xmrig | 4e961d93afc393f8ec31348308dbf0e6a604ff0757704cb3054aac577e6f49b0

Analysis

max time kernel
107s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
25/01/2025, 22:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4e961d93afc393f8ec31348308dbf0e6a604ff0757704cb3054aac577e6f49b0.exe
Size

1.6MB
MD5

143167d2d7749e040c652f23eedf9664
SHA1

e7642c4ef0922f9eac7576497e21f5fcff8eee51
SHA256

4e961d93afc393f8ec31348308dbf0e6a604ff0757704cb3054aac577e6f49b0
SHA512

424af45f8793dd292240742c179801284cf46a6393e983edb2b69a5e996ddc0314d8617be426f7705d39681026a10903b374b4b60c916046ac8152d754c3431c
SSDEEP

49152:GezaTF8FcNkNdfE0pZ9ozttwIRxj4c5yUT3Uea:GemTLkNdfE0pZyi

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 33 IoCs

miner

resource	yara_rule
behavioral2/files/0x0010000000023ba3-4.dat	xmrig
behavioral2/files/0x0008000000023c85-9.dat	xmrig
behavioral2/files/0x0007000000023c89-8.dat	xmrig
behavioral2/files/0x0007000000023c8a-19.dat	xmrig
behavioral2/files/0x0007000000023c8c-29.dat	xmrig
behavioral2/files/0x0007000000023c8d-33.dat	xmrig
behavioral2/files/0x0007000000023c94-67.dat	xmrig
behavioral2/files/0x0007000000023c9c-108.dat	xmrig
behavioral2/files/0x0007000000023ca2-136.dat	xmrig
behavioral2/files/0x0007000000023ca6-156.dat	xmrig
behavioral2/files/0x0007000000023ca7-161.dat	xmrig
behavioral2/files/0x0007000000023ca5-159.dat	xmrig
behavioral2/files/0x0007000000023ca4-154.dat	xmrig
behavioral2/files/0x0007000000023ca3-149.dat	xmrig
behavioral2/files/0x0007000000023ca1-139.dat	xmrig
behavioral2/files/0x0007000000023ca0-134.dat	xmrig
behavioral2/files/0x0007000000023c9f-129.dat	xmrig
behavioral2/files/0x0007000000023c9e-124.dat	xmrig
behavioral2/files/0x0007000000023c9d-119.dat	xmrig
behavioral2/files/0x0007000000023c9b-106.dat	xmrig
behavioral2/files/0x0007000000023c9a-102.dat	xmrig
behavioral2/files/0x0007000000023c99-96.dat	xmrig
behavioral2/files/0x0007000000023c98-92.dat	xmrig
behavioral2/files/0x0007000000023c97-87.dat	xmrig
behavioral2/files/0x0007000000023c96-81.dat	xmrig
behavioral2/files/0x0007000000023c95-77.dat	xmrig
behavioral2/files/0x0007000000023c93-70.dat	xmrig
behavioral2/files/0x0007000000023c92-64.dat	xmrig
behavioral2/files/0x0007000000023c91-59.dat	xmrig
behavioral2/files/0x0007000000023c90-49.dat	xmrig
behavioral2/files/0x0007000000023c8f-44.dat	xmrig
behavioral2/files/0x0007000000023c8e-39.dat	xmrig
behavioral2/files/0x0007000000023c8b-23.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
4664	LKctuKo.exe
5092	TSeofhI.exe
4984	BSTKUuk.exe
4836	QItmWbc.exe
4572	hWayLMo.exe
4856	ZYYmNSb.exe
1204	LiQvyae.exe
4816	FEdJGPY.exe
4540	wXMmLkR.exe
4948	Mvkjpct.exe
2224	jnFzSyx.exe
2268	FwwWFaB.exe
1676	ZpXHZIx.exe
1584	LkhauIx.exe
5080	lyysFkT.exe
3708	hUiboSe.exe
5028	srOZqXY.exe
3064	NDJCEls.exe
3184	ALfRwbt.exe
3512	eHDcrwT.exe
316	SlICEZm.exe
1528	dgpaCPK.exe
3124	cCxGloy.exe
3732	bXPpKJp.exe
3792	fQxllaB.exe
1932	iYGHdNi.exe
2596	ItfBtzv.exe
1628	tFRruPG.exe
2696	NypOcNX.exe
692	MpVtkWz.exe
896	sHjRqbl.exe
2612	kwKCLzb.exe
3568	ZyvFAkq.exe
2656	XDyssIW.exe
2984	wSENiTw.exe
4136	UKPKuyk.exe
4060	jMJrVyF.exe
2848	VEvWViN.exe
1708	DDFoGlF.exe
364	JLLFsrw.exe
428	nnXdbqQ.exe
3484	abxgJgg.exe
4580	qHaZbQv.exe
2364	WnAhftI.exe
3784	lTadunF.exe
2372	dDpNlnW.exe
3804	EixewZJ.exe
4944	wpELnZo.exe
2944	lLFCQUX.exe
2736	uPjFxqe.exe
2804	TbgTLQC.exe
3604	ASJLMzL.exe
2276	uPalslJ.exe
4340	YwzQTrq.exe
4056	WYoVAnm.exe
3528	MmfbRMt.exe
2320	qjhMmpW.exe
2560	sSKgbGl.exe
964	ITjgTay.exe
3892	rHRuskc.exe
624	NPqDujj.exe
4980	khDyGmk.exe
2044	HnmlukV.exe
3136	UEQogts.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\yWvkqUe.exe	4e961d93afc393f8ec31348308dbf0e6a604ff0757704cb3054aac577e6f49b0.exe
File created	C:\Windows\System\eHDcrwT.exe	4e961d93afc393f8ec31348308dbf0e6a604ff0757704cb3054aac577e6f49b0.exe
File created	C:\Windows\System\DajfIjR.exe	4e961d93afc393f8ec31348308dbf0e6a604ff0757704cb3054aac577e6f49b0.exe
File created	C:\Windows\System\XYLFUIs.exe	4e961d93afc393f8ec31348308dbf0e6a604ff0757704cb3054aac577e6f49b0.exe
File created	C:\Windows\System\PnhXcXm.exe	4e961d93afc393f8ec31348308dbf0e6a604ff0757704cb3054aac577e6f49b0.exe
File created	C:\Windows\System\OYypMAw.exe	4e961d93afc393f8ec31348308dbf0e6a604ff0757704cb3054aac577e6f49b0.exe
File created	C:\Windows\System\EmtpsDE.exe	4e961d93afc393f8ec31348308dbf0e6a604ff0757704cb3054aac577e6f49b0.exe
File created	C:\Windows\System\mnIzsZu.exe	4e961d93afc393f8ec31348308dbf0e6a604ff0757704cb3054aac577e6f49b0.exe
File created	C:\Windows\System\aXtNPNL.exe	4e961d93afc393f8ec31348308dbf0e6a604ff0757704cb3054aac577e6f49b0.exe
File created	C:\Windows\System\XWfCUNO.exe	4e961d93afc393f8ec31348308dbf0e6a604ff0757704cb3054aac577e6f49b0.exe
File created	C:\Windows\System\eVAjLWh.exe	4e961d93afc393f8ec31348308dbf0e6a604ff0757704cb3054aac577e6f49b0.exe
File created	C:\Windows\System\uqxWYEp.exe	4e961d93afc393f8ec31348308dbf0e6a604ff0757704cb3054aac577e6f49b0.exe
File created	C:\Windows\System\lhdRwOM.exe	4e961d93afc393f8ec31348308dbf0e6a604ff0757704cb3054aac577e6f49b0.exe
File created	C:\Windows\System\JMOMvof.exe	4e961d93afc393f8ec31348308dbf0e6a604ff0757704cb3054aac577e6f49b0.exe
File created	C:\Windows\System\hVbUKZv.exe	4e961d93afc393f8ec31348308dbf0e6a604ff0757704cb3054aac577e6f49b0.exe
File created	C:\Windows\System\jGeMRQw.exe	4e961d93afc393f8ec31348308dbf0e6a604ff0757704cb3054aac577e6f49b0.exe
File created	C:\Windows\System\QPiwDNk.exe	4e961d93afc393f8ec31348308dbf0e6a604ff0757704cb3054aac577e6f49b0.exe
File created	C:\Windows\System\MZWStuv.exe	4e961d93afc393f8ec31348308dbf0e6a604ff0757704cb3054aac577e6f49b0.exe
File created	C:\Windows\System\TtVtYOg.exe	4e961d93afc393f8ec31348308dbf0e6a604ff0757704cb3054aac577e6f49b0.exe
File created	C:\Windows\System\UkMhggY.exe	4e961d93afc393f8ec31348308dbf0e6a604ff0757704cb3054aac577e6f49b0.exe
File created	C:\Windows\System\hKiDJRf.exe	4e961d93afc393f8ec31348308dbf0e6a604ff0757704cb3054aac577e6f49b0.exe
File created	C:\Windows\System\nkIywmS.exe	4e961d93afc393f8ec31348308dbf0e6a604ff0757704cb3054aac577e6f49b0.exe
File created	C:\Windows\System\pQEIrrV.exe	4e961d93afc393f8ec31348308dbf0e6a604ff0757704cb3054aac577e6f49b0.exe
File created	C:\Windows\System\HnmlukV.exe	4e961d93afc393f8ec31348308dbf0e6a604ff0757704cb3054aac577e6f49b0.exe
File created	C:\Windows\System\bKOLSLx.exe	4e961d93afc393f8ec31348308dbf0e6a604ff0757704cb3054aac577e6f49b0.exe
File created	C:\Windows\System\cykFvoZ.exe	4e961d93afc393f8ec31348308dbf0e6a604ff0757704cb3054aac577e6f49b0.exe
File created	C:\Windows\System\DuQxwBt.exe	4e961d93afc393f8ec31348308dbf0e6a604ff0757704cb3054aac577e6f49b0.exe
File created	C:\Windows\System\NvMUmsl.exe	4e961d93afc393f8ec31348308dbf0e6a604ff0757704cb3054aac577e6f49b0.exe
File created	C:\Windows\System\wJOoBgE.exe	4e961d93afc393f8ec31348308dbf0e6a604ff0757704cb3054aac577e6f49b0.exe
File created	C:\Windows\System\bKrGKbq.exe	4e961d93afc393f8ec31348308dbf0e6a604ff0757704cb3054aac577e6f49b0.exe
File created	C:\Windows\System\AjFquRj.exe	4e961d93afc393f8ec31348308dbf0e6a604ff0757704cb3054aac577e6f49b0.exe
File created	C:\Windows\System\gpaBHlV.exe	4e961d93afc393f8ec31348308dbf0e6a604ff0757704cb3054aac577e6f49b0.exe
File created	C:\Windows\System\MrJVcIE.exe	4e961d93afc393f8ec31348308dbf0e6a604ff0757704cb3054aac577e6f49b0.exe
File created	C:\Windows\System\cEZLJrB.exe	4e961d93afc393f8ec31348308dbf0e6a604ff0757704cb3054aac577e6f49b0.exe
File created	C:\Windows\System\jdOZTWt.exe	4e961d93afc393f8ec31348308dbf0e6a604ff0757704cb3054aac577e6f49b0.exe
File created	C:\Windows\System\eADQYVn.exe	4e961d93afc393f8ec31348308dbf0e6a604ff0757704cb3054aac577e6f49b0.exe
File created	C:\Windows\System\ILeaqNz.exe	4e961d93afc393f8ec31348308dbf0e6a604ff0757704cb3054aac577e6f49b0.exe
File created	C:\Windows\System\iDBpCjD.exe	4e961d93afc393f8ec31348308dbf0e6a604ff0757704cb3054aac577e6f49b0.exe
File created	C:\Windows\System\DJYxxKK.exe	4e961d93afc393f8ec31348308dbf0e6a604ff0757704cb3054aac577e6f49b0.exe
File created	C:\Windows\System\lmBJMOQ.exe	4e961d93afc393f8ec31348308dbf0e6a604ff0757704cb3054aac577e6f49b0.exe
File created	C:\Windows\System\bansIUt.exe	4e961d93afc393f8ec31348308dbf0e6a604ff0757704cb3054aac577e6f49b0.exe
File created	C:\Windows\System\mtnlzMG.exe	4e961d93afc393f8ec31348308dbf0e6a604ff0757704cb3054aac577e6f49b0.exe
File created	C:\Windows\System\fLnzqWm.exe	4e961d93afc393f8ec31348308dbf0e6a604ff0757704cb3054aac577e6f49b0.exe
File created	C:\Windows\System\tqcAEVF.exe	4e961d93afc393f8ec31348308dbf0e6a604ff0757704cb3054aac577e6f49b0.exe
File created	C:\Windows\System\gWGEjIW.exe	4e961d93afc393f8ec31348308dbf0e6a604ff0757704cb3054aac577e6f49b0.exe
File created	C:\Windows\System\qDAHHiD.exe	4e961d93afc393f8ec31348308dbf0e6a604ff0757704cb3054aac577e6f49b0.exe
File created	C:\Windows\System\Mvkjpct.exe	4e961d93afc393f8ec31348308dbf0e6a604ff0757704cb3054aac577e6f49b0.exe
File created	C:\Windows\System\LwBSZHe.exe	4e961d93afc393f8ec31348308dbf0e6a604ff0757704cb3054aac577e6f49b0.exe
File created	C:\Windows\System\yYNbwXR.exe	4e961d93afc393f8ec31348308dbf0e6a604ff0757704cb3054aac577e6f49b0.exe
File created	C:\Windows\System\uHwAkWo.exe	4e961d93afc393f8ec31348308dbf0e6a604ff0757704cb3054aac577e6f49b0.exe
File created	C:\Windows\System\aubHWbB.exe	4e961d93afc393f8ec31348308dbf0e6a604ff0757704cb3054aac577e6f49b0.exe
File created	C:\Windows\System\wuxjEfP.exe	4e961d93afc393f8ec31348308dbf0e6a604ff0757704cb3054aac577e6f49b0.exe
File created	C:\Windows\System\ZpXHZIx.exe	4e961d93afc393f8ec31348308dbf0e6a604ff0757704cb3054aac577e6f49b0.exe
File created	C:\Windows\System\uhIJbsD.exe	4e961d93afc393f8ec31348308dbf0e6a604ff0757704cb3054aac577e6f49b0.exe
File created	C:\Windows\System\HxibKQB.exe	4e961d93afc393f8ec31348308dbf0e6a604ff0757704cb3054aac577e6f49b0.exe
File created	C:\Windows\System\eTxYxOc.exe	4e961d93afc393f8ec31348308dbf0e6a604ff0757704cb3054aac577e6f49b0.exe
File created	C:\Windows\System\IWzeUbi.exe	4e961d93afc393f8ec31348308dbf0e6a604ff0757704cb3054aac577e6f49b0.exe
File created	C:\Windows\System\dWpFoEs.exe	4e961d93afc393f8ec31348308dbf0e6a604ff0757704cb3054aac577e6f49b0.exe
File created	C:\Windows\System\BEtcAHl.exe	4e961d93afc393f8ec31348308dbf0e6a604ff0757704cb3054aac577e6f49b0.exe
File created	C:\Windows\System\OhwWWUf.exe	4e961d93afc393f8ec31348308dbf0e6a604ff0757704cb3054aac577e6f49b0.exe
File created	C:\Windows\System\svyFXhN.exe	4e961d93afc393f8ec31348308dbf0e6a604ff0757704cb3054aac577e6f49b0.exe
File created	C:\Windows\System\NTJtYvd.exe	4e961d93afc393f8ec31348308dbf0e6a604ff0757704cb3054aac577e6f49b0.exe
File created	C:\Windows\System\menKHhG.exe	4e961d93afc393f8ec31348308dbf0e6a604ff0757704cb3054aac577e6f49b0.exe
File created	C:\Windows\System\uPjFxqe.exe	4e961d93afc393f8ec31348308dbf0e6a604ff0757704cb3054aac577e6f49b0.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	16584	dwm.exe
Token: SeChangeNotifyPrivilege	16584	dwm.exe
Token: 33	16584	dwm.exe
Token: SeIncBasePriorityPrivilege	16584	dwm.exe
Token: SeShutdownPrivilege	16584	dwm.exe
Token: SeCreatePagefilePrivilege	16584	dwm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3940 wrote to memory of 4664	3940	4e961d93afc393f8ec31348308dbf0e6a604ff0757704cb3054aac577e6f49b0.exe	84
PID 3940 wrote to memory of 4664	3940	4e961d93afc393f8ec31348308dbf0e6a604ff0757704cb3054aac577e6f49b0.exe	84
PID 3940 wrote to memory of 5092	3940	4e961d93afc393f8ec31348308dbf0e6a604ff0757704cb3054aac577e6f49b0.exe	85
PID 3940 wrote to memory of 5092	3940	4e961d93afc393f8ec31348308dbf0e6a604ff0757704cb3054aac577e6f49b0.exe	85
PID 3940 wrote to memory of 4984	3940	4e961d93afc393f8ec31348308dbf0e6a604ff0757704cb3054aac577e6f49b0.exe	86
PID 3940 wrote to memory of 4984	3940	4e961d93afc393f8ec31348308dbf0e6a604ff0757704cb3054aac577e6f49b0.exe	86
PID 3940 wrote to memory of 4836	3940	4e961d93afc393f8ec31348308dbf0e6a604ff0757704cb3054aac577e6f49b0.exe	87
PID 3940 wrote to memory of 4836	3940	4e961d93afc393f8ec31348308dbf0e6a604ff0757704cb3054aac577e6f49b0.exe	87
PID 3940 wrote to memory of 4572	3940	4e961d93afc393f8ec31348308dbf0e6a604ff0757704cb3054aac577e6f49b0.exe	88
PID 3940 wrote to memory of 4572	3940	4e961d93afc393f8ec31348308dbf0e6a604ff0757704cb3054aac577e6f49b0.exe	88
PID 3940 wrote to memory of 4856	3940	4e961d93afc393f8ec31348308dbf0e6a604ff0757704cb3054aac577e6f49b0.exe	89
PID 3940 wrote to memory of 4856	3940	4e961d93afc393f8ec31348308dbf0e6a604ff0757704cb3054aac577e6f49b0.exe	89
PID 3940 wrote to memory of 1204	3940	4e961d93afc393f8ec31348308dbf0e6a604ff0757704cb3054aac577e6f49b0.exe	90
PID 3940 wrote to memory of 1204	3940	4e961d93afc393f8ec31348308dbf0e6a604ff0757704cb3054aac577e6f49b0.exe	90
PID 3940 wrote to memory of 4816	3940	4e961d93afc393f8ec31348308dbf0e6a604ff0757704cb3054aac577e6f49b0.exe	91
PID 3940 wrote to memory of 4816	3940	4e961d93afc393f8ec31348308dbf0e6a604ff0757704cb3054aac577e6f49b0.exe	91
PID 3940 wrote to memory of 4540	3940	4e961d93afc393f8ec31348308dbf0e6a604ff0757704cb3054aac577e6f49b0.exe	92
PID 3940 wrote to memory of 4540	3940	4e961d93afc393f8ec31348308dbf0e6a604ff0757704cb3054aac577e6f49b0.exe	92
PID 3940 wrote to memory of 4948	3940	4e961d93afc393f8ec31348308dbf0e6a604ff0757704cb3054aac577e6f49b0.exe	93
PID 3940 wrote to memory of 4948	3940	4e961d93afc393f8ec31348308dbf0e6a604ff0757704cb3054aac577e6f49b0.exe	93
PID 3940 wrote to memory of 2224	3940	4e961d93afc393f8ec31348308dbf0e6a604ff0757704cb3054aac577e6f49b0.exe	94
PID 3940 wrote to memory of 2224	3940	4e961d93afc393f8ec31348308dbf0e6a604ff0757704cb3054aac577e6f49b0.exe	94
PID 3940 wrote to memory of 2268	3940	4e961d93afc393f8ec31348308dbf0e6a604ff0757704cb3054aac577e6f49b0.exe	95
PID 3940 wrote to memory of 2268	3940	4e961d93afc393f8ec31348308dbf0e6a604ff0757704cb3054aac577e6f49b0.exe	95
PID 3940 wrote to memory of 1676	3940	4e961d93afc393f8ec31348308dbf0e6a604ff0757704cb3054aac577e6f49b0.exe	96
PID 3940 wrote to memory of 1676	3940	4e961d93afc393f8ec31348308dbf0e6a604ff0757704cb3054aac577e6f49b0.exe	96
PID 3940 wrote to memory of 1584	3940	4e961d93afc393f8ec31348308dbf0e6a604ff0757704cb3054aac577e6f49b0.exe	97
PID 3940 wrote to memory of 1584	3940	4e961d93afc393f8ec31348308dbf0e6a604ff0757704cb3054aac577e6f49b0.exe	97
PID 3940 wrote to memory of 5080	3940	4e961d93afc393f8ec31348308dbf0e6a604ff0757704cb3054aac577e6f49b0.exe	98
PID 3940 wrote to memory of 5080	3940	4e961d93afc393f8ec31348308dbf0e6a604ff0757704cb3054aac577e6f49b0.exe	98
PID 3940 wrote to memory of 3708	3940	4e961d93afc393f8ec31348308dbf0e6a604ff0757704cb3054aac577e6f49b0.exe	99
PID 3940 wrote to memory of 3708	3940	4e961d93afc393f8ec31348308dbf0e6a604ff0757704cb3054aac577e6f49b0.exe	99
PID 3940 wrote to memory of 5028	3940	4e961d93afc393f8ec31348308dbf0e6a604ff0757704cb3054aac577e6f49b0.exe	100
PID 3940 wrote to memory of 5028	3940	4e961d93afc393f8ec31348308dbf0e6a604ff0757704cb3054aac577e6f49b0.exe	100
PID 3940 wrote to memory of 3064	3940	4e961d93afc393f8ec31348308dbf0e6a604ff0757704cb3054aac577e6f49b0.exe	101
PID 3940 wrote to memory of 3064	3940	4e961d93afc393f8ec31348308dbf0e6a604ff0757704cb3054aac577e6f49b0.exe	101
PID 3940 wrote to memory of 3184	3940	4e961d93afc393f8ec31348308dbf0e6a604ff0757704cb3054aac577e6f49b0.exe	102
PID 3940 wrote to memory of 3184	3940	4e961d93afc393f8ec31348308dbf0e6a604ff0757704cb3054aac577e6f49b0.exe	102
PID 3940 wrote to memory of 3512	3940	4e961d93afc393f8ec31348308dbf0e6a604ff0757704cb3054aac577e6f49b0.exe	103
PID 3940 wrote to memory of 3512	3940	4e961d93afc393f8ec31348308dbf0e6a604ff0757704cb3054aac577e6f49b0.exe	103
PID 3940 wrote to memory of 316	3940	4e961d93afc393f8ec31348308dbf0e6a604ff0757704cb3054aac577e6f49b0.exe	104
PID 3940 wrote to memory of 316	3940	4e961d93afc393f8ec31348308dbf0e6a604ff0757704cb3054aac577e6f49b0.exe	104
PID 3940 wrote to memory of 1528	3940	4e961d93afc393f8ec31348308dbf0e6a604ff0757704cb3054aac577e6f49b0.exe	105
PID 3940 wrote to memory of 1528	3940	4e961d93afc393f8ec31348308dbf0e6a604ff0757704cb3054aac577e6f49b0.exe	105
PID 3940 wrote to memory of 3124	3940	4e961d93afc393f8ec31348308dbf0e6a604ff0757704cb3054aac577e6f49b0.exe	106
PID 3940 wrote to memory of 3124	3940	4e961d93afc393f8ec31348308dbf0e6a604ff0757704cb3054aac577e6f49b0.exe	106
PID 3940 wrote to memory of 3732	3940	4e961d93afc393f8ec31348308dbf0e6a604ff0757704cb3054aac577e6f49b0.exe	107
PID 3940 wrote to memory of 3732	3940	4e961d93afc393f8ec31348308dbf0e6a604ff0757704cb3054aac577e6f49b0.exe	107
PID 3940 wrote to memory of 3792	3940	4e961d93afc393f8ec31348308dbf0e6a604ff0757704cb3054aac577e6f49b0.exe	108
PID 3940 wrote to memory of 3792	3940	4e961d93afc393f8ec31348308dbf0e6a604ff0757704cb3054aac577e6f49b0.exe	108
PID 3940 wrote to memory of 1932	3940	4e961d93afc393f8ec31348308dbf0e6a604ff0757704cb3054aac577e6f49b0.exe	109
PID 3940 wrote to memory of 1932	3940	4e961d93afc393f8ec31348308dbf0e6a604ff0757704cb3054aac577e6f49b0.exe	109
PID 3940 wrote to memory of 2596	3940	4e961d93afc393f8ec31348308dbf0e6a604ff0757704cb3054aac577e6f49b0.exe	110
PID 3940 wrote to memory of 2596	3940	4e961d93afc393f8ec31348308dbf0e6a604ff0757704cb3054aac577e6f49b0.exe	110
PID 3940 wrote to memory of 1628	3940	4e961d93afc393f8ec31348308dbf0e6a604ff0757704cb3054aac577e6f49b0.exe	111
PID 3940 wrote to memory of 1628	3940	4e961d93afc393f8ec31348308dbf0e6a604ff0757704cb3054aac577e6f49b0.exe	111
PID 3940 wrote to memory of 2696	3940	4e961d93afc393f8ec31348308dbf0e6a604ff0757704cb3054aac577e6f49b0.exe	112
PID 3940 wrote to memory of 2696	3940	4e961d93afc393f8ec31348308dbf0e6a604ff0757704cb3054aac577e6f49b0.exe	112
PID 3940 wrote to memory of 692	3940	4e961d93afc393f8ec31348308dbf0e6a604ff0757704cb3054aac577e6f49b0.exe	113
PID 3940 wrote to memory of 692	3940	4e961d93afc393f8ec31348308dbf0e6a604ff0757704cb3054aac577e6f49b0.exe	113
PID 3940 wrote to memory of 896	3940	4e961d93afc393f8ec31348308dbf0e6a604ff0757704cb3054aac577e6f49b0.exe	114
PID 3940 wrote to memory of 896	3940	4e961d93afc393f8ec31348308dbf0e6a604ff0757704cb3054aac577e6f49b0.exe	114
PID 3940 wrote to memory of 2612	3940	4e961d93afc393f8ec31348308dbf0e6a604ff0757704cb3054aac577e6f49b0.exe	115
PID 3940 wrote to memory of 2612	3940	4e961d93afc393f8ec31348308dbf0e6a604ff0757704cb3054aac577e6f49b0.exe	115

C:\Users\Admin\AppData\Local\Temp\4e961d93afc393f8ec31348308dbf0e6a604ff0757704cb3054aac577e6f49b0.exe
"C:\Users\Admin\AppData\Local\Temp\4e961d93afc393f8ec31348308dbf0e6a604ff0757704cb3054aac577e6f49b0.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3940
- C:\Windows\System\LKctuKo.exe
  C:\Windows\System\LKctuKo.exe
  2⤵
  - Executes dropped EXE
  PID:4664
- C:\Windows\System\TSeofhI.exe
  C:\Windows\System\TSeofhI.exe
  2⤵
  - Executes dropped EXE
  PID:5092
- C:\Windows\System\BSTKUuk.exe
  C:\Windows\System\BSTKUuk.exe
  2⤵
  - Executes dropped EXE
  PID:4984
- C:\Windows\System\QItmWbc.exe
  C:\Windows\System\QItmWbc.exe
  2⤵
  - Executes dropped EXE
  PID:4836
- C:\Windows\System\hWayLMo.exe
  C:\Windows\System\hWayLMo.exe
  2⤵
  - Executes dropped EXE
  PID:4572
- C:\Windows\System\ZYYmNSb.exe
  C:\Windows\System\ZYYmNSb.exe
  2⤵
  - Executes dropped EXE
  PID:4856
- C:\Windows\System\LiQvyae.exe
  C:\Windows\System\LiQvyae.exe
  2⤵
  - Executes dropped EXE
  PID:1204
- C:\Windows\System\FEdJGPY.exe
  C:\Windows\System\FEdJGPY.exe
  2⤵
  - Executes dropped EXE
  PID:4816
- C:\Windows\System\wXMmLkR.exe
  C:\Windows\System\wXMmLkR.exe
  2⤵
  - Executes dropped EXE
  PID:4540
- C:\Windows\System\Mvkjpct.exe
  C:\Windows\System\Mvkjpct.exe
  2⤵
  - Executes dropped EXE
  PID:4948
- C:\Windows\System\jnFzSyx.exe
  C:\Windows\System\jnFzSyx.exe
  2⤵
  - Executes dropped EXE
  PID:2224
- C:\Windows\System\FwwWFaB.exe
  C:\Windows\System\FwwWFaB.exe
  2⤵
  - Executes dropped EXE
  PID:2268
- C:\Windows\System\ZpXHZIx.exe
  C:\Windows\System\ZpXHZIx.exe
  2⤵
  - Executes dropped EXE
  PID:1676
- C:\Windows\System\LkhauIx.exe
  C:\Windows\System\LkhauIx.exe
  2⤵
  - Executes dropped EXE
  PID:1584
- C:\Windows\System\lyysFkT.exe
  C:\Windows\System\lyysFkT.exe
  2⤵
  - Executes dropped EXE
  PID:5080
- C:\Windows\System\hUiboSe.exe
  C:\Windows\System\hUiboSe.exe
  2⤵
  - Executes dropped EXE
  PID:3708
- C:\Windows\System\srOZqXY.exe
  C:\Windows\System\srOZqXY.exe
  2⤵
  - Executes dropped EXE
  PID:5028
- C:\Windows\System\NDJCEls.exe
  C:\Windows\System\NDJCEls.exe
  2⤵
  - Executes dropped EXE
  PID:3064
- C:\Windows\System\ALfRwbt.exe
  C:\Windows\System\ALfRwbt.exe
  2⤵
  - Executes dropped EXE
  PID:3184
- C:\Windows\System\eHDcrwT.exe
  C:\Windows\System\eHDcrwT.exe
  2⤵
  - Executes dropped EXE
  PID:3512
- C:\Windows\System\SlICEZm.exe
  C:\Windows\System\SlICEZm.exe
  2⤵
  - Executes dropped EXE
  PID:316
- C:\Windows\System\dgpaCPK.exe
  C:\Windows\System\dgpaCPK.exe
  2⤵
  - Executes dropped EXE
  PID:1528
- C:\Windows\System\cCxGloy.exe
  C:\Windows\System\cCxGloy.exe
  2⤵
  - Executes dropped EXE
  PID:3124
- C:\Windows\System\bXPpKJp.exe
  C:\Windows\System\bXPpKJp.exe
  2⤵
  - Executes dropped EXE
  PID:3732
- C:\Windows\System\fQxllaB.exe
  C:\Windows\System\fQxllaB.exe
  2⤵
  - Executes dropped EXE
  PID:3792
- C:\Windows\System\iYGHdNi.exe
  C:\Windows\System\iYGHdNi.exe
  2⤵
  - Executes dropped EXE
  PID:1932
- C:\Windows\System\ItfBtzv.exe
  C:\Windows\System\ItfBtzv.exe
  2⤵
  - Executes dropped EXE
  PID:2596
- C:\Windows\System\tFRruPG.exe
  C:\Windows\System\tFRruPG.exe
  2⤵
  - Executes dropped EXE
  PID:1628
- C:\Windows\System\NypOcNX.exe
  C:\Windows\System\NypOcNX.exe
  2⤵
  - Executes dropped EXE
  PID:2696
- C:\Windows\System\MpVtkWz.exe
  C:\Windows\System\MpVtkWz.exe
  2⤵
  - Executes dropped EXE
  PID:692
- C:\Windows\System\sHjRqbl.exe
  C:\Windows\System\sHjRqbl.exe
  2⤵
  - Executes dropped EXE
  PID:896
- C:\Windows\System\kwKCLzb.exe
  C:\Windows\System\kwKCLzb.exe
  2⤵
  - Executes dropped EXE
  PID:2612
- C:\Windows\System\ZyvFAkq.exe
  C:\Windows\System\ZyvFAkq.exe
  2⤵
  - Executes dropped EXE
  PID:3568
- C:\Windows\System\XDyssIW.exe
  C:\Windows\System\XDyssIW.exe
  2⤵
  - Executes dropped EXE
  PID:2656
- C:\Windows\System\wSENiTw.exe
  C:\Windows\System\wSENiTw.exe
  2⤵
  - Executes dropped EXE
  PID:2984
- C:\Windows\System\UKPKuyk.exe
  C:\Windows\System\UKPKuyk.exe
  2⤵
  - Executes dropped EXE
  PID:4136
- C:\Windows\System\jMJrVyF.exe
  C:\Windows\System\jMJrVyF.exe
  2⤵
  - Executes dropped EXE
  PID:4060
- C:\Windows\System\VEvWViN.exe
  C:\Windows\System\VEvWViN.exe
  2⤵
  - Executes dropped EXE
  PID:2848
- C:\Windows\System\DDFoGlF.exe
  C:\Windows\System\DDFoGlF.exe
  2⤵
  - Executes dropped EXE
  PID:1708
- C:\Windows\System\JLLFsrw.exe
  C:\Windows\System\JLLFsrw.exe
  2⤵
  - Executes dropped EXE
  PID:364
- C:\Windows\System\nnXdbqQ.exe
  C:\Windows\System\nnXdbqQ.exe
  2⤵
  - Executes dropped EXE
  PID:428
- C:\Windows\System\abxgJgg.exe
  C:\Windows\System\abxgJgg.exe
  2⤵
  - Executes dropped EXE
  PID:3484
- C:\Windows\System\qHaZbQv.exe
  C:\Windows\System\qHaZbQv.exe
  2⤵
  - Executes dropped EXE
  PID:4580
- C:\Windows\System\WnAhftI.exe
  C:\Windows\System\WnAhftI.exe
  2⤵
  - Executes dropped EXE
  PID:2364
- C:\Windows\System\lTadunF.exe
  C:\Windows\System\lTadunF.exe
  2⤵
  - Executes dropped EXE
  PID:3784
- C:\Windows\System\dDpNlnW.exe
  C:\Windows\System\dDpNlnW.exe
  2⤵
  - Executes dropped EXE
  PID:2372
- C:\Windows\System\EixewZJ.exe
  C:\Windows\System\EixewZJ.exe
  2⤵
  - Executes dropped EXE
  PID:3804
- C:\Windows\System\wpELnZo.exe
  C:\Windows\System\wpELnZo.exe
  2⤵
  - Executes dropped EXE
  PID:4944
- C:\Windows\System\lLFCQUX.exe
  C:\Windows\System\lLFCQUX.exe
  2⤵
  - Executes dropped EXE
  PID:2944
- C:\Windows\System\uPjFxqe.exe
  C:\Windows\System\uPjFxqe.exe
  2⤵
  - Executes dropped EXE
  PID:2736
- C:\Windows\System\TbgTLQC.exe
  C:\Windows\System\TbgTLQC.exe
  2⤵
  - Executes dropped EXE
  PID:2804
- C:\Windows\System\ASJLMzL.exe
  C:\Windows\System\ASJLMzL.exe
  2⤵
  - Executes dropped EXE
  PID:3604
- C:\Windows\System\uPalslJ.exe
  C:\Windows\System\uPalslJ.exe
  2⤵
  - Executes dropped EXE
  PID:2276
- C:\Windows\System\YwzQTrq.exe
  C:\Windows\System\YwzQTrq.exe
  2⤵
  - Executes dropped EXE
  PID:4340
- C:\Windows\System\WYoVAnm.exe
  C:\Windows\System\WYoVAnm.exe
  2⤵
  - Executes dropped EXE
  PID:4056
- C:\Windows\System\MmfbRMt.exe
  C:\Windows\System\MmfbRMt.exe
  2⤵
  - Executes dropped EXE
  PID:3528
- C:\Windows\System\qjhMmpW.exe
  C:\Windows\System\qjhMmpW.exe
  2⤵
  - Executes dropped EXE
  PID:2320
- C:\Windows\System\sSKgbGl.exe
  C:\Windows\System\sSKgbGl.exe
  2⤵
  - Executes dropped EXE
  PID:2560
- C:\Windows\System\ITjgTay.exe
  C:\Windows\System\ITjgTay.exe
  2⤵
  - Executes dropped EXE
  PID:964
- C:\Windows\System\rHRuskc.exe
  C:\Windows\System\rHRuskc.exe
  2⤵
  - Executes dropped EXE
  PID:3892
- C:\Windows\System\NPqDujj.exe
  C:\Windows\System\NPqDujj.exe
  2⤵
  - Executes dropped EXE
  PID:624
- C:\Windows\System\khDyGmk.exe
  C:\Windows\System\khDyGmk.exe
  2⤵
  - Executes dropped EXE
  PID:4980
- C:\Windows\System\HnmlukV.exe
  C:\Windows\System\HnmlukV.exe
  2⤵
  - Executes dropped EXE
  PID:2044
- C:\Windows\System\UEQogts.exe
  C:\Windows\System\UEQogts.exe
  2⤵
  - Executes dropped EXE
  PID:3136
- C:\Windows\System\rLTwIqM.exe
  C:\Windows\System\rLTwIqM.exe
  2⤵
  PID:4472
- C:\Windows\System\BQfyfde.exe
  C:\Windows\System\BQfyfde.exe
  2⤵
  PID:4496
- C:\Windows\System\LBLCuZR.exe
  C:\Windows\System\LBLCuZR.exe
  2⤵
  PID:4720
- C:\Windows\System\GOUvQxZ.exe
  C:\Windows\System\GOUvQxZ.exe
  2⤵
  PID:1500
- C:\Windows\System\BeUhoBG.exe
  C:\Windows\System\BeUhoBG.exe
  2⤵
  PID:4212
- C:\Windows\System\lNeeTac.exe
  C:\Windows\System\lNeeTac.exe
  2⤵
  PID:4780
- C:\Windows\System\sBdoCnw.exe
  C:\Windows\System\sBdoCnw.exe
  2⤵
  PID:1088
- C:\Windows\System\cVrNfwv.exe
  C:\Windows\System\cVrNfwv.exe
  2⤵
  PID:400
- C:\Windows\System\sBsNNEg.exe
  C:\Windows\System\sBsNNEg.exe
  2⤵
  PID:1552
- C:\Windows\System\axQPRzs.exe
  C:\Windows\System\axQPRzs.exe
  2⤵
  PID:4512
- C:\Windows\System\aOKwxYl.exe
  C:\Windows\System\aOKwxYl.exe
  2⤵
  PID:3044
- C:\Windows\System\UyOitHP.exe
  C:\Windows\System\UyOitHP.exe
  2⤵
  PID:3336
- C:\Windows\System\CgdGOny.exe
  C:\Windows\System\CgdGOny.exe
  2⤵
  PID:1392
- C:\Windows\System\RdjVrIM.exe
  C:\Windows\System\RdjVrIM.exe
  2⤵
  PID:4644
- C:\Windows\System\zUCfHcL.exe
  C:\Windows\System\zUCfHcL.exe
  2⤵
  PID:4696
- C:\Windows\System\QjUuZDp.exe
  C:\Windows\System\QjUuZDp.exe
  2⤵
  PID:4268
- C:\Windows\System\xqKxGMt.exe
  C:\Windows\System\xqKxGMt.exe
  2⤵
  PID:3244
- C:\Windows\System\OZzvbEY.exe
  C:\Windows\System\OZzvbEY.exe
  2⤵
  PID:3564
- C:\Windows\System\GNfaOUW.exe
  C:\Windows\System\GNfaOUW.exe
  2⤵
  PID:4168
- C:\Windows\System\wJOoBgE.exe
  C:\Windows\System\wJOoBgE.exe
  2⤵
  PID:5084
- C:\Windows\System\YBuvPpi.exe
  C:\Windows\System\YBuvPpi.exe
  2⤵
  PID:920
- C:\Windows\System\uvbyjEQ.exe
  C:\Windows\System\uvbyjEQ.exe
  2⤵
  PID:2184
- C:\Windows\System\fQENkLn.exe
  C:\Windows\System\fQENkLn.exe
  2⤵
  PID:4440
- C:\Windows\System\BVrshBV.exe
  C:\Windows\System\BVrshBV.exe
  2⤵
  PID:4040
- C:\Windows\System\haUVOwa.exe
  C:\Windows\System\haUVOwa.exe
  2⤵
  PID:5148
- C:\Windows\System\PjRrJNE.exe
  C:\Windows\System\PjRrJNE.exe
  2⤵
  PID:5176
- C:\Windows\System\XWfCUNO.exe
  C:\Windows\System\XWfCUNO.exe
  2⤵
  PID:5204
- C:\Windows\System\fXGlROr.exe
  C:\Windows\System\fXGlROr.exe
  2⤵
  PID:5228
- C:\Windows\System\IyhsUIa.exe
  C:\Windows\System\IyhsUIa.exe
  2⤵
  PID:5256
- C:\Windows\System\tOYhRIt.exe
  C:\Windows\System\tOYhRIt.exe
  2⤵
  PID:5288
- C:\Windows\System\ogFcbMC.exe
  C:\Windows\System\ogFcbMC.exe
  2⤵
  PID:5316
- C:\Windows\System\ArtfxnQ.exe
  C:\Windows\System\ArtfxnQ.exe
  2⤵
  PID:5344
- C:\Windows\System\eVnrxjy.exe
  C:\Windows\System\eVnrxjy.exe
  2⤵
  PID:5372
- C:\Windows\System\UEIekoW.exe
  C:\Windows\System\UEIekoW.exe
  2⤵
  PID:5400
- C:\Windows\System\cJGJXGP.exe
  C:\Windows\System\cJGJXGP.exe
  2⤵
  PID:5428
- C:\Windows\System\wXmHfnH.exe
  C:\Windows\System\wXmHfnH.exe
  2⤵
  PID:5456
- C:\Windows\System\QiGkfGT.exe
  C:\Windows\System\QiGkfGT.exe
  2⤵
  PID:5484
- C:\Windows\System\iABBmef.exe
  C:\Windows\System\iABBmef.exe
  2⤵
  PID:5512
- C:\Windows\System\kbFyqIP.exe
  C:\Windows\System\kbFyqIP.exe
  2⤵
  PID:5536
- C:\Windows\System\XYjRxZF.exe
  C:\Windows\System\XYjRxZF.exe
  2⤵
  PID:5568
- C:\Windows\System\GlqZxzC.exe
  C:\Windows\System\GlqZxzC.exe
  2⤵
  PID:5596
- C:\Windows\System\ZPgNjGb.exe
  C:\Windows\System\ZPgNjGb.exe
  2⤵
  PID:5624
- C:\Windows\System\eADQYVn.exe
  C:\Windows\System\eADQYVn.exe
  2⤵
  PID:5648
- C:\Windows\System\pCAmzoe.exe
  C:\Windows\System\pCAmzoe.exe
  2⤵
  PID:5680
- C:\Windows\System\MtFsQfY.exe
  C:\Windows\System\MtFsQfY.exe
  2⤵
  PID:5740
- C:\Windows\System\DNttIhQ.exe
  C:\Windows\System\DNttIhQ.exe
  2⤵
  PID:5756
- C:\Windows\System\IOKoREv.exe
  C:\Windows\System\IOKoREv.exe
  2⤵
  PID:5772
- C:\Windows\System\vxdAlZc.exe
  C:\Windows\System\vxdAlZc.exe
  2⤵
  PID:5796
- C:\Windows\System\MBitzQS.exe
  C:\Windows\System\MBitzQS.exe
  2⤵
  PID:5824
- C:\Windows\System\VxeuMOw.exe
  C:\Windows\System\VxeuMOw.exe
  2⤵
  PID:5852
- C:\Windows\System\ARhdiJd.exe
  C:\Windows\System\ARhdiJd.exe
  2⤵
  PID:5872
- C:\Windows\System\HPwaeep.exe
  C:\Windows\System\HPwaeep.exe
  2⤵
  PID:5900
- C:\Windows\System\MscwNkI.exe
  C:\Windows\System\MscwNkI.exe
  2⤵
  PID:5928
- C:\Windows\System\bKOLSLx.exe
  C:\Windows\System\bKOLSLx.exe
  2⤵
  PID:5956
- C:\Windows\System\KfytQMq.exe
  C:\Windows\System\KfytQMq.exe
  2⤵
  PID:6000
- C:\Windows\System\cHsCwsD.exe
  C:\Windows\System\cHsCwsD.exe
  2⤵
  PID:6072
- C:\Windows\System\lhqtHxK.exe
  C:\Windows\System\lhqtHxK.exe
  2⤵
  PID:6100
- C:\Windows\System\mzIWhUI.exe
  C:\Windows\System\mzIWhUI.exe
  2⤵
  PID:6140
- C:\Windows\System\gBmjsHB.exe
  C:\Windows\System\gBmjsHB.exe
  2⤵
  PID:3480
- C:\Windows\System\QpgdUsw.exe
  C:\Windows\System\QpgdUsw.exe
  2⤵
  PID:3652
- C:\Windows\System\viztGyI.exe
  C:\Windows\System\viztGyI.exe
  2⤵
  PID:3640
- C:\Windows\System\pqZvkBl.exe
  C:\Windows\System\pqZvkBl.exe
  2⤵
  PID:1232
- C:\Windows\System\RiosZwQ.exe
  C:\Windows\System\RiosZwQ.exe
  2⤵
  PID:3204
- C:\Windows\System\NkRzArl.exe
  C:\Windows\System\NkRzArl.exe
  2⤵
  PID:5164
- C:\Windows\System\mtnlzMG.exe
  C:\Windows\System\mtnlzMG.exe
  2⤵
  PID:5192
- C:\Windows\System\IJqUGuM.exe
  C:\Windows\System\IJqUGuM.exe
  2⤵
  PID:5220
- C:\Windows\System\GoRTHWe.exe
  C:\Windows\System\GoRTHWe.exe
  2⤵
  PID:5272
- C:\Windows\System\bNEGjpt.exe
  C:\Windows\System\bNEGjpt.exe
  2⤵
  PID:5388
- C:\Windows\System\XNghsUd.exe
  C:\Windows\System\XNghsUd.exe
  2⤵
  PID:5448
- C:\Windows\System\MQwnLyj.exe
  C:\Windows\System\MQwnLyj.exe
  2⤵
  PID:5504
- C:\Windows\System\sdvvzkt.exe
  C:\Windows\System\sdvvzkt.exe
  2⤵
  PID:5548
- C:\Windows\System\tZpJfGO.exe
  C:\Windows\System\tZpJfGO.exe
  2⤵
  PID:5576
- C:\Windows\System\vYhKorm.exe
  C:\Windows\System\vYhKorm.exe
  2⤵
  PID:5604
- C:\Windows\System\yynasUl.exe
  C:\Windows\System\yynasUl.exe
  2⤵
  PID:5660
- C:\Windows\System\KRilQjy.exe
  C:\Windows\System\KRilQjy.exe
  2⤵
  PID:5696
- C:\Windows\System\uWJtizg.exe
  C:\Windows\System\uWJtizg.exe
  2⤵
  PID:2712
- C:\Windows\System\kWOpQUz.exe
  C:\Windows\System\kWOpQUz.exe
  2⤵
  PID:5768
- C:\Windows\System\zAJemyu.exe
  C:\Windows\System\zAJemyu.exe
  2⤵
  PID:5812
- C:\Windows\System\xHIUarJ.exe
  C:\Windows\System\xHIUarJ.exe
  2⤵
  PID:5840
- C:\Windows\System\dJQRBvG.exe
  C:\Windows\System\dJQRBvG.exe
  2⤵
  PID:5868
- C:\Windows\System\HjrubvJ.exe
  C:\Windows\System\HjrubvJ.exe
  2⤵
  PID:5968
- C:\Windows\System\MrAsFcg.exe
  C:\Windows\System\MrAsFcg.exe
  2⤵
  PID:5948
- C:\Windows\System\NClDxxo.exe
  C:\Windows\System\NClDxxo.exe
  2⤵
  PID:6024
- C:\Windows\System\VRFOZPw.exe
  C:\Windows\System\VRFOZPw.exe
  2⤵
  PID:6092
- C:\Windows\System\jAnkWKd.exe
  C:\Windows\System\jAnkWKd.exe
  2⤵
  PID:1572
- C:\Windows\System\zwmtpgd.exe
  C:\Windows\System\zwmtpgd.exe
  2⤵
  PID:4808
- C:\Windows\System\GwYlByD.exe
  C:\Windows\System\GwYlByD.exe
  2⤵
  PID:1856
- C:\Windows\System\JyabZKz.exe
  C:\Windows\System\JyabZKz.exe
  2⤵
  PID:2332
- C:\Windows\System\kcrMxcK.exe
  C:\Windows\System\kcrMxcK.exe
  2⤵
  PID:4444
- C:\Windows\System\OmDOdBc.exe
  C:\Windows\System\OmDOdBc.exe
  2⤵
  PID:4852
- C:\Windows\System\jCaDjkv.exe
  C:\Windows\System\jCaDjkv.exe
  2⤵
  PID:5068
- C:\Windows\System\QuPqCMj.exe
  C:\Windows\System\QuPqCMj.exe
  2⤵
  PID:5416
- C:\Windows\System\RMjGYQd.exe
  C:\Windows\System\RMjGYQd.exe
  2⤵
  PID:5444
- C:\Windows\System\izpATAx.exe
  C:\Windows\System\izpATAx.exe
  2⤵
  PID:4192
- C:\Windows\System\LJzqYDm.exe
  C:\Windows\System\LJzqYDm.exe
  2⤵
  PID:5492
- C:\Windows\System\WEVETVS.exe
  C:\Windows\System\WEVETVS.exe
  2⤵
  PID:5556
- C:\Windows\System\oeffDhW.exe
  C:\Windows\System\oeffDhW.exe
  2⤵
  PID:5748
- C:\Windows\System\yJIwzer.exe
  C:\Windows\System\yJIwzer.exe
  2⤵
  PID:5788
- C:\Windows\System\GPOGZDj.exe
  C:\Windows\System\GPOGZDj.exe
  2⤵
  PID:4020
- C:\Windows\System\HVXpNHM.exe
  C:\Windows\System\HVXpNHM.exe
  2⤵
  PID:6080
- C:\Windows\System\WbuGOTW.exe
  C:\Windows\System\WbuGOTW.exe
  2⤵
  PID:4172
- C:\Windows\System\OpPORhT.exe
  C:\Windows\System\OpPORhT.exe
  2⤵
  PID:5136
- C:\Windows\System\AgZOhSn.exe
  C:\Windows\System\AgZOhSn.exe
  2⤵
  PID:1640
- C:\Windows\System\LwBSZHe.exe
  C:\Windows\System\LwBSZHe.exe
  2⤵
  PID:4516
- C:\Windows\System\VJqLxAj.exe
  C:\Windows\System\VJqLxAj.exe
  2⤵
  PID:2352
- C:\Windows\System\pxWqBVo.exe
  C:\Windows\System\pxWqBVo.exe
  2⤵
  PID:2920
- C:\Windows\System\nsCPtmJ.exe
  C:\Windows\System\nsCPtmJ.exe
  2⤵
  PID:5920
- C:\Windows\System\vmhqRuu.exe
  C:\Windows\System\vmhqRuu.exe
  2⤵
  PID:4452
- C:\Windows\System\xfDvVIj.exe
  C:\Windows\System\xfDvVIj.exe
  2⤵
  PID:2404
- C:\Windows\System\lcqXLJd.exe
  C:\Windows\System\lcqXLJd.exe
  2⤵
  PID:4424
- C:\Windows\System\AQXUzvK.exe
  C:\Windows\System\AQXUzvK.exe
  2⤵
  PID:388
- C:\Windows\System\hFllPnt.exe
  C:\Windows\System\hFllPnt.exe
  2⤵
  PID:6156
- C:\Windows\System\YovZDUn.exe
  C:\Windows\System\YovZDUn.exe
  2⤵
  PID:6188
- C:\Windows\System\qadjynP.exe
  C:\Windows\System\qadjynP.exe
  2⤵
  PID:6224
- C:\Windows\System\GegicLl.exe
  C:\Windows\System\GegicLl.exe
  2⤵
  PID:6252
- C:\Windows\System\KBQPBhC.exe
  C:\Windows\System\KBQPBhC.exe
  2⤵
  PID:6284
- C:\Windows\System\Mdkwpvo.exe
  C:\Windows\System\Mdkwpvo.exe
  2⤵
  PID:6316
- C:\Windows\System\uxdQMDL.exe
  C:\Windows\System\uxdQMDL.exe
  2⤵
  PID:6348
- C:\Windows\System\gPgCJAZ.exe
  C:\Windows\System\gPgCJAZ.exe
  2⤵
  PID:6376
- C:\Windows\System\fEdKzSj.exe
  C:\Windows\System\fEdKzSj.exe
  2⤵
  PID:6408
- C:\Windows\System\CQbpjfC.exe
  C:\Windows\System\CQbpjfC.exe
  2⤵
  PID:6428
- C:\Windows\System\ewhLmMU.exe
  C:\Windows\System\ewhLmMU.exe
  2⤵
  PID:6460
- C:\Windows\System\BvXyRlu.exe
  C:\Windows\System\BvXyRlu.exe
  2⤵
  PID:6488
- C:\Windows\System\KhPbZQD.exe
  C:\Windows\System\KhPbZQD.exe
  2⤵
  PID:6512
- C:\Windows\System\qICbSex.exe
  C:\Windows\System\qICbSex.exe
  2⤵
  PID:6540
- C:\Windows\System\eVAjLWh.exe
  C:\Windows\System\eVAjLWh.exe
  2⤵
  PID:6576
- C:\Windows\System\LefUhnN.exe
  C:\Windows\System\LefUhnN.exe
  2⤵
  PID:6600
- C:\Windows\System\APhCgHD.exe
  C:\Windows\System\APhCgHD.exe
  2⤵
  PID:6632
- C:\Windows\System\lAXNsaG.exe
  C:\Windows\System\lAXNsaG.exe
  2⤵
  PID:6656
- C:\Windows\System\FskqFgb.exe
  C:\Windows\System\FskqFgb.exe
  2⤵
  PID:6684
- C:\Windows\System\DajfIjR.exe
  C:\Windows\System\DajfIjR.exe
  2⤵
  PID:6704
- C:\Windows\System\wxVPNRc.exe
  C:\Windows\System\wxVPNRc.exe
  2⤵
  PID:6732
- C:\Windows\System\awPswAs.exe
  C:\Windows\System\awPswAs.exe
  2⤵
  PID:6756
- C:\Windows\System\uAujVVN.exe
  C:\Windows\System\uAujVVN.exe
  2⤵
  PID:6780
- C:\Windows\System\bmCQSAM.exe
  C:\Windows\System\bmCQSAM.exe
  2⤵
  PID:6824
- C:\Windows\System\AIQevNJ.exe
  C:\Windows\System\AIQevNJ.exe
  2⤵
  PID:6856
- C:\Windows\System\esDdpxu.exe
  C:\Windows\System\esDdpxu.exe
  2⤵
  PID:6896
- C:\Windows\System\DuQxwBt.exe
  C:\Windows\System\DuQxwBt.exe
  2⤵
  PID:6924
- C:\Windows\System\FedKnLI.exe
  C:\Windows\System\FedKnLI.exe
  2⤵
  PID:6952
- C:\Windows\System\luVSkTk.exe
  C:\Windows\System\luVSkTk.exe
  2⤵
  PID:6976
- C:\Windows\System\UPhQRWo.exe
  C:\Windows\System\UPhQRWo.exe
  2⤵
  PID:7004
- C:\Windows\System\sTwpHQC.exe
  C:\Windows\System\sTwpHQC.exe
  2⤵
  PID:7040
- C:\Windows\System\yglrTlS.exe
  C:\Windows\System\yglrTlS.exe
  2⤵
  PID:7056
- C:\Windows\System\jGHMgTf.exe
  C:\Windows\System\jGHMgTf.exe
  2⤵
  PID:7088
- C:\Windows\System\EYpOreb.exe
  C:\Windows\System\EYpOreb.exe
  2⤵
  PID:7124
- C:\Windows\System\nMcJXKF.exe
  C:\Windows\System\nMcJXKF.exe
  2⤵
  PID:7156
- C:\Windows\System\rzydjMu.exe
  C:\Windows\System\rzydjMu.exe
  2⤵
  PID:6108
- C:\Windows\System\eJhGfZe.exe
  C:\Windows\System\eJhGfZe.exe
  2⤵
  PID:6216
- C:\Windows\System\EGLawwS.exe
  C:\Windows\System\EGLawwS.exe
  2⤵
  PID:6268
- C:\Windows\System\sGGdRoE.exe
  C:\Windows\System\sGGdRoE.exe
  2⤵
  PID:6372
- C:\Windows\System\BEtcAHl.exe
  C:\Windows\System\BEtcAHl.exe
  2⤵
  PID:6392
- C:\Windows\System\KyIzIRs.exe
  C:\Windows\System\KyIzIRs.exe
  2⤵
  PID:6476
- C:\Windows\System\ZIrpNQh.exe
  C:\Windows\System\ZIrpNQh.exe
  2⤵
  PID:6532
- C:\Windows\System\KcDBwzQ.exe
  C:\Windows\System\KcDBwzQ.exe
  2⤵
  PID:6612
- C:\Windows\System\hVbUKZv.exe
  C:\Windows\System\hVbUKZv.exe
  2⤵
  PID:6668
- C:\Windows\System\tqcAEVF.exe
  C:\Windows\System\tqcAEVF.exe
  2⤵
  PID:6728
- C:\Windows\System\HegIMZF.exe
  C:\Windows\System\HegIMZF.exe
  2⤵
  PID:6848
- C:\Windows\System\KWGczcU.exe
  C:\Windows\System\KWGczcU.exe
  2⤵
  PID:6892
- C:\Windows\System\TkiqjSd.exe
  C:\Windows\System\TkiqjSd.exe
  2⤵
  PID:6936
- C:\Windows\System\edRRtHY.exe
  C:\Windows\System\edRRtHY.exe
  2⤵
  PID:7012
- C:\Windows\System\UsMSyzv.exe
  C:\Windows\System\UsMSyzv.exe
  2⤵
  PID:7096
- C:\Windows\System\KwTmihQ.exe
  C:\Windows\System\KwTmihQ.exe
  2⤵
  PID:7108
- C:\Windows\System\SIUutpw.exe
  C:\Windows\System\SIUutpw.exe
  2⤵
  PID:7152
- C:\Windows\System\KDIRFyo.exe
  C:\Windows\System\KDIRFyo.exe
  2⤵
  PID:6248
- C:\Windows\System\GTEDcKy.exe
  C:\Windows\System\GTEDcKy.exe
  2⤵
  PID:6528
- C:\Windows\System\bHSVuLi.exe
  C:\Windows\System\bHSVuLi.exe
  2⤵
  PID:6676
- C:\Windows\System\DeWQEIW.exe
  C:\Windows\System\DeWQEIW.exe
  2⤵
  PID:6768
- C:\Windows\System\wCOWNnA.exe
  C:\Windows\System\wCOWNnA.exe
  2⤵
  PID:7000
- C:\Windows\System\gWGEjIW.exe
  C:\Windows\System\gWGEjIW.exe
  2⤵
  PID:7084
- C:\Windows\System\LLbUytV.exe
  C:\Windows\System\LLbUytV.exe
  2⤵
  PID:6296
- C:\Windows\System\jXDXuRT.exe
  C:\Windows\System\jXDXuRT.exe
  2⤵
  PID:6908
- C:\Windows\System\mTnoYGx.exe
  C:\Windows\System\mTnoYGx.exe
  2⤵
  PID:7136
- C:\Windows\System\IMvOySD.exe
  C:\Windows\System\IMvOySD.exe
  2⤵
  PID:7052
- C:\Windows\System\GETbhoB.exe
  C:\Windows\System\GETbhoB.exe
  2⤵
  PID:7192
- C:\Windows\System\XPdviQZ.exe
  C:\Windows\System\XPdviQZ.exe
  2⤵
  PID:7220
- C:\Windows\System\UPfqNOf.exe
  C:\Windows\System\UPfqNOf.exe
  2⤵
  PID:7240
- C:\Windows\System\ikBERea.exe
  C:\Windows\System\ikBERea.exe
  2⤵
  PID:7268
- C:\Windows\System\wXNQwxe.exe
  C:\Windows\System\wXNQwxe.exe
  2⤵
  PID:7284
- C:\Windows\System\iSTYOuO.exe
  C:\Windows\System\iSTYOuO.exe
  2⤵
  PID:7304
- C:\Windows\System\tAcCtXt.exe
  C:\Windows\System\tAcCtXt.exe
  2⤵
  PID:7328
- C:\Windows\System\OVrbxEx.exe
  C:\Windows\System\OVrbxEx.exe
  2⤵
  PID:7368
- C:\Windows\System\cSxUTWo.exe
  C:\Windows\System\cSxUTWo.exe
  2⤵
  PID:7392
- C:\Windows\System\XArmYLG.exe
  C:\Windows\System\XArmYLG.exe
  2⤵
  PID:7432
- C:\Windows\System\HjXFOuP.exe
  C:\Windows\System\HjXFOuP.exe
  2⤵
  PID:7464
- C:\Windows\System\IQmDwsQ.exe
  C:\Windows\System\IQmDwsQ.exe
  2⤵
  PID:7480
- C:\Windows\System\DjMlvko.exe
  C:\Windows\System\DjMlvko.exe
  2⤵
  PID:7532
- C:\Windows\System\DPwxFof.exe
  C:\Windows\System\DPwxFof.exe
  2⤵
  PID:7560
- C:\Windows\System\rhPqkzl.exe
  C:\Windows\System\rhPqkzl.exe
  2⤵
  PID:7588
- C:\Windows\System\HCYFKMb.exe
  C:\Windows\System\HCYFKMb.exe
  2⤵
  PID:7616
- C:\Windows\System\uUHQkYP.exe
  C:\Windows\System\uUHQkYP.exe
  2⤵
  PID:7644
- C:\Windows\System\gTSDHdh.exe
  C:\Windows\System\gTSDHdh.exe
  2⤵
  PID:7672
- C:\Windows\System\cykFvoZ.exe
  C:\Windows\System\cykFvoZ.exe
  2⤵
  PID:7692
- C:\Windows\System\wRkGmnh.exe
  C:\Windows\System\wRkGmnh.exe
  2⤵
  PID:7728
- C:\Windows\System\oIkAofO.exe
  C:\Windows\System\oIkAofO.exe
  2⤵
  PID:7756
- C:\Windows\System\OrXAliU.exe
  C:\Windows\System\OrXAliU.exe
  2⤵
  PID:7784
- C:\Windows\System\xLyPowp.exe
  C:\Windows\System\xLyPowp.exe
  2⤵
  PID:7808
- C:\Windows\System\rZdUUZg.exe
  C:\Windows\System\rZdUUZg.exe
  2⤵
  PID:7832
- C:\Windows\System\oQhdUOZ.exe
  C:\Windows\System\oQhdUOZ.exe
  2⤵
  PID:7872
- C:\Windows\System\fdtTbCa.exe
  C:\Windows\System\fdtTbCa.exe
  2⤵
  PID:7900
- C:\Windows\System\gyKWnFO.exe
  C:\Windows\System\gyKWnFO.exe
  2⤵
  PID:7920
- C:\Windows\System\cOJHbvQ.exe
  C:\Windows\System\cOJHbvQ.exe
  2⤵
  PID:7944
- C:\Windows\System\uhIJbsD.exe
  C:\Windows\System\uhIJbsD.exe
  2⤵
  PID:7972
- C:\Windows\System\xGKchFO.exe
  C:\Windows\System\xGKchFO.exe
  2⤵
  PID:8012
- C:\Windows\System\WkdRZRa.exe
  C:\Windows\System\WkdRZRa.exe
  2⤵
  PID:8040
- C:\Windows\System\RMbnlkv.exe
  C:\Windows\System\RMbnlkv.exe
  2⤵
  PID:8056
- C:\Windows\System\ZEzKddh.exe
  C:\Windows\System\ZEzKddh.exe
  2⤵
  PID:8088
- C:\Windows\System\vJIEFFW.exe
  C:\Windows\System\vJIEFFW.exe
  2⤵
  PID:8112
- C:\Windows\System\zyYAQEs.exe
  C:\Windows\System\zyYAQEs.exe
  2⤵
  PID:8144
- C:\Windows\System\sXjMIQk.exe
  C:\Windows\System\sXjMIQk.exe
  2⤵
  PID:8176
- C:\Windows\System\FbKHZYz.exe
  C:\Windows\System\FbKHZYz.exe
  2⤵
  PID:6748
- C:\Windows\System\WSKOIYV.exe
  C:\Windows\System\WSKOIYV.exe
  2⤵
  PID:7208
- C:\Windows\System\vfFQKPT.exe
  C:\Windows\System\vfFQKPT.exe
  2⤵
  PID:7312
- C:\Windows\System\KEFLSXT.exe
  C:\Windows\System\KEFLSXT.exe
  2⤵
  PID:7384
- C:\Windows\System\IpOUnyi.exe
  C:\Windows\System\IpOUnyi.exe
  2⤵
  PID:7440
- C:\Windows\System\DKqNQwi.exe
  C:\Windows\System\DKqNQwi.exe
  2⤵
  PID:7524
- C:\Windows\System\pRXuWVj.exe
  C:\Windows\System\pRXuWVj.exe
  2⤵
  PID:7580
- C:\Windows\System\Kgsnfrq.exe
  C:\Windows\System\Kgsnfrq.exe
  2⤵
  PID:7664
- C:\Windows\System\NlFxDuM.exe
  C:\Windows\System\NlFxDuM.exe
  2⤵
  PID:4764
- C:\Windows\System\sfmForx.exe
  C:\Windows\System\sfmForx.exe
  2⤵
  PID:7740
- C:\Windows\System\CXvJXJu.exe
  C:\Windows\System\CXvJXJu.exe
  2⤵
  PID:7820
- C:\Windows\System\zjTKgXV.exe
  C:\Windows\System\zjTKgXV.exe
  2⤵
  PID:7852
- C:\Windows\System\GunXJKe.exe
  C:\Windows\System\GunXJKe.exe
  2⤵
  PID:7916
- C:\Windows\System\uPiUsAK.exe
  C:\Windows\System\uPiUsAK.exe
  2⤵
  PID:7992
- C:\Windows\System\blDfeXv.exe
  C:\Windows\System\blDfeXv.exe
  2⤵
  PID:8076
- C:\Windows\System\VLBSEYU.exe
  C:\Windows\System\VLBSEYU.exe
  2⤵
  PID:8132
- C:\Windows\System\MrJIswO.exe
  C:\Windows\System\MrJIswO.exe
  2⤵
  PID:8172
- C:\Windows\System\HxibKQB.exe
  C:\Windows\System\HxibKQB.exe
  2⤵
  PID:7280
- C:\Windows\System\JzpAftW.exe
  C:\Windows\System\JzpAftW.exe
  2⤵
  PID:7428
- C:\Windows\System\QyJdWZu.exe
  C:\Windows\System\QyJdWZu.exe
  2⤵
  PID:7572
- C:\Windows\System\nTtawlI.exe
  C:\Windows\System\nTtawlI.exe
  2⤵
  PID:7716
- C:\Windows\System\qpPdeUf.exe
  C:\Windows\System\qpPdeUf.exe
  2⤵
  PID:7796
- C:\Windows\System\UkifgYb.exe
  C:\Windows\System\UkifgYb.exe
  2⤵
  PID:7936
- C:\Windows\System\GYCmOfk.exe
  C:\Windows\System\GYCmOfk.exe
  2⤵
  PID:8100
- C:\Windows\System\HXCRKfa.exe
  C:\Windows\System\HXCRKfa.exe
  2⤵
  PID:8188
- C:\Windows\System\HRoSytN.exe
  C:\Windows\System\HRoSytN.exe
  2⤵
  PID:7688
- C:\Windows\System\bBSIayv.exe
  C:\Windows\System\bBSIayv.exe
  2⤵
  PID:7204
- C:\Windows\System\ILeaqNz.exe
  C:\Windows\System\ILeaqNz.exe
  2⤵
  PID:7528
- C:\Windows\System\fiVBgOz.exe
  C:\Windows\System\fiVBgOz.exe
  2⤵
  PID:8072
- C:\Windows\System\mnIzsZu.exe
  C:\Windows\System\mnIzsZu.exe
  2⤵
  PID:8220
- C:\Windows\System\oxroaGY.exe
  C:\Windows\System\oxroaGY.exe
  2⤵
  PID:8248
- C:\Windows\System\llEJhMQ.exe
  C:\Windows\System\llEJhMQ.exe
  2⤵
  PID:8272
- C:\Windows\System\kyphZwe.exe
  C:\Windows\System\kyphZwe.exe
  2⤵
  PID:8300
- C:\Windows\System\YpEZrCM.exe
  C:\Windows\System\YpEZrCM.exe
  2⤵
  PID:8328
- C:\Windows\System\cUBzXQs.exe
  C:\Windows\System\cUBzXQs.exe
  2⤵
  PID:8356
- C:\Windows\System\lQRvtxL.exe
  C:\Windows\System\lQRvtxL.exe
  2⤵
  PID:8388
- C:\Windows\System\CPOlXsX.exe
  C:\Windows\System\CPOlXsX.exe
  2⤵
  PID:8424
- C:\Windows\System\ZSvoBZu.exe
  C:\Windows\System\ZSvoBZu.exe
  2⤵
  PID:8452
- C:\Windows\System\wacJdqc.exe
  C:\Windows\System\wacJdqc.exe
  2⤵
  PID:8468
- C:\Windows\System\ltpHeBh.exe
  C:\Windows\System\ltpHeBh.exe
  2⤵
  PID:8512
- C:\Windows\System\KReuIGE.exe
  C:\Windows\System\KReuIGE.exe
  2⤵
  PID:8540
- C:\Windows\System\YvvlNMd.exe
  C:\Windows\System\YvvlNMd.exe
  2⤵
  PID:8556
- C:\Windows\System\jXAwxEh.exe
  C:\Windows\System\jXAwxEh.exe
  2⤵
  PID:8584
- C:\Windows\System\iOhctau.exe
  C:\Windows\System\iOhctau.exe
  2⤵
  PID:8620
- C:\Windows\System\hJLwyMI.exe
  C:\Windows\System\hJLwyMI.exe
  2⤵
  PID:8652
- C:\Windows\System\chqMfaQ.exe
  C:\Windows\System\chqMfaQ.exe
  2⤵
  PID:8680
- C:\Windows\System\GjRZOKt.exe
  C:\Windows\System\GjRZOKt.exe
  2⤵
  PID:8708
- C:\Windows\System\uLmtCAz.exe
  C:\Windows\System\uLmtCAz.exe
  2⤵
  PID:8724
- C:\Windows\System\ZuHumgf.exe
  C:\Windows\System\ZuHumgf.exe
  2⤵
  PID:8748
- C:\Windows\System\mPNwhFn.exe
  C:\Windows\System\mPNwhFn.exe
  2⤵
  PID:8768
- C:\Windows\System\BdIVcqx.exe
  C:\Windows\System\BdIVcqx.exe
  2⤵
  PID:8800
- C:\Windows\System\yONroLM.exe
  C:\Windows\System\yONroLM.exe
  2⤵
  PID:8836
- C:\Windows\System\WedCpvc.exe
  C:\Windows\System\WedCpvc.exe
  2⤵
  PID:8856
- C:\Windows\System\mpEQlQT.exe
  C:\Windows\System\mpEQlQT.exe
  2⤵
  PID:8888
- C:\Windows\System\ugXLavT.exe
  C:\Windows\System\ugXLavT.exe
  2⤵
  PID:8920
- C:\Windows\System\eYUunbm.exe
  C:\Windows\System\eYUunbm.exe
  2⤵
  PID:8948
- C:\Windows\System\WvfctoV.exe
  C:\Windows\System\WvfctoV.exe
  2⤵
  PID:8976
- C:\Windows\System\eeBRPTZ.exe
  C:\Windows\System\eeBRPTZ.exe
  2⤵
  PID:9004
- C:\Windows\System\wzSyrCb.exe
  C:\Windows\System\wzSyrCb.exe
  2⤵
  PID:9044
- C:\Windows\System\UrfzJQt.exe
  C:\Windows\System\UrfzJQt.exe
  2⤵
  PID:9072
- C:\Windows\System\OGjZNlb.exe
  C:\Windows\System\OGjZNlb.exe
  2⤵
  PID:9100
- C:\Windows\System\ksfcmqQ.exe
  C:\Windows\System\ksfcmqQ.exe
  2⤵
  PID:9116
- C:\Windows\System\cxorLOX.exe
  C:\Windows\System\cxorLOX.exe
  2⤵
  PID:9136
- C:\Windows\System\gTeMaBD.exe
  C:\Windows\System\gTeMaBD.exe
  2⤵
  PID:9180
- C:\Windows\System\bOGwawB.exe
  C:\Windows\System\bOGwawB.exe
  2⤵
  PID:9212
- C:\Windows\System\OhcstNh.exe
  C:\Windows\System\OhcstNh.exe
  2⤵
  PID:8256
- C:\Windows\System\LCKYHEv.exe
  C:\Windows\System\LCKYHEv.exe
  2⤵
  PID:8292
- C:\Windows\System\uAKhLrw.exe
  C:\Windows\System\uAKhLrw.exe
  2⤵
  PID:8396
- C:\Windows\System\wtPRaAH.exe
  C:\Windows\System\wtPRaAH.exe
  2⤵
  PID:8408
- C:\Windows\System\BNoYpLV.exe
  C:\Windows\System\BNoYpLV.exe
  2⤵
  PID:8460
- C:\Windows\System\xvCqVte.exe
  C:\Windows\System\xvCqVte.exe
  2⤵
  PID:8504
- C:\Windows\System\viBoGdC.exe
  C:\Windows\System\viBoGdC.exe
  2⤵
  PID:8616
- C:\Windows\System\AxzRJWR.exe
  C:\Windows\System\AxzRJWR.exe
  2⤵
  PID:8668
- C:\Windows\System\FoFHeJr.exe
  C:\Windows\System\FoFHeJr.exe
  2⤵
  PID:8744
- C:\Windows\System\zJqTJIy.exe
  C:\Windows\System\zJqTJIy.exe
  2⤵
  PID:8756
- C:\Windows\System\cHdBzqS.exe
  C:\Windows\System\cHdBzqS.exe
  2⤵
  PID:8876
- C:\Windows\System\dvivQYa.exe
  C:\Windows\System\dvivQYa.exe
  2⤵
  PID:8968
- C:\Windows\System\oYmsbEq.exe
  C:\Windows\System\oYmsbEq.exe
  2⤵
  PID:8972
- C:\Windows\System\yEQEbTO.exe
  C:\Windows\System\yEQEbTO.exe
  2⤵
  PID:9088
- C:\Windows\System\pnjcXIv.exe
  C:\Windows\System\pnjcXIv.exe
  2⤵
  PID:9188
- C:\Windows\System\vUZTCJw.exe
  C:\Windows\System\vUZTCJw.exe
  2⤵
  PID:8208
- C:\Windows\System\mAewmRj.exe
  C:\Windows\System\mAewmRj.exe
  2⤵
  PID:8284
- C:\Windows\System\PtYhvqg.exe
  C:\Windows\System\PtYhvqg.exe
  2⤵
  PID:8320
- C:\Windows\System\TtEHryr.exe
  C:\Windows\System\TtEHryr.exe
  2⤵
  PID:8548
- C:\Windows\System\LfpdkpI.exe
  C:\Windows\System\LfpdkpI.exe
  2⤵
  PID:8796
- C:\Windows\System\lNNTJkv.exe
  C:\Windows\System\lNNTJkv.exe
  2⤵
  PID:8848
- C:\Windows\System\oBgIYuS.exe
  C:\Windows\System\oBgIYuS.exe
  2⤵
  PID:9040
- C:\Windows\System\krMDHIh.exe
  C:\Windows\System\krMDHIh.exe
  2⤵
  PID:8228
- C:\Windows\System\QXAbTtB.exe
  C:\Windows\System\QXAbTtB.exe
  2⤵
  PID:8340
- C:\Windows\System\CCPaGOM.exe
  C:\Windows\System\CCPaGOM.exe
  2⤵
  PID:8648
- C:\Windows\System\tNtfAtb.exe
  C:\Windows\System\tNtfAtb.exe
  2⤵
  PID:8996
- C:\Windows\System\CqEFqil.exe
  C:\Windows\System\CqEFqil.exe
  2⤵
  PID:8960
- C:\Windows\System\XYLFUIs.exe
  C:\Windows\System\XYLFUIs.exe
  2⤵
  PID:9232
- C:\Windows\System\NsnmPch.exe
  C:\Windows\System\NsnmPch.exe
  2⤵
  PID:9272
- C:\Windows\System\DGXlPGP.exe
  C:\Windows\System\DGXlPGP.exe
  2⤵
  PID:9304
- C:\Windows\System\TgXwSAp.exe
  C:\Windows\System\TgXwSAp.exe
  2⤵
  PID:9332
- C:\Windows\System\yQTXOAD.exe
  C:\Windows\System\yQTXOAD.exe
  2⤵
  PID:9348
- C:\Windows\System\IvLXIwt.exe
  C:\Windows\System\IvLXIwt.exe
  2⤵
  PID:9376
- C:\Windows\System\qCeWrNw.exe
  C:\Windows\System\qCeWrNw.exe
  2⤵
  PID:9408
- C:\Windows\System\uqxWYEp.exe
  C:\Windows\System\uqxWYEp.exe
  2⤵
  PID:9424
- C:\Windows\System\EeXtdRV.exe
  C:\Windows\System\EeXtdRV.exe
  2⤵
  PID:9460
- C:\Windows\System\eOPsUuJ.exe
  C:\Windows\System\eOPsUuJ.exe
  2⤵
  PID:9488
- C:\Windows\System\TcUFLzF.exe
  C:\Windows\System\TcUFLzF.exe
  2⤵
  PID:9528
- C:\Windows\System\yXMhvlI.exe
  C:\Windows\System\yXMhvlI.exe
  2⤵
  PID:9544
- C:\Windows\System\LjfMwIO.exe
  C:\Windows\System\LjfMwIO.exe
  2⤵
  PID:9572
- C:\Windows\System\dyggZWb.exe
  C:\Windows\System\dyggZWb.exe
  2⤵
  PID:9600
- C:\Windows\System\oChDrVw.exe
  C:\Windows\System\oChDrVw.exe
  2⤵
  PID:9628
- C:\Windows\System\GyoegON.exe
  C:\Windows\System\GyoegON.exe
  2⤵
  PID:9668
- C:\Windows\System\VKoSubE.exe
  C:\Windows\System\VKoSubE.exe
  2⤵
  PID:9700
- C:\Windows\System\lsqDgvB.exe
  C:\Windows\System\lsqDgvB.exe
  2⤵
  PID:9716
- C:\Windows\System\eTxYxOc.exe
  C:\Windows\System\eTxYxOc.exe
  2⤵
  PID:9748
- C:\Windows\System\UJkrcDQ.exe
  C:\Windows\System\UJkrcDQ.exe
  2⤵
  PID:9768
- C:\Windows\System\zPJRwhj.exe
  C:\Windows\System\zPJRwhj.exe
  2⤵
  PID:9788
- C:\Windows\System\UyCFdCr.exe
  C:\Windows\System\UyCFdCr.exe
  2⤵
  PID:9812
- C:\Windows\System\VVLIOvD.exe
  C:\Windows\System\VVLIOvD.exe
  2⤵
  PID:9868
- C:\Windows\System\WKYPnay.exe
  C:\Windows\System\WKYPnay.exe
  2⤵
  PID:9900
- C:\Windows\System\odZwEjS.exe
  C:\Windows\System\odZwEjS.exe
  2⤵
  PID:9928
- C:\Windows\System\gxRIJVz.exe
  C:\Windows\System\gxRIJVz.exe
  2⤵
  PID:9956
- C:\Windows\System\GJHoJGM.exe
  C:\Windows\System\GJHoJGM.exe
  2⤵
  PID:9984
- C:\Windows\System\QEUYJrW.exe
  C:\Windows\System\QEUYJrW.exe
  2⤵
  PID:10000
- C:\Windows\System\gMYUrpv.exe
  C:\Windows\System\gMYUrpv.exe
  2⤵
  PID:10028
- C:\Windows\System\qpkTprE.exe
  C:\Windows\System\qpkTprE.exe
  2⤵
  PID:10056
- C:\Windows\System\dvHKizr.exe
  C:\Windows\System\dvHKizr.exe
  2⤵
  PID:10092
- C:\Windows\System\lGqutxB.exe
  C:\Windows\System\lGqutxB.exe
  2⤵
  PID:10112
- C:\Windows\System\OhwWWUf.exe
  C:\Windows\System\OhwWWUf.exe
  2⤵
  PID:10140
- C:\Windows\System\svyFXhN.exe
  C:\Windows\System\svyFXhN.exe
  2⤵
  PID:10172
- C:\Windows\System\fLnzqWm.exe
  C:\Windows\System\fLnzqWm.exe
  2⤵
  PID:10196
- C:\Windows\System\EQuOihJ.exe
  C:\Windows\System\EQuOihJ.exe
  2⤵
  PID:10232
- C:\Windows\System\QwaFPpA.exe
  C:\Windows\System\QwaFPpA.exe
  2⤵
  PID:9224
- C:\Windows\System\kvduCPd.exe
  C:\Windows\System\kvduCPd.exe
  2⤵
  PID:9288
- C:\Windows\System\LJMOSXF.exe
  C:\Windows\System\LJMOSXF.exe
  2⤵
  PID:9372
- C:\Windows\System\YIObcFL.exe
  C:\Windows\System\YIObcFL.exe
  2⤵
  PID:9420
- C:\Windows\System\bfhfnhW.exe
  C:\Windows\System\bfhfnhW.exe
  2⤵
  PID:9504
- C:\Windows\System\SNyJsOn.exe
  C:\Windows\System\SNyJsOn.exe
  2⤵
  PID:9556
- C:\Windows\System\PBLOWXy.exe
  C:\Windows\System\PBLOWXy.exe
  2⤵
  PID:9592
- C:\Windows\System\cxWEzzx.exe
  C:\Windows\System\cxWEzzx.exe
  2⤵
  PID:9652
- C:\Windows\System\KYqgXYf.exe
  C:\Windows\System\KYqgXYf.exe
  2⤵
  PID:9760
- C:\Windows\System\gpaBHlV.exe
  C:\Windows\System\gpaBHlV.exe
  2⤵
  PID:9836
- C:\Windows\System\ToBAAPk.exe
  C:\Windows\System\ToBAAPk.exe
  2⤵
  PID:9864
- C:\Windows\System\zLeUCSc.exe
  C:\Windows\System\zLeUCSc.exe
  2⤵
  PID:9980
- C:\Windows\System\keJuddF.exe
  C:\Windows\System\keJuddF.exe
  2⤵
  PID:10048
- C:\Windows\System\uOrqLQx.exe
  C:\Windows\System\uOrqLQx.exe
  2⤵
  PID:10104
- C:\Windows\System\mqjugxm.exe
  C:\Windows\System\mqjugxm.exe
  2⤵
  PID:10192
- C:\Windows\System\NBJxbqJ.exe
  C:\Windows\System\NBJxbqJ.exe
  2⤵
  PID:9248
- C:\Windows\System\UdsNMYb.exe
  C:\Windows\System\UdsNMYb.exe
  2⤵
  PID:9400
- C:\Windows\System\vPIlGWV.exe
  C:\Windows\System\vPIlGWV.exe
  2⤵
  PID:9640
- C:\Windows\System\cvHQLbn.exe
  C:\Windows\System\cvHQLbn.exe
  2⤵
  PID:9664
- C:\Windows\System\YavgsbQ.exe
  C:\Windows\System\YavgsbQ.exe
  2⤵
  PID:9732
- C:\Windows\System\yxSOdhb.exe
  C:\Windows\System\yxSOdhb.exe
  2⤵
  PID:9972
- C:\Windows\System\UWUAxSS.exe
  C:\Windows\System\UWUAxSS.exe
  2⤵
  PID:10156
- C:\Windows\System\jWZwmte.exe
  C:\Windows\System\jWZwmte.exe
  2⤵
  PID:9328
- C:\Windows\System\JLeVtCU.exe
  C:\Windows\System\JLeVtCU.exe
  2⤵
  PID:9712
- C:\Windows\System\rCdNjkc.exe
  C:\Windows\System\rCdNjkc.exe
  2⤵
  PID:10152
- C:\Windows\System\euENpJw.exe
  C:\Windows\System\euENpJw.exe
  2⤵
  PID:9996
- C:\Windows\System\qhNHtQu.exe
  C:\Windows\System\qhNHtQu.exe
  2⤵
  PID:9564
- C:\Windows\System\JIEJyfS.exe
  C:\Windows\System\JIEJyfS.exe
  2⤵
  PID:10264
- C:\Windows\System\zwaQTln.exe
  C:\Windows\System\zwaQTln.exe
  2⤵
  PID:10300
- C:\Windows\System\DSHuXPw.exe
  C:\Windows\System\DSHuXPw.exe
  2⤵
  PID:10320
- C:\Windows\System\mBZbnFu.exe
  C:\Windows\System\mBZbnFu.exe
  2⤵
  PID:10348
- C:\Windows\System\MXaVVok.exe
  C:\Windows\System\MXaVVok.exe
  2⤵
  PID:10372
- C:\Windows\System\taDYrCw.exe
  C:\Windows\System\taDYrCw.exe
  2⤵
  PID:10400
- C:\Windows\System\lhdRwOM.exe
  C:\Windows\System\lhdRwOM.exe
  2⤵
  PID:10428
- C:\Windows\System\jwkggEI.exe
  C:\Windows\System\jwkggEI.exe
  2⤵
  PID:10468
- C:\Windows\System\UrAqrwf.exe
  C:\Windows\System\UrAqrwf.exe
  2⤵
  PID:10496
- C:\Windows\System\JuBfNCe.exe
  C:\Windows\System\JuBfNCe.exe
  2⤵
  PID:10524
- C:\Windows\System\IWzeUbi.exe
  C:\Windows\System\IWzeUbi.exe
  2⤵
  PID:10540
- C:\Windows\System\IBvNwiL.exe
  C:\Windows\System\IBvNwiL.exe
  2⤵
  PID:10568
- C:\Windows\System\SzMdQMG.exe
  C:\Windows\System\SzMdQMG.exe
  2⤵
  PID:10592
- C:\Windows\System\VMGaEwE.exe
  C:\Windows\System\VMGaEwE.exe
  2⤵
  PID:10624
- C:\Windows\System\xgdckse.exe
  C:\Windows\System\xgdckse.exe
  2⤵
  PID:10652
- C:\Windows\System\XWTdDtO.exe
  C:\Windows\System\XWTdDtO.exe
  2⤵
  PID:10680
- C:\Windows\System\EpSJXrF.exe
  C:\Windows\System\EpSJXrF.exe
  2⤵
  PID:10700
- C:\Windows\System\MFpGsuK.exe
  C:\Windows\System\MFpGsuK.exe
  2⤵
  PID:10736
- C:\Windows\System\pNHcbih.exe
  C:\Windows\System\pNHcbih.exe
  2⤵
  PID:10764
- C:\Windows\System\vvAEvOJ.exe
  C:\Windows\System\vvAEvOJ.exe
  2⤵
  PID:10784
- C:\Windows\System\mRfTDir.exe
  C:\Windows\System\mRfTDir.exe
  2⤵
  PID:10812
- C:\Windows\System\yzhPqkp.exe
  C:\Windows\System\yzhPqkp.exe
  2⤵
  PID:10840
- C:\Windows\System\TQWisAQ.exe
  C:\Windows\System\TQWisAQ.exe
  2⤵
  PID:10864
- C:\Windows\System\BOOuCHU.exe
  C:\Windows\System\BOOuCHU.exe
  2⤵
  PID:10892
- C:\Windows\System\UFhvqeL.exe
  C:\Windows\System\UFhvqeL.exe
  2⤵
  PID:10912
- C:\Windows\System\ltaYEiu.exe
  C:\Windows\System\ltaYEiu.exe
  2⤵
  PID:10948
- C:\Windows\System\zHGmqyl.exe
  C:\Windows\System\zHGmqyl.exe
  2⤵
  PID:10976
- C:\Windows\System\vQJFwxa.exe
  C:\Windows\System\vQJFwxa.exe
  2⤵
  PID:11020
- C:\Windows\System\VBgTYpk.exe
  C:\Windows\System\VBgTYpk.exe
  2⤵
  PID:11044
- C:\Windows\System\INokZPG.exe
  C:\Windows\System\INokZPG.exe
  2⤵
  PID:11072
- C:\Windows\System\HzBRGgg.exe
  C:\Windows\System\HzBRGgg.exe
  2⤵
  PID:11100
- C:\Windows\System\yYNbwXR.exe
  C:\Windows\System\yYNbwXR.exe
  2⤵
  PID:11124
- C:\Windows\System\nbQCFTh.exe
  C:\Windows\System\nbQCFTh.exe
  2⤵
  PID:11144
- C:\Windows\System\eldaBSO.exe
  C:\Windows\System\eldaBSO.exe
  2⤵
  PID:11172
- C:\Windows\System\QIPxrPJ.exe
  C:\Windows\System\QIPxrPJ.exe
  2⤵
  PID:11200
- C:\Windows\System\ssASInB.exe
  C:\Windows\System\ssASInB.exe
  2⤵
  PID:11228
- C:\Windows\System\YCWaMom.exe
  C:\Windows\System\YCWaMom.exe
  2⤵
  PID:9756
- C:\Windows\System\GaArrbb.exe
  C:\Windows\System\GaArrbb.exe
  2⤵
  PID:10296
- C:\Windows\System\gUowzGC.exe
  C:\Windows\System\gUowzGC.exe
  2⤵
  PID:10368
- C:\Windows\System\KDabGai.exe
  C:\Windows\System\KDabGai.exe
  2⤵
  PID:10456
- C:\Windows\System\jjsJpHG.exe
  C:\Windows\System\jjsJpHG.exe
  2⤵
  PID:10532
- C:\Windows\System\Shbkqlw.exe
  C:\Windows\System\Shbkqlw.exe
  2⤵
  PID:10604
- C:\Windows\System\jGeMRQw.exe
  C:\Windows\System\jGeMRQw.exe
  2⤵
  PID:10612
- C:\Windows\System\fZTicOe.exe
  C:\Windows\System\fZTicOe.exe
  2⤵
  PID:10696
- C:\Windows\System\MBRxOTm.exe
  C:\Windows\System\MBRxOTm.exe
  2⤵
  PID:10760
- C:\Windows\System\NmFwxWd.exe
  C:\Windows\System\NmFwxWd.exe
  2⤵
  PID:10836
- C:\Windows\System\slVCgrs.exe
  C:\Windows\System\slVCgrs.exe
  2⤵
  PID:10876
- C:\Windows\System\GhhbUYF.exe
  C:\Windows\System\GhhbUYF.exe
  2⤵
  PID:10928
- C:\Windows\System\ERpCgwe.exe
  C:\Windows\System\ERpCgwe.exe
  2⤵
  PID:9940
- C:\Windows\System\jlMbHlK.exe
  C:\Windows\System\jlMbHlK.exe
  2⤵
  PID:11028
- C:\Windows\System\YxEaRbe.exe
  C:\Windows\System\YxEaRbe.exe
  2⤵
  PID:11136
- C:\Windows\System\sXpDowT.exe
  C:\Windows\System\sXpDowT.exe
  2⤵
  PID:11240
- C:\Windows\System\cDBAJFJ.exe
  C:\Windows\System\cDBAJFJ.exe
  2⤵
  PID:11252
- C:\Windows\System\uhmwunH.exe
  C:\Windows\System\uhmwunH.exe
  2⤵
  PID:10420
- C:\Windows\System\dhhWpwg.exe
  C:\Windows\System\dhhWpwg.exe
  2⤵
  PID:10492
- C:\Windows\System\aiqkSGC.exe
  C:\Windows\System\aiqkSGC.exe
  2⤵
  PID:10668
- C:\Windows\System\nHoWsue.exe
  C:\Windows\System\nHoWsue.exe
  2⤵
  PID:10796
- C:\Windows\System\pfzegrN.exe
  C:\Windows\System\pfzegrN.exe
  2⤵
  PID:10972
- C:\Windows\System\OwbWAwb.exe
  C:\Windows\System\OwbWAwb.exe
  2⤵
  PID:11064
- C:\Windows\System\DJYxxKK.exe
  C:\Windows\System\DJYxxKK.exe
  2⤵
  PID:11236
- C:\Windows\System\WQYihmm.exe
  C:\Windows\System\WQYihmm.exe
  2⤵
  PID:10640
- C:\Windows\System\rgMrmtz.exe
  C:\Windows\System\rgMrmtz.exe
  2⤵
  PID:11164
- C:\Windows\System\EuRBMwc.exe
  C:\Windows\System\EuRBMwc.exe
  2⤵
  PID:10464
- C:\Windows\System\aXtNPNL.exe
  C:\Windows\System\aXtNPNL.exe
  2⤵
  PID:11012
- C:\Windows\System\yKjpJGZ.exe
  C:\Windows\System\yKjpJGZ.exe
  2⤵
  PID:11292
- C:\Windows\System\LAesPAh.exe
  C:\Windows\System\LAesPAh.exe
  2⤵
  PID:11320
- C:\Windows\System\MlcJiZQ.exe
  C:\Windows\System\MlcJiZQ.exe
  2⤵
  PID:11348
- C:\Windows\System\UYtZnUK.exe
  C:\Windows\System\UYtZnUK.exe
  2⤵
  PID:11376
- C:\Windows\System\CsPhiLq.exe
  C:\Windows\System\CsPhiLq.exe
  2⤵
  PID:11404
- C:\Windows\System\GbjqPMS.exe
  C:\Windows\System\GbjqPMS.exe
  2⤵
  PID:11432
- C:\Windows\System\PVmXxGP.exe
  C:\Windows\System\PVmXxGP.exe
  2⤵
  PID:11472
- C:\Windows\System\lwHTHqG.exe
  C:\Windows\System\lwHTHqG.exe
  2⤵
  PID:11500
- C:\Windows\System\kflmhBK.exe
  C:\Windows\System\kflmhBK.exe
  2⤵
  PID:11528
- C:\Windows\System\uvnTedN.exe
  C:\Windows\System\uvnTedN.exe
  2⤵
  PID:11556
- C:\Windows\System\dUZOVSO.exe
  C:\Windows\System\dUZOVSO.exe
  2⤵
  PID:11572
- C:\Windows\System\HpMtmZS.exe
  C:\Windows\System\HpMtmZS.exe
  2⤵
  PID:11612
- C:\Windows\System\WvFTsuW.exe
  C:\Windows\System\WvFTsuW.exe
  2⤵
  PID:11640
- C:\Windows\System\VUwwDtP.exe
  C:\Windows\System\VUwwDtP.exe
  2⤵
  PID:11668
- C:\Windows\System\amQQXwZ.exe
  C:\Windows\System\amQQXwZ.exe
  2⤵
  PID:11696
- C:\Windows\System\TfhBcEy.exe
  C:\Windows\System\TfhBcEy.exe
  2⤵
  PID:11712
- C:\Windows\System\DjDohVu.exe
  C:\Windows\System\DjDohVu.exe
  2⤵
  PID:11728
- C:\Windows\System\KxbAbjn.exe
  C:\Windows\System\KxbAbjn.exe
  2⤵
  PID:11752
- C:\Windows\System\ISZDolw.exe
  C:\Windows\System\ISZDolw.exe
  2⤵
  PID:11780
- C:\Windows\System\WupQRXu.exe
  C:\Windows\System\WupQRXu.exe
  2⤵
  PID:11836
- C:\Windows\System\fmLpQXY.exe
  C:\Windows\System\fmLpQXY.exe
  2⤵
  PID:11856
- C:\Windows\System\MHcqPcz.exe
  C:\Windows\System\MHcqPcz.exe
  2⤵
  PID:11880
- C:\Windows\System\ARtTHDV.exe
  C:\Windows\System\ARtTHDV.exe
  2⤵
  PID:11920
- C:\Windows\System\QUSqQOg.exe
  C:\Windows\System\QUSqQOg.exe
  2⤵
  PID:11948
- C:\Windows\System\PnhXcXm.exe
  C:\Windows\System\PnhXcXm.exe
  2⤵
  PID:11964
- C:\Windows\System\STQPNkp.exe
  C:\Windows\System\STQPNkp.exe
  2⤵
  PID:12004
- C:\Windows\System\kaXylZd.exe
  C:\Windows\System\kaXylZd.exe
  2⤵
  PID:12032
- C:\Windows\System\ireuaOB.exe
  C:\Windows\System\ireuaOB.exe
  2⤵
  PID:12052
- C:\Windows\System\OfNxNzi.exe
  C:\Windows\System\OfNxNzi.exe
  2⤵
  PID:12076
- C:\Windows\System\pxKcTKe.exe
  C:\Windows\System\pxKcTKe.exe
  2⤵
  PID:12104
- C:\Windows\System\BwQnDGx.exe
  C:\Windows\System\BwQnDGx.exe
  2⤵
  PID:12132
- C:\Windows\System\OaACXmm.exe
  C:\Windows\System\OaACXmm.exe
  2⤵
  PID:12148
- C:\Windows\System\PQoSozy.exe
  C:\Windows\System\PQoSozy.exe
  2⤵
  PID:12184
- C:\Windows\System\NGbLOjP.exe
  C:\Windows\System\NGbLOjP.exe
  2⤵
  PID:12216
- C:\Windows\System\QaXfEoz.exe
  C:\Windows\System\QaXfEoz.exe
  2⤵
  PID:12244
- C:\Windows\System\WlICiER.exe
  C:\Windows\System\WlICiER.exe
  2⤵
  PID:12260
- C:\Windows\System\LtahDvJ.exe
  C:\Windows\System\LtahDvJ.exe
  2⤵
  PID:10688
- C:\Windows\System\Kaodnyw.exe
  C:\Windows\System\Kaodnyw.exe
  2⤵
  PID:11316
- C:\Windows\System\CofSfbM.exe
  C:\Windows\System\CofSfbM.exe
  2⤵
  PID:11416
- C:\Windows\System\iRxVYAF.exe
  C:\Windows\System\iRxVYAF.exe
  2⤵
  PID:11484
- C:\Windows\System\YJJTVrd.exe
  C:\Windows\System\YJJTVrd.exe
  2⤵
  PID:11544
- C:\Windows\System\xBqoqwM.exe
  C:\Windows\System\xBqoqwM.exe
  2⤵
  PID:11604
- C:\Windows\System\IYhNQZT.exe
  C:\Windows\System\IYhNQZT.exe
  2⤵
  PID:11656
- C:\Windows\System\MZWStuv.exe
  C:\Windows\System\MZWStuv.exe
  2⤵
  PID:11708
- C:\Windows\System\UeUYmDy.exe
  C:\Windows\System\UeUYmDy.exe
  2⤵
  PID:11772
- C:\Windows\System\eoyYaZo.exe
  C:\Windows\System\eoyYaZo.exe
  2⤵
  PID:11864
- C:\Windows\System\uHYEFFk.exe
  C:\Windows\System\uHYEFFk.exe
  2⤵
  PID:11960
- C:\Windows\System\uKSgTJI.exe
  C:\Windows\System\uKSgTJI.exe
  2⤵
  PID:12016
- C:\Windows\System\efjZKWt.exe
  C:\Windows\System\efjZKWt.exe
  2⤵
  PID:12072
- C:\Windows\System\RZMKYon.exe
  C:\Windows\System\RZMKYon.exe
  2⤵
  PID:12144
- C:\Windows\System\KJmIwCy.exe
  C:\Windows\System\KJmIwCy.exe
  2⤵
  PID:12228
- C:\Windows\System\MrJVcIE.exe
  C:\Windows\System\MrJVcIE.exe
  2⤵
  PID:12280
- C:\Windows\System\PzxdZWc.exe
  C:\Windows\System\PzxdZWc.exe
  2⤵
  PID:11396
- C:\Windows\System\fYSvLvj.exe
  C:\Windows\System\fYSvLvj.exe
  2⤵
  PID:11512
- C:\Windows\System\BelvMMs.exe
  C:\Windows\System\BelvMMs.exe
  2⤵
  PID:11564
- C:\Windows\System\DDygOJT.exe
  C:\Windows\System\DDygOJT.exe
  2⤵
  PID:11680
- C:\Windows\System\juDFlSx.exe
  C:\Windows\System\juDFlSx.exe
  2⤵
  PID:11932
- C:\Windows\System\fzpowZl.exe
  C:\Windows\System\fzpowZl.exe
  2⤵
  PID:12088
- C:\Windows\System\bAPjEhz.exe
  C:\Windows\System\bAPjEhz.exe
  2⤵
  PID:11312
- C:\Windows\System\ETSnzLn.exe
  C:\Windows\System\ETSnzLn.exe
  2⤵
  PID:11524
- C:\Windows\System\LjXdjFn.exe
  C:\Windows\System\LjXdjFn.exe
  2⤵
  PID:12068
- C:\Windows\System\lGCZaHj.exe
  C:\Windows\System\lGCZaHj.exe
  2⤵
  PID:10508
- C:\Windows\System\zUzpDxV.exe
  C:\Windows\System\zUzpDxV.exe
  2⤵
  PID:11984
- C:\Windows\System\yOGKvtU.exe
  C:\Windows\System\yOGKvtU.exe
  2⤵
  PID:12312
- C:\Windows\System\lmBJMOQ.exe
  C:\Windows\System\lmBJMOQ.exe
  2⤵
  PID:12340
- C:\Windows\System\quavMXi.exe
  C:\Windows\System\quavMXi.exe
  2⤵
  PID:12364
- C:\Windows\System\miFqBqs.exe
  C:\Windows\System\miFqBqs.exe
  2⤵
  PID:12384
- C:\Windows\System\figHngH.exe
  C:\Windows\System\figHngH.exe
  2⤵
  PID:12408
- C:\Windows\System\zGcSwdz.exe
  C:\Windows\System\zGcSwdz.exe
  2⤵
  PID:12428
- C:\Windows\System\JPNQvww.exe
  C:\Windows\System\JPNQvww.exe
  2⤵
  PID:12456
- C:\Windows\System\YNutlrn.exe
  C:\Windows\System\YNutlrn.exe
  2⤵
  PID:12496
- C:\Windows\System\ZdihoAn.exe
  C:\Windows\System\ZdihoAn.exe
  2⤵
  PID:12524
- C:\Windows\System\SnJXoMO.exe
  C:\Windows\System\SnJXoMO.exe
  2⤵
  PID:12552
- C:\Windows\System\OpClRIT.exe
  C:\Windows\System\OpClRIT.exe
  2⤵
  PID:12580
- C:\Windows\System\JXXZdNB.exe
  C:\Windows\System\JXXZdNB.exe
  2⤵
  PID:12608
- C:\Windows\System\vYwZCGR.exe
  C:\Windows\System\vYwZCGR.exe
  2⤵
  PID:12624
- C:\Windows\System\mduwtjG.exe
  C:\Windows\System\mduwtjG.exe
  2⤵
  PID:12648
- C:\Windows\System\LvsmWrC.exe
  C:\Windows\System\LvsmWrC.exe
  2⤵
  PID:12676
- C:\Windows\System\pahcSxt.exe
  C:\Windows\System\pahcSxt.exe
  2⤵
  PID:12720
- C:\Windows\System\iFwYwjB.exe
  C:\Windows\System\iFwYwjB.exe
  2⤵
  PID:12736
- C:\Windows\System\dIGrjYb.exe
  C:\Windows\System\dIGrjYb.exe
  2⤵
  PID:12776
- C:\Windows\System\wqhYIoK.exe
  C:\Windows\System\wqhYIoK.exe
  2⤵
  PID:12804
- C:\Windows\System\UtIFSeF.exe
  C:\Windows\System\UtIFSeF.exe
  2⤵
  PID:12824
- C:\Windows\System\LsdkzGv.exe
  C:\Windows\System\LsdkzGv.exe
  2⤵
  PID:12852
- C:\Windows\System\ogXtDso.exe
  C:\Windows\System\ogXtDso.exe
  2⤵
  PID:12900
- C:\Windows\System\PGlxEht.exe
  C:\Windows\System\PGlxEht.exe
  2⤵
  PID:12928
- C:\Windows\System\PyitaLj.exe
  C:\Windows\System\PyitaLj.exe
  2⤵
  PID:12944
- C:\Windows\System\bjSEfwm.exe
  C:\Windows\System\bjSEfwm.exe
  2⤵
  PID:12984
- C:\Windows\System\ocsLuCt.exe
  C:\Windows\System\ocsLuCt.exe
  2⤵
  PID:13000
- C:\Windows\System\OdacRyu.exe
  C:\Windows\System\OdacRyu.exe
  2⤵
  PID:13024
- C:\Windows\System\aKtHabY.exe
  C:\Windows\System\aKtHabY.exe
  2⤵
  PID:13068
- C:\Windows\System\WxlzAIJ.exe
  C:\Windows\System\WxlzAIJ.exe
  2⤵
  PID:13084
- C:\Windows\System\KGTdjER.exe
  C:\Windows\System\KGTdjER.exe
  2⤵
  PID:13112
- C:\Windows\System\ErPAMbz.exe
  C:\Windows\System\ErPAMbz.exe
  2⤵
  PID:13132
- C:\Windows\System\tQehgxm.exe
  C:\Windows\System\tQehgxm.exe
  2⤵
  PID:13168
- C:\Windows\System\ueHAXcB.exe
  C:\Windows\System\ueHAXcB.exe
  2⤵
  PID:13196
- C:\Windows\System\dEHmyTf.exe
  C:\Windows\System\dEHmyTf.exe
  2⤵
  PID:13236
- C:\Windows\System\McSrpwn.exe
  C:\Windows\System\McSrpwn.exe
  2⤵
  PID:13256
- C:\Windows\System\PRBHOBI.exe
  C:\Windows\System\PRBHOBI.exe
  2⤵
  PID:13280
- C:\Windows\System\iVCarTC.exe
  C:\Windows\System\iVCarTC.exe
  2⤵
  PID:13304
- C:\Windows\System\JeghEgH.exe
  C:\Windows\System\JeghEgH.exe
  2⤵
  PID:12348
- C:\Windows\System\DVbLnSg.exe
  C:\Windows\System\DVbLnSg.exe
  2⤵
  PID:12440
- C:\Windows\System\lDbRKYi.exe
  C:\Windows\System\lDbRKYi.exe
  2⤵
  PID:12452
- C:\Windows\System\ocpGPWf.exe
  C:\Windows\System\ocpGPWf.exe
  2⤵
  PID:12520
- C:\Windows\System\CqAFpod.exe
  C:\Windows\System\CqAFpod.exe
  2⤵
  PID:12616
- C:\Windows\System\TtVtYOg.exe
  C:\Windows\System\TtVtYOg.exe
  2⤵
  PID:12640
- C:\Windows\System\MACdIxR.exe
  C:\Windows\System\MACdIxR.exe
  2⤵
  PID:12764
- C:\Windows\System\XMrGKQJ.exe
  C:\Windows\System\XMrGKQJ.exe
  2⤵
  PID:12816
- C:\Windows\System\DkQqEBR.exe
  C:\Windows\System\DkQqEBR.exe
  2⤵
  PID:12880
- C:\Windows\System\IwmxLKg.exe
  C:\Windows\System\IwmxLKg.exe
  2⤵
  PID:12940
- C:\Windows\System\mpUCesZ.exe
  C:\Windows\System\mpUCesZ.exe
  2⤵
  PID:13016
- C:\Windows\System\RVAXrta.exe
  C:\Windows\System\RVAXrta.exe
  2⤵
  PID:13076
- C:\Windows\System\uHwAkWo.exe
  C:\Windows\System\uHwAkWo.exe
  2⤵
  PID:13152
- C:\Windows\System\jjZsBux.exe
  C:\Windows\System\jjZsBux.exe
  2⤵
  PID:13184
- C:\Windows\System\XqhpNnw.exe
  C:\Windows\System\XqhpNnw.exe
  2⤵
  PID:13220
- C:\Windows\System\qLMjXNC.exe
  C:\Windows\System\qLMjXNC.exe
  2⤵
  PID:12372
- C:\Windows\System\urBEuWm.exe
  C:\Windows\System\urBEuWm.exe
  2⤵
  PID:12480
- C:\Windows\System\UHJKrJw.exe
  C:\Windows\System\UHJKrJw.exe
  2⤵
  PID:11896
- C:\Windows\System\KSfIPNA.exe
  C:\Windows\System\KSfIPNA.exe
  2⤵
  PID:12752
- C:\Windows\System\cYLNcTO.exe
  C:\Windows\System\cYLNcTO.exe
  2⤵
  PID:12884
- C:\Windows\System\RlljcPc.exe
  C:\Windows\System\RlljcPc.exe
  2⤵
  PID:13104
- C:\Windows\System\CMEbXqo.exe
  C:\Windows\System\CMEbXqo.exe
  2⤵
  PID:11660
- C:\Windows\System\gtbqxZJ.exe
  C:\Windows\System\gtbqxZJ.exe
  2⤵
  PID:12472
- C:\Windows\System\cBPAwGR.exe
  C:\Windows\System\cBPAwGR.exe
  2⤵
  PID:12636
- C:\Windows\System\bKrGKbq.exe
  C:\Windows\System\bKrGKbq.exe
  2⤵
  PID:12976
- C:\Windows\System\BaKPEKM.exe
  C:\Windows\System\BaKPEKM.exe
  2⤵
  PID:13060
- C:\Windows\System\YCFlJaP.exe
  C:\Windows\System\YCFlJaP.exe
  2⤵
  PID:12796
- C:\Windows\System\GuHhkBi.exe
  C:\Windows\System\GuHhkBi.exe
  2⤵
  PID:13328
- C:\Windows\System\mlxxrvH.exe
  C:\Windows\System\mlxxrvH.exe
  2⤵
  PID:13364
- C:\Windows\System\xRXYjlW.exe
  C:\Windows\System\xRXYjlW.exe
  2⤵
  PID:13392
- C:\Windows\System\XTDdfyG.exe
  C:\Windows\System\XTDdfyG.exe
  2⤵
  PID:13424
- C:\Windows\System\kgGZqKU.exe
  C:\Windows\System\kgGZqKU.exe
  2⤵
  PID:13448
- C:\Windows\System\TBeOsau.exe
  C:\Windows\System\TBeOsau.exe
  2⤵
  PID:13476
- C:\Windows\System\pOVyjVA.exe
  C:\Windows\System\pOVyjVA.exe
  2⤵
  PID:13504
- C:\Windows\System\RMYscJQ.exe
  C:\Windows\System\RMYscJQ.exe
  2⤵
  PID:13540
- C:\Windows\System\aTyFGJe.exe
  C:\Windows\System\aTyFGJe.exe
  2⤵
  PID:13556
- C:\Windows\System\lJczZDP.exe
  C:\Windows\System\lJczZDP.exe
  2⤵
  PID:13584
- C:\Windows\System\mRKmeBX.exe
  C:\Windows\System\mRKmeBX.exe
  2⤵
  PID:13624
- C:\Windows\System\xDuFJja.exe
  C:\Windows\System\xDuFJja.exe
  2⤵
  PID:13652
- C:\Windows\System\xDCljMV.exe
  C:\Windows\System\xDCljMV.exe
  2⤵
  PID:13680
- C:\Windows\System\lMcasvz.exe
  C:\Windows\System\lMcasvz.exe
  2⤵
  PID:13700
- C:\Windows\System\OZDMJuG.exe
  C:\Windows\System\OZDMJuG.exe
  2⤵
  PID:13724
- C:\Windows\System\NdlQofS.exe
  C:\Windows\System\NdlQofS.exe
  2⤵
  PID:13760
- C:\Windows\System\tgggAwK.exe
  C:\Windows\System\tgggAwK.exe
  2⤵
  PID:13780
- C:\Windows\System\zsIigoF.exe
  C:\Windows\System\zsIigoF.exe
  2⤵
  PID:13824
- C:\Windows\System\acEmHoI.exe
  C:\Windows\System\acEmHoI.exe
  2⤵
  PID:13848
- C:\Windows\System\bFjYWPo.exe
  C:\Windows\System\bFjYWPo.exe
  2⤵
  PID:13876
- C:\Windows\System\JFvMgSS.exe
  C:\Windows\System\JFvMgSS.exe
  2⤵
  PID:13896
- C:\Windows\System\snknXMv.exe
  C:\Windows\System\snknXMv.exe
  2⤵
  PID:13936
- C:\Windows\System\XjmgFjN.exe
  C:\Windows\System\XjmgFjN.exe
  2⤵
  PID:13964
- C:\Windows\System\TxyiFJu.exe
  C:\Windows\System\TxyiFJu.exe
  2⤵
  PID:13984
- C:\Windows\System\BTMZPmT.exe
  C:\Windows\System\BTMZPmT.exe
  2⤵
  PID:14008
- C:\Windows\System\LNeLMKE.exe
  C:\Windows\System\LNeLMKE.exe
  2⤵
  PID:14032
- C:\Windows\System\OhhWOui.exe
  C:\Windows\System\OhhWOui.exe
  2⤵
  PID:14076
- C:\Windows\System\PrMQoVW.exe
  C:\Windows\System\PrMQoVW.exe
  2⤵
  PID:14104
- C:\Windows\System\dWbhhPN.exe
  C:\Windows\System\dWbhhPN.exe
  2⤵
  PID:14132
- C:\Windows\System\KuRLQYY.exe
  C:\Windows\System\KuRLQYY.exe
  2⤵
  PID:14160
- C:\Windows\System\ItnZYoU.exe
  C:\Windows\System\ItnZYoU.exe
  2⤵
  PID:14176
- C:\Windows\System\jzjfEVc.exe
  C:\Windows\System\jzjfEVc.exe
  2⤵
  PID:14204
- C:\Windows\System\Wavsltb.exe
  C:\Windows\System\Wavsltb.exe
  2⤵
  PID:14244
- C:\Windows\System\EDAqVht.exe
  C:\Windows\System\EDAqVht.exe
  2⤵
  PID:14272
- C:\Windows\System\zcZpQEy.exe
  C:\Windows\System\zcZpQEy.exe
  2⤵
  PID:14300
- C:\Windows\System\Spftbpf.exe
  C:\Windows\System\Spftbpf.exe
  2⤵
  PID:14316
- C:\Windows\System\IngisXf.exe
  C:\Windows\System\IngisXf.exe
  2⤵
  PID:13340
- C:\Windows\System\QPiwDNk.exe
  C:\Windows\System\QPiwDNk.exe
  2⤵
  PID:13388
- C:\Windows\System\SkpdPQi.exe
  C:\Windows\System\SkpdPQi.exe
  2⤵
  PID:13464
- C:\Windows\System\aubHWbB.exe
  C:\Windows\System\aubHWbB.exe
  2⤵
  PID:13552
- C:\Windows\System\bEdJFao.exe
  C:\Windows\System\bEdJFao.exe
  2⤵
  PID:13608
- C:\Windows\System\XCKjQZa.exe
  C:\Windows\System\XCKjQZa.exe
  2⤵
  PID:13668
- C:\Windows\System\lPBEnrZ.exe
  C:\Windows\System\lPBEnrZ.exe
  2⤵
  PID:13752
- C:\Windows\System\wUjqFZp.exe
  C:\Windows\System\wUjqFZp.exe
  2⤵
  PID:13816
- C:\Windows\System\buyTOeX.exe
  C:\Windows\System\buyTOeX.exe
  2⤵
  PID:13888
- C:\Windows\System\egslszy.exe
  C:\Windows\System\egslszy.exe
  2⤵
  PID:13948
- C:\Windows\System\UkMhggY.exe
  C:\Windows\System\UkMhggY.exe
  2⤵
  PID:13992
- C:\Windows\System\XuEBihm.exe
  C:\Windows\System\XuEBihm.exe
  2⤵
  PID:14068
- C:\Windows\System\bdmxcAL.exe
  C:\Windows\System\bdmxcAL.exe
  2⤵
  PID:14128
- C:\Windows\System\kvnDBTo.exe
  C:\Windows\System\kvnDBTo.exe
  2⤵
  PID:14172
- C:\Windows\System\VuKvpcf.exe
  C:\Windows\System\VuKvpcf.exe
  2⤵
  PID:14264
- C:\Windows\System\HRULUQN.exe
  C:\Windows\System\HRULUQN.exe
  2⤵
  PID:14308
- C:\Windows\System\FFyaqgp.exe
  C:\Windows\System\FFyaqgp.exe
  2⤵
  PID:13492
- C:\Windows\System\kNyxdNG.exe
  C:\Windows\System\kNyxdNG.exe
  2⤵
  PID:13620
- C:\Windows\System\Awzxsja.exe
  C:\Windows\System\Awzxsja.exe
  2⤵
  PID:13796
- C:\Windows\System\OxMaVfZ.exe
  C:\Windows\System\OxMaVfZ.exe
  2⤵
  PID:13932
- C:\Windows\System\obEEEMB.exe
  C:\Windows\System\obEEEMB.exe
  2⤵
  PID:13976
- C:\Windows\System\NnKVIBg.exe
  C:\Windows\System\NnKVIBg.exe
  2⤵
  PID:14216
- C:\Windows\System\jifFuSh.exe
  C:\Windows\System\jifFuSh.exe
  2⤵
  PID:13372
- C:\Windows\System\dScHMYT.exe
  C:\Windows\System\dScHMYT.exe
  2⤵
  PID:13636
- C:\Windows\System\ZmqNaVv.exe
  C:\Windows\System\ZmqNaVv.exe
  2⤵
  PID:14040
- C:\Windows\System\TXwhDVo.exe
  C:\Windows\System\TXwhDVo.exe
  2⤵
  PID:14312
- C:\Windows\System\ySVFPOh.exe
  C:\Windows\System\ySVFPOh.exe
  2⤵
  PID:13756
- C:\Windows\System\qzJdfZZ.exe
  C:\Windows\System\qzJdfZZ.exe
  2⤵
  PID:14352
- C:\Windows\System\WvWiLsc.exe
  C:\Windows\System\WvWiLsc.exe
  2⤵
  PID:14392
- C:\Windows\System\gsUBRhA.exe
  C:\Windows\System\gsUBRhA.exe
  2⤵
  PID:14436
- C:\Windows\System\zNYPczf.exe
  C:\Windows\System\zNYPczf.exe
  2⤵
  PID:14456
- C:\Windows\System\jKVWaFj.exe
  C:\Windows\System\jKVWaFj.exe
  2⤵
  PID:14480
- C:\Windows\System\ucHvJMZ.exe
  C:\Windows\System\ucHvJMZ.exe
  2⤵
  PID:14508
- C:\Windows\System\TVoHlGk.exe
  C:\Windows\System\TVoHlGk.exe
  2⤵
  PID:14540
- C:\Windows\System\XQYwaXb.exe
  C:\Windows\System\XQYwaXb.exe
  2⤵
  PID:14576
- C:\Windows\System\JOgerQZ.exe
  C:\Windows\System\JOgerQZ.exe
  2⤵
  PID:14604
- C:\Windows\System\qufSitA.exe
  C:\Windows\System\qufSitA.exe
  2⤵
  PID:14624
- C:\Windows\System\yTanfDc.exe
  C:\Windows\System\yTanfDc.exe
  2⤵
  PID:14648
- C:\Windows\System\CFPswuW.exe
  C:\Windows\System\CFPswuW.exe
  2⤵
  PID:14676
- C:\Windows\System\FQRYMcy.exe
  C:\Windows\System\FQRYMcy.exe
  2⤵
  PID:14704
- C:\Windows\System\osvqzPK.exe
  C:\Windows\System\osvqzPK.exe
  2⤵
  PID:14732
- C:\Windows\System\MwnbwGc.exe
  C:\Windows\System\MwnbwGc.exe
  2⤵
  PID:14760
- C:\Windows\System\Wqdfcra.exe
  C:\Windows\System\Wqdfcra.exe
  2⤵
  PID:14788
- C:\Windows\System\XgscuOE.exe
  C:\Windows\System\XgscuOE.exe
  2⤵
  PID:14808
- C:\Windows\System\XswuDIu.exe
  C:\Windows\System\XswuDIu.exe
  2⤵
  PID:14832
- C:\Windows\System\AsAllZf.exe
  C:\Windows\System\AsAllZf.exe
  2⤵
  PID:14860
- C:\Windows\System\TXcLTzx.exe
  C:\Windows\System\TXcLTzx.exe
  2⤵
  PID:14896
- C:\Windows\System\paCusHD.exe
  C:\Windows\System\paCusHD.exe
  2⤵
  PID:14940
- C:\Windows\System\JBRIhrI.exe
  C:\Windows\System\JBRIhrI.exe
  2⤵
  PID:14960
- C:\Windows\System\cEZLJrB.exe
  C:\Windows\System\cEZLJrB.exe
  2⤵
  PID:14984
- C:\Windows\System\GIETtus.exe
  C:\Windows\System\GIETtus.exe
  2⤵
  PID:15012
- C:\Windows\System\pQEIrrV.exe
  C:\Windows\System\pQEIrrV.exe
  2⤵
  PID:15044
- C:\Windows\System\zMJzuGH.exe
  C:\Windows\System\zMJzuGH.exe
  2⤵
  PID:15072
- C:\Windows\System\HwygViN.exe
  C:\Windows\System\HwygViN.exe
  2⤵
  PID:15100
- C:\Windows\System\aRRngOJ.exe
  C:\Windows\System\aRRngOJ.exe
  2⤵
  PID:15128
- C:\Windows\System\AigiQGL.exe
  C:\Windows\System\AigiQGL.exe
  2⤵
  PID:15164
- C:\Windows\System\ALISOYd.exe
  C:\Windows\System\ALISOYd.exe
  2⤵
  PID:15180
- C:\Windows\System\aDkQBbB.exe
  C:\Windows\System\aDkQBbB.exe
  2⤵
  PID:15208
- C:\Windows\System\XChxdLJ.exe
  C:\Windows\System\XChxdLJ.exe
  2⤵
  PID:15236
- C:\Windows\System\qNGVHun.exe
  C:\Windows\System\qNGVHun.exe
  2⤵
  PID:15276
- C:\Windows\System\RszGVdI.exe
  C:\Windows\System\RszGVdI.exe
  2⤵
  PID:15292
- C:\Windows\System\BFwivLH.exe
  C:\Windows\System\BFwivLH.exe
  2⤵
  PID:15312
- C:\Windows\System\WcZhSOH.exe
  C:\Windows\System\WcZhSOH.exe
  2⤵
  PID:15352
- C:\Windows\System\wmmRlgZ.exe
  C:\Windows\System\wmmRlgZ.exe
  2⤵
  PID:13572
- C:\Windows\System\XFXzBEB.exe
  C:\Windows\System\XFXzBEB.exe
  2⤵
  PID:14376
- C:\Windows\System\iSIYzxT.exe
  C:\Windows\System\iSIYzxT.exe
  2⤵
  PID:14428
- C:\Windows\System\neGfmiQ.exe
  C:\Windows\System\neGfmiQ.exe
  2⤵
  PID:14464
- C:\Windows\System\kjxlxWk.exe
  C:\Windows\System\kjxlxWk.exe
  2⤵
  PID:14600
- C:\Windows\System\BaWOrVT.exe
  C:\Windows\System\BaWOrVT.exe
  2⤵
  PID:14664
- C:\Windows\System\gdzysRQ.exe
  C:\Windows\System\gdzysRQ.exe
  2⤵
  PID:14752
- C:\Windows\System\uKOWEDq.exe
  C:\Windows\System\uKOWEDq.exe
  2⤵
  PID:14804
- C:\Windows\System\EaMyprc.exe
  C:\Windows\System\EaMyprc.exe
  2⤵
  PID:14880
- C:\Windows\System\ibNrieC.exe
  C:\Windows\System\ibNrieC.exe
  2⤵
  PID:14916
- C:\Windows\System\RcZDpEq.exe
  C:\Windows\System\RcZDpEq.exe
  2⤵
  PID:15028
- C:\Windows\System\NTJtYvd.exe
  C:\Windows\System\NTJtYvd.exe
  2⤵
  PID:15092
- C:\Windows\System\mCyLRCA.exe
  C:\Windows\System\mCyLRCA.exe
  2⤵
  PID:15112
- C:\Windows\System\FWQcTma.exe
  C:\Windows\System\FWQcTma.exe
  2⤵
  PID:15160
- C:\Windows\System\HeEiCpd.exe
  C:\Windows\System\HeEiCpd.exe
  2⤵
  PID:15200
- C:\Windows\System\mhkpqgn.exe
  C:\Windows\System\mhkpqgn.exe
  2⤵
  PID:15264
- C:\Windows\System\cgsUwbh.exe
  C:\Windows\System\cgsUwbh.exe
  2⤵
  PID:15332
- C:\Windows\System\ZPjQNrw.exe
  C:\Windows\System\ZPjQNrw.exe
  2⤵
  PID:14368
- C:\Windows\System\mIgIWEx.exe
  C:\Windows\System\mIgIWEx.exe
  2⤵
  PID:14724
- C:\Windows\System\ZAvoUXA.exe
  C:\Windows\System\ZAvoUXA.exe
  2⤵
  PID:14872
- C:\Windows\System\qDAHHiD.exe
  C:\Windows\System\qDAHHiD.exe
  2⤵
  PID:14948
- C:\Windows\System\kHyatsm.exe
  C:\Windows\System\kHyatsm.exe
  2⤵
  PID:15136
- C:\Windows\System\qYBMPpZ.exe
  C:\Windows\System\qYBMPpZ.exe
  2⤵
  PID:15284
- C:\Windows\System\BuLhENt.exe
  C:\Windows\System\BuLhENt.exe
  2⤵
  PID:14560
- C:\Windows\System\CpubNai.exe
  C:\Windows\System\CpubNai.exe
  2⤵
  PID:14780
- C:\Windows\System\PaknbGT.exe
  C:\Windows\System\PaknbGT.exe
  2⤵
  PID:15056
- C:\Windows\System\TRpqqOo.exe
  C:\Windows\System\TRpqqOo.exe
  2⤵
  PID:14700
- C:\Windows\System\xkvwFHT.exe
  C:\Windows\System\xkvwFHT.exe
  2⤵
  PID:15340
- C:\Windows\System\vfMWdFg.exe
  C:\Windows\System\vfMWdFg.exe
  2⤵
  PID:15384
- C:\Windows\System\BZcxLeo.exe
  C:\Windows\System\BZcxLeo.exe
  2⤵
  PID:15424
- C:\Windows\System\nOpBDQp.exe
  C:\Windows\System\nOpBDQp.exe
  2⤵
  PID:15440
- C:\Windows\System\aKOIGjA.exe
  C:\Windows\System\aKOIGjA.exe
  2⤵
  PID:15468
- C:\Windows\System\UOxhPkq.exe
  C:\Windows\System\UOxhPkq.exe
  2⤵
  PID:15496
- C:\Windows\System\OYypMAw.exe
  C:\Windows\System\OYypMAw.exe
  2⤵
  PID:15520
- C:\Windows\System\DubLEZJ.exe
  C:\Windows\System\DubLEZJ.exe
  2⤵
  PID:15556
- C:\Windows\System\mhCGFOc.exe
  C:\Windows\System\mhCGFOc.exe
  2⤵
  PID:15580
- C:\Windows\System\yDUVepq.exe
  C:\Windows\System\yDUVepq.exe
  2⤵
  PID:15608
- C:\Windows\System\iKAygQQ.exe
  C:\Windows\System\iKAygQQ.exe
  2⤵
  PID:15652
- C:\Windows\System\NMGcsRV.exe
  C:\Windows\System\NMGcsRV.exe
  2⤵
  PID:15788
- C:\Windows\System\FiXxIKk.exe
  C:\Windows\System\FiXxIKk.exe
  2⤵
  PID:15804
- C:\Windows\System\dWpFoEs.exe
  C:\Windows\System\dWpFoEs.exe
  2⤵
  PID:15832
- C:\Windows\System\hVTbLjr.exe
  C:\Windows\System\hVTbLjr.exe
  2⤵
  PID:15852
- C:\Windows\System\ixSyaBT.exe
  C:\Windows\System\ixSyaBT.exe
  2⤵
  PID:15876
- C:\Windows\System\tTtNiYU.exe
  C:\Windows\System\tTtNiYU.exe
  2⤵
  PID:15892
- C:\Windows\System\TCRxvWi.exe
  C:\Windows\System\TCRxvWi.exe
  2⤵
  PID:15944
- C:\Windows\System\BKtDjkZ.exe
  C:\Windows\System\BKtDjkZ.exe
  2⤵
  PID:15972
- C:\Windows\System\yWvkqUe.exe
  C:\Windows\System\yWvkqUe.exe
  2⤵
  PID:15996
- C:\Windows\System\AkYlpxs.exe
  C:\Windows\System\AkYlpxs.exe
  2⤵
  PID:16044
- C:\Windows\System\PISqfXE.exe
  C:\Windows\System\PISqfXE.exe
  2⤵
  PID:16060
- C:\Windows\System\uoQIupw.exe
  C:\Windows\System\uoQIupw.exe
  2⤵
  PID:16108
- C:\Windows\System\wtPxJlB.exe
  C:\Windows\System\wtPxJlB.exe
  2⤵
  PID:16152
- C:\Windows\System\VoCvAnB.exe
  C:\Windows\System\VoCvAnB.exe
  2⤵
  PID:16180
- C:\Windows\System\dOthkiB.exe
  C:\Windows\System\dOthkiB.exe
  2⤵
  PID:16196
- C:\Windows\System\NCMERGN.exe
  C:\Windows\System\NCMERGN.exe
  2⤵
  PID:16240
- C:\Windows\System\NvMUmsl.exe
  C:\Windows\System\NvMUmsl.exe
  2⤵
  PID:16264
- C:\Windows\System\lPhrFgC.exe
  C:\Windows\System\lPhrFgC.exe
  2⤵
  PID:16280
- C:\Windows\System\clkSOtK.exe
  C:\Windows\System\clkSOtK.exe
  2⤵
  PID:16316
- C:\Windows\System\WmHcDJL.exe
  C:\Windows\System\WmHcDJL.exe
  2⤵
  PID:16352
- C:\Windows\System\BZXSBZZ.exe
  C:\Windows\System\BZXSBZZ.exe
  2⤵
  PID:16380
- C:\Windows\System\CLiWcrY.exe
  C:\Windows\System\CLiWcrY.exe
  2⤵
  PID:15408
- C:\Windows\System\zfpPzhW.exe
  C:\Windows\System\zfpPzhW.exe
  2⤵
  PID:15436
- C:\Windows\System\AjFquRj.exe
  C:\Windows\System\AjFquRj.exe
  2⤵
  PID:15536
- C:\Windows\System\bGHeovT.exe
  C:\Windows\System\bGHeovT.exe
  2⤵
  PID:15592
- C:\Windows\System\juZnRYH.exe
  C:\Windows\System\juZnRYH.exe
  2⤵
  PID:15664
- C:\Windows\System\awdvYBW.exe
  C:\Windows\System\awdvYBW.exe
  2⤵
  PID:15708
- C:\Windows\System\oqOfWbs.exe
  C:\Windows\System\oqOfWbs.exe
  2⤵
  PID:15728
- C:\Windows\System\nmbvFkl.exe
  C:\Windows\System\nmbvFkl.exe
  2⤵
  PID:15740
- C:\Windows\System\VGtBEyX.exe
  C:\Windows\System\VGtBEyX.exe
  2⤵
  PID:15764
- C:\Windows\System\AIdAbTM.exe
  C:\Windows\System\AIdAbTM.exe
  2⤵
  PID:15816
- C:\Windows\System\GlkhoYp.exe
  C:\Windows\System\GlkhoYp.exe
  2⤵
  PID:15848
- C:\Windows\System\UrGMipq.exe
  C:\Windows\System\UrGMipq.exe
  2⤵
  PID:15936
- C:\Windows\System\sGrNXjV.exe
  C:\Windows\System\sGrNXjV.exe
  2⤵
  PID:16036
- C:\Windows\System\jFCQWdm.exe
  C:\Windows\System\jFCQWdm.exe
  2⤵
  PID:16144
- C:\Windows\System\VrqIKCp.exe
  C:\Windows\System\VrqIKCp.exe
  2⤵
  PID:16188
- C:\Windows\System\TOWPEkY.exe
  C:\Windows\System\TOWPEkY.exe
  2⤵
  PID:16260
- C:\Windows\System\VBdmsfy.exe
  C:\Windows\System\VBdmsfy.exe
  2⤵
  PID:16308
- C:\Windows\System\SODhElK.exe
  C:\Windows\System\SODhElK.exe
  2⤵
  PID:16364
- C:\Windows\System\nAsmcLE.exe
  C:\Windows\System\nAsmcLE.exe
  2⤵
  PID:15508
- C:\Windows\System\UohqWsK.exe
  C:\Windows\System\UohqWsK.exe
  2⤵
  PID:15644
- C:\Windows\System\bansIUt.exe
  C:\Windows\System\bansIUt.exe
  2⤵
  PID:15760
- C:\Windows\System\cxZniyr.exe
  C:\Windows\System\cxZniyr.exe
  2⤵
  PID:15776
- C:\Windows\System\XgOWjAw.exe
  C:\Windows\System\XgOWjAw.exe
  2⤵
  PID:16052
- C:\Windows\System\HsOGUCS.exe
  C:\Windows\System\HsOGUCS.exe
  2⤵
  PID:16148
- C:\Windows\System\DQdnLcn.exe
  C:\Windows\System\DQdnLcn.exe
  2⤵
  PID:16372
- C:\Windows\System\doitgaZ.exe
  C:\Windows\System\doitgaZ.exe
  2⤵
  PID:15572
- C:\Windows\System\vEthngt.exe
  C:\Windows\System\vEthngt.exe
  2⤵
  PID:15884
- C:\Windows\System\ZkPKaVe.exe
  C:\Windows\System\ZkPKaVe.exe
  2⤵
  PID:16132
- C:\Windows\System\KGrHHHU.exe
  C:\Windows\System\KGrHHHU.exe
  2⤵
  PID:15452
- C:\Windows\System\KpkYXTJ.exe
  C:\Windows\System\KpkYXTJ.exe
  2⤵
  PID:16392
- C:\Windows\System\rhNlXIm.exe
  C:\Windows\System\rhNlXIm.exe
  2⤵
  PID:16416
- C:\Windows\System\yoSqquX.exe
  C:\Windows\System\yoSqquX.exe
  2⤵
  PID:16476
- C:\Windows\System\menKHhG.exe
  C:\Windows\System\menKHhG.exe
  2⤵
  PID:16504
- C:\Windows\System\kiZaeGU.exe
  C:\Windows\System\kiZaeGU.exe
  2⤵
  PID:16532
- C:\Windows\System\jFgGeLm.exe
  C:\Windows\System\jFgGeLm.exe
  2⤵
  PID:16656
- C:\Windows\System\kqRNgUG.exe
  C:\Windows\System\kqRNgUG.exe
  2⤵
  PID:16676
- C:\Windows\System\zkhvCmj.exe
  C:\Windows\System\zkhvCmj.exe
  2⤵
  PID:16700
- C:\Windows\System\sTgHxhw.exe
  C:\Windows\System\sTgHxhw.exe
  2⤵
  PID:16732
- C:\Windows\System\kyzkWJH.exe
  C:\Windows\System\kyzkWJH.exe
  2⤵
  PID:16760
- C:\Windows\System\SJyxJsM.exe
  C:\Windows\System\SJyxJsM.exe
  2⤵
  PID:16788
- C:\Windows\System\jdOZTWt.exe
  C:\Windows\System\jdOZTWt.exe
  2⤵
  PID:16828
- C:\Windows\System\hHWPASd.exe
  C:\Windows\System\hHWPASd.exe
  2⤵
  PID:16856
- C:\Windows\System\RbZFTmA.exe
  C:\Windows\System\RbZFTmA.exe
  2⤵
  PID:16884
- C:\Windows\System\JYcMEcs.exe
  C:\Windows\System\JYcMEcs.exe
  2⤵
  PID:16912
- C:\Windows\System\sdhvdNk.exe
  C:\Windows\System\sdhvdNk.exe
  2⤵
  PID:16940
- C:\Windows\System\wxJUWrl.exe
  C:\Windows\System\wxJUWrl.exe
  2⤵
  PID:16968
- C:\Windows\System\bBRfaUl.exe
  C:\Windows\System\bBRfaUl.exe
  2⤵
  PID:16996

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:16584

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\ALfRwbt.exe

Filesize
1.6MB

MD5
6ce8dda3f33dffae94907ce8759d4a8b

SHA1
7c62ca8d847877fd049fef5b3755fbcaf7678592

SHA256
dabed00ebf5051fb5c447a75623f468c8a9b55c4db76e89d994f415083bf551f

SHA512
cf7de07b5247a929ff8a88fa547a7addfc8c93d171ae1e8e307f85c4b218d34ffb56d807185c0c11be82c91dc2d3fa39b2346e9c48366cefabb32c83cd069639

Download Submit
C:\Windows\System\BSTKUuk.exe

Filesize
1.6MB

MD5
6fbec7469a4c53d98c0b46b7cd95fa7b

SHA1
07604d72614f729f6578dd10f4d7558695f12490

SHA256
1c1b8706f6b35ef4cf1021840b846f4e56095309dd1e9471fdc81d2ea7909154

SHA512
3a5448cb90b89ea76032720200e16f534f3620bd0810984685b3edd4c697398c4efe5bc4470612debfa052b7bcb0895b4b0c2b9e60cc17db8455f661d93c5012

Download Submit
C:\Windows\System\FEdJGPY.exe

Filesize
1.6MB

MD5
44b9c2a8dc7da95ddab2c17d0b8394a4

SHA1
9581604b7d29900b5cb266f2310d19b4c91a8373

SHA256
0680dbde73028d9766661b3f87751a3ba7a745fe2eb37171e14c60d0c25ed828

SHA512
80e53a81f403b7550d493f8a1ca0bec2e0731fa56235973e6d89b48de911950e4a2fe2b0b2447d319df2353d16a9d0f66dda84e416441800e648cb800fe15be0

Download Submit
C:\Windows\System\FwwWFaB.exe

Filesize
1.6MB

MD5
8ed4c10f5a3579b37a59a6ebaaaefd04

SHA1
cf8fd199f6431602b2adcd40a5b67b8b65dbb49c

SHA256
4c4bce70b93cdb7fcdab101de28ef0a0269171e0d20ec06226a4f3a2a8386418

SHA512
d6cf0798deca877ba3a63cbf3ec0bd581d96d7865ebe57810ceb1cce10553f9b1faf795e8133e83595be8d6ac3760ed68b0b44d10d60a102b9087cfb083cc1c0

Download Submit
C:\Windows\System\ItfBtzv.exe

Filesize
1.6MB

MD5
2e681e89f4f1689f33cc188c35f4863b

SHA1
40110cbf4fe8bbe590aaaad21f4a9c88cc095c8d

SHA256
1e066a4b797b180c1b3e7447173b00d26fc32cf29d1282a75de6c0654f0a823f

SHA512
2a362dd60a4d0647602a174a0c2327823939fc1957cc641f8aaeb269ce2452b660845aa93f928503db6951e45bbffa4b0fccef24f89d5200505209c96614b581

Download Submit
C:\Windows\System\LKctuKo.exe

Filesize
1.6MB

MD5
8c95c18f5de684222b4f569a577e017d

SHA1
ca48c51dfe930d307decabd5bc13474ee513a598

SHA256
d65bfc73547a13855a56c687c2968c206f35be545498494d2b964afa17f629a4

SHA512
4312035dc7ea39b3f144380d9486365ac67c9e5559316e7c8b35ce63ba56e451b50c4cc68678f70132e2f5ecc78e67d49b3ece4e08b5630f44bee8b39ae8044d

Download Submit
C:\Windows\System\LiQvyae.exe

Filesize
1.6MB

MD5
ff6293b64d4ea35f1a97341b0cf88111

SHA1
b9c91ae22a730e9163c05f0247bf9d65b5b92d36

SHA256
9c8a263a592fb0a2dda7f50d2d1fb993941aa9054b0deed861e310aebaaa9b38

SHA512
9334949afd9b2ffae9a87760a408b35a008e5ee3b979362f32a3b4457ed2c3237316171c15e794a792c0e5191ff8a39ab20480c044b939450a8ebc21ce6a8bc4

Download Submit
C:\Windows\System\LkhauIx.exe

Filesize
1.6MB

MD5
087159c2d89bd9fdf9d8f002cbfe99d7

SHA1
5b7db84c5589e248d568bdc2ab4c575fc29aeb48

SHA256
2c8e3ef8d3b45d76b37adfdb03b7382b0f8aab71dc7c69d410c92b40f72a2401

SHA512
3a7758cc9a83aea51d489b8428b951232f68076812165be370f647e9c7ea045c6f18832e9f8daf0d1543ee08ff94a989b7d155a76f232b10ffa70bb0acfaef52

Download Submit
C:\Windows\System\MpVtkWz.exe

Filesize
1.6MB

MD5
52586d5689618cf866e9f9e8e6e39ba3

SHA1
e57584d68adcce187dfb3fa22d4b1fbf20b5ef55

SHA256
874b5b154919e355ad7b932c2bd4a572379bd372df782ff012635d913f9568fc

SHA512
c580c46b3ac53e2a7543d8dd9c3f060660ee8c1bc1859aca999cf558f9cac7cd0f15ea40050cfece977e8ab75aac7b6df7f62c39d0f6279c5aa0bb3f540e3de0

Download Submit
C:\Windows\System\Mvkjpct.exe

Filesize
1.6MB

MD5
373143e716c53bb5985f489af7ba34e1

SHA1
5b642e1a232fa41cc1688aa253bc5a15412d6424

SHA256
05c9a4a5f9dde6dd4f5af718f97e58498c3fc6118e1491619b301f36ab348f35

SHA512
db6e3003cf139b846028181f9b8f995fdb9c93d551c132863ae9c1354c6eaf932781373a15864e249a59236a35fe7d218f01b34ef05d88e351c8a241a70fd0f3

Download Submit
C:\Windows\System\NDJCEls.exe

Filesize
1.6MB

MD5
947f4a974efae9986412c12145f28e04

SHA1
925c6fd4d86fb6955891a76c3ac1b5ad116b00c7

SHA256
a6743b158e85c15586a01be780b9da7df62462f24ef4e4860515f7a8f03df996

SHA512
9bf57905fe947e332663b3496815da702fa43905b90ea294ced4c66435db03576b583af00869edccc5cde7465d52edb904bb8c3cdeeb347dc96a6fcad5254c8d

Download Submit
C:\Windows\System\NypOcNX.exe

Filesize
1.6MB

MD5
78c1ff824a54eef8218ddf31f6de4647

SHA1
d71e2359f0e5489d0964c5fb2814363b0beca03d

SHA256
58b2cdd364ba7b27c99851560c2646890588cb1af05abae4e8779f188f0a2de7

SHA512
57e2d65bdae273e284c17b7dab9ced1f3d28012e44e062c79a15d0171f5037145017e438e8529fcf3711076317ab0527eb0a0aaa7241437db88dd00ac46d93f8

Download Submit
C:\Windows\System\QItmWbc.exe

Filesize
1.6MB

MD5
4616f930ebcad4f7756714f59cda023a

SHA1
769ee8e484a4c44932b0a308cf1e77d5ce7777e0

SHA256
ae728da48b41d2c8a9908ab01e38598e80b13660206d508a1c1a9999ecc62291

SHA512
5bdf90c371afd5ce6dd457099933925d2e17de8e0da9372d2afeb8da4c1df59278fb8561ce74f1f6d0ca4a9b84a987c42c47115a2e1eba686eda0842028b256d

Download Submit
C:\Windows\System\SlICEZm.exe

Filesize
1.6MB

MD5
959d3dd770a6cc6f8fe6341ee5823f5b

SHA1
a69fc7c52f320036fda598e0d81823270afcfa02

SHA256
7423f8856a29d9319ecc450501a7c136879633999a5f5638013f3dc6e753fac9

SHA512
27e50ba4c07427cf101b3b240d6bbc2d09cc68a8b8bc8c2951badaa50ca7348a01734755757b321c7eb686adb0504a8e583301bdc3cd2efd87d7d10db6511a2b

Download Submit
C:\Windows\System\TSeofhI.exe

Filesize
1.6MB

MD5
7de247ee883c852b63b1149a6055aa5b

SHA1
d710ff86da1d602bd61f3576864e978681c7b077

SHA256
fa5d926e8a72a19a42affb9d8457b273257d17d08110bb909e10fbfb13ea461e

SHA512
a433019f09b67deb3317a92456b72e723b456ec38eabb35d471cd5a21c2b73a8ec9b96ed59ddfa8956a57677fd7df36011049b99d9f9816ee656611f5563f040

Download Submit
C:\Windows\System\ZYYmNSb.exe

Filesize
1.6MB

MD5
38dd857a59c1c9276214182822e4387b

SHA1
ad24f2cf194cc6bcdabb9798e006373ef090d4ce

SHA256
fa2e72bafeb88d03f11e0a6180281361500972dc317c9566ce5eb62c44a3452f

SHA512
70c713a70188d2be49534cd8c6b2836a494eb44f370ff13ba546e3845e3a073ee826efb556a465e05387e7d0cb929a248fc9d3caceb3f11bec3e2d933026d1f0

Download Submit
C:\Windows\System\ZpXHZIx.exe

Filesize
1.6MB

MD5
b23ea27012581d2a4cb78272c5b873cd

SHA1
4459bf6b75e64e136174b8455bdefe6c6df7abb8

SHA256
15faaceb268aafbe567847227c66a8d5fefcda8ed7f2225a8d85ebe125d65a20

SHA512
1e372ce98ec0cae5148f8a7b70353ccb371462038dca9f4b4cf4f6bd44a30d01ea4f82a2ebf19aa32d60b927b6b84aba101869cce84bd6cc49822075f2a9dd72

Download Submit
C:\Windows\System\ZyvFAkq.exe

Filesize
1.6MB

MD5
3675a8b1f8f55e3ad8c64f3e0e7f1f9f

SHA1
9f76dffd6b155c77d0fb657336ed988a1e4535b4

SHA256
ef9b9f114895f0ba8b1868f25e0e0487a3dfbea8e295e3e5d2ab1e17f4c1ea71

SHA512
5bfc4158001b6632a7c642e5310405202b51fb0d7aab61e5b2b0aaecb430aeaebe6b6b11a15f1002bdbf93f34adcefe96accdb327c1236a6c8f3d971c9f66900

Download Submit
C:\Windows\System\bXPpKJp.exe

Filesize
1.6MB

MD5
a2e8a527cb21695f2a8fc7694d912ea6

SHA1
1d6a71e6271e5e657ab109eb551cb90b754f30a1

SHA256
c3bac4997fbd2f43fd41112e6cc93e373deeeae778028281ce18f12f4ec9dada

SHA512
3f839d531989572b9d822b5a6c05d61996b9e54775e5ffdbd3d280d1800df751491a0082bc0b8969b0568b4551206e916695ddfc4ddee219b47d1f242fae06a3

Download Submit
C:\Windows\System\cCxGloy.exe

Filesize
1.6MB

MD5
8efb378bc2756fee453f5e21c5b8879e

SHA1
501dee2bbc49e57eac8c8bd4973cb8026a10d9af

SHA256
a52f5d85f01f71c5a09f45692e029e34b5254efb42d6e22892fff5b782a81299

SHA512
421e18567054b6520855c4d033941c6efdceecbcbd2587c0221723cef8801c4934344872d9d061f34839a76417399a0533ee89b21ba2003d7aca37a99999e978

Download Submit
C:\Windows\System\dgpaCPK.exe

Filesize
1.6MB

MD5
12d519a23404ae66907783cfb0378775

SHA1
68d9e9c194165fa468222f8375eb0da401e14215

SHA256
50d384353677a670a1083bc34f523641a8d9fcf480185f3fd0b7fd259736fa72

SHA512
8c80c6d321df191c6b836a4dd43804e626914da55dfc1c836967f08c39c5e7e389b3312d359f2084c9d7614bdf4fb6a1f7a6304a62f1e4ff7494cf14f53d3ebb

Download Submit
C:\Windows\System\eHDcrwT.exe

Filesize
1.6MB

MD5
7db63dc23b768641d85cbed2052ac22c

SHA1
692b2c607a951d73b48ca08bf21fa9c9df788a3c

SHA256
d6c07e9874330f05169275e8ac19a2728a46815720987a30e7e86a0600d9d849

SHA512
1342e6de994003c6a379873ac03ca5cd8a778e41d4156bf9ced55a4323f8cf15a3ec58e94c54f1cb070602f4b780d4da740a9eb95173cca7d0179277292ee49e

Download Submit
C:\Windows\System\fQxllaB.exe

Filesize
1.6MB

MD5
d2aed9b7e5f79df61885035298deb1d8

SHA1
fe45d887ef2ec2144e819a3235fe6336206f1daa

SHA256
cff9faee67a13a581e614b23fa41ec7ff56f58584ecdcd71057262b4d78c5b1a

SHA512
76205f2513ae800fc17b9ed9805d67c9576e241cc3d335570f85a51fa1d644cb15b42c8ee5779a73d4cb6baec011e8a8664a40daf39474f9196c64fe8d210cdc

Download Submit
C:\Windows\System\hUiboSe.exe

Filesize
1.6MB

MD5
4e9ba35691edd667467369106be542aa

SHA1
0527ceb89342cf4774d362f9a34940f667cbf9f3

SHA256
cd5e3103626c4dc9f5448f3375bd4313942b2e2ad64b85c23644cde35911c9ef

SHA512
218df071bb2381898b5d9614c01ac666a117e07327018265dd79ab3d4fa203ffaad8ce6a012f4aa4f6d1281bb4dab51a39245f80fa37320a525eb7f73894eb7e

Download Submit
C:\Windows\System\hWayLMo.exe

Filesize
1.6MB

MD5
5cdd94b747547cc460034ada05b76ede

SHA1
afaff13e4fb087d603b79e448b087cbf1fdeb613

SHA256
ba8d1c8147817845c2858f08a47961153776ab5cb60ff3190f46bac318e05edb

SHA512
1c59d36e40c464a61aa4ee019af1f60d72f187e87dc7797bbf13a053bc73f3babaa0435be2d82484e8e1ab626dfb7b6bdc9db6845f6bdaffe4265d229616452e

Download Submit
C:\Windows\System\iYGHdNi.exe

Filesize
1.6MB

MD5
f53151b1b2675d16f937983633b0fc62

SHA1
4e508cb571eb9850c9b218beada0c7986e5bb64c

SHA256
9a2fb345aecd591dfdf53e71ac81b5c83d122eef3c17a29657aad7812f8a7fd6

SHA512
6592629b14ebf51b4b017669b9a0583a7b06249c74cf4f636b92f131eb0bc09716bfc7954a45fb54b6d6b58ef34a0f61b2a5440b7dd0d4ba956acbc7f38d37ff

Download Submit
C:\Windows\System\jnFzSyx.exe

Filesize
1.6MB

MD5
c3881615c5b744e230e1e5f7d3de21e7

SHA1
0aa86bb25bc80f1c4329977d855bdb5703e9f834

SHA256
6941d0468cc2f407f805e73a4c42a6a1569b5e4d9d45a23b48223fd907ccf7ae

SHA512
7d5c70af61203e3074b29d1e460a287db47e4c84fc0fedbb7789803feaae6d9114e2c2142d594be37c14f427e554e138b7f8bfebdaee7aa9f8d14e832a104c5d

Download Submit
C:\Windows\System\kwKCLzb.exe

Filesize
1.6MB

MD5
be164541dda2466564f76128ed489cb0

SHA1
9ac58d55e47d2477c83450d268b42ca2f975456f

SHA256
be6eddbea7456d0ab566e8eea535890dcd1de767274daacf0cc47eb0132545c7

SHA512
0d532307bf9451aad26e0ea7f9e329996c824c881d7ad60ef066d632a3e83b44b74595d98b8e4e98fd11a8fb0f4730a037b1fef0e37d70d66c69bb5fd1f34e12

Download Submit
C:\Windows\System\lyysFkT.exe

Filesize
1.6MB

MD5
f425ab53e675a5f643482e1eb18f9769

SHA1
101f4be7bf32aa8b500860d5dc2aee271bdd308d

SHA256
bab4f10a588999489d54677eb4bcec63ae6bd59855e35f1145079e83b06a3bcd

SHA512
870f6eea14a1201db49a203591b3c0f5fd9546c4c52a674fae2799099d1882f7c5b1b27c3a758e26538b16e914113b32470c3b6869c87075461e6c5292ebd0d4

Download Submit
C:\Windows\System\sHjRqbl.exe

Filesize
1.6MB

MD5
87673b7a6286f3e8f930ac532382a4b3

SHA1
1053391785e5c21eda73299a780c3123c49e1076

SHA256
72e13890737f1a250a4d5007dc6e437f28170d79a1daf32c78baf2bf5e09374b

SHA512
d5b6ffe102f93546a4bb6a3b2a61687f0cc681f452e70d4215952faec644fe389fe38b713258fe4f583eca01a444a1bd6a1ba7128e6ee649a7cb8d1b769ee50d

Download Submit
C:\Windows\System\srOZqXY.exe

Filesize
1.6MB

MD5
b43092ecf65ea493557a735eb523ef08

SHA1
ca4e37cdac4d8e1301bc3c53c9764bdcaf1fe1f5

SHA256
1d09940940c7b20e4bb8db29ecb277aae4e9c5436cca7b8f6c4bdf92e57b7b4b

SHA512
07e91eef829d31617e397f16dfe84d010bd4354613458a70f8783361e0498e65f4d5eaf0b3ef4e54ffd5c6ec0ff5cd29867ef140cb10eb04a16468160700b222

Download Submit
C:\Windows\System\tFRruPG.exe

Filesize
1.6MB

MD5
b29f2dd5d9d2f7ad385ac4cc197b70f9

SHA1
db5413f2dac65fb85acba5f284cb579f60ed2252

SHA256
43287b0059cb131e837b84839794b5273ea23ba72e1f51d45114bdd7f795a116

SHA512
5ac9d101848a84df0dbf7a16c9b8629a227c37424b35964f8172eabe217ed6cc0a5d01decf9a4b5379d88c0b7cfc6626323434d1dc41b91f6cfacf2e54a0c3bc

Download Submit
C:\Windows\System\wXMmLkR.exe

Filesize
1.6MB

MD5
9cadc75f67daa3e9036cf386909eec53

SHA1
4cd70bcf6ef3e5ee2b20b4c195e7c9e9bcd34075

SHA256
c4acada590b6348c462a366f414277adfc9dd7173bedbe4fe9ec45c2cf21d945

SHA512
cccf4eb9ad6a8e866b256da9363a03ee93ac0c12eb4bfaf251888e2c5402436431168594352c5adc6454fe56b0bbc688440369a5ca0671e6f6a2fc540cba0195

Download Submit
memory/3940-0-0x0000018FFE400000-0x0000018FFE410000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads