xmrig | 12ff182d620de23b9ea753bfd620bd2dfaae819bd4d02a8772788b490a5fd7d9

Analysis

max time kernel
142s
max time network
133s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
23-12-2024 19:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

12ff182d620de23b9ea753bfd620bd2dfaae819bd4d02a8772788b490a5fd7d9.exe
Size

1.7MB
MD5

deab535bae4b0767ae88c11115fd6a00
SHA1

8ff2cd7a52a432c2c6429fdaffe7388ad467fbfd
SHA256

12ff182d620de23b9ea753bfd620bd2dfaae819bd4d02a8772788b490a5fd7d9
SHA512

78c17229a2634949c8414875e61d5117ada762ec1b842373ae4ae8c5babb39d9b463df5ee3b52bd9e5ee4e5bb4e00e44037f35373ac31e126046c7fe3bb24947
SSDEEP

49152:GezaTF8FcNkNdfE0pZ9ozttwIRRR/1fGkv+ih4f:GemTLkNdfE0pZym

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 33 IoCs

miner

resource	yara_rule
behavioral2/files/0x000c000000023ba1-4.dat	xmrig
behavioral2/files/0x000a000000023bb3-7.dat	xmrig
behavioral2/files/0x000b000000023ba8-13.dat	xmrig
behavioral2/files/0x000e000000023bba-22.dat	xmrig
behavioral2/files/0x0008000000023bc3-21.dat	xmrig
behavioral2/files/0x0009000000023bc8-30.dat	xmrig
behavioral2/files/0x0009000000023bc9-34.dat	xmrig
behavioral2/files/0x0009000000023bca-38.dat	xmrig
behavioral2/files/0x0008000000023bd0-44.dat	xmrig
behavioral2/files/0x0008000000023bd4-58.dat	xmrig
behavioral2/files/0x0008000000023bd6-62.dat	xmrig
behavioral2/files/0x0008000000023bd5-57.dat	xmrig
behavioral2/files/0x0008000000023bd3-49.dat	xmrig
behavioral2/files/0x0008000000023c05-67.dat	xmrig
behavioral2/files/0x0008000000023c06-71.dat	xmrig
behavioral2/files/0x0008000000023c07-80.dat	xmrig
behavioral2/files/0x0008000000023c0a-95.dat	xmrig
behavioral2/files/0x0008000000023c10-104.dat	xmrig
behavioral2/files/0x0008000000023c08-115.dat	xmrig
behavioral2/files/0x0008000000023c2b-127.dat	xmrig
behavioral2/files/0x0008000000023c2e-144.dat	xmrig
behavioral2/files/0x0016000000023c44-167.dat	xmrig
behavioral2/files/0x000b000000023c43-165.dat	xmrig
behavioral2/files/0x0008000000023c4e-164.dat	xmrig
behavioral2/files/0x0008000000023c4a-157.dat	xmrig
behavioral2/files/0x0008000000023c2d-140.dat	xmrig
behavioral2/files/0x0008000000023c2c-138.dat	xmrig
behavioral2/files/0x0008000000023c2a-128.dat	xmrig
behavioral2/files/0x0008000000023c29-123.dat	xmrig
behavioral2/files/0x0008000000023c23-119.dat	xmrig
behavioral2/files/0x0008000000023c11-117.dat	xmrig
behavioral2/files/0x0008000000023c09-111.dat	xmrig
behavioral2/files/0x0008000000023c0f-98.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
1772	elPfSBo.exe
1152	NuoPASy.exe
2708	DXyoAjo.exe
3312	RXGqQvY.exe
2312	iyXabyS.exe
3616	XonETiZ.exe
1468	ysBoYMb.exe
1612	wNsmyPE.exe
3060	IZndPwq.exe
4312	YrJcjAQ.exe
220	ouoAgMm.exe
5068	CEIamJt.exe
4428	bdDogWp.exe
4968	TTSvuyJ.exe
2084	URgLQjz.exe
2260	ZURUhGI.exe
5036	CTiMGQu.exe
1600	KHCxrUX.exe
1684	IbNqKLK.exe
1548	MhLEPKk.exe
4676	tpRBbnq.exe
2628	dMYvdYV.exe
3924	wYYYfTn.exe
4128	qVtMJXw.exe
3584	LPLdZCZ.exe
3236	BdjjzbH.exe
3220	uTSbkMx.exe
456	NcMbLSc.exe
4580	ROcojhF.exe
4608	BUgdwDW.exe
688	VzAvjnr.exe
1672	OyPIiZY.exe
3448	dEqlmtk.exe
2784	DisOSDT.exe
2440	zudOjBH.exe
2568	pJrBZRL.exe
4284	JWXPopA.exe
4720	pOAFkgl.exe
680	zZEZpTj.exe
3020	EUWGkbD.exe
1680	GhTKKYI.exe
4012	EFjlWvz.exe
2012	WsFaLCr.exe
208	rYWaFGa.exe
2236	SQpmFuM.exe
3996	XzCkdQu.exe
2564	ldxhGQG.exe
1660	fgzwZrm.exe
2552	KofzkKI.exe
2636	HemjlgH.exe
1604	svOzwAD.exe
4060	kKPDxSt.exe
4616	UCRIOAC.exe
384	uVmuCCd.exe
4932	QXxJgNr.exe
216	aFKcFnS.exe
336	iAysTqq.exe
3536	QEjlGXc.exe
1516	KZmZHWo.exe
4868	MgZARfU.exe
3196	MGCddtb.exe
4976	sCiKcZf.exe
2856	VXympkL.exe
884	vbkdunB.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\EbgjIPz.exe	12ff182d620de23b9ea753bfd620bd2dfaae819bd4d02a8772788b490a5fd7d9.exe
File created	C:\Windows\System\iqfyKxS.exe	12ff182d620de23b9ea753bfd620bd2dfaae819bd4d02a8772788b490a5fd7d9.exe
File created	C:\Windows\System\PYSyxGo.exe	12ff182d620de23b9ea753bfd620bd2dfaae819bd4d02a8772788b490a5fd7d9.exe
File created	C:\Windows\System\xEJzoVo.exe	12ff182d620de23b9ea753bfd620bd2dfaae819bd4d02a8772788b490a5fd7d9.exe
File created	C:\Windows\System\fADfipX.exe	12ff182d620de23b9ea753bfd620bd2dfaae819bd4d02a8772788b490a5fd7d9.exe
File created	C:\Windows\System\nCSJNrK.exe	12ff182d620de23b9ea753bfd620bd2dfaae819bd4d02a8772788b490a5fd7d9.exe
File created	C:\Windows\System\dLugPcv.exe	12ff182d620de23b9ea753bfd620bd2dfaae819bd4d02a8772788b490a5fd7d9.exe
File created	C:\Windows\System\zxMbzYu.exe	12ff182d620de23b9ea753bfd620bd2dfaae819bd4d02a8772788b490a5fd7d9.exe
File created	C:\Windows\System\wNsmyPE.exe	12ff182d620de23b9ea753bfd620bd2dfaae819bd4d02a8772788b490a5fd7d9.exe
File created	C:\Windows\System\ZURUhGI.exe	12ff182d620de23b9ea753bfd620bd2dfaae819bd4d02a8772788b490a5fd7d9.exe
File created	C:\Windows\System\ykQFfes.exe	12ff182d620de23b9ea753bfd620bd2dfaae819bd4d02a8772788b490a5fd7d9.exe
File created	C:\Windows\System\JcfJDFB.exe	12ff182d620de23b9ea753bfd620bd2dfaae819bd4d02a8772788b490a5fd7d9.exe
File created	C:\Windows\System\zVPkGZq.exe	12ff182d620de23b9ea753bfd620bd2dfaae819bd4d02a8772788b490a5fd7d9.exe
File created	C:\Windows\System\sniZsYb.exe	12ff182d620de23b9ea753bfd620bd2dfaae819bd4d02a8772788b490a5fd7d9.exe
File created	C:\Windows\System\mxOKhbc.exe	12ff182d620de23b9ea753bfd620bd2dfaae819bd4d02a8772788b490a5fd7d9.exe
File created	C:\Windows\System\mFMmAIn.exe	12ff182d620de23b9ea753bfd620bd2dfaae819bd4d02a8772788b490a5fd7d9.exe
File created	C:\Windows\System\mcosQtt.exe	12ff182d620de23b9ea753bfd620bd2dfaae819bd4d02a8772788b490a5fd7d9.exe
File created	C:\Windows\System\MdcpRtC.exe	12ff182d620de23b9ea753bfd620bd2dfaae819bd4d02a8772788b490a5fd7d9.exe
File created	C:\Windows\System\ptcLCFi.exe	12ff182d620de23b9ea753bfd620bd2dfaae819bd4d02a8772788b490a5fd7d9.exe
File created	C:\Windows\System\CTlvKLw.exe	12ff182d620de23b9ea753bfd620bd2dfaae819bd4d02a8772788b490a5fd7d9.exe
File created	C:\Windows\System\QmImBco.exe	12ff182d620de23b9ea753bfd620bd2dfaae819bd4d02a8772788b490a5fd7d9.exe
File created	C:\Windows\System\mUicIwS.exe	12ff182d620de23b9ea753bfd620bd2dfaae819bd4d02a8772788b490a5fd7d9.exe
File created	C:\Windows\System\NqXRubX.exe	12ff182d620de23b9ea753bfd620bd2dfaae819bd4d02a8772788b490a5fd7d9.exe
File created	C:\Windows\System\wmDzuOL.exe	12ff182d620de23b9ea753bfd620bd2dfaae819bd4d02a8772788b490a5fd7d9.exe
File created	C:\Windows\System\ZswJvVf.exe	12ff182d620de23b9ea753bfd620bd2dfaae819bd4d02a8772788b490a5fd7d9.exe
File created	C:\Windows\System\ROuOnHA.exe	12ff182d620de23b9ea753bfd620bd2dfaae819bd4d02a8772788b490a5fd7d9.exe
File created	C:\Windows\System\vuLHENC.exe	12ff182d620de23b9ea753bfd620bd2dfaae819bd4d02a8772788b490a5fd7d9.exe
File created	C:\Windows\System\bTceTmo.exe	12ff182d620de23b9ea753bfd620bd2dfaae819bd4d02a8772788b490a5fd7d9.exe
File created	C:\Windows\System\tbQGWcR.exe	12ff182d620de23b9ea753bfd620bd2dfaae819bd4d02a8772788b490a5fd7d9.exe
File created	C:\Windows\System\kMNslfH.exe	12ff182d620de23b9ea753bfd620bd2dfaae819bd4d02a8772788b490a5fd7d9.exe
File created	C:\Windows\System\mFDUnsg.exe	12ff182d620de23b9ea753bfd620bd2dfaae819bd4d02a8772788b490a5fd7d9.exe
File created	C:\Windows\System\mdssrCY.exe	12ff182d620de23b9ea753bfd620bd2dfaae819bd4d02a8772788b490a5fd7d9.exe
File created	C:\Windows\System\wQJwqNY.exe	12ff182d620de23b9ea753bfd620bd2dfaae819bd4d02a8772788b490a5fd7d9.exe
File created	C:\Windows\System\vTNlxle.exe	12ff182d620de23b9ea753bfd620bd2dfaae819bd4d02a8772788b490a5fd7d9.exe
File created	C:\Windows\System\KQctoay.exe	12ff182d620de23b9ea753bfd620bd2dfaae819bd4d02a8772788b490a5fd7d9.exe
File created	C:\Windows\System\AFosJrm.exe	12ff182d620de23b9ea753bfd620bd2dfaae819bd4d02a8772788b490a5fd7d9.exe
File created	C:\Windows\System\nARSPUX.exe	12ff182d620de23b9ea753bfd620bd2dfaae819bd4d02a8772788b490a5fd7d9.exe
File created	C:\Windows\System\RBiIkpr.exe	12ff182d620de23b9ea753bfd620bd2dfaae819bd4d02a8772788b490a5fd7d9.exe
File created	C:\Windows\System\fbNUCUP.exe	12ff182d620de23b9ea753bfd620bd2dfaae819bd4d02a8772788b490a5fd7d9.exe
File created	C:\Windows\System\lrVoqSJ.exe	12ff182d620de23b9ea753bfd620bd2dfaae819bd4d02a8772788b490a5fd7d9.exe
File created	C:\Windows\System\SQZXylU.exe	12ff182d620de23b9ea753bfd620bd2dfaae819bd4d02a8772788b490a5fd7d9.exe
File created	C:\Windows\System\UrGhgXB.exe	12ff182d620de23b9ea753bfd620bd2dfaae819bd4d02a8772788b490a5fd7d9.exe
File created	C:\Windows\System\AxjCgru.exe	12ff182d620de23b9ea753bfd620bd2dfaae819bd4d02a8772788b490a5fd7d9.exe
File created	C:\Windows\System\UzDkvnN.exe	12ff182d620de23b9ea753bfd620bd2dfaae819bd4d02a8772788b490a5fd7d9.exe
File created	C:\Windows\System\WloEPCL.exe	12ff182d620de23b9ea753bfd620bd2dfaae819bd4d02a8772788b490a5fd7d9.exe
File created	C:\Windows\System\iYiYBFY.exe	12ff182d620de23b9ea753bfd620bd2dfaae819bd4d02a8772788b490a5fd7d9.exe
File created	C:\Windows\System\aJBHJVQ.exe	12ff182d620de23b9ea753bfd620bd2dfaae819bd4d02a8772788b490a5fd7d9.exe
File created	C:\Windows\System\GPyctzq.exe	12ff182d620de23b9ea753bfd620bd2dfaae819bd4d02a8772788b490a5fd7d9.exe
File created	C:\Windows\System\PsvrhqS.exe	12ff182d620de23b9ea753bfd620bd2dfaae819bd4d02a8772788b490a5fd7d9.exe
File created	C:\Windows\System\oeFPnET.exe	12ff182d620de23b9ea753bfd620bd2dfaae819bd4d02a8772788b490a5fd7d9.exe
File created	C:\Windows\System\MDbBBKQ.exe	12ff182d620de23b9ea753bfd620bd2dfaae819bd4d02a8772788b490a5fd7d9.exe
File created	C:\Windows\System\utleKRo.exe	12ff182d620de23b9ea753bfd620bd2dfaae819bd4d02a8772788b490a5fd7d9.exe
File created	C:\Windows\System\tiNKKNi.exe	12ff182d620de23b9ea753bfd620bd2dfaae819bd4d02a8772788b490a5fd7d9.exe
File created	C:\Windows\System\yHqOvIM.exe	12ff182d620de23b9ea753bfd620bd2dfaae819bd4d02a8772788b490a5fd7d9.exe
File created	C:\Windows\System\eLaICUn.exe	12ff182d620de23b9ea753bfd620bd2dfaae819bd4d02a8772788b490a5fd7d9.exe
File created	C:\Windows\System\rYWaFGa.exe	12ff182d620de23b9ea753bfd620bd2dfaae819bd4d02a8772788b490a5fd7d9.exe
File created	C:\Windows\System\lusQfLp.exe	12ff182d620de23b9ea753bfd620bd2dfaae819bd4d02a8772788b490a5fd7d9.exe
File created	C:\Windows\System\xexoklZ.exe	12ff182d620de23b9ea753bfd620bd2dfaae819bd4d02a8772788b490a5fd7d9.exe
File created	C:\Windows\System\wqPUJRM.exe	12ff182d620de23b9ea753bfd620bd2dfaae819bd4d02a8772788b490a5fd7d9.exe
File created	C:\Windows\System\uVmuCCd.exe	12ff182d620de23b9ea753bfd620bd2dfaae819bd4d02a8772788b490a5fd7d9.exe
File created	C:\Windows\System\ouZyDou.exe	12ff182d620de23b9ea753bfd620bd2dfaae819bd4d02a8772788b490a5fd7d9.exe
File created	C:\Windows\System\YMEuDYV.exe	12ff182d620de23b9ea753bfd620bd2dfaae819bd4d02a8772788b490a5fd7d9.exe
File created	C:\Windows\System\AmuZbUc.exe	12ff182d620de23b9ea753bfd620bd2dfaae819bd4d02a8772788b490a5fd7d9.exe
File created	C:\Windows\System\CXUFohG.exe	12ff182d620de23b9ea753bfd620bd2dfaae819bd4d02a8772788b490a5fd7d9.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	15592	dwm.exe
Token: SeChangeNotifyPrivilege	15592	dwm.exe
Token: 33	15592	dwm.exe
Token: SeIncBasePriorityPrivilege	15592	dwm.exe
Token: SeShutdownPrivilege	15592	dwm.exe
Token: SeCreatePagefilePrivilege	15592	dwm.exe
Token: SeShutdownPrivilege	15592	dwm.exe
Token: SeCreatePagefilePrivilege	15592	dwm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 948 wrote to memory of 1772	948	12ff182d620de23b9ea753bfd620bd2dfaae819bd4d02a8772788b490a5fd7d9.exe	83
PID 948 wrote to memory of 1772	948	12ff182d620de23b9ea753bfd620bd2dfaae819bd4d02a8772788b490a5fd7d9.exe	83
PID 948 wrote to memory of 1152	948	12ff182d620de23b9ea753bfd620bd2dfaae819bd4d02a8772788b490a5fd7d9.exe	84
PID 948 wrote to memory of 1152	948	12ff182d620de23b9ea753bfd620bd2dfaae819bd4d02a8772788b490a5fd7d9.exe	84
PID 948 wrote to memory of 2708	948	12ff182d620de23b9ea753bfd620bd2dfaae819bd4d02a8772788b490a5fd7d9.exe	85
PID 948 wrote to memory of 2708	948	12ff182d620de23b9ea753bfd620bd2dfaae819bd4d02a8772788b490a5fd7d9.exe	85
PID 948 wrote to memory of 3312	948	12ff182d620de23b9ea753bfd620bd2dfaae819bd4d02a8772788b490a5fd7d9.exe	86
PID 948 wrote to memory of 3312	948	12ff182d620de23b9ea753bfd620bd2dfaae819bd4d02a8772788b490a5fd7d9.exe	86
PID 948 wrote to memory of 2312	948	12ff182d620de23b9ea753bfd620bd2dfaae819bd4d02a8772788b490a5fd7d9.exe	87
PID 948 wrote to memory of 2312	948	12ff182d620de23b9ea753bfd620bd2dfaae819bd4d02a8772788b490a5fd7d9.exe	87
PID 948 wrote to memory of 3616	948	12ff182d620de23b9ea753bfd620bd2dfaae819bd4d02a8772788b490a5fd7d9.exe	88
PID 948 wrote to memory of 3616	948	12ff182d620de23b9ea753bfd620bd2dfaae819bd4d02a8772788b490a5fd7d9.exe	88
PID 948 wrote to memory of 1468	948	12ff182d620de23b9ea753bfd620bd2dfaae819bd4d02a8772788b490a5fd7d9.exe	89
PID 948 wrote to memory of 1468	948	12ff182d620de23b9ea753bfd620bd2dfaae819bd4d02a8772788b490a5fd7d9.exe	89
PID 948 wrote to memory of 1612	948	12ff182d620de23b9ea753bfd620bd2dfaae819bd4d02a8772788b490a5fd7d9.exe	90
PID 948 wrote to memory of 1612	948	12ff182d620de23b9ea753bfd620bd2dfaae819bd4d02a8772788b490a5fd7d9.exe	90
PID 948 wrote to memory of 3060	948	12ff182d620de23b9ea753bfd620bd2dfaae819bd4d02a8772788b490a5fd7d9.exe	91
PID 948 wrote to memory of 3060	948	12ff182d620de23b9ea753bfd620bd2dfaae819bd4d02a8772788b490a5fd7d9.exe	91
PID 948 wrote to memory of 4312	948	12ff182d620de23b9ea753bfd620bd2dfaae819bd4d02a8772788b490a5fd7d9.exe	92
PID 948 wrote to memory of 4312	948	12ff182d620de23b9ea753bfd620bd2dfaae819bd4d02a8772788b490a5fd7d9.exe	92
PID 948 wrote to memory of 220	948	12ff182d620de23b9ea753bfd620bd2dfaae819bd4d02a8772788b490a5fd7d9.exe	93
PID 948 wrote to memory of 220	948	12ff182d620de23b9ea753bfd620bd2dfaae819bd4d02a8772788b490a5fd7d9.exe	93
PID 948 wrote to memory of 5068	948	12ff182d620de23b9ea753bfd620bd2dfaae819bd4d02a8772788b490a5fd7d9.exe	94
PID 948 wrote to memory of 5068	948	12ff182d620de23b9ea753bfd620bd2dfaae819bd4d02a8772788b490a5fd7d9.exe	94
PID 948 wrote to memory of 4428	948	12ff182d620de23b9ea753bfd620bd2dfaae819bd4d02a8772788b490a5fd7d9.exe	95
PID 948 wrote to memory of 4428	948	12ff182d620de23b9ea753bfd620bd2dfaae819bd4d02a8772788b490a5fd7d9.exe	95
PID 948 wrote to memory of 4968	948	12ff182d620de23b9ea753bfd620bd2dfaae819bd4d02a8772788b490a5fd7d9.exe	96
PID 948 wrote to memory of 4968	948	12ff182d620de23b9ea753bfd620bd2dfaae819bd4d02a8772788b490a5fd7d9.exe	96
PID 948 wrote to memory of 2084	948	12ff182d620de23b9ea753bfd620bd2dfaae819bd4d02a8772788b490a5fd7d9.exe	97
PID 948 wrote to memory of 2084	948	12ff182d620de23b9ea753bfd620bd2dfaae819bd4d02a8772788b490a5fd7d9.exe	97
PID 948 wrote to memory of 2260	948	12ff182d620de23b9ea753bfd620bd2dfaae819bd4d02a8772788b490a5fd7d9.exe	98
PID 948 wrote to memory of 2260	948	12ff182d620de23b9ea753bfd620bd2dfaae819bd4d02a8772788b490a5fd7d9.exe	98
PID 948 wrote to memory of 1548	948	12ff182d620de23b9ea753bfd620bd2dfaae819bd4d02a8772788b490a5fd7d9.exe	99
PID 948 wrote to memory of 1548	948	12ff182d620de23b9ea753bfd620bd2dfaae819bd4d02a8772788b490a5fd7d9.exe	99
PID 948 wrote to memory of 5036	948	12ff182d620de23b9ea753bfd620bd2dfaae819bd4d02a8772788b490a5fd7d9.exe	100
PID 948 wrote to memory of 5036	948	12ff182d620de23b9ea753bfd620bd2dfaae819bd4d02a8772788b490a5fd7d9.exe	100
PID 948 wrote to memory of 1600	948	12ff182d620de23b9ea753bfd620bd2dfaae819bd4d02a8772788b490a5fd7d9.exe	101
PID 948 wrote to memory of 1600	948	12ff182d620de23b9ea753bfd620bd2dfaae819bd4d02a8772788b490a5fd7d9.exe	101
PID 948 wrote to memory of 1684	948	12ff182d620de23b9ea753bfd620bd2dfaae819bd4d02a8772788b490a5fd7d9.exe	102
PID 948 wrote to memory of 1684	948	12ff182d620de23b9ea753bfd620bd2dfaae819bd4d02a8772788b490a5fd7d9.exe	102
PID 948 wrote to memory of 4676	948	12ff182d620de23b9ea753bfd620bd2dfaae819bd4d02a8772788b490a5fd7d9.exe	103
PID 948 wrote to memory of 4676	948	12ff182d620de23b9ea753bfd620bd2dfaae819bd4d02a8772788b490a5fd7d9.exe	103
PID 948 wrote to memory of 2628	948	12ff182d620de23b9ea753bfd620bd2dfaae819bd4d02a8772788b490a5fd7d9.exe	104
PID 948 wrote to memory of 2628	948	12ff182d620de23b9ea753bfd620bd2dfaae819bd4d02a8772788b490a5fd7d9.exe	104
PID 948 wrote to memory of 3924	948	12ff182d620de23b9ea753bfd620bd2dfaae819bd4d02a8772788b490a5fd7d9.exe	105
PID 948 wrote to memory of 3924	948	12ff182d620de23b9ea753bfd620bd2dfaae819bd4d02a8772788b490a5fd7d9.exe	105
PID 948 wrote to memory of 4128	948	12ff182d620de23b9ea753bfd620bd2dfaae819bd4d02a8772788b490a5fd7d9.exe	106
PID 948 wrote to memory of 4128	948	12ff182d620de23b9ea753bfd620bd2dfaae819bd4d02a8772788b490a5fd7d9.exe	106
PID 948 wrote to memory of 3584	948	12ff182d620de23b9ea753bfd620bd2dfaae819bd4d02a8772788b490a5fd7d9.exe	107
PID 948 wrote to memory of 3584	948	12ff182d620de23b9ea753bfd620bd2dfaae819bd4d02a8772788b490a5fd7d9.exe	107
PID 948 wrote to memory of 3236	948	12ff182d620de23b9ea753bfd620bd2dfaae819bd4d02a8772788b490a5fd7d9.exe	108
PID 948 wrote to memory of 3236	948	12ff182d620de23b9ea753bfd620bd2dfaae819bd4d02a8772788b490a5fd7d9.exe	108
PID 948 wrote to memory of 3220	948	12ff182d620de23b9ea753bfd620bd2dfaae819bd4d02a8772788b490a5fd7d9.exe	109
PID 948 wrote to memory of 3220	948	12ff182d620de23b9ea753bfd620bd2dfaae819bd4d02a8772788b490a5fd7d9.exe	109
PID 948 wrote to memory of 456	948	12ff182d620de23b9ea753bfd620bd2dfaae819bd4d02a8772788b490a5fd7d9.exe	110
PID 948 wrote to memory of 456	948	12ff182d620de23b9ea753bfd620bd2dfaae819bd4d02a8772788b490a5fd7d9.exe	110
PID 948 wrote to memory of 4580	948	12ff182d620de23b9ea753bfd620bd2dfaae819bd4d02a8772788b490a5fd7d9.exe	111
PID 948 wrote to memory of 4580	948	12ff182d620de23b9ea753bfd620bd2dfaae819bd4d02a8772788b490a5fd7d9.exe	111
PID 948 wrote to memory of 4608	948	12ff182d620de23b9ea753bfd620bd2dfaae819bd4d02a8772788b490a5fd7d9.exe	112
PID 948 wrote to memory of 4608	948	12ff182d620de23b9ea753bfd620bd2dfaae819bd4d02a8772788b490a5fd7d9.exe	112
PID 948 wrote to memory of 688	948	12ff182d620de23b9ea753bfd620bd2dfaae819bd4d02a8772788b490a5fd7d9.exe	113
PID 948 wrote to memory of 688	948	12ff182d620de23b9ea753bfd620bd2dfaae819bd4d02a8772788b490a5fd7d9.exe	113
PID 948 wrote to memory of 1672	948	12ff182d620de23b9ea753bfd620bd2dfaae819bd4d02a8772788b490a5fd7d9.exe	114
PID 948 wrote to memory of 1672	948	12ff182d620de23b9ea753bfd620bd2dfaae819bd4d02a8772788b490a5fd7d9.exe	114

C:\Users\Admin\AppData\Local\Temp\12ff182d620de23b9ea753bfd620bd2dfaae819bd4d02a8772788b490a5fd7d9.exe
"C:\Users\Admin\AppData\Local\Temp\12ff182d620de23b9ea753bfd620bd2dfaae819bd4d02a8772788b490a5fd7d9.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:948
- C:\Windows\System\elPfSBo.exe
  C:\Windows\System\elPfSBo.exe
  2⤵
  - Executes dropped EXE
  PID:1772
- C:\Windows\System\NuoPASy.exe
  C:\Windows\System\NuoPASy.exe
  2⤵
  - Executes dropped EXE
  PID:1152
- C:\Windows\System\DXyoAjo.exe
  C:\Windows\System\DXyoAjo.exe
  2⤵
  - Executes dropped EXE
  PID:2708
- C:\Windows\System\RXGqQvY.exe
  C:\Windows\System\RXGqQvY.exe
  2⤵
  - Executes dropped EXE
  PID:3312
- C:\Windows\System\iyXabyS.exe
  C:\Windows\System\iyXabyS.exe
  2⤵
  - Executes dropped EXE
  PID:2312
- C:\Windows\System\XonETiZ.exe
  C:\Windows\System\XonETiZ.exe
  2⤵
  - Executes dropped EXE
  PID:3616
- C:\Windows\System\ysBoYMb.exe
  C:\Windows\System\ysBoYMb.exe
  2⤵
  - Executes dropped EXE
  PID:1468
- C:\Windows\System\wNsmyPE.exe
  C:\Windows\System\wNsmyPE.exe
  2⤵
  - Executes dropped EXE
  PID:1612
- C:\Windows\System\IZndPwq.exe
  C:\Windows\System\IZndPwq.exe
  2⤵
  - Executes dropped EXE
  PID:3060
- C:\Windows\System\YrJcjAQ.exe
  C:\Windows\System\YrJcjAQ.exe
  2⤵
  - Executes dropped EXE
  PID:4312
- C:\Windows\System\ouoAgMm.exe
  C:\Windows\System\ouoAgMm.exe
  2⤵
  - Executes dropped EXE
  PID:220
- C:\Windows\System\CEIamJt.exe
  C:\Windows\System\CEIamJt.exe
  2⤵
  - Executes dropped EXE
  PID:5068
- C:\Windows\System\bdDogWp.exe
  C:\Windows\System\bdDogWp.exe
  2⤵
  - Executes dropped EXE
  PID:4428
- C:\Windows\System\TTSvuyJ.exe
  C:\Windows\System\TTSvuyJ.exe
  2⤵
  - Executes dropped EXE
  PID:4968
- C:\Windows\System\URgLQjz.exe
  C:\Windows\System\URgLQjz.exe
  2⤵
  - Executes dropped EXE
  PID:2084
- C:\Windows\System\ZURUhGI.exe
  C:\Windows\System\ZURUhGI.exe
  2⤵
  - Executes dropped EXE
  PID:2260
- C:\Windows\System\MhLEPKk.exe
  C:\Windows\System\MhLEPKk.exe
  2⤵
  - Executes dropped EXE
  PID:1548
- C:\Windows\System\CTiMGQu.exe
  C:\Windows\System\CTiMGQu.exe
  2⤵
  - Executes dropped EXE
  PID:5036
- C:\Windows\System\KHCxrUX.exe
  C:\Windows\System\KHCxrUX.exe
  2⤵
  - Executes dropped EXE
  PID:1600
- C:\Windows\System\IbNqKLK.exe
  C:\Windows\System\IbNqKLK.exe
  2⤵
  - Executes dropped EXE
  PID:1684
- C:\Windows\System\tpRBbnq.exe
  C:\Windows\System\tpRBbnq.exe
  2⤵
  - Executes dropped EXE
  PID:4676
- C:\Windows\System\dMYvdYV.exe
  C:\Windows\System\dMYvdYV.exe
  2⤵
  - Executes dropped EXE
  PID:2628
- C:\Windows\System\wYYYfTn.exe
  C:\Windows\System\wYYYfTn.exe
  2⤵
  - Executes dropped EXE
  PID:3924
- C:\Windows\System\qVtMJXw.exe
  C:\Windows\System\qVtMJXw.exe
  2⤵
  - Executes dropped EXE
  PID:4128
- C:\Windows\System\LPLdZCZ.exe
  C:\Windows\System\LPLdZCZ.exe
  2⤵
  - Executes dropped EXE
  PID:3584
- C:\Windows\System\BdjjzbH.exe
  C:\Windows\System\BdjjzbH.exe
  2⤵
  - Executes dropped EXE
  PID:3236
- C:\Windows\System\uTSbkMx.exe
  C:\Windows\System\uTSbkMx.exe
  2⤵
  - Executes dropped EXE
  PID:3220
- C:\Windows\System\NcMbLSc.exe
  C:\Windows\System\NcMbLSc.exe
  2⤵
  - Executes dropped EXE
  PID:456
- C:\Windows\System\ROcojhF.exe
  C:\Windows\System\ROcojhF.exe
  2⤵
  - Executes dropped EXE
  PID:4580
- C:\Windows\System\BUgdwDW.exe
  C:\Windows\System\BUgdwDW.exe
  2⤵
  - Executes dropped EXE
  PID:4608
- C:\Windows\System\VzAvjnr.exe
  C:\Windows\System\VzAvjnr.exe
  2⤵
  - Executes dropped EXE
  PID:688
- C:\Windows\System\OyPIiZY.exe
  C:\Windows\System\OyPIiZY.exe
  2⤵
  - Executes dropped EXE
  PID:1672
- C:\Windows\System\dEqlmtk.exe
  C:\Windows\System\dEqlmtk.exe
  2⤵
  - Executes dropped EXE
  PID:3448
- C:\Windows\System\DisOSDT.exe
  C:\Windows\System\DisOSDT.exe
  2⤵
  - Executes dropped EXE
  PID:2784
- C:\Windows\System\zudOjBH.exe
  C:\Windows\System\zudOjBH.exe
  2⤵
  - Executes dropped EXE
  PID:2440
- C:\Windows\System\pJrBZRL.exe
  C:\Windows\System\pJrBZRL.exe
  2⤵
  - Executes dropped EXE
  PID:2568
- C:\Windows\System\JWXPopA.exe
  C:\Windows\System\JWXPopA.exe
  2⤵
  - Executes dropped EXE
  PID:4284
- C:\Windows\System\pOAFkgl.exe
  C:\Windows\System\pOAFkgl.exe
  2⤵
  - Executes dropped EXE
  PID:4720
- C:\Windows\System\zZEZpTj.exe
  C:\Windows\System\zZEZpTj.exe
  2⤵
  - Executes dropped EXE
  PID:680
- C:\Windows\System\EUWGkbD.exe
  C:\Windows\System\EUWGkbD.exe
  2⤵
  - Executes dropped EXE
  PID:3020
- C:\Windows\System\GhTKKYI.exe
  C:\Windows\System\GhTKKYI.exe
  2⤵
  - Executes dropped EXE
  PID:1680
- C:\Windows\System\EFjlWvz.exe
  C:\Windows\System\EFjlWvz.exe
  2⤵
  - Executes dropped EXE
  PID:4012
- C:\Windows\System\WsFaLCr.exe
  C:\Windows\System\WsFaLCr.exe
  2⤵
  - Executes dropped EXE
  PID:2012
- C:\Windows\System\rYWaFGa.exe
  C:\Windows\System\rYWaFGa.exe
  2⤵
  - Executes dropped EXE
  PID:208
- C:\Windows\System\SQpmFuM.exe
  C:\Windows\System\SQpmFuM.exe
  2⤵
  - Executes dropped EXE
  PID:2236
- C:\Windows\System\XzCkdQu.exe
  C:\Windows\System\XzCkdQu.exe
  2⤵
  - Executes dropped EXE
  PID:3996
- C:\Windows\System\ldxhGQG.exe
  C:\Windows\System\ldxhGQG.exe
  2⤵
  - Executes dropped EXE
  PID:2564
- C:\Windows\System\fgzwZrm.exe
  C:\Windows\System\fgzwZrm.exe
  2⤵
  - Executes dropped EXE
  PID:1660
- C:\Windows\System\KofzkKI.exe
  C:\Windows\System\KofzkKI.exe
  2⤵
  - Executes dropped EXE
  PID:2552
- C:\Windows\System\HemjlgH.exe
  C:\Windows\System\HemjlgH.exe
  2⤵
  - Executes dropped EXE
  PID:2636
- C:\Windows\System\svOzwAD.exe
  C:\Windows\System\svOzwAD.exe
  2⤵
  - Executes dropped EXE
  PID:1604
- C:\Windows\System\kKPDxSt.exe
  C:\Windows\System\kKPDxSt.exe
  2⤵
  - Executes dropped EXE
  PID:4060
- C:\Windows\System\UCRIOAC.exe
  C:\Windows\System\UCRIOAC.exe
  2⤵
  - Executes dropped EXE
  PID:4616
- C:\Windows\System\uVmuCCd.exe
  C:\Windows\System\uVmuCCd.exe
  2⤵
  - Executes dropped EXE
  PID:384
- C:\Windows\System\QXxJgNr.exe
  C:\Windows\System\QXxJgNr.exe
  2⤵
  - Executes dropped EXE
  PID:4932
- C:\Windows\System\aFKcFnS.exe
  C:\Windows\System\aFKcFnS.exe
  2⤵
  - Executes dropped EXE
  PID:216
- C:\Windows\System\iAysTqq.exe
  C:\Windows\System\iAysTqq.exe
  2⤵
  - Executes dropped EXE
  PID:336
- C:\Windows\System\QEjlGXc.exe
  C:\Windows\System\QEjlGXc.exe
  2⤵
  - Executes dropped EXE
  PID:3536
- C:\Windows\System\KZmZHWo.exe
  C:\Windows\System\KZmZHWo.exe
  2⤵
  - Executes dropped EXE
  PID:1516
- C:\Windows\System\MgZARfU.exe
  C:\Windows\System\MgZARfU.exe
  2⤵
  - Executes dropped EXE
  PID:4868
- C:\Windows\System\MGCddtb.exe
  C:\Windows\System\MGCddtb.exe
  2⤵
  - Executes dropped EXE
  PID:3196
- C:\Windows\System\sCiKcZf.exe
  C:\Windows\System\sCiKcZf.exe
  2⤵
  - Executes dropped EXE
  PID:4976
- C:\Windows\System\VXympkL.exe
  C:\Windows\System\VXympkL.exe
  2⤵
  - Executes dropped EXE
  PID:2856
- C:\Windows\System\vbkdunB.exe
  C:\Windows\System\vbkdunB.exe
  2⤵
  - Executes dropped EXE
  PID:884
- C:\Windows\System\LYgmQah.exe
  C:\Windows\System\LYgmQah.exe
  2⤵
  PID:4228
- C:\Windows\System\mWdmbEJ.exe
  C:\Windows\System\mWdmbEJ.exe
  2⤵
  PID:3480
- C:\Windows\System\MBoAqlu.exe
  C:\Windows\System\MBoAqlu.exe
  2⤵
  PID:668
- C:\Windows\System\kcyfEQK.exe
  C:\Windows\System\kcyfEQK.exe
  2⤵
  PID:2144
- C:\Windows\System\UukohhE.exe
  C:\Windows\System\UukohhE.exe
  2⤵
  PID:3760
- C:\Windows\System\qADGmLi.exe
  C:\Windows\System\qADGmLi.exe
  2⤵
  PID:4412
- C:\Windows\System\ZmoEqrL.exe
  C:\Windows\System\ZmoEqrL.exe
  2⤵
  PID:776
- C:\Windows\System\yujUIPP.exe
  C:\Windows\System\yujUIPP.exe
  2⤵
  PID:4400
- C:\Windows\System\fjqIfBs.exe
  C:\Windows\System\fjqIfBs.exe
  2⤵
  PID:4212
- C:\Windows\System\rmLAKdK.exe
  C:\Windows\System\rmLAKdK.exe
  2⤵
  PID:5056
- C:\Windows\System\oJjjBQo.exe
  C:\Windows\System\oJjjBQo.exe
  2⤵
  PID:3268
- C:\Windows\System\uumIVLf.exe
  C:\Windows\System\uumIVLf.exe
  2⤵
  PID:3568
- C:\Windows\System\uwYEJCG.exe
  C:\Windows\System\uwYEJCG.exe
  2⤵
  PID:3676
- C:\Windows\System\rFurzpZ.exe
  C:\Windows\System\rFurzpZ.exe
  2⤵
  PID:1076
- C:\Windows\System\vwOgIkx.exe
  C:\Windows\System\vwOgIkx.exe
  2⤵
  PID:2820
- C:\Windows\System\gVyuxaZ.exe
  C:\Windows\System\gVyuxaZ.exe
  2⤵
  PID:4160
- C:\Windows\System\lVvobxr.exe
  C:\Windows\System\lVvobxr.exe
  2⤵
  PID:3460
- C:\Windows\System\Ystwxky.exe
  C:\Windows\System\Ystwxky.exe
  2⤵
  PID:3248
- C:\Windows\System\MFZAvDg.exe
  C:\Windows\System\MFZAvDg.exe
  2⤵
  PID:1948
- C:\Windows\System\EILWXcA.exe
  C:\Windows\System\EILWXcA.exe
  2⤵
  PID:448
- C:\Windows\System\UFnbdsw.exe
  C:\Windows\System\UFnbdsw.exe
  2⤵
  PID:1020
- C:\Windows\System\QFAyaDw.exe
  C:\Windows\System\QFAyaDw.exe
  2⤵
  PID:1828
- C:\Windows\System\HgZeYpW.exe
  C:\Windows\System\HgZeYpW.exe
  2⤵
  PID:3332
- C:\Windows\System\bNZPoRk.exe
  C:\Windows\System\bNZPoRk.exe
  2⤵
  PID:4984
- C:\Windows\System\SwDBEOy.exe
  C:\Windows\System\SwDBEOy.exe
  2⤵
  PID:4752
- C:\Windows\System\jnItfIT.exe
  C:\Windows\System\jnItfIT.exe
  2⤵
  PID:3640
- C:\Windows\System\lusQfLp.exe
  C:\Windows\System\lusQfLp.exe
  2⤵
  PID:4672
- C:\Windows\System\eJSOFzO.exe
  C:\Windows\System\eJSOFzO.exe
  2⤵
  PID:4004
- C:\Windows\System\rUzlwzP.exe
  C:\Windows\System\rUzlwzP.exe
  2⤵
  PID:2800
- C:\Windows\System\tYCSYSB.exe
  C:\Windows\System\tYCSYSB.exe
  2⤵
  PID:4596
- C:\Windows\System\LkbZICQ.exe
  C:\Windows\System\LkbZICQ.exe
  2⤵
  PID:4836
- C:\Windows\System\lzWKNSM.exe
  C:\Windows\System\lzWKNSM.exe
  2⤵
  PID:1532
- C:\Windows\System\fbNUCUP.exe
  C:\Windows\System\fbNUCUP.exe
  2⤵
  PID:1848
- C:\Windows\System\uDzRwbK.exe
  C:\Windows\System\uDzRwbK.exe
  2⤵
  PID:1704
- C:\Windows\System\alNSUGh.exe
  C:\Windows\System\alNSUGh.exe
  2⤵
  PID:4844
- C:\Windows\System\JjMhUPv.exe
  C:\Windows\System\JjMhUPv.exe
  2⤵
  PID:1912
- C:\Windows\System\zltfEiT.exe
  C:\Windows\System\zltfEiT.exe
  2⤵
  PID:1184
- C:\Windows\System\xKmKprc.exe
  C:\Windows\System\xKmKprc.exe
  2⤵
  PID:5080
- C:\Windows\System\BCLToqr.exe
  C:\Windows\System\BCLToqr.exe
  2⤵
  PID:1972
- C:\Windows\System\IcDMBWl.exe
  C:\Windows\System\IcDMBWl.exe
  2⤵
  PID:4840
- C:\Windows\System\ouZyDou.exe
  C:\Windows\System\ouZyDou.exe
  2⤵
  PID:2520
- C:\Windows\System\UchguKP.exe
  C:\Windows\System\UchguKP.exe
  2⤵
  PID:3340
- C:\Windows\System\lPEnxeT.exe
  C:\Windows\System\lPEnxeT.exe
  2⤵
  PID:2064
- C:\Windows\System\KJLhcoZ.exe
  C:\Windows\System\KJLhcoZ.exe
  2⤵
  PID:3168
- C:\Windows\System\QmImBco.exe
  C:\Windows\System\QmImBco.exe
  2⤵
  PID:1744
- C:\Windows\System\SceByUD.exe
  C:\Windows\System\SceByUD.exe
  2⤵
  PID:4724
- C:\Windows\System\JdBqUGU.exe
  C:\Windows\System\JdBqUGU.exe
  2⤵
  PID:1784
- C:\Windows\System\GFwRZXk.exe
  C:\Windows\System\GFwRZXk.exe
  2⤵
  PID:1616
- C:\Windows\System\oFJjmjG.exe
  C:\Windows\System\oFJjmjG.exe
  2⤵
  PID:3944
- C:\Windows\System\MFcDDrW.exe
  C:\Windows\System\MFcDDrW.exe
  2⤵
  PID:4036
- C:\Windows\System\XPnjvtk.exe
  C:\Windows\System\XPnjvtk.exe
  2⤵
  PID:3528
- C:\Windows\System\JcTqbYy.exe
  C:\Windows\System\JcTqbYy.exe
  2⤵
  PID:4152
- C:\Windows\System\XmQcZeq.exe
  C:\Windows\System\XmQcZeq.exe
  2⤵
  PID:1808
- C:\Windows\System\qjTXlzf.exe
  C:\Windows\System\qjTXlzf.exe
  2⤵
  PID:5140
- C:\Windows\System\iukVmeH.exe
  C:\Windows\System\iukVmeH.exe
  2⤵
  PID:5172
- C:\Windows\System\JyObKpp.exe
  C:\Windows\System\JyObKpp.exe
  2⤵
  PID:5208
- C:\Windows\System\wrpZuCj.exe
  C:\Windows\System\wrpZuCj.exe
  2⤵
  PID:5224
- C:\Windows\System\GmAJHJG.exe
  C:\Windows\System\GmAJHJG.exe
  2⤵
  PID:5252
- C:\Windows\System\dHYgviy.exe
  C:\Windows\System\dHYgviy.exe
  2⤵
  PID:5280
- C:\Windows\System\rLPVbQO.exe
  C:\Windows\System\rLPVbQO.exe
  2⤵
  PID:5308
- C:\Windows\System\kNHnRiU.exe
  C:\Windows\System\kNHnRiU.exe
  2⤵
  PID:5336
- C:\Windows\System\wmzhQjg.exe
  C:\Windows\System\wmzhQjg.exe
  2⤵
  PID:5364
- C:\Windows\System\sYuUQUa.exe
  C:\Windows\System\sYuUQUa.exe
  2⤵
  PID:5392
- C:\Windows\System\fADfipX.exe
  C:\Windows\System\fADfipX.exe
  2⤵
  PID:5420
- C:\Windows\System\eMApazv.exe
  C:\Windows\System\eMApazv.exe
  2⤵
  PID:5448
- C:\Windows\System\DVjFgjT.exe
  C:\Windows\System\DVjFgjT.exe
  2⤵
  PID:5476
- C:\Windows\System\CfowRFU.exe
  C:\Windows\System\CfowRFU.exe
  2⤵
  PID:5504
- C:\Windows\System\xTVjVMa.exe
  C:\Windows\System\xTVjVMa.exe
  2⤵
  PID:5532
- C:\Windows\System\Xljahmt.exe
  C:\Windows\System\Xljahmt.exe
  2⤵
  PID:5560
- C:\Windows\System\fRzqVMv.exe
  C:\Windows\System\fRzqVMv.exe
  2⤵
  PID:5588
- C:\Windows\System\atHYFhQ.exe
  C:\Windows\System\atHYFhQ.exe
  2⤵
  PID:5608
- C:\Windows\System\ZIffoJh.exe
  C:\Windows\System\ZIffoJh.exe
  2⤵
  PID:5632
- C:\Windows\System\UeMxQin.exe
  C:\Windows\System\UeMxQin.exe
  2⤵
  PID:5660
- C:\Windows\System\DVmZjkc.exe
  C:\Windows\System\DVmZjkc.exe
  2⤵
  PID:5704
- C:\Windows\System\XYyukxd.exe
  C:\Windows\System\XYyukxd.exe
  2⤵
  PID:5728
- C:\Windows\System\EKionAr.exe
  C:\Windows\System\EKionAr.exe
  2⤵
  PID:5756
- C:\Windows\System\mUicIwS.exe
  C:\Windows\System\mUicIwS.exe
  2⤵
  PID:5784
- C:\Windows\System\BlexXJH.exe
  C:\Windows\System\BlexXJH.exe
  2⤵
  PID:5812
- C:\Windows\System\HpJtHQp.exe
  C:\Windows\System\HpJtHQp.exe
  2⤵
  PID:5840
- C:\Windows\System\PugSGDh.exe
  C:\Windows\System\PugSGDh.exe
  2⤵
  PID:5856
- C:\Windows\System\vDHTjHk.exe
  C:\Windows\System\vDHTjHk.exe
  2⤵
  PID:5884
- C:\Windows\System\zpxpKOE.exe
  C:\Windows\System\zpxpKOE.exe
  2⤵
  PID:5912
- C:\Windows\System\lXEvNbh.exe
  C:\Windows\System\lXEvNbh.exe
  2⤵
  PID:5940
- C:\Windows\System\HWIIzUc.exe
  C:\Windows\System\HWIIzUc.exe
  2⤵
  PID:5968
- C:\Windows\System\QqbyVXx.exe
  C:\Windows\System\QqbyVXx.exe
  2⤵
  PID:5996
- C:\Windows\System\dQPibds.exe
  C:\Windows\System\dQPibds.exe
  2⤵
  PID:6024
- C:\Windows\System\ZewDaOe.exe
  C:\Windows\System\ZewDaOe.exe
  2⤵
  PID:6056
- C:\Windows\System\EADPEpz.exe
  C:\Windows\System\EADPEpz.exe
  2⤵
  PID:6084
- C:\Windows\System\UCRsAiJ.exe
  C:\Windows\System\UCRsAiJ.exe
  2⤵
  PID:6120
- C:\Windows\System\qRaIViL.exe
  C:\Windows\System\qRaIViL.exe
  2⤵
  PID:6136
- C:\Windows\System\MjzFTDT.exe
  C:\Windows\System\MjzFTDT.exe
  2⤵
  PID:5152
- C:\Windows\System\wbYgyzl.exe
  C:\Windows\System\wbYgyzl.exe
  2⤵
  PID:5216
- C:\Windows\System\oCPfcPf.exe
  C:\Windows\System\oCPfcPf.exe
  2⤵
  PID:5244
- C:\Windows\System\AnaqbsG.exe
  C:\Windows\System\AnaqbsG.exe
  2⤵
  PID:5328
- C:\Windows\System\sudeSgm.exe
  C:\Windows\System\sudeSgm.exe
  2⤵
  PID:5416
- C:\Windows\System\utleKRo.exe
  C:\Windows\System\utleKRo.exe
  2⤵
  PID:5520
- C:\Windows\System\EkKpODc.exe
  C:\Windows\System\EkKpODc.exe
  2⤵
  PID:5544
- C:\Windows\System\ZswJvVf.exe
  C:\Windows\System\ZswJvVf.exe
  2⤵
  PID:5600
- C:\Windows\System\KpDSKVW.exe
  C:\Windows\System\KpDSKVW.exe
  2⤵
  PID:5680
- C:\Windows\System\LjBsORl.exe
  C:\Windows\System\LjBsORl.exe
  2⤵
  PID:5776
- C:\Windows\System\SZEANzq.exe
  C:\Windows\System\SZEANzq.exe
  2⤵
  PID:5832
- C:\Windows\System\EYCNqVY.exe
  C:\Windows\System\EYCNqVY.exe
  2⤵
  PID:5868
- C:\Windows\System\BQFXygR.exe
  C:\Windows\System\BQFXygR.exe
  2⤵
  PID:5952
- C:\Windows\System\hHZLwjn.exe
  C:\Windows\System\hHZLwjn.exe
  2⤵
  PID:6012
- C:\Windows\System\MMyJHZe.exe
  C:\Windows\System\MMyJHZe.exe
  2⤵
  PID:6104
- C:\Windows\System\UrZnQyX.exe
  C:\Windows\System\UrZnQyX.exe
  2⤵
  PID:5180
- C:\Windows\System\BWlcZsN.exe
  C:\Windows\System\BWlcZsN.exe
  2⤵
  PID:5248
- C:\Windows\System\bfzqLhZ.exe
  C:\Windows\System\bfzqLhZ.exe
  2⤵
  PID:5404
- C:\Windows\System\lXhbntz.exe
  C:\Windows\System\lXhbntz.exe
  2⤵
  PID:5552
- C:\Windows\System\nXWZnnB.exe
  C:\Windows\System\nXWZnnB.exe
  2⤵
  PID:5656
- C:\Windows\System\SnZNFYC.exe
  C:\Windows\System\SnZNFYC.exe
  2⤵
  PID:5872
- C:\Windows\System\dJLvgxK.exe
  C:\Windows\System\dJLvgxK.exe
  2⤵
  PID:6016
- C:\Windows\System\UrGhgXB.exe
  C:\Windows\System\UrGhgXB.exe
  2⤵
  PID:6072
- C:\Windows\System\JsqEbMU.exe
  C:\Windows\System\JsqEbMU.exe
  2⤵
  PID:5468
- C:\Windows\System\TedaYwj.exe
  C:\Windows\System\TedaYwj.exe
  2⤵
  PID:5804
- C:\Windows\System\lrVoqSJ.exe
  C:\Windows\System\lrVoqSJ.exe
  2⤵
  PID:5384
- C:\Windows\System\LGRdCZA.exe
  C:\Windows\System\LGRdCZA.exe
  2⤵
  PID:3820
- C:\Windows\System\UTDjkbt.exe
  C:\Windows\System\UTDjkbt.exe
  2⤵
  PID:5768
- C:\Windows\System\PnXHkwE.exe
  C:\Windows\System\PnXHkwE.exe
  2⤵
  PID:6156
- C:\Windows\System\PTSzygQ.exe
  C:\Windows\System\PTSzygQ.exe
  2⤵
  PID:6192
- C:\Windows\System\xkLGeFW.exe
  C:\Windows\System\xkLGeFW.exe
  2⤵
  PID:6224
- C:\Windows\System\hzXnOED.exe
  C:\Windows\System\hzXnOED.exe
  2⤵
  PID:6252
- C:\Windows\System\AFosJrm.exe
  C:\Windows\System\AFosJrm.exe
  2⤵
  PID:6280
- C:\Windows\System\RwsAUUy.exe
  C:\Windows\System\RwsAUUy.exe
  2⤵
  PID:6308
- C:\Windows\System\IZilAUQ.exe
  C:\Windows\System\IZilAUQ.exe
  2⤵
  PID:6332
- C:\Windows\System\JDnqzxp.exe
  C:\Windows\System\JDnqzxp.exe
  2⤵
  PID:6360
- C:\Windows\System\lMakQEH.exe
  C:\Windows\System\lMakQEH.exe
  2⤵
  PID:6392
- C:\Windows\System\odHUkdA.exe
  C:\Windows\System\odHUkdA.exe
  2⤵
  PID:6420
- C:\Windows\System\AxjCgru.exe
  C:\Windows\System\AxjCgru.exe
  2⤵
  PID:6444
- C:\Windows\System\MsOxHEc.exe
  C:\Windows\System\MsOxHEc.exe
  2⤵
  PID:6460
- C:\Windows\System\jggljas.exe
  C:\Windows\System\jggljas.exe
  2⤵
  PID:6492
- C:\Windows\System\UroFZQe.exe
  C:\Windows\System\UroFZQe.exe
  2⤵
  PID:6516
- C:\Windows\System\xweGYRa.exe
  C:\Windows\System\xweGYRa.exe
  2⤵
  PID:6548
- C:\Windows\System\nUNhssO.exe
  C:\Windows\System\nUNhssO.exe
  2⤵
  PID:6572
- C:\Windows\System\JuUmALK.exe
  C:\Windows\System\JuUmALK.exe
  2⤵
  PID:6596
- C:\Windows\System\Itruqcj.exe
  C:\Windows\System\Itruqcj.exe
  2⤵
  PID:6628
- C:\Windows\System\njIVZeD.exe
  C:\Windows\System\njIVZeD.exe
  2⤵
  PID:6668
- C:\Windows\System\mnKmmBS.exe
  C:\Windows\System\mnKmmBS.exe
  2⤵
  PID:6708
- C:\Windows\System\PPfldbp.exe
  C:\Windows\System\PPfldbp.exe
  2⤵
  PID:6728
- C:\Windows\System\oLGfqZM.exe
  C:\Windows\System\oLGfqZM.exe
  2⤵
  PID:6764
- C:\Windows\System\OPtxhfR.exe
  C:\Windows\System\OPtxhfR.exe
  2⤵
  PID:6792
- C:\Windows\System\FDZuQDR.exe
  C:\Windows\System\FDZuQDR.exe
  2⤵
  PID:6820
- C:\Windows\System\KHOwvYz.exe
  C:\Windows\System\KHOwvYz.exe
  2⤵
  PID:6840
- C:\Windows\System\CuUeSCs.exe
  C:\Windows\System\CuUeSCs.exe
  2⤵
  PID:6876
- C:\Windows\System\JmGJHyx.exe
  C:\Windows\System\JmGJHyx.exe
  2⤵
  PID:6896
- C:\Windows\System\iqfyKxS.exe
  C:\Windows\System\iqfyKxS.exe
  2⤵
  PID:6928
- C:\Windows\System\nghTNtc.exe
  C:\Windows\System\nghTNtc.exe
  2⤵
  PID:6948
- C:\Windows\System\bmgJkTh.exe
  C:\Windows\System\bmgJkTh.exe
  2⤵
  PID:6980
- C:\Windows\System\jVAOPbx.exe
  C:\Windows\System\jVAOPbx.exe
  2⤵
  PID:7004
- C:\Windows\System\EEheUYx.exe
  C:\Windows\System\EEheUYx.exe
  2⤵
  PID:7036
- C:\Windows\System\VRqPMzI.exe
  C:\Windows\System\VRqPMzI.exe
  2⤵
  PID:7064
- C:\Windows\System\ozizzfB.exe
  C:\Windows\System\ozizzfB.exe
  2⤵
  PID:7092
- C:\Windows\System\ctfucNA.exe
  C:\Windows\System\ctfucNA.exe
  2⤵
  PID:7116
- C:\Windows\System\QepoqXK.exe
  C:\Windows\System\QepoqXK.exe
  2⤵
  PID:7144
- C:\Windows\System\fdPDKyh.exe
  C:\Windows\System\fdPDKyh.exe
  2⤵
  PID:6152
- C:\Windows\System\ZfExgHF.exe
  C:\Windows\System\ZfExgHF.exe
  2⤵
  PID:6188
- C:\Windows\System\WnctyxP.exe
  C:\Windows\System\WnctyxP.exe
  2⤵
  PID:6296
- C:\Windows\System\YPypPag.exe
  C:\Windows\System\YPypPag.exe
  2⤵
  PID:6348
- C:\Windows\System\iCKqrKS.exe
  C:\Windows\System\iCKqrKS.exe
  2⤵
  PID:6456
- C:\Windows\System\aeRqFlH.exe
  C:\Windows\System\aeRqFlH.exe
  2⤵
  PID:6500
- C:\Windows\System\yDbRmde.exe
  C:\Windows\System\yDbRmde.exe
  2⤵
  PID:6484
- C:\Windows\System\oRNCRBA.exe
  C:\Windows\System\oRNCRBA.exe
  2⤵
  PID:6636
- C:\Windows\System\CIDIrNq.exe
  C:\Windows\System\CIDIrNq.exe
  2⤵
  PID:6680
- C:\Windows\System\foladPQ.exe
  C:\Windows\System\foladPQ.exe
  2⤵
  PID:6760
- C:\Windows\System\ILRCNvo.exe
  C:\Windows\System\ILRCNvo.exe
  2⤵
  PID:6836
- C:\Windows\System\QIewzjp.exe
  C:\Windows\System\QIewzjp.exe
  2⤵
  PID:6872
- C:\Windows\System\PYSyxGo.exe
  C:\Windows\System\PYSyxGo.exe
  2⤵
  PID:6940
- C:\Windows\System\aJBHJVQ.exe
  C:\Windows\System\aJBHJVQ.exe
  2⤵
  PID:7020
- C:\Windows\System\SMrGoRi.exe
  C:\Windows\System\SMrGoRi.exe
  2⤵
  PID:7076
- C:\Windows\System\zlRTUvl.exe
  C:\Windows\System\zlRTUvl.exe
  2⤵
  PID:7132
- C:\Windows\System\xgWezjj.exe
  C:\Windows\System\xgWezjj.exe
  2⤵
  PID:6240
- C:\Windows\System\OvCfaJm.exe
  C:\Windows\System\OvCfaJm.exe
  2⤵
  PID:6372
- C:\Windows\System\jcjcrfC.exe
  C:\Windows\System\jcjcrfC.exe
  2⤵
  PID:6512
- C:\Windows\System\WLgLwSc.exe
  C:\Windows\System\WLgLwSc.exe
  2⤵
  PID:6660
- C:\Windows\System\CObIDWK.exe
  C:\Windows\System\CObIDWK.exe
  2⤵
  PID:6808
- C:\Windows\System\kBjVktq.exe
  C:\Windows\System\kBjVktq.exe
  2⤵
  PID:6884
- C:\Windows\System\CzfOaXl.exe
  C:\Windows\System\CzfOaXl.exe
  2⤵
  PID:7052
- C:\Windows\System\ODSmeWy.exe
  C:\Windows\System\ODSmeWy.exe
  2⤵
  PID:6288
- C:\Windows\System\nlETcZi.exe
  C:\Windows\System\nlETcZi.exe
  2⤵
  PID:6588
- C:\Windows\System\CPfgpMY.exe
  C:\Windows\System\CPfgpMY.exe
  2⤵
  PID:7044
- C:\Windows\System\aGSnRmW.exe
  C:\Windows\System\aGSnRmW.exe
  2⤵
  PID:7160
- C:\Windows\System\wQbWEHR.exe
  C:\Windows\System\wQbWEHR.exe
  2⤵
  PID:6988
- C:\Windows\System\WlhgSYi.exe
  C:\Windows\System\WlhgSYi.exe
  2⤵
  PID:7196
- C:\Windows\System\awEMbEm.exe
  C:\Windows\System\awEMbEm.exe
  2⤵
  PID:7224
- C:\Windows\System\EewcGge.exe
  C:\Windows\System\EewcGge.exe
  2⤵
  PID:7248
- C:\Windows\System\wsXlItM.exe
  C:\Windows\System\wsXlItM.exe
  2⤵
  PID:7280
- C:\Windows\System\HicwIeq.exe
  C:\Windows\System\HicwIeq.exe
  2⤵
  PID:7312
- C:\Windows\System\IjsuGXz.exe
  C:\Windows\System\IjsuGXz.exe
  2⤵
  PID:7340
- C:\Windows\System\IoSfNlA.exe
  C:\Windows\System\IoSfNlA.exe
  2⤵
  PID:7368
- C:\Windows\System\ROuOnHA.exe
  C:\Windows\System\ROuOnHA.exe
  2⤵
  PID:7388
- C:\Windows\System\NgMvLYp.exe
  C:\Windows\System\NgMvLYp.exe
  2⤵
  PID:7404
- C:\Windows\System\wWUnRaA.exe
  C:\Windows\System\wWUnRaA.exe
  2⤵
  PID:7432
- C:\Windows\System\kNexGjn.exe
  C:\Windows\System\kNexGjn.exe
  2⤵
  PID:7464
- C:\Windows\System\lamaMyg.exe
  C:\Windows\System\lamaMyg.exe
  2⤵
  PID:7480
- C:\Windows\System\lxmSrdI.exe
  C:\Windows\System\lxmSrdI.exe
  2⤵
  PID:7508
- C:\Windows\System\FtJyurz.exe
  C:\Windows\System\FtJyurz.exe
  2⤵
  PID:7540
- C:\Windows\System\gOzmJpp.exe
  C:\Windows\System\gOzmJpp.exe
  2⤵
  PID:7576
- C:\Windows\System\EJuqEoS.exe
  C:\Windows\System\EJuqEoS.exe
  2⤵
  PID:7608
- C:\Windows\System\eNhGPxd.exe
  C:\Windows\System\eNhGPxd.exe
  2⤵
  PID:7640
- C:\Windows\System\PBpuqpH.exe
  C:\Windows\System\PBpuqpH.exe
  2⤵
  PID:7676
- C:\Windows\System\tGIsGxY.exe
  C:\Windows\System\tGIsGxY.exe
  2⤵
  PID:7704
- C:\Windows\System\eFXwzES.exe
  C:\Windows\System\eFXwzES.exe
  2⤵
  PID:7728
- C:\Windows\System\cFJOccw.exe
  C:\Windows\System\cFJOccw.exe
  2⤵
  PID:7756
- C:\Windows\System\KWMhJSx.exe
  C:\Windows\System\KWMhJSx.exe
  2⤵
  PID:7784
- C:\Windows\System\OmhvNwb.exe
  C:\Windows\System\OmhvNwb.exe
  2⤵
  PID:7816
- C:\Windows\System\PaPRFSl.exe
  C:\Windows\System\PaPRFSl.exe
  2⤵
  PID:7848
- C:\Windows\System\LLCNGDl.exe
  C:\Windows\System\LLCNGDl.exe
  2⤵
  PID:7868
- C:\Windows\System\dacqfuy.exe
  C:\Windows\System\dacqfuy.exe
  2⤵
  PID:7896
- C:\Windows\System\QzwpDwI.exe
  C:\Windows\System\QzwpDwI.exe
  2⤵
  PID:7924
- C:\Windows\System\BeRsjeL.exe
  C:\Windows\System\BeRsjeL.exe
  2⤵
  PID:7952
- C:\Windows\System\BtPwIMS.exe
  C:\Windows\System\BtPwIMS.exe
  2⤵
  PID:7976
- C:\Windows\System\uPbpJjO.exe
  C:\Windows\System\uPbpJjO.exe
  2⤵
  PID:7996
- C:\Windows\System\zhGWfoo.exe
  C:\Windows\System\zhGWfoo.exe
  2⤵
  PID:8020
- C:\Windows\System\ZbqcqBH.exe
  C:\Windows\System\ZbqcqBH.exe
  2⤵
  PID:8044
- C:\Windows\System\CuDdCcv.exe
  C:\Windows\System\CuDdCcv.exe
  2⤵
  PID:8060
- C:\Windows\System\NpHcrHO.exe
  C:\Windows\System\NpHcrHO.exe
  2⤵
  PID:8092
- C:\Windows\System\BjMeEbh.exe
  C:\Windows\System\BjMeEbh.exe
  2⤵
  PID:8112
- C:\Windows\System\rnJMgEU.exe
  C:\Windows\System\rnJMgEU.exe
  2⤵
  PID:8148
- C:\Windows\System\eaUKDFD.exe
  C:\Windows\System\eaUKDFD.exe
  2⤵
  PID:8172
- C:\Windows\System\sEvICuC.exe
  C:\Windows\System\sEvICuC.exe
  2⤵
  PID:7180
- C:\Windows\System\QbnUNwa.exe
  C:\Windows\System\QbnUNwa.exe
  2⤵
  PID:7240
- C:\Windows\System\nARSPUX.exe
  C:\Windows\System\nARSPUX.exe
  2⤵
  PID:7268
- C:\Windows\System\GPyctzq.exe
  C:\Windows\System\GPyctzq.exe
  2⤵
  PID:7320
- C:\Windows\System\KeLPOPh.exe
  C:\Windows\System\KeLPOPh.exe
  2⤵
  PID:7364
- C:\Windows\System\nfjcvXV.exe
  C:\Windows\System\nfjcvXV.exe
  2⤵
  PID:7472
- C:\Windows\System\PtYPRWA.exe
  C:\Windows\System\PtYPRWA.exe
  2⤵
  PID:7528
- C:\Windows\System\yrnBOrJ.exe
  C:\Windows\System\yrnBOrJ.exe
  2⤵
  PID:7552
- C:\Windows\System\xXMSkog.exe
  C:\Windows\System\xXMSkog.exe
  2⤵
  PID:7652
- C:\Windows\System\DqCozMR.exe
  C:\Windows\System\DqCozMR.exe
  2⤵
  PID:7748
- C:\Windows\System\jSpIFBA.exe
  C:\Windows\System\jSpIFBA.exe
  2⤵
  PID:7796
- C:\Windows\System\HFKssgL.exe
  C:\Windows\System\HFKssgL.exe
  2⤵
  PID:7880
- C:\Windows\System\fstXUhY.exe
  C:\Windows\System\fstXUhY.exe
  2⤵
  PID:7916
- C:\Windows\System\OimmRAo.exe
  C:\Windows\System\OimmRAo.exe
  2⤵
  PID:7964
- C:\Windows\System\DffzGez.exe
  C:\Windows\System\DffzGez.exe
  2⤵
  PID:8032
- C:\Windows\System\KmdlgBs.exe
  C:\Windows\System\KmdlgBs.exe
  2⤵
  PID:8180
- C:\Windows\System\AZEFVOl.exe
  C:\Windows\System\AZEFVOl.exe
  2⤵
  PID:7216
- C:\Windows\System\FlROGys.exe
  C:\Windows\System\FlROGys.exe
  2⤵
  PID:7236
- C:\Windows\System\jVCIFMs.exe
  C:\Windows\System\jVCIFMs.exe
  2⤵
  PID:7628
- C:\Windows\System\EXtstnD.exe
  C:\Windows\System\EXtstnD.exe
  2⤵
  PID:7720
- C:\Windows\System\IwLcnqi.exe
  C:\Windows\System\IwLcnqi.exe
  2⤵
  PID:7596
- C:\Windows\System\qxnNkre.exe
  C:\Windows\System\qxnNkre.exe
  2⤵
  PID:8056
- C:\Windows\System\zVPkGZq.exe
  C:\Windows\System\zVPkGZq.exe
  2⤵
  PID:8016
- C:\Windows\System\bUNQpDQ.exe
  C:\Windows\System\bUNQpDQ.exe
  2⤵
  PID:7304
- C:\Windows\System\udUfrBU.exe
  C:\Windows\System\udUfrBU.exe
  2⤵
  PID:7520
- C:\Windows\System\uZhCmZP.exe
  C:\Windows\System\uZhCmZP.exe
  2⤵
  PID:7972
- C:\Windows\System\erezfzt.exe
  C:\Windows\System\erezfzt.exe
  2⤵
  PID:7592
- C:\Windows\System\rpuLIht.exe
  C:\Windows\System\rpuLIht.exe
  2⤵
  PID:8228
- C:\Windows\System\FMzNziz.exe
  C:\Windows\System\FMzNziz.exe
  2⤵
  PID:8260
- C:\Windows\System\YatOOnb.exe
  C:\Windows\System\YatOOnb.exe
  2⤵
  PID:8284
- C:\Windows\System\vpsTsQf.exe
  C:\Windows\System\vpsTsQf.exe
  2⤵
  PID:8340
- C:\Windows\System\CDGpWPU.exe
  C:\Windows\System\CDGpWPU.exe
  2⤵
  PID:8376
- C:\Windows\System\mPjmEjI.exe
  C:\Windows\System\mPjmEjI.exe
  2⤵
  PID:8408
- C:\Windows\System\wOfrorC.exe
  C:\Windows\System\wOfrorC.exe
  2⤵
  PID:8424
- C:\Windows\System\WGZAHMb.exe
  C:\Windows\System\WGZAHMb.exe
  2⤵
  PID:8460
- C:\Windows\System\WCmdjnQ.exe
  C:\Windows\System\WCmdjnQ.exe
  2⤵
  PID:8484
- C:\Windows\System\YzKSzkQ.exe
  C:\Windows\System\YzKSzkQ.exe
  2⤵
  PID:8516
- C:\Windows\System\pSDXUbQ.exe
  C:\Windows\System\pSDXUbQ.exe
  2⤵
  PID:8552
- C:\Windows\System\OEPALjv.exe
  C:\Windows\System\OEPALjv.exe
  2⤵
  PID:8572
- C:\Windows\System\zulBxGb.exe
  C:\Windows\System\zulBxGb.exe
  2⤵
  PID:8600
- C:\Windows\System\ERqOjiq.exe
  C:\Windows\System\ERqOjiq.exe
  2⤵
  PID:8628
- C:\Windows\System\qtxCUzM.exe
  C:\Windows\System\qtxCUzM.exe
  2⤵
  PID:8664
- C:\Windows\System\kjXqnzn.exe
  C:\Windows\System\kjXqnzn.exe
  2⤵
  PID:8692
- C:\Windows\System\SpVRGuC.exe
  C:\Windows\System\SpVRGuC.exe
  2⤵
  PID:8708
- C:\Windows\System\mFMmAIn.exe
  C:\Windows\System\mFMmAIn.exe
  2⤵
  PID:8740
- C:\Windows\System\IPwhHRC.exe
  C:\Windows\System\IPwhHRC.exe
  2⤵
  PID:8764
- C:\Windows\System\yLlbqYJ.exe
  C:\Windows\System\yLlbqYJ.exe
  2⤵
  PID:8792
- C:\Windows\System\kPUzSSH.exe
  C:\Windows\System\kPUzSSH.exe
  2⤵
  PID:8824
- C:\Windows\System\THCtMWk.exe
  C:\Windows\System\THCtMWk.exe
  2⤵
  PID:8856
- C:\Windows\System\akDNWKI.exe
  C:\Windows\System\akDNWKI.exe
  2⤵
  PID:8876
- C:\Windows\System\jXcfOIO.exe
  C:\Windows\System\jXcfOIO.exe
  2⤵
  PID:8904
- C:\Windows\System\uFFteSM.exe
  C:\Windows\System\uFFteSM.exe
  2⤵
  PID:8944
- C:\Windows\System\MVRHfgf.exe
  C:\Windows\System\MVRHfgf.exe
  2⤵
  PID:8972
- C:\Windows\System\RBiIkpr.exe
  C:\Windows\System\RBiIkpr.exe
  2⤵
  PID:8988
- C:\Windows\System\oeFPnET.exe
  C:\Windows\System\oeFPnET.exe
  2⤵
  PID:9004
- C:\Windows\System\TSWFgNg.exe
  C:\Windows\System\TSWFgNg.exe
  2⤵
  PID:9040
- C:\Windows\System\PGGDpil.exe
  C:\Windows\System\PGGDpil.exe
  2⤵
  PID:9072
- C:\Windows\System\zgOOmsS.exe
  C:\Windows\System\zgOOmsS.exe
  2⤵
  PID:9088
- C:\Windows\System\AiuZHfz.exe
  C:\Windows\System\AiuZHfz.exe
  2⤵
  PID:9112
- C:\Windows\System\GhYyUES.exe
  C:\Windows\System\GhYyUES.exe
  2⤵
  PID:9140
- C:\Windows\System\jjcaSwz.exe
  C:\Windows\System\jjcaSwz.exe
  2⤵
  PID:9160
- C:\Windows\System\pezVYSa.exe
  C:\Windows\System\pezVYSa.exe
  2⤵
  PID:9184
- C:\Windows\System\uILpJkx.exe
  C:\Windows\System\uILpJkx.exe
  2⤵
  PID:7800
- C:\Windows\System\NqXRubX.exe
  C:\Windows\System\NqXRubX.exe
  2⤵
  PID:8220
- C:\Windows\System\knaOsFJ.exe
  C:\Windows\System\knaOsFJ.exe
  2⤵
  PID:8324
- C:\Windows\System\akzLflI.exe
  C:\Windows\System\akzLflI.exe
  2⤵
  PID:8272
- C:\Windows\System\czztwVH.exe
  C:\Windows\System\czztwVH.exe
  2⤵
  PID:8360
- C:\Windows\System\NilFLUI.exe
  C:\Windows\System\NilFLUI.exe
  2⤵
  PID:8468
- C:\Windows\System\WbSgKyC.exe
  C:\Windows\System\WbSgKyC.exe
  2⤵
  PID:8500
- C:\Windows\System\GtamvQB.exe
  C:\Windows\System\GtamvQB.exe
  2⤵
  PID:8596
- C:\Windows\System\SZEtshm.exe
  C:\Windows\System\SZEtshm.exe
  2⤵
  PID:8660
- C:\Windows\System\mdssrCY.exe
  C:\Windows\System\mdssrCY.exe
  2⤵
  PID:8720
- C:\Windows\System\aLiRnNl.exe
  C:\Windows\System\aLiRnNl.exe
  2⤵
  PID:8808
- C:\Windows\System\qURrDjZ.exe
  C:\Windows\System\qURrDjZ.exe
  2⤵
  PID:8888
- C:\Windows\System\oxDQOWH.exe
  C:\Windows\System\oxDQOWH.exe
  2⤵
  PID:8928
- C:\Windows\System\iEZBrNE.exe
  C:\Windows\System\iEZBrNE.exe
  2⤵
  PID:8996
- C:\Windows\System\wmDzuOL.exe
  C:\Windows\System\wmDzuOL.exe
  2⤵
  PID:9068
- C:\Windows\System\NhFMOnL.exe
  C:\Windows\System\NhFMOnL.exe
  2⤵
  PID:9156
- C:\Windows\System\HhSsiTQ.exe
  C:\Windows\System\HhSsiTQ.exe
  2⤵
  PID:9180
- C:\Windows\System\OcIEOjc.exe
  C:\Windows\System\OcIEOjc.exe
  2⤵
  PID:7688
- C:\Windows\System\XoObAiI.exe
  C:\Windows\System\XoObAiI.exe
  2⤵
  PID:8256
- C:\Windows\System\fhFpGEE.exe
  C:\Windows\System\fhFpGEE.exe
  2⤵
  PID:8568
- C:\Windows\System\CFiPCCq.exe
  C:\Windows\System\CFiPCCq.exe
  2⤵
  PID:8580
- C:\Windows\System\sFSMvcJ.exe
  C:\Windows\System\sFSMvcJ.exe
  2⤵
  PID:8832
- C:\Windows\System\LzFAgFJ.exe
  C:\Windows\System\LzFAgFJ.exe
  2⤵
  PID:8964
- C:\Windows\System\NQdvmyI.exe
  C:\Windows\System\NQdvmyI.exe
  2⤵
  PID:9000
- C:\Windows\System\cqKTNDq.exe
  C:\Windows\System\cqKTNDq.exe
  2⤵
  PID:9136
- C:\Windows\System\nCSJNrK.exe
  C:\Windows\System\nCSJNrK.exe
  2⤵
  PID:8420
- C:\Windows\System\IpQBiti.exe
  C:\Windows\System\IpQBiti.exe
  2⤵
  PID:8840
- C:\Windows\System\ugttaRn.exe
  C:\Windows\System\ugttaRn.exe
  2⤵
  PID:9016
- C:\Windows\System\egMwOST.exe
  C:\Windows\System\egMwOST.exe
  2⤵
  PID:9240
- C:\Windows\System\iSWduhK.exe
  C:\Windows\System\iSWduhK.exe
  2⤵
  PID:9268
- C:\Windows\System\VkCHROf.exe
  C:\Windows\System\VkCHROf.exe
  2⤵
  PID:9308
- C:\Windows\System\DwESWRh.exe
  C:\Windows\System\DwESWRh.exe
  2⤵
  PID:9332
- C:\Windows\System\GaCvlUy.exe
  C:\Windows\System\GaCvlUy.exe
  2⤵
  PID:9356
- C:\Windows\System\qYhKilq.exe
  C:\Windows\System\qYhKilq.exe
  2⤵
  PID:9388
- C:\Windows\System\ChtWfVL.exe
  C:\Windows\System\ChtWfVL.exe
  2⤵
  PID:9416
- C:\Windows\System\kgBGFGI.exe
  C:\Windows\System\kgBGFGI.exe
  2⤵
  PID:9432
- C:\Windows\System\qUSFopQ.exe
  C:\Windows\System\qUSFopQ.exe
  2⤵
  PID:9464
- C:\Windows\System\GGDlDKt.exe
  C:\Windows\System\GGDlDKt.exe
  2⤵
  PID:9492
- C:\Windows\System\FTuWrFC.exe
  C:\Windows\System\FTuWrFC.exe
  2⤵
  PID:9520
- C:\Windows\System\NZwgfmn.exe
  C:\Windows\System\NZwgfmn.exe
  2⤵
  PID:9552
- C:\Windows\System\HKGSIsO.exe
  C:\Windows\System\HKGSIsO.exe
  2⤵
  PID:9572
- C:\Windows\System\ZitbRQd.exe
  C:\Windows\System\ZitbRQd.exe
  2⤵
  PID:9600
- C:\Windows\System\OWaAcdq.exe
  C:\Windows\System\OWaAcdq.exe
  2⤵
  PID:9624
- C:\Windows\System\NCsXcDZ.exe
  C:\Windows\System\NCsXcDZ.exe
  2⤵
  PID:9652
- C:\Windows\System\ivadiml.exe
  C:\Windows\System\ivadiml.exe
  2⤵
  PID:9672
- C:\Windows\System\XzMXRXD.exe
  C:\Windows\System\XzMXRXD.exe
  2⤵
  PID:9700
- C:\Windows\System\BtdzNga.exe
  C:\Windows\System\BtdzNga.exe
  2⤵
  PID:9812
- C:\Windows\System\hFGJwoS.exe
  C:\Windows\System\hFGJwoS.exe
  2⤵
  PID:9828
- C:\Windows\System\Cxpbfls.exe
  C:\Windows\System\Cxpbfls.exe
  2⤵
  PID:9848
- C:\Windows\System\wQJwqNY.exe
  C:\Windows\System\wQJwqNY.exe
  2⤵
  PID:9876
- C:\Windows\System\BVTEYKt.exe
  C:\Windows\System\BVTEYKt.exe
  2⤵
  PID:9900
- C:\Windows\System\WKZEpCU.exe
  C:\Windows\System\WKZEpCU.exe
  2⤵
  PID:9928
- C:\Windows\System\dFkEzCE.exe
  C:\Windows\System\dFkEzCE.exe
  2⤵
  PID:9956
- C:\Windows\System\HksEuhl.exe
  C:\Windows\System\HksEuhl.exe
  2⤵
  PID:9976
- C:\Windows\System\QgoNRYY.exe
  C:\Windows\System\QgoNRYY.exe
  2⤵
  PID:10012
- C:\Windows\System\hBKZkmM.exe
  C:\Windows\System\hBKZkmM.exe
  2⤵
  PID:10044
- C:\Windows\System\LuuqpAC.exe
  C:\Windows\System\LuuqpAC.exe
  2⤵
  PID:10068
- C:\Windows\System\FyGHjoN.exe
  C:\Windows\System\FyGHjoN.exe
  2⤵
  PID:10084
- C:\Windows\System\uDPwKUh.exe
  C:\Windows\System\uDPwKUh.exe
  2⤵
  PID:10116
- C:\Windows\System\HHegWRU.exe
  C:\Windows\System\HHegWRU.exe
  2⤵
  PID:10152
- C:\Windows\System\BYGEBIz.exe
  C:\Windows\System\BYGEBIz.exe
  2⤵
  PID:10168
- C:\Windows\System\ENUZWYD.exe
  C:\Windows\System\ENUZWYD.exe
  2⤵
  PID:10204
- C:\Windows\System\YBWoviW.exe
  C:\Windows\System\YBWoviW.exe
  2⤵
  PID:10228
- C:\Windows\System\DGGWowp.exe
  C:\Windows\System\DGGWowp.exe
  2⤵
  PID:9236
- C:\Windows\System\BcyjEVe.exe
  C:\Windows\System\BcyjEVe.exe
  2⤵
  PID:8812
- C:\Windows\System\QLqtXGC.exe
  C:\Windows\System\QLqtXGC.exe
  2⤵
  PID:9352
- C:\Windows\System\rooWvsM.exe
  C:\Windows\System\rooWvsM.exe
  2⤵
  PID:9396
- C:\Windows\System\UzDkvnN.exe
  C:\Windows\System\UzDkvnN.exe
  2⤵
  PID:9508
- C:\Windows\System\mcosQtt.exe
  C:\Windows\System\mcosQtt.exe
  2⤵
  PID:9480
- C:\Windows\System\VHnBZYj.exe
  C:\Windows\System\VHnBZYj.exe
  2⤵
  PID:9544
- C:\Windows\System\TfCazHK.exe
  C:\Windows\System\TfCazHK.exe
  2⤵
  PID:9588
- C:\Windows\System\bQkKLRO.exe
  C:\Windows\System\bQkKLRO.exe
  2⤵
  PID:9688
- C:\Windows\System\xEJzoVo.exe
  C:\Windows\System\xEJzoVo.exe
  2⤵
  PID:9788
- C:\Windows\System\uLzHGDp.exe
  C:\Windows\System\uLzHGDp.exe
  2⤵
  PID:9856
- C:\Windows\System\sJEjCVc.exe
  C:\Windows\System\sJEjCVc.exe
  2⤵
  PID:9892
- C:\Windows\System\ltInxjJ.exe
  C:\Windows\System\ltInxjJ.exe
  2⤵
  PID:9972
- C:\Windows\System\LuoKwPg.exe
  C:\Windows\System\LuoKwPg.exe
  2⤵
  PID:10040
- C:\Windows\System\WloEPCL.exe
  C:\Windows\System\WloEPCL.exe
  2⤵
  PID:10128
- C:\Windows\System\uDaJFVK.exe
  C:\Windows\System\uDaJFVK.exe
  2⤵
  PID:10192
- C:\Windows\System\defRbKr.exe
  C:\Windows\System\defRbKr.exe
  2⤵
  PID:10188
- C:\Windows\System\jauupqI.exe
  C:\Windows\System\jauupqI.exe
  2⤵
  PID:8780
- C:\Windows\System\KtRwDQf.exe
  C:\Windows\System\KtRwDQf.exe
  2⤵
  PID:9348
- C:\Windows\System\lFOnzFl.exe
  C:\Windows\System\lFOnzFl.exe
  2⤵
  PID:9428
- C:\Windows\System\ixmQNuM.exe
  C:\Windows\System\ixmQNuM.exe
  2⤵
  PID:9584
- C:\Windows\System\YqqVPkF.exe
  C:\Windows\System\YqqVPkF.exe
  2⤵
  PID:9820
- C:\Windows\System\yOWadUk.exe
  C:\Windows\System\yOWadUk.exe
  2⤵
  PID:10000
- C:\Windows\System\DOoczqX.exe
  C:\Windows\System\DOoczqX.exe
  2⤵
  PID:10008
- C:\Windows\System\FFfsFxc.exe
  C:\Windows\System\FFfsFxc.exe
  2⤵
  PID:9228
- C:\Windows\System\SQZXylU.exe
  C:\Windows\System\SQZXylU.exe
  2⤵
  PID:9724
- C:\Windows\System\zUxwuse.exe
  C:\Windows\System\zUxwuse.exe
  2⤵
  PID:9996
- C:\Windows\System\MDbBBKQ.exe
  C:\Windows\System\MDbBBKQ.exe
  2⤵
  PID:10144
- C:\Windows\System\CTygTDK.exe
  C:\Windows\System\CTygTDK.exe
  2⤵
  PID:10248
- C:\Windows\System\tiNKKNi.exe
  C:\Windows\System\tiNKKNi.exe
  2⤵
  PID:10276
- C:\Windows\System\fGpKodj.exe
  C:\Windows\System\fGpKodj.exe
  2⤵
  PID:10296
- C:\Windows\System\UzbRtsK.exe
  C:\Windows\System\UzbRtsK.exe
  2⤵
  PID:10324
- C:\Windows\System\sfbdCGt.exe
  C:\Windows\System\sfbdCGt.exe
  2⤵
  PID:10360
- C:\Windows\System\NWZOhOo.exe
  C:\Windows\System\NWZOhOo.exe
  2⤵
  PID:10380
- C:\Windows\System\NotYJND.exe
  C:\Windows\System\NotYJND.exe
  2⤵
  PID:10400
- C:\Windows\System\IgSTdYb.exe
  C:\Windows\System\IgSTdYb.exe
  2⤵
  PID:10432
- C:\Windows\System\UWljYYQ.exe
  C:\Windows\System\UWljYYQ.exe
  2⤵
  PID:10456
- C:\Windows\System\QsblgqO.exe
  C:\Windows\System\QsblgqO.exe
  2⤵
  PID:10484
- C:\Windows\System\TEfEPIu.exe
  C:\Windows\System\TEfEPIu.exe
  2⤵
  PID:10516
- C:\Windows\System\dmamSLo.exe
  C:\Windows\System\dmamSLo.exe
  2⤵
  PID:10548
- C:\Windows\System\DxwPhxe.exe
  C:\Windows\System\DxwPhxe.exe
  2⤵
  PID:10564
- C:\Windows\System\dLugPcv.exe
  C:\Windows\System\dLugPcv.exe
  2⤵
  PID:10592
- C:\Windows\System\AeOXvsy.exe
  C:\Windows\System\AeOXvsy.exe
  2⤵
  PID:10628
- C:\Windows\System\RFVhpzv.exe
  C:\Windows\System\RFVhpzv.exe
  2⤵
  PID:10656
- C:\Windows\System\YsRFYgm.exe
  C:\Windows\System\YsRFYgm.exe
  2⤵
  PID:10684
- C:\Windows\System\qdduilo.exe
  C:\Windows\System\qdduilo.exe
  2⤵
  PID:10708
- C:\Windows\System\HiOzsUm.exe
  C:\Windows\System\HiOzsUm.exe
  2⤵
  PID:10736
- C:\Windows\System\tkKtPSE.exe
  C:\Windows\System\tkKtPSE.exe
  2⤵
  PID:10752
- C:\Windows\System\plzHVeP.exe
  C:\Windows\System\plzHVeP.exe
  2⤵
  PID:10796
- C:\Windows\System\WCZDKtO.exe
  C:\Windows\System\WCZDKtO.exe
  2⤵
  PID:10828
- C:\Windows\System\FVyXTTB.exe
  C:\Windows\System\FVyXTTB.exe
  2⤵
  PID:10856
- C:\Windows\System\CRnlLFG.exe
  C:\Windows\System\CRnlLFG.exe
  2⤵
  PID:10876
- C:\Windows\System\qkdAjMQ.exe
  C:\Windows\System\qkdAjMQ.exe
  2⤵
  PID:10908
- C:\Windows\System\SlMvpjL.exe
  C:\Windows\System\SlMvpjL.exe
  2⤵
  PID:10936
- C:\Windows\System\WFiWmjy.exe
  C:\Windows\System\WFiWmjy.exe
  2⤵
  PID:10960
- C:\Windows\System\QfXsRJH.exe
  C:\Windows\System\QfXsRJH.exe
  2⤵
  PID:10992
- C:\Windows\System\SrJpBXm.exe
  C:\Windows\System\SrJpBXm.exe
  2⤵
  PID:11024
- C:\Windows\System\zhLqpqd.exe
  C:\Windows\System\zhLqpqd.exe
  2⤵
  PID:11052
- C:\Windows\System\AtcGEMl.exe
  C:\Windows\System\AtcGEMl.exe
  2⤵
  PID:11076
- C:\Windows\System\nRsEYuO.exe
  C:\Windows\System\nRsEYuO.exe
  2⤵
  PID:11108
- C:\Windows\System\vxYuxXR.exe
  C:\Windows\System\vxYuxXR.exe
  2⤵
  PID:11148
- C:\Windows\System\tbQGWcR.exe
  C:\Windows\System\tbQGWcR.exe
  2⤵
  PID:11172
- C:\Windows\System\NHbDUzZ.exe
  C:\Windows\System\NHbDUzZ.exe
  2⤵
  PID:11204
- C:\Windows\System\ZaWTWHV.exe
  C:\Windows\System\ZaWTWHV.exe
  2⤵
  PID:11236
- C:\Windows\System\HcVKcJh.exe
  C:\Windows\System\HcVKcJh.exe
  2⤵
  PID:11260
- C:\Windows\System\EEdZdQR.exe
  C:\Windows\System\EEdZdQR.exe
  2⤵
  PID:9864
- C:\Windows\System\YzPRPnh.exe
  C:\Windows\System\YzPRPnh.exe
  2⤵
  PID:10284
- C:\Windows\System\gqMFZed.exe
  C:\Windows\System\gqMFZed.exe
  2⤵
  PID:10352
- C:\Windows\System\fbhEBPl.exe
  C:\Windows\System\fbhEBPl.exe
  2⤵
  PID:10424
- C:\Windows\System\IfIxQun.exe
  C:\Windows\System\IfIxQun.exe
  2⤵
  PID:10472
- C:\Windows\System\cVdHDhO.exe
  C:\Windows\System\cVdHDhO.exe
  2⤵
  PID:10608
- C:\Windows\System\IKPZriB.exe
  C:\Windows\System\IKPZriB.exe
  2⤵
  PID:10620
- C:\Windows\System\KGOkcms.exe
  C:\Windows\System\KGOkcms.exe
  2⤵
  PID:10672
- C:\Windows\System\BrDOifB.exe
  C:\Windows\System\BrDOifB.exe
  2⤵
  PID:10732
- C:\Windows\System\WVOnLSK.exe
  C:\Windows\System\WVOnLSK.exe
  2⤵
  PID:10780
- C:\Windows\System\FhwDZJz.exe
  C:\Windows\System\FhwDZJz.exe
  2⤵
  PID:10868
- C:\Windows\System\EKpDFJD.exe
  C:\Windows\System\EKpDFJD.exe
  2⤵
  PID:10932
- C:\Windows\System\sopyFIy.exe
  C:\Windows\System\sopyFIy.exe
  2⤵
  PID:10976
- C:\Windows\System\ZbZyqGC.exe
  C:\Windows\System\ZbZyqGC.exe
  2⤵
  PID:11128
- C:\Windows\System\HEtPLWT.exe
  C:\Windows\System\HEtPLWT.exe
  2⤵
  PID:11120
- C:\Windows\System\QVQBNRE.exe
  C:\Windows\System\QVQBNRE.exe
  2⤵
  PID:11200
- C:\Windows\System\PvvIlqU.exe
  C:\Windows\System\PvvIlqU.exe
  2⤵
  PID:10340
- C:\Windows\System\fSLxSWm.exe
  C:\Windows\System\fSLxSWm.exe
  2⤵
  PID:10512
- C:\Windows\System\wkqmHZj.exe
  C:\Windows\System\wkqmHZj.exe
  2⤵
  PID:10792
- C:\Windows\System\kMNslfH.exe
  C:\Windows\System\kMNslfH.exe
  2⤵
  PID:10652
- C:\Windows\System\LRNuFRQ.exe
  C:\Windows\System\LRNuFRQ.exe
  2⤵
  PID:11040
- C:\Windows\System\efmLPho.exe
  C:\Windows\System\efmLPho.exe
  2⤵
  PID:11008
- C:\Windows\System\yRhBMII.exe
  C:\Windows\System\yRhBMII.exe
  2⤵
  PID:11220
- C:\Windows\System\wrsrzwE.exe
  C:\Windows\System\wrsrzwE.exe
  2⤵
  PID:10420
- C:\Windows\System\LBpzxiC.exe
  C:\Windows\System\LBpzxiC.exe
  2⤵
  PID:11092
- C:\Windows\System\LmpfiHh.exe
  C:\Windows\System\LmpfiHh.exe
  2⤵
  PID:10244
- C:\Windows\System\WWlcxCw.exe
  C:\Windows\System\WWlcxCw.exe
  2⤵
  PID:11272
- C:\Windows\System\elYcPSQ.exe
  C:\Windows\System\elYcPSQ.exe
  2⤵
  PID:11288
- C:\Windows\System\VaVDGbC.exe
  C:\Windows\System\VaVDGbC.exe
  2⤵
  PID:11320
- C:\Windows\System\OOsVLAe.exe
  C:\Windows\System\OOsVLAe.exe
  2⤵
  PID:11344
- C:\Windows\System\DGeIDvQ.exe
  C:\Windows\System\DGeIDvQ.exe
  2⤵
  PID:11376
- C:\Windows\System\YMEuDYV.exe
  C:\Windows\System\YMEuDYV.exe
  2⤵
  PID:11396
- C:\Windows\System\oySjvit.exe
  C:\Windows\System\oySjvit.exe
  2⤵
  PID:11412
- C:\Windows\System\VkPbduj.exe
  C:\Windows\System\VkPbduj.exe
  2⤵
  PID:11432
- C:\Windows\System\wNiMrGg.exe
  C:\Windows\System\wNiMrGg.exe
  2⤵
  PID:11452
- C:\Windows\System\ETpQNPE.exe
  C:\Windows\System\ETpQNPE.exe
  2⤵
  PID:11488
- C:\Windows\System\IxWXcax.exe
  C:\Windows\System\IxWXcax.exe
  2⤵
  PID:11524
- C:\Windows\System\TTSFrWg.exe
  C:\Windows\System\TTSFrWg.exe
  2⤵
  PID:11544
- C:\Windows\System\WmvHKKR.exe
  C:\Windows\System\WmvHKKR.exe
  2⤵
  PID:11572
- C:\Windows\System\sniZsYb.exe
  C:\Windows\System\sniZsYb.exe
  2⤵
  PID:11596
- C:\Windows\System\iYiYBFY.exe
  C:\Windows\System\iYiYBFY.exe
  2⤵
  PID:11620
- C:\Windows\System\elAXDle.exe
  C:\Windows\System\elAXDle.exe
  2⤵
  PID:11652
- C:\Windows\System\vJnEyhB.exe
  C:\Windows\System\vJnEyhB.exe
  2⤵
  PID:11676
- C:\Windows\System\UNeQNfS.exe
  C:\Windows\System\UNeQNfS.exe
  2⤵
  PID:11692
- C:\Windows\System\sQjmeXp.exe
  C:\Windows\System\sQjmeXp.exe
  2⤵
  PID:11728
- C:\Windows\System\RcHWAgW.exe
  C:\Windows\System\RcHWAgW.exe
  2⤵
  PID:11748
- C:\Windows\System\oHULkFR.exe
  C:\Windows\System\oHULkFR.exe
  2⤵
  PID:11772
- C:\Windows\System\PiosjJw.exe
  C:\Windows\System\PiosjJw.exe
  2⤵
  PID:11800
- C:\Windows\System\vuLHENC.exe
  C:\Windows\System\vuLHENC.exe
  2⤵
  PID:11832
- C:\Windows\System\FWxyjSh.exe
  C:\Windows\System\FWxyjSh.exe
  2⤵
  PID:11876
- C:\Windows\System\AmuZbUc.exe
  C:\Windows\System\AmuZbUc.exe
  2⤵
  PID:11904
- C:\Windows\System\zNasLPv.exe
  C:\Windows\System\zNasLPv.exe
  2⤵
  PID:11940
- C:\Windows\System\NDSJeZU.exe
  C:\Windows\System\NDSJeZU.exe
  2⤵
  PID:11972
- C:\Windows\System\fgaKSFx.exe
  C:\Windows\System\fgaKSFx.exe
  2⤵
  PID:11996
- C:\Windows\System\zxMbzYu.exe
  C:\Windows\System\zxMbzYu.exe
  2⤵
  PID:12016
- C:\Windows\System\GaUEJAN.exe
  C:\Windows\System\GaUEJAN.exe
  2⤵
  PID:12044
- C:\Windows\System\OECanlu.exe
  C:\Windows\System\OECanlu.exe
  2⤵
  PID:12072
- C:\Windows\System\OlSFOCU.exe
  C:\Windows\System\OlSFOCU.exe
  2⤵
  PID:12108
- C:\Windows\System\eFUatkB.exe
  C:\Windows\System\eFUatkB.exe
  2⤵
  PID:12144
- C:\Windows\System\PPCoBoc.exe
  C:\Windows\System\PPCoBoc.exe
  2⤵
  PID:12168
- C:\Windows\System\KPiHwpf.exe
  C:\Windows\System\KPiHwpf.exe
  2⤵
  PID:12196
- C:\Windows\System\HjsUvSg.exe
  C:\Windows\System\HjsUvSg.exe
  2⤵
  PID:12224
- C:\Windows\System\nXvOPon.exe
  C:\Windows\System\nXvOPon.exe
  2⤵
  PID:12248
- C:\Windows\System\WIeVlqu.exe
  C:\Windows\System\WIeVlqu.exe
  2⤵
  PID:12272
- C:\Windows\System\sTmYcEc.exe
  C:\Windows\System\sTmYcEc.exe
  2⤵
  PID:10900
- C:\Windows\System\AiBWEBC.exe
  C:\Windows\System\AiBWEBC.exe
  2⤵
  PID:11300
- C:\Windows\System\UykDAQW.exe
  C:\Windows\System\UykDAQW.exe
  2⤵
  PID:11364
- C:\Windows\System\BqUaWlF.exe
  C:\Windows\System\BqUaWlF.exe
  2⤵
  PID:11448
- C:\Windows\System\PfXJRWX.exe
  C:\Windows\System\PfXJRWX.exe
  2⤵
  PID:11464
- C:\Windows\System\RJRkJgM.exe
  C:\Windows\System\RJRkJgM.exe
  2⤵
  PID:11552
- C:\Windows\System\wJFAdaE.exe
  C:\Windows\System\wJFAdaE.exe
  2⤵
  PID:11684
- C:\Windows\System\QompBWQ.exe
  C:\Windows\System\QompBWQ.exe
  2⤵
  PID:11712
- C:\Windows\System\YKfiDja.exe
  C:\Windows\System\YKfiDja.exe
  2⤵
  PID:11768
- C:\Windows\System\DiPLbuO.exe
  C:\Windows\System\DiPLbuO.exe
  2⤵
  PID:11916
- C:\Windows\System\LeIZwJk.exe
  C:\Windows\System\LeIZwJk.exe
  2⤵
  PID:11924
- C:\Windows\System\LfnDrFw.exe
  C:\Windows\System\LfnDrFw.exe
  2⤵
  PID:12012
- C:\Windows\System\fUMBrMR.exe
  C:\Windows\System\fUMBrMR.exe
  2⤵
  PID:12008
- C:\Windows\System\SjOaNCm.exe
  C:\Windows\System\SjOaNCm.exe
  2⤵
  PID:12132
- C:\Windows\System\NhGhTsM.exe
  C:\Windows\System\NhGhTsM.exe
  2⤵
  PID:12192
- C:\Windows\System\JdonCbj.exe
  C:\Windows\System\JdonCbj.exe
  2⤵
  PID:11004
- C:\Windows\System\wvRXsoa.exe
  C:\Windows\System\wvRXsoa.exe
  2⤵
  PID:11280
- C:\Windows\System\MSKSHSj.exe
  C:\Windows\System\MSKSHSj.exe
  2⤵
  PID:11332
- C:\Windows\System\SgMzGrS.exe
  C:\Windows\System\SgMzGrS.exe
  2⤵
  PID:11440
- C:\Windows\System\CXUFohG.exe
  C:\Windows\System\CXUFohG.exe
  2⤵
  PID:11608
- C:\Windows\System\BmTZCmF.exe
  C:\Windows\System\BmTZCmF.exe
  2⤵
  PID:11828
- C:\Windows\System\NjYOpsR.exe
  C:\Windows\System\NjYOpsR.exe
  2⤵
  PID:12068
- C:\Windows\System\yHqOvIM.exe
  C:\Windows\System\yHqOvIM.exe
  2⤵
  PID:12256
- C:\Windows\System\JPtNemm.exe
  C:\Windows\System\JPtNemm.exe
  2⤵
  PID:12280
- C:\Windows\System\RqjMqgH.exe
  C:\Windows\System\RqjMqgH.exe
  2⤵
  PID:11660
- C:\Windows\System\YHaWgog.exe
  C:\Windows\System\YHaWgog.exe
  2⤵
  PID:11764
- C:\Windows\System\Oufpsdl.exe
  C:\Windows\System\Oufpsdl.exe
  2⤵
  PID:12296
- C:\Windows\System\mPzFRXB.exe
  C:\Windows\System\mPzFRXB.exe
  2⤵
  PID:12328
- C:\Windows\System\orMbRBI.exe
  C:\Windows\System\orMbRBI.exe
  2⤵
  PID:12352
- C:\Windows\System\zNtXRvl.exe
  C:\Windows\System\zNtXRvl.exe
  2⤵
  PID:12376
- C:\Windows\System\fNxcfYx.exe
  C:\Windows\System\fNxcfYx.exe
  2⤵
  PID:12396
- C:\Windows\System\dnVKvBL.exe
  C:\Windows\System\dnVKvBL.exe
  2⤵
  PID:12424
- C:\Windows\System\HFzoHjJ.exe
  C:\Windows\System\HFzoHjJ.exe
  2⤵
  PID:12452
- C:\Windows\System\lHJKfuy.exe
  C:\Windows\System\lHJKfuy.exe
  2⤵
  PID:12484
- C:\Windows\System\HcWvSEn.exe
  C:\Windows\System\HcWvSEn.exe
  2⤵
  PID:12508
- C:\Windows\System\VkTqUDX.exe
  C:\Windows\System\VkTqUDX.exe
  2⤵
  PID:12528
- C:\Windows\System\rIdIBOJ.exe
  C:\Windows\System\rIdIBOJ.exe
  2⤵
  PID:12556
- C:\Windows\System\NoIKMEQ.exe
  C:\Windows\System\NoIKMEQ.exe
  2⤵
  PID:12584
- C:\Windows\System\XdSJdTF.exe
  C:\Windows\System\XdSJdTF.exe
  2⤵
  PID:12600
- C:\Windows\System\OioSjix.exe
  C:\Windows\System\OioSjix.exe
  2⤵
  PID:12632
- C:\Windows\System\gJwgZTf.exe
  C:\Windows\System\gJwgZTf.exe
  2⤵
  PID:12660
- C:\Windows\System\YoLwaId.exe
  C:\Windows\System\YoLwaId.exe
  2⤵
  PID:12676
- C:\Windows\System\bTceTmo.exe
  C:\Windows\System\bTceTmo.exe
  2⤵
  PID:12700
- C:\Windows\System\TuEzMLJ.exe
  C:\Windows\System\TuEzMLJ.exe
  2⤵
  PID:12724
- C:\Windows\System\MdcpRtC.exe
  C:\Windows\System\MdcpRtC.exe
  2⤵
  PID:12752
- C:\Windows\System\tWfIfEr.exe
  C:\Windows\System\tWfIfEr.exe
  2⤵
  PID:12776
- C:\Windows\System\ACQuLqR.exe
  C:\Windows\System\ACQuLqR.exe
  2⤵
  PID:12804
- C:\Windows\System\HtjoQnL.exe
  C:\Windows\System\HtjoQnL.exe
  2⤵
  PID:12840
- C:\Windows\System\TzlJkoS.exe
  C:\Windows\System\TzlJkoS.exe
  2⤵
  PID:12876
- C:\Windows\System\uWAxhOI.exe
  C:\Windows\System\uWAxhOI.exe
  2⤵
  PID:12904
- C:\Windows\System\ZRIwWPs.exe
  C:\Windows\System\ZRIwWPs.exe
  2⤵
  PID:12940
- C:\Windows\System\DqfBloE.exe
  C:\Windows\System\DqfBloE.exe
  2⤵
  PID:12968
- C:\Windows\System\VSAeUhV.exe
  C:\Windows\System\VSAeUhV.exe
  2⤵
  PID:12996
- C:\Windows\System\nAeRTuN.exe
  C:\Windows\System\nAeRTuN.exe
  2⤵
  PID:13028
- C:\Windows\System\PvmnkRA.exe
  C:\Windows\System\PvmnkRA.exe
  2⤵
  PID:13052
- C:\Windows\System\EbGpycu.exe
  C:\Windows\System\EbGpycu.exe
  2⤵
  PID:13076
- C:\Windows\System\CCrzXSP.exe
  C:\Windows\System\CCrzXSP.exe
  2⤵
  PID:13108
- C:\Windows\System\AIaBrZq.exe
  C:\Windows\System\AIaBrZq.exe
  2⤵
  PID:13148
- C:\Windows\System\HKbaKBg.exe
  C:\Windows\System\HKbaKBg.exe
  2⤵
  PID:13188
- C:\Windows\System\fAOcIOb.exe
  C:\Windows\System\fAOcIOb.exe
  2⤵
  PID:13216
- C:\Windows\System\Wmneydf.exe
  C:\Windows\System\Wmneydf.exe
  2⤵
  PID:13240
- C:\Windows\System\rECLVNl.exe
  C:\Windows\System\rECLVNl.exe
  2⤵
  PID:13256
- C:\Windows\System\EQQOXkU.exe
  C:\Windows\System\EQQOXkU.exe
  2⤵
  PID:13280
- C:\Windows\System\mxOKhbc.exe
  C:\Windows\System\mxOKhbc.exe
  2⤵
  PID:10720
- C:\Windows\System\nzkTJSK.exe
  C:\Windows\System\nzkTJSK.exe
  2⤵
  PID:11392
- C:\Windows\System\bxsMIZj.exe
  C:\Windows\System\bxsMIZj.exe
  2⤵
  PID:12420
- C:\Windows\System\RTLjmOJ.exe
  C:\Windows\System\RTLjmOJ.exe
  2⤵
  PID:12388
- C:\Windows\System\YdgUwsz.exe
  C:\Windows\System\YdgUwsz.exe
  2⤵
  PID:12504
- C:\Windows\System\csdnpxA.exe
  C:\Windows\System\csdnpxA.exe
  2⤵
  PID:12596
- C:\Windows\System\ozJLzMm.exe
  C:\Windows\System\ozJLzMm.exe
  2⤵
  PID:12656
- C:\Windows\System\lsIMAIh.exe
  C:\Windows\System\lsIMAIh.exe
  2⤵
  PID:12688
- C:\Windows\System\vFadteA.exe
  C:\Windows\System\vFadteA.exe
  2⤵
  PID:12812
- C:\Windows\System\ssreWIt.exe
  C:\Windows\System\ssreWIt.exe
  2⤵
  PID:12900
- C:\Windows\System\jHpwIsh.exe
  C:\Windows\System\jHpwIsh.exe
  2⤵
  PID:12936
- C:\Windows\System\IFDfAMN.exe
  C:\Windows\System\IFDfAMN.exe
  2⤵
  PID:12924
- C:\Windows\System\HEqpQGR.exe
  C:\Windows\System\HEqpQGR.exe
  2⤵
  PID:13064
- C:\Windows\System\wCCThgR.exe
  C:\Windows\System\wCCThgR.exe
  2⤵
  PID:13168
- C:\Windows\System\pdSxZic.exe
  C:\Windows\System\pdSxZic.exe
  2⤵
  PID:13228
- C:\Windows\System\GmgRMQH.exe
  C:\Windows\System\GmgRMQH.exe
  2⤵
  PID:13304
- C:\Windows\System\MWnAEUW.exe
  C:\Windows\System\MWnAEUW.exe
  2⤵
  PID:12372
- C:\Windows\System\EbgjIPz.exe
  C:\Windows\System\EbgjIPz.exe
  2⤵
  PID:12544
- C:\Windows\System\QSTceXg.exe
  C:\Windows\System\QSTceXg.exe
  2⤵
  PID:12552
- C:\Windows\System\iuyLOyC.exe
  C:\Windows\System\iuyLOyC.exe
  2⤵
  PID:12668
- C:\Windows\System\BOAGRxL.exe
  C:\Windows\System\BOAGRxL.exe
  2⤵
  PID:12860
- C:\Windows\System\xocXsCj.exe
  C:\Windows\System\xocXsCj.exe
  2⤵
  PID:13088
- C:\Windows\System\lItMfUY.exe
  C:\Windows\System\lItMfUY.exe
  2⤵
  PID:13276
- C:\Windows\System\mANMNpU.exe
  C:\Windows\System\mANMNpU.exe
  2⤵
  PID:12368
- C:\Windows\System\wpsihIN.exe
  C:\Windows\System\wpsihIN.exe
  2⤵
  PID:12792
- C:\Windows\System\HqCVRIn.exe
  C:\Windows\System\HqCVRIn.exe
  2⤵
  PID:12864
- C:\Windows\System\YwgCAOe.exe
  C:\Windows\System\YwgCAOe.exe
  2⤵
  PID:12712
- C:\Windows\System\ptbBzYP.exe
  C:\Windows\System\ptbBzYP.exe
  2⤵
  PID:13332
- C:\Windows\System\PsvrhqS.exe
  C:\Windows\System\PsvrhqS.exe
  2⤵
  PID:13352
- C:\Windows\System\lCWaFHC.exe
  C:\Windows\System\lCWaFHC.exe
  2⤵
  PID:13384
- C:\Windows\System\XFiIAtq.exe
  C:\Windows\System\XFiIAtq.exe
  2⤵
  PID:13404
- C:\Windows\System\TPRciqa.exe
  C:\Windows\System\TPRciqa.exe
  2⤵
  PID:13428
- C:\Windows\System\ofxpUBu.exe
  C:\Windows\System\ofxpUBu.exe
  2⤵
  PID:13456
- C:\Windows\System\PMKGydJ.exe
  C:\Windows\System\PMKGydJ.exe
  2⤵
  PID:13484
- C:\Windows\System\EaRGsKN.exe
  C:\Windows\System\EaRGsKN.exe
  2⤵
  PID:13504
- C:\Windows\System\fUdEpFy.exe
  C:\Windows\System\fUdEpFy.exe
  2⤵
  PID:13532
- C:\Windows\System\ylVYGtZ.exe
  C:\Windows\System\ylVYGtZ.exe
  2⤵
  PID:13556
- C:\Windows\System\HgPYaZO.exe
  C:\Windows\System\HgPYaZO.exe
  2⤵
  PID:13584
- C:\Windows\System\xexoklZ.exe
  C:\Windows\System\xexoklZ.exe
  2⤵
  PID:13608
- C:\Windows\System\cXSPyKg.exe
  C:\Windows\System\cXSPyKg.exe
  2⤵
  PID:13624
- C:\Windows\System\qflxFYc.exe
  C:\Windows\System\qflxFYc.exe
  2⤵
  PID:13644
- C:\Windows\System\CRbkGXe.exe
  C:\Windows\System\CRbkGXe.exe
  2⤵
  PID:13664
- C:\Windows\System\TzQNvBU.exe
  C:\Windows\System\TzQNvBU.exe
  2⤵
  PID:13688
- C:\Windows\System\hXAbNfY.exe
  C:\Windows\System\hXAbNfY.exe
  2⤵
  PID:13704
- C:\Windows\System\aqwmeCQ.exe
  C:\Windows\System\aqwmeCQ.exe
  2⤵
  PID:13736
- C:\Windows\System\XrkaxTJ.exe
  C:\Windows\System\XrkaxTJ.exe
  2⤵
  PID:13756
- C:\Windows\System\XDngnDN.exe
  C:\Windows\System\XDngnDN.exe
  2⤵
  PID:13788
- C:\Windows\System\oskFotE.exe
  C:\Windows\System\oskFotE.exe
  2⤵
  PID:13820
- C:\Windows\System\spqyWof.exe
  C:\Windows\System\spqyWof.exe
  2⤵
  PID:13856
- C:\Windows\System\kaJOVQN.exe
  C:\Windows\System\kaJOVQN.exe
  2⤵
  PID:13880
- C:\Windows\System\ryxVxkK.exe
  C:\Windows\System\ryxVxkK.exe
  2⤵
  PID:13908
- C:\Windows\System\oCyBqph.exe
  C:\Windows\System\oCyBqph.exe
  2⤵
  PID:13948
- C:\Windows\System\MSyPtzd.exe
  C:\Windows\System\MSyPtzd.exe
  2⤵
  PID:13980
- C:\Windows\System\sLRJumo.exe
  C:\Windows\System\sLRJumo.exe
  2⤵
  PID:14000
- C:\Windows\System\QmpynkO.exe
  C:\Windows\System\QmpynkO.exe
  2⤵
  PID:14040
- C:\Windows\System\PARDqDd.exe
  C:\Windows\System\PARDqDd.exe
  2⤵
  PID:14068
- C:\Windows\System\Auzlnnb.exe
  C:\Windows\System\Auzlnnb.exe
  2⤵
  PID:14096
- C:\Windows\System\WIEZhZa.exe
  C:\Windows\System\WIEZhZa.exe
  2⤵
  PID:14136
- C:\Windows\System\TiepPyr.exe
  C:\Windows\System\TiepPyr.exe
  2⤵
  PID:14176
- C:\Windows\System\HClugKR.exe
  C:\Windows\System\HClugKR.exe
  2⤵
  PID:14204
- C:\Windows\System\kGrPNxZ.exe
  C:\Windows\System\kGrPNxZ.exe
  2⤵
  PID:14240
- C:\Windows\System\spSksUc.exe
  C:\Windows\System\spSksUc.exe
  2⤵
  PID:14260
- C:\Windows\System\iPixATy.exe
  C:\Windows\System\iPixATy.exe
  2⤵
  PID:14288
- C:\Windows\System\CInrgNk.exe
  C:\Windows\System\CInrgNk.exe
  2⤵
  PID:14320
- C:\Windows\System\QsGCynH.exe
  C:\Windows\System\QsGCynH.exe
  2⤵
  PID:12672
- C:\Windows\System\LhvbYFa.exe
  C:\Windows\System\LhvbYFa.exe
  2⤵
  PID:13340
- C:\Windows\System\zMUypeH.exe
  C:\Windows\System\zMUypeH.exe
  2⤵
  PID:13376
- C:\Windows\System\gueapDx.exe
  C:\Windows\System\gueapDx.exe
  2⤵
  PID:13416
- C:\Windows\System\iLmClBp.exe
  C:\Windows\System\iLmClBp.exe
  2⤵
  PID:13572
- C:\Windows\System\TUDsexx.exe
  C:\Windows\System\TUDsexx.exe
  2⤵
  PID:13604
- C:\Windows\System\JKMpaLx.exe
  C:\Windows\System\JKMpaLx.exe
  2⤵
  PID:13660
- C:\Windows\System\CiYlCsO.exe
  C:\Windows\System\CiYlCsO.exe
  2⤵
  PID:13696
- C:\Windows\System\sSwQemS.exe
  C:\Windows\System\sSwQemS.exe
  2⤵
  PID:13744
- C:\Windows\System\AWUjLcD.exe
  C:\Windows\System\AWUjLcD.exe
  2⤵
  PID:13916
- C:\Windows\System\McEysvz.exe
  C:\Windows\System\McEysvz.exe
  2⤵
  PID:13992
- C:\Windows\System\vaMzTXA.exe
  C:\Windows\System\vaMzTXA.exe
  2⤵
  PID:14032
- C:\Windows\System\igafipd.exe
  C:\Windows\System\igafipd.exe
  2⤵
  PID:14164
- C:\Windows\System\ABsMvbm.exe
  C:\Windows\System\ABsMvbm.exe
  2⤵
  PID:14092
- C:\Windows\System\ysxixZr.exe
  C:\Windows\System\ysxixZr.exe
  2⤵
  PID:14236
- C:\Windows\System\QGkMsGe.exe
  C:\Windows\System\QGkMsGe.exe
  2⤵
  PID:13040
- C:\Windows\System\tGZAiOD.exe
  C:\Windows\System\tGZAiOD.exe
  2⤵
  PID:13372
- C:\Windows\System\RbpHjYA.exe
  C:\Windows\System\RbpHjYA.exe
  2⤵
  PID:13568
- C:\Windows\System\VesmPmD.exe
  C:\Windows\System\VesmPmD.exe
  2⤵
  PID:13520
- C:\Windows\System\oKTtykf.exe
  C:\Windows\System\oKTtykf.exe
  2⤵
  PID:13680
- C:\Windows\System\gMWEQun.exe
  C:\Windows\System\gMWEQun.exe
  2⤵
  PID:13932
- C:\Windows\System\PLhwCPe.exe
  C:\Windows\System\PLhwCPe.exe
  2⤵
  PID:14104
- C:\Windows\System\IWGduLj.exe
  C:\Windows\System\IWGduLj.exe
  2⤵
  PID:14276
- C:\Windows\System\OewvYUK.exe
  C:\Windows\System\OewvYUK.exe
  2⤵
  PID:14328
- C:\Windows\System\RkSJQql.exe
  C:\Windows\System\RkSJQql.exe
  2⤵
  PID:13844
- C:\Windows\System\kOBXXJL.exe
  C:\Windows\System\kOBXXJL.exe
  2⤵
  PID:13840
- C:\Windows\System\RsTTiWK.exe
  C:\Windows\System\RsTTiWK.exe
  2⤵
  PID:13620
- C:\Windows\System\JNnUzrC.exe
  C:\Windows\System\JNnUzrC.exe
  2⤵
  PID:14352
- C:\Windows\System\fpdxHud.exe
  C:\Windows\System\fpdxHud.exe
  2⤵
  PID:14384
- C:\Windows\System\cLIbJkO.exe
  C:\Windows\System\cLIbJkO.exe
  2⤵
  PID:14408
- C:\Windows\System\depnWcg.exe
  C:\Windows\System\depnWcg.exe
  2⤵
  PID:14436
- C:\Windows\System\LRjtueF.exe
  C:\Windows\System\LRjtueF.exe
  2⤵
  PID:14464
- C:\Windows\System\KxIWRpB.exe
  C:\Windows\System\KxIWRpB.exe
  2⤵
  PID:14500
- C:\Windows\System\nvFcuaz.exe
  C:\Windows\System\nvFcuaz.exe
  2⤵
  PID:14532
- C:\Windows\System\QVhPzpm.exe
  C:\Windows\System\QVhPzpm.exe
  2⤵
  PID:14560
- C:\Windows\System\iGyYoaS.exe
  C:\Windows\System\iGyYoaS.exe
  2⤵
  PID:14584
- C:\Windows\System\StVHJFv.exe
  C:\Windows\System\StVHJFv.exe
  2⤵
  PID:14612
- C:\Windows\System\RjImiMl.exe
  C:\Windows\System\RjImiMl.exe
  2⤵
  PID:14648
- C:\Windows\System\LORydyf.exe
  C:\Windows\System\LORydyf.exe
  2⤵
  PID:14684
- C:\Windows\System\ZNbyFCy.exe
  C:\Windows\System\ZNbyFCy.exe
  2⤵
  PID:14700
- C:\Windows\System\tOqLgBN.exe
  C:\Windows\System\tOqLgBN.exe
  2⤵
  PID:14724
- C:\Windows\System\ItbJetY.exe
  C:\Windows\System\ItbJetY.exe
  2⤵
  PID:14756
- C:\Windows\System\WlRjBLV.exe
  C:\Windows\System\WlRjBLV.exe
  2⤵
  PID:14772
- C:\Windows\System\ZcjSfUe.exe
  C:\Windows\System\ZcjSfUe.exe
  2⤵
  PID:14800
- C:\Windows\System\WWxvFZl.exe
  C:\Windows\System\WWxvFZl.exe
  2⤵
  PID:14820
- C:\Windows\System\rTPWWkN.exe
  C:\Windows\System\rTPWWkN.exe
  2⤵
  PID:14844
- C:\Windows\System\rhVDDSA.exe
  C:\Windows\System\rhVDDSA.exe
  2⤵
  PID:14872
- C:\Windows\System\HKmCHxK.exe
  C:\Windows\System\HKmCHxK.exe
  2⤵
  PID:14892
- C:\Windows\System\ZIwjIxA.exe
  C:\Windows\System\ZIwjIxA.exe
  2⤵
  PID:14920
- C:\Windows\System\kqydJek.exe
  C:\Windows\System\kqydJek.exe
  2⤵
  PID:14948
- C:\Windows\System\wGfaQUD.exe
  C:\Windows\System\wGfaQUD.exe
  2⤵
  PID:14976
- C:\Windows\System\xsaNevG.exe
  C:\Windows\System\xsaNevG.exe
  2⤵
  PID:15012
- C:\Windows\System\ZffRjLp.exe
  C:\Windows\System\ZffRjLp.exe
  2⤵
  PID:15032
- C:\Windows\System\ZFIjzhD.exe
  C:\Windows\System\ZFIjzhD.exe
  2⤵
  PID:15056
- C:\Windows\System\QxwCYYs.exe
  C:\Windows\System\QxwCYYs.exe
  2⤵
  PID:15096
- C:\Windows\System\fFZUPHl.exe
  C:\Windows\System\fFZUPHl.exe
  2⤵
  PID:15120
- C:\Windows\System\GqHLkvq.exe
  C:\Windows\System\GqHLkvq.exe
  2⤵
  PID:15144
- C:\Windows\System\OOmguNN.exe
  C:\Windows\System\OOmguNN.exe
  2⤵
  PID:15176
- C:\Windows\System\ShQDgRn.exe
  C:\Windows\System\ShQDgRn.exe
  2⤵
  PID:15212
- C:\Windows\System\AuOclfu.exe
  C:\Windows\System\AuOclfu.exe
  2⤵
  PID:15248
- C:\Windows\System\UuZMYeO.exe
  C:\Windows\System\UuZMYeO.exe
  2⤵
  PID:15276
- C:\Windows\System\grtYyrG.exe
  C:\Windows\System\grtYyrG.exe
  2⤵
  PID:15300
- C:\Windows\System\HLFCfFp.exe
  C:\Windows\System\HLFCfFp.exe
  2⤵
  PID:15324
- C:\Windows\System\YETgYgX.exe
  C:\Windows\System\YETgYgX.exe
  2⤵
  PID:15356
- C:\Windows\System\dZMtfjU.exe
  C:\Windows\System\dZMtfjU.exe
  2⤵
  PID:13500
- C:\Windows\System\mgMkubq.exe
  C:\Windows\System\mgMkubq.exe
  2⤵
  PID:14396
- C:\Windows\System\vTNlxle.exe
  C:\Windows\System\vTNlxle.exe
  2⤵
  PID:14432
- C:\Windows\System\CfTkIsW.exe
  C:\Windows\System\CfTkIsW.exe
  2⤵
  PID:14548
- C:\Windows\System\pNsmfci.exe
  C:\Windows\System\pNsmfci.exe
  2⤵
  PID:14628
- C:\Windows\System\xhYDDDA.exe
  C:\Windows\System\xhYDDDA.exe
  2⤵
  PID:14572
- C:\Windows\System\QLSqgKJ.exe
  C:\Windows\System\QLSqgKJ.exe
  2⤵
  PID:14716
- C:\Windows\System\vsGKCZy.exe
  C:\Windows\System\vsGKCZy.exe
  2⤵
  PID:14788
- C:\Windows\System\MyORDxd.exe
  C:\Windows\System\MyORDxd.exe
  2⤵
  PID:14868
- C:\Windows\System\EIzMRkd.exe
  C:\Windows\System\EIzMRkd.exe
  2⤵
  PID:14832
- C:\Windows\System\pckkiUc.exe
  C:\Windows\System\pckkiUc.exe
  2⤵
  PID:14912
- C:\Windows\System\EwttbOM.exe
  C:\Windows\System\EwttbOM.exe
  2⤵
  PID:15112
- C:\Windows\System\ykQFfes.exe
  C:\Windows\System\ykQFfes.exe
  2⤵
  PID:15076
- C:\Windows\System\tiRHhmh.exe
  C:\Windows\System\tiRHhmh.exe
  2⤵
  PID:15240
- C:\Windows\System\VpvPFEG.exe
  C:\Windows\System\VpvPFEG.exe
  2⤵
  PID:15196
- C:\Windows\System\eeANvJg.exe
  C:\Windows\System\eeANvJg.exe
  2⤵
  PID:15352
- C:\Windows\System\sDfWPTE.exe
  C:\Windows\System\sDfWPTE.exe
  2⤵
  PID:15316
- C:\Windows\System\yPmYImo.exe
  C:\Windows\System\yPmYImo.exe
  2⤵
  PID:14116
- C:\Windows\System\aJSlSOG.exe
  C:\Windows\System\aJSlSOG.exe
  2⤵
  PID:14556
- C:\Windows\System\cXTfSeC.exe
  C:\Windows\System\cXTfSeC.exe
  2⤵
  PID:14672
- C:\Windows\System\riJyhBj.exe
  C:\Windows\System\riJyhBj.exe
  2⤵
  PID:14916
- C:\Windows\System\DdEHDmi.exe
  C:\Windows\System\DdEHDmi.exe
  2⤵
  PID:14932
- C:\Windows\System\NfKgEZs.exe
  C:\Windows\System\NfKgEZs.exe
  2⤵
  PID:15088
- C:\Windows\System\PDhGiBE.exe
  C:\Windows\System\PDhGiBE.exe
  2⤵
  PID:15224
- C:\Windows\System\gxYHDTm.exe
  C:\Windows\System\gxYHDTm.exe
  2⤵
  PID:14528
- C:\Windows\System\ORiGqoB.exe
  C:\Windows\System\ORiGqoB.exe
  2⤵
  PID:14660
- C:\Windows\System\WwEsnfS.exe
  C:\Windows\System\WwEsnfS.exe
  2⤵
  PID:15132
- C:\Windows\System\IaqBnxW.exe
  C:\Windows\System\IaqBnxW.exe
  2⤵
  PID:15348
- C:\Windows\System\IaHMzQU.exe
  C:\Windows\System\IaHMzQU.exe
  2⤵
  PID:15004
- C:\Windows\System\ptcLCFi.exe
  C:\Windows\System\ptcLCFi.exe
  2⤵
  PID:15392
- C:\Windows\System\wxIpNRn.exe
  C:\Windows\System\wxIpNRn.exe
  2⤵
  PID:15424
- C:\Windows\System\jvJLtrU.exe
  C:\Windows\System\jvJLtrU.exe
  2⤵
  PID:15452
- C:\Windows\System\WkSKhJW.exe
  C:\Windows\System\WkSKhJW.exe
  2⤵
  PID:15484
- C:\Windows\System\CROPoEc.exe
  C:\Windows\System\CROPoEc.exe
  2⤵
  PID:15520
- C:\Windows\System\UDHcART.exe
  C:\Windows\System\UDHcART.exe
  2⤵
  PID:15552
- C:\Windows\System\qlzDaHk.exe
  C:\Windows\System\qlzDaHk.exe
  2⤵
  PID:15580
- C:\Windows\System\DpKvTWX.exe
  C:\Windows\System\DpKvTWX.exe
  2⤵
  PID:15608
- C:\Windows\System\KOtPXXk.exe
  C:\Windows\System\KOtPXXk.exe
  2⤵
  PID:15636
- C:\Windows\System\nItlpWp.exe
  C:\Windows\System\nItlpWp.exe
  2⤵
  PID:15676
- C:\Windows\System\uHVViIk.exe
  C:\Windows\System\uHVViIk.exe
  2⤵
  PID:15704
- C:\Windows\System\eCtjgCW.exe
  C:\Windows\System\eCtjgCW.exe
  2⤵
  PID:15736
- C:\Windows\System\KgkDwdq.exe
  C:\Windows\System\KgkDwdq.exe
  2⤵
  PID:15756
- C:\Windows\System\FfgFSXW.exe
  C:\Windows\System\FfgFSXW.exe
  2⤵
  PID:15776
- C:\Windows\System\DTiwQIU.exe
  C:\Windows\System\DTiwQIU.exe
  2⤵
  PID:15796
- C:\Windows\System\BFDjjfu.exe
  C:\Windows\System\BFDjjfu.exe
  2⤵
  PID:15920
- C:\Windows\System\iVOAipi.exe
  C:\Windows\System\iVOAipi.exe
  2⤵
  PID:15936
- C:\Windows\System\JcfJDFB.exe
  C:\Windows\System\JcfJDFB.exe
  2⤵
  PID:15952
- C:\Windows\System\LQtawDU.exe
  C:\Windows\System\LQtawDU.exe
  2⤵
  PID:15980
- C:\Windows\System\vsxWNiv.exe
  C:\Windows\System\vsxWNiv.exe
  2⤵
  PID:16004
- C:\Windows\System\txAsPRp.exe
  C:\Windows\System\txAsPRp.exe
  2⤵
  PID:16024
- C:\Windows\System\BFaTklY.exe
  C:\Windows\System\BFaTklY.exe
  2⤵
  PID:16052
- C:\Windows\System\YomLOUN.exe
  C:\Windows\System\YomLOUN.exe
  2⤵
  PID:16072
- C:\Windows\System\iGUArdI.exe
  C:\Windows\System\iGUArdI.exe
  2⤵
  PID:16100
- C:\Windows\System\wqPUJRM.exe
  C:\Windows\System\wqPUJRM.exe
  2⤵
  PID:16132
- C:\Windows\System\qGRNcxr.exe
  C:\Windows\System\qGRNcxr.exe
  2⤵
  PID:16160
- C:\Windows\System\kaPCJgE.exe
  C:\Windows\System\kaPCJgE.exe
  2⤵
  PID:16188
- C:\Windows\System\KwekBWR.exe
  C:\Windows\System\KwekBWR.exe
  2⤵
  PID:16208
- C:\Windows\System\KjWHkfL.exe
  C:\Windows\System\KjWHkfL.exe
  2⤵
  PID:16224
- C:\Windows\System\dinMzhb.exe
  C:\Windows\System\dinMzhb.exe
  2⤵
  PID:16248
- C:\Windows\System\AFSADnF.exe
  C:\Windows\System\AFSADnF.exe
  2⤵
  PID:16280
- C:\Windows\System\dPEdONz.exe
  C:\Windows\System\dPEdONz.exe
  2⤵
  PID:16308
- C:\Windows\System\yysHcGR.exe
  C:\Windows\System\yysHcGR.exe
  2⤵
  PID:16336
- C:\Windows\System\SpvdijI.exe
  C:\Windows\System\SpvdijI.exe
  2⤵
  PID:16364
- C:\Windows\System\WvFulol.exe
  C:\Windows\System\WvFulol.exe
  2⤵
  PID:14940
- C:\Windows\System\cryCAHh.exe
  C:\Windows\System\cryCAHh.exe
  2⤵
  PID:15432
- C:\Windows\System\CClJRFF.exe
  C:\Windows\System\CClJRFF.exe
  2⤵
  PID:15504
- C:\Windows\System\rxzMHuk.exe
  C:\Windows\System\rxzMHuk.exe
  2⤵
  PID:15532
- C:\Windows\System\mFDUnsg.exe
  C:\Windows\System\mFDUnsg.exe
  2⤵
  PID:15644
- C:\Windows\System\QfESAYy.exe
  C:\Windows\System\QfESAYy.exe
  2⤵
  PID:15668
- C:\Windows\System\YXnWsSQ.exe
  C:\Windows\System\YXnWsSQ.exe
  2⤵
  PID:15616
- C:\Windows\System\VFzBzYv.exe
  C:\Windows\System\VFzBzYv.exe
  2⤵
  PID:15748
- C:\Windows\System\daEjdoF.exe
  C:\Windows\System\daEjdoF.exe
  2⤵
  PID:15792
- C:\Windows\System\WHfNBUc.exe
  C:\Windows\System\WHfNBUc.exe
  2⤵
  PID:15868
- C:\Windows\System\kZrODyC.exe
  C:\Windows\System\kZrODyC.exe
  2⤵
  PID:15928
- C:\Windows\System\CTlvKLw.exe
  C:\Windows\System\CTlvKLw.exe
  2⤵
  PID:15964
- C:\Windows\System\MgFrrsN.exe
  C:\Windows\System\MgFrrsN.exe
  2⤵
  PID:16144
- C:\Windows\System\VTWZGEa.exe
  C:\Windows\System\VTWZGEa.exe
  2⤵
  PID:16196
- C:\Windows\System\RFBJbRk.exe
  C:\Windows\System\RFBJbRk.exe
  2⤵
  PID:16184
- C:\Windows\System\vncZRaf.exe
  C:\Windows\System\vncZRaf.exe
  2⤵
  PID:16324
- C:\Windows\System\sRNKvCd.exe
  C:\Windows\System\sRNKvCd.exe
  2⤵
  PID:14748
- C:\Windows\System\Vyrzhnv.exe
  C:\Windows\System\Vyrzhnv.exe
  2⤵
  PID:16376
- C:\Windows\System\WNFFbLD.exe
  C:\Windows\System\WNFFbLD.exe
  2⤵
  PID:15468
- C:\Windows\System\wEyVIFw.exe
  C:\Windows\System\wEyVIFw.exe
  2⤵
  PID:15768
- C:\Windows\System\OFTGiDJ.exe
  C:\Windows\System\OFTGiDJ.exe
  2⤵
  PID:15992
- C:\Windows\System\KQctoay.exe
  C:\Windows\System\KQctoay.exe
  2⤵
  PID:16124
- C:\Windows\System\RMjFFOM.exe
  C:\Windows\System\RMjFFOM.exe
  2⤵
  PID:16156
- C:\Windows\System\nBtePDG.exe
  C:\Windows\System\nBtePDG.exe
  2⤵
  PID:16260
- C:\Windows\System\zjvqmfQ.exe
  C:\Windows\System\zjvqmfQ.exe
  2⤵
  PID:15688
- C:\Windows\System\ZANfmwg.exe
  C:\Windows\System\ZANfmwg.exe
  2⤵
  PID:15828
- C:\Windows\System\dwAJYdf.exe
  C:\Windows\System\dwAJYdf.exe
  2⤵
  PID:16356
- C:\Windows\System\PolGtOh.exe
  C:\Windows\System\PolGtOh.exe
  2⤵
  PID:16408
- C:\Windows\System\ZCndfsM.exe
  C:\Windows\System\ZCndfsM.exe
  2⤵
  PID:16436
- C:\Windows\System\cGbThQG.exe
  C:\Windows\System\cGbThQG.exe
  2⤵
  PID:16464
- C:\Windows\System\UxsFCOE.exe
  C:\Windows\System\UxsFCOE.exe
  2⤵
  PID:16492
- C:\Windows\System\yiOSIPX.exe
  C:\Windows\System\yiOSIPX.exe
  2⤵
  PID:16512
- C:\Windows\System\zsRROra.exe
  C:\Windows\System\zsRROra.exe
  2⤵
  PID:16540
- C:\Windows\System\LhsYedN.exe
  C:\Windows\System\LhsYedN.exe
  2⤵
  PID:16580
- C:\Windows\System\SDYnRPh.exe
  C:\Windows\System\SDYnRPh.exe
  2⤵
  PID:16600
- C:\Windows\System\JpKmTOP.exe
  C:\Windows\System\JpKmTOP.exe
  2⤵
  PID:16632
- C:\Windows\System\NPTpivv.exe
  C:\Windows\System\NPTpivv.exe
  2⤵
  PID:16656
- C:\Windows\System\UkMDPBq.exe
  C:\Windows\System\UkMDPBq.exe
  2⤵
  PID:16676
- C:\Windows\System\tQsTJJR.exe
  C:\Windows\System\tQsTJJR.exe
  2⤵
  PID:16696
- C:\Windows\System\yLMIiXK.exe
  C:\Windows\System\yLMIiXK.exe
  2⤵
  PID:16720
- C:\Windows\System\DlYlmUU.exe
  C:\Windows\System\DlYlmUU.exe
  2⤵
  PID:16748
- C:\Windows\System\JcUabfs.exe
  C:\Windows\System\JcUabfs.exe
  2⤵
  PID:16776
- C:\Windows\System\ATvqcuW.exe
  C:\Windows\System\ATvqcuW.exe
  2⤵
  PID:16812
- C:\Windows\System\QBroFJm.exe
  C:\Windows\System\QBroFJm.exe
  2⤵
  PID:16844
- C:\Windows\System\fssZykw.exe
  C:\Windows\System\fssZykw.exe
  2⤵
  PID:16876
- C:\Windows\System\FRGlPWZ.exe
  C:\Windows\System\FRGlPWZ.exe
  2⤵
  PID:16908
- C:\Windows\System\CsLJyeE.exe
  C:\Windows\System\CsLJyeE.exe
  2⤵
  PID:16932
- C:\Windows\System\KJXJXoi.exe
  C:\Windows\System\KJXJXoi.exe
  2⤵
  PID:16960
- C:\Windows\System\wdxofzN.exe
  C:\Windows\System\wdxofzN.exe
  2⤵
  PID:16984
- C:\Windows\System\zZZcnCW.exe
  C:\Windows\System\zZZcnCW.exe
  2⤵
  PID:17012
- C:\Windows\System\ZDgYvAe.exe
  C:\Windows\System\ZDgYvAe.exe
  2⤵
  PID:17092

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:15592

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\BUgdwDW.exe

Filesize
1.7MB

MD5
ba19f805b7f2169c55bfb98c1d574a3d

SHA1
93423b9a8359ef150232d4e1658387bbf2efd4a7

SHA256
bbf976b45167d44b77ef59fe114ac5219174dcd03d9951b5012dbb11bafcbc57

SHA512
2616db50db4fa5428ed5eefc1dd66898698623c53d48ec67e04eb10586854e9ee877c28f38d2408d0eee9e8e00b111585b41b17a5ba84264bcb4bf0b24f0044b

Download Submit
C:\Windows\System\BdjjzbH.exe

Filesize
1.7MB

MD5
8d2a1207a637a2f1e6d265730024e5a3

SHA1
b11ec24cfb60d5a5b564debf9a13f4668a71d2ab

SHA256
9b0daa7807aa9d7caab70f7d7995dc0c30f3f91d14d3515982ba06e3adb40d24

SHA512
4d53274d3601ae9d2686ffd2dbe017f787dc021e8610b5bb4e5e8ca7e7aaae0b765fd199a4032db8dcc1e52c852b1f12b596765452c90693950df2daebdfb026

Download Submit
C:\Windows\System\CEIamJt.exe

Filesize
1.7MB

MD5
2209639d0814cc8387be645ce7746a41

SHA1
fa868ed5c887e36b5feee28ecfe91a63be4ce539

SHA256
dc5f05fbe7fc1d4ef929fa0b0078ffdb89dc9d439c47334f3fe0a228bad1e072

SHA512
d169ca2780f005f40c058f7b89900d244e259f780475d39ce5231f8f88511df5f99bf1bad31286115e61c53e6621cf9f9a1632ba15528bb55024882376391e62

Download Submit
C:\Windows\System\CTiMGQu.exe

Filesize
1.7MB

MD5
f28d67e5355ae045d39bbb7dd8bce188

SHA1
d786dc0d721fd1395b599e617e379c60a7e38238

SHA256
73faf270e38beb1cde5e14ab384e79fb88e58b183b14ae42009d13e7819d60bb

SHA512
d6a064bca885fe1d8d00a6eea69d45aa86c0bea86fa21c346e32de2edaf4f4d8fc654145fd7f579b0d6701e1821611821428cc19f4e0c527612c617ded8c530f

Download Submit
C:\Windows\System\DXyoAjo.exe

Filesize
1.7MB

MD5
926fa1e1373525a371602fd6a6b0be53

SHA1
d5297e8221d24b90decd460b637f58729a4b6fba

SHA256
ee3e516b109553586cbd9b7f5c18ae54f4507bf5597f08ca7437eb2986b5bee6

SHA512
1a64b43c8e7a57e16fccef530e39f2b55b893d50433173dfb00fb418310a4e0c69552a7e6bbad202c7ced9f9e9aa57002a2842ebe86782eb3b690c32874fc4e4

Download Submit
C:\Windows\System\IZndPwq.exe

Filesize
1.7MB

MD5
0a2f6bd742d15d8268896150069a754e

SHA1
1b9002b591451d4e40d76273a47133c451f73f11

SHA256
9cba2cc4b8b25bdbe0d81cb6047ce2fe15169aa4be10ab1ddf70a1b27ca2abc1

SHA512
2de399eacc1cd29cd88a77f92c19d2fa011491127fc87ce57dd1de280e68bdda3d498aea64045ee27c801bb9ce30481035a8f50c9d8f296722a461bba325e760

Download Submit
C:\Windows\System\IbNqKLK.exe

Filesize
1.7MB

MD5
b87d67b21d1efef76977905b06436f60

SHA1
5ba472acb81320d5bc0141fd82ffe9bf5a245c54

SHA256
874997923ea831daf1691c0d1e33d84efca8e2ca1b871c8000a53a0358c66a01

SHA512
a2dc7ee32f5b4bbeb9ead5bea2d62441a3f60d325b52f42e38535d0fc321d9e11e88a0507a0a8ee8038f11fd80705d5a9146c2a24b2d3bd0e63ac93ce77a5b39

Download Submit
C:\Windows\System\KHCxrUX.exe

Filesize
1.7MB

MD5
759ba3a574d2abe5747461e08144cf93

SHA1
11d76840618cb5d9cbd80b68dc406759ea41ed0f

SHA256
1c8d89202b57fa06a421b084d9ece095a838faaaad2664397406503c4b012173

SHA512
1c1bff6023f62459688eec48359070d7fa5d90401fc352f107283ab456a17c3e9a874d83634d85371e9299ac752fd9dc23b69f32631df1da76aeeae0bfd15f72

Download Submit
C:\Windows\System\LPLdZCZ.exe

Filesize
1.7MB

MD5
b0d19ac696747ab078147fb8e1fea530

SHA1
4c7620266fa614f8b1d85608f8839c211425c29b

SHA256
dbfff8bc2cb7d05b97af8fd81c06e012ab05cf9acc7b7460b875e55f99f7144b

SHA512
4d577d5d29134d9386dcb820d39f48224305ee2f4b56d42d1d49c3164e322553fea3e81d37376480988160adf367b64c9ffad178f9d76852a623821a048977b5

Download Submit
C:\Windows\System\MhLEPKk.exe

Filesize
1.7MB

MD5
894b30f64fb2016ec720cd71e196d858

SHA1
9cabcdac12d65ea631d3585840fa00e9aafffa6c

SHA256
f472fd26d38b51f2cf1db6e0216b8e7eafa7e5fc97b9aa759c01039fd059b025

SHA512
3eeeef573624f1a07d753835c42a5d9affd4151492363aee28c89d38d45f48e4424ee48b221dd3197a2f805bde253addda192f0e483adaef7fcd903ef824ff1f

Download Submit
C:\Windows\System\NcMbLSc.exe

Filesize
1.7MB

MD5
f6c314ba4e39565d09d75c757dc2e914

SHA1
00408052cb6df877203575128c60ae2e4ec82256

SHA256
e85f403c4535e0c937112c9e4e4042421485d6cfa904c20f0c4a23c9b10f83d1

SHA512
a7059474ade7193e0be0f3770626e09e9f285140509a0c6f708374b4d98072037f4bd274c73b5bf7bb5a75e92590e19d16a697f65116341deffcde727e3305b3

Download Submit
C:\Windows\System\NuoPASy.exe

Filesize
1.7MB

MD5
eb65f6df6f46425aef4a27da04661ae6

SHA1
bd9df06571ef713a12595abfc76058121e59d4d4

SHA256
2843a4de5ea49f5ced37f3cc6237b4c9df66b2a710087903a959c7acedafcd24

SHA512
e99a2a93c71fd7aca6da51800dc9a99db566e514bbb23d0fd72c5faffdb1c4dedad7da6aa00079995d42968e553eb88a2ef1461178249de03ec9dd079bb8487d

Download Submit
C:\Windows\System\OyPIiZY.exe

Filesize
1.7MB

MD5
d7f72f2d7a2ad586ca3a0bfff42f9500

SHA1
cd554d89362a0804fc54753221bd9d32ce19ee3a

SHA256
6d960d8ed26c6f43abc9db06c5d7e5f52bd2e550abaeb16a99445e2a8cc4029e

SHA512
c59e9086d65c62cf21637a8c0d8e5d5da3615e39575e7f2b855bc34ddc1dd2c2eac4a0bf1e7808df893fce8fe304403410ba714ea0126d5192ebf85f66358f40

Download Submit
C:\Windows\System\ROcojhF.exe

Filesize
1.7MB

MD5
d19843873dd4b88108f7ac7910ca4506

SHA1
f56a3433c9b83d3a989cc3536610cf9b6789c4db

SHA256
d7bf0b89a1dd290cf2b7974ec3d77714785f3f7a0909567541188577c6b39a5a

SHA512
39d857f1f9df9e24fdcc48e0760eed3b637547a42aea250a89d8371fcaef7d3ac79bc0afb6efe2820db477356778535c197765680fc8fc996b38181eecf8f3c5

Download Submit
C:\Windows\System\RXGqQvY.exe

Filesize
1.7MB

MD5
c0ddf52c0957df4fe12bc660511a05e8

SHA1
5939999e781691cf7f249f8646c3e231495c535e

SHA256
b884a19991a2cb7679d788afdb5d3d9bf4a8ea085d042efb642353979c5e49f0

SHA512
e4b8862772b3967404b46b09d3ad469c06f502c81fe79d0932b7031b556266175aaed88eac5968f702247a335c189b79a50a24d5f6d5e15b3a761d19cbc85cdf

Download Submit
C:\Windows\System\TTSvuyJ.exe

Filesize
1.7MB

MD5
d6d363af07de43d88fbfded9f66af076

SHA1
21e81b22dfc012a8297fbb0ecdfd7e6aac12f79e

SHA256
09f929317a144e900dbb02e527d1c5ef67178bdd06e92e9d1957c92417a0441b

SHA512
d1ae13ad82022aa58c4b35a7bfa8adb556f4ec1a2df27f30a9dd3328424b390da26a87de98dd65183a451624bfe7ee714b6d57277c3f6d491fba406e1e47b1d4

Download Submit
C:\Windows\System\URgLQjz.exe

Filesize
1.7MB

MD5
20476545c01dd9bd605b3249a65ea32a

SHA1
8cc7bc2371d374acd095a8a7dbb74bd426d7b45b

SHA256
f1f6668fd08e9f6e25e73ffb1f43140c2c3959261d21fdd6bddd9a72ad11f0e5

SHA512
4171ce921b7b766690bd3bf38f3ee503ba734c06d32e90c9a8507f54305637b440f4944be303c35a2e33d02756a0c205ebf3b2f04d716db4c0d1dd97c575febb

Download Submit
C:\Windows\System\VzAvjnr.exe

Filesize
1.7MB

MD5
c7904f9ee7d9ea25649a8b63add9cb1b

SHA1
df5ebcc2063a28cf0bd0976ea932cbee1545eb25

SHA256
b513fb5c986565e3e2d4ec3b5e6056cbb69371492951eb1add21b00959b515e4

SHA512
062bee77a4f694bb15b7bf660b63efb6ab0888ac0cfea02d74bb99e4135516b88398f8bfe9eedb35832d440da1b261e0d4699c71f13142858adf6a4667a72344

Download Submit
C:\Windows\System\XonETiZ.exe

Filesize
1.7MB

MD5
dd70a534d255083f671f76239d692d94

SHA1
3ab2044117effd981feba26160f6f0f10280552d

SHA256
63791ef07f3e56a25ddcb931e5ece0c5664c05b293512c1cd58c41467234c106

SHA512
e9f48d4fe9426ab56b14265fc67b090f586abf58fa9bdee487dbe42325c7f99e3013caf05d72c28ac22003e4fe656504c106210ea82266adbda8350ab188ae8f

Download Submit
C:\Windows\System\YrJcjAQ.exe

Filesize
1.7MB

MD5
f348a50b12fc421dd923cbebeea2c88b

SHA1
2275e4c844cd8d5573f9c02b2328a29d335b367a

SHA256
fd9e7f71f386ac46693619eff9ae54c895bdbcbcf83ef20f39dc3ee357147b0e

SHA512
48e8406a15b249c7bacaab9651666b254e4d02b72574550983bb4d109d90efd33291a819bb96a60267e13dda977f47493b9dd79bf27f874b6064936ddcd4d360

Download Submit
C:\Windows\System\ZURUhGI.exe

Filesize
1.7MB

MD5
23002b01889fff555d938c530cab765b

SHA1
38692d72b36e2e0402b590ee1d0c097a74abc278

SHA256
e043497b5b81f51371db66b8be6beb49d058d1bac289829abe779412f6c2080d

SHA512
f164cb4619023a7d546fa969780f9b4fafe986a5853d0b456250d77fffbdb56aab71dffa17e27eac8744a8581dab22fb198fb79bbd48db07ae0fbc4f6b0ff287

Download Submit
C:\Windows\System\bdDogWp.exe

Filesize
1.7MB

MD5
fce717918a13d9aa42609edd8172ec24

SHA1
e6d72e8f2442eb10047c28e89e10ff27468186e4

SHA256
d72fcaea386b9644eec263caf6769659067c8b920e13354df32cd653b9ee59cc

SHA512
5af67f5f586d5733269c059731b3ed4272108d15098598c223b58a9227c189bfe813a13033664180b3a0976c2a393d2ea68c1105cdca0d3dfb30ca2e04421c1c

Download Submit
C:\Windows\System\dEqlmtk.exe

Filesize
1.7MB

MD5
bef6e768f482fa226367fa07ceb3b97e

SHA1
756fc9c33d9982a702c1f96a9e7329a6be1ea575

SHA256
3e8943c501a0ab9790c9c77085b9a7addcf693e08bf8bc48368146c224995527

SHA512
50663d83bfeade08cab540ca44bfc26a88021c6ed3b6baad96a34d7040c8b3b54c140651e14d76b5fd2389bc1eb9d36eb96ccc6bb72f7504d30de5947e3ca410

Download Submit
C:\Windows\System\dMYvdYV.exe

Filesize
1.7MB

MD5
deeb3b05da378c2735d2a5cb3a83321f

SHA1
2cea689d1c9843815f6e2f6690a7cb5a5c37513c

SHA256
1c9211dc0819ae77cfbf83a8882c32cc411943ee5ed0e00a3d52fd1d4ec3340f

SHA512
37971e1bd921ba710391637675e19e907596d509eb349fdff7fd95961205dbf683ef7324bca6994ed033eff80692c8f95a1b21b7ae2ce8227890d161361a250d

Download Submit
C:\Windows\System\elPfSBo.exe

Filesize
1.7MB

MD5
b808b0bae5c9d45f1fe4925eb48c7da4

SHA1
6a558eb522fd436d6db557bd6fbc2da07a45b094

SHA256
576494b88f36c95cea3c674502812e3c5f4e2b0255f4e46e1f097573ad17d505

SHA512
7e0b6dc650edbbab0ecd0e63525145f093bf9349a250dcd00fd062bf03b04f510a7c958d247d02adfc533268c1ce7f657327cfa9deb85817f81b6cbd8f717fae

Download Submit
C:\Windows\System\iyXabyS.exe

Filesize
1.7MB

MD5
4cac2772e4efbf5bbd0fd47d826569f4

SHA1
61f922343f132a39404e6fe4b7db8fc4b35a58e6

SHA256
3bf94cd5d75df0b7879bb09122a820f22bdcf41abb2afc58a5445d7e138c680c

SHA512
5481702527cbccb2dc6cd58110b2dab6f6bd505223fbb407d5603fe3f916956d350d59223b979ad8a2fe854722704371e6ad3cb2f37b3fca8d981d524abc4f05

Download Submit
C:\Windows\System\ouoAgMm.exe

Filesize
1.7MB

MD5
4189a0042bf54f005ae6ed3faf481d6f

SHA1
8b92d931c85b0ac79f70ca4a98db04e5efa1f644

SHA256
407e3d5976c254743834e47c9397c1b90439396167acc6291bdf5d319f68da1f

SHA512
b60d932daa133ab95027bc8709fbe73293f7aa4a28b8c65fd48012c268e782cbab6de1ed031fda157ab262c7de6ecccd96ea83e85d22e5003059be5888d3aaff

Download Submit
C:\Windows\System\qVtMJXw.exe

Filesize
1.7MB

MD5
dc95d323d341869a7c89643aef36f318

SHA1
10a31d4e13cf8f0f3ef26c0f01acc74b4ba683c7

SHA256
6fa294b806391e9f58a67962c45d706ab7e48e0ef8ba5a397cd04fa920967334

SHA512
1ea747a808aeae667cc87916d48802c54d1d9231e5d73abc2386b10d78f23bed4d990da57deb0976fee02598de5d20256c7f005ef3d482af49394cfe63e93fb0

Download Submit
C:\Windows\System\tpRBbnq.exe

Filesize
1.7MB

MD5
a97543f9b60095636f7a24bb3a88243f

SHA1
6bfa7c3588e918bf969a56de72facba04f2ec497

SHA256
78d4b1882e34f08d8b12665d1903397d85234d767badd205812da0ba90b6ed25

SHA512
eef29722d8e327eef0b54154929e3e4f96fddea08036362e082ea7a15d6408c60fef070664a7c14cc8cc3f5f0fb2d2242a67a24b0eb67def24363b50689fa739

Download Submit
C:\Windows\System\uTSbkMx.exe

Filesize
1.7MB

MD5
029aa52eb0d7a1fd58495cfcd8235c5f

SHA1
1a200ba0514cf44df0d79a66e3c6a21d054894e0

SHA256
8525756d58988b26882a5053856b5ee2ec116c61e082b8d77b4742458dc0ab2a

SHA512
f63f49b914884394c4c4d1d7e3a39d4befee9cb07c476513f907f0f20ff91c1ee8d772d6312f36c6c7316e11d80acf2bce2f76575cad3ae5d39522af106dab47

Download Submit
C:\Windows\System\wNsmyPE.exe

Filesize
1.7MB

MD5
90625ebd4bab2685a218d5f8ae11e385

SHA1
67bdc2eea769e5de03e5322fd2143c13fe898ecb

SHA256
bf150b37a7b98f8186cf132b0916f7b7b101559093fd0450892115b2fe1761a8

SHA512
c72ae015d7e82ee1bc3a54a44c5b27d6fac30883ee7c8104bc785a197be2885fb2b08d6642763d9bdb56bb7f0affb848fdfda7d9340bf6b024050865dbe36131

Download Submit
C:\Windows\System\wYYYfTn.exe

Filesize
1.7MB

MD5
b667b0466118515f789d0783dbcf10f8

SHA1
ec3bce07aebb901cd2ddb8265f433a1e45615838

SHA256
85954d469eabdc0bc009cc12cc9400ca9ce267f81792b5a5657c1ba51237b3d5

SHA512
605d040cea9c2847d8175a01f321e465f342ec4fffaa4b5367d50088440bdddd50746a86e54b3f1521b9f122aba17b2f8ed506b2bbd262a56585bf9cd932d686

Download Submit
C:\Windows\System\ysBoYMb.exe

Filesize
1.7MB

MD5
a96112ee63ad4b6aa40b8d00b51443b2

SHA1
9b8c0164c7d0f71b575a5fb7fa59301a811b6642

SHA256
0e1585413ea581c5991edb62695895a1d2ec0631bc922e8f2c79a9d447a5fa6f

SHA512
19a13219dbc4410c1bf496856b28bfc1ad7fed40bbd3521233924a971679cfffd9247334a622833d3f148f8868f1e5126d7e24b95f9f7901d253b6c968002ab8

Download Submit
memory/948-0-0x0000021E1A670000-0x0000021E1A680000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads