xmrig | 7f344b6970fedee87457d737d4d3e1b2986b126357317e7e595bdd973410e540

Analysis

max time kernel
146s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
23-12-2024 22:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7f344b6970fedee87457d737d4d3e1b2986b126357317e7e595bdd973410e540.exe
Size

1.4MB
MD5

b919518e1b784463ab64e0bd0fa36f79
SHA1

e5074ed86a35f70cae94baa80fbb7afa560f3edb
SHA256

7f344b6970fedee87457d737d4d3e1b2986b126357317e7e595bdd973410e540
SHA512

5c3346a724c683a30628cd4b015cc41cf6cbff3e2d767d014ddb030c631248a1ca3d75d2fad8d3538c2a954f292ff03f8986690f9e5d71ebc66fc5bceaa83b69
SSDEEP

24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbpwlKenszbWKDNEm/51m6Pb8eiRe:GezaTF8FcNkNdfE0pZ9ozttwIRx3riRe

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 33 IoCs

miner

resource	yara_rule
behavioral2/files/0x000c000000023bad-4.dat	xmrig
behavioral2/files/0x0009000000023c95-9.dat	xmrig
behavioral2/files/0x0008000000023ca1-8.dat	xmrig
behavioral2/files/0x0007000000023ca2-19.dat	xmrig
behavioral2/files/0x0007000000023ca4-24.dat	xmrig
behavioral2/files/0x0007000000023ca5-28.dat	xmrig
behavioral2/files/0x0009000000023c97-37.dat	xmrig
behavioral2/files/0x0007000000023ca7-40.dat	xmrig
behavioral2/files/0x0007000000023ca8-47.dat	xmrig
behavioral2/files/0x0007000000023caa-57.dat	xmrig
behavioral2/files/0x0007000000023cab-64.dat	xmrig
behavioral2/files/0x0007000000023cb0-87.dat	xmrig
behavioral2/files/0x0007000000023cb1-100.dat	xmrig
behavioral2/files/0x0007000000023cb5-120.dat	xmrig
behavioral2/files/0x0007000000023cbb-142.dat	xmrig
behavioral2/files/0x0007000000023cbf-162.dat	xmrig
behavioral2/files/0x0007000000023cbd-160.dat	xmrig
behavioral2/files/0x0007000000023cbe-157.dat	xmrig
behavioral2/files/0x0007000000023cbc-155.dat	xmrig
behavioral2/files/0x0007000000023cba-145.dat	xmrig
behavioral2/files/0x0007000000023cb9-140.dat	xmrig
behavioral2/files/0x0007000000023cb8-135.dat	xmrig
behavioral2/files/0x0007000000023cb7-130.dat	xmrig
behavioral2/files/0x0007000000023cb6-125.dat	xmrig
behavioral2/files/0x0007000000023cb4-115.dat	xmrig
behavioral2/files/0x0007000000023cb3-110.dat	xmrig
behavioral2/files/0x0007000000023cb2-105.dat	xmrig
behavioral2/files/0x0007000000023caf-90.dat	xmrig
behavioral2/files/0x0007000000023cae-85.dat	xmrig
behavioral2/files/0x0007000000023cad-80.dat	xmrig
behavioral2/files/0x0007000000023cac-75.dat	xmrig
behavioral2/files/0x0007000000023ca9-58.dat	xmrig
behavioral2/files/0x0007000000023ca6-41.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
4316	mSOXvZF.exe
4048	aLqUFZb.exe
3260	zhWyfOF.exe
4044	bjJufzi.exe
2860	ijPTbRQ.exe
5040	YxrZDNt.exe
1148	zZTvMdO.exe
3984	uBioFAx.exe
5000	fbYfCED.exe
640	XwKqHJu.exe
4996	bDosXtZ.exe
2152	yXcrRnF.exe
2836	CMrzWai.exe
1420	LkPokxw.exe
4732	PQvcVJe.exe
2560	NYzBTzR.exe
4144	GhKsQUL.exe
3044	zKOGlCm.exe
340	EbkWoCl.exe
5084	oSkHoMH.exe
3548	tFXMNoY.exe
4468	ZZkiqtc.exe
628	FTpMfly.exe
4780	BFJSJGA.exe
4472	BpanyIN.exe
4368	GrVUXMz.exe
4848	ErIDeAw.exe
4008	xChkJCv.exe
2604	NOliLUh.exe
4884	cQAifJG.exe
2900	dwGEMrk.exe
312	XqwuiGz.exe
1920	cmMFiTk.exe
4348	IQZYqHB.exe
1200	pGqwpSR.exe
4872	bYDbJyu.exe
4312	KHNdVkL.exe
2196	IIxxxrq.exe
1812	WKvAXhX.exe
1316	lLaHXXl.exe
3208	GsTrtdM.exe
3132	yGubfFP.exe
3840	zJgrcYv.exe
1684	AnGmcjV.exe
3000	OIPaZcO.exe
2892	LiNUevO.exe
1744	pleKHpN.exe
3620	ybkOdyR.exe
4824	CqEEQaL.exe
2424	CKdIQKd.exe
696	JtGUQRw.exe
2044	vymHFcg.exe
2236	CytePqI.exe
4800	DGVAdMG.exe
4720	qhWiEED.exe
4392	GymLMPl.exe
1204	BMrOpRZ.exe
4920	lecEiSt.exe
516	vRnZChf.exe
3784	jIIioul.exe
1520	CqCTjgf.exe
4816	vqqXHZN.exe
668	MWMETnQ.exe
3176	titrwZY.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\cIcTjEu.exe	7f344b6970fedee87457d737d4d3e1b2986b126357317e7e595bdd973410e540.exe
File created	C:\Windows\System\xqIpuoH.exe	7f344b6970fedee87457d737d4d3e1b2986b126357317e7e595bdd973410e540.exe
File created	C:\Windows\System\CKdIQKd.exe	7f344b6970fedee87457d737d4d3e1b2986b126357317e7e595bdd973410e540.exe
File created	C:\Windows\System\hMeOEjy.exe	7f344b6970fedee87457d737d4d3e1b2986b126357317e7e595bdd973410e540.exe
File created	C:\Windows\System\hICOgPI.exe	7f344b6970fedee87457d737d4d3e1b2986b126357317e7e595bdd973410e540.exe
File created	C:\Windows\System\LPfoEYW.exe	7f344b6970fedee87457d737d4d3e1b2986b126357317e7e595bdd973410e540.exe
File created	C:\Windows\System\DBjEyCy.exe	7f344b6970fedee87457d737d4d3e1b2986b126357317e7e595bdd973410e540.exe
File created	C:\Windows\System\IiKXwNz.exe	7f344b6970fedee87457d737d4d3e1b2986b126357317e7e595bdd973410e540.exe
File created	C:\Windows\System\zZpLOxQ.exe	7f344b6970fedee87457d737d4d3e1b2986b126357317e7e595bdd973410e540.exe
File created	C:\Windows\System\SOowPQD.exe	7f344b6970fedee87457d737d4d3e1b2986b126357317e7e595bdd973410e540.exe
File created	C:\Windows\System\rwTJHoa.exe	7f344b6970fedee87457d737d4d3e1b2986b126357317e7e595bdd973410e540.exe
File created	C:\Windows\System\zjoGkst.exe	7f344b6970fedee87457d737d4d3e1b2986b126357317e7e595bdd973410e540.exe
File created	C:\Windows\System\fOvQThN.exe	7f344b6970fedee87457d737d4d3e1b2986b126357317e7e595bdd973410e540.exe
File created	C:\Windows\System\HlRitDL.exe	7f344b6970fedee87457d737d4d3e1b2986b126357317e7e595bdd973410e540.exe
File created	C:\Windows\System\BlOphav.exe	7f344b6970fedee87457d737d4d3e1b2986b126357317e7e595bdd973410e540.exe
File created	C:\Windows\System\pxQLnhE.exe	7f344b6970fedee87457d737d4d3e1b2986b126357317e7e595bdd973410e540.exe
File created	C:\Windows\System\afXlVXD.exe	7f344b6970fedee87457d737d4d3e1b2986b126357317e7e595bdd973410e540.exe
File created	C:\Windows\System\lAnapJI.exe	7f344b6970fedee87457d737d4d3e1b2986b126357317e7e595bdd973410e540.exe
File created	C:\Windows\System\riIlNYb.exe	7f344b6970fedee87457d737d4d3e1b2986b126357317e7e595bdd973410e540.exe
File created	C:\Windows\System\hHuJRun.exe	7f344b6970fedee87457d737d4d3e1b2986b126357317e7e595bdd973410e540.exe
File created	C:\Windows\System\CacnxzO.exe	7f344b6970fedee87457d737d4d3e1b2986b126357317e7e595bdd973410e540.exe
File created	C:\Windows\System\jHgZNms.exe	7f344b6970fedee87457d737d4d3e1b2986b126357317e7e595bdd973410e540.exe
File created	C:\Windows\System\bjJufzi.exe	7f344b6970fedee87457d737d4d3e1b2986b126357317e7e595bdd973410e540.exe
File created	C:\Windows\System\NOliLUh.exe	7f344b6970fedee87457d737d4d3e1b2986b126357317e7e595bdd973410e540.exe
File created	C:\Windows\System\TGtpUyL.exe	7f344b6970fedee87457d737d4d3e1b2986b126357317e7e595bdd973410e540.exe
File created	C:\Windows\System\xaXlFlI.exe	7f344b6970fedee87457d737d4d3e1b2986b126357317e7e595bdd973410e540.exe
File created	C:\Windows\System\QMhuhhf.exe	7f344b6970fedee87457d737d4d3e1b2986b126357317e7e595bdd973410e540.exe
File created	C:\Windows\System\IjfdzaA.exe	7f344b6970fedee87457d737d4d3e1b2986b126357317e7e595bdd973410e540.exe
File created	C:\Windows\System\TTXeNdy.exe	7f344b6970fedee87457d737d4d3e1b2986b126357317e7e595bdd973410e540.exe
File created	C:\Windows\System\YtEDjJH.exe	7f344b6970fedee87457d737d4d3e1b2986b126357317e7e595bdd973410e540.exe
File created	C:\Windows\System\uAEGqVF.exe	7f344b6970fedee87457d737d4d3e1b2986b126357317e7e595bdd973410e540.exe
File created	C:\Windows\System\Cvxbscn.exe	7f344b6970fedee87457d737d4d3e1b2986b126357317e7e595bdd973410e540.exe
File created	C:\Windows\System\MePKDEC.exe	7f344b6970fedee87457d737d4d3e1b2986b126357317e7e595bdd973410e540.exe
File created	C:\Windows\System\hBRUojG.exe	7f344b6970fedee87457d737d4d3e1b2986b126357317e7e595bdd973410e540.exe
File created	C:\Windows\System\TArTnTw.exe	7f344b6970fedee87457d737d4d3e1b2986b126357317e7e595bdd973410e540.exe
File created	C:\Windows\System\yGubfFP.exe	7f344b6970fedee87457d737d4d3e1b2986b126357317e7e595bdd973410e540.exe
File created	C:\Windows\System\OElZOAr.exe	7f344b6970fedee87457d737d4d3e1b2986b126357317e7e595bdd973410e540.exe
File created	C:\Windows\System\zfkNaWE.exe	7f344b6970fedee87457d737d4d3e1b2986b126357317e7e595bdd973410e540.exe
File created	C:\Windows\System\hfbKOOh.exe	7f344b6970fedee87457d737d4d3e1b2986b126357317e7e595bdd973410e540.exe
File created	C:\Windows\System\NajYrzA.exe	7f344b6970fedee87457d737d4d3e1b2986b126357317e7e595bdd973410e540.exe
File created	C:\Windows\System\qBhVVUN.exe	7f344b6970fedee87457d737d4d3e1b2986b126357317e7e595bdd973410e540.exe
File created	C:\Windows\System\uRkrUBj.exe	7f344b6970fedee87457d737d4d3e1b2986b126357317e7e595bdd973410e540.exe
File created	C:\Windows\System\zBnJJOl.exe	7f344b6970fedee87457d737d4d3e1b2986b126357317e7e595bdd973410e540.exe
File created	C:\Windows\System\YrscWyX.exe	7f344b6970fedee87457d737d4d3e1b2986b126357317e7e595bdd973410e540.exe
File created	C:\Windows\System\jyMoaqr.exe	7f344b6970fedee87457d737d4d3e1b2986b126357317e7e595bdd973410e540.exe
File created	C:\Windows\System\NpwuxMZ.exe	7f344b6970fedee87457d737d4d3e1b2986b126357317e7e595bdd973410e540.exe
File created	C:\Windows\System\KktdAcu.exe	7f344b6970fedee87457d737d4d3e1b2986b126357317e7e595bdd973410e540.exe
File created	C:\Windows\System\ZOqEZUq.exe	7f344b6970fedee87457d737d4d3e1b2986b126357317e7e595bdd973410e540.exe
File created	C:\Windows\System\rYKhyLm.exe	7f344b6970fedee87457d737d4d3e1b2986b126357317e7e595bdd973410e540.exe
File created	C:\Windows\System\AlcYrgC.exe	7f344b6970fedee87457d737d4d3e1b2986b126357317e7e595bdd973410e540.exe
File created	C:\Windows\System\ZUmVwLF.exe	7f344b6970fedee87457d737d4d3e1b2986b126357317e7e595bdd973410e540.exe
File created	C:\Windows\System\wdTOmwr.exe	7f344b6970fedee87457d737d4d3e1b2986b126357317e7e595bdd973410e540.exe
File created	C:\Windows\System\lXsZHBe.exe	7f344b6970fedee87457d737d4d3e1b2986b126357317e7e595bdd973410e540.exe
File created	C:\Windows\System\zrcTTtX.exe	7f344b6970fedee87457d737d4d3e1b2986b126357317e7e595bdd973410e540.exe
File created	C:\Windows\System\zQGnmij.exe	7f344b6970fedee87457d737d4d3e1b2986b126357317e7e595bdd973410e540.exe
File created	C:\Windows\System\kuKBHru.exe	7f344b6970fedee87457d737d4d3e1b2986b126357317e7e595bdd973410e540.exe
File created	C:\Windows\System\OGgAsiZ.exe	7f344b6970fedee87457d737d4d3e1b2986b126357317e7e595bdd973410e540.exe
File created	C:\Windows\System\SjXJCoF.exe	7f344b6970fedee87457d737d4d3e1b2986b126357317e7e595bdd973410e540.exe
File created	C:\Windows\System\nnQRLKo.exe	7f344b6970fedee87457d737d4d3e1b2986b126357317e7e595bdd973410e540.exe
File created	C:\Windows\System\qgfwfty.exe	7f344b6970fedee87457d737d4d3e1b2986b126357317e7e595bdd973410e540.exe
File created	C:\Windows\System\CerUqDL.exe	7f344b6970fedee87457d737d4d3e1b2986b126357317e7e595bdd973410e540.exe
File created	C:\Windows\System\ghLrMWP.exe	7f344b6970fedee87457d737d4d3e1b2986b126357317e7e595bdd973410e540.exe
File created	C:\Windows\System\nSDJhjD.exe	7f344b6970fedee87457d737d4d3e1b2986b126357317e7e595bdd973410e540.exe
File created	C:\Windows\System\vMwmbjY.exe	7f344b6970fedee87457d737d4d3e1b2986b126357317e7e595bdd973410e540.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	16432	dwm.exe
Token: SeChangeNotifyPrivilege	16432	dwm.exe
Token: 33	16432	dwm.exe
Token: SeIncBasePriorityPrivilege	16432	dwm.exe
Token: SeShutdownPrivilege	16432	dwm.exe
Token: SeCreatePagefilePrivilege	16432	dwm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2972 wrote to memory of 4316	2972	7f344b6970fedee87457d737d4d3e1b2986b126357317e7e595bdd973410e540.exe	84
PID 2972 wrote to memory of 4316	2972	7f344b6970fedee87457d737d4d3e1b2986b126357317e7e595bdd973410e540.exe	84
PID 2972 wrote to memory of 4048	2972	7f344b6970fedee87457d737d4d3e1b2986b126357317e7e595bdd973410e540.exe	85
PID 2972 wrote to memory of 4048	2972	7f344b6970fedee87457d737d4d3e1b2986b126357317e7e595bdd973410e540.exe	85
PID 2972 wrote to memory of 3260	2972	7f344b6970fedee87457d737d4d3e1b2986b126357317e7e595bdd973410e540.exe	86
PID 2972 wrote to memory of 3260	2972	7f344b6970fedee87457d737d4d3e1b2986b126357317e7e595bdd973410e540.exe	86
PID 2972 wrote to memory of 4044	2972	7f344b6970fedee87457d737d4d3e1b2986b126357317e7e595bdd973410e540.exe	87
PID 2972 wrote to memory of 4044	2972	7f344b6970fedee87457d737d4d3e1b2986b126357317e7e595bdd973410e540.exe	87
PID 2972 wrote to memory of 2860	2972	7f344b6970fedee87457d737d4d3e1b2986b126357317e7e595bdd973410e540.exe	88
PID 2972 wrote to memory of 2860	2972	7f344b6970fedee87457d737d4d3e1b2986b126357317e7e595bdd973410e540.exe	88
PID 2972 wrote to memory of 5040	2972	7f344b6970fedee87457d737d4d3e1b2986b126357317e7e595bdd973410e540.exe	89
PID 2972 wrote to memory of 5040	2972	7f344b6970fedee87457d737d4d3e1b2986b126357317e7e595bdd973410e540.exe	89
PID 2972 wrote to memory of 1148	2972	7f344b6970fedee87457d737d4d3e1b2986b126357317e7e595bdd973410e540.exe	90
PID 2972 wrote to memory of 1148	2972	7f344b6970fedee87457d737d4d3e1b2986b126357317e7e595bdd973410e540.exe	90
PID 2972 wrote to memory of 3984	2972	7f344b6970fedee87457d737d4d3e1b2986b126357317e7e595bdd973410e540.exe	91
PID 2972 wrote to memory of 3984	2972	7f344b6970fedee87457d737d4d3e1b2986b126357317e7e595bdd973410e540.exe	91
PID 2972 wrote to memory of 5000	2972	7f344b6970fedee87457d737d4d3e1b2986b126357317e7e595bdd973410e540.exe	92
PID 2972 wrote to memory of 5000	2972	7f344b6970fedee87457d737d4d3e1b2986b126357317e7e595bdd973410e540.exe	92
PID 2972 wrote to memory of 640	2972	7f344b6970fedee87457d737d4d3e1b2986b126357317e7e595bdd973410e540.exe	93
PID 2972 wrote to memory of 640	2972	7f344b6970fedee87457d737d4d3e1b2986b126357317e7e595bdd973410e540.exe	93
PID 2972 wrote to memory of 4996	2972	7f344b6970fedee87457d737d4d3e1b2986b126357317e7e595bdd973410e540.exe	94
PID 2972 wrote to memory of 4996	2972	7f344b6970fedee87457d737d4d3e1b2986b126357317e7e595bdd973410e540.exe	94
PID 2972 wrote to memory of 2152	2972	7f344b6970fedee87457d737d4d3e1b2986b126357317e7e595bdd973410e540.exe	95
PID 2972 wrote to memory of 2152	2972	7f344b6970fedee87457d737d4d3e1b2986b126357317e7e595bdd973410e540.exe	95
PID 2972 wrote to memory of 2836	2972	7f344b6970fedee87457d737d4d3e1b2986b126357317e7e595bdd973410e540.exe	96
PID 2972 wrote to memory of 2836	2972	7f344b6970fedee87457d737d4d3e1b2986b126357317e7e595bdd973410e540.exe	96
PID 2972 wrote to memory of 1420	2972	7f344b6970fedee87457d737d4d3e1b2986b126357317e7e595bdd973410e540.exe	97
PID 2972 wrote to memory of 1420	2972	7f344b6970fedee87457d737d4d3e1b2986b126357317e7e595bdd973410e540.exe	97
PID 2972 wrote to memory of 4732	2972	7f344b6970fedee87457d737d4d3e1b2986b126357317e7e595bdd973410e540.exe	98
PID 2972 wrote to memory of 4732	2972	7f344b6970fedee87457d737d4d3e1b2986b126357317e7e595bdd973410e540.exe	98
PID 2972 wrote to memory of 2560	2972	7f344b6970fedee87457d737d4d3e1b2986b126357317e7e595bdd973410e540.exe	99
PID 2972 wrote to memory of 2560	2972	7f344b6970fedee87457d737d4d3e1b2986b126357317e7e595bdd973410e540.exe	99
PID 2972 wrote to memory of 4144	2972	7f344b6970fedee87457d737d4d3e1b2986b126357317e7e595bdd973410e540.exe	100
PID 2972 wrote to memory of 4144	2972	7f344b6970fedee87457d737d4d3e1b2986b126357317e7e595bdd973410e540.exe	100
PID 2972 wrote to memory of 3044	2972	7f344b6970fedee87457d737d4d3e1b2986b126357317e7e595bdd973410e540.exe	101
PID 2972 wrote to memory of 3044	2972	7f344b6970fedee87457d737d4d3e1b2986b126357317e7e595bdd973410e540.exe	101
PID 2972 wrote to memory of 340	2972	7f344b6970fedee87457d737d4d3e1b2986b126357317e7e595bdd973410e540.exe	102
PID 2972 wrote to memory of 340	2972	7f344b6970fedee87457d737d4d3e1b2986b126357317e7e595bdd973410e540.exe	102
PID 2972 wrote to memory of 5084	2972	7f344b6970fedee87457d737d4d3e1b2986b126357317e7e595bdd973410e540.exe	103
PID 2972 wrote to memory of 5084	2972	7f344b6970fedee87457d737d4d3e1b2986b126357317e7e595bdd973410e540.exe	103
PID 2972 wrote to memory of 3548	2972	7f344b6970fedee87457d737d4d3e1b2986b126357317e7e595bdd973410e540.exe	104
PID 2972 wrote to memory of 3548	2972	7f344b6970fedee87457d737d4d3e1b2986b126357317e7e595bdd973410e540.exe	104
PID 2972 wrote to memory of 4468	2972	7f344b6970fedee87457d737d4d3e1b2986b126357317e7e595bdd973410e540.exe	105
PID 2972 wrote to memory of 4468	2972	7f344b6970fedee87457d737d4d3e1b2986b126357317e7e595bdd973410e540.exe	105
PID 2972 wrote to memory of 628	2972	7f344b6970fedee87457d737d4d3e1b2986b126357317e7e595bdd973410e540.exe	106
PID 2972 wrote to memory of 628	2972	7f344b6970fedee87457d737d4d3e1b2986b126357317e7e595bdd973410e540.exe	106
PID 2972 wrote to memory of 4780	2972	7f344b6970fedee87457d737d4d3e1b2986b126357317e7e595bdd973410e540.exe	107
PID 2972 wrote to memory of 4780	2972	7f344b6970fedee87457d737d4d3e1b2986b126357317e7e595bdd973410e540.exe	107
PID 2972 wrote to memory of 4472	2972	7f344b6970fedee87457d737d4d3e1b2986b126357317e7e595bdd973410e540.exe	108
PID 2972 wrote to memory of 4472	2972	7f344b6970fedee87457d737d4d3e1b2986b126357317e7e595bdd973410e540.exe	108
PID 2972 wrote to memory of 4368	2972	7f344b6970fedee87457d737d4d3e1b2986b126357317e7e595bdd973410e540.exe	109
PID 2972 wrote to memory of 4368	2972	7f344b6970fedee87457d737d4d3e1b2986b126357317e7e595bdd973410e540.exe	109
PID 2972 wrote to memory of 4848	2972	7f344b6970fedee87457d737d4d3e1b2986b126357317e7e595bdd973410e540.exe	110
PID 2972 wrote to memory of 4848	2972	7f344b6970fedee87457d737d4d3e1b2986b126357317e7e595bdd973410e540.exe	110
PID 2972 wrote to memory of 4008	2972	7f344b6970fedee87457d737d4d3e1b2986b126357317e7e595bdd973410e540.exe	111
PID 2972 wrote to memory of 4008	2972	7f344b6970fedee87457d737d4d3e1b2986b126357317e7e595bdd973410e540.exe	111
PID 2972 wrote to memory of 2604	2972	7f344b6970fedee87457d737d4d3e1b2986b126357317e7e595bdd973410e540.exe	112
PID 2972 wrote to memory of 2604	2972	7f344b6970fedee87457d737d4d3e1b2986b126357317e7e595bdd973410e540.exe	112
PID 2972 wrote to memory of 4884	2972	7f344b6970fedee87457d737d4d3e1b2986b126357317e7e595bdd973410e540.exe	113
PID 2972 wrote to memory of 4884	2972	7f344b6970fedee87457d737d4d3e1b2986b126357317e7e595bdd973410e540.exe	113
PID 2972 wrote to memory of 2900	2972	7f344b6970fedee87457d737d4d3e1b2986b126357317e7e595bdd973410e540.exe	114
PID 2972 wrote to memory of 2900	2972	7f344b6970fedee87457d737d4d3e1b2986b126357317e7e595bdd973410e540.exe	114
PID 2972 wrote to memory of 312	2972	7f344b6970fedee87457d737d4d3e1b2986b126357317e7e595bdd973410e540.exe	115
PID 2972 wrote to memory of 312	2972	7f344b6970fedee87457d737d4d3e1b2986b126357317e7e595bdd973410e540.exe	115

C:\Users\Admin\AppData\Local\Temp\7f344b6970fedee87457d737d4d3e1b2986b126357317e7e595bdd973410e540.exe
"C:\Users\Admin\AppData\Local\Temp\7f344b6970fedee87457d737d4d3e1b2986b126357317e7e595bdd973410e540.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2972
- C:\Windows\System\mSOXvZF.exe
  C:\Windows\System\mSOXvZF.exe
  2⤵
  - Executes dropped EXE
  PID:4316
- C:\Windows\System\aLqUFZb.exe
  C:\Windows\System\aLqUFZb.exe
  2⤵
  - Executes dropped EXE
  PID:4048
- C:\Windows\System\zhWyfOF.exe
  C:\Windows\System\zhWyfOF.exe
  2⤵
  - Executes dropped EXE
  PID:3260
- C:\Windows\System\bjJufzi.exe
  C:\Windows\System\bjJufzi.exe
  2⤵
  - Executes dropped EXE
  PID:4044
- C:\Windows\System\ijPTbRQ.exe
  C:\Windows\System\ijPTbRQ.exe
  2⤵
  - Executes dropped EXE
  PID:2860
- C:\Windows\System\YxrZDNt.exe
  C:\Windows\System\YxrZDNt.exe
  2⤵
  - Executes dropped EXE
  PID:5040
- C:\Windows\System\zZTvMdO.exe
  C:\Windows\System\zZTvMdO.exe
  2⤵
  - Executes dropped EXE
  PID:1148
- C:\Windows\System\uBioFAx.exe
  C:\Windows\System\uBioFAx.exe
  2⤵
  - Executes dropped EXE
  PID:3984
- C:\Windows\System\fbYfCED.exe
  C:\Windows\System\fbYfCED.exe
  2⤵
  - Executes dropped EXE
  PID:5000
- C:\Windows\System\XwKqHJu.exe
  C:\Windows\System\XwKqHJu.exe
  2⤵
  - Executes dropped EXE
  PID:640
- C:\Windows\System\bDosXtZ.exe
  C:\Windows\System\bDosXtZ.exe
  2⤵
  - Executes dropped EXE
  PID:4996
- C:\Windows\System\yXcrRnF.exe
  C:\Windows\System\yXcrRnF.exe
  2⤵
  - Executes dropped EXE
  PID:2152
- C:\Windows\System\CMrzWai.exe
  C:\Windows\System\CMrzWai.exe
  2⤵
  - Executes dropped EXE
  PID:2836
- C:\Windows\System\LkPokxw.exe
  C:\Windows\System\LkPokxw.exe
  2⤵
  - Executes dropped EXE
  PID:1420
- C:\Windows\System\PQvcVJe.exe
  C:\Windows\System\PQvcVJe.exe
  2⤵
  - Executes dropped EXE
  PID:4732
- C:\Windows\System\NYzBTzR.exe
  C:\Windows\System\NYzBTzR.exe
  2⤵
  - Executes dropped EXE
  PID:2560
- C:\Windows\System\GhKsQUL.exe
  C:\Windows\System\GhKsQUL.exe
  2⤵
  - Executes dropped EXE
  PID:4144
- C:\Windows\System\zKOGlCm.exe
  C:\Windows\System\zKOGlCm.exe
  2⤵
  - Executes dropped EXE
  PID:3044
- C:\Windows\System\EbkWoCl.exe
  C:\Windows\System\EbkWoCl.exe
  2⤵
  - Executes dropped EXE
  PID:340
- C:\Windows\System\oSkHoMH.exe
  C:\Windows\System\oSkHoMH.exe
  2⤵
  - Executes dropped EXE
  PID:5084
- C:\Windows\System\tFXMNoY.exe
  C:\Windows\System\tFXMNoY.exe
  2⤵
  - Executes dropped EXE
  PID:3548
- C:\Windows\System\ZZkiqtc.exe
  C:\Windows\System\ZZkiqtc.exe
  2⤵
  - Executes dropped EXE
  PID:4468
- C:\Windows\System\FTpMfly.exe
  C:\Windows\System\FTpMfly.exe
  2⤵
  - Executes dropped EXE
  PID:628
- C:\Windows\System\BFJSJGA.exe
  C:\Windows\System\BFJSJGA.exe
  2⤵
  - Executes dropped EXE
  PID:4780
- C:\Windows\System\BpanyIN.exe
  C:\Windows\System\BpanyIN.exe
  2⤵
  - Executes dropped EXE
  PID:4472
- C:\Windows\System\GrVUXMz.exe
  C:\Windows\System\GrVUXMz.exe
  2⤵
  - Executes dropped EXE
  PID:4368
- C:\Windows\System\ErIDeAw.exe
  C:\Windows\System\ErIDeAw.exe
  2⤵
  - Executes dropped EXE
  PID:4848
- C:\Windows\System\xChkJCv.exe
  C:\Windows\System\xChkJCv.exe
  2⤵
  - Executes dropped EXE
  PID:4008
- C:\Windows\System\NOliLUh.exe
  C:\Windows\System\NOliLUh.exe
  2⤵
  - Executes dropped EXE
  PID:2604
- C:\Windows\System\cQAifJG.exe
  C:\Windows\System\cQAifJG.exe
  2⤵
  - Executes dropped EXE
  PID:4884
- C:\Windows\System\dwGEMrk.exe
  C:\Windows\System\dwGEMrk.exe
  2⤵
  - Executes dropped EXE
  PID:2900
- C:\Windows\System\XqwuiGz.exe
  C:\Windows\System\XqwuiGz.exe
  2⤵
  - Executes dropped EXE
  PID:312
- C:\Windows\System\cmMFiTk.exe
  C:\Windows\System\cmMFiTk.exe
  2⤵
  - Executes dropped EXE
  PID:1920
- C:\Windows\System\IQZYqHB.exe
  C:\Windows\System\IQZYqHB.exe
  2⤵
  - Executes dropped EXE
  PID:4348
- C:\Windows\System\pGqwpSR.exe
  C:\Windows\System\pGqwpSR.exe
  2⤵
  - Executes dropped EXE
  PID:1200
- C:\Windows\System\bYDbJyu.exe
  C:\Windows\System\bYDbJyu.exe
  2⤵
  - Executes dropped EXE
  PID:4872
- C:\Windows\System\KHNdVkL.exe
  C:\Windows\System\KHNdVkL.exe
  2⤵
  - Executes dropped EXE
  PID:4312
- C:\Windows\System\IIxxxrq.exe
  C:\Windows\System\IIxxxrq.exe
  2⤵
  - Executes dropped EXE
  PID:2196
- C:\Windows\System\WKvAXhX.exe
  C:\Windows\System\WKvAXhX.exe
  2⤵
  - Executes dropped EXE
  PID:1812
- C:\Windows\System\lLaHXXl.exe
  C:\Windows\System\lLaHXXl.exe
  2⤵
  - Executes dropped EXE
  PID:1316
- C:\Windows\System\GsTrtdM.exe
  C:\Windows\System\GsTrtdM.exe
  2⤵
  - Executes dropped EXE
  PID:3208
- C:\Windows\System\yGubfFP.exe
  C:\Windows\System\yGubfFP.exe
  2⤵
  - Executes dropped EXE
  PID:3132
- C:\Windows\System\zJgrcYv.exe
  C:\Windows\System\zJgrcYv.exe
  2⤵
  - Executes dropped EXE
  PID:3840
- C:\Windows\System\AnGmcjV.exe
  C:\Windows\System\AnGmcjV.exe
  2⤵
  - Executes dropped EXE
  PID:1684
- C:\Windows\System\OIPaZcO.exe
  C:\Windows\System\OIPaZcO.exe
  2⤵
  - Executes dropped EXE
  PID:3000
- C:\Windows\System\LiNUevO.exe
  C:\Windows\System\LiNUevO.exe
  2⤵
  - Executes dropped EXE
  PID:2892
- C:\Windows\System\pleKHpN.exe
  C:\Windows\System\pleKHpN.exe
  2⤵
  - Executes dropped EXE
  PID:1744
- C:\Windows\System\ybkOdyR.exe
  C:\Windows\System\ybkOdyR.exe
  2⤵
  - Executes dropped EXE
  PID:3620
- C:\Windows\System\CqEEQaL.exe
  C:\Windows\System\CqEEQaL.exe
  2⤵
  - Executes dropped EXE
  PID:4824
- C:\Windows\System\CKdIQKd.exe
  C:\Windows\System\CKdIQKd.exe
  2⤵
  - Executes dropped EXE
  PID:2424
- C:\Windows\System\JtGUQRw.exe
  C:\Windows\System\JtGUQRw.exe
  2⤵
  - Executes dropped EXE
  PID:696
- C:\Windows\System\vymHFcg.exe
  C:\Windows\System\vymHFcg.exe
  2⤵
  - Executes dropped EXE
  PID:2044
- C:\Windows\System\CytePqI.exe
  C:\Windows\System\CytePqI.exe
  2⤵
  - Executes dropped EXE
  PID:2236
- C:\Windows\System\DGVAdMG.exe
  C:\Windows\System\DGVAdMG.exe
  2⤵
  - Executes dropped EXE
  PID:4800
- C:\Windows\System\qhWiEED.exe
  C:\Windows\System\qhWiEED.exe
  2⤵
  - Executes dropped EXE
  PID:4720
- C:\Windows\System\GymLMPl.exe
  C:\Windows\System\GymLMPl.exe
  2⤵
  - Executes dropped EXE
  PID:4392
- C:\Windows\System\BMrOpRZ.exe
  C:\Windows\System\BMrOpRZ.exe
  2⤵
  - Executes dropped EXE
  PID:1204
- C:\Windows\System\lecEiSt.exe
  C:\Windows\System\lecEiSt.exe
  2⤵
  - Executes dropped EXE
  PID:4920
- C:\Windows\System\vRnZChf.exe
  C:\Windows\System\vRnZChf.exe
  2⤵
  - Executes dropped EXE
  PID:516
- C:\Windows\System\jIIioul.exe
  C:\Windows\System\jIIioul.exe
  2⤵
  - Executes dropped EXE
  PID:3784
- C:\Windows\System\CqCTjgf.exe
  C:\Windows\System\CqCTjgf.exe
  2⤵
  - Executes dropped EXE
  PID:1520
- C:\Windows\System\vqqXHZN.exe
  C:\Windows\System\vqqXHZN.exe
  2⤵
  - Executes dropped EXE
  PID:4816
- C:\Windows\System\MWMETnQ.exe
  C:\Windows\System\MWMETnQ.exe
  2⤵
  - Executes dropped EXE
  PID:668
- C:\Windows\System\titrwZY.exe
  C:\Windows\System\titrwZY.exe
  2⤵
  - Executes dropped EXE
  PID:3176
- C:\Windows\System\AWCwQeS.exe
  C:\Windows\System\AWCwQeS.exe
  2⤵
  PID:316
- C:\Windows\System\WJieiyL.exe
  C:\Windows\System\WJieiyL.exe
  2⤵
  PID:3244
- C:\Windows\System\QQExlfO.exe
  C:\Windows\System\QQExlfO.exe
  2⤵
  PID:1104
- C:\Windows\System\sJdlber.exe
  C:\Windows\System\sJdlber.exe
  2⤵
  PID:4536
- C:\Windows\System\sbpUkeq.exe
  C:\Windows\System\sbpUkeq.exe
  2⤵
  PID:4588
- C:\Windows\System\hIinGCR.exe
  C:\Windows\System\hIinGCR.exe
  2⤵
  PID:2500
- C:\Windows\System\xaXlFlI.exe
  C:\Windows\System\xaXlFlI.exe
  2⤵
  PID:1672
- C:\Windows\System\TfiydBD.exe
  C:\Windows\System\TfiydBD.exe
  2⤵
  PID:1416
- C:\Windows\System\AOXOKjk.exe
  C:\Windows\System\AOXOKjk.exe
  2⤵
  PID:1376
- C:\Windows\System\NLdqOzW.exe
  C:\Windows\System\NLdqOzW.exe
  2⤵
  PID:2692
- C:\Windows\System\xaZrmcx.exe
  C:\Windows\System\xaZrmcx.exe
  2⤵
  PID:384
- C:\Windows\System\xXmFmSt.exe
  C:\Windows\System\xXmFmSt.exe
  2⤵
  PID:3484
- C:\Windows\System\dlaTXHD.exe
  C:\Windows\System\dlaTXHD.exe
  2⤵
  PID:1052
- C:\Windows\System\KRbfwaS.exe
  C:\Windows\System\KRbfwaS.exe
  2⤵
  PID:5096
- C:\Windows\System\mnzHGsR.exe
  C:\Windows\System\mnzHGsR.exe
  2⤵
  PID:2124
- C:\Windows\System\NrsVyoa.exe
  C:\Windows\System\NrsVyoa.exe
  2⤵
  PID:2096
- C:\Windows\System\CerUqDL.exe
  C:\Windows\System\CerUqDL.exe
  2⤵
  PID:1496
- C:\Windows\System\UFUXWST.exe
  C:\Windows\System\UFUXWST.exe
  2⤵
  PID:1988
- C:\Windows\System\EKDiHAV.exe
  C:\Windows\System\EKDiHAV.exe
  2⤵
  PID:4768
- C:\Windows\System\xQeOWnZ.exe
  C:\Windows\System\xQeOWnZ.exe
  2⤵
  PID:4820
- C:\Windows\System\HVekUKK.exe
  C:\Windows\System\HVekUKK.exe
  2⤵
  PID:3892
- C:\Windows\System\wdTOmwr.exe
  C:\Windows\System\wdTOmwr.exe
  2⤵
  PID:3016
- C:\Windows\System\qXrimwQ.exe
  C:\Windows\System\qXrimwQ.exe
  2⤵
  PID:4052
- C:\Windows\System\exobgdU.exe
  C:\Windows\System\exobgdU.exe
  2⤵
  PID:328
- C:\Windows\System\SqGVjJa.exe
  C:\Windows\System\SqGVjJa.exe
  2⤵
  PID:4988
- C:\Windows\System\qAkwSkC.exe
  C:\Windows\System\qAkwSkC.exe
  2⤵
  PID:4420
- C:\Windows\System\QMhuhhf.exe
  C:\Windows\System\QMhuhhf.exe
  2⤵
  PID:3616
- C:\Windows\System\HcPyQzf.exe
  C:\Windows\System\HcPyQzf.exe
  2⤵
  PID:2508
- C:\Windows\System\lRDJvwM.exe
  C:\Windows\System\lRDJvwM.exe
  2⤵
  PID:2484
- C:\Windows\System\CMaQRSl.exe
  C:\Windows\System\CMaQRSl.exe
  2⤵
  PID:984
- C:\Windows\System\FQKJmwi.exe
  C:\Windows\System\FQKJmwi.exe
  2⤵
  PID:5140
- C:\Windows\System\POrMXIk.exe
  C:\Windows\System\POrMXIk.exe
  2⤵
  PID:5168
- C:\Windows\System\lXsZHBe.exe
  C:\Windows\System\lXsZHBe.exe
  2⤵
  PID:5196
- C:\Windows\System\QqNeUTF.exe
  C:\Windows\System\QqNeUTF.exe
  2⤵
  PID:5224
- C:\Windows\System\mnoEXBn.exe
  C:\Windows\System\mnoEXBn.exe
  2⤵
  PID:5252
- C:\Windows\System\aryUYfH.exe
  C:\Windows\System\aryUYfH.exe
  2⤵
  PID:5276
- C:\Windows\System\yKdUsZs.exe
  C:\Windows\System\yKdUsZs.exe
  2⤵
  PID:5308
- C:\Windows\System\DvWSjyq.exe
  C:\Windows\System\DvWSjyq.exe
  2⤵
  PID:5336
- C:\Windows\System\gCIzNkX.exe
  C:\Windows\System\gCIzNkX.exe
  2⤵
  PID:5364
- C:\Windows\System\ebGdPPY.exe
  C:\Windows\System\ebGdPPY.exe
  2⤵
  PID:5392
- C:\Windows\System\omrDDfD.exe
  C:\Windows\System\omrDDfD.exe
  2⤵
  PID:5420
- C:\Windows\System\JwvJYqG.exe
  C:\Windows\System\JwvJYqG.exe
  2⤵
  PID:5448
- C:\Windows\System\fmjIxzH.exe
  C:\Windows\System\fmjIxzH.exe
  2⤵
  PID:5476
- C:\Windows\System\oBwRSlu.exe
  C:\Windows\System\oBwRSlu.exe
  2⤵
  PID:5504
- C:\Windows\System\UfPKCzc.exe
  C:\Windows\System\UfPKCzc.exe
  2⤵
  PID:5528
- C:\Windows\System\DepLXQW.exe
  C:\Windows\System\DepLXQW.exe
  2⤵
  PID:5560
- C:\Windows\System\yUlHAeJ.exe
  C:\Windows\System\yUlHAeJ.exe
  2⤵
  PID:5588
- C:\Windows\System\NajYrzA.exe
  C:\Windows\System\NajYrzA.exe
  2⤵
  PID:5616
- C:\Windows\System\trkiyCb.exe
  C:\Windows\System\trkiyCb.exe
  2⤵
  PID:5644
- C:\Windows\System\riIlNYb.exe
  C:\Windows\System\riIlNYb.exe
  2⤵
  PID:5672
- C:\Windows\System\NdBAHdl.exe
  C:\Windows\System\NdBAHdl.exe
  2⤵
  PID:5700
- C:\Windows\System\TAfhyUG.exe
  C:\Windows\System\TAfhyUG.exe
  2⤵
  PID:5728
- C:\Windows\System\eWHINcC.exe
  C:\Windows\System\eWHINcC.exe
  2⤵
  PID:5756
- C:\Windows\System\xTnrMEB.exe
  C:\Windows\System\xTnrMEB.exe
  2⤵
  PID:5784
- C:\Windows\System\IrpUNFz.exe
  C:\Windows\System\IrpUNFz.exe
  2⤵
  PID:5812
- C:\Windows\System\PQAVzxT.exe
  C:\Windows\System\PQAVzxT.exe
  2⤵
  PID:5840
- C:\Windows\System\iMkFUdI.exe
  C:\Windows\System\iMkFUdI.exe
  2⤵
  PID:5868
- C:\Windows\System\byOmUbD.exe
  C:\Windows\System\byOmUbD.exe
  2⤵
  PID:5896
- C:\Windows\System\NZCSgTN.exe
  C:\Windows\System\NZCSgTN.exe
  2⤵
  PID:5928
- C:\Windows\System\awHUhfL.exe
  C:\Windows\System\awHUhfL.exe
  2⤵
  PID:5952
- C:\Windows\System\NncmDST.exe
  C:\Windows\System\NncmDST.exe
  2⤵
  PID:5980
- C:\Windows\System\uAEGqVF.exe
  C:\Windows\System\uAEGqVF.exe
  2⤵
  PID:6008
- C:\Windows\System\MGEAtte.exe
  C:\Windows\System\MGEAtte.exe
  2⤵
  PID:6036
- C:\Windows\System\HGdPDUw.exe
  C:\Windows\System\HGdPDUw.exe
  2⤵
  PID:6064
- C:\Windows\System\nTJLxdr.exe
  C:\Windows\System\nTJLxdr.exe
  2⤵
  PID:6092
- C:\Windows\System\FEKPRUA.exe
  C:\Windows\System\FEKPRUA.exe
  2⤵
  PID:6120
- C:\Windows\System\QiGsQlQ.exe
  C:\Windows\System\QiGsQlQ.exe
  2⤵
  PID:2948
- C:\Windows\System\KZSttcA.exe
  C:\Windows\System\KZSttcA.exe
  2⤵
  PID:4408
- C:\Windows\System\yRihFEa.exe
  C:\Windows\System\yRihFEa.exe
  2⤵
  PID:2620
- C:\Windows\System\DjjqQKK.exe
  C:\Windows\System\DjjqQKK.exe
  2⤵
  PID:116
- C:\Windows\System\PZlhJDe.exe
  C:\Windows\System\PZlhJDe.exe
  2⤵
  PID:3228
- C:\Windows\System\PpiEuvk.exe
  C:\Windows\System\PpiEuvk.exe
  2⤵
  PID:2480
- C:\Windows\System\mWzudgV.exe
  C:\Windows\System\mWzudgV.exe
  2⤵
  PID:5128
- C:\Windows\System\jgkmRcw.exe
  C:\Windows\System\jgkmRcw.exe
  2⤵
  PID:5188
- C:\Windows\System\PLyWNjQ.exe
  C:\Windows\System\PLyWNjQ.exe
  2⤵
  PID:5264
- C:\Windows\System\aDRlart.exe
  C:\Windows\System\aDRlart.exe
  2⤵
  PID:5324
- C:\Windows\System\TWmOYZy.exe
  C:\Windows\System\TWmOYZy.exe
  2⤵
  PID:5384
- C:\Windows\System\GHEbvbJ.exe
  C:\Windows\System\GHEbvbJ.exe
  2⤵
  PID:5460
- C:\Windows\System\tPxfXGM.exe
  C:\Windows\System\tPxfXGM.exe
  2⤵
  PID:5516
- C:\Windows\System\NKUFiJY.exe
  C:\Windows\System\NKUFiJY.exe
  2⤵
  PID:5572
- C:\Windows\System\sPfNIgX.exe
  C:\Windows\System\sPfNIgX.exe
  2⤵
  PID:5628
- C:\Windows\System\wjzrUia.exe
  C:\Windows\System\wjzrUia.exe
  2⤵
  PID:5688
- C:\Windows\System\jfnSIKk.exe
  C:\Windows\System\jfnSIKk.exe
  2⤵
  PID:5748
- C:\Windows\System\IiKXwNz.exe
  C:\Windows\System\IiKXwNz.exe
  2⤵
  PID:5804
- C:\Windows\System\hAOiMEv.exe
  C:\Windows\System\hAOiMEv.exe
  2⤵
  PID:5856
- C:\Windows\System\UWQcYqb.exe
  C:\Windows\System\UWQcYqb.exe
  2⤵
  PID:5908
- C:\Windows\System\UjTZwMC.exe
  C:\Windows\System\UjTZwMC.exe
  2⤵
  PID:5964
- C:\Windows\System\nwnANuG.exe
  C:\Windows\System\nwnANuG.exe
  2⤵
  PID:6024
- C:\Windows\System\jkVJcty.exe
  C:\Windows\System\jkVJcty.exe
  2⤵
  PID:6104
- C:\Windows\System\CMUgSNb.exe
  C:\Windows\System\CMUgSNb.exe
  2⤵
  PID:3096
- C:\Windows\System\MweddUw.exe
  C:\Windows\System\MweddUw.exe
  2⤵
  PID:2920
- C:\Windows\System\XKEFGbz.exe
  C:\Windows\System\XKEFGbz.exe
  2⤵
  PID:1280
- C:\Windows\System\IHmjYbM.exe
  C:\Windows\System\IHmjYbM.exe
  2⤵
  PID:5216
- C:\Windows\System\dkdrOhH.exe
  C:\Windows\System\dkdrOhH.exe
  2⤵
  PID:5412
- C:\Windows\System\zdBIXLg.exe
  C:\Windows\System\zdBIXLg.exe
  2⤵
  PID:3200
- C:\Windows\System\HlRitDL.exe
  C:\Windows\System\HlRitDL.exe
  2⤵
  PID:5540
- C:\Windows\System\zgmiHCr.exe
  C:\Windows\System\zgmiHCr.exe
  2⤵
  PID:3716
- C:\Windows\System\KTBLrXU.exe
  C:\Windows\System\KTBLrXU.exe
  2⤵
  PID:5716
- C:\Windows\System\WenLvmn.exe
  C:\Windows\System\WenLvmn.exe
  2⤵
  PID:5796
- C:\Windows\System\jeubaSI.exe
  C:\Windows\System\jeubaSI.exe
  2⤵
  PID:1924
- C:\Windows\System\xrpXgLr.exe
  C:\Windows\System\xrpXgLr.exe
  2⤵
  PID:5944
- C:\Windows\System\MfuAEvf.exe
  C:\Windows\System\MfuAEvf.exe
  2⤵
  PID:760
- C:\Windows\System\LSMYDdv.exe
  C:\Windows\System\LSMYDdv.exe
  2⤵
  PID:3556
- C:\Windows\System\CJyzRni.exe
  C:\Windows\System\CJyzRni.exe
  2⤵
  PID:3668
- C:\Windows\System\WAMYjHF.exe
  C:\Windows\System\WAMYjHF.exe
  2⤵
  PID:4084
- C:\Windows\System\AdsCCIn.exe
  C:\Windows\System\AdsCCIn.exe
  2⤵
  PID:3196
- C:\Windows\System\yzGRLrl.exe
  C:\Windows\System\yzGRLrl.exe
  2⤵
  PID:5436
- C:\Windows\System\RQAeExg.exe
  C:\Windows\System\RQAeExg.exe
  2⤵
  PID:3268
- C:\Windows\System\SxzlgvU.exe
  C:\Windows\System\SxzlgvU.exe
  2⤵
  PID:5824
- C:\Windows\System\bSosEDr.exe
  C:\Windows\System\bSosEDr.exe
  2⤵
  PID:3460
- C:\Windows\System\UIiyzNg.exe
  C:\Windows\System\UIiyzNg.exe
  2⤵
  PID:5156
- C:\Windows\System\uvRhxFK.exe
  C:\Windows\System\uvRhxFK.exe
  2⤵
  PID:4576
- C:\Windows\System\hiaWkdI.exe
  C:\Windows\System\hiaWkdI.exe
  2⤵
  PID:6136
- C:\Windows\System\uVvtLaz.exe
  C:\Windows\System\uVvtLaz.exe
  2⤵
  PID:1048
- C:\Windows\System\LUJAwuR.exe
  C:\Windows\System\LUJAwuR.exe
  2⤵
  PID:3288
- C:\Windows\System\cPTQHfA.exe
  C:\Windows\System\cPTQHfA.exe
  2⤵
  PID:6168
- C:\Windows\System\IkNkXbO.exe
  C:\Windows\System\IkNkXbO.exe
  2⤵
  PID:6196
- C:\Windows\System\jEXPyWA.exe
  C:\Windows\System\jEXPyWA.exe
  2⤵
  PID:6224
- C:\Windows\System\zpZZAVX.exe
  C:\Windows\System\zpZZAVX.exe
  2⤵
  PID:6252
- C:\Windows\System\rQPNQIG.exe
  C:\Windows\System\rQPNQIG.exe
  2⤵
  PID:6292
- C:\Windows\System\EsTiTde.exe
  C:\Windows\System\EsTiTde.exe
  2⤵
  PID:6308
- C:\Windows\System\LiXTewG.exe
  C:\Windows\System\LiXTewG.exe
  2⤵
  PID:6348
- C:\Windows\System\bIKzuSR.exe
  C:\Windows\System\bIKzuSR.exe
  2⤵
  PID:6364
- C:\Windows\System\WZJkUGh.exe
  C:\Windows\System\WZJkUGh.exe
  2⤵
  PID:6392
- C:\Windows\System\oCDkdkQ.exe
  C:\Windows\System\oCDkdkQ.exe
  2⤵
  PID:6432
- C:\Windows\System\pjcSYMm.exe
  C:\Windows\System\pjcSYMm.exe
  2⤵
  PID:6448
- C:\Windows\System\wPKRRCV.exe
  C:\Windows\System\wPKRRCV.exe
  2⤵
  PID:6476
- C:\Windows\System\hMeOEjy.exe
  C:\Windows\System\hMeOEjy.exe
  2⤵
  PID:6516
- C:\Windows\System\McSTpgN.exe
  C:\Windows\System\McSTpgN.exe
  2⤵
  PID:6532
- C:\Windows\System\obuhwLQ.exe
  C:\Windows\System\obuhwLQ.exe
  2⤵
  PID:6556
- C:\Windows\System\TrRvszV.exe
  C:\Windows\System\TrRvszV.exe
  2⤵
  PID:6576
- C:\Windows\System\lEKrTxF.exe
  C:\Windows\System\lEKrTxF.exe
  2⤵
  PID:6616
- C:\Windows\System\KuoeMWU.exe
  C:\Windows\System\KuoeMWU.exe
  2⤵
  PID:6632
- C:\Windows\System\uYRzNlq.exe
  C:\Windows\System\uYRzNlq.exe
  2⤵
  PID:6672
- C:\Windows\System\PTtTEgU.exe
  C:\Windows\System\PTtTEgU.exe
  2⤵
  PID:6704
- C:\Windows\System\KwuSYmz.exe
  C:\Windows\System\KwuSYmz.exe
  2⤵
  PID:6728
- C:\Windows\System\dryEzYx.exe
  C:\Windows\System\dryEzYx.exe
  2⤵
  PID:6752
- C:\Windows\System\vMwmbjY.exe
  C:\Windows\System\vMwmbjY.exe
  2⤵
  PID:6796
- C:\Windows\System\cujAGzp.exe
  C:\Windows\System\cujAGzp.exe
  2⤵
  PID:6824
- C:\Windows\System\MIiqljh.exe
  C:\Windows\System\MIiqljh.exe
  2⤵
  PID:6840
- C:\Windows\System\IoqSLbv.exe
  C:\Windows\System\IoqSLbv.exe
  2⤵
  PID:6856
- C:\Windows\System\jyMoaqr.exe
  C:\Windows\System\jyMoaqr.exe
  2⤵
  PID:6908
- C:\Windows\System\KjhNCCo.exe
  C:\Windows\System\KjhNCCo.exe
  2⤵
  PID:6936
- C:\Windows\System\sLdQLHl.exe
  C:\Windows\System\sLdQLHl.exe
  2⤵
  PID:6956
- C:\Windows\System\emMzVIc.exe
  C:\Windows\System\emMzVIc.exe
  2⤵
  PID:6976
- C:\Windows\System\vHLkTaP.exe
  C:\Windows\System\vHLkTaP.exe
  2⤵
  PID:7008
- C:\Windows\System\lAnapJI.exe
  C:\Windows\System\lAnapJI.exe
  2⤵
  PID:7024
- C:\Windows\System\jBZhoFF.exe
  C:\Windows\System\jBZhoFF.exe
  2⤵
  PID:7064
- C:\Windows\System\tJihNYy.exe
  C:\Windows\System\tJihNYy.exe
  2⤵
  PID:7084
- C:\Windows\System\ynUniCC.exe
  C:\Windows\System\ynUniCC.exe
  2⤵
  PID:7116
- C:\Windows\System\rQYmVsc.exe
  C:\Windows\System\rQYmVsc.exe
  2⤵
  PID:7136
- C:\Windows\System\LRSlKvO.exe
  C:\Windows\System\LRSlKvO.exe
  2⤵
  PID:7152
- C:\Windows\System\Cvxbscn.exe
  C:\Windows\System\Cvxbscn.exe
  2⤵
  PID:6156
- C:\Windows\System\sLbDMry.exe
  C:\Windows\System\sLbDMry.exe
  2⤵
  PID:6208
- C:\Windows\System\qawvrDH.exe
  C:\Windows\System\qawvrDH.exe
  2⤵
  PID:6300
- C:\Windows\System\cxDGrKX.exe
  C:\Windows\System\cxDGrKX.exe
  2⤵
  PID:6360
- C:\Windows\System\OElZOAr.exe
  C:\Windows\System\OElZOAr.exe
  2⤵
  PID:6440
- C:\Windows\System\aYmNKKG.exe
  C:\Windows\System\aYmNKKG.exe
  2⤵
  PID:6528
- C:\Windows\System\HeOQvxH.exe
  C:\Windows\System\HeOQvxH.exe
  2⤵
  PID:6572
- C:\Windows\System\BLozUGF.exe
  C:\Windows\System\BLozUGF.exe
  2⤵
  PID:6668
- C:\Windows\System\mxxlfap.exe
  C:\Windows\System\mxxlfap.exe
  2⤵
  PID:6692
- C:\Windows\System\gHRMnUF.exe
  C:\Windows\System\gHRMnUF.exe
  2⤵
  PID:6764
- C:\Windows\System\wclKfiQ.exe
  C:\Windows\System\wclKfiQ.exe
  2⤵
  PID:6832
- C:\Windows\System\lvJUXdR.exe
  C:\Windows\System\lvJUXdR.exe
  2⤵
  PID:6920
- C:\Windows\System\fElOZxl.exe
  C:\Windows\System\fElOZxl.exe
  2⤵
  PID:7020
- C:\Windows\System\FsYzBzX.exe
  C:\Windows\System\FsYzBzX.exe
  2⤵
  PID:7048
- C:\Windows\System\UXVygyj.exe
  C:\Windows\System\UXVygyj.exe
  2⤵
  PID:7124
- C:\Windows\System\MuWZAZa.exe
  C:\Windows\System\MuWZAZa.exe
  2⤵
  PID:7144
- C:\Windows\System\qXgPDKM.exe
  C:\Windows\System\qXgPDKM.exe
  2⤵
  PID:6216
- C:\Windows\System\ypSkejb.exe
  C:\Windows\System\ypSkejb.exe
  2⤵
  PID:6444
- C:\Windows\System\luGtrPp.exe
  C:\Windows\System\luGtrPp.exe
  2⤵
  PID:6696
- C:\Windows\System\DrnspIu.exe
  C:\Windows\System\DrnspIu.exe
  2⤵
  PID:6624
- C:\Windows\System\nFrsoAr.exe
  C:\Windows\System\nFrsoAr.exe
  2⤵
  PID:6968
- C:\Windows\System\lvRTYuf.exe
  C:\Windows\System\lvRTYuf.exe
  2⤵
  PID:6356
- C:\Windows\System\zQGnmij.exe
  C:\Windows\System\zQGnmij.exe
  2⤵
  PID:6268
- C:\Windows\System\CIEvBAC.exe
  C:\Windows\System\CIEvBAC.exe
  2⤵
  PID:6808
- C:\Windows\System\PYboIiI.exe
  C:\Windows\System\PYboIiI.exe
  2⤵
  PID:6780
- C:\Windows\System\VPaBfCm.exe
  C:\Windows\System\VPaBfCm.exe
  2⤵
  PID:7172
- C:\Windows\System\taQkeri.exe
  C:\Windows\System\taQkeri.exe
  2⤵
  PID:7192
- C:\Windows\System\uyYtDhK.exe
  C:\Windows\System\uyYtDhK.exe
  2⤵
  PID:7212
- C:\Windows\System\mpzEjCw.exe
  C:\Windows\System\mpzEjCw.exe
  2⤵
  PID:7248
- C:\Windows\System\TluqQos.exe
  C:\Windows\System\TluqQos.exe
  2⤵
  PID:7300
- C:\Windows\System\GgcLvsr.exe
  C:\Windows\System\GgcLvsr.exe
  2⤵
  PID:7328
- C:\Windows\System\PvqeWzX.exe
  C:\Windows\System\PvqeWzX.exe
  2⤵
  PID:7344
- C:\Windows\System\ExpAIvV.exe
  C:\Windows\System\ExpAIvV.exe
  2⤵
  PID:7360
- C:\Windows\System\LQIAueU.exe
  C:\Windows\System\LQIAueU.exe
  2⤵
  PID:7376
- C:\Windows\System\PyFvmKX.exe
  C:\Windows\System\PyFvmKX.exe
  2⤵
  PID:7420
- C:\Windows\System\UypaOQv.exe
  C:\Windows\System\UypaOQv.exe
  2⤵
  PID:7448
- C:\Windows\System\VcOmnzk.exe
  C:\Windows\System\VcOmnzk.exe
  2⤵
  PID:7496
- C:\Windows\System\qmbkCYi.exe
  C:\Windows\System\qmbkCYi.exe
  2⤵
  PID:7524
- C:\Windows\System\eVaABpn.exe
  C:\Windows\System\eVaABpn.exe
  2⤵
  PID:7544
- C:\Windows\System\ZhnBuGP.exe
  C:\Windows\System\ZhnBuGP.exe
  2⤵
  PID:7572
- C:\Windows\System\xqtJlJL.exe
  C:\Windows\System\xqtJlJL.exe
  2⤵
  PID:7588
- C:\Windows\System\NUCKteC.exe
  C:\Windows\System\NUCKteC.exe
  2⤵
  PID:7612
- C:\Windows\System\qOEWlbI.exe
  C:\Windows\System\qOEWlbI.exe
  2⤵
  PID:7632
- C:\Windows\System\ORcLTJj.exe
  C:\Windows\System\ORcLTJj.exe
  2⤵
  PID:7652
- C:\Windows\System\WJjGIoB.exe
  C:\Windows\System\WJjGIoB.exe
  2⤵
  PID:7692
- C:\Windows\System\ugadtiG.exe
  C:\Windows\System\ugadtiG.exe
  2⤵
  PID:7720
- C:\Windows\System\gXjWCXH.exe
  C:\Windows\System\gXjWCXH.exe
  2⤵
  PID:7756
- C:\Windows\System\czKskOU.exe
  C:\Windows\System\czKskOU.exe
  2⤵
  PID:7792
- C:\Windows\System\OszsYbm.exe
  C:\Windows\System\OszsYbm.exe
  2⤵
  PID:7832
- C:\Windows\System\HHPtVWn.exe
  C:\Windows\System\HHPtVWn.exe
  2⤵
  PID:7860
- C:\Windows\System\MdhaQzw.exe
  C:\Windows\System\MdhaQzw.exe
  2⤵
  PID:7880
- C:\Windows\System\mdWOHdl.exe
  C:\Windows\System\mdWOHdl.exe
  2⤵
  PID:7912
- C:\Windows\System\dqBhvGr.exe
  C:\Windows\System\dqBhvGr.exe
  2⤵
  PID:7940
- C:\Windows\System\RJKoHHK.exe
  C:\Windows\System\RJKoHHK.exe
  2⤵
  PID:7980
- C:\Windows\System\YPXwhhX.exe
  C:\Windows\System\YPXwhhX.exe
  2⤵
  PID:8016
- C:\Windows\System\WGycSWE.exe
  C:\Windows\System\WGycSWE.exe
  2⤵
  PID:8032
- C:\Windows\System\uVPrBDc.exe
  C:\Windows\System\uVPrBDc.exe
  2⤵
  PID:8068
- C:\Windows\System\tlqrjwr.exe
  C:\Windows\System\tlqrjwr.exe
  2⤵
  PID:8100
- C:\Windows\System\yvStfou.exe
  C:\Windows\System\yvStfou.exe
  2⤵
  PID:8132
- C:\Windows\System\QlddMkb.exe
  C:\Windows\System\QlddMkb.exe
  2⤵
  PID:8160
- C:\Windows\System\AKGjMvv.exe
  C:\Windows\System\AKGjMvv.exe
  2⤵
  PID:8188
- C:\Windows\System\kdpUbkN.exe
  C:\Windows\System\kdpUbkN.exe
  2⤵
  PID:6568
- C:\Windows\System\MuElBye.exe
  C:\Windows\System\MuElBye.exe
  2⤵
  PID:7236
- C:\Windows\System\qBhVVUN.exe
  C:\Windows\System\qBhVVUN.exe
  2⤵
  PID:7296
- C:\Windows\System\GCzOTxk.exe
  C:\Windows\System\GCzOTxk.exe
  2⤵
  PID:7336
- C:\Windows\System\FAjKWBf.exe
  C:\Windows\System\FAjKWBf.exe
  2⤵
  PID:7444
- C:\Windows\System\APdtpmx.exe
  C:\Windows\System\APdtpmx.exe
  2⤵
  PID:7488
- C:\Windows\System\GAUkzPH.exe
  C:\Windows\System\GAUkzPH.exe
  2⤵
  PID:7564
- C:\Windows\System\bnrLBJs.exe
  C:\Windows\System\bnrLBJs.exe
  2⤵
  PID:7620
- C:\Windows\System\DGyLtqs.exe
  C:\Windows\System\DGyLtqs.exe
  2⤵
  PID:7668
- C:\Windows\System\vMdaGaR.exe
  C:\Windows\System\vMdaGaR.exe
  2⤵
  PID:7768
- C:\Windows\System\bTvMlms.exe
  C:\Windows\System\bTvMlms.exe
  2⤵
  PID:7820
- C:\Windows\System\SXbGGES.exe
  C:\Windows\System\SXbGGES.exe
  2⤵
  PID:7936
- C:\Windows\System\dGBNRZg.exe
  C:\Windows\System\dGBNRZg.exe
  2⤵
  PID:8024
- C:\Windows\System\eJQIBok.exe
  C:\Windows\System\eJQIBok.exe
  2⤵
  PID:8084
- C:\Windows\System\wvSiDZq.exe
  C:\Windows\System\wvSiDZq.exe
  2⤵
  PID:8144
- C:\Windows\System\QKFAYoY.exe
  C:\Windows\System\QKFAYoY.exe
  2⤵
  PID:8172
- C:\Windows\System\oBkBZtD.exe
  C:\Windows\System\oBkBZtD.exe
  2⤵
  PID:7264
- C:\Windows\System\BJwTYsr.exe
  C:\Windows\System\BJwTYsr.exe
  2⤵
  PID:7372
- C:\Windows\System\yaCuMuM.exe
  C:\Windows\System\yaCuMuM.exe
  2⤵
  PID:7532
- C:\Windows\System\nySHCEb.exe
  C:\Windows\System\nySHCEb.exe
  2⤵
  PID:7660
- C:\Windows\System\IjfdzaA.exe
  C:\Windows\System\IjfdzaA.exe
  2⤵
  PID:7840
- C:\Windows\System\GzdZfAH.exe
  C:\Windows\System\GzdZfAH.exe
  2⤵
  PID:7992
- C:\Windows\System\iqrIFSU.exe
  C:\Windows\System\iqrIFSU.exe
  2⤵
  PID:8116
- C:\Windows\System\SAqzYZP.exe
  C:\Windows\System\SAqzYZP.exe
  2⤵
  PID:7208
- C:\Windows\System\rYAHTfI.exe
  C:\Windows\System\rYAHTfI.exe
  2⤵
  PID:7816
- C:\Windows\System\cZHNYHz.exe
  C:\Windows\System\cZHNYHz.exe
  2⤵
  PID:7436
- C:\Windows\System\iHXXaDc.exe
  C:\Windows\System\iHXXaDc.exe
  2⤵
  PID:8064
- C:\Windows\System\NkxXUqN.exe
  C:\Windows\System\NkxXUqN.exe
  2⤵
  PID:8208
- C:\Windows\System\XXhxXli.exe
  C:\Windows\System\XXhxXli.exe
  2⤵
  PID:8232
- C:\Windows\System\GSQXFEF.exe
  C:\Windows\System\GSQXFEF.exe
  2⤵
  PID:8264
- C:\Windows\System\BGocSOc.exe
  C:\Windows\System\BGocSOc.exe
  2⤵
  PID:8300
- C:\Windows\System\rgpYIjU.exe
  C:\Windows\System\rgpYIjU.exe
  2⤵
  PID:8328
- C:\Windows\System\kQOVksP.exe
  C:\Windows\System\kQOVksP.exe
  2⤵
  PID:8356
- C:\Windows\System\PwZeomQ.exe
  C:\Windows\System\PwZeomQ.exe
  2⤵
  PID:8376
- C:\Windows\System\WcRmyDD.exe
  C:\Windows\System\WcRmyDD.exe
  2⤵
  PID:8424
- C:\Windows\System\MTwoFTk.exe
  C:\Windows\System\MTwoFTk.exe
  2⤵
  PID:8452
- C:\Windows\System\eAexfAg.exe
  C:\Windows\System\eAexfAg.exe
  2⤵
  PID:8484
- C:\Windows\System\WuIXLCE.exe
  C:\Windows\System\WuIXLCE.exe
  2⤵
  PID:8512
- C:\Windows\System\isvNkYd.exe
  C:\Windows\System\isvNkYd.exe
  2⤵
  PID:8528
- C:\Windows\System\OpBgDmW.exe
  C:\Windows\System\OpBgDmW.exe
  2⤵
  PID:8552
- C:\Windows\System\cZMrfYb.exe
  C:\Windows\System\cZMrfYb.exe
  2⤵
  PID:8596
- C:\Windows\System\tbYFsPu.exe
  C:\Windows\System\tbYFsPu.exe
  2⤵
  PID:8624
- C:\Windows\System\MhooZvF.exe
  C:\Windows\System\MhooZvF.exe
  2⤵
  PID:8652
- C:\Windows\System\AZOoTAM.exe
  C:\Windows\System\AZOoTAM.exe
  2⤵
  PID:8672
- C:\Windows\System\eovuvqC.exe
  C:\Windows\System\eovuvqC.exe
  2⤵
  PID:8700
- C:\Windows\System\fAuQzSh.exe
  C:\Windows\System\fAuQzSh.exe
  2⤵
  PID:8724
- C:\Windows\System\rSsEPvY.exe
  C:\Windows\System\rSsEPvY.exe
  2⤵
  PID:8752
- C:\Windows\System\VvtaRUT.exe
  C:\Windows\System\VvtaRUT.exe
  2⤵
  PID:8776
- C:\Windows\System\HGWtctn.exe
  C:\Windows\System\HGWtctn.exe
  2⤵
  PID:8808
- C:\Windows\System\PbIjQFd.exe
  C:\Windows\System\PbIjQFd.exe
  2⤵
  PID:8836
- C:\Windows\System\eEqlQSv.exe
  C:\Windows\System\eEqlQSv.exe
  2⤵
  PID:8876
- C:\Windows\System\fyedBMT.exe
  C:\Windows\System\fyedBMT.exe
  2⤵
  PID:8904
- C:\Windows\System\JwDzoVX.exe
  C:\Windows\System\JwDzoVX.exe
  2⤵
  PID:8932
- C:\Windows\System\ruuITxd.exe
  C:\Windows\System\ruuITxd.exe
  2⤵
  PID:8948
- C:\Windows\System\aLfOtCJ.exe
  C:\Windows\System\aLfOtCJ.exe
  2⤵
  PID:8980
- C:\Windows\System\EmljoKo.exe
  C:\Windows\System\EmljoKo.exe
  2⤵
  PID:8996
- C:\Windows\System\sZPNnMR.exe
  C:\Windows\System\sZPNnMR.exe
  2⤵
  PID:9028
- C:\Windows\System\vpApizb.exe
  C:\Windows\System\vpApizb.exe
  2⤵
  PID:9064
- C:\Windows\System\vULKpKV.exe
  C:\Windows\System\vULKpKV.exe
  2⤵
  PID:9104
- C:\Windows\System\jJVFwYF.exe
  C:\Windows\System\jJVFwYF.exe
  2⤵
  PID:9120
- C:\Windows\System\uTlDkOY.exe
  C:\Windows\System\uTlDkOY.exe
  2⤵
  PID:9148
- C:\Windows\System\vwaIbUf.exe
  C:\Windows\System\vwaIbUf.exe
  2⤵
  PID:9168
- C:\Windows\System\JpsryCO.exe
  C:\Windows\System\JpsryCO.exe
  2⤵
  PID:9204
- C:\Windows\System\rwTJHoa.exe
  C:\Windows\System\rwTJHoa.exe
  2⤵
  PID:8220
- C:\Windows\System\QMJeXSN.exe
  C:\Windows\System\QMJeXSN.exe
  2⤵
  PID:8292
- C:\Windows\System\hICOgPI.exe
  C:\Windows\System\hICOgPI.exe
  2⤵
  PID:8364
- C:\Windows\System\ZwMZtzF.exe
  C:\Windows\System\ZwMZtzF.exe
  2⤵
  PID:8444
- C:\Windows\System\OiAiNRV.exe
  C:\Windows\System\OiAiNRV.exe
  2⤵
  PID:8420
- C:\Windows\System\iYyJiwW.exe
  C:\Windows\System\iYyJiwW.exe
  2⤵
  PID:8544
- C:\Windows\System\dPvrMHJ.exe
  C:\Windows\System\dPvrMHJ.exe
  2⤵
  PID:8608
- C:\Windows\System\dxPgqrz.exe
  C:\Windows\System\dxPgqrz.exe
  2⤵
  PID:8680
- C:\Windows\System\PZqxpXn.exe
  C:\Windows\System\PZqxpXn.exe
  2⤵
  PID:8736
- C:\Windows\System\FUMIzhr.exe
  C:\Windows\System\FUMIzhr.exe
  2⤵
  PID:8792
- C:\Windows\System\Qymltxc.exe
  C:\Windows\System\Qymltxc.exe
  2⤵
  PID:8828
- C:\Windows\System\kuKBHru.exe
  C:\Windows\System\kuKBHru.exe
  2⤵
  PID:8892
- C:\Windows\System\LevcYpc.exe
  C:\Windows\System\LevcYpc.exe
  2⤵
  PID:8964
- C:\Windows\System\OXyxXvp.exe
  C:\Windows\System\OXyxXvp.exe
  2⤵
  PID:9092
- C:\Windows\System\wMPyAGj.exe
  C:\Windows\System\wMPyAGj.exe
  2⤵
  PID:9156
- C:\Windows\System\AxdnjVc.exe
  C:\Windows\System\AxdnjVc.exe
  2⤵
  PID:8228
- C:\Windows\System\UAVFssa.exe
  C:\Windows\System\UAVFssa.exe
  2⤵
  PID:8344
- C:\Windows\System\IfisLuk.exe
  C:\Windows\System\IfisLuk.exe
  2⤵
  PID:8496
- C:\Windows\System\cjuAriA.exe
  C:\Windows\System\cjuAriA.exe
  2⤵
  PID:8592
- C:\Windows\System\npSnZlo.exe
  C:\Windows\System\npSnZlo.exe
  2⤵
  PID:8860
- C:\Windows\System\pzGKIdG.exe
  C:\Windows\System\pzGKIdG.exe
  2⤵
  PID:9008
- C:\Windows\System\AzRtxCI.exe
  C:\Windows\System\AzRtxCI.exe
  2⤵
  PID:9116
- C:\Windows\System\PINExxr.exe
  C:\Windows\System\PINExxr.exe
  2⤵
  PID:8436
- C:\Windows\System\azuZwDG.exe
  C:\Windows\System\azuZwDG.exe
  2⤵
  PID:8820
- C:\Windows\System\RZPhyPS.exe
  C:\Windows\System\RZPhyPS.exe
  2⤵
  PID:8960
- C:\Windows\System\LatxlON.exe
  C:\Windows\System\LatxlON.exe
  2⤵
  PID:8524
- C:\Windows\System\drDcuCL.exe
  C:\Windows\System\drDcuCL.exe
  2⤵
  PID:9080
- C:\Windows\System\tsOsfvc.exe
  C:\Windows\System\tsOsfvc.exe
  2⤵
  PID:9236
- C:\Windows\System\goqfuFC.exe
  C:\Windows\System\goqfuFC.exe
  2⤵
  PID:9276
- C:\Windows\System\ouhkZNZ.exe
  C:\Windows\System\ouhkZNZ.exe
  2⤵
  PID:9300
- C:\Windows\System\pxAWBDT.exe
  C:\Windows\System\pxAWBDT.exe
  2⤵
  PID:9336
- C:\Windows\System\xrdpANr.exe
  C:\Windows\System\xrdpANr.exe
  2⤵
  PID:9352
- C:\Windows\System\vyXQZXm.exe
  C:\Windows\System\vyXQZXm.exe
  2⤵
  PID:9388
- C:\Windows\System\TPZKwGL.exe
  C:\Windows\System\TPZKwGL.exe
  2⤵
  PID:9412
- C:\Windows\System\xRgfxms.exe
  C:\Windows\System\xRgfxms.exe
  2⤵
  PID:9440
- C:\Windows\System\XFhGOcN.exe
  C:\Windows\System\XFhGOcN.exe
  2⤵
  PID:9468
- C:\Windows\System\BlOphav.exe
  C:\Windows\System\BlOphav.exe
  2⤵
  PID:9488
- C:\Windows\System\QYbCFwD.exe
  C:\Windows\System\QYbCFwD.exe
  2⤵
  PID:9520
- C:\Windows\System\RVoaxSf.exe
  C:\Windows\System\RVoaxSf.exe
  2⤵
  PID:9544
- C:\Windows\System\munKtnv.exe
  C:\Windows\System\munKtnv.exe
  2⤵
  PID:9600
- C:\Windows\System\KUstwvX.exe
  C:\Windows\System\KUstwvX.exe
  2⤵
  PID:9624
- C:\Windows\System\DteJqOo.exe
  C:\Windows\System\DteJqOo.exe
  2⤵
  PID:9644
- C:\Windows\System\higDioM.exe
  C:\Windows\System\higDioM.exe
  2⤵
  PID:9668
- C:\Windows\System\uftLpky.exe
  C:\Windows\System\uftLpky.exe
  2⤵
  PID:9688
- C:\Windows\System\wsVlQSi.exe
  C:\Windows\System\wsVlQSi.exe
  2⤵
  PID:9708
- C:\Windows\System\hebmmeQ.exe
  C:\Windows\System\hebmmeQ.exe
  2⤵
  PID:9736
- C:\Windows\System\QtxOyPw.exe
  C:\Windows\System\QtxOyPw.exe
  2⤵
  PID:9768
- C:\Windows\System\GEyjifu.exe
  C:\Windows\System\GEyjifu.exe
  2⤵
  PID:9796
- C:\Windows\System\HkDNjIk.exe
  C:\Windows\System\HkDNjIk.exe
  2⤵
  PID:9832
- C:\Windows\System\mojvPHD.exe
  C:\Windows\System\mojvPHD.exe
  2⤵
  PID:9884
- C:\Windows\System\ebrKdKz.exe
  C:\Windows\System\ebrKdKz.exe
  2⤵
  PID:9912
- C:\Windows\System\fwGhCTU.exe
  C:\Windows\System\fwGhCTU.exe
  2⤵
  PID:9928
- C:\Windows\System\uYDIAcU.exe
  C:\Windows\System\uYDIAcU.exe
  2⤵
  PID:9948
- C:\Windows\System\HkSmIGm.exe
  C:\Windows\System\HkSmIGm.exe
  2⤵
  PID:9972
- C:\Windows\System\qVkeMSs.exe
  C:\Windows\System\qVkeMSs.exe
  2⤵
  PID:10012
- C:\Windows\System\zBnJJOl.exe
  C:\Windows\System\zBnJJOl.exe
  2⤵
  PID:10036
- C:\Windows\System\bJmJeCs.exe
  C:\Windows\System\bJmJeCs.exe
  2⤵
  PID:10060
- C:\Windows\System\QptYXSs.exe
  C:\Windows\System\QptYXSs.exe
  2⤵
  PID:10084
- C:\Windows\System\DbXbDvX.exe
  C:\Windows\System\DbXbDvX.exe
  2⤵
  PID:10128
- C:\Windows\System\LtYpxil.exe
  C:\Windows\System\LtYpxil.exe
  2⤵
  PID:10152
- C:\Windows\System\VJphmcy.exe
  C:\Windows\System\VJphmcy.exe
  2⤵
  PID:10168
- C:\Windows\System\PrhCKwg.exe
  C:\Windows\System\PrhCKwg.exe
  2⤵
  PID:10200
- C:\Windows\System\KYGHbMG.exe
  C:\Windows\System\KYGHbMG.exe
  2⤵
  PID:10236
- C:\Windows\System\giAuEWk.exe
  C:\Windows\System\giAuEWk.exe
  2⤵
  PID:9232
- C:\Windows\System\henqvlz.exe
  C:\Windows\System\henqvlz.exe
  2⤵
  PID:9296
- C:\Windows\System\hfbKOOh.exe
  C:\Windows\System\hfbKOOh.exe
  2⤵
  PID:9404
- C:\Windows\System\YjnMbuH.exe
  C:\Windows\System\YjnMbuH.exe
  2⤵
  PID:9484
- C:\Windows\System\KSLpRuY.exe
  C:\Windows\System\KSLpRuY.exe
  2⤵
  PID:9500
- C:\Windows\System\MPvZjnW.exe
  C:\Windows\System\MPvZjnW.exe
  2⤵
  PID:9532
- C:\Windows\System\NTmDOjD.exe
  C:\Windows\System\NTmDOjD.exe
  2⤵
  PID:9608
- C:\Windows\System\ZpxsZQG.exe
  C:\Windows\System\ZpxsZQG.exe
  2⤵
  PID:9696
- C:\Windows\System\FBQKNdz.exe
  C:\Windows\System\FBQKNdz.exe
  2⤵
  PID:9732
- C:\Windows\System\eZCKOdE.exe
  C:\Windows\System\eZCKOdE.exe
  2⤵
  PID:9860
- C:\Windows\System\hqvWEHu.exe
  C:\Windows\System\hqvWEHu.exe
  2⤵
  PID:9924
- C:\Windows\System\bhRaejz.exe
  C:\Windows\System\bhRaejz.exe
  2⤵
  PID:9936
- C:\Windows\System\wrFVBkW.exe
  C:\Windows\System\wrFVBkW.exe
  2⤵
  PID:10028
- C:\Windows\System\xxyMNxO.exe
  C:\Windows\System\xxyMNxO.exe
  2⤵
  PID:10080
- C:\Windows\System\ZiCZDaE.exe
  C:\Windows\System\ZiCZDaE.exe
  2⤵
  PID:10140
- C:\Windows\System\sqmnXhD.exe
  C:\Windows\System\sqmnXhD.exe
  2⤵
  PID:10232
- C:\Windows\System\hLvMNjZ.exe
  C:\Windows\System\hLvMNjZ.exe
  2⤵
  PID:9288
- C:\Windows\System\wEyaQUS.exe
  C:\Windows\System\wEyaQUS.exe
  2⤵
  PID:9564
- C:\Windows\System\phbsBGZ.exe
  C:\Windows\System\phbsBGZ.exe
  2⤵
  PID:9728
- C:\Windows\System\IKWItKs.exe
  C:\Windows\System\IKWItKs.exe
  2⤵
  PID:9808
- C:\Windows\System\LCOrjAC.exe
  C:\Windows\System\LCOrjAC.exe
  2⤵
  PID:9984
- C:\Windows\System\RzBxNkp.exe
  C:\Windows\System\RzBxNkp.exe
  2⤵
  PID:10032
- C:\Windows\System\TaLxXra.exe
  C:\Windows\System\TaLxXra.exe
  2⤵
  PID:9292
- C:\Windows\System\XnlkQnN.exe
  C:\Windows\System\XnlkQnN.exe
  2⤵
  PID:9592
- C:\Windows\System\AnfEemR.exe
  C:\Windows\System\AnfEemR.exe
  2⤵
  PID:9956
- C:\Windows\System\ghLrMWP.exe
  C:\Windows\System\ghLrMWP.exe
  2⤵
  PID:9420
- C:\Windows\System\kFVsuEK.exe
  C:\Windows\System\kFVsuEK.exe
  2⤵
  PID:10164
- C:\Windows\System\gxkOire.exe
  C:\Windows\System\gxkOire.exe
  2⤵
  PID:10252
- C:\Windows\System\OIZUvrv.exe
  C:\Windows\System\OIZUvrv.exe
  2⤵
  PID:10280
- C:\Windows\System\lkthMSL.exe
  C:\Windows\System\lkthMSL.exe
  2⤵
  PID:10308
- C:\Windows\System\UXwPkum.exe
  C:\Windows\System\UXwPkum.exe
  2⤵
  PID:10336
- C:\Windows\System\YrscWyX.exe
  C:\Windows\System\YrscWyX.exe
  2⤵
  PID:10364
- C:\Windows\System\zYVnZOl.exe
  C:\Windows\System\zYVnZOl.exe
  2⤵
  PID:10380
- C:\Windows\System\TbGbhlu.exe
  C:\Windows\System\TbGbhlu.exe
  2⤵
  PID:10412
- C:\Windows\System\aCaVnUq.exe
  C:\Windows\System\aCaVnUq.exe
  2⤵
  PID:10436
- C:\Windows\System\cONqlkl.exe
  C:\Windows\System\cONqlkl.exe
  2⤵
  PID:10464
- C:\Windows\System\kPYdbhs.exe
  C:\Windows\System\kPYdbhs.exe
  2⤵
  PID:10480
- C:\Windows\System\EoiZoky.exe
  C:\Windows\System\EoiZoky.exe
  2⤵
  PID:10504
- C:\Windows\System\FexWJzD.exe
  C:\Windows\System\FexWJzD.exe
  2⤵
  PID:10540
- C:\Windows\System\WDwVwXb.exe
  C:\Windows\System\WDwVwXb.exe
  2⤵
  PID:10588
- C:\Windows\System\nRillVa.exe
  C:\Windows\System\nRillVa.exe
  2⤵
  PID:10616
- C:\Windows\System\RqHmeLh.exe
  C:\Windows\System\RqHmeLh.exe
  2⤵
  PID:10636
- C:\Windows\System\nKnEdbp.exe
  C:\Windows\System\nKnEdbp.exe
  2⤵
  PID:10660
- C:\Windows\System\SBCrXDz.exe
  C:\Windows\System\SBCrXDz.exe
  2⤵
  PID:10700
- C:\Windows\System\cgOZTNx.exe
  C:\Windows\System\cgOZTNx.exe
  2⤵
  PID:10720
- C:\Windows\System\RPigNvs.exe
  C:\Windows\System\RPigNvs.exe
  2⤵
  PID:10744
- C:\Windows\System\wXoiuDR.exe
  C:\Windows\System\wXoiuDR.exe
  2⤵
  PID:10784
- C:\Windows\System\cIcTjEu.exe
  C:\Windows\System\cIcTjEu.exe
  2⤵
  PID:10800
- C:\Windows\System\hWTHUfT.exe
  C:\Windows\System\hWTHUfT.exe
  2⤵
  PID:10828
- C:\Windows\System\wzSkLUj.exe
  C:\Windows\System\wzSkLUj.exe
  2⤵
  PID:10856
- C:\Windows\System\qDWioAg.exe
  C:\Windows\System\qDWioAg.exe
  2⤵
  PID:10892
- C:\Windows\System\WBnaMNy.exe
  C:\Windows\System\WBnaMNy.exe
  2⤵
  PID:10916
- C:\Windows\System\SOSdQEr.exe
  C:\Windows\System\SOSdQEr.exe
  2⤵
  PID:10944
- C:\Windows\System\ePzZPaq.exe
  C:\Windows\System\ePzZPaq.exe
  2⤵
  PID:10964
- C:\Windows\System\QvuwyPT.exe
  C:\Windows\System\QvuwyPT.exe
  2⤵
  PID:10988
- C:\Windows\System\TkWrRJd.exe
  C:\Windows\System\TkWrRJd.exe
  2⤵
  PID:11016
- C:\Windows\System\RFdglty.exe
  C:\Windows\System\RFdglty.exe
  2⤵
  PID:11060
- C:\Windows\System\oOKXlTi.exe
  C:\Windows\System\oOKXlTi.exe
  2⤵
  PID:11088
- C:\Windows\System\yaRAlEX.exe
  C:\Windows\System\yaRAlEX.exe
  2⤵
  PID:11120
- C:\Windows\System\wRPcfKC.exe
  C:\Windows\System\wRPcfKC.exe
  2⤵
  PID:11140
- C:\Windows\System\ypJrfea.exe
  C:\Windows\System\ypJrfea.exe
  2⤵
  PID:11168
- C:\Windows\System\kCuiovP.exe
  C:\Windows\System\kCuiovP.exe
  2⤵
  PID:11208
- C:\Windows\System\uBEVaYW.exe
  C:\Windows\System\uBEVaYW.exe
  2⤵
  PID:11224
- C:\Windows\System\hHuJRun.exe
  C:\Windows\System\hHuJRun.exe
  2⤵
  PID:11260
- C:\Windows\System\YArXhRz.exe
  C:\Windows\System\YArXhRz.exe
  2⤵
  PID:10268
- C:\Windows\System\CacnxzO.exe
  C:\Windows\System\CacnxzO.exe
  2⤵
  PID:10332
- C:\Windows\System\OfLURsU.exe
  C:\Windows\System\OfLURsU.exe
  2⤵
  PID:10456
- C:\Windows\System\buxfgYO.exe
  C:\Windows\System\buxfgYO.exe
  2⤵
  PID:10472
- C:\Windows\System\fOvQThN.exe
  C:\Windows\System\fOvQThN.exe
  2⤵
  PID:10496
- C:\Windows\System\DorVfcc.exe
  C:\Windows\System\DorVfcc.exe
  2⤵
  PID:10580
- C:\Windows\System\MEedgvq.exe
  C:\Windows\System\MEedgvq.exe
  2⤵
  PID:10652
- C:\Windows\System\IiqBSRe.exe
  C:\Windows\System\IiqBSRe.exe
  2⤵
  PID:10740
- C:\Windows\System\zfkNaWE.exe
  C:\Windows\System\zfkNaWE.exe
  2⤵
  PID:10772
- C:\Windows\System\ZsBaNcc.exe
  C:\Windows\System\ZsBaNcc.exe
  2⤵
  PID:10792
- C:\Windows\System\etNeRrN.exe
  C:\Windows\System\etNeRrN.exe
  2⤵
  PID:10848
- C:\Windows\System\iNOlbIG.exe
  C:\Windows\System\iNOlbIG.exe
  2⤵
  PID:10888
- C:\Windows\System\jHgZNms.exe
  C:\Windows\System\jHgZNms.exe
  2⤵
  PID:11084
- C:\Windows\System\xyyppXU.exe
  C:\Windows\System\xyyppXU.exe
  2⤵
  PID:11116
- C:\Windows\System\ThnVQyy.exe
  C:\Windows\System\ThnVQyy.exe
  2⤵
  PID:11188
- C:\Windows\System\ziZolwV.exe
  C:\Windows\System\ziZolwV.exe
  2⤵
  PID:11216
- C:\Windows\System\TGirHrf.exe
  C:\Windows\System\TGirHrf.exe
  2⤵
  PID:11252
- C:\Windows\System\CeCPKRT.exe
  C:\Windows\System\CeCPKRT.exe
  2⤵
  PID:10500
- C:\Windows\System\zQFiPkW.exe
  C:\Windows\System\zQFiPkW.exe
  2⤵
  PID:10688
- C:\Windows\System\JKDBCch.exe
  C:\Windows\System\JKDBCch.exe
  2⤵
  PID:10816
- C:\Windows\System\vpLfaEj.exe
  C:\Windows\System\vpLfaEj.exe
  2⤵
  PID:10900
- C:\Windows\System\dRlLtmF.exe
  C:\Windows\System\dRlLtmF.exe
  2⤵
  PID:11160
- C:\Windows\System\KktdAcu.exe
  C:\Windows\System\KktdAcu.exe
  2⤵
  PID:11236
- C:\Windows\System\WYgvkGN.exe
  C:\Windows\System\WYgvkGN.exe
  2⤵
  PID:10264
- C:\Windows\System\DReFrzz.exe
  C:\Windows\System\DReFrzz.exe
  2⤵
  PID:10984
- C:\Windows\System\tcPBEFZ.exe
  C:\Windows\System\tcPBEFZ.exe
  2⤵
  PID:11204
- C:\Windows\System\KUGaeZj.exe
  C:\Windows\System\KUGaeZj.exe
  2⤵
  PID:10632
- C:\Windows\System\IcItFne.exe
  C:\Windows\System\IcItFne.exe
  2⤵
  PID:11292
- C:\Windows\System\njYEfMr.exe
  C:\Windows\System\njYEfMr.exe
  2⤵
  PID:11308
- C:\Windows\System\zViZpyM.exe
  C:\Windows\System\zViZpyM.exe
  2⤵
  PID:11336
- C:\Windows\System\zjoGkst.exe
  C:\Windows\System\zjoGkst.exe
  2⤵
  PID:11376
- C:\Windows\System\nHQqQJx.exe
  C:\Windows\System\nHQqQJx.exe
  2⤵
  PID:11392
- C:\Windows\System\FKXqiCk.exe
  C:\Windows\System\FKXqiCk.exe
  2⤵
  PID:11432
- C:\Windows\System\RaEatHo.exe
  C:\Windows\System\RaEatHo.exe
  2⤵
  PID:11452
- C:\Windows\System\euVqkQu.exe
  C:\Windows\System\euVqkQu.exe
  2⤵
  PID:11476
- C:\Windows\System\RMpLIBa.exe
  C:\Windows\System\RMpLIBa.exe
  2⤵
  PID:11492
- C:\Windows\System\UpYcqPW.exe
  C:\Windows\System\UpYcqPW.exe
  2⤵
  PID:11512
- C:\Windows\System\ToMNSMe.exe
  C:\Windows\System\ToMNSMe.exe
  2⤵
  PID:11544
- C:\Windows\System\uOPaxQh.exe
  C:\Windows\System\uOPaxQh.exe
  2⤵
  PID:11596
- C:\Windows\System\vHMocBe.exe
  C:\Windows\System\vHMocBe.exe
  2⤵
  PID:11616
- C:\Windows\System\BtypQZg.exe
  C:\Windows\System\BtypQZg.exe
  2⤵
  PID:11636
- C:\Windows\System\jWPTtFp.exe
  C:\Windows\System\jWPTtFp.exe
  2⤵
  PID:11668
- C:\Windows\System\JoWwPra.exe
  C:\Windows\System\JoWwPra.exe
  2⤵
  PID:11696
- C:\Windows\System\oJasTNa.exe
  C:\Windows\System\oJasTNa.exe
  2⤵
  PID:11720
- C:\Windows\System\BrTCpvG.exe
  C:\Windows\System\BrTCpvG.exe
  2⤵
  PID:11744
- C:\Windows\System\PwmwNTy.exe
  C:\Windows\System\PwmwNTy.exe
  2⤵
  PID:11796
- C:\Windows\System\GHoaHpz.exe
  C:\Windows\System\GHoaHpz.exe
  2⤵
  PID:11812
- C:\Windows\System\OGgAsiZ.exe
  C:\Windows\System\OGgAsiZ.exe
  2⤵
  PID:11840
- C:\Windows\System\GNlJdoJ.exe
  C:\Windows\System\GNlJdoJ.exe
  2⤵
  PID:11868
- C:\Windows\System\QJwHbhU.exe
  C:\Windows\System\QJwHbhU.exe
  2⤵
  PID:11896
- C:\Windows\System\SiwzxMd.exe
  C:\Windows\System\SiwzxMd.exe
  2⤵
  PID:11928
- C:\Windows\System\omGkrXN.exe
  C:\Windows\System\omGkrXN.exe
  2⤵
  PID:11956
- C:\Windows\System\tXXNMih.exe
  C:\Windows\System\tXXNMih.exe
  2⤵
  PID:11972
- C:\Windows\System\zzITNrr.exe
  C:\Windows\System\zzITNrr.exe
  2⤵
  PID:11992
- C:\Windows\System\kIWthwG.exe
  C:\Windows\System\kIWthwG.exe
  2⤵
  PID:12024
- C:\Windows\System\YMUDEYh.exe
  C:\Windows\System\YMUDEYh.exe
  2⤵
  PID:12052
- C:\Windows\System\kENCoWO.exe
  C:\Windows\System\kENCoWO.exe
  2⤵
  PID:12076
- C:\Windows\System\ZOqEZUq.exe
  C:\Windows\System\ZOqEZUq.exe
  2⤵
  PID:12132
- C:\Windows\System\oUAifki.exe
  C:\Windows\System\oUAifki.exe
  2⤵
  PID:12152
- C:\Windows\System\rYKhyLm.exe
  C:\Windows\System\rYKhyLm.exe
  2⤵
  PID:12180
- C:\Windows\System\NnakiQa.exe
  C:\Windows\System\NnakiQa.exe
  2⤵
  PID:12216
- C:\Windows\System\ljygQoA.exe
  C:\Windows\System\ljygQoA.exe
  2⤵
  PID:12236
- C:\Windows\System\pXUrGDK.exe
  C:\Windows\System\pXUrGDK.exe
  2⤵
  PID:12276
- C:\Windows\System\ydinAEO.exe
  C:\Windows\System\ydinAEO.exe
  2⤵
  PID:10760
- C:\Windows\System\ByANlru.exe
  C:\Windows\System\ByANlru.exe
  2⤵
  PID:11288
- C:\Windows\System\uEwYsdA.exe
  C:\Windows\System\uEwYsdA.exe
  2⤵
  PID:11360
- C:\Windows\System\twBzCdw.exe
  C:\Windows\System\twBzCdw.exe
  2⤵
  PID:11460
- C:\Windows\System\AuphBRs.exe
  C:\Windows\System\AuphBRs.exe
  2⤵
  PID:11484
- C:\Windows\System\SgCjfVM.exe
  C:\Windows\System\SgCjfVM.exe
  2⤵
  PID:11560
- C:\Windows\System\QmmyLcp.exe
  C:\Windows\System\QmmyLcp.exe
  2⤵
  PID:11624
- C:\Windows\System\OUeXbww.exe
  C:\Windows\System\OUeXbww.exe
  2⤵
  PID:11736
- C:\Windows\System\LeAiZPg.exe
  C:\Windows\System\LeAiZPg.exe
  2⤵
  PID:11784
- C:\Windows\System\NVhmLOo.exe
  C:\Windows\System\NVhmLOo.exe
  2⤵
  PID:11856
- C:\Windows\System\qmsTxox.exe
  C:\Windows\System\qmsTxox.exe
  2⤵
  PID:11888
- C:\Windows\System\cZNbQak.exe
  C:\Windows\System\cZNbQak.exe
  2⤵
  PID:11984
- C:\Windows\System\HZedbfV.exe
  C:\Windows\System\HZedbfV.exe
  2⤵
  PID:12036
- C:\Windows\System\RaLxCRo.exe
  C:\Windows\System\RaLxCRo.exe
  2⤵
  PID:12144
- C:\Windows\System\qyZwUTC.exe
  C:\Windows\System\qyZwUTC.exe
  2⤵
  PID:12172
- C:\Windows\System\ZtosVGR.exe
  C:\Windows\System\ZtosVGR.exe
  2⤵
  PID:12224
- C:\Windows\System\CdUBnYK.exe
  C:\Windows\System\CdUBnYK.exe
  2⤵
  PID:10880
- C:\Windows\System\eBQMIKN.exe
  C:\Windows\System\eBQMIKN.exe
  2⤵
  PID:11324
- C:\Windows\System\kYrIlGr.exe
  C:\Windows\System\kYrIlGr.exe
  2⤵
  PID:11628
- C:\Windows\System\vkaCjde.exe
  C:\Windows\System\vkaCjde.exe
  2⤵
  PID:11716
- C:\Windows\System\nOnszVO.exe
  C:\Windows\System\nOnszVO.exe
  2⤵
  PID:11780
- C:\Windows\System\NIvPmoV.exe
  C:\Windows\System\NIvPmoV.exe
  2⤵
  PID:11964
- C:\Windows\System\nPbGNio.exe
  C:\Windows\System\nPbGNio.exe
  2⤵
  PID:12148
- C:\Windows\System\EJvkBGQ.exe
  C:\Windows\System\EJvkBGQ.exe
  2⤵
  PID:12284
- C:\Windows\System\EMQNRKA.exe
  C:\Windows\System\EMQNRKA.exe
  2⤵
  PID:11608
- C:\Windows\System\unLrkwK.exe
  C:\Windows\System\unLrkwK.exe
  2⤵
  PID:11880
- C:\Windows\System\tJbyRVa.exe
  C:\Windows\System\tJbyRVa.exe
  2⤵
  PID:12016
- C:\Windows\System\hQWYphY.exe
  C:\Windows\System\hQWYphY.exe
  2⤵
  PID:11472
- C:\Windows\System\RDCxAaL.exe
  C:\Windows\System\RDCxAaL.exe
  2⤵
  PID:12308
- C:\Windows\System\vsPrUuS.exe
  C:\Windows\System\vsPrUuS.exe
  2⤵
  PID:12348
- C:\Windows\System\mHxPpcR.exe
  C:\Windows\System\mHxPpcR.exe
  2⤵
  PID:12376
- C:\Windows\System\JFUsxSa.exe
  C:\Windows\System\JFUsxSa.exe
  2⤵
  PID:12396
- C:\Windows\System\oNgAcZp.exe
  C:\Windows\System\oNgAcZp.exe
  2⤵
  PID:12420
- C:\Windows\System\RQnQhtP.exe
  C:\Windows\System\RQnQhtP.exe
  2⤵
  PID:12460
- C:\Windows\System\LkTwGpt.exe
  C:\Windows\System\LkTwGpt.exe
  2⤵
  PID:12500
- C:\Windows\System\kDSIhiG.exe
  C:\Windows\System\kDSIhiG.exe
  2⤵
  PID:12532
- C:\Windows\System\iKyJilC.exe
  C:\Windows\System\iKyJilC.exe
  2⤵
  PID:12564
- C:\Windows\System\kdDjyZi.exe
  C:\Windows\System\kdDjyZi.exe
  2⤵
  PID:12588
- C:\Windows\System\UEUgTHp.exe
  C:\Windows\System\UEUgTHp.exe
  2⤵
  PID:12620
- C:\Windows\System\NhFVGVy.exe
  C:\Windows\System\NhFVGVy.exe
  2⤵
  PID:12644
- C:\Windows\System\PKIWOML.exe
  C:\Windows\System\PKIWOML.exe
  2⤵
  PID:12672
- C:\Windows\System\URdWOcT.exe
  C:\Windows\System\URdWOcT.exe
  2⤵
  PID:12700
- C:\Windows\System\MJaLtnM.exe
  C:\Windows\System\MJaLtnM.exe
  2⤵
  PID:12724
- C:\Windows\System\fmbagJL.exe
  C:\Windows\System\fmbagJL.exe
  2⤵
  PID:12760
- C:\Windows\System\jCtfatd.exe
  C:\Windows\System\jCtfatd.exe
  2⤵
  PID:12784
- C:\Windows\System\NxEkhaV.exe
  C:\Windows\System\NxEkhaV.exe
  2⤵
  PID:12800
- C:\Windows\System\WdTCjRE.exe
  C:\Windows\System\WdTCjRE.exe
  2⤵
  PID:12844
- C:\Windows\System\XFldiXM.exe
  C:\Windows\System\XFldiXM.exe
  2⤵
  PID:12888
- C:\Windows\System\FeLwPIL.exe
  C:\Windows\System\FeLwPIL.exe
  2⤵
  PID:12908
- C:\Windows\System\gNClOdP.exe
  C:\Windows\System\gNClOdP.exe
  2⤵
  PID:12948
- C:\Windows\System\nSDJhjD.exe
  C:\Windows\System\nSDJhjD.exe
  2⤵
  PID:12976
- C:\Windows\System\ACDeVum.exe
  C:\Windows\System\ACDeVum.exe
  2⤵
  PID:13004
- C:\Windows\System\WFfcNQQ.exe
  C:\Windows\System\WFfcNQQ.exe
  2⤵
  PID:13024
- C:\Windows\System\vPIxxhg.exe
  C:\Windows\System\vPIxxhg.exe
  2⤵
  PID:13044
- C:\Windows\System\xnAXOjg.exe
  C:\Windows\System\xnAXOjg.exe
  2⤵
  PID:13072
- C:\Windows\System\UgurIib.exe
  C:\Windows\System\UgurIib.exe
  2⤵
  PID:13120
- C:\Windows\System\bAeMjHW.exe
  C:\Windows\System\bAeMjHW.exe
  2⤵
  PID:13136
- C:\Windows\System\FRbBqJz.exe
  C:\Windows\System\FRbBqJz.exe
  2⤵
  PID:13152
- C:\Windows\System\VxPtzmE.exe
  C:\Windows\System\VxPtzmE.exe
  2⤵
  PID:13204
- C:\Windows\System\wiktMzx.exe
  C:\Windows\System\wiktMzx.exe
  2⤵
  PID:13220
- C:\Windows\System\SEfFsor.exe
  C:\Windows\System\SEfFsor.exe
  2⤵
  PID:13260
- C:\Windows\System\nwYVOKv.exe
  C:\Windows\System\nwYVOKv.exe
  2⤵
  PID:13288
- C:\Windows\System\uZkdkUq.exe
  C:\Windows\System\uZkdkUq.exe
  2⤵
  PID:11300
- C:\Windows\System\XbARAcs.exe
  C:\Windows\System\XbARAcs.exe
  2⤵
  PID:12336
- C:\Windows\System\nZfpkCX.exe
  C:\Windows\System\nZfpkCX.exe
  2⤵
  PID:12388
- C:\Windows\System\AtHqMXU.exe
  C:\Windows\System\AtHqMXU.exe
  2⤵
  PID:12488
- C:\Windows\System\ZJtsIgv.exe
  C:\Windows\System\ZJtsIgv.exe
  2⤵
  PID:12580
- C:\Windows\System\iJxUbJk.exe
  C:\Windows\System\iJxUbJk.exe
  2⤵
  PID:12660
- C:\Windows\System\qHsIVQf.exe
  C:\Windows\System\qHsIVQf.exe
  2⤵
  PID:12736
- C:\Windows\System\FKyhLKt.exe
  C:\Windows\System\FKyhLKt.exe
  2⤵
  PID:12692
- C:\Windows\System\lpIyCaa.exe
  C:\Windows\System\lpIyCaa.exe
  2⤵
  PID:12820
- C:\Windows\System\XSWUbBv.exe
  C:\Windows\System\XSWUbBv.exe
  2⤵
  PID:12900
- C:\Windows\System\oUOOhyo.exe
  C:\Windows\System\oUOOhyo.exe
  2⤵
  PID:12996
- C:\Windows\System\BbxFOYl.exe
  C:\Windows\System\BbxFOYl.exe
  2⤵
  PID:13012
- C:\Windows\System\jiwDFQt.exe
  C:\Windows\System\jiwDFQt.exe
  2⤵
  PID:13084
- C:\Windows\System\nyoazDw.exe
  C:\Windows\System\nyoazDw.exe
  2⤵
  PID:13144
- C:\Windows\System\tKnXORE.exe
  C:\Windows\System\tKnXORE.exe
  2⤵
  PID:13236
- C:\Windows\System\LPfoEYW.exe
  C:\Windows\System\LPfoEYW.exe
  2⤵
  PID:13300
- C:\Windows\System\PzhBSPF.exe
  C:\Windows\System\PzhBSPF.exe
  2⤵
  PID:12304
- C:\Windows\System\VxRvQSf.exe
  C:\Windows\System\VxRvQSf.exe
  2⤵
  PID:12556
- C:\Windows\System\LrwWqtA.exe
  C:\Windows\System\LrwWqtA.exe
  2⤵
  PID:12752
- C:\Windows\System\jNzvHEL.exe
  C:\Windows\System\jNzvHEL.exe
  2⤵
  PID:12856
- C:\Windows\System\dgQwJQq.exe
  C:\Windows\System\dgQwJQq.exe
  2⤵
  PID:12968
- C:\Windows\System\HgJvSUg.exe
  C:\Windows\System\HgJvSUg.exe
  2⤵
  PID:13196
- C:\Windows\System\afxcuVX.exe
  C:\Windows\System\afxcuVX.exe
  2⤵
  PID:12448
- C:\Windows\System\LdQOEJm.exe
  C:\Windows\System\LdQOEJm.exe
  2⤵
  PID:12720
- C:\Windows\System\pxQLnhE.exe
  C:\Windows\System\pxQLnhE.exe
  2⤵
  PID:12988
- C:\Windows\System\AENYvEU.exe
  C:\Windows\System\AENYvEU.exe
  2⤵
  PID:12792
- C:\Windows\System\RXFDHpw.exe
  C:\Windows\System\RXFDHpw.exe
  2⤵
  PID:13112
- C:\Windows\System\XGaTfmh.exe
  C:\Windows\System\XGaTfmh.exe
  2⤵
  PID:13340
- C:\Windows\System\BpYnXRK.exe
  C:\Windows\System\BpYnXRK.exe
  2⤵
  PID:13368
- C:\Windows\System\dtYVQbB.exe
  C:\Windows\System\dtYVQbB.exe
  2⤵
  PID:13384
- C:\Windows\System\DDCkOIj.exe
  C:\Windows\System\DDCkOIj.exe
  2⤵
  PID:13408
- C:\Windows\System\yUDueES.exe
  C:\Windows\System\yUDueES.exe
  2⤵
  PID:13440
- C:\Windows\System\yGOuQdi.exe
  C:\Windows\System\yGOuQdi.exe
  2⤵
  PID:13468
- C:\Windows\System\HPgOzZN.exe
  C:\Windows\System\HPgOzZN.exe
  2⤵
  PID:13484
- C:\Windows\System\wnJpAGD.exe
  C:\Windows\System\wnJpAGD.exe
  2⤵
  PID:13524
- C:\Windows\System\KPJjITa.exe
  C:\Windows\System\KPJjITa.exe
  2⤵
  PID:13544
- C:\Windows\System\rFGqMRw.exe
  C:\Windows\System\rFGqMRw.exe
  2⤵
  PID:13576
- C:\Windows\System\DkRwmrS.exe
  C:\Windows\System\DkRwmrS.exe
  2⤵
  PID:13600
- C:\Windows\System\UhGNwcn.exe
  C:\Windows\System\UhGNwcn.exe
  2⤵
  PID:13640
- C:\Windows\System\SjXJCoF.exe
  C:\Windows\System\SjXJCoF.exe
  2⤵
  PID:13664
- C:\Windows\System\qsWYjhJ.exe
  C:\Windows\System\qsWYjhJ.exe
  2⤵
  PID:13680
- C:\Windows\System\gXDwhCp.exe
  C:\Windows\System\gXDwhCp.exe
  2⤵
  PID:13712
- C:\Windows\System\KvEBUnD.exe
  C:\Windows\System\KvEBUnD.exe
  2⤵
  PID:13748
- C:\Windows\System\sShmTme.exe
  C:\Windows\System\sShmTme.exe
  2⤵
  PID:13788
- C:\Windows\System\UTumexc.exe
  C:\Windows\System\UTumexc.exe
  2⤵
  PID:13816
- C:\Windows\System\bNbKhZp.exe
  C:\Windows\System\bNbKhZp.exe
  2⤵
  PID:13840
- C:\Windows\System\wHBUhcR.exe
  C:\Windows\System\wHBUhcR.exe
  2⤵
  PID:13860
- C:\Windows\System\ouShBqm.exe
  C:\Windows\System\ouShBqm.exe
  2⤵
  PID:13880
- C:\Windows\System\aSfCpOv.exe
  C:\Windows\System\aSfCpOv.exe
  2⤵
  PID:13932
- C:\Windows\System\TqqjpWu.exe
  C:\Windows\System\TqqjpWu.exe
  2⤵
  PID:13948
- C:\Windows\System\uFCFjLy.exe
  C:\Windows\System\uFCFjLy.exe
  2⤵
  PID:13968
- C:\Windows\System\jdsSxgh.exe
  C:\Windows\System\jdsSxgh.exe
  2⤵
  PID:14004
- C:\Windows\System\ahiDryw.exe
  C:\Windows\System\ahiDryw.exe
  2⤵
  PID:14032
- C:\Windows\System\bWlybXj.exe
  C:\Windows\System\bWlybXj.exe
  2⤵
  PID:14076
- C:\Windows\System\yUONerj.exe
  C:\Windows\System\yUONerj.exe
  2⤵
  PID:14092
- C:\Windows\System\AlcYrgC.exe
  C:\Windows\System\AlcYrgC.exe
  2⤵
  PID:14112
- C:\Windows\System\oEJAWJy.exe
  C:\Windows\System\oEJAWJy.exe
  2⤵
  PID:14148
- C:\Windows\System\GmKTpJO.exe
  C:\Windows\System\GmKTpJO.exe
  2⤵
  PID:14172
- C:\Windows\System\GCwQYki.exe
  C:\Windows\System\GCwQYki.exe
  2⤵
  PID:14192
- C:\Windows\System\KGzWrzQ.exe
  C:\Windows\System\KGzWrzQ.exe
  2⤵
  PID:14228
- C:\Windows\System\ceHKZxg.exe
  C:\Windows\System\ceHKZxg.exe
  2⤵
  PID:14256
- C:\Windows\System\BpbOUMY.exe
  C:\Windows\System\BpbOUMY.exe
  2⤵
  PID:14288
- C:\Windows\System\fhuyduf.exe
  C:\Windows\System\fhuyduf.exe
  2⤵
  PID:14316
- C:\Windows\System\jTlWrQP.exe
  C:\Windows\System\jTlWrQP.exe
  2⤵
  PID:13352
- C:\Windows\System\FAJrumH.exe
  C:\Windows\System\FAJrumH.exe
  2⤵
  PID:13376
- C:\Windows\System\slAOfFY.exe
  C:\Windows\System\slAOfFY.exe
  2⤵
  PID:13460
- C:\Windows\System\TTXeNdy.exe
  C:\Windows\System\TTXeNdy.exe
  2⤵
  PID:13480
- C:\Windows\System\DwZvqmA.exe
  C:\Windows\System\DwZvqmA.exe
  2⤵
  PID:13596
- C:\Windows\System\bpeIsMZ.exe
  C:\Windows\System\bpeIsMZ.exe
  2⤵
  PID:13656
- C:\Windows\System\rCbXysA.exe
  C:\Windows\System\rCbXysA.exe
  2⤵
  PID:13744
- C:\Windows\System\lUkMQOO.exe
  C:\Windows\System\lUkMQOO.exe
  2⤵
  PID:13728
- C:\Windows\System\vpifsEg.exe
  C:\Windows\System\vpifsEg.exe
  2⤵
  PID:13868
- C:\Windows\System\TArTnTw.exe
  C:\Windows\System\TArTnTw.exe
  2⤵
  PID:13924
- C:\Windows\System\LXqdwDZ.exe
  C:\Windows\System\LXqdwDZ.exe
  2⤵
  PID:13988
- C:\Windows\System\NhRmSyu.exe
  C:\Windows\System\NhRmSyu.exe
  2⤵
  PID:14056
- C:\Windows\System\ubzBRRO.exe
  C:\Windows\System\ubzBRRO.exe
  2⤵
  PID:14088
- C:\Windows\System\XtQajJb.exe
  C:\Windows\System\XtQajJb.exe
  2⤵
  PID:14168
- C:\Windows\System\LLsOVHn.exe
  C:\Windows\System\LLsOVHn.exe
  2⤵
  PID:14224
- C:\Windows\System\kYvmENv.exe
  C:\Windows\System\kYvmENv.exe
  2⤵
  PID:14332
- C:\Windows\System\LPmeQAW.exe
  C:\Windows\System\LPmeQAW.exe
  2⤵
  PID:13428
- C:\Windows\System\uRkrUBj.exe
  C:\Windows\System\uRkrUBj.exe
  2⤵
  PID:13452
- C:\Windows\System\hDuVILf.exe
  C:\Windows\System\hDuVILf.exe
  2⤵
  PID:13624
- C:\Windows\System\sEjyKWp.exe
  C:\Windows\System\sEjyKWp.exe
  2⤵
  PID:13800
- C:\Windows\System\lFBHydt.exe
  C:\Windows\System\lFBHydt.exe
  2⤵
  PID:14000
- C:\Windows\System\NCRETzS.exe
  C:\Windows\System\NCRETzS.exe
  2⤵
  PID:14188
- C:\Windows\System\wlpWZGJ.exe
  C:\Windows\System\wlpWZGJ.exe
  2⤵
  PID:14220
- C:\Windows\System\rwSmBMk.exe
  C:\Windows\System\rwSmBMk.exe
  2⤵
  PID:13476
- C:\Windows\System\vcBNzCx.exe
  C:\Windows\System\vcBNzCx.exe
  2⤵
  PID:13812
- C:\Windows\System\xNTdhHX.exe
  C:\Windows\System\xNTdhHX.exe
  2⤵
  PID:14180
- C:\Windows\System\MePKDEC.exe
  C:\Windows\System\MePKDEC.exe
  2⤵
  PID:14252
- C:\Windows\System\KBBlOaH.exe
  C:\Windows\System\KBBlOaH.exe
  2⤵
  PID:14348
- C:\Windows\System\RNjRegn.exe
  C:\Windows\System\RNjRegn.exe
  2⤵
  PID:14376
- C:\Windows\System\fYZvyWX.exe
  C:\Windows\System\fYZvyWX.exe
  2⤵
  PID:14392
- C:\Windows\System\TaTnlzD.exe
  C:\Windows\System\TaTnlzD.exe
  2⤵
  PID:14432
- C:\Windows\System\uUccWcn.exe
  C:\Windows\System\uUccWcn.exe
  2⤵
  PID:14448
- C:\Windows\System\dTLhCLV.exe
  C:\Windows\System\dTLhCLV.exe
  2⤵
  PID:14468
- C:\Windows\System\zZpLOxQ.exe
  C:\Windows\System\zZpLOxQ.exe
  2⤵
  PID:14496
- C:\Windows\System\bWYDnsq.exe
  C:\Windows\System\bWYDnsq.exe
  2⤵
  PID:14520
- C:\Windows\System\QPpaKbX.exe
  C:\Windows\System\QPpaKbX.exe
  2⤵
  PID:14544
- C:\Windows\System\ULqzmPl.exe
  C:\Windows\System\ULqzmPl.exe
  2⤵
  PID:14564
- C:\Windows\System\zwBgsNM.exe
  C:\Windows\System\zwBgsNM.exe
  2⤵
  PID:14608
- C:\Windows\System\afXlVXD.exe
  C:\Windows\System\afXlVXD.exe
  2⤵
  PID:14648
- C:\Windows\System\cEniwZU.exe
  C:\Windows\System\cEniwZU.exe
  2⤵
  PID:14676
- C:\Windows\System\LovHgEp.exe
  C:\Windows\System\LovHgEp.exe
  2⤵
  PID:14692
- C:\Windows\System\pOOCjhI.exe
  C:\Windows\System\pOOCjhI.exe
  2⤵
  PID:14728
- C:\Windows\System\RPKSxgt.exe
  C:\Windows\System\RPKSxgt.exe
  2⤵
  PID:14764
- C:\Windows\System\orUKIPI.exe
  C:\Windows\System\orUKIPI.exe
  2⤵
  PID:14792
- C:\Windows\System\FMozESR.exe
  C:\Windows\System\FMozESR.exe
  2⤵
  PID:14816
- C:\Windows\System\IrZKZNv.exe
  C:\Windows\System\IrZKZNv.exe
  2⤵
  PID:14872
- C:\Windows\System\jAoXkJG.exe
  C:\Windows\System\jAoXkJG.exe
  2⤵
  PID:14888
- C:\Windows\System\JxoKfyI.exe
  C:\Windows\System\JxoKfyI.exe
  2⤵
  PID:14904
- C:\Windows\System\CNElLet.exe
  C:\Windows\System\CNElLet.exe
  2⤵
  PID:14924
- C:\Windows\System\zpdTKdR.exe
  C:\Windows\System\zpdTKdR.exe
  2⤵
  PID:14972
- C:\Windows\System\vdzCaOb.exe
  C:\Windows\System\vdzCaOb.exe
  2⤵
  PID:15000
- C:\Windows\System\ivqNUyA.exe
  C:\Windows\System\ivqNUyA.exe
  2⤵
  PID:15016
- C:\Windows\System\TGtpUyL.exe
  C:\Windows\System\TGtpUyL.exe
  2⤵
  PID:15040
- C:\Windows\System\TLZRjJf.exe
  C:\Windows\System\TLZRjJf.exe
  2⤵
  PID:15072
- C:\Windows\System\Hstclyk.exe
  C:\Windows\System\Hstclyk.exe
  2⤵
  PID:15108
- C:\Windows\System\zkYgqwm.exe
  C:\Windows\System\zkYgqwm.exe
  2⤵
  PID:15144
- C:\Windows\System\wSFbWwW.exe
  C:\Windows\System\wSFbWwW.exe
  2⤵
  PID:15176
- C:\Windows\System\IGZwxOc.exe
  C:\Windows\System\IGZwxOc.exe
  2⤵
  PID:15196
- C:\Windows\System\fbTIHgU.exe
  C:\Windows\System\fbTIHgU.exe
  2⤵
  PID:15236
- C:\Windows\System\IfTvWJY.exe
  C:\Windows\System\IfTvWJY.exe
  2⤵
  PID:15252
- C:\Windows\System\tUKgrcU.exe
  C:\Windows\System\tUKgrcU.exe
  2⤵
  PID:15280
- C:\Windows\System\qewuhVm.exe
  C:\Windows\System\qewuhVm.exe
  2⤵
  PID:15300
- C:\Windows\System\HlEJHMg.exe
  C:\Windows\System\HlEJHMg.exe
  2⤵
  PID:15352
- C:\Windows\System\xqIpuoH.exe
  C:\Windows\System\xqIpuoH.exe
  2⤵
  PID:14340
- C:\Windows\System\nJXLtkd.exe
  C:\Windows\System\nJXLtkd.exe
  2⤵
  PID:14416
- C:\Windows\System\gcLuors.exe
  C:\Windows\System\gcLuors.exe
  2⤵
  PID:14464
- C:\Windows\System\MKYkfTf.exe
  C:\Windows\System\MKYkfTf.exe
  2⤵
  PID:14560
- C:\Windows\System\OVICnVT.exe
  C:\Windows\System\OVICnVT.exe
  2⤵
  PID:14596
- C:\Windows\System\nEYjDzT.exe
  C:\Windows\System\nEYjDzT.exe
  2⤵
  PID:14708
- C:\Windows\System\IsbnbsJ.exe
  C:\Windows\System\IsbnbsJ.exe
  2⤵
  PID:14736
- C:\Windows\System\dtkTFZV.exe
  C:\Windows\System\dtkTFZV.exe
  2⤵
  PID:14812
- C:\Windows\System\xqrWSui.exe
  C:\Windows\System\xqrWSui.exe
  2⤵
  PID:14860
- C:\Windows\System\MkeFPii.exe
  C:\Windows\System\MkeFPii.exe
  2⤵
  PID:14072
- C:\Windows\System\LvIlEbm.exe
  C:\Windows\System\LvIlEbm.exe
  2⤵
  PID:14944
- C:\Windows\System\PXuZDCp.exe
  C:\Windows\System\PXuZDCp.exe
  2⤵
  PID:15028
- C:\Windows\System\kkbxsKz.exe
  C:\Windows\System\kkbxsKz.exe
  2⤵
  PID:15104
- C:\Windows\System\nauvjhv.exe
  C:\Windows\System\nauvjhv.exe
  2⤵
  PID:15140
- C:\Windows\System\mbfFyLy.exe
  C:\Windows\System\mbfFyLy.exe
  2⤵
  PID:15228
- C:\Windows\System\oMihWab.exe
  C:\Windows\System\oMihWab.exe
  2⤵
  PID:15344
- C:\Windows\System\oOJTlUT.exe
  C:\Windows\System\oOJTlUT.exe
  2⤵
  PID:14060
- C:\Windows\System\biSBUIc.exe
  C:\Windows\System\biSBUIc.exe
  2⤵
  PID:14556
- C:\Windows\System\CgRLpmC.exe
  C:\Windows\System\CgRLpmC.exe
  2⤵
  PID:14720
- C:\Windows\System\cgXQixY.exe
  C:\Windows\System\cgXQixY.exe
  2⤵
  PID:14828
- C:\Windows\System\wevFwIw.exe
  C:\Windows\System\wevFwIw.exe
  2⤵
  PID:14912
- C:\Windows\System\vjFRBkT.exe
  C:\Windows\System\vjFRBkT.exe
  2⤵
  PID:15132
- C:\Windows\System\YzmLFPM.exe
  C:\Windows\System\YzmLFPM.exe
  2⤵
  PID:15208
- C:\Windows\System\jigLGHq.exe
  C:\Windows\System\jigLGHq.exe
  2⤵
  PID:14020
- C:\Windows\System\oiISbRp.exe
  C:\Windows\System\oiISbRp.exe
  2⤵
  PID:14932
- C:\Windows\System\fSqkyFS.exe
  C:\Windows\System\fSqkyFS.exe
  2⤵
  PID:15052
- C:\Windows\System\qsgRqLH.exe
  C:\Windows\System\qsgRqLH.exe
  2⤵
  PID:14640
- C:\Windows\System\LqJdXHa.exe
  C:\Windows\System\LqJdXHa.exe
  2⤵
  PID:14536
- C:\Windows\System\pBJSzrA.exe
  C:\Windows\System\pBJSzrA.exe
  2⤵
  PID:15388
- C:\Windows\System\ZBukYUO.exe
  C:\Windows\System\ZBukYUO.exe
  2⤵
  PID:15436
- C:\Windows\System\JJxPSoq.exe
  C:\Windows\System\JJxPSoq.exe
  2⤵
  PID:15456
- C:\Windows\System\hEVaWLo.exe
  C:\Windows\System\hEVaWLo.exe
  2⤵
  PID:15476
- C:\Windows\System\DeRJKGQ.exe
  C:\Windows\System\DeRJKGQ.exe
  2⤵
  PID:15504
- C:\Windows\System\WEqDnaW.exe
  C:\Windows\System\WEqDnaW.exe
  2⤵
  PID:15528
- C:\Windows\System\ZUmVwLF.exe
  C:\Windows\System\ZUmVwLF.exe
  2⤵
  PID:15544
- C:\Windows\System\HhUkzcl.exe
  C:\Windows\System\HhUkzcl.exe
  2⤵
  PID:15568
- C:\Windows\System\Cpizphq.exe
  C:\Windows\System\Cpizphq.exe
  2⤵
  PID:15612
- C:\Windows\System\nnQRLKo.exe
  C:\Windows\System\nnQRLKo.exe
  2⤵
  PID:15628
- C:\Windows\System\iGwFhNX.exe
  C:\Windows\System\iGwFhNX.exe
  2⤵
  PID:15660
- C:\Windows\System\vlOsXlT.exe
  C:\Windows\System\vlOsXlT.exe
  2⤵
  PID:15692
- C:\Windows\System\ltjZQtG.exe
  C:\Windows\System\ltjZQtG.exe
  2⤵
  PID:15724
- C:\Windows\System\EsfkHkP.exe
  C:\Windows\System\EsfkHkP.exe
  2⤵
  PID:15752
- C:\Windows\System\twFJBcQ.exe
  C:\Windows\System\twFJBcQ.exe
  2⤵
  PID:15780
- C:\Windows\System\uqoJenw.exe
  C:\Windows\System\uqoJenw.exe
  2⤵
  PID:15800
- C:\Windows\System\mKpPgLn.exe
  C:\Windows\System\mKpPgLn.exe
  2⤵
  PID:15832
- C:\Windows\System\sSBKrJQ.exe
  C:\Windows\System\sSBKrJQ.exe
  2⤵
  PID:15856
- C:\Windows\System\eSFFEIo.exe
  C:\Windows\System\eSFFEIo.exe
  2⤵
  PID:15880
- C:\Windows\System\RIrSjzk.exe
  C:\Windows\System\RIrSjzk.exe
  2⤵
  PID:15936
- C:\Windows\System\gkNSDOH.exe
  C:\Windows\System\gkNSDOH.exe
  2⤵
  PID:15964
- C:\Windows\System\nflhSaP.exe
  C:\Windows\System\nflhSaP.exe
  2⤵
  PID:15980
- C:\Windows\System\SXweGPw.exe
  C:\Windows\System\SXweGPw.exe
  2⤵
  PID:16020
- C:\Windows\System\NLwzMum.exe
  C:\Windows\System\NLwzMum.exe
  2⤵
  PID:16036
- C:\Windows\System\NTxIunk.exe
  C:\Windows\System\NTxIunk.exe
  2⤵
  PID:16076
- C:\Windows\System\ZkYGJCp.exe
  C:\Windows\System\ZkYGJCp.exe
  2⤵
  PID:16100
- C:\Windows\System\gjIyYUB.exe
  C:\Windows\System\gjIyYUB.exe
  2⤵
  PID:16132
- C:\Windows\System\kZzrPYq.exe
  C:\Windows\System\kZzrPYq.exe
  2⤵
  PID:16152
- C:\Windows\System\pQzEqZh.exe
  C:\Windows\System\pQzEqZh.exe
  2⤵
  PID:16176
- C:\Windows\System\wtWlrMk.exe
  C:\Windows\System\wtWlrMk.exe
  2⤵
  PID:16192
- C:\Windows\System\qgfwfty.exe
  C:\Windows\System\qgfwfty.exe
  2⤵
  PID:16220
- C:\Windows\System\UzLgSsX.exe
  C:\Windows\System\UzLgSsX.exe
  2⤵
  PID:16244
- C:\Windows\System\FWdmZmQ.exe
  C:\Windows\System\FWdmZmQ.exe
  2⤵
  PID:16300
- C:\Windows\System\pCmUrQJ.exe
  C:\Windows\System\pCmUrQJ.exe
  2⤵
  PID:16320
- C:\Windows\System\ottqOtn.exe
  C:\Windows\System\ottqOtn.exe
  2⤵
  PID:16336
- C:\Windows\System\KdTmurA.exe
  C:\Windows\System\KdTmurA.exe
  2⤵
  PID:16360
- C:\Windows\System\UcjJVoU.exe
  C:\Windows\System\UcjJVoU.exe
  2⤵
  PID:15192
- C:\Windows\System\WJtzQHp.exe
  C:\Windows\System\WJtzQHp.exe
  2⤵
  PID:15408
- C:\Windows\System\tUXDROq.exe
  C:\Windows\System\tUXDROq.exe
  2⤵
  PID:15296
- C:\Windows\System\DOUoEND.exe
  C:\Windows\System\DOUoEND.exe
  2⤵
  PID:15588
- C:\Windows\System\YtEDjJH.exe
  C:\Windows\System\YtEDjJH.exe
  2⤵
  PID:15640
- C:\Windows\System\hBRUojG.exe
  C:\Windows\System\hBRUojG.exe
  2⤵
  PID:15712
- C:\Windows\System\hpYGqZz.exe
  C:\Windows\System\hpYGqZz.exe
  2⤵
  PID:15764
- C:\Windows\System\BkWdLhR.exe
  C:\Windows\System\BkWdLhR.exe
  2⤵
  PID:15868
- C:\Windows\System\bJwiztN.exe
  C:\Windows\System\bJwiztN.exe
  2⤵
  PID:15920
- C:\Windows\System\IZeyioF.exe
  C:\Windows\System\IZeyioF.exe
  2⤵
  PID:15976
- C:\Windows\System\scnpVhA.exe
  C:\Windows\System\scnpVhA.exe
  2⤵
  PID:16032
- C:\Windows\System\thXROpf.exe
  C:\Windows\System\thXROpf.exe
  2⤵
  PID:16068
- C:\Windows\System\HyBoYip.exe
  C:\Windows\System\HyBoYip.exe
  2⤵
  PID:16140
- C:\Windows\System\ybwCgHc.exe
  C:\Windows\System\ybwCgHc.exe
  2⤵
  PID:16212
- C:\Windows\System\EPnUuBo.exe
  C:\Windows\System\EPnUuBo.exe
  2⤵
  PID:16232
- C:\Windows\System\njDIuPa.exe
  C:\Windows\System\njDIuPa.exe
  2⤵
  PID:16348
- C:\Windows\System\FVNeNaq.exe
  C:\Windows\System\FVNeNaq.exe
  2⤵
  PID:15444
- C:\Windows\System\unyXZNF.exe
  C:\Windows\System\unyXZNF.exe
  2⤵
  PID:15516
- C:\Windows\System\LDolEJQ.exe
  C:\Windows\System\LDolEJQ.exe
  2⤵
  PID:15648
- C:\Windows\System\KTwFcoc.exe
  C:\Windows\System\KTwFcoc.exe
  2⤵
  PID:15788
- C:\Windows\System\rcqdbaN.exe
  C:\Windows\System\rcqdbaN.exe
  2⤵
  PID:15948
- C:\Windows\System\DBjEyCy.exe
  C:\Windows\System\DBjEyCy.exe
  2⤵
  PID:16072
- C:\Windows\System\SbLeYDN.exe
  C:\Windows\System\SbLeYDN.exe
  2⤵
  PID:16184
- C:\Windows\System\TpNdTCH.exe
  C:\Windows\System\TpNdTCH.exe
  2⤵
  PID:15620
- C:\Windows\System\bdczUpm.exe
  C:\Windows\System\bdczUpm.exe
  2⤵
  PID:16008
- C:\Windows\System\ifzCvjF.exe
  C:\Windows\System\ifzCvjF.exe
  2⤵
  PID:16108
- C:\Windows\System\ApbSCGz.exe
  C:\Windows\System\ApbSCGz.exe
  2⤵
  PID:16188
- C:\Windows\System\NpwuxMZ.exe
  C:\Windows\System\NpwuxMZ.exe
  2⤵
  PID:16396
- C:\Windows\System\ovWLIZv.exe
  C:\Windows\System\ovWLIZv.exe
  2⤵
  PID:16424
- C:\Windows\System\JuwtEbi.exe
  C:\Windows\System\JuwtEbi.exe
  2⤵
  PID:16440
- C:\Windows\System\epWDsaM.exe
  C:\Windows\System\epWDsaM.exe
  2⤵
  PID:16476
- C:\Windows\System\dnJzyUS.exe
  C:\Windows\System\dnJzyUS.exe
  2⤵
  PID:16496
- C:\Windows\System\sQLwlgA.exe
  C:\Windows\System\sQLwlgA.exe
  2⤵
  PID:16524
- C:\Windows\System\DcSREPZ.exe
  C:\Windows\System\DcSREPZ.exe
  2⤵
  PID:16540
- C:\Windows\System\RhOhkoz.exe
  C:\Windows\System\RhOhkoz.exe
  2⤵
  PID:16564
- C:\Windows\System\eyQlNBH.exe
  C:\Windows\System\eyQlNBH.exe
  2⤵
  PID:16604
- C:\Windows\System\kbbDBwm.exe
  C:\Windows\System\kbbDBwm.exe
  2⤵
  PID:16628
- C:\Windows\System\TYJtrfg.exe
  C:\Windows\System\TYJtrfg.exe
  2⤵
  PID:16656
- C:\Windows\System\IiTSCaU.exe
  C:\Windows\System\IiTSCaU.exe
  2⤵
  PID:16676
- C:\Windows\System\llkhVqr.exe
  C:\Windows\System\llkhVqr.exe
  2⤵
  PID:16732
- C:\Windows\System\zSRyiTP.exe
  C:\Windows\System\zSRyiTP.exe
  2⤵
  PID:16748
- C:\Windows\System\IPLtXBk.exe
  C:\Windows\System\IPLtXBk.exe
  2⤵
  PID:16768
- C:\Windows\System\vLZeziw.exe
  C:\Windows\System\vLZeziw.exe
  2⤵
  PID:16800
- C:\Windows\System\yQnCgTZ.exe
  C:\Windows\System\yQnCgTZ.exe
  2⤵
  PID:16824
- C:\Windows\System\qTlcqMl.exe
  C:\Windows\System\qTlcqMl.exe
  2⤵
  PID:16872
- C:\Windows\System\fFoeyOz.exe
  C:\Windows\System\fFoeyOz.exe
  2⤵
  PID:16892
- C:\Windows\System\cbRHBJr.exe
  C:\Windows\System\cbRHBJr.exe
  2⤵
  PID:16916
- C:\Windows\System\IxtLAHK.exe
  C:\Windows\System\IxtLAHK.exe
  2⤵
  PID:16944
- C:\Windows\System\zrcTTtX.exe
  C:\Windows\System\zrcTTtX.exe
  2⤵
  PID:16964
- C:\Windows\System\vPDtKkO.exe
  C:\Windows\System\vPDtKkO.exe
  2⤵
  PID:16988
- C:\Windows\System\eDCmCXP.exe
  C:\Windows\System\eDCmCXP.exe
  2⤵
  PID:17028
- C:\Windows\System\DEidLrP.exe
  C:\Windows\System\DEidLrP.exe
  2⤵
  PID:17052

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:16432

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\BFJSJGA.exe

Filesize
1.4MB

MD5
f5829e24f9a9acba9344a7c6bd1fd98b

SHA1
7a622c2951c77abc85849174850a718f621ff1bc

SHA256
92c1a459993552e9c842f88af6c5c824ca02adaac0f4adc02cf692ca9d7b976c

SHA512
347e80de7e11753310d400a585928d6a6d52242e5c7cf697242bf0b7a81411d60e9c001b30f1977937a96fb64e82da8069e418ffdd70eac4cef98bfe733851c2

Download Submit
C:\Windows\System\BpanyIN.exe

Filesize
1.4MB

MD5
4e25510074430c6816e5aa4036791881

SHA1
8a89594ca5426288aa9c310270400eaa97102556

SHA256
d6618efd782baa1e521f9c444731faf7e1469340da35f7361ae1eef613900843

SHA512
bdfa19910dfd8233aa56f0d8ba3c2ff0dca81c95252155ec9b4cbe29ef40b7d3a7b14cd5ca4c4a82a9b545ca21f7772e062b0f462fd5ffbc56bf11cc7fe0fe33

Download Submit
C:\Windows\System\CMrzWai.exe

Filesize
1.4MB

MD5
bb44608e1957396083ecbdd65f27cb42

SHA1
c8d928aff34466a45e21a5a35d6c24b843519579

SHA256
82e8577423eb508c9c8aa08e7db4d0f863296c42454a325dba43adc679cea012

SHA512
269f1c74fe47679602279a1ca6f982ecc45b574e5180fde3975a2721288844d961675ddd22d522bffb0aba44209d4826b4788d2768327a535a0eccafced0af12

Download Submit
C:\Windows\System\EbkWoCl.exe

Filesize
1.4MB

MD5
26e4091a85435ca0693687322ff5bd5c

SHA1
7364b8f238da0c1a58f0973fde45daadc7f3c0f3

SHA256
52a0f7288dee181d6315c8b12794b3c9b4a3374f2f286ae0ccd345193d95e2dd

SHA512
7cb09015f7d5fae979e4d3cbba211c0ea6210199ca406fe05a41bc79ecdb3c95f48b5730f2b363239c1508781ab53cf157d63580e9bed3cb4d8fd69996d4be2f

Download Submit
C:\Windows\System\ErIDeAw.exe

Filesize
1.4MB

MD5
3ad4bf6191e835e0b43e6f3e61c44e69

SHA1
f2827b0b14c12521c00f578b7ddd73ca8036ec14

SHA256
5b38f06e38e1e558437646c2ea7400d8599c31b7aa743d75147b537a189050e7

SHA512
ee6d899114a848878276cb17eb4d5b6426565d8c783db147b9c468b852a66eee9ae228f62bf06abdf9a089c8fb321b1bb4ca5db6a7a6d4ed9d9febe9ca0dfe05

Download Submit
C:\Windows\System\FTpMfly.exe

Filesize
1.4MB

MD5
0d00ed0061d9406994f599c72d163916

SHA1
e97d9d431e688b88e6ec4f104d43704db906312d

SHA256
83677c992c310f35d37e872875bdc0c35fb6fe4ac74748f648a5b1da23bbc440

SHA512
186720da58d709513b363fc932e8560c3cb537f42ef9cb5304175ce9a950dadb5032256e22a647c94892978b357dd0e8221dc153570d5985dd13e0cd7f27d0aa

Download Submit
C:\Windows\System\GhKsQUL.exe

Filesize
1.4MB

MD5
35ac4932e3b23dbfc309b0ff560f8355

SHA1
24d7113b4856336dfd61caa5973e65521850585d

SHA256
1f977929a3e1609ea19e3a0fd2fcf0724d7d41b4ea8b96416be1ac9638929faf

SHA512
dae535484117fadf0ff5e617c1f62cbc7ee9f5acac77a43c607002714d5ab841c7a354f811d0748cab3202b8b6c4c6e868180e036c093b55f2c21f27742327fe

Download Submit
C:\Windows\System\GrVUXMz.exe

Filesize
1.4MB

MD5
1d0f45684ce90806e7c0622cb5b215e4

SHA1
a1679774d227b852a7d0f23384a8518474dc1b4f

SHA256
2a45fe9bf59669add3f969cb8dd8f316b3f5845b6c79f913d8db846762014528

SHA512
a03d122e5a580d4f67ce7afd19dddf2b757b47911b465c4c51f7e547d4d40941df6652483ac4dfcffb302919dd21ac3e5d53ce3cfc96f5fc240324eb3778e2ed

Download Submit
C:\Windows\System\LkPokxw.exe

Filesize
1.4MB

MD5
8938ac3ad1e4ca728ef1ab56a05953ab

SHA1
bb0218d10aea76a48ed97429595b6f2c40f196a7

SHA256
ecd7638417491021dfdc94185c8f1201b6c638d23fae17a737262484332773aa

SHA512
7865cdf4515cb5758a2881ccb4361444aa5612d2c2ca0696cfa7cc1f341379a93395a3483669c45454316ae77b17b4c99cecfd210d33a36befde0f41d6482fb2

Download Submit
C:\Windows\System\NOliLUh.exe

Filesize
1.4MB

MD5
2e23a45a9e7198043f04d05c581b6946

SHA1
1fd2b1c608fed49857ce3adcf527e6bc2ff0f6a6

SHA256
f10dfa5ba7e6e1c26dd8f295a4c5e90d93e4e6bfa64a1afdcaf1f1bc3f832447

SHA512
f34134d954166e0798db21809fb6330b5c35a07accf44141e0e988655da518add3ddcc7e6c94a012cdf9d100fb48fadd4f2d0505b8810f848d5cf0e47ce299af

Download Submit
C:\Windows\System\NYzBTzR.exe

Filesize
1.4MB

MD5
9a529e7dcdd75a078024417ada1de198

SHA1
b0a10a4fafab221e801afa785f237394a0ad8e10

SHA256
d023ca659790e22ae1c34769432cbf521b164c8984f93c13ebde56f8472ca0dc

SHA512
e58bf5d8a8ec128bc3d8e512b5fd7403ff3a5c3ef2370d8d81ac32b73dfd298dfa8f12bd7be14ea3e2028a53e627e7eca4a13be5390af35956585f0e88f7e06d

Download Submit
C:\Windows\System\PQvcVJe.exe

Filesize
1.4MB

MD5
aed2bcc841aba0e295f3834042712890

SHA1
32d5f6302ea88f81dc497bc458ad17093fef7ed4

SHA256
9251b1833f655c32978207ba341edea94e81c3440c22d6ec7f83e309f3cb13ce

SHA512
b2fa32f897a7603dbafe3cd451c602d713f0ac18c50efe44a5a53b5c9bc5bcd32cbd846c6383a2cae04efc7c7b20db594786a3da18edcd47dfc22797abe4397d

Download Submit
C:\Windows\System\XqwuiGz.exe

Filesize
1.5MB

MD5
c54aad3f93202a90b5728e103cd106be

SHA1
a7c20dbb63af612bf573d8e6433a0eb2142ef6cf

SHA256
06627cc7e57e89c5bcb8e7f2347a62e512cac1820d53988144d35eae3652096e

SHA512
39905743f58cb1824226c483bf7d4c3216395472515d8c55d0f2036733d04cd4adf07fe960ea8a76d5955f0be89a4d6a0db3004f3180c7de68f5b31d10c473c3

Download Submit
C:\Windows\System\XwKqHJu.exe

Filesize
1.4MB

MD5
13b277c073bb01e29a3635308d467eae

SHA1
dd49382b051894d4a1080adab37aa8b8d4e20639

SHA256
7b10e10b73d690d61f292510ed8d0d429d6244315f494d7c07b80d8860bc21cf

SHA512
2b8e58e089968c3e4c3f0f0d2614be12177d9e322de468db2811731fc391e361475c666bd06748bbd00a802defe9dd5159ac80873aba677a30eeaf7e6155b0a9

Download Submit
C:\Windows\System\YxrZDNt.exe

Filesize
1.4MB

MD5
92e164c1603ed9fc2d74787887a9abb0

SHA1
ea1d61fe1fcf1fc9815327248802059f1a3a0464

SHA256
a4eaaafd7584616923b553f8de95c5cd82819be0652da2cd70e6f2d8176fa20c

SHA512
ae2200340d0cd9167f69b63c632eb6cc875b53ef3fe5851b3ac963dada7ef3883d7d7c98836bbd0b027a3595e67969d1a830ae907a732e8c38002ca960ed28dd

Download Submit
C:\Windows\System\ZZkiqtc.exe

Filesize
1.4MB

MD5
f845c636bea587deee437533053432e5

SHA1
a23415af19aee652f5b268eb599525582b99cd9c

SHA256
e72e0a5903752a3fe71bcca7d8c6543e41bf2f04d3be81389c3f44ea5ee0bb4e

SHA512
4a8dba6d62024bf808326cc5828073215e5408a690d14af35e3a470a53f0c88d62f69c60f33f6cc30f49196a717b997f72e8e8a011d4cad4bdbbe09bf008bbc5

Download Submit
C:\Windows\System\aLqUFZb.exe

Filesize
1.4MB

MD5
30c9e1e9d8a5eda30e803fd8f58ce997

SHA1
4af0579720c767623b464af0682c943b3888501c

SHA256
83a9faf00d58e0fb750bab13ba73d01fd77f6a9d5689ab467d85549d4cbda5ac

SHA512
2ff799059dd1f523020dba1ff1228869e70e4293808334c517b8b49844807623739a178dead6a1d642885bca23da0017cef60ad5408cd562ca3faea469763e10

Download Submit
C:\Windows\System\bDosXtZ.exe

Filesize
1.4MB

MD5
474c5f5506edd55683c439acb43d2884

SHA1
7f6f9a57e664f21ea753171c1b561ec8bf76e046

SHA256
736398c2bc82172bc535c15f66514cc240c3c191b78f07da033e965ef8f12244

SHA512
19923f31feacf9d8066358ec0111a7af3535558b361b318d1d5eb8b5871765c175b3e3fd4a521e357269e24046e1f6add764b7aee8965f5bc48d2b8f83a5cd3b

Download Submit
C:\Windows\System\bjJufzi.exe

Filesize
1.4MB

MD5
df35b5ef7548c3c7a975fa9ff0250fd5

SHA1
d6f41fc1f34b1aa873a1e8ac65fa4cf4af9feaa5

SHA256
b4069ecc1fdcd368d50a147332ff870ea1a1e3e6e56d07f65ea01755355c0e35

SHA512
a98771ad47c610b495177b7e8bdf84d89cab980e31d5839a5698a976ff0e131fe062f95ac55ce2d0cc7346f73d6d682b5d5c5459a44ec7e70559360e6601ecde

Download Submit
C:\Windows\System\cQAifJG.exe

Filesize
1.4MB

MD5
a9d6ff5d3875142a780eb65f5ce2760f

SHA1
afc2707c84aeb00cdf727a2beadbbd5a0214b6a9

SHA256
e668b4fdabd0384df5e9be4142252e0b8bd6df365ff43f07d306ff33f96a80a6

SHA512
84d230beba08d5a36d5f052900ad7f2f5a3a2ad034b4f3cf6f563eeede264363fa70263290170e8076b7767e198706956f48072b816d63640991e6749333a14b

Download Submit
C:\Windows\System\cmMFiTk.exe

Filesize
1.5MB

MD5
f7bb269e8ca19cdc114c34d1f522a0b2

SHA1
1337ca473c53d279ecf884d6e958b59189de74e3

SHA256
17c9403ce2ac0e896ef9d0a08d964ea8975b216eabe92a93fb7439e7d6e47d64

SHA512
4a0378c9e89982f17127a612b24912f2b97d7f4cf9c978a154c937f95fd93b16b20168f9c6794a3a9a093e3174b4ecb67fc1f875c4fe6eb7a0ee3ff961999f29

Download Submit
C:\Windows\System\dwGEMrk.exe

Filesize
1.4MB

MD5
a969e35c8d78ee03d02112ded3f75f0b

SHA1
2f6162401b1d834504099b79cb93b8fa7d54f12e

SHA256
77e280ed55ace55d25c2dbf8e649e0acf1dc976a8a056e4a9aab0676f41cd1b8

SHA512
60249a2bd3c4a6f32df33aa50ee50a04aee6ddcc1106e3c97ca77497376793548a21cdbb7fe5dd0ec30bee27151a014f6c6b961305566121091320f376eae6be

Download Submit
C:\Windows\System\fbYfCED.exe

Filesize
1.4MB

MD5
dd1085796c7eeecdd2ca6abeaa8ddbe6

SHA1
e29c5b3a3493961b2ef08c09f6ed22bd5485e41e

SHA256
f5eb36acac6a5832730c143361f0a8e75dd0561dffd3a03f65360d8c286c2f45

SHA512
d72ec3c09ecb1711cd7ef16299af8c9f49caca1319aedd49ddb79c1d7f3262fa56459f010c555a59e2cebb4a7939ff33612d8c001410498af1602a2db606c063

Download Submit
C:\Windows\System\ijPTbRQ.exe

Filesize
1.4MB

MD5
436e0163079526c40790801a9a941054

SHA1
ec5033003d80f095b5b5d0d0cb0c4e541a54da10

SHA256
6c6ad38bd4c7f13f24176b392f752976cdbdf2e1dcfb4268974d822ecfa015fc

SHA512
f69f89fb6e3497bd6c65bfd6ddb18213cea278806284efacc3d55ea7786a9602b64f4bb97bdc0cdb290ff9d3aea3ac751289492c381defdcbc34fa659e2e01b8

Download Submit
C:\Windows\System\mSOXvZF.exe

Filesize
1.4MB

MD5
9ac34295588c26b236d680b2a449059b

SHA1
01bd45d0fc989b2d60b14bd0c52d9bf3d9f0db57

SHA256
c7e9af8dbe41e32cd17bee001bca367a2e144c44d0391b5f9eb7724cf67b968c

SHA512
bf9886f336983b17fc5756ba5fddef7b907ac63391cd5114a95bb3c460792cc33c10afc491781fcfed9d489146f17fe1bf12886c7546231c055b2a758e764fb1

Download Submit
C:\Windows\System\oSkHoMH.exe

Filesize
1.4MB

MD5
15179918f1858f0aa23030c79d5dd67c

SHA1
eefd3d6d818e5fd513b17a2788ff9cb10838b7d6

SHA256
31c51e01ace2550356c93a129b10baee287e1a127746f7386fb680ddcb743d63

SHA512
d6d0e78e4286e99a0cc7e78bf2917a73278ea84525b2e9d6a57519f0294ff66491b001c95a062d83cc8d1c2bf101512b1dc95f8b3efbb82838c0f68d8f1b076b

Download Submit
C:\Windows\System\tFXMNoY.exe

Filesize
1.4MB

MD5
d206890c0f6d43e110ccaa2c4bf91a18

SHA1
bd7414ae34ac43dfd3ec51301ad3c0789a96637a

SHA256
3f4ccb08fabb5368abfcacf4453664112a7b1cd1340db0de1f0cd88b57fdb690

SHA512
9364b20271b32d3513802ff0131a712a76e5f342ec1dd80456ab6812b33526bc7ed1106a714bc494e02d006985d745e26469952fda29b4d5706bc002523af309

Download Submit
C:\Windows\System\uBioFAx.exe

Filesize
1.4MB

MD5
6ea3e200268e552faff0ccb0567c286e

SHA1
9fda1f90aaf19cbb76485a903cbde591ecaeb799

SHA256
d46e649068311c79cac7eec338f20220cc19589b5ba47ec8344c1374f95e1215

SHA512
345ccb961c830c6a38cb09e1eea7a95b89ed43c88532387fad932ed46045af52de8d9e29f13c9beb4cba9ff0a7da3024f714f967ea41f8d32fd09f7479f09783

Download Submit
C:\Windows\System\xChkJCv.exe

Filesize
1.4MB

MD5
5dfe509927f68ed269ce4d7872f11af0

SHA1
aaf28f14abbdc789ea2be9e79753d2f242718a76

SHA256
2e3d4b29e4f80b629995dd0f97ca3bee9d85708c87fe7466ced932a6ac286123

SHA512
abb44ea5cd9f1da449145438d27c2c6177c57ae24bcba69d89992d8aff05074a2261a6b761241384295b148bac9dee754598bdfacbdb19d95e1d923fec4115a3

Download Submit
C:\Windows\System\yXcrRnF.exe

Filesize
1.4MB

MD5
3f7207824e11ca4f5212ea8429ea50d0

SHA1
18c1d0f7ec3c8d2de7739e35ce94c1b477c2c463

SHA256
a8113dbd8e0030baad49031ede1c8e298fb32261827409b45d1f884c8b7e3ea7

SHA512
e5dd87a8e09b7d643966e4c80f9b74caf92b9fa45789c9e94e6067e7bf7f5817dbf40427c4bc89431b3d84d281a73a06fef0d608b02796f08546275a78f797b0

Download Submit
C:\Windows\System\zKOGlCm.exe

Filesize
1.4MB

MD5
f3f192422d2e400f616da83122bbadfd

SHA1
0277738aa7dfaf042a3511c1ce63999b7b4a2000

SHA256
25ab1e2438b60f7c81179f738f570a3dbb7842e428d5831ea3ce1c5503026101

SHA512
c75047511973c13d3fa60e607b71c61ada0ce18a9f52b60712002c771b76661fc380caee735d7a1dfc3e662b95e910756659995c19ece9af1d969589aa737a01

Download Submit
C:\Windows\System\zZTvMdO.exe

Filesize
1.4MB

MD5
b9ba1700dd0aeee3707cdfedd18c2507

SHA1
f21fe4aa1f59160be89ea0bf3517b54aa01fc19c

SHA256
66bac64ba60421bbebab1ac75d21490b45ec81b5f497ff76239ef2254fcbb81b

SHA512
bad0f455ff54148608b75cb60648671379efa1c01ce17399e729cf4d6b4e1cd85640a02c133f4384a9b140912504c3ede7dd8681c4af92fb2a6eb983f9bb038b

Download Submit
C:\Windows\System\zhWyfOF.exe

Filesize
1.4MB

MD5
42703c8389a24d3377b10ca401b0eb6e

SHA1
07e9119c64b2daf072eea2c891fe784d12d161bf

SHA256
615cbf8e877e161f85da16b0e5ba56d38ea09b632e3e63476b053c4f0bad13af

SHA512
121ac3bab6d7b0d8328bb92360f7a5ec716ef71165e156a4772c16f67e5d6e8b4bc05e6c36ab26f2516ee17f9d04085bbc0c76792c16a662324987aff0559a4b

Download Submit
memory/2972-0-0x000001877F9C0000-0x000001877F9D0000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads