xmrig | bd1423b28a1912b1006157e48181a42b3049ec93b4d72da0af6a1594f3f792f7

Analysis

max time kernel
122s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
24-12-2024 01:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bd1423b28a1912b1006157e48181a42b3049ec93b4d72da0af6a1594f3f792f7.exe
Size

1.8MB
MD5

6d160e8c1c72a54e14ae6b7ea4cab82f
SHA1

ad90ca53b45288fcbadb92cf46cec6a434a11db0
SHA256

bd1423b28a1912b1006157e48181a42b3049ec93b4d72da0af6a1594f3f792f7
SHA512

4d8984bf598eb3ecf442d17064e07b05d7f7b4b43e94295e26f913638f4108c562310f1b6ff8aa838ca922c0cae0385c3e0ab15c59de115b6c95594fb7bc46ee
SSDEEP

49152:GezaTF8FcNkNdfE0pZ9ozttwIRRR/1fGkv+ihn8:GemTLkNdfE0pZyM

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 34 IoCs

miner

resource	yara_rule
behavioral2/files/0x0008000000023cba-4.dat	xmrig
behavioral2/files/0x0007000000023cbf-8.dat	xmrig
behavioral2/files/0x0007000000023cbe-13.dat	xmrig
behavioral2/files/0x0007000000023cc0-26.dat	xmrig
behavioral2/files/0x0007000000023cc2-25.dat	xmrig
behavioral2/files/0x0007000000023cc1-36.dat	xmrig
behavioral2/files/0x0007000000023cc6-47.dat	xmrig
behavioral2/files/0x0007000000023cc7-55.dat	xmrig
behavioral2/files/0x0007000000023ccc-70.dat	xmrig
behavioral2/files/0x0007000000023cca-82.dat	xmrig
behavioral2/files/0x0007000000023cd3-106.dat	xmrig
behavioral2/files/0x0007000000023cd5-125.dat	xmrig
behavioral2/files/0x0007000000023cd4-123.dat	xmrig
behavioral2/files/0x0007000000023cd2-119.dat	xmrig
behavioral2/files/0x0007000000023cd1-117.dat	xmrig
behavioral2/files/0x0007000000023cd0-115.dat	xmrig
behavioral2/files/0x0007000000023ccf-113.dat	xmrig
behavioral2/files/0x0007000000023cce-111.dat	xmrig
behavioral2/files/0x0007000000023ccd-100.dat	xmrig
behavioral2/files/0x0007000000023ccb-92.dat	xmrig
behavioral2/files/0x0007000000023cc8-76.dat	xmrig
behavioral2/files/0x0007000000023cc9-71.dat	xmrig
behavioral2/files/0x0007000000023cc5-48.dat	xmrig
behavioral2/files/0x0007000000023cc4-40.dat	xmrig
behavioral2/files/0x0007000000023cc3-38.dat	xmrig
behavioral2/files/0x0007000000023cd6-133.dat	xmrig
behavioral2/files/0x0007000000023cd9-138.dat	xmrig
behavioral2/files/0x0007000000023cda-143.dat	xmrig
behavioral2/files/0x0007000000023cd8-146.dat	xmrig
behavioral2/files/0x0008000000023cbb-137.dat	xmrig
behavioral2/files/0x0007000000023cdd-164.dat	xmrig
behavioral2/files/0x0007000000023cde-167.dat	xmrig
behavioral2/files/0x0007000000023cdc-161.dat	xmrig
behavioral2/files/0x0007000000023cdb-154.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
4784	eUHWRqP.exe
4864	HXXJvXe.exe
2816	ccNAFzW.exe
1028	JPCmjLx.exe
2016	xCmzsLY.exe
4832	vwYczsZ.exe
3200	keueDYm.exe
1744	nCMghDS.exe
2080	DPdkmhi.exe
3880	OkRTzmr.exe
3752	QEgWuDz.exe
3652	VCTLIye.exe
1420	EGHEMtb.exe
2316	CKWGHVt.exe
2564	MOhdorA.exe
952	FqDSInv.exe
2424	pJfmnAS.exe
4712	gGPxabz.exe
3968	mNNDpBr.exe
3276	fSwhQRW.exe
3584	RuzEmcN.exe
2008	vJtZQIG.exe
1080	IfIYQBx.exe
3532	QkzGmRw.exe
1296	xXsLRdk.exe
2432	EoAOSzo.exe
2404	jRMzMqL.exe
1780	ZhsITMs.exe
3580	KxZOoGT.exe
4076	SmdueXE.exe
232	IkZaGlE.exe
2956	jYjybTt.exe
4780	rJSmdoo.exe
2368	hSaiFJa.exe
3292	bjqDQxt.exe
2940	fMFtMcY.exe
392	WxNnENK.exe
2392	NfkXsMV.exe
3980	CYkjEOv.exe
1160	jEOMyWH.exe
1996	hEjIPBS.exe
3216	pMnCIQt.exe
3272	dnzKUzu.exe
1628	OdnujeE.exe
2576	paDKJyQ.exe
3244	wDwbZIT.exe
3212	uusHodq.exe
508	vtsEMOe.exe
2312	MCuWVBc.exe
3284	QMwkOJQ.exe
960	tFHSwtM.exe
4428	bdirHhE.exe
2252	HDUBTuv.exe
1000	NDfwjBH.exe
1444	kLrbYkR.exe
1168	dlLqURD.exe
2164	ERQsGLQ.exe
4308	rHFOOiD.exe
4420	kzIxVgk.exe
3288	zxKUWPF.exe
2452	NGipnIb.exe
5004	ktspQNY.exe
2236	mbRmwwp.exe
3304	jxOxmHs.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\uMlbXSR.exe	bd1423b28a1912b1006157e48181a42b3049ec93b4d72da0af6a1594f3f792f7.exe
File created	C:\Windows\System\ynUUZwU.exe	bd1423b28a1912b1006157e48181a42b3049ec93b4d72da0af6a1594f3f792f7.exe
File created	C:\Windows\System\GVpkwhr.exe	bd1423b28a1912b1006157e48181a42b3049ec93b4d72da0af6a1594f3f792f7.exe
File created	C:\Windows\System\DCeTVZb.exe	bd1423b28a1912b1006157e48181a42b3049ec93b4d72da0af6a1594f3f792f7.exe
File created	C:\Windows\System\UxvQTfW.exe	bd1423b28a1912b1006157e48181a42b3049ec93b4d72da0af6a1594f3f792f7.exe
File created	C:\Windows\System\yAPAEGa.exe	bd1423b28a1912b1006157e48181a42b3049ec93b4d72da0af6a1594f3f792f7.exe
File created	C:\Windows\System\qLlFern.exe	bd1423b28a1912b1006157e48181a42b3049ec93b4d72da0af6a1594f3f792f7.exe
File created	C:\Windows\System\ZrEkipr.exe	bd1423b28a1912b1006157e48181a42b3049ec93b4d72da0af6a1594f3f792f7.exe
File created	C:\Windows\System\kuhzNkx.exe	bd1423b28a1912b1006157e48181a42b3049ec93b4d72da0af6a1594f3f792f7.exe
File created	C:\Windows\System\htDoTyx.exe	bd1423b28a1912b1006157e48181a42b3049ec93b4d72da0af6a1594f3f792f7.exe
File created	C:\Windows\System\TWquNph.exe	bd1423b28a1912b1006157e48181a42b3049ec93b4d72da0af6a1594f3f792f7.exe
File created	C:\Windows\System\lvmPjiK.exe	bd1423b28a1912b1006157e48181a42b3049ec93b4d72da0af6a1594f3f792f7.exe
File created	C:\Windows\System\GMnAAba.exe	bd1423b28a1912b1006157e48181a42b3049ec93b4d72da0af6a1594f3f792f7.exe
File created	C:\Windows\System\CColFEf.exe	bd1423b28a1912b1006157e48181a42b3049ec93b4d72da0af6a1594f3f792f7.exe
File created	C:\Windows\System\aZeKBoB.exe	bd1423b28a1912b1006157e48181a42b3049ec93b4d72da0af6a1594f3f792f7.exe
File created	C:\Windows\System\EGHEMtb.exe	bd1423b28a1912b1006157e48181a42b3049ec93b4d72da0af6a1594f3f792f7.exe
File created	C:\Windows\System\IvpTHuf.exe	bd1423b28a1912b1006157e48181a42b3049ec93b4d72da0af6a1594f3f792f7.exe
File created	C:\Windows\System\zSvflHt.exe	bd1423b28a1912b1006157e48181a42b3049ec93b4d72da0af6a1594f3f792f7.exe
File created	C:\Windows\System\UVpBcVF.exe	bd1423b28a1912b1006157e48181a42b3049ec93b4d72da0af6a1594f3f792f7.exe
File created	C:\Windows\System\HGGtxdG.exe	bd1423b28a1912b1006157e48181a42b3049ec93b4d72da0af6a1594f3f792f7.exe
File created	C:\Windows\System\QnhYIuM.exe	bd1423b28a1912b1006157e48181a42b3049ec93b4d72da0af6a1594f3f792f7.exe
File created	C:\Windows\System\oVgMmRs.exe	bd1423b28a1912b1006157e48181a42b3049ec93b4d72da0af6a1594f3f792f7.exe
File created	C:\Windows\System\kVGzzDO.exe	bd1423b28a1912b1006157e48181a42b3049ec93b4d72da0af6a1594f3f792f7.exe
File created	C:\Windows\System\GiJufqO.exe	bd1423b28a1912b1006157e48181a42b3049ec93b4d72da0af6a1594f3f792f7.exe
File created	C:\Windows\System\yBEFDwt.exe	bd1423b28a1912b1006157e48181a42b3049ec93b4d72da0af6a1594f3f792f7.exe
File created	C:\Windows\System\AwgGUmT.exe	bd1423b28a1912b1006157e48181a42b3049ec93b4d72da0af6a1594f3f792f7.exe
File created	C:\Windows\System\WFOScSN.exe	bd1423b28a1912b1006157e48181a42b3049ec93b4d72da0af6a1594f3f792f7.exe
File created	C:\Windows\System\VaYsKRy.exe	bd1423b28a1912b1006157e48181a42b3049ec93b4d72da0af6a1594f3f792f7.exe
File created	C:\Windows\System\vWIYIRi.exe	bd1423b28a1912b1006157e48181a42b3049ec93b4d72da0af6a1594f3f792f7.exe
File created	C:\Windows\System\MCuWVBc.exe	bd1423b28a1912b1006157e48181a42b3049ec93b4d72da0af6a1594f3f792f7.exe
File created	C:\Windows\System\EmgbzGr.exe	bd1423b28a1912b1006157e48181a42b3049ec93b4d72da0af6a1594f3f792f7.exe
File created	C:\Windows\System\OrfdUAb.exe	bd1423b28a1912b1006157e48181a42b3049ec93b4d72da0af6a1594f3f792f7.exe
File created	C:\Windows\System\GKkbIBi.exe	bd1423b28a1912b1006157e48181a42b3049ec93b4d72da0af6a1594f3f792f7.exe
File created	C:\Windows\System\tIDJHWj.exe	bd1423b28a1912b1006157e48181a42b3049ec93b4d72da0af6a1594f3f792f7.exe
File created	C:\Windows\System\zrqwBrZ.exe	bd1423b28a1912b1006157e48181a42b3049ec93b4d72da0af6a1594f3f792f7.exe
File created	C:\Windows\System\xsdEdgg.exe	bd1423b28a1912b1006157e48181a42b3049ec93b4d72da0af6a1594f3f792f7.exe
File created	C:\Windows\System\SxZcvFD.exe	bd1423b28a1912b1006157e48181a42b3049ec93b4d72da0af6a1594f3f792f7.exe
File created	C:\Windows\System\lpIrBlc.exe	bd1423b28a1912b1006157e48181a42b3049ec93b4d72da0af6a1594f3f792f7.exe
File created	C:\Windows\System\mJjuRyI.exe	bd1423b28a1912b1006157e48181a42b3049ec93b4d72da0af6a1594f3f792f7.exe
File created	C:\Windows\System\wQyeLxY.exe	bd1423b28a1912b1006157e48181a42b3049ec93b4d72da0af6a1594f3f792f7.exe
File created	C:\Windows\System\mcBEkZj.exe	bd1423b28a1912b1006157e48181a42b3049ec93b4d72da0af6a1594f3f792f7.exe
File created	C:\Windows\System\nTSFvCL.exe	bd1423b28a1912b1006157e48181a42b3049ec93b4d72da0af6a1594f3f792f7.exe
File created	C:\Windows\System\CIUXTDX.exe	bd1423b28a1912b1006157e48181a42b3049ec93b4d72da0af6a1594f3f792f7.exe
File created	C:\Windows\System\tVdxNGX.exe	bd1423b28a1912b1006157e48181a42b3049ec93b4d72da0af6a1594f3f792f7.exe
File created	C:\Windows\System\oRIzjob.exe	bd1423b28a1912b1006157e48181a42b3049ec93b4d72da0af6a1594f3f792f7.exe
File created	C:\Windows\System\onvxVIU.exe	bd1423b28a1912b1006157e48181a42b3049ec93b4d72da0af6a1594f3f792f7.exe
File created	C:\Windows\System\bSOpplv.exe	bd1423b28a1912b1006157e48181a42b3049ec93b4d72da0af6a1594f3f792f7.exe
File created	C:\Windows\System\aUaErTf.exe	bd1423b28a1912b1006157e48181a42b3049ec93b4d72da0af6a1594f3f792f7.exe
File created	C:\Windows\System\xbseHbx.exe	bd1423b28a1912b1006157e48181a42b3049ec93b4d72da0af6a1594f3f792f7.exe
File created	C:\Windows\System\GdZMxYd.exe	bd1423b28a1912b1006157e48181a42b3049ec93b4d72da0af6a1594f3f792f7.exe
File created	C:\Windows\System\vTifELL.exe	bd1423b28a1912b1006157e48181a42b3049ec93b4d72da0af6a1594f3f792f7.exe
File created	C:\Windows\System\xEcANcY.exe	bd1423b28a1912b1006157e48181a42b3049ec93b4d72da0af6a1594f3f792f7.exe
File created	C:\Windows\System\NykUcof.exe	bd1423b28a1912b1006157e48181a42b3049ec93b4d72da0af6a1594f3f792f7.exe
File created	C:\Windows\System\vJtZQIG.exe	bd1423b28a1912b1006157e48181a42b3049ec93b4d72da0af6a1594f3f792f7.exe
File created	C:\Windows\System\gZmyRSy.exe	bd1423b28a1912b1006157e48181a42b3049ec93b4d72da0af6a1594f3f792f7.exe
File created	C:\Windows\System\KUFTLGp.exe	bd1423b28a1912b1006157e48181a42b3049ec93b4d72da0af6a1594f3f792f7.exe
File created	C:\Windows\System\YaxQrJG.exe	bd1423b28a1912b1006157e48181a42b3049ec93b4d72da0af6a1594f3f792f7.exe
File created	C:\Windows\System\MNOhviA.exe	bd1423b28a1912b1006157e48181a42b3049ec93b4d72da0af6a1594f3f792f7.exe
File created	C:\Windows\System\wlEMiRh.exe	bd1423b28a1912b1006157e48181a42b3049ec93b4d72da0af6a1594f3f792f7.exe
File created	C:\Windows\System\MqoQxjJ.exe	bd1423b28a1912b1006157e48181a42b3049ec93b4d72da0af6a1594f3f792f7.exe
File created	C:\Windows\System\COVcrzS.exe	bd1423b28a1912b1006157e48181a42b3049ec93b4d72da0af6a1594f3f792f7.exe
File created	C:\Windows\System\MhHKVCs.exe	bd1423b28a1912b1006157e48181a42b3049ec93b4d72da0af6a1594f3f792f7.exe
File created	C:\Windows\System\nmmfBjt.exe	bd1423b28a1912b1006157e48181a42b3049ec93b4d72da0af6a1594f3f792f7.exe
File created	C:\Windows\System\rHFOOiD.exe	bd1423b28a1912b1006157e48181a42b3049ec93b4d72da0af6a1594f3f792f7.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	17340	dwm.exe
Token: SeChangeNotifyPrivilege	17340	dwm.exe
Token: 33	17340	dwm.exe
Token: SeIncBasePriorityPrivilege	17340	dwm.exe
Token: SeShutdownPrivilege	17340	dwm.exe
Token: SeCreatePagefilePrivilege	17340	dwm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3796 wrote to memory of 4784	3796	bd1423b28a1912b1006157e48181a42b3049ec93b4d72da0af6a1594f3f792f7.exe	84
PID 3796 wrote to memory of 4784	3796	bd1423b28a1912b1006157e48181a42b3049ec93b4d72da0af6a1594f3f792f7.exe	84
PID 3796 wrote to memory of 4864	3796	bd1423b28a1912b1006157e48181a42b3049ec93b4d72da0af6a1594f3f792f7.exe	85
PID 3796 wrote to memory of 4864	3796	bd1423b28a1912b1006157e48181a42b3049ec93b4d72da0af6a1594f3f792f7.exe	85
PID 3796 wrote to memory of 2816	3796	bd1423b28a1912b1006157e48181a42b3049ec93b4d72da0af6a1594f3f792f7.exe	86
PID 3796 wrote to memory of 2816	3796	bd1423b28a1912b1006157e48181a42b3049ec93b4d72da0af6a1594f3f792f7.exe	86
PID 3796 wrote to memory of 1028	3796	bd1423b28a1912b1006157e48181a42b3049ec93b4d72da0af6a1594f3f792f7.exe	87
PID 3796 wrote to memory of 1028	3796	bd1423b28a1912b1006157e48181a42b3049ec93b4d72da0af6a1594f3f792f7.exe	87
PID 3796 wrote to memory of 2016	3796	bd1423b28a1912b1006157e48181a42b3049ec93b4d72da0af6a1594f3f792f7.exe	88
PID 3796 wrote to memory of 2016	3796	bd1423b28a1912b1006157e48181a42b3049ec93b4d72da0af6a1594f3f792f7.exe	88
PID 3796 wrote to memory of 4832	3796	bd1423b28a1912b1006157e48181a42b3049ec93b4d72da0af6a1594f3f792f7.exe	89
PID 3796 wrote to memory of 4832	3796	bd1423b28a1912b1006157e48181a42b3049ec93b4d72da0af6a1594f3f792f7.exe	89
PID 3796 wrote to memory of 3200	3796	bd1423b28a1912b1006157e48181a42b3049ec93b4d72da0af6a1594f3f792f7.exe	90
PID 3796 wrote to memory of 3200	3796	bd1423b28a1912b1006157e48181a42b3049ec93b4d72da0af6a1594f3f792f7.exe	90
PID 3796 wrote to memory of 1744	3796	bd1423b28a1912b1006157e48181a42b3049ec93b4d72da0af6a1594f3f792f7.exe	91
PID 3796 wrote to memory of 1744	3796	bd1423b28a1912b1006157e48181a42b3049ec93b4d72da0af6a1594f3f792f7.exe	91
PID 3796 wrote to memory of 2080	3796	bd1423b28a1912b1006157e48181a42b3049ec93b4d72da0af6a1594f3f792f7.exe	92
PID 3796 wrote to memory of 2080	3796	bd1423b28a1912b1006157e48181a42b3049ec93b4d72da0af6a1594f3f792f7.exe	92
PID 3796 wrote to memory of 3880	3796	bd1423b28a1912b1006157e48181a42b3049ec93b4d72da0af6a1594f3f792f7.exe	93
PID 3796 wrote to memory of 3880	3796	bd1423b28a1912b1006157e48181a42b3049ec93b4d72da0af6a1594f3f792f7.exe	93
PID 3796 wrote to memory of 3752	3796	bd1423b28a1912b1006157e48181a42b3049ec93b4d72da0af6a1594f3f792f7.exe	94
PID 3796 wrote to memory of 3752	3796	bd1423b28a1912b1006157e48181a42b3049ec93b4d72da0af6a1594f3f792f7.exe	94
PID 3796 wrote to memory of 3652	3796	bd1423b28a1912b1006157e48181a42b3049ec93b4d72da0af6a1594f3f792f7.exe	95
PID 3796 wrote to memory of 3652	3796	bd1423b28a1912b1006157e48181a42b3049ec93b4d72da0af6a1594f3f792f7.exe	95
PID 3796 wrote to memory of 1420	3796	bd1423b28a1912b1006157e48181a42b3049ec93b4d72da0af6a1594f3f792f7.exe	96
PID 3796 wrote to memory of 1420	3796	bd1423b28a1912b1006157e48181a42b3049ec93b4d72da0af6a1594f3f792f7.exe	96
PID 3796 wrote to memory of 2316	3796	bd1423b28a1912b1006157e48181a42b3049ec93b4d72da0af6a1594f3f792f7.exe	97
PID 3796 wrote to memory of 2316	3796	bd1423b28a1912b1006157e48181a42b3049ec93b4d72da0af6a1594f3f792f7.exe	97
PID 3796 wrote to memory of 2564	3796	bd1423b28a1912b1006157e48181a42b3049ec93b4d72da0af6a1594f3f792f7.exe	98
PID 3796 wrote to memory of 2564	3796	bd1423b28a1912b1006157e48181a42b3049ec93b4d72da0af6a1594f3f792f7.exe	98
PID 3796 wrote to memory of 952	3796	bd1423b28a1912b1006157e48181a42b3049ec93b4d72da0af6a1594f3f792f7.exe	99
PID 3796 wrote to memory of 952	3796	bd1423b28a1912b1006157e48181a42b3049ec93b4d72da0af6a1594f3f792f7.exe	99
PID 3796 wrote to memory of 2424	3796	bd1423b28a1912b1006157e48181a42b3049ec93b4d72da0af6a1594f3f792f7.exe	100
PID 3796 wrote to memory of 2424	3796	bd1423b28a1912b1006157e48181a42b3049ec93b4d72da0af6a1594f3f792f7.exe	100
PID 3796 wrote to memory of 4712	3796	bd1423b28a1912b1006157e48181a42b3049ec93b4d72da0af6a1594f3f792f7.exe	101
PID 3796 wrote to memory of 4712	3796	bd1423b28a1912b1006157e48181a42b3049ec93b4d72da0af6a1594f3f792f7.exe	101
PID 3796 wrote to memory of 3968	3796	bd1423b28a1912b1006157e48181a42b3049ec93b4d72da0af6a1594f3f792f7.exe	102
PID 3796 wrote to memory of 3968	3796	bd1423b28a1912b1006157e48181a42b3049ec93b4d72da0af6a1594f3f792f7.exe	102
PID 3796 wrote to memory of 3276	3796	bd1423b28a1912b1006157e48181a42b3049ec93b4d72da0af6a1594f3f792f7.exe	103
PID 3796 wrote to memory of 3276	3796	bd1423b28a1912b1006157e48181a42b3049ec93b4d72da0af6a1594f3f792f7.exe	103
PID 3796 wrote to memory of 3584	3796	bd1423b28a1912b1006157e48181a42b3049ec93b4d72da0af6a1594f3f792f7.exe	104
PID 3796 wrote to memory of 3584	3796	bd1423b28a1912b1006157e48181a42b3049ec93b4d72da0af6a1594f3f792f7.exe	104
PID 3796 wrote to memory of 2008	3796	bd1423b28a1912b1006157e48181a42b3049ec93b4d72da0af6a1594f3f792f7.exe	105
PID 3796 wrote to memory of 2008	3796	bd1423b28a1912b1006157e48181a42b3049ec93b4d72da0af6a1594f3f792f7.exe	105
PID 3796 wrote to memory of 1080	3796	bd1423b28a1912b1006157e48181a42b3049ec93b4d72da0af6a1594f3f792f7.exe	106
PID 3796 wrote to memory of 1080	3796	bd1423b28a1912b1006157e48181a42b3049ec93b4d72da0af6a1594f3f792f7.exe	106
PID 3796 wrote to memory of 3532	3796	bd1423b28a1912b1006157e48181a42b3049ec93b4d72da0af6a1594f3f792f7.exe	107
PID 3796 wrote to memory of 3532	3796	bd1423b28a1912b1006157e48181a42b3049ec93b4d72da0af6a1594f3f792f7.exe	107
PID 3796 wrote to memory of 1296	3796	bd1423b28a1912b1006157e48181a42b3049ec93b4d72da0af6a1594f3f792f7.exe	108
PID 3796 wrote to memory of 1296	3796	bd1423b28a1912b1006157e48181a42b3049ec93b4d72da0af6a1594f3f792f7.exe	108
PID 3796 wrote to memory of 2432	3796	bd1423b28a1912b1006157e48181a42b3049ec93b4d72da0af6a1594f3f792f7.exe	109
PID 3796 wrote to memory of 2432	3796	bd1423b28a1912b1006157e48181a42b3049ec93b4d72da0af6a1594f3f792f7.exe	109
PID 3796 wrote to memory of 2404	3796	bd1423b28a1912b1006157e48181a42b3049ec93b4d72da0af6a1594f3f792f7.exe	110
PID 3796 wrote to memory of 2404	3796	bd1423b28a1912b1006157e48181a42b3049ec93b4d72da0af6a1594f3f792f7.exe	110
PID 3796 wrote to memory of 1780	3796	bd1423b28a1912b1006157e48181a42b3049ec93b4d72da0af6a1594f3f792f7.exe	111
PID 3796 wrote to memory of 1780	3796	bd1423b28a1912b1006157e48181a42b3049ec93b4d72da0af6a1594f3f792f7.exe	111
PID 3796 wrote to memory of 3580	3796	bd1423b28a1912b1006157e48181a42b3049ec93b4d72da0af6a1594f3f792f7.exe	112
PID 3796 wrote to memory of 3580	3796	bd1423b28a1912b1006157e48181a42b3049ec93b4d72da0af6a1594f3f792f7.exe	112
PID 3796 wrote to memory of 4076	3796	bd1423b28a1912b1006157e48181a42b3049ec93b4d72da0af6a1594f3f792f7.exe	113
PID 3796 wrote to memory of 4076	3796	bd1423b28a1912b1006157e48181a42b3049ec93b4d72da0af6a1594f3f792f7.exe	113
PID 3796 wrote to memory of 232	3796	bd1423b28a1912b1006157e48181a42b3049ec93b4d72da0af6a1594f3f792f7.exe	114
PID 3796 wrote to memory of 232	3796	bd1423b28a1912b1006157e48181a42b3049ec93b4d72da0af6a1594f3f792f7.exe	114
PID 3796 wrote to memory of 2956	3796	bd1423b28a1912b1006157e48181a42b3049ec93b4d72da0af6a1594f3f792f7.exe	115
PID 3796 wrote to memory of 2956	3796	bd1423b28a1912b1006157e48181a42b3049ec93b4d72da0af6a1594f3f792f7.exe	115

C:\Users\Admin\AppData\Local\Temp\bd1423b28a1912b1006157e48181a42b3049ec93b4d72da0af6a1594f3f792f7.exe
"C:\Users\Admin\AppData\Local\Temp\bd1423b28a1912b1006157e48181a42b3049ec93b4d72da0af6a1594f3f792f7.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3796
- C:\Windows\System\eUHWRqP.exe
  C:\Windows\System\eUHWRqP.exe
  2⤵
  - Executes dropped EXE
  PID:4784
- C:\Windows\System\HXXJvXe.exe
  C:\Windows\System\HXXJvXe.exe
  2⤵
  - Executes dropped EXE
  PID:4864
- C:\Windows\System\ccNAFzW.exe
  C:\Windows\System\ccNAFzW.exe
  2⤵
  - Executes dropped EXE
  PID:2816
- C:\Windows\System\JPCmjLx.exe
  C:\Windows\System\JPCmjLx.exe
  2⤵
  - Executes dropped EXE
  PID:1028
- C:\Windows\System\xCmzsLY.exe
  C:\Windows\System\xCmzsLY.exe
  2⤵
  - Executes dropped EXE
  PID:2016
- C:\Windows\System\vwYczsZ.exe
  C:\Windows\System\vwYczsZ.exe
  2⤵
  - Executes dropped EXE
  PID:4832
- C:\Windows\System\keueDYm.exe
  C:\Windows\System\keueDYm.exe
  2⤵
  - Executes dropped EXE
  PID:3200
- C:\Windows\System\nCMghDS.exe
  C:\Windows\System\nCMghDS.exe
  2⤵
  - Executes dropped EXE
  PID:1744
- C:\Windows\System\DPdkmhi.exe
  C:\Windows\System\DPdkmhi.exe
  2⤵
  - Executes dropped EXE
  PID:2080
- C:\Windows\System\OkRTzmr.exe
  C:\Windows\System\OkRTzmr.exe
  2⤵
  - Executes dropped EXE
  PID:3880
- C:\Windows\System\QEgWuDz.exe
  C:\Windows\System\QEgWuDz.exe
  2⤵
  - Executes dropped EXE
  PID:3752
- C:\Windows\System\VCTLIye.exe
  C:\Windows\System\VCTLIye.exe
  2⤵
  - Executes dropped EXE
  PID:3652
- C:\Windows\System\EGHEMtb.exe
  C:\Windows\System\EGHEMtb.exe
  2⤵
  - Executes dropped EXE
  PID:1420
- C:\Windows\System\CKWGHVt.exe
  C:\Windows\System\CKWGHVt.exe
  2⤵
  - Executes dropped EXE
  PID:2316
- C:\Windows\System\MOhdorA.exe
  C:\Windows\System\MOhdorA.exe
  2⤵
  - Executes dropped EXE
  PID:2564
- C:\Windows\System\FqDSInv.exe
  C:\Windows\System\FqDSInv.exe
  2⤵
  - Executes dropped EXE
  PID:952
- C:\Windows\System\pJfmnAS.exe
  C:\Windows\System\pJfmnAS.exe
  2⤵
  - Executes dropped EXE
  PID:2424
- C:\Windows\System\gGPxabz.exe
  C:\Windows\System\gGPxabz.exe
  2⤵
  - Executes dropped EXE
  PID:4712
- C:\Windows\System\mNNDpBr.exe
  C:\Windows\System\mNNDpBr.exe
  2⤵
  - Executes dropped EXE
  PID:3968
- C:\Windows\System\fSwhQRW.exe
  C:\Windows\System\fSwhQRW.exe
  2⤵
  - Executes dropped EXE
  PID:3276
- C:\Windows\System\RuzEmcN.exe
  C:\Windows\System\RuzEmcN.exe
  2⤵
  - Executes dropped EXE
  PID:3584
- C:\Windows\System\vJtZQIG.exe
  C:\Windows\System\vJtZQIG.exe
  2⤵
  - Executes dropped EXE
  PID:2008
- C:\Windows\System\IfIYQBx.exe
  C:\Windows\System\IfIYQBx.exe
  2⤵
  - Executes dropped EXE
  PID:1080
- C:\Windows\System\QkzGmRw.exe
  C:\Windows\System\QkzGmRw.exe
  2⤵
  - Executes dropped EXE
  PID:3532
- C:\Windows\System\xXsLRdk.exe
  C:\Windows\System\xXsLRdk.exe
  2⤵
  - Executes dropped EXE
  PID:1296
- C:\Windows\System\EoAOSzo.exe
  C:\Windows\System\EoAOSzo.exe
  2⤵
  - Executes dropped EXE
  PID:2432
- C:\Windows\System\jRMzMqL.exe
  C:\Windows\System\jRMzMqL.exe
  2⤵
  - Executes dropped EXE
  PID:2404
- C:\Windows\System\ZhsITMs.exe
  C:\Windows\System\ZhsITMs.exe
  2⤵
  - Executes dropped EXE
  PID:1780
- C:\Windows\System\KxZOoGT.exe
  C:\Windows\System\KxZOoGT.exe
  2⤵
  - Executes dropped EXE
  PID:3580
- C:\Windows\System\SmdueXE.exe
  C:\Windows\System\SmdueXE.exe
  2⤵
  - Executes dropped EXE
  PID:4076
- C:\Windows\System\IkZaGlE.exe
  C:\Windows\System\IkZaGlE.exe
  2⤵
  - Executes dropped EXE
  PID:232
- C:\Windows\System\jYjybTt.exe
  C:\Windows\System\jYjybTt.exe
  2⤵
  - Executes dropped EXE
  PID:2956
- C:\Windows\System\rJSmdoo.exe
  C:\Windows\System\rJSmdoo.exe
  2⤵
  - Executes dropped EXE
  PID:4780
- C:\Windows\System\hSaiFJa.exe
  C:\Windows\System\hSaiFJa.exe
  2⤵
  - Executes dropped EXE
  PID:2368
- C:\Windows\System\bjqDQxt.exe
  C:\Windows\System\bjqDQxt.exe
  2⤵
  - Executes dropped EXE
  PID:3292
- C:\Windows\System\fMFtMcY.exe
  C:\Windows\System\fMFtMcY.exe
  2⤵
  - Executes dropped EXE
  PID:2940
- C:\Windows\System\WxNnENK.exe
  C:\Windows\System\WxNnENK.exe
  2⤵
  - Executes dropped EXE
  PID:392
- C:\Windows\System\NfkXsMV.exe
  C:\Windows\System\NfkXsMV.exe
  2⤵
  - Executes dropped EXE
  PID:2392
- C:\Windows\System\CYkjEOv.exe
  C:\Windows\System\CYkjEOv.exe
  2⤵
  - Executes dropped EXE
  PID:3980
- C:\Windows\System\jEOMyWH.exe
  C:\Windows\System\jEOMyWH.exe
  2⤵
  - Executes dropped EXE
  PID:1160
- C:\Windows\System\hEjIPBS.exe
  C:\Windows\System\hEjIPBS.exe
  2⤵
  - Executes dropped EXE
  PID:1996
- C:\Windows\System\pMnCIQt.exe
  C:\Windows\System\pMnCIQt.exe
  2⤵
  - Executes dropped EXE
  PID:3216
- C:\Windows\System\dnzKUzu.exe
  C:\Windows\System\dnzKUzu.exe
  2⤵
  - Executes dropped EXE
  PID:3272
- C:\Windows\System\OdnujeE.exe
  C:\Windows\System\OdnujeE.exe
  2⤵
  - Executes dropped EXE
  PID:1628
- C:\Windows\System\paDKJyQ.exe
  C:\Windows\System\paDKJyQ.exe
  2⤵
  - Executes dropped EXE
  PID:2576
- C:\Windows\System\wDwbZIT.exe
  C:\Windows\System\wDwbZIT.exe
  2⤵
  - Executes dropped EXE
  PID:3244
- C:\Windows\System\uusHodq.exe
  C:\Windows\System\uusHodq.exe
  2⤵
  - Executes dropped EXE
  PID:3212
- C:\Windows\System\vtsEMOe.exe
  C:\Windows\System\vtsEMOe.exe
  2⤵
  - Executes dropped EXE
  PID:508
- C:\Windows\System\MCuWVBc.exe
  C:\Windows\System\MCuWVBc.exe
  2⤵
  - Executes dropped EXE
  PID:2312
- C:\Windows\System\kLrbYkR.exe
  C:\Windows\System\kLrbYkR.exe
  2⤵
  - Executes dropped EXE
  PID:1444
- C:\Windows\System\QMwkOJQ.exe
  C:\Windows\System\QMwkOJQ.exe
  2⤵
  - Executes dropped EXE
  PID:3284
- C:\Windows\System\tFHSwtM.exe
  C:\Windows\System\tFHSwtM.exe
  2⤵
  - Executes dropped EXE
  PID:960
- C:\Windows\System\bdirHhE.exe
  C:\Windows\System\bdirHhE.exe
  2⤵
  - Executes dropped EXE
  PID:4428
- C:\Windows\System\HDUBTuv.exe
  C:\Windows\System\HDUBTuv.exe
  2⤵
  - Executes dropped EXE
  PID:2252
- C:\Windows\System\NDfwjBH.exe
  C:\Windows\System\NDfwjBH.exe
  2⤵
  - Executes dropped EXE
  PID:1000
- C:\Windows\System\dlLqURD.exe
  C:\Windows\System\dlLqURD.exe
  2⤵
  - Executes dropped EXE
  PID:1168
- C:\Windows\System\ERQsGLQ.exe
  C:\Windows\System\ERQsGLQ.exe
  2⤵
  - Executes dropped EXE
  PID:2164
- C:\Windows\System\rHFOOiD.exe
  C:\Windows\System\rHFOOiD.exe
  2⤵
  - Executes dropped EXE
  PID:4308
- C:\Windows\System\kzIxVgk.exe
  C:\Windows\System\kzIxVgk.exe
  2⤵
  - Executes dropped EXE
  PID:4420
- C:\Windows\System\zxKUWPF.exe
  C:\Windows\System\zxKUWPF.exe
  2⤵
  - Executes dropped EXE
  PID:3288
- C:\Windows\System\NGipnIb.exe
  C:\Windows\System\NGipnIb.exe
  2⤵
  - Executes dropped EXE
  PID:2452
- C:\Windows\System\jxOxmHs.exe
  C:\Windows\System\jxOxmHs.exe
  2⤵
  - Executes dropped EXE
  PID:3304
- C:\Windows\System\ktspQNY.exe
  C:\Windows\System\ktspQNY.exe
  2⤵
  - Executes dropped EXE
  PID:5004
- C:\Windows\System\mbRmwwp.exe
  C:\Windows\System\mbRmwwp.exe
  2⤵
  - Executes dropped EXE
  PID:2236
- C:\Windows\System\GbWZmMj.exe
  C:\Windows\System\GbWZmMj.exe
  2⤵
  PID:3488
- C:\Windows\System\pznCisM.exe
  C:\Windows\System\pznCisM.exe
  2⤵
  PID:5000
- C:\Windows\System\ntPUaZB.exe
  C:\Windows\System\ntPUaZB.exe
  2⤵
  PID:4564
- C:\Windows\System\EmgbzGr.exe
  C:\Windows\System\EmgbzGr.exe
  2⤵
  PID:4176
- C:\Windows\System\DiiArxB.exe
  C:\Windows\System\DiiArxB.exe
  2⤵
  PID:1472
- C:\Windows\System\EvMsSaX.exe
  C:\Windows\System\EvMsSaX.exe
  2⤵
  PID:3240
- C:\Windows\System\qaWohlm.exe
  C:\Windows\System\qaWohlm.exe
  2⤵
  PID:8
- C:\Windows\System\pmeRLxS.exe
  C:\Windows\System\pmeRLxS.exe
  2⤵
  PID:3916
- C:\Windows\System\SoDXOjy.exe
  C:\Windows\System\SoDXOjy.exe
  2⤵
  PID:2580
- C:\Windows\System\qvdFsBJ.exe
  C:\Windows\System\qvdFsBJ.exe
  2⤵
  PID:3268
- C:\Windows\System\ZKpFsFK.exe
  C:\Windows\System\ZKpFsFK.exe
  2⤵
  PID:1276
- C:\Windows\System\zZPzyfj.exe
  C:\Windows\System\zZPzyfj.exe
  2⤵
  PID:3724
- C:\Windows\System\IvpTHuf.exe
  C:\Windows\System\IvpTHuf.exe
  2⤵
  PID:2332
- C:\Windows\System\GqnGgmy.exe
  C:\Windows\System\GqnGgmy.exe
  2⤵
  PID:4244
- C:\Windows\System\oyZxvvS.exe
  C:\Windows\System\oyZxvvS.exe
  2⤵
  PID:2092
- C:\Windows\System\bWerhkK.exe
  C:\Windows\System\bWerhkK.exe
  2⤵
  PID:1068
- C:\Windows\System\AuvjGhu.exe
  C:\Windows\System\AuvjGhu.exe
  2⤵
  PID:3596
- C:\Windows\System\bkPCZOn.exe
  C:\Windows\System\bkPCZOn.exe
  2⤵
  PID:2136
- C:\Windows\System\NzZFHce.exe
  C:\Windows\System\NzZFHce.exe
  2⤵
  PID:2132
- C:\Windows\System\YaxQrJG.exe
  C:\Windows\System\YaxQrJG.exe
  2⤵
  PID:208
- C:\Windows\System\IbeBAUb.exe
  C:\Windows\System\IbeBAUb.exe
  2⤵
  PID:2692
- C:\Windows\System\nKlhMcJ.exe
  C:\Windows\System\nKlhMcJ.exe
  2⤵
  PID:972
- C:\Windows\System\SeHTIfS.exe
  C:\Windows\System\SeHTIfS.exe
  2⤵
  PID:3364
- C:\Windows\System\jbJmder.exe
  C:\Windows\System\jbJmder.exe
  2⤵
  PID:540
- C:\Windows\System\EbsHEWx.exe
  C:\Windows\System\EbsHEWx.exe
  2⤵
  PID:4980
- C:\Windows\System\HDxRgGK.exe
  C:\Windows\System\HDxRgGK.exe
  2⤵
  PID:1764
- C:\Windows\System\DPfPXsG.exe
  C:\Windows\System\DPfPXsG.exe
  2⤵
  PID:1104
- C:\Windows\System\sXqgjQS.exe
  C:\Windows\System\sXqgjQS.exe
  2⤵
  PID:464
- C:\Windows\System\vQwpPme.exe
  C:\Windows\System\vQwpPme.exe
  2⤵
  PID:3856
- C:\Windows\System\CtoClnm.exe
  C:\Windows\System\CtoClnm.exe
  2⤵
  PID:4164
- C:\Windows\System\zaPbSPi.exe
  C:\Windows\System\zaPbSPi.exe
  2⤵
  PID:3016
- C:\Windows\System\NqZVMBK.exe
  C:\Windows\System\NqZVMBK.exe
  2⤵
  PID:4592
- C:\Windows\System\rOGlMJN.exe
  C:\Windows\System\rOGlMJN.exe
  2⤵
  PID:3336
- C:\Windows\System\NJcZqGX.exe
  C:\Windows\System\NJcZqGX.exe
  2⤵
  PID:2060
- C:\Windows\System\cQOcXvz.exe
  C:\Windows\System\cQOcXvz.exe
  2⤵
  PID:3104
- C:\Windows\System\vOHnKil.exe
  C:\Windows\System\vOHnKil.exe
  2⤵
  PID:3720
- C:\Windows\System\QnhYIuM.exe
  C:\Windows\System\QnhYIuM.exe
  2⤵
  PID:2508
- C:\Windows\System\uAAMYJd.exe
  C:\Windows\System\uAAMYJd.exe
  2⤵
  PID:1548
- C:\Windows\System\zQLUudb.exe
  C:\Windows\System\zQLUudb.exe
  2⤵
  PID:4352
- C:\Windows\System\SceOTca.exe
  C:\Windows\System\SceOTca.exe
  2⤵
  PID:3952
- C:\Windows\System\nxQhnot.exe
  C:\Windows\System\nxQhnot.exe
  2⤵
  PID:2064
- C:\Windows\System\xxmEZqs.exe
  C:\Windows\System\xxmEZqs.exe
  2⤵
  PID:1088
- C:\Windows\System\qLlFern.exe
  C:\Windows\System\qLlFern.exe
  2⤵
  PID:2800
- C:\Windows\System\DwGkpwR.exe
  C:\Windows\System\DwGkpwR.exe
  2⤵
  PID:1484
- C:\Windows\System\COvrHcT.exe
  C:\Windows\System\COvrHcT.exe
  2⤵
  PID:2276
- C:\Windows\System\GTQNgDY.exe
  C:\Windows\System\GTQNgDY.exe
  2⤵
  PID:1116
- C:\Windows\System\ahZkUUS.exe
  C:\Windows\System\ahZkUUS.exe
  2⤵
  PID:1564
- C:\Windows\System\AmMZDcB.exe
  C:\Windows\System\AmMZDcB.exe
  2⤵
  PID:2356
- C:\Windows\System\ACvlWgl.exe
  C:\Windows\System\ACvlWgl.exe
  2⤵
  PID:3136
- C:\Windows\System\ZNxKGUw.exe
  C:\Windows\System\ZNxKGUw.exe
  2⤵
  PID:5128
- C:\Windows\System\URrrXgD.exe
  C:\Windows\System\URrrXgD.exe
  2⤵
  PID:5156
- C:\Windows\System\PuFqJwm.exe
  C:\Windows\System\PuFqJwm.exe
  2⤵
  PID:5188
- C:\Windows\System\CAazxQQ.exe
  C:\Windows\System\CAazxQQ.exe
  2⤵
  PID:5204
- C:\Windows\System\gLJCQqL.exe
  C:\Windows\System\gLJCQqL.exe
  2⤵
  PID:5236
- C:\Windows\System\urgVvPJ.exe
  C:\Windows\System\urgVvPJ.exe
  2⤵
  PID:5272
- C:\Windows\System\yQPZpyN.exe
  C:\Windows\System\yQPZpyN.exe
  2⤵
  PID:5300
- C:\Windows\System\mJjuRyI.exe
  C:\Windows\System\mJjuRyI.exe
  2⤵
  PID:5328
- C:\Windows\System\eYexgHa.exe
  C:\Windows\System\eYexgHa.exe
  2⤵
  PID:5348
- C:\Windows\System\gieEsEj.exe
  C:\Windows\System\gieEsEj.exe
  2⤵
  PID:5372
- C:\Windows\System\cLDDmcY.exe
  C:\Windows\System\cLDDmcY.exe
  2⤵
  PID:5400
- C:\Windows\System\MpqidRR.exe
  C:\Windows\System\MpqidRR.exe
  2⤵
  PID:5432
- C:\Windows\System\hItAkxy.exe
  C:\Windows\System\hItAkxy.exe
  2⤵
  PID:5464
- C:\Windows\System\vxHapaE.exe
  C:\Windows\System\vxHapaE.exe
  2⤵
  PID:5500
- C:\Windows\System\sezeGoj.exe
  C:\Windows\System\sezeGoj.exe
  2⤵
  PID:5524
- C:\Windows\System\frTJnQj.exe
  C:\Windows\System\frTJnQj.exe
  2⤵
  PID:5552
- C:\Windows\System\iBfPqRr.exe
  C:\Windows\System\iBfPqRr.exe
  2⤵
  PID:5580
- C:\Windows\System\qQBcDIq.exe
  C:\Windows\System\qQBcDIq.exe
  2⤵
  PID:5596
- C:\Windows\System\JqTqZMu.exe
  C:\Windows\System\JqTqZMu.exe
  2⤵
  PID:5624
- C:\Windows\System\wQyeLxY.exe
  C:\Windows\System\wQyeLxY.exe
  2⤵
  PID:5644
- C:\Windows\System\GiJufqO.exe
  C:\Windows\System\GiJufqO.exe
  2⤵
  PID:5672
- C:\Windows\System\ZrEkipr.exe
  C:\Windows\System\ZrEkipr.exe
  2⤵
  PID:5708
- C:\Windows\System\yBEFDwt.exe
  C:\Windows\System\yBEFDwt.exe
  2⤵
  PID:5748
- C:\Windows\System\GNKbGXt.exe
  C:\Windows\System\GNKbGXt.exe
  2⤵
  PID:5776
- C:\Windows\System\WyIneBy.exe
  C:\Windows\System\WyIneBy.exe
  2⤵
  PID:5792
- C:\Windows\System\CXaHGTg.exe
  C:\Windows\System\CXaHGTg.exe
  2⤵
  PID:5820
- C:\Windows\System\TsYInmx.exe
  C:\Windows\System\TsYInmx.exe
  2⤵
  PID:5856
- C:\Windows\System\SSQOLQV.exe
  C:\Windows\System\SSQOLQV.exe
  2⤵
  PID:5876
- C:\Windows\System\GuCYjGv.exe
  C:\Windows\System\GuCYjGv.exe
  2⤵
  PID:5900
- C:\Windows\System\QLkoIBY.exe
  C:\Windows\System\QLkoIBY.exe
  2⤵
  PID:5924
- C:\Windows\System\AxdLIEH.exe
  C:\Windows\System\AxdLIEH.exe
  2⤵
  PID:5952
- C:\Windows\System\UISDhjm.exe
  C:\Windows\System\UISDhjm.exe
  2⤵
  PID:5980
- C:\Windows\System\CRnztjd.exe
  C:\Windows\System\CRnztjd.exe
  2⤵
  PID:6012
- C:\Windows\System\PDhrvYj.exe
  C:\Windows\System\PDhrvYj.exe
  2⤵
  PID:6048
- C:\Windows\System\GSYIurP.exe
  C:\Windows\System\GSYIurP.exe
  2⤵
  PID:6076
- C:\Windows\System\qIRtjSb.exe
  C:\Windows\System\qIRtjSb.exe
  2⤵
  PID:6104
- C:\Windows\System\wPwSEPb.exe
  C:\Windows\System\wPwSEPb.exe
  2⤵
  PID:6124
- C:\Windows\System\yGHHMWb.exe
  C:\Windows\System\yGHHMWb.exe
  2⤵
  PID:5144
- C:\Windows\System\qBXOJFc.exe
  C:\Windows\System\qBXOJFc.exe
  2⤵
  PID:5224
- C:\Windows\System\hwSzyed.exe
  C:\Windows\System\hwSzyed.exe
  2⤵
  PID:5292
- C:\Windows\System\diqDTuG.exe
  C:\Windows\System\diqDTuG.exe
  2⤵
  PID:5336
- C:\Windows\System\XMxBnbD.exe
  C:\Windows\System\XMxBnbD.exe
  2⤵
  PID:5384
- C:\Windows\System\rFixfbl.exe
  C:\Windows\System\rFixfbl.exe
  2⤵
  PID:5448
- C:\Windows\System\HeeoIjD.exe
  C:\Windows\System\HeeoIjD.exe
  2⤵
  PID:5516
- C:\Windows\System\mQpQjqo.exe
  C:\Windows\System\mQpQjqo.exe
  2⤵
  PID:5616
- C:\Windows\System\HpfYVcU.exe
  C:\Windows\System\HpfYVcU.exe
  2⤵
  PID:5664
- C:\Windows\System\rHPYqwA.exe
  C:\Windows\System\rHPYqwA.exe
  2⤵
  PID:5732
- C:\Windows\System\sNkebtH.exe
  C:\Windows\System\sNkebtH.exe
  2⤵
  PID:5816
- C:\Windows\System\zrqwBrZ.exe
  C:\Windows\System\zrqwBrZ.exe
  2⤵
  PID:5908
- C:\Windows\System\oyXmbGa.exe
  C:\Windows\System\oyXmbGa.exe
  2⤵
  PID:5972
- C:\Windows\System\QkkTeLR.exe
  C:\Windows\System\QkkTeLR.exe
  2⤵
  PID:6060
- C:\Windows\System\tDVaAsA.exe
  C:\Windows\System\tDVaAsA.exe
  2⤵
  PID:6096
- C:\Windows\System\VuinfdR.exe
  C:\Windows\System\VuinfdR.exe
  2⤵
  PID:5136
- C:\Windows\System\JpYWiuw.exe
  C:\Windows\System\JpYWiuw.exe
  2⤵
  PID:5324
- C:\Windows\System\QvekhsE.exe
  C:\Windows\System\QvekhsE.exe
  2⤵
  PID:5444
- C:\Windows\System\tLmNeZh.exe
  C:\Windows\System\tLmNeZh.exe
  2⤵
  PID:5612
- C:\Windows\System\lNuGEYi.exe
  C:\Windows\System\lNuGEYi.exe
  2⤵
  PID:5788
- C:\Windows\System\uNeepIl.exe
  C:\Windows\System\uNeepIl.exe
  2⤵
  PID:5944
- C:\Windows\System\QseIRpf.exe
  C:\Windows\System\QseIRpf.exe
  2⤵
  PID:6088
- C:\Windows\System\usUwWPh.exe
  C:\Windows\System\usUwWPh.exe
  2⤵
  PID:5492
- C:\Windows\System\dflFTDZ.exe
  C:\Windows\System\dflFTDZ.exe
  2⤵
  PID:5720
- C:\Windows\System\XYhgnen.exe
  C:\Windows\System\XYhgnen.exe
  2⤵
  PID:6064
- C:\Windows\System\VmnxyAA.exe
  C:\Windows\System\VmnxyAA.exe
  2⤵
  PID:5704
- C:\Windows\System\UuXlSuP.exe
  C:\Windows\System\UuXlSuP.exe
  2⤵
  PID:5548
- C:\Windows\System\idXtxxZ.exe
  C:\Windows\System\idXtxxZ.exe
  2⤵
  PID:6148
- C:\Windows\System\cEJbZkn.exe
  C:\Windows\System\cEJbZkn.exe
  2⤵
  PID:6196
- C:\Windows\System\RpFPBCp.exe
  C:\Windows\System\RpFPBCp.exe
  2⤵
  PID:6228
- C:\Windows\System\bihkVPJ.exe
  C:\Windows\System\bihkVPJ.exe
  2⤵
  PID:6260
- C:\Windows\System\SHZcCos.exe
  C:\Windows\System\SHZcCos.exe
  2⤵
  PID:6288
- C:\Windows\System\cHMhKAm.exe
  C:\Windows\System\cHMhKAm.exe
  2⤵
  PID:6316
- C:\Windows\System\GZmmExR.exe
  C:\Windows\System\GZmmExR.exe
  2⤵
  PID:6344
- C:\Windows\System\xbseHbx.exe
  C:\Windows\System\xbseHbx.exe
  2⤵
  PID:6376
- C:\Windows\System\AEDgodP.exe
  C:\Windows\System\AEDgodP.exe
  2⤵
  PID:6404
- C:\Windows\System\LQpHBdR.exe
  C:\Windows\System\LQpHBdR.exe
  2⤵
  PID:6436
- C:\Windows\System\CGqvZgX.exe
  C:\Windows\System\CGqvZgX.exe
  2⤵
  PID:6464
- C:\Windows\System\COPTgml.exe
  C:\Windows\System\COPTgml.exe
  2⤵
  PID:6492
- C:\Windows\System\dYlRixw.exe
  C:\Windows\System\dYlRixw.exe
  2⤵
  PID:6516
- C:\Windows\System\ICgBGGI.exe
  C:\Windows\System\ICgBGGI.exe
  2⤵
  PID:6540
- C:\Windows\System\eYZtFuy.exe
  C:\Windows\System\eYZtFuy.exe
  2⤵
  PID:6576
- C:\Windows\System\NvmizLP.exe
  C:\Windows\System\NvmizLP.exe
  2⤵
  PID:6604
- C:\Windows\System\WiHcvPd.exe
  C:\Windows\System\WiHcvPd.exe
  2⤵
  PID:6632
- C:\Windows\System\zSvflHt.exe
  C:\Windows\System\zSvflHt.exe
  2⤵
  PID:6648
- C:\Windows\System\KzBufgk.exe
  C:\Windows\System\KzBufgk.exe
  2⤵
  PID:6672
- C:\Windows\System\NmTfsYl.exe
  C:\Windows\System\NmTfsYl.exe
  2⤵
  PID:6712
- C:\Windows\System\pKYGwZc.exe
  C:\Windows\System\pKYGwZc.exe
  2⤵
  PID:6736
- C:\Windows\System\CIoeusX.exe
  C:\Windows\System\CIoeusX.exe
  2⤵
  PID:6768
- C:\Windows\System\uviUEwi.exe
  C:\Windows\System\uviUEwi.exe
  2⤵
  PID:6796
- C:\Windows\System\UYPlUut.exe
  C:\Windows\System\UYPlUut.exe
  2⤵
  PID:6824
- C:\Windows\System\RHoExVB.exe
  C:\Windows\System\RHoExVB.exe
  2⤵
  PID:6844
- C:\Windows\System\VvIUKmf.exe
  C:\Windows\System\VvIUKmf.exe
  2⤵
  PID:6872
- C:\Windows\System\HwkyTAz.exe
  C:\Windows\System\HwkyTAz.exe
  2⤵
  PID:6908
- C:\Windows\System\bEjMkLi.exe
  C:\Windows\System\bEjMkLi.exe
  2⤵
  PID:6936
- C:\Windows\System\onuDdgI.exe
  C:\Windows\System\onuDdgI.exe
  2⤵
  PID:6968
- C:\Windows\System\aEBwhSa.exe
  C:\Windows\System\aEBwhSa.exe
  2⤵
  PID:6996
- C:\Windows\System\ojkPsme.exe
  C:\Windows\System\ojkPsme.exe
  2⤵
  PID:7024
- C:\Windows\System\JfawCJO.exe
  C:\Windows\System\JfawCJO.exe
  2⤵
  PID:7052
- C:\Windows\System\IBEIDMJ.exe
  C:\Windows\System\IBEIDMJ.exe
  2⤵
  PID:7068
- C:\Windows\System\kZiQgge.exe
  C:\Windows\System\kZiQgge.exe
  2⤵
  PID:7100
- C:\Windows\System\VTViHgY.exe
  C:\Windows\System\VTViHgY.exe
  2⤵
  PID:7136
- C:\Windows\System\nvBaTUq.exe
  C:\Windows\System\nvBaTUq.exe
  2⤵
  PID:7164
- C:\Windows\System\fddBmBR.exe
  C:\Windows\System\fddBmBR.exe
  2⤵
  PID:6164
- C:\Windows\System\ePmFzRl.exe
  C:\Windows\System\ePmFzRl.exe
  2⤵
  PID:6248
- C:\Windows\System\gSRZizj.exe
  C:\Windows\System\gSRZizj.exe
  2⤵
  PID:6328
- C:\Windows\System\mpKKrpy.exe
  C:\Windows\System\mpKKrpy.exe
  2⤵
  PID:6416
- C:\Windows\System\bifireQ.exe
  C:\Windows\System\bifireQ.exe
  2⤵
  PID:6484
- C:\Windows\System\hvEgECS.exe
  C:\Windows\System\hvEgECS.exe
  2⤵
  PID:6524
- C:\Windows\System\MEAghdQ.exe
  C:\Windows\System\MEAghdQ.exe
  2⤵
  PID:6600
- C:\Windows\System\bbpOdBa.exe
  C:\Windows\System\bbpOdBa.exe
  2⤵
  PID:6668
- C:\Windows\System\owoHMwf.exe
  C:\Windows\System\owoHMwf.exe
  2⤵
  PID:6744
- C:\Windows\System\UUxUYHP.exe
  C:\Windows\System\UUxUYHP.exe
  2⤵
  PID:6816
- C:\Windows\System\QuBjKUN.exe
  C:\Windows\System\QuBjKUN.exe
  2⤵
  PID:6840
- C:\Windows\System\PrwcETt.exe
  C:\Windows\System\PrwcETt.exe
  2⤵
  PID:6900
- C:\Windows\System\VgILAdi.exe
  C:\Windows\System\VgILAdi.exe
  2⤵
  PID:6980
- C:\Windows\System\TEHDEmA.exe
  C:\Windows\System\TEHDEmA.exe
  2⤵
  PID:7040
- C:\Windows\System\PHOkdbe.exe
  C:\Windows\System\PHOkdbe.exe
  2⤵
  PID:7124
- C:\Windows\System\JxibFCW.exe
  C:\Windows\System\JxibFCW.exe
  2⤵
  PID:6216
- C:\Windows\System\UQqjqjy.exe
  C:\Windows\System\UQqjqjy.exe
  2⤵
  PID:6372
- C:\Windows\System\QXQDCSc.exe
  C:\Windows\System\QXQDCSc.exe
  2⤵
  PID:6500
- C:\Windows\System\qwSpMwb.exe
  C:\Windows\System\qwSpMwb.exe
  2⤵
  PID:6664
- C:\Windows\System\VyvJEuJ.exe
  C:\Windows\System\VyvJEuJ.exe
  2⤵
  PID:6856
- C:\Windows\System\vQjfTui.exe
  C:\Windows\System\vQjfTui.exe
  2⤵
  PID:6992
- C:\Windows\System\ZOIgRCd.exe
  C:\Windows\System\ZOIgRCd.exe
  2⤵
  PID:6160
- C:\Windows\System\gsNlIYt.exe
  C:\Windows\System\gsNlIYt.exe
  2⤵
  PID:6460
- C:\Windows\System\RiBoiyA.exe
  C:\Windows\System\RiBoiyA.exe
  2⤵
  PID:6792
- C:\Windows\System\BltXFbT.exe
  C:\Windows\System\BltXFbT.exe
  2⤵
  PID:7120
- C:\Windows\System\hrnkJSv.exe
  C:\Windows\System\hrnkJSv.exe
  2⤵
  PID:7064
- C:\Windows\System\sdKAnrg.exe
  C:\Windows\System\sdKAnrg.exe
  2⤵
  PID:7176
- C:\Windows\System\OjEvdDV.exe
  C:\Windows\System\OjEvdDV.exe
  2⤵
  PID:7200
- C:\Windows\System\VUxchLo.exe
  C:\Windows\System\VUxchLo.exe
  2⤵
  PID:7232
- C:\Windows\System\XmHmcdS.exe
  C:\Windows\System\XmHmcdS.exe
  2⤵
  PID:7272
- C:\Windows\System\AwgGUmT.exe
  C:\Windows\System\AwgGUmT.exe
  2⤵
  PID:7300
- C:\Windows\System\kuhzNkx.exe
  C:\Windows\System\kuhzNkx.exe
  2⤵
  PID:7328
- C:\Windows\System\FXnIalc.exe
  C:\Windows\System\FXnIalc.exe
  2⤵
  PID:7356
- C:\Windows\System\gMutBgY.exe
  C:\Windows\System\gMutBgY.exe
  2⤵
  PID:7372
- C:\Windows\System\etGAHcH.exe
  C:\Windows\System\etGAHcH.exe
  2⤵
  PID:7396
- C:\Windows\System\xkXvEPm.exe
  C:\Windows\System\xkXvEPm.exe
  2⤵
  PID:7428
- C:\Windows\System\tGcqhYG.exe
  C:\Windows\System\tGcqhYG.exe
  2⤵
  PID:7460
- C:\Windows\System\xlzNTCh.exe
  C:\Windows\System\xlzNTCh.exe
  2⤵
  PID:7496
- C:\Windows\System\lZjQvHG.exe
  C:\Windows\System\lZjQvHG.exe
  2⤵
  PID:7524
- C:\Windows\System\eaUHMIz.exe
  C:\Windows\System\eaUHMIz.exe
  2⤵
  PID:7552
- C:\Windows\System\ZQPTjsb.exe
  C:\Windows\System\ZQPTjsb.exe
  2⤵
  PID:7580
- C:\Windows\System\RsjFapg.exe
  C:\Windows\System\RsjFapg.exe
  2⤵
  PID:7596
- C:\Windows\System\uIUjNfY.exe
  C:\Windows\System\uIUjNfY.exe
  2⤵
  PID:7624
- C:\Windows\System\YVDluUX.exe
  C:\Windows\System\YVDluUX.exe
  2⤵
  PID:7664
- C:\Windows\System\JyQZBqt.exe
  C:\Windows\System\JyQZBqt.exe
  2⤵
  PID:7692
- C:\Windows\System\YHKCRfW.exe
  C:\Windows\System\YHKCRfW.exe
  2⤵
  PID:7720
- C:\Windows\System\RQQhorr.exe
  C:\Windows\System\RQQhorr.exe
  2⤵
  PID:7748
- C:\Windows\System\IajAiNU.exe
  C:\Windows\System\IajAiNU.exe
  2⤵
  PID:7776
- C:\Windows\System\KzFHYPP.exe
  C:\Windows\System\KzFHYPP.exe
  2⤵
  PID:7804
- C:\Windows\System\DqrRdJo.exe
  C:\Windows\System\DqrRdJo.exe
  2⤵
  PID:7820
- C:\Windows\System\xEcANcY.exe
  C:\Windows\System\xEcANcY.exe
  2⤵
  PID:7848
- C:\Windows\System\GTDtGsZ.exe
  C:\Windows\System\GTDtGsZ.exe
  2⤵
  PID:7876
- C:\Windows\System\HDtFxOS.exe
  C:\Windows\System\HDtFxOS.exe
  2⤵
  PID:7904
- C:\Windows\System\MNOhviA.exe
  C:\Windows\System\MNOhviA.exe
  2⤵
  PID:7932
- C:\Windows\System\pJqSaIt.exe
  C:\Windows\System\pJqSaIt.exe
  2⤵
  PID:7964
- C:\Windows\System\YNmvGas.exe
  C:\Windows\System\YNmvGas.exe
  2⤵
  PID:8000
- C:\Windows\System\ioprbxJ.exe
  C:\Windows\System\ioprbxJ.exe
  2⤵
  PID:8028
- C:\Windows\System\BOMRklZ.exe
  C:\Windows\System\BOMRklZ.exe
  2⤵
  PID:8056
- C:\Windows\System\zrsiNQk.exe
  C:\Windows\System\zrsiNQk.exe
  2⤵
  PID:8072
- C:\Windows\System\EuVmjlW.exe
  C:\Windows\System\EuVmjlW.exe
  2⤵
  PID:8108
- C:\Windows\System\NvMIxij.exe
  C:\Windows\System\NvMIxij.exe
  2⤵
  PID:8128
- C:\Windows\System\snWRmlU.exe
  C:\Windows\System\snWRmlU.exe
  2⤵
  PID:8144
- C:\Windows\System\BIoyYzw.exe
  C:\Windows\System\BIoyYzw.exe
  2⤵
  PID:8168
- C:\Windows\System\jcEtQSW.exe
  C:\Windows\System\jcEtQSW.exe
  2⤵
  PID:8188
- C:\Windows\System\isoaEFY.exe
  C:\Windows\System\isoaEFY.exe
  2⤵
  PID:7184
- C:\Windows\System\sYPtIWK.exe
  C:\Windows\System\sYPtIWK.exe
  2⤵
  PID:7260
- C:\Windows\System\clLpIPR.exe
  C:\Windows\System\clLpIPR.exe
  2⤵
  PID:7348
- C:\Windows\System\FXgiEOD.exe
  C:\Windows\System\FXgiEOD.exe
  2⤵
  PID:7384
- C:\Windows\System\MqoQxjJ.exe
  C:\Windows\System\MqoQxjJ.exe
  2⤵
  PID:7480
- C:\Windows\System\fdbeuan.exe
  C:\Windows\System\fdbeuan.exe
  2⤵
  PID:7576
- C:\Windows\System\SIEAvRv.exe
  C:\Windows\System\SIEAvRv.exe
  2⤵
  PID:7636
- C:\Windows\System\NykUcof.exe
  C:\Windows\System\NykUcof.exe
  2⤵
  PID:7704
- C:\Windows\System\HpisJZh.exe
  C:\Windows\System\HpisJZh.exe
  2⤵
  PID:7800
- C:\Windows\System\ikyFNxJ.exe
  C:\Windows\System\ikyFNxJ.exe
  2⤵
  PID:7864
- C:\Windows\System\wnQBicM.exe
  C:\Windows\System\wnQBicM.exe
  2⤵
  PID:7944
- C:\Windows\System\DrKcRwz.exe
  C:\Windows\System\DrKcRwz.exe
  2⤵
  PID:8012
- C:\Windows\System\qLPRZMt.exe
  C:\Windows\System\qLPRZMt.exe
  2⤵
  PID:8084
- C:\Windows\System\lskQOuk.exe
  C:\Windows\System\lskQOuk.exe
  2⤵
  PID:8160
- C:\Windows\System\qyDPrRH.exe
  C:\Windows\System\qyDPrRH.exe
  2⤵
  PID:8120
- C:\Windows\System\wvbzMFG.exe
  C:\Windows\System\wvbzMFG.exe
  2⤵
  PID:7316
- C:\Windows\System\NftNXYv.exe
  C:\Windows\System\NftNXYv.exe
  2⤵
  PID:7448
- C:\Windows\System\UVpBcVF.exe
  C:\Windows\System\UVpBcVF.exe
  2⤵
  PID:7608
- C:\Windows\System\SLqiUEl.exe
  C:\Windows\System\SLqiUEl.exe
  2⤵
  PID:7760
- C:\Windows\System\GdZMxYd.exe
  C:\Windows\System\GdZMxYd.exe
  2⤵
  PID:7860
- C:\Windows\System\gtzgUNo.exe
  C:\Windows\System\gtzgUNo.exe
  2⤵
  PID:8040
- C:\Windows\System\jxOhvTE.exe
  C:\Windows\System\jxOhvTE.exe
  2⤵
  PID:7296
- C:\Windows\System\AxWorSv.exe
  C:\Windows\System\AxWorSv.exe
  2⤵
  PID:7564
- C:\Windows\System\oOZQfJi.exe
  C:\Windows\System\oOZQfJi.exe
  2⤵
  PID:7924
- C:\Windows\System\KSrnCFo.exe
  C:\Windows\System\KSrnCFo.exe
  2⤵
  PID:7520
- C:\Windows\System\FPzTeUP.exe
  C:\Windows\System\FPzTeUP.exe
  2⤵
  PID:8176
- C:\Windows\System\vfJsEsC.exe
  C:\Windows\System\vfJsEsC.exe
  2⤵
  PID:8216
- C:\Windows\System\tFoeYrz.exe
  C:\Windows\System\tFoeYrz.exe
  2⤵
  PID:8236
- C:\Windows\System\IakqulC.exe
  C:\Windows\System\IakqulC.exe
  2⤵
  PID:8260
- C:\Windows\System\tbudQmu.exe
  C:\Windows\System\tbudQmu.exe
  2⤵
  PID:8284
- C:\Windows\System\tUQyutO.exe
  C:\Windows\System\tUQyutO.exe
  2⤵
  PID:8312
- C:\Windows\System\oRIzjob.exe
  C:\Windows\System\oRIzjob.exe
  2⤵
  PID:8332
- C:\Windows\System\ZUzZphN.exe
  C:\Windows\System\ZUzZphN.exe
  2⤵
  PID:8372
- C:\Windows\System\MymYyKR.exe
  C:\Windows\System\MymYyKR.exe
  2⤵
  PID:8420
- C:\Windows\System\EnrhEAT.exe
  C:\Windows\System\EnrhEAT.exe
  2⤵
  PID:8440
- C:\Windows\System\bHAWsaK.exe
  C:\Windows\System\bHAWsaK.exe
  2⤵
  PID:8456
- C:\Windows\System\SOiIbvo.exe
  C:\Windows\System\SOiIbvo.exe
  2⤵
  PID:8472
- C:\Windows\System\aouzJsX.exe
  C:\Windows\System\aouzJsX.exe
  2⤵
  PID:8504
- C:\Windows\System\GJTQFdZ.exe
  C:\Windows\System\GJTQFdZ.exe
  2⤵
  PID:8552
- C:\Windows\System\WNVSxPn.exe
  C:\Windows\System\WNVSxPn.exe
  2⤵
  PID:8592
- C:\Windows\System\rVgXrGt.exe
  C:\Windows\System\rVgXrGt.exe
  2⤵
  PID:8620
- C:\Windows\System\kqRbpPp.exe
  C:\Windows\System\kqRbpPp.exe
  2⤵
  PID:8648
- C:\Windows\System\dLSxaGY.exe
  C:\Windows\System\dLSxaGY.exe
  2⤵
  PID:8672
- C:\Windows\System\siqyEJj.exe
  C:\Windows\System\siqyEJj.exe
  2⤵
  PID:8692
- C:\Windows\System\EBQtRpb.exe
  C:\Windows\System\EBQtRpb.exe
  2⤵
  PID:8728
- C:\Windows\System\XqVdGrJ.exe
  C:\Windows\System\XqVdGrJ.exe
  2⤵
  PID:8760
- C:\Windows\System\lSGEokm.exe
  C:\Windows\System\lSGEokm.exe
  2⤵
  PID:8788
- C:\Windows\System\LwIZJaF.exe
  C:\Windows\System\LwIZJaF.exe
  2⤵
  PID:8816
- C:\Windows\System\rkJWXvl.exe
  C:\Windows\System\rkJWXvl.exe
  2⤵
  PID:8844
- C:\Windows\System\iFvuLhA.exe
  C:\Windows\System\iFvuLhA.exe
  2⤵
  PID:8872
- C:\Windows\System\ffiqERF.exe
  C:\Windows\System\ffiqERF.exe
  2⤵
  PID:8900
- C:\Windows\System\KuZSfsl.exe
  C:\Windows\System\KuZSfsl.exe
  2⤵
  PID:8928
- C:\Windows\System\kBZefkd.exe
  C:\Windows\System\kBZefkd.exe
  2⤵
  PID:8956
- C:\Windows\System\ueQWhiI.exe
  C:\Windows\System\ueQWhiI.exe
  2⤵
  PID:8972
- C:\Windows\System\gyOYknD.exe
  C:\Windows\System\gyOYknD.exe
  2⤵
  PID:9000
- C:\Windows\System\cMAYySV.exe
  C:\Windows\System\cMAYySV.exe
  2⤵
  PID:9032
- C:\Windows\System\OrfdUAb.exe
  C:\Windows\System\OrfdUAb.exe
  2⤵
  PID:9056
- C:\Windows\System\dclpTzf.exe
  C:\Windows\System\dclpTzf.exe
  2⤵
  PID:9084
- C:\Windows\System\tRbtcLf.exe
  C:\Windows\System\tRbtcLf.exe
  2⤵
  PID:9116
- C:\Windows\System\XeqazEO.exe
  C:\Windows\System\XeqazEO.exe
  2⤵
  PID:9136
- C:\Windows\System\xsdEdgg.exe
  C:\Windows\System\xsdEdgg.exe
  2⤵
  PID:9160
- C:\Windows\System\UHjxlXQ.exe
  C:\Windows\System\UHjxlXQ.exe
  2⤵
  PID:9196
- C:\Windows\System\qqiXcKp.exe
  C:\Windows\System\qqiXcKp.exe
  2⤵
  PID:8204
- C:\Windows\System\LlQpzKZ.exe
  C:\Windows\System\LlQpzKZ.exe
  2⤵
  PID:8224
- C:\Windows\System\LMFspkH.exe
  C:\Windows\System\LMFspkH.exe
  2⤵
  PID:8308
- C:\Windows\System\HOOelRk.exe
  C:\Windows\System\HOOelRk.exe
  2⤵
  PID:8400
- C:\Windows\System\kLprfvo.exe
  C:\Windows\System\kLprfvo.exe
  2⤵
  PID:8468
- C:\Windows\System\dagbTOE.exe
  C:\Windows\System\dagbTOE.exe
  2⤵
  PID:8548
- C:\Windows\System\XMpCTBT.exe
  C:\Windows\System\XMpCTBT.exe
  2⤵
  PID:8580
- C:\Windows\System\nZysliq.exe
  C:\Windows\System\nZysliq.exe
  2⤵
  PID:8668
- C:\Windows\System\ZVbLYXf.exe
  C:\Windows\System\ZVbLYXf.exe
  2⤵
  PID:8744
- C:\Windows\System\rQfGkXf.exe
  C:\Windows\System\rQfGkXf.exe
  2⤵
  PID:8776
- C:\Windows\System\veSfAID.exe
  C:\Windows\System\veSfAID.exe
  2⤵
  PID:8832
- C:\Windows\System\RdhHuCA.exe
  C:\Windows\System\RdhHuCA.exe
  2⤵
  PID:8916
- C:\Windows\System\zsmzARl.exe
  C:\Windows\System\zsmzARl.exe
  2⤵
  PID:8996
- C:\Windows\System\DnLugjS.exe
  C:\Windows\System\DnLugjS.exe
  2⤵
  PID:9048
- C:\Windows\System\SghbLEK.exe
  C:\Windows\System\SghbLEK.exe
  2⤵
  PID:9072
- C:\Windows\System\CSkodnv.exe
  C:\Windows\System\CSkodnv.exe
  2⤵
  PID:9124
- C:\Windows\System\KDGoFmw.exe
  C:\Windows\System\KDGoFmw.exe
  2⤵
  PID:9180
- C:\Windows\System\uvncscl.exe
  C:\Windows\System\uvncscl.exe
  2⤵
  PID:7984
- C:\Windows\System\jruBcEH.exe
  C:\Windows\System\jruBcEH.exe
  2⤵
  PID:8324
- C:\Windows\System\VwFEuii.exe
  C:\Windows\System\VwFEuii.exe
  2⤵
  PID:8528
- C:\Windows\System\CaDjOtB.exe
  C:\Windows\System\CaDjOtB.exe
  2⤵
  PID:8704
- C:\Windows\System\hBGEiWR.exe
  C:\Windows\System\hBGEiWR.exe
  2⤵
  PID:8864
- C:\Windows\System\ZxLoadA.exe
  C:\Windows\System\ZxLoadA.exe
  2⤵
  PID:9104
- C:\Windows\System\RDcVWOh.exe
  C:\Windows\System\RDcVWOh.exe
  2⤵
  PID:8276
- C:\Windows\System\tXRFtqG.exe
  C:\Windows\System\tXRFtqG.exe
  2⤵
  PID:8684
- C:\Windows\System\tAaDdpS.exe
  C:\Windows\System\tAaDdpS.exe
  2⤵
  PID:8812
- C:\Windows\System\htDoTyx.exe
  C:\Windows\System\htDoTyx.exe
  2⤵
  PID:8964
- C:\Windows\System\Sktnvaw.exe
  C:\Windows\System\Sktnvaw.exe
  2⤵
  PID:7340
- C:\Windows\System\RzJDntP.exe
  C:\Windows\System\RzJDntP.exe
  2⤵
  PID:9244
- C:\Windows\System\dzqXdJC.exe
  C:\Windows\System\dzqXdJC.exe
  2⤵
  PID:9268
- C:\Windows\System\CyukZjF.exe
  C:\Windows\System\CyukZjF.exe
  2⤵
  PID:9300
- C:\Windows\System\GaRTOYp.exe
  C:\Windows\System\GaRTOYp.exe
  2⤵
  PID:9328
- C:\Windows\System\fUSwIet.exe
  C:\Windows\System\fUSwIet.exe
  2⤵
  PID:9356
- C:\Windows\System\nXoiOGG.exe
  C:\Windows\System\nXoiOGG.exe
  2⤵
  PID:9384
- C:\Windows\System\COVcrzS.exe
  C:\Windows\System\COVcrzS.exe
  2⤵
  PID:9400
- C:\Windows\System\lUkknDv.exe
  C:\Windows\System\lUkknDv.exe
  2⤵
  PID:9416
- C:\Windows\System\BkTZhUW.exe
  C:\Windows\System\BkTZhUW.exe
  2⤵
  PID:9456
- C:\Windows\System\FirmjrX.exe
  C:\Windows\System\FirmjrX.exe
  2⤵
  PID:9472
- C:\Windows\System\hOPBGzj.exe
  C:\Windows\System\hOPBGzj.exe
  2⤵
  PID:9512
- C:\Windows\System\yGJgdbU.exe
  C:\Windows\System\yGJgdbU.exe
  2⤵
  PID:9548
- C:\Windows\System\PqwdpFQ.exe
  C:\Windows\System\PqwdpFQ.exe
  2⤵
  PID:9580
- C:\Windows\System\hSSKvTZ.exe
  C:\Windows\System\hSSKvTZ.exe
  2⤵
  PID:9608
- C:\Windows\System\tfnkaOk.exe
  C:\Windows\System\tfnkaOk.exe
  2⤵
  PID:9636
- C:\Windows\System\oZlmHrZ.exe
  C:\Windows\System\oZlmHrZ.exe
  2⤵
  PID:9656
- C:\Windows\System\gVxToVe.exe
  C:\Windows\System\gVxToVe.exe
  2⤵
  PID:9688
- C:\Windows\System\RxbUdLf.exe
  C:\Windows\System\RxbUdLf.exe
  2⤵
  PID:9708
- C:\Windows\System\xmdwZRv.exe
  C:\Windows\System\xmdwZRv.exe
  2⤵
  PID:9740
- C:\Windows\System\WkLXrcW.exe
  C:\Windows\System\WkLXrcW.exe
  2⤵
  PID:9776
- C:\Windows\System\SwmeTdp.exe
  C:\Windows\System\SwmeTdp.exe
  2⤵
  PID:9804
- C:\Windows\System\VWRltkR.exe
  C:\Windows\System\VWRltkR.exe
  2⤵
  PID:9832
- C:\Windows\System\WyPOiaY.exe
  C:\Windows\System\WyPOiaY.exe
  2⤵
  PID:9860
- C:\Windows\System\aIGsVcF.exe
  C:\Windows\System\aIGsVcF.exe
  2⤵
  PID:9888
- C:\Windows\System\wxwVcqs.exe
  C:\Windows\System\wxwVcqs.exe
  2⤵
  PID:9904
- C:\Windows\System\Hyhxbjp.exe
  C:\Windows\System\Hyhxbjp.exe
  2⤵
  PID:9932
- C:\Windows\System\MCJSZCe.exe
  C:\Windows\System\MCJSZCe.exe
  2⤵
  PID:9972
- C:\Windows\System\POmuQna.exe
  C:\Windows\System\POmuQna.exe
  2⤵
  PID:9996
- C:\Windows\System\gcgjZRK.exe
  C:\Windows\System\gcgjZRK.exe
  2⤵
  PID:10016
- C:\Windows\System\LywZDXs.exe
  C:\Windows\System\LywZDXs.exe
  2⤵
  PID:10056
- C:\Windows\System\bxStAaE.exe
  C:\Windows\System\bxStAaE.exe
  2⤵
  PID:10076
- C:\Windows\System\ynsdxcK.exe
  C:\Windows\System\ynsdxcK.exe
  2⤵
  PID:10104
- C:\Windows\System\WTHQvSJ.exe
  C:\Windows\System\WTHQvSJ.exe
  2⤵
  PID:10140
- C:\Windows\System\kzEYOZO.exe
  C:\Windows\System\kzEYOZO.exe
  2⤵
  PID:10172
- C:\Windows\System\NcREWbj.exe
  C:\Windows\System\NcREWbj.exe
  2⤵
  PID:10188
- C:\Windows\System\HRUSFtC.exe
  C:\Windows\System\HRUSFtC.exe
  2⤵
  PID:10220
- C:\Windows\System\ItVuuGD.exe
  C:\Windows\System\ItVuuGD.exe
  2⤵
  PID:9228
- C:\Windows\System\lMkAmKC.exe
  C:\Windows\System\lMkAmKC.exe
  2⤵
  PID:9260
- C:\Windows\System\RMQYJCq.exe
  C:\Windows\System\RMQYJCq.exe
  2⤵
  PID:9344
- C:\Windows\System\rwklJnO.exe
  C:\Windows\System\rwklJnO.exe
  2⤵
  PID:9396
- C:\Windows\System\nzQqrfa.exe
  C:\Windows\System\nzQqrfa.exe
  2⤵
  PID:9496
- C:\Windows\System\quyTyER.exe
  C:\Windows\System\quyTyER.exe
  2⤵
  PID:9572
- C:\Windows\System\SJvfTvo.exe
  C:\Windows\System\SJvfTvo.exe
  2⤵
  PID:9620
- C:\Windows\System\zhdNiXD.exe
  C:\Windows\System\zhdNiXD.exe
  2⤵
  PID:9720
- C:\Windows\System\piLaERq.exe
  C:\Windows\System\piLaERq.exe
  2⤵
  PID:9760
- C:\Windows\System\HAKPBqs.exe
  C:\Windows\System\HAKPBqs.exe
  2⤵
  PID:9824
- C:\Windows\System\AMTbPBq.exe
  C:\Windows\System\AMTbPBq.exe
  2⤵
  PID:9872
- C:\Windows\System\pmhEWVC.exe
  C:\Windows\System\pmhEWVC.exe
  2⤵
  PID:9928
- C:\Windows\System\lvhBKSk.exe
  C:\Windows\System\lvhBKSk.exe
  2⤵
  PID:10012
- C:\Windows\System\FQtxLxA.exe
  C:\Windows\System\FQtxLxA.exe
  2⤵
  PID:8464
- C:\Windows\System\dkAYykt.exe
  C:\Windows\System\dkAYykt.exe
  2⤵
  PID:10100
- C:\Windows\System\jjNMtAf.exe
  C:\Windows\System\jjNMtAf.exe
  2⤵
  PID:10200
- C:\Windows\System\YDPWuxp.exe
  C:\Windows\System\YDPWuxp.exe
  2⤵
  PID:8280
- C:\Windows\System\ntcMlgZ.exe
  C:\Windows\System\ntcMlgZ.exe
  2⤵
  PID:9380
- C:\Windows\System\qjACkWM.exe
  C:\Windows\System\qjACkWM.exe
  2⤵
  PID:9464
- C:\Windows\System\zIDtDOb.exe
  C:\Windows\System\zIDtDOb.exe
  2⤵
  PID:9684
- C:\Windows\System\NjrLwnz.exe
  C:\Windows\System\NjrLwnz.exe
  2⤵
  PID:9844
- C:\Windows\System\kKhedSx.exe
  C:\Windows\System\kKhedSx.exe
  2⤵
  PID:10004
- C:\Windows\System\ZjnBJiS.exe
  C:\Windows\System\ZjnBJiS.exe
  2⤵
  PID:9292
- C:\Windows\System\VIWqRRE.exe
  C:\Windows\System\VIWqRRE.exe
  2⤵
  PID:9508
- C:\Windows\System\QxijZlE.exe
  C:\Windows\System\QxijZlE.exe
  2⤵
  PID:9632
- C:\Windows\System\dVgeYKE.exe
  C:\Windows\System\dVgeYKE.exe
  2⤵
  PID:10040
- C:\Windows\System\ooOOKBr.exe
  C:\Windows\System\ooOOKBr.exe
  2⤵
  PID:9592
- C:\Windows\System\zVCwiKt.exe
  C:\Windows\System\zVCwiKt.exe
  2⤵
  PID:10252
- C:\Windows\System\SlhFXOt.exe
  C:\Windows\System\SlhFXOt.exe
  2⤵
  PID:10280
- C:\Windows\System\niWWqlI.exe
  C:\Windows\System\niWWqlI.exe
  2⤵
  PID:10308
- C:\Windows\System\uVVZkrz.exe
  C:\Windows\System\uVVZkrz.exe
  2⤵
  PID:10348
- C:\Windows\System\CgcplXK.exe
  C:\Windows\System\CgcplXK.exe
  2⤵
  PID:10364
- C:\Windows\System\ehzooKp.exe
  C:\Windows\System\ehzooKp.exe
  2⤵
  PID:10404
- C:\Windows\System\dfUBmwc.exe
  C:\Windows\System\dfUBmwc.exe
  2⤵
  PID:10420
- C:\Windows\System\IRShBgS.exe
  C:\Windows\System\IRShBgS.exe
  2⤵
  PID:10448
- C:\Windows\System\sKdleWp.exe
  C:\Windows\System\sKdleWp.exe
  2⤵
  PID:10468
- C:\Windows\System\mYzlwdr.exe
  C:\Windows\System\mYzlwdr.exe
  2⤵
  PID:10504
- C:\Windows\System\heRQFOJ.exe
  C:\Windows\System\heRQFOJ.exe
  2⤵
  PID:10532
- C:\Windows\System\kwUCLoV.exe
  C:\Windows\System\kwUCLoV.exe
  2⤵
  PID:10572
- C:\Windows\System\yaYyWnK.exe
  C:\Windows\System\yaYyWnK.exe
  2⤵
  PID:10600
- C:\Windows\System\SzoHNzQ.exe
  C:\Windows\System\SzoHNzQ.exe
  2⤵
  PID:10628
- C:\Windows\System\QaDpLza.exe
  C:\Windows\System\QaDpLza.exe
  2⤵
  PID:10656
- C:\Windows\System\hFXHkhC.exe
  C:\Windows\System\hFXHkhC.exe
  2⤵
  PID:10672
- C:\Windows\System\NtvbJlq.exe
  C:\Windows\System\NtvbJlq.exe
  2⤵
  PID:10700
- C:\Windows\System\KBbojty.exe
  C:\Windows\System\KBbojty.exe
  2⤵
  PID:10728
- C:\Windows\System\kUTMqho.exe
  C:\Windows\System\kUTMqho.exe
  2⤵
  PID:10756
- C:\Windows\System\CVuIfBd.exe
  C:\Windows\System\CVuIfBd.exe
  2⤵
  PID:10784
- C:\Windows\System\kZyFaeh.exe
  C:\Windows\System\kZyFaeh.exe
  2⤵
  PID:10820
- C:\Windows\System\UTcxtrA.exe
  C:\Windows\System\UTcxtrA.exe
  2⤵
  PID:10852
- C:\Windows\System\pBesyqa.exe
  C:\Windows\System\pBesyqa.exe
  2⤵
  PID:10880
- C:\Windows\System\NBfkDor.exe
  C:\Windows\System\NBfkDor.exe
  2⤵
  PID:10900
- C:\Windows\System\GADslNC.exe
  C:\Windows\System\GADslNC.exe
  2⤵
  PID:10928
- C:\Windows\System\EpzfpIJ.exe
  C:\Windows\System\EpzfpIJ.exe
  2⤵
  PID:10952
- C:\Windows\System\Zjjimgd.exe
  C:\Windows\System\Zjjimgd.exe
  2⤵
  PID:10992
- C:\Windows\System\TWquNph.exe
  C:\Windows\System\TWquNph.exe
  2⤵
  PID:11020
- C:\Windows\System\vMInphq.exe
  C:\Windows\System\vMInphq.exe
  2⤵
  PID:11040
- C:\Windows\System\xCQxOCc.exe
  C:\Windows\System\xCQxOCc.exe
  2⤵
  PID:11076
- C:\Windows\System\dezqUcN.exe
  C:\Windows\System\dezqUcN.exe
  2⤵
  PID:11096
- C:\Windows\System\xBjTGCS.exe
  C:\Windows\System\xBjTGCS.exe
  2⤵
  PID:11132
- C:\Windows\System\ILyQCTU.exe
  C:\Windows\System\ILyQCTU.exe
  2⤵
  PID:11152
- C:\Windows\System\HWKOEmE.exe
  C:\Windows\System\HWKOEmE.exe
  2⤵
  PID:11176
- C:\Windows\System\mcBEkZj.exe
  C:\Windows\System\mcBEkZj.exe
  2⤵
  PID:11192
- C:\Windows\System\jyqLgOH.exe
  C:\Windows\System\jyqLgOH.exe
  2⤵
  PID:11224
- C:\Windows\System\gSldakt.exe
  C:\Windows\System\gSldakt.exe
  2⤵
  PID:11256
- C:\Windows\System\XAzfwyg.exe
  C:\Windows\System\XAzfwyg.exe
  2⤵
  PID:10264
- C:\Windows\System\LZkuXCt.exe
  C:\Windows\System\LZkuXCt.exe
  2⤵
  PID:10320
- C:\Windows\System\QYuWAGY.exe
  C:\Windows\System\QYuWAGY.exe
  2⤵
  PID:10400
- C:\Windows\System\onvxVIU.exe
  C:\Windows\System\onvxVIU.exe
  2⤵
  PID:10476
- C:\Windows\System\heyAhxF.exe
  C:\Windows\System\heyAhxF.exe
  2⤵
  PID:10544
- C:\Windows\System\UGLwMdu.exe
  C:\Windows\System\UGLwMdu.exe
  2⤵
  PID:10612
- C:\Windows\System\QQQAAur.exe
  C:\Windows\System\QQQAAur.exe
  2⤵
  PID:10668
- C:\Windows\System\SWoyPZb.exe
  C:\Windows\System\SWoyPZb.exe
  2⤵
  PID:10724
- C:\Windows\System\HvagjZZ.exe
  C:\Windows\System\HvagjZZ.exe
  2⤵
  PID:10800
- C:\Windows\System\LThkjLf.exe
  C:\Windows\System\LThkjLf.exe
  2⤵
  PID:10872
- C:\Windows\System\rHXhJqx.exe
  C:\Windows\System\rHXhJqx.exe
  2⤵
  PID:10924
- C:\Windows\System\jwoVtbR.exe
  C:\Windows\System\jwoVtbR.exe
  2⤵
  PID:10980
- C:\Windows\System\ygQamZh.exe
  C:\Windows\System\ygQamZh.exe
  2⤵
  PID:11016
- C:\Windows\System\gZmyRSy.exe
  C:\Windows\System\gZmyRSy.exe
  2⤵
  PID:11072
- C:\Windows\System\LHPyzBm.exe
  C:\Windows\System\LHPyzBm.exe
  2⤵
  PID:11148
- C:\Windows\System\GfmcXil.exe
  C:\Windows\System\GfmcXil.exe
  2⤵
  PID:11212
- C:\Windows\System\XZiqVrS.exe
  C:\Windows\System\XZiqVrS.exe
  2⤵
  PID:9960
- C:\Windows\System\AmJPiFw.exe
  C:\Windows\System\AmJPiFw.exe
  2⤵
  PID:10444
- C:\Windows\System\rMxdTLp.exe
  C:\Windows\System\rMxdTLp.exe
  2⤵
  PID:10584
- C:\Windows\System\bsDATkk.exe
  C:\Windows\System\bsDATkk.exe
  2⤵
  PID:10688
- C:\Windows\System\nDfXUSz.exe
  C:\Windows\System\nDfXUSz.exe
  2⤵
  PID:10796
- C:\Windows\System\gjKBkBp.exe
  C:\Windows\System\gjKBkBp.exe
  2⤵
  PID:10848
- C:\Windows\System\AMgYljO.exe
  C:\Windows\System\AMgYljO.exe
  2⤵
  PID:11104
- C:\Windows\System\lAIliJd.exe
  C:\Windows\System\lAIliJd.exe
  2⤵
  PID:10500
- C:\Windows\System\LkJbNTD.exe
  C:\Windows\System\LkJbNTD.exe
  2⤵
  PID:10528
- C:\Windows\System\lVttAsI.exe
  C:\Windows\System\lVttAsI.exe
  2⤵
  PID:10964
- C:\Windows\System\NUiXZfF.exe
  C:\Windows\System\NUiXZfF.exe
  2⤵
  PID:10360
- C:\Windows\System\aPwglEl.exe
  C:\Windows\System\aPwglEl.exe
  2⤵
  PID:10416
- C:\Windows\System\GKkbIBi.exe
  C:\Windows\System\GKkbIBi.exe
  2⤵
  PID:11292
- C:\Windows\System\ZBIadFv.exe
  C:\Windows\System\ZBIadFv.exe
  2⤵
  PID:11324
- C:\Windows\System\qPUmNCz.exe
  C:\Windows\System\qPUmNCz.exe
  2⤵
  PID:11340
- C:\Windows\System\dpLbYeV.exe
  C:\Windows\System\dpLbYeV.exe
  2⤵
  PID:11372
- C:\Windows\System\KrCBwpE.exe
  C:\Windows\System\KrCBwpE.exe
  2⤵
  PID:11400
- C:\Windows\System\euUbkTc.exe
  C:\Windows\System\euUbkTc.exe
  2⤵
  PID:11436
- C:\Windows\System\AUMvSsg.exe
  C:\Windows\System\AUMvSsg.exe
  2⤵
  PID:11464
- C:\Windows\System\cKXdxBX.exe
  C:\Windows\System\cKXdxBX.exe
  2⤵
  PID:11492
- C:\Windows\System\eagNMLp.exe
  C:\Windows\System\eagNMLp.exe
  2⤵
  PID:11516
- C:\Windows\System\VaYsKRy.exe
  C:\Windows\System\VaYsKRy.exe
  2⤵
  PID:11532
- C:\Windows\System\hRqHUtR.exe
  C:\Windows\System\hRqHUtR.exe
  2⤵
  PID:11556
- C:\Windows\System\IFEGxTG.exe
  C:\Windows\System\IFEGxTG.exe
  2⤵
  PID:11572
- C:\Windows\System\SxZcvFD.exe
  C:\Windows\System\SxZcvFD.exe
  2⤵
  PID:11592
- C:\Windows\System\JIMnAzh.exe
  C:\Windows\System\JIMnAzh.exe
  2⤵
  PID:11616
- C:\Windows\System\uEmgdPF.exe
  C:\Windows\System\uEmgdPF.exe
  2⤵
  PID:11648
- C:\Windows\System\fZSCpSD.exe
  C:\Windows\System\fZSCpSD.exe
  2⤵
  PID:11676
- C:\Windows\System\HgSaHxo.exe
  C:\Windows\System\HgSaHxo.exe
  2⤵
  PID:11708
- C:\Windows\System\TPVGhdY.exe
  C:\Windows\System\TPVGhdY.exe
  2⤵
  PID:11728
- C:\Windows\System\ZznmOqh.exe
  C:\Windows\System\ZznmOqh.exe
  2⤵
  PID:11764
- C:\Windows\System\ZAVqaon.exe
  C:\Windows\System\ZAVqaon.exe
  2⤵
  PID:11792
- C:\Windows\System\TztmnpY.exe
  C:\Windows\System\TztmnpY.exe
  2⤵
  PID:11828
- C:\Windows\System\NwrcFxq.exe
  C:\Windows\System\NwrcFxq.exe
  2⤵
  PID:11848
- C:\Windows\System\yIIkLcu.exe
  C:\Windows\System\yIIkLcu.exe
  2⤵
  PID:11880
- C:\Windows\System\AQWShpT.exe
  C:\Windows\System\AQWShpT.exe
  2⤵
  PID:11908
- C:\Windows\System\AMVlUjN.exe
  C:\Windows\System\AMVlUjN.exe
  2⤵
  PID:11932
- C:\Windows\System\wBTswEp.exe
  C:\Windows\System\wBTswEp.exe
  2⤵
  PID:11960
- C:\Windows\System\OsaWdAW.exe
  C:\Windows\System\OsaWdAW.exe
  2⤵
  PID:11996
- C:\Windows\System\PMOqmzo.exe
  C:\Windows\System\PMOqmzo.exe
  2⤵
  PID:12016
- C:\Windows\System\fZWjxBf.exe
  C:\Windows\System\fZWjxBf.exe
  2⤵
  PID:12040
- C:\Windows\System\ChWfTys.exe
  C:\Windows\System\ChWfTys.exe
  2⤵
  PID:12068
- C:\Windows\System\MhHKVCs.exe
  C:\Windows\System\MhHKVCs.exe
  2⤵
  PID:12104
- C:\Windows\System\gPJYmVX.exe
  C:\Windows\System\gPJYmVX.exe
  2⤵
  PID:12128
- C:\Windows\System\HhioFeu.exe
  C:\Windows\System\HhioFeu.exe
  2⤵
  PID:12156
- C:\Windows\System\xClZFMY.exe
  C:\Windows\System\xClZFMY.exe
  2⤵
  PID:12184
- C:\Windows\System\BbTiPXa.exe
  C:\Windows\System\BbTiPXa.exe
  2⤵
  PID:12224
- C:\Windows\System\hCehUsH.exe
  C:\Windows\System\hCehUsH.exe
  2⤵
  PID:12272
- C:\Windows\System\wMfxKcB.exe
  C:\Windows\System\wMfxKcB.exe
  2⤵
  PID:10768
- C:\Windows\System\MFQAJze.exe
  C:\Windows\System\MFQAJze.exe
  2⤵
  PID:11276
- C:\Windows\System\sSZhKBM.exe
  C:\Windows\System\sSZhKBM.exe
  2⤵
  PID:11392
- C:\Windows\System\ezVfbEC.exe
  C:\Windows\System\ezVfbEC.exe
  2⤵
  PID:11384
- C:\Windows\System\LElKTff.exe
  C:\Windows\System\LElKTff.exe
  2⤵
  PID:11504
- C:\Windows\System\kKOiFpw.exe
  C:\Windows\System\kKOiFpw.exe
  2⤵
  PID:11480
- C:\Windows\System\OKucyFQ.exe
  C:\Windows\System\OKucyFQ.exe
  2⤵
  PID:11688
- C:\Windows\System\QTbbKTg.exe
  C:\Windows\System\QTbbKTg.exe
  2⤵
  PID:11660
- C:\Windows\System\ZJPvuDp.exe
  C:\Windows\System\ZJPvuDp.exe
  2⤵
  PID:11632
- C:\Windows\System\yhRwaYx.exe
  C:\Windows\System\yhRwaYx.exe
  2⤵
  PID:11888
- C:\Windows\System\aeJxFMI.exe
  C:\Windows\System\aeJxFMI.exe
  2⤵
  PID:11812
- C:\Windows\System\yDRNLLo.exe
  C:\Windows\System\yDRNLLo.exe
  2⤵
  PID:11864
- C:\Windows\System\rdDrXLc.exe
  C:\Windows\System\rdDrXLc.exe
  2⤵
  PID:11980
- C:\Windows\System\VvcFmxt.exe
  C:\Windows\System\VvcFmxt.exe
  2⤵
  PID:12084
- C:\Windows\System\QJCiwiG.exe
  C:\Windows\System\QJCiwiG.exe
  2⤵
  PID:12024
- C:\Windows\System\huzzxFS.exe
  C:\Windows\System\huzzxFS.exe
  2⤵
  PID:12192
- C:\Windows\System\jLgkMkA.exe
  C:\Windows\System\jLgkMkA.exe
  2⤵
  PID:12244
- C:\Windows\System\rSaeSqA.exe
  C:\Windows\System\rSaeSqA.exe
  2⤵
  PID:11352
- C:\Windows\System\gtgRxCq.exe
  C:\Windows\System\gtgRxCq.exe
  2⤵
  PID:11584
- C:\Windows\System\DJVpmpF.exe
  C:\Windows\System\DJVpmpF.exe
  2⤵
  PID:11636
- C:\Windows\System\opIjVJG.exe
  C:\Windows\System\opIjVJG.exe
  2⤵
  PID:11800
- C:\Windows\System\udBudiK.exe
  C:\Windows\System\udBudiK.exe
  2⤵
  PID:11876
- C:\Windows\System\qPVgSIl.exe
  C:\Windows\System\qPVgSIl.exe
  2⤵
  PID:12096
- C:\Windows\System\kSGdIWU.exe
  C:\Windows\System\kSGdIWU.exe
  2⤵
  PID:11332
- C:\Windows\System\kvvNELR.exe
  C:\Windows\System\kvvNELR.exe
  2⤵
  PID:11588
- C:\Windows\System\YHacqme.exe
  C:\Windows\System\YHacqme.exe
  2⤵
  PID:11424
- C:\Windows\System\roBlyPP.exe
  C:\Windows\System\roBlyPP.exe
  2⤵
  PID:12312
- C:\Windows\System\GyxtLVi.exe
  C:\Windows\System\GyxtLVi.exe
  2⤵
  PID:12328
- C:\Windows\System\tukleLJ.exe
  C:\Windows\System\tukleLJ.exe
  2⤵
  PID:12360
- C:\Windows\System\ctEsYTB.exe
  C:\Windows\System\ctEsYTB.exe
  2⤵
  PID:12392
- C:\Windows\System\WTfDmft.exe
  C:\Windows\System\WTfDmft.exe
  2⤵
  PID:12416
- C:\Windows\System\IgusROu.exe
  C:\Windows\System\IgusROu.exe
  2⤵
  PID:12440
- C:\Windows\System\jlfECeL.exe
  C:\Windows\System\jlfECeL.exe
  2⤵
  PID:12472
- C:\Windows\System\fXAFaWv.exe
  C:\Windows\System\fXAFaWv.exe
  2⤵
  PID:12508
- C:\Windows\System\sTBLxCN.exe
  C:\Windows\System\sTBLxCN.exe
  2⤵
  PID:12524
- C:\Windows\System\hmYJjlx.exe
  C:\Windows\System\hmYJjlx.exe
  2⤵
  PID:12556
- C:\Windows\System\VTZlRde.exe
  C:\Windows\System\VTZlRde.exe
  2⤵
  PID:12580
- C:\Windows\System\nTSFvCL.exe
  C:\Windows\System\nTSFvCL.exe
  2⤵
  PID:12612
- C:\Windows\System\CIUXTDX.exe
  C:\Windows\System\CIUXTDX.exe
  2⤵
  PID:12640
- C:\Windows\System\qTTDYnt.exe
  C:\Windows\System\qTTDYnt.exe
  2⤵
  PID:12660
- C:\Windows\System\vMhWVtz.exe
  C:\Windows\System\vMhWVtz.exe
  2⤵
  PID:12684
- C:\Windows\System\aZeKBoB.exe
  C:\Windows\System\aZeKBoB.exe
  2⤵
  PID:12704
- C:\Windows\System\kQHHujs.exe
  C:\Windows\System\kQHHujs.exe
  2⤵
  PID:12768
- C:\Windows\System\WCxWNeE.exe
  C:\Windows\System\WCxWNeE.exe
  2⤵
  PID:12788
- C:\Windows\System\fyRGJiB.exe
  C:\Windows\System\fyRGJiB.exe
  2⤵
  PID:12820
- C:\Windows\System\sIYJMHx.exe
  C:\Windows\System\sIYJMHx.exe
  2⤵
  PID:12840
- C:\Windows\System\QogdKIQ.exe
  C:\Windows\System\QogdKIQ.exe
  2⤵
  PID:12860
- C:\Windows\System\eyITorr.exe
  C:\Windows\System\eyITorr.exe
  2⤵
  PID:12884
- C:\Windows\System\IsnEzZz.exe
  C:\Windows\System\IsnEzZz.exe
  2⤵
  PID:12912
- C:\Windows\System\lpIrBlc.exe
  C:\Windows\System\lpIrBlc.exe
  2⤵
  PID:12932
- C:\Windows\System\YQpNfDd.exe
  C:\Windows\System\YQpNfDd.exe
  2⤵
  PID:12968
- C:\Windows\System\YVXpDLB.exe
  C:\Windows\System\YVXpDLB.exe
  2⤵
  PID:12992
- C:\Windows\System\SlsCXOS.exe
  C:\Windows\System\SlsCXOS.exe
  2⤵
  PID:13024
- C:\Windows\System\UrNXZHS.exe
  C:\Windows\System\UrNXZHS.exe
  2⤵
  PID:13060
- C:\Windows\System\HJndjQy.exe
  C:\Windows\System\HJndjQy.exe
  2⤵
  PID:13092
- C:\Windows\System\hURSxug.exe
  C:\Windows\System\hURSxug.exe
  2⤵
  PID:13116
- C:\Windows\System\GhXPwKC.exe
  C:\Windows\System\GhXPwKC.exe
  2⤵
  PID:13144
- C:\Windows\System\WLSfHcV.exe
  C:\Windows\System\WLSfHcV.exe
  2⤵
  PID:13168
- C:\Windows\System\cZUjKgi.exe
  C:\Windows\System\cZUjKgi.exe
  2⤵
  PID:13188
- C:\Windows\System\AQfuWRq.exe
  C:\Windows\System\AQfuWRq.exe
  2⤵
  PID:13224
- C:\Windows\System\dyuucIG.exe
  C:\Windows\System\dyuucIG.exe
  2⤵
  PID:13252
- C:\Windows\System\xsWDatc.exe
  C:\Windows\System\xsWDatc.exe
  2⤵
  PID:13276
- C:\Windows\System\dXkkHvr.exe
  C:\Windows\System\dXkkHvr.exe
  2⤵
  PID:13304
- C:\Windows\System\BxDIYcw.exe
  C:\Windows\System\BxDIYcw.exe
  2⤵
  PID:12436
- C:\Windows\System\qZlIeJT.exe
  C:\Windows\System\qZlIeJT.exe
  2⤵
  PID:12460
- C:\Windows\System\PwkaoRq.exe
  C:\Windows\System\PwkaoRq.exe
  2⤵
  PID:12544
- C:\Windows\System\tIDJHWj.exe
  C:\Windows\System\tIDJHWj.exe
  2⤵
  PID:12564
- C:\Windows\System\ePYLAaI.exe
  C:\Windows\System\ePYLAaI.exe
  2⤵
  PID:12600
- C:\Windows\System\fwgfjlz.exe
  C:\Windows\System\fwgfjlz.exe
  2⤵
  PID:12676
- C:\Windows\System\wzSOpbR.exe
  C:\Windows\System\wzSOpbR.exe
  2⤵
  PID:12804
- C:\Windows\System\iuoExqP.exe
  C:\Windows\System\iuoExqP.exe
  2⤵
  PID:12856
- C:\Windows\System\BWvLuOI.exe
  C:\Windows\System\BWvLuOI.exe
  2⤵
  PID:12832
- C:\Windows\System\kcWkHNh.exe
  C:\Windows\System\kcWkHNh.exe
  2⤵
  PID:12924
- C:\Windows\System\wlEMiRh.exe
  C:\Windows\System\wlEMiRh.exe
  2⤵
  PID:13048
- C:\Windows\System\DGlqluO.exe
  C:\Windows\System\DGlqluO.exe
  2⤵
  PID:13004
- C:\Windows\System\lKkGEzz.exe
  C:\Windows\System\lKkGEzz.exe
  2⤵
  PID:13012
- C:\Windows\System\yzurZDW.exe
  C:\Windows\System\yzurZDW.exe
  2⤵
  PID:13132
- C:\Windows\System\eRdBSXc.exe
  C:\Windows\System\eRdBSXc.exe
  2⤵
  PID:13196
- C:\Windows\System\dZFDrwf.exe
  C:\Windows\System\dZFDrwf.exe
  2⤵
  PID:12080
- C:\Windows\System\bHAeFIl.exe
  C:\Windows\System\bHAeFIl.exe
  2⤵
  PID:13244
- C:\Windows\System\HSnTWzB.exe
  C:\Windows\System\HSnTWzB.exe
  2⤵
  PID:12452
- C:\Windows\System\WxsVOIv.exe
  C:\Windows\System\WxsVOIv.exe
  2⤵
  PID:12624
- C:\Windows\System\WUZYiZz.exe
  C:\Windows\System\WUZYiZz.exe
  2⤵
  PID:12796
- C:\Windows\System\ZWFbUta.exe
  C:\Windows\System\ZWFbUta.exe
  2⤵
  PID:12904
- C:\Windows\System\gypqbAW.exe
  C:\Windows\System\gypqbAW.exe
  2⤵
  PID:12900
- C:\Windows\System\pnfceyK.exe
  C:\Windows\System\pnfceyK.exe
  2⤵
  PID:13044
- C:\Windows\System\nmmfBjt.exe
  C:\Windows\System\nmmfBjt.exe
  2⤵
  PID:13260
- C:\Windows\System\CGJEnTh.exe
  C:\Windows\System\CGJEnTh.exe
  2⤵
  PID:12348
- C:\Windows\System\KXyQDKA.exe
  C:\Windows\System\KXyQDKA.exe
  2⤵
  PID:12384
- C:\Windows\System\pQgSUUK.exe
  C:\Windows\System\pQgSUUK.exe
  2⤵
  PID:13084
- C:\Windows\System\lxtUDyJ.exe
  C:\Windows\System\lxtUDyJ.exe
  2⤵
  PID:12488
- C:\Windows\System\LNHvoRD.exe
  C:\Windows\System\LNHvoRD.exe
  2⤵
  PID:13300
- C:\Windows\System\npYiePi.exe
  C:\Windows\System\npYiePi.exe
  2⤵
  PID:13340
- C:\Windows\System\BueDeTo.exe
  C:\Windows\System\BueDeTo.exe
  2⤵
  PID:13368
- C:\Windows\System\cyiLxMl.exe
  C:\Windows\System\cyiLxMl.exe
  2⤵
  PID:13400
- C:\Windows\System\ilBtfOl.exe
  C:\Windows\System\ilBtfOl.exe
  2⤵
  PID:13420
- C:\Windows\System\FgSlIOH.exe
  C:\Windows\System\FgSlIOH.exe
  2⤵
  PID:13436
- C:\Windows\System\qHszRSv.exe
  C:\Windows\System\qHszRSv.exe
  2⤵
  PID:13468
- C:\Windows\System\SAfMgaa.exe
  C:\Windows\System\SAfMgaa.exe
  2⤵
  PID:13488
- C:\Windows\System\qOaAAVk.exe
  C:\Windows\System\qOaAAVk.exe
  2⤵
  PID:13516
- C:\Windows\System\fHRoUYF.exe
  C:\Windows\System\fHRoUYF.exe
  2⤵
  PID:13536
- C:\Windows\System\ykqUOSV.exe
  C:\Windows\System\ykqUOSV.exe
  2⤵
  PID:13560
- C:\Windows\System\qSWvSxv.exe
  C:\Windows\System\qSWvSxv.exe
  2⤵
  PID:13592
- C:\Windows\System\afmHwIG.exe
  C:\Windows\System\afmHwIG.exe
  2⤵
  PID:13620
- C:\Windows\System\pjLJSXT.exe
  C:\Windows\System\pjLJSXT.exe
  2⤵
  PID:13644
- C:\Windows\System\VBngQGc.exe
  C:\Windows\System\VBngQGc.exe
  2⤵
  PID:13668
- C:\Windows\System\XYPLdOL.exe
  C:\Windows\System\XYPLdOL.exe
  2⤵
  PID:13708
- C:\Windows\System\rfJAbRF.exe
  C:\Windows\System\rfJAbRF.exe
  2⤵
  PID:13744
- C:\Windows\System\qikmrcb.exe
  C:\Windows\System\qikmrcb.exe
  2⤵
  PID:13768
- C:\Windows\System\eQqiyAK.exe
  C:\Windows\System\eQqiyAK.exe
  2⤵
  PID:13792
- C:\Windows\System\uMlbXSR.exe
  C:\Windows\System\uMlbXSR.exe
  2⤵
  PID:13832
- C:\Windows\System\FuwEOrk.exe
  C:\Windows\System\FuwEOrk.exe
  2⤵
  PID:13848
- C:\Windows\System\NRcQvvj.exe
  C:\Windows\System\NRcQvvj.exe
  2⤵
  PID:13868
- C:\Windows\System\jdZxtVT.exe
  C:\Windows\System\jdZxtVT.exe
  2⤵
  PID:13888
- C:\Windows\System\HgXMyQB.exe
  C:\Windows\System\HgXMyQB.exe
  2⤵
  PID:13924
- C:\Windows\System\kLuKVcy.exe
  C:\Windows\System\kLuKVcy.exe
  2⤵
  PID:13944
- C:\Windows\System\MWXzLma.exe
  C:\Windows\System\MWXzLma.exe
  2⤵
  PID:13976
- C:\Windows\System\VuNhxwi.exe
  C:\Windows\System\VuNhxwi.exe
  2⤵
  PID:14008
- C:\Windows\System\oVgMmRs.exe
  C:\Windows\System\oVgMmRs.exe
  2⤵
  PID:14052
- C:\Windows\System\OGnQkBq.exe
  C:\Windows\System\OGnQkBq.exe
  2⤵
  PID:14076
- C:\Windows\System\bdxtxig.exe
  C:\Windows\System\bdxtxig.exe
  2⤵
  PID:14104
- C:\Windows\System\uXpngDt.exe
  C:\Windows\System\uXpngDt.exe
  2⤵
  PID:14132
- C:\Windows\System\aDoFCIc.exe
  C:\Windows\System\aDoFCIc.exe
  2⤵
  PID:14160
- C:\Windows\System\eKqBwpx.exe
  C:\Windows\System\eKqBwpx.exe
  2⤵
  PID:14180
- C:\Windows\System\zWabINI.exe
  C:\Windows\System\zWabINI.exe
  2⤵
  PID:14200
- C:\Windows\System\qjNYlRh.exe
  C:\Windows\System\qjNYlRh.exe
  2⤵
  PID:14232
- C:\Windows\System\lNpSMRS.exe
  C:\Windows\System\lNpSMRS.exe
  2⤵
  PID:14248
- C:\Windows\System\gmUygcG.exe
  C:\Windows\System\gmUygcG.exe
  2⤵
  PID:14284
- C:\Windows\System\QSdWJwk.exe
  C:\Windows\System\QSdWJwk.exe
  2⤵
  PID:14304
- C:\Windows\System\jZVAsvz.exe
  C:\Windows\System\jZVAsvz.exe
  2⤵
  PID:14332
- C:\Windows\System\HGucsyG.exe
  C:\Windows\System\HGucsyG.exe
  2⤵
  PID:12776
- C:\Windows\System\GgSYFib.exe
  C:\Windows\System\GgSYFib.exe
  2⤵
  PID:13076
- C:\Windows\System\jjewood.exe
  C:\Windows\System\jjewood.exe
  2⤵
  PID:13408
- C:\Windows\System\SVhkwIr.exe
  C:\Windows\System\SVhkwIr.exe
  2⤵
  PID:13632
- C:\Windows\System\lqeoliQ.exe
  C:\Windows\System\lqeoliQ.exe
  2⤵
  PID:13688
- C:\Windows\System\lvmPjiK.exe
  C:\Windows\System\lvmPjiK.exe
  2⤵
  PID:13584
- C:\Windows\System\RwjiDxd.exe
  C:\Windows\System\RwjiDxd.exe
  2⤵
  PID:13524
- C:\Windows\System\BgIQUXn.exe
  C:\Windows\System\BgIQUXn.exe
  2⤵
  PID:13828
- C:\Windows\System\EmPFduq.exe
  C:\Windows\System\EmPFduq.exe
  2⤵
  PID:13804
- C:\Windows\System\SpOhMIq.exe
  C:\Windows\System\SpOhMIq.exe
  2⤵
  PID:13884
- C:\Windows\System\JFhrMHx.exe
  C:\Windows\System\JFhrMHx.exe
  2⤵
  PID:13940
- C:\Windows\System\YJMyyUX.exe
  C:\Windows\System\YJMyyUX.exe
  2⤵
  PID:13968
- C:\Windows\System\lQobyXr.exe
  C:\Windows\System\lQobyXr.exe
  2⤵
  PID:14024
- C:\Windows\System\oreJqwp.exe
  C:\Windows\System\oreJqwp.exe
  2⤵
  PID:14088
- C:\Windows\System\GVpkwhr.exe
  C:\Windows\System\GVpkwhr.exe
  2⤵
  PID:14148
- C:\Windows\System\AWlDDfY.exe
  C:\Windows\System\AWlDDfY.exe
  2⤵
  PID:14192
- C:\Windows\System\iyNTixx.exe
  C:\Windows\System\iyNTixx.exe
  2⤵
  PID:13376
- C:\Windows\System\EYTSmQw.exe
  C:\Windows\System\EYTSmQw.exe
  2⤵
  PID:14296
- C:\Windows\System\TBixaZB.exe
  C:\Windows\System\TBixaZB.exe
  2⤵
  PID:13432
- C:\Windows\System\RWixGxr.exe
  C:\Windows\System\RWixGxr.exe
  2⤵
  PID:13680
- C:\Windows\System\bLjtsmI.exe
  C:\Windows\System\bLjtsmI.exe
  2⤵
  PID:13660
- C:\Windows\System\HifTIIc.exe
  C:\Windows\System\HifTIIc.exe
  2⤵
  PID:13912
- C:\Windows\System\ZgEUErv.exe
  C:\Windows\System\ZgEUErv.exe
  2⤵
  PID:14240
- C:\Windows\System\esNTcQt.exe
  C:\Windows\System\esNTcQt.exe
  2⤵
  PID:14344
- C:\Windows\System\xqwRvED.exe
  C:\Windows\System\xqwRvED.exe
  2⤵
  PID:14372
- C:\Windows\System\hhsjYEU.exe
  C:\Windows\System\hhsjYEU.exe
  2⤵
  PID:14396
- C:\Windows\System\NOIrSHp.exe
  C:\Windows\System\NOIrSHp.exe
  2⤵
  PID:14428
- C:\Windows\System\bnXxbqP.exe
  C:\Windows\System\bnXxbqP.exe
  2⤵
  PID:14452
- C:\Windows\System\NDFjNCL.exe
  C:\Windows\System\NDFjNCL.exe
  2⤵
  PID:14480
- C:\Windows\System\GeMtyjW.exe
  C:\Windows\System\GeMtyjW.exe
  2⤵
  PID:14500
- C:\Windows\System\UDDnVlr.exe
  C:\Windows\System\UDDnVlr.exe
  2⤵
  PID:14544
- C:\Windows\System\tClkWXB.exe
  C:\Windows\System\tClkWXB.exe
  2⤵
  PID:14560
- C:\Windows\System\tAIrySz.exe
  C:\Windows\System\tAIrySz.exe
  2⤵
  PID:14588
- C:\Windows\System\GMnAAba.exe
  C:\Windows\System\GMnAAba.exe
  2⤵
  PID:14620
- C:\Windows\System\kVGzzDO.exe
  C:\Windows\System\kVGzzDO.exe
  2⤵
  PID:14656
- C:\Windows\System\CColFEf.exe
  C:\Windows\System\CColFEf.exe
  2⤵
  PID:14672
- C:\Windows\System\NOsTrth.exe
  C:\Windows\System\NOsTrth.exe
  2⤵
  PID:14688
- C:\Windows\System\WimOqqZ.exe
  C:\Windows\System\WimOqqZ.exe
  2⤵
  PID:14720
- C:\Windows\System\gffGCMX.exe
  C:\Windows\System\gffGCMX.exe
  2⤵
  PID:14756
- C:\Windows\System\sjBlIJB.exe
  C:\Windows\System\sjBlIJB.exe
  2⤵
  PID:14776
- C:\Windows\System\rIYUALi.exe
  C:\Windows\System\rIYUALi.exe
  2⤵
  PID:14800
- C:\Windows\System\AtjgJem.exe
  C:\Windows\System\AtjgJem.exe
  2⤵
  PID:14820
- C:\Windows\System\EVDujCQ.exe
  C:\Windows\System\EVDujCQ.exe
  2⤵
  PID:14848
- C:\Windows\System\duqZrMP.exe
  C:\Windows\System\duqZrMP.exe
  2⤵
  PID:14872
- C:\Windows\System\bSOpplv.exe
  C:\Windows\System\bSOpplv.exe
  2⤵
  PID:14900
- C:\Windows\System\fJTUtXU.exe
  C:\Windows\System\fJTUtXU.exe
  2⤵
  PID:14920
- C:\Windows\System\MGiiZxu.exe
  C:\Windows\System\MGiiZxu.exe
  2⤵
  PID:14952
- C:\Windows\System\grfffGJ.exe
  C:\Windows\System\grfffGJ.exe
  2⤵
  PID:14972
- C:\Windows\System\jtrBLww.exe
  C:\Windows\System\jtrBLww.exe
  2⤵
  PID:14996
- C:\Windows\System\pmXsaUL.exe
  C:\Windows\System\pmXsaUL.exe
  2⤵
  PID:15032
- C:\Windows\System\tNaYVLT.exe
  C:\Windows\System\tNaYVLT.exe
  2⤵
  PID:15060
- C:\Windows\System\nhgwdYH.exe
  C:\Windows\System\nhgwdYH.exe
  2⤵
  PID:15080
- C:\Windows\System\YfRfuKb.exe
  C:\Windows\System\YfRfuKb.exe
  2⤵
  PID:15112
- C:\Windows\System\DCeTVZb.exe
  C:\Windows\System\DCeTVZb.exe
  2⤵
  PID:15128
- C:\Windows\System\ASyByFX.exe
  C:\Windows\System\ASyByFX.exe
  2⤵
  PID:15156
- C:\Windows\System\kKdWrHq.exe
  C:\Windows\System\kKdWrHq.exe
  2⤵
  PID:15204
- C:\Windows\System\scORyjC.exe
  C:\Windows\System\scORyjC.exe
  2⤵
  PID:15236
- C:\Windows\System\ZMAWOWx.exe
  C:\Windows\System\ZMAWOWx.exe
  2⤵
  PID:15260
- C:\Windows\System\AwfURoM.exe
  C:\Windows\System\AwfURoM.exe
  2⤵
  PID:15288
- C:\Windows\System\sbDyIca.exe
  C:\Windows\System\sbDyIca.exe
  2⤵
  PID:15304
- C:\Windows\System\cBGEvnE.exe
  C:\Windows\System\cBGEvnE.exe
  2⤵
  PID:15320
- C:\Windows\System\DaWdSie.exe
  C:\Windows\System\DaWdSie.exe
  2⤵
  PID:13820
- C:\Windows\System\wMPNECi.exe
  C:\Windows\System\wMPNECi.exe
  2⤵
  PID:14328
- C:\Windows\System\tVdxNGX.exe
  C:\Windows\System\tVdxNGX.exe
  2⤵
  PID:13604
- C:\Windows\System\vWIYIRi.exe
  C:\Windows\System\vWIYIRi.exe
  2⤵
  PID:13532
- C:\Windows\System\QyyLBmF.exe
  C:\Windows\System\QyyLBmF.exe
  2⤵
  PID:13552
- C:\Windows\System\VUxsyst.exe
  C:\Windows\System\VUxsyst.exe
  2⤵
  PID:13156
- C:\Windows\System\sEiTOcI.exe
  C:\Windows\System\sEiTOcI.exe
  2⤵
  PID:13956
- C:\Windows\System\kjEzfwT.exe
  C:\Windows\System\kjEzfwT.exe
  2⤵
  PID:14360
- C:\Windows\System\tsuedqO.exe
  C:\Windows\System\tsuedqO.exe
  2⤵
  PID:14444
- C:\Windows\System\nsWSrLZ.exe
  C:\Windows\System\nsWSrLZ.exe
  2⤵
  PID:14524
- C:\Windows\System\hKLHiSn.exe
  C:\Windows\System\hKLHiSn.exe
  2⤵
  PID:14572
- C:\Windows\System\jbARzhB.exe
  C:\Windows\System\jbARzhB.exe
  2⤵
  PID:14860
- C:\Windows\System\EGtBDpZ.exe
  C:\Windows\System\EGtBDpZ.exe
  2⤵
  PID:14948
- C:\Windows\System\rNIHBzz.exe
  C:\Windows\System\rNIHBzz.exe
  2⤵
  PID:14892
- C:\Windows\System\MohWIDq.exe
  C:\Windows\System\MohWIDq.exe
  2⤵
  PID:15108
- C:\Windows\System\LdTSPKR.exe
  C:\Windows\System\LdTSPKR.exe
  2⤵
  PID:15072
- C:\Windows\System\gVfXEpo.exe
  C:\Windows\System\gVfXEpo.exe
  2⤵
  PID:15180
- C:\Windows\System\xNsWgCV.exe
  C:\Windows\System\xNsWgCV.exe
  2⤵
  PID:15012
- C:\Windows\System\dpyZyWb.exe
  C:\Windows\System\dpyZyWb.exe
  2⤵
  PID:15256
- C:\Windows\System\HGGtxdG.exe
  C:\Windows\System\HGGtxdG.exe
  2⤵
  PID:14320
- C:\Windows\System\AfzYmVd.exe
  C:\Windows\System\AfzYmVd.exe
  2⤵
  PID:15124
- C:\Windows\System\KHLfeGZ.exe
  C:\Windows\System\KHLfeGZ.exe
  2⤵
  PID:15252
- C:\Windows\System\hGESVuz.exe
  C:\Windows\System\hGESVuz.exe
  2⤵
  PID:14216
- C:\Windows\System\mywsVlt.exe
  C:\Windows\System\mywsVlt.exe
  2⤵
  PID:13664
- C:\Windows\System\HkullHa.exe
  C:\Windows\System\HkullHa.exe
  2⤵
  PID:15100
- C:\Windows\System\BtbfwsG.exe
  C:\Windows\System\BtbfwsG.exe
  2⤵
  PID:14704
- C:\Windows\System\TSDQBoN.exe
  C:\Windows\System\TSDQBoN.exe
  2⤵
  PID:15076
- C:\Windows\System\SNhcSRR.exe
  C:\Windows\System\SNhcSRR.exe
  2⤵
  PID:15372
- C:\Windows\System\VinFTZy.exe
  C:\Windows\System\VinFTZy.exe
  2⤵
  PID:15388
- C:\Windows\System\ZGJkoMS.exe
  C:\Windows\System\ZGJkoMS.exe
  2⤵
  PID:15404
- C:\Windows\System\ihtHoAq.exe
  C:\Windows\System\ihtHoAq.exe
  2⤵
  PID:15436
- C:\Windows\System\azhSCYM.exe
  C:\Windows\System\azhSCYM.exe
  2⤵
  PID:15472
- C:\Windows\System\KhghjFm.exe
  C:\Windows\System\KhghjFm.exe
  2⤵
  PID:15492
- C:\Windows\System\ZHOfZaC.exe
  C:\Windows\System\ZHOfZaC.exe
  2⤵
  PID:15520
- C:\Windows\System\iXZVoke.exe
  C:\Windows\System\iXZVoke.exe
  2⤵
  PID:15544
- C:\Windows\System\pyDccUB.exe
  C:\Windows\System\pyDccUB.exe
  2⤵
  PID:15584
- C:\Windows\System\emmWvXU.exe
  C:\Windows\System\emmWvXU.exe
  2⤵
  PID:15604
- C:\Windows\System\geHhrHt.exe
  C:\Windows\System\geHhrHt.exe
  2⤵
  PID:15628
- C:\Windows\System\sdYzHxE.exe
  C:\Windows\System\sdYzHxE.exe
  2⤵
  PID:15656
- C:\Windows\System\LlmehMe.exe
  C:\Windows\System\LlmehMe.exe
  2⤵
  PID:15680
- C:\Windows\System\hkqmZxe.exe
  C:\Windows\System\hkqmZxe.exe
  2⤵
  PID:15708
- C:\Windows\System\tfiNiID.exe
  C:\Windows\System\tfiNiID.exe
  2⤵
  PID:15728
- C:\Windows\System\qYnaVIA.exe
  C:\Windows\System\qYnaVIA.exe
  2⤵
  PID:15764
- C:\Windows\System\JqDDCPR.exe
  C:\Windows\System\JqDDCPR.exe
  2⤵
  PID:15788
- C:\Windows\System\zgPFGyz.exe
  C:\Windows\System\zgPFGyz.exe
  2⤵
  PID:15816
- C:\Windows\System\BGTGQZn.exe
  C:\Windows\System\BGTGQZn.exe
  2⤵
  PID:15848
- C:\Windows\System\xsUhLTw.exe
  C:\Windows\System\xsUhLTw.exe
  2⤵
  PID:15872
- C:\Windows\System\UWziEdY.exe
  C:\Windows\System\UWziEdY.exe
  2⤵
  PID:15904
- C:\Windows\System\BLTQKgC.exe
  C:\Windows\System\BLTQKgC.exe
  2⤵
  PID:15920
- C:\Windows\System\AMHlPJO.exe
  C:\Windows\System\AMHlPJO.exe
  2⤵
  PID:15944
- C:\Windows\System\FYMpufG.exe
  C:\Windows\System\FYMpufG.exe
  2⤵
  PID:15960
- C:\Windows\System\EvdXwvE.exe
  C:\Windows\System\EvdXwvE.exe
  2⤵
  PID:15992
- C:\Windows\System\oBrZSmd.exe
  C:\Windows\System\oBrZSmd.exe
  2⤵
  PID:16008
- C:\Windows\System\lyJYMEr.exe
  C:\Windows\System\lyJYMEr.exe
  2⤵
  PID:16024
- C:\Windows\System\jhpUcLM.exe
  C:\Windows\System\jhpUcLM.exe
  2⤵
  PID:16064
- C:\Windows\System\ngmdUMV.exe
  C:\Windows\System\ngmdUMV.exe
  2⤵
  PID:16092
- C:\Windows\System\LatJHKh.exe
  C:\Windows\System\LatJHKh.exe
  2⤵
  PID:16120
- C:\Windows\System\PIMOWTG.exe
  C:\Windows\System\PIMOWTG.exe
  2⤵
  PID:16152
- C:\Windows\System\CcNRKfK.exe
  C:\Windows\System\CcNRKfK.exe
  2⤵
  PID:16176
- C:\Windows\System\sHWTMxU.exe
  C:\Windows\System\sHWTMxU.exe
  2⤵
  PID:16208
- C:\Windows\System\JLcNDfk.exe
  C:\Windows\System\JLcNDfk.exe
  2⤵
  PID:16232
- C:\Windows\System\UxvQTfW.exe
  C:\Windows\System\UxvQTfW.exe
  2⤵
  PID:16260
- C:\Windows\System\rbuxiBr.exe
  C:\Windows\System\rbuxiBr.exe
  2⤵
  PID:16284
- C:\Windows\System\StwNyij.exe
  C:\Windows\System\StwNyij.exe
  2⤵
  PID:16304
- C:\Windows\System\gwfORoB.exe
  C:\Windows\System\gwfORoB.exe
  2⤵
  PID:16332
- C:\Windows\System\lqrBBmQ.exe
  C:\Windows\System\lqrBBmQ.exe
  2⤵
  PID:16364
- C:\Windows\System\iAWmHeQ.exe
  C:\Windows\System\iAWmHeQ.exe
  2⤵
  PID:14840
- C:\Windows\System\HpoViiJ.exe
  C:\Windows\System\HpoViiJ.exe
  2⤵
  PID:14580
- C:\Windows\System\PggcQQQ.exe
  C:\Windows\System\PggcQQQ.exe
  2⤵
  PID:15140
- C:\Windows\System\DkgARkn.exe
  C:\Windows\System\DkgARkn.exe
  2⤵
  PID:15448
- C:\Windows\System\UTNAgym.exe
  C:\Windows\System\UTNAgym.exe
  2⤵
  PID:14276
- C:\Windows\System\uYimxGY.exe
  C:\Windows\System\uYimxGY.exe
  2⤵
  PID:14552
- C:\Windows\System\fDqBwXU.exe
  C:\Windows\System\fDqBwXU.exe
  2⤵
  PID:15532
- C:\Windows\System\aBPMeYZ.exe
  C:\Windows\System\aBPMeYZ.exe
  2⤵
  PID:15620
- C:\Windows\System\xCLuWWN.exe
  C:\Windows\System\xCLuWWN.exe
  2⤵
  PID:15644
- C:\Windows\System\LhyfsWg.exe
  C:\Windows\System\LhyfsWg.exe
  2⤵
  PID:15572
- C:\Windows\System\EPivGUp.exe
  C:\Windows\System\EPivGUp.exe
  2⤵
  PID:15668
- C:\Windows\System\UUPHuMv.exe
  C:\Windows\System\UUPHuMv.exe
  2⤵
  PID:15972
- C:\Windows\System\BRoDWFF.exe
  C:\Windows\System\BRoDWFF.exe
  2⤵
  PID:15800
- C:\Windows\System\hZGZdSh.exe
  C:\Windows\System\hZGZdSh.exe
  2⤵
  PID:16048
- C:\Windows\System\buJNvyG.exe
  C:\Windows\System\buJNvyG.exe
  2⤵
  PID:15696
- C:\Windows\System\tJKKPlr.exe
  C:\Windows\System\tJKKPlr.exe
  2⤵
  PID:16200
- C:\Windows\System\lYIvxBg.exe
  C:\Windows\System\lYIvxBg.exe
  2⤵
  PID:16072
- C:\Windows\System\QmVMQfE.exe
  C:\Windows\System\QmVMQfE.exe
  2⤵
  PID:16140
- C:\Windows\System\ZKqbmMD.exe
  C:\Windows\System\ZKqbmMD.exe
  2⤵
  PID:16320
- C:\Windows\System\zUIhLHg.exe
  C:\Windows\System\zUIhLHg.exe
  2⤵
  PID:16376
- C:\Windows\System\YevKUeU.exe
  C:\Windows\System\YevKUeU.exe
  2⤵
  PID:14968
- C:\Windows\System\tkJqflI.exe
  C:\Windows\System\tkJqflI.exe
  2⤵
  PID:15248
- C:\Windows\System\KUFTLGp.exe
  C:\Windows\System\KUFTLGp.exe
  2⤵
  PID:14932
- C:\Windows\System\yPVTEKJ.exe
  C:\Windows\System\yPVTEKJ.exe
  2⤵
  PID:15740
- C:\Windows\System\ybhJXIw.exe
  C:\Windows\System\ybhJXIw.exe
  2⤵
  PID:16316
- C:\Windows\System\drIBAAo.exe
  C:\Windows\System\drIBAAo.exe
  2⤵
  PID:15936
- C:\Windows\System\VfowhQH.exe
  C:\Windows\System\VfowhQH.exe
  2⤵
  PID:15380
- C:\Windows\System\xQZQexl.exe
  C:\Windows\System\xQZQexl.exe
  2⤵
  PID:15956
- C:\Windows\System\uQKwnlJ.exe
  C:\Windows\System\uQKwnlJ.exe
  2⤵
  PID:16388
- C:\Windows\System\FmEpYPu.exe
  C:\Windows\System\FmEpYPu.exe
  2⤵
  PID:16428
- C:\Windows\System\tuTBAHv.exe
  C:\Windows\System\tuTBAHv.exe
  2⤵
  PID:16468
- C:\Windows\System\yAPAEGa.exe
  C:\Windows\System\yAPAEGa.exe
  2⤵
  PID:16492
- C:\Windows\System\bLiWPSl.exe
  C:\Windows\System\bLiWPSl.exe
  2⤵
  PID:16532
- C:\Windows\System\yIEfAcr.exe
  C:\Windows\System\yIEfAcr.exe
  2⤵
  PID:16560
- C:\Windows\System\rkDhubP.exe
  C:\Windows\System\rkDhubP.exe
  2⤵
  PID:16592
- C:\Windows\System\vJRDVIj.exe
  C:\Windows\System\vJRDVIj.exe
  2⤵
  PID:16624
- C:\Windows\System\atqrscq.exe
  C:\Windows\System\atqrscq.exe
  2⤵
  PID:16652
- C:\Windows\System\YXQFAFM.exe
  C:\Windows\System\YXQFAFM.exe
  2⤵
  PID:16680
- C:\Windows\System\DMWpAYZ.exe
  C:\Windows\System\DMWpAYZ.exe
  2⤵
  PID:16708
- C:\Windows\System\eDuWqXv.exe
  C:\Windows\System\eDuWqXv.exe
  2⤵
  PID:16880
- C:\Windows\System\aDDIYhT.exe
  C:\Windows\System\aDDIYhT.exe
  2⤵
  PID:16936
- C:\Windows\System\txmRnLs.exe
  C:\Windows\System\txmRnLs.exe
  2⤵
  PID:16964

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:17340

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\CKWGHVt.exe

Filesize
1.8MB

MD5
7ac02715eca3da17704ed4ab03613d3c

SHA1
89e03a98aa7b5a5c2dba6ecc583d6cfbad8c41b2

SHA256
8ac81bc819bb94d2b3a2213794e1cd37c44d142346edebcbb6e15f57c5a1dd9f

SHA512
d5c29f7847d39b3641fef190c7c795eadf5afabca2a609a0ef67ee934d0bd72531f5a47369656d38b9361fb2b3425b1570cd76ca399266995116c715e5cf5899

Download Submit
C:\Windows\System\DPdkmhi.exe

Filesize
1.8MB

MD5
31c1b00d59816a121311c1865762fa49

SHA1
708cb9f42fe5897775c092343a906ddc7fa393ed

SHA256
51c49e1dcfc6ecf9beb39602324860cdd5964ce9af99f4624b3b92bfc30324df

SHA512
6e11a60ecc6bef4abd1121f1babf6485e147adc89c1c218ccc580c33333f4c8ead6e6b2f407d1687209c901f3a1a7b1a95e31ab8c22a2e268dfa5f1ca18e914e

Download Submit
C:\Windows\System\EGHEMtb.exe

Filesize
1.8MB

MD5
2827db0bac3da7d90c7fae04451c6892

SHA1
d661cbc758a48a87b00b2f89603e68277a9bfc02

SHA256
ec2ca0fc8a488600dd10b49ff69a045a5ceb882a4a3d5252a584e61026021973

SHA512
fa51b671881d4cbe6777ac3a16b7ebb4053b50060588429ceaa8585da6ee3938469c62ef6cf85bdb72ae66e0fc7671c0a7ad143a18e2fc286d7bc557199af6ce

Download Submit
C:\Windows\System\EoAOSzo.exe

Filesize
1.8MB

MD5
65efb4fc42a27b65ff9e6f8653952026

SHA1
ab1477bf867c5a28f93e6037da9220fddd8c45e4

SHA256
58ce1a884a4eb62e2a3f9cbb0a23376d951688e847041dd1d8ad5d3ff446ec0c

SHA512
ad4fc81608c3ea855a87c2f1597e840941b833637e83f772f655d1428131726ad65744a3a87c85b67415d4bbb67dadb2a85f41fd5514ed6cd2bc12f350e0173f

Download Submit
C:\Windows\System\FqDSInv.exe

Filesize
1.8MB

MD5
3919e976a2002220e4f06a3e1a915a61

SHA1
7943a7a0aee5c03e76267072d89f26288290d42e

SHA256
61e33efd3c85995e6e1800f6d8f77b262a8add0672ca63d058a95f484bffd720

SHA512
0ebcbb4175b2aa4a991d952c5c2141e23bc2b9ce7fbdbbc5ed6074fb68857836b473d94bcad6cee4bb6abbe3e460bd6ecd53fa2169fe273012a09478369d8b35

Download Submit
C:\Windows\System\HXXJvXe.exe

Filesize
1.8MB

MD5
df4bdba740769ea2cb919188a3ee4e84

SHA1
1687a6de6a492a5f96144a4cdf3a99de69927758

SHA256
c8cd12622dd0ce004902cba99d8bcd233fa9b1d234f4e98309adceb2f93d6168

SHA512
0ec918ecefff15dc51b62cddd771f7bdd5fddd8426005066c174633922e7c3b66620ea8751c5f925497807636fdfd82ff3d7e7d9e60373fc6abf1ae065c16bff

Download Submit
C:\Windows\System\IfIYQBx.exe

Filesize
1.8MB

MD5
da4f6a177edf3c67b46ca8f66dc40368

SHA1
767cb272234b963db63a2bc494672aa1235494d7

SHA256
3a05100662bda86c0df7b55cc1fc174fa25e7c339c1847b5045e745283233fe3

SHA512
ea8b957c12b362f4587093673a3718e4eedc086a73084fc1326684540f342d73d333622d7542c38443e473a73f903668a1629f79c9670dbf2a09f738510f3de6

Download Submit
C:\Windows\System\IkZaGlE.exe

Filesize
1.8MB

MD5
58f77792f1d61a34335f02a526be16b9

SHA1
d746c526a709ca94224a862d2425bec0d6b26f28

SHA256
633e7e7698685dd492bc6536fd08374c3a5842b646b09146348e9180fa131af3

SHA512
3589b3c7ad5b317b157304f3c0cdca827789da7e5d70e6fe23ee8c41141fff488e52d12ad6455d69d18f1d8a0d0f1ab96c9c8183559510ecd923daa8001830c8

Download Submit
C:\Windows\System\JPCmjLx.exe

Filesize
1.8MB

MD5
b5347a72dd80abd645896188c970d54a

SHA1
91c09e6957f4f0f7d2d7ddefe8b98a2338a7513a

SHA256
ffebb60fed76c52f0975944c99575ca07b2aeccb812c5f3c41c7c41dc0875d99

SHA512
a706ffd1bdb3292e403ac52501fcebadfbb2ab2cdaa62cff179cd4ba6476e1b8b63fb50841111dba103df31fe1faa2d6c96c68b8455374a0a044dc0e27bd73d2

Download Submit
C:\Windows\System\KxZOoGT.exe

Filesize
1.8MB

MD5
f23803bf1fd10e2b78b86a7d83b066b3

SHA1
b84d30f6ad856c8f4244858c44855b779fb9fc43

SHA256
abad9fb5230aa6cfa7d5a88755aa313756b027a551d10a8a9977ea89cc64a092

SHA512
2a59e4d53485523087071b76418ebb2dbc03cf467b73a2a9373095034ef2ff7e6488ea25a90eb88a3a0421f32ef377ca4846f0bab5ee52d56cb0970a7b51673c

Download Submit
C:\Windows\System\MOhdorA.exe

Filesize
1.8MB

MD5
75adf53db44092678c2467d6ef9ac968

SHA1
99434d24cf6e3d500b8e585a21add0f96e733725

SHA256
6c80344550efb099dfceeba5ac7193e41544cfb0a4034fcd7823a846b95e98d4

SHA512
87a8cf575cd37f6494b6f69dec4d93b5e22a8a67695d9c17ebaf73c02faeda5e91952b54597cfd5011eb44bc18bc8595b15af3230d8688add77ba3fa2fed9bc5

Download Submit
C:\Windows\System\OkRTzmr.exe

Filesize
1.8MB

MD5
0b8349cc6b6119214fce2ae44d0060c3

SHA1
9675daf09b029c55ff56d7f17428c762abd726ee

SHA256
cc7f637772099e79b44cb813dbce5aaa0ea07ba26be67c70937614693ac16620

SHA512
131319e9ba8aab8ef34178a601d173958b61af7ba88bb850c41cedb3b30e8e09165ee6f7dfd7c8359033970ca3afb15928022920a399777d2a962767eb6316c0

Download Submit
C:\Windows\System\QEgWuDz.exe

Filesize
1.8MB

MD5
3f3c145587fc11aafa17e742f948b8fb

SHA1
334f7e30ca0ec185699bf61b9c664aa45e75f208

SHA256
2a862a4f36744d31f736e1b01def6df5f128a24c49951c532a13e03fdbca7e42

SHA512
53d49faaf66854b51e3432192e9901b25f2b798ae8263a52a2de3de386560f40f9a9fd1e405144e9c2bde057b7a0a33d0ea5bfaed343f7d47665f6ed60be9716

Download Submit
C:\Windows\System\QkzGmRw.exe

Filesize
1.8MB

MD5
b0d72f56cf922e0f40b223d440777487

SHA1
6076d275828fbcee117fb1bdd3fc87a874864143

SHA256
ff44797c0de4c91b3114bee6691ffab07f208e2c67fc6722a7dc68c363e5810f

SHA512
5da3ca1f1adaf96ae369b0d80b691df68bb9f4b6784df3dacb0d9d652a9546b451b7f2e4712e0c93603c76e08bc63aee3d7799c8344eb4aa06edd87a22454a88

Download Submit
C:\Windows\System\RuzEmcN.exe

Filesize
1.8MB

MD5
95696098721933e6a70fc4d4e31eaaab

SHA1
8f92f584621cd143e154e449d3571a047283bbd3

SHA256
ec5b29bdd4b8aab333d1b28702744a792e47e58e43d6dd47969f0ac4cbe89ec5

SHA512
300f623e2a7cbbebe2a2d9d7f1333a205ba92a0ed6fe637909375ccac863cb3c421b92b16ad70edd5ad1490cac7c96dd2412532ff38fd48b2642a4018e494253

Download Submit
C:\Windows\System\SmdueXE.exe

Filesize
1.8MB

MD5
e3ea2b9b7c642995b4d202e8cb55ebf9

SHA1
0dc16c1aba01350b395bc92a450a1b1c6be12800

SHA256
be85d23636f6d476f6d4315455b76c8866d544eb6224a0eba6a99d5bbcc7343a

SHA512
1a00b5d37eb2c5f69d93ac9cbdef69696fb71bcdeb6fe2bcda377c180492a94f449ffca3f1c088741bd2857df3dce91475899f3fd0d5f72ab8d01c167d4fa759

Download Submit
C:\Windows\System\VCTLIye.exe

Filesize
1.8MB

MD5
9570722dc1168c19fe88da37d276299f

SHA1
fd1b156a49a42850b8925bd70d38b282da0bc1ad

SHA256
c8643b6e15f1e5af6ff82fe6f8ca180d4bc892b660b9bc140d80734a002fbd5d

SHA512
cbd6d9658fe421e292a5854e40be20edb6ca420ac33815c81adc08fe0cc41e01c08113c3eab134a666b4c9ea83926ee1cfd38ebb17d1cb2f7a82cf975e00509f

Download Submit
C:\Windows\System\ZhsITMs.exe

Filesize
1.8MB

MD5
cc303af5bb5503c6d81361b4727ff307

SHA1
73eb82aa5fc1c7e73521db170995e8875cbde449

SHA256
5dcb52d18db28abef5758d47d4740d9f106d01c791d219d40f71d097e8842acd

SHA512
dde0b68be40b0ea1392635dcb8eb6d09abfdf031402d9842139bc8d3923b819e2e5fc7d92da5ef0e2eb36ab2c7455568ad59217b9a32fccc5e04ca9992b607b5

Download Submit
C:\Windows\System\ccNAFzW.exe

Filesize
1.8MB

MD5
01902b083c0049fa77cbfc6646de118f

SHA1
462995dcc4ba352501dc8177c8ebb1a20572e220

SHA256
940e335459379ab5484271058d15667b9b6713c75114e5d8efe643ffca3fd8ab

SHA512
809e8d08ec1e607c712b4cc45a1cc2362f80b9fbc2c100f575bb276bffd92bb39dc2fce0056feed66d7031ed28b98c00fa042a170be4769baa1dca8a4c40e010

Download Submit
C:\Windows\System\eUHWRqP.exe

Filesize
1.8MB

MD5
78f2cbd7842f4b9c15dc84a2cfb0d19a

SHA1
d7ee61c376c98b5b068bdf37db49879034e3f93d

SHA256
c4765a863d1f98a2c7adc2b1de3d87ff3750ea917c7d1ed268948d1314cbb403

SHA512
59d3bb932308e69b9ff52dff6ab008c1709b5dbe06f5ab835312206fbbd3e830831bd8fc76a1dc34aec40d78670fab6a6388c27d93fc3772dd32bb352574646f

Download Submit
C:\Windows\System\fSwhQRW.exe

Filesize
1.8MB

MD5
ac7e0d831239744858beff215d9b66ee

SHA1
008cf7b2d3214c36d1598ff8e24b6461d4d2aa6f

SHA256
7f199b696c4ba72a690fbef4acdf9f810c6b99f18f50b082142e4a774337c78c

SHA512
c8c0f7f1068a581df7f6fee867ebd330fca1ed5aa809474d3085af6fd6f96ca7dd3e99e041c1e1df00af5c0b231413f58a878f9523a3a55a0b1c2d4d715b9557

Download Submit
C:\Windows\System\gGPxabz.exe

Filesize
1.8MB

MD5
4df9a27fede0c201e63dba99ffdb80be

SHA1
e0dec77546bab1dccae826aeabe97aadfc53810e

SHA256
76097a23fbae4b21fdabe455d40ca797091a047ef1a88001987c68b6fd8e9417

SHA512
21e303b4a7f4fff0d5d1faeb45ecff1952e4b0f2a19a1ccd36ed62057b6670fc15a40d196de2af8f2ec2c984f23a2278962be0c8fa73b06a6f93929685739b76

Download Submit
C:\Windows\System\hSaiFJa.exe

Filesize
1.8MB

MD5
2bd650a9ec7c3d6d26051f6568499aaa

SHA1
153367d8f0a099d2fc1a17a998f6887919943a2c

SHA256
a2c3df7791b3390f1214398364bdbe15361f4c12163d53c369fbbfff8696effa

SHA512
30096a9f921243917a73b264b86b9c571cf69006d0ef45595595b40b29b2055b213707829e61bfa7f7b6ab36f412ba1b78eab89b0c512c8e36c31a5ce4d1056e

Download Submit
C:\Windows\System\jRMzMqL.exe

Filesize
1.8MB

MD5
6db01f198a5cfeb8289c9ef6ea8a94ec

SHA1
ea828893b4736cbb9eebd2d6b722478c7d70c8a7

SHA256
02ef88cf78099540d68dd07ddc2f8a98204dcc35ebd5819bd3cf992035ea3795

SHA512
25fbb271b376cddc47ca568c2ed32b6eb69a2cfc932b2f7d45fb0eb9ab28480789212e7da30100338a2c7011f2177f9a30d700c266003cfbb90ba35a7a4b4f82

Download Submit
C:\Windows\System\jYjybTt.exe

Filesize
1.8MB

MD5
c97e15ac8301a7890be3dd9e0d729c59

SHA1
1729f743436a414c5aa10cee0267751e7afcd9e4

SHA256
beaa390fa3c5c442153362d14eb53141b4604e694323e177dd7ae5be13ec3b91

SHA512
eebc6ab6d3cd3f8d3996d165fdfd00a570fbdd39f29e25935dae3b266634dd457a935a500ab575b6d8b18bcd52cfeaa4236266d7ca8052a82282345c6bb0b604

Download Submit
C:\Windows\System\keueDYm.exe

Filesize
1.8MB

MD5
c627cebce0c9177c7626b7894a9945f8

SHA1
f6275d8ff0771b0369afa7a195ac3894efcddc39

SHA256
a74ce7650cad109511326283418e687ee6c7cdd53565efdf18dadc5c07f073f9

SHA512
52bb37ff5c70590cc4cf7359ab563061230d2d8f82839633e864f3995fccfaaf9c4f4863a74bfc13c7bdedfabc1ddf95d1af60311d30e8cc88ec4fa3ba03cb71

Download Submit
C:\Windows\System\mNNDpBr.exe

Filesize
1.8MB

MD5
70aaa77ce6c2263173f3b0f9564b9e91

SHA1
f83dace4f2b0f65acf1bbc15b15c5e677bb561da

SHA256
c9cb181086d77d2c6a3420fb580a976a422343be23a718d7deac0cce93c6aab9

SHA512
26baefa5858e155f7d13023e6d8172df25c3ff3b9d144279e810903db3732f51abfc0cd0fadb99cfb3fac950773838c9687e32249b005521baaf0df40faa02cd

Download Submit
C:\Windows\System\nCMghDS.exe

Filesize
1.8MB

MD5
c6104b2661219ad1d551cd20cd472d0f

SHA1
a8c65439b0bd1424b66b465788ff15b007d1e3c6

SHA256
aa64d015e9bb4bd9992299a2331ea4e3826f18ba82caac10a7fb3c136f641903

SHA512
13b6d4eebfbc4561c06075652e7fa63a7840fc1e308642f708e62d9753175048d9d687d4906c1e221402508e6bc72dae1333c4de0acd8ee397e5fdb2c45c7061

Download Submit
C:\Windows\System\pJfmnAS.exe

Filesize
1.8MB

MD5
4ce7dcbe7f253229391cb8e391bf5050

SHA1
0aae6ec24c5f097e7bc299c8223b3bd1c062053f

SHA256
7e112c54d9a041a1d54d2003cd505503ebdd8ebafe70906ddc8e241ee99a3f82

SHA512
9f0c914acf371e120a7025df2320930776de117e1fa2c7cc19d8651dd36e0b9024c9b8a7a7863cdf9eb1070565e610e20682226e75254489be3a8d011845eeaf

Download Submit
C:\Windows\System\rJSmdoo.exe

Filesize
1.8MB

MD5
554aa0de4faf7d9c64dc50a54a1ac5d2

SHA1
7f382c2fc47f0adb7375d2b548c5b2e7b83a6746

SHA256
100a7b67e081121c52f9da32d3f48d8265f1a50cdc8d2a324426aba6a95bed48

SHA512
b30f812d1c308f8c896d14e8a41ce2751377ce64ea519010a1a03c0bb796ee4831219677b0139fd334b586688405f7b6917510d90c5c2c6b26ea6657c6cfde99

Download Submit
C:\Windows\System\vJtZQIG.exe

Filesize
1.8MB

MD5
112afe4139fdaa770ddd62ebd9affe2f

SHA1
e20a057787ec4e36e8e9cc67f080c688c64fee82

SHA256
eacb21d19f371c13d94272272fae9136ecc9bc2b6a2e1be09318042c74437832

SHA512
b424e8579a6fd09d1df362d96db672aa52818421040bd4b16f614efc956006f8587c0dac75dce677446b92253c1f370d98175ac341d18f5d9519d45cd9da4c20

Download Submit
C:\Windows\System\vwYczsZ.exe

Filesize
1.8MB

MD5
c739b58528564b909910f8154fc1bf49

SHA1
c8b48941f2239ff4fbb029b61843b7177387a14e

SHA256
8d3bd45dbba6fa1c2f666f7ab01d22e6b34ba8fa69a4afa86b734966ef26cdfc

SHA512
c8e5ac02f11fab2028ec39bb79e581d6ec17cd964510cea56c51d7e4ae844cf7cfd9dbde9479d5bb8997b7932f731f86cf9b26649fd044a325deb626a44dbdf7

Download Submit
C:\Windows\System\xCmzsLY.exe

Filesize
1.8MB

MD5
f818e60eb3ae49715e8d6bf9119975d0

SHA1
b5fdb91d1cda0ad2cf601db8df48e8db43c6d7e2

SHA256
9aa07e96ce1290987d3207eca6d4dc767a3317e24d92cf8cd8af7701611943cd

SHA512
41d88a6e2401f91ae3367d674f98bb924c98b7d0d1cd69757d383864c37b5b523b3aacd304d9486d78d7d44e2035b7cc55202b54c04c91bbaae1c379e6dd268d

Download Submit
C:\Windows\System\xXsLRdk.exe

Filesize
1.8MB

MD5
c7bc329c28090ee730affab4650aa24e

SHA1
47c19c668b485e4465bdb5661f5583825f1818a7

SHA256
7c84871ab6695c85975fd90a43e1d59fff7bbabec3af1340a5b2b13f9a7d360a

SHA512
71469ad99b45aef2456e218bba109ac9dfcbf8ed4d1682b909896e84fd97090aaf8a695a7b62cda8bda8e2e401ecc73e35838a54ee0d48ca992ba9296586abdf

Download Submit
memory/3796-0-0x000001AB9D510000-0x000001AB9D520000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads