xmrig | 08df70cf329df6e29abcf809ed184149faf28dc729a7027e3ef3fd84ef2d8ca3

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
25-01-2025 19:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

08df70cf329df6e29abcf809ed184149faf28dc729a7027e3ef3fd84ef2d8ca3.exe
Size

1.1MB
MD5

1d8b5b13c9008de098281a1653f31748
SHA1

b6c66040a06e32b0eba67ab928af3d164d0dc0f5
SHA256

08df70cf329df6e29abcf809ed184149faf28dc729a7027e3ef3fd84ef2d8ca3
SHA512

15712b7043c9cd16ac3a45ac7e10a4234d90a76bd2095c5fd6a0204d20670904c16d9fc1b17c891b416712ed29fe048dd8d20d6a4b5443c40123373ed0c31c81
SSDEEP

24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbpwlKensz8Zs0YrTwkbK:GezaTF8FcNkNdfE0pZ9ozttwIRbfwv

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 33 IoCs

miner

resource	yara_rule
behavioral2/files/0x0008000000023cab-4.dat	xmrig
behavioral2/files/0x0007000000023caf-9.dat	xmrig
behavioral2/files/0x0007000000023cb5-42.dat	xmrig
behavioral2/files/0x0007000000023cb8-56.dat	xmrig
behavioral2/files/0x0007000000023cbb-68.dat	xmrig
behavioral2/files/0x0007000000023cc1-102.dat	xmrig
behavioral2/files/0x0007000000023cc5-118.dat	xmrig
behavioral2/files/0x0007000000023cce-161.dat	xmrig
behavioral2/files/0x0007000000023ccd-158.dat	xmrig
behavioral2/files/0x0007000000023ccc-156.dat	xmrig
behavioral2/files/0x0007000000023ccb-152.dat	xmrig
behavioral2/files/0x0007000000023cca-146.dat	xmrig
behavioral2/files/0x0007000000023cc9-142.dat	xmrig
behavioral2/files/0x0007000000023cc8-136.dat	xmrig
behavioral2/files/0x0007000000023cc7-132.dat	xmrig
behavioral2/files/0x0007000000023cc6-126.dat	xmrig
behavioral2/files/0x0007000000023cc4-116.dat	xmrig
behavioral2/files/0x0007000000023cc3-112.dat	xmrig
behavioral2/files/0x0007000000023cc2-106.dat	xmrig
behavioral2/files/0x0007000000023cc0-96.dat	xmrig
behavioral2/files/0x0007000000023cbf-92.dat	xmrig
behavioral2/files/0x0007000000023cbe-84.dat	xmrig
behavioral2/files/0x0007000000023cbd-82.dat	xmrig
behavioral2/files/0x0007000000023cbc-79.dat	xmrig
behavioral2/files/0x0007000000023cba-66.dat	xmrig
behavioral2/files/0x0007000000023cb9-62.dat	xmrig
behavioral2/files/0x0007000000023cb7-52.dat	xmrig
behavioral2/files/0x0007000000023cb6-46.dat	xmrig
behavioral2/files/0x0007000000023cb4-36.dat	xmrig
behavioral2/files/0x0007000000023cb3-32.dat	xmrig
behavioral2/files/0x0007000000023cb2-24.dat	xmrig
behavioral2/files/0x0007000000023cb1-19.dat	xmrig
behavioral2/files/0x0007000000023cb0-14.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
4640	WoNIOZK.exe
4580	YONdCfG.exe
744	gaqzgih.exe
1904	ywloSmE.exe
4280	fgkYxtb.exe
2108	npEOgDm.exe
4824	WIGnlpA.exe
3516	lPuHvMf.exe
4396	mMbIMuQ.exe
3504	wWpEsNC.exe
2132	GMIXKMc.exe
4036	iWZWvXM.exe
2952	WwAVjBi.exe
1732	LOGgzst.exe
1048	SHokuSC.exe
3940	imZPmoT.exe
1920	zdxDhNZ.exe
3192	rUgpIRn.exe
4544	FrSBblb.exe
4156	MeeHlFZ.exe
4200	PTFugDT.exe
2252	IMvVWDM.exe
2524	sgxZPbd.exe
336	InUYhKc.exe
3880	GKVxnqd.exe
4572	UHKcxxX.exe
2488	BaElblW.exe
1600	atcTrfR.exe
2528	IShRNVW.exe
624	DZbiWQA.exe
1856	mKEzBpw.exe
1812	KXfIJwz.exe
2864	bsbmXTF.exe
1220	jHUmtMO.exe
4812	eUrONMr.exe
928	AelVHLh.exe
940	MoVgMeH.exe
3044	lHDCGYi.exe
3040	vqYZwOY.exe
4404	MYoxHsI.exe
1320	wDjJoFJ.exe
4764	AfqxtmA.exe
3692	tEGfRDy.exe
3908	qhpFJWG.exe
4556	efFabgd.exe
3396	gUXoUHy.exe
3868	VrKfLRa.exe
4700	uqyPJLV.exe
1560	NfxUlAj.exe
1944	jNZhWcA.exe
812	NfbYUqf.exe
2388	snADYmS.exe
1576	bppzHQL.exe
1340	ejUDUpe.exe
3460	yzAseCU.exe
1524	fppKkEZ.exe
3720	bwZpNCk.exe
1680	eBFtgJo.exe
5032	CQAgEEW.exe
4504	oPIVfCg.exe
4752	wSShEqB.exe
4192	dgxLQWO.exe
320	uDjUacv.exe
2152	JiDdznF.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\ANPTdMx.exe	08df70cf329df6e29abcf809ed184149faf28dc729a7027e3ef3fd84ef2d8ca3.exe
File created	C:\Windows\System\nFfelIT.exe	08df70cf329df6e29abcf809ed184149faf28dc729a7027e3ef3fd84ef2d8ca3.exe
File created	C:\Windows\System\pjQHZFv.exe	08df70cf329df6e29abcf809ed184149faf28dc729a7027e3ef3fd84ef2d8ca3.exe
File created	C:\Windows\System\dbczUMb.exe	08df70cf329df6e29abcf809ed184149faf28dc729a7027e3ef3fd84ef2d8ca3.exe
File created	C:\Windows\System\XhEeOMu.exe	08df70cf329df6e29abcf809ed184149faf28dc729a7027e3ef3fd84ef2d8ca3.exe
File created	C:\Windows\System\UGuRWuj.exe	08df70cf329df6e29abcf809ed184149faf28dc729a7027e3ef3fd84ef2d8ca3.exe
File created	C:\Windows\System\dYxHtKg.exe	08df70cf329df6e29abcf809ed184149faf28dc729a7027e3ef3fd84ef2d8ca3.exe
File created	C:\Windows\System\wOZbRqB.exe	08df70cf329df6e29abcf809ed184149faf28dc729a7027e3ef3fd84ef2d8ca3.exe
File created	C:\Windows\System\bsrTbPi.exe	08df70cf329df6e29abcf809ed184149faf28dc729a7027e3ef3fd84ef2d8ca3.exe
File created	C:\Windows\System\SEPUviw.exe	08df70cf329df6e29abcf809ed184149faf28dc729a7027e3ef3fd84ef2d8ca3.exe
File created	C:\Windows\System\QvgduUz.exe	08df70cf329df6e29abcf809ed184149faf28dc729a7027e3ef3fd84ef2d8ca3.exe
File created	C:\Windows\System\XcxNPOu.exe	08df70cf329df6e29abcf809ed184149faf28dc729a7027e3ef3fd84ef2d8ca3.exe
File created	C:\Windows\System\xHHJSYH.exe	08df70cf329df6e29abcf809ed184149faf28dc729a7027e3ef3fd84ef2d8ca3.exe
File created	C:\Windows\System\lmdYHBY.exe	08df70cf329df6e29abcf809ed184149faf28dc729a7027e3ef3fd84ef2d8ca3.exe
File created	C:\Windows\System\VGVeLcv.exe	08df70cf329df6e29abcf809ed184149faf28dc729a7027e3ef3fd84ef2d8ca3.exe
File created	C:\Windows\System\VmgleEP.exe	08df70cf329df6e29abcf809ed184149faf28dc729a7027e3ef3fd84ef2d8ca3.exe
File created	C:\Windows\System\SSEPCVJ.exe	08df70cf329df6e29abcf809ed184149faf28dc729a7027e3ef3fd84ef2d8ca3.exe
File created	C:\Windows\System\KXfIJwz.exe	08df70cf329df6e29abcf809ed184149faf28dc729a7027e3ef3fd84ef2d8ca3.exe
File created	C:\Windows\System\iqfWfCI.exe	08df70cf329df6e29abcf809ed184149faf28dc729a7027e3ef3fd84ef2d8ca3.exe
File created	C:\Windows\System\jsnTHmj.exe	08df70cf329df6e29abcf809ed184149faf28dc729a7027e3ef3fd84ef2d8ca3.exe
File created	C:\Windows\System\TRyUXqd.exe	08df70cf329df6e29abcf809ed184149faf28dc729a7027e3ef3fd84ef2d8ca3.exe
File created	C:\Windows\System\YIhZhrp.exe	08df70cf329df6e29abcf809ed184149faf28dc729a7027e3ef3fd84ef2d8ca3.exe
File created	C:\Windows\System\aIhMzft.exe	08df70cf329df6e29abcf809ed184149faf28dc729a7027e3ef3fd84ef2d8ca3.exe
File created	C:\Windows\System\beVVraU.exe	08df70cf329df6e29abcf809ed184149faf28dc729a7027e3ef3fd84ef2d8ca3.exe
File created	C:\Windows\System\ppqAlBe.exe	08df70cf329df6e29abcf809ed184149faf28dc729a7027e3ef3fd84ef2d8ca3.exe
File created	C:\Windows\System\jVMjIeO.exe	08df70cf329df6e29abcf809ed184149faf28dc729a7027e3ef3fd84ef2d8ca3.exe
File created	C:\Windows\System\ySReCfv.exe	08df70cf329df6e29abcf809ed184149faf28dc729a7027e3ef3fd84ef2d8ca3.exe
File created	C:\Windows\System\FpRZRgW.exe	08df70cf329df6e29abcf809ed184149faf28dc729a7027e3ef3fd84ef2d8ca3.exe
File created	C:\Windows\System\riwROkI.exe	08df70cf329df6e29abcf809ed184149faf28dc729a7027e3ef3fd84ef2d8ca3.exe
File created	C:\Windows\System\lrqCQjY.exe	08df70cf329df6e29abcf809ed184149faf28dc729a7027e3ef3fd84ef2d8ca3.exe
File created	C:\Windows\System\hjlVpxa.exe	08df70cf329df6e29abcf809ed184149faf28dc729a7027e3ef3fd84ef2d8ca3.exe
File created	C:\Windows\System\AYBIZZm.exe	08df70cf329df6e29abcf809ed184149faf28dc729a7027e3ef3fd84ef2d8ca3.exe
File created	C:\Windows\System\zdaiCVw.exe	08df70cf329df6e29abcf809ed184149faf28dc729a7027e3ef3fd84ef2d8ca3.exe
File created	C:\Windows\System\BKXEJkc.exe	08df70cf329df6e29abcf809ed184149faf28dc729a7027e3ef3fd84ef2d8ca3.exe
File created	C:\Windows\System\cGhbJWc.exe	08df70cf329df6e29abcf809ed184149faf28dc729a7027e3ef3fd84ef2d8ca3.exe
File created	C:\Windows\System\dCxhoLJ.exe	08df70cf329df6e29abcf809ed184149faf28dc729a7027e3ef3fd84ef2d8ca3.exe
File created	C:\Windows\System\IlzQqhg.exe	08df70cf329df6e29abcf809ed184149faf28dc729a7027e3ef3fd84ef2d8ca3.exe
File created	C:\Windows\System\CswgjPU.exe	08df70cf329df6e29abcf809ed184149faf28dc729a7027e3ef3fd84ef2d8ca3.exe
File created	C:\Windows\System\gyAztJE.exe	08df70cf329df6e29abcf809ed184149faf28dc729a7027e3ef3fd84ef2d8ca3.exe
File created	C:\Windows\System\WXOkRWm.exe	08df70cf329df6e29abcf809ed184149faf28dc729a7027e3ef3fd84ef2d8ca3.exe
File created	C:\Windows\System\Xgdvylg.exe	08df70cf329df6e29abcf809ed184149faf28dc729a7027e3ef3fd84ef2d8ca3.exe
File created	C:\Windows\System\EKKujzg.exe	08df70cf329df6e29abcf809ed184149faf28dc729a7027e3ef3fd84ef2d8ca3.exe
File created	C:\Windows\System\BhsLvcu.exe	08df70cf329df6e29abcf809ed184149faf28dc729a7027e3ef3fd84ef2d8ca3.exe
File created	C:\Windows\System\YvEPncs.exe	08df70cf329df6e29abcf809ed184149faf28dc729a7027e3ef3fd84ef2d8ca3.exe
File created	C:\Windows\System\hBRKqte.exe	08df70cf329df6e29abcf809ed184149faf28dc729a7027e3ef3fd84ef2d8ca3.exe
File created	C:\Windows\System\zWlBvgo.exe	08df70cf329df6e29abcf809ed184149faf28dc729a7027e3ef3fd84ef2d8ca3.exe
File created	C:\Windows\System\OrWtEBP.exe	08df70cf329df6e29abcf809ed184149faf28dc729a7027e3ef3fd84ef2d8ca3.exe
File created	C:\Windows\System\DOjonzm.exe	08df70cf329df6e29abcf809ed184149faf28dc729a7027e3ef3fd84ef2d8ca3.exe
File created	C:\Windows\System\bsbmXTF.exe	08df70cf329df6e29abcf809ed184149faf28dc729a7027e3ef3fd84ef2d8ca3.exe
File created	C:\Windows\System\afPlvnw.exe	08df70cf329df6e29abcf809ed184149faf28dc729a7027e3ef3fd84ef2d8ca3.exe
File created	C:\Windows\System\OcWUJGx.exe	08df70cf329df6e29abcf809ed184149faf28dc729a7027e3ef3fd84ef2d8ca3.exe
File created	C:\Windows\System\AcFeIoW.exe	08df70cf329df6e29abcf809ed184149faf28dc729a7027e3ef3fd84ef2d8ca3.exe
File created	C:\Windows\System\HFwRKDZ.exe	08df70cf329df6e29abcf809ed184149faf28dc729a7027e3ef3fd84ef2d8ca3.exe
File created	C:\Windows\System\kgMqwIs.exe	08df70cf329df6e29abcf809ed184149faf28dc729a7027e3ef3fd84ef2d8ca3.exe
File created	C:\Windows\System\cgdlEzz.exe	08df70cf329df6e29abcf809ed184149faf28dc729a7027e3ef3fd84ef2d8ca3.exe
File created	C:\Windows\System\fMaDLTA.exe	08df70cf329df6e29abcf809ed184149faf28dc729a7027e3ef3fd84ef2d8ca3.exe
File created	C:\Windows\System\fFRvLsU.exe	08df70cf329df6e29abcf809ed184149faf28dc729a7027e3ef3fd84ef2d8ca3.exe
File created	C:\Windows\System\dKXHvrV.exe	08df70cf329df6e29abcf809ed184149faf28dc729a7027e3ef3fd84ef2d8ca3.exe
File created	C:\Windows\System\gaqzgih.exe	08df70cf329df6e29abcf809ed184149faf28dc729a7027e3ef3fd84ef2d8ca3.exe
File created	C:\Windows\System\XrndxcM.exe	08df70cf329df6e29abcf809ed184149faf28dc729a7027e3ef3fd84ef2d8ca3.exe
File created	C:\Windows\System\KogegOS.exe	08df70cf329df6e29abcf809ed184149faf28dc729a7027e3ef3fd84ef2d8ca3.exe
File created	C:\Windows\System\mqJKocx.exe	08df70cf329df6e29abcf809ed184149faf28dc729a7027e3ef3fd84ef2d8ca3.exe
File created	C:\Windows\System\hPumZyc.exe	08df70cf329df6e29abcf809ed184149faf28dc729a7027e3ef3fd84ef2d8ca3.exe
File created	C:\Windows\System\dgxLQWO.exe	08df70cf329df6e29abcf809ed184149faf28dc729a7027e3ef3fd84ef2d8ca3.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	17340	dwm.exe
Token: SeChangeNotifyPrivilege	17340	dwm.exe
Token: 33	17340	dwm.exe
Token: SeIncBasePriorityPrivilege	17340	dwm.exe
Token: SeShutdownPrivilege	17340	dwm.exe
Token: SeCreatePagefilePrivilege	17340	dwm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3132 wrote to memory of 4640	3132	08df70cf329df6e29abcf809ed184149faf28dc729a7027e3ef3fd84ef2d8ca3.exe	84
PID 3132 wrote to memory of 4640	3132	08df70cf329df6e29abcf809ed184149faf28dc729a7027e3ef3fd84ef2d8ca3.exe	84
PID 3132 wrote to memory of 4580	3132	08df70cf329df6e29abcf809ed184149faf28dc729a7027e3ef3fd84ef2d8ca3.exe	85
PID 3132 wrote to memory of 4580	3132	08df70cf329df6e29abcf809ed184149faf28dc729a7027e3ef3fd84ef2d8ca3.exe	85
PID 3132 wrote to memory of 744	3132	08df70cf329df6e29abcf809ed184149faf28dc729a7027e3ef3fd84ef2d8ca3.exe	86
PID 3132 wrote to memory of 744	3132	08df70cf329df6e29abcf809ed184149faf28dc729a7027e3ef3fd84ef2d8ca3.exe	86
PID 3132 wrote to memory of 1904	3132	08df70cf329df6e29abcf809ed184149faf28dc729a7027e3ef3fd84ef2d8ca3.exe	87
PID 3132 wrote to memory of 1904	3132	08df70cf329df6e29abcf809ed184149faf28dc729a7027e3ef3fd84ef2d8ca3.exe	87
PID 3132 wrote to memory of 4280	3132	08df70cf329df6e29abcf809ed184149faf28dc729a7027e3ef3fd84ef2d8ca3.exe	88
PID 3132 wrote to memory of 4280	3132	08df70cf329df6e29abcf809ed184149faf28dc729a7027e3ef3fd84ef2d8ca3.exe	88
PID 3132 wrote to memory of 2108	3132	08df70cf329df6e29abcf809ed184149faf28dc729a7027e3ef3fd84ef2d8ca3.exe	89
PID 3132 wrote to memory of 2108	3132	08df70cf329df6e29abcf809ed184149faf28dc729a7027e3ef3fd84ef2d8ca3.exe	89
PID 3132 wrote to memory of 4824	3132	08df70cf329df6e29abcf809ed184149faf28dc729a7027e3ef3fd84ef2d8ca3.exe	90
PID 3132 wrote to memory of 4824	3132	08df70cf329df6e29abcf809ed184149faf28dc729a7027e3ef3fd84ef2d8ca3.exe	90
PID 3132 wrote to memory of 3516	3132	08df70cf329df6e29abcf809ed184149faf28dc729a7027e3ef3fd84ef2d8ca3.exe	91
PID 3132 wrote to memory of 3516	3132	08df70cf329df6e29abcf809ed184149faf28dc729a7027e3ef3fd84ef2d8ca3.exe	91
PID 3132 wrote to memory of 4396	3132	08df70cf329df6e29abcf809ed184149faf28dc729a7027e3ef3fd84ef2d8ca3.exe	92
PID 3132 wrote to memory of 4396	3132	08df70cf329df6e29abcf809ed184149faf28dc729a7027e3ef3fd84ef2d8ca3.exe	92
PID 3132 wrote to memory of 3504	3132	08df70cf329df6e29abcf809ed184149faf28dc729a7027e3ef3fd84ef2d8ca3.exe	93
PID 3132 wrote to memory of 3504	3132	08df70cf329df6e29abcf809ed184149faf28dc729a7027e3ef3fd84ef2d8ca3.exe	93
PID 3132 wrote to memory of 2132	3132	08df70cf329df6e29abcf809ed184149faf28dc729a7027e3ef3fd84ef2d8ca3.exe	94
PID 3132 wrote to memory of 2132	3132	08df70cf329df6e29abcf809ed184149faf28dc729a7027e3ef3fd84ef2d8ca3.exe	94
PID 3132 wrote to memory of 4036	3132	08df70cf329df6e29abcf809ed184149faf28dc729a7027e3ef3fd84ef2d8ca3.exe	95
PID 3132 wrote to memory of 4036	3132	08df70cf329df6e29abcf809ed184149faf28dc729a7027e3ef3fd84ef2d8ca3.exe	95
PID 3132 wrote to memory of 2952	3132	08df70cf329df6e29abcf809ed184149faf28dc729a7027e3ef3fd84ef2d8ca3.exe	96
PID 3132 wrote to memory of 2952	3132	08df70cf329df6e29abcf809ed184149faf28dc729a7027e3ef3fd84ef2d8ca3.exe	96
PID 3132 wrote to memory of 1732	3132	08df70cf329df6e29abcf809ed184149faf28dc729a7027e3ef3fd84ef2d8ca3.exe	97
PID 3132 wrote to memory of 1732	3132	08df70cf329df6e29abcf809ed184149faf28dc729a7027e3ef3fd84ef2d8ca3.exe	97
PID 3132 wrote to memory of 1048	3132	08df70cf329df6e29abcf809ed184149faf28dc729a7027e3ef3fd84ef2d8ca3.exe	98
PID 3132 wrote to memory of 1048	3132	08df70cf329df6e29abcf809ed184149faf28dc729a7027e3ef3fd84ef2d8ca3.exe	98
PID 3132 wrote to memory of 3940	3132	08df70cf329df6e29abcf809ed184149faf28dc729a7027e3ef3fd84ef2d8ca3.exe	99
PID 3132 wrote to memory of 3940	3132	08df70cf329df6e29abcf809ed184149faf28dc729a7027e3ef3fd84ef2d8ca3.exe	99
PID 3132 wrote to memory of 1920	3132	08df70cf329df6e29abcf809ed184149faf28dc729a7027e3ef3fd84ef2d8ca3.exe	100
PID 3132 wrote to memory of 1920	3132	08df70cf329df6e29abcf809ed184149faf28dc729a7027e3ef3fd84ef2d8ca3.exe	100
PID 3132 wrote to memory of 3192	3132	08df70cf329df6e29abcf809ed184149faf28dc729a7027e3ef3fd84ef2d8ca3.exe	101
PID 3132 wrote to memory of 3192	3132	08df70cf329df6e29abcf809ed184149faf28dc729a7027e3ef3fd84ef2d8ca3.exe	101
PID 3132 wrote to memory of 4544	3132	08df70cf329df6e29abcf809ed184149faf28dc729a7027e3ef3fd84ef2d8ca3.exe	102
PID 3132 wrote to memory of 4544	3132	08df70cf329df6e29abcf809ed184149faf28dc729a7027e3ef3fd84ef2d8ca3.exe	102
PID 3132 wrote to memory of 4156	3132	08df70cf329df6e29abcf809ed184149faf28dc729a7027e3ef3fd84ef2d8ca3.exe	103
PID 3132 wrote to memory of 4156	3132	08df70cf329df6e29abcf809ed184149faf28dc729a7027e3ef3fd84ef2d8ca3.exe	103
PID 3132 wrote to memory of 4200	3132	08df70cf329df6e29abcf809ed184149faf28dc729a7027e3ef3fd84ef2d8ca3.exe	104
PID 3132 wrote to memory of 4200	3132	08df70cf329df6e29abcf809ed184149faf28dc729a7027e3ef3fd84ef2d8ca3.exe	104
PID 3132 wrote to memory of 2252	3132	08df70cf329df6e29abcf809ed184149faf28dc729a7027e3ef3fd84ef2d8ca3.exe	105
PID 3132 wrote to memory of 2252	3132	08df70cf329df6e29abcf809ed184149faf28dc729a7027e3ef3fd84ef2d8ca3.exe	105
PID 3132 wrote to memory of 2524	3132	08df70cf329df6e29abcf809ed184149faf28dc729a7027e3ef3fd84ef2d8ca3.exe	106
PID 3132 wrote to memory of 2524	3132	08df70cf329df6e29abcf809ed184149faf28dc729a7027e3ef3fd84ef2d8ca3.exe	106
PID 3132 wrote to memory of 336	3132	08df70cf329df6e29abcf809ed184149faf28dc729a7027e3ef3fd84ef2d8ca3.exe	107
PID 3132 wrote to memory of 336	3132	08df70cf329df6e29abcf809ed184149faf28dc729a7027e3ef3fd84ef2d8ca3.exe	107
PID 3132 wrote to memory of 3880	3132	08df70cf329df6e29abcf809ed184149faf28dc729a7027e3ef3fd84ef2d8ca3.exe	108
PID 3132 wrote to memory of 3880	3132	08df70cf329df6e29abcf809ed184149faf28dc729a7027e3ef3fd84ef2d8ca3.exe	108
PID 3132 wrote to memory of 4572	3132	08df70cf329df6e29abcf809ed184149faf28dc729a7027e3ef3fd84ef2d8ca3.exe	109
PID 3132 wrote to memory of 4572	3132	08df70cf329df6e29abcf809ed184149faf28dc729a7027e3ef3fd84ef2d8ca3.exe	109
PID 3132 wrote to memory of 2488	3132	08df70cf329df6e29abcf809ed184149faf28dc729a7027e3ef3fd84ef2d8ca3.exe	110
PID 3132 wrote to memory of 2488	3132	08df70cf329df6e29abcf809ed184149faf28dc729a7027e3ef3fd84ef2d8ca3.exe	110
PID 3132 wrote to memory of 1600	3132	08df70cf329df6e29abcf809ed184149faf28dc729a7027e3ef3fd84ef2d8ca3.exe	111
PID 3132 wrote to memory of 1600	3132	08df70cf329df6e29abcf809ed184149faf28dc729a7027e3ef3fd84ef2d8ca3.exe	111
PID 3132 wrote to memory of 2528	3132	08df70cf329df6e29abcf809ed184149faf28dc729a7027e3ef3fd84ef2d8ca3.exe	112
PID 3132 wrote to memory of 2528	3132	08df70cf329df6e29abcf809ed184149faf28dc729a7027e3ef3fd84ef2d8ca3.exe	112
PID 3132 wrote to memory of 624	3132	08df70cf329df6e29abcf809ed184149faf28dc729a7027e3ef3fd84ef2d8ca3.exe	113
PID 3132 wrote to memory of 624	3132	08df70cf329df6e29abcf809ed184149faf28dc729a7027e3ef3fd84ef2d8ca3.exe	113
PID 3132 wrote to memory of 1856	3132	08df70cf329df6e29abcf809ed184149faf28dc729a7027e3ef3fd84ef2d8ca3.exe	114
PID 3132 wrote to memory of 1856	3132	08df70cf329df6e29abcf809ed184149faf28dc729a7027e3ef3fd84ef2d8ca3.exe	114
PID 3132 wrote to memory of 1812	3132	08df70cf329df6e29abcf809ed184149faf28dc729a7027e3ef3fd84ef2d8ca3.exe	115
PID 3132 wrote to memory of 1812	3132	08df70cf329df6e29abcf809ed184149faf28dc729a7027e3ef3fd84ef2d8ca3.exe	115

C:\Users\Admin\AppData\Local\Temp\08df70cf329df6e29abcf809ed184149faf28dc729a7027e3ef3fd84ef2d8ca3.exe
"C:\Users\Admin\AppData\Local\Temp\08df70cf329df6e29abcf809ed184149faf28dc729a7027e3ef3fd84ef2d8ca3.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3132
- C:\Windows\System\WoNIOZK.exe
  C:\Windows\System\WoNIOZK.exe
  2⤵
  - Executes dropped EXE
  PID:4640
- C:\Windows\System\YONdCfG.exe
  C:\Windows\System\YONdCfG.exe
  2⤵
  - Executes dropped EXE
  PID:4580
- C:\Windows\System\gaqzgih.exe
  C:\Windows\System\gaqzgih.exe
  2⤵
  - Executes dropped EXE
  PID:744
- C:\Windows\System\ywloSmE.exe
  C:\Windows\System\ywloSmE.exe
  2⤵
  - Executes dropped EXE
  PID:1904
- C:\Windows\System\fgkYxtb.exe
  C:\Windows\System\fgkYxtb.exe
  2⤵
  - Executes dropped EXE
  PID:4280
- C:\Windows\System\npEOgDm.exe
  C:\Windows\System\npEOgDm.exe
  2⤵
  - Executes dropped EXE
  PID:2108
- C:\Windows\System\WIGnlpA.exe
  C:\Windows\System\WIGnlpA.exe
  2⤵
  - Executes dropped EXE
  PID:4824
- C:\Windows\System\lPuHvMf.exe
  C:\Windows\System\lPuHvMf.exe
  2⤵
  - Executes dropped EXE
  PID:3516
- C:\Windows\System\mMbIMuQ.exe
  C:\Windows\System\mMbIMuQ.exe
  2⤵
  - Executes dropped EXE
  PID:4396
- C:\Windows\System\wWpEsNC.exe
  C:\Windows\System\wWpEsNC.exe
  2⤵
  - Executes dropped EXE
  PID:3504
- C:\Windows\System\GMIXKMc.exe
  C:\Windows\System\GMIXKMc.exe
  2⤵
  - Executes dropped EXE
  PID:2132
- C:\Windows\System\iWZWvXM.exe
  C:\Windows\System\iWZWvXM.exe
  2⤵
  - Executes dropped EXE
  PID:4036
- C:\Windows\System\WwAVjBi.exe
  C:\Windows\System\WwAVjBi.exe
  2⤵
  - Executes dropped EXE
  PID:2952
- C:\Windows\System\LOGgzst.exe
  C:\Windows\System\LOGgzst.exe
  2⤵
  - Executes dropped EXE
  PID:1732
- C:\Windows\System\SHokuSC.exe
  C:\Windows\System\SHokuSC.exe
  2⤵
  - Executes dropped EXE
  PID:1048
- C:\Windows\System\imZPmoT.exe
  C:\Windows\System\imZPmoT.exe
  2⤵
  - Executes dropped EXE
  PID:3940
- C:\Windows\System\zdxDhNZ.exe
  C:\Windows\System\zdxDhNZ.exe
  2⤵
  - Executes dropped EXE
  PID:1920
- C:\Windows\System\rUgpIRn.exe
  C:\Windows\System\rUgpIRn.exe
  2⤵
  - Executes dropped EXE
  PID:3192
- C:\Windows\System\FrSBblb.exe
  C:\Windows\System\FrSBblb.exe
  2⤵
  - Executes dropped EXE
  PID:4544
- C:\Windows\System\MeeHlFZ.exe
  C:\Windows\System\MeeHlFZ.exe
  2⤵
  - Executes dropped EXE
  PID:4156
- C:\Windows\System\PTFugDT.exe
  C:\Windows\System\PTFugDT.exe
  2⤵
  - Executes dropped EXE
  PID:4200
- C:\Windows\System\IMvVWDM.exe
  C:\Windows\System\IMvVWDM.exe
  2⤵
  - Executes dropped EXE
  PID:2252
- C:\Windows\System\sgxZPbd.exe
  C:\Windows\System\sgxZPbd.exe
  2⤵
  - Executes dropped EXE
  PID:2524
- C:\Windows\System\InUYhKc.exe
  C:\Windows\System\InUYhKc.exe
  2⤵
  - Executes dropped EXE
  PID:336
- C:\Windows\System\GKVxnqd.exe
  C:\Windows\System\GKVxnqd.exe
  2⤵
  - Executes dropped EXE
  PID:3880
- C:\Windows\System\UHKcxxX.exe
  C:\Windows\System\UHKcxxX.exe
  2⤵
  - Executes dropped EXE
  PID:4572
- C:\Windows\System\BaElblW.exe
  C:\Windows\System\BaElblW.exe
  2⤵
  - Executes dropped EXE
  PID:2488
- C:\Windows\System\atcTrfR.exe
  C:\Windows\System\atcTrfR.exe
  2⤵
  - Executes dropped EXE
  PID:1600
- C:\Windows\System\IShRNVW.exe
  C:\Windows\System\IShRNVW.exe
  2⤵
  - Executes dropped EXE
  PID:2528
- C:\Windows\System\DZbiWQA.exe
  C:\Windows\System\DZbiWQA.exe
  2⤵
  - Executes dropped EXE
  PID:624
- C:\Windows\System\mKEzBpw.exe
  C:\Windows\System\mKEzBpw.exe
  2⤵
  - Executes dropped EXE
  PID:1856
- C:\Windows\System\KXfIJwz.exe
  C:\Windows\System\KXfIJwz.exe
  2⤵
  - Executes dropped EXE
  PID:1812
- C:\Windows\System\bsbmXTF.exe
  C:\Windows\System\bsbmXTF.exe
  2⤵
  - Executes dropped EXE
  PID:2864
- C:\Windows\System\jHUmtMO.exe
  C:\Windows\System\jHUmtMO.exe
  2⤵
  - Executes dropped EXE
  PID:1220
- C:\Windows\System\eUrONMr.exe
  C:\Windows\System\eUrONMr.exe
  2⤵
  - Executes dropped EXE
  PID:4812
- C:\Windows\System\AelVHLh.exe
  C:\Windows\System\AelVHLh.exe
  2⤵
  - Executes dropped EXE
  PID:928
- C:\Windows\System\MoVgMeH.exe
  C:\Windows\System\MoVgMeH.exe
  2⤵
  - Executes dropped EXE
  PID:940
- C:\Windows\System\lHDCGYi.exe
  C:\Windows\System\lHDCGYi.exe
  2⤵
  - Executes dropped EXE
  PID:3044
- C:\Windows\System\vqYZwOY.exe
  C:\Windows\System\vqYZwOY.exe
  2⤵
  - Executes dropped EXE
  PID:3040
- C:\Windows\System\MYoxHsI.exe
  C:\Windows\System\MYoxHsI.exe
  2⤵
  - Executes dropped EXE
  PID:4404
- C:\Windows\System\wDjJoFJ.exe
  C:\Windows\System\wDjJoFJ.exe
  2⤵
  - Executes dropped EXE
  PID:1320
- C:\Windows\System\AfqxtmA.exe
  C:\Windows\System\AfqxtmA.exe
  2⤵
  - Executes dropped EXE
  PID:4764
- C:\Windows\System\tEGfRDy.exe
  C:\Windows\System\tEGfRDy.exe
  2⤵
  - Executes dropped EXE
  PID:3692
- C:\Windows\System\qhpFJWG.exe
  C:\Windows\System\qhpFJWG.exe
  2⤵
  - Executes dropped EXE
  PID:3908
- C:\Windows\System\efFabgd.exe
  C:\Windows\System\efFabgd.exe
  2⤵
  - Executes dropped EXE
  PID:4556
- C:\Windows\System\gUXoUHy.exe
  C:\Windows\System\gUXoUHy.exe
  2⤵
  - Executes dropped EXE
  PID:3396
- C:\Windows\System\VrKfLRa.exe
  C:\Windows\System\VrKfLRa.exe
  2⤵
  - Executes dropped EXE
  PID:3868
- C:\Windows\System\uqyPJLV.exe
  C:\Windows\System\uqyPJLV.exe
  2⤵
  - Executes dropped EXE
  PID:4700
- C:\Windows\System\NfxUlAj.exe
  C:\Windows\System\NfxUlAj.exe
  2⤵
  - Executes dropped EXE
  PID:1560
- C:\Windows\System\jNZhWcA.exe
  C:\Windows\System\jNZhWcA.exe
  2⤵
  - Executes dropped EXE
  PID:1944
- C:\Windows\System\NfbYUqf.exe
  C:\Windows\System\NfbYUqf.exe
  2⤵
  - Executes dropped EXE
  PID:812
- C:\Windows\System\snADYmS.exe
  C:\Windows\System\snADYmS.exe
  2⤵
  - Executes dropped EXE
  PID:2388
- C:\Windows\System\bppzHQL.exe
  C:\Windows\System\bppzHQL.exe
  2⤵
  - Executes dropped EXE
  PID:1576
- C:\Windows\System\ejUDUpe.exe
  C:\Windows\System\ejUDUpe.exe
  2⤵
  - Executes dropped EXE
  PID:1340
- C:\Windows\System\yzAseCU.exe
  C:\Windows\System\yzAseCU.exe
  2⤵
  - Executes dropped EXE
  PID:3460
- C:\Windows\System\fppKkEZ.exe
  C:\Windows\System\fppKkEZ.exe
  2⤵
  - Executes dropped EXE
  PID:1524
- C:\Windows\System\bwZpNCk.exe
  C:\Windows\System\bwZpNCk.exe
  2⤵
  - Executes dropped EXE
  PID:3720
- C:\Windows\System\eBFtgJo.exe
  C:\Windows\System\eBFtgJo.exe
  2⤵
  - Executes dropped EXE
  PID:1680
- C:\Windows\System\CQAgEEW.exe
  C:\Windows\System\CQAgEEW.exe
  2⤵
  - Executes dropped EXE
  PID:5032
- C:\Windows\System\oPIVfCg.exe
  C:\Windows\System\oPIVfCg.exe
  2⤵
  - Executes dropped EXE
  PID:4504
- C:\Windows\System\wSShEqB.exe
  C:\Windows\System\wSShEqB.exe
  2⤵
  - Executes dropped EXE
  PID:4752
- C:\Windows\System\dgxLQWO.exe
  C:\Windows\System\dgxLQWO.exe
  2⤵
  - Executes dropped EXE
  PID:4192
- C:\Windows\System\uDjUacv.exe
  C:\Windows\System\uDjUacv.exe
  2⤵
  - Executes dropped EXE
  PID:320
- C:\Windows\System\JiDdznF.exe
  C:\Windows\System\JiDdznF.exe
  2⤵
  - Executes dropped EXE
  PID:2152
- C:\Windows\System\alWfsfL.exe
  C:\Windows\System\alWfsfL.exe
  2⤵
  PID:3952
- C:\Windows\System\vpJZoIg.exe
  C:\Windows\System\vpJZoIg.exe
  2⤵
  PID:1948
- C:\Windows\System\xcboNhK.exe
  C:\Windows\System\xcboNhK.exe
  2⤵
  PID:2868
- C:\Windows\System\pNssCxx.exe
  C:\Windows\System\pNssCxx.exe
  2⤵
  PID:3048
- C:\Windows\System\gxxvaDA.exe
  C:\Windows\System\gxxvaDA.exe
  2⤵
  PID:3432
- C:\Windows\System\FuHlFPU.exe
  C:\Windows\System\FuHlFPU.exe
  2⤵
  PID:5076
- C:\Windows\System\yVBZnaG.exe
  C:\Windows\System\yVBZnaG.exe
  2⤵
  PID:4452
- C:\Windows\System\lhEhRNt.exe
  C:\Windows\System\lhEhRNt.exe
  2⤵
  PID:5028
- C:\Windows\System\olYGWDG.exe
  C:\Windows\System\olYGWDG.exe
  2⤵
  PID:1392
- C:\Windows\System\ZObPiKQ.exe
  C:\Windows\System\ZObPiKQ.exe
  2⤵
  PID:3896
- C:\Windows\System\fmjFTUo.exe
  C:\Windows\System\fmjFTUo.exe
  2⤵
  PID:2028
- C:\Windows\System\OlguXpv.exe
  C:\Windows\System\OlguXpv.exe
  2⤵
  PID:1196
- C:\Windows\System\LHGeDRl.exe
  C:\Windows\System\LHGeDRl.exe
  2⤵
  PID:4300
- C:\Windows\System\RpgwLdc.exe
  C:\Windows\System\RpgwLdc.exe
  2⤵
  PID:1840
- C:\Windows\System\EKKujzg.exe
  C:\Windows\System\EKKujzg.exe
  2⤵
  PID:2596
- C:\Windows\System\ANPTdMx.exe
  C:\Windows\System\ANPTdMx.exe
  2⤵
  PID:4380
- C:\Windows\System\LcMmIPK.exe
  C:\Windows\System\LcMmIPK.exe
  2⤵
  PID:1688
- C:\Windows\System\FlECCkA.exe
  C:\Windows\System\FlECCkA.exe
  2⤵
  PID:4984
- C:\Windows\System\XmSoHUd.exe
  C:\Windows\System\XmSoHUd.exe
  2⤵
  PID:4792
- C:\Windows\System\IMtENDE.exe
  C:\Windows\System\IMtENDE.exe
  2⤵
  PID:1304
- C:\Windows\System\RmJIJkN.exe
  C:\Windows\System\RmJIJkN.exe
  2⤵
  PID:208
- C:\Windows\System\ZaXGcaK.exe
  C:\Windows\System\ZaXGcaK.exe
  2⤵
  PID:4672
- C:\Windows\System\fMaDLTA.exe
  C:\Windows\System\fMaDLTA.exe
  2⤵
  PID:3824
- C:\Windows\System\eoqiPZd.exe
  C:\Windows\System\eoqiPZd.exe
  2⤵
  PID:2608
- C:\Windows\System\kGZfPDx.exe
  C:\Windows\System\kGZfPDx.exe
  2⤵
  PID:3480
- C:\Windows\System\EztQgiZ.exe
  C:\Windows\System\EztQgiZ.exe
  2⤵
  PID:5152
- C:\Windows\System\tIBjdaZ.exe
  C:\Windows\System\tIBjdaZ.exe
  2⤵
  PID:5180
- C:\Windows\System\ebaPaUw.exe
  C:\Windows\System\ebaPaUw.exe
  2⤵
  PID:5212
- C:\Windows\System\nFfelIT.exe
  C:\Windows\System\nFfelIT.exe
  2⤵
  PID:5232
- C:\Windows\System\xPXGJdR.exe
  C:\Windows\System\xPXGJdR.exe
  2⤵
  PID:5264
- C:\Windows\System\EyDtIsa.exe
  C:\Windows\System\EyDtIsa.exe
  2⤵
  PID:5288
- C:\Windows\System\tIwnEDj.exe
  C:\Windows\System\tIwnEDj.exe
  2⤵
  PID:5320
- C:\Windows\System\IjdvuNU.exe
  C:\Windows\System\IjdvuNU.exe
  2⤵
  PID:5344
- C:\Windows\System\YMyAJds.exe
  C:\Windows\System\YMyAJds.exe
  2⤵
  PID:5376
- C:\Windows\System\RGfxNfz.exe
  C:\Windows\System\RGfxNfz.exe
  2⤵
  PID:5404
- C:\Windows\System\XVBZBQt.exe
  C:\Windows\System\XVBZBQt.exe
  2⤵
  PID:5428
- C:\Windows\System\JPvDCGJ.exe
  C:\Windows\System\JPvDCGJ.exe
  2⤵
  PID:5460
- C:\Windows\System\DavdsXC.exe
  C:\Windows\System\DavdsXC.exe
  2⤵
  PID:5488
- C:\Windows\System\tHhWZYG.exe
  C:\Windows\System\tHhWZYG.exe
  2⤵
  PID:5524
- C:\Windows\System\VpFxbpB.exe
  C:\Windows\System\VpFxbpB.exe
  2⤵
  PID:5552
- C:\Windows\System\wZPCqTE.exe
  C:\Windows\System\wZPCqTE.exe
  2⤵
  PID:5580
- C:\Windows\System\XBkEnBv.exe
  C:\Windows\System\XBkEnBv.exe
  2⤵
  PID:5608
- C:\Windows\System\ezpcrqr.exe
  C:\Windows\System\ezpcrqr.exe
  2⤵
  PID:5632
- C:\Windows\System\UYfcAlx.exe
  C:\Windows\System\UYfcAlx.exe
  2⤵
  PID:5664
- C:\Windows\System\RWZCmoy.exe
  C:\Windows\System\RWZCmoy.exe
  2⤵
  PID:5696
- C:\Windows\System\pgAzsWq.exe
  C:\Windows\System\pgAzsWq.exe
  2⤵
  PID:5724
- C:\Windows\System\cIkqlBK.exe
  C:\Windows\System\cIkqlBK.exe
  2⤵
  PID:5756
- C:\Windows\System\sPYTdhh.exe
  C:\Windows\System\sPYTdhh.exe
  2⤵
  PID:5780
- C:\Windows\System\RgxAaxO.exe
  C:\Windows\System\RgxAaxO.exe
  2⤵
  PID:5812
- C:\Windows\System\KhUXvsc.exe
  C:\Windows\System\KhUXvsc.exe
  2⤵
  PID:5844
- C:\Windows\System\HZFlKGs.exe
  C:\Windows\System\HZFlKGs.exe
  2⤵
  PID:5868
- C:\Windows\System\djsNxcv.exe
  C:\Windows\System\djsNxcv.exe
  2⤵
  PID:5888
- C:\Windows\System\htNwoXG.exe
  C:\Windows\System\htNwoXG.exe
  2⤵
  PID:5912
- C:\Windows\System\AsZeDXn.exe
  C:\Windows\System\AsZeDXn.exe
  2⤵
  PID:5948
- C:\Windows\System\gXJOObX.exe
  C:\Windows\System\gXJOObX.exe
  2⤵
  PID:5972
- C:\Windows\System\aomBVst.exe
  C:\Windows\System\aomBVst.exe
  2⤵
  PID:5996
- C:\Windows\System\fMUrREE.exe
  C:\Windows\System\fMUrREE.exe
  2⤵
  PID:6028
- C:\Windows\System\heQZzIC.exe
  C:\Windows\System\heQZzIC.exe
  2⤵
  PID:6052
- C:\Windows\System\iOBuDHT.exe
  C:\Windows\System\iOBuDHT.exe
  2⤵
  PID:6084
- C:\Windows\System\PiJFGFc.exe
  C:\Windows\System\PiJFGFc.exe
  2⤵
  PID:6112
- C:\Windows\System\wPaYftN.exe
  C:\Windows\System\wPaYftN.exe
  2⤵
  PID:6136
- C:\Windows\System\qntSCJe.exe
  C:\Windows\System\qntSCJe.exe
  2⤵
  PID:3956
- C:\Windows\System\leLTubX.exe
  C:\Windows\System\leLTubX.exe
  2⤵
  PID:3352
- C:\Windows\System\cksXKYO.exe
  C:\Windows\System\cksXKYO.exe
  2⤵
  PID:2720
- C:\Windows\System\MzltcAM.exe
  C:\Windows\System\MzltcAM.exe
  2⤵
  PID:1128
- C:\Windows\System\iiOyLUJ.exe
  C:\Windows\System\iiOyLUJ.exe
  2⤵
  PID:3876
- C:\Windows\System\mNNREge.exe
  C:\Windows\System\mNNREge.exe
  2⤵
  PID:4524
- C:\Windows\System\sfuhBZv.exe
  C:\Windows\System\sfuhBZv.exe
  2⤵
  PID:2188
- C:\Windows\System\RZTFAjj.exe
  C:\Windows\System\RZTFAjj.exe
  2⤵
  PID:5160
- C:\Windows\System\AfnJISj.exe
  C:\Windows\System\AfnJISj.exe
  2⤵
  PID:5208
- C:\Windows\System\WSCtYKo.exe
  C:\Windows\System\WSCtYKo.exe
  2⤵
  PID:5284
- C:\Windows\System\ERrCUGd.exe
  C:\Windows\System\ERrCUGd.exe
  2⤵
  PID:5340
- C:\Windows\System\fDYabeZ.exe
  C:\Windows\System\fDYabeZ.exe
  2⤵
  PID:5420
- C:\Windows\System\oahiVno.exe
  C:\Windows\System\oahiVno.exe
  2⤵
  PID:5484
- C:\Windows\System\MCSJVhi.exe
  C:\Windows\System\MCSJVhi.exe
  2⤵
  PID:5560
- C:\Windows\System\HYyfyBV.exe
  C:\Windows\System\HYyfyBV.exe
  2⤵
  PID:5620
- C:\Windows\System\nCPYQRt.exe
  C:\Windows\System\nCPYQRt.exe
  2⤵
  PID:5672
- C:\Windows\System\AtYVORz.exe
  C:\Windows\System\AtYVORz.exe
  2⤵
  PID:5744
- C:\Windows\System\wJVLfPe.exe
  C:\Windows\System\wJVLfPe.exe
  2⤵
  PID:5800
- C:\Windows\System\ljxrFNC.exe
  C:\Windows\System\ljxrFNC.exe
  2⤵
  PID:5860
- C:\Windows\System\kcMfGmj.exe
  C:\Windows\System\kcMfGmj.exe
  2⤵
  PID:5924
- C:\Windows\System\yZQWZos.exe
  C:\Windows\System\yZQWZos.exe
  2⤵
  PID:5988
- C:\Windows\System\voWivFR.exe
  C:\Windows\System\voWivFR.exe
  2⤵
  PID:6044
- C:\Windows\System\JuGXUVn.exe
  C:\Windows\System\JuGXUVn.exe
  2⤵
  PID:4328
- C:\Windows\System\LPlprNq.exe
  C:\Windows\System\LPlprNq.exe
  2⤵
  PID:3052
- C:\Windows\System\vZlyFQV.exe
  C:\Windows\System\vZlyFQV.exe
  2⤵
  PID:3468
- C:\Windows\System\ogxPzKv.exe
  C:\Windows\System\ogxPzKv.exe
  2⤵
  PID:3652
- C:\Windows\System\XGBfiRD.exe
  C:\Windows\System\XGBfiRD.exe
  2⤵
  PID:2060
- C:\Windows\System\gPLbzSZ.exe
  C:\Windows\System\gPLbzSZ.exe
  2⤵
  PID:5200
- C:\Windows\System\KqZYgrc.exe
  C:\Windows\System\KqZYgrc.exe
  2⤵
  PID:5336
- C:\Windows\System\cgdlEzz.exe
  C:\Windows\System\cgdlEzz.exe
  2⤵
  PID:964
- C:\Windows\System\nKhFTEw.exe
  C:\Windows\System\nKhFTEw.exe
  2⤵
  PID:5648
- C:\Windows\System\tOJTqzK.exe
  C:\Windows\System\tOJTqzK.exe
  2⤵
  PID:5740
- C:\Windows\System\BuCcPBR.exe
  C:\Windows\System\BuCcPBR.exe
  2⤵
  PID:5876
- C:\Windows\System\ojgsFyD.exe
  C:\Windows\System\ojgsFyD.exe
  2⤵
  PID:6008
- C:\Windows\System\LwNurau.exe
  C:\Windows\System\LwNurau.exe
  2⤵
  PID:6092
- C:\Windows\System\OrWtEBP.exe
  C:\Windows\System\OrWtEBP.exe
  2⤵
  PID:1040
- C:\Windows\System\NZUOfWA.exe
  C:\Windows\System\NZUOfWA.exe
  2⤵
  PID:4832
- C:\Windows\System\zOrvWKq.exe
  C:\Windows\System\zOrvWKq.exe
  2⤵
  PID:60
- C:\Windows\System\QuPYpkk.exe
  C:\Windows\System\QuPYpkk.exe
  2⤵
  PID:4496
- C:\Windows\System\pwkNNwm.exe
  C:\Windows\System\pwkNNwm.exe
  2⤵
  PID:5600
- C:\Windows\System\DpoGBaj.exe
  C:\Windows\System\DpoGBaj.exe
  2⤵
  PID:2808
- C:\Windows\System\glhtiJE.exe
  C:\Windows\System\glhtiJE.exe
  2⤵
  PID:2428
- C:\Windows\System\OcWUJGx.exe
  C:\Windows\System\OcWUJGx.exe
  2⤵
  PID:3232
- C:\Windows\System\NTupign.exe
  C:\Windows\System\NTupign.exe
  2⤵
  PID:5440
- C:\Windows\System\vhSfqgQ.exe
  C:\Windows\System\vhSfqgQ.exe
  2⤵
  PID:264
- C:\Windows\System\qdRBRFa.exe
  C:\Windows\System\qdRBRFa.exe
  2⤵
  PID:5720
- C:\Windows\System\TssQfKk.exe
  C:\Windows\System\TssQfKk.exe
  2⤵
  PID:1564
- C:\Windows\System\OXhdxwS.exe
  C:\Windows\System\OXhdxwS.exe
  2⤵
  PID:3344
- C:\Windows\System\jkTDyTJ.exe
  C:\Windows\System\jkTDyTJ.exe
  2⤵
  PID:3932
- C:\Windows\System\BhsLvcu.exe
  C:\Windows\System\BhsLvcu.exe
  2⤵
  PID:5832
- C:\Windows\System\RGiPqki.exe
  C:\Windows\System\RGiPqki.exe
  2⤵
  PID:3648
- C:\Windows\System\LPmKpsl.exe
  C:\Windows\System\LPmKpsl.exe
  2⤵
  PID:2972
- C:\Windows\System\MAahBUz.exe
  C:\Windows\System\MAahBUz.exe
  2⤵
  PID:6172
- C:\Windows\System\NifRSrn.exe
  C:\Windows\System\NifRSrn.exe
  2⤵
  PID:6212
- C:\Windows\System\ekiZZFN.exe
  C:\Windows\System\ekiZZFN.exe
  2⤵
  PID:6244
- C:\Windows\System\jsSNqbg.exe
  C:\Windows\System\jsSNqbg.exe
  2⤵
  PID:6268
- C:\Windows\System\qKYyGwQ.exe
  C:\Windows\System\qKYyGwQ.exe
  2⤵
  PID:6288
- C:\Windows\System\HrzNKYa.exe
  C:\Windows\System\HrzNKYa.exe
  2⤵
  PID:6316
- C:\Windows\System\kabBulD.exe
  C:\Windows\System\kabBulD.exe
  2⤵
  PID:6348
- C:\Windows\System\lJBydEo.exe
  C:\Windows\System\lJBydEo.exe
  2⤵
  PID:6368
- C:\Windows\System\HKjFcYj.exe
  C:\Windows\System\HKjFcYj.exe
  2⤵
  PID:6396
- C:\Windows\System\FIxTOKt.exe
  C:\Windows\System\FIxTOKt.exe
  2⤵
  PID:6436
- C:\Windows\System\KsExrGI.exe
  C:\Windows\System\KsExrGI.exe
  2⤵
  PID:6456
- C:\Windows\System\gsVrLpX.exe
  C:\Windows\System\gsVrLpX.exe
  2⤵
  PID:6472
- C:\Windows\System\QOyLoyy.exe
  C:\Windows\System\QOyLoyy.exe
  2⤵
  PID:6492
- C:\Windows\System\pGtwlQH.exe
  C:\Windows\System\pGtwlQH.exe
  2⤵
  PID:6524
- C:\Windows\System\hBRKqte.exe
  C:\Windows\System\hBRKqte.exe
  2⤵
  PID:6580
- C:\Windows\System\DZygMAZ.exe
  C:\Windows\System\DZygMAZ.exe
  2⤵
  PID:6596
- C:\Windows\System\gVaCruQ.exe
  C:\Windows\System\gVaCruQ.exe
  2⤵
  PID:6624
- C:\Windows\System\tpTJHvX.exe
  C:\Windows\System\tpTJHvX.exe
  2⤵
  PID:6652
- C:\Windows\System\lmdYHBY.exe
  C:\Windows\System\lmdYHBY.exe
  2⤵
  PID:6680
- C:\Windows\System\lHgCoSo.exe
  C:\Windows\System\lHgCoSo.exe
  2⤵
  PID:6704
- C:\Windows\System\cImiHHK.exe
  C:\Windows\System\cImiHHK.exe
  2⤵
  PID:6748
- C:\Windows\System\AcFeIoW.exe
  C:\Windows\System\AcFeIoW.exe
  2⤵
  PID:6764
- C:\Windows\System\HoSfjTY.exe
  C:\Windows\System\HoSfjTY.exe
  2⤵
  PID:6808
- C:\Windows\System\fFRvLsU.exe
  C:\Windows\System\fFRvLsU.exe
  2⤵
  PID:6828
- C:\Windows\System\XzsEdhS.exe
  C:\Windows\System\XzsEdhS.exe
  2⤵
  PID:6852
- C:\Windows\System\ktRWUOS.exe
  C:\Windows\System\ktRWUOS.exe
  2⤵
  PID:6880
- C:\Windows\System\xkRSwIA.exe
  C:\Windows\System\xkRSwIA.exe
  2⤵
  PID:6904
- C:\Windows\System\mPBsahQ.exe
  C:\Windows\System\mPBsahQ.exe
  2⤵
  PID:6936
- C:\Windows\System\NJDcNQX.exe
  C:\Windows\System\NJDcNQX.exe
  2⤵
  PID:6952
- C:\Windows\System\REuJVhf.exe
  C:\Windows\System\REuJVhf.exe
  2⤵
  PID:6984
- C:\Windows\System\unPCqvF.exe
  C:\Windows\System\unPCqvF.exe
  2⤵
  PID:7012
- C:\Windows\System\aFHJTFA.exe
  C:\Windows\System\aFHJTFA.exe
  2⤵
  PID:7036
- C:\Windows\System\RHxqpdN.exe
  C:\Windows\System\RHxqpdN.exe
  2⤵
  PID:7060
- C:\Windows\System\WMqFJRD.exe
  C:\Windows\System\WMqFJRD.exe
  2⤵
  PID:7084
- C:\Windows\System\odJTdFz.exe
  C:\Windows\System\odJTdFz.exe
  2⤵
  PID:7104
- C:\Windows\System\kratKPt.exe
  C:\Windows\System\kratKPt.exe
  2⤵
  PID:7132
- C:\Windows\System\uhpzaIg.exe
  C:\Windows\System\uhpzaIg.exe
  2⤵
  PID:6168
- C:\Windows\System\qJrNekC.exe
  C:\Windows\System\qJrNekC.exe
  2⤵
  PID:6208
- C:\Windows\System\joERaqs.exe
  C:\Windows\System\joERaqs.exe
  2⤵
  PID:6284
- C:\Windows\System\oIzdmfx.exe
  C:\Windows\System\oIzdmfx.exe
  2⤵
  PID:6344
- C:\Windows\System\HDwgVNi.exe
  C:\Windows\System\HDwgVNi.exe
  2⤵
  PID:6444
- C:\Windows\System\TqlupUG.exe
  C:\Windows\System\TqlupUG.exe
  2⤵
  PID:6516
- C:\Windows\System\NBLFobw.exe
  C:\Windows\System\NBLFobw.exe
  2⤵
  PID:6592
- C:\Windows\System\GVzkgLn.exe
  C:\Windows\System\GVzkgLn.exe
  2⤵
  PID:6648
- C:\Windows\System\tSeXADe.exe
  C:\Windows\System\tSeXADe.exe
  2⤵
  PID:6692
- C:\Windows\System\UVrCurZ.exe
  C:\Windows\System\UVrCurZ.exe
  2⤵
  PID:4732
- C:\Windows\System\MqSAMhm.exe
  C:\Windows\System\MqSAMhm.exe
  2⤵
  PID:6804
- C:\Windows\System\JEIJpcS.exe
  C:\Windows\System\JEIJpcS.exe
  2⤵
  PID:6864
- C:\Windows\System\QAXwqEm.exe
  C:\Windows\System\QAXwqEm.exe
  2⤵
  PID:6944
- C:\Windows\System\gxHSYuG.exe
  C:\Windows\System\gxHSYuG.exe
  2⤵
  PID:7000
- C:\Windows\System\FvUIVbA.exe
  C:\Windows\System\FvUIVbA.exe
  2⤵
  PID:7116
- C:\Windows\System\hPumZyc.exe
  C:\Windows\System\hPumZyc.exe
  2⤵
  PID:7100
- C:\Windows\System\nRARBXw.exe
  C:\Windows\System\nRARBXw.exe
  2⤵
  PID:6264
- C:\Windows\System\crrZJca.exe
  C:\Windows\System\crrZJca.exe
  2⤵
  PID:6384
- C:\Windows\System\OXzjDwW.exe
  C:\Windows\System\OXzjDwW.exe
  2⤵
  PID:6548
- C:\Windows\System\ExOFmbG.exe
  C:\Windows\System\ExOFmbG.exe
  2⤵
  PID:6728
- C:\Windows\System\dMRxDsL.exe
  C:\Windows\System\dMRxDsL.exe
  2⤵
  PID:1668
- C:\Windows\System\WCYxxlb.exe
  C:\Windows\System\WCYxxlb.exe
  2⤵
  PID:6896
- C:\Windows\System\vZiWVbO.exe
  C:\Windows\System\vZiWVbO.exe
  2⤵
  PID:7092
- C:\Windows\System\Xgdvylg.exe
  C:\Windows\System\Xgdvylg.exe
  2⤵
  PID:5304
- C:\Windows\System\qhcRQrd.exe
  C:\Windows\System\qhcRQrd.exe
  2⤵
  PID:6452
- C:\Windows\System\eTHevWa.exe
  C:\Windows\System\eTHevWa.exe
  2⤵
  PID:6744
- C:\Windows\System\xokSbwK.exe
  C:\Windows\System\xokSbwK.exe
  2⤵
  PID:6324
- C:\Windows\System\pGCBkGM.exe
  C:\Windows\System\pGCBkGM.exe
  2⤵
  PID:6660
- C:\Windows\System\tulbrJg.exe
  C:\Windows\System\tulbrJg.exe
  2⤵
  PID:7176
- C:\Windows\System\mRqtOQs.exe
  C:\Windows\System\mRqtOQs.exe
  2⤵
  PID:7228
- C:\Windows\System\dxyuoIi.exe
  C:\Windows\System\dxyuoIi.exe
  2⤵
  PID:7260
- C:\Windows\System\vBudRzU.exe
  C:\Windows\System\vBudRzU.exe
  2⤵
  PID:7284
- C:\Windows\System\iMpEIMp.exe
  C:\Windows\System\iMpEIMp.exe
  2⤵
  PID:7312
- C:\Windows\System\wBYZgDB.exe
  C:\Windows\System\wBYZgDB.exe
  2⤵
  PID:7356
- C:\Windows\System\mTczZmP.exe
  C:\Windows\System\mTczZmP.exe
  2⤵
  PID:7384
- C:\Windows\System\APMSzPo.exe
  C:\Windows\System\APMSzPo.exe
  2⤵
  PID:7416
- C:\Windows\System\wRvUVIl.exe
  C:\Windows\System\wRvUVIl.exe
  2⤵
  PID:7432
- C:\Windows\System\XcxNPOu.exe
  C:\Windows\System\XcxNPOu.exe
  2⤵
  PID:7456
- C:\Windows\System\rQNEEGg.exe
  C:\Windows\System\rQNEEGg.exe
  2⤵
  PID:7484
- C:\Windows\System\SGtKAVj.exe
  C:\Windows\System\SGtKAVj.exe
  2⤵
  PID:7512
- C:\Windows\System\QeuZUdb.exe
  C:\Windows\System\QeuZUdb.exe
  2⤵
  PID:7540
- C:\Windows\System\VGVeLcv.exe
  C:\Windows\System\VGVeLcv.exe
  2⤵
  PID:7568
- C:\Windows\System\KMmYbrX.exe
  C:\Windows\System\KMmYbrX.exe
  2⤵
  PID:7588
- C:\Windows\System\OAGceCG.exe
  C:\Windows\System\OAGceCG.exe
  2⤵
  PID:7616
- C:\Windows\System\xgnlMAe.exe
  C:\Windows\System\xgnlMAe.exe
  2⤵
  PID:7640
- C:\Windows\System\QPmhMUH.exe
  C:\Windows\System\QPmhMUH.exe
  2⤵
  PID:7664
- C:\Windows\System\PNPlwDi.exe
  C:\Windows\System\PNPlwDi.exe
  2⤵
  PID:7684
- C:\Windows\System\FwuMlvU.exe
  C:\Windows\System\FwuMlvU.exe
  2⤵
  PID:7712
- C:\Windows\System\xPvtZsN.exe
  C:\Windows\System\xPvtZsN.exe
  2⤵
  PID:7740
- C:\Windows\System\OeCRfRp.exe
  C:\Windows\System\OeCRfRp.exe
  2⤵
  PID:7760
- C:\Windows\System\MFVsNWk.exe
  C:\Windows\System\MFVsNWk.exe
  2⤵
  PID:7792
- C:\Windows\System\AQdandH.exe
  C:\Windows\System\AQdandH.exe
  2⤵
  PID:7816
- C:\Windows\System\IMyDSLW.exe
  C:\Windows\System\IMyDSLW.exe
  2⤵
  PID:7848
- C:\Windows\System\vzFOMBQ.exe
  C:\Windows\System\vzFOMBQ.exe
  2⤵
  PID:7904
- C:\Windows\System\XJDvxyj.exe
  C:\Windows\System\XJDvxyj.exe
  2⤵
  PID:7936
- C:\Windows\System\VOHhhXt.exe
  C:\Windows\System\VOHhhXt.exe
  2⤵
  PID:7960
- C:\Windows\System\qCzRqdT.exe
  C:\Windows\System\qCzRqdT.exe
  2⤵
  PID:7988
- C:\Windows\System\rdGgTCd.exe
  C:\Windows\System\rdGgTCd.exe
  2⤵
  PID:8024
- C:\Windows\System\hjlVpxa.exe
  C:\Windows\System\hjlVpxa.exe
  2⤵
  PID:8048
- C:\Windows\System\NesNoyB.exe
  C:\Windows\System\NesNoyB.exe
  2⤵
  PID:8072
- C:\Windows\System\AIKhPud.exe
  C:\Windows\System\AIKhPud.exe
  2⤵
  PID:8104
- C:\Windows\System\lrqCQjY.exe
  C:\Windows\System\lrqCQjY.exe
  2⤵
  PID:8132
- C:\Windows\System\bcyuePS.exe
  C:\Windows\System\bcyuePS.exe
  2⤵
  PID:8148
- C:\Windows\System\oxXhOmq.exe
  C:\Windows\System\oxXhOmq.exe
  2⤵
  PID:8164
- C:\Windows\System\bCrxlrj.exe
  C:\Windows\System\bCrxlrj.exe
  2⤵
  PID:6784
- C:\Windows\System\tTKhQpd.exe
  C:\Windows\System\tTKhQpd.exe
  2⤵
  PID:7220
- C:\Windows\System\OsbZrUU.exe
  C:\Windows\System\OsbZrUU.exe
  2⤵
  PID:7252
- C:\Windows\System\dCxhoLJ.exe
  C:\Windows\System\dCxhoLJ.exe
  2⤵
  PID:7304
- C:\Windows\System\cvDzAEV.exe
  C:\Windows\System\cvDzAEV.exe
  2⤵
  PID:7344
- C:\Windows\System\BUSfeLo.exe
  C:\Windows\System\BUSfeLo.exe
  2⤵
  PID:7496
- C:\Windows\System\QhcadQI.exe
  C:\Windows\System\QhcadQI.exe
  2⤵
  PID:7556
- C:\Windows\System\anRRgDD.exe
  C:\Windows\System\anRRgDD.exe
  2⤵
  PID:7600
- C:\Windows\System\ryJkEIy.exe
  C:\Windows\System\ryJkEIy.exe
  2⤵
  PID:7692
- C:\Windows\System\dsAlpjH.exe
  C:\Windows\System\dsAlpjH.exe
  2⤵
  PID:7752
- C:\Windows\System\QPTmFit.exe
  C:\Windows\System\QPTmFit.exe
  2⤵
  PID:7844
- C:\Windows\System\KhUCFSB.exe
  C:\Windows\System\KhUCFSB.exe
  2⤵
  PID:7932
- C:\Windows\System\bNadlKf.exe
  C:\Windows\System\bNadlKf.exe
  2⤵
  PID:7976
- C:\Windows\System\dKXHvrV.exe
  C:\Windows\System\dKXHvrV.exe
  2⤵
  PID:8020
- C:\Windows\System\YcapAMb.exe
  C:\Windows\System\YcapAMb.exe
  2⤵
  PID:8144
- C:\Windows\System\cxwvPxk.exe
  C:\Windows\System\cxwvPxk.exe
  2⤵
  PID:8156
- C:\Windows\System\dhOptOl.exe
  C:\Windows\System\dhOptOl.exe
  2⤵
  PID:7272
- C:\Windows\System\KeIHIKx.exe
  C:\Windows\System\KeIHIKx.exe
  2⤵
  PID:7412
- C:\Windows\System\NUUaXXC.exe
  C:\Windows\System\NUUaXXC.exe
  2⤵
  PID:7476
- C:\Windows\System\cxtfVxR.exe
  C:\Windows\System\cxtfVxR.exe
  2⤵
  PID:7632
- C:\Windows\System\eevzUZM.exe
  C:\Windows\System\eevzUZM.exe
  2⤵
  PID:7884
- C:\Windows\System\URkJxdW.exe
  C:\Windows\System\URkJxdW.exe
  2⤵
  PID:8116
- C:\Windows\System\BdrFBVF.exe
  C:\Windows\System\BdrFBVF.exe
  2⤵
  PID:8188
- C:\Windows\System\beVVraU.exe
  C:\Windows\System\beVVraU.exe
  2⤵
  PID:7536
- C:\Windows\System\mKnolWd.exe
  C:\Windows\System\mKnolWd.exe
  2⤵
  PID:7724
- C:\Windows\System\paULCWS.exe
  C:\Windows\System\paULCWS.exe
  2⤵
  PID:8044
- C:\Windows\System\EESRPJV.exe
  C:\Windows\System\EESRPJV.exe
  2⤵
  PID:7172
- C:\Windows\System\lxYyqeH.exe
  C:\Windows\System\lxYyqeH.exe
  2⤵
  PID:8196
- C:\Windows\System\OSQIXvC.exe
  C:\Windows\System\OSQIXvC.exe
  2⤵
  PID:8228
- C:\Windows\System\XfwpgGP.exe
  C:\Windows\System\XfwpgGP.exe
  2⤵
  PID:8248
- C:\Windows\System\FvgBLes.exe
  C:\Windows\System\FvgBLes.exe
  2⤵
  PID:8280
- C:\Windows\System\ndfJiMa.exe
  C:\Windows\System\ndfJiMa.exe
  2⤵
  PID:8300
- C:\Windows\System\fnonNWi.exe
  C:\Windows\System\fnonNWi.exe
  2⤵
  PID:8344
- C:\Windows\System\ZnfoKZl.exe
  C:\Windows\System\ZnfoKZl.exe
  2⤵
  PID:8364
- C:\Windows\System\mXtOVoV.exe
  C:\Windows\System\mXtOVoV.exe
  2⤵
  PID:8384
- C:\Windows\System\gFikVMg.exe
  C:\Windows\System\gFikVMg.exe
  2⤵
  PID:8420
- C:\Windows\System\cyaHAFK.exe
  C:\Windows\System\cyaHAFK.exe
  2⤵
  PID:8456
- C:\Windows\System\ICKllul.exe
  C:\Windows\System\ICKllul.exe
  2⤵
  PID:8476
- C:\Windows\System\RkgHbUM.exe
  C:\Windows\System\RkgHbUM.exe
  2⤵
  PID:8496
- C:\Windows\System\AYBIZZm.exe
  C:\Windows\System\AYBIZZm.exe
  2⤵
  PID:8516
- C:\Windows\System\oXwlIzs.exe
  C:\Windows\System\oXwlIzs.exe
  2⤵
  PID:8548
- C:\Windows\System\jqrmEHf.exe
  C:\Windows\System\jqrmEHf.exe
  2⤵
  PID:8592
- C:\Windows\System\yqnOauD.exe
  C:\Windows\System\yqnOauD.exe
  2⤵
  PID:8632
- C:\Windows\System\LMzOYUL.exe
  C:\Windows\System\LMzOYUL.exe
  2⤵
  PID:8656
- C:\Windows\System\RJQoazV.exe
  C:\Windows\System\RJQoazV.exe
  2⤵
  PID:8676
- C:\Windows\System\uQgMasx.exe
  C:\Windows\System\uQgMasx.exe
  2⤵
  PID:8696
- C:\Windows\System\TVaIwzk.exe
  C:\Windows\System\TVaIwzk.exe
  2⤵
  PID:8724
- C:\Windows\System\PEsEjwF.exe
  C:\Windows\System\PEsEjwF.exe
  2⤵
  PID:8748
- C:\Windows\System\DBpadCE.exe
  C:\Windows\System\DBpadCE.exe
  2⤵
  PID:8776
- C:\Windows\System\CBNqJQD.exe
  C:\Windows\System\CBNqJQD.exe
  2⤵
  PID:8812
- C:\Windows\System\cBgZLlv.exe
  C:\Windows\System\cBgZLlv.exe
  2⤵
  PID:8840
- C:\Windows\System\vnjrRAG.exe
  C:\Windows\System\vnjrRAG.exe
  2⤵
  PID:8860
- C:\Windows\System\JzZYkCs.exe
  C:\Windows\System\JzZYkCs.exe
  2⤵
  PID:8892
- C:\Windows\System\JfUqFTg.exe
  C:\Windows\System\JfUqFTg.exe
  2⤵
  PID:8920
- C:\Windows\System\EaaxSaS.exe
  C:\Windows\System\EaaxSaS.exe
  2⤵
  PID:8944
- C:\Windows\System\OwZNhwE.exe
  C:\Windows\System\OwZNhwE.exe
  2⤵
  PID:8972
- C:\Windows\System\ZAFnyVW.exe
  C:\Windows\System\ZAFnyVW.exe
  2⤵
  PID:9000
- C:\Windows\System\aqYpQlM.exe
  C:\Windows\System\aqYpQlM.exe
  2⤵
  PID:9064
- C:\Windows\System\YEPEskW.exe
  C:\Windows\System\YEPEskW.exe
  2⤵
  PID:9104
- C:\Windows\System\lAbjzWS.exe
  C:\Windows\System\lAbjzWS.exe
  2⤵
  PID:9124
- C:\Windows\System\qcOgJgT.exe
  C:\Windows\System\qcOgJgT.exe
  2⤵
  PID:9140
- C:\Windows\System\PcfoNRi.exe
  C:\Windows\System\PcfoNRi.exe
  2⤵
  PID:9168
- C:\Windows\System\wwlBmxC.exe
  C:\Windows\System\wwlBmxC.exe
  2⤵
  PID:8004
- C:\Windows\System\LLQFTlt.exe
  C:\Windows\System\LLQFTlt.exe
  2⤵
  PID:8036
- C:\Windows\System\ArkaokG.exe
  C:\Windows\System\ArkaokG.exe
  2⤵
  PID:8240
- C:\Windows\System\JVUCFkt.exe
  C:\Windows\System\JVUCFkt.exe
  2⤵
  PID:8340
- C:\Windows\System\sDWmGCx.exe
  C:\Windows\System\sDWmGCx.exe
  2⤵
  PID:8436
- C:\Windows\System\oBaCeKx.exe
  C:\Windows\System\oBaCeKx.exe
  2⤵
  PID:8472
- C:\Windows\System\LKXtPvn.exe
  C:\Windows\System\LKXtPvn.exe
  2⤵
  PID:8540
- C:\Windows\System\uoCYxJg.exe
  C:\Windows\System\uoCYxJg.exe
  2⤵
  PID:8544
- C:\Windows\System\tFiFUog.exe
  C:\Windows\System\tFiFUog.exe
  2⤵
  PID:8572
- C:\Windows\System\BwbJcQg.exe
  C:\Windows\System\BwbJcQg.exe
  2⤵
  PID:8712
- C:\Windows\System\yrCbTUT.exe
  C:\Windows\System\yrCbTUT.exe
  2⤵
  PID:8732
- C:\Windows\System\cnzRgJy.exe
  C:\Windows\System\cnzRgJy.exe
  2⤵
  PID:8820
- C:\Windows\System\XSpPErO.exe
  C:\Windows\System\XSpPErO.exe
  2⤵
  PID:8848
- C:\Windows\System\PLLpIfB.exe
  C:\Windows\System\PLLpIfB.exe
  2⤵
  PID:8936
- C:\Windows\System\VGFOilB.exe
  C:\Windows\System\VGFOilB.exe
  2⤵
  PID:8996
- C:\Windows\System\YyQtcUO.exe
  C:\Windows\System\YyQtcUO.exe
  2⤵
  PID:9136
- C:\Windows\System\QvbARgz.exe
  C:\Windows\System\QvbARgz.exe
  2⤵
  PID:9208
- C:\Windows\System\WGugpMr.exe
  C:\Windows\System\WGugpMr.exe
  2⤵
  PID:7780
- C:\Windows\System\gDqOjcS.exe
  C:\Windows\System\gDqOjcS.exe
  2⤵
  PID:8392
- C:\Windows\System\cheDyzr.exe
  C:\Windows\System\cheDyzr.exe
  2⤵
  PID:8508
- C:\Windows\System\jzNkAqs.exe
  C:\Windows\System\jzNkAqs.exe
  2⤵
  PID:8644
- C:\Windows\System\hQSvfRI.exe
  C:\Windows\System\hQSvfRI.exe
  2⤵
  PID:8900
- C:\Windows\System\qGmBfjP.exe
  C:\Windows\System\qGmBfjP.exe
  2⤵
  PID:8912
- C:\Windows\System\iiLZDGb.exe
  C:\Windows\System\iiLZDGb.exe
  2⤵
  PID:9156
- C:\Windows\System\AfarZHQ.exe
  C:\Windows\System\AfarZHQ.exe
  2⤵
  PID:9212
- C:\Windows\System\iEBbCle.exe
  C:\Windows\System\iEBbCle.exe
  2⤵
  PID:8672
- C:\Windows\System\fMpVZTM.exe
  C:\Windows\System\fMpVZTM.exe
  2⤵
  PID:8968
- C:\Windows\System\Qprddxq.exe
  C:\Windows\System\Qprddxq.exe
  2⤵
  PID:8608
- C:\Windows\System\CXhXjCZ.exe
  C:\Windows\System\CXhXjCZ.exe
  2⤵
  PID:9220
- C:\Windows\System\exUknlb.exe
  C:\Windows\System\exUknlb.exe
  2⤵
  PID:9240
- C:\Windows\System\FZKVdNv.exe
  C:\Windows\System\FZKVdNv.exe
  2⤵
  PID:9268
- C:\Windows\System\OESofIE.exe
  C:\Windows\System\OESofIE.exe
  2⤵
  PID:9296
- C:\Windows\System\KhsiZDy.exe
  C:\Windows\System\KhsiZDy.exe
  2⤵
  PID:9316
- C:\Windows\System\RzYJsJa.exe
  C:\Windows\System\RzYJsJa.exe
  2⤵
  PID:9344
- C:\Windows\System\ROqUhbD.exe
  C:\Windows\System\ROqUhbD.exe
  2⤵
  PID:9372
- C:\Windows\System\IlzQqhg.exe
  C:\Windows\System\IlzQqhg.exe
  2⤵
  PID:9396
- C:\Windows\System\GtuYqaS.exe
  C:\Windows\System\GtuYqaS.exe
  2⤵
  PID:9424
- C:\Windows\System\loFUWwQ.exe
  C:\Windows\System\loFUWwQ.exe
  2⤵
  PID:9452
- C:\Windows\System\XOiKULx.exe
  C:\Windows\System\XOiKULx.exe
  2⤵
  PID:9472
- C:\Windows\System\xIPisgC.exe
  C:\Windows\System\xIPisgC.exe
  2⤵
  PID:9500
- C:\Windows\System\URltCBs.exe
  C:\Windows\System\URltCBs.exe
  2⤵
  PID:9532
- C:\Windows\System\hoKyRjC.exe
  C:\Windows\System\hoKyRjC.exe
  2⤵
  PID:9560
- C:\Windows\System\lcQGDAp.exe
  C:\Windows\System\lcQGDAp.exe
  2⤵
  PID:9608
- C:\Windows\System\qkAfBkv.exe
  C:\Windows\System\qkAfBkv.exe
  2⤵
  PID:9636
- C:\Windows\System\ZzYnpRd.exe
  C:\Windows\System\ZzYnpRd.exe
  2⤵
  PID:9672
- C:\Windows\System\tsDqNLR.exe
  C:\Windows\System\tsDqNLR.exe
  2⤵
  PID:9696
- C:\Windows\System\dQxvtKq.exe
  C:\Windows\System\dQxvtKq.exe
  2⤵
  PID:9716
- C:\Windows\System\HHiARux.exe
  C:\Windows\System\HHiARux.exe
  2⤵
  PID:9748
- C:\Windows\System\zuYEUqm.exe
  C:\Windows\System\zuYEUqm.exe
  2⤵
  PID:9776
- C:\Windows\System\oaCtWNl.exe
  C:\Windows\System\oaCtWNl.exe
  2⤵
  PID:9820
- C:\Windows\System\vFSFhgv.exe
  C:\Windows\System\vFSFhgv.exe
  2⤵
  PID:9848
- C:\Windows\System\TRyUXqd.exe
  C:\Windows\System\TRyUXqd.exe
  2⤵
  PID:9872
- C:\Windows\System\kwfhyEU.exe
  C:\Windows\System\kwfhyEU.exe
  2⤵
  PID:9904
- C:\Windows\System\uTzFTqy.exe
  C:\Windows\System\uTzFTqy.exe
  2⤵
  PID:9920
- C:\Windows\System\xczKDap.exe
  C:\Windows\System\xczKDap.exe
  2⤵
  PID:9960
- C:\Windows\System\KaoZUvT.exe
  C:\Windows\System\KaoZUvT.exe
  2⤵
  PID:9976
- C:\Windows\System\VEItNJl.exe
  C:\Windows\System\VEItNJl.exe
  2⤵
  PID:10008
- C:\Windows\System\HFwRKDZ.exe
  C:\Windows\System\HFwRKDZ.exe
  2⤵
  PID:10028
- C:\Windows\System\YCqjuYu.exe
  C:\Windows\System\YCqjuYu.exe
  2⤵
  PID:10052
- C:\Windows\System\bXsMMUC.exe
  C:\Windows\System\bXsMMUC.exe
  2⤵
  PID:10080
- C:\Windows\System\RpeSxTD.exe
  C:\Windows\System\RpeSxTD.exe
  2⤵
  PID:10108
- C:\Windows\System\TqwOWIc.exe
  C:\Windows\System\TqwOWIc.exe
  2⤵
  PID:10144
- C:\Windows\System\zWLLNXv.exe
  C:\Windows\System\zWLLNXv.exe
  2⤵
  PID:10160
- C:\Windows\System\oMvxWTG.exe
  C:\Windows\System\oMvxWTG.exe
  2⤵
  PID:10196
- C:\Windows\System\FpKfSEi.exe
  C:\Windows\System\FpKfSEi.exe
  2⤵
  PID:10224
- C:\Windows\System\dqlVJxO.exe
  C:\Windows\System\dqlVJxO.exe
  2⤵
  PID:8588
- C:\Windows\System\LwmwOVd.exe
  C:\Windows\System\LwmwOVd.exe
  2⤵
  PID:9292
- C:\Windows\System\yIwdJtk.exe
  C:\Windows\System\yIwdJtk.exe
  2⤵
  PID:9324
- C:\Windows\System\NYtyJAs.exe
  C:\Windows\System\NYtyJAs.exe
  2⤵
  PID:9464
- C:\Windows\System\gYggmTZ.exe
  C:\Windows\System\gYggmTZ.exe
  2⤵
  PID:9520
- C:\Windows\System\mDjUEDv.exe
  C:\Windows\System\mDjUEDv.exe
  2⤵
  PID:9552
- C:\Windows\System\OOnssxO.exe
  C:\Windows\System\OOnssxO.exe
  2⤵
  PID:9600
- C:\Windows\System\iqWtGyM.exe
  C:\Windows\System\iqWtGyM.exe
  2⤵
  PID:9668
- C:\Windows\System\TnBgeOI.exe
  C:\Windows\System\TnBgeOI.exe
  2⤵
  PID:9712
- C:\Windows\System\ipJPmKg.exe
  C:\Windows\System\ipJPmKg.exe
  2⤵
  PID:9768
- C:\Windows\System\bqRLeiE.exe
  C:\Windows\System\bqRLeiE.exe
  2⤵
  PID:9868
- C:\Windows\System\eMuFsUF.exe
  C:\Windows\System\eMuFsUF.exe
  2⤵
  PID:9952
- C:\Windows\System\iqfWfCI.exe
  C:\Windows\System\iqfWfCI.exe
  2⤵
  PID:10020
- C:\Windows\System\WsEKABh.exe
  C:\Windows\System\WsEKABh.exe
  2⤵
  PID:10076
- C:\Windows\System\XlcOZex.exe
  C:\Windows\System\XlcOZex.exe
  2⤵
  PID:10140
- C:\Windows\System\UGuRWuj.exe
  C:\Windows\System\UGuRWuj.exe
  2⤵
  PID:10204
- C:\Windows\System\PGEIUsr.exe
  C:\Windows\System\PGEIUsr.exe
  2⤵
  PID:9352
- C:\Windows\System\EgEGNVL.exe
  C:\Windows\System\EgEGNVL.exe
  2⤵
  PID:9488
- C:\Windows\System\DFiwXaq.exe
  C:\Windows\System\DFiwXaq.exe
  2⤵
  PID:9804
- C:\Windows\System\wxSmqWE.exe
  C:\Windows\System\wxSmqWE.exe
  2⤵
  PID:9912
- C:\Windows\System\LVhUkYX.exe
  C:\Windows\System\LVhUkYX.exe
  2⤵
  PID:9892
- C:\Windows\System\qBVWblx.exe
  C:\Windows\System\qBVWblx.exe
  2⤵
  PID:10048
- C:\Windows\System\aqXcqsP.exe
  C:\Windows\System\aqXcqsP.exe
  2⤵
  PID:10188
- C:\Windows\System\TtyVxTQ.exe
  C:\Windows\System\TtyVxTQ.exe
  2⤵
  PID:9084
- C:\Windows\System\wcpRqfa.exe
  C:\Windows\System\wcpRqfa.exe
  2⤵
  PID:9236
- C:\Windows\System\tTgEpXs.exe
  C:\Windows\System\tTgEpXs.exe
  2⤵
  PID:10128
- C:\Windows\System\JNwELWz.exe
  C:\Windows\System\JNwELWz.exe
  2⤵
  PID:10248
- C:\Windows\System\nRrVgbX.exe
  C:\Windows\System\nRrVgbX.exe
  2⤵
  PID:10268
- C:\Windows\System\seqgsHS.exe
  C:\Windows\System\seqgsHS.exe
  2⤵
  PID:10288
- C:\Windows\System\ISJJzwe.exe
  C:\Windows\System\ISJJzwe.exe
  2⤵
  PID:10316
- C:\Windows\System\kbFHWjI.exe
  C:\Windows\System\kbFHWjI.exe
  2⤵
  PID:10352
- C:\Windows\System\QkjMRuM.exe
  C:\Windows\System\QkjMRuM.exe
  2⤵
  PID:10368
- C:\Windows\System\nEtEeHQ.exe
  C:\Windows\System\nEtEeHQ.exe
  2⤵
  PID:10416
- C:\Windows\System\cGhbJWc.exe
  C:\Windows\System\cGhbJWc.exe
  2⤵
  PID:10436
- C:\Windows\System\MUOlCcU.exe
  C:\Windows\System\MUOlCcU.exe
  2⤵
  PID:10456
- C:\Windows\System\BSTigBY.exe
  C:\Windows\System\BSTigBY.exe
  2⤵
  PID:10492
- C:\Windows\System\kwveijo.exe
  C:\Windows\System\kwveijo.exe
  2⤵
  PID:10508
- C:\Windows\System\ppqAlBe.exe
  C:\Windows\System\ppqAlBe.exe
  2⤵
  PID:10560
- C:\Windows\System\QAXqxNF.exe
  C:\Windows\System\QAXqxNF.exe
  2⤵
  PID:10580
- C:\Windows\System\AilAAxw.exe
  C:\Windows\System\AilAAxw.exe
  2⤵
  PID:10604
- C:\Windows\System\FriHlxN.exe
  C:\Windows\System\FriHlxN.exe
  2⤵
  PID:10628
- C:\Windows\System\ouOWNAW.exe
  C:\Windows\System\ouOWNAW.exe
  2⤵
  PID:10656
- C:\Windows\System\SSqmgAY.exe
  C:\Windows\System\SSqmgAY.exe
  2⤵
  PID:10676
- C:\Windows\System\vyycWJx.exe
  C:\Windows\System\vyycWJx.exe
  2⤵
  PID:10696
- C:\Windows\System\FBsARNL.exe
  C:\Windows\System\FBsARNL.exe
  2⤵
  PID:10728
- C:\Windows\System\LqClqWK.exe
  C:\Windows\System\LqClqWK.exe
  2⤵
  PID:10764
- C:\Windows\System\jBpGZQL.exe
  C:\Windows\System\jBpGZQL.exe
  2⤵
  PID:10788
- C:\Windows\System\gTQJSAk.exe
  C:\Windows\System\gTQJSAk.exe
  2⤵
  PID:10828
- C:\Windows\System\ZTIxakq.exe
  C:\Windows\System\ZTIxakq.exe
  2⤵
  PID:10848
- C:\Windows\System\vFmBdAC.exe
  C:\Windows\System\vFmBdAC.exe
  2⤵
  PID:10884
- C:\Windows\System\xlCYTzY.exe
  C:\Windows\System\xlCYTzY.exe
  2⤵
  PID:10900
- C:\Windows\System\rGywyEH.exe
  C:\Windows\System\rGywyEH.exe
  2⤵
  PID:10952
- C:\Windows\System\LAlZful.exe
  C:\Windows\System\LAlZful.exe
  2⤵
  PID:10968
- C:\Windows\System\QMWHjSj.exe
  C:\Windows\System\QMWHjSj.exe
  2⤵
  PID:10988
- C:\Windows\System\uogMrPU.exe
  C:\Windows\System\uogMrPU.exe
  2⤵
  PID:11012
- C:\Windows\System\bXoXkic.exe
  C:\Windows\System\bXoXkic.exe
  2⤵
  PID:11052
- C:\Windows\System\TQqMxGw.exe
  C:\Windows\System\TQqMxGw.exe
  2⤵
  PID:11092
- C:\Windows\System\ZVsFhta.exe
  C:\Windows\System\ZVsFhta.exe
  2⤵
  PID:11120
- C:\Windows\System\AdeBYEc.exe
  C:\Windows\System\AdeBYEc.exe
  2⤵
  PID:11148
- C:\Windows\System\mEYInvO.exe
  C:\Windows\System\mEYInvO.exe
  2⤵
  PID:11176
- C:\Windows\System\hpfrYtu.exe
  C:\Windows\System\hpfrYtu.exe
  2⤵
  PID:11192
- C:\Windows\System\XrRZqed.exe
  C:\Windows\System\XrRZqed.exe
  2⤵
  PID:11212
- C:\Windows\System\QXsSMDh.exe
  C:\Windows\System\QXsSMDh.exe
  2⤵
  PID:11236
- C:\Windows\System\UbaOkHu.exe
  C:\Windows\System\UbaOkHu.exe
  2⤵
  PID:11256
- C:\Windows\System\PNGAsRF.exe
  C:\Windows\System\PNGAsRF.exe
  2⤵
  PID:10312
- C:\Windows\System\qDXjzHQ.exe
  C:\Windows\System\qDXjzHQ.exe
  2⤵
  PID:10384
- C:\Windows\System\xzCxNdc.exe
  C:\Windows\System\xzCxNdc.exe
  2⤵
  PID:10428
- C:\Windows\System\GFwFKwG.exe
  C:\Windows\System\GFwFKwG.exe
  2⤵
  PID:10484
- C:\Windows\System\loNplbe.exe
  C:\Windows\System\loNplbe.exe
  2⤵
  PID:10524
- C:\Windows\System\cDLqJUV.exe
  C:\Windows\System\cDLqJUV.exe
  2⤵
  PID:10576
- C:\Windows\System\RMcwNpa.exe
  C:\Windows\System\RMcwNpa.exe
  2⤵
  PID:10620
- C:\Windows\System\pQpbIPI.exe
  C:\Windows\System\pQpbIPI.exe
  2⤵
  PID:10704
- C:\Windows\System\lhsThQC.exe
  C:\Windows\System\lhsThQC.exe
  2⤵
  PID:10784
- C:\Windows\System\fnGVXTh.exe
  C:\Windows\System\fnGVXTh.exe
  2⤵
  PID:10856
- C:\Windows\System\cbIjDxu.exe
  C:\Windows\System\cbIjDxu.exe
  2⤵
  PID:10892
- C:\Windows\System\TlUFlyK.exe
  C:\Windows\System\TlUFlyK.exe
  2⤵
  PID:11028
- C:\Windows\System\GdiIBfA.exe
  C:\Windows\System\GdiIBfA.exe
  2⤵
  PID:11008
- C:\Windows\System\mSvXrtc.exe
  C:\Windows\System\mSvXrtc.exe
  2⤵
  PID:11116
- C:\Windows\System\xSJmIoi.exe
  C:\Windows\System\xSJmIoi.exe
  2⤵
  PID:11220
- C:\Windows\System\aBPYfYz.exe
  C:\Windows\System\aBPYfYz.exe
  2⤵
  PID:10296
- C:\Windows\System\nwGIxxK.exe
  C:\Windows\System\nwGIxxK.exe
  2⤵
  PID:10504
- C:\Windows\System\lTEnRhc.exe
  C:\Windows\System\lTEnRhc.exe
  2⤵
  PID:10588
- C:\Windows\System\ciRrnQM.exe
  C:\Windows\System\ciRrnQM.exe
  2⤵
  PID:10716
- C:\Windows\System\QarUVby.exe
  C:\Windows\System\QarUVby.exe
  2⤵
  PID:10868
- C:\Windows\System\yOPGgWr.exe
  C:\Windows\System\yOPGgWr.exe
  2⤵
  PID:4292
- C:\Windows\System\tuQbcfl.exe
  C:\Windows\System\tuQbcfl.exe
  2⤵
  PID:11088
- C:\Windows\System\iVTrSSZ.exe
  C:\Windows\System\iVTrSSZ.exe
  2⤵
  PID:11244
- C:\Windows\System\sIGejyD.exe
  C:\Windows\System\sIGejyD.exe
  2⤵
  PID:10304
- C:\Windows\System\CXeuHLo.exe
  C:\Windows\System\CXeuHLo.exe
  2⤵
  PID:10424
- C:\Windows\System\ZGqIrVc.exe
  C:\Windows\System\ZGqIrVc.exe
  2⤵
  PID:10736
- C:\Windows\System\jRjhAqP.exe
  C:\Windows\System\jRjhAqP.exe
  2⤵
  PID:11004
- C:\Windows\System\TlyDeSU.exe
  C:\Windows\System\TlyDeSU.exe
  2⤵
  PID:11284
- C:\Windows\System\zEOCTvW.exe
  C:\Windows\System\zEOCTvW.exe
  2⤵
  PID:11300
- C:\Windows\System\KupJSYv.exe
  C:\Windows\System\KupJSYv.exe
  2⤵
  PID:11340
- C:\Windows\System\mlPxPvO.exe
  C:\Windows\System\mlPxPvO.exe
  2⤵
  PID:11356
- C:\Windows\System\YYbQRkq.exe
  C:\Windows\System\YYbQRkq.exe
  2⤵
  PID:11448
- C:\Windows\System\AIDPqqI.exe
  C:\Windows\System\AIDPqqI.exe
  2⤵
  PID:11472
- C:\Windows\System\lanMjkl.exe
  C:\Windows\System\lanMjkl.exe
  2⤵
  PID:11520
- C:\Windows\System\hQAEdas.exe
  C:\Windows\System\hQAEdas.exe
  2⤵
  PID:11540
- C:\Windows\System\LxUDzZd.exe
  C:\Windows\System\LxUDzZd.exe
  2⤵
  PID:11584
- C:\Windows\System\jQfVVEB.exe
  C:\Windows\System\jQfVVEB.exe
  2⤵
  PID:11604
- C:\Windows\System\HSuOsQl.exe
  C:\Windows\System\HSuOsQl.exe
  2⤵
  PID:11632
- C:\Windows\System\fCEuKou.exe
  C:\Windows\System\fCEuKou.exe
  2⤵
  PID:11688
- C:\Windows\System\lgGdFsc.exe
  C:\Windows\System\lgGdFsc.exe
  2⤵
  PID:11736
- C:\Windows\System\sYXcqLq.exe
  C:\Windows\System\sYXcqLq.exe
  2⤵
  PID:11764
- C:\Windows\System\AsqSCeb.exe
  C:\Windows\System\AsqSCeb.exe
  2⤵
  PID:11780
- C:\Windows\System\gwPDTDc.exe
  C:\Windows\System\gwPDTDc.exe
  2⤵
  PID:11812
- C:\Windows\System\YEQtHFL.exe
  C:\Windows\System\YEQtHFL.exe
  2⤵
  PID:11828
- C:\Windows\System\tTkfFqc.exe
  C:\Windows\System\tTkfFqc.exe
  2⤵
  PID:11852
- C:\Windows\System\lnzfbvY.exe
  C:\Windows\System\lnzfbvY.exe
  2⤵
  PID:11868
- C:\Windows\System\rpUZGbf.exe
  C:\Windows\System\rpUZGbf.exe
  2⤵
  PID:11892
- C:\Windows\System\DZGEUJO.exe
  C:\Windows\System\DZGEUJO.exe
  2⤵
  PID:11912
- C:\Windows\System\tKWRbzK.exe
  C:\Windows\System\tKWRbzK.exe
  2⤵
  PID:11972
- C:\Windows\System\BOXjXnt.exe
  C:\Windows\System\BOXjXnt.exe
  2⤵
  PID:11992
- C:\Windows\System\oKQOPer.exe
  C:\Windows\System\oKQOPer.exe
  2⤵
  PID:12012
- C:\Windows\System\UWtgIBI.exe
  C:\Windows\System\UWtgIBI.exe
  2⤵
  PID:12036
- C:\Windows\System\IaCbzRU.exe
  C:\Windows\System\IaCbzRU.exe
  2⤵
  PID:12060
- C:\Windows\System\jTZzxzg.exe
  C:\Windows\System\jTZzxzg.exe
  2⤵
  PID:12116
- C:\Windows\System\CkEDonq.exe
  C:\Windows\System\CkEDonq.exe
  2⤵
  PID:12136
- C:\Windows\System\vmiaiOM.exe
  C:\Windows\System\vmiaiOM.exe
  2⤵
  PID:12160
- C:\Windows\System\VaBLUSR.exe
  C:\Windows\System\VaBLUSR.exe
  2⤵
  PID:12200
- C:\Windows\System\bFVMHxy.exe
  C:\Windows\System\bFVMHxy.exe
  2⤵
  PID:12224
- C:\Windows\System\fQCDuEr.exe
  C:\Windows\System\fQCDuEr.exe
  2⤵
  PID:12248
- C:\Windows\System\ChvWuYI.exe
  C:\Windows\System\ChvWuYI.exe
  2⤵
  PID:12280
- C:\Windows\System\tJYZRkv.exe
  C:\Windows\System\tJYZRkv.exe
  2⤵
  PID:11204
- C:\Windows\System\DOKfUtJ.exe
  C:\Windows\System\DOKfUtJ.exe
  2⤵
  PID:10984
- C:\Windows\System\fsoqoHe.exe
  C:\Windows\System\fsoqoHe.exe
  2⤵
  PID:11328
- C:\Windows\System\oMLfhoS.exe
  C:\Windows\System\oMLfhoS.exe
  2⤵
  PID:11392
- C:\Windows\System\varqpKO.exe
  C:\Windows\System\varqpKO.exe
  2⤵
  PID:11528
- C:\Windows\System\nxiEPFv.exe
  C:\Windows\System\nxiEPFv.exe
  2⤵
  PID:11548
- C:\Windows\System\wXCzzEw.exe
  C:\Windows\System\wXCzzEw.exe
  2⤵
  PID:11596
- C:\Windows\System\ZDMssol.exe
  C:\Windows\System\ZDMssol.exe
  2⤵
  PID:11644
- C:\Windows\System\jVMjIeO.exe
  C:\Windows\System\jVMjIeO.exe
  2⤵
  PID:11748
- C:\Windows\System\FtPfAJO.exe
  C:\Windows\System\FtPfAJO.exe
  2⤵
  PID:11792
- C:\Windows\System\PvNDvCU.exe
  C:\Windows\System\PvNDvCU.exe
  2⤵
  PID:11864
- C:\Windows\System\cmVjsft.exe
  C:\Windows\System\cmVjsft.exe
  2⤵
  PID:11932
- C:\Windows\System\FKqWFLa.exe
  C:\Windows\System\FKqWFLa.exe
  2⤵
  PID:12008
- C:\Windows\System\FFFpQum.exe
  C:\Windows\System\FFFpQum.exe
  2⤵
  PID:12132
- C:\Windows\System\mEyVDTR.exe
  C:\Windows\System\mEyVDTR.exe
  2⤵
  PID:12188
- C:\Windows\System\YgVSEdl.exe
  C:\Windows\System\YgVSEdl.exe
  2⤵
  PID:12216
- C:\Windows\System\SNDYNjU.exe
  C:\Windows\System\SNDYNjU.exe
  2⤵
  PID:9796
- C:\Windows\System\dOKinKN.exe
  C:\Windows\System\dOKinKN.exe
  2⤵
  PID:11312
- C:\Windows\System\pSpuQcV.exe
  C:\Windows\System\pSpuQcV.exe
  2⤵
  PID:11536
- C:\Windows\System\yFCkiPL.exe
  C:\Windows\System\yFCkiPL.exe
  2⤵
  PID:11612
- C:\Windows\System\ShIkbmL.exe
  C:\Windows\System\ShIkbmL.exe
  2⤵
  PID:11824
- C:\Windows\System\XaCJZLi.exe
  C:\Windows\System\XaCJZLi.exe
  2⤵
  PID:11840
- C:\Windows\System\CnCzTcv.exe
  C:\Windows\System\CnCzTcv.exe
  2⤵
  PID:12092
- C:\Windows\System\oNBBVMW.exe
  C:\Windows\System\oNBBVMW.exe
  2⤵
  PID:12184
- C:\Windows\System\ekmfImq.exe
  C:\Windows\System\ekmfImq.exe
  2⤵
  PID:12268
- C:\Windows\System\yXHUOSm.exe
  C:\Windows\System\yXHUOSm.exe
  2⤵
  PID:11460
- C:\Windows\System\RDrdApY.exe
  C:\Windows\System\RDrdApY.exe
  2⤵
  PID:4048
- C:\Windows\System\WjLgMLi.exe
  C:\Windows\System\WjLgMLi.exe
  2⤵
  PID:4296
- C:\Windows\System\KImDxnc.exe
  C:\Windows\System\KImDxnc.exe
  2⤵
  PID:11628
- C:\Windows\System\RyyisvB.exe
  C:\Windows\System\RyyisvB.exe
  2⤵
  PID:10616
- C:\Windows\System\mugMfVY.exe
  C:\Windows\System\mugMfVY.exe
  2⤵
  PID:12308
- C:\Windows\System\jAkkaNr.exe
  C:\Windows\System\jAkkaNr.exe
  2⤵
  PID:12336
- C:\Windows\System\HahFiWm.exe
  C:\Windows\System\HahFiWm.exe
  2⤵
  PID:12352
- C:\Windows\System\fdsBzwf.exe
  C:\Windows\System\fdsBzwf.exe
  2⤵
  PID:12368
- C:\Windows\System\OymUBPF.exe
  C:\Windows\System\OymUBPF.exe
  2⤵
  PID:12388
- C:\Windows\System\oUWpMcg.exe
  C:\Windows\System\oUWpMcg.exe
  2⤵
  PID:12428
- C:\Windows\System\kekNDGr.exe
  C:\Windows\System\kekNDGr.exe
  2⤵
  PID:12492
- C:\Windows\System\GgjBxNv.exe
  C:\Windows\System\GgjBxNv.exe
  2⤵
  PID:12512
- C:\Windows\System\npblbSU.exe
  C:\Windows\System\npblbSU.exe
  2⤵
  PID:12536
- C:\Windows\System\kHWUclr.exe
  C:\Windows\System\kHWUclr.exe
  2⤵
  PID:12552
- C:\Windows\System\wRRqPch.exe
  C:\Windows\System\wRRqPch.exe
  2⤵
  PID:12572
- C:\Windows\System\viyzTHn.exe
  C:\Windows\System\viyzTHn.exe
  2⤵
  PID:12596
- C:\Windows\System\xzBhgbB.exe
  C:\Windows\System\xzBhgbB.exe
  2⤵
  PID:12620
- C:\Windows\System\TfyLdlB.exe
  C:\Windows\System\TfyLdlB.exe
  2⤵
  PID:12652
- C:\Windows\System\eMThIOt.exe
  C:\Windows\System\eMThIOt.exe
  2⤵
  PID:12724
- C:\Windows\System\YnwJSHE.exe
  C:\Windows\System\YnwJSHE.exe
  2⤵
  PID:12744
- C:\Windows\System\mMNhQol.exe
  C:\Windows\System\mMNhQol.exe
  2⤵
  PID:12764
- C:\Windows\System\QBNxyev.exe
  C:\Windows\System\QBNxyev.exe
  2⤵
  PID:12788
- C:\Windows\System\mpyonaq.exe
  C:\Windows\System\mpyonaq.exe
  2⤵
  PID:12816
- C:\Windows\System\VmgleEP.exe
  C:\Windows\System\VmgleEP.exe
  2⤵
  PID:12856
- C:\Windows\System\FlGroex.exe
  C:\Windows\System\FlGroex.exe
  2⤵
  PID:12872
- C:\Windows\System\XrndxcM.exe
  C:\Windows\System\XrndxcM.exe
  2⤵
  PID:12900
- C:\Windows\System\joNItys.exe
  C:\Windows\System\joNItys.exe
  2⤵
  PID:12928
- C:\Windows\System\XLWywIp.exe
  C:\Windows\System\XLWywIp.exe
  2⤵
  PID:12944
- C:\Windows\System\JAbtGgW.exe
  C:\Windows\System\JAbtGgW.exe
  2⤵
  PID:12972
- C:\Windows\System\NUhnbLX.exe
  C:\Windows\System\NUhnbLX.exe
  2⤵
  PID:12996
- C:\Windows\System\bQAeWHw.exe
  C:\Windows\System\bQAeWHw.exe
  2⤵
  PID:13064
- C:\Windows\System\gxsMsJj.exe
  C:\Windows\System\gxsMsJj.exe
  2⤵
  PID:13080
- C:\Windows\System\QvgduUz.exe
  C:\Windows\System\QvgduUz.exe
  2⤵
  PID:13116
- C:\Windows\System\zFfXHRT.exe
  C:\Windows\System\zFfXHRT.exe
  2⤵
  PID:13148
- C:\Windows\System\jrfWlyF.exe
  C:\Windows\System\jrfWlyF.exe
  2⤵
  PID:13164
- C:\Windows\System\ulAFobr.exe
  C:\Windows\System\ulAFobr.exe
  2⤵
  PID:13204
- C:\Windows\System\KogegOS.exe
  C:\Windows\System\KogegOS.exe
  2⤵
  PID:13220
- C:\Windows\System\dmqrmlE.exe
  C:\Windows\System\dmqrmlE.exe
  2⤵
  PID:13240
- C:\Windows\System\BRoqVXp.exe
  C:\Windows\System\BRoqVXp.exe
  2⤵
  PID:13280
- C:\Windows\System\ZgnonGw.exe
  C:\Windows\System\ZgnonGw.exe
  2⤵
  PID:13304
- C:\Windows\System\NkdqgTZ.exe
  C:\Windows\System\NkdqgTZ.exe
  2⤵
  PID:12320
- C:\Windows\System\xHHJSYH.exe
  C:\Windows\System\xHHJSYH.exe
  2⤵
  PID:12348
- C:\Windows\System\XiJNqMm.exe
  C:\Windows\System\XiJNqMm.exe
  2⤵
  PID:12420
- C:\Windows\System\ZRnPmRz.exe
  C:\Windows\System\ZRnPmRz.exe
  2⤵
  PID:12500
- C:\Windows\System\dYxHtKg.exe
  C:\Windows\System\dYxHtKg.exe
  2⤵
  PID:12528
- C:\Windows\System\AJbLzwb.exe
  C:\Windows\System\AJbLzwb.exe
  2⤵
  PID:12640
- C:\Windows\System\ySReCfv.exe
  C:\Windows\System\ySReCfv.exe
  2⤵
  PID:12720
- C:\Windows\System\hLzwQGw.exe
  C:\Windows\System\hLzwQGw.exe
  2⤵
  PID:12752
- C:\Windows\System\gCeHqzZ.exe
  C:\Windows\System\gCeHqzZ.exe
  2⤵
  PID:12832
- C:\Windows\System\dlwogtB.exe
  C:\Windows\System\dlwogtB.exe
  2⤵
  PID:12916
- C:\Windows\System\ddpNmen.exe
  C:\Windows\System\ddpNmen.exe
  2⤵
  PID:12960
- C:\Windows\System\RpHiMcY.exe
  C:\Windows\System\RpHiMcY.exe
  2⤵
  PID:12992
- C:\Windows\System\lhqkmAk.exe
  C:\Windows\System\lhqkmAk.exe
  2⤵
  PID:13076
- C:\Windows\System\carWLcC.exe
  C:\Windows\System\carWLcC.exe
  2⤵
  PID:13140
- C:\Windows\System\EOWShqE.exe
  C:\Windows\System\EOWShqE.exe
  2⤵
  PID:13256
- C:\Windows\System\zJBqJoY.exe
  C:\Windows\System\zJBqJoY.exe
  2⤵
  PID:13300
- C:\Windows\System\NtaqdnL.exe
  C:\Windows\System\NtaqdnL.exe
  2⤵
  PID:1484
- C:\Windows\System\SejRouY.exe
  C:\Windows\System\SejRouY.exe
  2⤵
  PID:12484
- C:\Windows\System\tAjzycK.exe
  C:\Windows\System\tAjzycK.exe
  2⤵
  PID:12560
- C:\Windows\System\iWXtUvD.exe
  C:\Windows\System\iWXtUvD.exe
  2⤵
  PID:12800
- C:\Windows\System\FpRZRgW.exe
  C:\Windows\System\FpRZRgW.exe
  2⤵
  PID:12936
- C:\Windows\System\mLKuKWE.exe
  C:\Windows\System\mLKuKWE.exe
  2⤵
  PID:13048
- C:\Windows\System\gakhuNm.exe
  C:\Windows\System\gakhuNm.exe
  2⤵
  PID:13136
- C:\Windows\System\TFmAlyi.exe
  C:\Windows\System\TFmAlyi.exe
  2⤵
  PID:13252
- C:\Windows\System\HTnDiJi.exe
  C:\Windows\System\HTnDiJi.exe
  2⤵
  PID:12524
- C:\Windows\System\JIasZDq.exe
  C:\Windows\System\JIasZDq.exe
  2⤵
  PID:12896
- C:\Windows\System\qgTzwjz.exe
  C:\Windows\System\qgTzwjz.exe
  2⤵
  PID:13320
- C:\Windows\System\HHcqdaR.exe
  C:\Windows\System\HHcqdaR.exe
  2⤵
  PID:13356
- C:\Windows\System\nEDBbGc.exe
  C:\Windows\System\nEDBbGc.exe
  2⤵
  PID:13384
- C:\Windows\System\aGLxSkr.exe
  C:\Windows\System\aGLxSkr.exe
  2⤵
  PID:13440
- C:\Windows\System\QcpurTe.exe
  C:\Windows\System\QcpurTe.exe
  2⤵
  PID:13460
- C:\Windows\System\nPbEUcM.exe
  C:\Windows\System\nPbEUcM.exe
  2⤵
  PID:13484
- C:\Windows\System\yVJZdoL.exe
  C:\Windows\System\yVJZdoL.exe
  2⤵
  PID:13504
- C:\Windows\System\ihrJqzS.exe
  C:\Windows\System\ihrJqzS.exe
  2⤵
  PID:13528
- C:\Windows\System\jXdYGav.exe
  C:\Windows\System\jXdYGav.exe
  2⤵
  PID:13552
- C:\Windows\System\JZRleQo.exe
  C:\Windows\System\JZRleQo.exe
  2⤵
  PID:13584
- C:\Windows\System\yCIUUdg.exe
  C:\Windows\System\yCIUUdg.exe
  2⤵
  PID:13604
- C:\Windows\System\NgUxxqw.exe
  C:\Windows\System\NgUxxqw.exe
  2⤵
  PID:13632
- C:\Windows\System\FbJkIPK.exe
  C:\Windows\System\FbJkIPK.exe
  2⤵
  PID:13664
- C:\Windows\System\nEmcMXC.exe
  C:\Windows\System\nEmcMXC.exe
  2⤵
  PID:13716
- C:\Windows\System\mzXYwnz.exe
  C:\Windows\System\mzXYwnz.exe
  2⤵
  PID:13744
- C:\Windows\System\LyIopsV.exe
  C:\Windows\System\LyIopsV.exe
  2⤵
  PID:13768
- C:\Windows\System\nnItYyW.exe
  C:\Windows\System\nnItYyW.exe
  2⤵
  PID:13792
- C:\Windows\System\uLNpliZ.exe
  C:\Windows\System\uLNpliZ.exe
  2⤵
  PID:13812
- C:\Windows\System\ioqNBct.exe
  C:\Windows\System\ioqNBct.exe
  2⤵
  PID:13828
- C:\Windows\System\UkfpSgB.exe
  C:\Windows\System\UkfpSgB.exe
  2⤵
  PID:13856
- C:\Windows\System\VUiSMwU.exe
  C:\Windows\System\VUiSMwU.exe
  2⤵
  PID:13884
- C:\Windows\System\pMOWGud.exe
  C:\Windows\System\pMOWGud.exe
  2⤵
  PID:13916
- C:\Windows\System\PHJBcCm.exe
  C:\Windows\System\PHJBcCm.exe
  2⤵
  PID:13944
- C:\Windows\System\TSpANhy.exe
  C:\Windows\System\TSpANhy.exe
  2⤵
  PID:13972
- C:\Windows\System\FdbvtuE.exe
  C:\Windows\System\FdbvtuE.exe
  2⤵
  PID:14016
- C:\Windows\System\fJAzxYw.exe
  C:\Windows\System\fJAzxYw.exe
  2⤵
  PID:14052
- C:\Windows\System\mqJKocx.exe
  C:\Windows\System\mqJKocx.exe
  2⤵
  PID:14092
- C:\Windows\System\dSVBrBc.exe
  C:\Windows\System\dSVBrBc.exe
  2⤵
  PID:14116
- C:\Windows\System\nuJrcHQ.exe
  C:\Windows\System\nuJrcHQ.exe
  2⤵
  PID:14144
- C:\Windows\System\IpjMbjk.exe
  C:\Windows\System\IpjMbjk.exe
  2⤵
  PID:14176
- C:\Windows\System\qAsfEOi.exe
  C:\Windows\System\qAsfEOi.exe
  2⤵
  PID:14212
- C:\Windows\System\diNBbCD.exe
  C:\Windows\System\diNBbCD.exe
  2⤵
  PID:14232
- C:\Windows\System\IiysPzX.exe
  C:\Windows\System\IiysPzX.exe
  2⤵
  PID:14264
- C:\Windows\System\aGdfkwr.exe
  C:\Windows\System\aGdfkwr.exe
  2⤵
  PID:14292
- C:\Windows\System\boZMAmw.exe
  C:\Windows\System\boZMAmw.exe
  2⤵
  PID:14312
- C:\Windows\System\kgxEvXN.exe
  C:\Windows\System\kgxEvXN.exe
  2⤵
  PID:13132
- C:\Windows\System\XOxHQHX.exe
  C:\Windows\System\XOxHQHX.exe
  2⤵
  PID:12328
- C:\Windows\System\LVVlLrU.exe
  C:\Windows\System\LVVlLrU.exe
  2⤵
  PID:13332
- C:\Windows\System\mSamScK.exe
  C:\Windows\System\mSamScK.exe
  2⤵
  PID:13372
- C:\Windows\System\vydBair.exe
  C:\Windows\System\vydBair.exe
  2⤵
  PID:13476
- C:\Windows\System\NYOqJqD.exe
  C:\Windows\System\NYOqJqD.exe
  2⤵
  PID:13576
- C:\Windows\System\MZKHgbH.exe
  C:\Windows\System\MZKHgbH.exe
  2⤵
  PID:13684
- C:\Windows\System\mVhAiCE.exe
  C:\Windows\System\mVhAiCE.exe
  2⤵
  PID:13704
- C:\Windows\System\mIfSzKL.exe
  C:\Windows\System\mIfSzKL.exe
  2⤵
  PID:13780
- C:\Windows\System\CswgjPU.exe
  C:\Windows\System\CswgjPU.exe
  2⤵
  PID:13808
- C:\Windows\System\MOXFFFI.exe
  C:\Windows\System\MOXFFFI.exe
  2⤵
  PID:13864
- C:\Windows\System\hnPtCZn.exe
  C:\Windows\System\hnPtCZn.exe
  2⤵
  PID:13912
- C:\Windows\System\PtlTjeO.exe
  C:\Windows\System\PtlTjeO.exe
  2⤵
  PID:13988
- C:\Windows\System\AzgvEqE.exe
  C:\Windows\System\AzgvEqE.exe
  2⤵
  PID:14004
- C:\Windows\System\RBKZvBt.exe
  C:\Windows\System\RBKZvBt.exe
  2⤵
  PID:14036
- C:\Windows\System\dXYElzi.exe
  C:\Windows\System\dXYElzi.exe
  2⤵
  PID:14132
- C:\Windows\System\vzBeDBt.exe
  C:\Windows\System\vzBeDBt.exe
  2⤵
  PID:14284
- C:\Windows\System\krXJIIM.exe
  C:\Windows\System\krXJIIM.exe
  2⤵
  PID:14332
- C:\Windows\System\AexVfKR.exe
  C:\Windows\System\AexVfKR.exe
  2⤵
  PID:13468
- C:\Windows\System\wKLiHsq.exe
  C:\Windows\System\wKLiHsq.exe
  2⤵
  PID:13804
- C:\Windows\System\bbThijk.exe
  C:\Windows\System\bbThijk.exe
  2⤵
  PID:13924
- C:\Windows\System\KuZKuSX.exe
  C:\Windows\System\KuZKuSX.exe
  2⤵
  PID:14024
- C:\Windows\System\LCVTKOJ.exe
  C:\Windows\System\LCVTKOJ.exe
  2⤵
  PID:14244
- C:\Windows\System\lTFFnhR.exe
  C:\Windows\System\lTFFnhR.exe
  2⤵
  PID:13404
- C:\Windows\System\kgMqwIs.exe
  C:\Windows\System\kgMqwIs.exe
  2⤵
  PID:14228
- C:\Windows\System\OdHAgHq.exe
  C:\Windows\System\OdHAgHq.exe
  2⤵
  PID:13960
- C:\Windows\System\HXlPWrE.exe
  C:\Windows\System\HXlPWrE.exe
  2⤵
  PID:14088
- C:\Windows\System\paDVFhS.exe
  C:\Windows\System\paDVFhS.exe
  2⤵
  PID:13496
- C:\Windows\System\iMPhMeO.exe
  C:\Windows\System\iMPhMeO.exe
  2⤵
  PID:14372
- C:\Windows\System\gyAztJE.exe
  C:\Windows\System\gyAztJE.exe
  2⤵
  PID:14396
- C:\Windows\System\BoorpNp.exe
  C:\Windows\System\BoorpNp.exe
  2⤵
  PID:14436
- C:\Windows\System\wOZbRqB.exe
  C:\Windows\System\wOZbRqB.exe
  2⤵
  PID:14452
- C:\Windows\System\XumKoMa.exe
  C:\Windows\System\XumKoMa.exe
  2⤵
  PID:14472
- C:\Windows\System\acYRgLi.exe
  C:\Windows\System\acYRgLi.exe
  2⤵
  PID:14492
- C:\Windows\System\GLPzjmg.exe
  C:\Windows\System\GLPzjmg.exe
  2⤵
  PID:14520
- C:\Windows\System\pjQHZFv.exe
  C:\Windows\System\pjQHZFv.exe
  2⤵
  PID:14560
- C:\Windows\System\MPyFIVx.exe
  C:\Windows\System\MPyFIVx.exe
  2⤵
  PID:14588
- C:\Windows\System\dvvZBqS.exe
  C:\Windows\System\dvvZBqS.exe
  2⤵
  PID:14608
- C:\Windows\System\wABSpKO.exe
  C:\Windows\System\wABSpKO.exe
  2⤵
  PID:14640
- C:\Windows\System\WnwEFSk.exe
  C:\Windows\System\WnwEFSk.exe
  2⤵
  PID:14664
- C:\Windows\System\cnlJkDX.exe
  C:\Windows\System\cnlJkDX.exe
  2⤵
  PID:14680
- C:\Windows\System\glPoJQH.exe
  C:\Windows\System\glPoJQH.exe
  2⤵
  PID:14700
- C:\Windows\System\utCFhkn.exe
  C:\Windows\System\utCFhkn.exe
  2⤵
  PID:14772
- C:\Windows\System\eBgjJLq.exe
  C:\Windows\System\eBgjJLq.exe
  2⤵
  PID:14800
- C:\Windows\System\fCspjme.exe
  C:\Windows\System\fCspjme.exe
  2⤵
  PID:14820
- C:\Windows\System\YIhZhrp.exe
  C:\Windows\System\YIhZhrp.exe
  2⤵
  PID:14840
- C:\Windows\System\dbczUMb.exe
  C:\Windows\System\dbczUMb.exe
  2⤵
  PID:14860
- C:\Windows\System\WIViRPa.exe
  C:\Windows\System\WIViRPa.exe
  2⤵
  PID:14892
- C:\Windows\System\iuFMrCq.exe
  C:\Windows\System\iuFMrCq.exe
  2⤵
  PID:14928
- C:\Windows\System\NzsWRZO.exe
  C:\Windows\System\NzsWRZO.exe
  2⤵
  PID:14956
- C:\Windows\System\ctjnHot.exe
  C:\Windows\System\ctjnHot.exe
  2⤵
  PID:14972
- C:\Windows\System\jPAadrc.exe
  C:\Windows\System\jPAadrc.exe
  2⤵
  PID:15016
- C:\Windows\System\lmxgoKF.exe
  C:\Windows\System\lmxgoKF.exe
  2⤵
  PID:15036
- C:\Windows\System\uMiiNLC.exe
  C:\Windows\System\uMiiNLC.exe
  2⤵
  PID:15064
- C:\Windows\System\oIzqsbI.exe
  C:\Windows\System\oIzqsbI.exe
  2⤵
  PID:15084
- C:\Windows\System\ddxApvE.exe
  C:\Windows\System\ddxApvE.exe
  2⤵
  PID:15108
- C:\Windows\System\tWIfDDQ.exe
  C:\Windows\System\tWIfDDQ.exe
  2⤵
  PID:15132
- C:\Windows\System\AafVqqA.exe
  C:\Windows\System\AafVqqA.exe
  2⤵
  PID:15180
- C:\Windows\System\kofPoOj.exe
  C:\Windows\System\kofPoOj.exe
  2⤵
  PID:15208
- C:\Windows\System\HIIgkZD.exe
  C:\Windows\System\HIIgkZD.exe
  2⤵
  PID:15252
- C:\Windows\System\gHNWaSf.exe
  C:\Windows\System\gHNWaSf.exe
  2⤵
  PID:15280
- C:\Windows\System\pMJOOVy.exe
  C:\Windows\System\pMJOOVy.exe
  2⤵
  PID:15300
- C:\Windows\System\YvEPncs.exe
  C:\Windows\System\YvEPncs.exe
  2⤵
  PID:15324
- C:\Windows\System\xEXuMxj.exe
  C:\Windows\System\xEXuMxj.exe
  2⤵
  PID:15348
- C:\Windows\System\FCggSNR.exe
  C:\Windows\System\FCggSNR.exe
  2⤵
  PID:13660
- C:\Windows\System\qAxTHvl.exe
  C:\Windows\System\qAxTHvl.exe
  2⤵
  PID:14368
- C:\Windows\System\sAqSgpj.exe
  C:\Windows\System\sAqSgpj.exe
  2⤵
  PID:14424
- C:\Windows\System\XnvBJOR.exe
  C:\Windows\System\XnvBJOR.exe
  2⤵
  PID:14572
- C:\Windows\System\SixipPU.exe
  C:\Windows\System\SixipPU.exe
  2⤵
  PID:14620
- C:\Windows\System\LpAslFv.exe
  C:\Windows\System\LpAslFv.exe
  2⤵
  PID:14648
- C:\Windows\System\diPZypm.exe
  C:\Windows\System\diPZypm.exe
  2⤵
  PID:14724
- C:\Windows\System\VDwfWFI.exe
  C:\Windows\System\VDwfWFI.exe
  2⤵
  PID:14836
- C:\Windows\System\rfXAcbZ.exe
  C:\Windows\System\rfXAcbZ.exe
  2⤵
  PID:14876
- C:\Windows\System\TqZavqc.exe
  C:\Windows\System\TqZavqc.exe
  2⤵
  PID:14920
- C:\Windows\System\vZjqvgL.exe
  C:\Windows\System\vZjqvgL.exe
  2⤵
  PID:14944
- C:\Windows\System\cflYcUU.exe
  C:\Windows\System\cflYcUU.exe
  2⤵
  PID:15032
- C:\Windows\System\ulMLxqz.exe
  C:\Windows\System\ulMLxqz.exe
  2⤵
  PID:15120
- C:\Windows\System\ycrZXzC.exe
  C:\Windows\System\ycrZXzC.exe
  2⤵
  PID:15172
- C:\Windows\System\LFUSBge.exe
  C:\Windows\System\LFUSBge.exe
  2⤵
  PID:15248
- C:\Windows\System\SSEPCVJ.exe
  C:\Windows\System\SSEPCVJ.exe
  2⤵
  PID:15296
- C:\Windows\System\xSztZpn.exe
  C:\Windows\System\xSztZpn.exe
  2⤵
  PID:11280
- C:\Windows\System\spWeaAA.exe
  C:\Windows\System\spWeaAA.exe
  2⤵
  PID:14468
- C:\Windows\System\BKgDLpY.exe
  C:\Windows\System\BKgDLpY.exe
  2⤵
  PID:14600
- C:\Windows\System\riwROkI.exe
  C:\Windows\System\riwROkI.exe
  2⤵
  PID:14736
- C:\Windows\System\yZIaqml.exe
  C:\Windows\System\yZIaqml.exe
  2⤵
  PID:14812
- C:\Windows\System\rjgAjly.exe
  C:\Windows\System\rjgAjly.exe
  2⤵
  PID:15024
- C:\Windows\System\EnarTEH.exe
  C:\Windows\System\EnarTEH.exe
  2⤵
  PID:14888
- C:\Windows\System\uWtefWl.exe
  C:\Windows\System\uWtefWl.exe
  2⤵
  PID:15220
- C:\Windows\System\YDOWADL.exe
  C:\Windows\System\YDOWADL.exe
  2⤵
  PID:15308
- C:\Windows\System\qAZihHK.exe
  C:\Windows\System\qAZihHK.exe
  2⤵
  PID:14716
- C:\Windows\System\yPcrHwU.exe
  C:\Windows\System\yPcrHwU.exe
  2⤵
  PID:15268
- C:\Windows\System\hnsmauk.exe
  C:\Windows\System\hnsmauk.exe
  2⤵
  PID:15372
- C:\Windows\System\DOjonzm.exe
  C:\Windows\System\DOjonzm.exe
  2⤵
  PID:15416
- C:\Windows\System\uEVrOXi.exe
  C:\Windows\System\uEVrOXi.exe
  2⤵
  PID:15444
- C:\Windows\System\JpuGQuG.exe
  C:\Windows\System\JpuGQuG.exe
  2⤵
  PID:15464
- C:\Windows\System\XhEeOMu.exe
  C:\Windows\System\XhEeOMu.exe
  2⤵
  PID:15504
- C:\Windows\System\EBxaXxf.exe
  C:\Windows\System\EBxaXxf.exe
  2⤵
  PID:15552
- C:\Windows\System\mfNVAGO.exe
  C:\Windows\System\mfNVAGO.exe
  2⤵
  PID:15580
- C:\Windows\System\cxCiHEp.exe
  C:\Windows\System\cxCiHEp.exe
  2⤵
  PID:15600
- C:\Windows\System\zXjwifq.exe
  C:\Windows\System\zXjwifq.exe
  2⤵
  PID:15624
- C:\Windows\System\ElXkcNn.exe
  C:\Windows\System\ElXkcNn.exe
  2⤵
  PID:15648
- C:\Windows\System\fxhnVPf.exe
  C:\Windows\System\fxhnVPf.exe
  2⤵
  PID:15676
- C:\Windows\System\NnflQPc.exe
  C:\Windows\System\NnflQPc.exe
  2⤵
  PID:15696
- C:\Windows\System\QKBVAuk.exe
  C:\Windows\System\QKBVAuk.exe
  2⤵
  PID:15724
- C:\Windows\System\nlnlISA.exe
  C:\Windows\System\nlnlISA.exe
  2⤵
  PID:15752
- C:\Windows\System\UbfmIoA.exe
  C:\Windows\System\UbfmIoA.exe
  2⤵
  PID:15776
- C:\Windows\System\MVbVQhD.exe
  C:\Windows\System\MVbVQhD.exe
  2⤵
  PID:15816
- C:\Windows\System\ZbxRjsM.exe
  C:\Windows\System\ZbxRjsM.exe
  2⤵
  PID:15840
- C:\Windows\System\pyqlQnX.exe
  C:\Windows\System\pyqlQnX.exe
  2⤵
  PID:15860
- C:\Windows\System\HsSlbQa.exe
  C:\Windows\System\HsSlbQa.exe
  2⤵
  PID:15900
- C:\Windows\System\aAQSiBI.exe
  C:\Windows\System\aAQSiBI.exe
  2⤵
  PID:15920
- C:\Windows\System\ghmRMMH.exe
  C:\Windows\System\ghmRMMH.exe
  2⤵
  PID:15972
- C:\Windows\System\gGvDlho.exe
  C:\Windows\System\gGvDlho.exe
  2⤵
  PID:15988
- C:\Windows\System\hnNIFkl.exe
  C:\Windows\System\hnNIFkl.exe
  2⤵
  PID:16016
- C:\Windows\System\CohnlDs.exe
  C:\Windows\System\CohnlDs.exe
  2⤵
  PID:16048
- C:\Windows\System\zGUjasp.exe
  C:\Windows\System\zGUjasp.exe
  2⤵
  PID:16068
- C:\Windows\System\wiAuGZj.exe
  C:\Windows\System\wiAuGZj.exe
  2⤵
  PID:16092
- C:\Windows\System\XeEgbMn.exe
  C:\Windows\System\XeEgbMn.exe
  2⤵
  PID:16120
- C:\Windows\System\yDZCLUs.exe
  C:\Windows\System\yDZCLUs.exe
  2⤵
  PID:16156
- C:\Windows\System\IgvNBRf.exe
  C:\Windows\System\IgvNBRf.exe
  2⤵
  PID:16184
- C:\Windows\System\PIgFmrG.exe
  C:\Windows\System\PIgFmrG.exe
  2⤵
  PID:16200
- C:\Windows\System\WpcNaDc.exe
  C:\Windows\System\WpcNaDc.exe
  2⤵
  PID:16216
- C:\Windows\System\zdaiCVw.exe
  C:\Windows\System\zdaiCVw.exe
  2⤵
  PID:16232
- C:\Windows\System\PTpKWgm.exe
  C:\Windows\System\PTpKWgm.exe
  2⤵
  PID:16252
- C:\Windows\System\QMIPgEn.exe
  C:\Windows\System\QMIPgEn.exe
  2⤵
  PID:16292
- C:\Windows\System\ktQfWHw.exe
  C:\Windows\System\ktQfWHw.exe
  2⤵
  PID:16324
- C:\Windows\System\GadFuSc.exe
  C:\Windows\System\GadFuSc.exe
  2⤵
  PID:16372
- C:\Windows\System\oFovfHC.exe
  C:\Windows\System\oFovfHC.exe
  2⤵
  PID:14676
- C:\Windows\System\BKXEJkc.exe
  C:\Windows\System\BKXEJkc.exe
  2⤵
  PID:15364
- C:\Windows\System\yWLoodk.exe
  C:\Windows\System\yWLoodk.exe
  2⤵
  PID:15412
- C:\Windows\System\gqISnDr.exe
  C:\Windows\System\gqISnDr.exe
  2⤵
  PID:15484
- C:\Windows\System\eHBYltS.exe
  C:\Windows\System\eHBYltS.exe
  2⤵
  PID:15608
- C:\Windows\System\afPlvnw.exe
  C:\Windows\System\afPlvnw.exe
  2⤵
  PID:15688
- C:\Windows\System\MRKhuxl.exe
  C:\Windows\System\MRKhuxl.exe
  2⤵
  PID:15712
- C:\Windows\System\ePOJyYu.exe
  C:\Windows\System\ePOJyYu.exe
  2⤵
  PID:15764
- C:\Windows\System\FigTdKo.exe
  C:\Windows\System\FigTdKo.exe
  2⤵
  PID:15892
- C:\Windows\System\DArOnql.exe
  C:\Windows\System\DArOnql.exe
  2⤵
  PID:15968
- C:\Windows\System\qxcHeXR.exe
  C:\Windows\System\qxcHeXR.exe
  2⤵
  PID:16000
- C:\Windows\System\YuIabLQ.exe
  C:\Windows\System\YuIabLQ.exe
  2⤵
  PID:16060
- C:\Windows\System\PNSKOjH.exe
  C:\Windows\System\PNSKOjH.exe
  2⤵
  PID:16116
- C:\Windows\System\jalFSgI.exe
  C:\Windows\System\jalFSgI.exe
  2⤵
  PID:16168
- C:\Windows\System\LDyindm.exe
  C:\Windows\System\LDyindm.exe
  2⤵
  PID:16224
- C:\Windows\System\qPscmCQ.exe
  C:\Windows\System\qPscmCQ.exe
  2⤵
  PID:16240
- C:\Windows\System\MWKrHNc.exe
  C:\Windows\System\MWKrHNc.exe
  2⤵
  PID:16380
- C:\Windows\System\iHhQcmm.exe
  C:\Windows\System\iHhQcmm.exe
  2⤵
  PID:15436
- C:\Windows\System\ZXoscXM.exe
  C:\Windows\System\ZXoscXM.exe
  2⤵
  PID:15644
- C:\Windows\System\MwcCzIx.exe
  C:\Windows\System\MwcCzIx.exe
  2⤵
  PID:15768
- C:\Windows\System\AwisGWQ.exe
  C:\Windows\System\AwisGWQ.exe
  2⤵
  PID:15916
- C:\Windows\System\ZgwEqhR.exe
  C:\Windows\System\ZgwEqhR.exe
  2⤵
  PID:16056
- C:\Windows\System\yGvKFFg.exe
  C:\Windows\System\yGvKFFg.exe
  2⤵
  PID:16152
- C:\Windows\System\DIJokVF.exe
  C:\Windows\System\DIJokVF.exe
  2⤵
  PID:16308
- C:\Windows\System\cGWtfxA.exe
  C:\Windows\System\cGWtfxA.exe
  2⤵
  PID:15524
- C:\Windows\System\AlsKMjg.exe
  C:\Windows\System\AlsKMjg.exe
  2⤵
  PID:15432
- C:\Windows\System\fhlFVKy.exe
  C:\Windows\System\fhlFVKy.exe
  2⤵
  PID:16244
- C:\Windows\System\VSgSCSz.exe
  C:\Windows\System\VSgSCSz.exe
  2⤵
  PID:16336
- C:\Windows\System\RPEjEvZ.exe
  C:\Windows\System\RPEjEvZ.exe
  2⤵
  PID:16400
- C:\Windows\System\ZIZkVXa.exe
  C:\Windows\System\ZIZkVXa.exe
  2⤵
  PID:16432
- C:\Windows\System\LriuhVn.exe
  C:\Windows\System\LriuhVn.exe
  2⤵
  PID:16448
- C:\Windows\System\KMufexj.exe
  C:\Windows\System\KMufexj.exe
  2⤵
  PID:16484
- C:\Windows\System\WVqYfpL.exe
  C:\Windows\System\WVqYfpL.exe
  2⤵
  PID:16504
- C:\Windows\System\cOUuzHC.exe
  C:\Windows\System\cOUuzHC.exe
  2⤵
  PID:16532
- C:\Windows\System\bsrTbPi.exe
  C:\Windows\System\bsrTbPi.exe
  2⤵
  PID:16556
- C:\Windows\System\GiSMYaJ.exe
  C:\Windows\System\GiSMYaJ.exe
  2⤵
  PID:16576
- C:\Windows\System\IvXUJei.exe
  C:\Windows\System\IvXUJei.exe
  2⤵
  PID:16604
- C:\Windows\System\VICkoAO.exe
  C:\Windows\System\VICkoAO.exe
  2⤵
  PID:16636
- C:\Windows\System\LSjwLNq.exe
  C:\Windows\System\LSjwLNq.exe
  2⤵
  PID:16660
- C:\Windows\System\HfzWHmW.exe
  C:\Windows\System\HfzWHmW.exe
  2⤵
  PID:16680
- C:\Windows\System\iJFVbVk.exe
  C:\Windows\System\iJFVbVk.exe
  2⤵
  PID:16716
- C:\Windows\System\cphNhsD.exe
  C:\Windows\System\cphNhsD.exe
  2⤵
  PID:16744
- C:\Windows\System\hfhtHGx.exe
  C:\Windows\System\hfhtHGx.exe
  2⤵
  PID:16780
- C:\Windows\System\VnfRMXl.exe
  C:\Windows\System\VnfRMXl.exe
  2⤵
  PID:16808
- C:\Windows\System\PyTnGVo.exe
  C:\Windows\System\PyTnGVo.exe
  2⤵
  PID:16836
- C:\Windows\System\srWeZzc.exe
  C:\Windows\System\srWeZzc.exe
  2⤵
  PID:16868
- C:\Windows\System\euTUldW.exe
  C:\Windows\System\euTUldW.exe
  2⤵
  PID:16920
- C:\Windows\System\narTqwy.exe
  C:\Windows\System\narTqwy.exe
  2⤵
  PID:16936
- C:\Windows\System\LjCCbkB.exe
  C:\Windows\System\LjCCbkB.exe
  2⤵
  PID:16964
- C:\Windows\System\FvpYRwI.exe
  C:\Windows\System\FvpYRwI.exe
  2⤵
  PID:17016

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:17340

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\BaElblW.exe

Filesize
1.1MB

MD5
13e9ed8b923666182e596a7cd31d78b8

SHA1
f9a0e032e85792424a0f5be6d0b1fb8e8d46e8be

SHA256
b131b187536b28551f217e6585726e5d62e2d9aef3e33a3d8544ec9311f076d3

SHA512
8ab95c948c65a83ed62a8d26447be8a679b7bd382329eeff13abfe99210f97ba5a7ff994ad17585120fce12c516b3e0b97af7e856ab97802530a203c8b1bf832

Download Submit
C:\Windows\System\DZbiWQA.exe

Filesize
1.1MB

MD5
a41c95411b04abae0ba994ddf362596f

SHA1
8015ba9aa79f2541fc827ad97dc7586772913f79

SHA256
810ebc1744232c7a6b4957fd3e69ea215842358145ee866b676e6147705c32ac

SHA512
6143af3e8aaf5fa3a39c1339254ddf8f27f1eb72b9eb89b3cc3aaa08d2e22d95a60690fcada82bc044d6c4fac3719f2a73301b9b54eca54adeb64d4d79aca235

Download Submit
C:\Windows\System\FrSBblb.exe

Filesize
1.1MB

MD5
1cbf4e303c66b7b417ed700563f1cc38

SHA1
5562ec2630b9ab3f76741c3183790c8998e9aadd

SHA256
0d878f0e61ed3fcb56aef3d325228c15cf0e96054eb131eb0b4b4e8651a0b71c

SHA512
e57cddb55e80df808a55d201e0cfdb073be5178dcdc5d36c44adf3947f49613e8e8bdf54ec38e78964f0d5ea953216d56f3f8ce208c2ed801346205b8e4414d7

Download Submit
C:\Windows\System\GKVxnqd.exe

Filesize
1.1MB

MD5
c1655c9ef2311bb93c33e805a26ddb05

SHA1
60992e2c15e0f4b31b9fad54a4aca4f4c5855e6f

SHA256
4d0be9d0795074c2473818ab97398d7e3832124b30741239056f9bf7a384f856

SHA512
998f9ee6f353940ed1b53e35db6cfeee9e52a4749464216936210a1dae075528dd5580e2fa6fa77ecf8c5cda3cd101391837cbb2750a4aa55c32dc8111034398

Download Submit
C:\Windows\System\GMIXKMc.exe

Filesize
1.1MB

MD5
c7a66fad3d61915472ed4dba94ce343d

SHA1
857d9170e85943351926895c07aebf6abf52dfb9

SHA256
2bdbf61a10bbcf0ac35b219a76187382e91d2ade11576e4302563dff36cb2b1b

SHA512
5d5be979f28be55f5e03c7692c6153d487ac9520c98dc27ef9db7026352b3ced69aefbc795c809ced194480d982184a459e7cd0737865d4681d7025562fb66c6

Download Submit
C:\Windows\System\IMvVWDM.exe

Filesize
1.1MB

MD5
b12127bafa59638c100739e8c6710b1b

SHA1
524b3b8bcd4e2f5544bf5cc2a76d387517599076

SHA256
c96d2c24391f21de39014b6839acba3376bf4b9e99c0364fa8e96fda7070b923

SHA512
9c489c4a2d18a4ccfbfd87a89fbdd318397147ddf49a93aa7293f0261a9edfbff68191dabbc11c01a2a3660148e4783aee4b0f7c52824b5d59cc12092743d732

Download Submit
C:\Windows\System\IShRNVW.exe

Filesize
1.1MB

MD5
1be51d4fdd34965c82ec8ef6663f90d2

SHA1
b18536f6db0bf339d9d11747663976198fa90153

SHA256
371b1afca5d09d633d62b3138ce95a3196f667574e451d30b593bc10dcf29e55

SHA512
deb11af28f01c9b8ab41ef7dbeab2ef690611d1d0ecaa8f61f5bc7e1d76841cb0bfc3901f73464ff400468cbbca70b84dbac7ece5b220659e74c83e91ee91d2f

Download Submit
C:\Windows\System\InUYhKc.exe

Filesize
1.1MB

MD5
741ba38305bf08d45d1528c0b3d4cff5

SHA1
c7d408a9b01d79a0c22197eb8c58de0a3ed65f17

SHA256
dd3034cc4520fb1cc211cd4b1c1502b2755657cee8d33c39503503e4f7f68c7a

SHA512
439bafed4bfa83f7f149707334e979c03b41ced1eb69ad16b3ba02f417a33752af682ba685350c5686129e908e782c2631f252ee68d02f17fc654bc57360f530

Download Submit
C:\Windows\System\KXfIJwz.exe

Filesize
1.1MB

MD5
bdbd9c251ddbf3b57cf983a623016402

SHA1
64f48b63eeb04ce32112028605858e2c79c7534f

SHA256
d35a0fd10eb52602ea2b58f5beb43b9854783e6e391fe846b90ce700803256e4

SHA512
535bd77f417285d736849fac87170eb1b391f6bf23f6c0e4b8fac187adddf0bc93f5a6e66c005a031f4fd973a166c42feb0422971266a91655033259630aa65e

Download Submit
C:\Windows\System\LOGgzst.exe

Filesize
1.1MB

MD5
e5956afe24f8f1e85031ee73309d2d5d

SHA1
19197d4806abda98fd3d91e6ac2df4ad2fa3d238

SHA256
b8f4fa6231cc7e1e3b328b969f6fb97560c2ba72d0181b9942f5ea7333a167e7

SHA512
25381ec679b8716ac787e78569d297c81605247d5334a7647a15ca166a191d3b168fe8736c97c33f243188bc1526fd84a81b61665bf0c6e818167280e95faceb

Download Submit
C:\Windows\System\MeeHlFZ.exe

Filesize
1.1MB

MD5
1e858b22395b861eae9bb1bb602b4474

SHA1
19fed5d1b3cbfc77086343b74c5702f913faaa4d

SHA256
6ca97edf53b6e4bd38168e2bfd8bafb88eda6515e6bf79b86c69ac08e427104c

SHA512
960e62af15f220700995e5cbf82d76fe074d8ec3855afb81d26f9315edd6363144056066be3489283be9bf29c8378fa32c844c133a13ca79c26fad507d685f67

Download Submit
C:\Windows\System\PTFugDT.exe

Filesize
1.1MB

MD5
bc519779eee2f66f36dbcce26d81ef54

SHA1
0d6f8e4e5ac956700aa442c361f7967623e81bba

SHA256
9d2fb66cada02f7c080aa1d8e06e729ba2eec8c5bf31a0a59c0fbd0d1fdabc5f

SHA512
e12fb78852c2c69d26ec97e3ddfc0d29e8a7c6f776fd3034d1e334a976b7f66a33b830a35dfc3f7c31477608b3b3339134e3e1273512cd135d715a0b155a051c

Download Submit
C:\Windows\System\SHokuSC.exe

Filesize
1.1MB

MD5
8015b64312ff0da993c3aebd80eb31d8

SHA1
a3885893aebf6d9635b436f37cafc490e4b54db3

SHA256
45e7309cb52a69ac07f22b30bfb86c4397a18c779a132d84582d84496eb7b267

SHA512
f13765f4f32f2eb385a30690732fe4dbdaf81843f1c12651b61d6a0e384ed523263bae10bc65d276376ceb32f7c4e41cb5101ac1f7403bdcfec86c594edade38

Download Submit
C:\Windows\System\UHKcxxX.exe

Filesize
1.1MB

MD5
3c1c375ff353d62deb49970ad4c955af

SHA1
0a54fe25b76aebd43f4fb11ed78253e8a333a9b5

SHA256
e88ea96387dca50e317c146fba45bace06ecac3e4c89c15d027a5a2bf4bd5afc

SHA512
c3f57b10e02e0f8edd9b624df23696cd978a6d389d61bd900439a0c37fc9aa06e7c3e25ac752c7be89e395baa6ddbef1bd761f48d3eaef5e911109e1ff259ede

Download Submit
C:\Windows\System\WIGnlpA.exe

Filesize
1.1MB

MD5
10bb7dff4083f7651afd1847cc1659fd

SHA1
b15b7013df8f50e0469ca27f1646040919d51bea

SHA256
ea2a8b9e1419022f91c75e81a085951b6828d7624abaf44b5c1e0b5fe2ddc913

SHA512
b832e89d102d0aeaf4d92b034557e0043316e1749e816e045c4603dacf084361083320655c65720047a279cb623f2d7323fca0bf63e886651559d8cc1a33b6bf

Download Submit
C:\Windows\System\WoNIOZK.exe

Filesize
1.1MB

MD5
b73e57d4af3cd0f1959217f06b884714

SHA1
b45e32dd9130f843c49acb70c1bf5a85d88dcf93

SHA256
ba4024b62cd16e7d20dbaebb6a80c93785116c9d3ab123961578339f40692c82

SHA512
08b3f9d5c07cded4a4c35051745f04d3091c8f2e997776808df7cac63888484bffed2639a6396bfabb10562645599ba7250f2df051807b788669533281a950d5

Download Submit
C:\Windows\System\WwAVjBi.exe

Filesize
1.1MB

MD5
fc8af4bb5466c9e3e118f01034d7284b

SHA1
8a7762802379df97f8aa11cf70fdfde8b954f1fb

SHA256
4e59a246b29aa930345b831d7ad244a4663d7a280612b63be2a179642eca9246

SHA512
4b8b0ad8705f2371d3fb38b524ab306b06a9b525eeb2e400d6f254d8cd63a558cc7859405a02cffbcb898e144edac4ef35a8d451cce968dd01bf402b37e51d62

Download Submit
C:\Windows\System\YONdCfG.exe

Filesize
1.1MB

MD5
7137b9c1f112b029174e31e39d8c8254

SHA1
3b182eed9852b46243df241d571ebf681bac8245

SHA256
fcce4b6f4b47c5ff70237ee9bc0c1fa3c1890b6b28db5b1269fd065c71472d17

SHA512
701c236a559ee57dd9724547154e5069a7b759e07ffac9107225ccce35408a824e31ba373e4e33b7924d9858fa761d0b86ece3ec66bd1887ea2f3b1f84cd1bd1

Download Submit
C:\Windows\System\atcTrfR.exe

Filesize
1.1MB

MD5
9e0cfd637f69e362f270aca909c6ef76

SHA1
851c70fea0207648fe65e6b1d8f0aa8f80e45850

SHA256
808a504846e75c57f7b424c01070fb1a27f7557f945224a947cf04ca97e2a127

SHA512
4715782dc533988348399e31b40eff72d179b524eadf3906dbba86177ad06ed7930a457c56ff73efa9cb4e66b0bf70d97e5fda90a88e784f3ca588297c1b979d

Download Submit
C:\Windows\System\bsbmXTF.exe

Filesize
1.1MB

MD5
00f4ed15d4e63803aa379b6cf71dd2de

SHA1
d517630c298491aa9c7d28a2c9f8686335b7bc20

SHA256
809774397a40d9428752cb8220951bcf54165f71ec2075ecc88f51aa040eb224

SHA512
1652ebdfb7432352d8cef75e6579347374d97277e7c8f302d83ed1fe148d9085bcd183be10b7ec7a177723516cabbb7b9864fdfffa8f25ea4848ea42871d43e9

Download Submit
C:\Windows\System\fgkYxtb.exe

Filesize
1.1MB

MD5
44aaf675c97f798b45b4d44269f56eb9

SHA1
15b199c0a3c115efcc02404b4b1411068b2118b8

SHA256
725be7a8d0dc5a27843be72a4703d6fde1b3e9e6857481131c0c637bdbaf0267

SHA512
bbe97bc69889591268e5237f8d167d071d07bed5af64bf280e16e2c39e79a9fd0c35e26b82c31b84c5ccf94de3c18a29ec47889fd5655af56df58de773b4f9db

Download Submit
C:\Windows\System\gaqzgih.exe

Filesize
1.1MB

MD5
7f1525cccf3020f74d406af7de704324

SHA1
f4611849305d563b0e8bec6644968d4de6e311e9

SHA256
4d7cce78883a1c7d38a325c78207656572154557cc7a35f399654ad5b27e8baa

SHA512
d6b7b30eb0dcb20079d2a487736bbc86342f71afa1b041d54b450acb190ebc2506ca335be73ac48dafa8f7827da14e5262e0540a394fe5f6245978324b41f5df

Download Submit
C:\Windows\System\iWZWvXM.exe

Filesize
1.1MB

MD5
6d2ad360a240b75cad3ae6ae56d4e47f

SHA1
90088e2046f3efa247c5d6d0557569b55cb30fa8

SHA256
fccf42bc56b4c7372fc6be3058822b075dd7b6bb86bced6b4b58270986e5b18a

SHA512
c42a98523c5c44c5fe65c95302620b43bbe05153216d6b015df75aa903e672c7e9a5a4ea463b17d7c3a94dfb080660a9301f19c2ae3063dfedee23bdae7fd021

Download Submit
C:\Windows\System\imZPmoT.exe

Filesize
1.1MB

MD5
945b0a10bb14e14a37f3817792664f89

SHA1
1a6256ef3224b907193131f13c24075cc80ddab4

SHA256
cf80e1246b05b4d6212bbd0fe299ececc39812de4de7b4cf39a613681645aa6b

SHA512
773ba34e71ca20429f1e64153357a897943e827c2e480b14a686014f965703ea5b5809d5abf2eca1888ec4268b234da03d70a5fc612cc7af9eaa305f3f5d9e1c

Download Submit
C:\Windows\System\lPuHvMf.exe

Filesize
1.1MB

MD5
6991ef59075716741820b002c2afb472

SHA1
cd2b63d985d3ab4e37d9bd819baff24564b1eb2a

SHA256
ea54bade3be7bb30b3cb28a3f9b6ca625938e824a9c6a256bc00792c4d9645ba

SHA512
b666abe3cf1737b9345e7016c91f11b5ae14e10cd6fac30a43f28455c92aac7a0a7a612672210342452b6cc641aa663dd679c947ae31dc5f3208a9dc5fadd4fe

Download Submit
C:\Windows\System\mKEzBpw.exe

Filesize
1.1MB

MD5
c275862960c095cca21b4e67686139cb

SHA1
2046eb01bec193ded6416dcaaf37ef10d737d4d2

SHA256
478edcee900d35853a4a74241673213363c3bba4c09880d8606ee49c3b915df6

SHA512
1ab681356ad5f2235dcca09f023e90c460ac541f06713853b74877017e33e59a37199a149de7d2bf6f8711140188623f555f1875264e94919b0ca11ee38834fc

Download Submit
C:\Windows\System\mMbIMuQ.exe

Filesize
1.1MB

MD5
1c70a19e5fdffc2efed43fd8fea33d80

SHA1
3e013c4ec02dc13aca3d1356653ec374f3c8983d

SHA256
fbbf74487af929b8a371dbe47afd7c50401bd86575b05b0d0c8c26566b3ff191

SHA512
a4b068437062c5888e2f709e07456f1a3ebf8c45499af7cf971d3557b4b5e89189d4ece5ec9059b92e65b3c8b16248b5551858e2efbf6d739ac3b7a81a130709

Download Submit
C:\Windows\System\npEOgDm.exe

Filesize
1.1MB

MD5
ff3e040bab81c74a54062a8f79cf40bf

SHA1
97c8d0379fd098693ae2b1f8498b95353af643ae

SHA256
610b45ff786bb97622f18116f7b295ce3e822dbf64de30f5577a9cdddeda0205

SHA512
6b85878e8c1e7af34d904aad111bd63e70bc425475fcf97ec0fe6e12240c84cf8abc679b3c3ed05357b0bf0d405a14454f90b21995c1680aa337845a93708785

Download Submit
C:\Windows\System\rUgpIRn.exe

Filesize
1.1MB

MD5
5a5c267889e99ce9354ac5497835c10b

SHA1
182ceb8c57cd38a3e049701194c2ec331ca1eea8

SHA256
6a6ad6cd9ef5a8b138e8c09604c12d5fdbc73cfbdcafd146876294c06b8646f6

SHA512
ebfd91947993f602133e7b9ee7257aa9681a70fe79cf9dfa62a938bf95426107e25747ab222a0000c3ae239ac1905461cb5e82fc718f6f1a2c75d996b41e0865

Download Submit
C:\Windows\System\sgxZPbd.exe

Filesize
1.1MB

MD5
d63922053859343a5637ada51c63d20d

SHA1
92365548f76556e78d977375441c725cbe41818d

SHA256
fa0676b2ab9408cb699b49004ddc262ec6c0da6a0545501434ab14d717eff683

SHA512
5ed4ffadd6d78779b6d4399ef2cc2b6a2a959cd552a52b2a29449548d649afcdd781d0338ca7ca3dc3954c4de38e6e9ae40f0c4d107b9f1d90f7f71e5af9cc93

Download Submit
C:\Windows\System\wWpEsNC.exe

Filesize
1.1MB

MD5
e605be83a19eaf5277aa91dd3f19ca1e

SHA1
d3c855a9009bdf029ec21046dcd71de69ca58e7a

SHA256
e65c448552e19614aff42b7fcca5f8e346e7c7a557e627efe788b1ed1878d1c2

SHA512
6cedcadf7135f3519ebe80abc750245432049c1be7b8f47e7ebb7203669aaaeae7033495d0a0f3dc87938f1e6eaf7ef1ef4cf7d67113abe30a2afa9846f38ca1

Download Submit
C:\Windows\System\ywloSmE.exe

Filesize
1.1MB

MD5
503e0a97da9b2f6548f196251d1b9bfe

SHA1
02858f6a1bb11ee8d626b4aa2622fe891627b442

SHA256
526ae0aeecfc6b5ec396fe1c9f987e1504330c9064249edca1e19e276b49adca

SHA512
98dd58967fefda30de1add2b1de17afc658cfdb64d9bdfe0470352bb0ddc64841c3411f814b89ef94fe0d1f28700136a580b01b8d53bd79595ec969328fc3b71

Download Submit
C:\Windows\System\zdxDhNZ.exe

Filesize
1.1MB

MD5
2f4e331f607a7180d56ed68b975dfe80

SHA1
d5e4df6db0dba36e51eb0efbb83dbcc813d309da

SHA256
4b8c5fede98d929c762fafca63d4fc2594a33fb2c9fcd72a9b69eb353b573b61

SHA512
df167e72b0af91565057a70a20e32b8dc98abc1fc51b47c3b00c7aad5e1b676b4030d027dd215819b7bb2bb1d69ce29fc17f463129ddeb58f031e0ac0028f78f

Download Submit
memory/3132-0-0x000002A54A330000-0x000002A54A340000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads