xmrig | bb495d1f47b1d03f0d03a3155326275c8b8d73a99952d6824adcc250e785fa07

Analysis

max time kernel
133s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
23-12-2024 02:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bb495d1f47b1d03f0d03a3155326275c8b8d73a99952d6824adcc250e785fa07.exe
Size

1.7MB
MD5

064f7cf6c782c354f3c4203e70ea48f3
SHA1

e1990470789fc9f3ccfabfb18f12f615ee593bfd
SHA256

bb495d1f47b1d03f0d03a3155326275c8b8d73a99952d6824adcc250e785fa07
SHA512

4a3303229996f1e8feacd6afd1664ea534445095f39a7f23620453f17bd3231cad953735db54fd80ec49d5c64ea85e30d0465f124b06a8ebed08c9023c063d47
SSDEEP

49152:GezaTF8FcNkNdfE0pZ9ozttwIRRvzc26JAisW:GemTLkNdfE0pZyM

Score

10^/10

xmrig miner persistence privilege_escalation

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 33 IoCs

miner

resource	yara_rule
behavioral2/files/0x000c000000023af7-4.dat	xmrig
behavioral2/files/0x000b000000023b56-9.dat	xmrig
behavioral2/files/0x0031000000023b5b-12.dat	xmrig
behavioral2/files/0x0031000000023b5d-21.dat	xmrig
behavioral2/files/0x000a000000023b5e-27.dat	xmrig
behavioral2/files/0x000a000000023b61-42.dat	xmrig
behavioral2/files/0x000a000000023b63-60.dat	xmrig
behavioral2/files/0x000a000000023b66-75.dat	xmrig
behavioral2/files/0x000a000000023b6a-95.dat	xmrig
behavioral2/files/0x000a000000023b6f-120.dat	xmrig
behavioral2/files/0x000a000000023b72-135.dat	xmrig
behavioral2/files/0x000a000000023b79-162.dat	xmrig
behavioral2/files/0x000a000000023b77-160.dat	xmrig
behavioral2/files/0x000a000000023b78-157.dat	xmrig
behavioral2/files/0x000a000000023b76-155.dat	xmrig
behavioral2/files/0x000a000000023b75-150.dat	xmrig
behavioral2/files/0x000a000000023b74-145.dat	xmrig
behavioral2/files/0x000a000000023b73-140.dat	xmrig
behavioral2/files/0x000a000000023b71-130.dat	xmrig
behavioral2/files/0x000a000000023b70-125.dat	xmrig
behavioral2/files/0x000a000000023b6e-115.dat	xmrig
behavioral2/files/0x000a000000023b6d-110.dat	xmrig
behavioral2/files/0x000a000000023b6c-105.dat	xmrig
behavioral2/files/0x000a000000023b6b-100.dat	xmrig
behavioral2/files/0x000a000000023b69-90.dat	xmrig
behavioral2/files/0x000a000000023b68-85.dat	xmrig
behavioral2/files/0x000a000000023b67-80.dat	xmrig
behavioral2/files/0x000a000000023b65-70.dat	xmrig
behavioral2/files/0x000a000000023b64-65.dat	xmrig
behavioral2/files/0x000a000000023b62-55.dat	xmrig
behavioral2/files/0x000a000000023b60-45.dat	xmrig
behavioral2/files/0x000a000000023b5f-40.dat	xmrig
behavioral2/files/0x0031000000023b5c-25.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
1520	zUaRTyh.exe
4168	SBmabzm.exe
4020	fXVYGsY.exe
1020	YJhoHFH.exe
1120	eqjdIER.exe
3552	sAgugjr.exe
4152	yGmpugo.exe
3704	oFnoPAp.exe
1584	rvZiGcq.exe
2292	lYEmGyO.exe
4280	UGkcIkW.exe
820	DOrHjaK.exe
1432	WJldBSP.exe
4284	mdvJkkU.exe
1960	RKJUUov.exe
1852	UYwahAk.exe
716	UaHIIVT.exe
2232	ivJigsR.exe
5012	BGIfTlo.exe
3728	YITssvz.exe
3204	RfDyOUI.exe
996	fWLyLmF.exe
4820	oQFUhzu.exe
4664	QYEQemr.exe
764	VfqZZcO.exe
3088	iDRfEbS.exe
4616	DBrodNH.exe
2648	WHUBJdm.exe
3460	YkhiEcH.exe
5088	vNFpMBH.exe
1036	gfRcbrC.exe
1504	xYgjYGu.exe
2764	EwCGjCx.exe
4656	enoVdtV.exe
1848	DrusPcn.exe
1732	FmVGkfe.exe
4296	CIBTNWy.exe
3708	HPaywrP.exe
1464	FfGaniy.exe
3180	KmDjGwv.exe
1460	CUKgfWz.exe
1132	qoHNWJk.exe
960	RGFIpQs.exe
4652	qjWHxwu.exe
4224	bLaMvDZ.exe
2956	faWGcoA.exe
1088	KWjpDWo.exe
4724	Jakzoct.exe
2372	IbreWkH.exe
796	HhEfSAa.exe
2076	MXnKyAi.exe
2848	slrdTik.exe
4008	fRZBXim.exe
4340	FPVJcym.exe
1360	NeYdDkk.exe
1640	ohRJJoL.exe
712	cdlSdnO.exe
2952	uALJrEd.exe
3224	dCDTBXE.exe
4192	GGVQLft.exe
4944	uOGAHwX.exe
2176	uCsDuDt.exe
3564	MyXfIFj.exe
4204	jPlszVB.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\mqWecVj.exe	bb495d1f47b1d03f0d03a3155326275c8b8d73a99952d6824adcc250e785fa07.exe
File created	C:\Windows\System\bPvOoDF.exe	bb495d1f47b1d03f0d03a3155326275c8b8d73a99952d6824adcc250e785fa07.exe
File created	C:\Windows\System\qgzwkbE.exe	bb495d1f47b1d03f0d03a3155326275c8b8d73a99952d6824adcc250e785fa07.exe
File created	C:\Windows\System\xYgjYGu.exe	bb495d1f47b1d03f0d03a3155326275c8b8d73a99952d6824adcc250e785fa07.exe
File created	C:\Windows\System\LrPLYzl.exe	bb495d1f47b1d03f0d03a3155326275c8b8d73a99952d6824adcc250e785fa07.exe
File created	C:\Windows\System\GOmLYsC.exe	bb495d1f47b1d03f0d03a3155326275c8b8d73a99952d6824adcc250e785fa07.exe
File created	C:\Windows\System\fWLyLmF.exe	bb495d1f47b1d03f0d03a3155326275c8b8d73a99952d6824adcc250e785fa07.exe
File created	C:\Windows\System\xmUUZzL.exe	bb495d1f47b1d03f0d03a3155326275c8b8d73a99952d6824adcc250e785fa07.exe
File created	C:\Windows\System\vUIrrEY.exe	bb495d1f47b1d03f0d03a3155326275c8b8d73a99952d6824adcc250e785fa07.exe
File created	C:\Windows\System\vHVKzLN.exe	bb495d1f47b1d03f0d03a3155326275c8b8d73a99952d6824adcc250e785fa07.exe
File created	C:\Windows\System\vMbPuOk.exe	bb495d1f47b1d03f0d03a3155326275c8b8d73a99952d6824adcc250e785fa07.exe
File created	C:\Windows\System\jUJxWxn.exe	bb495d1f47b1d03f0d03a3155326275c8b8d73a99952d6824adcc250e785fa07.exe
File created	C:\Windows\System\IVvyYUA.exe	bb495d1f47b1d03f0d03a3155326275c8b8d73a99952d6824adcc250e785fa07.exe
File created	C:\Windows\System\aOnKSbw.exe	bb495d1f47b1d03f0d03a3155326275c8b8d73a99952d6824adcc250e785fa07.exe
File created	C:\Windows\System\LPCorja.exe	bb495d1f47b1d03f0d03a3155326275c8b8d73a99952d6824adcc250e785fa07.exe
File created	C:\Windows\System\hqRSBrG.exe	bb495d1f47b1d03f0d03a3155326275c8b8d73a99952d6824adcc250e785fa07.exe
File created	C:\Windows\System\ATZJrWZ.exe	bb495d1f47b1d03f0d03a3155326275c8b8d73a99952d6824adcc250e785fa07.exe
File created	C:\Windows\System\XkKrZRH.exe	bb495d1f47b1d03f0d03a3155326275c8b8d73a99952d6824adcc250e785fa07.exe
File created	C:\Windows\System\jwpMtXA.exe	bb495d1f47b1d03f0d03a3155326275c8b8d73a99952d6824adcc250e785fa07.exe
File created	C:\Windows\System\MOUjiiw.exe	bb495d1f47b1d03f0d03a3155326275c8b8d73a99952d6824adcc250e785fa07.exe
File created	C:\Windows\System\NHuMNUY.exe	bb495d1f47b1d03f0d03a3155326275c8b8d73a99952d6824adcc250e785fa07.exe
File created	C:\Windows\System\vlBEzrm.exe	bb495d1f47b1d03f0d03a3155326275c8b8d73a99952d6824adcc250e785fa07.exe
File created	C:\Windows\System\aikKlaU.exe	bb495d1f47b1d03f0d03a3155326275c8b8d73a99952d6824adcc250e785fa07.exe
File created	C:\Windows\System\cgLBpQt.exe	bb495d1f47b1d03f0d03a3155326275c8b8d73a99952d6824adcc250e785fa07.exe
File created	C:\Windows\System\VGyTqBP.exe	bb495d1f47b1d03f0d03a3155326275c8b8d73a99952d6824adcc250e785fa07.exe
File created	C:\Windows\System\YIzmfIg.exe	bb495d1f47b1d03f0d03a3155326275c8b8d73a99952d6824adcc250e785fa07.exe
File created	C:\Windows\System\MwHmgwW.exe	bb495d1f47b1d03f0d03a3155326275c8b8d73a99952d6824adcc250e785fa07.exe
File created	C:\Windows\System\kuWdTqs.exe	bb495d1f47b1d03f0d03a3155326275c8b8d73a99952d6824adcc250e785fa07.exe
File created	C:\Windows\System\hnsODoy.exe	bb495d1f47b1d03f0d03a3155326275c8b8d73a99952d6824adcc250e785fa07.exe
File created	C:\Windows\System\oGQQiuF.exe	bb495d1f47b1d03f0d03a3155326275c8b8d73a99952d6824adcc250e785fa07.exe
File created	C:\Windows\System\bmFgLTz.exe	bb495d1f47b1d03f0d03a3155326275c8b8d73a99952d6824adcc250e785fa07.exe
File created	C:\Windows\System\mVyXwKI.exe	bb495d1f47b1d03f0d03a3155326275c8b8d73a99952d6824adcc250e785fa07.exe
File created	C:\Windows\System\TXfclSr.exe	bb495d1f47b1d03f0d03a3155326275c8b8d73a99952d6824adcc250e785fa07.exe
File created	C:\Windows\System\nEljtsE.exe	bb495d1f47b1d03f0d03a3155326275c8b8d73a99952d6824adcc250e785fa07.exe
File created	C:\Windows\System\JWmOiXu.exe	bb495d1f47b1d03f0d03a3155326275c8b8d73a99952d6824adcc250e785fa07.exe
File created	C:\Windows\System\gZQVFMj.exe	bb495d1f47b1d03f0d03a3155326275c8b8d73a99952d6824adcc250e785fa07.exe
File created	C:\Windows\System\ZGIVdPw.exe	bb495d1f47b1d03f0d03a3155326275c8b8d73a99952d6824adcc250e785fa07.exe
File created	C:\Windows\System\eObGnTI.exe	bb495d1f47b1d03f0d03a3155326275c8b8d73a99952d6824adcc250e785fa07.exe
File created	C:\Windows\System\DMnNSWq.exe	bb495d1f47b1d03f0d03a3155326275c8b8d73a99952d6824adcc250e785fa07.exe
File created	C:\Windows\System\vSTKjdR.exe	bb495d1f47b1d03f0d03a3155326275c8b8d73a99952d6824adcc250e785fa07.exe
File created	C:\Windows\System\HghpgLI.exe	bb495d1f47b1d03f0d03a3155326275c8b8d73a99952d6824adcc250e785fa07.exe
File created	C:\Windows\System\gtIKJZe.exe	bb495d1f47b1d03f0d03a3155326275c8b8d73a99952d6824adcc250e785fa07.exe
File created	C:\Windows\System\mjnhIRp.exe	bb495d1f47b1d03f0d03a3155326275c8b8d73a99952d6824adcc250e785fa07.exe
File created	C:\Windows\System\TFYqayk.exe	bb495d1f47b1d03f0d03a3155326275c8b8d73a99952d6824adcc250e785fa07.exe
File created	C:\Windows\System\DMlLvnd.exe	bb495d1f47b1d03f0d03a3155326275c8b8d73a99952d6824adcc250e785fa07.exe
File created	C:\Windows\System\kSPyxgG.exe	bb495d1f47b1d03f0d03a3155326275c8b8d73a99952d6824adcc250e785fa07.exe
File created	C:\Windows\System\ymqtWVg.exe	bb495d1f47b1d03f0d03a3155326275c8b8d73a99952d6824adcc250e785fa07.exe
File created	C:\Windows\System\AmQUxvl.exe	bb495d1f47b1d03f0d03a3155326275c8b8d73a99952d6824adcc250e785fa07.exe
File created	C:\Windows\System\DHnYaJF.exe	bb495d1f47b1d03f0d03a3155326275c8b8d73a99952d6824adcc250e785fa07.exe
File created	C:\Windows\System\TkZVcOX.exe	bb495d1f47b1d03f0d03a3155326275c8b8d73a99952d6824adcc250e785fa07.exe
File created	C:\Windows\System\EEEdPAQ.exe	bb495d1f47b1d03f0d03a3155326275c8b8d73a99952d6824adcc250e785fa07.exe
File created	C:\Windows\System\ltOLKzh.exe	bb495d1f47b1d03f0d03a3155326275c8b8d73a99952d6824adcc250e785fa07.exe
File created	C:\Windows\System\ZNEIucT.exe	bb495d1f47b1d03f0d03a3155326275c8b8d73a99952d6824adcc250e785fa07.exe
File created	C:\Windows\System\vQEiSGL.exe	bb495d1f47b1d03f0d03a3155326275c8b8d73a99952d6824adcc250e785fa07.exe
File created	C:\Windows\System\iMlrbsa.exe	bb495d1f47b1d03f0d03a3155326275c8b8d73a99952d6824adcc250e785fa07.exe
File created	C:\Windows\System\opWBARy.exe	bb495d1f47b1d03f0d03a3155326275c8b8d73a99952d6824adcc250e785fa07.exe
File created	C:\Windows\System\qIgWKlc.exe	bb495d1f47b1d03f0d03a3155326275c8b8d73a99952d6824adcc250e785fa07.exe
File created	C:\Windows\System\ULQMZJH.exe	bb495d1f47b1d03f0d03a3155326275c8b8d73a99952d6824adcc250e785fa07.exe
File created	C:\Windows\System\mGkOhgQ.exe	bb495d1f47b1d03f0d03a3155326275c8b8d73a99952d6824adcc250e785fa07.exe
File created	C:\Windows\System\XpPwBPc.exe	bb495d1f47b1d03f0d03a3155326275c8b8d73a99952d6824adcc250e785fa07.exe
File created	C:\Windows\System\uHUgJlh.exe	bb495d1f47b1d03f0d03a3155326275c8b8d73a99952d6824adcc250e785fa07.exe
File created	C:\Windows\System\dlEZxJi.exe	bb495d1f47b1d03f0d03a3155326275c8b8d73a99952d6824adcc250e785fa07.exe
File created	C:\Windows\System\ZJnlYKO.exe	bb495d1f47b1d03f0d03a3155326275c8b8d73a99952d6824adcc250e785fa07.exe
File created	C:\Windows\System\ACmsJtz.exe	bb495d1f47b1d03f0d03a3155326275c8b8d73a99952d6824adcc250e785fa07.exe

Event Triggered Execution: Accessibility Features 1 TTPs
Windows contains accessibility features that may be used by adversaries to establish persistence and/or elevate privileges.
persistence privilege_escalation

Accessibility Features
T1546.008

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	17100	dwm.exe
Token: SeChangeNotifyPrivilege	17100	dwm.exe
Token: 33	17100	dwm.exe
Token: SeIncBasePriorityPrivilege	17100	dwm.exe
Token: SeShutdownPrivilege	17100	dwm.exe
Token: SeCreatePagefilePrivilege	17100	dwm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5096 wrote to memory of 1520	5096	bb495d1f47b1d03f0d03a3155326275c8b8d73a99952d6824adcc250e785fa07.exe	84
PID 5096 wrote to memory of 1520	5096	bb495d1f47b1d03f0d03a3155326275c8b8d73a99952d6824adcc250e785fa07.exe	84
PID 5096 wrote to memory of 4168	5096	bb495d1f47b1d03f0d03a3155326275c8b8d73a99952d6824adcc250e785fa07.exe	85
PID 5096 wrote to memory of 4168	5096	bb495d1f47b1d03f0d03a3155326275c8b8d73a99952d6824adcc250e785fa07.exe	85
PID 5096 wrote to memory of 4020	5096	bb495d1f47b1d03f0d03a3155326275c8b8d73a99952d6824adcc250e785fa07.exe	86
PID 5096 wrote to memory of 4020	5096	bb495d1f47b1d03f0d03a3155326275c8b8d73a99952d6824adcc250e785fa07.exe	86
PID 5096 wrote to memory of 1020	5096	bb495d1f47b1d03f0d03a3155326275c8b8d73a99952d6824adcc250e785fa07.exe	87
PID 5096 wrote to memory of 1020	5096	bb495d1f47b1d03f0d03a3155326275c8b8d73a99952d6824adcc250e785fa07.exe	87
PID 5096 wrote to memory of 1120	5096	bb495d1f47b1d03f0d03a3155326275c8b8d73a99952d6824adcc250e785fa07.exe	88
PID 5096 wrote to memory of 1120	5096	bb495d1f47b1d03f0d03a3155326275c8b8d73a99952d6824adcc250e785fa07.exe	88
PID 5096 wrote to memory of 3552	5096	bb495d1f47b1d03f0d03a3155326275c8b8d73a99952d6824adcc250e785fa07.exe	89
PID 5096 wrote to memory of 3552	5096	bb495d1f47b1d03f0d03a3155326275c8b8d73a99952d6824adcc250e785fa07.exe	89
PID 5096 wrote to memory of 4152	5096	bb495d1f47b1d03f0d03a3155326275c8b8d73a99952d6824adcc250e785fa07.exe	90
PID 5096 wrote to memory of 4152	5096	bb495d1f47b1d03f0d03a3155326275c8b8d73a99952d6824adcc250e785fa07.exe	90
PID 5096 wrote to memory of 3704	5096	bb495d1f47b1d03f0d03a3155326275c8b8d73a99952d6824adcc250e785fa07.exe	91
PID 5096 wrote to memory of 3704	5096	bb495d1f47b1d03f0d03a3155326275c8b8d73a99952d6824adcc250e785fa07.exe	91
PID 5096 wrote to memory of 1584	5096	bb495d1f47b1d03f0d03a3155326275c8b8d73a99952d6824adcc250e785fa07.exe	92
PID 5096 wrote to memory of 1584	5096	bb495d1f47b1d03f0d03a3155326275c8b8d73a99952d6824adcc250e785fa07.exe	92
PID 5096 wrote to memory of 2292	5096	bb495d1f47b1d03f0d03a3155326275c8b8d73a99952d6824adcc250e785fa07.exe	93
PID 5096 wrote to memory of 2292	5096	bb495d1f47b1d03f0d03a3155326275c8b8d73a99952d6824adcc250e785fa07.exe	93
PID 5096 wrote to memory of 4280	5096	bb495d1f47b1d03f0d03a3155326275c8b8d73a99952d6824adcc250e785fa07.exe	94
PID 5096 wrote to memory of 4280	5096	bb495d1f47b1d03f0d03a3155326275c8b8d73a99952d6824adcc250e785fa07.exe	94
PID 5096 wrote to memory of 820	5096	bb495d1f47b1d03f0d03a3155326275c8b8d73a99952d6824adcc250e785fa07.exe	95
PID 5096 wrote to memory of 820	5096	bb495d1f47b1d03f0d03a3155326275c8b8d73a99952d6824adcc250e785fa07.exe	95
PID 5096 wrote to memory of 1432	5096	bb495d1f47b1d03f0d03a3155326275c8b8d73a99952d6824adcc250e785fa07.exe	96
PID 5096 wrote to memory of 1432	5096	bb495d1f47b1d03f0d03a3155326275c8b8d73a99952d6824adcc250e785fa07.exe	96
PID 5096 wrote to memory of 4284	5096	bb495d1f47b1d03f0d03a3155326275c8b8d73a99952d6824adcc250e785fa07.exe	97
PID 5096 wrote to memory of 4284	5096	bb495d1f47b1d03f0d03a3155326275c8b8d73a99952d6824adcc250e785fa07.exe	97
PID 5096 wrote to memory of 1960	5096	bb495d1f47b1d03f0d03a3155326275c8b8d73a99952d6824adcc250e785fa07.exe	98
PID 5096 wrote to memory of 1960	5096	bb495d1f47b1d03f0d03a3155326275c8b8d73a99952d6824adcc250e785fa07.exe	98
PID 5096 wrote to memory of 1852	5096	bb495d1f47b1d03f0d03a3155326275c8b8d73a99952d6824adcc250e785fa07.exe	99
PID 5096 wrote to memory of 1852	5096	bb495d1f47b1d03f0d03a3155326275c8b8d73a99952d6824adcc250e785fa07.exe	99
PID 5096 wrote to memory of 716	5096	bb495d1f47b1d03f0d03a3155326275c8b8d73a99952d6824adcc250e785fa07.exe	100
PID 5096 wrote to memory of 716	5096	bb495d1f47b1d03f0d03a3155326275c8b8d73a99952d6824adcc250e785fa07.exe	100
PID 5096 wrote to memory of 2232	5096	bb495d1f47b1d03f0d03a3155326275c8b8d73a99952d6824adcc250e785fa07.exe	101
PID 5096 wrote to memory of 2232	5096	bb495d1f47b1d03f0d03a3155326275c8b8d73a99952d6824adcc250e785fa07.exe	101
PID 5096 wrote to memory of 5012	5096	bb495d1f47b1d03f0d03a3155326275c8b8d73a99952d6824adcc250e785fa07.exe	102
PID 5096 wrote to memory of 5012	5096	bb495d1f47b1d03f0d03a3155326275c8b8d73a99952d6824adcc250e785fa07.exe	102
PID 5096 wrote to memory of 3728	5096	bb495d1f47b1d03f0d03a3155326275c8b8d73a99952d6824adcc250e785fa07.exe	103
PID 5096 wrote to memory of 3728	5096	bb495d1f47b1d03f0d03a3155326275c8b8d73a99952d6824adcc250e785fa07.exe	103
PID 5096 wrote to memory of 3204	5096	bb495d1f47b1d03f0d03a3155326275c8b8d73a99952d6824adcc250e785fa07.exe	104
PID 5096 wrote to memory of 3204	5096	bb495d1f47b1d03f0d03a3155326275c8b8d73a99952d6824adcc250e785fa07.exe	104
PID 5096 wrote to memory of 996	5096	bb495d1f47b1d03f0d03a3155326275c8b8d73a99952d6824adcc250e785fa07.exe	105
PID 5096 wrote to memory of 996	5096	bb495d1f47b1d03f0d03a3155326275c8b8d73a99952d6824adcc250e785fa07.exe	105
PID 5096 wrote to memory of 4820	5096	bb495d1f47b1d03f0d03a3155326275c8b8d73a99952d6824adcc250e785fa07.exe	106
PID 5096 wrote to memory of 4820	5096	bb495d1f47b1d03f0d03a3155326275c8b8d73a99952d6824adcc250e785fa07.exe	106
PID 5096 wrote to memory of 4664	5096	bb495d1f47b1d03f0d03a3155326275c8b8d73a99952d6824adcc250e785fa07.exe	107
PID 5096 wrote to memory of 4664	5096	bb495d1f47b1d03f0d03a3155326275c8b8d73a99952d6824adcc250e785fa07.exe	107
PID 5096 wrote to memory of 764	5096	bb495d1f47b1d03f0d03a3155326275c8b8d73a99952d6824adcc250e785fa07.exe	108
PID 5096 wrote to memory of 764	5096	bb495d1f47b1d03f0d03a3155326275c8b8d73a99952d6824adcc250e785fa07.exe	108
PID 5096 wrote to memory of 3088	5096	bb495d1f47b1d03f0d03a3155326275c8b8d73a99952d6824adcc250e785fa07.exe	109
PID 5096 wrote to memory of 3088	5096	bb495d1f47b1d03f0d03a3155326275c8b8d73a99952d6824adcc250e785fa07.exe	109
PID 5096 wrote to memory of 4616	5096	bb495d1f47b1d03f0d03a3155326275c8b8d73a99952d6824adcc250e785fa07.exe	110
PID 5096 wrote to memory of 4616	5096	bb495d1f47b1d03f0d03a3155326275c8b8d73a99952d6824adcc250e785fa07.exe	110
PID 5096 wrote to memory of 2648	5096	bb495d1f47b1d03f0d03a3155326275c8b8d73a99952d6824adcc250e785fa07.exe	111
PID 5096 wrote to memory of 2648	5096	bb495d1f47b1d03f0d03a3155326275c8b8d73a99952d6824adcc250e785fa07.exe	111
PID 5096 wrote to memory of 3460	5096	bb495d1f47b1d03f0d03a3155326275c8b8d73a99952d6824adcc250e785fa07.exe	112
PID 5096 wrote to memory of 3460	5096	bb495d1f47b1d03f0d03a3155326275c8b8d73a99952d6824adcc250e785fa07.exe	112
PID 5096 wrote to memory of 5088	5096	bb495d1f47b1d03f0d03a3155326275c8b8d73a99952d6824adcc250e785fa07.exe	113
PID 5096 wrote to memory of 5088	5096	bb495d1f47b1d03f0d03a3155326275c8b8d73a99952d6824adcc250e785fa07.exe	113
PID 5096 wrote to memory of 1036	5096	bb495d1f47b1d03f0d03a3155326275c8b8d73a99952d6824adcc250e785fa07.exe	114
PID 5096 wrote to memory of 1036	5096	bb495d1f47b1d03f0d03a3155326275c8b8d73a99952d6824adcc250e785fa07.exe	114
PID 5096 wrote to memory of 1504	5096	bb495d1f47b1d03f0d03a3155326275c8b8d73a99952d6824adcc250e785fa07.exe	115
PID 5096 wrote to memory of 1504	5096	bb495d1f47b1d03f0d03a3155326275c8b8d73a99952d6824adcc250e785fa07.exe	115

C:\Users\Admin\AppData\Local\Temp\bb495d1f47b1d03f0d03a3155326275c8b8d73a99952d6824adcc250e785fa07.exe
"C:\Users\Admin\AppData\Local\Temp\bb495d1f47b1d03f0d03a3155326275c8b8d73a99952d6824adcc250e785fa07.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:5096
- C:\Windows\System\zUaRTyh.exe
  C:\Windows\System\zUaRTyh.exe
  2⤵
  - Executes dropped EXE
  PID:1520
- C:\Windows\System\SBmabzm.exe
  C:\Windows\System\SBmabzm.exe
  2⤵
  - Executes dropped EXE
  PID:4168
- C:\Windows\System\fXVYGsY.exe
  C:\Windows\System\fXVYGsY.exe
  2⤵
  - Executes dropped EXE
  PID:4020
- C:\Windows\System\YJhoHFH.exe
  C:\Windows\System\YJhoHFH.exe
  2⤵
  - Executes dropped EXE
  PID:1020
- C:\Windows\System\eqjdIER.exe
  C:\Windows\System\eqjdIER.exe
  2⤵
  - Executes dropped EXE
  PID:1120
- C:\Windows\System\sAgugjr.exe
  C:\Windows\System\sAgugjr.exe
  2⤵
  - Executes dropped EXE
  PID:3552
- C:\Windows\System\yGmpugo.exe
  C:\Windows\System\yGmpugo.exe
  2⤵
  - Executes dropped EXE
  PID:4152
- C:\Windows\System\oFnoPAp.exe
  C:\Windows\System\oFnoPAp.exe
  2⤵
  - Executes dropped EXE
  PID:3704
- C:\Windows\System\rvZiGcq.exe
  C:\Windows\System\rvZiGcq.exe
  2⤵
  - Executes dropped EXE
  PID:1584
- C:\Windows\System\lYEmGyO.exe
  C:\Windows\System\lYEmGyO.exe
  2⤵
  - Executes dropped EXE
  PID:2292
- C:\Windows\System\UGkcIkW.exe
  C:\Windows\System\UGkcIkW.exe
  2⤵
  - Executes dropped EXE
  PID:4280
- C:\Windows\System\DOrHjaK.exe
  C:\Windows\System\DOrHjaK.exe
  2⤵
  - Executes dropped EXE
  PID:820
- C:\Windows\System\WJldBSP.exe
  C:\Windows\System\WJldBSP.exe
  2⤵
  - Executes dropped EXE
  PID:1432
- C:\Windows\System\mdvJkkU.exe
  C:\Windows\System\mdvJkkU.exe
  2⤵
  - Executes dropped EXE
  PID:4284
- C:\Windows\System\RKJUUov.exe
  C:\Windows\System\RKJUUov.exe
  2⤵
  - Executes dropped EXE
  PID:1960
- C:\Windows\System\UYwahAk.exe
  C:\Windows\System\UYwahAk.exe
  2⤵
  - Executes dropped EXE
  PID:1852
- C:\Windows\System\UaHIIVT.exe
  C:\Windows\System\UaHIIVT.exe
  2⤵
  - Executes dropped EXE
  PID:716
- C:\Windows\System\ivJigsR.exe
  C:\Windows\System\ivJigsR.exe
  2⤵
  - Executes dropped EXE
  PID:2232
- C:\Windows\System\BGIfTlo.exe
  C:\Windows\System\BGIfTlo.exe
  2⤵
  - Executes dropped EXE
  PID:5012
- C:\Windows\System\YITssvz.exe
  C:\Windows\System\YITssvz.exe
  2⤵
  - Executes dropped EXE
  PID:3728
- C:\Windows\System\RfDyOUI.exe
  C:\Windows\System\RfDyOUI.exe
  2⤵
  - Executes dropped EXE
  PID:3204
- C:\Windows\System\fWLyLmF.exe
  C:\Windows\System\fWLyLmF.exe
  2⤵
  - Executes dropped EXE
  PID:996
- C:\Windows\System\oQFUhzu.exe
  C:\Windows\System\oQFUhzu.exe
  2⤵
  - Executes dropped EXE
  PID:4820
- C:\Windows\System\QYEQemr.exe
  C:\Windows\System\QYEQemr.exe
  2⤵
  - Executes dropped EXE
  PID:4664
- C:\Windows\System\VfqZZcO.exe
  C:\Windows\System\VfqZZcO.exe
  2⤵
  - Executes dropped EXE
  PID:764
- C:\Windows\System\iDRfEbS.exe
  C:\Windows\System\iDRfEbS.exe
  2⤵
  - Executes dropped EXE
  PID:3088
- C:\Windows\System\DBrodNH.exe
  C:\Windows\System\DBrodNH.exe
  2⤵
  - Executes dropped EXE
  PID:4616
- C:\Windows\System\WHUBJdm.exe
  C:\Windows\System\WHUBJdm.exe
  2⤵
  - Executes dropped EXE
  PID:2648
- C:\Windows\System\YkhiEcH.exe
  C:\Windows\System\YkhiEcH.exe
  2⤵
  - Executes dropped EXE
  PID:3460
- C:\Windows\System\vNFpMBH.exe
  C:\Windows\System\vNFpMBH.exe
  2⤵
  - Executes dropped EXE
  PID:5088
- C:\Windows\System\gfRcbrC.exe
  C:\Windows\System\gfRcbrC.exe
  2⤵
  - Executes dropped EXE
  PID:1036
- C:\Windows\System\xYgjYGu.exe
  C:\Windows\System\xYgjYGu.exe
  2⤵
  - Executes dropped EXE
  PID:1504
- C:\Windows\System\EwCGjCx.exe
  C:\Windows\System\EwCGjCx.exe
  2⤵
  - Executes dropped EXE
  PID:2764
- C:\Windows\System\enoVdtV.exe
  C:\Windows\System\enoVdtV.exe
  2⤵
  - Executes dropped EXE
  PID:4656
- C:\Windows\System\DrusPcn.exe
  C:\Windows\System\DrusPcn.exe
  2⤵
  - Executes dropped EXE
  PID:1848
- C:\Windows\System\FmVGkfe.exe
  C:\Windows\System\FmVGkfe.exe
  2⤵
  - Executes dropped EXE
  PID:1732
- C:\Windows\System\CIBTNWy.exe
  C:\Windows\System\CIBTNWy.exe
  2⤵
  - Executes dropped EXE
  PID:4296
- C:\Windows\System\HPaywrP.exe
  C:\Windows\System\HPaywrP.exe
  2⤵
  - Executes dropped EXE
  PID:3708
- C:\Windows\System\FfGaniy.exe
  C:\Windows\System\FfGaniy.exe
  2⤵
  - Executes dropped EXE
  PID:1464
- C:\Windows\System\KmDjGwv.exe
  C:\Windows\System\KmDjGwv.exe
  2⤵
  - Executes dropped EXE
  PID:3180
- C:\Windows\System\CUKgfWz.exe
  C:\Windows\System\CUKgfWz.exe
  2⤵
  - Executes dropped EXE
  PID:1460
- C:\Windows\System\qoHNWJk.exe
  C:\Windows\System\qoHNWJk.exe
  2⤵
  - Executes dropped EXE
  PID:1132
- C:\Windows\System\RGFIpQs.exe
  C:\Windows\System\RGFIpQs.exe
  2⤵
  - Executes dropped EXE
  PID:960
- C:\Windows\System\qjWHxwu.exe
  C:\Windows\System\qjWHxwu.exe
  2⤵
  - Executes dropped EXE
  PID:4652
- C:\Windows\System\bLaMvDZ.exe
  C:\Windows\System\bLaMvDZ.exe
  2⤵
  - Executes dropped EXE
  PID:4224
- C:\Windows\System\faWGcoA.exe
  C:\Windows\System\faWGcoA.exe
  2⤵
  - Executes dropped EXE
  PID:2956
- C:\Windows\System\KWjpDWo.exe
  C:\Windows\System\KWjpDWo.exe
  2⤵
  - Executes dropped EXE
  PID:1088
- C:\Windows\System\Jakzoct.exe
  C:\Windows\System\Jakzoct.exe
  2⤵
  - Executes dropped EXE
  PID:4724
- C:\Windows\System\IbreWkH.exe
  C:\Windows\System\IbreWkH.exe
  2⤵
  - Executes dropped EXE
  PID:2372
- C:\Windows\System\HhEfSAa.exe
  C:\Windows\System\HhEfSAa.exe
  2⤵
  - Executes dropped EXE
  PID:796
- C:\Windows\System\MXnKyAi.exe
  C:\Windows\System\MXnKyAi.exe
  2⤵
  - Executes dropped EXE
  PID:2076
- C:\Windows\System\slrdTik.exe
  C:\Windows\System\slrdTik.exe
  2⤵
  - Executes dropped EXE
  PID:2848
- C:\Windows\System\fRZBXim.exe
  C:\Windows\System\fRZBXim.exe
  2⤵
  - Executes dropped EXE
  PID:4008
- C:\Windows\System\FPVJcym.exe
  C:\Windows\System\FPVJcym.exe
  2⤵
  - Executes dropped EXE
  PID:4340
- C:\Windows\System\NeYdDkk.exe
  C:\Windows\System\NeYdDkk.exe
  2⤵
  - Executes dropped EXE
  PID:1360
- C:\Windows\System\ohRJJoL.exe
  C:\Windows\System\ohRJJoL.exe
  2⤵
  - Executes dropped EXE
  PID:1640
- C:\Windows\System\cdlSdnO.exe
  C:\Windows\System\cdlSdnO.exe
  2⤵
  - Executes dropped EXE
  PID:712
- C:\Windows\System\uALJrEd.exe
  C:\Windows\System\uALJrEd.exe
  2⤵
  - Executes dropped EXE
  PID:2952
- C:\Windows\System\dCDTBXE.exe
  C:\Windows\System\dCDTBXE.exe
  2⤵
  - Executes dropped EXE
  PID:3224
- C:\Windows\System\GGVQLft.exe
  C:\Windows\System\GGVQLft.exe
  2⤵
  - Executes dropped EXE
  PID:4192
- C:\Windows\System\uOGAHwX.exe
  C:\Windows\System\uOGAHwX.exe
  2⤵
  - Executes dropped EXE
  PID:4944
- C:\Windows\System\uCsDuDt.exe
  C:\Windows\System\uCsDuDt.exe
  2⤵
  - Executes dropped EXE
  PID:2176
- C:\Windows\System\MyXfIFj.exe
  C:\Windows\System\MyXfIFj.exe
  2⤵
  - Executes dropped EXE
  PID:3564
- C:\Windows\System\jPlszVB.exe
  C:\Windows\System\jPlszVB.exe
  2⤵
  - Executes dropped EXE
  PID:4204
- C:\Windows\System\PfOPqCO.exe
  C:\Windows\System\PfOPqCO.exe
  2⤵
  PID:4904
- C:\Windows\System\mGkOhgQ.exe
  C:\Windows\System\mGkOhgQ.exe
  2⤵
  PID:2940
- C:\Windows\System\TThqHCX.exe
  C:\Windows\System\TThqHCX.exe
  2⤵
  PID:5020
- C:\Windows\System\vdRKpFg.exe
  C:\Windows\System\vdRKpFg.exe
  2⤵
  PID:2796
- C:\Windows\System\iFgPeUr.exe
  C:\Windows\System\iFgPeUr.exe
  2⤵
  PID:1100
- C:\Windows\System\BeNMnfV.exe
  C:\Windows\System\BeNMnfV.exe
  2⤵
  PID:4300
- C:\Windows\System\PggGLgc.exe
  C:\Windows\System\PggGLgc.exe
  2⤵
  PID:1488
- C:\Windows\System\HdnOFvM.exe
  C:\Windows\System\HdnOFvM.exe
  2⤵
  PID:1964
- C:\Windows\System\yuDdAxD.exe
  C:\Windows\System\yuDdAxD.exe
  2⤵
  PID:4576
- C:\Windows\System\nCBbduI.exe
  C:\Windows\System\nCBbduI.exe
  2⤵
  PID:5048
- C:\Windows\System\aOnKSbw.exe
  C:\Windows\System\aOnKSbw.exe
  2⤵
  PID:3520
- C:\Windows\System\FrAcSaK.exe
  C:\Windows\System\FrAcSaK.exe
  2⤵
  PID:4364
- C:\Windows\System\rltqQCk.exe
  C:\Windows\System\rltqQCk.exe
  2⤵
  PID:4896
- C:\Windows\System\lpRVMRY.exe
  C:\Windows\System\lpRVMRY.exe
  2⤵
  PID:2136
- C:\Windows\System\fZyhpMs.exe
  C:\Windows\System\fZyhpMs.exe
  2⤵
  PID:4748
- C:\Windows\System\TFYqayk.exe
  C:\Windows\System\TFYqayk.exe
  2⤵
  PID:3840
- C:\Windows\System\auoUxeL.exe
  C:\Windows\System\auoUxeL.exe
  2⤵
  PID:2608
- C:\Windows\System\LxScpfB.exe
  C:\Windows\System\LxScpfB.exe
  2⤵
  PID:5128
- C:\Windows\System\JWmOiXu.exe
  C:\Windows\System\JWmOiXu.exe
  2⤵
  PID:5156
- C:\Windows\System\HfJyofp.exe
  C:\Windows\System\HfJyofp.exe
  2⤵
  PID:5180
- C:\Windows\System\BSOCydq.exe
  C:\Windows\System\BSOCydq.exe
  2⤵
  PID:5208
- C:\Windows\System\eagEaoS.exe
  C:\Windows\System\eagEaoS.exe
  2⤵
  PID:5236
- C:\Windows\System\RlYVDeO.exe
  C:\Windows\System\RlYVDeO.exe
  2⤵
  PID:5264
- C:\Windows\System\gyrgnHn.exe
  C:\Windows\System\gyrgnHn.exe
  2⤵
  PID:5292
- C:\Windows\System\nzOggwW.exe
  C:\Windows\System\nzOggwW.exe
  2⤵
  PID:5320
- C:\Windows\System\SIesDqT.exe
  C:\Windows\System\SIesDqT.exe
  2⤵
  PID:5348
- C:\Windows\System\cneOonP.exe
  C:\Windows\System\cneOonP.exe
  2⤵
  PID:5380
- C:\Windows\System\fKzuCPq.exe
  C:\Windows\System\fKzuCPq.exe
  2⤵
  PID:5404
- C:\Windows\System\dOfSJmy.exe
  C:\Windows\System\dOfSJmy.exe
  2⤵
  PID:5432
- C:\Windows\System\aHlEuRc.exe
  C:\Windows\System\aHlEuRc.exe
  2⤵
  PID:5460
- C:\Windows\System\lsQYJFG.exe
  C:\Windows\System\lsQYJFG.exe
  2⤵
  PID:5488
- C:\Windows\System\YBTZrtg.exe
  C:\Windows\System\YBTZrtg.exe
  2⤵
  PID:5516
- C:\Windows\System\HnhGGLK.exe
  C:\Windows\System\HnhGGLK.exe
  2⤵
  PID:5548
- C:\Windows\System\uteIDUM.exe
  C:\Windows\System\uteIDUM.exe
  2⤵
  PID:5572
- C:\Windows\System\cQnmhdD.exe
  C:\Windows\System\cQnmhdD.exe
  2⤵
  PID:5600
- C:\Windows\System\PHkTBRU.exe
  C:\Windows\System\PHkTBRU.exe
  2⤵
  PID:5628
- C:\Windows\System\wNZrRiz.exe
  C:\Windows\System\wNZrRiz.exe
  2⤵
  PID:5656
- C:\Windows\System\zNWYXIJ.exe
  C:\Windows\System\zNWYXIJ.exe
  2⤵
  PID:5688
- C:\Windows\System\LgFUNmj.exe
  C:\Windows\System\LgFUNmj.exe
  2⤵
  PID:5712
- C:\Windows\System\dfPghJj.exe
  C:\Windows\System\dfPghJj.exe
  2⤵
  PID:5740
- C:\Windows\System\JIRlGGl.exe
  C:\Windows\System\JIRlGGl.exe
  2⤵
  PID:5768
- C:\Windows\System\ulDozqu.exe
  C:\Windows\System\ulDozqu.exe
  2⤵
  PID:5796
- C:\Windows\System\dFCkafR.exe
  C:\Windows\System\dFCkafR.exe
  2⤵
  PID:5824
- C:\Windows\System\ceUyqnQ.exe
  C:\Windows\System\ceUyqnQ.exe
  2⤵
  PID:5852
- C:\Windows\System\jUJxWxn.exe
  C:\Windows\System\jUJxWxn.exe
  2⤵
  PID:5880
- C:\Windows\System\KVViZMH.exe
  C:\Windows\System\KVViZMH.exe
  2⤵
  PID:5908
- C:\Windows\System\buotsIF.exe
  C:\Windows\System\buotsIF.exe
  2⤵
  PID:5936
- C:\Windows\System\tersMad.exe
  C:\Windows\System\tersMad.exe
  2⤵
  PID:5968
- C:\Windows\System\RjbpOjT.exe
  C:\Windows\System\RjbpOjT.exe
  2⤵
  PID:6028
- C:\Windows\System\wUtNQVO.exe
  C:\Windows\System\wUtNQVO.exe
  2⤵
  PID:6044
- C:\Windows\System\jkEtShd.exe
  C:\Windows\System\jkEtShd.exe
  2⤵
  PID:6060
- C:\Windows\System\uIZubrq.exe
  C:\Windows\System\uIZubrq.exe
  2⤵
  PID:6076
- C:\Windows\System\UADSGzg.exe
  C:\Windows\System\UADSGzg.exe
  2⤵
  PID:6104
- C:\Windows\System\vaptDBv.exe
  C:\Windows\System\vaptDBv.exe
  2⤵
  PID:6132
- C:\Windows\System\HtQHMKK.exe
  C:\Windows\System\HtQHMKK.exe
  2⤵
  PID:2456
- C:\Windows\System\EEEdPAQ.exe
  C:\Windows\System\EEEdPAQ.exe
  2⤵
  PID:2964
- C:\Windows\System\DEiieiI.exe
  C:\Windows\System\DEiieiI.exe
  2⤵
  PID:1468
- C:\Windows\System\cgLBpQt.exe
  C:\Windows\System\cgLBpQt.exe
  2⤵
  PID:1348
- C:\Windows\System\rfAnumI.exe
  C:\Windows\System\rfAnumI.exe
  2⤵
  PID:4504
- C:\Windows\System\nvZuiBz.exe
  C:\Windows\System\nvZuiBz.exe
  2⤵
  PID:3524
- C:\Windows\System\fZVsBwD.exe
  C:\Windows\System\fZVsBwD.exe
  2⤵
  PID:3636
- C:\Windows\System\VrMHpKg.exe
  C:\Windows\System\VrMHpKg.exe
  2⤵
  PID:5192
- C:\Windows\System\PfslWUn.exe
  C:\Windows\System\PfslWUn.exe
  2⤵
  PID:5252
- C:\Windows\System\nceXJhy.exe
  C:\Windows\System\nceXJhy.exe
  2⤵
  PID:5304
- C:\Windows\System\EucuZtX.exe
  C:\Windows\System\EucuZtX.exe
  2⤵
  PID:5364
- C:\Windows\System\uRigwdA.exe
  C:\Windows\System\uRigwdA.exe
  2⤵
  PID:5420
- C:\Windows\System\rqeIedr.exe
  C:\Windows\System\rqeIedr.exe
  2⤵
  PID:5480
- C:\Windows\System\cxPxCZV.exe
  C:\Windows\System\cxPxCZV.exe
  2⤵
  PID:5556
- C:\Windows\System\JCeMWAb.exe
  C:\Windows\System\JCeMWAb.exe
  2⤵
  PID:5616
- C:\Windows\System\LRUlaSH.exe
  C:\Windows\System\LRUlaSH.exe
  2⤵
  PID:5676
- C:\Windows\System\mHYJzrQ.exe
  C:\Windows\System\mHYJzrQ.exe
  2⤵
  PID:5752
- C:\Windows\System\FcvrAPB.exe
  C:\Windows\System\FcvrAPB.exe
  2⤵
  PID:5812
- C:\Windows\System\OAsnhhH.exe
  C:\Windows\System\OAsnhhH.exe
  2⤵
  PID:5868
- C:\Windows\System\FibYlMR.exe
  C:\Windows\System\FibYlMR.exe
  2⤵
  PID:5928
- C:\Windows\System\ETaIOTZ.exe
  C:\Windows\System\ETaIOTZ.exe
  2⤵
  PID:6008
- C:\Windows\System\MMnLxxS.exe
  C:\Windows\System\MMnLxxS.exe
  2⤵
  PID:6068
- C:\Windows\System\vAUCvSz.exe
  C:\Windows\System\vAUCvSz.exe
  2⤵
  PID:216
- C:\Windows\System\NWZizdx.exe
  C:\Windows\System\NWZizdx.exe
  2⤵
  PID:1568
- C:\Windows\System\GNuMBOZ.exe
  C:\Windows\System\GNuMBOZ.exe
  2⤵
  PID:1604
- C:\Windows\System\RNNpMZX.exe
  C:\Windows\System\RNNpMZX.exe
  2⤵
  PID:5172
- C:\Windows\System\GbrJsuv.exe
  C:\Windows\System\GbrJsuv.exe
  2⤵
  PID:5284
- C:\Windows\System\DufGXGu.exe
  C:\Windows\System\DufGXGu.exe
  2⤵
  PID:5400
- C:\Windows\System\DMnNSWq.exe
  C:\Windows\System\DMnNSWq.exe
  2⤵
  PID:5532
- C:\Windows\System\svOmEKw.exe
  C:\Windows\System\svOmEKw.exe
  2⤵
  PID:5672
- C:\Windows\System\sbCqwKj.exe
  C:\Windows\System\sbCqwKj.exe
  2⤵
  PID:6152
- C:\Windows\System\maIfZFA.exe
  C:\Windows\System\maIfZFA.exe
  2⤵
  PID:6176
- C:\Windows\System\DaVPdAl.exe
  C:\Windows\System\DaVPdAl.exe
  2⤵
  PID:6204
- C:\Windows\System\vaSMqJi.exe
  C:\Windows\System\vaSMqJi.exe
  2⤵
  PID:6232
- C:\Windows\System\XoYFnHD.exe
  C:\Windows\System\XoYFnHD.exe
  2⤵
  PID:6260
- C:\Windows\System\lXQlome.exe
  C:\Windows\System\lXQlome.exe
  2⤵
  PID:6288
- C:\Windows\System\vcVLsaq.exe
  C:\Windows\System\vcVLsaq.exe
  2⤵
  PID:6316
- C:\Windows\System\NOcAqMC.exe
  C:\Windows\System\NOcAqMC.exe
  2⤵
  PID:6344
- C:\Windows\System\eHGpsNa.exe
  C:\Windows\System\eHGpsNa.exe
  2⤵
  PID:6372
- C:\Windows\System\VzyxnvJ.exe
  C:\Windows\System\VzyxnvJ.exe
  2⤵
  PID:6400
- C:\Windows\System\GaQdCVa.exe
  C:\Windows\System\GaQdCVa.exe
  2⤵
  PID:6428
- C:\Windows\System\mqWecVj.exe
  C:\Windows\System\mqWecVj.exe
  2⤵
  PID:6456
- C:\Windows\System\Kuzckvf.exe
  C:\Windows\System\Kuzckvf.exe
  2⤵
  PID:6484
- C:\Windows\System\lSQzqXV.exe
  C:\Windows\System\lSQzqXV.exe
  2⤵
  PID:6512
- C:\Windows\System\XMXEpak.exe
  C:\Windows\System\XMXEpak.exe
  2⤵
  PID:6540
- C:\Windows\System\SAdNSdp.exe
  C:\Windows\System\SAdNSdp.exe
  2⤵
  PID:6568
- C:\Windows\System\tOwrbaq.exe
  C:\Windows\System\tOwrbaq.exe
  2⤵
  PID:6600
- C:\Windows\System\IZEzcND.exe
  C:\Windows\System\IZEzcND.exe
  2⤵
  PID:6628
- C:\Windows\System\iluLjsJ.exe
  C:\Windows\System\iluLjsJ.exe
  2⤵
  PID:6656
- C:\Windows\System\bPvOoDF.exe
  C:\Windows\System\bPvOoDF.exe
  2⤵
  PID:6684
- C:\Windows\System\hVjXVuw.exe
  C:\Windows\System\hVjXVuw.exe
  2⤵
  PID:6712
- C:\Windows\System\ltOLKzh.exe
  C:\Windows\System\ltOLKzh.exe
  2⤵
  PID:6740
- C:\Windows\System\Zybgosk.exe
  C:\Windows\System\Zybgosk.exe
  2⤵
  PID:6764
- C:\Windows\System\HNhCity.exe
  C:\Windows\System\HNhCity.exe
  2⤵
  PID:6796
- C:\Windows\System\rRBdmkH.exe
  C:\Windows\System\rRBdmkH.exe
  2⤵
  PID:6824
- C:\Windows\System\jRikGjy.exe
  C:\Windows\System\jRikGjy.exe
  2⤵
  PID:6848
- C:\Windows\System\RTXbbXK.exe
  C:\Windows\System\RTXbbXK.exe
  2⤵
  PID:6876
- C:\Windows\System\pJexABv.exe
  C:\Windows\System\pJexABv.exe
  2⤵
  PID:6904
- C:\Windows\System\SkBtxQz.exe
  C:\Windows\System\SkBtxQz.exe
  2⤵
  PID:6936
- C:\Windows\System\wquWrrt.exe
  C:\Windows\System\wquWrrt.exe
  2⤵
  PID:6964
- C:\Windows\System\FLJIiKK.exe
  C:\Windows\System\FLJIiKK.exe
  2⤵
  PID:6992
- C:\Windows\System\BMMdCct.exe
  C:\Windows\System\BMMdCct.exe
  2⤵
  PID:7016
- C:\Windows\System\ZNEIucT.exe
  C:\Windows\System\ZNEIucT.exe
  2⤵
  PID:7044
- C:\Windows\System\CrsPhjh.exe
  C:\Windows\System\CrsPhjh.exe
  2⤵
  PID:7072
- C:\Windows\System\hMHSbvI.exe
  C:\Windows\System\hMHSbvI.exe
  2⤵
  PID:7100
- C:\Windows\System\KpfRuYk.exe
  C:\Windows\System\KpfRuYk.exe
  2⤵
  PID:7132
- C:\Windows\System\HTxcGUj.exe
  C:\Windows\System\HTxcGUj.exe
  2⤵
  PID:7156
- C:\Windows\System\dXSvYxH.exe
  C:\Windows\System\dXSvYxH.exe
  2⤵
  PID:5920
- C:\Windows\System\ojpKtpC.exe
  C:\Windows\System\ojpKtpC.exe
  2⤵
  PID:6056
- C:\Windows\System\WJHNXdB.exe
  C:\Windows\System\WJHNXdB.exe
  2⤵
  PID:3940
- C:\Windows\System\rvDjQFg.exe
  C:\Windows\System\rvDjQFg.exe
  2⤵
  PID:5248
- C:\Windows\System\ZFLYIsq.exe
  C:\Windows\System\ZFLYIsq.exe
  2⤵
  PID:5528
- C:\Windows\System\vQEiSGL.exe
  C:\Windows\System\vQEiSGL.exe
  2⤵
  PID:6168
- C:\Windows\System\LDnaYdc.exe
  C:\Windows\System\LDnaYdc.exe
  2⤵
  PID:6224
- C:\Windows\System\GmpXXqp.exe
  C:\Windows\System\GmpXXqp.exe
  2⤵
  PID:6284
- C:\Windows\System\wjBnsTi.exe
  C:\Windows\System\wjBnsTi.exe
  2⤵
  PID:6340
- C:\Windows\System\WHuyicC.exe
  C:\Windows\System\WHuyicC.exe
  2⤵
  PID:6416
- C:\Windows\System\dObfJDT.exe
  C:\Windows\System\dObfJDT.exe
  2⤵
  PID:6476
- C:\Windows\System\HRQqCxJ.exe
  C:\Windows\System\HRQqCxJ.exe
  2⤵
  PID:3492
- C:\Windows\System\iMlrbsa.exe
  C:\Windows\System\iMlrbsa.exe
  2⤵
  PID:6584
- C:\Windows\System\OCWCKBQ.exe
  C:\Windows\System\OCWCKBQ.exe
  2⤵
  PID:6640
- C:\Windows\System\XpPwBPc.exe
  C:\Windows\System\XpPwBPc.exe
  2⤵
  PID:6700
- C:\Windows\System\XgeeFcE.exe
  C:\Windows\System\XgeeFcE.exe
  2⤵
  PID:6760
- C:\Windows\System\uiEpKpn.exe
  C:\Windows\System\uiEpKpn.exe
  2⤵
  PID:2804
- C:\Windows\System\sctRXcD.exe
  C:\Windows\System\sctRXcD.exe
  2⤵
  PID:6892
- C:\Windows\System\HGpcOii.exe
  C:\Windows\System\HGpcOii.exe
  2⤵
  PID:6952
- C:\Windows\System\eObGnTI.exe
  C:\Windows\System\eObGnTI.exe
  2⤵
  PID:7004
- C:\Windows\System\XkzdCHK.exe
  C:\Windows\System\XkzdCHK.exe
  2⤵
  PID:7060
- C:\Windows\System\HikNkLL.exe
  C:\Windows\System\HikNkLL.exe
  2⤵
  PID:7116
- C:\Windows\System\GbGUksA.exe
  C:\Windows\System\GbGUksA.exe
  2⤵
  PID:5864
- C:\Windows\System\ucsJnJr.exe
  C:\Windows\System\ucsJnJr.exe
  2⤵
  PID:1880
- C:\Windows\System\ftBLOCS.exe
  C:\Windows\System\ftBLOCS.exe
  2⤵
  PID:5472
- C:\Windows\System\tlAPLlM.exe
  C:\Windows\System\tlAPLlM.exe
  2⤵
  PID:6200
- C:\Windows\System\qzwMakm.exe
  C:\Windows\System\qzwMakm.exe
  2⤵
  PID:6336
- C:\Windows\System\yEWpTYR.exe
  C:\Windows\System\yEWpTYR.exe
  2⤵
  PID:6472
- C:\Windows\System\gCenrgV.exe
  C:\Windows\System\gCenrgV.exe
  2⤵
  PID:4016
- C:\Windows\System\CTNXeIN.exe
  C:\Windows\System\CTNXeIN.exe
  2⤵
  PID:6672
- C:\Windows\System\JZpIFHj.exe
  C:\Windows\System\JZpIFHj.exe
  2⤵
  PID:4832
- C:\Windows\System\DhgfdkH.exe
  C:\Windows\System\DhgfdkH.exe
  2⤵
  PID:2596
- C:\Windows\System\QdheBfz.exe
  C:\Windows\System\QdheBfz.exe
  2⤵
  PID:1092
- C:\Windows\System\xfAURGA.exe
  C:\Windows\System\xfAURGA.exe
  2⤵
  PID:436
- C:\Windows\System\IajohAm.exe
  C:\Windows\System\IajohAm.exe
  2⤵
  PID:1548
- C:\Windows\System\GmwUMgB.exe
  C:\Windows\System\GmwUMgB.exe
  2⤵
  PID:6312
- C:\Windows\System\ivKsTIZ.exe
  C:\Windows\System\ivKsTIZ.exe
  2⤵
  PID:1768
- C:\Windows\System\JMbgmwa.exe
  C:\Windows\System\JMbgmwa.exe
  2⤵
  PID:4076
- C:\Windows\System\DoxCFyd.exe
  C:\Windows\System\DoxCFyd.exe
  2⤵
  PID:2684
- C:\Windows\System\PzLUFdc.exe
  C:\Windows\System\PzLUFdc.exe
  2⤵
  PID:4928
- C:\Windows\System\XVXhbfM.exe
  C:\Windows\System\XVXhbfM.exe
  2⤵
  PID:2732
- C:\Windows\System\ivvilbc.exe
  C:\Windows\System\ivvilbc.exe
  2⤵
  PID:3484
- C:\Windows\System\SFMRZVO.exe
  C:\Windows\System\SFMRZVO.exe
  2⤵
  PID:4552
- C:\Windows\System\MMUGbXD.exe
  C:\Windows\System\MMUGbXD.exe
  2⤵
  PID:2348
- C:\Windows\System\SYBIRYi.exe
  C:\Windows\System\SYBIRYi.exe
  2⤵
  PID:7148
- C:\Windows\System\yfdZrpD.exe
  C:\Windows\System\yfdZrpD.exe
  2⤵
  PID:1196
- C:\Windows\System\AtLuFVh.exe
  C:\Windows\System\AtLuFVh.exe
  2⤵
  PID:2816
- C:\Windows\System\TjGPSgq.exe
  C:\Windows\System\TjGPSgq.exe
  2⤵
  PID:6616
- C:\Windows\System\vMaCKhL.exe
  C:\Windows\System\vMaCKhL.exe
  2⤵
  PID:3404
- C:\Windows\System\fioDzdC.exe
  C:\Windows\System\fioDzdC.exe
  2⤵
  PID:7040
- C:\Windows\System\EuQTRWc.exe
  C:\Windows\System\EuQTRWc.exe
  2⤵
  PID:4040
- C:\Windows\System\JIEpPEB.exe
  C:\Windows\System\JIEpPEB.exe
  2⤵
  PID:2004
- C:\Windows\System\JplMqdc.exe
  C:\Windows\System\JplMqdc.exe
  2⤵
  PID:6196
- C:\Windows\System\AMYmqyD.exe
  C:\Windows\System\AMYmqyD.exe
  2⤵
  PID:6928
- C:\Windows\System\jfNNOtH.exe
  C:\Windows\System\jfNNOtH.exe
  2⤵
  PID:7192
- C:\Windows\System\FmdXTJI.exe
  C:\Windows\System\FmdXTJI.exe
  2⤵
  PID:7212
- C:\Windows\System\DHnYaJF.exe
  C:\Windows\System\DHnYaJF.exe
  2⤵
  PID:7248
- C:\Windows\System\jWvWwAV.exe
  C:\Windows\System\jWvWwAV.exe
  2⤵
  PID:7268
- C:\Windows\System\xZqaoPr.exe
  C:\Windows\System\xZqaoPr.exe
  2⤵
  PID:7284
- C:\Windows\System\kcyZfvh.exe
  C:\Windows\System\kcyZfvh.exe
  2⤵
  PID:7304
- C:\Windows\System\igBuTQu.exe
  C:\Windows\System\igBuTQu.exe
  2⤵
  PID:7324
- C:\Windows\System\EIzOlvu.exe
  C:\Windows\System\EIzOlvu.exe
  2⤵
  PID:7352
- C:\Windows\System\oRKBDom.exe
  C:\Windows\System\oRKBDom.exe
  2⤵
  PID:7380
- C:\Windows\System\QTWHCBJ.exe
  C:\Windows\System\QTWHCBJ.exe
  2⤵
  PID:7408
- C:\Windows\System\NwqicCf.exe
  C:\Windows\System\NwqicCf.exe
  2⤵
  PID:7436
- C:\Windows\System\opWBARy.exe
  C:\Windows\System\opWBARy.exe
  2⤵
  PID:7492
- C:\Windows\System\pbHOEcr.exe
  C:\Windows\System\pbHOEcr.exe
  2⤵
  PID:7520
- C:\Windows\System\ioClMrY.exe
  C:\Windows\System\ioClMrY.exe
  2⤵
  PID:7540
- C:\Windows\System\KzAzpoF.exe
  C:\Windows\System\KzAzpoF.exe
  2⤵
  PID:7572
- C:\Windows\System\NrFTpmz.exe
  C:\Windows\System\NrFTpmz.exe
  2⤵
  PID:7632
- C:\Windows\System\llkQsCF.exe
  C:\Windows\System\llkQsCF.exe
  2⤵
  PID:7648
- C:\Windows\System\VvUigxy.exe
  C:\Windows\System\VvUigxy.exe
  2⤵
  PID:7672
- C:\Windows\System\yXHBJNW.exe
  C:\Windows\System\yXHBJNW.exe
  2⤵
  PID:7704
- C:\Windows\System\VXKzGYe.exe
  C:\Windows\System\VXKzGYe.exe
  2⤵
  PID:7744
- C:\Windows\System\wQFaIPM.exe
  C:\Windows\System\wQFaIPM.exe
  2⤵
  PID:7772
- C:\Windows\System\ZTerwGt.exe
  C:\Windows\System\ZTerwGt.exe
  2⤵
  PID:7800
- C:\Windows\System\vUIrrEY.exe
  C:\Windows\System\vUIrrEY.exe
  2⤵
  PID:7828
- C:\Windows\System\qKKQcBA.exe
  C:\Windows\System\qKKQcBA.exe
  2⤵
  PID:7856
- C:\Windows\System\bIDdCnB.exe
  C:\Windows\System\bIDdCnB.exe
  2⤵
  PID:7872
- C:\Windows\System\ZPzGIVI.exe
  C:\Windows\System\ZPzGIVI.exe
  2⤵
  PID:7912
- C:\Windows\System\SkmRJXE.exe
  C:\Windows\System\SkmRJXE.exe
  2⤵
  PID:7932
- C:\Windows\System\YLMGUxY.exe
  C:\Windows\System\YLMGUxY.exe
  2⤵
  PID:7956
- C:\Windows\System\UlVqTxL.exe
  C:\Windows\System\UlVqTxL.exe
  2⤵
  PID:7988
- C:\Windows\System\UejCltb.exe
  C:\Windows\System\UejCltb.exe
  2⤵
  PID:8016
- C:\Windows\System\hnsODoy.exe
  C:\Windows\System\hnsODoy.exe
  2⤵
  PID:8036
- C:\Windows\System\psBfmzo.exe
  C:\Windows\System\psBfmzo.exe
  2⤵
  PID:8080
- C:\Windows\System\CUfSwgY.exe
  C:\Windows\System\CUfSwgY.exe
  2⤵
  PID:8100
- C:\Windows\System\sWfSgDY.exe
  C:\Windows\System\sWfSgDY.exe
  2⤵
  PID:8136
- C:\Windows\System\dDOwbzb.exe
  C:\Windows\System\dDOwbzb.exe
  2⤵
  PID:8152
- C:\Windows\System\uBKdthY.exe
  C:\Windows\System\uBKdthY.exe
  2⤵
  PID:8180
- C:\Windows\System\lcNLckl.exe
  C:\Windows\System\lcNLckl.exe
  2⤵
  PID:7176
- C:\Windows\System\felAPbq.exe
  C:\Windows\System\felAPbq.exe
  2⤵
  PID:4556
- C:\Windows\System\rLJFdKj.exe
  C:\Windows\System\rLJFdKj.exe
  2⤵
  PID:7344
- C:\Windows\System\OObglTl.exe
  C:\Windows\System\OObglTl.exe
  2⤵
  PID:7368
- C:\Windows\System\raJEaKF.exe
  C:\Windows\System\raJEaKF.exe
  2⤵
  PID:7464
- C:\Windows\System\UHKvNQY.exe
  C:\Windows\System\UHKvNQY.exe
  2⤵
  PID:7500
- C:\Windows\System\RGTmUFK.exe
  C:\Windows\System\RGTmUFK.exe
  2⤵
  PID:7556
- C:\Windows\System\rRTxLuf.exe
  C:\Windows\System\rRTxLuf.exe
  2⤵
  PID:7616
- C:\Windows\System\puIiAaz.exe
  C:\Windows\System\puIiAaz.exe
  2⤵
  PID:7668
- C:\Windows\System\dozjNMV.exe
  C:\Windows\System\dozjNMV.exe
  2⤵
  PID:7736
- C:\Windows\System\bTMkmoi.exe
  C:\Windows\System\bTMkmoi.exe
  2⤵
  PID:7796
- C:\Windows\System\JqnsRVq.exe
  C:\Windows\System\JqnsRVq.exe
  2⤵
  PID:7864
- C:\Windows\System\vqQrQrt.exe
  C:\Windows\System\vqQrQrt.exe
  2⤵
  PID:7908
- C:\Windows\System\JwEBKiu.exe
  C:\Windows\System\JwEBKiu.exe
  2⤵
  PID:8024
- C:\Windows\System\RGdrxwB.exe
  C:\Windows\System\RGdrxwB.exe
  2⤵
  PID:8096
- C:\Windows\System\TYszqqx.exe
  C:\Windows\System\TYszqqx.exe
  2⤵
  PID:8132
- C:\Windows\System\vjJTbjo.exe
  C:\Windows\System\vjJTbjo.exe
  2⤵
  PID:8168
- C:\Windows\System\rGUpLRa.exe
  C:\Windows\System\rGUpLRa.exe
  2⤵
  PID:7256
- C:\Windows\System\VtjHdNN.exe
  C:\Windows\System\VtjHdNN.exe
  2⤵
  PID:7420
- C:\Windows\System\jdmwvYh.exe
  C:\Windows\System\jdmwvYh.exe
  2⤵
  PID:7548
- C:\Windows\System\cqrHwxY.exe
  C:\Windows\System\cqrHwxY.exe
  2⤵
  PID:7760
- C:\Windows\System\qFsoDsN.exe
  C:\Windows\System\qFsoDsN.exe
  2⤵
  PID:7840
- C:\Windows\System\hpuozcO.exe
  C:\Windows\System\hpuozcO.exe
  2⤵
  PID:8000
- C:\Windows\System\QwiGTOK.exe
  C:\Windows\System\QwiGTOK.exe
  2⤵
  PID:4404
- C:\Windows\System\xnIKbJS.exe
  C:\Windows\System\xnIKbJS.exe
  2⤵
  PID:7348
- C:\Windows\System\vNwEZUJ.exe
  C:\Windows\System\vNwEZUJ.exe
  2⤵
  PID:7696
- C:\Windows\System\IODmNpb.exe
  C:\Windows\System\IODmNpb.exe
  2⤵
  PID:7928
- C:\Windows\System\kajjsLE.exe
  C:\Windows\System\kajjsLE.exe
  2⤵
  PID:8144
- C:\Windows\System\tjoGdaK.exe
  C:\Windows\System\tjoGdaK.exe
  2⤵
  PID:8064
- C:\Windows\System\WUHvIfQ.exe
  C:\Windows\System\WUHvIfQ.exe
  2⤵
  PID:8164
- C:\Windows\System\ZWNBDoA.exe
  C:\Windows\System\ZWNBDoA.exe
  2⤵
  PID:8208
- C:\Windows\System\DTAAKqa.exe
  C:\Windows\System\DTAAKqa.exe
  2⤵
  PID:8248
- C:\Windows\System\DmqkyYa.exe
  C:\Windows\System\DmqkyYa.exe
  2⤵
  PID:8264
- C:\Windows\System\bSkemSN.exe
  C:\Windows\System\bSkemSN.exe
  2⤵
  PID:8292
- C:\Windows\System\LpIrYDU.exe
  C:\Windows\System\LpIrYDU.exe
  2⤵
  PID:8308
- C:\Windows\System\VdStXNo.exe
  C:\Windows\System\VdStXNo.exe
  2⤵
  PID:8336
- C:\Windows\System\ZcdxsKJ.exe
  C:\Windows\System\ZcdxsKJ.exe
  2⤵
  PID:8364
- C:\Windows\System\OrlzckI.exe
  C:\Windows\System\OrlzckI.exe
  2⤵
  PID:8392
- C:\Windows\System\gMioFcF.exe
  C:\Windows\System\gMioFcF.exe
  2⤵
  PID:8412
- C:\Windows\System\nKvgJWx.exe
  C:\Windows\System\nKvgJWx.exe
  2⤵
  PID:8440
- C:\Windows\System\WzBIAat.exe
  C:\Windows\System\WzBIAat.exe
  2⤵
  PID:8472
- C:\Windows\System\xbEIdtW.exe
  C:\Windows\System\xbEIdtW.exe
  2⤵
  PID:8500
- C:\Windows\System\UuvAuDA.exe
  C:\Windows\System\UuvAuDA.exe
  2⤵
  PID:8536
- C:\Windows\System\vOBvEhM.exe
  C:\Windows\System\vOBvEhM.exe
  2⤵
  PID:8556
- C:\Windows\System\PmBuNIU.exe
  C:\Windows\System\PmBuNIU.exe
  2⤵
  PID:8592
- C:\Windows\System\WwoeYYf.exe
  C:\Windows\System\WwoeYYf.exe
  2⤵
  PID:8648
- C:\Windows\System\viSfHYF.exe
  C:\Windows\System\viSfHYF.exe
  2⤵
  PID:8664
- C:\Windows\System\qyrcksJ.exe
  C:\Windows\System\qyrcksJ.exe
  2⤵
  PID:8692
- C:\Windows\System\UelGGHe.exe
  C:\Windows\System\UelGGHe.exe
  2⤵
  PID:8720
- C:\Windows\System\JgAfHAD.exe
  C:\Windows\System\JgAfHAD.exe
  2⤵
  PID:8748
- C:\Windows\System\EhlwvHX.exe
  C:\Windows\System\EhlwvHX.exe
  2⤵
  PID:8776
- C:\Windows\System\QbIQpoE.exe
  C:\Windows\System\QbIQpoE.exe
  2⤵
  PID:8804
- C:\Windows\System\bfshZZM.exe
  C:\Windows\System\bfshZZM.exe
  2⤵
  PID:8836
- C:\Windows\System\pgikuxF.exe
  C:\Windows\System\pgikuxF.exe
  2⤵
  PID:8864
- C:\Windows\System\NwoBsuL.exe
  C:\Windows\System\NwoBsuL.exe
  2⤵
  PID:8880
- C:\Windows\System\fZgGPfH.exe
  C:\Windows\System\fZgGPfH.exe
  2⤵
  PID:8924
- C:\Windows\System\ikHauwr.exe
  C:\Windows\System\ikHauwr.exe
  2⤵
  PID:8948
- C:\Windows\System\FNDFUkM.exe
  C:\Windows\System\FNDFUkM.exe
  2⤵
  PID:8988
- C:\Windows\System\USWgYDf.exe
  C:\Windows\System\USWgYDf.exe
  2⤵
  PID:9016
- C:\Windows\System\vSTKjdR.exe
  C:\Windows\System\vSTKjdR.exe
  2⤵
  PID:9044
- C:\Windows\System\xvUUStl.exe
  C:\Windows\System\xvUUStl.exe
  2⤵
  PID:9072
- C:\Windows\System\jwpMtXA.exe
  C:\Windows\System\jwpMtXA.exe
  2⤵
  PID:9096
- C:\Windows\System\rgcxQkX.exe
  C:\Windows\System\rgcxQkX.exe
  2⤵
  PID:9120
- C:\Windows\System\KXjjIiy.exe
  C:\Windows\System\KXjjIiy.exe
  2⤵
  PID:9144
- C:\Windows\System\xmUUZzL.exe
  C:\Windows\System\xmUUZzL.exe
  2⤵
  PID:9176
- C:\Windows\System\owmugmd.exe
  C:\Windows\System\owmugmd.exe
  2⤵
  PID:9200
- C:\Windows\System\rJbdFOp.exe
  C:\Windows\System\rJbdFOp.exe
  2⤵
  PID:8240
- C:\Windows\System\vlOEEUS.exe
  C:\Windows\System\vlOEEUS.exe
  2⤵
  PID:8260
- C:\Windows\System\beQXweq.exe
  C:\Windows\System\beQXweq.exe
  2⤵
  PID:8352
- C:\Windows\System\DufINzt.exe
  C:\Windows\System\DufINzt.exe
  2⤵
  PID:4472
- C:\Windows\System\eNNGgnI.exe
  C:\Windows\System\eNNGgnI.exe
  2⤵
  PID:4464
- C:\Windows\System\MxzSqYM.exe
  C:\Windows\System\MxzSqYM.exe
  2⤵
  PID:8436
- C:\Windows\System\eUPZRzD.exe
  C:\Windows\System\eUPZRzD.exe
  2⤵
  PID:8464
- C:\Windows\System\DQuxnxo.exe
  C:\Windows\System\DQuxnxo.exe
  2⤵
  PID:8568
- C:\Windows\System\GUQpRiT.exe
  C:\Windows\System\GUQpRiT.exe
  2⤵
  PID:8632
- C:\Windows\System\uxyuLVL.exe
  C:\Windows\System\uxyuLVL.exe
  2⤵
  PID:8740
- C:\Windows\System\OKDnMBv.exe
  C:\Windows\System\OKDnMBv.exe
  2⤵
  PID:8816
- C:\Windows\System\kVYMhOr.exe
  C:\Windows\System\kVYMhOr.exe
  2⤵
  PID:8900
- C:\Windows\System\ZfwJbSd.exe
  C:\Windows\System\ZfwJbSd.exe
  2⤵
  PID:8984
- C:\Windows\System\UwojdRN.exe
  C:\Windows\System\UwojdRN.exe
  2⤵
  PID:9008
- C:\Windows\System\NOpiJLO.exe
  C:\Windows\System\NOpiJLO.exe
  2⤵
  PID:9056
- C:\Windows\System\eKYLIwo.exe
  C:\Windows\System\eKYLIwo.exe
  2⤵
  PID:9136
- C:\Windows\System\ZCvDMKA.exe
  C:\Windows\System\ZCvDMKA.exe
  2⤵
  PID:8204
- C:\Windows\System\WIxAqKP.exe
  C:\Windows\System\WIxAqKP.exe
  2⤵
  PID:8304
- C:\Windows\System\EGEnHoU.exe
  C:\Windows\System\EGEnHoU.exe
  2⤵
  PID:8452
- C:\Windows\System\msEHOAY.exe
  C:\Windows\System\msEHOAY.exe
  2⤵
  PID:8584
- C:\Windows\System\FVJehPs.exe
  C:\Windows\System\FVJehPs.exe
  2⤵
  PID:8872
- C:\Windows\System\pVzopMI.exe
  C:\Windows\System\pVzopMI.exe
  2⤵
  PID:8964
- C:\Windows\System\EgvPEmh.exe
  C:\Windows\System\EgvPEmh.exe
  2⤵
  PID:9116
- C:\Windows\System\DBYEJQA.exe
  C:\Windows\System\DBYEJQA.exe
  2⤵
  PID:8284
- C:\Windows\System\cHilIjX.exe
  C:\Windows\System\cHilIjX.exe
  2⤵
  PID:8524
- C:\Windows\System\moYBFjK.exe
  C:\Windows\System\moYBFjK.exe
  2⤵
  PID:9084
- C:\Windows\System\OqPFdfG.exe
  C:\Windows\System\OqPFdfG.exe
  2⤵
  PID:9196
- C:\Windows\System\zmAgEFZ.exe
  C:\Windows\System\zmAgEFZ.exe
  2⤵
  PID:9032
- C:\Windows\System\ConFdTB.exe
  C:\Windows\System\ConFdTB.exe
  2⤵
  PID:9236
- C:\Windows\System\TyWGyFV.exe
  C:\Windows\System\TyWGyFV.exe
  2⤵
  PID:9276
- C:\Windows\System\VAYryVl.exe
  C:\Windows\System\VAYryVl.exe
  2⤵
  PID:9292
- C:\Windows\System\ZDaiaBj.exe
  C:\Windows\System\ZDaiaBj.exe
  2⤵
  PID:9308
- C:\Windows\System\iDhWYJu.exe
  C:\Windows\System\iDhWYJu.exe
  2⤵
  PID:9360
- C:\Windows\System\zCXJDee.exe
  C:\Windows\System\zCXJDee.exe
  2⤵
  PID:9388
- C:\Windows\System\hldsnvX.exe
  C:\Windows\System\hldsnvX.exe
  2⤵
  PID:9404
- C:\Windows\System\dgruCmT.exe
  C:\Windows\System\dgruCmT.exe
  2⤵
  PID:9420
- C:\Windows\System\vyqmgmi.exe
  C:\Windows\System\vyqmgmi.exe
  2⤵
  PID:9444
- C:\Windows\System\ByByCfx.exe
  C:\Windows\System\ByByCfx.exe
  2⤵
  PID:9480
- C:\Windows\System\kuWdTqs.exe
  C:\Windows\System\kuWdTqs.exe
  2⤵
  PID:9496
- C:\Windows\System\WtjyUEp.exe
  C:\Windows\System\WtjyUEp.exe
  2⤵
  PID:9520
- C:\Windows\System\oioHuIn.exe
  C:\Windows\System\oioHuIn.exe
  2⤵
  PID:9540
- C:\Windows\System\jdnDqqo.exe
  C:\Windows\System\jdnDqqo.exe
  2⤵
  PID:9576
- C:\Windows\System\QeKIcal.exe
  C:\Windows\System\QeKIcal.exe
  2⤵
  PID:9596
- C:\Windows\System\PCDsfRx.exe
  C:\Windows\System\PCDsfRx.exe
  2⤵
  PID:9624
- C:\Windows\System\XIgUygl.exe
  C:\Windows\System\XIgUygl.exe
  2⤵
  PID:9648
- C:\Windows\System\GfAVDCe.exe
  C:\Windows\System\GfAVDCe.exe
  2⤵
  PID:9668
- C:\Windows\System\spAQUhA.exe
  C:\Windows\System\spAQUhA.exe
  2⤵
  PID:9728
- C:\Windows\System\lguvrXU.exe
  C:\Windows\System\lguvrXU.exe
  2⤵
  PID:9760
- C:\Windows\System\bnNTKdK.exe
  C:\Windows\System\bnNTKdK.exe
  2⤵
  PID:9784
- C:\Windows\System\HBphdhg.exe
  C:\Windows\System\HBphdhg.exe
  2⤵
  PID:9808
- C:\Windows\System\qsoVFve.exe
  C:\Windows\System\qsoVFve.exe
  2⤵
  PID:9844
- C:\Windows\System\BpzIvIS.exe
  C:\Windows\System\BpzIvIS.exe
  2⤵
  PID:9880
- C:\Windows\System\nDGdJqE.exe
  C:\Windows\System\nDGdJqE.exe
  2⤵
  PID:9904
- C:\Windows\System\JhPuPyg.exe
  C:\Windows\System\JhPuPyg.exe
  2⤵
  PID:9932
- C:\Windows\System\KwzAlRI.exe
  C:\Windows\System\KwzAlRI.exe
  2⤵
  PID:9952
- C:\Windows\System\xrfUITA.exe
  C:\Windows\System\xrfUITA.exe
  2⤵
  PID:10000
- C:\Windows\System\tRTgkdZ.exe
  C:\Windows\System\tRTgkdZ.exe
  2⤵
  PID:10032
- C:\Windows\System\PgjswCH.exe
  C:\Windows\System\PgjswCH.exe
  2⤵
  PID:10048
- C:\Windows\System\AJlKkud.exe
  C:\Windows\System\AJlKkud.exe
  2⤵
  PID:10064
- C:\Windows\System\uHUgJlh.exe
  C:\Windows\System\uHUgJlh.exe
  2⤵
  PID:10104
- C:\Windows\System\fDOJzaB.exe
  C:\Windows\System\fDOJzaB.exe
  2⤵
  PID:10132
- C:\Windows\System\dsxBITr.exe
  C:\Windows\System\dsxBITr.exe
  2⤵
  PID:10172
- C:\Windows\System\mkFGhxe.exe
  C:\Windows\System\mkFGhxe.exe
  2⤵
  PID:10196
- C:\Windows\System\bAuEKWO.exe
  C:\Windows\System\bAuEKWO.exe
  2⤵
  PID:10216
- C:\Windows\System\kAbSUWX.exe
  C:\Windows\System\kAbSUWX.exe
  2⤵
  PID:10232
- C:\Windows\System\FYAkDEm.exe
  C:\Windows\System\FYAkDEm.exe
  2⤵
  PID:9224
- C:\Windows\System\LFwKTCx.exe
  C:\Windows\System\LFwKTCx.exe
  2⤵
  PID:9232
- C:\Windows\System\bJpMhIq.exe
  C:\Windows\System\bJpMhIq.exe
  2⤵
  PID:9324
- C:\Windows\System\mPjutVL.exe
  C:\Windows\System\mPjutVL.exe
  2⤵
  PID:9372
- C:\Windows\System\MceGCxY.exe
  C:\Windows\System\MceGCxY.exe
  2⤵
  PID:9492
- C:\Windows\System\smBiSPg.exe
  C:\Windows\System\smBiSPg.exe
  2⤵
  PID:9528
- C:\Windows\System\AAFLimJ.exe
  C:\Windows\System\AAFLimJ.exe
  2⤵
  PID:9612
- C:\Windows\System\SympvbN.exe
  C:\Windows\System\SympvbN.exe
  2⤵
  PID:9656
- C:\Windows\System\dNfiUkH.exe
  C:\Windows\System\dNfiUkH.exe
  2⤵
  PID:9736
- C:\Windows\System\glWaJnz.exe
  C:\Windows\System\glWaJnz.exe
  2⤵
  PID:9804
- C:\Windows\System\IzyJAoF.exe
  C:\Windows\System\IzyJAoF.exe
  2⤵
  PID:9872
- C:\Windows\System\oNDCrwK.exe
  C:\Windows\System\oNDCrwK.exe
  2⤵
  PID:9940
- C:\Windows\System\kPRsMov.exe
  C:\Windows\System\kPRsMov.exe
  2⤵
  PID:9992
- C:\Windows\System\ltKnSTA.exe
  C:\Windows\System\ltKnSTA.exe
  2⤵
  PID:10060
- C:\Windows\System\nlAVzHX.exe
  C:\Windows\System\nlAVzHX.exe
  2⤵
  PID:10184
- C:\Windows\System\KzOwvEP.exe
  C:\Windows\System\KzOwvEP.exe
  2⤵
  PID:10228
- C:\Windows\System\ZcnuILq.exe
  C:\Windows\System\ZcnuILq.exe
  2⤵
  PID:9288
- C:\Windows\System\GANPnVW.exe
  C:\Windows\System\GANPnVW.exe
  2⤵
  PID:9560
- C:\Windows\System\XkKrZRH.exe
  C:\Windows\System\XkKrZRH.exe
  2⤵
  PID:9592
- C:\Windows\System\FoJrYbU.exe
  C:\Windows\System\FoJrYbU.exe
  2⤵
  PID:9800
- C:\Windows\System\AlFqvjM.exe
  C:\Windows\System\AlFqvjM.exe
  2⤵
  PID:9820
- C:\Windows\System\weQxdbb.exe
  C:\Windows\System\weQxdbb.exe
  2⤵
  PID:9964
- C:\Windows\System\bYgidGw.exe
  C:\Windows\System\bYgidGw.exe
  2⤵
  PID:10168
- C:\Windows\System\dlEZxJi.exe
  C:\Windows\System\dlEZxJi.exe
  2⤵
  PID:9304
- C:\Windows\System\ADwaplT.exe
  C:\Windows\System\ADwaplT.exe
  2⤵
  PID:1200
- C:\Windows\System\eHXJjMV.exe
  C:\Windows\System\eHXJjMV.exe
  2⤵
  PID:9900
- C:\Windows\System\JKiDgwx.exe
  C:\Windows\System\JKiDgwx.exe
  2⤵
  PID:4388
- C:\Windows\System\qhgFgIw.exe
  C:\Windows\System\qhgFgIw.exe
  2⤵
  PID:9088
- C:\Windows\System\mRUnLBD.exe
  C:\Windows\System\mRUnLBD.exe
  2⤵
  PID:10252
- C:\Windows\System\VCUtCbE.exe
  C:\Windows\System\VCUtCbE.exe
  2⤵
  PID:10268
- C:\Windows\System\CfouKJf.exe
  C:\Windows\System\CfouKJf.exe
  2⤵
  PID:10308
- C:\Windows\System\BmEabJk.exe
  C:\Windows\System\BmEabJk.exe
  2⤵
  PID:10332
- C:\Windows\System\aEqyzFp.exe
  C:\Windows\System\aEqyzFp.exe
  2⤵
  PID:10356
- C:\Windows\System\gBASqOH.exe
  C:\Windows\System\gBASqOH.exe
  2⤵
  PID:10380
- C:\Windows\System\VGKWWmG.exe
  C:\Windows\System\VGKWWmG.exe
  2⤵
  PID:10408
- C:\Windows\System\kPqDDNs.exe
  C:\Windows\System\kPqDDNs.exe
  2⤵
  PID:10432
- C:\Windows\System\XQiIlFg.exe
  C:\Windows\System\XQiIlFg.exe
  2⤵
  PID:10460
- C:\Windows\System\rnUWBRn.exe
  C:\Windows\System\rnUWBRn.exe
  2⤵
  PID:10492
- C:\Windows\System\jBWnAzH.exe
  C:\Windows\System\jBWnAzH.exe
  2⤵
  PID:10520
- C:\Windows\System\ESzrBRH.exe
  C:\Windows\System\ESzrBRH.exe
  2⤵
  PID:10548
- C:\Windows\System\MtXWDSV.exe
  C:\Windows\System\MtXWDSV.exe
  2⤵
  PID:10576
- C:\Windows\System\fMcJPFE.exe
  C:\Windows\System\fMcJPFE.exe
  2⤵
  PID:10600
- C:\Windows\System\CdUHpIX.exe
  C:\Windows\System\CdUHpIX.exe
  2⤵
  PID:10636
- C:\Windows\System\OgnNqwk.exe
  C:\Windows\System\OgnNqwk.exe
  2⤵
  PID:10660
- C:\Windows\System\CPMNkbF.exe
  C:\Windows\System\CPMNkbF.exe
  2⤵
  PID:10684
- C:\Windows\System\qFoQEZe.exe
  C:\Windows\System\qFoQEZe.exe
  2⤵
  PID:10724
- C:\Windows\System\EmkjoaO.exe
  C:\Windows\System\EmkjoaO.exe
  2⤵
  PID:10760
- C:\Windows\System\zcjvLFl.exe
  C:\Windows\System\zcjvLFl.exe
  2⤵
  PID:10788
- C:\Windows\System\AXDYFNc.exe
  C:\Windows\System\AXDYFNc.exe
  2⤵
  PID:10808
- C:\Windows\System\EnJUOta.exe
  C:\Windows\System\EnJUOta.exe
  2⤵
  PID:10840
- C:\Windows\System\frGdsBr.exe
  C:\Windows\System\frGdsBr.exe
  2⤵
  PID:10888
- C:\Windows\System\EhskPmb.exe
  C:\Windows\System\EhskPmb.exe
  2⤵
  PID:10908
- C:\Windows\System\yYfOgBf.exe
  C:\Windows\System\yYfOgBf.exe
  2⤵
  PID:10932
- C:\Windows\System\CkBDDks.exe
  C:\Windows\System\CkBDDks.exe
  2⤵
  PID:10960
- C:\Windows\System\VTbqpah.exe
  C:\Windows\System\VTbqpah.exe
  2⤵
  PID:11000
- C:\Windows\System\bShNLeS.exe
  C:\Windows\System\bShNLeS.exe
  2⤵
  PID:11016
- C:\Windows\System\somPvqU.exe
  C:\Windows\System\somPvqU.exe
  2⤵
  PID:11044
- C:\Windows\System\dazDEcu.exe
  C:\Windows\System\dazDEcu.exe
  2⤵
  PID:11072
- C:\Windows\System\LvGqMeO.exe
  C:\Windows\System\LvGqMeO.exe
  2⤵
  PID:11096
- C:\Windows\System\zNLJOkB.exe
  C:\Windows\System\zNLJOkB.exe
  2⤵
  PID:11128
- C:\Windows\System\IEXSixx.exe
  C:\Windows\System\IEXSixx.exe
  2⤵
  PID:11148
- C:\Windows\System\ADMuIFd.exe
  C:\Windows\System\ADMuIFd.exe
  2⤵
  PID:11176
- C:\Windows\System\WfSiaDx.exe
  C:\Windows\System\WfSiaDx.exe
  2⤵
  PID:11208
- C:\Windows\System\iThdjvd.exe
  C:\Windows\System\iThdjvd.exe
  2⤵
  PID:11232
- C:\Windows\System\FoMHQLm.exe
  C:\Windows\System\FoMHQLm.exe
  2⤵
  PID:11256
- C:\Windows\System\myrEIfK.exe
  C:\Windows\System\myrEIfK.exe
  2⤵
  PID:10340
- C:\Windows\System\ENukXor.exe
  C:\Windows\System\ENukXor.exe
  2⤵
  PID:10372
- C:\Windows\System\JThhbRF.exe
  C:\Windows\System\JThhbRF.exe
  2⤵
  PID:10476
- C:\Windows\System\zuWusUx.exe
  C:\Windows\System\zuWusUx.exe
  2⤵
  PID:10536
- C:\Windows\System\oYsxSNg.exe
  C:\Windows\System\oYsxSNg.exe
  2⤵
  PID:10596
- C:\Windows\System\UhMkikM.exe
  C:\Windows\System\UhMkikM.exe
  2⤵
  PID:10700
- C:\Windows\System\vxayjGm.exe
  C:\Windows\System\vxayjGm.exe
  2⤵
  PID:10732
- C:\Windows\System\cyanlhQ.exe
  C:\Windows\System\cyanlhQ.exe
  2⤵
  PID:10828
- C:\Windows\System\ZWqNTiV.exe
  C:\Windows\System\ZWqNTiV.exe
  2⤵
  PID:10904
- C:\Windows\System\VGyTqBP.exe
  C:\Windows\System\VGyTqBP.exe
  2⤵
  PID:10988
- C:\Windows\System\HLqvEOi.exe
  C:\Windows\System\HLqvEOi.exe
  2⤵
  PID:11028
- C:\Windows\System\jMqoNAr.exe
  C:\Windows\System\jMqoNAr.exe
  2⤵
  PID:11116
- C:\Windows\System\BpKmWsa.exe
  C:\Windows\System\BpKmWsa.exe
  2⤵
  PID:11120
- C:\Windows\System\XuVTuit.exe
  C:\Windows\System\XuVTuit.exe
  2⤵
  PID:11220
- C:\Windows\System\ZyLgISC.exe
  C:\Windows\System\ZyLgISC.exe
  2⤵
  PID:9856
- C:\Windows\System\ywWCRDg.exe
  C:\Windows\System\ywWCRDg.exe
  2⤵
  PID:10624
- C:\Windows\System\HFJOlBP.exe
  C:\Windows\System\HFJOlBP.exe
  2⤵
  PID:10680
- C:\Windows\System\NkWWXSC.exe
  C:\Windows\System\NkWWXSC.exe
  2⤵
  PID:10944
- C:\Windows\System\oNOUZba.exe
  C:\Windows\System\oNOUZba.exe
  2⤵
  PID:11088
- C:\Windows\System\LPCorja.exe
  C:\Windows\System\LPCorja.exe
  2⤵
  PID:11168
- C:\Windows\System\ZJnlYKO.exe
  C:\Windows\System\ZJnlYKO.exe
  2⤵
  PID:10400
- C:\Windows\System\CWYFSwv.exe
  C:\Windows\System\CWYFSwv.exe
  2⤵
  PID:11188
- C:\Windows\System\vnvgdxh.exe
  C:\Windows\System\vnvgdxh.exe
  2⤵
  PID:11056
- C:\Windows\System\YrtfsKR.exe
  C:\Windows\System\YrtfsKR.exe
  2⤵
  PID:10796
- C:\Windows\System\dzKkVvx.exe
  C:\Windows\System\dzKkVvx.exe
  2⤵
  PID:11284
- C:\Windows\System\dWDwDDW.exe
  C:\Windows\System\dWDwDDW.exe
  2⤵
  PID:11352
- C:\Windows\System\GwCtMkF.exe
  C:\Windows\System\GwCtMkF.exe
  2⤵
  PID:11368
- C:\Windows\System\ACmsJtz.exe
  C:\Windows\System\ACmsJtz.exe
  2⤵
  PID:11388
- C:\Windows\System\yhqEEZH.exe
  C:\Windows\System\yhqEEZH.exe
  2⤵
  PID:11408
- C:\Windows\System\WFndwmt.exe
  C:\Windows\System\WFndwmt.exe
  2⤵
  PID:11452
- C:\Windows\System\uCZExIS.exe
  C:\Windows\System\uCZExIS.exe
  2⤵
  PID:11492
- C:\Windows\System\yyfuSzf.exe
  C:\Windows\System\yyfuSzf.exe
  2⤵
  PID:11516
- C:\Windows\System\fIYsTFC.exe
  C:\Windows\System\fIYsTFC.exe
  2⤵
  PID:11540
- C:\Windows\System\SoMzqZR.exe
  C:\Windows\System\SoMzqZR.exe
  2⤵
  PID:11568
- C:\Windows\System\tvqEckh.exe
  C:\Windows\System\tvqEckh.exe
  2⤵
  PID:11592
- C:\Windows\System\nlMCRkk.exe
  C:\Windows\System\nlMCRkk.exe
  2⤵
  PID:11620
- C:\Windows\System\vHVKzLN.exe
  C:\Windows\System\vHVKzLN.exe
  2⤵
  PID:11640
- C:\Windows\System\HghpgLI.exe
  C:\Windows\System\HghpgLI.exe
  2⤵
  PID:11676
- C:\Windows\System\irAFcTy.exe
  C:\Windows\System\irAFcTy.exe
  2⤵
  PID:11704
- C:\Windows\System\FqhaDwd.exe
  C:\Windows\System\FqhaDwd.exe
  2⤵
  PID:11728
- C:\Windows\System\OoBSEIh.exe
  C:\Windows\System\OoBSEIh.exe
  2⤵
  PID:11756
- C:\Windows\System\iYckLDB.exe
  C:\Windows\System\iYckLDB.exe
  2⤵
  PID:11796
- C:\Windows\System\InyykBk.exe
  C:\Windows\System\InyykBk.exe
  2⤵
  PID:11840
- C:\Windows\System\YqFktKq.exe
  C:\Windows\System\YqFktKq.exe
  2⤵
  PID:11868
- C:\Windows\System\txTtTUw.exe
  C:\Windows\System\txTtTUw.exe
  2⤵
  PID:11896
- C:\Windows\System\OnePyyv.exe
  C:\Windows\System\OnePyyv.exe
  2⤵
  PID:11912
- C:\Windows\System\kTWiEIc.exe
  C:\Windows\System\kTWiEIc.exe
  2⤵
  PID:11940
- C:\Windows\System\BBEFwAV.exe
  C:\Windows\System\BBEFwAV.exe
  2⤵
  PID:11956
- C:\Windows\System\VmCPQJv.exe
  C:\Windows\System\VmCPQJv.exe
  2⤵
  PID:12008
- C:\Windows\System\dtPczRI.exe
  C:\Windows\System\dtPczRI.exe
  2⤵
  PID:12028
- C:\Windows\System\QKajmnc.exe
  C:\Windows\System\QKajmnc.exe
  2⤵
  PID:12052
- C:\Windows\System\rGfiDxo.exe
  C:\Windows\System\rGfiDxo.exe
  2⤵
  PID:12092
- C:\Windows\System\gpFsYvN.exe
  C:\Windows\System\gpFsYvN.exe
  2⤵
  PID:12112
- C:\Windows\System\jSPFLPt.exe
  C:\Windows\System\jSPFLPt.exe
  2⤵
  PID:12136
- C:\Windows\System\OuiFxZr.exe
  C:\Windows\System\OuiFxZr.exe
  2⤵
  PID:12156
- C:\Windows\System\qwKrqgG.exe
  C:\Windows\System\qwKrqgG.exe
  2⤵
  PID:12184
- C:\Windows\System\idEYFvu.exe
  C:\Windows\System\idEYFvu.exe
  2⤵
  PID:12208
- C:\Windows\System\lDpCzCn.exe
  C:\Windows\System\lDpCzCn.exe
  2⤵
  PID:12232
- C:\Windows\System\yuZNHnA.exe
  C:\Windows\System\yuZNHnA.exe
  2⤵
  PID:12272
- C:\Windows\System\JipuZUS.exe
  C:\Windows\System\JipuZUS.exe
  2⤵
  PID:11012
- C:\Windows\System\jSdkuYY.exe
  C:\Windows\System\jSdkuYY.exe
  2⤵
  PID:11364
- C:\Windows\System\UkWPSkW.exe
  C:\Windows\System\UkWPSkW.exe
  2⤵
  PID:11396
- C:\Windows\System\lTeiRAP.exe
  C:\Windows\System\lTeiRAP.exe
  2⤵
  PID:11476
- C:\Windows\System\xxSzIQf.exe
  C:\Windows\System\xxSzIQf.exe
  2⤵
  PID:11488
- C:\Windows\System\kSPyxgG.exe
  C:\Windows\System\kSPyxgG.exe
  2⤵
  PID:11564
- C:\Windows\System\uSkToCU.exe
  C:\Windows\System\uSkToCU.exe
  2⤵
  PID:11612
- C:\Windows\System\jbrMatw.exe
  C:\Windows\System\jbrMatw.exe
  2⤵
  PID:11724
- C:\Windows\System\RCBBCel.exe
  C:\Windows\System\RCBBCel.exe
  2⤵
  PID:11812
- C:\Windows\System\hYeJBat.exe
  C:\Windows\System\hYeJBat.exe
  2⤵
  PID:11836
- C:\Windows\System\HSPJDGV.exe
  C:\Windows\System\HSPJDGV.exe
  2⤵
  PID:11952
- C:\Windows\System\hQAIvcb.exe
  C:\Windows\System\hQAIvcb.exe
  2⤵
  PID:11988
- C:\Windows\System\ATnaEVp.exe
  C:\Windows\System\ATnaEVp.exe
  2⤵
  PID:12040
- C:\Windows\System\KmOEqmB.exe
  C:\Windows\System\KmOEqmB.exe
  2⤵
  PID:12100
- C:\Windows\System\QywnHBF.exe
  C:\Windows\System\QywnHBF.exe
  2⤵
  PID:12172
- C:\Windows\System\JnZjeRn.exe
  C:\Windows\System\JnZjeRn.exe
  2⤵
  PID:12224
- C:\Windows\System\FoPTLdO.exe
  C:\Windows\System\FoPTLdO.exe
  2⤵
  PID:12264
- C:\Windows\System\jqwmJFc.exe
  C:\Windows\System\jqwmJFc.exe
  2⤵
  PID:11348
- C:\Windows\System\TudsLnJ.exe
  C:\Windows\System\TudsLnJ.exe
  2⤵
  PID:11584
- C:\Windows\System\kpuFYiV.exe
  C:\Windows\System\kpuFYiV.exe
  2⤵
  PID:11784
- C:\Windows\System\wJIQRxP.exe
  C:\Windows\System\wJIQRxP.exe
  2⤵
  PID:11908
- C:\Windows\System\cdCBrXa.exe
  C:\Windows\System\cdCBrXa.exe
  2⤵
  PID:12024
- C:\Windows\System\QUAVQZd.exe
  C:\Windows\System\QUAVQZd.exe
  2⤵
  PID:12228
- C:\Windows\System\qUGJugf.exe
  C:\Windows\System\qUGJugf.exe
  2⤵
  PID:11272
- C:\Windows\System\lQwNsHC.exe
  C:\Windows\System\lQwNsHC.exe
  2⤵
  PID:11536
- C:\Windows\System\DMlLvnd.exe
  C:\Windows\System\DMlLvnd.exe
  2⤵
  PID:11968
- C:\Windows\System\IygbRmc.exe
  C:\Windows\System\IygbRmc.exe
  2⤵
  PID:11268
- C:\Windows\System\WfJoxgd.exe
  C:\Windows\System\WfJoxgd.exe
  2⤵
  PID:12248
- C:\Windows\System\gntvGRz.exe
  C:\Windows\System\gntvGRz.exe
  2⤵
  PID:12308
- C:\Windows\System\weualdw.exe
  C:\Windows\System\weualdw.exe
  2⤵
  PID:12328
- C:\Windows\System\Zmdmkcv.exe
  C:\Windows\System\Zmdmkcv.exe
  2⤵
  PID:12352
- C:\Windows\System\oGQQiuF.exe
  C:\Windows\System\oGQQiuF.exe
  2⤵
  PID:12372
- C:\Windows\System\VtYEYiI.exe
  C:\Windows\System\VtYEYiI.exe
  2⤵
  PID:12396
- C:\Windows\System\ABmQKhS.exe
  C:\Windows\System\ABmQKhS.exe
  2⤵
  PID:12432
- C:\Windows\System\iNZQjbJ.exe
  C:\Windows\System\iNZQjbJ.exe
  2⤵
  PID:12468
- C:\Windows\System\MOUjiiw.exe
  C:\Windows\System\MOUjiiw.exe
  2⤵
  PID:12508
- C:\Windows\System\rBqiQQO.exe
  C:\Windows\System\rBqiQQO.exe
  2⤵
  PID:12528
- C:\Windows\System\gtIKJZe.exe
  C:\Windows\System\gtIKJZe.exe
  2⤵
  PID:12564
- C:\Windows\System\ZDTiFrk.exe
  C:\Windows\System\ZDTiFrk.exe
  2⤵
  PID:12584
- C:\Windows\System\oGqcaxM.exe
  C:\Windows\System\oGqcaxM.exe
  2⤵
  PID:12604
- C:\Windows\System\fVebmXf.exe
  C:\Windows\System\fVebmXf.exe
  2⤵
  PID:12628
- C:\Windows\System\JBcfDLM.exe
  C:\Windows\System\JBcfDLM.exe
  2⤵
  PID:12656
- C:\Windows\System\KaYFyEa.exe
  C:\Windows\System\KaYFyEa.exe
  2⤵
  PID:12684
- C:\Windows\System\scrMxNa.exe
  C:\Windows\System\scrMxNa.exe
  2⤵
  PID:12704
- C:\Windows\System\QUxkiaG.exe
  C:\Windows\System\QUxkiaG.exe
  2⤵
  PID:12728
- C:\Windows\System\AAzjaQU.exe
  C:\Windows\System\AAzjaQU.exe
  2⤵
  PID:12780
- C:\Windows\System\bsRPzLz.exe
  C:\Windows\System\bsRPzLz.exe
  2⤵
  PID:12800
- C:\Windows\System\FMhKjTL.exe
  C:\Windows\System\FMhKjTL.exe
  2⤵
  PID:12836
- C:\Windows\System\CnuQANe.exe
  C:\Windows\System\CnuQANe.exe
  2⤵
  PID:12868
- C:\Windows\System\SWAAyqq.exe
  C:\Windows\System\SWAAyqq.exe
  2⤵
  PID:12900
- C:\Windows\System\zSdetje.exe
  C:\Windows\System\zSdetje.exe
  2⤵
  PID:12940
- C:\Windows\System\CuMBwJX.exe
  C:\Windows\System\CuMBwJX.exe
  2⤵
  PID:12956
- C:\Windows\System\rcfTtBt.exe
  C:\Windows\System\rcfTtBt.exe
  2⤵
  PID:12976
- C:\Windows\System\haLePdP.exe
  C:\Windows\System\haLePdP.exe
  2⤵
  PID:13000
- C:\Windows\System\Btixqzp.exe
  C:\Windows\System\Btixqzp.exe
  2⤵
  PID:13020
- C:\Windows\System\YFxxWMP.exe
  C:\Windows\System\YFxxWMP.exe
  2⤵
  PID:13040
- C:\Windows\System\ymqtWVg.exe
  C:\Windows\System\ymqtWVg.exe
  2⤵
  PID:13064
- C:\Windows\System\qHPCBDu.exe
  C:\Windows\System\qHPCBDu.exe
  2⤵
  PID:13112
- C:\Windows\System\hPjSuLL.exe
  C:\Windows\System\hPjSuLL.exe
  2⤵
  PID:13136
- C:\Windows\System\CQZhGHR.exe
  C:\Windows\System\CQZhGHR.exe
  2⤵
  PID:13168
- C:\Windows\System\CsRyktA.exe
  C:\Windows\System\CsRyktA.exe
  2⤵
  PID:13220
- C:\Windows\System\SzOYrmQ.exe
  C:\Windows\System\SzOYrmQ.exe
  2⤵
  PID:13236
- C:\Windows\System\xwbjwVs.exe
  C:\Windows\System\xwbjwVs.exe
  2⤵
  PID:13252
- C:\Windows\System\EZfoVTg.exe
  C:\Windows\System\EZfoVTg.exe
  2⤵
  PID:13292
- C:\Windows\System\mXjqArt.exe
  C:\Windows\System\mXjqArt.exe
  2⤵
  PID:13308
- C:\Windows\System\siZEshv.exe
  C:\Windows\System\siZEshv.exe
  2⤵
  PID:12336
- C:\Windows\System\wUzkwNV.exe
  C:\Windows\System\wUzkwNV.exe
  2⤵
  PID:12384
- C:\Windows\System\mTUUZrh.exe
  C:\Windows\System\mTUUZrh.exe
  2⤵
  PID:12488
- C:\Windows\System\TKjsosv.exe
  C:\Windows\System\TKjsosv.exe
  2⤵
  PID:12572
- C:\Windows\System\hhrcDKL.exe
  C:\Windows\System\hhrcDKL.exe
  2⤵
  PID:12616
- C:\Windows\System\NPBfVcd.exe
  C:\Windows\System\NPBfVcd.exe
  2⤵
  PID:12748
- C:\Windows\System\MUCGPFu.exe
  C:\Windows\System\MUCGPFu.exe
  2⤵
  PID:12700
- C:\Windows\System\SZNcCmT.exe
  C:\Windows\System\SZNcCmT.exe
  2⤵
  PID:12772
- C:\Windows\System\HsmvLqe.exe
  C:\Windows\System\HsmvLqe.exe
  2⤵
  PID:12864
- C:\Windows\System\yBeaOtZ.exe
  C:\Windows\System\yBeaOtZ.exe
  2⤵
  PID:8608
- C:\Windows\System\AHlsmdN.exe
  C:\Windows\System\AHlsmdN.exe
  2⤵
  PID:12984
- C:\Windows\System\ytzTPTC.exe
  C:\Windows\System\ytzTPTC.exe
  2⤵
  PID:13008
- C:\Windows\System\yptmPTj.exe
  C:\Windows\System\yptmPTj.exe
  2⤵
  PID:13092
- C:\Windows\System\bmFgLTz.exe
  C:\Windows\System\bmFgLTz.exe
  2⤵
  PID:840
- C:\Windows\System\misjRdz.exe
  C:\Windows\System\misjRdz.exe
  2⤵
  PID:13216
- C:\Windows\System\zyIqWqm.exe
  C:\Windows\System\zyIqWqm.exe
  2⤵
  PID:13272
- C:\Windows\System\qrsgTIa.exe
  C:\Windows\System\qrsgTIa.exe
  2⤵
  PID:12324
- C:\Windows\System\dNmhBzb.exe
  C:\Windows\System\dNmhBzb.exe
  2⤵
  PID:12556
- C:\Windows\System\dcrnExo.exe
  C:\Windows\System\dcrnExo.exe
  2⤵
  PID:12652
- C:\Windows\System\bbIrIFl.exe
  C:\Windows\System\bbIrIFl.exe
  2⤵
  PID:12832
- C:\Windows\System\YXjrXxn.exe
  C:\Windows\System\YXjrXxn.exe
  2⤵
  PID:12912
- C:\Windows\System\oadPVPQ.exe
  C:\Windows\System\oadPVPQ.exe
  2⤵
  PID:13104
- C:\Windows\System\rfmBJyB.exe
  C:\Windows\System\rfmBJyB.exe
  2⤵
  PID:13228
- C:\Windows\System\qvyiqzV.exe
  C:\Windows\System\qvyiqzV.exe
  2⤵
  PID:12484
- C:\Windows\System\KwMCNjQ.exe
  C:\Windows\System\KwMCNjQ.exe
  2⤵
  PID:12644
- C:\Windows\System\idsoJiH.exe
  C:\Windows\System\idsoJiH.exe
  2⤵
  PID:13036
- C:\Windows\System\nqlZoto.exe
  C:\Windows\System\nqlZoto.exe
  2⤵
  PID:12676
- C:\Windows\System\asrggIZ.exe
  C:\Windows\System\asrggIZ.exe
  2⤵
  PID:13324
- C:\Windows\System\pTKhxJx.exe
  C:\Windows\System\pTKhxJx.exe
  2⤵
  PID:13352
- C:\Windows\System\nXqylMo.exe
  C:\Windows\System\nXqylMo.exe
  2⤵
  PID:13384
- C:\Windows\System\KaLPQse.exe
  C:\Windows\System\KaLPQse.exe
  2⤵
  PID:13400
- C:\Windows\System\NHuMNUY.exe
  C:\Windows\System\NHuMNUY.exe
  2⤵
  PID:13452
- C:\Windows\System\PBFSHcp.exe
  C:\Windows\System\PBFSHcp.exe
  2⤵
  PID:13472
- C:\Windows\System\oBMLDNL.exe
  C:\Windows\System\oBMLDNL.exe
  2⤵
  PID:13496
- C:\Windows\System\TaeImGu.exe
  C:\Windows\System\TaeImGu.exe
  2⤵
  PID:13520
- C:\Windows\System\tFUZpnE.exe
  C:\Windows\System\tFUZpnE.exe
  2⤵
  PID:13564
- C:\Windows\System\lRgMMtU.exe
  C:\Windows\System\lRgMMtU.exe
  2⤵
  PID:13592
- C:\Windows\System\lvdDvQz.exe
  C:\Windows\System\lvdDvQz.exe
  2⤵
  PID:13616
- C:\Windows\System\TPfxFOI.exe
  C:\Windows\System\TPfxFOI.exe
  2⤵
  PID:13636
- C:\Windows\System\qbkItHs.exe
  C:\Windows\System\qbkItHs.exe
  2⤵
  PID:13676
- C:\Windows\System\LnhhzWn.exe
  C:\Windows\System\LnhhzWn.exe
  2⤵
  PID:13704
- C:\Windows\System\IuEWxxe.exe
  C:\Windows\System\IuEWxxe.exe
  2⤵
  PID:13720
- C:\Windows\System\EStFWpZ.exe
  C:\Windows\System\EStFWpZ.exe
  2⤵
  PID:13744
- C:\Windows\System\ZurbAeH.exe
  C:\Windows\System\ZurbAeH.exe
  2⤵
  PID:13784
- C:\Windows\System\etFPplK.exe
  C:\Windows\System\etFPplK.exe
  2⤵
  PID:13804
- C:\Windows\System\hgcfPLx.exe
  C:\Windows\System\hgcfPLx.exe
  2⤵
  PID:13832
- C:\Windows\System\qIgWKlc.exe
  C:\Windows\System\qIgWKlc.exe
  2⤵
  PID:13860
- C:\Windows\System\ffEbzVn.exe
  C:\Windows\System\ffEbzVn.exe
  2⤵
  PID:13900
- C:\Windows\System\ToHNsSM.exe
  C:\Windows\System\ToHNsSM.exe
  2⤵
  PID:13928
- C:\Windows\System\LEncSsX.exe
  C:\Windows\System\LEncSsX.exe
  2⤵
  PID:13948
- C:\Windows\System\JGQjvdn.exe
  C:\Windows\System\JGQjvdn.exe
  2⤵
  PID:13972
- C:\Windows\System\LMgPWVO.exe
  C:\Windows\System\LMgPWVO.exe
  2⤵
  PID:13996
- C:\Windows\System\MycBUlx.exe
  C:\Windows\System\MycBUlx.exe
  2⤵
  PID:14012
- C:\Windows\System\KcAzgcK.exe
  C:\Windows\System\KcAzgcK.exe
  2⤵
  PID:14048
- C:\Windows\System\SePwjOl.exe
  C:\Windows\System\SePwjOl.exe
  2⤵
  PID:14076
- C:\Windows\System\BhirOWB.exe
  C:\Windows\System\BhirOWB.exe
  2⤵
  PID:14100
- C:\Windows\System\ONAWEzn.exe
  C:\Windows\System\ONAWEzn.exe
  2⤵
  PID:14132
- C:\Windows\System\afXYmFv.exe
  C:\Windows\System\afXYmFv.exe
  2⤵
  PID:14156
- C:\Windows\System\jyyYeoC.exe
  C:\Windows\System\jyyYeoC.exe
  2⤵
  PID:14188
- C:\Windows\System\SWexhBy.exe
  C:\Windows\System\SWexhBy.exe
  2⤵
  PID:14208
- C:\Windows\System\hcYIHeI.exe
  C:\Windows\System\hcYIHeI.exe
  2⤵
  PID:14252
- C:\Windows\System\hFPlsWF.exe
  C:\Windows\System\hFPlsWF.exe
  2⤵
  PID:14268
- C:\Windows\System\GOmLYsC.exe
  C:\Windows\System\GOmLYsC.exe
  2⤵
  PID:14292
- C:\Windows\System\hqRSBrG.exe
  C:\Windows\System\hqRSBrG.exe
  2⤵
  PID:13052
- C:\Windows\System\FzehcFf.exe
  C:\Windows\System\FzehcFf.exe
  2⤵
  PID:13336
- C:\Windows\System\UfHRWwH.exe
  C:\Windows\System\UfHRWwH.exe
  2⤵
  PID:13376
- C:\Windows\System\PIdcZJc.exe
  C:\Windows\System\PIdcZJc.exe
  2⤵
  PID:13432
- C:\Windows\System\CdBEaLs.exe
  C:\Windows\System\CdBEaLs.exe
  2⤵
  PID:13548
- C:\Windows\System\lujxvJC.exe
  C:\Windows\System\lujxvJC.exe
  2⤵
  PID:13588
- C:\Windows\System\tNcooLa.exe
  C:\Windows\System\tNcooLa.exe
  2⤵
  PID:13632
- C:\Windows\System\NlAsMOC.exe
  C:\Windows\System\NlAsMOC.exe
  2⤵
  PID:13696
- C:\Windows\System\aqdinaj.exe
  C:\Windows\System\aqdinaj.exe
  2⤵
  PID:13760
- C:\Windows\System\GwguYUb.exe
  C:\Windows\System\GwguYUb.exe
  2⤵
  PID:13896
- C:\Windows\System\fLGSlRe.exe
  C:\Windows\System\fLGSlRe.exe
  2⤵
  PID:13916
- C:\Windows\System\RgvmYEj.exe
  C:\Windows\System\RgvmYEj.exe
  2⤵
  PID:13968
- C:\Windows\System\RHIZdUn.exe
  C:\Windows\System\RHIZdUn.exe
  2⤵
  PID:14020
- C:\Windows\System\oOVggIM.exe
  C:\Windows\System\oOVggIM.exe
  2⤵
  PID:14064
- C:\Windows\System\giXbGAR.exe
  C:\Windows\System\giXbGAR.exe
  2⤵
  PID:14172
- C:\Windows\System\uvjjWOx.exe
  C:\Windows\System\uvjjWOx.exe
  2⤵
  PID:14260
- C:\Windows\System\HbFteId.exe
  C:\Windows\System\HbFteId.exe
  2⤵
  PID:14284
- C:\Windows\System\mVyXwKI.exe
  C:\Windows\System\mVyXwKI.exe
  2⤵
  PID:13480
- C:\Windows\System\XKaNQVu.exe
  C:\Windows\System\XKaNQVu.exe
  2⤵
  PID:13560
- C:\Windows\System\LwqQTCM.exe
  C:\Windows\System\LwqQTCM.exe
  2⤵
  PID:13668
- C:\Windows\System\XRSPPYc.exe
  C:\Windows\System\XRSPPYc.exe
  2⤵
  PID:13944
- C:\Windows\System\rkoiUwO.exe
  C:\Windows\System\rkoiUwO.exe
  2⤵
  PID:14008
- C:\Windows\System\aQXuAHc.exe
  C:\Windows\System\aQXuAHc.exe
  2⤵
  PID:3376
- C:\Windows\System\Xwnlgcq.exe
  C:\Windows\System\Xwnlgcq.exe
  2⤵
  PID:14280
- C:\Windows\System\WOYWZlV.exe
  C:\Windows\System\WOYWZlV.exe
  2⤵
  PID:13364
- C:\Windows\System\CJafeev.exe
  C:\Windows\System\CJafeev.exe
  2⤵
  PID:13396
- C:\Windows\System\euZRKNQ.exe
  C:\Windows\System\euZRKNQ.exe
  2⤵
  PID:14092
- C:\Windows\System\ZHzBeBo.exe
  C:\Windows\System\ZHzBeBo.exe
  2⤵
  PID:14128
- C:\Windows\System\NpLGgMj.exe
  C:\Windows\System\NpLGgMj.exe
  2⤵
  PID:13888
- C:\Windows\System\mjFjnZI.exe
  C:\Windows\System\mjFjnZI.exe
  2⤵
  PID:14356
- C:\Windows\System\uhBYFqt.exe
  C:\Windows\System\uhBYFqt.exe
  2⤵
  PID:14384
- C:\Windows\System\jdpecWR.exe
  C:\Windows\System\jdpecWR.exe
  2⤵
  PID:14416
- C:\Windows\System\UYEkmmy.exe
  C:\Windows\System\UYEkmmy.exe
  2⤵
  PID:14436
- C:\Windows\System\PitibJg.exe
  C:\Windows\System\PitibJg.exe
  2⤵
  PID:14468
- C:\Windows\System\pzWqFcU.exe
  C:\Windows\System\pzWqFcU.exe
  2⤵
  PID:14492
- C:\Windows\System\vgBnmOx.exe
  C:\Windows\System\vgBnmOx.exe
  2⤵
  PID:14516
- C:\Windows\System\RhLplFn.exe
  C:\Windows\System\RhLplFn.exe
  2⤵
  PID:14560
- C:\Windows\System\QLwdIOx.exe
  C:\Windows\System\QLwdIOx.exe
  2⤵
  PID:14576
- C:\Windows\System\xjFmsvf.exe
  C:\Windows\System\xjFmsvf.exe
  2⤵
  PID:14620
- C:\Windows\System\pWLtdjg.exe
  C:\Windows\System\pWLtdjg.exe
  2⤵
  PID:14640
- C:\Windows\System\QAKUITn.exe
  C:\Windows\System\QAKUITn.exe
  2⤵
  PID:14668
- C:\Windows\System\ruYuFDi.exe
  C:\Windows\System\ruYuFDi.exe
  2⤵
  PID:14712
- C:\Windows\System\FmPKOvh.exe
  C:\Windows\System\FmPKOvh.exe
  2⤵
  PID:14728
- C:\Windows\System\JVkcdfx.exe
  C:\Windows\System\JVkcdfx.exe
  2⤵
  PID:14744
- C:\Windows\System\aAswdgM.exe
  C:\Windows\System\aAswdgM.exe
  2⤵
  PID:14784
- C:\Windows\System\KyTjFml.exe
  C:\Windows\System\KyTjFml.exe
  2⤵
  PID:14812
- C:\Windows\System\MRmBORv.exe
  C:\Windows\System\MRmBORv.exe
  2⤵
  PID:14828
- C:\Windows\System\BDwCHEn.exe
  C:\Windows\System\BDwCHEn.exe
  2⤵
  PID:14880
- C:\Windows\System\LhddIdr.exe
  C:\Windows\System\LhddIdr.exe
  2⤵
  PID:14896
- C:\Windows\System\NScDUGW.exe
  C:\Windows\System\NScDUGW.exe
  2⤵
  PID:14912
- C:\Windows\System\KcmzbOC.exe
  C:\Windows\System\KcmzbOC.exe
  2⤵
  PID:14932
- C:\Windows\System\GPGKiIG.exe
  C:\Windows\System\GPGKiIG.exe
  2⤵
  PID:14956
- C:\Windows\System\cFjkCHv.exe
  C:\Windows\System\cFjkCHv.exe
  2⤵
  PID:14984
- C:\Windows\System\nodLZuZ.exe
  C:\Windows\System\nodLZuZ.exe
  2⤵
  PID:15016
- C:\Windows\System\kZHPNcc.exe
  C:\Windows\System\kZHPNcc.exe
  2⤵
  PID:15040
- C:\Windows\System\ovSVRpk.exe
  C:\Windows\System\ovSVRpk.exe
  2⤵
  PID:15056
- C:\Windows\System\qiWWUUx.exe
  C:\Windows\System\qiWWUUx.exe
  2⤵
  PID:15072
- C:\Windows\System\DAygedE.exe
  C:\Windows\System\DAygedE.exe
  2⤵
  PID:15088
- C:\Windows\System\yewZoDZ.exe
  C:\Windows\System\yewZoDZ.exe
  2⤵
  PID:15116
- C:\Windows\System\BtxwCLI.exe
  C:\Windows\System\BtxwCLI.exe
  2⤵
  PID:15156
- C:\Windows\System\ULFrRHQ.exe
  C:\Windows\System\ULFrRHQ.exe
  2⤵
  PID:15188
- C:\Windows\System\HnOcDyu.exe
  C:\Windows\System\HnOcDyu.exe
  2⤵
  PID:15244
- C:\Windows\System\ujtusaG.exe
  C:\Windows\System\ujtusaG.exe
  2⤵
  PID:15280
- C:\Windows\System\STAREkv.exe
  C:\Windows\System\STAREkv.exe
  2⤵
  PID:15308
- C:\Windows\System\osvKbcl.exe
  C:\Windows\System\osvKbcl.exe
  2⤵
  PID:15332
- C:\Windows\System\EoybAMO.exe
  C:\Windows\System\EoybAMO.exe
  2⤵
  PID:15348
- C:\Windows\System\PQgZSTO.exe
  C:\Windows\System\PQgZSTO.exe
  2⤵
  PID:13612
- C:\Windows\System\ShDNEJO.exe
  C:\Windows\System\ShDNEJO.exe
  2⤵
  PID:14408
- C:\Windows\System\mvqpIUp.exe
  C:\Windows\System\mvqpIUp.exe
  2⤵
  PID:14428
- C:\Windows\System\IVvyYUA.exe
  C:\Windows\System\IVvyYUA.exe
  2⤵
  PID:14480
- C:\Windows\System\mcdErWQ.exe
  C:\Windows\System\mcdErWQ.exe
  2⤵
  PID:14536
- C:\Windows\System\YIzmfIg.exe
  C:\Windows\System\YIzmfIg.exe
  2⤵
  PID:14572
- C:\Windows\System\ibdNBHt.exe
  C:\Windows\System\ibdNBHt.exe
  2⤵
  PID:14604
- C:\Windows\System\WxoPIpo.exe
  C:\Windows\System\WxoPIpo.exe
  2⤵
  PID:14664
- C:\Windows\System\YntKSxK.exe
  C:\Windows\System\YntKSxK.exe
  2⤵
  PID:14764
- C:\Windows\System\yRkaVOQ.exe
  C:\Windows\System\yRkaVOQ.exe
  2⤵
  PID:14772
- C:\Windows\System\sOTBmcQ.exe
  C:\Windows\System\sOTBmcQ.exe
  2⤵
  PID:14856
- C:\Windows\System\mOZmPVT.exe
  C:\Windows\System\mOZmPVT.exe
  2⤵
  PID:14928
- C:\Windows\System\yYMcpzP.exe
  C:\Windows\System\yYMcpzP.exe
  2⤵
  PID:15000
- C:\Windows\System\draaPnt.exe
  C:\Windows\System\draaPnt.exe
  2⤵
  PID:14972
- C:\Windows\System\LrPLYzl.exe
  C:\Windows\System\LrPLYzl.exe
  2⤵
  PID:15064
- C:\Windows\System\PTWkRKP.exe
  C:\Windows\System\PTWkRKP.exe
  2⤵
  PID:15084
- C:\Windows\System\oCzNIbB.exe
  C:\Windows\System\oCzNIbB.exe
  2⤵
  PID:15140
- C:\Windows\System\yNHGAOD.exe
  C:\Windows\System\yNHGAOD.exe
  2⤵
  PID:15224
- C:\Windows\System\QUmeYGP.exe
  C:\Windows\System\QUmeYGP.exe
  2⤵
  PID:15300
- C:\Windows\System\xXtbqYX.exe
  C:\Windows\System\xXtbqYX.exe
  2⤵
  PID:15296
- C:\Windows\System\ResmHKb.exe
  C:\Windows\System\ResmHKb.exe
  2⤵
  PID:15316
- C:\Windows\System\CfvhRbM.exe
  C:\Windows\System\CfvhRbM.exe
  2⤵
  PID:15340
- C:\Windows\System\hKWapDU.exe
  C:\Windows\System\hKWapDU.exe
  2⤵
  PID:14504
- C:\Windows\System\AmlxqsG.exe
  C:\Windows\System\AmlxqsG.exe
  2⤵
  PID:14684
- C:\Windows\System\WSxOwev.exe
  C:\Windows\System\WSxOwev.exe
  2⤵
  PID:14540
- C:\Windows\System\rQgljfs.exe
  C:\Windows\System\rQgljfs.exe
  2⤵
  PID:14876
- C:\Windows\System\RQVTMIZ.exe
  C:\Windows\System\RQVTMIZ.exe
  2⤵
  PID:14948
- C:\Windows\System\ttJcaSd.exe
  C:\Windows\System\ttJcaSd.exe
  2⤵
  PID:15236
- C:\Windows\System\SUavswX.exe
  C:\Windows\System\SUavswX.exe
  2⤵
  PID:15364
- C:\Windows\System\TXfclSr.exe
  C:\Windows\System\TXfclSr.exe
  2⤵
  PID:15392
- C:\Windows\System\KHyDtNO.exe
  C:\Windows\System\KHyDtNO.exe
  2⤵
  PID:15416
- C:\Windows\System\wMkUytw.exe
  C:\Windows\System\wMkUytw.exe
  2⤵
  PID:15444
- C:\Windows\System\KbJgTrD.exe
  C:\Windows\System\KbJgTrD.exe
  2⤵
  PID:15468
- C:\Windows\System\wafzZDQ.exe
  C:\Windows\System\wafzZDQ.exe
  2⤵
  PID:15484
- C:\Windows\System\dCBnYJS.exe
  C:\Windows\System\dCBnYJS.exe
  2⤵
  PID:15500
- C:\Windows\System\XYIqawM.exe
  C:\Windows\System\XYIqawM.exe
  2⤵
  PID:15532
- C:\Windows\System\HwwCccG.exe
  C:\Windows\System\HwwCccG.exe
  2⤵
  PID:15548
- C:\Windows\System\GpEQiJt.exe
  C:\Windows\System\GpEQiJt.exe
  2⤵
  PID:15576
- C:\Windows\System\lrkogpQ.exe
  C:\Windows\System\lrkogpQ.exe
  2⤵
  PID:15596
- C:\Windows\System\vlBEzrm.exe
  C:\Windows\System\vlBEzrm.exe
  2⤵
  PID:15616
- C:\Windows\System\trHWbyu.exe
  C:\Windows\System\trHWbyu.exe
  2⤵
  PID:15640
- C:\Windows\System\XEaUAEN.exe
  C:\Windows\System\XEaUAEN.exe
  2⤵
  PID:15672
- C:\Windows\System\QwvzGBG.exe
  C:\Windows\System\QwvzGBG.exe
  2⤵
  PID:15692
- C:\Windows\System\htRCaQb.exe
  C:\Windows\System\htRCaQb.exe
  2⤵
  PID:15708
- C:\Windows\System\AqJYgCR.exe
  C:\Windows\System\AqJYgCR.exe
  2⤵
  PID:15728
- C:\Windows\System\MsXJlDE.exe
  C:\Windows\System\MsXJlDE.exe
  2⤵
  PID:15748
- C:\Windows\System\aCmfCOM.exe
  C:\Windows\System\aCmfCOM.exe
  2⤵
  PID:15772
- C:\Windows\System\BZLvYXh.exe
  C:\Windows\System\BZLvYXh.exe
  2⤵
  PID:15796
- C:\Windows\System\xwZZywb.exe
  C:\Windows\System\xwZZywb.exe
  2⤵
  PID:15816
- C:\Windows\System\ncbnDJa.exe
  C:\Windows\System\ncbnDJa.exe
  2⤵
  PID:16136
- C:\Windows\System\ZaUzxJQ.exe
  C:\Windows\System\ZaUzxJQ.exe
  2⤵
  PID:16168
- C:\Windows\System\hlysQsn.exe
  C:\Windows\System\hlysQsn.exe
  2⤵
  PID:16184
- C:\Windows\System\PRtAtOy.exe
  C:\Windows\System\PRtAtOy.exe
  2⤵
  PID:16208
- C:\Windows\System\BqAjJcq.exe
  C:\Windows\System\BqAjJcq.exe
  2⤵
  PID:16236
- C:\Windows\System\DiXwvyC.exe
  C:\Windows\System\DiXwvyC.exe
  2⤵
  PID:16256
- C:\Windows\System\ZcfHYCu.exe
  C:\Windows\System\ZcfHYCu.exe
  2⤵
  PID:16272
- C:\Windows\System\pTNReGB.exe
  C:\Windows\System\pTNReGB.exe
  2⤵
  PID:16288
- C:\Windows\System\cMLxUFi.exe
  C:\Windows\System\cMLxUFi.exe
  2⤵
  PID:16312
- C:\Windows\System\mGGmgUu.exe
  C:\Windows\System\mGGmgUu.exe
  2⤵
  PID:16340
- C:\Windows\System\UlQfQcS.exe
  C:\Windows\System\UlQfQcS.exe
  2⤵
  PID:16364
- C:\Windows\System\hSpTrIP.exe
  C:\Windows\System\hSpTrIP.exe
  2⤵
  PID:15180
- C:\Windows\System\ZOLPFqy.exe
  C:\Windows\System\ZOLPFqy.exe
  2⤵
  PID:14720
- C:\Windows\System\mFuduRu.exe
  C:\Windows\System\mFuduRu.exe
  2⤵
  PID:14636
- C:\Windows\System\EKwXOVC.exe
  C:\Windows\System\EKwXOVC.exe
  2⤵
  PID:15152
- C:\Windows\System\awxNPKw.exe
  C:\Windows\System\awxNPKw.exe
  2⤵
  PID:14512
- C:\Windows\System\xgAATYt.exe
  C:\Windows\System\xgAATYt.exe
  2⤵
  PID:14904
- C:\Windows\System\vygPtgS.exe
  C:\Windows\System\vygPtgS.exe
  2⤵
  PID:15052
- C:\Windows\System\Oogjqos.exe
  C:\Windows\System\Oogjqos.exe
  2⤵
  PID:14952
- C:\Windows\System\VDogdma.exe
  C:\Windows\System\VDogdma.exe
  2⤵
  PID:15476
- C:\Windows\System\DNaziqt.exe
  C:\Windows\System\DNaziqt.exe
  2⤵
  PID:15716
- C:\Windows\System\IBRKkYR.exe
  C:\Windows\System\IBRKkYR.exe
  2⤵
  PID:15544
- C:\Windows\System\fzDijsq.exe
  C:\Windows\System\fzDijsq.exe
  2⤵
  PID:15456
- C:\Windows\System\IGdaQmI.exe
  C:\Windows\System\IGdaQmI.exe
  2⤵
  PID:15496
- C:\Windows\System\JOHzqCO.exe
  C:\Windows\System\JOHzqCO.exe
  2⤵
  PID:15736
- C:\Windows\System\NGdHyjJ.exe
  C:\Windows\System\NGdHyjJ.exe
  2⤵
  PID:15912
- C:\Windows\System\jMBvHbX.exe
  C:\Windows\System\jMBvHbX.exe
  2⤵
  PID:15812
- C:\Windows\System\EyzGqJy.exe
  C:\Windows\System\EyzGqJy.exe
  2⤵
  PID:15944
- C:\Windows\System\XeKxyRI.exe
  C:\Windows\System\XeKxyRI.exe
  2⤵
  PID:15832
- C:\Windows\System\apIRKCQ.exe
  C:\Windows\System\apIRKCQ.exe
  2⤵
  PID:16080
- C:\Windows\System\pCwLAxZ.exe
  C:\Windows\System\pCwLAxZ.exe
  2⤵
  PID:4804
- C:\Windows\System\ohgpxGt.exe
  C:\Windows\System\ohgpxGt.exe
  2⤵
  PID:16196
- C:\Windows\System\uSKVZJj.exe
  C:\Windows\System\uSKVZJj.exe
  2⤵
  PID:16224
- C:\Windows\System\vLcKFbC.exe
  C:\Windows\System\vLcKFbC.exe
  2⤵
  PID:16328
- C:\Windows\System\ONjJxcS.exe
  C:\Windows\System\ONjJxcS.exe
  2⤵
  PID:16284
- C:\Windows\System\oyrRYYD.exe
  C:\Windows\System\oyrRYYD.exe
  2⤵
  PID:4380
- C:\Windows\System\lOIULPp.exe
  C:\Windows\System\lOIULPp.exe
  2⤵
  PID:15432
- C:\Windows\System\YegKGRE.exe
  C:\Windows\System\YegKGRE.exe
  2⤵
  PID:14432
- C:\Windows\System\mIXedsS.exe
  C:\Windows\System\mIXedsS.exe
  2⤵
  PID:14648
- C:\Windows\System\MVejbjM.exe
  C:\Windows\System\MVejbjM.exe
  2⤵
  PID:15852
- C:\Windows\System\LeyszZM.exe
  C:\Windows\System\LeyszZM.exe
  2⤵
  PID:15804
- C:\Windows\System\HmZNLic.exe
  C:\Windows\System\HmZNLic.exe
  2⤵
  PID:15972
- C:\Windows\System\QeGZSPQ.exe
  C:\Windows\System\QeGZSPQ.exe
  2⤵
  PID:15440
- C:\Windows\System\TbSobHA.exe
  C:\Windows\System\TbSobHA.exe
  2⤵
  PID:16204
- C:\Windows\System\SHaafOH.exe
  C:\Windows\System\SHaafOH.exe
  2⤵
  PID:3816
- C:\Windows\System\YBVWgox.exe
  C:\Windows\System\YBVWgox.exe
  2⤵
  PID:16392
- C:\Windows\System\LiNPpMj.exe
  C:\Windows\System\LiNPpMj.exe
  2⤵
  PID:16408
- C:\Windows\System\qKwFzbP.exe
  C:\Windows\System\qKwFzbP.exe
  2⤵
  PID:16428
- C:\Windows\System\qsvFOnO.exe
  C:\Windows\System\qsvFOnO.exe
  2⤵
  PID:16444
- C:\Windows\System\nYASDQR.exe
  C:\Windows\System\nYASDQR.exe
  2⤵
  PID:16464
- C:\Windows\System\dUNSkOU.exe
  C:\Windows\System\dUNSkOU.exe
  2⤵
  PID:16504
- C:\Windows\System\exkYQki.exe
  C:\Windows\System\exkYQki.exe
  2⤵
  PID:16532
- C:\Windows\System\mBBfUIc.exe
  C:\Windows\System\mBBfUIc.exe
  2⤵
  PID:16548
- C:\Windows\System\BhmYSig.exe
  C:\Windows\System\BhmYSig.exe
  2⤵
  PID:16564
- C:\Windows\System\pdgjsCZ.exe
  C:\Windows\System\pdgjsCZ.exe
  2⤵
  PID:16592
- C:\Windows\System\cfPRNxU.exe
  C:\Windows\System\cfPRNxU.exe
  2⤵
  PID:16628
- C:\Windows\System\TkiCysR.exe
  C:\Windows\System\TkiCysR.exe
  2⤵
  PID:16652
- C:\Windows\System\oAXfJFP.exe
  C:\Windows\System\oAXfJFP.exe
  2⤵
  PID:16668
- C:\Windows\System\InjhsXz.exe
  C:\Windows\System\InjhsXz.exe
  2⤵
  PID:16692
- C:\Windows\System\uNPyBxw.exe
  C:\Windows\System\uNPyBxw.exe
  2⤵
  PID:16708
- C:\Windows\System\qgzwkbE.exe
  C:\Windows\System\qgzwkbE.exe
  2⤵
  PID:16724
- C:\Windows\System\ZGIVdPw.exe
  C:\Windows\System\ZGIVdPw.exe
  2⤵
  PID:16744
- C:\Windows\System\SYFIHDo.exe
  C:\Windows\System\SYFIHDo.exe
  2⤵
  PID:16780
- C:\Windows\System\CdUWqTW.exe
  C:\Windows\System\CdUWqTW.exe
  2⤵
  PID:16796
- C:\Windows\System\CplhkRK.exe
  C:\Windows\System\CplhkRK.exe
  2⤵
  PID:16820
- C:\Windows\System\wIvAcAx.exe
  C:\Windows\System\wIvAcAx.exe
  2⤵
  PID:16856
- C:\Windows\System\rigxkUT.exe
  C:\Windows\System\rigxkUT.exe
  2⤵
  PID:17284
- C:\Windows\System\ZKrYZyA.exe
  C:\Windows\System\ZKrYZyA.exe
  2⤵
  PID:17356
- C:\Windows\System\owYjkEH.exe
  C:\Windows\System\owYjkEH.exe
  2⤵
  PID:17388
- C:\Windows\System\nRwpczv.exe
  C:\Windows\System\nRwpczv.exe
  2⤵
  PID:15400
- C:\Windows\System\wwdLYxU.exe
  C:\Windows\System\wwdLYxU.exe
  2⤵
  PID:15628
- C:\Windows\System\nAOuIEP.exe
  C:\Windows\System\nAOuIEP.exe
  2⤵
  PID:14588
- C:\Windows\System\WYsOuqC.exe
  C:\Windows\System\WYsOuqC.exe
  2⤵
  PID:16832

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:17100

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Accessibility Features

T1546.008

Privilege Escalation

Event Triggered Execution

T1546

Accessibility Features

T1546.008

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\BGIfTlo.exe

Filesize
1.7MB

MD5
8b24b9b94b6b48d18c5da1c05c82f44a

SHA1
e1697d7edea4a25ea9d5a2b631fa6e497d9f97c0

SHA256
fdc9f66a66c01762ba0663740388629c5173fcc1bd2584bc0248c6e715e7b372

SHA512
2e80867a7c07f1f27fd845c8a6a385a2003da2476a1354991b5ded4a57d1f1ee015d541282f18afa87f62ffd78f5312a9203d4b0ee6e55b40fe642c7bea8c811

Download Submit
C:\Windows\System\DBrodNH.exe

Filesize
1.7MB

MD5
1e9c0abe6309df2cf5517866af1a7d60

SHA1
feca6e03910ddf2d56819e27208df65cbdaa44aa

SHA256
396ffe8d27d88ef63d147e9e59732424db49182866f907283d5e13c517a34dc8

SHA512
1e792b17ad461df9e2c54dd919344bd0f74873299fb7980f112a5c4471fa42fa8553c196ab2370e113cad84a8ef62031f4262787d5c5f7d2ddbb5daabb7c22b3

Download Submit
C:\Windows\System\DOrHjaK.exe

Filesize
1.7MB

MD5
49852e76084142221ff9e47593a34a31

SHA1
e5e5fa6e2983cf3eafffb65a65a98ada24c11867

SHA256
aef9d2a69de0aad57f4d3d8ca248da3e19be2568e6cd9e33fabe04bea33c629b

SHA512
50954ff9ac763b0b97d3b9c41e7587f91145423bc0a3fd8087f8e50dc2f207a1c029bda5ecf7df668c72e4b5b08d6a55e4e4260a704a216dd45cf2f527cc6188

Download Submit
C:\Windows\System\EwCGjCx.exe

Filesize
1.7MB

MD5
e264c5b62010b9d3a97bde5c3f15b4ee

SHA1
3e7a1f20ccfb4b28ec29ce0c4b718a533e305d33

SHA256
3e29c358ce86fc8aa9dd471e35c23e1b1f519228e11f3c536b3250369e75613d

SHA512
3aa5608732f64ae2867a74447c714f03693739779c4fffadea95b446574fe2a782854cef36a64a09e2a65e4c7cf32e6af1d04452c57528908904d518e283c35b

Download Submit
C:\Windows\System\QYEQemr.exe

Filesize
1.7MB

MD5
a4a11f83b9e6240968399845b117f49f

SHA1
4b44a154f82e26b858ecb9a77e929880777461ba

SHA256
623620e3f1646ad81cf9d6f1350610999603f2bdcf35350eaba4089da0ea82ca

SHA512
e01f2deaddf606e5f28b35006624d2cef3b5eafc028a37beb3dc9aa2239f389f6148434a8730448a661b16ef4282bef4732864b752972d1e0d0056bd820ed282

Download Submit
C:\Windows\System\RKJUUov.exe

Filesize
1.7MB

MD5
369a0cc4cb8d6428deb33315e2c4f50d

SHA1
5fab7d2776aacef35ca501340fc214587d5fdc7f

SHA256
1d94ab2595ff168f269cd7abc8caa68d19f7467eacaaaca5f9eced57d35edd14

SHA512
71f5a795f1651a29750a9255a80f8766fc7ee3dfdd7fc62c38341f897ad8512f282af2bd7a298683572d23d5f862c939f3f46c70cb14b0ebe1a15d79747fe161

Download Submit
C:\Windows\System\RfDyOUI.exe

Filesize
1.7MB

MD5
a501b85d820bb8a9f3cc893afa515814

SHA1
5ea352a6b6dbd70787fabe09b80667306b60135a

SHA256
7d240a6d19c486abbce9e32bd1e7fbc2d6b252c3d6cf3e5c157621017a582039

SHA512
efc38e6801bf5380354441ee4987bfbd16dd4e8f01084c4d46e8b3d57ff8e415cff661c5fe13e540d57d87cf6969060d4136f055568255130fcf976ae48f3c81

Download Submit
C:\Windows\System\SBmabzm.exe

Filesize
1.7MB

MD5
1c711f248b72e82a5b830defcb8ef885

SHA1
c7de9ed2394e820fec0d520eb5907ee96c06c532

SHA256
9ef67b98c9704b436a937ffaf8ecafdae8f03bad736c35cd11c96404770b4048

SHA512
8717ba79c745b140b828571e4ffca96961ab521e859f91138afa39245e88108285324f43cf1cd9de5363225900f9573bd1794d53027a0f003badb0f2c1d83f71

Download Submit
C:\Windows\System\UGkcIkW.exe

Filesize
1.7MB

MD5
9386c23682eee914dd2e301e00db63c8

SHA1
e168d67ba0fe336fa99bdd3342cc90eb5beb35ae

SHA256
d3ec89be276dd845ad5a7051baba7c1e80ca8d1f520fc46a58e8ed0e26672fdf

SHA512
7c672209c1ca05855b81151b0c15478b47a2178d2a41c21a8c26fcc4a0c1cb05ab318063dbd39fcc6594c26daea32d010d604f6f4c0005ced4f0707ce684df19

Download Submit
C:\Windows\System\UYwahAk.exe

Filesize
1.7MB

MD5
f93f4d16858c05565bf54af589efd8ce

SHA1
e270e8dd9245b6e211d24340337b4848a7b7fa51

SHA256
6ac4efe3554a538655baff20b961dfb12c1961de51bff71322e611ca84702289

SHA512
b49366b28389aee2806f6782fad4f47d37119ca938081ea8eb34155aadc6ad3a2d07e2ea0b44a9d555352d68641b4d5af8c3819a7baf0a66fcb3a152906b858a

Download Submit
C:\Windows\System\UaHIIVT.exe

Filesize
1.7MB

MD5
76aea0aae54b76df35761128c4720875

SHA1
9226779d2444d438725a37af3b25391109def6a4

SHA256
d12bdccfe3f0f21b349b6d4d322de7b22d609f9097cb7037b624723e9ed54bbe

SHA512
c0290f339d7dbfd414c6ecdf8f672a8f2df227b639a71fa5a92bc85abd452f6fb558c9bf7e2d79ab0de824065b6e64b26a3c6b23a0ffa8d407d66230ea0df676

Download Submit
C:\Windows\System\VfqZZcO.exe

Filesize
1.7MB

MD5
bf148ab13c91ccc53790f316005de5e3

SHA1
bb1eb101eea7437a8667ad2fee914a148c159718

SHA256
b914e456d7a8e20270b60dcf41df99de915d445cfc2c9f3c0388f887441925a8

SHA512
9abca9251153880210a8be578895f5c0b7bd48c7c4dedf95b0cf2daad186fc64fa15e447ab704661cbcf556791b7e1d4421030304cb79e34c47b48a306d78ba4

Download Submit
C:\Windows\System\WHUBJdm.exe

Filesize
1.7MB

MD5
838737a5d6940fe83daa52e86a801f57

SHA1
1cfb8014e442ed6032efb0dd494c22df0001bc3a

SHA256
097c191f81466f83a9e51775e73395f69b003b5fd55fe512083d8b3416b7760d

SHA512
fb03e412283a19133ae5e9a60464bb23465e001d1dbe4459efe39623d197937ed389d80e6824c82e8707ebc51fb53f04e2adef6e2fa8fa59383ad2ad76116565

Download Submit
C:\Windows\System\WJldBSP.exe

Filesize
1.7MB

MD5
8142bf1331c03ab6cd1e9750347b3d99

SHA1
ecef49b21b89bd11c4d016b0b71ff17df25ba6a0

SHA256
c078bd922ebfbadbf835427610443221e1d87903caf5db0343dc121be4d3006f

SHA512
6995b0b3c27ac78b81037366f6a51be8b2e36a2a4c56ae1ea787d0dc3bdcf2703159aefc41d9ed85fa63f7fe9c8b13ff4760664802bf0b10c5c1e92d589b6d3e

Download Submit
C:\Windows\System\YITssvz.exe

Filesize
1.7MB

MD5
741902feeccf2305a956924c65f01655

SHA1
67e9b2556aaf252c2ca0160d0ddc7bde1a853cbb

SHA256
57cd5a7316f7691c014cf1ad5e5e746465bb1e181323531e2365a526db78aa12

SHA512
749a54439c10c074cd88d8c75e9209c67526172621ace302507283dc8e45af76110f7264819857abe764d44d3cdf028f0abb9df97dce76bdb4bd1d1cf5bd2d9f

Download Submit
C:\Windows\System\YJhoHFH.exe

Filesize
1.7MB

MD5
d5443eff77ab43c5283f0ba99e15bd05

SHA1
f834a808461835ad450a2469360d6769f870b884

SHA256
1aed7e2d9483456034ec13e57d763e72057c6a6e744ac3c9f6ff56e620773e89

SHA512
8d99c516360a619992b7ceff316dd785bbb4ed0e22dab467c60c11be34694e4f7a08ee9d1e0544a64c59934f977a0eded317e5240d4080e0f9b175d850323c83

Download Submit
C:\Windows\System\YkhiEcH.exe

Filesize
1.7MB

MD5
d4a62ad2ecdc2ecddd8b1e86fc230772

SHA1
f769d4eb46b7117c8736c37e40fe960de00f28b5

SHA256
fabc61bcc67a1365cdfc544baa8cc8901309941956d127fbc4c7ad61bf3b5dc1

SHA512
001ae97d468c88dd1efc55e700f4a61a4ad6d68871702b219459cb716fe3eb477797e4b6a391516b81b1925bfcbf167828df8e8a813e660c70ddec24cb99f2cb

Download Submit
C:\Windows\System\eqjdIER.exe

Filesize
1.7MB

MD5
c34d11318a80caa771801831d6598bd7

SHA1
414215008eff6d9f5846ec363b3293cac9604dbf

SHA256
befe5a7428fe025b4487acf24e3a09d6b684295b50e74ecc406240c1ce5bb60d

SHA512
0dcde06aa56f5ff69ad6591cc98d721fe25bc42930abc1d777317d580f451cacc6ea73d249180bf04716ab203cb75d02c38cc3f3128e56aae9d7c909579fd074

Download Submit
C:\Windows\System\fWLyLmF.exe

Filesize
1.7MB

MD5
0dd6f5c22a8249d24e490fcadb7a5f94

SHA1
f37210b2533763ff14fa189f8f8329aaf4a67920

SHA256
1dc0c1c01793858193e7f0c1f585b4eba73304f84bf4c1ed3da02fbf7bf2f753

SHA512
0eafb92e660d212a658f8eef83e05d15ac474d06e29a624510965feb3bb1583caf183285571ae85e06f8d8bb551c8abe2f236ebdca02880a452860120aecd20e

Download Submit
C:\Windows\System\fXVYGsY.exe

Filesize
1.7MB

MD5
d9fc539af2bb79df8466e6d0b0e0987d

SHA1
312b232d2cbeb113eafaa71af2d7715d05218b98

SHA256
c9a65baf004281d03b51e68b195c91c6e347777636cc2a556f39b4a57ad6e169

SHA512
db1ba3a1bafc5435fbb766bf4d431721842f21a3878453b94d5d0b829e5154e19ba249422c462fe9f4a47fc42e49a19eaf44e3c59ccc612f133452371fc7b938

Download Submit
C:\Windows\System\gfRcbrC.exe

Filesize
1.7MB

MD5
8a23c7d6e8b393d81fd916f7edd77663

SHA1
0090ea3e228895b5cf7ad6a065dc3792c4bb6db1

SHA256
1f66e4c350539f298b27be33d7d2cceebdcd5a7b5ba583711f8b933c284922c3

SHA512
881ae739df128e7e832680c266f30a08b3bd636bcb4d1d4757b55dcfa375fb1cf9659179aaaeb8cdacb31a30c781104885ad2b502fb22718f337a0f848d102b0

Download Submit
C:\Windows\System\iDRfEbS.exe

Filesize
1.7MB

MD5
115c71c99cdb120d1ef89a03333520d4

SHA1
79dde6cf42bb68f26a2666230bdaa6379b7c9a9f

SHA256
44390a6f46b800e93d4ecba0aaf9838f5ee2e90a763bfcbd4b87e24dc38f6b84

SHA512
8050e61fa575cf17b137cec1789e0a658b6a1e517621da88a95cf74432dda939767113524cf2b2ca4f17a4dfa918d6f9f798db9743d24b85c58bcdcce8f2685a

Download Submit
C:\Windows\System\ivJigsR.exe

Filesize
1.7MB

MD5
e04f134cd40f18cf559fe03330e8fe4f

SHA1
5b07f3372aa368624e1c34596f744374a5d217fe

SHA256
f1c28094cee750b7bcc2841a5ec9fb1eb34502b1b63a64a1561b6d45097da4eb

SHA512
56514070e6ea18486358ed37c69c45b1a76738d4a6c3e98beddc62ccc044931a93ca085bb7897677819290a76e86ee0dd53ec89e8e36ae7b37c8f33dc69bcb78

Download Submit
C:\Windows\System\lYEmGyO.exe

Filesize
1.7MB

MD5
b5a6ef45193ab677b6ce69ba599dd646

SHA1
2787cadac65f2a2e2a8ad912afea8ab9434a9d5a

SHA256
692196ec8e291a4bbc52f966c7cb49349130e7bbe4c1bb613fbfad77c16af70a

SHA512
c79740f4e5cfcdd37db58ee417adc99c96e70306db315a355995ebc1321313ca54b0e286c7dc118e2645aa95773fe814627998cbf0bade938339162f88218654

Download Submit
C:\Windows\System\mdvJkkU.exe

Filesize
1.7MB

MD5
15fa33f1f34d0ad737691277342b8b28

SHA1
c1fef791af729c701006ae74109f30fe67667d0a

SHA256
4c69d15d74f787d35ce6d31fbdb13ebebbfdb5ec60354078475f640d3fee0667

SHA512
40f81f086a1ad8f4e18b69bf349a05b67d86562704b1bc7ab1814690bd5761ce7899da8dad5e9fdd325449022e3609fba90d68f19920e06cb84e92e290c5d69c

Download Submit
C:\Windows\System\oFnoPAp.exe

Filesize
1.7MB

MD5
47f32154d18ce481a7a678a600e2e17c

SHA1
2a4c91f988e618e0b26a3f5dccd3372ea3dc2517

SHA256
4625c449c02c33dea9a738c240380b9d2caa89678e7a670a302b4426052b358b

SHA512
f5f0371c19249124113a0eb4346b3740f5d464fff5371c50b0672f1c34a2a1bafabcf578016d014a5d360c376c0222678c8d904c42cd315fe772112e7daee9ac

Download Submit
C:\Windows\System\oQFUhzu.exe

Filesize
1.7MB

MD5
d973f3d79af40509443909288b10a674

SHA1
3cf9d740f9a212445f2300afb4b029a449336d9c

SHA256
03fc616989dbaaea4c9cdea05b4a9632f5e9ba511e20d10022a2d5edad6b2454

SHA512
26c3999a9c6e964e5179f4a7330ad5bb66a1aab6612c71716f5d010b670a39abe4ffb459edfc22975206d45763c26c91916a84892e1dac0f0659ece63d38ad0c

Download Submit
C:\Windows\System\rvZiGcq.exe

Filesize
1.7MB

MD5
b8599274b2cf3782de0cf2b027829c00

SHA1
bc4625bee8899753f2c5716a9509a0814d177df1

SHA256
2675a29fadd04dc560d4a114e03e7573eaca488a6288add4ba50a670ea320229

SHA512
b2265c6c5e79f46c7914226e15ad647e08e8655eee8a84fa0962c9af7374c70a3871853c53a85b578a234c02a2ecbf5d807d7719050dea7aa6bcd6fb7ae7475a

Download Submit
C:\Windows\System\sAgugjr.exe

Filesize
1.7MB

MD5
32f0bb948c99ecf29a1f22d93c141b6c

SHA1
ef966b5a2b81485ca3b11298e8d106650a9b9870

SHA256
faf09fafa663db86977d4d821b8cada23f3a178fc245569a73dad717ba656c7a

SHA512
68351d5e93a1ad834b8c2fd83029cfad8d39520a740b74773b425378f5d96cd85b0c82c09e2e1f5674bbf1cd103dcb9701aa6b355b8cdf3da104a7c0611f32ea

Download Submit
C:\Windows\System\vNFpMBH.exe

Filesize
1.7MB

MD5
2285875321bddf21ca53b26a4398fdb4

SHA1
2a70492d6ede40d70af9805ef26dbcd02c917f3b

SHA256
e7328640108eb3b1e3d4b656ce250dd3637307eb1a04f2d110391b7330fae596

SHA512
95941a0e6498c097b9905649f8d53b116c7bd90b0b55fb4c00f8b656607c18826269194c3bfb62c329d96a8862a5e3d739abd143eca2a1b812daab9764dad324

Download Submit
C:\Windows\System\xYgjYGu.exe

Filesize
1.7MB

MD5
5bc070c12f59055a5393f9348c7b844f

SHA1
6aecdc45d0caad7c1ec387e9a0d3bba6e7389e08

SHA256
3cc7271078f919bad8a96d06716265f61be1ae0cde1894933a495562e5cdc371

SHA512
f73fca5cfe0a5e379effc883620b25a7c1d8bca6cfcfcd3bfc16fe818003a2264d8232d9622893c9f3dc51f27b84427cae9b722c5a6ee56fe45c1faab8cad0f0

Download Submit
C:\Windows\System\yGmpugo.exe

Filesize
1.7MB

MD5
b18c9971fa01af6adb5d84e7f703aece

SHA1
101d7129d59e4e26ca08b653b74f4b5ee3ff7d9e

SHA256
b40664a6f5dee98337f1dc4f3f489e995efb2e0d39b18c146f892e11ea65401c

SHA512
5fef1501cb2175440cc7f804345099ee6f8fa692f2d98cb24d814997b99b59fb799669804893f5d64cb8a937792082cd55978b187be6bef69771c4bb488ef2ab

Download Submit
C:\Windows\System\zUaRTyh.exe

Filesize
1.7MB

MD5
eb309ac63dfc363fc278f24110b2da06

SHA1
2ec2658287e8231b11a383839d303b5f2fdcad05

SHA256
db9da54ec191ff6e695f70e5cdbefbe4de28d7129279f14835688836eed072bd

SHA512
0febfb1e5ec1afc63b84b7321ca2001d4a059fe944d35fcbe6928a3b3d697f773b5fc4c3f38c0d20f1acbae19a0ffd081808817f99b7bd6f5d10635130d4a2cf

Download Submit
memory/5096-0-0x0000020571EA0000-0x0000020571EB0000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads