xmrig | d55342d3b2795f62cf92e83cc5fa22413acf84bfd4f5c67203c407fb0d9f8a69

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
24-12-2024 01:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d55342d3b2795f62cf92e83cc5fa22413acf84bfd4f5c67203c407fb0d9f8a69.exe
Size

1.3MB
MD5

eab48349714164004bc035468fad947b
SHA1

b4f3d21ce20c42961659b812587dbcc6f0c27915
SHA256

d55342d3b2795f62cf92e83cc5fa22413acf84bfd4f5c67203c407fb0d9f8a69
SHA512

13426f31660bb476136e05c7bbebcc000c105834fc731b0261634f896b830f762a74204b21c489828d5f7effdd5cefb2df37cbe386a4c09f0a02345c0c01d6f6
SSDEEP

24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbpwlKenszQEMrP5+qzitMBb6JXSd:GezaTF8FcNkNdfE0pZ9ozttwIRQlpziW

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 33 IoCs

miner

resource	yara_rule
behavioral2/files/0x000c000000023b07-4.dat	xmrig
behavioral2/files/0x000b000000023b60-8.dat	xmrig
behavioral2/files/0x000a000000023b64-9.dat	xmrig
behavioral2/files/0x000a000000023b66-18.dat	xmrig
behavioral2/files/0x000a000000023b67-23.dat	xmrig
behavioral2/files/0x0031000000023b69-33.dat	xmrig
behavioral2/files/0x000a000000023b6b-45.dat	xmrig
behavioral2/files/0x0031000000023b6a-42.dat	xmrig
behavioral2/files/0x0031000000023b68-29.dat	xmrig
behavioral2/files/0x000a000000023b6d-54.dat	xmrig
behavioral2/files/0x000a000000023b6e-57.dat	xmrig
behavioral2/files/0x000a000000023b6f-70.dat	xmrig
behavioral2/files/0x000b000000023b61-78.dat	xmrig
behavioral2/files/0x000a000000023b71-85.dat	xmrig
behavioral2/files/0x000a000000023b76-102.dat	xmrig
behavioral2/files/0x000a000000023b77-107.dat	xmrig
behavioral2/files/0x000a000000023b78-120.dat	xmrig
behavioral2/files/0x000a000000023b7c-132.dat	xmrig
behavioral2/files/0x000a000000023b7e-150.dat	xmrig
behavioral2/files/0x000a000000023b82-162.dat	xmrig
behavioral2/files/0x000a000000023b80-160.dat	xmrig
behavioral2/files/0x000a000000023b81-157.dat	xmrig
behavioral2/files/0x000a000000023b7f-155.dat	xmrig
behavioral2/files/0x000a000000023b7d-145.dat	xmrig
behavioral2/files/0x000a000000023b7b-135.dat	xmrig
behavioral2/files/0x000a000000023b7a-130.dat	xmrig
behavioral2/files/0x000a000000023b79-125.dat	xmrig
behavioral2/files/0x000a000000023b75-105.dat	xmrig
behavioral2/files/0x000a000000023b74-100.dat	xmrig
behavioral2/files/0x000a000000023b73-95.dat	xmrig
behavioral2/files/0x000a000000023b72-90.dat	xmrig
behavioral2/files/0x000a000000023b70-72.dat	xmrig
behavioral2/files/0x000a000000023b6c-53.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2516	tpKCtkg.exe
1868	OFOevgD.exe
2900	fAOTIfk.exe
3864	JUmPWQK.exe
2912	NKyOaWC.exe
4628	LVDRzRk.exe
3820	zYPcTVe.exe
4468	mJJDJhj.exe
1988	ADQUbZx.exe
552	sgmxipe.exe
640	cqZRoJZ.exe
1312	XmKtady.exe
5060	TtnShKp.exe
4776	wbsMbcy.exe
3308	mtngeHI.exe
1132	pniDRSg.exe
2668	DPpMxNc.exe
2260	lTVPmxH.exe
1196	OIlhtgK.exe
3904	nFfKIOA.exe
2724	KpckVKe.exe
1896	gCtFAbk.exe
1052	GfTSUjF.exe
4064	CslYAgF.exe
3152	LpqhiPk.exe
4872	uRQIdaT.exe
1108	ntdGnLZ.exe
1524	TlBGLVQ.exe
748	WCwbVcH.exe
744	VrkEgrb.exe
2328	HDhmtcW.exe
996	VzuvqbG.exe
1600	YWlhgPQ.exe
2336	zjMglKY.exe
1536	PibKMgm.exe
2348	XScrlZY.exe
400	VYuTwVC.exe
2292	LaMwcKa.exe
4800	FUDfKDC.exe
3876	KHIGcxD.exe
980	WZhwGAj.exe
4420	aTebyQQ.exe
2952	sQlFIVP.exe
3624	sUOOfui.exe
4296	GBxiADu.exe
436	bCtjetk.exe
760	oNjmlqQ.exe
4784	JEQUOyO.exe
1412	imyBxLG.exe
540	zZRWEAP.exe
4220	hPdqOqW.exe
1968	hFcIlkB.exe
3984	ymMpNhv.exe
1568	zlYrPXj.exe
3976	ahHkYQx.exe
1088	QxCATAB.exe
3912	gMamnFZ.exe
1676	ClqSycA.exe
2172	NEvPsnG.exe
3888	UrsnHrX.exe
3036	XVhQECr.exe
4408	WQlXPYB.exe
3628	kgHmBfs.exe
840	YMwZIzE.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\qiXAhNJ.exe	d55342d3b2795f62cf92e83cc5fa22413acf84bfd4f5c67203c407fb0d9f8a69.exe
File created	C:\Windows\System\PibKMgm.exe	d55342d3b2795f62cf92e83cc5fa22413acf84bfd4f5c67203c407fb0d9f8a69.exe
File created	C:\Windows\System\NctTEcy.exe	d55342d3b2795f62cf92e83cc5fa22413acf84bfd4f5c67203c407fb0d9f8a69.exe
File created	C:\Windows\System\bBZNUXU.exe	d55342d3b2795f62cf92e83cc5fa22413acf84bfd4f5c67203c407fb0d9f8a69.exe
File created	C:\Windows\System\GJrtwCl.exe	d55342d3b2795f62cf92e83cc5fa22413acf84bfd4f5c67203c407fb0d9f8a69.exe
File created	C:\Windows\System\CagNgjw.exe	d55342d3b2795f62cf92e83cc5fa22413acf84bfd4f5c67203c407fb0d9f8a69.exe
File created	C:\Windows\System\LpqhiPk.exe	d55342d3b2795f62cf92e83cc5fa22413acf84bfd4f5c67203c407fb0d9f8a69.exe
File created	C:\Windows\System\koBxNba.exe	d55342d3b2795f62cf92e83cc5fa22413acf84bfd4f5c67203c407fb0d9f8a69.exe
File created	C:\Windows\System\wtSXeNf.exe	d55342d3b2795f62cf92e83cc5fa22413acf84bfd4f5c67203c407fb0d9f8a69.exe
File created	C:\Windows\System\ZippnBS.exe	d55342d3b2795f62cf92e83cc5fa22413acf84bfd4f5c67203c407fb0d9f8a69.exe
File created	C:\Windows\System\cPPTEPw.exe	d55342d3b2795f62cf92e83cc5fa22413acf84bfd4f5c67203c407fb0d9f8a69.exe
File created	C:\Windows\System\oFTisPl.exe	d55342d3b2795f62cf92e83cc5fa22413acf84bfd4f5c67203c407fb0d9f8a69.exe
File created	C:\Windows\System\lzvNory.exe	d55342d3b2795f62cf92e83cc5fa22413acf84bfd4f5c67203c407fb0d9f8a69.exe
File created	C:\Windows\System\iIuDZRc.exe	d55342d3b2795f62cf92e83cc5fa22413acf84bfd4f5c67203c407fb0d9f8a69.exe
File created	C:\Windows\System\FODvuKr.exe	d55342d3b2795f62cf92e83cc5fa22413acf84bfd4f5c67203c407fb0d9f8a69.exe
File created	C:\Windows\System\BCUvVMa.exe	d55342d3b2795f62cf92e83cc5fa22413acf84bfd4f5c67203c407fb0d9f8a69.exe
File created	C:\Windows\System\fKvsHja.exe	d55342d3b2795f62cf92e83cc5fa22413acf84bfd4f5c67203c407fb0d9f8a69.exe
File created	C:\Windows\System\eCehnUC.exe	d55342d3b2795f62cf92e83cc5fa22413acf84bfd4f5c67203c407fb0d9f8a69.exe
File created	C:\Windows\System\QRvCWFn.exe	d55342d3b2795f62cf92e83cc5fa22413acf84bfd4f5c67203c407fb0d9f8a69.exe
File created	C:\Windows\System\pWuDTLp.exe	d55342d3b2795f62cf92e83cc5fa22413acf84bfd4f5c67203c407fb0d9f8a69.exe
File created	C:\Windows\System\DWVPqtN.exe	d55342d3b2795f62cf92e83cc5fa22413acf84bfd4f5c67203c407fb0d9f8a69.exe
File created	C:\Windows\System\PiuJOYJ.exe	d55342d3b2795f62cf92e83cc5fa22413acf84bfd4f5c67203c407fb0d9f8a69.exe
File created	C:\Windows\System\UcVxXpz.exe	d55342d3b2795f62cf92e83cc5fa22413acf84bfd4f5c67203c407fb0d9f8a69.exe
File created	C:\Windows\System\cqZRoJZ.exe	d55342d3b2795f62cf92e83cc5fa22413acf84bfd4f5c67203c407fb0d9f8a69.exe
File created	C:\Windows\System\zhtVPfJ.exe	d55342d3b2795f62cf92e83cc5fa22413acf84bfd4f5c67203c407fb0d9f8a69.exe
File created	C:\Windows\System\ZSpiSGY.exe	d55342d3b2795f62cf92e83cc5fa22413acf84bfd4f5c67203c407fb0d9f8a69.exe
File created	C:\Windows\System\zlcBdxg.exe	d55342d3b2795f62cf92e83cc5fa22413acf84bfd4f5c67203c407fb0d9f8a69.exe
File created	C:\Windows\System\JkODtci.exe	d55342d3b2795f62cf92e83cc5fa22413acf84bfd4f5c67203c407fb0d9f8a69.exe
File created	C:\Windows\System\hocQFEI.exe	d55342d3b2795f62cf92e83cc5fa22413acf84bfd4f5c67203c407fb0d9f8a69.exe
File created	C:\Windows\System\PXiixfn.exe	d55342d3b2795f62cf92e83cc5fa22413acf84bfd4f5c67203c407fb0d9f8a69.exe
File created	C:\Windows\System\ofZZYDD.exe	d55342d3b2795f62cf92e83cc5fa22413acf84bfd4f5c67203c407fb0d9f8a69.exe
File created	C:\Windows\System\Zisbshi.exe	d55342d3b2795f62cf92e83cc5fa22413acf84bfd4f5c67203c407fb0d9f8a69.exe
File created	C:\Windows\System\tCBIaPG.exe	d55342d3b2795f62cf92e83cc5fa22413acf84bfd4f5c67203c407fb0d9f8a69.exe
File created	C:\Windows\System\OMojgpM.exe	d55342d3b2795f62cf92e83cc5fa22413acf84bfd4f5c67203c407fb0d9f8a69.exe
File created	C:\Windows\System\RHCSWFU.exe	d55342d3b2795f62cf92e83cc5fa22413acf84bfd4f5c67203c407fb0d9f8a69.exe
File created	C:\Windows\System\UmeocLf.exe	d55342d3b2795f62cf92e83cc5fa22413acf84bfd4f5c67203c407fb0d9f8a69.exe
File created	C:\Windows\System\dZwFyUj.exe	d55342d3b2795f62cf92e83cc5fa22413acf84bfd4f5c67203c407fb0d9f8a69.exe
File created	C:\Windows\System\LQrqeJy.exe	d55342d3b2795f62cf92e83cc5fa22413acf84bfd4f5c67203c407fb0d9f8a69.exe
File created	C:\Windows\System\WgOOUrC.exe	d55342d3b2795f62cf92e83cc5fa22413acf84bfd4f5c67203c407fb0d9f8a69.exe
File created	C:\Windows\System\bFuXlro.exe	d55342d3b2795f62cf92e83cc5fa22413acf84bfd4f5c67203c407fb0d9f8a69.exe
File created	C:\Windows\System\PhcQBvC.exe	d55342d3b2795f62cf92e83cc5fa22413acf84bfd4f5c67203c407fb0d9f8a69.exe
File created	C:\Windows\System\GSRfHLO.exe	d55342d3b2795f62cf92e83cc5fa22413acf84bfd4f5c67203c407fb0d9f8a69.exe
File created	C:\Windows\System\MIqjnJn.exe	d55342d3b2795f62cf92e83cc5fa22413acf84bfd4f5c67203c407fb0d9f8a69.exe
File created	C:\Windows\System\OeMGinC.exe	d55342d3b2795f62cf92e83cc5fa22413acf84bfd4f5c67203c407fb0d9f8a69.exe
File created	C:\Windows\System\qswWFln.exe	d55342d3b2795f62cf92e83cc5fa22413acf84bfd4f5c67203c407fb0d9f8a69.exe
File created	C:\Windows\System\AwRSzCX.exe	d55342d3b2795f62cf92e83cc5fa22413acf84bfd4f5c67203c407fb0d9f8a69.exe
File created	C:\Windows\System\cFWtyoP.exe	d55342d3b2795f62cf92e83cc5fa22413acf84bfd4f5c67203c407fb0d9f8a69.exe
File created	C:\Windows\System\BidPgJB.exe	d55342d3b2795f62cf92e83cc5fa22413acf84bfd4f5c67203c407fb0d9f8a69.exe
File created	C:\Windows\System\WCwbVcH.exe	d55342d3b2795f62cf92e83cc5fa22413acf84bfd4f5c67203c407fb0d9f8a69.exe
File created	C:\Windows\System\KiyEspP.exe	d55342d3b2795f62cf92e83cc5fa22413acf84bfd4f5c67203c407fb0d9f8a69.exe
File created	C:\Windows\System\GmBvrKv.exe	d55342d3b2795f62cf92e83cc5fa22413acf84bfd4f5c67203c407fb0d9f8a69.exe
File created	C:\Windows\System\claAhFY.exe	d55342d3b2795f62cf92e83cc5fa22413acf84bfd4f5c67203c407fb0d9f8a69.exe
File created	C:\Windows\System\fVPswtX.exe	d55342d3b2795f62cf92e83cc5fa22413acf84bfd4f5c67203c407fb0d9f8a69.exe
File created	C:\Windows\System\mCBsDku.exe	d55342d3b2795f62cf92e83cc5fa22413acf84bfd4f5c67203c407fb0d9f8a69.exe
File created	C:\Windows\System\sijNfSc.exe	d55342d3b2795f62cf92e83cc5fa22413acf84bfd4f5c67203c407fb0d9f8a69.exe
File created	C:\Windows\System\BnICPoF.exe	d55342d3b2795f62cf92e83cc5fa22413acf84bfd4f5c67203c407fb0d9f8a69.exe
File created	C:\Windows\System\egHLmyV.exe	d55342d3b2795f62cf92e83cc5fa22413acf84bfd4f5c67203c407fb0d9f8a69.exe
File created	C:\Windows\System\gmmdHdk.exe	d55342d3b2795f62cf92e83cc5fa22413acf84bfd4f5c67203c407fb0d9f8a69.exe
File created	C:\Windows\System\vRaZNbe.exe	d55342d3b2795f62cf92e83cc5fa22413acf84bfd4f5c67203c407fb0d9f8a69.exe
File created	C:\Windows\System\TyCuEpG.exe	d55342d3b2795f62cf92e83cc5fa22413acf84bfd4f5c67203c407fb0d9f8a69.exe
File created	C:\Windows\System\OYoPUPB.exe	d55342d3b2795f62cf92e83cc5fa22413acf84bfd4f5c67203c407fb0d9f8a69.exe
File created	C:\Windows\System\LVVdZGt.exe	d55342d3b2795f62cf92e83cc5fa22413acf84bfd4f5c67203c407fb0d9f8a69.exe
File created	C:\Windows\System\IlkDype.exe	d55342d3b2795f62cf92e83cc5fa22413acf84bfd4f5c67203c407fb0d9f8a69.exe
File created	C:\Windows\System\aWtnYXx.exe	d55342d3b2795f62cf92e83cc5fa22413acf84bfd4f5c67203c407fb0d9f8a69.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	17368	dwm.exe
Token: SeChangeNotifyPrivilege	17368	dwm.exe
Token: 33	17368	dwm.exe
Token: SeIncBasePriorityPrivilege	17368	dwm.exe
Token: SeShutdownPrivilege	17368	dwm.exe
Token: SeCreatePagefilePrivilege	17368	dwm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1464 wrote to memory of 2516	1464	d55342d3b2795f62cf92e83cc5fa22413acf84bfd4f5c67203c407fb0d9f8a69.exe	84
PID 1464 wrote to memory of 2516	1464	d55342d3b2795f62cf92e83cc5fa22413acf84bfd4f5c67203c407fb0d9f8a69.exe	84
PID 1464 wrote to memory of 1868	1464	d55342d3b2795f62cf92e83cc5fa22413acf84bfd4f5c67203c407fb0d9f8a69.exe	85
PID 1464 wrote to memory of 1868	1464	d55342d3b2795f62cf92e83cc5fa22413acf84bfd4f5c67203c407fb0d9f8a69.exe	85
PID 1464 wrote to memory of 2900	1464	d55342d3b2795f62cf92e83cc5fa22413acf84bfd4f5c67203c407fb0d9f8a69.exe	86
PID 1464 wrote to memory of 2900	1464	d55342d3b2795f62cf92e83cc5fa22413acf84bfd4f5c67203c407fb0d9f8a69.exe	86
PID 1464 wrote to memory of 3864	1464	d55342d3b2795f62cf92e83cc5fa22413acf84bfd4f5c67203c407fb0d9f8a69.exe	87
PID 1464 wrote to memory of 3864	1464	d55342d3b2795f62cf92e83cc5fa22413acf84bfd4f5c67203c407fb0d9f8a69.exe	87
PID 1464 wrote to memory of 2912	1464	d55342d3b2795f62cf92e83cc5fa22413acf84bfd4f5c67203c407fb0d9f8a69.exe	88
PID 1464 wrote to memory of 2912	1464	d55342d3b2795f62cf92e83cc5fa22413acf84bfd4f5c67203c407fb0d9f8a69.exe	88
PID 1464 wrote to memory of 4628	1464	d55342d3b2795f62cf92e83cc5fa22413acf84bfd4f5c67203c407fb0d9f8a69.exe	89
PID 1464 wrote to memory of 4628	1464	d55342d3b2795f62cf92e83cc5fa22413acf84bfd4f5c67203c407fb0d9f8a69.exe	89
PID 1464 wrote to memory of 3820	1464	d55342d3b2795f62cf92e83cc5fa22413acf84bfd4f5c67203c407fb0d9f8a69.exe	90
PID 1464 wrote to memory of 3820	1464	d55342d3b2795f62cf92e83cc5fa22413acf84bfd4f5c67203c407fb0d9f8a69.exe	90
PID 1464 wrote to memory of 4468	1464	d55342d3b2795f62cf92e83cc5fa22413acf84bfd4f5c67203c407fb0d9f8a69.exe	91
PID 1464 wrote to memory of 4468	1464	d55342d3b2795f62cf92e83cc5fa22413acf84bfd4f5c67203c407fb0d9f8a69.exe	91
PID 1464 wrote to memory of 1988	1464	d55342d3b2795f62cf92e83cc5fa22413acf84bfd4f5c67203c407fb0d9f8a69.exe	92
PID 1464 wrote to memory of 1988	1464	d55342d3b2795f62cf92e83cc5fa22413acf84bfd4f5c67203c407fb0d9f8a69.exe	92
PID 1464 wrote to memory of 552	1464	d55342d3b2795f62cf92e83cc5fa22413acf84bfd4f5c67203c407fb0d9f8a69.exe	93
PID 1464 wrote to memory of 552	1464	d55342d3b2795f62cf92e83cc5fa22413acf84bfd4f5c67203c407fb0d9f8a69.exe	93
PID 1464 wrote to memory of 640	1464	d55342d3b2795f62cf92e83cc5fa22413acf84bfd4f5c67203c407fb0d9f8a69.exe	94
PID 1464 wrote to memory of 640	1464	d55342d3b2795f62cf92e83cc5fa22413acf84bfd4f5c67203c407fb0d9f8a69.exe	94
PID 1464 wrote to memory of 1312	1464	d55342d3b2795f62cf92e83cc5fa22413acf84bfd4f5c67203c407fb0d9f8a69.exe	95
PID 1464 wrote to memory of 1312	1464	d55342d3b2795f62cf92e83cc5fa22413acf84bfd4f5c67203c407fb0d9f8a69.exe	95
PID 1464 wrote to memory of 5060	1464	d55342d3b2795f62cf92e83cc5fa22413acf84bfd4f5c67203c407fb0d9f8a69.exe	96
PID 1464 wrote to memory of 5060	1464	d55342d3b2795f62cf92e83cc5fa22413acf84bfd4f5c67203c407fb0d9f8a69.exe	96
PID 1464 wrote to memory of 4776	1464	d55342d3b2795f62cf92e83cc5fa22413acf84bfd4f5c67203c407fb0d9f8a69.exe	97
PID 1464 wrote to memory of 4776	1464	d55342d3b2795f62cf92e83cc5fa22413acf84bfd4f5c67203c407fb0d9f8a69.exe	97
PID 1464 wrote to memory of 3308	1464	d55342d3b2795f62cf92e83cc5fa22413acf84bfd4f5c67203c407fb0d9f8a69.exe	98
PID 1464 wrote to memory of 3308	1464	d55342d3b2795f62cf92e83cc5fa22413acf84bfd4f5c67203c407fb0d9f8a69.exe	98
PID 1464 wrote to memory of 1132	1464	d55342d3b2795f62cf92e83cc5fa22413acf84bfd4f5c67203c407fb0d9f8a69.exe	99
PID 1464 wrote to memory of 1132	1464	d55342d3b2795f62cf92e83cc5fa22413acf84bfd4f5c67203c407fb0d9f8a69.exe	99
PID 1464 wrote to memory of 2668	1464	d55342d3b2795f62cf92e83cc5fa22413acf84bfd4f5c67203c407fb0d9f8a69.exe	100
PID 1464 wrote to memory of 2668	1464	d55342d3b2795f62cf92e83cc5fa22413acf84bfd4f5c67203c407fb0d9f8a69.exe	100
PID 1464 wrote to memory of 2260	1464	d55342d3b2795f62cf92e83cc5fa22413acf84bfd4f5c67203c407fb0d9f8a69.exe	101
PID 1464 wrote to memory of 2260	1464	d55342d3b2795f62cf92e83cc5fa22413acf84bfd4f5c67203c407fb0d9f8a69.exe	101
PID 1464 wrote to memory of 1196	1464	d55342d3b2795f62cf92e83cc5fa22413acf84bfd4f5c67203c407fb0d9f8a69.exe	102
PID 1464 wrote to memory of 1196	1464	d55342d3b2795f62cf92e83cc5fa22413acf84bfd4f5c67203c407fb0d9f8a69.exe	102
PID 1464 wrote to memory of 3904	1464	d55342d3b2795f62cf92e83cc5fa22413acf84bfd4f5c67203c407fb0d9f8a69.exe	103
PID 1464 wrote to memory of 3904	1464	d55342d3b2795f62cf92e83cc5fa22413acf84bfd4f5c67203c407fb0d9f8a69.exe	103
PID 1464 wrote to memory of 2724	1464	d55342d3b2795f62cf92e83cc5fa22413acf84bfd4f5c67203c407fb0d9f8a69.exe	104
PID 1464 wrote to memory of 2724	1464	d55342d3b2795f62cf92e83cc5fa22413acf84bfd4f5c67203c407fb0d9f8a69.exe	104
PID 1464 wrote to memory of 1896	1464	d55342d3b2795f62cf92e83cc5fa22413acf84bfd4f5c67203c407fb0d9f8a69.exe	105
PID 1464 wrote to memory of 1896	1464	d55342d3b2795f62cf92e83cc5fa22413acf84bfd4f5c67203c407fb0d9f8a69.exe	105
PID 1464 wrote to memory of 1052	1464	d55342d3b2795f62cf92e83cc5fa22413acf84bfd4f5c67203c407fb0d9f8a69.exe	106
PID 1464 wrote to memory of 1052	1464	d55342d3b2795f62cf92e83cc5fa22413acf84bfd4f5c67203c407fb0d9f8a69.exe	106
PID 1464 wrote to memory of 4064	1464	d55342d3b2795f62cf92e83cc5fa22413acf84bfd4f5c67203c407fb0d9f8a69.exe	107
PID 1464 wrote to memory of 4064	1464	d55342d3b2795f62cf92e83cc5fa22413acf84bfd4f5c67203c407fb0d9f8a69.exe	107
PID 1464 wrote to memory of 3152	1464	d55342d3b2795f62cf92e83cc5fa22413acf84bfd4f5c67203c407fb0d9f8a69.exe	108
PID 1464 wrote to memory of 3152	1464	d55342d3b2795f62cf92e83cc5fa22413acf84bfd4f5c67203c407fb0d9f8a69.exe	108
PID 1464 wrote to memory of 4872	1464	d55342d3b2795f62cf92e83cc5fa22413acf84bfd4f5c67203c407fb0d9f8a69.exe	109
PID 1464 wrote to memory of 4872	1464	d55342d3b2795f62cf92e83cc5fa22413acf84bfd4f5c67203c407fb0d9f8a69.exe	109
PID 1464 wrote to memory of 1108	1464	d55342d3b2795f62cf92e83cc5fa22413acf84bfd4f5c67203c407fb0d9f8a69.exe	110
PID 1464 wrote to memory of 1108	1464	d55342d3b2795f62cf92e83cc5fa22413acf84bfd4f5c67203c407fb0d9f8a69.exe	110
PID 1464 wrote to memory of 1524	1464	d55342d3b2795f62cf92e83cc5fa22413acf84bfd4f5c67203c407fb0d9f8a69.exe	111
PID 1464 wrote to memory of 1524	1464	d55342d3b2795f62cf92e83cc5fa22413acf84bfd4f5c67203c407fb0d9f8a69.exe	111
PID 1464 wrote to memory of 748	1464	d55342d3b2795f62cf92e83cc5fa22413acf84bfd4f5c67203c407fb0d9f8a69.exe	112
PID 1464 wrote to memory of 748	1464	d55342d3b2795f62cf92e83cc5fa22413acf84bfd4f5c67203c407fb0d9f8a69.exe	112
PID 1464 wrote to memory of 744	1464	d55342d3b2795f62cf92e83cc5fa22413acf84bfd4f5c67203c407fb0d9f8a69.exe	113
PID 1464 wrote to memory of 744	1464	d55342d3b2795f62cf92e83cc5fa22413acf84bfd4f5c67203c407fb0d9f8a69.exe	113
PID 1464 wrote to memory of 2328	1464	d55342d3b2795f62cf92e83cc5fa22413acf84bfd4f5c67203c407fb0d9f8a69.exe	114
PID 1464 wrote to memory of 2328	1464	d55342d3b2795f62cf92e83cc5fa22413acf84bfd4f5c67203c407fb0d9f8a69.exe	114
PID 1464 wrote to memory of 996	1464	d55342d3b2795f62cf92e83cc5fa22413acf84bfd4f5c67203c407fb0d9f8a69.exe	115
PID 1464 wrote to memory of 996	1464	d55342d3b2795f62cf92e83cc5fa22413acf84bfd4f5c67203c407fb0d9f8a69.exe	115

C:\Users\Admin\AppData\Local\Temp\d55342d3b2795f62cf92e83cc5fa22413acf84bfd4f5c67203c407fb0d9f8a69.exe
"C:\Users\Admin\AppData\Local\Temp\d55342d3b2795f62cf92e83cc5fa22413acf84bfd4f5c67203c407fb0d9f8a69.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1464
- C:\Windows\System\tpKCtkg.exe
  C:\Windows\System\tpKCtkg.exe
  2⤵
  - Executes dropped EXE
  PID:2516
- C:\Windows\System\OFOevgD.exe
  C:\Windows\System\OFOevgD.exe
  2⤵
  - Executes dropped EXE
  PID:1868
- C:\Windows\System\fAOTIfk.exe
  C:\Windows\System\fAOTIfk.exe
  2⤵
  - Executes dropped EXE
  PID:2900
- C:\Windows\System\JUmPWQK.exe
  C:\Windows\System\JUmPWQK.exe
  2⤵
  - Executes dropped EXE
  PID:3864
- C:\Windows\System\NKyOaWC.exe
  C:\Windows\System\NKyOaWC.exe
  2⤵
  - Executes dropped EXE
  PID:2912
- C:\Windows\System\LVDRzRk.exe
  C:\Windows\System\LVDRzRk.exe
  2⤵
  - Executes dropped EXE
  PID:4628
- C:\Windows\System\zYPcTVe.exe
  C:\Windows\System\zYPcTVe.exe
  2⤵
  - Executes dropped EXE
  PID:3820
- C:\Windows\System\mJJDJhj.exe
  C:\Windows\System\mJJDJhj.exe
  2⤵
  - Executes dropped EXE
  PID:4468
- C:\Windows\System\ADQUbZx.exe
  C:\Windows\System\ADQUbZx.exe
  2⤵
  - Executes dropped EXE
  PID:1988
- C:\Windows\System\sgmxipe.exe
  C:\Windows\System\sgmxipe.exe
  2⤵
  - Executes dropped EXE
  PID:552
- C:\Windows\System\cqZRoJZ.exe
  C:\Windows\System\cqZRoJZ.exe
  2⤵
  - Executes dropped EXE
  PID:640
- C:\Windows\System\XmKtady.exe
  C:\Windows\System\XmKtady.exe
  2⤵
  - Executes dropped EXE
  PID:1312
- C:\Windows\System\TtnShKp.exe
  C:\Windows\System\TtnShKp.exe
  2⤵
  - Executes dropped EXE
  PID:5060
- C:\Windows\System\wbsMbcy.exe
  C:\Windows\System\wbsMbcy.exe
  2⤵
  - Executes dropped EXE
  PID:4776
- C:\Windows\System\mtngeHI.exe
  C:\Windows\System\mtngeHI.exe
  2⤵
  - Executes dropped EXE
  PID:3308
- C:\Windows\System\pniDRSg.exe
  C:\Windows\System\pniDRSg.exe
  2⤵
  - Executes dropped EXE
  PID:1132
- C:\Windows\System\DPpMxNc.exe
  C:\Windows\System\DPpMxNc.exe
  2⤵
  - Executes dropped EXE
  PID:2668
- C:\Windows\System\lTVPmxH.exe
  C:\Windows\System\lTVPmxH.exe
  2⤵
  - Executes dropped EXE
  PID:2260
- C:\Windows\System\OIlhtgK.exe
  C:\Windows\System\OIlhtgK.exe
  2⤵
  - Executes dropped EXE
  PID:1196
- C:\Windows\System\nFfKIOA.exe
  C:\Windows\System\nFfKIOA.exe
  2⤵
  - Executes dropped EXE
  PID:3904
- C:\Windows\System\KpckVKe.exe
  C:\Windows\System\KpckVKe.exe
  2⤵
  - Executes dropped EXE
  PID:2724
- C:\Windows\System\gCtFAbk.exe
  C:\Windows\System\gCtFAbk.exe
  2⤵
  - Executes dropped EXE
  PID:1896
- C:\Windows\System\GfTSUjF.exe
  C:\Windows\System\GfTSUjF.exe
  2⤵
  - Executes dropped EXE
  PID:1052
- C:\Windows\System\CslYAgF.exe
  C:\Windows\System\CslYAgF.exe
  2⤵
  - Executes dropped EXE
  PID:4064
- C:\Windows\System\LpqhiPk.exe
  C:\Windows\System\LpqhiPk.exe
  2⤵
  - Executes dropped EXE
  PID:3152
- C:\Windows\System\uRQIdaT.exe
  C:\Windows\System\uRQIdaT.exe
  2⤵
  - Executes dropped EXE
  PID:4872
- C:\Windows\System\ntdGnLZ.exe
  C:\Windows\System\ntdGnLZ.exe
  2⤵
  - Executes dropped EXE
  PID:1108
- C:\Windows\System\TlBGLVQ.exe
  C:\Windows\System\TlBGLVQ.exe
  2⤵
  - Executes dropped EXE
  PID:1524
- C:\Windows\System\WCwbVcH.exe
  C:\Windows\System\WCwbVcH.exe
  2⤵
  - Executes dropped EXE
  PID:748
- C:\Windows\System\VrkEgrb.exe
  C:\Windows\System\VrkEgrb.exe
  2⤵
  - Executes dropped EXE
  PID:744
- C:\Windows\System\HDhmtcW.exe
  C:\Windows\System\HDhmtcW.exe
  2⤵
  - Executes dropped EXE
  PID:2328
- C:\Windows\System\VzuvqbG.exe
  C:\Windows\System\VzuvqbG.exe
  2⤵
  - Executes dropped EXE
  PID:996
- C:\Windows\System\YWlhgPQ.exe
  C:\Windows\System\YWlhgPQ.exe
  2⤵
  - Executes dropped EXE
  PID:1600
- C:\Windows\System\zjMglKY.exe
  C:\Windows\System\zjMglKY.exe
  2⤵
  - Executes dropped EXE
  PID:2336
- C:\Windows\System\PibKMgm.exe
  C:\Windows\System\PibKMgm.exe
  2⤵
  - Executes dropped EXE
  PID:1536
- C:\Windows\System\XScrlZY.exe
  C:\Windows\System\XScrlZY.exe
  2⤵
  - Executes dropped EXE
  PID:2348
- C:\Windows\System\VYuTwVC.exe
  C:\Windows\System\VYuTwVC.exe
  2⤵
  - Executes dropped EXE
  PID:400
- C:\Windows\System\LaMwcKa.exe
  C:\Windows\System\LaMwcKa.exe
  2⤵
  - Executes dropped EXE
  PID:2292
- C:\Windows\System\FUDfKDC.exe
  C:\Windows\System\FUDfKDC.exe
  2⤵
  - Executes dropped EXE
  PID:4800
- C:\Windows\System\KHIGcxD.exe
  C:\Windows\System\KHIGcxD.exe
  2⤵
  - Executes dropped EXE
  PID:3876
- C:\Windows\System\WZhwGAj.exe
  C:\Windows\System\WZhwGAj.exe
  2⤵
  - Executes dropped EXE
  PID:980
- C:\Windows\System\aTebyQQ.exe
  C:\Windows\System\aTebyQQ.exe
  2⤵
  - Executes dropped EXE
  PID:4420
- C:\Windows\System\sQlFIVP.exe
  C:\Windows\System\sQlFIVP.exe
  2⤵
  - Executes dropped EXE
  PID:2952
- C:\Windows\System\sUOOfui.exe
  C:\Windows\System\sUOOfui.exe
  2⤵
  - Executes dropped EXE
  PID:3624
- C:\Windows\System\GBxiADu.exe
  C:\Windows\System\GBxiADu.exe
  2⤵
  - Executes dropped EXE
  PID:4296
- C:\Windows\System\bCtjetk.exe
  C:\Windows\System\bCtjetk.exe
  2⤵
  - Executes dropped EXE
  PID:436
- C:\Windows\System\oNjmlqQ.exe
  C:\Windows\System\oNjmlqQ.exe
  2⤵
  - Executes dropped EXE
  PID:760
- C:\Windows\System\JEQUOyO.exe
  C:\Windows\System\JEQUOyO.exe
  2⤵
  - Executes dropped EXE
  PID:4784
- C:\Windows\System\imyBxLG.exe
  C:\Windows\System\imyBxLG.exe
  2⤵
  - Executes dropped EXE
  PID:1412
- C:\Windows\System\zZRWEAP.exe
  C:\Windows\System\zZRWEAP.exe
  2⤵
  - Executes dropped EXE
  PID:540
- C:\Windows\System\hPdqOqW.exe
  C:\Windows\System\hPdqOqW.exe
  2⤵
  - Executes dropped EXE
  PID:4220
- C:\Windows\System\hFcIlkB.exe
  C:\Windows\System\hFcIlkB.exe
  2⤵
  - Executes dropped EXE
  PID:1968
- C:\Windows\System\ymMpNhv.exe
  C:\Windows\System\ymMpNhv.exe
  2⤵
  - Executes dropped EXE
  PID:3984
- C:\Windows\System\zlYrPXj.exe
  C:\Windows\System\zlYrPXj.exe
  2⤵
  - Executes dropped EXE
  PID:1568
- C:\Windows\System\ahHkYQx.exe
  C:\Windows\System\ahHkYQx.exe
  2⤵
  - Executes dropped EXE
  PID:3976
- C:\Windows\System\QxCATAB.exe
  C:\Windows\System\QxCATAB.exe
  2⤵
  - Executes dropped EXE
  PID:1088
- C:\Windows\System\gMamnFZ.exe
  C:\Windows\System\gMamnFZ.exe
  2⤵
  - Executes dropped EXE
  PID:3912
- C:\Windows\System\ClqSycA.exe
  C:\Windows\System\ClqSycA.exe
  2⤵
  - Executes dropped EXE
  PID:1676
- C:\Windows\System\NEvPsnG.exe
  C:\Windows\System\NEvPsnG.exe
  2⤵
  - Executes dropped EXE
  PID:2172
- C:\Windows\System\UrsnHrX.exe
  C:\Windows\System\UrsnHrX.exe
  2⤵
  - Executes dropped EXE
  PID:3888
- C:\Windows\System\XVhQECr.exe
  C:\Windows\System\XVhQECr.exe
  2⤵
  - Executes dropped EXE
  PID:3036
- C:\Windows\System\WQlXPYB.exe
  C:\Windows\System\WQlXPYB.exe
  2⤵
  - Executes dropped EXE
  PID:4408
- C:\Windows\System\kgHmBfs.exe
  C:\Windows\System\kgHmBfs.exe
  2⤵
  - Executes dropped EXE
  PID:3628
- C:\Windows\System\YMwZIzE.exe
  C:\Windows\System\YMwZIzE.exe
  2⤵
  - Executes dropped EXE
  PID:840
- C:\Windows\System\DsVFySG.exe
  C:\Windows\System\DsVFySG.exe
  2⤵
  PID:2008
- C:\Windows\System\fJWdDrQ.exe
  C:\Windows\System\fJWdDrQ.exe
  2⤵
  PID:4104
- C:\Windows\System\AvJFdPp.exe
  C:\Windows\System\AvJFdPp.exe
  2⤵
  PID:1048
- C:\Windows\System\kskbHOg.exe
  C:\Windows\System\kskbHOg.exe
  2⤵
  PID:1280
- C:\Windows\System\wQjyDRA.exe
  C:\Windows\System\wQjyDRA.exe
  2⤵
  PID:1852
- C:\Windows\System\isGEdGN.exe
  C:\Windows\System\isGEdGN.exe
  2⤵
  PID:3988
- C:\Windows\System\hAHaBKS.exe
  C:\Windows\System\hAHaBKS.exe
  2⤵
  PID:4480
- C:\Windows\System\MVuDvsA.exe
  C:\Windows\System\MVuDvsA.exe
  2⤵
  PID:844
- C:\Windows\System\UiJinIc.exe
  C:\Windows\System\UiJinIc.exe
  2⤵
  PID:2052
- C:\Windows\System\lPIqjDt.exe
  C:\Windows\System\lPIqjDt.exe
  2⤵
  PID:3636
- C:\Windows\System\ncIVEzZ.exe
  C:\Windows\System\ncIVEzZ.exe
  2⤵
  PID:816
- C:\Windows\System\wqLkYhD.exe
  C:\Windows\System\wqLkYhD.exe
  2⤵
  PID:2592
- C:\Windows\System\WgOOUrC.exe
  C:\Windows\System\WgOOUrC.exe
  2⤵
  PID:2684
- C:\Windows\System\WiwlTCI.exe
  C:\Windows\System\WiwlTCI.exe
  2⤵
  PID:2404
- C:\Windows\System\bjtTlAo.exe
  C:\Windows\System\bjtTlAo.exe
  2⤵
  PID:3452
- C:\Windows\System\KSdKYeT.exe
  C:\Windows\System\KSdKYeT.exe
  2⤵
  PID:4592
- C:\Windows\System\mYyGfjg.exe
  C:\Windows\System\mYyGfjg.exe
  2⤵
  PID:4432
- C:\Windows\System\TMozArD.exe
  C:\Windows\System\TMozArD.exe
  2⤵
  PID:4280
- C:\Windows\System\GzRSdoT.exe
  C:\Windows\System\GzRSdoT.exe
  2⤵
  PID:1456
- C:\Windows\System\tthaZve.exe
  C:\Windows\System\tthaZve.exe
  2⤵
  PID:5036
- C:\Windows\System\uPSrODG.exe
  C:\Windows\System\uPSrODG.exe
  2⤵
  PID:1168
- C:\Windows\System\MvSLDtL.exe
  C:\Windows\System\MvSLDtL.exe
  2⤵
  PID:4980
- C:\Windows\System\Cepgphw.exe
  C:\Windows\System\Cepgphw.exe
  2⤵
  PID:2944
- C:\Windows\System\ShgMfOW.exe
  C:\Windows\System\ShgMfOW.exe
  2⤵
  PID:1916
- C:\Windows\System\PzFSAkn.exe
  C:\Windows\System\PzFSAkn.exe
  2⤵
  PID:3108
- C:\Windows\System\lBVjiUi.exe
  C:\Windows\System\lBVjiUi.exe
  2⤵
  PID:4020
- C:\Windows\System\IbHIeBK.exe
  C:\Windows\System\IbHIeBK.exe
  2⤵
  PID:2064
- C:\Windows\System\WgpLomU.exe
  C:\Windows\System\WgpLomU.exe
  2⤵
  PID:5136
- C:\Windows\System\DltcpQz.exe
  C:\Windows\System\DltcpQz.exe
  2⤵
  PID:5164
- C:\Windows\System\tSOpCHQ.exe
  C:\Windows\System\tSOpCHQ.exe
  2⤵
  PID:5188
- C:\Windows\System\ETmEGak.exe
  C:\Windows\System\ETmEGak.exe
  2⤵
  PID:5220
- C:\Windows\System\HKyiWET.exe
  C:\Windows\System\HKyiWET.exe
  2⤵
  PID:5244
- C:\Windows\System\xHiXRAV.exe
  C:\Windows\System\xHiXRAV.exe
  2⤵
  PID:5268
- C:\Windows\System\MLHyixZ.exe
  C:\Windows\System\MLHyixZ.exe
  2⤵
  PID:5300
- C:\Windows\System\RwNoeXu.exe
  C:\Windows\System\RwNoeXu.exe
  2⤵
  PID:5328
- C:\Windows\System\pTZZaXt.exe
  C:\Windows\System\pTZZaXt.exe
  2⤵
  PID:5356
- C:\Windows\System\jDHQEyq.exe
  C:\Windows\System\jDHQEyq.exe
  2⤵
  PID:5384
- C:\Windows\System\lgESuzx.exe
  C:\Windows\System\lgESuzx.exe
  2⤵
  PID:5408
- C:\Windows\System\EcSyLdC.exe
  C:\Windows\System\EcSyLdC.exe
  2⤵
  PID:5440
- C:\Windows\System\lSkOrrF.exe
  C:\Windows\System\lSkOrrF.exe
  2⤵
  PID:5468
- C:\Windows\System\iIuDZRc.exe
  C:\Windows\System\iIuDZRc.exe
  2⤵
  PID:5496
- C:\Windows\System\BnICPoF.exe
  C:\Windows\System\BnICPoF.exe
  2⤵
  PID:5524
- C:\Windows\System\ByYrDhd.exe
  C:\Windows\System\ByYrDhd.exe
  2⤵
  PID:5560
- C:\Windows\System\zEsRMzI.exe
  C:\Windows\System\zEsRMzI.exe
  2⤵
  PID:5624
- C:\Windows\System\uDTVssL.exe
  C:\Windows\System\uDTVssL.exe
  2⤵
  PID:5640
- C:\Windows\System\PZgidkW.exe
  C:\Windows\System\PZgidkW.exe
  2⤵
  PID:5668
- C:\Windows\System\gJPktWv.exe
  C:\Windows\System\gJPktWv.exe
  2⤵
  PID:5688
- C:\Windows\System\JpUlosD.exe
  C:\Windows\System\JpUlosD.exe
  2⤵
  PID:5724
- C:\Windows\System\YVNRLdh.exe
  C:\Windows\System\YVNRLdh.exe
  2⤵
  PID:5760
- C:\Windows\System\xViRjab.exe
  C:\Windows\System\xViRjab.exe
  2⤵
  PID:5788
- C:\Windows\System\OIcffrU.exe
  C:\Windows\System\OIcffrU.exe
  2⤵
  PID:5816
- C:\Windows\System\mjRHqES.exe
  C:\Windows\System\mjRHqES.exe
  2⤵
  PID:5844
- C:\Windows\System\PorOBIN.exe
  C:\Windows\System\PorOBIN.exe
  2⤵
  PID:5872
- C:\Windows\System\aJSrWRt.exe
  C:\Windows\System\aJSrWRt.exe
  2⤵
  PID:5900
- C:\Windows\System\OUlKznh.exe
  C:\Windows\System\OUlKznh.exe
  2⤵
  PID:5928
- C:\Windows\System\QBAogCF.exe
  C:\Windows\System\QBAogCF.exe
  2⤵
  PID:5956
- C:\Windows\System\aWtnYXx.exe
  C:\Windows\System\aWtnYXx.exe
  2⤵
  PID:5984
- C:\Windows\System\jiMfVwZ.exe
  C:\Windows\System\jiMfVwZ.exe
  2⤵
  PID:6012
- C:\Windows\System\MrCaRDM.exe
  C:\Windows\System\MrCaRDM.exe
  2⤵
  PID:6040
- C:\Windows\System\YKdFqac.exe
  C:\Windows\System\YKdFqac.exe
  2⤵
  PID:6068
- C:\Windows\System\MnRtBRr.exe
  C:\Windows\System\MnRtBRr.exe
  2⤵
  PID:6096
- C:\Windows\System\bDnocND.exe
  C:\Windows\System\bDnocND.exe
  2⤵
  PID:6124
- C:\Windows\System\YfeWywB.exe
  C:\Windows\System\YfeWywB.exe
  2⤵
  PID:1136
- C:\Windows\System\AwRSzCX.exe
  C:\Windows\System\AwRSzCX.exe
  2⤵
  PID:1976
- C:\Windows\System\MHsVIKJ.exe
  C:\Windows\System\MHsVIKJ.exe
  2⤵
  PID:1492
- C:\Windows\System\FEkzeKc.exe
  C:\Windows\System\FEkzeKc.exe
  2⤵
  PID:1764
- C:\Windows\System\uJnKkqd.exe
  C:\Windows\System\uJnKkqd.exe
  2⤵
  PID:5172
- C:\Windows\System\xcicKLH.exe
  C:\Windows\System\xcicKLH.exe
  2⤵
  PID:2228
- C:\Windows\System\kctkOUO.exe
  C:\Windows\System\kctkOUO.exe
  2⤵
  PID:5288
- C:\Windows\System\PoUBrqL.exe
  C:\Windows\System\PoUBrqL.exe
  2⤵
  PID:5316
- C:\Windows\System\ZQWGgaf.exe
  C:\Windows\System\ZQWGgaf.exe
  2⤵
  PID:5348
- C:\Windows\System\PoRGTHx.exe
  C:\Windows\System\PoRGTHx.exe
  2⤵
  PID:5396
- C:\Windows\System\JVRdgaW.exe
  C:\Windows\System\JVRdgaW.exe
  2⤵
  PID:5460
- C:\Windows\System\OMojgpM.exe
  C:\Windows\System\OMojgpM.exe
  2⤵
  PID:5016
- C:\Windows\System\GvJUShB.exe
  C:\Windows\System\GvJUShB.exe
  2⤵
  PID:4116
- C:\Windows\System\giRfvPm.exe
  C:\Windows\System\giRfvPm.exe
  2⤵
  PID:2916
- C:\Windows\System\ilqtVXO.exe
  C:\Windows\System\ilqtVXO.exe
  2⤵
  PID:5536
- C:\Windows\System\gWLIQrf.exe
  C:\Windows\System\gWLIQrf.exe
  2⤵
  PID:5588
- C:\Windows\System\qawkWLN.exe
  C:\Windows\System\qawkWLN.exe
  2⤵
  PID:944
- C:\Windows\System\QgFNJZG.exe
  C:\Windows\System\QgFNJZG.exe
  2⤵
  PID:2740
- C:\Windows\System\LVOcKzu.exe
  C:\Windows\System\LVOcKzu.exe
  2⤵
  PID:2312
- C:\Windows\System\qswWFln.exe
  C:\Windows\System\qswWFln.exe
  2⤵
  PID:5680
- C:\Windows\System\YHedQhk.exe
  C:\Windows\System\YHedQhk.exe
  2⤵
  PID:3432
- C:\Windows\System\hdzkimu.exe
  C:\Windows\System\hdzkimu.exe
  2⤵
  PID:5780
- C:\Windows\System\OuqVCoK.exe
  C:\Windows\System\OuqVCoK.exe
  2⤵
  PID:5828
- C:\Windows\System\aNWTjOD.exe
  C:\Windows\System\aNWTjOD.exe
  2⤵
  PID:5856
- C:\Windows\System\kBrvWSY.exe
  C:\Windows\System\kBrvWSY.exe
  2⤵
  PID:5912
- C:\Windows\System\aYlYloq.exe
  C:\Windows\System\aYlYloq.exe
  2⤵
  PID:936
- C:\Windows\System\neNZDEI.exe
  C:\Windows\System\neNZDEI.exe
  2⤵
  PID:3660
- C:\Windows\System\kXItRmR.exe
  C:\Windows\System\kXItRmR.exe
  2⤵
  PID:6080
- C:\Windows\System\pMbwWXl.exe
  C:\Windows\System\pMbwWXl.exe
  2⤵
  PID:2948
- C:\Windows\System\HrumVGa.exe
  C:\Windows\System\HrumVGa.exe
  2⤵
  PID:6120
- C:\Windows\System\kuwHMvT.exe
  C:\Windows\System\kuwHMvT.exe
  2⤵
  PID:4140
- C:\Windows\System\UkIElRb.exe
  C:\Windows\System\UkIElRb.exe
  2⤵
  PID:4704
- C:\Windows\System\MIqjnJn.exe
  C:\Windows\System\MIqjnJn.exe
  2⤵
  PID:5128
- C:\Windows\System\RgQccug.exe
  C:\Windows\System\RgQccug.exe
  2⤵
  PID:5228
- C:\Windows\System\JbjODzL.exe
  C:\Windows\System\JbjODzL.exe
  2⤵
  PID:5344
- C:\Windows\System\mIjwmIZ.exe
  C:\Windows\System\mIjwmIZ.exe
  2⤵
  PID:5484
- C:\Windows\System\khZwKfi.exe
  C:\Windows\System\khZwKfi.exe
  2⤵
  PID:2924
- C:\Windows\System\xJxNVzP.exe
  C:\Windows\System\xJxNVzP.exe
  2⤵
  PID:5620
- C:\Windows\System\BIeQTTu.exe
  C:\Windows\System\BIeQTTu.exe
  2⤵
  PID:5592
- C:\Windows\System\NmsydVW.exe
  C:\Windows\System\NmsydVW.exe
  2⤵
  PID:1428
- C:\Windows\System\poVzdRw.exe
  C:\Windows\System\poVzdRw.exe
  2⤵
  PID:2456
- C:\Windows\System\QbtoRSa.exe
  C:\Windows\System\QbtoRSa.exe
  2⤵
  PID:5976
- C:\Windows\System\lUaiQcm.exe
  C:\Windows\System\lUaiQcm.exe
  2⤵
  PID:6108
- C:\Windows\System\gxFEDsy.exe
  C:\Windows\System\gxFEDsy.exe
  2⤵
  PID:648
- C:\Windows\System\uGqXQCu.exe
  C:\Windows\System\uGqXQCu.exe
  2⤵
  PID:5200
- C:\Windows\System\UclNmyk.exe
  C:\Windows\System\UclNmyk.exe
  2⤵
  PID:4588
- C:\Windows\System\uiCsbhs.exe
  C:\Windows\System\uiCsbhs.exe
  2⤵
  PID:676
- C:\Windows\System\llTVgKO.exe
  C:\Windows\System\llTVgKO.exe
  2⤵
  PID:5712
- C:\Windows\System\uuYndpD.exe
  C:\Windows\System\uuYndpD.exe
  2⤵
  PID:5840
- C:\Windows\System\dAJaROA.exe
  C:\Windows\System\dAJaROA.exe
  2⤵
  PID:5100
- C:\Windows\System\kbbGmcK.exe
  C:\Windows\System\kbbGmcK.exe
  2⤵
  PID:4804
- C:\Windows\System\wLxIVsC.exe
  C:\Windows\System\wLxIVsC.exe
  2⤵
  PID:2660
- C:\Windows\System\YDMmLPF.exe
  C:\Windows\System\YDMmLPF.exe
  2⤵
  PID:3504
- C:\Windows\System\hxorYyd.exe
  C:\Windows\System\hxorYyd.exe
  2⤵
  PID:6156
- C:\Windows\System\udTBVbW.exe
  C:\Windows\System\udTBVbW.exe
  2⤵
  PID:6184
- C:\Windows\System\bNAdSQN.exe
  C:\Windows\System\bNAdSQN.exe
  2⤵
  PID:6212
- C:\Windows\System\hXPiDpO.exe
  C:\Windows\System\hXPiDpO.exe
  2⤵
  PID:6256
- C:\Windows\System\wfcYnch.exe
  C:\Windows\System\wfcYnch.exe
  2⤵
  PID:6300
- C:\Windows\System\SdsHinL.exe
  C:\Windows\System\SdsHinL.exe
  2⤵
  PID:6328
- C:\Windows\System\gqUnAlK.exe
  C:\Windows\System\gqUnAlK.exe
  2⤵
  PID:6356
- C:\Windows\System\LljkFDW.exe
  C:\Windows\System\LljkFDW.exe
  2⤵
  PID:6396
- C:\Windows\System\bJZBSPb.exe
  C:\Windows\System\bJZBSPb.exe
  2⤵
  PID:6412
- C:\Windows\System\SPaQSBy.exe
  C:\Windows\System\SPaQSBy.exe
  2⤵
  PID:6440
- C:\Windows\System\caoXpUu.exe
  C:\Windows\System\caoXpUu.exe
  2⤵
  PID:6464
- C:\Windows\System\oOwwoCL.exe
  C:\Windows\System\oOwwoCL.exe
  2⤵
  PID:6488
- C:\Windows\System\USrOAiW.exe
  C:\Windows\System\USrOAiW.exe
  2⤵
  PID:6512
- C:\Windows\System\rdCTynu.exe
  C:\Windows\System\rdCTynu.exe
  2⤵
  PID:6528
- C:\Windows\System\fJkpbBI.exe
  C:\Windows\System\fJkpbBI.exe
  2⤵
  PID:6568
- C:\Windows\System\xFhmtyx.exe
  C:\Windows\System\xFhmtyx.exe
  2⤵
  PID:6604
- C:\Windows\System\lAMiFSU.exe
  C:\Windows\System\lAMiFSU.exe
  2⤵
  PID:6628
- C:\Windows\System\BPsewfP.exe
  C:\Windows\System\BPsewfP.exe
  2⤵
  PID:6656
- C:\Windows\System\HoGHvkL.exe
  C:\Windows\System\HoGHvkL.exe
  2⤵
  PID:6684
- C:\Windows\System\YEQvArm.exe
  C:\Windows\System\YEQvArm.exe
  2⤵
  PID:6712
- C:\Windows\System\nwJoGaW.exe
  C:\Windows\System\nwJoGaW.exe
  2⤵
  PID:6752
- C:\Windows\System\ShtuSaB.exe
  C:\Windows\System\ShtuSaB.exe
  2⤵
  PID:6796
- C:\Windows\System\PGROLnz.exe
  C:\Windows\System\PGROLnz.exe
  2⤵
  PID:6820
- C:\Windows\System\OYvdOPh.exe
  C:\Windows\System\OYvdOPh.exe
  2⤵
  PID:6860
- C:\Windows\System\uuqwjAO.exe
  C:\Windows\System\uuqwjAO.exe
  2⤵
  PID:6880
- C:\Windows\System\SEQHRUP.exe
  C:\Windows\System\SEQHRUP.exe
  2⤵
  PID:6904
- C:\Windows\System\gpVsZms.exe
  C:\Windows\System\gpVsZms.exe
  2⤵
  PID:6932
- C:\Windows\System\cJeCPEg.exe
  C:\Windows\System\cJeCPEg.exe
  2⤵
  PID:6956
- C:\Windows\System\fcfHJBl.exe
  C:\Windows\System\fcfHJBl.exe
  2⤵
  PID:6988
- C:\Windows\System\PlDwFim.exe
  C:\Windows\System\PlDwFim.exe
  2⤵
  PID:7016
- C:\Windows\System\ldpwUfO.exe
  C:\Windows\System\ldpwUfO.exe
  2⤵
  PID:7044
- C:\Windows\System\ipelJKt.exe
  C:\Windows\System\ipelJKt.exe
  2⤵
  PID:7064
- C:\Windows\System\npVKAIL.exe
  C:\Windows\System\npVKAIL.exe
  2⤵
  PID:7092
- C:\Windows\System\bQbjJtW.exe
  C:\Windows\System\bQbjJtW.exe
  2⤵
  PID:7120
- C:\Windows\System\uraPvUl.exe
  C:\Windows\System\uraPvUl.exe
  2⤵
  PID:7148
- C:\Windows\System\UQsbEsm.exe
  C:\Windows\System\UQsbEsm.exe
  2⤵
  PID:5432
- C:\Windows\System\LdkTRSl.exe
  C:\Windows\System\LdkTRSl.exe
  2⤵
  PID:5708
- C:\Windows\System\lMgsHtb.exe
  C:\Windows\System\lMgsHtb.exe
  2⤵
  PID:6208
- C:\Windows\System\cDFjOYj.exe
  C:\Windows\System\cDFjOYj.exe
  2⤵
  PID:6284
- C:\Windows\System\TXdYyOF.exe
  C:\Windows\System\TXdYyOF.exe
  2⤵
  PID:6384
- C:\Windows\System\zaBaDEy.exe
  C:\Windows\System\zaBaDEy.exe
  2⤵
  PID:6404
- C:\Windows\System\tikKqTm.exe
  C:\Windows\System\tikKqTm.exe
  2⤵
  PID:6580
- C:\Windows\System\Sjxzlqj.exe
  C:\Windows\System\Sjxzlqj.exe
  2⤵
  PID:6616
- C:\Windows\System\bFuXlro.exe
  C:\Windows\System\bFuXlro.exe
  2⤵
  PID:6676
- C:\Windows\System\fTjacss.exe
  C:\Windows\System\fTjacss.exe
  2⤵
  PID:6784
- C:\Windows\System\AkTaSAj.exe
  C:\Windows\System\AkTaSAj.exe
  2⤵
  PID:6840
- C:\Windows\System\koBxNba.exe
  C:\Windows\System\koBxNba.exe
  2⤵
  PID:6948
- C:\Windows\System\TEPQRSe.exe
  C:\Windows\System\TEPQRSe.exe
  2⤵
  PID:6968
- C:\Windows\System\oDYqEkL.exe
  C:\Windows\System\oDYqEkL.exe
  2⤵
  PID:7032
- C:\Windows\System\ckbPEcq.exe
  C:\Windows\System\ckbPEcq.exe
  2⤵
  PID:7144
- C:\Windows\System\JcgKIiR.exe
  C:\Windows\System\JcgKIiR.exe
  2⤵
  PID:6152
- C:\Windows\System\lIXEjLM.exe
  C:\Windows\System\lIXEjLM.exe
  2⤵
  PID:6340
- C:\Windows\System\kehaJBi.exe
  C:\Windows\System\kehaJBi.exe
  2⤵
  PID:6540
- C:\Windows\System\TrGXENi.exe
  C:\Windows\System\TrGXENi.exe
  2⤵
  PID:6588
- C:\Windows\System\kkvhRhm.exe
  C:\Windows\System\kkvhRhm.exe
  2⤵
  PID:6808
- C:\Windows\System\QlVfoKU.exe
  C:\Windows\System\QlVfoKU.exe
  2⤵
  PID:6980
- C:\Windows\System\YgKuYYZ.exe
  C:\Windows\System\YgKuYYZ.exe
  2⤵
  PID:6896
- C:\Windows\System\PsryUBk.exe
  C:\Windows\System\PsryUBk.exe
  2⤵
  PID:6348
- C:\Windows\System\vUFKMaY.exe
  C:\Windows\System\vUFKMaY.exe
  2⤵
  PID:6564
- C:\Windows\System\bHcszNA.exe
  C:\Windows\System\bHcszNA.exe
  2⤵
  PID:6720
- C:\Windows\System\edXtYvI.exe
  C:\Windows\System\edXtYvI.exe
  2⤵
  PID:1900
- C:\Windows\System\ECBpepB.exe
  C:\Windows\System\ECBpepB.exe
  2⤵
  PID:6640
- C:\Windows\System\MgptlON.exe
  C:\Windows\System\MgptlON.exe
  2⤵
  PID:7184
- C:\Windows\System\udyRWYJ.exe
  C:\Windows\System\udyRWYJ.exe
  2⤵
  PID:7220
- C:\Windows\System\PrscyHZ.exe
  C:\Windows\System\PrscyHZ.exe
  2⤵
  PID:7244
- C:\Windows\System\ZEpkCig.exe
  C:\Windows\System\ZEpkCig.exe
  2⤵
  PID:7268
- C:\Windows\System\jZOMrqa.exe
  C:\Windows\System\jZOMrqa.exe
  2⤵
  PID:7292
- C:\Windows\System\PuQfLVd.exe
  C:\Windows\System\PuQfLVd.exe
  2⤵
  PID:7312
- C:\Windows\System\WqeulmE.exe
  C:\Windows\System\WqeulmE.exe
  2⤵
  PID:7352
- C:\Windows\System\SjbPQxi.exe
  C:\Windows\System\SjbPQxi.exe
  2⤵
  PID:7400
- C:\Windows\System\SzeaFFi.exe
  C:\Windows\System\SzeaFFi.exe
  2⤵
  PID:7428
- C:\Windows\System\bVdRYAv.exe
  C:\Windows\System\bVdRYAv.exe
  2⤵
  PID:7452
- C:\Windows\System\QsMNeKY.exe
  C:\Windows\System\QsMNeKY.exe
  2⤵
  PID:7488
- C:\Windows\System\AKSjAxl.exe
  C:\Windows\System\AKSjAxl.exe
  2⤵
  PID:7520
- C:\Windows\System\DMCffSL.exe
  C:\Windows\System\DMCffSL.exe
  2⤵
  PID:7548
- C:\Windows\System\WNiHvLj.exe
  C:\Windows\System\WNiHvLj.exe
  2⤵
  PID:7576
- C:\Windows\System\drjtISE.exe
  C:\Windows\System\drjtISE.exe
  2⤵
  PID:7604
- C:\Windows\System\hsgZVTB.exe
  C:\Windows\System\hsgZVTB.exe
  2⤵
  PID:7632
- C:\Windows\System\SblFHwQ.exe
  C:\Windows\System\SblFHwQ.exe
  2⤵
  PID:7672
- C:\Windows\System\RHCSWFU.exe
  C:\Windows\System\RHCSWFU.exe
  2⤵
  PID:7688
- C:\Windows\System\EsVesTb.exe
  C:\Windows\System\EsVesTb.exe
  2⤵
  PID:7728
- C:\Windows\System\ffFeAit.exe
  C:\Windows\System\ffFeAit.exe
  2⤵
  PID:7764
- C:\Windows\System\aQTTmwc.exe
  C:\Windows\System\aQTTmwc.exe
  2⤵
  PID:7788
- C:\Windows\System\NYyNcyu.exe
  C:\Windows\System\NYyNcyu.exe
  2⤵
  PID:7808
- C:\Windows\System\HGPavRq.exe
  C:\Windows\System\HGPavRq.exe
  2⤵
  PID:7848
- C:\Windows\System\hcFjooi.exe
  C:\Windows\System\hcFjooi.exe
  2⤵
  PID:7864
- C:\Windows\System\drsxtul.exe
  C:\Windows\System\drsxtul.exe
  2⤵
  PID:7888
- C:\Windows\System\GEjCuOM.exe
  C:\Windows\System\GEjCuOM.exe
  2⤵
  PID:7924
- C:\Windows\System\zmiVvGc.exe
  C:\Windows\System\zmiVvGc.exe
  2⤵
  PID:7948
- C:\Windows\System\EokkAFH.exe
  C:\Windows\System\EokkAFH.exe
  2⤵
  PID:7976
- C:\Windows\System\SRnxkbq.exe
  C:\Windows\System\SRnxkbq.exe
  2⤵
  PID:8008
- C:\Windows\System\xEsRBjA.exe
  C:\Windows\System\xEsRBjA.exe
  2⤵
  PID:8032
- C:\Windows\System\KiyEspP.exe
  C:\Windows\System\KiyEspP.exe
  2⤵
  PID:8060
- C:\Windows\System\mqGllib.exe
  C:\Windows\System\mqGllib.exe
  2⤵
  PID:8076
- C:\Windows\System\VUlByVh.exe
  C:\Windows\System\VUlByVh.exe
  2⤵
  PID:8092
- C:\Windows\System\NiijdCx.exe
  C:\Windows\System\NiijdCx.exe
  2⤵
  PID:8120
- C:\Windows\System\UxmaPPq.exe
  C:\Windows\System\UxmaPPq.exe
  2⤵
  PID:8156
- C:\Windows\System\JEtvmKt.exe
  C:\Windows\System\JEtvmKt.exe
  2⤵
  PID:8176
- C:\Windows\System\xhNVEpZ.exe
  C:\Windows\System\xhNVEpZ.exe
  2⤵
  PID:6952
- C:\Windows\System\LbFdnFC.exe
  C:\Windows\System\LbFdnFC.exe
  2⤵
  PID:7204
- C:\Windows\System\EYVFREN.exe
  C:\Windows\System\EYVFREN.exe
  2⤵
  PID:7284
- C:\Windows\System\hXyJXYb.exe
  C:\Windows\System\hXyJXYb.exe
  2⤵
  PID:7412
- C:\Windows\System\oNrLDPp.exe
  C:\Windows\System\oNrLDPp.exe
  2⤵
  PID:2568
- C:\Windows\System\dcQjIMw.exe
  C:\Windows\System\dcQjIMw.exe
  2⤵
  PID:7512
- C:\Windows\System\SxdDqoI.exe
  C:\Windows\System\SxdDqoI.exe
  2⤵
  PID:7620
- C:\Windows\System\cvWtOTV.exe
  C:\Windows\System\cvWtOTV.exe
  2⤵
  PID:7668
- C:\Windows\System\eGivdgp.exe
  C:\Windows\System\eGivdgp.exe
  2⤵
  PID:7756
- C:\Windows\System\UmeocLf.exe
  C:\Windows\System\UmeocLf.exe
  2⤵
  PID:7800
- C:\Windows\System\HpYTfVE.exe
  C:\Windows\System\HpYTfVE.exe
  2⤵
  PID:7916
- C:\Windows\System\NxrbBDV.exe
  C:\Windows\System\NxrbBDV.exe
  2⤵
  PID:3304
- C:\Windows\System\AetBCfx.exe
  C:\Windows\System\AetBCfx.exe
  2⤵
  PID:8024
- C:\Windows\System\DBaTLCN.exe
  C:\Windows\System\DBaTLCN.exe
  2⤵
  PID:8052
- C:\Windows\System\mNTPsAY.exe
  C:\Windows\System\mNTPsAY.exe
  2⤵
  PID:8140
- C:\Windows\System\UllRMFl.exe
  C:\Windows\System\UllRMFl.exe
  2⤵
  PID:6872
- C:\Windows\System\CyXsNNl.exe
  C:\Windows\System\CyXsNNl.exe
  2⤵
  PID:7388
- C:\Windows\System\wAdDNwh.exe
  C:\Windows\System\wAdDNwh.exe
  2⤵
  PID:7348
- C:\Windows\System\NctTEcy.exe
  C:\Windows\System\NctTEcy.exe
  2⤵
  PID:7648
- C:\Windows\System\jzKxBME.exe
  C:\Windows\System\jzKxBME.exe
  2⤵
  PID:7708
- C:\Windows\System\wOvZmJm.exe
  C:\Windows\System\wOvZmJm.exe
  2⤵
  PID:7936
- C:\Windows\System\zhtVPfJ.exe
  C:\Windows\System\zhtVPfJ.exe
  2⤵
  PID:8048
- C:\Windows\System\uFapafk.exe
  C:\Windows\System\uFapafk.exe
  2⤵
  PID:7180
- C:\Windows\System\YYuywKH.exe
  C:\Windows\System\YYuywKH.exe
  2⤵
  PID:7628
- C:\Windows\System\HwPboQv.exe
  C:\Windows\System\HwPboQv.exe
  2⤵
  PID:8004
- C:\Windows\System\bwbltvb.exe
  C:\Windows\System\bwbltvb.exe
  2⤵
  PID:7164
- C:\Windows\System\zQIvyJY.exe
  C:\Windows\System\zQIvyJY.exe
  2⤵
  PID:8196
- C:\Windows\System\dxDofxB.exe
  C:\Windows\System\dxDofxB.exe
  2⤵
  PID:8224
- C:\Windows\System\cmwuYwg.exe
  C:\Windows\System\cmwuYwg.exe
  2⤵
  PID:8260
- C:\Windows\System\hVqHbtt.exe
  C:\Windows\System\hVqHbtt.exe
  2⤵
  PID:8288
- C:\Windows\System\DBPmVFT.exe
  C:\Windows\System\DBPmVFT.exe
  2⤵
  PID:8316
- C:\Windows\System\NloyTtp.exe
  C:\Windows\System\NloyTtp.exe
  2⤵
  PID:8332
- C:\Windows\System\pZTMctk.exe
  C:\Windows\System\pZTMctk.exe
  2⤵
  PID:8348
- C:\Windows\System\cipBYzy.exe
  C:\Windows\System\cipBYzy.exe
  2⤵
  PID:8376
- C:\Windows\System\bRRUpUj.exe
  C:\Windows\System\bRRUpUj.exe
  2⤵
  PID:8408
- C:\Windows\System\UaRAGKn.exe
  C:\Windows\System\UaRAGKn.exe
  2⤵
  PID:8444
- C:\Windows\System\pilXEyi.exe
  C:\Windows\System\pilXEyi.exe
  2⤵
  PID:8476
- C:\Windows\System\ELxdtos.exe
  C:\Windows\System\ELxdtos.exe
  2⤵
  PID:8516
- C:\Windows\System\MMcPHba.exe
  C:\Windows\System\MMcPHba.exe
  2⤵
  PID:8532
- C:\Windows\System\GOHsmpA.exe
  C:\Windows\System\GOHsmpA.exe
  2⤵
  PID:8560
- C:\Windows\System\gbeAyJe.exe
  C:\Windows\System\gbeAyJe.exe
  2⤵
  PID:8592
- C:\Windows\System\CUvmWeI.exe
  C:\Windows\System\CUvmWeI.exe
  2⤵
  PID:8612
- C:\Windows\System\XRNTXiq.exe
  C:\Windows\System\XRNTXiq.exe
  2⤵
  PID:8656
- C:\Windows\System\lfKtZdt.exe
  C:\Windows\System\lfKtZdt.exe
  2⤵
  PID:8684
- C:\Windows\System\KILxarM.exe
  C:\Windows\System\KILxarM.exe
  2⤵
  PID:8704
- C:\Windows\System\lDgAZpk.exe
  C:\Windows\System\lDgAZpk.exe
  2⤵
  PID:8732
- C:\Windows\System\doeWwKT.exe
  C:\Windows\System\doeWwKT.exe
  2⤵
  PID:8768
- C:\Windows\System\JeAaLFZ.exe
  C:\Windows\System\JeAaLFZ.exe
  2⤵
  PID:8796
- C:\Windows\System\nEMfPeL.exe
  C:\Windows\System\nEMfPeL.exe
  2⤵
  PID:8816
- C:\Windows\System\hocQFEI.exe
  C:\Windows\System\hocQFEI.exe
  2⤵
  PID:8840
- C:\Windows\System\cfjivAy.exe
  C:\Windows\System\cfjivAy.exe
  2⤵
  PID:8860
- C:\Windows\System\OQsOLsc.exe
  C:\Windows\System\OQsOLsc.exe
  2⤵
  PID:8896
- C:\Windows\System\UywiJUW.exe
  C:\Windows\System\UywiJUW.exe
  2⤵
  PID:8916
- C:\Windows\System\HCcnsgL.exe
  C:\Windows\System\HCcnsgL.exe
  2⤵
  PID:8944
- C:\Windows\System\vbykEPg.exe
  C:\Windows\System\vbykEPg.exe
  2⤵
  PID:8972
- C:\Windows\System\BfZNpeK.exe
  C:\Windows\System\BfZNpeK.exe
  2⤵
  PID:8996
- C:\Windows\System\LNBLuiu.exe
  C:\Windows\System\LNBLuiu.exe
  2⤵
  PID:9016
- C:\Windows\System\gPOZDxG.exe
  C:\Windows\System\gPOZDxG.exe
  2⤵
  PID:9044
- C:\Windows\System\qiXAhNJ.exe
  C:\Windows\System\qiXAhNJ.exe
  2⤵
  PID:9080
- C:\Windows\System\nrejmZW.exe
  C:\Windows\System\nrejmZW.exe
  2⤵
  PID:9108
- C:\Windows\System\eqmpmEX.exe
  C:\Windows\System\eqmpmEX.exe
  2⤵
  PID:9160
- C:\Windows\System\QhhwUrZ.exe
  C:\Windows\System\QhhwUrZ.exe
  2⤵
  PID:9176
- C:\Windows\System\QRvCWFn.exe
  C:\Windows\System\QRvCWFn.exe
  2⤵
  PID:9200
- C:\Windows\System\zeWLhHf.exe
  C:\Windows\System\zeWLhHf.exe
  2⤵
  PID:7304
- C:\Windows\System\jLMDenb.exe
  C:\Windows\System\jLMDenb.exe
  2⤵
  PID:8276
- C:\Windows\System\tySnKwL.exe
  C:\Windows\System\tySnKwL.exe
  2⤵
  PID:8368
- C:\Windows\System\fNPfmmo.exe
  C:\Windows\System\fNPfmmo.exe
  2⤵
  PID:8400
- C:\Windows\System\hNZHwKU.exe
  C:\Windows\System\hNZHwKU.exe
  2⤵
  PID:8432
- C:\Windows\System\FODvuKr.exe
  C:\Windows\System\FODvuKr.exe
  2⤵
  PID:8528
- C:\Windows\System\ofZZYDD.exe
  C:\Windows\System\ofZZYDD.exe
  2⤵
  PID:8604
- C:\Windows\System\XlkphyH.exe
  C:\Windows\System\XlkphyH.exe
  2⤵
  PID:8676
- C:\Windows\System\PXiixfn.exe
  C:\Windows\System\PXiixfn.exe
  2⤵
  PID:8728
- C:\Windows\System\BNXdChE.exe
  C:\Windows\System\BNXdChE.exe
  2⤵
  PID:8792
- C:\Windows\System\EbeaAZL.exe
  C:\Windows\System\EbeaAZL.exe
  2⤵
  PID:8876
- C:\Windows\System\HkavlLw.exe
  C:\Windows\System\HkavlLw.exe
  2⤵
  PID:8968
- C:\Windows\System\NSWVtgw.exe
  C:\Windows\System\NSWVtgw.exe
  2⤵
  PID:9012
- C:\Windows\System\seLUPad.exe
  C:\Windows\System\seLUPad.exe
  2⤵
  PID:9032
- C:\Windows\System\fdDpneM.exe
  C:\Windows\System\fdDpneM.exe
  2⤵
  PID:9056
- C:\Windows\System\XXGeIDH.exe
  C:\Windows\System\XXGeIDH.exe
  2⤵
  PID:9172
- C:\Windows\System\cZkuuaD.exe
  C:\Windows\System\cZkuuaD.exe
  2⤵
  PID:8300
- C:\Windows\System\LYOPFXz.exe
  C:\Windows\System\LYOPFXz.exe
  2⤵
  PID:8388
- C:\Windows\System\eBjyhKc.exe
  C:\Windows\System\eBjyhKc.exe
  2⤵
  PID:8552
- C:\Windows\System\WkAvpzm.exe
  C:\Windows\System\WkAvpzm.exe
  2⤵
  PID:8788
- C:\Windows\System\SjpAKpr.exe
  C:\Windows\System\SjpAKpr.exe
  2⤵
  PID:8908
- C:\Windows\System\tSQwZCK.exe
  C:\Windows\System\tSQwZCK.exe
  2⤵
  PID:8988
- C:\Windows\System\OYoPUPB.exe
  C:\Windows\System\OYoPUPB.exe
  2⤵
  PID:9152
- C:\Windows\System\jpeIuJQ.exe
  C:\Windows\System\jpeIuJQ.exe
  2⤵
  PID:8496
- C:\Windows\System\DaGKOPf.exe
  C:\Windows\System\DaGKOPf.exe
  2⤵
  PID:8960
- C:\Windows\System\hwpOlUs.exe
  C:\Windows\System\hwpOlUs.exe
  2⤵
  PID:8524
- C:\Windows\System\qprwTUc.exe
  C:\Windows\System\qprwTUc.exe
  2⤵
  PID:8780
- C:\Windows\System\FpahGnw.exe
  C:\Windows\System\FpahGnw.exe
  2⤵
  PID:9240
- C:\Windows\System\isgsXOK.exe
  C:\Windows\System\isgsXOK.exe
  2⤵
  PID:9268
- C:\Windows\System\tLYiirS.exe
  C:\Windows\System\tLYiirS.exe
  2⤵
  PID:9296
- C:\Windows\System\pmvzLaR.exe
  C:\Windows\System\pmvzLaR.exe
  2⤵
  PID:9312
- C:\Windows\System\ifqutSi.exe
  C:\Windows\System\ifqutSi.exe
  2⤵
  PID:9344
- C:\Windows\System\estYqgV.exe
  C:\Windows\System\estYqgV.exe
  2⤵
  PID:9368
- C:\Windows\System\adsdyjx.exe
  C:\Windows\System\adsdyjx.exe
  2⤵
  PID:9408
- C:\Windows\System\fdVEtHI.exe
  C:\Windows\System\fdVEtHI.exe
  2⤵
  PID:9436
- C:\Windows\System\GFKZsWO.exe
  C:\Windows\System\GFKZsWO.exe
  2⤵
  PID:9468
- C:\Windows\System\MhIuuwa.exe
  C:\Windows\System\MhIuuwa.exe
  2⤵
  PID:9496
- C:\Windows\System\EQqxLet.exe
  C:\Windows\System\EQqxLet.exe
  2⤵
  PID:9524
- C:\Windows\System\KorhRNY.exe
  C:\Windows\System\KorhRNY.exe
  2⤵
  PID:9544
- C:\Windows\System\zLfVwyC.exe
  C:\Windows\System\zLfVwyC.exe
  2⤵
  PID:9572
- C:\Windows\System\dNhdyFC.exe
  C:\Windows\System\dNhdyFC.exe
  2⤵
  PID:9596
- C:\Windows\System\UWTWxza.exe
  C:\Windows\System\UWTWxza.exe
  2⤵
  PID:9628
- C:\Windows\System\RDVvaHY.exe
  C:\Windows\System\RDVvaHY.exe
  2⤵
  PID:9652
- C:\Windows\System\tCcFcGH.exe
  C:\Windows\System\tCcFcGH.exe
  2⤵
  PID:9680
- C:\Windows\System\YKzmxRj.exe
  C:\Windows\System\YKzmxRj.exe
  2⤵
  PID:9704
- C:\Windows\System\CvvDUPv.exe
  C:\Windows\System\CvvDUPv.exe
  2⤵
  PID:9728
- C:\Windows\System\aOTGCRi.exe
  C:\Windows\System\aOTGCRi.exe
  2⤵
  PID:9764
- C:\Windows\System\sMToFbV.exe
  C:\Windows\System\sMToFbV.exe
  2⤵
  PID:9796
- C:\Windows\System\LyhJJQe.exe
  C:\Windows\System\LyhJJQe.exe
  2⤵
  PID:9820
- C:\Windows\System\bBZNUXU.exe
  C:\Windows\System\bBZNUXU.exe
  2⤵
  PID:9836
- C:\Windows\System\IVdVXrM.exe
  C:\Windows\System\IVdVXrM.exe
  2⤵
  PID:9852
- C:\Windows\System\OeMGinC.exe
  C:\Windows\System\OeMGinC.exe
  2⤵
  PID:9876
- C:\Windows\System\GkTNyKY.exe
  C:\Windows\System\GkTNyKY.exe
  2⤵
  PID:9916
- C:\Windows\System\cPPTEPw.exe
  C:\Windows\System\cPPTEPw.exe
  2⤵
  PID:9968
- C:\Windows\System\oFTisPl.exe
  C:\Windows\System\oFTisPl.exe
  2⤵
  PID:9992
- C:\Windows\System\FXKwWNh.exe
  C:\Windows\System\FXKwWNh.exe
  2⤵
  PID:10024
- C:\Windows\System\cZUwRzR.exe
  C:\Windows\System\cZUwRzR.exe
  2⤵
  PID:10044
- C:\Windows\System\zlWnCjk.exe
  C:\Windows\System\zlWnCjk.exe
  2⤵
  PID:10072
- C:\Windows\System\hyDKaly.exe
  C:\Windows\System\hyDKaly.exe
  2⤵
  PID:10100
- C:\Windows\System\CEWzFtO.exe
  C:\Windows\System\CEWzFtO.exe
  2⤵
  PID:10132
- C:\Windows\System\vQlmXRe.exe
  C:\Windows\System\vQlmXRe.exe
  2⤵
  PID:10156
- C:\Windows\System\LVVdZGt.exe
  C:\Windows\System\LVVdZGt.exe
  2⤵
  PID:10184
- C:\Windows\System\oKlAtgF.exe
  C:\Windows\System\oKlAtgF.exe
  2⤵
  PID:10212
- C:\Windows\System\WBssiVR.exe
  C:\Windows\System\WBssiVR.exe
  2⤵
  PID:10232
- C:\Windows\System\OSYVEVi.exe
  C:\Windows\System\OSYVEVi.exe
  2⤵
  PID:9232
- C:\Windows\System\AaqfMYG.exe
  C:\Windows\System\AaqfMYG.exe
  2⤵
  PID:9292
- C:\Windows\System\NSarimG.exe
  C:\Windows\System\NSarimG.exe
  2⤵
  PID:9356
- C:\Windows\System\VIzjvEy.exe
  C:\Windows\System\VIzjvEy.exe
  2⤵
  PID:9420
- C:\Windows\System\nAiOOGE.exe
  C:\Windows\System\nAiOOGE.exe
  2⤵
  PID:9484
- C:\Windows\System\nEFxzQs.exe
  C:\Windows\System\nEFxzQs.exe
  2⤵
  PID:9584
- C:\Windows\System\cZrmoWF.exe
  C:\Windows\System\cZrmoWF.exe
  2⤵
  PID:9644
- C:\Windows\System\XMjEVqD.exe
  C:\Windows\System\XMjEVqD.exe
  2⤵
  PID:9720
- C:\Windows\System\iAUeKnB.exe
  C:\Windows\System\iAUeKnB.exe
  2⤵
  PID:9736
- C:\Windows\System\iAHTcUF.exe
  C:\Windows\System\iAHTcUF.exe
  2⤵
  PID:9832
- C:\Windows\System\WYBqglJ.exe
  C:\Windows\System\WYBqglJ.exe
  2⤵
  PID:9908
- C:\Windows\System\DOzaOVP.exe
  C:\Windows\System\DOzaOVP.exe
  2⤵
  PID:9988
- C:\Windows\System\ffJMZbZ.exe
  C:\Windows\System\ffJMZbZ.exe
  2⤵
  PID:10056
- C:\Windows\System\QEOHpuo.exe
  C:\Windows\System\QEOHpuo.exe
  2⤵
  PID:10124
- C:\Windows\System\MKZSuKr.exe
  C:\Windows\System\MKZSuKr.exe
  2⤵
  PID:10196
- C:\Windows\System\qexLGDA.exe
  C:\Windows\System\qexLGDA.exe
  2⤵
  PID:9264
- C:\Windows\System\pWuDTLp.exe
  C:\Windows\System\pWuDTLp.exe
  2⤵
  PID:9324
- C:\Windows\System\GmBvrKv.exe
  C:\Windows\System\GmBvrKv.exe
  2⤵
  PID:9480
- C:\Windows\System\uFcjJLQ.exe
  C:\Windows\System\uFcjJLQ.exe
  2⤵
  PID:9612
- C:\Windows\System\MBsuhfy.exe
  C:\Windows\System\MBsuhfy.exe
  2⤵
  PID:9804
- C:\Windows\System\DDAlYcg.exe
  C:\Windows\System\DDAlYcg.exe
  2⤵
  PID:10032
- C:\Windows\System\nwHzwLV.exe
  C:\Windows\System\nwHzwLV.exe
  2⤵
  PID:10116
- C:\Windows\System\eJcAosq.exe
  C:\Windows\System\eJcAosq.exe
  2⤵
  PID:9400
- C:\Windows\System\XKmdddO.exe
  C:\Windows\System\XKmdddO.exe
  2⤵
  PID:9676
- C:\Windows\System\JbQGjQK.exe
  C:\Windows\System\JbQGjQK.exe
  2⤵
  PID:10200
- C:\Windows\System\GcemPTK.exe
  C:\Windows\System\GcemPTK.exe
  2⤵
  PID:8216
- C:\Windows\System\DiyAHLq.exe
  C:\Windows\System\DiyAHLq.exe
  2⤵
  PID:9308
- C:\Windows\System\QMRiJlL.exe
  C:\Windows\System\QMRiJlL.exe
  2⤵
  PID:10260
- C:\Windows\System\FXhaxeF.exe
  C:\Windows\System\FXhaxeF.exe
  2⤵
  PID:10288
- C:\Windows\System\nxphGdg.exe
  C:\Windows\System\nxphGdg.exe
  2⤵
  PID:10308
- C:\Windows\System\dGCPqjZ.exe
  C:\Windows\System\dGCPqjZ.exe
  2⤵
  PID:10340
- C:\Windows\System\UioqlVb.exe
  C:\Windows\System\UioqlVb.exe
  2⤵
  PID:10372
- C:\Windows\System\TlcUDkd.exe
  C:\Windows\System\TlcUDkd.exe
  2⤵
  PID:10404
- C:\Windows\System\SVwEgvP.exe
  C:\Windows\System\SVwEgvP.exe
  2⤵
  PID:10444
- C:\Windows\System\wABknBA.exe
  C:\Windows\System\wABknBA.exe
  2⤵
  PID:10472
- C:\Windows\System\dzIZqgU.exe
  C:\Windows\System\dzIZqgU.exe
  2⤵
  PID:10500
- C:\Windows\System\nwBGKlG.exe
  C:\Windows\System\nwBGKlG.exe
  2⤵
  PID:10528
- C:\Windows\System\kIgpsXQ.exe
  C:\Windows\System\kIgpsXQ.exe
  2⤵
  PID:10560
- C:\Windows\System\IqmHkWw.exe
  C:\Windows\System\IqmHkWw.exe
  2⤵
  PID:10576
- C:\Windows\System\crJpCjX.exe
  C:\Windows\System\crJpCjX.exe
  2⤵
  PID:10608
- C:\Windows\System\tqxNJdM.exe
  C:\Windows\System\tqxNJdM.exe
  2⤵
  PID:10632
- C:\Windows\System\fdPVlnU.exe
  C:\Windows\System\fdPVlnU.exe
  2⤵
  PID:10672
- C:\Windows\System\nCVhKjY.exe
  C:\Windows\System\nCVhKjY.exe
  2⤵
  PID:10700
- C:\Windows\System\MpBhLyc.exe
  C:\Windows\System\MpBhLyc.exe
  2⤵
  PID:10728
- C:\Windows\System\CFUImwT.exe
  C:\Windows\System\CFUImwT.exe
  2⤵
  PID:10756
- C:\Windows\System\GVVxjiO.exe
  C:\Windows\System\GVVxjiO.exe
  2⤵
  PID:10772
- C:\Windows\System\DWVPqtN.exe
  C:\Windows\System\DWVPqtN.exe
  2⤵
  PID:10812
- C:\Windows\System\XZLXWyM.exe
  C:\Windows\System\XZLXWyM.exe
  2⤵
  PID:10840
- C:\Windows\System\eVHLBkO.exe
  C:\Windows\System\eVHLBkO.exe
  2⤵
  PID:10864
- C:\Windows\System\tdBHiZK.exe
  C:\Windows\System\tdBHiZK.exe
  2⤵
  PID:10880
- C:\Windows\System\OxCWNtJ.exe
  C:\Windows\System\OxCWNtJ.exe
  2⤵
  PID:10896
- C:\Windows\System\kHvELrR.exe
  C:\Windows\System\kHvELrR.exe
  2⤵
  PID:10932
- C:\Windows\System\BkGyyCe.exe
  C:\Windows\System\BkGyyCe.exe
  2⤵
  PID:10960
- C:\Windows\System\suaTBet.exe
  C:\Windows\System\suaTBet.exe
  2⤵
  PID:11000
- C:\Windows\System\TLEYIGH.exe
  C:\Windows\System\TLEYIGH.exe
  2⤵
  PID:11020
- C:\Windows\System\ucaVsSw.exe
  C:\Windows\System\ucaVsSw.exe
  2⤵
  PID:11048
- C:\Windows\System\XkBPXQk.exe
  C:\Windows\System\XkBPXQk.exe
  2⤵
  PID:11080
- C:\Windows\System\uVnvijP.exe
  C:\Windows\System\uVnvijP.exe
  2⤵
  PID:11104
- C:\Windows\System\aRvgiiD.exe
  C:\Windows\System\aRvgiiD.exe
  2⤵
  PID:11136
- C:\Windows\System\DJvSnxj.exe
  C:\Windows\System\DJvSnxj.exe
  2⤵
  PID:11156
- C:\Windows\System\JGcuRco.exe
  C:\Windows\System\JGcuRco.exe
  2⤵
  PID:11184
- C:\Windows\System\lHpzHND.exe
  C:\Windows\System\lHpzHND.exe
  2⤵
  PID:11220
- C:\Windows\System\claAhFY.exe
  C:\Windows\System\claAhFY.exe
  2⤵
  PID:11260
- C:\Windows\System\HCMLrPx.exe
  C:\Windows\System\HCMLrPx.exe
  2⤵
  PID:9892
- C:\Windows\System\dRHXluA.exe
  C:\Windows\System\dRHXluA.exe
  2⤵
  PID:10324
- C:\Windows\System\DgFIrPr.exe
  C:\Windows\System\DgFIrPr.exe
  2⤵
  PID:10384
- C:\Windows\System\wtSXeNf.exe
  C:\Windows\System\wtSXeNf.exe
  2⤵
  PID:10464
- C:\Windows\System\RycHinA.exe
  C:\Windows\System\RycHinA.exe
  2⤵
  PID:10540
- C:\Windows\System\rnQigLF.exe
  C:\Windows\System\rnQigLF.exe
  2⤵
  PID:10600
- C:\Windows\System\xJATXnV.exe
  C:\Windows\System\xJATXnV.exe
  2⤵
  PID:10668
- C:\Windows\System\EQniBgP.exe
  C:\Windows\System\EQniBgP.exe
  2⤵
  PID:10744
- C:\Windows\System\aoZJVxi.exe
  C:\Windows\System\aoZJVxi.exe
  2⤵
  PID:10788
- C:\Windows\System\vEvmyDD.exe
  C:\Windows\System\vEvmyDD.exe
  2⤵
  PID:10860
- C:\Windows\System\zDnjSxM.exe
  C:\Windows\System\zDnjSxM.exe
  2⤵
  PID:10912
- C:\Windows\System\LFfGtAR.exe
  C:\Windows\System\LFfGtAR.exe
  2⤵
  PID:10984
- C:\Windows\System\USQwdYW.exe
  C:\Windows\System\USQwdYW.exe
  2⤵
  PID:11012
- C:\Windows\System\dZwFyUj.exe
  C:\Windows\System\dZwFyUj.exe
  2⤵
  PID:11116
- C:\Windows\System\hduwGhq.exe
  C:\Windows\System\hduwGhq.exe
  2⤵
  PID:11200
- C:\Windows\System\aZVrbeF.exe
  C:\Windows\System\aZVrbeF.exe
  2⤵
  PID:11244
- C:\Windows\System\bYfsvBC.exe
  C:\Windows\System\bYfsvBC.exe
  2⤵
  PID:10424
- C:\Windows\System\faNyzVr.exe
  C:\Windows\System\faNyzVr.exe
  2⤵
  PID:10460
- C:\Windows\System\glPklbc.exe
  C:\Windows\System\glPklbc.exe
  2⤵
  PID:10664
- C:\Windows\System\UtpBlaC.exe
  C:\Windows\System\UtpBlaC.exe
  2⤵
  PID:10764
- C:\Windows\System\CdmcImd.exe
  C:\Windows\System\CdmcImd.exe
  2⤵
  PID:10916
- C:\Windows\System\IbymyJK.exe
  C:\Windows\System\IbymyJK.exe
  2⤵
  PID:11072
- C:\Windows\System\qJYspAQ.exe
  C:\Windows\System\qJYspAQ.exe
  2⤵
  PID:10248
- C:\Windows\System\GwVsjhN.exe
  C:\Windows\System\GwVsjhN.exe
  2⤵
  PID:10652
- C:\Windows\System\FqhCCTK.exe
  C:\Windows\System\FqhCCTK.exe
  2⤵
  PID:10904
- C:\Windows\System\VBzkvGU.exe
  C:\Windows\System\VBzkvGU.exe
  2⤵
  PID:10392
- C:\Windows\System\qATTRnW.exe
  C:\Windows\System\qATTRnW.exe
  2⤵
  PID:10956
- C:\Windows\System\vjAUjgj.exe
  C:\Windows\System\vjAUjgj.exe
  2⤵
  PID:11284
- C:\Windows\System\bKqyTgy.exe
  C:\Windows\System\bKqyTgy.exe
  2⤵
  PID:11304
- C:\Windows\System\HTmJTUi.exe
  C:\Windows\System\HTmJTUi.exe
  2⤵
  PID:11348
- C:\Windows\System\BCUvVMa.exe
  C:\Windows\System\BCUvVMa.exe
  2⤵
  PID:11368
- C:\Windows\System\WgurjIQ.exe
  C:\Windows\System\WgurjIQ.exe
  2⤵
  PID:11396
- C:\Windows\System\cEqkyOC.exe
  C:\Windows\System\cEqkyOC.exe
  2⤵
  PID:11424
- C:\Windows\System\EVEDUnZ.exe
  C:\Windows\System\EVEDUnZ.exe
  2⤵
  PID:11448
- C:\Windows\System\Zisbshi.exe
  C:\Windows\System\Zisbshi.exe
  2⤵
  PID:11476
- C:\Windows\System\ZwRpeBJ.exe
  C:\Windows\System\ZwRpeBJ.exe
  2⤵
  PID:11516
- C:\Windows\System\ZQVYOPi.exe
  C:\Windows\System\ZQVYOPi.exe
  2⤵
  PID:11536
- C:\Windows\System\hrmHWIU.exe
  C:\Windows\System\hrmHWIU.exe
  2⤵
  PID:11560
- C:\Windows\System\hlsgnYb.exe
  C:\Windows\System\hlsgnYb.exe
  2⤵
  PID:11588
- C:\Windows\System\WvTFFWs.exe
  C:\Windows\System\WvTFFWs.exe
  2⤵
  PID:11616
- C:\Windows\System\UbzuBvv.exe
  C:\Windows\System\UbzuBvv.exe
  2⤵
  PID:11644
- C:\Windows\System\yQfgmOt.exe
  C:\Windows\System\yQfgmOt.exe
  2⤵
  PID:11668
- C:\Windows\System\dRHZmRQ.exe
  C:\Windows\System\dRHZmRQ.exe
  2⤵
  PID:11696
- C:\Windows\System\TJaADwT.exe
  C:\Windows\System\TJaADwT.exe
  2⤵
  PID:11740
- C:\Windows\System\YOQRqeJ.exe
  C:\Windows\System\YOQRqeJ.exe
  2⤵
  PID:11756
- C:\Windows\System\XNUvDAE.exe
  C:\Windows\System\XNUvDAE.exe
  2⤵
  PID:11776
- C:\Windows\System\kUFWuGs.exe
  C:\Windows\System\kUFWuGs.exe
  2⤵
  PID:11812
- C:\Windows\System\FUrjpRz.exe
  C:\Windows\System\FUrjpRz.exe
  2⤵
  PID:11840
- C:\Windows\System\wZLiYwV.exe
  C:\Windows\System\wZLiYwV.exe
  2⤵
  PID:11872
- C:\Windows\System\KqTsofC.exe
  C:\Windows\System\KqTsofC.exe
  2⤵
  PID:11896
- C:\Windows\System\qeRPoxK.exe
  C:\Windows\System\qeRPoxK.exe
  2⤵
  PID:11928
- C:\Windows\System\JejRIhU.exe
  C:\Windows\System\JejRIhU.exe
  2⤵
  PID:11968
- C:\Windows\System\LuwWnOE.exe
  C:\Windows\System\LuwWnOE.exe
  2⤵
  PID:11988
- C:\Windows\System\fwEcfdV.exe
  C:\Windows\System\fwEcfdV.exe
  2⤵
  PID:12012
- C:\Windows\System\pQAiitd.exe
  C:\Windows\System\pQAiitd.exe
  2⤵
  PID:12036
- C:\Windows\System\BvSGOxp.exe
  C:\Windows\System\BvSGOxp.exe
  2⤵
  PID:12064
- C:\Windows\System\ilxQTZN.exe
  C:\Windows\System\ilxQTZN.exe
  2⤵
  PID:12084
- C:\Windows\System\zBjZsOC.exe
  C:\Windows\System\zBjZsOC.exe
  2⤵
  PID:12128
- C:\Windows\System\beodSMQ.exe
  C:\Windows\System\beodSMQ.exe
  2⤵
  PID:12156
- C:\Windows\System\xgooeWq.exe
  C:\Windows\System\xgooeWq.exe
  2⤵
  PID:12180
- C:\Windows\System\lXJPNZD.exe
  C:\Windows\System\lXJPNZD.exe
  2⤵
  PID:12204
- C:\Windows\System\CzGvYRw.exe
  C:\Windows\System\CzGvYRw.exe
  2⤵
  PID:12236
- C:\Windows\System\orXZHfs.exe
  C:\Windows\System\orXZHfs.exe
  2⤵
  PID:12264
- C:\Windows\System\duybPyn.exe
  C:\Windows\System\duybPyn.exe
  2⤵
  PID:12280
- C:\Windows\System\rOfrEPq.exe
  C:\Windows\System\rOfrEPq.exe
  2⤵
  PID:11292
- C:\Windows\System\xlMsQAN.exe
  C:\Windows\System\xlMsQAN.exe
  2⤵
  PID:11420
- C:\Windows\System\YXGaKsh.exe
  C:\Windows\System\YXGaKsh.exe
  2⤵
  PID:11456
- C:\Windows\System\atSxbiJ.exe
  C:\Windows\System\atSxbiJ.exe
  2⤵
  PID:11508
- C:\Windows\System\xlbZDRa.exe
  C:\Windows\System\xlbZDRa.exe
  2⤵
  PID:11580
- C:\Windows\System\mKtbHXI.exe
  C:\Windows\System\mKtbHXI.exe
  2⤵
  PID:11636
- C:\Windows\System\EsxASWe.exe
  C:\Windows\System\EsxASWe.exe
  2⤵
  PID:11724
- C:\Windows\System\huBJOHM.exe
  C:\Windows\System\huBJOHM.exe
  2⤵
  PID:11772
- C:\Windows\System\LQrqeJy.exe
  C:\Windows\System\LQrqeJy.exe
  2⤵
  PID:11828
- C:\Windows\System\fOrENoA.exe
  C:\Windows\System\fOrENoA.exe
  2⤵
  PID:11916
- C:\Windows\System\RGqUtgc.exe
  C:\Windows\System\RGqUtgc.exe
  2⤵
  PID:11948
- C:\Windows\System\XKKcyQC.exe
  C:\Windows\System\XKKcyQC.exe
  2⤵
  PID:12072
- C:\Windows\System\KYYNfSB.exe
  C:\Windows\System\KYYNfSB.exe
  2⤵
  PID:12136
- C:\Windows\System\YqeeAQL.exe
  C:\Windows\System\YqeeAQL.exe
  2⤵
  PID:12172
- C:\Windows\System\vLBYytA.exe
  C:\Windows\System\vLBYytA.exe
  2⤵
  PID:12260
- C:\Windows\System\ovLuPmK.exe
  C:\Windows\System\ovLuPmK.exe
  2⤵
  PID:11340
- C:\Windows\System\IncuWuS.exe
  C:\Windows\System\IncuWuS.exe
  2⤵
  PID:11380
- C:\Windows\System\FANVhTJ.exe
  C:\Windows\System\FANVhTJ.exe
  2⤵
  PID:11576
- C:\Windows\System\APcHjLq.exe
  C:\Windows\System\APcHjLq.exe
  2⤵
  PID:11656
- C:\Windows\System\tCBIaPG.exe
  C:\Windows\System\tCBIaPG.exe
  2⤵
  PID:11884
- C:\Windows\System\aHFadCY.exe
  C:\Windows\System\aHFadCY.exe
  2⤵
  PID:12100
- C:\Windows\System\KDUtBZm.exe
  C:\Windows\System\KDUtBZm.exe
  2⤵
  PID:12188
- C:\Windows\System\VrqlcBu.exe
  C:\Windows\System\VrqlcBu.exe
  2⤵
  PID:11472
- C:\Windows\System\IRUTYOx.exe
  C:\Windows\System\IRUTYOx.exe
  2⤵
  PID:11832
- C:\Windows\System\eHEdTzv.exe
  C:\Windows\System\eHEdTzv.exe
  2⤵
  PID:12104
- C:\Windows\System\hNAdpTr.exe
  C:\Windows\System\hNAdpTr.exe
  2⤵
  PID:11468
- C:\Windows\System\MFzVEyg.exe
  C:\Windows\System\MFzVEyg.exe
  2⤵
  PID:11904
- C:\Windows\System\ldKOfCs.exe
  C:\Windows\System\ldKOfCs.exe
  2⤵
  PID:12308
- C:\Windows\System\vdNtsKo.exe
  C:\Windows\System\vdNtsKo.exe
  2⤵
  PID:12336
- C:\Windows\System\PiuJOYJ.exe
  C:\Windows\System\PiuJOYJ.exe
  2⤵
  PID:12352
- C:\Windows\System\wRBVDTr.exe
  C:\Windows\System\wRBVDTr.exe
  2⤵
  PID:12372
- C:\Windows\System\fEMtjle.exe
  C:\Windows\System\fEMtjle.exe
  2⤵
  PID:12404
- C:\Windows\System\LrESwJy.exe
  C:\Windows\System\LrESwJy.exe
  2⤵
  PID:12436
- C:\Windows\System\PGmejXA.exe
  C:\Windows\System\PGmejXA.exe
  2⤵
  PID:12452
- C:\Windows\System\NCcsrRj.exe
  C:\Windows\System\NCcsrRj.exe
  2⤵
  PID:12496
- C:\Windows\System\EYtnRwM.exe
  C:\Windows\System\EYtnRwM.exe
  2⤵
  PID:12532
- C:\Windows\System\tWqeFCk.exe
  C:\Windows\System\tWqeFCk.exe
  2⤵
  PID:12556
- C:\Windows\System\CWPErRH.exe
  C:\Windows\System\CWPErRH.exe
  2⤵
  PID:12588
- C:\Windows\System\KdGDBth.exe
  C:\Windows\System\KdGDBth.exe
  2⤵
  PID:12616
- C:\Windows\System\uliuNLU.exe
  C:\Windows\System\uliuNLU.exe
  2⤵
  PID:12644
- C:\Windows\System\XzVUAov.exe
  C:\Windows\System\XzVUAov.exe
  2⤵
  PID:12660
- C:\Windows\System\zRXqeeH.exe
  C:\Windows\System\zRXqeeH.exe
  2⤵
  PID:12700
- C:\Windows\System\tEizzhZ.exe
  C:\Windows\System\tEizzhZ.exe
  2⤵
  PID:12728
- C:\Windows\System\aRKxBfn.exe
  C:\Windows\System\aRKxBfn.exe
  2⤵
  PID:12748
- C:\Windows\System\UJQozfx.exe
  C:\Windows\System\UJQozfx.exe
  2⤵
  PID:12776
- C:\Windows\System\eEInxbj.exe
  C:\Windows\System\eEInxbj.exe
  2⤵
  PID:12812
- C:\Windows\System\aVOeXWW.exe
  C:\Windows\System\aVOeXWW.exe
  2⤵
  PID:12828
- C:\Windows\System\chQiSqY.exe
  C:\Windows\System\chQiSqY.exe
  2⤵
  PID:12856
- C:\Windows\System\DaXzDrA.exe
  C:\Windows\System\DaXzDrA.exe
  2⤵
  PID:12876
- C:\Windows\System\rRElurZ.exe
  C:\Windows\System\rRElurZ.exe
  2⤵
  PID:12904
- C:\Windows\System\OGBYnoU.exe
  C:\Windows\System\OGBYnoU.exe
  2⤵
  PID:12932
- C:\Windows\System\wzjokjg.exe
  C:\Windows\System\wzjokjg.exe
  2⤵
  PID:12964
- C:\Windows\System\GnGvGCT.exe
  C:\Windows\System\GnGvGCT.exe
  2⤵
  PID:13008
- C:\Windows\System\foSPcpm.exe
  C:\Windows\System\foSPcpm.exe
  2⤵
  PID:13036
- C:\Windows\System\STvZUwW.exe
  C:\Windows\System\STvZUwW.exe
  2⤵
  PID:13052
- C:\Windows\System\xCifOMO.exe
  C:\Windows\System\xCifOMO.exe
  2⤵
  PID:13084
- C:\Windows\System\oaHXqST.exe
  C:\Windows\System\oaHXqST.exe
  2⤵
  PID:13108
- C:\Windows\System\fZPeIbA.exe
  C:\Windows\System\fZPeIbA.exe
  2⤵
  PID:13124
- C:\Windows\System\jaEAMwT.exe
  C:\Windows\System\jaEAMwT.exe
  2⤵
  PID:13148
- C:\Windows\System\rAAUHQm.exe
  C:\Windows\System\rAAUHQm.exe
  2⤵
  PID:13172
- C:\Windows\System\ncssciY.exe
  C:\Windows\System\ncssciY.exe
  2⤵
  PID:13236
- C:\Windows\System\GEMqLst.exe
  C:\Windows\System\GEMqLst.exe
  2⤵
  PID:13252
- C:\Windows\System\fBqSGqN.exe
  C:\Windows\System\fBqSGqN.exe
  2⤵
  PID:13268
- C:\Windows\System\fdLFocK.exe
  C:\Windows\System\fdLFocK.exe
  2⤵
  PID:13304
- C:\Windows\System\xXntltF.exe
  C:\Windows\System\xXntltF.exe
  2⤵
  PID:12348
- C:\Windows\System\egzMbpD.exe
  C:\Windows\System\egzMbpD.exe
  2⤵
  PID:12380
- C:\Windows\System\wtslHPN.exe
  C:\Windows\System\wtslHPN.exe
  2⤵
  PID:12472
- C:\Windows\System\SRxERSV.exe
  C:\Windows\System\SRxERSV.exe
  2⤵
  PID:12520
- C:\Windows\System\pDnTwIE.exe
  C:\Windows\System\pDnTwIE.exe
  2⤵
  PID:12596
- C:\Windows\System\wWmOnZs.exe
  C:\Windows\System\wWmOnZs.exe
  2⤵
  PID:12696
- C:\Windows\System\nJswYle.exe
  C:\Windows\System\nJswYle.exe
  2⤵
  PID:12744
- C:\Windows\System\PhcQBvC.exe
  C:\Windows\System\PhcQBvC.exe
  2⤵
  PID:12796
- C:\Windows\System\bEpVIsX.exe
  C:\Windows\System\bEpVIsX.exe
  2⤵
  PID:12844
- C:\Windows\System\ZeVOCMZ.exe
  C:\Windows\System\ZeVOCMZ.exe
  2⤵
  PID:12920
- C:\Windows\System\TyCuEpG.exe
  C:\Windows\System\TyCuEpG.exe
  2⤵
  PID:12912
- C:\Windows\System\doPzEad.exe
  C:\Windows\System\doPzEad.exe
  2⤵
  PID:13020
- C:\Windows\System\VYhxnML.exe
  C:\Windows\System\VYhxnML.exe
  2⤵
  PID:13104
- C:\Windows\System\LDohedh.exe
  C:\Windows\System\LDohedh.exe
  2⤵
  PID:13244
- C:\Windows\System\lfRktVG.exe
  C:\Windows\System\lfRktVG.exe
  2⤵
  PID:13248
- C:\Windows\System\zvKZqrE.exe
  C:\Windows\System\zvKZqrE.exe
  2⤵
  PID:13300
- C:\Windows\System\zqCeZQA.exe
  C:\Windows\System\zqCeZQA.exe
  2⤵
  PID:12548
- C:\Windows\System\EUkDOwS.exe
  C:\Windows\System\EUkDOwS.exe
  2⤵
  PID:12488
- C:\Windows\System\ruOyftD.exe
  C:\Windows\System\ruOyftD.exe
  2⤵
  PID:11912
- C:\Windows\System\BztAUmH.exe
  C:\Windows\System\BztAUmH.exe
  2⤵
  PID:12944
- C:\Windows\System\tQuiBeK.exe
  C:\Windows\System\tQuiBeK.exe
  2⤵
  PID:13064
- C:\Windows\System\IvKYVqo.exe
  C:\Windows\System\IvKYVqo.exe
  2⤵
  PID:13184
- C:\Windows\System\AQOlSaw.exe
  C:\Windows\System\AQOlSaw.exe
  2⤵
  PID:12328
- C:\Windows\System\lYlZUDA.exe
  C:\Windows\System\lYlZUDA.exe
  2⤵
  PID:12576
- C:\Windows\System\lETBZdq.exe
  C:\Windows\System\lETBZdq.exe
  2⤵
  PID:12764
- C:\Windows\System\twbGKpc.exe
  C:\Windows\System\twbGKpc.exe
  2⤵
  PID:13216
- C:\Windows\System\JFrEMPn.exe
  C:\Windows\System\JFrEMPn.exe
  2⤵
  PID:13296
- C:\Windows\System\qComQcj.exe
  C:\Windows\System\qComQcj.exe
  2⤵
  PID:13364
- C:\Windows\System\YfmvPcu.exe
  C:\Windows\System\YfmvPcu.exe
  2⤵
  PID:13392
- C:\Windows\System\WqKiCCB.exe
  C:\Windows\System\WqKiCCB.exe
  2⤵
  PID:13420
- C:\Windows\System\sijNfSc.exe
  C:\Windows\System\sijNfSc.exe
  2⤵
  PID:13436
- C:\Windows\System\NrYiRKt.exe
  C:\Windows\System\NrYiRKt.exe
  2⤵
  PID:13464
- C:\Windows\System\ZSpiSGY.exe
  C:\Windows\System\ZSpiSGY.exe
  2⤵
  PID:13492
- C:\Windows\System\KamDoPs.exe
  C:\Windows\System\KamDoPs.exe
  2⤵
  PID:13516
- C:\Windows\System\lzvNory.exe
  C:\Windows\System\lzvNory.exe
  2⤵
  PID:13536
- C:\Windows\System\prAXRsl.exe
  C:\Windows\System\prAXRsl.exe
  2⤵
  PID:13584
- C:\Windows\System\OLKnbAd.exe
  C:\Windows\System\OLKnbAd.exe
  2⤵
  PID:13616
- C:\Windows\System\dRgzdkw.exe
  C:\Windows\System\dRgzdkw.exe
  2⤵
  PID:13644
- C:\Windows\System\EHhoWSf.exe
  C:\Windows\System\EHhoWSf.exe
  2⤵
  PID:13672
- C:\Windows\System\ZOOWjBj.exe
  C:\Windows\System\ZOOWjBj.exe
  2⤵
  PID:13688
- C:\Windows\System\gjLPIUC.exe
  C:\Windows\System\gjLPIUC.exe
  2⤵
  PID:13712
- C:\Windows\System\ZxoLJff.exe
  C:\Windows\System\ZxoLJff.exe
  2⤵
  PID:13744
- C:\Windows\System\jPJJors.exe
  C:\Windows\System\jPJJors.exe
  2⤵
  PID:13760
- C:\Windows\System\MwKqnFF.exe
  C:\Windows\System\MwKqnFF.exe
  2⤵
  PID:13788
- C:\Windows\System\dKmijLN.exe
  C:\Windows\System\dKmijLN.exe
  2⤵
  PID:13812
- C:\Windows\System\TUYQUHo.exe
  C:\Windows\System\TUYQUHo.exe
  2⤵
  PID:13856
- C:\Windows\System\YlJCzCc.exe
  C:\Windows\System\YlJCzCc.exe
  2⤵
  PID:13880
- C:\Windows\System\XwiQCqp.exe
  C:\Windows\System\XwiQCqp.exe
  2⤵
  PID:13912
- C:\Windows\System\OTSZapR.exe
  C:\Windows\System\OTSZapR.exe
  2⤵
  PID:13932
- C:\Windows\System\IeDsGXs.exe
  C:\Windows\System\IeDsGXs.exe
  2⤵
  PID:13952
- C:\Windows\System\MzMOPFH.exe
  C:\Windows\System\MzMOPFH.exe
  2⤵
  PID:13988
- C:\Windows\System\tfXhsLy.exe
  C:\Windows\System\tfXhsLy.exe
  2⤵
  PID:14016
- C:\Windows\System\GaaDTlt.exe
  C:\Windows\System\GaaDTlt.exe
  2⤵
  PID:14032
- C:\Windows\System\FBrLigA.exe
  C:\Windows\System\FBrLigA.exe
  2⤵
  PID:14092
- C:\Windows\System\MdQOOzm.exe
  C:\Windows\System\MdQOOzm.exe
  2⤵
  PID:14124
- C:\Windows\System\xekmVXn.exe
  C:\Windows\System\xekmVXn.exe
  2⤵
  PID:14148
- C:\Windows\System\pzWrruP.exe
  C:\Windows\System\pzWrruP.exe
  2⤵
  PID:14176
- C:\Windows\System\QjUeSpO.exe
  C:\Windows\System\QjUeSpO.exe
  2⤵
  PID:14196
- C:\Windows\System\pLIkuGn.exe
  C:\Windows\System\pLIkuGn.exe
  2⤵
  PID:14228
- C:\Windows\System\LITmMAE.exe
  C:\Windows\System\LITmMAE.exe
  2⤵
  PID:14268
- C:\Windows\System\azBvnOz.exe
  C:\Windows\System\azBvnOz.exe
  2⤵
  PID:14300
- C:\Windows\System\gmmdHdk.exe
  C:\Windows\System\gmmdHdk.exe
  2⤵
  PID:14328
- C:\Windows\System\etQeTxq.exe
  C:\Windows\System\etQeTxq.exe
  2⤵
  PID:13348
- C:\Windows\System\xCRyMVw.exe
  C:\Windows\System\xCRyMVw.exe
  2⤵
  PID:13384
- C:\Windows\System\iQirsdq.exe
  C:\Windows\System\iQirsdq.exe
  2⤵
  PID:13432
- C:\Windows\System\PgvzcDv.exe
  C:\Windows\System\PgvzcDv.exe
  2⤵
  PID:13504
- C:\Windows\System\DURZrJL.exe
  C:\Windows\System\DURZrJL.exe
  2⤵
  PID:13548
- C:\Windows\System\hYggTTj.exe
  C:\Windows\System\hYggTTj.exe
  2⤵
  PID:13636
- C:\Windows\System\PWOAuTF.exe
  C:\Windows\System\PWOAuTF.exe
  2⤵
  PID:13664
- C:\Windows\System\QxGZbyK.exe
  C:\Windows\System\QxGZbyK.exe
  2⤵
  PID:13724
- C:\Windows\System\DksXUgC.exe
  C:\Windows\System\DksXUgC.exe
  2⤵
  PID:13828
- C:\Windows\System\hPhdjGi.exe
  C:\Windows\System\hPhdjGi.exe
  2⤵
  PID:13872
- C:\Windows\System\qgicaZy.exe
  C:\Windows\System\qgicaZy.exe
  2⤵
  PID:13940
- C:\Windows\System\DYBHyNN.exe
  C:\Windows\System\DYBHyNN.exe
  2⤵
  PID:13976
- C:\Windows\System\PlotEkl.exe
  C:\Windows\System\PlotEkl.exe
  2⤵
  PID:14084
- C:\Windows\System\GSRfHLO.exe
  C:\Windows\System\GSRfHLO.exe
  2⤵
  PID:14168
- C:\Windows\System\IeTxyjJ.exe
  C:\Windows\System\IeTxyjJ.exe
  2⤵
  PID:14192
- C:\Windows\System\DZBllVU.exe
  C:\Windows\System\DZBllVU.exe
  2⤵
  PID:14324
- C:\Windows\System\IOWfuNY.exe
  C:\Windows\System\IOWfuNY.exe
  2⤵
  PID:12900
- C:\Windows\System\LdXLLfV.exe
  C:\Windows\System\LdXLLfV.exe
  2⤵
  PID:13484
- C:\Windows\System\YwHGsxr.exe
  C:\Windows\System\YwHGsxr.exe
  2⤵
  PID:13684
- C:\Windows\System\PHXsmyz.exe
  C:\Windows\System\PHXsmyz.exe
  2⤵
  PID:13808
- C:\Windows\System\MBnzDZt.exe
  C:\Windows\System\MBnzDZt.exe
  2⤵
  PID:13964
- C:\Windows\System\QARiHjK.exe
  C:\Windows\System\QARiHjK.exe
  2⤵
  PID:14104
- C:\Windows\System\emRSUxo.exe
  C:\Windows\System\emRSUxo.exe
  2⤵
  PID:12824
- C:\Windows\System\cgjRhiL.exe
  C:\Windows\System\cgjRhiL.exe
  2⤵
  PID:12692
- C:\Windows\System\tiEEbrG.exe
  C:\Windows\System\tiEEbrG.exe
  2⤵
  PID:13600
- C:\Windows\System\YWLiKoH.exe
  C:\Windows\System\YWLiKoH.exe
  2⤵
  PID:13996
- C:\Windows\System\bxhSLZT.exe
  C:\Windows\System\bxhSLZT.exe
  2⤵
  PID:13460
- C:\Windows\System\zpzxeuO.exe
  C:\Windows\System\zpzxeuO.exe
  2⤵
  PID:14344
- C:\Windows\System\tePNUdg.exe
  C:\Windows\System\tePNUdg.exe
  2⤵
  PID:14360
- C:\Windows\System\eoayGPI.exe
  C:\Windows\System\eoayGPI.exe
  2⤵
  PID:14400
- C:\Windows\System\pLQcwfs.exe
  C:\Windows\System\pLQcwfs.exe
  2⤵
  PID:14416
- C:\Windows\System\stdgamX.exe
  C:\Windows\System\stdgamX.exe
  2⤵
  PID:14456
- C:\Windows\System\shHROZI.exe
  C:\Windows\System\shHROZI.exe
  2⤵
  PID:14480
- C:\Windows\System\IHBHuIv.exe
  C:\Windows\System\IHBHuIv.exe
  2⤵
  PID:14500
- C:\Windows\System\JduXIto.exe
  C:\Windows\System\JduXIto.exe
  2⤵
  PID:14540
- C:\Windows\System\pXnIEXm.exe
  C:\Windows\System\pXnIEXm.exe
  2⤵
  PID:14556
- C:\Windows\System\DcmYNDG.exe
  C:\Windows\System\DcmYNDG.exe
  2⤵
  PID:14576
- C:\Windows\System\JXyAWjr.exe
  C:\Windows\System\JXyAWjr.exe
  2⤵
  PID:14604
- C:\Windows\System\fKvsHja.exe
  C:\Windows\System\fKvsHja.exe
  2⤵
  PID:14632
- C:\Windows\System\GRwbDCj.exe
  C:\Windows\System\GRwbDCj.exe
  2⤵
  PID:14664
- C:\Windows\System\OoutVwN.exe
  C:\Windows\System\OoutVwN.exe
  2⤵
  PID:14696
- C:\Windows\System\GJrtwCl.exe
  C:\Windows\System\GJrtwCl.exe
  2⤵
  PID:14712
- C:\Windows\System\ojUYVWW.exe
  C:\Windows\System\ojUYVWW.exe
  2⤵
  PID:14764
- C:\Windows\System\bSKAuLk.exe
  C:\Windows\System\bSKAuLk.exe
  2⤵
  PID:14792
- C:\Windows\System\ZrIBjoI.exe
  C:\Windows\System\ZrIBjoI.exe
  2⤵
  PID:14808
- C:\Windows\System\UYlhetM.exe
  C:\Windows\System\UYlhetM.exe
  2⤵
  PID:14836
- C:\Windows\System\CVNXZMZ.exe
  C:\Windows\System\CVNXZMZ.exe
  2⤵
  PID:14864
- C:\Windows\System\DrwLrSy.exe
  C:\Windows\System\DrwLrSy.exe
  2⤵
  PID:14904
- C:\Windows\System\EfhgiSZ.exe
  C:\Windows\System\EfhgiSZ.exe
  2⤵
  PID:14920
- C:\Windows\System\vRaZNbe.exe
  C:\Windows\System\vRaZNbe.exe
  2⤵
  PID:14944
- C:\Windows\System\azJdepS.exe
  C:\Windows\System\azJdepS.exe
  2⤵
  PID:14968
- C:\Windows\System\edsPBTa.exe
  C:\Windows\System\edsPBTa.exe
  2⤵
  PID:14996
- C:\Windows\System\JkPNbQA.exe
  C:\Windows\System\JkPNbQA.exe
  2⤵
  PID:15024
- C:\Windows\System\lMbDRVK.exe
  C:\Windows\System\lMbDRVK.exe
  2⤵
  PID:15048
- C:\Windows\System\XPjjrNf.exe
  C:\Windows\System\XPjjrNf.exe
  2⤵
  PID:15068
- C:\Windows\System\zlcBdxg.exe
  C:\Windows\System\zlcBdxg.exe
  2⤵
  PID:15092
- C:\Windows\System\WYaCWml.exe
  C:\Windows\System\WYaCWml.exe
  2⤵
  PID:15136
- C:\Windows\System\uQfRfqj.exe
  C:\Windows\System\uQfRfqj.exe
  2⤵
  PID:15168
- C:\Windows\System\AUABHPU.exe
  C:\Windows\System\AUABHPU.exe
  2⤵
  PID:15196
- C:\Windows\System\ROjNPOD.exe
  C:\Windows\System\ROjNPOD.exe
  2⤵
  PID:15220
- C:\Windows\System\avIlUGo.exe
  C:\Windows\System\avIlUGo.exe
  2⤵
  PID:15248
- C:\Windows\System\aHrBeHw.exe
  C:\Windows\System\aHrBeHw.exe
  2⤵
  PID:15276
- C:\Windows\System\yLMCvDX.exe
  C:\Windows\System\yLMCvDX.exe
  2⤵
  PID:15312
- C:\Windows\System\xozaTpR.exe
  C:\Windows\System\xozaTpR.exe
  2⤵
  PID:15352
- C:\Windows\System\rPCNvES.exe
  C:\Windows\System\rPCNvES.exe
  2⤵
  PID:14352
- C:\Windows\System\FOtuyjt.exe
  C:\Windows\System\FOtuyjt.exe
  2⤵
  PID:14412
- C:\Windows\System\CNlObbt.exe
  C:\Windows\System\CNlObbt.exe
  2⤵
  PID:14464
- C:\Windows\System\JbmmvlM.exe
  C:\Windows\System\JbmmvlM.exe
  2⤵
  PID:14512
- C:\Windows\System\FbCbxMu.exe
  C:\Windows\System\FbCbxMu.exe
  2⤵
  PID:14620
- C:\Windows\System\WgaxSvK.exe
  C:\Windows\System\WgaxSvK.exe
  2⤵
  PID:14688
- C:\Windows\System\kgxkMGN.exe
  C:\Windows\System\kgxkMGN.exe
  2⤵
  PID:14756
- C:\Windows\System\rNSOzct.exe
  C:\Windows\System\rNSOzct.exe
  2⤵
  PID:14800
- C:\Windows\System\oFVdvQR.exe
  C:\Windows\System\oFVdvQR.exe
  2⤵
  PID:14856
- C:\Windows\System\oLUuDhL.exe
  C:\Windows\System\oLUuDhL.exe
  2⤵
  PID:14936
- C:\Windows\System\DAPthMX.exe
  C:\Windows\System\DAPthMX.exe
  2⤵
  PID:15008
- C:\Windows\System\qxTPhum.exe
  C:\Windows\System\qxTPhum.exe
  2⤵
  PID:15088
- C:\Windows\System\NxPJlqP.exe
  C:\Windows\System\NxPJlqP.exe
  2⤵
  PID:15164
- C:\Windows\System\WrawOmE.exe
  C:\Windows\System\WrawOmE.exe
  2⤵
  PID:15228
- C:\Windows\System\zDAMviy.exe
  C:\Windows\System\zDAMviy.exe
  2⤵
  PID:15284
- C:\Windows\System\TbvORjh.exe
  C:\Windows\System\TbvORjh.exe
  2⤵
  PID:15344
- C:\Windows\System\cblBWlh.exe
  C:\Windows\System\cblBWlh.exe
  2⤵
  PID:14492
- C:\Windows\System\TxyDHQG.exe
  C:\Windows\System\TxyDHQG.exe
  2⤵
  PID:14656
- C:\Windows\System\cbPgAQU.exe
  C:\Windows\System\cbPgAQU.exe
  2⤵
  PID:14564
- C:\Windows\System\nTNIcYb.exe
  C:\Windows\System\nTNIcYb.exe
  2⤵
  PID:14912
- C:\Windows\System\RAPAnrs.exe
  C:\Windows\System\RAPAnrs.exe
  2⤵
  PID:15056
- C:\Windows\System\FFsYWCD.exe
  C:\Windows\System\FFsYWCD.exe
  2⤵
  PID:15188
- C:\Windows\System\byNRlpB.exe
  C:\Windows\System\byNRlpB.exe
  2⤵
  PID:15324
- C:\Windows\System\uMkLyEk.exe
  C:\Windows\System\uMkLyEk.exe
  2⤵
  PID:14628
- C:\Windows\System\eDzWCtv.exe
  C:\Windows\System\eDzWCtv.exe
  2⤵
  PID:15128
- C:\Windows\System\PRbPHyR.exe
  C:\Windows\System\PRbPHyR.exe
  2⤵
  PID:14592
- C:\Windows\System\IjbIeXl.exe
  C:\Windows\System\IjbIeXl.exe
  2⤵
  PID:15084
- C:\Windows\System\BwRIUEj.exe
  C:\Windows\System\BwRIUEj.exe
  2⤵
  PID:15384
- C:\Windows\System\vPuCVKT.exe
  C:\Windows\System\vPuCVKT.exe
  2⤵
  PID:15412
- C:\Windows\System\sWHbowP.exe
  C:\Windows\System\sWHbowP.exe
  2⤵
  PID:15440
- C:\Windows\System\bBblwqR.exe
  C:\Windows\System\bBblwqR.exe
  2⤵
  PID:15456
- C:\Windows\System\IlkDype.exe
  C:\Windows\System\IlkDype.exe
  2⤵
  PID:15480
- C:\Windows\System\QvNLPUI.exe
  C:\Windows\System\QvNLPUI.exe
  2⤵
  PID:15500
- C:\Windows\System\XOIemuE.exe
  C:\Windows\System\XOIemuE.exe
  2⤵
  PID:15536
- C:\Windows\System\QgSpwHx.exe
  C:\Windows\System\QgSpwHx.exe
  2⤵
  PID:15556
- C:\Windows\System\NnysLXQ.exe
  C:\Windows\System\NnysLXQ.exe
  2⤵
  PID:15584
- C:\Windows\System\sRggXqZ.exe
  C:\Windows\System\sRggXqZ.exe
  2⤵
  PID:15604
- C:\Windows\System\sHAtnAr.exe
  C:\Windows\System\sHAtnAr.exe
  2⤵
  PID:15652
- C:\Windows\System\uvxPyua.exe
  C:\Windows\System\uvxPyua.exe
  2⤵
  PID:15668
- C:\Windows\System\PUwsihM.exe
  C:\Windows\System\PUwsihM.exe
  2⤵
  PID:15692
- C:\Windows\System\ZippnBS.exe
  C:\Windows\System\ZippnBS.exe
  2⤵
  PID:15748
- C:\Windows\System\nCDoUPc.exe
  C:\Windows\System\nCDoUPc.exe
  2⤵
  PID:15776
- C:\Windows\System\mXYVqaD.exe
  C:\Windows\System\mXYVqaD.exe
  2⤵
  PID:15804
- C:\Windows\System\OZrvGMg.exe
  C:\Windows\System\OZrvGMg.exe
  2⤵
  PID:15832
- C:\Windows\System\EnmuyiS.exe
  C:\Windows\System\EnmuyiS.exe
  2⤵
  PID:15860
- C:\Windows\System\vYQcmvR.exe
  C:\Windows\System\vYQcmvR.exe
  2⤵
  PID:15876
- C:\Windows\System\ATLjyVo.exe
  C:\Windows\System\ATLjyVo.exe
  2⤵
  PID:15892
- C:\Windows\System\aTTeDrq.exe
  C:\Windows\System\aTTeDrq.exe
  2⤵
  PID:15912
- C:\Windows\System\ELflfua.exe
  C:\Windows\System\ELflfua.exe
  2⤵
  PID:15972
- C:\Windows\System\rUTCKvn.exe
  C:\Windows\System\rUTCKvn.exe
  2⤵
  PID:15988
- C:\Windows\System\ioHFLvu.exe
  C:\Windows\System\ioHFLvu.exe
  2⤵
  PID:16020
- C:\Windows\System\kfqMqDh.exe
  C:\Windows\System\kfqMqDh.exe
  2⤵
  PID:16048
- C:\Windows\System\oxZxMRK.exe
  C:\Windows\System\oxZxMRK.exe
  2⤵
  PID:16072
- C:\Windows\System\MGiyiOv.exe
  C:\Windows\System\MGiyiOv.exe
  2⤵
  PID:16100
- C:\Windows\System\knepaxA.exe
  C:\Windows\System\knepaxA.exe
  2⤵
  PID:16128
- C:\Windows\System\nStbsIq.exe
  C:\Windows\System\nStbsIq.exe
  2⤵
  PID:16160
- C:\Windows\System\aCGSIKE.exe
  C:\Windows\System\aCGSIKE.exe
  2⤵
  PID:16188
- C:\Windows\System\XBgHnuE.exe
  C:\Windows\System\XBgHnuE.exe
  2⤵
  PID:16216
- C:\Windows\System\uJpsBKH.exe
  C:\Windows\System\uJpsBKH.exe
  2⤵
  PID:16240
- C:\Windows\System\YYIXecA.exe
  C:\Windows\System\YYIXecA.exe
  2⤵
  PID:16268
- C:\Windows\System\pwjHnMw.exe
  C:\Windows\System\pwjHnMw.exe
  2⤵
  PID:16308
- C:\Windows\System\PXyFhXR.exe
  C:\Windows\System\PXyFhXR.exe
  2⤵
  PID:16324
- C:\Windows\System\mCBsDku.exe
  C:\Windows\System\mCBsDku.exe
  2⤵
  PID:16360
- C:\Windows\System\xaoIciv.exe
  C:\Windows\System\xaoIciv.exe
  2⤵
  PID:15372
- C:\Windows\System\UvXHSEq.exe
  C:\Windows\System\UvXHSEq.exe
  2⤵
  PID:15428
- C:\Windows\System\YPndXkv.exe
  C:\Windows\System\YPndXkv.exe
  2⤵
  PID:15468
- C:\Windows\System\ImrnXAt.exe
  C:\Windows\System\ImrnXAt.exe
  2⤵
  PID:15524
- C:\Windows\System\roBLpTI.exe
  C:\Windows\System\roBLpTI.exe
  2⤵
  PID:15592
- C:\Windows\System\ZieFjpj.exe
  C:\Windows\System\ZieFjpj.exe
  2⤵
  PID:15632
- C:\Windows\System\vFgwCRD.exe
  C:\Windows\System\vFgwCRD.exe
  2⤵
  PID:15660
- C:\Windows\System\DofjsVW.exe
  C:\Windows\System\DofjsVW.exe
  2⤵
  PID:15792
- C:\Windows\System\JkODtci.exe
  C:\Windows\System\JkODtci.exe
  2⤵
  PID:15824
- C:\Windows\System\ZVFLYLg.exe
  C:\Windows\System\ZVFLYLg.exe
  2⤵
  PID:15900
- C:\Windows\System\PdoOGZb.exe
  C:\Windows\System\PdoOGZb.exe
  2⤵
  PID:15920
- C:\Windows\System\ygvzsZq.exe
  C:\Windows\System\ygvzsZq.exe
  2⤵
  PID:15980
- C:\Windows\System\lrmqmnV.exe
  C:\Windows\System\lrmqmnV.exe
  2⤵
  PID:16056
- C:\Windows\System\SlpXehV.exe
  C:\Windows\System\SlpXehV.exe
  2⤵
  PID:16140
- C:\Windows\System\klLmyvL.exe
  C:\Windows\System\klLmyvL.exe
  2⤵
  PID:16228
- C:\Windows\System\AValYlb.exe
  C:\Windows\System\AValYlb.exe
  2⤵
  PID:16256
- C:\Windows\System\JNjYRXo.exe
  C:\Windows\System\JNjYRXo.exe
  2⤵
  PID:16368
- C:\Windows\System\QyimcdS.exe
  C:\Windows\System\QyimcdS.exe
  2⤵
  PID:15408
- C:\Windows\System\MDqPmRW.exe
  C:\Windows\System\MDqPmRW.exe
  2⤵
  PID:15552
- C:\Windows\System\ffEzZte.exe
  C:\Windows\System\ffEzZte.exe
  2⤵
  PID:15716
- C:\Windows\System\kxoPYzT.exe
  C:\Windows\System\kxoPYzT.exe
  2⤵
  PID:15868
- C:\Windows\System\LHofIrC.exe
  C:\Windows\System\LHofIrC.exe
  2⤵
  PID:16036
- C:\Windows\System\diPQdQB.exe
  C:\Windows\System\diPQdQB.exe
  2⤵
  PID:16096
- C:\Windows\System\kFjXhmv.exe
  C:\Windows\System\kFjXhmv.exe
  2⤵
  PID:15368
- C:\Windows\System\cJICjMf.exe
  C:\Windows\System\cJICjMf.exe
  2⤵
  PID:15596
- C:\Windows\System\naEvEes.exe
  C:\Windows\System\naEvEes.exe
  2⤵
  PID:15800
- C:\Windows\System\qDZnrzj.exe
  C:\Windows\System\qDZnrzj.exe
  2⤵
  PID:14960
- C:\Windows\System\UEwDCUN.exe
  C:\Windows\System\UEwDCUN.exe
  2⤵
  PID:15816
- C:\Windows\System\zVxCBWM.exe
  C:\Windows\System\zVxCBWM.exe
  2⤵
  PID:16396
- C:\Windows\System\UcVxXpz.exe
  C:\Windows\System\UcVxXpz.exe
  2⤵
  PID:16416
- C:\Windows\System\lEPenQT.exe
  C:\Windows\System\lEPenQT.exe
  2⤵
  PID:16460
- C:\Windows\System\axdcPFq.exe
  C:\Windows\System\axdcPFq.exe
  2⤵
  PID:16484
- C:\Windows\System\fVPswtX.exe
  C:\Windows\System\fVPswtX.exe
  2⤵
  PID:16512
- C:\Windows\System\CagNgjw.exe
  C:\Windows\System\CagNgjw.exe
  2⤵
  PID:16528
- C:\Windows\System\fGtlErd.exe
  C:\Windows\System\fGtlErd.exe
  2⤵
  PID:16584
- C:\Windows\System\JHuUQiA.exe
  C:\Windows\System\JHuUQiA.exe
  2⤵
  PID:16600
- C:\Windows\System\idjXhHq.exe
  C:\Windows\System\idjXhHq.exe
  2⤵
  PID:16628
- C:\Windows\System\sCTJxnI.exe
  C:\Windows\System\sCTJxnI.exe
  2⤵
  PID:16656
- C:\Windows\System\KwCIdPh.exe
  C:\Windows\System\KwCIdPh.exe
  2⤵
  PID:16684
- C:\Windows\System\wOSqDhf.exe
  C:\Windows\System\wOSqDhf.exe
  2⤵
  PID:16700
- C:\Windows\System\egHLmyV.exe
  C:\Windows\System\egHLmyV.exe
  2⤵
  PID:16728
- C:\Windows\System\FupcoXf.exe
  C:\Windows\System\FupcoXf.exe
  2⤵
  PID:16764
- C:\Windows\System\hFEtOxh.exe
  C:\Windows\System\hFEtOxh.exe
  2⤵
  PID:16784
- C:\Windows\System\rwVkgYL.exe
  C:\Windows\System\rwVkgYL.exe
  2⤵
  PID:16836
- C:\Windows\System\ePByJdT.exe
  C:\Windows\System\ePByJdT.exe
  2⤵
  PID:16852
- C:\Windows\System\jzMIljt.exe
  C:\Windows\System\jzMIljt.exe
  2⤵
  PID:16868
- C:\Windows\System\RknJinT.exe
  C:\Windows\System\RknJinT.exe
  2⤵
  PID:16884
- C:\Windows\System\rGtiRBX.exe
  C:\Windows\System\rGtiRBX.exe
  2⤵
  PID:16916
- C:\Windows\System\sjJDXeb.exe
  C:\Windows\System\sjJDXeb.exe
  2⤵
  PID:16960
- C:\Windows\System\oRvyqif.exe
  C:\Windows\System\oRvyqif.exe
  2⤵
  PID:16988
- C:\Windows\System\cFWtyoP.exe
  C:\Windows\System\cFWtyoP.exe
  2⤵
  PID:17012
- C:\Windows\System\Qadmgrr.exe
  C:\Windows\System\Qadmgrr.exe
  2⤵
  PID:17036
- C:\Windows\System\TaONiXS.exe
  C:\Windows\System\TaONiXS.exe
  2⤵
  PID:17072

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:17368

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\ADQUbZx.exe

Filesize
1.4MB

MD5
ef2dbfca3c3f61a52e5558dfebd9a8ea

SHA1
d7667f51f713fd856c5baf529f2c5d7f56d5868b

SHA256
100527d67a571e12fb1962677e812bb40d987b7f68b485117baf7b5b1875275f

SHA512
668cad3b5f05e16688a810c15b0854ef2383b71bb33d45b64c9bbda91be1d65988e6b1b26fc4ca4935c416ea15e3db842387ae52a5a067656cd88d71a4e77e37

Download Submit
C:\Windows\System\CslYAgF.exe

Filesize
1.4MB

MD5
886ad4986868ec4141a4aa0e70465d42

SHA1
3fd3209a8dfe99c035f579a8e0b9fa83727cbeb2

SHA256
d401cba4968a040fd12cfdd196a07a056934a34027d1681115eaa92eb2d6aca1

SHA512
9c6f704dd1c10da4b7125e36ff18b530f5e75b550048db6ebc8c843f48d07ff01faffec66ac3ada8a01e878981c990f4da40a42fdb625733b5b932c249412569

Download Submit
C:\Windows\System\DPpMxNc.exe

Filesize
1.4MB

MD5
d5d1f084a4b97393c6ac8a75dfd8e5fe

SHA1
3df4ff871324a09095e4767f130a1a7e00838066

SHA256
3ee9cbc84ebf727b4081228c0a5bd035c300566425bb89f4e1043a7ea4561739

SHA512
dd94b2836bb181086bd5d3c87dee0c712b1cb74c8b2c20ccb3cadbaf9ada1a5277566e481e53e34ac5b2af6ffad925ea9e64ffe969371327198c7afcff469f1d

Download Submit
C:\Windows\System\GfTSUjF.exe

Filesize
1.4MB

MD5
7d38eb7242bcff53106c7b5ff9a31ba7

SHA1
0c212b46bbd6758d763b0b907ebd0c90faec43c2

SHA256
f3b2be21d1bc511b30788c1e18c698cf3bb1e789da9266a071dd18311be5a541

SHA512
e426e91735c05ffb58f9b59ab5f8c4dd3471c01f1ec9cb3504ff682a0b2b0c03b3f5e7622f755aadd32a77b5b61019d88cb42852eb8c695e84b70783cbd7ce7a

Download Submit
C:\Windows\System\HDhmtcW.exe

Filesize
1.4MB

MD5
e5f14adacab93671e0af082db129b6c1

SHA1
9d1a0f604e8f12fcb03c66f6459746482163ce0b

SHA256
d6569cec7775b768595af3a81fe40b5f32fa6b52d8e6e570292cb2cef6d7e970

SHA512
aff92688acc6632a81ec8274d8da463eca40d0f0a02ae1f6ce14f3f50a65bc84037efd316f2d739c1a37f7ecbb1039e7a2be1fe9019d459fa52fa3562cdd41b6

Download Submit
C:\Windows\System\JUmPWQK.exe

Filesize
1.3MB

MD5
1631f4af6714d1b1ff5a6385bb6bd2ab

SHA1
8d15baea7c223b0aaa363cece6721874ed758c10

SHA256
d29d1c9511bdf85a1a626c2df3afd96b51bf6705a89904c35b7395f274b465e1

SHA512
12a87096a7deed91c3922439a2409606108b509ab56568495cfdcd5fff3a53895fd7096a70468e9dac4b740a681e58fc53431c2927d5e145ea52198ac146ea19

Download Submit
C:\Windows\System\KpckVKe.exe

Filesize
1.4MB

MD5
5183ba77a92c9570098e306a09c8c752

SHA1
6740d65fd6e5de496c992c4b268ddd6d3c01f4ed

SHA256
80f435766360472556de6948bd69d5cb99be3b09f8ceca40d57e4c1d61af2c11

SHA512
871c359cb9c66bdf9e0b2295773a6abf7a42cc6f6aa387ac2b26a43ab477fdec6e5f05b56ed9128315e301f2132223e9d70292b4d5d46a21d013ed9575ba354a

Download Submit
C:\Windows\System\LVDRzRk.exe

Filesize
1.3MB

MD5
56b3686e0b5e75ba74f9ad8385acdc77

SHA1
76e441297952ff5587fe11b58e209c40640a60ca

SHA256
20d6b204a14c18df213f5e992991da48dfa7438d568fe88f13c5850a85fa7c3b

SHA512
c1f14f1d40d93cf49068ff8234052efdc1d78032e208953d7b20b7e1d03d5a12dce1374b1e61597d6ad848aeb15c666a064d76abeea2956982097bfc13f94fc7

Download Submit
C:\Windows\System\LpqhiPk.exe

Filesize
1.4MB

MD5
397ec44b196f86bec4413bbfcbffd706

SHA1
4dc3435d66beee4e373acd563c838d759a0230ab

SHA256
0f35daf582c4356fb682c3b9027a67c00367aa3666711fb6637485f0dd3caced

SHA512
2aa92c6eef7194493bbe4df0c51f95a17d0a95cdd73400d9cec611f1cc941b37d8926ed360bd44067eb2db9170b367bb9ba230fc263846e9fac4362fce675aa3

Download Submit
C:\Windows\System\NKyOaWC.exe

Filesize
1.3MB

MD5
c920daf1450c0344266290c365d627d5

SHA1
594ce6da39ad56fd1afd7263bdad20f40a8be2f3

SHA256
22d11cab9265ee5facece919d804261a6e2187ba286b4d096ab455c9de580094

SHA512
da15db68cdf8be3c51ad1b0d72499cb2a3cc053ba51a2004d6507e8d33ad94e9ce3d88447504d92e6fdab3091dca0809b2452252003c4d3baf6f4eee63f1f5f5

Download Submit
C:\Windows\System\OFOevgD.exe

Filesize
1.3MB

MD5
7dca9c92e3faebc142b8f7620ff1f412

SHA1
6977a80cee6668e854666f225e0df0f8e462fe62

SHA256
eba35074386e7883c6d0f9fead72701d6098da4deb6de0feb767671ba9b64c84

SHA512
5de7449debf9f00ffe970557564100ccae1ce114230f10807552ae6c58b5de04a7bfdb42edadf3cb6dd840cafbf7de2753657b7b1e13d8195665cfdd8ceb7691

Download Submit
C:\Windows\System\OIlhtgK.exe

Filesize
1.4MB

MD5
096a0cbb1fa5ea7d1cb3adfb0f952c9d

SHA1
6e479685b1b6009309233dbe67d36f47d45c790e

SHA256
d6e8d37db65f880b77ac655e5d5a88f313baf017f9995244710a707ab25c4138

SHA512
fe8db5a8aef03cde07257c93f655ce487f01f97626ce300d80c9e33d6b3dfd01007ebc0378a46f42793ad8cabf3186e6801810e57b431c13f65c35c9ae81d3b3

Download Submit
C:\Windows\System\TlBGLVQ.exe

Filesize
1.4MB

MD5
c7f739669bea713bf4a768a4008625c0

SHA1
e43cc7c50982dcc4a1cb3d1519f6f080780ad56d

SHA256
1ba2858ee3981aa5e135c1015af2356ee9bdec54e0459bb8a0eff7b7fcf86f75

SHA512
c0b68d66a173c44849ef3296aeeba9c7a0d79a67fa6f2290535289cf5126f9bd93a75acdc7c32651fdc0d36cc1fc60c16424cfc5e1f8bc1398390cd4e7a6a9bf

Download Submit
C:\Windows\System\TtnShKp.exe

Filesize
1.4MB

MD5
ee98f26d5f1e31fb29b4b65b2ffd1ce7

SHA1
e0b47ad0aa22da0bc630a7cc94c23a08f63f6680

SHA256
b41d7924578a1b999c5dd6107d83ba97049e9ad11d13c5243376b8a8c56e7b6f

SHA512
10ecfa447c7618018fb2875f3fe8e2457ef73b91cd1d5a53f92548e31d78a9148ce773909087f7957c92c4670a49e2dc3fd0abfc9cf4c3291589b0dc248d15ba

Download Submit
C:\Windows\System\VrkEgrb.exe

Filesize
1.4MB

MD5
ff5cca2b5f8f749b42471714412e5f6f

SHA1
58213e30c4bab65db7e604a13e03c27bc3c4ebda

SHA256
54baef3b9fc3e453a84cddd7f206e3b1a0524ab013dd4034b7110d654dc747e4

SHA512
65ebe0969e474237f449daecf21a43791d41f4458de1a33a3e3c26c58a7850f57c2a79cc9d717399dceb0052dcaac90f7a5af2d08d066f48fad38c72bbb6c648

Download Submit
C:\Windows\System\VzuvqbG.exe

Filesize
1.4MB

MD5
84758948ae34989425e6ee45fb7f98c2

SHA1
9c01a5a7239fa2bd5e3b39f7dba4d6b7c3b43343

SHA256
15622c824112a8b8b6d241a347361f71bd4d723c9d462225fcc0098fa6fcaa8e

SHA512
acba0746988b354f6d31e51ce5b36d5a1856b3334c4b4c0f78d05fb8dc9cb8b0d8c1f3747850140be91990e8a89f82ee8ec74318d20c205a15acf53fbe9c2d7f

Download Submit
C:\Windows\System\WCwbVcH.exe

Filesize
1.4MB

MD5
b451bf5641acf34e34f74dea7a68876d

SHA1
1abbefaa486001277ea3529f48f03a6e09c17429

SHA256
430f6f6b5b8c7f974e693082fd59e364886b336e5f637c7f84605475951f3b17

SHA512
b5275dd4f92d2c1d45bbb786f82d949a3d8dffbabd37045a0013c8574abb0d9f7da387ed797f1ae75b73aed534296ed0921764a9cc005f91b49ba3efce7468df

Download Submit
C:\Windows\System\XmKtady.exe

Filesize
1.4MB

MD5
316328b9e74400ce86e58dc3fee3d52d

SHA1
dc6ff8c951949dfe469cd670bc8ccff89f5e0b33

SHA256
d82fcb97280fd68e715ed0532e6c79d9ccc8667a1477840ac6efc51a41375d62

SHA512
f2b51ccdb826bfbe1ef3af30382b5a35fbd30f70f4e97bc0a8447254776e3f66b0d2b1b6063b9dc4c284ea11d867893fad40d5e13cefe41c729cbb58d04e17a4

Download Submit
C:\Windows\System\YWlhgPQ.exe

Filesize
1.4MB

MD5
71ce881f234e1ad0f599f0f221d09ead

SHA1
6b44aa9b68c6ee4f25a18bf4a306dd7facdc9b2c

SHA256
f17d6ea62f03c16d7373f33f63abe105559059d4178551356f40cad0425453cf

SHA512
18a02cb2cafc52bfd026a380e790d6432e35046f6505e31c79010b853e29c06757fa6a39b5e22dfbb75e9d81980c03be212ffcd0852ea326ac6696b3aebd75bf

Download Submit
C:\Windows\System\cqZRoJZ.exe

Filesize
1.4MB

MD5
486680e3dad3448ea4494bd1f1b0c1c4

SHA1
6253eb225f7e905221e20b70d6ad41a0bb740325

SHA256
26b2674d6635f953573bf653d36eb4797270f88dc802221586ad420a6b2bb277

SHA512
afec98f04fee1d487db70ba50acb861dc9e424e42200daaca8482fa3ce643757f7c77425150d3fb0ae83468f4c12ace3ea967f402f3f606a57d9db7fb54d5088

Download Submit
C:\Windows\System\fAOTIfk.exe

Filesize
1.3MB

MD5
7fdbb6b05fb29f1f255e68432d021452

SHA1
942e224d3c7c33d08458ca2e7ca97b1f72993401

SHA256
a9b82db8579ba0c0a01b2a36b86316511af9f91db5c9b73cd67b7a846190ecad

SHA512
27db937741eb16f54e77c6725db3d51fc4737aaa6ece978cd9ce817f0a57704ee8ef69921c5494e7cc7e36b3772dfeb99399e00e455cc9b718801886f05c8036

Download Submit
C:\Windows\System\gCtFAbk.exe

Filesize
1.4MB

MD5
ba36c09d60e86e7a9e4f837b5776364e

SHA1
dcdce0669f87d17297aa78f77c90189977d25471

SHA256
ac690adf10d0b8fb08b3d0c496b3f16656c7529e07fd72885817e2de2ff8301c

SHA512
748a48b1dcb0bfa0a8a41b7ceb0f32f3ce6c55bcc0dfcbc233d27806379b8821743fbddf7b19aea1014fe027c875d7bb6dbac5b0fdb01a9c262bfa26d9b6d15f

Download Submit
C:\Windows\System\lTVPmxH.exe

Filesize
1.4MB

MD5
d5e97efeb53cb2a9eec08e2c0c116eaa

SHA1
83defaf1c382d74a4598f5b1954e6e8c67afe9c9

SHA256
796ceb557d900a3fae177a6763bb66e11769e63a0e8582d11d65dcc8d2b09a10

SHA512
821e2ab8c6901a6e8cda3a3f1198cdb71fda38f4bf02fc35eabd59d4e47455eb414338a044280d7f53f7ec017a106450e103711c95114de854d6ebfdae99e0c0

Download Submit
C:\Windows\System\mJJDJhj.exe

Filesize
1.4MB

MD5
a50ef3965d951f7778e2f382c268441c

SHA1
54e55082321fb433436be4e017027efb9c78cd8f

SHA256
1898b8ffd35367d6c0a80c8c05dfbdb7d94949effc2b4cd93572e073f31cacab

SHA512
623fcc8634c90627ba611330134e706edbd65f58f0ad5e8e48da39ed6981983508386dc784d317c9a3b62a36e643ad22730e4597f46a0128cf8fe43a4b6258ea

Download Submit
C:\Windows\System\mtngeHI.exe

Filesize
1.4MB

MD5
d14c3020da0f8781c1b541fd4e2e98af

SHA1
701259988d387c757f40f488e7e015187738b8fd

SHA256
16a19639005e72fa66849d6cb1843ba365a91ce9646ecf855f40b31fe2fc5ba6

SHA512
18bcd336339d4254d0878c6d61df7633a47b4b4151e9b3cc9c89220b0ba6bd0e51801db2b40e1b3ebf7327015e656c388dff94c2220c12644dcb64164ebb8fbb

Download Submit
C:\Windows\System\nFfKIOA.exe

Filesize
1.4MB

MD5
201de6893bc40b5f193688b199a23093

SHA1
a51398e56330922d8df02b4cfc52437a0e4917fc

SHA256
c103355aadce8a70215828cc0cdcb6f6386c9bc384bf0884b1523f3e31be84ef

SHA512
9ea79898a5208dd00f32b9aea718c5b6aa6e50367ac1ffa78944f7c38e6c7e84843af3dbda3428926c4629d0965a8afcc37e92aa9431c969fc03b885cb71afd9

Download Submit
C:\Windows\System\ntdGnLZ.exe

Filesize
1.4MB

MD5
1c156b2b4ace39d638a1def6569536ae

SHA1
088f13dc9f00326a2a4ec4e04812d40d5c9efdfd

SHA256
6180cc9e795168b934ae15ade290b56329547c4feeaf56635263b1a20a338ca9

SHA512
5da0f920cd495912035c77a2fd7e7fb48a40ee97b870531ac09c7ca32e26480e3e61dbda608a5fd125247c779f6d23d13610caffde27734ee9aee6858841d11a

Download Submit
C:\Windows\System\pniDRSg.exe

Filesize
1.4MB

MD5
4e76550bbd3d19df9eb7a98e8cc834e5

SHA1
fe6658fd570ffe41cdd750102de94a3fe15fe27c

SHA256
d2054347f278262ae1bda7d356cee8934c6dbdc5702329160963eca65ad6c718

SHA512
f7967494fd5bc9dd122a8e1e9ef139cc16052e9e10c2086fa62e99774c07cf2a2d8aebd08034c1b9ad5bb7e07ceae7df441d6242b3eab809e10c0213e3137a9d

Download Submit
C:\Windows\System\sgmxipe.exe

Filesize
1.4MB

MD5
a68ad52fd3aeace322f2178a01d59418

SHA1
1d40308189ab3b85b88f96822816bc2ffc75c712

SHA256
2f07801b65eaaecbfce6ac44ed33b68f4d55a535ca35bd6a31c44262bde557f5

SHA512
ef94de96ba5aaf8bcff05e00bbe9d6eafca5b210c810a2167384e5b33068b36d10aa2c3ea71526c5f3113a21f5747b8544ae9ca1d374834dfff0c504632472ab

Download Submit
C:\Windows\System\tpKCtkg.exe

Filesize
1.3MB

MD5
24f872645a4bbd696840d43500b25107

SHA1
9d977a1e80f2220c33753066b56d83b2c3b84537

SHA256
8c55e7579b9b85688b33ecab799ed5495f86a2943b97bba763afb9c7c52ca2eb

SHA512
41a15a409e1c973f059ccf156bb61cae1e6992f43ca8b47a4d5876523b714a0b7c5027ebde8a45cb455392dc214d6636b65f09e30dc1c339bed12e5ae7987d03

Download Submit
C:\Windows\System\uRQIdaT.exe

Filesize
1.4MB

MD5
d293e0d20f99805fd7560e2f231f5a9f

SHA1
2975ae6680072be8e4a5bb97b6f61d51fdf0000f

SHA256
32de9f7f3f839b2dc1bbf0959a7d4df9e306a0f371d50167da0a5c09142a1abd

SHA512
fe56591e1947dfdefbebd4ea08fa6a1cf5fee54fbdede56a39922f6794ecf20f4eef29fc59ff285b9bc5071826e120e7bb1408f7acc40878384778e215db9771

Download Submit
C:\Windows\System\wbsMbcy.exe

Filesize
1.4MB

MD5
004517598248f5cfb4021d675c1fa4e1

SHA1
f22838ea117eabdde2020ba0aee1f5b3de152579

SHA256
cf81a7e8a14210dcbff45548c2e78639ecfb1ebc03ae73b6bd122060ebdb662f

SHA512
9707097bc11b63a129779f72a244428cf4e340582e2c4e5c43bec49cf5dd452f2a64e0c9415a3e50ab71ab17dae96676dca1cc57ada02578797303e3d72b7234

Download Submit
C:\Windows\System\zYPcTVe.exe

Filesize
1.4MB

MD5
96dae530d9125923973f5366e796d393

SHA1
2d1d2f858f1b1ac72e13183deba4984a108b3283

SHA256
784b891d13abc4e8ac00405e783d96f15341066db34f692ab66ecf09222bf032

SHA512
874824025d30fdd24b25bf4bf4ff121afd7dfcebfa32f69d16ea851ade0653698f9f2750208b5dd712d72f128bf3547127dd7a9f106cd26771c573e64bd7744c

Download Submit
memory/1464-0-0x000001C6CCEA0000-0x000001C6CCEB0000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads