xmrig | 694333b2d10c88cbb0d68f46c4d517df1a03986b2750b4555b17ccfe56db8024

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
25/01/2025, 23:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

694333b2d10c88cbb0d68f46c4d517df1a03986b2750b4555b17ccfe56db8024.exe
Size

2.0MB
MD5

287de6307117651b79ab4d2727beeba3
SHA1

52dd3f582bd53ec1a74bb4e8daf349e7a2f3eb4b
SHA256

694333b2d10c88cbb0d68f46c4d517df1a03986b2750b4555b17ccfe56db8024
SHA512

acf9cf39678ec141e41527070514b889ea2fac2054947f4b80817f7519c829c5f680a9c556bb18d2c4d4b92d32fc3bd594433b91b7880cc8bdabdedd54f28f8f
SSDEEP

49152:GezaTF8FcNkNdfE0pZ9ozttwIRRvzcd8M3wN7K8h4vZ:GemTLkNdfE0pZyA

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 33 IoCs

miner

resource	yara_rule
behavioral2/files/0x000c000000023b8b-4.dat	xmrig
behavioral2/files/0x0008000000023c71-9.dat	xmrig
behavioral2/files/0x0007000000023c76-18.dat	xmrig
behavioral2/files/0x0007000000023c78-26.dat	xmrig
behavioral2/files/0x0007000000023c79-33.dat	xmrig
behavioral2/files/0x0007000000023c7b-42.dat	xmrig
behavioral2/files/0x0007000000023c7d-52.dat	xmrig
behavioral2/files/0x0007000000023c7e-58.dat	xmrig
behavioral2/files/0x0007000000023c85-89.dat	xmrig
behavioral2/files/0x0007000000023c94-162.dat	xmrig
behavioral2/files/0x0007000000023c92-160.dat	xmrig
behavioral2/files/0x0007000000023c93-157.dat	xmrig
behavioral2/files/0x0007000000023c91-152.dat	xmrig
behavioral2/files/0x0007000000023c90-148.dat	xmrig
behavioral2/files/0x0007000000023c8f-142.dat	xmrig
behavioral2/files/0x0007000000023c8e-138.dat	xmrig
behavioral2/files/0x0007000000023c8d-133.dat	xmrig
behavioral2/files/0x0007000000023c8c-128.dat	xmrig
behavioral2/files/0x0007000000023c8b-122.dat	xmrig
behavioral2/files/0x0007000000023c8a-118.dat	xmrig
behavioral2/files/0x0007000000023c89-113.dat	xmrig
behavioral2/files/0x0007000000023c88-107.dat	xmrig
behavioral2/files/0x0007000000023c87-103.dat	xmrig
behavioral2/files/0x0007000000023c86-98.dat	xmrig
behavioral2/files/0x0007000000023c84-87.dat	xmrig
behavioral2/files/0x0007000000023c83-83.dat	xmrig
behavioral2/files/0x0007000000023c82-77.dat	xmrig
behavioral2/files/0x0007000000023c81-73.dat	xmrig
behavioral2/files/0x0007000000023c80-68.dat	xmrig
behavioral2/files/0x0007000000023c7f-63.dat	xmrig
behavioral2/files/0x0007000000023c7c-48.dat	xmrig
behavioral2/files/0x0007000000023c7a-38.dat	xmrig
behavioral2/files/0x0007000000023c77-21.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
3952	QiopAZE.exe
1168	IGTXqrv.exe
3512	HCSpJyT.exe
3296	LvSwhvl.exe
1500	pWDsTZh.exe
2844	kzsExoj.exe
2948	pgZOAOj.exe
3236	fMqxuBH.exe
216	LnaXdiZ.exe
224	zNACixI.exe
4220	bwKtPZV.exe
3384	FfSiAKW.exe
4596	FVZpnqH.exe
3516	bOODYXe.exe
208	dOscadT.exe
448	AdIIlaK.exe
1388	nkkAwwP.exe
4564	ghfXkFX.exe
2092	RwqjnZa.exe
2148	WuSHIcz.exe
3068	inkMTKG.exe
2920	fuWGHkg.exe
5004	vrkyQOV.exe
3688	iGQaFZz.exe
1856	gwDGlgh.exe
712	nFhIIOi.exe
4224	NHrcXzI.exe
1556	eyaaHEl.exe
3248	psdyrGm.exe
5108	qlyQhnJ.exe
4700	gUBHWho.exe
1208	LEWSelm.exe
1568	vXNCYWR.exe
2316	lJKjVou.exe
4016	byUckuJ.exe
2268	tKuFLBh.exe
4060	cbuPlnj.exe
3928	KRkWUeX.exe
2896	wzFDkpe.exe
2716	NjjgaSN.exe
3604	eyzWSbu.exe
3700	ZLzqKVQ.exe
4484	hJJLLJi.exe
2252	NdtiMwh.exe
2680	CuiULnp.exe
2020	eWhvfNM.exe
2024	tRuItyp.exe
4424	oFXTvBQ.exe
4436	nmhtPhU.exe
4640	tLvtHmZ.exe
3144	fFAdItD.exe
2884	FbFQDeP.exe
4144	TgUnLjY.exe
4284	hFPVLrA.exe
396	LzAomSC.exe
2704	YdgvRtA.exe
1424	nKmrDTG.exe
2356	CalblIN.exe
4800	kSiqRdn.exe
4056	TvPZfoH.exe
1912	yteSvWy.exe
3888	XGsEeNV.exe
1236	vBtfFGF.exe
3972	UcnCFqQ.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\AFlxWnd.exe	694333b2d10c88cbb0d68f46c4d517df1a03986b2750b4555b17ccfe56db8024.exe
File created	C:\Windows\System\blIVgbh.exe	694333b2d10c88cbb0d68f46c4d517df1a03986b2750b4555b17ccfe56db8024.exe
File created	C:\Windows\System\VqrOCfq.exe	694333b2d10c88cbb0d68f46c4d517df1a03986b2750b4555b17ccfe56db8024.exe
File created	C:\Windows\System\HRTfqPc.exe	694333b2d10c88cbb0d68f46c4d517df1a03986b2750b4555b17ccfe56db8024.exe
File created	C:\Windows\System\LnaXdiZ.exe	694333b2d10c88cbb0d68f46c4d517df1a03986b2750b4555b17ccfe56db8024.exe
File created	C:\Windows\System\cdvAOqQ.exe	694333b2d10c88cbb0d68f46c4d517df1a03986b2750b4555b17ccfe56db8024.exe
File created	C:\Windows\System\iUqOXXF.exe	694333b2d10c88cbb0d68f46c4d517df1a03986b2750b4555b17ccfe56db8024.exe
File created	C:\Windows\System\gRyzaYr.exe	694333b2d10c88cbb0d68f46c4d517df1a03986b2750b4555b17ccfe56db8024.exe
File created	C:\Windows\System\JzNOXgJ.exe	694333b2d10c88cbb0d68f46c4d517df1a03986b2750b4555b17ccfe56db8024.exe
File created	C:\Windows\System\vGZuwXq.exe	694333b2d10c88cbb0d68f46c4d517df1a03986b2750b4555b17ccfe56db8024.exe
File created	C:\Windows\System\HaWdOkV.exe	694333b2d10c88cbb0d68f46c4d517df1a03986b2750b4555b17ccfe56db8024.exe
File created	C:\Windows\System\kvRZgci.exe	694333b2d10c88cbb0d68f46c4d517df1a03986b2750b4555b17ccfe56db8024.exe
File created	C:\Windows\System\UzBpWwl.exe	694333b2d10c88cbb0d68f46c4d517df1a03986b2750b4555b17ccfe56db8024.exe
File created	C:\Windows\System\jhvpwwp.exe	694333b2d10c88cbb0d68f46c4d517df1a03986b2750b4555b17ccfe56db8024.exe
File created	C:\Windows\System\NDwQuWK.exe	694333b2d10c88cbb0d68f46c4d517df1a03986b2750b4555b17ccfe56db8024.exe
File created	C:\Windows\System\eRUYpQy.exe	694333b2d10c88cbb0d68f46c4d517df1a03986b2750b4555b17ccfe56db8024.exe
File created	C:\Windows\System\uGFisXn.exe	694333b2d10c88cbb0d68f46c4d517df1a03986b2750b4555b17ccfe56db8024.exe
File created	C:\Windows\System\TgUnLjY.exe	694333b2d10c88cbb0d68f46c4d517df1a03986b2750b4555b17ccfe56db8024.exe
File created	C:\Windows\System\dxjNvBn.exe	694333b2d10c88cbb0d68f46c4d517df1a03986b2750b4555b17ccfe56db8024.exe
File created	C:\Windows\System\vZPekHI.exe	694333b2d10c88cbb0d68f46c4d517df1a03986b2750b4555b17ccfe56db8024.exe
File created	C:\Windows\System\qbyksYs.exe	694333b2d10c88cbb0d68f46c4d517df1a03986b2750b4555b17ccfe56db8024.exe
File created	C:\Windows\System\aaAoESQ.exe	694333b2d10c88cbb0d68f46c4d517df1a03986b2750b4555b17ccfe56db8024.exe
File created	C:\Windows\System\eWhvfNM.exe	694333b2d10c88cbb0d68f46c4d517df1a03986b2750b4555b17ccfe56db8024.exe
File created	C:\Windows\System\XClMRWR.exe	694333b2d10c88cbb0d68f46c4d517df1a03986b2750b4555b17ccfe56db8024.exe
File created	C:\Windows\System\VEiUgGG.exe	694333b2d10c88cbb0d68f46c4d517df1a03986b2750b4555b17ccfe56db8024.exe
File created	C:\Windows\System\FxfYtjX.exe	694333b2d10c88cbb0d68f46c4d517df1a03986b2750b4555b17ccfe56db8024.exe
File created	C:\Windows\System\MlybeKa.exe	694333b2d10c88cbb0d68f46c4d517df1a03986b2750b4555b17ccfe56db8024.exe
File created	C:\Windows\System\zQmVgiA.exe	694333b2d10c88cbb0d68f46c4d517df1a03986b2750b4555b17ccfe56db8024.exe
File created	C:\Windows\System\FFPJyNG.exe	694333b2d10c88cbb0d68f46c4d517df1a03986b2750b4555b17ccfe56db8024.exe
File created	C:\Windows\System\VKlaaje.exe	694333b2d10c88cbb0d68f46c4d517df1a03986b2750b4555b17ccfe56db8024.exe
File created	C:\Windows\System\FaMiJZv.exe	694333b2d10c88cbb0d68f46c4d517df1a03986b2750b4555b17ccfe56db8024.exe
File created	C:\Windows\System\BpYboOj.exe	694333b2d10c88cbb0d68f46c4d517df1a03986b2750b4555b17ccfe56db8024.exe
File created	C:\Windows\System\eTmTFYX.exe	694333b2d10c88cbb0d68f46c4d517df1a03986b2750b4555b17ccfe56db8024.exe
File created	C:\Windows\System\NRZQiFt.exe	694333b2d10c88cbb0d68f46c4d517df1a03986b2750b4555b17ccfe56db8024.exe
File created	C:\Windows\System\iyLoscX.exe	694333b2d10c88cbb0d68f46c4d517df1a03986b2750b4555b17ccfe56db8024.exe
File created	C:\Windows\System\rsVKSve.exe	694333b2d10c88cbb0d68f46c4d517df1a03986b2750b4555b17ccfe56db8024.exe
File created	C:\Windows\System\VALLobt.exe	694333b2d10c88cbb0d68f46c4d517df1a03986b2750b4555b17ccfe56db8024.exe
File created	C:\Windows\System\dvJKUWJ.exe	694333b2d10c88cbb0d68f46c4d517df1a03986b2750b4555b17ccfe56db8024.exe
File created	C:\Windows\System\wpquwIV.exe	694333b2d10c88cbb0d68f46c4d517df1a03986b2750b4555b17ccfe56db8024.exe
File created	C:\Windows\System\hUkeDik.exe	694333b2d10c88cbb0d68f46c4d517df1a03986b2750b4555b17ccfe56db8024.exe
File created	C:\Windows\System\XeXWMuW.exe	694333b2d10c88cbb0d68f46c4d517df1a03986b2750b4555b17ccfe56db8024.exe
File created	C:\Windows\System\yrVUhyA.exe	694333b2d10c88cbb0d68f46c4d517df1a03986b2750b4555b17ccfe56db8024.exe
File created	C:\Windows\System\wBJDQjW.exe	694333b2d10c88cbb0d68f46c4d517df1a03986b2750b4555b17ccfe56db8024.exe
File created	C:\Windows\System\DMrIYwC.exe	694333b2d10c88cbb0d68f46c4d517df1a03986b2750b4555b17ccfe56db8024.exe
File created	C:\Windows\System\cWTdfav.exe	694333b2d10c88cbb0d68f46c4d517df1a03986b2750b4555b17ccfe56db8024.exe
File created	C:\Windows\System\djTfCNl.exe	694333b2d10c88cbb0d68f46c4d517df1a03986b2750b4555b17ccfe56db8024.exe
File created	C:\Windows\System\imqQYRW.exe	694333b2d10c88cbb0d68f46c4d517df1a03986b2750b4555b17ccfe56db8024.exe
File created	C:\Windows\System\PCGbLef.exe	694333b2d10c88cbb0d68f46c4d517df1a03986b2750b4555b17ccfe56db8024.exe
File created	C:\Windows\System\nBqPAoA.exe	694333b2d10c88cbb0d68f46c4d517df1a03986b2750b4555b17ccfe56db8024.exe
File created	C:\Windows\System\muVvdpO.exe	694333b2d10c88cbb0d68f46c4d517df1a03986b2750b4555b17ccfe56db8024.exe
File created	C:\Windows\System\cCwrRJo.exe	694333b2d10c88cbb0d68f46c4d517df1a03986b2750b4555b17ccfe56db8024.exe
File created	C:\Windows\System\sPWkyCX.exe	694333b2d10c88cbb0d68f46c4d517df1a03986b2750b4555b17ccfe56db8024.exe
File created	C:\Windows\System\awQbXbE.exe	694333b2d10c88cbb0d68f46c4d517df1a03986b2750b4555b17ccfe56db8024.exe
File created	C:\Windows\System\pDqvjdv.exe	694333b2d10c88cbb0d68f46c4d517df1a03986b2750b4555b17ccfe56db8024.exe
File created	C:\Windows\System\nhcCLcP.exe	694333b2d10c88cbb0d68f46c4d517df1a03986b2750b4555b17ccfe56db8024.exe
File created	C:\Windows\System\WYSjMHa.exe	694333b2d10c88cbb0d68f46c4d517df1a03986b2750b4555b17ccfe56db8024.exe
File created	C:\Windows\System\ZYrpkzx.exe	694333b2d10c88cbb0d68f46c4d517df1a03986b2750b4555b17ccfe56db8024.exe
File created	C:\Windows\System\dsyAQbd.exe	694333b2d10c88cbb0d68f46c4d517df1a03986b2750b4555b17ccfe56db8024.exe
File created	C:\Windows\System\TWYxAWv.exe	694333b2d10c88cbb0d68f46c4d517df1a03986b2750b4555b17ccfe56db8024.exe
File created	C:\Windows\System\RJYglch.exe	694333b2d10c88cbb0d68f46c4d517df1a03986b2750b4555b17ccfe56db8024.exe
File created	C:\Windows\System\HzkfKvQ.exe	694333b2d10c88cbb0d68f46c4d517df1a03986b2750b4555b17ccfe56db8024.exe
File created	C:\Windows\System\VXTCYYn.exe	694333b2d10c88cbb0d68f46c4d517df1a03986b2750b4555b17ccfe56db8024.exe
File created	C:\Windows\System\ZutUKHp.exe	694333b2d10c88cbb0d68f46c4d517df1a03986b2750b4555b17ccfe56db8024.exe
File created	C:\Windows\System\GvJQvpC.exe	694333b2d10c88cbb0d68f46c4d517df1a03986b2750b4555b17ccfe56db8024.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	17100	dwm.exe
Token: SeChangeNotifyPrivilege	17100	dwm.exe
Token: 33	17100	dwm.exe
Token: SeIncBasePriorityPrivilege	17100	dwm.exe
Token: SeShutdownPrivilege	17100	dwm.exe
Token: SeCreatePagefilePrivilege	17100	dwm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 392 wrote to memory of 3952	392	694333b2d10c88cbb0d68f46c4d517df1a03986b2750b4555b17ccfe56db8024.exe	84
PID 392 wrote to memory of 3952	392	694333b2d10c88cbb0d68f46c4d517df1a03986b2750b4555b17ccfe56db8024.exe	84
PID 392 wrote to memory of 1168	392	694333b2d10c88cbb0d68f46c4d517df1a03986b2750b4555b17ccfe56db8024.exe	85
PID 392 wrote to memory of 1168	392	694333b2d10c88cbb0d68f46c4d517df1a03986b2750b4555b17ccfe56db8024.exe	85
PID 392 wrote to memory of 3512	392	694333b2d10c88cbb0d68f46c4d517df1a03986b2750b4555b17ccfe56db8024.exe	86
PID 392 wrote to memory of 3512	392	694333b2d10c88cbb0d68f46c4d517df1a03986b2750b4555b17ccfe56db8024.exe	86
PID 392 wrote to memory of 3296	392	694333b2d10c88cbb0d68f46c4d517df1a03986b2750b4555b17ccfe56db8024.exe	87
PID 392 wrote to memory of 3296	392	694333b2d10c88cbb0d68f46c4d517df1a03986b2750b4555b17ccfe56db8024.exe	87
PID 392 wrote to memory of 1500	392	694333b2d10c88cbb0d68f46c4d517df1a03986b2750b4555b17ccfe56db8024.exe	88
PID 392 wrote to memory of 1500	392	694333b2d10c88cbb0d68f46c4d517df1a03986b2750b4555b17ccfe56db8024.exe	88
PID 392 wrote to memory of 2844	392	694333b2d10c88cbb0d68f46c4d517df1a03986b2750b4555b17ccfe56db8024.exe	89
PID 392 wrote to memory of 2844	392	694333b2d10c88cbb0d68f46c4d517df1a03986b2750b4555b17ccfe56db8024.exe	89
PID 392 wrote to memory of 2948	392	694333b2d10c88cbb0d68f46c4d517df1a03986b2750b4555b17ccfe56db8024.exe	90
PID 392 wrote to memory of 2948	392	694333b2d10c88cbb0d68f46c4d517df1a03986b2750b4555b17ccfe56db8024.exe	90
PID 392 wrote to memory of 3236	392	694333b2d10c88cbb0d68f46c4d517df1a03986b2750b4555b17ccfe56db8024.exe	91
PID 392 wrote to memory of 3236	392	694333b2d10c88cbb0d68f46c4d517df1a03986b2750b4555b17ccfe56db8024.exe	91
PID 392 wrote to memory of 216	392	694333b2d10c88cbb0d68f46c4d517df1a03986b2750b4555b17ccfe56db8024.exe	92
PID 392 wrote to memory of 216	392	694333b2d10c88cbb0d68f46c4d517df1a03986b2750b4555b17ccfe56db8024.exe	92
PID 392 wrote to memory of 224	392	694333b2d10c88cbb0d68f46c4d517df1a03986b2750b4555b17ccfe56db8024.exe	93
PID 392 wrote to memory of 224	392	694333b2d10c88cbb0d68f46c4d517df1a03986b2750b4555b17ccfe56db8024.exe	93
PID 392 wrote to memory of 4220	392	694333b2d10c88cbb0d68f46c4d517df1a03986b2750b4555b17ccfe56db8024.exe	94
PID 392 wrote to memory of 4220	392	694333b2d10c88cbb0d68f46c4d517df1a03986b2750b4555b17ccfe56db8024.exe	94
PID 392 wrote to memory of 3384	392	694333b2d10c88cbb0d68f46c4d517df1a03986b2750b4555b17ccfe56db8024.exe	95
PID 392 wrote to memory of 3384	392	694333b2d10c88cbb0d68f46c4d517df1a03986b2750b4555b17ccfe56db8024.exe	95
PID 392 wrote to memory of 4596	392	694333b2d10c88cbb0d68f46c4d517df1a03986b2750b4555b17ccfe56db8024.exe	96
PID 392 wrote to memory of 4596	392	694333b2d10c88cbb0d68f46c4d517df1a03986b2750b4555b17ccfe56db8024.exe	96
PID 392 wrote to memory of 3516	392	694333b2d10c88cbb0d68f46c4d517df1a03986b2750b4555b17ccfe56db8024.exe	97
PID 392 wrote to memory of 3516	392	694333b2d10c88cbb0d68f46c4d517df1a03986b2750b4555b17ccfe56db8024.exe	97
PID 392 wrote to memory of 208	392	694333b2d10c88cbb0d68f46c4d517df1a03986b2750b4555b17ccfe56db8024.exe	98
PID 392 wrote to memory of 208	392	694333b2d10c88cbb0d68f46c4d517df1a03986b2750b4555b17ccfe56db8024.exe	98
PID 392 wrote to memory of 448	392	694333b2d10c88cbb0d68f46c4d517df1a03986b2750b4555b17ccfe56db8024.exe	99
PID 392 wrote to memory of 448	392	694333b2d10c88cbb0d68f46c4d517df1a03986b2750b4555b17ccfe56db8024.exe	99
PID 392 wrote to memory of 1388	392	694333b2d10c88cbb0d68f46c4d517df1a03986b2750b4555b17ccfe56db8024.exe	100
PID 392 wrote to memory of 1388	392	694333b2d10c88cbb0d68f46c4d517df1a03986b2750b4555b17ccfe56db8024.exe	100
PID 392 wrote to memory of 4564	392	694333b2d10c88cbb0d68f46c4d517df1a03986b2750b4555b17ccfe56db8024.exe	101
PID 392 wrote to memory of 4564	392	694333b2d10c88cbb0d68f46c4d517df1a03986b2750b4555b17ccfe56db8024.exe	101
PID 392 wrote to memory of 2092	392	694333b2d10c88cbb0d68f46c4d517df1a03986b2750b4555b17ccfe56db8024.exe	102
PID 392 wrote to memory of 2092	392	694333b2d10c88cbb0d68f46c4d517df1a03986b2750b4555b17ccfe56db8024.exe	102
PID 392 wrote to memory of 2148	392	694333b2d10c88cbb0d68f46c4d517df1a03986b2750b4555b17ccfe56db8024.exe	103
PID 392 wrote to memory of 2148	392	694333b2d10c88cbb0d68f46c4d517df1a03986b2750b4555b17ccfe56db8024.exe	103
PID 392 wrote to memory of 3068	392	694333b2d10c88cbb0d68f46c4d517df1a03986b2750b4555b17ccfe56db8024.exe	104
PID 392 wrote to memory of 3068	392	694333b2d10c88cbb0d68f46c4d517df1a03986b2750b4555b17ccfe56db8024.exe	104
PID 392 wrote to memory of 2920	392	694333b2d10c88cbb0d68f46c4d517df1a03986b2750b4555b17ccfe56db8024.exe	105
PID 392 wrote to memory of 2920	392	694333b2d10c88cbb0d68f46c4d517df1a03986b2750b4555b17ccfe56db8024.exe	105
PID 392 wrote to memory of 5004	392	694333b2d10c88cbb0d68f46c4d517df1a03986b2750b4555b17ccfe56db8024.exe	106
PID 392 wrote to memory of 5004	392	694333b2d10c88cbb0d68f46c4d517df1a03986b2750b4555b17ccfe56db8024.exe	106
PID 392 wrote to memory of 3688	392	694333b2d10c88cbb0d68f46c4d517df1a03986b2750b4555b17ccfe56db8024.exe	107
PID 392 wrote to memory of 3688	392	694333b2d10c88cbb0d68f46c4d517df1a03986b2750b4555b17ccfe56db8024.exe	107
PID 392 wrote to memory of 1856	392	694333b2d10c88cbb0d68f46c4d517df1a03986b2750b4555b17ccfe56db8024.exe	108
PID 392 wrote to memory of 1856	392	694333b2d10c88cbb0d68f46c4d517df1a03986b2750b4555b17ccfe56db8024.exe	108
PID 392 wrote to memory of 712	392	694333b2d10c88cbb0d68f46c4d517df1a03986b2750b4555b17ccfe56db8024.exe	109
PID 392 wrote to memory of 712	392	694333b2d10c88cbb0d68f46c4d517df1a03986b2750b4555b17ccfe56db8024.exe	109
PID 392 wrote to memory of 4224	392	694333b2d10c88cbb0d68f46c4d517df1a03986b2750b4555b17ccfe56db8024.exe	110
PID 392 wrote to memory of 4224	392	694333b2d10c88cbb0d68f46c4d517df1a03986b2750b4555b17ccfe56db8024.exe	110
PID 392 wrote to memory of 1556	392	694333b2d10c88cbb0d68f46c4d517df1a03986b2750b4555b17ccfe56db8024.exe	111
PID 392 wrote to memory of 1556	392	694333b2d10c88cbb0d68f46c4d517df1a03986b2750b4555b17ccfe56db8024.exe	111
PID 392 wrote to memory of 3248	392	694333b2d10c88cbb0d68f46c4d517df1a03986b2750b4555b17ccfe56db8024.exe	112
PID 392 wrote to memory of 3248	392	694333b2d10c88cbb0d68f46c4d517df1a03986b2750b4555b17ccfe56db8024.exe	112
PID 392 wrote to memory of 5108	392	694333b2d10c88cbb0d68f46c4d517df1a03986b2750b4555b17ccfe56db8024.exe	113
PID 392 wrote to memory of 5108	392	694333b2d10c88cbb0d68f46c4d517df1a03986b2750b4555b17ccfe56db8024.exe	113
PID 392 wrote to memory of 4700	392	694333b2d10c88cbb0d68f46c4d517df1a03986b2750b4555b17ccfe56db8024.exe	114
PID 392 wrote to memory of 4700	392	694333b2d10c88cbb0d68f46c4d517df1a03986b2750b4555b17ccfe56db8024.exe	114
PID 392 wrote to memory of 1208	392	694333b2d10c88cbb0d68f46c4d517df1a03986b2750b4555b17ccfe56db8024.exe	115
PID 392 wrote to memory of 1208	392	694333b2d10c88cbb0d68f46c4d517df1a03986b2750b4555b17ccfe56db8024.exe	115

C:\Users\Admin\AppData\Local\Temp\694333b2d10c88cbb0d68f46c4d517df1a03986b2750b4555b17ccfe56db8024.exe
"C:\Users\Admin\AppData\Local\Temp\694333b2d10c88cbb0d68f46c4d517df1a03986b2750b4555b17ccfe56db8024.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:392
- C:\Windows\System\QiopAZE.exe
  C:\Windows\System\QiopAZE.exe
  2⤵
  - Executes dropped EXE
  PID:3952
- C:\Windows\System\IGTXqrv.exe
  C:\Windows\System\IGTXqrv.exe
  2⤵
  - Executes dropped EXE
  PID:1168
- C:\Windows\System\HCSpJyT.exe
  C:\Windows\System\HCSpJyT.exe
  2⤵
  - Executes dropped EXE
  PID:3512
- C:\Windows\System\LvSwhvl.exe
  C:\Windows\System\LvSwhvl.exe
  2⤵
  - Executes dropped EXE
  PID:3296
- C:\Windows\System\pWDsTZh.exe
  C:\Windows\System\pWDsTZh.exe
  2⤵
  - Executes dropped EXE
  PID:1500
- C:\Windows\System\kzsExoj.exe
  C:\Windows\System\kzsExoj.exe
  2⤵
  - Executes dropped EXE
  PID:2844
- C:\Windows\System\pgZOAOj.exe
  C:\Windows\System\pgZOAOj.exe
  2⤵
  - Executes dropped EXE
  PID:2948
- C:\Windows\System\fMqxuBH.exe
  C:\Windows\System\fMqxuBH.exe
  2⤵
  - Executes dropped EXE
  PID:3236
- C:\Windows\System\LnaXdiZ.exe
  C:\Windows\System\LnaXdiZ.exe
  2⤵
  - Executes dropped EXE
  PID:216
- C:\Windows\System\zNACixI.exe
  C:\Windows\System\zNACixI.exe
  2⤵
  - Executes dropped EXE
  PID:224
- C:\Windows\System\bwKtPZV.exe
  C:\Windows\System\bwKtPZV.exe
  2⤵
  - Executes dropped EXE
  PID:4220
- C:\Windows\System\FfSiAKW.exe
  C:\Windows\System\FfSiAKW.exe
  2⤵
  - Executes dropped EXE
  PID:3384
- C:\Windows\System\FVZpnqH.exe
  C:\Windows\System\FVZpnqH.exe
  2⤵
  - Executes dropped EXE
  PID:4596
- C:\Windows\System\bOODYXe.exe
  C:\Windows\System\bOODYXe.exe
  2⤵
  - Executes dropped EXE
  PID:3516
- C:\Windows\System\dOscadT.exe
  C:\Windows\System\dOscadT.exe
  2⤵
  - Executes dropped EXE
  PID:208
- C:\Windows\System\AdIIlaK.exe
  C:\Windows\System\AdIIlaK.exe
  2⤵
  - Executes dropped EXE
  PID:448
- C:\Windows\System\nkkAwwP.exe
  C:\Windows\System\nkkAwwP.exe
  2⤵
  - Executes dropped EXE
  PID:1388
- C:\Windows\System\ghfXkFX.exe
  C:\Windows\System\ghfXkFX.exe
  2⤵
  - Executes dropped EXE
  PID:4564
- C:\Windows\System\RwqjnZa.exe
  C:\Windows\System\RwqjnZa.exe
  2⤵
  - Executes dropped EXE
  PID:2092
- C:\Windows\System\WuSHIcz.exe
  C:\Windows\System\WuSHIcz.exe
  2⤵
  - Executes dropped EXE
  PID:2148
- C:\Windows\System\inkMTKG.exe
  C:\Windows\System\inkMTKG.exe
  2⤵
  - Executes dropped EXE
  PID:3068
- C:\Windows\System\fuWGHkg.exe
  C:\Windows\System\fuWGHkg.exe
  2⤵
  - Executes dropped EXE
  PID:2920
- C:\Windows\System\vrkyQOV.exe
  C:\Windows\System\vrkyQOV.exe
  2⤵
  - Executes dropped EXE
  PID:5004
- C:\Windows\System\iGQaFZz.exe
  C:\Windows\System\iGQaFZz.exe
  2⤵
  - Executes dropped EXE
  PID:3688
- C:\Windows\System\gwDGlgh.exe
  C:\Windows\System\gwDGlgh.exe
  2⤵
  - Executes dropped EXE
  PID:1856
- C:\Windows\System\nFhIIOi.exe
  C:\Windows\System\nFhIIOi.exe
  2⤵
  - Executes dropped EXE
  PID:712
- C:\Windows\System\NHrcXzI.exe
  C:\Windows\System\NHrcXzI.exe
  2⤵
  - Executes dropped EXE
  PID:4224
- C:\Windows\System\eyaaHEl.exe
  C:\Windows\System\eyaaHEl.exe
  2⤵
  - Executes dropped EXE
  PID:1556
- C:\Windows\System\psdyrGm.exe
  C:\Windows\System\psdyrGm.exe
  2⤵
  - Executes dropped EXE
  PID:3248
- C:\Windows\System\qlyQhnJ.exe
  C:\Windows\System\qlyQhnJ.exe
  2⤵
  - Executes dropped EXE
  PID:5108
- C:\Windows\System\gUBHWho.exe
  C:\Windows\System\gUBHWho.exe
  2⤵
  - Executes dropped EXE
  PID:4700
- C:\Windows\System\LEWSelm.exe
  C:\Windows\System\LEWSelm.exe
  2⤵
  - Executes dropped EXE
  PID:1208
- C:\Windows\System\vXNCYWR.exe
  C:\Windows\System\vXNCYWR.exe
  2⤵
  - Executes dropped EXE
  PID:1568
- C:\Windows\System\lJKjVou.exe
  C:\Windows\System\lJKjVou.exe
  2⤵
  - Executes dropped EXE
  PID:2316
- C:\Windows\System\byUckuJ.exe
  C:\Windows\System\byUckuJ.exe
  2⤵
  - Executes dropped EXE
  PID:4016
- C:\Windows\System\tKuFLBh.exe
  C:\Windows\System\tKuFLBh.exe
  2⤵
  - Executes dropped EXE
  PID:2268
- C:\Windows\System\cbuPlnj.exe
  C:\Windows\System\cbuPlnj.exe
  2⤵
  - Executes dropped EXE
  PID:4060
- C:\Windows\System\KRkWUeX.exe
  C:\Windows\System\KRkWUeX.exe
  2⤵
  - Executes dropped EXE
  PID:3928
- C:\Windows\System\wzFDkpe.exe
  C:\Windows\System\wzFDkpe.exe
  2⤵
  - Executes dropped EXE
  PID:2896
- C:\Windows\System\NjjgaSN.exe
  C:\Windows\System\NjjgaSN.exe
  2⤵
  - Executes dropped EXE
  PID:2716
- C:\Windows\System\eyzWSbu.exe
  C:\Windows\System\eyzWSbu.exe
  2⤵
  - Executes dropped EXE
  PID:3604
- C:\Windows\System\ZLzqKVQ.exe
  C:\Windows\System\ZLzqKVQ.exe
  2⤵
  - Executes dropped EXE
  PID:3700
- C:\Windows\System\hJJLLJi.exe
  C:\Windows\System\hJJLLJi.exe
  2⤵
  - Executes dropped EXE
  PID:4484
- C:\Windows\System\NdtiMwh.exe
  C:\Windows\System\NdtiMwh.exe
  2⤵
  - Executes dropped EXE
  PID:2252
- C:\Windows\System\CuiULnp.exe
  C:\Windows\System\CuiULnp.exe
  2⤵
  - Executes dropped EXE
  PID:2680
- C:\Windows\System\eWhvfNM.exe
  C:\Windows\System\eWhvfNM.exe
  2⤵
  - Executes dropped EXE
  PID:2020
- C:\Windows\System\tRuItyp.exe
  C:\Windows\System\tRuItyp.exe
  2⤵
  - Executes dropped EXE
  PID:2024
- C:\Windows\System\oFXTvBQ.exe
  C:\Windows\System\oFXTvBQ.exe
  2⤵
  - Executes dropped EXE
  PID:4424
- C:\Windows\System\nmhtPhU.exe
  C:\Windows\System\nmhtPhU.exe
  2⤵
  - Executes dropped EXE
  PID:4436
- C:\Windows\System\tLvtHmZ.exe
  C:\Windows\System\tLvtHmZ.exe
  2⤵
  - Executes dropped EXE
  PID:4640
- C:\Windows\System\fFAdItD.exe
  C:\Windows\System\fFAdItD.exe
  2⤵
  - Executes dropped EXE
  PID:3144
- C:\Windows\System\FbFQDeP.exe
  C:\Windows\System\FbFQDeP.exe
  2⤵
  - Executes dropped EXE
  PID:2884
- C:\Windows\System\TgUnLjY.exe
  C:\Windows\System\TgUnLjY.exe
  2⤵
  - Executes dropped EXE
  PID:4144
- C:\Windows\System\hFPVLrA.exe
  C:\Windows\System\hFPVLrA.exe
  2⤵
  - Executes dropped EXE
  PID:4284
- C:\Windows\System\LzAomSC.exe
  C:\Windows\System\LzAomSC.exe
  2⤵
  - Executes dropped EXE
  PID:396
- C:\Windows\System\YdgvRtA.exe
  C:\Windows\System\YdgvRtA.exe
  2⤵
  - Executes dropped EXE
  PID:2704
- C:\Windows\System\nKmrDTG.exe
  C:\Windows\System\nKmrDTG.exe
  2⤵
  - Executes dropped EXE
  PID:1424
- C:\Windows\System\CalblIN.exe
  C:\Windows\System\CalblIN.exe
  2⤵
  - Executes dropped EXE
  PID:2356
- C:\Windows\System\kSiqRdn.exe
  C:\Windows\System\kSiqRdn.exe
  2⤵
  - Executes dropped EXE
  PID:4800
- C:\Windows\System\TvPZfoH.exe
  C:\Windows\System\TvPZfoH.exe
  2⤵
  - Executes dropped EXE
  PID:4056
- C:\Windows\System\yteSvWy.exe
  C:\Windows\System\yteSvWy.exe
  2⤵
  - Executes dropped EXE
  PID:1912
- C:\Windows\System\XGsEeNV.exe
  C:\Windows\System\XGsEeNV.exe
  2⤵
  - Executes dropped EXE
  PID:3888
- C:\Windows\System\vBtfFGF.exe
  C:\Windows\System\vBtfFGF.exe
  2⤵
  - Executes dropped EXE
  PID:1236
- C:\Windows\System\UcnCFqQ.exe
  C:\Windows\System\UcnCFqQ.exe
  2⤵
  - Executes dropped EXE
  PID:3972
- C:\Windows\System\AXklhMO.exe
  C:\Windows\System\AXklhMO.exe
  2⤵
  PID:4432
- C:\Windows\System\DgeYxlm.exe
  C:\Windows\System\DgeYxlm.exe
  2⤵
  PID:4712
- C:\Windows\System\hsBctaE.exe
  C:\Windows\System\hsBctaE.exe
  2⤵
  PID:2556
- C:\Windows\System\HrKiyMy.exe
  C:\Windows\System\HrKiyMy.exe
  2⤵
  PID:3880
- C:\Windows\System\gFkcYbB.exe
  C:\Windows\System\gFkcYbB.exe
  2⤵
  PID:2660
- C:\Windows\System\FaMiJZv.exe
  C:\Windows\System\FaMiJZv.exe
  2⤵
  PID:4108
- C:\Windows\System\SEzInMg.exe
  C:\Windows\System\SEzInMg.exe
  2⤵
  PID:1228
- C:\Windows\System\ZVqeRIK.exe
  C:\Windows\System\ZVqeRIK.exe
  2⤵
  PID:2016
- C:\Windows\System\zdxDRKs.exe
  C:\Windows\System\zdxDRKs.exe
  2⤵
  PID:3660
- C:\Windows\System\tMsHVfX.exe
  C:\Windows\System\tMsHVfX.exe
  2⤵
  PID:5156
- C:\Windows\System\zuwoMID.exe
  C:\Windows\System\zuwoMID.exe
  2⤵
  PID:5192
- C:\Windows\System\ZsfOzDO.exe
  C:\Windows\System\ZsfOzDO.exe
  2⤵
  PID:5216
- C:\Windows\System\UAfTsvv.exe
  C:\Windows\System\UAfTsvv.exe
  2⤵
  PID:5252
- C:\Windows\System\ahIwwwH.exe
  C:\Windows\System\ahIwwwH.exe
  2⤵
  PID:5280
- C:\Windows\System\bhfbHbR.exe
  C:\Windows\System\bhfbHbR.exe
  2⤵
  PID:5308
- C:\Windows\System\awQbXbE.exe
  C:\Windows\System\awQbXbE.exe
  2⤵
  PID:5332
- C:\Windows\System\hQUqWWa.exe
  C:\Windows\System\hQUqWWa.exe
  2⤵
  PID:5364
- C:\Windows\System\RJkopcV.exe
  C:\Windows\System\RJkopcV.exe
  2⤵
  PID:5388
- C:\Windows\System\TJMdobG.exe
  C:\Windows\System\TJMdobG.exe
  2⤵
  PID:5416
- C:\Windows\System\eIhRVcS.exe
  C:\Windows\System\eIhRVcS.exe
  2⤵
  PID:5444
- C:\Windows\System\iodXpgH.exe
  C:\Windows\System\iodXpgH.exe
  2⤵
  PID:5472
- C:\Windows\System\GZOTRge.exe
  C:\Windows\System\GZOTRge.exe
  2⤵
  PID:5500
- C:\Windows\System\hwQnqZF.exe
  C:\Windows\System\hwQnqZF.exe
  2⤵
  PID:5528
- C:\Windows\System\GNUnKRN.exe
  C:\Windows\System\GNUnKRN.exe
  2⤵
  PID:5556
- C:\Windows\System\irnJoLi.exe
  C:\Windows\System\irnJoLi.exe
  2⤵
  PID:5584
- C:\Windows\System\hUkeDik.exe
  C:\Windows\System\hUkeDik.exe
  2⤵
  PID:5612
- C:\Windows\System\cYbVUjA.exe
  C:\Windows\System\cYbVUjA.exe
  2⤵
  PID:5636
- C:\Windows\System\pMtxoHz.exe
  C:\Windows\System\pMtxoHz.exe
  2⤵
  PID:5668
- C:\Windows\System\ClFwDct.exe
  C:\Windows\System\ClFwDct.exe
  2⤵
  PID:5696
- C:\Windows\System\wFGYMEI.exe
  C:\Windows\System\wFGYMEI.exe
  2⤵
  PID:5724
- C:\Windows\System\jMlEJZq.exe
  C:\Windows\System\jMlEJZq.exe
  2⤵
  PID:5752
- C:\Windows\System\JcXcRmJ.exe
  C:\Windows\System\JcXcRmJ.exe
  2⤵
  PID:5776
- C:\Windows\System\kegZSfj.exe
  C:\Windows\System\kegZSfj.exe
  2⤵
  PID:5804
- C:\Windows\System\GNeDzNn.exe
  C:\Windows\System\GNeDzNn.exe
  2⤵
  PID:5832
- C:\Windows\System\wOjHHJL.exe
  C:\Windows\System\wOjHHJL.exe
  2⤵
  PID:5864
- C:\Windows\System\mgecakH.exe
  C:\Windows\System\mgecakH.exe
  2⤵
  PID:5892
- C:\Windows\System\DbhHLfL.exe
  C:\Windows\System\DbhHLfL.exe
  2⤵
  PID:5920
- C:\Windows\System\guLEPCk.exe
  C:\Windows\System\guLEPCk.exe
  2⤵
  PID:5948
- C:\Windows\System\nLMWPQC.exe
  C:\Windows\System\nLMWPQC.exe
  2⤵
  PID:5976
- C:\Windows\System\BerMLde.exe
  C:\Windows\System\BerMLde.exe
  2⤵
  PID:6004
- C:\Windows\System\gQAuKzf.exe
  C:\Windows\System\gQAuKzf.exe
  2⤵
  PID:6032
- C:\Windows\System\sXXgGBP.exe
  C:\Windows\System\sXXgGBP.exe
  2⤵
  PID:6060
- C:\Windows\System\sHxPuOw.exe
  C:\Windows\System\sHxPuOw.exe
  2⤵
  PID:6088
- C:\Windows\System\tScaauf.exe
  C:\Windows\System\tScaauf.exe
  2⤵
  PID:6116
- C:\Windows\System\vrcBbDO.exe
  C:\Windows\System\vrcBbDO.exe
  2⤵
  PID:636
- C:\Windows\System\BRUXKvn.exe
  C:\Windows\System\BRUXKvn.exe
  2⤵
  PID:4568
- C:\Windows\System\vGZuwXq.exe
  C:\Windows\System\vGZuwXq.exe
  2⤵
  PID:3632
- C:\Windows\System\ltePOzW.exe
  C:\Windows\System\ltePOzW.exe
  2⤵
  PID:3240
- C:\Windows\System\JAhSYFL.exe
  C:\Windows\System\JAhSYFL.exe
  2⤵
  PID:3080
- C:\Windows\System\MukNbow.exe
  C:\Windows\System\MukNbow.exe
  2⤵
  PID:4472
- C:\Windows\System\vZPekHI.exe
  C:\Windows\System\vZPekHI.exe
  2⤵
  PID:4360
- C:\Windows\System\ZKLcelA.exe
  C:\Windows\System\ZKLcelA.exe
  2⤵
  PID:5132
- C:\Windows\System\DKjPOiY.exe
  C:\Windows\System\DKjPOiY.exe
  2⤵
  PID:5208
- C:\Windows\System\lVvAjVq.exe
  C:\Windows\System\lVvAjVq.exe
  2⤵
  PID:5272
- C:\Windows\System\VwldgJY.exe
  C:\Windows\System\VwldgJY.exe
  2⤵
  PID:5344
- C:\Windows\System\muVvdpO.exe
  C:\Windows\System\muVvdpO.exe
  2⤵
  PID:5404
- C:\Windows\System\olAeObO.exe
  C:\Windows\System\olAeObO.exe
  2⤵
  PID:5464
- C:\Windows\System\YJyrdOP.exe
  C:\Windows\System\YJyrdOP.exe
  2⤵
  PID:5540
- C:\Windows\System\WndkjjT.exe
  C:\Windows\System\WndkjjT.exe
  2⤵
  PID:5596
- C:\Windows\System\plTDkxf.exe
  C:\Windows\System\plTDkxf.exe
  2⤵
  PID:5660
- C:\Windows\System\FxiQeXm.exe
  C:\Windows\System\FxiQeXm.exe
  2⤵
  PID:5716
- C:\Windows\System\MOSYcje.exe
  C:\Windows\System\MOSYcje.exe
  2⤵
  PID:5792
- C:\Windows\System\HexeaNc.exe
  C:\Windows\System\HexeaNc.exe
  2⤵
  PID:5852
- C:\Windows\System\qpCxaIX.exe
  C:\Windows\System\qpCxaIX.exe
  2⤵
  PID:5912
- C:\Windows\System\xvLGJwc.exe
  C:\Windows\System\xvLGJwc.exe
  2⤵
  PID:5988
- C:\Windows\System\OnSCGWl.exe
  C:\Windows\System\OnSCGWl.exe
  2⤵
  PID:6044
- C:\Windows\System\nKFpjAz.exe
  C:\Windows\System\nKFpjAz.exe
  2⤵
  PID:6108
- C:\Windows\System\pDqvjdv.exe
  C:\Windows\System\pDqvjdv.exe
  2⤵
  PID:2296
- C:\Windows\System\KWFpKUk.exe
  C:\Windows\System\KWFpKUk.exe
  2⤵
  PID:3908
- C:\Windows\System\QZHmFEU.exe
  C:\Windows\System\QZHmFEU.exe
  2⤵
  PID:4500
- C:\Windows\System\LEYveEv.exe
  C:\Windows\System\LEYveEv.exe
  2⤵
  PID:5184
- C:\Windows\System\XOitVzw.exe
  C:\Windows\System\XOitVzw.exe
  2⤵
  PID:5324
- C:\Windows\System\ovHqBPs.exe
  C:\Windows\System\ovHqBPs.exe
  2⤵
  PID:5512
- C:\Windows\System\wMaKacd.exe
  C:\Windows\System\wMaKacd.exe
  2⤵
  PID:6164
- C:\Windows\System\GAKhkiA.exe
  C:\Windows\System\GAKhkiA.exe
  2⤵
  PID:6192
- C:\Windows\System\YlDadtC.exe
  C:\Windows\System\YlDadtC.exe
  2⤵
  PID:6216
- C:\Windows\System\jkyDzXC.exe
  C:\Windows\System\jkyDzXC.exe
  2⤵
  PID:6248
- C:\Windows\System\ggVlnnA.exe
  C:\Windows\System\ggVlnnA.exe
  2⤵
  PID:6276
- C:\Windows\System\CgsfTCy.exe
  C:\Windows\System\CgsfTCy.exe
  2⤵
  PID:6300
- C:\Windows\System\LANfLjy.exe
  C:\Windows\System\LANfLjy.exe
  2⤵
  PID:6336
- C:\Windows\System\HIYpAEK.exe
  C:\Windows\System\HIYpAEK.exe
  2⤵
  PID:6360
- C:\Windows\System\CyZkxqt.exe
  C:\Windows\System\CyZkxqt.exe
  2⤵
  PID:6388
- C:\Windows\System\twXxPwd.exe
  C:\Windows\System\twXxPwd.exe
  2⤵
  PID:6420
- C:\Windows\System\iBLyRqb.exe
  C:\Windows\System\iBLyRqb.exe
  2⤵
  PID:6452
- C:\Windows\System\CWmoFVb.exe
  C:\Windows\System\CWmoFVb.exe
  2⤵
  PID:6480
- C:\Windows\System\KjuojdY.exe
  C:\Windows\System\KjuojdY.exe
  2⤵
  PID:6500
- C:\Windows\System\SoShAYF.exe
  C:\Windows\System\SoShAYF.exe
  2⤵
  PID:6532
- C:\Windows\System\uRePdoo.exe
  C:\Windows\System\uRePdoo.exe
  2⤵
  PID:6556
- C:\Windows\System\VZDTrTc.exe
  C:\Windows\System\VZDTrTc.exe
  2⤵
  PID:6584
- C:\Windows\System\mjQyDZp.exe
  C:\Windows\System\mjQyDZp.exe
  2⤵
  PID:6612
- C:\Windows\System\KKsnjnX.exe
  C:\Windows\System\KKsnjnX.exe
  2⤵
  PID:6640
- C:\Windows\System\KFawtlp.exe
  C:\Windows\System\KFawtlp.exe
  2⤵
  PID:6668
- C:\Windows\System\jLNhEwF.exe
  C:\Windows\System\jLNhEwF.exe
  2⤵
  PID:6696
- C:\Windows\System\cxcEFiL.exe
  C:\Windows\System\cxcEFiL.exe
  2⤵
  PID:6724
- C:\Windows\System\bXcBwme.exe
  C:\Windows\System\bXcBwme.exe
  2⤵
  PID:6752
- C:\Windows\System\nhUYCyj.exe
  C:\Windows\System\nhUYCyj.exe
  2⤵
  PID:6780
- C:\Windows\System\aHiEMGC.exe
  C:\Windows\System\aHiEMGC.exe
  2⤵
  PID:6808
- C:\Windows\System\zffJSCH.exe
  C:\Windows\System\zffJSCH.exe
  2⤵
  PID:6832
- C:\Windows\System\LDLXoLA.exe
  C:\Windows\System\LDLXoLA.exe
  2⤵
  PID:6864
- C:\Windows\System\cFNkYoE.exe
  C:\Windows\System\cFNkYoE.exe
  2⤵
  PID:6888
- C:\Windows\System\KIoyOhN.exe
  C:\Windows\System\KIoyOhN.exe
  2⤵
  PID:6920
- C:\Windows\System\weeBxoV.exe
  C:\Windows\System\weeBxoV.exe
  2⤵
  PID:6948
- C:\Windows\System\vmKchVj.exe
  C:\Windows\System\vmKchVj.exe
  2⤵
  PID:6976
- C:\Windows\System\VqrOCfq.exe
  C:\Windows\System\VqrOCfq.exe
  2⤵
  PID:7004
- C:\Windows\System\oZahKcC.exe
  C:\Windows\System\oZahKcC.exe
  2⤵
  PID:7036
- C:\Windows\System\qbyksYs.exe
  C:\Windows\System\qbyksYs.exe
  2⤵
  PID:7060
- C:\Windows\System\cKulGZw.exe
  C:\Windows\System\cKulGZw.exe
  2⤵
  PID:7088
- C:\Windows\System\umFKfQx.exe
  C:\Windows\System\umFKfQx.exe
  2⤵
  PID:7116
- C:\Windows\System\kOnEtiL.exe
  C:\Windows\System\kOnEtiL.exe
  2⤵
  PID:7144
- C:\Windows\System\BLfQNuH.exe
  C:\Windows\System\BLfQNuH.exe
  2⤵
  PID:5580
- C:\Windows\System\HXeXKEF.exe
  C:\Windows\System\HXeXKEF.exe
  2⤵
  PID:5764
- C:\Windows\System\eudwLlT.exe
  C:\Windows\System\eudwLlT.exe
  2⤵
  PID:5904
- C:\Windows\System\BpYboOj.exe
  C:\Windows\System\BpYboOj.exe
  2⤵
  PID:6024
- C:\Windows\System\XClMRWR.exe
  C:\Windows\System\XClMRWR.exe
  2⤵
  PID:3096
- C:\Windows\System\zSehdzh.exe
  C:\Windows\System\zSehdzh.exe
  2⤵
  PID:3956
- C:\Windows\System\CRhAoKs.exe
  C:\Windows\System\CRhAoKs.exe
  2⤵
  PID:5460
- C:\Windows\System\uIHtCoz.exe
  C:\Windows\System\uIHtCoz.exe
  2⤵
  PID:6204
- C:\Windows\System\mtmDPhE.exe
  C:\Windows\System\mtmDPhE.exe
  2⤵
  PID:6264
- C:\Windows\System\cwsDqdA.exe
  C:\Windows\System\cwsDqdA.exe
  2⤵
  PID:6332
- C:\Windows\System\fBbWqob.exe
  C:\Windows\System\fBbWqob.exe
  2⤵
  PID:6400
- C:\Windows\System\WXkxUkO.exe
  C:\Windows\System\WXkxUkO.exe
  2⤵
  PID:6468
- C:\Windows\System\lFAIKmj.exe
  C:\Windows\System\lFAIKmj.exe
  2⤵
  PID:6528
- C:\Windows\System\QCgbuce.exe
  C:\Windows\System\QCgbuce.exe
  2⤵
  PID:6596
- C:\Windows\System\MuqeJCI.exe
  C:\Windows\System\MuqeJCI.exe
  2⤵
  PID:6656
- C:\Windows\System\PdKfSno.exe
  C:\Windows\System\PdKfSno.exe
  2⤵
  PID:6716
- C:\Windows\System\PSJEqFI.exe
  C:\Windows\System\PSJEqFI.exe
  2⤵
  PID:6772
- C:\Windows\System\gOOimxr.exe
  C:\Windows\System\gOOimxr.exe
  2⤵
  PID:6852
- C:\Windows\System\grtGIuk.exe
  C:\Windows\System\grtGIuk.exe
  2⤵
  PID:6912
- C:\Windows\System\cCwrRJo.exe
  C:\Windows\System\cCwrRJo.exe
  2⤵
  PID:6988
- C:\Windows\System\MQrckGi.exe
  C:\Windows\System\MQrckGi.exe
  2⤵
  PID:7044
- C:\Windows\System\xRFZPiV.exe
  C:\Windows\System\xRFZPiV.exe
  2⤵
  PID:7080
- C:\Windows\System\odwZvrp.exe
  C:\Windows\System\odwZvrp.exe
  2⤵
  PID:7156
- C:\Windows\System\ZXqByZi.exe
  C:\Windows\System\ZXqByZi.exe
  2⤵
  PID:5828
- C:\Windows\System\xegRBIe.exe
  C:\Windows\System\xegRBIe.exe
  2⤵
  PID:3008
- C:\Windows\System\XeXWMuW.exe
  C:\Windows\System\XeXWMuW.exe
  2⤵
  PID:6156
- C:\Windows\System\tRPCPsp.exe
  C:\Windows\System\tRPCPsp.exe
  2⤵
  PID:6296
- C:\Windows\System\GMHetFI.exe
  C:\Windows\System\GMHetFI.exe
  2⤵
  PID:6444
- C:\Windows\System\qhIrsUC.exe
  C:\Windows\System\qhIrsUC.exe
  2⤵
  PID:6572
- C:\Windows\System\JgpglfL.exe
  C:\Windows\System\JgpglfL.exe
  2⤵
  PID:6744
- C:\Windows\System\XcKeuIX.exe
  C:\Windows\System\XcKeuIX.exe
  2⤵
  PID:6880
- C:\Windows\System\RtddYWU.exe
  C:\Windows\System\RtddYWU.exe
  2⤵
  PID:7176
- C:\Windows\System\zCNmdLf.exe
  C:\Windows\System\zCNmdLf.exe
  2⤵
  PID:7204
- C:\Windows\System\nuJWcmt.exe
  C:\Windows\System\nuJWcmt.exe
  2⤵
  PID:7232
- C:\Windows\System\XubWxXO.exe
  C:\Windows\System\XubWxXO.exe
  2⤵
  PID:7260
- C:\Windows\System\oLRgODC.exe
  C:\Windows\System\oLRgODC.exe
  2⤵
  PID:7284
- C:\Windows\System\qZHxSfM.exe
  C:\Windows\System\qZHxSfM.exe
  2⤵
  PID:7316
- C:\Windows\System\zYrHnJD.exe
  C:\Windows\System\zYrHnJD.exe
  2⤵
  PID:7344
- C:\Windows\System\xdYIOVY.exe
  C:\Windows\System\xdYIOVY.exe
  2⤵
  PID:7372
- C:\Windows\System\hkQnOFp.exe
  C:\Windows\System\hkQnOFp.exe
  2⤵
  PID:7400
- C:\Windows\System\BEENxYf.exe
  C:\Windows\System\BEENxYf.exe
  2⤵
  PID:7428
- C:\Windows\System\LDfzlMX.exe
  C:\Windows\System\LDfzlMX.exe
  2⤵
  PID:7452
- C:\Windows\System\hqIQZfb.exe
  C:\Windows\System\hqIQZfb.exe
  2⤵
  PID:7484
- C:\Windows\System\mvdymQv.exe
  C:\Windows\System\mvdymQv.exe
  2⤵
  PID:7512
- C:\Windows\System\zDAZZLg.exe
  C:\Windows\System\zDAZZLg.exe
  2⤵
  PID:7540
- C:\Windows\System\cxZAsip.exe
  C:\Windows\System\cxZAsip.exe
  2⤵
  PID:7568
- C:\Windows\System\QGmnuvw.exe
  C:\Windows\System\QGmnuvw.exe
  2⤵
  PID:7596
- C:\Windows\System\bvpzLAF.exe
  C:\Windows\System\bvpzLAF.exe
  2⤵
  PID:7620
- C:\Windows\System\CQNojtU.exe
  C:\Windows\System\CQNojtU.exe
  2⤵
  PID:7652
- C:\Windows\System\mZhbuJt.exe
  C:\Windows\System\mZhbuJt.exe
  2⤵
  PID:7676
- C:\Windows\System\JopGdRM.exe
  C:\Windows\System\JopGdRM.exe
  2⤵
  PID:7708
- C:\Windows\System\WoKXudN.exe
  C:\Windows\System\WoKXudN.exe
  2⤵
  PID:7732
- C:\Windows\System\DmEZYNJ.exe
  C:\Windows\System\DmEZYNJ.exe
  2⤵
  PID:7760
- C:\Windows\System\nhcCLcP.exe
  C:\Windows\System\nhcCLcP.exe
  2⤵
  PID:7792
- C:\Windows\System\wNOgKJu.exe
  C:\Windows\System\wNOgKJu.exe
  2⤵
  PID:7816
- C:\Windows\System\gGYqvjS.exe
  C:\Windows\System\gGYqvjS.exe
  2⤵
  PID:7848
- C:\Windows\System\iBWOzCX.exe
  C:\Windows\System\iBWOzCX.exe
  2⤵
  PID:7872
- C:\Windows\System\VALLobt.exe
  C:\Windows\System\VALLobt.exe
  2⤵
  PID:7904
- C:\Windows\System\ooQDDIc.exe
  C:\Windows\System\ooQDDIc.exe
  2⤵
  PID:7928
- C:\Windows\System\CqIhdzw.exe
  C:\Windows\System\CqIhdzw.exe
  2⤵
  PID:7960
- C:\Windows\System\YxfmniU.exe
  C:\Windows\System\YxfmniU.exe
  2⤵
  PID:7984
- C:\Windows\System\GLcmQES.exe
  C:\Windows\System\GLcmQES.exe
  2⤵
  PID:8016
- C:\Windows\System\JdhSVjY.exe
  C:\Windows\System\JdhSVjY.exe
  2⤵
  PID:8040
- C:\Windows\System\UFbRQBK.exe
  C:\Windows\System\UFbRQBK.exe
  2⤵
  PID:8068
- C:\Windows\System\vxPRPOL.exe
  C:\Windows\System\vxPRPOL.exe
  2⤵
  PID:8100
- C:\Windows\System\NLRJQjb.exe
  C:\Windows\System\NLRJQjb.exe
  2⤵
  PID:8128
- C:\Windows\System\DUdsxlO.exe
  C:\Windows\System\DUdsxlO.exe
  2⤵
  PID:8156
- C:\Windows\System\mmxMXgY.exe
  C:\Windows\System\mmxMXgY.exe
  2⤵
  PID:8184
- C:\Windows\System\JnYURCR.exe
  C:\Windows\System\JnYURCR.exe
  2⤵
  PID:7128
- C:\Windows\System\egGSofI.exe
  C:\Windows\System\egGSofI.exe
  2⤵
  PID:6236
- C:\Windows\System\WfwbeDS.exe
  C:\Windows\System\WfwbeDS.exe
  2⤵
  PID:5112
- C:\Windows\System\hPvRJOV.exe
  C:\Windows\System\hPvRJOV.exe
  2⤵
  PID:6688
- C:\Windows\System\RQoWyKQ.exe
  C:\Windows\System\RQoWyKQ.exe
  2⤵
  PID:6960
- C:\Windows\System\IquhLen.exe
  C:\Windows\System\IquhLen.exe
  2⤵
  PID:7276
- C:\Windows\System\EEpmhtX.exe
  C:\Windows\System\EEpmhtX.exe
  2⤵
  PID:7328
- C:\Windows\System\KMYnrBH.exe
  C:\Windows\System\KMYnrBH.exe
  2⤵
  PID:7364
- C:\Windows\System\WCPEgiN.exe
  C:\Windows\System\WCPEgiN.exe
  2⤵
  PID:7468
- C:\Windows\System\SiPxYkr.exe
  C:\Windows\System\SiPxYkr.exe
  2⤵
  PID:7504
- C:\Windows\System\SiTCtJp.exe
  C:\Windows\System\SiTCtJp.exe
  2⤵
  PID:7552
- C:\Windows\System\JrHlYiR.exe
  C:\Windows\System\JrHlYiR.exe
  2⤵
  PID:7588
- C:\Windows\System\zkUcrRu.exe
  C:\Windows\System\zkUcrRu.exe
  2⤵
  PID:7640
- C:\Windows\System\PODFWWD.exe
  C:\Windows\System\PODFWWD.exe
  2⤵
  PID:7672
- C:\Windows\System\ViNdLqg.exe
  C:\Windows\System\ViNdLqg.exe
  2⤵
  PID:7728
- C:\Windows\System\dMEEYnv.exe
  C:\Windows\System\dMEEYnv.exe
  2⤵
  PID:7780
- C:\Windows\System\SVdbsJh.exe
  C:\Windows\System\SVdbsJh.exe
  2⤵
  PID:7836
- C:\Windows\System\yKursiK.exe
  C:\Windows\System\yKursiK.exe
  2⤵
  PID:112
- C:\Windows\System\MvQXjro.exe
  C:\Windows\System\MvQXjro.exe
  2⤵
  PID:2124
- C:\Windows\System\byhmoEO.exe
  C:\Windows\System\byhmoEO.exe
  2⤵
  PID:7976
- C:\Windows\System\XycMdRc.exe
  C:\Windows\System\XycMdRc.exe
  2⤵
  PID:3940
- C:\Windows\System\AElIzsC.exe
  C:\Windows\System\AElIzsC.exe
  2⤵
  PID:8080
- C:\Windows\System\GpABnxR.exe
  C:\Windows\System\GpABnxR.exe
  2⤵
  PID:8112
- C:\Windows\System\KrCaogq.exe
  C:\Windows\System\KrCaogq.exe
  2⤵
  PID:1380
- C:\Windows\System\AXfeoUF.exe
  C:\Windows\System\AXfeoUF.exe
  2⤵
  PID:3924
- C:\Windows\System\rlJhQXF.exe
  C:\Windows\System\rlJhQXF.exe
  2⤵
  PID:1504
- C:\Windows\System\pDjajQQ.exe
  C:\Windows\System\pDjajQQ.exe
  2⤵
  PID:1464
- C:\Windows\System\UzBpWwl.exe
  C:\Windows\System\UzBpWwl.exe
  2⤵
  PID:4100
- C:\Windows\System\YvjzrwJ.exe
  C:\Windows\System\YvjzrwJ.exe
  2⤵
  PID:1216
- C:\Windows\System\NzsOTDQ.exe
  C:\Windows\System\NzsOTDQ.exe
  2⤵
  PID:2976
- C:\Windows\System\AUtLQJs.exe
  C:\Windows\System\AUtLQJs.exe
  2⤵
  PID:1976
- C:\Windows\System\qBOTvkf.exe
  C:\Windows\System\qBOTvkf.exe
  2⤵
  PID:2980
- C:\Windows\System\ykGpYbB.exe
  C:\Windows\System\ykGpYbB.exe
  2⤵
  PID:4988
- C:\Windows\System\YQPvlgb.exe
  C:\Windows\System\YQPvlgb.exe
  2⤵
  PID:4912
- C:\Windows\System\tNTumlq.exe
  C:\Windows\System\tNTumlq.exe
  2⤵
  PID:2700
- C:\Windows\System\osLkFAf.exe
  C:\Windows\System\osLkFAf.exe
  2⤵
  PID:5056
- C:\Windows\System\wwZOTjq.exe
  C:\Windows\System\wwZOTjq.exe
  2⤵
  PID:8180
- C:\Windows\System\bxmcqGN.exe
  C:\Windows\System\bxmcqGN.exe
  2⤵
  PID:4880
- C:\Windows\System\kUqofwo.exe
  C:\Windows\System\kUqofwo.exe
  2⤵
  PID:4720
- C:\Windows\System\RntRMHG.exe
  C:\Windows\System\RntRMHG.exe
  2⤵
  PID:6376
- C:\Windows\System\UZxOowC.exe
  C:\Windows\System\UZxOowC.exe
  2⤵
  PID:6372
- C:\Windows\System\FBjziUC.exe
  C:\Windows\System\FBjziUC.exe
  2⤵
  PID:7308
- C:\Windows\System\EBhGiCH.exe
  C:\Windows\System\EBhGiCH.exe
  2⤵
  PID:7448
- C:\Windows\System\LbDUgjj.exe
  C:\Windows\System\LbDUgjj.exe
  2⤵
  PID:7560
- C:\Windows\System\FupsYVk.exe
  C:\Windows\System\FupsYVk.exe
  2⤵
  PID:7636
- C:\Windows\System\GWogzkC.exe
  C:\Windows\System\GWogzkC.exe
  2⤵
  PID:7804
- C:\Windows\System\WkQiCDD.exe
  C:\Windows\System\WkQiCDD.exe
  2⤵
  PID:7916
- C:\Windows\System\oMVGrei.exe
  C:\Windows\System\oMVGrei.exe
  2⤵
  PID:8004
- C:\Windows\System\TNugrsS.exe
  C:\Windows\System\TNugrsS.exe
  2⤵
  PID:2248
- C:\Windows\System\KERzPMR.exe
  C:\Windows\System\KERzPMR.exe
  2⤵
  PID:1560
- C:\Windows\System\dsyAQbd.exe
  C:\Windows\System\dsyAQbd.exe
  2⤵
  PID:2332
- C:\Windows\System\FaNVGMW.exe
  C:\Windows\System\FaNVGMW.exe
  2⤵
  PID:1008
- C:\Windows\System\hXqDkOm.exe
  C:\Windows\System\hXqDkOm.exe
  2⤵
  PID:4856
- C:\Windows\System\FhGeZpv.exe
  C:\Windows\System\FhGeZpv.exe
  2⤵
  PID:4552
- C:\Windows\System\HaWdOkV.exe
  C:\Windows\System\HaWdOkV.exe
  2⤵
  PID:7072
- C:\Windows\System\ZdYlQTk.exe
  C:\Windows\System\ZdYlQTk.exe
  2⤵
  PID:4980
- C:\Windows\System\iAITgvz.exe
  C:\Windows\System\iAITgvz.exe
  2⤵
  PID:6824
- C:\Windows\System\BAOYoGv.exe
  C:\Windows\System\BAOYoGv.exe
  2⤵
  PID:7496
- C:\Windows\System\RTjiOIc.exe
  C:\Windows\System\RTjiOIc.exe
  2⤵
  PID:7720
- C:\Windows\System\ACggNqE.exe
  C:\Windows\System\ACggNqE.exe
  2⤵
  PID:8028
- C:\Windows\System\aafLdEw.exe
  C:\Windows\System\aafLdEw.exe
  2⤵
  PID:2292
- C:\Windows\System\wJUCeaj.exe
  C:\Windows\System\wJUCeaj.exe
  2⤵
  PID:3608
- C:\Windows\System\PjGeJFs.exe
  C:\Windows\System\PjGeJFs.exe
  2⤵
  PID:3968
- C:\Windows\System\JddtOrV.exe
  C:\Windows\System\JddtOrV.exe
  2⤵
  PID:7416
- C:\Windows\System\DhvXKOw.exe
  C:\Windows\System\DhvXKOw.exe
  2⤵
  PID:7812
- C:\Windows\System\ZgiqEKC.exe
  C:\Windows\System\ZgiqEKC.exe
  2⤵
  PID:6432
- C:\Windows\System\ukTnItw.exe
  C:\Windows\System\ukTnItw.exe
  2⤵
  PID:4600
- C:\Windows\System\IALLFju.exe
  C:\Windows\System\IALLFju.exe
  2⤵
  PID:8208
- C:\Windows\System\GJEuSYT.exe
  C:\Windows\System\GJEuSYT.exe
  2⤵
  PID:8236
- C:\Windows\System\TwfOoEz.exe
  C:\Windows\System\TwfOoEz.exe
  2⤵
  PID:8268
- C:\Windows\System\htoBCeO.exe
  C:\Windows\System\htoBCeO.exe
  2⤵
  PID:8284
- C:\Windows\System\LoCeRMJ.exe
  C:\Windows\System\LoCeRMJ.exe
  2⤵
  PID:8312
- C:\Windows\System\agCqdle.exe
  C:\Windows\System\agCqdle.exe
  2⤵
  PID:8332
- C:\Windows\System\HWElPgq.exe
  C:\Windows\System\HWElPgq.exe
  2⤵
  PID:8368
- C:\Windows\System\gpHBptb.exe
  C:\Windows\System\gpHBptb.exe
  2⤵
  PID:8388
- C:\Windows\System\LmBZfNI.exe
  C:\Windows\System\LmBZfNI.exe
  2⤵
  PID:8420
- C:\Windows\System\CJdsEyu.exe
  C:\Windows\System\CJdsEyu.exe
  2⤵
  PID:8452
- C:\Windows\System\gUxpyow.exe
  C:\Windows\System\gUxpyow.exe
  2⤵
  PID:8472
- C:\Windows\System\WKeOBSG.exe
  C:\Windows\System\WKeOBSG.exe
  2⤵
  PID:8504
- C:\Windows\System\HKudnzg.exe
  C:\Windows\System\HKudnzg.exe
  2⤵
  PID:8548
- C:\Windows\System\gPboirM.exe
  C:\Windows\System\gPboirM.exe
  2⤵
  PID:8564
- C:\Windows\System\HvsbPqR.exe
  C:\Windows\System\HvsbPqR.exe
  2⤵
  PID:8592
- C:\Windows\System\eoDVmAb.exe
  C:\Windows\System\eoDVmAb.exe
  2⤵
  PID:8632
- C:\Windows\System\QuACnHR.exe
  C:\Windows\System\QuACnHR.exe
  2⤵
  PID:8652
- C:\Windows\System\nqbQkHo.exe
  C:\Windows\System\nqbQkHo.exe
  2⤵
  PID:8668
- C:\Windows\System\WYSjMHa.exe
  C:\Windows\System\WYSjMHa.exe
  2⤵
  PID:8700
- C:\Windows\System\TraLkJX.exe
  C:\Windows\System\TraLkJX.exe
  2⤵
  PID:8720
- C:\Windows\System\QubGfsL.exe
  C:\Windows\System\QubGfsL.exe
  2⤵
  PID:8772
- C:\Windows\System\lieHKez.exe
  C:\Windows\System\lieHKez.exe
  2⤵
  PID:8792
- C:\Windows\System\abaZMXR.exe
  C:\Windows\System\abaZMXR.exe
  2⤵
  PID:8820
- C:\Windows\System\AhvasdG.exe
  C:\Windows\System\AhvasdG.exe
  2⤵
  PID:8836
- C:\Windows\System\pOqripw.exe
  C:\Windows\System\pOqripw.exe
  2⤵
  PID:8868
- C:\Windows\System\KMoctiB.exe
  C:\Windows\System\KMoctiB.exe
  2⤵
  PID:8896
- C:\Windows\System\ZcpmDpc.exe
  C:\Windows\System\ZcpmDpc.exe
  2⤵
  PID:8916
- C:\Windows\System\EsgSIKO.exe
  C:\Windows\System\EsgSIKO.exe
  2⤵
  PID:8956
- C:\Windows\System\iOpGgpt.exe
  C:\Windows\System\iOpGgpt.exe
  2⤵
  PID:8996
- C:\Windows\System\GBVnsCR.exe
  C:\Windows\System\GBVnsCR.exe
  2⤵
  PID:9028
- C:\Windows\System\levqQim.exe
  C:\Windows\System\levqQim.exe
  2⤵
  PID:9056
- C:\Windows\System\yrVUhyA.exe
  C:\Windows\System\yrVUhyA.exe
  2⤵
  PID:9084
- C:\Windows\System\KeWzSaC.exe
  C:\Windows\System\KeWzSaC.exe
  2⤵
  PID:9108
- C:\Windows\System\SnQkULP.exe
  C:\Windows\System\SnQkULP.exe
  2⤵
  PID:9132
- C:\Windows\System\gnVKzQT.exe
  C:\Windows\System\gnVKzQT.exe
  2⤵
  PID:9156
- C:\Windows\System\jEhuzNc.exe
  C:\Windows\System\jEhuzNc.exe
  2⤵
  PID:9172
- C:\Windows\System\hfMExWW.exe
  C:\Windows\System\hfMExWW.exe
  2⤵
  PID:9204
- C:\Windows\System\cvzMxke.exe
  C:\Windows\System\cvzMxke.exe
  2⤵
  PID:8232
- C:\Windows\System\myhrqRJ.exe
  C:\Windows\System\myhrqRJ.exe
  2⤵
  PID:8300
- C:\Windows\System\qwOtdmI.exe
  C:\Windows\System\qwOtdmI.exe
  2⤵
  PID:8348
- C:\Windows\System\bZlvKRU.exe
  C:\Windows\System\bZlvKRU.exe
  2⤵
  PID:8436
- C:\Windows\System\GbHltPu.exe
  C:\Windows\System\GbHltPu.exe
  2⤵
  PID:8524
- C:\Windows\System\LiGqJIm.exe
  C:\Windows\System\LiGqJIm.exe
  2⤵
  PID:8588
- C:\Windows\System\jhvpwwp.exe
  C:\Windows\System\jhvpwwp.exe
  2⤵
  PID:8644
- C:\Windows\System\brvNQYy.exe
  C:\Windows\System\brvNQYy.exe
  2⤵
  PID:8740
- C:\Windows\System\Sbconeq.exe
  C:\Windows\System\Sbconeq.exe
  2⤵
  PID:8784
- C:\Windows\System\tgzGZfm.exe
  C:\Windows\System\tgzGZfm.exe
  2⤵
  PID:8852
- C:\Windows\System\kaYwSOV.exe
  C:\Windows\System\kaYwSOV.exe
  2⤵
  PID:8860
- C:\Windows\System\PqKZawE.exe
  C:\Windows\System\PqKZawE.exe
  2⤵
  PID:8964
- C:\Windows\System\ykwtNyp.exe
  C:\Windows\System\ykwtNyp.exe
  2⤵
  PID:9052
- C:\Windows\System\blAtTZt.exe
  C:\Windows\System\blAtTZt.exe
  2⤵
  PID:9092
- C:\Windows\System\aOMqyng.exe
  C:\Windows\System\aOMqyng.exe
  2⤵
  PID:9144
- C:\Windows\System\lgHpPYs.exe
  C:\Windows\System\lgHpPYs.exe
  2⤵
  PID:8200
- C:\Windows\System\XwSZqvA.exe
  C:\Windows\System\XwSZqvA.exe
  2⤵
  PID:8432
- C:\Windows\System\rLYEtfr.exe
  C:\Windows\System\rLYEtfr.exe
  2⤵
  PID:8608
- C:\Windows\System\bVweaCU.exe
  C:\Windows\System\bVweaCU.exe
  2⤵
  PID:8696
- C:\Windows\System\kAlysDo.exe
  C:\Windows\System\kAlysDo.exe
  2⤵
  PID:8912
- C:\Windows\System\chxsnWi.exe
  C:\Windows\System\chxsnWi.exe
  2⤵
  PID:9080
- C:\Windows\System\VLFQXHP.exe
  C:\Windows\System\VLFQXHP.exe
  2⤵
  PID:9124
- C:\Windows\System\XbHKCUt.exe
  C:\Windows\System\XbHKCUt.exe
  2⤵
  PID:8464
- C:\Windows\System\dgfONDr.exe
  C:\Windows\System\dgfONDr.exe
  2⤵
  PID:8760
- C:\Windows\System\IcKEBod.exe
  C:\Windows\System\IcKEBod.exe
  2⤵
  PID:8856
- C:\Windows\System\AAPbbUi.exe
  C:\Windows\System\AAPbbUi.exe
  2⤵
  PID:9252
- C:\Windows\System\tAYvJNT.exe
  C:\Windows\System\tAYvJNT.exe
  2⤵
  PID:9272
- C:\Windows\System\GmtcCCN.exe
  C:\Windows\System\GmtcCCN.exe
  2⤵
  PID:9308
- C:\Windows\System\UOKJQfs.exe
  C:\Windows\System\UOKJQfs.exe
  2⤵
  PID:9324
- C:\Windows\System\KBXIwvM.exe
  C:\Windows\System\KBXIwvM.exe
  2⤵
  PID:9352
- C:\Windows\System\CDDyJGX.exe
  C:\Windows\System\CDDyJGX.exe
  2⤵
  PID:9380
- C:\Windows\System\DYqxCIH.exe
  C:\Windows\System\DYqxCIH.exe
  2⤵
  PID:9420
- C:\Windows\System\GbuaynS.exe
  C:\Windows\System\GbuaynS.exe
  2⤵
  PID:9448
- C:\Windows\System\MgwTbXl.exe
  C:\Windows\System\MgwTbXl.exe
  2⤵
  PID:9464
- C:\Windows\System\RTSMcCx.exe
  C:\Windows\System\RTSMcCx.exe
  2⤵
  PID:9496
- C:\Windows\System\RSTKoSO.exe
  C:\Windows\System\RSTKoSO.exe
  2⤵
  PID:9520
- C:\Windows\System\ZqFFlUl.exe
  C:\Windows\System\ZqFFlUl.exe
  2⤵
  PID:9560
- C:\Windows\System\COHohzZ.exe
  C:\Windows\System\COHohzZ.exe
  2⤵
  PID:9588
- C:\Windows\System\vHXyABc.exe
  C:\Windows\System\vHXyABc.exe
  2⤵
  PID:9616
- C:\Windows\System\jWDCSXZ.exe
  C:\Windows\System\jWDCSXZ.exe
  2⤵
  PID:9636
- C:\Windows\System\VDyHpxZ.exe
  C:\Windows\System\VDyHpxZ.exe
  2⤵
  PID:9660
- C:\Windows\System\wCKdwFT.exe
  C:\Windows\System\wCKdwFT.exe
  2⤵
  PID:9676
- C:\Windows\System\ucBPuqz.exe
  C:\Windows\System\ucBPuqz.exe
  2⤵
  PID:9708
- C:\Windows\System\VTPIkgj.exe
  C:\Windows\System\VTPIkgj.exe
  2⤵
  PID:9756
- C:\Windows\System\BJEnnPz.exe
  C:\Windows\System\BJEnnPz.exe
  2⤵
  PID:9784
- C:\Windows\System\OsxKqYU.exe
  C:\Windows\System\OsxKqYU.exe
  2⤵
  PID:9812
- C:\Windows\System\nRlKTUg.exe
  C:\Windows\System\nRlKTUg.exe
  2⤵
  PID:9840
- C:\Windows\System\kMQetRK.exe
  C:\Windows\System\kMQetRK.exe
  2⤵
  PID:9868
- C:\Windows\System\eTmTFYX.exe
  C:\Windows\System\eTmTFYX.exe
  2⤵
  PID:9896
- C:\Windows\System\baviSZI.exe
  C:\Windows\System\baviSZI.exe
  2⤵
  PID:9912
- C:\Windows\System\BiJWczR.exe
  C:\Windows\System\BiJWczR.exe
  2⤵
  PID:9932
- C:\Windows\System\TvXoThm.exe
  C:\Windows\System\TvXoThm.exe
  2⤵
  PID:9968
- C:\Windows\System\uLDCzpF.exe
  C:\Windows\System\uLDCzpF.exe
  2⤵
  PID:10000
- C:\Windows\System\fHRhCQc.exe
  C:\Windows\System\fHRhCQc.exe
  2⤵
  PID:10016
- C:\Windows\System\LoPDrnq.exe
  C:\Windows\System\LoPDrnq.exe
  2⤵
  PID:10040
- C:\Windows\System\TCfitUP.exe
  C:\Windows\System\TCfitUP.exe
  2⤵
  PID:10084
- C:\Windows\System\FnBrKkT.exe
  C:\Windows\System\FnBrKkT.exe
  2⤵
  PID:10100
- C:\Windows\System\adZCpgY.exe
  C:\Windows\System\adZCpgY.exe
  2⤵
  PID:10124
- C:\Windows\System\iZBaYoX.exe
  C:\Windows\System\iZBaYoX.exe
  2⤵
  PID:10168
- C:\Windows\System\AwZINoV.exe
  C:\Windows\System\AwZINoV.exe
  2⤵
  PID:10208
- C:\Windows\System\xWudgVT.exe
  C:\Windows\System\xWudgVT.exe
  2⤵
  PID:10236
- C:\Windows\System\WbNhDwr.exe
  C:\Windows\System\WbNhDwr.exe
  2⤵
  PID:8304
- C:\Windows\System\REpOQMn.exe
  C:\Windows\System\REpOQMn.exe
  2⤵
  PID:9268
- C:\Windows\System\ryKnfHz.exe
  C:\Windows\System\ryKnfHz.exe
  2⤵
  PID:9344
- C:\Windows\System\kvRZgci.exe
  C:\Windows\System\kvRZgci.exe
  2⤵
  PID:9436
- C:\Windows\System\jthvfFv.exe
  C:\Windows\System\jthvfFv.exe
  2⤵
  PID:9504
- C:\Windows\System\ZeSVFcg.exe
  C:\Windows\System\ZeSVFcg.exe
  2⤵
  PID:9556
- C:\Windows\System\iDjYKWz.exe
  C:\Windows\System\iDjYKWz.exe
  2⤵
  PID:9604
- C:\Windows\System\AbVdxxA.exe
  C:\Windows\System\AbVdxxA.exe
  2⤵
  PID:9688
- C:\Windows\System\WtPwuOA.exe
  C:\Windows\System\WtPwuOA.exe
  2⤵
  PID:9752
- C:\Windows\System\bnzCIIG.exe
  C:\Windows\System\bnzCIIG.exe
  2⤵
  PID:9824
- C:\Windows\System\wBnFwrI.exe
  C:\Windows\System\wBnFwrI.exe
  2⤵
  PID:9880
- C:\Windows\System\dtXihXk.exe
  C:\Windows\System\dtXihXk.exe
  2⤵
  PID:9960
- C:\Windows\System\zWdvIaF.exe
  C:\Windows\System\zWdvIaF.exe
  2⤵
  PID:10036
- C:\Windows\System\xUuorLR.exe
  C:\Windows\System\xUuorLR.exe
  2⤵
  PID:10112
- C:\Windows\System\MkYYjHt.exe
  C:\Windows\System\MkYYjHt.exe
  2⤵
  PID:10188
- C:\Windows\System\QgorZkx.exe
  C:\Windows\System\QgorZkx.exe
  2⤵
  PID:8624
- C:\Windows\System\CpUIwyp.exe
  C:\Windows\System\CpUIwyp.exe
  2⤵
  PID:9280
- C:\Windows\System\YjbYfqe.exe
  C:\Windows\System\YjbYfqe.exe
  2⤵
  PID:9416
- C:\Windows\System\DFRFdBF.exe
  C:\Windows\System\DFRFdBF.exe
  2⤵
  PID:9576
- C:\Windows\System\UhsJqmE.exe
  C:\Windows\System\UhsJqmE.exe
  2⤵
  PID:9736
- C:\Windows\System\oOELoDZ.exe
  C:\Windows\System\oOELoDZ.exe
  2⤵
  PID:9864
- C:\Windows\System\XtsbXZJ.exe
  C:\Windows\System\XtsbXZJ.exe
  2⤵
  PID:10012
- C:\Windows\System\jLaZEHL.exe
  C:\Windows\System\jLaZEHL.exe
  2⤵
  PID:1852
- C:\Windows\System\zQmVgiA.exe
  C:\Windows\System\zQmVgiA.exe
  2⤵
  PID:8992
- C:\Windows\System\bsMWExo.exe
  C:\Windows\System\bsMWExo.exe
  2⤵
  PID:9372
- C:\Windows\System\GwxECKg.exe
  C:\Windows\System\GwxECKg.exe
  2⤵
  PID:9552
- C:\Windows\System\MSYUfBR.exe
  C:\Windows\System\MSYUfBR.exe
  2⤵
  PID:9952
- C:\Windows\System\xBKPCyx.exe
  C:\Windows\System\xBKPCyx.exe
  2⤵
  PID:10060
- C:\Windows\System\KuhLShl.exe
  C:\Windows\System\KuhLShl.exe
  2⤵
  PID:9392
- C:\Windows\System\NDwQuWK.exe
  C:\Windows\System\NDwQuWK.exe
  2⤵
  PID:10244
- C:\Windows\System\ksHadxe.exe
  C:\Windows\System\ksHadxe.exe
  2⤵
  PID:10284
- C:\Windows\System\gaMBLLp.exe
  C:\Windows\System\gaMBLLp.exe
  2⤵
  PID:10312
- C:\Windows\System\wBJDQjW.exe
  C:\Windows\System\wBJDQjW.exe
  2⤵
  PID:10340
- C:\Windows\System\KOrVpar.exe
  C:\Windows\System\KOrVpar.exe
  2⤵
  PID:10368
- C:\Windows\System\fGhEDay.exe
  C:\Windows\System\fGhEDay.exe
  2⤵
  PID:10388
- C:\Windows\System\KAHYycp.exe
  C:\Windows\System\KAHYycp.exe
  2⤵
  PID:10432
- C:\Windows\System\ErCXydC.exe
  C:\Windows\System\ErCXydC.exe
  2⤵
  PID:10448
- C:\Windows\System\XAHQfwJ.exe
  C:\Windows\System\XAHQfwJ.exe
  2⤵
  PID:10476
- C:\Windows\System\KTqePDD.exe
  C:\Windows\System\KTqePDD.exe
  2⤵
  PID:10516
- C:\Windows\System\WKnttPa.exe
  C:\Windows\System\WKnttPa.exe
  2⤵
  PID:10540
- C:\Windows\System\CHrUTvX.exe
  C:\Windows\System\CHrUTvX.exe
  2⤵
  PID:10560
- C:\Windows\System\bOJIcDc.exe
  C:\Windows\System\bOJIcDc.exe
  2⤵
  PID:10600
- C:\Windows\System\NuvwYRv.exe
  C:\Windows\System\NuvwYRv.exe
  2⤵
  PID:10620
- C:\Windows\System\WcdtSaQ.exe
  C:\Windows\System\WcdtSaQ.exe
  2⤵
  PID:10648
- C:\Windows\System\QiJNKLI.exe
  C:\Windows\System\QiJNKLI.exe
  2⤵
  PID:10668
- C:\Windows\System\IXCVwtn.exe
  C:\Windows\System\IXCVwtn.exe
  2⤵
  PID:10712
- C:\Windows\System\OhnArRH.exe
  C:\Windows\System\OhnArRH.exe
  2⤵
  PID:10740
- C:\Windows\System\UHkLdfL.exe
  C:\Windows\System\UHkLdfL.exe
  2⤵
  PID:10768
- C:\Windows\System\MDfSHdx.exe
  C:\Windows\System\MDfSHdx.exe
  2⤵
  PID:10796
- C:\Windows\System\LIEoniL.exe
  C:\Windows\System\LIEoniL.exe
  2⤵
  PID:10812
- C:\Windows\System\xCqyLox.exe
  C:\Windows\System\xCqyLox.exe
  2⤵
  PID:10852
- C:\Windows\System\jBjsGVe.exe
  C:\Windows\System\jBjsGVe.exe
  2⤵
  PID:10876
- C:\Windows\System\BrkCyvi.exe
  C:\Windows\System\BrkCyvi.exe
  2⤵
  PID:10896
- C:\Windows\System\sKiDgaI.exe
  C:\Windows\System\sKiDgaI.exe
  2⤵
  PID:10936
- C:\Windows\System\IoJaqAa.exe
  C:\Windows\System\IoJaqAa.exe
  2⤵
  PID:10964
- C:\Windows\System\EahXIJR.exe
  C:\Windows\System\EahXIJR.exe
  2⤵
  PID:10980
- C:\Windows\System\CeEVARV.exe
  C:\Windows\System\CeEVARV.exe
  2⤵
  PID:10996
- C:\Windows\System\HireDbY.exe
  C:\Windows\System\HireDbY.exe
  2⤵
  PID:11048
- C:\Windows\System\ymHJpsq.exe
  C:\Windows\System\ymHJpsq.exe
  2⤵
  PID:11076
- C:\Windows\System\kSqRlWF.exe
  C:\Windows\System\kSqRlWF.exe
  2⤵
  PID:11108
- C:\Windows\System\SOfpPJI.exe
  C:\Windows\System\SOfpPJI.exe
  2⤵
  PID:11128
- C:\Windows\System\bqgAnDT.exe
  C:\Windows\System\bqgAnDT.exe
  2⤵
  PID:11156
- C:\Windows\System\WfCwZAd.exe
  C:\Windows\System\WfCwZAd.exe
  2⤵
  PID:11180
- C:\Windows\System\hUXTUsF.exe
  C:\Windows\System\hUXTUsF.exe
  2⤵
  PID:11208
- C:\Windows\System\vThfHRq.exe
  C:\Windows\System\vThfHRq.exe
  2⤵
  PID:11248
- C:\Windows\System\DmGsHTQ.exe
  C:\Windows\System\DmGsHTQ.exe
  2⤵
  PID:4448
- C:\Windows\System\nMnaLlo.exe
  C:\Windows\System\nMnaLlo.exe
  2⤵
  PID:10304
- C:\Windows\System\YEscIyf.exe
  C:\Windows\System\YEscIyf.exe
  2⤵
  PID:10384
- C:\Windows\System\fksMOBD.exe
  C:\Windows\System\fksMOBD.exe
  2⤵
  PID:10412
- C:\Windows\System\CftkUvm.exe
  C:\Windows\System\CftkUvm.exe
  2⤵
  PID:10508
- C:\Windows\System\RTezHSZ.exe
  C:\Windows\System\RTezHSZ.exe
  2⤵
  PID:10580
- C:\Windows\System\IiUlxJP.exe
  C:\Windows\System\IiUlxJP.exe
  2⤵
  PID:10628
- C:\Windows\System\HTzuuRC.exe
  C:\Windows\System\HTzuuRC.exe
  2⤵
  PID:10692
- C:\Windows\System\DyXUxwd.exe
  C:\Windows\System\DyXUxwd.exe
  2⤵
  PID:10792
- C:\Windows\System\WGCglbe.exe
  C:\Windows\System\WGCglbe.exe
  2⤵
  PID:10840
- C:\Windows\System\QMHHpkt.exe
  C:\Windows\System\QMHHpkt.exe
  2⤵
  PID:10920
- C:\Windows\System\tIYapHL.exe
  C:\Windows\System\tIYapHL.exe
  2⤵
  PID:10956
- C:\Windows\System\zENsDIG.exe
  C:\Windows\System\zENsDIG.exe
  2⤵
  PID:11044
- C:\Windows\System\YamFDJR.exe
  C:\Windows\System\YamFDJR.exe
  2⤵
  PID:11116
- C:\Windows\System\okQIevm.exe
  C:\Windows\System\okQIevm.exe
  2⤵
  PID:11144
- C:\Windows\System\STvPtol.exe
  C:\Windows\System\STvPtol.exe
  2⤵
  PID:11240
- C:\Windows\System\yxfVznX.exe
  C:\Windows\System\yxfVznX.exe
  2⤵
  PID:9808
- C:\Windows\System\fmhdvVK.exe
  C:\Windows\System\fmhdvVK.exe
  2⤵
  PID:10428
- C:\Windows\System\UPLQkcG.exe
  C:\Windows\System\UPLQkcG.exe
  2⤵
  PID:10664
- C:\Windows\System\lvIoUey.exe
  C:\Windows\System\lvIoUey.exe
  2⤵
  PID:10756
- C:\Windows\System\IJmfGBn.exe
  C:\Windows\System\IJmfGBn.exe
  2⤵
  PID:10836
- C:\Windows\System\uXZnuuN.exe
  C:\Windows\System\uXZnuuN.exe
  2⤵
  PID:11152
- C:\Windows\System\DeFnNrL.exe
  C:\Windows\System\DeFnNrL.exe
  2⤵
  PID:11256
- C:\Windows\System\EUukYgV.exe
  C:\Windows\System\EUukYgV.exe
  2⤵
  PID:10556
- C:\Windows\System\diDQCwq.exe
  C:\Windows\System\diDQCwq.exe
  2⤵
  PID:10908
- C:\Windows\System\YfcBVLs.exe
  C:\Windows\System\YfcBVLs.exe
  2⤵
  PID:11092
- C:\Windows\System\aiDAsfT.exe
  C:\Windows\System\aiDAsfT.exe
  2⤵
  PID:11124
- C:\Windows\System\olPAYKC.exe
  C:\Windows\System\olPAYKC.exe
  2⤵
  PID:11284
- C:\Windows\System\LpCYXAy.exe
  C:\Windows\System\LpCYXAy.exe
  2⤵
  PID:11324
- C:\Windows\System\qUebKkS.exe
  C:\Windows\System\qUebKkS.exe
  2⤵
  PID:11348
- C:\Windows\System\xWjZZwX.exe
  C:\Windows\System\xWjZZwX.exe
  2⤵
  PID:11372
- C:\Windows\System\HJqtMJE.exe
  C:\Windows\System\HJqtMJE.exe
  2⤵
  PID:11396
- C:\Windows\System\iTQDqYh.exe
  C:\Windows\System\iTQDqYh.exe
  2⤵
  PID:11424
- C:\Windows\System\tkbcggJ.exe
  C:\Windows\System\tkbcggJ.exe
  2⤵
  PID:11464
- C:\Windows\System\mRUQTMO.exe
  C:\Windows\System\mRUQTMO.exe
  2⤵
  PID:11492
- C:\Windows\System\MLcFNmZ.exe
  C:\Windows\System\MLcFNmZ.exe
  2⤵
  PID:11512
- C:\Windows\System\HRTfqPc.exe
  C:\Windows\System\HRTfqPc.exe
  2⤵
  PID:11532
- C:\Windows\System\TWhYvvW.exe
  C:\Windows\System\TWhYvvW.exe
  2⤵
  PID:11576
- C:\Windows\System\NFoSdTT.exe
  C:\Windows\System\NFoSdTT.exe
  2⤵
  PID:11604
- C:\Windows\System\wCKYiIN.exe
  C:\Windows\System\wCKYiIN.exe
  2⤵
  PID:11632
- C:\Windows\System\nyIbmkC.exe
  C:\Windows\System\nyIbmkC.exe
  2⤵
  PID:11660
- C:\Windows\System\AFlxWnd.exe
  C:\Windows\System\AFlxWnd.exe
  2⤵
  PID:11680
- C:\Windows\System\XeVUlda.exe
  C:\Windows\System\XeVUlda.exe
  2⤵
  PID:11704
- C:\Windows\System\gnAbyov.exe
  C:\Windows\System\gnAbyov.exe
  2⤵
  PID:11744
- C:\Windows\System\DBVUHRM.exe
  C:\Windows\System\DBVUHRM.exe
  2⤵
  PID:11772
- C:\Windows\System\jUcSLNS.exe
  C:\Windows\System\jUcSLNS.exe
  2⤵
  PID:11800
- C:\Windows\System\RMnrHdM.exe
  C:\Windows\System\RMnrHdM.exe
  2⤵
  PID:11816
- C:\Windows\System\UxPxbMo.exe
  C:\Windows\System\UxPxbMo.exe
  2⤵
  PID:11844
- C:\Windows\System\jFQktLZ.exe
  C:\Windows\System\jFQktLZ.exe
  2⤵
  PID:11872
- C:\Windows\System\Lqkyxbk.exe
  C:\Windows\System\Lqkyxbk.exe
  2⤵
  PID:11908
- C:\Windows\System\zPkMExA.exe
  C:\Windows\System\zPkMExA.exe
  2⤵
  PID:11928
- C:\Windows\System\KsewvMK.exe
  C:\Windows\System\KsewvMK.exe
  2⤵
  PID:11960
- C:\Windows\System\YaGEAvI.exe
  C:\Windows\System\YaGEAvI.exe
  2⤵
  PID:11984
- C:\Windows\System\cnQbzTl.exe
  C:\Windows\System\cnQbzTl.exe
  2⤵
  PID:12024
- C:\Windows\System\PDeBcjO.exe
  C:\Windows\System\PDeBcjO.exe
  2⤵
  PID:12052
- C:\Windows\System\rbuZXzj.exe
  C:\Windows\System\rbuZXzj.exe
  2⤵
  PID:12080
- C:\Windows\System\Odkrolp.exe
  C:\Windows\System\Odkrolp.exe
  2⤵
  PID:12096
- C:\Windows\System\HculFJZ.exe
  C:\Windows\System\HculFJZ.exe
  2⤵
  PID:12136
- C:\Windows\System\OuftOqN.exe
  C:\Windows\System\OuftOqN.exe
  2⤵
  PID:12164
- C:\Windows\System\FflZglX.exe
  C:\Windows\System\FflZglX.exe
  2⤵
  PID:12184
- C:\Windows\System\VqWXlnn.exe
  C:\Windows\System\VqWXlnn.exe
  2⤵
  PID:12220
- C:\Windows\System\XEjaCwl.exe
  C:\Windows\System\XEjaCwl.exe
  2⤵
  PID:12248
- C:\Windows\System\jEyxQQj.exe
  C:\Windows\System\jEyxQQj.exe
  2⤵
  PID:12276
- C:\Windows\System\xinNmrb.exe
  C:\Windows\System\xinNmrb.exe
  2⤵
  PID:11228
- C:\Windows\System\dxjNvBn.exe
  C:\Windows\System\dxjNvBn.exe
  2⤵
  PID:11332
- C:\Windows\System\QhCVQge.exe
  C:\Windows\System\QhCVQge.exe
  2⤵
  PID:11408
- C:\Windows\System\DuvGuwk.exe
  C:\Windows\System\DuvGuwk.exe
  2⤵
  PID:11484
- C:\Windows\System\fhpLHXC.exe
  C:\Windows\System\fhpLHXC.exe
  2⤵
  PID:11544
- C:\Windows\System\wfOcqLw.exe
  C:\Windows\System\wfOcqLw.exe
  2⤵
  PID:11620
- C:\Windows\System\TkyoCFW.exe
  C:\Windows\System\TkyoCFW.exe
  2⤵
  PID:11676
- C:\Windows\System\aBCehJS.exe
  C:\Windows\System\aBCehJS.exe
  2⤵
  PID:11716
- C:\Windows\System\NRZQiFt.exe
  C:\Windows\System\NRZQiFt.exe
  2⤵
  PID:11812
- C:\Windows\System\TWYxAWv.exe
  C:\Windows\System\TWYxAWv.exe
  2⤵
  PID:11864
- C:\Windows\System\LyYgstE.exe
  C:\Windows\System\LyYgstE.exe
  2⤵
  PID:11920
- C:\Windows\System\qwraOLI.exe
  C:\Windows\System\qwraOLI.exe
  2⤵
  PID:12004
- C:\Windows\System\PggPQAU.exe
  C:\Windows\System\PggPQAU.exe
  2⤵
  PID:12036
- C:\Windows\System\LYIsvnX.exe
  C:\Windows\System\LYIsvnX.exe
  2⤵
  PID:12128
- C:\Windows\System\BeNRQPf.exe
  C:\Windows\System\BeNRQPf.exe
  2⤵
  PID:12160
- C:\Windows\System\OiJiRDP.exe
  C:\Windows\System\OiJiRDP.exe
  2⤵
  PID:12204
- C:\Windows\System\dpFHFwJ.exe
  C:\Windows\System\dpFHFwJ.exe
  2⤵
  PID:11272
- C:\Windows\System\DMrIYwC.exe
  C:\Windows\System\DMrIYwC.exe
  2⤵
  PID:11368
- C:\Windows\System\NSjVkRg.exe
  C:\Windows\System\NSjVkRg.exe
  2⤵
  PID:11500
- C:\Windows\System\cWTdfav.exe
  C:\Windows\System\cWTdfav.exe
  2⤵
  PID:11696
- C:\Windows\System\uJgGmYa.exe
  C:\Windows\System\uJgGmYa.exe
  2⤵
  PID:11840
- C:\Windows\System\jEzoaqJ.exe
  C:\Windows\System\jEzoaqJ.exe
  2⤵
  PID:11980
- C:\Windows\System\AgweJEF.exe
  C:\Windows\System\AgweJEF.exe
  2⤵
  PID:12068
- C:\Windows\System\ZQrguJf.exe
  C:\Windows\System\ZQrguJf.exe
  2⤵
  PID:12264
- C:\Windows\System\VXTCYYn.exe
  C:\Windows\System\VXTCYYn.exe
  2⤵
  PID:11596
- C:\Windows\System\IembJIi.exe
  C:\Windows\System\IembJIi.exe
  2⤵
  PID:11780
- C:\Windows\System\Jrajbbw.exe
  C:\Windows\System\Jrajbbw.exe
  2⤵
  PID:11856
- C:\Windows\System\ahIjkrU.exe
  C:\Windows\System\ahIjkrU.exe
  2⤵
  PID:11380
- C:\Windows\System\aRuUrxn.exe
  C:\Windows\System\aRuUrxn.exe
  2⤵
  PID:12312
- C:\Windows\System\ennEjnq.exe
  C:\Windows\System\ennEjnq.exe
  2⤵
  PID:12336
- C:\Windows\System\DdxFdpd.exe
  C:\Windows\System\DdxFdpd.exe
  2⤵
  PID:12360
- C:\Windows\System\UsmRPqV.exe
  C:\Windows\System\UsmRPqV.exe
  2⤵
  PID:12384
- C:\Windows\System\ofpPzXj.exe
  C:\Windows\System\ofpPzXj.exe
  2⤵
  PID:12412
- C:\Windows\System\VQdOiKS.exe
  C:\Windows\System\VQdOiKS.exe
  2⤵
  PID:12428
- C:\Windows\System\lVDnkDh.exe
  C:\Windows\System\lVDnkDh.exe
  2⤵
  PID:12464
- C:\Windows\System\IkGyybB.exe
  C:\Windows\System\IkGyybB.exe
  2⤵
  PID:12492
- C:\Windows\System\cBHxDOg.exe
  C:\Windows\System\cBHxDOg.exe
  2⤵
  PID:12516
- C:\Windows\System\goqfwoh.exe
  C:\Windows\System\goqfwoh.exe
  2⤵
  PID:12544
- C:\Windows\System\PtFNtZU.exe
  C:\Windows\System\PtFNtZU.exe
  2⤵
  PID:12572
- C:\Windows\System\evImgMx.exe
  C:\Windows\System\evImgMx.exe
  2⤵
  PID:12592
- C:\Windows\System\blIVgbh.exe
  C:\Windows\System\blIVgbh.exe
  2⤵
  PID:12616
- C:\Windows\System\DiPRukb.exe
  C:\Windows\System\DiPRukb.exe
  2⤵
  PID:12660
- C:\Windows\System\pyeLkfQ.exe
  C:\Windows\System\pyeLkfQ.exe
  2⤵
  PID:12680
- C:\Windows\System\PFtCZIH.exe
  C:\Windows\System\PFtCZIH.exe
  2⤵
  PID:12704
- C:\Windows\System\TRYPzEJ.exe
  C:\Windows\System\TRYPzEJ.exe
  2⤵
  PID:12748
- C:\Windows\System\cCCKxKG.exe
  C:\Windows\System\cCCKxKG.exe
  2⤵
  PID:12764
- C:\Windows\System\bciGtkY.exe
  C:\Windows\System\bciGtkY.exe
  2⤵
  PID:12792
- C:\Windows\System\bYUzJvm.exe
  C:\Windows\System\bYUzJvm.exe
  2⤵
  PID:12824
- C:\Windows\System\FqqEPAq.exe
  C:\Windows\System\FqqEPAq.exe
  2⤵
  PID:12852
- C:\Windows\System\iqxNBrC.exe
  C:\Windows\System\iqxNBrC.exe
  2⤵
  PID:12876
- C:\Windows\System\EWIreQh.exe
  C:\Windows\System\EWIreQh.exe
  2⤵
  PID:12900
- C:\Windows\System\XnOmQMY.exe
  C:\Windows\System\XnOmQMY.exe
  2⤵
  PID:12936
- C:\Windows\System\aDdgKjd.exe
  C:\Windows\System\aDdgKjd.exe
  2⤵
  PID:12956
- C:\Windows\System\hYwwHNB.exe
  C:\Windows\System\hYwwHNB.exe
  2⤵
  PID:12988
- C:\Windows\System\FeblBMj.exe
  C:\Windows\System\FeblBMj.exe
  2⤵
  PID:13040
- C:\Windows\System\wQhilts.exe
  C:\Windows\System\wQhilts.exe
  2⤵
  PID:13056
- C:\Windows\System\OkiKllF.exe
  C:\Windows\System\OkiKllF.exe
  2⤵
  PID:13076
- C:\Windows\System\EhVnbnV.exe
  C:\Windows\System\EhVnbnV.exe
  2⤵
  PID:13108
- C:\Windows\System\xWoYMXJ.exe
  C:\Windows\System\xWoYMXJ.exe
  2⤵
  PID:13132
- C:\Windows\System\QXMrhWn.exe
  C:\Windows\System\QXMrhWn.exe
  2⤵
  PID:13168
- C:\Windows\System\RJYglch.exe
  C:\Windows\System\RJYglch.exe
  2⤵
  PID:13208
- C:\Windows\System\lZWNrRo.exe
  C:\Windows\System\lZWNrRo.exe
  2⤵
  PID:13224
- C:\Windows\System\MBgxNfb.exe
  C:\Windows\System\MBgxNfb.exe
  2⤵
  PID:13248
- C:\Windows\System\HYUrcYi.exe
  C:\Windows\System\HYUrcYi.exe
  2⤵
  PID:13272
- C:\Windows\System\AkwYGek.exe
  C:\Windows\System\AkwYGek.exe
  2⤵
  PID:13304
- C:\Windows\System\yVMfGaa.exe
  C:\Windows\System\yVMfGaa.exe
  2⤵
  PID:12380
- C:\Windows\System\aWjhAIQ.exe
  C:\Windows\System\aWjhAIQ.exe
  2⤵
  PID:12440
- C:\Windows\System\ilXhKBz.exe
  C:\Windows\System\ilXhKBz.exe
  2⤵
  PID:12524
- C:\Windows\System\DPiMFBT.exe
  C:\Windows\System\DPiMFBT.exe
  2⤵
  PID:12560
- C:\Windows\System\JuSgIPP.exe
  C:\Windows\System\JuSgIPP.exe
  2⤵
  PID:12604
- C:\Windows\System\NqunLnl.exe
  C:\Windows\System\NqunLnl.exe
  2⤵
  PID:12692
- C:\Windows\System\pGvToTm.exe
  C:\Windows\System\pGvToTm.exe
  2⤵
  PID:12756
- C:\Windows\System\BxSCaiU.exe
  C:\Windows\System\BxSCaiU.exe
  2⤵
  PID:12788
- C:\Windows\System\XvdEJcP.exe
  C:\Windows\System\XvdEJcP.exe
  2⤵
  PID:12920
- C:\Windows\System\YmQDIjz.exe
  C:\Windows\System\YmQDIjz.exe
  2⤵
  PID:12976
- C:\Windows\System\UiYaFtW.exe
  C:\Windows\System\UiYaFtW.exe
  2⤵
  PID:13008
- C:\Windows\System\MMoTkwn.exe
  C:\Windows\System\MMoTkwn.exe
  2⤵
  PID:13064
- C:\Windows\System\VjdxDjB.exe
  C:\Windows\System\VjdxDjB.exe
  2⤵
  PID:13128
- C:\Windows\System\APZePPs.exe
  C:\Windows\System\APZePPs.exe
  2⤵
  PID:13180
- C:\Windows\System\BYCYRNl.exe
  C:\Windows\System\BYCYRNl.exe
  2⤵
  PID:13280
- C:\Windows\System\lhVeJIz.exe
  C:\Windows\System\lhVeJIz.exe
  2⤵
  PID:12304
- C:\Windows\System\YgAxuEg.exe
  C:\Windows\System\YgAxuEg.exe
  2⤵
  PID:12420
- C:\Windows\System\AZBqhqW.exe
  C:\Windows\System\AZBqhqW.exe
  2⤵
  PID:12696
- C:\Windows\System\YyzUQSn.exe
  C:\Windows\System\YyzUQSn.exe
  2⤵
  PID:12860
- C:\Windows\System\HMNHeOk.exe
  C:\Windows\System\HMNHeOk.exe
  2⤵
  PID:13024
- C:\Windows\System\rabRdUM.exe
  C:\Windows\System\rabRdUM.exe
  2⤵
  PID:13152
- C:\Windows\System\uKLUalc.exe
  C:\Windows\System\uKLUalc.exe
  2⤵
  PID:13268
- C:\Windows\System\RYoiyMv.exe
  C:\Windows\System\RYoiyMv.exe
  2⤵
  PID:12656
- C:\Windows\System\hyucwWi.exe
  C:\Windows\System\hyucwWi.exe
  2⤵
  PID:12916
- C:\Windows\System\myGvFjZ.exe
  C:\Windows\System\myGvFjZ.exe
  2⤵
  PID:12452
- C:\Windows\System\QuTtgHN.exe
  C:\Windows\System\QuTtgHN.exe
  2⤵
  PID:13220
- C:\Windows\System\KZLtlvk.exe
  C:\Windows\System\KZLtlvk.exe
  2⤵
  PID:13328
- C:\Windows\System\DGdWzMB.exe
  C:\Windows\System\DGdWzMB.exe
  2⤵
  PID:13344
- C:\Windows\System\HcrNrzv.exe
  C:\Windows\System\HcrNrzv.exe
  2⤵
  PID:13384
- C:\Windows\System\IEdCxdX.exe
  C:\Windows\System\IEdCxdX.exe
  2⤵
  PID:13412
- C:\Windows\System\pxLdwmw.exe
  C:\Windows\System\pxLdwmw.exe
  2⤵
  PID:13428
- C:\Windows\System\WAreuLe.exe
  C:\Windows\System\WAreuLe.exe
  2⤵
  PID:13468
- C:\Windows\System\gjfoHyG.exe
  C:\Windows\System\gjfoHyG.exe
  2⤵
  PID:13488
- C:\Windows\System\DYuXsES.exe
  C:\Windows\System\DYuXsES.exe
  2⤵
  PID:13516
- C:\Windows\System\THIOeRs.exe
  C:\Windows\System\THIOeRs.exe
  2⤵
  PID:13544
- C:\Windows\System\THigCdp.exe
  C:\Windows\System\THigCdp.exe
  2⤵
  PID:13568
- C:\Windows\System\DrTTmNe.exe
  C:\Windows\System\DrTTmNe.exe
  2⤵
  PID:13584
- C:\Windows\System\HSGncbh.exe
  C:\Windows\System\HSGncbh.exe
  2⤵
  PID:13612
- C:\Windows\System\QQOrvbT.exe
  C:\Windows\System\QQOrvbT.exe
  2⤵
  PID:13632
- C:\Windows\System\AIUhtCk.exe
  C:\Windows\System\AIUhtCk.exe
  2⤵
  PID:13664
- C:\Windows\System\KYvxjXj.exe
  C:\Windows\System\KYvxjXj.exe
  2⤵
  PID:13704
- C:\Windows\System\cPmJRAf.exe
  C:\Windows\System\cPmJRAf.exe
  2⤵
  PID:13724
- C:\Windows\System\XVnmLej.exe
  C:\Windows\System\XVnmLej.exe
  2⤵
  PID:13768
- C:\Windows\System\uZROajK.exe
  C:\Windows\System\uZROajK.exe
  2⤵
  PID:13792
- C:\Windows\System\CmvRjZM.exe
  C:\Windows\System\CmvRjZM.exe
  2⤵
  PID:13820
- C:\Windows\System\aaAoESQ.exe
  C:\Windows\System\aaAoESQ.exe
  2⤵
  PID:13844
- C:\Windows\System\HzkfKvQ.exe
  C:\Windows\System\HzkfKvQ.exe
  2⤵
  PID:13864
- C:\Windows\System\YeQcfFa.exe
  C:\Windows\System\YeQcfFa.exe
  2⤵
  PID:13904
- C:\Windows\System\thGFXuV.exe
  C:\Windows\System\thGFXuV.exe
  2⤵
  PID:13924
- C:\Windows\System\GEWvDCB.exe
  C:\Windows\System\GEWvDCB.exe
  2⤵
  PID:13964
- C:\Windows\System\msVuSGP.exe
  C:\Windows\System\msVuSGP.exe
  2⤵
  PID:14000
- C:\Windows\System\bmJKCej.exe
  C:\Windows\System\bmJKCej.exe
  2⤵
  PID:14028
- C:\Windows\System\BuZBmjm.exe
  C:\Windows\System\BuZBmjm.exe
  2⤵
  PID:14044
- C:\Windows\System\MrTOdZX.exe
  C:\Windows\System\MrTOdZX.exe
  2⤵
  PID:14072
- C:\Windows\System\LkLUhlX.exe
  C:\Windows\System\LkLUhlX.exe
  2⤵
  PID:14100
- C:\Windows\System\KMhmyJc.exe
  C:\Windows\System\KMhmyJc.exe
  2⤵
  PID:14128
- C:\Windows\System\iyLoscX.exe
  C:\Windows\System\iyLoscX.exe
  2⤵
  PID:14148
- C:\Windows\System\lHIYjTW.exe
  C:\Windows\System\lHIYjTW.exe
  2⤵
  PID:14180
- C:\Windows\System\KurQRZE.exe
  C:\Windows\System\KurQRZE.exe
  2⤵
  PID:14204
- C:\Windows\System\AtAdNqt.exe
  C:\Windows\System\AtAdNqt.exe
  2⤵
  PID:14224
- C:\Windows\System\DzhIpMB.exe
  C:\Windows\System\DzhIpMB.exe
  2⤵
  PID:14252
- C:\Windows\System\NYGbKUw.exe
  C:\Windows\System\NYGbKUw.exe
  2⤵
  PID:14304
- C:\Windows\System\pLcRvvF.exe
  C:\Windows\System\pLcRvvF.exe
  2⤵
  PID:13240
- C:\Windows\System\BhnyIaK.exe
  C:\Windows\System\BhnyIaK.exe
  2⤵
  PID:13336
- C:\Windows\System\XubcpuP.exe
  C:\Windows\System\XubcpuP.exe
  2⤵
  PID:13408
- C:\Windows\System\DJoMMhb.exe
  C:\Windows\System\DJoMMhb.exe
  2⤵
  PID:13476
- C:\Windows\System\IqsmDZc.exe
  C:\Windows\System\IqsmDZc.exe
  2⤵
  PID:13564
- C:\Windows\System\WWvYJSY.exe
  C:\Windows\System\WWvYJSY.exe
  2⤵
  PID:13608
- C:\Windows\System\qwBkeuu.exe
  C:\Windows\System\qwBkeuu.exe
  2⤵
  PID:13656
- C:\Windows\System\ndQUNRb.exe
  C:\Windows\System\ndQUNRb.exe
  2⤵
  PID:13696
- C:\Windows\System\qbXcPmf.exe
  C:\Windows\System\qbXcPmf.exe
  2⤵
  PID:13744
- C:\Windows\System\TRtZWEY.exe
  C:\Windows\System\TRtZWEY.exe
  2⤵
  PID:13932
- C:\Windows\System\OyjJDJq.exe
  C:\Windows\System\OyjJDJq.exe
  2⤵
  PID:13912
- C:\Windows\System\AEvXfjf.exe
  C:\Windows\System\AEvXfjf.exe
  2⤵
  PID:14016
- C:\Windows\System\qJFxuTD.exe
  C:\Windows\System\qJFxuTD.exe
  2⤵
  PID:14060
- C:\Windows\System\ZutUKHp.exe
  C:\Windows\System\ZutUKHp.exe
  2⤵
  PID:14156
- C:\Windows\System\UdgCrEI.exe
  C:\Windows\System\UdgCrEI.exe
  2⤵
  PID:14192
- C:\Windows\System\ERxZXPI.exe
  C:\Windows\System\ERxZXPI.exe
  2⤵
  PID:14248
- C:\Windows\System\ipVyEjr.exe
  C:\Windows\System\ipVyEjr.exe
  2⤵
  PID:14296
- C:\Windows\System\KtoqBGZ.exe
  C:\Windows\System\KtoqBGZ.exe
  2⤵
  PID:13380
- C:\Windows\System\ZGWYOTZ.exe
  C:\Windows\System\ZGWYOTZ.exe
  2⤵
  PID:13552
- C:\Windows\System\dbBGCQK.exe
  C:\Windows\System\dbBGCQK.exe
  2⤵
  PID:13736
- C:\Windows\System\LMAlzmV.exe
  C:\Windows\System\LMAlzmV.exe
  2⤵
  PID:13812
- C:\Windows\System\DFbqXKZ.exe
  C:\Windows\System\DFbqXKZ.exe
  2⤵
  PID:13944
- C:\Windows\System\tTJmsPP.exe
  C:\Windows\System\tTJmsPP.exe
  2⤵
  PID:14080
- C:\Windows\System\AGHcVNe.exe
  C:\Windows\System\AGHcVNe.exe
  2⤵
  PID:14168
- C:\Windows\System\ybzcOIg.exe
  C:\Windows\System\ybzcOIg.exe
  2⤵
  PID:14300
- C:\Windows\System\aXJLbEJ.exe
  C:\Windows\System\aXJLbEJ.exe
  2⤵
  PID:13316
- C:\Windows\System\gUCqqqz.exe
  C:\Windows\System\gUCqqqz.exe
  2⤵
  PID:13676
- C:\Windows\System\BYDvZRy.exe
  C:\Windows\System\BYDvZRy.exe
  2⤵
  PID:14344
- C:\Windows\System\xqdwAtz.exe
  C:\Windows\System\xqdwAtz.exe
  2⤵
  PID:14368
- C:\Windows\System\gUpSGeP.exe
  C:\Windows\System\gUpSGeP.exe
  2⤵
  PID:14404
- C:\Windows\System\aLhySQR.exe
  C:\Windows\System\aLhySQR.exe
  2⤵
  PID:14444
- C:\Windows\System\gjFlOxf.exe
  C:\Windows\System\gjFlOxf.exe
  2⤵
  PID:14464
- C:\Windows\System\HazNVaQ.exe
  C:\Windows\System\HazNVaQ.exe
  2⤵
  PID:14500
- C:\Windows\System\eRUYpQy.exe
  C:\Windows\System\eRUYpQy.exe
  2⤵
  PID:14528
- C:\Windows\System\DWyXdiI.exe
  C:\Windows\System\DWyXdiI.exe
  2⤵
  PID:14544
- C:\Windows\System\CjUuIuv.exe
  C:\Windows\System\CjUuIuv.exe
  2⤵
  PID:14580
- C:\Windows\System\ZYrpkzx.exe
  C:\Windows\System\ZYrpkzx.exe
  2⤵
  PID:14612
- C:\Windows\System\eXaQLTM.exe
  C:\Windows\System\eXaQLTM.exe
  2⤵
  PID:14628
- C:\Windows\System\nhPvoEz.exe
  C:\Windows\System\nhPvoEz.exe
  2⤵
  PID:14680
- C:\Windows\System\HwzLxIE.exe
  C:\Windows\System\HwzLxIE.exe
  2⤵
  PID:14708
- C:\Windows\System\wIzoGWG.exe
  C:\Windows\System\wIzoGWG.exe
  2⤵
  PID:14724
- C:\Windows\System\KFaJXnl.exe
  C:\Windows\System\KFaJXnl.exe
  2⤵
  PID:14744
- C:\Windows\System\djTfCNl.exe
  C:\Windows\System\djTfCNl.exe
  2⤵
  PID:14780
- C:\Windows\System\czsfGaE.exe
  C:\Windows\System\czsfGaE.exe
  2⤵
  PID:14820
- C:\Windows\System\WCEkCfd.exe
  C:\Windows\System\WCEkCfd.exe
  2⤵
  PID:14836
- C:\Windows\System\dRaOzat.exe
  C:\Windows\System\dRaOzat.exe
  2⤵
  PID:14876
- C:\Windows\System\GmafUID.exe
  C:\Windows\System\GmafUID.exe
  2⤵
  PID:14908
- C:\Windows\System\SkKpKTj.exe
  C:\Windows\System\SkKpKTj.exe
  2⤵
  PID:14936
- C:\Windows\System\tlabnET.exe
  C:\Windows\System\tlabnET.exe
  2⤵
  PID:14952
- C:\Windows\System\UKEQXrS.exe
  C:\Windows\System\UKEQXrS.exe
  2⤵
  PID:15000
- C:\Windows\System\oFsMCdr.exe
  C:\Windows\System\oFsMCdr.exe
  2⤵
  PID:15040
- C:\Windows\System\hacAjxT.exe
  C:\Windows\System\hacAjxT.exe
  2⤵
  PID:15064
- C:\Windows\System\qWEkarx.exe
  C:\Windows\System\qWEkarx.exe
  2⤵
  PID:15092
- C:\Windows\System\DXFupZH.exe
  C:\Windows\System\DXFupZH.exe
  2⤵
  PID:15116
- C:\Windows\System\GagiJHM.exe
  C:\Windows\System\GagiJHM.exe
  2⤵
  PID:15140
- C:\Windows\System\IFAhjZy.exe
  C:\Windows\System\IFAhjZy.exe
  2⤵
  PID:15160
- C:\Windows\System\LrHekGa.exe
  C:\Windows\System\LrHekGa.exe
  2⤵
  PID:15184
- C:\Windows\System\YnOCfmA.exe
  C:\Windows\System\YnOCfmA.exe
  2⤵
  PID:15204
- C:\Windows\System\cMWALYY.exe
  C:\Windows\System\cMWALYY.exe
  2⤵
  PID:15228
- C:\Windows\System\PmvIyzr.exe
  C:\Windows\System\PmvIyzr.exe
  2⤵
  PID:15272
- C:\Windows\System\nBCWzXs.exe
  C:\Windows\System\nBCWzXs.exe
  2⤵
  PID:15292
- C:\Windows\System\mChdmnI.exe
  C:\Windows\System\mChdmnI.exe
  2⤵
  PID:15308
- C:\Windows\System\WsrzGnf.exe
  C:\Windows\System\WsrzGnf.exe
  2⤵
  PID:15344
- C:\Windows\System\VwRHpFD.exe
  C:\Windows\System\VwRHpFD.exe
  2⤵
  PID:14340
- C:\Windows\System\UBvfemV.exe
  C:\Windows\System\UBvfemV.exe
  2⤵
  PID:14392
- C:\Windows\System\AFdFHcg.exe
  C:\Windows\System\AFdFHcg.exe
  2⤵
  PID:14476
- C:\Windows\System\DwmSLJG.exe
  C:\Windows\System\DwmSLJG.exe
  2⤵
  PID:14524
- C:\Windows\System\RHjgvDf.exe
  C:\Windows\System\RHjgvDf.exe
  2⤵
  PID:14608
- C:\Windows\System\eHBaWkB.exe
  C:\Windows\System\eHBaWkB.exe
  2⤵
  PID:14640
- C:\Windows\System\VmCaHqK.exe
  C:\Windows\System\VmCaHqK.exe
  2⤵
  PID:14704
- C:\Windows\System\imqQYRW.exe
  C:\Windows\System\imqQYRW.exe
  2⤵
  PID:14804
- C:\Windows\System\pllkNeU.exe
  C:\Windows\System\pllkNeU.exe
  2⤵
  PID:14860
- C:\Windows\System\JjJxhms.exe
  C:\Windows\System\JjJxhms.exe
  2⤵
  PID:14920
- C:\Windows\System\CAzDlbd.exe
  C:\Windows\System\CAzDlbd.exe
  2⤵
  PID:14996
- C:\Windows\System\YJGIXJk.exe
  C:\Windows\System\YJGIXJk.exe
  2⤵
  PID:15028
- C:\Windows\System\gCJPdrA.exe
  C:\Windows\System\gCJPdrA.exe
  2⤵
  PID:15124
- C:\Windows\System\DwkagQf.exe
  C:\Windows\System\DwkagQf.exe
  2⤵
  PID:15156
- C:\Windows\System\ehbcRdR.exe
  C:\Windows\System\ehbcRdR.exe
  2⤵
  PID:15176
- C:\Windows\System\dGHGaqP.exe
  C:\Windows\System\dGHGaqP.exe
  2⤵
  PID:15288
- C:\Windows\System\XwKbVqW.exe
  C:\Windows\System\XwKbVqW.exe
  2⤵
  PID:14356
- C:\Windows\System\EZnFzKu.exe
  C:\Windows\System\EZnFzKu.exe
  2⤵
  PID:14492
- C:\Windows\System\ZciiUAP.exe
  C:\Windows\System\ZciiUAP.exe
  2⤵
  PID:14624
- C:\Windows\System\FQgZwFg.exe
  C:\Windows\System\FQgZwFg.exe
  2⤵
  PID:14764
- C:\Windows\System\rsrDukl.exe
  C:\Windows\System\rsrDukl.exe
  2⤵
  PID:14924
- C:\Windows\System\GvJQvpC.exe
  C:\Windows\System\GvJQvpC.exe
  2⤵
  PID:14900
- C:\Windows\System\SyCoqmg.exe
  C:\Windows\System\SyCoqmg.exe
  2⤵
  PID:15332
- C:\Windows\System\FzOHGwD.exe
  C:\Windows\System\FzOHGwD.exe
  2⤵
  PID:14424
- C:\Windows\System\pKIWRVu.exe
  C:\Windows\System\pKIWRVu.exe
  2⤵
  PID:14740
- C:\Windows\System\ZOlaVGJ.exe
  C:\Windows\System\ZOlaVGJ.exe
  2⤵
  PID:14884
- C:\Windows\System\wQNViAR.exe
  C:\Windows\System\wQNViAR.exe
  2⤵
  PID:15304
- C:\Windows\System\GzvyiYT.exe
  C:\Windows\System\GzvyiYT.exe
  2⤵
  PID:15080
- C:\Windows\System\TORJmYb.exe
  C:\Windows\System\TORJmYb.exe
  2⤵
  PID:14832
- C:\Windows\System\cEoKdfY.exe
  C:\Windows\System\cEoKdfY.exe
  2⤵
  PID:15380
- C:\Windows\System\sPWkyCX.exe
  C:\Windows\System\sPWkyCX.exe
  2⤵
  PID:15404
- C:\Windows\System\KeCiFuI.exe
  C:\Windows\System\KeCiFuI.exe
  2⤵
  PID:15432
- C:\Windows\System\gLqmGDC.exe
  C:\Windows\System\gLqmGDC.exe
  2⤵
  PID:15456
- C:\Windows\System\zOFReQg.exe
  C:\Windows\System\zOFReQg.exe
  2⤵
  PID:15476
- C:\Windows\System\UJjHjCL.exe
  C:\Windows\System\UJjHjCL.exe
  2⤵
  PID:15536
- C:\Windows\System\ZjttFVV.exe
  C:\Windows\System\ZjttFVV.exe
  2⤵
  PID:15564
- C:\Windows\System\jpwSvVV.exe
  C:\Windows\System\jpwSvVV.exe
  2⤵
  PID:15580
- C:\Windows\System\DaHhkXw.exe
  C:\Windows\System\DaHhkXw.exe
  2⤵
  PID:15608
- C:\Windows\System\xnTnFZC.exe
  C:\Windows\System\xnTnFZC.exe
  2⤵
  PID:15660
- C:\Windows\System\xKOHVka.exe
  C:\Windows\System\xKOHVka.exe
  2⤵
  PID:15676
- C:\Windows\System\SuFmMhC.exe
  C:\Windows\System\SuFmMhC.exe
  2⤵
  PID:15696
- C:\Windows\System\JvCFYTl.exe
  C:\Windows\System\JvCFYTl.exe
  2⤵
  PID:15720
- C:\Windows\System\iBUOIRi.exe
  C:\Windows\System\iBUOIRi.exe
  2⤵
  PID:15760
- C:\Windows\System\rLwEnLG.exe
  C:\Windows\System\rLwEnLG.exe
  2⤵
  PID:15776
- C:\Windows\System\ijphKyw.exe
  C:\Windows\System\ijphKyw.exe
  2⤵
  PID:15804
- C:\Windows\System\VMrYEsN.exe
  C:\Windows\System\VMrYEsN.exe
  2⤵
  PID:15820
- C:\Windows\System\DmYZhzW.exe
  C:\Windows\System\DmYZhzW.exe
  2⤵
  PID:15848
- C:\Windows\System\AprKBxb.exe
  C:\Windows\System\AprKBxb.exe
  2⤵
  PID:15876
- C:\Windows\System\QsGnEzA.exe
  C:\Windows\System\QsGnEzA.exe
  2⤵
  PID:15892
- C:\Windows\System\MfnnTOu.exe
  C:\Windows\System\MfnnTOu.exe
  2⤵
  PID:15928
- C:\Windows\System\iIrfaaX.exe
  C:\Windows\System\iIrfaaX.exe
  2⤵
  PID:15972
- C:\Windows\System\qKaoiLM.exe
  C:\Windows\System\qKaoiLM.exe
  2⤵
  PID:16000
- C:\Windows\System\LvYZzxt.exe
  C:\Windows\System\LvYZzxt.exe
  2⤵
  PID:16016
- C:\Windows\System\AJYQbAl.exe
  C:\Windows\System\AJYQbAl.exe
  2⤵
  PID:16044
- C:\Windows\System\SpeUIum.exe
  C:\Windows\System\SpeUIum.exe
  2⤵
  PID:16088
- C:\Windows\System\IqqvngG.exe
  C:\Windows\System\IqqvngG.exe
  2⤵
  PID:16112
- C:\Windows\System\vgdGeEb.exe
  C:\Windows\System\vgdGeEb.exe
  2⤵
  PID:16152
- C:\Windows\System\JhaAfoN.exe
  C:\Windows\System\JhaAfoN.exe
  2⤵
  PID:16180
- C:\Windows\System\nBqPAoA.exe
  C:\Windows\System\nBqPAoA.exe
  2⤵
  PID:16196
- C:\Windows\System\FUJWDAU.exe
  C:\Windows\System\FUJWDAU.exe
  2⤵
  PID:16224
- C:\Windows\System\eeIkIUJ.exe
  C:\Windows\System\eeIkIUJ.exe
  2⤵
  PID:16244
- C:\Windows\System\UiFLyQK.exe
  C:\Windows\System\UiFLyQK.exe
  2⤵
  PID:16268
- C:\Windows\System\lHKehHZ.exe
  C:\Windows\System\lHKehHZ.exe
  2⤵
  PID:16292
- C:\Windows\System\bxnNHMu.exe
  C:\Windows\System\bxnNHMu.exe
  2⤵
  PID:16320
- C:\Windows\System\FVNdVGy.exe
  C:\Windows\System\FVNdVGy.exe
  2⤵
  PID:16344
- C:\Windows\System\dvJKUWJ.exe
  C:\Windows\System\dvJKUWJ.exe
  2⤵
  PID:16360
- C:\Windows\System\cQpkhSb.exe
  C:\Windows\System\cQpkhSb.exe
  2⤵
  PID:14656
- C:\Windows\System\vzZnCIU.exe
  C:\Windows\System\vzZnCIU.exe
  2⤵
  PID:15412
- C:\Windows\System\QxMsuez.exe
  C:\Windows\System\QxMsuez.exe
  2⤵
  PID:15448
- C:\Windows\System\cdvAOqQ.exe
  C:\Windows\System\cdvAOqQ.exe
  2⤵
  PID:15524
- C:\Windows\System\zXhhqZA.exe
  C:\Windows\System\zXhhqZA.exe
  2⤵
  PID:15572
- C:\Windows\System\bWuYltC.exe
  C:\Windows\System\bWuYltC.exe
  2⤵
  PID:15620
- C:\Windows\System\urTyfJT.exe
  C:\Windows\System\urTyfJT.exe
  2⤵
  PID:15656
- C:\Windows\System\JCOaPji.exe
  C:\Windows\System\JCOaPji.exe
  2⤵
  PID:15732
- C:\Windows\System\jOsGLAa.exe
  C:\Windows\System\jOsGLAa.exe
  2⤵
  PID:15768
- C:\Windows\System\jOdGMsw.exe
  C:\Windows\System\jOdGMsw.exe
  2⤵
  PID:15812
- C:\Windows\System\LqJDsdV.exe
  C:\Windows\System\LqJDsdV.exe
  2⤵
  PID:15904
- C:\Windows\System\wpquwIV.exe
  C:\Windows\System\wpquwIV.exe
  2⤵
  PID:15956
- C:\Windows\System\GxROmuU.exe
  C:\Windows\System\GxROmuU.exe
  2⤵
  PID:15992
- C:\Windows\System\zmzPZVT.exe
  C:\Windows\System\zmzPZVT.exe
  2⤵
  PID:16028
- C:\Windows\System\SxUyUwa.exe
  C:\Windows\System\SxUyUwa.exe
  2⤵
  PID:16072
- C:\Windows\System\hkHHdrO.exe
  C:\Windows\System\hkHHdrO.exe
  2⤵
  PID:16172
- C:\Windows\System\iiiBTUS.exe
  C:\Windows\System\iiiBTUS.exe
  2⤵
  PID:16212
- C:\Windows\System\VEiUgGG.exe
  C:\Windows\System\VEiUgGG.exe
  2⤵
  PID:16252
- C:\Windows\System\rlpkmpK.exe
  C:\Windows\System\rlpkmpK.exe
  2⤵
  PID:16288
- C:\Windows\System\xDflxXi.exe
  C:\Windows\System\xDflxXi.exe
  2⤵
  PID:16256
- C:\Windows\System\aQNnTle.exe
  C:\Windows\System\aQNnTle.exe
  2⤵
  PID:15452
- C:\Windows\System\aPxkshs.exe
  C:\Windows\System\aPxkshs.exe
  2⤵
  PID:15472
- C:\Windows\System\iUqOXXF.exe
  C:\Windows\System\iUqOXXF.exe
  2⤵
  PID:15596
- C:\Windows\System\qodAkIP.exe
  C:\Windows\System\qodAkIP.exe
  2⤵
  PID:15600
- C:\Windows\System\NAkMBAd.exe
  C:\Windows\System\NAkMBAd.exe
  2⤵
  PID:16008
- C:\Windows\System\PHtlSRW.exe
  C:\Windows\System\PHtlSRW.exe
  2⤵
  PID:16096
- C:\Windows\System\fyObeQC.exe
  C:\Windows\System\fyObeQC.exe
  2⤵
  PID:16176
- C:\Windows\System\TroxHvb.exe
  C:\Windows\System\TroxHvb.exe
  2⤵
  PID:16168
- C:\Windows\System\wDopbyW.exe
  C:\Windows\System\wDopbyW.exe
  2⤵
  PID:16396
- C:\Windows\System\YEKDgCD.exe
  C:\Windows\System\YEKDgCD.exe
  2⤵
  PID:16416
- C:\Windows\System\gJsBzlH.exe
  C:\Windows\System\gJsBzlH.exe
  2⤵
  PID:16456
- C:\Windows\System\tguiODd.exe
  C:\Windows\System\tguiODd.exe
  2⤵
  PID:16484
- C:\Windows\System\XwBiNBs.exe
  C:\Windows\System\XwBiNBs.exe
  2⤵
  PID:16508
- C:\Windows\System\XNZpznk.exe
  C:\Windows\System\XNZpznk.exe
  2⤵
  PID:16528
- C:\Windows\System\BfryqVE.exe
  C:\Windows\System\BfryqVE.exe
  2⤵
  PID:16544
- C:\Windows\System\FxfYtjX.exe
  C:\Windows\System\FxfYtjX.exe
  2⤵
  PID:16568
- C:\Windows\System\PtQwlFP.exe
  C:\Windows\System\PtQwlFP.exe
  2⤵
  PID:16596
- C:\Windows\System\FifDONg.exe
  C:\Windows\System\FifDONg.exe
  2⤵
  PID:16616
- C:\Windows\System\ZKUjBEC.exe
  C:\Windows\System\ZKUjBEC.exe
  2⤵
  PID:16648
- C:\Windows\System\caIeiAq.exe
  C:\Windows\System\caIeiAq.exe
  2⤵
  PID:16672
- C:\Windows\System\UJIjIEn.exe
  C:\Windows\System\UJIjIEn.exe
  2⤵
  PID:16696
- C:\Windows\System\CFmOJPu.exe
  C:\Windows\System\CFmOJPu.exe
  2⤵
  PID:16720
- C:\Windows\System\FxALyee.exe
  C:\Windows\System\FxALyee.exe
  2⤵
  PID:16740
- C:\Windows\System\oQWLWXF.exe
  C:\Windows\System\oQWLWXF.exe
  2⤵
  PID:16780
- C:\Windows\System\hFqahsj.exe
  C:\Windows\System\hFqahsj.exe
  2⤵
  PID:16800
- C:\Windows\System\HavZlab.exe
  C:\Windows\System\HavZlab.exe
  2⤵
  PID:16820
- C:\Windows\System\vxGcRTA.exe
  C:\Windows\System\vxGcRTA.exe
  2⤵
  PID:16848
- C:\Windows\System\SbUwBBi.exe
  C:\Windows\System\SbUwBBi.exe
  2⤵
  PID:17140
- C:\Windows\System\qciaLyd.exe
  C:\Windows\System\qciaLyd.exe
  2⤵
  PID:17196
- C:\Windows\System\qlbNIWK.exe
  C:\Windows\System\qlbNIWK.exe
  2⤵
  PID:17224
- C:\Windows\System\hXAJHQC.exe
  C:\Windows\System\hXAJHQC.exe
  2⤵
  PID:17244
- C:\Windows\System\uGFisXn.exe
  C:\Windows\System\uGFisXn.exe
  2⤵
  PID:17272
- C:\Windows\System\zmrHQiM.exe
  C:\Windows\System\zmrHQiM.exe
  2⤵
  PID:17356
- C:\Windows\System\FFPJyNG.exe
  C:\Windows\System\FFPJyNG.exe
  2⤵
  PID:17376

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:17100

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\AdIIlaK.exe

Filesize
2.0MB

MD5
7cad22bb80ef7bf1dd5ac898bfb16bda

SHA1
5efc5edfce6807673ff026a05f52a58981989244

SHA256
f7638b48a5a684e582aaed61afc4d14adb84e7bdc6ef43d699fc9c3f6df37e17

SHA512
2382edab4580f2136681af23ba40e49050cf41de173100a863b87e2a9700352ffb3910aa57a96fed8e1031eb307f0a4d6db47981672bc3fb66fd8901378edb56

Download Submit
C:\Windows\System\FVZpnqH.exe

Filesize
2.0MB

MD5
cc49b59dcef9cba7600c9da641eb8118

SHA1
487f56552a0a998a225129914ae4051b85dfe379

SHA256
1fb6e13149786ccf5eff6b26ed94ace546d1917684a1dd32ef7f051775ffbb5a

SHA512
fc93219204861e8c7673d34e6b63d6e7051e297f5ecc80228341af72a8db9786a00804b1d249c67029d50234277d3bdefc9da6edd23184e09db87911fa804129

Download Submit
C:\Windows\System\FfSiAKW.exe

Filesize
2.0MB

MD5
bd43c0e224c3b15f384d8c07e9c88596

SHA1
39aaf02f89889bedd4a92773fcb0c3df0016fa3c

SHA256
620c971237efcb56f5cbe51c852a7b61021cb98e61323bb7609e865d7dce921d

SHA512
991e74c1d031d094d57b17e4d5325e3d3af00077202110bc5de422f217460a34b23e07f0781ec97bf1b4da6de7c402693fbfaac7aee00500abeb39cfcc4e90a6

Download Submit
C:\Windows\System\HCSpJyT.exe

Filesize
2.0MB

MD5
7f4d466381b7bdb2e04d8d6a108e3b9a

SHA1
ff0242171994f07eb5c4a4f41f9f71f6c9f9af18

SHA256
7bacd29cd54ad22b465a9a64b07b44ed06849c538dfaf97edadd035947c4ca3d

SHA512
be0deed4a6cf94b0e202a65101d63531238706694f6fde013c64a83696c01f020b57a47b90f57cbf43b855d153b937e0572710ab4b00e4b1154e8ddeb885c631

Download Submit
C:\Windows\System\IGTXqrv.exe

Filesize
2.0MB

MD5
e123621db826243cbd19340663952f0f

SHA1
a80f3c560ce217463d73baf0e7b6ad9747e05ad9

SHA256
b8f9fe3c7a6366798f4a5db3f8b988b68237d3d05350cce6300c68bc39fb727c

SHA512
b0ce32991800f9d65b38a09d0e41523b3fcba0ecad8991f2f5e2a4270b93d0b9144c933a66ce703de63959a73a9ead00ae583c1983df308f3f0b3bd99f070e5d

Download Submit
C:\Windows\System\LEWSelm.exe

Filesize
2.0MB

MD5
e4a07cf7965b7f04919dd4921db8f60c

SHA1
3e94f4a5e27b6e125451bee0b8f86a5d09faf6ce

SHA256
5257e2d74a597680e12d0c37928356834f9d608718530d903d26681bfbde71f4

SHA512
e89997ab68c14b36a4ee44b90c58381163b1170a6a553e990829f7c78c287d0d94343c48606d66479811a4cc9e8e90ba52e8698534540178f60e5a0a416cdca4

Download Submit
C:\Windows\System\LnaXdiZ.exe

Filesize
2.0MB

MD5
dab1f476d5a9c4c241b16cf86dde8a4a

SHA1
4184ae0bddb4be51798027412d82bbe3a9014494

SHA256
a1f2807525f2f9164b26827acfaff7320123b4ca416cd30328fc6b972692c306

SHA512
cdaf0980491193ff5e47dc7ee0df2f664cf40e2e956ed6461c465d0aac3d5955d6719edc3b11ead230a6d3b839f1bba25d484329b2168e937b19c69c12c06341

Download Submit
C:\Windows\System\LvSwhvl.exe

Filesize
2.0MB

MD5
981b5ad9f3347850a2274849cbf96520

SHA1
3a8c1427ce69d19e9dcfbdd35785b3f35df1a69e

SHA256
56d934180f1e34d4e2adc443a7e56a4b5b559c42b054f50a03fc4a487f483e2f

SHA512
333f16311ab00a7ba4484bb5c8ff03f878f2a3a8b28297a0a63889f66516f78879ae59986e2ec05121c29f3a808911b22aebc0375746689f7ce56e21670ecc53

Download Submit
C:\Windows\System\NHrcXzI.exe

Filesize
2.0MB

MD5
004f4e0369be671098817fcbaee7e2fb

SHA1
d47f19604851792dc0320b0250b88c01b4b5c715

SHA256
d254ba8c865a896ff50973ffd908c0f54386c954380969026ac81c5e6b6ed4b6

SHA512
2376dbbd8b054a1378e86db5dc8378c91ad6b13fb6ce38b22dfb40358af7a6292b6eea656e6fbc6a796de9e2eee742729617f43a4081cc121da853e2e8c7f9e2

Download Submit
C:\Windows\System\QiopAZE.exe

Filesize
2.0MB

MD5
140076f2edff3911278fbe7b09ac0284

SHA1
5fe42e2579c1d5276727b82e6627e9501660f854

SHA256
2ee83ea1a4fc5ac410c57619271fab8e143bdf5f9155468a1bf9dfbc34013abb

SHA512
324b88b8aa7bdc4a249e3f22663f7ff67b0cfb8ea94830ca645c2f36790b986b13cb4514a9cef7ecb6244404fc0ad915f7ca6d400353a5ae281bff946ea626d9

Download Submit
C:\Windows\System\RwqjnZa.exe

Filesize
2.0MB

MD5
906d163bdfc13446db956125febefd3e

SHA1
83b052b0a869897168fb563f32e8736ec5fcab5d

SHA256
a082c28d01e5a2518e2f406fbbc687146449db332f47c0c2fbbf7a59b222ddf9

SHA512
852683495da11f38ecbc66d5a1d4f5568f5d6783e08169a504a89c93f7ef2dbd7ebcb640076abc54505d7ba0a7a8442e7875fee8fa9e6e1f73207b5ffb80ebab

Download Submit
C:\Windows\System\WuSHIcz.exe

Filesize
2.0MB

MD5
cd611883c42d0972b58a80d8c54db82f

SHA1
7ed071960aecf559cc1af3f978a26c4f7ff12301

SHA256
604def6e914284d2ac7ce1daaa1e31aa9bda0aa3cb1b59ebea795aa31be73151

SHA512
0ca5668bd142cd5f373c0b0d9baaf7047569340297099804415c7230016ea830bc29ecff6d5f8d74d5bff7c1944af9b879e1f8a799c1fd40342b465d48ef243f

Download Submit
C:\Windows\System\bOODYXe.exe

Filesize
2.0MB

MD5
f343d2c5f1c1f140a05981c29233cbbe

SHA1
879b2ac5942b5e32fbadfff8ff1cab860b504669

SHA256
6eb098123aff6d9745c6dac2167ed6509581372fa4cf21d366012b7b9c126fd6

SHA512
08f2e2626da53005fc4b58748214989249365b43b86fc34242931c8e6cce3ea06801a6af40470b03bd15d4452e6032da6c141a0af2369aa0a6c9224e9b490f56

Download Submit
C:\Windows\System\bwKtPZV.exe

Filesize
2.0MB

MD5
b15e247ea1982433e0ab86fec14ac64b

SHA1
7e04226bd18bc382a73ac9e1a6006143b50b7df1

SHA256
8e9c0198c795b1ff5e9c01ef77a6b0c476294a44f7e1c691a4b14feb02c13a9a

SHA512
96da13721d4cc4a4bb2c10053be34e8f7f5f4b0906eb1f5556c5353185a43a516ab4ac29b6d3b85400e2b73e891b317ed2c58f283d1097691bf7e9f3bbdd09a3

Download Submit
C:\Windows\System\dOscadT.exe

Filesize
2.0MB

MD5
dbbe50a0b1f3b47cae33896558380ac1

SHA1
7729335497fe450ed16f639952f527cfd140965f

SHA256
85aae2b9a76e8aae8fcc96a49379ac2513131f37dc238bddb77f7a528c8cb7c3

SHA512
ae1079a872b1561dec28f54ac82d8a161c83027e76388a035d49ac84fd8b8b6b074de150de97cc7e093e3be141f76bc10e7bef8abcf7faba24c77c14041d99d2

Download Submit
C:\Windows\System\eyaaHEl.exe

Filesize
2.0MB

MD5
d3523331509752b0dd44153b37aeb2fd

SHA1
01298123f8104a8da53495ba909c68cb816aed30

SHA256
0492ff6e9cbb6e0b63eb0d435f0e6d2221080c90f1df9a21a5daa72aa6783f5b

SHA512
a33d1970eda27c6c4d75e4583479a2fd023ae430ea798addb3ea6345bdc1f1cadb8b55b5100d269adff5cc54a7ee72ce5d90e5da00d89a2f0840998321f34002

Download Submit
C:\Windows\System\fMqxuBH.exe

Filesize
2.0MB

MD5
f10efb79813c4d65fffddc40ffa7b73c

SHA1
254fdf5e595bc26a9cba67cfbd04c20947a35c0c

SHA256
ae6d1506190e537e164aec16111b099f39eb60d83b40a6d848ed12eb5bc5ad9c

SHA512
9204475091fff55effc9536195b6627c2893e8ae185ac01b107eb6d6cca3ea6ef7560fc51a416b3ae92fec02e5dfba2d8c4cd0f10c8477e42e602e3593fc65eb

Download Submit
C:\Windows\System\fuWGHkg.exe

Filesize
2.0MB

MD5
da87ebb7e66fec80fd64d2b0734fe58a

SHA1
b2aa09917de36994fbcd811f0f52f7f2f5961a60

SHA256
4e448003eb242c8fca50464f89f5ca6fa5a49c44f6a63594b106043d652f1e44

SHA512
0532914d0eacd1e1883b57fde3cb7fc1d38bd40227dbf0df51ecf8af87f9c9bacbeae04cd1ae1affcf1b2529b02232ff0713f4cac18db59fab251adf41ea68a1

Download Submit
C:\Windows\System\gUBHWho.exe

Filesize
2.0MB

MD5
491ae30bf6e8376a245704965ec8c0b4

SHA1
051c3fc09bc8a09c0a0d119aea53973d71bf044d

SHA256
faeb80136bd47b6ef5a0840415c7f8053196304ca1b2d9d252c230568355c665

SHA512
5c16e165f61144b93c53031155f5c91c7c31fd3ae3252358b054be251cf09e4a314470c992fe167ef48f0af3cb820945bcba8963044ee1b31e6c425b360da6c0

Download Submit
C:\Windows\System\ghfXkFX.exe

Filesize
2.0MB

MD5
d17cecd9cf23e81b6982bf3837568a3a

SHA1
a73e76689a47ce03038bd0b79325529fe24c2ef1

SHA256
e5373ec056906590d6801f1acb42fea71810bd6d4def0e6a46f626d2955aeede

SHA512
8f946b3074517d4dd2a4ede38938a036ebb411ab37acfadea5d79088a8591afc72be11f718209ce6d5e49b9ea12c6d5167103215756edd2c7b30a72159163c37

Download Submit
C:\Windows\System\gwDGlgh.exe

Filesize
2.0MB

MD5
3b59703242058ce203df6ed801083a59

SHA1
9d4aec23b1cf203c0a1d37e6c805b0fd2607a700

SHA256
b8727c988f6dce1714efedc15c2da928054c2fe7f606d42ca11cf567c0c26afa

SHA512
8cbe791b4f5b91f1df74cd8f9e01aa74f2263aed1a761627f347458d44f80a741c4d12436d737f03008694ab1fb240b3fc52cc66fbdee5ea310869024690e839

Download Submit
C:\Windows\System\iGQaFZz.exe

Filesize
2.0MB

MD5
bc8da0403d942b9cb96c1ce55709f504

SHA1
e4f13741e2797190fb59270a047d10ed36310fd5

SHA256
af303dfbb80bc6dfd4be4ef72865f03ccf332b9cd85fcbe6420dc299dfe5c833

SHA512
386fbf56666d5e957101762a4c18d6fd27174b471463f59ff22cd1ff568ae3a88a4b18d8f1a242ddeeb344e37b7ef7df89d8b3b6996c57c00e2b746ec7806352

Download Submit
C:\Windows\System\inkMTKG.exe

Filesize
2.0MB

MD5
edcb4b8949d3954e6073983907447671

SHA1
580621acf9028df87efb82047f2ea13c728c79f2

SHA256
4ad61c2b0425b0873a16b8d124c68502b2cbaf21e8fff2575c98c514f4d02069

SHA512
c7c45ce1f953490138bf6c0f812ada5d13331e3ae101738c03b936a696b510fab0e1d9ebd42b8a2d8d9f012f771a67caa869f2dba57837dae79efb9094d959b8

Download Submit
C:\Windows\System\kzsExoj.exe

Filesize
2.0MB

MD5
65ab5c9804cbb7c0697548379cbffb6a

SHA1
b4417848d76e6a86fab882204137dace04fc3a0e

SHA256
c462876349e5c929526dca9d281b6d1f51c9cfad85300cf53619faeab6d8c3db

SHA512
bf44324484a2ec9ed325b6d8233755024762adf0c365f734191e701e991f77ddfafe5786edf2d1512d1cae391686400f16af2e75b4de3dcaa2b39e0b0f38cdc5

Download Submit
C:\Windows\System\nFhIIOi.exe

Filesize
2.0MB

MD5
cd816c8a343fcff9ff76baf8a8b9e3e9

SHA1
3f92fb1953f48978cc11d171c66f4bdb88820989

SHA256
3b2935b34128541367c026309084f488b75185635f6f5e8cae7100031ca23a7e

SHA512
ff9117a0f8cc00bc7d2bcf2cb17db178f75096a204447f647e66b6c50df0b65937620c0a9933f5a6c035af2b537d3ab17e722371973662ad6bf2c294526939b8

Download Submit
C:\Windows\System\nkkAwwP.exe

Filesize
2.0MB

MD5
b90f6dcdf6ad26ae64011d3c9aa5bad7

SHA1
d0ed5e9059c2f6889cc58ecf1a4dd6766fc56248

SHA256
bc433c5c391ee078fa65a02405831c5227a2e6016f53cf02dc9bd6e6321d85e4

SHA512
2142fa615cb815d185d29ce3b5ba9e1b768207d3266f64cd2ff1cb088e405370fd8d0913d847e55c3ad4b70814742ec9c4323117a5f632788e478fbd814d6ea9

Download Submit
C:\Windows\System\pWDsTZh.exe

Filesize
2.0MB

MD5
d610af1113ae9fe3a78679aeb25ec130

SHA1
ce96a9a9300459ee79e06c0f57c02f56607b2fa3

SHA256
cfdd602ced13dcd0dbe4fc1cf8fbb2ed2654e241de91f76a17409c366e6ef0d1

SHA512
1a4ca8b184aed9bd23d7425e8fb674257575a37054ccc5d3818ecafb2d82b96c9b6f9f8c12b74d7d999f51f40a5ffc2da14b4991465638abb667964e5a2c8602

Download Submit
C:\Windows\System\pgZOAOj.exe

Filesize
2.0MB

MD5
7c8b1c982396788b8db3f9ea8d0b6f2d

SHA1
1c2e6e67d9dfa3e8f92b8d9fe04dd03cdb61bc38

SHA256
198161e6c44346dd09389dad8df7d2467f92d7376f2c60a3d925a868ea4e9f17

SHA512
928b02b130fe8f9c151b76e8eed3dc8ba3657b060e30701a0abc2bfa2a84c578b0fdb4d460a87b4b707ec76c24f8209a1c9b981889860a3c024f5842281d2393

Download Submit
C:\Windows\System\psdyrGm.exe

Filesize
2.0MB

MD5
8e00dd28e84a0020fe02d6b63c2475e4

SHA1
c1c70b086092e8b04bf9948e73c654004e5bd537

SHA256
d642bb02a026b1bdd39bfc28e925b6ed73764725cee297b47f16d2169014b006

SHA512
7eed916629e2c3ac40001a2775ab57e670b2fa96aa14f25ff454038106807c89da7866ec9417ecace69a506bbb52bbc0f562c4e97c2361b0774c860b05ab7565

Download Submit
C:\Windows\System\qlyQhnJ.exe

Filesize
2.0MB

MD5
48237092799d45af33163a7663a68ce9

SHA1
247cfbc82f6b13bd554d2b216eb725426be58619

SHA256
893f991e48901b27ebc1ecb132d08ddf4c12bb4d4ae37f2a5a8806b94080ca37

SHA512
0af45e29f952a08e2d21f0d771d5c672901950d2bd9b74a916f0088c3ee4946372aca3eda1811d3a7a1c50b94c8e8c1c5c27485f4c88ecd6823f80d7de0dd2fd

Download Submit
C:\Windows\System\vXNCYWR.exe

Filesize
2.0MB

MD5
e8ba87e04537ab7ccc11a528aac1fb29

SHA1
8c38710006f8a43a9f64260196af10b420037ce3

SHA256
528c7eb785480773a944a80253c8de4899fbd5ae90ef9ee3ec776ecd8a972995

SHA512
f72439df0857d09a07d1162428de34fee2d823a28cbb93c02ecc557c245f2003b6b7b883b9c53cccd9ffc2dd353bbe80e1a766cc242638d362b964f5ee38b45a

Download Submit
C:\Windows\System\vrkyQOV.exe

Filesize
2.0MB

MD5
b6974af04496248008d454e1d6ca442a

SHA1
1b51b69d4cd78dcbf2c4db1dad7cd4a479532f42

SHA256
8bea7290ac753e4f2a26e6e5912ebd64d7e80b179291ad91a7c5d8daddc310bd

SHA512
81c6b2e150afa6e31a74b352e8535954a453934c8afbcec87b28040566a6e2165d63c0f32c34200e3899446acac6126a21e6eccc269a7813d362129aa96b4330

Download Submit
C:\Windows\System\zNACixI.exe

Filesize
2.0MB

MD5
554c1a3e8e727e85eb5fcbca1e985986

SHA1
dd70d6182592a05c05ef590f655fa46c13ccfa7d

SHA256
f6263b1f0da9d27ef37ede1bf9af3bb2a55f0e869e75cd938075170c3cb8e223

SHA512
44feb7d63e425df6450c568622d68d88587f06046ccb8ac6e2ab011b6b3b34710d78761d0c23842229015911be885c79c2ac7909e1d72c41d0a534db25615c4d

Download Submit
memory/392-0-0x000001B12A3B0000-0x000001B12A3C0000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads