xmrig | ba9c622d2db2c825061b85a0e095a59e38acdadee5206a609f68a49fc33270bb

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
24-12-2024 01:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ba9c622d2db2c825061b85a0e095a59e38acdadee5206a609f68a49fc33270bb.exe
Size

1.1MB
MD5

2b5df86c848df81b7cbca673acbbd803
SHA1

97c18661d2294057e6aa820c713f1df6458a98e9
SHA256

ba9c622d2db2c825061b85a0e095a59e38acdadee5206a609f68a49fc33270bb
SHA512

903f8f6825d19a176b0ae9c55488011a2e6b69d9da6be3590ffde71bc7d36350d33291556fa58a1a15bb4af8f5596b32bc1a81cc45418f33788ea7f92f3c1ba6
SSDEEP

24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbpwlKenszQEMrrC54u8S:GezaTF8FcNkNdfE0pZ9ozttwIRQoZ

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 33 IoCs

miner

resource	yara_rule
behavioral2/files/0x000b000000023bc0-3.dat	xmrig
behavioral2/files/0x000c000000023c92-9.dat	xmrig
behavioral2/files/0x0007000000023c9c-19.dat	xmrig
behavioral2/files/0x0007000000023c9d-23.dat	xmrig
behavioral2/files/0x0007000000023ca0-34.dat	xmrig
behavioral2/files/0x0007000000023ca5-57.dat	xmrig
behavioral2/files/0x0007000000023cb1-117.dat	xmrig
behavioral2/files/0x0007000000023cba-162.dat	xmrig
behavioral2/files/0x0007000000023cb8-160.dat	xmrig
behavioral2/files/0x0007000000023cb9-157.dat	xmrig
behavioral2/files/0x0007000000023cb7-155.dat	xmrig
behavioral2/files/0x0007000000023cb6-150.dat	xmrig
behavioral2/files/0x0007000000023cb5-145.dat	xmrig
behavioral2/files/0x0007000000023cb4-140.dat	xmrig
behavioral2/files/0x0007000000023cb3-135.dat	xmrig
behavioral2/files/0x0007000000023cb2-130.dat	xmrig
behavioral2/files/0x0007000000023cb0-120.dat	xmrig
behavioral2/files/0x0007000000023caf-115.dat	xmrig
behavioral2/files/0x0007000000023cae-110.dat	xmrig
behavioral2/files/0x0007000000023cad-105.dat	xmrig
behavioral2/files/0x0007000000023cac-100.dat	xmrig
behavioral2/files/0x0007000000023cab-95.dat	xmrig
behavioral2/files/0x0007000000023caa-90.dat	xmrig
behavioral2/files/0x0007000000023ca9-85.dat	xmrig
behavioral2/files/0x0007000000023ca8-80.dat	xmrig
behavioral2/files/0x0007000000023ca7-75.dat	xmrig
behavioral2/files/0x0007000000023ca6-70.dat	xmrig
behavioral2/files/0x0007000000023ca4-60.dat	xmrig
behavioral2/files/0x0007000000023ca3-52.dat	xmrig
behavioral2/files/0x0007000000023ca2-48.dat	xmrig
behavioral2/files/0x0007000000023ca1-40.dat	xmrig
behavioral2/files/0x0007000000023c9e-30.dat	xmrig
behavioral2/files/0x0007000000023c9b-14.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
4188	xDGlRdA.exe
1156	gWqzXti.exe
1340	ZHyVeGQ.exe
2180	fEisaDy.exe
4532	HUbQAuD.exe
4540	SqAathX.exe
4788	eVMkxCf.exe
5072	StdWGoh.exe
4968	qUUOnoJ.exe
1196	bHdsRDs.exe
2808	kDHmAmd.exe
2388	QisZKWA.exe
432	mMZYBIv.exe
1400	PgCbhUt.exe
3140	kRyEgCT.exe
4880	iBYezsM.exe
3408	bwwkSBJ.exe
1852	kfOZNvu.exe
3988	vjYVGui.exe
2784	KRcTjTX.exe
2236	KztZBWo.exe
4340	IvfAvzW.exe
4912	zWsjdoa.exe
1688	FIespPj.exe
2508	XMzUjUG.exe
4712	OAdiyjs.exe
4012	qZPRmke.exe
4516	gbvNnBb.exe
2776	JPObwRf.exe
692	NVWyLTn.exe
4032	hcjyzJd.exe
4976	APGQTWV.exe
1032	konGMcB.exe
4416	czGqvhj.exe
3592	tYqEhVv.exe
1344	fMaesKv.exe
64	aVHduxk.exe
2360	MCaCEsk.exe
4616	yFsxKhv.exe
4228	aKYeUKb.exe
2044	puJtKdQ.exe
1832	gaOwboa.exe
396	ywHGmED.exe
2076	SKnxORW.exe
5024	JBbmgPh.exe
4600	JkYqIsf.exe
1588	UYlaTJb.exe
2912	ADHsJLa.exe
1732	jeTGuID.exe
1604	tROOida.exe
2396	OkmAbQk.exe
4700	NAsMHDe.exe
868	eRFCKRn.exe
1524	RZUqgjs.exe
3008	GuFKExH.exe
2520	iqUfPwn.exe
4316	LISJyNX.exe
3292	LcwNrqi.exe
5092	LxyYYFl.exe
924	Twggmsg.exe
2356	eghLseP.exe
2300	aVPawpm.exe
1520	acRyUQh.exe
4608	DuNGVQg.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\ikCJNRg.exe	ba9c622d2db2c825061b85a0e095a59e38acdadee5206a609f68a49fc33270bb.exe
File created	C:\Windows\System\HpkfuLf.exe	ba9c622d2db2c825061b85a0e095a59e38acdadee5206a609f68a49fc33270bb.exe
File created	C:\Windows\System\kDHmAmd.exe	ba9c622d2db2c825061b85a0e095a59e38acdadee5206a609f68a49fc33270bb.exe
File created	C:\Windows\System\gAtoupG.exe	ba9c622d2db2c825061b85a0e095a59e38acdadee5206a609f68a49fc33270bb.exe
File created	C:\Windows\System\aJVYiis.exe	ba9c622d2db2c825061b85a0e095a59e38acdadee5206a609f68a49fc33270bb.exe
File created	C:\Windows\System\JdlmGId.exe	ba9c622d2db2c825061b85a0e095a59e38acdadee5206a609f68a49fc33270bb.exe
File created	C:\Windows\System\YRWGhmb.exe	ba9c622d2db2c825061b85a0e095a59e38acdadee5206a609f68a49fc33270bb.exe
File created	C:\Windows\System\vFvfLOr.exe	ba9c622d2db2c825061b85a0e095a59e38acdadee5206a609f68a49fc33270bb.exe
File created	C:\Windows\System\sfwQkJD.exe	ba9c622d2db2c825061b85a0e095a59e38acdadee5206a609f68a49fc33270bb.exe
File created	C:\Windows\System\NhlhWgz.exe	ba9c622d2db2c825061b85a0e095a59e38acdadee5206a609f68a49fc33270bb.exe
File created	C:\Windows\System\kaaJqik.exe	ba9c622d2db2c825061b85a0e095a59e38acdadee5206a609f68a49fc33270bb.exe
File created	C:\Windows\System\thjIVUn.exe	ba9c622d2db2c825061b85a0e095a59e38acdadee5206a609f68a49fc33270bb.exe
File created	C:\Windows\System\xSARzKJ.exe	ba9c622d2db2c825061b85a0e095a59e38acdadee5206a609f68a49fc33270bb.exe
File created	C:\Windows\System\bshAWDV.exe	ba9c622d2db2c825061b85a0e095a59e38acdadee5206a609f68a49fc33270bb.exe
File created	C:\Windows\System\DKzVFGj.exe	ba9c622d2db2c825061b85a0e095a59e38acdadee5206a609f68a49fc33270bb.exe
File created	C:\Windows\System\Zvilcot.exe	ba9c622d2db2c825061b85a0e095a59e38acdadee5206a609f68a49fc33270bb.exe
File created	C:\Windows\System\mftDzoU.exe	ba9c622d2db2c825061b85a0e095a59e38acdadee5206a609f68a49fc33270bb.exe
File created	C:\Windows\System\tFdTjSV.exe	ba9c622d2db2c825061b85a0e095a59e38acdadee5206a609f68a49fc33270bb.exe
File created	C:\Windows\System\oDwtmpx.exe	ba9c622d2db2c825061b85a0e095a59e38acdadee5206a609f68a49fc33270bb.exe
File created	C:\Windows\System\bwvCYwz.exe	ba9c622d2db2c825061b85a0e095a59e38acdadee5206a609f68a49fc33270bb.exe
File created	C:\Windows\System\GyuXFQY.exe	ba9c622d2db2c825061b85a0e095a59e38acdadee5206a609f68a49fc33270bb.exe
File created	C:\Windows\System\yFsxKhv.exe	ba9c622d2db2c825061b85a0e095a59e38acdadee5206a609f68a49fc33270bb.exe
File created	C:\Windows\System\sjddVMO.exe	ba9c622d2db2c825061b85a0e095a59e38acdadee5206a609f68a49fc33270bb.exe
File created	C:\Windows\System\jZrxBJh.exe	ba9c622d2db2c825061b85a0e095a59e38acdadee5206a609f68a49fc33270bb.exe
File created	C:\Windows\System\BrrgEOM.exe	ba9c622d2db2c825061b85a0e095a59e38acdadee5206a609f68a49fc33270bb.exe
File created	C:\Windows\System\ZjfEFox.exe	ba9c622d2db2c825061b85a0e095a59e38acdadee5206a609f68a49fc33270bb.exe
File created	C:\Windows\System\IHaSyIs.exe	ba9c622d2db2c825061b85a0e095a59e38acdadee5206a609f68a49fc33270bb.exe
File created	C:\Windows\System\vZNSVEc.exe	ba9c622d2db2c825061b85a0e095a59e38acdadee5206a609f68a49fc33270bb.exe
File created	C:\Windows\System\SdMYeAd.exe	ba9c622d2db2c825061b85a0e095a59e38acdadee5206a609f68a49fc33270bb.exe
File created	C:\Windows\System\gvDpnZp.exe	ba9c622d2db2c825061b85a0e095a59e38acdadee5206a609f68a49fc33270bb.exe
File created	C:\Windows\System\DuNGVQg.exe	ba9c622d2db2c825061b85a0e095a59e38acdadee5206a609f68a49fc33270bb.exe
File created	C:\Windows\System\NQPjdiY.exe	ba9c622d2db2c825061b85a0e095a59e38acdadee5206a609f68a49fc33270bb.exe
File created	C:\Windows\System\RJshMqB.exe	ba9c622d2db2c825061b85a0e095a59e38acdadee5206a609f68a49fc33270bb.exe
File created	C:\Windows\System\AuXDQCb.exe	ba9c622d2db2c825061b85a0e095a59e38acdadee5206a609f68a49fc33270bb.exe
File created	C:\Windows\System\anheUHb.exe	ba9c622d2db2c825061b85a0e095a59e38acdadee5206a609f68a49fc33270bb.exe
File created	C:\Windows\System\ObsXCWt.exe	ba9c622d2db2c825061b85a0e095a59e38acdadee5206a609f68a49fc33270bb.exe
File created	C:\Windows\System\xBAbvAH.exe	ba9c622d2db2c825061b85a0e095a59e38acdadee5206a609f68a49fc33270bb.exe
File created	C:\Windows\System\jUfUQyn.exe	ba9c622d2db2c825061b85a0e095a59e38acdadee5206a609f68a49fc33270bb.exe
File created	C:\Windows\System\xqHoAqQ.exe	ba9c622d2db2c825061b85a0e095a59e38acdadee5206a609f68a49fc33270bb.exe
File created	C:\Windows\System\akYEtES.exe	ba9c622d2db2c825061b85a0e095a59e38acdadee5206a609f68a49fc33270bb.exe
File created	C:\Windows\System\eBlgyiA.exe	ba9c622d2db2c825061b85a0e095a59e38acdadee5206a609f68a49fc33270bb.exe
File created	C:\Windows\System\czGqvhj.exe	ba9c622d2db2c825061b85a0e095a59e38acdadee5206a609f68a49fc33270bb.exe
File created	C:\Windows\System\vEmnvGD.exe	ba9c622d2db2c825061b85a0e095a59e38acdadee5206a609f68a49fc33270bb.exe
File created	C:\Windows\System\kRSBvOX.exe	ba9c622d2db2c825061b85a0e095a59e38acdadee5206a609f68a49fc33270bb.exe
File created	C:\Windows\System\eeqfENI.exe	ba9c622d2db2c825061b85a0e095a59e38acdadee5206a609f68a49fc33270bb.exe
File created	C:\Windows\System\ApLgIWB.exe	ba9c622d2db2c825061b85a0e095a59e38acdadee5206a609f68a49fc33270bb.exe
File created	C:\Windows\System\pnvBViE.exe	ba9c622d2db2c825061b85a0e095a59e38acdadee5206a609f68a49fc33270bb.exe
File created	C:\Windows\System\WAOnYbl.exe	ba9c622d2db2c825061b85a0e095a59e38acdadee5206a609f68a49fc33270bb.exe
File created	C:\Windows\System\BvtsFTl.exe	ba9c622d2db2c825061b85a0e095a59e38acdadee5206a609f68a49fc33270bb.exe
File created	C:\Windows\System\ImtmzBq.exe	ba9c622d2db2c825061b85a0e095a59e38acdadee5206a609f68a49fc33270bb.exe
File created	C:\Windows\System\VYXtjOX.exe	ba9c622d2db2c825061b85a0e095a59e38acdadee5206a609f68a49fc33270bb.exe
File created	C:\Windows\System\yeEPjKs.exe	ba9c622d2db2c825061b85a0e095a59e38acdadee5206a609f68a49fc33270bb.exe
File created	C:\Windows\System\FMwedLh.exe	ba9c622d2db2c825061b85a0e095a59e38acdadee5206a609f68a49fc33270bb.exe
File created	C:\Windows\System\DRJakzb.exe	ba9c622d2db2c825061b85a0e095a59e38acdadee5206a609f68a49fc33270bb.exe
File created	C:\Windows\System\qOnhpYs.exe	ba9c622d2db2c825061b85a0e095a59e38acdadee5206a609f68a49fc33270bb.exe
File created	C:\Windows\System\lxSRxdV.exe	ba9c622d2db2c825061b85a0e095a59e38acdadee5206a609f68a49fc33270bb.exe
File created	C:\Windows\System\jHbGTKC.exe	ba9c622d2db2c825061b85a0e095a59e38acdadee5206a609f68a49fc33270bb.exe
File created	C:\Windows\System\xDGlRdA.exe	ba9c622d2db2c825061b85a0e095a59e38acdadee5206a609f68a49fc33270bb.exe
File created	C:\Windows\System\dqAjWIo.exe	ba9c622d2db2c825061b85a0e095a59e38acdadee5206a609f68a49fc33270bb.exe
File created	C:\Windows\System\tUGhrDD.exe	ba9c622d2db2c825061b85a0e095a59e38acdadee5206a609f68a49fc33270bb.exe
File created	C:\Windows\System\fjJKucj.exe	ba9c622d2db2c825061b85a0e095a59e38acdadee5206a609f68a49fc33270bb.exe
File created	C:\Windows\System\eRFCKRn.exe	ba9c622d2db2c825061b85a0e095a59e38acdadee5206a609f68a49fc33270bb.exe
File created	C:\Windows\System\SlUbclv.exe	ba9c622d2db2c825061b85a0e095a59e38acdadee5206a609f68a49fc33270bb.exe
File created	C:\Windows\System\CgclGCa.exe	ba9c622d2db2c825061b85a0e095a59e38acdadee5206a609f68a49fc33270bb.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	17276	dwm.exe
Token: SeChangeNotifyPrivilege	17276	dwm.exe
Token: 33	17276	dwm.exe
Token: SeIncBasePriorityPrivilege	17276	dwm.exe
Token: SeShutdownPrivilege	17276	dwm.exe
Token: SeCreatePagefilePrivilege	17276	dwm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4684 wrote to memory of 4188	4684	ba9c622d2db2c825061b85a0e095a59e38acdadee5206a609f68a49fc33270bb.exe	84
PID 4684 wrote to memory of 4188	4684	ba9c622d2db2c825061b85a0e095a59e38acdadee5206a609f68a49fc33270bb.exe	84
PID 4684 wrote to memory of 1156	4684	ba9c622d2db2c825061b85a0e095a59e38acdadee5206a609f68a49fc33270bb.exe	85
PID 4684 wrote to memory of 1156	4684	ba9c622d2db2c825061b85a0e095a59e38acdadee5206a609f68a49fc33270bb.exe	85
PID 4684 wrote to memory of 1340	4684	ba9c622d2db2c825061b85a0e095a59e38acdadee5206a609f68a49fc33270bb.exe	86
PID 4684 wrote to memory of 1340	4684	ba9c622d2db2c825061b85a0e095a59e38acdadee5206a609f68a49fc33270bb.exe	86
PID 4684 wrote to memory of 2180	4684	ba9c622d2db2c825061b85a0e095a59e38acdadee5206a609f68a49fc33270bb.exe	87
PID 4684 wrote to memory of 2180	4684	ba9c622d2db2c825061b85a0e095a59e38acdadee5206a609f68a49fc33270bb.exe	87
PID 4684 wrote to memory of 4532	4684	ba9c622d2db2c825061b85a0e095a59e38acdadee5206a609f68a49fc33270bb.exe	88
PID 4684 wrote to memory of 4532	4684	ba9c622d2db2c825061b85a0e095a59e38acdadee5206a609f68a49fc33270bb.exe	88
PID 4684 wrote to memory of 4540	4684	ba9c622d2db2c825061b85a0e095a59e38acdadee5206a609f68a49fc33270bb.exe	89
PID 4684 wrote to memory of 4540	4684	ba9c622d2db2c825061b85a0e095a59e38acdadee5206a609f68a49fc33270bb.exe	89
PID 4684 wrote to memory of 4788	4684	ba9c622d2db2c825061b85a0e095a59e38acdadee5206a609f68a49fc33270bb.exe	90
PID 4684 wrote to memory of 4788	4684	ba9c622d2db2c825061b85a0e095a59e38acdadee5206a609f68a49fc33270bb.exe	90
PID 4684 wrote to memory of 5072	4684	ba9c622d2db2c825061b85a0e095a59e38acdadee5206a609f68a49fc33270bb.exe	91
PID 4684 wrote to memory of 5072	4684	ba9c622d2db2c825061b85a0e095a59e38acdadee5206a609f68a49fc33270bb.exe	91
PID 4684 wrote to memory of 4968	4684	ba9c622d2db2c825061b85a0e095a59e38acdadee5206a609f68a49fc33270bb.exe	92
PID 4684 wrote to memory of 4968	4684	ba9c622d2db2c825061b85a0e095a59e38acdadee5206a609f68a49fc33270bb.exe	92
PID 4684 wrote to memory of 1196	4684	ba9c622d2db2c825061b85a0e095a59e38acdadee5206a609f68a49fc33270bb.exe	93
PID 4684 wrote to memory of 1196	4684	ba9c622d2db2c825061b85a0e095a59e38acdadee5206a609f68a49fc33270bb.exe	93
PID 4684 wrote to memory of 2808	4684	ba9c622d2db2c825061b85a0e095a59e38acdadee5206a609f68a49fc33270bb.exe	94
PID 4684 wrote to memory of 2808	4684	ba9c622d2db2c825061b85a0e095a59e38acdadee5206a609f68a49fc33270bb.exe	94
PID 4684 wrote to memory of 2388	4684	ba9c622d2db2c825061b85a0e095a59e38acdadee5206a609f68a49fc33270bb.exe	95
PID 4684 wrote to memory of 2388	4684	ba9c622d2db2c825061b85a0e095a59e38acdadee5206a609f68a49fc33270bb.exe	95
PID 4684 wrote to memory of 432	4684	ba9c622d2db2c825061b85a0e095a59e38acdadee5206a609f68a49fc33270bb.exe	96
PID 4684 wrote to memory of 432	4684	ba9c622d2db2c825061b85a0e095a59e38acdadee5206a609f68a49fc33270bb.exe	96
PID 4684 wrote to memory of 1400	4684	ba9c622d2db2c825061b85a0e095a59e38acdadee5206a609f68a49fc33270bb.exe	97
PID 4684 wrote to memory of 1400	4684	ba9c622d2db2c825061b85a0e095a59e38acdadee5206a609f68a49fc33270bb.exe	97
PID 4684 wrote to memory of 3140	4684	ba9c622d2db2c825061b85a0e095a59e38acdadee5206a609f68a49fc33270bb.exe	98
PID 4684 wrote to memory of 3140	4684	ba9c622d2db2c825061b85a0e095a59e38acdadee5206a609f68a49fc33270bb.exe	98
PID 4684 wrote to memory of 4880	4684	ba9c622d2db2c825061b85a0e095a59e38acdadee5206a609f68a49fc33270bb.exe	99
PID 4684 wrote to memory of 4880	4684	ba9c622d2db2c825061b85a0e095a59e38acdadee5206a609f68a49fc33270bb.exe	99
PID 4684 wrote to memory of 3408	4684	ba9c622d2db2c825061b85a0e095a59e38acdadee5206a609f68a49fc33270bb.exe	100
PID 4684 wrote to memory of 3408	4684	ba9c622d2db2c825061b85a0e095a59e38acdadee5206a609f68a49fc33270bb.exe	100
PID 4684 wrote to memory of 1852	4684	ba9c622d2db2c825061b85a0e095a59e38acdadee5206a609f68a49fc33270bb.exe	101
PID 4684 wrote to memory of 1852	4684	ba9c622d2db2c825061b85a0e095a59e38acdadee5206a609f68a49fc33270bb.exe	101
PID 4684 wrote to memory of 3988	4684	ba9c622d2db2c825061b85a0e095a59e38acdadee5206a609f68a49fc33270bb.exe	102
PID 4684 wrote to memory of 3988	4684	ba9c622d2db2c825061b85a0e095a59e38acdadee5206a609f68a49fc33270bb.exe	102
PID 4684 wrote to memory of 2784	4684	ba9c622d2db2c825061b85a0e095a59e38acdadee5206a609f68a49fc33270bb.exe	103
PID 4684 wrote to memory of 2784	4684	ba9c622d2db2c825061b85a0e095a59e38acdadee5206a609f68a49fc33270bb.exe	103
PID 4684 wrote to memory of 2236	4684	ba9c622d2db2c825061b85a0e095a59e38acdadee5206a609f68a49fc33270bb.exe	104
PID 4684 wrote to memory of 2236	4684	ba9c622d2db2c825061b85a0e095a59e38acdadee5206a609f68a49fc33270bb.exe	104
PID 4684 wrote to memory of 4340	4684	ba9c622d2db2c825061b85a0e095a59e38acdadee5206a609f68a49fc33270bb.exe	105
PID 4684 wrote to memory of 4340	4684	ba9c622d2db2c825061b85a0e095a59e38acdadee5206a609f68a49fc33270bb.exe	105
PID 4684 wrote to memory of 4912	4684	ba9c622d2db2c825061b85a0e095a59e38acdadee5206a609f68a49fc33270bb.exe	106
PID 4684 wrote to memory of 4912	4684	ba9c622d2db2c825061b85a0e095a59e38acdadee5206a609f68a49fc33270bb.exe	106
PID 4684 wrote to memory of 1688	4684	ba9c622d2db2c825061b85a0e095a59e38acdadee5206a609f68a49fc33270bb.exe	107
PID 4684 wrote to memory of 1688	4684	ba9c622d2db2c825061b85a0e095a59e38acdadee5206a609f68a49fc33270bb.exe	107
PID 4684 wrote to memory of 2508	4684	ba9c622d2db2c825061b85a0e095a59e38acdadee5206a609f68a49fc33270bb.exe	108
PID 4684 wrote to memory of 2508	4684	ba9c622d2db2c825061b85a0e095a59e38acdadee5206a609f68a49fc33270bb.exe	108
PID 4684 wrote to memory of 4712	4684	ba9c622d2db2c825061b85a0e095a59e38acdadee5206a609f68a49fc33270bb.exe	109
PID 4684 wrote to memory of 4712	4684	ba9c622d2db2c825061b85a0e095a59e38acdadee5206a609f68a49fc33270bb.exe	109
PID 4684 wrote to memory of 4012	4684	ba9c622d2db2c825061b85a0e095a59e38acdadee5206a609f68a49fc33270bb.exe	110
PID 4684 wrote to memory of 4012	4684	ba9c622d2db2c825061b85a0e095a59e38acdadee5206a609f68a49fc33270bb.exe	110
PID 4684 wrote to memory of 4516	4684	ba9c622d2db2c825061b85a0e095a59e38acdadee5206a609f68a49fc33270bb.exe	111
PID 4684 wrote to memory of 4516	4684	ba9c622d2db2c825061b85a0e095a59e38acdadee5206a609f68a49fc33270bb.exe	111
PID 4684 wrote to memory of 2776	4684	ba9c622d2db2c825061b85a0e095a59e38acdadee5206a609f68a49fc33270bb.exe	112
PID 4684 wrote to memory of 2776	4684	ba9c622d2db2c825061b85a0e095a59e38acdadee5206a609f68a49fc33270bb.exe	112
PID 4684 wrote to memory of 692	4684	ba9c622d2db2c825061b85a0e095a59e38acdadee5206a609f68a49fc33270bb.exe	113
PID 4684 wrote to memory of 692	4684	ba9c622d2db2c825061b85a0e095a59e38acdadee5206a609f68a49fc33270bb.exe	113
PID 4684 wrote to memory of 4032	4684	ba9c622d2db2c825061b85a0e095a59e38acdadee5206a609f68a49fc33270bb.exe	114
PID 4684 wrote to memory of 4032	4684	ba9c622d2db2c825061b85a0e095a59e38acdadee5206a609f68a49fc33270bb.exe	114
PID 4684 wrote to memory of 4976	4684	ba9c622d2db2c825061b85a0e095a59e38acdadee5206a609f68a49fc33270bb.exe	115
PID 4684 wrote to memory of 4976	4684	ba9c622d2db2c825061b85a0e095a59e38acdadee5206a609f68a49fc33270bb.exe	115

C:\Users\Admin\AppData\Local\Temp\ba9c622d2db2c825061b85a0e095a59e38acdadee5206a609f68a49fc33270bb.exe
"C:\Users\Admin\AppData\Local\Temp\ba9c622d2db2c825061b85a0e095a59e38acdadee5206a609f68a49fc33270bb.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4684
- C:\Windows\System\xDGlRdA.exe
  C:\Windows\System\xDGlRdA.exe
  2⤵
  - Executes dropped EXE
  PID:4188
- C:\Windows\System\gWqzXti.exe
  C:\Windows\System\gWqzXti.exe
  2⤵
  - Executes dropped EXE
  PID:1156
- C:\Windows\System\ZHyVeGQ.exe
  C:\Windows\System\ZHyVeGQ.exe
  2⤵
  - Executes dropped EXE
  PID:1340
- C:\Windows\System\fEisaDy.exe
  C:\Windows\System\fEisaDy.exe
  2⤵
  - Executes dropped EXE
  PID:2180
- C:\Windows\System\HUbQAuD.exe
  C:\Windows\System\HUbQAuD.exe
  2⤵
  - Executes dropped EXE
  PID:4532
- C:\Windows\System\SqAathX.exe
  C:\Windows\System\SqAathX.exe
  2⤵
  - Executes dropped EXE
  PID:4540
- C:\Windows\System\eVMkxCf.exe
  C:\Windows\System\eVMkxCf.exe
  2⤵
  - Executes dropped EXE
  PID:4788
- C:\Windows\System\StdWGoh.exe
  C:\Windows\System\StdWGoh.exe
  2⤵
  - Executes dropped EXE
  PID:5072
- C:\Windows\System\qUUOnoJ.exe
  C:\Windows\System\qUUOnoJ.exe
  2⤵
  - Executes dropped EXE
  PID:4968
- C:\Windows\System\bHdsRDs.exe
  C:\Windows\System\bHdsRDs.exe
  2⤵
  - Executes dropped EXE
  PID:1196
- C:\Windows\System\kDHmAmd.exe
  C:\Windows\System\kDHmAmd.exe
  2⤵
  - Executes dropped EXE
  PID:2808
- C:\Windows\System\QisZKWA.exe
  C:\Windows\System\QisZKWA.exe
  2⤵
  - Executes dropped EXE
  PID:2388
- C:\Windows\System\mMZYBIv.exe
  C:\Windows\System\mMZYBIv.exe
  2⤵
  - Executes dropped EXE
  PID:432
- C:\Windows\System\PgCbhUt.exe
  C:\Windows\System\PgCbhUt.exe
  2⤵
  - Executes dropped EXE
  PID:1400
- C:\Windows\System\kRyEgCT.exe
  C:\Windows\System\kRyEgCT.exe
  2⤵
  - Executes dropped EXE
  PID:3140
- C:\Windows\System\iBYezsM.exe
  C:\Windows\System\iBYezsM.exe
  2⤵
  - Executes dropped EXE
  PID:4880
- C:\Windows\System\bwwkSBJ.exe
  C:\Windows\System\bwwkSBJ.exe
  2⤵
  - Executes dropped EXE
  PID:3408
- C:\Windows\System\kfOZNvu.exe
  C:\Windows\System\kfOZNvu.exe
  2⤵
  - Executes dropped EXE
  PID:1852
- C:\Windows\System\vjYVGui.exe
  C:\Windows\System\vjYVGui.exe
  2⤵
  - Executes dropped EXE
  PID:3988
- C:\Windows\System\KRcTjTX.exe
  C:\Windows\System\KRcTjTX.exe
  2⤵
  - Executes dropped EXE
  PID:2784
- C:\Windows\System\KztZBWo.exe
  C:\Windows\System\KztZBWo.exe
  2⤵
  - Executes dropped EXE
  PID:2236
- C:\Windows\System\IvfAvzW.exe
  C:\Windows\System\IvfAvzW.exe
  2⤵
  - Executes dropped EXE
  PID:4340
- C:\Windows\System\zWsjdoa.exe
  C:\Windows\System\zWsjdoa.exe
  2⤵
  - Executes dropped EXE
  PID:4912
- C:\Windows\System\FIespPj.exe
  C:\Windows\System\FIespPj.exe
  2⤵
  - Executes dropped EXE
  PID:1688
- C:\Windows\System\XMzUjUG.exe
  C:\Windows\System\XMzUjUG.exe
  2⤵
  - Executes dropped EXE
  PID:2508
- C:\Windows\System\OAdiyjs.exe
  C:\Windows\System\OAdiyjs.exe
  2⤵
  - Executes dropped EXE
  PID:4712
- C:\Windows\System\qZPRmke.exe
  C:\Windows\System\qZPRmke.exe
  2⤵
  - Executes dropped EXE
  PID:4012
- C:\Windows\System\gbvNnBb.exe
  C:\Windows\System\gbvNnBb.exe
  2⤵
  - Executes dropped EXE
  PID:4516
- C:\Windows\System\JPObwRf.exe
  C:\Windows\System\JPObwRf.exe
  2⤵
  - Executes dropped EXE
  PID:2776
- C:\Windows\System\NVWyLTn.exe
  C:\Windows\System\NVWyLTn.exe
  2⤵
  - Executes dropped EXE
  PID:692
- C:\Windows\System\hcjyzJd.exe
  C:\Windows\System\hcjyzJd.exe
  2⤵
  - Executes dropped EXE
  PID:4032
- C:\Windows\System\APGQTWV.exe
  C:\Windows\System\APGQTWV.exe
  2⤵
  - Executes dropped EXE
  PID:4976
- C:\Windows\System\konGMcB.exe
  C:\Windows\System\konGMcB.exe
  2⤵
  - Executes dropped EXE
  PID:1032
- C:\Windows\System\czGqvhj.exe
  C:\Windows\System\czGqvhj.exe
  2⤵
  - Executes dropped EXE
  PID:4416
- C:\Windows\System\tYqEhVv.exe
  C:\Windows\System\tYqEhVv.exe
  2⤵
  - Executes dropped EXE
  PID:3592
- C:\Windows\System\fMaesKv.exe
  C:\Windows\System\fMaesKv.exe
  2⤵
  - Executes dropped EXE
  PID:1344
- C:\Windows\System\aVHduxk.exe
  C:\Windows\System\aVHduxk.exe
  2⤵
  - Executes dropped EXE
  PID:64
- C:\Windows\System\MCaCEsk.exe
  C:\Windows\System\MCaCEsk.exe
  2⤵
  - Executes dropped EXE
  PID:2360
- C:\Windows\System\yFsxKhv.exe
  C:\Windows\System\yFsxKhv.exe
  2⤵
  - Executes dropped EXE
  PID:4616
- C:\Windows\System\aKYeUKb.exe
  C:\Windows\System\aKYeUKb.exe
  2⤵
  - Executes dropped EXE
  PID:4228
- C:\Windows\System\puJtKdQ.exe
  C:\Windows\System\puJtKdQ.exe
  2⤵
  - Executes dropped EXE
  PID:2044
- C:\Windows\System\gaOwboa.exe
  C:\Windows\System\gaOwboa.exe
  2⤵
  - Executes dropped EXE
  PID:1832
- C:\Windows\System\ywHGmED.exe
  C:\Windows\System\ywHGmED.exe
  2⤵
  - Executes dropped EXE
  PID:396
- C:\Windows\System\SKnxORW.exe
  C:\Windows\System\SKnxORW.exe
  2⤵
  - Executes dropped EXE
  PID:2076
- C:\Windows\System\JBbmgPh.exe
  C:\Windows\System\JBbmgPh.exe
  2⤵
  - Executes dropped EXE
  PID:5024
- C:\Windows\System\JkYqIsf.exe
  C:\Windows\System\JkYqIsf.exe
  2⤵
  - Executes dropped EXE
  PID:4600
- C:\Windows\System\UYlaTJb.exe
  C:\Windows\System\UYlaTJb.exe
  2⤵
  - Executes dropped EXE
  PID:1588
- C:\Windows\System\ADHsJLa.exe
  C:\Windows\System\ADHsJLa.exe
  2⤵
  - Executes dropped EXE
  PID:2912
- C:\Windows\System\jeTGuID.exe
  C:\Windows\System\jeTGuID.exe
  2⤵
  - Executes dropped EXE
  PID:1732
- C:\Windows\System\tROOida.exe
  C:\Windows\System\tROOida.exe
  2⤵
  - Executes dropped EXE
  PID:1604
- C:\Windows\System\OkmAbQk.exe
  C:\Windows\System\OkmAbQk.exe
  2⤵
  - Executes dropped EXE
  PID:2396
- C:\Windows\System\NAsMHDe.exe
  C:\Windows\System\NAsMHDe.exe
  2⤵
  - Executes dropped EXE
  PID:4700
- C:\Windows\System\eRFCKRn.exe
  C:\Windows\System\eRFCKRn.exe
  2⤵
  - Executes dropped EXE
  PID:868
- C:\Windows\System\RZUqgjs.exe
  C:\Windows\System\RZUqgjs.exe
  2⤵
  - Executes dropped EXE
  PID:1524
- C:\Windows\System\GuFKExH.exe
  C:\Windows\System\GuFKExH.exe
  2⤵
  - Executes dropped EXE
  PID:3008
- C:\Windows\System\iqUfPwn.exe
  C:\Windows\System\iqUfPwn.exe
  2⤵
  - Executes dropped EXE
  PID:2520
- C:\Windows\System\LISJyNX.exe
  C:\Windows\System\LISJyNX.exe
  2⤵
  - Executes dropped EXE
  PID:4316
- C:\Windows\System\LcwNrqi.exe
  C:\Windows\System\LcwNrqi.exe
  2⤵
  - Executes dropped EXE
  PID:3292
- C:\Windows\System\LxyYYFl.exe
  C:\Windows\System\LxyYYFl.exe
  2⤵
  - Executes dropped EXE
  PID:5092
- C:\Windows\System\Twggmsg.exe
  C:\Windows\System\Twggmsg.exe
  2⤵
  - Executes dropped EXE
  PID:924
- C:\Windows\System\eghLseP.exe
  C:\Windows\System\eghLseP.exe
  2⤵
  - Executes dropped EXE
  PID:2356
- C:\Windows\System\aVPawpm.exe
  C:\Windows\System\aVPawpm.exe
  2⤵
  - Executes dropped EXE
  PID:2300
- C:\Windows\System\acRyUQh.exe
  C:\Windows\System\acRyUQh.exe
  2⤵
  - Executes dropped EXE
  PID:1520
- C:\Windows\System\DuNGVQg.exe
  C:\Windows\System\DuNGVQg.exe
  2⤵
  - Executes dropped EXE
  PID:4608
- C:\Windows\System\ntXsibh.exe
  C:\Windows\System\ntXsibh.exe
  2⤵
  PID:5116
- C:\Windows\System\wqbrlxy.exe
  C:\Windows\System\wqbrlxy.exe
  2⤵
  PID:2952
- C:\Windows\System\ZQsabpY.exe
  C:\Windows\System\ZQsabpY.exe
  2⤵
  PID:4080
- C:\Windows\System\shuletr.exe
  C:\Windows\System\shuletr.exe
  2⤵
  PID:208
- C:\Windows\System\RCgbwMJ.exe
  C:\Windows\System\RCgbwMJ.exe
  2⤵
  PID:1560
- C:\Windows\System\wLHOAYM.exe
  C:\Windows\System\wLHOAYM.exe
  2⤵
  PID:4836
- C:\Windows\System\vQzcRTk.exe
  C:\Windows\System\vQzcRTk.exe
  2⤵
  PID:1968
- C:\Windows\System\rWmbbUI.exe
  C:\Windows\System\rWmbbUI.exe
  2⤵
  PID:3804
- C:\Windows\System\PRObPUF.exe
  C:\Windows\System\PRObPUF.exe
  2⤵
  PID:4772
- C:\Windows\System\aYRXArF.exe
  C:\Windows\System\aYRXArF.exe
  2⤵
  PID:2652
- C:\Windows\System\ObsXCWt.exe
  C:\Windows\System\ObsXCWt.exe
  2⤵
  PID:2116
- C:\Windows\System\swRqkLs.exe
  C:\Windows\System\swRqkLs.exe
  2⤵
  PID:2916
- C:\Windows\System\YvkCdbr.exe
  C:\Windows\System\YvkCdbr.exe
  2⤵
  PID:2704
- C:\Windows\System\mACEBtk.exe
  C:\Windows\System\mACEBtk.exe
  2⤵
  PID:3536
- C:\Windows\System\SBZPYqa.exe
  C:\Windows\System\SBZPYqa.exe
  2⤵
  PID:1860
- C:\Windows\System\nbZZKsJ.exe
  C:\Windows\System\nbZZKsJ.exe
  2⤵
  PID:4660
- C:\Windows\System\rTwYoBg.exe
  C:\Windows\System\rTwYoBg.exe
  2⤵
  PID:1740
- C:\Windows\System\VBdAKJY.exe
  C:\Windows\System\VBdAKJY.exe
  2⤵
  PID:2188
- C:\Windows\System\mvjDMVx.exe
  C:\Windows\System\mvjDMVx.exe
  2⤵
  PID:4596
- C:\Windows\System\TFeNuxB.exe
  C:\Windows\System\TFeNuxB.exe
  2⤵
  PID:4748
- C:\Windows\System\gIclnqq.exe
  C:\Windows\System\gIclnqq.exe
  2⤵
  PID:404
- C:\Windows\System\INfLblm.exe
  C:\Windows\System\INfLblm.exe
  2⤵
  PID:4856
- C:\Windows\System\bchDnwY.exe
  C:\Windows\System\bchDnwY.exe
  2⤵
  PID:1364
- C:\Windows\System\bvFAgNU.exe
  C:\Windows\System\bvFAgNU.exe
  2⤵
  PID:5132
- C:\Windows\System\XvfLYLu.exe
  C:\Windows\System\XvfLYLu.exe
  2⤵
  PID:5156
- C:\Windows\System\qAgQGFD.exe
  C:\Windows\System\qAgQGFD.exe
  2⤵
  PID:5188
- C:\Windows\System\OrcmRbp.exe
  C:\Windows\System\OrcmRbp.exe
  2⤵
  PID:5216
- C:\Windows\System\MfKhCpD.exe
  C:\Windows\System\MfKhCpD.exe
  2⤵
  PID:5240
- C:\Windows\System\EUoLIOZ.exe
  C:\Windows\System\EUoLIOZ.exe
  2⤵
  PID:5272
- C:\Windows\System\cHPnhGq.exe
  C:\Windows\System\cHPnhGq.exe
  2⤵
  PID:5296
- C:\Windows\System\thjIVUn.exe
  C:\Windows\System\thjIVUn.exe
  2⤵
  PID:5328
- C:\Windows\System\dRltxmT.exe
  C:\Windows\System\dRltxmT.exe
  2⤵
  PID:5352
- C:\Windows\System\wOizZUi.exe
  C:\Windows\System\wOizZUi.exe
  2⤵
  PID:5384
- C:\Windows\System\wNGHVnp.exe
  C:\Windows\System\wNGHVnp.exe
  2⤵
  PID:5412
- C:\Windows\System\xSARzKJ.exe
  C:\Windows\System\xSARzKJ.exe
  2⤵
  PID:5440
- C:\Windows\System\jSZGnZt.exe
  C:\Windows\System\jSZGnZt.exe
  2⤵
  PID:5464
- C:\Windows\System\iWmCkrZ.exe
  C:\Windows\System\iWmCkrZ.exe
  2⤵
  PID:5496
- C:\Windows\System\YgQQfdp.exe
  C:\Windows\System\YgQQfdp.exe
  2⤵
  PID:5524
- C:\Windows\System\ESRSMRX.exe
  C:\Windows\System\ESRSMRX.exe
  2⤵
  PID:5548
- C:\Windows\System\LdQLVcv.exe
  C:\Windows\System\LdQLVcv.exe
  2⤵
  PID:5580
- C:\Windows\System\jJAmDoS.exe
  C:\Windows\System\jJAmDoS.exe
  2⤵
  PID:5604
- C:\Windows\System\ZjfEFox.exe
  C:\Windows\System\ZjfEFox.exe
  2⤵
  PID:5636
- C:\Windows\System\ZDWILZb.exe
  C:\Windows\System\ZDWILZb.exe
  2⤵
  PID:5664
- C:\Windows\System\OCSvxpU.exe
  C:\Windows\System\OCSvxpU.exe
  2⤵
  PID:5688
- C:\Windows\System\rWCfVMO.exe
  C:\Windows\System\rWCfVMO.exe
  2⤵
  PID:5720
- C:\Windows\System\pWFYqXE.exe
  C:\Windows\System\pWFYqXE.exe
  2⤵
  PID:5744
- C:\Windows\System\MQjFHDp.exe
  C:\Windows\System\MQjFHDp.exe
  2⤵
  PID:5780
- C:\Windows\System\yZaJvvC.exe
  C:\Windows\System\yZaJvvC.exe
  2⤵
  PID:5816
- C:\Windows\System\mVPSYVa.exe
  C:\Windows\System\mVPSYVa.exe
  2⤵
  PID:5840
- C:\Windows\System\GzdqTJo.exe
  C:\Windows\System\GzdqTJo.exe
  2⤵
  PID:5860
- C:\Windows\System\haJyihZ.exe
  C:\Windows\System\haJyihZ.exe
  2⤵
  PID:5884
- C:\Windows\System\dIideaJ.exe
  C:\Windows\System\dIideaJ.exe
  2⤵
  PID:5916
- C:\Windows\System\uqHIfZA.exe
  C:\Windows\System\uqHIfZA.exe
  2⤵
  PID:5944
- C:\Windows\System\DEfDfJw.exe
  C:\Windows\System\DEfDfJw.exe
  2⤵
  PID:5968
- C:\Windows\System\faTywMv.exe
  C:\Windows\System\faTywMv.exe
  2⤵
  PID:6000
- C:\Windows\System\IqgvIId.exe
  C:\Windows\System\IqgvIId.exe
  2⤵
  PID:6024
- C:\Windows\System\zGqiVst.exe
  C:\Windows\System\zGqiVst.exe
  2⤵
  PID:6056
- C:\Windows\System\pQiBhRE.exe
  C:\Windows\System\pQiBhRE.exe
  2⤵
  PID:6080
- C:\Windows\System\NTFbVYq.exe
  C:\Windows\System\NTFbVYq.exe
  2⤵
  PID:6112
- C:\Windows\System\vbUVLru.exe
  C:\Windows\System\vbUVLru.exe
  2⤵
  PID:6140
- C:\Windows\System\EajDkpO.exe
  C:\Windows\System\EajDkpO.exe
  2⤵
  PID:748
- C:\Windows\System\hxisIvb.exe
  C:\Windows\System\hxisIvb.exe
  2⤵
  PID:1596
- C:\Windows\System\NeUsBML.exe
  C:\Windows\System\NeUsBML.exe
  2⤵
  PID:2968
- C:\Windows\System\VwKVGpB.exe
  C:\Windows\System\VwKVGpB.exe
  2⤵
  PID:3428
- C:\Windows\System\mHxMjRu.exe
  C:\Windows\System\mHxMjRu.exe
  2⤵
  PID:944
- C:\Windows\System\YEXwQCg.exe
  C:\Windows\System\YEXwQCg.exe
  2⤵
  PID:3340
- C:\Windows\System\ZEaDBQW.exe
  C:\Windows\System\ZEaDBQW.exe
  2⤵
  PID:3840
- C:\Windows\System\zvMUViN.exe
  C:\Windows\System\zvMUViN.exe
  2⤵
  PID:5168
- C:\Windows\System\aNNRqfB.exe
  C:\Windows\System\aNNRqfB.exe
  2⤵
  PID:5236
- C:\Windows\System\ShFMqTs.exe
  C:\Windows\System\ShFMqTs.exe
  2⤵
  PID:5288
- C:\Windows\System\FXdptbS.exe
  C:\Windows\System\FXdptbS.exe
  2⤵
  PID:5336
- C:\Windows\System\syekgMt.exe
  C:\Windows\System\syekgMt.exe
  2⤵
  PID:5392
- C:\Windows\System\tnyZVPd.exe
  C:\Windows\System\tnyZVPd.exe
  2⤵
  PID:5456
- C:\Windows\System\oARFNfo.exe
  C:\Windows\System\oARFNfo.exe
  2⤵
  PID:2320
- C:\Windows\System\regzRTD.exe
  C:\Windows\System\regzRTD.exe
  2⤵
  PID:5560
- C:\Windows\System\VHdggDM.exe
  C:\Windows\System\VHdggDM.exe
  2⤵
  PID:5624
- C:\Windows\System\mZvvyWW.exe
  C:\Windows\System\mZvvyWW.exe
  2⤵
  PID:5700
- C:\Windows\System\DRJakzb.exe
  C:\Windows\System\DRJakzb.exe
  2⤵
  PID:5756
- C:\Windows\System\BCLhseh.exe
  C:\Windows\System\BCLhseh.exe
  2⤵
  PID:5824
- C:\Windows\System\XIuPfgY.exe
  C:\Windows\System\XIuPfgY.exe
  2⤵
  PID:5876
- C:\Windows\System\IiTjqAQ.exe
  C:\Windows\System\IiTjqAQ.exe
  2⤵
  PID:5936
- C:\Windows\System\ChBvFsv.exe
  C:\Windows\System\ChBvFsv.exe
  2⤵
  PID:5988
- C:\Windows\System\JSyNYhH.exe
  C:\Windows\System\JSyNYhH.exe
  2⤵
  PID:6040
- C:\Windows\System\qePAfFs.exe
  C:\Windows\System\qePAfFs.exe
  2⤵
  PID:6120
- C:\Windows\System\ElsaiCX.exe
  C:\Windows\System\ElsaiCX.exe
  2⤵
  PID:2080
- C:\Windows\System\dtMLilR.exe
  C:\Windows\System\dtMLilR.exe
  2⤵
  PID:2240
- C:\Windows\System\xFFUhSZ.exe
  C:\Windows\System\xFFUhSZ.exe
  2⤵
  PID:3628
- C:\Windows\System\AtcQdQa.exe
  C:\Windows\System\AtcQdQa.exe
  2⤵
  PID:3040
- C:\Windows\System\sjddVMO.exe
  C:\Windows\System\sjddVMO.exe
  2⤵
  PID:5280
- C:\Windows\System\KnIvqJg.exe
  C:\Windows\System\KnIvqJg.exe
  2⤵
  PID:5420
- C:\Windows\System\BhwnIvB.exe
  C:\Windows\System\BhwnIvB.exe
  2⤵
  PID:5540
- C:\Windows\System\wAfXZXz.exe
  C:\Windows\System\wAfXZXz.exe
  2⤵
  PID:5672
- C:\Windows\System\yTizAnN.exe
  C:\Windows\System\yTizAnN.exe
  2⤵
  PID:4792
- C:\Windows\System\TqfxWcx.exe
  C:\Windows\System\TqfxWcx.exe
  2⤵
  PID:3960
- C:\Windows\System\HTVABsZ.exe
  C:\Windows\System\HTVABsZ.exe
  2⤵
  PID:3740
- C:\Windows\System\FnsFovm.exe
  C:\Windows\System\FnsFovm.exe
  2⤵
  PID:6072
- C:\Windows\System\JwfSpWH.exe
  C:\Windows\System\JwfSpWH.exe
  2⤵
  PID:1212
- C:\Windows\System\gMnvxeM.exe
  C:\Windows\System\gMnvxeM.exe
  2⤵
  PID:2928
- C:\Windows\System\IHaSyIs.exe
  C:\Windows\System\IHaSyIs.exe
  2⤵
  PID:3940
- C:\Windows\System\UkOPivK.exe
  C:\Windows\System\UkOPivK.exe
  2⤵
  PID:5516
- C:\Windows\System\AVhCYSU.exe
  C:\Windows\System\AVhCYSU.exe
  2⤵
  PID:5600
- C:\Windows\System\xvxRFBS.exe
  C:\Windows\System\xvxRFBS.exe
  2⤵
  PID:4692
- C:\Windows\System\zQPZNki.exe
  C:\Windows\System\zQPZNki.exe
  2⤵
  PID:2260
- C:\Windows\System\TOQEwIK.exe
  C:\Windows\System\TOQEwIK.exe
  2⤵
  PID:4744
- C:\Windows\System\dthhQiI.exe
  C:\Windows\System\dthhQiI.exe
  2⤵
  PID:4804
- C:\Windows\System\kiVVgdf.exe
  C:\Windows\System\kiVVgdf.exe
  2⤵
  PID:3456
- C:\Windows\System\wVYbRmw.exe
  C:\Windows\System\wVYbRmw.exe
  2⤵
  PID:5596
- C:\Windows\System\UPnurAi.exe
  C:\Windows\System\UPnurAi.exe
  2⤵
  PID:3640
- C:\Windows\System\wRqIWVe.exe
  C:\Windows\System\wRqIWVe.exe
  2⤵
  PID:3320
- C:\Windows\System\CJInrlh.exe
  C:\Windows\System\CJInrlh.exe
  2⤵
  PID:5740
- C:\Windows\System\eesdnHk.exe
  C:\Windows\System\eesdnHk.exe
  2⤵
  PID:4636
- C:\Windows\System\kdBRinU.exe
  C:\Windows\System\kdBRinU.exe
  2⤵
  PID:1656
- C:\Windows\System\yJhfxxS.exe
  C:\Windows\System\yJhfxxS.exe
  2⤵
  PID:1536
- C:\Windows\System\iFFJmCJ.exe
  C:\Windows\System\iFFJmCJ.exe
  2⤵
  PID:6164
- C:\Windows\System\TikPOXg.exe
  C:\Windows\System\TikPOXg.exe
  2⤵
  PID:6188
- C:\Windows\System\vqaHLsz.exe
  C:\Windows\System\vqaHLsz.exe
  2⤵
  PID:6212
- C:\Windows\System\ANkSpBr.exe
  C:\Windows\System\ANkSpBr.exe
  2⤵
  PID:6232
- C:\Windows\System\yMYuWfv.exe
  C:\Windows\System\yMYuWfv.exe
  2⤵
  PID:6248
- C:\Windows\System\pqTsDCq.exe
  C:\Windows\System\pqTsDCq.exe
  2⤵
  PID:6292
- C:\Windows\System\NQPjdiY.exe
  C:\Windows\System\NQPjdiY.exe
  2⤵
  PID:6320
- C:\Windows\System\tQdIHoc.exe
  C:\Windows\System\tQdIHoc.exe
  2⤵
  PID:6356
- C:\Windows\System\SxAZxBM.exe
  C:\Windows\System\SxAZxBM.exe
  2⤵
  PID:6388
- C:\Windows\System\tcjRTIq.exe
  C:\Windows\System\tcjRTIq.exe
  2⤵
  PID:6416
- C:\Windows\System\XyPrPtA.exe
  C:\Windows\System\XyPrPtA.exe
  2⤵
  PID:6440
- C:\Windows\System\irdrRBz.exe
  C:\Windows\System\irdrRBz.exe
  2⤵
  PID:6472
- C:\Windows\System\SGrCXUM.exe
  C:\Windows\System\SGrCXUM.exe
  2⤵
  PID:6496
- C:\Windows\System\hxZaJCp.exe
  C:\Windows\System\hxZaJCp.exe
  2⤵
  PID:6512
- C:\Windows\System\vFvfLOr.exe
  C:\Windows\System\vFvfLOr.exe
  2⤵
  PID:6544
- C:\Windows\System\OWRFCwX.exe
  C:\Windows\System\OWRFCwX.exe
  2⤵
  PID:6572
- C:\Windows\System\HhoPoXk.exe
  C:\Windows\System\HhoPoXk.exe
  2⤵
  PID:6596
- C:\Windows\System\rWkfNEi.exe
  C:\Windows\System\rWkfNEi.exe
  2⤵
  PID:6644
- C:\Windows\System\qNggjpy.exe
  C:\Windows\System\qNggjpy.exe
  2⤵
  PID:6672
- C:\Windows\System\usPTEWC.exe
  C:\Windows\System\usPTEWC.exe
  2⤵
  PID:6712
- C:\Windows\System\yAYzgXd.exe
  C:\Windows\System\yAYzgXd.exe
  2⤵
  PID:6732
- C:\Windows\System\VIhJYhk.exe
  C:\Windows\System\VIhJYhk.exe
  2⤵
  PID:6748
- C:\Windows\System\gsqIDmx.exe
  C:\Windows\System\gsqIDmx.exe
  2⤵
  PID:6784
- C:\Windows\System\nJBoPYZ.exe
  C:\Windows\System\nJBoPYZ.exe
  2⤵
  PID:6804
- C:\Windows\System\dqAjWIo.exe
  C:\Windows\System\dqAjWIo.exe
  2⤵
  PID:6820
- C:\Windows\System\cThLiNM.exe
  C:\Windows\System\cThLiNM.exe
  2⤵
  PID:6876
- C:\Windows\System\nGPUMJN.exe
  C:\Windows\System\nGPUMJN.exe
  2⤵
  PID:6900
- C:\Windows\System\TuWcVCD.exe
  C:\Windows\System\TuWcVCD.exe
  2⤵
  PID:6916
- C:\Windows\System\EuNLrZy.exe
  C:\Windows\System\EuNLrZy.exe
  2⤵
  PID:6940
- C:\Windows\System\CIzMHUU.exe
  C:\Windows\System\CIzMHUU.exe
  2⤵
  PID:6988
- C:\Windows\System\KnntMNO.exe
  C:\Windows\System\KnntMNO.exe
  2⤵
  PID:7012
- C:\Windows\System\euAraSk.exe
  C:\Windows\System\euAraSk.exe
  2⤵
  PID:7040
- C:\Windows\System\BjMOcnl.exe
  C:\Windows\System\BjMOcnl.exe
  2⤵
  PID:7064
- C:\Windows\System\uMhGpNH.exe
  C:\Windows\System\uMhGpNH.exe
  2⤵
  PID:7092
- C:\Windows\System\yDKxUoL.exe
  C:\Windows\System\yDKxUoL.exe
  2⤵
  PID:7120
- C:\Windows\System\soHGvrd.exe
  C:\Windows\System\soHGvrd.exe
  2⤵
  PID:7164
- C:\Windows\System\HFUJMTl.exe
  C:\Windows\System\HFUJMTl.exe
  2⤵
  PID:6172
- C:\Windows\System\ToOGdLr.exe
  C:\Windows\System\ToOGdLr.exe
  2⤵
  PID:6244
- C:\Windows\System\xBAbvAH.exe
  C:\Windows\System\xBAbvAH.exe
  2⤵
  PID:6288
- C:\Windows\System\qPQsEwC.exe
  C:\Windows\System\qPQsEwC.exe
  2⤵
  PID:6344
- C:\Windows\System\JgUNQFo.exe
  C:\Windows\System\JgUNQFo.exe
  2⤵
  PID:6408
- C:\Windows\System\vZNSVEc.exe
  C:\Windows\System\vZNSVEc.exe
  2⤵
  PID:6508
- C:\Windows\System\VRLGeck.exe
  C:\Windows\System\VRLGeck.exe
  2⤵
  PID:6556
- C:\Windows\System\cxoXNdE.exe
  C:\Windows\System\cxoXNdE.exe
  2⤵
  PID:6656
- C:\Windows\System\IJVMLos.exe
  C:\Windows\System\IJVMLos.exe
  2⤵
  PID:6704
- C:\Windows\System\ZaNaBUH.exe
  C:\Windows\System\ZaNaBUH.exe
  2⤵
  PID:6772
- C:\Windows\System\sDPdnpU.exe
  C:\Windows\System\sDPdnpU.exe
  2⤵
  PID:6888
- C:\Windows\System\cXiGofg.exe
  C:\Windows\System\cXiGofg.exe
  2⤵
  PID:6908
- C:\Windows\System\KOTaGVx.exe
  C:\Windows\System\KOTaGVx.exe
  2⤵
  PID:6960
- C:\Windows\System\XCgqKCV.exe
  C:\Windows\System\XCgqKCV.exe
  2⤵
  PID:7060
- C:\Windows\System\COKnzYA.exe
  C:\Windows\System\COKnzYA.exe
  2⤵
  PID:7104
- C:\Windows\System\KqZWVmx.exe
  C:\Windows\System\KqZWVmx.exe
  2⤵
  PID:7156
- C:\Windows\System\rSTXWbS.exe
  C:\Windows\System\rSTXWbS.exe
  2⤵
  PID:6160
- C:\Windows\System\zmoJRyO.exe
  C:\Windows\System\zmoJRyO.exe
  2⤵
  PID:6456
- C:\Windows\System\GpBEjXu.exe
  C:\Windows\System\GpBEjXu.exe
  2⤵
  PID:6560
- C:\Windows\System\QldinLu.exe
  C:\Windows\System\QldinLu.exe
  2⤵
  PID:6728
- C:\Windows\System\jUfUQyn.exe
  C:\Windows\System\jUfUQyn.exe
  2⤵
  PID:6836
- C:\Windows\System\upPVcQn.exe
  C:\Windows\System\upPVcQn.exe
  2⤵
  PID:6976
- C:\Windows\System\KQSHkKt.exe
  C:\Windows\System\KQSHkKt.exe
  2⤵
  PID:3296
- C:\Windows\System\hHxBhrk.exe
  C:\Windows\System\hHxBhrk.exe
  2⤵
  PID:6488
- C:\Windows\System\scqoMuG.exe
  C:\Windows\System\scqoMuG.exe
  2⤵
  PID:6692
- C:\Windows\System\JMnrxOP.exe
  C:\Windows\System\JMnrxOP.exe
  2⤵
  PID:6384
- C:\Windows\System\hccdigl.exe
  C:\Windows\System\hccdigl.exe
  2⤵
  PID:6632
- C:\Windows\System\GFlmRMS.exe
  C:\Windows\System\GFlmRMS.exe
  2⤵
  PID:7172
- C:\Windows\System\SpUnGzQ.exe
  C:\Windows\System\SpUnGzQ.exe
  2⤵
  PID:7212
- C:\Windows\System\ApLgIWB.exe
  C:\Windows\System\ApLgIWB.exe
  2⤵
  PID:7228
- C:\Windows\System\lLQjbMG.exe
  C:\Windows\System\lLQjbMG.exe
  2⤵
  PID:7252
- C:\Windows\System\lkeAEWY.exe
  C:\Windows\System\lkeAEWY.exe
  2⤵
  PID:7280
- C:\Windows\System\PkTrwLn.exe
  C:\Windows\System\PkTrwLn.exe
  2⤵
  PID:7300
- C:\Windows\System\EDhztCO.exe
  C:\Windows\System\EDhztCO.exe
  2⤵
  PID:7352
- C:\Windows\System\pWaiovy.exe
  C:\Windows\System\pWaiovy.exe
  2⤵
  PID:7380
- C:\Windows\System\vOqoEkm.exe
  C:\Windows\System\vOqoEkm.exe
  2⤵
  PID:7408
- C:\Windows\System\OKJBBVX.exe
  C:\Windows\System\OKJBBVX.exe
  2⤵
  PID:7432
- C:\Windows\System\dvqPKxA.exe
  C:\Windows\System\dvqPKxA.exe
  2⤵
  PID:7452
- C:\Windows\System\FNzTKpX.exe
  C:\Windows\System\FNzTKpX.exe
  2⤵
  PID:7484
- C:\Windows\System\XCHjDlj.exe
  C:\Windows\System\XCHjDlj.exe
  2⤵
  PID:7500
- C:\Windows\System\fXyjlwV.exe
  C:\Windows\System\fXyjlwV.exe
  2⤵
  PID:7524
- C:\Windows\System\ewdDgXL.exe
  C:\Windows\System\ewdDgXL.exe
  2⤵
  PID:7552
- C:\Windows\System\AIEwxlY.exe
  C:\Windows\System\AIEwxlY.exe
  2⤵
  PID:7592
- C:\Windows\System\nVDNFzw.exe
  C:\Windows\System\nVDNFzw.exe
  2⤵
  PID:7620
- C:\Windows\System\NdNfiYX.exe
  C:\Windows\System\NdNfiYX.exe
  2⤵
  PID:7648
- C:\Windows\System\BzyHBth.exe
  C:\Windows\System\BzyHBth.exe
  2⤵
  PID:7672
- C:\Windows\System\bsLWwjk.exe
  C:\Windows\System\bsLWwjk.exe
  2⤵
  PID:7700
- C:\Windows\System\ZxMNHvi.exe
  C:\Windows\System\ZxMNHvi.exe
  2⤵
  PID:7740
- C:\Windows\System\afOcgze.exe
  C:\Windows\System\afOcgze.exe
  2⤵
  PID:7760
- C:\Windows\System\hYiJJSN.exe
  C:\Windows\System\hYiJJSN.exe
  2⤵
  PID:7788
- C:\Windows\System\mtHAzQi.exe
  C:\Windows\System\mtHAzQi.exe
  2⤵
  PID:7824
- C:\Windows\System\fXJVEoe.exe
  C:\Windows\System\fXJVEoe.exe
  2⤵
  PID:7840
- C:\Windows\System\tsgVxej.exe
  C:\Windows\System\tsgVxej.exe
  2⤵
  PID:7860
- C:\Windows\System\nnKfzfm.exe
  C:\Windows\System\nnKfzfm.exe
  2⤵
  PID:7884
- C:\Windows\System\SKvqPqB.exe
  C:\Windows\System\SKvqPqB.exe
  2⤵
  PID:7908
- C:\Windows\System\GheAYKq.exe
  C:\Windows\System\GheAYKq.exe
  2⤵
  PID:7928
- C:\Windows\System\PfLFdFd.exe
  C:\Windows\System\PfLFdFd.exe
  2⤵
  PID:7948
- C:\Windows\System\XmIxZMP.exe
  C:\Windows\System\XmIxZMP.exe
  2⤵
  PID:7968
- C:\Windows\System\tFdTjSV.exe
  C:\Windows\System\tFdTjSV.exe
  2⤵
  PID:7996
- C:\Windows\System\CmTJheI.exe
  C:\Windows\System\CmTJheI.exe
  2⤵
  PID:8044
- C:\Windows\System\ExkElXp.exe
  C:\Windows\System\ExkElXp.exe
  2⤵
  PID:8088
- C:\Windows\System\rpsXvqB.exe
  C:\Windows\System\rpsXvqB.exe
  2⤵
  PID:8116
- C:\Windows\System\PSXgEqp.exe
  C:\Windows\System\PSXgEqp.exe
  2⤵
  PID:8140
- C:\Windows\System\DtXpVwt.exe
  C:\Windows\System\DtXpVwt.exe
  2⤵
  PID:8164
- C:\Windows\System\GxGcSxd.exe
  C:\Windows\System\GxGcSxd.exe
  2⤵
  PID:8184
- C:\Windows\System\nTpPFmd.exe
  C:\Windows\System\nTpPFmd.exe
  2⤵
  PID:7192
- C:\Windows\System\QLbOeMq.exe
  C:\Windows\System\QLbOeMq.exe
  2⤵
  PID:7316
- C:\Windows\System\tUGhrDD.exe
  C:\Windows\System\tUGhrDD.exe
  2⤵
  PID:7404
- C:\Windows\System\nIsCvSB.exe
  C:\Windows\System\nIsCvSB.exe
  2⤵
  PID:7440
- C:\Windows\System\Ibmantt.exe
  C:\Windows\System\Ibmantt.exe
  2⤵
  PID:7496
- C:\Windows\System\UrQDnwI.exe
  C:\Windows\System\UrQDnwI.exe
  2⤵
  PID:7536
- C:\Windows\System\xmyuEkE.exe
  C:\Windows\System\xmyuEkE.exe
  2⤵
  PID:7572
- C:\Windows\System\yxpKCvf.exe
  C:\Windows\System\yxpKCvf.exe
  2⤵
  PID:7716
- C:\Windows\System\RJshMqB.exe
  C:\Windows\System\RJshMqB.exe
  2⤵
  PID:7748
- C:\Windows\System\aWjVIEs.exe
  C:\Windows\System\aWjVIEs.exe
  2⤵
  PID:7832
- C:\Windows\System\jzAoSvR.exe
  C:\Windows\System\jzAoSvR.exe
  2⤵
  PID:7856
- C:\Windows\System\bbktgVp.exe
  C:\Windows\System\bbktgVp.exe
  2⤵
  PID:7900
- C:\Windows\System\UQiCPVp.exe
  C:\Windows\System\UQiCPVp.exe
  2⤵
  PID:8032
- C:\Windows\System\hOnQMne.exe
  C:\Windows\System\hOnQMne.exe
  2⤵
  PID:8076
- C:\Windows\System\fbtBnvI.exe
  C:\Windows\System\fbtBnvI.exe
  2⤵
  PID:8096
- C:\Windows\System\DZYvegj.exe
  C:\Windows\System\DZYvegj.exe
  2⤵
  PID:8156
- C:\Windows\System\IKPqlWa.exe
  C:\Windows\System\IKPqlWa.exe
  2⤵
  PID:7420
- C:\Windows\System\MUpEfwp.exe
  C:\Windows\System\MUpEfwp.exe
  2⤵
  PID:7516
- C:\Windows\System\hiicNnh.exe
  C:\Windows\System\hiicNnh.exe
  2⤵
  PID:7616
- C:\Windows\System\gpVUpsl.exe
  C:\Windows\System\gpVUpsl.exe
  2⤵
  PID:7896
- C:\Windows\System\jMaykqp.exe
  C:\Windows\System\jMaykqp.exe
  2⤵
  PID:7964
- C:\Windows\System\WSrpReL.exe
  C:\Windows\System\WSrpReL.exe
  2⤵
  PID:8128
- C:\Windows\System\AXoVpmg.exe
  C:\Windows\System\AXoVpmg.exe
  2⤵
  PID:7328
- C:\Windows\System\vEmnvGD.exe
  C:\Windows\System\vEmnvGD.exe
  2⤵
  PID:7848
- C:\Windows\System\NKgHPoC.exe
  C:\Windows\System\NKgHPoC.exe
  2⤵
  PID:8196
- C:\Windows\System\tRYwTuz.exe
  C:\Windows\System\tRYwTuz.exe
  2⤵
  PID:8224
- C:\Windows\System\AuXDQCb.exe
  C:\Windows\System\AuXDQCb.exe
  2⤵
  PID:8248
- C:\Windows\System\cLAJPmV.exe
  C:\Windows\System\cLAJPmV.exe
  2⤵
  PID:8264
- C:\Windows\System\AneJWNE.exe
  C:\Windows\System\AneJWNE.exe
  2⤵
  PID:8296
- C:\Windows\System\ZKYMrPV.exe
  C:\Windows\System\ZKYMrPV.exe
  2⤵
  PID:8324
- C:\Windows\System\eBTlAMQ.exe
  C:\Windows\System\eBTlAMQ.exe
  2⤵
  PID:8348
- C:\Windows\System\MQUxVNT.exe
  C:\Windows\System\MQUxVNT.exe
  2⤵
  PID:8364
- C:\Windows\System\ZcmkSle.exe
  C:\Windows\System\ZcmkSle.exe
  2⤵
  PID:8388
- C:\Windows\System\MOSwbWC.exe
  C:\Windows\System\MOSwbWC.exe
  2⤵
  PID:8404
- C:\Windows\System\nJNFMac.exe
  C:\Windows\System\nJNFMac.exe
  2⤵
  PID:8472
- C:\Windows\System\qNEcLif.exe
  C:\Windows\System\qNEcLif.exe
  2⤵
  PID:8488
- C:\Windows\System\QZlkqHI.exe
  C:\Windows\System\QZlkqHI.exe
  2⤵
  PID:8516
- C:\Windows\System\AuGhIYB.exe
  C:\Windows\System\AuGhIYB.exe
  2⤵
  PID:8536
- C:\Windows\System\LEGqeOU.exe
  C:\Windows\System\LEGqeOU.exe
  2⤵
  PID:8568
- C:\Windows\System\RpXNKqq.exe
  C:\Windows\System\RpXNKqq.exe
  2⤵
  PID:8596
- C:\Windows\System\xXuVvOt.exe
  C:\Windows\System\xXuVvOt.exe
  2⤵
  PID:8616
- C:\Windows\System\DXyiRLf.exe
  C:\Windows\System\DXyiRLf.exe
  2⤵
  PID:8660
- C:\Windows\System\VdMiDEB.exe
  C:\Windows\System\VdMiDEB.exe
  2⤵
  PID:8688
- C:\Windows\System\anheUHb.exe
  C:\Windows\System\anheUHb.exe
  2⤵
  PID:8708
- C:\Windows\System\KeknHCN.exe
  C:\Windows\System\KeknHCN.exe
  2⤵
  PID:8764
- C:\Windows\System\xAniczC.exe
  C:\Windows\System\xAniczC.exe
  2⤵
  PID:8792
- C:\Windows\System\voyaATc.exe
  C:\Windows\System\voyaATc.exe
  2⤵
  PID:8820
- C:\Windows\System\ELdbMZL.exe
  C:\Windows\System\ELdbMZL.exe
  2⤵
  PID:8836
- C:\Windows\System\jWGcOib.exe
  C:\Windows\System\jWGcOib.exe
  2⤵
  PID:8856
- C:\Windows\System\YRgTkyu.exe
  C:\Windows\System\YRgTkyu.exe
  2⤵
  PID:8880
- C:\Windows\System\sfAoIrG.exe
  C:\Windows\System\sfAoIrG.exe
  2⤵
  PID:8916
- C:\Windows\System\kHcqxYY.exe
  C:\Windows\System\kHcqxYY.exe
  2⤵
  PID:8944
- C:\Windows\System\GWLiChf.exe
  C:\Windows\System\GWLiChf.exe
  2⤵
  PID:8972
- C:\Windows\System\qqdxdiS.exe
  C:\Windows\System\qqdxdiS.exe
  2⤵
  PID:8996
- C:\Windows\System\VGZAsrn.exe
  C:\Windows\System\VGZAsrn.exe
  2⤵
  PID:9016
- C:\Windows\System\OaEcycs.exe
  C:\Windows\System\OaEcycs.exe
  2⤵
  PID:9048
- C:\Windows\System\CVcoKDW.exe
  C:\Windows\System\CVcoKDW.exe
  2⤵
  PID:9068
- C:\Windows\System\mGmwjMD.exe
  C:\Windows\System\mGmwjMD.exe
  2⤵
  PID:9096
- C:\Windows\System\ynMsAct.exe
  C:\Windows\System\ynMsAct.exe
  2⤵
  PID:9120
- C:\Windows\System\qpYGGfT.exe
  C:\Windows\System\qpYGGfT.exe
  2⤵
  PID:9144
- C:\Windows\System\HEUvezZ.exe
  C:\Windows\System\HEUvezZ.exe
  2⤵
  PID:9180
- C:\Windows\System\OIyofmg.exe
  C:\Windows\System\OIyofmg.exe
  2⤵
  PID:9200
- C:\Windows\System\xqHoAqQ.exe
  C:\Windows\System\xqHoAqQ.exe
  2⤵
  PID:8208
- C:\Windows\System\SyTZagV.exe
  C:\Windows\System\SyTZagV.exe
  2⤵
  PID:8280
- C:\Windows\System\AqrlUhj.exe
  C:\Windows\System\AqrlUhj.exe
  2⤵
  PID:8276
- C:\Windows\System\TVDEXRH.exe
  C:\Windows\System\TVDEXRH.exe
  2⤵
  PID:8420
- C:\Windows\System\lSWfMUL.exe
  C:\Windows\System\lSWfMUL.exe
  2⤵
  PID:8504
- C:\Windows\System\omczPzV.exe
  C:\Windows\System\omczPzV.exe
  2⤵
  PID:8548
- C:\Windows\System\VEflqTs.exe
  C:\Windows\System\VEflqTs.exe
  2⤵
  PID:8584
- C:\Windows\System\LasKKuh.exe
  C:\Windows\System\LasKKuh.exe
  2⤵
  PID:8680
- C:\Windows\System\slxdcTX.exe
  C:\Windows\System\slxdcTX.exe
  2⤵
  PID:8728
- C:\Windows\System\pBvhRgz.exe
  C:\Windows\System\pBvhRgz.exe
  2⤵
  PID:8816
- C:\Windows\System\adQOGnH.exe
  C:\Windows\System\adQOGnH.exe
  2⤵
  PID:8868
- C:\Windows\System\jjWEXbS.exe
  C:\Windows\System\jjWEXbS.exe
  2⤵
  PID:8964
- C:\Windows\System\cjvAACH.exe
  C:\Windows\System\cjvAACH.exe
  2⤵
  PID:8992
- C:\Windows\System\IjtUreO.exe
  C:\Windows\System\IjtUreO.exe
  2⤵
  PID:9112
- C:\Windows\System\NJcdxtm.exe
  C:\Windows\System\NJcdxtm.exe
  2⤵
  PID:9092
- C:\Windows\System\mGPCsts.exe
  C:\Windows\System\mGPCsts.exe
  2⤵
  PID:8236
- C:\Windows\System\SdMYeAd.exe
  C:\Windows\System\SdMYeAd.exe
  2⤵
  PID:8312
- C:\Windows\System\rhywafM.exe
  C:\Windows\System\rhywafM.exe
  2⤵
  PID:8360
- C:\Windows\System\WxoyvRq.exe
  C:\Windows\System\WxoyvRq.exe
  2⤵
  PID:8524
- C:\Windows\System\WxCvtMF.exe
  C:\Windows\System\WxCvtMF.exe
  2⤵
  PID:8656
- C:\Windows\System\uwyXrtL.exe
  C:\Windows\System\uwyXrtL.exe
  2⤵
  PID:8904
- C:\Windows\System\twDvbet.exe
  C:\Windows\System\twDvbet.exe
  2⤵
  PID:8936
- C:\Windows\System\UOZzJdo.exe
  C:\Windows\System\UOZzJdo.exe
  2⤵
  PID:9140
- C:\Windows\System\XFylgJK.exe
  C:\Windows\System\XFylgJK.exe
  2⤵
  PID:8456
- C:\Windows\System\DGgBaua.exe
  C:\Windows\System\DGgBaua.exe
  2⤵
  PID:8804
- C:\Windows\System\worfZgU.exe
  C:\Windows\System\worfZgU.exe
  2⤵
  PID:9132
- C:\Windows\System\mhnMrRi.exe
  C:\Windows\System\mhnMrRi.exe
  2⤵
  PID:8376
- C:\Windows\System\EFPHuQE.exe
  C:\Windows\System\EFPHuQE.exe
  2⤵
  PID:9240
- C:\Windows\System\bbjtOWP.exe
  C:\Windows\System\bbjtOWP.exe
  2⤵
  PID:9268
- C:\Windows\System\tMcbVgk.exe
  C:\Windows\System\tMcbVgk.exe
  2⤵
  PID:9284
- C:\Windows\System\TrZxiRh.exe
  C:\Windows\System\TrZxiRh.exe
  2⤵
  PID:9300
- C:\Windows\System\SxWnmUY.exe
  C:\Windows\System\SxWnmUY.exe
  2⤵
  PID:9320
- C:\Windows\System\BkdiuSV.exe
  C:\Windows\System\BkdiuSV.exe
  2⤵
  PID:9336
- C:\Windows\System\rWrZReH.exe
  C:\Windows\System\rWrZReH.exe
  2⤵
  PID:9356
- C:\Windows\System\OSMriOe.exe
  C:\Windows\System\OSMriOe.exe
  2⤵
  PID:9380
- C:\Windows\System\ykWCEJl.exe
  C:\Windows\System\ykWCEJl.exe
  2⤵
  PID:9408
- C:\Windows\System\kRSBvOX.exe
  C:\Windows\System\kRSBvOX.exe
  2⤵
  PID:9456
- C:\Windows\System\oTyftAa.exe
  C:\Windows\System\oTyftAa.exe
  2⤵
  PID:9492
- C:\Windows\System\SlwpIBa.exe
  C:\Windows\System\SlwpIBa.exe
  2⤵
  PID:9520
- C:\Windows\System\pnvBViE.exe
  C:\Windows\System\pnvBViE.exe
  2⤵
  PID:9536
- C:\Windows\System\rBIICww.exe
  C:\Windows\System\rBIICww.exe
  2⤵
  PID:9564
- C:\Windows\System\JUCZWOg.exe
  C:\Windows\System\JUCZWOg.exe
  2⤵
  PID:9592
- C:\Windows\System\kAaRUEL.exe
  C:\Windows\System\kAaRUEL.exe
  2⤵
  PID:9652
- C:\Windows\System\GXLXGbh.exe
  C:\Windows\System\GXLXGbh.exe
  2⤵
  PID:9676
- C:\Windows\System\YSHswoC.exe
  C:\Windows\System\YSHswoC.exe
  2⤵
  PID:9692
- C:\Windows\System\qISdzeq.exe
  C:\Windows\System\qISdzeq.exe
  2⤵
  PID:9708
- C:\Windows\System\XULGCUw.exe
  C:\Windows\System\XULGCUw.exe
  2⤵
  PID:9732
- C:\Windows\System\wYqvwvc.exe
  C:\Windows\System\wYqvwvc.exe
  2⤵
  PID:9760
- C:\Windows\System\JWcjuxd.exe
  C:\Windows\System\JWcjuxd.exe
  2⤵
  PID:9816
- C:\Windows\System\vkHfzCI.exe
  C:\Windows\System\vkHfzCI.exe
  2⤵
  PID:9840
- C:\Windows\System\ygVgnAF.exe
  C:\Windows\System\ygVgnAF.exe
  2⤵
  PID:9856
- C:\Windows\System\xvoGCyn.exe
  C:\Windows\System\xvoGCyn.exe
  2⤵
  PID:9876
- C:\Windows\System\HLopjcj.exe
  C:\Windows\System\HLopjcj.exe
  2⤵
  PID:9892
- C:\Windows\System\zaRzVOI.exe
  C:\Windows\System\zaRzVOI.exe
  2⤵
  PID:9908
- C:\Windows\System\oDwtmpx.exe
  C:\Windows\System\oDwtmpx.exe
  2⤵
  PID:9964
- C:\Windows\System\QvhOiAD.exe
  C:\Windows\System\QvhOiAD.exe
  2⤵
  PID:10000
- C:\Windows\System\rzRMSFq.exe
  C:\Windows\System\rzRMSFq.exe
  2⤵
  PID:10020
- C:\Windows\System\HRrRyNz.exe
  C:\Windows\System\HRrRyNz.exe
  2⤵
  PID:10044
- C:\Windows\System\pUzUCBV.exe
  C:\Windows\System\pUzUCBV.exe
  2⤵
  PID:10108
- C:\Windows\System\TRoZoyu.exe
  C:\Windows\System\TRoZoyu.exe
  2⤵
  PID:10136
- C:\Windows\System\QVbBuet.exe
  C:\Windows\System\QVbBuet.exe
  2⤵
  PID:10160
- C:\Windows\System\zjEEdoQ.exe
  C:\Windows\System\zjEEdoQ.exe
  2⤵
  PID:10176
- C:\Windows\System\iBfHytL.exe
  C:\Windows\System\iBfHytL.exe
  2⤵
  PID:10204
- C:\Windows\System\twfdaBL.exe
  C:\Windows\System\twfdaBL.exe
  2⤵
  PID:10232
- C:\Windows\System\KkfngAp.exe
  C:\Windows\System\KkfngAp.exe
  2⤵
  PID:9220
- C:\Windows\System\bshAWDV.exe
  C:\Windows\System\bshAWDV.exe
  2⤵
  PID:9280
- C:\Windows\System\qTmcept.exe
  C:\Windows\System\qTmcept.exe
  2⤵
  PID:9308
- C:\Windows\System\pILqMyL.exe
  C:\Windows\System\pILqMyL.exe
  2⤵
  PID:9436
- C:\Windows\System\nsRDJow.exe
  C:\Windows\System\nsRDJow.exe
  2⤵
  PID:9528
- C:\Windows\System\sfwQkJD.exe
  C:\Windows\System\sfwQkJD.exe
  2⤵
  PID:9576
- C:\Windows\System\gAtoupG.exe
  C:\Windows\System\gAtoupG.exe
  2⤵
  PID:9684
- C:\Windows\System\IJyqtLy.exe
  C:\Windows\System\IJyqtLy.exe
  2⤵
  PID:9668
- C:\Windows\System\zXEsJLj.exe
  C:\Windows\System\zXEsJLj.exe
  2⤵
  PID:9728
- C:\Windows\System\paAhnka.exe
  C:\Windows\System\paAhnka.exe
  2⤵
  PID:9808
- C:\Windows\System\AiDxfuB.exe
  C:\Windows\System\AiDxfuB.exe
  2⤵
  PID:9832
- C:\Windows\System\MLmqqPP.exe
  C:\Windows\System\MLmqqPP.exe
  2⤵
  PID:9884
- C:\Windows\System\SYNJgfw.exe
  C:\Windows\System\SYNJgfw.exe
  2⤵
  PID:9988
- C:\Windows\System\ctSjbvu.exe
  C:\Windows\System\ctSjbvu.exe
  2⤵
  PID:10128
- C:\Windows\System\MEbsxRG.exe
  C:\Windows\System\MEbsxRG.exe
  2⤵
  PID:10216
- C:\Windows\System\ImtmzBq.exe
  C:\Windows\System\ImtmzBq.exe
  2⤵
  PID:8588
- C:\Windows\System\tfMbOOk.exe
  C:\Windows\System\tfMbOOk.exe
  2⤵
  PID:9260
- C:\Windows\System\tKLXwli.exe
  C:\Windows\System\tKLXwli.exe
  2⤵
  PID:9512
- C:\Windows\System\ZOTzxiK.exe
  C:\Windows\System\ZOTzxiK.exe
  2⤵
  PID:3248
- C:\Windows\System\HoHCbao.exe
  C:\Windows\System\HoHCbao.exe
  2⤵
  PID:9784
- C:\Windows\System\hSUprpW.exe
  C:\Windows\System\hSUprpW.exe
  2⤵
  PID:9812
- C:\Windows\System\FOtpnBg.exe
  C:\Windows\System\FOtpnBg.exe
  2⤵
  PID:10012
- C:\Windows\System\LXJQPkW.exe
  C:\Windows\System\LXJQPkW.exe
  2⤵
  PID:10172
- C:\Windows\System\ZlPHvXt.exe
  C:\Windows\System\ZlPHvXt.exe
  2⤵
  PID:9224
- C:\Windows\System\sUIAEGC.exe
  C:\Windows\System\sUIAEGC.exe
  2⤵
  PID:10068
- C:\Windows\System\JKfVbEO.exe
  C:\Windows\System\JKfVbEO.exe
  2⤵
  PID:9256
- C:\Windows\System\oBsnnEJ.exe
  C:\Windows\System\oBsnnEJ.exe
  2⤵
  PID:9464
- C:\Windows\System\TUPKBvr.exe
  C:\Windows\System\TUPKBvr.exe
  2⤵
  PID:10256
- C:\Windows\System\zZZkDwT.exe
  C:\Windows\System\zZZkDwT.exe
  2⤵
  PID:10272
- C:\Windows\System\akYEtES.exe
  C:\Windows\System\akYEtES.exe
  2⤵
  PID:10312
- C:\Windows\System\aeVJulc.exe
  C:\Windows\System\aeVJulc.exe
  2⤵
  PID:10332
- C:\Windows\System\gBmnLoP.exe
  C:\Windows\System\gBmnLoP.exe
  2⤵
  PID:10356
- C:\Windows\System\YuXDwFV.exe
  C:\Windows\System\YuXDwFV.exe
  2⤵
  PID:10380
- C:\Windows\System\DcUKwGo.exe
  C:\Windows\System\DcUKwGo.exe
  2⤵
  PID:10408
- C:\Windows\System\FZRDOKi.exe
  C:\Windows\System\FZRDOKi.exe
  2⤵
  PID:10452
- C:\Windows\System\YpaAWlp.exe
  C:\Windows\System\YpaAWlp.exe
  2⤵
  PID:10476
- C:\Windows\System\KpGlWuS.exe
  C:\Windows\System\KpGlWuS.exe
  2⤵
  PID:10496
- C:\Windows\System\uvQSxyz.exe
  C:\Windows\System\uvQSxyz.exe
  2⤵
  PID:10532
- C:\Windows\System\PQYOvoW.exe
  C:\Windows\System\PQYOvoW.exe
  2⤵
  PID:10548
- C:\Windows\System\eExeKGH.exe
  C:\Windows\System\eExeKGH.exe
  2⤵
  PID:10572
- C:\Windows\System\lAjXjqS.exe
  C:\Windows\System\lAjXjqS.exe
  2⤵
  PID:10596
- C:\Windows\System\iLMWWaZ.exe
  C:\Windows\System\iLMWWaZ.exe
  2⤵
  PID:10616
- C:\Windows\System\BRPeNdV.exe
  C:\Windows\System\BRPeNdV.exe
  2⤵
  PID:10644
- C:\Windows\System\UqFfzLY.exe
  C:\Windows\System\UqFfzLY.exe
  2⤵
  PID:10668
- C:\Windows\System\BrrgEOM.exe
  C:\Windows\System\BrrgEOM.exe
  2⤵
  PID:10684
- C:\Windows\System\pjLHIZD.exe
  C:\Windows\System\pjLHIZD.exe
  2⤵
  PID:10704
- C:\Windows\System\aNpRebJ.exe
  C:\Windows\System\aNpRebJ.exe
  2⤵
  PID:10740
- C:\Windows\System\sZziyAa.exe
  C:\Windows\System\sZziyAa.exe
  2⤵
  PID:10768
- C:\Windows\System\tDioYfn.exe
  C:\Windows\System\tDioYfn.exe
  2⤵
  PID:10796
- C:\Windows\System\jZrxBJh.exe
  C:\Windows\System\jZrxBJh.exe
  2⤵
  PID:10816
- C:\Windows\System\GvdiepL.exe
  C:\Windows\System\GvdiepL.exe
  2⤵
  PID:10860
- C:\Windows\System\GMltRSH.exe
  C:\Windows\System\GMltRSH.exe
  2⤵
  PID:10888
- C:\Windows\System\uDDXBIU.exe
  C:\Windows\System\uDDXBIU.exe
  2⤵
  PID:10928
- C:\Windows\System\ITVPXqR.exe
  C:\Windows\System\ITVPXqR.exe
  2⤵
  PID:10944
- C:\Windows\System\NuuQKEe.exe
  C:\Windows\System\NuuQKEe.exe
  2⤵
  PID:10976
- C:\Windows\System\OBIYKBY.exe
  C:\Windows\System\OBIYKBY.exe
  2⤵
  PID:11012
- C:\Windows\System\hJwjBAf.exe
  C:\Windows\System\hJwjBAf.exe
  2⤵
  PID:11032
- C:\Windows\System\VgUUNZH.exe
  C:\Windows\System\VgUUNZH.exe
  2⤵
  PID:11068
- C:\Windows\System\WAHZyVF.exe
  C:\Windows\System\WAHZyVF.exe
  2⤵
  PID:11096
- C:\Windows\System\vzxWWaY.exe
  C:\Windows\System\vzxWWaY.exe
  2⤵
  PID:11116
- C:\Windows\System\SABXDOa.exe
  C:\Windows\System\SABXDOa.exe
  2⤵
  PID:11148
- C:\Windows\System\HkMlJKO.exe
  C:\Windows\System\HkMlJKO.exe
  2⤵
  PID:11208
- C:\Windows\System\QWnjfAj.exe
  C:\Windows\System\QWnjfAj.exe
  2⤵
  PID:11228
- C:\Windows\System\VYXtjOX.exe
  C:\Windows\System\VYXtjOX.exe
  2⤵
  PID:11252
- C:\Windows\System\fGTCxYT.exe
  C:\Windows\System\fGTCxYT.exe
  2⤵
  PID:10268
- C:\Windows\System\NipwNgu.exe
  C:\Windows\System\NipwNgu.exe
  2⤵
  PID:10320
- C:\Windows\System\tYIRfxn.exe
  C:\Windows\System\tYIRfxn.exe
  2⤵
  PID:10392
- C:\Windows\System\SLfYiEw.exe
  C:\Windows\System\SLfYiEw.exe
  2⤵
  PID:10444
- C:\Windows\System\JmpAxvh.exe
  C:\Windows\System\JmpAxvh.exe
  2⤵
  PID:10488
- C:\Windows\System\fjhcfjD.exe
  C:\Windows\System\fjhcfjD.exe
  2⤵
  PID:10540
- C:\Windows\System\LWivrcF.exe
  C:\Windows\System\LWivrcF.exe
  2⤵
  PID:10624
- C:\Windows\System\eJGgzqv.exe
  C:\Windows\System\eJGgzqv.exe
  2⤵
  PID:10700
- C:\Windows\System\tsuWfcy.exe
  C:\Windows\System\tsuWfcy.exe
  2⤵
  PID:10836
- C:\Windows\System\WAOnYbl.exe
  C:\Windows\System\WAOnYbl.exe
  2⤵
  PID:10844
- C:\Windows\System\fXkhfkI.exe
  C:\Windows\System\fXkhfkI.exe
  2⤵
  PID:10956
- C:\Windows\System\YaJdWLd.exe
  C:\Windows\System\YaJdWLd.exe
  2⤵
  PID:10940
- C:\Windows\System\BeZYMSO.exe
  C:\Windows\System\BeZYMSO.exe
  2⤵
  PID:11052
- C:\Windows\System\HaLpsNM.exe
  C:\Windows\System\HaLpsNM.exe
  2⤵
  PID:11080
- C:\Windows\System\jOFzteo.exe
  C:\Windows\System\jOFzteo.exe
  2⤵
  PID:11176
- C:\Windows\System\WjRMhEM.exe
  C:\Windows\System\WjRMhEM.exe
  2⤵
  PID:11216
- C:\Windows\System\IXsdAoh.exe
  C:\Windows\System\IXsdAoh.exe
  2⤵
  PID:10352
- C:\Windows\System\zICcGGX.exe
  C:\Windows\System\zICcGGX.exe
  2⤵
  PID:10512
- C:\Windows\System\SXhFyTm.exe
  C:\Windows\System\SXhFyTm.exe
  2⤵
  PID:10588
- C:\Windows\System\CeAEfIV.exe
  C:\Windows\System\CeAEfIV.exe
  2⤵
  PID:10712
- C:\Windows\System\FxnYzoN.exe
  C:\Windows\System\FxnYzoN.exe
  2⤵
  PID:10872
- C:\Windows\System\UWAYbNY.exe
  C:\Windows\System\UWAYbNY.exe
  2⤵
  PID:11084
- C:\Windows\System\BGkcLNW.exe
  C:\Windows\System\BGkcLNW.exe
  2⤵
  PID:11188
- C:\Windows\System\gpXSprE.exe
  C:\Windows\System\gpXSprE.exe
  2⤵
  PID:10584
- C:\Windows\System\FQbcQGF.exe
  C:\Windows\System\FQbcQGF.exe
  2⤵
  PID:10964
- C:\Windows\System\YQthsgL.exe
  C:\Windows\System\YQthsgL.exe
  2⤵
  PID:11140
- C:\Windows\System\UJzHSxU.exe
  C:\Windows\System\UJzHSxU.exe
  2⤵
  PID:11276
- C:\Windows\System\UFrcmDg.exe
  C:\Windows\System\UFrcmDg.exe
  2⤵
  PID:11292
- C:\Windows\System\BMdSwWM.exe
  C:\Windows\System\BMdSwWM.exe
  2⤵
  PID:11316
- C:\Windows\System\qHkxtQJ.exe
  C:\Windows\System\qHkxtQJ.exe
  2⤵
  PID:11360
- C:\Windows\System\IAFlAqV.exe
  C:\Windows\System\IAFlAqV.exe
  2⤵
  PID:11388
- C:\Windows\System\HNdqQPC.exe
  C:\Windows\System\HNdqQPC.exe
  2⤵
  PID:11416
- C:\Windows\System\KjZHQJb.exe
  C:\Windows\System\KjZHQJb.exe
  2⤵
  PID:11444
- C:\Windows\System\kHsJfsc.exe
  C:\Windows\System\kHsJfsc.exe
  2⤵
  PID:11460
- C:\Windows\System\IsUFMdO.exe
  C:\Windows\System\IsUFMdO.exe
  2⤵
  PID:11500
- C:\Windows\System\gJKOphz.exe
  C:\Windows\System\gJKOphz.exe
  2⤵
  PID:11528
- C:\Windows\System\lajAfPM.exe
  C:\Windows\System\lajAfPM.exe
  2⤵
  PID:11556
- C:\Windows\System\TiuIWNu.exe
  C:\Windows\System\TiuIWNu.exe
  2⤵
  PID:11572
- C:\Windows\System\QOnSWTx.exe
  C:\Windows\System\QOnSWTx.exe
  2⤵
  PID:11592
- C:\Windows\System\UOagFFS.exe
  C:\Windows\System\UOagFFS.exe
  2⤵
  PID:11612
- C:\Windows\System\feuhiFx.exe
  C:\Windows\System\feuhiFx.exe
  2⤵
  PID:11632
- C:\Windows\System\XDThQcT.exe
  C:\Windows\System\XDThQcT.exe
  2⤵
  PID:11656
- C:\Windows\System\qOnhpYs.exe
  C:\Windows\System\qOnhpYs.exe
  2⤵
  PID:11684
- C:\Windows\System\mIrPWnR.exe
  C:\Windows\System\mIrPWnR.exe
  2⤵
  PID:11720
- C:\Windows\System\qFKOnfl.exe
  C:\Windows\System\qFKOnfl.exe
  2⤵
  PID:11768
- C:\Windows\System\ApFRKlu.exe
  C:\Windows\System\ApFRKlu.exe
  2⤵
  PID:11796
- C:\Windows\System\ckMnjSQ.exe
  C:\Windows\System\ckMnjSQ.exe
  2⤵
  PID:11812
- C:\Windows\System\eeqfENI.exe
  C:\Windows\System\eeqfENI.exe
  2⤵
  PID:11840
- C:\Windows\System\FTMMAuj.exe
  C:\Windows\System\FTMMAuj.exe
  2⤵
  PID:11868
- C:\Windows\System\tXJcGLz.exe
  C:\Windows\System\tXJcGLz.exe
  2⤵
  PID:11888
- C:\Windows\System\bmftcgG.exe
  C:\Windows\System\bmftcgG.exe
  2⤵
  PID:11916
- C:\Windows\System\xvSkyqd.exe
  C:\Windows\System\xvSkyqd.exe
  2⤵
  PID:11964
- C:\Windows\System\OkkPeKZ.exe
  C:\Windows\System\OkkPeKZ.exe
  2⤵
  PID:11984
- C:\Windows\System\FLxTjCM.exe
  C:\Windows\System\FLxTjCM.exe
  2⤵
  PID:12008
- C:\Windows\System\hZDGIhN.exe
  C:\Windows\System\hZDGIhN.exe
  2⤵
  PID:12036
- C:\Windows\System\ubAESpF.exe
  C:\Windows\System\ubAESpF.exe
  2⤵
  PID:12080
- C:\Windows\System\FPQGRfv.exe
  C:\Windows\System\FPQGRfv.exe
  2⤵
  PID:12104
- C:\Windows\System\oALQjkb.exe
  C:\Windows\System\oALQjkb.exe
  2⤵
  PID:12132
- C:\Windows\System\MBphgMc.exe
  C:\Windows\System\MBphgMc.exe
  2⤵
  PID:12172
- C:\Windows\System\eAPGtyg.exe
  C:\Windows\System\eAPGtyg.exe
  2⤵
  PID:12200
- C:\Windows\System\WfgEjsK.exe
  C:\Windows\System\WfgEjsK.exe
  2⤵
  PID:12224
- C:\Windows\System\aQMWixu.exe
  C:\Windows\System\aQMWixu.exe
  2⤵
  PID:12268
- C:\Windows\System\lBqjdHa.exe
  C:\Windows\System\lBqjdHa.exe
  2⤵
  PID:11024
- C:\Windows\System\npseTWS.exe
  C:\Windows\System\npseTWS.exe
  2⤵
  PID:11308
- C:\Windows\System\GGLEXos.exe
  C:\Windows\System\GGLEXos.exe
  2⤵
  PID:11356
- C:\Windows\System\RxIWnYu.exe
  C:\Windows\System\RxIWnYu.exe
  2⤵
  PID:11404
- C:\Windows\System\ShMojjp.exe
  C:\Windows\System\ShMojjp.exe
  2⤵
  PID:11476
- C:\Windows\System\eYrhSXn.exe
  C:\Windows\System\eYrhSXn.exe
  2⤵
  PID:11524
- C:\Windows\System\VafrMwt.exe
  C:\Windows\System\VafrMwt.exe
  2⤵
  PID:11588
- C:\Windows\System\eBlgyiA.exe
  C:\Windows\System\eBlgyiA.exe
  2⤵
  PID:11652
- C:\Windows\System\pLPdVMC.exe
  C:\Windows\System\pLPdVMC.exe
  2⤵
  PID:11668
- C:\Windows\System\NVIjQVQ.exe
  C:\Windows\System\NVIjQVQ.exe
  2⤵
  PID:11784
- C:\Windows\System\CDhgalb.exe
  C:\Windows\System\CDhgalb.exe
  2⤵
  PID:11836
- C:\Windows\System\hmvDEsx.exe
  C:\Windows\System\hmvDEsx.exe
  2⤵
  PID:11904
- C:\Windows\System\DZjWyNq.exe
  C:\Windows\System\DZjWyNq.exe
  2⤵
  PID:11932
- C:\Windows\System\mbhPMMd.exe
  C:\Windows\System\mbhPMMd.exe
  2⤵
  PID:12024
- C:\Windows\System\RUzBWMv.exe
  C:\Windows\System\RUzBWMv.exe
  2⤵
  PID:12048
- C:\Windows\System\JVcLCzE.exe
  C:\Windows\System\JVcLCzE.exe
  2⤵
  PID:12128
- C:\Windows\System\VTQFfLk.exe
  C:\Windows\System\VTQFfLk.exe
  2⤵
  PID:12208
- C:\Windows\System\yhvvyCq.exe
  C:\Windows\System\yhvvyCq.exe
  2⤵
  PID:11312
- C:\Windows\System\xaczOrx.exe
  C:\Windows\System\xaczOrx.exe
  2⤵
  PID:11428
- C:\Windows\System\bWbivdA.exe
  C:\Windows\System\bWbivdA.exe
  2⤵
  PID:11716
- C:\Windows\System\QNgVJNC.exe
  C:\Windows\System\QNgVJNC.exe
  2⤵
  PID:11760
- C:\Windows\System\JPdzcno.exe
  C:\Windows\System\JPdzcno.exe
  2⤵
  PID:12124
- C:\Windows\System\aJVYiis.exe
  C:\Windows\System\aJVYiis.exe
  2⤵
  PID:12216
- C:\Windows\System\atCetxm.exe
  C:\Windows\System\atCetxm.exe
  2⤵
  PID:11512
- C:\Windows\System\bjvUPBE.exe
  C:\Windows\System\bjvUPBE.exe
  2⤵
  PID:11624
- C:\Windows\System\MFgblWD.exe
  C:\Windows\System\MFgblWD.exe
  2⤵
  PID:11780
- C:\Windows\System\VfXakcB.exe
  C:\Windows\System\VfXakcB.exe
  2⤵
  PID:12096
- C:\Windows\System\jCdCQeR.exe
  C:\Windows\System\jCdCQeR.exe
  2⤵
  PID:12304
- C:\Windows\System\sWxBMOI.exe
  C:\Windows\System\sWxBMOI.exe
  2⤵
  PID:12336
- C:\Windows\System\ZdzqczH.exe
  C:\Windows\System\ZdzqczH.exe
  2⤵
  PID:12372
- C:\Windows\System\fPUFDCF.exe
  C:\Windows\System\fPUFDCF.exe
  2⤵
  PID:12400
- C:\Windows\System\cMpqXky.exe
  C:\Windows\System\cMpqXky.exe
  2⤵
  PID:12432
- C:\Windows\System\YoYQHkJ.exe
  C:\Windows\System\YoYQHkJ.exe
  2⤵
  PID:12480
- C:\Windows\System\vGxZAMG.exe
  C:\Windows\System\vGxZAMG.exe
  2⤵
  PID:12500
- C:\Windows\System\PjTfxxL.exe
  C:\Windows\System\PjTfxxL.exe
  2⤵
  PID:12524
- C:\Windows\System\iOxKAVo.exe
  C:\Windows\System\iOxKAVo.exe
  2⤵
  PID:12552
- C:\Windows\System\dAJZqLX.exe
  C:\Windows\System\dAJZqLX.exe
  2⤵
  PID:12584
- C:\Windows\System\ocqPRGs.exe
  C:\Windows\System\ocqPRGs.exe
  2⤵
  PID:12632
- C:\Windows\System\NIWzYsn.exe
  C:\Windows\System\NIWzYsn.exe
  2⤵
  PID:12652
- C:\Windows\System\LkFCIoL.exe
  C:\Windows\System\LkFCIoL.exe
  2⤵
  PID:12668
- C:\Windows\System\nOXeTjR.exe
  C:\Windows\System\nOXeTjR.exe
  2⤵
  PID:12696
- C:\Windows\System\cZVAMOp.exe
  C:\Windows\System\cZVAMOp.exe
  2⤵
  PID:12724
- C:\Windows\System\fjJKucj.exe
  C:\Windows\System\fjJKucj.exe
  2⤵
  PID:12748
- C:\Windows\System\mYdCCMV.exe
  C:\Windows\System\mYdCCMV.exe
  2⤵
  PID:12788
- C:\Windows\System\tgtxfyP.exe
  C:\Windows\System\tgtxfyP.exe
  2⤵
  PID:12808
- C:\Windows\System\mBRfqBR.exe
  C:\Windows\System\mBRfqBR.exe
  2⤵
  PID:12832
- C:\Windows\System\ZPHRJTf.exe
  C:\Windows\System\ZPHRJTf.exe
  2⤵
  PID:12880
- C:\Windows\System\iGeWdqb.exe
  C:\Windows\System\iGeWdqb.exe
  2⤵
  PID:12904
- C:\Windows\System\GeftxCh.exe
  C:\Windows\System\GeftxCh.exe
  2⤵
  PID:12920
- C:\Windows\System\AYnZlAb.exe
  C:\Windows\System\AYnZlAb.exe
  2⤵
  PID:12948
- C:\Windows\System\gFakltW.exe
  C:\Windows\System\gFakltW.exe
  2⤵
  PID:12980
- C:\Windows\System\vtFpnkA.exe
  C:\Windows\System\vtFpnkA.exe
  2⤵
  PID:13024
- C:\Windows\System\VqMKOWo.exe
  C:\Windows\System\VqMKOWo.exe
  2⤵
  PID:13056
- C:\Windows\System\LZnavLd.exe
  C:\Windows\System\LZnavLd.exe
  2⤵
  PID:13072
- C:\Windows\System\QiDMvkq.exe
  C:\Windows\System\QiDMvkq.exe
  2⤵
  PID:13108
- C:\Windows\System\AZCfvXy.exe
  C:\Windows\System\AZCfvXy.exe
  2⤵
  PID:13128
- C:\Windows\System\wCxUsCi.exe
  C:\Windows\System\wCxUsCi.exe
  2⤵
  PID:13172
- C:\Windows\System\rmDWcTe.exe
  C:\Windows\System\rmDWcTe.exe
  2⤵
  PID:13188
- C:\Windows\System\QDsgaKQ.exe
  C:\Windows\System\QDsgaKQ.exe
  2⤵
  PID:13204
- C:\Windows\System\dtImlxm.exe
  C:\Windows\System\dtImlxm.exe
  2⤵
  PID:13220
- C:\Windows\System\zeOKmak.exe
  C:\Windows\System\zeOKmak.exe
  2⤵
  PID:13252
- C:\Windows\System\ULxdFuW.exe
  C:\Windows\System\ULxdFuW.exe
  2⤵
  PID:13280
- C:\Windows\System\zeSluWz.exe
  C:\Windows\System\zeSluWz.exe
  2⤵
  PID:11372
- C:\Windows\System\dydSELx.exe
  C:\Windows\System\dydSELx.exe
  2⤵
  PID:11956
- C:\Windows\System\dWGaJbn.exe
  C:\Windows\System\dWGaJbn.exe
  2⤵
  PID:12380
- C:\Windows\System\maYITBh.exe
  C:\Windows\System\maYITBh.exe
  2⤵
  PID:12444
- C:\Windows\System\Ftbiaor.exe
  C:\Windows\System\Ftbiaor.exe
  2⤵
  PID:12456
- C:\Windows\System\ihAlAiT.exe
  C:\Windows\System\ihAlAiT.exe
  2⤵
  PID:12604
- C:\Windows\System\HnaUCUb.exe
  C:\Windows\System\HnaUCUb.exe
  2⤵
  PID:12564
- C:\Windows\System\FsLybmR.exe
  C:\Windows\System\FsLybmR.exe
  2⤵
  PID:12680
- C:\Windows\System\augYDgq.exe
  C:\Windows\System\augYDgq.exe
  2⤵
  PID:12732
- C:\Windows\System\jemEDWp.exe
  C:\Windows\System\jemEDWp.exe
  2⤵
  PID:12768
- C:\Windows\System\anBqEwS.exe
  C:\Windows\System\anBqEwS.exe
  2⤵
  PID:12912
- C:\Windows\System\dycQhZh.exe
  C:\Windows\System\dycQhZh.exe
  2⤵
  PID:12936
- C:\Windows\System\WpclKbK.exe
  C:\Windows\System\WpclKbK.exe
  2⤵
  PID:13016
- C:\Windows\System\wlVZbwR.exe
  C:\Windows\System\wlVZbwR.exe
  2⤵
  PID:13124
- C:\Windows\System\gocCdsN.exe
  C:\Windows\System\gocCdsN.exe
  2⤵
  PID:13200
- C:\Windows\System\MjNsKiw.exe
  C:\Windows\System\MjNsKiw.exe
  2⤵
  PID:13260
- C:\Windows\System\uDDLMFN.exe
  C:\Windows\System\uDDLMFN.exe
  2⤵
  PID:13292
- C:\Windows\System\WzKsKyy.exe
  C:\Windows\System\WzKsKyy.exe
  2⤵
  PID:12292
- C:\Windows\System\iiXzKeq.exe
  C:\Windows\System\iiXzKeq.exe
  2⤵
  PID:12496
- C:\Windows\System\zYzUbiJ.exe
  C:\Windows\System\zYzUbiJ.exe
  2⤵
  PID:12628
- C:\Windows\System\FTBhyzi.exe
  C:\Windows\System\FTBhyzi.exe
  2⤵
  PID:12776
- C:\Windows\System\MtymOvq.exe
  C:\Windows\System\MtymOvq.exe
  2⤵
  PID:13000
- C:\Windows\System\GjijNzP.exe
  C:\Windows\System\GjijNzP.exe
  2⤵
  PID:13084
- C:\Windows\System\DLmcCjJ.exe
  C:\Windows\System\DLmcCjJ.exe
  2⤵
  PID:13092
- C:\Windows\System\ExCiEfD.exe
  C:\Windows\System\ExCiEfD.exe
  2⤵
  PID:12532
- C:\Windows\System\PvNvguD.exe
  C:\Windows\System\PvNvguD.exe
  2⤵
  PID:12772
- C:\Windows\System\oMfQRLk.exe
  C:\Windows\System\oMfQRLk.exe
  2⤵
  PID:13160
- C:\Windows\System\qvIldfS.exe
  C:\Windows\System\qvIldfS.exe
  2⤵
  PID:13268
- C:\Windows\System\IwXtJik.exe
  C:\Windows\System\IwXtJik.exe
  2⤵
  PID:13328
- C:\Windows\System\UNHNjev.exe
  C:\Windows\System\UNHNjev.exe
  2⤵
  PID:13344
- C:\Windows\System\WIUlRps.exe
  C:\Windows\System\WIUlRps.exe
  2⤵
  PID:13380
- C:\Windows\System\IXbMTTg.exe
  C:\Windows\System\IXbMTTg.exe
  2⤵
  PID:13404
- C:\Windows\System\KvZheUN.exe
  C:\Windows\System\KvZheUN.exe
  2⤵
  PID:13424
- C:\Windows\System\CTNeWuq.exe
  C:\Windows\System\CTNeWuq.exe
  2⤵
  PID:13456
- C:\Windows\System\sPEbvGv.exe
  C:\Windows\System\sPEbvGv.exe
  2⤵
  PID:13480
- C:\Windows\System\oEwzzMF.exe
  C:\Windows\System\oEwzzMF.exe
  2⤵
  PID:13520
- C:\Windows\System\vtWPjeN.exe
  C:\Windows\System\vtWPjeN.exe
  2⤵
  PID:13548
- C:\Windows\System\ByNcRJl.exe
  C:\Windows\System\ByNcRJl.exe
  2⤵
  PID:13564
- C:\Windows\System\XkAmrTT.exe
  C:\Windows\System\XkAmrTT.exe
  2⤵
  PID:13596
- C:\Windows\System\rFqIbkv.exe
  C:\Windows\System\rFqIbkv.exe
  2⤵
  PID:13632
- C:\Windows\System\rmkpcXe.exe
  C:\Windows\System\rmkpcXe.exe
  2⤵
  PID:13648
- C:\Windows\System\WgoTDwu.exe
  C:\Windows\System\WgoTDwu.exe
  2⤵
  PID:13668
- C:\Windows\System\VJmtBkM.exe
  C:\Windows\System\VJmtBkM.exe
  2⤵
  PID:13696
- C:\Windows\System\lJviCag.exe
  C:\Windows\System\lJviCag.exe
  2⤵
  PID:13720
- C:\Windows\System\zeggCwk.exe
  C:\Windows\System\zeggCwk.exe
  2⤵
  PID:13752
- C:\Windows\System\zBFcjTO.exe
  C:\Windows\System\zBFcjTO.exe
  2⤵
  PID:13780
- C:\Windows\System\BvtsFTl.exe
  C:\Windows\System\BvtsFTl.exe
  2⤵
  PID:13820
- C:\Windows\System\NQjnonD.exe
  C:\Windows\System\NQjnonD.exe
  2⤵
  PID:13856
- C:\Windows\System\xOKuftl.exe
  C:\Windows\System\xOKuftl.exe
  2⤵
  PID:13872
- C:\Windows\System\apfPhQS.exe
  C:\Windows\System\apfPhQS.exe
  2⤵
  PID:13912
- C:\Windows\System\qPeLNSw.exe
  C:\Windows\System\qPeLNSw.exe
  2⤵
  PID:13952
- C:\Windows\System\sfexxpp.exe
  C:\Windows\System\sfexxpp.exe
  2⤵
  PID:13976
- C:\Windows\System\SlUbclv.exe
  C:\Windows\System\SlUbclv.exe
  2⤵
  PID:13996
- C:\Windows\System\WsPUevO.exe
  C:\Windows\System\WsPUevO.exe
  2⤵
  PID:14024
- C:\Windows\System\wHqdObK.exe
  C:\Windows\System\wHqdObK.exe
  2⤵
  PID:14044
- C:\Windows\System\ZClPOBj.exe
  C:\Windows\System\ZClPOBj.exe
  2⤵
  PID:14064
- C:\Windows\System\HpkfuLf.exe
  C:\Windows\System\HpkfuLf.exe
  2⤵
  PID:14108
- C:\Windows\System\jaDycIS.exe
  C:\Windows\System\jaDycIS.exe
  2⤵
  PID:14124
- C:\Windows\System\qZypUUJ.exe
  C:\Windows\System\qZypUUJ.exe
  2⤵
  PID:14148
- C:\Windows\System\FqnRyYj.exe
  C:\Windows\System\FqnRyYj.exe
  2⤵
  PID:14180
- C:\Windows\System\zaUHUyI.exe
  C:\Windows\System\zaUHUyI.exe
  2⤵
  PID:14208
- C:\Windows\System\KSPGpFq.exe
  C:\Windows\System\KSPGpFq.exe
  2⤵
  PID:14224
- C:\Windows\System\nYwUXCM.exe
  C:\Windows\System\nYwUXCM.exe
  2⤵
  PID:14260
- C:\Windows\System\xtvFbLf.exe
  C:\Windows\System\xtvFbLf.exe
  2⤵
  PID:14304
- C:\Windows\System\lbFZsGQ.exe
  C:\Windows\System\lbFZsGQ.exe
  2⤵
  PID:12568
- C:\Windows\System\OHFCfza.exe
  C:\Windows\System\OHFCfza.exe
  2⤵
  PID:13416
- C:\Windows\System\xGOIGEp.exe
  C:\Windows\System\xGOIGEp.exe
  2⤵
  PID:13532
- C:\Windows\System\CMhJOmF.exe
  C:\Windows\System\CMhJOmF.exe
  2⤵
  PID:13584
- C:\Windows\System\LKDzPNh.exe
  C:\Windows\System\LKDzPNh.exe
  2⤵
  PID:13688
- C:\Windows\System\nxviwLH.exe
  C:\Windows\System\nxviwLH.exe
  2⤵
  PID:13704
- C:\Windows\System\uCuWsTK.exe
  C:\Windows\System\uCuWsTK.exe
  2⤵
  PID:13708
- C:\Windows\System\ICDzZCx.exe
  C:\Windows\System\ICDzZCx.exe
  2⤵
  PID:13800
- C:\Windows\System\UqXmEmc.exe
  C:\Windows\System\UqXmEmc.exe
  2⤵
  PID:13816
- C:\Windows\System\cGjLYrn.exe
  C:\Windows\System\cGjLYrn.exe
  2⤵
  PID:13988
- C:\Windows\System\uBvAlNs.exe
  C:\Windows\System\uBvAlNs.exe
  2⤵
  PID:14032
- C:\Windows\System\qcibUVO.exe
  C:\Windows\System\qcibUVO.exe
  2⤵
  PID:14120
- C:\Windows\System\mFcyvFE.exe
  C:\Windows\System\mFcyvFE.exe
  2⤵
  PID:14156
- C:\Windows\System\dBCElvV.exe
  C:\Windows\System\dBCElvV.exe
  2⤵
  PID:14236
- C:\Windows\System\zTvTaeU.exe
  C:\Windows\System\zTvTaeU.exe
  2⤵
  PID:14292
- C:\Windows\System\JdlmGId.exe
  C:\Windows\System\JdlmGId.exe
  2⤵
  PID:12684
- C:\Windows\System\YmhThZf.exe
  C:\Windows\System\YmhThZf.exe
  2⤵
  PID:13512
- C:\Windows\System\SYzlGem.exe
  C:\Windows\System\SYzlGem.exe
  2⤵
  PID:13676
- C:\Windows\System\uoWZOEu.exe
  C:\Windows\System\uoWZOEu.exe
  2⤵
  PID:13904
- C:\Windows\System\tnZzOVb.exe
  C:\Windows\System\tnZzOVb.exe
  2⤵
  PID:14084
- C:\Windows\System\VDNOPPe.exe
  C:\Windows\System\VDNOPPe.exe
  2⤵
  PID:14196
- C:\Windows\System\SUMDdwk.exe
  C:\Windows\System\SUMDdwk.exe
  2⤵
  PID:14300
- C:\Windows\System\miVHrvr.exe
  C:\Windows\System\miVHrvr.exe
  2⤵
  PID:13608
- C:\Windows\System\lRPSdTE.exe
  C:\Windows\System\lRPSdTE.exe
  2⤵
  PID:13972
- C:\Windows\System\XaoiRSu.exe
  C:\Windows\System\XaoiRSu.exe
  2⤵
  PID:14172
- C:\Windows\System\sjAYcQS.exe
  C:\Windows\System\sjAYcQS.exe
  2⤵
  PID:14368
- C:\Windows\System\wjbTQJS.exe
  C:\Windows\System\wjbTQJS.exe
  2⤵
  PID:14420
- C:\Windows\System\UAOlhTl.exe
  C:\Windows\System\UAOlhTl.exe
  2⤵
  PID:14436
- C:\Windows\System\qEwPIAB.exe
  C:\Windows\System\qEwPIAB.exe
  2⤵
  PID:14456
- C:\Windows\System\GloddRh.exe
  C:\Windows\System\GloddRh.exe
  2⤵
  PID:14492
- C:\Windows\System\AqmTKSv.exe
  C:\Windows\System\AqmTKSv.exe
  2⤵
  PID:14508
- C:\Windows\System\vsTRXNP.exe
  C:\Windows\System\vsTRXNP.exe
  2⤵
  PID:14524
- C:\Windows\System\bEHokda.exe
  C:\Windows\System\bEHokda.exe
  2⤵
  PID:14544
- C:\Windows\System\rqVqmMo.exe
  C:\Windows\System\rqVqmMo.exe
  2⤵
  PID:14576
- C:\Windows\System\LwgFwBW.exe
  C:\Windows\System\LwgFwBW.exe
  2⤵
  PID:14632
- C:\Windows\System\PSViODp.exe
  C:\Windows\System\PSViODp.exe
  2⤵
  PID:14672
- C:\Windows\System\jhYqODy.exe
  C:\Windows\System\jhYqODy.exe
  2⤵
  PID:14692
- C:\Windows\System\hOHIJfy.exe
  C:\Windows\System\hOHIJfy.exe
  2⤵
  PID:14720
- C:\Windows\System\yRNNPVA.exe
  C:\Windows\System\yRNNPVA.exe
  2⤵
  PID:14740
- C:\Windows\System\RgLURGb.exe
  C:\Windows\System\RgLURGb.exe
  2⤵
  PID:14760
- C:\Windows\System\VVMgbJS.exe
  C:\Windows\System\VVMgbJS.exe
  2⤵
  PID:14784
- C:\Windows\System\ETecPRj.exe
  C:\Windows\System\ETecPRj.exe
  2⤵
  PID:14812
- C:\Windows\System\XTCZgpl.exe
  C:\Windows\System\XTCZgpl.exe
  2⤵
  PID:14856
- C:\Windows\System\mpaSHVY.exe
  C:\Windows\System\mpaSHVY.exe
  2⤵
  PID:14876
- C:\Windows\System\CAHEExe.exe
  C:\Windows\System\CAHEExe.exe
  2⤵
  PID:14900
- C:\Windows\System\wPiMXpM.exe
  C:\Windows\System\wPiMXpM.exe
  2⤵
  PID:14944
- C:\Windows\System\yeEPjKs.exe
  C:\Windows\System\yeEPjKs.exe
  2⤵
  PID:14984
- C:\Windows\System\oihOKdX.exe
  C:\Windows\System\oihOKdX.exe
  2⤵
  PID:15000
- C:\Windows\System\aaAFnaz.exe
  C:\Windows\System\aaAFnaz.exe
  2⤵
  PID:15020
- C:\Windows\System\OXFESeb.exe
  C:\Windows\System\OXFESeb.exe
  2⤵
  PID:15040
- C:\Windows\System\GKBwpXd.exe
  C:\Windows\System\GKBwpXd.exe
  2⤵
  PID:15072
- C:\Windows\System\sforUic.exe
  C:\Windows\System\sforUic.exe
  2⤵
  PID:15100
- C:\Windows\System\fFjGjFR.exe
  C:\Windows\System\fFjGjFR.exe
  2⤵
  PID:15132
- C:\Windows\System\zsossxw.exe
  C:\Windows\System\zsossxw.exe
  2⤵
  PID:15152
- C:\Windows\System\UMTlOqJ.exe
  C:\Windows\System\UMTlOqJ.exe
  2⤵
  PID:15180
- C:\Windows\System\SKqwJrQ.exe
  C:\Windows\System\SKqwJrQ.exe
  2⤵
  PID:15208
- C:\Windows\System\eskoxOE.exe
  C:\Windows\System\eskoxOE.exe
  2⤵
  PID:15224
- C:\Windows\System\hNMlDuU.exe
  C:\Windows\System\hNMlDuU.exe
  2⤵
  PID:15256
- C:\Windows\System\UwUOpGH.exe
  C:\Windows\System\UwUOpGH.exe
  2⤵
  PID:15312
- C:\Windows\System\UyyaWDt.exe
  C:\Windows\System\UyyaWDt.exe
  2⤵
  PID:15336
- C:\Windows\System\RHBgDre.exe
  C:\Windows\System\RHBgDre.exe
  2⤵
  PID:15356
- C:\Windows\System\gkVfBDG.exe
  C:\Windows\System\gkVfBDG.exe
  2⤵
  PID:14360
- C:\Windows\System\xTlQalb.exe
  C:\Windows\System\xTlQalb.exe
  2⤵
  PID:14252
- C:\Windows\System\WtdYiFB.exe
  C:\Windows\System\WtdYiFB.exe
  2⤵
  PID:14396
- C:\Windows\System\wjnWVwt.exe
  C:\Windows\System\wjnWVwt.exe
  2⤵
  PID:14572
- C:\Windows\System\frGSEHN.exe
  C:\Windows\System\frGSEHN.exe
  2⤵
  PID:14604
- C:\Windows\System\fVKmPNS.exe
  C:\Windows\System\fVKmPNS.exe
  2⤵
  PID:14664
- C:\Windows\System\TatzsmV.exe
  C:\Windows\System\TatzsmV.exe
  2⤵
  PID:14732
- C:\Windows\System\PCgoIPA.exe
  C:\Windows\System\PCgoIPA.exe
  2⤵
  PID:14752
- C:\Windows\System\iSghjCo.exe
  C:\Windows\System\iSghjCo.exe
  2⤵
  PID:14872
- C:\Windows\System\NSdOOBF.exe
  C:\Windows\System\NSdOOBF.exe
  2⤵
  PID:14892
- C:\Windows\System\BXULYHD.exe
  C:\Windows\System\BXULYHD.exe
  2⤵
  PID:14980
- C:\Windows\System\jHgKkjB.exe
  C:\Windows\System\jHgKkjB.exe
  2⤵
  PID:15084
- C:\Windows\System\rwTeLsb.exe
  C:\Windows\System\rwTeLsb.exe
  2⤵
  PID:15124
- C:\Windows\System\lGptLrk.exe
  C:\Windows\System\lGptLrk.exe
  2⤵
  PID:15188
- C:\Windows\System\FqqLDnk.exe
  C:\Windows\System\FqqLDnk.exe
  2⤵
  PID:15204
- C:\Windows\System\UIbXqIb.exe
  C:\Windows\System\UIbXqIb.exe
  2⤵
  PID:13476
- C:\Windows\System\zZFgrsh.exe
  C:\Windows\System\zZFgrsh.exe
  2⤵
  PID:14404
- C:\Windows\System\GOUpnXb.exe
  C:\Windows\System\GOUpnXb.exe
  2⤵
  PID:13772
- C:\Windows\System\VStbbzw.exe
  C:\Windows\System\VStbbzw.exe
  2⤵
  PID:14568
- C:\Windows\System\UCmwhrR.exe
  C:\Windows\System\UCmwhrR.exe
  2⤵
  PID:14844
- C:\Windows\System\aDVVsDN.exe
  C:\Windows\System\aDVVsDN.exe
  2⤵
  PID:14888
- C:\Windows\System\qAJajwh.exe
  C:\Windows\System\qAJajwh.exe
  2⤵
  PID:14996
- C:\Windows\System\lXqDprK.exe
  C:\Windows\System\lXqDprK.exe
  2⤵
  PID:15200
- C:\Windows\System\DyyLEEo.exe
  C:\Windows\System\DyyLEEo.exe
  2⤵
  PID:15344
- C:\Windows\System\FMjPjHC.exe
  C:\Windows\System\FMjPjHC.exe
  2⤵
  PID:14540
- C:\Windows\System\jdHEopQ.exe
  C:\Windows\System\jdHEopQ.exe
  2⤵
  PID:15216
- C:\Windows\System\tdtbirq.exe
  C:\Windows\System\tdtbirq.exe
  2⤵
  PID:14500
- C:\Windows\System\cLIDhkl.exe
  C:\Windows\System\cLIDhkl.exe
  2⤵
  PID:15372
- C:\Windows\System\DKzVFGj.exe
  C:\Windows\System\DKzVFGj.exe
  2⤵
  PID:15392
- C:\Windows\System\jEDugYX.exe
  C:\Windows\System\jEDugYX.exe
  2⤵
  PID:15412
- C:\Windows\System\oHyTnel.exe
  C:\Windows\System\oHyTnel.exe
  2⤵
  PID:15444
- C:\Windows\System\nLcgwUU.exe
  C:\Windows\System\nLcgwUU.exe
  2⤵
  PID:15472
- C:\Windows\System\BpaISrf.exe
  C:\Windows\System\BpaISrf.exe
  2⤵
  PID:15496
- C:\Windows\System\YRWGhmb.exe
  C:\Windows\System\YRWGhmb.exe
  2⤵
  PID:15516
- C:\Windows\System\xMHyMTU.exe
  C:\Windows\System\xMHyMTU.exe
  2⤵
  PID:15544
- C:\Windows\System\txgDAxz.exe
  C:\Windows\System\txgDAxz.exe
  2⤵
  PID:15564
- C:\Windows\System\sneOzCs.exe
  C:\Windows\System\sneOzCs.exe
  2⤵
  PID:15600
- C:\Windows\System\tFcXvBY.exe
  C:\Windows\System\tFcXvBY.exe
  2⤵
  PID:15624
- C:\Windows\System\yRwPDEQ.exe
  C:\Windows\System\yRwPDEQ.exe
  2⤵
  PID:15640
- C:\Windows\System\VxDFGhg.exe
  C:\Windows\System\VxDFGhg.exe
  2⤵
  PID:15664
- C:\Windows\System\bwvCYwz.exe
  C:\Windows\System\bwvCYwz.exe
  2⤵
  PID:15704
- C:\Windows\System\XLAyiOZ.exe
  C:\Windows\System\XLAyiOZ.exe
  2⤵
  PID:15764
- C:\Windows\System\KrPsFtq.exe
  C:\Windows\System\KrPsFtq.exe
  2⤵
  PID:15788
- C:\Windows\System\lxSRxdV.exe
  C:\Windows\System\lxSRxdV.exe
  2⤵
  PID:15816
- C:\Windows\System\iNJpdSP.exe
  C:\Windows\System\iNJpdSP.exe
  2⤵
  PID:15832
- C:\Windows\System\UDKrEjA.exe
  C:\Windows\System\UDKrEjA.exe
  2⤵
  PID:15868
- C:\Windows\System\JdPfreP.exe
  C:\Windows\System\JdPfreP.exe
  2⤵
  PID:15888
- C:\Windows\System\cAiJTGK.exe
  C:\Windows\System\cAiJTGK.exe
  2⤵
  PID:15912
- C:\Windows\System\GWSdSin.exe
  C:\Windows\System\GWSdSin.exe
  2⤵
  PID:15944
- C:\Windows\System\sDwZHwf.exe
  C:\Windows\System\sDwZHwf.exe
  2⤵
  PID:15976
- C:\Windows\System\qejINQp.exe
  C:\Windows\System\qejINQp.exe
  2⤵
  PID:16000
- C:\Windows\System\gvDpnZp.exe
  C:\Windows\System\gvDpnZp.exe
  2⤵
  PID:16032
- C:\Windows\System\JEvBskT.exe
  C:\Windows\System\JEvBskT.exe
  2⤵
  PID:16080
- C:\Windows\System\VcMNTRx.exe
  C:\Windows\System\VcMNTRx.exe
  2⤵
  PID:16100
- C:\Windows\System\OTLCaJr.exe
  C:\Windows\System\OTLCaJr.exe
  2⤵
  PID:16128
- C:\Windows\System\PzGZXPK.exe
  C:\Windows\System\PzGZXPK.exe
  2⤵
  PID:16144
- C:\Windows\System\NgyemiW.exe
  C:\Windows\System\NgyemiW.exe
  2⤵
  PID:16196
- C:\Windows\System\GyuXFQY.exe
  C:\Windows\System\GyuXFQY.exe
  2⤵
  PID:16212
- C:\Windows\System\CgclGCa.exe
  C:\Windows\System\CgclGCa.exe
  2⤵
  PID:16236
- C:\Windows\System\TPdyrvR.exe
  C:\Windows\System\TPdyrvR.exe
  2⤵
  PID:16256
- C:\Windows\System\ewBAvgj.exe
  C:\Windows\System\ewBAvgj.exe
  2⤵
  PID:16288
- C:\Windows\System\wMeTAty.exe
  C:\Windows\System\wMeTAty.exe
  2⤵
  PID:16324
- C:\Windows\System\UzzVyZu.exe
  C:\Windows\System\UzzVyZu.exe
  2⤵
  PID:16340
- C:\Windows\System\lvVGTdC.exe
  C:\Windows\System\lvVGTdC.exe
  2⤵
  PID:16372
- C:\Windows\System\UDIawce.exe
  C:\Windows\System\UDIawce.exe
  2⤵
  PID:15368
- C:\Windows\System\TmMCtfb.exe
  C:\Windows\System\TmMCtfb.exe
  2⤵
  PID:15380
- C:\Windows\System\FMwedLh.exe
  C:\Windows\System\FMwedLh.exe
  2⤵
  PID:15480
- C:\Windows\System\ZVnNeZq.exe
  C:\Windows\System\ZVnNeZq.exe
  2⤵
  PID:15532
- C:\Windows\System\eRXRdIm.exe
  C:\Windows\System\eRXRdIm.exe
  2⤵
  PID:15636
- C:\Windows\System\VXPwarl.exe
  C:\Windows\System\VXPwarl.exe
  2⤵
  PID:15652
- C:\Windows\System\FtLmVZk.exe
  C:\Windows\System\FtLmVZk.exe
  2⤵
  PID:15740
- C:\Windows\System\DtxsHNp.exe
  C:\Windows\System\DtxsHNp.exe
  2⤵
  PID:15804
- C:\Windows\System\aLPtytJ.exe
  C:\Windows\System\aLPtytJ.exe
  2⤵
  PID:15900
- C:\Windows\System\qeJzDKD.exe
  C:\Windows\System\qeJzDKD.exe
  2⤵
  PID:15928
- C:\Windows\System\yjQbQkj.exe
  C:\Windows\System\yjQbQkj.exe
  2⤵
  PID:15956
- C:\Windows\System\XVXoYHC.exe
  C:\Windows\System\XVXoYHC.exe
  2⤵
  PID:15996
- C:\Windows\System\qhoRjZW.exe
  C:\Windows\System\qhoRjZW.exe
  2⤵
  PID:16116
- C:\Windows\System\PerVRFi.exe
  C:\Windows\System\PerVRFi.exe
  2⤵
  PID:16184
- C:\Windows\System\ANNJMPq.exe
  C:\Windows\System\ANNJMPq.exe
  2⤵
  PID:16248
- C:\Windows\System\yqWrxgo.exe
  C:\Windows\System\yqWrxgo.exe
  2⤵
  PID:16284
- C:\Windows\System\SuWnTnR.exe
  C:\Windows\System\SuWnTnR.exe
  2⤵
  PID:15408
- C:\Windows\System\jHbGTKC.exe
  C:\Windows\System\jHbGTKC.exe
  2⤵
  PID:15464
- C:\Windows\System\tWWnteh.exe
  C:\Windows\System\tWWnteh.exe
  2⤵
  PID:15772
- C:\Windows\System\xDUsFoH.exe
  C:\Windows\System\xDUsFoH.exe
  2⤵
  PID:15860
- C:\Windows\System\otKqrYF.exe
  C:\Windows\System\otKqrYF.exe
  2⤵
  PID:15992
- C:\Windows\System\EbMOpEd.exe
  C:\Windows\System\EbMOpEd.exe
  2⤵
  PID:16120
- C:\Windows\System\NXUdXPd.exe
  C:\Windows\System\NXUdXPd.exe
  2⤵
  PID:16268
- C:\Windows\System\lzykzBs.exe
  C:\Windows\System\lzykzBs.exe
  2⤵
  PID:15632
- C:\Windows\System\ZRhTlBf.exe
  C:\Windows\System\ZRhTlBf.exe
  2⤵
  PID:15780
- C:\Windows\System\pCzOUet.exe
  C:\Windows\System\pCzOUet.exe
  2⤵
  PID:15968
- C:\Windows\System\cdmAPRZ.exe
  C:\Windows\System\cdmAPRZ.exe
  2⤵
  PID:15460
- C:\Windows\System\FVvWhAd.exe
  C:\Windows\System\FVvWhAd.exe
  2⤵
  PID:16388
- C:\Windows\System\ifiOzxu.exe
  C:\Windows\System\ifiOzxu.exe
  2⤵
  PID:16404
- C:\Windows\System\NMnoRnh.exe
  C:\Windows\System\NMnoRnh.exe
  2⤵
  PID:16444
- C:\Windows\System\FmsSwzh.exe
  C:\Windows\System\FmsSwzh.exe
  2⤵
  PID:16472
- C:\Windows\System\AAMJlLB.exe
  C:\Windows\System\AAMJlLB.exe
  2⤵
  PID:16488
- C:\Windows\System\lGrHePN.exe
  C:\Windows\System\lGrHePN.exe
  2⤵
  PID:16540
- C:\Windows\System\hloqcJD.exe
  C:\Windows\System\hloqcJD.exe
  2⤵
  PID:16556
- C:\Windows\System\yOfWqCk.exe
  C:\Windows\System\yOfWqCk.exe
  2⤵
  PID:16584
- C:\Windows\System\gXvNgEZ.exe
  C:\Windows\System\gXvNgEZ.exe
  2⤵
  PID:16600
- C:\Windows\System\bGjBdFm.exe
  C:\Windows\System\bGjBdFm.exe
  2⤵
  PID:16616
- C:\Windows\System\TrJdudY.exe
  C:\Windows\System\TrJdudY.exe
  2⤵
  PID:16652
- C:\Windows\System\TkNJwAg.exe
  C:\Windows\System\TkNJwAg.exe
  2⤵
  PID:16680
- C:\Windows\System\mftDzoU.exe
  C:\Windows\System\mftDzoU.exe
  2⤵
  PID:16700
- C:\Windows\System\NhlhWgz.exe
  C:\Windows\System\NhlhWgz.exe
  2⤵
  PID:16724
- C:\Windows\System\otWEkKt.exe
  C:\Windows\System\otWEkKt.exe
  2⤵
  PID:16764
- C:\Windows\System\qMocZYH.exe
  C:\Windows\System\qMocZYH.exe
  2⤵
  PID:16796
- C:\Windows\System\ONigCgF.exe
  C:\Windows\System\ONigCgF.exe
  2⤵
  PID:16828
- C:\Windows\System\ylQZLQE.exe
  C:\Windows\System\ylQZLQE.exe
  2⤵
  PID:16852
- C:\Windows\System\IiiKelF.exe
  C:\Windows\System\IiiKelF.exe
  2⤵
  PID:16888
- C:\Windows\System\lvbqmOf.exe
  C:\Windows\System\lvbqmOf.exe
  2⤵
  PID:16920
- C:\Windows\System\Zvilcot.exe
  C:\Windows\System\Zvilcot.exe
  2⤵
  PID:16936
- C:\Windows\System\qppIchR.exe
  C:\Windows\System\qppIchR.exe
  2⤵
  PID:16968

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:17276

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\APGQTWV.exe

Filesize
1.1MB

MD5
c6971a8d1bdbe9d04973f4d7c92d249c

SHA1
b5526a5d8c58efbc8fe99f151547d629199aca63

SHA256
74387e43a4fce35372c3da762daedeba76480b223d93207de95c1a8795c584ca

SHA512
f3c60dfd44a6cc15fbd7ddc6125a508a1b427e1738163b94d1f1a4e85e96b74dd91bc02ca26355a98cde19910bf78b921f3438c1f7902ef8a4a3b774d289f99e

Download Submit
C:\Windows\System\FIespPj.exe

Filesize
1.1MB

MD5
45f82646ab074eb868d7d78069ddd712

SHA1
7d15fd8b23bed335e430efcef962412985ea4cac

SHA256
60a08742f044eec65d45700d643aaadb2df1388da651c81151b93e2f60fdd660

SHA512
07e695cc030887f3cc0a5d6cb1fea055c111768ace20e01bb84d2a6aa0a9befc800228af78d828177a7df507f6236af78aed52e73c49dbdec05a06af8e96b14c

Download Submit
C:\Windows\System\HUbQAuD.exe

Filesize
1.1MB

MD5
0c38a8f65fa8de68da8ee0fa4b81ba51

SHA1
b782a98bdf16732e0f779a601943557a3ca1f2ff

SHA256
a58ab4f056568f4871475d33a93a5d315bc9f6ec42042b216b191c792db0e08e

SHA512
d4bfc96001aeb1874203b8898c2637699c05c867c0e01b2ef90c8fed973ed076e0e98be89929def1e170f0bc7606a6285b35868958287141dff0dd8be4c7e93e

Download Submit
C:\Windows\System\IvfAvzW.exe

Filesize
1.1MB

MD5
f09a418cd39c741ed80643fde67da77e

SHA1
7e46c636bf324086a171af0c121236b35a284971

SHA256
d17d5311a313d903f719399717d929184848d85352dd10999f9c630c9644fb3c

SHA512
b0fc8d1a896f6a5b99acf31275f94e227334d736258a565e7ce35fbfcaac922d4b93981778c9a878174feb04037556015f4e211f9e9e404653a86aee6d789ee9

Download Submit
C:\Windows\System\JPObwRf.exe

Filesize
1.1MB

MD5
e8878e538ec05e74ab0279fac92c4dad

SHA1
d3ecb7f850bd89764e83e7b96562edba79cabf26

SHA256
23a9d7e4e7066335ccad17cb234fc727ffa1db2113be19ae18118ef8fc0d2e75

SHA512
0273d195f1afc6b074b8c5b764c76d68851ed9dca5e19954830c306dfa30b5f899dcc7a436da341534c672b0d27cfe8aca2c2a12856d96b37713e35092cd5c46

Download Submit
C:\Windows\System\KRcTjTX.exe

Filesize
1.1MB

MD5
cf4a7dbf97c9f19d86beebb619f5b402

SHA1
949843cb693867eb4a6c71d75f87e5948e143c1a

SHA256
000078e24108013b1bba712e72d3e78a6e51fd0c49c457a4243db1346c2138fb

SHA512
579dc7aa3b2e94b2ea8ba189539ed9a8a847aa8e6afa8d7ba2e2431c4fbebd110b611abbdda9b428ff89b78c31cd86f5ef5d7d7f3577538ab995939ee460a7f4

Download Submit
C:\Windows\System\KztZBWo.exe

Filesize
1.1MB

MD5
a51384a31b4b46e8990ef5541f4b42ae

SHA1
f7390c34ebb6a232c22e115e76ed1e289343b62d

SHA256
749992a7adc4cc9f37987131b73827153aaa6a479a6ee5e77cf350d995b71c09

SHA512
65db8fe42a2d779c0e22579210aa31fbdadd24d11f91e124a7c61c9eac19749388c88f25a9451dffcca066296e86c327635d01d84f2659c0162e85a62705d136

Download Submit
C:\Windows\System\NVWyLTn.exe

Filesize
1.1MB

MD5
68b5a432bed8dbfaa4bec4b741f126c0

SHA1
4d94f222486e6ab13a91896182e75d0b55995723

SHA256
00294ee89db69a8aeea5cf3d06dfb824ee4546f8db77bb5668bea4ecfb5e0bff

SHA512
067acf6df897b086e072b627850295b2827cff2ee8fd78dd15acacad3b7a10d26f92e7bd5f29d44f0fd57ab568b1f66c9bbcf7d96032e57f91cc587a8cf6bd35

Download Submit
C:\Windows\System\OAdiyjs.exe

Filesize
1.1MB

MD5
80c6400787773defba94d067873a73ae

SHA1
2e0e5aa06ce588b51023e889fe65d4f2d6c63c89

SHA256
335fd1318d467b5f9eadac1848f129fd9f09512f56fc13ff97959f5e9c38f3c7

SHA512
26d1553cc6334753b0db61ad2e432742457ecd2ecd50301b28b037ac89e6e40e366e27507ce1976054c80ca75f9b4d4912fab0c9fa35c88d604b8ac65cb7c789

Download Submit
C:\Windows\System\PgCbhUt.exe

Filesize
1.1MB

MD5
538f083adb88a6aa4d396d8bdb62b93c

SHA1
ccc1b95af32e0275c70e33d015abef22b9b858fc

SHA256
a43dd7d524d8afa3f2953b8f469bc32b285c7029392be81c37bd38ff1b0c1e7c

SHA512
3bb49b9195cf27fcf3d69e6d66dbd7f944189755c3353454ed235a37c63d37a1bd5348d79d084d2df714ee720f1afb61372a256fb8ec70bbe01c4c1d142fd217

Download Submit
C:\Windows\System\QisZKWA.exe

Filesize
1.1MB

MD5
4a86a074806efdd49c84034208234452

SHA1
a7fc9f5f916e9a09899c14820325bdd844ec6bdc

SHA256
b1caaf929cbe9fe2522e25e7ae7dd20d1fb0184ff2c2f803a831b7671b947954

SHA512
a507ab130f018484237b924f3a58350c37ebc370ab1c10f55caa123b6a18c1fc47241844856ce86184c2aa2ad27e331c732f603c7ed5f9d31e59b21b2f3f5f19

Download Submit
C:\Windows\System\SqAathX.exe

Filesize
1.1MB

MD5
c8d4824e81b6a5569de96b8dc26c7d01

SHA1
0056495a33991c77bcbb3e580e38bfd202d8e402

SHA256
34f45f122fa2eba2d9d79554ec992ba73e3c979c3a8e967cd6076464ec29704b

SHA512
a2d6f3726a6ab8a6de7eadcd33ec3c00287e09444454b16097edf89f92e50987fb6ff4c91a09382186cdeff16d8033f2ff71195cd93affd0182225e9d53cbc34

Download Submit
C:\Windows\System\StdWGoh.exe

Filesize
1.1MB

MD5
6ac457886a094b0ff51888e1d72b6e0d

SHA1
aac603a5a197d9f25a8e8fcc30612489723a21a2

SHA256
6b51efd1de713716814a95305c753493b1646e0ba68199eabd1e854c949fce45

SHA512
f697cd4d21abbcc29059a878742fdbcb5fcd4ae76629539a23862df765537a8f0af33cbe554821d1e732255d36d4524a5e1e1be4ca058e2975987836d3038eb5

Download Submit
C:\Windows\System\XMzUjUG.exe

Filesize
1.1MB

MD5
c040ad13c4d140bc25ad4d2a844964a4

SHA1
4f44e71f541e9c5c1243e3f6f0ade8b1066dac0d

SHA256
5349c56a40e7d0ea471832a3e120598884c4a03eff0706208428b52106f30b91

SHA512
871b9ff90e9b2ec98fa6f250a70a999d0a4ae4852a69e9b859374bf8d2a461d7d130751200f5beeceb528e6758539e8846bddcb1272a23cf805c472833bc58b6

Download Submit
C:\Windows\System\ZHyVeGQ.exe

Filesize
1.1MB

MD5
6810735588b4ddf726c6d2f22f7ea113

SHA1
6c4093c41de9b25d02285fea8a6beb7ecc13ff49

SHA256
aa23b7bf418a52a9c822d25834e648a911a906b0d8058f9acacbb8c3636408b4

SHA512
a0df38175384597e3656dd361e2da34efa525900e8c9ea0df6024f3ac90b261a862ffe768c4bcd3cad9778a184c86f30a8c8ac48a04ceecc82906b039f4d1cd4

Download Submit
C:\Windows\System\bHdsRDs.exe

Filesize
1.1MB

MD5
43d1c25f166b01bd53e2fa83d74ddad2

SHA1
7c30a068d8e0ad12793966ac4ee3e5cb9467fb9e

SHA256
6301f061c25c95669af37bbd07b71ae064beccd24bae3d47fca778759b722e44

SHA512
1cfd069ab761621acb47ac06024af66cf4c58353fa70943f7d07c393361cd26507f9030fca826844bb943c94b1c2e23e2a840a06aaa29d070be4224c271460ad

Download Submit
C:\Windows\System\bwwkSBJ.exe

Filesize
1.1MB

MD5
be7eaeaafbc1f534e750288ef6387ad7

SHA1
6029745b12816e82545ec670761b81e4aa529753

SHA256
0df7c2e8ce99bab4ce2409a8667e509eb09b584e3e1ba9969b7e64f5874d43d2

SHA512
a2771736d7bb14c43ab71fbb253c5dcab62cbbb8d2913e83aa11fc1b4837b378675745d5e7bffa86d6283dab7c164471d5a50b799fd1f59c80e22db04551d237

Download Submit
C:\Windows\System\eVMkxCf.exe

Filesize
1.1MB

MD5
09eb30b2ac97f3f6a94150c8c07914f1

SHA1
cf0f16f8deaf63ee4b02fe8901011fc80c6d30d5

SHA256
b0d4acb7a907d9d80f118092d3d8b2a674ef98cd15e5e82246ebada5705ca97c

SHA512
b7ca03e0423f6f0b6d66882e0581048c151ad347e81c89a645de4eb6e3f66a7c4fb3c13e345fa69aa01bc2c902a774d3283726efe765ea19fca402709d24e88c

Download Submit
C:\Windows\System\fEisaDy.exe

Filesize
1.1MB

MD5
c9db36e2e3dee62f53ae4c5f154a58ac

SHA1
acd30f00c1c3aaa5f180b01b052e0cfda0013b51

SHA256
228d7ce3116192e9b44546569394d3b6886adac49ee40c4a6506410f72ee9fe7

SHA512
2f4e9616ae5d390a2e190d1b66e497a05c6050977161f8fd9b16bba90ef94ddf745d4ba1bc0490c9fd748b712bc0b97ee053e3ea2882e053f308cffb365e0722

Download Submit
C:\Windows\System\gWqzXti.exe

Filesize
1.1MB

MD5
f995f2b11fb6a243efe06defda3e8c9b

SHA1
3494fd6c644b35ae993df91bc1d029fed19609d1

SHA256
cce86e68ea6d7be68a3cf6678660c10fc92bf3eb86791c8ac7fb52f7459b0099

SHA512
5fadd8c7f29b7cc6d1ac7dc0d8813bb6ac2883d80bed00f403d35a2b5e2504e136f359c6c0ff179ec4d578804ee75371c5f6cd39f5ae93ddf6393532adebda92

Download Submit
C:\Windows\System\gbvNnBb.exe

Filesize
1.1MB

MD5
6192cb96ee30590a960f16b2b36fbb35

SHA1
988087ffc07a728d575dc1bd9502feed6ab6f84b

SHA256
4af84ab4959865dc8ca9d5404f5580c9780c3a503ee660e9651a71f092f64da0

SHA512
cc142cd6048f8026f48a6fa8b4808a62a9e2b8b9828d940baebeaee0536c11fd3fc6d6811d62190adcba649fdc9795226b293d1eb384a47d814702e6f2a52db5

Download Submit
C:\Windows\System\hcjyzJd.exe

Filesize
1.1MB

MD5
60f62b57ca6308c24d457e354667b0a8

SHA1
e8c5abebe2651c0f236df42609dd6917ef66663b

SHA256
a0195f067da050ff998dd063a67d82e5d6cbebba11175682b11c758fc07c6f2a

SHA512
330f1a09874fd23bb4615826abd668c2559c5eb14352ad2d7464024863ed4ff77375dbbd75ce6803fea6a5e411acc6bd86013af6c431f23728fb17de3a1a7c2a

Download Submit
C:\Windows\System\iBYezsM.exe

Filesize
1.1MB

MD5
f60baf8eb5326babac2c104d44367c41

SHA1
898c50e0051333d531d5e983c8c97679f8d2ae8e

SHA256
70ec91ad11a9b259a372d7835778c381635de4e13ba090ee5d152e94eba239c8

SHA512
8b41ad22418a78473d73b156e657e5ae0b3168c4e03e3495d3e9f3ee4d2401b65d04e401dadb3ebb82ce1cae173e357f9644b97bda263777c750fc4aca995cd0

Download Submit
C:\Windows\System\kDHmAmd.exe

Filesize
1.1MB

MD5
2cd016ce47156c8169ead78ceebef07c

SHA1
3c074938b3210639368e2193c595b0f57cd3368a

SHA256
72250629df75b7d51711e73bf0a2f9196ec46f33f32ef0f7adcdf7aefb54d08f

SHA512
099557e64cd964c221068fac6e1a95167b4987e13d2e726569fdb01437c1fa8e028cf9bf3d8cb8f9617b9b670a107cee38ed32f03f4ef2e83e360ef7d0ada10b

Download Submit
C:\Windows\System\kRyEgCT.exe

Filesize
1.1MB

MD5
620d2c6547a773226c2ee25a53413d2a

SHA1
612a5997d171cce212d56bb38b21c2d174361e3f

SHA256
404811281dcb1563a75f7ed784ade2b06a97ba402618a452a7019177a8f22b81

SHA512
e1667d26f827e26c24de7e69554791f24c0100700878a87aaf14ac0c5a50fd564614ed931a7740db8a29eb002446ac9c2730c9748b3de5b0250747b9da578a54

Download Submit
C:\Windows\System\kfOZNvu.exe

Filesize
1.1MB

MD5
3f6ecae61017a1a7173007ec9de080c1

SHA1
19e96d9812e59a06cc7fa5e2a13cc57c3c016421

SHA256
fe9eba8dd32fa8299b20fc2ecec1b903afa2a6461dedfbff0123d51b810474ed

SHA512
f72ac1694761db24db970050de287ed8fe7483f18986b5e052d9e9bf33d62819a658088d197bddd4c33805eabc25c3d25f48e1b2bee7ed378ab09e5314d36ff7

Download Submit
C:\Windows\System\konGMcB.exe

Filesize
1.1MB

MD5
045d623e1e90727718373b2a5bbe40f2

SHA1
36118a774b82d891492958525e5e2ebfb935df6d

SHA256
674cdc6dbfc4733f8314d6037833089cfedb3320b68e4b8f0b63bf17e670cffb

SHA512
e0ea4c7cff274b4fbbabba5c73b36dbe2d4c960302da584c40e89f9ea8176fdd88b21b190a55054c505ff3cc4d8a93abc85f4306c97d9b86934666cac12357bf

Download Submit
C:\Windows\System\mMZYBIv.exe

Filesize
1.1MB

MD5
7c01be9e9dcf439821e6a42756411174

SHA1
4d4d30f18c44ea79903626e0989c04fcc9dc5b9e

SHA256
58d440d3063b3010e9068e312f54685835cb8a88d4fb4e08e57ce5b15ec16643

SHA512
f338564c8857418f5d424b3eddf065dc5c9ee5e2d7145f472961c46f962b61ce20605402a5059bd459a9ce02c3d1d3c218c32978e15a8e06e9b0637c853d8e0f

Download Submit
C:\Windows\System\qUUOnoJ.exe

Filesize
1.1MB

MD5
4c1760f629831b1eee42566cb5451f35

SHA1
b506a75f990e857be37ab1c6bc36b6c7e0bb5173

SHA256
52a05c699e5811f829ed806b130211ece1b7106f68acc9483ed40d3f5ae5924f

SHA512
ee5cde2839c07c917d1fe8408881a380a46e90f8b9e0673539b1aba659fdd2312d34abc8737713e3d7f49e9a061bb1d77074f054f9c52401aaafd82c14c81466

Download Submit
C:\Windows\System\qZPRmke.exe

Filesize
1.1MB

MD5
86e2774e35a1d8dfb8cf8590ea200822

SHA1
bb560a641430a9976814a149fea53188e82c290a

SHA256
e490217a341b93e80f52e0b462ad945ab2da266b71436d997e9c8133a8d336ae

SHA512
7b25a214d0d23926120a354019c0257688440a2546259655e459732e8e460580869c610013ecd0e8ccba489a3bd255d1824339fb6c4d06527b4d53775b343745

Download Submit
C:\Windows\System\vjYVGui.exe

Filesize
1.1MB

MD5
9b1a34dfbac67f4287e2cf5995c3aa3e

SHA1
fa22507c72b7bb4954a5ba7621c9646c8788e6ef

SHA256
a1f24c6c03734478e3ff41fbf26618d7899c814e922407e60928ba9a6bcbcda5

SHA512
5c3ed6f18216544ab8c85d56c1565042c0e52aad20239a840e2509abd9975edbbbf4913189cae42512546efebf9ad14367adeb363cd409068cc156ee902f703f

Download Submit
C:\Windows\System\xDGlRdA.exe

Filesize
1.1MB

MD5
aafe30ee361098147714d83a5a6037b8

SHA1
f1491aed4738b69c7327c13f1887a73f728e44de

SHA256
51483ccd46e91d484d103143c717746c02b82834d62c88c44ef8af36dbf63e6f

SHA512
b26781adeb889234471a2de9dfe8a290e440ea3e1cc1873dc32e1fc468cbcbb43c1a632b5ce6dd131104d29664d5a29fb29f1fa3e1f2fdf0cd4c7c490becd059

Download Submit
C:\Windows\System\zWsjdoa.exe

Filesize
1.1MB

MD5
c868e0802e236bdf24203ef012358705

SHA1
20494a38407c7f41f54e2e54644a03289fe6c2b5

SHA256
537a38db27969950dafd0f5b5a9bda71f7d87a39764e9a33e6dd117a4394094e

SHA512
56aa3d5e3b25957930237730ce3b682c550cf5fb45f4f44cf85bc32483c7708ab03817cb27ac094b983edbe9269607bcba96bbc6767ab990a7f49fc14da77ce3

Download Submit
memory/4684-0-0x00000277573A0000-0x00000277573B0000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads