xmrig | 95988d955f4df172fba3454e5ff52279ad82c8381fa05100ff860c3530017ded

Analysis

max time kernel
131s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
23-12-2024 23:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

95988d955f4df172fba3454e5ff52279ad82c8381fa05100ff860c3530017ded.exe
Size

1.8MB
MD5

36f716d7d63d1ecdf2d1f8704ddc931c
SHA1

30e8bd7584a718fa430b921837ed1c79620cdfba
SHA256

95988d955f4df172fba3454e5ff52279ad82c8381fa05100ff860c3530017ded
SHA512

48d6b1fe8f985cbc37acdf104eda686bf21c0f36c7bbd5e1004ff40d562ec00dcbd5e60bd5e7bf939317812635e9e7a6a323c8089796bec4cd81fcc75b55ec28
SSDEEP

49152:GezaTF8FcNkNdfE0pZ9ozttwIRxj4c5yOYFg8ZYDMTg8E:GemTLkNdfE0pZyn

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 33 IoCs

miner

resource	yara_rule
behavioral2/files/0x000c000000023b1c-4.dat	xmrig
behavioral2/files/0x0031000000023b80-6.dat	xmrig
behavioral2/files/0x0031000000023b7f-8.dat	xmrig
behavioral2/files/0x0031000000023b81-17.dat	xmrig
behavioral2/files/0x000a000000023b82-24.dat	xmrig
behavioral2/files/0x000a000000023b83-28.dat	xmrig
behavioral2/files/0x000a000000023b84-32.dat	xmrig
behavioral2/files/0x000a000000023b85-40.dat	xmrig
behavioral2/files/0x000a000000023b86-43.dat	xmrig
behavioral2/files/0x000a000000023b87-48.dat	xmrig
behavioral2/files/0x000a000000023b88-54.dat	xmrig
behavioral2/files/0x000a000000023b89-61.dat	xmrig
behavioral2/files/0x000a000000023b8b-68.dat	xmrig
behavioral2/files/0x000a000000023b90-94.dat	xmrig
behavioral2/files/0x000a000000023b91-100.dat	xmrig
behavioral2/files/0x000a000000023b8f-101.dat	xmrig
behavioral2/files/0x000a000000023b8e-97.dat	xmrig
behavioral2/files/0x000a000000023b8d-90.dat	xmrig
behavioral2/files/0x000a000000023b8c-85.dat	xmrig
behavioral2/files/0x000a000000023b8a-72.dat	xmrig
behavioral2/files/0x000b000000023b7c-69.dat	xmrig
behavioral2/files/0x000a000000023b92-108.dat	xmrig
behavioral2/files/0x000a000000023b93-114.dat	xmrig
behavioral2/files/0x000a000000023b94-119.dat	xmrig
behavioral2/files/0x000a000000023b95-125.dat	xmrig
behavioral2/files/0x000a000000023b96-129.dat	xmrig
behavioral2/files/0x000a000000023b98-138.dat	xmrig
behavioral2/files/0x000a000000023b97-135.dat	xmrig
behavioral2/files/0x000a000000023b9a-147.dat	xmrig
behavioral2/files/0x000a000000023b99-144.dat	xmrig
behavioral2/files/0x000a000000023b9b-153.dat	xmrig
behavioral2/files/0x000a000000023b9c-157.dat	xmrig
behavioral2/files/0x000a000000023b9d-162.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2996	OgzFdfF.exe
960	awCfyky.exe
3104	SnmCBEW.exe
4884	fWOrUke.exe
1836	BXsLydd.exe
228	EGgqROZ.exe
4820	HCmNqRW.exe
4892	AJeEuTl.exe
732	tdMwItn.exe
1224	rALBDlA.exe
1016	GdXmJeW.exe
1924	xEvvUBJ.exe
4964	nRiOTnX.exe
1852	GMQcDnV.exe
1584	iWYRDoa.exe
2044	ObiWnyp.exe
1488	kXhndBu.exe
4616	oesKEcc.exe
3108	CtiERjt.exe
3588	FmNcGmQ.exe
3840	EjYVjRy.exe
2764	CZRDZol.exe
4508	pzaJYAa.exe
3652	rFIgSaC.exe
1104	fVhOGzK.exe
3244	GmfMdsb.exe
2588	dLbeqKC.exe
3940	xRdIEvW.exe
1372	HdMmydY.exe
2204	lypAWjI.exe
3384	TJALGGV.exe
8	zjbAyWv.exe
4020	VyxuPmZ.exe
1352	zTJFbnw.exe
3160	aovpuPt.exe
3220	QlFZcyr.exe
1956	XWrvwIw.exe
4564	YEYQgBD.exe
1504	sowopsA.exe
1952	JeIFyBl.exe
1156	sFCGtqs.exe
1804	LRDcpsm.exe
3768	xtTVXBg.exe
2448	BzzlCJc.exe
1752	olbUONo.exe
2452	zwyKqoC.exe
3448	zcbKHCb.exe
3832	rInYsZw.exe
4088	RKhJRMl.exe
1824	DHNHXBA.exe
3712	boCgrTV.exe
1356	zgYyumL.exe
1992	DuNtmQm.exe
4776	dBpcHwh.exe
1548	LORrdvr.exe
4600	LDThxYO.exe
2152	CiSwnfB.exe
752	jGpuEtJ.exe
1644	dblUsIM.exe
4420	Nwxmznn.exe
4408	MnCsVnt.exe
4584	ERCfGqn.exe
3672	ApRpYVA.exe
760	edQRthk.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\DSgyTeC.exe	95988d955f4df172fba3454e5ff52279ad82c8381fa05100ff860c3530017ded.exe
File created	C:\Windows\System\BdxhdMd.exe	95988d955f4df172fba3454e5ff52279ad82c8381fa05100ff860c3530017ded.exe
File created	C:\Windows\System\TJALGGV.exe	95988d955f4df172fba3454e5ff52279ad82c8381fa05100ff860c3530017ded.exe
File created	C:\Windows\System\xtTVXBg.exe	95988d955f4df172fba3454e5ff52279ad82c8381fa05100ff860c3530017ded.exe
File created	C:\Windows\System\AhutLsy.exe	95988d955f4df172fba3454e5ff52279ad82c8381fa05100ff860c3530017ded.exe
File created	C:\Windows\System\IZEYbfS.exe	95988d955f4df172fba3454e5ff52279ad82c8381fa05100ff860c3530017ded.exe
File created	C:\Windows\System\JXwlAUX.exe	95988d955f4df172fba3454e5ff52279ad82c8381fa05100ff860c3530017ded.exe
File created	C:\Windows\System\PSyNwsB.exe	95988d955f4df172fba3454e5ff52279ad82c8381fa05100ff860c3530017ded.exe
File created	C:\Windows\System\bDRfsOJ.exe	95988d955f4df172fba3454e5ff52279ad82c8381fa05100ff860c3530017ded.exe
File created	C:\Windows\System\CxVUUWJ.exe	95988d955f4df172fba3454e5ff52279ad82c8381fa05100ff860c3530017ded.exe
File created	C:\Windows\System\uPbxkZP.exe	95988d955f4df172fba3454e5ff52279ad82c8381fa05100ff860c3530017ded.exe
File created	C:\Windows\System\mtoXUWP.exe	95988d955f4df172fba3454e5ff52279ad82c8381fa05100ff860c3530017ded.exe
File created	C:\Windows\System\nHovAWy.exe	95988d955f4df172fba3454e5ff52279ad82c8381fa05100ff860c3530017ded.exe
File created	C:\Windows\System\zvwlHrm.exe	95988d955f4df172fba3454e5ff52279ad82c8381fa05100ff860c3530017ded.exe
File created	C:\Windows\System\beDeAsi.exe	95988d955f4df172fba3454e5ff52279ad82c8381fa05100ff860c3530017ded.exe
File created	C:\Windows\System\DMIvrFO.exe	95988d955f4df172fba3454e5ff52279ad82c8381fa05100ff860c3530017ded.exe
File created	C:\Windows\System\cOKHYGN.exe	95988d955f4df172fba3454e5ff52279ad82c8381fa05100ff860c3530017ded.exe
File created	C:\Windows\System\RxtOivB.exe	95988d955f4df172fba3454e5ff52279ad82c8381fa05100ff860c3530017ded.exe
File created	C:\Windows\System\olQPBvn.exe	95988d955f4df172fba3454e5ff52279ad82c8381fa05100ff860c3530017ded.exe
File created	C:\Windows\System\BrUIrFi.exe	95988d955f4df172fba3454e5ff52279ad82c8381fa05100ff860c3530017ded.exe
File created	C:\Windows\System\RJCWIbt.exe	95988d955f4df172fba3454e5ff52279ad82c8381fa05100ff860c3530017ded.exe
File created	C:\Windows\System\DmKeooJ.exe	95988d955f4df172fba3454e5ff52279ad82c8381fa05100ff860c3530017ded.exe
File created	C:\Windows\System\TveNVXG.exe	95988d955f4df172fba3454e5ff52279ad82c8381fa05100ff860c3530017ded.exe
File created	C:\Windows\System\JZsSRcA.exe	95988d955f4df172fba3454e5ff52279ad82c8381fa05100ff860c3530017ded.exe
File created	C:\Windows\System\CuZZxLz.exe	95988d955f4df172fba3454e5ff52279ad82c8381fa05100ff860c3530017ded.exe
File created	C:\Windows\System\WsgfLAk.exe	95988d955f4df172fba3454e5ff52279ad82c8381fa05100ff860c3530017ded.exe
File created	C:\Windows\System\edVsHag.exe	95988d955f4df172fba3454e5ff52279ad82c8381fa05100ff860c3530017ded.exe
File created	C:\Windows\System\oUgFnCn.exe	95988d955f4df172fba3454e5ff52279ad82c8381fa05100ff860c3530017ded.exe
File created	C:\Windows\System\baagafN.exe	95988d955f4df172fba3454e5ff52279ad82c8381fa05100ff860c3530017ded.exe
File created	C:\Windows\System\hHgoyLS.exe	95988d955f4df172fba3454e5ff52279ad82c8381fa05100ff860c3530017ded.exe
File created	C:\Windows\System\cucNyuH.exe	95988d955f4df172fba3454e5ff52279ad82c8381fa05100ff860c3530017ded.exe
File created	C:\Windows\System\ylKbPMP.exe	95988d955f4df172fba3454e5ff52279ad82c8381fa05100ff860c3530017ded.exe
File created	C:\Windows\System\VeiIFve.exe	95988d955f4df172fba3454e5ff52279ad82c8381fa05100ff860c3530017ded.exe
File created	C:\Windows\System\mwEnnjS.exe	95988d955f4df172fba3454e5ff52279ad82c8381fa05100ff860c3530017ded.exe
File created	C:\Windows\System\UvNPkSc.exe	95988d955f4df172fba3454e5ff52279ad82c8381fa05100ff860c3530017ded.exe
File created	C:\Windows\System\SVvbArU.exe	95988d955f4df172fba3454e5ff52279ad82c8381fa05100ff860c3530017ded.exe
File created	C:\Windows\System\RTaJZeI.exe	95988d955f4df172fba3454e5ff52279ad82c8381fa05100ff860c3530017ded.exe
File created	C:\Windows\System\BzzlCJc.exe	95988d955f4df172fba3454e5ff52279ad82c8381fa05100ff860c3530017ded.exe
File created	C:\Windows\System\ETKfmbN.exe	95988d955f4df172fba3454e5ff52279ad82c8381fa05100ff860c3530017ded.exe
File created	C:\Windows\System\FHoeLzH.exe	95988d955f4df172fba3454e5ff52279ad82c8381fa05100ff860c3530017ded.exe
File created	C:\Windows\System\dpjAWBE.exe	95988d955f4df172fba3454e5ff52279ad82c8381fa05100ff860c3530017ded.exe
File created	C:\Windows\System\kXhndBu.exe	95988d955f4df172fba3454e5ff52279ad82c8381fa05100ff860c3530017ded.exe
File created	C:\Windows\System\ckywyAn.exe	95988d955f4df172fba3454e5ff52279ad82c8381fa05100ff860c3530017ded.exe
File created	C:\Windows\System\CMGLtkb.exe	95988d955f4df172fba3454e5ff52279ad82c8381fa05100ff860c3530017ded.exe
File created	C:\Windows\System\eIjCZMx.exe	95988d955f4df172fba3454e5ff52279ad82c8381fa05100ff860c3530017ded.exe
File created	C:\Windows\System\cynbcRG.exe	95988d955f4df172fba3454e5ff52279ad82c8381fa05100ff860c3530017ded.exe
File created	C:\Windows\System\pDVvDdT.exe	95988d955f4df172fba3454e5ff52279ad82c8381fa05100ff860c3530017ded.exe
File created	C:\Windows\System\gxhDOts.exe	95988d955f4df172fba3454e5ff52279ad82c8381fa05100ff860c3530017ded.exe
File created	C:\Windows\System\aGODLxI.exe	95988d955f4df172fba3454e5ff52279ad82c8381fa05100ff860c3530017ded.exe
File created	C:\Windows\System\gtlesmg.exe	95988d955f4df172fba3454e5ff52279ad82c8381fa05100ff860c3530017ded.exe
File created	C:\Windows\System\tvCinSQ.exe	95988d955f4df172fba3454e5ff52279ad82c8381fa05100ff860c3530017ded.exe
File created	C:\Windows\System\hNWuEBi.exe	95988d955f4df172fba3454e5ff52279ad82c8381fa05100ff860c3530017ded.exe
File created	C:\Windows\System\GvvpfGY.exe	95988d955f4df172fba3454e5ff52279ad82c8381fa05100ff860c3530017ded.exe
File created	C:\Windows\System\hjoMxxc.exe	95988d955f4df172fba3454e5ff52279ad82c8381fa05100ff860c3530017ded.exe
File created	C:\Windows\System\wIrFvkX.exe	95988d955f4df172fba3454e5ff52279ad82c8381fa05100ff860c3530017ded.exe
File created	C:\Windows\System\OOFjHjy.exe	95988d955f4df172fba3454e5ff52279ad82c8381fa05100ff860c3530017ded.exe
File created	C:\Windows\System\WkKjvRU.exe	95988d955f4df172fba3454e5ff52279ad82c8381fa05100ff860c3530017ded.exe
File created	C:\Windows\System\NXlrSQP.exe	95988d955f4df172fba3454e5ff52279ad82c8381fa05100ff860c3530017ded.exe
File created	C:\Windows\System\nKRuiur.exe	95988d955f4df172fba3454e5ff52279ad82c8381fa05100ff860c3530017ded.exe
File created	C:\Windows\System\vHtishk.exe	95988d955f4df172fba3454e5ff52279ad82c8381fa05100ff860c3530017ded.exe
File created	C:\Windows\System\PoaFAcF.exe	95988d955f4df172fba3454e5ff52279ad82c8381fa05100ff860c3530017ded.exe
File created	C:\Windows\System\rALBDlA.exe	95988d955f4df172fba3454e5ff52279ad82c8381fa05100ff860c3530017ded.exe
File created	C:\Windows\System\yFcTlSP.exe	95988d955f4df172fba3454e5ff52279ad82c8381fa05100ff860c3530017ded.exe
File created	C:\Windows\System\hkcWIqh.exe	95988d955f4df172fba3454e5ff52279ad82c8381fa05100ff860c3530017ded.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	16416	dwm.exe
Token: SeChangeNotifyPrivilege	16416	dwm.exe
Token: 33	16416	dwm.exe
Token: SeIncBasePriorityPrivilege	16416	dwm.exe
Token: SeShutdownPrivilege	16416	dwm.exe
Token: SeCreatePagefilePrivilege	16416	dwm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3232 wrote to memory of 2996	3232	95988d955f4df172fba3454e5ff52279ad82c8381fa05100ff860c3530017ded.exe	83
PID 3232 wrote to memory of 2996	3232	95988d955f4df172fba3454e5ff52279ad82c8381fa05100ff860c3530017ded.exe	83
PID 3232 wrote to memory of 960	3232	95988d955f4df172fba3454e5ff52279ad82c8381fa05100ff860c3530017ded.exe	84
PID 3232 wrote to memory of 960	3232	95988d955f4df172fba3454e5ff52279ad82c8381fa05100ff860c3530017ded.exe	84
PID 3232 wrote to memory of 3104	3232	95988d955f4df172fba3454e5ff52279ad82c8381fa05100ff860c3530017ded.exe	85
PID 3232 wrote to memory of 3104	3232	95988d955f4df172fba3454e5ff52279ad82c8381fa05100ff860c3530017ded.exe	85
PID 3232 wrote to memory of 4884	3232	95988d955f4df172fba3454e5ff52279ad82c8381fa05100ff860c3530017ded.exe	86
PID 3232 wrote to memory of 4884	3232	95988d955f4df172fba3454e5ff52279ad82c8381fa05100ff860c3530017ded.exe	86
PID 3232 wrote to memory of 1836	3232	95988d955f4df172fba3454e5ff52279ad82c8381fa05100ff860c3530017ded.exe	87
PID 3232 wrote to memory of 1836	3232	95988d955f4df172fba3454e5ff52279ad82c8381fa05100ff860c3530017ded.exe	87
PID 3232 wrote to memory of 228	3232	95988d955f4df172fba3454e5ff52279ad82c8381fa05100ff860c3530017ded.exe	88
PID 3232 wrote to memory of 228	3232	95988d955f4df172fba3454e5ff52279ad82c8381fa05100ff860c3530017ded.exe	88
PID 3232 wrote to memory of 4820	3232	95988d955f4df172fba3454e5ff52279ad82c8381fa05100ff860c3530017ded.exe	89
PID 3232 wrote to memory of 4820	3232	95988d955f4df172fba3454e5ff52279ad82c8381fa05100ff860c3530017ded.exe	89
PID 3232 wrote to memory of 4892	3232	95988d955f4df172fba3454e5ff52279ad82c8381fa05100ff860c3530017ded.exe	90
PID 3232 wrote to memory of 4892	3232	95988d955f4df172fba3454e5ff52279ad82c8381fa05100ff860c3530017ded.exe	90
PID 3232 wrote to memory of 732	3232	95988d955f4df172fba3454e5ff52279ad82c8381fa05100ff860c3530017ded.exe	91
PID 3232 wrote to memory of 732	3232	95988d955f4df172fba3454e5ff52279ad82c8381fa05100ff860c3530017ded.exe	91
PID 3232 wrote to memory of 1224	3232	95988d955f4df172fba3454e5ff52279ad82c8381fa05100ff860c3530017ded.exe	92
PID 3232 wrote to memory of 1224	3232	95988d955f4df172fba3454e5ff52279ad82c8381fa05100ff860c3530017ded.exe	92
PID 3232 wrote to memory of 1016	3232	95988d955f4df172fba3454e5ff52279ad82c8381fa05100ff860c3530017ded.exe	93
PID 3232 wrote to memory of 1016	3232	95988d955f4df172fba3454e5ff52279ad82c8381fa05100ff860c3530017ded.exe	93
PID 3232 wrote to memory of 1924	3232	95988d955f4df172fba3454e5ff52279ad82c8381fa05100ff860c3530017ded.exe	94
PID 3232 wrote to memory of 1924	3232	95988d955f4df172fba3454e5ff52279ad82c8381fa05100ff860c3530017ded.exe	94
PID 3232 wrote to memory of 4964	3232	95988d955f4df172fba3454e5ff52279ad82c8381fa05100ff860c3530017ded.exe	95
PID 3232 wrote to memory of 4964	3232	95988d955f4df172fba3454e5ff52279ad82c8381fa05100ff860c3530017ded.exe	95
PID 3232 wrote to memory of 1852	3232	95988d955f4df172fba3454e5ff52279ad82c8381fa05100ff860c3530017ded.exe	96
PID 3232 wrote to memory of 1852	3232	95988d955f4df172fba3454e5ff52279ad82c8381fa05100ff860c3530017ded.exe	96
PID 3232 wrote to memory of 1584	3232	95988d955f4df172fba3454e5ff52279ad82c8381fa05100ff860c3530017ded.exe	97
PID 3232 wrote to memory of 1584	3232	95988d955f4df172fba3454e5ff52279ad82c8381fa05100ff860c3530017ded.exe	97
PID 3232 wrote to memory of 2044	3232	95988d955f4df172fba3454e5ff52279ad82c8381fa05100ff860c3530017ded.exe	98
PID 3232 wrote to memory of 2044	3232	95988d955f4df172fba3454e5ff52279ad82c8381fa05100ff860c3530017ded.exe	98
PID 3232 wrote to memory of 1488	3232	95988d955f4df172fba3454e5ff52279ad82c8381fa05100ff860c3530017ded.exe	99
PID 3232 wrote to memory of 1488	3232	95988d955f4df172fba3454e5ff52279ad82c8381fa05100ff860c3530017ded.exe	99
PID 3232 wrote to memory of 4616	3232	95988d955f4df172fba3454e5ff52279ad82c8381fa05100ff860c3530017ded.exe	100
PID 3232 wrote to memory of 4616	3232	95988d955f4df172fba3454e5ff52279ad82c8381fa05100ff860c3530017ded.exe	100
PID 3232 wrote to memory of 3108	3232	95988d955f4df172fba3454e5ff52279ad82c8381fa05100ff860c3530017ded.exe	101
PID 3232 wrote to memory of 3108	3232	95988d955f4df172fba3454e5ff52279ad82c8381fa05100ff860c3530017ded.exe	101
PID 3232 wrote to memory of 3588	3232	95988d955f4df172fba3454e5ff52279ad82c8381fa05100ff860c3530017ded.exe	102
PID 3232 wrote to memory of 3588	3232	95988d955f4df172fba3454e5ff52279ad82c8381fa05100ff860c3530017ded.exe	102
PID 3232 wrote to memory of 3840	3232	95988d955f4df172fba3454e5ff52279ad82c8381fa05100ff860c3530017ded.exe	103
PID 3232 wrote to memory of 3840	3232	95988d955f4df172fba3454e5ff52279ad82c8381fa05100ff860c3530017ded.exe	103
PID 3232 wrote to memory of 2764	3232	95988d955f4df172fba3454e5ff52279ad82c8381fa05100ff860c3530017ded.exe	104
PID 3232 wrote to memory of 2764	3232	95988d955f4df172fba3454e5ff52279ad82c8381fa05100ff860c3530017ded.exe	104
PID 3232 wrote to memory of 4508	3232	95988d955f4df172fba3454e5ff52279ad82c8381fa05100ff860c3530017ded.exe	105
PID 3232 wrote to memory of 4508	3232	95988d955f4df172fba3454e5ff52279ad82c8381fa05100ff860c3530017ded.exe	105
PID 3232 wrote to memory of 3652	3232	95988d955f4df172fba3454e5ff52279ad82c8381fa05100ff860c3530017ded.exe	106
PID 3232 wrote to memory of 3652	3232	95988d955f4df172fba3454e5ff52279ad82c8381fa05100ff860c3530017ded.exe	106
PID 3232 wrote to memory of 1104	3232	95988d955f4df172fba3454e5ff52279ad82c8381fa05100ff860c3530017ded.exe	107
PID 3232 wrote to memory of 1104	3232	95988d955f4df172fba3454e5ff52279ad82c8381fa05100ff860c3530017ded.exe	107
PID 3232 wrote to memory of 3244	3232	95988d955f4df172fba3454e5ff52279ad82c8381fa05100ff860c3530017ded.exe	108
PID 3232 wrote to memory of 3244	3232	95988d955f4df172fba3454e5ff52279ad82c8381fa05100ff860c3530017ded.exe	108
PID 3232 wrote to memory of 2588	3232	95988d955f4df172fba3454e5ff52279ad82c8381fa05100ff860c3530017ded.exe	109
PID 3232 wrote to memory of 2588	3232	95988d955f4df172fba3454e5ff52279ad82c8381fa05100ff860c3530017ded.exe	109
PID 3232 wrote to memory of 3940	3232	95988d955f4df172fba3454e5ff52279ad82c8381fa05100ff860c3530017ded.exe	110
PID 3232 wrote to memory of 3940	3232	95988d955f4df172fba3454e5ff52279ad82c8381fa05100ff860c3530017ded.exe	110
PID 3232 wrote to memory of 1372	3232	95988d955f4df172fba3454e5ff52279ad82c8381fa05100ff860c3530017ded.exe	111
PID 3232 wrote to memory of 1372	3232	95988d955f4df172fba3454e5ff52279ad82c8381fa05100ff860c3530017ded.exe	111
PID 3232 wrote to memory of 2204	3232	95988d955f4df172fba3454e5ff52279ad82c8381fa05100ff860c3530017ded.exe	112
PID 3232 wrote to memory of 2204	3232	95988d955f4df172fba3454e5ff52279ad82c8381fa05100ff860c3530017ded.exe	112
PID 3232 wrote to memory of 3384	3232	95988d955f4df172fba3454e5ff52279ad82c8381fa05100ff860c3530017ded.exe	113
PID 3232 wrote to memory of 3384	3232	95988d955f4df172fba3454e5ff52279ad82c8381fa05100ff860c3530017ded.exe	113
PID 3232 wrote to memory of 8	3232	95988d955f4df172fba3454e5ff52279ad82c8381fa05100ff860c3530017ded.exe	114
PID 3232 wrote to memory of 8	3232	95988d955f4df172fba3454e5ff52279ad82c8381fa05100ff860c3530017ded.exe	114

C:\Users\Admin\AppData\Local\Temp\95988d955f4df172fba3454e5ff52279ad82c8381fa05100ff860c3530017ded.exe
"C:\Users\Admin\AppData\Local\Temp\95988d955f4df172fba3454e5ff52279ad82c8381fa05100ff860c3530017ded.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3232
- C:\Windows\System\OgzFdfF.exe
  C:\Windows\System\OgzFdfF.exe
  2⤵
  - Executes dropped EXE
  PID:2996
- C:\Windows\System\awCfyky.exe
  C:\Windows\System\awCfyky.exe
  2⤵
  - Executes dropped EXE
  PID:960
- C:\Windows\System\SnmCBEW.exe
  C:\Windows\System\SnmCBEW.exe
  2⤵
  - Executes dropped EXE
  PID:3104
- C:\Windows\System\fWOrUke.exe
  C:\Windows\System\fWOrUke.exe
  2⤵
  - Executes dropped EXE
  PID:4884
- C:\Windows\System\BXsLydd.exe
  C:\Windows\System\BXsLydd.exe
  2⤵
  - Executes dropped EXE
  PID:1836
- C:\Windows\System\EGgqROZ.exe
  C:\Windows\System\EGgqROZ.exe
  2⤵
  - Executes dropped EXE
  PID:228
- C:\Windows\System\HCmNqRW.exe
  C:\Windows\System\HCmNqRW.exe
  2⤵
  - Executes dropped EXE
  PID:4820
- C:\Windows\System\AJeEuTl.exe
  C:\Windows\System\AJeEuTl.exe
  2⤵
  - Executes dropped EXE
  PID:4892
- C:\Windows\System\tdMwItn.exe
  C:\Windows\System\tdMwItn.exe
  2⤵
  - Executes dropped EXE
  PID:732
- C:\Windows\System\rALBDlA.exe
  C:\Windows\System\rALBDlA.exe
  2⤵
  - Executes dropped EXE
  PID:1224
- C:\Windows\System\GdXmJeW.exe
  C:\Windows\System\GdXmJeW.exe
  2⤵
  - Executes dropped EXE
  PID:1016
- C:\Windows\System\xEvvUBJ.exe
  C:\Windows\System\xEvvUBJ.exe
  2⤵
  - Executes dropped EXE
  PID:1924
- C:\Windows\System\nRiOTnX.exe
  C:\Windows\System\nRiOTnX.exe
  2⤵
  - Executes dropped EXE
  PID:4964
- C:\Windows\System\GMQcDnV.exe
  C:\Windows\System\GMQcDnV.exe
  2⤵
  - Executes dropped EXE
  PID:1852
- C:\Windows\System\iWYRDoa.exe
  C:\Windows\System\iWYRDoa.exe
  2⤵
  - Executes dropped EXE
  PID:1584
- C:\Windows\System\ObiWnyp.exe
  C:\Windows\System\ObiWnyp.exe
  2⤵
  - Executes dropped EXE
  PID:2044
- C:\Windows\System\kXhndBu.exe
  C:\Windows\System\kXhndBu.exe
  2⤵
  - Executes dropped EXE
  PID:1488
- C:\Windows\System\oesKEcc.exe
  C:\Windows\System\oesKEcc.exe
  2⤵
  - Executes dropped EXE
  PID:4616
- C:\Windows\System\CtiERjt.exe
  C:\Windows\System\CtiERjt.exe
  2⤵
  - Executes dropped EXE
  PID:3108
- C:\Windows\System\FmNcGmQ.exe
  C:\Windows\System\FmNcGmQ.exe
  2⤵
  - Executes dropped EXE
  PID:3588
- C:\Windows\System\EjYVjRy.exe
  C:\Windows\System\EjYVjRy.exe
  2⤵
  - Executes dropped EXE
  PID:3840
- C:\Windows\System\CZRDZol.exe
  C:\Windows\System\CZRDZol.exe
  2⤵
  - Executes dropped EXE
  PID:2764
- C:\Windows\System\pzaJYAa.exe
  C:\Windows\System\pzaJYAa.exe
  2⤵
  - Executes dropped EXE
  PID:4508
- C:\Windows\System\rFIgSaC.exe
  C:\Windows\System\rFIgSaC.exe
  2⤵
  - Executes dropped EXE
  PID:3652
- C:\Windows\System\fVhOGzK.exe
  C:\Windows\System\fVhOGzK.exe
  2⤵
  - Executes dropped EXE
  PID:1104
- C:\Windows\System\GmfMdsb.exe
  C:\Windows\System\GmfMdsb.exe
  2⤵
  - Executes dropped EXE
  PID:3244
- C:\Windows\System\dLbeqKC.exe
  C:\Windows\System\dLbeqKC.exe
  2⤵
  - Executes dropped EXE
  PID:2588
- C:\Windows\System\xRdIEvW.exe
  C:\Windows\System\xRdIEvW.exe
  2⤵
  - Executes dropped EXE
  PID:3940
- C:\Windows\System\HdMmydY.exe
  C:\Windows\System\HdMmydY.exe
  2⤵
  - Executes dropped EXE
  PID:1372
- C:\Windows\System\lypAWjI.exe
  C:\Windows\System\lypAWjI.exe
  2⤵
  - Executes dropped EXE
  PID:2204
- C:\Windows\System\TJALGGV.exe
  C:\Windows\System\TJALGGV.exe
  2⤵
  - Executes dropped EXE
  PID:3384
- C:\Windows\System\zjbAyWv.exe
  C:\Windows\System\zjbAyWv.exe
  2⤵
  - Executes dropped EXE
  PID:8
- C:\Windows\System\VyxuPmZ.exe
  C:\Windows\System\VyxuPmZ.exe
  2⤵
  - Executes dropped EXE
  PID:4020
- C:\Windows\System\zTJFbnw.exe
  C:\Windows\System\zTJFbnw.exe
  2⤵
  - Executes dropped EXE
  PID:1352
- C:\Windows\System\aovpuPt.exe
  C:\Windows\System\aovpuPt.exe
  2⤵
  - Executes dropped EXE
  PID:3160
- C:\Windows\System\QlFZcyr.exe
  C:\Windows\System\QlFZcyr.exe
  2⤵
  - Executes dropped EXE
  PID:3220
- C:\Windows\System\XWrvwIw.exe
  C:\Windows\System\XWrvwIw.exe
  2⤵
  - Executes dropped EXE
  PID:1956
- C:\Windows\System\YEYQgBD.exe
  C:\Windows\System\YEYQgBD.exe
  2⤵
  - Executes dropped EXE
  PID:4564
- C:\Windows\System\sowopsA.exe
  C:\Windows\System\sowopsA.exe
  2⤵
  - Executes dropped EXE
  PID:1504
- C:\Windows\System\JeIFyBl.exe
  C:\Windows\System\JeIFyBl.exe
  2⤵
  - Executes dropped EXE
  PID:1952
- C:\Windows\System\sFCGtqs.exe
  C:\Windows\System\sFCGtqs.exe
  2⤵
  - Executes dropped EXE
  PID:1156
- C:\Windows\System\LRDcpsm.exe
  C:\Windows\System\LRDcpsm.exe
  2⤵
  - Executes dropped EXE
  PID:1804
- C:\Windows\System\xtTVXBg.exe
  C:\Windows\System\xtTVXBg.exe
  2⤵
  - Executes dropped EXE
  PID:3768
- C:\Windows\System\BzzlCJc.exe
  C:\Windows\System\BzzlCJc.exe
  2⤵
  - Executes dropped EXE
  PID:2448
- C:\Windows\System\olbUONo.exe
  C:\Windows\System\olbUONo.exe
  2⤵
  - Executes dropped EXE
  PID:1752
- C:\Windows\System\zwyKqoC.exe
  C:\Windows\System\zwyKqoC.exe
  2⤵
  - Executes dropped EXE
  PID:2452
- C:\Windows\System\zcbKHCb.exe
  C:\Windows\System\zcbKHCb.exe
  2⤵
  - Executes dropped EXE
  PID:3448
- C:\Windows\System\rInYsZw.exe
  C:\Windows\System\rInYsZw.exe
  2⤵
  - Executes dropped EXE
  PID:3832
- C:\Windows\System\DHNHXBA.exe
  C:\Windows\System\DHNHXBA.exe
  2⤵
  - Executes dropped EXE
  PID:1824
- C:\Windows\System\RKhJRMl.exe
  C:\Windows\System\RKhJRMl.exe
  2⤵
  - Executes dropped EXE
  PID:4088
- C:\Windows\System\boCgrTV.exe
  C:\Windows\System\boCgrTV.exe
  2⤵
  - Executes dropped EXE
  PID:3712
- C:\Windows\System\zgYyumL.exe
  C:\Windows\System\zgYyumL.exe
  2⤵
  - Executes dropped EXE
  PID:1356
- C:\Windows\System\DuNtmQm.exe
  C:\Windows\System\DuNtmQm.exe
  2⤵
  - Executes dropped EXE
  PID:1992
- C:\Windows\System\dBpcHwh.exe
  C:\Windows\System\dBpcHwh.exe
  2⤵
  - Executes dropped EXE
  PID:4776
- C:\Windows\System\LORrdvr.exe
  C:\Windows\System\LORrdvr.exe
  2⤵
  - Executes dropped EXE
  PID:1548
- C:\Windows\System\LDThxYO.exe
  C:\Windows\System\LDThxYO.exe
  2⤵
  - Executes dropped EXE
  PID:4600
- C:\Windows\System\CiSwnfB.exe
  C:\Windows\System\CiSwnfB.exe
  2⤵
  - Executes dropped EXE
  PID:2152
- C:\Windows\System\jGpuEtJ.exe
  C:\Windows\System\jGpuEtJ.exe
  2⤵
  - Executes dropped EXE
  PID:752
- C:\Windows\System\dblUsIM.exe
  C:\Windows\System\dblUsIM.exe
  2⤵
  - Executes dropped EXE
  PID:1644
- C:\Windows\System\Nwxmznn.exe
  C:\Windows\System\Nwxmznn.exe
  2⤵
  - Executes dropped EXE
  PID:4420
- C:\Windows\System\MnCsVnt.exe
  C:\Windows\System\MnCsVnt.exe
  2⤵
  - Executes dropped EXE
  PID:4408
- C:\Windows\System\ApRpYVA.exe
  C:\Windows\System\ApRpYVA.exe
  2⤵
  - Executes dropped EXE
  PID:3672
- C:\Windows\System\ERCfGqn.exe
  C:\Windows\System\ERCfGqn.exe
  2⤵
  - Executes dropped EXE
  PID:4584
- C:\Windows\System\edQRthk.exe
  C:\Windows\System\edQRthk.exe
  2⤵
  - Executes dropped EXE
  PID:760
- C:\Windows\System\xgGqVHd.exe
  C:\Windows\System\xgGqVHd.exe
  2⤵
  PID:3960
- C:\Windows\System\QAbhJXp.exe
  C:\Windows\System\QAbhJXp.exe
  2⤵
  PID:3680
- C:\Windows\System\jEJGMYp.exe
  C:\Windows\System\jEJGMYp.exe
  2⤵
  PID:60
- C:\Windows\System\yZvGsqz.exe
  C:\Windows\System\yZvGsqz.exe
  2⤵
  PID:4768
- C:\Windows\System\MvTumvy.exe
  C:\Windows\System\MvTumvy.exe
  2⤵
  PID:1284
- C:\Windows\System\AyYdSqk.exe
  C:\Windows\System\AyYdSqk.exe
  2⤵
  PID:2760
- C:\Windows\System\bkMkDUg.exe
  C:\Windows\System\bkMkDUg.exe
  2⤵
  PID:4956
- C:\Windows\System\sQTusZI.exe
  C:\Windows\System\sQTusZI.exe
  2⤵
  PID:3536
- C:\Windows\System\nHovAWy.exe
  C:\Windows\System\nHovAWy.exe
  2⤵
  PID:4168
- C:\Windows\System\ROUmlxV.exe
  C:\Windows\System\ROUmlxV.exe
  2⤵
  PID:4520
- C:\Windows\System\szWVpGE.exe
  C:\Windows\System\szWVpGE.exe
  2⤵
  PID:4580
- C:\Windows\System\IxOsswF.exe
  C:\Windows\System\IxOsswF.exe
  2⤵
  PID:5092
- C:\Windows\System\CtpDzUi.exe
  C:\Windows\System\CtpDzUi.exe
  2⤵
  PID:1780
- C:\Windows\System\QyYzPhj.exe
  C:\Windows\System\QyYzPhj.exe
  2⤵
  PID:3372
- C:\Windows\System\bcATVel.exe
  C:\Windows\System\bcATVel.exe
  2⤵
  PID:800
- C:\Windows\System\CxVUUWJ.exe
  C:\Windows\System\CxVUUWJ.exe
  2⤵
  PID:3660
- C:\Windows\System\UIjsHps.exe
  C:\Windows\System\UIjsHps.exe
  2⤵
  PID:796
- C:\Windows\System\AWfOhes.exe
  C:\Windows\System\AWfOhes.exe
  2⤵
  PID:4848
- C:\Windows\System\roEsQrD.exe
  C:\Windows\System\roEsQrD.exe
  2⤵
  PID:4992
- C:\Windows\System\KojFBiX.exe
  C:\Windows\System\KojFBiX.exe
  2⤵
  PID:4808
- C:\Windows\System\naPuPwj.exe
  C:\Windows\System\naPuPwj.exe
  2⤵
  PID:3720
- C:\Windows\System\KXKBbZa.exe
  C:\Windows\System\KXKBbZa.exe
  2⤵
  PID:1240
- C:\Windows\System\zvwlHrm.exe
  C:\Windows\System\zvwlHrm.exe
  2⤵
  PID:4124
- C:\Windows\System\AYSghHO.exe
  C:\Windows\System\AYSghHO.exe
  2⤵
  PID:4536
- C:\Windows\System\HCFVgwX.exe
  C:\Windows\System\HCFVgwX.exe
  2⤵
  PID:2624
- C:\Windows\System\nkaQHjx.exe
  C:\Windows\System\nkaQHjx.exe
  2⤵
  PID:2356
- C:\Windows\System\taIPNxH.exe
  C:\Windows\System\taIPNxH.exe
  2⤵
  PID:2012
- C:\Windows\System\PscFTrs.exe
  C:\Windows\System\PscFTrs.exe
  2⤵
  PID:1492
- C:\Windows\System\jtLpfME.exe
  C:\Windows\System\jtLpfME.exe
  2⤵
  PID:2132
- C:\Windows\System\pemkQNn.exe
  C:\Windows\System\pemkQNn.exe
  2⤵
  PID:4860
- C:\Windows\System\YUQJKMZ.exe
  C:\Windows\System\YUQJKMZ.exe
  2⤵
  PID:3360
- C:\Windows\System\zYqCgsv.exe
  C:\Windows\System\zYqCgsv.exe
  2⤵
  PID:4932
- C:\Windows\System\kLSsEvh.exe
  C:\Windows\System\kLSsEvh.exe
  2⤵
  PID:3764
- C:\Windows\System\ywGiTpj.exe
  C:\Windows\System\ywGiTpj.exe
  2⤵
  PID:232
- C:\Windows\System\kiWjiVJ.exe
  C:\Windows\System\kiWjiVJ.exe
  2⤵
  PID:2016
- C:\Windows\System\LhTyQVq.exe
  C:\Windows\System\LhTyQVq.exe
  2⤵
  PID:1676
- C:\Windows\System\NtXqLer.exe
  C:\Windows\System\NtXqLer.exe
  2⤵
  PID:1364
- C:\Windows\System\YpLgFTG.exe
  C:\Windows\System\YpLgFTG.exe
  2⤵
  PID:1440
- C:\Windows\System\lAmeUWv.exe
  C:\Windows\System\lAmeUWv.exe
  2⤵
  PID:976
- C:\Windows\System\yiQhxFU.exe
  C:\Windows\System\yiQhxFU.exe
  2⤵
  PID:3084
- C:\Windows\System\cOKHYGN.exe
  C:\Windows\System\cOKHYGN.exe
  2⤵
  PID:2412
- C:\Windows\System\cqBBLxt.exe
  C:\Windows\System\cqBBLxt.exe
  2⤵
  PID:4704
- C:\Windows\System\OTcIzyI.exe
  C:\Windows\System\OTcIzyI.exe
  2⤵
  PID:2088
- C:\Windows\System\qreklQC.exe
  C:\Windows\System\qreklQC.exe
  2⤵
  PID:5088
- C:\Windows\System\QnRbAZL.exe
  C:\Windows\System\QnRbAZL.exe
  2⤵
  PID:4300
- C:\Windows\System\zFTkxVh.exe
  C:\Windows\System\zFTkxVh.exe
  2⤵
  PID:4836
- C:\Windows\System\gjKeiut.exe
  C:\Windows\System\gjKeiut.exe
  2⤵
  PID:3312
- C:\Windows\System\lBgeNGW.exe
  C:\Windows\System\lBgeNGW.exe
  2⤵
  PID:2524
- C:\Windows\System\TIrAGZJ.exe
  C:\Windows\System\TIrAGZJ.exe
  2⤵
  PID:3100
- C:\Windows\System\ljSrTAR.exe
  C:\Windows\System\ljSrTAR.exe
  2⤵
  PID:1716
- C:\Windows\System\NAjWoOE.exe
  C:\Windows\System\NAjWoOE.exe
  2⤵
  PID:3584
- C:\Windows\System\EzMYePF.exe
  C:\Windows\System\EzMYePF.exe
  2⤵
  PID:3504
- C:\Windows\System\RxtOivB.exe
  C:\Windows\System\RxtOivB.exe
  2⤵
  PID:3988
- C:\Windows\System\FHQbyqo.exe
  C:\Windows\System\FHQbyqo.exe
  2⤵
  PID:2052
- C:\Windows\System\XVIqriZ.exe
  C:\Windows\System\XVIqriZ.exe
  2⤵
  PID:5124
- C:\Windows\System\mwEnnjS.exe
  C:\Windows\System\mwEnnjS.exe
  2⤵
  PID:5152
- C:\Windows\System\jZbSUAH.exe
  C:\Windows\System\jZbSUAH.exe
  2⤵
  PID:5176
- C:\Windows\System\uAJShRh.exe
  C:\Windows\System\uAJShRh.exe
  2⤵
  PID:5196
- C:\Windows\System\EmvtDob.exe
  C:\Windows\System\EmvtDob.exe
  2⤵
  PID:5224
- C:\Windows\System\tiQLgOT.exe
  C:\Windows\System\tiQLgOT.exe
  2⤵
  PID:5260
- C:\Windows\System\pgRJFVF.exe
  C:\Windows\System\pgRJFVF.exe
  2⤵
  PID:5284
- C:\Windows\System\BXqAEjR.exe
  C:\Windows\System\BXqAEjR.exe
  2⤵
  PID:5324
- C:\Windows\System\BVpaqNu.exe
  C:\Windows\System\BVpaqNu.exe
  2⤵
  PID:5340
- C:\Windows\System\IZEYbfS.exe
  C:\Windows\System\IZEYbfS.exe
  2⤵
  PID:5368
- C:\Windows\System\vyhdvZR.exe
  C:\Windows\System\vyhdvZR.exe
  2⤵
  PID:5400
- C:\Windows\System\UfAPTwV.exe
  C:\Windows\System\UfAPTwV.exe
  2⤵
  PID:5432
- C:\Windows\System\uEGquIp.exe
  C:\Windows\System\uEGquIp.exe
  2⤵
  PID:5460
- C:\Windows\System\QhjsUbF.exe
  C:\Windows\System\QhjsUbF.exe
  2⤵
  PID:5484
- C:\Windows\System\EWxmJqP.exe
  C:\Windows\System\EWxmJqP.exe
  2⤵
  PID:5512
- C:\Windows\System\LUFaRCT.exe
  C:\Windows\System\LUFaRCT.exe
  2⤵
  PID:5544
- C:\Windows\System\GzeKFGl.exe
  C:\Windows\System\GzeKFGl.exe
  2⤵
  PID:5568
- C:\Windows\System\amybFFD.exe
  C:\Windows\System\amybFFD.exe
  2⤵
  PID:5604
- C:\Windows\System\pHsXBKU.exe
  C:\Windows\System\pHsXBKU.exe
  2⤵
  PID:5624
- C:\Windows\System\Yabbrye.exe
  C:\Windows\System\Yabbrye.exe
  2⤵
  PID:5656
- C:\Windows\System\olQPBvn.exe
  C:\Windows\System\olQPBvn.exe
  2⤵
  PID:5676
- C:\Windows\System\nctaaeB.exe
  C:\Windows\System\nctaaeB.exe
  2⤵
  PID:5704
- C:\Windows\System\mweIKzV.exe
  C:\Windows\System\mweIKzV.exe
  2⤵
  PID:5736
- C:\Windows\System\eJFdwFw.exe
  C:\Windows\System\eJFdwFw.exe
  2⤵
  PID:5760
- C:\Windows\System\XDpAxjr.exe
  C:\Windows\System\XDpAxjr.exe
  2⤵
  PID:5800
- C:\Windows\System\qmvaYYF.exe
  C:\Windows\System\qmvaYYF.exe
  2⤵
  PID:5820
- C:\Windows\System\MvzqzXL.exe
  C:\Windows\System\MvzqzXL.exe
  2⤵
  PID:5852
- C:\Windows\System\dVMndJZ.exe
  C:\Windows\System\dVMndJZ.exe
  2⤵
  PID:5872
- C:\Windows\System\lysELsn.exe
  C:\Windows\System\lysELsn.exe
  2⤵
  PID:5912
- C:\Windows\System\EwCodFB.exe
  C:\Windows\System\EwCodFB.exe
  2⤵
  PID:5940
- C:\Windows\System\cTcfnpV.exe
  C:\Windows\System\cTcfnpV.exe
  2⤵
  PID:5964
- C:\Windows\System\OanOzMZ.exe
  C:\Windows\System\OanOzMZ.exe
  2⤵
  PID:5992
- C:\Windows\System\cYojkSh.exe
  C:\Windows\System\cYojkSh.exe
  2⤵
  PID:6016
- C:\Windows\System\zKCXFoj.exe
  C:\Windows\System\zKCXFoj.exe
  2⤵
  PID:6040
- C:\Windows\System\rHGWMJP.exe
  C:\Windows\System\rHGWMJP.exe
  2⤵
  PID:6068
- C:\Windows\System\JifIDcB.exe
  C:\Windows\System\JifIDcB.exe
  2⤵
  PID:6088
- C:\Windows\System\gNApXio.exe
  C:\Windows\System\gNApXio.exe
  2⤵
  PID:6120
- C:\Windows\System\UsNAvNF.exe
  C:\Windows\System\UsNAvNF.exe
  2⤵
  PID:5136
- C:\Windows\System\hkBEhpA.exe
  C:\Windows\System\hkBEhpA.exe
  2⤵
  PID:5212
- C:\Windows\System\hQseUih.exe
  C:\Windows\System\hQseUih.exe
  2⤵
  PID:5252
- C:\Windows\System\iZGiPlU.exe
  C:\Windows\System\iZGiPlU.exe
  2⤵
  PID:5308
- C:\Windows\System\QcMNdvM.exe
  C:\Windows\System\QcMNdvM.exe
  2⤵
  PID:5384
- C:\Windows\System\KQzELfE.exe
  C:\Windows\System\KQzELfE.exe
  2⤵
  PID:5448
- C:\Windows\System\jRlyQET.exe
  C:\Windows\System\jRlyQET.exe
  2⤵
  PID:5536
- C:\Windows\System\EoqBztu.exe
  C:\Windows\System\EoqBztu.exe
  2⤵
  PID:5592
- C:\Windows\System\hyOMasM.exe
  C:\Windows\System\hyOMasM.exe
  2⤵
  PID:5636
- C:\Windows\System\cwyWyib.exe
  C:\Windows\System\cwyWyib.exe
  2⤵
  PID:5732
- C:\Windows\System\bbqydsr.exe
  C:\Windows\System\bbqydsr.exe
  2⤵
  PID:5784
- C:\Windows\System\Oldfljq.exe
  C:\Windows\System\Oldfljq.exe
  2⤵
  PID:5836
- C:\Windows\System\ZKqwAvY.exe
  C:\Windows\System\ZKqwAvY.exe
  2⤵
  PID:5932
- C:\Windows\System\voSWEuU.exe
  C:\Windows\System\voSWEuU.exe
  2⤵
  PID:5984
- C:\Windows\System\mqmjhfA.exe
  C:\Windows\System\mqmjhfA.exe
  2⤵
  PID:6032
- C:\Windows\System\ZAXCrAO.exe
  C:\Windows\System\ZAXCrAO.exe
  2⤵
  PID:5148
- C:\Windows\System\XwtqilO.exe
  C:\Windows\System\XwtqilO.exe
  2⤵
  PID:5184
- C:\Windows\System\BzGGRGD.exe
  C:\Windows\System\BzGGRGD.exe
  2⤵
  PID:5276
- C:\Windows\System\COAdkxT.exe
  C:\Windows\System\COAdkxT.exe
  2⤵
  PID:5500
- C:\Windows\System\wiaMCtL.exe
  C:\Windows\System\wiaMCtL.exe
  2⤵
  PID:5692
- C:\Windows\System\FqrDBgh.exe
  C:\Windows\System\FqrDBgh.exe
  2⤵
  PID:5752
- C:\Windows\System\ajQYKFQ.exe
  C:\Windows\System\ajQYKFQ.exe
  2⤵
  PID:5972
- C:\Windows\System\kjjudZm.exe
  C:\Windows\System\kjjudZm.exe
  2⤵
  PID:5248
- C:\Windows\System\EgrQAyc.exe
  C:\Windows\System\EgrQAyc.exe
  2⤵
  PID:5416
- C:\Windows\System\hvxgLra.exe
  C:\Windows\System\hvxgLra.exe
  2⤵
  PID:5772
- C:\Windows\System\hCXayoN.exe
  C:\Windows\System\hCXayoN.exe
  2⤵
  PID:6104
- C:\Windows\System\VPjFbTL.exe
  C:\Windows\System\VPjFbTL.exe
  2⤵
  PID:6060
- C:\Windows\System\CwMDKZB.exe
  C:\Windows\System\CwMDKZB.exe
  2⤵
  PID:6152
- C:\Windows\System\mDvQwbE.exe
  C:\Windows\System\mDvQwbE.exe
  2⤵
  PID:6180
- C:\Windows\System\BNEWrEg.exe
  C:\Windows\System\BNEWrEg.exe
  2⤵
  PID:6200
- C:\Windows\System\TNjCyHD.exe
  C:\Windows\System\TNjCyHD.exe
  2⤵
  PID:6236
- C:\Windows\System\NDYWCly.exe
  C:\Windows\System\NDYWCly.exe
  2⤵
  PID:6272
- C:\Windows\System\zhNNfQx.exe
  C:\Windows\System\zhNNfQx.exe
  2⤵
  PID:6300
- C:\Windows\System\PZGeMEe.exe
  C:\Windows\System\PZGeMEe.exe
  2⤵
  PID:6332
- C:\Windows\System\LHIhXHw.exe
  C:\Windows\System\LHIhXHw.exe
  2⤵
  PID:6360
- C:\Windows\System\uVJMEEp.exe
  C:\Windows\System\uVJMEEp.exe
  2⤵
  PID:6376
- C:\Windows\System\wNHKYnB.exe
  C:\Windows\System\wNHKYnB.exe
  2⤵
  PID:6404
- C:\Windows\System\hwReHTG.exe
  C:\Windows\System\hwReHTG.exe
  2⤵
  PID:6432
- C:\Windows\System\yBPKBmp.exe
  C:\Windows\System\yBPKBmp.exe
  2⤵
  PID:6460
- C:\Windows\System\aAymAuq.exe
  C:\Windows\System\aAymAuq.exe
  2⤵
  PID:6488
- C:\Windows\System\CfgrbTH.exe
  C:\Windows\System\CfgrbTH.exe
  2⤵
  PID:6516
- C:\Windows\System\zEJKUqV.exe
  C:\Windows\System\zEJKUqV.exe
  2⤵
  PID:6548
- C:\Windows\System\CbeBBRM.exe
  C:\Windows\System\CbeBBRM.exe
  2⤵
  PID:6580
- C:\Windows\System\RCVNFjV.exe
  C:\Windows\System\RCVNFjV.exe
  2⤵
  PID:6612
- C:\Windows\System\mfsUuJU.exe
  C:\Windows\System\mfsUuJU.exe
  2⤵
  PID:6628
- C:\Windows\System\ebIFgxF.exe
  C:\Windows\System\ebIFgxF.exe
  2⤵
  PID:6656
- C:\Windows\System\GyxwFJg.exe
  C:\Windows\System\GyxwFJg.exe
  2⤵
  PID:6676
- C:\Windows\System\VhplxVD.exe
  C:\Windows\System\VhplxVD.exe
  2⤵
  PID:6700
- C:\Windows\System\eHIvhjj.exe
  C:\Windows\System\eHIvhjj.exe
  2⤵
  PID:6740
- C:\Windows\System\YOqpVKV.exe
  C:\Windows\System\YOqpVKV.exe
  2⤵
  PID:6768
- C:\Windows\System\zRiIikD.exe
  C:\Windows\System\zRiIikD.exe
  2⤵
  PID:6792
- C:\Windows\System\zUrTegE.exe
  C:\Windows\System\zUrTegE.exe
  2⤵
  PID:6824
- C:\Windows\System\hWDjgzO.exe
  C:\Windows\System\hWDjgzO.exe
  2⤵
  PID:6852
- C:\Windows\System\beDeAsi.exe
  C:\Windows\System\beDeAsi.exe
  2⤵
  PID:6872
- C:\Windows\System\gfLPhFe.exe
  C:\Windows\System\gfLPhFe.exe
  2⤵
  PID:6904
- C:\Windows\System\dLrsdKP.exe
  C:\Windows\System\dLrsdKP.exe
  2⤵
  PID:6936
- C:\Windows\System\JxRRHad.exe
  C:\Windows\System\JxRRHad.exe
  2⤵
  PID:6968
- C:\Windows\System\boQEvCb.exe
  C:\Windows\System\boQEvCb.exe
  2⤵
  PID:6996
- C:\Windows\System\GSIQtrK.exe
  C:\Windows\System\GSIQtrK.exe
  2⤵
  PID:7032
- C:\Windows\System\BCgTaLO.exe
  C:\Windows\System\BCgTaLO.exe
  2⤵
  PID:7060
- C:\Windows\System\QLFeMnk.exe
  C:\Windows\System\QLFeMnk.exe
  2⤵
  PID:7088
- C:\Windows\System\iCMVGNR.exe
  C:\Windows\System\iCMVGNR.exe
  2⤵
  PID:7116
- C:\Windows\System\QmflQqk.exe
  C:\Windows\System\QmflQqk.exe
  2⤵
  PID:7144
- C:\Windows\System\XGWmuLS.exe
  C:\Windows\System\XGWmuLS.exe
  2⤵
  PID:7160
- C:\Windows\System\YaVVFfZ.exe
  C:\Windows\System\YaVVFfZ.exe
  2⤵
  PID:6188
- C:\Windows\System\kGVPCLt.exe
  C:\Windows\System\kGVPCLt.exe
  2⤵
  PID:6252
- C:\Windows\System\YmzCtqq.exe
  C:\Windows\System\YmzCtqq.exe
  2⤵
  PID:6328
- C:\Windows\System\rKgENKN.exe
  C:\Windows\System\rKgENKN.exe
  2⤵
  PID:6372
- C:\Windows\System\jrsESfV.exe
  C:\Windows\System\jrsESfV.exe
  2⤵
  PID:6444
- C:\Windows\System\Qnxunep.exe
  C:\Windows\System\Qnxunep.exe
  2⤵
  PID:6528
- C:\Windows\System\WsgfLAk.exe
  C:\Windows\System\WsgfLAk.exe
  2⤵
  PID:6604
- C:\Windows\System\tRurPFb.exe
  C:\Windows\System\tRurPFb.exe
  2⤵
  PID:6644
- C:\Windows\System\nwOdVRF.exe
  C:\Windows\System\nwOdVRF.exe
  2⤵
  PID:6724
- C:\Windows\System\tRjyBbz.exe
  C:\Windows\System\tRjyBbz.exe
  2⤵
  PID:6764
- C:\Windows\System\GumGyUg.exe
  C:\Windows\System\GumGyUg.exe
  2⤵
  PID:6892
- C:\Windows\System\jjghEwn.exe
  C:\Windows\System\jjghEwn.exe
  2⤵
  PID:6924
- C:\Windows\System\lZgMLyl.exe
  C:\Windows\System\lZgMLyl.exe
  2⤵
  PID:6976
- C:\Windows\System\qbXAmlK.exe
  C:\Windows\System\qbXAmlK.exe
  2⤵
  PID:7028
- C:\Windows\System\yCBYOWI.exe
  C:\Windows\System\yCBYOWI.exe
  2⤵
  PID:7128
- C:\Windows\System\dApseXg.exe
  C:\Windows\System\dApseXg.exe
  2⤵
  PID:6148
- C:\Windows\System\oZtSEii.exe
  C:\Windows\System\oZtSEii.exe
  2⤵
  PID:6368
- C:\Windows\System\YTNdGMb.exe
  C:\Windows\System\YTNdGMb.exe
  2⤵
  PID:6424
- C:\Windows\System\BthAOwr.exe
  C:\Windows\System\BthAOwr.exe
  2⤵
  PID:6624
- C:\Windows\System\gTSIRnL.exe
  C:\Windows\System\gTSIRnL.exe
  2⤵
  PID:6848
- C:\Windows\System\GelFBUl.exe
  C:\Windows\System\GelFBUl.exe
  2⤵
  PID:6960
- C:\Windows\System\NXnxsYN.exe
  C:\Windows\System\NXnxsYN.exe
  2⤵
  PID:7100
- C:\Windows\System\wjGMXEU.exe
  C:\Windows\System\wjGMXEU.exe
  2⤵
  PID:6192
- C:\Windows\System\UvNPkSc.exe
  C:\Windows\System\UvNPkSc.exe
  2⤵
  PID:6572
- C:\Windows\System\WAfneLB.exe
  C:\Windows\System\WAfneLB.exe
  2⤵
  PID:6952
- C:\Windows\System\SmhvuSe.exe
  C:\Windows\System\SmhvuSe.exe
  2⤵
  PID:6500
- C:\Windows\System\hPfZVYE.exe
  C:\Windows\System\hPfZVYE.exe
  2⤵
  PID:7052
- C:\Windows\System\YxgivKw.exe
  C:\Windows\System\YxgivKw.exe
  2⤵
  PID:7184
- C:\Windows\System\fdpaQIF.exe
  C:\Windows\System\fdpaQIF.exe
  2⤵
  PID:7212
- C:\Windows\System\uDyIHcE.exe
  C:\Windows\System\uDyIHcE.exe
  2⤵
  PID:7244
- C:\Windows\System\ZhsDiRZ.exe
  C:\Windows\System\ZhsDiRZ.exe
  2⤵
  PID:7272
- C:\Windows\System\DsgMgfu.exe
  C:\Windows\System\DsgMgfu.exe
  2⤵
  PID:7300
- C:\Windows\System\WVClEaG.exe
  C:\Windows\System\WVClEaG.exe
  2⤵
  PID:7332
- C:\Windows\System\ckywyAn.exe
  C:\Windows\System\ckywyAn.exe
  2⤵
  PID:7356
- C:\Windows\System\UkPUKLq.exe
  C:\Windows\System\UkPUKLq.exe
  2⤵
  PID:7384
- C:\Windows\System\nQpTjGB.exe
  C:\Windows\System\nQpTjGB.exe
  2⤵
  PID:7412
- C:\Windows\System\uQcpRnc.exe
  C:\Windows\System\uQcpRnc.exe
  2⤵
  PID:7440
- C:\Windows\System\HbtNIgD.exe
  C:\Windows\System\HbtNIgD.exe
  2⤵
  PID:7468
- C:\Windows\System\tmoMTsi.exe
  C:\Windows\System\tmoMTsi.exe
  2⤵
  PID:7496
- C:\Windows\System\IedqyFs.exe
  C:\Windows\System\IedqyFs.exe
  2⤵
  PID:7524
- C:\Windows\System\MNSVTKP.exe
  C:\Windows\System\MNSVTKP.exe
  2⤵
  PID:7552
- C:\Windows\System\CtEWWTE.exe
  C:\Windows\System\CtEWWTE.exe
  2⤵
  PID:7580
- C:\Windows\System\FHoeLzH.exe
  C:\Windows\System\FHoeLzH.exe
  2⤵
  PID:7612
- C:\Windows\System\UfdjvjQ.exe
  C:\Windows\System\UfdjvjQ.exe
  2⤵
  PID:7636
- C:\Windows\System\XrVKvHN.exe
  C:\Windows\System\XrVKvHN.exe
  2⤵
  PID:7664
- C:\Windows\System\HZWaFkR.exe
  C:\Windows\System\HZWaFkR.exe
  2⤵
  PID:7692
- C:\Windows\System\UFaiGVG.exe
  C:\Windows\System\UFaiGVG.exe
  2⤵
  PID:7720
- C:\Windows\System\kpsQcpX.exe
  C:\Windows\System\kpsQcpX.exe
  2⤵
  PID:7748
- C:\Windows\System\ILdaunn.exe
  C:\Windows\System\ILdaunn.exe
  2⤵
  PID:7776
- C:\Windows\System\QrwagLW.exe
  C:\Windows\System\QrwagLW.exe
  2⤵
  PID:7804
- C:\Windows\System\oScirfU.exe
  C:\Windows\System\oScirfU.exe
  2⤵
  PID:7832
- C:\Windows\System\TJuZpDw.exe
  C:\Windows\System\TJuZpDw.exe
  2⤵
  PID:7860
- C:\Windows\System\pqDRgrg.exe
  C:\Windows\System\pqDRgrg.exe
  2⤵
  PID:7888
- C:\Windows\System\FrDJCdb.exe
  C:\Windows\System\FrDJCdb.exe
  2⤵
  PID:7916
- C:\Windows\System\VgiEIKY.exe
  C:\Windows\System\VgiEIKY.exe
  2⤵
  PID:7944
- C:\Windows\System\yrkwWOf.exe
  C:\Windows\System\yrkwWOf.exe
  2⤵
  PID:7972
- C:\Windows\System\JWegLrD.exe
  C:\Windows\System\JWegLrD.exe
  2⤵
  PID:8000
- C:\Windows\System\LgmdKpi.exe
  C:\Windows\System\LgmdKpi.exe
  2⤵
  PID:8028
- C:\Windows\System\uPbxkZP.exe
  C:\Windows\System\uPbxkZP.exe
  2⤵
  PID:8056
- C:\Windows\System\hFBBqYS.exe
  C:\Windows\System\hFBBqYS.exe
  2⤵
  PID:8084
- C:\Windows\System\HvumKfu.exe
  C:\Windows\System\HvumKfu.exe
  2⤵
  PID:8112
- C:\Windows\System\tePiZJK.exe
  C:\Windows\System\tePiZJK.exe
  2⤵
  PID:8140
- C:\Windows\System\SKBRUNB.exe
  C:\Windows\System\SKBRUNB.exe
  2⤵
  PID:8168
- C:\Windows\System\lmbYoqc.exe
  C:\Windows\System\lmbYoqc.exe
  2⤵
  PID:7176
- C:\Windows\System\INPYJov.exe
  C:\Windows\System\INPYJov.exe
  2⤵
  PID:7240
- C:\Windows\System\lHcXepH.exe
  C:\Windows\System\lHcXepH.exe
  2⤵
  PID:7312
- C:\Windows\System\upasXep.exe
  C:\Windows\System\upasXep.exe
  2⤵
  PID:7376
- C:\Windows\System\vNaxadB.exe
  C:\Windows\System\vNaxadB.exe
  2⤵
  PID:7436
- C:\Windows\System\TKfTrEv.exe
  C:\Windows\System\TKfTrEv.exe
  2⤵
  PID:7508
- C:\Windows\System\qbEaBIw.exe
  C:\Windows\System\qbEaBIw.exe
  2⤵
  PID:7572
- C:\Windows\System\eTdbzaR.exe
  C:\Windows\System\eTdbzaR.exe
  2⤵
  PID:7632
- C:\Windows\System\wqEOGTo.exe
  C:\Windows\System\wqEOGTo.exe
  2⤵
  PID:7704
- C:\Windows\System\UfiMuKE.exe
  C:\Windows\System\UfiMuKE.exe
  2⤵
  PID:7768
- C:\Windows\System\biPiHwE.exe
  C:\Windows\System\biPiHwE.exe
  2⤵
  PID:7824
- C:\Windows\System\UjaElwm.exe
  C:\Windows\System\UjaElwm.exe
  2⤵
  PID:7900
- C:\Windows\System\TPMWAvf.exe
  C:\Windows\System\TPMWAvf.exe
  2⤵
  PID:7964
- C:\Windows\System\zmsveCG.exe
  C:\Windows\System\zmsveCG.exe
  2⤵
  PID:8024
- C:\Windows\System\VYMopnL.exe
  C:\Windows\System\VYMopnL.exe
  2⤵
  PID:8096
- C:\Windows\System\AsDxrWJ.exe
  C:\Windows\System\AsDxrWJ.exe
  2⤵
  PID:8160
- C:\Windows\System\vYeThjO.exe
  C:\Windows\System\vYeThjO.exe
  2⤵
  PID:7236
- C:\Windows\System\cwmEEyU.exe
  C:\Windows\System\cwmEEyU.exe
  2⤵
  PID:7408
- C:\Windows\System\oerEaTU.exe
  C:\Windows\System\oerEaTU.exe
  2⤵
  PID:7544
- C:\Windows\System\EJAwhqe.exe
  C:\Windows\System\EJAwhqe.exe
  2⤵
  PID:7628
- C:\Windows\System\whDCkgq.exe
  C:\Windows\System\whDCkgq.exe
  2⤵
  PID:7760
- C:\Windows\System\dJVrxUR.exe
  C:\Windows\System\dJVrxUR.exe
  2⤵
  PID:7940
- C:\Windows\System\LFFlvSa.exe
  C:\Windows\System\LFFlvSa.exe
  2⤵
  PID:8076
- C:\Windows\System\BpLzYMP.exe
  C:\Windows\System\BpLzYMP.exe
  2⤵
  PID:7352
- C:\Windows\System\KleZEEZ.exe
  C:\Windows\System\KleZEEZ.exe
  2⤵
  PID:7732
- C:\Windows\System\KvJLqpv.exe
  C:\Windows\System\KvJLqpv.exe
  2⤵
  PID:8152
- C:\Windows\System\ZicZpRT.exe
  C:\Windows\System\ZicZpRT.exe
  2⤵
  PID:7600
- C:\Windows\System\gpkONjX.exe
  C:\Windows\System\gpkONjX.exe
  2⤵
  PID:7880
- C:\Windows\System\mzuXSqN.exe
  C:\Windows\System\mzuXSqN.exe
  2⤵
  PID:8212
- C:\Windows\System\XPWIVjs.exe
  C:\Windows\System\XPWIVjs.exe
  2⤵
  PID:8240
- C:\Windows\System\KpFAJDX.exe
  C:\Windows\System\KpFAJDX.exe
  2⤵
  PID:8268
- C:\Windows\System\JQMDiVU.exe
  C:\Windows\System\JQMDiVU.exe
  2⤵
  PID:8288
- C:\Windows\System\PYmVNfn.exe
  C:\Windows\System\PYmVNfn.exe
  2⤵
  PID:8308
- C:\Windows\System\YCATuDy.exe
  C:\Windows\System\YCATuDy.exe
  2⤵
  PID:8332
- C:\Windows\System\uvYBNCp.exe
  C:\Windows\System\uvYBNCp.exe
  2⤵
  PID:8372
- C:\Windows\System\kOONomf.exe
  C:\Windows\System\kOONomf.exe
  2⤵
  PID:8392
- C:\Windows\System\cfKZUbJ.exe
  C:\Windows\System\cfKZUbJ.exe
  2⤵
  PID:8420
- C:\Windows\System\JtRAJlR.exe
  C:\Windows\System\JtRAJlR.exe
  2⤵
  PID:8452
- C:\Windows\System\gEqaHfS.exe
  C:\Windows\System\gEqaHfS.exe
  2⤵
  PID:8484
- C:\Windows\System\KHQjsss.exe
  C:\Windows\System\KHQjsss.exe
  2⤵
  PID:8520
- C:\Windows\System\wIWOgNy.exe
  C:\Windows\System\wIWOgNy.exe
  2⤵
  PID:8540
- C:\Windows\System\JlZdhci.exe
  C:\Windows\System\JlZdhci.exe
  2⤵
  PID:8572
- C:\Windows\System\gtlesmg.exe
  C:\Windows\System\gtlesmg.exe
  2⤵
  PID:8600
- C:\Windows\System\jHPtLQB.exe
  C:\Windows\System\jHPtLQB.exe
  2⤵
  PID:8624
- C:\Windows\System\aOhPKmh.exe
  C:\Windows\System\aOhPKmh.exe
  2⤵
  PID:8644
- C:\Windows\System\BrUIrFi.exe
  C:\Windows\System\BrUIrFi.exe
  2⤵
  PID:8668
- C:\Windows\System\kAEtflX.exe
  C:\Windows\System\kAEtflX.exe
  2⤵
  PID:8700
- C:\Windows\System\lDJrPqJ.exe
  C:\Windows\System\lDJrPqJ.exe
  2⤵
  PID:8724
- C:\Windows\System\tkCGCxE.exe
  C:\Windows\System\tkCGCxE.exe
  2⤵
  PID:8752
- C:\Windows\System\yxNjRKb.exe
  C:\Windows\System\yxNjRKb.exe
  2⤵
  PID:8772
- C:\Windows\System\ZERbyVn.exe
  C:\Windows\System\ZERbyVn.exe
  2⤵
  PID:8840
- C:\Windows\System\sQvOFxs.exe
  C:\Windows\System\sQvOFxs.exe
  2⤵
  PID:8860
- C:\Windows\System\GnRUaSO.exe
  C:\Windows\System\GnRUaSO.exe
  2⤵
  PID:8888
- C:\Windows\System\aMkLcQy.exe
  C:\Windows\System\aMkLcQy.exe
  2⤵
  PID:8916
- C:\Windows\System\LNJarMK.exe
  C:\Windows\System\LNJarMK.exe
  2⤵
  PID:8936
- C:\Windows\System\wIrFvkX.exe
  C:\Windows\System\wIrFvkX.exe
  2⤵
  PID:8972
- C:\Windows\System\ZvslcOY.exe
  C:\Windows\System\ZvslcOY.exe
  2⤵
  PID:8988
- C:\Windows\System\RJCWIbt.exe
  C:\Windows\System\RJCWIbt.exe
  2⤵
  PID:9016
- C:\Windows\System\oTbGxsG.exe
  C:\Windows\System\oTbGxsG.exe
  2⤵
  PID:9048
- C:\Windows\System\FNqYBeF.exe
  C:\Windows\System\FNqYBeF.exe
  2⤵
  PID:9084
- C:\Windows\System\ZNOlzcZ.exe
  C:\Windows\System\ZNOlzcZ.exe
  2⤵
  PID:9100
- C:\Windows\System\DmKeooJ.exe
  C:\Windows\System\DmKeooJ.exe
  2⤵
  PID:9128
- C:\Windows\System\TveNVXG.exe
  C:\Windows\System\TveNVXG.exe
  2⤵
  PID:9168
- C:\Windows\System\hNWuEBi.exe
  C:\Windows\System\hNWuEBi.exe
  2⤵
  PID:9196
- C:\Windows\System\guTlVGP.exe
  C:\Windows\System\guTlVGP.exe
  2⤵
  PID:8200
- C:\Windows\System\QNNWOlg.exe
  C:\Windows\System\QNNWOlg.exe
  2⤵
  PID:8276
- C:\Windows\System\QjqCuOS.exe
  C:\Windows\System\QjqCuOS.exe
  2⤵
  PID:8340
- C:\Windows\System\RuFYUof.exe
  C:\Windows\System\RuFYUof.exe
  2⤵
  PID:8404
- C:\Windows\System\kJtYAUk.exe
  C:\Windows\System\kJtYAUk.exe
  2⤵
  PID:8428
- C:\Windows\System\dLZGQmu.exe
  C:\Windows\System\dLZGQmu.exe
  2⤵
  PID:8508
- C:\Windows\System\TgDxBNy.exe
  C:\Windows\System\TgDxBNy.exe
  2⤵
  PID:8528
- C:\Windows\System\YxscCkz.exe
  C:\Windows\System\YxscCkz.exe
  2⤵
  PID:8596
- C:\Windows\System\kBJgqVv.exe
  C:\Windows\System\kBJgqVv.exe
  2⤵
  PID:8656
- C:\Windows\System\RLrtQKy.exe
  C:\Windows\System\RLrtQKy.exe
  2⤵
  PID:8760
- C:\Windows\System\sCemhXe.exe
  C:\Windows\System\sCemhXe.exe
  2⤵
  PID:8852
- C:\Windows\System\yMzlRXQ.exe
  C:\Windows\System\yMzlRXQ.exe
  2⤵
  PID:8912
- C:\Windows\System\TMQdSmN.exe
  C:\Windows\System\TMQdSmN.exe
  2⤵
  PID:8984
- C:\Windows\System\mzCbEsw.exe
  C:\Windows\System\mzCbEsw.exe
  2⤵
  PID:9028
- C:\Windows\System\XpXdmAP.exe
  C:\Windows\System\XpXdmAP.exe
  2⤵
  PID:9120
- C:\Windows\System\bCkvUHm.exe
  C:\Windows\System\bCkvUHm.exe
  2⤵
  PID:9184
- C:\Windows\System\KKJiggp.exe
  C:\Windows\System\KKJiggp.exe
  2⤵
  PID:8236
- C:\Windows\System\EJLIilY.exe
  C:\Windows\System\EJLIilY.exe
  2⤵
  PID:8388
- C:\Windows\System\XMzEqPa.exe
  C:\Windows\System\XMzEqPa.exe
  2⤵
  PID:8512
- C:\Windows\System\CpqTiDw.exe
  C:\Windows\System\CpqTiDw.exe
  2⤵
  PID:8768
- C:\Windows\System\DokSutT.exe
  C:\Windows\System\DokSutT.exe
  2⤵
  PID:8808
- C:\Windows\System\ZjYxUuN.exe
  C:\Windows\System\ZjYxUuN.exe
  2⤵
  PID:9004
- C:\Windows\System\NvBLovp.exe
  C:\Windows\System\NvBLovp.exe
  2⤵
  PID:9056
- C:\Windows\System\dnkqJwu.exe
  C:\Windows\System\dnkqJwu.exe
  2⤵
  PID:9152
- C:\Windows\System\OOFjHjy.exe
  C:\Windows\System\OOFjHjy.exe
  2⤵
  PID:8620
- C:\Windows\System\qCYBQXc.exe
  C:\Windows\System\qCYBQXc.exe
  2⤵
  PID:8924
- C:\Windows\System\thPScKV.exe
  C:\Windows\System\thPScKV.exe
  2⤵
  PID:8476
- C:\Windows\System\ncJCbhB.exe
  C:\Windows\System\ncJCbhB.exe
  2⤵
  PID:9224
- C:\Windows\System\AdDXmOt.exe
  C:\Windows\System\AdDXmOt.exe
  2⤵
  PID:9240
- C:\Windows\System\vIhFxWD.exe
  C:\Windows\System\vIhFxWD.exe
  2⤵
  PID:9272
- C:\Windows\System\HVBjhJE.exe
  C:\Windows\System\HVBjhJE.exe
  2⤵
  PID:9296
- C:\Windows\System\jzKEGur.exe
  C:\Windows\System\jzKEGur.exe
  2⤵
  PID:9328
- C:\Windows\System\ZAfvjfk.exe
  C:\Windows\System\ZAfvjfk.exe
  2⤵
  PID:9364
- C:\Windows\System\qYuEyus.exe
  C:\Windows\System\qYuEyus.exe
  2⤵
  PID:9396
- C:\Windows\System\lRpXrMo.exe
  C:\Windows\System\lRpXrMo.exe
  2⤵
  PID:9420
- C:\Windows\System\AhutLsy.exe
  C:\Windows\System\AhutLsy.exe
  2⤵
  PID:9452
- C:\Windows\System\sPUpbvT.exe
  C:\Windows\System\sPUpbvT.exe
  2⤵
  PID:9480
- C:\Windows\System\WGfveYG.exe
  C:\Windows\System\WGfveYG.exe
  2⤵
  PID:9508
- C:\Windows\System\tVQlPur.exe
  C:\Windows\System\tVQlPur.exe
  2⤵
  PID:9536
- C:\Windows\System\RyPCMhe.exe
  C:\Windows\System\RyPCMhe.exe
  2⤵
  PID:9564
- C:\Windows\System\xxyzdnk.exe
  C:\Windows\System\xxyzdnk.exe
  2⤵
  PID:9596
- C:\Windows\System\eucHwyv.exe
  C:\Windows\System\eucHwyv.exe
  2⤵
  PID:9632
- C:\Windows\System\PhCritU.exe
  C:\Windows\System\PhCritU.exe
  2⤵
  PID:9664
- C:\Windows\System\pNjHYEG.exe
  C:\Windows\System\pNjHYEG.exe
  2⤵
  PID:9688
- C:\Windows\System\gxKhaUs.exe
  C:\Windows\System\gxKhaUs.exe
  2⤵
  PID:9716
- C:\Windows\System\aZOSPBM.exe
  C:\Windows\System\aZOSPBM.exe
  2⤵
  PID:9748
- C:\Windows\System\AwWaTCX.exe
  C:\Windows\System\AwWaTCX.exe
  2⤵
  PID:9780
- C:\Windows\System\bMzNvQM.exe
  C:\Windows\System\bMzNvQM.exe
  2⤵
  PID:9804
- C:\Windows\System\TGndtbW.exe
  C:\Windows\System\TGndtbW.exe
  2⤵
  PID:9828
- C:\Windows\System\AQXCJdM.exe
  C:\Windows\System\AQXCJdM.exe
  2⤵
  PID:9848
- C:\Windows\System\cnxxMnN.exe
  C:\Windows\System\cnxxMnN.exe
  2⤵
  PID:9884
- C:\Windows\System\sMiwYaH.exe
  C:\Windows\System\sMiwYaH.exe
  2⤵
  PID:9900
- C:\Windows\System\JXwlAUX.exe
  C:\Windows\System\JXwlAUX.exe
  2⤵
  PID:9920
- C:\Windows\System\mCxVvyJ.exe
  C:\Windows\System\mCxVvyJ.exe
  2⤵
  PID:9944
- C:\Windows\System\JzXNEHV.exe
  C:\Windows\System\JzXNEHV.exe
  2⤵
  PID:9964
- C:\Windows\System\MXKWmMK.exe
  C:\Windows\System\MXKWmMK.exe
  2⤵
  PID:9992
- C:\Windows\System\WhjJJUy.exe
  C:\Windows\System\WhjJJUy.exe
  2⤵
  PID:10020
- C:\Windows\System\NJcVjDd.exe
  C:\Windows\System\NJcVjDd.exe
  2⤵
  PID:10060
- C:\Windows\System\cynbcRG.exe
  C:\Windows\System\cynbcRG.exe
  2⤵
  PID:10076
- C:\Windows\System\gApFDOr.exe
  C:\Windows\System\gApFDOr.exe
  2⤵
  PID:10116
- C:\Windows\System\hHgoyLS.exe
  C:\Windows\System\hHgoyLS.exe
  2⤵
  PID:10148
- C:\Windows\System\AwAGuKA.exe
  C:\Windows\System\AwAGuKA.exe
  2⤵
  PID:10176
- C:\Windows\System\JmuKogg.exe
  C:\Windows\System\JmuKogg.exe
  2⤵
  PID:10216
- C:\Windows\System\tvCinSQ.exe
  C:\Windows\System\tvCinSQ.exe
  2⤵
  PID:9252
- C:\Windows\System\IpRPenz.exe
  C:\Windows\System\IpRPenz.exe
  2⤵
  PID:9260
- C:\Windows\System\QSXdMQY.exe
  C:\Windows\System\QSXdMQY.exe
  2⤵
  PID:9312
- C:\Windows\System\MPqySvd.exe
  C:\Windows\System\MPqySvd.exe
  2⤵
  PID:9416
- C:\Windows\System\DkeXCmI.exe
  C:\Windows\System\DkeXCmI.exe
  2⤵
  PID:9472
- C:\Windows\System\wyVdjJt.exe
  C:\Windows\System\wyVdjJt.exe
  2⤵
  PID:9544
- C:\Windows\System\RfdJMmt.exe
  C:\Windows\System\RfdJMmt.exe
  2⤵
  PID:9604
- C:\Windows\System\cucNyuH.exe
  C:\Windows\System\cucNyuH.exe
  2⤵
  PID:9648
- C:\Windows\System\PSyNwsB.exe
  C:\Windows\System\PSyNwsB.exe
  2⤵
  PID:9732
- C:\Windows\System\CLQqltO.exe
  C:\Windows\System\CLQqltO.exe
  2⤵
  PID:9772
- C:\Windows\System\CdsgshL.exe
  C:\Windows\System\CdsgshL.exe
  2⤵
  PID:9820
- C:\Windows\System\BlArujo.exe
  C:\Windows\System\BlArujo.exe
  2⤵
  PID:9892
- C:\Windows\System\cHVXDgQ.exe
  C:\Windows\System\cHVXDgQ.exe
  2⤵
  PID:9940
- C:\Windows\System\jJCKSoe.exe
  C:\Windows\System\jJCKSoe.exe
  2⤵
  PID:9916
- C:\Windows\System\LgHHRiv.exe
  C:\Windows\System\LgHHRiv.exe
  2⤵
  PID:9980
- C:\Windows\System\VsetlYF.exe
  C:\Windows\System\VsetlYF.exe
  2⤵
  PID:10104
- C:\Windows\System\YmnpgSM.exe
  C:\Windows\System\YmnpgSM.exe
  2⤵
  PID:10184
- C:\Windows\System\bwHUWeF.exe
  C:\Windows\System\bwHUWeF.exe
  2⤵
  PID:10196
- C:\Windows\System\DWVKZXL.exe
  C:\Windows\System\DWVKZXL.exe
  2⤵
  PID:9412
- C:\Windows\System\ClefqlM.exe
  C:\Windows\System\ClefqlM.exe
  2⤵
  PID:9464
- C:\Windows\System\YLacsgE.exe
  C:\Windows\System\YLacsgE.exe
  2⤵
  PID:9728
- C:\Windows\System\OcOlVYb.exe
  C:\Windows\System\OcOlVYb.exe
  2⤵
  PID:9864
- C:\Windows\System\HgSXrlj.exe
  C:\Windows\System\HgSXrlj.exe
  2⤵
  PID:10012
- C:\Windows\System\fadjnou.exe
  C:\Windows\System\fadjnou.exe
  2⤵
  PID:10200
- C:\Windows\System\pQmdemt.exe
  C:\Windows\System\pQmdemt.exe
  2⤵
  PID:9356
- C:\Windows\System\gCPqGLo.exe
  C:\Windows\System\gCPqGLo.exe
  2⤵
  PID:9708
- C:\Windows\System\KvUWILv.exe
  C:\Windows\System\KvUWILv.exe
  2⤵
  PID:10100
- C:\Windows\System\IygberA.exe
  C:\Windows\System\IygberA.exe
  2⤵
  PID:10248
- C:\Windows\System\CETIaPe.exe
  C:\Windows\System\CETIaPe.exe
  2⤵
  PID:10264
- C:\Windows\System\WuuUkQI.exe
  C:\Windows\System\WuuUkQI.exe
  2⤵
  PID:10304
- C:\Windows\System\SAvvITm.exe
  C:\Windows\System\SAvvITm.exe
  2⤵
  PID:10320
- C:\Windows\System\ralPOOj.exe
  C:\Windows\System\ralPOOj.exe
  2⤵
  PID:10356
- C:\Windows\System\eMrNxHH.exe
  C:\Windows\System\eMrNxHH.exe
  2⤵
  PID:10388
- C:\Windows\System\VuXFQUm.exe
  C:\Windows\System\VuXFQUm.exe
  2⤵
  PID:10404
- C:\Windows\System\bwpzwhh.exe
  C:\Windows\System\bwpzwhh.exe
  2⤵
  PID:10420
- C:\Windows\System\CGRsEIf.exe
  C:\Windows\System\CGRsEIf.exe
  2⤵
  PID:10452
- C:\Windows\System\kWLbwBM.exe
  C:\Windows\System\kWLbwBM.exe
  2⤵
  PID:10480
- C:\Windows\System\PkevcKs.exe
  C:\Windows\System\PkevcKs.exe
  2⤵
  PID:10516
- C:\Windows\System\cqJPJQL.exe
  C:\Windows\System\cqJPJQL.exe
  2⤵
  PID:10548
- C:\Windows\System\CMGLtkb.exe
  C:\Windows\System\CMGLtkb.exe
  2⤵
  PID:10580
- C:\Windows\System\BdxhdMd.exe
  C:\Windows\System\BdxhdMd.exe
  2⤵
  PID:10608
- C:\Windows\System\QJdvphI.exe
  C:\Windows\System\QJdvphI.exe
  2⤵
  PID:10632
- C:\Windows\System\Skorliv.exe
  C:\Windows\System\Skorliv.exe
  2⤵
  PID:10664
- C:\Windows\System\XvkzHuo.exe
  C:\Windows\System\XvkzHuo.exe
  2⤵
  PID:10688
- C:\Windows\System\mRiqOcK.exe
  C:\Windows\System\mRiqOcK.exe
  2⤵
  PID:10716
- C:\Windows\System\ptbpVCD.exe
  C:\Windows\System\ptbpVCD.exe
  2⤵
  PID:10744
- C:\Windows\System\sDfIvmn.exe
  C:\Windows\System\sDfIvmn.exe
  2⤵
  PID:10772
- C:\Windows\System\MpdZBSi.exe
  C:\Windows\System\MpdZBSi.exe
  2⤵
  PID:10800
- C:\Windows\System\fdQrLbE.exe
  C:\Windows\System\fdQrLbE.exe
  2⤵
  PID:10828
- C:\Windows\System\XLaQuiQ.exe
  C:\Windows\System\XLaQuiQ.exe
  2⤵
  PID:10856
- C:\Windows\System\hHVbfnN.exe
  C:\Windows\System\hHVbfnN.exe
  2⤵
  PID:10888
- C:\Windows\System\ZuLrJTj.exe
  C:\Windows\System\ZuLrJTj.exe
  2⤵
  PID:10912
- C:\Windows\System\coGoRat.exe
  C:\Windows\System\coGoRat.exe
  2⤵
  PID:10940
- C:\Windows\System\wIxBYxK.exe
  C:\Windows\System\wIxBYxK.exe
  2⤵
  PID:10972
- C:\Windows\System\HPMUWNJ.exe
  C:\Windows\System\HPMUWNJ.exe
  2⤵
  PID:11000
- C:\Windows\System\HjpCIhd.exe
  C:\Windows\System\HjpCIhd.exe
  2⤵
  PID:11036
- C:\Windows\System\ByEzMwC.exe
  C:\Windows\System\ByEzMwC.exe
  2⤵
  PID:11064
- C:\Windows\System\ALUaBmd.exe
  C:\Windows\System\ALUaBmd.exe
  2⤵
  PID:11092
- C:\Windows\System\pDVvDdT.exe
  C:\Windows\System\pDVvDdT.exe
  2⤵
  PID:11112
- C:\Windows\System\FDdBSfn.exe
  C:\Windows\System\FDdBSfn.exe
  2⤵
  PID:11148
- C:\Windows\System\iNJELlr.exe
  C:\Windows\System\iNJELlr.exe
  2⤵
  PID:11176
- C:\Windows\System\sNDAbtG.exe
  C:\Windows\System\sNDAbtG.exe
  2⤵
  PID:11200
- C:\Windows\System\MqBmgJM.exe
  C:\Windows\System\MqBmgJM.exe
  2⤵
  PID:11220
- C:\Windows\System\jdOOUxd.exe
  C:\Windows\System\jdOOUxd.exe
  2⤵
  PID:11244
- C:\Windows\System\rswrCRK.exe
  C:\Windows\System\rswrCRK.exe
  2⤵
  PID:9960
- C:\Windows\System\WjudPZj.exe
  C:\Windows\System\WjudPZj.exe
  2⤵
  PID:10288
- C:\Windows\System\vcTbJCy.exe
  C:\Windows\System\vcTbJCy.exe
  2⤵
  PID:10372
- C:\Windows\System\OlteRhM.exe
  C:\Windows\System\OlteRhM.exe
  2⤵
  PID:10396
- C:\Windows\System\AbvcRDn.exe
  C:\Windows\System\AbvcRDn.exe
  2⤵
  PID:10496
- C:\Windows\System\vMeUMOO.exe
  C:\Windows\System\vMeUMOO.exe
  2⤵
  PID:10568
- C:\Windows\System\mbDErOY.exe
  C:\Windows\System\mbDErOY.exe
  2⤵
  PID:10616
- C:\Windows\System\ECMzZSb.exe
  C:\Windows\System\ECMzZSb.exe
  2⤵
  PID:10680
- C:\Windows\System\wPTmGBA.exe
  C:\Windows\System\wPTmGBA.exe
  2⤵
  PID:10704
- C:\Windows\System\OlqVzGx.exe
  C:\Windows\System\OlqVzGx.exe
  2⤵
  PID:10768
- C:\Windows\System\KLeFqrK.exe
  C:\Windows\System\KLeFqrK.exe
  2⤵
  PID:10840
- C:\Windows\System\RrMzgJb.exe
  C:\Windows\System\RrMzgJb.exe
  2⤵
  PID:10924
- C:\Windows\System\VbXwGxr.exe
  C:\Windows\System\VbXwGxr.exe
  2⤵
  PID:10984
- C:\Windows\System\GwHBbtu.exe
  C:\Windows\System\GwHBbtu.exe
  2⤵
  PID:11052
- C:\Windows\System\aHfjPlC.exe
  C:\Windows\System\aHfjPlC.exe
  2⤵
  PID:11136
- C:\Windows\System\HbpbGzd.exe
  C:\Windows\System\HbpbGzd.exe
  2⤵
  PID:11216
- C:\Windows\System\vShzIKa.exe
  C:\Windows\System\vShzIKa.exe
  2⤵
  PID:10260
- C:\Windows\System\WUsfTVO.exe
  C:\Windows\System\WUsfTVO.exe
  2⤵
  PID:10416
- C:\Windows\System\eIjCZMx.exe
  C:\Windows\System\eIjCZMx.exe
  2⤵
  PID:10556
- C:\Windows\System\QSTPtnT.exe
  C:\Windows\System\QSTPtnT.exe
  2⤵
  PID:10676
- C:\Windows\System\JjabEbL.exe
  C:\Windows\System\JjabEbL.exe
  2⤵
  PID:10928
- C:\Windows\System\QudRJfa.exe
  C:\Windows\System\QudRJfa.exe
  2⤵
  PID:11020
- C:\Windows\System\bxLmSgd.exe
  C:\Windows\System\bxLmSgd.exe
  2⤵
  PID:11168
- C:\Windows\System\kvypzvS.exe
  C:\Windows\System\kvypzvS.exe
  2⤵
  PID:10340
- C:\Windows\System\AgokuFy.exe
  C:\Windows\System\AgokuFy.exe
  2⤵
  PID:10656
- C:\Windows\System\jBPNcJj.exe
  C:\Windows\System\jBPNcJj.exe
  2⤵
  PID:11108
- C:\Windows\System\NhQNRTR.exe
  C:\Windows\System\NhQNRTR.exe
  2⤵
  PID:10376
- C:\Windows\System\UvkdMtT.exe
  C:\Windows\System\UvkdMtT.exe
  2⤵
  PID:11160
- C:\Windows\System\kpRNTQp.exe
  C:\Windows\System\kpRNTQp.exe
  2⤵
  PID:11284
- C:\Windows\System\jbooYih.exe
  C:\Windows\System\jbooYih.exe
  2⤵
  PID:11312
- C:\Windows\System\uXTxQtW.exe
  C:\Windows\System\uXTxQtW.exe
  2⤵
  PID:11340
- C:\Windows\System\KkJWNuN.exe
  C:\Windows\System\KkJWNuN.exe
  2⤵
  PID:11384
- C:\Windows\System\rlTiIaw.exe
  C:\Windows\System\rlTiIaw.exe
  2⤵
  PID:11420
- C:\Windows\System\OjtTczt.exe
  C:\Windows\System\OjtTczt.exe
  2⤵
  PID:11436
- C:\Windows\System\oBUnPvY.exe
  C:\Windows\System\oBUnPvY.exe
  2⤵
  PID:11464
- C:\Windows\System\JSHaCdP.exe
  C:\Windows\System\JSHaCdP.exe
  2⤵
  PID:11492
- C:\Windows\System\fzMuqKo.exe
  C:\Windows\System\fzMuqKo.exe
  2⤵
  PID:11520
- C:\Windows\System\LPpreZf.exe
  C:\Windows\System\LPpreZf.exe
  2⤵
  PID:11548
- C:\Windows\System\MFheJFl.exe
  C:\Windows\System\MFheJFl.exe
  2⤵
  PID:11576
- C:\Windows\System\ScBKtOK.exe
  C:\Windows\System\ScBKtOK.exe
  2⤵
  PID:11604
- C:\Windows\System\jXhYlPA.exe
  C:\Windows\System\jXhYlPA.exe
  2⤵
  PID:11632
- C:\Windows\System\AAOsiNb.exe
  C:\Windows\System\AAOsiNb.exe
  2⤵
  PID:11648
- C:\Windows\System\znYiMCF.exe
  C:\Windows\System\znYiMCF.exe
  2⤵
  PID:11688
- C:\Windows\System\aVegwgq.exe
  C:\Windows\System\aVegwgq.exe
  2⤵
  PID:11716
- C:\Windows\System\LRbErSQ.exe
  C:\Windows\System\LRbErSQ.exe
  2⤵
  PID:11744
- C:\Windows\System\qPCnFiL.exe
  C:\Windows\System\qPCnFiL.exe
  2⤵
  PID:11772
- C:\Windows\System\rAOSmAu.exe
  C:\Windows\System\rAOSmAu.exe
  2⤵
  PID:11804
- C:\Windows\System\vHtishk.exe
  C:\Windows\System\vHtishk.exe
  2⤵
  PID:11832
- C:\Windows\System\wszhDHl.exe
  C:\Windows\System\wszhDHl.exe
  2⤵
  PID:11856
- C:\Windows\System\Ubkjkde.exe
  C:\Windows\System\Ubkjkde.exe
  2⤵
  PID:11880
- C:\Windows\System\aYYeHzI.exe
  C:\Windows\System\aYYeHzI.exe
  2⤵
  PID:11900
- C:\Windows\System\vMsEaFr.exe
  C:\Windows\System\vMsEaFr.exe
  2⤵
  PID:11932
- C:\Windows\System\TWmKMRt.exe
  C:\Windows\System\TWmKMRt.exe
  2⤵
  PID:11960
- C:\Windows\System\yGazJVM.exe
  C:\Windows\System\yGazJVM.exe
  2⤵
  PID:11996
- C:\Windows\System\lHWmcWN.exe
  C:\Windows\System\lHWmcWN.exe
  2⤵
  PID:12016
- C:\Windows\System\QJoFdiB.exe
  C:\Windows\System\QJoFdiB.exe
  2⤵
  PID:12048
- C:\Windows\System\FrZQGST.exe
  C:\Windows\System\FrZQGST.exe
  2⤵
  PID:12080
- C:\Windows\System\UIUPGGA.exe
  C:\Windows\System\UIUPGGA.exe
  2⤵
  PID:12096
- C:\Windows\System\AxEXRak.exe
  C:\Windows\System\AxEXRak.exe
  2⤵
  PID:12120
- C:\Windows\System\cfyCEmA.exe
  C:\Windows\System\cfyCEmA.exe
  2⤵
  PID:12148
- C:\Windows\System\wiWddTG.exe
  C:\Windows\System\wiWddTG.exe
  2⤵
  PID:12172
- C:\Windows\System\LRqTmvJ.exe
  C:\Windows\System\LRqTmvJ.exe
  2⤵
  PID:12204
- C:\Windows\System\NOtyxhx.exe
  C:\Windows\System\NOtyxhx.exe
  2⤵
  PID:12240
- C:\Windows\System\oyzHBgN.exe
  C:\Windows\System\oyzHBgN.exe
  2⤵
  PID:12264
- C:\Windows\System\TABgBwB.exe
  C:\Windows\System\TABgBwB.exe
  2⤵
  PID:10164
- C:\Windows\System\OAFTYcI.exe
  C:\Windows\System\OAFTYcI.exe
  2⤵
  PID:11320
- C:\Windows\System\GbXXbkD.exe
  C:\Windows\System\GbXXbkD.exe
  2⤵
  PID:11328
- C:\Windows\System\WTjxAoF.exe
  C:\Windows\System\WTjxAoF.exe
  2⤵
  PID:11448
- C:\Windows\System\ZjMSTzl.exe
  C:\Windows\System\ZjMSTzl.exe
  2⤵
  PID:11516
- C:\Windows\System\GvvpfGY.exe
  C:\Windows\System\GvvpfGY.exe
  2⤵
  PID:11544
- C:\Windows\System\RSlcKEB.exe
  C:\Windows\System\RSlcKEB.exe
  2⤵
  PID:11616
- C:\Windows\System\IuxEOwp.exe
  C:\Windows\System\IuxEOwp.exe
  2⤵
  PID:11672
- C:\Windows\System\fyvzsTs.exe
  C:\Windows\System\fyvzsTs.exe
  2⤵
  PID:11768
- C:\Windows\System\nprwdEC.exe
  C:\Windows\System\nprwdEC.exe
  2⤵
  PID:11848
- C:\Windows\System\CzRlGog.exe
  C:\Windows\System\CzRlGog.exe
  2⤵
  PID:11896
- C:\Windows\System\ORaAQDn.exe
  C:\Windows\System\ORaAQDn.exe
  2⤵
  PID:11988
- C:\Windows\System\WkKjvRU.exe
  C:\Windows\System\WkKjvRU.exe
  2⤵
  PID:12076
- C:\Windows\System\lESqOBA.exe
  C:\Windows\System\lESqOBA.exe
  2⤵
  PID:12108
- C:\Windows\System\XZyDISB.exe
  C:\Windows\System\XZyDISB.exe
  2⤵
  PID:12188
- C:\Windows\System\kQlscOY.exe
  C:\Windows\System\kQlscOY.exe
  2⤵
  PID:12228
- C:\Windows\System\fhClUTh.exe
  C:\Windows\System\fhClUTh.exe
  2⤵
  PID:12280
- C:\Windows\System\SEbeVuL.exe
  C:\Windows\System\SEbeVuL.exe
  2⤵
  PID:11360
- C:\Windows\System\FYCIIAm.exe
  C:\Windows\System\FYCIIAm.exe
  2⤵
  PID:11572
- C:\Windows\System\XZsLczC.exe
  C:\Windows\System\XZsLczC.exe
  2⤵
  PID:11712
- C:\Windows\System\ezDZWyM.exe
  C:\Windows\System\ezDZWyM.exe
  2⤵
  PID:11968
- C:\Windows\System\OIEQotf.exe
  C:\Windows\System\OIEQotf.exe
  2⤵
  PID:12004
- C:\Windows\System\psmYgJb.exe
  C:\Windows\System\psmYgJb.exe
  2⤵
  PID:12144
- C:\Windows\System\tVwplSB.exe
  C:\Windows\System\tVwplSB.exe
  2⤵
  PID:11504
- C:\Windows\System\YbcbyKH.exe
  C:\Windows\System\YbcbyKH.exe
  2⤵
  PID:11812
- C:\Windows\System\XYPkSTz.exe
  C:\Windows\System\XYPkSTz.exe
  2⤵
  PID:12252
- C:\Windows\System\kLxOcGO.exe
  C:\Windows\System\kLxOcGO.exe
  2⤵
  PID:11640
- C:\Windows\System\hfuWmxn.exe
  C:\Windows\System\hfuWmxn.exe
  2⤵
  PID:12316
- C:\Windows\System\GjEHGTz.exe
  C:\Windows\System\GjEHGTz.exe
  2⤵
  PID:12352
- C:\Windows\System\QFAWhrx.exe
  C:\Windows\System\QFAWhrx.exe
  2⤵
  PID:12380
- C:\Windows\System\otvoTTv.exe
  C:\Windows\System\otvoTTv.exe
  2⤵
  PID:12408
- C:\Windows\System\lXTvVxW.exe
  C:\Windows\System\lXTvVxW.exe
  2⤵
  PID:12440
- C:\Windows\System\uFlDKGJ.exe
  C:\Windows\System\uFlDKGJ.exe
  2⤵
  PID:12464
- C:\Windows\System\cgidlnE.exe
  C:\Windows\System\cgidlnE.exe
  2⤵
  PID:12488
- C:\Windows\System\didmQIy.exe
  C:\Windows\System\didmQIy.exe
  2⤵
  PID:12516
- C:\Windows\System\utMwqzM.exe
  C:\Windows\System\utMwqzM.exe
  2⤵
  PID:12548
- C:\Windows\System\GBCMqVw.exe
  C:\Windows\System\GBCMqVw.exe
  2⤵
  PID:12576
- C:\Windows\System\CPEhpmd.exe
  C:\Windows\System\CPEhpmd.exe
  2⤵
  PID:12604
- C:\Windows\System\CYrNIzs.exe
  C:\Windows\System\CYrNIzs.exe
  2⤵
  PID:12636
- C:\Windows\System\edVsHag.exe
  C:\Windows\System\edVsHag.exe
  2⤵
  PID:12656
- C:\Windows\System\ncQgNoA.exe
  C:\Windows\System\ncQgNoA.exe
  2⤵
  PID:12684
- C:\Windows\System\qyKNiFg.exe
  C:\Windows\System\qyKNiFg.exe
  2⤵
  PID:12712
- C:\Windows\System\WbhasBG.exe
  C:\Windows\System\WbhasBG.exe
  2⤵
  PID:12740
- C:\Windows\System\OOGkVqg.exe
  C:\Windows\System\OOGkVqg.exe
  2⤵
  PID:12760
- C:\Windows\System\MCMQFMo.exe
  C:\Windows\System\MCMQFMo.exe
  2⤵
  PID:12780
- C:\Windows\System\XhkDymX.exe
  C:\Windows\System\XhkDymX.exe
  2⤵
  PID:12816
- C:\Windows\System\MbvAJbm.exe
  C:\Windows\System\MbvAJbm.exe
  2⤵
  PID:12844
- C:\Windows\System\yatxNfp.exe
  C:\Windows\System\yatxNfp.exe
  2⤵
  PID:12884
- C:\Windows\System\XrNjbcv.exe
  C:\Windows\System\XrNjbcv.exe
  2⤵
  PID:12912
- C:\Windows\System\HzUGlCW.exe
  C:\Windows\System\HzUGlCW.exe
  2⤵
  PID:12940
- C:\Windows\System\mirAsLa.exe
  C:\Windows\System\mirAsLa.exe
  2⤵
  PID:12968
- C:\Windows\System\fRDKnjK.exe
  C:\Windows\System\fRDKnjK.exe
  2⤵
  PID:12996
- C:\Windows\System\qFbHlrQ.exe
  C:\Windows\System\qFbHlrQ.exe
  2⤵
  PID:13028
- C:\Windows\System\MBzCQpQ.exe
  C:\Windows\System\MBzCQpQ.exe
  2⤵
  PID:13052
- C:\Windows\System\xaexuXG.exe
  C:\Windows\System\xaexuXG.exe
  2⤵
  PID:13080
- C:\Windows\System\RnUCcWH.exe
  C:\Windows\System\RnUCcWH.exe
  2⤵
  PID:13108
- C:\Windows\System\qIsNUxA.exe
  C:\Windows\System\qIsNUxA.exe
  2⤵
  PID:13140
- C:\Windows\System\hcfXqPX.exe
  C:\Windows\System\hcfXqPX.exe
  2⤵
  PID:13168
- C:\Windows\System\qcbJlnU.exe
  C:\Windows\System\qcbJlnU.exe
  2⤵
  PID:13200
- C:\Windows\System\MHuMtim.exe
  C:\Windows\System\MHuMtim.exe
  2⤵
  PID:13232
- C:\Windows\System\ZdLFBgX.exe
  C:\Windows\System\ZdLFBgX.exe
  2⤵
  PID:13248
- C:\Windows\System\BKeQKXa.exe
  C:\Windows\System\BKeQKXa.exe
  2⤵
  PID:13276
- C:\Windows\System\LSsudPW.exe
  C:\Windows\System\LSsudPW.exe
  2⤵
  PID:13304
- C:\Windows\System\ZXAPBDX.exe
  C:\Windows\System\ZXAPBDX.exe
  2⤵
  PID:12344
- C:\Windows\System\orcNzBk.exe
  C:\Windows\System\orcNzBk.exe
  2⤵
  PID:12364
- C:\Windows\System\YYXtYYJ.exe
  C:\Windows\System\YYXtYYJ.exe
  2⤵
  PID:12448
- C:\Windows\System\YznxGVC.exe
  C:\Windows\System\YznxGVC.exe
  2⤵
  PID:12504
- C:\Windows\System\LkrpjVK.exe
  C:\Windows\System\LkrpjVK.exe
  2⤵
  PID:12560
- C:\Windows\System\ywOPtmB.exe
  C:\Windows\System\ywOPtmB.exe
  2⤵
  PID:12620
- C:\Windows\System\tvtcshd.exe
  C:\Windows\System\tvtcshd.exe
  2⤵
  PID:12648
- C:\Windows\System\GTRvJLC.exe
  C:\Windows\System\GTRvJLC.exe
  2⤵
  PID:12724
- C:\Windows\System\AsbvASO.exe
  C:\Windows\System\AsbvASO.exe
  2⤵
  PID:12796
- C:\Windows\System\jQldOmF.exe
  C:\Windows\System\jQldOmF.exe
  2⤵
  PID:12860
- C:\Windows\System\ylKbPMP.exe
  C:\Windows\System\ylKbPMP.exe
  2⤵
  PID:12928
- C:\Windows\System\KPUCjoB.exe
  C:\Windows\System\KPUCjoB.exe
  2⤵
  PID:12988
- C:\Windows\System\JJHJZmv.exe
  C:\Windows\System\JJHJZmv.exe
  2⤵
  PID:13064
- C:\Windows\System\GWCgulo.exe
  C:\Windows\System\GWCgulo.exe
  2⤵
  PID:13148
- C:\Windows\System\jlFtisF.exe
  C:\Windows\System\jlFtisF.exe
  2⤵
  PID:13216
- C:\Windows\System\RLXEYgi.exe
  C:\Windows\System\RLXEYgi.exe
  2⤵
  PID:13268
- C:\Windows\System\taOCHru.exe
  C:\Windows\System\taOCHru.exe
  2⤵
  PID:13288
- C:\Windows\System\pnJHvYt.exe
  C:\Windows\System\pnJHvYt.exe
  2⤵
  PID:12300
- C:\Windows\System\ATMySfc.exe
  C:\Windows\System\ATMySfc.exe
  2⤵
  PID:12544
- C:\Windows\System\PoaFAcF.exe
  C:\Windows\System\PoaFAcF.exe
  2⤵
  PID:12672
- C:\Windows\System\XArHjcq.exe
  C:\Windows\System\XArHjcq.exe
  2⤵
  PID:12776
- C:\Windows\System\DAYoVYA.exe
  C:\Windows\System\DAYoVYA.exe
  2⤵
  PID:12980
- C:\Windows\System\oUgFnCn.exe
  C:\Windows\System\oUgFnCn.exe
  2⤵
  PID:13196
- C:\Windows\System\LrbDCIK.exe
  C:\Windows\System\LrbDCIK.exe
  2⤵
  PID:11280
- C:\Windows\System\CrWLlLu.exe
  C:\Windows\System\CrWLlLu.exe
  2⤵
  PID:12160
- C:\Windows\System\ypXWlbw.exe
  C:\Windows\System\ypXWlbw.exe
  2⤵
  PID:12828
- C:\Windows\System\yFFeEKz.exe
  C:\Windows\System\yFFeEKz.exe
  2⤵
  PID:13132
- C:\Windows\System\LjXJAcx.exe
  C:\Windows\System\LjXJAcx.exe
  2⤵
  PID:12396
- C:\Windows\System\gXzcXSP.exe
  C:\Windows\System\gXzcXSP.exe
  2⤵
  PID:13336
- C:\Windows\System\TKkbeqk.exe
  C:\Windows\System\TKkbeqk.exe
  2⤵
  PID:13352
- C:\Windows\System\QIIWszv.exe
  C:\Windows\System\QIIWszv.exe
  2⤵
  PID:13384
- C:\Windows\System\neEehHR.exe
  C:\Windows\System\neEehHR.exe
  2⤵
  PID:13420
- C:\Windows\System\ULIxbjG.exe
  C:\Windows\System\ULIxbjG.exe
  2⤵
  PID:13444
- C:\Windows\System\SIqAwEb.exe
  C:\Windows\System\SIqAwEb.exe
  2⤵
  PID:13476
- C:\Windows\System\QINHdYw.exe
  C:\Windows\System\QINHdYw.exe
  2⤵
  PID:13504
- C:\Windows\System\pJWrmlD.exe
  C:\Windows\System\pJWrmlD.exe
  2⤵
  PID:13544
- C:\Windows\System\EXXCnuR.exe
  C:\Windows\System\EXXCnuR.exe
  2⤵
  PID:13572
- C:\Windows\System\Zlhcscl.exe
  C:\Windows\System\Zlhcscl.exe
  2⤵
  PID:13588
- C:\Windows\System\wEIOLzm.exe
  C:\Windows\System\wEIOLzm.exe
  2⤵
  PID:13616
- C:\Windows\System\FdtpDTn.exe
  C:\Windows\System\FdtpDTn.exe
  2⤵
  PID:13636
- C:\Windows\System\KzxMmSA.exe
  C:\Windows\System\KzxMmSA.exe
  2⤵
  PID:13660
- C:\Windows\System\YQBHoxh.exe
  C:\Windows\System\YQBHoxh.exe
  2⤵
  PID:13676
- C:\Windows\System\OPNiFPZ.exe
  C:\Windows\System\OPNiFPZ.exe
  2⤵
  PID:13692
- C:\Windows\System\qgDVejS.exe
  C:\Windows\System\qgDVejS.exe
  2⤵
  PID:13720
- C:\Windows\System\vuYZpKy.exe
  C:\Windows\System\vuYZpKy.exe
  2⤵
  PID:13760
- C:\Windows\System\QVKywoc.exe
  C:\Windows\System\QVKywoc.exe
  2⤵
  PID:13792
- C:\Windows\System\HpoxqtV.exe
  C:\Windows\System\HpoxqtV.exe
  2⤵
  PID:13828
- C:\Windows\System\PaEWLfv.exe
  C:\Windows\System\PaEWLfv.exe
  2⤵
  PID:13856
- C:\Windows\System\VHvKzYQ.exe
  C:\Windows\System\VHvKzYQ.exe
  2⤵
  PID:13892
- C:\Windows\System\scZpWTR.exe
  C:\Windows\System\scZpWTR.exe
  2⤵
  PID:13924
- C:\Windows\System\cBbdCFS.exe
  C:\Windows\System\cBbdCFS.exe
  2⤵
  PID:13940
- C:\Windows\System\vVnnTKa.exe
  C:\Windows\System\vVnnTKa.exe
  2⤵
  PID:13968
- C:\Windows\System\YpBEEiL.exe
  C:\Windows\System\YpBEEiL.exe
  2⤵
  PID:13992
- C:\Windows\System\RtxtrQd.exe
  C:\Windows\System\RtxtrQd.exe
  2⤵
  PID:14016
- C:\Windows\System\StFMtDs.exe
  C:\Windows\System\StFMtDs.exe
  2⤵
  PID:14036
- C:\Windows\System\PMZPbOs.exe
  C:\Windows\System\PMZPbOs.exe
  2⤵
  PID:14064
- C:\Windows\System\JOoxMls.exe
  C:\Windows\System\JOoxMls.exe
  2⤵
  PID:14096
- C:\Windows\System\osmHlBS.exe
  C:\Windows\System\osmHlBS.exe
  2⤵
  PID:14124
- C:\Windows\System\hjoMxxc.exe
  C:\Windows\System\hjoMxxc.exe
  2⤵
  PID:14152
- C:\Windows\System\NJDJyPn.exe
  C:\Windows\System\NJDJyPn.exe
  2⤵
  PID:14176
- C:\Windows\System\KOwSaHl.exe
  C:\Windows\System\KOwSaHl.exe
  2⤵
  PID:14216
- C:\Windows\System\fNlCSdr.exe
  C:\Windows\System\fNlCSdr.exe
  2⤵
  PID:14248
- C:\Windows\System\EYHjbjS.exe
  C:\Windows\System\EYHjbjS.exe
  2⤵
  PID:14272
- C:\Windows\System\gxhDOts.exe
  C:\Windows\System\gxhDOts.exe
  2⤵
  PID:14296
- C:\Windows\System\iGbVCBE.exe
  C:\Windows\System\iGbVCBE.exe
  2⤵
  PID:14328
- C:\Windows\System\fCyWlLp.exe
  C:\Windows\System\fCyWlLp.exe
  2⤵
  PID:13348
- C:\Windows\System\bHUTvOc.exe
  C:\Windows\System\bHUTvOc.exe
  2⤵
  PID:13344
- C:\Windows\System\eZIVUgQ.exe
  C:\Windows\System\eZIVUgQ.exe
  2⤵
  PID:13456
- C:\Windows\System\ywylxDH.exe
  C:\Windows\System\ywylxDH.exe
  2⤵
  PID:13492
- C:\Windows\System\nqRmiYA.exe
  C:\Windows\System\nqRmiYA.exe
  2⤵
  PID:13580
- C:\Windows\System\PETOCvB.exe
  C:\Windows\System\PETOCvB.exe
  2⤵
  PID:13652
- C:\Windows\System\UcrXwDX.exe
  C:\Windows\System\UcrXwDX.exe
  2⤵
  PID:13788
- C:\Windows\System\rOiwQfN.exe
  C:\Windows\System\rOiwQfN.exe
  2⤵
  PID:13872
- C:\Windows\System\FShCHuS.exe
  C:\Windows\System\FShCHuS.exe
  2⤵
  PID:13964
- C:\Windows\System\bMwSEUY.exe
  C:\Windows\System\bMwSEUY.exe
  2⤵
  PID:13984
- C:\Windows\System\JZsSRcA.exe
  C:\Windows\System\JZsSRcA.exe
  2⤵
  PID:14052
- C:\Windows\System\JtzFlLs.exe
  C:\Windows\System\JtzFlLs.exe
  2⤵
  PID:14076
- C:\Windows\System\KxmLPfT.exe
  C:\Windows\System\KxmLPfT.exe
  2⤵
  PID:14188
- C:\Windows\System\lUFvgXM.exe
  C:\Windows\System\lUFvgXM.exe
  2⤵
  PID:14168
- C:\Windows\System\YDSYVLD.exe
  C:\Windows\System\YDSYVLD.exe
  2⤵
  PID:14316
- C:\Windows\System\SNjOhMb.exe
  C:\Windows\System\SNjOhMb.exe
  2⤵
  PID:13328
- C:\Windows\System\QdfNiAV.exe
  C:\Windows\System\QdfNiAV.exe
  2⤵
  PID:13412
- C:\Windows\System\jZppyOD.exe
  C:\Windows\System\jZppyOD.exe
  2⤵
  PID:13668
- C:\Windows\System\VeiIFve.exe
  C:\Windows\System\VeiIFve.exe
  2⤵
  PID:13868
- C:\Windows\System\yFcTlSP.exe
  C:\Windows\System\yFcTlSP.exe
  2⤵
  PID:14028
- C:\Windows\System\jDaaOpX.exe
  C:\Windows\System\jDaaOpX.exe
  2⤵
  PID:14164
- C:\Windows\System\VkUMVqG.exe
  C:\Windows\System\VkUMVqG.exe
  2⤵
  PID:13228
- C:\Windows\System\ENDmLnW.exe
  C:\Windows\System\ENDmLnW.exe
  2⤵
  PID:13800
- C:\Windows\System\GDEkqUn.exe
  C:\Windows\System\GDEkqUn.exe
  2⤵
  PID:13936
- C:\Windows\System\ZvEqsBe.exe
  C:\Windows\System\ZvEqsBe.exe
  2⤵
  PID:13632
- C:\Windows\System\mydyJzH.exe
  C:\Windows\System\mydyJzH.exe
  2⤵
  PID:13808
- C:\Windows\System\FBVWuWe.exe
  C:\Windows\System\FBVWuWe.exe
  2⤵
  PID:14360
- C:\Windows\System\ZxOOwbk.exe
  C:\Windows\System\ZxOOwbk.exe
  2⤵
  PID:14388
- C:\Windows\System\sGkmwED.exe
  C:\Windows\System\sGkmwED.exe
  2⤵
  PID:14420
- C:\Windows\System\oFREUms.exe
  C:\Windows\System\oFREUms.exe
  2⤵
  PID:14444
- C:\Windows\System\szVYfRT.exe
  C:\Windows\System\szVYfRT.exe
  2⤵
  PID:14460
- C:\Windows\System\WAjOvtM.exe
  C:\Windows\System\WAjOvtM.exe
  2⤵
  PID:14488
- C:\Windows\System\UaFZiGh.exe
  C:\Windows\System\UaFZiGh.exe
  2⤵
  PID:14512
- C:\Windows\System\eGPdMOM.exe
  C:\Windows\System\eGPdMOM.exe
  2⤵
  PID:14540
- C:\Windows\System\NJvKOsy.exe
  C:\Windows\System\NJvKOsy.exe
  2⤵
  PID:14564
- C:\Windows\System\XxdwvSv.exe
  C:\Windows\System\XxdwvSv.exe
  2⤵
  PID:14592
- C:\Windows\System\DSgyTeC.exe
  C:\Windows\System\DSgyTeC.exe
  2⤵
  PID:14624
- C:\Windows\System\CaZcajd.exe
  C:\Windows\System\CaZcajd.exe
  2⤵
  PID:14644
- C:\Windows\System\CuZZxLz.exe
  C:\Windows\System\CuZZxLz.exe
  2⤵
  PID:14672
- C:\Windows\System\dCaCycu.exe
  C:\Windows\System\dCaCycu.exe
  2⤵
  PID:14692
- C:\Windows\System\rXdWrcy.exe
  C:\Windows\System\rXdWrcy.exe
  2⤵
  PID:14724
- C:\Windows\System\rISXEOf.exe
  C:\Windows\System\rISXEOf.exe
  2⤵
  PID:14748
- C:\Windows\System\lLxxNoB.exe
  C:\Windows\System\lLxxNoB.exe
  2⤵
  PID:14780
- C:\Windows\System\KVRSxMZ.exe
  C:\Windows\System\KVRSxMZ.exe
  2⤵
  PID:14816
- C:\Windows\System\IhNKJQl.exe
  C:\Windows\System\IhNKJQl.exe
  2⤵
  PID:14860
- C:\Windows\System\LioeyOm.exe
  C:\Windows\System\LioeyOm.exe
  2⤵
  PID:14880
- C:\Windows\System\AJzlBpM.exe
  C:\Windows\System\AJzlBpM.exe
  2⤵
  PID:14908
- C:\Windows\System\vMUCDwy.exe
  C:\Windows\System\vMUCDwy.exe
  2⤵
  PID:14940
- C:\Windows\System\mtoXUWP.exe
  C:\Windows\System\mtoXUWP.exe
  2⤵
  PID:14956
- C:\Windows\System\aTJNGUm.exe
  C:\Windows\System\aTJNGUm.exe
  2⤵
  PID:14988
- C:\Windows\System\mGEZDlJ.exe
  C:\Windows\System\mGEZDlJ.exe
  2⤵
  PID:15012
- C:\Windows\System\LAeDEbI.exe
  C:\Windows\System\LAeDEbI.exe
  2⤵
  PID:15040
- C:\Windows\System\nybyqNp.exe
  C:\Windows\System\nybyqNp.exe
  2⤵
  PID:15076
- C:\Windows\System\nGwwTtW.exe
  C:\Windows\System\nGwwTtW.exe
  2⤵
  PID:15104
- C:\Windows\System\yxrOluC.exe
  C:\Windows\System\yxrOluC.exe
  2⤵
  PID:15128
- C:\Windows\System\NXlrSQP.exe
  C:\Windows\System\NXlrSQP.exe
  2⤵
  PID:15160
- C:\Windows\System\MnzcGGx.exe
  C:\Windows\System\MnzcGGx.exe
  2⤵
  PID:15192
- C:\Windows\System\FVkSggF.exe
  C:\Windows\System\FVkSggF.exe
  2⤵
  PID:15216
- C:\Windows\System\jLPPFpE.exe
  C:\Windows\System\jLPPFpE.exe
  2⤵
  PID:15248
- C:\Windows\System\dMFUnOU.exe
  C:\Windows\System\dMFUnOU.exe
  2⤵
  PID:15264
- C:\Windows\System\QqIegRm.exe
  C:\Windows\System\QqIegRm.exe
  2⤵
  PID:15284
- C:\Windows\System\hnAcvZc.exe
  C:\Windows\System\hnAcvZc.exe
  2⤵
  PID:15316
- C:\Windows\System\BXALiFW.exe
  C:\Windows\System\BXALiFW.exe
  2⤵
  PID:15336
- C:\Windows\System\CSFZIWb.exe
  C:\Windows\System\CSFZIWb.exe
  2⤵
  PID:13648
- C:\Windows\System\IjDATOt.exe
  C:\Windows\System\IjDATOt.exe
  2⤵
  PID:14400
- C:\Windows\System\DpLyLEq.exe
  C:\Windows\System\DpLyLEq.exe
  2⤵
  PID:14432
- C:\Windows\System\ETKfmbN.exe
  C:\Windows\System\ETKfmbN.exe
  2⤵
  PID:14472
- C:\Windows\System\XDfyDZp.exe
  C:\Windows\System\XDfyDZp.exe
  2⤵
  PID:14560
- C:\Windows\System\zdRHQJC.exe
  C:\Windows\System\zdRHQJC.exe
  2⤵
  PID:14708
- C:\Windows\System\NXmRqpw.exe
  C:\Windows\System\NXmRqpw.exe
  2⤵
  PID:14632
- C:\Windows\System\wlNbmUe.exe
  C:\Windows\System\wlNbmUe.exe
  2⤵
  PID:14772
- C:\Windows\System\qWhbBMb.exe
  C:\Windows\System\qWhbBMb.exe
  2⤵
  PID:14804
- C:\Windows\System\VPdEgPb.exe
  C:\Windows\System\VPdEgPb.exe
  2⤵
  PID:14836
- C:\Windows\System\tSkRRZS.exe
  C:\Windows\System\tSkRRZS.exe
  2⤵
  PID:14952
- C:\Windows\System\cspviuB.exe
  C:\Windows\System\cspviuB.exe
  2⤵
  PID:15048
- C:\Windows\System\LLWGENq.exe
  C:\Windows\System\LLWGENq.exe
  2⤵
  PID:15120
- C:\Windows\System\KpjQlAg.exe
  C:\Windows\System\KpjQlAg.exe
  2⤵
  PID:15140
- C:\Windows\System\TDRrMsu.exe
  C:\Windows\System\TDRrMsu.exe
  2⤵
  PID:15256
- C:\Windows\System\pHltULw.exe
  C:\Windows\System\pHltULw.exe
  2⤵
  PID:15232
- C:\Windows\System\SlhZosa.exe
  C:\Windows\System\SlhZosa.exe
  2⤵
  PID:15304
- C:\Windows\System\dpDzooC.exe
  C:\Windows\System\dpDzooC.exe
  2⤵
  PID:14376
- C:\Windows\System\YeUoqGK.exe
  C:\Windows\System\YeUoqGK.exe
  2⤵
  PID:14524
- C:\Windows\System\DRXMFcL.exe
  C:\Windows\System\DRXMFcL.exe
  2⤵
  PID:14508
- C:\Windows\System\WSQbHNw.exe
  C:\Windows\System\WSQbHNw.exe
  2⤵
  PID:14984
- C:\Windows\System\jmRxwdE.exe
  C:\Windows\System\jmRxwdE.exe
  2⤵
  PID:15068
- C:\Windows\System\imtxIlX.exe
  C:\Windows\System\imtxIlX.exe
  2⤵
  PID:15260
- C:\Windows\System\WxucgPP.exe
  C:\Windows\System\WxucgPP.exe
  2⤵
  PID:14352
- C:\Windows\System\OokCdMZ.exe
  C:\Windows\System\OokCdMZ.exe
  2⤵
  PID:13912
- C:\Windows\System\irMKzth.exe
  C:\Windows\System\irMKzth.exe
  2⤵
  PID:14980
- C:\Windows\System\veUJCtY.exe
  C:\Windows\System\veUJCtY.exe
  2⤵
  PID:14552
- C:\Windows\System\rfXdCaL.exe
  C:\Windows\System\rfXdCaL.exe
  2⤵
  PID:15376
- C:\Windows\System\TCIAQKu.exe
  C:\Windows\System\TCIAQKu.exe
  2⤵
  PID:15416
- C:\Windows\System\JUlLTOJ.exe
  C:\Windows\System\JUlLTOJ.exe
  2⤵
  PID:15440
- C:\Windows\System\MDTcCAA.exe
  C:\Windows\System\MDTcCAA.exe
  2⤵
  PID:15460
- C:\Windows\System\nKUbRzq.exe
  C:\Windows\System\nKUbRzq.exe
  2⤵
  PID:15496
- C:\Windows\System\YzCpUVh.exe
  C:\Windows\System\YzCpUVh.exe
  2⤵
  PID:15524
- C:\Windows\System\frTifFl.exe
  C:\Windows\System\frTifFl.exe
  2⤵
  PID:15552
- C:\Windows\System\WgwMbdN.exe
  C:\Windows\System\WgwMbdN.exe
  2⤵
  PID:15580
- C:\Windows\System\gqpoInc.exe
  C:\Windows\System\gqpoInc.exe
  2⤵
  PID:15608
- C:\Windows\System\dpKajcS.exe
  C:\Windows\System\dpKajcS.exe
  2⤵
  PID:15636
- C:\Windows\System\hkcWIqh.exe
  C:\Windows\System\hkcWIqh.exe
  2⤵
  PID:15664
- C:\Windows\System\MduBaWn.exe
  C:\Windows\System\MduBaWn.exe
  2⤵
  PID:15704
- C:\Windows\System\hpbRjhg.exe
  C:\Windows\System\hpbRjhg.exe
  2⤵
  PID:15728
- C:\Windows\System\fqbKdCg.exe
  C:\Windows\System\fqbKdCg.exe
  2⤵
  PID:15768
- C:\Windows\System\nJcilYg.exe
  C:\Windows\System\nJcilYg.exe
  2⤵
  PID:15796
- C:\Windows\System\Kbygvud.exe
  C:\Windows\System\Kbygvud.exe
  2⤵
  PID:15820
- C:\Windows\System\zekszEy.exe
  C:\Windows\System\zekszEy.exe
  2⤵
  PID:15840
- C:\Windows\System\DnhrIGJ.exe
  C:\Windows\System\DnhrIGJ.exe
  2⤵
  PID:15872
- C:\Windows\System\AlQccLG.exe
  C:\Windows\System\AlQccLG.exe
  2⤵
  PID:15904
- C:\Windows\System\GYopxcF.exe
  C:\Windows\System\GYopxcF.exe
  2⤵
  PID:15924
- C:\Windows\System\CKEADLG.exe
  C:\Windows\System\CKEADLG.exe
  2⤵
  PID:15948
- C:\Windows\System\VvGjZDC.exe
  C:\Windows\System\VvGjZDC.exe
  2⤵
  PID:15996
- C:\Windows\System\apaeqPr.exe
  C:\Windows\System\apaeqPr.exe
  2⤵
  PID:16020
- C:\Windows\System\WDxkmcQ.exe
  C:\Windows\System\WDxkmcQ.exe
  2⤵
  PID:16040
- C:\Windows\System\mHxtRSr.exe
  C:\Windows\System\mHxtRSr.exe
  2⤵
  PID:16072
- C:\Windows\System\sPOdbgJ.exe
  C:\Windows\System\sPOdbgJ.exe
  2⤵
  PID:16108
- C:\Windows\System\MkeRosE.exe
  C:\Windows\System\MkeRosE.exe
  2⤵
  PID:16136
- C:\Windows\System\DMIvrFO.exe
  C:\Windows\System\DMIvrFO.exe
  2⤵
  PID:16164
- C:\Windows\System\bSHdGvU.exe
  C:\Windows\System\bSHdGvU.exe
  2⤵
  PID:16200
- C:\Windows\System\ZwzuOpJ.exe
  C:\Windows\System\ZwzuOpJ.exe
  2⤵
  PID:16232
- C:\Windows\System\aVWeiQA.exe
  C:\Windows\System\aVWeiQA.exe
  2⤵
  PID:16260
- C:\Windows\System\YrGDbpW.exe
  C:\Windows\System\YrGDbpW.exe
  2⤵
  PID:16296
- C:\Windows\System\khJohHg.exe
  C:\Windows\System\khJohHg.exe
  2⤵
  PID:16324
- C:\Windows\System\zRQisBY.exe
  C:\Windows\System\zRQisBY.exe
  2⤵
  PID:16352
- C:\Windows\System\UgbcIfj.exe
  C:\Windows\System\UgbcIfj.exe
  2⤵
  PID:16380
- C:\Windows\System\vXqbvjd.exe
  C:\Windows\System\vXqbvjd.exe
  2⤵
  PID:15388
- C:\Windows\System\lgfYxWh.exe
  C:\Windows\System\lgfYxWh.exe
  2⤵
  PID:15368
- C:\Windows\System\yvdDkCZ.exe
  C:\Windows\System\yvdDkCZ.exe
  2⤵
  PID:15448
- C:\Windows\System\iUWdcWD.exe
  C:\Windows\System\iUWdcWD.exe
  2⤵
  PID:15548
- C:\Windows\System\SPdkqAK.exe
  C:\Windows\System\SPdkqAK.exe
  2⤵
  PID:15592
- C:\Windows\System\BnAoTGk.exe
  C:\Windows\System\BnAoTGk.exe
  2⤵
  PID:15696
- C:\Windows\System\dBjWVVc.exe
  C:\Windows\System\dBjWVVc.exe
  2⤵
  PID:15724
- C:\Windows\System\iadDYZW.exe
  C:\Windows\System\iadDYZW.exe
  2⤵
  PID:15812
- C:\Windows\System\vHtHnFN.exe
  C:\Windows\System\vHtHnFN.exe
  2⤵
  PID:15892
- C:\Windows\System\hgUvkmF.exe
  C:\Windows\System\hgUvkmF.exe
  2⤵
  PID:15956
- C:\Windows\System\RTxsALQ.exe
  C:\Windows\System\RTxsALQ.exe
  2⤵
  PID:15980
- C:\Windows\System\mvGdQqe.exe
  C:\Windows\System\mvGdQqe.exe
  2⤵
  PID:16052
- C:\Windows\System\ZXLkiIV.exe
  C:\Windows\System\ZXLkiIV.exe
  2⤵
  PID:16148
- C:\Windows\System\vUCjMUS.exe
  C:\Windows\System\vUCjMUS.exe
  2⤵
  PID:16180
- C:\Windows\System\SVvbArU.exe
  C:\Windows\System\SVvbArU.exe
  2⤵
  PID:16248
- C:\Windows\System\aiArYFg.exe
  C:\Windows\System\aiArYFg.exe
  2⤵
  PID:16316
- C:\Windows\System\cwKEFxr.exe
  C:\Windows\System\cwKEFxr.exe
  2⤵
  PID:16364
- C:\Windows\System\UCWVEAS.exe
  C:\Windows\System\UCWVEAS.exe
  2⤵
  PID:15468
- C:\Windows\System\pvIxsnH.exe
  C:\Windows\System\pvIxsnH.exe
  2⤵
  PID:15568
- C:\Windows\System\ExiGads.exe
  C:\Windows\System\ExiGads.exe
  2⤵
  PID:15804
- C:\Windows\System\baagafN.exe
  C:\Windows\System\baagafN.exe
  2⤵
  PID:15944
- C:\Windows\System\wJNjaxm.exe
  C:\Windows\System\wJNjaxm.exe
  2⤵
  PID:16124
- C:\Windows\System\vaHoIRW.exe
  C:\Windows\System\vaHoIRW.exe
  2⤵
  PID:16292
- C:\Windows\System\zHcjYsU.exe
  C:\Windows\System\zHcjYsU.exe
  2⤵
  PID:16344
- C:\Windows\System\rFHcpnX.exe
  C:\Windows\System\rFHcpnX.exe
  2⤵
  PID:15656
- C:\Windows\System\yREfBBM.exe
  C:\Windows\System\yREfBBM.exe
  2⤵
  PID:16224
- C:\Windows\System\ljQXufK.exe
  C:\Windows\System\ljQXufK.exe
  2⤵
  PID:16280
- C:\Windows\System\RTaJZeI.exe
  C:\Windows\System\RTaJZeI.exe
  2⤵
  PID:15988
- C:\Windows\System\XcOIrEy.exe
  C:\Windows\System\XcOIrEy.exe
  2⤵
  PID:16392
- C:\Windows\System\gOzvTNi.exe
  C:\Windows\System\gOzvTNi.exe
  2⤵
  PID:16424
- C:\Windows\System\LflqNyQ.exe
  C:\Windows\System\LflqNyQ.exe
  2⤵
  PID:16452
- C:\Windows\System\drXRwmu.exe
  C:\Windows\System\drXRwmu.exe
  2⤵
  PID:16480
- C:\Windows\System\nKRuiur.exe
  C:\Windows\System\nKRuiur.exe
  2⤵
  PID:16496
- C:\Windows\System\ntFaKyF.exe
  C:\Windows\System\ntFaKyF.exe
  2⤵
  PID:16524
- C:\Windows\System\aGODLxI.exe
  C:\Windows\System\aGODLxI.exe
  2⤵
  PID:16540
- C:\Windows\System\dbMAEeU.exe
  C:\Windows\System\dbMAEeU.exe
  2⤵
  PID:16572
- C:\Windows\System\bdfTOVT.exe
  C:\Windows\System\bdfTOVT.exe
  2⤵
  PID:16596
- C:\Windows\System\XdgLPMp.exe
  C:\Windows\System\XdgLPMp.exe
  2⤵
  PID:16620
- C:\Windows\System\jNmdWal.exe
  C:\Windows\System\jNmdWal.exe
  2⤵
  PID:16648
- C:\Windows\System\WrAdTCa.exe
  C:\Windows\System\WrAdTCa.exe
  2⤵
  PID:16680
- C:\Windows\System\SlcYwgf.exe
  C:\Windows\System\SlcYwgf.exe
  2⤵
  PID:16700
- C:\Windows\System\NYURUgx.exe
  C:\Windows\System\NYURUgx.exe
  2⤵
  PID:16724
- C:\Windows\System\qcFMkzQ.exe
  C:\Windows\System\qcFMkzQ.exe
  2⤵
  PID:16760
- C:\Windows\System\NjlqURT.exe
  C:\Windows\System\NjlqURT.exe
  2⤵
  PID:16780
- C:\Windows\System\bSsqSTA.exe
  C:\Windows\System\bSsqSTA.exe
  2⤵
  PID:16800
- C:\Windows\System\ufIlRDh.exe
  C:\Windows\System\ufIlRDh.exe
  2⤵
  PID:16824
- C:\Windows\System\lFcsvJN.exe
  C:\Windows\System\lFcsvJN.exe
  2⤵
  PID:16852
- C:\Windows\System\TTvhVlN.exe
  C:\Windows\System\TTvhVlN.exe
  2⤵
  PID:16880
- C:\Windows\System\JXSZhQr.exe
  C:\Windows\System\JXSZhQr.exe
  2⤵
  PID:16896
- C:\Windows\System\BKVeczJ.exe
  C:\Windows\System\BKVeczJ.exe
  2⤵
  PID:16936
- - C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -u -p 16936 -s 248
    3⤵
    PID:17236
- C:\Windows\System\bDRfsOJ.exe
  C:\Windows\System\bDRfsOJ.exe
  2⤵
  PID:16972
- C:\Windows\System\XMHMYdO.exe
  C:\Windows\System\XMHMYdO.exe
  2⤵
  PID:17000
- C:\Windows\System\DXgECCO.exe
  C:\Windows\System\DXgECCO.exe
  2⤵
  PID:17024
- C:\Windows\System\oLvIeRP.exe
  C:\Windows\System\oLvIeRP.exe
  2⤵
  PID:17168

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:16416

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\AJeEuTl.exe

Filesize
1.8MB

MD5
2abd6ad49e070161d6f75e66c93955e8

SHA1
7f43be48dbe358cadf58a633223e0c6f6b27e2fc

SHA256
db446946d738d2b43ebb6b2f1a77a4b9ea1d7d586f0d4bdffb59f5723d1594e0

SHA512
e4a46dce0b5bd88674e08a34fcd987b37b69b85e93202cf7ae847456c4b100a7f357c2b1b5eca45e92b590c938b051d88bdc017b79f60be8bd8a2c69749500c6

Download Submit
C:\Windows\System\BXsLydd.exe

Filesize
1.8MB

MD5
60c8440dcadafa03e8503cea8c0b27bd

SHA1
57bcea0d0bb5c94c7f321e7df1ec1287f01fa8f9

SHA256
52664e20b3bc552523441c5abc8bffdc2fe3c9628a44aecd043100c26702eb7c

SHA512
88ae6859ec7641fde9aeabf87ee588ab6a95629240c77aa5a54153cf924381b768a4537ab6a8b3e3abbb9947e1d2b9df9beee35fb495ab263bf8aa2769f78f40

Download Submit
C:\Windows\System\CZRDZol.exe

Filesize
1.8MB

MD5
afaf20bd7f91ed162c7bdec3873af7a2

SHA1
c81a9fd61d4332cc6300c4372d292a95ad32ef8d

SHA256
63560e5e780ce273b6e8938151d215bdf36e3345c21fc3225c7345fcfe7a41ea

SHA512
fa54dc079f214a6fa7331046b09ebe66ab06600c3e4bd458454be6b325454e99c4c9a72fc6747418ee51d9e033663d27e2aa7f639035b7f207bfd203b23ae1fa

Download Submit
C:\Windows\System\CtiERjt.exe

Filesize
1.8MB

MD5
c31fd84bd31ea6b88b6201020c9a5ae7

SHA1
b6cf35997dfc12de3a6ee189cc3e6e6afbafde83

SHA256
965fa980a7c493d70bb31eb855d9d1e0fcfc27bf0a3e6840ad4bef962e230e26

SHA512
51f99a1d9b03d28db7322e5401c44f9eba46a27c322f59b6180f871a24fbbcad1abcfa64409d9c10503f71f00272328c8cbad56ac94c51f1028eb4f019da03d8

Download Submit
C:\Windows\System\EGgqROZ.exe

Filesize
1.8MB

MD5
88a655eb74dbda45337006a1a1f1398b

SHA1
19a248622df5c8cb20fc82acdeece9975573ebe3

SHA256
73aca2833fe75c77bb4a5cbdb69c15f1cf76227206ab3f8d04127bc7bb9ac280

SHA512
bda59a0b676fd3f14cac83301c0000b33d845e59f5fa70fb723fadab71f0c78c38b003233ed093a9305087583eb1cffa8832dd452ecfd8b1f1f98a5245e69ad7

Download Submit
C:\Windows\System\EjYVjRy.exe

Filesize
1.8MB

MD5
3a4fb6dac68e9393816c25868c525af6

SHA1
bfa2d46808678b4e4534f5a3a3040c48f30cf107

SHA256
e9844f3e7ccdd04154ca0c44383b4eca1065185af41f20ba0eb03f729c8c5149

SHA512
a38900351a7e4307f1a68ada7ff450010d29b436e2d6a6477ece86a913d47b249ee452e61a5a1201d9d41f62364e5cc082d25537c80e2f56fd61982aa7903473

Download Submit
C:\Windows\System\FmNcGmQ.exe

Filesize
1.8MB

MD5
2a424a0c2748ae5d433affd8650994b4

SHA1
d1ab7a24d6afc2aa6dc39cd07dff802b1b85dde0

SHA256
00c72adc0f0695f820e143389add5fef504d5e0fd53083d445309a30ff501d8e

SHA512
99e8d431423237521b2022ae8dd2b32f8b657be8f2759d93385debbfd2635cb915d10f0fd76e84f540ada0d2b3abf4f7033cda26e6c00cd417c5f93f79f57b88

Download Submit
C:\Windows\System\GMQcDnV.exe

Filesize
1.8MB

MD5
a1d7571fe65ab37b689dc0c2e842dd62

SHA1
f2b6d6cc952a0f200a18c7da2433e05efee83326

SHA256
c0dd5f55fbb90aaaad8af29e71422abc28eae8f01b3d06aa79e3fc272aaa576d

SHA512
6e5fab7a52542346a604d57f5429322aba6d2178a306b92e4ef42f65fe0517d1682a5d75e1c4109f8381f85072f1f0c9d9fca0710a366e4672e848ab49a3c9f2

Download Submit
C:\Windows\System\GdXmJeW.exe

Filesize
1.8MB

MD5
f86a5558124b32ce6b9cfc100dd43a1d

SHA1
36b844fb60775693be38f4eaef90b9b2b494e328

SHA256
1fa4c69c32b1a6241f2d997c5d2d311a7b27372d5256d26027ec8d820352cd5b

SHA512
c22c38493c83fb7077e0042f4d62420d29c987ca84bf1d73cf821a125e7d47857d4e3326385879717b33445a936f28b8013a2992314830257a7121ac2790a408

Download Submit
C:\Windows\System\GmfMdsb.exe

Filesize
1.8MB

MD5
9cc99348162aa880dcd60b30d5cd24b5

SHA1
76eb6fceb944b7c00e95da2bb40764e6751c2f0a

SHA256
6b242b36ed7c30cd2afb241a56325ee55a7c842d839395861b782a973e5cb73f

SHA512
19d0ebdf1502f9fc62ed34a810310946be8f17aecc3a1a71a20493da2cef5f2fcf6bb695a75c1f2f97e876cdaa6f64248e0b87f331212c755b7e1b5cb0918a73

Download Submit
C:\Windows\System\HCmNqRW.exe

Filesize
1.8MB

MD5
438b9aa6246cd59cdf87405e437678d9

SHA1
c8aa378ced50c01d70eba4c14e6f084f9aae73f4

SHA256
658e19517e5cd1c1e7d5b17cd1e3388e9d1b73eaea7ac23a83b5e8470c41f3df

SHA512
f8fb66af49f4d79f9c8f081365dea709d0419da36118241e482a98cd9ad49e232850300fe29be3b6249b6ecfc8bf1459190e912790bfcddee1d4d1f81afbd9a2

Download Submit
C:\Windows\System\HdMmydY.exe

Filesize
1.8MB

MD5
2965828910a7ef472600eac6426b4488

SHA1
048d639f981a4bd2abc62d21bc643d61ce852d48

SHA256
567e208ab50619819ef988fbe9e64669cbdd0d1049020f97f49f864e73f71ebb

SHA512
e028b5d4f17323434a8e6e389f6f13b5ec9c48f970c7bf12715dc5eba419305005cf4caead4fb21e127f9148ccd688d6256498ca6ef28287635e7cdd5f2b77b6

Download Submit
C:\Windows\System\ObiWnyp.exe

Filesize
1.8MB

MD5
985859ca045494783e46f9a741bee95c

SHA1
fce1cce1ae6dd66ce36ef749407200c63fda2e59

SHA256
108f34a4b62a87a8156410534e0d1ec5d5aa2e78a3ac090e7b4c3c168a0b53ba

SHA512
f2651877a8ca26e0897fc44655cc11b212958d3db453a4966e22b375f72477768229c8b445fc797e62e4d4fc1947358045f194223e07b922ca8bf1116427f4d8

Download Submit
C:\Windows\System\OgzFdfF.exe

Filesize
1.8MB

MD5
4e7d79a8deddae2040409e52a40a15e5

SHA1
8a8397da0cbe854a1bb2af61e589eab3f2ac61b8

SHA256
d4b0ee2a3a1a5a4a5e96c5cd9c13b023ca35342801f3fe347036a2ec663b7c96

SHA512
b06b24062dfa8531ff3181697758fef0fc05a298eb032bbcd7f2f3a6946d1a3abee3a89c859507dd7bf2ec4e02d9d2419db735e26bb2942b7c77bd82feb1fd49

Download Submit
C:\Windows\System\SnmCBEW.exe

Filesize
1.8MB

MD5
a1f99d0fa8d1ed8f355deb46841d00f3

SHA1
8c9858c88a3190cb53b4b525bbcd87def750da65

SHA256
90702d3db097ab0b6bea41c440ba39dbff176100df71624e082c5afc64b14df7

SHA512
3786f89c97d04b0ce2fa454aaba7a66132700f4d2ce3b8c5b4e3414bf04b11973116c0a103074f62ec89c9a13dbcbb67812522a530b177cad39d5a6522bf729d

Download Submit
C:\Windows\System\TJALGGV.exe

Filesize
1.8MB

MD5
912645308d7f48441f248e0f2a9e5596

SHA1
04155bd72f87a020d1571e6b7da5f40ca7a10231

SHA256
6418d166dd33a3fff1197d9a35c545ee9d0518cb6a9338315871b0659aa16297

SHA512
2bb66e66fe7bcbc94a7909721c0c3d86b463d581f1de4b7717fdb5d9466378d426a023d409042c550300a728ae264778a5e8a203718649e810ea114e8d753ee3

Download Submit
C:\Windows\System\VyxuPmZ.exe

Filesize
1.8MB

MD5
a6c0a260009c354897d37901828ae2fa

SHA1
e207182bbaf5e136a47e3efabb5855ce06fbda4a

SHA256
90e5b21ce554fa2c3282c71145a55ef1a8e620992a2f16e02e39a83155895e85

SHA512
caf3a524ba223e25fff0b970f6fef50c3bf35bf54bd65829a5d0072888b864ecaf9a5ed5a02206bc8a9d83d86c8ffafcf5d00785eec9ed4b4f65a1c4b1637716

Download Submit
C:\Windows\System\awCfyky.exe

Filesize
1.8MB

MD5
f913b2c7b47cd5710797ab1d5ad2a20e

SHA1
0101215b83cbf1b9d89d244ec430919c5b00f6f5

SHA256
9632bcc37ef91c9f0525d1170c5d25c7df6f62caa22c4d97687bb64f9be78b72

SHA512
935988b494cd3f386d757677b350dcd334c96cb17cacd41c32b81589d45cfcd2c12caa297172214453533703fe61c08b832c7a304a07e19e14c62aeb8942d10b

Download Submit
C:\Windows\System\dLbeqKC.exe

Filesize
1.8MB

MD5
189f26e51e1e33479b4a6b4a1c697ca1

SHA1
4ab1cee4ef052fd6a04c48ffea8b0695e1f26d91

SHA256
099a7842c6e3aadb107f2527a2e7174ffb4022fcd88ef72d5583718d322b6ede

SHA512
f30d1bd26ac51cc1064a9862c381238641739b29770a99bfcea070efb9cc407859c5986e7f40d8ada1670f5e53feaf4f5ed4cfad62125ca936531165e7ee45b4

Download Submit
C:\Windows\System\fVhOGzK.exe

Filesize
1.8MB

MD5
b9918f3189e44ac18116b18f298aefe2

SHA1
b802030d8c82385c2cebeea3347fa16d20162a39

SHA256
aa3ca68308f1122f78bf657683c948ede5bd9c4461c22365d4d01e204c6fce70

SHA512
65f395455cc2d0a03d94edca8f4e87cab31debb472232d2429a291b1c47d0efd03939bfbd6525f1ffae2992a24b8e7430aaeeccae431c1239efe901b2cf75463

Download Submit
C:\Windows\System\fWOrUke.exe

Filesize
1.8MB

MD5
fdd9a826d615f4a10d21c4b1f19b1b22

SHA1
f94a49f5ada231ed0e3177da5c1cb82aff8e4bb6

SHA256
6c8f05ff96cf155974e18eab3b486e8d742bc19b4b94cab3575ff6457189a790

SHA512
39140a17f3520dec4dd2f170c63801b31b7601b5923c68d2bd45d14c968a6ce916da222cf3fa7a74b5d16f9d6e443483e50737c735e887bfd8f2437282e89940

Download Submit
C:\Windows\System\iWYRDoa.exe

Filesize
1.8MB

MD5
b5df5ae01933d5975662fabf90e3667b

SHA1
04a604c6f6349c92433500902eea87d2af16037d

SHA256
458264c642a24085524326f4ea796b3b95ac7b80bc4a07c25ce626ac3d1af95d

SHA512
8377186187dca45212d02a5de468290dd5c488d5ad34ffb5971dea91b1dcb626cfaac1a54d51ccabba41f8a2e0c393776636fa62cecaa7c73d96e03060755093

Download Submit
C:\Windows\System\kXhndBu.exe

Filesize
1.8MB

MD5
96fa088376aad59b2a75dccd51caf6c7

SHA1
46e5f69831e56cf4a116901eb2b4890a24be456e

SHA256
c1b8cf96f628794f5a6e53b1517095a83e1e1fc1e35700b3e70e218342745162

SHA512
1f4c14c823946baae282afe1cb72c7fe224b6b267aa914c1eee9df715c17b9a30f99fb6846a1e47bc047fc9a73456ce3dc4ddb0ec8787aed27d1bc6faa5b4a35

Download Submit
C:\Windows\System\lypAWjI.exe

Filesize
1.8MB

MD5
b69ef1a812112e868421c54d4f56c727

SHA1
030fff9110bc6095e25882486481c39eedb25045

SHA256
5cd6ca1eab77e1c1db7733d02fa10393217a76207965c2ff27d48658ec8f2ffe

SHA512
b834ac22fce4623ab66bbe10f2d536d797daa812d86c9ef5a34ab912f1c3ef00206d1eaa60d17f6f07d7444e72839f1f0e1632f0612bb3b5210788209def6794

Download Submit
C:\Windows\System\nRiOTnX.exe

Filesize
1.8MB

MD5
8b6814addb5c839ef45392e0c4dad843

SHA1
f81b6ac7299fc8f79fc6092f1a52ce0f6f82c7b5

SHA256
83cb8f2f65cf05d88223bd7c30874fbdb56a09524d61b1728ff7ede10c1821f6

SHA512
bee38e7f9bdb14c5b52dc50d5af3d02677d803e9f746fd15706f3b2dccc7e8f6e61f8d21a08ce39fbe0d713bcb6de4b2f5d6972e806f5a40fb220097f5d072cf

Download Submit
C:\Windows\System\oesKEcc.exe

Filesize
1.8MB

MD5
148ce429f5385c05c19d0f996c2f43d7

SHA1
e68b51ff480519a16cfad6cb45b87a3f9d30e516

SHA256
a2b06ec2845193ad61ecb62cd22c586c54741dc004e71081742c6a896a3b9519

SHA512
be7c8d12756564567e1363e17ed816e1766c004c438a17e49defd6b593c9ddd1ff1e3b77738f84993702147867ef4b8e4c8cd287668ba4b20c5030bba969a77f

Download Submit
C:\Windows\System\pzaJYAa.exe

Filesize
1.8MB

MD5
3d675e645ebc72cbb9c3c556dca2e908

SHA1
7d7565e9f47a3dae232ec87b6cb8d160ce1f1f65

SHA256
f973b58cf045eba50fdb71e94d692b54c7565fd81a094f390235fbbe55333bfa

SHA512
08e1ea3b9fa8af2cbb135d608a46294d39c15d4d0bbb0c228d9b21ae3cf8813686fd2fc0e4cd653757d6986a57d787ecc574da609ec1cda5a7f66061ce69639a

Download Submit
C:\Windows\System\rALBDlA.exe

Filesize
1.8MB

MD5
677e377964910e603c288eb251509bd3

SHA1
6550873172465acfbe72bf6afdf9ac8edfed1c27

SHA256
5fa8390d5eb46e501be681a28be029efbfbdb7384f49af7f87d87b90b31c77c4

SHA512
b3cabd8b998ef55348946e3103169607640b618f1cbf4b07e5d7a91034728d8d6d574166f0dc4df01ba597b0192ab866dfb1d65701d5892a421a8d4f4f627a34

Download Submit
C:\Windows\System\rFIgSaC.exe

Filesize
1.8MB

MD5
49860a74bc88c4ac330f5cfeebbcd9f7

SHA1
cf265a5236a091fdb747f242783c650bb11394c1

SHA256
3671038759ec9172132e7e83456829673790f85843e018722c74aeec12736aa0

SHA512
2f021f2967666848992666d410e59a2930608c4ec7b666ea1e8e11ed94f0198a25688497d9b06359c1338f81503dc28d16ef6a8a30ffb57a2b765e33b01ddf2c

Download Submit
C:\Windows\System\tdMwItn.exe

Filesize
1.8MB

MD5
6abcd9b6dccaecada8f2f00d71112542

SHA1
63dcce07a52302c71fd8d9d391530e36d15e0a77

SHA256
164cd9e6b869ae8f9959c3fdbd002e57e45fc1f41623cdf76536f65c1491cb5e

SHA512
79044ad458c3ebeaadac14e6a4d274bca09130446f734a8aa69e348011bbdf0d82ecd732e628d14b4ff53b016f713c2d6caccc45ae557b96f530d148415f5e5c

Download Submit
C:\Windows\System\xEvvUBJ.exe

Filesize
1.8MB

MD5
62838dedc54eb3dc9ffb998fd18bb81f

SHA1
63c1f19f32d72abfbeaa4b3b1e14cafa2f13a810

SHA256
6d1240de7d65a34f3f5ccb5ecc81cf7dec2304fa1c4e3a796bd99c52e722dd68

SHA512
bfc929b8ad4f7b59ed7a3b2c504acb728c7f1ea6cfac724e70a8995f6ee6a6b42aeb92bc4c9186475461022da31e5c2be5d6f1f62ed9939e8744f5da4cd9a3ce

Download Submit
C:\Windows\System\xRdIEvW.exe

Filesize
1.8MB

MD5
04e503f27b8ceef6c88da200bde87d93

SHA1
62d4f10351cbd816ca1bb4bda99e754c6ef58ee5

SHA256
d320020ed9d6c6c59e9886d37a34a21d0617fcf365c857cdf1b7e1be3d669852

SHA512
1b3a66b97132245e9e83785f1907ff2a75a4ba893caa36f1668fcf296c60d3a43ad7fc95d3f3506c8e36f97dc64c06cc5a0938347fc65228ff39ab035e523583

Download Submit
C:\Windows\System\zjbAyWv.exe

Filesize
1.8MB

MD5
2aac7d4e852237936cc0094cc794d069

SHA1
9f0300fee275830d2b4895755f7cbe68e94ab625

SHA256
3bf03cc5ae4f997efee539cf0c451254e2398df5cc8ab58ed4639b82a7986885

SHA512
d1500f4402660b231a98f8b52b8ba4fb71fbb52fad12655490ad05c96f7c174c7372da5fd9b18624b385d925509e9b1e7ba82b0a04d0ffd791f86e6b71aa2e90

Download Submit
memory/3232-0-0x000001D0EB6F0000-0x000001D0EB700000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads