xmrig | b5da530737e5830a6e95e7454d184d94f3ef43f5a82a870dfe96682ede4fe800

Analysis

max time kernel
118s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
25/12/2024, 02:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b5da530737e5830a6e95e7454d184d94f3ef43f5a82a870dfe96682ede4fe800.exe
Size

1.4MB
MD5

c4e22f13de7cc9ba6d4e8de4d5dbfac1
SHA1

77e36e3c3f449d84c3fdc17b6360a5f92213efc3
SHA256

b5da530737e5830a6e95e7454d184d94f3ef43f5a82a870dfe96682ede4fe800
SHA512

e8d76f766594dd2c64db1714834c82ca5f27847abb82504ef89414aa7cfe3bc0101fd3aada925b17a30f5c21de6c1a339123f0d341d73e2d8bb57721faeab5fa
SSDEEP

24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbpwlKenszbWKDNEm/5p904aohckI:GezaTF8FcNkNdfE0pZ9ozttwIRxGDK3y

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 33 IoCs

miner

resource	yara_rule
behavioral2/files/0x0009000000023c64-4.dat	xmrig
behavioral2/files/0x0007000000023c78-6.dat	xmrig
behavioral2/files/0x0009000000023c6c-8.dat	xmrig
behavioral2/files/0x0007000000023c7b-33.dat	xmrig
behavioral2/files/0x0007000000023c7d-39.dat	xmrig
behavioral2/files/0x0007000000023c7e-47.dat	xmrig
behavioral2/files/0x0007000000023c86-82.dat	xmrig
behavioral2/files/0x0007000000023c8a-102.dat	xmrig
behavioral2/files/0x0007000000023c96-162.dat	xmrig
behavioral2/files/0x0007000000023c94-160.dat	xmrig
behavioral2/files/0x0007000000023c95-157.dat	xmrig
behavioral2/files/0x0007000000023c93-155.dat	xmrig
behavioral2/files/0x0007000000023c92-150.dat	xmrig
behavioral2/files/0x0007000000023c91-145.dat	xmrig
behavioral2/files/0x0007000000023c90-140.dat	xmrig
behavioral2/files/0x0007000000023c8f-135.dat	xmrig
behavioral2/files/0x0007000000023c8e-130.dat	xmrig
behavioral2/files/0x0007000000023c8d-125.dat	xmrig
behavioral2/files/0x0007000000023c8c-120.dat	xmrig
behavioral2/files/0x0007000000023c8b-115.dat	xmrig
behavioral2/files/0x0007000000023c89-105.dat	xmrig
behavioral2/files/0x0007000000023c88-100.dat	xmrig
behavioral2/files/0x0007000000023c87-95.dat	xmrig
behavioral2/files/0x0007000000023c85-85.dat	xmrig
behavioral2/files/0x0007000000023c84-80.dat	xmrig
behavioral2/files/0x0007000000023c83-75.dat	xmrig
behavioral2/files/0x0007000000023c82-70.dat	xmrig
behavioral2/files/0x0007000000023c81-65.dat	xmrig
behavioral2/files/0x0007000000023c80-60.dat	xmrig
behavioral2/files/0x0007000000023c7f-55.dat	xmrig
behavioral2/files/0x0007000000023c7c-37.dat	xmrig
behavioral2/files/0x0007000000023c7a-28.dat	xmrig
behavioral2/files/0x0007000000023c79-21.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
4716	JyYGsQB.exe
3512	fcherPD.exe
3468	OzbwIGN.exe
3848	hTVqKGb.exe
4408	AuaUgkr.exe
528	dsJavqN.exe
220	qNdwSRM.exe
1464	UvSBpcC.exe
5084	aVdIKlW.exe
4300	EERQUHO.exe
1032	qFZLpCg.exe
4136	xRkfUQQ.exe
4296	JpJRftt.exe
1028	DEBckdj.exe
4552	QmpAyAM.exe
3652	gdSSYFX.exe
4648	DeQbGyx.exe
2188	OEXYbmj.exe
888	lmiVThs.exe
3664	NakUdHc.exe
4488	kWVSiHb.exe
2528	KMpwOFg.exe
1980	Idhroak.exe
3948	SJjsKjV.exe
2884	CxhkcgE.exe
2208	mBsyzVt.exe
4756	KMBFOdT.exe
916	PhLpcCB.exe
4100	TcMujmZ.exe
2664	EXPtnbQ.exe
5040	SyKTfpZ.exe
1692	jmPVwUq.exe
2708	ekXQEZp.exe
4936	UGUrbsI.exe
3580	GSlzcuA.exe
760	qqNwXlU.exe
5024	HLjTWBU.exe
4348	eNYgEoN.exe
2172	gxoHQbf.exe
4568	VXVTkNH.exe
2712	rKoGjJI.exe
4948	JoGkHvt.exe
3520	ReGerER.exe
2040	BrRSUdz.exe
5000	eRnuZgP.exe
3196	IXggazo.exe
2628	wALJGpO.exe
3692	lwlurtM.exe
2584	qZfEGIN.exe
3012	qkNSjJL.exe
3004	mbFucYT.exe
3620	CzBVfhB.exe
2552	CxpgjDW.exe
1856	hysNuUP.exe
1548	xNVcKLi.exe
3408	nOaLmVe.exe
3972	IwjBrRI.exe
1208	VLTAlDl.exe
4264	DjsyrBu.exe
4352	gFjcLlK.exe
4680	XFyYGPd.exe
3888	stGSQRl.exe
4724	tIUnvQX.exe
4148	kcNLfTJ.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\CFSErss.exe	b5da530737e5830a6e95e7454d184d94f3ef43f5a82a870dfe96682ede4fe800.exe
File created	C:\Windows\System\IOqexcb.exe	b5da530737e5830a6e95e7454d184d94f3ef43f5a82a870dfe96682ede4fe800.exe
File created	C:\Windows\System\fWgsxao.exe	b5da530737e5830a6e95e7454d184d94f3ef43f5a82a870dfe96682ede4fe800.exe
File created	C:\Windows\System\RsoXluw.exe	b5da530737e5830a6e95e7454d184d94f3ef43f5a82a870dfe96682ede4fe800.exe
File created	C:\Windows\System\OpRBenx.exe	b5da530737e5830a6e95e7454d184d94f3ef43f5a82a870dfe96682ede4fe800.exe
File created	C:\Windows\System\MbIpRKj.exe	b5da530737e5830a6e95e7454d184d94f3ef43f5a82a870dfe96682ede4fe800.exe
File created	C:\Windows\System\YxkqzkX.exe	b5da530737e5830a6e95e7454d184d94f3ef43f5a82a870dfe96682ede4fe800.exe
File created	C:\Windows\System\TjUbtGi.exe	b5da530737e5830a6e95e7454d184d94f3ef43f5a82a870dfe96682ede4fe800.exe
File created	C:\Windows\System\JoGkHvt.exe	b5da530737e5830a6e95e7454d184d94f3ef43f5a82a870dfe96682ede4fe800.exe
File created	C:\Windows\System\GoqMGvF.exe	b5da530737e5830a6e95e7454d184d94f3ef43f5a82a870dfe96682ede4fe800.exe
File created	C:\Windows\System\lJzSnIU.exe	b5da530737e5830a6e95e7454d184d94f3ef43f5a82a870dfe96682ede4fe800.exe
File created	C:\Windows\System\OaqPQUx.exe	b5da530737e5830a6e95e7454d184d94f3ef43f5a82a870dfe96682ede4fe800.exe
File created	C:\Windows\System\EZKiaHO.exe	b5da530737e5830a6e95e7454d184d94f3ef43f5a82a870dfe96682ede4fe800.exe
File created	C:\Windows\System\JyYGsQB.exe	b5da530737e5830a6e95e7454d184d94f3ef43f5a82a870dfe96682ede4fe800.exe
File created	C:\Windows\System\rKoGjJI.exe	b5da530737e5830a6e95e7454d184d94f3ef43f5a82a870dfe96682ede4fe800.exe
File created	C:\Windows\System\mbFucYT.exe	b5da530737e5830a6e95e7454d184d94f3ef43f5a82a870dfe96682ede4fe800.exe
File created	C:\Windows\System\vqjosYt.exe	b5da530737e5830a6e95e7454d184d94f3ef43f5a82a870dfe96682ede4fe800.exe
File created	C:\Windows\System\ezcTXKM.exe	b5da530737e5830a6e95e7454d184d94f3ef43f5a82a870dfe96682ede4fe800.exe
File created	C:\Windows\System\EpOpjbi.exe	b5da530737e5830a6e95e7454d184d94f3ef43f5a82a870dfe96682ede4fe800.exe
File created	C:\Windows\System\DbOmuDv.exe	b5da530737e5830a6e95e7454d184d94f3ef43f5a82a870dfe96682ede4fe800.exe
File created	C:\Windows\System\dmUmqnS.exe	b5da530737e5830a6e95e7454d184d94f3ef43f5a82a870dfe96682ede4fe800.exe
File created	C:\Windows\System\cusspuM.exe	b5da530737e5830a6e95e7454d184d94f3ef43f5a82a870dfe96682ede4fe800.exe
File created	C:\Windows\System\HfkXYAG.exe	b5da530737e5830a6e95e7454d184d94f3ef43f5a82a870dfe96682ede4fe800.exe
File created	C:\Windows\System\JJYpcvB.exe	b5da530737e5830a6e95e7454d184d94f3ef43f5a82a870dfe96682ede4fe800.exe
File created	C:\Windows\System\tRvLeca.exe	b5da530737e5830a6e95e7454d184d94f3ef43f5a82a870dfe96682ede4fe800.exe
File created	C:\Windows\System\xdZvIXu.exe	b5da530737e5830a6e95e7454d184d94f3ef43f5a82a870dfe96682ede4fe800.exe
File created	C:\Windows\System\jHKDzJp.exe	b5da530737e5830a6e95e7454d184d94f3ef43f5a82a870dfe96682ede4fe800.exe
File created	C:\Windows\System\rmetCFB.exe	b5da530737e5830a6e95e7454d184d94f3ef43f5a82a870dfe96682ede4fe800.exe
File created	C:\Windows\System\FRLsSUT.exe	b5da530737e5830a6e95e7454d184d94f3ef43f5a82a870dfe96682ede4fe800.exe
File created	C:\Windows\System\XjDwOUR.exe	b5da530737e5830a6e95e7454d184d94f3ef43f5a82a870dfe96682ede4fe800.exe
File created	C:\Windows\System\pXceQbl.exe	b5da530737e5830a6e95e7454d184d94f3ef43f5a82a870dfe96682ede4fe800.exe
File created	C:\Windows\System\JpJRftt.exe	b5da530737e5830a6e95e7454d184d94f3ef43f5a82a870dfe96682ede4fe800.exe
File created	C:\Windows\System\HYqYDgC.exe	b5da530737e5830a6e95e7454d184d94f3ef43f5a82a870dfe96682ede4fe800.exe
File created	C:\Windows\System\AOIJjir.exe	b5da530737e5830a6e95e7454d184d94f3ef43f5a82a870dfe96682ede4fe800.exe
File created	C:\Windows\System\IqUZhPk.exe	b5da530737e5830a6e95e7454d184d94f3ef43f5a82a870dfe96682ede4fe800.exe
File created	C:\Windows\System\rVSzRNz.exe	b5da530737e5830a6e95e7454d184d94f3ef43f5a82a870dfe96682ede4fe800.exe
File created	C:\Windows\System\mYaMFbT.exe	b5da530737e5830a6e95e7454d184d94f3ef43f5a82a870dfe96682ede4fe800.exe
File created	C:\Windows\System\zPgKsMm.exe	b5da530737e5830a6e95e7454d184d94f3ef43f5a82a870dfe96682ede4fe800.exe
File created	C:\Windows\System\xpyHpwO.exe	b5da530737e5830a6e95e7454d184d94f3ef43f5a82a870dfe96682ede4fe800.exe
File created	C:\Windows\System\yqvaBom.exe	b5da530737e5830a6e95e7454d184d94f3ef43f5a82a870dfe96682ede4fe800.exe
File created	C:\Windows\System\mmoaHBz.exe	b5da530737e5830a6e95e7454d184d94f3ef43f5a82a870dfe96682ede4fe800.exe
File created	C:\Windows\System\todGQnW.exe	b5da530737e5830a6e95e7454d184d94f3ef43f5a82a870dfe96682ede4fe800.exe
File created	C:\Windows\System\nNoZApR.exe	b5da530737e5830a6e95e7454d184d94f3ef43f5a82a870dfe96682ede4fe800.exe
File created	C:\Windows\System\jjxOauy.exe	b5da530737e5830a6e95e7454d184d94f3ef43f5a82a870dfe96682ede4fe800.exe
File created	C:\Windows\System\whxPxuU.exe	b5da530737e5830a6e95e7454d184d94f3ef43f5a82a870dfe96682ede4fe800.exe
File created	C:\Windows\System\UiuIxhj.exe	b5da530737e5830a6e95e7454d184d94f3ef43f5a82a870dfe96682ede4fe800.exe
File created	C:\Windows\System\UJIdaez.exe	b5da530737e5830a6e95e7454d184d94f3ef43f5a82a870dfe96682ede4fe800.exe
File created	C:\Windows\System\qvsGDdo.exe	b5da530737e5830a6e95e7454d184d94f3ef43f5a82a870dfe96682ede4fe800.exe
File created	C:\Windows\System\xdEKTQN.exe	b5da530737e5830a6e95e7454d184d94f3ef43f5a82a870dfe96682ede4fe800.exe
File created	C:\Windows\System\kQxXQUs.exe	b5da530737e5830a6e95e7454d184d94f3ef43f5a82a870dfe96682ede4fe800.exe
File created	C:\Windows\System\hmPuGou.exe	b5da530737e5830a6e95e7454d184d94f3ef43f5a82a870dfe96682ede4fe800.exe
File created	C:\Windows\System\VRVoXMI.exe	b5da530737e5830a6e95e7454d184d94f3ef43f5a82a870dfe96682ede4fe800.exe
File created	C:\Windows\System\UolFLFS.exe	b5da530737e5830a6e95e7454d184d94f3ef43f5a82a870dfe96682ede4fe800.exe
File created	C:\Windows\System\RIjiSQa.exe	b5da530737e5830a6e95e7454d184d94f3ef43f5a82a870dfe96682ede4fe800.exe
File created	C:\Windows\System\PZHhcjt.exe	b5da530737e5830a6e95e7454d184d94f3ef43f5a82a870dfe96682ede4fe800.exe
File created	C:\Windows\System\yDZiBkX.exe	b5da530737e5830a6e95e7454d184d94f3ef43f5a82a870dfe96682ede4fe800.exe
File created	C:\Windows\System\cbTewKW.exe	b5da530737e5830a6e95e7454d184d94f3ef43f5a82a870dfe96682ede4fe800.exe
File created	C:\Windows\System\AfEfedt.exe	b5da530737e5830a6e95e7454d184d94f3ef43f5a82a870dfe96682ede4fe800.exe
File created	C:\Windows\System\ZpQJnFr.exe	b5da530737e5830a6e95e7454d184d94f3ef43f5a82a870dfe96682ede4fe800.exe
File created	C:\Windows\System\YEFrCqv.exe	b5da530737e5830a6e95e7454d184d94f3ef43f5a82a870dfe96682ede4fe800.exe
File created	C:\Windows\System\NULIYcA.exe	b5da530737e5830a6e95e7454d184d94f3ef43f5a82a870dfe96682ede4fe800.exe
File created	C:\Windows\System\DVRrVXu.exe	b5da530737e5830a6e95e7454d184d94f3ef43f5a82a870dfe96682ede4fe800.exe
File created	C:\Windows\System\WNCecXp.exe	b5da530737e5830a6e95e7454d184d94f3ef43f5a82a870dfe96682ede4fe800.exe
File created	C:\Windows\System\LyzhdNw.exe	b5da530737e5830a6e95e7454d184d94f3ef43f5a82a870dfe96682ede4fe800.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	17160	dwm.exe
Token: SeChangeNotifyPrivilege	17160	dwm.exe
Token: 33	17160	dwm.exe
Token: SeIncBasePriorityPrivilege	17160	dwm.exe
Token: SeShutdownPrivilege	17160	dwm.exe
Token: SeCreatePagefilePrivilege	17160	dwm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1164 wrote to memory of 4716	1164	b5da530737e5830a6e95e7454d184d94f3ef43f5a82a870dfe96682ede4fe800.exe	83
PID 1164 wrote to memory of 4716	1164	b5da530737e5830a6e95e7454d184d94f3ef43f5a82a870dfe96682ede4fe800.exe	83
PID 1164 wrote to memory of 3512	1164	b5da530737e5830a6e95e7454d184d94f3ef43f5a82a870dfe96682ede4fe800.exe	84
PID 1164 wrote to memory of 3512	1164	b5da530737e5830a6e95e7454d184d94f3ef43f5a82a870dfe96682ede4fe800.exe	84
PID 1164 wrote to memory of 3468	1164	b5da530737e5830a6e95e7454d184d94f3ef43f5a82a870dfe96682ede4fe800.exe	85
PID 1164 wrote to memory of 3468	1164	b5da530737e5830a6e95e7454d184d94f3ef43f5a82a870dfe96682ede4fe800.exe	85
PID 1164 wrote to memory of 3848	1164	b5da530737e5830a6e95e7454d184d94f3ef43f5a82a870dfe96682ede4fe800.exe	86
PID 1164 wrote to memory of 3848	1164	b5da530737e5830a6e95e7454d184d94f3ef43f5a82a870dfe96682ede4fe800.exe	86
PID 1164 wrote to memory of 4408	1164	b5da530737e5830a6e95e7454d184d94f3ef43f5a82a870dfe96682ede4fe800.exe	87
PID 1164 wrote to memory of 4408	1164	b5da530737e5830a6e95e7454d184d94f3ef43f5a82a870dfe96682ede4fe800.exe	87
PID 1164 wrote to memory of 528	1164	b5da530737e5830a6e95e7454d184d94f3ef43f5a82a870dfe96682ede4fe800.exe	88
PID 1164 wrote to memory of 528	1164	b5da530737e5830a6e95e7454d184d94f3ef43f5a82a870dfe96682ede4fe800.exe	88
PID 1164 wrote to memory of 220	1164	b5da530737e5830a6e95e7454d184d94f3ef43f5a82a870dfe96682ede4fe800.exe	89
PID 1164 wrote to memory of 220	1164	b5da530737e5830a6e95e7454d184d94f3ef43f5a82a870dfe96682ede4fe800.exe	89
PID 1164 wrote to memory of 1464	1164	b5da530737e5830a6e95e7454d184d94f3ef43f5a82a870dfe96682ede4fe800.exe	90
PID 1164 wrote to memory of 1464	1164	b5da530737e5830a6e95e7454d184d94f3ef43f5a82a870dfe96682ede4fe800.exe	90
PID 1164 wrote to memory of 5084	1164	b5da530737e5830a6e95e7454d184d94f3ef43f5a82a870dfe96682ede4fe800.exe	91
PID 1164 wrote to memory of 5084	1164	b5da530737e5830a6e95e7454d184d94f3ef43f5a82a870dfe96682ede4fe800.exe	91
PID 1164 wrote to memory of 4300	1164	b5da530737e5830a6e95e7454d184d94f3ef43f5a82a870dfe96682ede4fe800.exe	92
PID 1164 wrote to memory of 4300	1164	b5da530737e5830a6e95e7454d184d94f3ef43f5a82a870dfe96682ede4fe800.exe	92
PID 1164 wrote to memory of 1032	1164	b5da530737e5830a6e95e7454d184d94f3ef43f5a82a870dfe96682ede4fe800.exe	93
PID 1164 wrote to memory of 1032	1164	b5da530737e5830a6e95e7454d184d94f3ef43f5a82a870dfe96682ede4fe800.exe	93
PID 1164 wrote to memory of 4136	1164	b5da530737e5830a6e95e7454d184d94f3ef43f5a82a870dfe96682ede4fe800.exe	94
PID 1164 wrote to memory of 4136	1164	b5da530737e5830a6e95e7454d184d94f3ef43f5a82a870dfe96682ede4fe800.exe	94
PID 1164 wrote to memory of 4296	1164	b5da530737e5830a6e95e7454d184d94f3ef43f5a82a870dfe96682ede4fe800.exe	95
PID 1164 wrote to memory of 4296	1164	b5da530737e5830a6e95e7454d184d94f3ef43f5a82a870dfe96682ede4fe800.exe	95
PID 1164 wrote to memory of 1028	1164	b5da530737e5830a6e95e7454d184d94f3ef43f5a82a870dfe96682ede4fe800.exe	96
PID 1164 wrote to memory of 1028	1164	b5da530737e5830a6e95e7454d184d94f3ef43f5a82a870dfe96682ede4fe800.exe	96
PID 1164 wrote to memory of 4552	1164	b5da530737e5830a6e95e7454d184d94f3ef43f5a82a870dfe96682ede4fe800.exe	97
PID 1164 wrote to memory of 4552	1164	b5da530737e5830a6e95e7454d184d94f3ef43f5a82a870dfe96682ede4fe800.exe	97
PID 1164 wrote to memory of 3652	1164	b5da530737e5830a6e95e7454d184d94f3ef43f5a82a870dfe96682ede4fe800.exe	98
PID 1164 wrote to memory of 3652	1164	b5da530737e5830a6e95e7454d184d94f3ef43f5a82a870dfe96682ede4fe800.exe	98
PID 1164 wrote to memory of 4648	1164	b5da530737e5830a6e95e7454d184d94f3ef43f5a82a870dfe96682ede4fe800.exe	99
PID 1164 wrote to memory of 4648	1164	b5da530737e5830a6e95e7454d184d94f3ef43f5a82a870dfe96682ede4fe800.exe	99
PID 1164 wrote to memory of 2188	1164	b5da530737e5830a6e95e7454d184d94f3ef43f5a82a870dfe96682ede4fe800.exe	100
PID 1164 wrote to memory of 2188	1164	b5da530737e5830a6e95e7454d184d94f3ef43f5a82a870dfe96682ede4fe800.exe	100
PID 1164 wrote to memory of 888	1164	b5da530737e5830a6e95e7454d184d94f3ef43f5a82a870dfe96682ede4fe800.exe	101
PID 1164 wrote to memory of 888	1164	b5da530737e5830a6e95e7454d184d94f3ef43f5a82a870dfe96682ede4fe800.exe	101
PID 1164 wrote to memory of 3664	1164	b5da530737e5830a6e95e7454d184d94f3ef43f5a82a870dfe96682ede4fe800.exe	102
PID 1164 wrote to memory of 3664	1164	b5da530737e5830a6e95e7454d184d94f3ef43f5a82a870dfe96682ede4fe800.exe	102
PID 1164 wrote to memory of 4488	1164	b5da530737e5830a6e95e7454d184d94f3ef43f5a82a870dfe96682ede4fe800.exe	103
PID 1164 wrote to memory of 4488	1164	b5da530737e5830a6e95e7454d184d94f3ef43f5a82a870dfe96682ede4fe800.exe	103
PID 1164 wrote to memory of 2528	1164	b5da530737e5830a6e95e7454d184d94f3ef43f5a82a870dfe96682ede4fe800.exe	104
PID 1164 wrote to memory of 2528	1164	b5da530737e5830a6e95e7454d184d94f3ef43f5a82a870dfe96682ede4fe800.exe	104
PID 1164 wrote to memory of 1980	1164	b5da530737e5830a6e95e7454d184d94f3ef43f5a82a870dfe96682ede4fe800.exe	105
PID 1164 wrote to memory of 1980	1164	b5da530737e5830a6e95e7454d184d94f3ef43f5a82a870dfe96682ede4fe800.exe	105
PID 1164 wrote to memory of 3948	1164	b5da530737e5830a6e95e7454d184d94f3ef43f5a82a870dfe96682ede4fe800.exe	106
PID 1164 wrote to memory of 3948	1164	b5da530737e5830a6e95e7454d184d94f3ef43f5a82a870dfe96682ede4fe800.exe	106
PID 1164 wrote to memory of 2884	1164	b5da530737e5830a6e95e7454d184d94f3ef43f5a82a870dfe96682ede4fe800.exe	107
PID 1164 wrote to memory of 2884	1164	b5da530737e5830a6e95e7454d184d94f3ef43f5a82a870dfe96682ede4fe800.exe	107
PID 1164 wrote to memory of 2208	1164	b5da530737e5830a6e95e7454d184d94f3ef43f5a82a870dfe96682ede4fe800.exe	108
PID 1164 wrote to memory of 2208	1164	b5da530737e5830a6e95e7454d184d94f3ef43f5a82a870dfe96682ede4fe800.exe	108
PID 1164 wrote to memory of 4756	1164	b5da530737e5830a6e95e7454d184d94f3ef43f5a82a870dfe96682ede4fe800.exe	109
PID 1164 wrote to memory of 4756	1164	b5da530737e5830a6e95e7454d184d94f3ef43f5a82a870dfe96682ede4fe800.exe	109
PID 1164 wrote to memory of 916	1164	b5da530737e5830a6e95e7454d184d94f3ef43f5a82a870dfe96682ede4fe800.exe	110
PID 1164 wrote to memory of 916	1164	b5da530737e5830a6e95e7454d184d94f3ef43f5a82a870dfe96682ede4fe800.exe	110
PID 1164 wrote to memory of 4100	1164	b5da530737e5830a6e95e7454d184d94f3ef43f5a82a870dfe96682ede4fe800.exe	111
PID 1164 wrote to memory of 4100	1164	b5da530737e5830a6e95e7454d184d94f3ef43f5a82a870dfe96682ede4fe800.exe	111
PID 1164 wrote to memory of 2664	1164	b5da530737e5830a6e95e7454d184d94f3ef43f5a82a870dfe96682ede4fe800.exe	112
PID 1164 wrote to memory of 2664	1164	b5da530737e5830a6e95e7454d184d94f3ef43f5a82a870dfe96682ede4fe800.exe	112
PID 1164 wrote to memory of 5040	1164	b5da530737e5830a6e95e7454d184d94f3ef43f5a82a870dfe96682ede4fe800.exe	113
PID 1164 wrote to memory of 5040	1164	b5da530737e5830a6e95e7454d184d94f3ef43f5a82a870dfe96682ede4fe800.exe	113
PID 1164 wrote to memory of 1692	1164	b5da530737e5830a6e95e7454d184d94f3ef43f5a82a870dfe96682ede4fe800.exe	114
PID 1164 wrote to memory of 1692	1164	b5da530737e5830a6e95e7454d184d94f3ef43f5a82a870dfe96682ede4fe800.exe	114

C:\Users\Admin\AppData\Local\Temp\b5da530737e5830a6e95e7454d184d94f3ef43f5a82a870dfe96682ede4fe800.exe
"C:\Users\Admin\AppData\Local\Temp\b5da530737e5830a6e95e7454d184d94f3ef43f5a82a870dfe96682ede4fe800.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1164
- C:\Windows\System\JyYGsQB.exe
  C:\Windows\System\JyYGsQB.exe
  2⤵
  - Executes dropped EXE
  PID:4716
- C:\Windows\System\fcherPD.exe
  C:\Windows\System\fcherPD.exe
  2⤵
  - Executes dropped EXE
  PID:3512
- C:\Windows\System\OzbwIGN.exe
  C:\Windows\System\OzbwIGN.exe
  2⤵
  - Executes dropped EXE
  PID:3468
- C:\Windows\System\hTVqKGb.exe
  C:\Windows\System\hTVqKGb.exe
  2⤵
  - Executes dropped EXE
  PID:3848
- C:\Windows\System\AuaUgkr.exe
  C:\Windows\System\AuaUgkr.exe
  2⤵
  - Executes dropped EXE
  PID:4408
- C:\Windows\System\dsJavqN.exe
  C:\Windows\System\dsJavqN.exe
  2⤵
  - Executes dropped EXE
  PID:528
- C:\Windows\System\qNdwSRM.exe
  C:\Windows\System\qNdwSRM.exe
  2⤵
  - Executes dropped EXE
  PID:220
- C:\Windows\System\UvSBpcC.exe
  C:\Windows\System\UvSBpcC.exe
  2⤵
  - Executes dropped EXE
  PID:1464
- C:\Windows\System\aVdIKlW.exe
  C:\Windows\System\aVdIKlW.exe
  2⤵
  - Executes dropped EXE
  PID:5084
- C:\Windows\System\EERQUHO.exe
  C:\Windows\System\EERQUHO.exe
  2⤵
  - Executes dropped EXE
  PID:4300
- C:\Windows\System\qFZLpCg.exe
  C:\Windows\System\qFZLpCg.exe
  2⤵
  - Executes dropped EXE
  PID:1032
- C:\Windows\System\xRkfUQQ.exe
  C:\Windows\System\xRkfUQQ.exe
  2⤵
  - Executes dropped EXE
  PID:4136
- C:\Windows\System\JpJRftt.exe
  C:\Windows\System\JpJRftt.exe
  2⤵
  - Executes dropped EXE
  PID:4296
- C:\Windows\System\DEBckdj.exe
  C:\Windows\System\DEBckdj.exe
  2⤵
  - Executes dropped EXE
  PID:1028
- C:\Windows\System\QmpAyAM.exe
  C:\Windows\System\QmpAyAM.exe
  2⤵
  - Executes dropped EXE
  PID:4552
- C:\Windows\System\gdSSYFX.exe
  C:\Windows\System\gdSSYFX.exe
  2⤵
  - Executes dropped EXE
  PID:3652
- C:\Windows\System\DeQbGyx.exe
  C:\Windows\System\DeQbGyx.exe
  2⤵
  - Executes dropped EXE
  PID:4648
- C:\Windows\System\OEXYbmj.exe
  C:\Windows\System\OEXYbmj.exe
  2⤵
  - Executes dropped EXE
  PID:2188
- C:\Windows\System\lmiVThs.exe
  C:\Windows\System\lmiVThs.exe
  2⤵
  - Executes dropped EXE
  PID:888
- C:\Windows\System\NakUdHc.exe
  C:\Windows\System\NakUdHc.exe
  2⤵
  - Executes dropped EXE
  PID:3664
- C:\Windows\System\kWVSiHb.exe
  C:\Windows\System\kWVSiHb.exe
  2⤵
  - Executes dropped EXE
  PID:4488
- C:\Windows\System\KMpwOFg.exe
  C:\Windows\System\KMpwOFg.exe
  2⤵
  - Executes dropped EXE
  PID:2528
- C:\Windows\System\Idhroak.exe
  C:\Windows\System\Idhroak.exe
  2⤵
  - Executes dropped EXE
  PID:1980
- C:\Windows\System\SJjsKjV.exe
  C:\Windows\System\SJjsKjV.exe
  2⤵
  - Executes dropped EXE
  PID:3948
- C:\Windows\System\CxhkcgE.exe
  C:\Windows\System\CxhkcgE.exe
  2⤵
  - Executes dropped EXE
  PID:2884
- C:\Windows\System\mBsyzVt.exe
  C:\Windows\System\mBsyzVt.exe
  2⤵
  - Executes dropped EXE
  PID:2208
- C:\Windows\System\KMBFOdT.exe
  C:\Windows\System\KMBFOdT.exe
  2⤵
  - Executes dropped EXE
  PID:4756
- C:\Windows\System\PhLpcCB.exe
  C:\Windows\System\PhLpcCB.exe
  2⤵
  - Executes dropped EXE
  PID:916
- C:\Windows\System\TcMujmZ.exe
  C:\Windows\System\TcMujmZ.exe
  2⤵
  - Executes dropped EXE
  PID:4100
- C:\Windows\System\EXPtnbQ.exe
  C:\Windows\System\EXPtnbQ.exe
  2⤵
  - Executes dropped EXE
  PID:2664
- C:\Windows\System\SyKTfpZ.exe
  C:\Windows\System\SyKTfpZ.exe
  2⤵
  - Executes dropped EXE
  PID:5040
- C:\Windows\System\jmPVwUq.exe
  C:\Windows\System\jmPVwUq.exe
  2⤵
  - Executes dropped EXE
  PID:1692
- C:\Windows\System\ekXQEZp.exe
  C:\Windows\System\ekXQEZp.exe
  2⤵
  - Executes dropped EXE
  PID:2708
- C:\Windows\System\UGUrbsI.exe
  C:\Windows\System\UGUrbsI.exe
  2⤵
  - Executes dropped EXE
  PID:4936
- C:\Windows\System\GSlzcuA.exe
  C:\Windows\System\GSlzcuA.exe
  2⤵
  - Executes dropped EXE
  PID:3580
- C:\Windows\System\qqNwXlU.exe
  C:\Windows\System\qqNwXlU.exe
  2⤵
  - Executes dropped EXE
  PID:760
- C:\Windows\System\HLjTWBU.exe
  C:\Windows\System\HLjTWBU.exe
  2⤵
  - Executes dropped EXE
  PID:5024
- C:\Windows\System\eNYgEoN.exe
  C:\Windows\System\eNYgEoN.exe
  2⤵
  - Executes dropped EXE
  PID:4348
- C:\Windows\System\gxoHQbf.exe
  C:\Windows\System\gxoHQbf.exe
  2⤵
  - Executes dropped EXE
  PID:2172
- C:\Windows\System\VXVTkNH.exe
  C:\Windows\System\VXVTkNH.exe
  2⤵
  - Executes dropped EXE
  PID:4568
- C:\Windows\System\rKoGjJI.exe
  C:\Windows\System\rKoGjJI.exe
  2⤵
  - Executes dropped EXE
  PID:2712
- C:\Windows\System\JoGkHvt.exe
  C:\Windows\System\JoGkHvt.exe
  2⤵
  - Executes dropped EXE
  PID:4948
- C:\Windows\System\ReGerER.exe
  C:\Windows\System\ReGerER.exe
  2⤵
  - Executes dropped EXE
  PID:3520
- C:\Windows\System\BrRSUdz.exe
  C:\Windows\System\BrRSUdz.exe
  2⤵
  - Executes dropped EXE
  PID:2040
- C:\Windows\System\eRnuZgP.exe
  C:\Windows\System\eRnuZgP.exe
  2⤵
  - Executes dropped EXE
  PID:5000
- C:\Windows\System\IXggazo.exe
  C:\Windows\System\IXggazo.exe
  2⤵
  - Executes dropped EXE
  PID:3196
- C:\Windows\System\wALJGpO.exe
  C:\Windows\System\wALJGpO.exe
  2⤵
  - Executes dropped EXE
  PID:2628
- C:\Windows\System\lwlurtM.exe
  C:\Windows\System\lwlurtM.exe
  2⤵
  - Executes dropped EXE
  PID:3692
- C:\Windows\System\qZfEGIN.exe
  C:\Windows\System\qZfEGIN.exe
  2⤵
  - Executes dropped EXE
  PID:2584
- C:\Windows\System\qkNSjJL.exe
  C:\Windows\System\qkNSjJL.exe
  2⤵
  - Executes dropped EXE
  PID:3012
- C:\Windows\System\mbFucYT.exe
  C:\Windows\System\mbFucYT.exe
  2⤵
  - Executes dropped EXE
  PID:3004
- C:\Windows\System\CzBVfhB.exe
  C:\Windows\System\CzBVfhB.exe
  2⤵
  - Executes dropped EXE
  PID:3620
- C:\Windows\System\CxpgjDW.exe
  C:\Windows\System\CxpgjDW.exe
  2⤵
  - Executes dropped EXE
  PID:2552
- C:\Windows\System\hysNuUP.exe
  C:\Windows\System\hysNuUP.exe
  2⤵
  - Executes dropped EXE
  PID:1856
- C:\Windows\System\xNVcKLi.exe
  C:\Windows\System\xNVcKLi.exe
  2⤵
  - Executes dropped EXE
  PID:1548
- C:\Windows\System\nOaLmVe.exe
  C:\Windows\System\nOaLmVe.exe
  2⤵
  - Executes dropped EXE
  PID:3408
- C:\Windows\System\IwjBrRI.exe
  C:\Windows\System\IwjBrRI.exe
  2⤵
  - Executes dropped EXE
  PID:3972
- C:\Windows\System\VLTAlDl.exe
  C:\Windows\System\VLTAlDl.exe
  2⤵
  - Executes dropped EXE
  PID:1208
- C:\Windows\System\DjsyrBu.exe
  C:\Windows\System\DjsyrBu.exe
  2⤵
  - Executes dropped EXE
  PID:4264
- C:\Windows\System\gFjcLlK.exe
  C:\Windows\System\gFjcLlK.exe
  2⤵
  - Executes dropped EXE
  PID:4352
- C:\Windows\System\XFyYGPd.exe
  C:\Windows\System\XFyYGPd.exe
  2⤵
  - Executes dropped EXE
  PID:4680
- C:\Windows\System\stGSQRl.exe
  C:\Windows\System\stGSQRl.exe
  2⤵
  - Executes dropped EXE
  PID:3888
- C:\Windows\System\tIUnvQX.exe
  C:\Windows\System\tIUnvQX.exe
  2⤵
  - Executes dropped EXE
  PID:4724
- C:\Windows\System\kcNLfTJ.exe
  C:\Windows\System\kcNLfTJ.exe
  2⤵
  - Executes dropped EXE
  PID:4148
- C:\Windows\System\JdQhQeG.exe
  C:\Windows\System\JdQhQeG.exe
  2⤵
  PID:1700
- C:\Windows\System\xUvbVWw.exe
  C:\Windows\System\xUvbVWw.exe
  2⤵
  PID:3672
- C:\Windows\System\aMXZTmJ.exe
  C:\Windows\System\aMXZTmJ.exe
  2⤵
  PID:4228
- C:\Windows\System\BYicsVV.exe
  C:\Windows\System\BYicsVV.exe
  2⤵
  PID:3660
- C:\Windows\System\cusspuM.exe
  C:\Windows\System\cusspuM.exe
  2⤵
  PID:2924
- C:\Windows\System\lxkVwSl.exe
  C:\Windows\System\lxkVwSl.exe
  2⤵
  PID:872
- C:\Windows\System\cTkoZDk.exe
  C:\Windows\System\cTkoZDk.exe
  2⤵
  PID:1872
- C:\Windows\System\glPywgO.exe
  C:\Windows\System\glPywgO.exe
  2⤵
  PID:4164
- C:\Windows\System\LoWkQdA.exe
  C:\Windows\System\LoWkQdA.exe
  2⤵
  PID:868
- C:\Windows\System\MdwRSAj.exe
  C:\Windows\System\MdwRSAj.exe
  2⤵
  PID:1504
- C:\Windows\System\QNCAmJU.exe
  C:\Windows\System\QNCAmJU.exe
  2⤵
  PID:1140
- C:\Windows\System\OgiXnCe.exe
  C:\Windows\System\OgiXnCe.exe
  2⤵
  PID:1108
- C:\Windows\System\ygepZoz.exe
  C:\Windows\System\ygepZoz.exe
  2⤵
  PID:3548
- C:\Windows\System\jelTctL.exe
  C:\Windows\System\jelTctL.exe
  2⤵
  PID:1528
- C:\Windows\System\QLgPFFW.exe
  C:\Windows\System\QLgPFFW.exe
  2⤵
  PID:4252
- C:\Windows\System\YMCBRGE.exe
  C:\Windows\System\YMCBRGE.exe
  2⤵
  PID:2624
- C:\Windows\System\ZFeBnNY.exe
  C:\Windows\System\ZFeBnNY.exe
  2⤵
  PID:816
- C:\Windows\System\NZGycHM.exe
  C:\Windows\System\NZGycHM.exe
  2⤵
  PID:4788
- C:\Windows\System\QCuASsu.exe
  C:\Windows\System\QCuASsu.exe
  2⤵
  PID:2888
- C:\Windows\System\CReLOVd.exe
  C:\Windows\System\CReLOVd.exe
  2⤵
  PID:4832
- C:\Windows\System\hiHFpBm.exe
  C:\Windows\System\hiHFpBm.exe
  2⤵
  PID:4992
- C:\Windows\System\kSnSFRN.exe
  C:\Windows\System\kSnSFRN.exe
  2⤵
  PID:224
- C:\Windows\System\pQcoRFS.exe
  C:\Windows\System\pQcoRFS.exe
  2⤵
  PID:1800
- C:\Windows\System\vcKBxUF.exe
  C:\Windows\System\vcKBxUF.exe
  2⤵
  PID:2288
- C:\Windows\System\GuScIeA.exe
  C:\Windows\System\GuScIeA.exe
  2⤵
  PID:1056
- C:\Windows\System\AppMxgD.exe
  C:\Windows\System\AppMxgD.exe
  2⤵
  PID:432
- C:\Windows\System\yCETouQ.exe
  C:\Windows\System\yCETouQ.exe
  2⤵
  PID:5064
- C:\Windows\System\PGxemxh.exe
  C:\Windows\System\PGxemxh.exe
  2⤵
  PID:4232
- C:\Windows\System\WLOKxbH.exe
  C:\Windows\System\WLOKxbH.exe
  2⤵
  PID:5144
- C:\Windows\System\IRmsEJi.exe
  C:\Windows\System\IRmsEJi.exe
  2⤵
  PID:5172
- C:\Windows\System\FfHGfHF.exe
  C:\Windows\System\FfHGfHF.exe
  2⤵
  PID:5200
- C:\Windows\System\HBjEnFa.exe
  C:\Windows\System\HBjEnFa.exe
  2⤵
  PID:5224
- C:\Windows\System\VpLAMPD.exe
  C:\Windows\System\VpLAMPD.exe
  2⤵
  PID:5256
- C:\Windows\System\KSnHyVf.exe
  C:\Windows\System\KSnHyVf.exe
  2⤵
  PID:5284
- C:\Windows\System\rruKjjm.exe
  C:\Windows\System\rruKjjm.exe
  2⤵
  PID:5312
- C:\Windows\System\xpyHpwO.exe
  C:\Windows\System\xpyHpwO.exe
  2⤵
  PID:5336
- C:\Windows\System\dVQfZRo.exe
  C:\Windows\System\dVQfZRo.exe
  2⤵
  PID:5368
- C:\Windows\System\mZTRNvC.exe
  C:\Windows\System\mZTRNvC.exe
  2⤵
  PID:5396
- C:\Windows\System\jsJvdyp.exe
  C:\Windows\System\jsJvdyp.exe
  2⤵
  PID:5424
- C:\Windows\System\dxrfVuZ.exe
  C:\Windows\System\dxrfVuZ.exe
  2⤵
  PID:5448
- C:\Windows\System\ZzHpDeZ.exe
  C:\Windows\System\ZzHpDeZ.exe
  2⤵
  PID:5484
- C:\Windows\System\vjTdwbh.exe
  C:\Windows\System\vjTdwbh.exe
  2⤵
  PID:5508
- C:\Windows\System\ZMhMDGk.exe
  C:\Windows\System\ZMhMDGk.exe
  2⤵
  PID:5532
- C:\Windows\System\vPYOqxL.exe
  C:\Windows\System\vPYOqxL.exe
  2⤵
  PID:5560
- C:\Windows\System\DzdHAgX.exe
  C:\Windows\System\DzdHAgX.exe
  2⤵
  PID:5592
- C:\Windows\System\tBlKfRC.exe
  C:\Windows\System\tBlKfRC.exe
  2⤵
  PID:5616
- C:\Windows\System\EbdtamF.exe
  C:\Windows\System\EbdtamF.exe
  2⤵
  PID:5648
- C:\Windows\System\HAvCqNx.exe
  C:\Windows\System\HAvCqNx.exe
  2⤵
  PID:5676
- C:\Windows\System\gPZPjLN.exe
  C:\Windows\System\gPZPjLN.exe
  2⤵
  PID:5704
- C:\Windows\System\JZKCCLB.exe
  C:\Windows\System\JZKCCLB.exe
  2⤵
  PID:5728
- C:\Windows\System\dPKrxEz.exe
  C:\Windows\System\dPKrxEz.exe
  2⤵
  PID:5760
- C:\Windows\System\KJyWkvz.exe
  C:\Windows\System\KJyWkvz.exe
  2⤵
  PID:5824
- C:\Windows\System\NgWbtAp.exe
  C:\Windows\System\NgWbtAp.exe
  2⤵
  PID:5840
- C:\Windows\System\TjSdVgt.exe
  C:\Windows\System\TjSdVgt.exe
  2⤵
  PID:5856
- C:\Windows\System\XhGcpAb.exe
  C:\Windows\System\XhGcpAb.exe
  2⤵
  PID:5880
- C:\Windows\System\AVRvGnz.exe
  C:\Windows\System\AVRvGnz.exe
  2⤵
  PID:5908
- C:\Windows\System\JClpZhT.exe
  C:\Windows\System\JClpZhT.exe
  2⤵
  PID:5940
- C:\Windows\System\BVTmihe.exe
  C:\Windows\System\BVTmihe.exe
  2⤵
  PID:5964
- C:\Windows\System\yrpAwJh.exe
  C:\Windows\System\yrpAwJh.exe
  2⤵
  PID:5992
- C:\Windows\System\hnCkibo.exe
  C:\Windows\System\hnCkibo.exe
  2⤵
  PID:6024
- C:\Windows\System\KkhFdNp.exe
  C:\Windows\System\KkhFdNp.exe
  2⤵
  PID:6052
- C:\Windows\System\NAHpHcG.exe
  C:\Windows\System\NAHpHcG.exe
  2⤵
  PID:6076
- C:\Windows\System\rUhMHaL.exe
  C:\Windows\System\rUhMHaL.exe
  2⤵
  PID:6104
- C:\Windows\System\BhwSgHB.exe
  C:\Windows\System\BhwSgHB.exe
  2⤵
  PID:6132
- C:\Windows\System\XZnOUot.exe
  C:\Windows\System\XZnOUot.exe
  2⤵
  PID:1516
- C:\Windows\System\bEjaxkk.exe
  C:\Windows\System\bEjaxkk.exe
  2⤵
  PID:4180
- C:\Windows\System\PllWvYt.exe
  C:\Windows\System\PllWvYt.exe
  2⤵
  PID:1232
- C:\Windows\System\TOLVisb.exe
  C:\Windows\System\TOLVisb.exe
  2⤵
  PID:4976
- C:\Windows\System\FzvZHEb.exe
  C:\Windows\System\FzvZHEb.exe
  2⤵
  PID:3912
- C:\Windows\System\DIHrnlL.exe
  C:\Windows\System\DIHrnlL.exe
  2⤵
  PID:408
- C:\Windows\System\vqjosYt.exe
  C:\Windows\System\vqjosYt.exe
  2⤵
  PID:3736
- C:\Windows\System\QjGRptl.exe
  C:\Windows\System\QjGRptl.exe
  2⤵
  PID:5136
- C:\Windows\System\KCmiDIn.exe
  C:\Windows\System\KCmiDIn.exe
  2⤵
  PID:5208
- C:\Windows\System\ECwyJbu.exe
  C:\Windows\System\ECwyJbu.exe
  2⤵
  PID:5272
- C:\Windows\System\exbGqKm.exe
  C:\Windows\System\exbGqKm.exe
  2⤵
  PID:5328
- C:\Windows\System\lJzSnIU.exe
  C:\Windows\System\lJzSnIU.exe
  2⤵
  PID:5388
- C:\Windows\System\USYRStl.exe
  C:\Windows\System\USYRStl.exe
  2⤵
  PID:5460
- C:\Windows\System\ZpQJnFr.exe
  C:\Windows\System\ZpQJnFr.exe
  2⤵
  PID:4388
- C:\Windows\System\nNBsQtx.exe
  C:\Windows\System\nNBsQtx.exe
  2⤵
  PID:5580
- C:\Windows\System\nyaiLoV.exe
  C:\Windows\System\nyaiLoV.exe
  2⤵
  PID:5636
- C:\Windows\System\muEudcU.exe
  C:\Windows\System\muEudcU.exe
  2⤵
  PID:5712
- C:\Windows\System\XWLUYeX.exe
  C:\Windows\System\XWLUYeX.exe
  2⤵
  PID:5776
- C:\Windows\System\gmXEchU.exe
  C:\Windows\System\gmXEchU.exe
  2⤵
  PID:5848
- C:\Windows\System\RqPBkvj.exe
  C:\Windows\System\RqPBkvj.exe
  2⤵
  PID:5900
- C:\Windows\System\anzxqoI.exe
  C:\Windows\System\anzxqoI.exe
  2⤵
  PID:5960
- C:\Windows\System\FJwYwWQ.exe
  C:\Windows\System\FJwYwWQ.exe
  2⤵
  PID:6016
- C:\Windows\System\YtCkusp.exe
  C:\Windows\System\YtCkusp.exe
  2⤵
  PID:6072
- C:\Windows\System\gidExXY.exe
  C:\Windows\System\gidExXY.exe
  2⤵
  PID:1672
- C:\Windows\System\pZmfVHd.exe
  C:\Windows\System\pZmfVHd.exe
  2⤵
  PID:720
- C:\Windows\System\agrmhqb.exe
  C:\Windows\System\agrmhqb.exe
  2⤵
  PID:2652
- C:\Windows\System\akwSctT.exe
  C:\Windows\System\akwSctT.exe
  2⤵
  PID:1680
- C:\Windows\System\ykqlMpR.exe
  C:\Windows\System\ykqlMpR.exe
  2⤵
  PID:5188
- C:\Windows\System\gymCJJl.exe
  C:\Windows\System\gymCJJl.exe
  2⤵
  PID:5352
- C:\Windows\System\qataVPZ.exe
  C:\Windows\System\qataVPZ.exe
  2⤵
  PID:5440
- C:\Windows\System\CNgYjoR.exe
  C:\Windows\System\CNgYjoR.exe
  2⤵
  PID:5552
- C:\Windows\System\HfkXYAG.exe
  C:\Windows\System\HfkXYAG.exe
  2⤵
  PID:5812
- C:\Windows\System\uhRTkZX.exe
  C:\Windows\System\uhRTkZX.exe
  2⤵
  PID:5952
- C:\Windows\System\oevsnXA.exe
  C:\Windows\System\oevsnXA.exe
  2⤵
  PID:6064
- C:\Windows\System\XQkVVyH.exe
  C:\Windows\System\XQkVVyH.exe
  2⤵
  PID:6120
- C:\Windows\System\LSKlzvx.exe
  C:\Windows\System\LSKlzvx.exe
  2⤵
  PID:4200
- C:\Windows\System\MvmUDLI.exe
  C:\Windows\System\MvmUDLI.exe
  2⤵
  PID:6164
- C:\Windows\System\TjtskDc.exe
  C:\Windows\System\TjtskDc.exe
  2⤵
  PID:6192
- C:\Windows\System\wkhKGNE.exe
  C:\Windows\System\wkhKGNE.exe
  2⤵
  PID:6220
- C:\Windows\System\RmefnQm.exe
  C:\Windows\System\RmefnQm.exe
  2⤵
  PID:6248
- C:\Windows\System\ldkCEXP.exe
  C:\Windows\System\ldkCEXP.exe
  2⤵
  PID:6276
- C:\Windows\System\RCqzKAI.exe
  C:\Windows\System\RCqzKAI.exe
  2⤵
  PID:6304
- C:\Windows\System\ONRmWVa.exe
  C:\Windows\System\ONRmWVa.exe
  2⤵
  PID:6332
- C:\Windows\System\TtSgotk.exe
  C:\Windows\System\TtSgotk.exe
  2⤵
  PID:6360
- C:\Windows\System\JdYWSCm.exe
  C:\Windows\System\JdYWSCm.exe
  2⤵
  PID:6388
- C:\Windows\System\sBRHkSO.exe
  C:\Windows\System\sBRHkSO.exe
  2⤵
  PID:6412
- C:\Windows\System\OAOchew.exe
  C:\Windows\System\OAOchew.exe
  2⤵
  PID:6440
- C:\Windows\System\xtuqASh.exe
  C:\Windows\System\xtuqASh.exe
  2⤵
  PID:6468
- C:\Windows\System\cbTewKW.exe
  C:\Windows\System\cbTewKW.exe
  2⤵
  PID:6500
- C:\Windows\System\EFDHquS.exe
  C:\Windows\System\EFDHquS.exe
  2⤵
  PID:6524
- C:\Windows\System\NHHdsCS.exe
  C:\Windows\System\NHHdsCS.exe
  2⤵
  PID:6556
- C:\Windows\System\MQbBFlB.exe
  C:\Windows\System\MQbBFlB.exe
  2⤵
  PID:6580
- C:\Windows\System\XCwDlmH.exe
  C:\Windows\System\XCwDlmH.exe
  2⤵
  PID:6608
- C:\Windows\System\LFLIIFJ.exe
  C:\Windows\System\LFLIIFJ.exe
  2⤵
  PID:6696
- C:\Windows\System\sSSkYRE.exe
  C:\Windows\System\sSSkYRE.exe
  2⤵
  PID:6724
- C:\Windows\System\JzSjors.exe
  C:\Windows\System\JzSjors.exe
  2⤵
  PID:6740
- C:\Windows\System\puHLMDL.exe
  C:\Windows\System\puHLMDL.exe
  2⤵
  PID:6776
- C:\Windows\System\mBUBSZa.exe
  C:\Windows\System\mBUBSZa.exe
  2⤵
  PID:6804
- C:\Windows\System\QOgzfDU.exe
  C:\Windows\System\QOgzfDU.exe
  2⤵
  PID:6832
- C:\Windows\System\pqUWysc.exe
  C:\Windows\System\pqUWysc.exe
  2⤵
  PID:6868
- C:\Windows\System\knhEmMl.exe
  C:\Windows\System\knhEmMl.exe
  2⤵
  PID:6900
- C:\Windows\System\fuHuKUT.exe
  C:\Windows\System\fuHuKUT.exe
  2⤵
  PID:6924
- C:\Windows\System\jiZOTPY.exe
  C:\Windows\System\jiZOTPY.exe
  2⤵
  PID:6952
- C:\Windows\System\LVXCsxE.exe
  C:\Windows\System\LVXCsxE.exe
  2⤵
  PID:6992
- C:\Windows\System\HPJylFx.exe
  C:\Windows\System\HPJylFx.exe
  2⤵
  PID:7016
- C:\Windows\System\xAItHPT.exe
  C:\Windows\System\xAItHPT.exe
  2⤵
  PID:7068
- C:\Windows\System\oaEMZrQ.exe
  C:\Windows\System\oaEMZrQ.exe
  2⤵
  PID:7096
- C:\Windows\System\AWKMFyv.exe
  C:\Windows\System\AWKMFyv.exe
  2⤵
  PID:7124
- C:\Windows\System\mTQWgdO.exe
  C:\Windows\System\mTQWgdO.exe
  2⤵
  PID:7152
- C:\Windows\System\IlNfNYJ.exe
  C:\Windows\System\IlNfNYJ.exe
  2⤵
  PID:1860
- C:\Windows\System\RnsNPBP.exe
  C:\Windows\System\RnsNPBP.exe
  2⤵
  PID:264
- C:\Windows\System\ksJzlkE.exe
  C:\Windows\System\ksJzlkE.exe
  2⤵
  PID:5684
- C:\Windows\System\HJxeBfv.exe
  C:\Windows\System\HJxeBfv.exe
  2⤵
  PID:3056
- C:\Windows\System\wXZIjTN.exe
  C:\Windows\System\wXZIjTN.exe
  2⤵
  PID:1812
- C:\Windows\System\EgGULQo.exe
  C:\Windows\System\EgGULQo.exe
  2⤵
  PID:448
- C:\Windows\System\SDPLLBs.exe
  C:\Windows\System\SDPLLBs.exe
  2⤵
  PID:4064
- C:\Windows\System\lIndlzi.exe
  C:\Windows\System\lIndlzi.exe
  2⤵
  PID:5052
- C:\Windows\System\CxCdiAp.exe
  C:\Windows\System\CxCdiAp.exe
  2⤵
  PID:6320
- C:\Windows\System\cNmVshC.exe
  C:\Windows\System\cNmVshC.exe
  2⤵
  PID:6352
- C:\Windows\System\DkrnMQx.exe
  C:\Windows\System\DkrnMQx.exe
  2⤵
  PID:6404
- C:\Windows\System\RxNOued.exe
  C:\Windows\System\RxNOued.exe
  2⤵
  PID:6436
- C:\Windows\System\iHlcKiS.exe
  C:\Windows\System\iHlcKiS.exe
  2⤵
  PID:6460
- C:\Windows\System\cipwUUs.exe
  C:\Windows\System\cipwUUs.exe
  2⤵
  PID:6492
- C:\Windows\System\KEHahhe.exe
  C:\Windows\System\KEHahhe.exe
  2⤵
  PID:6548
- C:\Windows\System\auTORBO.exe
  C:\Windows\System\auTORBO.exe
  2⤵
  PID:884
- C:\Windows\System\IaNoXNE.exe
  C:\Windows\System\IaNoXNE.exe
  2⤵
  PID:1392
- C:\Windows\System\WHQXjLV.exe
  C:\Windows\System\WHQXjLV.exe
  2⤵
  PID:6576
- C:\Windows\System\dYmugHH.exe
  C:\Windows\System\dYmugHH.exe
  2⤵
  PID:4844
- C:\Windows\System\JVBgtPA.exe
  C:\Windows\System\JVBgtPA.exe
  2⤵
  PID:6752
- C:\Windows\System\ACTWcQS.exe
  C:\Windows\System\ACTWcQS.exe
  2⤵
  PID:6792
- C:\Windows\System\DppdWmu.exe
  C:\Windows\System\DppdWmu.exe
  2⤵
  PID:6812
- C:\Windows\System\yYmfuYD.exe
  C:\Windows\System\yYmfuYD.exe
  2⤵
  PID:6864
- C:\Windows\System\Hhmbkhd.exe
  C:\Windows\System\Hhmbkhd.exe
  2⤵
  PID:6920
- C:\Windows\System\OgSPfYt.exe
  C:\Windows\System\OgSPfYt.exe
  2⤵
  PID:6968
- C:\Windows\System\SaPYsdH.exe
  C:\Windows\System\SaPYsdH.exe
  2⤵
  PID:7064
- C:\Windows\System\CBFPbNw.exe
  C:\Windows\System\CBFPbNw.exe
  2⤵
  PID:2028
- C:\Windows\System\VWfAVWH.exe
  C:\Windows\System\VWfAVWH.exe
  2⤵
  PID:5076
- C:\Windows\System\OpRBenx.exe
  C:\Windows\System\OpRBenx.exe
  2⤵
  PID:6152
- C:\Windows\System\EgUyUiL.exe
  C:\Windows\System\EgUyUiL.exe
  2⤵
  PID:6208
- C:\Windows\System\mxJdqiN.exe
  C:\Windows\System\mxJdqiN.exe
  2⤵
  PID:6296
- C:\Windows\System\PRJiTmG.exe
  C:\Windows\System\PRJiTmG.exe
  2⤵
  PID:5048
- C:\Windows\System\mGaSeJb.exe
  C:\Windows\System\mGaSeJb.exe
  2⤵
  PID:4900
- C:\Windows\System\bisvjQN.exe
  C:\Windows\System\bisvjQN.exe
  2⤵
  PID:6660
- C:\Windows\System\FEesAsS.exe
  C:\Windows\System\FEesAsS.exe
  2⤵
  PID:6828
- C:\Windows\System\LNxCULt.exe
  C:\Windows\System\LNxCULt.exe
  2⤵
  PID:6916
- C:\Windows\System\EpOpjbi.exe
  C:\Windows\System\EpOpjbi.exe
  2⤵
  PID:7088
- C:\Windows\System\yqCdyOw.exe
  C:\Windows\System\yqCdyOw.exe
  2⤵
  PID:7148
- C:\Windows\System\pUQQSkm.exe
  C:\Windows\System\pUQQSkm.exe
  2⤵
  PID:6176
- C:\Windows\System\aivIGhd.exe
  C:\Windows\System\aivIGhd.exe
  2⤵
  PID:1868
- C:\Windows\System\eKtWOXO.exe
  C:\Windows\System\eKtWOXO.exe
  2⤵
  PID:3884
- C:\Windows\System\yDqKtat.exe
  C:\Windows\System\yDqKtat.exe
  2⤵
  PID:6948
- C:\Windows\System\vYmUPFU.exe
  C:\Windows\System\vYmUPFU.exe
  2⤵
  PID:5548
- C:\Windows\System\ZUDXWAv.exe
  C:\Windows\System\ZUDXWAv.exe
  2⤵
  PID:6692
- C:\Windows\System\LWiVVDn.exe
  C:\Windows\System\LWiVVDn.exe
  2⤵
  PID:6100
- C:\Windows\System\USKcdNA.exe
  C:\Windows\System\USKcdNA.exe
  2⤵
  PID:7192
- C:\Windows\System\AqnPXyV.exe
  C:\Windows\System\AqnPXyV.exe
  2⤵
  PID:7224
- C:\Windows\System\KkoEseh.exe
  C:\Windows\System\KkoEseh.exe
  2⤵
  PID:7248
- C:\Windows\System\NVfBYAR.exe
  C:\Windows\System\NVfBYAR.exe
  2⤵
  PID:7276
- C:\Windows\System\GtUtQWH.exe
  C:\Windows\System\GtUtQWH.exe
  2⤵
  PID:7316
- C:\Windows\System\upPskIw.exe
  C:\Windows\System\upPskIw.exe
  2⤵
  PID:7336
- C:\Windows\System\evrnCqA.exe
  C:\Windows\System\evrnCqA.exe
  2⤵
  PID:7372
- C:\Windows\System\WCisfDh.exe
  C:\Windows\System\WCisfDh.exe
  2⤵
  PID:7396
- C:\Windows\System\CRjDYCT.exe
  C:\Windows\System\CRjDYCT.exe
  2⤵
  PID:7424
- C:\Windows\System\mGqHLRo.exe
  C:\Windows\System\mGqHLRo.exe
  2⤵
  PID:7440
- C:\Windows\System\rVSzRNz.exe
  C:\Windows\System\rVSzRNz.exe
  2⤵
  PID:7460
- C:\Windows\System\MkqqmDS.exe
  C:\Windows\System\MkqqmDS.exe
  2⤵
  PID:7484
- C:\Windows\System\FNkgEjO.exe
  C:\Windows\System\FNkgEjO.exe
  2⤵
  PID:7520
- C:\Windows\System\tRvLeca.exe
  C:\Windows\System\tRvLeca.exe
  2⤵
  PID:7548
- C:\Windows\System\ZnyVRPe.exe
  C:\Windows\System\ZnyVRPe.exe
  2⤵
  PID:7580
- C:\Windows\System\fvWBsrJ.exe
  C:\Windows\System\fvWBsrJ.exe
  2⤵
  PID:7600
- C:\Windows\System\ceknisB.exe
  C:\Windows\System\ceknisB.exe
  2⤵
  PID:7644
- C:\Windows\System\OEZJTVc.exe
  C:\Windows\System\OEZJTVc.exe
  2⤵
  PID:7672
- C:\Windows\System\TfVUHLo.exe
  C:\Windows\System\TfVUHLo.exe
  2⤵
  PID:7712
- C:\Windows\System\mbFTXXl.exe
  C:\Windows\System\mbFTXXl.exe
  2⤵
  PID:7728
- C:\Windows\System\dSFeSdi.exe
  C:\Windows\System\dSFeSdi.exe
  2⤵
  PID:7760
- C:\Windows\System\YFWbjxN.exe
  C:\Windows\System\YFWbjxN.exe
  2⤵
  PID:7780
- C:\Windows\System\KWcqQtt.exe
  C:\Windows\System\KWcqQtt.exe
  2⤵
  PID:7800
- C:\Windows\System\cwfOfBn.exe
  C:\Windows\System\cwfOfBn.exe
  2⤵
  PID:7816
- C:\Windows\System\XrSnrAl.exe
  C:\Windows\System\XrSnrAl.exe
  2⤵
  PID:7840
- C:\Windows\System\BnezImI.exe
  C:\Windows\System\BnezImI.exe
  2⤵
  PID:7868
- C:\Windows\System\XxQzhPa.exe
  C:\Windows\System\XxQzhPa.exe
  2⤵
  PID:7904
- C:\Windows\System\cbWfWfs.exe
  C:\Windows\System\cbWfWfs.exe
  2⤵
  PID:7976
- C:\Windows\System\rfeMHdD.exe
  C:\Windows\System\rfeMHdD.exe
  2⤵
  PID:7996
- C:\Windows\System\vqeUGaz.exe
  C:\Windows\System\vqeUGaz.exe
  2⤵
  PID:8012
- C:\Windows\System\VRVoXMI.exe
  C:\Windows\System\VRVoXMI.exe
  2⤵
  PID:8036
- C:\Windows\System\OXhPlww.exe
  C:\Windows\System\OXhPlww.exe
  2⤵
  PID:8060
- C:\Windows\System\LVxJaNM.exe
  C:\Windows\System\LVxJaNM.exe
  2⤵
  PID:8080
- C:\Windows\System\BciNuGi.exe
  C:\Windows\System\BciNuGi.exe
  2⤵
  PID:8112
- C:\Windows\System\HqNbqkf.exe
  C:\Windows\System\HqNbqkf.exe
  2⤵
  PID:8136
- C:\Windows\System\RdFfeNB.exe
  C:\Windows\System\RdFfeNB.exe
  2⤵
  PID:8160
- C:\Windows\System\xPoQZKT.exe
  C:\Windows\System\xPoQZKT.exe
  2⤵
  PID:8188
- C:\Windows\System\aacqmVQ.exe
  C:\Windows\System\aacqmVQ.exe
  2⤵
  PID:7180
- C:\Windows\System\cfPMOvs.exe
  C:\Windows\System\cfPMOvs.exe
  2⤵
  PID:7260
- C:\Windows\System\nNoZApR.exe
  C:\Windows\System\nNoZApR.exe
  2⤵
  PID:7364
- C:\Windows\System\rKvNWYj.exe
  C:\Windows\System\rKvNWYj.exe
  2⤵
  PID:7416
- C:\Windows\System\xdZvIXu.exe
  C:\Windows\System\xdZvIXu.exe
  2⤵
  PID:7456
- C:\Windows\System\pjUMgPB.exe
  C:\Windows\System\pjUMgPB.exe
  2⤵
  PID:7504
- C:\Windows\System\gnLKAku.exe
  C:\Windows\System\gnLKAku.exe
  2⤵
  PID:7596
- C:\Windows\System\bcCeYKW.exe
  C:\Windows\System\bcCeYKW.exe
  2⤵
  PID:7660
- C:\Windows\System\WbQIUnq.exe
  C:\Windows\System\WbQIUnq.exe
  2⤵
  PID:7744
- C:\Windows\System\nYIctLt.exe
  C:\Windows\System\nYIctLt.exe
  2⤵
  PID:7788
- C:\Windows\System\soLLYsY.exe
  C:\Windows\System\soLLYsY.exe
  2⤵
  PID:7864
- C:\Windows\System\BwsbqHu.exe
  C:\Windows\System\BwsbqHu.exe
  2⤵
  PID:7992
- C:\Windows\System\IObMgUL.exe
  C:\Windows\System\IObMgUL.exe
  2⤵
  PID:8048
- C:\Windows\System\OHRsAPc.exe
  C:\Windows\System\OHRsAPc.exe
  2⤵
  PID:8148
- C:\Windows\System\gTDukkD.exe
  C:\Windows\System\gTDukkD.exe
  2⤵
  PID:8156
- C:\Windows\System\cdjWBCT.exe
  C:\Windows\System\cdjWBCT.exe
  2⤵
  PID:7332
- C:\Windows\System\OEICCdx.exe
  C:\Windows\System\OEICCdx.exe
  2⤵
  PID:7380
- C:\Windows\System\oDZxxwl.exe
  C:\Windows\System\oDZxxwl.exe
  2⤵
  PID:7612
- C:\Windows\System\uHOAqIn.exe
  C:\Windows\System\uHOAqIn.exe
  2⤵
  PID:7704
- C:\Windows\System\jbtIhBg.exe
  C:\Windows\System\jbtIhBg.exe
  2⤵
  PID:7856
- C:\Windows\System\ZFRvMDS.exe
  C:\Windows\System\ZFRvMDS.exe
  2⤵
  PID:8052
- C:\Windows\System\kMAUQym.exe
  C:\Windows\System\kMAUQym.exe
  2⤵
  PID:7324
- C:\Windows\System\lJzkrck.exe
  C:\Windows\System\lJzkrck.exe
  2⤵
  PID:7292
- C:\Windows\System\AkOuMif.exe
  C:\Windows\System\AkOuMif.exe
  2⤵
  PID:7776
- C:\Windows\System\RofWZBm.exe
  C:\Windows\System\RofWZBm.exe
  2⤵
  PID:7176
- C:\Windows\System\Rzrmfme.exe
  C:\Windows\System\Rzrmfme.exe
  2⤵
  PID:8024
- C:\Windows\System\SmOnSiu.exe
  C:\Windows\System\SmOnSiu.exe
  2⤵
  PID:7796
- C:\Windows\System\oRqDseF.exe
  C:\Windows\System\oRqDseF.exe
  2⤵
  PID:8224
- C:\Windows\System\eBOEojh.exe
  C:\Windows\System\eBOEojh.exe
  2⤵
  PID:8240
- C:\Windows\System\JJYpcvB.exe
  C:\Windows\System\JJYpcvB.exe
  2⤵
  PID:8272
- C:\Windows\System\RWyprYO.exe
  C:\Windows\System\RWyprYO.exe
  2⤵
  PID:8320
- C:\Windows\System\TiKyfKv.exe
  C:\Windows\System\TiKyfKv.exe
  2⤵
  PID:8348
- C:\Windows\System\DbOmuDv.exe
  C:\Windows\System\DbOmuDv.exe
  2⤵
  PID:8376
- C:\Windows\System\yqvaBom.exe
  C:\Windows\System\yqvaBom.exe
  2⤵
  PID:8392
- C:\Windows\System\qyxwuqL.exe
  C:\Windows\System\qyxwuqL.exe
  2⤵
  PID:8424
- C:\Windows\System\BwYcnDs.exe
  C:\Windows\System\BwYcnDs.exe
  2⤵
  PID:8448
- C:\Windows\System\mZmzbqK.exe
  C:\Windows\System\mZmzbqK.exe
  2⤵
  PID:8476
- C:\Windows\System\mHUPHDM.exe
  C:\Windows\System\mHUPHDM.exe
  2⤵
  PID:8508
- C:\Windows\System\jtxRqha.exe
  C:\Windows\System\jtxRqha.exe
  2⤵
  PID:8532
- C:\Windows\System\SqKzdMm.exe
  C:\Windows\System\SqKzdMm.exe
  2⤵
  PID:8552
- C:\Windows\System\XIBQPtD.exe
  C:\Windows\System\XIBQPtD.exe
  2⤵
  PID:8612
- C:\Windows\System\SIjWePI.exe
  C:\Windows\System\SIjWePI.exe
  2⤵
  PID:8628
- C:\Windows\System\BepRSFu.exe
  C:\Windows\System\BepRSFu.exe
  2⤵
  PID:8660
- C:\Windows\System\luhiIfq.exe
  C:\Windows\System\luhiIfq.exe
  2⤵
  PID:8688
- C:\Windows\System\TfvKKHG.exe
  C:\Windows\System\TfvKKHG.exe
  2⤵
  PID:8716
- C:\Windows\System\YacXYnF.exe
  C:\Windows\System\YacXYnF.exe
  2⤵
  PID:8752
- C:\Windows\System\fbFgtJB.exe
  C:\Windows\System\fbFgtJB.exe
  2⤵
  PID:8768
- C:\Windows\System\fWBpaFW.exe
  C:\Windows\System\fWBpaFW.exe
  2⤵
  PID:8788
- C:\Windows\System\dmUmqnS.exe
  C:\Windows\System\dmUmqnS.exe
  2⤵
  PID:8816
- C:\Windows\System\YwNvDzr.exe
  C:\Windows\System\YwNvDzr.exe
  2⤵
  PID:8844
- C:\Windows\System\lcDppZo.exe
  C:\Windows\System\lcDppZo.exe
  2⤵
  PID:8896
- C:\Windows\System\KCHnwhd.exe
  C:\Windows\System\KCHnwhd.exe
  2⤵
  PID:8912
- C:\Windows\System\CVJZweO.exe
  C:\Windows\System\CVJZweO.exe
  2⤵
  PID:8936
- C:\Windows\System\JiBEUVd.exe
  C:\Windows\System\JiBEUVd.exe
  2⤵
  PID:8952
- C:\Windows\System\RPbwORs.exe
  C:\Windows\System\RPbwORs.exe
  2⤵
  PID:8996
- C:\Windows\System\IaltTgu.exe
  C:\Windows\System\IaltTgu.exe
  2⤵
  PID:9036
- C:\Windows\System\jHKDzJp.exe
  C:\Windows\System\jHKDzJp.exe
  2⤵
  PID:9064
- C:\Windows\System\MbIpRKj.exe
  C:\Windows\System\MbIpRKj.exe
  2⤵
  PID:9092
- C:\Windows\System\xWtYXbN.exe
  C:\Windows\System\xWtYXbN.exe
  2⤵
  PID:9124
- C:\Windows\System\jjxOauy.exe
  C:\Windows\System\jjxOauy.exe
  2⤵
  PID:9140
- C:\Windows\System\GqtDIPz.exe
  C:\Windows\System\GqtDIPz.exe
  2⤵
  PID:9156
- C:\Windows\System\QRwcdsX.exe
  C:\Windows\System\QRwcdsX.exe
  2⤵
  PID:9180
- C:\Windows\System\YxrIiYT.exe
  C:\Windows\System\YxrIiYT.exe
  2⤵
  PID:7628
- C:\Windows\System\LpUbyYp.exe
  C:\Windows\System\LpUbyYp.exe
  2⤵
  PID:8264
- C:\Windows\System\MQfiJhI.exe
  C:\Windows\System\MQfiJhI.exe
  2⤵
  PID:8360
- C:\Windows\System\VjQqfnt.exe
  C:\Windows\System\VjQqfnt.exe
  2⤵
  PID:8364
- C:\Windows\System\NeJWeHe.exe
  C:\Windows\System\NeJWeHe.exe
  2⤵
  PID:8388
- C:\Windows\System\kSOqcQc.exe
  C:\Windows\System\kSOqcQc.exe
  2⤵
  PID:8460
- C:\Windows\System\OIbGPOm.exe
  C:\Windows\System\OIbGPOm.exe
  2⤵
  PID:8540
- C:\Windows\System\YdzKOiI.exe
  C:\Windows\System\YdzKOiI.exe
  2⤵
  PID:8644
- C:\Windows\System\IRLMGJF.exe
  C:\Windows\System\IRLMGJF.exe
  2⤵
  PID:8672
- C:\Windows\System\bnAnZKm.exe
  C:\Windows\System\bnAnZKm.exe
  2⤵
  PID:8748
- C:\Windows\System\bEYWLeu.exe
  C:\Windows\System\bEYWLeu.exe
  2⤵
  PID:8804
- C:\Windows\System\GwgDuAc.exe
  C:\Windows\System\GwgDuAc.exe
  2⤵
  PID:8892
- C:\Windows\System\WDzazTL.exe
  C:\Windows\System\WDzazTL.exe
  2⤵
  PID:9024
- C:\Windows\System\GoqMGvF.exe
  C:\Windows\System\GoqMGvF.exe
  2⤵
  PID:9052
- C:\Windows\System\AUAevJZ.exe
  C:\Windows\System\AUAevJZ.exe
  2⤵
  PID:9120
- C:\Windows\System\BcyjweA.exe
  C:\Windows\System\BcyjweA.exe
  2⤵
  PID:9148
- C:\Windows\System\HeqZTGk.exe
  C:\Windows\System\HeqZTGk.exe
  2⤵
  PID:8332
- C:\Windows\System\DWAVmkZ.exe
  C:\Windows\System\DWAVmkZ.exe
  2⤵
  PID:8412
- C:\Windows\System\CFSErss.exe
  C:\Windows\System\CFSErss.exe
  2⤵
  PID:8680
- C:\Windows\System\uKgqynj.exe
  C:\Windows\System\uKgqynj.exe
  2⤵
  PID:8780
- C:\Windows\System\BlgPLCQ.exe
  C:\Windows\System\BlgPLCQ.exe
  2⤵
  PID:8776
- C:\Windows\System\vbccppM.exe
  C:\Windows\System\vbccppM.exe
  2⤵
  PID:8992
- C:\Windows\System\UolFLFS.exe
  C:\Windows\System\UolFLFS.exe
  2⤵
  PID:9136
- C:\Windows\System\eQTQElD.exe
  C:\Windows\System\eQTQElD.exe
  2⤵
  PID:9176
- C:\Windows\System\TmtxRAq.exe
  C:\Windows\System\TmtxRAq.exe
  2⤵
  PID:8868
- C:\Windows\System\oSARUBX.exe
  C:\Windows\System\oSARUBX.exe
  2⤵
  PID:8260
- C:\Windows\System\bjmQRrg.exe
  C:\Windows\System\bjmQRrg.exe
  2⤵
  PID:8440
- C:\Windows\System\TguptTG.exe
  C:\Windows\System\TguptTG.exe
  2⤵
  PID:9232
- C:\Windows\System\OlDixSd.exe
  C:\Windows\System\OlDixSd.exe
  2⤵
  PID:9260
- C:\Windows\System\Ewzephp.exe
  C:\Windows\System\Ewzephp.exe
  2⤵
  PID:9288
- C:\Windows\System\qFIvWkr.exe
  C:\Windows\System\qFIvWkr.exe
  2⤵
  PID:9304
- C:\Windows\System\VepjryY.exe
  C:\Windows\System\VepjryY.exe
  2⤵
  PID:9332
- C:\Windows\System\zCwQLjx.exe
  C:\Windows\System\zCwQLjx.exe
  2⤵
  PID:9360
- C:\Windows\System\JtslDeY.exe
  C:\Windows\System\JtslDeY.exe
  2⤵
  PID:9384
- C:\Windows\System\RIldKsd.exe
  C:\Windows\System\RIldKsd.exe
  2⤵
  PID:9428
- C:\Windows\System\UbOAAmu.exe
  C:\Windows\System\UbOAAmu.exe
  2⤵
  PID:9448
- C:\Windows\System\PmNNAnQ.exe
  C:\Windows\System\PmNNAnQ.exe
  2⤵
  PID:9472
- C:\Windows\System\EKylsSc.exe
  C:\Windows\System\EKylsSc.exe
  2⤵
  PID:9496
- C:\Windows\System\gpqVjyo.exe
  C:\Windows\System\gpqVjyo.exe
  2⤵
  PID:9552
- C:\Windows\System\xlPjSPB.exe
  C:\Windows\System\xlPjSPB.exe
  2⤵
  PID:9576
- C:\Windows\System\tPqetbf.exe
  C:\Windows\System\tPqetbf.exe
  2⤵
  PID:9592
- C:\Windows\System\RIjiSQa.exe
  C:\Windows\System\RIjiSQa.exe
  2⤵
  PID:9612
- C:\Windows\System\NrbixXv.exe
  C:\Windows\System\NrbixXv.exe
  2⤵
  PID:9628
- C:\Windows\System\gLaaSwD.exe
  C:\Windows\System\gLaaSwD.exe
  2⤵
  PID:9656
- C:\Windows\System\LghePFj.exe
  C:\Windows\System\LghePFj.exe
  2⤵
  PID:9708
- C:\Windows\System\ixrGZDy.exe
  C:\Windows\System\ixrGZDy.exe
  2⤵
  PID:9736
- C:\Windows\System\aozRYkJ.exe
  C:\Windows\System\aozRYkJ.exe
  2⤵
  PID:9752
- C:\Windows\System\xdEKTQN.exe
  C:\Windows\System\xdEKTQN.exe
  2⤵
  PID:9784
- C:\Windows\System\VYMdQDr.exe
  C:\Windows\System\VYMdQDr.exe
  2⤵
  PID:9808
- C:\Windows\System\jkEmBZo.exe
  C:\Windows\System\jkEmBZo.exe
  2⤵
  PID:9852
- C:\Windows\System\ZCbzknq.exe
  C:\Windows\System\ZCbzknq.exe
  2⤵
  PID:9884
- C:\Windows\System\vsOASdf.exe
  C:\Windows\System\vsOASdf.exe
  2⤵
  PID:9912
- C:\Windows\System\xHPZxug.exe
  C:\Windows\System\xHPZxug.exe
  2⤵
  PID:9944
- C:\Windows\System\kQxXQUs.exe
  C:\Windows\System\kQxXQUs.exe
  2⤵
  PID:9972
- C:\Windows\System\WNCecXp.exe
  C:\Windows\System\WNCecXp.exe
  2⤵
  PID:10000
- C:\Windows\System\nrYzBFw.exe
  C:\Windows\System\nrYzBFw.exe
  2⤵
  PID:10024
- C:\Windows\System\LAeQpDS.exe
  C:\Windows\System\LAeQpDS.exe
  2⤵
  PID:10044
- C:\Windows\System\nDnavrq.exe
  C:\Windows\System\nDnavrq.exe
  2⤵
  PID:10072
- C:\Windows\System\nALWWaS.exe
  C:\Windows\System\nALWWaS.exe
  2⤵
  PID:10100
- C:\Windows\System\pajVLDA.exe
  C:\Windows\System\pajVLDA.exe
  2⤵
  PID:10128
- C:\Windows\System\cyChAkZ.exe
  C:\Windows\System\cyChAkZ.exe
  2⤵
  PID:10152
- C:\Windows\System\TGWUxCQ.exe
  C:\Windows\System\TGWUxCQ.exe
  2⤵
  PID:10184
- C:\Windows\System\uBHACXF.exe
  C:\Windows\System\uBHACXF.exe
  2⤵
  PID:10212
- C:\Windows\System\awAnXCK.exe
  C:\Windows\System\awAnXCK.exe
  2⤵
  PID:10232
- C:\Windows\System\ZPZYRbC.exe
  C:\Windows\System\ZPZYRbC.exe
  2⤵
  PID:9220
- C:\Windows\System\PEaestZ.exe
  C:\Windows\System\PEaestZ.exe
  2⤵
  PID:9280
- C:\Windows\System\ZJoLuSg.exe
  C:\Windows\System\ZJoLuSg.exe
  2⤵
  PID:9380
- C:\Windows\System\sABoMHe.exe
  C:\Windows\System\sABoMHe.exe
  2⤵
  PID:9420
- C:\Windows\System\cwQHPyj.exe
  C:\Windows\System\cwQHPyj.exe
  2⤵
  PID:9484
- C:\Windows\System\pieQsyE.exe
  C:\Windows\System\pieQsyE.exe
  2⤵
  PID:9540
- C:\Windows\System\EJYcBIM.exe
  C:\Windows\System\EJYcBIM.exe
  2⤵
  PID:9688
- C:\Windows\System\jTHxjny.exe
  C:\Windows\System\jTHxjny.exe
  2⤵
  PID:9732
- C:\Windows\System\WDGFEJg.exe
  C:\Windows\System\WDGFEJg.exe
  2⤵
  PID:9776
- C:\Windows\System\YEFrCqv.exe
  C:\Windows\System\YEFrCqv.exe
  2⤵
  PID:9844
- C:\Windows\System\rBhsJXm.exe
  C:\Windows\System\rBhsJXm.exe
  2⤵
  PID:9880
- C:\Windows\System\sujEjQb.exe
  C:\Windows\System\sujEjQb.exe
  2⤵
  PID:9984
- C:\Windows\System\Fdfxprl.exe
  C:\Windows\System\Fdfxprl.exe
  2⤵
  PID:10032
- C:\Windows\System\HHFbTQi.exe
  C:\Windows\System\HHFbTQi.exe
  2⤵
  PID:10064
- C:\Windows\System\CvNuuvh.exe
  C:\Windows\System\CvNuuvh.exe
  2⤵
  PID:10112
- C:\Windows\System\wFxTmCw.exe
  C:\Windows\System\wFxTmCw.exe
  2⤵
  PID:10196
- C:\Windows\System\dyJvxAX.exe
  C:\Windows\System\dyJvxAX.exe
  2⤵
  PID:9320
- C:\Windows\System\ohRScdh.exe
  C:\Windows\System\ohRScdh.exe
  2⤵
  PID:9444
- C:\Windows\System\atuXGdZ.exe
  C:\Windows\System\atuXGdZ.exe
  2⤵
  PID:9584
- C:\Windows\System\LzqmLTt.exe
  C:\Windows\System\LzqmLTt.exe
  2⤵
  PID:9704
- C:\Windows\System\zmITyyr.exe
  C:\Windows\System\zmITyyr.exe
  2⤵
  PID:9800
- C:\Windows\System\cPxAQDL.exe
  C:\Windows\System\cPxAQDL.exe
  2⤵
  PID:9876
- C:\Windows\System\YMQBhLY.exe
  C:\Windows\System\YMQBhLY.exe
  2⤵
  PID:9932
- C:\Windows\System\ghuleBT.exe
  C:\Windows\System\ghuleBT.exe
  2⤵
  PID:10056
- C:\Windows\System\HYqYDgC.exe
  C:\Windows\System\HYqYDgC.exe
  2⤵
  PID:10140
- C:\Windows\System\uBmHgXb.exe
  C:\Windows\System\uBmHgXb.exe
  2⤵
  PID:9748
- C:\Windows\System\pWZLfjU.exe
  C:\Windows\System\pWZLfjU.exe
  2⤵
  PID:10292
- C:\Windows\System\PiXKLJL.exe
  C:\Windows\System\PiXKLJL.exe
  2⤵
  PID:10312
- C:\Windows\System\JMplSwn.exe
  C:\Windows\System\JMplSwn.exe
  2⤵
  PID:10336
- C:\Windows\System\kCFHpFY.exe
  C:\Windows\System\kCFHpFY.exe
  2⤵
  PID:10360
- C:\Windows\System\ZDdVQoC.exe
  C:\Windows\System\ZDdVQoC.exe
  2⤵
  PID:10380
- C:\Windows\System\wvACHfP.exe
  C:\Windows\System\wvACHfP.exe
  2⤵
  PID:10408
- C:\Windows\System\rmetCFB.exe
  C:\Windows\System\rmetCFB.exe
  2⤵
  PID:10456
- C:\Windows\System\WxcymRH.exe
  C:\Windows\System\WxcymRH.exe
  2⤵
  PID:10476
- C:\Windows\System\OBewROO.exe
  C:\Windows\System\OBewROO.exe
  2⤵
  PID:10496
- C:\Windows\System\wZkpPry.exe
  C:\Windows\System\wZkpPry.exe
  2⤵
  PID:10532
- C:\Windows\System\QtyKIRw.exe
  C:\Windows\System\QtyKIRw.exe
  2⤵
  PID:10548
- C:\Windows\System\jEcXoSc.exe
  C:\Windows\System\jEcXoSc.exe
  2⤵
  PID:10564
- C:\Windows\System\AeZuUWM.exe
  C:\Windows\System\AeZuUWM.exe
  2⤵
  PID:10628
- C:\Windows\System\ASUwwJo.exe
  C:\Windows\System\ASUwwJo.exe
  2⤵
  PID:10656
- C:\Windows\System\UujSJRt.exe
  C:\Windows\System\UujSJRt.exe
  2⤵
  PID:10684
- C:\Windows\System\mYsLTHw.exe
  C:\Windows\System\mYsLTHw.exe
  2⤵
  PID:10712
- C:\Windows\System\fCHIurb.exe
  C:\Windows\System\fCHIurb.exe
  2⤵
  PID:10736
- C:\Windows\System\lkVMjYE.exe
  C:\Windows\System\lkVMjYE.exe
  2⤵
  PID:10756
- C:\Windows\System\aaKIlmC.exe
  C:\Windows\System\aaKIlmC.exe
  2⤵
  PID:10772
- C:\Windows\System\TkWaktR.exe
  C:\Windows\System\TkWaktR.exe
  2⤵
  PID:10824
- C:\Windows\System\TmHqDld.exe
  C:\Windows\System\TmHqDld.exe
  2⤵
  PID:10852
- C:\Windows\System\zDlJQMI.exe
  C:\Windows\System\zDlJQMI.exe
  2⤵
  PID:10880
- C:\Windows\System\GkjjDQO.exe
  C:\Windows\System\GkjjDQO.exe
  2⤵
  PID:10908
- C:\Windows\System\mkabJUC.exe
  C:\Windows\System\mkabJUC.exe
  2⤵
  PID:10924
- C:\Windows\System\CGvkItt.exe
  C:\Windows\System\CGvkItt.exe
  2⤵
  PID:10952
- C:\Windows\System\hWuXBCU.exe
  C:\Windows\System\hWuXBCU.exe
  2⤵
  PID:10980
- C:\Windows\System\ybJGTYf.exe
  C:\Windows\System\ybJGTYf.exe
  2⤵
  PID:11008
- C:\Windows\System\zqIwmJj.exe
  C:\Windows\System\zqIwmJj.exe
  2⤵
  PID:11036
- C:\Windows\System\XuDmFKh.exe
  C:\Windows\System\XuDmFKh.exe
  2⤵
  PID:11064
- C:\Windows\System\RHMqQmB.exe
  C:\Windows\System\RHMqQmB.exe
  2⤵
  PID:11104
- C:\Windows\System\gAEDthw.exe
  C:\Windows\System\gAEDthw.exe
  2⤵
  PID:11132
- C:\Windows\System\hZgITCf.exe
  C:\Windows\System\hZgITCf.exe
  2⤵
  PID:11148
- C:\Windows\System\EAxlnZe.exe
  C:\Windows\System\EAxlnZe.exe
  2⤵
  PID:11180
- C:\Windows\System\tjoXdAZ.exe
  C:\Windows\System\tjoXdAZ.exe
  2⤵
  PID:11208
- C:\Windows\System\sptzyfh.exe
  C:\Windows\System\sptzyfh.exe
  2⤵
  PID:11232
- C:\Windows\System\ToVjRDZ.exe
  C:\Windows\System\ToVjRDZ.exe
  2⤵
  PID:11248
- C:\Windows\System\fmHXEPh.exe
  C:\Windows\System\fmHXEPh.exe
  2⤵
  PID:9348
- C:\Windows\System\HaZufNs.exe
  C:\Windows\System\HaZufNs.exe
  2⤵
  PID:10260
- C:\Windows\System\tTaXdRC.exe
  C:\Windows\System\tTaXdRC.exe
  2⤵
  PID:10324
- C:\Windows\System\wJcLmGS.exe
  C:\Windows\System\wJcLmGS.exe
  2⤵
  PID:10332
- C:\Windows\System\nVhUalr.exe
  C:\Windows\System\nVhUalr.exe
  2⤵
  PID:10440
- C:\Windows\System\NrATZua.exe
  C:\Windows\System\NrATZua.exe
  2⤵
  PID:10524
- C:\Windows\System\LZkEWvb.exe
  C:\Windows\System\LZkEWvb.exe
  2⤵
  PID:10596
- C:\Windows\System\mmoaHBz.exe
  C:\Windows\System\mmoaHBz.exe
  2⤵
  PID:10668
- C:\Windows\System\iThMIVG.exe
  C:\Windows\System\iThMIVG.exe
  2⤵
  PID:10792
- C:\Windows\System\OYkoaBL.exe
  C:\Windows\System\OYkoaBL.exe
  2⤵
  PID:10836
- C:\Windows\System\iEIoGMp.exe
  C:\Windows\System\iEIoGMp.exe
  2⤵
  PID:10876
- C:\Windows\System\UfNujVN.exe
  C:\Windows\System\UfNujVN.exe
  2⤵
  PID:10936
- C:\Windows\System\PFsGMSR.exe
  C:\Windows\System\PFsGMSR.exe
  2⤵
  PID:11016
- C:\Windows\System\rNpYsEg.exe
  C:\Windows\System\rNpYsEg.exe
  2⤵
  PID:11052
- C:\Windows\System\TTpZdVK.exe
  C:\Windows\System\TTpZdVK.exe
  2⤵
  PID:11100
- C:\Windows\System\AOIJjir.exe
  C:\Windows\System\AOIJjir.exe
  2⤵
  PID:11172
- C:\Windows\System\aVkpBER.exe
  C:\Windows\System\aVkpBER.exe
  2⤵
  PID:11220
- C:\Windows\System\URUTnIn.exe
  C:\Windows\System\URUTnIn.exe
  2⤵
  PID:10084
- C:\Windows\System\xUKzUNW.exe
  C:\Windows\System\xUKzUNW.exe
  2⤵
  PID:10308
- C:\Windows\System\UJIdaez.exe
  C:\Windows\System\UJIdaez.exe
  2⤵
  PID:10504
- C:\Windows\System\nQiyTjm.exe
  C:\Windows\System\nQiyTjm.exe
  2⤵
  PID:10652
- C:\Windows\System\GdwMouQ.exe
  C:\Windows\System\GdwMouQ.exe
  2⤵
  PID:6876
- C:\Windows\System\qccoYoy.exe
  C:\Windows\System\qccoYoy.exe
  2⤵
  PID:10788
- C:\Windows\System\VbXNRDE.exe
  C:\Windows\System\VbXNRDE.exe
  2⤵
  PID:10808
- C:\Windows\System\rCqIAJK.exe
  C:\Windows\System\rCqIAJK.exe
  2⤵
  PID:11096
- C:\Windows\System\iRemSDO.exe
  C:\Windows\System\iRemSDO.exe
  2⤵
  PID:11204
- C:\Windows\System\sctitXn.exe
  C:\Windows\System\sctitXn.exe
  2⤵
  PID:4828
- C:\Windows\System\SeujIax.exe
  C:\Windows\System\SeujIax.exe
  2⤵
  PID:10904
- C:\Windows\System\PsyHfIc.exe
  C:\Windows\System\PsyHfIc.exe
  2⤵
  PID:11120
- C:\Windows\System\NSQltRO.exe
  C:\Windows\System\NSQltRO.exe
  2⤵
  PID:10820
- C:\Windows\System\pzMVigz.exe
  C:\Windows\System\pzMVigz.exe
  2⤵
  PID:11268
- C:\Windows\System\xcYsqPf.exe
  C:\Windows\System\xcYsqPf.exe
  2⤵
  PID:11296
- C:\Windows\System\FzFSOMS.exe
  C:\Windows\System\FzFSOMS.exe
  2⤵
  PID:11320
- C:\Windows\System\XbMxCpQ.exe
  C:\Windows\System\XbMxCpQ.exe
  2⤵
  PID:11344
- C:\Windows\System\CFmJKjK.exe
  C:\Windows\System\CFmJKjK.exe
  2⤵
  PID:11396
- C:\Windows\System\hmPuGou.exe
  C:\Windows\System\hmPuGou.exe
  2⤵
  PID:11416
- C:\Windows\System\cmkPplS.exe
  C:\Windows\System\cmkPplS.exe
  2⤵
  PID:11456
- C:\Windows\System\flhQmQA.exe
  C:\Windows\System\flhQmQA.exe
  2⤵
  PID:11472
- C:\Windows\System\RUBgeFg.exe
  C:\Windows\System\RUBgeFg.exe
  2⤵
  PID:11504
- C:\Windows\System\WNBlhAW.exe
  C:\Windows\System\WNBlhAW.exe
  2⤵
  PID:11528
- C:\Windows\System\WFvqNSF.exe
  C:\Windows\System\WFvqNSF.exe
  2⤵
  PID:11556
- C:\Windows\System\XnupoEn.exe
  C:\Windows\System\XnupoEn.exe
  2⤵
  PID:11576
- C:\Windows\System\ZoCANzs.exe
  C:\Windows\System\ZoCANzs.exe
  2⤵
  PID:11620
- C:\Windows\System\xeHngHz.exe
  C:\Windows\System\xeHngHz.exe
  2⤵
  PID:11640
- C:\Windows\System\KYIvwZd.exe
  C:\Windows\System\KYIvwZd.exe
  2⤵
  PID:11680
- C:\Windows\System\TCXmQgV.exe
  C:\Windows\System\TCXmQgV.exe
  2⤵
  PID:11700
- C:\Windows\System\YchiKlh.exe
  C:\Windows\System\YchiKlh.exe
  2⤵
  PID:11728
- C:\Windows\System\lTrURss.exe
  C:\Windows\System\lTrURss.exe
  2⤵
  PID:11752
- C:\Windows\System\KuLaeii.exe
  C:\Windows\System\KuLaeii.exe
  2⤵
  PID:11784
- C:\Windows\System\sVjqnwr.exe
  C:\Windows\System\sVjqnwr.exe
  2⤵
  PID:11812
- C:\Windows\System\RoIBhJq.exe
  C:\Windows\System\RoIBhJq.exe
  2⤵
  PID:11836
- C:\Windows\System\uNTilTS.exe
  C:\Windows\System\uNTilTS.exe
  2⤵
  PID:11864
- C:\Windows\System\OJAGmYj.exe
  C:\Windows\System\OJAGmYj.exe
  2⤵
  PID:11900
- C:\Windows\System\RFxxkHy.exe
  C:\Windows\System\RFxxkHy.exe
  2⤵
  PID:11952
- C:\Windows\System\vBwzctF.exe
  C:\Windows\System\vBwzctF.exe
  2⤵
  PID:12004
- C:\Windows\System\aXtpmsQ.exe
  C:\Windows\System\aXtpmsQ.exe
  2⤵
  PID:12020
- C:\Windows\System\LgucOiz.exe
  C:\Windows\System\LgucOiz.exe
  2⤵
  PID:12040
- C:\Windows\System\vDlWSsi.exe
  C:\Windows\System\vDlWSsi.exe
  2⤵
  PID:12092
- C:\Windows\System\jcGoRDv.exe
  C:\Windows\System\jcGoRDv.exe
  2⤵
  PID:12124
- C:\Windows\System\gdtmvoJ.exe
  C:\Windows\System\gdtmvoJ.exe
  2⤵
  PID:12144
- C:\Windows\System\soQNeta.exe
  C:\Windows\System\soQNeta.exe
  2⤵
  PID:12188
- C:\Windows\System\WiZMDdk.exe
  C:\Windows\System\WiZMDdk.exe
  2⤵
  PID:12216
- C:\Windows\System\XXlFOHv.exe
  C:\Windows\System\XXlFOHv.exe
  2⤵
  PID:12232
- C:\Windows\System\gxFGkip.exe
  C:\Windows\System\gxFGkip.exe
  2⤵
  PID:12256
- C:\Windows\System\DlzlVni.exe
  C:\Windows\System\DlzlVni.exe
  2⤵
  PID:12276
- C:\Windows\System\dtAhByZ.exe
  C:\Windows\System\dtAhByZ.exe
  2⤵
  PID:11316
- C:\Windows\System\mYaMFbT.exe
  C:\Windows\System\mYaMFbT.exe
  2⤵
  PID:11392
- C:\Windows\System\Awpmwnw.exe
  C:\Windows\System\Awpmwnw.exe
  2⤵
  PID:11432
- C:\Windows\System\JGQefCd.exe
  C:\Windows\System\JGQefCd.exe
  2⤵
  PID:11540
- C:\Windows\System\MoniyFS.exe
  C:\Windows\System\MoniyFS.exe
  2⤵
  PID:11564
- C:\Windows\System\eqZuXOG.exe
  C:\Windows\System\eqZuXOG.exe
  2⤵
  PID:11664
- C:\Windows\System\XZWYDaZ.exe
  C:\Windows\System\XZWYDaZ.exe
  2⤵
  PID:11688
- C:\Windows\System\xXIfyDC.exe
  C:\Windows\System\xXIfyDC.exe
  2⤵
  PID:11772
- C:\Windows\System\KsOIeFo.exe
  C:\Windows\System\KsOIeFo.exe
  2⤵
  PID:11880
- C:\Windows\System\BOBaAUL.exe
  C:\Windows\System\BOBaAUL.exe
  2⤵
  PID:11916
- C:\Windows\System\CEAPYMM.exe
  C:\Windows\System\CEAPYMM.exe
  2⤵
  PID:11988
- C:\Windows\System\sFHqWXn.exe
  C:\Windows\System\sFHqWXn.exe
  2⤵
  PID:12064
- C:\Windows\System\VnqiZvC.exe
  C:\Windows\System\VnqiZvC.exe
  2⤵
  PID:12104
- C:\Windows\System\GEouSRO.exe
  C:\Windows\System\GEouSRO.exe
  2⤵
  PID:12156
- C:\Windows\System\NARZtCT.exe
  C:\Windows\System\NARZtCT.exe
  2⤵
  PID:12248
- C:\Windows\System\cUjKwor.exe
  C:\Windows\System\cUjKwor.exe
  2⤵
  PID:10816
- C:\Windows\System\nlBTVsV.exe
  C:\Windows\System\nlBTVsV.exe
  2⤵
  PID:11288
- C:\Windows\System\PEDCPOX.exe
  C:\Windows\System\PEDCPOX.exe
  2⤵
  PID:11500
- C:\Windows\System\hPDHLDx.exe
  C:\Windows\System\hPDHLDx.exe
  2⤵
  PID:11708
- C:\Windows\System\UIEnKrB.exe
  C:\Windows\System\UIEnKrB.exe
  2⤵
  PID:12088
- C:\Windows\System\eRUZxlV.exe
  C:\Windows\System\eRUZxlV.exe
  2⤵
  PID:12084
- C:\Windows\System\psdBLDs.exe
  C:\Windows\System\psdBLDs.exe
  2⤵
  PID:11628
- C:\Windows\System\OaqPQUx.exe
  C:\Windows\System\OaqPQUx.exe
  2⤵
  PID:11604
- C:\Windows\System\zpLeaGG.exe
  C:\Windows\System\zpLeaGG.exe
  2⤵
  PID:12016
- C:\Windows\System\clMgMKs.exe
  C:\Windows\System\clMgMKs.exe
  2⤵
  PID:12136
- C:\Windows\System\gNIyjzp.exe
  C:\Windows\System\gNIyjzp.exe
  2⤵
  PID:12304
- C:\Windows\System\VBimoAf.exe
  C:\Windows\System\VBimoAf.exe
  2⤵
  PID:12324
- C:\Windows\System\mOjHhLz.exe
  C:\Windows\System\mOjHhLz.exe
  2⤵
  PID:12356
- C:\Windows\System\izlDbmh.exe
  C:\Windows\System\izlDbmh.exe
  2⤵
  PID:12376
- C:\Windows\System\wZUmDBD.exe
  C:\Windows\System\wZUmDBD.exe
  2⤵
  PID:12420
- C:\Windows\System\FBcdCfQ.exe
  C:\Windows\System\FBcdCfQ.exe
  2⤵
  PID:12436
- C:\Windows\System\IYFZEDj.exe
  C:\Windows\System\IYFZEDj.exe
  2⤵
  PID:12488
- C:\Windows\System\vLdRbRt.exe
  C:\Windows\System\vLdRbRt.exe
  2⤵
  PID:12512
- C:\Windows\System\WRGTmBo.exe
  C:\Windows\System\WRGTmBo.exe
  2⤵
  PID:12532
- C:\Windows\System\GOOJKjb.exe
  C:\Windows\System\GOOJKjb.exe
  2⤵
  PID:12560
- C:\Windows\System\NSHwQvK.exe
  C:\Windows\System\NSHwQvK.exe
  2⤵
  PID:12584
- C:\Windows\System\Xyluawr.exe
  C:\Windows\System\Xyluawr.exe
  2⤵
  PID:12612
- C:\Windows\System\OzlXVTW.exe
  C:\Windows\System\OzlXVTW.exe
  2⤵
  PID:12644
- C:\Windows\System\lSKMVYw.exe
  C:\Windows\System\lSKMVYw.exe
  2⤵
  PID:12664
- C:\Windows\System\aOUkpFn.exe
  C:\Windows\System\aOUkpFn.exe
  2⤵
  PID:12700
- C:\Windows\System\aookSRF.exe
  C:\Windows\System\aookSRF.exe
  2⤵
  PID:12740
- C:\Windows\System\lbhZNEV.exe
  C:\Windows\System\lbhZNEV.exe
  2⤵
  PID:12756
- C:\Windows\System\mRCdFKm.exe
  C:\Windows\System\mRCdFKm.exe
  2⤵
  PID:12784
- C:\Windows\System\IOqexcb.exe
  C:\Windows\System\IOqexcb.exe
  2⤵
  PID:12800
- C:\Windows\System\IqUZhPk.exe
  C:\Windows\System\IqUZhPk.exe
  2⤵
  PID:12824
- C:\Windows\System\bRwtNin.exe
  C:\Windows\System\bRwtNin.exe
  2⤵
  PID:12856
- C:\Windows\System\OdwNERp.exe
  C:\Windows\System\OdwNERp.exe
  2⤵
  PID:12880
- C:\Windows\System\LYxdNul.exe
  C:\Windows\System\LYxdNul.exe
  2⤵
  PID:12908
- C:\Windows\System\Cribszc.exe
  C:\Windows\System\Cribszc.exe
  2⤵
  PID:12932
- C:\Windows\System\CLgZIuM.exe
  C:\Windows\System\CLgZIuM.exe
  2⤵
  PID:12996
- C:\Windows\System\lfsvFqT.exe
  C:\Windows\System\lfsvFqT.exe
  2⤵
  PID:13024
- C:\Windows\System\zwnIrxA.exe
  C:\Windows\System\zwnIrxA.exe
  2⤵
  PID:13052
- C:\Windows\System\nKnZTDx.exe
  C:\Windows\System\nKnZTDx.exe
  2⤵
  PID:13076
- C:\Windows\System\MYIcSju.exe
  C:\Windows\System\MYIcSju.exe
  2⤵
  PID:13108
- C:\Windows\System\mMizAQR.exe
  C:\Windows\System\mMizAQR.exe
  2⤵
  PID:13124
- C:\Windows\System\IsNFyRd.exe
  C:\Windows\System\IsNFyRd.exe
  2⤵
  PID:13140
- C:\Windows\System\SmLCVpp.exe
  C:\Windows\System\SmLCVpp.exe
  2⤵
  PID:13192
- C:\Windows\System\crSQajc.exe
  C:\Windows\System\crSQajc.exe
  2⤵
  PID:13220
- C:\Windows\System\qvsGDdo.exe
  C:\Windows\System\qvsGDdo.exe
  2⤵
  PID:13236
- C:\Windows\System\tAgKTCc.exe
  C:\Windows\System\tAgKTCc.exe
  2⤵
  PID:13264
- C:\Windows\System\xeoDBZs.exe
  C:\Windows\System\xeoDBZs.exe
  2⤵
  PID:13280
- C:\Windows\System\fWCIRto.exe
  C:\Windows\System\fWCIRto.exe
  2⤵
  PID:13304
- C:\Windows\System\wvWegWE.exe
  C:\Windows\System\wvWegWE.exe
  2⤵
  PID:12296
- C:\Windows\System\NVShYOv.exe
  C:\Windows\System\NVShYOv.exe
  2⤵
  PID:12428
- C:\Windows\System\mivlUhF.exe
  C:\Windows\System\mivlUhF.exe
  2⤵
  PID:12480
- C:\Windows\System\CvdQZlS.exe
  C:\Windows\System\CvdQZlS.exe
  2⤵
  PID:12520
- C:\Windows\System\vQVgqID.exe
  C:\Windows\System\vQVgqID.exe
  2⤵
  PID:12580
- C:\Windows\System\SSLITES.exe
  C:\Windows\System\SSLITES.exe
  2⤵
  PID:12680
- C:\Windows\System\KatbkDL.exe
  C:\Windows\System\KatbkDL.exe
  2⤵
  PID:12728
- C:\Windows\System\BqjdmbQ.exe
  C:\Windows\System\BqjdmbQ.exe
  2⤵
  PID:12812
- C:\Windows\System\QMOsacL.exe
  C:\Windows\System\QMOsacL.exe
  2⤵
  PID:12900
- C:\Windows\System\upTJNIy.exe
  C:\Windows\System\upTJNIy.exe
  2⤵
  PID:12924
- C:\Windows\System\FVVJhLD.exe
  C:\Windows\System\FVVJhLD.exe
  2⤵
  PID:13008
- C:\Windows\System\RymGuHG.exe
  C:\Windows\System\RymGuHG.exe
  2⤵
  PID:13072
- C:\Windows\System\uOKrdDp.exe
  C:\Windows\System\uOKrdDp.exe
  2⤵
  PID:13120
- C:\Windows\System\UlEZWZs.exe
  C:\Windows\System\UlEZWZs.exe
  2⤵
  PID:13132
- C:\Windows\System\BtPPeaG.exe
  C:\Windows\System\BtPPeaG.exe
  2⤵
  PID:13204
- C:\Windows\System\piAviXq.exe
  C:\Windows\System\piAviXq.exe
  2⤵
  PID:13288
- C:\Windows\System\PGIpiYW.exe
  C:\Windows\System\PGIpiYW.exe
  2⤵
  PID:12368
- C:\Windows\System\cQRTvAS.exe
  C:\Windows\System\cQRTvAS.exe
  2⤵
  PID:12624
- C:\Windows\System\HkqxtJS.exe
  C:\Windows\System\HkqxtJS.exe
  2⤵
  PID:12876
- C:\Windows\System\PVnnuyV.exe
  C:\Windows\System\PVnnuyV.exe
  2⤵
  PID:12976
- C:\Windows\System\BatEVYY.exe
  C:\Windows\System\BatEVYY.exe
  2⤵
  PID:13188
- C:\Windows\System\RunTEhg.exe
  C:\Windows\System\RunTEhg.exe
  2⤵
  PID:12312
- C:\Windows\System\tngZjny.exe
  C:\Windows\System\tngZjny.exe
  2⤵
  PID:12872
- C:\Windows\System\ctcLtUl.exe
  C:\Windows\System\ctcLtUl.exe
  2⤵
  PID:11412
- C:\Windows\System\EZKiaHO.exe
  C:\Windows\System\EZKiaHO.exe
  2⤵
  PID:13344
- C:\Windows\System\eqoaRff.exe
  C:\Windows\System\eqoaRff.exe
  2⤵
  PID:13372
- C:\Windows\System\zUiHxLt.exe
  C:\Windows\System\zUiHxLt.exe
  2⤵
  PID:13412
- C:\Windows\System\LwThxFI.exe
  C:\Windows\System\LwThxFI.exe
  2⤵
  PID:13440
- C:\Windows\System\GuNLxRT.exe
  C:\Windows\System\GuNLxRT.exe
  2⤵
  PID:13464
- C:\Windows\System\NzyBJDJ.exe
  C:\Windows\System\NzyBJDJ.exe
  2⤵
  PID:13484
- C:\Windows\System\YGEgNKd.exe
  C:\Windows\System\YGEgNKd.exe
  2⤵
  PID:13508
- C:\Windows\System\EAJHzMe.exe
  C:\Windows\System\EAJHzMe.exe
  2⤵
  PID:13536
- C:\Windows\System\xKVQEIB.exe
  C:\Windows\System\xKVQEIB.exe
  2⤵
  PID:13580
- C:\Windows\System\JbjjWCa.exe
  C:\Windows\System\JbjjWCa.exe
  2⤵
  PID:13608
- C:\Windows\System\iOzKWrJ.exe
  C:\Windows\System\iOzKWrJ.exe
  2⤵
  PID:13624
- C:\Windows\System\hiBdGXb.exe
  C:\Windows\System\hiBdGXb.exe
  2⤵
  PID:13640
- C:\Windows\System\RLwzCJo.exe
  C:\Windows\System\RLwzCJo.exe
  2⤵
  PID:13692
- C:\Windows\System\fWgsxao.exe
  C:\Windows\System\fWgsxao.exe
  2⤵
  PID:13720
- C:\Windows\System\RJNWNBz.exe
  C:\Windows\System\RJNWNBz.exe
  2⤵
  PID:13748
- C:\Windows\System\ThdKkSU.exe
  C:\Windows\System\ThdKkSU.exe
  2⤵
  PID:13776
- C:\Windows\System\oDgrrhV.exe
  C:\Windows\System\oDgrrhV.exe
  2⤵
  PID:13796
- C:\Windows\System\YpwNanX.exe
  C:\Windows\System\YpwNanX.exe
  2⤵
  PID:13820
- C:\Windows\System\msAzWvC.exe
  C:\Windows\System\msAzWvC.exe
  2⤵
  PID:13840
- C:\Windows\System\SfnlKUq.exe
  C:\Windows\System\SfnlKUq.exe
  2⤵
  PID:13868
- C:\Windows\System\VegWeMP.exe
  C:\Windows\System\VegWeMP.exe
  2⤵
  PID:13892
- C:\Windows\System\TTVnoFf.exe
  C:\Windows\System\TTVnoFf.exe
  2⤵
  PID:13920
- C:\Windows\System\DMIUeGk.exe
  C:\Windows\System\DMIUeGk.exe
  2⤵
  PID:13944
- C:\Windows\System\mWJUaEL.exe
  C:\Windows\System\mWJUaEL.exe
  2⤵
  PID:13964
- C:\Windows\System\IbvMOAC.exe
  C:\Windows\System\IbvMOAC.exe
  2⤵
  PID:14028
- C:\Windows\System\TYufkSo.exe
  C:\Windows\System\TYufkSo.exe
  2⤵
  PID:14056
- C:\Windows\System\bBWREXB.exe
  C:\Windows\System\bBWREXB.exe
  2⤵
  PID:14084
- C:\Windows\System\RzYEDDu.exe
  C:\Windows\System\RzYEDDu.exe
  2⤵
  PID:14116
- C:\Windows\System\yAvbtEV.exe
  C:\Windows\System\yAvbtEV.exe
  2⤵
  PID:14132
- C:\Windows\System\gLyzpnt.exe
  C:\Windows\System\gLyzpnt.exe
  2⤵
  PID:14156
- C:\Windows\System\PossLPp.exe
  C:\Windows\System\PossLPp.exe
  2⤵
  PID:14184
- C:\Windows\System\BCdrbLz.exe
  C:\Windows\System\BCdrbLz.exe
  2⤵
  PID:14216
- C:\Windows\System\BpNOcFo.exe
  C:\Windows\System\BpNOcFo.exe
  2⤵
  PID:14232
- C:\Windows\System\MSrEXfc.exe
  C:\Windows\System\MSrEXfc.exe
  2⤵
  PID:14256
- C:\Windows\System\IVGzPjE.exe
  C:\Windows\System\IVGzPjE.exe
  2⤵
  PID:14272
- C:\Windows\System\fGSGqUK.exe
  C:\Windows\System\fGSGqUK.exe
  2⤵
  PID:14292
- C:\Windows\System\pWDBgzM.exe
  C:\Windows\System\pWDBgzM.exe
  2⤵
  PID:14316
- C:\Windows\System\tLZnzOV.exe
  C:\Windows\System\tLZnzOV.exe
  2⤵
  PID:13320
- C:\Windows\System\zkLJbVB.exe
  C:\Windows\System\zkLJbVB.exe
  2⤵
  PID:13408
- C:\Windows\System\jDzIptV.exe
  C:\Windows\System\jDzIptV.exe
  2⤵
  PID:13504
- C:\Windows\System\ZPMfnNP.exe
  C:\Windows\System\ZPMfnNP.exe
  2⤵
  PID:13592
- C:\Windows\System\FTAAClK.exe
  C:\Windows\System\FTAAClK.exe
  2⤵
  PID:13672
- C:\Windows\System\sgsuWhB.exe
  C:\Windows\System\sgsuWhB.exe
  2⤵
  PID:13712
- C:\Windows\System\brMSFSm.exe
  C:\Windows\System\brMSFSm.exe
  2⤵
  PID:13804
- C:\Windows\System\bKRlYkf.exe
  C:\Windows\System\bKRlYkf.exe
  2⤵
  PID:13832
- C:\Windows\System\IpYgVEi.exe
  C:\Windows\System\IpYgVEi.exe
  2⤵
  PID:13860
- C:\Windows\System\VOivdpG.exe
  C:\Windows\System\VOivdpG.exe
  2⤵
  PID:13960
- C:\Windows\System\wCbVjhu.exe
  C:\Windows\System\wCbVjhu.exe
  2⤵
  PID:14020
- C:\Windows\System\tnTLfcr.exe
  C:\Windows\System\tnTLfcr.exe
  2⤵
  PID:14068
- C:\Windows\System\RAFFsIk.exe
  C:\Windows\System\RAFFsIk.exe
  2⤵
  PID:14124
- C:\Windows\System\xteCCmq.exe
  C:\Windows\System\xteCCmq.exe
  2⤵
  PID:14168
- C:\Windows\System\svddItC.exe
  C:\Windows\System\svddItC.exe
  2⤵
  PID:14268
- C:\Windows\System\pyrtrpW.exe
  C:\Windows\System\pyrtrpW.exe
  2⤵
  PID:14284
- C:\Windows\System\tgVivdU.exe
  C:\Windows\System\tgVivdU.exe
  2⤵
  PID:13528
- C:\Windows\System\reCHLxu.exe
  C:\Windows\System\reCHLxu.exe
  2⤵
  PID:13436
- C:\Windows\System\sKCthqA.exe
  C:\Windows\System\sKCthqA.exe
  2⤵
  PID:13848
- C:\Windows\System\cYbagcU.exe
  C:\Windows\System\cYbagcU.exe
  2⤵
  PID:13856
- C:\Windows\System\TCxNWgH.exe
  C:\Windows\System\TCxNWgH.exe
  2⤵
  PID:14040
- C:\Windows\System\XUJbYIS.exe
  C:\Windows\System\XUJbYIS.exe
  2⤵
  PID:14204
- C:\Windows\System\tYuPVPs.exe
  C:\Windows\System\tYuPVPs.exe
  2⤵
  PID:14304
- C:\Windows\System\noCQYEp.exe
  C:\Windows\System\noCQYEp.exe
  2⤵
  PID:13044
- C:\Windows\System\KBDlHgG.exe
  C:\Windows\System\KBDlHgG.exe
  2⤵
  PID:13704
- C:\Windows\System\GGnzMtd.exe
  C:\Windows\System\GGnzMtd.exe
  2⤵
  PID:13916
- C:\Windows\System\PRzecDh.exe
  C:\Windows\System\PRzecDh.exe
  2⤵
  PID:13976
- C:\Windows\System\tvzBxPd.exe
  C:\Windows\System\tvzBxPd.exe
  2⤵
  PID:14352
- C:\Windows\System\PZHhcjt.exe
  C:\Windows\System\PZHhcjt.exe
  2⤵
  PID:14380
- C:\Windows\System\pfamrqO.exe
  C:\Windows\System\pfamrqO.exe
  2⤵
  PID:14436
- C:\Windows\System\nVYbsAh.exe
  C:\Windows\System\nVYbsAh.exe
  2⤵
  PID:14460
- C:\Windows\System\RsoXluw.exe
  C:\Windows\System\RsoXluw.exe
  2⤵
  PID:14484
- C:\Windows\System\LxSeEVC.exe
  C:\Windows\System\LxSeEVC.exe
  2⤵
  PID:14524
- C:\Windows\System\hPKjXhH.exe
  C:\Windows\System\hPKjXhH.exe
  2⤵
  PID:14544
- C:\Windows\System\ABkZccp.exe
  C:\Windows\System\ABkZccp.exe
  2⤵
  PID:14576
- C:\Windows\System\mDsfzDh.exe
  C:\Windows\System\mDsfzDh.exe
  2⤵
  PID:14604
- C:\Windows\System\AUtXoxV.exe
  C:\Windows\System\AUtXoxV.exe
  2⤵
  PID:14628
- C:\Windows\System\aGWvHqc.exe
  C:\Windows\System\aGWvHqc.exe
  2⤵
  PID:14656
- C:\Windows\System\FRLsSUT.exe
  C:\Windows\System\FRLsSUT.exe
  2⤵
  PID:14684
- C:\Windows\System\bVYTOfL.exe
  C:\Windows\System\bVYTOfL.exe
  2⤵
  PID:14708
- C:\Windows\System\dZdOwyK.exe
  C:\Windows\System\dZdOwyK.exe
  2⤵
  PID:14744
- C:\Windows\System\uCbRkpk.exe
  C:\Windows\System\uCbRkpk.exe
  2⤵
  PID:14764
- C:\Windows\System\QPbyQLh.exe
  C:\Windows\System\QPbyQLh.exe
  2⤵
  PID:14808
- C:\Windows\System\XjDwOUR.exe
  C:\Windows\System\XjDwOUR.exe
  2⤵
  PID:14836
- C:\Windows\System\hJcpfij.exe
  C:\Windows\System\hJcpfij.exe
  2⤵
  PID:14852
- C:\Windows\System\todGQnW.exe
  C:\Windows\System\todGQnW.exe
  2⤵
  PID:14904
- C:\Windows\System\OpsXyNt.exe
  C:\Windows\System\OpsXyNt.exe
  2⤵
  PID:14920
- C:\Windows\System\CdNSkKK.exe
  C:\Windows\System\CdNSkKK.exe
  2⤵
  PID:14948
- C:\Windows\System\SUJHhUP.exe
  C:\Windows\System\SUJHhUP.exe
  2⤵
  PID:14964
- C:\Windows\System\YvDVMwt.exe
  C:\Windows\System\YvDVMwt.exe
  2⤵
  PID:15004
- C:\Windows\System\FXrsFIj.exe
  C:\Windows\System\FXrsFIj.exe
  2⤵
  PID:15020
- C:\Windows\System\dFfjZsp.exe
  C:\Windows\System\dFfjZsp.exe
  2⤵
  PID:15044
- C:\Windows\System\slrjIaF.exe
  C:\Windows\System\slrjIaF.exe
  2⤵
  PID:15084
- C:\Windows\System\JGUXGgl.exe
  C:\Windows\System\JGUXGgl.exe
  2⤵
  PID:15104
- C:\Windows\System\zMTmnnK.exe
  C:\Windows\System\zMTmnnK.exe
  2⤵
  PID:15152
- C:\Windows\System\EiCGhOg.exe
  C:\Windows\System\EiCGhOg.exe
  2⤵
  PID:15168
- C:\Windows\System\xZfPlDk.exe
  C:\Windows\System\xZfPlDk.exe
  2⤵
  PID:15188
- C:\Windows\System\VwEifjG.exe
  C:\Windows\System\VwEifjG.exe
  2⤵
  PID:15240
- C:\Windows\System\KwjOWEu.exe
  C:\Windows\System\KwjOWEu.exe
  2⤵
  PID:15264
- C:\Windows\System\YxkqzkX.exe
  C:\Windows\System\YxkqzkX.exe
  2⤵
  PID:15284
- C:\Windows\System\OOkDgGF.exe
  C:\Windows\System\OOkDgGF.exe
  2⤵
  PID:15312
- C:\Windows\System\DYGFOOS.exe
  C:\Windows\System\DYGFOOS.exe
  2⤵
  PID:15328
- C:\Windows\System\ZANDiUd.exe
  C:\Windows\System\ZANDiUd.exe
  2⤵
  PID:13424
- C:\Windows\System\zPgKsMm.exe
  C:\Windows\System\zPgKsMm.exe
  2⤵
  PID:14200
- C:\Windows\System\aWEVcbW.exe
  C:\Windows\System\aWEVcbW.exe
  2⤵
  PID:14404
- C:\Windows\System\yDZiBkX.exe
  C:\Windows\System\yDZiBkX.exe
  2⤵
  PID:14492
- C:\Windows\System\rdjwIat.exe
  C:\Windows\System\rdjwIat.exe
  2⤵
  PID:14508
- C:\Windows\System\NULIYcA.exe
  C:\Windows\System\NULIYcA.exe
  2⤵
  PID:14640
- C:\Windows\System\PaCuMHq.exe
  C:\Windows\System\PaCuMHq.exe
  2⤵
  PID:14668
- C:\Windows\System\uItITLT.exe
  C:\Windows\System\uItITLT.exe
  2⤵
  PID:14780
- C:\Windows\System\DVRrVXu.exe
  C:\Windows\System\DVRrVXu.exe
  2⤵
  PID:14848
- C:\Windows\System\lxXgCQY.exe
  C:\Windows\System\lxXgCQY.exe
  2⤵
  PID:14888
- C:\Windows\System\nYCDdVJ.exe
  C:\Windows\System\nYCDdVJ.exe
  2⤵
  PID:14936
- C:\Windows\System\rsGRrLp.exe
  C:\Windows\System\rsGRrLp.exe
  2⤵
  PID:14976
- C:\Windows\System\HqndqwW.exe
  C:\Windows\System\HqndqwW.exe
  2⤵
  PID:15080
- C:\Windows\System\HtJEqyn.exe
  C:\Windows\System\HtJEqyn.exe
  2⤵
  PID:15124
- C:\Windows\System\nVJkbUv.exe
  C:\Windows\System\nVJkbUv.exe
  2⤵
  PID:15176
- C:\Windows\System\oIznKrI.exe
  C:\Windows\System\oIznKrI.exe
  2⤵
  PID:15296
- C:\Windows\System\JWYTDHj.exe
  C:\Windows\System\JWYTDHj.exe
  2⤵
  PID:14372
- C:\Windows\System\pXceQbl.exe
  C:\Windows\System\pXceQbl.exe
  2⤵
  PID:14340
- C:\Windows\System\ezcTXKM.exe
  C:\Windows\System\ezcTXKM.exe
  2⤵
  PID:14536
- C:\Windows\System\HrhlMbc.exe
  C:\Windows\System\HrhlMbc.exe
  2⤵
  PID:14676
- C:\Windows\System\TjUbtGi.exe
  C:\Windows\System\TjUbtGi.exe
  2⤵
  PID:14844
- C:\Windows\System\KZvbVNJ.exe
  C:\Windows\System\KZvbVNJ.exe
  2⤵
  PID:15012
- C:\Windows\System\vGOvRbw.exe
  C:\Windows\System\vGOvRbw.exe
  2⤵
  PID:15096
- C:\Windows\System\fzpNtgN.exe
  C:\Windows\System\fzpNtgN.exe
  2⤵
  PID:15236
- C:\Windows\System\aINuYiY.exe
  C:\Windows\System\aINuYiY.exe
  2⤵
  PID:14112
- C:\Windows\System\vOKqyvW.exe
  C:\Windows\System\vOKqyvW.exe
  2⤵
  PID:14600
- C:\Windows\System\PHIzlRP.exe
  C:\Windows\System\PHIzlRP.exe
  2⤵
  PID:14624
- C:\Windows\System\qrQMyuV.exe
  C:\Windows\System\qrQMyuV.exe
  2⤵
  PID:14956
- C:\Windows\System\OoABaPg.exe
  C:\Windows\System\OoABaPg.exe
  2⤵
  PID:15384
- C:\Windows\System\SdFoSxD.exe
  C:\Windows\System\SdFoSxD.exe
  2⤵
  PID:15428
- C:\Windows\System\WleqzbA.exe
  C:\Windows\System\WleqzbA.exe
  2⤵
  PID:15452
- C:\Windows\System\UtHiIGJ.exe
  C:\Windows\System\UtHiIGJ.exe
  2⤵
  PID:15496
- C:\Windows\System\RbojOGG.exe
  C:\Windows\System\RbojOGG.exe
  2⤵
  PID:15512
- C:\Windows\System\tIBaavm.exe
  C:\Windows\System\tIBaavm.exe
  2⤵
  PID:15528
- C:\Windows\System\SRrNgNW.exe
  C:\Windows\System\SRrNgNW.exe
  2⤵
  PID:15580
- C:\Windows\System\IhcuCNW.exe
  C:\Windows\System\IhcuCNW.exe
  2⤵
  PID:15604
- C:\Windows\System\gaggwuu.exe
  C:\Windows\System\gaggwuu.exe
  2⤵
  PID:15632
- C:\Windows\System\HPIqtII.exe
  C:\Windows\System\HPIqtII.exe
  2⤵
  PID:15652
- C:\Windows\System\JiiyaPC.exe
  C:\Windows\System\JiiyaPC.exe
  2⤵
  PID:15704
- C:\Windows\System\SwWVKiC.exe
  C:\Windows\System\SwWVKiC.exe
  2⤵
  PID:15736
- C:\Windows\System\UWYDiBc.exe
  C:\Windows\System\UWYDiBc.exe
  2⤵
  PID:15756
- C:\Windows\System\eVISvxb.exe
  C:\Windows\System\eVISvxb.exe
  2⤵
  PID:15780
- C:\Windows\System\QATkhxH.exe
  C:\Windows\System\QATkhxH.exe
  2⤵
  PID:15796
- C:\Windows\System\hwdGMYa.exe
  C:\Windows\System\hwdGMYa.exe
  2⤵
  PID:15836
- C:\Windows\System\FomqCBp.exe
  C:\Windows\System\FomqCBp.exe
  2⤵
  PID:15852
- C:\Windows\System\TPssoRk.exe
  C:\Windows\System\TPssoRk.exe
  2⤵
  PID:15900
- C:\Windows\System\ECmDEQM.exe
  C:\Windows\System\ECmDEQM.exe
  2⤵
  PID:15920
- C:\Windows\System\tXvyYpu.exe
  C:\Windows\System\tXvyYpu.exe
  2⤵
  PID:15940
- C:\Windows\System\cFAYbxZ.exe
  C:\Windows\System\cFAYbxZ.exe
  2⤵
  PID:15972
- C:\Windows\System\uphEpsN.exe
  C:\Windows\System\uphEpsN.exe
  2⤵
  PID:15992
- C:\Windows\System\pBiNMwi.exe
  C:\Windows\System\pBiNMwi.exe
  2⤵
  PID:16032
- C:\Windows\System\UUtJtqr.exe
  C:\Windows\System\UUtJtqr.exe
  2⤵
  PID:16048
- C:\Windows\System\onmVHFm.exe
  C:\Windows\System\onmVHFm.exe
  2⤵
  PID:16100
- C:\Windows\System\DioSbOU.exe
  C:\Windows\System\DioSbOU.exe
  2⤵
  PID:16116
- C:\Windows\System\IHqlXtX.exe
  C:\Windows\System\IHqlXtX.exe
  2⤵
  PID:16136
- C:\Windows\System\rmGqNTs.exe
  C:\Windows\System\rmGqNTs.exe
  2⤵
  PID:16172
- C:\Windows\System\yzYieWO.exe
  C:\Windows\System\yzYieWO.exe
  2⤵
  PID:16188
- C:\Windows\System\pZXnCXE.exe
  C:\Windows\System\pZXnCXE.exe
  2⤵
  PID:16216
- C:\Windows\System\GjIHspb.exe
  C:\Windows\System\GjIHspb.exe
  2⤵
  PID:16248
- C:\Windows\System\ZiAWyWF.exe
  C:\Windows\System\ZiAWyWF.exe
  2⤵
  PID:16268
- C:\Windows\System\oRyVKHl.exe
  C:\Windows\System\oRyVKHl.exe
  2⤵
  PID:16296
- C:\Windows\System\UtpJLhl.exe
  C:\Windows\System\UtpJLhl.exe
  2⤵
  PID:16332
- C:\Windows\System\TPNPWsL.exe
  C:\Windows\System\TPNPWsL.exe
  2⤵
  PID:16348
- C:\Windows\System\VOQvkzD.exe
  C:\Windows\System\VOQvkzD.exe
  2⤵
  PID:16372
- C:\Windows\System\QfrHzEp.exe
  C:\Windows\System\QfrHzEp.exe
  2⤵
  PID:15040
- C:\Windows\System\DOZmRds.exe
  C:\Windows\System\DOZmRds.exe
  2⤵
  PID:15488
- C:\Windows\System\TNkYExy.exe
  C:\Windows\System\TNkYExy.exe
  2⤵
  PID:15504
- C:\Windows\System\IlqJIXv.exe
  C:\Windows\System\IlqJIXv.exe
  2⤵
  PID:15568
- C:\Windows\System\LyzhdNw.exe
  C:\Windows\System\LyzhdNw.exe
  2⤵
  PID:15600
- C:\Windows\System\SczSzeF.exe
  C:\Windows\System\SczSzeF.exe
  2⤵
  PID:15676
- C:\Windows\System\HPSivJT.exe
  C:\Windows\System\HPSivJT.exe
  2⤵
  PID:15732
- C:\Windows\System\kxQKBLR.exe
  C:\Windows\System\kxQKBLR.exe
  2⤵
  PID:15788
- C:\Windows\System\JRCHdQU.exe
  C:\Windows\System\JRCHdQU.exe
  2⤵
  PID:15872
- C:\Windows\System\KOgmMDX.exe
  C:\Windows\System\KOgmMDX.exe
  2⤵
  PID:15984
- C:\Windows\System\pjBgHEE.exe
  C:\Windows\System\pjBgHEE.exe
  2⤵
  PID:15988
- C:\Windows\System\nDdqNMW.exe
  C:\Windows\System\nDdqNMW.exe
  2⤵
  PID:16108
- C:\Windows\System\qhVtoqh.exe
  C:\Windows\System\qhVtoqh.exe
  2⤵
  PID:14480
- C:\Windows\System\sTctTll.exe
  C:\Windows\System\sTctTll.exe
  2⤵
  PID:16200
- C:\Windows\System\jERtrwv.exe
  C:\Windows\System\jERtrwv.exe
  2⤵
  PID:16236
- C:\Windows\System\kUiuXRY.exe
  C:\Windows\System\kUiuXRY.exe
  2⤵
  PID:16316
- C:\Windows\System\AzaPVJZ.exe
  C:\Windows\System\AzaPVJZ.exe
  2⤵
  PID:13908
- C:\Windows\System\kCUSSVp.exe
  C:\Windows\System\kCUSSVp.exe
  2⤵
  PID:15588
- C:\Windows\System\PWwlWFi.exe
  C:\Windows\System\PWwlWFi.exe
  2⤵
  PID:15552
- C:\Windows\System\iLXuOdi.exe
  C:\Windows\System\iLXuOdi.exe
  2⤵
  PID:15864
- C:\Windows\System\mvTunJm.exe
  C:\Windows\System\mvTunJm.exe
  2⤵
  PID:15876
- C:\Windows\System\QmlpTEy.exe
  C:\Windows\System\QmlpTEy.exe
  2⤵
  PID:16084
- C:\Windows\System\uQVnFuy.exe
  C:\Windows\System\uQVnFuy.exe
  2⤵
  PID:16260
- C:\Windows\System\TJmULKs.exe
  C:\Windows\System\TJmULKs.exe
  2⤵
  PID:16368
- C:\Windows\System\ceakXCN.exe
  C:\Windows\System\ceakXCN.exe
  2⤵
  PID:15764
- C:\Windows\System\xzlvozl.exe
  C:\Windows\System\xzlvozl.exe
  2⤵
  PID:15948
- C:\Windows\System\EBHFYfP.exe
  C:\Windows\System\EBHFYfP.exe
  2⤵
  PID:15968
- C:\Windows\System\vhlgAnm.exe
  C:\Windows\System\vhlgAnm.exe
  2⤵
  PID:15692
- C:\Windows\System\aruhiUa.exe
  C:\Windows\System\aruhiUa.exe
  2⤵
  PID:16404
- C:\Windows\System\kXlJmxN.exe
  C:\Windows\System\kXlJmxN.exe
  2⤵
  PID:16420
- C:\Windows\System\DzQiXrx.exe
  C:\Windows\System\DzQiXrx.exe
  2⤵
  PID:16484
- C:\Windows\System\HMBHPQk.exe
  C:\Windows\System\HMBHPQk.exe
  2⤵
  PID:16508
- C:\Windows\System\mHEqtnB.exe
  C:\Windows\System\mHEqtnB.exe
  2⤵
  PID:16528
- C:\Windows\System\MZlLOYV.exe
  C:\Windows\System\MZlLOYV.exe
  2⤵
  PID:16548
- C:\Windows\System\RupfTLF.exe
  C:\Windows\System\RupfTLF.exe
  2⤵
  PID:16584
- C:\Windows\System\YJciEAC.exe
  C:\Windows\System\YJciEAC.exe
  2⤵
  PID:16604
- C:\Windows\System\ojgTuyK.exe
  C:\Windows\System\ojgTuyK.exe
  2⤵
  PID:16628
- C:\Windows\System\AvsimaO.exe
  C:\Windows\System\AvsimaO.exe
  2⤵
  PID:16644
- C:\Windows\System\UiuIxhj.exe
  C:\Windows\System\UiuIxhj.exe
  2⤵
  PID:16684
- C:\Windows\System\GXnrrlj.exe
  C:\Windows\System\GXnrrlj.exe
  2⤵
  PID:16712
- C:\Windows\System\ldYIbRv.exe
  C:\Windows\System\ldYIbRv.exe
  2⤵
  PID:16752
- C:\Windows\System\cfbzHKk.exe
  C:\Windows\System\cfbzHKk.exe
  2⤵
  PID:16784
- C:\Windows\System\aXbTkgb.exe
  C:\Windows\System\aXbTkgb.exe
  2⤵
  PID:16800
- C:\Windows\System\CgSzcvh.exe
  C:\Windows\System\CgSzcvh.exe
  2⤵
  PID:16820
- C:\Windows\System\LBLTXZY.exe
  C:\Windows\System\LBLTXZY.exe
  2⤵
  PID:16856
- C:\Windows\System\jTaCRHC.exe
  C:\Windows\System\jTaCRHC.exe
  2⤵
  PID:16876
- C:\Windows\System\gWcsuhL.exe
  C:\Windows\System\gWcsuhL.exe
  2⤵
  PID:16896
- C:\Windows\System\xWvvmUM.exe
  C:\Windows\System\xWvvmUM.exe
  2⤵
  PID:16912

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:17160

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\AuaUgkr.exe

Filesize
1.4MB

MD5
61067322b01b2e8c96c3672b66700881

SHA1
d21ab47cfba3be1675b1adebd9069a73f58d712e

SHA256
3a26db77850346c5d718d1d2c577c527a24d118a539070ecf12925bd1b0a5663

SHA512
8f2f129a1d2b478bcaf8720f2e697732140bafee9ad9e83e3391d23e59fd8bd6836e274ccfff83a139725360f7e8b11fc2cd94d37d556e7b90b2945cef6b11c0

Download Submit
C:\Windows\System\CxhkcgE.exe

Filesize
1.4MB

MD5
627d828005ab0b436b42a7b9360c50a5

SHA1
9528fabcbb5f067782c34231f70f109601f2fe91

SHA256
644be0707f818ec93d385c72cc37f6fcd1479db42c9c34dd04947d28c6a87bed

SHA512
aff98c337aea1a41a4a26784c5ee91cc21d5f9a5302c990a585c82beeb8cc63e1eb60e924c028c866a68835dcdbb5e81cc0b6f5b8baac4f6362e5d07649b742c

Download Submit
C:\Windows\System\DEBckdj.exe

Filesize
1.4MB

MD5
e062ea7e820fe153a6fee0ee12caf907

SHA1
17716ab00fd9838cf437c900f3aae6cb7a1f491b

SHA256
162a6db69bd11c18941a65c327ab9441f56e57c068249cffd357e0ca41faafca

SHA512
35e6fd46df2f14cab88dd03994d8d80c014b8d7ae058c08d024ebe10b91291764254cbce05e1c974cbf9c0effafdd79e96eb288d5baf421001723f2dc7e7137b

Download Submit
C:\Windows\System\DeQbGyx.exe

Filesize
1.4MB

MD5
8fbdd28c17ef83434cff3bcfd8d6a75f

SHA1
3be593e71ff9d5d998441ba1ca40a7099340ab69

SHA256
9f2e3bc018288c452a0bc89f1981c865e5be303933565a78966f7e7c10c8da34

SHA512
024899acad92839919e951f56cbabb6122117d533ab6616a13ddc8a8c161fcfdfe6d72be47e4782524f3948021b9870ebcb846ff0ac9406bb18d1c635e998713

Download Submit
C:\Windows\System\EERQUHO.exe

Filesize
1.4MB

MD5
bfa776067f051aa51ac20c400a4a7ca0

SHA1
a05ce9dcf0b0d1da4731da6f35aa4a7e5d80e21d

SHA256
75304e0853d1a0b4a6f08e55ef0ac5686f72cd4cb05ca7d39e49b4dc8ce5392d

SHA512
5ed939a2062b5e3740bdd3354e6893654c12ecdc99d934355ce603c0cb28eb0f42d5548bdb440cc7af047b8e78086586764c2b1a86a32c0a45e3e8f1b8ea4cc1

Download Submit
C:\Windows\System\EXPtnbQ.exe

Filesize
1.4MB

MD5
7bfbb4b91e7ae377b34dda654c85d4e2

SHA1
e4c30950702ddfd49f3b6a2b903a1dd1a2f9254d

SHA256
6ad5b8cb2fe512751e8a7fba4684e6c5b6005ca20ec41756f141c891f863ffa8

SHA512
6f5dd646c252084117451eec24a336513d3abc2955c9adbdee577edc69477e42cb97468e5e8ce1cc1e0c94caf59f44d4da1ab31f20ee39e8d7fd95ff7a5aa8f9

Download Submit
C:\Windows\System\Idhroak.exe

Filesize
1.4MB

MD5
82049a6cf959da8e2576c42d82a87316

SHA1
cd2e345fc489c1e13031ca6fdaa20162796143c8

SHA256
a97d7e36977bd597349e0ca32252dcab3d42cb8beeb31f67b09fd047bb007c4c

SHA512
495dcb64d6c2547bbe62bf9a98efb2bfffc9ab54bef53247737e81d11f44956d1d144acdfef5211ed4bc2ee3aa9d256ea8a139a1e7987f3f3453d95511b9ecde

Download Submit
C:\Windows\System\JpJRftt.exe

Filesize
1.4MB

MD5
47f5cdca6e2d6a23dc350ade62600dec

SHA1
ee6a7c8ceed8df5099868874bfb980d4d8876c90

SHA256
2dfb468c3c377d740d08539d1b4a0c99f0509c78bb54c9587b630b09c45756f1

SHA512
bf549c7edb85a002a343992c5bf02de2d12162cb95edab20388351752b06da345dd2a463ad6fcb6d33c0b087d85e39f51f8a42b46f0863af8ce63e8a819c7caa

Download Submit
C:\Windows\System\JyYGsQB.exe

Filesize
1.4MB

MD5
166c9102f3c186f9c1782b424edb8850

SHA1
0b7973ab62ec7980e9e60252ba4d0b4d0d95a1dd

SHA256
f51dffd28931a9c833e8e1c272db3646348b1946c8f24be5b762538c2e6e9f47

SHA512
affe79d19a71ce8f6b9a9a2a2797956c658c04968956208967a7bdf636d69dce94f9bb7cb7b47ba46a16bf5e7e7f14e77f453d52ab22fe95084a04b5d683b289

Download Submit
C:\Windows\System\KMBFOdT.exe

Filesize
1.4MB

MD5
58780d86af8aa68f928bcfe5911235b4

SHA1
79fbf465d21c414b44b5fcacdc671fdc76edad72

SHA256
3093a3d14508d247089bdd6a4b9e6eb09e01cf2dc096b27f492712ee2b212945

SHA512
bdee088401aa2a20a12566f03f915b50275460ba68b5cfc9e75761c96acde869bbb63b71802d34d29fb9b1df6546691fe4c47f749854eac702b5311ce06b2d6b

Download Submit
C:\Windows\System\KMpwOFg.exe

Filesize
1.4MB

MD5
bc7cae82c606535844fa5f73bc036e24

SHA1
15d39cd88ad7d531ce356c10971354aeac21cbe2

SHA256
a0a1759f7588f895679503512871d4a8da77c12dda929a42322ef8ff13e0d253

SHA512
02616a3243a0127413805b508b1c06f493ecc02343102b7734b86c21335914306e1c991660ec12144854f5dfd0558c5f1d358953b7e2169d5a8ce17bec2633f3

Download Submit
C:\Windows\System\NakUdHc.exe

Filesize
1.4MB

MD5
083b4b428f66b42721ede706f17ef9f7

SHA1
1a0d17ff5d61c1d5d11d1414e188ba00d0fa32bd

SHA256
f27b6c312ae798ce4506890549c07b499614771e2d79c715746275e8f3bfa639

SHA512
5d629e8310f3149e32bee5df12ee8a8731179780b867e33872d7462c2be7e7d0a905cf30c17acaf86eec020562229244d75f7278b2d473eed5c0de11dee1be6d

Download Submit
C:\Windows\System\OEXYbmj.exe

Filesize
1.4MB

MD5
1d2b2d83b6b532282be1150037c0402c

SHA1
47a8d4c1b44264970ac140681f0d2df42623ef50

SHA256
7a2033f2dd3eba2f254f3256225b77531d4a67898b43e42dcc2203ee11e9a455

SHA512
f6c60973e051f03d2abaaed21dd03ff95c3906badca7522bdee360b157a3f1bb17f54f1f62d1e08dee1b5f70cdb9b38c70cddf160e74db4ad3b08244afdc33c8

Download Submit
C:\Windows\System\OzbwIGN.exe

Filesize
1.4MB

MD5
4d26e00595ebd2ecfe88ff7bbe2f6d86

SHA1
f1eb6006a09df765a6e206931c9fcd2b9e839712

SHA256
fe753ddbf00031d7e60f0aed7cb99643fad9a72ac9f46e43fdc907415f6270c1

SHA512
85257b6d2d79c8e32c646598cc16db1d0113edd4c638c1cea8e5f640403e425d68b2fb01b6fd77aec8d989afc29f18711029bb54cd06e88d24d189ffc237b6e0

Download Submit
C:\Windows\System\PhLpcCB.exe

Filesize
1.4MB

MD5
c8ced31b3dc9d7a041fa1153d4c13387

SHA1
01017a42c296d63c3d1d41f7413a648d5acaf303

SHA256
8f4e3649bf412189ee38eb9d61bd9f169ba2e7ee3ab2d94a6398a985824807f2

SHA512
e0d3411b73fba309b4243ed7e7a5a46900c6a94427af1f1905d7cb0b30140688205d1e089934e932b640cadc647c690c99155dd0010b083a245aba21306b8521

Download Submit
C:\Windows\System\QmpAyAM.exe

Filesize
1.4MB

MD5
d9f6660425008a0637190d74f10351c4

SHA1
b9fcc190cfed243478b382acacdf2af91fa785dd

SHA256
cc0818e86342b03e817001aef5b7e47880ae86a05793330eee577e17a0d5e3bd

SHA512
21a903c051961edb60e72853055e56941c262c59300349589af4191edfd4614f9146a97324937ccae21c113ed71f0acb1b8af3ede084940b71d4df18515e0c5d

Download Submit
C:\Windows\System\SJjsKjV.exe

Filesize
1.4MB

MD5
a3637ce59eed3417b33bdef61b450a91

SHA1
87e2c32185814cf4332e1668edd631a0c257f71e

SHA256
47513d495ff70019811781bd6738d7e42bf3c5a502eecee601b0f88914e25d9f

SHA512
b50ebea43eb192e2a8f7bb642fafc938dac3808ad667ab3408fa9b4a14e963e07e8077030cae525f0fcb157a57bd5e38e5768d7b096011e0c6ed6988ca85065f

Download Submit
C:\Windows\System\SyKTfpZ.exe

Filesize
1.4MB

MD5
f564e99da84d7c85a7d78114635f2d2e

SHA1
013b016409d3b268e779fed8c3ce15382bca158c

SHA256
3fc782994828178d2583017dcbbabad9dddfbfe3cd435fe5226e5b35d0dc8c7a

SHA512
5cef902a560d85e9094f96b04e11e48ce490beda3109521f8f7668a8e15659808cfcbdb0130ec68f9e4d346bb74e040459a1f5e0494bb47b6ca1351358f9f577

Download Submit
C:\Windows\System\TcMujmZ.exe

Filesize
1.4MB

MD5
dc869c68065b90512c1345a61b8f2b23

SHA1
a097bc8fd24a25d0a2f5fb4c4e1639d94a327d26

SHA256
c8d847ce9eb8241d367d4483ea475c2423c81d785ae0878db0856df04075781a

SHA512
43d3da48345a95a277faa0397f1592485337a28118fd48fa8a946422a81930d74a8e016003f5a7cdf68fdd5ffce262453e2591b7f8a91d9ce31b9fc33d5b3a53

Download Submit
C:\Windows\System\UvSBpcC.exe

Filesize
1.4MB

MD5
a7e7ea48596194110783b8be0981566b

SHA1
69a471d4f0b72daa86427bef271f02e0278e0de5

SHA256
99f6448a7808243d5646abbd14f10cc47b2763e0985568bbe60d2c4f7d0256a4

SHA512
1cd6649fb66a271d14a945955f856e6ee89e6c32b729ec5759f1289d48069e65dee7552ec93a91911e7286b935838db073b5eaa2d49ae51f13886ebd6bb61bf4

Download Submit
C:\Windows\System\aVdIKlW.exe

Filesize
1.4MB

MD5
33f64e60584bfabc0dc0b625f1de72b2

SHA1
561f6f5281cf7e496bd0365964b9720fea92cc04

SHA256
6a4e10b4a934bf1217787b2ddbe94e60c14819d0062e4761d314dadff34a6c20

SHA512
c85ed20727c0f40a597b38c14a91fc4914602f036de0592c42c7d686ccce78295623cca06f86bb73cbde982b9a2dedff8ce39f511fc7f244790194234557fcc3

Download Submit
C:\Windows\System\dsJavqN.exe

Filesize
1.4MB

MD5
5a74d55a359c36a3a1bde3bbc46935de

SHA1
81682d0bc018f3ab7538a6d6f932d56f51b2becc

SHA256
ce5727f9a08100322bad990dc88b798dbffcea0bd142a972a834457e3bf4e685

SHA512
c4bb6e3caa11e509dd844685a1d03cfdd08ddb27e5a5d1dd642dbd19f45883118a2206181e43b8d0bfb4066ca436d2428528494b70bacacde286594ef827426c

Download Submit
C:\Windows\System\ekXQEZp.exe

Filesize
1.4MB

MD5
39f857c3938ed47d02452ad72fe0c773

SHA1
dde3910d5e83660a78c8cba8de73f20d648e619d

SHA256
3312a2bfcc3608d27fb7123d15664d98065f5e17a3433ef3be95764b5f4afe19

SHA512
11c2a6b1e2a959126d23b7a24a7a64c1768e34d693d40be4665e415532aef2ada77153157e9be59a0538bcbd928518a6c78b08e0d1d39ff25d4e690124f4083f

Download Submit
C:\Windows\System\fcherPD.exe

Filesize
1.4MB

MD5
94392d67ca3dc92d499b0a356b0178fb

SHA1
f977e6b2159118801f5968125b273e967e570827

SHA256
80a088519030796508adf965454713257a13a0d7d0bb9797cba7ae05d9ad6ec6

SHA512
7c7d79faffc3409e8846af5e981f08058d2755d1f7359f6a39349210f93b977a1f6d61dc8cf4bbd081684f9f00875f9f6c183d9415e6cf4a1e9b29a57bc7ba8b

Download Submit
C:\Windows\System\gdSSYFX.exe

Filesize
1.4MB

MD5
dab3d4d76f83a029bdebe18410f9e26d

SHA1
b9ed65403f6cf31cf59ef1908a68452eaed1bb57

SHA256
11a127c5551c3c5e3e112093f3b7d6ac9a8fe9c89835e02907a19aa65d4eca1a

SHA512
1a21b3a4247554bff64c09b82036002b80a57b312e0183fa45fdd7f5c68bc9f25d9043a08f60dca72471975e957aac4b60c5080131c74a0ba3b26792634c9bd7

Download Submit
C:\Windows\System\hTVqKGb.exe

Filesize
1.4MB

MD5
48a391f7d6c2cfea1627a433cc087ab7

SHA1
9e6593b267c5da173a72c03f5ed5a125b14622e1

SHA256
72ae8dfe48f3a42cd89615adfc39180c97d847592592bb31cc8a3760dd1e52b6

SHA512
02ad6aebc490176ab9f866e59eb7be373aacb18b87b63effa2a21d6e2caf905ab0fbb791994fe2e66647c43e39e4e445748e90df140541fd1de33fa2ca6b684c

Download Submit
C:\Windows\System\jmPVwUq.exe

Filesize
1.4MB

MD5
1a0fbde80b62d726e2ad9a07f69b17c4

SHA1
83cc55f83f38bbd0439be1cb3d0940a353cc2cfe

SHA256
7ed977e3c79ac4a3557feec47a65cd087dc6a2101173dba85ced5dec62602841

SHA512
3a18182397fd6712a1a31da8166e11cea7f86e13de98a1c4bb64aeb603135e62246dd35c7ac9917a343ed2fbf0b5fb9985865795a10f726cd78a2e37052cd178

Download Submit
C:\Windows\System\kWVSiHb.exe

Filesize
1.4MB

MD5
a06471703218079ea2d10b8a45006993

SHA1
fa42e7dc56bb9723eb0e4fe8fffba48245e808aa

SHA256
1519ab4429496cfa3e36a90110d52c7f90d35c7abf8a2acd189f7c2ec106bb8a

SHA512
0f322433673f8f77ee2bf4ec1ad5a92ddfc30f9dc3a99e58bcaefcc2a6354c9747131c888728cf1bd3ee9fa44424412034231f0f708188081f556e6dc9c60fe1

Download Submit
C:\Windows\System\lmiVThs.exe

Filesize
1.4MB

MD5
c68821f9ff6407b1ef8a0743fd262ed1

SHA1
ec1959db775cd092258249cc3e10ee7727aa8a36

SHA256
c780d6a6ee319fae4d106ccd7939ff38e6c67f7b553674aa769313356f4b085d

SHA512
53855bc4c6f411c55f382ded75d05b4d3c6bfdab355b780411440aa639a9f44303ae6173e47a817304e6a6edb2554501cbfea01bf45bf311d39332237596b670

Download Submit
C:\Windows\System\mBsyzVt.exe

Filesize
1.4MB

MD5
860d15c42f212699003f070fcbeb3095

SHA1
2909016f36bab9f5670c874f420b31d0da7b4c68

SHA256
9e333b7b86a71eea362378fda88f45ef8ef9470ed2fc49ae209a13db59b5ccfe

SHA512
ba0b5639ada90fb30b83c779c1ba7142514eb37ca9fa21bb13773650f30fd52455248abfc976fc598e0321c7e0b3ac2eff6be4e756e8bdb58e8ecd8976803546

Download Submit
C:\Windows\System\qFZLpCg.exe

Filesize
1.4MB

MD5
c3c4bffe8fad8f95301c892a0c51c683

SHA1
705d818e3745a819c2842fd2ab0dac54cafdd03b

SHA256
353c407aad53df72c906c880e36624e2060f2685c1d95f054190ab8fea0c88b8

SHA512
0366454f3b1f250171f058297453b8aa89048b1b8e8e69584286ffa6b502c8b9952968dfd64e6d2df9e138bb4742c39081b4bb3392d53b96f89614c48a08e573

Download Submit
C:\Windows\System\qNdwSRM.exe

Filesize
1.4MB

MD5
a8b21573d1f36076d79256fcbaca7822

SHA1
4feed1e414d2d02706ce872d7682d01b22d2f76f

SHA256
1c54477ab5d09be4f790dbae8a1c06b00c7f658c1a232d2618eb2437db6c90e9

SHA512
3d95bbe7e375d517b0626563a9015a8cdac16d62a5e18b340c8b88e9681593a31a1685d965837a61299ba137fece7a84371246a14f7c25d2abacc2a3b53ea164

Download Submit
C:\Windows\System\xRkfUQQ.exe

Filesize
1.4MB

MD5
6d95865aae72f7647ed69632eee25c09

SHA1
1eeb8e68a0b7cc865afc8d7611c7e62948b0e5ca

SHA256
ead99f70bc93d8554032fa4ac45462512a7f81eda80afe0f073604d7414c2ccd

SHA512
89a41828d537ed78be5637f7753e94f8f2c1064f510766498b5a7ebf1f3c6ae72cc97278cd596bfa237a3efd3073f3cafd0037511e6a27f8e7993eb72b2eadd9

Download Submit
memory/1164-0-0x000001C1ABEE0000-0x000001C1ABEF0000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads