xmrig | 3a4a65e8eb0161eda1a86e82da596da4114f44fbb4d3423b104de148ba806fbe

Analysis

max time kernel
114s
max time network
122s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
25-01-2025 21:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3a4a65e8eb0161eda1a86e82da596da4114f44fbb4d3423b104de148ba806fbe.exe
Size

1.5MB
MD5

0ca5b20de358e2dae61cbf5b4521fa5a
SHA1

fa8273a9fd591a52f07de018fd2a798866bb09c7
SHA256

3a4a65e8eb0161eda1a86e82da596da4114f44fbb4d3423b104de148ba806fbe
SHA512

199aa29fe2bcf19688682c1bbfd589bffe7c7a3f5bf5803f6302be0bbb189d6d71b9af1dca75f71e582169f0fae5c5e4ac873e7633a871dc6b7179717d5ca881
SSDEEP

24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbpwlKenszbWKDNEm/5p84neZKTbr:GezaTF8FcNkNdfE0pZ9ozttwIRxA1Mc8

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 32 IoCs

miner

resource	yara_rule
behavioral2/files/0x000c000000023b78-4.dat	xmrig
behavioral2/files/0x000a000000023b80-7.dat	xmrig
behavioral2/files/0x000a000000023b81-30.dat	xmrig
behavioral2/files/0x000a000000023b8d-68.dat	xmrig
behavioral2/files/0x000a000000023b88-99.dat	xmrig
behavioral2/files/0x000a000000023b93-140.dat	xmrig
behavioral2/files/0x000a000000023b9a-138.dat	xmrig
behavioral2/files/0x000a000000023b99-136.dat	xmrig
behavioral2/files/0x000a000000023b98-134.dat	xmrig
behavioral2/files/0x000a000000023b97-132.dat	xmrig
behavioral2/files/0x000a000000023b96-130.dat	xmrig
behavioral2/files/0x000a000000023b95-128.dat	xmrig
behavioral2/files/0x000a000000023b8f-126.dat	xmrig
behavioral2/files/0x000a000000023b94-124.dat	xmrig
behavioral2/files/0x000a000000023b92-119.dat	xmrig
behavioral2/files/0x000a000000023b91-115.dat	xmrig
behavioral2/files/0x000a000000023b90-109.dat	xmrig
behavioral2/files/0x000a000000023b8c-105.dat	xmrig
behavioral2/files/0x000a000000023b8e-100.dat	xmrig
behavioral2/files/0x000a000000023b8b-83.dat	xmrig
behavioral2/files/0x000a000000023b8a-77.dat	xmrig
behavioral2/files/0x000a000000023b89-75.dat	xmrig
behavioral2/files/0x000a000000023b9b-144.dat	xmrig
behavioral2/files/0x000a000000023b87-62.dat	xmrig
behavioral2/files/0x0031000000023b86-50.dat	xmrig
behavioral2/files/0x000a000000023b83-41.dat	xmrig
behavioral2/files/0x000c000000023b79-153.dat	xmrig
behavioral2/files/0x000a000000023b9e-157.dat	xmrig
behavioral2/files/0x000a000000023b9d-158.dat	xmrig
behavioral2/files/0x000a000000023b82-34.dat	xmrig
behavioral2/files/0x0031000000023b84-38.dat	xmrig
behavioral2/files/0x0031000000023b85-37.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
5108	ksBNEbK.exe
4704	WPegarc.exe
1624	WRJhAdm.exe
3668	TySPeWM.exe
3952	anwwhVb.exe
1388	xUqPgYp.exe
4120	zOBhPOJ.exe
1068	KEDlMxf.exe
3244	BxigEcK.exe
2220	XUdRGDI.exe
2076	avClEHb.exe
1924	XTQmStD.exe
5040	KgfzrfF.exe
3984	QoYOEvr.exe
2368	bbbBmkX.exe
2928	hQPtmvy.exe
1048	BeaazxM.exe
1588	AVqKOJC.exe
1296	ScFpIUW.exe
2268	fFYJKqO.exe
1288	nbDmuHB.exe
1368	kXmILlC.exe
1156	JqgEBYR.exe
468	hIPFxgZ.exe
3064	ZpmYZQD.exe
4640	bfJMaHC.exe
232	dGYzkjk.exe
3284	dttprCL.exe
116	MPrpkHo.exe
4380	XbtwhkR.exe
3448	NinmUfv.exe
1480	nNsaAZB.exe
4088	XKaGIiQ.exe
1984	sloRSgB.exe
2120	kjSOKXW.exe
1972	GSGEKuc.exe
4412	FSMkIbG.exe
3128	QWrpERW.exe
3080	JOkCJGK.exe
3416	ynTWwnB.exe
4016	XmTTcEv.exe
4032	bVOtotu.exe
2876	lqhsuFj.exe
2036	xddytxT.exe
5028	nUIHzJy.exe
4276	ARqPnsm.exe
3500	YXgWrjr.exe
3636	vIxWMTA.exe
224	gkuzGAs.exe
3540	DwuMHzn.exe
3348	VfJWQPN.exe
3684	DMpQnAV.exe
3464	bToWHCG.exe
3164	SNnGCvP.exe
4852	fPPTaqj.exe
2136	CPhmLkz.exe
2800	hAEFpSN.exe
3372	OdhpNml.exe
3976	LkdjiwE.exe
4508	tvBYuOf.exe
1260	NlBbiGh.exe
3368	qxtsiSc.exe
1888	ewCKmQg.exe
448	QxVmVhu.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\IVzOLqO.exe	3a4a65e8eb0161eda1a86e82da596da4114f44fbb4d3423b104de148ba806fbe.exe
File created	C:\Windows\System\EExapKk.exe	3a4a65e8eb0161eda1a86e82da596da4114f44fbb4d3423b104de148ba806fbe.exe
File created	C:\Windows\System\DrUYotn.exe	3a4a65e8eb0161eda1a86e82da596da4114f44fbb4d3423b104de148ba806fbe.exe
File created	C:\Windows\System\BhqiOvn.exe	3a4a65e8eb0161eda1a86e82da596da4114f44fbb4d3423b104de148ba806fbe.exe
File created	C:\Windows\System\CRnYufM.exe	3a4a65e8eb0161eda1a86e82da596da4114f44fbb4d3423b104de148ba806fbe.exe
File created	C:\Windows\System\ZCVqrDZ.exe	3a4a65e8eb0161eda1a86e82da596da4114f44fbb4d3423b104de148ba806fbe.exe
File created	C:\Windows\System\PkXDvDH.exe	3a4a65e8eb0161eda1a86e82da596da4114f44fbb4d3423b104de148ba806fbe.exe
File created	C:\Windows\System\xUqPgYp.exe	3a4a65e8eb0161eda1a86e82da596da4114f44fbb4d3423b104de148ba806fbe.exe
File created	C:\Windows\System\VVaTjbj.exe	3a4a65e8eb0161eda1a86e82da596da4114f44fbb4d3423b104de148ba806fbe.exe
File created	C:\Windows\System\wsnUniF.exe	3a4a65e8eb0161eda1a86e82da596da4114f44fbb4d3423b104de148ba806fbe.exe
File created	C:\Windows\System\cIUDRlg.exe	3a4a65e8eb0161eda1a86e82da596da4114f44fbb4d3423b104de148ba806fbe.exe
File created	C:\Windows\System\HxDViGe.exe	3a4a65e8eb0161eda1a86e82da596da4114f44fbb4d3423b104de148ba806fbe.exe
File created	C:\Windows\System\TgMyCRg.exe	3a4a65e8eb0161eda1a86e82da596da4114f44fbb4d3423b104de148ba806fbe.exe
File created	C:\Windows\System\FSMkIbG.exe	3a4a65e8eb0161eda1a86e82da596da4114f44fbb4d3423b104de148ba806fbe.exe
File created	C:\Windows\System\iQczSYO.exe	3a4a65e8eb0161eda1a86e82da596da4114f44fbb4d3423b104de148ba806fbe.exe
File created	C:\Windows\System\uENsheB.exe	3a4a65e8eb0161eda1a86e82da596da4114f44fbb4d3423b104de148ba806fbe.exe
File created	C:\Windows\System\VslWBnn.exe	3a4a65e8eb0161eda1a86e82da596da4114f44fbb4d3423b104de148ba806fbe.exe
File created	C:\Windows\System\AunUpLS.exe	3a4a65e8eb0161eda1a86e82da596da4114f44fbb4d3423b104de148ba806fbe.exe
File created	C:\Windows\System\JocuHvn.exe	3a4a65e8eb0161eda1a86e82da596da4114f44fbb4d3423b104de148ba806fbe.exe
File created	C:\Windows\System\iUXjKkn.exe	3a4a65e8eb0161eda1a86e82da596da4114f44fbb4d3423b104de148ba806fbe.exe
File created	C:\Windows\System\jQHUmSV.exe	3a4a65e8eb0161eda1a86e82da596da4114f44fbb4d3423b104de148ba806fbe.exe
File created	C:\Windows\System\nbdMshj.exe	3a4a65e8eb0161eda1a86e82da596da4114f44fbb4d3423b104de148ba806fbe.exe
File created	C:\Windows\System\uXbfMpE.exe	3a4a65e8eb0161eda1a86e82da596da4114f44fbb4d3423b104de148ba806fbe.exe
File created	C:\Windows\System\rTYhGSP.exe	3a4a65e8eb0161eda1a86e82da596da4114f44fbb4d3423b104de148ba806fbe.exe
File created	C:\Windows\System\QaGVaaz.exe	3a4a65e8eb0161eda1a86e82da596da4114f44fbb4d3423b104de148ba806fbe.exe
File created	C:\Windows\System\PNtZWxj.exe	3a4a65e8eb0161eda1a86e82da596da4114f44fbb4d3423b104de148ba806fbe.exe
File created	C:\Windows\System\vLVbIjz.exe	3a4a65e8eb0161eda1a86e82da596da4114f44fbb4d3423b104de148ba806fbe.exe
File created	C:\Windows\System\bUvVecP.exe	3a4a65e8eb0161eda1a86e82da596da4114f44fbb4d3423b104de148ba806fbe.exe
File created	C:\Windows\System\jPwlgvT.exe	3a4a65e8eb0161eda1a86e82da596da4114f44fbb4d3423b104de148ba806fbe.exe
File created	C:\Windows\System\bToWHCG.exe	3a4a65e8eb0161eda1a86e82da596da4114f44fbb4d3423b104de148ba806fbe.exe
File created	C:\Windows\System\iRcDZuT.exe	3a4a65e8eb0161eda1a86e82da596da4114f44fbb4d3423b104de148ba806fbe.exe
File created	C:\Windows\System\HTPwSwS.exe	3a4a65e8eb0161eda1a86e82da596da4114f44fbb4d3423b104de148ba806fbe.exe
File created	C:\Windows\System\qepTqAD.exe	3a4a65e8eb0161eda1a86e82da596da4114f44fbb4d3423b104de148ba806fbe.exe
File created	C:\Windows\System\Iqxjjiw.exe	3a4a65e8eb0161eda1a86e82da596da4114f44fbb4d3423b104de148ba806fbe.exe
File created	C:\Windows\System\KSqpNqk.exe	3a4a65e8eb0161eda1a86e82da596da4114f44fbb4d3423b104de148ba806fbe.exe
File created	C:\Windows\System\zqaHdOh.exe	3a4a65e8eb0161eda1a86e82da596da4114f44fbb4d3423b104de148ba806fbe.exe
File created	C:\Windows\System\vmWPyaD.exe	3a4a65e8eb0161eda1a86e82da596da4114f44fbb4d3423b104de148ba806fbe.exe
File created	C:\Windows\System\xpegukk.exe	3a4a65e8eb0161eda1a86e82da596da4114f44fbb4d3423b104de148ba806fbe.exe
File created	C:\Windows\System\nUqqQHx.exe	3a4a65e8eb0161eda1a86e82da596da4114f44fbb4d3423b104de148ba806fbe.exe
File created	C:\Windows\System\LCfwlKu.exe	3a4a65e8eb0161eda1a86e82da596da4114f44fbb4d3423b104de148ba806fbe.exe
File created	C:\Windows\System\HDuruEc.exe	3a4a65e8eb0161eda1a86e82da596da4114f44fbb4d3423b104de148ba806fbe.exe
File created	C:\Windows\System\CWVeKqE.exe	3a4a65e8eb0161eda1a86e82da596da4114f44fbb4d3423b104de148ba806fbe.exe
File created	C:\Windows\System\QaTUSah.exe	3a4a65e8eb0161eda1a86e82da596da4114f44fbb4d3423b104de148ba806fbe.exe
File created	C:\Windows\System\NiuJMaD.exe	3a4a65e8eb0161eda1a86e82da596da4114f44fbb4d3423b104de148ba806fbe.exe
File created	C:\Windows\System\WmRBTjo.exe	3a4a65e8eb0161eda1a86e82da596da4114f44fbb4d3423b104de148ba806fbe.exe
File created	C:\Windows\System\CgmbwLW.exe	3a4a65e8eb0161eda1a86e82da596da4114f44fbb4d3423b104de148ba806fbe.exe
File created	C:\Windows\System\cZoOSEj.exe	3a4a65e8eb0161eda1a86e82da596da4114f44fbb4d3423b104de148ba806fbe.exe
File created	C:\Windows\System\ppcHUiN.exe	3a4a65e8eb0161eda1a86e82da596da4114f44fbb4d3423b104de148ba806fbe.exe
File created	C:\Windows\System\ylBFqGk.exe	3a4a65e8eb0161eda1a86e82da596da4114f44fbb4d3423b104de148ba806fbe.exe
File created	C:\Windows\System\ptSJyuG.exe	3a4a65e8eb0161eda1a86e82da596da4114f44fbb4d3423b104de148ba806fbe.exe
File created	C:\Windows\System\AKElxek.exe	3a4a65e8eb0161eda1a86e82da596da4114f44fbb4d3423b104de148ba806fbe.exe
File created	C:\Windows\System\yfdEJxF.exe	3a4a65e8eb0161eda1a86e82da596da4114f44fbb4d3423b104de148ba806fbe.exe
File created	C:\Windows\System\zGLCfPS.exe	3a4a65e8eb0161eda1a86e82da596da4114f44fbb4d3423b104de148ba806fbe.exe
File created	C:\Windows\System\NhLlYOv.exe	3a4a65e8eb0161eda1a86e82da596da4114f44fbb4d3423b104de148ba806fbe.exe
File created	C:\Windows\System\cBstoKh.exe	3a4a65e8eb0161eda1a86e82da596da4114f44fbb4d3423b104de148ba806fbe.exe
File created	C:\Windows\System\otcfNtA.exe	3a4a65e8eb0161eda1a86e82da596da4114f44fbb4d3423b104de148ba806fbe.exe
File created	C:\Windows\System\YIWnEeX.exe	3a4a65e8eb0161eda1a86e82da596da4114f44fbb4d3423b104de148ba806fbe.exe
File created	C:\Windows\System\EClNTIs.exe	3a4a65e8eb0161eda1a86e82da596da4114f44fbb4d3423b104de148ba806fbe.exe
File created	C:\Windows\System\qSErTtz.exe	3a4a65e8eb0161eda1a86e82da596da4114f44fbb4d3423b104de148ba806fbe.exe
File created	C:\Windows\System\oDgkWJj.exe	3a4a65e8eb0161eda1a86e82da596da4114f44fbb4d3423b104de148ba806fbe.exe
File created	C:\Windows\System\DMopSLl.exe	3a4a65e8eb0161eda1a86e82da596da4114f44fbb4d3423b104de148ba806fbe.exe
File created	C:\Windows\System\AGytBvO.exe	3a4a65e8eb0161eda1a86e82da596da4114f44fbb4d3423b104de148ba806fbe.exe
File created	C:\Windows\System\KiMbGQH.exe	3a4a65e8eb0161eda1a86e82da596da4114f44fbb4d3423b104de148ba806fbe.exe
File created	C:\Windows\System\nUIHzJy.exe	3a4a65e8eb0161eda1a86e82da596da4114f44fbb4d3423b104de148ba806fbe.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	16212	dwm.exe
Token: SeChangeNotifyPrivilege	16212	dwm.exe
Token: 33	16212	dwm.exe
Token: SeIncBasePriorityPrivilege	16212	dwm.exe
Token: SeShutdownPrivilege	16212	dwm.exe
Token: SeCreatePagefilePrivilege	16212	dwm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4356 wrote to memory of 5108	4356	3a4a65e8eb0161eda1a86e82da596da4114f44fbb4d3423b104de148ba806fbe.exe	84
PID 4356 wrote to memory of 5108	4356	3a4a65e8eb0161eda1a86e82da596da4114f44fbb4d3423b104de148ba806fbe.exe	84
PID 4356 wrote to memory of 4704	4356	3a4a65e8eb0161eda1a86e82da596da4114f44fbb4d3423b104de148ba806fbe.exe	85
PID 4356 wrote to memory of 4704	4356	3a4a65e8eb0161eda1a86e82da596da4114f44fbb4d3423b104de148ba806fbe.exe	85
PID 4356 wrote to memory of 1624	4356	3a4a65e8eb0161eda1a86e82da596da4114f44fbb4d3423b104de148ba806fbe.exe	86
PID 4356 wrote to memory of 1624	4356	3a4a65e8eb0161eda1a86e82da596da4114f44fbb4d3423b104de148ba806fbe.exe	86
PID 4356 wrote to memory of 3668	4356	3a4a65e8eb0161eda1a86e82da596da4114f44fbb4d3423b104de148ba806fbe.exe	87
PID 4356 wrote to memory of 3668	4356	3a4a65e8eb0161eda1a86e82da596da4114f44fbb4d3423b104de148ba806fbe.exe	87
PID 4356 wrote to memory of 3952	4356	3a4a65e8eb0161eda1a86e82da596da4114f44fbb4d3423b104de148ba806fbe.exe	88
PID 4356 wrote to memory of 3952	4356	3a4a65e8eb0161eda1a86e82da596da4114f44fbb4d3423b104de148ba806fbe.exe	88
PID 4356 wrote to memory of 1388	4356	3a4a65e8eb0161eda1a86e82da596da4114f44fbb4d3423b104de148ba806fbe.exe	89
PID 4356 wrote to memory of 1388	4356	3a4a65e8eb0161eda1a86e82da596da4114f44fbb4d3423b104de148ba806fbe.exe	89
PID 4356 wrote to memory of 4120	4356	3a4a65e8eb0161eda1a86e82da596da4114f44fbb4d3423b104de148ba806fbe.exe	90
PID 4356 wrote to memory of 4120	4356	3a4a65e8eb0161eda1a86e82da596da4114f44fbb4d3423b104de148ba806fbe.exe	90
PID 4356 wrote to memory of 1068	4356	3a4a65e8eb0161eda1a86e82da596da4114f44fbb4d3423b104de148ba806fbe.exe	91
PID 4356 wrote to memory of 1068	4356	3a4a65e8eb0161eda1a86e82da596da4114f44fbb4d3423b104de148ba806fbe.exe	91
PID 4356 wrote to memory of 3244	4356	3a4a65e8eb0161eda1a86e82da596da4114f44fbb4d3423b104de148ba806fbe.exe	92
PID 4356 wrote to memory of 3244	4356	3a4a65e8eb0161eda1a86e82da596da4114f44fbb4d3423b104de148ba806fbe.exe	92
PID 4356 wrote to memory of 2220	4356	3a4a65e8eb0161eda1a86e82da596da4114f44fbb4d3423b104de148ba806fbe.exe	93
PID 4356 wrote to memory of 2220	4356	3a4a65e8eb0161eda1a86e82da596da4114f44fbb4d3423b104de148ba806fbe.exe	93
PID 4356 wrote to memory of 2076	4356	3a4a65e8eb0161eda1a86e82da596da4114f44fbb4d3423b104de148ba806fbe.exe	94
PID 4356 wrote to memory of 2076	4356	3a4a65e8eb0161eda1a86e82da596da4114f44fbb4d3423b104de148ba806fbe.exe	94
PID 4356 wrote to memory of 1924	4356	3a4a65e8eb0161eda1a86e82da596da4114f44fbb4d3423b104de148ba806fbe.exe	95
PID 4356 wrote to memory of 1924	4356	3a4a65e8eb0161eda1a86e82da596da4114f44fbb4d3423b104de148ba806fbe.exe	95
PID 4356 wrote to memory of 5040	4356	3a4a65e8eb0161eda1a86e82da596da4114f44fbb4d3423b104de148ba806fbe.exe	96
PID 4356 wrote to memory of 5040	4356	3a4a65e8eb0161eda1a86e82da596da4114f44fbb4d3423b104de148ba806fbe.exe	96
PID 4356 wrote to memory of 3984	4356	3a4a65e8eb0161eda1a86e82da596da4114f44fbb4d3423b104de148ba806fbe.exe	97
PID 4356 wrote to memory of 3984	4356	3a4a65e8eb0161eda1a86e82da596da4114f44fbb4d3423b104de148ba806fbe.exe	97
PID 4356 wrote to memory of 2368	4356	3a4a65e8eb0161eda1a86e82da596da4114f44fbb4d3423b104de148ba806fbe.exe	98
PID 4356 wrote to memory of 2368	4356	3a4a65e8eb0161eda1a86e82da596da4114f44fbb4d3423b104de148ba806fbe.exe	98
PID 4356 wrote to memory of 1296	4356	3a4a65e8eb0161eda1a86e82da596da4114f44fbb4d3423b104de148ba806fbe.exe	99
PID 4356 wrote to memory of 1296	4356	3a4a65e8eb0161eda1a86e82da596da4114f44fbb4d3423b104de148ba806fbe.exe	99
PID 4356 wrote to memory of 1288	4356	3a4a65e8eb0161eda1a86e82da596da4114f44fbb4d3423b104de148ba806fbe.exe	100
PID 4356 wrote to memory of 1288	4356	3a4a65e8eb0161eda1a86e82da596da4114f44fbb4d3423b104de148ba806fbe.exe	100
PID 4356 wrote to memory of 2928	4356	3a4a65e8eb0161eda1a86e82da596da4114f44fbb4d3423b104de148ba806fbe.exe	101
PID 4356 wrote to memory of 2928	4356	3a4a65e8eb0161eda1a86e82da596da4114f44fbb4d3423b104de148ba806fbe.exe	101
PID 4356 wrote to memory of 1048	4356	3a4a65e8eb0161eda1a86e82da596da4114f44fbb4d3423b104de148ba806fbe.exe	102
PID 4356 wrote to memory of 1048	4356	3a4a65e8eb0161eda1a86e82da596da4114f44fbb4d3423b104de148ba806fbe.exe	102
PID 4356 wrote to memory of 1588	4356	3a4a65e8eb0161eda1a86e82da596da4114f44fbb4d3423b104de148ba806fbe.exe	103
PID 4356 wrote to memory of 1588	4356	3a4a65e8eb0161eda1a86e82da596da4114f44fbb4d3423b104de148ba806fbe.exe	103
PID 4356 wrote to memory of 3284	4356	3a4a65e8eb0161eda1a86e82da596da4114f44fbb4d3423b104de148ba806fbe.exe	104
PID 4356 wrote to memory of 3284	4356	3a4a65e8eb0161eda1a86e82da596da4114f44fbb4d3423b104de148ba806fbe.exe	104
PID 4356 wrote to memory of 2268	4356	3a4a65e8eb0161eda1a86e82da596da4114f44fbb4d3423b104de148ba806fbe.exe	105
PID 4356 wrote to memory of 2268	4356	3a4a65e8eb0161eda1a86e82da596da4114f44fbb4d3423b104de148ba806fbe.exe	105
PID 4356 wrote to memory of 1368	4356	3a4a65e8eb0161eda1a86e82da596da4114f44fbb4d3423b104de148ba806fbe.exe	106
PID 4356 wrote to memory of 1368	4356	3a4a65e8eb0161eda1a86e82da596da4114f44fbb4d3423b104de148ba806fbe.exe	106
PID 4356 wrote to memory of 1156	4356	3a4a65e8eb0161eda1a86e82da596da4114f44fbb4d3423b104de148ba806fbe.exe	107
PID 4356 wrote to memory of 1156	4356	3a4a65e8eb0161eda1a86e82da596da4114f44fbb4d3423b104de148ba806fbe.exe	107
PID 4356 wrote to memory of 468	4356	3a4a65e8eb0161eda1a86e82da596da4114f44fbb4d3423b104de148ba806fbe.exe	108
PID 4356 wrote to memory of 468	4356	3a4a65e8eb0161eda1a86e82da596da4114f44fbb4d3423b104de148ba806fbe.exe	108
PID 4356 wrote to memory of 3064	4356	3a4a65e8eb0161eda1a86e82da596da4114f44fbb4d3423b104de148ba806fbe.exe	109
PID 4356 wrote to memory of 3064	4356	3a4a65e8eb0161eda1a86e82da596da4114f44fbb4d3423b104de148ba806fbe.exe	109
PID 4356 wrote to memory of 4640	4356	3a4a65e8eb0161eda1a86e82da596da4114f44fbb4d3423b104de148ba806fbe.exe	110
PID 4356 wrote to memory of 4640	4356	3a4a65e8eb0161eda1a86e82da596da4114f44fbb4d3423b104de148ba806fbe.exe	110
PID 4356 wrote to memory of 232	4356	3a4a65e8eb0161eda1a86e82da596da4114f44fbb4d3423b104de148ba806fbe.exe	111
PID 4356 wrote to memory of 232	4356	3a4a65e8eb0161eda1a86e82da596da4114f44fbb4d3423b104de148ba806fbe.exe	111
PID 4356 wrote to memory of 116	4356	3a4a65e8eb0161eda1a86e82da596da4114f44fbb4d3423b104de148ba806fbe.exe	112
PID 4356 wrote to memory of 116	4356	3a4a65e8eb0161eda1a86e82da596da4114f44fbb4d3423b104de148ba806fbe.exe	112
PID 4356 wrote to memory of 4380	4356	3a4a65e8eb0161eda1a86e82da596da4114f44fbb4d3423b104de148ba806fbe.exe	113
PID 4356 wrote to memory of 4380	4356	3a4a65e8eb0161eda1a86e82da596da4114f44fbb4d3423b104de148ba806fbe.exe	113
PID 4356 wrote to memory of 3448	4356	3a4a65e8eb0161eda1a86e82da596da4114f44fbb4d3423b104de148ba806fbe.exe	114
PID 4356 wrote to memory of 3448	4356	3a4a65e8eb0161eda1a86e82da596da4114f44fbb4d3423b104de148ba806fbe.exe	114
PID 4356 wrote to memory of 1480	4356	3a4a65e8eb0161eda1a86e82da596da4114f44fbb4d3423b104de148ba806fbe.exe	115
PID 4356 wrote to memory of 1480	4356	3a4a65e8eb0161eda1a86e82da596da4114f44fbb4d3423b104de148ba806fbe.exe	115

C:\Users\Admin\AppData\Local\Temp\3a4a65e8eb0161eda1a86e82da596da4114f44fbb4d3423b104de148ba806fbe.exe
"C:\Users\Admin\AppData\Local\Temp\3a4a65e8eb0161eda1a86e82da596da4114f44fbb4d3423b104de148ba806fbe.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4356
- C:\Windows\System\ksBNEbK.exe
  C:\Windows\System\ksBNEbK.exe
  2⤵
  - Executes dropped EXE
  PID:5108
- C:\Windows\System\WPegarc.exe
  C:\Windows\System\WPegarc.exe
  2⤵
  - Executes dropped EXE
  PID:4704
- C:\Windows\System\WRJhAdm.exe
  C:\Windows\System\WRJhAdm.exe
  2⤵
  - Executes dropped EXE
  PID:1624
- C:\Windows\System\TySPeWM.exe
  C:\Windows\System\TySPeWM.exe
  2⤵
  - Executes dropped EXE
  PID:3668
- C:\Windows\System\anwwhVb.exe
  C:\Windows\System\anwwhVb.exe
  2⤵
  - Executes dropped EXE
  PID:3952
- C:\Windows\System\xUqPgYp.exe
  C:\Windows\System\xUqPgYp.exe
  2⤵
  - Executes dropped EXE
  PID:1388
- C:\Windows\System\zOBhPOJ.exe
  C:\Windows\System\zOBhPOJ.exe
  2⤵
  - Executes dropped EXE
  PID:4120
- C:\Windows\System\KEDlMxf.exe
  C:\Windows\System\KEDlMxf.exe
  2⤵
  - Executes dropped EXE
  PID:1068
- C:\Windows\System\BxigEcK.exe
  C:\Windows\System\BxigEcK.exe
  2⤵
  - Executes dropped EXE
  PID:3244
- C:\Windows\System\XUdRGDI.exe
  C:\Windows\System\XUdRGDI.exe
  2⤵
  - Executes dropped EXE
  PID:2220
- C:\Windows\System\avClEHb.exe
  C:\Windows\System\avClEHb.exe
  2⤵
  - Executes dropped EXE
  PID:2076
- C:\Windows\System\XTQmStD.exe
  C:\Windows\System\XTQmStD.exe
  2⤵
  - Executes dropped EXE
  PID:1924
- C:\Windows\System\KgfzrfF.exe
  C:\Windows\System\KgfzrfF.exe
  2⤵
  - Executes dropped EXE
  PID:5040
- C:\Windows\System\QoYOEvr.exe
  C:\Windows\System\QoYOEvr.exe
  2⤵
  - Executes dropped EXE
  PID:3984
- C:\Windows\System\bbbBmkX.exe
  C:\Windows\System\bbbBmkX.exe
  2⤵
  - Executes dropped EXE
  PID:2368
- C:\Windows\System\ScFpIUW.exe
  C:\Windows\System\ScFpIUW.exe
  2⤵
  - Executes dropped EXE
  PID:1296
- C:\Windows\System\nbDmuHB.exe
  C:\Windows\System\nbDmuHB.exe
  2⤵
  - Executes dropped EXE
  PID:1288
- C:\Windows\System\hQPtmvy.exe
  C:\Windows\System\hQPtmvy.exe
  2⤵
  - Executes dropped EXE
  PID:2928
- C:\Windows\System\BeaazxM.exe
  C:\Windows\System\BeaazxM.exe
  2⤵
  - Executes dropped EXE
  PID:1048
- C:\Windows\System\AVqKOJC.exe
  C:\Windows\System\AVqKOJC.exe
  2⤵
  - Executes dropped EXE
  PID:1588
- C:\Windows\System\dttprCL.exe
  C:\Windows\System\dttprCL.exe
  2⤵
  - Executes dropped EXE
  PID:3284
- C:\Windows\System\fFYJKqO.exe
  C:\Windows\System\fFYJKqO.exe
  2⤵
  - Executes dropped EXE
  PID:2268
- C:\Windows\System\kXmILlC.exe
  C:\Windows\System\kXmILlC.exe
  2⤵
  - Executes dropped EXE
  PID:1368
- C:\Windows\System\JqgEBYR.exe
  C:\Windows\System\JqgEBYR.exe
  2⤵
  - Executes dropped EXE
  PID:1156
- C:\Windows\System\hIPFxgZ.exe
  C:\Windows\System\hIPFxgZ.exe
  2⤵
  - Executes dropped EXE
  PID:468
- C:\Windows\System\ZpmYZQD.exe
  C:\Windows\System\ZpmYZQD.exe
  2⤵
  - Executes dropped EXE
  PID:3064
- C:\Windows\System\bfJMaHC.exe
  C:\Windows\System\bfJMaHC.exe
  2⤵
  - Executes dropped EXE
  PID:4640
- C:\Windows\System\dGYzkjk.exe
  C:\Windows\System\dGYzkjk.exe
  2⤵
  - Executes dropped EXE
  PID:232
- C:\Windows\System\MPrpkHo.exe
  C:\Windows\System\MPrpkHo.exe
  2⤵
  - Executes dropped EXE
  PID:116
- C:\Windows\System\XbtwhkR.exe
  C:\Windows\System\XbtwhkR.exe
  2⤵
  - Executes dropped EXE
  PID:4380
- C:\Windows\System\NinmUfv.exe
  C:\Windows\System\NinmUfv.exe
  2⤵
  - Executes dropped EXE
  PID:3448
- C:\Windows\System\nNsaAZB.exe
  C:\Windows\System\nNsaAZB.exe
  2⤵
  - Executes dropped EXE
  PID:1480
- C:\Windows\System\XKaGIiQ.exe
  C:\Windows\System\XKaGIiQ.exe
  2⤵
  - Executes dropped EXE
  PID:4088
- C:\Windows\System\sloRSgB.exe
  C:\Windows\System\sloRSgB.exe
  2⤵
  - Executes dropped EXE
  PID:1984
- C:\Windows\System\kjSOKXW.exe
  C:\Windows\System\kjSOKXW.exe
  2⤵
  - Executes dropped EXE
  PID:2120
- C:\Windows\System\GSGEKuc.exe
  C:\Windows\System\GSGEKuc.exe
  2⤵
  - Executes dropped EXE
  PID:1972
- C:\Windows\System\QWrpERW.exe
  C:\Windows\System\QWrpERW.exe
  2⤵
  - Executes dropped EXE
  PID:3128
- C:\Windows\System\FSMkIbG.exe
  C:\Windows\System\FSMkIbG.exe
  2⤵
  - Executes dropped EXE
  PID:4412
- C:\Windows\System\JOkCJGK.exe
  C:\Windows\System\JOkCJGK.exe
  2⤵
  - Executes dropped EXE
  PID:3080
- C:\Windows\System\ynTWwnB.exe
  C:\Windows\System\ynTWwnB.exe
  2⤵
  - Executes dropped EXE
  PID:3416
- C:\Windows\System\XmTTcEv.exe
  C:\Windows\System\XmTTcEv.exe
  2⤵
  - Executes dropped EXE
  PID:4016
- C:\Windows\System\lqhsuFj.exe
  C:\Windows\System\lqhsuFj.exe
  2⤵
  - Executes dropped EXE
  PID:2876
- C:\Windows\System\bVOtotu.exe
  C:\Windows\System\bVOtotu.exe
  2⤵
  - Executes dropped EXE
  PID:4032
- C:\Windows\System\xddytxT.exe
  C:\Windows\System\xddytxT.exe
  2⤵
  - Executes dropped EXE
  PID:2036
- C:\Windows\System\nUIHzJy.exe
  C:\Windows\System\nUIHzJy.exe
  2⤵
  - Executes dropped EXE
  PID:5028
- C:\Windows\System\ARqPnsm.exe
  C:\Windows\System\ARqPnsm.exe
  2⤵
  - Executes dropped EXE
  PID:4276
- C:\Windows\System\YXgWrjr.exe
  C:\Windows\System\YXgWrjr.exe
  2⤵
  - Executes dropped EXE
  PID:3500
- C:\Windows\System\vIxWMTA.exe
  C:\Windows\System\vIxWMTA.exe
  2⤵
  - Executes dropped EXE
  PID:3636
- C:\Windows\System\gkuzGAs.exe
  C:\Windows\System\gkuzGAs.exe
  2⤵
  - Executes dropped EXE
  PID:224
- C:\Windows\System\DwuMHzn.exe
  C:\Windows\System\DwuMHzn.exe
  2⤵
  - Executes dropped EXE
  PID:3540
- C:\Windows\System\VfJWQPN.exe
  C:\Windows\System\VfJWQPN.exe
  2⤵
  - Executes dropped EXE
  PID:3348
- C:\Windows\System\DMpQnAV.exe
  C:\Windows\System\DMpQnAV.exe
  2⤵
  - Executes dropped EXE
  PID:3684
- C:\Windows\System\bToWHCG.exe
  C:\Windows\System\bToWHCG.exe
  2⤵
  - Executes dropped EXE
  PID:3464
- C:\Windows\System\SNnGCvP.exe
  C:\Windows\System\SNnGCvP.exe
  2⤵
  - Executes dropped EXE
  PID:3164
- C:\Windows\System\fPPTaqj.exe
  C:\Windows\System\fPPTaqj.exe
  2⤵
  - Executes dropped EXE
  PID:4852
- C:\Windows\System\CPhmLkz.exe
  C:\Windows\System\CPhmLkz.exe
  2⤵
  - Executes dropped EXE
  PID:2136
- C:\Windows\System\hAEFpSN.exe
  C:\Windows\System\hAEFpSN.exe
  2⤵
  - Executes dropped EXE
  PID:2800
- C:\Windows\System\OdhpNml.exe
  C:\Windows\System\OdhpNml.exe
  2⤵
  - Executes dropped EXE
  PID:3372
- C:\Windows\System\LkdjiwE.exe
  C:\Windows\System\LkdjiwE.exe
  2⤵
  - Executes dropped EXE
  PID:3976
- C:\Windows\System\tvBYuOf.exe
  C:\Windows\System\tvBYuOf.exe
  2⤵
  - Executes dropped EXE
  PID:4508
- C:\Windows\System\NlBbiGh.exe
  C:\Windows\System\NlBbiGh.exe
  2⤵
  - Executes dropped EXE
  PID:1260
- C:\Windows\System\qxtsiSc.exe
  C:\Windows\System\qxtsiSc.exe
  2⤵
  - Executes dropped EXE
  PID:3368
- C:\Windows\System\ewCKmQg.exe
  C:\Windows\System\ewCKmQg.exe
  2⤵
  - Executes dropped EXE
  PID:1888
- C:\Windows\System\QxVmVhu.exe
  C:\Windows\System\QxVmVhu.exe
  2⤵
  - Executes dropped EXE
  PID:448
- C:\Windows\System\UyXrpDV.exe
  C:\Windows\System\UyXrpDV.exe
  2⤵
  PID:864
- C:\Windows\System\bQoUyET.exe
  C:\Windows\System\bQoUyET.exe
  2⤵
  PID:1220
- C:\Windows\System\IeygADf.exe
  C:\Windows\System\IeygADf.exe
  2⤵
  PID:2108
- C:\Windows\System\cUCVnMf.exe
  C:\Windows\System\cUCVnMf.exe
  2⤵
  PID:5016
- C:\Windows\System\fOsGiaq.exe
  C:\Windows\System\fOsGiaq.exe
  2⤵
  PID:5100
- C:\Windows\System\UUqTNMp.exe
  C:\Windows\System\UUqTNMp.exe
  2⤵
  PID:60
- C:\Windows\System\ieiKAQL.exe
  C:\Windows\System\ieiKAQL.exe
  2⤵
  PID:952
- C:\Windows\System\KFwlHCK.exe
  C:\Windows\System\KFwlHCK.exe
  2⤵
  PID:4920
- C:\Windows\System\vaBkUaL.exe
  C:\Windows\System\vaBkUaL.exe
  2⤵
  PID:4448
- C:\Windows\System\uutBzak.exe
  C:\Windows\System\uutBzak.exe
  2⤵
  PID:1464
- C:\Windows\System\mzsGwNk.exe
  C:\Windows\System\mzsGwNk.exe
  2⤵
  PID:2660
- C:\Windows\System\dsNruKE.exe
  C:\Windows\System\dsNruKE.exe
  2⤵
  PID:4064
- C:\Windows\System\dBTJzAQ.exe
  C:\Windows\System\dBTJzAQ.exe
  2⤵
  PID:1492
- C:\Windows\System\cZoOSEj.exe
  C:\Windows\System\cZoOSEj.exe
  2⤵
  PID:4956
- C:\Windows\System\refGsmw.exe
  C:\Windows\System\refGsmw.exe
  2⤵
  PID:4540
- C:\Windows\System\rTYhGSP.exe
  C:\Windows\System\rTYhGSP.exe
  2⤵
  PID:1900
- C:\Windows\System\rwlmyaM.exe
  C:\Windows\System\rwlmyaM.exe
  2⤵
  PID:3280
- C:\Windows\System\kTAHrbX.exe
  C:\Windows\System\kTAHrbX.exe
  2⤵
  PID:4428
- C:\Windows\System\csVlXBR.exe
  C:\Windows\System\csVlXBR.exe
  2⤵
  PID:4432
- C:\Windows\System\nTlkhXL.exe
  C:\Windows\System\nTlkhXL.exe
  2⤵
  PID:4308
- C:\Windows\System\NNDppCv.exe
  C:\Windows\System\NNDppCv.exe
  2⤵
  PID:4320
- C:\Windows\System\uIwimJR.exe
  C:\Windows\System\uIwimJR.exe
  2⤵
  PID:1244
- C:\Windows\System\qOJnsHn.exe
  C:\Windows\System\qOJnsHn.exe
  2⤵
  PID:3672
- C:\Windows\System\wOomaPR.exe
  C:\Windows\System\wOomaPR.exe
  2⤵
  PID:1788
- C:\Windows\System\YYQQSSe.exe
  C:\Windows\System\YYQQSSe.exe
  2⤵
  PID:608
- C:\Windows\System\RPlawZu.exe
  C:\Windows\System\RPlawZu.exe
  2⤵
  PID:312
- C:\Windows\System\LIvfBdX.exe
  C:\Windows\System\LIvfBdX.exe
  2⤵
  PID:1816
- C:\Windows\System\sqvPAUR.exe
  C:\Windows\System\sqvPAUR.exe
  2⤵
  PID:4856
- C:\Windows\System\OMOluLE.exe
  C:\Windows\System\OMOluLE.exe
  2⤵
  PID:2836
- C:\Windows\System\FXnHMBl.exe
  C:\Windows\System\FXnHMBl.exe
  2⤵
  PID:1476
- C:\Windows\System\lYVoGMn.exe
  C:\Windows\System\lYVoGMn.exe
  2⤵
  PID:2272
- C:\Windows\System\quCWiyP.exe
  C:\Windows\System\quCWiyP.exe
  2⤵
  PID:4180
- C:\Windows\System\KMLWseY.exe
  C:\Windows\System\KMLWseY.exe
  2⤵
  PID:1780
- C:\Windows\System\UBzjHyK.exe
  C:\Windows\System\UBzjHyK.exe
  2⤵
  PID:844
- C:\Windows\System\mEYvraF.exe
  C:\Windows\System\mEYvraF.exe
  2⤵
  PID:3356
- C:\Windows\System\ZeBrPbI.exe
  C:\Windows\System\ZeBrPbI.exe
  2⤵
  PID:3332
- C:\Windows\System\zqaHdOh.exe
  C:\Windows\System\zqaHdOh.exe
  2⤵
  PID:2216
- C:\Windows\System\rIjhELC.exe
  C:\Windows\System\rIjhELC.exe
  2⤵
  PID:2104
- C:\Windows\System\WTeCUzm.exe
  C:\Windows\System\WTeCUzm.exe
  2⤵
  PID:2284
- C:\Windows\System\iIYkMEi.exe
  C:\Windows\System\iIYkMEi.exe
  2⤵
  PID:3896
- C:\Windows\System\iQczSYO.exe
  C:\Windows\System\iQczSYO.exe
  2⤵
  PID:2784
- C:\Windows\System\zibUdnX.exe
  C:\Windows\System\zibUdnX.exe
  2⤵
  PID:2484
- C:\Windows\System\WXLWLiP.exe
  C:\Windows\System\WXLWLiP.exe
  2⤵
  PID:2680
- C:\Windows\System\jvIzggi.exe
  C:\Windows\System\jvIzggi.exe
  2⤵
  PID:1072
- C:\Windows\System\WxFYMOC.exe
  C:\Windows\System\WxFYMOC.exe
  2⤵
  PID:2324
- C:\Windows\System\dTsTwro.exe
  C:\Windows\System\dTsTwro.exe
  2⤵
  PID:364
- C:\Windows\System\jCkYOpc.exe
  C:\Windows\System\jCkYOpc.exe
  2⤵
  PID:4040
- C:\Windows\System\qJjWUIk.exe
  C:\Windows\System\qJjWUIk.exe
  2⤵
  PID:2640
- C:\Windows\System\McDEKjE.exe
  C:\Windows\System\McDEKjE.exe
  2⤵
  PID:888
- C:\Windows\System\WjPMiMS.exe
  C:\Windows\System\WjPMiMS.exe
  2⤵
  PID:2460
- C:\Windows\System\Qtsjwsc.exe
  C:\Windows\System\Qtsjwsc.exe
  2⤵
  PID:4796
- C:\Windows\System\BwPjGmG.exe
  C:\Windows\System\BwPjGmG.exe
  2⤵
  PID:5144
- C:\Windows\System\ZWhiotS.exe
  C:\Windows\System\ZWhiotS.exe
  2⤵
  PID:5168
- C:\Windows\System\QaGVaaz.exe
  C:\Windows\System\QaGVaaz.exe
  2⤵
  PID:5204
- C:\Windows\System\BnjCCaL.exe
  C:\Windows\System\BnjCCaL.exe
  2⤵
  PID:5244
- C:\Windows\System\hndvJNl.exe
  C:\Windows\System\hndvJNl.exe
  2⤵
  PID:5264
- C:\Windows\System\mILzvPU.exe
  C:\Windows\System\mILzvPU.exe
  2⤵
  PID:5280
- C:\Windows\System\AyPcjBX.exe
  C:\Windows\System\AyPcjBX.exe
  2⤵
  PID:5308
- C:\Windows\System\ujZCkqs.exe
  C:\Windows\System\ujZCkqs.exe
  2⤵
  PID:5336
- C:\Windows\System\JMGvJlS.exe
  C:\Windows\System\JMGvJlS.exe
  2⤵
  PID:5368
- C:\Windows\System\zaAWhPO.exe
  C:\Windows\System\zaAWhPO.exe
  2⤵
  PID:5404
- C:\Windows\System\RisaLtn.exe
  C:\Windows\System\RisaLtn.exe
  2⤵
  PID:5436
- C:\Windows\System\dWPqAiZ.exe
  C:\Windows\System\dWPqAiZ.exe
  2⤵
  PID:5464
- C:\Windows\System\pnVHGMI.exe
  C:\Windows\System\pnVHGMI.exe
  2⤵
  PID:5492
- C:\Windows\System\SizFOLa.exe
  C:\Windows\System\SizFOLa.exe
  2⤵
  PID:5520
- C:\Windows\System\zwrEIPO.exe
  C:\Windows\System\zwrEIPO.exe
  2⤵
  PID:5540
- C:\Windows\System\izsTKzg.exe
  C:\Windows\System\izsTKzg.exe
  2⤵
  PID:5568
- C:\Windows\System\uCFaRJc.exe
  C:\Windows\System\uCFaRJc.exe
  2⤵
  PID:5600
- C:\Windows\System\MoVNyyw.exe
  C:\Windows\System\MoVNyyw.exe
  2⤵
  PID:5628
- C:\Windows\System\tCwRdPJ.exe
  C:\Windows\System\tCwRdPJ.exe
  2⤵
  PID:5652
- C:\Windows\System\kgZmeCp.exe
  C:\Windows\System\kgZmeCp.exe
  2⤵
  PID:5680
- C:\Windows\System\CmtuYUA.exe
  C:\Windows\System\CmtuYUA.exe
  2⤵
  PID:5708
- C:\Windows\System\bEgvcUh.exe
  C:\Windows\System\bEgvcUh.exe
  2⤵
  PID:5732
- C:\Windows\System\utFhJAI.exe
  C:\Windows\System\utFhJAI.exe
  2⤵
  PID:5760
- C:\Windows\System\LQXqmJJ.exe
  C:\Windows\System\LQXqmJJ.exe
  2⤵
  PID:5780
- C:\Windows\System\oOeHODF.exe
  C:\Windows\System\oOeHODF.exe
  2⤵
  PID:5816
- C:\Windows\System\xGssubR.exe
  C:\Windows\System\xGssubR.exe
  2⤵
  PID:5848
- C:\Windows\System\XcAxxFp.exe
  C:\Windows\System\XcAxxFp.exe
  2⤵
  PID:5868
- C:\Windows\System\MMrBPQu.exe
  C:\Windows\System\MMrBPQu.exe
  2⤵
  PID:5888
- C:\Windows\System\splBZaT.exe
  C:\Windows\System\splBZaT.exe
  2⤵
  PID:5912
- C:\Windows\System\eCntWJo.exe
  C:\Windows\System\eCntWJo.exe
  2⤵
  PID:5944
- C:\Windows\System\UKTlDCH.exe
  C:\Windows\System\UKTlDCH.exe
  2⤵
  PID:5972
- C:\Windows\System\XKEMIul.exe
  C:\Windows\System\XKEMIul.exe
  2⤵
  PID:6012
- C:\Windows\System\UiugLVp.exe
  C:\Windows\System\UiugLVp.exe
  2⤵
  PID:6028
- C:\Windows\System\ceHlNoi.exe
  C:\Windows\System\ceHlNoi.exe
  2⤵
  PID:6056
- C:\Windows\System\oQjGmbl.exe
  C:\Windows\System\oQjGmbl.exe
  2⤵
  PID:6072
- C:\Windows\System\pjuamNK.exe
  C:\Windows\System\pjuamNK.exe
  2⤵
  PID:6100
- C:\Windows\System\wVlNYJt.exe
  C:\Windows\System\wVlNYJt.exe
  2⤵
  PID:6132
- C:\Windows\System\elUtSUM.exe
  C:\Windows\System\elUtSUM.exe
  2⤵
  PID:5152
- C:\Windows\System\pxGOxyE.exe
  C:\Windows\System\pxGOxyE.exe
  2⤵
  PID:5192
- C:\Windows\System\MsfPhqn.exe
  C:\Windows\System\MsfPhqn.exe
  2⤵
  PID:5272
- C:\Windows\System\ScNZAkn.exe
  C:\Windows\System\ScNZAkn.exe
  2⤵
  PID:5352
- C:\Windows\System\sgvPKVP.exe
  C:\Windows\System\sgvPKVP.exe
  2⤵
  PID:5420
- C:\Windows\System\ENpJLqv.exe
  C:\Windows\System\ENpJLqv.exe
  2⤵
  PID:5460
- C:\Windows\System\AMJpkVV.exe
  C:\Windows\System\AMJpkVV.exe
  2⤵
  PID:5528
- C:\Windows\System\dORAyEk.exe
  C:\Windows\System\dORAyEk.exe
  2⤵
  PID:5592
- C:\Windows\System\LCfwlKu.exe
  C:\Windows\System\LCfwlKu.exe
  2⤵
  PID:5676
- C:\Windows\System\kBuiaaq.exe
  C:\Windows\System\kBuiaaq.exe
  2⤵
  PID:5800
- C:\Windows\System\UYnQODr.exe
  C:\Windows\System\UYnQODr.exe
  2⤵
  PID:5824
- C:\Windows\System\uEcVxkq.exe
  C:\Windows\System\uEcVxkq.exe
  2⤵
  PID:5832
- C:\Windows\System\qPpvLcX.exe
  C:\Windows\System\qPpvLcX.exe
  2⤵
  PID:5928
- C:\Windows\System\XBtBZOD.exe
  C:\Windows\System\XBtBZOD.exe
  2⤵
  PID:6020
- C:\Windows\System\NhLlYOv.exe
  C:\Windows\System\NhLlYOv.exe
  2⤵
  PID:6092
- C:\Windows\System\jAurrDl.exe
  C:\Windows\System\jAurrDl.exe
  2⤵
  PID:4988
- C:\Windows\System\wCUNxoH.exe
  C:\Windows\System\wCUNxoH.exe
  2⤵
  PID:5156
- C:\Windows\System\suuZbMu.exe
  C:\Windows\System\suuZbMu.exe
  2⤵
  PID:5360
- C:\Windows\System\FRZnthb.exe
  C:\Windows\System\FRZnthb.exe
  2⤵
  PID:5608
- C:\Windows\System\gueeynG.exe
  C:\Windows\System\gueeynG.exe
  2⤵
  PID:5716
- C:\Windows\System\ROqyUut.exe
  C:\Windows\System\ROqyUut.exe
  2⤵
  PID:5648
- C:\Windows\System\pTlFRGQ.exe
  C:\Windows\System\pTlFRGQ.exe
  2⤵
  PID:5860
- C:\Windows\System\IyblgrT.exe
  C:\Windows\System\IyblgrT.exe
  2⤵
  PID:6048
- C:\Windows\System\JdySXTs.exe
  C:\Windows\System\JdySXTs.exe
  2⤵
  PID:5516
- C:\Windows\System\SJwgyGs.exe
  C:\Windows\System\SJwgyGs.exe
  2⤵
  PID:5792
- C:\Windows\System\KiuVTvE.exe
  C:\Windows\System\KiuVTvE.exe
  2⤵
  PID:5184
- C:\Windows\System\XDsZzKC.exe
  C:\Windows\System\XDsZzKC.exe
  2⤵
  PID:6152
- C:\Windows\System\ULoptgh.exe
  C:\Windows\System\ULoptgh.exe
  2⤵
  PID:6188
- C:\Windows\System\OobSLug.exe
  C:\Windows\System\OobSLug.exe
  2⤵
  PID:6216
- C:\Windows\System\BxpWBQD.exe
  C:\Windows\System\BxpWBQD.exe
  2⤵
  PID:6244
- C:\Windows\System\FxyDBys.exe
  C:\Windows\System\FxyDBys.exe
  2⤵
  PID:6272
- C:\Windows\System\AunUpLS.exe
  C:\Windows\System\AunUpLS.exe
  2⤵
  PID:6292
- C:\Windows\System\ZicUNWp.exe
  C:\Windows\System\ZicUNWp.exe
  2⤵
  PID:6328
- C:\Windows\System\SOqMvlN.exe
  C:\Windows\System\SOqMvlN.exe
  2⤵
  PID:6356
- C:\Windows\System\RxIrkRr.exe
  C:\Windows\System\RxIrkRr.exe
  2⤵
  PID:6384
- C:\Windows\System\riVNPvi.exe
  C:\Windows\System\riVNPvi.exe
  2⤵
  PID:6416
- C:\Windows\System\ldRGeGv.exe
  C:\Windows\System\ldRGeGv.exe
  2⤵
  PID:6440
- C:\Windows\System\ClrbkvX.exe
  C:\Windows\System\ClrbkvX.exe
  2⤵
  PID:6468
- C:\Windows\System\qQjQebr.exe
  C:\Windows\System\qQjQebr.exe
  2⤵
  PID:6496
- C:\Windows\System\SCigRBA.exe
  C:\Windows\System\SCigRBA.exe
  2⤵
  PID:6524
- C:\Windows\System\XQyITXY.exe
  C:\Windows\System\XQyITXY.exe
  2⤵
  PID:6552
- C:\Windows\System\IUfBtcs.exe
  C:\Windows\System\IUfBtcs.exe
  2⤵
  PID:6580
- C:\Windows\System\InYPnVg.exe
  C:\Windows\System\InYPnVg.exe
  2⤵
  PID:6596
- C:\Windows\System\ifTxaRC.exe
  C:\Windows\System\ifTxaRC.exe
  2⤵
  PID:6616
- C:\Windows\System\WmvwMLV.exe
  C:\Windows\System\WmvwMLV.exe
  2⤵
  PID:6636
- C:\Windows\System\BhqiOvn.exe
  C:\Windows\System\BhqiOvn.exe
  2⤵
  PID:6668
- C:\Windows\System\ILswzQd.exe
  C:\Windows\System\ILswzQd.exe
  2⤵
  PID:6700
- C:\Windows\System\XCIXMLx.exe
  C:\Windows\System\XCIXMLx.exe
  2⤵
  PID:6724
- C:\Windows\System\lflUYKE.exe
  C:\Windows\System\lflUYKE.exe
  2⤵
  PID:6748
- C:\Windows\System\mPHyGza.exe
  C:\Windows\System\mPHyGza.exe
  2⤵
  PID:6784
- C:\Windows\System\wsnUniF.exe
  C:\Windows\System\wsnUniF.exe
  2⤵
  PID:6808
- C:\Windows\System\eGKlXTA.exe
  C:\Windows\System\eGKlXTA.exe
  2⤵
  PID:6848
- C:\Windows\System\obuQvHV.exe
  C:\Windows\System\obuQvHV.exe
  2⤵
  PID:6864
- C:\Windows\System\LIXrQOP.exe
  C:\Windows\System\LIXrQOP.exe
  2⤵
  PID:6896
- C:\Windows\System\EfmraSl.exe
  C:\Windows\System\EfmraSl.exe
  2⤵
  PID:6920
- C:\Windows\System\ZLvSeTK.exe
  C:\Windows\System\ZLvSeTK.exe
  2⤵
  PID:6940
- C:\Windows\System\ffDCuXN.exe
  C:\Windows\System\ffDCuXN.exe
  2⤵
  PID:6960
- C:\Windows\System\rtyRlKj.exe
  C:\Windows\System\rtyRlKj.exe
  2⤵
  PID:6996
- C:\Windows\System\mflMoFR.exe
  C:\Windows\System\mflMoFR.exe
  2⤵
  PID:7016
- C:\Windows\System\PnvLiCs.exe
  C:\Windows\System\PnvLiCs.exe
  2⤵
  PID:7048
- C:\Windows\System\HOvynLM.exe
  C:\Windows\System\HOvynLM.exe
  2⤵
  PID:7080
- C:\Windows\System\UCZVhRm.exe
  C:\Windows\System\UCZVhRm.exe
  2⤵
  PID:7112
- C:\Windows\System\miPbTKq.exe
  C:\Windows\System\miPbTKq.exe
  2⤵
  PID:7144
- C:\Windows\System\DlfJRLo.exe
  C:\Windows\System\DlfJRLo.exe
  2⤵
  PID:5536
- C:\Windows\System\uMsqCaw.exe
  C:\Windows\System\uMsqCaw.exe
  2⤵
  PID:6160
- C:\Windows\System\MDsipGe.exe
  C:\Windows\System\MDsipGe.exe
  2⤵
  PID:6260
- C:\Windows\System\hkUAoPt.exe
  C:\Windows\System\hkUAoPt.exe
  2⤵
  PID:6288
- C:\Windows\System\NPDrpFq.exe
  C:\Windows\System\NPDrpFq.exe
  2⤵
  PID:6368
- C:\Windows\System\rDoFpwl.exe
  C:\Windows\System\rDoFpwl.exe
  2⤵
  PID:6456
- C:\Windows\System\GhdtGqV.exe
  C:\Windows\System\GhdtGqV.exe
  2⤵
  PID:6484
- C:\Windows\System\gypASWf.exe
  C:\Windows\System\gypASWf.exe
  2⤵
  PID:6568
- C:\Windows\System\oeJRoEk.exe
  C:\Windows\System\oeJRoEk.exe
  2⤵
  PID:6624
- C:\Windows\System\evOduuc.exe
  C:\Windows\System\evOduuc.exe
  2⤵
  PID:6688
- C:\Windows\System\JUHWkAu.exe
  C:\Windows\System\JUHWkAu.exe
  2⤵
  PID:6768
- C:\Windows\System\qkHvsJB.exe
  C:\Windows\System\qkHvsJB.exe
  2⤵
  PID:6820
- C:\Windows\System\qHNFSUA.exe
  C:\Windows\System\qHNFSUA.exe
  2⤵
  PID:6908
- C:\Windows\System\Cbifwwn.exe
  C:\Windows\System\Cbifwwn.exe
  2⤵
  PID:6984
- C:\Windows\System\OXafipG.exe
  C:\Windows\System\OXafipG.exe
  2⤵
  PID:7096
- C:\Windows\System\ppcHUiN.exe
  C:\Windows\System\ppcHUiN.exe
  2⤵
  PID:7164
- C:\Windows\System\jkGnnzY.exe
  C:\Windows\System\jkGnnzY.exe
  2⤵
  PID:7120
- C:\Windows\System\bbTCfTB.exe
  C:\Windows\System\bbTCfTB.exe
  2⤵
  PID:6424
- C:\Windows\System\OaOGDVg.exe
  C:\Windows\System\OaOGDVg.exe
  2⤵
  PID:6436
- C:\Windows\System\sHkhItL.exe
  C:\Windows\System\sHkhItL.exe
  2⤵
  PID:6708
- C:\Windows\System\rXoAUpb.exe
  C:\Windows\System\rXoAUpb.exe
  2⤵
  PID:6744
- C:\Windows\System\welgWCe.exe
  C:\Windows\System\welgWCe.exe
  2⤵
  PID:6800
- C:\Windows\System\qklmqUN.exe
  C:\Windows\System\qklmqUN.exe
  2⤵
  PID:6892
- C:\Windows\System\mQmsjlr.exe
  C:\Windows\System\mQmsjlr.exe
  2⤵
  PID:6176
- C:\Windows\System\VVaTjbj.exe
  C:\Windows\System\VVaTjbj.exe
  2⤵
  PID:6536
- C:\Windows\System\VkInCci.exe
  C:\Windows\System\VkInCci.exe
  2⤵
  PID:6696
- C:\Windows\System\lUSfBAN.exe
  C:\Windows\System\lUSfBAN.exe
  2⤵
  PID:6876
- C:\Windows\System\ugiTkNj.exe
  C:\Windows\System\ugiTkNj.exe
  2⤵
  PID:7180
- C:\Windows\System\qCcpDVQ.exe
  C:\Windows\System\qCcpDVQ.exe
  2⤵
  PID:7200
- C:\Windows\System\cOajlEy.exe
  C:\Windows\System\cOajlEy.exe
  2⤵
  PID:7232
- C:\Windows\System\Iinadyl.exe
  C:\Windows\System\Iinadyl.exe
  2⤵
  PID:7256
- C:\Windows\System\rlkIdNn.exe
  C:\Windows\System\rlkIdNn.exe
  2⤵
  PID:7280
- C:\Windows\System\EpdWuqn.exe
  C:\Windows\System\EpdWuqn.exe
  2⤵
  PID:7300
- C:\Windows\System\pudXYWr.exe
  C:\Windows\System\pudXYWr.exe
  2⤵
  PID:7324
- C:\Windows\System\sSzkWYa.exe
  C:\Windows\System\sSzkWYa.exe
  2⤵
  PID:7352
- C:\Windows\System\YnLXGyd.exe
  C:\Windows\System\YnLXGyd.exe
  2⤵
  PID:7380
- C:\Windows\System\cjJSBtA.exe
  C:\Windows\System\cjJSBtA.exe
  2⤵
  PID:7416
- C:\Windows\System\QNfTeeP.exe
  C:\Windows\System\QNfTeeP.exe
  2⤵
  PID:7448
- C:\Windows\System\phVWxBE.exe
  C:\Windows\System\phVWxBE.exe
  2⤵
  PID:7476
- C:\Windows\System\NVONAnB.exe
  C:\Windows\System\NVONAnB.exe
  2⤵
  PID:7500
- C:\Windows\System\LrNruMY.exe
  C:\Windows\System\LrNruMY.exe
  2⤵
  PID:7528
- C:\Windows\System\xbFbcCH.exe
  C:\Windows\System\xbFbcCH.exe
  2⤵
  PID:7548
- C:\Windows\System\YHRbPGZ.exe
  C:\Windows\System\YHRbPGZ.exe
  2⤵
  PID:7580
- C:\Windows\System\mvAIFob.exe
  C:\Windows\System\mvAIFob.exe
  2⤵
  PID:7600
- C:\Windows\System\lZUzAhR.exe
  C:\Windows\System\lZUzAhR.exe
  2⤵
  PID:7632
- C:\Windows\System\rUvBYeF.exe
  C:\Windows\System\rUvBYeF.exe
  2⤵
  PID:7656
- C:\Windows\System\iqiFfyO.exe
  C:\Windows\System\iqiFfyO.exe
  2⤵
  PID:7696
- C:\Windows\System\yEGthhe.exe
  C:\Windows\System\yEGthhe.exe
  2⤵
  PID:7736
- C:\Windows\System\vOQBtEV.exe
  C:\Windows\System\vOQBtEV.exe
  2⤵
  PID:7760
- C:\Windows\System\NxKAVkQ.exe
  C:\Windows\System\NxKAVkQ.exe
  2⤵
  PID:7792
- C:\Windows\System\iMJEJHA.exe
  C:\Windows\System\iMJEJHA.exe
  2⤵
  PID:7808
- C:\Windows\System\hwxKROs.exe
  C:\Windows\System\hwxKROs.exe
  2⤵
  PID:7828
- C:\Windows\System\SEtibzI.exe
  C:\Windows\System\SEtibzI.exe
  2⤵
  PID:7852
- C:\Windows\System\TIONWgJ.exe
  C:\Windows\System\TIONWgJ.exe
  2⤵
  PID:7884
- C:\Windows\System\GeErHim.exe
  C:\Windows\System\GeErHim.exe
  2⤵
  PID:7908
- C:\Windows\System\WUQrBgx.exe
  C:\Windows\System\WUQrBgx.exe
  2⤵
  PID:7932
- C:\Windows\System\LxdDOiN.exe
  C:\Windows\System\LxdDOiN.exe
  2⤵
  PID:7960
- C:\Windows\System\mgWHWRr.exe
  C:\Windows\System\mgWHWRr.exe
  2⤵
  PID:7996
- C:\Windows\System\rTzotDK.exe
  C:\Windows\System\rTzotDK.exe
  2⤵
  PID:8024
- C:\Windows\System\tAbNaOo.exe
  C:\Windows\System\tAbNaOo.exe
  2⤵
  PID:8044
- C:\Windows\System\olXlRLZ.exe
  C:\Windows\System\olXlRLZ.exe
  2⤵
  PID:8064
- C:\Windows\System\nNxXUdt.exe
  C:\Windows\System\nNxXUdt.exe
  2⤵
  PID:8088
- C:\Windows\System\yZfWRDk.exe
  C:\Windows\System\yZfWRDk.exe
  2⤵
  PID:8116
- C:\Windows\System\NiCKVLz.exe
  C:\Windows\System\NiCKVLz.exe
  2⤵
  PID:8144
- C:\Windows\System\fLalIEK.exe
  C:\Windows\System\fLalIEK.exe
  2⤵
  PID:8176
- C:\Windows\System\QtOAGPc.exe
  C:\Windows\System\QtOAGPc.exe
  2⤵
  PID:6612
- C:\Windows\System\EtLXyPK.exe
  C:\Windows\System\EtLXyPK.exe
  2⤵
  PID:7276
- C:\Windows\System\KQhxxPX.exe
  C:\Windows\System\KQhxxPX.exe
  2⤵
  PID:7336
- C:\Windows\System\vwbWhou.exe
  C:\Windows\System\vwbWhou.exe
  2⤵
  PID:7364
- C:\Windows\System\JDvIphX.exe
  C:\Windows\System\JDvIphX.exe
  2⤵
  PID:7440
- C:\Windows\System\iOBQJSV.exe
  C:\Windows\System\iOBQJSV.exe
  2⤵
  PID:7512
- C:\Windows\System\SxcqUue.exe
  C:\Windows\System\SxcqUue.exe
  2⤵
  PID:7596
- C:\Windows\System\MZGsYRH.exe
  C:\Windows\System\MZGsYRH.exe
  2⤵
  PID:7652
- C:\Windows\System\QxQBQVY.exe
  C:\Windows\System\QxQBQVY.exe
  2⤵
  PID:7684
- C:\Windows\System\SoVWnjg.exe
  C:\Windows\System\SoVWnjg.exe
  2⤵
  PID:7784
- C:\Windows\System\QUwmPVd.exe
  C:\Windows\System\QUwmPVd.exe
  2⤵
  PID:7872
- C:\Windows\System\XoalkQg.exe
  C:\Windows\System\XoalkQg.exe
  2⤵
  PID:7892
- C:\Windows\System\qSErTtz.exe
  C:\Windows\System\qSErTtz.exe
  2⤵
  PID:7972
- C:\Windows\System\qjuoPsF.exe
  C:\Windows\System\qjuoPsF.exe
  2⤵
  PID:8020
- C:\Windows\System\gTnnvlU.exe
  C:\Windows\System\gTnnvlU.exe
  2⤵
  PID:8040
- C:\Windows\System\woSvORC.exe
  C:\Windows\System\woSvORC.exe
  2⤵
  PID:8132
- C:\Windows\System\cRKpVDv.exe
  C:\Windows\System\cRKpVDv.exe
  2⤵
  PID:7228
- C:\Windows\System\QaIApZh.exe
  C:\Windows\System\QaIApZh.exe
  2⤵
  PID:7400
- C:\Windows\System\PBUDmDh.exe
  C:\Windows\System\PBUDmDh.exe
  2⤵
  PID:7316
- C:\Windows\System\ItYoHeS.exe
  C:\Windows\System\ItYoHeS.exe
  2⤵
  PID:7752
- C:\Windows\System\crxjipz.exe
  C:\Windows\System\crxjipz.exe
  2⤵
  PID:7568
- C:\Windows\System\KPgNEKj.exe
  C:\Windows\System\KPgNEKj.exe
  2⤵
  PID:7712
- C:\Windows\System\TAbaKKn.exe
  C:\Windows\System\TAbaKKn.exe
  2⤵
  PID:8080
- C:\Windows\System\YoQlyhB.exe
  C:\Windows\System\YoQlyhB.exe
  2⤵
  PID:7272
- C:\Windows\System\TInVWep.exe
  C:\Windows\System\TInVWep.exe
  2⤵
  PID:7848
- C:\Windows\System\BKHZmHl.exe
  C:\Windows\System\BKHZmHl.exe
  2⤵
  PID:7564
- C:\Windows\System\JocuHvn.exe
  C:\Windows\System\JocuHvn.exe
  2⤵
  PID:8212
- C:\Windows\System\qUMgeWx.exe
  C:\Windows\System\qUMgeWx.exe
  2⤵
  PID:8236
- C:\Windows\System\tDjRgoG.exe
  C:\Windows\System\tDjRgoG.exe
  2⤵
  PID:8268
- C:\Windows\System\ZIYAtos.exe
  C:\Windows\System\ZIYAtos.exe
  2⤵
  PID:8300
- C:\Windows\System\YalvNsn.exe
  C:\Windows\System\YalvNsn.exe
  2⤵
  PID:8328
- C:\Windows\System\oURorwq.exe
  C:\Windows\System\oURorwq.exe
  2⤵
  PID:8360
- C:\Windows\System\UAeVelS.exe
  C:\Windows\System\UAeVelS.exe
  2⤵
  PID:8388
- C:\Windows\System\ShwhyMG.exe
  C:\Windows\System\ShwhyMG.exe
  2⤵
  PID:8424
- C:\Windows\System\bUvVecP.exe
  C:\Windows\System\bUvVecP.exe
  2⤵
  PID:8448
- C:\Windows\System\mkvQErz.exe
  C:\Windows\System\mkvQErz.exe
  2⤵
  PID:8480
- C:\Windows\System\WYDMjwp.exe
  C:\Windows\System\WYDMjwp.exe
  2⤵
  PID:8508
- C:\Windows\System\GAqceDS.exe
  C:\Windows\System\GAqceDS.exe
  2⤵
  PID:8540
- C:\Windows\System\TnRgyzC.exe
  C:\Windows\System\TnRgyzC.exe
  2⤵
  PID:8572
- C:\Windows\System\VdIJtcm.exe
  C:\Windows\System\VdIJtcm.exe
  2⤵
  PID:8600
- C:\Windows\System\OgvERNL.exe
  C:\Windows\System\OgvERNL.exe
  2⤵
  PID:8628
- C:\Windows\System\ByflQqV.exe
  C:\Windows\System\ByflQqV.exe
  2⤵
  PID:8652
- C:\Windows\System\MbmRaRx.exe
  C:\Windows\System\MbmRaRx.exe
  2⤵
  PID:8680
- C:\Windows\System\ppUXOVF.exe
  C:\Windows\System\ppUXOVF.exe
  2⤵
  PID:8712
- C:\Windows\System\BZbRKON.exe
  C:\Windows\System\BZbRKON.exe
  2⤵
  PID:8740
- C:\Windows\System\Klejccy.exe
  C:\Windows\System\Klejccy.exe
  2⤵
  PID:8760
- C:\Windows\System\OebNXuE.exe
  C:\Windows\System\OebNXuE.exe
  2⤵
  PID:8784
- C:\Windows\System\AONoVbJ.exe
  C:\Windows\System\AONoVbJ.exe
  2⤵
  PID:8820
- C:\Windows\System\cXuLNZq.exe
  C:\Windows\System\cXuLNZq.exe
  2⤵
  PID:8856
- C:\Windows\System\CWVeKqE.exe
  C:\Windows\System\CWVeKqE.exe
  2⤵
  PID:8880
- C:\Windows\System\qDUoSOS.exe
  C:\Windows\System\qDUoSOS.exe
  2⤵
  PID:8912
- C:\Windows\System\cLapYfV.exe
  C:\Windows\System\cLapYfV.exe
  2⤵
  PID:8944
- C:\Windows\System\DkqWDor.exe
  C:\Windows\System\DkqWDor.exe
  2⤵
  PID:8968
- C:\Windows\System\GuBijdn.exe
  C:\Windows\System\GuBijdn.exe
  2⤵
  PID:8988
- C:\Windows\System\CvtiEdm.exe
  C:\Windows\System\CvtiEdm.exe
  2⤵
  PID:9016
- C:\Windows\System\YOZRbbm.exe
  C:\Windows\System\YOZRbbm.exe
  2⤵
  PID:9048
- C:\Windows\System\PgpxaLa.exe
  C:\Windows\System\PgpxaLa.exe
  2⤵
  PID:9084
- C:\Windows\System\PhwhvyE.exe
  C:\Windows\System\PhwhvyE.exe
  2⤵
  PID:9116
- C:\Windows\System\hpmbuYB.exe
  C:\Windows\System\hpmbuYB.exe
  2⤵
  PID:9144
- C:\Windows\System\npeVkAe.exe
  C:\Windows\System\npeVkAe.exe
  2⤵
  PID:9168
- C:\Windows\System\DMopSLl.exe
  C:\Windows\System\DMopSLl.exe
  2⤵
  PID:9204
- C:\Windows\System\yyLeBRT.exe
  C:\Windows\System\yyLeBRT.exe
  2⤵
  PID:7348
- C:\Windows\System\bUJEzIx.exe
  C:\Windows\System\bUJEzIx.exe
  2⤵
  PID:7896
- C:\Windows\System\GCWBBaj.exe
  C:\Windows\System\GCWBBaj.exe
  2⤵
  PID:8260
- C:\Windows\System\Yzsmbge.exe
  C:\Windows\System\Yzsmbge.exe
  2⤵
  PID:8288
- C:\Windows\System\QaTUSah.exe
  C:\Windows\System\QaTUSah.exe
  2⤵
  PID:8384
- C:\Windows\System\PbgjAwk.exe
  C:\Windows\System\PbgjAwk.exe
  2⤵
  PID:8468
- C:\Windows\System\SLvgikj.exe
  C:\Windows\System\SLvgikj.exe
  2⤵
  PID:8532
- C:\Windows\System\QhLjMMf.exe
  C:\Windows\System\QhLjMMf.exe
  2⤵
  PID:8580
- C:\Windows\System\JdjRkRS.exe
  C:\Windows\System\JdjRkRS.exe
  2⤵
  PID:8708
- C:\Windows\System\vmWPyaD.exe
  C:\Windows\System\vmWPyaD.exe
  2⤵
  PID:8756
- C:\Windows\System\DxofWcR.exe
  C:\Windows\System\DxofWcR.exe
  2⤵
  PID:8780
- C:\Windows\System\rBSfxvs.exe
  C:\Windows\System\rBSfxvs.exe
  2⤵
  PID:8844
- C:\Windows\System\rzEatHG.exe
  C:\Windows\System\rzEatHG.exe
  2⤵
  PID:8876
- C:\Windows\System\qnqldbh.exe
  C:\Windows\System\qnqldbh.exe
  2⤵
  PID:8976
- C:\Windows\System\HDuruEc.exe
  C:\Windows\System\HDuruEc.exe
  2⤵
  PID:9060
- C:\Windows\System\BdTwEom.exe
  C:\Windows\System\BdTwEom.exe
  2⤵
  PID:9096
- C:\Windows\System\BoijYKW.exe
  C:\Windows\System\BoijYKW.exe
  2⤵
  PID:8012
- C:\Windows\System\ZCVqrDZ.exe
  C:\Windows\System\ZCVqrDZ.exe
  2⤵
  PID:8108
- C:\Windows\System\oDgkWJj.exe
  C:\Windows\System\oDgkWJj.exe
  2⤵
  PID:8440
- C:\Windows\System\IZbHMFv.exe
  C:\Windows\System\IZbHMFv.exe
  2⤵
  PID:8640
- C:\Windows\System\iNyypCJ.exe
  C:\Windows\System\iNyypCJ.exe
  2⤵
  PID:8496
- C:\Windows\System\auxqhXD.exe
  C:\Windows\System\auxqhXD.exe
  2⤵
  PID:7576
- C:\Windows\System\LBQfqUB.exe
  C:\Windows\System\LBQfqUB.exe
  2⤵
  PID:8888
- C:\Windows\System\zqeuwxg.exe
  C:\Windows\System\zqeuwxg.exe
  2⤵
  PID:9108
- C:\Windows\System\HTLDlwO.exe
  C:\Windows\System\HTLDlwO.exe
  2⤵
  PID:9000
- C:\Windows\System\SpYuefJ.exe
  C:\Windows\System\SpYuefJ.exe
  2⤵
  PID:7772
- C:\Windows\System\XbeHWQa.exe
  C:\Windows\System\XbeHWQa.exe
  2⤵
  PID:8616
- C:\Windows\System\EWFhmEF.exe
  C:\Windows\System\EWFhmEF.exe
  2⤵
  PID:8504
- C:\Windows\System\NgeYCrV.exe
  C:\Windows\System\NgeYCrV.exe
  2⤵
  PID:9240
- C:\Windows\System\QtMeICj.exe
  C:\Windows\System\QtMeICj.exe
  2⤵
  PID:9264
- C:\Windows\System\BrzRRiX.exe
  C:\Windows\System\BrzRRiX.exe
  2⤵
  PID:9288
- C:\Windows\System\ngYLmuq.exe
  C:\Windows\System\ngYLmuq.exe
  2⤵
  PID:9312
- C:\Windows\System\ZUUipJE.exe
  C:\Windows\System\ZUUipJE.exe
  2⤵
  PID:9340
- C:\Windows\System\mBKkxLn.exe
  C:\Windows\System\mBKkxLn.exe
  2⤵
  PID:9364
- C:\Windows\System\zSmQdTV.exe
  C:\Windows\System\zSmQdTV.exe
  2⤵
  PID:9384
- C:\Windows\System\CPtSpcf.exe
  C:\Windows\System\CPtSpcf.exe
  2⤵
  PID:9516
- C:\Windows\System\ssDvZRV.exe
  C:\Windows\System\ssDvZRV.exe
  2⤵
  PID:9532
- C:\Windows\System\CxlzgcP.exe
  C:\Windows\System\CxlzgcP.exe
  2⤵
  PID:9548
- C:\Windows\System\rYcqvEK.exe
  C:\Windows\System\rYcqvEK.exe
  2⤵
  PID:9576
- C:\Windows\System\pfXNzMv.exe
  C:\Windows\System\pfXNzMv.exe
  2⤵
  PID:9604
- C:\Windows\System\pPnVvNi.exe
  C:\Windows\System\pPnVvNi.exe
  2⤵
  PID:9632
- C:\Windows\System\iHSroDH.exe
  C:\Windows\System\iHSroDH.exe
  2⤵
  PID:9652
- C:\Windows\System\ylBFqGk.exe
  C:\Windows\System\ylBFqGk.exe
  2⤵
  PID:9676
- C:\Windows\System\UrMoTzM.exe
  C:\Windows\System\UrMoTzM.exe
  2⤵
  PID:9692
- C:\Windows\System\CRnYufM.exe
  C:\Windows\System\CRnYufM.exe
  2⤵
  PID:9716
- C:\Windows\System\SWxfAvu.exe
  C:\Windows\System\SWxfAvu.exe
  2⤵
  PID:9736
- C:\Windows\System\ouoSkJW.exe
  C:\Windows\System\ouoSkJW.exe
  2⤵
  PID:9752
- C:\Windows\System\bKlTGcj.exe
  C:\Windows\System\bKlTGcj.exe
  2⤵
  PID:9776
- C:\Windows\System\wJVAFOL.exe
  C:\Windows\System\wJVAFOL.exe
  2⤵
  PID:9804
- C:\Windows\System\gPnjdGn.exe
  C:\Windows\System\gPnjdGn.exe
  2⤵
  PID:9828
- C:\Windows\System\pJTnirf.exe
  C:\Windows\System\pJTnirf.exe
  2⤵
  PID:9860
- C:\Windows\System\JwhEOVI.exe
  C:\Windows\System\JwhEOVI.exe
  2⤵
  PID:9888
- C:\Windows\System\mmqESiE.exe
  C:\Windows\System\mmqESiE.exe
  2⤵
  PID:9924
- C:\Windows\System\zmzUMFo.exe
  C:\Windows\System\zmzUMFo.exe
  2⤵
  PID:9948
- C:\Windows\System\NAgIhqH.exe
  C:\Windows\System\NAgIhqH.exe
  2⤵
  PID:9968
- C:\Windows\System\qrsQKxV.exe
  C:\Windows\System\qrsQKxV.exe
  2⤵
  PID:9988
- C:\Windows\System\FzZfSZw.exe
  C:\Windows\System\FzZfSZw.exe
  2⤵
  PID:10020
- C:\Windows\System\MjRYzxV.exe
  C:\Windows\System\MjRYzxV.exe
  2⤵
  PID:10048
- C:\Windows\System\uHKkLtz.exe
  C:\Windows\System\uHKkLtz.exe
  2⤵
  PID:10084
- C:\Windows\System\iUXjKkn.exe
  C:\Windows\System\iUXjKkn.exe
  2⤵
  PID:10120
- C:\Windows\System\nTfWDzF.exe
  C:\Windows\System\nTfWDzF.exe
  2⤵
  PID:10136
- C:\Windows\System\EtKlxQK.exe
  C:\Windows\System\EtKlxQK.exe
  2⤵
  PID:10160
- C:\Windows\System\EzlIrdw.exe
  C:\Windows\System\EzlIrdw.exe
  2⤵
  PID:10180
- C:\Windows\System\XfIMnQJ.exe
  C:\Windows\System\XfIMnQJ.exe
  2⤵
  PID:10204
- C:\Windows\System\UZTQKGA.exe
  C:\Windows\System\UZTQKGA.exe
  2⤵
  PID:10232
- C:\Windows\System\nAzNhVd.exe
  C:\Windows\System\nAzNhVd.exe
  2⤵
  PID:8344
- C:\Windows\System\WQAzluL.exe
  C:\Windows\System\WQAzluL.exe
  2⤵
  PID:8812
- C:\Windows\System\WDlKgcR.exe
  C:\Windows\System\WDlKgcR.exe
  2⤵
  PID:9320
- C:\Windows\System\VnEyUyk.exe
  C:\Windows\System\VnEyUyk.exe
  2⤵
  PID:9356
- C:\Windows\System\wqQVVzs.exe
  C:\Windows\System\wqQVVzs.exe
  2⤵
  PID:9472
- C:\Windows\System\QPWJrzV.exe
  C:\Windows\System\QPWJrzV.exe
  2⤵
  PID:9492
- C:\Windows\System\uMbXoIz.exe
  C:\Windows\System\uMbXoIz.exe
  2⤵
  PID:9560
- C:\Windows\System\tCFdspP.exe
  C:\Windows\System\tCFdspP.exe
  2⤵
  PID:9644
- C:\Windows\System\xJjrQmt.exe
  C:\Windows\System\xJjrQmt.exe
  2⤵
  PID:9708
- C:\Windows\System\vjLfuJH.exe
  C:\Windows\System\vjLfuJH.exe
  2⤵
  PID:9812
- C:\Windows\System\BaiQupW.exe
  C:\Windows\System\BaiQupW.exe
  2⤵
  PID:9848
- C:\Windows\System\oRwjQhT.exe
  C:\Windows\System\oRwjQhT.exe
  2⤵
  PID:9940
- C:\Windows\System\dGCiYmw.exe
  C:\Windows\System\dGCiYmw.exe
  2⤵
  PID:10016
- C:\Windows\System\FfVzEHS.exe
  C:\Windows\System\FfVzEHS.exe
  2⤵
  PID:9956
- C:\Windows\System\lwMWoJM.exe
  C:\Windows\System\lwMWoJM.exe
  2⤵
  PID:10104
- C:\Windows\System\KzcmZoE.exe
  C:\Windows\System\KzcmZoE.exe
  2⤵
  PID:9252
- C:\Windows\System\lvjHrCW.exe
  C:\Windows\System\lvjHrCW.exe
  2⤵
  PID:8356
- C:\Windows\System\hCqaBuv.exe
  C:\Windows\System\hCqaBuv.exe
  2⤵
  PID:9300
- C:\Windows\System\yiEAHEl.exe
  C:\Windows\System\yiEAHEl.exe
  2⤵
  PID:9616
- C:\Windows\System\RDxVXNB.exe
  C:\Windows\System\RDxVXNB.exe
  2⤵
  PID:9336
- C:\Windows\System\lXHtPcc.exe
  C:\Windows\System\lXHtPcc.exe
  2⤵
  PID:9588
- C:\Windows\System\kzCwJhK.exe
  C:\Windows\System\kzCwJhK.exe
  2⤵
  PID:9844
- C:\Windows\System\nWgOEHL.exe
  C:\Windows\System\nWgOEHL.exe
  2⤵
  PID:10128
- C:\Windows\System\rdBsKNm.exe
  C:\Windows\System\rdBsKNm.exe
  2⤵
  PID:9792
- C:\Windows\System\kgUZRss.exe
  C:\Windows\System\kgUZRss.exe
  2⤵
  PID:10064
- C:\Windows\System\DaBiZJy.exe
  C:\Windows\System\DaBiZJy.exe
  2⤵
  PID:9276
- C:\Windows\System\eKurbdm.exe
  C:\Windows\System\eKurbdm.exe
  2⤵
  PID:9664
- C:\Windows\System\JiJDfkv.exe
  C:\Windows\System\JiJDfkv.exe
  2⤵
  PID:9540
- C:\Windows\System\ghQjvbR.exe
  C:\Windows\System\ghQjvbR.exe
  2⤵
  PID:10264
- C:\Windows\System\ZbwJkvW.exe
  C:\Windows\System\ZbwJkvW.exe
  2⤵
  PID:10292
- C:\Windows\System\ZBPqOZh.exe
  C:\Windows\System\ZBPqOZh.exe
  2⤵
  PID:10316
- C:\Windows\System\iVfhmSF.exe
  C:\Windows\System\iVfhmSF.exe
  2⤵
  PID:10344
- C:\Windows\System\jNlclhl.exe
  C:\Windows\System\jNlclhl.exe
  2⤵
  PID:10380
- C:\Windows\System\TkgTpvr.exe
  C:\Windows\System\TkgTpvr.exe
  2⤵
  PID:10432
- C:\Windows\System\VzfxPyE.exe
  C:\Windows\System\VzfxPyE.exe
  2⤵
  PID:10452
- C:\Windows\System\yPPtqgf.exe
  C:\Windows\System\yPPtqgf.exe
  2⤵
  PID:10476
- C:\Windows\System\JmvSQZH.exe
  C:\Windows\System\JmvSQZH.exe
  2⤵
  PID:10500
- C:\Windows\System\WlQOmZj.exe
  C:\Windows\System\WlQOmZj.exe
  2⤵
  PID:10532
- C:\Windows\System\otcfNtA.exe
  C:\Windows\System\otcfNtA.exe
  2⤵
  PID:10552
- C:\Windows\System\HFCtZyy.exe
  C:\Windows\System\HFCtZyy.exe
  2⤵
  PID:10580
- C:\Windows\System\UQLjnqB.exe
  C:\Windows\System\UQLjnqB.exe
  2⤵
  PID:10604
- C:\Windows\System\QijZyFV.exe
  C:\Windows\System\QijZyFV.exe
  2⤵
  PID:10628
- C:\Windows\System\VLgesde.exe
  C:\Windows\System\VLgesde.exe
  2⤵
  PID:10652
- C:\Windows\System\TjjobGa.exe
  C:\Windows\System\TjjobGa.exe
  2⤵
  PID:10676
- C:\Windows\System\tdRmRfe.exe
  C:\Windows\System\tdRmRfe.exe
  2⤵
  PID:10716
- C:\Windows\System\xpegukk.exe
  C:\Windows\System\xpegukk.exe
  2⤵
  PID:10744
- C:\Windows\System\VLgdgEB.exe
  C:\Windows\System\VLgdgEB.exe
  2⤵
  PID:10768
- C:\Windows\System\HTPwSwS.exe
  C:\Windows\System\HTPwSwS.exe
  2⤵
  PID:10796
- C:\Windows\System\oUObjCf.exe
  C:\Windows\System\oUObjCf.exe
  2⤵
  PID:10828
- C:\Windows\System\agGDahJ.exe
  C:\Windows\System\agGDahJ.exe
  2⤵
  PID:10852
- C:\Windows\System\UarkeuU.exe
  C:\Windows\System\UarkeuU.exe
  2⤵
  PID:10880
- C:\Windows\System\efQELbL.exe
  C:\Windows\System\efQELbL.exe
  2⤵
  PID:10916
- C:\Windows\System\cIUDRlg.exe
  C:\Windows\System\cIUDRlg.exe
  2⤵
  PID:10932
- C:\Windows\System\fGoRyNW.exe
  C:\Windows\System\fGoRyNW.exe
  2⤵
  PID:10968
- C:\Windows\System\auDmHbG.exe
  C:\Windows\System\auDmHbG.exe
  2⤵
  PID:10992
- C:\Windows\System\OpsDKcj.exe
  C:\Windows\System\OpsDKcj.exe
  2⤵
  PID:11024
- C:\Windows\System\FMhtvGc.exe
  C:\Windows\System\FMhtvGc.exe
  2⤵
  PID:11052
- C:\Windows\System\fnIftRD.exe
  C:\Windows\System\fnIftRD.exe
  2⤵
  PID:11080
- C:\Windows\System\PDsDbhF.exe
  C:\Windows\System\PDsDbhF.exe
  2⤵
  PID:11108
- C:\Windows\System\DIHMpyV.exe
  C:\Windows\System\DIHMpyV.exe
  2⤵
  PID:11140
- C:\Windows\System\ohnwpdv.exe
  C:\Windows\System\ohnwpdv.exe
  2⤵
  PID:11156
- C:\Windows\System\jGutusI.exe
  C:\Windows\System\jGutusI.exe
  2⤵
  PID:11188
- C:\Windows\System\HixzSKv.exe
  C:\Windows\System\HixzSKv.exe
  2⤵
  PID:11212
- C:\Windows\System\ptSJyuG.exe
  C:\Windows\System\ptSJyuG.exe
  2⤵
  PID:11236
- C:\Windows\System\ctMVXBx.exe
  C:\Windows\System\ctMVXBx.exe
  2⤵
  PID:11260
- C:\Windows\System\OBuROvn.exe
  C:\Windows\System\OBuROvn.exe
  2⤵
  PID:10192
- C:\Windows\System\CEBMIlF.exe
  C:\Windows\System\CEBMIlF.exe
  2⤵
  PID:10276
- C:\Windows\System\FXyojUi.exe
  C:\Windows\System\FXyojUi.exe
  2⤵
  PID:9324
- C:\Windows\System\NsVMpfb.exe
  C:\Windows\System\NsVMpfb.exe
  2⤵
  PID:10260
- C:\Windows\System\cBstoKh.exe
  C:\Windows\System\cBstoKh.exe
  2⤵
  PID:10388
- C:\Windows\System\ZiRXfSF.exe
  C:\Windows\System\ZiRXfSF.exe
  2⤵
  PID:10440
- C:\Windows\System\zEekjPK.exe
  C:\Windows\System\zEekjPK.exe
  2⤵
  PID:10484
- C:\Windows\System\OpLtTFY.exe
  C:\Windows\System\OpLtTFY.exe
  2⤵
  PID:10520
- C:\Windows\System\uGXjMbT.exe
  C:\Windows\System\uGXjMbT.exe
  2⤵
  PID:10760
- C:\Windows\System\RduMczl.exe
  C:\Windows\System\RduMczl.exe
  2⤵
  PID:10624
- C:\Windows\System\FvFhWRv.exe
  C:\Windows\System\FvFhWRv.exe
  2⤵
  PID:10732
- C:\Windows\System\LBmPejS.exe
  C:\Windows\System\LBmPejS.exe
  2⤵
  PID:10900
- C:\Windows\System\QdLCuCx.exe
  C:\Windows\System\QdLCuCx.exe
  2⤵
  PID:10912
- C:\Windows\System\Zaxwhoq.exe
  C:\Windows\System\Zaxwhoq.exe
  2⤵
  PID:11040
- C:\Windows\System\JwqmKCu.exe
  C:\Windows\System\JwqmKCu.exe
  2⤵
  PID:10904
- C:\Windows\System\qSkrQop.exe
  C:\Windows\System\qSkrQop.exe
  2⤵
  PID:11152
- C:\Windows\System\WRGYiRq.exe
  C:\Windows\System\WRGYiRq.exe
  2⤵
  PID:11104
- C:\Windows\System\iRcDZuT.exe
  C:\Windows\System\iRcDZuT.exe
  2⤵
  PID:11148
- C:\Windows\System\PCCtgVP.exe
  C:\Windows\System\PCCtgVP.exe
  2⤵
  PID:11208
- C:\Windows\System\oXiGbrM.exe
  C:\Windows\System\oXiGbrM.exe
  2⤵
  PID:10336
- C:\Windows\System\MSAVcJj.exe
  C:\Windows\System\MSAVcJj.exe
  2⤵
  PID:10588
- C:\Windows\System\LFHLzGJ.exe
  C:\Windows\System\LFHLzGJ.exe
  2⤵
  PID:10312
- C:\Windows\System\FolTwFr.exe
  C:\Windows\System\FolTwFr.exe
  2⤵
  PID:11072
- C:\Windows\System\PofLwwk.exe
  C:\Windows\System\PofLwwk.exe
  2⤵
  PID:10780
- C:\Windows\System\LIuqyYt.exe
  C:\Windows\System\LIuqyYt.exe
  2⤵
  PID:11244
- C:\Windows\System\WDTtLqc.exe
  C:\Windows\System\WDTtLqc.exe
  2⤵
  PID:11280
- C:\Windows\System\dLtTmQN.exe
  C:\Windows\System\dLtTmQN.exe
  2⤵
  PID:11312
- C:\Windows\System\sEOUlhL.exe
  C:\Windows\System\sEOUlhL.exe
  2⤵
  PID:11340
- C:\Windows\System\jdNQPmi.exe
  C:\Windows\System\jdNQPmi.exe
  2⤵
  PID:11364
- C:\Windows\System\bhyiAOz.exe
  C:\Windows\System\bhyiAOz.exe
  2⤵
  PID:11392
- C:\Windows\System\xAakyOf.exe
  C:\Windows\System\xAakyOf.exe
  2⤵
  PID:11412
- C:\Windows\System\qfMrRXA.exe
  C:\Windows\System\qfMrRXA.exe
  2⤵
  PID:11444
- C:\Windows\System\jdLwTJv.exe
  C:\Windows\System\jdLwTJv.exe
  2⤵
  PID:11468
- C:\Windows\System\qepTqAD.exe
  C:\Windows\System\qepTqAD.exe
  2⤵
  PID:11484
- C:\Windows\System\hJoohNo.exe
  C:\Windows\System\hJoohNo.exe
  2⤵
  PID:11520
- C:\Windows\System\FSXZrdC.exe
  C:\Windows\System\FSXZrdC.exe
  2⤵
  PID:11548
- C:\Windows\System\fvAVtdt.exe
  C:\Windows\System\fvAVtdt.exe
  2⤵
  PID:11576
- C:\Windows\System\mfjyEAN.exe
  C:\Windows\System\mfjyEAN.exe
  2⤵
  PID:11604
- C:\Windows\System\iQByCOE.exe
  C:\Windows\System\iQByCOE.exe
  2⤵
  PID:11636
- C:\Windows\System\IfbzxVg.exe
  C:\Windows\System\IfbzxVg.exe
  2⤵
  PID:11680
- C:\Windows\System\iimiTPN.exe
  C:\Windows\System\iimiTPN.exe
  2⤵
  PID:11700
- C:\Windows\System\YpHDiLi.exe
  C:\Windows\System\YpHDiLi.exe
  2⤵
  PID:11732
- C:\Windows\System\ABZIqvo.exe
  C:\Windows\System\ABZIqvo.exe
  2⤵
  PID:11748
- C:\Windows\System\UPGJoNa.exe
  C:\Windows\System\UPGJoNa.exe
  2⤵
  PID:11784
- C:\Windows\System\AKElxek.exe
  C:\Windows\System\AKElxek.exe
  2⤵
  PID:11808
- C:\Windows\System\LzkQxJO.exe
  C:\Windows\System\LzkQxJO.exe
  2⤵
  PID:11836
- C:\Windows\System\NGsmgFZ.exe
  C:\Windows\System\NGsmgFZ.exe
  2⤵
  PID:11864
- C:\Windows\System\SIVHVeU.exe
  C:\Windows\System\SIVHVeU.exe
  2⤵
  PID:11888
- C:\Windows\System\TSmUgtx.exe
  C:\Windows\System\TSmUgtx.exe
  2⤵
  PID:11916
- C:\Windows\System\ImBnXJx.exe
  C:\Windows\System\ImBnXJx.exe
  2⤵
  PID:11940
- C:\Windows\System\LfrsuaN.exe
  C:\Windows\System\LfrsuaN.exe
  2⤵
  PID:11964
- C:\Windows\System\aTqosSA.exe
  C:\Windows\System\aTqosSA.exe
  2⤵
  PID:11992
- C:\Windows\System\TyPErPa.exe
  C:\Windows\System\TyPErPa.exe
  2⤵
  PID:12024
- C:\Windows\System\GJWprzi.exe
  C:\Windows\System\GJWprzi.exe
  2⤵
  PID:12044
- C:\Windows\System\pyzRVKT.exe
  C:\Windows\System\pyzRVKT.exe
  2⤵
  PID:12068
- C:\Windows\System\jQHUmSV.exe
  C:\Windows\System\jQHUmSV.exe
  2⤵
  PID:12104
- C:\Windows\System\pcXTJep.exe
  C:\Windows\System\pcXTJep.exe
  2⤵
  PID:12124
- C:\Windows\System\PLYBMmT.exe
  C:\Windows\System\PLYBMmT.exe
  2⤵
  PID:12152
- C:\Windows\System\LVMeOik.exe
  C:\Windows\System\LVMeOik.exe
  2⤵
  PID:12196
- C:\Windows\System\bUSLDdG.exe
  C:\Windows\System\bUSLDdG.exe
  2⤵
  PID:12220
- C:\Windows\System\FzCZhIl.exe
  C:\Windows\System\FzCZhIl.exe
  2⤵
  PID:12252
- C:\Windows\System\LkfbDVB.exe
  C:\Windows\System\LkfbDVB.exe
  2⤵
  PID:12276
- C:\Windows\System\fHYReSc.exe
  C:\Windows\System\fHYReSc.exe
  2⤵
  PID:10660
- C:\Windows\System\UAQHeMn.exe
  C:\Windows\System\UAQHeMn.exe
  2⤵
  PID:10488
- C:\Windows\System\GbekBWd.exe
  C:\Windows\System\GbekBWd.exe
  2⤵
  PID:10544
- C:\Windows\System\NXgRFwC.exe
  C:\Windows\System\NXgRFwC.exe
  2⤵
  PID:10836
- C:\Windows\System\STCARjD.exe
  C:\Windows\System\STCARjD.exe
  2⤵
  PID:11408
- C:\Windows\System\vqswSNG.exe
  C:\Windows\System\vqswSNG.exe
  2⤵
  PID:11456
- C:\Windows\System\uYNbRUF.exe
  C:\Windows\System\uYNbRUF.exe
  2⤵
  PID:11460
- C:\Windows\System\AEQMomv.exe
  C:\Windows\System\AEQMomv.exe
  2⤵
  PID:11356
- C:\Windows\System\cgeJrmn.exe
  C:\Windows\System\cgeJrmn.exe
  2⤵
  PID:11560
- C:\Windows\System\BOmppYY.exe
  C:\Windows\System\BOmppYY.exe
  2⤵
  PID:11740
- C:\Windows\System\KoloFjP.exe
  C:\Windows\System\KoloFjP.exe
  2⤵
  PID:11820
- C:\Windows\System\zSQOhph.exe
  C:\Windows\System\zSQOhph.exe
  2⤵
  PID:11628
- C:\Windows\System\SRrMeHq.exe
  C:\Windows\System\SRrMeHq.exe
  2⤵
  PID:11668
- C:\Windows\System\iHwMaNL.exe
  C:\Windows\System\iHwMaNL.exe
  2⤵
  PID:11880
- C:\Windows\System\eAIABtd.exe
  C:\Windows\System\eAIABtd.exe
  2⤵
  PID:11960
- C:\Windows\System\SsnvoIS.exe
  C:\Windows\System\SsnvoIS.exe
  2⤵
  PID:11924
- C:\Windows\System\maWysfi.exe
  C:\Windows\System\maWysfi.exe
  2⤵
  PID:11936
- C:\Windows\System\tOUWkdp.exe
  C:\Windows\System\tOUWkdp.exe
  2⤵
  PID:12084
- C:\Windows\System\DzzXNRo.exe
  C:\Windows\System\DzzXNRo.exe
  2⤵
  PID:12112
- C:\Windows\System\IFHtEkG.exe
  C:\Windows\System\IFHtEkG.exe
  2⤵
  PID:12172
- C:\Windows\System\ircVODd.exe
  C:\Windows\System\ircVODd.exe
  2⤵
  PID:11296
- C:\Windows\System\AXDrZrz.exe
  C:\Windows\System\AXDrZrz.exe
  2⤵
  PID:12244
- C:\Windows\System\JzhDjdy.exe
  C:\Windows\System\JzhDjdy.exe
  2⤵
  PID:11380
- C:\Windows\System\bgcgzHr.exe
  C:\Windows\System\bgcgzHr.exe
  2⤵
  PID:12012
- C:\Windows\System\BiJZymu.exe
  C:\Windows\System\BiJZymu.exe
  2⤵
  PID:11760
- C:\Windows\System\gmtLEIy.exe
  C:\Windows\System\gmtLEIy.exe
  2⤵
  PID:11980
- C:\Windows\System\HOkSNsX.exe
  C:\Windows\System\HOkSNsX.exe
  2⤵
  PID:12308
- C:\Windows\System\NiuJMaD.exe
  C:\Windows\System\NiuJMaD.exe
  2⤵
  PID:12344
- C:\Windows\System\xPzgEYi.exe
  C:\Windows\System\xPzgEYi.exe
  2⤵
  PID:12372
- C:\Windows\System\DHhpgxA.exe
  C:\Windows\System\DHhpgxA.exe
  2⤵
  PID:12392
- C:\Windows\System\klxdbKY.exe
  C:\Windows\System\klxdbKY.exe
  2⤵
  PID:12416
- C:\Windows\System\ltfGUoI.exe
  C:\Windows\System\ltfGUoI.exe
  2⤵
  PID:12436
- C:\Windows\System\HxDViGe.exe
  C:\Windows\System\HxDViGe.exe
  2⤵
  PID:12456
- C:\Windows\System\vvNUZoJ.exe
  C:\Windows\System\vvNUZoJ.exe
  2⤵
  PID:12484
- C:\Windows\System\vebxsVr.exe
  C:\Windows\System\vebxsVr.exe
  2⤵
  PID:12512
- C:\Windows\System\iKGvNiO.exe
  C:\Windows\System\iKGvNiO.exe
  2⤵
  PID:12536
- C:\Windows\System\LruzOfV.exe
  C:\Windows\System\LruzOfV.exe
  2⤵
  PID:12564
- C:\Windows\System\kiMVXGY.exe
  C:\Windows\System\kiMVXGY.exe
  2⤵
  PID:12600
- C:\Windows\System\awbfcpp.exe
  C:\Windows\System\awbfcpp.exe
  2⤵
  PID:12636
- C:\Windows\System\FFmezwk.exe
  C:\Windows\System\FFmezwk.exe
  2⤵
  PID:12652
- C:\Windows\System\YIWnEeX.exe
  C:\Windows\System\YIWnEeX.exe
  2⤵
  PID:12680
- C:\Windows\System\anBlQMd.exe
  C:\Windows\System\anBlQMd.exe
  2⤵
  PID:12712
- C:\Windows\System\EiWXzBI.exe
  C:\Windows\System\EiWXzBI.exe
  2⤵
  PID:12732
- C:\Windows\System\JUJrHIi.exe
  C:\Windows\System\JUJrHIi.exe
  2⤵
  PID:12756
- C:\Windows\System\WrIZHdY.exe
  C:\Windows\System\WrIZHdY.exe
  2⤵
  PID:12792
- C:\Windows\System\GNotZQw.exe
  C:\Windows\System\GNotZQw.exe
  2⤵
  PID:12812
- C:\Windows\System\NQtQzNg.exe
  C:\Windows\System\NQtQzNg.exe
  2⤵
  PID:12840
- C:\Windows\System\tPxjHQe.exe
  C:\Windows\System\tPxjHQe.exe
  2⤵
  PID:12864
- C:\Windows\System\uHkytOO.exe
  C:\Windows\System\uHkytOO.exe
  2⤵
  PID:12904
- C:\Windows\System\fRKtUpf.exe
  C:\Windows\System\fRKtUpf.exe
  2⤵
  PID:12924
- C:\Windows\System\AocdceN.exe
  C:\Windows\System\AocdceN.exe
  2⤵
  PID:12948
- C:\Windows\System\nbdMshj.exe
  C:\Windows\System\nbdMshj.exe
  2⤵
  PID:12976
- C:\Windows\System\jPwlgvT.exe
  C:\Windows\System\jPwlgvT.exe
  2⤵
  PID:13000
- C:\Windows\System\PchdJmu.exe
  C:\Windows\System\PchdJmu.exe
  2⤵
  PID:13024
- C:\Windows\System\eAiqUtg.exe
  C:\Windows\System\eAiqUtg.exe
  2⤵
  PID:13052
- C:\Windows\System\KwTpsRx.exe
  C:\Windows\System\KwTpsRx.exe
  2⤵
  PID:13084
- C:\Windows\System\awQbhIs.exe
  C:\Windows\System\awQbhIs.exe
  2⤵
  PID:13104
- C:\Windows\System\PNtZWxj.exe
  C:\Windows\System\PNtZWxj.exe
  2⤵
  PID:13124
- C:\Windows\System\PXcbbKz.exe
  C:\Windows\System\PXcbbKz.exe
  2⤵
  PID:13144
- C:\Windows\System\gtXPIWX.exe
  C:\Windows\System\gtXPIWX.exe
  2⤵
  PID:13172
- C:\Windows\System\sVyNUwu.exe
  C:\Windows\System\sVyNUwu.exe
  2⤵
  PID:13200
- C:\Windows\System\jTFbABM.exe
  C:\Windows\System\jTFbABM.exe
  2⤵
  PID:13232
- C:\Windows\System\xKOUFnD.exe
  C:\Windows\System\xKOUFnD.exe
  2⤵
  PID:13256
- C:\Windows\System\vxabSHS.exe
  C:\Windows\System\vxabSHS.exe
  2⤵
  PID:13280
- C:\Windows\System\Iqxjjiw.exe
  C:\Windows\System\Iqxjjiw.exe
  2⤵
  PID:13304
- C:\Windows\System\igPjkIm.exe
  C:\Windows\System\igPjkIm.exe
  2⤵
  PID:11800
- C:\Windows\System\PkXDvDH.exe
  C:\Windows\System\PkXDvDH.exe
  2⤵
  PID:11660
- C:\Windows\System\twSpCwI.exe
  C:\Windows\System\twSpCwI.exe
  2⤵
  PID:11796
- C:\Windows\System\iDanucr.exe
  C:\Windows\System\iDanucr.exe
  2⤵
  PID:11596
- C:\Windows\System\gwLkSpH.exe
  C:\Windows\System\gwLkSpH.exe
  2⤵
  PID:11952
- C:\Windows\System\ixNcquL.exe
  C:\Windows\System\ixNcquL.exe
  2⤵
  PID:12300
- C:\Windows\System\zxhePzg.exe
  C:\Windows\System\zxhePzg.exe
  2⤵
  PID:11324
- C:\Windows\System\TttNXEE.exe
  C:\Windows\System\TttNXEE.exe
  2⤵
  PID:12628
- C:\Windows\System\mmEgYSx.exe
  C:\Windows\System\mmEgYSx.exe
  2⤵
  PID:12476
- C:\Windows\System\ihsKstK.exe
  C:\Windows\System\ihsKstK.exe
  2⤵
  PID:12612
- C:\Windows\System\PEyznme.exe
  C:\Windows\System\PEyznme.exe
  2⤵
  PID:12444
- C:\Windows\System\vKDrsKE.exe
  C:\Windows\System\vKDrsKE.exe
  2⤵
  PID:12700
- C:\Windows\System\RdjqcpL.exe
  C:\Windows\System\RdjqcpL.exe
  2⤵
  PID:12892
- C:\Windows\System\ntNQvvq.exe
  C:\Windows\System\ntNQvvq.exe
  2⤵
  PID:13036
- C:\Windows\System\OGrvexC.exe
  C:\Windows\System\OGrvexC.exe
  2⤵
  PID:12772
- C:\Windows\System\haOEtgI.exe
  C:\Windows\System\haOEtgI.exe
  2⤵
  PID:13016
- C:\Windows\System\DorzQOm.exe
  C:\Windows\System\DorzQOm.exe
  2⤵
  PID:13044
- C:\Windows\System\hlNaOjd.exe
  C:\Windows\System\hlNaOjd.exe
  2⤵
  PID:13116
- C:\Windows\System\cLFtPJn.exe
  C:\Windows\System\cLFtPJn.exe
  2⤵
  PID:13012
- C:\Windows\System\IVzOLqO.exe
  C:\Windows\System\IVzOLqO.exe
  2⤵
  PID:12384
- C:\Windows\System\rvFkhBV.exe
  C:\Windows\System\rvFkhBV.exe
  2⤵
  PID:13296
- C:\Windows\System\dFxRONu.exe
  C:\Windows\System\dFxRONu.exe
  2⤵
  PID:13140
- C:\Windows\System\DKlaiuT.exe
  C:\Windows\System\DKlaiuT.exe
  2⤵
  PID:12860
- C:\Windows\System\MhQinux.exe
  C:\Windows\System\MhQinux.exe
  2⤵
  PID:13092
- C:\Windows\System\sGyeYjQ.exe
  C:\Windows\System\sGyeYjQ.exe
  2⤵
  PID:13324
- C:\Windows\System\fEvfmuB.exe
  C:\Windows\System\fEvfmuB.exe
  2⤵
  PID:13340
- C:\Windows\System\dTdDVaH.exe
  C:\Windows\System\dTdDVaH.exe
  2⤵
  PID:13360
- C:\Windows\System\urClUnW.exe
  C:\Windows\System\urClUnW.exe
  2⤵
  PID:13384
- C:\Windows\System\bShkmmX.exe
  C:\Windows\System\bShkmmX.exe
  2⤵
  PID:13420
- C:\Windows\System\bHlliJG.exe
  C:\Windows\System\bHlliJG.exe
  2⤵
  PID:13436
- C:\Windows\System\MBBTSgN.exe
  C:\Windows\System\MBBTSgN.exe
  2⤵
  PID:13468
- C:\Windows\System\nzAQTej.exe
  C:\Windows\System\nzAQTej.exe
  2⤵
  PID:13492
- C:\Windows\System\OcKIuRa.exe
  C:\Windows\System\OcKIuRa.exe
  2⤵
  PID:13512
- C:\Windows\System\sHYynHr.exe
  C:\Windows\System\sHYynHr.exe
  2⤵
  PID:13548
- C:\Windows\System\vLVbIjz.exe
  C:\Windows\System\vLVbIjz.exe
  2⤵
  PID:13564
- C:\Windows\System\GABfRbs.exe
  C:\Windows\System\GABfRbs.exe
  2⤵
  PID:13580
- C:\Windows\System\ENOqiAV.exe
  C:\Windows\System\ENOqiAV.exe
  2⤵
  PID:13712
- C:\Windows\System\viQrnJV.exe
  C:\Windows\System\viQrnJV.exe
  2⤵
  PID:13736
- C:\Windows\System\gyfCbGC.exe
  C:\Windows\System\gyfCbGC.exe
  2⤵
  PID:13768
- C:\Windows\System\kfTyOaW.exe
  C:\Windows\System\kfTyOaW.exe
  2⤵
  PID:13796
- C:\Windows\System\yijJGGL.exe
  C:\Windows\System\yijJGGL.exe
  2⤵
  PID:13828
- C:\Windows\System\StLhceT.exe
  C:\Windows\System\StLhceT.exe
  2⤵
  PID:13884
- C:\Windows\System\MhjRBdc.exe
  C:\Windows\System\MhjRBdc.exe
  2⤵
  PID:13920
- C:\Windows\System\TgMyCRg.exe
  C:\Windows\System\TgMyCRg.exe
  2⤵
  PID:13960
- C:\Windows\System\ZrApcRG.exe
  C:\Windows\System\ZrApcRG.exe
  2⤵
  PID:13980
- C:\Windows\System\oIBxxnO.exe
  C:\Windows\System\oIBxxnO.exe
  2⤵
  PID:14008
- C:\Windows\System\ISrrYEh.exe
  C:\Windows\System\ISrrYEh.exe
  2⤵
  PID:14032
- C:\Windows\System\QqUqTfE.exe
  C:\Windows\System\QqUqTfE.exe
  2⤵
  PID:14076
- C:\Windows\System\tHvmGge.exe
  C:\Windows\System\tHvmGge.exe
  2⤵
  PID:14104
- C:\Windows\System\ZWWLqpk.exe
  C:\Windows\System\ZWWLqpk.exe
  2⤵
  PID:14136
- C:\Windows\System\BCdYdQm.exe
  C:\Windows\System\BCdYdQm.exe
  2⤵
  PID:14156
- C:\Windows\System\waNiMJL.exe
  C:\Windows\System\waNiMJL.exe
  2⤵
  PID:14172
- C:\Windows\System\VOBDsfY.exe
  C:\Windows\System\VOBDsfY.exe
  2⤵
  PID:14208
- C:\Windows\System\jDrnBXa.exe
  C:\Windows\System\jDrnBXa.exe
  2⤵
  PID:14232
- C:\Windows\System\OKllUhb.exe
  C:\Windows\System\OKllUhb.exe
  2⤵
  PID:14256
- C:\Windows\System\pQZnBmW.exe
  C:\Windows\System\pQZnBmW.exe
  2⤵
  PID:14288
- C:\Windows\System\KHFdiou.exe
  C:\Windows\System\KHFdiou.exe
  2⤵
  PID:14316
- C:\Windows\System\NzJAPGY.exe
  C:\Windows\System\NzJAPGY.exe
  2⤵
  PID:13228
- C:\Windows\System\EExapKk.exe
  C:\Windows\System\EExapKk.exe
  2⤵
  PID:12532
- C:\Windows\System\AVaRNTQ.exe
  C:\Windows\System\AVaRNTQ.exe
  2⤵
  PID:12888
- C:\Windows\System\rlCwzkC.exe
  C:\Windows\System\rlCwzkC.exe
  2⤵
  PID:12960
- C:\Windows\System\eOJVAia.exe
  C:\Windows\System\eOJVAia.exe
  2⤵
  PID:12508
- C:\Windows\System\zTzMjyJ.exe
  C:\Windows\System\zTzMjyJ.exe
  2⤵
  PID:13372
- C:\Windows\System\zXBUTad.exe
  C:\Windows\System\zXBUTad.exe
  2⤵
  PID:13300
- C:\Windows\System\GGabnaN.exe
  C:\Windows\System\GGabnaN.exe
  2⤵
  PID:13480
- C:\Windows\System\DEoLvVP.exe
  C:\Windows\System\DEoLvVP.exe
  2⤵
  PID:13216
- C:\Windows\System\cbvsDzY.exe
  C:\Windows\System\cbvsDzY.exe
  2⤵
  PID:13600
- C:\Windows\System\DysMAfe.exe
  C:\Windows\System\DysMAfe.exe
  2⤵
  PID:13508
- C:\Windows\System\iJEtwaw.exe
  C:\Windows\System\iJEtwaw.exe
  2⤵
  PID:13876
- C:\Windows\System\cYZTDTe.exe
  C:\Windows\System\cYZTDTe.exe
  2⤵
  PID:13608
- C:\Windows\System\KSqpNqk.exe
  C:\Windows\System\KSqpNqk.exe
  2⤵
  PID:13996
- C:\Windows\System\LgALnaS.exe
  C:\Windows\System\LgALnaS.exe
  2⤵
  PID:13660
- C:\Windows\System\RbeezgX.exe
  C:\Windows\System\RbeezgX.exe
  2⤵
  PID:13936
- C:\Windows\System\OTXgowk.exe
  C:\Windows\System\OTXgowk.exe
  2⤵
  PID:14112
- C:\Windows\System\ZUzTtng.exe
  C:\Windows\System\ZUzTtng.exe
  2⤵
  PID:14192
- C:\Windows\System\prDzxzd.exe
  C:\Windows\System\prDzxzd.exe
  2⤵
  PID:14084
- C:\Windows\System\sHfZFLW.exe
  C:\Windows\System\sHfZFLW.exe
  2⤵
  PID:14144
- C:\Windows\System\VIIvGBg.exe
  C:\Windows\System\VIIvGBg.exe
  2⤵
  PID:14328
- C:\Windows\System\GfMzyxo.exe
  C:\Windows\System\GfMzyxo.exe
  2⤵
  PID:12088
- C:\Windows\System\eMpkHcm.exe
  C:\Windows\System\eMpkHcm.exe
  2⤵
  PID:14116
- C:\Windows\System\LfVnNnE.exe
  C:\Windows\System\LfVnNnE.exe
  2⤵
  PID:11540
- C:\Windows\System\mCEWtzW.exe
  C:\Windows\System\mCEWtzW.exe
  2⤵
  PID:14276
- C:\Windows\System\WnqUXeI.exe
  C:\Windows\System\WnqUXeI.exe
  2⤵
  PID:13100
- C:\Windows\System\bWXcKoC.exe
  C:\Windows\System\bWXcKoC.exe
  2⤵
  PID:13316
- C:\Windows\System\vCoOLRP.exe
  C:\Windows\System\vCoOLRP.exe
  2⤵
  PID:13624
- C:\Windows\System\faEtFVH.exe
  C:\Windows\System\faEtFVH.exe
  2⤵
  PID:13460
- C:\Windows\System\TEwdTKr.exe
  C:\Windows\System\TEwdTKr.exe
  2⤵
  PID:13992
- C:\Windows\System\UJeNlpu.exe
  C:\Windows\System\UJeNlpu.exe
  2⤵
  PID:14352
- C:\Windows\System\CoekUao.exe
  C:\Windows\System\CoekUao.exe
  2⤵
  PID:14380
- C:\Windows\System\jpLEiKi.exe
  C:\Windows\System\jpLEiKi.exe
  2⤵
  PID:14404
- C:\Windows\System\cNXgOeJ.exe
  C:\Windows\System\cNXgOeJ.exe
  2⤵
  PID:14436
- C:\Windows\System\iLOnJrB.exe
  C:\Windows\System\iLOnJrB.exe
  2⤵
  PID:14460
- C:\Windows\System\TRWzmFS.exe
  C:\Windows\System\TRWzmFS.exe
  2⤵
  PID:14488
- C:\Windows\System\vCLsqXF.exe
  C:\Windows\System\vCLsqXF.exe
  2⤵
  PID:14512
- C:\Windows\System\uMAUKOc.exe
  C:\Windows\System\uMAUKOc.exe
  2⤵
  PID:14528
- C:\Windows\System\BXUnkZY.exe
  C:\Windows\System\BXUnkZY.exe
  2⤵
  PID:14556
- C:\Windows\System\HfSHyGY.exe
  C:\Windows\System\HfSHyGY.exe
  2⤵
  PID:14580
- C:\Windows\System\QPXxPiB.exe
  C:\Windows\System\QPXxPiB.exe
  2⤵
  PID:14604
- C:\Windows\System\zeUwPcF.exe
  C:\Windows\System\zeUwPcF.exe
  2⤵
  PID:14632
- C:\Windows\System\hlJkmFT.exe
  C:\Windows\System\hlJkmFT.exe
  2⤵
  PID:14844
- C:\Windows\System\gkxLjIp.exe
  C:\Windows\System\gkxLjIp.exe
  2⤵
  PID:14900
- C:\Windows\System\ylJlGEW.exe
  C:\Windows\System\ylJlGEW.exe
  2⤵
  PID:14964
- C:\Windows\System\UPtLByU.exe
  C:\Windows\System\UPtLByU.exe
  2⤵
  PID:15008
- C:\Windows\System\KiLIcyf.exe
  C:\Windows\System\KiLIcyf.exe
  2⤵
  PID:15040
- C:\Windows\System\AtAMhIN.exe
  C:\Windows\System\AtAMhIN.exe
  2⤵
  PID:15056
- C:\Windows\System\ctRrswY.exe
  C:\Windows\System\ctRrswY.exe
  2⤵
  PID:15084
- C:\Windows\System\GIzyLOT.exe
  C:\Windows\System\GIzyLOT.exe
  2⤵
  PID:15108
- C:\Windows\System\FshQUbX.exe
  C:\Windows\System\FshQUbX.exe
  2⤵
  PID:15128
- C:\Windows\System\gQQWuor.exe
  C:\Windows\System\gQQWuor.exe
  2⤵
  PID:15152
- C:\Windows\System\ltsassN.exe
  C:\Windows\System\ltsassN.exe
  2⤵
  PID:15176
- C:\Windows\System\OdugrCf.exe
  C:\Windows\System\OdugrCf.exe
  2⤵
  PID:15208
- C:\Windows\System\wyOQlTy.exe
  C:\Windows\System\wyOQlTy.exe
  2⤵
  PID:15236
- C:\Windows\System\aEKplzD.exe
  C:\Windows\System\aEKplzD.exe
  2⤵
  PID:15260
- C:\Windows\System\HPWhjZO.exe
  C:\Windows\System\HPWhjZO.exe
  2⤵
  PID:15276
- C:\Windows\System\kzLSfHi.exe
  C:\Windows\System\kzLSfHi.exe
  2⤵
  PID:15296
- C:\Windows\System\xhIklBW.exe
  C:\Windows\System\xhIklBW.exe
  2⤵
  PID:15320
- C:\Windows\System\LXzBKpR.exe
  C:\Windows\System\LXzBKpR.exe
  2⤵
  PID:15340
- C:\Windows\System\SskKuky.exe
  C:\Windows\System\SskKuky.exe
  2⤵
  PID:13164
- C:\Windows\System\uAlyuqs.exe
  C:\Windows\System\uAlyuqs.exe
  2⤵
  PID:13896
- C:\Windows\System\zNchpQl.exe
  C:\Windows\System\zNchpQl.exe
  2⤵
  PID:13776
- C:\Windows\System\fLJoGra.exe
  C:\Windows\System\fLJoGra.exe
  2⤵
  PID:12544
- C:\Windows\System\TmUGVJl.exe
  C:\Windows\System\TmUGVJl.exe
  2⤵
  PID:14120
- C:\Windows\System\ixilqOa.exe
  C:\Windows\System\ixilqOa.exe
  2⤵
  PID:14056
- C:\Windows\System\plilMEg.exe
  C:\Windows\System\plilMEg.exe
  2⤵
  PID:14392
- C:\Windows\System\vMvBjQi.exe
  C:\Windows\System\vMvBjQi.exe
  2⤵
  PID:13932
- C:\Windows\System\SgbloFK.exe
  C:\Windows\System\SgbloFK.exe
  2⤵
  PID:13380
- C:\Windows\System\MgFGjaM.exe
  C:\Windows\System\MgFGjaM.exe
  2⤵
  PID:14524
- C:\Windows\System\keUUEdr.exe
  C:\Windows\System\keUUEdr.exe
  2⤵
  PID:14628
- C:\Windows\System\xuvlJVC.exe
  C:\Windows\System\xuvlJVC.exe
  2⤵
  PID:14620
- C:\Windows\System\fwrLZlb.exe
  C:\Windows\System\fwrLZlb.exe
  2⤵
  PID:14884
- C:\Windows\System\hvsdtOg.exe
  C:\Windows\System\hvsdtOg.exe
  2⤵
  PID:14880
- C:\Windows\System\chTVsEs.exe
  C:\Windows\System\chTVsEs.exe
  2⤵
  PID:14936
- C:\Windows\System\AiZTwxQ.exe
  C:\Windows\System\AiZTwxQ.exe
  2⤵
  PID:14980
- C:\Windows\System\dwTZxoy.exe
  C:\Windows\System\dwTZxoy.exe
  2⤵
  PID:15100
- C:\Windows\System\dTtUAiT.exe
  C:\Windows\System\dTtUAiT.exe
  2⤵
  PID:15092
- C:\Windows\System\uhZBbbS.exe
  C:\Windows\System\uhZBbbS.exe
  2⤵
  PID:15164
- C:\Windows\System\zlHbaSq.exe
  C:\Windows\System\zlHbaSq.exe
  2⤵
  PID:15148
- C:\Windows\System\mbMXjtp.exe
  C:\Windows\System\mbMXjtp.exe
  2⤵
  PID:15192
- C:\Windows\System\VNTlbXM.exe
  C:\Windows\System\VNTlbXM.exe
  2⤵
  PID:15316
- C:\Windows\System\fsNvPZR.exe
  C:\Windows\System\fsNvPZR.exe
  2⤵
  PID:14376
- C:\Windows\System\PYkUDTY.exe
  C:\Windows\System\PYkUDTY.exe
  2⤵
  PID:15304
- C:\Windows\System\FUXBwGg.exe
  C:\Windows\System\FUXBwGg.exe
  2⤵
  PID:13744
- C:\Windows\System\nwiYkyy.exe
  C:\Windows\System\nwiYkyy.exe
  2⤵
  PID:14388
- C:\Windows\System\qHnTJMx.exe
  C:\Windows\System\qHnTJMx.exe
  2⤵
  PID:14296
- C:\Windows\System\UkGSWsP.exe
  C:\Windows\System\UkGSWsP.exe
  2⤵
  PID:14448
- C:\Windows\System\zXIDboh.exe
  C:\Windows\System\zXIDboh.exe
  2⤵
  PID:14948
- C:\Windows\System\CBCaeDX.exe
  C:\Windows\System\CBCaeDX.exe
  2⤵
  PID:14540
- C:\Windows\System\OTMyfKN.exe
  C:\Windows\System\OTMyfKN.exe
  2⤵
  PID:14828
- C:\Windows\System\vBXNICP.exe
  C:\Windows\System\vBXNICP.exe
  2⤵
  PID:14612
- C:\Windows\System\PzCztUm.exe
  C:\Windows\System\PzCztUm.exe
  2⤵
  PID:14504
- C:\Windows\System\rNgsScO.exe
  C:\Windows\System\rNgsScO.exe
  2⤵
  PID:14196
- C:\Windows\System\uXbfMpE.exe
  C:\Windows\System\uXbfMpE.exe
  2⤵
  PID:15388
- C:\Windows\System\xrOgAZw.exe
  C:\Windows\System\xrOgAZw.exe
  2⤵
  PID:15420
- C:\Windows\System\rdouDTZ.exe
  C:\Windows\System\rdouDTZ.exe
  2⤵
  PID:15440
- C:\Windows\System\dhQUTtc.exe
  C:\Windows\System\dhQUTtc.exe
  2⤵
  PID:15472
- C:\Windows\System\nLrSJhb.exe
  C:\Windows\System\nLrSJhb.exe
  2⤵
  PID:15500
- C:\Windows\System\XPtOgSV.exe
  C:\Windows\System\XPtOgSV.exe
  2⤵
  PID:15524
- C:\Windows\System\mSAJGCO.exe
  C:\Windows\System\mSAJGCO.exe
  2⤵
  PID:15548
- C:\Windows\System\VnEOEpq.exe
  C:\Windows\System\VnEOEpq.exe
  2⤵
  PID:15568
- C:\Windows\System\VpiLxMj.exe
  C:\Windows\System\VpiLxMj.exe
  2⤵
  PID:15588
- C:\Windows\System\nXBgDrA.exe
  C:\Windows\System\nXBgDrA.exe
  2⤵
  PID:15620
- C:\Windows\System\hDKzurS.exe
  C:\Windows\System\hDKzurS.exe
  2⤵
  PID:15640
- C:\Windows\System\dPWJnww.exe
  C:\Windows\System\dPWJnww.exe
  2⤵
  PID:15672
- C:\Windows\System\wuCKCQV.exe
  C:\Windows\System\wuCKCQV.exe
  2⤵
  PID:15700
- C:\Windows\System\PXJZmeU.exe
  C:\Windows\System\PXJZmeU.exe
  2⤵
  PID:15716
- C:\Windows\System\AyVnqXl.exe
  C:\Windows\System\AyVnqXl.exe
  2⤵
  PID:15740
- C:\Windows\System\PfEIhjN.exe
  C:\Windows\System\PfEIhjN.exe
  2⤵
  PID:15772
- C:\Windows\System\Csyxalh.exe
  C:\Windows\System\Csyxalh.exe
  2⤵
  PID:15800
- C:\Windows\System\hHBCwCl.exe
  C:\Windows\System\hHBCwCl.exe
  2⤵
  PID:15820
- C:\Windows\System\ynpvSTV.exe
  C:\Windows\System\ynpvSTV.exe
  2⤵
  PID:15848
- C:\Windows\System\ZgfpFKD.exe
  C:\Windows\System\ZgfpFKD.exe
  2⤵
  PID:15868
- C:\Windows\System\OpjXXKt.exe
  C:\Windows\System\OpjXXKt.exe
  2⤵
  PID:15888
- C:\Windows\System\khKwRAL.exe
  C:\Windows\System\khKwRAL.exe
  2⤵
  PID:15924
- C:\Windows\System\BcGlHFB.exe
  C:\Windows\System\BcGlHFB.exe
  2⤵
  PID:15952
- C:\Windows\System\dwHxsmc.exe
  C:\Windows\System\dwHxsmc.exe
  2⤵
  PID:15968
- C:\Windows\System\bcUgvXO.exe
  C:\Windows\System\bcUgvXO.exe
  2⤵
  PID:15992
- C:\Windows\System\JBFvfZl.exe
  C:\Windows\System\JBFvfZl.exe
  2⤵
  PID:16020
- C:\Windows\System\kAXUJrf.exe
  C:\Windows\System\kAXUJrf.exe
  2⤵
  PID:16044
- C:\Windows\System\ZVZrUNX.exe
  C:\Windows\System\ZVZrUNX.exe
  2⤵
  PID:16076
- C:\Windows\System\WcvidTZ.exe
  C:\Windows\System\WcvidTZ.exe
  2⤵
  PID:16100
- C:\Windows\System\xnVoZhN.exe
  C:\Windows\System\xnVoZhN.exe
  2⤵
  PID:16124
- C:\Windows\System\DrUYotn.exe
  C:\Windows\System\DrUYotn.exe
  2⤵
  PID:16144
- C:\Windows\System\XBtsSkZ.exe
  C:\Windows\System\XBtsSkZ.exe
  2⤵
  PID:16168
- C:\Windows\System\KMvCtlh.exe
  C:\Windows\System\KMvCtlh.exe
  2⤵
  PID:16200
- C:\Windows\System\ilQKGqH.exe
  C:\Windows\System\ilQKGqH.exe
  2⤵
  PID:16228
- C:\Windows\System\KowUGxE.exe
  C:\Windows\System\KowUGxE.exe
  2⤵
  PID:16252
- C:\Windows\System\yIfaTtV.exe
  C:\Windows\System\yIfaTtV.exe
  2⤵
  PID:16288
- C:\Windows\System\JwUCRqo.exe
  C:\Windows\System\JwUCRqo.exe
  2⤵
  PID:16304
- C:\Windows\System\XCSXWNa.exe
  C:\Windows\System\XCSXWNa.exe
  2⤵
  PID:16328
- C:\Windows\System\YUYgsrH.exe
  C:\Windows\System\YUYgsrH.exe
  2⤵
  PID:16356
- C:\Windows\System\dkrIYAy.exe
  C:\Windows\System\dkrIYAy.exe
  2⤵
  PID:16376
- C:\Windows\System\fWLKlMz.exe
  C:\Windows\System\fWLKlMz.exe
  2⤵
  PID:14476
- C:\Windows\System\FzQdsHM.exe
  C:\Windows\System\FzQdsHM.exe
  2⤵
  PID:11204
- C:\Windows\System\wUfhxSK.exe
  C:\Windows\System\wUfhxSK.exe
  2⤵
  PID:15332
- C:\Windows\System\okjoaQK.exe
  C:\Windows\System\okjoaQK.exe
  2⤵
  PID:15200
- C:\Windows\System\tvPyLWl.exe
  C:\Windows\System\tvPyLWl.exe
  2⤵
  PID:15400
- C:\Windows\System\aLUZGGy.exe
  C:\Windows\System\aLUZGGy.exe
  2⤵
  PID:15488
- C:\Windows\System\vyNyylH.exe
  C:\Windows\System\vyNyylH.exe
  2⤵
  PID:15540
- C:\Windows\System\tjsXhAp.exe
  C:\Windows\System\tjsXhAp.exe
  2⤵
  PID:15556
- C:\Windows\System\vrKwvsO.exe
  C:\Windows\System\vrKwvsO.exe
  2⤵
  PID:15436
- C:\Windows\System\iWaKlvL.exe
  C:\Windows\System\iWaKlvL.exe
  2⤵
  PID:15896
- C:\Windows\System\nUqqQHx.exe
  C:\Windows\System\nUqqQHx.exe
  2⤵
  PID:15812
- C:\Windows\System\AMjalbg.exe
  C:\Windows\System\AMjalbg.exe
  2⤵
  PID:15652
- C:\Windows\System\wwckEBd.exe
  C:\Windows\System\wwckEBd.exe
  2⤵
  PID:16084
- C:\Windows\System\SFCkgAu.exe
  C:\Windows\System\SFCkgAu.exe
  2⤵
  PID:15752
- C:\Windows\System\QShRfzE.exe
  C:\Windows\System\QShRfzE.exe
  2⤵
  PID:16156
- C:\Windows\System\jJtKccb.exe
  C:\Windows\System\jJtKccb.exe
  2⤵
  PID:16196
- C:\Windows\System\vjdlXAq.exe
  C:\Windows\System\vjdlXAq.exe
  2⤵
  PID:15856
- C:\Windows\System\ETHrqMo.exe
  C:\Windows\System\ETHrqMo.exe
  2⤵
  PID:16140
- C:\Windows\System\tUiYKPY.exe
  C:\Windows\System\tUiYKPY.exe
  2⤵
  PID:16176
- C:\Windows\System\VslWBnn.exe
  C:\Windows\System\VslWBnn.exe
  2⤵
  PID:13572
- C:\Windows\System\tnCZyvr.exe
  C:\Windows\System\tnCZyvr.exe
  2⤵
  PID:16060
- C:\Windows\System\LnNIWFT.exe
  C:\Windows\System\LnNIWFT.exe
  2⤵
  PID:16340
- C:\Windows\System\dHkJcHB.exe
  C:\Windows\System\dHkJcHB.exe
  2⤵
  PID:16372
- C:\Windows\System\sLIMjbU.exe
  C:\Windows\System\sLIMjbU.exe
  2⤵
  PID:16392
- C:\Windows\System\TncDeoz.exe
  C:\Windows\System\TncDeoz.exe
  2⤵
  PID:16424
- C:\Windows\System\XXRXsPe.exe
  C:\Windows\System\XXRXsPe.exe
  2⤵
  PID:16440
- C:\Windows\System\zWyJDSQ.exe
  C:\Windows\System\zWyJDSQ.exe
  2⤵
  PID:16464
- C:\Windows\System\gTwvgwP.exe
  C:\Windows\System\gTwvgwP.exe
  2⤵
  PID:16496
- C:\Windows\System\EClNTIs.exe
  C:\Windows\System\EClNTIs.exe
  2⤵
  PID:16532
- C:\Windows\System\kkIKcNi.exe
  C:\Windows\System\kkIKcNi.exe
  2⤵
  PID:16552
- C:\Windows\System\PVhNKQg.exe
  C:\Windows\System\PVhNKQg.exe
  2⤵
  PID:16576
- C:\Windows\System\PRmxZew.exe
  C:\Windows\System\PRmxZew.exe
  2⤵
  PID:16596
- C:\Windows\System\DQUnSbb.exe
  C:\Windows\System\DQUnSbb.exe
  2⤵
  PID:16632
- C:\Windows\System\UJHIUyI.exe
  C:\Windows\System\UJHIUyI.exe
  2⤵
  PID:16648
- C:\Windows\System\hfPzXlr.exe
  C:\Windows\System\hfPzXlr.exe
  2⤵
  PID:16684
- C:\Windows\System\lCDoGMc.exe
  C:\Windows\System\lCDoGMc.exe
  2⤵
  PID:16704
- C:\Windows\System\DuBcvpi.exe
  C:\Windows\System\DuBcvpi.exe
  2⤵
  PID:16732
- C:\Windows\System\YeGrjlS.exe
  C:\Windows\System\YeGrjlS.exe
  2⤵
  PID:16752
- C:\Windows\System\zhZHyOh.exe
  C:\Windows\System\zhZHyOh.exe
  2⤵
  PID:16776
- C:\Windows\System\GnsqMOE.exe
  C:\Windows\System\GnsqMOE.exe
  2⤵
  PID:16792
- C:\Windows\System\sngksMB.exe
  C:\Windows\System\sngksMB.exe
  2⤵
  PID:16820
- C:\Windows\System\LWArHrC.exe
  C:\Windows\System\LWArHrC.exe
  2⤵
  PID:16852
- C:\Windows\System\dmRuiVQ.exe
  C:\Windows\System\dmRuiVQ.exe
  2⤵
  PID:16884
- C:\Windows\System\aGOzYqE.exe
  C:\Windows\System\aGOzYqE.exe
  2⤵
  PID:16900
- C:\Windows\System\wdnetLu.exe
  C:\Windows\System\wdnetLu.exe
  2⤵
  PID:16928
- C:\Windows\System\XGhGnCy.exe
  C:\Windows\System\XGhGnCy.exe
  2⤵
  PID:16952
- C:\Windows\System\ahPKieC.exe
  C:\Windows\System\ahPKieC.exe
  2⤵
  PID:16972
- C:\Windows\System\nmEXPzh.exe
  C:\Windows\System\nmEXPzh.exe
  2⤵
  PID:17000
- C:\Windows\System\jERjByj.exe
  C:\Windows\System\jERjByj.exe
  2⤵
  PID:17020
- C:\Windows\System\GRvjinA.exe
  C:\Windows\System\GRvjinA.exe
  2⤵
  PID:17040
- C:\Windows\System\iItcmDU.exe
  C:\Windows\System\iItcmDU.exe
  2⤵
  PID:17072
- C:\Windows\System\thGXavS.exe
  C:\Windows\System\thGXavS.exe
  2⤵
  PID:17088
- C:\Windows\System\rOoNjOD.exe
  C:\Windows\System\rOoNjOD.exe
  2⤵
  PID:17120
- C:\Windows\System\iksqJtx.exe
  C:\Windows\System\iksqJtx.exe
  2⤵
  PID:15788
- C:\Windows\System\LrGRRpU.exe
  C:\Windows\System\LrGRRpU.exe
  2⤵
  PID:15692
- C:\Windows\System\QFTosGr.exe
  C:\Windows\System\QFTosGr.exe
  2⤵
  PID:15708
- C:\Windows\System\CaieZxK.exe
  C:\Windows\System\CaieZxK.exe
  2⤵
  PID:16612
- C:\Windows\System\TOhLzCG.exe
  C:\Windows\System\TOhLzCG.exe
  2⤵
  PID:16348
- C:\Windows\System\AWCUcix.exe
  C:\Windows\System\AWCUcix.exe
  2⤵
  PID:15080
- C:\Windows\System\wshCLrd.exe
  C:\Windows\System\wshCLrd.exe
  2⤵
  PID:17028
- C:\Windows\System\zGLCfPS.exe
  C:\Windows\System\zGLCfPS.exe
  2⤵
  PID:16728
- C:\Windows\System\OZAvGjl.exe
  C:\Windows\System\OZAvGjl.exe
  2⤵
  PID:17160

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:16212

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\AVqKOJC.exe

Filesize
1.5MB

MD5
1feed14f4f91f7aec0f09a90111a2935

SHA1
aa8eafa8133e3b745d6af298624c2cbe358402a2

SHA256
862be34588a3b55cfa5bd9fa80d7ce9a26ec0af9d455ee008decb61e5e290729

SHA512
4ea7d3e3621378a821ed1f81200793da251dda23db1e90cd7fd675cc0a895e1134406779a590744b1acaed4bde0a26968dca75e49fc7788609181f29fc514215

Download Submit
C:\Windows\System\BeaazxM.exe

Filesize
1.5MB

MD5
72e58471fa9d5fc057ed43540d9c76f1

SHA1
fb9042b3bc49817ce882b6b5d3b344460f70903e

SHA256
e22cafddd73c9b5aded7dd8b94be2317c24a3cf61be1c5aad5b4dfb8c68100b5

SHA512
23d5e7c967138af1f5a84793b031e0ec09ec5df039b4ec0ac8c656a45cc21906f0b887c69d21d693776e1bbb7a0248f6efae20d5811ef037c5fd39fd746a9e03

Download Submit
C:\Windows\System\BxigEcK.exe

Filesize
1.5MB

MD5
d2897bcbdead098caef0ac70f12e53cc

SHA1
bd11bd1d8625d270f4239899924ad7b32b4e8e82

SHA256
d54baba3bf34092b9afff817d9469042d0f5add4c8192e9f2fe8c5e93475c5e5

SHA512
8af41113cb61cbd2b1e10a290392a0edf84cdc963b266087e4b1556ff11a5e8718830c5764cd0d5be2a75d249d38edf71af79ebf6efd043d4043e0c5ded3f6e4

Download Submit
C:\Windows\System\JqgEBYR.exe

Filesize
1.5MB

MD5
f0288e0048dfcc25e23cb35f5c34bc98

SHA1
dfdf22a66a2c9a466afd36ed3fff49c75a8216f4

SHA256
e657fa1d670dc285795eeb2bc94eb36b1a288fe15c072e6c6207d2b954bf7f92

SHA512
552179120e3eeb0bde38d15e9987f8dc7c0a81f01e3b20bd9aa71d030b61f4098af6c33c9586bdf26a2e0cceb09cc7c278164e13f1d92291470289dac5f4774e

Download Submit
C:\Windows\System\KEDlMxf.exe

Filesize
1.5MB

MD5
98b448b7e25369f60c3fcb557e257fc0

SHA1
cfb2577c7c7f3ba051244f18592a24b0030476bb

SHA256
aed77531e7d568ba7c8c23206ac9ac77361807515ad1306a6745625805d1ad6f

SHA512
84915a753ceb23f12dfab480416b7db01473d970b7d748bfcb1feb7ffe313ea397fae479cb8eca1065e1bd4dbb078c052cce21979e4eb16bf5c4b811cc4997fa

Download Submit
C:\Windows\System\KgfzrfF.exe

Filesize
1.5MB

MD5
4fadb2123ccd06b1d35b6ba7b0ddb7a0

SHA1
6115c0abf1a54bdae5802cb411e93f161e9bebf9

SHA256
da7531e4152b57bb00ee2dcc299581aed394acebfed39c1ded7898b765dd6d2f

SHA512
111a80fd34ea8932fef7aa80b8e8588f103d027326484a9c1be58381126c16054743ac57449d562f9aa479aae368c4ed6d3cb594434afdf40d37d3b2214249a8

Download Submit
C:\Windows\System\MPrpkHo.exe

Filesize
1.5MB

MD5
12ebc7656766b2a7951e7b52f8c2d8f9

SHA1
6c76c0930a1c908054dda1dd318176f654a3a81d

SHA256
38a9252db89bae2e4df857e1249bb48878336fb8e22d8899e429687a6d844d72

SHA512
068e332e11b0b00f9361219e0b6400a0772948dd1cb43a1ec9d169dc7b946ae6299559ccc9af96cb40b99938bb7ca5b403459a58f6c571343b8f5abf4583a51b

Download Submit
C:\Windows\System\NinmUfv.exe

Filesize
1.5MB

MD5
01222a4e8d91569b4eb651ea48e29954

SHA1
7ac825ec80ced4b4c240b03d8bef60aff2db9e9b

SHA256
aa30b6bb7c75ea55f6924225e8c0ec177c5389c42c4c081cc6a53b3c9522da80

SHA512
6adb4f41ed96c373785d9e04ebfa6139f578bdef5404c39312396ddffb2d9f253e3b0d5f7d57892c4318caf37e672e20c45067fdc2a60c6f0a3f56b2a3090b33

Download Submit
C:\Windows\System\QoYOEvr.exe

Filesize
1.5MB

MD5
47d280808e336a41de6df7be515519b0

SHA1
e87e6bc9df5a25c2e3947fa4d7cdc86c2acacf99

SHA256
0cb632a93e98747496f31967c8dd2fe05469e80c96e5cf91f92a74764d288f9f

SHA512
4df77a8e6634b56dccb08795fc5a1493226ba63fd8821b68b2053851173a5d7a84f73157e2e7d6db710794ad391acec64fdae0d78b5ee9317c4228e7cc3d477e

Download Submit
C:\Windows\System\ScFpIUW.exe

Filesize
1.5MB

MD5
bd058effee41e758ef57fe0e1a405cbe

SHA1
655883aebcdd80bd650da078f1d59763a53e1802

SHA256
c77e73a717a7558f50d1e8e6f02f7cc50218ebc6509a872bf65031f4279abe83

SHA512
75fc7f103fc5e67af0223ed08639d651345a570f49ffc36098f374d300ca01c39eb822768661679188a8021e68effcc26b081555685f183d0c7afab0d10c3fe7

Download Submit
C:\Windows\System\TySPeWM.exe

Filesize
1.5MB

MD5
81726bccd6f28ec3443bed493044d110

SHA1
1116f82aa4c195452386e64618d3843567a62bea

SHA256
550a1acb15e153b7c845c15d6676371af4d995525f425f44488433f386204fe3

SHA512
65146a98484c13c5d1cf82beb2708362e39e412cdf31dc128b27e26683521856fe0af687fb4aa329ca04a13cbad8d76d02e1eeb9aa5a54ae342dde01e1ae23ff

Download Submit
C:\Windows\System\WPegarc.exe

Filesize
1.5MB

MD5
83860097224b361bd8f062c76d474c78

SHA1
19408b3bfd591f52e861e0a9e38eaaad47bd5436

SHA256
3ee72c2f49231f845e81581c1ce20f3d560eb5457f18e71b879029de63c14b2b

SHA512
de880cc4e0e526b11625bf09b78b06ba25b8fb8374d69bc6d6a4761411752fea4f2271fbfd2e56e805e9d57a522a731ab98dc75093b106f7c1cbbf4e4c291a5e

Download Submit
C:\Windows\System\WRJhAdm.exe

Filesize
1.5MB

MD5
2c6a80ff2b794a354aaa5c1ca64e0d59

SHA1
faf4b7c50fc6dd218181ffbe6e630dc9a88cba83

SHA256
ab4028434c03eed2ef50a9b825d129e963439afa10263e060ae61a92973c661e

SHA512
06c7bae0ef6df58a972e8ba90e166258750285d450e7948dde0cff7108d568c4bd626310b3e98b16bd05b557213468602cecc072f21caf8e84b423b8ce4d6b30

Download Submit
C:\Windows\System\XTQmStD.exe

Filesize
1.5MB

MD5
e0f576e8a02aedfd3f176242c397d3d5

SHA1
bfc80a5f394810c5110b3586ba14c7ea0b4b529a

SHA256
0c197c8662e8c0251eed88cf2703ea17c4d76fd572b74943e09f9cf8323c9870

SHA512
b348813e6cfb710443d239dd0c4bd39ebf99e0b552a4b2cd7812d77d6ffe05de684b5cfc70edd056037983eb671d0da76055af5a655338100a59ae9c6ab92ab6

Download Submit
C:\Windows\System\XUdRGDI.exe

Filesize
1.5MB

MD5
a039a6563bd4928973fcb408ac7216d1

SHA1
891ab19cf39089a0c3bfa21ca1e82e18c9648a08

SHA256
6a8bd8467a5119991eb4952a7d0bf6a1a073bbb121783a6169eb4c09e45000f4

SHA512
a049799d6d0686545752174212367276ee8a840f154c72069cc7b6296e6d8aebb1a480eea10a0014389f591c714e1838c3d2e9651d627098523e1b68b9a8919b

Download Submit
C:\Windows\System\XbtwhkR.exe

Filesize
1.5MB

MD5
acbe1955d342b59b3a39d6bc27eb858c

SHA1
6e747cdcc089143704b5109673d6f4d1857bd704

SHA256
90b60a4db9d78f08c0666dfa253df561b7d21bf6a9213c783a5761991abafde4

SHA512
519c44c65b26c526191e9c6af5ae7d838f8f781fb72f3feaefa40f7e1ca0808fbfcdcd87ff54505becd1f2291d4f68cc34755d4acc1954b05d580f8176b3162a

Download Submit
C:\Windows\System\ZpmYZQD.exe

Filesize
1.5MB

MD5
d6f2e41307991e08a7730a24254401ee

SHA1
824fb363ed860405664fa557c98fae15562474d3

SHA256
19135eabd2f49e0ac4e146b572dade6f9a2caf7cc676da0096c7e7ab9b6f9b37

SHA512
8a2b5fa38a5b191b75583c3d772680b9b4a8ae3855298f8bdedd2d8cc52cf80fe6dbe3172c5327e0f3c719f81dfc4fae0f72eea76775298ae84e8a3dbb0a9e5a

Download Submit
C:\Windows\System\anwwhVb.exe

Filesize
1.5MB

MD5
7dde6dd76c43fe80cb30063be1be2357

SHA1
9e669d12f4d6d24b2fabeb164447d2ed2189c39d

SHA256
e3e20b31d3c753b8fa2fd2bccbba52e37fde2f868e0dbde5fd7bb25873423cfa

SHA512
6445b4f0cb36bd882f615dd7bd429f4a9c045a73f9284dd5236037af4a823fa6e672540e04e9003e2b5850a2e1474c4f90deb9e9d956beb9da0abbf1619fbae0

Download Submit
C:\Windows\System\avClEHb.exe

Filesize
1.5MB

MD5
9483ea3dcefbaf0c0ee019ec59f99afb

SHA1
0908c02e879dead9e300c270ce2daa2b767aab2c

SHA256
6be4faa2226523a106eea416e65796b26b81c9d848bb23a24ccfdaa404c7de42

SHA512
a9080f8ab492d04322f441389d645c787aba26025d8c9bb0ecbbdddf0f0ff2553d3bca587aa7cedb39b5952e989c418d1428382888ea3b450a71fc5481cffbea

Download Submit
C:\Windows\System\bbbBmkX.exe

Filesize
1.5MB

MD5
0e7d5ed3b979fd2ea7daa91d92f80676

SHA1
0cb1cbd1daef612ab189d4b2961e8085abd617f8

SHA256
4559293c7501ca6be8f1ebd54c8af647fd4a839f1db97749bbc57bdbe2130171

SHA512
eb63dbc91fde7f99e8ef2611c68bbef8673b38f134c3f1f6f3eeb09a224cdd9a852063642de458f56908f4f33f6ea91a9d7fbeb6a1ec740564cf751f6b168019

Download Submit
C:\Windows\System\bfJMaHC.exe

Filesize
1.5MB

MD5
6a3fa6881140ddcd39b10ca12de63c07

SHA1
2aeecefe732bd11a726f7013c4e7a77254b49302

SHA256
a1dffb9530a63a6df0ea137c1ba4c06f1b0db882b03c3c8da6214d1b4b12daa1

SHA512
c83e3f1fe87d5e3b609845fd04c8045e9b090486bfee3e364850b1443fa57aad11325c86f06295a1119c900b0700d1dd3a5b426ee097b67bb1907583291efac8

Download Submit
C:\Windows\System\dGYzkjk.exe

Filesize
1.5MB

MD5
c14bd7d7c51ed454d1db8f248d4ddc1d

SHA1
1cf91635b05b440452265da1cfe88574710de068

SHA256
09577b387dd41200099394c817c3010de0e95f897b70f98eac7232641a1ae634

SHA512
9c8be948353eaf85cef2ad9ba129abf0526183bc4299093e23596caee00126aaae5fe1f49930ef1bfdfb4488d573dbc084ccfbe5d4b539e74ea2a4532bf14be6

Download Submit
C:\Windows\System\dttprCL.exe

Filesize
1.5MB

MD5
071cf46ada6a3dccc41b67d226726639

SHA1
13458c0bb39852073cad0c7219227a6b0691d7c5

SHA256
8d75811480ebec3f50805bf2061f93ffd4efd773f3efd9fe45b6828de16e3a86

SHA512
f85d13f415e30754d388b3a986dbdde19cfb6faba4431606a133d4fb8ef31f039e34f1236b920a3d54f2dd6a4bd31737ee25f152c288f2dd7822c158a55405c5

Download Submit
C:\Windows\System\fFYJKqO.exe

Filesize
1.5MB

MD5
611c9f7625a75dbf2a023ddc9f804d10

SHA1
19593d8090171b58ed388f628b52a8e352eee5cd

SHA256
2dd4d462a2f02203f6ec588ae5c3d569bd399b5523c8236bc5b5861a5e611cd9

SHA512
72747334e6f49356de7538699cacf21db125ca22ba1a685d58468c6a0855d455349b226e12133ab2d55bd6b92cd9a3c85e43edb4c82afe4822bc3fceb7720e65

Download Submit
C:\Windows\System\hIPFxgZ.exe

Filesize
1.5MB

MD5
1594afd489878c216c0dcbe2da87639f

SHA1
dea7c633121af6bc22be0e2e504e605409248c10

SHA256
51eb376cc7c76b970cf4186d6f5263a5c128c556ec8f437a027d32732d70aaac

SHA512
d12ec2753ff4c1c9348c62509e49e5ea55204b70b505f6fa6bb26025588317687ed7a11c8b1b2a17d5c8e07ad2ffc0855c75a4be21504e89305bc676702fcc45

Download Submit
C:\Windows\System\hQPtmvy.exe

Filesize
1.5MB

MD5
a49c842e41b5142466466c1ace1dc680

SHA1
844a85b456e08cbc43200ee2fe30097422792173

SHA256
c4d043374d277ccf419281275f3defece6c08cc4a4216983ff76c1cd5833c1ca

SHA512
fc92fdf0e4888a1557bc04f3ba0e168b3d9abd6bac727e57b85f9f3c5daf22c01f1aaa8f9fb681417e76947f0f0d0f4cd9811a454ebd9e5b4254fe2eaccfc91c

Download Submit
C:\Windows\System\kXmILlC.exe

Filesize
1.5MB

MD5
cf2dca83b1e4f43f0225b5f2ebb7e301

SHA1
d94fd23686cbb992b2fdba6d91807c3aa95fe0a9

SHA256
1f98bc80e99df041627be42817287fbf506fba72114c0a5c13d1216a8063651a

SHA512
4cbe34c5411e4f44830dc09259ba02b4ff24158be5df75c149aec9e245bb6b086854046e5e016a1772fa05dc23309bdde543656c1b042dba641933efd4f966a6

Download Submit
C:\Windows\System\ksBNEbK.exe

Filesize
1.5MB

MD5
759d587aa2bdc7ae3342879767a7d3ac

SHA1
53448aa74c1c496a43534b6dd9b2f61fcf4b2b89

SHA256
6033e938211db97b09ad0bdff64429a423355bc84b772654f2ae3df0525314a7

SHA512
9c8b6bee72e74363732a2b54ab25fa1b6c2c0fd92ff4f700c838f53be1a1ff1f03fb5e6cca271e9d856cf0956ac72da8a9e6e0c2ad56d0a498ac9b74cca399a4

Download Submit
C:\Windows\System\nNsaAZB.exe

Filesize
1.5MB

MD5
51accf861955f43d3fcee6c634f3fa3c

SHA1
0f57011b93e6d137c4368ca8c93a6521f2690e48

SHA256
9bc9cdb29a803c35ba09cb0b6344d14efefe0fb23722fd451fe60d92d36b2ea9

SHA512
87a70997837a856554516c42e57e1220a60e9de465502fc57bc2db706b037db7596fdf88e2171ed8d48f5efd70b87ce03471782d7471a5417c1bb1968b131a5c

Download Submit
C:\Windows\System\nbDmuHB.exe

Filesize
1.5MB

MD5
8f31ee78b1c0241ab0d2c9b5a148f5b1

SHA1
36a17754ab98989e4a9139f8644a496c3bc4e84f

SHA256
9e8f94154babdd8c67ebf642d66aae3c86c2d0ceb956810bdf25790085c20ee4

SHA512
a9487c0f4f7a77e164475b6f97c14dd2443716dc5724a3d825cb57635ce9f6c5b85b02fd89ff75c25786f19c75fea1990f41aca7367e4abb580e4785a42132f4

Download Submit
C:\Windows\System\xUqPgYp.exe

Filesize
1.5MB

MD5
36458ca28818777d64076ec493132f9e

SHA1
34cedf9581d105ea17d87169d195decbdef78517

SHA256
a8784b33d5d58d1f4ff914b6a22f4197cd09e7d01207ff4b6e75e444ea49eb57

SHA512
6fb8d1db10a577148fcfd013bdd448e3b4f2287fb467eed830ae1a74cc2da6db2853f25a88cecba8c59db50850a77e9c19cc889b9556a57b53274ed2875324b0

Download Submit
C:\Windows\System\zOBhPOJ.exe

Filesize
1.5MB

MD5
e203dcfab08d68b2b8062dc5cdb6c9a8

SHA1
367034e1ef3468e24364cca4aea2f993461f801e

SHA256
ae41c41826fdd17194d0eb8a353039fe2cec20399fde1249e4675a866e91a2f3

SHA512
62191af74d28f54a451a71fc78c13df1615bba3f5eb321cd8ad894af1caa32c2d71393e8e13843bd37e220209b1822f2755db163c060d683647e9429bd007a3f

Download Submit
memory/4356-0-0x00000252002E0000-0x00000252002F0000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads