xmrig | 5904b1bad3888824bcf41fe463376bfb0b29ced6dbd7e7994b5901a005f74b38

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
25/01/2025, 23:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5904b1bad3888824bcf41fe463376bfb0b29ced6dbd7e7994b5901a005f74b38.exe
Size

1.7MB
MD5

07c1233e4ed0adcd911daa0ceee59807
SHA1

b6389ae922e1e71b6c8de532288f7f3cb1ed98ab
SHA256

5904b1bad3888824bcf41fe463376bfb0b29ced6dbd7e7994b5901a005f74b38
SHA512

89be378350c5a712aa41e35113604a5ebd21e8be2815eb578dbc6435f62cb0bceb90a4c1a080d08e83adcf3cc6eb63b7310ee923e3f3634de129403393901229
SSDEEP

49152:GezaTF8FcNkNdfE0pZ9ozttwIRxA1Mc2UVHe:GemTLkNdfE0pZyH

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 33 IoCs

miner

resource	yara_rule
behavioral2/files/0x000c000000023b99-4.dat	xmrig
behavioral2/files/0x0008000000023c89-9.dat	xmrig
behavioral2/files/0x0007000000023c8d-14.dat	xmrig
behavioral2/files/0x0007000000023c8e-18.dat	xmrig
behavioral2/files/0x0007000000023c90-29.dat	xmrig
behavioral2/files/0x0007000000023c92-34.dat	xmrig
behavioral2/files/0x0007000000023c94-43.dat	xmrig
behavioral2/files/0x0007000000023c95-51.dat	xmrig
behavioral2/files/0x0007000000023c97-59.dat	xmrig
behavioral2/files/0x0007000000023c9d-92.dat	xmrig
behavioral2/files/0x0007000000023ca2-113.dat	xmrig
behavioral2/files/0x0007000000023ca6-136.dat	xmrig
behavioral2/files/0x0007000000023cac-161.dat	xmrig
behavioral2/files/0x0007000000023cab-158.dat	xmrig
behavioral2/files/0x0007000000023caa-156.dat	xmrig
behavioral2/files/0x0007000000023ca9-152.dat	xmrig
behavioral2/files/0x0007000000023ca8-146.dat	xmrig
behavioral2/files/0x0007000000023ca7-142.dat	xmrig
behavioral2/files/0x0007000000023ca5-132.dat	xmrig
behavioral2/files/0x0007000000023ca4-124.dat	xmrig
behavioral2/files/0x0007000000023ca3-119.dat	xmrig
behavioral2/files/0x0007000000023ca1-111.dat	xmrig
behavioral2/files/0x0007000000023ca0-107.dat	xmrig
behavioral2/files/0x0007000000023c9f-102.dat	xmrig
behavioral2/files/0x0007000000023c9e-97.dat	xmrig
behavioral2/files/0x0007000000023c9c-86.dat	xmrig
behavioral2/files/0x0007000000023c9b-82.dat	xmrig
behavioral2/files/0x0007000000023c9a-77.dat	xmrig
behavioral2/files/0x0007000000023c99-71.dat	xmrig
behavioral2/files/0x0007000000023c98-67.dat	xmrig
behavioral2/files/0x0007000000023c96-54.dat	xmrig
behavioral2/files/0x0007000000023c93-39.dat	xmrig
behavioral2/files/0x0007000000023c8f-23.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
4132	OSasbDD.exe
3360	CmkDVgj.exe
880	BtbyDxx.exe
2764	wrPxATm.exe
5064	EzQzmBb.exe
552	ymzoUFQ.exe
1760	BBxheLl.exe
3640	hCafaCr.exe
4876	EhiJIrZ.exe
3352	qaPlhqV.exe
2164	mqsWepi.exe
4652	OjUlyPF.exe
1288	txYCyEO.exe
3288	cCxxIIy.exe
3864	gftAmYr.exe
1316	tLivMoO.exe
3280	hXmnwgb.exe
1832	yOnNVIL.exe
2112	ZiqCgJM.exe
3052	cCmdkLT.exe
1364	LWKVhXG.exe
2544	PerRxZc.exe
4428	nSspWNX.exe
3440	zwnagkR.exe
4916	wQUuHIm.exe
456	ZFnOPRJ.exe
4040	LgaVBbB.exe
4248	RmxnufR.exe
2940	fBLQoYg.exe
460	kRTfeIj.exe
2528	abfQcfs.exe
224	SGWirTY.exe
4384	hkPkQQz.exe
1064	igmBUOA.exe
2844	wtkgMfn.exe
1964	QkMjisk.exe
3516	ggqGGxn.exe
692	wiHSYVP.exe
2368	MnkrgPe.exe
4072	DnrPItH.exe
2532	VTdaKPh.exe
3064	XyhkUwt.exe
3120	zOSczww.exe
1400	eUGaqIk.exe
1468	kIYMLLY.exe
4168	GgBjree.exe
4568	vHrdMJm.exe
1684	VhqVONj.exe
4540	NcvPljW.exe
4508	jhkspvN.exe
3620	ipKKTaU.exe
2572	NHYcMfk.exe
452	SxAgbck.exe
5016	JEgGZqC.exe
3292	kntnbUO.exe
2904	ibDQect.exe
4308	GGMdTod.exe
4336	ICThfvq.exe
3236	JgzjnSl.exe
4468	XEDafYP.exe
3008	aqiHeMC.exe
2900	FyztkBU.exe
3196	FFhEzCp.exe
3220	dtyMHBq.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\kcYPeZB.exe	5904b1bad3888824bcf41fe463376bfb0b29ced6dbd7e7994b5901a005f74b38.exe
File created	C:\Windows\System\ehcaWeJ.exe	5904b1bad3888824bcf41fe463376bfb0b29ced6dbd7e7994b5901a005f74b38.exe
File created	C:\Windows\System\BpzAFVO.exe	5904b1bad3888824bcf41fe463376bfb0b29ced6dbd7e7994b5901a005f74b38.exe
File created	C:\Windows\System\kqfKNLd.exe	5904b1bad3888824bcf41fe463376bfb0b29ced6dbd7e7994b5901a005f74b38.exe
File created	C:\Windows\System\iUBKUxf.exe	5904b1bad3888824bcf41fe463376bfb0b29ced6dbd7e7994b5901a005f74b38.exe
File created	C:\Windows\System\cCmdkLT.exe	5904b1bad3888824bcf41fe463376bfb0b29ced6dbd7e7994b5901a005f74b38.exe
File created	C:\Windows\System\PKsnvYW.exe	5904b1bad3888824bcf41fe463376bfb0b29ced6dbd7e7994b5901a005f74b38.exe
File created	C:\Windows\System\fKMgFMM.exe	5904b1bad3888824bcf41fe463376bfb0b29ced6dbd7e7994b5901a005f74b38.exe
File created	C:\Windows\System\UwuSMCO.exe	5904b1bad3888824bcf41fe463376bfb0b29ced6dbd7e7994b5901a005f74b38.exe
File created	C:\Windows\System\djCpcUq.exe	5904b1bad3888824bcf41fe463376bfb0b29ced6dbd7e7994b5901a005f74b38.exe
File created	C:\Windows\System\YqDgzJy.exe	5904b1bad3888824bcf41fe463376bfb0b29ced6dbd7e7994b5901a005f74b38.exe
File created	C:\Windows\System\GhLGJMu.exe	5904b1bad3888824bcf41fe463376bfb0b29ced6dbd7e7994b5901a005f74b38.exe
File created	C:\Windows\System\rlwkdgb.exe	5904b1bad3888824bcf41fe463376bfb0b29ced6dbd7e7994b5901a005f74b38.exe
File created	C:\Windows\System\XnbmnxL.exe	5904b1bad3888824bcf41fe463376bfb0b29ced6dbd7e7994b5901a005f74b38.exe
File created	C:\Windows\System\npAIOFn.exe	5904b1bad3888824bcf41fe463376bfb0b29ced6dbd7e7994b5901a005f74b38.exe
File created	C:\Windows\System\dwDEMoF.exe	5904b1bad3888824bcf41fe463376bfb0b29ced6dbd7e7994b5901a005f74b38.exe
File created	C:\Windows\System\dKLdnNz.exe	5904b1bad3888824bcf41fe463376bfb0b29ced6dbd7e7994b5901a005f74b38.exe
File created	C:\Windows\System\vaalmWv.exe	5904b1bad3888824bcf41fe463376bfb0b29ced6dbd7e7994b5901a005f74b38.exe
File created	C:\Windows\System\VztNvYe.exe	5904b1bad3888824bcf41fe463376bfb0b29ced6dbd7e7994b5901a005f74b38.exe
File created	C:\Windows\System\WsmpLaa.exe	5904b1bad3888824bcf41fe463376bfb0b29ced6dbd7e7994b5901a005f74b38.exe
File created	C:\Windows\System\DVzYWHE.exe	5904b1bad3888824bcf41fe463376bfb0b29ced6dbd7e7994b5901a005f74b38.exe
File created	C:\Windows\System\JWodwCn.exe	5904b1bad3888824bcf41fe463376bfb0b29ced6dbd7e7994b5901a005f74b38.exe
File created	C:\Windows\System\MYFYgLU.exe	5904b1bad3888824bcf41fe463376bfb0b29ced6dbd7e7994b5901a005f74b38.exe
File created	C:\Windows\System\gvSABOy.exe	5904b1bad3888824bcf41fe463376bfb0b29ced6dbd7e7994b5901a005f74b38.exe
File created	C:\Windows\System\ggEFtbp.exe	5904b1bad3888824bcf41fe463376bfb0b29ced6dbd7e7994b5901a005f74b38.exe
File created	C:\Windows\System\wQUuHIm.exe	5904b1bad3888824bcf41fe463376bfb0b29ced6dbd7e7994b5901a005f74b38.exe
File created	C:\Windows\System\VLuhsST.exe	5904b1bad3888824bcf41fe463376bfb0b29ced6dbd7e7994b5901a005f74b38.exe
File created	C:\Windows\System\imJNnDf.exe	5904b1bad3888824bcf41fe463376bfb0b29ced6dbd7e7994b5901a005f74b38.exe
File created	C:\Windows\System\aluCJii.exe	5904b1bad3888824bcf41fe463376bfb0b29ced6dbd7e7994b5901a005f74b38.exe
File created	C:\Windows\System\WjVNMdl.exe	5904b1bad3888824bcf41fe463376bfb0b29ced6dbd7e7994b5901a005f74b38.exe
File created	C:\Windows\System\JEgGZqC.exe	5904b1bad3888824bcf41fe463376bfb0b29ced6dbd7e7994b5901a005f74b38.exe
File created	C:\Windows\System\jkwuBQo.exe	5904b1bad3888824bcf41fe463376bfb0b29ced6dbd7e7994b5901a005f74b38.exe
File created	C:\Windows\System\PhkMGsw.exe	5904b1bad3888824bcf41fe463376bfb0b29ced6dbd7e7994b5901a005f74b38.exe
File created	C:\Windows\System\tkuoPDM.exe	5904b1bad3888824bcf41fe463376bfb0b29ced6dbd7e7994b5901a005f74b38.exe
File created	C:\Windows\System\eGRDmpw.exe	5904b1bad3888824bcf41fe463376bfb0b29ced6dbd7e7994b5901a005f74b38.exe
File created	C:\Windows\System\aWwqvKs.exe	5904b1bad3888824bcf41fe463376bfb0b29ced6dbd7e7994b5901a005f74b38.exe
File created	C:\Windows\System\LWKVhXG.exe	5904b1bad3888824bcf41fe463376bfb0b29ced6dbd7e7994b5901a005f74b38.exe
File created	C:\Windows\System\pXxvfYO.exe	5904b1bad3888824bcf41fe463376bfb0b29ced6dbd7e7994b5901a005f74b38.exe
File created	C:\Windows\System\RZprdiz.exe	5904b1bad3888824bcf41fe463376bfb0b29ced6dbd7e7994b5901a005f74b38.exe
File created	C:\Windows\System\rcksGZO.exe	5904b1bad3888824bcf41fe463376bfb0b29ced6dbd7e7994b5901a005f74b38.exe
File created	C:\Windows\System\PsDnOgG.exe	5904b1bad3888824bcf41fe463376bfb0b29ced6dbd7e7994b5901a005f74b38.exe
File created	C:\Windows\System\XGFGZWu.exe	5904b1bad3888824bcf41fe463376bfb0b29ced6dbd7e7994b5901a005f74b38.exe
File created	C:\Windows\System\ggqGGxn.exe	5904b1bad3888824bcf41fe463376bfb0b29ced6dbd7e7994b5901a005f74b38.exe
File created	C:\Windows\System\TTuuuBY.exe	5904b1bad3888824bcf41fe463376bfb0b29ced6dbd7e7994b5901a005f74b38.exe
File created	C:\Windows\System\cBWjRuK.exe	5904b1bad3888824bcf41fe463376bfb0b29ced6dbd7e7994b5901a005f74b38.exe
File created	C:\Windows\System\uSuEhKd.exe	5904b1bad3888824bcf41fe463376bfb0b29ced6dbd7e7994b5901a005f74b38.exe
File created	C:\Windows\System\moKqKgl.exe	5904b1bad3888824bcf41fe463376bfb0b29ced6dbd7e7994b5901a005f74b38.exe
File created	C:\Windows\System\KAgZhUw.exe	5904b1bad3888824bcf41fe463376bfb0b29ced6dbd7e7994b5901a005f74b38.exe
File created	C:\Windows\System\OHFXdtE.exe	5904b1bad3888824bcf41fe463376bfb0b29ced6dbd7e7994b5901a005f74b38.exe
File created	C:\Windows\System\hkPkQQz.exe	5904b1bad3888824bcf41fe463376bfb0b29ced6dbd7e7994b5901a005f74b38.exe
File created	C:\Windows\System\eUGaqIk.exe	5904b1bad3888824bcf41fe463376bfb0b29ced6dbd7e7994b5901a005f74b38.exe
File created	C:\Windows\System\amGVLli.exe	5904b1bad3888824bcf41fe463376bfb0b29ced6dbd7e7994b5901a005f74b38.exe
File created	C:\Windows\System\UvRMoXP.exe	5904b1bad3888824bcf41fe463376bfb0b29ced6dbd7e7994b5901a005f74b38.exe
File created	C:\Windows\System\xUhNufW.exe	5904b1bad3888824bcf41fe463376bfb0b29ced6dbd7e7994b5901a005f74b38.exe
File created	C:\Windows\System\cGEJMtk.exe	5904b1bad3888824bcf41fe463376bfb0b29ced6dbd7e7994b5901a005f74b38.exe
File created	C:\Windows\System\POCVXvn.exe	5904b1bad3888824bcf41fe463376bfb0b29ced6dbd7e7994b5901a005f74b38.exe
File created	C:\Windows\System\YssmTNy.exe	5904b1bad3888824bcf41fe463376bfb0b29ced6dbd7e7994b5901a005f74b38.exe
File created	C:\Windows\System\CRsVHjA.exe	5904b1bad3888824bcf41fe463376bfb0b29ced6dbd7e7994b5901a005f74b38.exe
File created	C:\Windows\System\qrYoZLQ.exe	5904b1bad3888824bcf41fe463376bfb0b29ced6dbd7e7994b5901a005f74b38.exe
File created	C:\Windows\System\XrWffAh.exe	5904b1bad3888824bcf41fe463376bfb0b29ced6dbd7e7994b5901a005f74b38.exe
File created	C:\Windows\System\FFhEzCp.exe	5904b1bad3888824bcf41fe463376bfb0b29ced6dbd7e7994b5901a005f74b38.exe
File created	C:\Windows\System\kjcstaC.exe	5904b1bad3888824bcf41fe463376bfb0b29ced6dbd7e7994b5901a005f74b38.exe
File created	C:\Windows\System\LUrEpeZ.exe	5904b1bad3888824bcf41fe463376bfb0b29ced6dbd7e7994b5901a005f74b38.exe
File created	C:\Windows\System\KwUTiDT.exe	5904b1bad3888824bcf41fe463376bfb0b29ced6dbd7e7994b5901a005f74b38.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	17112	dwm.exe
Token: SeChangeNotifyPrivilege	17112	dwm.exe
Token: 33	17112	dwm.exe
Token: SeIncBasePriorityPrivilege	17112	dwm.exe
Token: SeShutdownPrivilege	17112	dwm.exe
Token: SeCreatePagefilePrivilege	17112	dwm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4748 wrote to memory of 4132	4748	5904b1bad3888824bcf41fe463376bfb0b29ced6dbd7e7994b5901a005f74b38.exe	84
PID 4748 wrote to memory of 4132	4748	5904b1bad3888824bcf41fe463376bfb0b29ced6dbd7e7994b5901a005f74b38.exe	84
PID 4748 wrote to memory of 3360	4748	5904b1bad3888824bcf41fe463376bfb0b29ced6dbd7e7994b5901a005f74b38.exe	85
PID 4748 wrote to memory of 3360	4748	5904b1bad3888824bcf41fe463376bfb0b29ced6dbd7e7994b5901a005f74b38.exe	85
PID 4748 wrote to memory of 880	4748	5904b1bad3888824bcf41fe463376bfb0b29ced6dbd7e7994b5901a005f74b38.exe	86
PID 4748 wrote to memory of 880	4748	5904b1bad3888824bcf41fe463376bfb0b29ced6dbd7e7994b5901a005f74b38.exe	86
PID 4748 wrote to memory of 2764	4748	5904b1bad3888824bcf41fe463376bfb0b29ced6dbd7e7994b5901a005f74b38.exe	87
PID 4748 wrote to memory of 2764	4748	5904b1bad3888824bcf41fe463376bfb0b29ced6dbd7e7994b5901a005f74b38.exe	87
PID 4748 wrote to memory of 5064	4748	5904b1bad3888824bcf41fe463376bfb0b29ced6dbd7e7994b5901a005f74b38.exe	88
PID 4748 wrote to memory of 5064	4748	5904b1bad3888824bcf41fe463376bfb0b29ced6dbd7e7994b5901a005f74b38.exe	88
PID 4748 wrote to memory of 552	4748	5904b1bad3888824bcf41fe463376bfb0b29ced6dbd7e7994b5901a005f74b38.exe	89
PID 4748 wrote to memory of 552	4748	5904b1bad3888824bcf41fe463376bfb0b29ced6dbd7e7994b5901a005f74b38.exe	89
PID 4748 wrote to memory of 1760	4748	5904b1bad3888824bcf41fe463376bfb0b29ced6dbd7e7994b5901a005f74b38.exe	90
PID 4748 wrote to memory of 1760	4748	5904b1bad3888824bcf41fe463376bfb0b29ced6dbd7e7994b5901a005f74b38.exe	90
PID 4748 wrote to memory of 3640	4748	5904b1bad3888824bcf41fe463376bfb0b29ced6dbd7e7994b5901a005f74b38.exe	91
PID 4748 wrote to memory of 3640	4748	5904b1bad3888824bcf41fe463376bfb0b29ced6dbd7e7994b5901a005f74b38.exe	91
PID 4748 wrote to memory of 4876	4748	5904b1bad3888824bcf41fe463376bfb0b29ced6dbd7e7994b5901a005f74b38.exe	92
PID 4748 wrote to memory of 4876	4748	5904b1bad3888824bcf41fe463376bfb0b29ced6dbd7e7994b5901a005f74b38.exe	92
PID 4748 wrote to memory of 3352	4748	5904b1bad3888824bcf41fe463376bfb0b29ced6dbd7e7994b5901a005f74b38.exe	93
PID 4748 wrote to memory of 3352	4748	5904b1bad3888824bcf41fe463376bfb0b29ced6dbd7e7994b5901a005f74b38.exe	93
PID 4748 wrote to memory of 2164	4748	5904b1bad3888824bcf41fe463376bfb0b29ced6dbd7e7994b5901a005f74b38.exe	94
PID 4748 wrote to memory of 2164	4748	5904b1bad3888824bcf41fe463376bfb0b29ced6dbd7e7994b5901a005f74b38.exe	94
PID 4748 wrote to memory of 4652	4748	5904b1bad3888824bcf41fe463376bfb0b29ced6dbd7e7994b5901a005f74b38.exe	95
PID 4748 wrote to memory of 4652	4748	5904b1bad3888824bcf41fe463376bfb0b29ced6dbd7e7994b5901a005f74b38.exe	95
PID 4748 wrote to memory of 1288	4748	5904b1bad3888824bcf41fe463376bfb0b29ced6dbd7e7994b5901a005f74b38.exe	96
PID 4748 wrote to memory of 1288	4748	5904b1bad3888824bcf41fe463376bfb0b29ced6dbd7e7994b5901a005f74b38.exe	96
PID 4748 wrote to memory of 3288	4748	5904b1bad3888824bcf41fe463376bfb0b29ced6dbd7e7994b5901a005f74b38.exe	97
PID 4748 wrote to memory of 3288	4748	5904b1bad3888824bcf41fe463376bfb0b29ced6dbd7e7994b5901a005f74b38.exe	97
PID 4748 wrote to memory of 3864	4748	5904b1bad3888824bcf41fe463376bfb0b29ced6dbd7e7994b5901a005f74b38.exe	98
PID 4748 wrote to memory of 3864	4748	5904b1bad3888824bcf41fe463376bfb0b29ced6dbd7e7994b5901a005f74b38.exe	98
PID 4748 wrote to memory of 1316	4748	5904b1bad3888824bcf41fe463376bfb0b29ced6dbd7e7994b5901a005f74b38.exe	99
PID 4748 wrote to memory of 1316	4748	5904b1bad3888824bcf41fe463376bfb0b29ced6dbd7e7994b5901a005f74b38.exe	99
PID 4748 wrote to memory of 3280	4748	5904b1bad3888824bcf41fe463376bfb0b29ced6dbd7e7994b5901a005f74b38.exe	100
PID 4748 wrote to memory of 3280	4748	5904b1bad3888824bcf41fe463376bfb0b29ced6dbd7e7994b5901a005f74b38.exe	100
PID 4748 wrote to memory of 1832	4748	5904b1bad3888824bcf41fe463376bfb0b29ced6dbd7e7994b5901a005f74b38.exe	101
PID 4748 wrote to memory of 1832	4748	5904b1bad3888824bcf41fe463376bfb0b29ced6dbd7e7994b5901a005f74b38.exe	101
PID 4748 wrote to memory of 2112	4748	5904b1bad3888824bcf41fe463376bfb0b29ced6dbd7e7994b5901a005f74b38.exe	102
PID 4748 wrote to memory of 2112	4748	5904b1bad3888824bcf41fe463376bfb0b29ced6dbd7e7994b5901a005f74b38.exe	102
PID 4748 wrote to memory of 3052	4748	5904b1bad3888824bcf41fe463376bfb0b29ced6dbd7e7994b5901a005f74b38.exe	103
PID 4748 wrote to memory of 3052	4748	5904b1bad3888824bcf41fe463376bfb0b29ced6dbd7e7994b5901a005f74b38.exe	103
PID 4748 wrote to memory of 1364	4748	5904b1bad3888824bcf41fe463376bfb0b29ced6dbd7e7994b5901a005f74b38.exe	104
PID 4748 wrote to memory of 1364	4748	5904b1bad3888824bcf41fe463376bfb0b29ced6dbd7e7994b5901a005f74b38.exe	104
PID 4748 wrote to memory of 2544	4748	5904b1bad3888824bcf41fe463376bfb0b29ced6dbd7e7994b5901a005f74b38.exe	105
PID 4748 wrote to memory of 2544	4748	5904b1bad3888824bcf41fe463376bfb0b29ced6dbd7e7994b5901a005f74b38.exe	105
PID 4748 wrote to memory of 4428	4748	5904b1bad3888824bcf41fe463376bfb0b29ced6dbd7e7994b5901a005f74b38.exe	106
PID 4748 wrote to memory of 4428	4748	5904b1bad3888824bcf41fe463376bfb0b29ced6dbd7e7994b5901a005f74b38.exe	106
PID 4748 wrote to memory of 3440	4748	5904b1bad3888824bcf41fe463376bfb0b29ced6dbd7e7994b5901a005f74b38.exe	107
PID 4748 wrote to memory of 3440	4748	5904b1bad3888824bcf41fe463376bfb0b29ced6dbd7e7994b5901a005f74b38.exe	107
PID 4748 wrote to memory of 4916	4748	5904b1bad3888824bcf41fe463376bfb0b29ced6dbd7e7994b5901a005f74b38.exe	108
PID 4748 wrote to memory of 4916	4748	5904b1bad3888824bcf41fe463376bfb0b29ced6dbd7e7994b5901a005f74b38.exe	108
PID 4748 wrote to memory of 456	4748	5904b1bad3888824bcf41fe463376bfb0b29ced6dbd7e7994b5901a005f74b38.exe	109
PID 4748 wrote to memory of 456	4748	5904b1bad3888824bcf41fe463376bfb0b29ced6dbd7e7994b5901a005f74b38.exe	109
PID 4748 wrote to memory of 4040	4748	5904b1bad3888824bcf41fe463376bfb0b29ced6dbd7e7994b5901a005f74b38.exe	110
PID 4748 wrote to memory of 4040	4748	5904b1bad3888824bcf41fe463376bfb0b29ced6dbd7e7994b5901a005f74b38.exe	110
PID 4748 wrote to memory of 4248	4748	5904b1bad3888824bcf41fe463376bfb0b29ced6dbd7e7994b5901a005f74b38.exe	111
PID 4748 wrote to memory of 4248	4748	5904b1bad3888824bcf41fe463376bfb0b29ced6dbd7e7994b5901a005f74b38.exe	111
PID 4748 wrote to memory of 2940	4748	5904b1bad3888824bcf41fe463376bfb0b29ced6dbd7e7994b5901a005f74b38.exe	112
PID 4748 wrote to memory of 2940	4748	5904b1bad3888824bcf41fe463376bfb0b29ced6dbd7e7994b5901a005f74b38.exe	112
PID 4748 wrote to memory of 460	4748	5904b1bad3888824bcf41fe463376bfb0b29ced6dbd7e7994b5901a005f74b38.exe	113
PID 4748 wrote to memory of 460	4748	5904b1bad3888824bcf41fe463376bfb0b29ced6dbd7e7994b5901a005f74b38.exe	113
PID 4748 wrote to memory of 2528	4748	5904b1bad3888824bcf41fe463376bfb0b29ced6dbd7e7994b5901a005f74b38.exe	114
PID 4748 wrote to memory of 2528	4748	5904b1bad3888824bcf41fe463376bfb0b29ced6dbd7e7994b5901a005f74b38.exe	114
PID 4748 wrote to memory of 224	4748	5904b1bad3888824bcf41fe463376bfb0b29ced6dbd7e7994b5901a005f74b38.exe	115
PID 4748 wrote to memory of 224	4748	5904b1bad3888824bcf41fe463376bfb0b29ced6dbd7e7994b5901a005f74b38.exe	115

C:\Users\Admin\AppData\Local\Temp\5904b1bad3888824bcf41fe463376bfb0b29ced6dbd7e7994b5901a005f74b38.exe
"C:\Users\Admin\AppData\Local\Temp\5904b1bad3888824bcf41fe463376bfb0b29ced6dbd7e7994b5901a005f74b38.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4748
- C:\Windows\System\OSasbDD.exe
  C:\Windows\System\OSasbDD.exe
  2⤵
  - Executes dropped EXE
  PID:4132
- C:\Windows\System\CmkDVgj.exe
  C:\Windows\System\CmkDVgj.exe
  2⤵
  - Executes dropped EXE
  PID:3360
- C:\Windows\System\BtbyDxx.exe
  C:\Windows\System\BtbyDxx.exe
  2⤵
  - Executes dropped EXE
  PID:880
- C:\Windows\System\wrPxATm.exe
  C:\Windows\System\wrPxATm.exe
  2⤵
  - Executes dropped EXE
  PID:2764
- C:\Windows\System\EzQzmBb.exe
  C:\Windows\System\EzQzmBb.exe
  2⤵
  - Executes dropped EXE
  PID:5064
- C:\Windows\System\ymzoUFQ.exe
  C:\Windows\System\ymzoUFQ.exe
  2⤵
  - Executes dropped EXE
  PID:552
- C:\Windows\System\BBxheLl.exe
  C:\Windows\System\BBxheLl.exe
  2⤵
  - Executes dropped EXE
  PID:1760
- C:\Windows\System\hCafaCr.exe
  C:\Windows\System\hCafaCr.exe
  2⤵
  - Executes dropped EXE
  PID:3640
- C:\Windows\System\EhiJIrZ.exe
  C:\Windows\System\EhiJIrZ.exe
  2⤵
  - Executes dropped EXE
  PID:4876
- C:\Windows\System\qaPlhqV.exe
  C:\Windows\System\qaPlhqV.exe
  2⤵
  - Executes dropped EXE
  PID:3352
- C:\Windows\System\mqsWepi.exe
  C:\Windows\System\mqsWepi.exe
  2⤵
  - Executes dropped EXE
  PID:2164
- C:\Windows\System\OjUlyPF.exe
  C:\Windows\System\OjUlyPF.exe
  2⤵
  - Executes dropped EXE
  PID:4652
- C:\Windows\System\txYCyEO.exe
  C:\Windows\System\txYCyEO.exe
  2⤵
  - Executes dropped EXE
  PID:1288
- C:\Windows\System\cCxxIIy.exe
  C:\Windows\System\cCxxIIy.exe
  2⤵
  - Executes dropped EXE
  PID:3288
- C:\Windows\System\gftAmYr.exe
  C:\Windows\System\gftAmYr.exe
  2⤵
  - Executes dropped EXE
  PID:3864
- C:\Windows\System\tLivMoO.exe
  C:\Windows\System\tLivMoO.exe
  2⤵
  - Executes dropped EXE
  PID:1316
- C:\Windows\System\hXmnwgb.exe
  C:\Windows\System\hXmnwgb.exe
  2⤵
  - Executes dropped EXE
  PID:3280
- C:\Windows\System\yOnNVIL.exe
  C:\Windows\System\yOnNVIL.exe
  2⤵
  - Executes dropped EXE
  PID:1832
- C:\Windows\System\ZiqCgJM.exe
  C:\Windows\System\ZiqCgJM.exe
  2⤵
  - Executes dropped EXE
  PID:2112
- C:\Windows\System\cCmdkLT.exe
  C:\Windows\System\cCmdkLT.exe
  2⤵
  - Executes dropped EXE
  PID:3052
- C:\Windows\System\LWKVhXG.exe
  C:\Windows\System\LWKVhXG.exe
  2⤵
  - Executes dropped EXE
  PID:1364
- C:\Windows\System\PerRxZc.exe
  C:\Windows\System\PerRxZc.exe
  2⤵
  - Executes dropped EXE
  PID:2544
- C:\Windows\System\nSspWNX.exe
  C:\Windows\System\nSspWNX.exe
  2⤵
  - Executes dropped EXE
  PID:4428
- C:\Windows\System\zwnagkR.exe
  C:\Windows\System\zwnagkR.exe
  2⤵
  - Executes dropped EXE
  PID:3440
- C:\Windows\System\wQUuHIm.exe
  C:\Windows\System\wQUuHIm.exe
  2⤵
  - Executes dropped EXE
  PID:4916
- C:\Windows\System\ZFnOPRJ.exe
  C:\Windows\System\ZFnOPRJ.exe
  2⤵
  - Executes dropped EXE
  PID:456
- C:\Windows\System\LgaVBbB.exe
  C:\Windows\System\LgaVBbB.exe
  2⤵
  - Executes dropped EXE
  PID:4040
- C:\Windows\System\RmxnufR.exe
  C:\Windows\System\RmxnufR.exe
  2⤵
  - Executes dropped EXE
  PID:4248
- C:\Windows\System\fBLQoYg.exe
  C:\Windows\System\fBLQoYg.exe
  2⤵
  - Executes dropped EXE
  PID:2940
- C:\Windows\System\kRTfeIj.exe
  C:\Windows\System\kRTfeIj.exe
  2⤵
  - Executes dropped EXE
  PID:460
- C:\Windows\System\abfQcfs.exe
  C:\Windows\System\abfQcfs.exe
  2⤵
  - Executes dropped EXE
  PID:2528
- C:\Windows\System\SGWirTY.exe
  C:\Windows\System\SGWirTY.exe
  2⤵
  - Executes dropped EXE
  PID:224
- C:\Windows\System\hkPkQQz.exe
  C:\Windows\System\hkPkQQz.exe
  2⤵
  - Executes dropped EXE
  PID:4384
- C:\Windows\System\igmBUOA.exe
  C:\Windows\System\igmBUOA.exe
  2⤵
  - Executes dropped EXE
  PID:1064
- C:\Windows\System\wtkgMfn.exe
  C:\Windows\System\wtkgMfn.exe
  2⤵
  - Executes dropped EXE
  PID:2844
- C:\Windows\System\QkMjisk.exe
  C:\Windows\System\QkMjisk.exe
  2⤵
  - Executes dropped EXE
  PID:1964
- C:\Windows\System\ggqGGxn.exe
  C:\Windows\System\ggqGGxn.exe
  2⤵
  - Executes dropped EXE
  PID:3516
- C:\Windows\System\wiHSYVP.exe
  C:\Windows\System\wiHSYVP.exe
  2⤵
  - Executes dropped EXE
  PID:692
- C:\Windows\System\MnkrgPe.exe
  C:\Windows\System\MnkrgPe.exe
  2⤵
  - Executes dropped EXE
  PID:2368
- C:\Windows\System\DnrPItH.exe
  C:\Windows\System\DnrPItH.exe
  2⤵
  - Executes dropped EXE
  PID:4072
- C:\Windows\System\VTdaKPh.exe
  C:\Windows\System\VTdaKPh.exe
  2⤵
  - Executes dropped EXE
  PID:2532
- C:\Windows\System\XyhkUwt.exe
  C:\Windows\System\XyhkUwt.exe
  2⤵
  - Executes dropped EXE
  PID:3064
- C:\Windows\System\zOSczww.exe
  C:\Windows\System\zOSczww.exe
  2⤵
  - Executes dropped EXE
  PID:3120
- C:\Windows\System\eUGaqIk.exe
  C:\Windows\System\eUGaqIk.exe
  2⤵
  - Executes dropped EXE
  PID:1400
- C:\Windows\System\kIYMLLY.exe
  C:\Windows\System\kIYMLLY.exe
  2⤵
  - Executes dropped EXE
  PID:1468
- C:\Windows\System\GgBjree.exe
  C:\Windows\System\GgBjree.exe
  2⤵
  - Executes dropped EXE
  PID:4168
- C:\Windows\System\vHrdMJm.exe
  C:\Windows\System\vHrdMJm.exe
  2⤵
  - Executes dropped EXE
  PID:4568
- C:\Windows\System\VhqVONj.exe
  C:\Windows\System\VhqVONj.exe
  2⤵
  - Executes dropped EXE
  PID:1684
- C:\Windows\System\NcvPljW.exe
  C:\Windows\System\NcvPljW.exe
  2⤵
  - Executes dropped EXE
  PID:4540
- C:\Windows\System\jhkspvN.exe
  C:\Windows\System\jhkspvN.exe
  2⤵
  - Executes dropped EXE
  PID:4508
- C:\Windows\System\ipKKTaU.exe
  C:\Windows\System\ipKKTaU.exe
  2⤵
  - Executes dropped EXE
  PID:3620
- C:\Windows\System\NHYcMfk.exe
  C:\Windows\System\NHYcMfk.exe
  2⤵
  - Executes dropped EXE
  PID:2572
- C:\Windows\System\SxAgbck.exe
  C:\Windows\System\SxAgbck.exe
  2⤵
  - Executes dropped EXE
  PID:452
- C:\Windows\System\JEgGZqC.exe
  C:\Windows\System\JEgGZqC.exe
  2⤵
  - Executes dropped EXE
  PID:5016
- C:\Windows\System\kntnbUO.exe
  C:\Windows\System\kntnbUO.exe
  2⤵
  - Executes dropped EXE
  PID:3292
- C:\Windows\System\ibDQect.exe
  C:\Windows\System\ibDQect.exe
  2⤵
  - Executes dropped EXE
  PID:2904
- C:\Windows\System\GGMdTod.exe
  C:\Windows\System\GGMdTod.exe
  2⤵
  - Executes dropped EXE
  PID:4308
- C:\Windows\System\ICThfvq.exe
  C:\Windows\System\ICThfvq.exe
  2⤵
  - Executes dropped EXE
  PID:4336
- C:\Windows\System\JgzjnSl.exe
  C:\Windows\System\JgzjnSl.exe
  2⤵
  - Executes dropped EXE
  PID:3236
- C:\Windows\System\XEDafYP.exe
  C:\Windows\System\XEDafYP.exe
  2⤵
  - Executes dropped EXE
  PID:4468
- C:\Windows\System\aqiHeMC.exe
  C:\Windows\System\aqiHeMC.exe
  2⤵
  - Executes dropped EXE
  PID:3008
- C:\Windows\System\FyztkBU.exe
  C:\Windows\System\FyztkBU.exe
  2⤵
  - Executes dropped EXE
  PID:2900
- C:\Windows\System\FFhEzCp.exe
  C:\Windows\System\FFhEzCp.exe
  2⤵
  - Executes dropped EXE
  PID:3196
- C:\Windows\System\dtyMHBq.exe
  C:\Windows\System\dtyMHBq.exe
  2⤵
  - Executes dropped EXE
  PID:3220
- C:\Windows\System\ytotnFO.exe
  C:\Windows\System\ytotnFO.exe
  2⤵
  PID:3936
- C:\Windows\System\IiSGyrj.exe
  C:\Windows\System\IiSGyrj.exe
  2⤵
  PID:1844
- C:\Windows\System\WmGFkdv.exe
  C:\Windows\System\WmGFkdv.exe
  2⤵
  PID:1624
- C:\Windows\System\RIPBTCP.exe
  C:\Windows\System\RIPBTCP.exe
  2⤵
  PID:1448
- C:\Windows\System\LSVzszd.exe
  C:\Windows\System\LSVzszd.exe
  2⤵
  PID:708
- C:\Windows\System\svtchOk.exe
  C:\Windows\System\svtchOk.exe
  2⤵
  PID:976
- C:\Windows\System\jLuEAWB.exe
  C:\Windows\System\jLuEAWB.exe
  2⤵
  PID:1196
- C:\Windows\System\mKlFKRi.exe
  C:\Windows\System\mKlFKRi.exe
  2⤵
  PID:2576
- C:\Windows\System\NvfIhQc.exe
  C:\Windows\System\NvfIhQc.exe
  2⤵
  PID:4296
- C:\Windows\System\gQFkeXU.exe
  C:\Windows\System\gQFkeXU.exe
  2⤵
  PID:1716
- C:\Windows\System\tFJQqOk.exe
  C:\Windows\System\tFJQqOk.exe
  2⤵
  PID:4320
- C:\Windows\System\Iajqbso.exe
  C:\Windows\System\Iajqbso.exe
  2⤵
  PID:3284
- C:\Windows\System\RRSYOmn.exe
  C:\Windows\System\RRSYOmn.exe
  2⤵
  PID:4144
- C:\Windows\System\CisLxyV.exe
  C:\Windows\System\CisLxyV.exe
  2⤵
  PID:1060
- C:\Windows\System\NiZgqcx.exe
  C:\Windows\System\NiZgqcx.exe
  2⤵
  PID:1720
- C:\Windows\System\eAweNXf.exe
  C:\Windows\System\eAweNXf.exe
  2⤵
  PID:4852
- C:\Windows\System\QFflosF.exe
  C:\Windows\System\QFflosF.exe
  2⤵
  PID:2168
- C:\Windows\System\YHzRtjr.exe
  C:\Windows\System\YHzRtjr.exe
  2⤵
  PID:4128
- C:\Windows\System\kTCXPbc.exe
  C:\Windows\System\kTCXPbc.exe
  2⤵
  PID:1332
- C:\Windows\System\yIKRkdh.exe
  C:\Windows\System\yIKRkdh.exe
  2⤵
  PID:696
- C:\Windows\System\YhRkWAG.exe
  C:\Windows\System\YhRkWAG.exe
  2⤵
  PID:1704
- C:\Windows\System\ASoapLy.exe
  C:\Windows\System\ASoapLy.exe
  2⤵
  PID:4404
- C:\Windows\System\ZUjikEv.exe
  C:\Windows\System\ZUjikEv.exe
  2⤵
  PID:4232
- C:\Windows\System\nTpgEXP.exe
  C:\Windows\System\nTpgEXP.exe
  2⤵
  PID:3480
- C:\Windows\System\BOAglEV.exe
  C:\Windows\System\BOAglEV.exe
  2⤵
  PID:5128
- C:\Windows\System\QKoyJbU.exe
  C:\Windows\System\QKoyJbU.exe
  2⤵
  PID:5160
- C:\Windows\System\GGqIxtT.exe
  C:\Windows\System\GGqIxtT.exe
  2⤵
  PID:5192
- C:\Windows\System\ISEnnPU.exe
  C:\Windows\System\ISEnnPU.exe
  2⤵
  PID:5216
- C:\Windows\System\KXIWQSI.exe
  C:\Windows\System\KXIWQSI.exe
  2⤵
  PID:5248
- C:\Windows\System\apmXzZR.exe
  C:\Windows\System\apmXzZR.exe
  2⤵
  PID:5272
- C:\Windows\System\KlNBMxR.exe
  C:\Windows\System\KlNBMxR.exe
  2⤵
  PID:5300
- C:\Windows\System\aQSoydC.exe
  C:\Windows\System\aQSoydC.exe
  2⤵
  PID:5328
- C:\Windows\System\Owvypga.exe
  C:\Windows\System\Owvypga.exe
  2⤵
  PID:5360
- C:\Windows\System\dJjmuLt.exe
  C:\Windows\System\dJjmuLt.exe
  2⤵
  PID:5388
- C:\Windows\System\WsmpLaa.exe
  C:\Windows\System\WsmpLaa.exe
  2⤵
  PID:5416
- C:\Windows\System\sNLbioF.exe
  C:\Windows\System\sNLbioF.exe
  2⤵
  PID:5440
- C:\Windows\System\ezZqAzw.exe
  C:\Windows\System\ezZqAzw.exe
  2⤵
  PID:5460
- C:\Windows\System\uzozZQK.exe
  C:\Windows\System\uzozZQK.exe
  2⤵
  PID:5488
- C:\Windows\System\skkVVGs.exe
  C:\Windows\System\skkVVGs.exe
  2⤵
  PID:5516
- C:\Windows\System\NpSfWLG.exe
  C:\Windows\System\NpSfWLG.exe
  2⤵
  PID:5544
- C:\Windows\System\MzuMiny.exe
  C:\Windows\System\MzuMiny.exe
  2⤵
  PID:5572
- C:\Windows\System\tcjLlmm.exe
  C:\Windows\System\tcjLlmm.exe
  2⤵
  PID:5600
- C:\Windows\System\tdUGnSJ.exe
  C:\Windows\System\tdUGnSJ.exe
  2⤵
  PID:5632
- C:\Windows\System\HORGyQt.exe
  C:\Windows\System\HORGyQt.exe
  2⤵
  PID:5660
- C:\Windows\System\NqFEcwV.exe
  C:\Windows\System\NqFEcwV.exe
  2⤵
  PID:5692
- C:\Windows\System\tGtUiMK.exe
  C:\Windows\System\tGtUiMK.exe
  2⤵
  PID:5732
- C:\Windows\System\LbWdkzT.exe
  C:\Windows\System\LbWdkzT.exe
  2⤵
  PID:5748
- C:\Windows\System\lRKoTIG.exe
  C:\Windows\System\lRKoTIG.exe
  2⤵
  PID:5780
- C:\Windows\System\oiGSSFT.exe
  C:\Windows\System\oiGSSFT.exe
  2⤵
  PID:5804
- C:\Windows\System\SIHSLBx.exe
  C:\Windows\System\SIHSLBx.exe
  2⤵
  PID:5836
- C:\Windows\System\ycxNpyI.exe
  C:\Windows\System\ycxNpyI.exe
  2⤵
  PID:5860
- C:\Windows\System\DdbIJXy.exe
  C:\Windows\System\DdbIJXy.exe
  2⤵
  PID:5888
- C:\Windows\System\ucVQQBX.exe
  C:\Windows\System\ucVQQBX.exe
  2⤵
  PID:5916
- C:\Windows\System\mJDZueT.exe
  C:\Windows\System\mJDZueT.exe
  2⤵
  PID:5948
- C:\Windows\System\YUMfUOn.exe
  C:\Windows\System\YUMfUOn.exe
  2⤵
  PID:5972
- C:\Windows\System\zPAwIOr.exe
  C:\Windows\System\zPAwIOr.exe
  2⤵
  PID:6004
- C:\Windows\System\InwKcwt.exe
  C:\Windows\System\InwKcwt.exe
  2⤵
  PID:6028
- C:\Windows\System\iTehAhL.exe
  C:\Windows\System\iTehAhL.exe
  2⤵
  PID:6060
- C:\Windows\System\HKYaYRd.exe
  C:\Windows\System\HKYaYRd.exe
  2⤵
  PID:6084
- C:\Windows\System\POCVXvn.exe
  C:\Windows\System\POCVXvn.exe
  2⤵
  PID:6104
- C:\Windows\System\uKSPHVi.exe
  C:\Windows\System\uKSPHVi.exe
  2⤵
  PID:6132
- C:\Windows\System\oNBJHCv.exe
  C:\Windows\System\oNBJHCv.exe
  2⤵
  PID:3732
- C:\Windows\System\EgOyLpt.exe
  C:\Windows\System\EgOyLpt.exe
  2⤵
  PID:2796
- C:\Windows\System\HSTHGDM.exe
  C:\Windows\System\HSTHGDM.exe
  2⤵
  PID:4664
- C:\Windows\System\vtoTqHr.exe
  C:\Windows\System\vtoTqHr.exe
  2⤵
  PID:4884
- C:\Windows\System\UNGlNLI.exe
  C:\Windows\System\UNGlNLI.exe
  2⤵
  PID:1968
- C:\Windows\System\kjcstaC.exe
  C:\Windows\System\kjcstaC.exe
  2⤵
  PID:3276
- C:\Windows\System\qVDKXUk.exe
  C:\Windows\System\qVDKXUk.exe
  2⤵
  PID:3092
- C:\Windows\System\QgVXqtM.exe
  C:\Windows\System\QgVXqtM.exe
  2⤵
  PID:5148
- C:\Windows\System\qtMXEyW.exe
  C:\Windows\System\qtMXEyW.exe
  2⤵
  PID:5228
- C:\Windows\System\dKLdnNz.exe
  C:\Windows\System\dKLdnNz.exe
  2⤵
  PID:5284
- C:\Windows\System\ACfnSmW.exe
  C:\Windows\System\ACfnSmW.exe
  2⤵
  PID:5344
- C:\Windows\System\tDMyjMW.exe
  C:\Windows\System\tDMyjMW.exe
  2⤵
  PID:5408
- C:\Windows\System\FapjDhH.exe
  C:\Windows\System\FapjDhH.exe
  2⤵
  PID:5476
- C:\Windows\System\mgAHdhD.exe
  C:\Windows\System\mgAHdhD.exe
  2⤵
  PID:5536
- C:\Windows\System\DbTGGki.exe
  C:\Windows\System\DbTGGki.exe
  2⤵
  PID:5592
- C:\Windows\System\bQOfpRo.exe
  C:\Windows\System\bQOfpRo.exe
  2⤵
  PID:5676
- C:\Windows\System\PKsnvYW.exe
  C:\Windows\System\PKsnvYW.exe
  2⤵
  PID:5740
- C:\Windows\System\VrOBYke.exe
  C:\Windows\System\VrOBYke.exe
  2⤵
  PID:5800
- C:\Windows\System\gYmSQzs.exe
  C:\Windows\System\gYmSQzs.exe
  2⤵
  PID:5872
- C:\Windows\System\IIomhER.exe
  C:\Windows\System\IIomhER.exe
  2⤵
  PID:5932
- C:\Windows\System\XMOwZbz.exe
  C:\Windows\System\XMOwZbz.exe
  2⤵
  PID:5992
- C:\Windows\System\EHYoazA.exe
  C:\Windows\System\EHYoazA.exe
  2⤵
  PID:6068
- C:\Windows\System\zaPOSny.exe
  C:\Windows\System\zaPOSny.exe
  2⤵
  PID:6124
- C:\Windows\System\LQXvbOX.exe
  C:\Windows\System\LQXvbOX.exe
  2⤵
  PID:1452
- C:\Windows\System\JsZGvFn.exe
  C:\Windows\System\JsZGvFn.exe
  2⤵
  PID:3544
- C:\Windows\System\vbgCIlF.exe
  C:\Windows\System\vbgCIlF.exe
  2⤵
  PID:3660
- C:\Windows\System\xUhSbIO.exe
  C:\Windows\System\xUhSbIO.exe
  2⤵
  PID:5176
- C:\Windows\System\dGcAQbC.exe
  C:\Windows\System\dGcAQbC.exe
  2⤵
  PID:5320
- C:\Windows\System\xDwKKOv.exe
  C:\Windows\System\xDwKKOv.exe
  2⤵
  PID:5452
- C:\Windows\System\njBAOpG.exe
  C:\Windows\System\njBAOpG.exe
  2⤵
  PID:5628
- C:\Windows\System\ODXlepR.exe
  C:\Windows\System\ODXlepR.exe
  2⤵
  PID:2324
- C:\Windows\System\LMnFvCU.exe
  C:\Windows\System\LMnFvCU.exe
  2⤵
  PID:5904
- C:\Windows\System\LqpqJya.exe
  C:\Windows\System\LqpqJya.exe
  2⤵
  PID:6172
- C:\Windows\System\ltcINWU.exe
  C:\Windows\System\ltcINWU.exe
  2⤵
  PID:6200
- C:\Windows\System\eZdHhsu.exe
  C:\Windows\System\eZdHhsu.exe
  2⤵
  PID:6228
- C:\Windows\System\mAJKULT.exe
  C:\Windows\System\mAJKULT.exe
  2⤵
  PID:6256
- C:\Windows\System\SiWHouG.exe
  C:\Windows\System\SiWHouG.exe
  2⤵
  PID:6284
- C:\Windows\System\pGHeOBd.exe
  C:\Windows\System\pGHeOBd.exe
  2⤵
  PID:6312
- C:\Windows\System\pMhqDYQ.exe
  C:\Windows\System\pMhqDYQ.exe
  2⤵
  PID:6340
- C:\Windows\System\ecSiamx.exe
  C:\Windows\System\ecSiamx.exe
  2⤵
  PID:6368
- C:\Windows\System\nClOllj.exe
  C:\Windows\System\nClOllj.exe
  2⤵
  PID:6396
- C:\Windows\System\YualHkb.exe
  C:\Windows\System\YualHkb.exe
  2⤵
  PID:6424
- C:\Windows\System\IWrbHCO.exe
  C:\Windows\System\IWrbHCO.exe
  2⤵
  PID:6452
- C:\Windows\System\iZsNsDB.exe
  C:\Windows\System\iZsNsDB.exe
  2⤵
  PID:6480
- C:\Windows\System\IChiBpD.exe
  C:\Windows\System\IChiBpD.exe
  2⤵
  PID:6508
- C:\Windows\System\NrZxCKC.exe
  C:\Windows\System\NrZxCKC.exe
  2⤵
  PID:6536
- C:\Windows\System\zdKhXok.exe
  C:\Windows\System\zdKhXok.exe
  2⤵
  PID:6564
- C:\Windows\System\wPxYxxy.exe
  C:\Windows\System\wPxYxxy.exe
  2⤵
  PID:6592
- C:\Windows\System\AqVHnZw.exe
  C:\Windows\System\AqVHnZw.exe
  2⤵
  PID:6620
- C:\Windows\System\rENQbTr.exe
  C:\Windows\System\rENQbTr.exe
  2⤵
  PID:6648
- C:\Windows\System\qVtbKhl.exe
  C:\Windows\System\qVtbKhl.exe
  2⤵
  PID:6676
- C:\Windows\System\XeZQlyP.exe
  C:\Windows\System\XeZQlyP.exe
  2⤵
  PID:6704
- C:\Windows\System\GrVnIUx.exe
  C:\Windows\System\GrVnIUx.exe
  2⤵
  PID:6732
- C:\Windows\System\DWHgptU.exe
  C:\Windows\System\DWHgptU.exe
  2⤵
  PID:6760
- C:\Windows\System\UwuSMCO.exe
  C:\Windows\System\UwuSMCO.exe
  2⤵
  PID:6788
- C:\Windows\System\QysPBUa.exe
  C:\Windows\System\QysPBUa.exe
  2⤵
  PID:6816
- C:\Windows\System\vXOSpWD.exe
  C:\Windows\System\vXOSpWD.exe
  2⤵
  PID:6844
- C:\Windows\System\QSNWzXy.exe
  C:\Windows\System\QSNWzXy.exe
  2⤵
  PID:6872
- C:\Windows\System\yWUUVGm.exe
  C:\Windows\System\yWUUVGm.exe
  2⤵
  PID:6900
- C:\Windows\System\LlFNKCU.exe
  C:\Windows\System\LlFNKCU.exe
  2⤵
  PID:6928
- C:\Windows\System\SDzVGVh.exe
  C:\Windows\System\SDzVGVh.exe
  2⤵
  PID:6956
- C:\Windows\System\LKRJABy.exe
  C:\Windows\System\LKRJABy.exe
  2⤵
  PID:6984
- C:\Windows\System\XGFGZWu.exe
  C:\Windows\System\XGFGZWu.exe
  2⤵
  PID:7012
- C:\Windows\System\oYRgQLL.exe
  C:\Windows\System\oYRgQLL.exe
  2⤵
  PID:7040
- C:\Windows\System\eEJSJlt.exe
  C:\Windows\System\eEJSJlt.exe
  2⤵
  PID:7068
- C:\Windows\System\jkwuBQo.exe
  C:\Windows\System\jkwuBQo.exe
  2⤵
  PID:7096
- C:\Windows\System\PLgdRDu.exe
  C:\Windows\System\PLgdRDu.exe
  2⤵
  PID:7124
- C:\Windows\System\fKMgFMM.exe
  C:\Windows\System\fKMgFMM.exe
  2⤵
  PID:7152
- C:\Windows\System\ekdoBEq.exe
  C:\Windows\System\ekdoBEq.exe
  2⤵
  PID:5984
- C:\Windows\System\ZyYcygi.exe
  C:\Windows\System\ZyYcygi.exe
  2⤵
  PID:6112
- C:\Windows\System\OYpeGBa.exe
  C:\Windows\System\OYpeGBa.exe
  2⤵
  PID:2592
- C:\Windows\System\SpIAkRP.exe
  C:\Windows\System\SpIAkRP.exe
  2⤵
  PID:1548
- C:\Windows\System\flMjgxH.exe
  C:\Windows\System\flMjgxH.exe
  2⤵
  PID:5436
- C:\Windows\System\TillgHs.exe
  C:\Windows\System\TillgHs.exe
  2⤵
  PID:5712
- C:\Windows\System\ltrRxsu.exe
  C:\Windows\System\ltrRxsu.exe
  2⤵
  PID:6164
- C:\Windows\System\djCpcUq.exe
  C:\Windows\System\djCpcUq.exe
  2⤵
  PID:6240
- C:\Windows\System\nnYWfgb.exe
  C:\Windows\System\nnYWfgb.exe
  2⤵
  PID:3540
- C:\Windows\System\BxWRMlm.exe
  C:\Windows\System\BxWRMlm.exe
  2⤵
  PID:6352
- C:\Windows\System\hkYMaDm.exe
  C:\Windows\System\hkYMaDm.exe
  2⤵
  PID:6548
- C:\Windows\System\WvaBINu.exe
  C:\Windows\System\WvaBINu.exe
  2⤵
  PID:6604
- C:\Windows\System\vkcVPll.exe
  C:\Windows\System\vkcVPll.exe
  2⤵
  PID:6636
- C:\Windows\System\YVblXiB.exe
  C:\Windows\System\YVblXiB.exe
  2⤵
  PID:6716
- C:\Windows\System\kLedgUu.exe
  C:\Windows\System\kLedgUu.exe
  2⤵
  PID:6772
- C:\Windows\System\aEqAVCs.exe
  C:\Windows\System\aEqAVCs.exe
  2⤵
  PID:6836
- C:\Windows\System\tAcLMlz.exe
  C:\Windows\System\tAcLMlz.exe
  2⤵
  PID:6892
- C:\Windows\System\eKpJJXI.exe
  C:\Windows\System\eKpJJXI.exe
  2⤵
  PID:6944
- C:\Windows\System\ITsJizu.exe
  C:\Windows\System\ITsJizu.exe
  2⤵
  PID:6972
- C:\Windows\System\sibXDBI.exe
  C:\Windows\System\sibXDBI.exe
  2⤵
  PID:7000
- C:\Windows\System\FqbUzpq.exe
  C:\Windows\System\FqbUzpq.exe
  2⤵
  PID:7032
- C:\Windows\System\AohzFCS.exe
  C:\Windows\System\AohzFCS.exe
  2⤵
  PID:4832
- C:\Windows\System\BhAoemN.exe
  C:\Windows\System\BhAoemN.exe
  2⤵
  PID:7084
- C:\Windows\System\FWZqhpC.exe
  C:\Windows\System\FWZqhpC.exe
  2⤵
  PID:7140
- C:\Windows\System\YPiWzHb.exe
  C:\Windows\System\YPiWzHb.exe
  2⤵
  PID:6040
- C:\Windows\System\qbfbFmu.exe
  C:\Windows\System\qbfbFmu.exe
  2⤵
  PID:4780
- C:\Windows\System\MkSZDvu.exe
  C:\Windows\System\MkSZDvu.exe
  2⤵
  PID:3944
- C:\Windows\System\WgxUyum.exe
  C:\Windows\System\WgxUyum.exe
  2⤵
  PID:432
- C:\Windows\System\fIRqNxN.exe
  C:\Windows\System\fIRqNxN.exe
  2⤵
  PID:5028
- C:\Windows\System\jGQhsvi.exe
  C:\Windows\System\jGQhsvi.exe
  2⤵
  PID:6464
- C:\Windows\System\BxvlnAO.exe
  C:\Windows\System\BxvlnAO.exe
  2⤵
  PID:2228
- C:\Windows\System\BpzAFVO.exe
  C:\Windows\System\BpzAFVO.exe
  2⤵
  PID:4388
- C:\Windows\System\wmYMBCY.exe
  C:\Windows\System\wmYMBCY.exe
  2⤵
  PID:1736
- C:\Windows\System\LbzENyh.exe
  C:\Windows\System\LbzENyh.exe
  2⤵
  PID:6752
- C:\Windows\System\ZflPueK.exe
  C:\Windows\System\ZflPueK.exe
  2⤵
  PID:6920
- C:\Windows\System\fdOnDqS.exe
  C:\Windows\System\fdOnDqS.exe
  2⤵
  PID:1900
- C:\Windows\System\RSbAeib.exe
  C:\Windows\System\RSbAeib.exe
  2⤵
  PID:5964
- C:\Windows\System\rcksGZO.exe
  C:\Windows\System\rcksGZO.exe
  2⤵
  PID:5908
- C:\Windows\System\xHfcQbW.exe
  C:\Windows\System\xHfcQbW.exe
  2⤵
  PID:2960
- C:\Windows\System\IUyvXya.exe
  C:\Windows\System\IUyvXya.exe
  2⤵
  PID:3164
- C:\Windows\System\JCVqNAp.exe
  C:\Windows\System\JCVqNAp.exe
  2⤵
  PID:6444
- C:\Windows\System\OAcvROz.exe
  C:\Windows\System\OAcvROz.exe
  2⤵
  PID:6828
- C:\Windows\System\HRmqiuS.exe
  C:\Windows\System\HRmqiuS.exe
  2⤵
  PID:1604
- C:\Windows\System\YbIlSEV.exe
  C:\Windows\System\YbIlSEV.exe
  2⤵
  PID:576
- C:\Windows\System\uSuEhKd.exe
  C:\Windows\System\uSuEhKd.exe
  2⤵
  PID:6612
- C:\Windows\System\qmZpDLC.exe
  C:\Windows\System\qmZpDLC.exe
  2⤵
  PID:5564
- C:\Windows\System\NYSPBHO.exe
  C:\Windows\System\NYSPBHO.exe
  2⤵
  PID:4348
- C:\Windows\System\OGevBeJ.exe
  C:\Windows\System\OGevBeJ.exe
  2⤵
  PID:7176
- C:\Windows\System\gZCQFYO.exe
  C:\Windows\System\gZCQFYO.exe
  2⤵
  PID:7204
- C:\Windows\System\FabjasR.exe
  C:\Windows\System\FabjasR.exe
  2⤵
  PID:7244
- C:\Windows\System\tRlWccd.exe
  C:\Windows\System\tRlWccd.exe
  2⤵
  PID:7272
- C:\Windows\System\AkRuRPx.exe
  C:\Windows\System\AkRuRPx.exe
  2⤵
  PID:7292
- C:\Windows\System\zqKxxMa.exe
  C:\Windows\System\zqKxxMa.exe
  2⤵
  PID:7316
- C:\Windows\System\zlSDPnY.exe
  C:\Windows\System\zlSDPnY.exe
  2⤵
  PID:7344
- C:\Windows\System\WJaQyKW.exe
  C:\Windows\System\WJaQyKW.exe
  2⤵
  PID:7360
- C:\Windows\System\QkOyNgZ.exe
  C:\Windows\System\QkOyNgZ.exe
  2⤵
  PID:7376
- C:\Windows\System\vaalmWv.exe
  C:\Windows\System\vaalmWv.exe
  2⤵
  PID:7416
- C:\Windows\System\NiQRjng.exe
  C:\Windows\System\NiQRjng.exe
  2⤵
  PID:7456
- C:\Windows\System\jihGAvU.exe
  C:\Windows\System\jihGAvU.exe
  2⤵
  PID:7500
- C:\Windows\System\YCWsweg.exe
  C:\Windows\System\YCWsweg.exe
  2⤵
  PID:7528
- C:\Windows\System\pRJSTYy.exe
  C:\Windows\System\pRJSTYy.exe
  2⤵
  PID:7556
- C:\Windows\System\ZayRtil.exe
  C:\Windows\System\ZayRtil.exe
  2⤵
  PID:7572
- C:\Windows\System\cqLnDwU.exe
  C:\Windows\System\cqLnDwU.exe
  2⤵
  PID:7600
- C:\Windows\System\qccvTgS.exe
  C:\Windows\System\qccvTgS.exe
  2⤵
  PID:7616
- C:\Windows\System\hhaUMjY.exe
  C:\Windows\System\hhaUMjY.exe
  2⤵
  PID:7648
- C:\Windows\System\PsDnOgG.exe
  C:\Windows\System\PsDnOgG.exe
  2⤵
  PID:7684
- C:\Windows\System\mIDodUs.exe
  C:\Windows\System\mIDodUs.exe
  2⤵
  PID:7720
- C:\Windows\System\qxlgROD.exe
  C:\Windows\System\qxlgROD.exe
  2⤵
  PID:7740
- C:\Windows\System\AFUOazm.exe
  C:\Windows\System\AFUOazm.exe
  2⤵
  PID:7768
- C:\Windows\System\EEfSCUg.exe
  C:\Windows\System\EEfSCUg.exe
  2⤵
  PID:7804
- C:\Windows\System\iPqPADD.exe
  C:\Windows\System\iPqPADD.exe
  2⤵
  PID:7824
- C:\Windows\System\BEgKqSd.exe
  C:\Windows\System\BEgKqSd.exe
  2⤵
  PID:7852
- C:\Windows\System\DHtJjBb.exe
  C:\Windows\System\DHtJjBb.exe
  2⤵
  PID:7888
- C:\Windows\System\YqDgzJy.exe
  C:\Windows\System\YqDgzJy.exe
  2⤵
  PID:7916
- C:\Windows\System\enxUzBZ.exe
  C:\Windows\System\enxUzBZ.exe
  2⤵
  PID:7948
- C:\Windows\System\TYQwmih.exe
  C:\Windows\System\TYQwmih.exe
  2⤵
  PID:7964
- C:\Windows\System\MTiposg.exe
  C:\Windows\System\MTiposg.exe
  2⤵
  PID:7996
- C:\Windows\System\MXijwUu.exe
  C:\Windows\System\MXijwUu.exe
  2⤵
  PID:8020
- C:\Windows\System\GyVYHGN.exe
  C:\Windows\System\GyVYHGN.exe
  2⤵
  PID:8044
- C:\Windows\System\tldRGsV.exe
  C:\Windows\System\tldRGsV.exe
  2⤵
  PID:8060
- C:\Windows\System\zPMTDgt.exe
  C:\Windows\System\zPMTDgt.exe
  2⤵
  PID:8092
- C:\Windows\System\tJJWXVy.exe
  C:\Windows\System\tJJWXVy.exe
  2⤵
  PID:8144
- C:\Windows\System\VEuOPjU.exe
  C:\Windows\System\VEuOPjU.exe
  2⤵
  PID:8172
- C:\Windows\System\TsWSjNG.exe
  C:\Windows\System\TsWSjNG.exe
  2⤵
  PID:4968
- C:\Windows\System\NaZEYZQ.exe
  C:\Windows\System\NaZEYZQ.exe
  2⤵
  PID:7224
- C:\Windows\System\hOqXEKJ.exe
  C:\Windows\System\hOqXEKJ.exe
  2⤵
  PID:7284
- C:\Windows\System\eFazllZ.exe
  C:\Windows\System\eFazllZ.exe
  2⤵
  PID:7336
- C:\Windows\System\tkfWDux.exe
  C:\Windows\System\tkfWDux.exe
  2⤵
  PID:7436
- C:\Windows\System\sdfWMIA.exe
  C:\Windows\System\sdfWMIA.exe
  2⤵
  PID:7512
- C:\Windows\System\vHrTBUO.exe
  C:\Windows\System\vHrTBUO.exe
  2⤵
  PID:7568
- C:\Windows\System\hHzQVMs.exe
  C:\Windows\System\hHzQVMs.exe
  2⤵
  PID:7612
- C:\Windows\System\SHCCQcf.exe
  C:\Windows\System\SHCCQcf.exe
  2⤵
  PID:7668
- C:\Windows\System\rXdJHkz.exe
  C:\Windows\System\rXdJHkz.exe
  2⤵
  PID:7728
- C:\Windows\System\losoMiy.exe
  C:\Windows\System\losoMiy.exe
  2⤵
  PID:7820
- C:\Windows\System\RYvABOH.exe
  C:\Windows\System\RYvABOH.exe
  2⤵
  PID:7896
- C:\Windows\System\tkuoPDM.exe
  C:\Windows\System\tkuoPDM.exe
  2⤵
  PID:7960
- C:\Windows\System\FpNiObe.exe
  C:\Windows\System\FpNiObe.exe
  2⤵
  PID:7984
- C:\Windows\System\VztNvYe.exe
  C:\Windows\System\VztNvYe.exe
  2⤵
  PID:8068
- C:\Windows\System\lvRinED.exe
  C:\Windows\System\lvRinED.exe
  2⤵
  PID:8128
- C:\Windows\System\eZJzYwE.exe
  C:\Windows\System\eZJzYwE.exe
  2⤵
  PID:8184
- C:\Windows\System\ZfGIwxO.exe
  C:\Windows\System\ZfGIwxO.exe
  2⤵
  PID:7340
- C:\Windows\System\mwXcsWv.exe
  C:\Windows\System\mwXcsWv.exe
  2⤵
  PID:7412
- C:\Windows\System\sfhcNUY.exe
  C:\Windows\System\sfhcNUY.exe
  2⤵
  PID:7552
- C:\Windows\System\FEEkUwe.exe
  C:\Windows\System\FEEkUwe.exe
  2⤵
  PID:7732
- C:\Windows\System\cGEJMtk.exe
  C:\Windows\System\cGEJMtk.exe
  2⤵
  PID:7956
- C:\Windows\System\RUSeXba.exe
  C:\Windows\System\RUSeXba.exe
  2⤵
  PID:8124
- C:\Windows\System\SLUZjoW.exe
  C:\Windows\System\SLUZjoW.exe
  2⤵
  PID:7328
- C:\Windows\System\eCFyOAo.exe
  C:\Windows\System\eCFyOAo.exe
  2⤵
  PID:7700
- C:\Windows\System\EXXneJN.exe
  C:\Windows\System\EXXneJN.exe
  2⤵
  PID:7876
- C:\Windows\System\FFurVrv.exe
  C:\Windows\System\FFurVrv.exe
  2⤵
  PID:8080
- C:\Windows\System\qVqmUCv.exe
  C:\Windows\System\qVqmUCv.exe
  2⤵
  PID:8200
- C:\Windows\System\YYTJnhS.exe
  C:\Windows\System\YYTJnhS.exe
  2⤵
  PID:8224
- C:\Windows\System\TpdOWVE.exe
  C:\Windows\System\TpdOWVE.exe
  2⤵
  PID:8256
- C:\Windows\System\ROuPisD.exe
  C:\Windows\System\ROuPisD.exe
  2⤵
  PID:8284
- C:\Windows\System\mPKBKVv.exe
  C:\Windows\System\mPKBKVv.exe
  2⤵
  PID:8304
- C:\Windows\System\NVGGpEC.exe
  C:\Windows\System\NVGGpEC.exe
  2⤵
  PID:8340
- C:\Windows\System\PirWfVz.exe
  C:\Windows\System\PirWfVz.exe
  2⤵
  PID:8356
- C:\Windows\System\WtEBRiR.exe
  C:\Windows\System\WtEBRiR.exe
  2⤵
  PID:8408
- C:\Windows\System\UaDMDQa.exe
  C:\Windows\System\UaDMDQa.exe
  2⤵
  PID:8424
- C:\Windows\System\mxYJWhJ.exe
  C:\Windows\System\mxYJWhJ.exe
  2⤵
  PID:8452
- C:\Windows\System\qtJJPYe.exe
  C:\Windows\System\qtJJPYe.exe
  2⤵
  PID:8480
- C:\Windows\System\QplBOCn.exe
  C:\Windows\System\QplBOCn.exe
  2⤵
  PID:8520
- C:\Windows\System\ekuntzk.exe
  C:\Windows\System\ekuntzk.exe
  2⤵
  PID:8548
- C:\Windows\System\VLuhsST.exe
  C:\Windows\System\VLuhsST.exe
  2⤵
  PID:8576
- C:\Windows\System\nqtfsyl.exe
  C:\Windows\System\nqtfsyl.exe
  2⤵
  PID:8604
- C:\Windows\System\zgUNCDl.exe
  C:\Windows\System\zgUNCDl.exe
  2⤵
  PID:8620
- C:\Windows\System\vRMqxif.exe
  C:\Windows\System\vRMqxif.exe
  2⤵
  PID:8648
- C:\Windows\System\lHNIaDg.exe
  C:\Windows\System\lHNIaDg.exe
  2⤵
  PID:8676
- C:\Windows\System\OdKTyuj.exe
  C:\Windows\System\OdKTyuj.exe
  2⤵
  PID:8708
- C:\Windows\System\eOdOuMH.exe
  C:\Windows\System\eOdOuMH.exe
  2⤵
  PID:8732
- C:\Windows\System\VJFkHkw.exe
  C:\Windows\System\VJFkHkw.exe
  2⤵
  PID:8760
- C:\Windows\System\gpBQWsD.exe
  C:\Windows\System\gpBQWsD.exe
  2⤵
  PID:8776
- C:\Windows\System\pvdCZYc.exe
  C:\Windows\System\pvdCZYc.exe
  2⤵
  PID:8828
- C:\Windows\System\kmCdSMi.exe
  C:\Windows\System\kmCdSMi.exe
  2⤵
  PID:8844
- C:\Windows\System\CRsVHjA.exe
  C:\Windows\System\CRsVHjA.exe
  2⤵
  PID:8872
- C:\Windows\System\YXLGBgf.exe
  C:\Windows\System\YXLGBgf.exe
  2⤵
  PID:8900
- C:\Windows\System\xyFZayk.exe
  C:\Windows\System\xyFZayk.exe
  2⤵
  PID:8928
- C:\Windows\System\qyqaljP.exe
  C:\Windows\System\qyqaljP.exe
  2⤵
  PID:8968
- C:\Windows\System\brvWXib.exe
  C:\Windows\System\brvWXib.exe
  2⤵
  PID:8992
- C:\Windows\System\ytAPEpY.exe
  C:\Windows\System\ytAPEpY.exe
  2⤵
  PID:9012
- C:\Windows\System\kznTPLZ.exe
  C:\Windows\System\kznTPLZ.exe
  2⤵
  PID:9040
- C:\Windows\System\DvxHKML.exe
  C:\Windows\System\DvxHKML.exe
  2⤵
  PID:9056
- C:\Windows\System\BXaAGRc.exe
  C:\Windows\System\BXaAGRc.exe
  2⤵
  PID:9072
- C:\Windows\System\TEQXodm.exe
  C:\Windows\System\TEQXodm.exe
  2⤵
  PID:9092
- C:\Windows\System\oSqWicv.exe
  C:\Windows\System\oSqWicv.exe
  2⤵
  PID:9128
- C:\Windows\System\WSropUg.exe
  C:\Windows\System\WSropUg.exe
  2⤵
  PID:9148
- C:\Windows\System\umtCKuF.exe
  C:\Windows\System\umtCKuF.exe
  2⤵
  PID:9208
- C:\Windows\System\LwEmfDt.exe
  C:\Windows\System\LwEmfDt.exe
  2⤵
  PID:8004
- C:\Windows\System\YfoCnQt.exe
  C:\Windows\System\YfoCnQt.exe
  2⤵
  PID:8268
- C:\Windows\System\poQNNon.exe
  C:\Windows\System\poQNNon.exe
  2⤵
  PID:8380
- C:\Windows\System\BwutYWe.exe
  C:\Windows\System\BwutYWe.exe
  2⤵
  PID:8420
- C:\Windows\System\gvNgLrC.exe
  C:\Windows\System\gvNgLrC.exe
  2⤵
  PID:8448
- C:\Windows\System\KXnXUzx.exe
  C:\Windows\System\KXnXUzx.exe
  2⤵
  PID:8512
- C:\Windows\System\NZCvQHn.exe
  C:\Windows\System\NZCvQHn.exe
  2⤵
  PID:8596
- C:\Windows\System\iEEkFMm.exe
  C:\Windows\System\iEEkFMm.exe
  2⤵
  PID:8664
- C:\Windows\System\suBVOCS.exe
  C:\Windows\System\suBVOCS.exe
  2⤵
  PID:8748
- C:\Windows\System\LvqFWJQ.exe
  C:\Windows\System\LvqFWJQ.exe
  2⤵
  PID:8820
- C:\Windows\System\zvtGqBh.exe
  C:\Windows\System\zvtGqBh.exe
  2⤵
  PID:8896
- C:\Windows\System\zmuyGVN.exe
  C:\Windows\System\zmuyGVN.exe
  2⤵
  PID:8964
- C:\Windows\System\IEtGnrt.exe
  C:\Windows\System\IEtGnrt.exe
  2⤵
  PID:8976
- C:\Windows\System\eHcImJu.exe
  C:\Windows\System\eHcImJu.exe
  2⤵
  PID:9088
- C:\Windows\System\WyOPhvn.exe
  C:\Windows\System\WyOPhvn.exe
  2⤵
  PID:9192
- C:\Windows\System\glebxIL.exe
  C:\Windows\System\glebxIL.exe
  2⤵
  PID:9160
- C:\Windows\System\zcKopiX.exe
  C:\Windows\System\zcKopiX.exe
  2⤵
  PID:8240
- C:\Windows\System\mptFYMb.exe
  C:\Windows\System\mptFYMb.exe
  2⤵
  PID:8404
- C:\Windows\System\MBSaXOe.exe
  C:\Windows\System\MBSaXOe.exe
  2⤵
  PID:8640
- C:\Windows\System\opuclLN.exe
  C:\Windows\System\opuclLN.exe
  2⤵
  PID:8644
- C:\Windows\System\ehcaWeJ.exe
  C:\Windows\System\ehcaWeJ.exe
  2⤵
  PID:8856
- C:\Windows\System\MYFYgLU.exe
  C:\Windows\System\MYFYgLU.exe
  2⤵
  PID:9100
- C:\Windows\System\VrjpteJ.exe
  C:\Windows\System\VrjpteJ.exe
  2⤵
  PID:9184
- C:\Windows\System\FFyGpZB.exe
  C:\Windows\System\FFyGpZB.exe
  2⤵
  PID:8400
- C:\Windows\System\FQFTWJb.exe
  C:\Windows\System\FQFTWJb.exe
  2⤵
  PID:8696
- C:\Windows\System\imJNnDf.exe
  C:\Windows\System\imJNnDf.exe
  2⤵
  PID:8916
- C:\Windows\System\gCHEopv.exe
  C:\Windows\System\gCHEopv.exe
  2⤵
  PID:9064
- C:\Windows\System\oWdSPSB.exe
  C:\Windows\System\oWdSPSB.exe
  2⤵
  PID:8536
- C:\Windows\System\qXQkKPx.exe
  C:\Windows\System\qXQkKPx.exe
  2⤵
  PID:9260
- C:\Windows\System\llbwOXa.exe
  C:\Windows\System\llbwOXa.exe
  2⤵
  PID:9308
- C:\Windows\System\vdcmKJh.exe
  C:\Windows\System\vdcmKJh.exe
  2⤵
  PID:9336
- C:\Windows\System\CmTyqiz.exe
  C:\Windows\System\CmTyqiz.exe
  2⤵
  PID:9364
- C:\Windows\System\kVxxByX.exe
  C:\Windows\System\kVxxByX.exe
  2⤵
  PID:9392
- C:\Windows\System\qbohban.exe
  C:\Windows\System\qbohban.exe
  2⤵
  PID:9408
- C:\Windows\System\UrnzoxM.exe
  C:\Windows\System\UrnzoxM.exe
  2⤵
  PID:9436
- C:\Windows\System\Abrhfnn.exe
  C:\Windows\System\Abrhfnn.exe
  2⤵
  PID:9464
- C:\Windows\System\fiGqNpX.exe
  C:\Windows\System\fiGqNpX.exe
  2⤵
  PID:9504
- C:\Windows\System\PWOSnkK.exe
  C:\Windows\System\PWOSnkK.exe
  2⤵
  PID:9532
- C:\Windows\System\NDehRhm.exe
  C:\Windows\System\NDehRhm.exe
  2⤵
  PID:9560
- C:\Windows\System\lzrTYrG.exe
  C:\Windows\System\lzrTYrG.exe
  2⤵
  PID:9576
- C:\Windows\System\cDAWkfx.exe
  C:\Windows\System\cDAWkfx.exe
  2⤵
  PID:9604
- C:\Windows\System\sBLzCMr.exe
  C:\Windows\System\sBLzCMr.exe
  2⤵
  PID:9632
- C:\Windows\System\ZQswVLj.exe
  C:\Windows\System\ZQswVLj.exe
  2⤵
  PID:9660
- C:\Windows\System\cPBpKJD.exe
  C:\Windows\System\cPBpKJD.exe
  2⤵
  PID:9688
- C:\Windows\System\ATjMzZU.exe
  C:\Windows\System\ATjMzZU.exe
  2⤵
  PID:9728
- C:\Windows\System\FFIvFnq.exe
  C:\Windows\System\FFIvFnq.exe
  2⤵
  PID:9756
- C:\Windows\System\oLpiaaE.exe
  C:\Windows\System\oLpiaaE.exe
  2⤵
  PID:9784
- C:\Windows\System\cDsSGuf.exe
  C:\Windows\System\cDsSGuf.exe
  2⤵
  PID:9812
- C:\Windows\System\bvExePU.exe
  C:\Windows\System\bvExePU.exe
  2⤵
  PID:9828
- C:\Windows\System\VdjFSxQ.exe
  C:\Windows\System\VdjFSxQ.exe
  2⤵
  PID:9844
- C:\Windows\System\pmWPkvj.exe
  C:\Windows\System\pmWPkvj.exe
  2⤵
  PID:9864
- C:\Windows\System\rlwkdgb.exe
  C:\Windows\System\rlwkdgb.exe
  2⤵
  PID:9924
- C:\Windows\System\jSCEXpL.exe
  C:\Windows\System\jSCEXpL.exe
  2⤵
  PID:9944
- C:\Windows\System\kFgINJe.exe
  C:\Windows\System\kFgINJe.exe
  2⤵
  PID:9968
- C:\Windows\System\ZJgtfaE.exe
  C:\Windows\System\ZJgtfaE.exe
  2⤵
  PID:9996
- C:\Windows\System\YYpegLE.exe
  C:\Windows\System\YYpegLE.exe
  2⤵
  PID:10028
- C:\Windows\System\OBrWSgs.exe
  C:\Windows\System\OBrWSgs.exe
  2⤵
  PID:10052
- C:\Windows\System\PMWjLFY.exe
  C:\Windows\System\PMWjLFY.exe
  2⤵
  PID:10092
- C:\Windows\System\NoglHEW.exe
  C:\Windows\System\NoglHEW.exe
  2⤵
  PID:10120
- C:\Windows\System\aweMQSU.exe
  C:\Windows\System\aweMQSU.exe
  2⤵
  PID:10148
- C:\Windows\System\NrkkchQ.exe
  C:\Windows\System\NrkkchQ.exe
  2⤵
  PID:10164
- C:\Windows\System\mXXSoxp.exe
  C:\Windows\System\mXXSoxp.exe
  2⤵
  PID:10204
- C:\Windows\System\FPYWLIu.exe
  C:\Windows\System\FPYWLIu.exe
  2⤵
  PID:10220
- C:\Windows\System\WdAkqso.exe
  C:\Windows\System\WdAkqso.exe
  2⤵
  PID:10236
- C:\Windows\System\AfoRCxQ.exe
  C:\Windows\System\AfoRCxQ.exe
  2⤵
  PID:9248
- C:\Windows\System\EpMzzKQ.exe
  C:\Windows\System\EpMzzKQ.exe
  2⤵
  PID:9324
- C:\Windows\System\CUvFHmP.exe
  C:\Windows\System\CUvFHmP.exe
  2⤵
  PID:9380
- C:\Windows\System\lqdTSTT.exe
  C:\Windows\System\lqdTSTT.exe
  2⤵
  PID:9460
- C:\Windows\System\LbrYFea.exe
  C:\Windows\System\LbrYFea.exe
  2⤵
  PID:9516
- C:\Windows\System\RMdzsHr.exe
  C:\Windows\System\RMdzsHr.exe
  2⤵
  PID:9548
- C:\Windows\System\IrUjDYY.exe
  C:\Windows\System\IrUjDYY.exe
  2⤵
  PID:9624
- C:\Windows\System\jZlfqbO.exe
  C:\Windows\System\jZlfqbO.exe
  2⤵
  PID:9712
- C:\Windows\System\oDzEXuB.exe
  C:\Windows\System\oDzEXuB.exe
  2⤵
  PID:9796
- C:\Windows\System\uUPwven.exe
  C:\Windows\System\uUPwven.exe
  2⤵
  PID:9836
- C:\Windows\System\EfjeSuD.exe
  C:\Windows\System\EfjeSuD.exe
  2⤵
  PID:9904
- C:\Windows\System\yjAZcZv.exe
  C:\Windows\System\yjAZcZv.exe
  2⤵
  PID:9988
- C:\Windows\System\uIyOZnp.exe
  C:\Windows\System\uIyOZnp.exe
  2⤵
  PID:10068
- C:\Windows\System\moKqKgl.exe
  C:\Windows\System\moKqKgl.exe
  2⤵
  PID:10104
- C:\Windows\System\sYyomMk.exe
  C:\Windows\System\sYyomMk.exe
  2⤵
  PID:10184
- C:\Windows\System\XszGREl.exe
  C:\Windows\System\XszGREl.exe
  2⤵
  PID:10212
- C:\Windows\System\ZuSddWG.exe
  C:\Windows\System\ZuSddWG.exe
  2⤵
  PID:9360
- C:\Windows\System\isNhCWb.exe
  C:\Windows\System\isNhCWb.exe
  2⤵
  PID:9552
- C:\Windows\System\akqzTAl.exe
  C:\Windows\System\akqzTAl.exe
  2⤵
  PID:9592
- C:\Windows\System\ezOBxWI.exe
  C:\Windows\System\ezOBxWI.exe
  2⤵
  PID:9672
- C:\Windows\System\fXDbOCD.exe
  C:\Windows\System\fXDbOCD.exe
  2⤵
  PID:9964
- C:\Windows\System\WOVsSGA.exe
  C:\Windows\System\WOVsSGA.exe
  2⤵
  PID:8600
- C:\Windows\System\XWGkjVI.exe
  C:\Windows\System\XWGkjVI.exe
  2⤵
  PID:10196
- C:\Windows\System\UZZxthT.exe
  C:\Windows\System\UZZxthT.exe
  2⤵
  PID:9496
- C:\Windows\System\SeYoFzU.exe
  C:\Windows\System\SeYoFzU.exe
  2⤵
  PID:9940
- C:\Windows\System\jpEsPZQ.exe
  C:\Windows\System\jpEsPZQ.exe
  2⤵
  PID:9772
- C:\Windows\System\GDkQFuF.exe
  C:\Windows\System\GDkQFuF.exe
  2⤵
  PID:10228
- C:\Windows\System\UPyiBPb.exe
  C:\Windows\System\UPyiBPb.exe
  2⤵
  PID:10264
- C:\Windows\System\XnbmnxL.exe
  C:\Windows\System\XnbmnxL.exe
  2⤵
  PID:10280
- C:\Windows\System\rcrOmLF.exe
  C:\Windows\System\rcrOmLF.exe
  2⤵
  PID:10296
- C:\Windows\System\nXMqNck.exe
  C:\Windows\System\nXMqNck.exe
  2⤵
  PID:10324
- C:\Windows\System\OlAATFq.exe
  C:\Windows\System\OlAATFq.exe
  2⤵
  PID:10348
- C:\Windows\System\wMiFYFI.exe
  C:\Windows\System\wMiFYFI.exe
  2⤵
  PID:10392
- C:\Windows\System\duubISF.exe
  C:\Windows\System\duubISF.exe
  2⤵
  PID:10424
- C:\Windows\System\aluCJii.exe
  C:\Windows\System\aluCJii.exe
  2⤵
  PID:10448
- C:\Windows\System\BKdVnzV.exe
  C:\Windows\System\BKdVnzV.exe
  2⤵
  PID:10464
- C:\Windows\System\YotlaMF.exe
  C:\Windows\System\YotlaMF.exe
  2⤵
  PID:10492
- C:\Windows\System\pXxvfYO.exe
  C:\Windows\System\pXxvfYO.exe
  2⤵
  PID:10544
- C:\Windows\System\jYAtYuy.exe
  C:\Windows\System\jYAtYuy.exe
  2⤵
  PID:10560
- C:\Windows\System\YzxJEKo.exe
  C:\Windows\System\YzxJEKo.exe
  2⤵
  PID:10588
- C:\Windows\System\NehrDep.exe
  C:\Windows\System\NehrDep.exe
  2⤵
  PID:10620
- C:\Windows\System\ulkdekM.exe
  C:\Windows\System\ulkdekM.exe
  2⤵
  PID:10644
- C:\Windows\System\OpYENWY.exe
  C:\Windows\System\OpYENWY.exe
  2⤵
  PID:10672
- C:\Windows\System\CjMfDKU.exe
  C:\Windows\System\CjMfDKU.exe
  2⤵
  PID:10700
- C:\Windows\System\WYxlZaz.exe
  C:\Windows\System\WYxlZaz.exe
  2⤵
  PID:10736
- C:\Windows\System\RYSzjFy.exe
  C:\Windows\System\RYSzjFy.exe
  2⤵
  PID:10756
- C:\Windows\System\jLIeJFb.exe
  C:\Windows\System\jLIeJFb.exe
  2⤵
  PID:10784
- C:\Windows\System\rSIqvrA.exe
  C:\Windows\System\rSIqvrA.exe
  2⤵
  PID:10800
- C:\Windows\System\MtNKOXa.exe
  C:\Windows\System\MtNKOXa.exe
  2⤵
  PID:10820
- C:\Windows\System\Rttutsv.exe
  C:\Windows\System\Rttutsv.exe
  2⤵
  PID:10852
- C:\Windows\System\tXeDMNX.exe
  C:\Windows\System\tXeDMNX.exe
  2⤵
  PID:10884
- C:\Windows\System\NBHnSud.exe
  C:\Windows\System\NBHnSud.exe
  2⤵
  PID:10936
- C:\Windows\System\aTPkxBq.exe
  C:\Windows\System\aTPkxBq.exe
  2⤵
  PID:10964
- C:\Windows\System\EeBcAMc.exe
  C:\Windows\System\EeBcAMc.exe
  2⤵
  PID:10992
- C:\Windows\System\CHhQUTW.exe
  C:\Windows\System\CHhQUTW.exe
  2⤵
  PID:11008
- C:\Windows\System\xCYkzGq.exe
  C:\Windows\System\xCYkzGq.exe
  2⤵
  PID:11036
- C:\Windows\System\knNtzxl.exe
  C:\Windows\System\knNtzxl.exe
  2⤵
  PID:11064
- C:\Windows\System\KyxiRej.exe
  C:\Windows\System\KyxiRej.exe
  2⤵
  PID:11092
- C:\Windows\System\nuUdBDL.exe
  C:\Windows\System\nuUdBDL.exe
  2⤵
  PID:11120
- C:\Windows\System\prcwWsB.exe
  C:\Windows\System\prcwWsB.exe
  2⤵
  PID:11148
- C:\Windows\System\ekgHSAS.exe
  C:\Windows\System\ekgHSAS.exe
  2⤵
  PID:11176
- C:\Windows\System\ywXiqDN.exe
  C:\Windows\System\ywXiqDN.exe
  2⤵
  PID:11204
- C:\Windows\System\tegLAhm.exe
  C:\Windows\System\tegLAhm.exe
  2⤵
  PID:11232
- C:\Windows\System\FCULdRi.exe
  C:\Windows\System\FCULdRi.exe
  2⤵
  PID:11260
- C:\Windows\System\AqTptVg.exe
  C:\Windows\System\AqTptVg.exe
  2⤵
  PID:9644
- C:\Windows\System\mcMRdUy.exe
  C:\Windows\System\mcMRdUy.exe
  2⤵
  PID:10288
- C:\Windows\System\tZPgPgr.exe
  C:\Windows\System\tZPgPgr.exe
  2⤵
  PID:10368
- C:\Windows\System\jDvyDed.exe
  C:\Windows\System\jDvyDed.exe
  2⤵
  PID:10460
- C:\Windows\System\tUTOMtM.exe
  C:\Windows\System\tUTOMtM.exe
  2⤵
  PID:10528
- C:\Windows\System\mFuwDIO.exe
  C:\Windows\System\mFuwDIO.exe
  2⤵
  PID:10584
- C:\Windows\System\lwsjNJm.exe
  C:\Windows\System\lwsjNJm.exe
  2⤵
  PID:10668
- C:\Windows\System\XXgcxGc.exe
  C:\Windows\System\XXgcxGc.exe
  2⤵
  PID:10772
- C:\Windows\System\tYbThzl.exe
  C:\Windows\System\tYbThzl.exe
  2⤵
  PID:10816
- C:\Windows\System\tfKZuSR.exe
  C:\Windows\System\tfKZuSR.exe
  2⤵
  PID:10896
- C:\Windows\System\tdZnDbb.exe
  C:\Windows\System\tdZnDbb.exe
  2⤵
  PID:10976
- C:\Windows\System\TcoMdxK.exe
  C:\Windows\System\TcoMdxK.exe
  2⤵
  PID:11084
- C:\Windows\System\oSuUsKL.exe
  C:\Windows\System\oSuUsKL.exe
  2⤵
  PID:11160
- C:\Windows\System\HEbXWJa.exe
  C:\Windows\System\HEbXWJa.exe
  2⤵
  PID:11192
- C:\Windows\System\UWEafdb.exe
  C:\Windows\System\UWEafdb.exe
  2⤵
  PID:9708
- C:\Windows\System\VLeDjfp.exe
  C:\Windows\System\VLeDjfp.exe
  2⤵
  PID:10308
- C:\Windows\System\gYVFhjK.exe
  C:\Windows\System\gYVFhjK.exe
  2⤵
  PID:10480
- C:\Windows\System\WMavSnl.exe
  C:\Windows\System\WMavSnl.exe
  2⤵
  PID:10684
- C:\Windows\System\YbXmRKl.exe
  C:\Windows\System\YbXmRKl.exe
  2⤵
  PID:10792
- C:\Windows\System\NIYFZnz.exe
  C:\Windows\System\NIYFZnz.exe
  2⤵
  PID:10848
- C:\Windows\System\IOgiYpf.exe
  C:\Windows\System\IOgiYpf.exe
  2⤵
  PID:11108
- C:\Windows\System\qrYoZLQ.exe
  C:\Windows\System\qrYoZLQ.exe
  2⤵
  PID:10340
- C:\Windows\System\PnADYOZ.exe
  C:\Windows\System\PnADYOZ.exe
  2⤵
  PID:11104
- C:\Windows\System\GxsfiQH.exe
  C:\Windows\System\GxsfiQH.exe
  2⤵
  PID:11004
- C:\Windows\System\hGdtwCU.exe
  C:\Windows\System\hGdtwCU.exe
  2⤵
  PID:10632
- C:\Windows\System\EenFLpk.exe
  C:\Windows\System\EenFLpk.exe
  2⤵
  PID:10456
- C:\Windows\System\EaPlYjS.exe
  C:\Windows\System\EaPlYjS.exe
  2⤵
  PID:11284
- C:\Windows\System\tqiiLdu.exe
  C:\Windows\System\tqiiLdu.exe
  2⤵
  PID:11300
- C:\Windows\System\gxtCKNU.exe
  C:\Windows\System\gxtCKNU.exe
  2⤵
  PID:11332
- C:\Windows\System\EinEqAc.exe
  C:\Windows\System\EinEqAc.exe
  2⤵
  PID:11364
- C:\Windows\System\kcPOoAI.exe
  C:\Windows\System\kcPOoAI.exe
  2⤵
  PID:11380
- C:\Windows\System\FvqlOwr.exe
  C:\Windows\System\FvqlOwr.exe
  2⤵
  PID:11404
- C:\Windows\System\amGVLli.exe
  C:\Windows\System\amGVLli.exe
  2⤵
  PID:11428
- C:\Windows\System\UCZqPUq.exe
  C:\Windows\System\UCZqPUq.exe
  2⤵
  PID:11456
- C:\Windows\System\EJanMbO.exe
  C:\Windows\System\EJanMbO.exe
  2⤵
  PID:11472
- C:\Windows\System\cBqSakz.exe
  C:\Windows\System\cBqSakz.exe
  2⤵
  PID:11496
- C:\Windows\System\UcFTASs.exe
  C:\Windows\System\UcFTASs.exe
  2⤵
  PID:11544
- C:\Windows\System\NSEHyCD.exe
  C:\Windows\System\NSEHyCD.exe
  2⤵
  PID:11580
- C:\Windows\System\zVCBKQa.exe
  C:\Windows\System\zVCBKQa.exe
  2⤵
  PID:11628
- C:\Windows\System\GAcIeEs.exe
  C:\Windows\System\GAcIeEs.exe
  2⤵
  PID:11656
- C:\Windows\System\LsRsSBB.exe
  C:\Windows\System\LsRsSBB.exe
  2⤵
  PID:11672
- C:\Windows\System\COrpnrf.exe
  C:\Windows\System\COrpnrf.exe
  2⤵
  PID:11700
- C:\Windows\System\LvknPkk.exe
  C:\Windows\System\LvknPkk.exe
  2⤵
  PID:11736
- C:\Windows\System\SXxmMXl.exe
  C:\Windows\System\SXxmMXl.exe
  2⤵
  PID:11752
- C:\Windows\System\QbAYNec.exe
  C:\Windows\System\QbAYNec.exe
  2⤵
  PID:11772
- C:\Windows\System\nCFjMkj.exe
  C:\Windows\System\nCFjMkj.exe
  2⤵
  PID:11812
- C:\Windows\System\jKuKYwR.exe
  C:\Windows\System\jKuKYwR.exe
  2⤵
  PID:11852
- C:\Windows\System\OHIppkY.exe
  C:\Windows\System\OHIppkY.exe
  2⤵
  PID:11868
- C:\Windows\System\eGRDmpw.exe
  C:\Windows\System\eGRDmpw.exe
  2⤵
  PID:11896
- C:\Windows\System\segNRLF.exe
  C:\Windows\System\segNRLF.exe
  2⤵
  PID:11936
- C:\Windows\System\YUPdxPh.exe
  C:\Windows\System\YUPdxPh.exe
  2⤵
  PID:11952
- C:\Windows\System\WjVNMdl.exe
  C:\Windows\System\WjVNMdl.exe
  2⤵
  PID:11984
- C:\Windows\System\IpnCGYD.exe
  C:\Windows\System\IpnCGYD.exe
  2⤵
  PID:12024
- C:\Windows\System\zuxbmhz.exe
  C:\Windows\System\zuxbmhz.exe
  2⤵
  PID:12052
- C:\Windows\System\hEQYhIc.exe
  C:\Windows\System\hEQYhIc.exe
  2⤵
  PID:12080
- C:\Windows\System\BOYVLRY.exe
  C:\Windows\System\BOYVLRY.exe
  2⤵
  PID:12112
- C:\Windows\System\wdmYYfO.exe
  C:\Windows\System\wdmYYfO.exe
  2⤵
  PID:12140
- C:\Windows\System\NZUmlKv.exe
  C:\Windows\System\NZUmlKv.exe
  2⤵
  PID:12156
- C:\Windows\System\BmRvMpw.exe
  C:\Windows\System\BmRvMpw.exe
  2⤵
  PID:12184
- C:\Windows\System\VOKsPyi.exe
  C:\Windows\System\VOKsPyi.exe
  2⤵
  PID:12212
- C:\Windows\System\LSiQqyO.exe
  C:\Windows\System\LSiQqyO.exe
  2⤵
  PID:12232
- C:\Windows\System\jrqCTiw.exe
  C:\Windows\System\jrqCTiw.exe
  2⤵
  PID:12256
- C:\Windows\System\PlKZlDm.exe
  C:\Windows\System\PlKZlDm.exe
  2⤵
  PID:12284
- C:\Windows\System\FUstgGP.exe
  C:\Windows\System\FUstgGP.exe
  2⤵
  PID:11316
- C:\Windows\System\VvwtUNQ.exe
  C:\Windows\System\VvwtUNQ.exe
  2⤵
  PID:11396
- C:\Windows\System\RgheBMS.exe
  C:\Windows\System\RgheBMS.exe
  2⤵
  PID:11468
- C:\Windows\System\dwDEMoF.exe
  C:\Windows\System\dwDEMoF.exe
  2⤵
  PID:11528
- C:\Windows\System\DoLVENn.exe
  C:\Windows\System\DoLVENn.exe
  2⤵
  PID:11608
- C:\Windows\System\TSHHVDJ.exe
  C:\Windows\System\TSHHVDJ.exe
  2⤵
  PID:11668
- C:\Windows\System\FUmlraF.exe
  C:\Windows\System\FUmlraF.exe
  2⤵
  PID:11764
- C:\Windows\System\ooHbrsV.exe
  C:\Windows\System\ooHbrsV.exe
  2⤵
  PID:11844
- C:\Windows\System\PbGzGXG.exe
  C:\Windows\System\PbGzGXG.exe
  2⤵
  PID:11884
- C:\Windows\System\wQjeZRN.exe
  C:\Windows\System\wQjeZRN.exe
  2⤵
  PID:11920
- C:\Windows\System\AyEIqlV.exe
  C:\Windows\System\AyEIqlV.exe
  2⤵
  PID:12020
- C:\Windows\System\SfQDefO.exe
  C:\Windows\System\SfQDefO.exe
  2⤵
  PID:4464
- C:\Windows\System\WnzLNfJ.exe
  C:\Windows\System\WnzLNfJ.exe
  2⤵
  PID:12076
- C:\Windows\System\uNgdxsr.exe
  C:\Windows\System\uNgdxsr.exe
  2⤵
  PID:12152
- C:\Windows\System\ycaqBiH.exe
  C:\Windows\System\ycaqBiH.exe
  2⤵
  PID:12248
- C:\Windows\System\ZmxkMnW.exe
  C:\Windows\System\ZmxkMnW.exe
  2⤵
  PID:12228
- C:\Windows\System\kcYPeZB.exe
  C:\Windows\System\kcYPeZB.exe
  2⤵
  PID:11372
- C:\Windows\System\WwGKZZH.exe
  C:\Windows\System\WwGKZZH.exe
  2⤵
  PID:11564
- C:\Windows\System\ZivXXnD.exe
  C:\Windows\System\ZivXXnD.exe
  2⤵
  PID:11648
- C:\Windows\System\NXgvRXd.exe
  C:\Windows\System\NXgvRXd.exe
  2⤵
  PID:6500
- C:\Windows\System\yNtqIRr.exe
  C:\Windows\System\yNtqIRr.exe
  2⤵
  PID:12004
- C:\Windows\System\IvdfPki.exe
  C:\Windows\System\IvdfPki.exe
  2⤵
  PID:12148
- C:\Windows\System\TvVHjYS.exe
  C:\Windows\System\TvVHjYS.exe
  2⤵
  PID:12196
- C:\Windows\System\kkwiJoN.exe
  C:\Windows\System\kkwiJoN.exe
  2⤵
  PID:11424
- C:\Windows\System\ErkGxya.exe
  C:\Windows\System\ErkGxya.exe
  2⤵
  PID:11684
- C:\Windows\System\JCsijHK.exe
  C:\Windows\System\JCsijHK.exe
  2⤵
  PID:2332
- C:\Windows\System\xgnFCNW.exe
  C:\Windows\System\xgnFCNW.exe
  2⤵
  PID:12276
- C:\Windows\System\yyusYid.exe
  C:\Windows\System\yyusYid.exe
  2⤵
  PID:12200
- C:\Windows\System\UYouEEZ.exe
  C:\Windows\System\UYouEEZ.exe
  2⤵
  PID:12304
- C:\Windows\System\VbNkqpz.exe
  C:\Windows\System\VbNkqpz.exe
  2⤵
  PID:12332
- C:\Windows\System\KHIeVJk.exe
  C:\Windows\System\KHIeVJk.exe
  2⤵
  PID:12360
- C:\Windows\System\TlliuIg.exe
  C:\Windows\System\TlliuIg.exe
  2⤵
  PID:12376
- C:\Windows\System\YJhUXir.exe
  C:\Windows\System\YJhUXir.exe
  2⤵
  PID:12404
- C:\Windows\System\yXhNZal.exe
  C:\Windows\System\yXhNZal.exe
  2⤵
  PID:12440
- C:\Windows\System\yuEMEOm.exe
  C:\Windows\System\yuEMEOm.exe
  2⤵
  PID:12464
- C:\Windows\System\dOiCITF.exe
  C:\Windows\System\dOiCITF.exe
  2⤵
  PID:12512
- C:\Windows\System\EjqfJaa.exe
  C:\Windows\System\EjqfJaa.exe
  2⤵
  PID:12540
- C:\Windows\System\sdtXgzP.exe
  C:\Windows\System\sdtXgzP.exe
  2⤵
  PID:12560
- C:\Windows\System\rRhMBMw.exe
  C:\Windows\System\rRhMBMw.exe
  2⤵
  PID:12584
- C:\Windows\System\xgalsIH.exe
  C:\Windows\System\xgalsIH.exe
  2⤵
  PID:12624
- C:\Windows\System\sqzGaYK.exe
  C:\Windows\System\sqzGaYK.exe
  2⤵
  PID:12640
- C:\Windows\System\WeMypSh.exe
  C:\Windows\System\WeMypSh.exe
  2⤵
  PID:12668
- C:\Windows\System\zwyrCKd.exe
  C:\Windows\System\zwyrCKd.exe
  2⤵
  PID:12696
- C:\Windows\System\fqFQLOC.exe
  C:\Windows\System\fqFQLOC.exe
  2⤵
  PID:12724
- C:\Windows\System\HPhxISW.exe
  C:\Windows\System\HPhxISW.exe
  2⤵
  PID:12752
- C:\Windows\System\aWwqvKs.exe
  C:\Windows\System\aWwqvKs.exe
  2⤵
  PID:12768
- C:\Windows\System\PrEDNAk.exe
  C:\Windows\System\PrEDNAk.exe
  2⤵
  PID:12820
- C:\Windows\System\ZYKqGSp.exe
  C:\Windows\System\ZYKqGSp.exe
  2⤵
  PID:12836
- C:\Windows\System\YoRlVzD.exe
  C:\Windows\System\YoRlVzD.exe
  2⤵
  PID:12872
- C:\Windows\System\nuPgRHD.exe
  C:\Windows\System\nuPgRHD.exe
  2⤵
  PID:12892
- C:\Windows\System\QcfOTEW.exe
  C:\Windows\System\QcfOTEW.exe
  2⤵
  PID:12932
- C:\Windows\System\rvdUbfu.exe
  C:\Windows\System\rvdUbfu.exe
  2⤵
  PID:12960
- C:\Windows\System\kxVUZCd.exe
  C:\Windows\System\kxVUZCd.exe
  2⤵
  PID:12980
- C:\Windows\System\eQVeQGj.exe
  C:\Windows\System\eQVeQGj.exe
  2⤵
  PID:13008
- C:\Windows\System\PKTvMnr.exe
  C:\Windows\System\PKTvMnr.exe
  2⤵
  PID:13048
- C:\Windows\System\ZgFbyKM.exe
  C:\Windows\System\ZgFbyKM.exe
  2⤵
  PID:13072
- C:\Windows\System\cCwTlPY.exe
  C:\Windows\System\cCwTlPY.exe
  2⤵
  PID:13104
- C:\Windows\System\VHZvJCc.exe
  C:\Windows\System\VHZvJCc.exe
  2⤵
  PID:13132
- C:\Windows\System\POxhGaH.exe
  C:\Windows\System\POxhGaH.exe
  2⤵
  PID:13160
- C:\Windows\System\amOcxuv.exe
  C:\Windows\System\amOcxuv.exe
  2⤵
  PID:13176
- C:\Windows\System\TUtYFyY.exe
  C:\Windows\System\TUtYFyY.exe
  2⤵
  PID:13204
- C:\Windows\System\zAXHfHs.exe
  C:\Windows\System\zAXHfHs.exe
  2⤵
  PID:13232
- C:\Windows\System\aybGcud.exe
  C:\Windows\System\aybGcud.exe
  2⤵
  PID:13260
- C:\Windows\System\LLfrZza.exe
  C:\Windows\System\LLfrZza.exe
  2⤵
  PID:13292
- C:\Windows\System\MuNJaxq.exe
  C:\Windows\System\MuNJaxq.exe
  2⤵
  PID:12300
- C:\Windows\System\LkxBCbZ.exe
  C:\Windows\System\LkxBCbZ.exe
  2⤵
  PID:12348
- C:\Windows\System\bpLFefp.exe
  C:\Windows\System\bpLFefp.exe
  2⤵
  PID:12448
- C:\Windows\System\gjnuLTF.exe
  C:\Windows\System\gjnuLTF.exe
  2⤵
  PID:12492
- C:\Windows\System\gvSABOy.exe
  C:\Windows\System\gvSABOy.exe
  2⤵
  PID:12548
- C:\Windows\System\tVnmoAJ.exe
  C:\Windows\System\tVnmoAJ.exe
  2⤵
  PID:12580
- C:\Windows\System\lugiVBp.exe
  C:\Windows\System\lugiVBp.exe
  2⤵
  PID:12680
- C:\Windows\System\VnMjhEg.exe
  C:\Windows\System\VnMjhEg.exe
  2⤵
  PID:12736
- C:\Windows\System\nEuIQUq.exe
  C:\Windows\System\nEuIQUq.exe
  2⤵
  PID:12780
- C:\Windows\System\JvYmWsS.exe
  C:\Windows\System\JvYmWsS.exe
  2⤵
  PID:12848
- C:\Windows\System\GPIekft.exe
  C:\Windows\System\GPIekft.exe
  2⤵
  PID:12916
- C:\Windows\System\aLEtaGH.exe
  C:\Windows\System\aLEtaGH.exe
  2⤵
  PID:12968
- C:\Windows\System\amYiJft.exe
  C:\Windows\System\amYiJft.exe
  2⤵
  PID:13024
- C:\Windows\System\cGagnpb.exe
  C:\Windows\System\cGagnpb.exe
  2⤵
  PID:13128
- C:\Windows\System\aOAQotk.exe
  C:\Windows\System\aOAQotk.exe
  2⤵
  PID:13188
- C:\Windows\System\cOlSsfZ.exe
  C:\Windows\System\cOlSsfZ.exe
  2⤵
  PID:13300
- C:\Windows\System\peQEnSr.exe
  C:\Windows\System\peQEnSr.exe
  2⤵
  PID:12368
- C:\Windows\System\ZMKAcso.exe
  C:\Windows\System\ZMKAcso.exe
  2⤵
  PID:12496
- C:\Windows\System\AQMCKWa.exe
  C:\Windows\System\AQMCKWa.exe
  2⤵
  PID:12656
- C:\Windows\System\KtSmLLT.exe
  C:\Windows\System\KtSmLLT.exe
  2⤵
  PID:12760
- C:\Windows\System\hwNHPUz.exe
  C:\Windows\System\hwNHPUz.exe
  2⤵
  PID:12828
- C:\Windows\System\vUnGwmT.exe
  C:\Windows\System\vUnGwmT.exe
  2⤵
  PID:13064
- C:\Windows\System\aXlTEHE.exe
  C:\Windows\System\aXlTEHE.exe
  2⤵
  PID:13228
- C:\Windows\System\DYvthDT.exe
  C:\Windows\System\DYvthDT.exe
  2⤵
  PID:12328
- C:\Windows\System\GOdcWDv.exe
  C:\Windows\System\GOdcWDv.exe
  2⤵
  PID:12716
- C:\Windows\System\LIrctcY.exe
  C:\Windows\System\LIrctcY.exe
  2⤵
  PID:13304
- C:\Windows\System\tnsXqIT.exe
  C:\Windows\System\tnsXqIT.exe
  2⤵
  PID:12316
- C:\Windows\System\TTuuuBY.exe
  C:\Windows\System\TTuuuBY.exe
  2⤵
  PID:13324
- C:\Windows\System\hylmBVl.exe
  C:\Windows\System\hylmBVl.exe
  2⤵
  PID:13340
- C:\Windows\System\xuRkAoJ.exe
  C:\Windows\System\xuRkAoJ.exe
  2⤵
  PID:13380
- C:\Windows\System\KgJsEcp.exe
  C:\Windows\System\KgJsEcp.exe
  2⤵
  PID:13408
- C:\Windows\System\PYhqxec.exe
  C:\Windows\System\PYhqxec.exe
  2⤵
  PID:13424
- C:\Windows\System\HAhVtHt.exe
  C:\Windows\System\HAhVtHt.exe
  2⤵
  PID:13452
- C:\Windows\System\QnrBzMd.exe
  C:\Windows\System\QnrBzMd.exe
  2⤵
  PID:13480
- C:\Windows\System\skssGDg.exe
  C:\Windows\System\skssGDg.exe
  2⤵
  PID:13508
- C:\Windows\System\OLLEKRb.exe
  C:\Windows\System\OLLEKRb.exe
  2⤵
  PID:13524
- C:\Windows\System\aoIoshF.exe
  C:\Windows\System\aoIoshF.exe
  2⤵
  PID:13564
- C:\Windows\System\TfSMpMw.exe
  C:\Windows\System\TfSMpMw.exe
  2⤵
  PID:13584
- C:\Windows\System\OvQFYEi.exe
  C:\Windows\System\OvQFYEi.exe
  2⤵
  PID:13628
- C:\Windows\System\YPxthcx.exe
  C:\Windows\System\YPxthcx.exe
  2⤵
  PID:13648
- C:\Windows\System\dFbvXlj.exe
  C:\Windows\System\dFbvXlj.exe
  2⤵
  PID:13676
- C:\Windows\System\Uapzbkn.exe
  C:\Windows\System\Uapzbkn.exe
  2⤵
  PID:13704
- C:\Windows\System\XrWffAh.exe
  C:\Windows\System\XrWffAh.exe
  2⤵
  PID:13720
- C:\Windows\System\ryzjcCr.exe
  C:\Windows\System\ryzjcCr.exe
  2⤵
  PID:13744
- C:\Windows\System\rNQlISh.exe
  C:\Windows\System\rNQlISh.exe
  2⤵
  PID:13772
- C:\Windows\System\vzUGGhP.exe
  C:\Windows\System\vzUGGhP.exe
  2⤵
  PID:13828
- C:\Windows\System\EjRjOdG.exe
  C:\Windows\System\EjRjOdG.exe
  2⤵
  PID:13856
- C:\Windows\System\BlJaUAx.exe
  C:\Windows\System\BlJaUAx.exe
  2⤵
  PID:13872
- C:\Windows\System\tLXIrWk.exe
  C:\Windows\System\tLXIrWk.exe
  2⤵
  PID:13896
- C:\Windows\System\QRAdwHL.exe
  C:\Windows\System\QRAdwHL.exe
  2⤵
  PID:13928
- C:\Windows\System\aXPmHdJ.exe
  C:\Windows\System\aXPmHdJ.exe
  2⤵
  PID:13956
- C:\Windows\System\CQzfszd.exe
  C:\Windows\System\CQzfszd.exe
  2⤵
  PID:13984
- C:\Windows\System\LyszVLN.exe
  C:\Windows\System\LyszVLN.exe
  2⤵
  PID:14012
- C:\Windows\System\vgzUYzG.exe
  C:\Windows\System\vgzUYzG.exe
  2⤵
  PID:14032
- C:\Windows\System\UdpTBiP.exe
  C:\Windows\System\UdpTBiP.exe
  2⤵
  PID:14068
- C:\Windows\System\WfKKmST.exe
  C:\Windows\System\WfKKmST.exe
  2⤵
  PID:14096
- C:\Windows\System\UvRMoXP.exe
  C:\Windows\System\UvRMoXP.exe
  2⤵
  PID:14128
- C:\Windows\System\QnOnZqu.exe
  C:\Windows\System\QnOnZqu.exe
  2⤵
  PID:14152
- C:\Windows\System\tbiWBoB.exe
  C:\Windows\System\tbiWBoB.exe
  2⤵
  PID:14180
- C:\Windows\System\bYceUDI.exe
  C:\Windows\System\bYceUDI.exe
  2⤵
  PID:14212
- C:\Windows\System\yxIMlzO.exe
  C:\Windows\System\yxIMlzO.exe
  2⤵
  PID:14228
- C:\Windows\System\bECAFTa.exe
  C:\Windows\System\bECAFTa.exe
  2⤵
  PID:14260
- C:\Windows\System\iQPDhQK.exe
  C:\Windows\System\iQPDhQK.exe
  2⤵
  PID:14308
- C:\Windows\System\AAuCdjT.exe
  C:\Windows\System\AAuCdjT.exe
  2⤵
  PID:12596
- C:\Windows\System\uSLMBYM.exe
  C:\Windows\System\uSLMBYM.exe
  2⤵
  PID:13352
- C:\Windows\System\XMTdoef.exe
  C:\Windows\System\XMTdoef.exe
  2⤵
  PID:13440
- C:\Windows\System\tohxpGT.exe
  C:\Windows\System\tohxpGT.exe
  2⤵
  PID:13496
- C:\Windows\System\HblPQCI.exe
  C:\Windows\System\HblPQCI.exe
  2⤵
  PID:13572
- C:\Windows\System\PecDycu.exe
  C:\Windows\System\PecDycu.exe
  2⤵
  PID:13592
- C:\Windows\System\mxZGswv.exe
  C:\Windows\System\mxZGswv.exe
  2⤵
  PID:13636
- C:\Windows\System\zYdHgGJ.exe
  C:\Windows\System\zYdHgGJ.exe
  2⤵
  PID:13692
- C:\Windows\System\PhkMGsw.exe
  C:\Windows\System\PhkMGsw.exe
  2⤵
  PID:13736
- C:\Windows\System\uJaTovw.exe
  C:\Windows\System\uJaTovw.exe
  2⤵
  PID:13864
- C:\Windows\System\PRlpmFv.exe
  C:\Windows\System\PRlpmFv.exe
  2⤵
  PID:13912
- C:\Windows\System\oZAVzAm.exe
  C:\Windows\System\oZAVzAm.exe
  2⤵
  PID:14004
- C:\Windows\System\KAgZhUw.exe
  C:\Windows\System\KAgZhUw.exe
  2⤵
  PID:14056
- C:\Windows\System\ggEFtbp.exe
  C:\Windows\System\ggEFtbp.exe
  2⤵
  PID:14112
- C:\Windows\System\dTMZAVk.exe
  C:\Windows\System\dTMZAVk.exe
  2⤵
  PID:14188
- C:\Windows\System\YssmTNy.exe
  C:\Windows\System\YssmTNy.exe
  2⤵
  PID:14252
- C:\Windows\System\kNLIAca.exe
  C:\Windows\System\kNLIAca.exe
  2⤵
  PID:14332
- C:\Windows\System\rWHMVrL.exe
  C:\Windows\System\rWHMVrL.exe
  2⤵
  PID:13416
- C:\Windows\System\NvAFDsK.exe
  C:\Windows\System\NvAFDsK.exe
  2⤵
  PID:13536
- C:\Windows\System\jkrySNJ.exe
  C:\Windows\System\jkrySNJ.exe
  2⤵
  PID:13644
- C:\Windows\System\PIszino.exe
  C:\Windows\System\PIszino.exe
  2⤵
  PID:13788
- C:\Windows\System\SyXoZwY.exe
  C:\Windows\System\SyXoZwY.exe
  2⤵
  PID:13840
- C:\Windows\System\PDRovuD.exe
  C:\Windows\System\PDRovuD.exe
  2⤵
  PID:14020
- C:\Windows\System\CFTrqqi.exe
  C:\Windows\System\CFTrqqi.exe
  2⤵
  PID:14320
- C:\Windows\System\HjNVFbZ.exe
  C:\Windows\System\HjNVFbZ.exe
  2⤵
  PID:13360
- C:\Windows\System\PWyvQMQ.exe
  C:\Windows\System\PWyvQMQ.exe
  2⤵
  PID:13556
- C:\Windows\System\eOAtDDf.exe
  C:\Windows\System\eOAtDDf.exe
  2⤵
  PID:13888
- C:\Windows\System\RPVjsau.exe
  C:\Windows\System\RPVjsau.exe
  2⤵
  PID:13732
- C:\Windows\System\QxGhCTg.exe
  C:\Windows\System\QxGhCTg.exe
  2⤵
  PID:14356
- C:\Windows\System\bWdumGe.exe
  C:\Windows\System\bWdumGe.exe
  2⤵
  PID:14376
- C:\Windows\System\pHWXjOW.exe
  C:\Windows\System\pHWXjOW.exe
  2⤵
  PID:14400
- C:\Windows\System\rfUCecL.exe
  C:\Windows\System\rfUCecL.exe
  2⤵
  PID:14428
- C:\Windows\System\xPEmmpO.exe
  C:\Windows\System\xPEmmpO.exe
  2⤵
  PID:14476
- C:\Windows\System\htVwxfj.exe
  C:\Windows\System\htVwxfj.exe
  2⤵
  PID:14504
- C:\Windows\System\HvDOBoV.exe
  C:\Windows\System\HvDOBoV.exe
  2⤵
  PID:14524
- C:\Windows\System\lztedXJ.exe
  C:\Windows\System\lztedXJ.exe
  2⤵
  PID:14548
- C:\Windows\System\CuEcVDc.exe
  C:\Windows\System\CuEcVDc.exe
  2⤵
  PID:14576
- C:\Windows\System\yllJnet.exe
  C:\Windows\System\yllJnet.exe
  2⤵
  PID:14600
- C:\Windows\System\aOrAIgD.exe
  C:\Windows\System\aOrAIgD.exe
  2⤵
  PID:14628
- C:\Windows\System\HsaGeZZ.exe
  C:\Windows\System\HsaGeZZ.exe
  2⤵
  PID:14684
- C:\Windows\System\BpumeRb.exe
  C:\Windows\System\BpumeRb.exe
  2⤵
  PID:14700
- C:\Windows\System\KRzFVQn.exe
  C:\Windows\System\KRzFVQn.exe
  2⤵
  PID:14736
- C:\Windows\System\rCEptHE.exe
  C:\Windows\System\rCEptHE.exe
  2⤵
  PID:14756
- C:\Windows\System\vIGCNMs.exe
  C:\Windows\System\vIGCNMs.exe
  2⤵
  PID:14796
- C:\Windows\System\vQmAzmW.exe
  C:\Windows\System\vQmAzmW.exe
  2⤵
  PID:14812
- C:\Windows\System\retYQbf.exe
  C:\Windows\System\retYQbf.exe
  2⤵
  PID:14840
- C:\Windows\System\AxNkPCE.exe
  C:\Windows\System\AxNkPCE.exe
  2⤵
  PID:14868
- C:\Windows\System\CiZUeXl.exe
  C:\Windows\System\CiZUeXl.exe
  2⤵
  PID:14888
- C:\Windows\System\qBeSezV.exe
  C:\Windows\System\qBeSezV.exe
  2⤵
  PID:14916
- C:\Windows\System\KbdlyMU.exe
  C:\Windows\System\KbdlyMU.exe
  2⤵
  PID:14952
- C:\Windows\System\ccMyrsT.exe
  C:\Windows\System\ccMyrsT.exe
  2⤵
  PID:14972
- C:\Windows\System\ZXwPoJu.exe
  C:\Windows\System\ZXwPoJu.exe
  2⤵
  PID:14996
- C:\Windows\System\RZprdiz.exe
  C:\Windows\System\RZprdiz.exe
  2⤵
  PID:15012
- C:\Windows\System\IGJuqib.exe
  C:\Windows\System\IGJuqib.exe
  2⤵
  PID:15040
- C:\Windows\System\dFuQdgH.exe
  C:\Windows\System\dFuQdgH.exe
  2⤵
  PID:15096
- C:\Windows\System\nnAgurI.exe
  C:\Windows\System\nnAgurI.exe
  2⤵
  PID:15120
- C:\Windows\System\eOVCOjg.exe
  C:\Windows\System\eOVCOjg.exe
  2⤵
  PID:15140
- C:\Windows\System\fiXLOPJ.exe
  C:\Windows\System\fiXLOPJ.exe
  2⤵
  PID:15176
- C:\Windows\System\kqfKNLd.exe
  C:\Windows\System\kqfKNLd.exe
  2⤵
  PID:15192
- C:\Windows\System\jiLlKKu.exe
  C:\Windows\System\jiLlKKu.exe
  2⤵
  PID:15232
- C:\Windows\System\MGrfEao.exe
  C:\Windows\System\MGrfEao.exe
  2⤵
  PID:15256
- C:\Windows\System\AxRoyFB.exe
  C:\Windows\System\AxRoyFB.exe
  2⤵
  PID:15288
- C:\Windows\System\HiJkyHt.exe
  C:\Windows\System\HiJkyHt.exe
  2⤵
  PID:15320
- C:\Windows\System\QVhLdqU.exe
  C:\Windows\System\QVhLdqU.exe
  2⤵
  PID:15352
- C:\Windows\System\KcsYxJp.exe
  C:\Windows\System\KcsYxJp.exe
  2⤵
  PID:14256
- C:\Windows\System\UDaMNFR.exe
  C:\Windows\System\UDaMNFR.exe
  2⤵
  PID:13520
- C:\Windows\System\BHZqxWB.exe
  C:\Windows\System\BHZqxWB.exe
  2⤵
  PID:14420
- C:\Windows\System\eLkQewL.exe
  C:\Windows\System\eLkQewL.exe
  2⤵
  PID:14532
- C:\Windows\System\BNPOmbG.exe
  C:\Windows\System\BNPOmbG.exe
  2⤵
  PID:14616
- C:\Windows\System\YQcCWnP.exe
  C:\Windows\System\YQcCWnP.exe
  2⤵
  PID:14668
- C:\Windows\System\vbaBdvk.exe
  C:\Windows\System\vbaBdvk.exe
  2⤵
  PID:14752
- C:\Windows\System\DxwUGbO.exe
  C:\Windows\System\DxwUGbO.exe
  2⤵
  PID:14804
- C:\Windows\System\DevszmB.exe
  C:\Windows\System\DevszmB.exe
  2⤵
  PID:14884
- C:\Windows\System\tgfsOuF.exe
  C:\Windows\System\tgfsOuF.exe
  2⤵
  PID:14900
- C:\Windows\System\HWUhuiO.exe
  C:\Windows\System\HWUhuiO.exe
  2⤵
  PID:14980
- C:\Windows\System\iUBKUxf.exe
  C:\Windows\System\iUBKUxf.exe
  2⤵
  PID:15084
- C:\Windows\System\qKtwEJe.exe
  C:\Windows\System\qKtwEJe.exe
  2⤵
  PID:15104
- C:\Windows\System\MYfxYUL.exe
  C:\Windows\System\MYfxYUL.exe
  2⤵
  PID:15160
- C:\Windows\System\BxzrdwB.exe
  C:\Windows\System\BxzrdwB.exe
  2⤵
  PID:15244
- C:\Windows\System\HlfAtal.exe
  C:\Windows\System\HlfAtal.exe
  2⤵
  PID:15272
- C:\Windows\System\vXXfnWT.exe
  C:\Windows\System\vXXfnWT.exe
  2⤵
  PID:15328
- C:\Windows\System\wGUeBKO.exe
  C:\Windows\System\wGUeBKO.exe
  2⤵
  PID:14496
- C:\Windows\System\QMtSFKB.exe
  C:\Windows\System\QMtSFKB.exe
  2⤵
  PID:14672
- C:\Windows\System\hpGxIym.exe
  C:\Windows\System\hpGxIym.exe
  2⤵
  PID:14808
- C:\Windows\System\jfHyDNf.exe
  C:\Windows\System\jfHyDNf.exe
  2⤵
  PID:14932
- C:\Windows\System\YwQVjuZ.exe
  C:\Windows\System\YwQVjuZ.exe
  2⤵
  PID:15056
- C:\Windows\System\hjgzjmi.exe
  C:\Windows\System\hjgzjmi.exe
  2⤵
  PID:15308
- C:\Windows\System\oOccjjp.exe
  C:\Windows\System\oOccjjp.exe
  2⤵
  PID:14364
- C:\Windows\System\BZhdxwY.exe
  C:\Windows\System\BZhdxwY.exe
  2⤵
  PID:14584
- C:\Windows\System\jPEpMXm.exe
  C:\Windows\System\jPEpMXm.exe
  2⤵
  PID:15052
- C:\Windows\System\QTHDVaK.exe
  C:\Windows\System\QTHDVaK.exe
  2⤵
  PID:15252
- C:\Windows\System\wcfJoLs.exe
  C:\Windows\System\wcfJoLs.exe
  2⤵
  PID:14940
- C:\Windows\System\wUrTTYY.exe
  C:\Windows\System\wUrTTYY.exe
  2⤵
  PID:15388
- C:\Windows\System\jWXWapD.exe
  C:\Windows\System\jWXWapD.exe
  2⤵
  PID:15404
- C:\Windows\System\BZXfRbZ.exe
  C:\Windows\System\BZXfRbZ.exe
  2⤵
  PID:15448
- C:\Windows\System\iKOJJeJ.exe
  C:\Windows\System\iKOJJeJ.exe
  2⤵
  PID:15472
- C:\Windows\System\kQtvoNM.exe
  C:\Windows\System\kQtvoNM.exe
  2⤵
  PID:15512
- C:\Windows\System\TKCCmev.exe
  C:\Windows\System\TKCCmev.exe
  2⤵
  PID:15528
- C:\Windows\System\vdVuudd.exe
  C:\Windows\System\vdVuudd.exe
  2⤵
  PID:15568
- C:\Windows\System\avOOPzl.exe
  C:\Windows\System\avOOPzl.exe
  2⤵
  PID:15596
- C:\Windows\System\COzRupD.exe
  C:\Windows\System\COzRupD.exe
  2⤵
  PID:15624
- C:\Windows\System\EYkqVTO.exe
  C:\Windows\System\EYkqVTO.exe
  2⤵
  PID:15652
- C:\Windows\System\VCiuESu.exe
  C:\Windows\System\VCiuESu.exe
  2⤵
  PID:15688
- C:\Windows\System\RJvrgns.exe
  C:\Windows\System\RJvrgns.exe
  2⤵
  PID:15716
- C:\Windows\System\ctCyngS.exe
  C:\Windows\System\ctCyngS.exe
  2⤵
  PID:15744
- C:\Windows\System\fLUVqGa.exe
  C:\Windows\System\fLUVqGa.exe
  2⤵
  PID:15760
- C:\Windows\System\zpvSPzT.exe
  C:\Windows\System\zpvSPzT.exe
  2⤵
  PID:15800
- C:\Windows\System\GhLGJMu.exe
  C:\Windows\System\GhLGJMu.exe
  2⤵
  PID:15828
- C:\Windows\System\SSZkoRA.exe
  C:\Windows\System\SSZkoRA.exe
  2⤵
  PID:15844
- C:\Windows\System\aDFTjJf.exe
  C:\Windows\System\aDFTjJf.exe
  2⤵
  PID:15872
- C:\Windows\System\hwroKXU.exe
  C:\Windows\System\hwroKXU.exe
  2⤵
  PID:15888
- C:\Windows\System\DVzYWHE.exe
  C:\Windows\System\DVzYWHE.exe
  2⤵
  PID:15920
- C:\Windows\System\RdSCwfy.exe
  C:\Windows\System\RdSCwfy.exe
  2⤵
  PID:15944
- C:\Windows\System\bYcXPxr.exe
  C:\Windows\System\bYcXPxr.exe
  2⤵
  PID:15972
- C:\Windows\System\ZRHEReg.exe
  C:\Windows\System\ZRHEReg.exe
  2⤵
  PID:16004
- C:\Windows\System\DRxbPwe.exe
  C:\Windows\System\DRxbPwe.exe
  2⤵
  PID:16032
- C:\Windows\System\fbplpIM.exe
  C:\Windows\System\fbplpIM.exe
  2⤵
  PID:16064
- C:\Windows\System\PFuRCSM.exe
  C:\Windows\System\PFuRCSM.exe
  2⤵
  PID:16084
- C:\Windows\System\VYpPArb.exe
  C:\Windows\System\VYpPArb.exe
  2⤵
  PID:16116
- C:\Windows\System\ogDwDwK.exe
  C:\Windows\System\ogDwDwK.exe
  2⤵
  PID:16144
- C:\Windows\System\XcuhyYl.exe
  C:\Windows\System\XcuhyYl.exe
  2⤵
  PID:16184
- C:\Windows\System\RSpfkrR.exe
  C:\Windows\System\RSpfkrR.exe
  2⤵
  PID:16224
- C:\Windows\System\yJqiwhl.exe
  C:\Windows\System\yJqiwhl.exe
  2⤵
  PID:16256
- C:\Windows\System\EKVSgyV.exe
  C:\Windows\System\EKVSgyV.exe
  2⤵
  PID:16284
- C:\Windows\System\geWaWlf.exe
  C:\Windows\System\geWaWlf.exe
  2⤵
  PID:16300
- C:\Windows\System\aIdxKBR.exe
  C:\Windows\System\aIdxKBR.exe
  2⤵
  PID:16340
- C:\Windows\System\jogNAWk.exe
  C:\Windows\System\jogNAWk.exe
  2⤵
  PID:16368
- C:\Windows\System\cBWjRuK.exe
  C:\Windows\System\cBWjRuK.exe
  2⤵
  PID:15376
- C:\Windows\System\njFqcrv.exe
  C:\Windows\System\njFqcrv.exe
  2⤵
  PID:15368
- C:\Windows\System\mRBysuQ.exe
  C:\Windows\System\mRBysuQ.exe
  2⤵
  PID:15464
- C:\Windows\System\dJluHzI.exe
  C:\Windows\System\dJluHzI.exe
  2⤵
  PID:15468
- C:\Windows\System\LYXuAdG.exe
  C:\Windows\System\LYXuAdG.exe
  2⤵
  PID:15524
- C:\Windows\System\LLRrWEG.exe
  C:\Windows\System\LLRrWEG.exe
  2⤵
  PID:15592
- C:\Windows\System\yJDhGTg.exe
  C:\Windows\System\yJDhGTg.exe
  2⤵
  PID:15644
- C:\Windows\System\UqtCNJI.exe
  C:\Windows\System\UqtCNJI.exe
  2⤵
  PID:15736
- C:\Windows\System\AwyFjWg.exe
  C:\Windows\System\AwyFjWg.exe
  2⤵
  PID:15836
- C:\Windows\System\EPUVjae.exe
  C:\Windows\System\EPUVjae.exe
  2⤵
  PID:15856
- C:\Windows\System\UgsQFsN.exe
  C:\Windows\System\UgsQFsN.exe
  2⤵
  PID:15968
- C:\Windows\System\QOJxhFo.exe
  C:\Windows\System\QOJxhFo.exe
  2⤵
  PID:16020
- C:\Windows\System\rcievsK.exe
  C:\Windows\System\rcievsK.exe
  2⤵
  PID:16056
- C:\Windows\System\JBKUKlg.exe
  C:\Windows\System\JBKUKlg.exe
  2⤵
  PID:16160
- C:\Windows\System\xBQEXTF.exe
  C:\Windows\System\xBQEXTF.exe
  2⤵
  PID:16220
- C:\Windows\System\WBLIxzU.exe
  C:\Windows\System\WBLIxzU.exe
  2⤵
  PID:16328
- C:\Windows\System\FRxjrAd.exe
  C:\Windows\System\FRxjrAd.exe
  2⤵
  PID:14788
- C:\Windows\System\WAHljJc.exe
  C:\Windows\System\WAHljJc.exe
  2⤵
  PID:15416
- C:\Windows\System\NHlCfpw.exe
  C:\Windows\System\NHlCfpw.exe
  2⤵
  PID:15500
- C:\Windows\System\zpFMjYM.exe
  C:\Windows\System\zpFMjYM.exe
  2⤵
  PID:15816
- C:\Windows\System\fjptkbp.exe
  C:\Windows\System\fjptkbp.exe
  2⤵
  PID:14456
- C:\Windows\System\LUrEpeZ.exe
  C:\Windows\System\LUrEpeZ.exe
  2⤵
  PID:15988
- C:\Windows\System\zxPedwk.exe
  C:\Windows\System\zxPedwk.exe
  2⤵
  PID:16112
- C:\Windows\System\IUstdyb.exe
  C:\Windows\System\IUstdyb.exe
  2⤵
  PID:15372
- C:\Windows\System\svoEvxR.exe
  C:\Windows\System\svoEvxR.exe
  2⤵
  PID:15520
- C:\Windows\System\tyMYwXT.exe
  C:\Windows\System\tyMYwXT.exe
  2⤵
  PID:15952
- C:\Windows\System\AmSFuCw.exe
  C:\Windows\System\AmSFuCw.exe
  2⤵
  PID:16376
- C:\Windows\System\qnWIKbG.exe
  C:\Windows\System\qnWIKbG.exe
  2⤵
  PID:15620
- C:\Windows\System\HmZdlEJ.exe
  C:\Windows\System\HmZdlEJ.exe
  2⤵
  PID:16404
- C:\Windows\System\MscrKcW.exe
  C:\Windows\System\MscrKcW.exe
  2⤵
  PID:16424
- C:\Windows\System\hpwfyVV.exe
  C:\Windows\System\hpwfyVV.exe
  2⤵
  PID:16440
- C:\Windows\System\ozRyfXX.exe
  C:\Windows\System\ozRyfXX.exe
  2⤵
  PID:16500
- C:\Windows\System\PIWrWcn.exe
  C:\Windows\System\PIWrWcn.exe
  2⤵
  PID:16532
- C:\Windows\System\exlLNrH.exe
  C:\Windows\System\exlLNrH.exe
  2⤵
  PID:16560
- C:\Windows\System\xJnVNIl.exe
  C:\Windows\System\xJnVNIl.exe
  2⤵
  PID:16584
- C:\Windows\System\uvDzjqD.exe
  C:\Windows\System\uvDzjqD.exe
  2⤵
  PID:16604
- C:\Windows\System\npAIOFn.exe
  C:\Windows\System\npAIOFn.exe
  2⤵
  PID:16620
- C:\Windows\System\yAKxdlE.exe
  C:\Windows\System\yAKxdlE.exe
  2⤵
  PID:16680
- C:\Windows\System\vOujqCX.exe
  C:\Windows\System\vOujqCX.exe
  2⤵
  PID:16696

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:17112

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\BBxheLl.exe

Filesize
1.7MB

MD5
911f901a351b82e2f2550661137c7af9

SHA1
e2e5a8955480d0f79580b68eafc8d84818f7d7cd

SHA256
30ca4eb4ca3b9812dd34454dcf92883aed928676c8d46bbd4e096c601745c0f6

SHA512
0d4cc9c1b81e4c9d9f624b42e05da15f7898a98cbe9c496ba9dc9347e7e98e983b65e9a51cccfd4a1265e7945b5f0ea8f62235d03dff10407255d2ca7a72eed8

Download Submit
C:\Windows\System\BtbyDxx.exe

Filesize
1.7MB

MD5
bf4338ea5cc7acc3a06d21b3e954cbbd

SHA1
1daaa21617a08d47a6fecf7931e26a7c56a911a4

SHA256
3fafe72f07532ca83405e975c92203c1c9ce094ead94af4e5f927408565a62a2

SHA512
1c03290ec4b99f1dbdd6def81c024a78c5a9de5bb3f8ec1bbf120173826a44e174ebe01edcf314d0926431947648157737cdd8d14f2bf143a8929f3c509aaf56

Download Submit
C:\Windows\System\CmkDVgj.exe

Filesize
1.7MB

MD5
2d2fe32905bf05fbb43ad6270273a301

SHA1
913280b26bec0d38011a7ce87947fe5745fad0e4

SHA256
4360f36a50cb01e0f03036806029b90f13f243fec74d67d75e6fc83df5ab875a

SHA512
ed7c7dee09d4fbf60038f911e430fc34bb5930106a0d548a7d6ccc25761e3c9b09b80ac31d373411bbc4c3ee65ebd6a2b31b7a290bfd5cd2b824bbe1d3c438a2

Download Submit
C:\Windows\System\EhiJIrZ.exe

Filesize
1.7MB

MD5
8bc56850bfe17fe23c64591b22c6d604

SHA1
7325528bdb279f58f8b8ef8474c7e27aacb3626e

SHA256
e7d530433cee4e614186661f15b4e49b1baaa8de946b66475ccd18cdd5c3df2e

SHA512
5aeee849f024f7a213db773ab1b3b155f09ee9010e3cedb0534a7a8ee1eceea5f855b4784f2419d7a3042396998710ddf275ba442f90e375c8ceb3765c2dbf0f

Download Submit
C:\Windows\System\EzQzmBb.exe

Filesize
1.7MB

MD5
255b8e13a210da7d2446a0cf1f8bcdd3

SHA1
905e73bd6d0fda5149245d9b428e2846b11f3abe

SHA256
03f9e14125d7b897da9640782bd30e2c9317bf6b228169ef97ecc7edf9d10057

SHA512
4134ff6587a39be2ba7bcea14d191b9c490c1a3104e0a553bd3370ab7bc5f707d840b852a6ffda19d1be990a36c6d7d7658b931e05b68b0f6cfedd38f1a020e3

Download Submit
C:\Windows\System\LWKVhXG.exe

Filesize
1.7MB

MD5
b0c4362dc847387e374974e7f57ef92c

SHA1
ea0b80d51e9e8cdf6d9a34b40ced6ffdb7c1b69d

SHA256
087c682d9312895a03bc3c0aef62617d9dae899e51a9961c9439e96c8d4eaea1

SHA512
7ffae550fed9973157fa7cc6f6f744b01803677a15c32c5159ced2df1fca9bc4f9d5098983727c661549c0936c647238107e453e88a24939bcf93b4c3510497e

Download Submit
C:\Windows\System\LgaVBbB.exe

Filesize
1.7MB

MD5
385c38d03a65f0234d7519732674f9d1

SHA1
fbeff38ff78f06918d1e1d4b9e9f01501dd03325

SHA256
1295c671f2c2c4e1c481a9aa9e79115aba4ac6aa3f3139a1831a665213437cca

SHA512
72aa0cefd8b2ae1bf0d9d7b948d07c17464924a69bf764ad33fe865817f60c3280af90df7b9cd195f437072ec7c2e52a73a926d6ebe51ab0507b36404f3a1e24

Download Submit
C:\Windows\System\OSasbDD.exe

Filesize
1.7MB

MD5
7f7272cd05454a633eeb723977878970

SHA1
ca5b569a2f4c87fb7204115a55501c6823f3294d

SHA256
46478b7a8165280dbdb2da1f13a9c7c9b4960b7a8cf47573f9292765cd6ccc5b

SHA512
880079c940349942c7d51a5df2ebe151e670adf5db2c3575c0cca417355fb5485c9ca8fc013e17e916fe9001384c6be9d7732dc2497983858ed6b7050b290031

Download Submit
C:\Windows\System\OjUlyPF.exe

Filesize
1.7MB

MD5
181271e1ecbb58534971d943d309acf4

SHA1
f0f2ba51d00b5f5f32c74a9ad69ae6058838b319

SHA256
7dfd505f2391ecb42536b1b0fe79d054dad3795677078a0f6f9c710bbf708b1c

SHA512
e0eb635f481fb17702470031ccc506626a0a0975e6a22b1716a92ceb77791a6efa47f63247cea86fc7d563395d4ae32e0b6b5b11e124da3b6ab6a79542f5d2da

Download Submit
C:\Windows\System\PerRxZc.exe

Filesize
1.7MB

MD5
b8b612ec6cf1951161092197b6310af0

SHA1
627cdf69e22aeac50d7811fbde42c85a82709483

SHA256
4fbe12be7f31fed8abc80aeb0eb1215d2d087714c073ab1b270c4d178a6958e0

SHA512
3dff3a2075f4a0a5a3861a572266e13d387b40ac05c286472a9fd51cfe7929fda562824eca8d40d255287a149755f0c91d3aa034e6ab2e2bf2bbd6540f5c5719

Download Submit
C:\Windows\System\RmxnufR.exe

Filesize
1.7MB

MD5
bb3e6655224d5534201c8886ecda671b

SHA1
141ea7c061d88fc902d8b5a2113865820538a76d

SHA256
7496d20bb96057b1dd4ee30bd94b439018f3b89315ea4786bdcb28e5e1142954

SHA512
658f19158871cbf269ec162c83f4132cb4b4d4c8623144d6608402b2701ffe765401e9dd5e9d3e8da453b93550f9488530933a629859b47f754ff137edc52a32

Download Submit
C:\Windows\System\SGWirTY.exe

Filesize
1.7MB

MD5
2360ec063ec49a7c41df37b9a4e7458e

SHA1
239ef3c2eeebdd06fd31e4afa3b2b2fc4797c65d

SHA256
5bfbf27e34db79b16e28a92ec987ed80e0b6472d37f26ca69de30614aa1ab0ef

SHA512
6b90e8426109460a46845deaa0b3d5b73fb35ba0d9adcec85bc0befb988d96167eb70fbe0cafadce8ee9dff3a2515d9b93d66d97f9afe369abf793ec67803ad8

Download Submit
C:\Windows\System\ZFnOPRJ.exe

Filesize
1.7MB

MD5
298ca3d6d19683c681f1f4eb7ead4111

SHA1
445684eafa2987592b1578f3c32fc5bcf643c1d3

SHA256
5137b0447e1a42f48e7289fd7229065a8177766605b60c9dd8409ca6f19ed609

SHA512
02900b4e69ca4c9c8e04cb732ec27e9dc48c59511164865d5f31f40bcdd94dc7cb1b5de5a09357f4b158e9cb0635cfd9420347174a4d7d803827ae1b18b7f812

Download Submit
C:\Windows\System\ZiqCgJM.exe

Filesize
1.7MB

MD5
4ee6a41e315762c8dcf3334420c7b0c9

SHA1
17f86d3c749135c1fd5cf18047d0594e62ee268e

SHA256
a6bd7e736146e72fbd0e54511b5a6816f99e95cb1595277e2050eb3e4e25c3e3

SHA512
328c8eecfe75972920b6f87200c929c518aca34d036008c1fa242a449aca109c3200b2b5f6dbb1a391fd69134b4a99757778cd87db291afc78cb1304bb4cb083

Download Submit
C:\Windows\System\abfQcfs.exe

Filesize
1.7MB

MD5
5f89fc214897f823bc22562dc85d3da6

SHA1
89bdf032c31b063558672464744aa6d416551d75

SHA256
de00ccf1ca9dcbe65393974099014ebdc16bd655d75346c3b1cbbe1f13a19923

SHA512
208c6508729abf60a9be86dc553ac2690a1aa9b63c4706a19d9abd9db1a94fad9848c7962888aee38673bf163e5531009fb056ba4b76304492cf7cbac1b4863d

Download Submit
C:\Windows\System\cCmdkLT.exe

Filesize
1.7MB

MD5
2deedb4a190afd6635dcd3bddcdf0857

SHA1
57768bcc1d2ed47883c9f1c154968b456e3f60a7

SHA256
c0f9cd8cb3b088483a90d648710ac08c079376cd871bbed339080f086baa2f3e

SHA512
40502a545480760e04e2d99c7f26da70fb29c5f00927d9c92d5491b34045c0e7c84c0d1695f5b2f657eb6c4affbb9e1e0937ed3449fec68ff682cf3b54717077

Download Submit
C:\Windows\System\cCxxIIy.exe

Filesize
1.7MB

MD5
0562d908cdbc5be646fa7c16e29627bb

SHA1
a6cb29284c1b6f5aaf68957382f2af5e681c83e6

SHA256
c887d5af13bd67a3a356201067a818a3d886d99646a0ccf3068edc623f8ad36c

SHA512
31b6bc8e8b1832889e5d0775140ff0df0bc2af2117d806e1cbfd5e07eb13278778646111af35ea76869043bf38fb7963eba3acceb93947ee7a593346441df875

Download Submit
C:\Windows\System\fBLQoYg.exe

Filesize
1.7MB

MD5
5df3de1053094d49051475a97cfaed17

SHA1
f414c6737e8d4f1db2db2a410c781516ad0bc83a

SHA256
d40d7e1a1dc970decf5c6b9d4e5db511f8df82dc0aad3a9ecdbb075e2836c0c5

SHA512
19892173d3ecc4ec69d067823ee663012ed3d69ba6539603cb44975b76f653d6d9a9220f8a437c2d03a63cf3194db9077cbf806d0bbfc7a9cd9c92e56e820c18

Download Submit
C:\Windows\System\gftAmYr.exe

Filesize
1.7MB

MD5
183454c4ef4d4a6f97edf795232994ee

SHA1
2d03c82d8512a6d796c93f0890a53158a45e2e5a

SHA256
41694f9c43eeb5e43a9176faefcdc4a066160fcaeb13d40cdd1d312ec3b37302

SHA512
ed9d34b0967551618f436adf05b929dbde103f770ceab5e7a69ae532e4648d9c7d9dd92b586b9fb7d5ec16afc43f464077b85926495fff845e64658140010d56

Download Submit
C:\Windows\System\hCafaCr.exe

Filesize
1.7MB

MD5
d73e188e6fc22a713a04211d4639af7f

SHA1
4b3ef341db4da4dd1e063c2bedc9845f4ccb286c

SHA256
25b642828a04b1ae5c72e5d004d91208ea9ffe2fea9f1e5377945b31f210e948

SHA512
58864f39239b6b733012f502af13664d4054a4e018273ace395be34813cbb89b5ef5c6504b487b678c474535381196b4aa4b61d3399a8ccf574ec5c378381c51

Download Submit
C:\Windows\System\hXmnwgb.exe

Filesize
1.7MB

MD5
e2e04e986288727794acd730cdbd3afa

SHA1
e20b2996e98d0078189fa8ddb90c8d943cc372b4

SHA256
b9743fadc079ed83c9086aae28e6344925f37fec335946e922baa91b6de5c936

SHA512
c48e54b93c477bff6f783a365dd761fbf3e2a44e3a1ad1185610cb0693eab7c6d002fdffa2c6088dad0f200f60d0c6cf0ff3bd4deada34ff2a8b7b8a8953625e

Download Submit
C:\Windows\System\hkPkQQz.exe

Filesize
1.7MB

MD5
a93decbce9ffbcfee794120279a36ced

SHA1
3f8c58dca7aabd0124f187ffa21d139f6fec529a

SHA256
b5f5a8aa7c94e925fa103c639206bd63d960128dc6d134a858ac748192286855

SHA512
5685428763649de7af6ce79d397f4f1f68e688b3f2c5f912ef597be6f43e07d63979a9750e27b8d56f58907508c0a0b8a6f9b44fc1bcb33708d86e64f39707b5

Download Submit
C:\Windows\System\kRTfeIj.exe

Filesize
1.7MB

MD5
46d5a0459df0faa26f59757da6b07e06

SHA1
540f64560074444f4b46f76f3e7cccb7dba3a736

SHA256
96414983ffaf45de8891b4f80055c65080f31a7a5c546534f8cae2a6ad8c6026

SHA512
bb3edbbaa2c488e54d6bdf450832e86602114abd3853f908af8d61ceca9a03bbf738012afef1292468c28ff71ae4d3ce6b21de8f0c86e6398403284911f8cc61

Download Submit
C:\Windows\System\mqsWepi.exe

Filesize
1.7MB

MD5
cad569cb5aa25252c1b506208d87ab9a

SHA1
b30ef55db72781f18cc1c94fbd48136970a6af8c

SHA256
2fa2a360366cdae40cb6cd4222d4a2f1d6557c7ce1b4b7221988673da76864cf

SHA512
9b091433c7c3796777ba9f26bb85b6056ac4af3f1ace7317bfc6e41a2335d2312e97395ebcf48003c23f57fb0f8600c82678c40c93774d45cc8a71e0ad284152

Download Submit
C:\Windows\System\nSspWNX.exe

Filesize
1.7MB

MD5
ed173e06b32955b1d6c23f08690ce1cd

SHA1
d2f66891d09f6be12c3dfa1b332b8b1a465cbf30

SHA256
e43b11acaeee59ac7022e9410a0ebc9f530da68119227421028805d9f604f524

SHA512
290bb6e45d03be4e9b1860235add38ca7fe1848f0ebde0613868ef7dec31ed6a73e626ea15d82a65082dbc5155851b836f9c96d10bdf9ca653e307ad178421ff

Download Submit
C:\Windows\System\qaPlhqV.exe

Filesize
1.7MB

MD5
3a3052f499b28be7c34e188ad189ee98

SHA1
6b2d42e0f22695803b252316140f19bc2468f9ca

SHA256
ea08e86512662b569d25285edd6b9b0590119291ce3e28122249cd4409045c1d

SHA512
86a7ccc538500e529de2fcf4c3fc95f35389a630039d2e0d95eeb94b5346c2933461edf68ba12fc9bfd0fbc1cff448df1f3d1746b9ed37305f17746931cf4175

Download Submit
C:\Windows\System\tLivMoO.exe

Filesize
1.7MB

MD5
72a6172bbadb755e23b223b53fc2897f

SHA1
b22feb6ed4b33fbbfcb49ebe6cbbee8fc4d3d8d4

SHA256
f08960b9759f87f635f804b55900520ff9580ec0218e67da2f5ba888e87492bf

SHA512
74a7959f78e75894614a3c23c69c563db0f07697715a63e63059002cc88238effc9bf6f855c9baf3dbd8f2c4d2b15cd401c09e5b33ffbfd4fee656cb2eedd4a8

Download Submit
C:\Windows\System\txYCyEO.exe

Filesize
1.7MB

MD5
0a08243e43345fb514fcb58b82565be9

SHA1
e950d5214032fc0229bd45b646e934721de84963

SHA256
92af70cb4b12df04d46298015cc4a455ab566cb4e960dd36d9e7cf535d4575cb

SHA512
1bedbb695f767a5d89f148736556cd4d805cb62067cfb1a222006dc6d78fd92e49a7344a5f5b174f5673596104263bf8adcb775195b85c29b0843d56a5aa1ea9

Download Submit
C:\Windows\System\wQUuHIm.exe

Filesize
1.7MB

MD5
3c79fe01e4e18a7283e7eb3ee5f2daff

SHA1
bf82bc60265b23a870cd0f3b74ea99c5d6b9b617

SHA256
d1e03910450f8d059bedb6450d90eee55b76956c8854ac4119b6e159b81bcae7

SHA512
149882d4f9833b66d75fcecacacfd35fec3dd3e86386ab027636da961aca2af246710c781751a8a1a5eb5d37ce87b20c458fcc8767a6e9bd129babff75c6fd82

Download Submit
C:\Windows\System\wrPxATm.exe

Filesize
1.7MB

MD5
9591942d8376b38619f696a768670c0b

SHA1
ac22bf15751fcc9d49d1bbc93234a4ac576027d4

SHA256
a96b25c7b46ae950d9413a337fd2513d9d9cfeba712377e4e4f12f4f5a38eddd

SHA512
12355fcb56374661c8f7ddac9880dd9a07b58c8faea061114dedc7ec9a74813e1ffca366186ad028ef8fee245a8689fdb72efcd11d1aa79c59407456f29a9705

Download Submit
C:\Windows\System\yOnNVIL.exe

Filesize
1.7MB

MD5
95267da93e5903128ce4122dea4fe4dc

SHA1
b1458201d1dda587564e2e2e14b172d6e07fb5dc

SHA256
eaa35ae782407c44e7166da2abdf58057e27549ba63787327da0dd63a1cd560c

SHA512
326f073d7fbdebbf1dfc7421056983993aaa528178712c434e387d625d9eb223a4af274807b22154eaa9706162050ddd5dc60b779285a7c66e3eda4ca8de0ad0

Download Submit
C:\Windows\System\ymzoUFQ.exe

Filesize
1.7MB

MD5
3a922a1f55b2d1d1f4fb0990e46e1fdd

SHA1
cdd380786069fa6e1af2817df8a52043f4d3ba90

SHA256
f6f62e2eb9367b67f22e10c42c6e9cf7aa48d584e9a17985ef86ba4d8a86b504

SHA512
18b13a9b997d8cd55196fe7b225c73002ee1868c1bc8c5b2ab8def7413df0ee695c2b67e662ca3d7a93a236907794ded1311185088fc3da1e33ba3a4b9eddd8d

Download Submit
C:\Windows\System\zwnagkR.exe

Filesize
1.7MB

MD5
02ffd779d6e8a16d16079430935f2416

SHA1
cafcb4e0050f1710b5d05d8ac20f516f630a5a30

SHA256
3cbcdd64a53e337d8092238219484cb2e6126868264b94d7223e5d81da914f8b

SHA512
c3b94dacf5ec1cb2139d4e5784a671b04ac733b0e68573b239806efacab75a0f1ddc1a909dc5177bd8b0179178ef26d8e56b0e9df6f82295f8385b9309a2ddcb

Download Submit
memory/4748-0-0x00000198067E0000-0x00000198067F0000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads