xmrig | 781f2be69392e84c15fba5664d9b018b51be10b2ecf000f0ef41dad9b98d35f5

Analysis

max time kernel
147s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
23/12/2024, 22:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

781f2be69392e84c15fba5664d9b018b51be10b2ecf000f0ef41dad9b98d35f5.exe
Size

1.7MB
MD5

95fdd7d792dd2b92131587b05c248f05
SHA1

27c76607e49da2fe54d2afe804ac5fe080aae01f
SHA256

781f2be69392e84c15fba5664d9b018b51be10b2ecf000f0ef41dad9b98d35f5
SHA512

ca60f15654414c4eef99bab6858cf26e9a2c0cb70c3409ed1c4845a1d0918d2f91d36ac283cde1e4715a65bec2bcb03d3c2f04124a95aa68921c2defa4032645
SSDEEP

49152:GezaTF8FcNkNdfE0pZ9ozttwIRxj4c5yOYFg8ZYDMTgk:GemTLkNdfE0pZyq

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 33 IoCs

miner

resource	yara_rule
behavioral2/files/0x000c000000023b35-4.dat	xmrig
behavioral2/files/0x000b000000023b8e-10.dat	xmrig
behavioral2/files/0x000a000000023b93-7.dat	xmrig
behavioral2/files/0x000a000000023b94-17.dat	xmrig
behavioral2/files/0x000a000000023b95-23.dat	xmrig
behavioral2/files/0x000a000000023b96-29.dat	xmrig
behavioral2/files/0x000a000000023b97-35.dat	xmrig
behavioral2/files/0x000a000000023b9a-53.dat	xmrig
behavioral2/files/0x000a000000023b9c-59.dat	xmrig
behavioral2/files/0x000a000000023ba9-124.dat	xmrig
behavioral2/files/0x000a000000023bb8-162.dat	xmrig
behavioral2/files/0x000b000000023baf-158.dat	xmrig
behavioral2/files/0x000b000000023bb0-157.dat	xmrig
behavioral2/files/0x000b000000023bae-153.dat	xmrig
behavioral2/files/0x000a000000023bad-148.dat	xmrig
behavioral2/files/0x000a000000023bac-142.dat	xmrig
behavioral2/files/0x000a000000023bab-138.dat	xmrig
behavioral2/files/0x000a000000023baa-133.dat	xmrig
behavioral2/files/0x000a000000023ba8-122.dat	xmrig
behavioral2/files/0x000a000000023ba7-118.dat	xmrig
behavioral2/files/0x000a000000023ba6-112.dat	xmrig
behavioral2/files/0x000a000000023ba5-108.dat	xmrig
behavioral2/files/0x000a000000023ba4-102.dat	xmrig
behavioral2/files/0x000a000000023ba3-98.dat	xmrig
behavioral2/files/0x000a000000023ba2-92.dat	xmrig
behavioral2/files/0x000a000000023ba1-88.dat	xmrig
behavioral2/files/0x000a000000023ba0-83.dat	xmrig
behavioral2/files/0x000a000000023b9f-77.dat	xmrig
behavioral2/files/0x000a000000023b9e-73.dat	xmrig
behavioral2/files/0x000a000000023b9d-67.dat	xmrig
behavioral2/files/0x000a000000023b9b-57.dat	xmrig
behavioral2/files/0x000a000000023b99-45.dat	xmrig
behavioral2/files/0x000a000000023b98-42.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
3260	nWPJHkl.exe
3556	JmIzyTF.exe
3824	igbSLjm.exe
2828	okunENr.exe
2436	MGEmoeb.exe
4520	wyxgQcb.exe
1932	AInLaMU.exe
4456	nsAPokm.exe
4796	hZBWEFg.exe
3024	hcXkNYY.exe
2724	fZvMExT.exe
2452	PLWsEdP.exe
1388	nOZdrTC.exe
4604	yYpmtzc.exe
2948	afSkKju.exe
2800	uWLUrsO.exe
3264	ZsThDcl.exe
4568	reQwsBm.exe
4356	ZnfjhJc.exe
4664	CsMPKlP.exe
2004	ykTmtHv.exe
4916	vevcylF.exe
1160	MZKJbsf.exe
2036	nnDgAdr.exe
3604	lzdTuNA.exe
4812	icjjgQO.exe
4160	sqcrAIR.exe
5080	ZWfckTr.exe
2092	QUcPzDi.exe
4692	ZTljZmf.exe
1780	aUGUgjO.exe
3784	zWuMmyu.exe
1380	OOxCyKc.exe
4840	FRuPIwy.exe
2556	rsFDcQw.exe
3620	DKmLSmh.exe
2448	FrIkHBy.exe
4224	LJBcuPc.exe
852	kguBlVN.exe
3720	HLVBRsU.exe
3608	EBazBPi.exe
4268	TrcNLJt.exe
3992	RFxPWlv.exe
3068	cNmJrKc.exe
2860	cEDqTZh.exe
4516	xJscBEk.exe
4368	YdvnlSA.exe
3464	srFdmEG.exe
4072	rJvYFMC.exe
3296	CbXtDNn.exe
4820	vSMRjVR.exe
3844	INTZIFf.exe
1744	WdMJwmz.exe
2832	YrSaHWv.exe
3656	rkxztZC.exe
2268	WcRZioC.exe
2260	QivBJGj.exe
4696	quPEdDe.exe
1808	dxGHiOs.exe
2676	CTYrFSo.exe
4672	oQTDMvx.exe
1180	iMrxQAB.exe
2568	ebZUaYF.exe
4408	AfoiBWL.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\rJqZVkX.exe	781f2be69392e84c15fba5664d9b018b51be10b2ecf000f0ef41dad9b98d35f5.exe
File created	C:\Windows\System\SFeBjJe.exe	781f2be69392e84c15fba5664d9b018b51be10b2ecf000f0ef41dad9b98d35f5.exe
File created	C:\Windows\System\FEGtNOv.exe	781f2be69392e84c15fba5664d9b018b51be10b2ecf000f0ef41dad9b98d35f5.exe
File created	C:\Windows\System\fFvbceM.exe	781f2be69392e84c15fba5664d9b018b51be10b2ecf000f0ef41dad9b98d35f5.exe
File created	C:\Windows\System\GJwdGFZ.exe	781f2be69392e84c15fba5664d9b018b51be10b2ecf000f0ef41dad9b98d35f5.exe
File created	C:\Windows\System\WzfAgBQ.exe	781f2be69392e84c15fba5664d9b018b51be10b2ecf000f0ef41dad9b98d35f5.exe
File created	C:\Windows\System\vhHlLBl.exe	781f2be69392e84c15fba5664d9b018b51be10b2ecf000f0ef41dad9b98d35f5.exe
File created	C:\Windows\System\DasZWBD.exe	781f2be69392e84c15fba5664d9b018b51be10b2ecf000f0ef41dad9b98d35f5.exe
File created	C:\Windows\System\cEDqTZh.exe	781f2be69392e84c15fba5664d9b018b51be10b2ecf000f0ef41dad9b98d35f5.exe
File created	C:\Windows\System\uDRnoJC.exe	781f2be69392e84c15fba5664d9b018b51be10b2ecf000f0ef41dad9b98d35f5.exe
File created	C:\Windows\System\xabYleu.exe	781f2be69392e84c15fba5664d9b018b51be10b2ecf000f0ef41dad9b98d35f5.exe
File created	C:\Windows\System\DVXXhsi.exe	781f2be69392e84c15fba5664d9b018b51be10b2ecf000f0ef41dad9b98d35f5.exe
File created	C:\Windows\System\vFkOHlL.exe	781f2be69392e84c15fba5664d9b018b51be10b2ecf000f0ef41dad9b98d35f5.exe
File created	C:\Windows\System\lzLYHLA.exe	781f2be69392e84c15fba5664d9b018b51be10b2ecf000f0ef41dad9b98d35f5.exe
File created	C:\Windows\System\SotvyxE.exe	781f2be69392e84c15fba5664d9b018b51be10b2ecf000f0ef41dad9b98d35f5.exe
File created	C:\Windows\System\hJOefvw.exe	781f2be69392e84c15fba5664d9b018b51be10b2ecf000f0ef41dad9b98d35f5.exe
File created	C:\Windows\System\nAOCqRJ.exe	781f2be69392e84c15fba5664d9b018b51be10b2ecf000f0ef41dad9b98d35f5.exe
File created	C:\Windows\System\ilzSbuA.exe	781f2be69392e84c15fba5664d9b018b51be10b2ecf000f0ef41dad9b98d35f5.exe
File created	C:\Windows\System\FkpTuJm.exe	781f2be69392e84c15fba5664d9b018b51be10b2ecf000f0ef41dad9b98d35f5.exe
File created	C:\Windows\System\JQGDDyy.exe	781f2be69392e84c15fba5664d9b018b51be10b2ecf000f0ef41dad9b98d35f5.exe
File created	C:\Windows\System\wfGwHmD.exe	781f2be69392e84c15fba5664d9b018b51be10b2ecf000f0ef41dad9b98d35f5.exe
File created	C:\Windows\System\mEiqBOn.exe	781f2be69392e84c15fba5664d9b018b51be10b2ecf000f0ef41dad9b98d35f5.exe
File created	C:\Windows\System\kjmhbHw.exe	781f2be69392e84c15fba5664d9b018b51be10b2ecf000f0ef41dad9b98d35f5.exe
File created	C:\Windows\System\oCOJRan.exe	781f2be69392e84c15fba5664d9b018b51be10b2ecf000f0ef41dad9b98d35f5.exe
File created	C:\Windows\System\KmTNxxL.exe	781f2be69392e84c15fba5664d9b018b51be10b2ecf000f0ef41dad9b98d35f5.exe
File created	C:\Windows\System\AyhMPwK.exe	781f2be69392e84c15fba5664d9b018b51be10b2ecf000f0ef41dad9b98d35f5.exe
File created	C:\Windows\System\OkcprFO.exe	781f2be69392e84c15fba5664d9b018b51be10b2ecf000f0ef41dad9b98d35f5.exe
File created	C:\Windows\System\IZMBaTl.exe	781f2be69392e84c15fba5664d9b018b51be10b2ecf000f0ef41dad9b98d35f5.exe
File created	C:\Windows\System\UkxTOfJ.exe	781f2be69392e84c15fba5664d9b018b51be10b2ecf000f0ef41dad9b98d35f5.exe
File created	C:\Windows\System\xFnaLbN.exe	781f2be69392e84c15fba5664d9b018b51be10b2ecf000f0ef41dad9b98d35f5.exe
File created	C:\Windows\System\htMSZZA.exe	781f2be69392e84c15fba5664d9b018b51be10b2ecf000f0ef41dad9b98d35f5.exe
File created	C:\Windows\System\gxhxued.exe	781f2be69392e84c15fba5664d9b018b51be10b2ecf000f0ef41dad9b98d35f5.exe
File created	C:\Windows\System\ipFcnNQ.exe	781f2be69392e84c15fba5664d9b018b51be10b2ecf000f0ef41dad9b98d35f5.exe
File created	C:\Windows\System\DtaTpJh.exe	781f2be69392e84c15fba5664d9b018b51be10b2ecf000f0ef41dad9b98d35f5.exe
File created	C:\Windows\System\MowFEXw.exe	781f2be69392e84c15fba5664d9b018b51be10b2ecf000f0ef41dad9b98d35f5.exe
File created	C:\Windows\System\DWlljog.exe	781f2be69392e84c15fba5664d9b018b51be10b2ecf000f0ef41dad9b98d35f5.exe
File created	C:\Windows\System\xOgyhxb.exe	781f2be69392e84c15fba5664d9b018b51be10b2ecf000f0ef41dad9b98d35f5.exe
File created	C:\Windows\System\FqaALZE.exe	781f2be69392e84c15fba5664d9b018b51be10b2ecf000f0ef41dad9b98d35f5.exe
File created	C:\Windows\System\BnBfLHf.exe	781f2be69392e84c15fba5664d9b018b51be10b2ecf000f0ef41dad9b98d35f5.exe
File created	C:\Windows\System\PWYldXP.exe	781f2be69392e84c15fba5664d9b018b51be10b2ecf000f0ef41dad9b98d35f5.exe
File created	C:\Windows\System\GRYwdQR.exe	781f2be69392e84c15fba5664d9b018b51be10b2ecf000f0ef41dad9b98d35f5.exe
File created	C:\Windows\System\xAEDaFu.exe	781f2be69392e84c15fba5664d9b018b51be10b2ecf000f0ef41dad9b98d35f5.exe
File created	C:\Windows\System\dxGHiOs.exe	781f2be69392e84c15fba5664d9b018b51be10b2ecf000f0ef41dad9b98d35f5.exe
File created	C:\Windows\System\ZWfckTr.exe	781f2be69392e84c15fba5664d9b018b51be10b2ecf000f0ef41dad9b98d35f5.exe
File created	C:\Windows\System\QivBJGj.exe	781f2be69392e84c15fba5664d9b018b51be10b2ecf000f0ef41dad9b98d35f5.exe
File created	C:\Windows\System\YTPyrMx.exe	781f2be69392e84c15fba5664d9b018b51be10b2ecf000f0ef41dad9b98d35f5.exe
File created	C:\Windows\System\MJbzRBB.exe	781f2be69392e84c15fba5664d9b018b51be10b2ecf000f0ef41dad9b98d35f5.exe
File created	C:\Windows\System\cncEJRD.exe	781f2be69392e84c15fba5664d9b018b51be10b2ecf000f0ef41dad9b98d35f5.exe
File created	C:\Windows\System\unFOrVG.exe	781f2be69392e84c15fba5664d9b018b51be10b2ecf000f0ef41dad9b98d35f5.exe
File created	C:\Windows\System\EXzdCWL.exe	781f2be69392e84c15fba5664d9b018b51be10b2ecf000f0ef41dad9b98d35f5.exe
File created	C:\Windows\System\WdMJwmz.exe	781f2be69392e84c15fba5664d9b018b51be10b2ecf000f0ef41dad9b98d35f5.exe
File created	C:\Windows\System\CVdDelB.exe	781f2be69392e84c15fba5664d9b018b51be10b2ecf000f0ef41dad9b98d35f5.exe
File created	C:\Windows\System\SXebjIH.exe	781f2be69392e84c15fba5664d9b018b51be10b2ecf000f0ef41dad9b98d35f5.exe
File created	C:\Windows\System\LLyZPXG.exe	781f2be69392e84c15fba5664d9b018b51be10b2ecf000f0ef41dad9b98d35f5.exe
File created	C:\Windows\System\pkxjBJO.exe	781f2be69392e84c15fba5664d9b018b51be10b2ecf000f0ef41dad9b98d35f5.exe
File created	C:\Windows\System\YSnIwwd.exe	781f2be69392e84c15fba5664d9b018b51be10b2ecf000f0ef41dad9b98d35f5.exe
File created	C:\Windows\System\WShhtyo.exe	781f2be69392e84c15fba5664d9b018b51be10b2ecf000f0ef41dad9b98d35f5.exe
File created	C:\Windows\System\EbTwJYa.exe	781f2be69392e84c15fba5664d9b018b51be10b2ecf000f0ef41dad9b98d35f5.exe
File created	C:\Windows\System\ADqaKnA.exe	781f2be69392e84c15fba5664d9b018b51be10b2ecf000f0ef41dad9b98d35f5.exe
File created	C:\Windows\System\DPEEUEu.exe	781f2be69392e84c15fba5664d9b018b51be10b2ecf000f0ef41dad9b98d35f5.exe
File created	C:\Windows\System\qfIfdkr.exe	781f2be69392e84c15fba5664d9b018b51be10b2ecf000f0ef41dad9b98d35f5.exe
File created	C:\Windows\System\bacgvQm.exe	781f2be69392e84c15fba5664d9b018b51be10b2ecf000f0ef41dad9b98d35f5.exe
File created	C:\Windows\System\gJZnEJp.exe	781f2be69392e84c15fba5664d9b018b51be10b2ecf000f0ef41dad9b98d35f5.exe
File created	C:\Windows\System\pSZaRrY.exe	781f2be69392e84c15fba5664d9b018b51be10b2ecf000f0ef41dad9b98d35f5.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	16500	dwm.exe
Token: SeChangeNotifyPrivilege	16500	dwm.exe
Token: 33	16500	dwm.exe
Token: SeIncBasePriorityPrivilege	16500	dwm.exe
Token: SeShutdownPrivilege	16500	dwm.exe
Token: SeCreatePagefilePrivilege	16500	dwm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1764 wrote to memory of 3260	1764	781f2be69392e84c15fba5664d9b018b51be10b2ecf000f0ef41dad9b98d35f5.exe	84
PID 1764 wrote to memory of 3260	1764	781f2be69392e84c15fba5664d9b018b51be10b2ecf000f0ef41dad9b98d35f5.exe	84
PID 1764 wrote to memory of 3556	1764	781f2be69392e84c15fba5664d9b018b51be10b2ecf000f0ef41dad9b98d35f5.exe	85
PID 1764 wrote to memory of 3556	1764	781f2be69392e84c15fba5664d9b018b51be10b2ecf000f0ef41dad9b98d35f5.exe	85
PID 1764 wrote to memory of 3824	1764	781f2be69392e84c15fba5664d9b018b51be10b2ecf000f0ef41dad9b98d35f5.exe	86
PID 1764 wrote to memory of 3824	1764	781f2be69392e84c15fba5664d9b018b51be10b2ecf000f0ef41dad9b98d35f5.exe	86
PID 1764 wrote to memory of 2828	1764	781f2be69392e84c15fba5664d9b018b51be10b2ecf000f0ef41dad9b98d35f5.exe	87
PID 1764 wrote to memory of 2828	1764	781f2be69392e84c15fba5664d9b018b51be10b2ecf000f0ef41dad9b98d35f5.exe	87
PID 1764 wrote to memory of 2436	1764	781f2be69392e84c15fba5664d9b018b51be10b2ecf000f0ef41dad9b98d35f5.exe	88
PID 1764 wrote to memory of 2436	1764	781f2be69392e84c15fba5664d9b018b51be10b2ecf000f0ef41dad9b98d35f5.exe	88
PID 1764 wrote to memory of 4520	1764	781f2be69392e84c15fba5664d9b018b51be10b2ecf000f0ef41dad9b98d35f5.exe	89
PID 1764 wrote to memory of 4520	1764	781f2be69392e84c15fba5664d9b018b51be10b2ecf000f0ef41dad9b98d35f5.exe	89
PID 1764 wrote to memory of 1932	1764	781f2be69392e84c15fba5664d9b018b51be10b2ecf000f0ef41dad9b98d35f5.exe	90
PID 1764 wrote to memory of 1932	1764	781f2be69392e84c15fba5664d9b018b51be10b2ecf000f0ef41dad9b98d35f5.exe	90
PID 1764 wrote to memory of 4456	1764	781f2be69392e84c15fba5664d9b018b51be10b2ecf000f0ef41dad9b98d35f5.exe	91
PID 1764 wrote to memory of 4456	1764	781f2be69392e84c15fba5664d9b018b51be10b2ecf000f0ef41dad9b98d35f5.exe	91
PID 1764 wrote to memory of 4796	1764	781f2be69392e84c15fba5664d9b018b51be10b2ecf000f0ef41dad9b98d35f5.exe	92
PID 1764 wrote to memory of 4796	1764	781f2be69392e84c15fba5664d9b018b51be10b2ecf000f0ef41dad9b98d35f5.exe	92
PID 1764 wrote to memory of 3024	1764	781f2be69392e84c15fba5664d9b018b51be10b2ecf000f0ef41dad9b98d35f5.exe	93
PID 1764 wrote to memory of 3024	1764	781f2be69392e84c15fba5664d9b018b51be10b2ecf000f0ef41dad9b98d35f5.exe	93
PID 1764 wrote to memory of 2724	1764	781f2be69392e84c15fba5664d9b018b51be10b2ecf000f0ef41dad9b98d35f5.exe	94
PID 1764 wrote to memory of 2724	1764	781f2be69392e84c15fba5664d9b018b51be10b2ecf000f0ef41dad9b98d35f5.exe	94
PID 1764 wrote to memory of 2452	1764	781f2be69392e84c15fba5664d9b018b51be10b2ecf000f0ef41dad9b98d35f5.exe	95
PID 1764 wrote to memory of 2452	1764	781f2be69392e84c15fba5664d9b018b51be10b2ecf000f0ef41dad9b98d35f5.exe	95
PID 1764 wrote to memory of 1388	1764	781f2be69392e84c15fba5664d9b018b51be10b2ecf000f0ef41dad9b98d35f5.exe	96
PID 1764 wrote to memory of 1388	1764	781f2be69392e84c15fba5664d9b018b51be10b2ecf000f0ef41dad9b98d35f5.exe	96
PID 1764 wrote to memory of 4604	1764	781f2be69392e84c15fba5664d9b018b51be10b2ecf000f0ef41dad9b98d35f5.exe	97
PID 1764 wrote to memory of 4604	1764	781f2be69392e84c15fba5664d9b018b51be10b2ecf000f0ef41dad9b98d35f5.exe	97
PID 1764 wrote to memory of 2948	1764	781f2be69392e84c15fba5664d9b018b51be10b2ecf000f0ef41dad9b98d35f5.exe	98
PID 1764 wrote to memory of 2948	1764	781f2be69392e84c15fba5664d9b018b51be10b2ecf000f0ef41dad9b98d35f5.exe	98
PID 1764 wrote to memory of 2800	1764	781f2be69392e84c15fba5664d9b018b51be10b2ecf000f0ef41dad9b98d35f5.exe	99
PID 1764 wrote to memory of 2800	1764	781f2be69392e84c15fba5664d9b018b51be10b2ecf000f0ef41dad9b98d35f5.exe	99
PID 1764 wrote to memory of 3264	1764	781f2be69392e84c15fba5664d9b018b51be10b2ecf000f0ef41dad9b98d35f5.exe	100
PID 1764 wrote to memory of 3264	1764	781f2be69392e84c15fba5664d9b018b51be10b2ecf000f0ef41dad9b98d35f5.exe	100
PID 1764 wrote to memory of 4568	1764	781f2be69392e84c15fba5664d9b018b51be10b2ecf000f0ef41dad9b98d35f5.exe	101
PID 1764 wrote to memory of 4568	1764	781f2be69392e84c15fba5664d9b018b51be10b2ecf000f0ef41dad9b98d35f5.exe	101
PID 1764 wrote to memory of 4356	1764	781f2be69392e84c15fba5664d9b018b51be10b2ecf000f0ef41dad9b98d35f5.exe	102
PID 1764 wrote to memory of 4356	1764	781f2be69392e84c15fba5664d9b018b51be10b2ecf000f0ef41dad9b98d35f5.exe	102
PID 1764 wrote to memory of 4664	1764	781f2be69392e84c15fba5664d9b018b51be10b2ecf000f0ef41dad9b98d35f5.exe	103
PID 1764 wrote to memory of 4664	1764	781f2be69392e84c15fba5664d9b018b51be10b2ecf000f0ef41dad9b98d35f5.exe	103
PID 1764 wrote to memory of 2004	1764	781f2be69392e84c15fba5664d9b018b51be10b2ecf000f0ef41dad9b98d35f5.exe	104
PID 1764 wrote to memory of 2004	1764	781f2be69392e84c15fba5664d9b018b51be10b2ecf000f0ef41dad9b98d35f5.exe	104
PID 1764 wrote to memory of 4916	1764	781f2be69392e84c15fba5664d9b018b51be10b2ecf000f0ef41dad9b98d35f5.exe	105
PID 1764 wrote to memory of 4916	1764	781f2be69392e84c15fba5664d9b018b51be10b2ecf000f0ef41dad9b98d35f5.exe	105
PID 1764 wrote to memory of 1160	1764	781f2be69392e84c15fba5664d9b018b51be10b2ecf000f0ef41dad9b98d35f5.exe	106
PID 1764 wrote to memory of 1160	1764	781f2be69392e84c15fba5664d9b018b51be10b2ecf000f0ef41dad9b98d35f5.exe	106
PID 1764 wrote to memory of 2036	1764	781f2be69392e84c15fba5664d9b018b51be10b2ecf000f0ef41dad9b98d35f5.exe	107
PID 1764 wrote to memory of 2036	1764	781f2be69392e84c15fba5664d9b018b51be10b2ecf000f0ef41dad9b98d35f5.exe	107
PID 1764 wrote to memory of 3604	1764	781f2be69392e84c15fba5664d9b018b51be10b2ecf000f0ef41dad9b98d35f5.exe	108
PID 1764 wrote to memory of 3604	1764	781f2be69392e84c15fba5664d9b018b51be10b2ecf000f0ef41dad9b98d35f5.exe	108
PID 1764 wrote to memory of 4812	1764	781f2be69392e84c15fba5664d9b018b51be10b2ecf000f0ef41dad9b98d35f5.exe	109
PID 1764 wrote to memory of 4812	1764	781f2be69392e84c15fba5664d9b018b51be10b2ecf000f0ef41dad9b98d35f5.exe	109
PID 1764 wrote to memory of 4160	1764	781f2be69392e84c15fba5664d9b018b51be10b2ecf000f0ef41dad9b98d35f5.exe	110
PID 1764 wrote to memory of 4160	1764	781f2be69392e84c15fba5664d9b018b51be10b2ecf000f0ef41dad9b98d35f5.exe	110
PID 1764 wrote to memory of 5080	1764	781f2be69392e84c15fba5664d9b018b51be10b2ecf000f0ef41dad9b98d35f5.exe	111
PID 1764 wrote to memory of 5080	1764	781f2be69392e84c15fba5664d9b018b51be10b2ecf000f0ef41dad9b98d35f5.exe	111
PID 1764 wrote to memory of 2092	1764	781f2be69392e84c15fba5664d9b018b51be10b2ecf000f0ef41dad9b98d35f5.exe	112
PID 1764 wrote to memory of 2092	1764	781f2be69392e84c15fba5664d9b018b51be10b2ecf000f0ef41dad9b98d35f5.exe	112
PID 1764 wrote to memory of 4692	1764	781f2be69392e84c15fba5664d9b018b51be10b2ecf000f0ef41dad9b98d35f5.exe	113
PID 1764 wrote to memory of 4692	1764	781f2be69392e84c15fba5664d9b018b51be10b2ecf000f0ef41dad9b98d35f5.exe	113
PID 1764 wrote to memory of 1780	1764	781f2be69392e84c15fba5664d9b018b51be10b2ecf000f0ef41dad9b98d35f5.exe	114
PID 1764 wrote to memory of 1780	1764	781f2be69392e84c15fba5664d9b018b51be10b2ecf000f0ef41dad9b98d35f5.exe	114
PID 1764 wrote to memory of 3784	1764	781f2be69392e84c15fba5664d9b018b51be10b2ecf000f0ef41dad9b98d35f5.exe	115
PID 1764 wrote to memory of 3784	1764	781f2be69392e84c15fba5664d9b018b51be10b2ecf000f0ef41dad9b98d35f5.exe	115

C:\Users\Admin\AppData\Local\Temp\781f2be69392e84c15fba5664d9b018b51be10b2ecf000f0ef41dad9b98d35f5.exe
"C:\Users\Admin\AppData\Local\Temp\781f2be69392e84c15fba5664d9b018b51be10b2ecf000f0ef41dad9b98d35f5.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1764
- C:\Windows\System\nWPJHkl.exe
  C:\Windows\System\nWPJHkl.exe
  2⤵
  - Executes dropped EXE
  PID:3260
- C:\Windows\System\JmIzyTF.exe
  C:\Windows\System\JmIzyTF.exe
  2⤵
  - Executes dropped EXE
  PID:3556
- C:\Windows\System\igbSLjm.exe
  C:\Windows\System\igbSLjm.exe
  2⤵
  - Executes dropped EXE
  PID:3824
- C:\Windows\System\okunENr.exe
  C:\Windows\System\okunENr.exe
  2⤵
  - Executes dropped EXE
  PID:2828
- C:\Windows\System\MGEmoeb.exe
  C:\Windows\System\MGEmoeb.exe
  2⤵
  - Executes dropped EXE
  PID:2436
- C:\Windows\System\wyxgQcb.exe
  C:\Windows\System\wyxgQcb.exe
  2⤵
  - Executes dropped EXE
  PID:4520
- C:\Windows\System\AInLaMU.exe
  C:\Windows\System\AInLaMU.exe
  2⤵
  - Executes dropped EXE
  PID:1932
- C:\Windows\System\nsAPokm.exe
  C:\Windows\System\nsAPokm.exe
  2⤵
  - Executes dropped EXE
  PID:4456
- C:\Windows\System\hZBWEFg.exe
  C:\Windows\System\hZBWEFg.exe
  2⤵
  - Executes dropped EXE
  PID:4796
- C:\Windows\System\hcXkNYY.exe
  C:\Windows\System\hcXkNYY.exe
  2⤵
  - Executes dropped EXE
  PID:3024
- C:\Windows\System\fZvMExT.exe
  C:\Windows\System\fZvMExT.exe
  2⤵
  - Executes dropped EXE
  PID:2724
- C:\Windows\System\PLWsEdP.exe
  C:\Windows\System\PLWsEdP.exe
  2⤵
  - Executes dropped EXE
  PID:2452
- C:\Windows\System\nOZdrTC.exe
  C:\Windows\System\nOZdrTC.exe
  2⤵
  - Executes dropped EXE
  PID:1388
- C:\Windows\System\yYpmtzc.exe
  C:\Windows\System\yYpmtzc.exe
  2⤵
  - Executes dropped EXE
  PID:4604
- C:\Windows\System\afSkKju.exe
  C:\Windows\System\afSkKju.exe
  2⤵
  - Executes dropped EXE
  PID:2948
- C:\Windows\System\uWLUrsO.exe
  C:\Windows\System\uWLUrsO.exe
  2⤵
  - Executes dropped EXE
  PID:2800
- C:\Windows\System\ZsThDcl.exe
  C:\Windows\System\ZsThDcl.exe
  2⤵
  - Executes dropped EXE
  PID:3264
- C:\Windows\System\reQwsBm.exe
  C:\Windows\System\reQwsBm.exe
  2⤵
  - Executes dropped EXE
  PID:4568
- C:\Windows\System\ZnfjhJc.exe
  C:\Windows\System\ZnfjhJc.exe
  2⤵
  - Executes dropped EXE
  PID:4356
- C:\Windows\System\CsMPKlP.exe
  C:\Windows\System\CsMPKlP.exe
  2⤵
  - Executes dropped EXE
  PID:4664
- C:\Windows\System\ykTmtHv.exe
  C:\Windows\System\ykTmtHv.exe
  2⤵
  - Executes dropped EXE
  PID:2004
- C:\Windows\System\vevcylF.exe
  C:\Windows\System\vevcylF.exe
  2⤵
  - Executes dropped EXE
  PID:4916
- C:\Windows\System\MZKJbsf.exe
  C:\Windows\System\MZKJbsf.exe
  2⤵
  - Executes dropped EXE
  PID:1160
- C:\Windows\System\nnDgAdr.exe
  C:\Windows\System\nnDgAdr.exe
  2⤵
  - Executes dropped EXE
  PID:2036
- C:\Windows\System\lzdTuNA.exe
  C:\Windows\System\lzdTuNA.exe
  2⤵
  - Executes dropped EXE
  PID:3604
- C:\Windows\System\icjjgQO.exe
  C:\Windows\System\icjjgQO.exe
  2⤵
  - Executes dropped EXE
  PID:4812
- C:\Windows\System\sqcrAIR.exe
  C:\Windows\System\sqcrAIR.exe
  2⤵
  - Executes dropped EXE
  PID:4160
- C:\Windows\System\ZWfckTr.exe
  C:\Windows\System\ZWfckTr.exe
  2⤵
  - Executes dropped EXE
  PID:5080
- C:\Windows\System\QUcPzDi.exe
  C:\Windows\System\QUcPzDi.exe
  2⤵
  - Executes dropped EXE
  PID:2092
- C:\Windows\System\ZTljZmf.exe
  C:\Windows\System\ZTljZmf.exe
  2⤵
  - Executes dropped EXE
  PID:4692
- C:\Windows\System\aUGUgjO.exe
  C:\Windows\System\aUGUgjO.exe
  2⤵
  - Executes dropped EXE
  PID:1780
- C:\Windows\System\zWuMmyu.exe
  C:\Windows\System\zWuMmyu.exe
  2⤵
  - Executes dropped EXE
  PID:3784
- C:\Windows\System\OOxCyKc.exe
  C:\Windows\System\OOxCyKc.exe
  2⤵
  - Executes dropped EXE
  PID:1380
- C:\Windows\System\FRuPIwy.exe
  C:\Windows\System\FRuPIwy.exe
  2⤵
  - Executes dropped EXE
  PID:4840
- C:\Windows\System\rsFDcQw.exe
  C:\Windows\System\rsFDcQw.exe
  2⤵
  - Executes dropped EXE
  PID:2556
- C:\Windows\System\DKmLSmh.exe
  C:\Windows\System\DKmLSmh.exe
  2⤵
  - Executes dropped EXE
  PID:3620
- C:\Windows\System\FrIkHBy.exe
  C:\Windows\System\FrIkHBy.exe
  2⤵
  - Executes dropped EXE
  PID:2448
- C:\Windows\System\LJBcuPc.exe
  C:\Windows\System\LJBcuPc.exe
  2⤵
  - Executes dropped EXE
  PID:4224
- C:\Windows\System\kguBlVN.exe
  C:\Windows\System\kguBlVN.exe
  2⤵
  - Executes dropped EXE
  PID:852
- C:\Windows\System\HLVBRsU.exe
  C:\Windows\System\HLVBRsU.exe
  2⤵
  - Executes dropped EXE
  PID:3720
- C:\Windows\System\EBazBPi.exe
  C:\Windows\System\EBazBPi.exe
  2⤵
  - Executes dropped EXE
  PID:3608
- C:\Windows\System\TrcNLJt.exe
  C:\Windows\System\TrcNLJt.exe
  2⤵
  - Executes dropped EXE
  PID:4268
- C:\Windows\System\RFxPWlv.exe
  C:\Windows\System\RFxPWlv.exe
  2⤵
  - Executes dropped EXE
  PID:3992
- C:\Windows\System\cNmJrKc.exe
  C:\Windows\System\cNmJrKc.exe
  2⤵
  - Executes dropped EXE
  PID:3068
- C:\Windows\System\cEDqTZh.exe
  C:\Windows\System\cEDqTZh.exe
  2⤵
  - Executes dropped EXE
  PID:2860
- C:\Windows\System\xJscBEk.exe
  C:\Windows\System\xJscBEk.exe
  2⤵
  - Executes dropped EXE
  PID:4516
- C:\Windows\System\YdvnlSA.exe
  C:\Windows\System\YdvnlSA.exe
  2⤵
  - Executes dropped EXE
  PID:4368
- C:\Windows\System\srFdmEG.exe
  C:\Windows\System\srFdmEG.exe
  2⤵
  - Executes dropped EXE
  PID:3464
- C:\Windows\System\rJvYFMC.exe
  C:\Windows\System\rJvYFMC.exe
  2⤵
  - Executes dropped EXE
  PID:4072
- C:\Windows\System\CbXtDNn.exe
  C:\Windows\System\CbXtDNn.exe
  2⤵
  - Executes dropped EXE
  PID:3296
- C:\Windows\System\vSMRjVR.exe
  C:\Windows\System\vSMRjVR.exe
  2⤵
  - Executes dropped EXE
  PID:4820
- C:\Windows\System\INTZIFf.exe
  C:\Windows\System\INTZIFf.exe
  2⤵
  - Executes dropped EXE
  PID:3844
- C:\Windows\System\WdMJwmz.exe
  C:\Windows\System\WdMJwmz.exe
  2⤵
  - Executes dropped EXE
  PID:1744
- C:\Windows\System\YrSaHWv.exe
  C:\Windows\System\YrSaHWv.exe
  2⤵
  - Executes dropped EXE
  PID:2832
- C:\Windows\System\rkxztZC.exe
  C:\Windows\System\rkxztZC.exe
  2⤵
  - Executes dropped EXE
  PID:3656
- C:\Windows\System\WcRZioC.exe
  C:\Windows\System\WcRZioC.exe
  2⤵
  - Executes dropped EXE
  PID:2268
- C:\Windows\System\QivBJGj.exe
  C:\Windows\System\QivBJGj.exe
  2⤵
  - Executes dropped EXE
  PID:2260
- C:\Windows\System\quPEdDe.exe
  C:\Windows\System\quPEdDe.exe
  2⤵
  - Executes dropped EXE
  PID:4696
- C:\Windows\System\dxGHiOs.exe
  C:\Windows\System\dxGHiOs.exe
  2⤵
  - Executes dropped EXE
  PID:1808
- C:\Windows\System\CTYrFSo.exe
  C:\Windows\System\CTYrFSo.exe
  2⤵
  - Executes dropped EXE
  PID:2676
- C:\Windows\System\oQTDMvx.exe
  C:\Windows\System\oQTDMvx.exe
  2⤵
  - Executes dropped EXE
  PID:4672
- C:\Windows\System\iMrxQAB.exe
  C:\Windows\System\iMrxQAB.exe
  2⤵
  - Executes dropped EXE
  PID:1180
- C:\Windows\System\ebZUaYF.exe
  C:\Windows\System\ebZUaYF.exe
  2⤵
  - Executes dropped EXE
  PID:2568
- C:\Windows\System\AfoiBWL.exe
  C:\Windows\System\AfoiBWL.exe
  2⤵
  - Executes dropped EXE
  PID:4408
- C:\Windows\System\TSMsoZs.exe
  C:\Windows\System\TSMsoZs.exe
  2⤵
  PID:1036
- C:\Windows\System\ckAQQUc.exe
  C:\Windows\System\ckAQQUc.exe
  2⤵
  PID:1920
- C:\Windows\System\IZMBaTl.exe
  C:\Windows\System\IZMBaTl.exe
  2⤵
  PID:5012
- C:\Windows\System\CWkbsEO.exe
  C:\Windows\System\CWkbsEO.exe
  2⤵
  PID:832
- C:\Windows\System\tlcyjVz.exe
  C:\Windows\System\tlcyjVz.exe
  2⤵
  PID:2364
- C:\Windows\System\gNvlnbZ.exe
  C:\Windows\System\gNvlnbZ.exe
  2⤵
  PID:4344
- C:\Windows\System\ULnyiNR.exe
  C:\Windows\System\ULnyiNR.exe
  2⤵
  PID:4896
- C:\Windows\System\oicZVRj.exe
  C:\Windows\System\oicZVRj.exe
  2⤵
  PID:4880
- C:\Windows\System\lrFYanJ.exe
  C:\Windows\System\lrFYanJ.exe
  2⤵
  PID:1608
- C:\Windows\System\ygBLDkp.exe
  C:\Windows\System\ygBLDkp.exe
  2⤵
  PID:1640
- C:\Windows\System\SmeKOho.exe
  C:\Windows\System\SmeKOho.exe
  2⤵
  PID:2428
- C:\Windows\System\qsbxREH.exe
  C:\Windows\System\qsbxREH.exe
  2⤵
  PID:5128
- C:\Windows\System\pkxjBJO.exe
  C:\Windows\System\pkxjBJO.exe
  2⤵
  PID:5156
- C:\Windows\System\hwKGhHI.exe
  C:\Windows\System\hwKGhHI.exe
  2⤵
  PID:5184
- C:\Windows\System\FqrMRAz.exe
  C:\Windows\System\FqrMRAz.exe
  2⤵
  PID:5212
- C:\Windows\System\qaPrxvl.exe
  C:\Windows\System\qaPrxvl.exe
  2⤵
  PID:5240
- C:\Windows\System\juLRILh.exe
  C:\Windows\System\juLRILh.exe
  2⤵
  PID:5268
- C:\Windows\System\azAIhdJ.exe
  C:\Windows\System\azAIhdJ.exe
  2⤵
  PID:5296
- C:\Windows\System\GdjKRWm.exe
  C:\Windows\System\GdjKRWm.exe
  2⤵
  PID:5328
- C:\Windows\System\NVuuMMk.exe
  C:\Windows\System\NVuuMMk.exe
  2⤵
  PID:5352
- C:\Windows\System\OEKLLAR.exe
  C:\Windows\System\OEKLLAR.exe
  2⤵
  PID:5384
- C:\Windows\System\kXYaCrA.exe
  C:\Windows\System\kXYaCrA.exe
  2⤵
  PID:5412
- C:\Windows\System\HCNekxW.exe
  C:\Windows\System\HCNekxW.exe
  2⤵
  PID:5440
- C:\Windows\System\gcDodRb.exe
  C:\Windows\System\gcDodRb.exe
  2⤵
  PID:5464
- C:\Windows\System\UgpjGPj.exe
  C:\Windows\System\UgpjGPj.exe
  2⤵
  PID:5496
- C:\Windows\System\UUPRSHH.exe
  C:\Windows\System\UUPRSHH.exe
  2⤵
  PID:5524
- C:\Windows\System\VKAoKLm.exe
  C:\Windows\System\VKAoKLm.exe
  2⤵
  PID:5548
- C:\Windows\System\KenjXgp.exe
  C:\Windows\System\KenjXgp.exe
  2⤵
  PID:5580
- C:\Windows\System\GMhHwDt.exe
  C:\Windows\System\GMhHwDt.exe
  2⤵
  PID:5608
- C:\Windows\System\AhNdjqt.exe
  C:\Windows\System\AhNdjqt.exe
  2⤵
  PID:5636
- C:\Windows\System\LoJJwyI.exe
  C:\Windows\System\LoJJwyI.exe
  2⤵
  PID:5664
- C:\Windows\System\foxAiHY.exe
  C:\Windows\System\foxAiHY.exe
  2⤵
  PID:5692
- C:\Windows\System\cjkpxJX.exe
  C:\Windows\System\cjkpxJX.exe
  2⤵
  PID:5720
- C:\Windows\System\aGFqbWB.exe
  C:\Windows\System\aGFqbWB.exe
  2⤵
  PID:5748
- C:\Windows\System\cPqIjgp.exe
  C:\Windows\System\cPqIjgp.exe
  2⤵
  PID:5772
- C:\Windows\System\PSSzhAa.exe
  C:\Windows\System\PSSzhAa.exe
  2⤵
  PID:5800
- C:\Windows\System\YzVAFet.exe
  C:\Windows\System\YzVAFet.exe
  2⤵
  PID:5828
- C:\Windows\System\FGLmIBW.exe
  C:\Windows\System\FGLmIBW.exe
  2⤵
  PID:5860
- C:\Windows\System\IyreZzD.exe
  C:\Windows\System\IyreZzD.exe
  2⤵
  PID:5888
- C:\Windows\System\LEIwiFy.exe
  C:\Windows\System\LEIwiFy.exe
  2⤵
  PID:5912
- C:\Windows\System\xeqTReN.exe
  C:\Windows\System\xeqTReN.exe
  2⤵
  PID:5940
- C:\Windows\System\dMnkfCY.exe
  C:\Windows\System\dMnkfCY.exe
  2⤵
  PID:5968
- C:\Windows\System\yrBwfOm.exe
  C:\Windows\System\yrBwfOm.exe
  2⤵
  PID:6032
- C:\Windows\System\LWbkNmx.exe
  C:\Windows\System\LWbkNmx.exe
  2⤵
  PID:6048
- C:\Windows\System\VsCuoWF.exe
  C:\Windows\System\VsCuoWF.exe
  2⤵
  PID:6064
- C:\Windows\System\kUKSXVJ.exe
  C:\Windows\System\kUKSXVJ.exe
  2⤵
  PID:6092
- C:\Windows\System\Biqjrig.exe
  C:\Windows\System\Biqjrig.exe
  2⤵
  PID:6120
- C:\Windows\System\xYWDPlU.exe
  C:\Windows\System\xYWDPlU.exe
  2⤵
  PID:1628
- C:\Windows\System\SNZwJCa.exe
  C:\Windows\System\SNZwJCa.exe
  2⤵
  PID:3804
- C:\Windows\System\QDjdwxH.exe
  C:\Windows\System\QDjdwxH.exe
  2⤵
  PID:3080
- C:\Windows\System\mPIFImP.exe
  C:\Windows\System\mPIFImP.exe
  2⤵
  PID:408
- C:\Windows\System\pNYhhjL.exe
  C:\Windows\System\pNYhhjL.exe
  2⤵
  PID:3292
- C:\Windows\System\vaJiwIv.exe
  C:\Windows\System\vaJiwIv.exe
  2⤵
  PID:1696
- C:\Windows\System\MmWRSva.exe
  C:\Windows\System\MmWRSva.exe
  2⤵
  PID:3744
- C:\Windows\System\myAOPLf.exe
  C:\Windows\System\myAOPLf.exe
  2⤵
  PID:5164
- C:\Windows\System\eIZeWAL.exe
  C:\Windows\System\eIZeWAL.exe
  2⤵
  PID:5228
- C:\Windows\System\EunHuUn.exe
  C:\Windows\System\EunHuUn.exe
  2⤵
  PID:5288
- C:\Windows\System\dzpBlEh.exe
  C:\Windows\System\dzpBlEh.exe
  2⤵
  PID:5364
- C:\Windows\System\zpUjScX.exe
  C:\Windows\System\zpUjScX.exe
  2⤵
  PID:5420
- C:\Windows\System\cncEJRD.exe
  C:\Windows\System\cncEJRD.exe
  2⤵
  PID:5480
- C:\Windows\System\trYBUbg.exe
  C:\Windows\System\trYBUbg.exe
  2⤵
  PID:5544
- C:\Windows\System\VavpYIk.exe
  C:\Windows\System\VavpYIk.exe
  2⤵
  PID:4412
- C:\Windows\System\NWvqZqa.exe
  C:\Windows\System\NWvqZqa.exe
  2⤵
  PID:5672
- C:\Windows\System\ZdhlQEn.exe
  C:\Windows\System\ZdhlQEn.exe
  2⤵
  PID:5736
- C:\Windows\System\OVGbjHS.exe
  C:\Windows\System\OVGbjHS.exe
  2⤵
  PID:5792
- C:\Windows\System\sRrMjJN.exe
  C:\Windows\System\sRrMjJN.exe
  2⤵
  PID:5848
- C:\Windows\System\EYovWPe.exe
  C:\Windows\System\EYovWPe.exe
  2⤵
  PID:5924
- C:\Windows\System\VzvQtVL.exe
  C:\Windows\System\VzvQtVL.exe
  2⤵
  PID:5984
- C:\Windows\System\UWaprQQ.exe
  C:\Windows\System\UWaprQQ.exe
  2⤵
  PID:6056
- C:\Windows\System\PMTzFUT.exe
  C:\Windows\System\PMTzFUT.exe
  2⤵
  PID:6112
- C:\Windows\System\MlzqnMx.exe
  C:\Windows\System\MlzqnMx.exe
  2⤵
  PID:4016
- C:\Windows\System\zOjGvll.exe
  C:\Windows\System\zOjGvll.exe
  2⤵
  PID:1540
- C:\Windows\System\SgKzLgG.exe
  C:\Windows\System\SgKzLgG.exe
  2⤵
  PID:1448
- C:\Windows\System\sbixNDr.exe
  C:\Windows\System\sbixNDr.exe
  2⤵
  PID:5256
- C:\Windows\System\EoouchK.exe
  C:\Windows\System\EoouchK.exe
  2⤵
  PID:4832
- C:\Windows\System\RNsqYoq.exe
  C:\Windows\System\RNsqYoq.exe
  2⤵
  PID:5512
- C:\Windows\System\ZvwsCyy.exe
  C:\Windows\System\ZvwsCyy.exe
  2⤵
  PID:5700
- C:\Windows\System\lfgqsRL.exe
  C:\Windows\System\lfgqsRL.exe
  2⤵
  PID:3052
- C:\Windows\System\wYFFiXz.exe
  C:\Windows\System\wYFFiXz.exe
  2⤵
  PID:5960
- C:\Windows\System\dERNjFW.exe
  C:\Windows\System\dERNjFW.exe
  2⤵
  PID:6164
- C:\Windows\System\VPTVDAc.exe
  C:\Windows\System\VPTVDAc.exe
  2⤵
  PID:6196
- C:\Windows\System\nmEGzpB.exe
  C:\Windows\System\nmEGzpB.exe
  2⤵
  PID:6224
- C:\Windows\System\YQqriCw.exe
  C:\Windows\System\YQqriCw.exe
  2⤵
  PID:6252
- C:\Windows\System\kzxGolI.exe
  C:\Windows\System\kzxGolI.exe
  2⤵
  PID:6280
- C:\Windows\System\VOEmlAY.exe
  C:\Windows\System\VOEmlAY.exe
  2⤵
  PID:6308
- C:\Windows\System\KEqVUWv.exe
  C:\Windows\System\KEqVUWv.exe
  2⤵
  PID:6336
- C:\Windows\System\OQWseHY.exe
  C:\Windows\System\OQWseHY.exe
  2⤵
  PID:6364
- C:\Windows\System\IabGOUJ.exe
  C:\Windows\System\IabGOUJ.exe
  2⤵
  PID:6392
- C:\Windows\System\Yghzcqd.exe
  C:\Windows\System\Yghzcqd.exe
  2⤵
  PID:6420
- C:\Windows\System\ESqSNqB.exe
  C:\Windows\System\ESqSNqB.exe
  2⤵
  PID:6448
- C:\Windows\System\kXkURbk.exe
  C:\Windows\System\kXkURbk.exe
  2⤵
  PID:6476
- C:\Windows\System\ASvDLIq.exe
  C:\Windows\System\ASvDLIq.exe
  2⤵
  PID:6504
- C:\Windows\System\SldJRbB.exe
  C:\Windows\System\SldJRbB.exe
  2⤵
  PID:6532
- C:\Windows\System\erivvbh.exe
  C:\Windows\System\erivvbh.exe
  2⤵
  PID:6560
- C:\Windows\System\UkxTOfJ.exe
  C:\Windows\System\UkxTOfJ.exe
  2⤵
  PID:6588
- C:\Windows\System\uvgeDXX.exe
  C:\Windows\System\uvgeDXX.exe
  2⤵
  PID:6616
- C:\Windows\System\WktxrGc.exe
  C:\Windows\System\WktxrGc.exe
  2⤵
  PID:6644
- C:\Windows\System\KlAfCWy.exe
  C:\Windows\System\KlAfCWy.exe
  2⤵
  PID:6672
- C:\Windows\System\LxmLLXi.exe
  C:\Windows\System\LxmLLXi.exe
  2⤵
  PID:6704
- C:\Windows\System\gNsExvT.exe
  C:\Windows\System\gNsExvT.exe
  2⤵
  PID:6728
- C:\Windows\System\cQyKnuQ.exe
  C:\Windows\System\cQyKnuQ.exe
  2⤵
  PID:6756
- C:\Windows\System\fGhkdgc.exe
  C:\Windows\System\fGhkdgc.exe
  2⤵
  PID:6784
- C:\Windows\System\YVEMDKV.exe
  C:\Windows\System\YVEMDKV.exe
  2⤵
  PID:6812
- C:\Windows\System\tzvKgBI.exe
  C:\Windows\System\tzvKgBI.exe
  2⤵
  PID:6840
- C:\Windows\System\VXcAynf.exe
  C:\Windows\System\VXcAynf.exe
  2⤵
  PID:6864
- C:\Windows\System\kjmhbHw.exe
  C:\Windows\System\kjmhbHw.exe
  2⤵
  PID:6896
- C:\Windows\System\AyhMPwK.exe
  C:\Windows\System\AyhMPwK.exe
  2⤵
  PID:6920
- C:\Windows\System\KHFwJzC.exe
  C:\Windows\System\KHFwJzC.exe
  2⤵
  PID:6948
- C:\Windows\System\wSBUGci.exe
  C:\Windows\System\wSBUGci.exe
  2⤵
  PID:6980
- C:\Windows\System\fAsIGju.exe
  C:\Windows\System\fAsIGju.exe
  2⤵
  PID:7008
- C:\Windows\System\yqPFPDE.exe
  C:\Windows\System\yqPFPDE.exe
  2⤵
  PID:7036
- C:\Windows\System\FqaALZE.exe
  C:\Windows\System\FqaALZE.exe
  2⤵
  PID:7064
- C:\Windows\System\GIBcrdA.exe
  C:\Windows\System\GIBcrdA.exe
  2⤵
  PID:7092
- C:\Windows\System\IIzFuhb.exe
  C:\Windows\System\IIzFuhb.exe
  2⤵
  PID:7120
- C:\Windows\System\AZOfIXl.exe
  C:\Windows\System\AZOfIXl.exe
  2⤵
  PID:7148
- C:\Windows\System\eUGBFXb.exe
  C:\Windows\System\eUGBFXb.exe
  2⤵
  PID:6080
- C:\Windows\System\vVpMIvB.exe
  C:\Windows\System\vVpMIvB.exe
  2⤵
  PID:1652
- C:\Windows\System\gcCQbcx.exe
  C:\Windows\System\gcCQbcx.exe
  2⤵
  PID:5204
- C:\Windows\System\FXRKbeG.exe
  C:\Windows\System\FXRKbeG.exe
  2⤵
  PID:5568
- C:\Windows\System\NqxmLvp.exe
  C:\Windows\System\NqxmLvp.exe
  2⤵
  PID:5904
- C:\Windows\System\nJsyhdO.exe
  C:\Windows\System\nJsyhdO.exe
  2⤵
  PID:6180
- C:\Windows\System\OBFRpdW.exe
  C:\Windows\System\OBFRpdW.exe
  2⤵
  PID:6272
- C:\Windows\System\bYVSSZo.exe
  C:\Windows\System\bYVSSZo.exe
  2⤵
  PID:6320
- C:\Windows\System\OKNOKpF.exe
  C:\Windows\System\OKNOKpF.exe
  2⤵
  PID:6436
- C:\Windows\System\BLPpBvx.exe
  C:\Windows\System\BLPpBvx.exe
  2⤵
  PID:6492
- C:\Windows\System\jwVdtKO.exe
  C:\Windows\System\jwVdtKO.exe
  2⤵
  PID:6552
- C:\Windows\System\rcpNqCb.exe
  C:\Windows\System\rcpNqCb.exe
  2⤵
  PID:6628
- C:\Windows\System\kZlfmqJ.exe
  C:\Windows\System\kZlfmqJ.exe
  2⤵
  PID:6712
- C:\Windows\System\qMCPDnf.exe
  C:\Windows\System\qMCPDnf.exe
  2⤵
  PID:6748
- C:\Windows\System\DeFjuam.exe
  C:\Windows\System\DeFjuam.exe
  2⤵
  PID:6796
- C:\Windows\System\SkjnKOw.exe
  C:\Windows\System\SkjnKOw.exe
  2⤵
  PID:6824
- C:\Windows\System\AQXVdfz.exe
  C:\Windows\System\AQXVdfz.exe
  2⤵
  PID:6888
- C:\Windows\System\WoYanOK.exe
  C:\Windows\System\WoYanOK.exe
  2⤵
  PID:6936
- C:\Windows\System\fiARBqQ.exe
  C:\Windows\System\fiARBqQ.exe
  2⤵
  PID:7000
- C:\Windows\System\MIJiqRQ.exe
  C:\Windows\System\MIJiqRQ.exe
  2⤵
  PID:2516
- C:\Windows\System\dcVRVFU.exe
  C:\Windows\System\dcVRVFU.exe
  2⤵
  PID:7104
- C:\Windows\System\LRhuWpx.exe
  C:\Windows\System\LRhuWpx.exe
  2⤵
  PID:7140
- C:\Windows\System\dyraIWa.exe
  C:\Windows\System\dyraIWa.exe
  2⤵
  PID:5336
- C:\Windows\System\vopyLEt.exe
  C:\Windows\System\vopyLEt.exe
  2⤵
  PID:5000
- C:\Windows\System\MZqMdWs.exe
  C:\Windows\System\MZqMdWs.exe
  2⤵
  PID:2272
- C:\Windows\System\fLqEwDc.exe
  C:\Windows\System\fLqEwDc.exe
  2⤵
  PID:1656
- C:\Windows\System\cGebNAN.exe
  C:\Windows\System\cGebNAN.exe
  2⤵
  PID:760
- C:\Windows\System\fCojifT.exe
  C:\Windows\System\fCojifT.exe
  2⤵
  PID:1572
- C:\Windows\System\WvXZGXg.exe
  C:\Windows\System\WvXZGXg.exe
  2⤵
  PID:3980
- C:\Windows\System\HoJiFqe.exe
  C:\Windows\System\HoJiFqe.exe
  2⤵
  PID:3988
- C:\Windows\System\quvWdQl.exe
  C:\Windows\System\quvWdQl.exe
  2⤵
  PID:2412
- C:\Windows\System\BNAHLTn.exe
  C:\Windows\System\BNAHLTn.exe
  2⤵
  PID:3960
- C:\Windows\System\OYqmioc.exe
  C:\Windows\System\OYqmioc.exe
  2⤵
  PID:2076
- C:\Windows\System\muGcnIJ.exe
  C:\Windows\System\muGcnIJ.exe
  2⤵
  PID:4288
- C:\Windows\System\ckWJUiE.exe
  C:\Windows\System\ckWJUiE.exe
  2⤵
  PID:3768
- C:\Windows\System\xFnaLbN.exe
  C:\Windows\System\xFnaLbN.exe
  2⤵
  PID:5784
- C:\Windows\System\KqGfrsT.exe
  C:\Windows\System\KqGfrsT.exe
  2⤵
  PID:4380
- C:\Windows\System\XvjJBHq.exe
  C:\Windows\System\XvjJBHq.exe
  2⤵
  PID:1384
- C:\Windows\System\eJUxDJs.exe
  C:\Windows\System\eJUxDJs.exe
  2⤵
  PID:1704
- C:\Windows\System\hLDmPSH.exe
  C:\Windows\System\hLDmPSH.exe
  2⤵
  PID:6356
- C:\Windows\System\CVdDelB.exe
  C:\Windows\System\CVdDelB.exe
  2⤵
  PID:6300
- C:\Windows\System\RIciWze.exe
  C:\Windows\System\RIciWze.exe
  2⤵
  PID:6468
- C:\Windows\System\VxUTNNx.exe
  C:\Windows\System\VxUTNNx.exe
  2⤵
  PID:368
- C:\Windows\System\YMPKRCh.exe
  C:\Windows\System\YMPKRCh.exe
  2⤵
  PID:392
- C:\Windows\System\uUNjXDw.exe
  C:\Windows\System\uUNjXDw.exe
  2⤵
  PID:6972
- C:\Windows\System\URTBLZh.exe
  C:\Windows\System\URTBLZh.exe
  2⤵
  PID:4948
- C:\Windows\System\DxmchTE.exe
  C:\Windows\System\DxmchTE.exe
  2⤵
  PID:7136
- C:\Windows\System\ggVwvzp.exe
  C:\Windows\System\ggVwvzp.exe
  2⤵
  PID:2844
- C:\Windows\System\pYjiUkP.exe
  C:\Windows\System\pYjiUkP.exe
  2⤵
  PID:828
- C:\Windows\System\qAxHdKg.exe
  C:\Windows\System\qAxHdKg.exe
  2⤵
  PID:4076
- C:\Windows\System\pyZXMBM.exe
  C:\Windows\System\pyZXMBM.exe
  2⤵
  PID:3132
- C:\Windows\System\BPfDMDy.exe
  C:\Windows\System\BPfDMDy.exe
  2⤵
  PID:3776
- C:\Windows\System\CAFXChg.exe
  C:\Windows\System\CAFXChg.exe
  2⤵
  PID:6160
- C:\Windows\System\ewDlauE.exe
  C:\Windows\System\ewDlauE.exe
  2⤵
  PID:3168
- C:\Windows\System\GEUcPcu.exe
  C:\Windows\System\GEUcPcu.exe
  2⤵
  PID:1392
- C:\Windows\System\dirTXJU.exe
  C:\Windows\System\dirTXJU.exe
  2⤵
  PID:692
- C:\Windows\System\FrYcApJ.exe
  C:\Windows\System\FrYcApJ.exe
  2⤵
  PID:5988
- C:\Windows\System\pyzxMwc.exe
  C:\Windows\System\pyzxMwc.exe
  2⤵
  PID:4920
- C:\Windows\System\DanIoHZ.exe
  C:\Windows\System\DanIoHZ.exe
  2⤵
  PID:1912
- C:\Windows\System\jZUvOXf.exe
  C:\Windows\System\jZUvOXf.exe
  2⤵
  PID:5448
- C:\Windows\System\fypUkMk.exe
  C:\Windows\System\fypUkMk.exe
  2⤵
  PID:3808
- C:\Windows\System\erxOoea.exe
  C:\Windows\System\erxOoea.exe
  2⤵
  PID:6852
- C:\Windows\System\yztOsUc.exe
  C:\Windows\System\yztOsUc.exe
  2⤵
  PID:3900
- C:\Windows\System\PUIZlfB.exe
  C:\Windows\System\PUIZlfB.exe
  2⤵
  PID:628
- C:\Windows\System\uTdmutm.exe
  C:\Windows\System\uTdmutm.exe
  2⤵
  PID:7180
- C:\Windows\System\htMSZZA.exe
  C:\Windows\System\htMSZZA.exe
  2⤵
  PID:7228
- C:\Windows\System\bacgvQm.exe
  C:\Windows\System\bacgvQm.exe
  2⤵
  PID:7264
- C:\Windows\System\oELPRKh.exe
  C:\Windows\System\oELPRKh.exe
  2⤵
  PID:7284
- C:\Windows\System\CdjQkug.exe
  C:\Windows\System\CdjQkug.exe
  2⤵
  PID:7312
- C:\Windows\System\btSWvbx.exe
  C:\Windows\System\btSWvbx.exe
  2⤵
  PID:7340
- C:\Windows\System\hdJEmmo.exe
  C:\Windows\System\hdJEmmo.exe
  2⤵
  PID:7360
- C:\Windows\System\JQGDDyy.exe
  C:\Windows\System\JQGDDyy.exe
  2⤵
  PID:7384
- C:\Windows\System\EhbJiHn.exe
  C:\Windows\System\EhbJiHn.exe
  2⤵
  PID:7400
- C:\Windows\System\OBWnavL.exe
  C:\Windows\System\OBWnavL.exe
  2⤵
  PID:7424
- C:\Windows\System\SWrbUBD.exe
  C:\Windows\System\SWrbUBD.exe
  2⤵
  PID:7460
- C:\Windows\System\eRBoBkb.exe
  C:\Windows\System\eRBoBkb.exe
  2⤵
  PID:7492
- C:\Windows\System\WSgTJsA.exe
  C:\Windows\System\WSgTJsA.exe
  2⤵
  PID:7520
- C:\Windows\System\SXebjIH.exe
  C:\Windows\System\SXebjIH.exe
  2⤵
  PID:7540
- C:\Windows\System\fSaFpKp.exe
  C:\Windows\System\fSaFpKp.exe
  2⤵
  PID:7564
- C:\Windows\System\uySShpE.exe
  C:\Windows\System\uySShpE.exe
  2⤵
  PID:7608
- C:\Windows\System\TBYPTHX.exe
  C:\Windows\System\TBYPTHX.exe
  2⤵
  PID:7644
- C:\Windows\System\VMxqcgd.exe
  C:\Windows\System\VMxqcgd.exe
  2⤵
  PID:7672
- C:\Windows\System\LQGJLqw.exe
  C:\Windows\System\LQGJLqw.exe
  2⤵
  PID:7704
- C:\Windows\System\RFhDMrH.exe
  C:\Windows\System\RFhDMrH.exe
  2⤵
  PID:7728
- C:\Windows\System\InabDZs.exe
  C:\Windows\System\InabDZs.exe
  2⤵
  PID:7756
- C:\Windows\System\vFkOHlL.exe
  C:\Windows\System\vFkOHlL.exe
  2⤵
  PID:7788
- C:\Windows\System\XEaJKxe.exe
  C:\Windows\System\XEaJKxe.exe
  2⤵
  PID:7816
- C:\Windows\System\RJhkZLV.exe
  C:\Windows\System\RJhkZLV.exe
  2⤵
  PID:7840
- C:\Windows\System\DtaTpJh.exe
  C:\Windows\System\DtaTpJh.exe
  2⤵
  PID:7868
- C:\Windows\System\POomanP.exe
  C:\Windows\System\POomanP.exe
  2⤵
  PID:7892
- C:\Windows\System\ccqtYwO.exe
  C:\Windows\System\ccqtYwO.exe
  2⤵
  PID:7940
- C:\Windows\System\OkcprFO.exe
  C:\Windows\System\OkcprFO.exe
  2⤵
  PID:7956
- C:\Windows\System\kEoUYdn.exe
  C:\Windows\System\kEoUYdn.exe
  2⤵
  PID:7984
- C:\Windows\System\ZkEsYOL.exe
  C:\Windows\System\ZkEsYOL.exe
  2⤵
  PID:8012
- C:\Windows\System\vsttjAj.exe
  C:\Windows\System\vsttjAj.exe
  2⤵
  PID:8036
- C:\Windows\System\LbqxvDw.exe
  C:\Windows\System\LbqxvDw.exe
  2⤵
  PID:8060
- C:\Windows\System\BBLjjVy.exe
  C:\Windows\System\BBLjjVy.exe
  2⤵
  PID:8080
- C:\Windows\System\RTitNMe.exe
  C:\Windows\System\RTitNMe.exe
  2⤵
  PID:8100
- C:\Windows\System\ObuZyxJ.exe
  C:\Windows\System\ObuZyxJ.exe
  2⤵
  PID:8160
- C:\Windows\System\dyRlSUN.exe
  C:\Windows\System\dyRlSUN.exe
  2⤵
  PID:8180
- C:\Windows\System\mogKoub.exe
  C:\Windows\System\mogKoub.exe
  2⤵
  PID:7028
- C:\Windows\System\vqqjgaP.exe
  C:\Windows\System\vqqjgaP.exe
  2⤵
  PID:7216
- C:\Windows\System\yKtCdrI.exe
  C:\Windows\System\yKtCdrI.exe
  2⤵
  PID:7280
- C:\Windows\System\xshWyFw.exe
  C:\Windows\System\xshWyFw.exe
  2⤵
  PID:7324
- C:\Windows\System\VEccHII.exe
  C:\Windows\System\VEccHII.exe
  2⤵
  PID:7372
- C:\Windows\System\hJOefvw.exe
  C:\Windows\System\hJOefvw.exe
  2⤵
  PID:7452
- C:\Windows\System\jiTyCxM.exe
  C:\Windows\System\jiTyCxM.exe
  2⤵
  PID:7508
- C:\Windows\System\RrlyLvJ.exe
  C:\Windows\System\RrlyLvJ.exe
  2⤵
  PID:7600
- C:\Windows\System\MKiLwut.exe
  C:\Windows\System\MKiLwut.exe
  2⤵
  PID:7684
- C:\Windows\System\ORzGhFd.exe
  C:\Windows\System\ORzGhFd.exe
  2⤵
  PID:7748
- C:\Windows\System\DwzyULY.exe
  C:\Windows\System\DwzyULY.exe
  2⤵
  PID:7800
- C:\Windows\System\rRXsaON.exe
  C:\Windows\System\rRXsaON.exe
  2⤵
  PID:7916
- C:\Windows\System\aTOYpTC.exe
  C:\Windows\System\aTOYpTC.exe
  2⤵
  PID:7920
- C:\Windows\System\DYHCTCS.exe
  C:\Windows\System\DYHCTCS.exe
  2⤵
  PID:8004
- C:\Windows\System\PGtCpIU.exe
  C:\Windows\System\PGtCpIU.exe
  2⤵
  PID:8032
- C:\Windows\System\lQnCquO.exe
  C:\Windows\System\lQnCquO.exe
  2⤵
  PID:8116
- C:\Windows\System\QixqMpJ.exe
  C:\Windows\System\QixqMpJ.exe
  2⤵
  PID:6264
- C:\Windows\System\fcfzcGE.exe
  C:\Windows\System\fcfzcGE.exe
  2⤵
  PID:7240
- C:\Windows\System\WWZvUwo.exe
  C:\Windows\System\WWZvUwo.exe
  2⤵
  PID:7412
- C:\Windows\System\PANoQhf.exe
  C:\Windows\System\PANoQhf.exe
  2⤵
  PID:7628
- C:\Windows\System\tboVAqo.exe
  C:\Windows\System\tboVAqo.exe
  2⤵
  PID:7856
- C:\Windows\System\UTccydQ.exe
  C:\Windows\System\UTccydQ.exe
  2⤵
  PID:7884
- C:\Windows\System\zxkLYEI.exe
  C:\Windows\System\zxkLYEI.exe
  2⤵
  PID:8072
- C:\Windows\System\otrROzu.exe
  C:\Windows\System\otrROzu.exe
  2⤵
  PID:1828
- C:\Windows\System\XgIWsUK.exe
  C:\Windows\System\XgIWsUK.exe
  2⤵
  PID:7716
- C:\Windows\System\GxfAeNa.exe
  C:\Windows\System\GxfAeNa.exe
  2⤵
  PID:8020
- C:\Windows\System\OYPTTLr.exe
  C:\Windows\System\OYPTTLr.exe
  2⤵
  PID:7276
- C:\Windows\System\FtJRavq.exe
  C:\Windows\System\FtJRavq.exe
  2⤵
  PID:8196
- C:\Windows\System\DNdzBgo.exe
  C:\Windows\System\DNdzBgo.exe
  2⤵
  PID:8212
- C:\Windows\System\BHueRWE.exe
  C:\Windows\System\BHueRWE.exe
  2⤵
  PID:8236
- C:\Windows\System\HkrRoxe.exe
  C:\Windows\System\HkrRoxe.exe
  2⤵
  PID:8276
- C:\Windows\System\rJqZVkX.exe
  C:\Windows\System\rJqZVkX.exe
  2⤵
  PID:8304
- C:\Windows\System\lVwNFYw.exe
  C:\Windows\System\lVwNFYw.exe
  2⤵
  PID:8332
- C:\Windows\System\DEOSDOv.exe
  C:\Windows\System\DEOSDOv.exe
  2⤵
  PID:8372
- C:\Windows\System\SLYRemi.exe
  C:\Windows\System\SLYRemi.exe
  2⤵
  PID:8400
- C:\Windows\System\lCFfQWt.exe
  C:\Windows\System\lCFfQWt.exe
  2⤵
  PID:8428
- C:\Windows\System\PMXsYrb.exe
  C:\Windows\System\PMXsYrb.exe
  2⤵
  PID:8448
- C:\Windows\System\SEQsLGR.exe
  C:\Windows\System\SEQsLGR.exe
  2⤵
  PID:8484
- C:\Windows\System\pXbByKA.exe
  C:\Windows\System\pXbByKA.exe
  2⤵
  PID:8516
- C:\Windows\System\yfeoCHC.exe
  C:\Windows\System\yfeoCHC.exe
  2⤵
  PID:8544
- C:\Windows\System\FCKywRk.exe
  C:\Windows\System\FCKywRk.exe
  2⤵
  PID:8560
- C:\Windows\System\ulkwULD.exe
  C:\Windows\System\ulkwULD.exe
  2⤵
  PID:8592
- C:\Windows\System\CfXFIud.exe
  C:\Windows\System\CfXFIud.exe
  2⤵
  PID:8624
- C:\Windows\System\EOMXxcM.exe
  C:\Windows\System\EOMXxcM.exe
  2⤵
  PID:8644
- C:\Windows\System\SFeBjJe.exe
  C:\Windows\System\SFeBjJe.exe
  2⤵
  PID:8660
- C:\Windows\System\zFFZUFN.exe
  C:\Windows\System\zFFZUFN.exe
  2⤵
  PID:8696
- C:\Windows\System\LZKwPvH.exe
  C:\Windows\System\LZKwPvH.exe
  2⤵
  PID:8732
- C:\Windows\System\NLpZfmE.exe
  C:\Windows\System\NLpZfmE.exe
  2⤵
  PID:8760
- C:\Windows\System\hBqztQZ.exe
  C:\Windows\System\hBqztQZ.exe
  2⤵
  PID:8800
- C:\Windows\System\QBlymWJ.exe
  C:\Windows\System\QBlymWJ.exe
  2⤵
  PID:8816
- C:\Windows\System\kXhWAHD.exe
  C:\Windows\System\kXhWAHD.exe
  2⤵
  PID:8836
- C:\Windows\System\FkUEglq.exe
  C:\Windows\System\FkUEglq.exe
  2⤵
  PID:8856
- C:\Windows\System\mxrmuue.exe
  C:\Windows\System\mxrmuue.exe
  2⤵
  PID:8888
- C:\Windows\System\RysfQQX.exe
  C:\Windows\System\RysfQQX.exe
  2⤵
  PID:8904
- C:\Windows\System\ALgDZvW.exe
  C:\Windows\System\ALgDZvW.exe
  2⤵
  PID:8936
- C:\Windows\System\BdpUfVf.exe
  C:\Windows\System\BdpUfVf.exe
  2⤵
  PID:8968
- C:\Windows\System\deMCrSo.exe
  C:\Windows\System\deMCrSo.exe
  2⤵
  PID:9004
- C:\Windows\System\XcMKCTf.exe
  C:\Windows\System\XcMKCTf.exe
  2⤵
  PID:9056
- C:\Windows\System\LDPnqqq.exe
  C:\Windows\System\LDPnqqq.exe
  2⤵
  PID:9076
- C:\Windows\System\IDqrkyF.exe
  C:\Windows\System\IDqrkyF.exe
  2⤵
  PID:9112
- C:\Windows\System\khGZBrP.exe
  C:\Windows\System\khGZBrP.exe
  2⤵
  PID:9140
- C:\Windows\System\GOasYrc.exe
  C:\Windows\System\GOasYrc.exe
  2⤵
  PID:9168
- C:\Windows\System\YTPyrMx.exe
  C:\Windows\System\YTPyrMx.exe
  2⤵
  PID:9196
- C:\Windows\System\AOtdwTp.exe
  C:\Windows\System\AOtdwTp.exe
  2⤵
  PID:8208
- C:\Windows\System\QYNoRkL.exe
  C:\Windows\System\QYNoRkL.exe
  2⤵
  PID:8292
- C:\Windows\System\nBWNIjq.exe
  C:\Windows\System\nBWNIjq.exe
  2⤵
  PID:8320
- C:\Windows\System\tYJXghS.exe
  C:\Windows\System\tYJXghS.exe
  2⤵
  PID:8352
- C:\Windows\System\WaiGALV.exe
  C:\Windows\System\WaiGALV.exe
  2⤵
  PID:8500
- C:\Windows\System\DasZWBD.exe
  C:\Windows\System\DasZWBD.exe
  2⤵
  PID:8556
- C:\Windows\System\Yjjpomr.exe
  C:\Windows\System\Yjjpomr.exe
  2⤵
  PID:8612
- C:\Windows\System\ScAnore.exe
  C:\Windows\System\ScAnore.exe
  2⤵
  PID:8676
- C:\Windows\System\vGkmcZj.exe
  C:\Windows\System\vGkmcZj.exe
  2⤵
  PID:8776
- C:\Windows\System\VieZNlT.exe
  C:\Windows\System\VieZNlT.exe
  2⤵
  PID:8848
- C:\Windows\System\USXbybw.exe
  C:\Windows\System\USXbybw.exe
  2⤵
  PID:8852
- C:\Windows\System\lzLYHLA.exe
  C:\Windows\System\lzLYHLA.exe
  2⤵
  PID:8988
- C:\Windows\System\lnAreIK.exe
  C:\Windows\System\lnAreIK.exe
  2⤵
  PID:9024
- C:\Windows\System\DdHfwwl.exe
  C:\Windows\System\DdHfwwl.exe
  2⤵
  PID:9100
- C:\Windows\System\WTVkaNR.exe
  C:\Windows\System\WTVkaNR.exe
  2⤵
  PID:9152
- C:\Windows\System\xJfbIYi.exe
  C:\Windows\System\xJfbIYi.exe
  2⤵
  PID:8228
- C:\Windows\System\dtMyTbZ.exe
  C:\Windows\System\dtMyTbZ.exe
  2⤵
  PID:8356
- C:\Windows\System\pqhUmEe.exe
  C:\Windows\System\pqhUmEe.exe
  2⤵
  PID:8528
- C:\Windows\System\cMFmhIz.exe
  C:\Windows\System\cMFmhIz.exe
  2⤵
  PID:8576
- C:\Windows\System\kKlAIMI.exe
  C:\Windows\System\kKlAIMI.exe
  2⤵
  PID:8812
- C:\Windows\System\MImgNua.exe
  C:\Windows\System\MImgNua.exe
  2⤵
  PID:8980
- C:\Windows\System\EeBrnXu.exe
  C:\Windows\System\EeBrnXu.exe
  2⤵
  PID:9036
- C:\Windows\System\xmwukZd.exe
  C:\Windows\System\xmwukZd.exe
  2⤵
  PID:8652
- C:\Windows\System\LqKUiQS.exe
  C:\Windows\System\LqKUiQS.exe
  2⤵
  PID:8620
- C:\Windows\System\FEGtNOv.exe
  C:\Windows\System\FEGtNOv.exe
  2⤵
  PID:8512
- C:\Windows\System\xPlvtDx.exe
  C:\Windows\System\xPlvtDx.exe
  2⤵
  PID:9224
- C:\Windows\System\unFOrVG.exe
  C:\Windows\System\unFOrVG.exe
  2⤵
  PID:9252
- C:\Windows\System\NeEuFeu.exe
  C:\Windows\System\NeEuFeu.exe
  2⤵
  PID:9296
- C:\Windows\System\hchnHyF.exe
  C:\Windows\System\hchnHyF.exe
  2⤵
  PID:9324
- C:\Windows\System\RbmhXpN.exe
  C:\Windows\System\RbmhXpN.exe
  2⤵
  PID:9352
- C:\Windows\System\AHfEVnF.exe
  C:\Windows\System\AHfEVnF.exe
  2⤵
  PID:9380
- C:\Windows\System\YlXmAEi.exe
  C:\Windows\System\YlXmAEi.exe
  2⤵
  PID:9408
- C:\Windows\System\nRCXzcI.exe
  C:\Windows\System\nRCXzcI.exe
  2⤵
  PID:9436
- C:\Windows\System\KwVsyqd.exe
  C:\Windows\System\KwVsyqd.exe
  2⤵
  PID:9464
- C:\Windows\System\TLufMDk.exe
  C:\Windows\System\TLufMDk.exe
  2⤵
  PID:9492
- C:\Windows\System\mSikSSm.exe
  C:\Windows\System\mSikSSm.exe
  2⤵
  PID:9512
- C:\Windows\System\TNEeEvV.exe
  C:\Windows\System\TNEeEvV.exe
  2⤵
  PID:9536
- C:\Windows\System\dyncgIf.exe
  C:\Windows\System\dyncgIf.exe
  2⤵
  PID:9568
- C:\Windows\System\YmBcEBt.exe
  C:\Windows\System\YmBcEBt.exe
  2⤵
  PID:9596
- C:\Windows\System\IoojBRz.exe
  C:\Windows\System\IoojBRz.exe
  2⤵
  PID:9620
- C:\Windows\System\hnEItgU.exe
  C:\Windows\System\hnEItgU.exe
  2⤵
  PID:9648
- C:\Windows\System\byUMzOh.exe
  C:\Windows\System\byUMzOh.exe
  2⤵
  PID:9668
- C:\Windows\System\TPziDkV.exe
  C:\Windows\System\TPziDkV.exe
  2⤵
  PID:9688
- C:\Windows\System\vdCIgxW.exe
  C:\Windows\System\vdCIgxW.exe
  2⤵
  PID:9712
- C:\Windows\System\hTsMtia.exe
  C:\Windows\System\hTsMtia.exe
  2⤵
  PID:9772
- C:\Windows\System\lZylpMD.exe
  C:\Windows\System\lZylpMD.exe
  2⤵
  PID:9808
- C:\Windows\System\fYYqFye.exe
  C:\Windows\System\fYYqFye.exe
  2⤵
  PID:9824
- C:\Windows\System\TiGtVrB.exe
  C:\Windows\System\TiGtVrB.exe
  2⤵
  PID:9852
- C:\Windows\System\moWPFnp.exe
  C:\Windows\System\moWPFnp.exe
  2⤵
  PID:9880
- C:\Windows\System\lDyKLvI.exe
  C:\Windows\System\lDyKLvI.exe
  2⤵
  PID:9920
- C:\Windows\System\dALzoEK.exe
  C:\Windows\System\dALzoEK.exe
  2⤵
  PID:9948
- C:\Windows\System\PzHnPJt.exe
  C:\Windows\System\PzHnPJt.exe
  2⤵
  PID:9976
- C:\Windows\System\XxrgHrg.exe
  C:\Windows\System\XxrgHrg.exe
  2⤵
  PID:10004
- C:\Windows\System\ywlWWJd.exe
  C:\Windows\System\ywlWWJd.exe
  2⤵
  PID:10032
- C:\Windows\System\VbEqLvs.exe
  C:\Windows\System\VbEqLvs.exe
  2⤵
  PID:10060
- C:\Windows\System\wkeeEDi.exe
  C:\Windows\System\wkeeEDi.exe
  2⤵
  PID:10088
- C:\Windows\System\YhjQlio.exe
  C:\Windows\System\YhjQlio.exe
  2⤵
  PID:10104
- C:\Windows\System\tWzeySh.exe
  C:\Windows\System\tWzeySh.exe
  2⤵
  PID:10144
- C:\Windows\System\ZYxlmSm.exe
  C:\Windows\System\ZYxlmSm.exe
  2⤵
  PID:10160
- C:\Windows\System\kEHbsBm.exe
  C:\Windows\System\kEHbsBm.exe
  2⤵
  PID:10200
- C:\Windows\System\LJaGdSo.exe
  C:\Windows\System\LJaGdSo.exe
  2⤵
  PID:10228
- C:\Windows\System\AFOHSyU.exe
  C:\Windows\System\AFOHSyU.exe
  2⤵
  PID:9236
- C:\Windows\System\mrBSOKE.exe
  C:\Windows\System\mrBSOKE.exe
  2⤵
  PID:9248
- C:\Windows\System\mGKQqGE.exe
  C:\Windows\System\mGKQqGE.exe
  2⤵
  PID:9348
- C:\Windows\System\PWSKXon.exe
  C:\Windows\System\PWSKXon.exe
  2⤵
  PID:9432
- C:\Windows\System\gxhxued.exe
  C:\Windows\System\gxhxued.exe
  2⤵
  PID:9452
- C:\Windows\System\bQPAzhE.exe
  C:\Windows\System\bQPAzhE.exe
  2⤵
  PID:9508
- C:\Windows\System\xspmmfI.exe
  C:\Windows\System\xspmmfI.exe
  2⤵
  PID:9588
- C:\Windows\System\NeebnRU.exe
  C:\Windows\System\NeebnRU.exe
  2⤵
  PID:9660
- C:\Windows\System\FwJbvvM.exe
  C:\Windows\System\FwJbvvM.exe
  2⤵
  PID:9732
- C:\Windows\System\NTYCJUM.exe
  C:\Windows\System\NTYCJUM.exe
  2⤵
  PID:9752
- C:\Windows\System\lwpvdrL.exe
  C:\Windows\System\lwpvdrL.exe
  2⤵
  PID:9792
- C:\Windows\System\odBjGEV.exe
  C:\Windows\System\odBjGEV.exe
  2⤵
  PID:9932
- C:\Windows\System\rLRSaMr.exe
  C:\Windows\System\rLRSaMr.exe
  2⤵
  PID:9964
- C:\Windows\System\WJVVkKW.exe
  C:\Windows\System\WJVVkKW.exe
  2⤵
  PID:10028
- C:\Windows\System\dFCMmKJ.exe
  C:\Windows\System\dFCMmKJ.exe
  2⤵
  PID:10096
- C:\Windows\System\wnpxqeA.exe
  C:\Windows\System\wnpxqeA.exe
  2⤵
  PID:10196
- C:\Windows\System\AnVeRWu.exe
  C:\Windows\System\AnVeRWu.exe
  2⤵
  PID:9160
- C:\Windows\System\TnZFoQh.exe
  C:\Windows\System\TnZFoQh.exe
  2⤵
  PID:9344
- C:\Windows\System\rQmPles.exe
  C:\Windows\System\rQmPles.exe
  2⤵
  PID:220
- C:\Windows\System\OSJjKpE.exe
  C:\Windows\System\OSJjKpE.exe
  2⤵
  PID:9628
- C:\Windows\System\foUEUHF.exe
  C:\Windows\System\foUEUHF.exe
  2⤵
  PID:9796
- C:\Windows\System\NffKDfB.exe
  C:\Windows\System\NffKDfB.exe
  2⤵
  PID:9960
- C:\Windows\System\gLZztIx.exe
  C:\Windows\System\gLZztIx.exe
  2⤵
  PID:10140
- C:\Windows\System\juyvOJL.exe
  C:\Windows\System\juyvOJL.exe
  2⤵
  PID:9424
- C:\Windows\System\khwNvPn.exe
  C:\Windows\System\khwNvPn.exe
  2⤵
  PID:3732
- C:\Windows\System\dqnnPMi.exe
  C:\Windows\System\dqnnPMi.exe
  2⤵
  PID:9768
- C:\Windows\System\fMwNKwz.exe
  C:\Windows\System\fMwNKwz.exe
  2⤵
  PID:10224
- C:\Windows\System\CqvlaSH.exe
  C:\Windows\System\CqvlaSH.exe
  2⤵
  PID:10000
- C:\Windows\System\pYCjGtd.exe
  C:\Windows\System\pYCjGtd.exe
  2⤵
  PID:10076
- C:\Windows\System\zIhFqrN.exe
  C:\Windows\System\zIhFqrN.exe
  2⤵
  PID:10252
- C:\Windows\System\JOEMDYr.exe
  C:\Windows\System\JOEMDYr.exe
  2⤵
  PID:10276
- C:\Windows\System\fZcMcZU.exe
  C:\Windows\System\fZcMcZU.exe
  2⤵
  PID:10312
- C:\Windows\System\qlAcPjx.exe
  C:\Windows\System\qlAcPjx.exe
  2⤵
  PID:10336
- C:\Windows\System\QtPyuEr.exe
  C:\Windows\System\QtPyuEr.exe
  2⤵
  PID:10352
- C:\Windows\System\MiwohIc.exe
  C:\Windows\System\MiwohIc.exe
  2⤵
  PID:10384
- C:\Windows\System\ilzSbuA.exe
  C:\Windows\System\ilzSbuA.exe
  2⤵
  PID:10444
- C:\Windows\System\xzJbTUz.exe
  C:\Windows\System\xzJbTUz.exe
  2⤵
  PID:10472
- C:\Windows\System\jlwRUqA.exe
  C:\Windows\System\jlwRUqA.exe
  2⤵
  PID:10488
- C:\Windows\System\DHrzvtY.exe
  C:\Windows\System\DHrzvtY.exe
  2⤵
  PID:10528
- C:\Windows\System\cqNXtiC.exe
  C:\Windows\System\cqNXtiC.exe
  2⤵
  PID:10556
- C:\Windows\System\woVwCjC.exe
  C:\Windows\System\woVwCjC.exe
  2⤵
  PID:10584
- C:\Windows\System\cktKCru.exe
  C:\Windows\System\cktKCru.exe
  2⤵
  PID:10612
- C:\Windows\System\XUaDzZW.exe
  C:\Windows\System\XUaDzZW.exe
  2⤵
  PID:10632
- C:\Windows\System\sYHJSaJ.exe
  C:\Windows\System\sYHJSaJ.exe
  2⤵
  PID:10668
- C:\Windows\System\zFUcuOr.exe
  C:\Windows\System\zFUcuOr.exe
  2⤵
  PID:10696
- C:\Windows\System\nYvIAKP.exe
  C:\Windows\System\nYvIAKP.exe
  2⤵
  PID:10712
- C:\Windows\System\KWhVTlQ.exe
  C:\Windows\System\KWhVTlQ.exe
  2⤵
  PID:10740
- C:\Windows\System\rqgWCks.exe
  C:\Windows\System\rqgWCks.exe
  2⤵
  PID:10772
- C:\Windows\System\YFmAZxg.exe
  C:\Windows\System\YFmAZxg.exe
  2⤵
  PID:10800
- C:\Windows\System\NduqdfF.exe
  C:\Windows\System\NduqdfF.exe
  2⤵
  PID:10840
- C:\Windows\System\bzPGFvX.exe
  C:\Windows\System\bzPGFvX.exe
  2⤵
  PID:10856
- C:\Windows\System\GExapul.exe
  C:\Windows\System\GExapul.exe
  2⤵
  PID:10872
- C:\Windows\System\nYhUNiv.exe
  C:\Windows\System\nYhUNiv.exe
  2⤵
  PID:10892
- C:\Windows\System\KoahHMJ.exe
  C:\Windows\System\KoahHMJ.exe
  2⤵
  PID:10920
- C:\Windows\System\IlkqOOE.exe
  C:\Windows\System\IlkqOOE.exe
  2⤵
  PID:10956
- C:\Windows\System\vzwpSNg.exe
  C:\Windows\System\vzwpSNg.exe
  2⤵
  PID:10984
- C:\Windows\System\JHnfAhs.exe
  C:\Windows\System\JHnfAhs.exe
  2⤵
  PID:11020
- C:\Windows\System\IzDwdHf.exe
  C:\Windows\System\IzDwdHf.exe
  2⤵
  PID:11040
- C:\Windows\System\MKZRJtk.exe
  C:\Windows\System\MKZRJtk.exe
  2⤵
  PID:11064
- C:\Windows\System\nqbQlBI.exe
  C:\Windows\System\nqbQlBI.exe
  2⤵
  PID:11100
- C:\Windows\System\WohtpHf.exe
  C:\Windows\System\WohtpHf.exe
  2⤵
  PID:11148
- C:\Windows\System\XcEMUHp.exe
  C:\Windows\System\XcEMUHp.exe
  2⤵
  PID:11164
- C:\Windows\System\ADqaKnA.exe
  C:\Windows\System\ADqaKnA.exe
  2⤵
  PID:11192
- C:\Windows\System\wQMVbJM.exe
  C:\Windows\System\wQMVbJM.exe
  2⤵
  PID:11220
- C:\Windows\System\LIGitso.exe
  C:\Windows\System\LIGitso.exe
  2⤵
  PID:11260
- C:\Windows\System\LtbHZJV.exe
  C:\Windows\System\LtbHZJV.exe
  2⤵
  PID:10284
- C:\Windows\System\YceijhG.exe
  C:\Windows\System\YceijhG.exe
  2⤵
  PID:10348
- C:\Windows\System\PhDjQud.exe
  C:\Windows\System\PhDjQud.exe
  2⤵
  PID:10364
- C:\Windows\System\CnBJjsk.exe
  C:\Windows\System\CnBJjsk.exe
  2⤵
  PID:10440
- C:\Windows\System\zOJQoEi.exe
  C:\Windows\System\zOJQoEi.exe
  2⤵
  PID:10504
- C:\Windows\System\oqbjVUY.exe
  C:\Windows\System\oqbjVUY.exe
  2⤵
  PID:10568
- C:\Windows\System\TwWIGvs.exe
  C:\Windows\System\TwWIGvs.exe
  2⤵
  PID:10640
- C:\Windows\System\EObeqOM.exe
  C:\Windows\System\EObeqOM.exe
  2⤵
  PID:10724
- C:\Windows\System\kFMinzN.exe
  C:\Windows\System\kFMinzN.exe
  2⤵
  PID:10756
- C:\Windows\System\IMwJscs.exe
  C:\Windows\System\IMwJscs.exe
  2⤵
  PID:10852
- C:\Windows\System\pffkSdC.exe
  C:\Windows\System\pffkSdC.exe
  2⤵
  PID:10912
- C:\Windows\System\AyzlXyQ.exe
  C:\Windows\System\AyzlXyQ.exe
  2⤵
  PID:10992
- C:\Windows\System\VxPccHL.exe
  C:\Windows\System\VxPccHL.exe
  2⤵
  PID:11012
- C:\Windows\System\DgsjqFM.exe
  C:\Windows\System\DgsjqFM.exe
  2⤵
  PID:11076
- C:\Windows\System\qVctDMn.exe
  C:\Windows\System\qVctDMn.exe
  2⤵
  PID:11124
- C:\Windows\System\hYwyhJD.exe
  C:\Windows\System\hYwyhJD.exe
  2⤵
  PID:11212
- C:\Windows\System\BIpgvyG.exe
  C:\Windows\System\BIpgvyG.exe
  2⤵
  PID:11252
- C:\Windows\System\liyFsyd.exe
  C:\Windows\System\liyFsyd.exe
  2⤵
  PID:2656
- C:\Windows\System\nrxwnUp.exe
  C:\Windows\System\nrxwnUp.exe
  2⤵
  PID:10620
- C:\Windows\System\UXDLmZS.exe
  C:\Windows\System\UXDLmZS.exe
  2⤵
  PID:10812
- C:\Windows\System\aKnCEEy.exe
  C:\Windows\System\aKnCEEy.exe
  2⤵
  PID:10368
- C:\Windows\System\uqTCaHn.exe
  C:\Windows\System\uqTCaHn.exe
  2⤵
  PID:11032
- C:\Windows\System\UBFYjZR.exe
  C:\Windows\System\UBFYjZR.exe
  2⤵
  PID:9656
- C:\Windows\System\jIzouUP.exe
  C:\Windows\System\jIzouUP.exe
  2⤵
  PID:10460
- C:\Windows\System\WUOGprN.exe
  C:\Windows\System\WUOGprN.exe
  2⤵
  PID:10784
- C:\Windows\System\vlMLZPH.exe
  C:\Windows\System\vlMLZPH.exe
  2⤵
  PID:11136
- C:\Windows\System\UEhtdHb.exe
  C:\Windows\System\UEhtdHb.exe
  2⤵
  PID:10760
- C:\Windows\System\rfGVnnW.exe
  C:\Windows\System\rfGVnnW.exe
  2⤵
  PID:11276
- C:\Windows\System\buCpnyj.exe
  C:\Windows\System\buCpnyj.exe
  2⤵
  PID:11308
- C:\Windows\System\sLLYCKx.exe
  C:\Windows\System\sLLYCKx.exe
  2⤵
  PID:11364
- C:\Windows\System\rHGwhgY.exe
  C:\Windows\System\rHGwhgY.exe
  2⤵
  PID:11384
- C:\Windows\System\XSsHsHY.exe
  C:\Windows\System\XSsHsHY.exe
  2⤵
  PID:11420
- C:\Windows\System\nQbOPAi.exe
  C:\Windows\System\nQbOPAi.exe
  2⤵
  PID:11436
- C:\Windows\System\EyXGZaC.exe
  C:\Windows\System\EyXGZaC.exe
  2⤵
  PID:11456
- C:\Windows\System\qQStCJT.exe
  C:\Windows\System\qQStCJT.exe
  2⤵
  PID:11500
- C:\Windows\System\OxoPVyv.exe
  C:\Windows\System\OxoPVyv.exe
  2⤵
  PID:11520
- C:\Windows\System\rnLXirT.exe
  C:\Windows\System\rnLXirT.exe
  2⤵
  PID:11548
- C:\Windows\System\fxffcoa.exe
  C:\Windows\System\fxffcoa.exe
  2⤵
  PID:11576
- C:\Windows\System\vAGbmOp.exe
  C:\Windows\System\vAGbmOp.exe
  2⤵
  PID:11616
- C:\Windows\System\uGsJPIc.exe
  C:\Windows\System\uGsJPIc.exe
  2⤵
  PID:11644
- C:\Windows\System\ipYDzGh.exe
  C:\Windows\System\ipYDzGh.exe
  2⤵
  PID:11660
- C:\Windows\System\CwxPLPQ.exe
  C:\Windows\System\CwxPLPQ.exe
  2⤵
  PID:11676
- C:\Windows\System\MkIPOeC.exe
  C:\Windows\System\MkIPOeC.exe
  2⤵
  PID:11704
- C:\Windows\System\ohkjZeS.exe
  C:\Windows\System\ohkjZeS.exe
  2⤵
  PID:11728
- C:\Windows\System\bOwLoOg.exe
  C:\Windows\System\bOwLoOg.exe
  2⤵
  PID:11764
- C:\Windows\System\LwHBzjb.exe
  C:\Windows\System\LwHBzjb.exe
  2⤵
  PID:11800
- C:\Windows\System\ACHwyaQ.exe
  C:\Windows\System\ACHwyaQ.exe
  2⤵
  PID:11840
- C:\Windows\System\MowFEXw.exe
  C:\Windows\System\MowFEXw.exe
  2⤵
  PID:11868
- C:\Windows\System\NEPVWzE.exe
  C:\Windows\System\NEPVWzE.exe
  2⤵
  PID:11884
- C:\Windows\System\wfGwHmD.exe
  C:\Windows\System\wfGwHmD.exe
  2⤵
  PID:11912
- C:\Windows\System\DRtRnjE.exe
  C:\Windows\System\DRtRnjE.exe
  2⤵
  PID:11940
- C:\Windows\System\HJqREog.exe
  C:\Windows\System\HJqREog.exe
  2⤵
  PID:11956
- C:\Windows\System\LGGjdGE.exe
  C:\Windows\System\LGGjdGE.exe
  2⤵
  PID:11988
- C:\Windows\System\EljvFXd.exe
  C:\Windows\System\EljvFXd.exe
  2⤵
  PID:12020
- C:\Windows\System\RHFqlOw.exe
  C:\Windows\System\RHFqlOw.exe
  2⤵
  PID:12064
- C:\Windows\System\pNgEzrB.exe
  C:\Windows\System\pNgEzrB.exe
  2⤵
  PID:12080
- C:\Windows\System\EHptXOa.exe
  C:\Windows\System\EHptXOa.exe
  2⤵
  PID:12108
- C:\Windows\System\sHuZZgO.exe
  C:\Windows\System\sHuZZgO.exe
  2⤵
  PID:12148
- C:\Windows\System\XmbpPZn.exe
  C:\Windows\System\XmbpPZn.exe
  2⤵
  PID:12176
- C:\Windows\System\FknyojL.exe
  C:\Windows\System\FknyojL.exe
  2⤵
  PID:12192
- C:\Windows\System\ajPMoVX.exe
  C:\Windows\System\ajPMoVX.exe
  2⤵
  PID:12216
- C:\Windows\System\KLhcVFi.exe
  C:\Windows\System\KLhcVFi.exe
  2⤵
  PID:12240
- C:\Windows\System\YZymkTl.exe
  C:\Windows\System\YZymkTl.exe
  2⤵
  PID:12276
- C:\Windows\System\ubIquyr.exe
  C:\Windows\System\ubIquyr.exe
  2⤵
  PID:11132
- C:\Windows\System\vBMyjfj.exe
  C:\Windows\System\vBMyjfj.exe
  2⤵
  PID:11304
- C:\Windows\System\DGfVdiE.exe
  C:\Windows\System\DGfVdiE.exe
  2⤵
  PID:11372
- C:\Windows\System\vJqcIum.exe
  C:\Windows\System\vJqcIum.exe
  2⤵
  PID:11476
- C:\Windows\System\yELzZls.exe
  C:\Windows\System\yELzZls.exe
  2⤵
  PID:11532
- C:\Windows\System\TgAJzhv.exe
  C:\Windows\System\TgAJzhv.exe
  2⤵
  PID:11564
- C:\Windows\System\gJZnEJp.exe
  C:\Windows\System\gJZnEJp.exe
  2⤵
  PID:11668
- C:\Windows\System\bnEHtUh.exe
  C:\Windows\System\bnEHtUh.exe
  2⤵
  PID:11748
- C:\Windows\System\frHtYkQ.exe
  C:\Windows\System\frHtYkQ.exe
  2⤵
  PID:11820
- C:\Windows\System\FkKgEYI.exe
  C:\Windows\System\FkKgEYI.exe
  2⤵
  PID:11864
- C:\Windows\System\fcrXRmP.exe
  C:\Windows\System\fcrXRmP.exe
  2⤵
  PID:11952
- C:\Windows\System\LNiatMe.exe
  C:\Windows\System\LNiatMe.exe
  2⤵
  PID:11976
- C:\Windows\System\DPEEUEu.exe
  C:\Windows\System\DPEEUEu.exe
  2⤵
  PID:12004
- C:\Windows\System\jLPrXms.exe
  C:\Windows\System\jLPrXms.exe
  2⤵
  PID:12132
- C:\Windows\System\btmkxQM.exe
  C:\Windows\System\btmkxQM.exe
  2⤵
  PID:12184
- C:\Windows\System\OkfbLln.exe
  C:\Windows\System\OkfbLln.exe
  2⤵
  PID:12268
- C:\Windows\System\nRtTSDq.exe
  C:\Windows\System\nRtTSDq.exe
  2⤵
  PID:11380
- C:\Windows\System\ffoKWBk.exe
  C:\Windows\System\ffoKWBk.exe
  2⤵
  PID:11432
- C:\Windows\System\YVrbSfB.exe
  C:\Windows\System\YVrbSfB.exe
  2⤵
  PID:11628
- C:\Windows\System\PTVGWCK.exe
  C:\Windows\System\PTVGWCK.exe
  2⤵
  PID:11688
- C:\Windows\System\fgcBJbT.exe
  C:\Windows\System\fgcBJbT.exe
  2⤵
  PID:11788
- C:\Windows\System\zFPyqPv.exe
  C:\Windows\System\zFPyqPv.exe
  2⤵
  PID:11900
- C:\Windows\System\iLVyDmy.exe
  C:\Windows\System\iLVyDmy.exe
  2⤵
  PID:12224
- C:\Windows\System\YSnIwwd.exe
  C:\Windows\System\YSnIwwd.exe
  2⤵
  PID:11176
- C:\Windows\System\rKEnTLO.exe
  C:\Windows\System\rKEnTLO.exe
  2⤵
  PID:11652
- C:\Windows\System\SkfsgOV.exe
  C:\Windows\System\SkfsgOV.exe
  2⤵
  PID:12128
- C:\Windows\System\XaNBxbi.exe
  C:\Windows\System\XaNBxbi.exe
  2⤵
  PID:11464
- C:\Windows\System\NOMeivy.exe
  C:\Windows\System\NOMeivy.exe
  2⤵
  PID:11592
- C:\Windows\System\wfJuBxk.exe
  C:\Windows\System\wfJuBxk.exe
  2⤵
  PID:12308
- C:\Windows\System\QeAiabY.exe
  C:\Windows\System\QeAiabY.exe
  2⤵
  PID:12332
- C:\Windows\System\ZmhbYHE.exe
  C:\Windows\System\ZmhbYHE.exe
  2⤵
  PID:12364
- C:\Windows\System\hWAyPuS.exe
  C:\Windows\System\hWAyPuS.exe
  2⤵
  PID:12388
- C:\Windows\System\xfcTIdP.exe
  C:\Windows\System\xfcTIdP.exe
  2⤵
  PID:12408
- C:\Windows\System\fwSsHoC.exe
  C:\Windows\System\fwSsHoC.exe
  2⤵
  PID:12428
- C:\Windows\System\tGWeDVT.exe
  C:\Windows\System\tGWeDVT.exe
  2⤵
  PID:12472
- C:\Windows\System\iXxBuGF.exe
  C:\Windows\System\iXxBuGF.exe
  2⤵
  PID:12500
- C:\Windows\System\aQqjynv.exe
  C:\Windows\System\aQqjynv.exe
  2⤵
  PID:12528
- C:\Windows\System\nAOCqRJ.exe
  C:\Windows\System\nAOCqRJ.exe
  2⤵
  PID:12568
- C:\Windows\System\dpivRvx.exe
  C:\Windows\System\dpivRvx.exe
  2⤵
  PID:12596
- C:\Windows\System\vUiNftc.exe
  C:\Windows\System\vUiNftc.exe
  2⤵
  PID:12624
- C:\Windows\System\JjsnFmR.exe
  C:\Windows\System\JjsnFmR.exe
  2⤵
  PID:12640
- C:\Windows\System\ubGflbs.exe
  C:\Windows\System\ubGflbs.exe
  2⤵
  PID:12668
- C:\Windows\System\VMifBSh.exe
  C:\Windows\System\VMifBSh.exe
  2⤵
  PID:12684
- C:\Windows\System\ngpdLwR.exe
  C:\Windows\System\ngpdLwR.exe
  2⤵
  PID:12724
- C:\Windows\System\wyjwQGT.exe
  C:\Windows\System\wyjwQGT.exe
  2⤵
  PID:12740
- C:\Windows\System\UmLLiAs.exe
  C:\Windows\System\UmLLiAs.exe
  2⤵
  PID:12772
- C:\Windows\System\nnYzeun.exe
  C:\Windows\System\nnYzeun.exe
  2⤵
  PID:12804
- C:\Windows\System\LQWIKHZ.exe
  C:\Windows\System\LQWIKHZ.exe
  2⤵
  PID:12848
- C:\Windows\System\bDLGAPE.exe
  C:\Windows\System\bDLGAPE.exe
  2⤵
  PID:12868
- C:\Windows\System\XIrCPfp.exe
  C:\Windows\System\XIrCPfp.exe
  2⤵
  PID:12904
- C:\Windows\System\IbuyASb.exe
  C:\Windows\System\IbuyASb.exe
  2⤵
  PID:12920
- C:\Windows\System\cRRhzhG.exe
  C:\Windows\System\cRRhzhG.exe
  2⤵
  PID:12944
- C:\Windows\System\NVLYaym.exe
  C:\Windows\System\NVLYaym.exe
  2⤵
  PID:12976
- C:\Windows\System\tdfSgCy.exe
  C:\Windows\System\tdfSgCy.exe
  2⤵
  PID:13004
- C:\Windows\System\lbvvUPj.exe
  C:\Windows\System\lbvvUPj.exe
  2⤵
  PID:13032
- C:\Windows\System\JZNRAnG.exe
  C:\Windows\System\JZNRAnG.exe
  2⤵
  PID:13056
- C:\Windows\System\FrtitrK.exe
  C:\Windows\System\FrtitrK.exe
  2⤵
  PID:13096
- C:\Windows\System\TqmwOgL.exe
  C:\Windows\System\TqmwOgL.exe
  2⤵
  PID:13128
- C:\Windows\System\YjPySJv.exe
  C:\Windows\System\YjPySJv.exe
  2⤵
  PID:13156
- C:\Windows\System\GxZSDvK.exe
  C:\Windows\System\GxZSDvK.exe
  2⤵
  PID:13188
- C:\Windows\System\fFvbceM.exe
  C:\Windows\System\fFvbceM.exe
  2⤵
  PID:13204
- C:\Windows\System\AtghGtL.exe
  C:\Windows\System\AtghGtL.exe
  2⤵
  PID:13232
- C:\Windows\System\SVvoomS.exe
  C:\Windows\System\SVvoomS.exe
  2⤵
  PID:13260
- C:\Windows\System\VzHRtZH.exe
  C:\Windows\System\VzHRtZH.exe
  2⤵
  PID:13288
- C:\Windows\System\KeraRPF.exe
  C:\Windows\System\KeraRPF.exe
  2⤵
  PID:13308
- C:\Windows\System\MeIcaxa.exe
  C:\Windows\System\MeIcaxa.exe
  2⤵
  PID:12296
- C:\Windows\System\FQtkKwc.exe
  C:\Windows\System\FQtkKwc.exe
  2⤵
  PID:12456
- C:\Windows\System\PfifpoO.exe
  C:\Windows\System\PfifpoO.exe
  2⤵
  PID:12452
- C:\Windows\System\pCZXKWd.exe
  C:\Windows\System\pCZXKWd.exe
  2⤵
  PID:12516
- C:\Windows\System\IdFukgL.exe
  C:\Windows\System\IdFukgL.exe
  2⤵
  PID:12580
- C:\Windows\System\rWOOrun.exe
  C:\Windows\System\rWOOrun.exe
  2⤵
  PID:12632
- C:\Windows\System\NYSplZT.exe
  C:\Windows\System\NYSplZT.exe
  2⤵
  PID:12712
- C:\Windows\System\KkjFfni.exe
  C:\Windows\System\KkjFfni.exe
  2⤵
  PID:12824
- C:\Windows\System\AFstymo.exe
  C:\Windows\System\AFstymo.exe
  2⤵
  PID:12876
- C:\Windows\System\bMIGMDC.exe
  C:\Windows\System\bMIGMDC.exe
  2⤵
  PID:12940
- C:\Windows\System\xrSlqpp.exe
  C:\Windows\System\xrSlqpp.exe
  2⤵
  PID:13016
- C:\Windows\System\ICkUFRJ.exe
  C:\Windows\System\ICkUFRJ.exe
  2⤵
  PID:13048
- C:\Windows\System\GCkjMuH.exe
  C:\Windows\System\GCkjMuH.exe
  2⤵
  PID:13104
- C:\Windows\System\CvqUNmh.exe
  C:\Windows\System\CvqUNmh.exe
  2⤵
  PID:13200
- C:\Windows\System\LVgtoOd.exe
  C:\Windows\System\LVgtoOd.exe
  2⤵
  PID:13224
- C:\Windows\System\ZSuFSVZ.exe
  C:\Windows\System\ZSuFSVZ.exe
  2⤵
  PID:12344
- C:\Windows\System\mEiqBOn.exe
  C:\Windows\System\mEiqBOn.exe
  2⤵
  PID:12416
- C:\Windows\System\WShhtyo.exe
  C:\Windows\System\WShhtyo.exe
  2⤵
  PID:12612
- C:\Windows\System\guqkzFZ.exe
  C:\Windows\System\guqkzFZ.exe
  2⤵
  PID:12636
- C:\Windows\System\EqcdUNR.exe
  C:\Windows\System\EqcdUNR.exe
  2⤵
  PID:12912
- C:\Windows\System\BnBfLHf.exe
  C:\Windows\System\BnBfLHf.exe
  2⤵
  PID:13084
- C:\Windows\System\ktFiIMy.exe
  C:\Windows\System\ktFiIMy.exe
  2⤵
  PID:13148
- C:\Windows\System\VEBaNfF.exe
  C:\Windows\System\VEBaNfF.exe
  2⤵
  PID:12680
- C:\Windows\System\zsWvGPZ.exe
  C:\Windows\System\zsWvGPZ.exe
  2⤵
  PID:12844
- C:\Windows\System\EVktyZO.exe
  C:\Windows\System\EVktyZO.exe
  2⤵
  PID:12968
- C:\Windows\System\nSMoohM.exe
  C:\Windows\System\nSMoohM.exe
  2⤵
  PID:12400
- C:\Windows\System\DLFcpMz.exe
  C:\Windows\System\DLFcpMz.exe
  2⤵
  PID:13324
- C:\Windows\System\OJDFeGX.exe
  C:\Windows\System\OJDFeGX.exe
  2⤵
  PID:13356
- C:\Windows\System\AvLDXmE.exe
  C:\Windows\System\AvLDXmE.exe
  2⤵
  PID:13384
- C:\Windows\System\YbKgvwY.exe
  C:\Windows\System\YbKgvwY.exe
  2⤵
  PID:13412
- C:\Windows\System\ikATQQl.exe
  C:\Windows\System\ikATQQl.exe
  2⤵
  PID:13432
- C:\Windows\System\CgWPaMc.exe
  C:\Windows\System\CgWPaMc.exe
  2⤵
  PID:13464
- C:\Windows\System\SarVIwc.exe
  C:\Windows\System\SarVIwc.exe
  2⤵
  PID:13488
- C:\Windows\System\hmbhDCT.exe
  C:\Windows\System\hmbhDCT.exe
  2⤵
  PID:13504
- C:\Windows\System\KyOBlAT.exe
  C:\Windows\System\KyOBlAT.exe
  2⤵
  PID:13524
- C:\Windows\System\nRbIsHF.exe
  C:\Windows\System\nRbIsHF.exe
  2⤵
  PID:13556
- C:\Windows\System\QxrJdcb.exe
  C:\Windows\System\QxrJdcb.exe
  2⤵
  PID:13580
- C:\Windows\System\hfVRKdO.exe
  C:\Windows\System\hfVRKdO.exe
  2⤵
  PID:13656
- C:\Windows\System\CGyaZbF.exe
  C:\Windows\System\CGyaZbF.exe
  2⤵
  PID:13680
- C:\Windows\System\AAdVuGZ.exe
  C:\Windows\System\AAdVuGZ.exe
  2⤵
  PID:13708
- C:\Windows\System\kfQZjVg.exe
  C:\Windows\System\kfQZjVg.exe
  2⤵
  PID:13732
- C:\Windows\System\cYfAVHJ.exe
  C:\Windows\System\cYfAVHJ.exe
  2⤵
  PID:13752
- C:\Windows\System\rLnQnPg.exe
  C:\Windows\System\rLnQnPg.exe
  2⤵
  PID:13776
- C:\Windows\System\WNQsnBY.exe
  C:\Windows\System\WNQsnBY.exe
  2⤵
  PID:13808
- C:\Windows\System\prCjlrn.exe
  C:\Windows\System\prCjlrn.exe
  2⤵
  PID:13832
- C:\Windows\System\ssgRSEo.exe
  C:\Windows\System\ssgRSEo.exe
  2⤵
  PID:13860
- C:\Windows\System\cEjqnYz.exe
  C:\Windows\System\cEjqnYz.exe
  2⤵
  PID:13880
- C:\Windows\System\refzPde.exe
  C:\Windows\System\refzPde.exe
  2⤵
  PID:13912
- C:\Windows\System\jxrmofL.exe
  C:\Windows\System\jxrmofL.exe
  2⤵
  PID:13960
- C:\Windows\System\VnnBTjW.exe
  C:\Windows\System\VnnBTjW.exe
  2⤵
  PID:13988
- C:\Windows\System\pwjSJRb.exe
  C:\Windows\System\pwjSJRb.exe
  2⤵
  PID:14004
- C:\Windows\System\JurJZcx.exe
  C:\Windows\System\JurJZcx.exe
  2⤵
  PID:14024
- C:\Windows\System\yLhSejQ.exe
  C:\Windows\System\yLhSejQ.exe
  2⤵
  PID:14060
- C:\Windows\System\ouRaXsR.exe
  C:\Windows\System\ouRaXsR.exe
  2⤵
  PID:14080
- C:\Windows\System\EAEvXsF.exe
  C:\Windows\System\EAEvXsF.exe
  2⤵
  PID:14108
- C:\Windows\System\RBrMlEi.exe
  C:\Windows\System\RBrMlEi.exe
  2⤵
  PID:14144
- C:\Windows\System\cWOixzM.exe
  C:\Windows\System\cWOixzM.exe
  2⤵
  PID:14172
- C:\Windows\System\gcuXmbn.exe
  C:\Windows\System\gcuXmbn.exe
  2⤵
  PID:14200
- C:\Windows\System\yJEMBHn.exe
  C:\Windows\System\yJEMBHn.exe
  2⤵
  PID:14224
- C:\Windows\System\GrbJTiC.exe
  C:\Windows\System\GrbJTiC.exe
  2⤵
  PID:14252
- C:\Windows\System\PcejCHz.exe
  C:\Windows\System\PcejCHz.exe
  2⤵
  PID:14272
- C:\Windows\System\YdsDXXm.exe
  C:\Windows\System\YdsDXXm.exe
  2⤵
  PID:14292
- C:\Windows\System\cMPsXHq.exe
  C:\Windows\System\cMPsXHq.exe
  2⤵
  PID:14312
- C:\Windows\System\ShIPCFi.exe
  C:\Windows\System\ShIPCFi.exe
  2⤵
  PID:13052
- C:\Windows\System\kpDFNqu.exe
  C:\Windows\System\kpDFNqu.exe
  2⤵
  PID:13368
- C:\Windows\System\IeQZacQ.exe
  C:\Windows\System\IeQZacQ.exe
  2⤵
  PID:13496
- C:\Windows\System\PKISxLh.exe
  C:\Windows\System\PKISxLh.exe
  2⤵
  PID:13536
- C:\Windows\System\WVZCgqD.exe
  C:\Windows\System\WVZCgqD.exe
  2⤵
  PID:13564
- C:\Windows\System\MeKwMli.exe
  C:\Windows\System\MeKwMli.exe
  2⤵
  PID:13616
- C:\Windows\System\YwmUCai.exe
  C:\Windows\System\YwmUCai.exe
  2⤵
  PID:13744
- C:\Windows\System\NzKFIFa.exe
  C:\Windows\System\NzKFIFa.exe
  2⤵
  PID:13816
- C:\Windows\System\QFVONDk.exe
  C:\Windows\System\QFVONDk.exe
  2⤵
  PID:13892
- C:\Windows\System\NEFArDl.exe
  C:\Windows\System\NEFArDl.exe
  2⤵
  PID:13924
- C:\Windows\System\evGpJhs.exe
  C:\Windows\System\evGpJhs.exe
  2⤵
  PID:13996
- C:\Windows\System\iAbscvH.exe
  C:\Windows\System\iAbscvH.exe
  2⤵
  PID:14068
- C:\Windows\System\zKDgvaV.exe
  C:\Windows\System\zKDgvaV.exe
  2⤵
  PID:14136
- C:\Windows\System\hYawboi.exe
  C:\Windows\System\hYawboi.exe
  2⤵
  PID:14160
- C:\Windows\System\yvyaVgr.exe
  C:\Windows\System\yvyaVgr.exe
  2⤵
  PID:14268
- C:\Windows\System\DEdFEbT.exe
  C:\Windows\System\DEdFEbT.exe
  2⤵
  PID:13344
- C:\Windows\System\mClCHmT.exe
  C:\Windows\System\mClCHmT.exe
  2⤵
  PID:13376
- C:\Windows\System\PTfBEQD.exe
  C:\Windows\System\PTfBEQD.exe
  2⤵
  PID:13544
- C:\Windows\System\dUBxrCr.exe
  C:\Windows\System\dUBxrCr.exe
  2⤵
  PID:13696
- C:\Windows\System\pSdnepA.exe
  C:\Windows\System\pSdnepA.exe
  2⤵
  PID:13788
- C:\Windows\System\PCkAOyJ.exe
  C:\Windows\System\PCkAOyJ.exe
  2⤵
  PID:13940
- C:\Windows\System\GJwdGFZ.exe
  C:\Windows\System\GJwdGFZ.exe
  2⤵
  PID:14040
- C:\Windows\System\xdxoteM.exe
  C:\Windows\System\xdxoteM.exe
  2⤵
  PID:14188
- C:\Windows\System\FkpTuJm.exe
  C:\Windows\System\FkpTuJm.exe
  2⤵
  PID:13448
- C:\Windows\System\fWNUrBK.exe
  C:\Windows\System\fWNUrBK.exe
  2⤵
  PID:13720
- C:\Windows\System\TkcQhDh.exe
  C:\Windows\System\TkcQhDh.exe
  2⤵
  PID:14132
- C:\Windows\System\EbTwJYa.exe
  C:\Windows\System\EbTwJYa.exe
  2⤵
  PID:12796
- C:\Windows\System\lRKiHCo.exe
  C:\Windows\System\lRKiHCo.exe
  2⤵
  PID:13980
- C:\Windows\System\fkcnjzr.exe
  C:\Windows\System\fkcnjzr.exe
  2⤵
  PID:14352
- C:\Windows\System\NzTNzDI.exe
  C:\Windows\System\NzTNzDI.exe
  2⤵
  PID:14392
- C:\Windows\System\puzVmRV.exe
  C:\Windows\System\puzVmRV.exe
  2⤵
  PID:14420
- C:\Windows\System\wbkHCGQ.exe
  C:\Windows\System\wbkHCGQ.exe
  2⤵
  PID:14460
- C:\Windows\System\YghYHJd.exe
  C:\Windows\System\YghYHJd.exe
  2⤵
  PID:14484
- C:\Windows\System\PWYldXP.exe
  C:\Windows\System\PWYldXP.exe
  2⤵
  PID:14504
- C:\Windows\System\KxwqGNu.exe
  C:\Windows\System\KxwqGNu.exe
  2⤵
  PID:14540
- C:\Windows\System\OUgviMn.exe
  C:\Windows\System\OUgviMn.exe
  2⤵
  PID:14572
- C:\Windows\System\LzTBqPo.exe
  C:\Windows\System\LzTBqPo.exe
  2⤵
  PID:14596
- C:\Windows\System\oCOJRan.exe
  C:\Windows\System\oCOJRan.exe
  2⤵
  PID:14616
- C:\Windows\System\rCOCjHX.exe
  C:\Windows\System\rCOCjHX.exe
  2⤵
  PID:14656
- C:\Windows\System\LGweCeO.exe
  C:\Windows\System\LGweCeO.exe
  2⤵
  PID:14672
- C:\Windows\System\DUPcwTE.exe
  C:\Windows\System\DUPcwTE.exe
  2⤵
  PID:14700
- C:\Windows\System\sIcGQKO.exe
  C:\Windows\System\sIcGQKO.exe
  2⤵
  PID:14728
- C:\Windows\System\seOeXyt.exe
  C:\Windows\System\seOeXyt.exe
  2⤵
  PID:14780
- C:\Windows\System\vibQFQB.exe
  C:\Windows\System\vibQFQB.exe
  2⤵
  PID:14796
- C:\Windows\System\XitDLIb.exe
  C:\Windows\System\XitDLIb.exe
  2⤵
  PID:14816
- C:\Windows\System\FLHgHox.exe
  C:\Windows\System\FLHgHox.exe
  2⤵
  PID:14840
- C:\Windows\System\EXzdCWL.exe
  C:\Windows\System\EXzdCWL.exe
  2⤵
  PID:14856
- C:\Windows\System\jNjEEUa.exe
  C:\Windows\System\jNjEEUa.exe
  2⤵
  PID:14880
- C:\Windows\System\TQYqTMb.exe
  C:\Windows\System\TQYqTMb.exe
  2⤵
  PID:14912
- C:\Windows\System\qdOdtaO.exe
  C:\Windows\System\qdOdtaO.exe
  2⤵
  PID:14948
- C:\Windows\System\Cqhxrys.exe
  C:\Windows\System\Cqhxrys.exe
  2⤵
  PID:14972
- C:\Windows\System\eHqHyqw.exe
  C:\Windows\System\eHqHyqw.exe
  2⤵
  PID:15008
- C:\Windows\System\rVWVMpl.exe
  C:\Windows\System\rVWVMpl.exe
  2⤵
  PID:15036
- C:\Windows\System\YxZKuOk.exe
  C:\Windows\System\YxZKuOk.exe
  2⤵
  PID:15056
- C:\Windows\System\OLaUqcl.exe
  C:\Windows\System\OLaUqcl.exe
  2⤵
  PID:15084
- C:\Windows\System\wZevXoJ.exe
  C:\Windows\System\wZevXoJ.exe
  2⤵
  PID:15100
- C:\Windows\System\ZybLcfJ.exe
  C:\Windows\System\ZybLcfJ.exe
  2⤵
  PID:15152
- C:\Windows\System\Pctzcdv.exe
  C:\Windows\System\Pctzcdv.exe
  2⤵
  PID:15168
- C:\Windows\System\xjydQje.exe
  C:\Windows\System\xjydQje.exe
  2⤵
  PID:15204
- C:\Windows\System\qfIfdkr.exe
  C:\Windows\System\qfIfdkr.exe
  2⤵
  PID:15236
- C:\Windows\System\UYmTnwN.exe
  C:\Windows\System\UYmTnwN.exe
  2⤵
  PID:15264
- C:\Windows\System\OlUlpiy.exe
  C:\Windows\System\OlUlpiy.exe
  2⤵
  PID:15300
- C:\Windows\System\UaMNSvE.exe
  C:\Windows\System\UaMNSvE.exe
  2⤵
  PID:15332
- C:\Windows\System\GpaZpAH.exe
  C:\Windows\System\GpaZpAH.exe
  2⤵
  PID:15348
- C:\Windows\System\KzVkxxm.exe
  C:\Windows\System\KzVkxxm.exe
  2⤵
  PID:14348
- C:\Windows\System\WuGEUPX.exe
  C:\Windows\System\WuGEUPX.exe
  2⤵
  PID:14452
- C:\Windows\System\nDYdnee.exe
  C:\Windows\System\nDYdnee.exe
  2⤵
  PID:14536
- C:\Windows\System\HUGFLDf.exe
  C:\Windows\System\HUGFLDf.exe
  2⤵
  PID:14628
- C:\Windows\System\oPJgaCe.exe
  C:\Windows\System\oPJgaCe.exe
  2⤵
  PID:14640
- C:\Windows\System\pSZaRrY.exe
  C:\Windows\System\pSZaRrY.exe
  2⤵
  PID:14668
- C:\Windows\System\fsNUNyC.exe
  C:\Windows\System\fsNUNyC.exe
  2⤵
  PID:14712
- C:\Windows\System\jzCwjRW.exe
  C:\Windows\System\jzCwjRW.exe
  2⤵
  PID:14788
- C:\Windows\System\MJbzRBB.exe
  C:\Windows\System\MJbzRBB.exe
  2⤵
  PID:14832
- C:\Windows\System\NAVvJcj.exe
  C:\Windows\System\NAVvJcj.exe
  2⤵
  PID:14900
- C:\Windows\System\maWusEo.exe
  C:\Windows\System\maWusEo.exe
  2⤵
  PID:14944
- C:\Windows\System\whxUtPA.exe
  C:\Windows\System\whxUtPA.exe
  2⤵
  PID:15064
- C:\Windows\System\lTyiwze.exe
  C:\Windows\System\lTyiwze.exe
  2⤵
  PID:15160
- C:\Windows\System\DWlljog.exe
  C:\Windows\System\DWlljog.exe
  2⤵
  PID:15188
- C:\Windows\System\lEVjNVK.exe
  C:\Windows\System\lEVjNVK.exe
  2⤵
  PID:15324
- C:\Windows\System\pYtztTb.exe
  C:\Windows\System\pYtztTb.exe
  2⤵
  PID:13984
- C:\Windows\System\MKspfAQ.exe
  C:\Windows\System\MKspfAQ.exe
  2⤵
  PID:14516
- C:\Windows\System\HTjnjdl.exe
  C:\Windows\System\HTjnjdl.exe
  2⤵
  PID:14604
- C:\Windows\System\kJBRzcY.exe
  C:\Windows\System\kJBRzcY.exe
  2⤵
  PID:14824
- C:\Windows\System\ORofEbu.exe
  C:\Windows\System\ORofEbu.exe
  2⤵
  PID:15028
- C:\Windows\System\oIKtxXl.exe
  C:\Windows\System\oIKtxXl.exe
  2⤵
  PID:15120
- C:\Windows\System\geooPJT.exe
  C:\Windows\System\geooPJT.exe
  2⤵
  PID:15276
- C:\Windows\System\oWUtWMW.exe
  C:\Windows\System\oWUtWMW.exe
  2⤵
  PID:15340
- C:\Windows\System\qeNrkPR.exe
  C:\Windows\System\qeNrkPR.exe
  2⤵
  PID:14876
- C:\Windows\System\DPpqrtL.exe
  C:\Windows\System\DPpqrtL.exe
  2⤵
  PID:15020
- C:\Windows\System\dlvCcso.exe
  C:\Windows\System\dlvCcso.exe
  2⤵
  PID:15228
- C:\Windows\System\kWDMDBv.exe
  C:\Windows\System\kWDMDBv.exe
  2⤵
  PID:14928
- C:\Windows\System\bhUReiQ.exe
  C:\Windows\System\bhUReiQ.exe
  2⤵
  PID:15368
- C:\Windows\System\GRYwdQR.exe
  C:\Windows\System\GRYwdQR.exe
  2⤵
  PID:15388
- C:\Windows\System\mblDIRq.exe
  C:\Windows\System\mblDIRq.exe
  2⤵
  PID:15416
- C:\Windows\System\olOXNaE.exe
  C:\Windows\System\olOXNaE.exe
  2⤵
  PID:15452
- C:\Windows\System\BnrpErZ.exe
  C:\Windows\System\BnrpErZ.exe
  2⤵
  PID:15492
- C:\Windows\System\aMJmRoR.exe
  C:\Windows\System\aMJmRoR.exe
  2⤵
  PID:15524
- C:\Windows\System\eEoEfiS.exe
  C:\Windows\System\eEoEfiS.exe
  2⤵
  PID:15556
- C:\Windows\System\LwTPuCc.exe
  C:\Windows\System\LwTPuCc.exe
  2⤵
  PID:15576
- C:\Windows\System\KmTNxxL.exe
  C:\Windows\System\KmTNxxL.exe
  2⤵
  PID:15600
- C:\Windows\System\dnXkYTA.exe
  C:\Windows\System\dnXkYTA.exe
  2⤵
  PID:15628
- C:\Windows\System\trpmkBb.exe
  C:\Windows\System\trpmkBb.exe
  2⤵
  PID:15668
- C:\Windows\System\fvXtoFW.exe
  C:\Windows\System\fvXtoFW.exe
  2⤵
  PID:15704
- C:\Windows\System\yjdAofZ.exe
  C:\Windows\System\yjdAofZ.exe
  2⤵
  PID:15724
- C:\Windows\System\ysSchqL.exe
  C:\Windows\System\ysSchqL.exe
  2⤵
  PID:15748
- C:\Windows\System\zjgqOGB.exe
  C:\Windows\System\zjgqOGB.exe
  2⤵
  PID:15772
- C:\Windows\System\LJOAoPn.exe
  C:\Windows\System\LJOAoPn.exe
  2⤵
  PID:15808
- C:\Windows\System\PQsUdfC.exe
  C:\Windows\System\PQsUdfC.exe
  2⤵
  PID:15848
- C:\Windows\System\ZFJInzz.exe
  C:\Windows\System\ZFJInzz.exe
  2⤵
  PID:15876
- C:\Windows\System\aWgSruW.exe
  C:\Windows\System\aWgSruW.exe
  2⤵
  PID:15904
- C:\Windows\System\NPSjmjn.exe
  C:\Windows\System\NPSjmjn.exe
  2⤵
  PID:15932
- C:\Windows\System\gsXQwYy.exe
  C:\Windows\System\gsXQwYy.exe
  2⤵
  PID:15948
- C:\Windows\System\HGaFiJs.exe
  C:\Windows\System\HGaFiJs.exe
  2⤵
  PID:15976
- C:\Windows\System\SBQGCVq.exe
  C:\Windows\System\SBQGCVq.exe
  2⤵
  PID:16000
- C:\Windows\System\rVoJSrZ.exe
  C:\Windows\System\rVoJSrZ.exe
  2⤵
  PID:16044
- C:\Windows\System\TSiZwRX.exe
  C:\Windows\System\TSiZwRX.exe
  2⤵
  PID:16072
- C:\Windows\System\zZQgzyO.exe
  C:\Windows\System\zZQgzyO.exe
  2⤵
  PID:16088
- C:\Windows\System\uSZbYOn.exe
  C:\Windows\System\uSZbYOn.exe
  2⤵
  PID:16128
- C:\Windows\System\yFLwlva.exe
  C:\Windows\System\yFLwlva.exe
  2⤵
  PID:16156
- C:\Windows\System\XfTuOju.exe
  C:\Windows\System\XfTuOju.exe
  2⤵
  PID:16172
- C:\Windows\System\RvTzMXD.exe
  C:\Windows\System\RvTzMXD.exe
  2⤵
  PID:16200
- C:\Windows\System\sjYirCf.exe
  C:\Windows\System\sjYirCf.exe
  2⤵
  PID:16216
- C:\Windows\System\WzfAgBQ.exe
  C:\Windows\System\WzfAgBQ.exe
  2⤵
  PID:16236
- C:\Windows\System\GSRioPr.exe
  C:\Windows\System\GSRioPr.exe
  2⤵
  PID:16272
- C:\Windows\System\QdfiiHx.exe
  C:\Windows\System\QdfiiHx.exe
  2⤵
  PID:16292
- C:\Windows\System\xXovRrc.exe
  C:\Windows\System\xXovRrc.exe
  2⤵
  PID:16320
- C:\Windows\System\mlDllQH.exe
  C:\Windows\System\mlDllQH.exe
  2⤵
  PID:16356
- C:\Windows\System\ipFcnNQ.exe
  C:\Windows\System\ipFcnNQ.exe
  2⤵
  PID:16380
- C:\Windows\System\xcgmemV.exe
  C:\Windows\System\xcgmemV.exe
  2⤵
  PID:14892
- C:\Windows\System\WsnZwEl.exe
  C:\Windows\System\WsnZwEl.exe
  2⤵
  PID:15412
- C:\Windows\System\SotvyxE.exe
  C:\Windows\System\SotvyxE.exe
  2⤵
  PID:15512
- C:\Windows\System\HplVfCM.exe
  C:\Windows\System\HplVfCM.exe
  2⤵
  PID:15652
- C:\Windows\System\pJEFIen.exe
  C:\Windows\System\pJEFIen.exe
  2⤵
  PID:15700
- C:\Windows\System\mXFlJXV.exe
  C:\Windows\System\mXFlJXV.exe
  2⤵
  PID:15780
- C:\Windows\System\xOgyhxb.exe
  C:\Windows\System\xOgyhxb.exe
  2⤵
  PID:15796
- C:\Windows\System\HZZOfpT.exe
  C:\Windows\System\HZZOfpT.exe
  2⤵
  PID:15888
- C:\Windows\System\vhHlLBl.exe
  C:\Windows\System\vhHlLBl.exe
  2⤵
  PID:15968
- C:\Windows\System\aeMfPEG.exe
  C:\Windows\System\aeMfPEG.exe
  2⤵
  PID:16016
- C:\Windows\System\VgmiaVc.exe
  C:\Windows\System\VgmiaVc.exe
  2⤵
  PID:16084
- C:\Windows\System\adUcwQo.exe
  C:\Windows\System\adUcwQo.exe
  2⤵
  PID:16140
- C:\Windows\System\sTgSaQo.exe
  C:\Windows\System\sTgSaQo.exe
  2⤵
  PID:16188
- C:\Windows\System\CvJqDpd.exe
  C:\Windows\System\CvJqDpd.exe
  2⤵
  PID:16248
- C:\Windows\System\mAWjxKu.exe
  C:\Windows\System\mAWjxKu.exe
  2⤵
  PID:16300
- C:\Windows\System\WqUtyzs.exe
  C:\Windows\System\WqUtyzs.exe
  2⤵
  PID:14852
- C:\Windows\System\eytshgg.exe
  C:\Windows\System\eytshgg.exe
  2⤵
  PID:15396
- C:\Windows\System\gYnQKRA.exe
  C:\Windows\System\gYnQKRA.exe
  2⤵
  PID:15584
- C:\Windows\System\bFnxJQR.exe
  C:\Windows\System\bFnxJQR.exe
  2⤵
  PID:15740
- C:\Windows\System\oXpHLTD.exe
  C:\Windows\System\oXpHLTD.exe
  2⤵
  PID:15832
- C:\Windows\System\knkegov.exe
  C:\Windows\System\knkegov.exe
  2⤵
  PID:16028
- C:\Windows\System\WXNDOOc.exe
  C:\Windows\System\WXNDOOc.exe
  2⤵
  PID:16116
- C:\Windows\System\kOqYThy.exe
  C:\Windows\System\kOqYThy.exe
  2⤵
  PID:16212
- C:\Windows\System\KtENyhN.exe
  C:\Windows\System\KtENyhN.exe
  2⤵
  PID:15444
- C:\Windows\System\zkGwgar.exe
  C:\Windows\System\zkGwgar.exe
  2⤵
  PID:15836
- C:\Windows\System\ObJHfOB.exe
  C:\Windows\System\ObJHfOB.exe
  2⤵
  PID:16316
- C:\Windows\System\RChBQcq.exe
  C:\Windows\System\RChBQcq.exe
  2⤵
  PID:16392
- C:\Windows\System\tVQRokU.exe
  C:\Windows\System\tVQRokU.exe
  2⤵
  PID:16408
- C:\Windows\System\DkPfPkE.exe
  C:\Windows\System\DkPfPkE.exe
  2⤵
  PID:16436
- C:\Windows\System\fOXaMwU.exe
  C:\Windows\System\fOXaMwU.exe
  2⤵
  PID:16456
- C:\Windows\System\BTxVgSr.exe
  C:\Windows\System\BTxVgSr.exe
  2⤵
  PID:16484
- C:\Windows\System\YKVSicv.exe
  C:\Windows\System\YKVSicv.exe
  2⤵
  PID:16508
- C:\Windows\System\cYCcRgk.exe
  C:\Windows\System\cYCcRgk.exe
  2⤵
  PID:16552
- C:\Windows\System\DXXJYJf.exe
  C:\Windows\System\DXXJYJf.exe
  2⤵
  PID:16576
- C:\Windows\System\MirVMMy.exe
  C:\Windows\System\MirVMMy.exe
  2⤵
  PID:16604
- C:\Windows\System\OLvLiVG.exe
  C:\Windows\System\OLvLiVG.exe
  2⤵
  PID:16644
- C:\Windows\System\pxBCGHp.exe
  C:\Windows\System\pxBCGHp.exe
  2⤵
  PID:16660
- C:\Windows\System\uDRnoJC.exe
  C:\Windows\System\uDRnoJC.exe
  2⤵
  PID:16684
- C:\Windows\System\tePrySy.exe
  C:\Windows\System\tePrySy.exe
  2⤵
  PID:16712
- C:\Windows\System\kVGxVRZ.exe
  C:\Windows\System\kVGxVRZ.exe
  2⤵
  PID:16740
- C:\Windows\System\VoXcsHY.exe
  C:\Windows\System\VoXcsHY.exe
  2⤵
  PID:16764
- C:\Windows\System\EvfcUWc.exe
  C:\Windows\System\EvfcUWc.exe
  2⤵
  PID:16800
- C:\Windows\System\bvqDaxs.exe
  C:\Windows\System\bvqDaxs.exe
  2⤵
  PID:16840
- C:\Windows\System\LLyZPXG.exe
  C:\Windows\System\LLyZPXG.exe
  2⤵
  PID:16856
- C:\Windows\System\NRBcWdM.exe
  C:\Windows\System\NRBcWdM.exe
  2⤵
  PID:16880
- C:\Windows\System\MNLgZir.exe
  C:\Windows\System\MNLgZir.exe
  2⤵
  PID:16904
- C:\Windows\System\lJroyMf.exe
  C:\Windows\System\lJroyMf.exe
  2⤵
  PID:16948
- C:\Windows\System\zhhadIH.exe
  C:\Windows\System\zhhadIH.exe
  2⤵
  PID:16964
- C:\Windows\System\bfFkXYg.exe
  C:\Windows\System\bfFkXYg.exe
  2⤵
  PID:16988
- C:\Windows\System\tEQVPHf.exe
  C:\Windows\System\tEQVPHf.exe
  2⤵
  PID:17024
- C:\Windows\System\VQmlLmi.exe
  C:\Windows\System\VQmlLmi.exe
  2⤵
  PID:17112

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:16500

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\AInLaMU.exe

Filesize
1.7MB

MD5
e9be150c80dbcbfc292f52c2e177b857

SHA1
8402e02b847448b1f577bdb3e6cf6cec931ca173

SHA256
e3523e521e914f7d5e0bf3a8ccea709b7d0a00724c71732def17698cfdd41abc

SHA512
199837fa9803cbb6f66b0621cd98e1804af3a8d247ae7af07a2618bfc4c62c54f75e64ef5f2323c705ce61359dec7e4e0dbd8a34877146e6bdee1ed5d7450861

Download Submit
C:\Windows\System\CsMPKlP.exe

Filesize
1.8MB

MD5
3c7f185036a538f9cc5b6f4dcb55a456

SHA1
6ebdde74e8b9f4faca18aa7056c09a1c3dc96605

SHA256
7b739bc19272979d4ccf0d6bf4f6f29800a3def94c6d9c6fc33f2ae1d60bb474

SHA512
4db64aa57193912b099261429003c7c95644b6413d54ac98a6871fe11bc4aa638ec08d65794b5a8650c893fd98cca59b0218a3361f88eb26fce65fc38620a683

Download Submit
C:\Windows\System\JmIzyTF.exe

Filesize
1.7MB

MD5
205778494067ed26c7e979b1181ffdd9

SHA1
e14c73527b8b095774522ffcc88830243e653547

SHA256
d15c5f7246f0babc5eea568e8d0a63972815366e9cd865c52dce4736b3b9c3eb

SHA512
81dbd548979d1bae0a3a4ebe28f03e7ef0c1cae5a49ea81bb75c78bb50e37637ab9dfdcb9ee8146d18990bcb5a8205f5a0e29b1ac1eed15fe09613271c93a263

Download Submit
C:\Windows\System\MGEmoeb.exe

Filesize
1.7MB

MD5
9670f56d1c5148b40f37460fdded1816

SHA1
ae8abe32eb70077d2e1849de33fc94da26fbce55

SHA256
7edea9c0b40f5214a285c0aa067f7a382158b4b5f1868c3b800d1110aa6d7ec6

SHA512
8927d5e56d341caa0cedf7cffdcf4a06103b9b0681abc959fcf335c1786edb26fa9d9d929b50c248dc1650d2e9b146824fda68ac4b9aa422eb9e13815d466531

Download Submit
C:\Windows\System\MZKJbsf.exe

Filesize
1.8MB

MD5
be134bca36cd9a95f61c8172b14f6151

SHA1
0eed7914cd169c57b3909c81bb803193a5176b5c

SHA256
95254989564aceba9a6f0b61ff8a3ab93c0ab765cd80843db89b93cf4bb6fe28

SHA512
af10b1ca4c401949af01ed7902b8bf067eaf14dc558fe273c0c3d4357fcb1333b03b68bc53c4cd3ac7fa868f169cd2527d3a7c2b412f67ecdc4f3b1cf2a0d68c

Download Submit
C:\Windows\System\OOxCyKc.exe

Filesize
1.8MB

MD5
43a76f11dadb675914f3cef56b4ae15e

SHA1
d31b165e98a9b63e71d2a3a5d0a4ee0ad9a47c37

SHA256
a74cd90b1aeeeef0785ec9092e517df43ca597e0c69d8b17538d5c4c40c2e319

SHA512
4e90ddc3d8854bdead7c3d01c0f6827f39efa5f92e896ccca102aa3834a2d2e7bf525c74391c2ffe09c5cf9a5f9bf23b26bbbd36e9c5e80ee42c0c83265f2c8b

Download Submit
C:\Windows\System\PLWsEdP.exe

Filesize
1.7MB

MD5
3852bab1e5a9ed4d2c0bbcd782a12d99

SHA1
ce56adb9e4cabc49c7f6f9724f3ebc486816650c

SHA256
45b3bc6ab6399a8df9da8c7acc4669adf384ec144ecd892454fb5dbac177b842

SHA512
cd29de6c5c4bc4f7f2841da33a1e1ca3d8f7a1963dd5d2622b3da5becb962bd7278077ba7308194769740fcfc4cf57f933bc0c45cb1044d5a04b431d2906ab8d

Download Submit
C:\Windows\System\QUcPzDi.exe

Filesize
1.8MB

MD5
5e61e5af38096cee0a9a18871309e056

SHA1
2f6493143e8afb191fdaf50b31ed0eab8705716a

SHA256
cdb001b3bc56881938bf49694502d4fb579c7c80d892b8ca20d491a2b8787a88

SHA512
95b7abdfcb2d14d7e3618fc9572dc9e3aaec2fb4b5976884ad824e89bfb4b647dfb31d6975ff098c22e304f4280f240c039cf48cc51b4c9b148b2e0baf25eae5

Download Submit
C:\Windows\System\ZTljZmf.exe

Filesize
1.8MB

MD5
d04a2bdb488439398e7dcce69d344da5

SHA1
0875441ef9623b89029259d67c3f14dd6ad93417

SHA256
16b0a2689194d79b0ebe30ef298117cf26a42dd587e62cf6bb3f3b233a81e6be

SHA512
d73a9b4e25c533b80c8e4880bb4a6e078d84191c61e00567f0101c9c4604d5a21c2c634983344c8205be2e32aaf8e69332fdfa1dfff98134294d3d94b2d999a9

Download Submit
C:\Windows\System\ZWfckTr.exe

Filesize
1.8MB

MD5
63b8c0c84958ff18b5b88c1fd7ed3ca8

SHA1
4b3ec215c495aeba498a7863ade771e081129a9c

SHA256
59048f2d8b791462f49a779109f01f2ae7105dd73d659c1f62a7d4cb4ae389fc

SHA512
faf1472d4bdb43fcf54cb1fef33c9a7b2871a269bdd36ed7516935d9357141603cf1b31774d6c3951826cb08fd3c16271c1129923a914ca1fbd41d66298d75b8

Download Submit
C:\Windows\System\ZnfjhJc.exe

Filesize
1.7MB

MD5
99b17a36989741f99809904b06f9c87f

SHA1
939bf5150e93d858cbc618fa4368fc6971883c3a

SHA256
2b55742c2ce697d7f8126af66b1d0c500964a412274f055c39659bf61f98fd6a

SHA512
8337751c8b9dc469ed1f7deceb6c99917bb80acf8f424842068608802a77f0b886c7dbadb67b0e6d2ec8c4eadcc914e7f6da0d2a7be55f5319ba980949bb745e

Download Submit
C:\Windows\System\ZsThDcl.exe

Filesize
1.7MB

MD5
eb463b16cf8ac477e8e3b7750c570082

SHA1
a1d2a9de8fdd8360c8950a46d26196d8ed68bdc6

SHA256
9e521b15548d4ceae3c92acfea6af5f486a9b692dbf693a58b846dbff4c2f1f4

SHA512
d978203db85350bca3afddeb4ca1a37c40e97a84fb6855a450af0529e933c23de4d09c07323c29c26e851787840a7d827f68a2bb547052c36caf007dcaeac445

Download Submit
C:\Windows\System\aUGUgjO.exe

Filesize
1.8MB

MD5
945c6109b1961e41a2afe85c3a4b1281

SHA1
3a41c4a658c032f0a730ce7cf542bdd935e95870

SHA256
05e093ab850822f8d5aeaf47aa263f33884cf21f08c9876dffcaac58cd034109

SHA512
ac226ef6506b98d4b438a181fba467b4a84d5dfb5812bfbe3884023acfa834c5189bb82ef84bcea20b3ed9e125d6bb52d0c98cf8a2f5f7289c6b8ad02439177d

Download Submit
C:\Windows\System\afSkKju.exe

Filesize
1.7MB

MD5
65c3168096e82b8ae8d42bee5a0f58bd

SHA1
ebbf0f8e98b7ccc0764a56ef7d1774462771b6cd

SHA256
76f1f9c70c2370da7822766b76db1b5dfc7247ce83ad93df12beb7358b6971c5

SHA512
5f7fdee4b672972b83cc6f87a35dfa1c31f14477cbb711ad99933747ae3b29e3c29234923c63af0b2dbc01b29764e81c6639bc1b31f2e1001c9e69729be20c13

Download Submit
C:\Windows\System\fZvMExT.exe

Filesize
1.7MB

MD5
a145169281b258fa9972278c91b5e4f2

SHA1
acc2e6fb152dca7e2d15c42bfe834ec60d3d05b4

SHA256
01ac5111f64f9c7cbb11af0d73abeb0a2c3c78226bbe09af2c4600c694f0f833

SHA512
245b4640b9e3900ac90667015a8d7b218aba00eb91f6d5c7102a6cc5879472da9f01354423adf26cc201a1d540f6c450cd32d91d19d45c26a1f04a8b6ac739f0

Download Submit
C:\Windows\System\hZBWEFg.exe

Filesize
1.7MB

MD5
1979e725a22a6b3d105c988420f13824

SHA1
05ce74b7f31046b8978e82d8c4712ab43707efae

SHA256
e708a5a2001891e956b92dfa17946b8acd8c062d555092b87151702bf5729876

SHA512
4cc24469afbfeed35e85b034979ca6d31bdb3ff8dc332b3c30d883ac152e01ff42b7656d0140b7af74a6df08353c7114625c42c57367b27331b292e0da9406ce

Download Submit
C:\Windows\System\hcXkNYY.exe

Filesize
1.7MB

MD5
2e70eaeefb8782394b2fc4f06b219e05

SHA1
a44f6b2e51f5e7b449cc7a668ff4185f346ee22a

SHA256
5fa558d7b2f396b73d74e25e659337c0ee101fd87fc61c01287533b7bc04bc06

SHA512
2ca917281f6ab31557f5342b7a7deaa4789d9ac2fc0ef59675bb0633ddbab5b0bd8a669cf4d1a3f3f8845c0cc7abab48a3da725c7fc2e71d167e63d8c5717220

Download Submit
C:\Windows\System\icjjgQO.exe

Filesize
1.8MB

MD5
165cf9605c60d9ade231e919de9710d3

SHA1
ac221a865c53ed3b78e308042145320d5aab1335

SHA256
7a1780da2c7720d80df755db6c188f4a826b270ebf7be54d3ca843dd8e317e76

SHA512
37986bab2e2e5d46dee96cffc1939708732e485e48d34ebb6f2fcc91b90fc767ecb0d418baaa5b6a3297a4d00f24b5546b4d06562c25070e1735f5005b6778c0

Download Submit
C:\Windows\System\igbSLjm.exe

Filesize
1.7MB

MD5
0963f3d0fd29a01790ce40912a4cb168

SHA1
a1037fc56b96410e27686a558572dc229b0a4572

SHA256
51b1f3313afdaf6baebe368536e063b5c98b80b936b4e167bd57e79e4b5397c6

SHA512
c7df08d64a05c192d00c3b8a43e4edf5f33ecdcc0189ba1e4a1227cbfeec04fc59658b1b35d9088656d4334adc408fc164b03eedd2eabd1d9b8cc7fb894ad00d

Download Submit
C:\Windows\System\lzdTuNA.exe

Filesize
1.8MB

MD5
c28d579097812a28c5af22c50e84ca4c

SHA1
5f63b59645e586bda69dca1fcd4ec12e0654f90b

SHA256
670d9a0a082aaf1690e77f2d16ea677df3c74ccceb25647cfc9bc441bdd3e8ec

SHA512
ceee862ccac74de000ff6c1683668129f00f9120f5260edd61a4f7c51d8788deeb980b4e218b7b30f4991cd4dbb1f2360b2d8632ad1431168427ab4de1dc8a6c

Download Submit
C:\Windows\System\nOZdrTC.exe

Filesize
1.7MB

MD5
87be7394cb58864f85848a9354b867eb

SHA1
6759de0c937c627cdf5cb4ca22ce9d65e427de67

SHA256
27233de406601585c9518ae21d41ef75cfea7e15b4799f70d4173b1d0c95c7e8

SHA512
7c8feeb28048b9a618836956608d836f510b96b5229f5072c72348eba4fa92141bac7aca657302cb954958a58fd39de848859f725a69d1ca0af08dca0cdafac7

Download Submit
C:\Windows\System\nWPJHkl.exe

Filesize
1.7MB

MD5
da579c7a2b0863016b7ec4c7562d05c4

SHA1
daaec4dbcb8d8ed48d5840412566c413c41b176e

SHA256
020b94f75dab2b6ddabf04281a27fb705924289455575310003d7a54434b7cb0

SHA512
f0f3a6c32ec751b465cc29a597191d50a46e8cf14ae29369597ef930ed31f4ff405a1fd0437de456d1e30077a5d6665c9e192d8f3be6c8b7eb8c964d5c118c5c

Download Submit
C:\Windows\System\nnDgAdr.exe

Filesize
1.8MB

MD5
1863bf6fdb99f014f86fb0c27547c8e7

SHA1
cadbb0d14d24c266dcda711b10a4ba1661e8a6e4

SHA256
73536ef075749c75d9d05fcf92e2bbc2e16bdb943195c8c70c5673416423a446

SHA512
10543f4ac2a72726d062f500a4eb74ffcf08d6387dffe66f91897f644b7bf89d2dd992da89e41f5c5b67d74daf259b7b14d14451efb7bc41e9b6c7ee34e32c62

Download Submit
C:\Windows\System\nsAPokm.exe

Filesize
1.7MB

MD5
a4b8778f8905b62ffecb4e0538edbfb8

SHA1
7032e083dda4c58030932ec011bf4dcc07b7e6ea

SHA256
c632895e17a3a28371d9d3e3908b325719060082b38ccc960fbab605aadd5207

SHA512
360ad8d506eddbca2f7c4b032e359070d282174832394d7fec4be4652ea4a2c9ec31585646bf28d945fbddf6228ff2f9e59225532a617ee0f90864723d4c1a61

Download Submit
C:\Windows\System\okunENr.exe

Filesize
1.7MB

MD5
227b1954fb42c689fed29ac25a1feeca

SHA1
d7e66f3489401c958e469b474e9dd4df645eec5e

SHA256
f96486fe734f6f285d8e8d2a97671627b511a3001ea2c521536ce34c009c4d5a

SHA512
8aca0969c07406b8d8abc85515e525860f91b478f53cab55263a48c685a6cbb82d55eae9486df899196797d4bc295a40566124c93fd05d2d13aa108dbafefe10

Download Submit
C:\Windows\System\reQwsBm.exe

Filesize
1.7MB

MD5
df2c68bc49c869c35f7658aafcd93145

SHA1
845a0ab3b696e48315ed0a926e503c4be78d210b

SHA256
4fea84f7b16a19a3b4d0f0f9f51af15028a25a5c56d63ad917055db2cfeaf86b

SHA512
6c5baa80abe90d69676d11bf9efbc4ab237d6358facd3dfe383d192cf63fb84c44bf1a58cfb014a6d05644d814af556d88c2627edc905735b77a7711f9229d73

Download Submit
C:\Windows\System\sqcrAIR.exe

Filesize
1.8MB

MD5
a69f4ad7c7d316aef128ba3d2d9d778d

SHA1
e4834bdb1c7fd7bc90df3e57ca3b6fca1546156f

SHA256
382f32fb514e6594dc0a43fb8fcd7d2611ad5bef356bbf27a728cd92659cc803

SHA512
894f52d3b689cf7df8da7c95927f92bdaa0a32ee3630a367104bcf553bba7bc350f3e4d37bf2398982b90f0e1759b76d767f77813ea6a4d081837d8734bcf9aa

Download Submit
C:\Windows\System\uWLUrsO.exe

Filesize
1.7MB

MD5
1f9da04c334b268eaeb38eef6d92915a

SHA1
030b9f06afdb6ade03738441957701549b96ce80

SHA256
9e49ba7ffd777adedf7cdb8946fb0995b31c34a095f0b9e74377ab3651458b6f

SHA512
1e71e64379df05516b73cfe4c1214877a065684305fd2ac9ab8eef176fc25518dee62e4616079835d1401e0077576e2e2e4ce7cf9fb2bfe051e4ccd89ee63591

Download Submit
C:\Windows\System\vevcylF.exe

Filesize
1.8MB

MD5
65ba441041e58a0aaa5c2fb53527cefc

SHA1
193ea8935b114aaeb8a3268055728b6ae860f571

SHA256
8338f95bab7b3415d525d0332d43bbb24aed386551f2214bd6e9cf511dc57e07

SHA512
a9336f8f8b2c6c60404bc9eb866f443b86ee3fe82da9a52abe6c1dece8361f090d95a4362764a7f1128b2cdf394de60115f6fe3ed8c42c8ac9f62b849611568c

Download Submit
C:\Windows\System\wyxgQcb.exe

Filesize
1.7MB

MD5
34708caac80f9393ba39011a87fd8fc0

SHA1
d5429e9b8ce3ae66568cbaff77d2f54a21ab2ea6

SHA256
dd912fa3b1f123be4868f0ded38e756bfecf24c3f7e5bb987cc3b4f5b39af1cd

SHA512
ce1ec0d4af3c303a83c09a8d0bdab098df354be0c76ef36dc2c3c19e61a6239f2d251a52d67cd1952045d31e3751ccb770b76d690f6e5e9f4cd1df1a36ca70c7

Download Submit
C:\Windows\System\yYpmtzc.exe

Filesize
1.7MB

MD5
259f7c64638966e3f69ed619c0ad92e5

SHA1
7c7f3d6d71d7ca550289910609da3be9c078ba64

SHA256
57917a9f740b0df1fdbe52756a9d1bd63c72c3dc97e1d2e17363780b6acef045

SHA512
0f9fb85e386012e03458d00c46575299b8d77decaeb28a82e7caac24dcf065c254e8ea827998e8720e0e82332478c564ca247cc05ccbfdb602285bb907466c86

Download Submit
C:\Windows\System\ykTmtHv.exe

Filesize
1.8MB

MD5
f3f7f98ce832907eb17dedaf28f5dcf4

SHA1
46ab40be7dd1c29f6521a5c30953d3aa3dce5d54

SHA256
b76f4701341c75d48d475baff5f27e0d9beb72fad363fd7780d295e9b00db89a

SHA512
16d094e8a6dd1f190a641cac3e559d4a2219dd7d1a476f0e8f133ce9a72cdb191a4dc5049200afb4f12582cb3e4de59aba36939b628d9c51298403c095c8ed85

Download Submit
C:\Windows\System\zWuMmyu.exe

Filesize
1.8MB

MD5
0f6a48952362943b7c22c149f96da80f

SHA1
9f72114228f550cebff31fa38d057cee9df2033f

SHA256
813303ab4913e735e3856cc5dd206215cb7617823ed9367a972792e70abdb430

SHA512
ec9291ce2f497d524f274be276b8afa326995b9c6d5a077c0943fe08a6d8d3757a740efdd28b68490f212540e7712ad436e5d9a31d1cb49b34b88cec1ff396f7

Download Submit
memory/1764-0-0x0000015C74F60000-0x0000015C74F70000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads