xmrig | 944bd716640aff6aa33fba92ce2b0ca69cbc2e0a9465a5ed781ff70e0c01c87e

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
25-01-2025 03:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

944bd716640aff6aa33fba92ce2b0ca69cbc2e0a9465a5ed781ff70e0c01c87e.exe
Size

1.8MB
MD5

01450fbf88c17b6d90b41bcc19b25668
SHA1

614aec47d44f327b0c113d372d1823e9a4614507
SHA256

944bd716640aff6aa33fba92ce2b0ca69cbc2e0a9465a5ed781ff70e0c01c87e
SHA512

2983383233814701b2c033de884a73af86c430f551f77dfded7932d52bee19604c11380360e80ec75b9f42c8bbc47d7f6e921708355af21f91b94caf2c770ca8
SSDEEP

49152:GezaTF8FcNkNdfE0pZ9ozttwIRxj4c5yOYFu4/qPXSYnI:GemTLkNdfE0pZyM

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 33 IoCs

miner

resource	yara_rule
behavioral2/files/0x000c000000023baa-4.dat	xmrig
behavioral2/files/0x0007000000023ca1-6.dat	xmrig
behavioral2/files/0x0007000000023ca2-24.dat	xmrig
behavioral2/files/0x0007000000023ca7-38.dat	xmrig
behavioral2/files/0x0007000000023cab-56.dat	xmrig
behavioral2/files/0x0007000000023caa-67.dat	xmrig
behavioral2/files/0x0007000000023caf-87.dat	xmrig
behavioral2/files/0x0007000000023cb4-99.dat	xmrig
behavioral2/files/0x0007000000023cb0-108.dat	xmrig
behavioral2/files/0x0007000000023cbf-139.dat	xmrig
behavioral2/files/0x0007000000023cbd-148.dat	xmrig
behavioral2/files/0x0007000000023cbc-147.dat	xmrig
behavioral2/files/0x0007000000023cb7-146.dat	xmrig
behavioral2/files/0x0007000000023cb5-145.dat	xmrig
behavioral2/files/0x0007000000023cbb-144.dat	xmrig
behavioral2/files/0x0007000000023cba-143.dat	xmrig
behavioral2/files/0x0007000000023cb9-142.dat	xmrig
behavioral2/files/0x0007000000023cb8-141.dat	xmrig
behavioral2/files/0x0007000000023cb6-140.dat	xmrig
behavioral2/files/0x0007000000023cbe-138.dat	xmrig
behavioral2/files/0x0007000000023cb3-125.dat	xmrig
behavioral2/files/0x0007000000023cb2-118.dat	xmrig
behavioral2/files/0x0007000000023cb1-115.dat	xmrig
behavioral2/files/0x0007000000023cae-95.dat	xmrig
behavioral2/files/0x0007000000023ca9-84.dat	xmrig
behavioral2/files/0x0007000000023cad-82.dat	xmrig
behavioral2/files/0x0007000000023cac-80.dat	xmrig
behavioral2/files/0x0007000000023ca8-62.dat	xmrig
behavioral2/files/0x0007000000023ca6-57.dat	xmrig
behavioral2/files/0x0007000000023ca5-49.dat	xmrig
behavioral2/files/0x0007000000023ca4-43.dat	xmrig
behavioral2/files/0x0007000000023ca3-27.dat	xmrig
behavioral2/files/0x0008000000023c9d-18.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
1356	BeApmxM.exe
1824	UAmjpfl.exe
1524	zVFGtre.exe
2648	WKxpvCM.exe
3600	IIdhJtB.exe
2272	XEgGLko.exe
1740	mbGUCJK.exe
3040	ohoQlgD.exe
4748	fERRCvR.exe
3332	eZaLndx.exe
4816	mCEklwZ.exe
4532	BOWCCnN.exe
3500	XsYMOEa.exe
4340	QZUtuSG.exe
4140	AOBzlUE.exe
2996	jETMlwI.exe
3984	oRvTpjJ.exe
796	uCFAkQh.exe
4948	GCpTxLY.exe
2308	VvJSAfw.exe
4488	FosWSzl.exe
3008	tFsdxrk.exe
5052	rKvnnIQ.exe
4416	NBEcdHa.exe
4440	nxEZJjP.exe
2840	rXRQSti.exe
2520	xjzDqcL.exe
3208	mEYKkNW.exe
4912	jgDuZSv.exe
2008	sovCFhV.exe
2192	EijFyme.exe
1948	XZMKoJp.exe
3000	FSHNuLD.exe
3840	FVvmmzO.exe
1848	GYDVOZG.exe
5024	cmOajUb.exe
756	RsyZSRs.exe
264	jvUmYUL.exe
4196	xHLgape.exe
4288	bdPqMXW.exe
3432	ODxkVmh.exe
3552	VXzDExa.exe
2728	ygevrbl.exe
3516	zEjYfxc.exe
3952	jBirOnF.exe
1360	JYsdlzS.exe
3416	UfzvXRp.exe
5044	ufzcytJ.exe
2300	akFmyTx.exe
184	voxnWLI.exe
2784	jMXjbZy.exe
3364	xQGcCkU.exe
4516	nzikHJF.exe
3076	zvvJnVY.exe
2388	dZbVHyA.exe
536	fXiweCv.exe
5016	fFZTXsF.exe
2268	hdwtNmA.exe
3468	ZLxhrhk.exe
428	uAcQUjA.exe
636	SJvbYQQ.exe
4332	oSaptQe.exe
4276	arFiDep.exe
348	PTnnxwD.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\hDAJgVG.exe	944bd716640aff6aa33fba92ce2b0ca69cbc2e0a9465a5ed781ff70e0c01c87e.exe
File created	C:\Windows\System\jpduRgL.exe	944bd716640aff6aa33fba92ce2b0ca69cbc2e0a9465a5ed781ff70e0c01c87e.exe
File created	C:\Windows\System\qkfwjIQ.exe	944bd716640aff6aa33fba92ce2b0ca69cbc2e0a9465a5ed781ff70e0c01c87e.exe
File created	C:\Windows\System\QhfoUdR.exe	944bd716640aff6aa33fba92ce2b0ca69cbc2e0a9465a5ed781ff70e0c01c87e.exe
File created	C:\Windows\System\MBZNtRv.exe	944bd716640aff6aa33fba92ce2b0ca69cbc2e0a9465a5ed781ff70e0c01c87e.exe
File created	C:\Windows\System\buwzCud.exe	944bd716640aff6aa33fba92ce2b0ca69cbc2e0a9465a5ed781ff70e0c01c87e.exe
File created	C:\Windows\System\gcYIojm.exe	944bd716640aff6aa33fba92ce2b0ca69cbc2e0a9465a5ed781ff70e0c01c87e.exe
File created	C:\Windows\System\aRFuuJb.exe	944bd716640aff6aa33fba92ce2b0ca69cbc2e0a9465a5ed781ff70e0c01c87e.exe
File created	C:\Windows\System\QDoHnPK.exe	944bd716640aff6aa33fba92ce2b0ca69cbc2e0a9465a5ed781ff70e0c01c87e.exe
File created	C:\Windows\System\fnWVgPa.exe	944bd716640aff6aa33fba92ce2b0ca69cbc2e0a9465a5ed781ff70e0c01c87e.exe
File created	C:\Windows\System\ndEPJJX.exe	944bd716640aff6aa33fba92ce2b0ca69cbc2e0a9465a5ed781ff70e0c01c87e.exe
File created	C:\Windows\System\RGTqVZJ.exe	944bd716640aff6aa33fba92ce2b0ca69cbc2e0a9465a5ed781ff70e0c01c87e.exe
File created	C:\Windows\System\VXzDExa.exe	944bd716640aff6aa33fba92ce2b0ca69cbc2e0a9465a5ed781ff70e0c01c87e.exe
File created	C:\Windows\System\brcHesG.exe	944bd716640aff6aa33fba92ce2b0ca69cbc2e0a9465a5ed781ff70e0c01c87e.exe
File created	C:\Windows\System\ynuLqif.exe	944bd716640aff6aa33fba92ce2b0ca69cbc2e0a9465a5ed781ff70e0c01c87e.exe
File created	C:\Windows\System\RBdtvpg.exe	944bd716640aff6aa33fba92ce2b0ca69cbc2e0a9465a5ed781ff70e0c01c87e.exe
File created	C:\Windows\System\TQHqtsf.exe	944bd716640aff6aa33fba92ce2b0ca69cbc2e0a9465a5ed781ff70e0c01c87e.exe
File created	C:\Windows\System\EHxFaAs.exe	944bd716640aff6aa33fba92ce2b0ca69cbc2e0a9465a5ed781ff70e0c01c87e.exe
File created	C:\Windows\System\fceYVwG.exe	944bd716640aff6aa33fba92ce2b0ca69cbc2e0a9465a5ed781ff70e0c01c87e.exe
File created	C:\Windows\System\IRLlXkn.exe	944bd716640aff6aa33fba92ce2b0ca69cbc2e0a9465a5ed781ff70e0c01c87e.exe
File created	C:\Windows\System\PuqLPgO.exe	944bd716640aff6aa33fba92ce2b0ca69cbc2e0a9465a5ed781ff70e0c01c87e.exe
File created	C:\Windows\System\IjhzqZZ.exe	944bd716640aff6aa33fba92ce2b0ca69cbc2e0a9465a5ed781ff70e0c01c87e.exe
File created	C:\Windows\System\JhkZWDN.exe	944bd716640aff6aa33fba92ce2b0ca69cbc2e0a9465a5ed781ff70e0c01c87e.exe
File created	C:\Windows\System\ToHXIrY.exe	944bd716640aff6aa33fba92ce2b0ca69cbc2e0a9465a5ed781ff70e0c01c87e.exe
File created	C:\Windows\System\zMmqWTh.exe	944bd716640aff6aa33fba92ce2b0ca69cbc2e0a9465a5ed781ff70e0c01c87e.exe
File created	C:\Windows\System\ZhatTZk.exe	944bd716640aff6aa33fba92ce2b0ca69cbc2e0a9465a5ed781ff70e0c01c87e.exe
File created	C:\Windows\System\aNaUFBW.exe	944bd716640aff6aa33fba92ce2b0ca69cbc2e0a9465a5ed781ff70e0c01c87e.exe
File created	C:\Windows\System\zPfqiJc.exe	944bd716640aff6aa33fba92ce2b0ca69cbc2e0a9465a5ed781ff70e0c01c87e.exe
File created	C:\Windows\System\UbifIkT.exe	944bd716640aff6aa33fba92ce2b0ca69cbc2e0a9465a5ed781ff70e0c01c87e.exe
File created	C:\Windows\System\qxrqJJI.exe	944bd716640aff6aa33fba92ce2b0ca69cbc2e0a9465a5ed781ff70e0c01c87e.exe
File created	C:\Windows\System\itiLunP.exe	944bd716640aff6aa33fba92ce2b0ca69cbc2e0a9465a5ed781ff70e0c01c87e.exe
File created	C:\Windows\System\uUmoVHr.exe	944bd716640aff6aa33fba92ce2b0ca69cbc2e0a9465a5ed781ff70e0c01c87e.exe
File created	C:\Windows\System\qrCzCaP.exe	944bd716640aff6aa33fba92ce2b0ca69cbc2e0a9465a5ed781ff70e0c01c87e.exe
File created	C:\Windows\System\HAGbVWJ.exe	944bd716640aff6aa33fba92ce2b0ca69cbc2e0a9465a5ed781ff70e0c01c87e.exe
File created	C:\Windows\System\gXPxqmi.exe	944bd716640aff6aa33fba92ce2b0ca69cbc2e0a9465a5ed781ff70e0c01c87e.exe
File created	C:\Windows\System\vITSUfZ.exe	944bd716640aff6aa33fba92ce2b0ca69cbc2e0a9465a5ed781ff70e0c01c87e.exe
File created	C:\Windows\System\EMXPqal.exe	944bd716640aff6aa33fba92ce2b0ca69cbc2e0a9465a5ed781ff70e0c01c87e.exe
File created	C:\Windows\System\qQWwQRr.exe	944bd716640aff6aa33fba92ce2b0ca69cbc2e0a9465a5ed781ff70e0c01c87e.exe
File created	C:\Windows\System\NEypcAk.exe	944bd716640aff6aa33fba92ce2b0ca69cbc2e0a9465a5ed781ff70e0c01c87e.exe
File created	C:\Windows\System\QgVCgSh.exe	944bd716640aff6aa33fba92ce2b0ca69cbc2e0a9465a5ed781ff70e0c01c87e.exe
File created	C:\Windows\System\QozaJXd.exe	944bd716640aff6aa33fba92ce2b0ca69cbc2e0a9465a5ed781ff70e0c01c87e.exe
File created	C:\Windows\System\FkkZItT.exe	944bd716640aff6aa33fba92ce2b0ca69cbc2e0a9465a5ed781ff70e0c01c87e.exe
File created	C:\Windows\System\xzeQtRv.exe	944bd716640aff6aa33fba92ce2b0ca69cbc2e0a9465a5ed781ff70e0c01c87e.exe
File created	C:\Windows\System\vjulhrO.exe	944bd716640aff6aa33fba92ce2b0ca69cbc2e0a9465a5ed781ff70e0c01c87e.exe
File created	C:\Windows\System\aaNIATS.exe	944bd716640aff6aa33fba92ce2b0ca69cbc2e0a9465a5ed781ff70e0c01c87e.exe
File created	C:\Windows\System\SMEPGJm.exe	944bd716640aff6aa33fba92ce2b0ca69cbc2e0a9465a5ed781ff70e0c01c87e.exe
File created	C:\Windows\System\EijFyme.exe	944bd716640aff6aa33fba92ce2b0ca69cbc2e0a9465a5ed781ff70e0c01c87e.exe
File created	C:\Windows\System\fmBLMEv.exe	944bd716640aff6aa33fba92ce2b0ca69cbc2e0a9465a5ed781ff70e0c01c87e.exe
File created	C:\Windows\System\JTXDXha.exe	944bd716640aff6aa33fba92ce2b0ca69cbc2e0a9465a5ed781ff70e0c01c87e.exe
File created	C:\Windows\System\VgluleH.exe	944bd716640aff6aa33fba92ce2b0ca69cbc2e0a9465a5ed781ff70e0c01c87e.exe
File created	C:\Windows\System\lyNIMLQ.exe	944bd716640aff6aa33fba92ce2b0ca69cbc2e0a9465a5ed781ff70e0c01c87e.exe
File created	C:\Windows\System\FytAdOv.exe	944bd716640aff6aa33fba92ce2b0ca69cbc2e0a9465a5ed781ff70e0c01c87e.exe
File created	C:\Windows\System\rWYfpfF.exe	944bd716640aff6aa33fba92ce2b0ca69cbc2e0a9465a5ed781ff70e0c01c87e.exe
File created	C:\Windows\System\mazAREK.exe	944bd716640aff6aa33fba92ce2b0ca69cbc2e0a9465a5ed781ff70e0c01c87e.exe
File created	C:\Windows\System\kjRgPJT.exe	944bd716640aff6aa33fba92ce2b0ca69cbc2e0a9465a5ed781ff70e0c01c87e.exe
File created	C:\Windows\System\NqBWrHW.exe	944bd716640aff6aa33fba92ce2b0ca69cbc2e0a9465a5ed781ff70e0c01c87e.exe
File created	C:\Windows\System\QiqExhD.exe	944bd716640aff6aa33fba92ce2b0ca69cbc2e0a9465a5ed781ff70e0c01c87e.exe
File created	C:\Windows\System\yXSudBd.exe	944bd716640aff6aa33fba92ce2b0ca69cbc2e0a9465a5ed781ff70e0c01c87e.exe
File created	C:\Windows\System\bPqwzPg.exe	944bd716640aff6aa33fba92ce2b0ca69cbc2e0a9465a5ed781ff70e0c01c87e.exe
File created	C:\Windows\System\sKcwQNZ.exe	944bd716640aff6aa33fba92ce2b0ca69cbc2e0a9465a5ed781ff70e0c01c87e.exe
File created	C:\Windows\System\xFFzCZV.exe	944bd716640aff6aa33fba92ce2b0ca69cbc2e0a9465a5ed781ff70e0c01c87e.exe
File created	C:\Windows\System\IZNOipU.exe	944bd716640aff6aa33fba92ce2b0ca69cbc2e0a9465a5ed781ff70e0c01c87e.exe
File created	C:\Windows\System\NyXjjBw.exe	944bd716640aff6aa33fba92ce2b0ca69cbc2e0a9465a5ed781ff70e0c01c87e.exe
File created	C:\Windows\System\XsYMOEa.exe	944bd716640aff6aa33fba92ce2b0ca69cbc2e0a9465a5ed781ff70e0c01c87e.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	17348	dwm.exe
Token: SeChangeNotifyPrivilege	17348	dwm.exe
Token: 33	17348	dwm.exe
Token: SeIncBasePriorityPrivilege	17348	dwm.exe
Token: SeShutdownPrivilege	17348	dwm.exe
Token: SeCreatePagefilePrivilege	17348	dwm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4396 wrote to memory of 1356	4396	944bd716640aff6aa33fba92ce2b0ca69cbc2e0a9465a5ed781ff70e0c01c87e.exe	84
PID 4396 wrote to memory of 1356	4396	944bd716640aff6aa33fba92ce2b0ca69cbc2e0a9465a5ed781ff70e0c01c87e.exe	84
PID 4396 wrote to memory of 1824	4396	944bd716640aff6aa33fba92ce2b0ca69cbc2e0a9465a5ed781ff70e0c01c87e.exe	85
PID 4396 wrote to memory of 1824	4396	944bd716640aff6aa33fba92ce2b0ca69cbc2e0a9465a5ed781ff70e0c01c87e.exe	85
PID 4396 wrote to memory of 1524	4396	944bd716640aff6aa33fba92ce2b0ca69cbc2e0a9465a5ed781ff70e0c01c87e.exe	86
PID 4396 wrote to memory of 1524	4396	944bd716640aff6aa33fba92ce2b0ca69cbc2e0a9465a5ed781ff70e0c01c87e.exe	86
PID 4396 wrote to memory of 2648	4396	944bd716640aff6aa33fba92ce2b0ca69cbc2e0a9465a5ed781ff70e0c01c87e.exe	87
PID 4396 wrote to memory of 2648	4396	944bd716640aff6aa33fba92ce2b0ca69cbc2e0a9465a5ed781ff70e0c01c87e.exe	87
PID 4396 wrote to memory of 3600	4396	944bd716640aff6aa33fba92ce2b0ca69cbc2e0a9465a5ed781ff70e0c01c87e.exe	88
PID 4396 wrote to memory of 3600	4396	944bd716640aff6aa33fba92ce2b0ca69cbc2e0a9465a5ed781ff70e0c01c87e.exe	88
PID 4396 wrote to memory of 2272	4396	944bd716640aff6aa33fba92ce2b0ca69cbc2e0a9465a5ed781ff70e0c01c87e.exe	89
PID 4396 wrote to memory of 2272	4396	944bd716640aff6aa33fba92ce2b0ca69cbc2e0a9465a5ed781ff70e0c01c87e.exe	89
PID 4396 wrote to memory of 1740	4396	944bd716640aff6aa33fba92ce2b0ca69cbc2e0a9465a5ed781ff70e0c01c87e.exe	90
PID 4396 wrote to memory of 1740	4396	944bd716640aff6aa33fba92ce2b0ca69cbc2e0a9465a5ed781ff70e0c01c87e.exe	90
PID 4396 wrote to memory of 3040	4396	944bd716640aff6aa33fba92ce2b0ca69cbc2e0a9465a5ed781ff70e0c01c87e.exe	91
PID 4396 wrote to memory of 3040	4396	944bd716640aff6aa33fba92ce2b0ca69cbc2e0a9465a5ed781ff70e0c01c87e.exe	91
PID 4396 wrote to memory of 4748	4396	944bd716640aff6aa33fba92ce2b0ca69cbc2e0a9465a5ed781ff70e0c01c87e.exe	92
PID 4396 wrote to memory of 4748	4396	944bd716640aff6aa33fba92ce2b0ca69cbc2e0a9465a5ed781ff70e0c01c87e.exe	92
PID 4396 wrote to memory of 3332	4396	944bd716640aff6aa33fba92ce2b0ca69cbc2e0a9465a5ed781ff70e0c01c87e.exe	93
PID 4396 wrote to memory of 3332	4396	944bd716640aff6aa33fba92ce2b0ca69cbc2e0a9465a5ed781ff70e0c01c87e.exe	93
PID 4396 wrote to memory of 4140	4396	944bd716640aff6aa33fba92ce2b0ca69cbc2e0a9465a5ed781ff70e0c01c87e.exe	94
PID 4396 wrote to memory of 4140	4396	944bd716640aff6aa33fba92ce2b0ca69cbc2e0a9465a5ed781ff70e0c01c87e.exe	94
PID 4396 wrote to memory of 4816	4396	944bd716640aff6aa33fba92ce2b0ca69cbc2e0a9465a5ed781ff70e0c01c87e.exe	95
PID 4396 wrote to memory of 4816	4396	944bd716640aff6aa33fba92ce2b0ca69cbc2e0a9465a5ed781ff70e0c01c87e.exe	95
PID 4396 wrote to memory of 4532	4396	944bd716640aff6aa33fba92ce2b0ca69cbc2e0a9465a5ed781ff70e0c01c87e.exe	96
PID 4396 wrote to memory of 4532	4396	944bd716640aff6aa33fba92ce2b0ca69cbc2e0a9465a5ed781ff70e0c01c87e.exe	96
PID 4396 wrote to memory of 3500	4396	944bd716640aff6aa33fba92ce2b0ca69cbc2e0a9465a5ed781ff70e0c01c87e.exe	97
PID 4396 wrote to memory of 3500	4396	944bd716640aff6aa33fba92ce2b0ca69cbc2e0a9465a5ed781ff70e0c01c87e.exe	97
PID 4396 wrote to memory of 4340	4396	944bd716640aff6aa33fba92ce2b0ca69cbc2e0a9465a5ed781ff70e0c01c87e.exe	98
PID 4396 wrote to memory of 4340	4396	944bd716640aff6aa33fba92ce2b0ca69cbc2e0a9465a5ed781ff70e0c01c87e.exe	98
PID 4396 wrote to memory of 2996	4396	944bd716640aff6aa33fba92ce2b0ca69cbc2e0a9465a5ed781ff70e0c01c87e.exe	99
PID 4396 wrote to memory of 2996	4396	944bd716640aff6aa33fba92ce2b0ca69cbc2e0a9465a5ed781ff70e0c01c87e.exe	99
PID 4396 wrote to memory of 3984	4396	944bd716640aff6aa33fba92ce2b0ca69cbc2e0a9465a5ed781ff70e0c01c87e.exe	100
PID 4396 wrote to memory of 3984	4396	944bd716640aff6aa33fba92ce2b0ca69cbc2e0a9465a5ed781ff70e0c01c87e.exe	100
PID 4396 wrote to memory of 796	4396	944bd716640aff6aa33fba92ce2b0ca69cbc2e0a9465a5ed781ff70e0c01c87e.exe	101
PID 4396 wrote to memory of 796	4396	944bd716640aff6aa33fba92ce2b0ca69cbc2e0a9465a5ed781ff70e0c01c87e.exe	101
PID 4396 wrote to memory of 4948	4396	944bd716640aff6aa33fba92ce2b0ca69cbc2e0a9465a5ed781ff70e0c01c87e.exe	102
PID 4396 wrote to memory of 4948	4396	944bd716640aff6aa33fba92ce2b0ca69cbc2e0a9465a5ed781ff70e0c01c87e.exe	102
PID 4396 wrote to memory of 2308	4396	944bd716640aff6aa33fba92ce2b0ca69cbc2e0a9465a5ed781ff70e0c01c87e.exe	103
PID 4396 wrote to memory of 2308	4396	944bd716640aff6aa33fba92ce2b0ca69cbc2e0a9465a5ed781ff70e0c01c87e.exe	103
PID 4396 wrote to memory of 4488	4396	944bd716640aff6aa33fba92ce2b0ca69cbc2e0a9465a5ed781ff70e0c01c87e.exe	104
PID 4396 wrote to memory of 4488	4396	944bd716640aff6aa33fba92ce2b0ca69cbc2e0a9465a5ed781ff70e0c01c87e.exe	104
PID 4396 wrote to memory of 3008	4396	944bd716640aff6aa33fba92ce2b0ca69cbc2e0a9465a5ed781ff70e0c01c87e.exe	105
PID 4396 wrote to memory of 3008	4396	944bd716640aff6aa33fba92ce2b0ca69cbc2e0a9465a5ed781ff70e0c01c87e.exe	105
PID 4396 wrote to memory of 4912	4396	944bd716640aff6aa33fba92ce2b0ca69cbc2e0a9465a5ed781ff70e0c01c87e.exe	106
PID 4396 wrote to memory of 4912	4396	944bd716640aff6aa33fba92ce2b0ca69cbc2e0a9465a5ed781ff70e0c01c87e.exe	106
PID 4396 wrote to memory of 5052	4396	944bd716640aff6aa33fba92ce2b0ca69cbc2e0a9465a5ed781ff70e0c01c87e.exe	107
PID 4396 wrote to memory of 5052	4396	944bd716640aff6aa33fba92ce2b0ca69cbc2e0a9465a5ed781ff70e0c01c87e.exe	107
PID 4396 wrote to memory of 4416	4396	944bd716640aff6aa33fba92ce2b0ca69cbc2e0a9465a5ed781ff70e0c01c87e.exe	108
PID 4396 wrote to memory of 4416	4396	944bd716640aff6aa33fba92ce2b0ca69cbc2e0a9465a5ed781ff70e0c01c87e.exe	108
PID 4396 wrote to memory of 4440	4396	944bd716640aff6aa33fba92ce2b0ca69cbc2e0a9465a5ed781ff70e0c01c87e.exe	109
PID 4396 wrote to memory of 4440	4396	944bd716640aff6aa33fba92ce2b0ca69cbc2e0a9465a5ed781ff70e0c01c87e.exe	109
PID 4396 wrote to memory of 2840	4396	944bd716640aff6aa33fba92ce2b0ca69cbc2e0a9465a5ed781ff70e0c01c87e.exe	110
PID 4396 wrote to memory of 2840	4396	944bd716640aff6aa33fba92ce2b0ca69cbc2e0a9465a5ed781ff70e0c01c87e.exe	110
PID 4396 wrote to memory of 2520	4396	944bd716640aff6aa33fba92ce2b0ca69cbc2e0a9465a5ed781ff70e0c01c87e.exe	111
PID 4396 wrote to memory of 2520	4396	944bd716640aff6aa33fba92ce2b0ca69cbc2e0a9465a5ed781ff70e0c01c87e.exe	111
PID 4396 wrote to memory of 3208	4396	944bd716640aff6aa33fba92ce2b0ca69cbc2e0a9465a5ed781ff70e0c01c87e.exe	112
PID 4396 wrote to memory of 3208	4396	944bd716640aff6aa33fba92ce2b0ca69cbc2e0a9465a5ed781ff70e0c01c87e.exe	112
PID 4396 wrote to memory of 2008	4396	944bd716640aff6aa33fba92ce2b0ca69cbc2e0a9465a5ed781ff70e0c01c87e.exe	113
PID 4396 wrote to memory of 2008	4396	944bd716640aff6aa33fba92ce2b0ca69cbc2e0a9465a5ed781ff70e0c01c87e.exe	113
PID 4396 wrote to memory of 2192	4396	944bd716640aff6aa33fba92ce2b0ca69cbc2e0a9465a5ed781ff70e0c01c87e.exe	114
PID 4396 wrote to memory of 2192	4396	944bd716640aff6aa33fba92ce2b0ca69cbc2e0a9465a5ed781ff70e0c01c87e.exe	114
PID 4396 wrote to memory of 1948	4396	944bd716640aff6aa33fba92ce2b0ca69cbc2e0a9465a5ed781ff70e0c01c87e.exe	115
PID 4396 wrote to memory of 1948	4396	944bd716640aff6aa33fba92ce2b0ca69cbc2e0a9465a5ed781ff70e0c01c87e.exe	115

C:\Users\Admin\AppData\Local\Temp\944bd716640aff6aa33fba92ce2b0ca69cbc2e0a9465a5ed781ff70e0c01c87e.exe
"C:\Users\Admin\AppData\Local\Temp\944bd716640aff6aa33fba92ce2b0ca69cbc2e0a9465a5ed781ff70e0c01c87e.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4396
- C:\Windows\System\BeApmxM.exe
  C:\Windows\System\BeApmxM.exe
  2⤵
  - Executes dropped EXE
  PID:1356
- C:\Windows\System\UAmjpfl.exe
  C:\Windows\System\UAmjpfl.exe
  2⤵
  - Executes dropped EXE
  PID:1824
- C:\Windows\System\zVFGtre.exe
  C:\Windows\System\zVFGtre.exe
  2⤵
  - Executes dropped EXE
  PID:1524
- C:\Windows\System\WKxpvCM.exe
  C:\Windows\System\WKxpvCM.exe
  2⤵
  - Executes dropped EXE
  PID:2648
- C:\Windows\System\IIdhJtB.exe
  C:\Windows\System\IIdhJtB.exe
  2⤵
  - Executes dropped EXE
  PID:3600
- C:\Windows\System\XEgGLko.exe
  C:\Windows\System\XEgGLko.exe
  2⤵
  - Executes dropped EXE
  PID:2272
- C:\Windows\System\mbGUCJK.exe
  C:\Windows\System\mbGUCJK.exe
  2⤵
  - Executes dropped EXE
  PID:1740
- C:\Windows\System\ohoQlgD.exe
  C:\Windows\System\ohoQlgD.exe
  2⤵
  - Executes dropped EXE
  PID:3040
- C:\Windows\System\fERRCvR.exe
  C:\Windows\System\fERRCvR.exe
  2⤵
  - Executes dropped EXE
  PID:4748
- C:\Windows\System\eZaLndx.exe
  C:\Windows\System\eZaLndx.exe
  2⤵
  - Executes dropped EXE
  PID:3332
- C:\Windows\System\AOBzlUE.exe
  C:\Windows\System\AOBzlUE.exe
  2⤵
  - Executes dropped EXE
  PID:4140
- C:\Windows\System\mCEklwZ.exe
  C:\Windows\System\mCEklwZ.exe
  2⤵
  - Executes dropped EXE
  PID:4816
- C:\Windows\System\BOWCCnN.exe
  C:\Windows\System\BOWCCnN.exe
  2⤵
  - Executes dropped EXE
  PID:4532
- C:\Windows\System\XsYMOEa.exe
  C:\Windows\System\XsYMOEa.exe
  2⤵
  - Executes dropped EXE
  PID:3500
- C:\Windows\System\QZUtuSG.exe
  C:\Windows\System\QZUtuSG.exe
  2⤵
  - Executes dropped EXE
  PID:4340
- C:\Windows\System\jETMlwI.exe
  C:\Windows\System\jETMlwI.exe
  2⤵
  - Executes dropped EXE
  PID:2996
- C:\Windows\System\oRvTpjJ.exe
  C:\Windows\System\oRvTpjJ.exe
  2⤵
  - Executes dropped EXE
  PID:3984
- C:\Windows\System\uCFAkQh.exe
  C:\Windows\System\uCFAkQh.exe
  2⤵
  - Executes dropped EXE
  PID:796
- C:\Windows\System\GCpTxLY.exe
  C:\Windows\System\GCpTxLY.exe
  2⤵
  - Executes dropped EXE
  PID:4948
- C:\Windows\System\VvJSAfw.exe
  C:\Windows\System\VvJSAfw.exe
  2⤵
  - Executes dropped EXE
  PID:2308
- C:\Windows\System\FosWSzl.exe
  C:\Windows\System\FosWSzl.exe
  2⤵
  - Executes dropped EXE
  PID:4488
- C:\Windows\System\tFsdxrk.exe
  C:\Windows\System\tFsdxrk.exe
  2⤵
  - Executes dropped EXE
  PID:3008
- C:\Windows\System\jgDuZSv.exe
  C:\Windows\System\jgDuZSv.exe
  2⤵
  - Executes dropped EXE
  PID:4912
- C:\Windows\System\rKvnnIQ.exe
  C:\Windows\System\rKvnnIQ.exe
  2⤵
  - Executes dropped EXE
  PID:5052
- C:\Windows\System\NBEcdHa.exe
  C:\Windows\System\NBEcdHa.exe
  2⤵
  - Executes dropped EXE
  PID:4416
- C:\Windows\System\nxEZJjP.exe
  C:\Windows\System\nxEZJjP.exe
  2⤵
  - Executes dropped EXE
  PID:4440
- C:\Windows\System\rXRQSti.exe
  C:\Windows\System\rXRQSti.exe
  2⤵
  - Executes dropped EXE
  PID:2840
- C:\Windows\System\xjzDqcL.exe
  C:\Windows\System\xjzDqcL.exe
  2⤵
  - Executes dropped EXE
  PID:2520
- C:\Windows\System\mEYKkNW.exe
  C:\Windows\System\mEYKkNW.exe
  2⤵
  - Executes dropped EXE
  PID:3208
- C:\Windows\System\sovCFhV.exe
  C:\Windows\System\sovCFhV.exe
  2⤵
  - Executes dropped EXE
  PID:2008
- C:\Windows\System\EijFyme.exe
  C:\Windows\System\EijFyme.exe
  2⤵
  - Executes dropped EXE
  PID:2192
- C:\Windows\System\XZMKoJp.exe
  C:\Windows\System\XZMKoJp.exe
  2⤵
  - Executes dropped EXE
  PID:1948
- C:\Windows\System\FSHNuLD.exe
  C:\Windows\System\FSHNuLD.exe
  2⤵
  - Executes dropped EXE
  PID:3000
- C:\Windows\System\FVvmmzO.exe
  C:\Windows\System\FVvmmzO.exe
  2⤵
  - Executes dropped EXE
  PID:3840
- C:\Windows\System\GYDVOZG.exe
  C:\Windows\System\GYDVOZG.exe
  2⤵
  - Executes dropped EXE
  PID:1848
- C:\Windows\System\cmOajUb.exe
  C:\Windows\System\cmOajUb.exe
  2⤵
  - Executes dropped EXE
  PID:5024
- C:\Windows\System\RsyZSRs.exe
  C:\Windows\System\RsyZSRs.exe
  2⤵
  - Executes dropped EXE
  PID:756
- C:\Windows\System\jvUmYUL.exe
  C:\Windows\System\jvUmYUL.exe
  2⤵
  - Executes dropped EXE
  PID:264
- C:\Windows\System\xHLgape.exe
  C:\Windows\System\xHLgape.exe
  2⤵
  - Executes dropped EXE
  PID:4196
- C:\Windows\System\bdPqMXW.exe
  C:\Windows\System\bdPqMXW.exe
  2⤵
  - Executes dropped EXE
  PID:4288
- C:\Windows\System\ODxkVmh.exe
  C:\Windows\System\ODxkVmh.exe
  2⤵
  - Executes dropped EXE
  PID:3432
- C:\Windows\System\VXzDExa.exe
  C:\Windows\System\VXzDExa.exe
  2⤵
  - Executes dropped EXE
  PID:3552
- C:\Windows\System\ygevrbl.exe
  C:\Windows\System\ygevrbl.exe
  2⤵
  - Executes dropped EXE
  PID:2728
- C:\Windows\System\zEjYfxc.exe
  C:\Windows\System\zEjYfxc.exe
  2⤵
  - Executes dropped EXE
  PID:3516
- C:\Windows\System\jBirOnF.exe
  C:\Windows\System\jBirOnF.exe
  2⤵
  - Executes dropped EXE
  PID:3952
- C:\Windows\System\JYsdlzS.exe
  C:\Windows\System\JYsdlzS.exe
  2⤵
  - Executes dropped EXE
  PID:1360
- C:\Windows\System\UfzvXRp.exe
  C:\Windows\System\UfzvXRp.exe
  2⤵
  - Executes dropped EXE
  PID:3416
- C:\Windows\System\ufzcytJ.exe
  C:\Windows\System\ufzcytJ.exe
  2⤵
  - Executes dropped EXE
  PID:5044
- C:\Windows\System\akFmyTx.exe
  C:\Windows\System\akFmyTx.exe
  2⤵
  - Executes dropped EXE
  PID:2300
- C:\Windows\System\voxnWLI.exe
  C:\Windows\System\voxnWLI.exe
  2⤵
  - Executes dropped EXE
  PID:184
- C:\Windows\System\jMXjbZy.exe
  C:\Windows\System\jMXjbZy.exe
  2⤵
  - Executes dropped EXE
  PID:2784
- C:\Windows\System\xQGcCkU.exe
  C:\Windows\System\xQGcCkU.exe
  2⤵
  - Executes dropped EXE
  PID:3364
- C:\Windows\System\nzikHJF.exe
  C:\Windows\System\nzikHJF.exe
  2⤵
  - Executes dropped EXE
  PID:4516
- C:\Windows\System\zvvJnVY.exe
  C:\Windows\System\zvvJnVY.exe
  2⤵
  - Executes dropped EXE
  PID:3076
- C:\Windows\System\dZbVHyA.exe
  C:\Windows\System\dZbVHyA.exe
  2⤵
  - Executes dropped EXE
  PID:2388
- C:\Windows\System\fXiweCv.exe
  C:\Windows\System\fXiweCv.exe
  2⤵
  - Executes dropped EXE
  PID:536
- C:\Windows\System\fFZTXsF.exe
  C:\Windows\System\fFZTXsF.exe
  2⤵
  - Executes dropped EXE
  PID:5016
- C:\Windows\System\hdwtNmA.exe
  C:\Windows\System\hdwtNmA.exe
  2⤵
  - Executes dropped EXE
  PID:2268
- C:\Windows\System\ZLxhrhk.exe
  C:\Windows\System\ZLxhrhk.exe
  2⤵
  - Executes dropped EXE
  PID:3468
- C:\Windows\System\uAcQUjA.exe
  C:\Windows\System\uAcQUjA.exe
  2⤵
  - Executes dropped EXE
  PID:428
- C:\Windows\System\SJvbYQQ.exe
  C:\Windows\System\SJvbYQQ.exe
  2⤵
  - Executes dropped EXE
  PID:636
- C:\Windows\System\oSaptQe.exe
  C:\Windows\System\oSaptQe.exe
  2⤵
  - Executes dropped EXE
  PID:4332
- C:\Windows\System\arFiDep.exe
  C:\Windows\System\arFiDep.exe
  2⤵
  - Executes dropped EXE
  PID:4276
- C:\Windows\System\PTnnxwD.exe
  C:\Windows\System\PTnnxwD.exe
  2⤵
  - Executes dropped EXE
  PID:348
- C:\Windows\System\hBttCpb.exe
  C:\Windows\System\hBttCpb.exe
  2⤵
  PID:1732
- C:\Windows\System\syFWszf.exe
  C:\Windows\System\syFWszf.exe
  2⤵
  PID:412
- C:\Windows\System\MDldJGk.exe
  C:\Windows\System\MDldJGk.exe
  2⤵
  PID:3728
- C:\Windows\System\FytAdOv.exe
  C:\Windows\System\FytAdOv.exe
  2⤵
  PID:4208
- C:\Windows\System\IvQQjSy.exe
  C:\Windows\System\IvQQjSy.exe
  2⤵
  PID:5080
- C:\Windows\System\ABLfwvk.exe
  C:\Windows\System\ABLfwvk.exe
  2⤵
  PID:4540
- C:\Windows\System\sBhEIkz.exe
  C:\Windows\System\sBhEIkz.exe
  2⤵
  PID:4356
- C:\Windows\System\jipuDrG.exe
  C:\Windows\System\jipuDrG.exe
  2⤵
  PID:1908
- C:\Windows\System\GbAhjmP.exe
  C:\Windows\System\GbAhjmP.exe
  2⤵
  PID:3824
- C:\Windows\System\TKzCPKg.exe
  C:\Windows\System\TKzCPKg.exe
  2⤵
  PID:1968
- C:\Windows\System\utvndqh.exe
  C:\Windows\System\utvndqh.exe
  2⤵
  PID:4608
- C:\Windows\System\noUQcNq.exe
  C:\Windows\System\noUQcNq.exe
  2⤵
  PID:3972
- C:\Windows\System\xgXqjal.exe
  C:\Windows\System\xgXqjal.exe
  2⤵
  PID:224
- C:\Windows\System\pZvnECU.exe
  C:\Windows\System\pZvnECU.exe
  2⤵
  PID:2080
- C:\Windows\System\WuHzIJs.exe
  C:\Windows\System\WuHzIJs.exe
  2⤵
  PID:4724
- C:\Windows\System\hjRRlkE.exe
  C:\Windows\System\hjRRlkE.exe
  2⤵
  PID:1568
- C:\Windows\System\iwzhcIP.exe
  C:\Windows\System\iwzhcIP.exe
  2⤵
  PID:1224
- C:\Windows\System\RVBJyMs.exe
  C:\Windows\System\RVBJyMs.exe
  2⤵
  PID:4460
- C:\Windows\System\FgleJCx.exe
  C:\Windows\System\FgleJCx.exe
  2⤵
  PID:1712
- C:\Windows\System\kpOwoqD.exe
  C:\Windows\System\kpOwoqD.exe
  2⤵
  PID:2752
- C:\Windows\System\QXVbpQG.exe
  C:\Windows\System\QXVbpQG.exe
  2⤵
  PID:4484
- C:\Windows\System\DVjDCon.exe
  C:\Windows\System\DVjDCon.exe
  2⤵
  PID:2336
- C:\Windows\System\PiLtQWL.exe
  C:\Windows\System\PiLtQWL.exe
  2⤵
  PID:4368
- C:\Windows\System\awinrwP.exe
  C:\Windows\System\awinrwP.exe
  2⤵
  PID:1068
- C:\Windows\System\lSXSTcT.exe
  C:\Windows\System\lSXSTcT.exe
  2⤵
  PID:852
- C:\Windows\System\JnIyxhP.exe
  C:\Windows\System\JnIyxhP.exe
  2⤵
  PID:4164
- C:\Windows\System\SMaTBBl.exe
  C:\Windows\System\SMaTBBl.exe
  2⤵
  PID:3596
- C:\Windows\System\tysKWDr.exe
  C:\Windows\System\tysKWDr.exe
  2⤵
  PID:4176
- C:\Windows\System\qQWwQRr.exe
  C:\Windows\System\qQWwQRr.exe
  2⤵
  PID:1896
- C:\Windows\System\IFHoTpW.exe
  C:\Windows\System\IFHoTpW.exe
  2⤵
  PID:4076
- C:\Windows\System\sDKMoWa.exe
  C:\Windows\System\sDKMoWa.exe
  2⤵
  PID:4444
- C:\Windows\System\QEOsOFM.exe
  C:\Windows\System\QEOsOFM.exe
  2⤵
  PID:4404
- C:\Windows\System\xfBqTHo.exe
  C:\Windows\System\xfBqTHo.exe
  2⤵
  PID:4296
- C:\Windows\System\eCvKAKv.exe
  C:\Windows\System\eCvKAKv.exe
  2⤵
  PID:3832
- C:\Windows\System\ZGpZUYy.exe
  C:\Windows\System\ZGpZUYy.exe
  2⤵
  PID:2332
- C:\Windows\System\LsyOCYU.exe
  C:\Windows\System\LsyOCYU.exe
  2⤵
  PID:1828
- C:\Windows\System\psKkERf.exe
  C:\Windows\System\psKkERf.exe
  2⤵
  PID:4496
- C:\Windows\System\MVYEijm.exe
  C:\Windows\System\MVYEijm.exe
  2⤵
  PID:4068
- C:\Windows\System\tVxIgRT.exe
  C:\Windows\System\tVxIgRT.exe
  2⤵
  PID:208
- C:\Windows\System\TRaZhaD.exe
  C:\Windows\System\TRaZhaD.exe
  2⤵
  PID:2620
- C:\Windows\System\XvaLODX.exe
  C:\Windows\System\XvaLODX.exe
  2⤵
  PID:2108
- C:\Windows\System\KOZqhAK.exe
  C:\Windows\System\KOZqhAK.exe
  2⤵
  PID:3756
- C:\Windows\System\UVoXLUU.exe
  C:\Windows\System\UVoXLUU.exe
  2⤵
  PID:848
- C:\Windows\System\LjufWzl.exe
  C:\Windows\System\LjufWzl.exe
  2⤵
  PID:4512
- C:\Windows\System\pHJhlSc.exe
  C:\Windows\System\pHJhlSc.exe
  2⤵
  PID:3876
- C:\Windows\System\BFCHmWg.exe
  C:\Windows\System\BFCHmWg.exe
  2⤵
  PID:4464
- C:\Windows\System\bqrmPbh.exe
  C:\Windows\System\bqrmPbh.exe
  2⤵
  PID:5128
- C:\Windows\System\wYRVPfy.exe
  C:\Windows\System\wYRVPfy.exe
  2⤵
  PID:5156
- C:\Windows\System\kZuZHPc.exe
  C:\Windows\System\kZuZHPc.exe
  2⤵
  PID:5188
- C:\Windows\System\kKoZane.exe
  C:\Windows\System\kKoZane.exe
  2⤵
  PID:5224
- C:\Windows\System\kNlwWcl.exe
  C:\Windows\System\kNlwWcl.exe
  2⤵
  PID:5240
- C:\Windows\System\kcEfzuN.exe
  C:\Windows\System\kcEfzuN.exe
  2⤵
  PID:5268
- C:\Windows\System\pfawegH.exe
  C:\Windows\System\pfawegH.exe
  2⤵
  PID:5304
- C:\Windows\System\ZdjAlwE.exe
  C:\Windows\System\ZdjAlwE.exe
  2⤵
  PID:5324
- C:\Windows\System\PsqXavI.exe
  C:\Windows\System\PsqXavI.exe
  2⤵
  PID:5352
- C:\Windows\System\QozaJXd.exe
  C:\Windows\System\QozaJXd.exe
  2⤵
  PID:5372
- C:\Windows\System\bligQee.exe
  C:\Windows\System\bligQee.exe
  2⤵
  PID:5408
- C:\Windows\System\fQgLhXg.exe
  C:\Windows\System\fQgLhXg.exe
  2⤵
  PID:5436
- C:\Windows\System\bmOYTjM.exe
  C:\Windows\System\bmOYTjM.exe
  2⤵
  PID:5452
- C:\Windows\System\EIoNTjg.exe
  C:\Windows\System\EIoNTjg.exe
  2⤵
  PID:5484
- C:\Windows\System\jwYTWgQ.exe
  C:\Windows\System\jwYTWgQ.exe
  2⤵
  PID:5516
- C:\Windows\System\DjFmXBT.exe
  C:\Windows\System\DjFmXBT.exe
  2⤵
  PID:5548
- C:\Windows\System\OSQrvdz.exe
  C:\Windows\System\OSQrvdz.exe
  2⤵
  PID:5576
- C:\Windows\System\DnNNHSk.exe
  C:\Windows\System\DnNNHSk.exe
  2⤵
  PID:5596
- C:\Windows\System\eEXjMcq.exe
  C:\Windows\System\eEXjMcq.exe
  2⤵
  PID:5632
- C:\Windows\System\vKjQhiL.exe
  C:\Windows\System\vKjQhiL.exe
  2⤵
  PID:5660
- C:\Windows\System\MVdPFXg.exe
  C:\Windows\System\MVdPFXg.exe
  2⤵
  PID:5688
- C:\Windows\System\KWmxula.exe
  C:\Windows\System\KWmxula.exe
  2⤵
  PID:5716
- C:\Windows\System\PIkcufy.exe
  C:\Windows\System\PIkcufy.exe
  2⤵
  PID:5752
- C:\Windows\System\VFAqUul.exe
  C:\Windows\System\VFAqUul.exe
  2⤵
  PID:5784
- C:\Windows\System\CfurKlQ.exe
  C:\Windows\System\CfurKlQ.exe
  2⤵
  PID:5800
- C:\Windows\System\NFOnuvi.exe
  C:\Windows\System\NFOnuvi.exe
  2⤵
  PID:5816
- C:\Windows\System\BDEKnVZ.exe
  C:\Windows\System\BDEKnVZ.exe
  2⤵
  PID:5840
- C:\Windows\System\USAYxzE.exe
  C:\Windows\System\USAYxzE.exe
  2⤵
  PID:5872
- C:\Windows\System\IjhzqZZ.exe
  C:\Windows\System\IjhzqZZ.exe
  2⤵
  PID:5896
- C:\Windows\System\xzOuSsY.exe
  C:\Windows\System\xzOuSsY.exe
  2⤵
  PID:5932
- C:\Windows\System\oyMJdSr.exe
  C:\Windows\System\oyMJdSr.exe
  2⤵
  PID:5960
- C:\Windows\System\nxRQcOO.exe
  C:\Windows\System\nxRQcOO.exe
  2⤵
  PID:5984
- C:\Windows\System\GnILyLm.exe
  C:\Windows\System\GnILyLm.exe
  2⤵
  PID:6000
- C:\Windows\System\CRuCXkG.exe
  C:\Windows\System\CRuCXkG.exe
  2⤵
  PID:6024
- C:\Windows\System\kHhwXkY.exe
  C:\Windows\System\kHhwXkY.exe
  2⤵
  PID:6052
- C:\Windows\System\AqxdFdZ.exe
  C:\Windows\System\AqxdFdZ.exe
  2⤵
  PID:6080
- C:\Windows\System\nIBdWBj.exe
  C:\Windows\System\nIBdWBj.exe
  2⤵
  PID:6108
- C:\Windows\System\LQBVGnS.exe
  C:\Windows\System\LQBVGnS.exe
  2⤵
  PID:6140
- C:\Windows\System\iAGHaCZ.exe
  C:\Windows\System\iAGHaCZ.exe
  2⤵
  PID:5144
- C:\Windows\System\aqXLNLp.exe
  C:\Windows\System\aqXLNLp.exe
  2⤵
  PID:5212
- C:\Windows\System\ciRivpw.exe
  C:\Windows\System\ciRivpw.exe
  2⤵
  PID:5320
- C:\Windows\System\gYJmpVs.exe
  C:\Windows\System\gYJmpVs.exe
  2⤵
  PID:5336
- C:\Windows\System\znMScIY.exe
  C:\Windows\System\znMScIY.exe
  2⤵
  PID:5428
- C:\Windows\System\icYbtgp.exe
  C:\Windows\System\icYbtgp.exe
  2⤵
  PID:5464
- C:\Windows\System\UkwKyHa.exe
  C:\Windows\System\UkwKyHa.exe
  2⤵
  PID:5508
- C:\Windows\System\NKLaxcH.exe
  C:\Windows\System\NKLaxcH.exe
  2⤵
  PID:5532
- C:\Windows\System\hxGJMGm.exe
  C:\Windows\System\hxGJMGm.exe
  2⤵
  PID:5616
- C:\Windows\System\lrFfcLc.exe
  C:\Windows\System\lrFfcLc.exe
  2⤵
  PID:5672
- C:\Windows\System\gQuJJVi.exe
  C:\Windows\System\gQuJJVi.exe
  2⤵
  PID:5760
- C:\Windows\System\sVNqlmy.exe
  C:\Windows\System\sVNqlmy.exe
  2⤵
  PID:5776
- C:\Windows\System\zYBpfhN.exe
  C:\Windows\System\zYBpfhN.exe
  2⤵
  PID:5836
- C:\Windows\System\ziYnreb.exe
  C:\Windows\System\ziYnreb.exe
  2⤵
  PID:5908
- C:\Windows\System\PPnqQNG.exe
  C:\Windows\System\PPnqQNG.exe
  2⤵
  PID:5976
- C:\Windows\System\YPRUoeN.exe
  C:\Windows\System\YPRUoeN.exe
  2⤵
  PID:6012
- C:\Windows\System\LTmLgRk.exe
  C:\Windows\System\LTmLgRk.exe
  2⤵
  PID:6048
- C:\Windows\System\GROYEwN.exe
  C:\Windows\System\GROYEwN.exe
  2⤵
  PID:6064
- C:\Windows\System\XMVZqPl.exe
  C:\Windows\System\XMVZqPl.exe
  2⤵
  PID:5232
- C:\Windows\System\fvxFnaD.exe
  C:\Windows\System\fvxFnaD.exe
  2⤵
  PID:5340
- C:\Windows\System\FQBrxfd.exe
  C:\Windows\System\FQBrxfd.exe
  2⤵
  PID:5444
- C:\Windows\System\WGCTvXD.exe
  C:\Windows\System\WGCTvXD.exe
  2⤵
  PID:5780
- C:\Windows\System\JUuXtZw.exe
  C:\Windows\System\JUuXtZw.exe
  2⤵
  PID:5996
- C:\Windows\System\rSwwYUS.exe
  C:\Windows\System\rSwwYUS.exe
  2⤵
  PID:6072
- C:\Windows\System\RkwCetu.exe
  C:\Windows\System\RkwCetu.exe
  2⤵
  PID:5528
- C:\Windows\System\DSXfmfS.exe
  C:\Windows\System\DSXfmfS.exe
  2⤵
  PID:5644
- C:\Windows\System\zthSaBJ.exe
  C:\Windows\System\zthSaBJ.exe
  2⤵
  PID:5296
- C:\Windows\System\xzqphep.exe
  C:\Windows\System\xzqphep.exe
  2⤵
  PID:6184
- C:\Windows\System\bmxVbib.exe
  C:\Windows\System\bmxVbib.exe
  2⤵
  PID:6216
- C:\Windows\System\xjmLXpK.exe
  C:\Windows\System\xjmLXpK.exe
  2⤵
  PID:6252
- C:\Windows\System\PMjIVoL.exe
  C:\Windows\System\PMjIVoL.exe
  2⤵
  PID:6288
- C:\Windows\System\AxMczuO.exe
  C:\Windows\System\AxMczuO.exe
  2⤵
  PID:6324
- C:\Windows\System\yqrcXkI.exe
  C:\Windows\System\yqrcXkI.exe
  2⤵
  PID:6356
- C:\Windows\System\JhkZWDN.exe
  C:\Windows\System\JhkZWDN.exe
  2⤵
  PID:6380
- C:\Windows\System\nsLaAEV.exe
  C:\Windows\System\nsLaAEV.exe
  2⤵
  PID:6412
- C:\Windows\System\brcHesG.exe
  C:\Windows\System\brcHesG.exe
  2⤵
  PID:6436
- C:\Windows\System\bXavxAL.exe
  C:\Windows\System\bXavxAL.exe
  2⤵
  PID:6460
- C:\Windows\System\AbJPiZL.exe
  C:\Windows\System\AbJPiZL.exe
  2⤵
  PID:6500
- C:\Windows\System\xDHCcXm.exe
  C:\Windows\System\xDHCcXm.exe
  2⤵
  PID:6528
- C:\Windows\System\jdGYqpU.exe
  C:\Windows\System\jdGYqpU.exe
  2⤵
  PID:6552
- C:\Windows\System\Epmieli.exe
  C:\Windows\System\Epmieli.exe
  2⤵
  PID:6584
- C:\Windows\System\jdaYPgN.exe
  C:\Windows\System\jdaYPgN.exe
  2⤵
  PID:6612
- C:\Windows\System\zuKZKot.exe
  C:\Windows\System\zuKZKot.exe
  2⤵
  PID:6644
- C:\Windows\System\uuIKjBS.exe
  C:\Windows\System\uuIKjBS.exe
  2⤵
  PID:6664
- C:\Windows\System\QAsHSqy.exe
  C:\Windows\System\QAsHSqy.exe
  2⤵
  PID:6680
- C:\Windows\System\BdFaCbK.exe
  C:\Windows\System\BdFaCbK.exe
  2⤵
  PID:6704
- C:\Windows\System\cNVpDPW.exe
  C:\Windows\System\cNVpDPW.exe
  2⤵
  PID:6732
- C:\Windows\System\DYebWip.exe
  C:\Windows\System\DYebWip.exe
  2⤵
  PID:6760
- C:\Windows\System\xlYaalk.exe
  C:\Windows\System\xlYaalk.exe
  2⤵
  PID:6788
- C:\Windows\System\cfnqGjl.exe
  C:\Windows\System\cfnqGjl.exe
  2⤵
  PID:6816
- C:\Windows\System\CKWGPhF.exe
  C:\Windows\System\CKWGPhF.exe
  2⤵
  PID:6852
- C:\Windows\System\aPoIjnx.exe
  C:\Windows\System\aPoIjnx.exe
  2⤵
  PID:6888
- C:\Windows\System\qMqNnhv.exe
  C:\Windows\System\qMqNnhv.exe
  2⤵
  PID:6924
- C:\Windows\System\kEVtnsf.exe
  C:\Windows\System\kEVtnsf.exe
  2⤵
  PID:6988
- C:\Windows\System\AkjCNRS.exe
  C:\Windows\System\AkjCNRS.exe
  2⤵
  PID:7004
- C:\Windows\System\RXXJryh.exe
  C:\Windows\System\RXXJryh.exe
  2⤵
  PID:7028
- C:\Windows\System\yRZcFis.exe
  C:\Windows\System\yRZcFis.exe
  2⤵
  PID:7044
- C:\Windows\System\smQDUBh.exe
  C:\Windows\System\smQDUBh.exe
  2⤵
  PID:7076
- C:\Windows\System\uVfYasQ.exe
  C:\Windows\System\uVfYasQ.exe
  2⤵
  PID:7104
- C:\Windows\System\nGYiyRi.exe
  C:\Windows\System\nGYiyRi.exe
  2⤵
  PID:7136
- C:\Windows\System\kjyRQmd.exe
  C:\Windows\System\kjyRQmd.exe
  2⤵
  PID:6092
- C:\Windows\System\OJuNlCI.exe
  C:\Windows\System\OJuNlCI.exe
  2⤵
  PID:6180
- C:\Windows\System\cLJHIFI.exe
  C:\Windows\System\cLJHIFI.exe
  2⤵
  PID:6156
- C:\Windows\System\wAbjkPR.exe
  C:\Windows\System\wAbjkPR.exe
  2⤵
  PID:6276
- C:\Windows\System\fcDfnkr.exe
  C:\Windows\System\fcDfnkr.exe
  2⤵
  PID:6336
- C:\Windows\System\CgmdksE.exe
  C:\Windows\System\CgmdksE.exe
  2⤵
  PID:6388
- C:\Windows\System\OKlYwLM.exe
  C:\Windows\System\OKlYwLM.exe
  2⤵
  PID:6448
- C:\Windows\System\NyZVUvL.exe
  C:\Windows\System\NyZVUvL.exe
  2⤵
  PID:6544
- C:\Windows\System\KhjTwWW.exe
  C:\Windows\System\KhjTwWW.exe
  2⤵
  PID:6608
- C:\Windows\System\TcNTbop.exe
  C:\Windows\System\TcNTbop.exe
  2⤵
  PID:6692
- C:\Windows\System\qClEocG.exe
  C:\Windows\System\qClEocG.exe
  2⤵
  PID:6728
- C:\Windows\System\nXoUPng.exe
  C:\Windows\System\nXoUPng.exe
  2⤵
  PID:6756
- C:\Windows\System\PahqKTL.exe
  C:\Windows\System\PahqKTL.exe
  2⤵
  PID:6828
- C:\Windows\System\IGRotkZ.exe
  C:\Windows\System\IGRotkZ.exe
  2⤵
  PID:6912
- C:\Windows\System\SiNEhiu.exe
  C:\Windows\System\SiNEhiu.exe
  2⤵
  PID:4452
- C:\Windows\System\rWYfpfF.exe
  C:\Windows\System\rWYfpfF.exe
  2⤵
  PID:7000
- C:\Windows\System\SSHyLCH.exe
  C:\Windows\System\SSHyLCH.exe
  2⤵
  PID:7068
- C:\Windows\System\nAwGfzc.exe
  C:\Windows\System\nAwGfzc.exe
  2⤵
  PID:7128
- C:\Windows\System\oXpOsSf.exe
  C:\Windows\System\oXpOsSf.exe
  2⤵
  PID:6200
- C:\Windows\System\avePaPa.exe
  C:\Windows\System\avePaPa.exe
  2⤵
  PID:6432
- C:\Windows\System\FVyCFpb.exe
  C:\Windows\System\FVyCFpb.exe
  2⤵
  PID:6536
- C:\Windows\System\iEfVYtP.exe
  C:\Windows\System\iEfVYtP.exe
  2⤵
  PID:6656
- C:\Windows\System\drwnKhK.exe
  C:\Windows\System\drwnKhK.exe
  2⤵
  PID:6848
- C:\Windows\System\qFBzWCd.exe
  C:\Windows\System\qFBzWCd.exe
  2⤵
  PID:6968
- C:\Windows\System\IBbdoND.exe
  C:\Windows\System\IBbdoND.exe
  2⤵
  PID:5700
- C:\Windows\System\OCDJiPH.exe
  C:\Windows\System\OCDJiPH.exe
  2⤵
  PID:6676
- C:\Windows\System\dWlKEvv.exe
  C:\Windows\System\dWlKEvv.exe
  2⤵
  PID:7148
- C:\Windows\System\NOEyUDM.exe
  C:\Windows\System\NOEyUDM.exe
  2⤵
  PID:7180
- C:\Windows\System\FLPvMed.exe
  C:\Windows\System\FLPvMed.exe
  2⤵
  PID:7204
- C:\Windows\System\qrNglsd.exe
  C:\Windows\System\qrNglsd.exe
  2⤵
  PID:7232
- C:\Windows\System\HBdgsht.exe
  C:\Windows\System\HBdgsht.exe
  2⤵
  PID:7260
- C:\Windows\System\JpYFVqn.exe
  C:\Windows\System\JpYFVqn.exe
  2⤵
  PID:7288
- C:\Windows\System\vRfzuYL.exe
  C:\Windows\System\vRfzuYL.exe
  2⤵
  PID:7320
- C:\Windows\System\cehhqWE.exe
  C:\Windows\System\cehhqWE.exe
  2⤵
  PID:7348
- C:\Windows\System\izhAWMa.exe
  C:\Windows\System\izhAWMa.exe
  2⤵
  PID:7372
- C:\Windows\System\qrCzCaP.exe
  C:\Windows\System\qrCzCaP.exe
  2⤵
  PID:7400
- C:\Windows\System\rvEXJNy.exe
  C:\Windows\System\rvEXJNy.exe
  2⤵
  PID:7436
- C:\Windows\System\thMTuMS.exe
  C:\Windows\System\thMTuMS.exe
  2⤵
  PID:7464
- C:\Windows\System\zcSrZCp.exe
  C:\Windows\System\zcSrZCp.exe
  2⤵
  PID:7480
- C:\Windows\System\KFSIvGk.exe
  C:\Windows\System\KFSIvGk.exe
  2⤵
  PID:7500
- C:\Windows\System\klcrIrI.exe
  C:\Windows\System\klcrIrI.exe
  2⤵
  PID:7520
- C:\Windows\System\oAhYNvl.exe
  C:\Windows\System\oAhYNvl.exe
  2⤵
  PID:7548
- C:\Windows\System\uWBwyvq.exe
  C:\Windows\System\uWBwyvq.exe
  2⤵
  PID:7580
- C:\Windows\System\MCeFnyJ.exe
  C:\Windows\System\MCeFnyJ.exe
  2⤵
  PID:7608
- C:\Windows\System\LBbdyva.exe
  C:\Windows\System\LBbdyva.exe
  2⤵
  PID:7644
- C:\Windows\System\YYJUHyi.exe
  C:\Windows\System\YYJUHyi.exe
  2⤵
  PID:7672
- C:\Windows\System\tKCcwof.exe
  C:\Windows\System\tKCcwof.exe
  2⤵
  PID:7704
- C:\Windows\System\FkTDTwn.exe
  C:\Windows\System\FkTDTwn.exe
  2⤵
  PID:7732
- C:\Windows\System\HsvQuaB.exe
  C:\Windows\System\HsvQuaB.exe
  2⤵
  PID:7772
- C:\Windows\System\jnYUxMy.exe
  C:\Windows\System\jnYUxMy.exe
  2⤵
  PID:7796
- C:\Windows\System\eIuryVL.exe
  C:\Windows\System\eIuryVL.exe
  2⤵
  PID:7828
- C:\Windows\System\yqAvRDI.exe
  C:\Windows\System\yqAvRDI.exe
  2⤵
  PID:7852
- C:\Windows\System\rDoJrEU.exe
  C:\Windows\System\rDoJrEU.exe
  2⤵
  PID:7876
- C:\Windows\System\QJUEQya.exe
  C:\Windows\System\QJUEQya.exe
  2⤵
  PID:7904
- C:\Windows\System\rasQvDi.exe
  C:\Windows\System\rasQvDi.exe
  2⤵
  PID:7940
- C:\Windows\System\KYphQsC.exe
  C:\Windows\System\KYphQsC.exe
  2⤵
  PID:7968
- C:\Windows\System\QtzGFlt.exe
  C:\Windows\System\QtzGFlt.exe
  2⤵
  PID:7984
- C:\Windows\System\DcvCDvD.exe
  C:\Windows\System\DcvCDvD.exe
  2⤵
  PID:8000
- C:\Windows\System\IXahUhe.exe
  C:\Windows\System\IXahUhe.exe
  2⤵
  PID:8024
- C:\Windows\System\JTSKTbT.exe
  C:\Windows\System\JTSKTbT.exe
  2⤵
  PID:8056
- C:\Windows\System\fwWnliy.exe
  C:\Windows\System\fwWnliy.exe
  2⤵
  PID:8084
- C:\Windows\System\FMuHeXP.exe
  C:\Windows\System\FMuHeXP.exe
  2⤵
  PID:8116
- C:\Windows\System\PXYTycq.exe
  C:\Windows\System\PXYTycq.exe
  2⤵
  PID:8140
- C:\Windows\System\CRyyqTU.exe
  C:\Windows\System\CRyyqTU.exe
  2⤵
  PID:8156
- C:\Windows\System\ccpskbT.exe
  C:\Windows\System\ccpskbT.exe
  2⤵
  PID:6976
- C:\Windows\System\XPTMilN.exe
  C:\Windows\System\XPTMilN.exe
  2⤵
  PID:7192
- C:\Windows\System\pYVFoRH.exe
  C:\Windows\System\pYVFoRH.exe
  2⤵
  PID:7248
- C:\Windows\System\OIOSNGs.exe
  C:\Windows\System\OIOSNGs.exe
  2⤵
  PID:7304
- C:\Windows\System\bLouinz.exe
  C:\Windows\System\bLouinz.exe
  2⤵
  PID:7384
- C:\Windows\System\rmXwNZn.exe
  C:\Windows\System\rmXwNZn.exe
  2⤵
  PID:7476
- C:\Windows\System\ijvAlbw.exe
  C:\Windows\System\ijvAlbw.exe
  2⤵
  PID:7536
- C:\Windows\System\pcUDzxY.exe
  C:\Windows\System\pcUDzxY.exe
  2⤵
  PID:7620
- C:\Windows\System\SrMrLrD.exe
  C:\Windows\System\SrMrLrD.exe
  2⤵
  PID:7660
- C:\Windows\System\zWlESpv.exe
  C:\Windows\System\zWlESpv.exe
  2⤵
  PID:7716
- C:\Windows\System\SbvWuzb.exe
  C:\Windows\System\SbvWuzb.exe
  2⤵
  PID:7792
- C:\Windows\System\agjDsag.exe
  C:\Windows\System\agjDsag.exe
  2⤵
  PID:7864
- C:\Windows\System\oNkOZNi.exe
  C:\Windows\System\oNkOZNi.exe
  2⤵
  PID:7912
- C:\Windows\System\TJnHkHX.exe
  C:\Windows\System\TJnHkHX.exe
  2⤵
  PID:7996
- C:\Windows\System\cFlIVeW.exe
  C:\Windows\System\cFlIVeW.exe
  2⤵
  PID:8076
- C:\Windows\System\FsvwyZj.exe
  C:\Windows\System\FsvwyZj.exe
  2⤵
  PID:8096
- C:\Windows\System\JhnopKg.exe
  C:\Windows\System\JhnopKg.exe
  2⤵
  PID:8180
- C:\Windows\System\mlhSxMw.exe
  C:\Windows\System\mlhSxMw.exe
  2⤵
  PID:7448
- C:\Windows\System\MZvGmYq.exe
  C:\Windows\System\MZvGmYq.exe
  2⤵
  PID:6392
- C:\Windows\System\dnckHur.exe
  C:\Windows\System\dnckHur.exe
  2⤵
  PID:7588
- C:\Windows\System\GpGgGGg.exe
  C:\Windows\System\GpGgGGg.exe
  2⤵
  PID:7600
- C:\Windows\System\mpdvUfW.exe
  C:\Windows\System\mpdvUfW.exe
  2⤵
  PID:7956
- C:\Windows\System\ZTlceQH.exe
  C:\Windows\System\ZTlceQH.exe
  2⤵
  PID:8064
- C:\Windows\System\DJVmWIl.exe
  C:\Windows\System\DJVmWIl.exe
  2⤵
  PID:8068
- C:\Windows\System\syDQuVx.exe
  C:\Windows\System\syDQuVx.exe
  2⤵
  PID:7560
- C:\Windows\System\oIlmmTs.exe
  C:\Windows\System\oIlmmTs.exe
  2⤵
  PID:7892
- C:\Windows\System\hLjFMSA.exe
  C:\Windows\System\hLjFMSA.exe
  2⤵
  PID:7976
- C:\Windows\System\kXGKolC.exe
  C:\Windows\System\kXGKolC.exe
  2⤵
  PID:8196
- C:\Windows\System\EZbTEDf.exe
  C:\Windows\System\EZbTEDf.exe
  2⤵
  PID:8216
- C:\Windows\System\VmGTbjw.exe
  C:\Windows\System\VmGTbjw.exe
  2⤵
  PID:8232
- C:\Windows\System\JWrENQl.exe
  C:\Windows\System\JWrENQl.exe
  2⤵
  PID:8268
- C:\Windows\System\YuWZlyi.exe
  C:\Windows\System\YuWZlyi.exe
  2⤵
  PID:8292
- C:\Windows\System\IUTvssi.exe
  C:\Windows\System\IUTvssi.exe
  2⤵
  PID:8312
- C:\Windows\System\bnkCuBg.exe
  C:\Windows\System\bnkCuBg.exe
  2⤵
  PID:8336
- C:\Windows\System\wDYUotM.exe
  C:\Windows\System\wDYUotM.exe
  2⤵
  PID:8368
- C:\Windows\System\cBuTlwp.exe
  C:\Windows\System\cBuTlwp.exe
  2⤵
  PID:8404
- C:\Windows\System\WLNbgif.exe
  C:\Windows\System\WLNbgif.exe
  2⤵
  PID:8436
- C:\Windows\System\LJmHmLn.exe
  C:\Windows\System\LJmHmLn.exe
  2⤵
  PID:8464
- C:\Windows\System\VijyNoZ.exe
  C:\Windows\System\VijyNoZ.exe
  2⤵
  PID:8492
- C:\Windows\System\PuMkFYg.exe
  C:\Windows\System\PuMkFYg.exe
  2⤵
  PID:8512
- C:\Windows\System\HgddjCi.exe
  C:\Windows\System\HgddjCi.exe
  2⤵
  PID:8540
- C:\Windows\System\vHtEsSo.exe
  C:\Windows\System\vHtEsSo.exe
  2⤵
  PID:8564
- C:\Windows\System\uNCCRsU.exe
  C:\Windows\System\uNCCRsU.exe
  2⤵
  PID:8600
- C:\Windows\System\xLwHQOu.exe
  C:\Windows\System\xLwHQOu.exe
  2⤵
  PID:8624
- C:\Windows\System\WTsjnRA.exe
  C:\Windows\System\WTsjnRA.exe
  2⤵
  PID:8664
- C:\Windows\System\WoKBaaY.exe
  C:\Windows\System\WoKBaaY.exe
  2⤵
  PID:8700
- C:\Windows\System\YjjZNAB.exe
  C:\Windows\System\YjjZNAB.exe
  2⤵
  PID:8732
- C:\Windows\System\LgOoBpC.exe
  C:\Windows\System\LgOoBpC.exe
  2⤵
  PID:8764
- C:\Windows\System\wpxLWBl.exe
  C:\Windows\System\wpxLWBl.exe
  2⤵
  PID:8796
- C:\Windows\System\DXjFBhZ.exe
  C:\Windows\System\DXjFBhZ.exe
  2⤵
  PID:8836
- C:\Windows\System\kxiVqHp.exe
  C:\Windows\System\kxiVqHp.exe
  2⤵
  PID:8864
- C:\Windows\System\pwMZrFw.exe
  C:\Windows\System\pwMZrFw.exe
  2⤵
  PID:8884
- C:\Windows\System\zpoLybO.exe
  C:\Windows\System\zpoLybO.exe
  2⤵
  PID:8912
- C:\Windows\System\xYQLWcn.exe
  C:\Windows\System\xYQLWcn.exe
  2⤵
  PID:8940
- C:\Windows\System\tOPvycs.exe
  C:\Windows\System\tOPvycs.exe
  2⤵
  PID:8960
- C:\Windows\System\CbfBHdt.exe
  C:\Windows\System\CbfBHdt.exe
  2⤵
  PID:8976
- C:\Windows\System\bPqwzPg.exe
  C:\Windows\System\bPqwzPg.exe
  2⤵
  PID:8996
- C:\Windows\System\RggLclS.exe
  C:\Windows\System\RggLclS.exe
  2⤵
  PID:9028
- C:\Windows\System\HpQsguM.exe
  C:\Windows\System\HpQsguM.exe
  2⤵
  PID:9132
- C:\Windows\System\zQjhjaA.exe
  C:\Windows\System\zQjhjaA.exe
  2⤵
  PID:9148
- C:\Windows\System\INYFrLP.exe
  C:\Windows\System\INYFrLP.exe
  2⤵
  PID:9168
- C:\Windows\System\fnWVgPa.exe
  C:\Windows\System\fnWVgPa.exe
  2⤵
  PID:9192
- C:\Windows\System\iWjcZKs.exe
  C:\Windows\System\iWjcZKs.exe
  2⤵
  PID:8020
- C:\Windows\System\pTgJfFd.exe
  C:\Windows\System\pTgJfFd.exe
  2⤵
  PID:8204
- C:\Windows\System\mBtsIXN.exe
  C:\Windows\System\mBtsIXN.exe
  2⤵
  PID:6940
- C:\Windows\System\ToHXIrY.exe
  C:\Windows\System\ToHXIrY.exe
  2⤵
  PID:8304
- C:\Windows\System\AYNGYrk.exe
  C:\Windows\System\AYNGYrk.exe
  2⤵
  PID:8320
- C:\Windows\System\twTzVjA.exe
  C:\Windows\System\twTzVjA.exe
  2⤵
  PID:8396
- C:\Windows\System\OkBpRbg.exe
  C:\Windows\System\OkBpRbg.exe
  2⤵
  PID:8452
- C:\Windows\System\pRVdaHq.exe
  C:\Windows\System\pRVdaHq.exe
  2⤵
  PID:8536
- C:\Windows\System\GUzKVZB.exe
  C:\Windows\System\GUzKVZB.exe
  2⤵
  PID:8556
- C:\Windows\System\kwECEfk.exe
  C:\Windows\System\kwECEfk.exe
  2⤵
  PID:8616
- C:\Windows\System\Xqjnxvk.exe
  C:\Windows\System\Xqjnxvk.exe
  2⤵
  PID:8584
- C:\Windows\System\ynuLqif.exe
  C:\Windows\System\ynuLqif.exe
  2⤵
  PID:8828
- C:\Windows\System\STMUmiu.exe
  C:\Windows\System\STMUmiu.exe
  2⤵
  PID:8852
- C:\Windows\System\ZeJtUyZ.exe
  C:\Windows\System\ZeJtUyZ.exe
  2⤵
  PID:8920
- C:\Windows\System\kXAapnz.exe
  C:\Windows\System\kXAapnz.exe
  2⤵
  PID:8992
- C:\Windows\System\wkjfKBN.exe
  C:\Windows\System\wkjfKBN.exe
  2⤵
  PID:9012
- C:\Windows\System\oMcObdO.exe
  C:\Windows\System\oMcObdO.exe
  2⤵
  PID:388
- C:\Windows\System\OmeMYDT.exe
  C:\Windows\System\OmeMYDT.exe
  2⤵
  PID:9144
- C:\Windows\System\iRBTysC.exe
  C:\Windows\System\iRBTysC.exe
  2⤵
  PID:9204
- C:\Windows\System\IVmtzCm.exe
  C:\Windows\System\IVmtzCm.exe
  2⤵
  PID:7728
- C:\Windows\System\jdupkyn.exe
  C:\Windows\System\jdupkyn.exe
  2⤵
  PID:8300
- C:\Windows\System\mYZrqct.exe
  C:\Windows\System\mYZrqct.exe
  2⤵
  PID:8448
- C:\Windows\System\OQGmlMv.exe
  C:\Windows\System\OQGmlMv.exe
  2⤵
  PID:8656
- C:\Windows\System\vudEKFx.exe
  C:\Windows\System\vudEKFx.exe
  2⤵
  PID:8688
- C:\Windows\System\lwUasXp.exe
  C:\Windows\System\lwUasXp.exe
  2⤵
  PID:9096
- C:\Windows\System\kjRgPJT.exe
  C:\Windows\System\kjRgPJT.exe
  2⤵
  PID:3548
- C:\Windows\System\qcIJfFs.exe
  C:\Windows\System\qcIJfFs.exe
  2⤵
  PID:8280
- C:\Windows\System\uQOXkdA.exe
  C:\Windows\System\uQOXkdA.exe
  2⤵
  PID:8416
- C:\Windows\System\DOSvVBb.exe
  C:\Windows\System\DOSvVBb.exe
  2⤵
  PID:8956
- C:\Windows\System\EoCDrJD.exe
  C:\Windows\System\EoCDrJD.exe
  2⤵
  PID:8380
- C:\Windows\System\epigAIP.exe
  C:\Windows\System\epigAIP.exe
  2⤵
  PID:8808
- C:\Windows\System\SQJkwkC.exe
  C:\Windows\System\SQJkwkC.exe
  2⤵
  PID:9248
- C:\Windows\System\EQcVOVp.exe
  C:\Windows\System\EQcVOVp.exe
  2⤵
  PID:9272
- C:\Windows\System\mhcEbqo.exe
  C:\Windows\System\mhcEbqo.exe
  2⤵
  PID:9300
- C:\Windows\System\CTcctfu.exe
  C:\Windows\System\CTcctfu.exe
  2⤵
  PID:9332
- C:\Windows\System\NfWHqUa.exe
  C:\Windows\System\NfWHqUa.exe
  2⤵
  PID:9360
- C:\Windows\System\tjuXHfw.exe
  C:\Windows\System\tjuXHfw.exe
  2⤵
  PID:9384
- C:\Windows\System\sQpxKdW.exe
  C:\Windows\System\sQpxKdW.exe
  2⤵
  PID:9416
- C:\Windows\System\tpTVpse.exe
  C:\Windows\System\tpTVpse.exe
  2⤵
  PID:9448
- C:\Windows\System\OaCNMtw.exe
  C:\Windows\System\OaCNMtw.exe
  2⤵
  PID:9480
- C:\Windows\System\UDfixUi.exe
  C:\Windows\System\UDfixUi.exe
  2⤵
  PID:9524
- C:\Windows\System\wVCkBjX.exe
  C:\Windows\System\wVCkBjX.exe
  2⤵
  PID:9540
- C:\Windows\System\XzvZtzj.exe
  C:\Windows\System\XzvZtzj.exe
  2⤵
  PID:9568
- C:\Windows\System\OKuzJlN.exe
  C:\Windows\System\OKuzJlN.exe
  2⤵
  PID:9596
- C:\Windows\System\tOAnJFt.exe
  C:\Windows\System\tOAnJFt.exe
  2⤵
  PID:9624
- C:\Windows\System\fmBLMEv.exe
  C:\Windows\System\fmBLMEv.exe
  2⤵
  PID:9664
- C:\Windows\System\wsOFuMA.exe
  C:\Windows\System\wsOFuMA.exe
  2⤵
  PID:9692
- C:\Windows\System\JEygcGC.exe
  C:\Windows\System\JEygcGC.exe
  2⤵
  PID:9716
- C:\Windows\System\gQLwhuE.exe
  C:\Windows\System\gQLwhuE.exe
  2⤵
  PID:9752
- C:\Windows\System\EDRsgtn.exe
  C:\Windows\System\EDRsgtn.exe
  2⤵
  PID:9784
- C:\Windows\System\hrocRLp.exe
  C:\Windows\System\hrocRLp.exe
  2⤵
  PID:9824
- C:\Windows\System\HuuuuHG.exe
  C:\Windows\System\HuuuuHG.exe
  2⤵
  PID:9860
- C:\Windows\System\VlOOIut.exe
  C:\Windows\System\VlOOIut.exe
  2⤵
  PID:9884
- C:\Windows\System\iTuJhSz.exe
  C:\Windows\System\iTuJhSz.exe
  2⤵
  PID:9908
- C:\Windows\System\OZQYJof.exe
  C:\Windows\System\OZQYJof.exe
  2⤵
  PID:9932
- C:\Windows\System\jPtcSxA.exe
  C:\Windows\System\jPtcSxA.exe
  2⤵
  PID:9960
- C:\Windows\System\EvRYcMt.exe
  C:\Windows\System\EvRYcMt.exe
  2⤵
  PID:9988
- C:\Windows\System\gxdpLIa.exe
  C:\Windows\System\gxdpLIa.exe
  2⤵
  PID:10016
- C:\Windows\System\GqfwDLW.exe
  C:\Windows\System\GqfwDLW.exe
  2⤵
  PID:10040
- C:\Windows\System\CyCsWNf.exe
  C:\Windows\System\CyCsWNf.exe
  2⤵
  PID:10072
- C:\Windows\System\tOTievA.exe
  C:\Windows\System\tOTievA.exe
  2⤵
  PID:10100
- C:\Windows\System\dyuNpoG.exe
  C:\Windows\System\dyuNpoG.exe
  2⤵
  PID:10128
- C:\Windows\System\LMZLOZu.exe
  C:\Windows\System\LMZLOZu.exe
  2⤵
  PID:10156
- C:\Windows\System\vKcdxWB.exe
  C:\Windows\System\vKcdxWB.exe
  2⤵
  PID:10188
- C:\Windows\System\NqBWrHW.exe
  C:\Windows\System\NqBWrHW.exe
  2⤵
  PID:10208
- C:\Windows\System\yfCktET.exe
  C:\Windows\System\yfCktET.exe
  2⤵
  PID:10224
- C:\Windows\System\dvEWDZq.exe
  C:\Windows\System\dvEWDZq.exe
  2⤵
  PID:9232
- C:\Windows\System\HokeAPa.exe
  C:\Windows\System\HokeAPa.exe
  2⤵
  PID:9288
- C:\Windows\System\rnOjmJr.exe
  C:\Windows\System\rnOjmJr.exe
  2⤵
  PID:9316
- C:\Windows\System\JOLygfo.exe
  C:\Windows\System\JOLygfo.exe
  2⤵
  PID:9344
- C:\Windows\System\wvKcOTY.exe
  C:\Windows\System\wvKcOTY.exe
  2⤵
  PID:9444
- C:\Windows\System\ttazeJJ.exe
  C:\Windows\System\ttazeJJ.exe
  2⤵
  PID:9532
- C:\Windows\System\gmyxEbB.exe
  C:\Windows\System\gmyxEbB.exe
  2⤵
  PID:9612
- C:\Windows\System\CWoTmTZ.exe
  C:\Windows\System\CWoTmTZ.exe
  2⤵
  PID:9608
- C:\Windows\System\CCQSqtu.exe
  C:\Windows\System\CCQSqtu.exe
  2⤵
  PID:9704
- C:\Windows\System\wfubAvO.exe
  C:\Windows\System\wfubAvO.exe
  2⤵
  PID:9812
- C:\Windows\System\ZhatTZk.exe
  C:\Windows\System\ZhatTZk.exe
  2⤵
  PID:9868
- C:\Windows\System\uJcPbuG.exe
  C:\Windows\System\uJcPbuG.exe
  2⤵
  PID:9972
- C:\Windows\System\EzDuOaH.exe
  C:\Windows\System\EzDuOaH.exe
  2⤵
  PID:10068
- C:\Windows\System\ZpatkNb.exe
  C:\Windows\System\ZpatkNb.exe
  2⤵
  PID:10112
- C:\Windows\System\BwhqBjW.exe
  C:\Windows\System\BwhqBjW.exe
  2⤵
  PID:10176
- C:\Windows\System\nWBsgDt.exe
  C:\Windows\System\nWBsgDt.exe
  2⤵
  PID:10220
- C:\Windows\System\RBdtvpg.exe
  C:\Windows\System\RBdtvpg.exe
  2⤵
  PID:8388
- C:\Windows\System\JTXDXha.exe
  C:\Windows\System\JTXDXha.exe
  2⤵
  PID:9476
- C:\Windows\System\KJYkEFX.exe
  C:\Windows\System\KJYkEFX.exe
  2⤵
  PID:9576
- C:\Windows\System\ndEPJJX.exe
  C:\Windows\System\ndEPJJX.exe
  2⤵
  PID:9848
- C:\Windows\System\xVDfJmh.exe
  C:\Windows\System\xVDfJmh.exe
  2⤵
  PID:9976
- C:\Windows\System\ePkWEhI.exe
  C:\Windows\System\ePkWEhI.exe
  2⤵
  PID:10088
- C:\Windows\System\XZdJeUu.exe
  C:\Windows\System\XZdJeUu.exe
  2⤵
  PID:10092
- C:\Windows\System\pcsOJoT.exe
  C:\Windows\System\pcsOJoT.exe
  2⤵
  PID:9380
- C:\Windows\System\wfYsfzX.exe
  C:\Windows\System\wfYsfzX.exe
  2⤵
  PID:9728
- C:\Windows\System\mMkbOLG.exe
  C:\Windows\System\mMkbOLG.exe
  2⤵
  PID:9928
- C:\Windows\System\tQFdvtE.exe
  C:\Windows\System\tQFdvtE.exe
  2⤵
  PID:9660
- C:\Windows\System\iCwPFhl.exe
  C:\Windows\System\iCwPFhl.exe
  2⤵
  PID:10264
- C:\Windows\System\HAGbVWJ.exe
  C:\Windows\System\HAGbVWJ.exe
  2⤵
  PID:10300
- C:\Windows\System\UQqOtAV.exe
  C:\Windows\System\UQqOtAV.exe
  2⤵
  PID:10336
- C:\Windows\System\waiklVm.exe
  C:\Windows\System\waiklVm.exe
  2⤵
  PID:10360
- C:\Windows\System\jjirykz.exe
  C:\Windows\System\jjirykz.exe
  2⤵
  PID:10388
- C:\Windows\System\eLMSNpq.exe
  C:\Windows\System\eLMSNpq.exe
  2⤵
  PID:10408
- C:\Windows\System\xatwkkD.exe
  C:\Windows\System\xatwkkD.exe
  2⤵
  PID:10440
- C:\Windows\System\VdtOnBe.exe
  C:\Windows\System\VdtOnBe.exe
  2⤵
  PID:10476
- C:\Windows\System\AoyhLUM.exe
  C:\Windows\System\AoyhLUM.exe
  2⤵
  PID:10500
- C:\Windows\System\DWUYSzP.exe
  C:\Windows\System\DWUYSzP.exe
  2⤵
  PID:10524
- C:\Windows\System\yEMAyyd.exe
  C:\Windows\System\yEMAyyd.exe
  2⤵
  PID:10560
- C:\Windows\System\caYIfyC.exe
  C:\Windows\System\caYIfyC.exe
  2⤵
  PID:10588
- C:\Windows\System\YfYENvH.exe
  C:\Windows\System\YfYENvH.exe
  2⤵
  PID:10620
- C:\Windows\System\cTDaWKt.exe
  C:\Windows\System\cTDaWKt.exe
  2⤵
  PID:10648
- C:\Windows\System\XTjWPZh.exe
  C:\Windows\System\XTjWPZh.exe
  2⤵
  PID:10684
- C:\Windows\System\YdOkrHv.exe
  C:\Windows\System\YdOkrHv.exe
  2⤵
  PID:10712
- C:\Windows\System\XhAFPNI.exe
  C:\Windows\System\XhAFPNI.exe
  2⤵
  PID:10728
- C:\Windows\System\BIPSCTj.exe
  C:\Windows\System\BIPSCTj.exe
  2⤵
  PID:10760
- C:\Windows\System\hgPVuEs.exe
  C:\Windows\System\hgPVuEs.exe
  2⤵
  PID:10788
- C:\Windows\System\aaNIATS.exe
  C:\Windows\System\aaNIATS.exe
  2⤵
  PID:10820
- C:\Windows\System\gcYIojm.exe
  C:\Windows\System\gcYIojm.exe
  2⤵
  PID:10848
- C:\Windows\System\IVVCzLw.exe
  C:\Windows\System\IVVCzLw.exe
  2⤵
  PID:10872
- C:\Windows\System\BghetWl.exe
  C:\Windows\System\BghetWl.exe
  2⤵
  PID:10892
- C:\Windows\System\hAvOKtE.exe
  C:\Windows\System\hAvOKtE.exe
  2⤵
  PID:10932
- C:\Windows\System\QbSyxyj.exe
  C:\Windows\System\QbSyxyj.exe
  2⤵
  PID:10956
- C:\Windows\System\JIdWeAF.exe
  C:\Windows\System\JIdWeAF.exe
  2⤵
  PID:10988
- C:\Windows\System\azlbBZm.exe
  C:\Windows\System\azlbBZm.exe
  2⤵
  PID:11012
- C:\Windows\System\lkdaaaD.exe
  C:\Windows\System\lkdaaaD.exe
  2⤵
  PID:11036
- C:\Windows\System\KNflMCd.exe
  C:\Windows\System\KNflMCd.exe
  2⤵
  PID:11060
- C:\Windows\System\IZWujrN.exe
  C:\Windows\System\IZWujrN.exe
  2⤵
  PID:11084
- C:\Windows\System\yeUAJhG.exe
  C:\Windows\System\yeUAJhG.exe
  2⤵
  PID:11116
- C:\Windows\System\aNaUFBW.exe
  C:\Windows\System\aNaUFBW.exe
  2⤵
  PID:11148
- C:\Windows\System\xgvLHgg.exe
  C:\Windows\System\xgvLHgg.exe
  2⤵
  PID:11176
- C:\Windows\System\GTfIyMb.exe
  C:\Windows\System\GTfIyMb.exe
  2⤵
  PID:11208
- C:\Windows\System\PecGxXc.exe
  C:\Windows\System\PecGxXc.exe
  2⤵
  PID:11232
- C:\Windows\System\CGQSoyp.exe
  C:\Windows\System\CGQSoyp.exe
  2⤵
  PID:11260
- C:\Windows\System\rSAbwME.exe
  C:\Windows\System\rSAbwME.exe
  2⤵
  PID:9184
- C:\Windows\System\RdBlhqQ.exe
  C:\Windows\System\RdBlhqQ.exe
  2⤵
  PID:10284
- C:\Windows\System\ZmNUADp.exe
  C:\Windows\System\ZmNUADp.exe
  2⤵
  PID:10396
- C:\Windows\System\kUuXEHM.exe
  C:\Windows\System\kUuXEHM.exe
  2⤵
  PID:10372
- C:\Windows\System\SUVmDGn.exe
  C:\Windows\System\SUVmDGn.exe
  2⤵
  PID:10520
- C:\Windows\System\ZKwKgMm.exe
  C:\Windows\System\ZKwKgMm.exe
  2⤵
  PID:10600
- C:\Windows\System\VRSPRxY.exe
  C:\Windows\System\VRSPRxY.exe
  2⤵
  PID:10604
- C:\Windows\System\adqiivu.exe
  C:\Windows\System\adqiivu.exe
  2⤵
  PID:10656
- C:\Windows\System\QXYZynp.exe
  C:\Windows\System\QXYZynp.exe
  2⤵
  PID:10780
- C:\Windows\System\xvgqDmw.exe
  C:\Windows\System\xvgqDmw.exe
  2⤵
  PID:10836
- C:\Windows\System\VRDGyyO.exe
  C:\Windows\System\VRDGyyO.exe
  2⤵
  PID:10860
- C:\Windows\System\jyUuxur.exe
  C:\Windows\System\jyUuxur.exe
  2⤵
  PID:11004
- C:\Windows\System\ckegKEr.exe
  C:\Windows\System\ckegKEr.exe
  2⤵
  PID:11032
- C:\Windows\System\aCfiYOA.exe
  C:\Windows\System\aCfiYOA.exe
  2⤵
  PID:11096
- C:\Windows\System\wqHdxcl.exe
  C:\Windows\System\wqHdxcl.exe
  2⤵
  PID:11160
- C:\Windows\System\DoQzCPz.exe
  C:\Windows\System\DoQzCPz.exe
  2⤵
  PID:11196
- C:\Windows\System\GtMIQSu.exe
  C:\Windows\System\GtMIQSu.exe
  2⤵
  PID:9904
- C:\Windows\System\QJckudK.exe
  C:\Windows\System\QJckudK.exe
  2⤵
  PID:10384
- C:\Windows\System\NwkeEUM.exe
  C:\Windows\System\NwkeEUM.exe
  2⤵
  PID:10424
- C:\Windows\System\TfDqVxh.exe
  C:\Windows\System\TfDqVxh.exe
  2⤵
  PID:10668
- C:\Windows\System\NEypcAk.exe
  C:\Windows\System\NEypcAk.exe
  2⤵
  PID:10812
- C:\Windows\System\PpjgDBc.exe
  C:\Windows\System\PpjgDBc.exe
  2⤵
  PID:10940
- C:\Windows\System\muEBRAQ.exe
  C:\Windows\System\muEBRAQ.exe
  2⤵
  PID:11252
- C:\Windows\System\yqQGPDo.exe
  C:\Windows\System\yqQGPDo.exe
  2⤵
  PID:10252
- C:\Windows\System\AMFXpDV.exe
  C:\Windows\System\AMFXpDV.exe
  2⤵
  PID:10664
- C:\Windows\System\kHqtmzR.exe
  C:\Windows\System\kHqtmzR.exe
  2⤵
  PID:10404
- C:\Windows\System\eeuvitW.exe
  C:\Windows\System\eeuvitW.exe
  2⤵
  PID:11104
- C:\Windows\System\ZNvLHFn.exe
  C:\Windows\System\ZNvLHFn.exe
  2⤵
  PID:11220
- C:\Windows\System\AEIXaaP.exe
  C:\Windows\System\AEIXaaP.exe
  2⤵
  PID:11284
- C:\Windows\System\ElZboZV.exe
  C:\Windows\System\ElZboZV.exe
  2⤵
  PID:11320
- C:\Windows\System\vApicfk.exe
  C:\Windows\System\vApicfk.exe
  2⤵
  PID:11352
- C:\Windows\System\SoDZEsi.exe
  C:\Windows\System\SoDZEsi.exe
  2⤵
  PID:11384
- C:\Windows\System\LHZZhVl.exe
  C:\Windows\System\LHZZhVl.exe
  2⤵
  PID:11412
- C:\Windows\System\SYWLJpG.exe
  C:\Windows\System\SYWLJpG.exe
  2⤵
  PID:11444
- C:\Windows\System\hsJYfgl.exe
  C:\Windows\System\hsJYfgl.exe
  2⤵
  PID:11464
- C:\Windows\System\NdDcwvD.exe
  C:\Windows\System\NdDcwvD.exe
  2⤵
  PID:11488
- C:\Windows\System\CgMuzme.exe
  C:\Windows\System\CgMuzme.exe
  2⤵
  PID:11520
- C:\Windows\System\EOJGQWO.exe
  C:\Windows\System\EOJGQWO.exe
  2⤵
  PID:11560
- C:\Windows\System\HrEdyJu.exe
  C:\Windows\System\HrEdyJu.exe
  2⤵
  PID:11592
- C:\Windows\System\BVQMZLX.exe
  C:\Windows\System\BVQMZLX.exe
  2⤵
  PID:11608
- C:\Windows\System\rXubLbW.exe
  C:\Windows\System\rXubLbW.exe
  2⤵
  PID:11628
- C:\Windows\System\CMGxeBK.exe
  C:\Windows\System\CMGxeBK.exe
  2⤵
  PID:11652
- C:\Windows\System\EuQxyyS.exe
  C:\Windows\System\EuQxyyS.exe
  2⤵
  PID:11680
- C:\Windows\System\RvUNeqk.exe
  C:\Windows\System\RvUNeqk.exe
  2⤵
  PID:11704
- C:\Windows\System\LocYxwl.exe
  C:\Windows\System\LocYxwl.exe
  2⤵
  PID:11736
- C:\Windows\System\pKRIrnj.exe
  C:\Windows\System\pKRIrnj.exe
  2⤵
  PID:11760
- C:\Windows\System\LNLQOwC.exe
  C:\Windows\System\LNLQOwC.exe
  2⤵
  PID:11788
- C:\Windows\System\ANiKvel.exe
  C:\Windows\System\ANiKvel.exe
  2⤵
  PID:11816
- C:\Windows\System\rMQstdT.exe
  C:\Windows\System\rMQstdT.exe
  2⤵
  PID:11852
- C:\Windows\System\QgVCgSh.exe
  C:\Windows\System\QgVCgSh.exe
  2⤵
  PID:11872
- C:\Windows\System\fkcyYWW.exe
  C:\Windows\System\fkcyYWW.exe
  2⤵
  PID:11904
- C:\Windows\System\ctIDyJB.exe
  C:\Windows\System\ctIDyJB.exe
  2⤵
  PID:11940
- C:\Windows\System\LTQsJFn.exe
  C:\Windows\System\LTQsJFn.exe
  2⤵
  PID:11960
- C:\Windows\System\TJBrsVu.exe
  C:\Windows\System\TJBrsVu.exe
  2⤵
  PID:11992
- C:\Windows\System\ewrzIjD.exe
  C:\Windows\System\ewrzIjD.exe
  2⤵
  PID:12032
- C:\Windows\System\GLYOaDV.exe
  C:\Windows\System\GLYOaDV.exe
  2⤵
  PID:12064
- C:\Windows\System\bVxsGyi.exe
  C:\Windows\System\bVxsGyi.exe
  2⤵
  PID:12088
- C:\Windows\System\itHpSlM.exe
  C:\Windows\System\itHpSlM.exe
  2⤵
  PID:12116
- C:\Windows\System\OlmsZib.exe
  C:\Windows\System\OlmsZib.exe
  2⤵
  PID:12136
- C:\Windows\System\WzBulMq.exe
  C:\Windows\System\WzBulMq.exe
  2⤵
  PID:12160
- C:\Windows\System\qCKbgHS.exe
  C:\Windows\System\qCKbgHS.exe
  2⤵
  PID:12188
- C:\Windows\System\IQtKDvq.exe
  C:\Windows\System\IQtKDvq.exe
  2⤵
  PID:12220
- C:\Windows\System\xqqosMX.exe
  C:\Windows\System\xqqosMX.exe
  2⤵
  PID:12252
- C:\Windows\System\UbifIkT.exe
  C:\Windows\System\UbifIkT.exe
  2⤵
  PID:12280
- C:\Windows\System\TQHqtsf.exe
  C:\Windows\System\TQHqtsf.exe
  2⤵
  PID:11200
- C:\Windows\System\SMEPGJm.exe
  C:\Windows\System\SMEPGJm.exe
  2⤵
  PID:11420
- C:\Windows\System\HjTWuzH.exe
  C:\Windows\System\HjTWuzH.exe
  2⤵
  PID:11400
- C:\Windows\System\JgfQoSL.exe
  C:\Windows\System\JgfQoSL.exe
  2⤵
  PID:11460
- C:\Windows\System\kiJQAfr.exe
  C:\Windows\System\kiJQAfr.exe
  2⤵
  PID:11544
- C:\Windows\System\mbpwjNy.exe
  C:\Windows\System\mbpwjNy.exe
  2⤵
  PID:11584
- C:\Windows\System\XJblsQk.exe
  C:\Windows\System\XJblsQk.exe
  2⤵
  PID:11600
- C:\Windows\System\aEZgAtf.exe
  C:\Windows\System\aEZgAtf.exe
  2⤵
  PID:11668
- C:\Windows\System\UvMCyzD.exe
  C:\Windows\System\UvMCyzD.exe
  2⤵
  PID:11700
- C:\Windows\System\lfVTDqt.exe
  C:\Windows\System\lfVTDqt.exe
  2⤵
  PID:11748
- C:\Windows\System\RmYduRZ.exe
  C:\Windows\System\RmYduRZ.exe
  2⤵
  PID:11840
- C:\Windows\System\UNWCQXd.exe
  C:\Windows\System\UNWCQXd.exe
  2⤵
  PID:11888
- C:\Windows\System\QwyWrBM.exe
  C:\Windows\System\QwyWrBM.exe
  2⤵
  PID:11956
- C:\Windows\System\UHrFEeM.exe
  C:\Windows\System\UHrFEeM.exe
  2⤵
  PID:12084
- C:\Windows\System\IjJClyT.exe
  C:\Windows\System\IjJClyT.exe
  2⤵
  PID:12100
- C:\Windows\System\aRFuuJb.exe
  C:\Windows\System\aRFuuJb.exe
  2⤵
  PID:12156
- C:\Windows\System\hCfDero.exe
  C:\Windows\System\hCfDero.exe
  2⤵
  PID:12232
- C:\Windows\System\IvVAxjs.exe
  C:\Windows\System\IvVAxjs.exe
  2⤵
  PID:12208
- C:\Windows\System\IDJXKkE.exe
  C:\Windows\System\IDJXKkE.exe
  2⤵
  PID:11392
- C:\Windows\System\UzKEndw.exe
  C:\Windows\System\UzKEndw.exe
  2⤵
  PID:11336
- C:\Windows\System\JipsBWS.exe
  C:\Windows\System\JipsBWS.exe
  2⤵
  PID:11624
- C:\Windows\System\McophRe.exe
  C:\Windows\System\McophRe.exe
  2⤵
  PID:11808
- C:\Windows\System\HVPGdtz.exe
  C:\Windows\System\HVPGdtz.exe
  2⤵
  PID:12004
- C:\Windows\System\ChtVflG.exe
  C:\Windows\System\ChtVflG.exe
  2⤵
  PID:12124
- C:\Windows\System\OPpcyfB.exe
  C:\Windows\System\OPpcyfB.exe
  2⤵
  PID:12060
- C:\Windows\System\tvbrBuo.exe
  C:\Windows\System\tvbrBuo.exe
  2⤵
  PID:11860
- C:\Windows\System\RmcGbwE.exe
  C:\Windows\System\RmcGbwE.exe
  2⤵
  PID:11976
- C:\Windows\System\VoPoXSo.exe
  C:\Windows\System\VoPoXSo.exe
  2⤵
  PID:12296
- C:\Windows\System\vXSKHDt.exe
  C:\Windows\System\vXSKHDt.exe
  2⤵
  PID:12320
- C:\Windows\System\fmtpYZT.exe
  C:\Windows\System\fmtpYZT.exe
  2⤵
  PID:12344
- C:\Windows\System\IpPMbds.exe
  C:\Windows\System\IpPMbds.exe
  2⤵
  PID:12372
- C:\Windows\System\IjSrZlz.exe
  C:\Windows\System\IjSrZlz.exe
  2⤵
  PID:12396
- C:\Windows\System\fmLoOod.exe
  C:\Windows\System\fmLoOod.exe
  2⤵
  PID:12432
- C:\Windows\System\MqLhfQW.exe
  C:\Windows\System\MqLhfQW.exe
  2⤵
  PID:12460
- C:\Windows\System\BUEgcBG.exe
  C:\Windows\System\BUEgcBG.exe
  2⤵
  PID:12488
- C:\Windows\System\vAuKjnF.exe
  C:\Windows\System\vAuKjnF.exe
  2⤵
  PID:12516
- C:\Windows\System\NlVFWCg.exe
  C:\Windows\System\NlVFWCg.exe
  2⤵
  PID:12548
- C:\Windows\System\wcPXYGn.exe
  C:\Windows\System\wcPXYGn.exe
  2⤵
  PID:12576
- C:\Windows\System\pumvOrU.exe
  C:\Windows\System\pumvOrU.exe
  2⤵
  PID:12604
- C:\Windows\System\oQGpWvs.exe
  C:\Windows\System\oQGpWvs.exe
  2⤵
  PID:12624
- C:\Windows\System\VikmSYj.exe
  C:\Windows\System\VikmSYj.exe
  2⤵
  PID:12648
- C:\Windows\System\FBbZVtA.exe
  C:\Windows\System\FBbZVtA.exe
  2⤵
  PID:12672
- C:\Windows\System\cklQufq.exe
  C:\Windows\System\cklQufq.exe
  2⤵
  PID:12696
- C:\Windows\System\OEKVhpj.exe
  C:\Windows\System\OEKVhpj.exe
  2⤵
  PID:12732
- C:\Windows\System\dszVqmK.exe
  C:\Windows\System\dszVqmK.exe
  2⤵
  PID:12756
- C:\Windows\System\ErnZpDe.exe
  C:\Windows\System\ErnZpDe.exe
  2⤵
  PID:12780
- C:\Windows\System\NDZMNbs.exe
  C:\Windows\System\NDZMNbs.exe
  2⤵
  PID:12804
- C:\Windows\System\wRoakgD.exe
  C:\Windows\System\wRoakgD.exe
  2⤵
  PID:12832
- C:\Windows\System\RHPTLQL.exe
  C:\Windows\System\RHPTLQL.exe
  2⤵
  PID:12864
- C:\Windows\System\RknDBjF.exe
  C:\Windows\System\RknDBjF.exe
  2⤵
  PID:12884
- C:\Windows\System\YSTmgae.exe
  C:\Windows\System\YSTmgae.exe
  2⤵
  PID:12908
- C:\Windows\System\yVZrOdw.exe
  C:\Windows\System\yVZrOdw.exe
  2⤵
  PID:12948
- C:\Windows\System\PURQEiL.exe
  C:\Windows\System\PURQEiL.exe
  2⤵
  PID:12972
- C:\Windows\System\QZWfmrd.exe
  C:\Windows\System\QZWfmrd.exe
  2⤵
  PID:13000
- C:\Windows\System\cNWFljU.exe
  C:\Windows\System\cNWFljU.exe
  2⤵
  PID:13036
- C:\Windows\System\ZVUISGH.exe
  C:\Windows\System\ZVUISGH.exe
  2⤵
  PID:13060
- C:\Windows\System\SqDXNGW.exe
  C:\Windows\System\SqDXNGW.exe
  2⤵
  PID:13084
- C:\Windows\System\ZZqKgxz.exe
  C:\Windows\System\ZZqKgxz.exe
  2⤵
  PID:13112
- C:\Windows\System\QDoHnPK.exe
  C:\Windows\System\QDoHnPK.exe
  2⤵
  PID:13140
- C:\Windows\System\ukEXCMp.exe
  C:\Windows\System\ukEXCMp.exe
  2⤵
  PID:13172
- C:\Windows\System\sKcwQNZ.exe
  C:\Windows\System\sKcwQNZ.exe
  2⤵
  PID:13196
- C:\Windows\System\RHfGJTb.exe
  C:\Windows\System\RHfGJTb.exe
  2⤵
  PID:13216
- C:\Windows\System\gXPxqmi.exe
  C:\Windows\System\gXPxqmi.exe
  2⤵
  PID:13236
- C:\Windows\System\rFquToa.exe
  C:\Windows\System\rFquToa.exe
  2⤵
  PID:13260
- C:\Windows\System\qslIyps.exe
  C:\Windows\System\qslIyps.exe
  2⤵
  PID:13284
- C:\Windows\System\YoVJWMZ.exe
  C:\Windows\System\YoVJWMZ.exe
  2⤵
  PID:13308
- C:\Windows\System\fukAVZX.exe
  C:\Windows\System\fukAVZX.exe
  2⤵
  PID:12148
- C:\Windows\System\JTYoVGk.exe
  C:\Windows\System\JTYoVGk.exe
  2⤵
  PID:12312
- C:\Windows\System\ENqEZnH.exe
  C:\Windows\System\ENqEZnH.exe
  2⤵
  PID:11640
- C:\Windows\System\CqndrzN.exe
  C:\Windows\System\CqndrzN.exe
  2⤵
  PID:11312
- C:\Windows\System\xzeQtRv.exe
  C:\Windows\System\xzeQtRv.exe
  2⤵
  PID:12444
- C:\Windows\System\fIWwwmA.exe
  C:\Windows\System\fIWwwmA.exe
  2⤵
  PID:12416
- C:\Windows\System\QqhvPkv.exe
  C:\Windows\System\QqhvPkv.exe
  2⤵
  PID:12584
- C:\Windows\System\fBJDlkn.exe
  C:\Windows\System\fBJDlkn.exe
  2⤵
  PID:12620
- C:\Windows\System\AlZjWEK.exe
  C:\Windows\System\AlZjWEK.exe
  2⤵
  PID:12748
- C:\Windows\System\gQoKdEl.exe
  C:\Windows\System\gQoKdEl.exe
  2⤵
  PID:12776
- C:\Windows\System\kFoVwgR.exe
  C:\Windows\System\kFoVwgR.exe
  2⤵
  PID:12816
- C:\Windows\System\BErbIbW.exe
  C:\Windows\System\BErbIbW.exe
  2⤵
  PID:12968
- C:\Windows\System\haKxsDl.exe
  C:\Windows\System\haKxsDl.exe
  2⤵
  PID:12928
- C:\Windows\System\enxnZWo.exe
  C:\Windows\System\enxnZWo.exe
  2⤵
  PID:13072
- C:\Windows\System\XibeRIw.exe
  C:\Windows\System\XibeRIw.exe
  2⤵
  PID:12988
- C:\Windows\System\GtjuLPW.exe
  C:\Windows\System\GtjuLPW.exe
  2⤵
  PID:13048
- C:\Windows\System\zxuBRgy.exe
  C:\Windows\System\zxuBRgy.exe
  2⤵
  PID:13212
- C:\Windows\System\IKAieuC.exe
  C:\Windows\System\IKAieuC.exe
  2⤵
  PID:13296
- C:\Windows\System\iOvxZeU.exe
  C:\Windows\System\iOvxZeU.exe
  2⤵
  PID:13244
- C:\Windows\System\hFoVAxK.exe
  C:\Windows\System\hFoVAxK.exe
  2⤵
  PID:12616
- C:\Windows\System\FkkZItT.exe
  C:\Windows\System\FkkZItT.exe
  2⤵
  PID:12564
- C:\Windows\System\vcMOiqc.exe
  C:\Windows\System\vcMOiqc.exe
  2⤵
  PID:12872
- C:\Windows\System\IotFvHo.exe
  C:\Windows\System\IotFvHo.exe
  2⤵
  PID:13152
- C:\Windows\System\XkpCioD.exe
  C:\Windows\System\XkpCioD.exe
  2⤵
  PID:13012
- C:\Windows\System\PNSKhYV.exe
  C:\Windows\System\PNSKhYV.exe
  2⤵
  PID:13384
- C:\Windows\System\IiiVJkA.exe
  C:\Windows\System\IiiVJkA.exe
  2⤵
  PID:13424
- C:\Windows\System\IXvCuSQ.exe
  C:\Windows\System\IXvCuSQ.exe
  2⤵
  PID:13464
- C:\Windows\System\mklkgxn.exe
  C:\Windows\System\mklkgxn.exe
  2⤵
  PID:13496
- C:\Windows\System\VqGLFtP.exe
  C:\Windows\System\VqGLFtP.exe
  2⤵
  PID:13516
- C:\Windows\System\EHGjSNI.exe
  C:\Windows\System\EHGjSNI.exe
  2⤵
  PID:13544
- C:\Windows\System\FEeRRLX.exe
  C:\Windows\System\FEeRRLX.exe
  2⤵
  PID:13572
- C:\Windows\System\TExwlhO.exe
  C:\Windows\System\TExwlhO.exe
  2⤵
  PID:13592
- C:\Windows\System\zajflWx.exe
  C:\Windows\System\zajflWx.exe
  2⤵
  PID:13624
- C:\Windows\System\kmhgujZ.exe
  C:\Windows\System\kmhgujZ.exe
  2⤵
  PID:13732
- C:\Windows\System\hDAJgVG.exe
  C:\Windows\System\hDAJgVG.exe
  2⤵
  PID:13748
- C:\Windows\System\HRNtFaq.exe
  C:\Windows\System\HRNtFaq.exe
  2⤵
  PID:13768
- C:\Windows\System\EJHMJQJ.exe
  C:\Windows\System\EJHMJQJ.exe
  2⤵
  PID:13792
- C:\Windows\System\zUpImeJ.exe
  C:\Windows\System\zUpImeJ.exe
  2⤵
  PID:13808
- C:\Windows\System\iAOIulW.exe
  C:\Windows\System\iAOIulW.exe
  2⤵
  PID:13836
- C:\Windows\System\RrBnzVG.exe
  C:\Windows\System\RrBnzVG.exe
  2⤵
  PID:13856
- C:\Windows\System\LdOKPdM.exe
  C:\Windows\System\LdOKPdM.exe
  2⤵
  PID:13872
- C:\Windows\System\JksVyxY.exe
  C:\Windows\System\JksVyxY.exe
  2⤵
  PID:13900
- C:\Windows\System\EBMbKXb.exe
  C:\Windows\System\EBMbKXb.exe
  2⤵
  PID:13928
- C:\Windows\System\iCZNMpn.exe
  C:\Windows\System\iCZNMpn.exe
  2⤵
  PID:13960
- C:\Windows\System\NKlxENK.exe
  C:\Windows\System\NKlxENK.exe
  2⤵
  PID:13976
- C:\Windows\System\xdMvlBS.exe
  C:\Windows\System\xdMvlBS.exe
  2⤵
  PID:14012
- C:\Windows\System\rQnhTTQ.exe
  C:\Windows\System\rQnhTTQ.exe
  2⤵
  PID:14040
- C:\Windows\System\vITSUfZ.exe
  C:\Windows\System\vITSUfZ.exe
  2⤵
  PID:14084
- C:\Windows\System\MMLZimD.exe
  C:\Windows\System\MMLZimD.exe
  2⤵
  PID:14100
- C:\Windows\System\scduEOR.exe
  C:\Windows\System\scduEOR.exe
  2⤵
  PID:14120
- C:\Windows\System\kCvGteb.exe
  C:\Windows\System\kCvGteb.exe
  2⤵
  PID:14148
- C:\Windows\System\EMXPqal.exe
  C:\Windows\System\EMXPqal.exe
  2⤵
  PID:14168
- C:\Windows\System\OLIluXa.exe
  C:\Windows\System\OLIluXa.exe
  2⤵
  PID:14212
- C:\Windows\System\xFWDRVl.exe
  C:\Windows\System\xFWDRVl.exe
  2⤵
  PID:14228
- C:\Windows\System\CLChFqH.exe
  C:\Windows\System\CLChFqH.exe
  2⤵
  PID:14252
- C:\Windows\System\mazAREK.exe
  C:\Windows\System\mazAREK.exe
  2⤵
  PID:14280
- C:\Windows\System\Kkqmdtk.exe
  C:\Windows\System\Kkqmdtk.exe
  2⤵
  PID:14308
- C:\Windows\System\IPvXMkF.exe
  C:\Windows\System\IPvXMkF.exe
  2⤵
  PID:12592
- C:\Windows\System\fWnnzZb.exe
  C:\Windows\System\fWnnzZb.exe
  2⤵
  PID:12924
- C:\Windows\System\FJtHtrH.exe
  C:\Windows\System\FJtHtrH.exe
  2⤵
  PID:13020
- C:\Windows\System\cNNbkkC.exe
  C:\Windows\System\cNNbkkC.exe
  2⤵
  PID:13328
- C:\Windows\System\Tzojmod.exe
  C:\Windows\System\Tzojmod.exe
  2⤵
  PID:13492
- C:\Windows\System\kXMhJzX.exe
  C:\Windows\System\kXMhJzX.exe
  2⤵
  PID:13532
- C:\Windows\System\jpduRgL.exe
  C:\Windows\System\jpduRgL.exe
  2⤵
  PID:13488
- C:\Windows\System\bMdRUKN.exe
  C:\Windows\System\bMdRUKN.exe
  2⤵
  PID:13528
- C:\Windows\System\Ikdbrmg.exe
  C:\Windows\System\Ikdbrmg.exe
  2⤵
  PID:13672
- C:\Windows\System\YRXhQBb.exe
  C:\Windows\System\YRXhQBb.exe
  2⤵
  PID:13728
- C:\Windows\System\AlFukih.exe
  C:\Windows\System\AlFukih.exe
  2⤵
  PID:13764
- C:\Windows\System\ltYtylv.exe
  C:\Windows\System\ltYtylv.exe
  2⤵
  PID:13844
- C:\Windows\System\NVRuweB.exe
  C:\Windows\System\NVRuweB.exe
  2⤵
  PID:13948
- C:\Windows\System\jztjueh.exe
  C:\Windows\System\jztjueh.exe
  2⤵
  PID:13912
- C:\Windows\System\yPfrPhp.exe
  C:\Windows\System\yPfrPhp.exe
  2⤵
  PID:14048
- C:\Windows\System\PTblMYB.exe
  C:\Windows\System\PTblMYB.exe
  2⤵
  PID:14096
- C:\Windows\System\PMuqGWz.exe
  C:\Windows\System\PMuqGWz.exe
  2⤵
  PID:14092
- C:\Windows\System\FWUygiX.exe
  C:\Windows\System\FWUygiX.exe
  2⤵
  PID:14224
- C:\Windows\System\hWrWett.exe
  C:\Windows\System\hWrWett.exe
  2⤵
  PID:14300
- C:\Windows\System\ocNBmOL.exe
  C:\Windows\System\ocNBmOL.exe
  2⤵
  PID:14328
- C:\Windows\System\INORLaN.exe
  C:\Windows\System\INORLaN.exe
  2⤵
  PID:13208
- C:\Windows\System\YRTsxVf.exe
  C:\Windows\System\YRTsxVf.exe
  2⤵
  PID:12308
- C:\Windows\System\tvAWcDN.exe
  C:\Windows\System\tvAWcDN.exe
  2⤵
  PID:13688
- C:\Windows\System\UWICVFj.exe
  C:\Windows\System\UWICVFj.exe
  2⤵
  PID:13684
- C:\Windows\System\uEszXja.exe
  C:\Windows\System\uEszXja.exe
  2⤵
  PID:13884
- C:\Windows\System\QiqExhD.exe
  C:\Windows\System\QiqExhD.exe
  2⤵
  PID:14192
- C:\Windows\System\ERJxRuQ.exe
  C:\Windows\System\ERJxRuQ.exe
  2⤵
  PID:14060
- C:\Windows\System\IEHJTky.exe
  C:\Windows\System\IEHJTky.exe
  2⤵
  PID:14220
- C:\Windows\System\FwWodei.exe
  C:\Windows\System\FwWodei.exe
  2⤵
  PID:13452
- C:\Windows\System\EHxFaAs.exe
  C:\Windows\System\EHxFaAs.exe
  2⤵
  PID:13512
- C:\Windows\System\ulpETRO.exe
  C:\Windows\System\ulpETRO.exe
  2⤵
  PID:14272
- C:\Windows\System\tLogQsH.exe
  C:\Windows\System\tLogQsH.exe
  2⤵
  PID:13404
- C:\Windows\System\yyVeAWd.exe
  C:\Windows\System\yyVeAWd.exe
  2⤵
  PID:14356
- C:\Windows\System\KbOLVUa.exe
  C:\Windows\System\KbOLVUa.exe
  2⤵
  PID:14380
- C:\Windows\System\bmhSSqq.exe
  C:\Windows\System\bmhSSqq.exe
  2⤵
  PID:14412
- C:\Windows\System\jAoIWHu.exe
  C:\Windows\System\jAoIWHu.exe
  2⤵
  PID:14444
- C:\Windows\System\EMxpmQZ.exe
  C:\Windows\System\EMxpmQZ.exe
  2⤵
  PID:14472
- C:\Windows\System\PggTQfH.exe
  C:\Windows\System\PggTQfH.exe
  2⤵
  PID:14496
- C:\Windows\System\XCleCNz.exe
  C:\Windows\System\XCleCNz.exe
  2⤵
  PID:14516
- C:\Windows\System\AkbqLNm.exe
  C:\Windows\System\AkbqLNm.exe
  2⤵
  PID:14540
- C:\Windows\System\FXoVbPg.exe
  C:\Windows\System\FXoVbPg.exe
  2⤵
  PID:14560
- C:\Windows\System\uFpwZTw.exe
  C:\Windows\System\uFpwZTw.exe
  2⤵
  PID:14580
- C:\Windows\System\FhnKqzc.exe
  C:\Windows\System\FhnKqzc.exe
  2⤵
  PID:14600
- C:\Windows\System\FORtHvj.exe
  C:\Windows\System\FORtHvj.exe
  2⤵
  PID:14616
- C:\Windows\System\UtHxlja.exe
  C:\Windows\System\UtHxlja.exe
  2⤵
  PID:14648
- C:\Windows\System\bxdOHrv.exe
  C:\Windows\System\bxdOHrv.exe
  2⤵
  PID:14676
- C:\Windows\System\uuaTNHd.exe
  C:\Windows\System\uuaTNHd.exe
  2⤵
  PID:14700
- C:\Windows\System\FFHExzY.exe
  C:\Windows\System\FFHExzY.exe
  2⤵
  PID:14728
- C:\Windows\System\guXFUpf.exe
  C:\Windows\System\guXFUpf.exe
  2⤵
  PID:14760
- C:\Windows\System\ELXjVeB.exe
  C:\Windows\System\ELXjVeB.exe
  2⤵
  PID:14796
- C:\Windows\System\MgnFcTu.exe
  C:\Windows\System\MgnFcTu.exe
  2⤵
  PID:14832
- C:\Windows\System\KxfUCFx.exe
  C:\Windows\System\KxfUCFx.exe
  2⤵
  PID:14860
- C:\Windows\System\flLGMkV.exe
  C:\Windows\System\flLGMkV.exe
  2⤵
  PID:14888
- C:\Windows\System\nUyEHHw.exe
  C:\Windows\System\nUyEHHw.exe
  2⤵
  PID:14912
- C:\Windows\System\ORMTLaB.exe
  C:\Windows\System\ORMTLaB.exe
  2⤵
  PID:14932
- C:\Windows\System\fceYVwG.exe
  C:\Windows\System\fceYVwG.exe
  2⤵
  PID:14968
- C:\Windows\System\YBrizgE.exe
  C:\Windows\System\YBrizgE.exe
  2⤵
  PID:14992
- C:\Windows\System\vcsqKcL.exe
  C:\Windows\System\vcsqKcL.exe
  2⤵
  PID:15020
- C:\Windows\System\zhIfsls.exe
  C:\Windows\System\zhIfsls.exe
  2⤵
  PID:15044
- C:\Windows\System\KpQqWFc.exe
  C:\Windows\System\KpQqWFc.exe
  2⤵
  PID:15060
- C:\Windows\System\VdDEjZX.exe
  C:\Windows\System\VdDEjZX.exe
  2⤵
  PID:15084
- C:\Windows\System\YyQXSUH.exe
  C:\Windows\System\YyQXSUH.exe
  2⤵
  PID:15108
- C:\Windows\System\fUPElqh.exe
  C:\Windows\System\fUPElqh.exe
  2⤵
  PID:15128
- C:\Windows\System\DzANxUr.exe
  C:\Windows\System\DzANxUr.exe
  2⤵
  PID:15148
- C:\Windows\System\qkfwjIQ.exe
  C:\Windows\System\qkfwjIQ.exe
  2⤵
  PID:15172
- C:\Windows\System\gWpzNAx.exe
  C:\Windows\System\gWpzNAx.exe
  2⤵
  PID:15204
- C:\Windows\System\kWzjloo.exe
  C:\Windows\System\kWzjloo.exe
  2⤵
  PID:15232
- C:\Windows\System\NfGDcEN.exe
  C:\Windows\System\NfGDcEN.exe
  2⤵
  PID:15256
- C:\Windows\System\YqERrOQ.exe
  C:\Windows\System\YqERrOQ.exe
  2⤵
  PID:15288
- C:\Windows\System\qxrqJJI.exe
  C:\Windows\System\qxrqJJI.exe
  2⤵
  PID:15320
- C:\Windows\System\keaEowt.exe
  C:\Windows\System\keaEowt.exe
  2⤵
  PID:15348
- C:\Windows\System\uVnulld.exe
  C:\Windows\System\uVnulld.exe
  2⤵
  PID:14296
- C:\Windows\System\zMmqWTh.exe
  C:\Windows\System\zMmqWTh.exe
  2⤵
  PID:14368
- C:\Windows\System\maBAjns.exe
  C:\Windows\System\maBAjns.exe
  2⤵
  PID:12688
- C:\Windows\System\KBHrTNL.exe
  C:\Windows\System\KBHrTNL.exe
  2⤵
  PID:14460
- C:\Windows\System\SDnAxEi.exe
  C:\Windows\System\SDnAxEi.exe
  2⤵
  PID:14536
- C:\Windows\System\ESexWwq.exe
  C:\Windows\System\ESexWwq.exe
  2⤵
  PID:14488
- C:\Windows\System\ZSlHOJV.exe
  C:\Windows\System\ZSlHOJV.exe
  2⤵
  PID:14400
- C:\Windows\System\CCriMkU.exe
  C:\Windows\System\CCriMkU.exe
  2⤵
  PID:14808
- C:\Windows\System\MAsaDVu.exe
  C:\Windows\System\MAsaDVu.exe
  2⤵
  PID:14592
- C:\Windows\System\BklFlxz.exe
  C:\Windows\System\BklFlxz.exe
  2⤵
  PID:14644
- C:\Windows\System\MEOdDzM.exe
  C:\Windows\System\MEOdDzM.exe
  2⤵
  PID:14780
- C:\Windows\System\UovHFXv.exe
  C:\Windows\System\UovHFXv.exe
  2⤵
  PID:14856
- C:\Windows\System\DMyDzze.exe
  C:\Windows\System\DMyDzze.exe
  2⤵
  PID:15032
- C:\Windows\System\mIqUgZW.exe
  C:\Windows\System\mIqUgZW.exe
  2⤵
  PID:14964
- C:\Windows\System\siKDSos.exe
  C:\Windows\System\siKDSos.exe
  2⤵
  PID:14900
- C:\Windows\System\YCXYYVH.exe
  C:\Windows\System\YCXYYVH.exe
  2⤵
  PID:15052
- C:\Windows\System\FRVbCDu.exe
  C:\Windows\System\FRVbCDu.exe
  2⤵
  PID:15284
- C:\Windows\System\QhfoUdR.exe
  C:\Windows\System\QhfoUdR.exe
  2⤵
  PID:15344
- C:\Windows\System\OukoLLJ.exe
  C:\Windows\System\OukoLLJ.exe
  2⤵
  PID:15276
- C:\Windows\System\XfWZjDw.exe
  C:\Windows\System\XfWZjDw.exe
  2⤵
  PID:14464
- C:\Windows\System\kNwrQZm.exe
  C:\Windows\System\kNwrQZm.exe
  2⤵
  PID:15220
- C:\Windows\System\RMBjiIA.exe
  C:\Windows\System\RMBjiIA.exe
  2⤵
  PID:14456
- C:\Windows\System\oWiJimT.exe
  C:\Windows\System\oWiJimT.exe
  2⤵
  PID:15300
- C:\Windows\System\KrYiTcd.exe
  C:\Windows\System\KrYiTcd.exe
  2⤵
  PID:14636
- C:\Windows\System\FrOfUlc.exe
  C:\Windows\System\FrOfUlc.exe
  2⤵
  PID:15364
- C:\Windows\System\zhoyHRx.exe
  C:\Windows\System\zhoyHRx.exe
  2⤵
  PID:15392
- C:\Windows\System\JoaDXAB.exe
  C:\Windows\System\JoaDXAB.exe
  2⤵
  PID:15416
- C:\Windows\System\kOGURDu.exe
  C:\Windows\System\kOGURDu.exe
  2⤵
  PID:15440
- C:\Windows\System\DTzreFe.exe
  C:\Windows\System\DTzreFe.exe
  2⤵
  PID:15464
- C:\Windows\System\GdDMZhS.exe
  C:\Windows\System\GdDMZhS.exe
  2⤵
  PID:15484
- C:\Windows\System\AnfgUHF.exe
  C:\Windows\System\AnfgUHF.exe
  2⤵
  PID:15512
- C:\Windows\System\IKooeEn.exe
  C:\Windows\System\IKooeEn.exe
  2⤵
  PID:15532
- C:\Windows\System\xAytLrR.exe
  C:\Windows\System\xAytLrR.exe
  2⤵
  PID:15556
- C:\Windows\System\RGTqVZJ.exe
  C:\Windows\System\RGTqVZJ.exe
  2⤵
  PID:15580
- C:\Windows\System\kwJjqYq.exe
  C:\Windows\System\kwJjqYq.exe
  2⤵
  PID:15612
- C:\Windows\System\DzlOJxr.exe
  C:\Windows\System\DzlOJxr.exe
  2⤵
  PID:15640
- C:\Windows\System\mvaBMlJ.exe
  C:\Windows\System\mvaBMlJ.exe
  2⤵
  PID:15656
- C:\Windows\System\xnknQXc.exe
  C:\Windows\System\xnknQXc.exe
  2⤵
  PID:15688
- C:\Windows\System\WAfAtCK.exe
  C:\Windows\System\WAfAtCK.exe
  2⤵
  PID:15712
- C:\Windows\System\pRtIGQr.exe
  C:\Windows\System\pRtIGQr.exe
  2⤵
  PID:15736
- C:\Windows\System\SLRJteq.exe
  C:\Windows\System\SLRJteq.exe
  2⤵
  PID:15764
- C:\Windows\System\qOdUfuY.exe
  C:\Windows\System\qOdUfuY.exe
  2⤵
  PID:15808
- C:\Windows\System\JZdVgkW.exe
  C:\Windows\System\JZdVgkW.exe
  2⤵
  PID:15828
- C:\Windows\System\MBZNtRv.exe
  C:\Windows\System\MBZNtRv.exe
  2⤵
  PID:15852
- C:\Windows\System\IRLlXkn.exe
  C:\Windows\System\IRLlXkn.exe
  2⤵
  PID:15884
- C:\Windows\System\KLvHLCQ.exe
  C:\Windows\System\KLvHLCQ.exe
  2⤵
  PID:15920
- C:\Windows\System\TTyKhrG.exe
  C:\Windows\System\TTyKhrG.exe
  2⤵
  PID:15956
- C:\Windows\System\rbJhVTe.exe
  C:\Windows\System\rbJhVTe.exe
  2⤵
  PID:15972
- C:\Windows\System\ieaOhyY.exe
  C:\Windows\System\ieaOhyY.exe
  2⤵
  PID:15996
- C:\Windows\System\sgEEjTZ.exe
  C:\Windows\System\sgEEjTZ.exe
  2⤵
  PID:16024
- C:\Windows\System\uPzfzNo.exe
  C:\Windows\System\uPzfzNo.exe
  2⤵
  PID:16052
- C:\Windows\System\xFFzCZV.exe
  C:\Windows\System\xFFzCZV.exe
  2⤵
  PID:16080
- C:\Windows\System\zgHpdNJ.exe
  C:\Windows\System\zgHpdNJ.exe
  2⤵
  PID:16108
- C:\Windows\System\rNqqExV.exe
  C:\Windows\System\rNqqExV.exe
  2⤵
  PID:16128
- C:\Windows\System\ZLLhBmV.exe
  C:\Windows\System\ZLLhBmV.exe
  2⤵
  PID:16152
- C:\Windows\System\KuMWBWk.exe
  C:\Windows\System\KuMWBWk.exe
  2⤵
  PID:16172
- C:\Windows\System\fAPTGrp.exe
  C:\Windows\System\fAPTGrp.exe
  2⤵
  PID:16200
- C:\Windows\System\utqEQJp.exe
  C:\Windows\System\utqEQJp.exe
  2⤵
  PID:16220
- C:\Windows\System\xUBluqs.exe
  C:\Windows\System\xUBluqs.exe
  2⤵
  PID:16248
- C:\Windows\System\XGNizKo.exe
  C:\Windows\System\XGNizKo.exe
  2⤵
  PID:16276
- C:\Windows\System\fqMYAqF.exe
  C:\Windows\System\fqMYAqF.exe
  2⤵
  PID:16300
- C:\Windows\System\mdKtYSv.exe
  C:\Windows\System\mdKtYSv.exe
  2⤵
  PID:16316
- C:\Windows\System\itiLunP.exe
  C:\Windows\System\itiLunP.exe
  2⤵
  PID:16336
- C:\Windows\System\SLCjRWI.exe
  C:\Windows\System\SLCjRWI.exe
  2⤵
  PID:16364
- C:\Windows\System\MEBOIwT.exe
  C:\Windows\System\MEBOIwT.exe
  2⤵
  PID:15164
- C:\Windows\System\cmIRiJZ.exe
  C:\Windows\System\cmIRiJZ.exe
  2⤵
  PID:15160
- C:\Windows\System\VrZlpGY.exe
  C:\Windows\System\VrZlpGY.exe
  2⤵
  PID:14028
- C:\Windows\System\fBJfypg.exe
  C:\Windows\System\fBJfypg.exe
  2⤵
  PID:13924
- C:\Windows\System\UnJYkxW.exe
  C:\Windows\System\UnJYkxW.exe
  2⤵
  PID:15424
- C:\Windows\System\YohekuL.exe
  C:\Windows\System\YohekuL.exe
  2⤵
  PID:15504
- C:\Windows\System\uMWSmoT.exe
  C:\Windows\System\uMWSmoT.exe
  2⤵
  PID:15608
- C:\Windows\System\fKxqouO.exe
  C:\Windows\System\fKxqouO.exe
  2⤵
  PID:15700
- C:\Windows\System\RMpjPzR.exe
  C:\Windows\System\RMpjPzR.exe
  2⤵
  PID:15668
- C:\Windows\System\jqXccNa.exe
  C:\Windows\System\jqXccNa.exe
  2⤵
  PID:15724
- C:\Windows\System\IujKdOu.exe
  C:\Windows\System\IujKdOu.exe
  2⤵
  PID:15796
- C:\Windows\System\SAjFFRA.exe
  C:\Windows\System\SAjFFRA.exe
  2⤵
  PID:15836
- C:\Windows\System\jcuLwct.exe
  C:\Windows\System\jcuLwct.exe
  2⤵
  PID:15936
- C:\Windows\System\GEoulKP.exe
  C:\Windows\System\GEoulKP.exe
  2⤵
  PID:16216
- C:\Windows\System\DCOUoDX.exe
  C:\Windows\System\DCOUoDX.exe
  2⤵
  PID:16020
- C:\Windows\System\JCQbklW.exe
  C:\Windows\System\JCQbklW.exe
  2⤵
  PID:15844
- C:\Windows\System\tLLLwFG.exe
  C:\Windows\System\tLLLwFG.exe
  2⤵
  PID:16116
- C:\Windows\System\yEShLAF.exe
  C:\Windows\System\yEShLAF.exe
  2⤵
  PID:16360
- C:\Windows\System\nrYqtTj.exe
  C:\Windows\System\nrYqtTj.exe
  2⤵
  PID:16232
- C:\Windows\System\tUbcdWi.exe
  C:\Windows\System\tUbcdWi.exe
  2⤵
  PID:16256
- C:\Windows\System\VLsvAhq.exe
  C:\Windows\System\VLsvAhq.exe
  2⤵
  PID:15568
- C:\Windows\System\BdrxbYj.exe
  C:\Windows\System\BdrxbYj.exe
  2⤵
  PID:15912
- C:\Windows\System\DbXwnMc.exe
  C:\Windows\System\DbXwnMc.exe
  2⤵
  PID:14688
- C:\Windows\System\buwzCud.exe
  C:\Windows\System\buwzCud.exe
  2⤵
  PID:15404
- C:\Windows\System\ZCxlpHj.exe
  C:\Windows\System\ZCxlpHj.exe
  2⤵
  PID:16396
- C:\Windows\System\DPoCEdv.exe
  C:\Windows\System\DPoCEdv.exe
  2⤵
  PID:16436
- C:\Windows\System\VVpcXrn.exe
  C:\Windows\System\VVpcXrn.exe
  2⤵
  PID:16456
- C:\Windows\System\IRWtidF.exe
  C:\Windows\System\IRWtidF.exe
  2⤵
  PID:16488
- C:\Windows\System\QaJPZBG.exe
  C:\Windows\System\QaJPZBG.exe
  2⤵
  PID:16504
- C:\Windows\System\hDmZgNr.exe
  C:\Windows\System\hDmZgNr.exe
  2⤵
  PID:16528
- C:\Windows\System\YkWBqIq.exe
  C:\Windows\System\YkWBqIq.exe
  2⤵
  PID:16552
- C:\Windows\System\SCdZdZo.exe
  C:\Windows\System\SCdZdZo.exe
  2⤵
  PID:16580
- C:\Windows\System\kmiXUPK.exe
  C:\Windows\System\kmiXUPK.exe
  2⤵
  PID:16600
- C:\Windows\System\IITHoDH.exe
  C:\Windows\System\IITHoDH.exe
  2⤵
  PID:16616
- C:\Windows\System\oXOlBzR.exe
  C:\Windows\System\oXOlBzR.exe
  2⤵
  PID:16640
- C:\Windows\System\bYjuxbZ.exe
  C:\Windows\System\bYjuxbZ.exe
  2⤵
  PID:16664
- C:\Windows\System\VgluleH.exe
  C:\Windows\System\VgluleH.exe
  2⤵
  PID:16688
- C:\Windows\System\sFyWlJx.exe
  C:\Windows\System\sFyWlJx.exe
  2⤵
  PID:16712
- C:\Windows\System\BNSuNac.exe
  C:\Windows\System\BNSuNac.exe
  2⤵
  PID:16736
- C:\Windows\System\ItjvBLp.exe
  C:\Windows\System\ItjvBLp.exe
  2⤵
  PID:16764
- C:\Windows\System\CDWiVSe.exe
  C:\Windows\System\CDWiVSe.exe
  2⤵
  PID:16784
- C:\Windows\System\bCEycgE.exe
  C:\Windows\System\bCEycgE.exe
  2⤵
  PID:16808
- C:\Windows\System\TvMIZxg.exe
  C:\Windows\System\TvMIZxg.exe
  2⤵
  PID:16828
- C:\Windows\System\MEQcIgC.exe
  C:\Windows\System\MEQcIgC.exe
  2⤵
  PID:16860
- C:\Windows\System\LhKcDme.exe
  C:\Windows\System\LhKcDme.exe
  2⤵
  PID:16880
- C:\Windows\System\KZWRtiH.exe
  C:\Windows\System\KZWRtiH.exe
  2⤵
  PID:16908
- C:\Windows\System\ViHEAhK.exe
  C:\Windows\System\ViHEAhK.exe
  2⤵
  PID:17176
- C:\Windows\System\DycTmlQ.exe
  C:\Windows\System\DycTmlQ.exe
  2⤵
  PID:17288
- C:\Windows\System\ukojpgS.exe
  C:\Windows\System\ukojpgS.exe
  2⤵
  PID:17352
- C:\Windows\System\wJZsUPm.exe
  C:\Windows\System\wJZsUPm.exe
  2⤵
  PID:17376
- C:\Windows\System\rubAPUF.exe
  C:\Windows\System\rubAPUF.exe
  2⤵
  PID:17400
- C:\Windows\System\ZKPXlzP.exe
  C:\Windows\System\ZKPXlzP.exe
  2⤵
  PID:15412
- C:\Windows\System\eRzBIyU.exe
  C:\Windows\System\eRzBIyU.exe
  2⤵
  PID:16308
- C:\Windows\System\TwQPAtr.exe
  C:\Windows\System\TwQPAtr.exe
  2⤵
  PID:14408

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:17348

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\AOBzlUE.exe

Filesize
1.8MB

MD5
c6eef18587a235a9ba6f371a54d8442d

SHA1
5352f5fe9563d10878f59459cf00816427d87082

SHA256
a4378a98dd65876f6566d4eca7d5cbfe67f321ddf1bf60e7b6057473b5bb763c

SHA512
04025c44cc0f8c18168a7bdc76fd7db80da0e4849982ebbcb8823848f5abdc6e71f251baa2269887b4c79b424b3b6cbb1ff39c9e2e8bf5d1e88e64adbb1b65d9

Download Submit
C:\Windows\System\BOWCCnN.exe

Filesize
1.8MB

MD5
6f328627e6109cb2f74d21e1f6ee254b

SHA1
c5002f8bd46b1e3f96e7c3fe43f6c89f616dce6d

SHA256
c27393d723737bd405fe297303e6cac1542c82c8eae10fdabd04c86d0d764f5d

SHA512
16c1440285d256e01e7843465a619ff9caaebf34f3097e99af058158e983e04c9f11f4a1287729b11e86946c28a71d15b4cb0b169eb248c78fa6213b74cbd718

Download Submit
C:\Windows\System\BeApmxM.exe

Filesize
1.8MB

MD5
28e6ad45ca6629f113ce866c4cebfa85

SHA1
d86b96e4a31f64131969ada77fb9a42e852ab4f2

SHA256
e057f8d4dc246372b28044e04da9ea81f3456a83ce997d5556e7f6222fb23edd

SHA512
4a6bac020cdb32c1bbcb1a1f9eb0a36c5e775b5e55f3c3582fed5d62acdba1bb008bb5c756c25cca63b77e1779ee51563b62c412f735b8c8d974afed97a3b7f0

Download Submit
C:\Windows\System\EijFyme.exe

Filesize
1.8MB

MD5
e949d44adf2357c96c1059a4b9b3141e

SHA1
7f80a969840d4451a2b340e160b5d1ec411a2ae0

SHA256
34dcc78a48ad309d499eaaf790c9d5169d10c0824cecd77d1d0d2bc379e852f9

SHA512
d6f28047f143080af9213ecc1d8093bad79c37af55e19f7003cafb4a4038fa643fa3d74bed1e4c89e0d7be522848e8343f17445d4d7b6a37f8460a2e47c39d79

Download Submit
C:\Windows\System\FSHNuLD.exe

Filesize
1.8MB

MD5
5f85a6b761e2e7f3c273bd9bd526834d

SHA1
008685eadece61e8c151b8e4c790bed3310aa01d

SHA256
9f4794d1218aabbd86662b02710d7aecd1ea7863758e66cff047bb802fc02bb7

SHA512
7cfaf235903c8cef5c0f3013e129cc95c27b4df0dacb0c84a452e9e710a878277aac2d7e3cb63db8fa7e781277f6d6499b9714dd01a10c9764605ec55416c77c

Download Submit
C:\Windows\System\FosWSzl.exe

Filesize
1.8MB

MD5
b9263e1fac81f85f4ca78a605751f9be

SHA1
5d1b5e9e84b1dee8f321f66936c668ca8c425223

SHA256
68b93ffe0b740c443c020a9fc390eb4cf3364a3cd339de641f8a5c5f0394da31

SHA512
a695fe412c6d038f04d4f682156d5b2730ddbd49eac22c15209249ab1d6e67e049244b7d08e8ff1cf63ed580ee078a9d2c7d1d8b08b7aea7647d1ababfd0cefc

Download Submit
C:\Windows\System\GCpTxLY.exe

Filesize
1.8MB

MD5
9df5b99b6f4d2066bd401a2e35c747f8

SHA1
4a3891c1646b6879528716c6eaa11465660d2590

SHA256
879a400527ab5e8807d388da5386a1a2c804e82c9d1260887ce216f7295bd816

SHA512
017f4d61d9f3a271ccc2f95e9737e62492ee41473ddd078282ea6e404b7da7ea6ed6920979f472c3743335e45378f5897f1e34b1e329c323205a43d9ac09b3e0

Download Submit
C:\Windows\System\IIdhJtB.exe

Filesize
1.8MB

MD5
86662384d411625a1948e61f1dfda4f2

SHA1
f14c627841b3625abfa453eb76ecd525b3c3417f

SHA256
5dca564bda4d77587ec5102db7d8ff025fb26ed2ff901dc0ea92e0c42e161259

SHA512
991f53c58b7855482b2d53b9b9c2c5285f030d7bf8ba62bbec56a4994426dfee101e6e9b8655e316228d6a438c2632672c46c522ef1bdff54c4eb9ca3af661bf

Download Submit
C:\Windows\System\NBEcdHa.exe

Filesize
1.8MB

MD5
9bd6ba68fbb6332267be6b44398f4431

SHA1
bf2fe53e16c46355d14b3e4cbb9845f650817103

SHA256
5a5fa6c8b3efbacf49e96ff4738c686a92a5222d8ee70b3353479ddfd3bf0291

SHA512
871bf3d2e1184239c2de4d0ead72aa3688042535bfa3a14fb33aab6d4b9d83fae6d61050fb9fb81b6b099da07c1b3b8a54b9391518e4611449a7d0c264f84c4e

Download Submit
C:\Windows\System\QZUtuSG.exe

Filesize
1.8MB

MD5
9f4468a4744b209c8ddcccde13b12e99

SHA1
984352210f9e1e4c5fecd1a60d3940c38cd4c769

SHA256
60f6eaff370f359bda540b97b7c3bea4a2f2746acee904df0778eca528142e68

SHA512
b380f56fee68efc11301c6995fec52be54c66a7a6cf5ef31bd5cd5071d6dbdade44e6a09c000b00a079bd4b49b0ff4872eac88817c53e7bde044982eec5d9f54

Download Submit
C:\Windows\System\UAmjpfl.exe

Filesize
1.8MB

MD5
5cd1c65b9822497405da48fce74a6d55

SHA1
a7abefe3bb48d9888e8f91ba2e3d26fbc371d716

SHA256
4db464b292bf1a578ba656cdfa59e87e60bacd94b952d7497fe83109b2d93959

SHA512
14e243f0089cf8314a37661a7e9393264ae33f7369aaa4fbbd49f406ff1fb02dc3b9e85a47693e175b0def77e25a9acdc295cfb88d7967a304fcdb43fb78ee1b

Download Submit
C:\Windows\System\VvJSAfw.exe

Filesize
1.8MB

MD5
13083ec77d232c560a4c644d2f1361cf

SHA1
aa6a8b86e6061c585ddf4486720e8e2964fd6684

SHA256
db24e8b8b90c2646c917fd1b2bd1179cfa78d36f63d7fdafaf2f44c4e0773bf1

SHA512
d3121b8db463b76b1d95b3cf49843cf05deb6b8971b30104f8d5443bf0023b27cc895df6e58a0b108f72ed2cdb8df5c9a04314573547349becacfe0c97f35391

Download Submit
C:\Windows\System\WKxpvCM.exe

Filesize
1.8MB

MD5
f9b25fb8d167ab7d6bf81f477f8ebafa

SHA1
a446f2f867c0be59a7226b32225aa3004b7092a4

SHA256
defa22f99a929ec987fd28f604463555005f51c71b09b7e2f65c743b60d58cc8

SHA512
fb82002b2c0ee754c550b1b213f150e782aa35802fd79ffee33770f3f2aa5c3d63f23884b29c597567664d78547e197424682b99afea961e07d67a0f94d807c8

Download Submit
C:\Windows\System\XEgGLko.exe

Filesize
1.8MB

MD5
069a9eb4e31fed366acde328197ad39f

SHA1
65876034f19b09214201b4600f33b5983bdacaf7

SHA256
eb3d2e759044739333d2618e039846013a6299f3c0b819a7e99aa88e51cb0a21

SHA512
080a852c9523db3e2274b25b99e5d8057a56c5f172c51c33db09567cacd83ab10afee2f7a7ca1c66849be734208b8038180b99a1b7063d80028ea74fcc3a8298

Download Submit
C:\Windows\System\XZMKoJp.exe

Filesize
1.8MB

MD5
4dfd5206c6be16a85ee9cda95d5fba95

SHA1
99d8277aa97b3a6420b1c21e8a3739902972e6a4

SHA256
080442b21e25387f1ae027b606391ccce1578f4341e5cd14b7650a842328c2f9

SHA512
5ea8bff7c1b03af12ff945c631af1387ca2a7720ce1eae21fc13000eb4fcc36422050359266073406277fbe33cd2bab0cd5cb2bcfed8ece83ac8d11844742d4c

Download Submit
C:\Windows\System\XsYMOEa.exe

Filesize
1.8MB

MD5
dc2dcdd00f06727f721a98006993f695

SHA1
57c650c4fbda18cedc8b79bc0f556412b234146d

SHA256
1ba8cad38a584040d6086a0f4c01794044323eab73271eab6480adf7efc7cd77

SHA512
de5493de104ddd6ead2a5597ef979c06ae97c4381ef7503c194f2ba5ea7f8ce7d6431de3ebc2e4d80f2f1e2d463d0ddf812717da7eebba131d0f2d899003a74a

Download Submit
C:\Windows\System\eZaLndx.exe

Filesize
1.8MB

MD5
28ea5b63866b13e56417ab7a257f6775

SHA1
d99214bc0b9a14db6dbc5e6f01113610b3299b40

SHA256
ea89ada79c2d2c8322a4deb337da14adda4a48faa8e4c1377611353737d7d6ba

SHA512
96fe66c658b9d0ca52e79750df143bfe6982cb487f8fa7925802fc6206283c20da8925c3bb237c962ce8dee2d012956b9346d5cfa414fca330f4565290543506

Download Submit
C:\Windows\System\fERRCvR.exe

Filesize
1.8MB

MD5
d4e45df62dbd692bf3cc8e5da6ef8d32

SHA1
712b4af84c8ac38ca78d3d6ce59f515b6141cf81

SHA256
fa28208e046541de3bd0531374c6e2ea015a03729467e9c92fa1c246c776484a

SHA512
fb1e19ff19cc125a847291a52e6a2fc63b2da0de06da009c29c8af46a06022be7d27fa850c0639fce1b603f8896e757bf840a579acf12a2fca9527f889acde65

Download Submit
C:\Windows\System\jETMlwI.exe

Filesize
1.8MB

MD5
35ae8d47cbbbd4492e361f93408cbcc3

SHA1
c637ced3e98a25a71fb6d3f8c883cc8bb1ef280e

SHA256
1c9315cb2a5d5af151a163fd328b90e37984ba7720a231366740a56b604cd9b3

SHA512
5c2bdc99373dcdad3cb80e808140c312587d731bf8f975b32ca13233c1430ebbe1716aa12d4ebfc8930a7b924a26c2d7791682f6ff6cf2fed383bd151eb3dba4

Download Submit
C:\Windows\System\jgDuZSv.exe

Filesize
1.8MB

MD5
763d1ef1c9fa6173e81a2941659572ac

SHA1
24b0ce2ed30c8de268f648b32618a90f92af57e3

SHA256
8c19cfadc037b282782979d96ba5f416b3a28816031de8d8cedd79c63a3ada01

SHA512
f61b6f68a0a36d64ce9010bfeb5a8f99e9a8a77457f92a9cde4e6d424899b66c802d21bc1bf921526ecc2ae306b7fffe37adad8ae520f88d88ea9200e3899a1c

Download Submit
C:\Windows\System\mCEklwZ.exe

Filesize
1.8MB

MD5
92ad9e1f47057dd295eba96c98e5a3f1

SHA1
f1c15d661d67d613931ca8e9ca61c9d4d485db43

SHA256
2f6a7d6dadbb3a3d3e21d7cc49eb6478b45ee83f7639b8dff9fb8fa52b239c78

SHA512
48c351cd9dfc619b161e953713d279ca65a355706bc6daf03e99b5b333a23366b76ecf6f03f33022d1bede7a7e458e1454c281d3f57cb3ad426fec1dbcc735e9

Download Submit
C:\Windows\System\mEYKkNW.exe

Filesize
1.8MB

MD5
72133a0d0730476019cb70b5bc4f0850

SHA1
6f8392260ac64a58894e5ef3d18c9186884a4c8e

SHA256
09ed27ce514918808702211ba6ac3907250cf56ad391a59ceb48a81b842bf15a

SHA512
7d668ca6fe1043aafe537d858b541518d8872d59a927478a4b69f59f99e424b3473126a9a957b72e7a4193574359f07df9ec68a50e56ae0da9aad5c1b8304899

Download Submit
C:\Windows\System\mbGUCJK.exe

Filesize
1.8MB

MD5
4930ecd696b545be030573b83b6a7e61

SHA1
1184289ab084feaf636b962950f3c5d2e28281ba

SHA256
7288d9fdc4bdf77eaab8db942f3e292b01d259f14462b52d4c0619d9b36cb680

SHA512
803a2a222b0d1289b20b25f24a1d1bb897921423872c46c06c69ca7b6f0faced829435fd07aff6a1df1a3dda4436d53ccedaf04cb6348a7291746958287a2fb5

Download Submit
C:\Windows\System\nxEZJjP.exe

Filesize
1.8MB

MD5
c2e06f64f193b6d5d1b440535c0f5e7e

SHA1
a18f526bd02f190f8060979e92e0d558511b4796

SHA256
8c7ee7accd3cd624fc928e3694c471e5e040bda06db9810c72c0d28a8a04cc36

SHA512
fdafa2101a2be44aea716b4523de9eeb8be0ac9b5e4f060febaf83a8c1e1d513ddf628800ab63323d765de59f7f11a9af2b7e5d56c4e33614a100ce691ca094f

Download Submit
C:\Windows\System\oRvTpjJ.exe

Filesize
1.8MB

MD5
dcc250f03c3ed870ced9c283455ced86

SHA1
0e4734542ac7278a2eda0c316de2a72c08c24bb3

SHA256
49e6ea08fb75895e799371c7ba951023cf7422edbd2a3c44a9f6b21e6ca08425

SHA512
37e183942995e0cb5b29138ca492e2ec82565e0a6d46399238e7110e89fdfe2f6a9dbb2ff618dfe847fed3a4181e915c3d14820748a68be67adfca412f710951

Download Submit
C:\Windows\System\ohoQlgD.exe

Filesize
1.8MB

MD5
0dc4db85663811d1bbbc6845155db37c

SHA1
afb9a37ed2b95d368d89ad049b855fbb17a4898e

SHA256
e8b030437110b2fcfc74cafa742ca6e4d4b113862a6694a54646f3f172709493

SHA512
b9514282559e0e44869351186601635ce31b33f2629be37eb7eaa03c509d61affa3b5486cb300d11e8fd2e865aa42a813a4648232b2fb61d55805ee783fb05fd

Download Submit
C:\Windows\System\rKvnnIQ.exe

Filesize
1.8MB

MD5
c7f540ab65d12ae52d332244b6f5cc5c

SHA1
cf3b4f12f771d744ad419fbb07f212c6f7ea1e00

SHA256
a02643e52ccea850e49a253d0f4aa2101019c2ce95eb31b1bc715f838d5e393e

SHA512
7858e7aac43f364f20f1483dac666fff397a392c2b46a4b2f667f1be8b4c7057ab944129e1737252abb1102751c8e62fe798aabc8bd4ee280a3f506816bf1f82

Download Submit
C:\Windows\System\rXRQSti.exe

Filesize
1.8MB

MD5
a2699ae248ad4fc2dbfbcc0c1d5f8a4c

SHA1
aa0844be55b7f93f7d1fac0e0dbfc739e937dc8a

SHA256
ec248918429f229daf07f2f02016abbed9650b2aaa56db55a6cba12af115309b

SHA512
e05472ab591ccc4114ead716b16aefebe76988e91cf031a762fc034ec73184da53d62b8d0284514dade28d72a4ab108b8dc034894a1eed292e5b0a687e8bf0f5

Download Submit
C:\Windows\System\sovCFhV.exe

Filesize
1.8MB

MD5
5a31763215e06380d169d49d2d6a14e2

SHA1
c5fe7e17b97e8d757e1fe17109087e8f910e5d56

SHA256
0fa10a069e4f09d53311389b98d9966de9c3d8e1b831b0db84aa9da22c96960b

SHA512
955f121aadc0374d7e217f48e49235c60a1e92c9b3f069f11589d511f7802c259c00bf77cfbf041bfdebbed9df8cde3682d04c98ab63dbe907550c840a7d1e28

Download Submit
C:\Windows\System\tFsdxrk.exe

Filesize
1.8MB

MD5
993a401838727b83e1fef9def02eae32

SHA1
9d2c0b0e4f27c8aa78931f0204e4789f98151f23

SHA256
8b3c0046100a6e0cf7c024459a4ac3d44da1c6d739b7ab9093ee03b30a92435e

SHA512
1d6c71e083ffc5ffb50e00a6e61995f06c20e4dc121fad4197e7127ecd6c58000e72128be01f21aaf91b92cf129a94f5b7bbdaf2bedec0bc589e1b140c73dc86

Download Submit
C:\Windows\System\uCFAkQh.exe

Filesize
1.8MB

MD5
fde43109b3c979825d5f798ada0d7245

SHA1
6a0864e01128c3a5466225ad51cc969c33c6b8c6

SHA256
248ce0e3e4d395d956dbf320d21236b6d073340c33478b6dce905281afe0cd72

SHA512
d5fe83a2c5b414d4a18d7ef9b9d369c7167510edf1868bf2fc841a2a9548d52e24a61042ed209e31b52a8e15da214cdc015ac8df874dfc9fd6c7b065db0f3a77

Download Submit
C:\Windows\System\xjzDqcL.exe

Filesize
1.8MB

MD5
7bf66c130aa6884fb70072397f4fdce8

SHA1
5872f8e039ff7caeb688ef6130b7abc30c6e38ce

SHA256
77380cc19250d81509b904a640848bba71043c753eb7097f4bcd51a2c22cec9a

SHA512
b8a0239ae98e529021978a616508b269df7868b992f9cf122362a7b466850f4e56d7d28b22c3d0db0867eab1e3329da28e826c17acf80fa1e79bfdb09da8e863

Download Submit
C:\Windows\System\zVFGtre.exe

Filesize
1.8MB

MD5
6061f117ad68b0902c1e852739d4267a

SHA1
22de11cacc246a179e5839541a4eb9fc74aacfd7

SHA256
a036018143c9d4c4f0b52081e1ce67f259eb27a72fde4abae4674f2344c34d62

SHA512
1cab295516ef7fd32d8c00a5037ec9bfe42b17f8762dd785b41f8ef2b82a45b6f4d7d73422e42ee60c2dda85c76f17deee5fcd4694308d49c8ce378a1a976ef1

Download Submit
memory/4396-0-0x0000024842330000-0x0000024842340000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads