xmrig | ed7bbb423ea85fe60e38271698005e201ee98fa2fce2bbd12bdbe08cbd2abbc9

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
24-12-2024 02:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ed7bbb423ea85fe60e38271698005e201ee98fa2fce2bbd12bdbe08cbd2abbc9.exe
Size

1.5MB
MD5

01fc5314305e6324a0a639c885b6fded
SHA1

506487130cd1e1d03879cc6a4f045fbde25b26d9
SHA256

ed7bbb423ea85fe60e38271698005e201ee98fa2fce2bbd12bdbe08cbd2abbc9
SHA512

c676e65a2873d45ec464a5b08886383c7a87ac2d3d617202d282104298865cdb43e79276ce68ab4f126c7111695beb13e83c6c8876964d37877d7c32af14f491
SSDEEP

24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbpwlKenszbWKDNEm/5ph70VwvToe:GezaTF8FcNkNdfE0pZ9ozttwIRx2Vike

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 33 IoCs

miner

resource	yara_rule
behavioral2/files/0x000c000000023b07-4.dat	xmrig
behavioral2/files/0x000b000000023b60-5.dat	xmrig
behavioral2/files/0x000a000000023b64-12.dat	xmrig
behavioral2/files/0x000a000000023b66-20.dat	xmrig
behavioral2/files/0x0031000000023b68-38.dat	xmrig
behavioral2/files/0x000a000000023b6b-53.dat	xmrig
behavioral2/files/0x000a000000023b6c-58.dat	xmrig
behavioral2/files/0x000a000000023b6f-69.dat	xmrig
behavioral2/files/0x000a000000023b74-98.dat	xmrig
behavioral2/files/0x000a000000023b77-115.dat	xmrig
behavioral2/files/0x000a000000023b7a-130.dat	xmrig
behavioral2/files/0x000a000000023b80-152.dat	xmrig
behavioral2/files/0x000a000000023b82-162.dat	xmrig
behavioral2/files/0x000a000000023b81-157.dat	xmrig
behavioral2/files/0x000a000000023b7f-155.dat	xmrig
behavioral2/files/0x000a000000023b7e-150.dat	xmrig
behavioral2/files/0x000a000000023b7d-145.dat	xmrig
behavioral2/files/0x000a000000023b7c-140.dat	xmrig
behavioral2/files/0x000a000000023b7b-135.dat	xmrig
behavioral2/files/0x000a000000023b79-125.dat	xmrig
behavioral2/files/0x000a000000023b78-120.dat	xmrig
behavioral2/files/0x000a000000023b76-110.dat	xmrig
behavioral2/files/0x000a000000023b75-102.dat	xmrig
behavioral2/files/0x000a000000023b73-92.dat	xmrig
behavioral2/files/0x000a000000023b72-88.dat	xmrig
behavioral2/files/0x000a000000023b71-83.dat	xmrig
behavioral2/files/0x000a000000023b70-78.dat	xmrig
behavioral2/files/0x000a000000023b6e-67.dat	xmrig
behavioral2/files/0x000a000000023b6d-63.dat	xmrig
behavioral2/files/0x0031000000023b6a-48.dat	xmrig
behavioral2/files/0x0031000000023b69-42.dat	xmrig
behavioral2/files/0x000a000000023b67-36.dat	xmrig
behavioral2/files/0x000a000000023b65-19.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
968	wYqdIad.exe
3984	sSJpfHl.exe
2656	PWjMxqX.exe
1904	eozxHHH.exe
392	fGZEWjO.exe
3628	KmgDFHr.exe
2540	WVfhxna.exe
4368	qrAhBmU.exe
4884	rFsBXkg.exe
1492	RnBUVEh.exe
948	EAXydPL.exe
3980	ORWKgJq.exe
2276	jjhkqiJ.exe
2080	OwDJUap.exe
4320	DkcnLjq.exe
4588	wjwumUw.exe
3036	qvqRpvh.exe
3156	HeqEspG.exe
1196	IdJlpCz.exe
3376	flNAlWi.exe
1304	WtvXurb.exe
4300	YDvELJe.exe
3192	gySOJeu.exe
4836	sOMcFsi.exe
740	lJtDsOt.exe
3480	sUoNVRn.exe
1448	UkLslfm.exe
5036	cUCtuAg.exe
4524	TLHhlOA.exe
1136	ljarlrO.exe
4184	UfidEou.exe
3432	yCzqOeR.exe
2692	hDySCdB.exe
2788	ueQVYIM.exe
1612	MxuerTv.exe
1128	omcfwUR.exe
4888	hGGnFte.exe
3744	pVQANqB.exe
4996	JYGpqyD.exe
1140	rspyEjH.exe
1180	zxMsjJd.exe
404	RWnJEwI.exe
1608	yHrHQDg.exe
3484	TyEZypd.exe
3976	GBLNYiY.exe
5116	unncLkX.exe
1708	oXNIMTj.exe
2888	fJvLkxO.exe
212	fIRIzIg.exe
2160	hoNkSQc.exe
4712	KUpHRRe.exe
2308	OsFGwyW.exe
2112	hDVaous.exe
4344	epcIbCU.exe
3396	iJrZNcR.exe
1848	pCWpSLo.exe
2936	FvbQplD.exe
4236	FpqkNlB.exe
5064	ENvIxfJ.exe
1312	JyyRZls.exe
3388	PINOvwp.exe
516	EXiGLkn.exe
4280	ydBFGvP.exe
4316	DOzDzxb.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\iEehuzX.exe	ed7bbb423ea85fe60e38271698005e201ee98fa2fce2bbd12bdbe08cbd2abbc9.exe
File created	C:\Windows\System\vAtnfgT.exe	ed7bbb423ea85fe60e38271698005e201ee98fa2fce2bbd12bdbe08cbd2abbc9.exe
File created	C:\Windows\System\qvqRpvh.exe	ed7bbb423ea85fe60e38271698005e201ee98fa2fce2bbd12bdbe08cbd2abbc9.exe
File created	C:\Windows\System\JKQrEao.exe	ed7bbb423ea85fe60e38271698005e201ee98fa2fce2bbd12bdbe08cbd2abbc9.exe
File created	C:\Windows\System\chqCLVm.exe	ed7bbb423ea85fe60e38271698005e201ee98fa2fce2bbd12bdbe08cbd2abbc9.exe
File created	C:\Windows\System\vxZIfEE.exe	ed7bbb423ea85fe60e38271698005e201ee98fa2fce2bbd12bdbe08cbd2abbc9.exe
File created	C:\Windows\System\aTGnVza.exe	ed7bbb423ea85fe60e38271698005e201ee98fa2fce2bbd12bdbe08cbd2abbc9.exe
File created	C:\Windows\System\bPRTFVU.exe	ed7bbb423ea85fe60e38271698005e201ee98fa2fce2bbd12bdbe08cbd2abbc9.exe
File created	C:\Windows\System\DfTgwiz.exe	ed7bbb423ea85fe60e38271698005e201ee98fa2fce2bbd12bdbe08cbd2abbc9.exe
File created	C:\Windows\System\fJvLkxO.exe	ed7bbb423ea85fe60e38271698005e201ee98fa2fce2bbd12bdbe08cbd2abbc9.exe
File created	C:\Windows\System\PVDpjtS.exe	ed7bbb423ea85fe60e38271698005e201ee98fa2fce2bbd12bdbe08cbd2abbc9.exe
File created	C:\Windows\System\DjXUvSz.exe	ed7bbb423ea85fe60e38271698005e201ee98fa2fce2bbd12bdbe08cbd2abbc9.exe
File created	C:\Windows\System\qtuPDPF.exe	ed7bbb423ea85fe60e38271698005e201ee98fa2fce2bbd12bdbe08cbd2abbc9.exe
File created	C:\Windows\System\vDIbdnM.exe	ed7bbb423ea85fe60e38271698005e201ee98fa2fce2bbd12bdbe08cbd2abbc9.exe
File created	C:\Windows\System\lVHDHJl.exe	ed7bbb423ea85fe60e38271698005e201ee98fa2fce2bbd12bdbe08cbd2abbc9.exe
File created	C:\Windows\System\TyEZypd.exe	ed7bbb423ea85fe60e38271698005e201ee98fa2fce2bbd12bdbe08cbd2abbc9.exe
File created	C:\Windows\System\zkmSJZO.exe	ed7bbb423ea85fe60e38271698005e201ee98fa2fce2bbd12bdbe08cbd2abbc9.exe
File created	C:\Windows\System\PWSUIwW.exe	ed7bbb423ea85fe60e38271698005e201ee98fa2fce2bbd12bdbe08cbd2abbc9.exe
File created	C:\Windows\System\jnVXbOl.exe	ed7bbb423ea85fe60e38271698005e201ee98fa2fce2bbd12bdbe08cbd2abbc9.exe
File created	C:\Windows\System\oXNIMTj.exe	ed7bbb423ea85fe60e38271698005e201ee98fa2fce2bbd12bdbe08cbd2abbc9.exe
File created	C:\Windows\System\dSNkvFm.exe	ed7bbb423ea85fe60e38271698005e201ee98fa2fce2bbd12bdbe08cbd2abbc9.exe
File created	C:\Windows\System\EMCxvPb.exe	ed7bbb423ea85fe60e38271698005e201ee98fa2fce2bbd12bdbe08cbd2abbc9.exe
File created	C:\Windows\System\QQAuxtT.exe	ed7bbb423ea85fe60e38271698005e201ee98fa2fce2bbd12bdbe08cbd2abbc9.exe
File created	C:\Windows\System\XZEBvVA.exe	ed7bbb423ea85fe60e38271698005e201ee98fa2fce2bbd12bdbe08cbd2abbc9.exe
File created	C:\Windows\System\lXGrxET.exe	ed7bbb423ea85fe60e38271698005e201ee98fa2fce2bbd12bdbe08cbd2abbc9.exe
File created	C:\Windows\System\hurXfRH.exe	ed7bbb423ea85fe60e38271698005e201ee98fa2fce2bbd12bdbe08cbd2abbc9.exe
File created	C:\Windows\System\eQagxrx.exe	ed7bbb423ea85fe60e38271698005e201ee98fa2fce2bbd12bdbe08cbd2abbc9.exe
File created	C:\Windows\System\DGDgWSD.exe	ed7bbb423ea85fe60e38271698005e201ee98fa2fce2bbd12bdbe08cbd2abbc9.exe
File created	C:\Windows\System\OLOtfGW.exe	ed7bbb423ea85fe60e38271698005e201ee98fa2fce2bbd12bdbe08cbd2abbc9.exe
File created	C:\Windows\System\EvsawFT.exe	ed7bbb423ea85fe60e38271698005e201ee98fa2fce2bbd12bdbe08cbd2abbc9.exe
File created	C:\Windows\System\NXMFndA.exe	ed7bbb423ea85fe60e38271698005e201ee98fa2fce2bbd12bdbe08cbd2abbc9.exe
File created	C:\Windows\System\pbYgZfL.exe	ed7bbb423ea85fe60e38271698005e201ee98fa2fce2bbd12bdbe08cbd2abbc9.exe
File created	C:\Windows\System\yCzqOeR.exe	ed7bbb423ea85fe60e38271698005e201ee98fa2fce2bbd12bdbe08cbd2abbc9.exe
File created	C:\Windows\System\wXdYBAM.exe	ed7bbb423ea85fe60e38271698005e201ee98fa2fce2bbd12bdbe08cbd2abbc9.exe
File created	C:\Windows\System\cZRjjPn.exe	ed7bbb423ea85fe60e38271698005e201ee98fa2fce2bbd12bdbe08cbd2abbc9.exe
File created	C:\Windows\System\aMrqUEB.exe	ed7bbb423ea85fe60e38271698005e201ee98fa2fce2bbd12bdbe08cbd2abbc9.exe
File created	C:\Windows\System\SYWehmf.exe	ed7bbb423ea85fe60e38271698005e201ee98fa2fce2bbd12bdbe08cbd2abbc9.exe
File created	C:\Windows\System\GaLCunC.exe	ed7bbb423ea85fe60e38271698005e201ee98fa2fce2bbd12bdbe08cbd2abbc9.exe
File created	C:\Windows\System\kIYFNjJ.exe	ed7bbb423ea85fe60e38271698005e201ee98fa2fce2bbd12bdbe08cbd2abbc9.exe
File created	C:\Windows\System\NxStIgv.exe	ed7bbb423ea85fe60e38271698005e201ee98fa2fce2bbd12bdbe08cbd2abbc9.exe
File created	C:\Windows\System\LUmWish.exe	ed7bbb423ea85fe60e38271698005e201ee98fa2fce2bbd12bdbe08cbd2abbc9.exe
File created	C:\Windows\System\xitraYS.exe	ed7bbb423ea85fe60e38271698005e201ee98fa2fce2bbd12bdbe08cbd2abbc9.exe
File created	C:\Windows\System\hGGnFte.exe	ed7bbb423ea85fe60e38271698005e201ee98fa2fce2bbd12bdbe08cbd2abbc9.exe
File created	C:\Windows\System\AQzcWfS.exe	ed7bbb423ea85fe60e38271698005e201ee98fa2fce2bbd12bdbe08cbd2abbc9.exe
File created	C:\Windows\System\dJaypCU.exe	ed7bbb423ea85fe60e38271698005e201ee98fa2fce2bbd12bdbe08cbd2abbc9.exe
File created	C:\Windows\System\BeqEALd.exe	ed7bbb423ea85fe60e38271698005e201ee98fa2fce2bbd12bdbe08cbd2abbc9.exe
File created	C:\Windows\System\CAjdHHi.exe	ed7bbb423ea85fe60e38271698005e201ee98fa2fce2bbd12bdbe08cbd2abbc9.exe
File created	C:\Windows\System\lLSbVYO.exe	ed7bbb423ea85fe60e38271698005e201ee98fa2fce2bbd12bdbe08cbd2abbc9.exe
File created	C:\Windows\System\kiUtXAf.exe	ed7bbb423ea85fe60e38271698005e201ee98fa2fce2bbd12bdbe08cbd2abbc9.exe
File created	C:\Windows\System\MIURnrg.exe	ed7bbb423ea85fe60e38271698005e201ee98fa2fce2bbd12bdbe08cbd2abbc9.exe
File created	C:\Windows\System\bFbYsMl.exe	ed7bbb423ea85fe60e38271698005e201ee98fa2fce2bbd12bdbe08cbd2abbc9.exe
File created	C:\Windows\System\WRVUhcB.exe	ed7bbb423ea85fe60e38271698005e201ee98fa2fce2bbd12bdbe08cbd2abbc9.exe
File created	C:\Windows\System\VxfTDfy.exe	ed7bbb423ea85fe60e38271698005e201ee98fa2fce2bbd12bdbe08cbd2abbc9.exe
File created	C:\Windows\System\IqJTrxP.exe	ed7bbb423ea85fe60e38271698005e201ee98fa2fce2bbd12bdbe08cbd2abbc9.exe
File created	C:\Windows\System\tTbXtXQ.exe	ed7bbb423ea85fe60e38271698005e201ee98fa2fce2bbd12bdbe08cbd2abbc9.exe
File created	C:\Windows\System\eJKHZtC.exe	ed7bbb423ea85fe60e38271698005e201ee98fa2fce2bbd12bdbe08cbd2abbc9.exe
File created	C:\Windows\System\EHmkdgN.exe	ed7bbb423ea85fe60e38271698005e201ee98fa2fce2bbd12bdbe08cbd2abbc9.exe
File created	C:\Windows\System\kRWabRP.exe	ed7bbb423ea85fe60e38271698005e201ee98fa2fce2bbd12bdbe08cbd2abbc9.exe
File created	C:\Windows\System\xJnZdiR.exe	ed7bbb423ea85fe60e38271698005e201ee98fa2fce2bbd12bdbe08cbd2abbc9.exe
File created	C:\Windows\System\yiUvpMb.exe	ed7bbb423ea85fe60e38271698005e201ee98fa2fce2bbd12bdbe08cbd2abbc9.exe
File created	C:\Windows\System\qQDiKip.exe	ed7bbb423ea85fe60e38271698005e201ee98fa2fce2bbd12bdbe08cbd2abbc9.exe
File created	C:\Windows\System\LdNdmTc.exe	ed7bbb423ea85fe60e38271698005e201ee98fa2fce2bbd12bdbe08cbd2abbc9.exe
File created	C:\Windows\System\oijfTQs.exe	ed7bbb423ea85fe60e38271698005e201ee98fa2fce2bbd12bdbe08cbd2abbc9.exe
File created	C:\Windows\System\zuGZcTH.exe	ed7bbb423ea85fe60e38271698005e201ee98fa2fce2bbd12bdbe08cbd2abbc9.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	17364	dwm.exe
Token: SeChangeNotifyPrivilege	17364	dwm.exe
Token: 33	17364	dwm.exe
Token: SeIncBasePriorityPrivilege	17364	dwm.exe
Token: SeShutdownPrivilege	17364	dwm.exe
Token: SeCreatePagefilePrivilege	17364	dwm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5084 wrote to memory of 968	5084	ed7bbb423ea85fe60e38271698005e201ee98fa2fce2bbd12bdbe08cbd2abbc9.exe	84
PID 5084 wrote to memory of 968	5084	ed7bbb423ea85fe60e38271698005e201ee98fa2fce2bbd12bdbe08cbd2abbc9.exe	84
PID 5084 wrote to memory of 3984	5084	ed7bbb423ea85fe60e38271698005e201ee98fa2fce2bbd12bdbe08cbd2abbc9.exe	85
PID 5084 wrote to memory of 3984	5084	ed7bbb423ea85fe60e38271698005e201ee98fa2fce2bbd12bdbe08cbd2abbc9.exe	85
PID 5084 wrote to memory of 2656	5084	ed7bbb423ea85fe60e38271698005e201ee98fa2fce2bbd12bdbe08cbd2abbc9.exe	86
PID 5084 wrote to memory of 2656	5084	ed7bbb423ea85fe60e38271698005e201ee98fa2fce2bbd12bdbe08cbd2abbc9.exe	86
PID 5084 wrote to memory of 1904	5084	ed7bbb423ea85fe60e38271698005e201ee98fa2fce2bbd12bdbe08cbd2abbc9.exe	87
PID 5084 wrote to memory of 1904	5084	ed7bbb423ea85fe60e38271698005e201ee98fa2fce2bbd12bdbe08cbd2abbc9.exe	87
PID 5084 wrote to memory of 392	5084	ed7bbb423ea85fe60e38271698005e201ee98fa2fce2bbd12bdbe08cbd2abbc9.exe	88
PID 5084 wrote to memory of 392	5084	ed7bbb423ea85fe60e38271698005e201ee98fa2fce2bbd12bdbe08cbd2abbc9.exe	88
PID 5084 wrote to memory of 3628	5084	ed7bbb423ea85fe60e38271698005e201ee98fa2fce2bbd12bdbe08cbd2abbc9.exe	89
PID 5084 wrote to memory of 3628	5084	ed7bbb423ea85fe60e38271698005e201ee98fa2fce2bbd12bdbe08cbd2abbc9.exe	89
PID 5084 wrote to memory of 2540	5084	ed7bbb423ea85fe60e38271698005e201ee98fa2fce2bbd12bdbe08cbd2abbc9.exe	90
PID 5084 wrote to memory of 2540	5084	ed7bbb423ea85fe60e38271698005e201ee98fa2fce2bbd12bdbe08cbd2abbc9.exe	90
PID 5084 wrote to memory of 4368	5084	ed7bbb423ea85fe60e38271698005e201ee98fa2fce2bbd12bdbe08cbd2abbc9.exe	91
PID 5084 wrote to memory of 4368	5084	ed7bbb423ea85fe60e38271698005e201ee98fa2fce2bbd12bdbe08cbd2abbc9.exe	91
PID 5084 wrote to memory of 4884	5084	ed7bbb423ea85fe60e38271698005e201ee98fa2fce2bbd12bdbe08cbd2abbc9.exe	92
PID 5084 wrote to memory of 4884	5084	ed7bbb423ea85fe60e38271698005e201ee98fa2fce2bbd12bdbe08cbd2abbc9.exe	92
PID 5084 wrote to memory of 1492	5084	ed7bbb423ea85fe60e38271698005e201ee98fa2fce2bbd12bdbe08cbd2abbc9.exe	93
PID 5084 wrote to memory of 1492	5084	ed7bbb423ea85fe60e38271698005e201ee98fa2fce2bbd12bdbe08cbd2abbc9.exe	93
PID 5084 wrote to memory of 948	5084	ed7bbb423ea85fe60e38271698005e201ee98fa2fce2bbd12bdbe08cbd2abbc9.exe	94
PID 5084 wrote to memory of 948	5084	ed7bbb423ea85fe60e38271698005e201ee98fa2fce2bbd12bdbe08cbd2abbc9.exe	94
PID 5084 wrote to memory of 3980	5084	ed7bbb423ea85fe60e38271698005e201ee98fa2fce2bbd12bdbe08cbd2abbc9.exe	95
PID 5084 wrote to memory of 3980	5084	ed7bbb423ea85fe60e38271698005e201ee98fa2fce2bbd12bdbe08cbd2abbc9.exe	95
PID 5084 wrote to memory of 2276	5084	ed7bbb423ea85fe60e38271698005e201ee98fa2fce2bbd12bdbe08cbd2abbc9.exe	96
PID 5084 wrote to memory of 2276	5084	ed7bbb423ea85fe60e38271698005e201ee98fa2fce2bbd12bdbe08cbd2abbc9.exe	96
PID 5084 wrote to memory of 2080	5084	ed7bbb423ea85fe60e38271698005e201ee98fa2fce2bbd12bdbe08cbd2abbc9.exe	97
PID 5084 wrote to memory of 2080	5084	ed7bbb423ea85fe60e38271698005e201ee98fa2fce2bbd12bdbe08cbd2abbc9.exe	97
PID 5084 wrote to memory of 4320	5084	ed7bbb423ea85fe60e38271698005e201ee98fa2fce2bbd12bdbe08cbd2abbc9.exe	98
PID 5084 wrote to memory of 4320	5084	ed7bbb423ea85fe60e38271698005e201ee98fa2fce2bbd12bdbe08cbd2abbc9.exe	98
PID 5084 wrote to memory of 4588	5084	ed7bbb423ea85fe60e38271698005e201ee98fa2fce2bbd12bdbe08cbd2abbc9.exe	99
PID 5084 wrote to memory of 4588	5084	ed7bbb423ea85fe60e38271698005e201ee98fa2fce2bbd12bdbe08cbd2abbc9.exe	99
PID 5084 wrote to memory of 3036	5084	ed7bbb423ea85fe60e38271698005e201ee98fa2fce2bbd12bdbe08cbd2abbc9.exe	100
PID 5084 wrote to memory of 3036	5084	ed7bbb423ea85fe60e38271698005e201ee98fa2fce2bbd12bdbe08cbd2abbc9.exe	100
PID 5084 wrote to memory of 3156	5084	ed7bbb423ea85fe60e38271698005e201ee98fa2fce2bbd12bdbe08cbd2abbc9.exe	101
PID 5084 wrote to memory of 3156	5084	ed7bbb423ea85fe60e38271698005e201ee98fa2fce2bbd12bdbe08cbd2abbc9.exe	101
PID 5084 wrote to memory of 1196	5084	ed7bbb423ea85fe60e38271698005e201ee98fa2fce2bbd12bdbe08cbd2abbc9.exe	102
PID 5084 wrote to memory of 1196	5084	ed7bbb423ea85fe60e38271698005e201ee98fa2fce2bbd12bdbe08cbd2abbc9.exe	102
PID 5084 wrote to memory of 3376	5084	ed7bbb423ea85fe60e38271698005e201ee98fa2fce2bbd12bdbe08cbd2abbc9.exe	103
PID 5084 wrote to memory of 3376	5084	ed7bbb423ea85fe60e38271698005e201ee98fa2fce2bbd12bdbe08cbd2abbc9.exe	103
PID 5084 wrote to memory of 1304	5084	ed7bbb423ea85fe60e38271698005e201ee98fa2fce2bbd12bdbe08cbd2abbc9.exe	104
PID 5084 wrote to memory of 1304	5084	ed7bbb423ea85fe60e38271698005e201ee98fa2fce2bbd12bdbe08cbd2abbc9.exe	104
PID 5084 wrote to memory of 4300	5084	ed7bbb423ea85fe60e38271698005e201ee98fa2fce2bbd12bdbe08cbd2abbc9.exe	105
PID 5084 wrote to memory of 4300	5084	ed7bbb423ea85fe60e38271698005e201ee98fa2fce2bbd12bdbe08cbd2abbc9.exe	105
PID 5084 wrote to memory of 3192	5084	ed7bbb423ea85fe60e38271698005e201ee98fa2fce2bbd12bdbe08cbd2abbc9.exe	106
PID 5084 wrote to memory of 3192	5084	ed7bbb423ea85fe60e38271698005e201ee98fa2fce2bbd12bdbe08cbd2abbc9.exe	106
PID 5084 wrote to memory of 4836	5084	ed7bbb423ea85fe60e38271698005e201ee98fa2fce2bbd12bdbe08cbd2abbc9.exe	107
PID 5084 wrote to memory of 4836	5084	ed7bbb423ea85fe60e38271698005e201ee98fa2fce2bbd12bdbe08cbd2abbc9.exe	107
PID 5084 wrote to memory of 740	5084	ed7bbb423ea85fe60e38271698005e201ee98fa2fce2bbd12bdbe08cbd2abbc9.exe	108
PID 5084 wrote to memory of 740	5084	ed7bbb423ea85fe60e38271698005e201ee98fa2fce2bbd12bdbe08cbd2abbc9.exe	108
PID 5084 wrote to memory of 3480	5084	ed7bbb423ea85fe60e38271698005e201ee98fa2fce2bbd12bdbe08cbd2abbc9.exe	109
PID 5084 wrote to memory of 3480	5084	ed7bbb423ea85fe60e38271698005e201ee98fa2fce2bbd12bdbe08cbd2abbc9.exe	109
PID 5084 wrote to memory of 1448	5084	ed7bbb423ea85fe60e38271698005e201ee98fa2fce2bbd12bdbe08cbd2abbc9.exe	110
PID 5084 wrote to memory of 1448	5084	ed7bbb423ea85fe60e38271698005e201ee98fa2fce2bbd12bdbe08cbd2abbc9.exe	110
PID 5084 wrote to memory of 5036	5084	ed7bbb423ea85fe60e38271698005e201ee98fa2fce2bbd12bdbe08cbd2abbc9.exe	111
PID 5084 wrote to memory of 5036	5084	ed7bbb423ea85fe60e38271698005e201ee98fa2fce2bbd12bdbe08cbd2abbc9.exe	111
PID 5084 wrote to memory of 4524	5084	ed7bbb423ea85fe60e38271698005e201ee98fa2fce2bbd12bdbe08cbd2abbc9.exe	112
PID 5084 wrote to memory of 4524	5084	ed7bbb423ea85fe60e38271698005e201ee98fa2fce2bbd12bdbe08cbd2abbc9.exe	112
PID 5084 wrote to memory of 1136	5084	ed7bbb423ea85fe60e38271698005e201ee98fa2fce2bbd12bdbe08cbd2abbc9.exe	113
PID 5084 wrote to memory of 1136	5084	ed7bbb423ea85fe60e38271698005e201ee98fa2fce2bbd12bdbe08cbd2abbc9.exe	113
PID 5084 wrote to memory of 4184	5084	ed7bbb423ea85fe60e38271698005e201ee98fa2fce2bbd12bdbe08cbd2abbc9.exe	114
PID 5084 wrote to memory of 4184	5084	ed7bbb423ea85fe60e38271698005e201ee98fa2fce2bbd12bdbe08cbd2abbc9.exe	114
PID 5084 wrote to memory of 3432	5084	ed7bbb423ea85fe60e38271698005e201ee98fa2fce2bbd12bdbe08cbd2abbc9.exe	115
PID 5084 wrote to memory of 3432	5084	ed7bbb423ea85fe60e38271698005e201ee98fa2fce2bbd12bdbe08cbd2abbc9.exe	115

C:\Users\Admin\AppData\Local\Temp\ed7bbb423ea85fe60e38271698005e201ee98fa2fce2bbd12bdbe08cbd2abbc9.exe
"C:\Users\Admin\AppData\Local\Temp\ed7bbb423ea85fe60e38271698005e201ee98fa2fce2bbd12bdbe08cbd2abbc9.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:5084
- C:\Windows\System\wYqdIad.exe
  C:\Windows\System\wYqdIad.exe
  2⤵
  - Executes dropped EXE
  PID:968
- C:\Windows\System\sSJpfHl.exe
  C:\Windows\System\sSJpfHl.exe
  2⤵
  - Executes dropped EXE
  PID:3984
- C:\Windows\System\PWjMxqX.exe
  C:\Windows\System\PWjMxqX.exe
  2⤵
  - Executes dropped EXE
  PID:2656
- C:\Windows\System\eozxHHH.exe
  C:\Windows\System\eozxHHH.exe
  2⤵
  - Executes dropped EXE
  PID:1904
- C:\Windows\System\fGZEWjO.exe
  C:\Windows\System\fGZEWjO.exe
  2⤵
  - Executes dropped EXE
  PID:392
- C:\Windows\System\KmgDFHr.exe
  C:\Windows\System\KmgDFHr.exe
  2⤵
  - Executes dropped EXE
  PID:3628
- C:\Windows\System\WVfhxna.exe
  C:\Windows\System\WVfhxna.exe
  2⤵
  - Executes dropped EXE
  PID:2540
- C:\Windows\System\qrAhBmU.exe
  C:\Windows\System\qrAhBmU.exe
  2⤵
  - Executes dropped EXE
  PID:4368
- C:\Windows\System\rFsBXkg.exe
  C:\Windows\System\rFsBXkg.exe
  2⤵
  - Executes dropped EXE
  PID:4884
- C:\Windows\System\RnBUVEh.exe
  C:\Windows\System\RnBUVEh.exe
  2⤵
  - Executes dropped EXE
  PID:1492
- C:\Windows\System\EAXydPL.exe
  C:\Windows\System\EAXydPL.exe
  2⤵
  - Executes dropped EXE
  PID:948
- C:\Windows\System\ORWKgJq.exe
  C:\Windows\System\ORWKgJq.exe
  2⤵
  - Executes dropped EXE
  PID:3980
- C:\Windows\System\jjhkqiJ.exe
  C:\Windows\System\jjhkqiJ.exe
  2⤵
  - Executes dropped EXE
  PID:2276
- C:\Windows\System\OwDJUap.exe
  C:\Windows\System\OwDJUap.exe
  2⤵
  - Executes dropped EXE
  PID:2080
- C:\Windows\System\DkcnLjq.exe
  C:\Windows\System\DkcnLjq.exe
  2⤵
  - Executes dropped EXE
  PID:4320
- C:\Windows\System\wjwumUw.exe
  C:\Windows\System\wjwumUw.exe
  2⤵
  - Executes dropped EXE
  PID:4588
- C:\Windows\System\qvqRpvh.exe
  C:\Windows\System\qvqRpvh.exe
  2⤵
  - Executes dropped EXE
  PID:3036
- C:\Windows\System\HeqEspG.exe
  C:\Windows\System\HeqEspG.exe
  2⤵
  - Executes dropped EXE
  PID:3156
- C:\Windows\System\IdJlpCz.exe
  C:\Windows\System\IdJlpCz.exe
  2⤵
  - Executes dropped EXE
  PID:1196
- C:\Windows\System\flNAlWi.exe
  C:\Windows\System\flNAlWi.exe
  2⤵
  - Executes dropped EXE
  PID:3376
- C:\Windows\System\WtvXurb.exe
  C:\Windows\System\WtvXurb.exe
  2⤵
  - Executes dropped EXE
  PID:1304
- C:\Windows\System\YDvELJe.exe
  C:\Windows\System\YDvELJe.exe
  2⤵
  - Executes dropped EXE
  PID:4300
- C:\Windows\System\gySOJeu.exe
  C:\Windows\System\gySOJeu.exe
  2⤵
  - Executes dropped EXE
  PID:3192
- C:\Windows\System\sOMcFsi.exe
  C:\Windows\System\sOMcFsi.exe
  2⤵
  - Executes dropped EXE
  PID:4836
- C:\Windows\System\lJtDsOt.exe
  C:\Windows\System\lJtDsOt.exe
  2⤵
  - Executes dropped EXE
  PID:740
- C:\Windows\System\sUoNVRn.exe
  C:\Windows\System\sUoNVRn.exe
  2⤵
  - Executes dropped EXE
  PID:3480
- C:\Windows\System\UkLslfm.exe
  C:\Windows\System\UkLslfm.exe
  2⤵
  - Executes dropped EXE
  PID:1448
- C:\Windows\System\cUCtuAg.exe
  C:\Windows\System\cUCtuAg.exe
  2⤵
  - Executes dropped EXE
  PID:5036
- C:\Windows\System\TLHhlOA.exe
  C:\Windows\System\TLHhlOA.exe
  2⤵
  - Executes dropped EXE
  PID:4524
- C:\Windows\System\ljarlrO.exe
  C:\Windows\System\ljarlrO.exe
  2⤵
  - Executes dropped EXE
  PID:1136
- C:\Windows\System\UfidEou.exe
  C:\Windows\System\UfidEou.exe
  2⤵
  - Executes dropped EXE
  PID:4184
- C:\Windows\System\yCzqOeR.exe
  C:\Windows\System\yCzqOeR.exe
  2⤵
  - Executes dropped EXE
  PID:3432
- C:\Windows\System\hDySCdB.exe
  C:\Windows\System\hDySCdB.exe
  2⤵
  - Executes dropped EXE
  PID:2692
- C:\Windows\System\ueQVYIM.exe
  C:\Windows\System\ueQVYIM.exe
  2⤵
  - Executes dropped EXE
  PID:2788
- C:\Windows\System\MxuerTv.exe
  C:\Windows\System\MxuerTv.exe
  2⤵
  - Executes dropped EXE
  PID:1612
- C:\Windows\System\omcfwUR.exe
  C:\Windows\System\omcfwUR.exe
  2⤵
  - Executes dropped EXE
  PID:1128
- C:\Windows\System\hGGnFte.exe
  C:\Windows\System\hGGnFte.exe
  2⤵
  - Executes dropped EXE
  PID:4888
- C:\Windows\System\pVQANqB.exe
  C:\Windows\System\pVQANqB.exe
  2⤵
  - Executes dropped EXE
  PID:3744
- C:\Windows\System\JYGpqyD.exe
  C:\Windows\System\JYGpqyD.exe
  2⤵
  - Executes dropped EXE
  PID:4996
- C:\Windows\System\rspyEjH.exe
  C:\Windows\System\rspyEjH.exe
  2⤵
  - Executes dropped EXE
  PID:1140
- C:\Windows\System\zxMsjJd.exe
  C:\Windows\System\zxMsjJd.exe
  2⤵
  - Executes dropped EXE
  PID:1180
- C:\Windows\System\RWnJEwI.exe
  C:\Windows\System\RWnJEwI.exe
  2⤵
  - Executes dropped EXE
  PID:404
- C:\Windows\System\yHrHQDg.exe
  C:\Windows\System\yHrHQDg.exe
  2⤵
  - Executes dropped EXE
  PID:1608
- C:\Windows\System\TyEZypd.exe
  C:\Windows\System\TyEZypd.exe
  2⤵
  - Executes dropped EXE
  PID:3484
- C:\Windows\System\GBLNYiY.exe
  C:\Windows\System\GBLNYiY.exe
  2⤵
  - Executes dropped EXE
  PID:3976
- C:\Windows\System\unncLkX.exe
  C:\Windows\System\unncLkX.exe
  2⤵
  - Executes dropped EXE
  PID:5116
- C:\Windows\System\oXNIMTj.exe
  C:\Windows\System\oXNIMTj.exe
  2⤵
  - Executes dropped EXE
  PID:1708
- C:\Windows\System\fJvLkxO.exe
  C:\Windows\System\fJvLkxO.exe
  2⤵
  - Executes dropped EXE
  PID:2888
- C:\Windows\System\fIRIzIg.exe
  C:\Windows\System\fIRIzIg.exe
  2⤵
  - Executes dropped EXE
  PID:212
- C:\Windows\System\hoNkSQc.exe
  C:\Windows\System\hoNkSQc.exe
  2⤵
  - Executes dropped EXE
  PID:2160
- C:\Windows\System\KUpHRRe.exe
  C:\Windows\System\KUpHRRe.exe
  2⤵
  - Executes dropped EXE
  PID:4712
- C:\Windows\System\OsFGwyW.exe
  C:\Windows\System\OsFGwyW.exe
  2⤵
  - Executes dropped EXE
  PID:2308
- C:\Windows\System\hDVaous.exe
  C:\Windows\System\hDVaous.exe
  2⤵
  - Executes dropped EXE
  PID:2112
- C:\Windows\System\epcIbCU.exe
  C:\Windows\System\epcIbCU.exe
  2⤵
  - Executes dropped EXE
  PID:4344
- C:\Windows\System\iJrZNcR.exe
  C:\Windows\System\iJrZNcR.exe
  2⤵
  - Executes dropped EXE
  PID:3396
- C:\Windows\System\pCWpSLo.exe
  C:\Windows\System\pCWpSLo.exe
  2⤵
  - Executes dropped EXE
  PID:1848
- C:\Windows\System\FvbQplD.exe
  C:\Windows\System\FvbQplD.exe
  2⤵
  - Executes dropped EXE
  PID:2936
- C:\Windows\System\FpqkNlB.exe
  C:\Windows\System\FpqkNlB.exe
  2⤵
  - Executes dropped EXE
  PID:4236
- C:\Windows\System\ENvIxfJ.exe
  C:\Windows\System\ENvIxfJ.exe
  2⤵
  - Executes dropped EXE
  PID:5064
- C:\Windows\System\JyyRZls.exe
  C:\Windows\System\JyyRZls.exe
  2⤵
  - Executes dropped EXE
  PID:1312
- C:\Windows\System\PINOvwp.exe
  C:\Windows\System\PINOvwp.exe
  2⤵
  - Executes dropped EXE
  PID:3388
- C:\Windows\System\EXiGLkn.exe
  C:\Windows\System\EXiGLkn.exe
  2⤵
  - Executes dropped EXE
  PID:516
- C:\Windows\System\ydBFGvP.exe
  C:\Windows\System\ydBFGvP.exe
  2⤵
  - Executes dropped EXE
  PID:4280
- C:\Windows\System\DOzDzxb.exe
  C:\Windows\System\DOzDzxb.exe
  2⤵
  - Executes dropped EXE
  PID:4316
- C:\Windows\System\PBnheSZ.exe
  C:\Windows\System\PBnheSZ.exe
  2⤵
  PID:4104
- C:\Windows\System\WQwJUKp.exe
  C:\Windows\System\WQwJUKp.exe
  2⤵
  PID:4648
- C:\Windows\System\TSLgclz.exe
  C:\Windows\System\TSLgclz.exe
  2⤵
  PID:2252
- C:\Windows\System\vpOfzbC.exe
  C:\Windows\System\vpOfzbC.exe
  2⤵
  PID:5072
- C:\Windows\System\wXYaqTU.exe
  C:\Windows\System\wXYaqTU.exe
  2⤵
  PID:1972
- C:\Windows\System\JXMQefg.exe
  C:\Windows\System\JXMQefg.exe
  2⤵
  PID:1876
- C:\Windows\System\WiiHsWU.exe
  C:\Windows\System\WiiHsWU.exe
  2⤵
  PID:3640
- C:\Windows\System\IOqGNyW.exe
  C:\Windows\System\IOqGNyW.exe
  2⤵
  PID:2268
- C:\Windows\System\madKlHp.exe
  C:\Windows\System\madKlHp.exe
  2⤵
  PID:1712
- C:\Windows\System\TRCfDmp.exe
  C:\Windows\System\TRCfDmp.exe
  2⤵
  PID:2380
- C:\Windows\System\eQagxrx.exe
  C:\Windows\System\eQagxrx.exe
  2⤵
  PID:4644
- C:\Windows\System\chSBJbw.exe
  C:\Windows\System\chSBJbw.exe
  2⤵
  PID:1684
- C:\Windows\System\vlFPjLc.exe
  C:\Windows\System\vlFPjLc.exe
  2⤵
  PID:1320
- C:\Windows\System\QQAuxtT.exe
  C:\Windows\System\QQAuxtT.exe
  2⤵
  PID:4728
- C:\Windows\System\ZsxFhPQ.exe
  C:\Windows\System\ZsxFhPQ.exe
  2⤵
  PID:4628
- C:\Windows\System\tOviisi.exe
  C:\Windows\System\tOviisi.exe
  2⤵
  PID:2036
- C:\Windows\System\nUhYNyC.exe
  C:\Windows\System\nUhYNyC.exe
  2⤵
  PID:1340
- C:\Windows\System\HLXmdZV.exe
  C:\Windows\System\HLXmdZV.exe
  2⤵
  PID:4144
- C:\Windows\System\wXdYBAM.exe
  C:\Windows\System\wXdYBAM.exe
  2⤵
  PID:2152
- C:\Windows\System\MkvnqCF.exe
  C:\Windows\System\MkvnqCF.exe
  2⤵
  PID:2236
- C:\Windows\System\wYSuhPD.exe
  C:\Windows\System\wYSuhPD.exe
  2⤵
  PID:1256
- C:\Windows\System\kJscbMG.exe
  C:\Windows\System\kJscbMG.exe
  2⤵
  PID:1592
- C:\Windows\System\XBcgwaT.exe
  C:\Windows\System\XBcgwaT.exe
  2⤵
  PID:2240
- C:\Windows\System\xsBGBiv.exe
  C:\Windows\System\xsBGBiv.exe
  2⤵
  PID:4500
- C:\Windows\System\HPcByqO.exe
  C:\Windows\System\HPcByqO.exe
  2⤵
  PID:5136
- C:\Windows\System\CGECPNr.exe
  C:\Windows\System\CGECPNr.exe
  2⤵
  PID:5164
- C:\Windows\System\aMmFhCb.exe
  C:\Windows\System\aMmFhCb.exe
  2⤵
  PID:5180
- C:\Windows\System\JSFgjKh.exe
  C:\Windows\System\JSFgjKh.exe
  2⤵
  PID:5212
- C:\Windows\System\zkmSJZO.exe
  C:\Windows\System\zkmSJZO.exe
  2⤵
  PID:5236
- C:\Windows\System\uxedpCP.exe
  C:\Windows\System\uxedpCP.exe
  2⤵
  PID:5256
- C:\Windows\System\QXFmFEh.exe
  C:\Windows\System\QXFmFEh.exe
  2⤵
  PID:5280
- C:\Windows\System\dkTPFnh.exe
  C:\Windows\System\dkTPFnh.exe
  2⤵
  PID:5312
- C:\Windows\System\rqFCIpf.exe
  C:\Windows\System\rqFCIpf.exe
  2⤵
  PID:5336
- C:\Windows\System\QhFGmFw.exe
  C:\Windows\System\QhFGmFw.exe
  2⤵
  PID:5364
- C:\Windows\System\sWxXOjG.exe
  C:\Windows\System\sWxXOjG.exe
  2⤵
  PID:5396
- C:\Windows\System\fPVVown.exe
  C:\Windows\System\fPVVown.exe
  2⤵
  PID:5420
- C:\Windows\System\vxBEIte.exe
  C:\Windows\System\vxBEIte.exe
  2⤵
  PID:5448
- C:\Windows\System\yxQyaTx.exe
  C:\Windows\System\yxQyaTx.exe
  2⤵
  PID:5524
- C:\Windows\System\WzFarUd.exe
  C:\Windows\System\WzFarUd.exe
  2⤵
  PID:5540
- C:\Windows\System\EHmkdgN.exe
  C:\Windows\System\EHmkdgN.exe
  2⤵
  PID:5556
- C:\Windows\System\PbQcufH.exe
  C:\Windows\System\PbQcufH.exe
  2⤵
  PID:5572
- C:\Windows\System\lyXmdJe.exe
  C:\Windows\System\lyXmdJe.exe
  2⤵
  PID:5600
- C:\Windows\System\OJKBTPf.exe
  C:\Windows\System\OJKBTPf.exe
  2⤵
  PID:5624
- C:\Windows\System\yngFBKQ.exe
  C:\Windows\System\yngFBKQ.exe
  2⤵
  PID:5656
- C:\Windows\System\fEZlKgi.exe
  C:\Windows\System\fEZlKgi.exe
  2⤵
  PID:5680
- C:\Windows\System\IZAkhdF.exe
  C:\Windows\System\IZAkhdF.exe
  2⤵
  PID:5712
- C:\Windows\System\tyXidgn.exe
  C:\Windows\System\tyXidgn.exe
  2⤵
  PID:5736
- C:\Windows\System\PmXHnIN.exe
  C:\Windows\System\PmXHnIN.exe
  2⤵
  PID:5764
- C:\Windows\System\vxZIfEE.exe
  C:\Windows\System\vxZIfEE.exe
  2⤵
  PID:5796
- C:\Windows\System\VWciIWu.exe
  C:\Windows\System\VWciIWu.exe
  2⤵
  PID:5872
- C:\Windows\System\PbUIdpC.exe
  C:\Windows\System\PbUIdpC.exe
  2⤵
  PID:5904
- C:\Windows\System\qbFJcPY.exe
  C:\Windows\System\qbFJcPY.exe
  2⤵
  PID:5956
- C:\Windows\System\JcRgJeh.exe
  C:\Windows\System\JcRgJeh.exe
  2⤵
  PID:5984
- C:\Windows\System\uqqAnCS.exe
  C:\Windows\System\uqqAnCS.exe
  2⤵
  PID:6032
- C:\Windows\System\KBgSaaa.exe
  C:\Windows\System\KBgSaaa.exe
  2⤵
  PID:6060
- C:\Windows\System\GolkOiQ.exe
  C:\Windows\System\GolkOiQ.exe
  2⤵
  PID:6088
- C:\Windows\System\giSPsDM.exe
  C:\Windows\System\giSPsDM.exe
  2⤵
  PID:6116
- C:\Windows\System\ZJuoeVi.exe
  C:\Windows\System\ZJuoeVi.exe
  2⤵
  PID:2960
- C:\Windows\System\zbanRGA.exe
  C:\Windows\System\zbanRGA.exe
  2⤵
  PID:4140
- C:\Windows\System\EyFJxrB.exe
  C:\Windows\System\EyFJxrB.exe
  2⤵
  PID:1100
- C:\Windows\System\PWSUIwW.exe
  C:\Windows\System\PWSUIwW.exe
  2⤵
  PID:2176
- C:\Windows\System\JuaxRlI.exe
  C:\Windows\System\JuaxRlI.exe
  2⤵
  PID:5156
- C:\Windows\System\NptOyPV.exe
  C:\Windows\System\NptOyPV.exe
  2⤵
  PID:5228
- C:\Windows\System\EnEXMtn.exe
  C:\Windows\System\EnEXMtn.exe
  2⤵
  PID:5276
- C:\Windows\System\XoLtjXp.exe
  C:\Windows\System\XoLtjXp.exe
  2⤵
  PID:5356
- C:\Windows\System\PIrrXZc.exe
  C:\Windows\System\PIrrXZc.exe
  2⤵
  PID:5404
- C:\Windows\System\mIMCPKu.exe
  C:\Windows\System\mIMCPKu.exe
  2⤵
  PID:5480
- C:\Windows\System\RtIhafd.exe
  C:\Windows\System\RtIhafd.exe
  2⤵
  PID:5536
- C:\Windows\System\bsCOwqV.exe
  C:\Windows\System\bsCOwqV.exe
  2⤵
  PID:5592
- C:\Windows\System\BrqCXhe.exe
  C:\Windows\System\BrqCXhe.exe
  2⤵
  PID:5640
- C:\Windows\System\HSIOmyG.exe
  C:\Windows\System\HSIOmyG.exe
  2⤵
  PID:5696
- C:\Windows\System\VxJwuZn.exe
  C:\Windows\System\VxJwuZn.exe
  2⤵
  PID:3360
- C:\Windows\System\iRsMXnv.exe
  C:\Windows\System\iRsMXnv.exe
  2⤵
  PID:696
- C:\Windows\System\JsbPuiE.exe
  C:\Windows\System\JsbPuiE.exe
  2⤵
  PID:4908
- C:\Windows\System\fseZjmB.exe
  C:\Windows\System\fseZjmB.exe
  2⤵
  PID:1352
- C:\Windows\System\cZRjjPn.exe
  C:\Windows\System\cZRjjPn.exe
  2⤵
  PID:4704
- C:\Windows\System\AQzcWfS.exe
  C:\Windows\System\AQzcWfS.exe
  2⤵
  PID:5756
- C:\Windows\System\SPZkNQG.exe
  C:\Windows\System\SPZkNQG.exe
  2⤵
  PID:5780
- C:\Windows\System\MuxLyce.exe
  C:\Windows\System\MuxLyce.exe
  2⤵
  PID:5924
- C:\Windows\System\OWgxnvz.exe
  C:\Windows\System\OWgxnvz.exe
  2⤵
  PID:5896
- C:\Windows\System\CoDMGOV.exe
  C:\Windows\System\CoDMGOV.exe
  2⤵
  PID:4508
- C:\Windows\System\vCIxjBb.exe
  C:\Windows\System\vCIxjBb.exe
  2⤵
  PID:6000
- C:\Windows\System\lGSSaJA.exe
  C:\Windows\System\lGSSaJA.exe
  2⤵
  PID:6024
- C:\Windows\System\vzpqDYF.exe
  C:\Windows\System\vzpqDYF.exe
  2⤵
  PID:3164
- C:\Windows\System\aTGnVza.exe
  C:\Windows\System\aTGnVza.exe
  2⤵
  PID:4384
- C:\Windows\System\PVDpjtS.exe
  C:\Windows\System\PVDpjtS.exe
  2⤵
  PID:6136
- C:\Windows\System\ILdDLiI.exe
  C:\Windows\System\ILdDLiI.exe
  2⤵
  PID:1736
- C:\Windows\System\hbGCaea.exe
  C:\Windows\System\hbGCaea.exe
  2⤵
  PID:816
- C:\Windows\System\GFvrQev.exe
  C:\Windows\System\GFvrQev.exe
  2⤵
  PID:2352
- C:\Windows\System\UusBfFC.exe
  C:\Windows\System\UusBfFC.exe
  2⤵
  PID:5152
- C:\Windows\System\TNRMzYH.exe
  C:\Windows\System\TNRMzYH.exe
  2⤵
  PID:5244
- C:\Windows\System\BrWSpaX.exe
  C:\Windows\System\BrWSpaX.exe
  2⤵
  PID:5320
- C:\Windows\System\CDhBQja.exe
  C:\Windows\System\CDhBQja.exe
  2⤵
  PID:744
- C:\Windows\System\AWdLBCa.exe
  C:\Windows\System\AWdLBCa.exe
  2⤵
  PID:4968
- C:\Windows\System\GKCbNxt.exe
  C:\Windows\System\GKCbNxt.exe
  2⤵
  PID:6012
- C:\Windows\System\wjtyoDL.exe
  C:\Windows\System\wjtyoDL.exe
  2⤵
  PID:6020
- C:\Windows\System\WKWvVzh.exe
  C:\Windows\System\WKWvVzh.exe
  2⤵
  PID:5668
- C:\Windows\System\RVCtuZq.exe
  C:\Windows\System\RVCtuZq.exe
  2⤵
  PID:4220
- C:\Windows\System\LlICnqU.exe
  C:\Windows\System\LlICnqU.exe
  2⤵
  PID:5112
- C:\Windows\System\JyMjPpJ.exe
  C:\Windows\System\JyMjPpJ.exe
  2⤵
  PID:3664
- C:\Windows\System\JMQIBEN.exe
  C:\Windows\System\JMQIBEN.exe
  2⤵
  PID:5856
- C:\Windows\System\JIcQHNt.exe
  C:\Windows\System\JIcQHNt.exe
  2⤵
  PID:1888
- C:\Windows\System\sYWePWH.exe
  C:\Windows\System\sYWePWH.exe
  2⤵
  PID:6108
- C:\Windows\System\NPHDsgx.exe
  C:\Windows\System\NPHDsgx.exe
  2⤵
  PID:3996
- C:\Windows\System\MgnjuKl.exe
  C:\Windows\System\MgnjuKl.exe
  2⤵
  PID:5148
- C:\Windows\System\UgwefVy.exe
  C:\Windows\System\UgwefVy.exe
  2⤵
  PID:1524
- C:\Windows\System\FpzYUKY.exe
  C:\Windows\System\FpzYUKY.exe
  2⤵
  PID:4660
- C:\Windows\System\jpCShUz.exe
  C:\Windows\System\jpCShUz.exe
  2⤵
  PID:64
- C:\Windows\System\HThwtyv.exe
  C:\Windows\System\HThwtyv.exe
  2⤵
  PID:316
- C:\Windows\System\DJsEHvc.exe
  C:\Windows\System\DJsEHvc.exe
  2⤵
  PID:1740
- C:\Windows\System\HYwEeuz.exe
  C:\Windows\System\HYwEeuz.exe
  2⤵
  PID:2148
- C:\Windows\System\VRLtzrX.exe
  C:\Windows\System\VRLtzrX.exe
  2⤵
  PID:5132
- C:\Windows\System\thsrfZh.exe
  C:\Windows\System\thsrfZh.exe
  2⤵
  PID:1772
- C:\Windows\System\piDTHzb.exe
  C:\Windows\System\piDTHzb.exe
  2⤵
  PID:5868
- C:\Windows\System\zyzzrAV.exe
  C:\Windows\System\zyzzrAV.exe
  2⤵
  PID:5504
- C:\Windows\System\MJQgNGe.exe
  C:\Windows\System\MJQgNGe.exe
  2⤵
  PID:2328
- C:\Windows\System\xSFgACd.exe
  C:\Windows\System\xSFgACd.exe
  2⤵
  PID:6188
- C:\Windows\System\TKHlHnt.exe
  C:\Windows\System\TKHlHnt.exe
  2⤵
  PID:6204
- C:\Windows\System\wRsGjNc.exe
  C:\Windows\System\wRsGjNc.exe
  2⤵
  PID:6220
- C:\Windows\System\SQsdIsj.exe
  C:\Windows\System\SQsdIsj.exe
  2⤵
  PID:6248
- C:\Windows\System\dRTfkyK.exe
  C:\Windows\System\dRTfkyK.exe
  2⤵
  PID:6276
- C:\Windows\System\UHCGtYr.exe
  C:\Windows\System\UHCGtYr.exe
  2⤵
  PID:6308
- C:\Windows\System\SHCNRHV.exe
  C:\Windows\System\SHCNRHV.exe
  2⤵
  PID:6336
- C:\Windows\System\oteaUBk.exe
  C:\Windows\System\oteaUBk.exe
  2⤵
  PID:6372
- C:\Windows\System\GBzkPQq.exe
  C:\Windows\System\GBzkPQq.exe
  2⤵
  PID:6412
- C:\Windows\System\kslNTjz.exe
  C:\Windows\System\kslNTjz.exe
  2⤵
  PID:6444
- C:\Windows\System\pUzCBBT.exe
  C:\Windows\System\pUzCBBT.exe
  2⤵
  PID:6472
- C:\Windows\System\hguVqIz.exe
  C:\Windows\System\hguVqIz.exe
  2⤵
  PID:6500
- C:\Windows\System\tXOishW.exe
  C:\Windows\System\tXOishW.exe
  2⤵
  PID:6516
- C:\Windows\System\QczLgGa.exe
  C:\Windows\System\QczLgGa.exe
  2⤵
  PID:6536
- C:\Windows\System\uzJPles.exe
  C:\Windows\System\uzJPles.exe
  2⤵
  PID:6556
- C:\Windows\System\lsxHKNt.exe
  C:\Windows\System\lsxHKNt.exe
  2⤵
  PID:6596
- C:\Windows\System\fOuBvRJ.exe
  C:\Windows\System\fOuBvRJ.exe
  2⤵
  PID:6628
- C:\Windows\System\mGubgPJ.exe
  C:\Windows\System\mGubgPJ.exe
  2⤵
  PID:6644
- C:\Windows\System\WRVUhcB.exe
  C:\Windows\System\WRVUhcB.exe
  2⤵
  PID:6660
- C:\Windows\System\qugZBPD.exe
  C:\Windows\System\qugZBPD.exe
  2⤵
  PID:6676
- C:\Windows\System\QIbWwse.exe
  C:\Windows\System\QIbWwse.exe
  2⤵
  PID:6716
- C:\Windows\System\ijQeoeG.exe
  C:\Windows\System\ijQeoeG.exe
  2⤵
  PID:6756
- C:\Windows\System\MmnvWRk.exe
  C:\Windows\System\MmnvWRk.exe
  2⤵
  PID:6780
- C:\Windows\System\OTLWwPH.exe
  C:\Windows\System\OTLWwPH.exe
  2⤵
  PID:6816
- C:\Windows\System\UdEQLOG.exe
  C:\Windows\System\UdEQLOG.exe
  2⤵
  PID:6844
- C:\Windows\System\jhQaoJx.exe
  C:\Windows\System\jhQaoJx.exe
  2⤵
  PID:6880
- C:\Windows\System\hfDhmDE.exe
  C:\Windows\System\hfDhmDE.exe
  2⤵
  PID:6908
- C:\Windows\System\jQVGeJW.exe
  C:\Windows\System\jQVGeJW.exe
  2⤵
  PID:6928
- C:\Windows\System\zbDnBzc.exe
  C:\Windows\System\zbDnBzc.exe
  2⤵
  PID:6964
- C:\Windows\System\HKeDfcv.exe
  C:\Windows\System\HKeDfcv.exe
  2⤵
  PID:6992
- C:\Windows\System\tvfmRNW.exe
  C:\Windows\System\tvfmRNW.exe
  2⤵
  PID:7008
- C:\Windows\System\AdJpjLJ.exe
  C:\Windows\System\AdJpjLJ.exe
  2⤵
  PID:7060
- C:\Windows\System\PcWKnez.exe
  C:\Windows\System\PcWKnez.exe
  2⤵
  PID:7084
- C:\Windows\System\LBFJyir.exe
  C:\Windows\System\LBFJyir.exe
  2⤵
  PID:7112
- C:\Windows\System\KAAJJMW.exe
  C:\Windows\System\KAAJJMW.exe
  2⤵
  PID:7132
- C:\Windows\System\dbcosOA.exe
  C:\Windows\System\dbcosOA.exe
  2⤵
  PID:7152
- C:\Windows\System\otIcdwV.exe
  C:\Windows\System\otIcdwV.exe
  2⤵
  PID:6180
- C:\Windows\System\FWpHdII.exe
  C:\Windows\System\FWpHdII.exe
  2⤵
  PID:6200
- C:\Windows\System\EDpwXNK.exe
  C:\Windows\System\EDpwXNK.exe
  2⤵
  PID:6304
- C:\Windows\System\WLzpmDC.exe
  C:\Windows\System\WLzpmDC.exe
  2⤵
  PID:6396
- C:\Windows\System\VGRejox.exe
  C:\Windows\System\VGRejox.exe
  2⤵
  PID:6488
- C:\Windows\System\oqHVdXQ.exe
  C:\Windows\System\oqHVdXQ.exe
  2⤵
  PID:6548
- C:\Windows\System\GZmMYjO.exe
  C:\Windows\System\GZmMYjO.exe
  2⤵
  PID:6592
- C:\Windows\System\DGDgWSD.exe
  C:\Windows\System\DGDgWSD.exe
  2⤵
  PID:6672
- C:\Windows\System\XgGvxRw.exe
  C:\Windows\System\XgGvxRw.exe
  2⤵
  PID:6728
- C:\Windows\System\emEWIAj.exe
  C:\Windows\System\emEWIAj.exe
  2⤵
  PID:6812
- C:\Windows\System\esIQNXR.exe
  C:\Windows\System\esIQNXR.exe
  2⤵
  PID:6860
- C:\Windows\System\ItWpCcL.exe
  C:\Windows\System\ItWpCcL.exe
  2⤵
  PID:6940
- C:\Windows\System\ylwdrti.exe
  C:\Windows\System\ylwdrti.exe
  2⤵
  PID:7004
- C:\Windows\System\pTNNnPa.exe
  C:\Windows\System\pTNNnPa.exe
  2⤵
  PID:7092
- C:\Windows\System\QxqHfCn.exe
  C:\Windows\System\QxqHfCn.exe
  2⤵
  PID:7164
- C:\Windows\System\CAFtMIc.exe
  C:\Windows\System\CAFtMIc.exe
  2⤵
  PID:6232
- C:\Windows\System\HNYXpSk.exe
  C:\Windows\System\HNYXpSk.exe
  2⤵
  PID:6384
- C:\Windows\System\reisvNN.exe
  C:\Windows\System\reisvNN.exe
  2⤵
  PID:6528
- C:\Windows\System\EJAFqIR.exe
  C:\Windows\System\EJAFqIR.exe
  2⤵
  PID:6616
- C:\Windows\System\pVrzHIj.exe
  C:\Windows\System\pVrzHIj.exe
  2⤵
  PID:6700
- C:\Windows\System\TwRwufv.exe
  C:\Windows\System\TwRwufv.exe
  2⤵
  PID:6972
- C:\Windows\System\lpSQdOQ.exe
  C:\Windows\System\lpSQdOQ.exe
  2⤵
  PID:6160
- C:\Windows\System\rxcmapc.exe
  C:\Windows\System\rxcmapc.exe
  2⤵
  PID:4512
- C:\Windows\System\EdUhdVb.exe
  C:\Windows\System\EdUhdVb.exe
  2⤵
  PID:6708
- C:\Windows\System\YwqrHSa.exe
  C:\Windows\System\YwqrHSa.exe
  2⤵
  PID:7104
- C:\Windows\System\xaoOMQP.exe
  C:\Windows\System\xaoOMQP.exe
  2⤵
  PID:7128
- C:\Windows\System\rrbAPte.exe
  C:\Windows\System\rrbAPte.exe
  2⤵
  PID:7180
- C:\Windows\System\XmxjZpo.exe
  C:\Windows\System\XmxjZpo.exe
  2⤵
  PID:7208
- C:\Windows\System\odWhptY.exe
  C:\Windows\System\odWhptY.exe
  2⤵
  PID:7236
- C:\Windows\System\ymTGqNA.exe
  C:\Windows\System\ymTGqNA.exe
  2⤵
  PID:7264
- C:\Windows\System\PjKPjVC.exe
  C:\Windows\System\PjKPjVC.exe
  2⤵
  PID:7292
- C:\Windows\System\ekUobJQ.exe
  C:\Windows\System\ekUobJQ.exe
  2⤵
  PID:7320
- C:\Windows\System\vErbiGY.exe
  C:\Windows\System\vErbiGY.exe
  2⤵
  PID:7344
- C:\Windows\System\HOvDiPx.exe
  C:\Windows\System\HOvDiPx.exe
  2⤵
  PID:7368
- C:\Windows\System\hnuNAUt.exe
  C:\Windows\System\hnuNAUt.exe
  2⤵
  PID:7400
- C:\Windows\System\WDBTCFv.exe
  C:\Windows\System\WDBTCFv.exe
  2⤵
  PID:7436
- C:\Windows\System\xZRCQXE.exe
  C:\Windows\System\xZRCQXE.exe
  2⤵
  PID:7464
- C:\Windows\System\tuaJsHy.exe
  C:\Windows\System\tuaJsHy.exe
  2⤵
  PID:7492
- C:\Windows\System\zRVUhLW.exe
  C:\Windows\System\zRVUhLW.exe
  2⤵
  PID:7520
- C:\Windows\System\qKYmHLd.exe
  C:\Windows\System\qKYmHLd.exe
  2⤵
  PID:7548
- C:\Windows\System\hszXBYo.exe
  C:\Windows\System\hszXBYo.exe
  2⤵
  PID:7580
- C:\Windows\System\tOHeqaa.exe
  C:\Windows\System\tOHeqaa.exe
  2⤵
  PID:7608
- C:\Windows\System\AzTxQGs.exe
  C:\Windows\System\AzTxQGs.exe
  2⤵
  PID:7636
- C:\Windows\System\neMNQQe.exe
  C:\Windows\System\neMNQQe.exe
  2⤵
  PID:7664
- C:\Windows\System\uCqZoiv.exe
  C:\Windows\System\uCqZoiv.exe
  2⤵
  PID:7692
- C:\Windows\System\hIlpsGY.exe
  C:\Windows\System\hIlpsGY.exe
  2⤵
  PID:7720
- C:\Windows\System\PEYPTyo.exe
  C:\Windows\System\PEYPTyo.exe
  2⤵
  PID:7748
- C:\Windows\System\KHxYiYd.exe
  C:\Windows\System\KHxYiYd.exe
  2⤵
  PID:7776
- C:\Windows\System\YiIQQKN.exe
  C:\Windows\System\YiIQQKN.exe
  2⤵
  PID:7804
- C:\Windows\System\bhqjilP.exe
  C:\Windows\System\bhqjilP.exe
  2⤵
  PID:7832
- C:\Windows\System\INgnHOm.exe
  C:\Windows\System\INgnHOm.exe
  2⤵
  PID:7864
- C:\Windows\System\RVndQlb.exe
  C:\Windows\System\RVndQlb.exe
  2⤵
  PID:7880
- C:\Windows\System\AazlARB.exe
  C:\Windows\System\AazlARB.exe
  2⤵
  PID:7912
- C:\Windows\System\BeqEALd.exe
  C:\Windows\System\BeqEALd.exe
  2⤵
  PID:7940
- C:\Windows\System\sMgXnnb.exe
  C:\Windows\System\sMgXnnb.exe
  2⤵
  PID:7976
- C:\Windows\System\jyCdPin.exe
  C:\Windows\System\jyCdPin.exe
  2⤵
  PID:7996
- C:\Windows\System\VeqPROI.exe
  C:\Windows\System\VeqPROI.exe
  2⤵
  PID:8016
- C:\Windows\System\fjJbRLa.exe
  C:\Windows\System\fjJbRLa.exe
  2⤵
  PID:8036
- C:\Windows\System\NgWsBsT.exe
  C:\Windows\System\NgWsBsT.exe
  2⤵
  PID:8068
- C:\Windows\System\OysMvka.exe
  C:\Windows\System\OysMvka.exe
  2⤵
  PID:8100
- C:\Windows\System\MqoTqoT.exe
  C:\Windows\System\MqoTqoT.exe
  2⤵
  PID:8132
- C:\Windows\System\YsWCtBs.exe
  C:\Windows\System\YsWCtBs.exe
  2⤵
  PID:8168
- C:\Windows\System\KYGsrSM.exe
  C:\Windows\System\KYGsrSM.exe
  2⤵
  PID:7176
- C:\Windows\System\EQKxIVR.exe
  C:\Windows\System\EQKxIVR.exe
  2⤵
  PID:7228
- C:\Windows\System\zpjOFWT.exe
  C:\Windows\System\zpjOFWT.exe
  2⤵
  PID:7284
- C:\Windows\System\CDWmAVI.exe
  C:\Windows\System\CDWmAVI.exe
  2⤵
  PID:2624
- C:\Windows\System\gTtwYlz.exe
  C:\Windows\System\gTtwYlz.exe
  2⤵
  PID:7448
- C:\Windows\System\ITZMyde.exe
  C:\Windows\System\ITZMyde.exe
  2⤵
  PID:7512
- C:\Windows\System\crRxBov.exe
  C:\Windows\System\crRxBov.exe
  2⤵
  PID:7572
- C:\Windows\System\epwzAJH.exe
  C:\Windows\System\epwzAJH.exe
  2⤵
  PID:7620
- C:\Windows\System\XiIlvmP.exe
  C:\Windows\System\XiIlvmP.exe
  2⤵
  PID:7688
- C:\Windows\System\Vrazlsf.exe
  C:\Windows\System\Vrazlsf.exe
  2⤵
  PID:7772
- C:\Windows\System\xlZAalQ.exe
  C:\Windows\System\xlZAalQ.exe
  2⤵
  PID:7844
- C:\Windows\System\WgXKzmr.exe
  C:\Windows\System\WgXKzmr.exe
  2⤵
  PID:7876
- C:\Windows\System\ZhEztlA.exe
  C:\Windows\System\ZhEztlA.exe
  2⤵
  PID:7960
- C:\Windows\System\YeqMhzi.exe
  C:\Windows\System\YeqMhzi.exe
  2⤵
  PID:8008
- C:\Windows\System\PjYxvWB.exe
  C:\Windows\System\PjYxvWB.exe
  2⤵
  PID:8064
- C:\Windows\System\nYeHXno.exe
  C:\Windows\System\nYeHXno.exe
  2⤵
  PID:8184
- C:\Windows\System\qtdgbfu.exe
  C:\Windows\System\qtdgbfu.exe
  2⤵
  PID:7224
- C:\Windows\System\PnEVpvl.exe
  C:\Windows\System\PnEVpvl.exe
  2⤵
  PID:7332
- C:\Windows\System\DwEnzXE.exe
  C:\Windows\System\DwEnzXE.exe
  2⤵
  PID:7576
- C:\Windows\System\ySFAdDb.exe
  C:\Windows\System\ySFAdDb.exe
  2⤵
  PID:7824
- C:\Windows\System\WDptuRE.exe
  C:\Windows\System\WDptuRE.exe
  2⤵
  PID:7852
- C:\Windows\System\lkmcqUf.exe
  C:\Windows\System\lkmcqUf.exe
  2⤵
  PID:8004
- C:\Windows\System\SqhjhnJ.exe
  C:\Windows\System\SqhjhnJ.exe
  2⤵
  PID:7248
- C:\Windows\System\skbsybd.exe
  C:\Windows\System\skbsybd.exe
  2⤵
  PID:7660
- C:\Windows\System\YlCAHNC.exe
  C:\Windows\System\YlCAHNC.exe
  2⤵
  PID:8032
- C:\Windows\System\qrajpxi.exe
  C:\Windows\System\qrajpxi.exe
  2⤵
  PID:7476
- C:\Windows\System\NSejWlA.exe
  C:\Windows\System\NSejWlA.exe
  2⤵
  PID:8200
- C:\Windows\System\wghzjoV.exe
  C:\Windows\System\wghzjoV.exe
  2⤵
  PID:8216
- C:\Windows\System\WVvXIuK.exe
  C:\Windows\System\WVvXIuK.exe
  2⤵
  PID:8248
- C:\Windows\System\ErJaYmk.exe
  C:\Windows\System\ErJaYmk.exe
  2⤵
  PID:8264
- C:\Windows\System\Thjurel.exe
  C:\Windows\System\Thjurel.exe
  2⤵
  PID:8288
- C:\Windows\System\mQVXEFg.exe
  C:\Windows\System\mQVXEFg.exe
  2⤵
  PID:8312
- C:\Windows\System\YJYMXqV.exe
  C:\Windows\System\YJYMXqV.exe
  2⤵
  PID:8336
- C:\Windows\System\BaNmcio.exe
  C:\Windows\System\BaNmcio.exe
  2⤵
  PID:8364
- C:\Windows\System\DBmPloL.exe
  C:\Windows\System\DBmPloL.exe
  2⤵
  PID:8388
- C:\Windows\System\NGxBcIT.exe
  C:\Windows\System\NGxBcIT.exe
  2⤵
  PID:8412
- C:\Windows\System\TNDrcUk.exe
  C:\Windows\System\TNDrcUk.exe
  2⤵
  PID:8456
- C:\Windows\System\FMzYFpK.exe
  C:\Windows\System\FMzYFpK.exe
  2⤵
  PID:8480
- C:\Windows\System\TGgWiZB.exe
  C:\Windows\System\TGgWiZB.exe
  2⤵
  PID:8536
- C:\Windows\System\DyBGBEx.exe
  C:\Windows\System\DyBGBEx.exe
  2⤵
  PID:8552
- C:\Windows\System\nWUBUbm.exe
  C:\Windows\System\nWUBUbm.exe
  2⤵
  PID:8592
- C:\Windows\System\OeHIJIl.exe
  C:\Windows\System\OeHIJIl.exe
  2⤵
  PID:8620
- C:\Windows\System\idvXRYS.exe
  C:\Windows\System\idvXRYS.exe
  2⤵
  PID:8648
- C:\Windows\System\ZpUGuep.exe
  C:\Windows\System\ZpUGuep.exe
  2⤵
  PID:8664
- C:\Windows\System\nNGWcUe.exe
  C:\Windows\System\nNGWcUe.exe
  2⤵
  PID:8684
- C:\Windows\System\vfGgPQg.exe
  C:\Windows\System\vfGgPQg.exe
  2⤵
  PID:8724
- C:\Windows\System\QCuAfjU.exe
  C:\Windows\System\QCuAfjU.exe
  2⤵
  PID:8748
- C:\Windows\System\mFbfvHo.exe
  C:\Windows\System\mFbfvHo.exe
  2⤵
  PID:8784
- C:\Windows\System\dJaypCU.exe
  C:\Windows\System\dJaypCU.exe
  2⤵
  PID:8816
- C:\Windows\System\XuNppcd.exe
  C:\Windows\System\XuNppcd.exe
  2⤵
  PID:8832
- C:\Windows\System\xjzCdiB.exe
  C:\Windows\System\xjzCdiB.exe
  2⤵
  PID:8860
- C:\Windows\System\LzdGzTC.exe
  C:\Windows\System\LzdGzTC.exe
  2⤵
  PID:8900
- C:\Windows\System\IGyCSrC.exe
  C:\Windows\System\IGyCSrC.exe
  2⤵
  PID:8932
- C:\Windows\System\CSuAYMU.exe
  C:\Windows\System\CSuAYMU.exe
  2⤵
  PID:8952
- C:\Windows\System\DxGRonT.exe
  C:\Windows\System\DxGRonT.exe
  2⤵
  PID:8988
- C:\Windows\System\RaSGLaW.exe
  C:\Windows\System\RaSGLaW.exe
  2⤵
  PID:9004
- C:\Windows\System\IQjFusn.exe
  C:\Windows\System\IQjFusn.exe
  2⤵
  PID:9032
- C:\Windows\System\nOASJig.exe
  C:\Windows\System\nOASJig.exe
  2⤵
  PID:9064
- C:\Windows\System\cwMrIxU.exe
  C:\Windows\System\cwMrIxU.exe
  2⤵
  PID:9088
- C:\Windows\System\ylMdowQ.exe
  C:\Windows\System\ylMdowQ.exe
  2⤵
  PID:9116
- C:\Windows\System\ELMULHC.exe
  C:\Windows\System\ELMULHC.exe
  2⤵
  PID:9144
- C:\Windows\System\CCBEuhs.exe
  C:\Windows\System\CCBEuhs.exe
  2⤵
  PID:9184
- C:\Windows\System\Uhdqnqe.exe
  C:\Windows\System\Uhdqnqe.exe
  2⤵
  PID:9212
- C:\Windows\System\LKWjURq.exe
  C:\Windows\System\LKWjURq.exe
  2⤵
  PID:7432
- C:\Windows\System\AjLndiY.exe
  C:\Windows\System\AjLndiY.exe
  2⤵
  PID:8304
- C:\Windows\System\nytjKnF.exe
  C:\Windows\System\nytjKnF.exe
  2⤵
  PID:8360
- C:\Windows\System\XAZxVOC.exe
  C:\Windows\System\XAZxVOC.exe
  2⤵
  PID:8404
- C:\Windows\System\GKQUJyi.exe
  C:\Windows\System\GKQUJyi.exe
  2⤵
  PID:8500
- C:\Windows\System\wTSRXBr.exe
  C:\Windows\System\wTSRXBr.exe
  2⤵
  PID:8544
- C:\Windows\System\VqzDiAy.exe
  C:\Windows\System\VqzDiAy.exe
  2⤵
  PID:8616
- C:\Windows\System\SlmuAIL.exe
  C:\Windows\System\SlmuAIL.exe
  2⤵
  PID:8672
- C:\Windows\System\ZTfRjQX.exe
  C:\Windows\System\ZTfRjQX.exe
  2⤵
  PID:8744
- C:\Windows\System\FeNKSuh.exe
  C:\Windows\System\FeNKSuh.exe
  2⤵
  PID:8800
- C:\Windows\System\nJNlqFF.exe
  C:\Windows\System\nJNlqFF.exe
  2⤵
  PID:8852
- C:\Windows\System\dpWlqRZ.exe
  C:\Windows\System\dpWlqRZ.exe
  2⤵
  PID:8912
- C:\Windows\System\SIebQXt.exe
  C:\Windows\System\SIebQXt.exe
  2⤵
  PID:8984
- C:\Windows\System\rnFhWBu.exe
  C:\Windows\System\rnFhWBu.exe
  2⤵
  PID:9020
- C:\Windows\System\nflKTkW.exe
  C:\Windows\System\nflKTkW.exe
  2⤵
  PID:9108
- C:\Windows\System\zjxWROs.exe
  C:\Windows\System\zjxWROs.exe
  2⤵
  PID:9204
- C:\Windows\System\HBhxiMC.exe
  C:\Windows\System\HBhxiMC.exe
  2⤵
  PID:8272
- C:\Windows\System\BAKlrFb.exe
  C:\Windows\System\BAKlrFb.exe
  2⤵
  PID:8428
- C:\Windows\System\rmDzoAt.exe
  C:\Windows\System\rmDzoAt.exe
  2⤵
  PID:8524
- C:\Windows\System\NTXzltA.exe
  C:\Windows\System\NTXzltA.exe
  2⤵
  PID:8660
- C:\Windows\System\EvsawFT.exe
  C:\Windows\System\EvsawFT.exe
  2⤵
  PID:8736
- C:\Windows\System\QGEzndR.exe
  C:\Windows\System\QGEzndR.exe
  2⤵
  PID:8892
- C:\Windows\System\bfshwtp.exe
  C:\Windows\System\bfshwtp.exe
  2⤵
  PID:9072
- C:\Windows\System\ZtvwyTC.exe
  C:\Windows\System\ZtvwyTC.exe
  2⤵
  PID:8376
- C:\Windows\System\MerwmEK.exe
  C:\Windows\System\MerwmEK.exe
  2⤵
  PID:8844
- C:\Windows\System\rszWSzI.exe
  C:\Windows\System\rszWSzI.exe
  2⤵
  PID:9128
- C:\Windows\System\QdZDGZI.exe
  C:\Windows\System\QdZDGZI.exe
  2⤵
  PID:8588
- C:\Windows\System\HPBrNVf.exe
  C:\Windows\System\HPBrNVf.exe
  2⤵
  PID:9244
- C:\Windows\System\vqGunPW.exe
  C:\Windows\System\vqGunPW.exe
  2⤵
  PID:9280
- C:\Windows\System\BchYXut.exe
  C:\Windows\System\BchYXut.exe
  2⤵
  PID:9300
- C:\Windows\System\zvYKYAw.exe
  C:\Windows\System\zvYKYAw.exe
  2⤵
  PID:9316
- C:\Windows\System\JbqAfjx.exe
  C:\Windows\System\JbqAfjx.exe
  2⤵
  PID:9344
- C:\Windows\System\YSGIHhY.exe
  C:\Windows\System\YSGIHhY.exe
  2⤵
  PID:9360
- C:\Windows\System\vSPReJE.exe
  C:\Windows\System\vSPReJE.exe
  2⤵
  PID:9420
- C:\Windows\System\kRWabRP.exe
  C:\Windows\System\kRWabRP.exe
  2⤵
  PID:9452
- C:\Windows\System\YJoXHGe.exe
  C:\Windows\System\YJoXHGe.exe
  2⤵
  PID:9480
- C:\Windows\System\vvnqfwT.exe
  C:\Windows\System\vvnqfwT.exe
  2⤵
  PID:9508
- C:\Windows\System\BMEcafJ.exe
  C:\Windows\System\BMEcafJ.exe
  2⤵
  PID:9536
- C:\Windows\System\KwIlbDf.exe
  C:\Windows\System\KwIlbDf.exe
  2⤵
  PID:9556
- C:\Windows\System\ZkgMWqN.exe
  C:\Windows\System\ZkgMWqN.exe
  2⤵
  PID:9588
- C:\Windows\System\jWUGGFu.exe
  C:\Windows\System\jWUGGFu.exe
  2⤵
  PID:9624
- C:\Windows\System\JWLqmzu.exe
  C:\Windows\System\JWLqmzu.exe
  2⤵
  PID:9652
- C:\Windows\System\tuvJEdZ.exe
  C:\Windows\System\tuvJEdZ.exe
  2⤵
  PID:9668
- C:\Windows\System\VZKsRlJ.exe
  C:\Windows\System\VZKsRlJ.exe
  2⤵
  PID:9688
- C:\Windows\System\NxStIgv.exe
  C:\Windows\System\NxStIgv.exe
  2⤵
  PID:9716
- C:\Windows\System\tTlxruY.exe
  C:\Windows\System\tTlxruY.exe
  2⤵
  PID:9744
- C:\Windows\System\YXyCtFS.exe
  C:\Windows\System\YXyCtFS.exe
  2⤵
  PID:9772
- C:\Windows\System\XsotPyg.exe
  C:\Windows\System\XsotPyg.exe
  2⤵
  PID:9800
- C:\Windows\System\kNwlPol.exe
  C:\Windows\System\kNwlPol.exe
  2⤵
  PID:9828
- C:\Windows\System\peGpmaF.exe
  C:\Windows\System\peGpmaF.exe
  2⤵
  PID:9856
- C:\Windows\System\qeXIlgN.exe
  C:\Windows\System\qeXIlgN.exe
  2⤵
  PID:9880
- C:\Windows\System\XXtsVre.exe
  C:\Windows\System\XXtsVre.exe
  2⤵
  PID:9916
- C:\Windows\System\XGFvtFP.exe
  C:\Windows\System\XGFvtFP.exe
  2⤵
  PID:9948
- C:\Windows\System\wjNLiPF.exe
  C:\Windows\System\wjNLiPF.exe
  2⤵
  PID:9976
- C:\Windows\System\UWHnsUp.exe
  C:\Windows\System\UWHnsUp.exe
  2⤵
  PID:10004
- C:\Windows\System\yEhrVXL.exe
  C:\Windows\System\yEhrVXL.exe
  2⤵
  PID:10032
- C:\Windows\System\SeNBdmD.exe
  C:\Windows\System\SeNBdmD.exe
  2⤵
  PID:10072
- C:\Windows\System\eyVzGmA.exe
  C:\Windows\System\eyVzGmA.exe
  2⤵
  PID:10088
- C:\Windows\System\HHzVReT.exe
  C:\Windows\System\HHzVReT.exe
  2⤵
  PID:10120
- C:\Windows\System\tQMzulJ.exe
  C:\Windows\System\tQMzulJ.exe
  2⤵
  PID:10144
- C:\Windows\System\dovViYw.exe
  C:\Windows\System\dovViYw.exe
  2⤵
  PID:10160
- C:\Windows\System\DOsqfYY.exe
  C:\Windows\System\DOsqfYY.exe
  2⤵
  PID:10188
- C:\Windows\System\bJNTJXy.exe
  C:\Windows\System\bJNTJXy.exe
  2⤵
  PID:10216
- C:\Windows\System\Ilojain.exe
  C:\Windows\System\Ilojain.exe
  2⤵
  PID:9228
- C:\Windows\System\AjUAimB.exe
  C:\Windows\System\AjUAimB.exe
  2⤵
  PID:9100
- C:\Windows\System\ESKSaLH.exe
  C:\Windows\System\ESKSaLH.exe
  2⤵
  PID:9328
- C:\Windows\System\mZVIyUj.exe
  C:\Windows\System\mZVIyUj.exe
  2⤵
  PID:9388
- C:\Windows\System\dRenhfy.exe
  C:\Windows\System\dRenhfy.exe
  2⤵
  PID:9464
- C:\Windows\System\uljTfms.exe
  C:\Windows\System\uljTfms.exe
  2⤵
  PID:9524
- C:\Windows\System\IdUwkMm.exe
  C:\Windows\System\IdUwkMm.exe
  2⤵
  PID:9584
- C:\Windows\System\rnPXSpG.exe
  C:\Windows\System\rnPXSpG.exe
  2⤵
  PID:9636
- C:\Windows\System\wMItgeG.exe
  C:\Windows\System\wMItgeG.exe
  2⤵
  PID:9712
- C:\Windows\System\mIhwVcI.exe
  C:\Windows\System\mIhwVcI.exe
  2⤵
  PID:9792
- C:\Windows\System\WGtQoLY.exe
  C:\Windows\System\WGtQoLY.exe
  2⤵
  PID:9876
- C:\Windows\System\IxFcAtt.exe
  C:\Windows\System\IxFcAtt.exe
  2⤵
  PID:9944
- C:\Windows\System\zRmqBXe.exe
  C:\Windows\System\zRmqBXe.exe
  2⤵
  PID:9992
- C:\Windows\System\WYWXezy.exe
  C:\Windows\System\WYWXezy.exe
  2⤵
  PID:10056
- C:\Windows\System\BmSxdMX.exe
  C:\Windows\System\BmSxdMX.exe
  2⤵
  PID:10100
- C:\Windows\System\qbnAhZL.exe
  C:\Windows\System\qbnAhZL.exe
  2⤵
  PID:10180
- C:\Windows\System\zzWSYOh.exe
  C:\Windows\System\zzWSYOh.exe
  2⤵
  PID:10236
- C:\Windows\System\UVbXBDh.exe
  C:\Windows\System\UVbXBDh.exe
  2⤵
  PID:9312
- C:\Windows\System\auCaycI.exe
  C:\Windows\System\auCaycI.exe
  2⤵
  PID:9500
- C:\Windows\System\mXOXlVg.exe
  C:\Windows\System\mXOXlVg.exe
  2⤵
  PID:9616
- C:\Windows\System\kgFwzcV.exe
  C:\Windows\System\kgFwzcV.exe
  2⤵
  PID:9836
- C:\Windows\System\qRwmhiO.exe
  C:\Windows\System\qRwmhiO.exe
  2⤵
  PID:10024
- C:\Windows\System\pyCPKxl.exe
  C:\Windows\System\pyCPKxl.exe
  2⤵
  PID:10140
- C:\Windows\System\ikljZES.exe
  C:\Windows\System\ikljZES.exe
  2⤵
  PID:9428
- C:\Windows\System\gtFyARq.exe
  C:\Windows\System\gtFyARq.exe
  2⤵
  PID:9704
- C:\Windows\System\afNxzfL.exe
  C:\Windows\System\afNxzfL.exe
  2⤵
  PID:9996
- C:\Windows\System\sOGByZT.exe
  C:\Windows\System\sOGByZT.exe
  2⤵
  PID:9264
- C:\Windows\System\JAoBhwM.exe
  C:\Windows\System\JAoBhwM.exe
  2⤵
  PID:10228
- C:\Windows\System\PreTwOC.exe
  C:\Windows\System\PreTwOC.exe
  2⤵
  PID:10256
- C:\Windows\System\qaUbBBW.exe
  C:\Windows\System\qaUbBBW.exe
  2⤵
  PID:10280
- C:\Windows\System\MRWbLFu.exe
  C:\Windows\System\MRWbLFu.exe
  2⤵
  PID:10308
- C:\Windows\System\LdNdmTc.exe
  C:\Windows\System\LdNdmTc.exe
  2⤵
  PID:10328
- C:\Windows\System\jKosJbY.exe
  C:\Windows\System\jKosJbY.exe
  2⤵
  PID:10344
- C:\Windows\System\EiNdpaF.exe
  C:\Windows\System\EiNdpaF.exe
  2⤵
  PID:10372
- C:\Windows\System\PuKulgZ.exe
  C:\Windows\System\PuKulgZ.exe
  2⤵
  PID:10416
- C:\Windows\System\mcwPDwA.exe
  C:\Windows\System\mcwPDwA.exe
  2⤵
  PID:10452
- C:\Windows\System\XVUDZNS.exe
  C:\Windows\System\XVUDZNS.exe
  2⤵
  PID:10492
- C:\Windows\System\JdSgRIp.exe
  C:\Windows\System\JdSgRIp.exe
  2⤵
  PID:10520
- C:\Windows\System\ytCuZuR.exe
  C:\Windows\System\ytCuZuR.exe
  2⤵
  PID:10544
- C:\Windows\System\dMjrUKM.exe
  C:\Windows\System\dMjrUKM.exe
  2⤵
  PID:10568
- C:\Windows\System\jMgRzWn.exe
  C:\Windows\System\jMgRzWn.exe
  2⤵
  PID:10604
- C:\Windows\System\hBNaSsO.exe
  C:\Windows\System\hBNaSsO.exe
  2⤵
  PID:10632
- C:\Windows\System\YdYzdBv.exe
  C:\Windows\System\YdYzdBv.exe
  2⤵
  PID:10648
- C:\Windows\System\MEzUiNr.exe
  C:\Windows\System\MEzUiNr.exe
  2⤵
  PID:10688
- C:\Windows\System\GQrdwfs.exe
  C:\Windows\System\GQrdwfs.exe
  2⤵
  PID:10716
- C:\Windows\System\cqoyHKn.exe
  C:\Windows\System\cqoyHKn.exe
  2⤵
  PID:10732
- C:\Windows\System\abBpHrA.exe
  C:\Windows\System\abBpHrA.exe
  2⤵
  PID:10748
- C:\Windows\System\yjhJToZ.exe
  C:\Windows\System\yjhJToZ.exe
  2⤵
  PID:10784
- C:\Windows\System\obOLVFy.exe
  C:\Windows\System\obOLVFy.exe
  2⤵
  PID:10828
- C:\Windows\System\MlXrOre.exe
  C:\Windows\System\MlXrOre.exe
  2⤵
  PID:10856
- C:\Windows\System\byRsXEu.exe
  C:\Windows\System\byRsXEu.exe
  2⤵
  PID:10884
- C:\Windows\System\WENJSur.exe
  C:\Windows\System\WENJSur.exe
  2⤵
  PID:10904
- C:\Windows\System\wSiekcf.exe
  C:\Windows\System\wSiekcf.exe
  2⤵
  PID:10928
- C:\Windows\System\bPRTFVU.exe
  C:\Windows\System\bPRTFVU.exe
  2⤵
  PID:10956
- C:\Windows\System\nVoSYai.exe
  C:\Windows\System\nVoSYai.exe
  2⤵
  PID:10996
- C:\Windows\System\JFDvcBz.exe
  C:\Windows\System\JFDvcBz.exe
  2⤵
  PID:11024
- C:\Windows\System\sFNvQHa.exe
  C:\Windows\System\sFNvQHa.exe
  2⤵
  PID:11044
- C:\Windows\System\VxfTDfy.exe
  C:\Windows\System\VxfTDfy.exe
  2⤵
  PID:11076
- C:\Windows\System\pUuaBlV.exe
  C:\Windows\System\pUuaBlV.exe
  2⤵
  PID:11104
- C:\Windows\System\SxnyzBE.exe
  C:\Windows\System\SxnyzBE.exe
  2⤵
  PID:11136
- C:\Windows\System\cgLnRfW.exe
  C:\Windows\System\cgLnRfW.exe
  2⤵
  PID:11164
- C:\Windows\System\vBUDskT.exe
  C:\Windows\System\vBUDskT.exe
  2⤵
  PID:11180
- C:\Windows\System\xjkPQpk.exe
  C:\Windows\System\xjkPQpk.exe
  2⤵
  PID:11204
- C:\Windows\System\qfMnAvN.exe
  C:\Windows\System\qfMnAvN.exe
  2⤵
  PID:11228
- C:\Windows\System\USfbqqv.exe
  C:\Windows\System\USfbqqv.exe
  2⤵
  PID:11260
- C:\Windows\System\rDNxUMc.exe
  C:\Windows\System\rDNxUMc.exe
  2⤵
  PID:10292
- C:\Windows\System\NXMFndA.exe
  C:\Windows\System\NXMFndA.exe
  2⤵
  PID:10364
- C:\Windows\System\IqJTrxP.exe
  C:\Windows\System\IqJTrxP.exe
  2⤵
  PID:10428
- C:\Windows\System\NittlVG.exe
  C:\Windows\System\NittlVG.exe
  2⤵
  PID:10476
- C:\Windows\System\xGmtDWc.exe
  C:\Windows\System\xGmtDWc.exe
  2⤵
  PID:10532
- C:\Windows\System\fwWZOFr.exe
  C:\Windows\System\fwWZOFr.exe
  2⤵
  PID:10588
- C:\Windows\System\SYWehmf.exe
  C:\Windows\System\SYWehmf.exe
  2⤵
  PID:9544
- C:\Windows\System\qwOjjkL.exe
  C:\Windows\System\qwOjjkL.exe
  2⤵
  PID:10760
- C:\Windows\System\UwVmTud.exe
  C:\Windows\System\UwVmTud.exe
  2⤵
  PID:10820
- C:\Windows\System\wBfBTeH.exe
  C:\Windows\System\wBfBTeH.exe
  2⤵
  PID:10876
- C:\Windows\System\RRdaUdQ.exe
  C:\Windows\System\RRdaUdQ.exe
  2⤵
  PID:10924
- C:\Windows\System\eQNbsGL.exe
  C:\Windows\System\eQNbsGL.exe
  2⤵
  PID:11016
- C:\Windows\System\pmPdOWN.exe
  C:\Windows\System\pmPdOWN.exe
  2⤵
  PID:11068
- C:\Windows\System\iKtDGWy.exe
  C:\Windows\System\iKtDGWy.exe
  2⤵
  PID:11132
- C:\Windows\System\oijfTQs.exe
  C:\Windows\System\oijfTQs.exe
  2⤵
  PID:11196
- C:\Windows\System\DklAsYY.exe
  C:\Windows\System\DklAsYY.exe
  2⤵
  PID:10252
- C:\Windows\System\XwvekGw.exe
  C:\Windows\System\XwvekGw.exe
  2⤵
  PID:10320
- C:\Windows\System\gwIXVNF.exe
  C:\Windows\System\gwIXVNF.exe
  2⤵
  PID:10512
- C:\Windows\System\hhTGYWp.exe
  C:\Windows\System\hhTGYWp.exe
  2⤵
  PID:10712
- C:\Windows\System\yNZwgcD.exe
  C:\Windows\System\yNZwgcD.exe
  2⤵
  PID:10912
- C:\Windows\System\HMoMEuA.exe
  C:\Windows\System\HMoMEuA.exe
  2⤵
  PID:10976
- C:\Windows\System\mLWoDvk.exe
  C:\Windows\System\mLWoDvk.exe
  2⤵
  PID:11128
- C:\Windows\System\zxZoXYx.exe
  C:\Windows\System\zxZoXYx.exe
  2⤵
  PID:11244
- C:\Windows\System\fTHXTGs.exe
  C:\Windows\System\fTHXTGs.exe
  2⤵
  PID:10740
- C:\Windows\System\OLOtfGW.exe
  C:\Windows\System\OLOtfGW.exe
  2⤵
  PID:11036
- C:\Windows\System\ekkvUNS.exe
  C:\Windows\System\ekkvUNS.exe
  2⤵
  PID:10288
- C:\Windows\System\mJDJtrj.exe
  C:\Windows\System\mJDJtrj.exe
  2⤵
  PID:10728
- C:\Windows\System\VLmnace.exe
  C:\Windows\System\VLmnace.exe
  2⤵
  PID:11284
- C:\Windows\System\QPXmQiY.exe
  C:\Windows\System\QPXmQiY.exe
  2⤵
  PID:11312
- C:\Windows\System\GKpFJzu.exe
  C:\Windows\System\GKpFJzu.exe
  2⤵
  PID:11344
- C:\Windows\System\VzpVBnF.exe
  C:\Windows\System\VzpVBnF.exe
  2⤵
  PID:11364
- C:\Windows\System\EVIjYGR.exe
  C:\Windows\System\EVIjYGR.exe
  2⤵
  PID:11412
- C:\Windows\System\JWLuulH.exe
  C:\Windows\System\JWLuulH.exe
  2⤵
  PID:11428
- C:\Windows\System\xFjwQxl.exe
  C:\Windows\System\xFjwQxl.exe
  2⤵
  PID:11468
- C:\Windows\System\ghTLVSE.exe
  C:\Windows\System\ghTLVSE.exe
  2⤵
  PID:11488
- C:\Windows\System\MbbkqGf.exe
  C:\Windows\System\MbbkqGf.exe
  2⤵
  PID:11512
- C:\Windows\System\TguRoXr.exe
  C:\Windows\System\TguRoXr.exe
  2⤵
  PID:11540
- C:\Windows\System\LyZSSfz.exe
  C:\Windows\System\LyZSSfz.exe
  2⤵
  PID:11560
- C:\Windows\System\tSJEJqt.exe
  C:\Windows\System\tSJEJqt.exe
  2⤵
  PID:11592
- C:\Windows\System\YoADuNg.exe
  C:\Windows\System\YoADuNg.exe
  2⤵
  PID:11636
- C:\Windows\System\IjdzScg.exe
  C:\Windows\System\IjdzScg.exe
  2⤵
  PID:11664
- C:\Windows\System\FcvRGYV.exe
  C:\Windows\System\FcvRGYV.exe
  2⤵
  PID:11692
- C:\Windows\System\zrkFoYr.exe
  C:\Windows\System\zrkFoYr.exe
  2⤵
  PID:11720
- C:\Windows\System\ArvnfLI.exe
  C:\Windows\System\ArvnfLI.exe
  2⤵
  PID:11748
- C:\Windows\System\rsHAQDe.exe
  C:\Windows\System\rsHAQDe.exe
  2⤵
  PID:11776
- C:\Windows\System\gDtIcXW.exe
  C:\Windows\System\gDtIcXW.exe
  2⤵
  PID:11796
- C:\Windows\System\TZGbIrA.exe
  C:\Windows\System\TZGbIrA.exe
  2⤵
  PID:11824
- C:\Windows\System\iXwMpbL.exe
  C:\Windows\System\iXwMpbL.exe
  2⤵
  PID:11852
- C:\Windows\System\CjFCYDk.exe
  C:\Windows\System\CjFCYDk.exe
  2⤵
  PID:11880
- C:\Windows\System\OtXAfHs.exe
  C:\Windows\System\OtXAfHs.exe
  2⤵
  PID:11912
- C:\Windows\System\RyAFqAf.exe
  C:\Windows\System\RyAFqAf.exe
  2⤵
  PID:11932
- C:\Windows\System\ahpJzrV.exe
  C:\Windows\System\ahpJzrV.exe
  2⤵
  PID:11972
- C:\Windows\System\iQaEaZD.exe
  C:\Windows\System\iQaEaZD.exe
  2⤵
  PID:12000
- C:\Windows\System\KJsTvcD.exe
  C:\Windows\System\KJsTvcD.exe
  2⤵
  PID:12028
- C:\Windows\System\yPiqfMq.exe
  C:\Windows\System\yPiqfMq.exe
  2⤵
  PID:12056
- C:\Windows\System\vvmpJWD.exe
  C:\Windows\System\vvmpJWD.exe
  2⤵
  PID:12080
- C:\Windows\System\GSTKldA.exe
  C:\Windows\System\GSTKldA.exe
  2⤵
  PID:12096
- C:\Windows\System\qRxEEFm.exe
  C:\Windows\System\qRxEEFm.exe
  2⤵
  PID:12140
- C:\Windows\System\xYDiiuc.exe
  C:\Windows\System\xYDiiuc.exe
  2⤵
  PID:12168
- C:\Windows\System\hHAnfiU.exe
  C:\Windows\System\hHAnfiU.exe
  2⤵
  PID:12196
- C:\Windows\System\BahUwqp.exe
  C:\Windows\System\BahUwqp.exe
  2⤵
  PID:12216
- C:\Windows\System\XZEBvVA.exe
  C:\Windows\System\XZEBvVA.exe
  2⤵
  PID:12252
- C:\Windows\System\DtVHinN.exe
  C:\Windows\System\DtVHinN.exe
  2⤵
  PID:12268
- C:\Windows\System\cwukUwG.exe
  C:\Windows\System\cwukUwG.exe
  2⤵
  PID:11268
- C:\Windows\System\vDIbdnM.exe
  C:\Windows\System\vDIbdnM.exe
  2⤵
  PID:11336
- C:\Windows\System\TgwVHch.exe
  C:\Windows\System\TgwVHch.exe
  2⤵
  PID:11392
- C:\Windows\System\ynqQdQe.exe
  C:\Windows\System\ynqQdQe.exe
  2⤵
  PID:11420
- C:\Windows\System\bjrUkkr.exe
  C:\Windows\System\bjrUkkr.exe
  2⤵
  PID:11532
- C:\Windows\System\tgepNce.exe
  C:\Windows\System\tgepNce.exe
  2⤵
  PID:11576
- C:\Windows\System\ybpVKqr.exe
  C:\Windows\System\ybpVKqr.exe
  2⤵
  PID:11620
- C:\Windows\System\HAXBAxV.exe
  C:\Windows\System\HAXBAxV.exe
  2⤵
  PID:11736
- C:\Windows\System\zpZWntL.exe
  C:\Windows\System\zpZWntL.exe
  2⤵
  PID:11788
- C:\Windows\System\cMwRVYX.exe
  C:\Windows\System\cMwRVYX.exe
  2⤵
  PID:11872
- C:\Windows\System\fnAfEpb.exe
  C:\Windows\System\fnAfEpb.exe
  2⤵
  PID:11924
- C:\Windows\System\GaLCunC.exe
  C:\Windows\System\GaLCunC.exe
  2⤵
  PID:12012
- C:\Windows\System\HtqQTWa.exe
  C:\Windows\System\HtqQTWa.exe
  2⤵
  PID:12040
- C:\Windows\System\MtoRUlo.exe
  C:\Windows\System\MtoRUlo.exe
  2⤵
  PID:12120
- C:\Windows\System\zHPfMcw.exe
  C:\Windows\System\zHPfMcw.exe
  2⤵
  PID:12156
- C:\Windows\System\TISykkh.exe
  C:\Windows\System\TISykkh.exe
  2⤵
  PID:12224
- C:\Windows\System\ebgwbdy.exe
  C:\Windows\System\ebgwbdy.exe
  2⤵
  PID:11328
- C:\Windows\System\fueIyqF.exe
  C:\Windows\System\fueIyqF.exe
  2⤵
  PID:11408
- C:\Windows\System\oEtVvWv.exe
  C:\Windows\System\oEtVvWv.exe
  2⤵
  PID:11660
- C:\Windows\System\wfgigph.exe
  C:\Windows\System\wfgigph.exe
  2⤵
  PID:11760
- C:\Windows\System\xJnZdiR.exe
  C:\Windows\System\xJnZdiR.exe
  2⤵
  PID:11908
- C:\Windows\System\koVBcls.exe
  C:\Windows\System\koVBcls.exe
  2⤵
  PID:12092
- C:\Windows\System\vNypNhm.exe
  C:\Windows\System\vNypNhm.exe
  2⤵
  PID:12280
- C:\Windows\System\epzRUhY.exe
  C:\Windows\System\epzRUhY.exe
  2⤵
  PID:11612
- C:\Windows\System\BpqqJjp.exe
  C:\Windows\System\BpqqJjp.exe
  2⤵
  PID:12020
- C:\Windows\System\rSOmSLR.exe
  C:\Windows\System\rSOmSLR.exe
  2⤵
  PID:12148
- C:\Windows\System\apBuXmG.exe
  C:\Windows\System\apBuXmG.exe
  2⤵
  PID:11680
- C:\Windows\System\LHYQjEg.exe
  C:\Windows\System\LHYQjEg.exe
  2⤵
  PID:11864
- C:\Windows\System\UaVvLEm.exe
  C:\Windows\System\UaVvLEm.exe
  2⤵
  PID:12292
- C:\Windows\System\CJGItOp.exe
  C:\Windows\System\CJGItOp.exe
  2⤵
  PID:12316
- C:\Windows\System\cRkcxVt.exe
  C:\Windows\System\cRkcxVt.exe
  2⤵
  PID:12336
- C:\Windows\System\UYYVLwX.exe
  C:\Windows\System\UYYVLwX.exe
  2⤵
  PID:12396
- C:\Windows\System\qCcPYkp.exe
  C:\Windows\System\qCcPYkp.exe
  2⤵
  PID:12416
- C:\Windows\System\wFYwIZp.exe
  C:\Windows\System\wFYwIZp.exe
  2⤵
  PID:12440
- C:\Windows\System\UXvZqLn.exe
  C:\Windows\System\UXvZqLn.exe
  2⤵
  PID:12472
- C:\Windows\System\WjaBoHP.exe
  C:\Windows\System\WjaBoHP.exe
  2⤵
  PID:12500
- C:\Windows\System\exMofYI.exe
  C:\Windows\System\exMofYI.exe
  2⤵
  PID:12520
- C:\Windows\System\wpSgwpO.exe
  C:\Windows\System\wpSgwpO.exe
  2⤵
  PID:12548
- C:\Windows\System\kIYFNjJ.exe
  C:\Windows\System\kIYFNjJ.exe
  2⤵
  PID:12576
- C:\Windows\System\LUOumLf.exe
  C:\Windows\System\LUOumLf.exe
  2⤵
  PID:12604
- C:\Windows\System\JmmkHrX.exe
  C:\Windows\System\JmmkHrX.exe
  2⤵
  PID:12632
- C:\Windows\System\twzYJlO.exe
  C:\Windows\System\twzYJlO.exe
  2⤵
  PID:12652
- C:\Windows\System\rJmbQQv.exe
  C:\Windows\System\rJmbQQv.exe
  2⤵
  PID:12680
- C:\Windows\System\KDBQtmq.exe
  C:\Windows\System\KDBQtmq.exe
  2⤵
  PID:12704
- C:\Windows\System\TEJsmPB.exe
  C:\Windows\System\TEJsmPB.exe
  2⤵
  PID:12724
- C:\Windows\System\iEehuzX.exe
  C:\Windows\System\iEehuzX.exe
  2⤵
  PID:12744
- C:\Windows\System\lZOqDmz.exe
  C:\Windows\System\lZOqDmz.exe
  2⤵
  PID:12772
- C:\Windows\System\pzTOJbc.exe
  C:\Windows\System\pzTOJbc.exe
  2⤵
  PID:12828
- C:\Windows\System\jwTfmQi.exe
  C:\Windows\System\jwTfmQi.exe
  2⤵
  PID:12852
- C:\Windows\System\ZdNUmIu.exe
  C:\Windows\System\ZdNUmIu.exe
  2⤵
  PID:12880
- C:\Windows\System\zfzDYzT.exe
  C:\Windows\System\zfzDYzT.exe
  2⤵
  PID:12900
- C:\Windows\System\oZjieQD.exe
  C:\Windows\System\oZjieQD.exe
  2⤵
  PID:12980
- C:\Windows\System\uSvXCTf.exe
  C:\Windows\System\uSvXCTf.exe
  2⤵
  PID:13000
- C:\Windows\System\tTbXtXQ.exe
  C:\Windows\System\tTbXtXQ.exe
  2⤵
  PID:13028
- C:\Windows\System\dSYOURd.exe
  C:\Windows\System\dSYOURd.exe
  2⤵
  PID:13056
- C:\Windows\System\iJjORbW.exe
  C:\Windows\System\iJjORbW.exe
  2⤵
  PID:13076
- C:\Windows\System\kiUtXAf.exe
  C:\Windows\System\kiUtXAf.exe
  2⤵
  PID:13104
- C:\Windows\System\onatKxb.exe
  C:\Windows\System\onatKxb.exe
  2⤵
  PID:13136
- C:\Windows\System\JuDfmjl.exe
  C:\Windows\System\JuDfmjl.exe
  2⤵
  PID:13156
- C:\Windows\System\TFPLLbH.exe
  C:\Windows\System\TFPLLbH.exe
  2⤵
  PID:13192
- C:\Windows\System\vloTUmv.exe
  C:\Windows\System\vloTUmv.exe
  2⤵
  PID:13216
- C:\Windows\System\zRTGKgt.exe
  C:\Windows\System\zRTGKgt.exe
  2⤵
  PID:13244
- C:\Windows\System\tQSOMrl.exe
  C:\Windows\System\tQSOMrl.exe
  2⤵
  PID:13284
- C:\Windows\System\xtNrAhF.exe
  C:\Windows\System\xtNrAhF.exe
  2⤵
  PID:13300
- C:\Windows\System\DfTgwiz.exe
  C:\Windows\System\DfTgwiz.exe
  2⤵
  PID:12376
- C:\Windows\System\wBuUmLt.exe
  C:\Windows\System\wBuUmLt.exe
  2⤵
  PID:12388
- C:\Windows\System\PQHIfAP.exe
  C:\Windows\System\PQHIfAP.exe
  2⤵
  PID:12432
- C:\Windows\System\MifrarM.exe
  C:\Windows\System\MifrarM.exe
  2⤵
  PID:12488
- C:\Windows\System\uuQOXJl.exe
  C:\Windows\System\uuQOXJl.exe
  2⤵
  PID:12592
- C:\Windows\System\vfybQlH.exe
  C:\Windows\System\vfybQlH.exe
  2⤵
  PID:12716
- C:\Windows\System\sIZbMel.exe
  C:\Windows\System\sIZbMel.exe
  2⤵
  PID:12692
- C:\Windows\System\uYPBzok.exe
  C:\Windows\System\uYPBzok.exe
  2⤵
  PID:12764
- C:\Windows\System\XTFQMFi.exe
  C:\Windows\System\XTFQMFi.exe
  2⤵
  PID:12792
- C:\Windows\System\qPdPSUZ.exe
  C:\Windows\System\qPdPSUZ.exe
  2⤵
  PID:12892
- C:\Windows\System\skkhxSs.exe
  C:\Windows\System\skkhxSs.exe
  2⤵
  PID:12972
- C:\Windows\System\qtYYJdb.exe
  C:\Windows\System\qtYYJdb.exe
  2⤵
  PID:13040
- C:\Windows\System\ZudWuPp.exe
  C:\Windows\System\ZudWuPp.exe
  2⤵
  PID:13064
- C:\Windows\System\ehCHjqQ.exe
  C:\Windows\System\ehCHjqQ.exe
  2⤵
  PID:13152
- C:\Windows\System\AyjRYNI.exe
  C:\Windows\System\AyjRYNI.exe
  2⤵
  PID:13280
- C:\Windows\System\YKAlRdM.exe
  C:\Windows\System\YKAlRdM.exe
  2⤵
  PID:12308
- C:\Windows\System\VrjWLaz.exe
  C:\Windows\System\VrjWLaz.exe
  2⤵
  PID:12448
- C:\Windows\System\ZEwOIcJ.exe
  C:\Windows\System\ZEwOIcJ.exe
  2⤵
  PID:12648
- C:\Windows\System\SkpuRJm.exe
  C:\Windows\System\SkpuRJm.exe
  2⤵
  PID:12740
- C:\Windows\System\XHNFxTE.exe
  C:\Windows\System\XHNFxTE.exe
  2⤵
  PID:12876
- C:\Windows\System\NoRZOoM.exe
  C:\Windows\System\NoRZOoM.exe
  2⤵
  PID:13052
- C:\Windows\System\JJTLxnz.exe
  C:\Windows\System\JJTLxnz.exe
  2⤵
  PID:13188
- C:\Windows\System\QADLBCq.exe
  C:\Windows\System\QADLBCq.exe
  2⤵
  PID:12532
- C:\Windows\System\ukPTYfH.exe
  C:\Windows\System\ukPTYfH.exe
  2⤵
  PID:12640
- C:\Windows\System\qlqMgzo.exe
  C:\Windows\System\qlqMgzo.exe
  2⤵
  PID:13112
- C:\Windows\System\SFkOJdU.exe
  C:\Windows\System\SFkOJdU.exe
  2⤵
  PID:12664
- C:\Windows\System\MAIsFkD.exe
  C:\Windows\System\MAIsFkD.exe
  2⤵
  PID:13328
- C:\Windows\System\zmNADwZ.exe
  C:\Windows\System\zmNADwZ.exe
  2⤵
  PID:13368
- C:\Windows\System\lXGrxET.exe
  C:\Windows\System\lXGrxET.exe
  2⤵
  PID:13396
- C:\Windows\System\bkGLUJA.exe
  C:\Windows\System\bkGLUJA.exe
  2⤵
  PID:13412
- C:\Windows\System\WoXOTtq.exe
  C:\Windows\System\WoXOTtq.exe
  2⤵
  PID:13440
- C:\Windows\System\dAFsFam.exe
  C:\Windows\System\dAFsFam.exe
  2⤵
  PID:13456
- C:\Windows\System\bkUqDOj.exe
  C:\Windows\System\bkUqDOj.exe
  2⤵
  PID:13476
- C:\Windows\System\EfLpNuc.exe
  C:\Windows\System\EfLpNuc.exe
  2⤵
  PID:13536
- C:\Windows\System\RBxLMZV.exe
  C:\Windows\System\RBxLMZV.exe
  2⤵
  PID:13560
- C:\Windows\System\UjuJJnU.exe
  C:\Windows\System\UjuJJnU.exe
  2⤵
  PID:13584
- C:\Windows\System\qaEBbLW.exe
  C:\Windows\System\qaEBbLW.exe
  2⤵
  PID:13616
- C:\Windows\System\AanNWet.exe
  C:\Windows\System\AanNWet.exe
  2⤵
  PID:13648
- C:\Windows\System\coMKdHU.exe
  C:\Windows\System\coMKdHU.exe
  2⤵
  PID:13664
- C:\Windows\System\vMZbXdi.exe
  C:\Windows\System\vMZbXdi.exe
  2⤵
  PID:13692
- C:\Windows\System\GBDOZNN.exe
  C:\Windows\System\GBDOZNN.exe
  2⤵
  PID:13728
- C:\Windows\System\ToAcYMV.exe
  C:\Windows\System\ToAcYMV.exe
  2⤵
  PID:13744
- C:\Windows\System\PyrMFSe.exe
  C:\Windows\System\PyrMFSe.exe
  2⤵
  PID:13788
- C:\Windows\System\MIURnrg.exe
  C:\Windows\System\MIURnrg.exe
  2⤵
  PID:13816
- C:\Windows\System\xBSlkxO.exe
  C:\Windows\System\xBSlkxO.exe
  2⤵
  PID:13844
- C:\Windows\System\IkWdnSz.exe
  C:\Windows\System\IkWdnSz.exe
  2⤵
  PID:13860
- C:\Windows\System\lEghQUn.exe
  C:\Windows\System\lEghQUn.exe
  2⤵
  PID:13888
- C:\Windows\System\EMqpupl.exe
  C:\Windows\System\EMqpupl.exe
  2⤵
  PID:13916
- C:\Windows\System\YaXRtwk.exe
  C:\Windows\System\YaXRtwk.exe
  2⤵
  PID:13944
- C:\Windows\System\GioXUyh.exe
  C:\Windows\System\GioXUyh.exe
  2⤵
  PID:13964
- C:\Windows\System\JgWrLwS.exe
  C:\Windows\System\JgWrLwS.exe
  2⤵
  PID:14012
- C:\Windows\System\CGLSlsE.exe
  C:\Windows\System\CGLSlsE.exe
  2⤵
  PID:14040
- C:\Windows\System\HfUClsy.exe
  C:\Windows\System\HfUClsy.exe
  2⤵
  PID:14068
- C:\Windows\System\MDRttVY.exe
  C:\Windows\System\MDRttVY.exe
  2⤵
  PID:14084
- C:\Windows\System\fjqvfWL.exe
  C:\Windows\System\fjqvfWL.exe
  2⤵
  PID:14112
- C:\Windows\System\PZniIrV.exe
  C:\Windows\System\PZniIrV.exe
  2⤵
  PID:14140
- C:\Windows\System\iyeLXKu.exe
  C:\Windows\System\iyeLXKu.exe
  2⤵
  PID:14168
- C:\Windows\System\cjcPLFX.exe
  C:\Windows\System\cjcPLFX.exe
  2⤵
  PID:14188
- C:\Windows\System\OlEOQRw.exe
  C:\Windows\System\OlEOQRw.exe
  2⤵
  PID:14224
- C:\Windows\System\xyszOjN.exe
  C:\Windows\System\xyszOjN.exe
  2⤵
  PID:14244
- C:\Windows\System\TDzwRnH.exe
  C:\Windows\System\TDzwRnH.exe
  2⤵
  PID:14268
- C:\Windows\System\wYVDuNo.exe
  C:\Windows\System\wYVDuNo.exe
  2⤵
  PID:14292
- C:\Windows\System\XRgdaJq.exe
  C:\Windows\System\XRgdaJq.exe
  2⤵
  PID:14324
- C:\Windows\System\VdznFIO.exe
  C:\Windows\System\VdznFIO.exe
  2⤵
  PID:12452
- C:\Windows\System\tQoptLD.exe
  C:\Windows\System\tQoptLD.exe
  2⤵
  PID:13364
- C:\Windows\System\AHzCPIG.exe
  C:\Windows\System\AHzCPIG.exe
  2⤵
  PID:13448
- C:\Windows\System\dvRkTud.exe
  C:\Windows\System\dvRkTud.exe
  2⤵
  PID:13548
- C:\Windows\System\ZShQkMh.exe
  C:\Windows\System\ZShQkMh.exe
  2⤵
  PID:13608
- C:\Windows\System\GcjZhar.exe
  C:\Windows\System\GcjZhar.exe
  2⤵
  PID:13656
- C:\Windows\System\STzPhGX.exe
  C:\Windows\System\STzPhGX.exe
  2⤵
  PID:13736
- C:\Windows\System\biZiDJu.exe
  C:\Windows\System\biZiDJu.exe
  2⤵
  PID:13828
- C:\Windows\System\qeZxRRn.exe
  C:\Windows\System\qeZxRRn.exe
  2⤵
  PID:13900
- C:\Windows\System\QTNojgA.exe
  C:\Windows\System\QTNojgA.exe
  2⤵
  PID:13928
- C:\Windows\System\pcCindo.exe
  C:\Windows\System\pcCindo.exe
  2⤵
  PID:14032
- C:\Windows\System\LUmWish.exe
  C:\Windows\System\LUmWish.exe
  2⤵
  PID:14096
- C:\Windows\System\CNTZOOq.exe
  C:\Windows\System\CNTZOOq.exe
  2⤵
  PID:14128
- C:\Windows\System\JKQrEao.exe
  C:\Windows\System\JKQrEao.exe
  2⤵
  PID:14196
- C:\Windows\System\puULUzo.exe
  C:\Windows\System\puULUzo.exe
  2⤵
  PID:14260
- C:\Windows\System\EVLZywr.exe
  C:\Windows\System\EVLZywr.exe
  2⤵
  PID:14312
- C:\Windows\System\WewkRHj.exe
  C:\Windows\System\WewkRHj.exe
  2⤵
  PID:13348
- C:\Windows\System\UzjDMie.exe
  C:\Windows\System\UzjDMie.exe
  2⤵
  PID:13508
- C:\Windows\System\FsctyfD.exe
  C:\Windows\System\FsctyfD.exe
  2⤵
  PID:13636
- C:\Windows\System\NjvMrIa.exe
  C:\Windows\System\NjvMrIa.exe
  2⤵
  PID:13628
- C:\Windows\System\JwwiVgx.exe
  C:\Windows\System\JwwiVgx.exe
  2⤵
  PID:13904
- C:\Windows\System\PaFGWUn.exe
  C:\Windows\System\PaFGWUn.exe
  2⤵
  PID:14204
- C:\Windows\System\lMpYhBc.exe
  C:\Windows\System\lMpYhBc.exe
  2⤵
  PID:14240
- C:\Windows\System\EwYHGuU.exe
  C:\Windows\System\EwYHGuU.exe
  2⤵
  PID:13388
- C:\Windows\System\oGKZgak.exe
  C:\Windows\System\oGKZgak.exe
  2⤵
  PID:13720
- C:\Windows\System\UGqjcxa.exe
  C:\Windows\System\UGqjcxa.exe
  2⤵
  PID:13600
- C:\Windows\System\HOZPcYQ.exe
  C:\Windows\System\HOZPcYQ.exe
  2⤵
  PID:13556
- C:\Windows\System\TzWbzjQ.exe
  C:\Windows\System\TzWbzjQ.exe
  2⤵
  PID:13724
- C:\Windows\System\feWngAP.exe
  C:\Windows\System\feWngAP.exe
  2⤵
  PID:14372
- C:\Windows\System\EAWIaqF.exe
  C:\Windows\System\EAWIaqF.exe
  2⤵
  PID:14392
- C:\Windows\System\VZHBgMC.exe
  C:\Windows\System\VZHBgMC.exe
  2⤵
  PID:14428
- C:\Windows\System\nJLyetu.exe
  C:\Windows\System\nJLyetu.exe
  2⤵
  PID:14448
- C:\Windows\System\kXBRSqd.exe
  C:\Windows\System\kXBRSqd.exe
  2⤵
  PID:14488
- C:\Windows\System\jnVXbOl.exe
  C:\Windows\System\jnVXbOl.exe
  2⤵
  PID:14508
- C:\Windows\System\qQpDdgQ.exe
  C:\Windows\System\qQpDdgQ.exe
  2⤵
  PID:14532
- C:\Windows\System\YJqEtpn.exe
  C:\Windows\System\YJqEtpn.exe
  2⤵
  PID:14552
- C:\Windows\System\BreowWM.exe
  C:\Windows\System\BreowWM.exe
  2⤵
  PID:14600
- C:\Windows\System\PGuWrjB.exe
  C:\Windows\System\PGuWrjB.exe
  2⤵
  PID:14628
- C:\Windows\System\xxglWuO.exe
  C:\Windows\System\xxglWuO.exe
  2⤵
  PID:14656
- C:\Windows\System\MoUtXSL.exe
  C:\Windows\System\MoUtXSL.exe
  2⤵
  PID:14676
- C:\Windows\System\okLFnsu.exe
  C:\Windows\System\okLFnsu.exe
  2⤵
  PID:14700
- C:\Windows\System\KlmLVlW.exe
  C:\Windows\System\KlmLVlW.exe
  2⤵
  PID:14740
- C:\Windows\System\fDrFjbM.exe
  C:\Windows\System\fDrFjbM.exe
  2⤵
  PID:14756
- C:\Windows\System\hhmOCQF.exe
  C:\Windows\System\hhmOCQF.exe
  2⤵
  PID:14784
- C:\Windows\System\GmSIXgY.exe
  C:\Windows\System\GmSIXgY.exe
  2⤵
  PID:14812
- C:\Windows\System\gUGrqgo.exe
  C:\Windows\System\gUGrqgo.exe
  2⤵
  PID:14828
- C:\Windows\System\WKzGEMy.exe
  C:\Windows\System\WKzGEMy.exe
  2⤵
  PID:14880
- C:\Windows\System\BUXSGaZ.exe
  C:\Windows\System\BUXSGaZ.exe
  2⤵
  PID:14908
- C:\Windows\System\JIHEycu.exe
  C:\Windows\System\JIHEycu.exe
  2⤵
  PID:14924
- C:\Windows\System\UKrwFHN.exe
  C:\Windows\System\UKrwFHN.exe
  2⤵
  PID:14964
- C:\Windows\System\lGdlFiJ.exe
  C:\Windows\System\lGdlFiJ.exe
  2⤵
  PID:14980
- C:\Windows\System\pAAezmK.exe
  C:\Windows\System\pAAezmK.exe
  2⤵
  PID:14996
- C:\Windows\System\IDEEhzx.exe
  C:\Windows\System\IDEEhzx.exe
  2⤵
  PID:15032
- C:\Windows\System\ezPRjzC.exe
  C:\Windows\System\ezPRjzC.exe
  2⤵
  PID:15060
- C:\Windows\System\eIbBkGj.exe
  C:\Windows\System\eIbBkGj.exe
  2⤵
  PID:15088
- C:\Windows\System\hurXfRH.exe
  C:\Windows\System\hurXfRH.exe
  2⤵
  PID:15108
- C:\Windows\System\hNFVGdW.exe
  C:\Windows\System\hNFVGdW.exe
  2⤵
  PID:15128
- C:\Windows\System\zbcvECD.exe
  C:\Windows\System\zbcvECD.exe
  2⤵
  PID:15188
- C:\Windows\System\diUaQPg.exe
  C:\Windows\System\diUaQPg.exe
  2⤵
  PID:15204
- C:\Windows\System\gTXdypv.exe
  C:\Windows\System\gTXdypv.exe
  2⤵
  PID:15220
- C:\Windows\System\vQKlODZ.exe
  C:\Windows\System\vQKlODZ.exe
  2⤵
  PID:15256
- C:\Windows\System\cHkoCFj.exe
  C:\Windows\System\cHkoCFj.exe
  2⤵
  PID:15284
- C:\Windows\System\hJIWXFl.exe
  C:\Windows\System\hJIWXFl.exe
  2⤵
  PID:15316
- C:\Windows\System\oemKWnJ.exe
  C:\Windows\System\oemKWnJ.exe
  2⤵
  PID:15332
- C:\Windows\System\vAtnfgT.exe
  C:\Windows\System\vAtnfgT.exe
  2⤵
  PID:15348
- C:\Windows\System\cCdBUDB.exe
  C:\Windows\System\cCdBUDB.exe
  2⤵
  PID:14368
- C:\Windows\System\QASovPo.exe
  C:\Windows\System\QASovPo.exe
  2⤵
  PID:14464
- C:\Windows\System\lhtcaok.exe
  C:\Windows\System\lhtcaok.exe
  2⤵
  PID:14524
- C:\Windows\System\WPAXjNE.exe
  C:\Windows\System\WPAXjNE.exe
  2⤵
  PID:14616
- C:\Windows\System\dSNkvFm.exe
  C:\Windows\System\dSNkvFm.exe
  2⤵
  PID:14688
- C:\Windows\System\IgFVcOS.exe
  C:\Windows\System\IgFVcOS.exe
  2⤵
  PID:14724
- C:\Windows\System\EeqgXwC.exe
  C:\Windows\System\EeqgXwC.exe
  2⤵
  PID:14752
- C:\Windows\System\EPfVbjz.exe
  C:\Windows\System\EPfVbjz.exe
  2⤵
  PID:14844
- C:\Windows\System\IjSZMeT.exe
  C:\Windows\System\IjSZMeT.exe
  2⤵
  PID:14892
- C:\Windows\System\GBMNQTc.exe
  C:\Windows\System\GBMNQTc.exe
  2⤵
  PID:14920
- C:\Windows\System\DjXUvSz.exe
  C:\Windows\System\DjXUvSz.exe
  2⤵
  PID:14976
- C:\Windows\System\uVODZyI.exe
  C:\Windows\System\uVODZyI.exe
  2⤵
  PID:15076
- C:\Windows\System\rSphJhY.exe
  C:\Windows\System\rSphJhY.exe
  2⤵
  PID:15104
- C:\Windows\System\CAjdHHi.exe
  C:\Windows\System\CAjdHHi.exe
  2⤵
  PID:15240
- C:\Windows\System\wygoxTp.exe
  C:\Windows\System\wygoxTp.exe
  2⤵
  PID:15324
- C:\Windows\System\CSnTBDK.exe
  C:\Windows\System\CSnTBDK.exe
  2⤵
  PID:14280
- C:\Windows\System\GpYRQgV.exe
  C:\Windows\System\GpYRQgV.exe
  2⤵
  PID:14380
- C:\Windows\System\ugjoTPh.exe
  C:\Windows\System\ugjoTPh.exe
  2⤵
  PID:14652
- C:\Windows\System\WxkecdK.exe
  C:\Windows\System\WxkecdK.exe
  2⤵
  PID:14800
- C:\Windows\System\fnLIaNp.exe
  C:\Windows\System\fnLIaNp.exe
  2⤵
  PID:15160
- C:\Windows\System\PYDXWFT.exe
  C:\Windows\System\PYDXWFT.exe
  2⤵
  PID:15140
- C:\Windows\System\tDUrSBc.exe
  C:\Windows\System\tDUrSBc.exe
  2⤵
  PID:15200
- C:\Windows\System\nmyWqJC.exe
  C:\Windows\System\nmyWqJC.exe
  2⤵
  PID:13344
- C:\Windows\System\nDMroSN.exe
  C:\Windows\System\nDMroSN.exe
  2⤵
  PID:14696
- C:\Windows\System\ELHIyHn.exe
  C:\Windows\System\ELHIyHn.exe
  2⤵
  PID:15232
- C:\Windows\System\JfxYCdF.exe
  C:\Windows\System\JfxYCdF.exe
  2⤵
  PID:14572
- C:\Windows\System\EhOOoTa.exe
  C:\Windows\System\EhOOoTa.exe
  2⤵
  PID:15384
- C:\Windows\System\SLNIHTF.exe
  C:\Windows\System\SLNIHTF.exe
  2⤵
  PID:15400
- C:\Windows\System\cgZtqRT.exe
  C:\Windows\System\cgZtqRT.exe
  2⤵
  PID:15452
- C:\Windows\System\lisFORT.exe
  C:\Windows\System\lisFORT.exe
  2⤵
  PID:15468
- C:\Windows\System\ArsEGbw.exe
  C:\Windows\System\ArsEGbw.exe
  2⤵
  PID:15508
- C:\Windows\System\pqbFLPJ.exe
  C:\Windows\System\pqbFLPJ.exe
  2⤵
  PID:15536
- C:\Windows\System\fbLWomo.exe
  C:\Windows\System\fbLWomo.exe
  2⤵
  PID:15552
- C:\Windows\System\yxGhZbU.exe
  C:\Windows\System\yxGhZbU.exe
  2⤵
  PID:15576
- C:\Windows\System\IZVaeyT.exe
  C:\Windows\System\IZVaeyT.exe
  2⤵
  PID:15608
- C:\Windows\System\htToRpK.exe
  C:\Windows\System\htToRpK.exe
  2⤵
  PID:15648
- C:\Windows\System\HZALrgc.exe
  C:\Windows\System\HZALrgc.exe
  2⤵
  PID:15672
- C:\Windows\System\chqCLVm.exe
  C:\Windows\System\chqCLVm.exe
  2⤵
  PID:15692
- C:\Windows\System\gGmyzMQ.exe
  C:\Windows\System\gGmyzMQ.exe
  2⤵
  PID:15732
- C:\Windows\System\nTgfyFe.exe
  C:\Windows\System\nTgfyFe.exe
  2⤵
  PID:15760
- C:\Windows\System\aWZGXtl.exe
  C:\Windows\System\aWZGXtl.exe
  2⤵
  PID:15788
- C:\Windows\System\BmFCVLo.exe
  C:\Windows\System\BmFCVLo.exe
  2⤵
  PID:15804
- C:\Windows\System\gYMgiXR.exe
  C:\Windows\System\gYMgiXR.exe
  2⤵
  PID:15824
- C:\Windows\System\zuGZcTH.exe
  C:\Windows\System\zuGZcTH.exe
  2⤵
  PID:15872
- C:\Windows\System\Ibgcnwi.exe
  C:\Windows\System\Ibgcnwi.exe
  2⤵
  PID:15888
- C:\Windows\System\okwZoWz.exe
  C:\Windows\System\okwZoWz.exe
  2⤵
  PID:15916
- C:\Windows\System\xJWayaP.exe
  C:\Windows\System\xJWayaP.exe
  2⤵
  PID:15944
- C:\Windows\System\cTvMacY.exe
  C:\Windows\System\cTvMacY.exe
  2⤵
  PID:15984
- C:\Windows\System\QKQyryh.exe
  C:\Windows\System\QKQyryh.exe
  2⤵
  PID:16000
- C:\Windows\System\ptSsuqp.exe
  C:\Windows\System\ptSsuqp.exe
  2⤵
  PID:16032
- C:\Windows\System\fAkCaqK.exe
  C:\Windows\System\fAkCaqK.exe
  2⤵
  PID:16072
- C:\Windows\System\uKFArWY.exe
  C:\Windows\System\uKFArWY.exe
  2⤵
  PID:16096
- C:\Windows\System\COxwdGS.exe
  C:\Windows\System\COxwdGS.exe
  2⤵
  PID:16116
- C:\Windows\System\kSvLreo.exe
  C:\Windows\System\kSvLreo.exe
  2⤵
  PID:16136
- C:\Windows\System\XiywFkR.exe
  C:\Windows\System\XiywFkR.exe
  2⤵
  PID:16164
- C:\Windows\System\WgXhjQr.exe
  C:\Windows\System\WgXhjQr.exe
  2⤵
  PID:16188
- C:\Windows\System\Uqgufuj.exe
  C:\Windows\System\Uqgufuj.exe
  2⤵
  PID:16224
- C:\Windows\System\kIPJAKh.exe
  C:\Windows\System\kIPJAKh.exe
  2⤵
  PID:16256
- C:\Windows\System\XJMortI.exe
  C:\Windows\System\XJMortI.exe
  2⤵
  PID:16284
- C:\Windows\System\YQRVflj.exe
  C:\Windows\System\YQRVflj.exe
  2⤵
  PID:16308
- C:\Windows\System\LLIFmkP.exe
  C:\Windows\System\LLIFmkP.exe
  2⤵
  PID:16340
- C:\Windows\System\pbPDiwl.exe
  C:\Windows\System\pbPDiwl.exe
  2⤵
  PID:16368
- C:\Windows\System\gAdJnLX.exe
  C:\Windows\System\gAdJnLX.exe
  2⤵
  PID:15372
- C:\Windows\System\GqkPPRp.exe
  C:\Windows\System\GqkPPRp.exe
  2⤵
  PID:15428
- C:\Windows\System\mcXbsGK.exe
  C:\Windows\System\mcXbsGK.exe
  2⤵
  PID:15520
- C:\Windows\System\HbUWjDC.exe
  C:\Windows\System\HbUWjDC.exe
  2⤵
  PID:15544
- C:\Windows\System\yiUvpMb.exe
  C:\Windows\System\yiUvpMb.exe
  2⤵
  PID:15620
- C:\Windows\System\bVrpIhu.exe
  C:\Windows\System\bVrpIhu.exe
  2⤵
  PID:15656
- C:\Windows\System\lLSbVYO.exe
  C:\Windows\System\lLSbVYO.exe
  2⤵
  PID:15724
- C:\Windows\System\OfwuoED.exe
  C:\Windows\System\OfwuoED.exe
  2⤵
  PID:15812
- C:\Windows\System\iirAyRc.exe
  C:\Windows\System\iirAyRc.exe
  2⤵
  PID:15884
- C:\Windows\System\kwCxMeX.exe
  C:\Windows\System\kwCxMeX.exe
  2⤵
  PID:15976
- C:\Windows\System\jRAhKXS.exe
  C:\Windows\System\jRAhKXS.exe
  2⤵
  PID:16020
- C:\Windows\System\EhCcEqM.exe
  C:\Windows\System\EhCcEqM.exe
  2⤵
  PID:16080
- C:\Windows\System\qtuPDPF.exe
  C:\Windows\System\qtuPDPF.exe
  2⤵
  PID:16024
- C:\Windows\System\lTqLVRs.exe
  C:\Windows\System\lTqLVRs.exe
  2⤵
  PID:16180
- C:\Windows\System\nAkibCZ.exe
  C:\Windows\System\nAkibCZ.exe
  2⤵
  PID:16244
- C:\Windows\System\IfDSzWi.exe
  C:\Windows\System\IfDSzWi.exe
  2⤵
  PID:16300
- C:\Windows\System\YrFIGde.exe
  C:\Windows\System\YrFIGde.exe
  2⤵
  PID:15028
- C:\Windows\System\QIMOFLq.exe
  C:\Windows\System\QIMOFLq.exe
  2⤵
  PID:15412
- C:\Windows\System\UgtqYqd.exe
  C:\Windows\System\UgtqYqd.exe
  2⤵
  PID:15688
- C:\Windows\System\lShbMcX.exe
  C:\Windows\System\lShbMcX.exe
  2⤵
  PID:15796
- C:\Windows\System\oKsQRTm.exe
  C:\Windows\System\oKsQRTm.exe
  2⤵
  PID:15932
- C:\Windows\System\giKtMdb.exe
  C:\Windows\System\giKtMdb.exe
  2⤵
  PID:16064
- C:\Windows\System\kEEQmLI.exe
  C:\Windows\System\kEEQmLI.exe
  2⤵
  PID:16092
- C:\Windows\System\ZETsoFr.exe
  C:\Windows\System\ZETsoFr.exe
  2⤵
  PID:16352
- C:\Windows\System\rYZeKXu.exe
  C:\Windows\System\rYZeKXu.exe
  2⤵
  PID:15392
- C:\Windows\System\IjFlvzO.exe
  C:\Windows\System\IjFlvzO.exe
  2⤵
  PID:15940
- C:\Windows\System\NuxcSRq.exe
  C:\Windows\System\NuxcSRq.exe
  2⤵
  PID:15296
- C:\Windows\System\JjjCtmz.exe
  C:\Windows\System\JjjCtmz.exe
  2⤵
  PID:16396
- C:\Windows\System\aatuqoo.exe
  C:\Windows\System\aatuqoo.exe
  2⤵
  PID:16424
- C:\Windows\System\lVHDHJl.exe
  C:\Windows\System\lVHDHJl.exe
  2⤵
  PID:16452
- C:\Windows\System\mvuNLcW.exe
  C:\Windows\System\mvuNLcW.exe
  2⤵
  PID:16472
- C:\Windows\System\iFSXyGe.exe
  C:\Windows\System\iFSXyGe.exe
  2⤵
  PID:16512
- C:\Windows\System\lqKEAVR.exe
  C:\Windows\System\lqKEAVR.exe
  2⤵
  PID:16544
- C:\Windows\System\LXAFQEZ.exe
  C:\Windows\System\LXAFQEZ.exe
  2⤵
  PID:16588
- C:\Windows\System\LVWbwNL.exe
  C:\Windows\System\LVWbwNL.exe
  2⤵
  PID:16604
- C:\Windows\System\rIBiFLM.exe
  C:\Windows\System\rIBiFLM.exe
  2⤵
  PID:16624
- C:\Windows\System\iEoMDpi.exe
  C:\Windows\System\iEoMDpi.exe
  2⤵
  PID:16652
- C:\Windows\System\ebxqfev.exe
  C:\Windows\System\ebxqfev.exe
  2⤵
  PID:16684
- C:\Windows\System\fTzcbCn.exe
  C:\Windows\System\fTzcbCn.exe
  2⤵
  PID:16708
- C:\Windows\System\AKlFTHo.exe
  C:\Windows\System\AKlFTHo.exe
  2⤵
  PID:16736
- C:\Windows\System\PNHRIFf.exe
  C:\Windows\System\PNHRIFf.exe
  2⤵
  PID:16776
- C:\Windows\System\YtzxSPC.exe
  C:\Windows\System\YtzxSPC.exe
  2⤵
  PID:16804
- C:\Windows\System\BMFvqwH.exe
  C:\Windows\System\BMFvqwH.exe
  2⤵
  PID:16832
- C:\Windows\System\gbmIrNp.exe
  C:\Windows\System\gbmIrNp.exe
  2⤵
  PID:16848
- C:\Windows\System\xitraYS.exe
  C:\Windows\System\xitraYS.exe
  2⤵
  PID:16880
- C:\Windows\System\gCCBraR.exe
  C:\Windows\System\gCCBraR.exe
  2⤵
  PID:16920
- C:\Windows\System\OJZCoRl.exe
  C:\Windows\System\OJZCoRl.exe
  2⤵
  PID:16944

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:17364

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\DkcnLjq.exe

Filesize
1.5MB

MD5
20dfb4d64a5b730059a58f0042b1f722

SHA1
694309bff08c7b057cd72996d665c080453cd113

SHA256
b207ed252cc4f22765a35dc7e2fb1f5f3f33ed769e1914de06c6bee28a2c5a2a

SHA512
dd074e0847cb9d5e65d01b45a2853c37c1d70ab01658d60898978e434906eb03ce9ab69ee3820702bc6a4379594659ed9d86243c0d4a5022b81fd306758c33b7

Download Submit
C:\Windows\System\EAXydPL.exe

Filesize
1.5MB

MD5
d2f3eb30b2c32812c428ce752b993cfc

SHA1
3ad6bedbb69c6fc27887875470a2494e3dc96369

SHA256
56c30c0e324f2d3ee6fe444328c410a4e279e54af24af5a72beaf158c10df996

SHA512
1015cd2513841d63179a4912e18a90f9f208bc02dbd5887ce58c47485ff7f00b62f94e345095a6d8a167fafd2cc478b7e903faac25069fa76809f75d1de07d0b

Download Submit
C:\Windows\System\HeqEspG.exe

Filesize
1.5MB

MD5
a950e6a1eef0101deb3db71a94f405db

SHA1
16cbbf0d00497489bddf500afca40dce0057947e

SHA256
5691bbd1e5d48e43d46146c0a1a9598622c5fb491c9daf20c5482e09691c6a38

SHA512
6bd5613d31e285f78e24d8f10edb8d2fc7d5b825b5b5db42ef139af9bd6a2067cafc4e28e93a0c36f8badb6c630c64b90efeaf1da1b9c1926b85b40e90d744cb

Download Submit
C:\Windows\System\IdJlpCz.exe

Filesize
1.5MB

MD5
e6ad26c8b3cec0e683d227a3db095a68

SHA1
7d4904113d7e31dae2d293a9a0add2dbf662332f

SHA256
9a2286b87c3ad9bf7f46d347e2951beb9cd4562c7f2f5a9e61f3ec850e04a0ea

SHA512
e0cc70da6fbaa878d6ce21ff817734a75a44bda9e80c0f71a67f0f26661820f74667a27b00512a61f537255258f34bf3655adf4c1cf8ca788936d0e340daf36d

Download Submit
C:\Windows\System\KmgDFHr.exe

Filesize
1.5MB

MD5
ead6f248b5d41728bc3d43a5d73b12b8

SHA1
2b332debf57d41fcaab040ff65ea603e945d2af4

SHA256
a829cbc2e3d6ef39cab9daaf1b8a70d3bcebc4d4423f281a9d4393921f2f1f08

SHA512
fd0315a2f9777514202da348e33248278a3f3339f3b09fda0a2af2a186f186d4fdacff88ab254c5a26b3bab6566a056c25edc5244309041af8c49f9e72cea94f

Download Submit
C:\Windows\System\ORWKgJq.exe

Filesize
1.5MB

MD5
f1e2ee955d904a29355653fa7074139a

SHA1
ad3ec5545cc60bbdcaf233d6dd81dfff41415250

SHA256
acc004582ca1e43af9b20802fedf9f88c0fdd5f745498aa6755ffd04cfb91c74

SHA512
f64151b3450a4c1665b9bd89eceda0714f1f176641ecd6bb5f80d4e64076a2ae367ec2687701b0c8b5c986b4ea9d7451bbdc9a8f77cc15513a9615d3f010c7b4

Download Submit
C:\Windows\System\OwDJUap.exe

Filesize
1.5MB

MD5
27c46a96a65b72691eadd93a75c2d401

SHA1
f017532d41a1ec60128c57c2df15e5c4b9a78a88

SHA256
2b9d2dc2f6d57e063437a8b392a0ebd8cf1747eb6f3cc2ebc33fc13fae105cea

SHA512
0b1052602a48070d08553cb53785f1bad83660908168bf08f05fe93d83b22c0790be35f5faca2e0e92dee1b1dac121629063b5049cca8245d0fee017f8217ed1

Download Submit
C:\Windows\System\PWjMxqX.exe

Filesize
1.5MB

MD5
008135c37bde507fd93bd04297abcfab

SHA1
83271eaf2e85b7a271d6860a83ec2200dcd8a922

SHA256
1b8f2bb29c8054398f0a5a30c6d49086f8a8c4ec5c4e97be4aee7ff8905dfcb0

SHA512
3fecde299af78543c499b669f87782986b80970ea1ab87f4176df5fe23643f55902acb952ef99e8a2f5c9b9e2b069c66f14ebbdf6c51af598056ed8696e3e544

Download Submit
C:\Windows\System\RnBUVEh.exe

Filesize
1.5MB

MD5
0c71209b3503d40c6a36d9aa702dde6b

SHA1
801f6b7ed522fa4e8d4085b576ca70195fd47e80

SHA256
c8d9ed87d6d2fffbcea5215125aa577d1de1d467fc5a9c7e62ec2d90933010ab

SHA512
3b55aa9c8a9b0efd99f0075df423345355876898842f4ffd4c383c143965256fa7711dd2cceec3a86c1ce51e2075000e644f4f1246c89b9744467bb2269762dd

Download Submit
C:\Windows\System\TLHhlOA.exe

Filesize
1.5MB

MD5
f982816b398a9398a8315b9587bdee96

SHA1
d5916ae1731ff576d2368bd851eaebc76febc5ad

SHA256
c3324923b4ca13b053c7f2a83b999edc7a37541369e9c24ef87dd81cb578c242

SHA512
afbf73f6ccc8d64c92941338f2e22e72c23c5f448d0f4d3dd0d704b0f78e3e4ba62518a4de6e83b6b30d9402a70c128a9873192332d39f04e52a9891d128667a

Download Submit
C:\Windows\System\UfidEou.exe

Filesize
1.5MB

MD5
a671c43bbf50b201330cbce44e974853

SHA1
10876825a8588d82911601da1cad466a958a7be7

SHA256
519614733e47f850f2413bde13669482a049cf03cf1c5c4b0df3f1ba9a2791c4

SHA512
8b3d2cb91c55da7e846e6034fccd2c065c39e2ad8e33b5073c3d9dd565af6eed263850ce319505f5e364c774f9338da4a0502e56382ecef618e0e054dff7c03e

Download Submit
C:\Windows\System\UkLslfm.exe

Filesize
1.5MB

MD5
7db2be2002e0fed2e70f05c798f7e2ef

SHA1
fc16423da09c72aa05d9915d025e51eff8f43093

SHA256
00d35d7f18a7d9a65ccd8d3abac890b2f1e1fe50a4d3285bfe5b92b5486ea211

SHA512
55119ecaa85b868d0ad1831be68bc928a264c63e5960bf0e74aff8aa1729595f5181b06e6b590ae48e56d45a29eed12c26fd16961199f196f521d7fda8add0ad

Download Submit
C:\Windows\System\WVfhxna.exe

Filesize
1.5MB

MD5
77dad0b10735a9b3424f36f0eb49d64a

SHA1
f33696169c92a29afa3e05daff2cd623d5f1f480

SHA256
75138c4fe3b217b0da92bedce470606228acfad28749042d2008356c37505850

SHA512
77add460a6321370ed61a01fb4998f2bafd2779e5e42cdfb86dace6de731b1269721e6d403b6b2ea028b4b5e76d45cda78f037c7bcf51119d328e1fd39b41ccd

Download Submit
C:\Windows\System\WtvXurb.exe

Filesize
1.5MB

MD5
91629c4fa46b2d253054347bd5ad2cff

SHA1
a642852650c61ef9cfd99ef7e25e68ee7bab58c1

SHA256
9f2cc88a62442aca94a46278e7d9f7c1d53cb77c4a96c2dcefdb04ab2c09bbf0

SHA512
29e1a92a62110087805e99d9b3659fdf3b62e020695fa3f873e51088b70f9b3724b48a8eaa22dbc9d7a5c17224c80252a39b85530fc1fda6201722b67ad3a502

Download Submit
C:\Windows\System\YDvELJe.exe

Filesize
1.5MB

MD5
d2bcd454977338982aaeca1ba23211d2

SHA1
db750a912000e1a20ddadb472fcf5eba61972e91

SHA256
a5920b594bf6e26d6968ca3387dddff655822fca745115575c763c7803fd32a8

SHA512
50f02e3648bec1b8682c9bb8f0bc8102cb2ba02bd3a677d1d0a77b90bb88fce96cad8470ee706d3558bc13c5cea7991b99536d219b06a223ddfa721c450b381a

Download Submit
C:\Windows\System\cUCtuAg.exe

Filesize
1.5MB

MD5
e13c2888e33251620f529105ae2332ef

SHA1
c4238474b7c2e04e3458fc4bef9006d1a811d88d

SHA256
179485e3fe289faa14460784c5d51ccb5ba0152834007413e2de9a192abc9f35

SHA512
e6b6dc985a8a37f14648e465751ae90eaf9e0617d4b62705d2f98a837c8a559825de31478fe641d34fc6e839eaee585f1177f5cc0005ed31f2bf0919635d7d59

Download Submit
C:\Windows\System\eozxHHH.exe

Filesize
1.5MB

MD5
6189cf741ab4b053e1afbab2242d32d3

SHA1
5993f6753d008375511bf8d61feecec3c940a9c7

SHA256
3484eeae463d51266e04295dce91b1e8bba5e1c8676d571951efea0e093dba9e

SHA512
360239e5e66da7dc6041409ded869a5799581b76899f9b11277b1d77e848ef2c39e039ef3cd7afe106a95af56c811046aeb4d13b3a95ef9169a6d5681f641d6d

Download Submit
C:\Windows\System\fGZEWjO.exe

Filesize
1.5MB

MD5
15032240055aaabdbde7d63b6ac55976

SHA1
14defab71f808942d2306f9bfa2657462c441206

SHA256
5d1cb8bd726e8e6b855d25bfe4fa74ddb382347f4249ae31aa9a47ece21d5795

SHA512
66854d659f501ebe68a191e03d78ed2ab34baea4ba79a3fb5d54eeca5ac8a06c0785f555b131bacf3ae9cde093b81bda022880c93122c40bfe9d4f5eeb5020ac

Download Submit
C:\Windows\System\flNAlWi.exe

Filesize
1.5MB

MD5
9f2f1ccb4816351fb81ddeedf80a69be

SHA1
3aeef773a293292c036922a17dced49634f9f5b1

SHA256
5ea0db416591436da05ea8a39cd2eec6199aaad07c5289945222bfc37d86a82e

SHA512
a97f2bcc1dea7778e2716ac859f8ccb07de3d7c3facde42e01b5671c521385886a527443eb22570d2c5754a80eed0c1f858ec7178b32565ac3eafa2fc6450b36

Download Submit
C:\Windows\System\gySOJeu.exe

Filesize
1.5MB

MD5
83fbf9d0fa92d06f3b524f2d70ba1462

SHA1
226cb5cdc132dcf634110017fd69647d5cc3248e

SHA256
beb474448f8e832614935881864b0421eeb00ce012f6d48cbd4a2954ba21f182

SHA512
5721ef49756894dd278d465465941f27057dfef8f548f279fb26518fc26456e9d3baae80b7a48673024d341e0b2e161f10d780a3ea8c8bb37444a45c7486d55d

Download Submit
C:\Windows\System\hDySCdB.exe

Filesize
1.5MB

MD5
01a8d67b348cc2c98ebc3b49fea52c22

SHA1
4c0d710d0876b21f8a94241b376c114d7d985acd

SHA256
9b5e4e501efc2d3fd41c3ac9c2278f6c75b4b61bc07b89df2a212ea2819d4bc9

SHA512
9bf880e8995dd8d6ed659dbbbb7584d4437a2f3e659729d54c0d7271cd76372c886bdcabd425e48471d3e6c924d409fb4c702a397ae8e3422affe0caf0cbd012

Download Submit
C:\Windows\System\jjhkqiJ.exe

Filesize
1.5MB

MD5
6efaa4e82c6c445b1951045671eefc4f

SHA1
9d7572f346b6e7b6a13eae8af64ebf1357a301b5

SHA256
23e5e0645438c82b83ff8c473d4519d2a52220f017b66a7f0d4925bc1ab4165b

SHA512
a29000e0f5d42ce449c140119074ce28df15b098489583450259435588641f36a96802e516d361dbc9efa51f2e3dc75edc0221cabe3ccf602168167dd2e9403f

Download Submit
C:\Windows\System\lJtDsOt.exe

Filesize
1.5MB

MD5
c05faf097230274695149cdca782adce

SHA1
0da7f6367feb69b91063d02db4a344da296088fa

SHA256
69ff6727942ccaf4ccb8cd1443a1d262cb9893032a751fde2e0850338d40ebfa

SHA512
e06da52459496881597805f08bfecb5ea0377082475ec4b3029cbb1333230ea07538cd4a204e183c9639400193d3194196d0a3af3251cf8e8358464e89d03d61

Download Submit
C:\Windows\System\ljarlrO.exe

Filesize
1.5MB

MD5
b044cbd9861240a48c8fc3de1e54193a

SHA1
add6bf7d4788dc2d6cca463cbbe22400db4b2da5

SHA256
4370cb9c1f223c319ed859024fc8e6370edcbef0f3eed2c92b0e7f1fbf1ff001

SHA512
67e9ca3c9f55f6b83e569d488fda8cd53eaa140424e29c405fe33c8e4f6a02d3d0afd528d62662e1ee55754d8fd303e640ce4839abe7ae06dd4a37ffb18e5ec8

Download Submit
C:\Windows\System\qrAhBmU.exe

Filesize
1.5MB

MD5
11e4cbdbf2b37b8a2c30f4bf3cd83e7c

SHA1
4f6776ec1983799e667a7668fcfd467c72e2a1e4

SHA256
a1eebf4663d5b80d402201eb3384d6319ff1a6815ce9eea02ef3a9a057731126

SHA512
79e6ee281c7deacc71763349e5bad0e00f9a5b83836f32fc0bbfc3e0bdf32261732e7a45aadab14ce030408961de5004922572b1b101274b61283fb88bdcd65b

Download Submit
C:\Windows\System\qvqRpvh.exe

Filesize
1.5MB

MD5
606150cd7107f17ee07fcad238833127

SHA1
5b7b3efee778122002fba08d6d4cb8bc00d44578

SHA256
e18acf348776a82ac91042b8b814d3021797bae58f183f66f7b0efb3dd654ced

SHA512
f89392c4d30960e681c7d56bf16230ed47e52c043a4a3aed5018c95d299be0b6b1ed0cfa3e5cfe4e223bb0cdd5e556137be53511b7a85566a77038e3c1fe50cc

Download Submit
C:\Windows\System\rFsBXkg.exe

Filesize
1.5MB

MD5
ee634784c1288c0b5847fab972215a70

SHA1
e977303542688207fb00442f9e68b337c5f069c2

SHA256
4b3b1ffd60e183ef5becf76fc4dde8ad5f9644004f457109cf6513e1d09c833b

SHA512
a614d636000a78246afc1f20ee102c6ecc0406efd9ef15f6c2d0e9e5294e8f8921d3917bbc9d1905a8e2c0878ee0d3b05bd92866cfa606e6c08ca3c22d2de144

Download Submit
C:\Windows\System\sOMcFsi.exe

Filesize
1.5MB

MD5
2028f9ad3720c25b93b046ee8d74d101

SHA1
1597c1c3eba3bbe83f770b26d55ca85c2842c4a1

SHA256
54315a6e0b9582dbfc47aa62461d30085d5b21baf64d35b64502a0f8ce323697

SHA512
ae5333ffc0f810c720e15e2de4d196440b2fbc0d856738ddecf4a02ac5ab8425197dddff4fcbba0bf8867fe7095d196b45ac17332c7ed47495468f879619dd6b

Download Submit
C:\Windows\System\sSJpfHl.exe

Filesize
1.5MB

MD5
5c184d9a2f6c63cbd42a3bc70c3d2ce9

SHA1
c6200d027c6f1e90fcf6170a45da6d33e4885c6b

SHA256
73e2ca9e27fb95926140a5d4057e6d5b7a6e25773b37eb5fca3b9342ce9b52f5

SHA512
76ce39786f68f745b395c2f12de84c160343db8bd35749182ae9f3d9345be7fbc4f6e5499bf26f78c4e34c8216a65a09640bf01e9526d227e74ea569e2dcaf33

Download Submit
C:\Windows\System\sUoNVRn.exe

Filesize
1.5MB

MD5
1d3e89f72f1e52b67a6abcef532c7233

SHA1
e76fc5f1b197b0843f5106b05179d8ccacdbe3d9

SHA256
ac01d98e43646602866a733febbaf11602a9af7e7b5b9e14dc0bdbd55e92ee14

SHA512
7a05882883ec8308f163eeccddeca28f43d1897ef9876baffef6122ad3ca75f92116885c766bea4310635cb059f6b7999fab08c468e5f7c60378cc108ab020eb

Download Submit
C:\Windows\System\wYqdIad.exe

Filesize
1.5MB

MD5
dda94ecb6e3e8ce4ec3f323e35dc95ba

SHA1
d12594f532c0cbf5a5c40bfd654f764609d47406

SHA256
5c5081dc8f366d4f70cdab1e637e5c9a7ea4a2b0f7c543d2abed20d3f0a5ef6e

SHA512
5db52a67f1fdf6548f9afac58f42410b6abf968a385940b50438b0a3bde81cf47f74722d992aff16b83e3aadcd98751e08356fc08b1934155c98354d6531b1a1

Download Submit
C:\Windows\System\wjwumUw.exe

Filesize
1.5MB

MD5
a4edf1ee1031d4cd14491e12e7dffdbd

SHA1
17ed020d38c352bfb4a9ccc05001004aa3c571b4

SHA256
e3d50ba5fc246a2b000e0dc532766730dd6dfd5324315a68f46090c46d96cb66

SHA512
dc2174bff228a60bb61fc439b75ee9b169af44d29fe95c7573ccb5889e1b6d72b8e62811d271e03488a43311ff3687a604b42306e0b1777683cdc518837e4a89

Download Submit
C:\Windows\System\yCzqOeR.exe

Filesize
1.5MB

MD5
906ad39716bebc08a38bf404c995a01a

SHA1
b0b8ed69be9014ee2350dfb110fc3ded672a0c19

SHA256
6e9bd45b24e2fdbbd61d76100dd3b054157f30a6b18b4f3c82db1787b223fc86

SHA512
eb7b4a6a5a1933f472120073544a63091d3a748e376d149a6053b0005fa3cbca684150c0f54cf3558b85cb9cc6b52669d7fcb8fc5e1ccc6935a1c80bd2be122e

Download Submit
memory/5084-0-0x000001C27BE60000-0x000001C27BE70000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads