xmrig | df1dc136ac616b2bc651708c073213bfd32e6fd83dc0c4f7b10300bed82348b6

Analysis

max time kernel
116s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
25-12-2024 03:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

df1dc136ac616b2bc651708c073213bfd32e6fd83dc0c4f7b10300bed82348b6.exe
Size

1.3MB
MD5

c2600cbfdcdd142597edcec722ffb7d8
SHA1

759890b458ec502666b1ac09e549fa72241be762
SHA256

df1dc136ac616b2bc651708c073213bfd32e6fd83dc0c4f7b10300bed82348b6
SHA512

228adcd686fa10f12da786d925f8265804ff116bb02d3a6e2f55a5031d0d5daef45e1fafbdf8d91f7ff178de8f43381e67a360256be3acb541e7793fb053703a
SSDEEP

24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbpwlKenszQEMr2KrD8znOkR:GezaTF8FcNkNdfE0pZ9ozttwIRQC+OnR

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 36 IoCs

miner

resource	yara_rule
behavioral2/files/0x000c000000023b15-4.dat	xmrig
behavioral2/files/0x000a000000023b78-6.dat	xmrig
behavioral2/files/0x000c000000023b74-13.dat	xmrig
behavioral2/files/0x000a000000023b79-19.dat	xmrig
behavioral2/files/0x000a000000023b7a-24.dat	xmrig
behavioral2/files/0x000a000000023b7b-28.dat	xmrig
behavioral2/files/0x000a000000023b7c-38.dat	xmrig
behavioral2/files/0x000a000000023b7e-42.dat	xmrig
behavioral2/files/0x000a000000023b7f-51.dat	xmrig
behavioral2/files/0x000a000000023b81-55.dat	xmrig
behavioral2/files/0x000a000000023b80-53.dat	xmrig
behavioral2/files/0x000a000000023b82-59.dat	xmrig
behavioral2/files/0x0032000000023b75-65.dat	xmrig
behavioral2/files/0x000a000000023b83-68.dat	xmrig
behavioral2/files/0x000a000000023b84-74.dat	xmrig
behavioral2/files/0x000a000000023b85-79.dat	xmrig
behavioral2/files/0x000a000000023b86-83.dat	xmrig
behavioral2/files/0x000a000000023b87-88.dat	xmrig
behavioral2/files/0x000a000000023b8a-95.dat	xmrig
behavioral2/files/0x000a000000023b8c-107.dat	xmrig
behavioral2/files/0x000a000000023b8e-114.dat	xmrig
behavioral2/files/0x000a000000023b90-142.dat	xmrig
behavioral2/files/0x000a000000023b99-163.dat	xmrig
behavioral2/files/0x000a000000023b9a-175.dat	xmrig
behavioral2/files/0x000a000000023b8f-173.dat	xmrig
behavioral2/files/0x000a000000023b92-171.dat	xmrig
behavioral2/files/0x000a000000023b95-170.dat	xmrig
behavioral2/files/0x000a000000023b98-160.dat	xmrig
behavioral2/files/0x000a000000023b97-159.dat	xmrig
behavioral2/files/0x000a000000023b96-154.dat	xmrig
behavioral2/files/0x000a000000023b91-147.dat	xmrig
behavioral2/files/0x000a000000023b93-139.dat	xmrig
behavioral2/files/0x000a000000023b8d-132.dat	xmrig
behavioral2/files/0x000a000000023b94-153.dat	xmrig
behavioral2/files/0x000a000000023b8b-112.dat	xmrig
behavioral2/files/0x000a000000023b89-101.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
3116	WVyvvft.exe
3636	fJJJKsu.exe
3912	BBuCvNf.exe
2760	XoFPKmY.exe
2200	SWxTrwo.exe
1992	sleaIPh.exe
2420	OROsvvC.exe
3924	ynCdpzt.exe
4552	CMjcVwc.exe
1028	TkzuDgG.exe
1432	ydLfsda.exe
2328	mFzNFuL.exe
3868	DpsmvpC.exe
4568	yUqbkmx.exe
4796	dsJEgFl.exe
2684	wnzXUmR.exe
1976	dflQuLG.exe
4936	SzcPZkK.exe
4636	TLxMWpz.exe
2460	FOTjsOY.exe
4324	rNovirm.exe
3212	GBAsZIp.exe
3164	DQayHnH.exe
4016	YvGucdd.exe
688	tWHFRVH.exe
2348	zDDORbs.exe
4108	jtKnbvU.exe
3500	pYIvSfX.exe
1088	QDQzyjD.exe
1532	FTFfrER.exe
1660	JlXDzOg.exe
880	jfSMIWv.exe
2800	sAySpta.exe
4056	PvKpRrn.exe
4448	XlyBuPF.exe
5020	SYQhUMn.exe
5112	ogqxXhx.exe
3492	TpIEQqT.exe
3872	IvwFath.exe
1548	uWDMqti.exe
3184	HoLJDoe.exe
4884	dQQzbuu.exe
3788	CCMdAGQ.exe
1824	BowGxKr.exe
4316	RNxrWpr.exe
1372	DusPdbS.exe
3620	YSiCTyk.exe
5028	XxCvcsV.exe
704	CrHFerF.exe
3824	uPtZSvw.exe
4732	ZbmIoCw.exe
2628	JUWuKFQ.exe
3256	nsVPTPz.exe
2500	kqBiEnP.exe
2884	ULHyyrK.exe
2652	nOjLHRn.exe
3760	lkwacGS.exe
724	aAdEpRT.exe
404	RSqykvC.exe
2204	SZryIcW.exe
3952	prdBDGd.exe
2952	PaGhfPu.exe
4044	JpBwAMc.exe
1856	TIGFAgZ.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\yOVVGrf.exe	df1dc136ac616b2bc651708c073213bfd32e6fd83dc0c4f7b10300bed82348b6.exe
File created	C:\Windows\System\QLOwShQ.exe	df1dc136ac616b2bc651708c073213bfd32e6fd83dc0c4f7b10300bed82348b6.exe
File created	C:\Windows\System\fcrvAHT.exe	df1dc136ac616b2bc651708c073213bfd32e6fd83dc0c4f7b10300bed82348b6.exe
File created	C:\Windows\System\xQKKdlw.exe	df1dc136ac616b2bc651708c073213bfd32e6fd83dc0c4f7b10300bed82348b6.exe
File created	C:\Windows\System\FHgGvwx.exe	df1dc136ac616b2bc651708c073213bfd32e6fd83dc0c4f7b10300bed82348b6.exe
File created	C:\Windows\System\gedjvqK.exe	df1dc136ac616b2bc651708c073213bfd32e6fd83dc0c4f7b10300bed82348b6.exe
File created	C:\Windows\System\MOfOKPd.exe	df1dc136ac616b2bc651708c073213bfd32e6fd83dc0c4f7b10300bed82348b6.exe
File created	C:\Windows\System\yCzZsvd.exe	df1dc136ac616b2bc651708c073213bfd32e6fd83dc0c4f7b10300bed82348b6.exe
File created	C:\Windows\System\wImMOaa.exe	df1dc136ac616b2bc651708c073213bfd32e6fd83dc0c4f7b10300bed82348b6.exe
File created	C:\Windows\System\jVbtqmb.exe	df1dc136ac616b2bc651708c073213bfd32e6fd83dc0c4f7b10300bed82348b6.exe
File created	C:\Windows\System\suNINgr.exe	df1dc136ac616b2bc651708c073213bfd32e6fd83dc0c4f7b10300bed82348b6.exe
File created	C:\Windows\System\uCLiiTq.exe	df1dc136ac616b2bc651708c073213bfd32e6fd83dc0c4f7b10300bed82348b6.exe
File created	C:\Windows\System\CEkfJeq.exe	df1dc136ac616b2bc651708c073213bfd32e6fd83dc0c4f7b10300bed82348b6.exe
File created	C:\Windows\System\qGvkFWD.exe	df1dc136ac616b2bc651708c073213bfd32e6fd83dc0c4f7b10300bed82348b6.exe
File created	C:\Windows\System\xuVDPzg.exe	df1dc136ac616b2bc651708c073213bfd32e6fd83dc0c4f7b10300bed82348b6.exe
File created	C:\Windows\System\GGzmUGn.exe	df1dc136ac616b2bc651708c073213bfd32e6fd83dc0c4f7b10300bed82348b6.exe
File created	C:\Windows\System\JiXAFOQ.exe	df1dc136ac616b2bc651708c073213bfd32e6fd83dc0c4f7b10300bed82348b6.exe
File created	C:\Windows\System\FqEBrOb.exe	df1dc136ac616b2bc651708c073213bfd32e6fd83dc0c4f7b10300bed82348b6.exe
File created	C:\Windows\System\xYVhumw.exe	df1dc136ac616b2bc651708c073213bfd32e6fd83dc0c4f7b10300bed82348b6.exe
File created	C:\Windows\System\RZtXoGT.exe	df1dc136ac616b2bc651708c073213bfd32e6fd83dc0c4f7b10300bed82348b6.exe
File created	C:\Windows\System\usUPdTT.exe	df1dc136ac616b2bc651708c073213bfd32e6fd83dc0c4f7b10300bed82348b6.exe
File created	C:\Windows\System\sFjZaFq.exe	df1dc136ac616b2bc651708c073213bfd32e6fd83dc0c4f7b10300bed82348b6.exe
File created	C:\Windows\System\aeNSGsT.exe	df1dc136ac616b2bc651708c073213bfd32e6fd83dc0c4f7b10300bed82348b6.exe
File created	C:\Windows\System\cZSRfVM.exe	df1dc136ac616b2bc651708c073213bfd32e6fd83dc0c4f7b10300bed82348b6.exe
File created	C:\Windows\System\wySpRll.exe	df1dc136ac616b2bc651708c073213bfd32e6fd83dc0c4f7b10300bed82348b6.exe
File created	C:\Windows\System\cHqBEZO.exe	df1dc136ac616b2bc651708c073213bfd32e6fd83dc0c4f7b10300bed82348b6.exe
File created	C:\Windows\System\MaSJOrk.exe	df1dc136ac616b2bc651708c073213bfd32e6fd83dc0c4f7b10300bed82348b6.exe
File created	C:\Windows\System\ZbmIoCw.exe	df1dc136ac616b2bc651708c073213bfd32e6fd83dc0c4f7b10300bed82348b6.exe
File created	C:\Windows\System\RSqykvC.exe	df1dc136ac616b2bc651708c073213bfd32e6fd83dc0c4f7b10300bed82348b6.exe
File created	C:\Windows\System\DOtWNDs.exe	df1dc136ac616b2bc651708c073213bfd32e6fd83dc0c4f7b10300bed82348b6.exe
File created	C:\Windows\System\LskbTAc.exe	df1dc136ac616b2bc651708c073213bfd32e6fd83dc0c4f7b10300bed82348b6.exe
File created	C:\Windows\System\OSinlsz.exe	df1dc136ac616b2bc651708c073213bfd32e6fd83dc0c4f7b10300bed82348b6.exe
File created	C:\Windows\System\sBCXzIM.exe	df1dc136ac616b2bc651708c073213bfd32e6fd83dc0c4f7b10300bed82348b6.exe
File created	C:\Windows\System\efITisL.exe	df1dc136ac616b2bc651708c073213bfd32e6fd83dc0c4f7b10300bed82348b6.exe
File created	C:\Windows\System\SZryIcW.exe	df1dc136ac616b2bc651708c073213bfd32e6fd83dc0c4f7b10300bed82348b6.exe
File created	C:\Windows\System\ixICmgl.exe	df1dc136ac616b2bc651708c073213bfd32e6fd83dc0c4f7b10300bed82348b6.exe
File created	C:\Windows\System\orewbeC.exe	df1dc136ac616b2bc651708c073213bfd32e6fd83dc0c4f7b10300bed82348b6.exe
File created	C:\Windows\System\HmSjuht.exe	df1dc136ac616b2bc651708c073213bfd32e6fd83dc0c4f7b10300bed82348b6.exe
File created	C:\Windows\System\yeWcQxV.exe	df1dc136ac616b2bc651708c073213bfd32e6fd83dc0c4f7b10300bed82348b6.exe
File created	C:\Windows\System\IFyZRBC.exe	df1dc136ac616b2bc651708c073213bfd32e6fd83dc0c4f7b10300bed82348b6.exe
File created	C:\Windows\System\YXnjGAd.exe	df1dc136ac616b2bc651708c073213bfd32e6fd83dc0c4f7b10300bed82348b6.exe
File created	C:\Windows\System\WemcqwZ.exe	df1dc136ac616b2bc651708c073213bfd32e6fd83dc0c4f7b10300bed82348b6.exe
File created	C:\Windows\System\nYgzLJY.exe	df1dc136ac616b2bc651708c073213bfd32e6fd83dc0c4f7b10300bed82348b6.exe
File created	C:\Windows\System\QNAdjQr.exe	df1dc136ac616b2bc651708c073213bfd32e6fd83dc0c4f7b10300bed82348b6.exe
File created	C:\Windows\System\rYnyzRt.exe	df1dc136ac616b2bc651708c073213bfd32e6fd83dc0c4f7b10300bed82348b6.exe
File created	C:\Windows\System\QHRUYtY.exe	df1dc136ac616b2bc651708c073213bfd32e6fd83dc0c4f7b10300bed82348b6.exe
File created	C:\Windows\System\qgWmzmu.exe	df1dc136ac616b2bc651708c073213bfd32e6fd83dc0c4f7b10300bed82348b6.exe
File created	C:\Windows\System\wFQebUv.exe	df1dc136ac616b2bc651708c073213bfd32e6fd83dc0c4f7b10300bed82348b6.exe
File created	C:\Windows\System\MfXBYXV.exe	df1dc136ac616b2bc651708c073213bfd32e6fd83dc0c4f7b10300bed82348b6.exe
File created	C:\Windows\System\zLrKpal.exe	df1dc136ac616b2bc651708c073213bfd32e6fd83dc0c4f7b10300bed82348b6.exe
File created	C:\Windows\System\rNovirm.exe	df1dc136ac616b2bc651708c073213bfd32e6fd83dc0c4f7b10300bed82348b6.exe
File created	C:\Windows\System\OGJQNCJ.exe	df1dc136ac616b2bc651708c073213bfd32e6fd83dc0c4f7b10300bed82348b6.exe
File created	C:\Windows\System\IpMrQIk.exe	df1dc136ac616b2bc651708c073213bfd32e6fd83dc0c4f7b10300bed82348b6.exe
File created	C:\Windows\System\Vlsuufl.exe	df1dc136ac616b2bc651708c073213bfd32e6fd83dc0c4f7b10300bed82348b6.exe
File created	C:\Windows\System\XAmeRcU.exe	df1dc136ac616b2bc651708c073213bfd32e6fd83dc0c4f7b10300bed82348b6.exe
File created	C:\Windows\System\peFJfuW.exe	df1dc136ac616b2bc651708c073213bfd32e6fd83dc0c4f7b10300bed82348b6.exe
File created	C:\Windows\System\xxrkroc.exe	df1dc136ac616b2bc651708c073213bfd32e6fd83dc0c4f7b10300bed82348b6.exe
File created	C:\Windows\System\oktTQfz.exe	df1dc136ac616b2bc651708c073213bfd32e6fd83dc0c4f7b10300bed82348b6.exe
File created	C:\Windows\System\pVPECNv.exe	df1dc136ac616b2bc651708c073213bfd32e6fd83dc0c4f7b10300bed82348b6.exe
File created	C:\Windows\System\nSOeFQl.exe	df1dc136ac616b2bc651708c073213bfd32e6fd83dc0c4f7b10300bed82348b6.exe
File created	C:\Windows\System\aRRxqgW.exe	df1dc136ac616b2bc651708c073213bfd32e6fd83dc0c4f7b10300bed82348b6.exe
File created	C:\Windows\System\JkQewdx.exe	df1dc136ac616b2bc651708c073213bfd32e6fd83dc0c4f7b10300bed82348b6.exe
File created	C:\Windows\System\SYQhUMn.exe	df1dc136ac616b2bc651708c073213bfd32e6fd83dc0c4f7b10300bed82348b6.exe
File created	C:\Windows\System\oAApJaZ.exe	df1dc136ac616b2bc651708c073213bfd32e6fd83dc0c4f7b10300bed82348b6.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	16992	dwm.exe
Token: SeChangeNotifyPrivilege	16992	dwm.exe
Token: 33	16992	dwm.exe
Token: SeIncBasePriorityPrivilege	16992	dwm.exe
Token: SeShutdownPrivilege	16992	dwm.exe
Token: SeCreatePagefilePrivilege	16992	dwm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4912 wrote to memory of 3116	4912	df1dc136ac616b2bc651708c073213bfd32e6fd83dc0c4f7b10300bed82348b6.exe	84
PID 4912 wrote to memory of 3116	4912	df1dc136ac616b2bc651708c073213bfd32e6fd83dc0c4f7b10300bed82348b6.exe	84
PID 4912 wrote to memory of 3636	4912	df1dc136ac616b2bc651708c073213bfd32e6fd83dc0c4f7b10300bed82348b6.exe	85
PID 4912 wrote to memory of 3636	4912	df1dc136ac616b2bc651708c073213bfd32e6fd83dc0c4f7b10300bed82348b6.exe	85
PID 4912 wrote to memory of 3912	4912	df1dc136ac616b2bc651708c073213bfd32e6fd83dc0c4f7b10300bed82348b6.exe	86
PID 4912 wrote to memory of 3912	4912	df1dc136ac616b2bc651708c073213bfd32e6fd83dc0c4f7b10300bed82348b6.exe	86
PID 4912 wrote to memory of 2760	4912	df1dc136ac616b2bc651708c073213bfd32e6fd83dc0c4f7b10300bed82348b6.exe	87
PID 4912 wrote to memory of 2760	4912	df1dc136ac616b2bc651708c073213bfd32e6fd83dc0c4f7b10300bed82348b6.exe	87
PID 4912 wrote to memory of 2200	4912	df1dc136ac616b2bc651708c073213bfd32e6fd83dc0c4f7b10300bed82348b6.exe	88
PID 4912 wrote to memory of 2200	4912	df1dc136ac616b2bc651708c073213bfd32e6fd83dc0c4f7b10300bed82348b6.exe	88
PID 4912 wrote to memory of 1992	4912	df1dc136ac616b2bc651708c073213bfd32e6fd83dc0c4f7b10300bed82348b6.exe	89
PID 4912 wrote to memory of 1992	4912	df1dc136ac616b2bc651708c073213bfd32e6fd83dc0c4f7b10300bed82348b6.exe	89
PID 4912 wrote to memory of 2420	4912	df1dc136ac616b2bc651708c073213bfd32e6fd83dc0c4f7b10300bed82348b6.exe	90
PID 4912 wrote to memory of 2420	4912	df1dc136ac616b2bc651708c073213bfd32e6fd83dc0c4f7b10300bed82348b6.exe	90
PID 4912 wrote to memory of 3924	4912	df1dc136ac616b2bc651708c073213bfd32e6fd83dc0c4f7b10300bed82348b6.exe	91
PID 4912 wrote to memory of 3924	4912	df1dc136ac616b2bc651708c073213bfd32e6fd83dc0c4f7b10300bed82348b6.exe	91
PID 4912 wrote to memory of 4552	4912	df1dc136ac616b2bc651708c073213bfd32e6fd83dc0c4f7b10300bed82348b6.exe	92
PID 4912 wrote to memory of 4552	4912	df1dc136ac616b2bc651708c073213bfd32e6fd83dc0c4f7b10300bed82348b6.exe	92
PID 4912 wrote to memory of 1028	4912	df1dc136ac616b2bc651708c073213bfd32e6fd83dc0c4f7b10300bed82348b6.exe	93
PID 4912 wrote to memory of 1028	4912	df1dc136ac616b2bc651708c073213bfd32e6fd83dc0c4f7b10300bed82348b6.exe	93
PID 4912 wrote to memory of 1432	4912	df1dc136ac616b2bc651708c073213bfd32e6fd83dc0c4f7b10300bed82348b6.exe	94
PID 4912 wrote to memory of 1432	4912	df1dc136ac616b2bc651708c073213bfd32e6fd83dc0c4f7b10300bed82348b6.exe	94
PID 4912 wrote to memory of 2328	4912	df1dc136ac616b2bc651708c073213bfd32e6fd83dc0c4f7b10300bed82348b6.exe	95
PID 4912 wrote to memory of 2328	4912	df1dc136ac616b2bc651708c073213bfd32e6fd83dc0c4f7b10300bed82348b6.exe	95
PID 4912 wrote to memory of 3868	4912	df1dc136ac616b2bc651708c073213bfd32e6fd83dc0c4f7b10300bed82348b6.exe	96
PID 4912 wrote to memory of 3868	4912	df1dc136ac616b2bc651708c073213bfd32e6fd83dc0c4f7b10300bed82348b6.exe	96
PID 4912 wrote to memory of 4568	4912	df1dc136ac616b2bc651708c073213bfd32e6fd83dc0c4f7b10300bed82348b6.exe	97
PID 4912 wrote to memory of 4568	4912	df1dc136ac616b2bc651708c073213bfd32e6fd83dc0c4f7b10300bed82348b6.exe	97
PID 4912 wrote to memory of 4796	4912	df1dc136ac616b2bc651708c073213bfd32e6fd83dc0c4f7b10300bed82348b6.exe	98
PID 4912 wrote to memory of 4796	4912	df1dc136ac616b2bc651708c073213bfd32e6fd83dc0c4f7b10300bed82348b6.exe	98
PID 4912 wrote to memory of 2684	4912	df1dc136ac616b2bc651708c073213bfd32e6fd83dc0c4f7b10300bed82348b6.exe	99
PID 4912 wrote to memory of 2684	4912	df1dc136ac616b2bc651708c073213bfd32e6fd83dc0c4f7b10300bed82348b6.exe	99
PID 4912 wrote to memory of 1976	4912	df1dc136ac616b2bc651708c073213bfd32e6fd83dc0c4f7b10300bed82348b6.exe	100
PID 4912 wrote to memory of 1976	4912	df1dc136ac616b2bc651708c073213bfd32e6fd83dc0c4f7b10300bed82348b6.exe	100
PID 4912 wrote to memory of 4936	4912	df1dc136ac616b2bc651708c073213bfd32e6fd83dc0c4f7b10300bed82348b6.exe	101
PID 4912 wrote to memory of 4936	4912	df1dc136ac616b2bc651708c073213bfd32e6fd83dc0c4f7b10300bed82348b6.exe	101
PID 4912 wrote to memory of 4636	4912	df1dc136ac616b2bc651708c073213bfd32e6fd83dc0c4f7b10300bed82348b6.exe	102
PID 4912 wrote to memory of 4636	4912	df1dc136ac616b2bc651708c073213bfd32e6fd83dc0c4f7b10300bed82348b6.exe	102
PID 4912 wrote to memory of 2460	4912	df1dc136ac616b2bc651708c073213bfd32e6fd83dc0c4f7b10300bed82348b6.exe	103
PID 4912 wrote to memory of 2460	4912	df1dc136ac616b2bc651708c073213bfd32e6fd83dc0c4f7b10300bed82348b6.exe	103
PID 4912 wrote to memory of 4324	4912	df1dc136ac616b2bc651708c073213bfd32e6fd83dc0c4f7b10300bed82348b6.exe	104
PID 4912 wrote to memory of 4324	4912	df1dc136ac616b2bc651708c073213bfd32e6fd83dc0c4f7b10300bed82348b6.exe	104
PID 4912 wrote to memory of 3212	4912	df1dc136ac616b2bc651708c073213bfd32e6fd83dc0c4f7b10300bed82348b6.exe	105
PID 4912 wrote to memory of 3212	4912	df1dc136ac616b2bc651708c073213bfd32e6fd83dc0c4f7b10300bed82348b6.exe	105
PID 4912 wrote to memory of 3164	4912	df1dc136ac616b2bc651708c073213bfd32e6fd83dc0c4f7b10300bed82348b6.exe	106
PID 4912 wrote to memory of 3164	4912	df1dc136ac616b2bc651708c073213bfd32e6fd83dc0c4f7b10300bed82348b6.exe	106
PID 4912 wrote to memory of 4016	4912	df1dc136ac616b2bc651708c073213bfd32e6fd83dc0c4f7b10300bed82348b6.exe	107
PID 4912 wrote to memory of 4016	4912	df1dc136ac616b2bc651708c073213bfd32e6fd83dc0c4f7b10300bed82348b6.exe	107
PID 4912 wrote to memory of 688	4912	df1dc136ac616b2bc651708c073213bfd32e6fd83dc0c4f7b10300bed82348b6.exe	108
PID 4912 wrote to memory of 688	4912	df1dc136ac616b2bc651708c073213bfd32e6fd83dc0c4f7b10300bed82348b6.exe	108
PID 4912 wrote to memory of 2348	4912	df1dc136ac616b2bc651708c073213bfd32e6fd83dc0c4f7b10300bed82348b6.exe	109
PID 4912 wrote to memory of 2348	4912	df1dc136ac616b2bc651708c073213bfd32e6fd83dc0c4f7b10300bed82348b6.exe	109
PID 4912 wrote to memory of 4108	4912	df1dc136ac616b2bc651708c073213bfd32e6fd83dc0c4f7b10300bed82348b6.exe	110
PID 4912 wrote to memory of 4108	4912	df1dc136ac616b2bc651708c073213bfd32e6fd83dc0c4f7b10300bed82348b6.exe	110
PID 4912 wrote to memory of 3500	4912	df1dc136ac616b2bc651708c073213bfd32e6fd83dc0c4f7b10300bed82348b6.exe	111
PID 4912 wrote to memory of 3500	4912	df1dc136ac616b2bc651708c073213bfd32e6fd83dc0c4f7b10300bed82348b6.exe	111
PID 4912 wrote to memory of 1088	4912	df1dc136ac616b2bc651708c073213bfd32e6fd83dc0c4f7b10300bed82348b6.exe	112
PID 4912 wrote to memory of 1088	4912	df1dc136ac616b2bc651708c073213bfd32e6fd83dc0c4f7b10300bed82348b6.exe	112
PID 4912 wrote to memory of 1532	4912	df1dc136ac616b2bc651708c073213bfd32e6fd83dc0c4f7b10300bed82348b6.exe	113
PID 4912 wrote to memory of 1532	4912	df1dc136ac616b2bc651708c073213bfd32e6fd83dc0c4f7b10300bed82348b6.exe	113
PID 4912 wrote to memory of 4448	4912	df1dc136ac616b2bc651708c073213bfd32e6fd83dc0c4f7b10300bed82348b6.exe	114
PID 4912 wrote to memory of 4448	4912	df1dc136ac616b2bc651708c073213bfd32e6fd83dc0c4f7b10300bed82348b6.exe	114
PID 4912 wrote to memory of 1660	4912	df1dc136ac616b2bc651708c073213bfd32e6fd83dc0c4f7b10300bed82348b6.exe	115
PID 4912 wrote to memory of 1660	4912	df1dc136ac616b2bc651708c073213bfd32e6fd83dc0c4f7b10300bed82348b6.exe	115

C:\Users\Admin\AppData\Local\Temp\df1dc136ac616b2bc651708c073213bfd32e6fd83dc0c4f7b10300bed82348b6.exe
"C:\Users\Admin\AppData\Local\Temp\df1dc136ac616b2bc651708c073213bfd32e6fd83dc0c4f7b10300bed82348b6.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4912
- C:\Windows\System\WVyvvft.exe
  C:\Windows\System\WVyvvft.exe
  2⤵
  - Executes dropped EXE
  PID:3116
- C:\Windows\System\fJJJKsu.exe
  C:\Windows\System\fJJJKsu.exe
  2⤵
  - Executes dropped EXE
  PID:3636
- C:\Windows\System\BBuCvNf.exe
  C:\Windows\System\BBuCvNf.exe
  2⤵
  - Executes dropped EXE
  PID:3912
- C:\Windows\System\XoFPKmY.exe
  C:\Windows\System\XoFPKmY.exe
  2⤵
  - Executes dropped EXE
  PID:2760
- C:\Windows\System\SWxTrwo.exe
  C:\Windows\System\SWxTrwo.exe
  2⤵
  - Executes dropped EXE
  PID:2200
- C:\Windows\System\sleaIPh.exe
  C:\Windows\System\sleaIPh.exe
  2⤵
  - Executes dropped EXE
  PID:1992
- C:\Windows\System\OROsvvC.exe
  C:\Windows\System\OROsvvC.exe
  2⤵
  - Executes dropped EXE
  PID:2420
- C:\Windows\System\ynCdpzt.exe
  C:\Windows\System\ynCdpzt.exe
  2⤵
  - Executes dropped EXE
  PID:3924
- C:\Windows\System\CMjcVwc.exe
  C:\Windows\System\CMjcVwc.exe
  2⤵
  - Executes dropped EXE
  PID:4552
- C:\Windows\System\TkzuDgG.exe
  C:\Windows\System\TkzuDgG.exe
  2⤵
  - Executes dropped EXE
  PID:1028
- C:\Windows\System\ydLfsda.exe
  C:\Windows\System\ydLfsda.exe
  2⤵
  - Executes dropped EXE
  PID:1432
- C:\Windows\System\mFzNFuL.exe
  C:\Windows\System\mFzNFuL.exe
  2⤵
  - Executes dropped EXE
  PID:2328
- C:\Windows\System\DpsmvpC.exe
  C:\Windows\System\DpsmvpC.exe
  2⤵
  - Executes dropped EXE
  PID:3868
- C:\Windows\System\yUqbkmx.exe
  C:\Windows\System\yUqbkmx.exe
  2⤵
  - Executes dropped EXE
  PID:4568
- C:\Windows\System\dsJEgFl.exe
  C:\Windows\System\dsJEgFl.exe
  2⤵
  - Executes dropped EXE
  PID:4796
- C:\Windows\System\wnzXUmR.exe
  C:\Windows\System\wnzXUmR.exe
  2⤵
  - Executes dropped EXE
  PID:2684
- C:\Windows\System\dflQuLG.exe
  C:\Windows\System\dflQuLG.exe
  2⤵
  - Executes dropped EXE
  PID:1976
- C:\Windows\System\SzcPZkK.exe
  C:\Windows\System\SzcPZkK.exe
  2⤵
  - Executes dropped EXE
  PID:4936
- C:\Windows\System\TLxMWpz.exe
  C:\Windows\System\TLxMWpz.exe
  2⤵
  - Executes dropped EXE
  PID:4636
- C:\Windows\System\FOTjsOY.exe
  C:\Windows\System\FOTjsOY.exe
  2⤵
  - Executes dropped EXE
  PID:2460
- C:\Windows\System\rNovirm.exe
  C:\Windows\System\rNovirm.exe
  2⤵
  - Executes dropped EXE
  PID:4324
- C:\Windows\System\GBAsZIp.exe
  C:\Windows\System\GBAsZIp.exe
  2⤵
  - Executes dropped EXE
  PID:3212
- C:\Windows\System\DQayHnH.exe
  C:\Windows\System\DQayHnH.exe
  2⤵
  - Executes dropped EXE
  PID:3164
- C:\Windows\System\YvGucdd.exe
  C:\Windows\System\YvGucdd.exe
  2⤵
  - Executes dropped EXE
  PID:4016
- C:\Windows\System\tWHFRVH.exe
  C:\Windows\System\tWHFRVH.exe
  2⤵
  - Executes dropped EXE
  PID:688
- C:\Windows\System\zDDORbs.exe
  C:\Windows\System\zDDORbs.exe
  2⤵
  - Executes dropped EXE
  PID:2348
- C:\Windows\System\jtKnbvU.exe
  C:\Windows\System\jtKnbvU.exe
  2⤵
  - Executes dropped EXE
  PID:4108
- C:\Windows\System\pYIvSfX.exe
  C:\Windows\System\pYIvSfX.exe
  2⤵
  - Executes dropped EXE
  PID:3500
- C:\Windows\System\QDQzyjD.exe
  C:\Windows\System\QDQzyjD.exe
  2⤵
  - Executes dropped EXE
  PID:1088
- C:\Windows\System\FTFfrER.exe
  C:\Windows\System\FTFfrER.exe
  2⤵
  - Executes dropped EXE
  PID:1532
- C:\Windows\System\XlyBuPF.exe
  C:\Windows\System\XlyBuPF.exe
  2⤵
  - Executes dropped EXE
  PID:4448
- C:\Windows\System\JlXDzOg.exe
  C:\Windows\System\JlXDzOg.exe
  2⤵
  - Executes dropped EXE
  PID:1660
- C:\Windows\System\jfSMIWv.exe
  C:\Windows\System\jfSMIWv.exe
  2⤵
  - Executes dropped EXE
  PID:880
- C:\Windows\System\sAySpta.exe
  C:\Windows\System\sAySpta.exe
  2⤵
  - Executes dropped EXE
  PID:2800
- C:\Windows\System\PvKpRrn.exe
  C:\Windows\System\PvKpRrn.exe
  2⤵
  - Executes dropped EXE
  PID:4056
- C:\Windows\System\SYQhUMn.exe
  C:\Windows\System\SYQhUMn.exe
  2⤵
  - Executes dropped EXE
  PID:5020
- C:\Windows\System\ogqxXhx.exe
  C:\Windows\System\ogqxXhx.exe
  2⤵
  - Executes dropped EXE
  PID:5112
- C:\Windows\System\TpIEQqT.exe
  C:\Windows\System\TpIEQqT.exe
  2⤵
  - Executes dropped EXE
  PID:3492
- C:\Windows\System\IvwFath.exe
  C:\Windows\System\IvwFath.exe
  2⤵
  - Executes dropped EXE
  PID:3872
- C:\Windows\System\uWDMqti.exe
  C:\Windows\System\uWDMqti.exe
  2⤵
  - Executes dropped EXE
  PID:1548
- C:\Windows\System\HoLJDoe.exe
  C:\Windows\System\HoLJDoe.exe
  2⤵
  - Executes dropped EXE
  PID:3184
- C:\Windows\System\dQQzbuu.exe
  C:\Windows\System\dQQzbuu.exe
  2⤵
  - Executes dropped EXE
  PID:4884
- C:\Windows\System\CCMdAGQ.exe
  C:\Windows\System\CCMdAGQ.exe
  2⤵
  - Executes dropped EXE
  PID:3788
- C:\Windows\System\BowGxKr.exe
  C:\Windows\System\BowGxKr.exe
  2⤵
  - Executes dropped EXE
  PID:1824
- C:\Windows\System\RNxrWpr.exe
  C:\Windows\System\RNxrWpr.exe
  2⤵
  - Executes dropped EXE
  PID:4316
- C:\Windows\System\DusPdbS.exe
  C:\Windows\System\DusPdbS.exe
  2⤵
  - Executes dropped EXE
  PID:1372
- C:\Windows\System\YSiCTyk.exe
  C:\Windows\System\YSiCTyk.exe
  2⤵
  - Executes dropped EXE
  PID:3620
- C:\Windows\System\XxCvcsV.exe
  C:\Windows\System\XxCvcsV.exe
  2⤵
  - Executes dropped EXE
  PID:5028
- C:\Windows\System\CrHFerF.exe
  C:\Windows\System\CrHFerF.exe
  2⤵
  - Executes dropped EXE
  PID:704
- C:\Windows\System\uPtZSvw.exe
  C:\Windows\System\uPtZSvw.exe
  2⤵
  - Executes dropped EXE
  PID:3824
- C:\Windows\System\ZbmIoCw.exe
  C:\Windows\System\ZbmIoCw.exe
  2⤵
  - Executes dropped EXE
  PID:4732
- C:\Windows\System\JUWuKFQ.exe
  C:\Windows\System\JUWuKFQ.exe
  2⤵
  - Executes dropped EXE
  PID:2628
- C:\Windows\System\nsVPTPz.exe
  C:\Windows\System\nsVPTPz.exe
  2⤵
  - Executes dropped EXE
  PID:3256
- C:\Windows\System\kqBiEnP.exe
  C:\Windows\System\kqBiEnP.exe
  2⤵
  - Executes dropped EXE
  PID:2500
- C:\Windows\System\ULHyyrK.exe
  C:\Windows\System\ULHyyrK.exe
  2⤵
  - Executes dropped EXE
  PID:2884
- C:\Windows\System\nOjLHRn.exe
  C:\Windows\System\nOjLHRn.exe
  2⤵
  - Executes dropped EXE
  PID:2652
- C:\Windows\System\lkwacGS.exe
  C:\Windows\System\lkwacGS.exe
  2⤵
  - Executes dropped EXE
  PID:3760
- C:\Windows\System\aAdEpRT.exe
  C:\Windows\System\aAdEpRT.exe
  2⤵
  - Executes dropped EXE
  PID:724
- C:\Windows\System\RSqykvC.exe
  C:\Windows\System\RSqykvC.exe
  2⤵
  - Executes dropped EXE
  PID:404
- C:\Windows\System\SZryIcW.exe
  C:\Windows\System\SZryIcW.exe
  2⤵
  - Executes dropped EXE
  PID:2204
- C:\Windows\System\prdBDGd.exe
  C:\Windows\System\prdBDGd.exe
  2⤵
  - Executes dropped EXE
  PID:3952
- C:\Windows\System\PaGhfPu.exe
  C:\Windows\System\PaGhfPu.exe
  2⤵
  - Executes dropped EXE
  PID:2952
- C:\Windows\System\JpBwAMc.exe
  C:\Windows\System\JpBwAMc.exe
  2⤵
  - Executes dropped EXE
  PID:4044
- C:\Windows\System\TIGFAgZ.exe
  C:\Windows\System\TIGFAgZ.exe
  2⤵
  - Executes dropped EXE
  PID:1856
- C:\Windows\System\JqNHQMu.exe
  C:\Windows\System\JqNHQMu.exe
  2⤵
  PID:3252
- C:\Windows\System\cFstZQB.exe
  C:\Windows\System\cFstZQB.exe
  2⤵
  PID:4540
- C:\Windows\System\PvbGVGW.exe
  C:\Windows\System\PvbGVGW.exe
  2⤵
  PID:4624
- C:\Windows\System\xMdgNTS.exe
  C:\Windows\System\xMdgNTS.exe
  2⤵
  PID:3488
- C:\Windows\System\LOjAeOn.exe
  C:\Windows\System\LOjAeOn.exe
  2⤵
  PID:3156
- C:\Windows\System\JMhAeSL.exe
  C:\Windows\System\JMhAeSL.exe
  2⤵
  PID:2480
- C:\Windows\System\fcrvAHT.exe
  C:\Windows\System\fcrvAHT.exe
  2⤵
  PID:3708
- C:\Windows\System\nMboKOc.exe
  C:\Windows\System\nMboKOc.exe
  2⤵
  PID:4768
- C:\Windows\System\CRKQBew.exe
  C:\Windows\System\CRKQBew.exe
  2⤵
  PID:3852
- C:\Windows\System\vmBbgsJ.exe
  C:\Windows\System\vmBbgsJ.exe
  2⤵
  PID:5044
- C:\Windows\System\HrCIQHo.exe
  C:\Windows\System\HrCIQHo.exe
  2⤵
  PID:2004
- C:\Windows\System\DeXMeTX.exe
  C:\Windows\System\DeXMeTX.exe
  2⤵
  PID:1120
- C:\Windows\System\KbXTrnI.exe
  C:\Windows\System\KbXTrnI.exe
  2⤵
  PID:2336
- C:\Windows\System\OGJQNCJ.exe
  C:\Windows\System\OGJQNCJ.exe
  2⤵
  PID:2924
- C:\Windows\System\MSCtCFa.exe
  C:\Windows\System\MSCtCFa.exe
  2⤵
  PID:968
- C:\Windows\System\GKHaVFF.exe
  C:\Windows\System\GKHaVFF.exe
  2⤵
  PID:4372
- C:\Windows\System\pmqOeup.exe
  C:\Windows\System\pmqOeup.exe
  2⤵
  PID:2064
- C:\Windows\System\Kdpzabq.exe
  C:\Windows\System\Kdpzabq.exe
  2⤵
  PID:3604
- C:\Windows\System\vKNgcTP.exe
  C:\Windows\System\vKNgcTP.exe
  2⤵
  PID:4820
- C:\Windows\System\eNMxMku.exe
  C:\Windows\System\eNMxMku.exe
  2⤵
  PID:3600
- C:\Windows\System\KRzWuOU.exe
  C:\Windows\System\KRzWuOU.exe
  2⤵
  PID:3756
- C:\Windows\System\IluxDhN.exe
  C:\Windows\System\IluxDhN.exe
  2⤵
  PID:3496
- C:\Windows\System\qPkYoGy.exe
  C:\Windows\System\qPkYoGy.exe
  2⤵
  PID:1048
- C:\Windows\System\lWgBfPo.exe
  C:\Windows\System\lWgBfPo.exe
  2⤵
  PID:2568
- C:\Windows\System\zJGVVnV.exe
  C:\Windows\System\zJGVVnV.exe
  2⤵
  PID:2332
- C:\Windows\System\XVPnxrw.exe
  C:\Windows\System\XVPnxrw.exe
  2⤵
  PID:3364
- C:\Windows\System\NmDxqxH.exe
  C:\Windows\System\NmDxqxH.exe
  2⤵
  PID:4728
- C:\Windows\System\oktTQfz.exe
  C:\Windows\System\oktTQfz.exe
  2⤵
  PID:900
- C:\Windows\System\ynFoIgI.exe
  C:\Windows\System\ynFoIgI.exe
  2⤵
  PID:4612
- C:\Windows\System\LgoswDf.exe
  C:\Windows\System\LgoswDf.exe
  2⤵
  PID:4392
- C:\Windows\System\LIikkxQ.exe
  C:\Windows\System\LIikkxQ.exe
  2⤵
  PID:4968
- C:\Windows\System\ewIxdmL.exe
  C:\Windows\System\ewIxdmL.exe
  2⤵
  PID:1524
- C:\Windows\System\mZxjVuC.exe
  C:\Windows\System\mZxjVuC.exe
  2⤵
  PID:3968
- C:\Windows\System\lbXLiVL.exe
  C:\Windows\System\lbXLiVL.exe
  2⤵
  PID:4512
- C:\Windows\System\esQhdqQ.exe
  C:\Windows\System\esQhdqQ.exe
  2⤵
  PID:4368
- C:\Windows\System\wFQebUv.exe
  C:\Windows\System\wFQebUv.exe
  2⤵
  PID:2296
- C:\Windows\System\fMPEJIk.exe
  C:\Windows\System\fMPEJIk.exe
  2⤵
  PID:2580
- C:\Windows\System\vxHmPwr.exe
  C:\Windows\System\vxHmPwr.exe
  2⤵
  PID:4036
- C:\Windows\System\WSzOyOF.exe
  C:\Windows\System\WSzOyOF.exe
  2⤵
  PID:2320
- C:\Windows\System\oVBpoPb.exe
  C:\Windows\System\oVBpoPb.exe
  2⤵
  PID:5008
- C:\Windows\System\YbdXxHN.exe
  C:\Windows\System\YbdXxHN.exe
  2⤵
  PID:3996
- C:\Windows\System\IWoOEAV.exe
  C:\Windows\System\IWoOEAV.exe
  2⤵
  PID:2232
- C:\Windows\System\yEutkNC.exe
  C:\Windows\System\yEutkNC.exe
  2⤵
  PID:4292
- C:\Windows\System\QkHXtbT.exe
  C:\Windows\System\QkHXtbT.exe
  2⤵
  PID:5100
- C:\Windows\System\dpltUjb.exe
  C:\Windows\System\dpltUjb.exe
  2⤵
  PID:2944
- C:\Windows\System\xHBVkzh.exe
  C:\Windows\System\xHBVkzh.exe
  2⤵
  PID:4956
- C:\Windows\System\fYKTyAr.exe
  C:\Windows\System\fYKTyAr.exe
  2⤵
  PID:1208
- C:\Windows\System\oEalwIl.exe
  C:\Windows\System\oEalwIl.exe
  2⤵
  PID:2284
- C:\Windows\System\hXlEaZp.exe
  C:\Windows\System\hXlEaZp.exe
  2⤵
  PID:5156
- C:\Windows\System\ajfRRyJ.exe
  C:\Windows\System\ajfRRyJ.exe
  2⤵
  PID:5176
- C:\Windows\System\lczSfbT.exe
  C:\Windows\System\lczSfbT.exe
  2⤵
  PID:5212
- C:\Windows\System\pVPECNv.exe
  C:\Windows\System\pVPECNv.exe
  2⤵
  PID:5236
- C:\Windows\System\xJetnIR.exe
  C:\Windows\System\xJetnIR.exe
  2⤵
  PID:5268
- C:\Windows\System\BQXnWnI.exe
  C:\Windows\System\BQXnWnI.exe
  2⤵
  PID:5296
- C:\Windows\System\lcnGeqI.exe
  C:\Windows\System\lcnGeqI.exe
  2⤵
  PID:5328
- C:\Windows\System\oIiOrqs.exe
  C:\Windows\System\oIiOrqs.exe
  2⤵
  PID:5352
- C:\Windows\System\LCSEHwg.exe
  C:\Windows\System\LCSEHwg.exe
  2⤵
  PID:5372
- C:\Windows\System\ddRrJOP.exe
  C:\Windows\System\ddRrJOP.exe
  2⤵
  PID:5404
- C:\Windows\System\NLazGOR.exe
  C:\Windows\System\NLazGOR.exe
  2⤵
  PID:5440
- C:\Windows\System\LYiHsdw.exe
  C:\Windows\System\LYiHsdw.exe
  2⤵
  PID:5468
- C:\Windows\System\oefHbyd.exe
  C:\Windows\System\oefHbyd.exe
  2⤵
  PID:5492
- C:\Windows\System\eNrcfbE.exe
  C:\Windows\System\eNrcfbE.exe
  2⤵
  PID:5524
- C:\Windows\System\xNZbCcY.exe
  C:\Windows\System\xNZbCcY.exe
  2⤵
  PID:5552
- C:\Windows\System\eQqiVlY.exe
  C:\Windows\System\eQqiVlY.exe
  2⤵
  PID:5584
- C:\Windows\System\DFTipBu.exe
  C:\Windows\System\DFTipBu.exe
  2⤵
  PID:5608
- C:\Windows\System\xuVDPzg.exe
  C:\Windows\System\xuVDPzg.exe
  2⤵
  PID:5636
- C:\Windows\System\HmSjuht.exe
  C:\Windows\System\HmSjuht.exe
  2⤵
  PID:5656
- C:\Windows\System\SvJKgJv.exe
  C:\Windows\System\SvJKgJv.exe
  2⤵
  PID:5696
- C:\Windows\System\ZaDCICC.exe
  C:\Windows\System\ZaDCICC.exe
  2⤵
  PID:5720
- C:\Windows\System\ROLpSin.exe
  C:\Windows\System\ROLpSin.exe
  2⤵
  PID:5748
- C:\Windows\System\zjEBWkG.exe
  C:\Windows\System\zjEBWkG.exe
  2⤵
  PID:5768
- C:\Windows\System\aeNSGsT.exe
  C:\Windows\System\aeNSGsT.exe
  2⤵
  PID:5788
- C:\Windows\System\wImMOaa.exe
  C:\Windows\System\wImMOaa.exe
  2⤵
  PID:5820
- C:\Windows\System\sdppdzE.exe
  C:\Windows\System\sdppdzE.exe
  2⤵
  PID:5848
- C:\Windows\System\uBLfEYT.exe
  C:\Windows\System\uBLfEYT.exe
  2⤵
  PID:5880
- C:\Windows\System\kGcLpQO.exe
  C:\Windows\System\kGcLpQO.exe
  2⤵
  PID:5912
- C:\Windows\System\ixICmgl.exe
  C:\Windows\System\ixICmgl.exe
  2⤵
  PID:5944
- C:\Windows\System\FqEBrOb.exe
  C:\Windows\System\FqEBrOb.exe
  2⤵
  PID:5964
- C:\Windows\System\HKzhalG.exe
  C:\Windows\System\HKzhalG.exe
  2⤵
  PID:6000
- C:\Windows\System\acKHVaF.exe
  C:\Windows\System\acKHVaF.exe
  2⤵
  PID:6028
- C:\Windows\System\AbfRTqG.exe
  C:\Windows\System\AbfRTqG.exe
  2⤵
  PID:6056
- C:\Windows\System\zYnEaEJ.exe
  C:\Windows\System\zYnEaEJ.exe
  2⤵
  PID:6084
- C:\Windows\System\opozFSM.exe
  C:\Windows\System\opozFSM.exe
  2⤵
  PID:6112
- C:\Windows\System\KLxXBaC.exe
  C:\Windows\System\KLxXBaC.exe
  2⤵
  PID:3732
- C:\Windows\System\zbHvtQO.exe
  C:\Windows\System\zbHvtQO.exe
  2⤵
  PID:5136
- C:\Windows\System\wdIBlnW.exe
  C:\Windows\System\wdIBlnW.exe
  2⤵
  PID:5192
- C:\Windows\System\gQNmfJs.exe
  C:\Windows\System\gQNmfJs.exe
  2⤵
  PID:5256
- C:\Windows\System\SiwaRXv.exe
  C:\Windows\System\SiwaRXv.exe
  2⤵
  PID:5336
- C:\Windows\System\fLGROOi.exe
  C:\Windows\System\fLGROOi.exe
  2⤵
  PID:5392
- C:\Windows\System\oGOhZFY.exe
  C:\Windows\System\oGOhZFY.exe
  2⤵
  PID:5500
- C:\Windows\System\Urrkwlf.exe
  C:\Windows\System\Urrkwlf.exe
  2⤵
  PID:5536
- C:\Windows\System\jmSpfUg.exe
  C:\Windows\System\jmSpfUg.exe
  2⤵
  PID:5576
- C:\Windows\System\aIDDtwG.exe
  C:\Windows\System\aIDDtwG.exe
  2⤵
  PID:5648
- C:\Windows\System\YOndevw.exe
  C:\Windows\System\YOndevw.exe
  2⤵
  PID:5716
- C:\Windows\System\WemcqwZ.exe
  C:\Windows\System\WemcqwZ.exe
  2⤵
  PID:5808
- C:\Windows\System\oovAmhP.exe
  C:\Windows\System\oovAmhP.exe
  2⤵
  PID:5856
- C:\Windows\System\YSrPXin.exe
  C:\Windows\System\YSrPXin.exe
  2⤵
  PID:5920
- C:\Windows\System\DOtWNDs.exe
  C:\Windows\System\DOtWNDs.exe
  2⤵
  PID:5956
- C:\Windows\System\KZBXUFt.exe
  C:\Windows\System\KZBXUFt.exe
  2⤵
  PID:6020
- C:\Windows\System\IpMrQIk.exe
  C:\Windows\System\IpMrQIk.exe
  2⤵
  PID:6072
- C:\Windows\System\gAutPmb.exe
  C:\Windows\System\gAutPmb.exe
  2⤵
  PID:6124
- C:\Windows\System\TIyrDOI.exe
  C:\Windows\System\TIyrDOI.exe
  2⤵
  PID:5144
- C:\Windows\System\oPPGGuP.exe
  C:\Windows\System\oPPGGuP.exe
  2⤵
  PID:5308
- C:\Windows\System\QtZvqIo.exe
  C:\Windows\System\QtZvqIo.exe
  2⤵
  PID:5476
- C:\Windows\System\MtychDm.exe
  C:\Windows\System\MtychDm.exe
  2⤵
  PID:5596
- C:\Windows\System\vlDrIMc.exe
  C:\Windows\System\vlDrIMc.exe
  2⤵
  PID:5692
- C:\Windows\System\vnznjfN.exe
  C:\Windows\System\vnznjfN.exe
  2⤵
  PID:5892
- C:\Windows\System\HfeIeJl.exe
  C:\Windows\System\HfeIeJl.exe
  2⤵
  PID:6136
- C:\Windows\System\tyTJxDe.exe
  C:\Windows\System\tyTJxDe.exe
  2⤵
  PID:5384
- C:\Windows\System\FnOMggu.exe
  C:\Windows\System\FnOMggu.exe
  2⤵
  PID:5388
- C:\Windows\System\oKnzeCX.exe
  C:\Windows\System\oKnzeCX.exe
  2⤵
  PID:5844
- C:\Windows\System\iroNoyS.exe
  C:\Windows\System\iroNoyS.exe
  2⤵
  PID:6096
- C:\Windows\System\UluSEfH.exe
  C:\Windows\System\UluSEfH.exe
  2⤵
  PID:6164
- C:\Windows\System\oNKnSee.exe
  C:\Windows\System\oNKnSee.exe
  2⤵
  PID:6192
- C:\Windows\System\jVbtqmb.exe
  C:\Windows\System\jVbtqmb.exe
  2⤵
  PID:6216
- C:\Windows\System\EAwSsWQ.exe
  C:\Windows\System\EAwSsWQ.exe
  2⤵
  PID:6248
- C:\Windows\System\YPuwhzb.exe
  C:\Windows\System\YPuwhzb.exe
  2⤵
  PID:6280
- C:\Windows\System\usUPdTT.exe
  C:\Windows\System\usUPdTT.exe
  2⤵
  PID:6308
- C:\Windows\System\IFayLmV.exe
  C:\Windows\System\IFayLmV.exe
  2⤵
  PID:6336
- C:\Windows\System\jijwvCu.exe
  C:\Windows\System\jijwvCu.exe
  2⤵
  PID:6352
- C:\Windows\System\pXjCPbD.exe
  C:\Windows\System\pXjCPbD.exe
  2⤵
  PID:6380
- C:\Windows\System\JbuZUhw.exe
  C:\Windows\System\JbuZUhw.exe
  2⤵
  PID:6412
- C:\Windows\System\WhxVYgY.exe
  C:\Windows\System\WhxVYgY.exe
  2⤵
  PID:6436
- C:\Windows\System\DGVfdqF.exe
  C:\Windows\System\DGVfdqF.exe
  2⤵
  PID:6464
- C:\Windows\System\otHPxVE.exe
  C:\Windows\System\otHPxVE.exe
  2⤵
  PID:6484
- C:\Windows\System\UDYyTHn.exe
  C:\Windows\System\UDYyTHn.exe
  2⤵
  PID:6504
- C:\Windows\System\bYxexVm.exe
  C:\Windows\System\bYxexVm.exe
  2⤵
  PID:6524
- C:\Windows\System\HVskehz.exe
  C:\Windows\System\HVskehz.exe
  2⤵
  PID:6556
- C:\Windows\System\VzRpkTs.exe
  C:\Windows\System\VzRpkTs.exe
  2⤵
  PID:6576
- C:\Windows\System\IDVDFAE.exe
  C:\Windows\System\IDVDFAE.exe
  2⤵
  PID:6604
- C:\Windows\System\UqLemTg.exe
  C:\Windows\System\UqLemTg.exe
  2⤵
  PID:6632
- C:\Windows\System\uIVXtIm.exe
  C:\Windows\System\uIVXtIm.exe
  2⤵
  PID:6652
- C:\Windows\System\ADtFBOd.exe
  C:\Windows\System\ADtFBOd.exe
  2⤵
  PID:6688
- C:\Windows\System\AOOOOyq.exe
  C:\Windows\System\AOOOOyq.exe
  2⤵
  PID:6716
- C:\Windows\System\jUqvltz.exe
  C:\Windows\System\jUqvltz.exe
  2⤵
  PID:6740
- C:\Windows\System\CsKINEq.exe
  C:\Windows\System\CsKINEq.exe
  2⤵
  PID:6772
- C:\Windows\System\upuTMer.exe
  C:\Windows\System\upuTMer.exe
  2⤵
  PID:6804
- C:\Windows\System\SYztBco.exe
  C:\Windows\System\SYztBco.exe
  2⤵
  PID:6836
- C:\Windows\System\qQagyHl.exe
  C:\Windows\System\qQagyHl.exe
  2⤵
  PID:6864
- C:\Windows\System\McJlVGb.exe
  C:\Windows\System\McJlVGb.exe
  2⤵
  PID:6892
- C:\Windows\System\bknLEwq.exe
  C:\Windows\System\bknLEwq.exe
  2⤵
  PID:6920
- C:\Windows\System\HpDtZjP.exe
  C:\Windows\System\HpDtZjP.exe
  2⤵
  PID:6944
- C:\Windows\System\sALtyGr.exe
  C:\Windows\System\sALtyGr.exe
  2⤵
  PID:6968
- C:\Windows\System\KELmVlq.exe
  C:\Windows\System\KELmVlq.exe
  2⤵
  PID:6996
- C:\Windows\System\OXVzBOG.exe
  C:\Windows\System\OXVzBOG.exe
  2⤵
  PID:7028
- C:\Windows\System\ZEwPVgp.exe
  C:\Windows\System\ZEwPVgp.exe
  2⤵
  PID:7056
- C:\Windows\System\GZpftZi.exe
  C:\Windows\System\GZpftZi.exe
  2⤵
  PID:7088
- C:\Windows\System\RAbFPFp.exe
  C:\Windows\System\RAbFPFp.exe
  2⤵
  PID:7112
- C:\Windows\System\cZSRfVM.exe
  C:\Windows\System\cZSRfVM.exe
  2⤵
  PID:7128
- C:\Windows\System\QihtlpL.exe
  C:\Windows\System\QihtlpL.exe
  2⤵
  PID:7160
- C:\Windows\System\ZbLIGqT.exe
  C:\Windows\System\ZbLIGqT.exe
  2⤵
  PID:5228
- C:\Windows\System\SqLQByf.exe
  C:\Windows\System\SqLQByf.exe
  2⤵
  PID:6108
- C:\Windows\System\aLaIAtN.exe
  C:\Windows\System\aLaIAtN.exe
  2⤵
  PID:6236
- C:\Windows\System\DNCiAGV.exe
  C:\Windows\System\DNCiAGV.exe
  2⤵
  PID:6304
- C:\Windows\System\MKlFhEW.exe
  C:\Windows\System\MKlFhEW.exe
  2⤵
  PID:6372
- C:\Windows\System\cLrsDRf.exe
  C:\Windows\System\cLrsDRf.exe
  2⤵
  PID:6364
- C:\Windows\System\aZobZGX.exe
  C:\Windows\System\aZobZGX.exe
  2⤵
  PID:6496
- C:\Windows\System\kcqhlrm.exe
  C:\Windows\System\kcqhlrm.exe
  2⤵
  PID:6476
- C:\Windows\System\kWBTyHE.exe
  C:\Windows\System\kWBTyHE.exe
  2⤵
  PID:6592
- C:\Windows\System\zxBuKai.exe
  C:\Windows\System\zxBuKai.exe
  2⤵
  PID:6668
- C:\Windows\System\ppRqXON.exe
  C:\Windows\System\ppRqXON.exe
  2⤵
  PID:6680
- C:\Windows\System\jaxqwgu.exe
  C:\Windows\System\jaxqwgu.exe
  2⤵
  PID:6756
- C:\Windows\System\osXDRya.exe
  C:\Windows\System\osXDRya.exe
  2⤵
  PID:6872
- C:\Windows\System\kfAIFVQ.exe
  C:\Windows\System\kfAIFVQ.exe
  2⤵
  PID:6936
- C:\Windows\System\yhjDgay.exe
  C:\Windows\System\yhjDgay.exe
  2⤵
  PID:6852
- C:\Windows\System\hRBoYIQ.exe
  C:\Windows\System\hRBoYIQ.exe
  2⤵
  PID:7072
- C:\Windows\System\AkOFgUj.exe
  C:\Windows\System\AkOFgUj.exe
  2⤵
  PID:7124
- C:\Windows\System\MOfOKPd.exe
  C:\Windows\System\MOfOKPd.exe
  2⤵
  PID:6180
- C:\Windows\System\wCoyOTJ.exe
  C:\Windows\System\wCoyOTJ.exe
  2⤵
  PID:7068
- C:\Windows\System\MVoqMPH.exe
  C:\Windows\System\MVoqMPH.exe
  2⤵
  PID:6348
- C:\Windows\System\BWhutoj.exe
  C:\Windows\System\BWhutoj.exe
  2⤵
  PID:5780
- C:\Windows\System\UYlQcgR.exe
  C:\Windows\System\UYlQcgR.exe
  2⤵
  PID:6768
- C:\Windows\System\fvIXZOy.exe
  C:\Windows\System\fvIXZOy.exe
  2⤵
  PID:6640
- C:\Windows\System\FFjCapJ.exe
  C:\Windows\System\FFjCapJ.exe
  2⤵
  PID:6764
- C:\Windows\System\ttAbbJO.exe
  C:\Windows\System\ttAbbJO.exe
  2⤵
  PID:7080
- C:\Windows\System\Ofwvvvq.exe
  C:\Windows\System\Ofwvvvq.exe
  2⤵
  PID:6980
- C:\Windows\System\WKEEmJb.exe
  C:\Windows\System\WKEEmJb.exe
  2⤵
  PID:6828
- C:\Windows\System\amgjDGk.exe
  C:\Windows\System\amgjDGk.exe
  2⤵
  PID:7184
- C:\Windows\System\pfxWHkW.exe
  C:\Windows\System\pfxWHkW.exe
  2⤵
  PID:7212
- C:\Windows\System\DPFMbHw.exe
  C:\Windows\System\DPFMbHw.exe
  2⤵
  PID:7228
- C:\Windows\System\YhohGFR.exe
  C:\Windows\System\YhohGFR.exe
  2⤵
  PID:7256
- C:\Windows\System\JnSDtfQ.exe
  C:\Windows\System\JnSDtfQ.exe
  2⤵
  PID:7288
- C:\Windows\System\vUyFZnQ.exe
  C:\Windows\System\vUyFZnQ.exe
  2⤵
  PID:7312
- C:\Windows\System\mIjLpkP.exe
  C:\Windows\System\mIjLpkP.exe
  2⤵
  PID:7348
- C:\Windows\System\CudTILF.exe
  C:\Windows\System\CudTILF.exe
  2⤵
  PID:7380
- C:\Windows\System\GyJgzco.exe
  C:\Windows\System\GyJgzco.exe
  2⤵
  PID:7400
- C:\Windows\System\VsGFMMw.exe
  C:\Windows\System\VsGFMMw.exe
  2⤵
  PID:7432
- C:\Windows\System\ymsIonv.exe
  C:\Windows\System\ymsIonv.exe
  2⤵
  PID:7456
- C:\Windows\System\ZAwMjfk.exe
  C:\Windows\System\ZAwMjfk.exe
  2⤵
  PID:7476
- C:\Windows\System\CoZEFbZ.exe
  C:\Windows\System\CoZEFbZ.exe
  2⤵
  PID:7500
- C:\Windows\System\pRIVNOT.exe
  C:\Windows\System\pRIVNOT.exe
  2⤵
  PID:7536
- C:\Windows\System\suNINgr.exe
  C:\Windows\System\suNINgr.exe
  2⤵
  PID:7560
- C:\Windows\System\RsEYsyM.exe
  C:\Windows\System\RsEYsyM.exe
  2⤵
  PID:7592
- C:\Windows\System\cJKUtUD.exe
  C:\Windows\System\cJKUtUD.exe
  2⤵
  PID:7620
- C:\Windows\System\WyfCCbj.exe
  C:\Windows\System\WyfCCbj.exe
  2⤵
  PID:7652
- C:\Windows\System\FXxnLIr.exe
  C:\Windows\System\FXxnLIr.exe
  2⤵
  PID:7680
- C:\Windows\System\FMhreDh.exe
  C:\Windows\System\FMhreDh.exe
  2⤵
  PID:7704
- C:\Windows\System\aRprczz.exe
  C:\Windows\System\aRprczz.exe
  2⤵
  PID:7728
- C:\Windows\System\hHIoVPi.exe
  C:\Windows\System\hHIoVPi.exe
  2⤵
  PID:7764
- C:\Windows\System\rTdBnfl.exe
  C:\Windows\System\rTdBnfl.exe
  2⤵
  PID:7792
- C:\Windows\System\aRpvrDJ.exe
  C:\Windows\System\aRpvrDJ.exe
  2⤵
  PID:7816
- C:\Windows\System\hQHScET.exe
  C:\Windows\System\hQHScET.exe
  2⤵
  PID:7840
- C:\Windows\System\vAXCwpf.exe
  C:\Windows\System\vAXCwpf.exe
  2⤵
  PID:7868
- C:\Windows\System\fJKciRy.exe
  C:\Windows\System\fJKciRy.exe
  2⤵
  PID:7896
- C:\Windows\System\xYVhumw.exe
  C:\Windows\System\xYVhumw.exe
  2⤵
  PID:7920
- C:\Windows\System\wySpRll.exe
  C:\Windows\System\wySpRll.exe
  2⤵
  PID:7952
- C:\Windows\System\spMZEwv.exe
  C:\Windows\System\spMZEwv.exe
  2⤵
  PID:7980
- C:\Windows\System\MMqifMO.exe
  C:\Windows\System\MMqifMO.exe
  2⤵
  PID:8012
- C:\Windows\System\cNChIXb.exe
  C:\Windows\System\cNChIXb.exe
  2⤵
  PID:8044
- C:\Windows\System\QAjLjTU.exe
  C:\Windows\System\QAjLjTU.exe
  2⤵
  PID:8072
- C:\Windows\System\BdUBQij.exe
  C:\Windows\System\BdUBQij.exe
  2⤵
  PID:8100
- C:\Windows\System\DwYTiJJ.exe
  C:\Windows\System\DwYTiJJ.exe
  2⤵
  PID:8132
- C:\Windows\System\TXnJkkr.exe
  C:\Windows\System\TXnJkkr.exe
  2⤵
  PID:8160
- C:\Windows\System\fjPdCVh.exe
  C:\Windows\System\fjPdCVh.exe
  2⤵
  PID:6704
- C:\Windows\System\tmMOvXB.exe
  C:\Windows\System\tmMOvXB.exe
  2⤵
  PID:6960
- C:\Windows\System\KTzgyPe.exe
  C:\Windows\System\KTzgyPe.exe
  2⤵
  PID:6956
- C:\Windows\System\RSWfcxR.exe
  C:\Windows\System\RSWfcxR.exe
  2⤵
  PID:7200
- C:\Windows\System\CMgMiGF.exe
  C:\Windows\System\CMgMiGF.exe
  2⤵
  PID:6320
- C:\Windows\System\tMhQyuO.exe
  C:\Windows\System\tMhQyuO.exe
  2⤵
  PID:7300
- C:\Windows\System\ZeIqoXl.exe
  C:\Windows\System\ZeIqoXl.exe
  2⤵
  PID:7364
- C:\Windows\System\MfXBYXV.exe
  C:\Windows\System\MfXBYXV.exe
  2⤵
  PID:7512
- C:\Windows\System\TodBukb.exe
  C:\Windows\System\TodBukb.exe
  2⤵
  PID:7468
- C:\Windows\System\hdxRPmp.exe
  C:\Windows\System\hdxRPmp.exe
  2⤵
  PID:7452
- C:\Windows\System\bygENGC.exe
  C:\Windows\System\bygENGC.exe
  2⤵
  PID:7552
- C:\Windows\System\pfsNLne.exe
  C:\Windows\System\pfsNLne.exe
  2⤵
  PID:7752
- C:\Windows\System\ruEYbXM.exe
  C:\Windows\System\ruEYbXM.exe
  2⤵
  PID:7532
- C:\Windows\System\PWDgeeY.exe
  C:\Windows\System\PWDgeeY.exe
  2⤵
  PID:7888
- C:\Windows\System\jghsAfO.exe
  C:\Windows\System\jghsAfO.exe
  2⤵
  PID:7824
- C:\Windows\System\dDnYntd.exe
  C:\Windows\System\dDnYntd.exe
  2⤵
  PID:7804
- C:\Windows\System\PBMEyku.exe
  C:\Windows\System\PBMEyku.exe
  2⤵
  PID:8056
- C:\Windows\System\AjqcLyd.exe
  C:\Windows\System\AjqcLyd.exe
  2⤵
  PID:8116
- C:\Windows\System\BvLUexv.exe
  C:\Windows\System\BvLUexv.exe
  2⤵
  PID:8152
- C:\Windows\System\amSyrcD.exe
  C:\Windows\System\amSyrcD.exe
  2⤵
  PID:6448
- C:\Windows\System\KNjWfUv.exe
  C:\Windows\System\KNjWfUv.exe
  2⤵
  PID:6568
- C:\Windows\System\BSRMqnG.exe
  C:\Windows\System\BSRMqnG.exe
  2⤵
  PID:7104
- C:\Windows\System\chQcMvH.exe
  C:\Windows\System\chQcMvH.exe
  2⤵
  PID:7604
- C:\Windows\System\WBeqsAN.exe
  C:\Windows\System\WBeqsAN.exe
  2⤵
  PID:7740
- C:\Windows\System\oiATgfK.exe
  C:\Windows\System\oiATgfK.exe
  2⤵
  PID:7472
- C:\Windows\System\VkRWFtT.exe
  C:\Windows\System\VkRWFtT.exe
  2⤵
  PID:7908
- C:\Windows\System\afeSFPz.exe
  C:\Windows\System\afeSFPz.exe
  2⤵
  PID:7912
- C:\Windows\System\vuFOGBe.exe
  C:\Windows\System\vuFOGBe.exe
  2⤵
  PID:8204
- C:\Windows\System\aFNMXTq.exe
  C:\Windows\System\aFNMXTq.exe
  2⤵
  PID:8236
- C:\Windows\System\FWhoQkZ.exe
  C:\Windows\System\FWhoQkZ.exe
  2⤵
  PID:8252
- C:\Windows\System\BnbFjNS.exe
  C:\Windows\System\BnbFjNS.exe
  2⤵
  PID:8284
- C:\Windows\System\dEcoLaU.exe
  C:\Windows\System\dEcoLaU.exe
  2⤵
  PID:8316
- C:\Windows\System\glIqKZo.exe
  C:\Windows\System\glIqKZo.exe
  2⤵
  PID:8344
- C:\Windows\System\UlSlgEo.exe
  C:\Windows\System\UlSlgEo.exe
  2⤵
  PID:8372
- C:\Windows\System\LskbTAc.exe
  C:\Windows\System\LskbTAc.exe
  2⤵
  PID:8404
- C:\Windows\System\WVbgWPh.exe
  C:\Windows\System\WVbgWPh.exe
  2⤵
  PID:8428
- C:\Windows\System\AhzlAVw.exe
  C:\Windows\System\AhzlAVw.exe
  2⤵
  PID:8452
- C:\Windows\System\NDpKEjz.exe
  C:\Windows\System\NDpKEjz.exe
  2⤵
  PID:8484
- C:\Windows\System\AVDXgiQ.exe
  C:\Windows\System\AVDXgiQ.exe
  2⤵
  PID:8516
- C:\Windows\System\bsICALX.exe
  C:\Windows\System\bsICALX.exe
  2⤵
  PID:8536
- C:\Windows\System\jICeUIR.exe
  C:\Windows\System\jICeUIR.exe
  2⤵
  PID:8564
- C:\Windows\System\mBIrPkl.exe
  C:\Windows\System\mBIrPkl.exe
  2⤵
  PID:8588
- C:\Windows\System\TnQmQpn.exe
  C:\Windows\System\TnQmQpn.exe
  2⤵
  PID:8608
- C:\Windows\System\lzGfVGe.exe
  C:\Windows\System\lzGfVGe.exe
  2⤵
  PID:8636
- C:\Windows\System\tYiKBHD.exe
  C:\Windows\System\tYiKBHD.exe
  2⤵
  PID:8660
- C:\Windows\System\Jnwwoaj.exe
  C:\Windows\System\Jnwwoaj.exe
  2⤵
  PID:8688
- C:\Windows\System\EGGLuoi.exe
  C:\Windows\System\EGGLuoi.exe
  2⤵
  PID:8704
- C:\Windows\System\WmseNUs.exe
  C:\Windows\System\WmseNUs.exe
  2⤵
  PID:8728
- C:\Windows\System\YfgjWRl.exe
  C:\Windows\System\YfgjWRl.exe
  2⤵
  PID:8748
- C:\Windows\System\uppJipo.exe
  C:\Windows\System\uppJipo.exe
  2⤵
  PID:8764
- C:\Windows\System\VqGvQUF.exe
  C:\Windows\System\VqGvQUF.exe
  2⤵
  PID:8792
- C:\Windows\System\agNxrYq.exe
  C:\Windows\System\agNxrYq.exe
  2⤵
  PID:8820
- C:\Windows\System\KMNFDzf.exe
  C:\Windows\System\KMNFDzf.exe
  2⤵
  PID:8848
- C:\Windows\System\NMPOseG.exe
  C:\Windows\System\NMPOseG.exe
  2⤵
  PID:8876
- C:\Windows\System\xIvpEFz.exe
  C:\Windows\System\xIvpEFz.exe
  2⤵
  PID:8908
- C:\Windows\System\lYkNWbq.exe
  C:\Windows\System\lYkNWbq.exe
  2⤵
  PID:8936
- C:\Windows\System\RKFVCQd.exe
  C:\Windows\System\RKFVCQd.exe
  2⤵
  PID:8964
- C:\Windows\System\cJugWyF.exe
  C:\Windows\System\cJugWyF.exe
  2⤵
  PID:8988
- C:\Windows\System\XdvwRtz.exe
  C:\Windows\System\XdvwRtz.exe
  2⤵
  PID:9016
- C:\Windows\System\kKIeEND.exe
  C:\Windows\System\kKIeEND.exe
  2⤵
  PID:9044
- C:\Windows\System\ARUNtwM.exe
  C:\Windows\System\ARUNtwM.exe
  2⤵
  PID:9072
- C:\Windows\System\ySpEyOE.exe
  C:\Windows\System\ySpEyOE.exe
  2⤵
  PID:9108
- C:\Windows\System\geiEDdM.exe
  C:\Windows\System\geiEDdM.exe
  2⤵
  PID:9128
- C:\Windows\System\TmqSUCd.exe
  C:\Windows\System\TmqSUCd.exe
  2⤵
  PID:9160
- C:\Windows\System\lmlUMkR.exe
  C:\Windows\System\lmlUMkR.exe
  2⤵
  PID:9184
- C:\Windows\System\UXGGMYR.exe
  C:\Windows\System\UXGGMYR.exe
  2⤵
  PID:9212
- C:\Windows\System\jhWJxXK.exe
  C:\Windows\System\jhWJxXK.exe
  2⤵
  PID:7548
- C:\Windows\System\rfqupBk.exe
  C:\Windows\System\rfqupBk.exe
  2⤵
  PID:7608
- C:\Windows\System\vfJnXcy.exe
  C:\Windows\System\vfJnXcy.exe
  2⤵
  PID:8228
- C:\Windows\System\MAnwFGl.exe
  C:\Windows\System\MAnwFGl.exe
  2⤵
  PID:7944
- C:\Windows\System\lFNUPuB.exe
  C:\Windows\System\lFNUPuB.exe
  2⤵
  PID:8336
- C:\Windows\System\qRYkCvv.exe
  C:\Windows\System\qRYkCvv.exe
  2⤵
  PID:8196
- C:\Windows\System\FzkQnNi.exe
  C:\Windows\System\FzkQnNi.exe
  2⤵
  PID:8512
- C:\Windows\System\qPGPxjl.exe
  C:\Windows\System\qPGPxjl.exe
  2⤵
  PID:8556
- C:\Windows\System\gICBPhy.exe
  C:\Windows\System\gICBPhy.exe
  2⤵
  PID:8584
- C:\Windows\System\lsjrpVp.exe
  C:\Windows\System\lsjrpVp.exe
  2⤵
  PID:8532
- C:\Windows\System\xjlfoRV.exe
  C:\Windows\System\xjlfoRV.exe
  2⤵
  PID:8604
- C:\Windows\System\WGireMV.exe
  C:\Windows\System\WGireMV.exe
  2⤵
  PID:8784
- C:\Windows\System\FAtobCP.exe
  C:\Windows\System\FAtobCP.exe
  2⤵
  PID:8868
- C:\Windows\System\Vlsuufl.exe
  C:\Windows\System\Vlsuufl.exe
  2⤵
  PID:8888
- C:\Windows\System\IADctzu.exe
  C:\Windows\System\IADctzu.exe
  2⤵
  PID:8808
- C:\Windows\System\DIGnXxK.exe
  C:\Windows\System\DIGnXxK.exe
  2⤵
  PID:8836
- C:\Windows\System\IIBGxmg.exe
  C:\Windows\System\IIBGxmg.exe
  2⤵
  PID:8920
- C:\Windows\System\PgkrmaK.exe
  C:\Windows\System\PgkrmaK.exe
  2⤵
  PID:9180
- C:\Windows\System\FSAIEEy.exe
  C:\Windows\System\FSAIEEy.exe
  2⤵
  PID:8144
- C:\Windows\System\ynkOuBw.exe
  C:\Windows\System\ynkOuBw.exe
  2⤵
  PID:8928
- C:\Windows\System\wbskoHX.exe
  C:\Windows\System\wbskoHX.exe
  2⤵
  PID:9088
- C:\Windows\System\qcvfGgN.exe
  C:\Windows\System\qcvfGgN.exe
  2⤵
  PID:9192
- C:\Windows\System\WxWNoOi.exe
  C:\Windows\System\WxWNoOi.exe
  2⤵
  PID:9008
- C:\Windows\System\AtKBkKS.exe
  C:\Windows\System\AtKBkKS.exe
  2⤵
  PID:9124
- C:\Windows\System\TRKveRU.exe
  C:\Windows\System\TRKveRU.exe
  2⤵
  PID:8384
- C:\Windows\System\bELPTtC.exe
  C:\Windows\System\bELPTtC.exe
  2⤵
  PID:8420
- C:\Windows\System\TMvLCUM.exe
  C:\Windows\System\TMvLCUM.exe
  2⤵
  PID:8624
- C:\Windows\System\yCzZsvd.exe
  C:\Windows\System\yCzZsvd.exe
  2⤵
  PID:9236
- C:\Windows\System\FHgGvwx.exe
  C:\Windows\System\FHgGvwx.exe
  2⤵
  PID:9272
- C:\Windows\System\PjqEzFy.exe
  C:\Windows\System\PjqEzFy.exe
  2⤵
  PID:9296
- C:\Windows\System\tuvJtbB.exe
  C:\Windows\System\tuvJtbB.exe
  2⤵
  PID:9320
- C:\Windows\System\duWDkWH.exe
  C:\Windows\System\duWDkWH.exe
  2⤵
  PID:9344
- C:\Windows\System\NUEmDYO.exe
  C:\Windows\System\NUEmDYO.exe
  2⤵
  PID:9376
- C:\Windows\System\mVtMpsf.exe
  C:\Windows\System\mVtMpsf.exe
  2⤵
  PID:9400
- C:\Windows\System\TZjDxRV.exe
  C:\Windows\System\TZjDxRV.exe
  2⤵
  PID:9428
- C:\Windows\System\GLWOzov.exe
  C:\Windows\System\GLWOzov.exe
  2⤵
  PID:9460
- C:\Windows\System\OSinlsz.exe
  C:\Windows\System\OSinlsz.exe
  2⤵
  PID:9492
- C:\Windows\System\exyGvKP.exe
  C:\Windows\System\exyGvKP.exe
  2⤵
  PID:9520
- C:\Windows\System\KmkHzWP.exe
  C:\Windows\System\KmkHzWP.exe
  2⤵
  PID:9548
- C:\Windows\System\hQJlZzd.exe
  C:\Windows\System\hQJlZzd.exe
  2⤵
  PID:9568
- C:\Windows\System\LFQpiJL.exe
  C:\Windows\System\LFQpiJL.exe
  2⤵
  PID:9596
- C:\Windows\System\UlVJLOK.exe
  C:\Windows\System\UlVJLOK.exe
  2⤵
  PID:9624
- C:\Windows\System\nHEmPEL.exe
  C:\Windows\System\nHEmPEL.exe
  2⤵
  PID:9652
- C:\Windows\System\aBYAqwS.exe
  C:\Windows\System\aBYAqwS.exe
  2⤵
  PID:9680
- C:\Windows\System\lTHrzhw.exe
  C:\Windows\System\lTHrzhw.exe
  2⤵
  PID:9708
- C:\Windows\System\JpkDAzk.exe
  C:\Windows\System\JpkDAzk.exe
  2⤵
  PID:9724
- C:\Windows\System\wPbvCTW.exe
  C:\Windows\System\wPbvCTW.exe
  2⤵
  PID:9756
- C:\Windows\System\LSjCxIX.exe
  C:\Windows\System\LSjCxIX.exe
  2⤵
  PID:9788
- C:\Windows\System\wGaSpkw.exe
  C:\Windows\System\wGaSpkw.exe
  2⤵
  PID:9820
- C:\Windows\System\BqhIBqs.exe
  C:\Windows\System\BqhIBqs.exe
  2⤵
  PID:9844
- C:\Windows\System\PxxekQC.exe
  C:\Windows\System\PxxekQC.exe
  2⤵
  PID:9864
- C:\Windows\System\wBIQghx.exe
  C:\Windows\System\wBIQghx.exe
  2⤵
  PID:9892
- C:\Windows\System\mWBTfJb.exe
  C:\Windows\System\mWBTfJb.exe
  2⤵
  PID:9920
- C:\Windows\System\hZSvOPD.exe
  C:\Windows\System\hZSvOPD.exe
  2⤵
  PID:9944
- C:\Windows\System\ENRYofA.exe
  C:\Windows\System\ENRYofA.exe
  2⤵
  PID:9968
- C:\Windows\System\zsLfGBd.exe
  C:\Windows\System\zsLfGBd.exe
  2⤵
  PID:9996
- C:\Windows\System\zOqIJsM.exe
  C:\Windows\System\zOqIJsM.exe
  2⤵
  PID:10020
- C:\Windows\System\shqryvQ.exe
  C:\Windows\System\shqryvQ.exe
  2⤵
  PID:10040
- C:\Windows\System\iaMlJcA.exe
  C:\Windows\System\iaMlJcA.exe
  2⤵
  PID:10068
- C:\Windows\System\vActgMi.exe
  C:\Windows\System\vActgMi.exe
  2⤵
  PID:10092
- C:\Windows\System\wCHQgCd.exe
  C:\Windows\System\wCHQgCd.exe
  2⤵
  PID:10120
- C:\Windows\System\jazxPvk.exe
  C:\Windows\System\jazxPvk.exe
  2⤵
  PID:10144
- C:\Windows\System\nYgzLJY.exe
  C:\Windows\System\nYgzLJY.exe
  2⤵
  PID:10168
- C:\Windows\System\WeIHniv.exe
  C:\Windows\System\WeIHniv.exe
  2⤵
  PID:10192
- C:\Windows\System\RHvwLSd.exe
  C:\Windows\System\RHvwLSd.exe
  2⤵
  PID:10212
- C:\Windows\System\HvaIDXS.exe
  C:\Windows\System\HvaIDXS.exe
  2⤵
  PID:10232
- C:\Windows\System\lbQkXJO.exe
  C:\Windows\System\lbQkXJO.exe
  2⤵
  PID:8580
- C:\Windows\System\rYnyzRt.exe
  C:\Windows\System\rYnyzRt.exe
  2⤵
  PID:8628
- C:\Windows\System\sFjZaFq.exe
  C:\Windows\System\sFjZaFq.exe
  2⤵
  PID:9004
- C:\Windows\System\KgvRLJA.exe
  C:\Windows\System\KgvRLJA.exe
  2⤵
  PID:8672
- C:\Windows\System\jEQPZLL.exe
  C:\Windows\System\jEQPZLL.exe
  2⤵
  PID:9316
- C:\Windows\System\VzaFcwO.exe
  C:\Windows\System\VzaFcwO.exe
  2⤵
  PID:9232
- C:\Windows\System\GjGbZWi.exe
  C:\Windows\System\GjGbZWi.exe
  2⤵
  PID:9268
- C:\Windows\System\zbeZrAX.exe
  C:\Windows\System\zbeZrAX.exe
  2⤵
  PID:9364
- C:\Windows\System\DwHAIBz.exe
  C:\Windows\System\DwHAIBz.exe
  2⤵
  PID:9436
- C:\Windows\System\jdnbOhT.exe
  C:\Windows\System\jdnbOhT.exe
  2⤵
  PID:9688
- C:\Windows\System\yeWcQxV.exe
  C:\Windows\System\yeWcQxV.exe
  2⤵
  PID:9776
- C:\Windows\System\GYglIHF.exe
  C:\Windows\System\GYglIHF.exe
  2⤵
  PID:9808
- C:\Windows\System\MauUdsU.exe
  C:\Windows\System\MauUdsU.exe
  2⤵
  PID:9592
- C:\Windows\System\FsqusMQ.exe
  C:\Windows\System\FsqusMQ.exe
  2⤵
  PID:9644
- C:\Windows\System\gjlPnFm.exe
  C:\Windows\System\gjlPnFm.exe
  2⤵
  PID:9736
- C:\Windows\System\sBCXzIM.exe
  C:\Windows\System\sBCXzIM.exe
  2⤵
  PID:9772
- C:\Windows\System\xfggRHG.exe
  C:\Windows\System\xfggRHG.exe
  2⤵
  PID:10152
- C:\Windows\System\zMFTler.exe
  C:\Windows\System\zMFTler.exe
  2⤵
  PID:9976
- C:\Windows\System\HNnzSPB.exe
  C:\Windows\System\HNnzSPB.exe
  2⤵
  PID:10016
- C:\Windows\System\rXtNHfx.exe
  C:\Windows\System\rXtNHfx.exe
  2⤵
  PID:9880
- C:\Windows\System\jzXCQVH.exe
  C:\Windows\System\jzXCQVH.exe
  2⤵
  PID:8700
- C:\Windows\System\PVfoNXv.exe
  C:\Windows\System\PVfoNXv.exe
  2⤵
  PID:8900
- C:\Windows\System\aekBGyV.exe
  C:\Windows\System\aekBGyV.exe
  2⤵
  PID:10112
- C:\Windows\System\GlpYpNF.exe
  C:\Windows\System\GlpYpNF.exe
  2⤵
  PID:8120
- C:\Windows\System\hgXPQrm.exe
  C:\Windows\System\hgXPQrm.exe
  2⤵
  PID:10244
- C:\Windows\System\lejzLBg.exe
  C:\Windows\System\lejzLBg.exe
  2⤵
  PID:10272
- C:\Windows\System\JkiPuvf.exe
  C:\Windows\System\JkiPuvf.exe
  2⤵
  PID:10304
- C:\Windows\System\HLmGGbN.exe
  C:\Windows\System\HLmGGbN.exe
  2⤵
  PID:10320
- C:\Windows\System\eRBYZep.exe
  C:\Windows\System\eRBYZep.exe
  2⤵
  PID:10344
- C:\Windows\System\xQKKdlw.exe
  C:\Windows\System\xQKKdlw.exe
  2⤵
  PID:10372
- C:\Windows\System\wAuGHCX.exe
  C:\Windows\System\wAuGHCX.exe
  2⤵
  PID:10392
- C:\Windows\System\EBPcxpf.exe
  C:\Windows\System\EBPcxpf.exe
  2⤵
  PID:10420
- C:\Windows\System\QWNHpnS.exe
  C:\Windows\System\QWNHpnS.exe
  2⤵
  PID:10464
- C:\Windows\System\sLlGhFf.exe
  C:\Windows\System\sLlGhFf.exe
  2⤵
  PID:10496
- C:\Windows\System\KyWqnMc.exe
  C:\Windows\System\KyWqnMc.exe
  2⤵
  PID:10528
- C:\Windows\System\GnbQusH.exe
  C:\Windows\System\GnbQusH.exe
  2⤵
  PID:10552
- C:\Windows\System\tiJYYJT.exe
  C:\Windows\System\tiJYYJT.exe
  2⤵
  PID:10580
- C:\Windows\System\RKFnpiE.exe
  C:\Windows\System\RKFnpiE.exe
  2⤵
  PID:10608
- C:\Windows\System\zsrijrT.exe
  C:\Windows\System\zsrijrT.exe
  2⤵
  PID:10640
- C:\Windows\System\CyQfqTY.exe
  C:\Windows\System\CyQfqTY.exe
  2⤵
  PID:10664
- C:\Windows\System\eXUklwX.exe
  C:\Windows\System\eXUklwX.exe
  2⤵
  PID:10696
- C:\Windows\System\LPexCIG.exe
  C:\Windows\System\LPexCIG.exe
  2⤵
  PID:10720
- C:\Windows\System\GGzmUGn.exe
  C:\Windows\System\GGzmUGn.exe
  2⤵
  PID:10752
- C:\Windows\System\dcbNxcP.exe
  C:\Windows\System\dcbNxcP.exe
  2⤵
  PID:10776
- C:\Windows\System\QFzPPmJ.exe
  C:\Windows\System\QFzPPmJ.exe
  2⤵
  PID:10804
- C:\Windows\System\TSxeAgx.exe
  C:\Windows\System\TSxeAgx.exe
  2⤵
  PID:10840
- C:\Windows\System\gDHAcew.exe
  C:\Windows\System\gDHAcew.exe
  2⤵
  PID:10864
- C:\Windows\System\vaeOrVV.exe
  C:\Windows\System\vaeOrVV.exe
  2⤵
  PID:10892
- C:\Windows\System\KXIQRAa.exe
  C:\Windows\System\KXIQRAa.exe
  2⤵
  PID:10916
- C:\Windows\System\gTcDXzo.exe
  C:\Windows\System\gTcDXzo.exe
  2⤵
  PID:10940
- C:\Windows\System\WTiAXJY.exe
  C:\Windows\System\WTiAXJY.exe
  2⤵
  PID:10968
- C:\Windows\System\TbqOVFt.exe
  C:\Windows\System\TbqOVFt.exe
  2⤵
  PID:10988
- C:\Windows\System\riEfkCU.exe
  C:\Windows\System\riEfkCU.exe
  2⤵
  PID:11016
- C:\Windows\System\QNAdjQr.exe
  C:\Windows\System\QNAdjQr.exe
  2⤵
  PID:11048
- C:\Windows\System\oAApJaZ.exe
  C:\Windows\System\oAApJaZ.exe
  2⤵
  PID:11068
- C:\Windows\System\eoQoMik.exe
  C:\Windows\System\eoQoMik.exe
  2⤵
  PID:11092
- C:\Windows\System\kQBypSk.exe
  C:\Windows\System\kQBypSk.exe
  2⤵
  PID:11112
- C:\Windows\System\ObFMARg.exe
  C:\Windows\System\ObFMARg.exe
  2⤵
  PID:11144
- C:\Windows\System\wdpdHDk.exe
  C:\Windows\System\wdpdHDk.exe
  2⤵
  PID:11164
- C:\Windows\System\GzOiime.exe
  C:\Windows\System\GzOiime.exe
  2⤵
  PID:11196
- C:\Windows\System\vcSpfaw.exe
  C:\Windows\System\vcSpfaw.exe
  2⤵
  PID:11220
- C:\Windows\System\UMCLTpT.exe
  C:\Windows\System\UMCLTpT.exe
  2⤵
  PID:11244
- C:\Windows\System\ZSGVYDR.exe
  C:\Windows\System\ZSGVYDR.exe
  2⤵
  PID:10056
- C:\Windows\System\nSOeFQl.exe
  C:\Windows\System\nSOeFQl.exe
  2⤵
  PID:9284
- C:\Windows\System\cUxzyhT.exe
  C:\Windows\System\cUxzyhT.exe
  2⤵
  PID:9560
- C:\Windows\System\chVupvV.exe
  C:\Windows\System\chVupvV.exe
  2⤵
  PID:9720
- C:\Windows\System\iRAObJS.exe
  C:\Windows\System\iRAObJS.exe
  2⤵
  PID:9412
- C:\Windows\System\TotAEai.exe
  C:\Windows\System\TotAEai.exe
  2⤵
  PID:10100
- C:\Windows\System\fwseVKa.exe
  C:\Windows\System\fwseVKa.exe
  2⤵
  PID:10036
- C:\Windows\System\ghqXYNa.exe
  C:\Windows\System\ghqXYNa.exe
  2⤵
  PID:9784
- C:\Windows\System\GCsClei.exe
  C:\Windows\System\GCsClei.exe
  2⤵
  PID:9696
- C:\Windows\System\NZtKLnW.exe
  C:\Windows\System\NZtKLnW.exe
  2⤵
  PID:10336
- C:\Windows\System\bnIDjAF.exe
  C:\Windows\System\bnIDjAF.exe
  2⤵
  PID:10620
- C:\Windows\System\ZKlFUxw.exe
  C:\Windows\System\ZKlFUxw.exe
  2⤵
  PID:10380
- C:\Windows\System\OrnvOkh.exe
  C:\Windows\System\OrnvOkh.exe
  2⤵
  PID:10436
- C:\Windows\System\cEqWOuY.exe
  C:\Windows\System\cEqWOuY.exe
  2⤵
  PID:8396
- C:\Windows\System\PGFTHFI.exe
  C:\Windows\System\PGFTHFI.exe
  2⤵
  PID:10524
- C:\Windows\System\DjuoOkN.exe
  C:\Windows\System\DjuoOkN.exe
  2⤵
  PID:10568
- C:\Windows\System\lmslcHf.exe
  C:\Windows\System\lmslcHf.exe
  2⤵
  PID:10936
- C:\Windows\System\IsMroDM.exe
  C:\Windows\System\IsMroDM.exe
  2⤵
  PID:10984
- C:\Windows\System\aRRxqgW.exe
  C:\Windows\System\aRRxqgW.exe
  2⤵
  PID:10712
- C:\Windows\System\ymvtYVy.exe
  C:\Windows\System\ymvtYVy.exe
  2⤵
  PID:10876
- C:\Windows\System\BRLSxMm.exe
  C:\Windows\System\BRLSxMm.exe
  2⤵
  PID:10952
- C:\Windows\System\ZfuJbgF.exe
  C:\Windows\System\ZfuJbgF.exe
  2⤵
  PID:11008
- C:\Windows\System\QktOiFz.exe
  C:\Windows\System\QktOiFz.exe
  2⤵
  PID:11076
- C:\Windows\System\ALhSeNW.exe
  C:\Windows\System\ALhSeNW.exe
  2⤵
  PID:10388
- C:\Windows\System\WZxpahO.exe
  C:\Windows\System\WZxpahO.exe
  2⤵
  PID:9800
- C:\Windows\System\Ndvocnq.exe
  C:\Windows\System\Ndvocnq.exe
  2⤵
  PID:10592
- C:\Windows\System\skaNdNc.exe
  C:\Windows\System\skaNdNc.exe
  2⤵
  PID:11268
- C:\Windows\System\gnKilJQ.exe
  C:\Windows\System\gnKilJQ.exe
  2⤵
  PID:11296
- C:\Windows\System\ExMrlHb.exe
  C:\Windows\System\ExMrlHb.exe
  2⤵
  PID:11324
- C:\Windows\System\XcImUwk.exe
  C:\Windows\System\XcImUwk.exe
  2⤵
  PID:11352
- C:\Windows\System\KKbOFty.exe
  C:\Windows\System\KKbOFty.exe
  2⤵
  PID:11392
- C:\Windows\System\MamEUgL.exe
  C:\Windows\System\MamEUgL.exe
  2⤵
  PID:11428
- C:\Windows\System\oJGPuyN.exe
  C:\Windows\System\oJGPuyN.exe
  2⤵
  PID:11448
- C:\Windows\System\pPZEPHm.exe
  C:\Windows\System\pPZEPHm.exe
  2⤵
  PID:11480
- C:\Windows\System\NvdgPIb.exe
  C:\Windows\System\NvdgPIb.exe
  2⤵
  PID:11512
- C:\Windows\System\TADJjzD.exe
  C:\Windows\System\TADJjzD.exe
  2⤵
  PID:11540
- C:\Windows\System\mdRhmob.exe
  C:\Windows\System\mdRhmob.exe
  2⤵
  PID:11560
- C:\Windows\System\MNpoQIv.exe
  C:\Windows\System\MNpoQIv.exe
  2⤵
  PID:11588
- C:\Windows\System\TRjwTYJ.exe
  C:\Windows\System\TRjwTYJ.exe
  2⤵
  PID:11616
- C:\Windows\System\rqNQWeF.exe
  C:\Windows\System\rqNQWeF.exe
  2⤵
  PID:11632
- C:\Windows\System\pAAorlj.exe
  C:\Windows\System\pAAorlj.exe
  2⤵
  PID:11660
- C:\Windows\System\bxPovoU.exe
  C:\Windows\System\bxPovoU.exe
  2⤵
  PID:11692
- C:\Windows\System\OPSIqCP.exe
  C:\Windows\System\OPSIqCP.exe
  2⤵
  PID:11720
- C:\Windows\System\qqOUGjS.exe
  C:\Windows\System\qqOUGjS.exe
  2⤵
  PID:11748
- C:\Windows\System\uVodDoc.exe
  C:\Windows\System\uVodDoc.exe
  2⤵
  PID:11780
- C:\Windows\System\lAwRCYz.exe
  C:\Windows\System\lAwRCYz.exe
  2⤵
  PID:11804
- C:\Windows\System\GrqmBRP.exe
  C:\Windows\System\GrqmBRP.exe
  2⤵
  PID:11828
- C:\Windows\System\lgYmNoQ.exe
  C:\Windows\System\lgYmNoQ.exe
  2⤵
  PID:11852
- C:\Windows\System\ZYjXPwY.exe
  C:\Windows\System\ZYjXPwY.exe
  2⤵
  PID:11872
- C:\Windows\System\tZeHnAA.exe
  C:\Windows\System\tZeHnAA.exe
  2⤵
  PID:11896
- C:\Windows\System\xxwgsPC.exe
  C:\Windows\System\xxwgsPC.exe
  2⤵
  PID:11916
- C:\Windows\System\mhKMxYD.exe
  C:\Windows\System\mhKMxYD.exe
  2⤵
  PID:11948
- C:\Windows\System\CSMRUTP.exe
  C:\Windows\System\CSMRUTP.exe
  2⤵
  PID:11968
- C:\Windows\System\epnjLWb.exe
  C:\Windows\System\epnjLWb.exe
  2⤵
  PID:12000
- C:\Windows\System\hCsxkjr.exe
  C:\Windows\System\hCsxkjr.exe
  2⤵
  PID:12036
- C:\Windows\System\lgOjFYj.exe
  C:\Windows\System\lgOjFYj.exe
  2⤵
  PID:12060
- C:\Windows\System\GfnEwHu.exe
  C:\Windows\System\GfnEwHu.exe
  2⤵
  PID:12084
- C:\Windows\System\MkCsoii.exe
  C:\Windows\System\MkCsoii.exe
  2⤵
  PID:12104
- C:\Windows\System\ILllsPo.exe
  C:\Windows\System\ILllsPo.exe
  2⤵
  PID:12128
- C:\Windows\System\qeZwkgp.exe
  C:\Windows\System\qeZwkgp.exe
  2⤵
  PID:12156
- C:\Windows\System\SHLpftF.exe
  C:\Windows\System\SHLpftF.exe
  2⤵
  PID:12172
- C:\Windows\System\hokYXMR.exe
  C:\Windows\System\hokYXMR.exe
  2⤵
  PID:12188
- C:\Windows\System\TPNHYzb.exe
  C:\Windows\System\TPNHYzb.exe
  2⤵
  PID:12216
- C:\Windows\System\FtlPQIV.exe
  C:\Windows\System\FtlPQIV.exe
  2⤵
  PID:12232
- C:\Windows\System\SmXPRHB.exe
  C:\Windows\System\SmXPRHB.exe
  2⤵
  PID:12260
- C:\Windows\System\yPaLNni.exe
  C:\Windows\System\yPaLNni.exe
  2⤵
  PID:12280
- C:\Windows\System\UuYDBTA.exe
  C:\Windows\System\UuYDBTA.exe
  2⤵
  PID:11160
- C:\Windows\System\puSLCLB.exe
  C:\Windows\System\puSLCLB.exe
  2⤵
  PID:11188
- C:\Windows\System\nvinMZQ.exe
  C:\Windows\System\nvinMZQ.exe
  2⤵
  PID:10224
- C:\Windows\System\xQEoYKR.exe
  C:\Windows\System\xQEoYKR.exe
  2⤵
  PID:10740
- C:\Windows\System\nPPIWeT.exe
  C:\Windows\System\nPPIWeT.exe
  2⤵
  PID:11236
- C:\Windows\System\dbjkGwg.exe
  C:\Windows\System\dbjkGwg.exe
  2⤵
  PID:9940
- C:\Windows\System\GeEUBMC.exe
  C:\Windows\System\GeEUBMC.exe
  2⤵
  PID:10312
- C:\Windows\System\NBIcIuP.exe
  C:\Windows\System\NBIcIuP.exe
  2⤵
  PID:10792
- C:\Windows\System\ABHDOCM.exe
  C:\Windows\System\ABHDOCM.exe
  2⤵
  PID:11380
- C:\Windows\System\ULmVNjm.exe
  C:\Windows\System\ULmVNjm.exe
  2⤵
  PID:11028
- C:\Windows\System\VrMOJBY.exe
  C:\Windows\System\VrMOJBY.exe
  2⤵
  PID:10772
- C:\Windows\System\sYCRawE.exe
  C:\Windows\System\sYCRawE.exe
  2⤵
  PID:11580
- C:\Windows\System\NotOlTK.exe
  C:\Windows\System\NotOlTK.exe
  2⤵
  PID:11604
- C:\Windows\System\XAmeRcU.exe
  C:\Windows\System\XAmeRcU.exe
  2⤵
  PID:11716
- C:\Windows\System\OtgFpwx.exe
  C:\Windows\System\OtgFpwx.exe
  2⤵
  PID:11764
- C:\Windows\System\uCLiiTq.exe
  C:\Windows\System\uCLiiTq.exe
  2⤵
  PID:11816
- C:\Windows\System\cQpvJgG.exe
  C:\Windows\System\cQpvJgG.exe
  2⤵
  PID:11860
- C:\Windows\System\qJIwJTp.exe
  C:\Windows\System\qJIwJTp.exe
  2⤵
  PID:11528
- C:\Windows\System\BfigVeR.exe
  C:\Windows\System\BfigVeR.exe
  2⤵
  PID:11984
- C:\Windows\System\AwdfzEd.exe
  C:\Windows\System\AwdfzEd.exe
  2⤵
  PID:11312
- C:\Windows\System\zLrKpal.exe
  C:\Windows\System\zLrKpal.exe
  2⤵
  PID:11728
- C:\Windows\System\sICElnL.exe
  C:\Windows\System\sICElnL.exe
  2⤵
  PID:11824
- C:\Windows\System\nobPQnD.exe
  C:\Windows\System\nobPQnD.exe
  2⤵
  PID:11884
- C:\Windows\System\WXpogYl.exe
  C:\Windows\System\WXpogYl.exe
  2⤵
  PID:11624
- C:\Windows\System\IFyZRBC.exe
  C:\Windows\System\IFyZRBC.exe
  2⤵
  PID:9092
- C:\Windows\System\EUyjewU.exe
  C:\Windows\System\EUyjewU.exe
  2⤵
  PID:12052
- C:\Windows\System\SwGSlrl.exe
  C:\Windows\System\SwGSlrl.exe
  2⤵
  PID:11792
- C:\Windows\System\VBNDRbH.exe
  C:\Windows\System\VBNDRbH.exe
  2⤵
  PID:12308
- C:\Windows\System\hXiYzNu.exe
  C:\Windows\System\hXiYzNu.exe
  2⤵
  PID:12336
- C:\Windows\System\OeylffR.exe
  C:\Windows\System\OeylffR.exe
  2⤵
  PID:12364
- C:\Windows\System\dvcKUtj.exe
  C:\Windows\System\dvcKUtj.exe
  2⤵
  PID:12392
- C:\Windows\System\CEkfJeq.exe
  C:\Windows\System\CEkfJeq.exe
  2⤵
  PID:12440
- C:\Windows\System\EdLAVrk.exe
  C:\Windows\System\EdLAVrk.exe
  2⤵
  PID:12460
- C:\Windows\System\PCeFjtP.exe
  C:\Windows\System\PCeFjtP.exe
  2⤵
  PID:12488
- C:\Windows\System\ROhfiFc.exe
  C:\Windows\System\ROhfiFc.exe
  2⤵
  PID:12504
- C:\Windows\System\azRNavD.exe
  C:\Windows\System\azRNavD.exe
  2⤵
  PID:12532
- C:\Windows\System\VDdpiIZ.exe
  C:\Windows\System\VDdpiIZ.exe
  2⤵
  PID:12556
- C:\Windows\System\kAmNEzD.exe
  C:\Windows\System\kAmNEzD.exe
  2⤵
  PID:12588
- C:\Windows\System\xwbEiQH.exe
  C:\Windows\System\xwbEiQH.exe
  2⤵
  PID:12612
- C:\Windows\System\DDetkCv.exe
  C:\Windows\System\DDetkCv.exe
  2⤵
  PID:12644
- C:\Windows\System\YgahTQH.exe
  C:\Windows\System\YgahTQH.exe
  2⤵
  PID:12664
- C:\Windows\System\lyUcVUC.exe
  C:\Windows\System\lyUcVUC.exe
  2⤵
  PID:12692
- C:\Windows\System\hBREOfg.exe
  C:\Windows\System\hBREOfg.exe
  2⤵
  PID:12712
- C:\Windows\System\XUbKybf.exe
  C:\Windows\System\XUbKybf.exe
  2⤵
  PID:12740
- C:\Windows\System\cHqBEZO.exe
  C:\Windows\System\cHqBEZO.exe
  2⤵
  PID:12768
- C:\Windows\System\zNGGDlm.exe
  C:\Windows\System\zNGGDlm.exe
  2⤵
  PID:12792
- C:\Windows\System\YWUfFMM.exe
  C:\Windows\System\YWUfFMM.exe
  2⤵
  PID:12820
- C:\Windows\System\VyqAwkd.exe
  C:\Windows\System\VyqAwkd.exe
  2⤵
  PID:12844
- C:\Windows\System\WIzmfwa.exe
  C:\Windows\System\WIzmfwa.exe
  2⤵
  PID:12872
- C:\Windows\System\QsCWWDO.exe
  C:\Windows\System\QsCWWDO.exe
  2⤵
  PID:12896
- C:\Windows\System\ccmlTdN.exe
  C:\Windows\System\ccmlTdN.exe
  2⤵
  PID:12920
- C:\Windows\System\mEDtcVC.exe
  C:\Windows\System\mEDtcVC.exe
  2⤵
  PID:12948
- C:\Windows\System\KhgHCvQ.exe
  C:\Windows\System\KhgHCvQ.exe
  2⤵
  PID:12976
- C:\Windows\System\pXLpVde.exe
  C:\Windows\System\pXLpVde.exe
  2⤵
  PID:13012
- C:\Windows\System\yOVVGrf.exe
  C:\Windows\System\yOVVGrf.exe
  2⤵
  PID:13052
- C:\Windows\System\dEkEduW.exe
  C:\Windows\System\dEkEduW.exe
  2⤵
  PID:13072
- C:\Windows\System\MaSJOrk.exe
  C:\Windows\System\MaSJOrk.exe
  2⤵
  PID:13100
- C:\Windows\System\bBeiffT.exe
  C:\Windows\System\bBeiffT.exe
  2⤵
  PID:13124
- C:\Windows\System\kgxMQIQ.exe
  C:\Windows\System\kgxMQIQ.exe
  2⤵
  PID:13156
- C:\Windows\System\lBLcwJs.exe
  C:\Windows\System\lBLcwJs.exe
  2⤵
  PID:13176
- C:\Windows\System\FFXBjJU.exe
  C:\Windows\System\FFXBjJU.exe
  2⤵
  PID:13196
- C:\Windows\System\scnzOty.exe
  C:\Windows\System\scnzOty.exe
  2⤵
  PID:13224
- C:\Windows\System\TqGfRGF.exe
  C:\Windows\System\TqGfRGF.exe
  2⤵
  PID:13244
- C:\Windows\System\Yfzkria.exe
  C:\Windows\System\Yfzkria.exe
  2⤵
  PID:13260
- C:\Windows\System\xcNVqUV.exe
  C:\Windows\System\xcNVqUV.exe
  2⤵
  PID:13296
- C:\Windows\System\wEoOiiJ.exe
  C:\Windows\System\wEoOiiJ.exe
  2⤵
  PID:11100
- C:\Windows\System\fnDjXno.exe
  C:\Windows\System\fnDjXno.exe
  2⤵
  PID:12224
- C:\Windows\System\ohSizEv.exe
  C:\Windows\System\ohSizEv.exe
  2⤵
  PID:12268
- C:\Windows\System\Fsvinin.exe
  C:\Windows\System\Fsvinin.exe
  2⤵
  PID:11676
- C:\Windows\System\KXTMIjE.exe
  C:\Windows\System\KXTMIjE.exe
  2⤵
  PID:12152
- C:\Windows\System\wmSXIFu.exe
  C:\Windows\System\wmSXIFu.exe
  2⤵
  PID:12144
- C:\Windows\System\ZxPUCfL.exe
  C:\Windows\System\ZxPUCfL.exe
  2⤵
  PID:9416
- C:\Windows\System\elpFkXG.exe
  C:\Windows\System\elpFkXG.exe
  2⤵
  PID:12092
- C:\Windows\System\IBxKOks.exe
  C:\Windows\System\IBxKOks.exe
  2⤵
  PID:12180
- C:\Windows\System\MhRApCd.exe
  C:\Windows\System\MhRApCd.exe
  2⤵
  PID:12256
- C:\Windows\System\kRQhxkA.exe
  C:\Windows\System\kRQhxkA.exe
  2⤵
  PID:12484
- C:\Windows\System\LiJdJRm.exe
  C:\Windows\System\LiJdJRm.exe
  2⤵
  PID:12568
- C:\Windows\System\GIHjiCh.exe
  C:\Windows\System\GIHjiCh.exe
  2⤵
  PID:12624
- C:\Windows\System\auXmsXP.exe
  C:\Windows\System\auXmsXP.exe
  2⤵
  PID:12676
- C:\Windows\System\YzhtlDC.exe
  C:\Windows\System\YzhtlDC.exe
  2⤵
  PID:12724
- C:\Windows\System\orewbeC.exe
  C:\Windows\System\orewbeC.exe
  2⤵
  PID:9452
- C:\Windows\System\PkHyyHF.exe
  C:\Windows\System\PkHyyHF.exe
  2⤵
  PID:12300
- C:\Windows\System\mFiTOwR.exe
  C:\Windows\System\mFiTOwR.exe
  2⤵
  PID:12420
- C:\Windows\System\Ntaipfh.exe
  C:\Windows\System\Ntaipfh.exe
  2⤵
  PID:12972
- C:\Windows\System\ORBSJjN.exe
  C:\Windows\System\ORBSJjN.exe
  2⤵
  PID:13068
- C:\Windows\System\ckAqNOP.exe
  C:\Windows\System\ckAqNOP.exe
  2⤵
  PID:13324
- C:\Windows\System\cPYKKUs.exe
  C:\Windows\System\cPYKKUs.exe
  2⤵
  PID:13352
- C:\Windows\System\LvLElvW.exe
  C:\Windows\System\LvLElvW.exe
  2⤵
  PID:13376
- C:\Windows\System\lzpOdsc.exe
  C:\Windows\System\lzpOdsc.exe
  2⤵
  PID:13400
- C:\Windows\System\mSxyexM.exe
  C:\Windows\System\mSxyexM.exe
  2⤵
  PID:13420
- C:\Windows\System\rCYuvAp.exe
  C:\Windows\System\rCYuvAp.exe
  2⤵
  PID:13440
- C:\Windows\System\MXrVVpe.exe
  C:\Windows\System\MXrVVpe.exe
  2⤵
  PID:13472
- C:\Windows\System\XmtRyZM.exe
  C:\Windows\System\XmtRyZM.exe
  2⤵
  PID:13488
- C:\Windows\System\jBDbIEE.exe
  C:\Windows\System\jBDbIEE.exe
  2⤵
  PID:13512
- C:\Windows\System\IWIDivt.exe
  C:\Windows\System\IWIDivt.exe
  2⤵
  PID:13536
- C:\Windows\System\qTueldx.exe
  C:\Windows\System\qTueldx.exe
  2⤵
  PID:13560
- C:\Windows\System\zjHgrxV.exe
  C:\Windows\System\zjHgrxV.exe
  2⤵
  PID:13592
- C:\Windows\System\Jwormxf.exe
  C:\Windows\System\Jwormxf.exe
  2⤵
  PID:13612
- C:\Windows\System\XClZvyb.exe
  C:\Windows\System\XClZvyb.exe
  2⤵
  PID:13644
- C:\Windows\System\efITisL.exe
  C:\Windows\System\efITisL.exe
  2⤵
  PID:13668
- C:\Windows\System\dgDMiIs.exe
  C:\Windows\System\dgDMiIs.exe
  2⤵
  PID:13700
- C:\Windows\System\wGnZvkg.exe
  C:\Windows\System\wGnZvkg.exe
  2⤵
  PID:13736
- C:\Windows\System\ZdpyJTv.exe
  C:\Windows\System\ZdpyJTv.exe
  2⤵
  PID:13760
- C:\Windows\System\DXaOvRz.exe
  C:\Windows\System\DXaOvRz.exe
  2⤵
  PID:13780
- C:\Windows\System\qCkwifI.exe
  C:\Windows\System\qCkwifI.exe
  2⤵
  PID:13804
- C:\Windows\System\iysnXhq.exe
  C:\Windows\System\iysnXhq.exe
  2⤵
  PID:13832
- C:\Windows\System\HhWyzme.exe
  C:\Windows\System\HhWyzme.exe
  2⤵
  PID:13852
- C:\Windows\System\fJYyZdP.exe
  C:\Windows\System\fJYyZdP.exe
  2⤵
  PID:13876
- C:\Windows\System\RZtXoGT.exe
  C:\Windows\System\RZtXoGT.exe
  2⤵
  PID:13896
- C:\Windows\System\AEchWmm.exe
  C:\Windows\System\AEchWmm.exe
  2⤵
  PID:13920
- C:\Windows\System\cdQBaeY.exe
  C:\Windows\System\cdQBaeY.exe
  2⤵
  PID:13944
- C:\Windows\System\FaLRqAg.exe
  C:\Windows\System\FaLRqAg.exe
  2⤵
  PID:13972
- C:\Windows\System\YYIpdTm.exe
  C:\Windows\System\YYIpdTm.exe
  2⤵
  PID:13992
- C:\Windows\System\UTgKOQh.exe
  C:\Windows\System\UTgKOQh.exe
  2⤵
  PID:14028
- C:\Windows\System\qFDdyfB.exe
  C:\Windows\System\qFDdyfB.exe
  2⤵
  PID:14056
- C:\Windows\System\vbOyQXk.exe
  C:\Windows\System\vbOyQXk.exe
  2⤵
  PID:14080
- C:\Windows\System\SuoIwRj.exe
  C:\Windows\System\SuoIwRj.exe
  2⤵
  PID:14108
- C:\Windows\System\RYpmZnK.exe
  C:\Windows\System\RYpmZnK.exe
  2⤵
  PID:14136
- C:\Windows\System\qqpnDRZ.exe
  C:\Windows\System\qqpnDRZ.exe
  2⤵
  PID:14152
- C:\Windows\System\mGKIOPs.exe
  C:\Windows\System\mGKIOPs.exe
  2⤵
  PID:14172
- C:\Windows\System\WSKErpt.exe
  C:\Windows\System\WSKErpt.exe
  2⤵
  PID:14192
- C:\Windows\System\xeauhjh.exe
  C:\Windows\System\xeauhjh.exe
  2⤵
  PID:14212
- C:\Windows\System\lnXjOwZ.exe
  C:\Windows\System\lnXjOwZ.exe
  2⤵
  PID:14244
- C:\Windows\System\uAVqgIv.exe
  C:\Windows\System\uAVqgIv.exe
  2⤵
  PID:14268
- C:\Windows\System\nNCemEv.exe
  C:\Windows\System\nNCemEv.exe
  2⤵
  PID:14292
- C:\Windows\System\XetKNdY.exe
  C:\Windows\System\XetKNdY.exe
  2⤵
  PID:14328
- C:\Windows\System\KaTFvvx.exe
  C:\Windows\System\KaTFvvx.exe
  2⤵
  PID:13148
- C:\Windows\System\eenlxlX.exe
  C:\Windows\System\eenlxlX.exe
  2⤵
  PID:13212
- C:\Windows\System\rXoBrzG.exe
  C:\Windows\System\rXoBrzG.exe
  2⤵
  PID:12756
- C:\Windows\System\YfVPxPK.exe
  C:\Windows\System\YfVPxPK.exe
  2⤵
  PID:12304
- C:\Windows\System\jaJjnEP.exe
  C:\Windows\System\jaJjnEP.exe
  2⤵
  PID:12856
- C:\Windows\System\IvNhYMd.exe
  C:\Windows\System\IvNhYMd.exe
  2⤵
  PID:12888
- C:\Windows\System\PoHLGiM.exe
  C:\Windows\System\PoHLGiM.exe
  2⤵
  PID:12348
- C:\Windows\System\ORgQwuu.exe
  C:\Windows\System\ORgQwuu.exe
  2⤵
  PID:12496
- C:\Windows\System\vDTfiNG.exe
  C:\Windows\System\vDTfiNG.exe
  2⤵
  PID:12548
- C:\Windows\System\wWmxNss.exe
  C:\Windows\System\wWmxNss.exe
  2⤵
  PID:11408
- C:\Windows\System\dNoJZSI.exe
  C:\Windows\System\dNoJZSI.exe
  2⤵
  PID:13108
- C:\Windows\System\GbXZKLy.exe
  C:\Windows\System\GbXZKLy.exe
  2⤵
  PID:13396
- C:\Windows\System\FqyeXLT.exe
  C:\Windows\System\FqyeXLT.exe
  2⤵
  PID:13484
- C:\Windows\System\GmEXwes.exe
  C:\Windows\System\GmEXwes.exe
  2⤵
  PID:12804
- C:\Windows\System\HiEzGIl.exe
  C:\Windows\System\HiEzGIl.exe
  2⤵
  PID:13608
- C:\Windows\System\VbLwXDY.exe
  C:\Windows\System\VbLwXDY.exe
  2⤵
  PID:12100
- C:\Windows\System\mTUFfNe.exe
  C:\Windows\System\mTUFfNe.exe
  2⤵
  PID:13664
- C:\Windows\System\OaAoKDw.exe
  C:\Windows\System\OaAoKDw.exe
  2⤵
  PID:11284
- C:\Windows\System\cTyuZPK.exe
  C:\Windows\System\cTyuZPK.exe
  2⤵
  PID:13776
- C:\Windows\System\GLhZqWE.exe
  C:\Windows\System\GLhZqWE.exe
  2⤵
  PID:13816
- C:\Windows\System\NMiIUbE.exe
  C:\Windows\System\NMiIUbE.exe
  2⤵
  PID:13036
- C:\Windows\System\iXhTTZC.exe
  C:\Windows\System\iXhTTZC.exe
  2⤵
  PID:13060
- C:\Windows\System\HlLaXhv.exe
  C:\Windows\System\HlLaXhv.exe
  2⤵
  PID:13164
- C:\Windows\System\LauDiiI.exe
  C:\Windows\System\LauDiiI.exe
  2⤵
  PID:14024
- C:\Windows\System\YXnjGAd.exe
  C:\Windows\System\YXnjGAd.exe
  2⤵
  PID:13192
- C:\Windows\System\iXGrkih.exe
  C:\Windows\System\iXGrkih.exe
  2⤵
  PID:14148
- C:\Windows\System\oZqJMiD.exe
  C:\Windows\System\oZqJMiD.exe
  2⤵
  PID:14352
- C:\Windows\System\sBhiCZU.exe
  C:\Windows\System\sBhiCZU.exe
  2⤵
  PID:14380
- C:\Windows\System\gjKZNaY.exe
  C:\Windows\System\gjKZNaY.exe
  2⤵
  PID:14412
- C:\Windows\System\oyYusJt.exe
  C:\Windows\System\oyYusJt.exe
  2⤵
  PID:14436
- C:\Windows\System\ZrXnKGM.exe
  C:\Windows\System\ZrXnKGM.exe
  2⤵
  PID:14456
- C:\Windows\System\UKTPyRe.exe
  C:\Windows\System\UKTPyRe.exe
  2⤵
  PID:14488
- C:\Windows\System\bJzdeYL.exe
  C:\Windows\System\bJzdeYL.exe
  2⤵
  PID:14508
- C:\Windows\System\pZldGBi.exe
  C:\Windows\System\pZldGBi.exe
  2⤵
  PID:14528
- C:\Windows\System\gedjvqK.exe
  C:\Windows\System\gedjvqK.exe
  2⤵
  PID:14560
- C:\Windows\System\bHLuNIo.exe
  C:\Windows\System\bHLuNIo.exe
  2⤵
  PID:14580
- C:\Windows\System\MwJPaww.exe
  C:\Windows\System\MwJPaww.exe
  2⤵
  PID:14604
- C:\Windows\System\vThkqks.exe
  C:\Windows\System\vThkqks.exe
  2⤵
  PID:14628
- C:\Windows\System\QHRUYtY.exe
  C:\Windows\System\QHRUYtY.exe
  2⤵
  PID:14652
- C:\Windows\System\cRfdDaX.exe
  C:\Windows\System\cRfdDaX.exe
  2⤵
  PID:14676
- C:\Windows\System\WuQqmYc.exe
  C:\Windows\System\WuQqmYc.exe
  2⤵
  PID:14712
- C:\Windows\System\lOhCOEO.exe
  C:\Windows\System\lOhCOEO.exe
  2⤵
  PID:14732
- C:\Windows\System\OJEUMSo.exe
  C:\Windows\System\OJEUMSo.exe
  2⤵
  PID:14752
- C:\Windows\System\UeWSdzG.exe
  C:\Windows\System\UeWSdzG.exe
  2⤵
  PID:14776
- C:\Windows\System\crfYZGm.exe
  C:\Windows\System\crfYZGm.exe
  2⤵
  PID:14804
- C:\Windows\System\vTvyzFX.exe
  C:\Windows\System\vTvyzFX.exe
  2⤵
  PID:14824
- C:\Windows\System\FXdZCvD.exe
  C:\Windows\System\FXdZCvD.exe
  2⤵
  PID:14852
- C:\Windows\System\UmXoqpU.exe
  C:\Windows\System\UmXoqpU.exe
  2⤵
  PID:14880
- C:\Windows\System\IsmVOzc.exe
  C:\Windows\System\IsmVOzc.exe
  2⤵
  PID:14896
- C:\Windows\System\HUEOVhp.exe
  C:\Windows\System\HUEOVhp.exe
  2⤵
  PID:14916
- C:\Windows\System\rwueiOu.exe
  C:\Windows\System\rwueiOu.exe
  2⤵
  PID:14932
- C:\Windows\System\RYxIOpd.exe
  C:\Windows\System\RYxIOpd.exe
  2⤵
  PID:14960
- C:\Windows\System\jwNRjzr.exe
  C:\Windows\System\jwNRjzr.exe
  2⤵
  PID:14984
- C:\Windows\System\NjCPbAK.exe
  C:\Windows\System\NjCPbAK.exe
  2⤵
  PID:15012
- C:\Windows\System\dmgCcLk.exe
  C:\Windows\System\dmgCcLk.exe
  2⤵
  PID:15036
- C:\Windows\System\rrrDHFR.exe
  C:\Windows\System\rrrDHFR.exe
  2⤵
  PID:15060
- C:\Windows\System\gDDGzhS.exe
  C:\Windows\System\gDDGzhS.exe
  2⤵
  PID:15088
- C:\Windows\System\BDVbhoI.exe
  C:\Windows\System\BDVbhoI.exe
  2⤵
  PID:15116
- C:\Windows\System\lnEHTqh.exe
  C:\Windows\System\lnEHTqh.exe
  2⤵
  PID:15136
- C:\Windows\System\sXEzKTT.exe
  C:\Windows\System\sXEzKTT.exe
  2⤵
  PID:15168
- C:\Windows\System\dZFGRIl.exe
  C:\Windows\System\dZFGRIl.exe
  2⤵
  PID:15192
- C:\Windows\System\peFJfuW.exe
  C:\Windows\System\peFJfuW.exe
  2⤵
  PID:15212
- C:\Windows\System\MsFjPos.exe
  C:\Windows\System\MsFjPos.exe
  2⤵
  PID:15236
- C:\Windows\System\pvQMmvp.exe
  C:\Windows\System\pvQMmvp.exe
  2⤵
  PID:15268
- C:\Windows\System\yQPkRKV.exe
  C:\Windows\System\yQPkRKV.exe
  2⤵
  PID:15308
- C:\Windows\System\qjQxgxr.exe
  C:\Windows\System\qjQxgxr.exe
  2⤵
  PID:15340
- C:\Windows\System\SySiTRs.exe
  C:\Windows\System\SySiTRs.exe
  2⤵
  PID:13528
- C:\Windows\System\BqMVXLG.exe
  C:\Windows\System\BqMVXLG.exe
  2⤵
  PID:14264
- C:\Windows\System\FcPegrX.exe
  C:\Windows\System\FcPegrX.exe
  2⤵
  PID:11336
- C:\Windows\System\iFPTGQw.exe
  C:\Windows\System\iFPTGQw.exe
  2⤵
  PID:14552
- C:\Windows\System\MezdSYU.exe
  C:\Windows\System\MezdSYU.exe
  2⤵
  PID:12836
- C:\Windows\System\ZeJIJWe.exe
  C:\Windows\System\ZeJIJWe.exe
  2⤵
  PID:14612
- C:\Windows\System\jJJtPzb.exe
  C:\Windows\System\jJJtPzb.exe
  2⤵
  PID:12520
- C:\Windows\System\uDutCVE.exe
  C:\Windows\System\uDutCVE.exe
  2⤵
  PID:13288
- C:\Windows\System\xWtSRDn.exe
  C:\Windows\System\xWtSRDn.exe
  2⤵
  PID:11956
- C:\Windows\System\ErOeIhw.exe
  C:\Windows\System\ErOeIhw.exe
  2⤵
  PID:13980
- C:\Windows\System\WZXkdhI.exe
  C:\Windows\System\WZXkdhI.exe
  2⤵
  PID:14892
- C:\Windows\System\ZoaXSIc.exe
  C:\Windows\System\ZoaXSIc.exe
  2⤵
  PID:14068
- C:\Windows\System\vgEdYUN.exe
  C:\Windows\System\vgEdYUN.exe
  2⤵
  PID:12208
- C:\Windows\System\vUUtGuN.exe
  C:\Windows\System\vUUtGuN.exe
  2⤵
  PID:15536
- C:\Windows\System\rkTWNdQ.exe
  C:\Windows\System\rkTWNdQ.exe
  2⤵
  PID:15608
- C:\Windows\System\awqmAJU.exe
  C:\Windows\System\awqmAJU.exe
  2⤵
  PID:15628
- C:\Windows\System\SnYldTS.exe
  C:\Windows\System\SnYldTS.exe
  2⤵
  PID:15644
- C:\Windows\System\RgcdNgX.exe
  C:\Windows\System\RgcdNgX.exe
  2⤵
  PID:15664
- C:\Windows\System\PHuaICx.exe
  C:\Windows\System\PHuaICx.exe
  2⤵
  PID:15684
- C:\Windows\System\FdHSshm.exe
  C:\Windows\System\FdHSshm.exe
  2⤵
  PID:15700
- C:\Windows\System\UkBlhzL.exe
  C:\Windows\System\UkBlhzL.exe
  2⤵
  PID:15716
- C:\Windows\System\RvYcgKY.exe
  C:\Windows\System\RvYcgKY.exe
  2⤵
  PID:15732
- C:\Windows\System\MAEBCGr.exe
  C:\Windows\System\MAEBCGr.exe
  2⤵
  PID:15748
- C:\Windows\System\thwOLOq.exe
  C:\Windows\System\thwOLOq.exe
  2⤵
  PID:15800
- C:\Windows\System\vgtCJaJ.exe
  C:\Windows\System\vgtCJaJ.exe
  2⤵
  PID:15816
- C:\Windows\System\swgUYEs.exe
  C:\Windows\System\swgUYEs.exe
  2⤵
  PID:15844
- C:\Windows\System\TOILpwQ.exe
  C:\Windows\System\TOILpwQ.exe
  2⤵
  PID:15872
- C:\Windows\System\xxrkroc.exe
  C:\Windows\System\xxrkroc.exe
  2⤵
  PID:15936
- C:\Windows\System\lHijAgS.exe
  C:\Windows\System\lHijAgS.exe
  2⤵
  PID:15956
- C:\Windows\System\PekYBeN.exe
  C:\Windows\System\PekYBeN.exe
  2⤵
  PID:15972
- C:\Windows\System\cYPBtPe.exe
  C:\Windows\System\cYPBtPe.exe
  2⤵
  PID:15992
- C:\Windows\System\yKAXQuk.exe
  C:\Windows\System\yKAXQuk.exe
  2⤵
  PID:16024
- C:\Windows\System\yOCTONT.exe
  C:\Windows\System\yOCTONT.exe
  2⤵
  PID:16056
- C:\Windows\System\rzJDbdI.exe
  C:\Windows\System\rzJDbdI.exe
  2⤵
  PID:16080
- C:\Windows\System\AStsZbk.exe
  C:\Windows\System\AStsZbk.exe
  2⤵
  PID:16112
- C:\Windows\System\pjQmsrE.exe
  C:\Windows\System\pjQmsrE.exe
  2⤵
  PID:16144
- C:\Windows\System\vFDHGvz.exe
  C:\Windows\System\vFDHGvz.exe
  2⤵
  PID:16164
- C:\Windows\System\XskNhEZ.exe
  C:\Windows\System\XskNhEZ.exe
  2⤵
  PID:16192
- C:\Windows\System\VgamDfA.exe
  C:\Windows\System\VgamDfA.exe
  2⤵
  PID:16220
- C:\Windows\System\PQRiLwf.exe
  C:\Windows\System\PQRiLwf.exe
  2⤵
  PID:16240
- C:\Windows\System\fgHSKfZ.exe
  C:\Windows\System\fgHSKfZ.exe
  2⤵
  PID:16272
- C:\Windows\System\bwaEdpK.exe
  C:\Windows\System\bwaEdpK.exe
  2⤵
  PID:16308
- C:\Windows\System\IsJCEic.exe
  C:\Windows\System\IsJCEic.exe
  2⤵
  PID:16344
- C:\Windows\System\wSBNwow.exe
  C:\Windows\System\wSBNwow.exe
  2⤵
  PID:16380
- C:\Windows\System\MyFfgpJ.exe
  C:\Windows\System\MyFfgpJ.exe
  2⤵
  PID:12572
- C:\Windows\System\wDuyjjB.exe
  C:\Windows\System\wDuyjjB.exe
  2⤵
  PID:14740
- C:\Windows\System\ukSLiXU.exe
  C:\Windows\System\ukSLiXU.exe
  2⤵
  PID:13656
- C:\Windows\System\piICWnR.exe
  C:\Windows\System\piICWnR.exe
  2⤵
  PID:10672
- C:\Windows\System\shzwSLn.exe
  C:\Windows\System\shzwSLn.exe
  2⤵
  PID:11420
- C:\Windows\System\TYHLksc.exe
  C:\Windows\System\TYHLksc.exe
  2⤵
  PID:12988
- C:\Windows\System\qGvkFWD.exe
  C:\Windows\System\qGvkFWD.exe
  2⤵
  PID:15024
- C:\Windows\System\AQgXZTV.exe
  C:\Windows\System\AQgXZTV.exe
  2⤵
  PID:15112
- C:\Windows\System\IIYftqz.exe
  C:\Windows\System\IIYftqz.exe
  2⤵
  PID:14376
- C:\Windows\System\IJJQlPV.exe
  C:\Windows\System\IJJQlPV.exe
  2⤵
  PID:14464
- C:\Windows\System\fcvYTJE.exe
  C:\Windows\System\fcvYTJE.exe
  2⤵
  PID:14504
- C:\Windows\System\PmoiKeL.exe
  C:\Windows\System\PmoiKeL.exe
  2⤵
  PID:14320
- C:\Windows\System\ZkIpOuu.exe
  C:\Windows\System\ZkIpOuu.exe
  2⤵
  PID:15376
- C:\Windows\System\cQrGyxy.exe
  C:\Windows\System\cQrGyxy.exe
  2⤵
  PID:14708
- C:\Windows\System\ctEoRoq.exe
  C:\Windows\System\ctEoRoq.exe
  2⤵
  PID:14908
- C:\Windows\System\ZqrKNWC.exe
  C:\Windows\System\ZqrKNWC.exe
  2⤵
  PID:15068
- C:\Windows\System\EtYIxMT.exe
  C:\Windows\System\EtYIxMT.exe
  2⤵
  PID:15284
- C:\Windows\System\GKTffsA.exe
  C:\Windows\System\GKTffsA.exe
  2⤵
  PID:14188
- C:\Windows\System\QegZulJ.exe
  C:\Windows\System\QegZulJ.exe
  2⤵
  PID:14944
- C:\Windows\System\CHltlad.exe
  C:\Windows\System\CHltlad.exe
  2⤵
  PID:15128
- C:\Windows\System\TCdlaGJ.exe
  C:\Windows\System\TCdlaGJ.exe
  2⤵
  PID:15652
- C:\Windows\System\EyccUCb.exe
  C:\Windows\System\EyccUCb.exe
  2⤵
  PID:15392
- C:\Windows\System\vdRhauy.exe
  C:\Windows\System\vdRhauy.exe
  2⤵
  PID:14232
- C:\Windows\System\MYDleOy.exe
  C:\Windows\System\MYDleOy.exe
  2⤵
  PID:10088
- C:\Windows\System\BXzhwOu.exe
  C:\Windows\System\BXzhwOu.exe
  2⤵
  PID:15468
- C:\Windows\System\cGSkbro.exe
  C:\Windows\System\cGSkbro.exe
  2⤵
  PID:14592
- C:\Windows\System\ITKVPIj.exe
  C:\Windows\System\ITKVPIj.exe
  2⤵
  PID:13916
- C:\Windows\System\biRFHEG.exe
  C:\Windows\System\biRFHEG.exe
  2⤵
  PID:13828
- C:\Windows\System\zbdJkYu.exe
  C:\Windows\System\zbdJkYu.exe
  2⤵
  PID:15640
- C:\Windows\System\AarAuSL.exe
  C:\Windows\System\AarAuSL.exe
  2⤵
  PID:16012
- C:\Windows\System\OzUtZcE.exe
  C:\Windows\System\OzUtZcE.exe
  2⤵
  PID:16140
- C:\Windows\System\ZzXoDcd.exe
  C:\Windows\System\ZzXoDcd.exe
  2⤵
  PID:16304
- C:\Windows\System\yJQufIw.exe
  C:\Windows\System\yJQufIw.exe
  2⤵
  PID:13556
- C:\Windows\System\ccldqpM.exe
  C:\Windows\System\ccldqpM.exe
  2⤵
  PID:15484
- C:\Windows\System\CyYwhUO.exe
  C:\Windows\System\CyYwhUO.exe
  2⤵
  PID:12864
- C:\Windows\System\ddVIDvP.exe
  C:\Windows\System\ddVIDvP.exe
  2⤵
  PID:15576
- C:\Windows\System\JQEDRxH.exe
  C:\Windows\System\JQEDRxH.exe
  2⤵
  PID:16396
- C:\Windows\System\tRVvDED.exe
  C:\Windows\System\tRVvDED.exe
  2⤵
  PID:16416
- C:\Windows\System\FIafwTE.exe
  C:\Windows\System\FIafwTE.exe
  2⤵
  PID:16440
- C:\Windows\System\BAWaYHX.exe
  C:\Windows\System\BAWaYHX.exe
  2⤵
  PID:16592
- C:\Windows\System\gyHvIed.exe
  C:\Windows\System\gyHvIed.exe
  2⤵
  PID:16620
- C:\Windows\System\yGuoLHK.exe
  C:\Windows\System\yGuoLHK.exe
  2⤵
  PID:16636
- C:\Windows\System\tyXCRGd.exe
  C:\Windows\System\tyXCRGd.exe
  2⤵
  PID:16652
- C:\Windows\System\DNfZcGC.exe
  C:\Windows\System\DNfZcGC.exe
  2⤵
  PID:16668
- C:\Windows\System\QLOwShQ.exe
  C:\Windows\System\QLOwShQ.exe
  2⤵
  PID:16684
- C:\Windows\System\pQJIyxE.exe
  C:\Windows\System\pQJIyxE.exe
  2⤵
  PID:16712
- C:\Windows\System\uHjxuDv.exe
  C:\Windows\System\uHjxuDv.exe
  2⤵
  PID:16728
- C:\Windows\System\XJQbciP.exe
  C:\Windows\System\XJQbciP.exe
  2⤵
  PID:16752
- C:\Windows\System\pONkWbW.exe
  C:\Windows\System\pONkWbW.exe
  2⤵
  PID:16780
- C:\Windows\System\OkJUJtH.exe
  C:\Windows\System\OkJUJtH.exe
  2⤵
  PID:16812
- C:\Windows\System\CVinQcQ.exe
  C:\Windows\System\CVinQcQ.exe
  2⤵
  PID:16836
- C:\Windows\System\olLlDjZ.exe
  C:\Windows\System\olLlDjZ.exe
  2⤵
  PID:16868
- C:\Windows\System\NmkkNHF.exe
  C:\Windows\System\NmkkNHF.exe
  2⤵
  PID:16892
- C:\Windows\System\wXJdEpJ.exe
  C:\Windows\System\wXJdEpJ.exe
  2⤵
  PID:16912
- C:\Windows\System\nNppWeh.exe
  C:\Windows\System\nNppWeh.exe
  2⤵
  PID:16940
- C:\Windows\System\UYNpakN.exe
  C:\Windows\System\UYNpakN.exe
  2⤵
  PID:16960
- C:\Windows\System\dZRVKhM.exe
  C:\Windows\System\dZRVKhM.exe
  2⤵
  PID:16980
- C:\Windows\System\UVNhbvA.exe
  C:\Windows\System\UVNhbvA.exe
  2⤵
  PID:15424
- C:\Windows\System\MbdNDKt.exe
  C:\Windows\System\MbdNDKt.exe
  2⤵
  PID:15880
- C:\Windows\System\jgIZZEG.exe
  C:\Windows\System\jgIZZEG.exe
  2⤵
  PID:16296
- C:\Windows\System\hbvCqWp.exe
  C:\Windows\System\hbvCqWp.exe
  2⤵
  PID:12452
- C:\Windows\System\fepHABW.exe
  C:\Windows\System\fepHABW.exe
  2⤵
  PID:16600
- C:\Windows\System\PLqbwvk.exe
  C:\Windows\System\PLqbwvk.exe
  2⤵
  PID:15184
- C:\Windows\System\HdgFlBM.exe
  C:\Windows\System\HdgFlBM.exe
  2⤵
  PID:16876
- C:\Windows\System\PRNwMQo.exe
  C:\Windows\System\PRNwMQo.exe
  2⤵
  PID:16928
- C:\Windows\System\qaocOTP.exe
  C:\Windows\System\qaocOTP.exe
  2⤵
  PID:17032
- C:\Windows\System\JkQewdx.exe
  C:\Windows\System\JkQewdx.exe
  2⤵
  PID:16052
- C:\Windows\System\OKRVrNS.exe
  C:\Windows\System\OKRVrNS.exe
  2⤵
  PID:16680
- C:\Windows\System\BaTgxTb.exe
  C:\Windows\System\BaTgxTb.exe
  2⤵
  PID:16724

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:16992

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\BBuCvNf.exe

Filesize
1.3MB

MD5
ef9293cad5a677a5b9926e7cbbac78c8

SHA1
743fd8d7fd4ceea2d93ae2eb1c99bc0828c71f47

SHA256
84a837f888d80c31c95d4540156a183adc617370e6204b5239cd663c7f3faf45

SHA512
5161876d7fbe90afaec14a34494f257654bed56eb291a10c9bed04fc92be5f92a068381d466a3bba5390b18cd3ec6e95aee8b670d1bdef12c662533e298c20f6

Download Submit
C:\Windows\System\CMjcVwc.exe

Filesize
1.3MB

MD5
cdca8f1d02dcc72c1a49eb57e110e7ea

SHA1
fc2b9f5524a93d29147f3fedcb2f800f14765bce

SHA256
1cfaac7c3983fced9e2ee9b656177eb4fea65553fd1db0430fedf7a0f92acaa5

SHA512
2f22f5fc9fdfe2d07f9e7a0c2c0e070c69f95554d88f7bf1014cd014ce37124c48d59c293e1657b23cb0fed3e60a0641f2abc33ada3ec4fa8751e514b9f4aa06

Download Submit
C:\Windows\System\DQayHnH.exe

Filesize
1.3MB

MD5
6a5a3701a021f834dc091adf58d9c666

SHA1
c5c7e72dec5ac2feff5143dd42ef67adb0180c3a

SHA256
e788fe8ad4469a0757e38a2de44958f3aa93ea050b599822a26abe2e594eac49

SHA512
c72df676a9edf3db9721b1416dd1c45d2479b39f816ded0334cf83c79562cb5902b8e5c8156856994bb089804b428b10b877cdc788c329204efbb2d7cb7955b4

Download Submit
C:\Windows\System\DpsmvpC.exe

Filesize
1.3MB

MD5
78c46bd3aae544ae588a26de195cbfa3

SHA1
7a7c1ba0756bf08bdc1cb19529008bb8c4fb4377

SHA256
cd60caf34da37a4a04b0b38b4fb4ba7d05d62be73bf2cf73ca39f20bafe65129

SHA512
96393473a419981465ce1f51826fb7e17e680968b9b0da469e43a2f10d287254a992fcca71933b65a3b74c38c9e58a55ea994a1ee9cf639098c6612d70e3cb6f

Download Submit
C:\Windows\System\FOTjsOY.exe

Filesize
1.3MB

MD5
a5b1a8d6b31503391e3ed65967c918f7

SHA1
5c0b1ccae108e27cd3850272cda5ae5d3973b83f

SHA256
9828b8b1ba1106ab3107d5593c0d0fce46527061e2e5c9f6901a4c5ee24a3b3c

SHA512
efbcc3063e4d444c53cd33e46f859c89f7371e540ede77fa712253a543030cb902ad55b625cac389711745c863fa01dbe71251e268e177d1253d99c68e7c0343

Download Submit
C:\Windows\System\FTFfrER.exe

Filesize
1.3MB

MD5
5e8da935ef3d3b7357163a2944ac4d83

SHA1
9b9ee5838e4ce388af30be6f6050ffba8cf0e00c

SHA256
c48cdbeb6ffc76f15c25fc6626ddf2843aa7c04301e02db1628405dd76b13d20

SHA512
829e6fbf40951c0ad606380655ee6d957e208d9f6663fa584214bbed8842b88bdf08de042209afd478a6861e9b1a4250f9c2ebc04d4f350de74e1d12fb1f7ae5

Download Submit
C:\Windows\System\GBAsZIp.exe

Filesize
1.3MB

MD5
fc42e09bc53397c633f48735723f5be6

SHA1
8f909ca90d9809532f61c769033f928b04b67997

SHA256
8ac618360af4d4c19b6b621040a3844b677f6ed0dad6aa41b33b61337c4344e7

SHA512
6d35b485e6f5a6c687ddd11c160d5d8aa7b361ea4c6d1d7e9f51b294ac5d216ca3c6e8dd7b3600b35290c518991b0413bbe493dada8acd6dbdd1a3e5e138bc00

Download Submit
C:\Windows\System\JlXDzOg.exe

Filesize
1.3MB

MD5
29e3944cd2b34d1c26a8971125216a39

SHA1
6efc914d5cee4b12775ba9f191f8975b8cad8587

SHA256
cfe9a4f1b05bc9a53fc7cfff1f32f5b1fce3b21eccb07603f86755b19f276e76

SHA512
b3ec345b40c763c40b6f4d12ef4f5e76bc6b8093b04214e0718728bb63eadf4e81ad045ec2a6e5dfb08a0c6d1605dbd519d3561c2909d7f01cdf62b1ae2f0af6

Download Submit
C:\Windows\System\OROsvvC.exe

Filesize
1.3MB

MD5
468e2971858d69ce033582788e869b05

SHA1
5bae3569cab039e7f9aa4f136aa95b3b30f02dd1

SHA256
4ade008ae1d1e808d35cf7b54c693a07f786ea4fe801b871b5b741dc1693f0f2

SHA512
a7cc729881b92f464e19e0b8fc30a97adda14e00688c8793dadf4f862d34e43618721fd7074f519091c53bd84720749d06b16066211a2a57847e36a92aefd5e9

Download Submit
C:\Windows\System\PvKpRrn.exe

Filesize
1.3MB

MD5
2db8df4517683e3ab3be3147e96b940b

SHA1
c0ddf742511034e9f76ea7da43fc08e54f21e836

SHA256
4de0489e03fb272aeba7f74d33efc1d095143fbd22287c525bf0c7f4189d3a1e

SHA512
052a0e10860eaa4ad0d074a5227b0a9aff6d28673f43fbf39d34884edd4774fc3c7a462a238ffd36ab03f6e05b9289724c0ffe72960f97fbaf3cc7066f0a7f9d

Download Submit
C:\Windows\System\QDQzyjD.exe

Filesize
1.3MB

MD5
d6ced2264bc6c9cf9f92949f257907ac

SHA1
08afa85b0a71d7c84302ff261b36ffdee771b884

SHA256
487b69d3a9236a3a0c86e072ca8856fb553c7676b3b388030599b0e8263bb133

SHA512
8598f0f81142b15bac620ff1c399e26d3c817c0472ba1d33af9722c838f35675bd41c40bf5c4cab7b54351cd796453bc97b8d430f4fb925a94c7253135840109

Download Submit
C:\Windows\System\SWxTrwo.exe

Filesize
1.3MB

MD5
ff2a8c4ce1effda9846f4316a57d279f

SHA1
7b5ee7b04b5d1e3d16c64427a6a2c7456f9795a6

SHA256
89fac08caf5addbdc9df2179a2ae18e66d4dbbd9b3de70b15bfe14ae815a2c26

SHA512
6f9d14148eac33f8990fd9458a8cd06512c518f86f746ac3050ee1db761d174770bce9e8c6cd40cdf8ca1a534d3bc69c5ecae144b2474e5057bf119c3e58c44f

Download Submit
C:\Windows\System\SYQhUMn.exe

Filesize
1.3MB

MD5
e521f86fb92af9816d4d5ec0286e2df5

SHA1
0355c5c1c99544059c4da387e05b66cc1593c805

SHA256
ce5a1b036e94b8164507325d232ef1382ffd3f47e306756ca0bad9503cbb0043

SHA512
f55f6ba139af7bab94995ed841ec92efb1efa13bcaf8df60bc40fb4450e4d5ce90e6e79832d579d5a310ac2ea426e52e3055edc198d3ae888e0752322dd8667f

Download Submit
C:\Windows\System\SzcPZkK.exe

Filesize
1.3MB

MD5
fbe18726ec9eea8d4cbd40e4e8bdf662

SHA1
cf3e50631eb8c9579a9555cf9c62d93e4e506aaf

SHA256
67888b5310253a411c2d7f720518dc555d498eca73cc2d5911397ee465fa9961

SHA512
e2fdf95223e4d6d5771a9e11bcacf3482058e9c51044ace202394759bfe3409ac560c986b4a39ac829a12b0d3cf76b71eb16f719f5b983e1741a46ae8aab2449

Download Submit
C:\Windows\System\TLxMWpz.exe

Filesize
1.3MB

MD5
85b523229f952d547fb596a49af3d116

SHA1
edd61ff80b2b83ca94c5a1dda2341917ad85c377

SHA256
6d39729ac598afbc83f138599616bc1e329b1a4e18611050f5ba45fe7151bf57

SHA512
20fcc393f21e593f2690b74be07ed9ddcfa8559f38614d7e094b332a0b810e9abdb2621e89e696e9e56bbf910039ded3da72a77548f7c57286c36562ff02a39c

Download Submit
C:\Windows\System\TkzuDgG.exe

Filesize
1.3MB

MD5
d26a145e3dce8957e5693eea6290e596

SHA1
a9540f6e0455c37f1ce592b55a14f647a0fe6f1d

SHA256
49fe130328632460780581443012ccc5ed20fc127ca7600cefcc603a9f27314a

SHA512
2cbe28d946c3b4c441dc438b675e5fe4b27aeb17bdac20864a4e27ee1f117268a6d22ec1ad8cc5be770a35ce0aab4766bdabcce3872da7db2cd2c9626aec2b0e

Download Submit
C:\Windows\System\WVyvvft.exe

Filesize
1.3MB

MD5
39276a227e093709d38fce461c503f40

SHA1
8f2f0e713b7ec657b62869aba154686969e58d56

SHA256
3f7e4eb6fafaf856feb1d2a0071f6136ad86db73f477852c48a377127413a3dd

SHA512
4845bb09b7162cdf7df1cbc174954598e935b46c4bd949cf1c0139b25cfc2e28f2c2b023e542995024d1d8cbfb88cb5bf42e74a4ee122f24506819de8e568a9d

Download Submit
C:\Windows\System\XlyBuPF.exe

Filesize
1.3MB

MD5
2be5bc21870675b675cfd8e00c632a41

SHA1
fcf679abc4b13c9e10629887a9e3c96155f23285

SHA256
e7d42c1450318c0a5bb90be158c213fe50ac158c2aef8e7e1015b13336fa51ac

SHA512
2f18bbffa1d8e7c71c976b65394f646ec91ab67b6e69b7473991b306a25078755a249a5570393b7296384f829da0c85901899838f51fac858a0251ef5a704920

Download Submit
C:\Windows\System\XoFPKmY.exe

Filesize
1.3MB

MD5
3f4e406a5f56f70aee998a69490aaeab

SHA1
1be5b784e1a07c8b3970edb6068d05dd3f237f03

SHA256
ddf63a42f1f0e75edd9e75bb27f395247370e957ae6df3ac832a8e42b5332150

SHA512
61a8c0114a813753237b238db4590687ec090bc456dd3a48a40690fb76be0f6bb54f4196ba161a5d372c0cb32f0eac238e69aa685b132091a4546120171ab02c

Download Submit
C:\Windows\System\YvGucdd.exe

Filesize
1.3MB

MD5
bebac438cdb21c9bf672ced6dc80325e

SHA1
51f41f5ee6fea94203d215a9b9786c5aec51911f

SHA256
88d439886b7f910b97102ade680900e827c9c66ceb84233a054fe39584e15d0e

SHA512
f4cd0ca8d3ad78251e9ab3058bc6fbdb2eebc47ba50766c06d7bb4072e3512db89d15845be4af42fe0174879ac7225fa7b5ec75e942cdc4009b76953a93f5ae8

Download Submit
C:\Windows\System\dflQuLG.exe

Filesize
1.3MB

MD5
2d083c48357c1b0f4db65798a3f8dda4

SHA1
b4cd0d97f078294e9472c0672c1131e712fb70fc

SHA256
d7ae9bae342fb70fc208e3336542312b7ce026af49631edc5b6296f545b69bb7

SHA512
940fd48b24eb32b62a356fb92eff185e0a32ac64417357db5bd30ecae3379d2002520c22157712a12f2429252e56af8371d0c91f6947b151023e89812dbcd0db

Download Submit
C:\Windows\System\dsJEgFl.exe

Filesize
1.3MB

MD5
263157aae0ff20f6101f65e58fa800fe

SHA1
ab92b2c6db4ef73eb075638cfb775490a60d2946

SHA256
c5d868fd265aaa4a60dae564b198343222c5277943cba4868feeda910fc16edb

SHA512
8516c5fb46c323d1634225bd3ec2fa03d00a693fa2e08f8f9ea597775592ce7044e4656ea6ab2e855dc9bd7507986d18c3e8540e23120421ac457bed2a806b6b

Download Submit
C:\Windows\System\fJJJKsu.exe

Filesize
1.3MB

MD5
c4f8b6c139e134c717d051dbd038adeb

SHA1
afa72bf627756747de473f29385e81343a2532af

SHA256
c4e6817e57f09d0a750fa94584306cc1a7926c446f6b53a31be2c3de85d04d36

SHA512
a2dbf927fb9a623284c406af675a7defbe8765ea02b2cbadac01e0a973fe85c68483f73f49ca6c5859a7647366c7d7751b78207759dc103baa9c53ae02800602

Download Submit
C:\Windows\System\jfSMIWv.exe

Filesize
1.3MB

MD5
436c22d2d818ad80f6cd3fdeea14e25c

SHA1
9d26e8d67d4d648d048fdc5b8bbfb969f2161f14

SHA256
32bb4ca2ce0931a1907eb8cb6ea9a42972260cb0af6785d31ba2594dcc6ca944

SHA512
7a05ccd2ba770b2b7737219459b6dab6ebea0ae142218d7869a357b986b57f1494714d8fef75d0caa7d2c5e2c247d9ff685763684b42a853ed913aefd8686f74

Download Submit
C:\Windows\System\jtKnbvU.exe

Filesize
1.3MB

MD5
9fdeef0d1b97ca6b03c78ca8d9f20c99

SHA1
4e4d262535ad2e53b56c7bc68b0f6b69ee14ee31

SHA256
addeea99b543a934ad1965cc2f2fdac62340fb6fec2a9c17ad58c66a6673e7b4

SHA512
c4e1376ae51f63a34ec78b64db3a43d23d9f4207139083153e8b583410b4b3f07d99074e8778c23e8727160bdb4e948dce0c770ecaf91712aa3a3a86c80a9813

Download Submit
C:\Windows\System\mFzNFuL.exe

Filesize
1.3MB

MD5
8fe9444a95810ec949d798a1bef90bdc

SHA1
174be2ad6eeb2e6db53277a1a46f598590975b18

SHA256
63f21add0428f929ccf007925128a7f218b6f4f996abc01dce7472b8c84e6cf7

SHA512
c6b8009528f0abbdd0a0fd062c090fd9ca6735e64094d8a463c9d1b62dde19755e205978b122281c62d546102f550e4720ed4d0991c920b1172658e3dca6f12a

Download Submit
C:\Windows\System\pYIvSfX.exe

Filesize
1.3MB

MD5
11b062383d024e09d30ee102642c0c5c

SHA1
c58f1adfc42d4aee96f2bce80fcae73303007519

SHA256
009f1a34a48390ca6b501012a57775f84e9ebf5732048da92a96f9f84f4f14ea

SHA512
0cea8d1820600a85488c60770ee8949cb1a6049fab0f6258f844afa0ea75bb2cb218da994c37d17faf5a90b388813eb4f2bbe2bae7b92d1521005a2a2192ba86

Download Submit
C:\Windows\System\rNovirm.exe

Filesize
1.3MB

MD5
ce3958edf7d8b91160e7e4d362785332

SHA1
aac2ae28fe2c8c40fda5f972e265460cc0a1fa05

SHA256
97d9c3e608e8c174197157c82c0ab5023cd00999412e088431135e5f1af9d0cb

SHA512
39cd68143cd55e025bcfc8033c8af9229f7272baf32a31de4da236955a09a322029fecf6adee66bcdac4560a45777a3abf82d124eb3c5a8c8c0bc3e05ab42948

Download Submit
C:\Windows\System\sAySpta.exe

Filesize
1.3MB

MD5
d9468fddb2144e9d9dad9a57193bb539

SHA1
103bc79820f8b06160650fedd7a273a9197e6f92

SHA256
ad29890889f1474dea91794fe939f224aba06092388b0c02bbe7a5d25aa6aad8

SHA512
10c055605903eb00d408daac90cea17f3a14a112a9dd11e3ae2bf3632565f4dcd2f6e2a6caf581c316229953caab419c1961832b7ead1a00080d5a8beaff84b9

Download Submit
C:\Windows\System\sleaIPh.exe

Filesize
1.3MB

MD5
ed3a85d0fc8ae7a36821021689417fec

SHA1
7418fd20089aef54218d8d8ee35a878051e4de6b

SHA256
4b8ec13c8ecd95352616b0fdd2f3585f8b6fe9c8d4b5ef002a8908376e4605ae

SHA512
31b16a8aa3bff1249845ec6bcc080d53a4750ab3074699431e892e4ddde58479454df87dcd12757034c0138cf3fa1da28fc6d10c03ad3c5a832cd1feded9c4c5

Download Submit
C:\Windows\System\tWHFRVH.exe

Filesize
1.3MB

MD5
0a9a14d7d2a14830b4be0f60f5abeb75

SHA1
dd929e57ee5557c355f4efc299855152a84e1e32

SHA256
f80134955093ac60c1b4b9a0d2eb01f0393e34bb367e67f0eb2581f284be4177

SHA512
7969116242ed38593ce67102e0c74200de0335849ead7fd4e9f5fa81ef283df44bae7fe5c5d31f766685cb259dad8226d2d0a42455897d2e5d2a97ad25a22b7d

Download Submit
C:\Windows\System\wnzXUmR.exe

Filesize
1.3MB

MD5
f3568ae65af318c7798a5af02adf61ba

SHA1
dab68b2f99683330b7007063283a73877aa566d3

SHA256
ab00b88d8f8661c3a73ac51536f867ee9d4955cf83bd17d7a92b60f072ca26c0

SHA512
4df6c71071773a99300b07119bc003f79c12cc2beb26820e9af725b4f7d8aca04f6ea3ef95bb38539b74bbe50e14d35add76ba7b1ca6dd565895cd18cda4ac9b

Download Submit
C:\Windows\System\yUqbkmx.exe

Filesize
1.3MB

MD5
641fb627d08b758f34e50312c1671bd5

SHA1
136112f5d01ba96db5b1685e012e9004e45d0d98

SHA256
5235361d647e5123513bd3e3ab5eae90c88a988e7f3452808625458cf0acbed1

SHA512
96cd4f9586582634aeb292f5ee4f928fc846033fe6a8bf701fea7a4d38aa66a93476e855a559109ad77618ab19f2ab840d5bb24510d0bfa9f4d6f48dcd1a5f40

Download Submit
C:\Windows\System\ydLfsda.exe

Filesize
1.3MB

MD5
ae6483adcd30ca3d2315d8bdbe70999a

SHA1
29b61831b7485b72d8a65d9d5096e3fa4f7f9497

SHA256
b5c9b18fa79bec13edb55d407ab5f8df37fb063fad67b7c9501f5e86857cb173

SHA512
dd5a81986d8cb761737fee821ea04e6f5563c76effa1d9e8ddead2aea9002004f4364a6f719e029d6d88e8297b5d2becec8e6dbd43b63b57a5cfda3b23b5e839

Download Submit
C:\Windows\System\ynCdpzt.exe

Filesize
1.3MB

MD5
a3b57b6d83450b84b87c25edefefe97c

SHA1
5f1e177b4356432ab290e04a8bb8dfe73090dc20

SHA256
d16ee55bbc09e64a792b381e02b5f45869d70f36fbc49a04adf4c01e94797411

SHA512
c6a7ccc648dfc0911bade0597e8587173c80bb755c6809983357048a3c2cfeb312bb79ae9a004db84efb7434a28fa0faefe4e29360ee3dadbb5d6c816cdaaadc

Download Submit
C:\Windows\System\zDDORbs.exe

Filesize
1.3MB

MD5
ab6f9c531a440507834c793d535ef136

SHA1
cc6731ae026b61974080bf6cc39ed9f8483b91ec

SHA256
d96907b09024508fdd71879b09f73f8914776b36abc86af214b535152f0d19a9

SHA512
ec2444c0f6d2a3661606b3aec1fd58311fef6d859f98e826a879c80f8db44df121a91fcb1ec548f68810af14f622e19f0d6ebb53d2549095d3c81ecf1f7e8842

Download Submit
memory/4912-0-0x000001329B4D0000-0x000001329B4E0000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads