a000000023b8d-138.dat	xmrig
behavioral2/files/0x000a000000023b92-157.dat	xmrig
behavioral2/files/0x000a000000023b93-162.dat	xmrig
behavioral2/files/0x000a000000023b91-160.dat	xmrig
behavioral2/files/0x000a000000023b90-155.dat	xmrig
behavioral2/files/0x000a000000023b8f-148.dat	xmrig
behavioral2/files/0x000a000000023b8e-143.dat	xmrig
behavioral2/files/0x000a000000023b8c-133.dat	xmrig
behavioral2/files/0x000a000000023b8b-127.dat	xmrig
behavioral2/files/0x000a000000023b89-117.dat	xmrig
behavioral2/files/0x000a000000023b88-113.dat	xmrig
behavioral2/files/0x000a000000023b87-107.dat	xmrig
behavioral2/files/0x000a000000023b86-103.dat	xmrig
behavioral2/files/0x000a000000023b85-98.dat	xmrig
behavioral2/files/0x000a000000023b84-92.dat	xmrig
behavioral2/files/0x000a000000023b82-83.dat	xmrig
behavioral2/files/0x000a000000023b81-77.dat	xmrig
behavioral2/files/0x000a000000023b80-73.dat	xmrig
behavioral2/files/0x000a000000023b7f-67.dat	xmrig
behavioral2/files/0x000a000000023b7e-63.dat	xmrig
behavioral2/files/0x000a000000023b7d-57.dat	xmrig
behavioral2/files/0x000a000000023b7b-47.dat	xmrig
behavioral2/files/0x000a000000023b79-37.dat	xmrig
behavioral2/files/0x0031000000023b78-33.dat	xmrig
behavioral2/files/0x0031000000023b77-27.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
3344	QOmbuqI.exe
4768	yHXPKbp.exe
3924	GBTJfif.exe
4572	SRThzom.exe
1432	WUruewl.exe
1880	hYgWBMC.exe
3032	josogeP.exe
1436	VpwSfdO.exe
1232	QdIMocf.exe
1976	plDWrgl.exe
2956	istxImZ.exe
4440	pETBCKa.exe
628	eaKoNbI.exe
5076	NtSYSYr.exe
1816	LHQlhTn.exe
5036	tLJygQR.exe
640	hJxtyMM.exe
4052	akXZsDv.exe
1040	nHuzbYA.exe
3880	kEndhsA.exe
4392	bYicFpj.exe
464	QPMoUHG.exe
4372	uOUvkYT.exe
1528	kNOPXPR.exe
4988	MjpfYkc.exe
4276	XLHVlwg.exe
2776	BobPXPj.exe
4072	RNWFGUP.exe
1252	gdWdWvZ.exe
3496	BohPlWT.exe
1700	VxcESrR.exe
1508	tSGiPNx.exe
2948	gPhsYUB.exe
624	WmWdqkP.exe
3908	PywItvu.exe
3904	KWIjaNt.exe
540	ESGDwUB.exe
4556	HIouKSk.exe
1560	RjeIPMg.exe
2236	xFAJmop.exe
3224	GDicEYg.exe
224	bteZMRG.exe
4540	NLYjyKB.exe
4288	rbpNXmP.exe
1828	uiUKjhp.exe
4844	LJnXnsm.exe
2448	tumyMwW.exe
4332	kzYpcAy.exe
4528	DchXtpQ.exe
4488	AxpaSfe.exe
4316	QsgCoUK.exe
1824	buiZfKU.exe
2884	MZGXqjS.exe
4176	kiBtjdL.exe
3688	PRFNTVK.exe
1240	xZZcHlF.exe
1328	gvRPLoV.exe
3960	bIucoCP.exe
4836	PtapwYR.exe
1236	CHBVaao.exe
3440	yHrySMY.exe
5016	HBljOFk.exe
4480	bnTuzzU.exe
4632	nDyWbGF.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\kzKLwpS.exe	5df10dd4c78546aab1ae33588593b467dc9fb3a20a262a72b35c6473bdaff5fe.exe
File created	C:\Windows\System\DmVJVCC.exe	5df10dd4c78546aab1ae33588593b467dc9fb3a20a262a72b35c6473bdaff5fe.exe
File created	C:\Windows\System\MCBmXCG.exe	5df10dd4c78546aab1ae33588593b467dc9fb3a20a262a72b35c6473bdaff5fe.exe
File created	C:\Windows\System\ApAdJSK.exe	5df10dd4c78546aab1ae33588593b467dc9fb3a20a262a72b35c6473bdaff5fe.exe
File created	C:\Windows\System\NtSYSYr.exe	5df10dd4c78546aab1ae33588593b467dc9fb3a20a262a72b35c6473bdaff5fe.exe
File created	C:\Windows\System\eWCujAM.exe	5df10dd4c78546aab1ae33588593b467dc9fb3a20a262a72b35c6473bdaff5fe.exe
File created	C:\Windows\System\vXJYpBc.exe	5df10dd4c78546aab1ae33588593b467dc9fb3a20a262a72b35c6473bdaff5fe.exe
File created	C:\Windows\System\GgdRpEV.exe	5df10dd4c78546aab1ae33588593b467dc9fb3a20a262a72b35c6473bdaff5fe.exe
File created	C:\Windows\System\EkNVTjA.exe	5df10dd4c78546aab1ae33588593b467dc9fb3a20a262a72b35c6473bdaff5fe.exe
File created	C:\Windows\System\KlAcXrt.exe	5df10dd4c78546aab1ae33588593b467dc9fb3a20a262a72b35c6473bdaff5fe.exe
File created	C:\Windows\System\itYrUPi.exe	5df10dd4c78546aab1ae33588593b467dc9fb3a20a262a72b35c6473bdaff5fe.exe
File created	C:\Windows\System\tfwxvIT.exe	5df10dd4c78546aab1ae33588593b467dc9fb3a20a262a72b35c6473bdaff5fe.exe
File created	C:\Windows\System\eploqvN.exe	5df10dd4c78546aab1ae33588593b467dc9fb3a20a262a72b35c6473bdaff5fe.exe
File created	C:\Windows\System\QeaBEtK.exe	5df10dd4c78546aab1ae33588593b467dc9fb3a20a262a72b35c6473bdaff5fe.exe
File created	C:\Windows\System\lQPaBqe.exe	5df10dd4c78546aab1ae33588593b467dc9fb3a20a262a72b35c6473bdaff5fe.exe
File created	C:\Windows\System\zknKqed.exe	5df10dd4c78546aab1ae33588593b467dc9fb3a20a262a72b35c6473bdaff5fe.exe
File created	C:\Windows\System\KoVDymP.exe	5df10dd4c78546aab1ae33588593b467dc9fb3a20a262a72b35c6473bdaff5fe.exe
File created	C:\Windows\System\sSpmeBM.exe	5df10dd4c78546aab1ae33588593b467dc9fb3a20a262a72b35c6473bdaff5fe.exe
File created	C:\Windows\System\hYgWBMC.exe	5df10dd4c78546aab1ae33588593b467dc9fb3a20a262a72b35c6473bdaff5fe.exe
File created	C:\Windows\System\hVybtMO.exe	5df10dd4c78546aab1ae33588593b467dc9fb3a20a262a72b35c6473bdaff5fe.exe
File created	C:\Windows\System\mfJGazM.exe	5df10dd4c78546aab1ae33588593b467dc9fb3a20a262a72b35c6473bdaff5fe.exe
File created	C:\Windows\System\vkRWmpq.exe	5df10dd4c78546aab1ae33588593b467dc9fb3a20a262a72b35c6473bdaff5fe.exe
File created	C:\Windows\System\LrgAdrr.exe	5df10dd4c78546aab1ae33588593b467dc9fb3a20a262a72b35c6473bdaff5fe.exe
File created	C:\Windows\System\bwdLMpX.exe	5df10dd4c78546aab1ae33588593b467dc9fb3a20a262a72b35c6473bdaff5fe.exe
File created	C:\Windows\System\YiNRiJN.exe	5df10dd4c78546aab1ae33588593b467dc9fb3a20a262a72b35c6473bdaff5fe.exe
File created	C:\Windows\System\dpCYGMG.exe	5df10dd4c78546aab1ae33588593b467dc9fb3a20a262a72b35c6473bdaff5fe.exe
File created	C:\Windows\System\JWuyscF.exe	5df10dd4c78546aab1ae33588593b467dc9fb3a20a262a72b35c6473bdaff5fe.exe
File created	C:\Windows\System\eRTvTmB.exe	5df10dd4c78546aab1ae33588593b467dc9fb3a20a262a72b35c6473bdaff5fe.exe
File created	C:\Windows\System\yivqNfh.exe	5df10dd4c78546aab1ae33588593b467dc9fb3a20a262a72b35c6473bdaff5fe.exe
File created	C:\Windows\System\GcOWhcp.exe	5df10dd4c78546aab1ae33588593b467dc9fb3a20a262a72b35c6473bdaff5fe.exe
File created	C:\Windows\System\MlmiZvG.exe	5df10dd4c78546aab1ae33588593b467dc9fb3a20a262a72b35c6473bdaff5fe.exe
File created	C:\Windows\System\cjNMXSl.exe	5df10dd4c78546aab1ae33588593b467dc9fb3a20a262a72b35c6473bdaff5fe.exe
File created	C:\Windows\System\tLJygQR.exe	5df10dd4c78546aab1ae33588593b467dc9fb3a20a262a72b35c6473bdaff5fe.exe
File created	C:\Windows\System\rUCVxZH.exe	5df10dd4c78546aab1ae33588593b467dc9fb3a20a262a72b35c6473bdaff5fe.exe
File created	C:\Windows\System\BTiEIDr.exe	5df10dd4c78546aab1ae33588593b467dc9fb3a20a262a72b35c6473bdaff5fe.exe
File created	C:\Windows\System\EJhKuqv.exe	5df10dd4c78546aab1ae33588593b467dc9fb3a20a262a72b35c6473bdaff5fe.exe
File created	C:\Windows\System\PGufyIO.exe	5df10dd4c78546aab1ae33588593b467dc9fb3a20a262a72b35c6473bdaff5fe.exe
File created	C:\Windows\System\VxCyRgv.exe	5df10dd4c78546aab1ae33588593b467dc9fb3a20a262a72b35c6473bdaff5fe.exe
File created	C:\Windows\System\aOwEwbF.exe	5df10dd4c78546aab1ae33588593b467dc9fb3a20a262a72b35c6473bdaff5fe.exe
File created	C:\Windows\System\hCBDoQb.exe	5df10dd4c78546aab1ae33588593b467dc9fb3a20a262a72b35c6473bdaff5fe.exe
File created	C:\Windows\System\CGnCCRI.exe	5df10dd4c78546aab1ae33588593b467dc9fb3a20a262a72b35c6473bdaff5fe.exe
File created	C:\Windows\System\ozUNVCW.exe	5df10dd4c78546aab1ae33588593b467dc9fb3a20a262a72b35c6473bdaff5fe.exe
File created	C:\Windows\System\mmnBALz.exe	5df10dd4c78546aab1ae33588593b467dc9fb3a20a262a72b35c6473bdaff5fe.exe
File created	C:\Windows\System\WFZtJDO.exe	5df10dd4c78546aab1ae33588593b467dc9fb3a20a262a72b35c6473bdaff5fe.exe
File created	C:\Windows\System\jnUGSaC.exe	5df10dd4c78546aab1ae33588593b467dc9fb3a20a262a72b35c6473bdaff5fe.exe
File created	C:\Windows\System\NwIfIMT.exe	5df10dd4c78546aab1ae33588593b467dc9fb3a20a262a72b35c6473bdaff5fe.exe
File created	C:\Windows\System\JwhMMJr.exe	5df10dd4c78546aab1ae33588593b467dc9fb3a20a262a72b35c6473bdaff5fe.exe
File created	C:\Windows\System\PyRtxMy.exe	5df10dd4c78546aab1ae33588593b467dc9fb3a20a262a72b35c6473bdaff5fe.exe
File created	C:\Windows\System\rBjZfno.exe	5df10dd4c78546aab1ae33588593b467dc9fb3a20a262a72b35c6473bdaff5fe.exe
File created	C:\Windows\System\ZWcRZkD.exe	5df10dd4c78546aab1ae33588593b467dc9fb3a20a262a72b35c6473bdaff5fe.exe
File created	C:\Windows\System\MfHZIeM.exe	5df10dd4c78546aab1ae33588593b467dc9fb3a20a262a72b35c6473bdaff5fe.exe
File created	C:\Windows\System\QHxvwyk.exe	5df10dd4c78546aab1ae33588593b467dc9fb3a20a262a72b35c6473bdaff5fe.exe
File created	C:\Windows\System\ukNKnMS.exe	5df10dd4c78546aab1ae33588593b467dc9fb3a20a262a72b35c6473bdaff5fe.exe
File created	C:\Windows\System\FuFOBtN.exe	5df10dd4c78546aab1ae33588593b467dc9fb3a20a262a72b35c6473bdaff5fe.exe
File created	C:\Windows\System\yNqXFuK.exe	5df10dd4c78546aab1ae33588593b467dc9fb3a20a262a72b35c6473bdaff5fe.exe
File created	C:\Windows\System\WKZlVlX.exe	5df10dd4c78546aab1ae33588593b467dc9fb3a20a262a72b35c6473bdaff5fe.exe
File created	C:\Windows\System\TATdbSM.exe	5df10dd4c78546aab1ae33588593b467dc9fb3a20a262a72b35c6473bdaff5fe.exe
File created	C:\Windows\System\dACNArg.exe	5df10dd4c78546aab1ae33588593b467dc9fb3a20a262a72b35c6473bdaff5fe.exe
File created	C:\Windows\System\tGNGHMP.exe	5df10dd4c78546aab1ae33588593b467dc9fb3a20a262a72b35c6473bdaff5fe.exe
File created	C:\Windows\System\OsJgpSY.exe	5df10dd4c78546aab1ae33588593b467dc9fb3a20a262a72b35c6473bdaff5fe.exe
File created	C:\Windows\System\YDeaFAJ.exe	5df10dd4c78546aab1ae33588593b467dc9fb3a20a262a72b35c6473bdaff5fe.exe
File created	C:\Windows\System\CjWyHYT.exe	5df10dd4c78546aab1ae33588593b467dc9fb3a20a262a72b35c6473bdaff5fe.exe
File created	C:\Windows\System\seqXhVg.exe	5df10dd4c78546aab1ae33588593b467dc9fb3a20a262a72b35c6473bdaff5fe.exe
File created	C:\Windows\System\wPZQoKb.exe	5df10dd4c78546aab1ae33588593b467dc9fb3a20a262a72b35c6473bdaff5fe.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	16648	dwm.exe
Token: SeChangeNotifyPrivilege	16648	dwm.exe
Token: 33	16648	dwm.exe
Token: SeIncBasePriorityPrivilege	16648	dwm.exe
Token: SeShutdownPrivilege	16648	dwm.exe
Token: SeCreatePagefilePrivilege	16648	dwm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2784 wrote to memory of 3344	2784	5df10dd4c78546aab1ae33588593b467dc9fb3a20a262a72b35c6473bdaff5fe.exe	84
PID 2784 wrote to memory of 3344	2784	5df10dd4c78546aab1ae33588593b467dc9fb3a20a262a72b35c6473bdaff5fe.exe	84
PID 2784 wrote to memory of 4768	2784	5df10dd4c78546aab1ae33588593b467dc9fb3a20a262a72b35c6473bdaff5fe.exe	85
PID 2784 wrote to memory of 4768	2784	5df10dd4c78546aab1ae33588593b467dc9fb3a20a262a72b35c6473bdaff5fe.exe	85
PID 2784 wrote to memory of 3924	2784	5df10dd4c78546aab1ae33588593b467dc9fb3a20a262a72b35c6473bdaff5fe.exe	86
PID 2784 wrote to memory of 3924	2784	5df10dd4c78546aab1ae33588593b467dc9fb3a20a262a72b35c6473bdaff5fe.exe	86
PID 2784 wrote to memory of 4572	2784	5df10dd4c78546aab1ae33588593b467dc9fb3a20a262a72b35c6473bdaff5fe.exe	87
PID 2784 wrote to memory of 4572	2784	5df10dd4c78546aab1ae33588593b467dc9fb3a20a262a72b35c6473bdaff5fe.exe	87
PID 2784 wrote to memory of 1432	2784	5df10dd4c78546aab1ae33588593b467dc9fb3a20a262a72b35c6473bdaff5fe.exe	88
PID 2784 wrote to memory of 1432	2784	5df10dd4c78546aab1ae33588593b467dc9fb3a20a262a72b35c6473bdaff5fe.exe	88
PID 2784 wrote to memory of 1880	2784	5df10dd4c78546aab1ae33588593b467dc9fb3a20a262a72b35c6473bdaff5fe.exe	89
PID 2784 wrote to memory of 1880	2784	5df10dd4c78546aab1ae33588593b467dc9fb3a20a262a72b35c6473bdaff5fe.exe	89
PID 2784 wrote to memory of 3032	2784	5df10dd4c78546aab1ae33588593b467dc9fb3a20a262a72b35c6473bdaff5fe.exe	90
PID 2784 wrote to memory of 3032	2784	5df10dd4c78546aab1ae33588593b467dc9fb3a20a262a72b35c6473bdaff5fe.exe	90
PID 2784 wrote to memory of 1436	2784	5df10dd4c78546aab1ae33588593b467dc9fb3a20a262a72b35c6473bdaff5fe.exe	91
PID 2784 wrote to memory of 1436	2784	5df10dd4c78546aab1ae33588593b467dc9fb3a20a262a72b35c6473bdaff5fe.exe	91
PID 2784 wrote to memory of 1232	2784	5df10dd4c78546aab1ae33588593b467dc9fb3a20a262a72b35c6473bdaff5fe.exe	92
PID 2784 wrote to memory of 1232	2784	5df10dd4c78546aab1ae33588593b467dc9fb3a20a262a72b35c6473bdaff5fe.exe	92
PID 2784 wrote to memory of 1976	2784	5df10dd4c78546aab1ae33588593b467dc9fb3a20a262a72b35c6473bdaff5fe.exe	93
PID 2784 wrote to memory of 1976	2784	5df10dd4c78546aab1ae33588593b467dc9fb3a20a262a72b35c6473bdaff5fe.exe	93
PID 2784 wrote to memory of 2956	2784	5df10dd4c78546aab1ae33588593b467dc9fb3a20a262a72b35c6473bdaff5fe.exe	94
PID 2784 wrote to memory of 2956	2784	5df10dd4c78546aab1ae33588593b467dc9fb3a20a262a72b35c6473bdaff5fe.exe	94
PID 2784 wrote to memory of 4440	2784	5df10dd4c78546aab1ae33588593b467dc9fb3a20a262a72b35c6473bdaff5fe.exe	95
PID 2784 wrote to memory of 4440	2784	5df10dd4c78546aab1ae33588593b467dc9fb3a20a262a72b35c6473bdaff5fe.exe	95
PID 2784 wrote to memory of 628	2784	5df10dd4c78546aab1ae33588593b467dc9fb3a20a262a72b35c6473bdaff5fe.exe	96
PID 2784 wrote to memory of 628	2784	5df10dd4c78546aab1ae33588593b467dc9fb3a20a262a72b35c6473bdaff5fe.exe	96
PID 2784 wrote to memory of 5076	2784	5df10dd4c78546aab1ae33588593b467dc9fb3a20a262a72b35c6473bdaff5fe.exe	97
PID 2784 wrote to memory of 5076	2784	5df10dd4c78546aab1ae33588593b467dc9fb3a20a262a72b35c6473bdaff5fe.exe	97
PID 2784 wrote to memory of 1816	2784	5df10dd4c78546aab1ae33588593b467dc9fb3a20a262a72b35c6473bdaff5fe.exe	98
PID 2784 wrote to memory of 1816	2784	5df10dd4c78546aab1ae33588593b467dc9fb3a20a262a72b35c6473bdaff5fe.exe	98
PID 2784 wrote to memory of 5036	2784	5df10dd4c78546aab1ae33588593b467dc9fb3a20a262a72b35c6473bdaff5fe.exe	99
PID 2784 wrote to memory of 5036	2784	5df10dd4c78546aab1ae33588593b467dc9fb3a20a262a72b35c6473bdaff5fe.exe	99
PID 2784 wrote to memory of 640	2784	5df10dd4c78546aab1ae33588593b467dc9fb3a20a262a72b35c6473bdaff5fe.exe	100
PID 2784 wrote to memory of 640	2784	5df10dd4c78546aab1ae33588593b467dc9fb3a20a262a72b35c6473bdaff5fe.exe	100
PID 2784 wrote to memory of 4052	2784	5df10dd4c78546aab1ae33588593b467dc9fb3a20a262a72b35c6473bdaff5fe.exe	101
PID 2784 wrote to memory of 4052	2784	5df10dd4c78546aab1ae33588593b467dc9fb3a20a262a72b35c6473bdaff5fe.exe	101
PID 2784 wrote to memory of 1040	2784	5df10dd4c78546aab1ae33588593b467dc9fb3a20a262a72b35c6473bdaff5fe.exe	102
PID 2784 wrote to memory of 1040	2784	5df10dd4c78546aab1ae33588593b467dc9fb3a20a262a72b35c6473bdaff5fe.exe	102
PID 2784 wrote to memory of 3880	2784	5df10dd4c78546aab1ae33588593b467dc9fb3a20a262a72b35c6473bdaff5fe.exe	103
PID 2784 wrote to memory of 3880	2784	5df10dd4c78546aab1ae33588593b467dc9fb3a20a262a72b35c6473bdaff5fe.exe	103
PID 2784 wrote to memory of 4392	2784	5df10dd4c78546aab1ae33588593b467dc9fb3a20a262a72b35c6473bdaff5fe.exe	104
PID 2784 wrote to memory of 4392	2784	5df10dd4c78546aab1ae33588593b467dc9fb3a20a262a72b35c6473bdaff5fe.exe	104
PID 2784 wrote to memory of 464	2784	5df10dd4c78546aab1ae33588593b467dc9fb3a20a262a72b35c6473bdaff5fe.exe	105
PID 2784 wrote to memory of 464	2784	5df10dd4c78546aab1ae33588593b467dc9fb3a20a262a72b35c6473bdaff5fe.exe	105
PID 2784 wrote to memory of 4372	2784	5df10dd4c78546aab1ae33588593b467dc9fb3a20a262a72b35c6473bdaff5fe.exe	106
PID 2784 wrote to memory of 4372	2784	5df10dd4c78546aab1ae33588593b467dc9fb3a20a262a72b35c6473bdaff5fe.exe	106
PID 2784 wrote to memory of 1528	2784	5df10dd4c78546aab1ae33588593b467dc9fb3a20a262a72b35c6473bdaff5fe.exe	107
PID 2784 wrote to memory of 1528	2784	5df10dd4c78546aab1ae33588593b467dc9fb3a20a262a72b35c6473bdaff5fe.exe	107
PID 2784 wrote to memory of 4988	2784	5df10dd4c78546aab1ae33588593b467dc9fb3a20a262a72b35c6473bdaff5fe.exe	108
PID 2784 wrote to memory of 4988	2784	5df10dd4c78546aab1ae33588593b467dc9fb3a20a262a72b35c6473bdaff5fe.exe	108
PID 2784 wrote to memory of 4276	2784	5df10dd4c78546aab1ae33588593b467dc9fb3a20a262a72b35c6473bdaff5fe.exe	109
PID 2784 wrote to memory of 4276	2784	5df10dd4c78546aab1ae33588593b467dc9fb3a20a262a72b35c6473bdaff5fe.exe	109
PID 2784 wrote to memory of 2776	2784	5df10dd4c78546aab1ae33588593b467dc9fb3a20a262a72b35c6473bdaff5fe.exe	110
PID 2784 wrote to memory of 2776	2784	5df10dd4c78546aab1ae33588593b467dc9fb3a20a262a72b35c6473bdaff5fe.exe	110
PID 2784 wrote to memory of 4072	2784	5df10dd4c78546aab1ae33588593b467dc9fb3a20a262a72b35c6473bdaff5fe.exe	111
PID 2784 wrote to memory of 4072	2784	5df10dd4c78546aab1ae33588593b467dc9fb3a20a262a72b35c6473bdaff5fe.exe	111
PID 2784 wrote to memory of 1252	2784	5df10dd4c78546aab1ae33588593b467dc9fb3a20a262a72b35c6473bdaff5fe.exe	112
PID 2784 wrote to memory of 1252	2784	5df10dd4c78546aab1ae33588593b467dc9fb3a20a262a72b35c6473bdaff5fe.exe	112
PID 2784 wrote to memory of 3496	2784	5df10dd4c78546aab1ae33588593b467dc9fb3a20a262a72b35c6473bdaff5fe.exe	113
PID 2784 wrote to memory of 3496	2784	5df10dd4c78546aab1ae33588593b467dc9fb3a20a262a72b35c6473bdaff5fe.exe	113
PID 2784 wrote to memory of 1700	2784	5df10dd4c78546aab1ae33588593b467dc9fb3a20a262a72b35c6473bdaff5fe.exe	114
PID 2784 wrote to memory of 1700	2784	5df10dd4c78546aab1ae33588593b467dc9fb3a20a262a72b35c6473bdaff5fe.exe	114
PID 2784 wrote to memory of 1508	2784	5df10dd4c78546aab1ae33588593b467dc9fb3a20a262a72b35c6473bdaff5fe.exe	115
PID 2784 wrote to memory of 1508	2784	5df10dd4c78546aab1ae33588593b467dc9fb3a20a262a72b35c6473bdaff5fe.exe	115

C:\Users\Admin\AppData\Local\Temp\5df10dd4c78546aab1ae33588593b467dc9fb3a20a262a72b35c6473bdaff5fe.exe
"C:\Users\Admin\AppData\Local\Temp\5df10dd4c78546aab1ae33588593b467dc9fb3a20a262a72b35c6473bdaff5fe.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2784
- C:\Windows\System\QOmbuqI.exe
  C:\Windows\System\QOmbuqI.exe
  2⤵
  - Executes dropped EXE
  PID:3344
- C:\Windows\System\yHXPKbp.exe
  C:\Windows\System\yHXPKbp.exe
  2⤵
  - Executes dropped EXE
  PID:4768
- C:\Windows\System\GBTJfif.exe
  C:\Windows\System\GBTJfif.exe
  2⤵
  - Executes dropped EXE
  PID:3924
- C:\Windows\System\SRThzom.exe
  C:\Windows\System\SRThzom.exe
  2⤵
  - Executes dropped EXE
  PID:4572
- C:\Windows\System\WUruewl.exe
  C:\Windows\System\WUruewl.exe
  2⤵
  - Executes dropped EXE
  PID:1432
- C:\Windows\System\hYgWBMC.exe
  C:\Windows\System\hYgWBMC.exe
  2⤵
  - Executes dropped EXE
  PID:1880
- C:\Windows\System\josogeP.exe
  C:\Windows\System\josogeP.exe
  2⤵
  - Executes dropped EXE
  PID:3032
- C:\Windows\System\VpwSfdO.exe
  C:\Windows\System\VpwSfdO.exe
  2⤵
  - Executes dropped EXE
  PID:1436
- C:\Windows\System\QdIMocf.exe
  C:\Windows\System\QdIMocf.exe
  2⤵
  - Executes dropped EXE
  PID:1232
- C:\Windows\System\plDWrgl.exe
  C:\Windows\System\plDWrgl.exe
  2⤵
  - Executes dropped EXE
  PID:1976
- C:\Windows\System\istxImZ.exe
  C:\Windows\System\istxImZ.exe
  2⤵
  - Executes dropped EXE
  PID:2956
- C:\Windows\System\pETBCKa.exe
  C:\Windows\System\pETBCKa.exe
  2⤵
  - Executes dropped EXE
  PID:4440
- C:\Windows\System\eaKoNbI.exe
  C:\Windows\System\eaKoNbI.exe
  2⤵
  - Executes dropped EXE
  PID:628
- C:\Windows\System\NtSYSYr.exe
  C:\Windows\System\NtSYSYr.exe
  2⤵
  - Executes dropped EXE
  PID:5076
- C:\Windows\System\LHQlhTn.exe
  C:\Windows\System\LHQlhTn.exe
  2⤵
  - Executes dropped EXE
  PID:1816
- C:\Windows\System\tLJygQR.exe
  C:\Windows\System\tLJygQR.exe
  2⤵
  - Executes dropped EXE
  PID:5036
- C:\Windows\System\hJxtyMM.exe
  C:\Windows\System\hJxtyMM.exe
  2⤵
  - Executes dropped EXE
  PID:640
- C:\Windows\System\akXZsDv.exe
  C:\Windows\System\akXZsDv.exe
  2⤵
  - Executes dropped EXE
  PID:4052
- C:\Windows\System\nHuzbYA.exe
  C:\Windows\System\nHuzbYA.exe
  2⤵
  - Executes dropped EXE
  PID:1040
- C:\Windows\System\kEndhsA.exe
  C:\Windows\System\kEndhsA.exe
  2⤵
  - Executes dropped EXE
  PID:3880
- C:\Windows\System\bYicFpj.exe
  C:\Windows\System\bYicFpj.exe
  2⤵
  - Executes dropped EXE
  PID:4392
- C:\Windows\System\QPMoUHG.exe
  C:\Windows\System\QPMoUHG.exe
  2⤵
  - Executes dropped EXE
  PID:464
- C:\Windows\System\uOUvkYT.exe
  C:\Windows\System\uOUvkYT.exe
  2⤵
  - Executes dropped EXE
  PID:4372
- C:\Windows\System\kNOPXPR.exe
  C:\Windows\System\kNOPXPR.exe
  2⤵
  - Executes dropped EXE
  PID:1528
- C:\Windows\System\MjpfYkc.exe
  C:\Windows\System\MjpfYkc.exe
  2⤵
  - Executes dropped EXE
  PID:4988
- C:\Windows\System\XLHVlwg.exe
  C:\Windows\System\XLHVlwg.exe
  2⤵
  - Executes dropped EXE
  PID:4276
- C:\Windows\System\BobPXPj.exe
  C:\Windows\System\BobPXPj.exe
  2⤵
  - Executes dropped EXE
  PID:2776
- C:\Windows\System\RNWFGUP.exe
  C:\Windows\System\RNWFGUP.exe
  2⤵
  - Executes dropped EXE
  PID:4072
- C:\Windows\System\gdWdWvZ.exe
  C:\Windows\System\gdWdWvZ.exe
  2⤵
  - Executes dropped EXE
  PID:1252
- C:\Windows\System\BohPlWT.exe
  C:\Windows\System\BohPlWT.exe
  2⤵
  - Executes dropped EXE
  PID:3496
- C:\Windows\System\VxcESrR.exe
  C:\Windows\System\VxcESrR.exe
  2⤵
  - Executes dropped EXE
  PID:1700
- C:\Windows\System\tSGiPNx.exe
  C:\Windows\System\tSGiPNx.exe
  2⤵
  - Executes dropped EXE
  PID:1508
- C:\Windows\System\gPhsYUB.exe
  C:\Windows\System\gPhsYUB.exe
  2⤵
  - Executes dropped EXE
  PID:2948
- C:\Windows\System\WmWdqkP.exe
  C:\Windows\System\WmWdqkP.exe
  2⤵
  - Executes dropped EXE
  PID:624
- C:\Windows\System\PywItvu.exe
  C:\Windows\System\PywItvu.exe
  2⤵
  - Executes dropped EXE
  PID:3908
- C:\Windows\System\KWIjaNt.exe
  C:\Windows\System\KWIjaNt.exe
  2⤵
  - Executes dropped EXE
  PID:3904
- C:\Windows\System\ESGDwUB.exe
  C:\Windows\System\ESGDwUB.exe
  2⤵
  - Executes dropped EXE
  PID:540
- C:\Windows\System\HIouKSk.exe
  C:\Windows\System\HIouKSk.exe
  2⤵
  - Executes dropped EXE
  PID:4556
- C:\Windows\System\RjeIPMg.exe
  C:\Windows\System\RjeIPMg.exe
  2⤵
  - Executes dropped EXE
  PID:1560
- C:\Windows\System\xFAJmop.exe
  C:\Windows\System\xFAJmop.exe
  2⤵
  - Executes dropped EXE
  PID:2236
- C:\Windows\System\GDicEYg.exe
  C:\Windows\System\GDicEYg.exe
  2⤵
  - Executes dropped EXE
  PID:3224
- C:\Windows\System\bteZMRG.exe
  C:\Windows\System\bteZMRG.exe
  2⤵
  - Executes dropped EXE
  PID:224
- C:\Windows\System\NLYjyKB.exe
  C:\Windows\System\NLYjyKB.exe
  2⤵
  - Executes dropped EXE
  PID:4540
- C:\Windows\System\rbpNXmP.exe
  C:\Windows\System\rbpNXmP.exe
  2⤵
  - Executes dropped EXE
  PID:4288
- C:\Windows\System\uiUKjhp.exe
  C:\Windows\System\uiUKjhp.exe
  2⤵
  - Executes dropped EXE
  PID:1828
- C:\Windows\System\LJnXnsm.exe
  C:\Windows\System\LJnXnsm.exe
  2⤵
  - Executes dropped EXE
  PID:4844
- C:\Windows\System\tumyMwW.exe
  C:\Windows\System\tumyMwW.exe
  2⤵
  - Executes dropped EXE
  PID:2448
- C:\Windows\System\kzYpcAy.exe
  C:\Windows\System\kzYpcAy.exe
  2⤵
  - Executes dropped EXE
  PID:4332
- C:\Windows\System\DchXtpQ.exe
  C:\Windows\System\DchXtpQ.exe
  2⤵
  - Executes dropped EXE
  PID:4528
- C:\Windows\System\AxpaSfe.exe
  C:\Windows\System\AxpaSfe.exe
  2⤵
  - Executes dropped EXE
  PID:4488
- C:\Windows\System\QsgCoUK.exe
  C:\Windows\System\QsgCoUK.exe
  2⤵
  - Executes dropped EXE
  PID:4316
- C:\Windows\System\buiZfKU.exe
  C:\Windows\System\buiZfKU.exe
  2⤵
  - Executes dropped EXE
  PID:1824
- C:\Windows\System\MZGXqjS.exe
  C:\Windows\System\MZGXqjS.exe
  2⤵
  - Executes dropped EXE
  PID:2884
- C:\Windows\System\kiBtjdL.exe
  C:\Windows\System\kiBtjdL.exe
  2⤵
  - Executes dropped EXE
  PID:4176
- C:\Windows\System\PRFNTVK.exe
  C:\Windows\System\PRFNTVK.exe
  2⤵
  - Executes dropped EXE
  PID:3688
- C:\Windows\System\xZZcHlF.exe
  C:\Windows\System\xZZcHlF.exe
  2⤵
  - Executes dropped EXE
  PID:1240
- C:\Windows\System\gvRPLoV.exe
  C:\Windows\System\gvRPLoV.exe
  2⤵
  - Executes dropped EXE
  PID:1328
- C:\Windows\System\bIucoCP.exe
  C:\Windows\System\bIucoCP.exe
  2⤵
  - Executes dropped EXE
  PID:3960
- C:\Windows\System\PtapwYR.exe
  C:\Windows\System\PtapwYR.exe
  2⤵
  - Executes dropped EXE
  PID:4836
- C:\Windows\System\CHBVaao.exe
  C:\Windows\System\CHBVaao.exe
  2⤵
  - Executes dropped EXE
  PID:1236
- C:\Windows\System\yHrySMY.exe
  C:\Windows\System\yHrySMY.exe
  2⤵
  - Executes dropped EXE
  PID:3440
- C:\Windows\System\HBljOFk.exe
  C:\Windows\System\HBljOFk.exe
  2⤵
  - Executes dropped EXE
  PID:5016
- C:\Windows\System\bnTuzzU.exe
  C:\Windows\System\bnTuzzU.exe
  2⤵
  - Executes dropped EXE
  PID:4480
- C:\Windows\System\nDyWbGF.exe
  C:\Windows\System\nDyWbGF.exe
  2⤵
  - Executes dropped EXE
  PID:4632
- C:\Windows\System\QPQnLRS.exe
  C:\Windows\System\QPQnLRS.exe
  2⤵
  PID:3380
- C:\Windows\System\SLZdHnp.exe
  C:\Windows\System\SLZdHnp.exe
  2⤵
  PID:4788
- C:\Windows\System\SuucUdO.exe
  C:\Windows\System\SuucUdO.exe
  2⤵
  PID:4748
- C:\Windows\System\zwAEKmY.exe
  C:\Windows\System\zwAEKmY.exe
  2⤵
  PID:3140
- C:\Windows\System\JnEYZUr.exe
  C:\Windows\System\JnEYZUr.exe
  2⤵
  PID:4220
- C:\Windows\System\dQXAcUq.exe
  C:\Windows\System\dQXAcUq.exe
  2⤵
  PID:4496
- C:\Windows\System\NhFKlXA.exe
  C:\Windows\System\NhFKlXA.exe
  2⤵
  PID:4856
- C:\Windows\System\HaROTOq.exe
  C:\Windows\System\HaROTOq.exe
  2⤵
  PID:4816
- C:\Windows\System\lGsMSjS.exe
  C:\Windows\System\lGsMSjS.exe
  2⤵
  PID:3608
- C:\Windows\System\LRGxybp.exe
  C:\Windows\System\LRGxybp.exe
  2⤵
  PID:3484
- C:\Windows\System\sUGNYHY.exe
  C:\Windows\System\sUGNYHY.exe
  2⤵
  PID:2428
- C:\Windows\System\ZidfUHH.exe
  C:\Windows\System\ZidfUHH.exe
  2⤵
  PID:1576
- C:\Windows\System\vkRWmpq.exe
  C:\Windows\System\vkRWmpq.exe
  2⤵
  PID:2452
- C:\Windows\System\mIbxFrm.exe
  C:\Windows\System\mIbxFrm.exe
  2⤵
  PID:5152
- C:\Windows\System\oauUSRP.exe
  C:\Windows\System\oauUSRP.exe
  2⤵
  PID:5180
- C:\Windows\System\cOXxWeI.exe
  C:\Windows\System\cOXxWeI.exe
  2⤵
  PID:5204
- C:\Windows\System\mmnBALz.exe
  C:\Windows\System\mmnBALz.exe
  2⤵
  PID:5232
- C:\Windows\System\wgZuLCY.exe
  C:\Windows\System\wgZuLCY.exe
  2⤵
  PID:5264
- C:\Windows\System\zagPbPq.exe
  C:\Windows\System\zagPbPq.exe
  2⤵
  PID:5296
- C:\Windows\System\gGHmUAh.exe
  C:\Windows\System\gGHmUAh.exe
  2⤵
  PID:5328
- C:\Windows\System\zCyjJzJ.exe
  C:\Windows\System\zCyjJzJ.exe
  2⤵
  PID:5356
- C:\Windows\System\NQjqUbe.exe
  C:\Windows\System\NQjqUbe.exe
  2⤵
  PID:5384
- C:\Windows\System\hxueMyR.exe
  C:\Windows\System\hxueMyR.exe
  2⤵
  PID:5412
- C:\Windows\System\fboKFfC.exe
  C:\Windows\System\fboKFfC.exe
  2⤵
  PID:5436
- C:\Windows\System\DufYFXN.exe
  C:\Windows\System\DufYFXN.exe
  2⤵
  PID:5468
- C:\Windows\System\WPYYvjR.exe
  C:\Windows\System\WPYYvjR.exe
  2⤵
  PID:5496
- C:\Windows\System\yReNSzo.exe
  C:\Windows\System\yReNSzo.exe
  2⤵
  PID:5524
- C:\Windows\System\zqRIvfC.exe
  C:\Windows\System\zqRIvfC.exe
  2⤵
  PID:5552
- C:\Windows\System\qmhtxXI.exe
  C:\Windows\System\qmhtxXI.exe
  2⤵
  PID:5580
- C:\Windows\System\wtzciOg.exe
  C:\Windows\System\wtzciOg.exe
  2⤵
  PID:5608
- C:\Windows\System\alezctO.exe
  C:\Windows\System\alezctO.exe
  2⤵
  PID:5636
- C:\Windows\System\VTYWeQA.exe
  C:\Windows\System\VTYWeQA.exe
  2⤵
  PID:5664
- C:\Windows\System\ssdFakK.exe
  C:\Windows\System\ssdFakK.exe
  2⤵
  PID:5692
- C:\Windows\System\bHHGcnT.exe
  C:\Windows\System\bHHGcnT.exe
  2⤵
  PID:5748
- C:\Windows\System\cVjtDQZ.exe
  C:\Windows\System\cVjtDQZ.exe
  2⤵
  PID:5764
- C:\Windows\System\cdsgOlf.exe
  C:\Windows\System\cdsgOlf.exe
  2⤵
  PID:5780
- C:\Windows\System\ipEiylx.exe
  C:\Windows\System\ipEiylx.exe
  2⤵
  PID:5804
- C:\Windows\System\rUCVxZH.exe
  C:\Windows\System\rUCVxZH.exe
  2⤵
  PID:5832
- C:\Windows\System\sKbxDAa.exe
  C:\Windows\System\sKbxDAa.exe
  2⤵
  PID:5852
- C:\Windows\System\oEcXAki.exe
  C:\Windows\System\oEcXAki.exe
  2⤵
  PID:5880
- C:\Windows\System\dGHDByB.exe
  C:\Windows\System\dGHDByB.exe
  2⤵
  PID:5908
- C:\Windows\System\wsOcWVw.exe
  C:\Windows\System\wsOcWVw.exe
  2⤵
  PID:5932
- C:\Windows\System\nDbvasP.exe
  C:\Windows\System\nDbvasP.exe
  2⤵
  PID:5960
- C:\Windows\System\hVfTEri.exe
  C:\Windows\System\hVfTEri.exe
  2⤵
  PID:5992
- C:\Windows\System\ElpqOaz.exe
  C:\Windows\System\ElpqOaz.exe
  2⤵
  PID:6020
- C:\Windows\System\RHovQDv.exe
  C:\Windows\System\RHovQDv.exe
  2⤵
  PID:6044
- C:\Windows\System\NJGjCnN.exe
  C:\Windows\System\NJGjCnN.exe
  2⤵
  PID:6072
- C:\Windows\System\FNHHmCU.exe
  C:\Windows\System\FNHHmCU.exe
  2⤵
  PID:6100
- C:\Windows\System\nTpoYVj.exe
  C:\Windows\System\nTpoYVj.exe
  2⤵
  PID:6132
- C:\Windows\System\yXyYaMk.exe
  C:\Windows\System\yXyYaMk.exe
  2⤵
  PID:1524
- C:\Windows\System\YJZDGeh.exe
  C:\Windows\System\YJZDGeh.exe
  2⤵
  PID:4716
- C:\Windows\System\DtAjTow.exe
  C:\Windows\System\DtAjTow.exe
  2⤵
  PID:2740
- C:\Windows\System\vPzGytC.exe
  C:\Windows\System\vPzGytC.exe
  2⤵
  PID:2484
- C:\Windows\System\UzrIkbS.exe
  C:\Windows\System\UzrIkbS.exe
  2⤵
  PID:916
- C:\Windows\System\YCPKOiZ.exe
  C:\Windows\System\YCPKOiZ.exe
  2⤵
  PID:4564
- C:\Windows\System\BTiEIDr.exe
  C:\Windows\System\BTiEIDr.exe
  2⤵
  PID:1860
- C:\Windows\System\JEPuWvj.exe
  C:\Windows\System\JEPuWvj.exe
  2⤵
  PID:5132
- C:\Windows\System\tcsHSVj.exe
  C:\Windows\System\tcsHSVj.exe
  2⤵
  PID:5188
- C:\Windows\System\TSnsalV.exe
  C:\Windows\System\TSnsalV.exe
  2⤵
  PID:5248
- C:\Windows\System\qaoXtvg.exe
  C:\Windows\System\qaoXtvg.exe
  2⤵
  PID:5320
- C:\Windows\System\pyNUjKy.exe
  C:\Windows\System\pyNUjKy.exe
  2⤵
  PID:5376
- C:\Windows\System\fYHrVFP.exe
  C:\Windows\System\fYHrVFP.exe
  2⤵
  PID:5452
- C:\Windows\System\tkLuWWE.exe
  C:\Windows\System\tkLuWWE.exe
  2⤵
  PID:5512
- C:\Windows\System\hMEqFOq.exe
  C:\Windows\System\hMEqFOq.exe
  2⤵
  PID:5592
- C:\Windows\System\nwyeVWK.exe
  C:\Windows\System\nwyeVWK.exe
  2⤵
  PID:5648
- C:\Windows\System\wiNMXRF.exe
  C:\Windows\System\wiNMXRF.exe
  2⤵
  PID:3840
- C:\Windows\System\DyDbcER.exe
  C:\Windows\System\DyDbcER.exe
  2⤵
  PID:5776
- C:\Windows\System\IgSmHPW.exe
  C:\Windows\System\IgSmHPW.exe
  2⤵
  PID:5844
- C:\Windows\System\eRTvTmB.exe
  C:\Windows\System\eRTvTmB.exe
  2⤵
  PID:5900
- C:\Windows\System\BYDlnIU.exe
  C:\Windows\System\BYDlnIU.exe
  2⤵
  PID:5956
- C:\Windows\System\WCzyweP.exe
  C:\Windows\System\WCzyweP.exe
  2⤵
  PID:6032
- C:\Windows\System\XPxXoRn.exe
  C:\Windows\System\XPxXoRn.exe
  2⤵
  PID:6092
- C:\Windows\System\GoFaqgA.exe
  C:\Windows\System\GoFaqgA.exe
  2⤵
  PID:2980
- C:\Windows\System\CHnhEsY.exe
  C:\Windows\System\CHnhEsY.exe
  2⤵
  PID:4408
- C:\Windows\System\NsrQcNQ.exe
  C:\Windows\System\NsrQcNQ.exe
  2⤵
  PID:4472
- C:\Windows\System\JirIAUT.exe
  C:\Windows\System\JirIAUT.exe
  2⤵
  PID:5160
- C:\Windows\System\CgNkjUw.exe
  C:\Windows\System\CgNkjUw.exe
  2⤵
  PID:5292
- C:\Windows\System\OsJgpSY.exe
  C:\Windows\System\OsJgpSY.exe
  2⤵
  PID:5432
- C:\Windows\System\gaUyovd.exe
  C:\Windows\System\gaUyovd.exe
  2⤵
  PID:5620
- C:\Windows\System\MIbIExI.exe
  C:\Windows\System\MIbIExI.exe
  2⤵
  PID:6172
- C:\Windows\System\bphwzgQ.exe
  C:\Windows\System\bphwzgQ.exe
  2⤵
  PID:6188
- C:\Windows\System\CvqrdSe.exe
  C:\Windows\System\CvqrdSe.exe
  2⤵
  PID:6216
- C:\Windows\System\bkQevvN.exe
  C:\Windows\System\bkQevvN.exe
  2⤵
  PID:6252
- C:\Windows\System\kBTxgch.exe
  C:\Windows\System\kBTxgch.exe
  2⤵
  PID:6280
- C:\Windows\System\APpboGk.exe
  C:\Windows\System\APpboGk.exe
  2⤵
  PID:6308
- C:\Windows\System\yivqNfh.exe
  C:\Windows\System\yivqNfh.exe
  2⤵
  PID:6340
- C:\Windows\System\EpJehea.exe
  C:\Windows\System\EpJehea.exe
  2⤵
  PID:6372
- C:\Windows\System\kHIUvEE.exe
  C:\Windows\System\kHIUvEE.exe
  2⤵
  PID:6400
- C:\Windows\System\eKxqPJg.exe
  C:\Windows\System\eKxqPJg.exe
  2⤵
  PID:6428
- C:\Windows\System\IPHTkbr.exe
  C:\Windows\System\IPHTkbr.exe
  2⤵
  PID:6460
- C:\Windows\System\tGQMQQz.exe
  C:\Windows\System\tGQMQQz.exe
  2⤵
  PID:6484
- C:\Windows\System\BEYRFQr.exe
  C:\Windows\System\BEYRFQr.exe
  2⤵
  PID:6524
- C:\Windows\System\CyjxjEb.exe
  C:\Windows\System\CyjxjEb.exe
  2⤵
  PID:6544
- C:\Windows\System\hvtYJZY.exe
  C:\Windows\System\hvtYJZY.exe
  2⤵
  PID:6568
- C:\Windows\System\XzUEwSt.exe
  C:\Windows\System\XzUEwSt.exe
  2⤵
  PID:6596
- C:\Windows\System\yIEGsZk.exe
  C:\Windows\System\yIEGsZk.exe
  2⤵
  PID:6628
- C:\Windows\System\PyRtxMy.exe
  C:\Windows\System\PyRtxMy.exe
  2⤵
  PID:6652
- C:\Windows\System\xQvDnoU.exe
  C:\Windows\System\xQvDnoU.exe
  2⤵
  PID:6684
- C:\Windows\System\CaIvKOx.exe
  C:\Windows\System\CaIvKOx.exe
  2⤵
  PID:6708
- C:\Windows\System\VuEHsUE.exe
  C:\Windows\System\VuEHsUE.exe
  2⤵
  PID:6740
- C:\Windows\System\lHtFojl.exe
  C:\Windows\System\lHtFojl.exe
  2⤵
  PID:6764
- C:\Windows\System\zNUTWat.exe
  C:\Windows\System\zNUTWat.exe
  2⤵
  PID:6792
- C:\Windows\System\KSNcpPD.exe
  C:\Windows\System\KSNcpPD.exe
  2⤵
  PID:6824
- C:\Windows\System\AKbRWeb.exe
  C:\Windows\System\AKbRWeb.exe
  2⤵
  PID:6852
- C:\Windows\System\rLAwIjM.exe
  C:\Windows\System\rLAwIjM.exe
  2⤵
  PID:6880
- C:\Windows\System\VnBEgiG.exe
  C:\Windows\System\VnBEgiG.exe
  2⤵
  PID:6908
- C:\Windows\System\aSZClmV.exe
  C:\Windows\System\aSZClmV.exe
  2⤵
  PID:6932
- C:\Windows\System\HLNefHH.exe
  C:\Windows\System\HLNefHH.exe
  2⤵
  PID:6964
- C:\Windows\System\gbZCdnp.exe
  C:\Windows\System\gbZCdnp.exe
  2⤵
  PID:6988
- C:\Windows\System\XpChYZS.exe
  C:\Windows\System\XpChYZS.exe
  2⤵
  PID:7016
- C:\Windows\System\lKPhFiz.exe
  C:\Windows\System\lKPhFiz.exe
  2⤵
  PID:7048
- C:\Windows\System\tKAabyu.exe
  C:\Windows\System\tKAabyu.exe
  2⤵
  PID:7076
- C:\Windows\System\MKSbtwn.exe
  C:\Windows\System\MKSbtwn.exe
  2⤵
  PID:7108
- C:\Windows\System\OfnQHXm.exe
  C:\Windows\System\OfnQHXm.exe
  2⤵
  PID:7136
- C:\Windows\System\NItccUL.exe
  C:\Windows\System\NItccUL.exe
  2⤵
  PID:7164
- C:\Windows\System\fEPXMFP.exe
  C:\Windows\System\fEPXMFP.exe
  2⤵
  PID:5760
- C:\Windows\System\aIreZUD.exe
  C:\Windows\System\aIreZUD.exe
  2⤵
  PID:5928
- C:\Windows\System\tOpRmYc.exe
  C:\Windows\System\tOpRmYc.exe
  2⤵
  PID:6064
- C:\Windows\System\NcypKyw.exe
  C:\Windows\System\NcypKyw.exe
  2⤵
  PID:1632
- C:\Windows\System\bpitgDK.exe
  C:\Windows\System\bpitgDK.exe
  2⤵
  PID:964
- C:\Windows\System\ljRQblw.exe
  C:\Windows\System\ljRQblw.exe
  2⤵
  PID:5424
- C:\Windows\System\RbYWrJr.exe
  C:\Windows\System\RbYWrJr.exe
  2⤵
  PID:6184
- C:\Windows\System\tdGXcGa.exe
  C:\Windows\System\tdGXcGa.exe
  2⤵
  PID:6240
- C:\Windows\System\FTUzWUX.exe
  C:\Windows\System\FTUzWUX.exe
  2⤵
  PID:6324
- C:\Windows\System\yMKOTKG.exe
  C:\Windows\System\yMKOTKG.exe
  2⤵
  PID:6392
- C:\Windows\System\bVGOLfg.exe
  C:\Windows\System\bVGOLfg.exe
  2⤵
  PID:3500
- C:\Windows\System\uaMgPZO.exe
  C:\Windows\System\uaMgPZO.exe
  2⤵
  PID:6500
- C:\Windows\System\VImibLh.exe
  C:\Windows\System\VImibLh.exe
  2⤵
  PID:6560
- C:\Windows\System\bjAnNre.exe
  C:\Windows\System\bjAnNre.exe
  2⤵
  PID:6620
- C:\Windows\System\PcsnHsq.exe
  C:\Windows\System\PcsnHsq.exe
  2⤵
  PID:6696
- C:\Windows\System\WKUXABV.exe
  C:\Windows\System\WKUXABV.exe
  2⤵
  PID:6756
- C:\Windows\System\RZBGhsN.exe
  C:\Windows\System\RZBGhsN.exe
  2⤵
  PID:6816
- C:\Windows\System\gvJuRAI.exe
  C:\Windows\System\gvJuRAI.exe
  2⤵
  PID:2736
- C:\Windows\System\oijzZft.exe
  C:\Windows\System\oijzZft.exe
  2⤵
  PID:6952
- C:\Windows\System\WZFMxht.exe
  C:\Windows\System\WZFMxht.exe
  2⤵
  PID:7012
- C:\Windows\System\wufPrxd.exe
  C:\Windows\System\wufPrxd.exe
  2⤵
  PID:7064
- C:\Windows\System\CzaKPBs.exe
  C:\Windows\System\CzaKPBs.exe
  2⤵
  PID:7132
- C:\Windows\System\mBTRGix.exe
  C:\Windows\System\mBTRGix.exe
  2⤵
  PID:5824
- C:\Windows\System\XauILMd.exe
  C:\Windows\System\XauILMd.exe
  2⤵
  PID:4436
- C:\Windows\System\YDeaFAJ.exe
  C:\Windows\System\YDeaFAJ.exe
  2⤵
  PID:5372
- C:\Windows\System\ukNKnMS.exe
  C:\Windows\System\ukNKnMS.exe
  2⤵
  PID:6236
- C:\Windows\System\NpDhnDd.exe
  C:\Windows\System\NpDhnDd.exe
  2⤵
  PID:6420
- C:\Windows\System\IHLhkLi.exe
  C:\Windows\System\IHLhkLi.exe
  2⤵
  PID:4064
- C:\Windows\System\rYKelFU.exe
  C:\Windows\System\rYKelFU.exe
  2⤵
  PID:6616
- C:\Windows\System\bVTYMpM.exe
  C:\Windows\System\bVTYMpM.exe
  2⤵
  PID:6788
- C:\Windows\System\HxdQLfg.exe
  C:\Windows\System\HxdQLfg.exe
  2⤵
  PID:3488
- C:\Windows\System\uRXaXYQ.exe
  C:\Windows\System\uRXaXYQ.exe
  2⤵
  PID:2224
- C:\Windows\System\AWgGKCX.exe
  C:\Windows\System\AWgGKCX.exe
  2⤵
  PID:7172
- C:\Windows\System\WoKjLVv.exe
  C:\Windows\System\WoKjLVv.exe
  2⤵
  PID:7196
- C:\Windows\System\eVccASO.exe
  C:\Windows\System\eVccASO.exe
  2⤵
  PID:7224
- C:\Windows\System\WecsIqS.exe
  C:\Windows\System\WecsIqS.exe
  2⤵
  PID:7256
- C:\Windows\System\rTPjdrn.exe
  C:\Windows\System\rTPjdrn.exe
  2⤵
  PID:7284
- C:\Windows\System\InfbGTL.exe
  C:\Windows\System\InfbGTL.exe
  2⤵
  PID:7308
- C:\Windows\System\LhoZVAS.exe
  C:\Windows\System\LhoZVAS.exe
  2⤵
  PID:7340
- C:\Windows\System\BZlDmDe.exe
  C:\Windows\System\BZlDmDe.exe
  2⤵
  PID:7364
- C:\Windows\System\OvMARQD.exe
  C:\Windows\System\OvMARQD.exe
  2⤵
  PID:7396
- C:\Windows\System\sCHBNvj.exe
  C:\Windows\System\sCHBNvj.exe
  2⤵
  PID:7424
- C:\Windows\System\XmhadLT.exe
  C:\Windows\System\XmhadLT.exe
  2⤵
  PID:7448
- C:\Windows\System\slLfmaz.exe
  C:\Windows\System\slLfmaz.exe
  2⤵
  PID:7476
- C:\Windows\System\wDCaSCN.exe
  C:\Windows\System\wDCaSCN.exe
  2⤵
  PID:7504
- C:\Windows\System\WxOvFuF.exe
  C:\Windows\System\WxOvFuF.exe
  2⤵
  PID:7532
- C:\Windows\System\NIlNNNV.exe
  C:\Windows\System\NIlNNNV.exe
  2⤵
  PID:7560
- C:\Windows\System\aLfEPRV.exe
  C:\Windows\System\aLfEPRV.exe
  2⤵
  PID:7588
- C:\Windows\System\uPpzPWn.exe
  C:\Windows\System\uPpzPWn.exe
  2⤵
  PID:7620
- C:\Windows\System\WwEAaii.exe
  C:\Windows\System\WwEAaii.exe
  2⤵
  PID:7648
- C:\Windows\System\SYmmoXd.exe
  C:\Windows\System\SYmmoXd.exe
  2⤵
  PID:7672
- C:\Windows\System\lbrlQJu.exe
  C:\Windows\System\lbrlQJu.exe
  2⤵
  PID:7700
- C:\Windows\System\SrVAEAB.exe
  C:\Windows\System\SrVAEAB.exe
  2⤵
  PID:7756
- C:\Windows\System\ikNQsLt.exe
  C:\Windows\System\ikNQsLt.exe
  2⤵
  PID:7788
- C:\Windows\System\NsuMOkx.exe
  C:\Windows\System\NsuMOkx.exe
  2⤵
  PID:7808
- C:\Windows\System\fIxGQCk.exe
  C:\Windows\System\fIxGQCk.exe
  2⤵
  PID:7868
- C:\Windows\System\xmkEzSe.exe
  C:\Windows\System\xmkEzSe.exe
  2⤵
  PID:7908
- C:\Windows\System\pUILjlQ.exe
  C:\Windows\System\pUILjlQ.exe
  2⤵
  PID:7936
- C:\Windows\System\ApgxgCl.exe
  C:\Windows\System\ApgxgCl.exe
  2⤵
  PID:7952
- C:\Windows\System\RvIaysr.exe
  C:\Windows\System\RvIaysr.exe
  2⤵
  PID:7972
- C:\Windows\System\GqlxQnQ.exe
  C:\Windows\System\GqlxQnQ.exe
  2⤵
  PID:7996
- C:\Windows\System\ozLZXXr.exe
  C:\Windows\System\ozLZXXr.exe
  2⤵
  PID:8020
- C:\Windows\System\zLRnXeE.exe
  C:\Windows\System\zLRnXeE.exe
  2⤵
  PID:8052
- C:\Windows\System\lzHKNoz.exe
  C:\Windows\System\lzHKNoz.exe
  2⤵
  PID:8068
- C:\Windows\System\PBGymst.exe
  C:\Windows\System\PBGymst.exe
  2⤵
  PID:8108
- C:\Windows\System\oQeafVU.exe
  C:\Windows\System\oQeafVU.exe
  2⤵
  PID:8136
- C:\Windows\System\VmwsdQF.exe
  C:\Windows\System\VmwsdQF.exe
  2⤵
  PID:8160
- C:\Windows\System\pcmfUhR.exe
  C:\Windows\System\pcmfUhR.exe
  2⤵
  PID:6008
- C:\Windows\System\vOgZDAl.exe
  C:\Windows\System\vOgZDAl.exe
  2⤵
  PID:6356
- C:\Windows\System\KDgchSk.exe
  C:\Windows\System\KDgchSk.exe
  2⤵
  PID:1248
- C:\Windows\System\rBjZfno.exe
  C:\Windows\System\rBjZfno.exe
  2⤵
  PID:6868
- C:\Windows\System\ccwNaCz.exe
  C:\Windows\System\ccwNaCz.exe
  2⤵
  PID:7004
- C:\Windows\System\gYQtxcQ.exe
  C:\Windows\System\gYQtxcQ.exe
  2⤵
  PID:2444
- C:\Windows\System\tVJcDLy.exe
  C:\Windows\System\tVJcDLy.exe
  2⤵
  PID:2256
- C:\Windows\System\uvlTiFI.exe
  C:\Windows\System\uvlTiFI.exe
  2⤵
  PID:7272
- C:\Windows\System\KZWYBDP.exe
  C:\Windows\System\KZWYBDP.exe
  2⤵
  PID:7328
- C:\Windows\System\PgRqNVM.exe
  C:\Windows\System\PgRqNVM.exe
  2⤵
  PID:2724
- C:\Windows\System\iHLeukw.exe
  C:\Windows\System\iHLeukw.exe
  2⤵
  PID:7436
- C:\Windows\System\TKBTbwI.exe
  C:\Windows\System\TKBTbwI.exe
  2⤵
  PID:1356
- C:\Windows\System\jQPvnPi.exe
  C:\Windows\System\jQPvnPi.exe
  2⤵
  PID:7524
- C:\Windows\System\CXUMZwU.exe
  C:\Windows\System\CXUMZwU.exe
  2⤵
  PID:7552
- C:\Windows\System\YcyhnYI.exe
  C:\Windows\System\YcyhnYI.exe
  2⤵
  PID:1936
- C:\Windows\System\ftgcgxc.exe
  C:\Windows\System\ftgcgxc.exe
  2⤵
  PID:3052
- C:\Windows\System\KlAcXrt.exe
  C:\Windows\System\KlAcXrt.exe
  2⤵
  PID:7600
- C:\Windows\System\DtcAryT.exe
  C:\Windows\System\DtcAryT.exe
  2⤵
  PID:7636
- C:\Windows\System\KvIpqhD.exe
  C:\Windows\System\KvIpqhD.exe
  2⤵
  PID:884
- C:\Windows\System\QeaBEtK.exe
  C:\Windows\System\QeaBEtK.exe
  2⤵
  PID:2620
- C:\Windows\System\iUfUWpP.exe
  C:\Windows\System\iUfUWpP.exe
  2⤵
  PID:1520
- C:\Windows\System\MRhjwjW.exe
  C:\Windows\System\MRhjwjW.exe
  2⤵
  PID:1100
- C:\Windows\System\cjncHlK.exe
  C:\Windows\System\cjncHlK.exe
  2⤵
  PID:7692
- C:\Windows\System\EzdFXMB.exe
  C:\Windows\System\EzdFXMB.exe
  2⤵
  PID:3564
- C:\Windows\System\XuzvODm.exe
  C:\Windows\System\XuzvODm.exe
  2⤵
  PID:4228
- C:\Windows\System\eQgNhbi.exe
  C:\Windows\System\eQgNhbi.exe
  2⤵
  PID:1208
- C:\Windows\System\zaLOrVL.exe
  C:\Windows\System\zaLOrVL.exe
  2⤵
  PID:1084
- C:\Windows\System\pKvRdFP.exe
  C:\Windows\System\pKvRdFP.exe
  2⤵
  PID:7848
- C:\Windows\System\WyQZjLs.exe
  C:\Windows\System\WyQZjLs.exe
  2⤵
  PID:7900
- C:\Windows\System\QfFhRkk.exe
  C:\Windows\System\QfFhRkk.exe
  2⤵
  PID:7968
- C:\Windows\System\rTjnqam.exe
  C:\Windows\System\rTjnqam.exe
  2⤵
  PID:8008
- C:\Windows\System\WFZtJDO.exe
  C:\Windows\System\WFZtJDO.exe
  2⤵
  PID:8100
- C:\Windows\System\wMMlBdU.exe
  C:\Windows\System\wMMlBdU.exe
  2⤵
  PID:8176
- C:\Windows\System\jhNpuOP.exe
  C:\Windows\System\jhNpuOP.exe
  2⤵
  PID:776
- C:\Windows\System\OuimcrH.exe
  C:\Windows\System\OuimcrH.exe
  2⤵
  PID:6732
- C:\Windows\System\PLYUqCx.exe
  C:\Windows\System\PLYUqCx.exe
  2⤵
  PID:7244
- C:\Windows\System\ULwmgLl.exe
  C:\Windows\System\ULwmgLl.exe
  2⤵
  PID:7360
- C:\Windows\System\PXpCGkW.exe
  C:\Windows\System\PXpCGkW.exe
  2⤵
  PID:7408
- C:\Windows\System\rkiKHuv.exe
  C:\Windows\System\rkiKHuv.exe
  2⤵
  PID:7440
- C:\Windows\System\kjoxLds.exe
  C:\Windows\System\kjoxLds.exe
  2⤵
  PID:3764
- C:\Windows\System\YFXgZKT.exe
  C:\Windows\System\YFXgZKT.exe
  2⤵
  PID:1896
- C:\Windows\System\IujKgNy.exe
  C:\Windows\System\IujKgNy.exe
  2⤵
  PID:3108
- C:\Windows\System\FNQXkgy.exe
  C:\Windows\System\FNQXkgy.exe
  2⤵
  PID:4820
- C:\Windows\System\CjWyHYT.exe
  C:\Windows\System\CjWyHYT.exe
  2⤵
  PID:4360
- C:\Windows\System\UrmyBuK.exe
  C:\Windows\System\UrmyBuK.exe
  2⤵
  PID:5040
- C:\Windows\System\WmaCMgc.exe
  C:\Windows\System\WmaCMgc.exe
  2⤵
  PID:7832
- C:\Windows\System\VNerwig.exe
  C:\Windows\System\VNerwig.exe
  2⤵
  PID:7948
- C:\Windows\System\UPRwsub.exe
  C:\Windows\System\UPRwsub.exe
  2⤵
  PID:8132
- C:\Windows\System\LuGoBDA.exe
  C:\Windows\System\LuGoBDA.exe
  2⤵
  PID:5052
- C:\Windows\System\yARfZUj.exe
  C:\Windows\System\yARfZUj.exe
  2⤵
  PID:3592
- C:\Windows\System\ozUNVCW.exe
  C:\Windows\System\ozUNVCW.exe
  2⤵
  PID:7520
- C:\Windows\System\WkGsnzY.exe
  C:\Windows\System\WkGsnzY.exe
  2⤵
  PID:3184
- C:\Windows\System\tyMuXrQ.exe
  C:\Windows\System\tyMuXrQ.exe
  2⤵
  PID:2768
- C:\Windows\System\WLAYwVB.exe
  C:\Windows\System\WLAYwVB.exe
  2⤵
  PID:4896
- C:\Windows\System\gECLoRo.exe
  C:\Windows\System\gECLoRo.exe
  2⤵
  PID:8012
- C:\Windows\System\JibArOp.exe
  C:\Windows\System\JibArOp.exe
  2⤵
  PID:7296
- C:\Windows\System\IOuUISW.exe
  C:\Windows\System\IOuUISW.exe
  2⤵
  PID:3748
- C:\Windows\System\IuoEZRE.exe
  C:\Windows\System\IuoEZRE.exe
  2⤵
  PID:4628
- C:\Windows\System\ToEJeUV.exe
  C:\Windows\System\ToEJeUV.exe
  2⤵
  PID:7300
- C:\Windows\System\GtbKifP.exe
  C:\Windows\System\GtbKifP.exe
  2⤵
  PID:8208
- C:\Windows\System\mJcsPdX.exe
  C:\Windows\System\mJcsPdX.exe
  2⤵
  PID:8244
- C:\Windows\System\CrdOSYp.exe
  C:\Windows\System\CrdOSYp.exe
  2⤵
  PID:8260
- C:\Windows\System\jnUGSaC.exe
  C:\Windows\System\jnUGSaC.exe
  2⤵
  PID:8276
- C:\Windows\System\QurOPoN.exe
  C:\Windows\System\QurOPoN.exe
  2⤵
  PID:8292
- C:\Windows\System\FROjnwo.exe
  C:\Windows\System\FROjnwo.exe
  2⤵
  PID:8316
- C:\Windows\System\cvVuyug.exe
  C:\Windows\System\cvVuyug.exe
  2⤵
  PID:8340
- C:\Windows\System\lQPaBqe.exe
  C:\Windows\System\lQPaBqe.exe
  2⤵
  PID:8424
- C:\Windows\System\KbMYQla.exe
  C:\Windows\System\KbMYQla.exe
  2⤵
  PID:8440
- C:\Windows\System\pqlgEqh.exe
  C:\Windows\System\pqlgEqh.exe
  2⤵
  PID:8460
- C:\Windows\System\HDpeJQM.exe
  C:\Windows\System\HDpeJQM.exe
  2⤵
  PID:8480
- C:\Windows\System\lZPeipb.exe
  C:\Windows\System\lZPeipb.exe
  2⤵
  PID:8500
- C:\Windows\System\sSimPqi.exe
  C:\Windows\System\sSimPqi.exe
  2⤵
  PID:8552
- C:\Windows\System\WZACNoL.exe
  C:\Windows\System\WZACNoL.exe
  2⤵
  PID:8584
- C:\Windows\System\euMOvlr.exe
  C:\Windows\System\euMOvlr.exe
  2⤵
  PID:8608
- C:\Windows\System\wgjjdjs.exe
  C:\Windows\System\wgjjdjs.exe
  2⤵
  PID:8652
- C:\Windows\System\aOteHFm.exe
  C:\Windows\System\aOteHFm.exe
  2⤵
  PID:8688
- C:\Windows\System\pCwGPeT.exe
  C:\Windows\System\pCwGPeT.exe
  2⤵
  PID:8716
- C:\Windows\System\aWAorvp.exe
  C:\Windows\System\aWAorvp.exe
  2⤵
  PID:8732
- C:\Windows\System\uTFkoto.exe
  C:\Windows\System\uTFkoto.exe
  2⤵
  PID:8772
- C:\Windows\System\yNqXFuK.exe
  C:\Windows\System\yNqXFuK.exe
  2⤵
  PID:8800
- C:\Windows\System\iGrqzAV.exe
  C:\Windows\System\iGrqzAV.exe
  2⤵
  PID:8820
- C:\Windows\System\UjUlWJW.exe
  C:\Windows\System\UjUlWJW.exe
  2⤵
  PID:8856
- C:\Windows\System\mAXyegl.exe
  C:\Windows\System\mAXyegl.exe
  2⤵
  PID:8872
- C:\Windows\System\MGDRVIU.exe
  C:\Windows\System\MGDRVIU.exe
  2⤵
  PID:8908
- C:\Windows\System\bdfosql.exe
  C:\Windows\System\bdfosql.exe
  2⤵
  PID:8932
- C:\Windows\System\yAZCYRe.exe
  C:\Windows\System\yAZCYRe.exe
  2⤵
  PID:8968
- C:\Windows\System\bxYTOfC.exe
  C:\Windows\System\bxYTOfC.exe
  2⤵
  PID:8996
- C:\Windows\System\zKRekUD.exe
  C:\Windows\System\zKRekUD.exe
  2⤵
  PID:9016
- C:\Windows\System\WpDnxRc.exe
  C:\Windows\System\WpDnxRc.exe
  2⤵
  PID:9040
- C:\Windows\System\AHAsyWf.exe
  C:\Windows\System\AHAsyWf.exe
  2⤵
  PID:9080
- C:\Windows\System\CsrHkQk.exe
  C:\Windows\System\CsrHkQk.exe
  2⤵
  PID:9108
- C:\Windows\System\NqMimMG.exe
  C:\Windows\System\NqMimMG.exe
  2⤵
  PID:9136
- C:\Windows\System\YFVFuCU.exe
  C:\Windows\System\YFVFuCU.exe
  2⤵
  PID:9152
- C:\Windows\System\XufzaEY.exe
  C:\Windows\System\XufzaEY.exe
  2⤵
  PID:9192
- C:\Windows\System\hCBDoQb.exe
  C:\Windows\System\hCBDoQb.exe
  2⤵
  PID:9208
- C:\Windows\System\ZmSPncR.exe
  C:\Windows\System\ZmSPncR.exe
  2⤵
  PID:2360
- C:\Windows\System\KzVAzvx.exe
  C:\Windows\System\KzVAzvx.exe
  2⤵
  PID:8288
- C:\Windows\System\dLhMLaX.exe
  C:\Windows\System\dLhMLaX.exe
  2⤵
  PID:8356
- C:\Windows\System\wlyITPv.exe
  C:\Windows\System\wlyITPv.exe
  2⤵
  PID:8412
- C:\Windows\System\VobMuFl.exe
  C:\Windows\System\VobMuFl.exe
  2⤵
  PID:8528
- C:\Windows\System\vRidlre.exe
  C:\Windows\System\vRidlre.exe
  2⤵
  PID:8496
- C:\Windows\System\kdeZtnn.exe
  C:\Windows\System\kdeZtnn.exe
  2⤵
  PID:8564
- C:\Windows\System\QWnScaV.exe
  C:\Windows\System\QWnScaV.exe
  2⤵
  PID:8640
- C:\Windows\System\QBJLrVb.exe
  C:\Windows\System\QBJLrVb.exe
  2⤵
  PID:8768
- C:\Windows\System\gNkXVkm.exe
  C:\Windows\System\gNkXVkm.exe
  2⤵
  PID:8840
- C:\Windows\System\qArOhFk.exe
  C:\Windows\System\qArOhFk.exe
  2⤵
  PID:8868
- C:\Windows\System\bDqpoBm.exe
  C:\Windows\System\bDqpoBm.exe
  2⤵
  PID:8924
- C:\Windows\System\CVtzMjK.exe
  C:\Windows\System\CVtzMjK.exe
  2⤵
  PID:8988
- C:\Windows\System\LvXIGcg.exe
  C:\Windows\System\LvXIGcg.exe
  2⤵
  PID:9032
- C:\Windows\System\mGpLawV.exe
  C:\Windows\System\mGpLawV.exe
  2⤵
  PID:920
- C:\Windows\System\FQWmFYz.exe
  C:\Windows\System\FQWmFYz.exe
  2⤵
  PID:9144
- C:\Windows\System\vDpsChZ.exe
  C:\Windows\System\vDpsChZ.exe
  2⤵
  PID:7856
- C:\Windows\System\ctKxQos.exe
  C:\Windows\System\ctKxQos.exe
  2⤵
  PID:8328
- C:\Windows\System\zXUGiJm.exe
  C:\Windows\System\zXUGiJm.exe
  2⤵
  PID:8512
- C:\Windows\System\hHjxlZh.exe
  C:\Windows\System\hHjxlZh.exe
  2⤵
  PID:8624
- C:\Windows\System\IEwAEUo.exe
  C:\Windows\System\IEwAEUo.exe
  2⤵
  PID:8796
- C:\Windows\System\FuFOBtN.exe
  C:\Windows\System\FuFOBtN.exe
  2⤵
  PID:8952
- C:\Windows\System\iNVeMiS.exe
  C:\Windows\System\iNVeMiS.exe
  2⤵
  PID:8204
- C:\Windows\System\IYmTZeI.exe
  C:\Windows\System\IYmTZeI.exe
  2⤵
  PID:8572
- C:\Windows\System\FEjsTBF.exe
  C:\Windows\System\FEjsTBF.exe
  2⤵
  PID:8864
- C:\Windows\System\XSNJoGI.exe
  C:\Windows\System\XSNJoGI.exe
  2⤵
  PID:9064
- C:\Windows\System\FxVbRUY.exe
  C:\Windows\System\FxVbRUY.exe
  2⤵
  PID:9012
- C:\Windows\System\rDiCYlZ.exe
  C:\Windows\System\rDiCYlZ.exe
  2⤵
  PID:8724
- C:\Windows\System\GPvplhf.exe
  C:\Windows\System\GPvplhf.exe
  2⤵
  PID:9244
- C:\Windows\System\AiXyUPQ.exe
  C:\Windows\System\AiXyUPQ.exe
  2⤵
  PID:9268
- C:\Windows\System\ZquNsyE.exe
  C:\Windows\System\ZquNsyE.exe
  2⤵
  PID:9308
- C:\Windows\System\kFwqcVg.exe
  C:\Windows\System\kFwqcVg.exe
  2⤵
  PID:9324
- C:\Windows\System\QMDpaqG.exe
  C:\Windows\System\QMDpaqG.exe
  2⤵
  PID:9364
- C:\Windows\System\sLDZMJG.exe
  C:\Windows\System\sLDZMJG.exe
  2⤵
  PID:9384
- C:\Windows\System\jKUTpJN.exe
  C:\Windows\System\jKUTpJN.exe
  2⤵
  PID:9408
- C:\Windows\System\BaPvPiC.exe
  C:\Windows\System\BaPvPiC.exe
  2⤵
  PID:9444
- C:\Windows\System\DjZbIFI.exe
  C:\Windows\System\DjZbIFI.exe
  2⤵
  PID:9464
- C:\Windows\System\LrgAdrr.exe
  C:\Windows\System\LrgAdrr.exe
  2⤵
  PID:9492
- C:\Windows\System\OvbYaOT.exe
  C:\Windows\System\OvbYaOT.exe
  2⤵
  PID:9528
- C:\Windows\System\awsteEY.exe
  C:\Windows\System\awsteEY.exe
  2⤵
  PID:9548
- C:\Windows\System\vmSriqr.exe
  C:\Windows\System\vmSriqr.exe
  2⤵
  PID:9588
- C:\Windows\System\CWGCGIR.exe
  C:\Windows\System\CWGCGIR.exe
  2⤵
  PID:9604
- C:\Windows\System\eghOkdv.exe
  C:\Windows\System\eghOkdv.exe
  2⤵
  PID:9644
- C:\Windows\System\CGnCCRI.exe
  C:\Windows\System\CGnCCRI.exe
  2⤵
  PID:9664
- C:\Windows\System\euAVGXh.exe
  C:\Windows\System\euAVGXh.exe
  2⤵
  PID:9700
- C:\Windows\System\tmgiVWd.exe
  C:\Windows\System\tmgiVWd.exe
  2⤵
  PID:9716
- C:\Windows\System\CuseKsw.exe
  C:\Windows\System\CuseKsw.exe
  2⤵
  PID:9756
- C:\Windows\System\haiXNXl.exe
  C:\Windows\System\haiXNXl.exe
  2⤵
  PID:9780
- C:\Windows\System\QeEITeb.exe
  C:\Windows\System\QeEITeb.exe
  2⤵
  PID:9796
- C:\Windows\System\eEHCgBf.exe
  C:\Windows\System\eEHCgBf.exe
  2⤵
  PID:9824
- C:\Windows\System\GcOWhcp.exe
  C:\Windows\System\GcOWhcp.exe
  2⤵
  PID:9844
- C:\Windows\System\pHSIMOt.exe
  C:\Windows\System\pHSIMOt.exe
  2⤵
  PID:9888
- C:\Windows\System\CSOliya.exe
  C:\Windows\System\CSOliya.exe
  2⤵
  PID:9912
- C:\Windows\System\qhuMypX.exe
  C:\Windows\System\qhuMypX.exe
  2⤵
  PID:9936
- C:\Windows\System\JweneKc.exe
  C:\Windows\System\JweneKc.exe
  2⤵
  PID:9956
- C:\Windows\System\tanFNGm.exe
  C:\Windows\System\tanFNGm.exe
  2⤵
  PID:9984
- C:\Windows\System\lDdOjbz.exe
  C:\Windows\System\lDdOjbz.exe
  2⤵
  PID:10012
- C:\Windows\System\JGoUCfx.exe
  C:\Windows\System\JGoUCfx.exe
  2⤵
  PID:10060
- C:\Windows\System\PuPomFp.exe
  C:\Windows\System\PuPomFp.exe
  2⤵
  PID:10080
- C:\Windows\System\lEDKyCw.exe
  C:\Windows\System\lEDKyCw.exe
  2⤵
  PID:10120
- C:\Windows\System\iRbMjNC.exe
  C:\Windows\System\iRbMjNC.exe
  2⤵
  PID:10148
- C:\Windows\System\LUktYGh.exe
  C:\Windows\System\LUktYGh.exe
  2⤵
  PID:10168
- C:\Windows\System\hVybtMO.exe
  C:\Windows\System\hVybtMO.exe
  2⤵
  PID:10192
- C:\Windows\System\ILjnKIv.exe
  C:\Windows\System\ILjnKIv.exe
  2⤵
  PID:10232
- C:\Windows\System\ggFoPAu.exe
  C:\Windows\System\ggFoPAu.exe
  2⤵
  PID:9232
- C:\Windows\System\IUGZrcU.exe
  C:\Windows\System\IUGZrcU.exe
  2⤵
  PID:9240
- C:\Windows\System\NwIfIMT.exe
  C:\Windows\System\NwIfIMT.exe
  2⤵
  PID:9316
- C:\Windows\System\RWKfzmF.exe
  C:\Windows\System\RWKfzmF.exe
  2⤵
  PID:9396
- C:\Windows\System\pEtXVtW.exe
  C:\Windows\System\pEtXVtW.exe
  2⤵
  PID:9480
- C:\Windows\System\kCuQuty.exe
  C:\Windows\System\kCuQuty.exe
  2⤵
  PID:9540
- C:\Windows\System\gDELdVb.exe
  C:\Windows\System\gDELdVb.exe
  2⤵
  PID:9596
- C:\Windows\System\bHbXBQS.exe
  C:\Windows\System\bHbXBQS.exe
  2⤵
  PID:9684
- C:\Windows\System\kzKLwpS.exe
  C:\Windows\System\kzKLwpS.exe
  2⤵
  PID:9744
- C:\Windows\System\wPZQoKb.exe
  C:\Windows\System\wPZQoKb.exe
  2⤵
  PID:9776
- C:\Windows\System\adWCuaq.exe
  C:\Windows\System\adWCuaq.exe
  2⤵
  PID:9816
- C:\Windows\System\ZZISxlV.exe
  C:\Windows\System\ZZISxlV.exe
  2⤵
  PID:9876
- C:\Windows\System\SqXVRYh.exe
  C:\Windows\System\SqXVRYh.exe
  2⤵
  PID:9928
- C:\Windows\System\XJyGuOa.exe
  C:\Windows\System\XJyGuOa.exe
  2⤵
  PID:10044
- C:\Windows\System\lnvnakH.exe
  C:\Windows\System\lnvnakH.exe
  2⤵
  PID:10112
- C:\Windows\System\DmVJVCC.exe
  C:\Windows\System\DmVJVCC.exe
  2⤵
  PID:10176
- C:\Windows\System\BBKaRDV.exe
  C:\Windows\System\BBKaRDV.exe
  2⤵
  PID:10224
- C:\Windows\System\eGeRcXr.exe
  C:\Windows\System\eGeRcXr.exe
  2⤵
  PID:8312
- C:\Windows\System\SCZdeXi.exe
  C:\Windows\System\SCZdeXi.exe
  2⤵
  PID:9380
- C:\Windows\System\iESPOiT.exe
  C:\Windows\System\iESPOiT.exe
  2⤵
  PID:9524
- C:\Windows\System\QnVYJhZ.exe
  C:\Windows\System\QnVYJhZ.exe
  2⤵
  PID:9628
- C:\Windows\System\rtNbLQS.exe
  C:\Windows\System\rtNbLQS.exe
  2⤵
  PID:9884
- C:\Windows\System\OvmuZDR.exe
  C:\Windows\System\OvmuZDR.exe
  2⤵
  PID:9944
- C:\Windows\System\KWwsKEJ.exe
  C:\Windows\System\KWwsKEJ.exe
  2⤵
  PID:10104
- C:\Windows\System\qDvPFQX.exe
  C:\Windows\System\qDvPFQX.exe
  2⤵
  PID:9228
- C:\Windows\System\hTogCFI.exe
  C:\Windows\System\hTogCFI.exe
  2⤵
  PID:9708
- C:\Windows\System\jXFCQlo.exe
  C:\Windows\System\jXFCQlo.exe
  2⤵
  PID:9864
- C:\Windows\System\lfFiDBE.exe
  C:\Windows\System\lfFiDBE.exe
  2⤵
  PID:9280
- C:\Windows\System\BUFVAMU.exe
  C:\Windows\System\BUFVAMU.exe
  2⤵
  PID:10252
- C:\Windows\System\smpYMmF.exe
  C:\Windows\System\smpYMmF.exe
  2⤵
  PID:10276
- C:\Windows\System\nOvpXXa.exe
  C:\Windows\System\nOvpXXa.exe
  2⤵
  PID:10296
- C:\Windows\System\WCzrpdw.exe
  C:\Windows\System\WCzrpdw.exe
  2⤵
  PID:10348
- C:\Windows\System\KDUviob.exe
  C:\Windows\System\KDUviob.exe
  2⤵
  PID:10372
- C:\Windows\System\wypcfyz.exe
  C:\Windows\System\wypcfyz.exe
  2⤵
  PID:10392
- C:\Windows\System\PYDMIxe.exe
  C:\Windows\System\PYDMIxe.exe
  2⤵
  PID:10432
- C:\Windows\System\AlcZusC.exe
  C:\Windows\System\AlcZusC.exe
  2⤵
  PID:10460
- C:\Windows\System\OvHOXOX.exe
  C:\Windows\System\OvHOXOX.exe
  2⤵
  PID:10488
- C:\Windows\System\vwJHtOD.exe
  C:\Windows\System\vwJHtOD.exe
  2⤵
  PID:10520
- C:\Windows\System\cgRtanQ.exe
  C:\Windows\System\cgRtanQ.exe
  2⤵
  PID:10544
- C:\Windows\System\OzbXIAm.exe
  C:\Windows\System\OzbXIAm.exe
  2⤵
  PID:10568
- C:\Windows\System\dEUCGyn.exe
  C:\Windows\System\dEUCGyn.exe
  2⤵
  PID:10592
- C:\Windows\System\REethvO.exe
  C:\Windows\System\REethvO.exe
  2⤵
  PID:10616
- C:\Windows\System\FgZaILQ.exe
  C:\Windows\System\FgZaILQ.exe
  2⤵
  PID:10668
- C:\Windows\System\cxJAhba.exe
  C:\Windows\System\cxJAhba.exe
  2⤵
  PID:10696
- C:\Windows\System\XZtBBWZ.exe
  C:\Windows\System\XZtBBWZ.exe
  2⤵
  PID:10724
- C:\Windows\System\OCbCQIT.exe
  C:\Windows\System\OCbCQIT.exe
  2⤵
  PID:10748
- C:\Windows\System\ZoFmbCW.exe
  C:\Windows\System\ZoFmbCW.exe
  2⤵
  PID:10780
- C:\Windows\System\GwrryaK.exe
  C:\Windows\System\GwrryaK.exe
  2⤵
  PID:10808
- C:\Windows\System\yEDTDae.exe
  C:\Windows\System\yEDTDae.exe
  2⤵
  PID:10824
- C:\Windows\System\tfwxvIT.exe
  C:\Windows\System\tfwxvIT.exe
  2⤵
  PID:10864
- C:\Windows\System\WpXrLUZ.exe
  C:\Windows\System\WpXrLUZ.exe
  2⤵
  PID:10892
- C:\Windows\System\wOupYnE.exe
  C:\Windows\System\wOupYnE.exe
  2⤵
  PID:10920
- C:\Windows\System\tQxmWIN.exe
  C:\Windows\System\tQxmWIN.exe
  2⤵
  PID:10944
- C:\Windows\System\jYvZHMX.exe
  C:\Windows\System\jYvZHMX.exe
  2⤵
  PID:10972
- C:\Windows\System\PyAnKKF.exe
  C:\Windows\System\PyAnKKF.exe
  2⤵
  PID:11000
- C:\Windows\System\rmFoIXc.exe
  C:\Windows\System\rmFoIXc.exe
  2⤵
  PID:11020
- C:\Windows\System\bwdLMpX.exe
  C:\Windows\System\bwdLMpX.exe
  2⤵
  PID:11076
- C:\Windows\System\fLBYdkd.exe
  C:\Windows\System\fLBYdkd.exe
  2⤵
  PID:11104
- C:\Windows\System\cTYbpis.exe
  C:\Windows\System\cTYbpis.exe
  2⤵
  PID:11132
- C:\Windows\System\EokLuIf.exe
  C:\Windows\System\EokLuIf.exe
  2⤵
  PID:11160
- C:\Windows\System\FcJVcHX.exe
  C:\Windows\System\FcJVcHX.exe
  2⤵
  PID:11180
- C:\Windows\System\chJhfAH.exe
  C:\Windows\System\chJhfAH.exe
  2⤵
  PID:11204
- C:\Windows\System\bStcRHr.exe
  C:\Windows\System\bStcRHr.exe
  2⤵
  PID:11244
- C:\Windows\System\iADAnoB.exe
  C:\Windows\System\iADAnoB.exe
  2⤵
  PID:10244
- C:\Windows\System\bUcOQsa.exe
  C:\Windows\System\bUcOQsa.exe
  2⤵
  PID:10332
- C:\Windows\System\VlEoYYv.exe
  C:\Windows\System\VlEoYYv.exe
  2⤵
  PID:10316
- C:\Windows\System\aABuEbY.exe
  C:\Windows\System\aABuEbY.exe
  2⤵
  PID:10368
- C:\Windows\System\OkjQZkx.exe
  C:\Windows\System\OkjQZkx.exe
  2⤵
  PID:10448
- C:\Windows\System\nzhixXr.exe
  C:\Windows\System\nzhixXr.exe
  2⤵
  PID:10512
- C:\Windows\System\PVBMmQg.exe
  C:\Windows\System\PVBMmQg.exe
  2⤵
  PID:10588
- C:\Windows\System\YbTrbqZ.exe
  C:\Windows\System\YbTrbqZ.exe
  2⤵
  PID:10656
- C:\Windows\System\rbODOvN.exe
  C:\Windows\System\rbODOvN.exe
  2⤵
  PID:10756
- C:\Windows\System\YzkGvMn.exe
  C:\Windows\System\YzkGvMn.exe
  2⤵
  PID:10816
- C:\Windows\System\bWOgfvA.exe
  C:\Windows\System\bWOgfvA.exe
  2⤵
  PID:10880
- C:\Windows\System\PpTyyQh.exe
  C:\Windows\System\PpTyyQh.exe
  2⤵
  PID:10992
- C:\Windows\System\rlUwwIe.exe
  C:\Windows\System\rlUwwIe.exe
  2⤵
  PID:11040
- C:\Windows\System\dSAeFSJ.exe
  C:\Windows\System\dSAeFSJ.exe
  2⤵
  PID:11100
- C:\Windows\System\KOMwGal.exe
  C:\Windows\System\KOMwGal.exe
  2⤵
  PID:11200
- C:\Windows\System\IVTUkuZ.exe
  C:\Windows\System\IVTUkuZ.exe
  2⤵
  PID:9772
- C:\Windows\System\boTAWCp.exe
  C:\Windows\System\boTAWCp.exe
  2⤵
  PID:11252
- C:\Windows\System\CMrXykb.exe
  C:\Windows\System\CMrXykb.exe
  2⤵
  PID:10472
- C:\Windows\System\zknKqed.exe
  C:\Windows\System\zknKqed.exe
  2⤵
  PID:10712
- C:\Windows\System\zcioDKP.exe
  C:\Windows\System\zcioDKP.exe
  2⤵
  PID:10856
- C:\Windows\System\DeqHcnz.exe
  C:\Windows\System\DeqHcnz.exe
  2⤵
  PID:11036
- C:\Windows\System\axRhBUS.exe
  C:\Windows\System\axRhBUS.exe
  2⤵
  PID:11192
- C:\Windows\System\SkQXwVX.exe
  C:\Windows\System\SkQXwVX.exe
  2⤵
  PID:11240
- C:\Windows\System\ybQxTbL.exe
  C:\Windows\System\ybQxTbL.exe
  2⤵
  PID:10404
- C:\Windows\System\VMKwzru.exe
  C:\Windows\System\VMKwzru.exe
  2⤵
  PID:10776
- C:\Windows\System\xDkPsmr.exe
  C:\Windows\System\xDkPsmr.exe
  2⤵
  PID:11048
- C:\Windows\System\raEJtwb.exe
  C:\Windows\System\raEJtwb.exe
  2⤵
  PID:10652
- C:\Windows\System\uDkqMqW.exe
  C:\Windows\System\uDkqMqW.exe
  2⤵
  PID:11292
- C:\Windows\System\wsJIXgO.exe
  C:\Windows\System\wsJIXgO.exe
  2⤵
  PID:11316
- C:\Windows\System\wwnprYV.exe
  C:\Windows\System\wwnprYV.exe
  2⤵
  PID:11344
- C:\Windows\System\yNiOgSL.exe
  C:\Windows\System\yNiOgSL.exe
  2⤵
  PID:11376
- C:\Windows\System\xogYVHG.exe
  C:\Windows\System\xogYVHG.exe
  2⤵
  PID:11428
- C:\Windows\System\OSADuaX.exe
  C:\Windows\System\OSADuaX.exe
  2⤵
  PID:11456
- C:\Windows\System\tPBXFUW.exe
  C:\Windows\System\tPBXFUW.exe
  2⤵
  PID:11484
- C:\Windows\System\qGXHPlv.exe
  C:\Windows\System\qGXHPlv.exe
  2⤵
  PID:11528
- C:\Windows\System\dODpWyj.exe
  C:\Windows\System\dODpWyj.exe
  2⤵
  PID:11556
- C:\Windows\System\HmlhDhw.exe
  C:\Windows\System\HmlhDhw.exe
  2⤵
  PID:11584
- C:\Windows\System\OiNaOAC.exe
  C:\Windows\System\OiNaOAC.exe
  2⤵
  PID:11612
- C:\Windows\System\JXGmSpK.exe
  C:\Windows\System\JXGmSpK.exe
  2⤵
  PID:11640
- C:\Windows\System\SrUsXUs.exe
  C:\Windows\System\SrUsXUs.exe
  2⤵
  PID:11656
- C:\Windows\System\fElGvVh.exe
  C:\Windows\System\fElGvVh.exe
  2⤵
  PID:11676
- C:\Windows\System\rqKHvch.exe
  C:\Windows\System\rqKHvch.exe
  2⤵
  PID:11704
- C:\Windows\System\YQKOitJ.exe
  C:\Windows\System\YQKOitJ.exe
  2⤵
  PID:11728
- C:\Windows\System\JUvSRFN.exe
  C:\Windows\System\JUvSRFN.exe
  2⤵
  PID:11760
- C:\Windows\System\upKLkQW.exe
  C:\Windows\System\upKLkQW.exe
  2⤵
  PID:11792
- C:\Windows\System\vDFBbnd.exe
  C:\Windows\System\vDFBbnd.exe
  2⤵
  PID:11816
- C:\Windows\System\GxRvaKS.exe
  C:\Windows\System\GxRvaKS.exe
  2⤵
  PID:11864
- C:\Windows\System\MCjMVST.exe
  C:\Windows\System\MCjMVST.exe
  2⤵
  PID:11892
- C:\Windows\System\QGGuiGA.exe
  C:\Windows\System\QGGuiGA.exe
  2⤵
  PID:11916
- C:\Windows\System\LAWZhMg.exe
  C:\Windows\System\LAWZhMg.exe
  2⤵
  PID:11944
- C:\Windows\System\rINWgSW.exe
  C:\Windows\System\rINWgSW.exe
  2⤵
  PID:11964
- C:\Windows\System\fgiopeC.exe
  C:\Windows\System\fgiopeC.exe
  2⤵
  PID:11988
- C:\Windows\System\fPrAyDS.exe
  C:\Windows\System\fPrAyDS.exe
  2⤵
  PID:12016
- C:\Windows\System\FSymqnJ.exe
  C:\Windows\System\FSymqnJ.exe
  2⤵
  PID:12052
- C:\Windows\System\BecRtNf.exe
  C:\Windows\System\BecRtNf.exe
  2⤵
  PID:12092
- C:\Windows\System\dYGAgxM.exe
  C:\Windows\System\dYGAgxM.exe
  2⤵
  PID:12120
- C:\Windows\System\EhaaaoR.exe
  C:\Windows\System\EhaaaoR.exe
  2⤵
  PID:12140
- C:\Windows\System\tbXbKOV.exe
  C:\Windows\System\tbXbKOV.exe
  2⤵
  PID:12164
- C:\Windows\System\BWAHJgv.exe
  C:\Windows\System\BWAHJgv.exe
  2⤵
  PID:12204
- C:\Windows\System\mkciIMw.exe
  C:\Windows\System\mkciIMw.exe
  2⤵
  PID:12224
- C:\Windows\System\eWCujAM.exe
  C:\Windows\System\eWCujAM.exe
  2⤵
  PID:12248
- C:\Windows\System\mdmvwdN.exe
  C:\Windows\System\mdmvwdN.exe
  2⤵
  PID:12272
- C:\Windows\System\KOtlRPx.exe
  C:\Windows\System\KOtlRPx.exe
  2⤵
  PID:10292
- C:\Windows\System\FUpIzxf.exe
  C:\Windows\System\FUpIzxf.exe
  2⤵
  PID:11332
- C:\Windows\System\RUSwgRf.exe
  C:\Windows\System\RUSwgRf.exe
  2⤵
  PID:11392
- C:\Windows\System\BNfTLKI.exe
  C:\Windows\System\BNfTLKI.exe
  2⤵
  PID:11452
- C:\Windows\System\dICdDzL.exe
  C:\Windows\System\dICdDzL.exe
  2⤵
  PID:11512
- C:\Windows\System\ArtdwDq.exe
  C:\Windows\System\ArtdwDq.exe
  2⤵
  PID:11572
- C:\Windows\System\mTJQldt.exe
  C:\Windows\System\mTJQldt.exe
  2⤵
  PID:11600
- C:\Windows\System\mmHGEFl.exe
  C:\Windows\System\mmHGEFl.exe
  2⤵
  PID:11684
- C:\Windows\System\QgnbrkK.exe
  C:\Windows\System\QgnbrkK.exe
  2⤵
  PID:11772
- C:\Windows\System\AQOBrOn.exe
  C:\Windows\System\AQOBrOn.exe
  2⤵
  PID:11824
- C:\Windows\System\pSzsejM.exe
  C:\Windows\System\pSzsejM.exe
  2⤵
  PID:8664
- C:\Windows\System\UkWWrSa.exe
  C:\Windows\System\UkWWrSa.exe
  2⤵
  PID:11888
- C:\Windows\System\mKJStnf.exe
  C:\Windows\System\mKJStnf.exe
  2⤵
  PID:11940
- C:\Windows\System\OkKTzHJ.exe
  C:\Windows\System\OkKTzHJ.exe
  2⤵
  PID:11960
- C:\Windows\System\EeEhFyC.exe
  C:\Windows\System\EeEhFyC.exe
  2⤵
  PID:12084
- C:\Windows\System\pWnUCZO.exe
  C:\Windows\System\pWnUCZO.exe
  2⤵
  PID:12152
- C:\Windows\System\mfJGazM.exe
  C:\Windows\System\mfJGazM.exe
  2⤵
  PID:12192
- C:\Windows\System\vMvLTMl.exe
  C:\Windows\System\vMvLTMl.exe
  2⤵
  PID:12284
- C:\Windows\System\gtjUeGq.exe
  C:\Windows\System\gtjUeGq.exe
  2⤵
  PID:11368
- C:\Windows\System\HMpdIks.exe
  C:\Windows\System\HMpdIks.exe
  2⤵
  PID:11552
- C:\Windows\System\zXVOBEy.exe
  C:\Windows\System\zXVOBEy.exe
  2⤵
  PID:11740
- C:\Windows\System\dRUPOak.exe
  C:\Windows\System\dRUPOak.exe
  2⤵
  PID:1728
- C:\Windows\System\Qdnxcfi.exe
  C:\Windows\System\Qdnxcfi.exe
  2⤵
  PID:11952
- C:\Windows\System\eCPJNYA.exe
  C:\Windows\System\eCPJNYA.exe
  2⤵
  PID:12232
- C:\Windows\System\LaqDlux.exe
  C:\Windows\System\LaqDlux.exe
  2⤵
  PID:11236
- C:\Windows\System\qcetjqA.exe
  C:\Windows\System\qcetjqA.exe
  2⤵
  PID:11596
- C:\Windows\System\bhxprzg.exe
  C:\Windows\System\bhxprzg.exe
  2⤵
  PID:11752
- C:\Windows\System\dsleJKr.exe
  C:\Windows\System\dsleJKr.exe
  2⤵
  PID:12128
- C:\Windows\System\ZdkUKOM.exe
  C:\Windows\System\ZdkUKOM.exe
  2⤵
  PID:11304
- C:\Windows\System\PkdFPBz.exe
  C:\Windows\System\PkdFPBz.exe
  2⤵
  PID:12308
- C:\Windows\System\aGZwNqr.exe
  C:\Windows\System\aGZwNqr.exe
  2⤵
  PID:12332
- C:\Windows\System\WfHlVpv.exe
  C:\Windows\System\WfHlVpv.exe
  2⤵
  PID:12364
- C:\Windows\System\hAyEoTl.exe
  C:\Windows\System\hAyEoTl.exe
  2⤵
  PID:12388
- C:\Windows\System\HeilrjR.exe
  C:\Windows\System\HeilrjR.exe
  2⤵
  PID:12420
- C:\Windows\System\YWkgLUY.exe
  C:\Windows\System\YWkgLUY.exe
  2⤵
  PID:12440
- C:\Windows\System\rIHgVog.exe
  C:\Windows\System\rIHgVog.exe
  2⤵
  PID:12464
- C:\Windows\System\xDWrpoZ.exe
  C:\Windows\System\xDWrpoZ.exe
  2⤵
  PID:12496
- C:\Windows\System\wfzSPBJ.exe
  C:\Windows\System\wfzSPBJ.exe
  2⤵
  PID:12520
- C:\Windows\System\NPjsemM.exe
  C:\Windows\System\NPjsemM.exe
  2⤵
  PID:12536
- C:\Windows\System\IfVlZXS.exe
  C:\Windows\System\IfVlZXS.exe
  2⤵
  PID:12572
- C:\Windows\System\EJhKuqv.exe
  C:\Windows\System\EJhKuqv.exe
  2⤵
  PID:12592
- C:\Windows\System\zygdZIa.exe
  C:\Windows\System\zygdZIa.exe
  2⤵
  PID:12632
- C:\Windows\System\dZWBpDs.exe
  C:\Windows\System\dZWBpDs.exe
  2⤵
  PID:12652
- C:\Windows\System\MCBmXCG.exe
  C:\Windows\System\MCBmXCG.exe
  2⤵
  PID:12672
- C:\Windows\System\nZeMQrb.exe
  C:\Windows\System\nZeMQrb.exe
  2⤵
  PID:12704
- C:\Windows\System\KXoDQJT.exe
  C:\Windows\System\KXoDQJT.exe
  2⤵
  PID:12756
- C:\Windows\System\TjQBKDN.exe
  C:\Windows\System\TjQBKDN.exe
  2⤵
  PID:12772
- C:\Windows\System\PcAZtwi.exe
  C:\Windows\System\PcAZtwi.exe
  2⤵
  PID:12800
- C:\Windows\System\mABjzqa.exe
  C:\Windows\System\mABjzqa.exe
  2⤵
  PID:12824
- C:\Windows\System\WKZlVlX.exe
  C:\Windows\System\WKZlVlX.exe
  2⤵
  PID:12852
- C:\Windows\System\EComBPz.exe
  C:\Windows\System\EComBPz.exe
  2⤵
  PID:12880
- C:\Windows\System\wYiwMCM.exe
  C:\Windows\System\wYiwMCM.exe
  2⤵
  PID:12924
- C:\Windows\System\yJzwyUc.exe
  C:\Windows\System\yJzwyUc.exe
  2⤵
  PID:12952
- C:\Windows\System\OeMxfFT.exe
  C:\Windows\System\OeMxfFT.exe
  2⤵
  PID:12972
- C:\Windows\System\FlEBJLy.exe
  C:\Windows\System\FlEBJLy.exe
  2⤵
  PID:12996
- C:\Windows\System\oOxnyHx.exe
  C:\Windows\System\oOxnyHx.exe
  2⤵
  PID:13032
- C:\Windows\System\lXmGJfL.exe
  C:\Windows\System\lXmGJfL.exe
  2⤵
  PID:13064
- C:\Windows\System\CAgIrca.exe
  C:\Windows\System\CAgIrca.exe
  2⤵
  PID:13092
- C:\Windows\System\aARZgzI.exe
  C:\Windows\System\aARZgzI.exe
  2⤵
  PID:13120
- C:\Windows\System\ijAJFCZ.exe
  C:\Windows\System\ijAJFCZ.exe
  2⤵
  PID:13136
- C:\Windows\System\LueXKsX.exe
  C:\Windows\System\LueXKsX.exe
  2⤵
  PID:13160
- C:\Windows\System\mTzGzPc.exe
  C:\Windows\System\mTzGzPc.exe
  2⤵
  PID:13188
- C:\Windows\System\MIZrSsI.exe
  C:\Windows\System\MIZrSsI.exe
  2⤵
  PID:13212
- C:\Windows\System\AyNtUpT.exe
  C:\Windows\System\AyNtUpT.exe
  2⤵
  PID:13236
- C:\Windows\System\LCYmSnI.exe
  C:\Windows\System\LCYmSnI.exe
  2⤵
  PID:13276
- C:\Windows\System\DTRSiSt.exe
  C:\Windows\System\DTRSiSt.exe
  2⤵
  PID:13296
- C:\Windows\System\tPnFFQC.exe
  C:\Windows\System\tPnFFQC.exe
  2⤵
  PID:12324
- C:\Windows\System\bOzyMLW.exe
  C:\Windows\System\bOzyMLW.exe
  2⤵
  PID:12352
- C:\Windows\System\polMUdb.exe
  C:\Windows\System\polMUdb.exe
  2⤵
  PID:12412
- C:\Windows\System\ZRkhsYl.exe
  C:\Windows\System\ZRkhsYl.exe
  2⤵
  PID:12428
- C:\Windows\System\XHnKaty.exe
  C:\Windows\System\XHnKaty.exe
  2⤵
  PID:12488
- C:\Windows\System\uvdRStT.exe
  C:\Windows\System\uvdRStT.exe
  2⤵
  PID:12612
- C:\Windows\System\OuPLWiN.exe
  C:\Windows\System\OuPLWiN.exe
  2⤵
  PID:12640
- C:\Windows\System\jxKNFxq.exe
  C:\Windows\System\jxKNFxq.exe
  2⤵
  PID:12700
- C:\Windows\System\sYfNWgr.exe
  C:\Windows\System\sYfNWgr.exe
  2⤵
  PID:12792
- C:\Windows\System\DHFMpfp.exe
  C:\Windows\System\DHFMpfp.exe
  2⤵
  PID:12836
- C:\Windows\System\MfHZIeM.exe
  C:\Windows\System\MfHZIeM.exe
  2⤵
  PID:12904
- C:\Windows\System\OTRLWsh.exe
  C:\Windows\System\OTRLWsh.exe
  2⤵
  PID:13016
- C:\Windows\System\lgkHnzY.exe
  C:\Windows\System\lgkHnzY.exe
  2⤵
  PID:13060
- C:\Windows\System\qwxGRtb.exe
  C:\Windows\System\qwxGRtb.exe
  2⤵
  PID:13152
- C:\Windows\System\jjkUidg.exe
  C:\Windows\System\jjkUidg.exe
  2⤵
  PID:13260
- C:\Windows\System\CkDdotg.exe
  C:\Windows\System\CkDdotg.exe
  2⤵
  PID:11904
- C:\Windows\System\bxGAJYb.exe
  C:\Windows\System\bxGAJYb.exe
  2⤵
  PID:12304
- C:\Windows\System\IRvBZDQ.exe
  C:\Windows\System\IRvBZDQ.exe
  2⤵
  PID:12528
- C:\Windows\System\HvjYOZR.exe
  C:\Windows\System\HvjYOZR.exe
  2⤵
  PID:12680
- C:\Windows\System\plSaSvp.exe
  C:\Windows\System\plSaSvp.exe
  2⤵
  PID:12788
- C:\Windows\System\MiZNiKz.exe
  C:\Windows\System\MiZNiKz.exe
  2⤵
  PID:12864
- C:\Windows\System\rSMWdxD.exe
  C:\Windows\System\rSMWdxD.exe
  2⤵
  PID:13148
- C:\Windows\System\eSlsSFc.exe
  C:\Windows\System\eSlsSFc.exe
  2⤵
  PID:13308
- C:\Windows\System\deZwJUj.exe
  C:\Windows\System\deZwJUj.exe
  2⤵
  PID:12448
- C:\Windows\System\xlEGDMv.exe
  C:\Windows\System\xlEGDMv.exe
  2⤵
  PID:12752
- C:\Windows\System\ArYfnGM.exe
  C:\Windows\System\ArYfnGM.exe
  2⤵
  PID:13180
- C:\Windows\System\KRpaxiM.exe
  C:\Windows\System\KRpaxiM.exe
  2⤵
  PID:12820
- C:\Windows\System\SjBNBky.exe
  C:\Windows\System\SjBNBky.exe
  2⤵
  PID:13284
- C:\Windows\System\MlmiZvG.exe
  C:\Windows\System\MlmiZvG.exe
  2⤵
  PID:13324
- C:\Windows\System\pqdcngh.exe
  C:\Windows\System\pqdcngh.exe
  2⤵
  PID:13364
- C:\Windows\System\qlIeHCt.exe
  C:\Windows\System\qlIeHCt.exe
  2⤵
  PID:13400
- C:\Windows\System\IypMnyi.exe
  C:\Windows\System\IypMnyi.exe
  2⤵
  PID:13424
- C:\Windows\System\zMyMYfd.exe
  C:\Windows\System\zMyMYfd.exe
  2⤵
  PID:13444
- C:\Windows\System\ZTFEePh.exe
  C:\Windows\System\ZTFEePh.exe
  2⤵
  PID:13464
- C:\Windows\System\jpdRlKx.exe
  C:\Windows\System\jpdRlKx.exe
  2⤵
  PID:13516
- C:\Windows\System\izVghEw.exe
  C:\Windows\System\izVghEw.exe
  2⤵
  PID:13536
- C:\Windows\System\PCeJuKX.exe
  C:\Windows\System\PCeJuKX.exe
  2⤵
  PID:13560
- C:\Windows\System\UYXpAHL.exe
  C:\Windows\System\UYXpAHL.exe
  2⤵
  PID:13584
- C:\Windows\System\ZfOZRgg.exe
  C:\Windows\System\ZfOZRgg.exe
  2⤵
  PID:13604
- C:\Windows\System\gSowlKr.exe
  C:\Windows\System\gSowlKr.exe
  2⤵
  PID:13660
- C:\Windows\System\WBxomrg.exe
  C:\Windows\System\WBxomrg.exe
  2⤵
  PID:13680
- C:\Windows\System\hHsEYKe.exe
  C:\Windows\System\hHsEYKe.exe
  2⤵
  PID:13704
- C:\Windows\System\tmIJQTs.exe
  C:\Windows\System\tmIJQTs.exe
  2⤵
  PID:13732
- C:\Windows\System\ZFkkweq.exe
  C:\Windows\System\ZFkkweq.exe
  2⤵
  PID:13752
- C:\Windows\System\DNfpVCP.exe
  C:\Windows\System\DNfpVCP.exe
  2⤵
  PID:13784
- C:\Windows\System\OslpfHo.exe
  C:\Windows\System\OslpfHo.exe
  2⤵
  PID:13808
- C:\Windows\System\ZpzHtmL.exe
  C:\Windows\System\ZpzHtmL.exe
  2⤵
  PID:13832
- C:\Windows\System\VbwzfgJ.exe
  C:\Windows\System\VbwzfgJ.exe
  2⤵
  PID:13852
- C:\Windows\System\CBMpZyi.exe
  C:\Windows\System\CBMpZyi.exe
  2⤵
  PID:13880
- C:\Windows\System\FazlBfj.exe
  C:\Windows\System\FazlBfj.exe
  2⤵
  PID:13916
- C:\Windows\System\kwuJeFE.exe
  C:\Windows\System\kwuJeFE.exe
  2⤵
  PID:13956
- C:\Windows\System\TwVfQZp.exe
  C:\Windows\System\TwVfQZp.exe
  2⤵
  PID:13972
- C:\Windows\System\jEClNBd.exe
  C:\Windows\System\jEClNBd.exe
  2⤵
  PID:14012
- C:\Windows\System\oScDFVy.exe
  C:\Windows\System\oScDFVy.exe
  2⤵
  PID:14032
- C:\Windows\System\KULWGqw.exe
  C:\Windows\System\KULWGqw.exe
  2⤵
  PID:14072
- C:\Windows\System\noktnNT.exe
  C:\Windows\System\noktnNT.exe
  2⤵
  PID:14100
- C:\Windows\System\phLcizL.exe
  C:\Windows\System\phLcizL.exe
  2⤵
  PID:14124
- C:\Windows\System\TATdbSM.exe
  C:\Windows\System\TATdbSM.exe
  2⤵
  PID:14140
- C:\Windows\System\YbSZueX.exe
  C:\Windows\System\YbSZueX.exe
  2⤵
  PID:14192
- C:\Windows\System\IuUyKrR.exe
  C:\Windows\System\IuUyKrR.exe
  2⤵
  PID:14212
- C:\Windows\System\OIcWfuG.exe
  C:\Windows\System\OIcWfuG.exe
  2⤵
  PID:14236
- C:\Windows\System\oqHnkyd.exe
  C:\Windows\System\oqHnkyd.exe
  2⤵
  PID:14268
- C:\Windows\System\INhCngH.exe
  C:\Windows\System\INhCngH.exe
  2⤵
  PID:14292
- C:\Windows\System\szWuvCl.exe
  C:\Windows\System\szWuvCl.exe
  2⤵
  PID:14308
- C:\Windows\System\PVTSFMB.exe
  C:\Windows\System\PVTSFMB.exe
  2⤵
  PID:14332
- C:\Windows\System\UpIbOUF.exe
  C:\Windows\System\UpIbOUF.exe
  2⤵
  PID:13344
- C:\Windows\System\lhVGmnd.exe
  C:\Windows\System\lhVGmnd.exe
  2⤵
  PID:13408
- C:\Windows\System\vDtwzyc.exe
  C:\Windows\System\vDtwzyc.exe
  2⤵
  PID:13488
- C:\Windows\System\ycqqikX.exe
  C:\Windows\System\ycqqikX.exe
  2⤵
  PID:13572
- C:\Windows\System\tTAJhyO.exe
  C:\Windows\System\tTAJhyO.exe
  2⤵
  PID:13596
- C:\Windows\System\iYumyYQ.exe
  C:\Windows\System\iYumyYQ.exe
  2⤵
  PID:13740
- C:\Windows\System\msmnIIl.exe
  C:\Windows\System\msmnIIl.exe
  2⤵
  PID:13768
- C:\Windows\System\JCBmCqb.exe
  C:\Windows\System\JCBmCqb.exe
  2⤵
  PID:13844
- C:\Windows\System\GmJlBLJ.exe
  C:\Windows\System\GmJlBLJ.exe
  2⤵
  PID:13912
- C:\Windows\System\CyXHNME.exe
  C:\Windows\System\CyXHNME.exe
  2⤵
  PID:13940
- C:\Windows\System\QQZAKVy.exe
  C:\Windows\System\QQZAKVy.exe
  2⤵
  PID:13968
- C:\Windows\System\JraMLUN.exe
  C:\Windows\System\JraMLUN.exe
  2⤵
  PID:14040
- C:\Windows\System\qKpMZmx.exe
  C:\Windows\System\qKpMZmx.exe
  2⤵
  PID:14172
- C:\Windows\System\LaGvFFV.exe
  C:\Windows\System\LaGvFFV.exe
  2⤵
  PID:14232
- C:\Windows\System\YiNRiJN.exe
  C:\Windows\System\YiNRiJN.exe
  2⤵
  PID:3536
- C:\Windows\System\AIkbIfE.exe
  C:\Windows\System\AIkbIfE.exe
  2⤵
  PID:14304
- C:\Windows\System\Fjycitf.exe
  C:\Windows\System\Fjycitf.exe
  2⤵
  PID:13396
- C:\Windows\System\jkqMJKe.exe
  C:\Windows\System\jkqMJKe.exe
  2⤵
  PID:13548
- C:\Windows\System\yEqGNRQ.exe
  C:\Windows\System\yEqGNRQ.exe
  2⤵
  PID:13700
- C:\Windows\System\nHPkqMn.exe
  C:\Windows\System\nHPkqMn.exe
  2⤵
  PID:13840
- C:\Windows\System\itYrUPi.exe
  C:\Windows\System\itYrUPi.exe
  2⤵
  PID:14028
- C:\Windows\System\aSwlKcg.exe
  C:\Windows\System\aSwlKcg.exe
  2⤵
  PID:14132
- C:\Windows\System\EiVEdBl.exe
  C:\Windows\System\EiVEdBl.exe
  2⤵
  PID:13524
- C:\Windows\System\KoVDymP.exe
  C:\Windows\System\KoVDymP.exe
  2⤵
  PID:13640
- C:\Windows\System\qSyqHBJ.exe
  C:\Windows\System\qSyqHBJ.exe
  2⤵
  PID:14188
- C:\Windows\System\znfpVGD.exe
  C:\Windows\System\znfpVGD.exe
  2⤵
  PID:14300
- C:\Windows\System\itUxQBV.exe
  C:\Windows\System\itUxQBV.exe
  2⤵
  PID:13760
- C:\Windows\System\FaPXKvI.exe
  C:\Windows\System\FaPXKvI.exe
  2⤵
  PID:14344
- C:\Windows\System\yHuAwXM.exe
  C:\Windows\System\yHuAwXM.exe
  2⤵
  PID:14368
- C:\Windows\System\xysFGhk.exe
  C:\Windows\System\xysFGhk.exe
  2⤵
  PID:14388
- C:\Windows\System\duNBNfe.exe
  C:\Windows\System\duNBNfe.exe
  2⤵
  PID:14412
- C:\Windows\System\QaYVQrn.exe
  C:\Windows\System\QaYVQrn.exe
  2⤵
  PID:14436
- C:\Windows\System\Kmorhqw.exe
  C:\Windows\System\Kmorhqw.exe
  2⤵
  PID:14468
- C:\Windows\System\VpxCKDh.exe
  C:\Windows\System\VpxCKDh.exe
  2⤵
  PID:14504
- C:\Windows\System\pxRluVQ.exe
  C:\Windows\System\pxRluVQ.exe
  2⤵
  PID:14528
- C:\Windows\System\BOBEcVd.exe
  C:\Windows\System\BOBEcVd.exe
  2⤵
  PID:14552
- C:\Windows\System\JkUdSBc.exe
  C:\Windows\System\JkUdSBc.exe
  2⤵
  PID:14572
- C:\Windows\System\QEHVQLZ.exe
  C:\Windows\System\QEHVQLZ.exe
  2⤵
  PID:14596
- C:\Windows\System\JIVZncr.exe
  C:\Windows\System\JIVZncr.exe
  2⤵
  PID:14616
- C:\Windows\System\snTjAsF.exe
  C:\Windows\System\snTjAsF.exe
  2⤵
  PID:14640
- C:\Windows\System\NYocKWA.exe
  C:\Windows\System\NYocKWA.exe
  2⤵
  PID:14668
- C:\Windows\System\jBhACfg.exe
  C:\Windows\System\jBhACfg.exe
  2⤵
  PID:14684
- C:\Windows\System\mmOIDMh.exe
  C:\Windows\System\mmOIDMh.exe
  2⤵
  PID:14708
- C:\Windows\System\LxzTCQf.exe
  C:\Windows\System\LxzTCQf.exe
  2⤵
  PID:14740
- C:\Windows\System\KrNpgjK.exe
  C:\Windows\System\KrNpgjK.exe
  2⤵
  PID:14756
- C:\Windows\System\lZNAOQA.exe
  C:\Windows\System\lZNAOQA.exe
  2⤵
  PID:14780
- C:\Windows\System\TBIMexK.exe
  C:\Windows\System\TBIMexK.exe
  2⤵
  PID:14804
- C:\Windows\System\FgLBIpq.exe
  C:\Windows\System\FgLBIpq.exe
  2⤵
  PID:14836
- C:\Windows\System\dlsFInN.exe
  C:\Windows\System\dlsFInN.exe
  2⤵
  PID:14860
- C:\Windows\System\JwhMMJr.exe
  C:\Windows\System\JwhMMJr.exe
  2⤵
  PID:14880
- C:\Windows\System\dJMMheA.exe
  C:\Windows\System\dJMMheA.exe
  2⤵
  PID:14904
- C:\Windows\System\dEUygvK.exe
  C:\Windows\System\dEUygvK.exe
  2⤵
  PID:14924
- C:\Windows\System\xtJYEkf.exe
  C:\Windows\System\xtJYEkf.exe
  2⤵
  PID:14948
- C:\Windows\System\JfjLmWu.exe
  C:\Windows\System\JfjLmWu.exe
  2⤵
  PID:14976
- C:\Windows\System\buohBeW.exe
  C:\Windows\System\buohBeW.exe
  2⤵
  PID:14992
- C:\Windows\System\TKHTbgX.exe
  C:\Windows\System\TKHTbgX.exe
  2⤵
  PID:15020
- C:\Windows\System\PGufyIO.exe
  C:\Windows\System\PGufyIO.exe
  2⤵
  PID:15048
- C:\Windows\System\NNCODnB.exe
  C:\Windows\System\NNCODnB.exe
  2⤵
  PID:15076
- C:\Windows\System\voIVARe.exe
  C:\Windows\System\voIVARe.exe
  2⤵
  PID:15092
- C:\Windows\System\XdEIRED.exe
  C:\Windows\System\XdEIRED.exe
  2⤵
  PID:15116
- C:\Windows\System\hVPZDEZ.exe
  C:\Windows\System\hVPZDEZ.exe
  2⤵
  PID:15144
- C:\Windows\System\QHxvwyk.exe
  C:\Windows\System\QHxvwyk.exe
  2⤵
  PID:15176
- C:\Windows\System\hooZSWV.exe
  C:\Windows\System\hooZSWV.exe
  2⤵
  PID:15196
- C:\Windows\System\LTtSltt.exe
  C:\Windows\System\LTtSltt.exe
  2⤵
  PID:15228
- C:\Windows\System\CZieeEA.exe
  C:\Windows\System\CZieeEA.exe
  2⤵
  PID:15248
- C:\Windows\System\JHhZGXl.exe
  C:\Windows\System\JHhZGXl.exe
  2⤵
  PID:15264
- C:\Windows\System\vXJYpBc.exe
  C:\Windows\System\vXJYpBc.exe
  2⤵
  PID:15296
- C:\Windows\System\ayKnOPC.exe
  C:\Windows\System\ayKnOPC.exe
  2⤵
  PID:15324
- C:\Windows\System\BbLNWse.exe
  C:\Windows\System\BbLNWse.exe
  2⤵
  PID:15348
- C:\Windows\System\bYwWdrY.exe
  C:\Windows\System\bYwWdrY.exe
  2⤵
  PID:14004
- C:\Windows\System\NxLrkVW.exe
  C:\Windows\System\NxLrkVW.exe
  2⤵
  PID:14380
- C:\Windows\System\seqXhVg.exe
  C:\Windows\System\seqXhVg.exe
  2⤵
  PID:13992
- C:\Windows\System\AeBsHfV.exe
  C:\Windows\System\AeBsHfV.exe
  2⤵
  PID:14484
- C:\Windows\System\ItfnnRv.exe
  C:\Windows\System\ItfnnRv.exe
  2⤵
  PID:14496
- C:\Windows\System\ARdNVcA.exe
  C:\Windows\System\ARdNVcA.exe
  2⤵
  PID:14540
- C:\Windows\System\lPrPdXl.exe
  C:\Windows\System\lPrPdXl.exe
  2⤵
  PID:14548
- C:\Windows\System\bvUqckj.exe
  C:\Windows\System\bvUqckj.exe
  2⤵
  PID:14592
- C:\Windows\System\vMDGPRq.exe
  C:\Windows\System\vMDGPRq.exe
  2⤵
  PID:14724
- C:\Windows\System\tUnqKkB.exe
  C:\Windows\System\tUnqKkB.exe
  2⤵
  PID:14824
- C:\Windows\System\yyEjvjC.exe
  C:\Windows\System\yyEjvjC.exe
  2⤵
  PID:14816
- C:\Windows\System\pKhRqLY.exe
  C:\Windows\System\pKhRqLY.exe
  2⤵
  PID:14852
- C:\Windows\System\iHyOiZf.exe
  C:\Windows\System\iHyOiZf.exe
  2⤵
  PID:14892
- C:\Windows\System\meYSHJe.exe
  C:\Windows\System\meYSHJe.exe
  2⤵
  PID:15064
- C:\Windows\System\baNYrFS.exe
  C:\Windows\System\baNYrFS.exe
  2⤵
  PID:15072
- C:\Windows\System\akWIzaG.exe
  C:\Windows\System\akWIzaG.exe
  2⤵
  PID:15004
- C:\Windows\System\sSpmeBM.exe
  C:\Windows\System\sSpmeBM.exe
  2⤵
  PID:15240
- C:\Windows\System\WuBXuBu.exe
  C:\Windows\System\WuBXuBu.exe
  2⤵
  PID:15104
- C:\Windows\System\IuVAhmn.exe
  C:\Windows\System\IuVAhmn.exe
  2⤵
  PID:15188
- C:\Windows\System\NXegVDg.exe
  C:\Windows\System\NXegVDg.exe
  2⤵
  PID:14396
- C:\Windows\System\YCNHTNQ.exe
  C:\Windows\System\YCNHTNQ.exe
  2⤵
  PID:15136
- C:\Windows\System\IStQdvd.exe
  C:\Windows\System\IStQdvd.exe
  2⤵
  PID:14632
- C:\Windows\System\KnhFRqE.exe
  C:\Windows\System\KnhFRqE.exe
  2⤵
  PID:14704
- C:\Windows\System\MgWFpYQ.exe
  C:\Windows\System\MgWFpYQ.exe
  2⤵
  PID:15388
- C:\Windows\System\hykUdut.exe
  C:\Windows\System\hykUdut.exe
  2⤵
  PID:15412
- C:\Windows\System\GgdRpEV.exe
  C:\Windows\System\GgdRpEV.exe
  2⤵
  PID:15428
- C:\Windows\System\nnkuUIx.exe
  C:\Windows\System\nnkuUIx.exe
  2⤵
  PID:15460
- C:\Windows\System\LvwDefl.exe
  C:\Windows\System\LvwDefl.exe
  2⤵
  PID:15476
- C:\Windows\System\uiOUMDP.exe
  C:\Windows\System\uiOUMDP.exe
  2⤵
  PID:15504
- C:\Windows\System\JgJLqTE.exe
  C:\Windows\System\JgJLqTE.exe
  2⤵
  PID:15524
- C:\Windows\System\GOFJgXq.exe
  C:\Windows\System\GOFJgXq.exe
  2⤵
  PID:15556
- C:\Windows\System\MYEZPLm.exe
  C:\Windows\System\MYEZPLm.exe
  2⤵
  PID:15576
- C:\Windows\System\EkNVTjA.exe
  C:\Windows\System\EkNVTjA.exe
  2⤵
  PID:15604
- C:\Windows\System\dTKBDBF.exe
  C:\Windows\System\dTKBDBF.exe
  2⤵
  PID:15624
- C:\Windows\System\rVPmFpW.exe
  C:\Windows\System\rVPmFpW.exe
  2⤵
  PID:15644
- C:\Windows\System\aLhNGNp.exe
  C:\Windows\System\aLhNGNp.exe
  2⤵
  PID:15672
- C:\Windows\System\ApAdJSK.exe
  C:\Windows\System\ApAdJSK.exe
  2⤵
  PID:15692
- C:\Windows\System\BSDVWkx.exe
  C:\Windows\System\BSDVWkx.exe
  2⤵
  PID:15728
- C:\Windows\System\jWfrApW.exe
  C:\Windows\System\jWfrApW.exe
  2⤵
  PID:15748
- C:\Windows\System\MlfZRXF.exe
  C:\Windows\System\MlfZRXF.exe
  2⤵
  PID:15772
- C:\Windows\System\eploqvN.exe
  C:\Windows\System\eploqvN.exe
  2⤵
  PID:15792
- C:\Windows\System\wcIHDux.exe
  C:\Windows\System\wcIHDux.exe
  2⤵
  PID:15812
- C:\Windows\System\SFolaeW.exe
  C:\Windows\System\SFolaeW.exe
  2⤵
  PID:15840
- C:\Windows\System\tAKrYqu.exe
  C:\Windows\System\tAKrYqu.exe
  2⤵
  PID:15860
- C:\Windows\System\OtdVjwl.exe
  C:\Windows\System\OtdVjwl.exe
  2⤵
  PID:15884
- C:\Windows\System\VxCyRgv.exe
  C:\Windows\System\VxCyRgv.exe
  2⤵
  PID:15900
- C:\Windows\System\epHazcP.exe
  C:\Windows\System\epHazcP.exe
  2⤵
  PID:15928
- C:\Windows\System\ErIlrbh.exe
  C:\Windows\System\ErIlrbh.exe
  2⤵
  PID:15944
- C:\Windows\System\yKiImoV.exe
  C:\Windows\System\yKiImoV.exe
  2⤵
  PID:15968
- C:\Windows\System\HdgrZqo.exe
  C:\Windows\System\HdgrZqo.exe
  2⤵
  PID:16000
- C:\Windows\System\iKqiISH.exe
  C:\Windows\System\iKqiISH.exe
  2⤵
  PID:16016
- C:\Windows\System\vFSgSib.exe
  C:\Windows\System\vFSgSib.exe
  2⤵
  PID:16044
- C:\Windows\System\dpCYGMG.exe
  C:\Windows\System\dpCYGMG.exe
  2⤵
  PID:16072
- C:\Windows\System\EZixhXA.exe
  C:\Windows\System\EZixhXA.exe
  2⤵
  PID:16096
- C:\Windows\System\gLUDJRL.exe
  C:\Windows\System\gLUDJRL.exe
  2⤵
  PID:16112
- C:\Windows\System\JPqPqLd.exe
  C:\Windows\System\JPqPqLd.exe
  2⤵
  PID:16132
- C:\Windows\System\NhgzZVc.exe
  C:\Windows\System\NhgzZVc.exe
  2⤵
  PID:16160
- C:\Windows\System\NHCtWIv.exe
  C:\Windows\System\NHCtWIv.exe
  2⤵
  PID:16184
- C:\Windows\System\UbGjgOe.exe
  C:\Windows\System\UbGjgOe.exe
  2⤵
  PID:16216
- C:\Windows\System\aOwEwbF.exe
  C:\Windows\System\aOwEwbF.exe
  2⤵
  PID:16232
- C:\Windows\System\QWePkzg.exe
  C:\Windows\System\QWePkzg.exe
  2⤵
  PID:16248
- C:\Windows\System\cfgfUBs.exe
  C:\Windows\System\cfgfUBs.exe
  2⤵
  PID:16264
- C:\Windows\System\laCYNcc.exe
  C:\Windows\System\laCYNcc.exe
  2⤵
  PID:16292
- C:\Windows\System\qWIlgje.exe
  C:\Windows\System\qWIlgje.exe
  2⤵
  PID:16320
- C:\Windows\System\CXISHcF.exe
  C:\Windows\System\CXISHcF.exe
  2⤵
  PID:16344
- C:\Windows\System\jGleDml.exe
  C:\Windows\System\jGleDml.exe
  2⤵
  PID:16372
- C:\Windows\System\EWaMvJi.exe
  C:\Windows\System\EWaMvJi.exe
  2⤵
  PID:14460
- C:\Windows\System\moOdulv.exe
  C:\Windows\System\moOdulv.exe
  2⤵
  PID:14680
- C:\Windows\System\pmcJzRc.exe
  C:\Windows\System\pmcJzRc.exe
  2⤵
  PID:14700
- C:\Windows\System\xxDyrUO.exe
  C:\Windows\System\xxDyrUO.exe
  2⤵
  PID:15256
- C:\Windows\System\Nkmwcmz.exe
  C:\Windows\System\Nkmwcmz.exe
  2⤵
  PID:14536
- C:\Windows\System\ZzSNSwm.exe
  C:\Windows\System\ZzSNSwm.exe
  2⤵
  PID:15368
- C:\Windows\System\axqESXM.exe
  C:\Windows\System\axqESXM.exe
  2⤵
  PID:15044
- C:\Windows\System\rYdaEqg.exe
  C:\Windows\System\rYdaEqg.exe
  2⤵
  PID:15172
- C:\Windows\System\GTnrGpB.exe
  C:\Windows\System\GTnrGpB.exe
  2⤵
  PID:14844
- C:\Windows\System\ZzWUrgH.exe
  C:\Windows\System\ZzWUrgH.exe
  2⤵
  PID:15636
- C:\Windows\System\JWuyscF.exe
  C:\Windows\System\JWuyscF.exe
  2⤵
  PID:15404
- C:\Windows\System\GIyFSCe.exe
  C:\Windows\System\GIyFSCe.exe
  2⤵
  PID:15204
- C:\Windows\System\aBpfdaQ.exe
  C:\Windows\System\aBpfdaQ.exe
  2⤵
  PID:15852
- C:\Windows\System\YNHhhzW.exe
  C:\Windows\System\YNHhhzW.exe
  2⤵
  PID:15756
- C:\Windows\System\bABftzp.exe
  C:\Windows\System\bABftzp.exe
  2⤵
  PID:15520
- C:\Windows\System\cQakEUd.exe
  C:\Windows\System\cQakEUd.exe
  2⤵
  PID:16260
- C:\Windows\System\MELiQTf.exe
  C:\Windows\System\MELiQTf.exe
  2⤵
  PID:16032
- C:\Windows\System\jdCDxdK.exe
  C:\Windows\System\jdCDxdK.exe
  2⤵
  PID:15536
- C:\Windows\System\YucuGrc.exe
  C:\Windows\System\YucuGrc.exe
  2⤵
  PID:15488
- C:\Windows\System\cjNMXSl.exe
  C:\Windows\System\cjNMXSl.exe
  2⤵
  PID:16368
- C:\Windows\System\XCoGuRL.exe
  C:\Windows\System\XCoGuRL.exe
  2⤵
  PID:15060
- C:\Windows\System\EYkNFaQ.exe
  C:\Windows\System\EYkNFaQ.exe
  2⤵
  PID:15084
- C:\Windows\System\vIySTkO.exe
  C:\Windows\System\vIySTkO.exe
  2⤵
  PID:14792
- C:\Windows\System\GjtWCkC.exe
  C:\Windows\System\GjtWCkC.exe
  2⤵
  PID:15452
- C:\Windows\System\jTKzPXM.exe
  C:\Windows\System\jTKzPXM.exe
  2⤵
  PID:15632
- C:\Windows\System\gQclMPa.exe
  C:\Windows\System\gQclMPa.exe
  2⤵
  PID:15764
- C:\Windows\System\TfPdBLD.exe
  C:\Windows\System\TfPdBLD.exe
  2⤵
  PID:16276
- C:\Windows\System\rprxSuM.exe
  C:\Windows\System\rprxSuM.exe
  2⤵
  PID:16104
- C:\Windows\System\zcBgFwN.exe
  C:\Windows\System\zcBgFwN.exe
  2⤵
  PID:15800
- C:\Windows\System\YGThEXl.exe
  C:\Windows\System\YGThEXl.exe
  2⤵
  PID:4256
- C:\Windows\System\WnftGwH.exe
  C:\Windows\System\WnftGwH.exe
  2⤵
  PID:16416
- C:\Windows\System\pGYKcSW.exe
  C:\Windows\System\pGYKcSW.exe
  2⤵
  PID:16452
- C:\Windows\System\svmNtAk.exe
  C:\Windows\System\svmNtAk.exe
  2⤵
  PID:16472
- C:\Windows\System\dACNArg.exe
  C:\Windows\System\dACNArg.exe
  2⤵
  PID:16500
- C:\Windows\System\OebsyQe.exe
  C:\Windows\System\OebsyQe.exe
  2⤵
  PID:16528
- C:\Windows\System\NtGKUke.exe
  C:\Windows\System\NtGKUke.exe
  2⤵
  PID:16548
- C:\Windows\System\PwAJpGY.exe
  C:\Windows\System\PwAJpGY.exe
  2⤵
  PID:16584
- C:\Windows\System\XXgZRdI.exe
  C:\Windows\System\XXgZRdI.exe
  2⤵
  PID:16600
- C:\Windows\System\CPDhKfv.exe
  C:\Windows\System\CPDhKfv.exe
  2⤵
  PID:16632
- C:\Windows\System\FEVsOuL.exe
  C:\Windows\System\FEVsOuL.exe
  2⤵
  PID:16656
- C:\Windows\System\ZWcRZkD.exe
  C:\Windows\System\ZWcRZkD.exe
  2⤵
  PID:16680
- C:\Windows\System\kxBDicd.exe
  C:\Windows\System\kxBDicd.exe
  2⤵
  PID:16704
- C:\Windows\System\COWKiJU.exe
  C:\Windows\System\COWKiJU.exe
  2⤵
  PID:17172
- C:\Windows\System\ZOLilPK.exe
  C:\Windows\System\ZOLilPK.exe
  2⤵
  PID:17188
- C:\Windows\System\bbxugeP.exe
  C:\Windows\System\bbxugeP.exe
  2⤵
  PID:17208
- C:\Windows\System\cftZsIo.exe
  C:\Windows\System\cftZsIo.exe
  2⤵
  PID:17228
- C:\Windows\System\lJJamCH.exe
  C:\Windows\System\lJJamCH.exe
  2⤵
  PID:17256

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:16648

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\BobPXPj.exe

Filesize
1.8MB

MD5
c9a37796911756e23b078cb13029aec7

SHA1
4553258f5cecd182a37eed3162a67f145cd55b9f

SHA256
8cfc014edb190ec39aed002687e089fdf62f7a5075c11118276fa2eee8f54d57

SHA512
43c444a225d39051a26751b0634f5e5548b3a91ae612e239f21cd053a7d2ce2d63738ed87d747f544c111737a5221aec17eb7d9fe02fcf1827172548e8b094bd

Download Submit
C:\Windows\System\BohPlWT.exe

Filesize
1.8MB

MD5
fc66bcfa7f9de4a61b280f631222c4be

SHA1
64578b479b7fef6aeb375410ccb0e6800b82b9de

SHA256
17d86c556076f6285d8a0a7bb3da1255e057aba63935ecc0f14a9c41510d2a00

SHA512
bf30f7af072dcefe9bdc8e797b846410f210876ba82fa77478fda503bf793bc920dda956fb271dafefa1023a98ed9e66f0051e287d9c3719ecbdf20ff1fef411

Download Submit
C:\Windows\System\GBTJfif.exe

Filesize
1.8MB

MD5
cf20db70a8d9bc270f596cf4c35f2f4d

SHA1
335aaf4aa2b4067e81ab7eaa56aff1bbfc4edc75

SHA256
1a2c29afe78ba72b377e14a07af2fd079ac5aa87f7e2b06d1a4a28c28ce43db9

SHA512
0bd18c27a9cdcf31480211c32df81e19272d413ab4b729077c0a363eb6be86252aa8ffa9c2d0ffc295bf2c4755f3b03cdc076b960d424764dfbc9ec815523bab

Download Submit
C:\Windows\System\LHQlhTn.exe

Filesize
1.8MB

MD5
36c99a5d073d61dd90aa5ff5c8f6e780

SHA1
88fdcecaad3c35d70ef9c7a4fe41e0b449c99a48

SHA256
b3a38e0076a4a0e352ce86a21aa1e9eaca501d26f958ac22dac433239ed1dfaf

SHA512
27c3303ef51009b3356091c6a6a7ed8e2f702864489921cefab9149c0a7188c27c54a73e9f248f30378a7a84cabdb7e8683590e196e5cb4e971a07206c084b8e

Download Submit
C:\Windows\System\MjpfYkc.exe

Filesize
1.8MB

MD5
7015f38234aa438f7fb51bcde162a4b9

SHA1
1a3b616b4e51a0a091368bd38fc7dabe201ea39b

SHA256
c34bf5709e687b8bcc9cae66dac74bc7849dcb0a58feb3d304d8f8e187c1529c

SHA512
1f6cab43d7b0df42c04b9a9197a660a6a588e7e59af2c7314cb12af2eaca505f6c6e019f87e630ca62a8e3991fce84a4b3cccd6bd4009d0e4e76948f3a1e3349

Download Submit
C:\Windows\System\NtSYSYr.exe

Filesize
1.8MB

MD5
5ac2bef0091b50d2bee99ff679de637b

SHA1
4aeeccbd48c1c9de8c2d3580c64e31fc3747e22b

SHA256
db82c3df3ed016901f197da681f336b4c7a3a082866eef58feb2cd718654c839

SHA512
471edfebf88be49417ce9ffa4fad53b684e2cc690dc77302be3b6766c13c922893bc431d8af64084e67589a82a4c650d382196fac403988d9d1c0dbd30988d57

Download Submit
C:\Windows\System\QOmbuqI.exe

Filesize
1.8MB

MD5
f8d3e949413b260150a64286a3f8840e

SHA1
0e630bf93988a90acdf578e071156f1368fe6d58

SHA256
b3c4e3e24853ddec713a221ca068017cecb20fb944abb855c9df76c56dd0ec08

SHA512
026ef5a056d181fcd055cb24664ee49ee6aba60e55c339d5087a816912739d0b5271dc15c566faeaf35c4aa0ce5c03c77d68cd695e6c0b5079ddd242bef59580

Download Submit
C:\Windows\System\QPMoUHG.exe

Filesize
1.8MB

MD5
6a8c840c340619ebbd51249b1c46a3d9

SHA1
4f4bc3b77258ae3e189bcfc6df9539f242fa2121

SHA256
03ce130aac70faea4ff7ad6272b3cbe6fcadb60fa68c15ecdab95af296ef01e9

SHA512
0690c3cfd92f532f05408fd9126c84a595c79d45882807b900134fa24cf0457fcfaa9211d5a44a010d7d035cf315a084c9a24b946155150a564f8b77c690bd8d

Download Submit
C:\Windows\System\QdIMocf.exe

Filesize
1.8MB

MD5
a5dacd20a83983805afbd73a94043e17

SHA1
19ad60ef8ba21047c568bae84a2d506cb1732753

SHA256
0a2303caeb320a304e3952b67a99b5baacbdc3d5c2b5a58436536afed9cc68d7

SHA512
97b30ee2bcde1272b0ca1aedb0ca866477b32313d6fab05a198265af8ab5212b92d088315562d25b9ea5da03dbc67fcb334b9aae61125013f1fef1e1b443b1b9

Download Submit
C:\Windows\System\RNWFGUP.exe

Filesize
1.8MB

MD5
bec5b2ad12f911d26e9771361ea0b41c

SHA1
846669505e38232153df84e8c4f06c81b42b047b

SHA256
3d41d1aead3571a953dfa4a42cbad5264b7b064f4a72a942458eb3f8a6bbef69

SHA512
be105ce07fe4a93ab483a64383b040cd2b5e8b3768895908a73e2a7e82a200ee6e717e3e419dd5f4d0fe649d63bb75ee05095a4c248885c37a437096ec906054

Download Submit
C:\Windows\System\SRThzom.exe

Filesize
1.8MB

MD5
ab862acd1a3a1dc6e43e21a382259db8

SHA1
0d93a568320b6a6aa0697744d5666b9256349437

SHA256
531b1f6b16653a9aec2b74a40973e189b8071c5771e9b951d3d49583fbd63676

SHA512
40a22b02b0837db5281cc293b07b5e4feed29521252e93651a7746d837d226b3076bffe5f47c33c3b4fea8179f347c510c7b057f7793e6485e27e751671f607d

Download Submit
C:\Windows\System\VpwSfdO.exe

Filesize
1.8MB

MD5
6107ea548035c79fd1dedb3062f274b9

SHA1
858cdc3ff2122615a1b4f4d4360fa8d5fe9cddb2

SHA256
c9c7404e7b800561f94f40d41bc890905ace9f1c00dc922ad7f76522bfeed054

SHA512
f1d2c79ba0fdb50d788c8e828f1e82c74b86be6d27a4a8056b5cb205e865049e063c8ab9cf116e1085fe52ed5de5e381e4a87210938237487cb21f4087add7d2

Download Submit
C:\Windows\System\VxcESrR.exe

Filesize
1.8MB

MD5
dcdccc22c557cf6e50c9792d758a1631

SHA1
d4532e2e3b4802608bba35168ca4cb9129738572

SHA256
8b33f5cd98392d751843b0664aa41fd56fec2cb855cc007410afad6a6e5a2f03

SHA512
33eb8b7ff262b58696bbe3cce51e7f6f63029a4a32d418b5252de4d9b8e9e57db2878747549fb45f84a793df185f12d25c94b1bf232e41e052a42347259772f8

Download Submit
C:\Windows\System\WUruewl.exe

Filesize
1.8MB

MD5
2f5c09430479e301e50a6f2355af281c

SHA1
0b99188881ada4445acd5146f5a177ccec8af179

SHA256
b49462297a86c55436307708e523b9aa2004a96ac1b4fc2f7682feb01fa924f0

SHA512
f96f36764cd1773670f482f628add54eb5d19fad9450f2a57692e2e676892331411b485f9d47f49a669e94a175965b224a39ac18ac2fa6c8062f7e18e671a0ba

Download Submit
C:\Windows\System\XLHVlwg.exe

Filesize
1.8MB

MD5
0bf12937d74727e4e1673c9be1ed7ac5

SHA1
8f421074abe12e6eabf0c8a5cbe0615f83410ca2

SHA256
19da69d75916dc704ad4ed105a3981e9d2614d3aed07cf2c4578c632dbcf8a1d

SHA512
b654997b17ba45b9296d605a0d38bd64a9ffc32912593a0d0101a7a03d1e424bed75f8471d39c685cf8316118872f7677967c027bfa7d3bf14be2992ad033026

Download Submit
C:\Windows\System\akXZsDv.exe

Filesize
1.8MB

MD5
cd5dc672e39b80587fc90cb7a1514a2a

SHA1
36616fc7fbc28763b3b967a1395955f8047a3499

SHA256
3ce51cb543179ada2b951611bae5567cd42358ee99346837971fd042089a838f

SHA512
e8d306d7ebbc4a2a46c96e80b725927a291806f39763315e28909b233fc4018309c381b2f9edebdb4f83c5e0b009cd1963b778ba24dbb10aaa0fda57224d5d10

Download Submit
C:\Windows\System\bYicFpj.exe

Filesize
1.8MB

MD5
bfa6e145780ad83b82ffcf78ee96ee0a

SHA1
0e56005d27c9778b2d9a74f594fb3b113f901bde

SHA256
f0acc28cc817ba6feec35f05240a1da7147f68e1434e792853aa9a63edc038b5

SHA512
22a25f4d5950b6f87dd38f1e3c3ca8149192d4cea438bd257e493294487af90e1475413d173b10d5ec27a2ec6689cd28862c9df717ef7dc754a6b3bc7390013a

Download Submit
C:\Windows\System\eaKoNbI.exe

Filesize
1.8MB

MD5
c8e9e3fb9f5ac867c39227bd975bcbd0

SHA1
21a0b4f1182a76d9773ec97e3171cc5c391bf8f8

SHA256
def3450484f7f4c6b62d20d5a6b74da18fad218245cc7a64f8e3d5028539189f

SHA512
847f1559cea8539d270778675b0d698858209a96dce63b0c4756f6a701051df71d34fe9e3685b3d93e7aa4c5db243e5a565cee1c0b222889fcd9bd49cf4b66e3

Download Submit
C:\Windows\System\gPhsYUB.exe

Filesize
1.8MB

MD5
a6b07515a9e6732c14545c28a7c10570

SHA1
a9348775e4888bed8741bbab66530b0d63f26bb7

SHA256
1069bbc81f767f7a3424050710e2410b8200631cd53e7c373fc235e2df852051

SHA512
9b4543cf30f15e9516275f5e0b2566017ad145b834cea0b7e8fd04d90c5069fcd8559747d03da7f840dec9e601158ea907731e1973b8fd769dba3db2c4250998

Download Submit
C:\Windows\System\gdWdWvZ.exe

Filesize
1.8MB

MD5
b9e9dda99f434e4349eba85c8a1865fe

SHA1
bf33fe6f11863f5c28ad0e4592a204a5ebf13796

SHA256
f0026e4c633c3291879502cded8acb233a0796c9398138a5b3115a5bccb84a46

SHA512
ef85d5bb63de4abfd3d365d16e60118b60febdf0e7411cd7cc9b51a9ae3223c584a4c7dc910d9b5f57d47c012fb521d817e570dcac856dbe47a7f12d26f63892

Download Submit
C:\Windows\System\hJxtyMM.exe

Filesize
1.8MB

MD5
e9a34584822b91248e483e91c6132d2a

SHA1
8b96c2c582b02681a1963904fe47245fa8384e92

SHA256
1f636d0cee47a42bd6497238c72a725d8cba03e9537a1c70e310cbdf0b5df6b1

SHA512
ecac0d58e7082e223bea3757372766aa2873832b7e9657bb68d17aaa5cf017db3ac72f911e957c85fe723867ccd07e384e23fe5d0ede3d43dd9caa63ff35c7e6

Download Submit
C:\Windows\System\hYgWBMC.exe

Filesize
1.8MB

MD5
20fc185bca7379526114ae142ba22cec

SHA1
0859439fa712764273ab3c8d08bf8e86e61d383f

SHA256
241a76801f86b655beeec5ad59671110cfe6410c8f0019e2a76e94c85000aeaf

SHA512
cb0b04160b541c6b2316578943f6dea9ee92f89390655c1e8dba9fa6cae8dbeb2442cf4570eae81122aa51dd87d11e497517a8fd06b758fa890ce4da5f9c2c42

Download Submit
C:\Windows\System\istxImZ.exe

Filesize
1.8MB

MD5
5ce1b9dc5045d8a5814e47b63ce9bc74

SHA1
30c7cd5e28af123cc6feba7018f71f75115e5162

SHA256
492978e4dfd1b05372115e1c086979010422c2a7af8ac812c232e4b9479b9f45

SHA512
7a7bc0bffea1eacf5959b2966caa7a02d63ee43561ee479ddceeebd4a853b33bfc36e7014432d9d671989594ff18ea24f757163bea9bb85c515c2377e602d045

Download Submit
C:\Windows\System\josogeP.exe

Filesize
1.8MB

MD5
fd5ef711dcd8e509071d4c08d574989e

SHA1
0e498cc453c9c0419a1eff4cbb0510d5aa96aa85

SHA256
625df424415285662c6a27e7aaa354498ed8985015b0cd35e32c9dd29fdb978c

SHA512
1ea0129ef38bf2c6643a88cca7ab7a5338253de11cd4cad6b81c762a78e4c9fb109f2d599cd198296a49e7b14b746f89d0f4f7c86b21e292cfe4b54f38adaab7

Download Submit
C:\Windows\System\kEndhsA.exe

Filesize
1.8MB

MD5
b2bc69e3d65eab3730f7053f587d1c22

SHA1
bd27126a5fc7cb300fdb5569d59aa997f8863371

SHA256
1f6f567e27fd6949c8c77ff406d20796154a3af86193a729b12d6ea5511fc73d

SHA512
f38f7b92676fdbe2282d5b1c5e1522a8febba95e4295e0d7179bea9bb46586d4c079de4e12b9c449e788061abdb2fe8610d3b349b8f34c2a1dfb233b84e82b13

Download Submit
C:\Windows\System\kNOPXPR.exe

Filesize
1.8MB

MD5
6ce4a7a9e0b8c762864461c08d4a6d09

SHA1
3f63f32f1c9f381d9688b7b859e77d857497967b

SHA256
af77bcf05382738fb3f9c7b1d12a89698e9be2f55b585d3425a0ba98c7e16ec7

SHA512
7671651365317c4d9982f8312997c492d623ab1ea7099a4c65e54f944c966dd31fa8949b210e4e6cbfca919aafb13e6df8c778a12d9aa9d0e4923faebddf6ea0

Download Submit
C:\Windows\System\nHuzbYA.exe

Filesize
1.8MB

MD5
f20901892cd773728f6c23c8ad3788b9

SHA1
8a14c7edad630f33c25c24b5285ed1ad4acb5c94

SHA256
9f67723e7a8ccfca1a8fdcbe76dfafa701ca604976923d266005580058f5bc37

SHA512
d3f5ad4769bcf0a3380988fd837c1ffb7dc03c716f80c7f2632f8bac7c39b14b02bb664cf674fc826b98bc3e753feea4d109a2b2d4b4715ca9edd8b416c69aa2

Download Submit
C:\Windows\System\pETBCKa.exe

Filesize
1.8MB

MD5
b5e9d0e26e00826ae2e6e971b0b806e1

SHA1
9360a442fd2fd84b7e3f7e287f31bfef69e053ca

SHA256
42477e3c62bffdc849f3761381b3a31ec5ab593b848b290f06197135b7fe6be8

SHA512
897e0ac37850596b9e4e018a8e25552be07bdc5f3b92fa0950b2b7954aa06ea413ad64d048cfad77ecb886b452031c68c9452faa0b4264535db8e92cb242d534

Download Submit
C:\Windows\System\plDWrgl.exe

Filesize
1.8MB

MD5
f9a18d6aa545cf0db42e7c9075ed3234

SHA1
1e52a87b55db34ae2f85bf5ce1be8fd2f6900238

SHA256
f9042035d323c268c21fa73ecb6b31fafd3a0545f447813569cff5c93fa7045f

SHA512
1bdabc720be816dfc15d68cb8af494b524457f829e4080715322c247f98ad520690915a58864ce2661d2993e2db8bf470da3100cbc0184eb7ef708dbd206a380

Download Submit
C:\Windows\System\tLJygQR.exe

Filesize
1.8MB

MD5
0785fd9f4a81a52221f151209a6e5a48

SHA1
f46cd766954b16840cd23cf6a289f2363173be6c

SHA256
4c2e51ac689299d6f0212e87121a19c73e4279a8cc005110498bbe7017ccd731

SHA512
9c6834e7f7e8d209cffdbe76cc03bce187fada5cc2f058699169f0e4f5e71d65192266abac5cd2d3c95460b5056b4ec61c3464f7b4aae6345d35538d4020dc6c

Download Submit
C:\Windows\System\tSGiPNx.exe

Filesize
1.8MB

MD5
f36a00c204492650eed980d1117202a6

SHA1
17f48d58b93ff7c017e7071402c74784ddc8542e

SHA256
b13a9dd7f13a2456fb2a0b8f19adc8d6339a80337821f651971cf60cfad25de9

SHA512
d11a2cea71a7d5cd99fb737022efad2416493de09561b02317123c86664186fd1f65be7069cae2bd4ded00537c7663a1cfa5efe69c20786010655b3aa8375899

Download Submit
C:\Windows\System\uOUvkYT.exe

Filesize
1.8MB

MD5
ca3d450b8be1ca2c947d8b9eca8bf542

SHA1
902a63b9fac17d61cdd09768e58acbf44ae0c463

SHA256
7ba7e59bca56acbed599fc0f9b5f93d90373c2d5c20159db09ca04c5f93a28a7

SHA512
4a2267f4154e14531435851f53dd62cd6ab37b0001aac6ab219616be126ba737a4306fbcc889bbe7b5e5dbc7f17a9afffb3d7d7b30639a9ac03141b3b7666284

Download Submit
C:\Windows\System\yHXPKbp.exe

Filesize
1.8MB

MD5
210b9ef79711c372f43f6d1211c3f3b8

SHA1
7d171f33753e2f58604cfe0f1781fc82f44b0dac

SHA256
2309e3ffa8b3a0d479e477f1c37fd66154676d405f9eee2c42c10faa0fb6fcf3

SHA512
d82e729119ee801560bd522a850779e6e7cd1cae0e12831e27a2a8623ef4ce2b25d7badc5a9b84c1335a6af7c98646fb569013476f0d118c98aca80d0dd28e4c

Download Submit
memory/2784-0-0x000001B206BC0000-0x000001B206BD0000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads