xmrig | 4e2730ab97f109e2b1c537f8eb7c238ec4d006e82d263e33ecb56fa7a3638c45

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
25/01/2025, 22:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4e2730ab97f109e2b1c537f8eb7c238ec4d006e82d263e33ecb56fa7a3638c45.exe
Size

980KB
MD5

2b8f6d3df2b16ba4c7f39d81389f35c4
SHA1

929869628a2189c9ff30aa146ee6fa1a0116250a
SHA256

4e2730ab97f109e2b1c537f8eb7c238ec4d006e82d263e33ecb56fa7a3638c45
SHA512

bfa66a81fecb9885e00c78104f24043e2706700983324533cc49fdf0a1417e2deebb8b6b0c1a040e6d3041bc7bf2bde0640483b434c460269dfd3c70eb01f879
SSDEEP

24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbpwlKenszQEMry:GezaTF8FcNkNdfE0pZ9ozttwIRQ2

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 33 IoCs

miner

resource	yara_rule
behavioral2/files/0x000a000000023c1f-4.dat	xmrig
behavioral2/files/0x0008000000023cab-8.dat	xmrig
behavioral2/files/0x0007000000023caf-15.dat	xmrig
behavioral2/files/0x0007000000023cb2-30.dat	xmrig
behavioral2/files/0x0007000000023cb3-38.dat	xmrig
behavioral2/files/0x0007000000023cb7-58.dat	xmrig
behavioral2/files/0x0007000000023cbb-74.dat	xmrig
behavioral2/files/0x0007000000023cc2-109.dat	xmrig
behavioral2/files/0x0007000000023cc8-139.dat	xmrig
behavioral2/files/0x0007000000023ccd-162.dat	xmrig
behavioral2/files/0x0007000000023ccc-159.dat	xmrig
behavioral2/files/0x0007000000023ccb-157.dat	xmrig
behavioral2/files/0x0007000000023cca-153.dat	xmrig
behavioral2/files/0x0007000000023cc9-147.dat	xmrig
behavioral2/files/0x0007000000023cc7-137.dat	xmrig
behavioral2/files/0x0007000000023cc6-133.dat	xmrig
behavioral2/files/0x0007000000023cc5-127.dat	xmrig
behavioral2/files/0x0007000000023cc4-123.dat	xmrig
behavioral2/files/0x0007000000023cc3-117.dat	xmrig
behavioral2/files/0x0007000000023cc1-105.dat	xmrig
behavioral2/files/0x0007000000023cc0-102.dat	xmrig
behavioral2/files/0x0007000000023cbf-98.dat	xmrig
behavioral2/files/0x0007000000023cbe-92.dat	xmrig
behavioral2/files/0x0007000000023cbd-88.dat	xmrig
behavioral2/files/0x0007000000023cbc-82.dat	xmrig
behavioral2/files/0x0007000000023cba-72.dat	xmrig
behavioral2/files/0x0007000000023cb9-68.dat	xmrig
behavioral2/files/0x0007000000023cb8-62.dat	xmrig
behavioral2/files/0x0007000000023cb6-52.dat	xmrig
behavioral2/files/0x0007000000023cb5-48.dat	xmrig
behavioral2/files/0x0007000000023cb4-42.dat	xmrig
behavioral2/files/0x0007000000023cb1-24.dat	xmrig
behavioral2/files/0x0007000000023cb0-20.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
724	eTnHrPB.exe
4784	ZNqdSNa.exe
4028	xxDcwBh.exe
3120	lzTMWLT.exe
1224	yEgqsID.exe
3052	dnKjRIG.exe
536	eBJtNKS.exe
628	QxIObCD.exe
4396	jaJLRBO.exe
1120	YazRsXe.exe
1228	nWoPoQY.exe
1748	ugLeeXi.exe
3116	vEQxSwf.exe
2600	lhdQcKv.exe
2520	JuZGaaO.exe
2256	ikjjgfe.exe
220	icAOhBD.exe
5012	mVtDUTo.exe
4672	aFPPGeD.exe
2808	hezpiVc.exe
440	GokwgwF.exe
4040	cbPEXEc.exe
1664	buOMHko.exe
3096	sOwmfSB.exe
2716	XwkQIIx.exe
3668	eumnOGT.exe
832	lqGmsmk.exe
4412	MtxsvMU.exe
1844	esgQfOm.exe
2608	TYDBzmA.exe
4476	oqPZwnE.exe
4724	YkcAuBq.exe
3636	YzBWGOM.exe
912	OKWRVuo.exe
4184	prkwSSS.exe
1420	SsyyMfK.exe
64	uuWblHQ.exe
976	gfgXbVs.exe
2568	vuNlizO.exe
3956	LuWWuNw.exe
2100	bhjWEmh.exe
2644	pdHEAiW.exe
1196	xkdLOpS.exe
808	nTuNObh.exe
4836	Swbwvmz.exe
1696	XnxTIku.exe
1508	iMmkOmZ.exe
1432	teZxMwe.exe
3672	PgAZcGc.exe
1736	kTLGqyc.exe
4936	HVnGxqi.exe
812	izVDySK.exe
1140	UHyfSwF.exe
4448	BWPMSGc.exe
2136	RnpFQLs.exe
4400	ITnhunY.exe
1216	KRkBEIW.exe
4284	xIBYKta.exe
3124	xMBnaFY.exe
744	Bhalxjt.exe
4920	vyRuMuI.exe
2320	PevRIBz.exe
2132	HICydck.exe
312	xupQQIW.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\OWFYvxd.exe	4e2730ab97f109e2b1c537f8eb7c238ec4d006e82d263e33ecb56fa7a3638c45.exe
File created	C:\Windows\System\fKLEYWF.exe	4e2730ab97f109e2b1c537f8eb7c238ec4d006e82d263e33ecb56fa7a3638c45.exe
File created	C:\Windows\System\exFsGui.exe	4e2730ab97f109e2b1c537f8eb7c238ec4d006e82d263e33ecb56fa7a3638c45.exe
File created	C:\Windows\System\vLsSUWd.exe	4e2730ab97f109e2b1c537f8eb7c238ec4d006e82d263e33ecb56fa7a3638c45.exe
File created	C:\Windows\System\gPJJSat.exe	4e2730ab97f109e2b1c537f8eb7c238ec4d006e82d263e33ecb56fa7a3638c45.exe
File created	C:\Windows\System\gfgXbVs.exe	4e2730ab97f109e2b1c537f8eb7c238ec4d006e82d263e33ecb56fa7a3638c45.exe
File created	C:\Windows\System\leLiOEG.exe	4e2730ab97f109e2b1c537f8eb7c238ec4d006e82d263e33ecb56fa7a3638c45.exe
File created	C:\Windows\System\FMpsirR.exe	4e2730ab97f109e2b1c537f8eb7c238ec4d006e82d263e33ecb56fa7a3638c45.exe
File created	C:\Windows\System\inujGhb.exe	4e2730ab97f109e2b1c537f8eb7c238ec4d006e82d263e33ecb56fa7a3638c45.exe
File created	C:\Windows\System\AdDnLor.exe	4e2730ab97f109e2b1c537f8eb7c238ec4d006e82d263e33ecb56fa7a3638c45.exe
File created	C:\Windows\System\zJpZPGX.exe	4e2730ab97f109e2b1c537f8eb7c238ec4d006e82d263e33ecb56fa7a3638c45.exe
File created	C:\Windows\System\kTLGqyc.exe	4e2730ab97f109e2b1c537f8eb7c238ec4d006e82d263e33ecb56fa7a3638c45.exe
File created	C:\Windows\System\wPIYszk.exe	4e2730ab97f109e2b1c537f8eb7c238ec4d006e82d263e33ecb56fa7a3638c45.exe
File created	C:\Windows\System\uvDYJtT.exe	4e2730ab97f109e2b1c537f8eb7c238ec4d006e82d263e33ecb56fa7a3638c45.exe
File created	C:\Windows\System\PgAZcGc.exe	4e2730ab97f109e2b1c537f8eb7c238ec4d006e82d263e33ecb56fa7a3638c45.exe
File created	C:\Windows\System\ybYRTqt.exe	4e2730ab97f109e2b1c537f8eb7c238ec4d006e82d263e33ecb56fa7a3638c45.exe
File created	C:\Windows\System\MXtfSML.exe	4e2730ab97f109e2b1c537f8eb7c238ec4d006e82d263e33ecb56fa7a3638c45.exe
File created	C:\Windows\System\LpCGLgV.exe	4e2730ab97f109e2b1c537f8eb7c238ec4d006e82d263e33ecb56fa7a3638c45.exe
File created	C:\Windows\System\QRbRHRX.exe	4e2730ab97f109e2b1c537f8eb7c238ec4d006e82d263e33ecb56fa7a3638c45.exe
File created	C:\Windows\System\YqWoGic.exe	4e2730ab97f109e2b1c537f8eb7c238ec4d006e82d263e33ecb56fa7a3638c45.exe
File created	C:\Windows\System\rPRQrxA.exe	4e2730ab97f109e2b1c537f8eb7c238ec4d006e82d263e33ecb56fa7a3638c45.exe
File created	C:\Windows\System\hbzVTIj.exe	4e2730ab97f109e2b1c537f8eb7c238ec4d006e82d263e33ecb56fa7a3638c45.exe
File created	C:\Windows\System\MYbJIGN.exe	4e2730ab97f109e2b1c537f8eb7c238ec4d006e82d263e33ecb56fa7a3638c45.exe
File created	C:\Windows\System\ygVlaZU.exe	4e2730ab97f109e2b1c537f8eb7c238ec4d006e82d263e33ecb56fa7a3638c45.exe
File created	C:\Windows\System\ROrSGyZ.exe	4e2730ab97f109e2b1c537f8eb7c238ec4d006e82d263e33ecb56fa7a3638c45.exe
File created	C:\Windows\System\FXJpDoa.exe	4e2730ab97f109e2b1c537f8eb7c238ec4d006e82d263e33ecb56fa7a3638c45.exe
File created	C:\Windows\System\GUziugR.exe	4e2730ab97f109e2b1c537f8eb7c238ec4d006e82d263e33ecb56fa7a3638c45.exe
File created	C:\Windows\System\RrRbcCZ.exe	4e2730ab97f109e2b1c537f8eb7c238ec4d006e82d263e33ecb56fa7a3638c45.exe
File created	C:\Windows\System\epAgOzo.exe	4e2730ab97f109e2b1c537f8eb7c238ec4d006e82d263e33ecb56fa7a3638c45.exe
File created	C:\Windows\System\dgyNrRw.exe	4e2730ab97f109e2b1c537f8eb7c238ec4d006e82d263e33ecb56fa7a3638c45.exe
File created	C:\Windows\System\rzckoTH.exe	4e2730ab97f109e2b1c537f8eb7c238ec4d006e82d263e33ecb56fa7a3638c45.exe
File created	C:\Windows\System\fsfpspv.exe	4e2730ab97f109e2b1c537f8eb7c238ec4d006e82d263e33ecb56fa7a3638c45.exe
File created	C:\Windows\System\bqUKcim.exe	4e2730ab97f109e2b1c537f8eb7c238ec4d006e82d263e33ecb56fa7a3638c45.exe
File created	C:\Windows\System\mVtDUTo.exe	4e2730ab97f109e2b1c537f8eb7c238ec4d006e82d263e33ecb56fa7a3638c45.exe
File created	C:\Windows\System\shlYNFj.exe	4e2730ab97f109e2b1c537f8eb7c238ec4d006e82d263e33ecb56fa7a3638c45.exe
File created	C:\Windows\System\TUxLUsi.exe	4e2730ab97f109e2b1c537f8eb7c238ec4d006e82d263e33ecb56fa7a3638c45.exe
File created	C:\Windows\System\zLCuZaw.exe	4e2730ab97f109e2b1c537f8eb7c238ec4d006e82d263e33ecb56fa7a3638c45.exe
File created	C:\Windows\System\vEzVofh.exe	4e2730ab97f109e2b1c537f8eb7c238ec4d006e82d263e33ecb56fa7a3638c45.exe
File created	C:\Windows\System\TaVtkNB.exe	4e2730ab97f109e2b1c537f8eb7c238ec4d006e82d263e33ecb56fa7a3638c45.exe
File created	C:\Windows\System\CKufCoX.exe	4e2730ab97f109e2b1c537f8eb7c238ec4d006e82d263e33ecb56fa7a3638c45.exe
File created	C:\Windows\System\jaJLRBO.exe	4e2730ab97f109e2b1c537f8eb7c238ec4d006e82d263e33ecb56fa7a3638c45.exe
File created	C:\Windows\System\prkwSSS.exe	4e2730ab97f109e2b1c537f8eb7c238ec4d006e82d263e33ecb56fa7a3638c45.exe
File created	C:\Windows\System\iGMXcrc.exe	4e2730ab97f109e2b1c537f8eb7c238ec4d006e82d263e33ecb56fa7a3638c45.exe
File created	C:\Windows\System\TepmnmC.exe	4e2730ab97f109e2b1c537f8eb7c238ec4d006e82d263e33ecb56fa7a3638c45.exe
File created	C:\Windows\System\bgTDUmC.exe	4e2730ab97f109e2b1c537f8eb7c238ec4d006e82d263e33ecb56fa7a3638c45.exe
File created	C:\Windows\System\loHGeEH.exe	4e2730ab97f109e2b1c537f8eb7c238ec4d006e82d263e33ecb56fa7a3638c45.exe
File created	C:\Windows\System\aNwwvQl.exe	4e2730ab97f109e2b1c537f8eb7c238ec4d006e82d263e33ecb56fa7a3638c45.exe
File created	C:\Windows\System\HVnGxqi.exe	4e2730ab97f109e2b1c537f8eb7c238ec4d006e82d263e33ecb56fa7a3638c45.exe
File created	C:\Windows\System\pnfZUWL.exe	4e2730ab97f109e2b1c537f8eb7c238ec4d006e82d263e33ecb56fa7a3638c45.exe
File created	C:\Windows\System\jmEfTGF.exe	4e2730ab97f109e2b1c537f8eb7c238ec4d006e82d263e33ecb56fa7a3638c45.exe
File created	C:\Windows\System\OARNoVj.exe	4e2730ab97f109e2b1c537f8eb7c238ec4d006e82d263e33ecb56fa7a3638c45.exe
File created	C:\Windows\System\QeOfMmD.exe	4e2730ab97f109e2b1c537f8eb7c238ec4d006e82d263e33ecb56fa7a3638c45.exe
File created	C:\Windows\System\fgenCXq.exe	4e2730ab97f109e2b1c537f8eb7c238ec4d006e82d263e33ecb56fa7a3638c45.exe
File created	C:\Windows\System\OmVgcuC.exe	4e2730ab97f109e2b1c537f8eb7c238ec4d006e82d263e33ecb56fa7a3638c45.exe
File created	C:\Windows\System\DXPrlLs.exe	4e2730ab97f109e2b1c537f8eb7c238ec4d006e82d263e33ecb56fa7a3638c45.exe
File created	C:\Windows\System\nvSDEMh.exe	4e2730ab97f109e2b1c537f8eb7c238ec4d006e82d263e33ecb56fa7a3638c45.exe
File created	C:\Windows\System\gCFnkQB.exe	4e2730ab97f109e2b1c537f8eb7c238ec4d006e82d263e33ecb56fa7a3638c45.exe
File created	C:\Windows\System\tOOAAoa.exe	4e2730ab97f109e2b1c537f8eb7c238ec4d006e82d263e33ecb56fa7a3638c45.exe
File created	C:\Windows\System\oqPZwnE.exe	4e2730ab97f109e2b1c537f8eb7c238ec4d006e82d263e33ecb56fa7a3638c45.exe
File created	C:\Windows\System\HovXtEy.exe	4e2730ab97f109e2b1c537f8eb7c238ec4d006e82d263e33ecb56fa7a3638c45.exe
File created	C:\Windows\System\bezsMon.exe	4e2730ab97f109e2b1c537f8eb7c238ec4d006e82d263e33ecb56fa7a3638c45.exe
File created	C:\Windows\System\Dealfqq.exe	4e2730ab97f109e2b1c537f8eb7c238ec4d006e82d263e33ecb56fa7a3638c45.exe
File created	C:\Windows\System\CfgoOfq.exe	4e2730ab97f109e2b1c537f8eb7c238ec4d006e82d263e33ecb56fa7a3638c45.exe
File created	C:\Windows\System\dmwFlPT.exe	4e2730ab97f109e2b1c537f8eb7c238ec4d006e82d263e33ecb56fa7a3638c45.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	17280	dwm.exe
Token: SeChangeNotifyPrivilege	17280	dwm.exe
Token: 33	17280	dwm.exe
Token: SeIncBasePriorityPrivilege	17280	dwm.exe
Token: SeShutdownPrivilege	17280	dwm.exe
Token: SeCreatePagefilePrivilege	17280	dwm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2180 wrote to memory of 724	2180	4e2730ab97f109e2b1c537f8eb7c238ec4d006e82d263e33ecb56fa7a3638c45.exe	84
PID 2180 wrote to memory of 724	2180	4e2730ab97f109e2b1c537f8eb7c238ec4d006e82d263e33ecb56fa7a3638c45.exe	84
PID 2180 wrote to memory of 4784	2180	4e2730ab97f109e2b1c537f8eb7c238ec4d006e82d263e33ecb56fa7a3638c45.exe	85
PID 2180 wrote to memory of 4784	2180	4e2730ab97f109e2b1c537f8eb7c238ec4d006e82d263e33ecb56fa7a3638c45.exe	85
PID 2180 wrote to memory of 4028	2180	4e2730ab97f109e2b1c537f8eb7c238ec4d006e82d263e33ecb56fa7a3638c45.exe	86
PID 2180 wrote to memory of 4028	2180	4e2730ab97f109e2b1c537f8eb7c238ec4d006e82d263e33ecb56fa7a3638c45.exe	86
PID 2180 wrote to memory of 3120	2180	4e2730ab97f109e2b1c537f8eb7c238ec4d006e82d263e33ecb56fa7a3638c45.exe	87
PID 2180 wrote to memory of 3120	2180	4e2730ab97f109e2b1c537f8eb7c238ec4d006e82d263e33ecb56fa7a3638c45.exe	87
PID 2180 wrote to memory of 1224	2180	4e2730ab97f109e2b1c537f8eb7c238ec4d006e82d263e33ecb56fa7a3638c45.exe	88
PID 2180 wrote to memory of 1224	2180	4e2730ab97f109e2b1c537f8eb7c238ec4d006e82d263e33ecb56fa7a3638c45.exe	88
PID 2180 wrote to memory of 3052	2180	4e2730ab97f109e2b1c537f8eb7c238ec4d006e82d263e33ecb56fa7a3638c45.exe	89
PID 2180 wrote to memory of 3052	2180	4e2730ab97f109e2b1c537f8eb7c238ec4d006e82d263e33ecb56fa7a3638c45.exe	89
PID 2180 wrote to memory of 536	2180	4e2730ab97f109e2b1c537f8eb7c238ec4d006e82d263e33ecb56fa7a3638c45.exe	90
PID 2180 wrote to memory of 536	2180	4e2730ab97f109e2b1c537f8eb7c238ec4d006e82d263e33ecb56fa7a3638c45.exe	90
PID 2180 wrote to memory of 628	2180	4e2730ab97f109e2b1c537f8eb7c238ec4d006e82d263e33ecb56fa7a3638c45.exe	91
PID 2180 wrote to memory of 628	2180	4e2730ab97f109e2b1c537f8eb7c238ec4d006e82d263e33ecb56fa7a3638c45.exe	91
PID 2180 wrote to memory of 4396	2180	4e2730ab97f109e2b1c537f8eb7c238ec4d006e82d263e33ecb56fa7a3638c45.exe	92
PID 2180 wrote to memory of 4396	2180	4e2730ab97f109e2b1c537f8eb7c238ec4d006e82d263e33ecb56fa7a3638c45.exe	92
PID 2180 wrote to memory of 1120	2180	4e2730ab97f109e2b1c537f8eb7c238ec4d006e82d263e33ecb56fa7a3638c45.exe	93
PID 2180 wrote to memory of 1120	2180	4e2730ab97f109e2b1c537f8eb7c238ec4d006e82d263e33ecb56fa7a3638c45.exe	93
PID 2180 wrote to memory of 1228	2180	4e2730ab97f109e2b1c537f8eb7c238ec4d006e82d263e33ecb56fa7a3638c45.exe	94
PID 2180 wrote to memory of 1228	2180	4e2730ab97f109e2b1c537f8eb7c238ec4d006e82d263e33ecb56fa7a3638c45.exe	94
PID 2180 wrote to memory of 1748	2180	4e2730ab97f109e2b1c537f8eb7c238ec4d006e82d263e33ecb56fa7a3638c45.exe	95
PID 2180 wrote to memory of 1748	2180	4e2730ab97f109e2b1c537f8eb7c238ec4d006e82d263e33ecb56fa7a3638c45.exe	95
PID 2180 wrote to memory of 3116	2180	4e2730ab97f109e2b1c537f8eb7c238ec4d006e82d263e33ecb56fa7a3638c45.exe	96
PID 2180 wrote to memory of 3116	2180	4e2730ab97f109e2b1c537f8eb7c238ec4d006e82d263e33ecb56fa7a3638c45.exe	96
PID 2180 wrote to memory of 2600	2180	4e2730ab97f109e2b1c537f8eb7c238ec4d006e82d263e33ecb56fa7a3638c45.exe	97
PID 2180 wrote to memory of 2600	2180	4e2730ab97f109e2b1c537f8eb7c238ec4d006e82d263e33ecb56fa7a3638c45.exe	97
PID 2180 wrote to memory of 2520	2180	4e2730ab97f109e2b1c537f8eb7c238ec4d006e82d263e33ecb56fa7a3638c45.exe	98
PID 2180 wrote to memory of 2520	2180	4e2730ab97f109e2b1c537f8eb7c238ec4d006e82d263e33ecb56fa7a3638c45.exe	98
PID 2180 wrote to memory of 2256	2180	4e2730ab97f109e2b1c537f8eb7c238ec4d006e82d263e33ecb56fa7a3638c45.exe	99
PID 2180 wrote to memory of 2256	2180	4e2730ab97f109e2b1c537f8eb7c238ec4d006e82d263e33ecb56fa7a3638c45.exe	99
PID 2180 wrote to memory of 220	2180	4e2730ab97f109e2b1c537f8eb7c238ec4d006e82d263e33ecb56fa7a3638c45.exe	100
PID 2180 wrote to memory of 220	2180	4e2730ab97f109e2b1c537f8eb7c238ec4d006e82d263e33ecb56fa7a3638c45.exe	100
PID 2180 wrote to memory of 5012	2180	4e2730ab97f109e2b1c537f8eb7c238ec4d006e82d263e33ecb56fa7a3638c45.exe	101
PID 2180 wrote to memory of 5012	2180	4e2730ab97f109e2b1c537f8eb7c238ec4d006e82d263e33ecb56fa7a3638c45.exe	101
PID 2180 wrote to memory of 4672	2180	4e2730ab97f109e2b1c537f8eb7c238ec4d006e82d263e33ecb56fa7a3638c45.exe	102
PID 2180 wrote to memory of 4672	2180	4e2730ab97f109e2b1c537f8eb7c238ec4d006e82d263e33ecb56fa7a3638c45.exe	102
PID 2180 wrote to memory of 2808	2180	4e2730ab97f109e2b1c537f8eb7c238ec4d006e82d263e33ecb56fa7a3638c45.exe	103
PID 2180 wrote to memory of 2808	2180	4e2730ab97f109e2b1c537f8eb7c238ec4d006e82d263e33ecb56fa7a3638c45.exe	103
PID 2180 wrote to memory of 440	2180	4e2730ab97f109e2b1c537f8eb7c238ec4d006e82d263e33ecb56fa7a3638c45.exe	104
PID 2180 wrote to memory of 440	2180	4e2730ab97f109e2b1c537f8eb7c238ec4d006e82d263e33ecb56fa7a3638c45.exe	104
PID 2180 wrote to memory of 4040	2180	4e2730ab97f109e2b1c537f8eb7c238ec4d006e82d263e33ecb56fa7a3638c45.exe	105
PID 2180 wrote to memory of 4040	2180	4e2730ab97f109e2b1c537f8eb7c238ec4d006e82d263e33ecb56fa7a3638c45.exe	105
PID 2180 wrote to memory of 1664	2180	4e2730ab97f109e2b1c537f8eb7c238ec4d006e82d263e33ecb56fa7a3638c45.exe	106
PID 2180 wrote to memory of 1664	2180	4e2730ab97f109e2b1c537f8eb7c238ec4d006e82d263e33ecb56fa7a3638c45.exe	106
PID 2180 wrote to memory of 3096	2180	4e2730ab97f109e2b1c537f8eb7c238ec4d006e82d263e33ecb56fa7a3638c45.exe	107
PID 2180 wrote to memory of 3096	2180	4e2730ab97f109e2b1c537f8eb7c238ec4d006e82d263e33ecb56fa7a3638c45.exe	107
PID 2180 wrote to memory of 2716	2180	4e2730ab97f109e2b1c537f8eb7c238ec4d006e82d263e33ecb56fa7a3638c45.exe	108
PID 2180 wrote to memory of 2716	2180	4e2730ab97f109e2b1c537f8eb7c238ec4d006e82d263e33ecb56fa7a3638c45.exe	108
PID 2180 wrote to memory of 3668	2180	4e2730ab97f109e2b1c537f8eb7c238ec4d006e82d263e33ecb56fa7a3638c45.exe	109
PID 2180 wrote to memory of 3668	2180	4e2730ab97f109e2b1c537f8eb7c238ec4d006e82d263e33ecb56fa7a3638c45.exe	109
PID 2180 wrote to memory of 832	2180	4e2730ab97f109e2b1c537f8eb7c238ec4d006e82d263e33ecb56fa7a3638c45.exe	110
PID 2180 wrote to memory of 832	2180	4e2730ab97f109e2b1c537f8eb7c238ec4d006e82d263e33ecb56fa7a3638c45.exe	110
PID 2180 wrote to memory of 4412	2180	4e2730ab97f109e2b1c537f8eb7c238ec4d006e82d263e33ecb56fa7a3638c45.exe	111
PID 2180 wrote to memory of 4412	2180	4e2730ab97f109e2b1c537f8eb7c238ec4d006e82d263e33ecb56fa7a3638c45.exe	111
PID 2180 wrote to memory of 1844	2180	4e2730ab97f109e2b1c537f8eb7c238ec4d006e82d263e33ecb56fa7a3638c45.exe	112
PID 2180 wrote to memory of 1844	2180	4e2730ab97f109e2b1c537f8eb7c238ec4d006e82d263e33ecb56fa7a3638c45.exe	112
PID 2180 wrote to memory of 2608	2180	4e2730ab97f109e2b1c537f8eb7c238ec4d006e82d263e33ecb56fa7a3638c45.exe	113
PID 2180 wrote to memory of 2608	2180	4e2730ab97f109e2b1c537f8eb7c238ec4d006e82d263e33ecb56fa7a3638c45.exe	113
PID 2180 wrote to memory of 4476	2180	4e2730ab97f109e2b1c537f8eb7c238ec4d006e82d263e33ecb56fa7a3638c45.exe	114
PID 2180 wrote to memory of 4476	2180	4e2730ab97f109e2b1c537f8eb7c238ec4d006e82d263e33ecb56fa7a3638c45.exe	114
PID 2180 wrote to memory of 4724	2180	4e2730ab97f109e2b1c537f8eb7c238ec4d006e82d263e33ecb56fa7a3638c45.exe	115
PID 2180 wrote to memory of 4724	2180	4e2730ab97f109e2b1c537f8eb7c238ec4d006e82d263e33ecb56fa7a3638c45.exe	115

C:\Users\Admin\AppData\Local\Temp\4e2730ab97f109e2b1c537f8eb7c238ec4d006e82d263e33ecb56fa7a3638c45.exe
"C:\Users\Admin\AppData\Local\Temp\4e2730ab97f109e2b1c537f8eb7c238ec4d006e82d263e33ecb56fa7a3638c45.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2180
- C:\Windows\System\eTnHrPB.exe
  C:\Windows\System\eTnHrPB.exe
  2⤵
  - Executes dropped EXE
  PID:724
- C:\Windows\System\ZNqdSNa.exe
  C:\Windows\System\ZNqdSNa.exe
  2⤵
  - Executes dropped EXE
  PID:4784
- C:\Windows\System\xxDcwBh.exe
  C:\Windows\System\xxDcwBh.exe
  2⤵
  - Executes dropped EXE
  PID:4028
- C:\Windows\System\lzTMWLT.exe
  C:\Windows\System\lzTMWLT.exe
  2⤵
  - Executes dropped EXE
  PID:3120
- C:\Windows\System\yEgqsID.exe
  C:\Windows\System\yEgqsID.exe
  2⤵
  - Executes dropped EXE
  PID:1224
- C:\Windows\System\dnKjRIG.exe
  C:\Windows\System\dnKjRIG.exe
  2⤵
  - Executes dropped EXE
  PID:3052
- C:\Windows\System\eBJtNKS.exe
  C:\Windows\System\eBJtNKS.exe
  2⤵
  - Executes dropped EXE
  PID:536
- C:\Windows\System\QxIObCD.exe
  C:\Windows\System\QxIObCD.exe
  2⤵
  - Executes dropped EXE
  PID:628
- C:\Windows\System\jaJLRBO.exe
  C:\Windows\System\jaJLRBO.exe
  2⤵
  - Executes dropped EXE
  PID:4396
- C:\Windows\System\YazRsXe.exe
  C:\Windows\System\YazRsXe.exe
  2⤵
  - Executes dropped EXE
  PID:1120
- C:\Windows\System\nWoPoQY.exe
  C:\Windows\System\nWoPoQY.exe
  2⤵
  - Executes dropped EXE
  PID:1228
- C:\Windows\System\ugLeeXi.exe
  C:\Windows\System\ugLeeXi.exe
  2⤵
  - Executes dropped EXE
  PID:1748
- C:\Windows\System\vEQxSwf.exe
  C:\Windows\System\vEQxSwf.exe
  2⤵
  - Executes dropped EXE
  PID:3116
- C:\Windows\System\lhdQcKv.exe
  C:\Windows\System\lhdQcKv.exe
  2⤵
  - Executes dropped EXE
  PID:2600
- C:\Windows\System\JuZGaaO.exe
  C:\Windows\System\JuZGaaO.exe
  2⤵
  - Executes dropped EXE
  PID:2520
- C:\Windows\System\ikjjgfe.exe
  C:\Windows\System\ikjjgfe.exe
  2⤵
  - Executes dropped EXE
  PID:2256
- C:\Windows\System\icAOhBD.exe
  C:\Windows\System\icAOhBD.exe
  2⤵
  - Executes dropped EXE
  PID:220
- C:\Windows\System\mVtDUTo.exe
  C:\Windows\System\mVtDUTo.exe
  2⤵
  - Executes dropped EXE
  PID:5012
- C:\Windows\System\aFPPGeD.exe
  C:\Windows\System\aFPPGeD.exe
  2⤵
  - Executes dropped EXE
  PID:4672
- C:\Windows\System\hezpiVc.exe
  C:\Windows\System\hezpiVc.exe
  2⤵
  - Executes dropped EXE
  PID:2808
- C:\Windows\System\GokwgwF.exe
  C:\Windows\System\GokwgwF.exe
  2⤵
  - Executes dropped EXE
  PID:440
- C:\Windows\System\cbPEXEc.exe
  C:\Windows\System\cbPEXEc.exe
  2⤵
  - Executes dropped EXE
  PID:4040
- C:\Windows\System\buOMHko.exe
  C:\Windows\System\buOMHko.exe
  2⤵
  - Executes dropped EXE
  PID:1664
- C:\Windows\System\sOwmfSB.exe
  C:\Windows\System\sOwmfSB.exe
  2⤵
  - Executes dropped EXE
  PID:3096
- C:\Windows\System\XwkQIIx.exe
  C:\Windows\System\XwkQIIx.exe
  2⤵
  - Executes dropped EXE
  PID:2716
- C:\Windows\System\eumnOGT.exe
  C:\Windows\System\eumnOGT.exe
  2⤵
  - Executes dropped EXE
  PID:3668
- C:\Windows\System\lqGmsmk.exe
  C:\Windows\System\lqGmsmk.exe
  2⤵
  - Executes dropped EXE
  PID:832
- C:\Windows\System\MtxsvMU.exe
  C:\Windows\System\MtxsvMU.exe
  2⤵
  - Executes dropped EXE
  PID:4412
- C:\Windows\System\esgQfOm.exe
  C:\Windows\System\esgQfOm.exe
  2⤵
  - Executes dropped EXE
  PID:1844
- C:\Windows\System\TYDBzmA.exe
  C:\Windows\System\TYDBzmA.exe
  2⤵
  - Executes dropped EXE
  PID:2608
- C:\Windows\System\oqPZwnE.exe
  C:\Windows\System\oqPZwnE.exe
  2⤵
  - Executes dropped EXE
  PID:4476
- C:\Windows\System\YkcAuBq.exe
  C:\Windows\System\YkcAuBq.exe
  2⤵
  - Executes dropped EXE
  PID:4724
- C:\Windows\System\YzBWGOM.exe
  C:\Windows\System\YzBWGOM.exe
  2⤵
  - Executes dropped EXE
  PID:3636
- C:\Windows\System\OKWRVuo.exe
  C:\Windows\System\OKWRVuo.exe
  2⤵
  - Executes dropped EXE
  PID:912
- C:\Windows\System\prkwSSS.exe
  C:\Windows\System\prkwSSS.exe
  2⤵
  - Executes dropped EXE
  PID:4184
- C:\Windows\System\SsyyMfK.exe
  C:\Windows\System\SsyyMfK.exe
  2⤵
  - Executes dropped EXE
  PID:1420
- C:\Windows\System\uuWblHQ.exe
  C:\Windows\System\uuWblHQ.exe
  2⤵
  - Executes dropped EXE
  PID:64
- C:\Windows\System\gfgXbVs.exe
  C:\Windows\System\gfgXbVs.exe
  2⤵
  - Executes dropped EXE
  PID:976
- C:\Windows\System\vuNlizO.exe
  C:\Windows\System\vuNlizO.exe
  2⤵
  - Executes dropped EXE
  PID:2568
- C:\Windows\System\LuWWuNw.exe
  C:\Windows\System\LuWWuNw.exe
  2⤵
  - Executes dropped EXE
  PID:3956
- C:\Windows\System\bhjWEmh.exe
  C:\Windows\System\bhjWEmh.exe
  2⤵
  - Executes dropped EXE
  PID:2100
- C:\Windows\System\pdHEAiW.exe
  C:\Windows\System\pdHEAiW.exe
  2⤵
  - Executes dropped EXE
  PID:2644
- C:\Windows\System\xkdLOpS.exe
  C:\Windows\System\xkdLOpS.exe
  2⤵
  - Executes dropped EXE
  PID:1196
- C:\Windows\System\nTuNObh.exe
  C:\Windows\System\nTuNObh.exe
  2⤵
  - Executes dropped EXE
  PID:808
- C:\Windows\System\Swbwvmz.exe
  C:\Windows\System\Swbwvmz.exe
  2⤵
  - Executes dropped EXE
  PID:4836
- C:\Windows\System\XnxTIku.exe
  C:\Windows\System\XnxTIku.exe
  2⤵
  - Executes dropped EXE
  PID:1696
- C:\Windows\System\iMmkOmZ.exe
  C:\Windows\System\iMmkOmZ.exe
  2⤵
  - Executes dropped EXE
  PID:1508
- C:\Windows\System\teZxMwe.exe
  C:\Windows\System\teZxMwe.exe
  2⤵
  - Executes dropped EXE
  PID:1432
- C:\Windows\System\PgAZcGc.exe
  C:\Windows\System\PgAZcGc.exe
  2⤵
  - Executes dropped EXE
  PID:3672
- C:\Windows\System\kTLGqyc.exe
  C:\Windows\System\kTLGqyc.exe
  2⤵
  - Executes dropped EXE
  PID:1736
- C:\Windows\System\HVnGxqi.exe
  C:\Windows\System\HVnGxqi.exe
  2⤵
  - Executes dropped EXE
  PID:4936
- C:\Windows\System\izVDySK.exe
  C:\Windows\System\izVDySK.exe
  2⤵
  - Executes dropped EXE
  PID:812
- C:\Windows\System\UHyfSwF.exe
  C:\Windows\System\UHyfSwF.exe
  2⤵
  - Executes dropped EXE
  PID:1140
- C:\Windows\System\BWPMSGc.exe
  C:\Windows\System\BWPMSGc.exe
  2⤵
  - Executes dropped EXE
  PID:4448
- C:\Windows\System\RnpFQLs.exe
  C:\Windows\System\RnpFQLs.exe
  2⤵
  - Executes dropped EXE
  PID:2136
- C:\Windows\System\ITnhunY.exe
  C:\Windows\System\ITnhunY.exe
  2⤵
  - Executes dropped EXE
  PID:4400
- C:\Windows\System\KRkBEIW.exe
  C:\Windows\System\KRkBEIW.exe
  2⤵
  - Executes dropped EXE
  PID:1216
- C:\Windows\System\xIBYKta.exe
  C:\Windows\System\xIBYKta.exe
  2⤵
  - Executes dropped EXE
  PID:4284
- C:\Windows\System\xMBnaFY.exe
  C:\Windows\System\xMBnaFY.exe
  2⤵
  - Executes dropped EXE
  PID:3124
- C:\Windows\System\Bhalxjt.exe
  C:\Windows\System\Bhalxjt.exe
  2⤵
  - Executes dropped EXE
  PID:744
- C:\Windows\System\vyRuMuI.exe
  C:\Windows\System\vyRuMuI.exe
  2⤵
  - Executes dropped EXE
  PID:4920
- C:\Windows\System\PevRIBz.exe
  C:\Windows\System\PevRIBz.exe
  2⤵
  - Executes dropped EXE
  PID:2320
- C:\Windows\System\HICydck.exe
  C:\Windows\System\HICydck.exe
  2⤵
  - Executes dropped EXE
  PID:2132
- C:\Windows\System\xupQQIW.exe
  C:\Windows\System\xupQQIW.exe
  2⤵
  - Executes dropped EXE
  PID:312
- C:\Windows\System\hbzVTIj.exe
  C:\Windows\System\hbzVTIj.exe
  2⤵
  PID:264
- C:\Windows\System\ySfkyYH.exe
  C:\Windows\System\ySfkyYH.exe
  2⤵
  PID:3952
- C:\Windows\System\TjJOMMD.exe
  C:\Windows\System\TjJOMMD.exe
  2⤵
  PID:4544
- C:\Windows\System\raJpFmZ.exe
  C:\Windows\System\raJpFmZ.exe
  2⤵
  PID:3740
- C:\Windows\System\YKUdpGd.exe
  C:\Windows\System\YKUdpGd.exe
  2⤵
  PID:2712
- C:\Windows\System\tCtDIoa.exe
  C:\Windows\System\tCtDIoa.exe
  2⤵
  PID:3068
- C:\Windows\System\GabgpVW.exe
  C:\Windows\System\GabgpVW.exe
  2⤵
  PID:1592
- C:\Windows\System\XPFkHLI.exe
  C:\Windows\System\XPFkHLI.exe
  2⤵
  PID:1132
- C:\Windows\System\TQCunCu.exe
  C:\Windows\System\TQCunCu.exe
  2⤵
  PID:3984
- C:\Windows\System\rneLVDg.exe
  C:\Windows\System\rneLVDg.exe
  2⤵
  PID:448
- C:\Windows\System\ZIVQbjM.exe
  C:\Windows\System\ZIVQbjM.exe
  2⤵
  PID:3896
- C:\Windows\System\iUEzVFD.exe
  C:\Windows\System\iUEzVFD.exe
  2⤵
  PID:4020
- C:\Windows\System\UYKyxNI.exe
  C:\Windows\System\UYKyxNI.exe
  2⤵
  PID:708
- C:\Windows\System\shlYNFj.exe
  C:\Windows\System\shlYNFj.exe
  2⤵
  PID:3352
- C:\Windows\System\IMucbXB.exe
  C:\Windows\System\IMucbXB.exe
  2⤵
  PID:3396
- C:\Windows\System\cLdqNfU.exe
  C:\Windows\System\cLdqNfU.exe
  2⤵
  PID:4700
- C:\Windows\System\BJtpxfL.exe
  C:\Windows\System\BJtpxfL.exe
  2⤵
  PID:4660
- C:\Windows\System\vakyBcW.exe
  C:\Windows\System\vakyBcW.exe
  2⤵
  PID:4296
- C:\Windows\System\iFBzFJg.exe
  C:\Windows\System\iFBzFJg.exe
  2⤵
  PID:4984
- C:\Windows\System\YHxtXVi.exe
  C:\Windows\System\YHxtXVi.exe
  2⤵
  PID:4392
- C:\Windows\System\jZFeJqQ.exe
  C:\Windows\System\jZFeJqQ.exe
  2⤵
  PID:4388
- C:\Windows\System\HrkCaUS.exe
  C:\Windows\System\HrkCaUS.exe
  2⤵
  PID:2068
- C:\Windows\System\DdCOtVy.exe
  C:\Windows\System\DdCOtVy.exe
  2⤵
  PID:1712
- C:\Windows\System\krbLRiA.exe
  C:\Windows\System\krbLRiA.exe
  2⤵
  PID:4200
- C:\Windows\System\zwPRrBL.exe
  C:\Windows\System\zwPRrBL.exe
  2⤵
  PID:1072
- C:\Windows\System\KjvzlIg.exe
  C:\Windows\System\KjvzlIg.exe
  2⤵
  PID:5136
- C:\Windows\System\IhhYhBH.exe
  C:\Windows\System\IhhYhBH.exe
  2⤵
  PID:5160
- C:\Windows\System\FbAjzez.exe
  C:\Windows\System\FbAjzez.exe
  2⤵
  PID:5188
- C:\Windows\System\IAglmFI.exe
  C:\Windows\System\IAglmFI.exe
  2⤵
  PID:5212
- C:\Windows\System\kbpXGlS.exe
  C:\Windows\System\kbpXGlS.exe
  2⤵
  PID:5248
- C:\Windows\System\SplMxYM.exe
  C:\Windows\System\SplMxYM.exe
  2⤵
  PID:5272
- C:\Windows\System\gpGRjiR.exe
  C:\Windows\System\gpGRjiR.exe
  2⤵
  PID:5304
- C:\Windows\System\pDYpgdC.exe
  C:\Windows\System\pDYpgdC.exe
  2⤵
  PID:5332
- C:\Windows\System\JZElUDS.exe
  C:\Windows\System\JZElUDS.exe
  2⤵
  PID:5356
- C:\Windows\System\FfzriLQ.exe
  C:\Windows\System\FfzriLQ.exe
  2⤵
  PID:5388
- C:\Windows\System\hLYPpnZ.exe
  C:\Windows\System\hLYPpnZ.exe
  2⤵
  PID:5412
- C:\Windows\System\FXJpDoa.exe
  C:\Windows\System\FXJpDoa.exe
  2⤵
  PID:5444
- C:\Windows\System\derIdzk.exe
  C:\Windows\System\derIdzk.exe
  2⤵
  PID:5468
- C:\Windows\System\iiMPieB.exe
  C:\Windows\System\iiMPieB.exe
  2⤵
  PID:5500
- C:\Windows\System\loHGeEH.exe
  C:\Windows\System\loHGeEH.exe
  2⤵
  PID:5524
- C:\Windows\System\OVFfnyT.exe
  C:\Windows\System\OVFfnyT.exe
  2⤵
  PID:5556
- C:\Windows\System\pNVCDac.exe
  C:\Windows\System\pNVCDac.exe
  2⤵
  PID:5580
- C:\Windows\System\klxDCFK.exe
  C:\Windows\System\klxDCFK.exe
  2⤵
  PID:5608
- C:\Windows\System\GZFAaIs.exe
  C:\Windows\System\GZFAaIs.exe
  2⤵
  PID:5632
- C:\Windows\System\OVuvJFF.exe
  C:\Windows\System\OVuvJFF.exe
  2⤵
  PID:5668
- C:\Windows\System\ShbeOCJ.exe
  C:\Windows\System\ShbeOCJ.exe
  2⤵
  PID:5692
- C:\Windows\System\imTOagV.exe
  C:\Windows\System\imTOagV.exe
  2⤵
  PID:5724
- C:\Windows\System\vvlDCvs.exe
  C:\Windows\System\vvlDCvs.exe
  2⤵
  PID:5752
- C:\Windows\System\vJINqIg.exe
  C:\Windows\System\vJINqIg.exe
  2⤵
  PID:5780
- C:\Windows\System\TpLLids.exe
  C:\Windows\System\TpLLids.exe
  2⤵
  PID:5804
- C:\Windows\System\mOdwjTh.exe
  C:\Windows\System\mOdwjTh.exe
  2⤵
  PID:5836
- C:\Windows\System\rNKoBUE.exe
  C:\Windows\System\rNKoBUE.exe
  2⤵
  PID:5860
- C:\Windows\System\SyydseE.exe
  C:\Windows\System\SyydseE.exe
  2⤵
  PID:5892
- C:\Windows\System\aKPTwve.exe
  C:\Windows\System\aKPTwve.exe
  2⤵
  PID:5916
- C:\Windows\System\ldPxyCp.exe
  C:\Windows\System\ldPxyCp.exe
  2⤵
  PID:5948
- C:\Windows\System\mxicTBp.exe
  C:\Windows\System\mxicTBp.exe
  2⤵
  PID:5972
- C:\Windows\System\uLAFIkP.exe
  C:\Windows\System\uLAFIkP.exe
  2⤵
  PID:6000
- C:\Windows\System\ugpzqgf.exe
  C:\Windows\System\ugpzqgf.exe
  2⤵
  PID:6024
- C:\Windows\System\UBDpsjP.exe
  C:\Windows\System\UBDpsjP.exe
  2⤵
  PID:6060
- C:\Windows\System\omuDCxT.exe
  C:\Windows\System\omuDCxT.exe
  2⤵
  PID:6084
- C:\Windows\System\XrxdyPQ.exe
  C:\Windows\System\XrxdyPQ.exe
  2⤵
  PID:6116
- C:\Windows\System\uraVDLt.exe
  C:\Windows\System\uraVDLt.exe
  2⤵
  PID:876
- C:\Windows\System\vLsSUWd.exe
  C:\Windows\System\vLsSUWd.exe
  2⤵
  PID:3380
- C:\Windows\System\GSehGgR.exe
  C:\Windows\System\GSehGgR.exe
  2⤵
  PID:3708
- C:\Windows\System\rLGVfgu.exe
  C:\Windows\System\rLGVfgu.exe
  2⤵
  PID:1484
- C:\Windows\System\PSKiVLv.exe
  C:\Windows\System\PSKiVLv.exe
  2⤵
  PID:1960
- C:\Windows\System\OgZXDXT.exe
  C:\Windows\System\OgZXDXT.exe
  2⤵
  PID:872
- C:\Windows\System\XIveIbE.exe
  C:\Windows\System\XIveIbE.exe
  2⤵
  PID:1532
- C:\Windows\System\beaDIrb.exe
  C:\Windows\System\beaDIrb.exe
  2⤵
  PID:3936
- C:\Windows\System\wmlNBDP.exe
  C:\Windows\System\wmlNBDP.exe
  2⤵
  PID:5116
- C:\Windows\System\EYkVmDP.exe
  C:\Windows\System\EYkVmDP.exe
  2⤵
  PID:5200
- C:\Windows\System\rfzgvRp.exe
  C:\Windows\System\rfzgvRp.exe
  2⤵
  PID:5236
- C:\Windows\System\NiaKOdX.exe
  C:\Windows\System\NiaKOdX.exe
  2⤵
  PID:5312
- C:\Windows\System\HaixlTa.exe
  C:\Windows\System\HaixlTa.exe
  2⤵
  PID:5372
- C:\Windows\System\EEoocTw.exe
  C:\Windows\System\EEoocTw.exe
  2⤵
  PID:5428
- C:\Windows\System\gRBNNYF.exe
  C:\Windows\System\gRBNNYF.exe
  2⤵
  PID:5508
- C:\Windows\System\qqOnaaU.exe
  C:\Windows\System\qqOnaaU.exe
  2⤵
  PID:5572
- C:\Windows\System\WKRBfvF.exe
  C:\Windows\System\WKRBfvF.exe
  2⤵
  PID:5620
- C:\Windows\System\MGyHFGW.exe
  C:\Windows\System\MGyHFGW.exe
  2⤵
  PID:5684
- C:\Windows\System\SAokFaG.exe
  C:\Windows\System\SAokFaG.exe
  2⤵
  PID:5744
- C:\Windows\System\qWVGNmc.exe
  C:\Windows\System\qWVGNmc.exe
  2⤵
  PID:5800
- C:\Windows\System\gpMgxtN.exe
  C:\Windows\System\gpMgxtN.exe
  2⤵
  PID:5876
- C:\Windows\System\HwEqfIN.exe
  C:\Windows\System\HwEqfIN.exe
  2⤵
  PID:5928
- C:\Windows\System\mtlCBTI.exe
  C:\Windows\System\mtlCBTI.exe
  2⤵
  PID:5984
- C:\Windows\System\RTvzAVa.exe
  C:\Windows\System\RTvzAVa.exe
  2⤵
  PID:6040
- C:\Windows\System\ybYRTqt.exe
  C:\Windows\System\ybYRTqt.exe
  2⤵
  PID:1740
- C:\Windows\System\ahhRPba.exe
  C:\Windows\System\ahhRPba.exe
  2⤵
  PID:2624
- C:\Windows\System\UCOotNz.exe
  C:\Windows\System\UCOotNz.exe
  2⤵
  PID:4436
- C:\Windows\System\ygFjHdm.exe
  C:\Windows\System\ygFjHdm.exe
  2⤵
  PID:4844
- C:\Windows\System\UziBCTx.exe
  C:\Windows\System\UziBCTx.exe
  2⤵
  PID:1732
- C:\Windows\System\spKFwXa.exe
  C:\Windows\System\spKFwXa.exe
  2⤵
  PID:5172
- C:\Windows\System\YdCTtuw.exe
  C:\Windows\System\YdCTtuw.exe
  2⤵
  PID:848
- C:\Windows\System\aGxykcG.exe
  C:\Windows\System\aGxykcG.exe
  2⤵
  PID:5408
- C:\Windows\System\bmiPNfL.exe
  C:\Windows\System\bmiPNfL.exe
  2⤵
  PID:5596
- C:\Windows\System\ucSgnOn.exe
  C:\Windows\System\ucSgnOn.exe
  2⤵
  PID:5768
- C:\Windows\System\KFuavHo.exe
  C:\Windows\System\KFuavHo.exe
  2⤵
  PID:5844
- C:\Windows\System\wHbxiqL.exe
  C:\Windows\System\wHbxiqL.exe
  2⤵
  PID:3496
- C:\Windows\System\thgpuMw.exe
  C:\Windows\System\thgpuMw.exe
  2⤵
  PID:6016
- C:\Windows\System\itrighL.exe
  C:\Windows\System\itrighL.exe
  2⤵
  PID:6080
- C:\Windows\System\raiiDNp.exe
  C:\Windows\System\raiiDNp.exe
  2⤵
  PID:3192
- C:\Windows\System\QeOfMmD.exe
  C:\Windows\System\QeOfMmD.exe
  2⤵
  PID:2288
- C:\Windows\System\JpOCneX.exe
  C:\Windows\System\JpOCneX.exe
  2⤵
  PID:3060
- C:\Windows\System\PVzWcSx.exe
  C:\Windows\System\PVzWcSx.exe
  2⤵
  PID:5324
- C:\Windows\System\vtSIRkG.exe
  C:\Windows\System\vtSIRkG.exe
  2⤵
  PID:3504
- C:\Windows\System\bRcqmYf.exe
  C:\Windows\System\bRcqmYf.exe
  2⤵
  PID:1624
- C:\Windows\System\azFkUaC.exe
  C:\Windows\System\azFkUaC.exe
  2⤵
  PID:1984
- C:\Windows\System\HovXtEy.exe
  C:\Windows\System\HovXtEy.exe
  2⤵
  PID:2188
- C:\Windows\System\MvIVWbN.exe
  C:\Windows\System\MvIVWbN.exe
  2⤵
  PID:516
- C:\Windows\System\ylXJCYf.exe
  C:\Windows\System\ylXJCYf.exe
  2⤵
  PID:1560
- C:\Windows\System\HkgVFWC.exe
  C:\Windows\System\HkgVFWC.exe
  2⤵
  PID:4384
- C:\Windows\System\cMzuyEC.exe
  C:\Windows\System\cMzuyEC.exe
  2⤵
  PID:3100
- C:\Windows\System\xHgVYTi.exe
  C:\Windows\System\xHgVYTi.exe
  2⤵
  PID:2392
- C:\Windows\System\iRPixMq.exe
  C:\Windows\System\iRPixMq.exe
  2⤵
  PID:2508
- C:\Windows\System\ndEaRgA.exe
  C:\Windows\System\ndEaRgA.exe
  2⤵
  PID:316
- C:\Windows\System\FSxUEgX.exe
  C:\Windows\System\FSxUEgX.exe
  2⤵
  PID:720
- C:\Windows\System\SaWSlfn.exe
  C:\Windows\System\SaWSlfn.exe
  2⤵
  PID:5956
- C:\Windows\System\kgnKNNu.exe
  C:\Windows\System\kgnKNNu.exe
  2⤵
  PID:6156
- C:\Windows\System\eXzaryq.exe
  C:\Windows\System\eXzaryq.exe
  2⤵
  PID:6184
- C:\Windows\System\DGEucTw.exe
  C:\Windows\System\DGEucTw.exe
  2⤵
  PID:6216
- C:\Windows\System\oBbOqOG.exe
  C:\Windows\System\oBbOqOG.exe
  2⤵
  PID:6248
- C:\Windows\System\ABwNxbN.exe
  C:\Windows\System\ABwNxbN.exe
  2⤵
  PID:6276
- C:\Windows\System\MjftJjP.exe
  C:\Windows\System\MjftJjP.exe
  2⤵
  PID:6300
- C:\Windows\System\hVLpxiC.exe
  C:\Windows\System\hVLpxiC.exe
  2⤵
  PID:6328
- C:\Windows\System\fyLlzMe.exe
  C:\Windows\System\fyLlzMe.exe
  2⤵
  PID:6352
- C:\Windows\System\HFrTcUX.exe
  C:\Windows\System\HFrTcUX.exe
  2⤵
  PID:6388
- C:\Windows\System\xzBrOAY.exe
  C:\Windows\System\xzBrOAY.exe
  2⤵
  PID:6416
- C:\Windows\System\AGVapKQ.exe
  C:\Windows\System\AGVapKQ.exe
  2⤵
  PID:6448
- C:\Windows\System\opxlPVk.exe
  C:\Windows\System\opxlPVk.exe
  2⤵
  PID:6464
- C:\Windows\System\LXIJgKv.exe
  C:\Windows\System\LXIJgKv.exe
  2⤵
  PID:6492
- C:\Windows\System\NPbjLCb.exe
  C:\Windows\System\NPbjLCb.exe
  2⤵
  PID:6516
- C:\Windows\System\xfSctbn.exe
  C:\Windows\System\xfSctbn.exe
  2⤵
  PID:6540
- C:\Windows\System\ufdOphF.exe
  C:\Windows\System\ufdOphF.exe
  2⤵
  PID:6564
- C:\Windows\System\GsGdSxI.exe
  C:\Windows\System\GsGdSxI.exe
  2⤵
  PID:6608
- C:\Windows\System\pxvMFoC.exe
  C:\Windows\System\pxvMFoC.exe
  2⤵
  PID:6632
- C:\Windows\System\JiRDbbC.exe
  C:\Windows\System\JiRDbbC.exe
  2⤵
  PID:6656
- C:\Windows\System\UgbMkKe.exe
  C:\Windows\System\UgbMkKe.exe
  2⤵
  PID:6704
- C:\Windows\System\mNKvGnl.exe
  C:\Windows\System\mNKvGnl.exe
  2⤵
  PID:6728
- C:\Windows\System\QDQanTw.exe
  C:\Windows\System\QDQanTw.exe
  2⤵
  PID:6748
- C:\Windows\System\sKtclWM.exe
  C:\Windows\System\sKtclWM.exe
  2⤵
  PID:6780
- C:\Windows\System\BNRwByl.exe
  C:\Windows\System\BNRwByl.exe
  2⤵
  PID:6840
- C:\Windows\System\ZKwOWvP.exe
  C:\Windows\System\ZKwOWvP.exe
  2⤵
  PID:6856
- C:\Windows\System\nXUPymp.exe
  C:\Windows\System\nXUPymp.exe
  2⤵
  PID:6884
- C:\Windows\System\YcivXPR.exe
  C:\Windows\System\YcivXPR.exe
  2⤵
  PID:6912
- C:\Windows\System\VCtJfuY.exe
  C:\Windows\System\VCtJfuY.exe
  2⤵
  PID:6928
- C:\Windows\System\CfgoOfq.exe
  C:\Windows\System\CfgoOfq.exe
  2⤵
  PID:6956
- C:\Windows\System\Dealfqq.exe
  C:\Windows\System\Dealfqq.exe
  2⤵
  PID:6972
- C:\Windows\System\sIRgfkV.exe
  C:\Windows\System\sIRgfkV.exe
  2⤵
  PID:7000
- C:\Windows\System\nuGALnZ.exe
  C:\Windows\System\nuGALnZ.exe
  2⤵
  PID:7020
- C:\Windows\System\rYIQioI.exe
  C:\Windows\System\rYIQioI.exe
  2⤵
  PID:7056
- C:\Windows\System\DschEWV.exe
  C:\Windows\System\DschEWV.exe
  2⤵
  PID:7076
- C:\Windows\System\AxAVVjH.exe
  C:\Windows\System\AxAVVjH.exe
  2⤵
  PID:7112
- C:\Windows\System\oXfPHhJ.exe
  C:\Windows\System\oXfPHhJ.exe
  2⤵
  PID:7164
- C:\Windows\System\TJrWovT.exe
  C:\Windows\System\TJrWovT.exe
  2⤵
  PID:6224
- C:\Windows\System\eMLbyuF.exe
  C:\Windows\System\eMLbyuF.exe
  2⤵
  PID:6236
- C:\Windows\System\FgJFeWM.exe
  C:\Windows\System\FgJFeWM.exe
  2⤵
  PID:6336
- C:\Windows\System\ZIYROhK.exe
  C:\Windows\System\ZIYROhK.exe
  2⤵
  PID:6372
- C:\Windows\System\dmwFlPT.exe
  C:\Windows\System\dmwFlPT.exe
  2⤵
  PID:6436
- C:\Windows\System\IQjzJHt.exe
  C:\Windows\System\IQjzJHt.exe
  2⤵
  PID:6456
- C:\Windows\System\FjLBJXy.exe
  C:\Windows\System\FjLBJXy.exe
  2⤵
  PID:6524
- C:\Windows\System\cyvmRov.exe
  C:\Windows\System\cyvmRov.exe
  2⤵
  PID:6600
- C:\Windows\System\tLNyREZ.exe
  C:\Windows\System\tLNyREZ.exe
  2⤵
  PID:6628
- C:\Windows\System\FoaQLtq.exe
  C:\Windows\System\FoaQLtq.exe
  2⤵
  PID:6688
- C:\Windows\System\DFScBqx.exe
  C:\Windows\System\DFScBqx.exe
  2⤵
  PID:6716
- C:\Windows\System\fwHapdu.exe
  C:\Windows\System\fwHapdu.exe
  2⤵
  PID:6792
- C:\Windows\System\rvZMAEo.exe
  C:\Windows\System\rvZMAEo.exe
  2⤵
  PID:6876
- C:\Windows\System\QRJeTkj.exe
  C:\Windows\System\QRJeTkj.exe
  2⤵
  PID:6924
- C:\Windows\System\UBSSVxO.exe
  C:\Windows\System\UBSSVxO.exe
  2⤵
  PID:7028
- C:\Windows\System\mkzRyEg.exe
  C:\Windows\System\mkzRyEg.exe
  2⤵
  PID:6148
- C:\Windows\System\bZFdaJR.exe
  C:\Windows\System\bZFdaJR.exe
  2⤵
  PID:6312
- C:\Windows\System\PrBwsyb.exe
  C:\Windows\System\PrBwsyb.exe
  2⤵
  PID:6396
- C:\Windows\System\LpCGLgV.exe
  C:\Windows\System\LpCGLgV.exe
  2⤵
  PID:6560
- C:\Windows\System\oCmSTHM.exe
  C:\Windows\System\oCmSTHM.exe
  2⤵
  PID:6680
- C:\Windows\System\faRCZvY.exe
  C:\Windows\System\faRCZvY.exe
  2⤵
  PID:6828
- C:\Windows\System\vfJWIZN.exe
  C:\Windows\System\vfJWIZN.exe
  2⤵
  PID:6984
- C:\Windows\System\FCbTOXR.exe
  C:\Windows\System\FCbTOXR.exe
  2⤵
  PID:7140
- C:\Windows\System\hZjZIno.exe
  C:\Windows\System\hZjZIno.exe
  2⤵
  PID:6460
- C:\Windows\System\fKLEYWF.exe
  C:\Windows\System\fKLEYWF.exe
  2⤵
  PID:6736
- C:\Windows\System\PXTdKrM.exe
  C:\Windows\System\PXTdKrM.exe
  2⤵
  PID:7136
- C:\Windows\System\ITPEMiN.exe
  C:\Windows\System\ITPEMiN.exe
  2⤵
  PID:7084
- C:\Windows\System\wsjxSAI.exe
  C:\Windows\System\wsjxSAI.exe
  2⤵
  PID:6368
- C:\Windows\System\jwilwoc.exe
  C:\Windows\System\jwilwoc.exe
  2⤵
  PID:6904
- C:\Windows\System\gjHbSvn.exe
  C:\Windows\System\gjHbSvn.exe
  2⤵
  PID:7188
- C:\Windows\System\EAIZTXA.exe
  C:\Windows\System\EAIZTXA.exe
  2⤵
  PID:7212
- C:\Windows\System\TUxLUsi.exe
  C:\Windows\System\TUxLUsi.exe
  2⤵
  PID:7244
- C:\Windows\System\UXAbCwh.exe
  C:\Windows\System\UXAbCwh.exe
  2⤵
  PID:7296
- C:\Windows\System\ibyrqCg.exe
  C:\Windows\System\ibyrqCg.exe
  2⤵
  PID:7316
- C:\Windows\System\euYBYEk.exe
  C:\Windows\System\euYBYEk.exe
  2⤵
  PID:7340
- C:\Windows\System\gvbJFhz.exe
  C:\Windows\System\gvbJFhz.exe
  2⤵
  PID:7364
- C:\Windows\System\ouTsvdj.exe
  C:\Windows\System\ouTsvdj.exe
  2⤵
  PID:7392
- C:\Windows\System\pIUOCTF.exe
  C:\Windows\System\pIUOCTF.exe
  2⤵
  PID:7416
- C:\Windows\System\ZNusFYx.exe
  C:\Windows\System\ZNusFYx.exe
  2⤵
  PID:7492
- C:\Windows\System\exFsGui.exe
  C:\Windows\System\exFsGui.exe
  2⤵
  PID:7540
- C:\Windows\System\mjzrKaC.exe
  C:\Windows\System\mjzrKaC.exe
  2⤵
  PID:7564
- C:\Windows\System\oPNsDhS.exe
  C:\Windows\System\oPNsDhS.exe
  2⤵
  PID:7588
- C:\Windows\System\JMtrRuv.exe
  C:\Windows\System\JMtrRuv.exe
  2⤵
  PID:7608
- C:\Windows\System\DiuOdqA.exe
  C:\Windows\System\DiuOdqA.exe
  2⤵
  PID:7636
- C:\Windows\System\SYHVHHp.exe
  C:\Windows\System\SYHVHHp.exe
  2⤵
  PID:7664
- C:\Windows\System\pdegbLz.exe
  C:\Windows\System\pdegbLz.exe
  2⤵
  PID:7688
- C:\Windows\System\QYCtGte.exe
  C:\Windows\System\QYCtGte.exe
  2⤵
  PID:7716
- C:\Windows\System\lsJfpkO.exe
  C:\Windows\System\lsJfpkO.exe
  2⤵
  PID:7740
- C:\Windows\System\prhpqqK.exe
  C:\Windows\System\prhpqqK.exe
  2⤵
  PID:7768
- C:\Windows\System\SuseVrt.exe
  C:\Windows\System\SuseVrt.exe
  2⤵
  PID:7800
- C:\Windows\System\QqeqQKH.exe
  C:\Windows\System\QqeqQKH.exe
  2⤵
  PID:7852
- C:\Windows\System\tOVcXGi.exe
  C:\Windows\System\tOVcXGi.exe
  2⤵
  PID:7868
- C:\Windows\System\VFrpgci.exe
  C:\Windows\System\VFrpgci.exe
  2⤵
  PID:7896
- C:\Windows\System\fgenCXq.exe
  C:\Windows\System\fgenCXq.exe
  2⤵
  PID:7920
- C:\Windows\System\uWWcWjl.exe
  C:\Windows\System\uWWcWjl.exe
  2⤵
  PID:7940
- C:\Windows\System\MYbJIGN.exe
  C:\Windows\System\MYbJIGN.exe
  2⤵
  PID:7980
- C:\Windows\System\sMLHkqe.exe
  C:\Windows\System\sMLHkqe.exe
  2⤵
  PID:7996
- C:\Windows\System\xFehPII.exe
  C:\Windows\System\xFehPII.exe
  2⤵
  PID:8024
- C:\Windows\System\uDrpynt.exe
  C:\Windows\System\uDrpynt.exe
  2⤵
  PID:8040
- C:\Windows\System\egyoaaL.exe
  C:\Windows\System\egyoaaL.exe
  2⤵
  PID:8064
- C:\Windows\System\LfFfCqi.exe
  C:\Windows\System\LfFfCqi.exe
  2⤵
  PID:8124
- C:\Windows\System\yNTjSlf.exe
  C:\Windows\System\yNTjSlf.exe
  2⤵
  PID:8140
- C:\Windows\System\YdOGleS.exe
  C:\Windows\System\YdOGleS.exe
  2⤵
  PID:8160
- C:\Windows\System\anuawhr.exe
  C:\Windows\System\anuawhr.exe
  2⤵
  PID:7204
- C:\Windows\System\LhcTGzK.exe
  C:\Windows\System\LhcTGzK.exe
  2⤵
  PID:7292
- C:\Windows\System\UENolti.exe
  C:\Windows\System\UENolti.exe
  2⤵
  PID:7220
- C:\Windows\System\WMRhrRK.exe
  C:\Windows\System\WMRhrRK.exe
  2⤵
  PID:7336
- C:\Windows\System\SSSLxhu.exe
  C:\Windows\System\SSSLxhu.exe
  2⤵
  PID:7468
- C:\Windows\System\RrRbcCZ.exe
  C:\Windows\System\RrRbcCZ.exe
  2⤵
  PID:7528
- C:\Windows\System\kLkReNo.exe
  C:\Windows\System\kLkReNo.exe
  2⤵
  PID:7572
- C:\Windows\System\vLYIxyk.exe
  C:\Windows\System\vLYIxyk.exe
  2⤵
  PID:7624
- C:\Windows\System\jKWBqBx.exe
  C:\Windows\System\jKWBqBx.exe
  2⤵
  PID:7700
- C:\Windows\System\xrIgBVs.exe
  C:\Windows\System\xrIgBVs.exe
  2⤵
  PID:7736
- C:\Windows\System\qdhKyvr.exe
  C:\Windows\System\qdhKyvr.exe
  2⤵
  PID:7860
- C:\Windows\System\ZfqJhID.exe
  C:\Windows\System\ZfqJhID.exe
  2⤵
  PID:7952
- C:\Windows\System\qTYOpvq.exe
  C:\Windows\System\qTYOpvq.exe
  2⤵
  PID:7972
- C:\Windows\System\cnVwqmd.exe
  C:\Windows\System\cnVwqmd.exe
  2⤵
  PID:8036
- C:\Windows\System\NZnKbYc.exe
  C:\Windows\System\NZnKbYc.exe
  2⤵
  PID:8096
- C:\Windows\System\nJlQsuO.exe
  C:\Windows\System\nJlQsuO.exe
  2⤵
  PID:8156
- C:\Windows\System\JhtCCvW.exe
  C:\Windows\System\JhtCCvW.exe
  2⤵
  PID:7172
- C:\Windows\System\mSCmzvQ.exe
  C:\Windows\System\mSCmzvQ.exe
  2⤵
  PID:7308
- C:\Windows\System\chsoOqA.exe
  C:\Windows\System\chsoOqA.exe
  2⤵
  PID:7404
- C:\Windows\System\rgnEnkc.exe
  C:\Windows\System\rgnEnkc.exe
  2⤵
  PID:7552
- C:\Windows\System\fALJoTA.exe
  C:\Windows\System\fALJoTA.exe
  2⤵
  PID:7848
- C:\Windows\System\NapKTap.exe
  C:\Windows\System\NapKTap.exe
  2⤵
  PID:8108
- C:\Windows\System\OWFYvxd.exe
  C:\Windows\System\OWFYvxd.exe
  2⤵
  PID:8152
- C:\Windows\System\kAfAsjS.exe
  C:\Windows\System\kAfAsjS.exe
  2⤵
  PID:7380
- C:\Windows\System\cZohiLN.exe
  C:\Windows\System\cZohiLN.exe
  2⤵
  PID:7844
- C:\Windows\System\zgKwcna.exe
  C:\Windows\System\zgKwcna.exe
  2⤵
  PID:7184
- C:\Windows\System\IjUPiLz.exe
  C:\Windows\System\IjUPiLz.exe
  2⤵
  PID:7484
- C:\Windows\System\JfmDCrD.exe
  C:\Windows\System\JfmDCrD.exe
  2⤵
  PID:8212
- C:\Windows\System\dqSFLwf.exe
  C:\Windows\System\dqSFLwf.exe
  2⤵
  PID:8260
- C:\Windows\System\KeGwqPa.exe
  C:\Windows\System\KeGwqPa.exe
  2⤵
  PID:8276
- C:\Windows\System\xIalKLa.exe
  C:\Windows\System\xIalKLa.exe
  2⤵
  PID:8300
- C:\Windows\System\MPhMrkK.exe
  C:\Windows\System\MPhMrkK.exe
  2⤵
  PID:8328
- C:\Windows\System\HhMsRuG.exe
  C:\Windows\System\HhMsRuG.exe
  2⤵
  PID:8352
- C:\Windows\System\sirewXO.exe
  C:\Windows\System\sirewXO.exe
  2⤵
  PID:8388
- C:\Windows\System\dSLfitf.exe
  C:\Windows\System\dSLfitf.exe
  2⤵
  PID:8404
- C:\Windows\System\jmEkyzK.exe
  C:\Windows\System\jmEkyzK.exe
  2⤵
  PID:8428
- C:\Windows\System\PzGCAZW.exe
  C:\Windows\System\PzGCAZW.exe
  2⤵
  PID:8480
- C:\Windows\System\mZtsqaJ.exe
  C:\Windows\System\mZtsqaJ.exe
  2⤵
  PID:8512
- C:\Windows\System\FZDXbUv.exe
  C:\Windows\System\FZDXbUv.exe
  2⤵
  PID:8532
- C:\Windows\System\cEOTXMH.exe
  C:\Windows\System\cEOTXMH.exe
  2⤵
  PID:8560
- C:\Windows\System\RwenQHU.exe
  C:\Windows\System\RwenQHU.exe
  2⤵
  PID:8584
- C:\Windows\System\nvgyIoX.exe
  C:\Windows\System\nvgyIoX.exe
  2⤵
  PID:8632
- C:\Windows\System\nZJHBtN.exe
  C:\Windows\System\nZJHBtN.exe
  2⤵
  PID:8652
- C:\Windows\System\FQOdQCj.exe
  C:\Windows\System\FQOdQCj.exe
  2⤵
  PID:8672
- C:\Windows\System\EZqnnqY.exe
  C:\Windows\System\EZqnnqY.exe
  2⤵
  PID:8696
- C:\Windows\System\jvadTVW.exe
  C:\Windows\System\jvadTVW.exe
  2⤵
  PID:8728
- C:\Windows\System\zZwJZoa.exe
  C:\Windows\System\zZwJZoa.exe
  2⤵
  PID:8748
- C:\Windows\System\CWGZYNJ.exe
  C:\Windows\System\CWGZYNJ.exe
  2⤵
  PID:8780
- C:\Windows\System\bnclASF.exe
  C:\Windows\System\bnclASF.exe
  2⤵
  PID:8800
- C:\Windows\System\PNwobwb.exe
  C:\Windows\System\PNwobwb.exe
  2⤵
  PID:8828
- C:\Windows\System\AEZqQjm.exe
  C:\Windows\System\AEZqQjm.exe
  2⤵
  PID:8856
- C:\Windows\System\YAqcJiJ.exe
  C:\Windows\System\YAqcJiJ.exe
  2⤵
  PID:8884
- C:\Windows\System\zmARAsR.exe
  C:\Windows\System\zmARAsR.exe
  2⤵
  PID:8908
- C:\Windows\System\ZVszdRV.exe
  C:\Windows\System\ZVszdRV.exe
  2⤵
  PID:8928
- C:\Windows\System\ZZhfBPp.exe
  C:\Windows\System\ZZhfBPp.exe
  2⤵
  PID:8944
- C:\Windows\System\TUCTqFO.exe
  C:\Windows\System\TUCTqFO.exe
  2⤵
  PID:8984
- C:\Windows\System\gfvUsHG.exe
  C:\Windows\System\gfvUsHG.exe
  2⤵
  PID:9008
- C:\Windows\System\epqXiEU.exe
  C:\Windows\System\epqXiEU.exe
  2⤵
  PID:9044
- C:\Windows\System\JeItbpl.exe
  C:\Windows\System\JeItbpl.exe
  2⤵
  PID:9072
- C:\Windows\System\JsPxUXg.exe
  C:\Windows\System\JsPxUXg.exe
  2⤵
  PID:9116
- C:\Windows\System\QSpIRfa.exe
  C:\Windows\System\QSpIRfa.exe
  2⤵
  PID:9140
- C:\Windows\System\ygVlaZU.exe
  C:\Windows\System\ygVlaZU.exe
  2⤵
  PID:9160
- C:\Windows\System\pVeRohf.exe
  C:\Windows\System\pVeRohf.exe
  2⤵
  PID:9184
- C:\Windows\System\vxEEBWf.exe
  C:\Windows\System\vxEEBWf.exe
  2⤵
  PID:9212
- C:\Windows\System\sJjQMlx.exe
  C:\Windows\System\sJjQMlx.exe
  2⤵
  PID:8240
- C:\Windows\System\ettEQpq.exe
  C:\Windows\System\ettEQpq.exe
  2⤵
  PID:8292
- C:\Windows\System\zelgKZt.exe
  C:\Windows\System\zelgKZt.exe
  2⤵
  PID:8396
- C:\Windows\System\sfDbKsc.exe
  C:\Windows\System\sfDbKsc.exe
  2⤵
  PID:8452
- C:\Windows\System\pBjOjMn.exe
  C:\Windows\System\pBjOjMn.exe
  2⤵
  PID:8504
- C:\Windows\System\JAbJiRh.exe
  C:\Windows\System\JAbJiRh.exe
  2⤵
  PID:8568
- C:\Windows\System\zWMMLhq.exe
  C:\Windows\System\zWMMLhq.exe
  2⤵
  PID:8640
- C:\Windows\System\bKMrsAj.exe
  C:\Windows\System\bKMrsAj.exe
  2⤵
  PID:8740
- C:\Windows\System\eTGHVuP.exe
  C:\Windows\System\eTGHVuP.exe
  2⤵
  PID:8796
- C:\Windows\System\ozBkWUK.exe
  C:\Windows\System\ozBkWUK.exe
  2⤵
  PID:8844
- C:\Windows\System\fsKHIcA.exe
  C:\Windows\System\fsKHIcA.exe
  2⤵
  PID:8892
- C:\Windows\System\UnzpbhY.exe
  C:\Windows\System\UnzpbhY.exe
  2⤵
  PID:9000
- C:\Windows\System\ouJIUnv.exe
  C:\Windows\System\ouJIUnv.exe
  2⤵
  PID:9036
- C:\Windows\System\hUXkboG.exe
  C:\Windows\System\hUXkboG.exe
  2⤵
  PID:9068
- C:\Windows\System\lppAzqL.exe
  C:\Windows\System\lppAzqL.exe
  2⤵
  PID:9100
- C:\Windows\System\gqXePFb.exe
  C:\Windows\System\gqXePFb.exe
  2⤵
  PID:9180
- C:\Windows\System\xMlugXM.exe
  C:\Windows\System\xMlugXM.exe
  2⤵
  PID:8416
- C:\Windows\System\ziPrEAA.exe
  C:\Windows\System\ziPrEAA.exe
  2⤵
  PID:8496
- C:\Windows\System\jmEfTGF.exe
  C:\Windows\System\jmEfTGF.exe
  2⤵
  PID:8600
- C:\Windows\System\gytliwj.exe
  C:\Windows\System\gytliwj.exe
  2⤵
  PID:8668
- C:\Windows\System\BDwRnMC.exe
  C:\Windows\System\BDwRnMC.exe
  2⤵
  PID:8896
- C:\Windows\System\HbnyfZi.exe
  C:\Windows\System\HbnyfZi.exe
  2⤵
  PID:8972
- C:\Windows\System\IhtbwcW.exe
  C:\Windows\System\IhtbwcW.exe
  2⤵
  PID:9156
- C:\Windows\System\SLaHyet.exe
  C:\Windows\System\SLaHyet.exe
  2⤵
  PID:9172
- C:\Windows\System\xUDwPwq.exe
  C:\Windows\System\xUDwPwq.exe
  2⤵
  PID:9124
- C:\Windows\System\hZwMJeZ.exe
  C:\Windows\System\hZwMJeZ.exe
  2⤵
  PID:8816
- C:\Windows\System\iqSkxuC.exe
  C:\Windows\System\iqSkxuC.exe
  2⤵
  PID:9236
- C:\Windows\System\edborRk.exe
  C:\Windows\System\edborRk.exe
  2⤵
  PID:9256
- C:\Windows\System\kQqyFmo.exe
  C:\Windows\System\kQqyFmo.exe
  2⤵
  PID:9276
- C:\Windows\System\yewumaD.exe
  C:\Windows\System\yewumaD.exe
  2⤵
  PID:9308
- C:\Windows\System\pZVkDVX.exe
  C:\Windows\System\pZVkDVX.exe
  2⤵
  PID:9324
- C:\Windows\System\mpBtnIN.exe
  C:\Windows\System\mpBtnIN.exe
  2⤵
  PID:9344
- C:\Windows\System\nvSDEMh.exe
  C:\Windows\System\nvSDEMh.exe
  2⤵
  PID:9372
- C:\Windows\System\GImqOMV.exe
  C:\Windows\System\GImqOMV.exe
  2⤵
  PID:9404
- C:\Windows\System\IPmrxwH.exe
  C:\Windows\System\IPmrxwH.exe
  2⤵
  PID:9440
- C:\Windows\System\tMBqqKb.exe
  C:\Windows\System\tMBqqKb.exe
  2⤵
  PID:9464
- C:\Windows\System\eoJYnTW.exe
  C:\Windows\System\eoJYnTW.exe
  2⤵
  PID:9480
- C:\Windows\System\ViIfjgs.exe
  C:\Windows\System\ViIfjgs.exe
  2⤵
  PID:9520
- C:\Windows\System\THxoFrD.exe
  C:\Windows\System\THxoFrD.exe
  2⤵
  PID:9548
- C:\Windows\System\KoeDBuv.exe
  C:\Windows\System\KoeDBuv.exe
  2⤵
  PID:9572
- C:\Windows\System\xRWdZNa.exe
  C:\Windows\System\xRWdZNa.exe
  2⤵
  PID:9596
- C:\Windows\System\HXeaTQJ.exe
  C:\Windows\System\HXeaTQJ.exe
  2⤵
  PID:9648
- C:\Windows\System\TtbOTAA.exe
  C:\Windows\System\TtbOTAA.exe
  2⤵
  PID:9672
- C:\Windows\System\SBATaCG.exe
  C:\Windows\System\SBATaCG.exe
  2⤵
  PID:9712
- C:\Windows\System\eoDulPm.exe
  C:\Windows\System\eoDulPm.exe
  2⤵
  PID:9732
- C:\Windows\System\EIvcdXG.exe
  C:\Windows\System\EIvcdXG.exe
  2⤵
  PID:9768
- C:\Windows\System\FtuzQbq.exe
  C:\Windows\System\FtuzQbq.exe
  2⤵
  PID:9796
- C:\Windows\System\rACyEjc.exe
  C:\Windows\System\rACyEjc.exe
  2⤵
  PID:9816
- C:\Windows\System\JfdTCkh.exe
  C:\Windows\System\JfdTCkh.exe
  2⤵
  PID:9840
- C:\Windows\System\ksrQVzr.exe
  C:\Windows\System\ksrQVzr.exe
  2⤵
  PID:9856
- C:\Windows\System\OzFQDHa.exe
  C:\Windows\System\OzFQDHa.exe
  2⤵
  PID:9896
- C:\Windows\System\uVHdBeE.exe
  C:\Windows\System\uVHdBeE.exe
  2⤵
  PID:9920
- C:\Windows\System\IffADty.exe
  C:\Windows\System\IffADty.exe
  2⤵
  PID:9944
- C:\Windows\System\RgWfxLE.exe
  C:\Windows\System\RgWfxLE.exe
  2⤵
  PID:9972
- C:\Windows\System\KSDxqlt.exe
  C:\Windows\System\KSDxqlt.exe
  2⤵
  PID:10024
- C:\Windows\System\aPhWesB.exe
  C:\Windows\System\aPhWesB.exe
  2⤵
  PID:10040
- C:\Windows\System\BsJXrPj.exe
  C:\Windows\System\BsJXrPj.exe
  2⤵
  PID:10076
- C:\Windows\System\NjtwZcc.exe
  C:\Windows\System\NjtwZcc.exe
  2⤵
  PID:10096
- C:\Windows\System\tCrLVXJ.exe
  C:\Windows\System\tCrLVXJ.exe
  2⤵
  PID:10124
- C:\Windows\System\QLRUcbP.exe
  C:\Windows\System\QLRUcbP.exe
  2⤵
  PID:10164
- C:\Windows\System\xIVuyxn.exe
  C:\Windows\System\xIVuyxn.exe
  2⤵
  PID:10188
- C:\Windows\System\nDOXzVt.exe
  C:\Windows\System\nDOXzVt.exe
  2⤵
  PID:10208
- C:\Windows\System\tWZFLYd.exe
  C:\Windows\System\tWZFLYd.exe
  2⤵
  PID:10236
- C:\Windows\System\gNeThtJ.exe
  C:\Windows\System\gNeThtJ.exe
  2⤵
  PID:8552
- C:\Windows\System\SEVNPli.exe
  C:\Windows\System\SEVNPli.exe
  2⤵
  PID:9300
- C:\Windows\System\TSaDrhw.exe
  C:\Windows\System\TSaDrhw.exe
  2⤵
  PID:9352
- C:\Windows\System\bOOjqEJ.exe
  C:\Windows\System\bOOjqEJ.exe
  2⤵
  PID:9448
- C:\Windows\System\vEzVofh.exe
  C:\Windows\System\vEzVofh.exe
  2⤵
  PID:9456
- C:\Windows\System\uEAvbhr.exe
  C:\Windows\System\uEAvbhr.exe
  2⤵
  PID:9564
- C:\Windows\System\CefOWNK.exe
  C:\Windows\System\CefOWNK.exe
  2⤵
  PID:9684
- C:\Windows\System\xakUprE.exe
  C:\Windows\System\xakUprE.exe
  2⤵
  PID:9720
- C:\Windows\System\emUcBPk.exe
  C:\Windows\System\emUcBPk.exe
  2⤵
  PID:9784
- C:\Windows\System\SPIEDTo.exe
  C:\Windows\System\SPIEDTo.exe
  2⤵
  PID:9864
- C:\Windows\System\FfjojCU.exe
  C:\Windows\System\FfjojCU.exe
  2⤵
  PID:9916
- C:\Windows\System\GFEcNaB.exe
  C:\Windows\System\GFEcNaB.exe
  2⤵
  PID:10016
- C:\Windows\System\viusIHV.exe
  C:\Windows\System\viusIHV.exe
  2⤵
  PID:10092
- C:\Windows\System\UJlXBtF.exe
  C:\Windows\System\UJlXBtF.exe
  2⤵
  PID:10136
- C:\Windows\System\CAWeCaO.exe
  C:\Windows\System\CAWeCaO.exe
  2⤵
  PID:10196
- C:\Windows\System\zZTboiA.exe
  C:\Windows\System\zZTboiA.exe
  2⤵
  PID:10228
- C:\Windows\System\sCoKzDx.exe
  C:\Windows\System\sCoKzDx.exe
  2⤵
  PID:9360
- C:\Windows\System\ymjEdcl.exe
  C:\Windows\System\ymjEdcl.exe
  2⤵
  PID:9476
- C:\Windows\System\LfsWaqP.exe
  C:\Windows\System\LfsWaqP.exe
  2⤵
  PID:9636
- C:\Windows\System\ucuRTXB.exe
  C:\Windows\System\ucuRTXB.exe
  2⤵
  PID:9832
- C:\Windows\System\KNxiPEZ.exe
  C:\Windows\System\KNxiPEZ.exe
  2⤵
  PID:9824
- C:\Windows\System\hKtqZDK.exe
  C:\Windows\System\hKtqZDK.exe
  2⤵
  PID:10072
- C:\Windows\System\GjCMaRm.exe
  C:\Windows\System\GjCMaRm.exe
  2⤵
  PID:9428
- C:\Windows\System\kMxbRRS.exe
  C:\Windows\System\kMxbRRS.exe
  2⤵
  PID:9264
- C:\Windows\System\fNlzsnZ.exe
  C:\Windows\System\fNlzsnZ.exe
  2⤵
  PID:10012
- C:\Windows\System\uUYSLAW.exe
  C:\Windows\System\uUYSLAW.exe
  2⤵
  PID:10160
- C:\Windows\System\WSDWOWp.exe
  C:\Windows\System\WSDWOWp.exe
  2⤵
  PID:9892
- C:\Windows\System\YqWoGic.exe
  C:\Windows\System\YqWoGic.exe
  2⤵
  PID:10268
- C:\Windows\System\PVpFbHt.exe
  C:\Windows\System\PVpFbHt.exe
  2⤵
  PID:10284
- C:\Windows\System\OmVgcuC.exe
  C:\Windows\System\OmVgcuC.exe
  2⤵
  PID:10308
- C:\Windows\System\zIQDNxQ.exe
  C:\Windows\System\zIQDNxQ.exe
  2⤵
  PID:10336
- C:\Windows\System\zaPUIUh.exe
  C:\Windows\System\zaPUIUh.exe
  2⤵
  PID:10356
- C:\Windows\System\eLcHMuK.exe
  C:\Windows\System\eLcHMuK.exe
  2⤵
  PID:10388
- C:\Windows\System\gcpuyuU.exe
  C:\Windows\System\gcpuyuU.exe
  2⤵
  PID:10456
- C:\Windows\System\WzwvZbq.exe
  C:\Windows\System\WzwvZbq.exe
  2⤵
  PID:10484
- C:\Windows\System\cySleYy.exe
  C:\Windows\System\cySleYy.exe
  2⤵
  PID:10500
- C:\Windows\System\oknvySI.exe
  C:\Windows\System\oknvySI.exe
  2⤵
  PID:10528
- C:\Windows\System\iNwnnPg.exe
  C:\Windows\System\iNwnnPg.exe
  2⤵
  PID:10552
- C:\Windows\System\MuRFHFy.exe
  C:\Windows\System\MuRFHFy.exe
  2⤵
  PID:10572
- C:\Windows\System\gIKvXkN.exe
  C:\Windows\System\gIKvXkN.exe
  2⤵
  PID:10604
- C:\Windows\System\KjidQKY.exe
  C:\Windows\System\KjidQKY.exe
  2⤵
  PID:10640
- C:\Windows\System\pnfZUWL.exe
  C:\Windows\System\pnfZUWL.exe
  2⤵
  PID:10656
- C:\Windows\System\KkbnyKI.exe
  C:\Windows\System\KkbnyKI.exe
  2⤵
  PID:10700
- C:\Windows\System\bvmIPIO.exe
  C:\Windows\System\bvmIPIO.exe
  2⤵
  PID:10724
- C:\Windows\System\gxYsOyd.exe
  C:\Windows\System\gxYsOyd.exe
  2⤵
  PID:10740
- C:\Windows\System\YbHxYux.exe
  C:\Windows\System\YbHxYux.exe
  2⤵
  PID:10772
- C:\Windows\System\yKJaSxi.exe
  C:\Windows\System\yKJaSxi.exe
  2⤵
  PID:10808
- C:\Windows\System\AdDnLor.exe
  C:\Windows\System\AdDnLor.exe
  2⤵
  PID:10828
- C:\Windows\System\DKpAwES.exe
  C:\Windows\System\DKpAwES.exe
  2⤵
  PID:10848
- C:\Windows\System\QdnLayk.exe
  C:\Windows\System\QdnLayk.exe
  2⤵
  PID:10876
- C:\Windows\System\LzumDtc.exe
  C:\Windows\System\LzumDtc.exe
  2⤵
  PID:10908
- C:\Windows\System\SJVZAwG.exe
  C:\Windows\System\SJVZAwG.exe
  2⤵
  PID:10932
- C:\Windows\System\wzyVcuC.exe
  C:\Windows\System\wzyVcuC.exe
  2⤵
  PID:10964
- C:\Windows\System\sMePmPI.exe
  C:\Windows\System\sMePmPI.exe
  2⤵
  PID:10988
- C:\Windows\System\iAbUjwS.exe
  C:\Windows\System\iAbUjwS.exe
  2⤵
  PID:11016
- C:\Windows\System\FfEvzUr.exe
  C:\Windows\System\FfEvzUr.exe
  2⤵
  PID:11060
- C:\Windows\System\ARriTeK.exe
  C:\Windows\System\ARriTeK.exe
  2⤵
  PID:11076
- C:\Windows\System\rzckoTH.exe
  C:\Windows\System\rzckoTH.exe
  2⤵
  PID:11112
- C:\Windows\System\QcDiNtR.exe
  C:\Windows\System\QcDiNtR.exe
  2⤵
  PID:11136
- C:\Windows\System\JPXNpou.exe
  C:\Windows\System\JPXNpou.exe
  2⤵
  PID:11160
- C:\Windows\System\wgQbHbu.exe
  C:\Windows\System\wgQbHbu.exe
  2⤵
  PID:11196
- C:\Windows\System\IuvRvOu.exe
  C:\Windows\System\IuvRvOu.exe
  2⤵
  PID:11224
- C:\Windows\System\khEQYIe.exe
  C:\Windows\System\khEQYIe.exe
  2⤵
  PID:11256
- C:\Windows\System\lLbRqxY.exe
  C:\Windows\System\lLbRqxY.exe
  2⤵
  PID:10280
- C:\Windows\System\geDszuN.exe
  C:\Windows\System\geDszuN.exe
  2⤵
  PID:10332
- C:\Windows\System\xeNZAJP.exe
  C:\Windows\System\xeNZAJP.exe
  2⤵
  PID:10348
- C:\Windows\System\HDavWTM.exe
  C:\Windows\System\HDavWTM.exe
  2⤵
  PID:10472
- C:\Windows\System\QselBgc.exe
  C:\Windows\System\QselBgc.exe
  2⤵
  PID:10516
- C:\Windows\System\qDAlwua.exe
  C:\Windows\System\qDAlwua.exe
  2⤵
  PID:10568
- C:\Windows\System\KDdJTQX.exe
  C:\Windows\System\KDdJTQX.exe
  2⤵
  PID:10668
- C:\Windows\System\DGlWhQG.exe
  C:\Windows\System\DGlWhQG.exe
  2⤵
  PID:10732
- C:\Windows\System\NRgZXfZ.exe
  C:\Windows\System\NRgZXfZ.exe
  2⤵
  PID:10800
- C:\Windows\System\YZguGgK.exe
  C:\Windows\System\YZguGgK.exe
  2⤵
  PID:10824
- C:\Windows\System\WdAYohm.exe
  C:\Windows\System\WdAYohm.exe
  2⤵
  PID:10916
- C:\Windows\System\hUAiMZp.exe
  C:\Windows\System\hUAiMZp.exe
  2⤵
  PID:10920
- C:\Windows\System\oEIrwQd.exe
  C:\Windows\System\oEIrwQd.exe
  2⤵
  PID:11032
- C:\Windows\System\TGHCzNZ.exe
  C:\Windows\System\TGHCzNZ.exe
  2⤵
  PID:11088
- C:\Windows\System\ntFzyWO.exe
  C:\Windows\System\ntFzyWO.exe
  2⤵
  PID:11144
- C:\Windows\System\QOLXAsR.exe
  C:\Windows\System\QOLXAsR.exe
  2⤵
  PID:11244
- C:\Windows\System\ItMXKBn.exe
  C:\Windows\System\ItMXKBn.exe
  2⤵
  PID:10260
- C:\Windows\System\TepmnmC.exe
  C:\Windows\System\TepmnmC.exe
  2⤵
  PID:10300
- C:\Windows\System\TBaidEB.exe
  C:\Windows\System\TBaidEB.exe
  2⤵
  PID:10480
- C:\Windows\System\SwUCNrD.exe
  C:\Windows\System\SwUCNrD.exe
  2⤵
  PID:10752
- C:\Windows\System\FBqGpXV.exe
  C:\Windows\System\FBqGpXV.exe
  2⤵
  PID:10792
- C:\Windows\System\AHbJTUG.exe
  C:\Windows\System\AHbJTUG.exe
  2⤵
  PID:10976
- C:\Windows\System\cZWEtYj.exe
  C:\Windows\System\cZWEtYj.exe
  2⤵
  PID:11028
- C:\Windows\System\mhbSEou.exe
  C:\Windows\System\mhbSEou.exe
  2⤵
  PID:11124
- C:\Windows\System\yHhNSEe.exe
  C:\Windows\System\yHhNSEe.exe
  2⤵
  PID:10760
- C:\Windows\System\OIboTua.exe
  C:\Windows\System\OIboTua.exe
  2⤵
  PID:10520
- C:\Windows\System\kOujpJW.exe
  C:\Windows\System\kOujpJW.exe
  2⤵
  PID:11208
- C:\Windows\System\OARNoVj.exe
  C:\Windows\System\OARNoVj.exe
  2⤵
  PID:9556
- C:\Windows\System\ntjPOWW.exe
  C:\Windows\System\ntjPOWW.exe
  2⤵
  PID:11280
- C:\Windows\System\pHaFVJN.exe
  C:\Windows\System\pHaFVJN.exe
  2⤵
  PID:11336
- C:\Windows\System\aNwwvQl.exe
  C:\Windows\System\aNwwvQl.exe
  2⤵
  PID:11356
- C:\Windows\System\lJOEHYp.exe
  C:\Windows\System\lJOEHYp.exe
  2⤵
  PID:11396
- C:\Windows\System\gPJJSat.exe
  C:\Windows\System\gPJJSat.exe
  2⤵
  PID:11436
- C:\Windows\System\upPapaJ.exe
  C:\Windows\System\upPapaJ.exe
  2⤵
  PID:11456
- C:\Windows\System\KbFLKdz.exe
  C:\Windows\System\KbFLKdz.exe
  2⤵
  PID:11484
- C:\Windows\System\iKiNdJI.exe
  C:\Windows\System\iKiNdJI.exe
  2⤵
  PID:11504
- C:\Windows\System\pPIrajR.exe
  C:\Windows\System\pPIrajR.exe
  2⤵
  PID:11532
- C:\Windows\System\cuPDfBp.exe
  C:\Windows\System\cuPDfBp.exe
  2⤵
  PID:11592
- C:\Windows\System\OiywslA.exe
  C:\Windows\System\OiywslA.exe
  2⤵
  PID:11608
- C:\Windows\System\DXPrlLs.exe
  C:\Windows\System\DXPrlLs.exe
  2⤵
  PID:11628
- C:\Windows\System\TJQuhcQ.exe
  C:\Windows\System\TJQuhcQ.exe
  2⤵
  PID:11652
- C:\Windows\System\dXJnbhk.exe
  C:\Windows\System\dXJnbhk.exe
  2⤵
  PID:11668
- C:\Windows\System\OctlWYo.exe
  C:\Windows\System\OctlWYo.exe
  2⤵
  PID:11688
- C:\Windows\System\TEkRueG.exe
  C:\Windows\System\TEkRueG.exe
  2⤵
  PID:11708
- C:\Windows\System\VrvNdMk.exe
  C:\Windows\System\VrvNdMk.exe
  2⤵
  PID:11732
- C:\Windows\System\SuiERqP.exe
  C:\Windows\System\SuiERqP.exe
  2⤵
  PID:11804
- C:\Windows\System\syiirsO.exe
  C:\Windows\System\syiirsO.exe
  2⤵
  PID:11820
- C:\Windows\System\xDZzBXl.exe
  C:\Windows\System\xDZzBXl.exe
  2⤵
  PID:11836
- C:\Windows\System\PpUXTMS.exe
  C:\Windows\System\PpUXTMS.exe
  2⤵
  PID:11876
- C:\Windows\System\tFkIJuR.exe
  C:\Windows\System\tFkIJuR.exe
  2⤵
  PID:11896
- C:\Windows\System\wqHCCUu.exe
  C:\Windows\System\wqHCCUu.exe
  2⤵
  PID:11944
- C:\Windows\System\pGYQuZT.exe
  C:\Windows\System\pGYQuZT.exe
  2⤵
  PID:11964
- C:\Windows\System\BwIWTJO.exe
  C:\Windows\System\BwIWTJO.exe
  2⤵
  PID:11988
- C:\Windows\System\OIvsVPf.exe
  C:\Windows\System\OIvsVPf.exe
  2⤵
  PID:12004
- C:\Windows\System\epAgOzo.exe
  C:\Windows\System\epAgOzo.exe
  2⤵
  PID:12052
- C:\Windows\System\kDIvcGL.exe
  C:\Windows\System\kDIvcGL.exe
  2⤵
  PID:12072
- C:\Windows\System\rJObNur.exe
  C:\Windows\System\rJObNur.exe
  2⤵
  PID:12100
- C:\Windows\System\QAagVSZ.exe
  C:\Windows\System\QAagVSZ.exe
  2⤵
  PID:12124
- C:\Windows\System\VxFZnQD.exe
  C:\Windows\System\VxFZnQD.exe
  2⤵
  PID:12156
- C:\Windows\System\NqYWJFA.exe
  C:\Windows\System\NqYWJFA.exe
  2⤵
  PID:12220
- C:\Windows\System\rPJeAOC.exe
  C:\Windows\System\rPJeAOC.exe
  2⤵
  PID:12264
- C:\Windows\System\YTlNMXk.exe
  C:\Windows\System\YTlNMXk.exe
  2⤵
  PID:12280
- C:\Windows\System\VZuBcJv.exe
  C:\Windows\System\VZuBcJv.exe
  2⤵
  PID:10380
- C:\Windows\System\aUkvbTq.exe
  C:\Windows\System\aUkvbTq.exe
  2⤵
  PID:11316
- C:\Windows\System\rhlfzEA.exe
  C:\Windows\System\rhlfzEA.exe
  2⤵
  PID:11388
- C:\Windows\System\vacJQdy.exe
  C:\Windows\System\vacJQdy.exe
  2⤵
  PID:11452
- C:\Windows\System\xuWcUFD.exe
  C:\Windows\System\xuWcUFD.exe
  2⤵
  PID:11544
- C:\Windows\System\eIifaYB.exe
  C:\Windows\System\eIifaYB.exe
  2⤵
  PID:7584
- C:\Windows\System\BgiHCvC.exe
  C:\Windows\System\BgiHCvC.exe
  2⤵
  PID:11576
- C:\Windows\System\GcXJfxS.exe
  C:\Windows\System\GcXJfxS.exe
  2⤵
  PID:11636
- C:\Windows\System\VmRAsRG.exe
  C:\Windows\System\VmRAsRG.exe
  2⤵
  PID:11644
- C:\Windows\System\psIkuYZ.exe
  C:\Windows\System\psIkuYZ.exe
  2⤵
  PID:11780
- C:\Windows\System\bELrmqb.exe
  C:\Windows\System\bELrmqb.exe
  2⤵
  PID:11868
- C:\Windows\System\IJfxvci.exe
  C:\Windows\System\IJfxvci.exe
  2⤵
  PID:11920
- C:\Windows\System\jROknTe.exe
  C:\Windows\System\jROknTe.exe
  2⤵
  PID:11960
- C:\Windows\System\ENcQDeD.exe
  C:\Windows\System\ENcQDeD.exe
  2⤵
  PID:12016
- C:\Windows\System\otCSKlB.exe
  C:\Windows\System\otCSKlB.exe
  2⤵
  PID:12112
- C:\Windows\System\YRNoSDq.exe
  C:\Windows\System\YRNoSDq.exe
  2⤵
  PID:12152
- C:\Windows\System\MoshTIM.exe
  C:\Windows\System\MoshTIM.exe
  2⤵
  PID:10496
- C:\Windows\System\PSWwFHF.exe
  C:\Windows\System\PSWwFHF.exe
  2⤵
  PID:11352
- C:\Windows\System\UptoEFP.exe
  C:\Windows\System\UptoEFP.exe
  2⤵
  PID:3460
- C:\Windows\System\kbeQkwc.exe
  C:\Windows\System\kbeQkwc.exe
  2⤵
  PID:11700
- C:\Windows\System\BTzjcYa.exe
  C:\Windows\System\BTzjcYa.exe
  2⤵
  PID:11752
- C:\Windows\System\vQsfQGE.exe
  C:\Windows\System\vQsfQGE.exe
  2⤵
  PID:12032
- C:\Windows\System\GUziugR.exe
  C:\Windows\System\GUziugR.exe
  2⤵
  PID:12208
- C:\Windows\System\LjqsWVI.exe
  C:\Windows\System\LjqsWVI.exe
  2⤵
  PID:11604
- C:\Windows\System\FYKrdYy.exe
  C:\Windows\System\FYKrdYy.exe
  2⤵
  PID:11664
- C:\Windows\System\KZaKUgO.exe
  C:\Windows\System\KZaKUgO.exe
  2⤵
  PID:11368
- C:\Windows\System\cPUDIhZ.exe
  C:\Windows\System\cPUDIhZ.exe
  2⤵
  PID:11520
- C:\Windows\System\IzyCnLe.exe
  C:\Windows\System\IzyCnLe.exe
  2⤵
  PID:12300
- C:\Windows\System\KzmviNW.exe
  C:\Windows\System\KzmviNW.exe
  2⤵
  PID:12320
- C:\Windows\System\gaGZTub.exe
  C:\Windows\System\gaGZTub.exe
  2⤵
  PID:12348
- C:\Windows\System\TCydAuM.exe
  C:\Windows\System\TCydAuM.exe
  2⤵
  PID:12376
- C:\Windows\System\UrPNyDG.exe
  C:\Windows\System\UrPNyDG.exe
  2⤵
  PID:12404
- C:\Windows\System\pbiETQi.exe
  C:\Windows\System\pbiETQi.exe
  2⤵
  PID:12428
- C:\Windows\System\XbZTbQB.exe
  C:\Windows\System\XbZTbQB.exe
  2⤵
  PID:12476
- C:\Windows\System\bgTDUmC.exe
  C:\Windows\System\bgTDUmC.exe
  2⤵
  PID:12500
- C:\Windows\System\YcCCUQR.exe
  C:\Windows\System\YcCCUQR.exe
  2⤵
  PID:12516
- C:\Windows\System\osggdvx.exe
  C:\Windows\System\osggdvx.exe
  2⤵
  PID:12556
- C:\Windows\System\npEpxEI.exe
  C:\Windows\System\npEpxEI.exe
  2⤵
  PID:12572
- C:\Windows\System\jrAIRnH.exe
  C:\Windows\System\jrAIRnH.exe
  2⤵
  PID:12600
- C:\Windows\System\gCFnkQB.exe
  C:\Windows\System\gCFnkQB.exe
  2⤵
  PID:12628
- C:\Windows\System\MHIxBRx.exe
  C:\Windows\System\MHIxBRx.exe
  2⤵
  PID:12644
- C:\Windows\System\IafvSsd.exe
  C:\Windows\System\IafvSsd.exe
  2⤵
  PID:12672
- C:\Windows\System\RvdHNpF.exe
  C:\Windows\System\RvdHNpF.exe
  2⤵
  PID:12696
- C:\Windows\System\mbsvzVo.exe
  C:\Windows\System\mbsvzVo.exe
  2⤵
  PID:12744
- C:\Windows\System\rPRQrxA.exe
  C:\Windows\System\rPRQrxA.exe
  2⤵
  PID:12764
- C:\Windows\System\ndkUDFl.exe
  C:\Windows\System\ndkUDFl.exe
  2⤵
  PID:12820
- C:\Windows\System\OmRNGwq.exe
  C:\Windows\System\OmRNGwq.exe
  2⤵
  PID:12840
- C:\Windows\System\FSpHumZ.exe
  C:\Windows\System\FSpHumZ.exe
  2⤵
  PID:12856
- C:\Windows\System\byiAnXp.exe
  C:\Windows\System\byiAnXp.exe
  2⤵
  PID:12892
- C:\Windows\System\IeWHHKA.exe
  C:\Windows\System\IeWHHKA.exe
  2⤵
  PID:12944
- C:\Windows\System\UtJdsxX.exe
  C:\Windows\System\UtJdsxX.exe
  2⤵
  PID:12964
- C:\Windows\System\ZgXsazq.exe
  C:\Windows\System\ZgXsazq.exe
  2⤵
  PID:12988
- C:\Windows\System\EIdFzDs.exe
  C:\Windows\System\EIdFzDs.exe
  2⤵
  PID:13004
- C:\Windows\System\FIBUOLj.exe
  C:\Windows\System\FIBUOLj.exe
  2⤵
  PID:13024
- C:\Windows\System\SmDWeJl.exe
  C:\Windows\System\SmDWeJl.exe
  2⤵
  PID:13052
- C:\Windows\System\ubBKlHk.exe
  C:\Windows\System\ubBKlHk.exe
  2⤵
  PID:13084
- C:\Windows\System\naSemqC.exe
  C:\Windows\System\naSemqC.exe
  2⤵
  PID:13104
- C:\Windows\System\LowVETJ.exe
  C:\Windows\System\LowVETJ.exe
  2⤵
  PID:13168
- C:\Windows\System\QSiEwas.exe
  C:\Windows\System\QSiEwas.exe
  2⤵
  PID:13184
- C:\Windows\System\cXvHPMF.exe
  C:\Windows\System\cXvHPMF.exe
  2⤵
  PID:13204
- C:\Windows\System\voctWlG.exe
  C:\Windows\System\voctWlG.exe
  2⤵
  PID:13228
- C:\Windows\System\EHOOyPY.exe
  C:\Windows\System\EHOOyPY.exe
  2⤵
  PID:13252
- C:\Windows\System\QZVKWMp.exe
  C:\Windows\System\QZVKWMp.exe
  2⤵
  PID:13308
- C:\Windows\System\dcwmUHO.exe
  C:\Windows\System\dcwmUHO.exe
  2⤵
  PID:12316
- C:\Windows\System\aXEKaKZ.exe
  C:\Windows\System\aXEKaKZ.exe
  2⤵
  PID:12328
- C:\Windows\System\wCOiBTq.exe
  C:\Windows\System\wCOiBTq.exe
  2⤵
  PID:12392
- C:\Windows\System\MmDmzNL.exe
  C:\Windows\System\MmDmzNL.exe
  2⤵
  PID:12448
- C:\Windows\System\QLtknqJ.exe
  C:\Windows\System\QLtknqJ.exe
  2⤵
  PID:12492
- C:\Windows\System\CgBXquM.exe
  C:\Windows\System\CgBXquM.exe
  2⤵
  PID:12568
- C:\Windows\System\zJpZPGX.exe
  C:\Windows\System\zJpZPGX.exe
  2⤵
  PID:12592
- C:\Windows\System\aDRHKzU.exe
  C:\Windows\System\aDRHKzU.exe
  2⤵
  PID:12668
- C:\Windows\System\KAEkdBu.exe
  C:\Windows\System\KAEkdBu.exe
  2⤵
  PID:12804
- C:\Windows\System\jRJYiUG.exe
  C:\Windows\System\jRJYiUG.exe
  2⤵
  PID:12788
- C:\Windows\System\QtVPngE.exe
  C:\Windows\System\QtVPngE.exe
  2⤵
  PID:12836
- C:\Windows\System\JYlCqGD.exe
  C:\Windows\System\JYlCqGD.exe
  2⤵
  PID:12956
- C:\Windows\System\ndmNydL.exe
  C:\Windows\System\ndmNydL.exe
  2⤵
  PID:13000
- C:\Windows\System\RDZSxEX.exe
  C:\Windows\System\RDZSxEX.exe
  2⤵
  PID:13076
- C:\Windows\System\VlkMCKP.exe
  C:\Windows\System\VlkMCKP.exe
  2⤵
  PID:13132
- C:\Windows\System\MBFPCLw.exe
  C:\Windows\System\MBFPCLw.exe
  2⤵
  PID:13220
- C:\Windows\System\JuBYaqh.exe
  C:\Windows\System\JuBYaqh.exe
  2⤵
  PID:13288
- C:\Windows\System\kvfLKpf.exe
  C:\Windows\System\kvfLKpf.exe
  2⤵
  PID:12508
- C:\Windows\System\XwickhQ.exe
  C:\Windows\System\XwickhQ.exe
  2⤵
  PID:12612
- C:\Windows\System\XRlOnsQ.exe
  C:\Windows\System\XRlOnsQ.exe
  2⤵
  PID:12796
- C:\Windows\System\QzDXibn.exe
  C:\Windows\System\QzDXibn.exe
  2⤵
  PID:12832
- C:\Windows\System\sipHxZS.exe
  C:\Windows\System\sipHxZS.exe
  2⤵
  PID:13180
- C:\Windows\System\nObagjE.exe
  C:\Windows\System\nObagjE.exe
  2⤵
  PID:13244
- C:\Windows\System\qZJlmdw.exe
  C:\Windows\System\qZJlmdw.exe
  2⤵
  PID:12424
- C:\Windows\System\OMLerxV.exe
  C:\Windows\System\OMLerxV.exe
  2⤵
  PID:12904
- C:\Windows\System\JvKvRiK.exe
  C:\Windows\System\JvKvRiK.exe
  2⤵
  PID:12996
- C:\Windows\System\bPminAx.exe
  C:\Windows\System\bPminAx.exe
  2⤵
  PID:13176
- C:\Windows\System\QTCbTMt.exe
  C:\Windows\System\QTCbTMt.exe
  2⤵
  PID:12712
- C:\Windows\System\MizGkar.exe
  C:\Windows\System\MizGkar.exe
  2⤵
  PID:13324
- C:\Windows\System\ROrSGyZ.exe
  C:\Windows\System\ROrSGyZ.exe
  2⤵
  PID:13352
- C:\Windows\System\BXjCehg.exe
  C:\Windows\System\BXjCehg.exe
  2⤵
  PID:13384
- C:\Windows\System\jFDfWel.exe
  C:\Windows\System\jFDfWel.exe
  2⤵
  PID:13420
- C:\Windows\System\bezjJhF.exe
  C:\Windows\System\bezjJhF.exe
  2⤵
  PID:13440
- C:\Windows\System\POQSDiN.exe
  C:\Windows\System\POQSDiN.exe
  2⤵
  PID:13480
- C:\Windows\System\tgVNGjJ.exe
  C:\Windows\System\tgVNGjJ.exe
  2⤵
  PID:13520
- C:\Windows\System\JiknAsp.exe
  C:\Windows\System\JiknAsp.exe
  2⤵
  PID:13568
- C:\Windows\System\MXtfSML.exe
  C:\Windows\System\MXtfSML.exe
  2⤵
  PID:13584
- C:\Windows\System\XbfAbRT.exe
  C:\Windows\System\XbfAbRT.exe
  2⤵
  PID:13604
- C:\Windows\System\wcmlWOW.exe
  C:\Windows\System\wcmlWOW.exe
  2⤵
  PID:13628
- C:\Windows\System\FMpsirR.exe
  C:\Windows\System\FMpsirR.exe
  2⤵
  PID:13644
- C:\Windows\System\AlcZzMx.exe
  C:\Windows\System\AlcZzMx.exe
  2⤵
  PID:13668
- C:\Windows\System\JQKsCXM.exe
  C:\Windows\System\JQKsCXM.exe
  2⤵
  PID:13704
- C:\Windows\System\VwpbRyS.exe
  C:\Windows\System\VwpbRyS.exe
  2⤵
  PID:13752
- C:\Windows\System\eshRJxA.exe
  C:\Windows\System\eshRJxA.exe
  2⤵
  PID:13768
- C:\Windows\System\HznjoYr.exe
  C:\Windows\System\HznjoYr.exe
  2⤵
  PID:13808
- C:\Windows\System\ZtLGCjF.exe
  C:\Windows\System\ZtLGCjF.exe
  2⤵
  PID:13828
- C:\Windows\System\eOUVkeV.exe
  C:\Windows\System\eOUVkeV.exe
  2⤵
  PID:13856
- C:\Windows\System\JOxMewf.exe
  C:\Windows\System\JOxMewf.exe
  2⤵
  PID:13880
- C:\Windows\System\tweJCuP.exe
  C:\Windows\System\tweJCuP.exe
  2⤵
  PID:13908
- C:\Windows\System\kdYTAxF.exe
  C:\Windows\System\kdYTAxF.exe
  2⤵
  PID:13932
- C:\Windows\System\APFmYkj.exe
  C:\Windows\System\APFmYkj.exe
  2⤵
  PID:13968
- C:\Windows\System\kpBbRVe.exe
  C:\Windows\System\kpBbRVe.exe
  2⤵
  PID:13996
- C:\Windows\System\omueEmE.exe
  C:\Windows\System\omueEmE.exe
  2⤵
  PID:14028
- C:\Windows\System\thojYBi.exe
  C:\Windows\System\thojYBi.exe
  2⤵
  PID:14052
- C:\Windows\System\IQuxujx.exe
  C:\Windows\System\IQuxujx.exe
  2⤵
  PID:14072
- C:\Windows\System\zKVBiuA.exe
  C:\Windows\System\zKVBiuA.exe
  2⤵
  PID:14092
- C:\Windows\System\xkhrIol.exe
  C:\Windows\System\xkhrIol.exe
  2⤵
  PID:14136
- C:\Windows\System\SkIErzd.exe
  C:\Windows\System\SkIErzd.exe
  2⤵
  PID:14160
- C:\Windows\System\KIpKitW.exe
  C:\Windows\System\KIpKitW.exe
  2⤵
  PID:14188
- C:\Windows\System\rsTiTcD.exe
  C:\Windows\System\rsTiTcD.exe
  2⤵
  PID:14208
- C:\Windows\System\OCpbFdP.exe
  C:\Windows\System\OCpbFdP.exe
  2⤵
  PID:14224
- C:\Windows\System\CykHORp.exe
  C:\Windows\System\CykHORp.exe
  2⤵
  PID:14288
- C:\Windows\System\WRXcfYW.exe
  C:\Windows\System\WRXcfYW.exe
  2⤵
  PID:14304
- C:\Windows\System\bVPhDCU.exe
  C:\Windows\System\bVPhDCU.exe
  2⤵
  PID:14328
- C:\Windows\System\LMwhbbf.exe
  C:\Windows\System\LMwhbbf.exe
  2⤵
  PID:12752
- C:\Windows\System\heywFiU.exe
  C:\Windows\System\heywFiU.exe
  2⤵
  PID:13416
- C:\Windows\System\PRecJOa.exe
  C:\Windows\System\PRecJOa.exe
  2⤵
  PID:13436
- C:\Windows\System\HfcCpMX.exe
  C:\Windows\System\HfcCpMX.exe
  2⤵
  PID:13504
- C:\Windows\System\cMlQGZe.exe
  C:\Windows\System\cMlQGZe.exe
  2⤵
  PID:13564
- C:\Windows\System\PtmULCP.exe
  C:\Windows\System\PtmULCP.exe
  2⤵
  PID:13624
- C:\Windows\System\zGRcobE.exe
  C:\Windows\System\zGRcobE.exe
  2⤵
  PID:13736
- C:\Windows\System\hLQTFPq.exe
  C:\Windows\System\hLQTFPq.exe
  2⤵
  PID:13780
- C:\Windows\System\rtCmdpC.exe
  C:\Windows\System\rtCmdpC.exe
  2⤵
  PID:13844
- C:\Windows\System\fRIJIdA.exe
  C:\Windows\System\fRIJIdA.exe
  2⤵
  PID:13872
- C:\Windows\System\nMbEGkn.exe
  C:\Windows\System\nMbEGkn.exe
  2⤵
  PID:14008
- C:\Windows\System\hcwLeJY.exe
  C:\Windows\System\hcwLeJY.exe
  2⤵
  PID:14116
- C:\Windows\System\VpkitJK.exe
  C:\Windows\System\VpkitJK.exe
  2⤵
  PID:14144
- C:\Windows\System\AwtcSaj.exe
  C:\Windows\System\AwtcSaj.exe
  2⤵
  PID:14180
- C:\Windows\System\NOwVJsw.exe
  C:\Windows\System\NOwVJsw.exe
  2⤵
  PID:14216
- C:\Windows\System\QSqgmCL.exe
  C:\Windows\System\QSqgmCL.exe
  2⤵
  PID:14268
- C:\Windows\System\DdbIaAp.exe
  C:\Windows\System\DdbIaAp.exe
  2⤵
  PID:13320
- C:\Windows\System\fraPZoA.exe
  C:\Windows\System\fraPZoA.exe
  2⤵
  PID:13432
- C:\Windows\System\vcQvOcS.exe
  C:\Windows\System\vcQvOcS.exe
  2⤵
  PID:13576
- C:\Windows\System\YGNtfFU.exe
  C:\Windows\System\YGNtfFU.exe
  2⤵
  PID:13656
- C:\Windows\System\nsrjMNA.exe
  C:\Windows\System\nsrjMNA.exe
  2⤵
  PID:13804
- C:\Windows\System\PUZjQRi.exe
  C:\Windows\System\PUZjQRi.exe
  2⤵
  PID:14112
- C:\Windows\System\BXyZwWU.exe
  C:\Windows\System\BXyZwWU.exe
  2⤵
  PID:14264
- C:\Windows\System\AIWoUKO.exe
  C:\Windows\System\AIWoUKO.exe
  2⤵
  PID:13460
- C:\Windows\System\DkSSjiy.exe
  C:\Windows\System\DkSSjiy.exe
  2⤵
  PID:14060
- C:\Windows\System\oTxRylY.exe
  C:\Windows\System\oTxRylY.exe
  2⤵
  PID:14204
- C:\Windows\System\kzQRRUk.exe
  C:\Windows\System\kzQRRUk.exe
  2⤵
  PID:14348
- C:\Windows\System\imgnrhD.exe
  C:\Windows\System\imgnrhD.exe
  2⤵
  PID:14364
- C:\Windows\System\zJZOpfV.exe
  C:\Windows\System\zJZOpfV.exe
  2⤵
  PID:14404
- C:\Windows\System\kmStcjA.exe
  C:\Windows\System\kmStcjA.exe
  2⤵
  PID:14420
- C:\Windows\System\kxYcuur.exe
  C:\Windows\System\kxYcuur.exe
  2⤵
  PID:14444
- C:\Windows\System\MeRXpqG.exe
  C:\Windows\System\MeRXpqG.exe
  2⤵
  PID:14468
- C:\Windows\System\TeMhTQB.exe
  C:\Windows\System\TeMhTQB.exe
  2⤵
  PID:14492
- C:\Windows\System\PshhwKG.exe
  C:\Windows\System\PshhwKG.exe
  2⤵
  PID:14544
- C:\Windows\System\piAnszl.exe
  C:\Windows\System\piAnszl.exe
  2⤵
  PID:14560
- C:\Windows\System\GXtHXZm.exe
  C:\Windows\System\GXtHXZm.exe
  2⤵
  PID:14584
- C:\Windows\System\fWbeKSy.exe
  C:\Windows\System\fWbeKSy.exe
  2⤵
  PID:14604
- C:\Windows\System\GFtnPMV.exe
  C:\Windows\System\GFtnPMV.exe
  2⤵
  PID:14624
- C:\Windows\System\LzaHECp.exe
  C:\Windows\System\LzaHECp.exe
  2⤵
  PID:14644
- C:\Windows\System\TkwsGLT.exe
  C:\Windows\System\TkwsGLT.exe
  2⤵
  PID:14704
- C:\Windows\System\udxTEPB.exe
  C:\Windows\System\udxTEPB.exe
  2⤵
  PID:14720
- C:\Windows\System\cCbrdPI.exe
  C:\Windows\System\cCbrdPI.exe
  2⤵
  PID:14736
- C:\Windows\System\aAQKcYv.exe
  C:\Windows\System\aAQKcYv.exe
  2⤵
  PID:14752
- C:\Windows\System\hitohTc.exe
  C:\Windows\System\hitohTc.exe
  2⤵
  PID:14772
- C:\Windows\System\JDdFVND.exe
  C:\Windows\System\JDdFVND.exe
  2⤵
  PID:14812
- C:\Windows\System\YcTfoxg.exe
  C:\Windows\System\YcTfoxg.exe
  2⤵
  PID:14840
- C:\Windows\System\bHIKygk.exe
  C:\Windows\System\bHIKygk.exe
  2⤵
  PID:14892
- C:\Windows\System\EhXjlcY.exe
  C:\Windows\System\EhXjlcY.exe
  2⤵
  PID:14912
- C:\Windows\System\JkwClbU.exe
  C:\Windows\System\JkwClbU.exe
  2⤵
  PID:14940
- C:\Windows\System\gJDnFJD.exe
  C:\Windows\System\gJDnFJD.exe
  2⤵
  PID:14964
- C:\Windows\System\MnuxXvZ.exe
  C:\Windows\System\MnuxXvZ.exe
  2⤵
  PID:14980
- C:\Windows\System\iiFXfPK.exe
  C:\Windows\System\iiFXfPK.exe
  2⤵
  PID:14996
- C:\Windows\System\iBrEqWY.exe
  C:\Windows\System\iBrEqWY.exe
  2⤵
  PID:15020
- C:\Windows\System\HolQvEk.exe
  C:\Windows\System\HolQvEk.exe
  2⤵
  PID:15096
- C:\Windows\System\WPzzKxJ.exe
  C:\Windows\System\WPzzKxJ.exe
  2⤵
  PID:15116
- C:\Windows\System\ZsYHWbf.exe
  C:\Windows\System\ZsYHWbf.exe
  2⤵
  PID:15132
- C:\Windows\System\eXarhoy.exe
  C:\Windows\System\eXarhoy.exe
  2⤵
  PID:15156
- C:\Windows\System\sNpwUaa.exe
  C:\Windows\System\sNpwUaa.exe
  2⤵
  PID:15192
- C:\Windows\System\uJvTnvu.exe
  C:\Windows\System\uJvTnvu.exe
  2⤵
  PID:15248
- C:\Windows\System\ZmHinFI.exe
  C:\Windows\System\ZmHinFI.exe
  2⤵
  PID:15276
- C:\Windows\System\OdyUBzG.exe
  C:\Windows\System\OdyUBzG.exe
  2⤵
  PID:15304
- C:\Windows\System\KGCFmSc.exe
  C:\Windows\System\KGCFmSc.exe
  2⤵
  PID:15320
- C:\Windows\System\DvDzVau.exe
  C:\Windows\System\DvDzVau.exe
  2⤵
  PID:15336
- C:\Windows\System\inujGhb.exe
  C:\Windows\System\inujGhb.exe
  2⤵
  PID:13964
- C:\Windows\System\VNiEtUN.exe
  C:\Windows\System\VNiEtUN.exe
  2⤵
  PID:14384
- C:\Windows\System\SNLQMfO.exe
  C:\Windows\System\SNLQMfO.exe
  2⤵
  PID:14436
- C:\Windows\System\OTTGgWt.exe
  C:\Windows\System\OTTGgWt.exe
  2⤵
  PID:14540
- C:\Windows\System\dxtPbRM.exe
  C:\Windows\System\dxtPbRM.exe
  2⤵
  PID:14612
- C:\Windows\System\zAphaPI.exe
  C:\Windows\System\zAphaPI.exe
  2⤵
  PID:14712
- C:\Windows\System\QvkNnzf.exe
  C:\Windows\System\QvkNnzf.exe
  2⤵
  PID:14668
- C:\Windows\System\hTzheui.exe
  C:\Windows\System\hTzheui.exe
  2⤵
  PID:14808
- C:\Windows\System\gSqaSXU.exe
  C:\Windows\System\gSqaSXU.exe
  2⤵
  PID:14800
- C:\Windows\System\FdyzUUS.exe
  C:\Windows\System\FdyzUUS.exe
  2⤵
  PID:14880
- C:\Windows\System\Fonvqdj.exe
  C:\Windows\System\Fonvqdj.exe
  2⤵
  PID:14904
- C:\Windows\System\HlvwfYC.exe
  C:\Windows\System\HlvwfYC.exe
  2⤵
  PID:14992
- C:\Windows\System\zYmUDWz.exe
  C:\Windows\System\zYmUDWz.exe
  2⤵
  PID:15056
- C:\Windows\System\ddWQsTn.exe
  C:\Windows\System\ddWQsTn.exe
  2⤵
  PID:15128
- C:\Windows\System\rmfdhAy.exe
  C:\Windows\System\rmfdhAy.exe
  2⤵
  PID:15240
- C:\Windows\System\czczScr.exe
  C:\Windows\System\czczScr.exe
  2⤵
  PID:15312
- C:\Windows\System\uCcYvcW.exe
  C:\Windows\System\uCcYvcW.exe
  2⤵
  PID:15348
- C:\Windows\System\qeuTYyM.exe
  C:\Windows\System\qeuTYyM.exe
  2⤵
  PID:14460
- C:\Windows\System\MjMTopr.exe
  C:\Windows\System\MjMTopr.exe
  2⤵
  PID:14636
- C:\Windows\System\MfnVrGM.exe
  C:\Windows\System\MfnVrGM.exe
  2⤵
  PID:14784
- C:\Windows\System\vypafrt.exe
  C:\Windows\System\vypafrt.exe
  2⤵
  PID:14956
- C:\Windows\System\QRbRHRX.exe
  C:\Windows\System\QRbRHRX.exe
  2⤵
  PID:14988
- C:\Windows\System\LYLxuiF.exe
  C:\Windows\System\LYLxuiF.exe
  2⤵
  PID:15036
- C:\Windows\System\LsNhxMj.exe
  C:\Windows\System\LsNhxMj.exe
  2⤵
  PID:15356
- C:\Windows\System\ylYRhvF.exe
  C:\Windows\System\ylYRhvF.exe
  2⤵
  PID:14616
- C:\Windows\System\TTuCKzi.exe
  C:\Windows\System\TTuCKzi.exe
  2⤵
  PID:14936
- C:\Windows\System\iGMXcrc.exe
  C:\Windows\System\iGMXcrc.exe
  2⤵
  PID:15124
- C:\Windows\System\ShvvRwC.exe
  C:\Windows\System\ShvvRwC.exe
  2⤵
  PID:15380
- C:\Windows\System\ESyVPAW.exe
  C:\Windows\System\ESyVPAW.exe
  2⤵
  PID:15400
- C:\Windows\System\FoGQenR.exe
  C:\Windows\System\FoGQenR.exe
  2⤵
  PID:15424
- C:\Windows\System\AtvWlwG.exe
  C:\Windows\System\AtvWlwG.exe
  2⤵
  PID:15488
- C:\Windows\System\zHQQeqT.exe
  C:\Windows\System\zHQQeqT.exe
  2⤵
  PID:15524
- C:\Windows\System\dRdXoCv.exe
  C:\Windows\System\dRdXoCv.exe
  2⤵
  PID:15548
- C:\Windows\System\wtKtUSU.exe
  C:\Windows\System\wtKtUSU.exe
  2⤵
  PID:15580
- C:\Windows\System\OzHBCdE.exe
  C:\Windows\System\OzHBCdE.exe
  2⤵
  PID:15600
- C:\Windows\System\wPIYszk.exe
  C:\Windows\System\wPIYszk.exe
  2⤵
  PID:15628
- C:\Windows\System\xFutIfJ.exe
  C:\Windows\System\xFutIfJ.exe
  2⤵
  PID:15664
- C:\Windows\System\RwQdGjr.exe
  C:\Windows\System\RwQdGjr.exe
  2⤵
  PID:15684
- C:\Windows\System\yMoKqzK.exe
  C:\Windows\System\yMoKqzK.exe
  2⤵
  PID:15704
- C:\Windows\System\leLiOEG.exe
  C:\Windows\System\leLiOEG.exe
  2⤵
  PID:15720
- C:\Windows\System\WismtPI.exe
  C:\Windows\System\WismtPI.exe
  2⤵
  PID:15756
- C:\Windows\System\EEUIorA.exe
  C:\Windows\System\EEUIorA.exe
  2⤵
  PID:15800
- C:\Windows\System\mvgwEKH.exe
  C:\Windows\System\mvgwEKH.exe
  2⤵
  PID:15848
- C:\Windows\System\sOpLAqL.exe
  C:\Windows\System\sOpLAqL.exe
  2⤵
  PID:15884
- C:\Windows\System\XYxwyHq.exe
  C:\Windows\System\XYxwyHq.exe
  2⤵
  PID:15900
- C:\Windows\System\PDTYzYc.exe
  C:\Windows\System\PDTYzYc.exe
  2⤵
  PID:15916
- C:\Windows\System\bKwYdLc.exe
  C:\Windows\System\bKwYdLc.exe
  2⤵
  PID:15940
- C:\Windows\System\fsfpspv.exe
  C:\Windows\System\fsfpspv.exe
  2⤵
  PID:15980
- C:\Windows\System\zFmUqdc.exe
  C:\Windows\System\zFmUqdc.exe
  2⤵
  PID:16000
- C:\Windows\System\WKcrGbF.exe
  C:\Windows\System\WKcrGbF.exe
  2⤵
  PID:16024
- C:\Windows\System\HldMXDL.exe
  C:\Windows\System\HldMXDL.exe
  2⤵
  PID:16060
- C:\Windows\System\JgQapuL.exe
  C:\Windows\System\JgQapuL.exe
  2⤵
  PID:16104
- C:\Windows\System\LLsISzo.exe
  C:\Windows\System\LLsISzo.exe
  2⤵
  PID:16124
- C:\Windows\System\zElECVF.exe
  C:\Windows\System\zElECVF.exe
  2⤵
  PID:16156
- C:\Windows\System\dFfkszp.exe
  C:\Windows\System\dFfkszp.exe
  2⤵
  PID:16184
- C:\Windows\System\bqUKcim.exe
  C:\Windows\System\bqUKcim.exe
  2⤵
  PID:16216
- C:\Windows\System\TFhUgYd.exe
  C:\Windows\System\TFhUgYd.exe
  2⤵
  PID:16236
- C:\Windows\System\bIpjFFG.exe
  C:\Windows\System\bIpjFFG.exe
  2⤵
  PID:16256
- C:\Windows\System\tvWWCXF.exe
  C:\Windows\System\tvWWCXF.exe
  2⤵
  PID:16272
- C:\Windows\System\CkwDShO.exe
  C:\Windows\System\CkwDShO.exe
  2⤵
  PID:16320
- C:\Windows\System\qQvWXLG.exe
  C:\Windows\System\qQvWXLG.exe
  2⤵
  PID:16356
- C:\Windows\System\lsPiNPb.exe
  C:\Windows\System\lsPiNPb.exe
  2⤵
  PID:16376
- C:\Windows\System\rcJfETe.exe
  C:\Windows\System\rcJfETe.exe
  2⤵
  PID:15368
- C:\Windows\System\vZfvIGX.exe
  C:\Windows\System\vZfvIGX.exe
  2⤵
  PID:14952
- C:\Windows\System\OTTYPHF.exe
  C:\Windows\System\OTTYPHF.exe
  2⤵
  PID:15500
- C:\Windows\System\YhFLJwB.exe
  C:\Windows\System\YhFLJwB.exe
  2⤵
  PID:15512
- C:\Windows\System\TnoMIbh.exe
  C:\Windows\System\TnoMIbh.exe
  2⤵
  PID:15636
- C:\Windows\System\zLCuZaw.exe
  C:\Windows\System\zLCuZaw.exe
  2⤵
  PID:15660
- C:\Windows\System\OfddqxH.exe
  C:\Windows\System\OfddqxH.exe
  2⤵
  PID:15700
- C:\Windows\System\gCgbWqI.exe
  C:\Windows\System\gCgbWqI.exe
  2⤵
  PID:15744
- C:\Windows\System\jkEpNgO.exe
  C:\Windows\System\jkEpNgO.exe
  2⤵
  PID:15876
- C:\Windows\System\CoqeBvK.exe
  C:\Windows\System\CoqeBvK.exe
  2⤵
  PID:15932
- C:\Windows\System\PHtwyrB.exe
  C:\Windows\System\PHtwyrB.exe
  2⤵
  PID:15952
- C:\Windows\System\DWTsSYV.exe
  C:\Windows\System\DWTsSYV.exe
  2⤵
  PID:15988
- C:\Windows\System\XkqzqqI.exe
  C:\Windows\System\XkqzqqI.exe
  2⤵
  PID:16092
- C:\Windows\System\LDNoDUM.exe
  C:\Windows\System\LDNoDUM.exe
  2⤵
  PID:16172
- C:\Windows\System\UEDfAVA.exe
  C:\Windows\System\UEDfAVA.exe
  2⤵
  PID:16208
- C:\Windows\System\MhIAMbe.exe
  C:\Windows\System\MhIAMbe.exe
  2⤵
  PID:16252
- C:\Windows\System\ubrQfyZ.exe
  C:\Windows\System\ubrQfyZ.exe
  2⤵
  PID:16312
- C:\Windows\System\ZYnrqCU.exe
  C:\Windows\System\ZYnrqCU.exe
  2⤵
  PID:16372
- C:\Windows\System\osZDIeI.exe
  C:\Windows\System\osZDIeI.exe
  2⤵
  PID:15420
- C:\Windows\System\xpbVMln.exe
  C:\Windows\System\xpbVMln.exe
  2⤵
  PID:15560
- C:\Windows\System\sbOtEsP.exe
  C:\Windows\System\sbOtEsP.exe
  2⤵
  PID:15540
- C:\Windows\System\RfACmFG.exe
  C:\Windows\System\RfACmFG.exe
  2⤵
  PID:15740
- C:\Windows\System\RXQPscX.exe
  C:\Windows\System\RXQPscX.exe
  2⤵
  PID:16192
- C:\Windows\System\Emmribv.exe
  C:\Windows\System\Emmribv.exe
  2⤵
  PID:15204
- C:\Windows\System\cKWfzDk.exe
  C:\Windows\System\cKWfzDk.exe
  2⤵
  PID:15680
- C:\Windows\System\SBzXLjn.exe
  C:\Windows\System\SBzXLjn.exe
  2⤵
  PID:15692
- C:\Windows\System\JMHqMUH.exe
  C:\Windows\System\JMHqMUH.exe
  2⤵
  PID:16396
- C:\Windows\System\VbsVHIO.exe
  C:\Windows\System\VbsVHIO.exe
  2⤵
  PID:16416
- C:\Windows\System\VWCjnbl.exe
  C:\Windows\System\VWCjnbl.exe
  2⤵
  PID:16444
- C:\Windows\System\NewlMgs.exe
  C:\Windows\System\NewlMgs.exe
  2⤵
  PID:16460
- C:\Windows\System\vCEEHez.exe
  C:\Windows\System\vCEEHez.exe
  2⤵
  PID:16476
- C:\Windows\System\ubeXlkf.exe
  C:\Windows\System\ubeXlkf.exe
  2⤵
  PID:16504
- C:\Windows\System\hyNnExc.exe
  C:\Windows\System\hyNnExc.exe
  2⤵
  PID:16532
- C:\Windows\System\HpYovvl.exe
  C:\Windows\System\HpYovvl.exe
  2⤵
  PID:16548
- C:\Windows\System\viHepTP.exe
  C:\Windows\System\viHepTP.exe
  2⤵
  PID:16580
- C:\Windows\System\JmfNvNy.exe
  C:\Windows\System\JmfNvNy.exe
  2⤵
  PID:16600
- C:\Windows\System\gWXWoNs.exe
  C:\Windows\System\gWXWoNs.exe
  2⤵
  PID:16632
- C:\Windows\System\dmdgHvC.exe
  C:\Windows\System\dmdgHvC.exe
  2⤵
  PID:16648
- C:\Windows\System\nfGIdPd.exe
  C:\Windows\System\nfGIdPd.exe
  2⤵
  PID:16672
- C:\Windows\System\isuCWli.exe
  C:\Windows\System\isuCWli.exe
  2⤵
  PID:16720
- C:\Windows\System\balbjiT.exe
  C:\Windows\System\balbjiT.exe
  2⤵
  PID:16756
- C:\Windows\System\pCLCBkJ.exe
  C:\Windows\System\pCLCBkJ.exe
  2⤵
  PID:16776
- C:\Windows\System\OtGbKHl.exe
  C:\Windows\System\OtGbKHl.exe
  2⤵
  PID:16804
- C:\Windows\System\WtIUbnD.exe
  C:\Windows\System\WtIUbnD.exe
  2⤵
  PID:16828
- C:\Windows\System\HZlaACK.exe
  C:\Windows\System\HZlaACK.exe
  2⤵
  PID:16856
- C:\Windows\System\bezsMon.exe
  C:\Windows\System\bezsMon.exe
  2⤵
  PID:16876
- C:\Windows\System\TaVtkNB.exe
  C:\Windows\System\TaVtkNB.exe
  2⤵
  PID:16892
- C:\Windows\System\PTFkJBv.exe
  C:\Windows\System\PTFkJBv.exe
  2⤵
  PID:16924

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:17280

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\GokwgwF.exe

Filesize
985KB

MD5
7484fed4f5754b8cff0182a05b98b0ca

SHA1
0a14b1f2f8f018e192dc49699da2c66f363586d3

SHA256
b8dfb767d754efce106b9b0449c15a30b68c99fdd7822bd6ba8b9f903de4715e

SHA512
4a25ecfbfce14f9a28f761a32c7ce59ca908957e5c2ce6c162dbbc610ea23e260a48d086839af01d0882ced53c517083cc173e7fc2d75007a69d7d1f401288eb

Download Submit
C:\Windows\System\JuZGaaO.exe

Filesize
984KB

MD5
2fcfa6c146167ab8507aac56391cba0c

SHA1
4413a4a6d0cabf83d0cec3827a4bc2d4da44a6d5

SHA256
38da4b715266bfb95e9922426119adcb9cc41bece46340053ed3225daadccd9a

SHA512
e6de76da6f98dc9dc1c6ced2b7091a26e4b69560f587d585e3a2e8d365057118c9504589fc52657b66ffcd3a37243cf53df1c147db5a23a15fd59616fcd2af49

Download Submit
C:\Windows\System\MtxsvMU.exe

Filesize
987KB

MD5
7c50f364ef67bd81e306dc39e10b32fb

SHA1
00b7441c5300a1cf67342960ea4bf91d3694c085

SHA256
e788da4812937cc1a7f8d7330ce15b191b45d87aaf03af2a449ec83b5e871843

SHA512
88d5590f9c98ed5a943b92bdbc2d3c37ff1ab3332fbfb0b97c7315f521099392f2e186caa4146dd86b2498f27fd6993547a52f61b736d33571116c0c180a552d

Download Submit
C:\Windows\System\QxIObCD.exe

Filesize
982KB

MD5
b055158f44c5b130bd6879eeeef2bacb

SHA1
646eb05b9fdc3b7f9cb46503a2f8dd2835dc24ab

SHA256
b7982bb62cb7b43d9c50118a16ac75c2e97ae797e5ae37156111efc8c8d48db0

SHA512
098c24229fb1c08892c3e47c6f77ae46c5d0bdddc9c0a0acc811a7bb0b41c41733f1a8ea6d96c51d1bf97b265922d296ce063d7eb38fedf00e766bd684af0023

Download Submit
C:\Windows\System\TYDBzmA.exe

Filesize
987KB

MD5
03c27fbf00c96e7341c70cc2ef99affe

SHA1
28aa6e002e2ee6739a07547d508c5806348e942c

SHA256
ad2bc614d3893aca422d2215668ecd332ffaa206ea4de8c1de4797750ae8a2c1

SHA512
d47164a7887277acf9275740cf6f559ba952e74bfe8dc4c20188bd49bba9fa40e1d56a6b131fa2237e89b98ac76d568cae6240e1de6a83993e4901169763d598

Download Submit
C:\Windows\System\XwkQIIx.exe

Filesize
986KB

MD5
9ac573239959abc529df6c7b5eaea631

SHA1
50786affc085f725eca1640fc8a6b4cb13964035

SHA256
63de0d73216738a05efc55fa756b7ccf709b15c51788fdf6ceb6be6a897467ed

SHA512
507b9df2ff93ad7ef59632dd8f685a8393740a3fcbde9c5c8ffbd160688030a1f000f6c797f61c6ca2e0a1c2350d6d3b33c295748ae5345a21ca9bc30e7460b9

Download Submit
C:\Windows\System\YazRsXe.exe

Filesize
982KB

MD5
431e80179dfe28aa41bb144a11f1263d

SHA1
3a1d956bf3c73ca7275127da4702d573288c8ba3

SHA256
a822e70e251fb3a974150bd27689c8ab7dbffbd698dd3fa933b94a38ed834d44

SHA512
38246deec6020046160baeb81acbaa87103729129c24e94f1befdd1c1ad48f9a99b9bc61a7a1454e2ea81eb6f4cfb3ead29362c648787074d62d0befb460cb18

Download Submit
C:\Windows\System\YkcAuBq.exe

Filesize
988KB

MD5
d3c77c0c2e524427b8b78f0a07a78be4

SHA1
9e2184c0d3c9915189d149fbdbb9aa37059c8404

SHA256
65d2a1e70abb21fb50939baf431da0f625d20d72ad4d9c947a84c60dc9234f6f

SHA512
d1d83a8f003de8b3d2b62d563c2493db15d8944c05078c0d5f11212f4cf2431bfff6a16c036362cd077874222ca53b45c5d6e13652465bcfde078883ceda71aa

Download Submit
C:\Windows\System\YzBWGOM.exe

Filesize
988KB

MD5
24823e7c21ea52cfed35dd9946f25bb3

SHA1
6b7c28703655f8536db23360f8952a656d8b087c

SHA256
b31233091cede966fc61ac8cf67aaaecb3cf2a4989500b45095afed6055b3ac7

SHA512
2106f05e4c05837c54564267206db3193ead556f8c46dbd4cfea8d87b615b592da82c97a3a72e09ec670c10093887d1cdfbb98ceb6bfa8659a6bae72aa4ed74f

Download Submit
C:\Windows\System\ZNqdSNa.exe

Filesize
980KB

MD5
2925babac8be31b2c855a5ec2b8bc803

SHA1
20a8a38ece862e3dc368520343781e46d40ac343

SHA256
69a2d8d633050feef9b3753595933c09121ca7f2885915126da96343deb5c60d

SHA512
0d3597078ef5f9233fc516aca63829a9fa950c11ef371c5dd3b992532e518fd42a011c32cd222b88bf03efef28823aac92a7b15dd579d18210773ee543efdac2

Download Submit
C:\Windows\System\aFPPGeD.exe

Filesize
985KB

MD5
5bfb623ea20333d2d01a0bfb4cf30858

SHA1
f638b894caf364da9ea536a6853f98e43659358a

SHA256
8bd3ba8688382c02adedf3da70b1d1d0855207854a0323bfc0bb0ce73925580a

SHA512
b23529712b8887a922fba97ff58dd33db87b57eb1583d1127ba5d9a714bc965bd7241f4f23e6b1f7f91a300b2f4b04147a8a89f3daf82bf0d1fa11ff51def492

Download Submit
C:\Windows\System\buOMHko.exe

Filesize
986KB

MD5
45e1c0b0570779c4fcd6afbd33195ca6

SHA1
dc91d5de98eccf34caf56709b61097f423effeb6

SHA256
ab874c77a6784baa3f171f603718dd4ed35021b711e32e2abb5b0dc695d8c7a8

SHA512
50bcf6d0aa4ee21287510e1b82978b19aca2b85f42c37febc97479691ce52f983feb71676dcd45fbd1e04e2711ed85ac7679385510aeaf762664845741878472

Download Submit
C:\Windows\System\cbPEXEc.exe

Filesize
985KB

MD5
471b4fb81914d571e925f435a8a5e517

SHA1
b46df38bc81c865fd92be54f656f01499336887b

SHA256
a138776bfd35d76ebb15df5d3bad049a2a1f3e4887eda9fd5009c2ac7c85a38c

SHA512
f54a60442b967b02772457ac98e2102272a0defc58b29c1572ff1186e2dba0220c8e4c5e17ff2fccbea08bb0bf5b5c5299be9d4672d6f05ae12a365b486d86d0

Download Submit
C:\Windows\System\dnKjRIG.exe

Filesize
981KB

MD5
05673c3cef1235a96007223109fb7414

SHA1
7af2af1f6c4c9f43316ea010d38a1afbb4e9e68d

SHA256
e84429724b3db2187dacf0014670b46a02a82776dd1b3765401106a577399586

SHA512
3e960bca24857915762dd425216d4390badea0ca0d72b0de5d4468e3eead3d8b254c5e2349b49933b8aa0ce5f36da4065fead50ca52ad0d13f1a723346191665

Download Submit
C:\Windows\System\eBJtNKS.exe

Filesize
982KB

MD5
e7c1e916f2365bb9020ce8f1db6c7d1d

SHA1
66df692c41ea7f63958767b5502e99b4d9c0aa0f

SHA256
b847cb43766cf6adc7ad23fdefe266ed0e2e754896d5597e6fd4f066deaaa9d7

SHA512
afc6a870c916541c966a38d3f771950122b1fe0ac6b85fdd4d4fa3e2ba0ef8764e41aabae1903beca2fc8f25907e276ac0f4aa8420e42c0d4660e0f1e9a534b2

Download Submit
C:\Windows\System\eTnHrPB.exe

Filesize
980KB

MD5
09114cb254e6df13bd3f2b2ea4606805

SHA1
e0f1fa396c7c0396046214f712a67852505504bc

SHA256
88918ac09bef4a2c0e82bcf81956dcc602b4289c740d4f2bcfa57e729cafb35f

SHA512
345e57ed001c4b8160a3436488bdf49336d39697d4aca6b9d70166c9ad03ffcc75c8c2892c4e661bdf4b3a4319c20b20f94af356151a35dd524bebb64e3879b1

Download Submit
C:\Windows\System\esgQfOm.exe

Filesize
987KB

MD5
3218039e4d22bc798186e35d2b2e3849

SHA1
7e64cf965d5da043d80b36eeae7b6f43ab57ad55

SHA256
7ac15ca2b16d8341f75d2810cbad245bbce5a7cba0cd720090c02f0e2ba0fab8

SHA512
f7a0f431318ca62606de731c9960abc95cda70cde96f7759b81a243b7383e3cc02852bbf25e1686318e70cec2c6f96add724e4878cf2b6d035d6a13b518ddd60

Download Submit
C:\Windows\System\eumnOGT.exe

Filesize
986KB

MD5
0cdf114a4a28981090745b1271beb904

SHA1
bb7b5071aeb0851ff0aa67dba9ec9e7adb3c95e4

SHA256
1b2bbb62680c42e213f4ef5a55a9964a38d14c03d97401e44b54802972cef543

SHA512
4313a737283e642b51361bc99112d4d2b812b38b627dd980b5c387a4d2ebfc90ca966b026f2765464f4799191e8d4b584e7c9ef022f0ffbf48232dcca1c7ab8e

Download Submit
C:\Windows\System\hezpiVc.exe

Filesize
985KB

MD5
f913d92b4848017093e152cd07e471a5

SHA1
c225004f56be85cbf691c290569f370d1cb1d954

SHA256
20bdf5c022737d57fb7620381f869982306cd4298c91a0df0c9ea9044cc10a0b

SHA512
7eeb11fb4fe92df0d332a96766593cc9d1f6030bdeac1c987cca381989bd206d9f0653e29cbad23510074ff79a57d1cfff55fc7ba06049854ce8c623ffe5f582

Download Submit
C:\Windows\System\icAOhBD.exe

Filesize
984KB

MD5
4ff9c6f53c75f8a03e26891275f5bab5

SHA1
22ef3b986473903474f7b34be9c4d2f16253e3f5

SHA256
466eed27b7831eb2c08dec517bd94a39f44e9ad10698941b83b0c1a06e3eb8a8

SHA512
0bcef9f0bc81ee8f29e881935f90ab7de67b47ac81dba846b405052a1ceaffd70909c8bd7469ce12ec8246edb526b79dbd04891f04b49074c1861a4ab0d743d3

Download Submit
C:\Windows\System\ikjjgfe.exe

Filesize
984KB

MD5
23ef29fe9200e412341a9a2695db4079

SHA1
734273a661b50df81ae31f54477ddc72e428a137

SHA256
9fd97ffcd1ae79288abcac2c0f468ec0269da8191eeec7259aacd0c0347883ce

SHA512
c713b9924a5c37ff46e2f17f2714c6278d55b7391dd1245adaf00c7d973923b8cc9967fa44ce6739557c1cc284d2cc4b84634f7eecddcf1a957c78977f7d121e

Download Submit
C:\Windows\System\jaJLRBO.exe

Filesize
982KB

MD5
455317f25a481d82280cd32060d3e209

SHA1
b60ce30d1f43c5d9403187f0693c23bfd54772f7

SHA256
59c22cd8376c9e956e403b82d671ad2621f215f40a27be3b38798cbd5d5b6df6

SHA512
9f716f33e3ddf4c4dde63cc243a78824e8fb085bb594cfd6e24f0718723013b21a15b7315631fd18f1aa5ce4086ccbcea6dc2472957b1a4a10579a1f2b40b8b3

Download Submit
C:\Windows\System\lhdQcKv.exe

Filesize
983KB

MD5
80b7890b60bcde9f388d7940e1d1af30

SHA1
6f8b1ad0e567be4f3599e6a13683151fe2602b45

SHA256
bbd91afab3a7d0e36957537d78e23358129597a3ce8223fedbedab06503ae514

SHA512
35088b6c2db2aeadeaf12bf73ffe1c0176bd97cf6cb57dbbed170ac64546d82768afed0d96ac8cec34a646350d9fa73a59cc005294554846145f5045b3b6298f

Download Submit
C:\Windows\System\lqGmsmk.exe

Filesize
986KB

MD5
63be6d2eb48a8a44230d5d3799e49568

SHA1
a2543916b7fa7f3d58a2b2fc0200f4f460cc65c0

SHA256
0f5cfab596a0aafe300e1aa69648af6a4a6f516f62f064a1d8684ed03837245e

SHA512
5255a6b0569839ecc67feab26784608a2030a63f314bc921b7d20057e32d7ac6164df95781f20c8035bdb5365261fe63311c0efe6b65a5c09357dd9c9881a7a9

Download Submit
C:\Windows\System\lzTMWLT.exe

Filesize
981KB

MD5
6d16401fce4511a01d1045a22575fd63

SHA1
511f9fa69e885b6945c829a55b0ef66877fb9555

SHA256
54466ea3e5da8571e4c081d6f7f1b8f4d72ebf7b9fa8777f17d3acf67e2e5b2c

SHA512
b94593c5ee7116826eb4ac2ac441d378eab9b21239b5eb0e125212d7fce969a683bf0f73d99b78717a41a14202122138c8852c10a71452396bd2fdcfa8306e37

Download Submit
C:\Windows\System\mVtDUTo.exe

Filesize
984KB

MD5
e77ad491ddc6b3282fe86ec75c7dfccf

SHA1
c24e102838dc8e7290c39633a74ed82ee817d23d

SHA256
202c61d01b27d412b0618cc7478e8ebe903e1d6f69625ad0efd9cf0c4521194f

SHA512
513ec9b5aac6925694cd5a47399f8ab576994401f33513cea4926da7a78f39e771305fe1a6cded3cb57cf47ea7f26de9be79d550bc6336c0d1d45d2e77243bac

Download Submit
C:\Windows\System\nWoPoQY.exe

Filesize
983KB

MD5
5a6f79f05d3963da8dfb5dd8b8df8ad5

SHA1
5f6cb2dc76e5a89529ee0bb5649079187c6e1c5b

SHA256
2f20303f8e9d812d6d978f0ed5873ee3b53de54a074f3763610249d2187651c1

SHA512
3b8365455eecdce35154d59b5cedcfe68d928c529c0cca63f6f1af34fa0f2df504acebe9bccd560f04a1ae018b53a86dc7921db595d051a42c918acd645d11a0

Download Submit
C:\Windows\System\oqPZwnE.exe

Filesize
987KB

MD5
65691e97f9aa8259d07d719fdc6dc4f3

SHA1
72f4ab0eb17825c1b293729c9de5946d9ed26e63

SHA256
f031bdb4d03b0675e44e2ebfc40ee16cb493c8a057b906bf9b8d91c65b8e6be4

SHA512
f38ec55ef086c94d4911d92b9205ab68c3a592df87fcc51e814f587cfe3c0b6e53b96388fdd1176b66f71182371726eec20232fb40121599d39a0ee3c5777aa3

Download Submit
C:\Windows\System\sOwmfSB.exe

Filesize
986KB

MD5
4cefde34bafc98cf011fcd6b7f25f569

SHA1
734bed2fc77fe2b691be4b4cb427f714c2580b4c

SHA256
6ed0ed2350b714b7ab155711e0a37e69d4822d82ef5443ee00375345a8baa372

SHA512
ff0614a4dfc4afdad82bef1f8506e707c95258627471e0652c1bc1c4b7095dd0cbb02d74f7570a680ef38a82550f2e7510e1519a94bc03da40290f18dd2d1042

Download Submit
C:\Windows\System\ugLeeXi.exe

Filesize
983KB

MD5
290f3e0f3f55ecce255c39b7370eeab3

SHA1
bd21182910548066126f7a52b0d9051048e636b9

SHA256
df28e0fc15a787968efca03e33ef9d406f51e8771354ff57517de7492da212d4

SHA512
449ca50a0f7cc3b392aed14161139547f5d175290b8f26a8ba66f1ae9edde81862f1a54690765859a23bc589f020aba10b6ebd22b81b79dba895aa39329fa5d2

Download Submit
C:\Windows\System\vEQxSwf.exe

Filesize
983KB

MD5
1ff5be8404e637114248f7460548f3b3

SHA1
4cfbede7200a16e1345266c5b5a91a1a316d76bc

SHA256
13c2a06b065e778b46d54a4b824ed3c5855b808dc9856b153c5a53b9c675dd88

SHA512
5eb73ad318527cb7b9aedaf69b57eb2e43fe3fcff2f1988051d93265549cefef0b87b03cb82cae80aac5911580e6b2c283920c04cefeb8aa2ad231023ed97084

Download Submit
C:\Windows\System\xxDcwBh.exe

Filesize
981KB

MD5
6273026685b74951d6343fb15ff9ab15

SHA1
2100f8c8392dfacde1a52c24a6068aa517843f2b

SHA256
d6a705affd97c467e248ba42e50edb478ddc3ddb2495e28b7bcfff99782a165f

SHA512
58413fce8a3d23b4c6435169e23180388109ba4bf68983f4be82bdf23b18914932990a5aa195382288d30e426bf79ff9092bceb02ae9cba1f16bc20ec921ee55

Download Submit
C:\Windows\System\yEgqsID.exe

Filesize
981KB

MD5
b03c0a0abbef032c57899becd8d37188

SHA1
9647652ccc9f2b613ad71765b4ddc97046ef4947

SHA256
731881e1fe43d29b9805229d15664096ceb924d90046407c4c5cc21d99e7e2d7

SHA512
6bb6cdf5ac691dc0b402af3c9758c44d977c9396deeee72a85adbae02a5abbca8eb6a76d4c818e3426b62d5cd04a98c8889a0898c890705e5192f680b29284d1

Download Submit
memory/2180-0-0x000001A3195C0000-0x000001A3195D0000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads