xmrig | bc33e76b76a8d328a36d6a8edf125db67d09fe430b6b8e30565f7d993bf5682b

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
25-01-2025 05:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bc33e76b76a8d328a36d6a8edf125db67d09fe430b6b8e30565f7d993bf5682b.exe
Size

1.8MB
MD5

18ec7b0a430fb5426e66741fcd4893a0
SHA1

740dfc822a2c4c52cda28c06b68f4baeaf549492
SHA256

bc33e76b76a8d328a36d6a8edf125db67d09fe430b6b8e30565f7d993bf5682b
SHA512

5a41a8ae91a90c9bdd6d546b98563ee661375ea73d8b1d5af37af57d6c977e6afaa6ecff436316ce761a95872f07ee65bc85aabd44637ced3c5c66361ee04608
SSDEEP

49152:GezaTF8FcNkNdfE0pZ9ozttwIRRXRnn7Id2qH:GemTLkNdfE0pZyI

Score

10^/10

xmrig miner persistence privilege_escalation

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 33 IoCs

miner

resource	yara_rule
behavioral2/files/0x000c000000023b17-4.dat	xmrig
behavioral2/files/0x000a000000023b7a-8.dat	xmrig
behavioral2/files/0x000b000000023b76-9.dat	xmrig
behavioral2/files/0x000a000000023b7b-18.dat	xmrig
behavioral2/files/0x000a000000023b7c-22.dat	xmrig
behavioral2/files/0x000a000000023b7d-32.dat	xmrig
behavioral2/files/0x000a000000023b7e-34.dat	xmrig
behavioral2/files/0x000a000000023b7f-38.dat	xmrig
behavioral2/files/0x000a000000023b80-44.dat	xmrig
behavioral2/files/0x000a000000023b81-50.dat	xmrig
behavioral2/files/0x000a000000023b82-54.dat	xmrig
behavioral2/files/0x000a000000023b83-59.dat	xmrig
behavioral2/files/0x000a000000023b85-65.dat	xmrig
behavioral2/files/0x000a000000023b86-70.dat	xmrig
behavioral2/files/0x000a000000023b87-74.dat	xmrig
behavioral2/files/0x000a000000023b88-79.dat	xmrig
behavioral2/files/0x000a000000023b89-85.dat	xmrig
behavioral2/files/0x000a000000023b8a-89.dat	xmrig
behavioral2/files/0x000a000000023b8b-94.dat	xmrig
behavioral2/files/0x000a000000023b8f-112.dat	xmrig
behavioral2/files/0x0009000000023bb2-162.dat	xmrig
behavioral2/files/0x0009000000023bb1-159.dat	xmrig
behavioral2/files/0x0008000000023bac-157.dat	xmrig
behavioral2/files/0x000e000000023ba3-153.dat	xmrig
behavioral2/files/0x000a000000023b9c-148.dat	xmrig
behavioral2/files/0x000b000000023b94-142.dat	xmrig
behavioral2/files/0x000b000000023b93-138.dat	xmrig
behavioral2/files/0x000b000000023b92-132.dat	xmrig
behavioral2/files/0x000a000000023b91-128.dat	xmrig
behavioral2/files/0x000a000000023b90-122.dat	xmrig
behavioral2/files/0x000a000000023b8e-113.dat	xmrig
behavioral2/files/0x000a000000023b8d-108.dat	xmrig
behavioral2/files/0x000a000000023b8c-103.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
5084	uEQwMPd.exe
5032	RyJMgnQ.exe
852	GdneARS.exe
1972	qXTheAw.exe
4464	bGmKwUL.exe
2404	CXOJqnm.exe
3936	FIrBUCR.exe
3320	ZicrieY.exe
1548	fGOsQMS.exe
4364	zwDXOcR.exe
5028	rhZdWaq.exe
3808	WUetCUw.exe
2432	Ehovghw.exe
2376	TuwsHBD.exe
2224	SRRCKup.exe
4064	YETUZbE.exe
3456	QDGsAPg.exe
1844	DHDuczL.exe
3772	xKAKuMg.exe
3388	lgLrnOS.exe
408	SsUPrCn.exe
748	CheOeYV.exe
4492	wBxTlPb.exe
2512	MXuRDaA.exe
2592	ZGGnwpC.exe
1368	JBdQAzZ.exe
3104	jrJbxDj.exe
4484	JByvRTN.exe
4632	btryQHt.exe
3568	LNqQPtJ.exe
208	yHmsFnb.exe
916	ZmkoUuT.exe
3372	KsfEzTE.exe
4992	IUYAJPQ.exe
216	tSLtdaf.exe
3504	OkCBdeD.exe
1148	UtxNTEE.exe
3816	FstKzTf.exe
3440	LVFKhrw.exe
1540	mhXMIFS.exe
1580	xebZpSu.exe
2284	lfPZQII.exe
4844	RGqnuFm.exe
1080	xQszJSj.exe
5060	yzgLjOy.exe
3220	YSLogqe.exe
3820	oBMZbLX.exe
2556	eEzlvVP.exe
4580	vCDRTMi.exe
1984	CRsrkFF.exe
368	ctXySXQ.exe
4412	UJynuOh.exe
2180	IwDWuQb.exe
4196	ypzMXsl.exe
1968	GDYBMeT.exe
3080	RaXyIPp.exe
388	BUGPiBF.exe
2216	HTMWhEM.exe
4752	KLogwHT.exe
4560	SvjFAIA.exe
3976	MMGzJSW.exe
2176	IRGTCCs.exe
3336	BazkuMj.exe
4528	tuMBKGb.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\lLlMfPc.exe	bc33e76b76a8d328a36d6a8edf125db67d09fe430b6b8e30565f7d993bf5682b.exe
File created	C:\Windows\System\VxnWWxE.exe	bc33e76b76a8d328a36d6a8edf125db67d09fe430b6b8e30565f7d993bf5682b.exe
File created	C:\Windows\System\ToWTrOp.exe	bc33e76b76a8d328a36d6a8edf125db67d09fe430b6b8e30565f7d993bf5682b.exe
File created	C:\Windows\System\jGTmnft.exe	bc33e76b76a8d328a36d6a8edf125db67d09fe430b6b8e30565f7d993bf5682b.exe
File created	C:\Windows\System\RyJMgnQ.exe	bc33e76b76a8d328a36d6a8edf125db67d09fe430b6b8e30565f7d993bf5682b.exe
File created	C:\Windows\System\lfGpeIT.exe	bc33e76b76a8d328a36d6a8edf125db67d09fe430b6b8e30565f7d993bf5682b.exe
File created	C:\Windows\System\ZjQdsZu.exe	bc33e76b76a8d328a36d6a8edf125db67d09fe430b6b8e30565f7d993bf5682b.exe
File created	C:\Windows\System\ZsWxdEe.exe	bc33e76b76a8d328a36d6a8edf125db67d09fe430b6b8e30565f7d993bf5682b.exe
File created	C:\Windows\System\RWGEVNv.exe	bc33e76b76a8d328a36d6a8edf125db67d09fe430b6b8e30565f7d993bf5682b.exe
File created	C:\Windows\System\UtxNTEE.exe	bc33e76b76a8d328a36d6a8edf125db67d09fe430b6b8e30565f7d993bf5682b.exe
File created	C:\Windows\System\xQszJSj.exe	bc33e76b76a8d328a36d6a8edf125db67d09fe430b6b8e30565f7d993bf5682b.exe
File created	C:\Windows\System\xuglCbb.exe	bc33e76b76a8d328a36d6a8edf125db67d09fe430b6b8e30565f7d993bf5682b.exe
File created	C:\Windows\System\scynsbE.exe	bc33e76b76a8d328a36d6a8edf125db67d09fe430b6b8e30565f7d993bf5682b.exe
File created	C:\Windows\System\QxHGyCR.exe	bc33e76b76a8d328a36d6a8edf125db67d09fe430b6b8e30565f7d993bf5682b.exe
File created	C:\Windows\System\aJsVBqa.exe	bc33e76b76a8d328a36d6a8edf125db67d09fe430b6b8e30565f7d993bf5682b.exe
File created	C:\Windows\System\uSkoIWn.exe	bc33e76b76a8d328a36d6a8edf125db67d09fe430b6b8e30565f7d993bf5682b.exe
File created	C:\Windows\System\MLlIMhu.exe	bc33e76b76a8d328a36d6a8edf125db67d09fe430b6b8e30565f7d993bf5682b.exe
File created	C:\Windows\System\QiyMWoR.exe	bc33e76b76a8d328a36d6a8edf125db67d09fe430b6b8e30565f7d993bf5682b.exe
File created	C:\Windows\System\fCyVpCw.exe	bc33e76b76a8d328a36d6a8edf125db67d09fe430b6b8e30565f7d993bf5682b.exe
File created	C:\Windows\System\chmIpTL.exe	bc33e76b76a8d328a36d6a8edf125db67d09fe430b6b8e30565f7d993bf5682b.exe
File created	C:\Windows\System\VAfsdNu.exe	bc33e76b76a8d328a36d6a8edf125db67d09fe430b6b8e30565f7d993bf5682b.exe
File created	C:\Windows\System\JHsHCFi.exe	bc33e76b76a8d328a36d6a8edf125db67d09fe430b6b8e30565f7d993bf5682b.exe
File created	C:\Windows\System\LIXSDeW.exe	bc33e76b76a8d328a36d6a8edf125db67d09fe430b6b8e30565f7d993bf5682b.exe
File created	C:\Windows\System\gQgHapx.exe	bc33e76b76a8d328a36d6a8edf125db67d09fe430b6b8e30565f7d993bf5682b.exe
File created	C:\Windows\System\nHLSlNG.exe	bc33e76b76a8d328a36d6a8edf125db67d09fe430b6b8e30565f7d993bf5682b.exe
File created	C:\Windows\System\uVQqEUX.exe	bc33e76b76a8d328a36d6a8edf125db67d09fe430b6b8e30565f7d993bf5682b.exe
File created	C:\Windows\System\rblqjNk.exe	bc33e76b76a8d328a36d6a8edf125db67d09fe430b6b8e30565f7d993bf5682b.exe
File created	C:\Windows\System\gMrRSaR.exe	bc33e76b76a8d328a36d6a8edf125db67d09fe430b6b8e30565f7d993bf5682b.exe
File created	C:\Windows\System\puViKSa.exe	bc33e76b76a8d328a36d6a8edf125db67d09fe430b6b8e30565f7d993bf5682b.exe
File created	C:\Windows\System\zLBgLad.exe	bc33e76b76a8d328a36d6a8edf125db67d09fe430b6b8e30565f7d993bf5682b.exe
File created	C:\Windows\System\mNnwwxI.exe	bc33e76b76a8d328a36d6a8edf125db67d09fe430b6b8e30565f7d993bf5682b.exe
File created	C:\Windows\System\RTMHArI.exe	bc33e76b76a8d328a36d6a8edf125db67d09fe430b6b8e30565f7d993bf5682b.exe
File created	C:\Windows\System\sWonOMX.exe	bc33e76b76a8d328a36d6a8edf125db67d09fe430b6b8e30565f7d993bf5682b.exe
File created	C:\Windows\System\YoyCyEC.exe	bc33e76b76a8d328a36d6a8edf125db67d09fe430b6b8e30565f7d993bf5682b.exe
File created	C:\Windows\System\bWGieKs.exe	bc33e76b76a8d328a36d6a8edf125db67d09fe430b6b8e30565f7d993bf5682b.exe
File created	C:\Windows\System\FZTLfAV.exe	bc33e76b76a8d328a36d6a8edf125db67d09fe430b6b8e30565f7d993bf5682b.exe
File created	C:\Windows\System\wEFkswS.exe	bc33e76b76a8d328a36d6a8edf125db67d09fe430b6b8e30565f7d993bf5682b.exe
File created	C:\Windows\System\IefGpor.exe	bc33e76b76a8d328a36d6a8edf125db67d09fe430b6b8e30565f7d993bf5682b.exe
File created	C:\Windows\System\DjwEaQr.exe	bc33e76b76a8d328a36d6a8edf125db67d09fe430b6b8e30565f7d993bf5682b.exe
File created	C:\Windows\System\fnZIchZ.exe	bc33e76b76a8d328a36d6a8edf125db67d09fe430b6b8e30565f7d993bf5682b.exe
File created	C:\Windows\System\MUDUvrF.exe	bc33e76b76a8d328a36d6a8edf125db67d09fe430b6b8e30565f7d993bf5682b.exe
File created	C:\Windows\System\XNFaFpa.exe	bc33e76b76a8d328a36d6a8edf125db67d09fe430b6b8e30565f7d993bf5682b.exe
File created	C:\Windows\System\FgQhkLR.exe	bc33e76b76a8d328a36d6a8edf125db67d09fe430b6b8e30565f7d993bf5682b.exe
File created	C:\Windows\System\vecwaKG.exe	bc33e76b76a8d328a36d6a8edf125db67d09fe430b6b8e30565f7d993bf5682b.exe
File created	C:\Windows\System\ohTOkNI.exe	bc33e76b76a8d328a36d6a8edf125db67d09fe430b6b8e30565f7d993bf5682b.exe
File created	C:\Windows\System\uDqDJaU.exe	bc33e76b76a8d328a36d6a8edf125db67d09fe430b6b8e30565f7d993bf5682b.exe
File created	C:\Windows\System\iMdfoAN.exe	bc33e76b76a8d328a36d6a8edf125db67d09fe430b6b8e30565f7d993bf5682b.exe
File created	C:\Windows\System\BgxHPXy.exe	bc33e76b76a8d328a36d6a8edf125db67d09fe430b6b8e30565f7d993bf5682b.exe
File created	C:\Windows\System\WqLioWf.exe	bc33e76b76a8d328a36d6a8edf125db67d09fe430b6b8e30565f7d993bf5682b.exe
File created	C:\Windows\System\dmMSglk.exe	bc33e76b76a8d328a36d6a8edf125db67d09fe430b6b8e30565f7d993bf5682b.exe
File created	C:\Windows\System\JWUdnxR.exe	bc33e76b76a8d328a36d6a8edf125db67d09fe430b6b8e30565f7d993bf5682b.exe
File created	C:\Windows\System\rPwetbE.exe	bc33e76b76a8d328a36d6a8edf125db67d09fe430b6b8e30565f7d993bf5682b.exe
File created	C:\Windows\System\DlzXOId.exe	bc33e76b76a8d328a36d6a8edf125db67d09fe430b6b8e30565f7d993bf5682b.exe
File created	C:\Windows\System\lMRZaCy.exe	bc33e76b76a8d328a36d6a8edf125db67d09fe430b6b8e30565f7d993bf5682b.exe
File created	C:\Windows\System\JTbbAuF.exe	bc33e76b76a8d328a36d6a8edf125db67d09fe430b6b8e30565f7d993bf5682b.exe
File created	C:\Windows\System\ErCYfpd.exe	bc33e76b76a8d328a36d6a8edf125db67d09fe430b6b8e30565f7d993bf5682b.exe
File created	C:\Windows\System\LANgaDU.exe	bc33e76b76a8d328a36d6a8edf125db67d09fe430b6b8e30565f7d993bf5682b.exe
File created	C:\Windows\System\OYNhEMS.exe	bc33e76b76a8d328a36d6a8edf125db67d09fe430b6b8e30565f7d993bf5682b.exe
File created	C:\Windows\System\jlqhATC.exe	bc33e76b76a8d328a36d6a8edf125db67d09fe430b6b8e30565f7d993bf5682b.exe
File created	C:\Windows\System\oiDVFJf.exe	bc33e76b76a8d328a36d6a8edf125db67d09fe430b6b8e30565f7d993bf5682b.exe
File created	C:\Windows\System\CAEOmTs.exe	bc33e76b76a8d328a36d6a8edf125db67d09fe430b6b8e30565f7d993bf5682b.exe
File created	C:\Windows\System\WkQVvpo.exe	bc33e76b76a8d328a36d6a8edf125db67d09fe430b6b8e30565f7d993bf5682b.exe
File created	C:\Windows\System\IrXbURk.exe	bc33e76b76a8d328a36d6a8edf125db67d09fe430b6b8e30565f7d993bf5682b.exe
File created	C:\Windows\System\HOaGKna.exe	bc33e76b76a8d328a36d6a8edf125db67d09fe430b6b8e30565f7d993bf5682b.exe

Event Triggered Execution: Accessibility Features 1 TTPs
Windows contains accessibility features that may be used by adversaries to establish persistence and/or elevate privileges.
persistence privilege_escalation

Accessibility Features
T1546.008

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	17080	dwm.exe
Token: SeChangeNotifyPrivilege	17080	dwm.exe
Token: 33	17080	dwm.exe
Token: SeIncBasePriorityPrivilege	17080	dwm.exe
Token: SeShutdownPrivilege	17080	dwm.exe
Token: SeCreatePagefilePrivilege	17080	dwm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1348 wrote to memory of 5084	1348	bc33e76b76a8d328a36d6a8edf125db67d09fe430b6b8e30565f7d993bf5682b.exe	84
PID 1348 wrote to memory of 5084	1348	bc33e76b76a8d328a36d6a8edf125db67d09fe430b6b8e30565f7d993bf5682b.exe	84
PID 1348 wrote to memory of 5032	1348	bc33e76b76a8d328a36d6a8edf125db67d09fe430b6b8e30565f7d993bf5682b.exe	85
PID 1348 wrote to memory of 5032	1348	bc33e76b76a8d328a36d6a8edf125db67d09fe430b6b8e30565f7d993bf5682b.exe	85
PID 1348 wrote to memory of 852	1348	bc33e76b76a8d328a36d6a8edf125db67d09fe430b6b8e30565f7d993bf5682b.exe	86
PID 1348 wrote to memory of 852	1348	bc33e76b76a8d328a36d6a8edf125db67d09fe430b6b8e30565f7d993bf5682b.exe	86
PID 1348 wrote to memory of 1972	1348	bc33e76b76a8d328a36d6a8edf125db67d09fe430b6b8e30565f7d993bf5682b.exe	87
PID 1348 wrote to memory of 1972	1348	bc33e76b76a8d328a36d6a8edf125db67d09fe430b6b8e30565f7d993bf5682b.exe	87
PID 1348 wrote to memory of 4464	1348	bc33e76b76a8d328a36d6a8edf125db67d09fe430b6b8e30565f7d993bf5682b.exe	88
PID 1348 wrote to memory of 4464	1348	bc33e76b76a8d328a36d6a8edf125db67d09fe430b6b8e30565f7d993bf5682b.exe	88
PID 1348 wrote to memory of 2404	1348	bc33e76b76a8d328a36d6a8edf125db67d09fe430b6b8e30565f7d993bf5682b.exe	89
PID 1348 wrote to memory of 2404	1348	bc33e76b76a8d328a36d6a8edf125db67d09fe430b6b8e30565f7d993bf5682b.exe	89
PID 1348 wrote to memory of 3936	1348	bc33e76b76a8d328a36d6a8edf125db67d09fe430b6b8e30565f7d993bf5682b.exe	90
PID 1348 wrote to memory of 3936	1348	bc33e76b76a8d328a36d6a8edf125db67d09fe430b6b8e30565f7d993bf5682b.exe	90
PID 1348 wrote to memory of 3320	1348	bc33e76b76a8d328a36d6a8edf125db67d09fe430b6b8e30565f7d993bf5682b.exe	91
PID 1348 wrote to memory of 3320	1348	bc33e76b76a8d328a36d6a8edf125db67d09fe430b6b8e30565f7d993bf5682b.exe	91
PID 1348 wrote to memory of 1548	1348	bc33e76b76a8d328a36d6a8edf125db67d09fe430b6b8e30565f7d993bf5682b.exe	92
PID 1348 wrote to memory of 1548	1348	bc33e76b76a8d328a36d6a8edf125db67d09fe430b6b8e30565f7d993bf5682b.exe	92
PID 1348 wrote to memory of 4364	1348	bc33e76b76a8d328a36d6a8edf125db67d09fe430b6b8e30565f7d993bf5682b.exe	93
PID 1348 wrote to memory of 4364	1348	bc33e76b76a8d328a36d6a8edf125db67d09fe430b6b8e30565f7d993bf5682b.exe	93
PID 1348 wrote to memory of 5028	1348	bc33e76b76a8d328a36d6a8edf125db67d09fe430b6b8e30565f7d993bf5682b.exe	94
PID 1348 wrote to memory of 5028	1348	bc33e76b76a8d328a36d6a8edf125db67d09fe430b6b8e30565f7d993bf5682b.exe	94
PID 1348 wrote to memory of 3808	1348	bc33e76b76a8d328a36d6a8edf125db67d09fe430b6b8e30565f7d993bf5682b.exe	95
PID 1348 wrote to memory of 3808	1348	bc33e76b76a8d328a36d6a8edf125db67d09fe430b6b8e30565f7d993bf5682b.exe	95
PID 1348 wrote to memory of 2432	1348	bc33e76b76a8d328a36d6a8edf125db67d09fe430b6b8e30565f7d993bf5682b.exe	96
PID 1348 wrote to memory of 2432	1348	bc33e76b76a8d328a36d6a8edf125db67d09fe430b6b8e30565f7d993bf5682b.exe	96
PID 1348 wrote to memory of 2376	1348	bc33e76b76a8d328a36d6a8edf125db67d09fe430b6b8e30565f7d993bf5682b.exe	97
PID 1348 wrote to memory of 2376	1348	bc33e76b76a8d328a36d6a8edf125db67d09fe430b6b8e30565f7d993bf5682b.exe	97
PID 1348 wrote to memory of 2224	1348	bc33e76b76a8d328a36d6a8edf125db67d09fe430b6b8e30565f7d993bf5682b.exe	98
PID 1348 wrote to memory of 2224	1348	bc33e76b76a8d328a36d6a8edf125db67d09fe430b6b8e30565f7d993bf5682b.exe	98
PID 1348 wrote to memory of 4064	1348	bc33e76b76a8d328a36d6a8edf125db67d09fe430b6b8e30565f7d993bf5682b.exe	99
PID 1348 wrote to memory of 4064	1348	bc33e76b76a8d328a36d6a8edf125db67d09fe430b6b8e30565f7d993bf5682b.exe	99
PID 1348 wrote to memory of 3456	1348	bc33e76b76a8d328a36d6a8edf125db67d09fe430b6b8e30565f7d993bf5682b.exe	100
PID 1348 wrote to memory of 3456	1348	bc33e76b76a8d328a36d6a8edf125db67d09fe430b6b8e30565f7d993bf5682b.exe	100
PID 1348 wrote to memory of 1844	1348	bc33e76b76a8d328a36d6a8edf125db67d09fe430b6b8e30565f7d993bf5682b.exe	101
PID 1348 wrote to memory of 1844	1348	bc33e76b76a8d328a36d6a8edf125db67d09fe430b6b8e30565f7d993bf5682b.exe	101
PID 1348 wrote to memory of 3772	1348	bc33e76b76a8d328a36d6a8edf125db67d09fe430b6b8e30565f7d993bf5682b.exe	102
PID 1348 wrote to memory of 3772	1348	bc33e76b76a8d328a36d6a8edf125db67d09fe430b6b8e30565f7d993bf5682b.exe	102
PID 1348 wrote to memory of 3388	1348	bc33e76b76a8d328a36d6a8edf125db67d09fe430b6b8e30565f7d993bf5682b.exe	103
PID 1348 wrote to memory of 3388	1348	bc33e76b76a8d328a36d6a8edf125db67d09fe430b6b8e30565f7d993bf5682b.exe	103
PID 1348 wrote to memory of 408	1348	bc33e76b76a8d328a36d6a8edf125db67d09fe430b6b8e30565f7d993bf5682b.exe	104
PID 1348 wrote to memory of 408	1348	bc33e76b76a8d328a36d6a8edf125db67d09fe430b6b8e30565f7d993bf5682b.exe	104
PID 1348 wrote to memory of 748	1348	bc33e76b76a8d328a36d6a8edf125db67d09fe430b6b8e30565f7d993bf5682b.exe	105
PID 1348 wrote to memory of 748	1348	bc33e76b76a8d328a36d6a8edf125db67d09fe430b6b8e30565f7d993bf5682b.exe	105
PID 1348 wrote to memory of 4492	1348	bc33e76b76a8d328a36d6a8edf125db67d09fe430b6b8e30565f7d993bf5682b.exe	106
PID 1348 wrote to memory of 4492	1348	bc33e76b76a8d328a36d6a8edf125db67d09fe430b6b8e30565f7d993bf5682b.exe	106
PID 1348 wrote to memory of 2512	1348	bc33e76b76a8d328a36d6a8edf125db67d09fe430b6b8e30565f7d993bf5682b.exe	107
PID 1348 wrote to memory of 2512	1348	bc33e76b76a8d328a36d6a8edf125db67d09fe430b6b8e30565f7d993bf5682b.exe	107
PID 1348 wrote to memory of 2592	1348	bc33e76b76a8d328a36d6a8edf125db67d09fe430b6b8e30565f7d993bf5682b.exe	108
PID 1348 wrote to memory of 2592	1348	bc33e76b76a8d328a36d6a8edf125db67d09fe430b6b8e30565f7d993bf5682b.exe	108
PID 1348 wrote to memory of 1368	1348	bc33e76b76a8d328a36d6a8edf125db67d09fe430b6b8e30565f7d993bf5682b.exe	109
PID 1348 wrote to memory of 1368	1348	bc33e76b76a8d328a36d6a8edf125db67d09fe430b6b8e30565f7d993bf5682b.exe	109
PID 1348 wrote to memory of 3104	1348	bc33e76b76a8d328a36d6a8edf125db67d09fe430b6b8e30565f7d993bf5682b.exe	110
PID 1348 wrote to memory of 3104	1348	bc33e76b76a8d328a36d6a8edf125db67d09fe430b6b8e30565f7d993bf5682b.exe	110
PID 1348 wrote to memory of 4484	1348	bc33e76b76a8d328a36d6a8edf125db67d09fe430b6b8e30565f7d993bf5682b.exe	111
PID 1348 wrote to memory of 4484	1348	bc33e76b76a8d328a36d6a8edf125db67d09fe430b6b8e30565f7d993bf5682b.exe	111
PID 1348 wrote to memory of 4632	1348	bc33e76b76a8d328a36d6a8edf125db67d09fe430b6b8e30565f7d993bf5682b.exe	112
PID 1348 wrote to memory of 4632	1348	bc33e76b76a8d328a36d6a8edf125db67d09fe430b6b8e30565f7d993bf5682b.exe	112
PID 1348 wrote to memory of 3568	1348	bc33e76b76a8d328a36d6a8edf125db67d09fe430b6b8e30565f7d993bf5682b.exe	113
PID 1348 wrote to memory of 3568	1348	bc33e76b76a8d328a36d6a8edf125db67d09fe430b6b8e30565f7d993bf5682b.exe	113
PID 1348 wrote to memory of 208	1348	bc33e76b76a8d328a36d6a8edf125db67d09fe430b6b8e30565f7d993bf5682b.exe	114
PID 1348 wrote to memory of 208	1348	bc33e76b76a8d328a36d6a8edf125db67d09fe430b6b8e30565f7d993bf5682b.exe	114
PID 1348 wrote to memory of 916	1348	bc33e76b76a8d328a36d6a8edf125db67d09fe430b6b8e30565f7d993bf5682b.exe	115
PID 1348 wrote to memory of 916	1348	bc33e76b76a8d328a36d6a8edf125db67d09fe430b6b8e30565f7d993bf5682b.exe	115

C:\Users\Admin\AppData\Local\Temp\bc33e76b76a8d328a36d6a8edf125db67d09fe430b6b8e30565f7d993bf5682b.exe
"C:\Users\Admin\AppData\Local\Temp\bc33e76b76a8d328a36d6a8edf125db67d09fe430b6b8e30565f7d993bf5682b.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1348
- C:\Windows\System\uEQwMPd.exe
  C:\Windows\System\uEQwMPd.exe
  2⤵
  - Executes dropped EXE
  PID:5084
- C:\Windows\System\RyJMgnQ.exe
  C:\Windows\System\RyJMgnQ.exe
  2⤵
  - Executes dropped EXE
  PID:5032
- C:\Windows\System\GdneARS.exe
  C:\Windows\System\GdneARS.exe
  2⤵
  - Executes dropped EXE
  PID:852
- C:\Windows\System\qXTheAw.exe
  C:\Windows\System\qXTheAw.exe
  2⤵
  - Executes dropped EXE
  PID:1972
- C:\Windows\System\bGmKwUL.exe
  C:\Windows\System\bGmKwUL.exe
  2⤵
  - Executes dropped EXE
  PID:4464
- C:\Windows\System\CXOJqnm.exe
  C:\Windows\System\CXOJqnm.exe
  2⤵
  - Executes dropped EXE
  PID:2404
- C:\Windows\System\FIrBUCR.exe
  C:\Windows\System\FIrBUCR.exe
  2⤵
  - Executes dropped EXE
  PID:3936
- C:\Windows\System\ZicrieY.exe
  C:\Windows\System\ZicrieY.exe
  2⤵
  - Executes dropped EXE
  PID:3320
- C:\Windows\System\fGOsQMS.exe
  C:\Windows\System\fGOsQMS.exe
  2⤵
  - Executes dropped EXE
  PID:1548
- C:\Windows\System\zwDXOcR.exe
  C:\Windows\System\zwDXOcR.exe
  2⤵
  - Executes dropped EXE
  PID:4364
- C:\Windows\System\rhZdWaq.exe
  C:\Windows\System\rhZdWaq.exe
  2⤵
  - Executes dropped EXE
  PID:5028
- C:\Windows\System\WUetCUw.exe
  C:\Windows\System\WUetCUw.exe
  2⤵
  - Executes dropped EXE
  PID:3808
- C:\Windows\System\Ehovghw.exe
  C:\Windows\System\Ehovghw.exe
  2⤵
  - Executes dropped EXE
  PID:2432
- C:\Windows\System\TuwsHBD.exe
  C:\Windows\System\TuwsHBD.exe
  2⤵
  - Executes dropped EXE
  PID:2376
- C:\Windows\System\SRRCKup.exe
  C:\Windows\System\SRRCKup.exe
  2⤵
  - Executes dropped EXE
  PID:2224
- C:\Windows\System\YETUZbE.exe
  C:\Windows\System\YETUZbE.exe
  2⤵
  - Executes dropped EXE
  PID:4064
- C:\Windows\System\QDGsAPg.exe
  C:\Windows\System\QDGsAPg.exe
  2⤵
  - Executes dropped EXE
  PID:3456
- C:\Windows\System\DHDuczL.exe
  C:\Windows\System\DHDuczL.exe
  2⤵
  - Executes dropped EXE
  PID:1844
- C:\Windows\System\xKAKuMg.exe
  C:\Windows\System\xKAKuMg.exe
  2⤵
  - Executes dropped EXE
  PID:3772
- C:\Windows\System\lgLrnOS.exe
  C:\Windows\System\lgLrnOS.exe
  2⤵
  - Executes dropped EXE
  PID:3388
- C:\Windows\System\SsUPrCn.exe
  C:\Windows\System\SsUPrCn.exe
  2⤵
  - Executes dropped EXE
  PID:408
- C:\Windows\System\CheOeYV.exe
  C:\Windows\System\CheOeYV.exe
  2⤵
  - Executes dropped EXE
  PID:748
- C:\Windows\System\wBxTlPb.exe
  C:\Windows\System\wBxTlPb.exe
  2⤵
  - Executes dropped EXE
  PID:4492
- C:\Windows\System\MXuRDaA.exe
  C:\Windows\System\MXuRDaA.exe
  2⤵
  - Executes dropped EXE
  PID:2512
- C:\Windows\System\ZGGnwpC.exe
  C:\Windows\System\ZGGnwpC.exe
  2⤵
  - Executes dropped EXE
  PID:2592
- C:\Windows\System\JBdQAzZ.exe
  C:\Windows\System\JBdQAzZ.exe
  2⤵
  - Executes dropped EXE
  PID:1368
- C:\Windows\System\jrJbxDj.exe
  C:\Windows\System\jrJbxDj.exe
  2⤵
  - Executes dropped EXE
  PID:3104
- C:\Windows\System\JByvRTN.exe
  C:\Windows\System\JByvRTN.exe
  2⤵
  - Executes dropped EXE
  PID:4484
- C:\Windows\System\btryQHt.exe
  C:\Windows\System\btryQHt.exe
  2⤵
  - Executes dropped EXE
  PID:4632
- C:\Windows\System\LNqQPtJ.exe
  C:\Windows\System\LNqQPtJ.exe
  2⤵
  - Executes dropped EXE
  PID:3568
- C:\Windows\System\yHmsFnb.exe
  C:\Windows\System\yHmsFnb.exe
  2⤵
  - Executes dropped EXE
  PID:208
- C:\Windows\System\ZmkoUuT.exe
  C:\Windows\System\ZmkoUuT.exe
  2⤵
  - Executes dropped EXE
  PID:916
- C:\Windows\System\KsfEzTE.exe
  C:\Windows\System\KsfEzTE.exe
  2⤵
  - Executes dropped EXE
  PID:3372
- C:\Windows\System\IUYAJPQ.exe
  C:\Windows\System\IUYAJPQ.exe
  2⤵
  - Executes dropped EXE
  PID:4992
- C:\Windows\System\tSLtdaf.exe
  C:\Windows\System\tSLtdaf.exe
  2⤵
  - Executes dropped EXE
  PID:216
- C:\Windows\System\OkCBdeD.exe
  C:\Windows\System\OkCBdeD.exe
  2⤵
  - Executes dropped EXE
  PID:3504
- C:\Windows\System\UtxNTEE.exe
  C:\Windows\System\UtxNTEE.exe
  2⤵
  - Executes dropped EXE
  PID:1148
- C:\Windows\System\FstKzTf.exe
  C:\Windows\System\FstKzTf.exe
  2⤵
  - Executes dropped EXE
  PID:3816
- C:\Windows\System\LVFKhrw.exe
  C:\Windows\System\LVFKhrw.exe
  2⤵
  - Executes dropped EXE
  PID:3440
- C:\Windows\System\mhXMIFS.exe
  C:\Windows\System\mhXMIFS.exe
  2⤵
  - Executes dropped EXE
  PID:1540
- C:\Windows\System\xebZpSu.exe
  C:\Windows\System\xebZpSu.exe
  2⤵
  - Executes dropped EXE
  PID:1580
- C:\Windows\System\lfPZQII.exe
  C:\Windows\System\lfPZQII.exe
  2⤵
  - Executes dropped EXE
  PID:2284
- C:\Windows\System\RGqnuFm.exe
  C:\Windows\System\RGqnuFm.exe
  2⤵
  - Executes dropped EXE
  PID:4844
- C:\Windows\System\xQszJSj.exe
  C:\Windows\System\xQszJSj.exe
  2⤵
  - Executes dropped EXE
  PID:1080
- C:\Windows\System\yzgLjOy.exe
  C:\Windows\System\yzgLjOy.exe
  2⤵
  - Executes dropped EXE
  PID:5060
- C:\Windows\System\YSLogqe.exe
  C:\Windows\System\YSLogqe.exe
  2⤵
  - Executes dropped EXE
  PID:3220
- C:\Windows\System\oBMZbLX.exe
  C:\Windows\System\oBMZbLX.exe
  2⤵
  - Executes dropped EXE
  PID:3820
- C:\Windows\System\eEzlvVP.exe
  C:\Windows\System\eEzlvVP.exe
  2⤵
  - Executes dropped EXE
  PID:2556
- C:\Windows\System\vCDRTMi.exe
  C:\Windows\System\vCDRTMi.exe
  2⤵
  - Executes dropped EXE
  PID:4580
- C:\Windows\System\CRsrkFF.exe
  C:\Windows\System\CRsrkFF.exe
  2⤵
  - Executes dropped EXE
  PID:1984
- C:\Windows\System\ctXySXQ.exe
  C:\Windows\System\ctXySXQ.exe
  2⤵
  - Executes dropped EXE
  PID:368
- C:\Windows\System\UJynuOh.exe
  C:\Windows\System\UJynuOh.exe
  2⤵
  - Executes dropped EXE
  PID:4412
- C:\Windows\System\IwDWuQb.exe
  C:\Windows\System\IwDWuQb.exe
  2⤵
  - Executes dropped EXE
  PID:2180
- C:\Windows\System\ypzMXsl.exe
  C:\Windows\System\ypzMXsl.exe
  2⤵
  - Executes dropped EXE
  PID:4196
- C:\Windows\System\GDYBMeT.exe
  C:\Windows\System\GDYBMeT.exe
  2⤵
  - Executes dropped EXE
  PID:1968
- C:\Windows\System\RaXyIPp.exe
  C:\Windows\System\RaXyIPp.exe
  2⤵
  - Executes dropped EXE
  PID:3080
- C:\Windows\System\BUGPiBF.exe
  C:\Windows\System\BUGPiBF.exe
  2⤵
  - Executes dropped EXE
  PID:388
- C:\Windows\System\HTMWhEM.exe
  C:\Windows\System\HTMWhEM.exe
  2⤵
  - Executes dropped EXE
  PID:2216
- C:\Windows\System\KLogwHT.exe
  C:\Windows\System\KLogwHT.exe
  2⤵
  - Executes dropped EXE
  PID:4752
- C:\Windows\System\SvjFAIA.exe
  C:\Windows\System\SvjFAIA.exe
  2⤵
  - Executes dropped EXE
  PID:4560
- C:\Windows\System\MMGzJSW.exe
  C:\Windows\System\MMGzJSW.exe
  2⤵
  - Executes dropped EXE
  PID:3976
- C:\Windows\System\IRGTCCs.exe
  C:\Windows\System\IRGTCCs.exe
  2⤵
  - Executes dropped EXE
  PID:2176
- C:\Windows\System\BazkuMj.exe
  C:\Windows\System\BazkuMj.exe
  2⤵
  - Executes dropped EXE
  PID:3336
- C:\Windows\System\tuMBKGb.exe
  C:\Windows\System\tuMBKGb.exe
  2⤵
  - Executes dropped EXE
  PID:4528
- C:\Windows\System\wrnobCF.exe
  C:\Windows\System\wrnobCF.exe
  2⤵
  PID:1372
- C:\Windows\System\wbNPXYN.exe
  C:\Windows\System\wbNPXYN.exe
  2⤵
  PID:3432
- C:\Windows\System\gNtWsXZ.exe
  C:\Windows\System\gNtWsXZ.exe
  2⤵
  PID:3084
- C:\Windows\System\WxzqYXp.exe
  C:\Windows\System\WxzqYXp.exe
  2⤵
  PID:2192
- C:\Windows\System\deJdHAe.exe
  C:\Windows\System\deJdHAe.exe
  2⤵
  PID:2708
- C:\Windows\System\vIVSllu.exe
  C:\Windows\System\vIVSllu.exe
  2⤵
  PID:1052
- C:\Windows\System\MKMkOuU.exe
  C:\Windows\System\MKMkOuU.exe
  2⤵
  PID:4720
- C:\Windows\System\tshRCyY.exe
  C:\Windows\System\tshRCyY.exe
  2⤵
  PID:3844
- C:\Windows\System\wWfClrB.exe
  C:\Windows\System\wWfClrB.exe
  2⤵
  PID:4332
- C:\Windows\System\UZCzpWo.exe
  C:\Windows\System\UZCzpWo.exe
  2⤵
  PID:4440
- C:\Windows\System\nIrCnkR.exe
  C:\Windows\System\nIrCnkR.exe
  2⤵
  PID:448
- C:\Windows\System\krakfJM.exe
  C:\Windows\System\krakfJM.exe
  2⤵
  PID:2604
- C:\Windows\System\kTuloEq.exe
  C:\Windows\System\kTuloEq.exe
  2⤵
  PID:1864
- C:\Windows\System\rblqjNk.exe
  C:\Windows\System\rblqjNk.exe
  2⤵
  PID:4308
- C:\Windows\System\HbqZrcM.exe
  C:\Windows\System\HbqZrcM.exe
  2⤵
  PID:3968
- C:\Windows\System\pSKVkSm.exe
  C:\Windows\System\pSKVkSm.exe
  2⤵
  PID:3012
- C:\Windows\System\jqPQBpI.exe
  C:\Windows\System\jqPQBpI.exe
  2⤵
  PID:4408
- C:\Windows\System\gzWNmiz.exe
  C:\Windows\System\gzWNmiz.exe
  2⤵
  PID:2456
- C:\Windows\System\uDqDJaU.exe
  C:\Windows\System\uDqDJaU.exe
  2⤵
  PID:4704
- C:\Windows\System\AUInkSQ.exe
  C:\Windows\System\AUInkSQ.exe
  2⤵
  PID:3308
- C:\Windows\System\ICVsfrz.exe
  C:\Windows\System\ICVsfrz.exe
  2⤵
  PID:2024
- C:\Windows\System\MKgcmFk.exe
  C:\Windows\System\MKgcmFk.exe
  2⤵
  PID:3404
- C:\Windows\System\RBNMVPO.exe
  C:\Windows\System\RBNMVPO.exe
  2⤵
  PID:4764
- C:\Windows\System\qHlKJEX.exe
  C:\Windows\System\qHlKJEX.exe
  2⤵
  PID:2812
- C:\Windows\System\gwvfbbx.exe
  C:\Windows\System\gwvfbbx.exe
  2⤵
  PID:4968
- C:\Windows\System\VKjpSwN.exe
  C:\Windows\System\VKjpSwN.exe
  2⤵
  PID:1904
- C:\Windows\System\PuKsZUu.exe
  C:\Windows\System\PuKsZUu.exe
  2⤵
  PID:4948
- C:\Windows\System\MmOYotu.exe
  C:\Windows\System\MmOYotu.exe
  2⤵
  PID:4964
- C:\Windows\System\sGEgVwW.exe
  C:\Windows\System\sGEgVwW.exe
  2⤵
  PID:2200
- C:\Windows\System\UwawFBV.exe
  C:\Windows\System\UwawFBV.exe
  2⤵
  PID:1012
- C:\Windows\System\UFJTvbp.exe
  C:\Windows\System\UFJTvbp.exe
  2⤵
  PID:5088
- C:\Windows\System\QbkPIdE.exe
  C:\Windows\System\QbkPIdE.exe
  2⤵
  PID:2412
- C:\Windows\System\hNVPcOB.exe
  C:\Windows\System\hNVPcOB.exe
  2⤵
  PID:3052
- C:\Windows\System\tVAEKiF.exe
  C:\Windows\System\tVAEKiF.exe
  2⤵
  PID:2104
- C:\Windows\System\sntVvNW.exe
  C:\Windows\System\sntVvNW.exe
  2⤵
  PID:4188
- C:\Windows\System\bdSurhQ.exe
  C:\Windows\System\bdSurhQ.exe
  2⤵
  PID:3520
- C:\Windows\System\hzCKmjh.exe
  C:\Windows\System\hzCKmjh.exe
  2⤵
  PID:1596
- C:\Windows\System\OnnKgGG.exe
  C:\Windows\System\OnnKgGG.exe
  2⤵
  PID:5076
- C:\Windows\System\VxnWWxE.exe
  C:\Windows\System\VxnWWxE.exe
  2⤵
  PID:5124
- C:\Windows\System\YvDSmei.exe
  C:\Windows\System\YvDSmei.exe
  2⤵
  PID:5144
- C:\Windows\System\knlNdDT.exe
  C:\Windows\System\knlNdDT.exe
  2⤵
  PID:5172
- C:\Windows\System\lurRgOz.exe
  C:\Windows\System\lurRgOz.exe
  2⤵
  PID:5200
- C:\Windows\System\VHRyHDw.exe
  C:\Windows\System\VHRyHDw.exe
  2⤵
  PID:5228
- C:\Windows\System\dUJsBCW.exe
  C:\Windows\System\dUJsBCW.exe
  2⤵
  PID:5252
- C:\Windows\System\DcWWpzs.exe
  C:\Windows\System\DcWWpzs.exe
  2⤵
  PID:5284
- C:\Windows\System\SlJEvAN.exe
  C:\Windows\System\SlJEvAN.exe
  2⤵
  PID:5312
- C:\Windows\System\hunQeQK.exe
  C:\Windows\System\hunQeQK.exe
  2⤵
  PID:5336
- C:\Windows\System\XkTgCjg.exe
  C:\Windows\System\XkTgCjg.exe
  2⤵
  PID:5364
- C:\Windows\System\KkrtlaK.exe
  C:\Windows\System\KkrtlaK.exe
  2⤵
  PID:5392
- C:\Windows\System\gOnavNG.exe
  C:\Windows\System\gOnavNG.exe
  2⤵
  PID:5424
- C:\Windows\System\yuxMzyB.exe
  C:\Windows\System\yuxMzyB.exe
  2⤵
  PID:5452
- C:\Windows\System\YkyywGv.exe
  C:\Windows\System\YkyywGv.exe
  2⤵
  PID:5476
- C:\Windows\System\tPGRiIf.exe
  C:\Windows\System\tPGRiIf.exe
  2⤵
  PID:5508
- C:\Windows\System\RpwZtmf.exe
  C:\Windows\System\RpwZtmf.exe
  2⤵
  PID:5536
- C:\Windows\System\ynNgsMf.exe
  C:\Windows\System\ynNgsMf.exe
  2⤵
  PID:5556
- C:\Windows\System\FXiIwSU.exe
  C:\Windows\System\FXiIwSU.exe
  2⤵
  PID:5572
- C:\Windows\System\LnHhZKG.exe
  C:\Windows\System\LnHhZKG.exe
  2⤵
  PID:5588
- C:\Windows\System\WyYCYAr.exe
  C:\Windows\System\WyYCYAr.exe
  2⤵
  PID:5604
- C:\Windows\System\hIXsMDR.exe
  C:\Windows\System\hIXsMDR.exe
  2⤵
  PID:5640
- C:\Windows\System\sRfDGcm.exe
  C:\Windows\System\sRfDGcm.exe
  2⤵
  PID:5668
- C:\Windows\System\vUbNAYH.exe
  C:\Windows\System\vUbNAYH.exe
  2⤵
  PID:5684
- C:\Windows\System\sNKcohX.exe
  C:\Windows\System\sNKcohX.exe
  2⤵
  PID:5700
- C:\Windows\System\cUATOsV.exe
  C:\Windows\System\cUATOsV.exe
  2⤵
  PID:5728
- C:\Windows\System\aQKSmUm.exe
  C:\Windows\System\aQKSmUm.exe
  2⤵
  PID:5832
- C:\Windows\System\CXEPpxq.exe
  C:\Windows\System\CXEPpxq.exe
  2⤵
  PID:5864
- C:\Windows\System\ethQrEM.exe
  C:\Windows\System\ethQrEM.exe
  2⤵
  PID:5892
- C:\Windows\System\kGinwEy.exe
  C:\Windows\System\kGinwEy.exe
  2⤵
  PID:5924
- C:\Windows\System\UVCuYqJ.exe
  C:\Windows\System\UVCuYqJ.exe
  2⤵
  PID:5948
- C:\Windows\System\dVcoqKe.exe
  C:\Windows\System\dVcoqKe.exe
  2⤵
  PID:5976
- C:\Windows\System\RWfqvsx.exe
  C:\Windows\System\RWfqvsx.exe
  2⤵
  PID:6008
- C:\Windows\System\gSurSOC.exe
  C:\Windows\System\gSurSOC.exe
  2⤵
  PID:6044
- C:\Windows\System\xpNAmZZ.exe
  C:\Windows\System\xpNAmZZ.exe
  2⤵
  PID:6060
- C:\Windows\System\OxRjYRE.exe
  C:\Windows\System\OxRjYRE.exe
  2⤵
  PID:6092
- C:\Windows\System\DinVZqh.exe
  C:\Windows\System\DinVZqh.exe
  2⤵
  PID:6128
- C:\Windows\System\qnYsMhx.exe
  C:\Windows\System\qnYsMhx.exe
  2⤵
  PID:4288
- C:\Windows\System\CAEOmTs.exe
  C:\Windows\System\CAEOmTs.exe
  2⤵
  PID:2040
- C:\Windows\System\WkQVvpo.exe
  C:\Windows\System\WkQVvpo.exe
  2⤵
  PID:5156
- C:\Windows\System\mznnZKQ.exe
  C:\Windows\System\mznnZKQ.exe
  2⤵
  PID:5212
- C:\Windows\System\kzUszVP.exe
  C:\Windows\System\kzUszVP.exe
  2⤵
  PID:4988
- C:\Windows\System\GhzHnqJ.exe
  C:\Windows\System\GhzHnqJ.exe
  2⤵
  PID:5272
- C:\Windows\System\LTmosfD.exe
  C:\Windows\System\LTmosfD.exe
  2⤵
  PID:5360
- C:\Windows\System\oUgsUPN.exe
  C:\Windows\System\oUgsUPN.exe
  2⤵
  PID:5408
- C:\Windows\System\aJsVBqa.exe
  C:\Windows\System\aJsVBqa.exe
  2⤵
  PID:5440
- C:\Windows\System\NOTrAiF.exe
  C:\Windows\System\NOTrAiF.exe
  2⤵
  PID:5464
- C:\Windows\System\NEiKTOi.exe
  C:\Windows\System\NEiKTOi.exe
  2⤵
  PID:1264
- C:\Windows\System\vecwaKG.exe
  C:\Windows\System\vecwaKG.exe
  2⤵
  PID:5500
- C:\Windows\System\jGHcMrE.exe
  C:\Windows\System\jGHcMrE.exe
  2⤵
  PID:1292
- C:\Windows\System\fQoEogA.exe
  C:\Windows\System\fQoEogA.exe
  2⤵
  PID:5568
- C:\Windows\System\EJxppik.exe
  C:\Windows\System\EJxppik.exe
  2⤵
  PID:2448
- C:\Windows\System\bnxARzW.exe
  C:\Windows\System\bnxARzW.exe
  2⤵
  PID:5716
- C:\Windows\System\IefGpor.exe
  C:\Windows\System\IefGpor.exe
  2⤵
  PID:5768
- C:\Windows\System\pJnEqSi.exe
  C:\Windows\System\pJnEqSi.exe
  2⤵
  PID:5840
- C:\Windows\System\kDFHTeY.exe
  C:\Windows\System\kDFHTeY.exe
  2⤵
  PID:1376
- C:\Windows\System\WxjzCJx.exe
  C:\Windows\System\WxjzCJx.exe
  2⤵
  PID:5968
- C:\Windows\System\LqtXJbP.exe
  C:\Windows\System\LqtXJbP.exe
  2⤵
  PID:6072
- C:\Windows\System\wnYLZfh.exe
  C:\Windows\System\wnYLZfh.exe
  2⤵
  PID:656
- C:\Windows\System\oZUSTiV.exe
  C:\Windows\System\oZUSTiV.exe
  2⤵
  PID:5136
- C:\Windows\System\UbstVzM.exe
  C:\Windows\System\UbstVzM.exe
  2⤵
  PID:5244
- C:\Windows\System\pLOPlDv.exe
  C:\Windows\System\pLOPlDv.exe
  2⤵
  PID:1056
- C:\Windows\System\lsziJVc.exe
  C:\Windows\System\lsziJVc.exe
  2⤵
  PID:5356
- C:\Windows\System\RJDMOtw.exe
  C:\Windows\System\RJDMOtw.exe
  2⤵
  PID:5444
- C:\Windows\System\oRzKzsl.exe
  C:\Windows\System\oRzKzsl.exe
  2⤵
  PID:5496
- C:\Windows\System\TCKuJbV.exe
  C:\Windows\System\TCKuJbV.exe
  2⤵
  PID:908
- C:\Windows\System\QYXSNyI.exe
  C:\Windows\System\QYXSNyI.exe
  2⤵
  PID:5764
- C:\Windows\System\RTMHArI.exe
  C:\Windows\System\RTMHArI.exe
  2⤵
  PID:5904
- C:\Windows\System\TqXhodC.exe
  C:\Windows\System\TqXhodC.exe
  2⤵
  PID:6056
- C:\Windows\System\Icbrxvb.exe
  C:\Windows\System\Icbrxvb.exe
  2⤵
  PID:3396
- C:\Windows\System\iifzvyg.exe
  C:\Windows\System\iifzvyg.exe
  2⤵
  PID:4944
- C:\Windows\System\qurirlA.exe
  C:\Windows\System\qurirlA.exe
  2⤵
  PID:4572
- C:\Windows\System\cywadWn.exe
  C:\Windows\System\cywadWn.exe
  2⤵
  PID:5776
- C:\Windows\System\GOMVfJI.exe
  C:\Windows\System\GOMVfJI.exe
  2⤵
  PID:5188
- C:\Windows\System\mBfJizK.exe
  C:\Windows\System\mBfJizK.exe
  2⤵
  PID:5712
- C:\Windows\System\iwtxGRh.exe
  C:\Windows\System\iwtxGRh.exe
  2⤵
  PID:6160
- C:\Windows\System\VXuvccF.exe
  C:\Windows\System\VXuvccF.exe
  2⤵
  PID:6176
- C:\Windows\System\fwfXSoA.exe
  C:\Windows\System\fwfXSoA.exe
  2⤵
  PID:6192
- C:\Windows\System\IZMpNOU.exe
  C:\Windows\System\IZMpNOU.exe
  2⤵
  PID:6220
- C:\Windows\System\ejtOLto.exe
  C:\Windows\System\ejtOLto.exe
  2⤵
  PID:6264
- C:\Windows\System\UrexuXp.exe
  C:\Windows\System\UrexuXp.exe
  2⤵
  PID:6288
- C:\Windows\System\CObJmmM.exe
  C:\Windows\System\CObJmmM.exe
  2⤵
  PID:6328
- C:\Windows\System\PYRXdPG.exe
  C:\Windows\System\PYRXdPG.exe
  2⤵
  PID:6356
- C:\Windows\System\hdKlCPO.exe
  C:\Windows\System\hdKlCPO.exe
  2⤵
  PID:6372
- C:\Windows\System\zubvvZz.exe
  C:\Windows\System\zubvvZz.exe
  2⤵
  PID:6408
- C:\Windows\System\eGmkZNY.exe
  C:\Windows\System\eGmkZNY.exe
  2⤵
  PID:6440
- C:\Windows\System\eNNRMAs.exe
  C:\Windows\System\eNNRMAs.exe
  2⤵
  PID:6468
- C:\Windows\System\khXZoTi.exe
  C:\Windows\System\khXZoTi.exe
  2⤵
  PID:6488
- C:\Windows\System\IrtEEzZ.exe
  C:\Windows\System\IrtEEzZ.exe
  2⤵
  PID:6516
- C:\Windows\System\CwkSpNz.exe
  C:\Windows\System\CwkSpNz.exe
  2⤵
  PID:6552
- C:\Windows\System\qTTRDpW.exe
  C:\Windows\System\qTTRDpW.exe
  2⤵
  PID:6580
- C:\Windows\System\xqiRJBO.exe
  C:\Windows\System\xqiRJBO.exe
  2⤵
  PID:6608
- C:\Windows\System\aXcNMaQ.exe
  C:\Windows\System\aXcNMaQ.exe
  2⤵
  PID:6640
- C:\Windows\System\iaTlYbA.exe
  C:\Windows\System\iaTlYbA.exe
  2⤵
  PID:6660
- C:\Windows\System\KeOOzJZ.exe
  C:\Windows\System\KeOOzJZ.exe
  2⤵
  PID:6684
- C:\Windows\System\IRXZuPb.exe
  C:\Windows\System\IRXZuPb.exe
  2⤵
  PID:6712
- C:\Windows\System\rDFRbyI.exe
  C:\Windows\System\rDFRbyI.exe
  2⤵
  PID:6740
- C:\Windows\System\dkaIpSA.exe
  C:\Windows\System\dkaIpSA.exe
  2⤵
  PID:6772
- C:\Windows\System\uThQzWQ.exe
  C:\Windows\System\uThQzWQ.exe
  2⤵
  PID:6796
- C:\Windows\System\IahwOkK.exe
  C:\Windows\System\IahwOkK.exe
  2⤵
  PID:6836
- C:\Windows\System\pENkVxz.exe
  C:\Windows\System\pENkVxz.exe
  2⤵
  PID:6864
- C:\Windows\System\sWonOMX.exe
  C:\Windows\System\sWonOMX.exe
  2⤵
  PID:6892
- C:\Windows\System\IrXbURk.exe
  C:\Windows\System\IrXbURk.exe
  2⤵
  PID:6920
- C:\Windows\System\vqppUBt.exe
  C:\Windows\System\vqppUBt.exe
  2⤵
  PID:6936
- C:\Windows\System\PpXjeyk.exe
  C:\Windows\System\PpXjeyk.exe
  2⤵
  PID:6972
- C:\Windows\System\TtUhdqt.exe
  C:\Windows\System\TtUhdqt.exe
  2⤵
  PID:7020
- C:\Windows\System\FcJivxy.exe
  C:\Windows\System\FcJivxy.exe
  2⤵
  PID:7036
- C:\Windows\System\ALfXeSi.exe
  C:\Windows\System\ALfXeSi.exe
  2⤵
  PID:7064
- C:\Windows\System\uanRLKY.exe
  C:\Windows\System\uanRLKY.exe
  2⤵
  PID:7092
- C:\Windows\System\QiyMWoR.exe
  C:\Windows\System\QiyMWoR.exe
  2⤵
  PID:7120
- C:\Windows\System\marVWim.exe
  C:\Windows\System\marVWim.exe
  2⤵
  PID:7148
- C:\Windows\System\oimRBnu.exe
  C:\Windows\System\oimRBnu.exe
  2⤵
  PID:5544
- C:\Windows\System\OnhMsTz.exe
  C:\Windows\System\OnhMsTz.exe
  2⤵
  PID:6184
- C:\Windows\System\eemjRIy.exe
  C:\Windows\System\eemjRIy.exe
  2⤵
  PID:6216
- C:\Windows\System\vRbIbTi.exe
  C:\Windows\System\vRbIbTi.exe
  2⤵
  PID:6260
- C:\Windows\System\JHsHCFi.exe
  C:\Windows\System\JHsHCFi.exe
  2⤵
  PID:6392
- C:\Windows\System\Mpazdch.exe
  C:\Windows\System\Mpazdch.exe
  2⤵
  PID:6456
- C:\Windows\System\xhUROth.exe
  C:\Windows\System\xhUROth.exe
  2⤵
  PID:6544
- C:\Windows\System\BNOzHod.exe
  C:\Windows\System\BNOzHod.exe
  2⤵
  PID:6572
- C:\Windows\System\nLJfZPU.exe
  C:\Windows\System\nLJfZPU.exe
  2⤵
  PID:6628
- C:\Windows\System\FkmVGCd.exe
  C:\Windows\System\FkmVGCd.exe
  2⤵
  PID:6676
- C:\Windows\System\KZzdhAY.exe
  C:\Windows\System\KZzdhAY.exe
  2⤵
  PID:6752
- C:\Windows\System\gMrRSaR.exe
  C:\Windows\System\gMrRSaR.exe
  2⤵
  PID:6824
- C:\Windows\System\fnZIchZ.exe
  C:\Windows\System\fnZIchZ.exe
  2⤵
  PID:6904
- C:\Windows\System\KOjAEKB.exe
  C:\Windows\System\KOjAEKB.exe
  2⤵
  PID:6980
- C:\Windows\System\FwGVMLq.exe
  C:\Windows\System\FwGVMLq.exe
  2⤵
  PID:7048
- C:\Windows\System\rRmqtcw.exe
  C:\Windows\System\rRmqtcw.exe
  2⤵
  PID:7104
- C:\Windows\System\nDjQjoM.exe
  C:\Windows\System\nDjQjoM.exe
  2⤵
  PID:5632
- C:\Windows\System\KlxskuY.exe
  C:\Windows\System\KlxskuY.exe
  2⤵
  PID:6232
- C:\Windows\System\utqhHVp.exe
  C:\Windows\System\utqhHVp.exe
  2⤵
  PID:6432
- C:\Windows\System\XmbrYoA.exe
  C:\Windows\System\XmbrYoA.exe
  2⤵
  PID:6596
- C:\Windows\System\dlRtpAg.exe
  C:\Windows\System\dlRtpAg.exe
  2⤵
  PID:6724
- C:\Windows\System\pdarpio.exe
  C:\Windows\System\pdarpio.exe
  2⤵
  PID:6852
- C:\Windows\System\Vpiwvwg.exe
  C:\Windows\System\Vpiwvwg.exe
  2⤵
  PID:7076
- C:\Windows\System\XvDaFmV.exe
  C:\Windows\System\XvDaFmV.exe
  2⤵
  PID:6188
- C:\Windows\System\gQgHapx.exe
  C:\Windows\System\gQgHapx.exe
  2⤵
  PID:6532
- C:\Windows\System\zVAwFNY.exe
  C:\Windows\System\zVAwFNY.exe
  2⤵
  PID:6928
- C:\Windows\System\NrvmPvq.exe
  C:\Windows\System\NrvmPvq.exe
  2⤵
  PID:7108
- C:\Windows\System\BVemXhW.exe
  C:\Windows\System\BVemXhW.exe
  2⤵
  PID:6916
- C:\Windows\System\bLkLtXM.exe
  C:\Windows\System\bLkLtXM.exe
  2⤵
  PID:7180
- C:\Windows\System\VUwkNkl.exe
  C:\Windows\System\VUwkNkl.exe
  2⤵
  PID:7208
- C:\Windows\System\fRtKpDI.exe
  C:\Windows\System\fRtKpDI.exe
  2⤵
  PID:7244
- C:\Windows\System\qZfrRqs.exe
  C:\Windows\System\qZfrRqs.exe
  2⤵
  PID:7272
- C:\Windows\System\wjHHsdn.exe
  C:\Windows\System\wjHHsdn.exe
  2⤵
  PID:7300
- C:\Windows\System\vIbZhcu.exe
  C:\Windows\System\vIbZhcu.exe
  2⤵
  PID:7328
- C:\Windows\System\gvnOfAz.exe
  C:\Windows\System\gvnOfAz.exe
  2⤵
  PID:7352
- C:\Windows\System\QpLjWPh.exe
  C:\Windows\System\QpLjWPh.exe
  2⤵
  PID:7380
- C:\Windows\System\ssKByvK.exe
  C:\Windows\System\ssKByvK.exe
  2⤵
  PID:7412
- C:\Windows\System\bpGoHlh.exe
  C:\Windows\System\bpGoHlh.exe
  2⤵
  PID:7440
- C:\Windows\System\ZrACqmd.exe
  C:\Windows\System\ZrACqmd.exe
  2⤵
  PID:7468
- C:\Windows\System\mTlFzYC.exe
  C:\Windows\System\mTlFzYC.exe
  2⤵
  PID:7484
- C:\Windows\System\oiDVFJf.exe
  C:\Windows\System\oiDVFJf.exe
  2⤵
  PID:7524
- C:\Windows\System\ZcForqa.exe
  C:\Windows\System\ZcForqa.exe
  2⤵
  PID:7552
- C:\Windows\System\uRprqFs.exe
  C:\Windows\System\uRprqFs.exe
  2⤵
  PID:7572
- C:\Windows\System\VmIBFrk.exe
  C:\Windows\System\VmIBFrk.exe
  2⤵
  PID:7608
- C:\Windows\System\ZLGmscq.exe
  C:\Windows\System\ZLGmscq.exe
  2⤵
  PID:7624
- C:\Windows\System\ymPMZGZ.exe
  C:\Windows\System\ymPMZGZ.exe
  2⤵
  PID:7656
- C:\Windows\System\sTPstED.exe
  C:\Windows\System\sTPstED.exe
  2⤵
  PID:7692
- C:\Windows\System\sqzhMMp.exe
  C:\Windows\System\sqzhMMp.exe
  2⤵
  PID:7712
- C:\Windows\System\hSZDThn.exe
  C:\Windows\System\hSZDThn.exe
  2⤵
  PID:7740
- C:\Windows\System\ymOHSAW.exe
  C:\Windows\System\ymOHSAW.exe
  2⤵
  PID:7764
- C:\Windows\System\GQvoKKG.exe
  C:\Windows\System\GQvoKKG.exe
  2⤵
  PID:7800
- C:\Windows\System\jFINMxZ.exe
  C:\Windows\System\jFINMxZ.exe
  2⤵
  PID:7832
- C:\Windows\System\QdzXGfg.exe
  C:\Windows\System\QdzXGfg.exe
  2⤵
  PID:7860
- C:\Windows\System\ihegSRL.exe
  C:\Windows\System\ihegSRL.exe
  2⤵
  PID:7888
- C:\Windows\System\BakncBL.exe
  C:\Windows\System\BakncBL.exe
  2⤵
  PID:7908
- C:\Windows\System\MVQcFvv.exe
  C:\Windows\System\MVQcFvv.exe
  2⤵
  PID:7936
- C:\Windows\System\zYGjtqr.exe
  C:\Windows\System\zYGjtqr.exe
  2⤵
  PID:7960
- C:\Windows\System\kBAKufY.exe
  C:\Windows\System\kBAKufY.exe
  2⤵
  PID:7988
- C:\Windows\System\xWhBCYn.exe
  C:\Windows\System\xWhBCYn.exe
  2⤵
  PID:8032
- C:\Windows\System\yqCawmx.exe
  C:\Windows\System\yqCawmx.exe
  2⤵
  PID:8060
- C:\Windows\System\dQZFnNF.exe
  C:\Windows\System\dQZFnNF.exe
  2⤵
  PID:8088
- C:\Windows\System\uDEzmgC.exe
  C:\Windows\System\uDEzmgC.exe
  2⤵
  PID:8116
- C:\Windows\System\NILFfpb.exe
  C:\Windows\System\NILFfpb.exe
  2⤵
  PID:8136
- C:\Windows\System\ENFDbCv.exe
  C:\Windows\System\ENFDbCv.exe
  2⤵
  PID:8168
- C:\Windows\System\GgeRPab.exe
  C:\Windows\System\GgeRPab.exe
  2⤵
  PID:7176
- C:\Windows\System\qqUbdJF.exe
  C:\Windows\System\qqUbdJF.exe
  2⤵
  PID:7256
- C:\Windows\System\CAKBpIg.exe
  C:\Windows\System\CAKBpIg.exe
  2⤵
  PID:7312
- C:\Windows\System\NyBYKTK.exe
  C:\Windows\System\NyBYKTK.exe
  2⤵
  PID:7372
- C:\Windows\System\qTRpBrA.exe
  C:\Windows\System\qTRpBrA.exe
  2⤵
  PID:7452
- C:\Windows\System\DGXDNzy.exe
  C:\Windows\System\DGXDNzy.exe
  2⤵
  PID:7516
- C:\Windows\System\wIYCQwl.exe
  C:\Windows\System\wIYCQwl.exe
  2⤵
  PID:7584
- C:\Windows\System\DYSlmfR.exe
  C:\Windows\System\DYSlmfR.exe
  2⤵
  PID:7644
- C:\Windows\System\YgpAoKm.exe
  C:\Windows\System\YgpAoKm.exe
  2⤵
  PID:7700
- C:\Windows\System\UybyUrd.exe
  C:\Windows\System\UybyUrd.exe
  2⤵
  PID:7776
- C:\Windows\System\SeLuAUR.exe
  C:\Windows\System\SeLuAUR.exe
  2⤵
  PID:7808
- C:\Windows\System\ydqrQAi.exe
  C:\Windows\System\ydqrQAi.exe
  2⤵
  PID:7916
- C:\Windows\System\znAQpZs.exe
  C:\Windows\System\znAQpZs.exe
  2⤵
  PID:7972
- C:\Windows\System\OYOPTrI.exe
  C:\Windows\System\OYOPTrI.exe
  2⤵
  PID:8048
- C:\Windows\System\zICFchz.exe
  C:\Windows\System\zICFchz.exe
  2⤵
  PID:8080
- C:\Windows\System\CMywUvI.exe
  C:\Windows\System\CMywUvI.exe
  2⤵
  PID:8160
- C:\Windows\System\wlnMUxi.exe
  C:\Windows\System\wlnMUxi.exe
  2⤵
  PID:7196
- C:\Windows\System\NPIiBoO.exe
  C:\Windows\System\NPIiBoO.exe
  2⤵
  PID:7396
- C:\Windows\System\KiYnosk.exe
  C:\Windows\System\KiYnosk.exe
  2⤵
  PID:7540
- C:\Windows\System\NUGtAwy.exe
  C:\Windows\System\NUGtAwy.exe
  2⤵
  PID:7756
- C:\Windows\System\bloWdZj.exe
  C:\Windows\System\bloWdZj.exe
  2⤵
  PID:7796
- C:\Windows\System\lMRZaCy.exe
  C:\Windows\System\lMRZaCy.exe
  2⤵
  PID:8056
- C:\Windows\System\ALcHaoD.exe
  C:\Windows\System\ALcHaoD.exe
  2⤵
  PID:7188
- C:\Windows\System\QNtAwez.exe
  C:\Windows\System\QNtAwez.exe
  2⤵
  PID:7564
- C:\Windows\System\FOJJBUM.exe
  C:\Windows\System\FOJJBUM.exe
  2⤵
  PID:7872
- C:\Windows\System\CeaNcAG.exe
  C:\Windows\System\CeaNcAG.exe
  2⤵
  PID:7456
- C:\Windows\System\ESjSxpM.exe
  C:\Windows\System\ESjSxpM.exe
  2⤵
  PID:7708
- C:\Windows\System\tudZwZX.exe
  C:\Windows\System\tudZwZX.exe
  2⤵
  PID:8216
- C:\Windows\System\QPNdfme.exe
  C:\Windows\System\QPNdfme.exe
  2⤵
  PID:8248
- C:\Windows\System\fFJjWqv.exe
  C:\Windows\System\fFJjWqv.exe
  2⤵
  PID:8272
- C:\Windows\System\FbijBxa.exe
  C:\Windows\System\FbijBxa.exe
  2⤵
  PID:8304
- C:\Windows\System\YCQUwmp.exe
  C:\Windows\System\YCQUwmp.exe
  2⤵
  PID:8332
- C:\Windows\System\KwFCHvH.exe
  C:\Windows\System\KwFCHvH.exe
  2⤵
  PID:8356
- C:\Windows\System\wzobLKT.exe
  C:\Windows\System\wzobLKT.exe
  2⤵
  PID:8396
- C:\Windows\System\xuglCbb.exe
  C:\Windows\System\xuglCbb.exe
  2⤵
  PID:8412
- C:\Windows\System\HKdIsYi.exe
  C:\Windows\System\HKdIsYi.exe
  2⤵
  PID:8452
- C:\Windows\System\AKorAIK.exe
  C:\Windows\System\AKorAIK.exe
  2⤵
  PID:8472
- C:\Windows\System\GMtrbXY.exe
  C:\Windows\System\GMtrbXY.exe
  2⤵
  PID:8504
- C:\Windows\System\klepscQ.exe
  C:\Windows\System\klepscQ.exe
  2⤵
  PID:8536
- C:\Windows\System\lfGpeIT.exe
  C:\Windows\System\lfGpeIT.exe
  2⤵
  PID:8564
- C:\Windows\System\bHPPLFl.exe
  C:\Windows\System\bHPPLFl.exe
  2⤵
  PID:8584
- C:\Windows\System\HfOyRsE.exe
  C:\Windows\System\HfOyRsE.exe
  2⤵
  PID:8608
- C:\Windows\System\GxbwaiI.exe
  C:\Windows\System\GxbwaiI.exe
  2⤵
  PID:8636
- C:\Windows\System\XpZWzMc.exe
  C:\Windows\System\XpZWzMc.exe
  2⤵
  PID:8672
- C:\Windows\System\iufSuUZ.exe
  C:\Windows\System\iufSuUZ.exe
  2⤵
  PID:8704
- C:\Windows\System\rYqIDgB.exe
  C:\Windows\System\rYqIDgB.exe
  2⤵
  PID:8732
- C:\Windows\System\MUDUvrF.exe
  C:\Windows\System\MUDUvrF.exe
  2⤵
  PID:8752
- C:\Windows\System\zdfTEgw.exe
  C:\Windows\System\zdfTEgw.exe
  2⤵
  PID:8776
- C:\Windows\System\WqLioWf.exe
  C:\Windows\System\WqLioWf.exe
  2⤵
  PID:8796
- C:\Windows\System\xjMRcPk.exe
  C:\Windows\System\xjMRcPk.exe
  2⤵
  PID:8812
- C:\Windows\System\ITaweCn.exe
  C:\Windows\System\ITaweCn.exe
  2⤵
  PID:8840
- C:\Windows\System\eMjgiKz.exe
  C:\Windows\System\eMjgiKz.exe
  2⤵
  PID:8884
- C:\Windows\System\zyWNZSa.exe
  C:\Windows\System\zyWNZSa.exe
  2⤵
  PID:8904
- C:\Windows\System\lDfqwkx.exe
  C:\Windows\System\lDfqwkx.exe
  2⤵
  PID:8924
- C:\Windows\System\kBocQAs.exe
  C:\Windows\System\kBocQAs.exe
  2⤵
  PID:8956
- C:\Windows\System\sIvvMtu.exe
  C:\Windows\System\sIvvMtu.exe
  2⤵
  PID:8984
- C:\Windows\System\tSqmGOP.exe
  C:\Windows\System\tSqmGOP.exe
  2⤵
  PID:9008
- C:\Windows\System\ijTwgAL.exe
  C:\Windows\System\ijTwgAL.exe
  2⤵
  PID:9044
- C:\Windows\System\pUQJKld.exe
  C:\Windows\System\pUQJKld.exe
  2⤵
  PID:9068
- C:\Windows\System\CxvgqRV.exe
  C:\Windows\System\CxvgqRV.exe
  2⤵
  PID:9112
- C:\Windows\System\esJKSXf.exe
  C:\Windows\System\esJKSXf.exe
  2⤵
  PID:9136
- C:\Windows\System\CIGDqYE.exe
  C:\Windows\System\CIGDqYE.exe
  2⤵
  PID:9184
- C:\Windows\System\kyAuVLV.exe
  C:\Windows\System\kyAuVLV.exe
  2⤵
  PID:9212
- C:\Windows\System\SmNPXrj.exe
  C:\Windows\System\SmNPXrj.exe
  2⤵
  PID:7340
- C:\Windows\System\DKeDZfb.exe
  C:\Windows\System\DKeDZfb.exe
  2⤵
  PID:8264
- C:\Windows\System\fcoJAql.exe
  C:\Windows\System\fcoJAql.exe
  2⤵
  PID:8328
- C:\Windows\System\iMdfoAN.exe
  C:\Windows\System\iMdfoAN.exe
  2⤵
  PID:8376
- C:\Windows\System\uHrmPmU.exe
  C:\Windows\System\uHrmPmU.exe
  2⤵
  PID:8448
- C:\Windows\System\MuoBral.exe
  C:\Windows\System\MuoBral.exe
  2⤵
  PID:8524
- C:\Windows\System\FgMFmIc.exe
  C:\Windows\System\FgMFmIc.exe
  2⤵
  PID:8600
- C:\Windows\System\FkTPeGL.exe
  C:\Windows\System\FkTPeGL.exe
  2⤵
  PID:8652
- C:\Windows\System\dmMSglk.exe
  C:\Windows\System\dmMSglk.exe
  2⤵
  PID:8648
- C:\Windows\System\AxQGoPh.exe
  C:\Windows\System\AxQGoPh.exe
  2⤵
  PID:8784
- C:\Windows\System\gmmSdrs.exe
  C:\Windows\System\gmmSdrs.exe
  2⤵
  PID:8836
- C:\Windows\System\HNkuJlJ.exe
  C:\Windows\System\HNkuJlJ.exe
  2⤵
  PID:8916
- C:\Windows\System\bCJbPPI.exe
  C:\Windows\System\bCJbPPI.exe
  2⤵
  PID:8936
- C:\Windows\System\cNwoLJr.exe
  C:\Windows\System\cNwoLJr.exe
  2⤵
  PID:9032
- C:\Windows\System\ZGIPXuE.exe
  C:\Windows\System\ZGIPXuE.exe
  2⤵
  PID:9088
- C:\Windows\System\NtGKUVt.exe
  C:\Windows\System\NtGKUVt.exe
  2⤵
  PID:9180
- C:\Windows\System\xlURxnz.exe
  C:\Windows\System\xlURxnz.exe
  2⤵
  PID:8228
- C:\Windows\System\nHLSlNG.exe
  C:\Windows\System\nHLSlNG.exe
  2⤵
  PID:8352
- C:\Windows\System\xHVvcfE.exe
  C:\Windows\System\xHVvcfE.exe
  2⤵
  PID:8468
- C:\Windows\System\uSkoIWn.exe
  C:\Windows\System\uSkoIWn.exe
  2⤵
  PID:8620
- C:\Windows\System\ijNgUap.exe
  C:\Windows\System\ijNgUap.exe
  2⤵
  PID:8728
- C:\Windows\System\NjkioOT.exe
  C:\Windows\System\NjkioOT.exe
  2⤵
  PID:8772
- C:\Windows\System\LUXpYff.exe
  C:\Windows\System\LUXpYff.exe
  2⤵
  PID:8976
- C:\Windows\System\bRVaBbn.exe
  C:\Windows\System\bRVaBbn.exe
  2⤵
  PID:8112
- C:\Windows\System\rCBNPqT.exe
  C:\Windows\System\rCBNPqT.exe
  2⤵
  PID:8580
- C:\Windows\System\xgtlRQB.exe
  C:\Windows\System\xgtlRQB.exe
  2⤵
  PID:9060
- C:\Windows\System\vdKVGeL.exe
  C:\Windows\System\vdKVGeL.exe
  2⤵
  PID:9208
- C:\Windows\System\XYQyOqt.exe
  C:\Windows\System\XYQyOqt.exe
  2⤵
  PID:8896
- C:\Windows\System\ZbLhmTm.exe
  C:\Windows\System\ZbLhmTm.exe
  2⤵
  PID:9220
- C:\Windows\System\SSMZkFc.exe
  C:\Windows\System\SSMZkFc.exe
  2⤵
  PID:9244
- C:\Windows\System\AnDzxHS.exe
  C:\Windows\System\AnDzxHS.exe
  2⤵
  PID:9284
- C:\Windows\System\OhXWVMp.exe
  C:\Windows\System\OhXWVMp.exe
  2⤵
  PID:9300
- C:\Windows\System\uqyoxjt.exe
  C:\Windows\System\uqyoxjt.exe
  2⤵
  PID:9316
- C:\Windows\System\qASexbd.exe
  C:\Windows\System\qASexbd.exe
  2⤵
  PID:9344
- C:\Windows\System\kPfdwTc.exe
  C:\Windows\System\kPfdwTc.exe
  2⤵
  PID:9372
- C:\Windows\System\AjYcQNG.exe
  C:\Windows\System\AjYcQNG.exe
  2⤵
  PID:9424
- C:\Windows\System\hfvOOcA.exe
  C:\Windows\System\hfvOOcA.exe
  2⤵
  PID:9452
- C:\Windows\System\cZwRdSh.exe
  C:\Windows\System\cZwRdSh.exe
  2⤵
  PID:9480
- C:\Windows\System\PcYYFEF.exe
  C:\Windows\System\PcYYFEF.exe
  2⤵
  PID:9508
- C:\Windows\System\JWUdnxR.exe
  C:\Windows\System\JWUdnxR.exe
  2⤵
  PID:9536
- C:\Windows\System\aJJYXsX.exe
  C:\Windows\System\aJJYXsX.exe
  2⤵
  PID:9564
- C:\Windows\System\kwaWRoN.exe
  C:\Windows\System\kwaWRoN.exe
  2⤵
  PID:9580
- C:\Windows\System\tvqEpHl.exe
  C:\Windows\System\tvqEpHl.exe
  2⤵
  PID:9620
- C:\Windows\System\DXbQMqx.exe
  C:\Windows\System\DXbQMqx.exe
  2⤵
  PID:9640
- C:\Windows\System\fEKIOKa.exe
  C:\Windows\System\fEKIOKa.exe
  2⤵
  PID:9668
- C:\Windows\System\TzaeasU.exe
  C:\Windows\System\TzaeasU.exe
  2⤵
  PID:9704
- C:\Windows\System\ESUlpsW.exe
  C:\Windows\System\ESUlpsW.exe
  2⤵
  PID:9732
- C:\Windows\System\ytzZqIU.exe
  C:\Windows\System\ytzZqIU.exe
  2⤵
  PID:9748
- C:\Windows\System\Lpzkjjn.exe
  C:\Windows\System\Lpzkjjn.exe
  2⤵
  PID:9780
- C:\Windows\System\UGIKmkS.exe
  C:\Windows\System\UGIKmkS.exe
  2⤵
  PID:9812
- C:\Windows\System\ZjQdsZu.exe
  C:\Windows\System\ZjQdsZu.exe
  2⤵
  PID:9840
- C:\Windows\System\fErmNvY.exe
  C:\Windows\System\fErmNvY.exe
  2⤵
  PID:9860
- C:\Windows\System\AGCoZBr.exe
  C:\Windows\System\AGCoZBr.exe
  2⤵
  PID:9888
- C:\Windows\System\clnDXhH.exe
  C:\Windows\System\clnDXhH.exe
  2⤵
  PID:9916
- C:\Windows\System\XkDwmRM.exe
  C:\Windows\System\XkDwmRM.exe
  2⤵
  PID:9952
- C:\Windows\System\lFACvJP.exe
  C:\Windows\System\lFACvJP.exe
  2⤵
  PID:9988
- C:\Windows\System\ESbWNEd.exe
  C:\Windows\System\ESbWNEd.exe
  2⤵
  PID:10024
- C:\Windows\System\SwumpXo.exe
  C:\Windows\System\SwumpXo.exe
  2⤵
  PID:10048
- C:\Windows\System\wnYydoO.exe
  C:\Windows\System\wnYydoO.exe
  2⤵
  PID:10064
- C:\Windows\System\Npwssvu.exe
  C:\Windows\System\Npwssvu.exe
  2⤵
  PID:10096
- C:\Windows\System\RUjSwOr.exe
  C:\Windows\System\RUjSwOr.exe
  2⤵
  PID:10132
- C:\Windows\System\URSacSh.exe
  C:\Windows\System\URSacSh.exe
  2⤵
  PID:10164
- C:\Windows\System\EKjXrdl.exe
  C:\Windows\System\EKjXrdl.exe
  2⤵
  PID:10184
- C:\Windows\System\OYNhEMS.exe
  C:\Windows\System\OYNhEMS.exe
  2⤵
  PID:10216
- C:\Windows\System\pYOLJbj.exe
  C:\Windows\System\pYOLJbj.exe
  2⤵
  PID:10232
- C:\Windows\System\uFVdQOY.exe
  C:\Windows\System\uFVdQOY.exe
  2⤵
  PID:9296
- C:\Windows\System\YoyCyEC.exe
  C:\Windows\System\YoyCyEC.exe
  2⤵
  PID:9404
- C:\Windows\System\zyZHlNe.exe
  C:\Windows\System\zyZHlNe.exe
  2⤵
  PID:9436
- C:\Windows\System\xhRtYTX.exe
  C:\Windows\System\xhRtYTX.exe
  2⤵
  PID:9520
- C:\Windows\System\PDgIriC.exe
  C:\Windows\System\PDgIriC.exe
  2⤵
  PID:9552
- C:\Windows\System\ueQQnjg.exe
  C:\Windows\System\ueQQnjg.exe
  2⤵
  PID:9648
- C:\Windows\System\iovGBeu.exe
  C:\Windows\System\iovGBeu.exe
  2⤵
  PID:9688
- C:\Windows\System\ctEGsHq.exe
  C:\Windows\System\ctEGsHq.exe
  2⤵
  PID:9768
- C:\Windows\System\CmrxFee.exe
  C:\Windows\System\CmrxFee.exe
  2⤵
  PID:9832
- C:\Windows\System\ZsWxdEe.exe
  C:\Windows\System\ZsWxdEe.exe
  2⤵
  PID:9912
- C:\Windows\System\ECHSlSC.exe
  C:\Windows\System\ECHSlSC.exe
  2⤵
  PID:9972
- C:\Windows\System\jPjHOpI.exe
  C:\Windows\System\jPjHOpI.exe
  2⤵
  PID:10004
- C:\Windows\System\mFSzBRy.exe
  C:\Windows\System\mFSzBRy.exe
  2⤵
  PID:10056
- C:\Windows\System\jlqhATC.exe
  C:\Windows\System\jlqhATC.exe
  2⤵
  PID:10124
- C:\Windows\System\wOGgtvt.exe
  C:\Windows\System\wOGgtvt.exe
  2⤵
  PID:10208
- C:\Windows\System\ZAIKhCl.exe
  C:\Windows\System\ZAIKhCl.exe
  2⤵
  PID:10224
- C:\Windows\System\ByagLnH.exe
  C:\Windows\System\ByagLnH.exe
  2⤵
  PID:9492
- C:\Windows\System\ieojJqh.exe
  C:\Windows\System\ieojJqh.exe
  2⤵
  PID:9612
- C:\Windows\System\LMeAWlO.exe
  C:\Windows\System\LMeAWlO.exe
  2⤵
  PID:9728
- C:\Windows\System\FpvAlPt.exe
  C:\Windows\System\FpvAlPt.exe
  2⤵
  PID:9900
- C:\Windows\System\YDZFZHS.exe
  C:\Windows\System\YDZFZHS.exe
  2⤵
  PID:10084
- C:\Windows\System\psuOLDR.exe
  C:\Windows\System\psuOLDR.exe
  2⤵
  PID:10092
- C:\Windows\System\XCrrijM.exe
  C:\Windows\System\XCrrijM.exe
  2⤵
  PID:9340
- C:\Windows\System\NNWlgiE.exe
  C:\Windows\System\NNWlgiE.exe
  2⤵
  PID:9664
- C:\Windows\System\jaBCWfv.exe
  C:\Windows\System\jaBCWfv.exe
  2⤵
  PID:10076
- C:\Windows\System\niQoiBH.exe
  C:\Windows\System\niQoiBH.exe
  2⤵
  PID:9368
- C:\Windows\System\IsgMNwS.exe
  C:\Windows\System\IsgMNwS.exe
  2⤵
  PID:9964
- C:\Windows\System\bseuAHD.exe
  C:\Windows\System\bseuAHD.exe
  2⤵
  PID:10268
- C:\Windows\System\pPYdboa.exe
  C:\Windows\System\pPYdboa.exe
  2⤵
  PID:10296
- C:\Windows\System\XojAAiT.exe
  C:\Windows\System\XojAAiT.exe
  2⤵
  PID:10316
- C:\Windows\System\qrHRSGu.exe
  C:\Windows\System\qrHRSGu.exe
  2⤵
  PID:10348
- C:\Windows\System\yIePwIR.exe
  C:\Windows\System\yIePwIR.exe
  2⤵
  PID:10376
- C:\Windows\System\hUjzhaN.exe
  C:\Windows\System\hUjzhaN.exe
  2⤵
  PID:10400
- C:\Windows\System\qywhjRc.exe
  C:\Windows\System\qywhjRc.exe
  2⤵
  PID:10428
- C:\Windows\System\vepalYF.exe
  C:\Windows\System\vepalYF.exe
  2⤵
  PID:10468
- C:\Windows\System\CgECqiZ.exe
  C:\Windows\System\CgECqiZ.exe
  2⤵
  PID:10484
- C:\Windows\System\NPtyJTg.exe
  C:\Windows\System\NPtyJTg.exe
  2⤵
  PID:10524
- C:\Windows\System\HICdCqw.exe
  C:\Windows\System\HICdCqw.exe
  2⤵
  PID:10540
- C:\Windows\System\wslaiAz.exe
  C:\Windows\System\wslaiAz.exe
  2⤵
  PID:10568
- C:\Windows\System\HNqSTxI.exe
  C:\Windows\System\HNqSTxI.exe
  2⤵
  PID:10596
- C:\Windows\System\YNFJwUv.exe
  C:\Windows\System\YNFJwUv.exe
  2⤵
  PID:10628
- C:\Windows\System\kiKFUSx.exe
  C:\Windows\System\kiKFUSx.exe
  2⤵
  PID:10656
- C:\Windows\System\YwVzmXI.exe
  C:\Windows\System\YwVzmXI.exe
  2⤵
  PID:10688
- C:\Windows\System\izeEmjZ.exe
  C:\Windows\System\izeEmjZ.exe
  2⤵
  PID:10716
- C:\Windows\System\VnnwFAa.exe
  C:\Windows\System\VnnwFAa.exe
  2⤵
  PID:10756
- C:\Windows\System\Xpifceg.exe
  C:\Windows\System\Xpifceg.exe
  2⤵
  PID:10784
- C:\Windows\System\fybAtfc.exe
  C:\Windows\System\fybAtfc.exe
  2⤵
  PID:10812
- C:\Windows\System\fzisgvC.exe
  C:\Windows\System\fzisgvC.exe
  2⤵
  PID:10832
- C:\Windows\System\erRsdJi.exe
  C:\Windows\System\erRsdJi.exe
  2⤵
  PID:10856
- C:\Windows\System\SkJRjsn.exe
  C:\Windows\System\SkJRjsn.exe
  2⤵
  PID:10876
- C:\Windows\System\yixMuPh.exe
  C:\Windows\System\yixMuPh.exe
  2⤵
  PID:10908
- C:\Windows\System\AAIQYOY.exe
  C:\Windows\System\AAIQYOY.exe
  2⤵
  PID:10940
- C:\Windows\System\taOUMQY.exe
  C:\Windows\System\taOUMQY.exe
  2⤵
  PID:10976
- C:\Windows\System\gujMdrV.exe
  C:\Windows\System\gujMdrV.exe
  2⤵
  PID:10992
- C:\Windows\System\RNvVQQz.exe
  C:\Windows\System\RNvVQQz.exe
  2⤵
  PID:11024
- C:\Windows\System\KyBTSqD.exe
  C:\Windows\System\KyBTSqD.exe
  2⤵
  PID:11052
- C:\Windows\System\NuKnUzs.exe
  C:\Windows\System\NuKnUzs.exe
  2⤵
  PID:11076
- C:\Windows\System\LKSHExw.exe
  C:\Windows\System\LKSHExw.exe
  2⤵
  PID:11108
- C:\Windows\System\RITGptL.exe
  C:\Windows\System\RITGptL.exe
  2⤵
  PID:11136
- C:\Windows\System\LIXSDeW.exe
  C:\Windows\System\LIXSDeW.exe
  2⤵
  PID:11156
- C:\Windows\System\XNFaFpa.exe
  C:\Windows\System\XNFaFpa.exe
  2⤵
  PID:11176
- C:\Windows\System\gzUgIpv.exe
  C:\Windows\System\gzUgIpv.exe
  2⤵
  PID:11204
- C:\Windows\System\DSJJjrU.exe
  C:\Windows\System\DSJJjrU.exe
  2⤵
  PID:11260
- C:\Windows\System\MltCiAO.exe
  C:\Windows\System\MltCiAO.exe
  2⤵
  PID:10244
- C:\Windows\System\QbMFkPC.exe
  C:\Windows\System\QbMFkPC.exe
  2⤵
  PID:10336
- C:\Windows\System\auyXaqa.exe
  C:\Windows\System\auyXaqa.exe
  2⤵
  PID:10392
- C:\Windows\System\YizGZhi.exe
  C:\Windows\System\YizGZhi.exe
  2⤵
  PID:10424
- C:\Windows\System\fCyVpCw.exe
  C:\Windows\System\fCyVpCw.exe
  2⤵
  PID:10500
- C:\Windows\System\iuCTvlP.exe
  C:\Windows\System\iuCTvlP.exe
  2⤵
  PID:10560
- C:\Windows\System\RnAHpAB.exe
  C:\Windows\System\RnAHpAB.exe
  2⤵
  PID:10652
- C:\Windows\System\ckWJlMn.exe
  C:\Windows\System\ckWJlMn.exe
  2⤵
  PID:10752
- C:\Windows\System\PiVyLhM.exe
  C:\Windows\System\PiVyLhM.exe
  2⤵
  PID:10820
- C:\Windows\System\TMSqeoB.exe
  C:\Windows\System\TMSqeoB.exe
  2⤵
  PID:10864
- C:\Windows\System\WvzEnhF.exe
  C:\Windows\System\WvzEnhF.exe
  2⤵
  PID:10896
- C:\Windows\System\hdEZnvt.exe
  C:\Windows\System\hdEZnvt.exe
  2⤵
  PID:10988
- C:\Windows\System\BQlRGdG.exe
  C:\Windows\System\BQlRGdG.exe
  2⤵
  PID:11072
- C:\Windows\System\EXlNNpt.exe
  C:\Windows\System\EXlNNpt.exe
  2⤵
  PID:11144
- C:\Windows\System\jXQQJCJ.exe
  C:\Windows\System\jXQQJCJ.exe
  2⤵
  PID:11196
- C:\Windows\System\zDxjmQe.exe
  C:\Windows\System\zDxjmQe.exe
  2⤵
  PID:11228
- C:\Windows\System\CGdhQOw.exe
  C:\Windows\System\CGdhQOw.exe
  2⤵
  PID:10360
- C:\Windows\System\WYtwaHC.exe
  C:\Windows\System\WYtwaHC.exe
  2⤵
  PID:10440
- C:\Windows\System\jOYKFFW.exe
  C:\Windows\System\jOYKFFW.exe
  2⤵
  PID:10508
- C:\Windows\System\RsZfSLU.exe
  C:\Windows\System\RsZfSLU.exe
  2⤵
  PID:10776
- C:\Windows\System\yrJBHJM.exe
  C:\Windows\System\yrJBHJM.exe
  2⤵
  PID:10932
- C:\Windows\System\fupXMpU.exe
  C:\Windows\System\fupXMpU.exe
  2⤵
  PID:11152
- C:\Windows\System\BMrkGFx.exe
  C:\Windows\System\BMrkGFx.exe
  2⤵
  PID:10384
- C:\Windows\System\TcbFSpY.exe
  C:\Windows\System\TcbFSpY.exe
  2⤵
  PID:10744
- C:\Windows\System\FKlIbHE.exe
  C:\Windows\System\FKlIbHE.exe
  2⤵
  PID:10852
- C:\Windows\System\wohfjob.exe
  C:\Windows\System\wohfjob.exe
  2⤵
  PID:9332
- C:\Windows\System\xePuotA.exe
  C:\Windows\System\xePuotA.exe
  2⤵
  PID:11088
- C:\Windows\System\tdJhImj.exe
  C:\Windows\System\tdJhImj.exe
  2⤵
  PID:11276
- C:\Windows\System\wGvQPSR.exe
  C:\Windows\System\wGvQPSR.exe
  2⤵
  PID:11312
- C:\Windows\System\chmIpTL.exe
  C:\Windows\System\chmIpTL.exe
  2⤵
  PID:11340
- C:\Windows\System\hWIizja.exe
  C:\Windows\System\hWIizja.exe
  2⤵
  PID:11356
- C:\Windows\System\ktntnCF.exe
  C:\Windows\System\ktntnCF.exe
  2⤵
  PID:11372
- C:\Windows\System\hUMyeEQ.exe
  C:\Windows\System\hUMyeEQ.exe
  2⤵
  PID:11412
- C:\Windows\System\uxYFBum.exe
  C:\Windows\System\uxYFBum.exe
  2⤵
  PID:11428
- C:\Windows\System\UDjJtrU.exe
  C:\Windows\System\UDjJtrU.exe
  2⤵
  PID:11472
- C:\Windows\System\XzXbQWv.exe
  C:\Windows\System\XzXbQWv.exe
  2⤵
  PID:11508
- C:\Windows\System\puViKSa.exe
  C:\Windows\System\puViKSa.exe
  2⤵
  PID:11536
- C:\Windows\System\KDMWAEG.exe
  C:\Windows\System\KDMWAEG.exe
  2⤵
  PID:11568
- C:\Windows\System\mAzPpqM.exe
  C:\Windows\System\mAzPpqM.exe
  2⤵
  PID:11596
- C:\Windows\System\GOKsuJf.exe
  C:\Windows\System\GOKsuJf.exe
  2⤵
  PID:11624
- C:\Windows\System\JcYDtdk.exe
  C:\Windows\System\JcYDtdk.exe
  2⤵
  PID:11652
- C:\Windows\System\aaLXjOS.exe
  C:\Windows\System\aaLXjOS.exe
  2⤵
  PID:11680
- C:\Windows\System\bblRJNd.exe
  C:\Windows\System\bblRJNd.exe
  2⤵
  PID:11708
- C:\Windows\System\SqwGCoc.exe
  C:\Windows\System\SqwGCoc.exe
  2⤵
  PID:11724
- C:\Windows\System\vWxoyKp.exe
  C:\Windows\System\vWxoyKp.exe
  2⤵
  PID:11752
- C:\Windows\System\HsZyqIl.exe
  C:\Windows\System\HsZyqIl.exe
  2⤵
  PID:11784
- C:\Windows\System\cEXOIXI.exe
  C:\Windows\System\cEXOIXI.exe
  2⤵
  PID:11820
- C:\Windows\System\PfasAZm.exe
  C:\Windows\System\PfasAZm.exe
  2⤵
  PID:11848
- C:\Windows\System\scynsbE.exe
  C:\Windows\System\scynsbE.exe
  2⤵
  PID:11864
- C:\Windows\System\izKKoEk.exe
  C:\Windows\System\izKKoEk.exe
  2⤵
  PID:11904
- C:\Windows\System\vIsnhrg.exe
  C:\Windows\System\vIsnhrg.exe
  2⤵
  PID:11924
- C:\Windows\System\KPFtqIJ.exe
  C:\Windows\System\KPFtqIJ.exe
  2⤵
  PID:11948
- C:\Windows\System\nriSoqH.exe
  C:\Windows\System\nriSoqH.exe
  2⤵
  PID:11976
- C:\Windows\System\TSanLwE.exe
  C:\Windows\System\TSanLwE.exe
  2⤵
  PID:12000
- C:\Windows\System\rEfQNIc.exe
  C:\Windows\System\rEfQNIc.exe
  2⤵
  PID:12032
- C:\Windows\System\EhZalal.exe
  C:\Windows\System\EhZalal.exe
  2⤵
  PID:12060
- C:\Windows\System\jopUdwF.exe
  C:\Windows\System\jopUdwF.exe
  2⤵
  PID:12088
- C:\Windows\System\HMqGHZg.exe
  C:\Windows\System\HMqGHZg.exe
  2⤵
  PID:12116
- C:\Windows\System\HOaGKna.exe
  C:\Windows\System\HOaGKna.exe
  2⤵
  PID:12148
- C:\Windows\System\ONqbVzj.exe
  C:\Windows\System\ONqbVzj.exe
  2⤵
  PID:12180
- C:\Windows\System\zjnaSPP.exe
  C:\Windows\System\zjnaSPP.exe
  2⤵
  PID:12208
- C:\Windows\System\rbKQwcY.exe
  C:\Windows\System\rbKQwcY.exe
  2⤵
  PID:12240
- C:\Windows\System\YdgrmnO.exe
  C:\Windows\System\YdgrmnO.exe
  2⤵
  PID:12268
- C:\Windows\System\jINGfob.exe
  C:\Windows\System\jINGfob.exe
  2⤵
  PID:10668
- C:\Windows\System\lsGkaJB.exe
  C:\Windows\System\lsGkaJB.exe
  2⤵
  PID:11308
- C:\Windows\System\xmjVEPi.exe
  C:\Windows\System\xmjVEPi.exe
  2⤵
  PID:11384
- C:\Windows\System\UqXyyMq.exe
  C:\Windows\System\UqXyyMq.exe
  2⤵
  PID:11444
- C:\Windows\System\KhWhsiu.exe
  C:\Windows\System\KhWhsiu.exe
  2⤵
  PID:11504
- C:\Windows\System\gADynbH.exe
  C:\Windows\System\gADynbH.exe
  2⤵
  PID:11564
- C:\Windows\System\yHOQQMn.exe
  C:\Windows\System\yHOQQMn.exe
  2⤵
  PID:11676
- C:\Windows\System\TNgYAUc.exe
  C:\Windows\System\TNgYAUc.exe
  2⤵
  PID:11740
- C:\Windows\System\aEMmtAe.exe
  C:\Windows\System\aEMmtAe.exe
  2⤵
  PID:11796
- C:\Windows\System\vyYgNwu.exe
  C:\Windows\System\vyYgNwu.exe
  2⤵
  PID:11892
- C:\Windows\System\HxsbDTJ.exe
  C:\Windows\System\HxsbDTJ.exe
  2⤵
  PID:11944
- C:\Windows\System\UWrRoXb.exe
  C:\Windows\System\UWrRoXb.exe
  2⤵
  PID:12016
- C:\Windows\System\MHuqscN.exe
  C:\Windows\System\MHuqscN.exe
  2⤵
  PID:12076
- C:\Windows\System\VNrkmjO.exe
  C:\Windows\System\VNrkmjO.exe
  2⤵
  PID:12156
- C:\Windows\System\ysCDkRH.exe
  C:\Windows\System\ysCDkRH.exe
  2⤵
  PID:12204
- C:\Windows\System\uGNrLAe.exe
  C:\Windows\System\uGNrLAe.exe
  2⤵
  PID:12252
- C:\Windows\System\sFoTIWF.exe
  C:\Windows\System\sFoTIWF.exe
  2⤵
  PID:11396
- C:\Windows\System\HxscxWa.exe
  C:\Windows\System\HxscxWa.exe
  2⤵
  PID:11460
- C:\Windows\System\JrAxKhj.exe
  C:\Windows\System\JrAxKhj.exe
  2⤵
  PID:11668
- C:\Windows\System\gRyIMsL.exe
  C:\Windows\System\gRyIMsL.exe
  2⤵
  PID:11780
- C:\Windows\System\zFZRpWX.exe
  C:\Windows\System\zFZRpWX.exe
  2⤵
  PID:11936
- C:\Windows\System\buzXphk.exe
  C:\Windows\System\buzXphk.exe
  2⤵
  PID:12080
- C:\Windows\System\jmKxvyq.exe
  C:\Windows\System\jmKxvyq.exe
  2⤵
  PID:12188
- C:\Windows\System\TsBcetr.exe
  C:\Windows\System\TsBcetr.exe
  2⤵
  PID:11424
- C:\Windows\System\ZiwcQah.exe
  C:\Windows\System\ZiwcQah.exe
  2⤵
  PID:11856
- C:\Windows\System\FVlfGHg.exe
  C:\Windows\System\FVlfGHg.exe
  2⤵
  PID:12136
- C:\Windows\System\rPwetbE.exe
  C:\Windows\System\rPwetbE.exe
  2⤵
  PID:12236
- C:\Windows\System\DjwEaQr.exe
  C:\Windows\System\DjwEaQr.exe
  2⤵
  PID:12296
- C:\Windows\System\uVQqEUX.exe
  C:\Windows\System\uVQqEUX.exe
  2⤵
  PID:12312
- C:\Windows\System\zLBgLad.exe
  C:\Windows\System\zLBgLad.exe
  2⤵
  PID:12328
- C:\Windows\System\cDRaxys.exe
  C:\Windows\System\cDRaxys.exe
  2⤵
  PID:12348
- C:\Windows\System\xEIVriv.exe
  C:\Windows\System\xEIVriv.exe
  2⤵
  PID:12368
- C:\Windows\System\YjvOBgy.exe
  C:\Windows\System\YjvOBgy.exe
  2⤵
  PID:12432
- C:\Windows\System\yOjfTVz.exe
  C:\Windows\System\yOjfTVz.exe
  2⤵
  PID:12476
- C:\Windows\System\KGVJKBt.exe
  C:\Windows\System\KGVJKBt.exe
  2⤵
  PID:12500
- C:\Windows\System\rufIdlU.exe
  C:\Windows\System\rufIdlU.exe
  2⤵
  PID:12520
- C:\Windows\System\PjzsOZV.exe
  C:\Windows\System\PjzsOZV.exe
  2⤵
  PID:12552
- C:\Windows\System\fsqImQi.exe
  C:\Windows\System\fsqImQi.exe
  2⤵
  PID:12580
- C:\Windows\System\FtIdZeB.exe
  C:\Windows\System\FtIdZeB.exe
  2⤵
  PID:12596
- C:\Windows\System\rQZLkFe.exe
  C:\Windows\System\rQZLkFe.exe
  2⤵
  PID:12616
- C:\Windows\System\HgqTyQM.exe
  C:\Windows\System\HgqTyQM.exe
  2⤵
  PID:12672
- C:\Windows\System\ncsjKqz.exe
  C:\Windows\System\ncsjKqz.exe
  2⤵
  PID:12700
- C:\Windows\System\fEJVjLv.exe
  C:\Windows\System\fEJVjLv.exe
  2⤵
  PID:12728
- C:\Windows\System\EWNUCZx.exe
  C:\Windows\System\EWNUCZx.exe
  2⤵
  PID:12756
- C:\Windows\System\RHOnktD.exe
  C:\Windows\System\RHOnktD.exe
  2⤵
  PID:12788
- C:\Windows\System\DhFiTTk.exe
  C:\Windows\System\DhFiTTk.exe
  2⤵
  PID:12816
- C:\Windows\System\OTVnqUe.exe
  C:\Windows\System\OTVnqUe.exe
  2⤵
  PID:12832
- C:\Windows\System\sjUvAZa.exe
  C:\Windows\System\sjUvAZa.exe
  2⤵
  PID:12872
- C:\Windows\System\WsMotEO.exe
  C:\Windows\System\WsMotEO.exe
  2⤵
  PID:12896
- C:\Windows\System\imAZWTe.exe
  C:\Windows\System\imAZWTe.exe
  2⤵
  PID:12920
- C:\Windows\System\kkSyYZv.exe
  C:\Windows\System\kkSyYZv.exe
  2⤵
  PID:12956
- C:\Windows\System\hpBFNGw.exe
  C:\Windows\System\hpBFNGw.exe
  2⤵
  PID:12972
- C:\Windows\System\TiSdMxZ.exe
  C:\Windows\System\TiSdMxZ.exe
  2⤵
  PID:12992
- C:\Windows\System\NZwJpsw.exe
  C:\Windows\System\NZwJpsw.exe
  2⤵
  PID:13020
- C:\Windows\System\lHEWcHI.exe
  C:\Windows\System\lHEWcHI.exe
  2⤵
  PID:13048
- C:\Windows\System\NKauVjg.exe
  C:\Windows\System\NKauVjg.exe
  2⤵
  PID:13076
- C:\Windows\System\CdsLuxZ.exe
  C:\Windows\System\CdsLuxZ.exe
  2⤵
  PID:13100
- C:\Windows\System\uwOgyXf.exe
  C:\Windows\System\uwOgyXf.exe
  2⤵
  PID:13124
- C:\Windows\System\obJRbdW.exe
  C:\Windows\System\obJRbdW.exe
  2⤵
  PID:13168
- C:\Windows\System\vJcNPgs.exe
  C:\Windows\System\vJcNPgs.exe
  2⤵
  PID:13200
- C:\Windows\System\EUsvfdX.exe
  C:\Windows\System\EUsvfdX.exe
  2⤵
  PID:13224
- C:\Windows\System\pymQKPO.exe
  C:\Windows\System\pymQKPO.exe
  2⤵
  PID:13252
- C:\Windows\System\nHQOlYM.exe
  C:\Windows\System\nHQOlYM.exe
  2⤵
  PID:13292
- C:\Windows\System\CjsPwLj.exe
  C:\Windows\System\CjsPwLj.exe
  2⤵
  PID:13308
- C:\Windows\System\lLlMfPc.exe
  C:\Windows\System\lLlMfPc.exe
  2⤵
  PID:12336
- C:\Windows\System\pRIFcKM.exe
  C:\Windows\System\pRIFcKM.exe
  2⤵
  PID:12380
- C:\Windows\System\MZZvRAg.exe
  C:\Windows\System\MZZvRAg.exe
  2⤵
  PID:12492
- C:\Windows\System\oUGdbOx.exe
  C:\Windows\System\oUGdbOx.exe
  2⤵
  PID:12568
- C:\Windows\System\hVbbBjC.exe
  C:\Windows\System\hVbbBjC.exe
  2⤵
  PID:12612
- C:\Windows\System\nhbouGT.exe
  C:\Windows\System\nhbouGT.exe
  2⤵
  PID:12668
- C:\Windows\System\iaDBlMb.exe
  C:\Windows\System\iaDBlMb.exe
  2⤵
  PID:12724
- C:\Windows\System\DgzabBt.exe
  C:\Windows\System\DgzabBt.exe
  2⤵
  PID:12800
- C:\Windows\System\SseoOWu.exe
  C:\Windows\System\SseoOWu.exe
  2⤵
  PID:12888
- C:\Windows\System\QDdCpXT.exe
  C:\Windows\System\QDdCpXT.exe
  2⤵
  PID:12948
- C:\Windows\System\BrGWCFm.exe
  C:\Windows\System\BrGWCFm.exe
  2⤵
  PID:12984
- C:\Windows\System\qCkarIs.exe
  C:\Windows\System\qCkarIs.exe
  2⤵
  PID:13028
- C:\Windows\System\rOyLIps.exe
  C:\Windows\System\rOyLIps.exe
  2⤵
  PID:13152
- C:\Windows\System\NPIMfvr.exe
  C:\Windows\System\NPIMfvr.exe
  2⤵
  PID:13220
- C:\Windows\System\OfVTBBA.exe
  C:\Windows\System\OfVTBBA.exe
  2⤵
  PID:13236
- C:\Windows\System\stWAGYx.exe
  C:\Windows\System\stWAGYx.exe
  2⤵
  PID:12308
- C:\Windows\System\QqaoDTW.exe
  C:\Windows\System\QqaoDTW.exe
  2⤵
  PID:12456
- C:\Windows\System\xLhuRqD.exe
  C:\Windows\System\xLhuRqD.exe
  2⤵
  PID:12632
- C:\Windows\System\TuubiJx.exe
  C:\Windows\System\TuubiJx.exe
  2⤵
  PID:12780
- C:\Windows\System\iJtmeTH.exe
  C:\Windows\System\iJtmeTH.exe
  2⤵
  PID:12944
- C:\Windows\System\aacPTRU.exe
  C:\Windows\System\aacPTRU.exe
  2⤵
  PID:13060
- C:\Windows\System\udsjoYt.exe
  C:\Windows\System\udsjoYt.exe
  2⤵
  PID:13180
- C:\Windows\System\wtxxYoY.exe
  C:\Windows\System\wtxxYoY.exe
  2⤵
  PID:12416
- C:\Windows\System\IwSIire.exe
  C:\Windows\System\IwSIire.exe
  2⤵
  PID:12856
- C:\Windows\System\uAooJwD.exe
  C:\Windows\System\uAooJwD.exe
  2⤵
  PID:13184
- C:\Windows\System\qurQfUX.exe
  C:\Windows\System\qurQfUX.exe
  2⤵
  PID:12696
- C:\Windows\System\xVjGHMX.exe
  C:\Windows\System\xVjGHMX.exe
  2⤵
  PID:13116
- C:\Windows\System\NPqgGjv.exe
  C:\Windows\System\NPqgGjv.exe
  2⤵
  PID:13328
- C:\Windows\System\gvQisqj.exe
  C:\Windows\System\gvQisqj.exe
  2⤵
  PID:13360
- C:\Windows\System\NMGULtG.exe
  C:\Windows\System\NMGULtG.exe
  2⤵
  PID:13388
- C:\Windows\System\guqrYJo.exe
  C:\Windows\System\guqrYJo.exe
  2⤵
  PID:13416
- C:\Windows\System\FOgxoTp.exe
  C:\Windows\System\FOgxoTp.exe
  2⤵
  PID:13432
- C:\Windows\System\cyWxoUw.exe
  C:\Windows\System\cyWxoUw.exe
  2⤵
  PID:13460
- C:\Windows\System\jGMEnmd.exe
  C:\Windows\System\jGMEnmd.exe
  2⤵
  PID:13496
- C:\Windows\System\kmZBXpy.exe
  C:\Windows\System\kmZBXpy.exe
  2⤵
  PID:13528
- C:\Windows\System\OPJWIbD.exe
  C:\Windows\System\OPJWIbD.exe
  2⤵
  PID:13556
- C:\Windows\System\MwpPakm.exe
  C:\Windows\System\MwpPakm.exe
  2⤵
  PID:13572
- C:\Windows\System\khCXrwP.exe
  C:\Windows\System\khCXrwP.exe
  2⤵
  PID:13600
- C:\Windows\System\nRDTMLC.exe
  C:\Windows\System\nRDTMLC.exe
  2⤵
  PID:13640
- C:\Windows\System\ToWTrOp.exe
  C:\Windows\System\ToWTrOp.exe
  2⤵
  PID:13664
- C:\Windows\System\rqKwvJD.exe
  C:\Windows\System\rqKwvJD.exe
  2⤵
  PID:13684
- C:\Windows\System\Kjtiprn.exe
  C:\Windows\System\Kjtiprn.exe
  2⤵
  PID:13724
- C:\Windows\System\LlfocZa.exe
  C:\Windows\System\LlfocZa.exe
  2⤵
  PID:13752
- C:\Windows\System\okDiccs.exe
  C:\Windows\System\okDiccs.exe
  2⤵
  PID:13768
- C:\Windows\System\wFkzhny.exe
  C:\Windows\System\wFkzhny.exe
  2⤵
  PID:13796
- C:\Windows\System\KdUAIGr.exe
  C:\Windows\System\KdUAIGr.exe
  2⤵
  PID:13836
- C:\Windows\System\GlOTlcg.exe
  C:\Windows\System\GlOTlcg.exe
  2⤵
  PID:13864
- C:\Windows\System\zJBQpWC.exe
  C:\Windows\System\zJBQpWC.exe
  2⤵
  PID:13880
- C:\Windows\System\bWGieKs.exe
  C:\Windows\System\bWGieKs.exe
  2⤵
  PID:13916
- C:\Windows\System\YzTjUrn.exe
  C:\Windows\System\YzTjUrn.exe
  2⤵
  PID:13936
- C:\Windows\System\BtKmogM.exe
  C:\Windows\System\BtKmogM.exe
  2⤵
  PID:13964
- C:\Windows\System\ohTOkNI.exe
  C:\Windows\System\ohTOkNI.exe
  2⤵
  PID:13996
- C:\Windows\System\wjisKKI.exe
  C:\Windows\System\wjisKKI.exe
  2⤵
  PID:14024
- C:\Windows\System\NoZlWDb.exe
  C:\Windows\System\NoZlWDb.exe
  2⤵
  PID:14048
- C:\Windows\System\wDYolDw.exe
  C:\Windows\System\wDYolDw.exe
  2⤵
  PID:14076
- C:\Windows\System\RZVhBFW.exe
  C:\Windows\System\RZVhBFW.exe
  2⤵
  PID:14104
- C:\Windows\System\WZhChTD.exe
  C:\Windows\System\WZhChTD.exe
  2⤵
  PID:14120
- C:\Windows\System\xuRLPus.exe
  C:\Windows\System\xuRLPus.exe
  2⤵
  PID:14156
- C:\Windows\System\HOrGUbC.exe
  C:\Windows\System\HOrGUbC.exe
  2⤵
  PID:14188
- C:\Windows\System\AivPKtx.exe
  C:\Windows\System\AivPKtx.exe
  2⤵
  PID:14228
- C:\Windows\System\LxjWHvj.exe
  C:\Windows\System\LxjWHvj.exe
  2⤵
  PID:14256
- C:\Windows\System\Dmdbqpa.exe
  C:\Windows\System\Dmdbqpa.exe
  2⤵
  PID:14284
- C:\Windows\System\wJASCHJ.exe
  C:\Windows\System\wJASCHJ.exe
  2⤵
  PID:14312
- C:\Windows\System\aNQHbFe.exe
  C:\Windows\System\aNQHbFe.exe
  2⤵
  PID:14328
- C:\Windows\System\ZVkvgYP.exe
  C:\Windows\System\ZVkvgYP.exe
  2⤵
  PID:13384
- C:\Windows\System\PtABJTu.exe
  C:\Windows\System\PtABJTu.exe
  2⤵
  PID:13448
- C:\Windows\System\CznubEL.exe
  C:\Windows\System\CznubEL.exe
  2⤵
  PID:13512
- C:\Windows\System\zITWwoo.exe
  C:\Windows\System\zITWwoo.exe
  2⤵
  PID:13540
- C:\Windows\System\kgZQREC.exe
  C:\Windows\System\kgZQREC.exe
  2⤵
  PID:13596
- C:\Windows\System\tXfYtXV.exe
  C:\Windows\System\tXfYtXV.exe
  2⤵
  PID:13660
- C:\Windows\System\InWBsvT.exe
  C:\Windows\System\InWBsvT.exe
  2⤵
  PID:13716
- C:\Windows\System\miOCjxf.exe
  C:\Windows\System\miOCjxf.exe
  2⤵
  PID:13792
- C:\Windows\System\hUYXbSI.exe
  C:\Windows\System\hUYXbSI.exe
  2⤵
  PID:13948
- C:\Windows\System\JTbbAuF.exe
  C:\Windows\System\JTbbAuF.exe
  2⤵
  PID:13992
- C:\Windows\System\ywomxBW.exe
  C:\Windows\System\ywomxBW.exe
  2⤵
  PID:14020
- C:\Windows\System\RcqyNZp.exe
  C:\Windows\System\RcqyNZp.exe
  2⤵
  PID:14116
- C:\Windows\System\SwkHfWK.exe
  C:\Windows\System\SwkHfWK.exe
  2⤵
  PID:14196
- C:\Windows\System\PEAuNJR.exe
  C:\Windows\System\PEAuNJR.exe
  2⤵
  PID:14304
- C:\Windows\System\WflKNat.exe
  C:\Windows\System\WflKNat.exe
  2⤵
  PID:13444
- C:\Windows\System\oUqzxNR.exe
  C:\Windows\System\oUqzxNR.exe
  2⤵
  PID:13584
- C:\Windows\System\irAaWug.exe
  C:\Windows\System\irAaWug.exe
  2⤵
  PID:13760
- C:\Windows\System\EbLLDyJ.exe
  C:\Windows\System\EbLLDyJ.exe
  2⤵
  PID:13912
- C:\Windows\System\bhsnzrp.exe
  C:\Windows\System\bhsnzrp.exe
  2⤵
  PID:14132
- C:\Windows\System\NkyKeqT.exe
  C:\Windows\System\NkyKeqT.exe
  2⤵
  PID:14244
- C:\Windows\System\JcUsoYx.exe
  C:\Windows\System\JcUsoYx.exe
  2⤵
  PID:13372
- C:\Windows\System\vwhYUhk.exe
  C:\Windows\System\vwhYUhk.exe
  2⤵
  PID:13784
- C:\Windows\System\VlFdbpO.exe
  C:\Windows\System\VlFdbpO.exe
  2⤵
  PID:13324
- C:\Windows\System\kIbhXwG.exe
  C:\Windows\System\kIbhXwG.exe
  2⤵
  PID:13520
- C:\Windows\System\pjIOkJz.exe
  C:\Windows\System\pjIOkJz.exe
  2⤵
  PID:14352
- C:\Windows\System\XtbRqZW.exe
  C:\Windows\System\XtbRqZW.exe
  2⤵
  PID:14384
- C:\Windows\System\usVDKPY.exe
  C:\Windows\System\usVDKPY.exe
  2⤵
  PID:14412
- C:\Windows\System\INGgJbq.exe
  C:\Windows\System\INGgJbq.exe
  2⤵
  PID:14440
- C:\Windows\System\bgakOFL.exe
  C:\Windows\System\bgakOFL.exe
  2⤵
  PID:14456
- C:\Windows\System\yymCkqp.exe
  C:\Windows\System\yymCkqp.exe
  2⤵
  PID:14496
- C:\Windows\System\RnFDWhp.exe
  C:\Windows\System\RnFDWhp.exe
  2⤵
  PID:14520
- C:\Windows\System\yILCdaA.exe
  C:\Windows\System\yILCdaA.exe
  2⤵
  PID:14548
- C:\Windows\System\echJEnv.exe
  C:\Windows\System\echJEnv.exe
  2⤵
  PID:14572
- C:\Windows\System\BkzMhzT.exe
  C:\Windows\System\BkzMhzT.exe
  2⤵
  PID:14608
- C:\Windows\System\ibQHxcg.exe
  C:\Windows\System\ibQHxcg.exe
  2⤵
  PID:14636
- C:\Windows\System\SbsgGtO.exe
  C:\Windows\System\SbsgGtO.exe
  2⤵
  PID:14652
- C:\Windows\System\iIEtdzg.exe
  C:\Windows\System\iIEtdzg.exe
  2⤵
  PID:14692
- C:\Windows\System\rfivNmd.exe
  C:\Windows\System\rfivNmd.exe
  2⤵
  PID:14720
- C:\Windows\System\jDiNahA.exe
  C:\Windows\System\jDiNahA.exe
  2⤵
  PID:14748
- C:\Windows\System\pcqFHcy.exe
  C:\Windows\System\pcqFHcy.exe
  2⤵
  PID:14772
- C:\Windows\System\ldmBNAA.exe
  C:\Windows\System\ldmBNAA.exe
  2⤵
  PID:14792
- C:\Windows\System\FgQhkLR.exe
  C:\Windows\System\FgQhkLR.exe
  2⤵
  PID:14828
- C:\Windows\System\tjkIFeK.exe
  C:\Windows\System\tjkIFeK.exe
  2⤵
  PID:14852
- C:\Windows\System\CzmUmUL.exe
  C:\Windows\System\CzmUmUL.exe
  2⤵
  PID:14876
- C:\Windows\System\oKlLxow.exe
  C:\Windows\System\oKlLxow.exe
  2⤵
  PID:14916
- C:\Windows\System\XxSwqUx.exe
  C:\Windows\System\XxSwqUx.exe
  2⤵
  PID:14944
- C:\Windows\System\ypmuuVZ.exe
  C:\Windows\System\ypmuuVZ.exe
  2⤵
  PID:15000
- C:\Windows\System\xBhznNv.exe
  C:\Windows\System\xBhznNv.exe
  2⤵
  PID:15032
- C:\Windows\System\qzYdXCv.exe
  C:\Windows\System\qzYdXCv.exe
  2⤵
  PID:15088
- C:\Windows\System\nGovbfw.exe
  C:\Windows\System\nGovbfw.exe
  2⤵
  PID:15128
- C:\Windows\System\RWGEVNv.exe
  C:\Windows\System\RWGEVNv.exe
  2⤵
  PID:15156
- C:\Windows\System\fTzytcY.exe
  C:\Windows\System\fTzytcY.exe
  2⤵
  PID:15172
- C:\Windows\System\xzmGtHP.exe
  C:\Windows\System\xzmGtHP.exe
  2⤵
  PID:15204
- C:\Windows\System\UXhGslC.exe
  C:\Windows\System\UXhGslC.exe
  2⤵
  PID:15244
- C:\Windows\System\HdReQLz.exe
  C:\Windows\System\HdReQLz.exe
  2⤵
  PID:15272
- C:\Windows\System\wfbtrUi.exe
  C:\Windows\System\wfbtrUi.exe
  2⤵
  PID:15300
- C:\Windows\System\JpriUDG.exe
  C:\Windows\System\JpriUDG.exe
  2⤵
  PID:14036
- C:\Windows\System\FLZBRxl.exe
  C:\Windows\System\FLZBRxl.exe
  2⤵
  PID:14404
- C:\Windows\System\xsZbxkk.exe
  C:\Windows\System\xsZbxkk.exe
  2⤵
  PID:14472
- C:\Windows\System\ShvJkva.exe
  C:\Windows\System\ShvJkva.exe
  2⤵
  PID:14568
- C:\Windows\System\iIckjOK.exe
  C:\Windows\System\iIckjOK.exe
  2⤵
  PID:14632
- C:\Windows\System\bpzPMkY.exe
  C:\Windows\System\bpzPMkY.exe
  2⤵
  PID:14704
- C:\Windows\System\hKtmJHh.exe
  C:\Windows\System\hKtmJHh.exe
  2⤵
  PID:14804
- C:\Windows\System\RbrVXGb.exe
  C:\Windows\System\RbrVXGb.exe
  2⤵
  PID:14860
- C:\Windows\System\hUzLePU.exe
  C:\Windows\System\hUzLePU.exe
  2⤵
  PID:14932
- C:\Windows\System\VelwkUM.exe
  C:\Windows\System\VelwkUM.exe
  2⤵
  PID:15056
- C:\Windows\System\HCROFqU.exe
  C:\Windows\System\HCROFqU.exe
  2⤵
  PID:15144
- C:\Windows\System\kDBXTOz.exe
  C:\Windows\System\kDBXTOz.exe
  2⤵
  PID:15220
- C:\Windows\System\MtlgHBx.exe
  C:\Windows\System\MtlgHBx.exe
  2⤵
  PID:15292
- C:\Windows\System\KVzotiI.exe
  C:\Windows\System\KVzotiI.exe
  2⤵
  PID:14368
- C:\Windows\System\xWDsVPW.exe
  C:\Windows\System\xWDsVPW.exe
  2⤵
  PID:14544
- C:\Windows\System\YcICQHz.exe
  C:\Windows\System\YcICQHz.exe
  2⤵
  PID:14784
- C:\Windows\System\eEyjFwv.exe
  C:\Windows\System\eEyjFwv.exe
  2⤵
  PID:14892
- C:\Windows\System\LRfrhMF.exe
  C:\Windows\System\LRfrhMF.exe
  2⤵
  PID:15028
- C:\Windows\System\OKRXQab.exe
  C:\Windows\System\OKRXQab.exe
  2⤵
  PID:15268
- C:\Windows\System\NkaFyvS.exe
  C:\Windows\System\NkaFyvS.exe
  2⤵
  PID:14732
- C:\Windows\System\zMHSQYs.exe
  C:\Windows\System\zMHSQYs.exe
  2⤵
  PID:15356
- C:\Windows\System\baRAEGy.exe
  C:\Windows\System\baRAEGy.exe
  2⤵
  PID:15196
- C:\Windows\System\uCrlcqm.exe
  C:\Windows\System\uCrlcqm.exe
  2⤵
  PID:15380
- C:\Windows\System\CHKOFNH.exe
  C:\Windows\System\CHKOFNH.exe
  2⤵
  PID:15408
- C:\Windows\System\DVuemLc.exe
  C:\Windows\System\DVuemLc.exe
  2⤵
  PID:15428
- C:\Windows\System\HczLcCC.exe
  C:\Windows\System\HczLcCC.exe
  2⤵
  PID:15452
- C:\Windows\System\bwZXYTm.exe
  C:\Windows\System\bwZXYTm.exe
  2⤵
  PID:15480
- C:\Windows\System\NFVaxNT.exe
  C:\Windows\System\NFVaxNT.exe
  2⤵
  PID:15508
- C:\Windows\System\BgxHPXy.exe
  C:\Windows\System\BgxHPXy.exe
  2⤵
  PID:15528
- C:\Windows\System\rPStooN.exe
  C:\Windows\System\rPStooN.exe
  2⤵
  PID:15548
- C:\Windows\System\bkzjCPj.exe
  C:\Windows\System\bkzjCPj.exe
  2⤵
  PID:15568
- C:\Windows\System\qxzYlax.exe
  C:\Windows\System\qxzYlax.exe
  2⤵
  PID:15632
- C:\Windows\System\rlLMLgd.exe
  C:\Windows\System\rlLMLgd.exe
  2⤵
  PID:15656
- C:\Windows\System\RTwpEGM.exe
  C:\Windows\System\RTwpEGM.exe
  2⤵
  PID:15688
- C:\Windows\System\xzHmqFW.exe
  C:\Windows\System\xzHmqFW.exe
  2⤵
  PID:15712
- C:\Windows\System\QxHGyCR.exe
  C:\Windows\System\QxHGyCR.exe
  2⤵
  PID:15740
- C:\Windows\System\aGtqzvu.exe
  C:\Windows\System\aGtqzvu.exe
  2⤵
  PID:15768
- C:\Windows\System\VAfsdNu.exe
  C:\Windows\System\VAfsdNu.exe
  2⤵
  PID:15792
- C:\Windows\System\HehHCQA.exe
  C:\Windows\System\HehHCQA.exe
  2⤵
  PID:15820
- C:\Windows\System\zSWRAga.exe
  C:\Windows\System\zSWRAga.exe
  2⤵
  PID:15840
- C:\Windows\System\aPMiUrN.exe
  C:\Windows\System\aPMiUrN.exe
  2⤵
  PID:15884
- C:\Windows\System\DlzXOId.exe
  C:\Windows\System\DlzXOId.exe
  2⤵
  PID:15912
- C:\Windows\System\xYUJfVw.exe
  C:\Windows\System\xYUJfVw.exe
  2⤵
  PID:15948
- C:\Windows\System\LANgaDU.exe
  C:\Windows\System\LANgaDU.exe
  2⤵
  PID:15976
- C:\Windows\System\sOFLLTk.exe
  C:\Windows\System\sOFLLTk.exe
  2⤵
  PID:16004
- C:\Windows\System\BtaQfjp.exe
  C:\Windows\System\BtaQfjp.exe
  2⤵
  PID:16032
- C:\Windows\System\XUQlrTN.exe
  C:\Windows\System\XUQlrTN.exe
  2⤵
  PID:16052
- C:\Windows\System\uFXwkRx.exe
  C:\Windows\System\uFXwkRx.exe
  2⤵
  PID:16068
- C:\Windows\System\Bjlgjum.exe
  C:\Windows\System\Bjlgjum.exe
  2⤵
  PID:16100
- C:\Windows\System\mHtCoAs.exe
  C:\Windows\System\mHtCoAs.exe
  2⤵
  PID:16148
- C:\Windows\System\ittOnhM.exe
  C:\Windows\System\ittOnhM.exe
  2⤵
  PID:16176
- C:\Windows\System\QUDUufi.exe
  C:\Windows\System\QUDUufi.exe
  2⤵
  PID:16204
- C:\Windows\System\FVyOTBK.exe
  C:\Windows\System\FVyOTBK.exe
  2⤵
  PID:16232
- C:\Windows\System\jcAdBPY.exe
  C:\Windows\System\jcAdBPY.exe
  2⤵
  PID:16272
- C:\Windows\System\njGwmaG.exe
  C:\Windows\System\njGwmaG.exe
  2⤵
  PID:16296
- C:\Windows\System\BkZbNGJ.exe
  C:\Windows\System\BkZbNGJ.exe
  2⤵
  PID:16328
- C:\Windows\System\kBaNpQj.exe
  C:\Windows\System\kBaNpQj.exe
  2⤵
  PID:16356
- C:\Windows\System\nLHraPx.exe
  C:\Windows\System\nLHraPx.exe
  2⤵
  PID:16372
- C:\Windows\System\szFHfJP.exe
  C:\Windows\System\szFHfJP.exe
  2⤵
  PID:15436
- C:\Windows\System\DncRFAj.exe
  C:\Windows\System\DncRFAj.exe
  2⤵
  PID:15500
- C:\Windows\System\wEFkswS.exe
  C:\Windows\System\wEFkswS.exe
  2⤵
  PID:15540
- C:\Windows\System\RqWBnts.exe
  C:\Windows\System\RqWBnts.exe
  2⤵
  PID:15644
- C:\Windows\System\ghfKdbq.exe
  C:\Windows\System\ghfKdbq.exe
  2⤵
  PID:15652
- C:\Windows\System\KVtmFRv.exe
  C:\Windows\System\KVtmFRv.exe
  2⤵
  PID:15736
- C:\Windows\System\CmwPDRG.exe
  C:\Windows\System\CmwPDRG.exe
  2⤵
  PID:15828
- C:\Windows\System\FZTLfAV.exe
  C:\Windows\System\FZTLfAV.exe
  2⤵
  PID:15896
- C:\Windows\System\FrHOzSn.exe
  C:\Windows\System\FrHOzSn.exe
  2⤵
  PID:15984
- C:\Windows\System\EqmVpQT.exe
  C:\Windows\System\EqmVpQT.exe
  2⤵
  PID:16044
- C:\Windows\System\BBKqNUt.exe
  C:\Windows\System\BBKqNUt.exe
  2⤵
  PID:16088
- C:\Windows\System\RtFUFOw.exe
  C:\Windows\System\RtFUFOw.exe
  2⤵
  PID:16164
- C:\Windows\System\vExxemc.exe
  C:\Windows\System\vExxemc.exe
  2⤵
  PID:16224
- C:\Windows\System\jBqAPEp.exe
  C:\Windows\System\jBqAPEp.exe
  2⤵
  PID:16312
- C:\Windows\System\Hqdwoxa.exe
  C:\Windows\System\Hqdwoxa.exe
  2⤵
  PID:14516
- C:\Windows\System\rloXmlu.exe
  C:\Windows\System\rloXmlu.exe
  2⤵
  PID:15476
- C:\Windows\System\OGKTUST.exe
  C:\Windows\System\OGKTUST.exe
  2⤵
  PID:15612
- C:\Windows\System\xLBfNlx.exe
  C:\Windows\System\xLBfNlx.exe
  2⤵
  PID:15728
- C:\Windows\System\BUHnQbD.exe
  C:\Windows\System\BUHnQbD.exe
  2⤵
  PID:15924
- C:\Windows\System\hjauCwZ.exe
  C:\Windows\System\hjauCwZ.exe
  2⤵
  PID:16120
- C:\Windows\System\gklChHw.exe
  C:\Windows\System\gklChHw.exe
  2⤵
  PID:16188
- C:\Windows\System\MvinFTZ.exe
  C:\Windows\System\MvinFTZ.exe
  2⤵
  PID:15364
- C:\Windows\System\mNnwwxI.exe
  C:\Windows\System\mNnwwxI.exe
  2⤵
  PID:15808
- C:\Windows\System\ttNORoK.exe
  C:\Windows\System\ttNORoK.exe
  2⤵
  PID:16144
- C:\Windows\System\wUShEqh.exe
  C:\Windows\System\wUShEqh.exe
  2⤵
  PID:15700
- C:\Windows\System\tvsLxdL.exe
  C:\Windows\System\tvsLxdL.exe
  2⤵
  PID:15556
- C:\Windows\System\PBEhvlu.exe
  C:\Windows\System\PBEhvlu.exe
  2⤵
  PID:16352
- C:\Windows\System\bwJMLAI.exe
  C:\Windows\System\bwJMLAI.exe
  2⤵
  PID:16412
- C:\Windows\System\vjPXZzf.exe
  C:\Windows\System\vjPXZzf.exe
  2⤵
  PID:16440
- C:\Windows\System\gCOyqTG.exe
  C:\Windows\System\gCOyqTG.exe
  2⤵
  PID:16468
- C:\Windows\System\znrDqax.exe
  C:\Windows\System\znrDqax.exe
  2⤵
  PID:16496
- C:\Windows\System\bYcWQWG.exe
  C:\Windows\System\bYcWQWG.exe
  2⤵
  PID:16524
- C:\Windows\System\oPCVGmh.exe
  C:\Windows\System\oPCVGmh.exe
  2⤵
  PID:16552
- C:\Windows\System\xshkyZq.exe
  C:\Windows\System\xshkyZq.exe
  2⤵
  PID:16584
- C:\Windows\System\SCkKIXz.exe
  C:\Windows\System\SCkKIXz.exe
  2⤵
  PID:16608
- C:\Windows\System\yGmUJlU.exe
  C:\Windows\System\yGmUJlU.exe
  2⤵
  PID:16648
- C:\Windows\System\dpWVaFU.exe
  C:\Windows\System\dpWVaFU.exe
  2⤵
  PID:16676
- C:\Windows\System\blHITGp.exe
  C:\Windows\System\blHITGp.exe
  2⤵
  PID:16704
- C:\Windows\System\ErCYfpd.exe
  C:\Windows\System\ErCYfpd.exe
  2⤵
  PID:16728
- C:\Windows\System\oOXUtfb.exe
  C:\Windows\System\oOXUtfb.exe
  2⤵
  PID:16760
- C:\Windows\System\ruJBOUy.exe
  C:\Windows\System\ruJBOUy.exe
  2⤵
  PID:16776
- C:\Windows\System\JrDkmeD.exe
  C:\Windows\System\JrDkmeD.exe
  2⤵
  PID:16804
- C:\Windows\System\eOWrayl.exe
  C:\Windows\System\eOWrayl.exe
  2⤵
  PID:16836
- C:\Windows\System\XGzMYWo.exe
  C:\Windows\System\XGzMYWo.exe
  2⤵
  PID:16860
- C:\Windows\System\ZcPhJQQ.exe
  C:\Windows\System\ZcPhJQQ.exe
  2⤵
  PID:16900
- C:\Windows\System\KghYqrw.exe
  C:\Windows\System\KghYqrw.exe
  2⤵
  PID:16916
- C:\Windows\System\mGKgQxs.exe
  C:\Windows\System\mGKgQxs.exe
  2⤵
  PID:16936
- C:\Windows\System\yfVFZSb.exe
  C:\Windows\System\yfVFZSb.exe
  2⤵
  PID:16984
- C:\Windows\System\gGLpKsN.exe
  C:\Windows\System\gGLpKsN.exe
  2⤵
  PID:17012
- C:\Windows\System\QgcspaG.exe
  C:\Windows\System\QgcspaG.exe
  2⤵
  PID:17036
- C:\Windows\System\DmEozSl.exe
  C:\Windows\System\DmEozSl.exe
  2⤵
  PID:17068
- C:\Windows\System\RPdKGFX.exe
  C:\Windows\System\RPdKGFX.exe
  2⤵
  PID:17096
- C:\Windows\System\AuSJDdJ.exe
  C:\Windows\System\AuSJDdJ.exe
  2⤵
  PID:17112
- C:\Windows\System\ytqEyIZ.exe
  C:\Windows\System\ytqEyIZ.exe
  2⤵
  PID:17144
- C:\Windows\System\BRssWpK.exe
  C:\Windows\System\BRssWpK.exe
  2⤵
  PID:17180
- C:\Windows\System\WgvLIqG.exe
  C:\Windows\System\WgvLIqG.exe
  2⤵
  PID:17196
- C:\Windows\System\JfydxiX.exe
  C:\Windows\System\JfydxiX.exe
  2⤵
  PID:17212
- C:\Windows\System\acqsMvo.exe
  C:\Windows\System\acqsMvo.exe
  2⤵
  PID:17256
- C:\Windows\System\COaYArA.exe
  C:\Windows\System\COaYArA.exe
  2⤵
  PID:17292
- C:\Windows\System\OkizAht.exe
  C:\Windows\System\OkizAht.exe
  2⤵
  PID:17320

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:17080

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Accessibility Features

T1546.008

Privilege Escalation

Event Triggered Execution

T1546

Accessibility Features

T1546.008

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\CXOJqnm.exe

Filesize
1.8MB

MD5
3c37559d3e86ae904740551a56255258

SHA1
370ed907ffa0eeccdc9e55cffcef16e29d393dcc

SHA256
f63550c8c271e0bc76e83e832c4c584a553cb3b92c66c154b15786092a93ee5b

SHA512
d397b3045dc8f0a63a9e79127480704c20525720f36dbcd0b0ca26e373ec64b3a0966be9ed96e5353fef9672cd70603ced4f07a1522d46815676dac3009cfee8

Download Submit
C:\Windows\System\CheOeYV.exe

Filesize
1.8MB

MD5
280c63328aea4fa71129d51ea5c9b974

SHA1
a50f1723d1b046b986a30f237863687a44a54f85

SHA256
a47edc6d8c02f2e8438dbb8781c2b623babaa3bede23c08b25803a9c9c53148e

SHA512
2465da41c1fd3e3d56d06b2cfb5b1e1ee6be15e26e32eef135ef9c483d32640522a5a2c9131993698aa756b71e8714635bc04971c64daa11e4c2bc77297ced71

Download Submit
C:\Windows\System\DHDuczL.exe

Filesize
1.8MB

MD5
3450be7401eef8500cd8a065ff7becbd

SHA1
8e2930cd069653f864394d72d08b0c2fb84df651

SHA256
971026658fc86128a20f364df99a77006e7aa77772883a36c604a1d2dc352b41

SHA512
535e601e5e729e9f61b36e8e79f1681455207039edc4d05df5f6f5b811eb3cfc9aaba645f6cb03851e29a94535dc585e77c3d9887a87a0a7f71b7108a74f1ba9

Download Submit
C:\Windows\System\Ehovghw.exe

Filesize
1.8MB

MD5
5f89fd186e15d07d62a368d5b063724f

SHA1
714126ef279f3d0a78f59ceaaa715f983ccdaf46

SHA256
8c0710e6547b9fde78edc511f0c211e08041579643f026a190cc274e7fb71a2e

SHA512
44f9fc30b2afee9138f675d2ed8fb92fd7f9e02f5f5f4e835abf0e46fc523ad37ac6989fc9039fc3ec9c0865cab020103228de589baacef5f9d138d2198d1a31

Download Submit
C:\Windows\System\FIrBUCR.exe

Filesize
1.8MB

MD5
73a7e64c7db540db5deb7b25b5473fd6

SHA1
d90758e66fc4715a2cacfd6b00b4af8d752eaa58

SHA256
2ebc62b71db8cdc13c6b1afc6c13ed64def201b83e1b7d9613a78fd3b25f651a

SHA512
fe36ceae323cdd25f7e57417625f8be441eb35f90d0046dce906d3e266d2978251e1afcb5555110ef118bfac9acdc13efeed387c014f0f5809254ff475faaeec

Download Submit
C:\Windows\System\GdneARS.exe

Filesize
1.8MB

MD5
82e3064fe0c70510d75c39d2352dd371

SHA1
7bec98791f97866ba3db7624199740b89ca65b1e

SHA256
e721b67337ae7742c0d2b19376675407fbe57f96ad0dc7a68f3da71fdac42c70

SHA512
30070d5d0ee83d659254dc8129f4249c26c7ad7b37a35d72ca97ae0a39c9aba92892ff6e181e6dfcbe6baaa5dc758da85e7f5dc77560e4120804eddc22dde441

Download Submit
C:\Windows\System\JBdQAzZ.exe

Filesize
1.8MB

MD5
b978f7a66b95117d28de811b33c94d49

SHA1
5373de8aba32bc91c1b205b8c3388609c9e331ab

SHA256
d9b37a2ef8dafb037f415514e8554177bf63b483d5336bacdbb93bfb17a335ea

SHA512
ae974457e4a8fabbfdbd277887e5d7d6f9b895b80b4110eb3e08baee5e28cd03cc025266203ecba522980abb67694edc9ab3b4255c57bcc19170917c49102ef5

Download Submit
C:\Windows\System\JByvRTN.exe

Filesize
1.8MB

MD5
759a00c738ec87e86bae003fe6676e38

SHA1
b4e5077d6ce93dd307b95e06be145586736a09df

SHA256
9b3997bf4b9d7a0e0aedab6bc4e5956a2b4bb77df3a77b58c258f633aaa02529

SHA512
5ff63db4f61d3dbb10a16ff7186aa3e54b0975ad3bcf3050c272441c5b5c8de62ec2d8fcab51965cc0dbe2e57691adfae721b198f7ff97639255847e2abac8b1

Download Submit
C:\Windows\System\KsfEzTE.exe

Filesize
1.8MB

MD5
8a2daa71585de11a57ac76e2b4f1953f

SHA1
0d0a8f7b15f72c312747070c0dd87bee49aa7c5b

SHA256
21fc2c4b1db167b148dd77d184d2f7898409c9456de5450e53cea42449f2fece

SHA512
6e8515154baf352b6b52f5918c018bea1fb1eb4a3dcb1e42ed51e5f02ec70138e744ee9354b469d83ec056f2f7fecaec239ef8a65eb1ba0844894e4576d9431d

Download Submit
C:\Windows\System\LNqQPtJ.exe

Filesize
1.8MB

MD5
b035bd8a8326622891a94f761ee5bf32

SHA1
74b42f4c8930b9b393abdcacbe9150aeb50dac07

SHA256
b8cd0c8c173fed3973751c830369d040cb76d91f60833c3a10d2c5ee2c4059da

SHA512
2590a0b48c038872bedfc570af15143ec0ca465af4d394a4bd07002e93ce7c1e6037ad877e97f5fb02bca24870c32cfbf13f6fafd8f59c64009b1690d39e8969

Download Submit
C:\Windows\System\MXuRDaA.exe

Filesize
1.8MB

MD5
681dc273a9b8e933789fbb46332438ba

SHA1
4c719ce1ed3512d832dfef3ae27c0e62571ef896

SHA256
e5ac0367ece7f26ea1290c9b851960c5fb7222614abd349dd0e9afcb35414d65

SHA512
5c48b0e57e4a417b0320d42efdd92f5d6d461065dc86249acc451c08685717a1e2f87668326803666e30f099da85ffe7d5afe97f2433d75330b1c83977745455

Download Submit
C:\Windows\System\QDGsAPg.exe

Filesize
1.8MB

MD5
e97b3e190ffa32fbd36f1b17aaecc561

SHA1
dec026501da852f10ee88ec41623c42800accd6e

SHA256
b535bb49440e5271ad745aca167cda8fed3061b8806553697ac8b32e7be95a30

SHA512
cfbc3e731b093f35e6c02e00dd1a0c37878625cc13c69d3738d2cb16c1b6aad9a160d2dc7edff1353625f4c1680fd65f5e592a4fe2ba92b8ac7bc561a3412c7f

Download Submit
C:\Windows\System\RyJMgnQ.exe

Filesize
1.8MB

MD5
4361973584cd4f2486b415e8b7c6c5f0

SHA1
8d52c749222aa776326c8820b39081298a98c00c

SHA256
36f8d7a66e2c08d3400f98e7fe30364803e5fb5568e59192360943b2f360a5f0

SHA512
168597f6b608206a72d139280aac14b1c7b2eab9e62bb5948b3ded8bad4c5b81de1a99a4ac939cd2a9a74550d76926c3d6931fdaca7e0cdcc8d21135a8a1e11b

Download Submit
C:\Windows\System\SRRCKup.exe

Filesize
1.8MB

MD5
38e7673d0cd27098d7edeb88e9cf2ce5

SHA1
697748179dbeaf8fb4f66da8ba641e5aa6f53885

SHA256
67144bbc0657bb4e01860f06abb91abb38025574e1bc06e30eb8aa6b12af8b93

SHA512
6de4a56bfae725fa9f5642d54c9a22dff3bcb0264080b22b00d42e3b1c3ee07435e4d6409333caa8ada9e7096854724edf8b0971bc54dc1f493a27c638938292

Download Submit
C:\Windows\System\SsUPrCn.exe

Filesize
1.8MB

MD5
02b8e88a964b7460914aa79e5cf9aaad

SHA1
5ef066c43b3fff360ca7b834815844fa959463ed

SHA256
db02af13e470d9e7c98bada1ce49ffa8456548d557448dcefbd4aed6d5ca51b3

SHA512
bf76ae9e5bbcdd3ddcf7800b18932d3f94dd9836c14e129667bf6698c2d4d39b1c8d9f916e05ed0ff3b92c121b7d42b1212c63ebb69501ea63c03aa344a4d118

Download Submit
C:\Windows\System\TuwsHBD.exe

Filesize
1.8MB

MD5
179bdaefcb9cc4cc3b7265112f930946

SHA1
07e3fdee593d5bce6650be90dd5158a6cf28840e

SHA256
f4c7e3e954db493cbccf10344dd30af398901a549aab3ec73ad8e7980ced47cb

SHA512
aa40ad36e9d39a43076b47277efa35d6be66edbb15555920832fa4d19a615afe7ceee682c27a4f97c8d814a535d8ac14cf2c7df625e8443620b6550700377bb5

Download Submit
C:\Windows\System\WUetCUw.exe

Filesize
1.8MB

MD5
88c756b36e71449dd46a359c1712a37f

SHA1
fefc0090599fb8840405da10697a137c0a8b08c9

SHA256
f21f0980608e32cbb0abf785e387a0208a45f83575079d459077a49aa4702599

SHA512
32b5498a793e076dc4a47796cd2cf8f431eb4ef3dedd7df3915bac04904649abccb659c6444afa85dbb80e0dea11afbda6416bf6cd2ec0a105cd84ae18c05d03

Download Submit
C:\Windows\System\YETUZbE.exe

Filesize
1.8MB

MD5
e1bd902751b7b7d41d0c738ca7ab1a75

SHA1
e7efb56dde08b49860417ad97d1e82c90ea93a22

SHA256
785e02156c8ebc64025754191928fc0f6b48650cdab8a343343d6f34b8d49d0e

SHA512
c016a48cc09fbb0f626e131528f27d1f8c782e1f9bd3b04500b6fa6cbd38867ac541aff3d49f539829c5d8298e88173e517bd908e4a7932847647b39619469e3

Download Submit
C:\Windows\System\ZGGnwpC.exe

Filesize
1.8MB

MD5
6ec44878ac337caa1c9eb80c64f870c6

SHA1
9316587037dc11bf0ae3012e66aff6efda2ca094

SHA256
59582be10f4680e57509ea7aad826575f11af56947db4db7c5fbfbd62e6457df

SHA512
c334f982b10750e626b05865b876ed9827955c5c4b05197a51274d6f9aa514bb1c2c9645c22ded6e173d864ec9cae2a370cf71b73e31ec4a0a4f9cc9f8c72d7f

Download Submit
C:\Windows\System\ZicrieY.exe

Filesize
1.8MB

MD5
8ac1ef6ff4a4f8d79fafb5abb1426547

SHA1
fdba40b41915583031897d05603b8273f98abfd4

SHA256
506f9e0e79fdc3ae1520ed1e883a296a539adfc23eebe64faaca135c46b83fae

SHA512
9949d668daf81ca3ed42de1d4bf7cd55b1bbbbf9cc2ce8cc0b399a0363fc27577283fe4bfbbae1af8840ff43d7ebc7059697fd5bf241ca4e4290779b51e46e90

Download Submit
C:\Windows\System\ZmkoUuT.exe

Filesize
1.8MB

MD5
8641dbed8c43bca9cd03ba515424f432

SHA1
ac2a78c622c5856f9e96ecbe363d98aa7277d289

SHA256
0bd560f2e99371469e571b2a89b798b60603c6ca1ed8856d8582f7c8b3e8e4ce

SHA512
0d687b7619ba51bf0d6275ab3b99df43c10c49886d324b55aa60ae8b9526d6f3c9640c1da9063037d22957c2b53bee0b266f24aa6060f44f956f5488bfd42a77

Download Submit
C:\Windows\System\bGmKwUL.exe

Filesize
1.8MB

MD5
7653fe5efa9d5e08ee955ac32f7cd964

SHA1
8c24f65e9ba226ffd89551f9bbbd57d00a2eb593

SHA256
538fcc8cf64b10522c33d9c779d2cdda159963df969b48fc05bdae8bca7943fa

SHA512
5688666ba7fcbedb6e09c8daa97b0b2ca18bf39a00a9fe3113e4b4535fe7e0cf8155f833455ff3fc66e6b86e91fa564d0ad976b3392225f4750ea36cc43033ad

Download Submit
C:\Windows\System\btryQHt.exe

Filesize
1.8MB

MD5
027dbd525e7668c5520fc1d0923da897

SHA1
4c6a33a770446a93a0bafc8c143929f5995d6b44

SHA256
9c44b636df7531e038f5db901c95ef24527f8feb8997c11b5e82c7ba3a6e752b

SHA512
6a546c173726abbcba8c76c996680de5b51eb605da859a83a74d1ecd1c9a169a6c4e97d5475f6a846fec2c719ed47bfa504eab48ea19882f5faf6085bd204231

Download Submit
C:\Windows\System\fGOsQMS.exe

Filesize
1.8MB

MD5
51bf13fd565dc74da4307dadf84677d6

SHA1
f09ac9d3e0568b10b054a50b8f38e46dd7feecb6

SHA256
c042f5cd388ee9d09816d72c80b656e1c745b0677497a2738062beb4410805d3

SHA512
b08e36e8a4366d753848e9cc9ca4a8ef6e87910dec0d51fcbba55d3f0566fef4636fa9b17bb21ea093143c8d3b67605ce533e7f026e892336359ee783b4645d9

Download Submit
C:\Windows\System\jrJbxDj.exe

Filesize
1.8MB

MD5
a9bbb4de1190637176f855cad03c85b8

SHA1
95629f5d89d81a2c97b512228b691f440a17a63b

SHA256
e0c80e979e97ff3953e70c9e07167576bedcaf98bd938bd7289e9cf6d7ade157

SHA512
7af766440893e47be8370e7e3d0a6d05cd02165d5855b798177b22897c1adf6b29f44e77a5de4c90311623da4a31b0752421dba52d9e84660c6a8f18b77de233

Download Submit
C:\Windows\System\lgLrnOS.exe

Filesize
1.8MB

MD5
ec6a72d2c25eba6bc6df5e8bba6a1591

SHA1
aa426ad76297889b56774dd68ab8ee2969a4cb4b

SHA256
fbc36af2e6d83d913d206a4f19666e7f050cbff56dd202ce33889f3d6467f82f

SHA512
9850f1d5fd114c351c7d2517e9a5666e5507fed309f13b9971d99009a9ccf86b2044de3a1c6ba8d7a5fbcfacc75d14d99f1776930a5e278535953cad97709a47

Download Submit
C:\Windows\System\qXTheAw.exe

Filesize
1.8MB

MD5
357b6ed839f65c2a961d27510ab7600b

SHA1
ec0896dfe03d854f86be7235f85b7fb655a25cda

SHA256
1b0e3ad94ecd813b5a253dedf968acdddc549db3df9e49ab9e77b5c8fac5b1e4

SHA512
ae5bba0e9669b8107c41b2b319cb31b1c88a33bd447fc438b2249dc32515df9f93206353d980a0fcceb445202524d4c2f24e68b03c09095e83443adc056a8a43

Download Submit
C:\Windows\System\rhZdWaq.exe

Filesize
1.8MB

MD5
70db25ba24b0d20e4d19c9414a57e13d

SHA1
3682bd6fcda9960cd2576afdb14363ebb03e7fb0

SHA256
8b4341f1ca8d7a9548b9ad09fca227ac0797b021f6d993ff149b8512aa8d00d5

SHA512
9c4bd46a5b26891032c840a3908b502cfe111240f15a39d6529621419421f68d376f6725bbc4cf374749ddd0e09d67c166287c82ca7af54424e067912e04374a

Download Submit
C:\Windows\System\uEQwMPd.exe

Filesize
1.8MB

MD5
a92985907a933fa70a14404a95cf87a3

SHA1
1b219e59f205299bfd5b58bc478b9f2b33b828c6

SHA256
31229260f1368211bf9e7fd36aba42dfc61f2c3fdafedb42f61a3e9e5dc389ae

SHA512
8d2d746f02e629de2389e096775b7a6a37bb16e4ab6d567c7e1f20966172a6c9c9032e831db3649146de87f186b6ad52f0b07ec5657d5246df3aa34bd3e6176f

Download Submit
C:\Windows\System\wBxTlPb.exe

Filesize
1.8MB

MD5
2add03ee6ddb1ba4cff974658a39de30

SHA1
6ada836ed7872fbdf227fb501f2dca6070dbe152

SHA256
84bd34f4e4c0d27c8ac87c79a600e2abdc0824fa25eba60ee4a072bd0552174d

SHA512
976ae79318bc5b47467255e6a558a3c99883cbc246b67ad20a27c23405d00bd46b5e5e5c08a3cc8e3a4545681746b3f9c321f9f1f68060fed74db993a705b794

Download Submit
C:\Windows\System\xKAKuMg.exe

Filesize
1.8MB

MD5
c62cb4494ae62d87d2c6524a063bfba3

SHA1
647a91d4235bc1a3d0e9976ee51beab0e0410e56

SHA256
d336643c7e182da84c95a9f655fd5f79d43f4d007405257467e7567ba018e0f6

SHA512
c7b42d2f4b3be1e67f2b3340d0f483491857bb8bb5857a2405a489979202549a2da0af2e9fdf4bcad1711563d712f50524ace8b23e42b73e58e3c1301de90e27

Download Submit
C:\Windows\System\yHmsFnb.exe

Filesize
1.8MB

MD5
fb2a64e37250632103416e44a0af06ee

SHA1
fe2b1fcb81d829e2aa90d508e2d9d6a101d49675

SHA256
7e222085aa4e6cfe9d322e7c5fd32280d0043d83cb3e8b046121754d4a737429

SHA512
783ef9f16fa921d3f019b0043e589b8b75fb97f2578032d20f115231714725839b555e17137e945b317d5db2c88cbfbfc1b6c6cc7ef00112bcd46231f9cac635

Download Submit
C:\Windows\System\zwDXOcR.exe

Filesize
1.8MB

MD5
7d313cce5f5db646d76e4e5bca158511

SHA1
05892f65fe49b286b51c36bebe571f1cd5f14a78

SHA256
77c365cfd6278aaf3f6abd55dc65a9b91bd0e7bd1f20a1e7426aab47056c5c35

SHA512
8b5edf28c5b9d00b51e07d3fae3f77524e1012e742fd096cb42012fafbf2d0ab8f6232a75a203ba1ac0e0a01cf38df7af61d5aecf51caefa34b97a188716d3b6

Download Submit
memory/1348-0-0x000001F507FE0000-0x000001F507FF0000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads