xmrig | 10896c2aae6da76d4b45acf3304bdcea35cd4bb13d963e995400f4deb3bc7b40

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
25-01-2025 19:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

10896c2aae6da76d4b45acf3304bdcea35cd4bb13d963e995400f4deb3bc7b40.exe
Size

1.1MB
MD5

0634f4d555f424e5f2aab7828b83890a
SHA1

440a9d6395062eb901ec69e9090184ad7c4714b7
SHA256

10896c2aae6da76d4b45acf3304bdcea35cd4bb13d963e995400f4deb3bc7b40
SHA512

0f9979590742b680a7b7b6d94afcf5ae3820fc401c4933974365c9decad8f8684fa1e3d010998483a065fcfbebc35a8afb4a69056327169148b1ee58c5f391a7
SSDEEP

24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbpwlKenszQEMrG5+C:GezaTF8FcNkNdfE0pZ9ozttwIRQq+C

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 33 IoCs

miner

resource	yara_rule
behavioral2/files/0x000a000000023c1f-5.dat	xmrig
behavioral2/files/0x0007000000023caf-9.dat	xmrig
behavioral2/files/0x0007000000023cb0-15.dat	xmrig
behavioral2/files/0x0007000000023cb1-19.dat	xmrig
behavioral2/files/0x0007000000023cb2-21.dat	xmrig
behavioral2/files/0x0007000000023cb4-32.dat	xmrig
behavioral2/files/0x0007000000023cb3-33.dat	xmrig
behavioral2/files/0x0007000000023cb5-41.dat	xmrig
behavioral2/files/0x0007000000023cb6-42.dat	xmrig
behavioral2/files/0x0007000000023cb7-46.dat	xmrig
behavioral2/files/0x0007000000023cb9-56.dat	xmrig
behavioral2/files/0x0007000000023cba-65.dat	xmrig
behavioral2/files/0x0007000000023cbd-88.dat	xmrig
behavioral2/files/0x0007000000023cc0-99.dat	xmrig
behavioral2/files/0x0007000000023cc2-115.dat	xmrig
behavioral2/files/0x0007000000023ccb-160.dat	xmrig
behavioral2/files/0x0007000000023ccd-162.dat	xmrig
behavioral2/files/0x0007000000023ccc-157.dat	xmrig
behavioral2/files/0x0007000000023cca-155.dat	xmrig
behavioral2/files/0x0007000000023cc9-150.dat	xmrig
behavioral2/files/0x0007000000023cc8-142.dat	xmrig
behavioral2/files/0x0007000000023cc7-138.dat	xmrig
behavioral2/files/0x0007000000023cc6-133.dat	xmrig
behavioral2/files/0x0007000000023cc5-130.dat	xmrig
behavioral2/files/0x0007000000023cc4-125.dat	xmrig
behavioral2/files/0x0007000000023cc3-120.dat	xmrig
behavioral2/files/0x0007000000023cc1-107.dat	xmrig
behavioral2/files/0x0007000000023cbf-95.dat	xmrig
behavioral2/files/0x0007000000023cbe-92.dat	xmrig
behavioral2/files/0x0007000000023cbc-80.dat	xmrig
behavioral2/files/0x0007000000023cbb-75.dat	xmrig
behavioral2/files/0x0008000000023cac-70.dat	xmrig
behavioral2/files/0x0007000000023cb8-58.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
1364	bFJhfOH.exe
5032	NOiyNEG.exe
744	yDnxaiP.exe
4576	luQQrca.exe
2108	pTovbnN.exe
536	cPIkwCV.exe
3128	pngjymF.exe
1120	luGfOwo.exe
2132	gahvXej.exe
1748	SzCiMHW.exe
2204	CONBMqY.exe
2600	RbPubib.exe
3612	yCGWDTu.exe
2572	ctrrLsq.exe
3060	wxmgEOq.exe
3448	TriElFc.exe
2808	FTApmwJ.exe
4156	tBnySIG.exe
4200	PmXNQQL.exe
4500	chJGBgS.exe
2392	hTYPIGd.exe
2712	KeWSrNU.exe
3880	pxyEcVM.exe
2060	TsXKSoE.exe
4092	iNXxGJL.exe
2188	nwmzvLc.exe
1600	KTjncqM.exe
4848	dEFaVMl.exe
1856	SKBFArv.exe
2412	IgkCkUG.exe
3636	txeXTtm.exe
5028	MKZEBng.exe
5084	SchpzGt.exe
1392	QUrJjTb.exe
4420	VRSbVMf.exe
1744	pvtMcUT.exe
4416	xFapTvB.exe
1428	GEtEPyB.exe
2644	IDdhEuc.exe
836	ZxRuInf.exe
3692	eIxQjPo.exe
1176	dzdXBRy.exe
1696	GzRoHEa.exe
1872	BEyYyep.exe
2460	qUHNOMa.exe
4336	dCQeLTI.exe
1560	cNJUQmt.exe
1960	NibtFxV.exe
4660	KjqQbbC.exe
2388	SyvVsBP.exe
3424	gAycQLg.exe
4308	Ugxvxge.exe
1124	XRoCVxZ.exe
1464	KQheIUb.exe
1216	LUZYwva.exe
2340	stZNBIr.exe
4640	QAHKyjF.exe
3904	iMijATf.exe
1904	GIsvUGs.exe
2308	SHkMcUc.exe
1304	cnowYVH.exe
3928	TRqfexA.exe
2272	kuivxEg.exe
312	vygOBmp.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\zPzUxTU.exe	10896c2aae6da76d4b45acf3304bdcea35cd4bb13d963e995400f4deb3bc7b40.exe
File created	C:\Windows\System\cWWhlCm.exe	10896c2aae6da76d4b45acf3304bdcea35cd4bb13d963e995400f4deb3bc7b40.exe
File created	C:\Windows\System\jhwvLAj.exe	10896c2aae6da76d4b45acf3304bdcea35cd4bb13d963e995400f4deb3bc7b40.exe
File created	C:\Windows\System\cMihEWF.exe	10896c2aae6da76d4b45acf3304bdcea35cd4bb13d963e995400f4deb3bc7b40.exe
File created	C:\Windows\System\SKBFArv.exe	10896c2aae6da76d4b45acf3304bdcea35cd4bb13d963e995400f4deb3bc7b40.exe
File created	C:\Windows\System\hsiZyFK.exe	10896c2aae6da76d4b45acf3304bdcea35cd4bb13d963e995400f4deb3bc7b40.exe
File created	C:\Windows\System\hgWwYSP.exe	10896c2aae6da76d4b45acf3304bdcea35cd4bb13d963e995400f4deb3bc7b40.exe
File created	C:\Windows\System\bvwznYe.exe	10896c2aae6da76d4b45acf3304bdcea35cd4bb13d963e995400f4deb3bc7b40.exe
File created	C:\Windows\System\YgYPPnD.exe	10896c2aae6da76d4b45acf3304bdcea35cd4bb13d963e995400f4deb3bc7b40.exe
File created	C:\Windows\System\NtAJtVP.exe	10896c2aae6da76d4b45acf3304bdcea35cd4bb13d963e995400f4deb3bc7b40.exe
File created	C:\Windows\System\vBUNgmS.exe	10896c2aae6da76d4b45acf3304bdcea35cd4bb13d963e995400f4deb3bc7b40.exe
File created	C:\Windows\System\KDHZCKl.exe	10896c2aae6da76d4b45acf3304bdcea35cd4bb13d963e995400f4deb3bc7b40.exe
File created	C:\Windows\System\VuYfFwj.exe	10896c2aae6da76d4b45acf3304bdcea35cd4bb13d963e995400f4deb3bc7b40.exe
File created	C:\Windows\System\WfAKsHP.exe	10896c2aae6da76d4b45acf3304bdcea35cd4bb13d963e995400f4deb3bc7b40.exe
File created	C:\Windows\System\iSLifVS.exe	10896c2aae6da76d4b45acf3304bdcea35cd4bb13d963e995400f4deb3bc7b40.exe
File created	C:\Windows\System\ObZLJwm.exe	10896c2aae6da76d4b45acf3304bdcea35cd4bb13d963e995400f4deb3bc7b40.exe
File created	C:\Windows\System\gAycQLg.exe	10896c2aae6da76d4b45acf3304bdcea35cd4bb13d963e995400f4deb3bc7b40.exe
File created	C:\Windows\System\ERvrIyV.exe	10896c2aae6da76d4b45acf3304bdcea35cd4bb13d963e995400f4deb3bc7b40.exe
File created	C:\Windows\System\jvudafI.exe	10896c2aae6da76d4b45acf3304bdcea35cd4bb13d963e995400f4deb3bc7b40.exe
File created	C:\Windows\System\mVTJTBV.exe	10896c2aae6da76d4b45acf3304bdcea35cd4bb13d963e995400f4deb3bc7b40.exe
File created	C:\Windows\System\UkKSobn.exe	10896c2aae6da76d4b45acf3304bdcea35cd4bb13d963e995400f4deb3bc7b40.exe
File created	C:\Windows\System\sgXFpMr.exe	10896c2aae6da76d4b45acf3304bdcea35cd4bb13d963e995400f4deb3bc7b40.exe
File created	C:\Windows\System\ZSUdLfn.exe	10896c2aae6da76d4b45acf3304bdcea35cd4bb13d963e995400f4deb3bc7b40.exe
File created	C:\Windows\System\QfhDdzA.exe	10896c2aae6da76d4b45acf3304bdcea35cd4bb13d963e995400f4deb3bc7b40.exe
File created	C:\Windows\System\KeWSrNU.exe	10896c2aae6da76d4b45acf3304bdcea35cd4bb13d963e995400f4deb3bc7b40.exe
File created	C:\Windows\System\fLvxEQC.exe	10896c2aae6da76d4b45acf3304bdcea35cd4bb13d963e995400f4deb3bc7b40.exe
File created	C:\Windows\System\sooMCyf.exe	10896c2aae6da76d4b45acf3304bdcea35cd4bb13d963e995400f4deb3bc7b40.exe
File created	C:\Windows\System\IDdhEuc.exe	10896c2aae6da76d4b45acf3304bdcea35cd4bb13d963e995400f4deb3bc7b40.exe
File created	C:\Windows\System\UnbDTgS.exe	10896c2aae6da76d4b45acf3304bdcea35cd4bb13d963e995400f4deb3bc7b40.exe
File created	C:\Windows\System\bQAQowf.exe	10896c2aae6da76d4b45acf3304bdcea35cd4bb13d963e995400f4deb3bc7b40.exe
File created	C:\Windows\System\RaLNpqk.exe	10896c2aae6da76d4b45acf3304bdcea35cd4bb13d963e995400f4deb3bc7b40.exe
File created	C:\Windows\System\VpiEYCl.exe	10896c2aae6da76d4b45acf3304bdcea35cd4bb13d963e995400f4deb3bc7b40.exe
File created	C:\Windows\System\cxndSKO.exe	10896c2aae6da76d4b45acf3304bdcea35cd4bb13d963e995400f4deb3bc7b40.exe
File created	C:\Windows\System\iNXxGJL.exe	10896c2aae6da76d4b45acf3304bdcea35cd4bb13d963e995400f4deb3bc7b40.exe
File created	C:\Windows\System\SYZBNVl.exe	10896c2aae6da76d4b45acf3304bdcea35cd4bb13d963e995400f4deb3bc7b40.exe
File created	C:\Windows\System\cpSjUbQ.exe	10896c2aae6da76d4b45acf3304bdcea35cd4bb13d963e995400f4deb3bc7b40.exe
File created	C:\Windows\System\ckYYydL.exe	10896c2aae6da76d4b45acf3304bdcea35cd4bb13d963e995400f4deb3bc7b40.exe
File created	C:\Windows\System\CKjCMjX.exe	10896c2aae6da76d4b45acf3304bdcea35cd4bb13d963e995400f4deb3bc7b40.exe
File created	C:\Windows\System\TDZBZJG.exe	10896c2aae6da76d4b45acf3304bdcea35cd4bb13d963e995400f4deb3bc7b40.exe
File created	C:\Windows\System\axunLUN.exe	10896c2aae6da76d4b45acf3304bdcea35cd4bb13d963e995400f4deb3bc7b40.exe
File created	C:\Windows\System\WxlAgyJ.exe	10896c2aae6da76d4b45acf3304bdcea35cd4bb13d963e995400f4deb3bc7b40.exe
File created	C:\Windows\System\yIOpYvP.exe	10896c2aae6da76d4b45acf3304bdcea35cd4bb13d963e995400f4deb3bc7b40.exe
File created	C:\Windows\System\cfAFpqc.exe	10896c2aae6da76d4b45acf3304bdcea35cd4bb13d963e995400f4deb3bc7b40.exe
File created	C:\Windows\System\NfoeyKD.exe	10896c2aae6da76d4b45acf3304bdcea35cd4bb13d963e995400f4deb3bc7b40.exe
File created	C:\Windows\System\xoZGoNp.exe	10896c2aae6da76d4b45acf3304bdcea35cd4bb13d963e995400f4deb3bc7b40.exe
File created	C:\Windows\System\xjxsVGh.exe	10896c2aae6da76d4b45acf3304bdcea35cd4bb13d963e995400f4deb3bc7b40.exe
File created	C:\Windows\System\MFqZpbf.exe	10896c2aae6da76d4b45acf3304bdcea35cd4bb13d963e995400f4deb3bc7b40.exe
File created	C:\Windows\System\pLCJueM.exe	10896c2aae6da76d4b45acf3304bdcea35cd4bb13d963e995400f4deb3bc7b40.exe
File created	C:\Windows\System\USRfEYa.exe	10896c2aae6da76d4b45acf3304bdcea35cd4bb13d963e995400f4deb3bc7b40.exe
File created	C:\Windows\System\KNHOwFT.exe	10896c2aae6da76d4b45acf3304bdcea35cd4bb13d963e995400f4deb3bc7b40.exe
File created	C:\Windows\System\IdVVKcA.exe	10896c2aae6da76d4b45acf3304bdcea35cd4bb13d963e995400f4deb3bc7b40.exe
File created	C:\Windows\System\nrpXIZt.exe	10896c2aae6da76d4b45acf3304bdcea35cd4bb13d963e995400f4deb3bc7b40.exe
File created	C:\Windows\System\tQsdpbF.exe	10896c2aae6da76d4b45acf3304bdcea35cd4bb13d963e995400f4deb3bc7b40.exe
File created	C:\Windows\System\rdpGCoV.exe	10896c2aae6da76d4b45acf3304bdcea35cd4bb13d963e995400f4deb3bc7b40.exe
File created	C:\Windows\System\FTApmwJ.exe	10896c2aae6da76d4b45acf3304bdcea35cd4bb13d963e995400f4deb3bc7b40.exe
File created	C:\Windows\System\zPMIzRH.exe	10896c2aae6da76d4b45acf3304bdcea35cd4bb13d963e995400f4deb3bc7b40.exe
File created	C:\Windows\System\egYKxzv.exe	10896c2aae6da76d4b45acf3304bdcea35cd4bb13d963e995400f4deb3bc7b40.exe
File created	C:\Windows\System\rXKFAli.exe	10896c2aae6da76d4b45acf3304bdcea35cd4bb13d963e995400f4deb3bc7b40.exe
File created	C:\Windows\System\fnEyiHM.exe	10896c2aae6da76d4b45acf3304bdcea35cd4bb13d963e995400f4deb3bc7b40.exe
File created	C:\Windows\System\SRiRwGr.exe	10896c2aae6da76d4b45acf3304bdcea35cd4bb13d963e995400f4deb3bc7b40.exe
File created	C:\Windows\System\NuOASVZ.exe	10896c2aae6da76d4b45acf3304bdcea35cd4bb13d963e995400f4deb3bc7b40.exe
File created	C:\Windows\System\IfXyzeN.exe	10896c2aae6da76d4b45acf3304bdcea35cd4bb13d963e995400f4deb3bc7b40.exe
File created	C:\Windows\System\nQIYDZC.exe	10896c2aae6da76d4b45acf3304bdcea35cd4bb13d963e995400f4deb3bc7b40.exe
File created	C:\Windows\System\pkyAvJd.exe	10896c2aae6da76d4b45acf3304bdcea35cd4bb13d963e995400f4deb3bc7b40.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	16404	dwm.exe
Token: SeChangeNotifyPrivilege	16404	dwm.exe
Token: 33	16404	dwm.exe
Token: SeIncBasePriorityPrivilege	16404	dwm.exe
Token: SeShutdownPrivilege	16404	dwm.exe
Token: SeCreatePagefilePrivilege	16404	dwm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2816 wrote to memory of 1364	2816	10896c2aae6da76d4b45acf3304bdcea35cd4bb13d963e995400f4deb3bc7b40.exe	84
PID 2816 wrote to memory of 1364	2816	10896c2aae6da76d4b45acf3304bdcea35cd4bb13d963e995400f4deb3bc7b40.exe	84
PID 2816 wrote to memory of 5032	2816	10896c2aae6da76d4b45acf3304bdcea35cd4bb13d963e995400f4deb3bc7b40.exe	85
PID 2816 wrote to memory of 5032	2816	10896c2aae6da76d4b45acf3304bdcea35cd4bb13d963e995400f4deb3bc7b40.exe	85
PID 2816 wrote to memory of 744	2816	10896c2aae6da76d4b45acf3304bdcea35cd4bb13d963e995400f4deb3bc7b40.exe	86
PID 2816 wrote to memory of 744	2816	10896c2aae6da76d4b45acf3304bdcea35cd4bb13d963e995400f4deb3bc7b40.exe	86
PID 2816 wrote to memory of 4576	2816	10896c2aae6da76d4b45acf3304bdcea35cd4bb13d963e995400f4deb3bc7b40.exe	87
PID 2816 wrote to memory of 4576	2816	10896c2aae6da76d4b45acf3304bdcea35cd4bb13d963e995400f4deb3bc7b40.exe	87
PID 2816 wrote to memory of 2108	2816	10896c2aae6da76d4b45acf3304bdcea35cd4bb13d963e995400f4deb3bc7b40.exe	88
PID 2816 wrote to memory of 2108	2816	10896c2aae6da76d4b45acf3304bdcea35cd4bb13d963e995400f4deb3bc7b40.exe	88
PID 2816 wrote to memory of 536	2816	10896c2aae6da76d4b45acf3304bdcea35cd4bb13d963e995400f4deb3bc7b40.exe	89
PID 2816 wrote to memory of 536	2816	10896c2aae6da76d4b45acf3304bdcea35cd4bb13d963e995400f4deb3bc7b40.exe	89
PID 2816 wrote to memory of 3128	2816	10896c2aae6da76d4b45acf3304bdcea35cd4bb13d963e995400f4deb3bc7b40.exe	90
PID 2816 wrote to memory of 3128	2816	10896c2aae6da76d4b45acf3304bdcea35cd4bb13d963e995400f4deb3bc7b40.exe	90
PID 2816 wrote to memory of 1120	2816	10896c2aae6da76d4b45acf3304bdcea35cd4bb13d963e995400f4deb3bc7b40.exe	91
PID 2816 wrote to memory of 1120	2816	10896c2aae6da76d4b45acf3304bdcea35cd4bb13d963e995400f4deb3bc7b40.exe	91
PID 2816 wrote to memory of 2132	2816	10896c2aae6da76d4b45acf3304bdcea35cd4bb13d963e995400f4deb3bc7b40.exe	92
PID 2816 wrote to memory of 2132	2816	10896c2aae6da76d4b45acf3304bdcea35cd4bb13d963e995400f4deb3bc7b40.exe	92
PID 2816 wrote to memory of 1748	2816	10896c2aae6da76d4b45acf3304bdcea35cd4bb13d963e995400f4deb3bc7b40.exe	93
PID 2816 wrote to memory of 1748	2816	10896c2aae6da76d4b45acf3304bdcea35cd4bb13d963e995400f4deb3bc7b40.exe	93
PID 2816 wrote to memory of 2204	2816	10896c2aae6da76d4b45acf3304bdcea35cd4bb13d963e995400f4deb3bc7b40.exe	94
PID 2816 wrote to memory of 2204	2816	10896c2aae6da76d4b45acf3304bdcea35cd4bb13d963e995400f4deb3bc7b40.exe	94
PID 2816 wrote to memory of 2600	2816	10896c2aae6da76d4b45acf3304bdcea35cd4bb13d963e995400f4deb3bc7b40.exe	95
PID 2816 wrote to memory of 2600	2816	10896c2aae6da76d4b45acf3304bdcea35cd4bb13d963e995400f4deb3bc7b40.exe	95
PID 2816 wrote to memory of 3612	2816	10896c2aae6da76d4b45acf3304bdcea35cd4bb13d963e995400f4deb3bc7b40.exe	96
PID 2816 wrote to memory of 3612	2816	10896c2aae6da76d4b45acf3304bdcea35cd4bb13d963e995400f4deb3bc7b40.exe	96
PID 2816 wrote to memory of 2572	2816	10896c2aae6da76d4b45acf3304bdcea35cd4bb13d963e995400f4deb3bc7b40.exe	97
PID 2816 wrote to memory of 2572	2816	10896c2aae6da76d4b45acf3304bdcea35cd4bb13d963e995400f4deb3bc7b40.exe	97
PID 2816 wrote to memory of 3060	2816	10896c2aae6da76d4b45acf3304bdcea35cd4bb13d963e995400f4deb3bc7b40.exe	98
PID 2816 wrote to memory of 3060	2816	10896c2aae6da76d4b45acf3304bdcea35cd4bb13d963e995400f4deb3bc7b40.exe	98
PID 2816 wrote to memory of 3448	2816	10896c2aae6da76d4b45acf3304bdcea35cd4bb13d963e995400f4deb3bc7b40.exe	99
PID 2816 wrote to memory of 3448	2816	10896c2aae6da76d4b45acf3304bdcea35cd4bb13d963e995400f4deb3bc7b40.exe	99
PID 2816 wrote to memory of 2808	2816	10896c2aae6da76d4b45acf3304bdcea35cd4bb13d963e995400f4deb3bc7b40.exe	100
PID 2816 wrote to memory of 2808	2816	10896c2aae6da76d4b45acf3304bdcea35cd4bb13d963e995400f4deb3bc7b40.exe	100
PID 2816 wrote to memory of 4156	2816	10896c2aae6da76d4b45acf3304bdcea35cd4bb13d963e995400f4deb3bc7b40.exe	101
PID 2816 wrote to memory of 4156	2816	10896c2aae6da76d4b45acf3304bdcea35cd4bb13d963e995400f4deb3bc7b40.exe	101
PID 2816 wrote to memory of 4200	2816	10896c2aae6da76d4b45acf3304bdcea35cd4bb13d963e995400f4deb3bc7b40.exe	102
PID 2816 wrote to memory of 4200	2816	10896c2aae6da76d4b45acf3304bdcea35cd4bb13d963e995400f4deb3bc7b40.exe	102
PID 2816 wrote to memory of 4500	2816	10896c2aae6da76d4b45acf3304bdcea35cd4bb13d963e995400f4deb3bc7b40.exe	103
PID 2816 wrote to memory of 4500	2816	10896c2aae6da76d4b45acf3304bdcea35cd4bb13d963e995400f4deb3bc7b40.exe	103
PID 2816 wrote to memory of 2392	2816	10896c2aae6da76d4b45acf3304bdcea35cd4bb13d963e995400f4deb3bc7b40.exe	104
PID 2816 wrote to memory of 2392	2816	10896c2aae6da76d4b45acf3304bdcea35cd4bb13d963e995400f4deb3bc7b40.exe	104
PID 2816 wrote to memory of 2712	2816	10896c2aae6da76d4b45acf3304bdcea35cd4bb13d963e995400f4deb3bc7b40.exe	105
PID 2816 wrote to memory of 2712	2816	10896c2aae6da76d4b45acf3304bdcea35cd4bb13d963e995400f4deb3bc7b40.exe	105
PID 2816 wrote to memory of 3880	2816	10896c2aae6da76d4b45acf3304bdcea35cd4bb13d963e995400f4deb3bc7b40.exe	106
PID 2816 wrote to memory of 3880	2816	10896c2aae6da76d4b45acf3304bdcea35cd4bb13d963e995400f4deb3bc7b40.exe	106
PID 2816 wrote to memory of 2060	2816	10896c2aae6da76d4b45acf3304bdcea35cd4bb13d963e995400f4deb3bc7b40.exe	107
PID 2816 wrote to memory of 2060	2816	10896c2aae6da76d4b45acf3304bdcea35cd4bb13d963e995400f4deb3bc7b40.exe	107
PID 2816 wrote to memory of 4092	2816	10896c2aae6da76d4b45acf3304bdcea35cd4bb13d963e995400f4deb3bc7b40.exe	108
PID 2816 wrote to memory of 4092	2816	10896c2aae6da76d4b45acf3304bdcea35cd4bb13d963e995400f4deb3bc7b40.exe	108
PID 2816 wrote to memory of 2188	2816	10896c2aae6da76d4b45acf3304bdcea35cd4bb13d963e995400f4deb3bc7b40.exe	109
PID 2816 wrote to memory of 2188	2816	10896c2aae6da76d4b45acf3304bdcea35cd4bb13d963e995400f4deb3bc7b40.exe	109
PID 2816 wrote to memory of 1600	2816	10896c2aae6da76d4b45acf3304bdcea35cd4bb13d963e995400f4deb3bc7b40.exe	110
PID 2816 wrote to memory of 1600	2816	10896c2aae6da76d4b45acf3304bdcea35cd4bb13d963e995400f4deb3bc7b40.exe	110
PID 2816 wrote to memory of 4848	2816	10896c2aae6da76d4b45acf3304bdcea35cd4bb13d963e995400f4deb3bc7b40.exe	111
PID 2816 wrote to memory of 4848	2816	10896c2aae6da76d4b45acf3304bdcea35cd4bb13d963e995400f4deb3bc7b40.exe	111
PID 2816 wrote to memory of 1856	2816	10896c2aae6da76d4b45acf3304bdcea35cd4bb13d963e995400f4deb3bc7b40.exe	112
PID 2816 wrote to memory of 1856	2816	10896c2aae6da76d4b45acf3304bdcea35cd4bb13d963e995400f4deb3bc7b40.exe	112
PID 2816 wrote to memory of 2412	2816	10896c2aae6da76d4b45acf3304bdcea35cd4bb13d963e995400f4deb3bc7b40.exe	113
PID 2816 wrote to memory of 2412	2816	10896c2aae6da76d4b45acf3304bdcea35cd4bb13d963e995400f4deb3bc7b40.exe	113
PID 2816 wrote to memory of 3636	2816	10896c2aae6da76d4b45acf3304bdcea35cd4bb13d963e995400f4deb3bc7b40.exe	114
PID 2816 wrote to memory of 3636	2816	10896c2aae6da76d4b45acf3304bdcea35cd4bb13d963e995400f4deb3bc7b40.exe	114
PID 2816 wrote to memory of 5028	2816	10896c2aae6da76d4b45acf3304bdcea35cd4bb13d963e995400f4deb3bc7b40.exe	115
PID 2816 wrote to memory of 5028	2816	10896c2aae6da76d4b45acf3304bdcea35cd4bb13d963e995400f4deb3bc7b40.exe	115

C:\Users\Admin\AppData\Local\Temp\10896c2aae6da76d4b45acf3304bdcea35cd4bb13d963e995400f4deb3bc7b40.exe
"C:\Users\Admin\AppData\Local\Temp\10896c2aae6da76d4b45acf3304bdcea35cd4bb13d963e995400f4deb3bc7b40.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2816
- C:\Windows\System\bFJhfOH.exe
  C:\Windows\System\bFJhfOH.exe
  2⤵
  - Executes dropped EXE
  PID:1364
- C:\Windows\System\NOiyNEG.exe
  C:\Windows\System\NOiyNEG.exe
  2⤵
  - Executes dropped EXE
  PID:5032
- C:\Windows\System\yDnxaiP.exe
  C:\Windows\System\yDnxaiP.exe
  2⤵
  - Executes dropped EXE
  PID:744
- C:\Windows\System\luQQrca.exe
  C:\Windows\System\luQQrca.exe
  2⤵
  - Executes dropped EXE
  PID:4576
- C:\Windows\System\pTovbnN.exe
  C:\Windows\System\pTovbnN.exe
  2⤵
  - Executes dropped EXE
  PID:2108
- C:\Windows\System\cPIkwCV.exe
  C:\Windows\System\cPIkwCV.exe
  2⤵
  - Executes dropped EXE
  PID:536
- C:\Windows\System\pngjymF.exe
  C:\Windows\System\pngjymF.exe
  2⤵
  - Executes dropped EXE
  PID:3128
- C:\Windows\System\luGfOwo.exe
  C:\Windows\System\luGfOwo.exe
  2⤵
  - Executes dropped EXE
  PID:1120
- C:\Windows\System\gahvXej.exe
  C:\Windows\System\gahvXej.exe
  2⤵
  - Executes dropped EXE
  PID:2132
- C:\Windows\System\SzCiMHW.exe
  C:\Windows\System\SzCiMHW.exe
  2⤵
  - Executes dropped EXE
  PID:1748
- C:\Windows\System\CONBMqY.exe
  C:\Windows\System\CONBMqY.exe
  2⤵
  - Executes dropped EXE
  PID:2204
- C:\Windows\System\RbPubib.exe
  C:\Windows\System\RbPubib.exe
  2⤵
  - Executes dropped EXE
  PID:2600
- C:\Windows\System\yCGWDTu.exe
  C:\Windows\System\yCGWDTu.exe
  2⤵
  - Executes dropped EXE
  PID:3612
- C:\Windows\System\ctrrLsq.exe
  C:\Windows\System\ctrrLsq.exe
  2⤵
  - Executes dropped EXE
  PID:2572
- C:\Windows\System\wxmgEOq.exe
  C:\Windows\System\wxmgEOq.exe
  2⤵
  - Executes dropped EXE
  PID:3060
- C:\Windows\System\TriElFc.exe
  C:\Windows\System\TriElFc.exe
  2⤵
  - Executes dropped EXE
  PID:3448
- C:\Windows\System\FTApmwJ.exe
  C:\Windows\System\FTApmwJ.exe
  2⤵
  - Executes dropped EXE
  PID:2808
- C:\Windows\System\tBnySIG.exe
  C:\Windows\System\tBnySIG.exe
  2⤵
  - Executes dropped EXE
  PID:4156
- C:\Windows\System\PmXNQQL.exe
  C:\Windows\System\PmXNQQL.exe
  2⤵
  - Executes dropped EXE
  PID:4200
- C:\Windows\System\chJGBgS.exe
  C:\Windows\System\chJGBgS.exe
  2⤵
  - Executes dropped EXE
  PID:4500
- C:\Windows\System\hTYPIGd.exe
  C:\Windows\System\hTYPIGd.exe
  2⤵
  - Executes dropped EXE
  PID:2392
- C:\Windows\System\KeWSrNU.exe
  C:\Windows\System\KeWSrNU.exe
  2⤵
  - Executes dropped EXE
  PID:2712
- C:\Windows\System\pxyEcVM.exe
  C:\Windows\System\pxyEcVM.exe
  2⤵
  - Executes dropped EXE
  PID:3880
- C:\Windows\System\TsXKSoE.exe
  C:\Windows\System\TsXKSoE.exe
  2⤵
  - Executes dropped EXE
  PID:2060
- C:\Windows\System\iNXxGJL.exe
  C:\Windows\System\iNXxGJL.exe
  2⤵
  - Executes dropped EXE
  PID:4092
- C:\Windows\System\nwmzvLc.exe
  C:\Windows\System\nwmzvLc.exe
  2⤵
  - Executes dropped EXE
  PID:2188
- C:\Windows\System\KTjncqM.exe
  C:\Windows\System\KTjncqM.exe
  2⤵
  - Executes dropped EXE
  PID:1600
- C:\Windows\System\dEFaVMl.exe
  C:\Windows\System\dEFaVMl.exe
  2⤵
  - Executes dropped EXE
  PID:4848
- C:\Windows\System\SKBFArv.exe
  C:\Windows\System\SKBFArv.exe
  2⤵
  - Executes dropped EXE
  PID:1856
- C:\Windows\System\IgkCkUG.exe
  C:\Windows\System\IgkCkUG.exe
  2⤵
  - Executes dropped EXE
  PID:2412
- C:\Windows\System\txeXTtm.exe
  C:\Windows\System\txeXTtm.exe
  2⤵
  - Executes dropped EXE
  PID:3636
- C:\Windows\System\MKZEBng.exe
  C:\Windows\System\MKZEBng.exe
  2⤵
  - Executes dropped EXE
  PID:5028
- C:\Windows\System\SchpzGt.exe
  C:\Windows\System\SchpzGt.exe
  2⤵
  - Executes dropped EXE
  PID:5084
- C:\Windows\System\QUrJjTb.exe
  C:\Windows\System\QUrJjTb.exe
  2⤵
  - Executes dropped EXE
  PID:1392
- C:\Windows\System\VRSbVMf.exe
  C:\Windows\System\VRSbVMf.exe
  2⤵
  - Executes dropped EXE
  PID:4420
- C:\Windows\System\pvtMcUT.exe
  C:\Windows\System\pvtMcUT.exe
  2⤵
  - Executes dropped EXE
  PID:1744
- C:\Windows\System\xFapTvB.exe
  C:\Windows\System\xFapTvB.exe
  2⤵
  - Executes dropped EXE
  PID:4416
- C:\Windows\System\GEtEPyB.exe
  C:\Windows\System\GEtEPyB.exe
  2⤵
  - Executes dropped EXE
  PID:1428
- C:\Windows\System\IDdhEuc.exe
  C:\Windows\System\IDdhEuc.exe
  2⤵
  - Executes dropped EXE
  PID:2644
- C:\Windows\System\ZxRuInf.exe
  C:\Windows\System\ZxRuInf.exe
  2⤵
  - Executes dropped EXE
  PID:836
- C:\Windows\System\eIxQjPo.exe
  C:\Windows\System\eIxQjPo.exe
  2⤵
  - Executes dropped EXE
  PID:3692
- C:\Windows\System\dzdXBRy.exe
  C:\Windows\System\dzdXBRy.exe
  2⤵
  - Executes dropped EXE
  PID:1176
- C:\Windows\System\GzRoHEa.exe
  C:\Windows\System\GzRoHEa.exe
  2⤵
  - Executes dropped EXE
  PID:1696
- C:\Windows\System\BEyYyep.exe
  C:\Windows\System\BEyYyep.exe
  2⤵
  - Executes dropped EXE
  PID:1872
- C:\Windows\System\qUHNOMa.exe
  C:\Windows\System\qUHNOMa.exe
  2⤵
  - Executes dropped EXE
  PID:2460
- C:\Windows\System\dCQeLTI.exe
  C:\Windows\System\dCQeLTI.exe
  2⤵
  - Executes dropped EXE
  PID:4336
- C:\Windows\System\cNJUQmt.exe
  C:\Windows\System\cNJUQmt.exe
  2⤵
  - Executes dropped EXE
  PID:1560
- C:\Windows\System\NibtFxV.exe
  C:\Windows\System\NibtFxV.exe
  2⤵
  - Executes dropped EXE
  PID:1960
- C:\Windows\System\KjqQbbC.exe
  C:\Windows\System\KjqQbbC.exe
  2⤵
  - Executes dropped EXE
  PID:4660
- C:\Windows\System\SyvVsBP.exe
  C:\Windows\System\SyvVsBP.exe
  2⤵
  - Executes dropped EXE
  PID:2388
- C:\Windows\System\gAycQLg.exe
  C:\Windows\System\gAycQLg.exe
  2⤵
  - Executes dropped EXE
  PID:3424
- C:\Windows\System\Ugxvxge.exe
  C:\Windows\System\Ugxvxge.exe
  2⤵
  - Executes dropped EXE
  PID:4308
- C:\Windows\System\XRoCVxZ.exe
  C:\Windows\System\XRoCVxZ.exe
  2⤵
  - Executes dropped EXE
  PID:1124
- C:\Windows\System\KQheIUb.exe
  C:\Windows\System\KQheIUb.exe
  2⤵
  - Executes dropped EXE
  PID:1464
- C:\Windows\System\LUZYwva.exe
  C:\Windows\System\LUZYwva.exe
  2⤵
  - Executes dropped EXE
  PID:1216
- C:\Windows\System\stZNBIr.exe
  C:\Windows\System\stZNBIr.exe
  2⤵
  - Executes dropped EXE
  PID:2340
- C:\Windows\System\QAHKyjF.exe
  C:\Windows\System\QAHKyjF.exe
  2⤵
  - Executes dropped EXE
  PID:4640
- C:\Windows\System\iMijATf.exe
  C:\Windows\System\iMijATf.exe
  2⤵
  - Executes dropped EXE
  PID:3904
- C:\Windows\System\GIsvUGs.exe
  C:\Windows\System\GIsvUGs.exe
  2⤵
  - Executes dropped EXE
  PID:1904
- C:\Windows\System\SHkMcUc.exe
  C:\Windows\System\SHkMcUc.exe
  2⤵
  - Executes dropped EXE
  PID:2308
- C:\Windows\System\cnowYVH.exe
  C:\Windows\System\cnowYVH.exe
  2⤵
  - Executes dropped EXE
  PID:1304
- C:\Windows\System\TRqfexA.exe
  C:\Windows\System\TRqfexA.exe
  2⤵
  - Executes dropped EXE
  PID:3928
- C:\Windows\System\kuivxEg.exe
  C:\Windows\System\kuivxEg.exe
  2⤵
  - Executes dropped EXE
  PID:2272
- C:\Windows\System\vygOBmp.exe
  C:\Windows\System\vygOBmp.exe
  2⤵
  - Executes dropped EXE
  PID:312
- C:\Windows\System\aOOxvVu.exe
  C:\Windows\System\aOOxvVu.exe
  2⤵
  PID:3940
- C:\Windows\System\jyKgKea.exe
  C:\Windows\System\jyKgKea.exe
  2⤵
  PID:4384
- C:\Windows\System\PKzeSlF.exe
  C:\Windows\System\PKzeSlF.exe
  2⤵
  PID:4208
- C:\Windows\System\DGNxiDP.exe
  C:\Windows\System\DGNxiDP.exe
  2⤵
  PID:4040
- C:\Windows\System\dlxCRhq.exe
  C:\Windows\System\dlxCRhq.exe
  2⤵
  PID:4232
- C:\Windows\System\iXTVPtY.exe
  C:\Windows\System\iXTVPtY.exe
  2⤵
  PID:404
- C:\Windows\System\wEMRVht.exe
  C:\Windows\System\wEMRVht.exe
  2⤵
  PID:2528
- C:\Windows\System\uwEUvjV.exe
  C:\Windows\System\uwEUvjV.exe
  2⤵
  PID:3228
- C:\Windows\System\iOuClRo.exe
  C:\Windows\System\iOuClRo.exe
  2⤵
  PID:2492
- C:\Windows\System\ikYIzgp.exe
  C:\Windows\System\ikYIzgp.exe
  2⤵
  PID:4248
- C:\Windows\System\WTOjJxA.exe
  C:\Windows\System\WTOjJxA.exe
  2⤵
  PID:3956
- C:\Windows\System\SuMskgV.exe
  C:\Windows\System\SuMskgV.exe
  2⤵
  PID:3568
- C:\Windows\System\LFCgUQk.exe
  C:\Windows\System\LFCgUQk.exe
  2⤵
  PID:3352
- C:\Windows\System\kyFyMGN.exe
  C:\Windows\System\kyFyMGN.exe
  2⤵
  PID:3372
- C:\Windows\System\YfpfTsk.exe
  C:\Windows\System\YfpfTsk.exe
  2⤵
  PID:3672
- C:\Windows\System\cJfMxSM.exe
  C:\Windows\System\cJfMxSM.exe
  2⤵
  PID:4936
- C:\Windows\System\TEiKzXE.exe
  C:\Windows\System\TEiKzXE.exe
  2⤵
  PID:4904
- C:\Windows\System\kZimvbI.exe
  C:\Windows\System\kZimvbI.exe
  2⤵
  PID:412
- C:\Windows\System\LLVKyhY.exe
  C:\Windows\System\LLVKyhY.exe
  2⤵
  PID:4284
- C:\Windows\System\TauXHys.exe
  C:\Windows\System\TauXHys.exe
  2⤵
  PID:1668
- C:\Windows\System\yQbGFDL.exe
  C:\Windows\System\yQbGFDL.exe
  2⤵
  PID:4504
- C:\Windows\System\OSycLwD.exe
  C:\Windows\System\OSycLwD.exe
  2⤵
  PID:1940
- C:\Windows\System\EXhYhuc.exe
  C:\Windows\System\EXhYhuc.exe
  2⤵
  PID:3948
- C:\Windows\System\NawUvfm.exe
  C:\Windows\System\NawUvfm.exe
  2⤵
  PID:4320
- C:\Windows\System\QxCnmmt.exe
  C:\Windows\System\QxCnmmt.exe
  2⤵
  PID:336
- C:\Windows\System\BqbniaC.exe
  C:\Windows\System\BqbniaC.exe
  2⤵
  PID:2228
- C:\Windows\System\EBBweSz.exe
  C:\Windows\System\EBBweSz.exe
  2⤵
  PID:3380
- C:\Windows\System\FokucHP.exe
  C:\Windows\System\FokucHP.exe
  2⤵
  PID:4808
- C:\Windows\System\NtAJtVP.exe
  C:\Windows\System\NtAJtVP.exe
  2⤵
  PID:452
- C:\Windows\System\bvwznYe.exe
  C:\Windows\System\bvwznYe.exe
  2⤵
  PID:3588
- C:\Windows\System\syunzLs.exe
  C:\Windows\System\syunzLs.exe
  2⤵
  PID:5148
- C:\Windows\System\BAYUkYh.exe
  C:\Windows\System\BAYUkYh.exe
  2⤵
  PID:5176
- C:\Windows\System\sCqFfvC.exe
  C:\Windows\System\sCqFfvC.exe
  2⤵
  PID:5200
- C:\Windows\System\WWssxVO.exe
  C:\Windows\System\WWssxVO.exe
  2⤵
  PID:5232
- C:\Windows\System\aODtKJb.exe
  C:\Windows\System\aODtKJb.exe
  2⤵
  PID:5256
- C:\Windows\System\nPKqASF.exe
  C:\Windows\System\nPKqASF.exe
  2⤵
  PID:5292
- C:\Windows\System\kHxuwZK.exe
  C:\Windows\System\kHxuwZK.exe
  2⤵
  PID:5312
- C:\Windows\System\PdUJHLN.exe
  C:\Windows\System\PdUJHLN.exe
  2⤵
  PID:5344
- C:\Windows\System\kobVRii.exe
  C:\Windows\System\kobVRii.exe
  2⤵
  PID:5368
- C:\Windows\System\WZwwnMB.exe
  C:\Windows\System\WZwwnMB.exe
  2⤵
  PID:5400
- C:\Windows\System\qQEpAsc.exe
  C:\Windows\System\qQEpAsc.exe
  2⤵
  PID:5424
- C:\Windows\System\UYinEQF.exe
  C:\Windows\System\UYinEQF.exe
  2⤵
  PID:5456
- C:\Windows\System\EsJesMK.exe
  C:\Windows\System\EsJesMK.exe
  2⤵
  PID:5480
- C:\Windows\System\QSlQGAa.exe
  C:\Windows\System\QSlQGAa.exe
  2⤵
  PID:5512
- C:\Windows\System\AhkQOYW.exe
  C:\Windows\System\AhkQOYW.exe
  2⤵
  PID:5540
- C:\Windows\System\XnEHuyS.exe
  C:\Windows\System\XnEHuyS.exe
  2⤵
  PID:5564
- C:\Windows\System\ERvrIyV.exe
  C:\Windows\System\ERvrIyV.exe
  2⤵
  PID:5596
- C:\Windows\System\VtCEFva.exe
  C:\Windows\System\VtCEFva.exe
  2⤵
  PID:5620
- C:\Windows\System\rxIZlYK.exe
  C:\Windows\System\rxIZlYK.exe
  2⤵
  PID:5648
- C:\Windows\System\xZvlqnk.exe
  C:\Windows\System\xZvlqnk.exe
  2⤵
  PID:5680
- C:\Windows\System\lrtSYkM.exe
  C:\Windows\System\lrtSYkM.exe
  2⤵
  PID:5708
- C:\Windows\System\qSVocpu.exe
  C:\Windows\System\qSVocpu.exe
  2⤵
  PID:5732
- C:\Windows\System\WCZrBvm.exe
  C:\Windows\System\WCZrBvm.exe
  2⤵
  PID:5764
- C:\Windows\System\GJwQBlP.exe
  C:\Windows\System\GJwQBlP.exe
  2⤵
  PID:5792
- C:\Windows\System\HmxCjcR.exe
  C:\Windows\System\HmxCjcR.exe
  2⤵
  PID:5816
- C:\Windows\System\HSfQoiv.exe
  C:\Windows\System\HSfQoiv.exe
  2⤵
  PID:5848
- C:\Windows\System\QgECOoG.exe
  C:\Windows\System\QgECOoG.exe
  2⤵
  PID:5872
- C:\Windows\System\zqTSzoK.exe
  C:\Windows\System\zqTSzoK.exe
  2⤵
  PID:5904
- C:\Windows\System\aSliFQD.exe
  C:\Windows\System\aSliFQD.exe
  2⤵
  PID:5928
- C:\Windows\System\sOxyWDp.exe
  C:\Windows\System\sOxyWDp.exe
  2⤵
  PID:5960
- C:\Windows\System\rNRFTyZ.exe
  C:\Windows\System\rNRFTyZ.exe
  2⤵
  PID:5988
- C:\Windows\System\YnweDVf.exe
  C:\Windows\System\YnweDVf.exe
  2⤵
  PID:6012
- C:\Windows\System\aFmfepz.exe
  C:\Windows\System\aFmfepz.exe
  2⤵
  PID:6044
- C:\Windows\System\jECFIEq.exe
  C:\Windows\System\jECFIEq.exe
  2⤵
  PID:6076
- C:\Windows\System\MeHpkdU.exe
  C:\Windows\System\MeHpkdU.exe
  2⤵
  PID:6108
- C:\Windows\System\yOMcbnH.exe
  C:\Windows\System\yOMcbnH.exe
  2⤵
  PID:6132
- C:\Windows\System\KtaJpmC.exe
  C:\Windows\System\KtaJpmC.exe
  2⤵
  PID:2908
- C:\Windows\System\UATuOYN.exe
  C:\Windows\System\UATuOYN.exe
  2⤵
  PID:4564
- C:\Windows\System\nvraZFy.exe
  C:\Windows\System\nvraZFy.exe
  2⤵
  PID:1164
- C:\Windows\System\LKpqolx.exe
  C:\Windows\System\LKpqolx.exe
  2⤵
  PID:3400
- C:\Windows\System\SENPMdK.exe
  C:\Windows\System\SENPMdK.exe
  2⤵
  PID:2624
- C:\Windows\System\BnwfHoV.exe
  C:\Windows\System\BnwfHoV.exe
  2⤵
  PID:1432
- C:\Windows\System\oxrxMer.exe
  C:\Windows\System\oxrxMer.exe
  2⤵
  PID:5156
- C:\Windows\System\LpLzwEc.exe
  C:\Windows\System\LpLzwEc.exe
  2⤵
  PID:5192
- C:\Windows\System\WoqLtCE.exe
  C:\Windows\System\WoqLtCE.exe
  2⤵
  PID:1712
- C:\Windows\System\WwtWTqV.exe
  C:\Windows\System\WwtWTqV.exe
  2⤵
  PID:5308
- C:\Windows\System\hQtIVbG.exe
  C:\Windows\System\hQtIVbG.exe
  2⤵
  PID:5380
- C:\Windows\System\zDHVuGz.exe
  C:\Windows\System\zDHVuGz.exe
  2⤵
  PID:5444
- C:\Windows\System\IfXyzeN.exe
  C:\Windows\System\IfXyzeN.exe
  2⤵
  PID:5520
- C:\Windows\System\SYZBNVl.exe
  C:\Windows\System\SYZBNVl.exe
  2⤵
  PID:5604
- C:\Windows\System\MPfapfl.exe
  C:\Windows\System\MPfapfl.exe
  2⤵
  PID:5656
- C:\Windows\System\hFwDrxT.exe
  C:\Windows\System\hFwDrxT.exe
  2⤵
  PID:5748
- C:\Windows\System\RANgvgu.exe
  C:\Windows\System\RANgvgu.exe
  2⤵
  PID:5812
- C:\Windows\System\VyuybYo.exe
  C:\Windows\System\VyuybYo.exe
  2⤵
  PID:5864
- C:\Windows\System\sZTCpvI.exe
  C:\Windows\System\sZTCpvI.exe
  2⤵
  PID:5920
- C:\Windows\System\WBBKpXj.exe
  C:\Windows\System\WBBKpXj.exe
  2⤵
  PID:5976
- C:\Windows\System\SAvUKvy.exe
  C:\Windows\System\SAvUKvy.exe
  2⤵
  PID:6060
- C:\Windows\System\BBIgTJV.exe
  C:\Windows\System\BBIgTJV.exe
  2⤵
  PID:6100
- C:\Windows\System\NEqDkQt.exe
  C:\Windows\System\NEqDkQt.exe
  2⤵
  PID:764
- C:\Windows\System\JUfRxkl.exe
  C:\Windows\System\JUfRxkl.exe
  2⤵
  PID:4588
- C:\Windows\System\ikFuUhe.exe
  C:\Windows\System\ikFuUhe.exe
  2⤵
  PID:4740
- C:\Windows\System\ZrcaZTz.exe
  C:\Windows\System\ZrcaZTz.exe
  2⤵
  PID:4476
- C:\Windows\System\QFeimVu.exe
  C:\Windows\System\QFeimVu.exe
  2⤵
  PID:2596
- C:\Windows\System\mYwsjoo.exe
  C:\Windows\System\mYwsjoo.exe
  2⤵
  PID:2376
- C:\Windows\System\yTtPBmN.exe
  C:\Windows\System\yTtPBmN.exe
  2⤵
  PID:5492
- C:\Windows\System\sKBqqXH.exe
  C:\Windows\System\sKBqqXH.exe
  2⤵
  PID:5436
- C:\Windows\System\ewLxlxZ.exe
  C:\Windows\System\ewLxlxZ.exe
  2⤵
  PID:5364
- C:\Windows\System\mVTJTBV.exe
  C:\Windows\System\mVTJTBV.exe
  2⤵
  PID:4452
- C:\Windows\System\hPrNPlP.exe
  C:\Windows\System\hPrNPlP.exe
  2⤵
  PID:5408
- C:\Windows\System\cbYyFUN.exe
  C:\Windows\System\cbYyFUN.exe
  2⤵
  PID:5580
- C:\Windows\System\MFqZpbf.exe
  C:\Windows\System\MFqZpbf.exe
  2⤵
  PID:5800
- C:\Windows\System\YZTupls.exe
  C:\Windows\System\YZTupls.exe
  2⤵
  PID:6052
- C:\Windows\System\UvpYPWH.exe
  C:\Windows\System\UvpYPWH.exe
  2⤵
  PID:3096
- C:\Windows\System\tWIHlJk.exe
  C:\Windows\System\tWIHlJk.exe
  2⤵
  PID:4276
- C:\Windows\System\YpQqScW.exe
  C:\Windows\System\YpQqScW.exe
  2⤵
  PID:1012
- C:\Windows\System\AWEtJxJ.exe
  C:\Windows\System\AWEtJxJ.exe
  2⤵
  PID:5476
- C:\Windows\System\HOQAkzK.exe
  C:\Windows\System\HOQAkzK.exe
  2⤵
  PID:1420
- C:\Windows\System\NUsHrLd.exe
  C:\Windows\System\NUsHrLd.exe
  2⤵
  PID:5944
- C:\Windows\System\LnIQkfa.exe
  C:\Windows\System\LnIQkfa.exe
  2⤵
  PID:516
- C:\Windows\System\zPMIzRH.exe
  C:\Windows\System\zPMIzRH.exe
  2⤵
  PID:4732
- C:\Windows\System\DnKOAPS.exe
  C:\Windows\System\DnKOAPS.exe
  2⤵
  PID:2496
- C:\Windows\System\lsYEIAS.exe
  C:\Windows\System\lsYEIAS.exe
  2⤵
  PID:5212
- C:\Windows\System\kqGSMyo.exe
  C:\Windows\System\kqGSMyo.exe
  2⤵
  PID:6092
- C:\Windows\System\mIVTUgd.exe
  C:\Windows\System\mIVTUgd.exe
  2⤵
  PID:6164
- C:\Windows\System\jvudafI.exe
  C:\Windows\System\jvudafI.exe
  2⤵
  PID:6192
- C:\Windows\System\kLaHktz.exe
  C:\Windows\System\kLaHktz.exe
  2⤵
  PID:6216
- C:\Windows\System\XElGoYA.exe
  C:\Windows\System\XElGoYA.exe
  2⤵
  PID:6248
- C:\Windows\System\mFwqMbc.exe
  C:\Windows\System\mFwqMbc.exe
  2⤵
  PID:6268
- C:\Windows\System\vKyrvFC.exe
  C:\Windows\System\vKyrvFC.exe
  2⤵
  PID:6284
- C:\Windows\System\zPzUxTU.exe
  C:\Windows\System\zPzUxTU.exe
  2⤵
  PID:6304
- C:\Windows\System\vOCQayl.exe
  C:\Windows\System\vOCQayl.exe
  2⤵
  PID:6356
- C:\Windows\System\dVKbBvc.exe
  C:\Windows\System\dVKbBvc.exe
  2⤵
  PID:6376
- C:\Windows\System\DZYMyIH.exe
  C:\Windows\System\DZYMyIH.exe
  2⤵
  PID:6416
- C:\Windows\System\lsPXBzZ.exe
  C:\Windows\System\lsPXBzZ.exe
  2⤵
  PID:6432
- C:\Windows\System\QiMLyFH.exe
  C:\Windows\System\QiMLyFH.exe
  2⤵
  PID:6456
- C:\Windows\System\pLCJueM.exe
  C:\Windows\System\pLCJueM.exe
  2⤵
  PID:6484
- C:\Windows\System\UrRTIqd.exe
  C:\Windows\System\UrRTIqd.exe
  2⤵
  PID:6516
- C:\Windows\System\MWOeBVU.exe
  C:\Windows\System\MWOeBVU.exe
  2⤵
  PID:6536
- C:\Windows\System\ScoEKNQ.exe
  C:\Windows\System\ScoEKNQ.exe
  2⤵
  PID:6560
- C:\Windows\System\mfkVWDD.exe
  C:\Windows\System\mfkVWDD.exe
  2⤵
  PID:6584
- C:\Windows\System\txuqoFQ.exe
  C:\Windows\System\txuqoFQ.exe
  2⤵
  PID:6616
- C:\Windows\System\hUcnQUa.exe
  C:\Windows\System\hUcnQUa.exe
  2⤵
  PID:6632
- C:\Windows\System\FarfVnT.exe
  C:\Windows\System\FarfVnT.exe
  2⤵
  PID:6660
- C:\Windows\System\rPcqGxM.exe
  C:\Windows\System\rPcqGxM.exe
  2⤵
  PID:6684
- C:\Windows\System\HvZYlht.exe
  C:\Windows\System\HvZYlht.exe
  2⤵
  PID:6720
- C:\Windows\System\oORbTvC.exe
  C:\Windows\System\oORbTvC.exe
  2⤵
  PID:6760
- C:\Windows\System\oaBARXJ.exe
  C:\Windows\System\oaBARXJ.exe
  2⤵
  PID:6780
- C:\Windows\System\urBAxzj.exe
  C:\Windows\System\urBAxzj.exe
  2⤵
  PID:6804
- C:\Windows\System\zXHJZic.exe
  C:\Windows\System\zXHJZic.exe
  2⤵
  PID:6848
- C:\Windows\System\hFyHKeu.exe
  C:\Windows\System\hFyHKeu.exe
  2⤵
  PID:6904
- C:\Windows\System\hAVxmOA.exe
  C:\Windows\System\hAVxmOA.exe
  2⤵
  PID:6924
- C:\Windows\System\aiWsFtu.exe
  C:\Windows\System\aiWsFtu.exe
  2⤵
  PID:6948
- C:\Windows\System\KXGosBg.exe
  C:\Windows\System\KXGosBg.exe
  2⤵
  PID:6980
- C:\Windows\System\WsWAjgm.exe
  C:\Windows\System\WsWAjgm.exe
  2⤵
  PID:7008
- C:\Windows\System\cpSjUbQ.exe
  C:\Windows\System\cpSjUbQ.exe
  2⤵
  PID:7036
- C:\Windows\System\KfzKixt.exe
  C:\Windows\System\KfzKixt.exe
  2⤵
  PID:7060
- C:\Windows\System\kXfxPSY.exe
  C:\Windows\System\kXfxPSY.exe
  2⤵
  PID:7096
- C:\Windows\System\mkHmobu.exe
  C:\Windows\System\mkHmobu.exe
  2⤵
  PID:7120
- C:\Windows\System\fbagPJG.exe
  C:\Windows\System\fbagPJG.exe
  2⤵
  PID:7140
- C:\Windows\System\BKRoIgG.exe
  C:\Windows\System\BKRoIgG.exe
  2⤵
  PID:7164
- C:\Windows\System\XflfRYK.exe
  C:\Windows\System\XflfRYK.exe
  2⤵
  PID:6188
- C:\Windows\System\mUJVKtw.exe
  C:\Windows\System\mUJVKtw.exe
  2⤵
  PID:6228
- C:\Windows\System\peNUvuu.exe
  C:\Windows\System\peNUvuu.exe
  2⤵
  PID:6292
- C:\Windows\System\NvFMToL.exe
  C:\Windows\System\NvFMToL.exe
  2⤵
  PID:6348
- C:\Windows\System\GXLmsfV.exe
  C:\Windows\System\GXLmsfV.exe
  2⤵
  PID:6428
- C:\Windows\System\MRDFCvu.exe
  C:\Windows\System\MRDFCvu.exe
  2⤵
  PID:6452
- C:\Windows\System\RRKdGUv.exe
  C:\Windows\System\RRKdGUv.exe
  2⤵
  PID:6500
- C:\Windows\System\YYshlVl.exe
  C:\Windows\System\YYshlVl.exe
  2⤵
  PID:6624
- C:\Windows\System\vyVanJn.exe
  C:\Windows\System\vyVanJn.exe
  2⤵
  PID:6668
- C:\Windows\System\jBxWbBZ.exe
  C:\Windows\System\jBxWbBZ.exe
  2⤵
  PID:6748
- C:\Windows\System\bPAYLEG.exe
  C:\Windows\System\bPAYLEG.exe
  2⤵
  PID:6900
- C:\Windows\System\XtYTkgD.exe
  C:\Windows\System\XtYTkgD.exe
  2⤵
  PID:7000
- C:\Windows\System\pGEPzAP.exe
  C:\Windows\System\pGEPzAP.exe
  2⤵
  PID:7048
- C:\Windows\System\jZJHfcW.exe
  C:\Windows\System\jZJHfcW.exe
  2⤵
  PID:7108
- C:\Windows\System\hQKtsuE.exe
  C:\Windows\System\hQKtsuE.exe
  2⤵
  PID:7152
- C:\Windows\System\nEaOPUs.exe
  C:\Windows\System\nEaOPUs.exe
  2⤵
  PID:6328
- C:\Windows\System\DBwzWyR.exe
  C:\Windows\System\DBwzWyR.exe
  2⤵
  PID:6444
- C:\Windows\System\lkjwuIT.exe
  C:\Windows\System\lkjwuIT.exe
  2⤵
  PID:6680
- C:\Windows\System\WyzPlin.exe
  C:\Windows\System\WyzPlin.exe
  2⤵
  PID:6820
- C:\Windows\System\hAFFpBQ.exe
  C:\Windows\System\hAFFpBQ.exe
  2⤵
  PID:6756
- C:\Windows\System\LVMZnsi.exe
  C:\Windows\System\LVMZnsi.exe
  2⤵
  PID:6944
- C:\Windows\System\hEoCBeS.exe
  C:\Windows\System\hEoCBeS.exe
  2⤵
  PID:6204
- C:\Windows\System\LlVXqYW.exe
  C:\Windows\System\LlVXqYW.exe
  2⤵
  PID:6232
- C:\Windows\System\vBUNgmS.exe
  C:\Windows\System\vBUNgmS.exe
  2⤵
  PID:6772
- C:\Windows\System\pXsYiZG.exe
  C:\Windows\System\pXsYiZG.exe
  2⤵
  PID:4296
- C:\Windows\System\XAkCCMj.exe
  C:\Windows\System\XAkCCMj.exe
  2⤵
  PID:6552
- C:\Windows\System\spIeQZB.exe
  C:\Windows\System\spIeQZB.exe
  2⤵
  PID:6844
- C:\Windows\System\InujEwF.exe
  C:\Windows\System\InujEwF.exe
  2⤵
  PID:7196
- C:\Windows\System\qrNiYMo.exe
  C:\Windows\System\qrNiYMo.exe
  2⤵
  PID:7224
- C:\Windows\System\kGWzdHu.exe
  C:\Windows\System\kGWzdHu.exe
  2⤵
  PID:7260
- C:\Windows\System\kiLXqru.exe
  C:\Windows\System\kiLXqru.exe
  2⤵
  PID:7284
- C:\Windows\System\APMTbhk.exe
  C:\Windows\System\APMTbhk.exe
  2⤵
  PID:7308
- C:\Windows\System\hgWcpLp.exe
  C:\Windows\System\hgWcpLp.exe
  2⤵
  PID:7340
- C:\Windows\System\cEprSXp.exe
  C:\Windows\System\cEprSXp.exe
  2⤵
  PID:7364
- C:\Windows\System\UnbDTgS.exe
  C:\Windows\System\UnbDTgS.exe
  2⤵
  PID:7404
- C:\Windows\System\JQLRSEj.exe
  C:\Windows\System\JQLRSEj.exe
  2⤵
  PID:7420
- C:\Windows\System\ydqySfm.exe
  C:\Windows\System\ydqySfm.exe
  2⤵
  PID:7444
- C:\Windows\System\BFkAxMO.exe
  C:\Windows\System\BFkAxMO.exe
  2⤵
  PID:7472
- C:\Windows\System\xJRiDkV.exe
  C:\Windows\System\xJRiDkV.exe
  2⤵
  PID:7500
- C:\Windows\System\YyBIKjb.exe
  C:\Windows\System\YyBIKjb.exe
  2⤵
  PID:7524
- C:\Windows\System\orpaXrI.exe
  C:\Windows\System\orpaXrI.exe
  2⤵
  PID:7544
- C:\Windows\System\aJpESQq.exe
  C:\Windows\System\aJpESQq.exe
  2⤵
  PID:7584
- C:\Windows\System\mBZPlai.exe
  C:\Windows\System\mBZPlai.exe
  2⤵
  PID:7612
- C:\Windows\System\PhqckZk.exe
  C:\Windows\System\PhqckZk.exe
  2⤵
  PID:7636
- C:\Windows\System\GFhQdvL.exe
  C:\Windows\System\GFhQdvL.exe
  2⤵
  PID:7680
- C:\Windows\System\UYiXauJ.exe
  C:\Windows\System\UYiXauJ.exe
  2⤵
  PID:7704
- C:\Windows\System\hVmitMw.exe
  C:\Windows\System\hVmitMw.exe
  2⤵
  PID:7732
- C:\Windows\System\KwobcmW.exe
  C:\Windows\System\KwobcmW.exe
  2⤵
  PID:7760
- C:\Windows\System\HguZTOD.exe
  C:\Windows\System\HguZTOD.exe
  2⤵
  PID:7776
- C:\Windows\System\ZeRYJSL.exe
  C:\Windows\System\ZeRYJSL.exe
  2⤵
  PID:7824
- C:\Windows\System\cdKamFk.exe
  C:\Windows\System\cdKamFk.exe
  2⤵
  PID:7844
- C:\Windows\System\VuYfFwj.exe
  C:\Windows\System\VuYfFwj.exe
  2⤵
  PID:7860
- C:\Windows\System\euvMbBM.exe
  C:\Windows\System\euvMbBM.exe
  2⤵
  PID:7888
- C:\Windows\System\nQIYDZC.exe
  C:\Windows\System\nQIYDZC.exe
  2⤵
  PID:7940
- C:\Windows\System\JlMURWK.exe
  C:\Windows\System\JlMURWK.exe
  2⤵
  PID:7964
- C:\Windows\System\TkMydGw.exe
  C:\Windows\System\TkMydGw.exe
  2⤵
  PID:8004
- C:\Windows\System\IIpySJt.exe
  C:\Windows\System\IIpySJt.exe
  2⤵
  PID:8024
- C:\Windows\System\yQtZNwf.exe
  C:\Windows\System\yQtZNwf.exe
  2⤵
  PID:8064
- C:\Windows\System\HSwzRkq.exe
  C:\Windows\System\HSwzRkq.exe
  2⤵
  PID:8080
- C:\Windows\System\ZdZiYoI.exe
  C:\Windows\System\ZdZiYoI.exe
  2⤵
  PID:8108
- C:\Windows\System\wZAyyLq.exe
  C:\Windows\System\wZAyyLq.exe
  2⤵
  PID:8128
- C:\Windows\System\itIFmjH.exe
  C:\Windows\System\itIFmjH.exe
  2⤵
  PID:8148
- C:\Windows\System\vxrHRaw.exe
  C:\Windows\System\vxrHRaw.exe
  2⤵
  PID:8180
- C:\Windows\System\XlOlpof.exe
  C:\Windows\System\XlOlpof.exe
  2⤵
  PID:6708
- C:\Windows\System\rpcCuiQ.exe
  C:\Windows\System\rpcCuiQ.exe
  2⤵
  PID:7220
- C:\Windows\System\fkQARgS.exe
  C:\Windows\System\fkQARgS.exe
  2⤵
  PID:7332
- C:\Windows\System\ViQkjpC.exe
  C:\Windows\System\ViQkjpC.exe
  2⤵
  PID:7376
- C:\Windows\System\PfSdnnO.exe
  C:\Windows\System\PfSdnnO.exe
  2⤵
  PID:7512
- C:\Windows\System\zbIIPAB.exe
  C:\Windows\System\zbIIPAB.exe
  2⤵
  PID:7468
- C:\Windows\System\uEisNkq.exe
  C:\Windows\System\uEisNkq.exe
  2⤵
  PID:7540
- C:\Windows\System\bmQSZhn.exe
  C:\Windows\System\bmQSZhn.exe
  2⤵
  PID:7620
- C:\Windows\System\ZSUdLfn.exe
  C:\Windows\System\ZSUdLfn.exe
  2⤵
  PID:7648
- C:\Windows\System\EzltyFM.exe
  C:\Windows\System\EzltyFM.exe
  2⤵
  PID:7724
- C:\Windows\System\wMuDTpb.exe
  C:\Windows\System\wMuDTpb.exe
  2⤵
  PID:7728
- C:\Windows\System\LepnnHR.exe
  C:\Windows\System\LepnnHR.exe
  2⤵
  PID:7808
- C:\Windows\System\YRLHUOK.exe
  C:\Windows\System\YRLHUOK.exe
  2⤵
  PID:7996
- C:\Windows\System\bUwKWCL.exe
  C:\Windows\System\bUwKWCL.exe
  2⤵
  PID:8056
- C:\Windows\System\uVbrGgK.exe
  C:\Windows\System\uVbrGgK.exe
  2⤵
  PID:8124
- C:\Windows\System\UQPjPRJ.exe
  C:\Windows\System\UQPjPRJ.exe
  2⤵
  PID:7128
- C:\Windows\System\qyBOKDC.exe
  C:\Windows\System\qyBOKDC.exe
  2⤵
  PID:7356
- C:\Windows\System\NeaibAK.exe
  C:\Windows\System\NeaibAK.exe
  2⤵
  PID:7440
- C:\Windows\System\qmUHuly.exe
  C:\Windows\System\qmUHuly.exe
  2⤵
  PID:7536
- C:\Windows\System\kVqDJkB.exe
  C:\Windows\System\kVqDJkB.exe
  2⤵
  PID:7596
- C:\Windows\System\vbLyZsA.exe
  C:\Windows\System\vbLyZsA.exe
  2⤵
  PID:7752
- C:\Windows\System\scjvtEn.exe
  C:\Windows\System\scjvtEn.exe
  2⤵
  PID:7856
- C:\Windows\System\djDJIjh.exe
  C:\Windows\System\djDJIjh.exe
  2⤵
  PID:8044
- C:\Windows\System\cgpfngC.exe
  C:\Windows\System\cgpfngC.exe
  2⤵
  PID:7296
- C:\Windows\System\uqdtXXC.exe
  C:\Windows\System\uqdtXXC.exe
  2⤵
  PID:7400
- C:\Windows\System\CyzShLp.exe
  C:\Windows\System\CyzShLp.exe
  2⤵
  PID:7876
- C:\Windows\System\OYKpPGA.exe
  C:\Windows\System\OYKpPGA.exe
  2⤵
  PID:7488
- C:\Windows\System\eLyGtof.exe
  C:\Windows\System\eLyGtof.exe
  2⤵
  PID:8212
- C:\Windows\System\fbVcUaC.exe
  C:\Windows\System\fbVcUaC.exe
  2⤵
  PID:8232
- C:\Windows\System\DgKRdgw.exe
  C:\Windows\System\DgKRdgw.exe
  2⤵
  PID:8260
- C:\Windows\System\cRTqQNU.exe
  C:\Windows\System\cRTqQNU.exe
  2⤵
  PID:8292
- C:\Windows\System\nNfdMSQ.exe
  C:\Windows\System\nNfdMSQ.exe
  2⤵
  PID:8312
- C:\Windows\System\lodYkJG.exe
  C:\Windows\System\lodYkJG.exe
  2⤵
  PID:8344
- C:\Windows\System\rqTBUOW.exe
  C:\Windows\System\rqTBUOW.exe
  2⤵
  PID:8400
- C:\Windows\System\vbebSlZ.exe
  C:\Windows\System\vbebSlZ.exe
  2⤵
  PID:8416
- C:\Windows\System\xPVpOPF.exe
  C:\Windows\System\xPVpOPF.exe
  2⤵
  PID:8432
- C:\Windows\System\pkyAvJd.exe
  C:\Windows\System\pkyAvJd.exe
  2⤵
  PID:8452
- C:\Windows\System\VelLhNl.exe
  C:\Windows\System\VelLhNl.exe
  2⤵
  PID:8472
- C:\Windows\System\hsiZyFK.exe
  C:\Windows\System\hsiZyFK.exe
  2⤵
  PID:8496
- C:\Windows\System\bQAQowf.exe
  C:\Windows\System\bQAQowf.exe
  2⤵
  PID:8560
- C:\Windows\System\HYviodh.exe
  C:\Windows\System\HYviodh.exe
  2⤵
  PID:8592
- C:\Windows\System\waNZTOa.exe
  C:\Windows\System\waNZTOa.exe
  2⤵
  PID:8636
- C:\Windows\System\BldYCas.exe
  C:\Windows\System\BldYCas.exe
  2⤵
  PID:8664
- C:\Windows\System\uJqOCPi.exe
  C:\Windows\System\uJqOCPi.exe
  2⤵
  PID:8692
- C:\Windows\System\KDHZCKl.exe
  C:\Windows\System\KDHZCKl.exe
  2⤵
  PID:8708
- C:\Windows\System\MDyYmUh.exe
  C:\Windows\System\MDyYmUh.exe
  2⤵
  PID:8748
- C:\Windows\System\PRQTaEa.exe
  C:\Windows\System\PRQTaEa.exe
  2⤵
  PID:8764
- C:\Windows\System\axunLUN.exe
  C:\Windows\System\axunLUN.exe
  2⤵
  PID:8780
- C:\Windows\System\sSXipXp.exe
  C:\Windows\System\sSXipXp.exe
  2⤵
  PID:8804
- C:\Windows\System\TEuVSXe.exe
  C:\Windows\System\TEuVSXe.exe
  2⤵
  PID:8832
- C:\Windows\System\SbfcjDj.exe
  C:\Windows\System\SbfcjDj.exe
  2⤵
  PID:8888
- C:\Windows\System\uEgQxPG.exe
  C:\Windows\System\uEgQxPG.exe
  2⤵
  PID:8904
- C:\Windows\System\GBCHBUz.exe
  C:\Windows\System\GBCHBUz.exe
  2⤵
  PID:8928
- C:\Windows\System\dttxFCF.exe
  C:\Windows\System\dttxFCF.exe
  2⤵
  PID:8960
- C:\Windows\System\AOmlYig.exe
  C:\Windows\System\AOmlYig.exe
  2⤵
  PID:8976
- C:\Windows\System\jCUZjuc.exe
  C:\Windows\System\jCUZjuc.exe
  2⤵
  PID:9004
- C:\Windows\System\XUGAjnY.exe
  C:\Windows\System\XUGAjnY.exe
  2⤵
  PID:9056
- C:\Windows\System\sxYICOo.exe
  C:\Windows\System\sxYICOo.exe
  2⤵
  PID:9076
- C:\Windows\System\YFOfBYE.exe
  C:\Windows\System\YFOfBYE.exe
  2⤵
  PID:9100
- C:\Windows\System\dJSGLuF.exe
  C:\Windows\System\dJSGLuF.exe
  2⤵
  PID:9120
- C:\Windows\System\gDZwdJH.exe
  C:\Windows\System\gDZwdJH.exe
  2⤵
  PID:9148
- C:\Windows\System\BhqGczB.exe
  C:\Windows\System\BhqGczB.exe
  2⤵
  PID:9176
- C:\Windows\System\yFVkdfF.exe
  C:\Windows\System\yFVkdfF.exe
  2⤵
  PID:7608
- C:\Windows\System\oIaFaCO.exe
  C:\Windows\System\oIaFaCO.exe
  2⤵
  PID:7936
- C:\Windows\System\coGKKWC.exe
  C:\Windows\System\coGKKWC.exe
  2⤵
  PID:8276
- C:\Windows\System\qWDIzRg.exe
  C:\Windows\System\qWDIzRg.exe
  2⤵
  PID:8368
- C:\Windows\System\eFitemV.exe
  C:\Windows\System\eFitemV.exe
  2⤵
  PID:8440
- C:\Windows\System\DVUEQEd.exe
  C:\Windows\System\DVUEQEd.exe
  2⤵
  PID:8484
- C:\Windows\System\yUEbbhR.exe
  C:\Windows\System\yUEbbhR.exe
  2⤵
  PID:8492
- C:\Windows\System\ZsyDmPs.exe
  C:\Windows\System\ZsyDmPs.exe
  2⤵
  PID:8620
- C:\Windows\System\yjSzhyN.exe
  C:\Windows\System\yjSzhyN.exe
  2⤵
  PID:8688
- C:\Windows\System\KDcETJf.exe
  C:\Windows\System\KDcETJf.exe
  2⤵
  PID:8728
- C:\Windows\System\NPBJDxk.exe
  C:\Windows\System\NPBJDxk.exe
  2⤵
  PID:8772
- C:\Windows\System\fzNkDae.exe
  C:\Windows\System\fzNkDae.exe
  2⤵
  PID:8884
- C:\Windows\System\esCNbAZ.exe
  C:\Windows\System\esCNbAZ.exe
  2⤵
  PID:8940
- C:\Windows\System\SHnFovm.exe
  C:\Windows\System\SHnFovm.exe
  2⤵
  PID:8988
- C:\Windows\System\HJgcHud.exe
  C:\Windows\System\HJgcHud.exe
  2⤵
  PID:9072
- C:\Windows\System\dkWHAyv.exe
  C:\Windows\System\dkWHAyv.exe
  2⤵
  PID:9116
- C:\Windows\System\kslLzUB.exe
  C:\Windows\System\kslLzUB.exe
  2⤵
  PID:9188
- C:\Windows\System\LIDylie.exe
  C:\Windows\System\LIDylie.exe
  2⤵
  PID:8248
- C:\Windows\System\UuMaTKP.exe
  C:\Windows\System\UuMaTKP.exe
  2⤵
  PID:8588
- C:\Windows\System\WxlAgyJ.exe
  C:\Windows\System\WxlAgyJ.exe
  2⤵
  PID:8656
- C:\Windows\System\xVnfVxU.exe
  C:\Windows\System\xVnfVxU.exe
  2⤵
  PID:8820
- C:\Windows\System\oSezWie.exe
  C:\Windows\System\oSezWie.exe
  2⤵
  PID:8936
- C:\Windows\System\izYhotH.exe
  C:\Windows\System\izYhotH.exe
  2⤵
  PID:9136
- C:\Windows\System\mUwbCnL.exe
  C:\Windows\System\mUwbCnL.exe
  2⤵
  PID:9096
- C:\Windows\System\wcHbIDq.exe
  C:\Windows\System\wcHbIDq.exe
  2⤵
  PID:8548
- C:\Windows\System\jweUnjL.exe
  C:\Windows\System\jweUnjL.exe
  2⤵
  PID:8756
- C:\Windows\System\cmhRLkJ.exe
  C:\Windows\System\cmhRLkJ.exe
  2⤵
  PID:9200
- C:\Windows\System\Cwmspxh.exe
  C:\Windows\System\Cwmspxh.exe
  2⤵
  PID:8792
- C:\Windows\System\qNeGTfm.exe
  C:\Windows\System\qNeGTfm.exe
  2⤵
  PID:9232
- C:\Windows\System\kkIVHgY.exe
  C:\Windows\System\kkIVHgY.exe
  2⤵
  PID:9248
- C:\Windows\System\IUKPPjb.exe
  C:\Windows\System\IUKPPjb.exe
  2⤵
  PID:9276
- C:\Windows\System\BOuBlvg.exe
  C:\Windows\System\BOuBlvg.exe
  2⤵
  PID:9304
- C:\Windows\System\XqEQwbH.exe
  C:\Windows\System\XqEQwbH.exe
  2⤵
  PID:9320
- C:\Windows\System\acBhQye.exe
  C:\Windows\System\acBhQye.exe
  2⤵
  PID:9340
- C:\Windows\System\qYVNWEq.exe
  C:\Windows\System\qYVNWEq.exe
  2⤵
  PID:9380
- C:\Windows\System\UyIpndJ.exe
  C:\Windows\System\UyIpndJ.exe
  2⤵
  PID:9412
- C:\Windows\System\uutkVqm.exe
  C:\Windows\System\uutkVqm.exe
  2⤵
  PID:9444
- C:\Windows\System\dlmelHq.exe
  C:\Windows\System\dlmelHq.exe
  2⤵
  PID:9460
- C:\Windows\System\jVneazc.exe
  C:\Windows\System\jVneazc.exe
  2⤵
  PID:9496
- C:\Windows\System\JjatPdd.exe
  C:\Windows\System\JjatPdd.exe
  2⤵
  PID:9528
- C:\Windows\System\fOIxlnX.exe
  C:\Windows\System\fOIxlnX.exe
  2⤵
  PID:9556
- C:\Windows\System\nAZHwQu.exe
  C:\Windows\System\nAZHwQu.exe
  2⤵
  PID:9576
- C:\Windows\System\dgSQSAw.exe
  C:\Windows\System\dgSQSAw.exe
  2⤵
  PID:9604
- C:\Windows\System\nrpXIZt.exe
  C:\Windows\System\nrpXIZt.exe
  2⤵
  PID:9628
- C:\Windows\System\GZYeZKq.exe
  C:\Windows\System\GZYeZKq.exe
  2⤵
  PID:9680
- C:\Windows\System\UfvMflI.exe
  C:\Windows\System\UfvMflI.exe
  2⤵
  PID:9704
- C:\Windows\System\JGZTzKO.exe
  C:\Windows\System\JGZTzKO.exe
  2⤵
  PID:9724
- C:\Windows\System\XZNqRXz.exe
  C:\Windows\System\XZNqRXz.exe
  2⤵
  PID:9764
- C:\Windows\System\YGKCfvB.exe
  C:\Windows\System\YGKCfvB.exe
  2⤵
  PID:9792
- C:\Windows\System\UxNxgPq.exe
  C:\Windows\System\UxNxgPq.exe
  2⤵
  PID:9812
- C:\Windows\System\xoSuiND.exe
  C:\Windows\System\xoSuiND.exe
  2⤵
  PID:9836
- C:\Windows\System\WDTWqWE.exe
  C:\Windows\System\WDTWqWE.exe
  2⤵
  PID:9864
- C:\Windows\System\lokxjKU.exe
  C:\Windows\System\lokxjKU.exe
  2⤵
  PID:9892
- C:\Windows\System\UFdiNGR.exe
  C:\Windows\System\UFdiNGR.exe
  2⤵
  PID:9916
- C:\Windows\System\kRGcjry.exe
  C:\Windows\System\kRGcjry.exe
  2⤵
  PID:9936
- C:\Windows\System\SRlsSGl.exe
  C:\Windows\System\SRlsSGl.exe
  2⤵
  PID:9952
- C:\Windows\System\sTPNPXh.exe
  C:\Windows\System\sTPNPXh.exe
  2⤵
  PID:10008
- C:\Windows\System\igfLZIn.exe
  C:\Windows\System\igfLZIn.exe
  2⤵
  PID:10032
- C:\Windows\System\jLtKtRK.exe
  C:\Windows\System\jLtKtRK.exe
  2⤵
  PID:10056
- C:\Windows\System\okLFuPK.exe
  C:\Windows\System\okLFuPK.exe
  2⤵
  PID:10100
- C:\Windows\System\qaVzliJ.exe
  C:\Windows\System\qaVzliJ.exe
  2⤵
  PID:10116
- C:\Windows\System\LzACNgj.exe
  C:\Windows\System\LzACNgj.exe
  2⤵
  PID:10156
- C:\Windows\System\ZKjcaGC.exe
  C:\Windows\System\ZKjcaGC.exe
  2⤵
  PID:10172
- C:\Windows\System\TlavqlP.exe
  C:\Windows\System\TlavqlP.exe
  2⤵
  PID:10192
- C:\Windows\System\ozGaFwe.exe
  C:\Windows\System\ozGaFwe.exe
  2⤵
  PID:10212
- C:\Windows\System\eoQDSQU.exe
  C:\Windows\System\eoQDSQU.exe
  2⤵
  PID:9220
- C:\Windows\System\YlKawEP.exe
  C:\Windows\System\YlKawEP.exe
  2⤵
  PID:9300
- C:\Windows\System\odZepMG.exe
  C:\Windows\System\odZepMG.exe
  2⤵
  PID:9356
- C:\Windows\System\mmiAumA.exe
  C:\Windows\System\mmiAumA.exe
  2⤵
  PID:9456
- C:\Windows\System\FzUAWkB.exe
  C:\Windows\System\FzUAWkB.exe
  2⤵
  PID:9520
- C:\Windows\System\TRkffFr.exe
  C:\Windows\System\TRkffFr.exe
  2⤵
  PID:9572
- C:\Windows\System\oRCsLEE.exe
  C:\Windows\System\oRCsLEE.exe
  2⤵
  PID:9672
- C:\Windows\System\XsSdewB.exe
  C:\Windows\System\XsSdewB.exe
  2⤵
  PID:9752
- C:\Windows\System\OOuspEg.exe
  C:\Windows\System\OOuspEg.exe
  2⤵
  PID:9780
- C:\Windows\System\BXSdcsS.exe
  C:\Windows\System\BXSdcsS.exe
  2⤵
  PID:9828
- C:\Windows\System\qmBGVvP.exe
  C:\Windows\System\qmBGVvP.exe
  2⤵
  PID:9908
- C:\Windows\System\NEUqtmg.exe
  C:\Windows\System\NEUqtmg.exe
  2⤵
  PID:9988
- C:\Windows\System\IbYbezB.exe
  C:\Windows\System\IbYbezB.exe
  2⤵
  PID:10024
- C:\Windows\System\jrszlVU.exe
  C:\Windows\System\jrszlVU.exe
  2⤵
  PID:10072
- C:\Windows\System\EcGRJZs.exe
  C:\Windows\System\EcGRJZs.exe
  2⤵
  PID:10168
- C:\Windows\System\SqnWghN.exe
  C:\Windows\System\SqnWghN.exe
  2⤵
  PID:10236
- C:\Windows\System\IJUQFab.exe
  C:\Windows\System\IJUQFab.exe
  2⤵
  PID:9348
- C:\Windows\System\tQsdpbF.exe
  C:\Windows\System\tQsdpbF.exe
  2⤵
  PID:9436
- C:\Windows\System\CHweXcp.exe
  C:\Windows\System\CHweXcp.exe
  2⤵
  PID:9484
- C:\Windows\System\ggVFDQH.exe
  C:\Windows\System\ggVFDQH.exe
  2⤵
  PID:9776
- C:\Windows\System\LDGiddZ.exe
  C:\Windows\System\LDGiddZ.exe
  2⤵
  PID:9944
- C:\Windows\System\fDzZGNz.exe
  C:\Windows\System\fDzZGNz.exe
  2⤵
  PID:10088
- C:\Windows\System\hxXgDgI.exe
  C:\Windows\System\hxXgDgI.exe
  2⤵
  PID:10220
- C:\Windows\System\KcXJRxJ.exe
  C:\Windows\System\KcXJRxJ.exe
  2⤵
  PID:9664
- C:\Windows\System\GgyTioX.exe
  C:\Windows\System\GgyTioX.exe
  2⤵
  PID:9720
- C:\Windows\System\hgWwYSP.exe
  C:\Windows\System\hgWwYSP.exe
  2⤵
  PID:10208
- C:\Windows\System\alNNONT.exe
  C:\Windows\System\alNNONT.exe
  2⤵
  PID:10244
- C:\Windows\System\wXApLqL.exe
  C:\Windows\System\wXApLqL.exe
  2⤵
  PID:10268
- C:\Windows\System\RrPsmtH.exe
  C:\Windows\System\RrPsmtH.exe
  2⤵
  PID:10292
- C:\Windows\System\VGxjRGA.exe
  C:\Windows\System\VGxjRGA.exe
  2⤵
  PID:10308
- C:\Windows\System\zwPzoYh.exe
  C:\Windows\System\zwPzoYh.exe
  2⤵
  PID:10352
- C:\Windows\System\xNNHMPp.exe
  C:\Windows\System\xNNHMPp.exe
  2⤵
  PID:10372
- C:\Windows\System\bwODkqQ.exe
  C:\Windows\System\bwODkqQ.exe
  2⤵
  PID:10392
- C:\Windows\System\yKFlNBg.exe
  C:\Windows\System\yKFlNBg.exe
  2⤵
  PID:10456
- C:\Windows\System\MkkNYIb.exe
  C:\Windows\System\MkkNYIb.exe
  2⤵
  PID:10472
- C:\Windows\System\fVJvfBn.exe
  C:\Windows\System\fVJvfBn.exe
  2⤵
  PID:10512
- C:\Windows\System\dmkgiIV.exe
  C:\Windows\System\dmkgiIV.exe
  2⤵
  PID:10536
- C:\Windows\System\eenpdVr.exe
  C:\Windows\System\eenpdVr.exe
  2⤵
  PID:10556
- C:\Windows\System\PciNAIt.exe
  C:\Windows\System\PciNAIt.exe
  2⤵
  PID:10576
- C:\Windows\System\RqRthqD.exe
  C:\Windows\System\RqRthqD.exe
  2⤵
  PID:10624
- C:\Windows\System\MUAfGyU.exe
  C:\Windows\System\MUAfGyU.exe
  2⤵
  PID:10640
- C:\Windows\System\NfIFhzS.exe
  C:\Windows\System\NfIFhzS.exe
  2⤵
  PID:10668
- C:\Windows\System\xDBVqMX.exe
  C:\Windows\System\xDBVqMX.exe
  2⤵
  PID:10704
- C:\Windows\System\HiRRPJt.exe
  C:\Windows\System\HiRRPJt.exe
  2⤵
  PID:10724
- C:\Windows\System\WMtiecN.exe
  C:\Windows\System\WMtiecN.exe
  2⤵
  PID:10744
- C:\Windows\System\euRPGIH.exe
  C:\Windows\System\euRPGIH.exe
  2⤵
  PID:10764
- C:\Windows\System\rXKFAli.exe
  C:\Windows\System\rXKFAli.exe
  2⤵
  PID:10796
- C:\Windows\System\dtwqNOr.exe
  C:\Windows\System\dtwqNOr.exe
  2⤵
  PID:10824
- C:\Windows\System\nTWxRcv.exe
  C:\Windows\System\nTWxRcv.exe
  2⤵
  PID:10868
- C:\Windows\System\yIOpYvP.exe
  C:\Windows\System\yIOpYvP.exe
  2⤵
  PID:10900
- C:\Windows\System\nEcFbBI.exe
  C:\Windows\System\nEcFbBI.exe
  2⤵
  PID:10920
- C:\Windows\System\ZFyTfci.exe
  C:\Windows\System\ZFyTfci.exe
  2⤵
  PID:10948
- C:\Windows\System\NQHPqFn.exe
  C:\Windows\System\NQHPqFn.exe
  2⤵
  PID:10972
- C:\Windows\System\LdwUAMu.exe
  C:\Windows\System\LdwUAMu.exe
  2⤵
  PID:10992
- C:\Windows\System\wCrkGBi.exe
  C:\Windows\System\wCrkGBi.exe
  2⤵
  PID:11012
- C:\Windows\System\Emltflr.exe
  C:\Windows\System\Emltflr.exe
  2⤵
  PID:11052
- C:\Windows\System\KjoDBQB.exe
  C:\Windows\System\KjoDBQB.exe
  2⤵
  PID:11084
- C:\Windows\System\ZVwvZPX.exe
  C:\Windows\System\ZVwvZPX.exe
  2⤵
  PID:11128
- C:\Windows\System\jOaWUIp.exe
  C:\Windows\System\jOaWUIp.exe
  2⤵
  PID:11144
- C:\Windows\System\ScPAEjT.exe
  C:\Windows\System\ScPAEjT.exe
  2⤵
  PID:11184
- C:\Windows\System\QwXJxPX.exe
  C:\Windows\System\QwXJxPX.exe
  2⤵
  PID:11200
- C:\Windows\System\HOvpZgV.exe
  C:\Windows\System\HOvpZgV.exe
  2⤵
  PID:11224
- C:\Windows\System\edFVOBS.exe
  C:\Windows\System\edFVOBS.exe
  2⤵
  PID:11244
- C:\Windows\System\WEfxKGt.exe
  C:\Windows\System\WEfxKGt.exe
  2⤵
  PID:10280
- C:\Windows\System\JRDYKEz.exe
  C:\Windows\System\JRDYKEz.exe
  2⤵
  PID:10276
- C:\Windows\System\rBXikfm.exe
  C:\Windows\System\rBXikfm.exe
  2⤵
  PID:10364
- C:\Windows\System\qvYoVwv.exe
  C:\Windows\System\qvYoVwv.exe
  2⤵
  PID:10420
- C:\Windows\System\ckYYydL.exe
  C:\Windows\System\ckYYydL.exe
  2⤵
  PID:10488
- C:\Windows\System\JbLftJj.exe
  C:\Windows\System\JbLftJj.exe
  2⤵
  PID:10548
- C:\Windows\System\wSXJpAC.exe
  C:\Windows\System\wSXJpAC.exe
  2⤵
  PID:10588
- C:\Windows\System\knNPMko.exe
  C:\Windows\System\knNPMko.exe
  2⤵
  PID:10652
- C:\Windows\System\iwamgfg.exe
  C:\Windows\System\iwamgfg.exe
  2⤵
  PID:10720
- C:\Windows\System\LIbRpVo.exe
  C:\Windows\System\LIbRpVo.exe
  2⤵
  PID:10808
- C:\Windows\System\PhuEWQX.exe
  C:\Windows\System\PhuEWQX.exe
  2⤵
  PID:10892
- C:\Windows\System\noVAIRu.exe
  C:\Windows\System\noVAIRu.exe
  2⤵
  PID:10940
- C:\Windows\System\xmYzPGW.exe
  C:\Windows\System\xmYzPGW.exe
  2⤵
  PID:11020
- C:\Windows\System\utiFhgK.exe
  C:\Windows\System\utiFhgK.exe
  2⤵
  PID:11044
- C:\Windows\System\ZZKEmeb.exe
  C:\Windows\System\ZZKEmeb.exe
  2⤵
  PID:11112
- C:\Windows\System\hRQpOWw.exe
  C:\Windows\System\hRQpOWw.exe
  2⤵
  PID:11140
- C:\Windows\System\CvddbnL.exe
  C:\Windows\System\CvddbnL.exe
  2⤵
  PID:11192
- C:\Windows\System\pTwKxQk.exe
  C:\Windows\System\pTwKxQk.exe
  2⤵
  PID:11256
- C:\Windows\System\xCLMwPG.exe
  C:\Windows\System\xCLMwPG.exe
  2⤵
  PID:10340
- C:\Windows\System\BLLojDA.exe
  C:\Windows\System\BLLojDA.exe
  2⤵
  PID:10432
- C:\Windows\System\QIoUMir.exe
  C:\Windows\System\QIoUMir.exe
  2⤵
  PID:10636
- C:\Windows\System\WZtlgJu.exe
  C:\Windows\System\WZtlgJu.exe
  2⤵
  PID:10716
- C:\Windows\System\JocMbXL.exe
  C:\Windows\System\JocMbXL.exe
  2⤵
  PID:10908
- C:\Windows\System\WmIfaoF.exe
  C:\Windows\System\WmIfaoF.exe
  2⤵
  PID:11040
- C:\Windows\System\HOvnAbq.exe
  C:\Windows\System\HOvnAbq.exe
  2⤵
  PID:10284
- C:\Windows\System\uFUMMYI.exe
  C:\Windows\System\uFUMMYI.exe
  2⤵
  PID:10784
- C:\Windows\System\FxvjvZu.exe
  C:\Windows\System\FxvjvZu.exe
  2⤵
  PID:10524
- C:\Windows\System\wgZKcVE.exe
  C:\Windows\System\wgZKcVE.exe
  2⤵
  PID:11272
- C:\Windows\System\uqFJFYU.exe
  C:\Windows\System\uqFJFYU.exe
  2⤵
  PID:11300
- C:\Windows\System\xthrfuU.exe
  C:\Windows\System\xthrfuU.exe
  2⤵
  PID:11316
- C:\Windows\System\vIyWGcy.exe
  C:\Windows\System\vIyWGcy.exe
  2⤵
  PID:11392
- C:\Windows\System\LHDaGYd.exe
  C:\Windows\System\LHDaGYd.exe
  2⤵
  PID:11412
- C:\Windows\System\GfbMqWd.exe
  C:\Windows\System\GfbMqWd.exe
  2⤵
  PID:11436
- C:\Windows\System\NtICbQj.exe
  C:\Windows\System\NtICbQj.exe
  2⤵
  PID:11464
- C:\Windows\System\lfyBRqp.exe
  C:\Windows\System\lfyBRqp.exe
  2⤵
  PID:11492
- C:\Windows\System\LFJoqNO.exe
  C:\Windows\System\LFJoqNO.exe
  2⤵
  PID:11516
- C:\Windows\System\dJwIMLR.exe
  C:\Windows\System\dJwIMLR.exe
  2⤵
  PID:11536
- C:\Windows\System\fGmVQdv.exe
  C:\Windows\System\fGmVQdv.exe
  2⤵
  PID:11556
- C:\Windows\System\ZotZHpK.exe
  C:\Windows\System\ZotZHpK.exe
  2⤵
  PID:11580
- C:\Windows\System\GvMOASd.exe
  C:\Windows\System\GvMOASd.exe
  2⤵
  PID:11628
- C:\Windows\System\WWvVtRF.exe
  C:\Windows\System\WWvVtRF.exe
  2⤵
  PID:11656
- C:\Windows\System\SRiRwGr.exe
  C:\Windows\System\SRiRwGr.exe
  2⤵
  PID:11676
- C:\Windows\System\pJnKSre.exe
  C:\Windows\System\pJnKSre.exe
  2⤵
  PID:11712
- C:\Windows\System\bSxbaEn.exe
  C:\Windows\System\bSxbaEn.exe
  2⤵
  PID:11744
- C:\Windows\System\WfAKsHP.exe
  C:\Windows\System\WfAKsHP.exe
  2⤵
  PID:11764
- C:\Windows\System\XYqcNPf.exe
  C:\Windows\System\XYqcNPf.exe
  2⤵
  PID:11812
- C:\Windows\System\wmINpxw.exe
  C:\Windows\System\wmINpxw.exe
  2⤵
  PID:11840
- C:\Windows\System\caNeGyg.exe
  C:\Windows\System\caNeGyg.exe
  2⤵
  PID:11856
- C:\Windows\System\VzeggmO.exe
  C:\Windows\System\VzeggmO.exe
  2⤵
  PID:11896
- C:\Windows\System\ThJfYzB.exe
  C:\Windows\System\ThJfYzB.exe
  2⤵
  PID:11912
- C:\Windows\System\xStszfw.exe
  C:\Windows\System\xStszfw.exe
  2⤵
  PID:11948
- C:\Windows\System\ggtpdsa.exe
  C:\Windows\System\ggtpdsa.exe
  2⤵
  PID:11980
- C:\Windows\System\qkizqtD.exe
  C:\Windows\System\qkizqtD.exe
  2⤵
  PID:12000
- C:\Windows\System\JmREYxz.exe
  C:\Windows\System\JmREYxz.exe
  2⤵
  PID:12020
- C:\Windows\System\HSgFxge.exe
  C:\Windows\System\HSgFxge.exe
  2⤵
  PID:12044
- C:\Windows\System\XnjSRSP.exe
  C:\Windows\System\XnjSRSP.exe
  2⤵
  PID:12068
- C:\Windows\System\GAXIwPn.exe
  C:\Windows\System\GAXIwPn.exe
  2⤵
  PID:12120
- C:\Windows\System\zWrFVME.exe
  C:\Windows\System\zWrFVME.exe
  2⤵
  PID:12144
- C:\Windows\System\fFrEWuR.exe
  C:\Windows\System\fFrEWuR.exe
  2⤵
  PID:12168
- C:\Windows\System\heBXGfv.exe
  C:\Windows\System\heBXGfv.exe
  2⤵
  PID:12208
- C:\Windows\System\rXCwieY.exe
  C:\Windows\System\rXCwieY.exe
  2⤵
  PID:12264
- C:\Windows\System\DPeTKKd.exe
  C:\Windows\System\DPeTKKd.exe
  2⤵
  PID:10960
- C:\Windows\System\CLZwsSF.exe
  C:\Windows\System\CLZwsSF.exe
  2⤵
  PID:11296
- C:\Windows\System\qDauClI.exe
  C:\Windows\System\qDauClI.exe
  2⤵
  PID:11348
- C:\Windows\System\KvwudUe.exe
  C:\Windows\System\KvwudUe.exe
  2⤵
  PID:11424
- C:\Windows\System\iaVqMkx.exe
  C:\Windows\System\iaVqMkx.exe
  2⤵
  PID:11476
- C:\Windows\System\mnvRxSQ.exe
  C:\Windows\System\mnvRxSQ.exe
  2⤵
  PID:11544
- C:\Windows\System\vLrtltd.exe
  C:\Windows\System\vLrtltd.exe
  2⤵
  PID:11572
- C:\Windows\System\CekRFaH.exe
  C:\Windows\System\CekRFaH.exe
  2⤵
  PID:11668
- C:\Windows\System\RaLNpqk.exe
  C:\Windows\System\RaLNpqk.exe
  2⤵
  PID:11704
- C:\Windows\System\SogNqlR.exe
  C:\Windows\System\SogNqlR.exe
  2⤵
  PID:11792
- C:\Windows\System\RemfofA.exe
  C:\Windows\System\RemfofA.exe
  2⤵
  PID:11828
- C:\Windows\System\UHeEsHN.exe
  C:\Windows\System\UHeEsHN.exe
  2⤵
  PID:11904
- C:\Windows\System\aIdckBp.exe
  C:\Windows\System\aIdckBp.exe
  2⤵
  PID:11964
- C:\Windows\System\xCfbRUm.exe
  C:\Windows\System\xCfbRUm.exe
  2⤵
  PID:12076
- C:\Windows\System\UkKSobn.exe
  C:\Windows\System\UkKSobn.exe
  2⤵
  PID:12064
- C:\Windows\System\OvNLkld.exe
  C:\Windows\System\OvNLkld.exe
  2⤵
  PID:12256
- C:\Windows\System\uyXnqia.exe
  C:\Windows\System\uyXnqia.exe
  2⤵
  PID:11328
- C:\Windows\System\bvdKDCz.exe
  C:\Windows\System\bvdKDCz.exe
  2⤵
  PID:11456
- C:\Windows\System\HGJHhSN.exe
  C:\Windows\System\HGJHhSN.exe
  2⤵
  PID:11640
- C:\Windows\System\uWzMaNk.exe
  C:\Windows\System\uWzMaNk.exe
  2⤵
  PID:11708
- C:\Windows\System\kZOHhZC.exe
  C:\Windows\System\kZOHhZC.exe
  2⤵
  PID:11876
- C:\Windows\System\oujTAFh.exe
  C:\Windows\System\oujTAFh.exe
  2⤵
  PID:12016
- C:\Windows\System\EKupfXW.exe
  C:\Windows\System\EKupfXW.exe
  2⤵
  PID:12224
- C:\Windows\System\eBBlFKu.exe
  C:\Windows\System\eBBlFKu.exe
  2⤵
  PID:11528
- C:\Windows\System\YrVklmd.exe
  C:\Windows\System\YrVklmd.exe
  2⤵
  PID:11788
- C:\Windows\System\jhwvLAj.exe
  C:\Windows\System\jhwvLAj.exe
  2⤵
  PID:11944
- C:\Windows\System\fXXQxzm.exe
  C:\Windows\System\fXXQxzm.exe
  2⤵
  PID:12152
- C:\Windows\System\LDbMYCu.exe
  C:\Windows\System\LDbMYCu.exe
  2⤵
  PID:12316
- C:\Windows\System\UyUyRjd.exe
  C:\Windows\System\UyUyRjd.exe
  2⤵
  PID:12340
- C:\Windows\System\YUQmawf.exe
  C:\Windows\System\YUQmawf.exe
  2⤵
  PID:12372
- C:\Windows\System\yusGrZC.exe
  C:\Windows\System\yusGrZC.exe
  2⤵
  PID:12400
- C:\Windows\System\xRbrPhS.exe
  C:\Windows\System\xRbrPhS.exe
  2⤵
  PID:12416
- C:\Windows\System\daIpIQP.exe
  C:\Windows\System\daIpIQP.exe
  2⤵
  PID:12436
- C:\Windows\System\vHVFjhv.exe
  C:\Windows\System\vHVFjhv.exe
  2⤵
  PID:12488
- C:\Windows\System\gnNbjPq.exe
  C:\Windows\System\gnNbjPq.exe
  2⤵
  PID:12512
- C:\Windows\System\CIcKZLv.exe
  C:\Windows\System\CIcKZLv.exe
  2⤵
  PID:12552
- C:\Windows\System\EaBXNop.exe
  C:\Windows\System\EaBXNop.exe
  2⤵
  PID:12568
- C:\Windows\System\LLDsGof.exe
  C:\Windows\System\LLDsGof.exe
  2⤵
  PID:12608
- C:\Windows\System\JZXnymc.exe
  C:\Windows\System\JZXnymc.exe
  2⤵
  PID:12624
- C:\Windows\System\USRfEYa.exe
  C:\Windows\System\USRfEYa.exe
  2⤵
  PID:12652
- C:\Windows\System\UQsBnGe.exe
  C:\Windows\System\UQsBnGe.exe
  2⤵
  PID:12668
- C:\Windows\System\ybAHLsZ.exe
  C:\Windows\System\ybAHLsZ.exe
  2⤵
  PID:12696
- C:\Windows\System\exohEGJ.exe
  C:\Windows\System\exohEGJ.exe
  2⤵
  PID:12724
- C:\Windows\System\NXtYnlF.exe
  C:\Windows\System\NXtYnlF.exe
  2⤵
  PID:12760
- C:\Windows\System\cfRlpeK.exe
  C:\Windows\System\cfRlpeK.exe
  2⤵
  PID:12788
- C:\Windows\System\YRuffTg.exe
  C:\Windows\System\YRuffTg.exe
  2⤵
  PID:12808
- C:\Windows\System\vYGQqZW.exe
  C:\Windows\System\vYGQqZW.exe
  2⤵
  PID:12840
- C:\Windows\System\uGtkRfq.exe
  C:\Windows\System\uGtkRfq.exe
  2⤵
  PID:12872
- C:\Windows\System\XqkFqrk.exe
  C:\Windows\System\XqkFqrk.exe
  2⤵
  PID:12892
- C:\Windows\System\WXBsLEu.exe
  C:\Windows\System\WXBsLEu.exe
  2⤵
  PID:12920
- C:\Windows\System\OeucDpT.exe
  C:\Windows\System\OeucDpT.exe
  2⤵
  PID:12948
- C:\Windows\System\QfhDdzA.exe
  C:\Windows\System\QfhDdzA.exe
  2⤵
  PID:12964
- C:\Windows\System\cfyajuG.exe
  C:\Windows\System\cfyajuG.exe
  2⤵
  PID:12992
- C:\Windows\System\AMVKYms.exe
  C:\Windows\System\AMVKYms.exe
  2⤵
  PID:13032
- C:\Windows\System\sCKgRgK.exe
  C:\Windows\System\sCKgRgK.exe
  2⤵
  PID:13084
- C:\Windows\System\QLJFUsE.exe
  C:\Windows\System\QLJFUsE.exe
  2⤵
  PID:13112
- C:\Windows\System\NrvMTGV.exe
  C:\Windows\System\NrvMTGV.exe
  2⤵
  PID:13132
- C:\Windows\System\QYDDRGL.exe
  C:\Windows\System\QYDDRGL.exe
  2⤵
  PID:13156
- C:\Windows\System\zhdNXCo.exe
  C:\Windows\System\zhdNXCo.exe
  2⤵
  PID:13176
- C:\Windows\System\YwBTSqC.exe
  C:\Windows\System\YwBTSqC.exe
  2⤵
  PID:13200
- C:\Windows\System\JKAkEer.exe
  C:\Windows\System\JKAkEer.exe
  2⤵
  PID:13240
- C:\Windows\System\cMihEWF.exe
  C:\Windows\System\cMihEWF.exe
  2⤵
  PID:13268
- C:\Windows\System\CtJXSCG.exe
  C:\Windows\System\CtJXSCG.exe
  2⤵
  PID:13296
- C:\Windows\System\xyAkvIq.exe
  C:\Windows\System\xyAkvIq.exe
  2⤵
  PID:12292
- C:\Windows\System\mBodgbh.exe
  C:\Windows\System\mBodgbh.exe
  2⤵
  PID:12308
- C:\Windows\System\KQBpWes.exe
  C:\Windows\System\KQBpWes.exe
  2⤵
  PID:12392
- C:\Windows\System\YcFLlLb.exe
  C:\Windows\System\YcFLlLb.exe
  2⤵
  PID:12456
- C:\Windows\System\qZyUczV.exe
  C:\Windows\System\qZyUczV.exe
  2⤵
  PID:12524
- C:\Windows\System\cfAFpqc.exe
  C:\Windows\System\cfAFpqc.exe
  2⤵
  PID:12564
- C:\Windows\System\LgQdPKH.exe
  C:\Windows\System\LgQdPKH.exe
  2⤵
  PID:12644
- C:\Windows\System\KKrCfWG.exe
  C:\Windows\System\KKrCfWG.exe
  2⤵
  PID:12692
- C:\Windows\System\NNSAyea.exe
  C:\Windows\System\NNSAyea.exe
  2⤵
  PID:12796
- C:\Windows\System\EzfQDYO.exe
  C:\Windows\System\EzfQDYO.exe
  2⤵
  PID:12832
- C:\Windows\System\mbbCfhd.exe
  C:\Windows\System\mbbCfhd.exe
  2⤵
  PID:12904
- C:\Windows\System\QNNxDhg.exe
  C:\Windows\System\QNNxDhg.exe
  2⤵
  PID:12944
- C:\Windows\System\esWZgzE.exe
  C:\Windows\System\esWZgzE.exe
  2⤵
  PID:13012
- C:\Windows\System\FrmpHQa.exe
  C:\Windows\System\FrmpHQa.exe
  2⤵
  PID:13060
- C:\Windows\System\Nlwppxb.exe
  C:\Windows\System\Nlwppxb.exe
  2⤵
  PID:13140
- C:\Windows\System\ceSrdiC.exe
  C:\Windows\System\ceSrdiC.exe
  2⤵
  PID:13248
- C:\Windows\System\hKCkgvL.exe
  C:\Windows\System\hKCkgvL.exe
  2⤵
  PID:13308
- C:\Windows\System\GVVQToE.exe
  C:\Windows\System\GVVQToE.exe
  2⤵
  PID:12112
- C:\Windows\System\iSLifVS.exe
  C:\Windows\System\iSLifVS.exe
  2⤵
  PID:12464
- C:\Windows\System\CAXKEwS.exe
  C:\Windows\System\CAXKEwS.exe
  2⤵
  PID:12636
- C:\Windows\System\wvqenIq.exe
  C:\Windows\System\wvqenIq.exe
  2⤵
  PID:12848
- C:\Windows\System\gPvVfFn.exe
  C:\Windows\System\gPvVfFn.exe
  2⤵
  PID:13056
- C:\Windows\System\qYLlxnC.exe
  C:\Windows\System\qYLlxnC.exe
  2⤵
  PID:12888
- C:\Windows\System\dsRmuzl.exe
  C:\Windows\System\dsRmuzl.exe
  2⤵
  PID:13264
- C:\Windows\System\VGRgAVZ.exe
  C:\Windows\System\VGRgAVZ.exe
  2⤵
  PID:12508
- C:\Windows\System\sjCinPS.exe
  C:\Windows\System\sjCinPS.exe
  2⤵
  PID:12736
- C:\Windows\System\bTxVyEs.exe
  C:\Windows\System\bTxVyEs.exe
  2⤵
  PID:12956
- C:\Windows\System\GatqfcT.exe
  C:\Windows\System\GatqfcT.exe
  2⤵
  PID:12780
- C:\Windows\System\mzTlsJX.exe
  C:\Windows\System\mzTlsJX.exe
  2⤵
  PID:13316
- C:\Windows\System\HMySekt.exe
  C:\Windows\System\HMySekt.exe
  2⤵
  PID:13352
- C:\Windows\System\fXVonAX.exe
  C:\Windows\System\fXVonAX.exe
  2⤵
  PID:13372
- C:\Windows\System\CKjCMjX.exe
  C:\Windows\System\CKjCMjX.exe
  2⤵
  PID:13412
- C:\Windows\System\eEgvIYA.exe
  C:\Windows\System\eEgvIYA.exe
  2⤵
  PID:13432
- C:\Windows\System\HlzPDWI.exe
  C:\Windows\System\HlzPDWI.exe
  2⤵
  PID:13476
- C:\Windows\System\AaSPqwM.exe
  C:\Windows\System\AaSPqwM.exe
  2⤵
  PID:13492
- C:\Windows\System\CPNCgQv.exe
  C:\Windows\System\CPNCgQv.exe
  2⤵
  PID:13508
- C:\Windows\System\ifZvZQv.exe
  C:\Windows\System\ifZvZQv.exe
  2⤵
  PID:13540
- C:\Windows\System\AEbVeIs.exe
  C:\Windows\System\AEbVeIs.exe
  2⤵
  PID:13568
- C:\Windows\System\ERYDdWE.exe
  C:\Windows\System\ERYDdWE.exe
  2⤵
  PID:13608
- C:\Windows\System\fnEyiHM.exe
  C:\Windows\System\fnEyiHM.exe
  2⤵
  PID:13644
- C:\Windows\System\YgYPPnD.exe
  C:\Windows\System\YgYPPnD.exe
  2⤵
  PID:13664
- C:\Windows\System\hlKxfVI.exe
  C:\Windows\System\hlKxfVI.exe
  2⤵
  PID:13704
- C:\Windows\System\pimPTpk.exe
  C:\Windows\System\pimPTpk.exe
  2⤵
  PID:13720
- C:\Windows\System\rdpGCoV.exe
  C:\Windows\System\rdpGCoV.exe
  2⤵
  PID:13736
- C:\Windows\System\QIQzWpz.exe
  C:\Windows\System\QIQzWpz.exe
  2⤵
  PID:13800
- C:\Windows\System\xxrWyft.exe
  C:\Windows\System\xxrWyft.exe
  2⤵
  PID:13820
- C:\Windows\System\XcdrChM.exe
  C:\Windows\System\XcdrChM.exe
  2⤵
  PID:13840
- C:\Windows\System\vwOhUjm.exe
  C:\Windows\System\vwOhUjm.exe
  2⤵
  PID:13872
- C:\Windows\System\bggUoKV.exe
  C:\Windows\System\bggUoKV.exe
  2⤵
  PID:13888
- C:\Windows\System\WXKGEIK.exe
  C:\Windows\System\WXKGEIK.exe
  2⤵
  PID:13908
- C:\Windows\System\OxgNQyz.exe
  C:\Windows\System\OxgNQyz.exe
  2⤵
  PID:13932
- C:\Windows\System\xuCMPbi.exe
  C:\Windows\System\xuCMPbi.exe
  2⤵
  PID:13956
- C:\Windows\System\yuHVKQb.exe
  C:\Windows\System\yuHVKQb.exe
  2⤵
  PID:14012
- C:\Windows\System\LSVPxzU.exe
  C:\Windows\System\LSVPxzU.exe
  2⤵
  PID:14032
- C:\Windows\System\qPhIGvH.exe
  C:\Windows\System\qPhIGvH.exe
  2⤵
  PID:14068
- C:\Windows\System\zcLepxl.exe
  C:\Windows\System\zcLepxl.exe
  2⤵
  PID:14088
- C:\Windows\System\cWWhlCm.exe
  C:\Windows\System\cWWhlCm.exe
  2⤵
  PID:14132
- C:\Windows\System\TTBkTwK.exe
  C:\Windows\System\TTBkTwK.exe
  2⤵
  PID:14148
- C:\Windows\System\rSHQjfT.exe
  C:\Windows\System\rSHQjfT.exe
  2⤵
  PID:14172
- C:\Windows\System\sQWiYcV.exe
  C:\Windows\System\sQWiYcV.exe
  2⤵
  PID:14196
- C:\Windows\System\NfoeyKD.exe
  C:\Windows\System\NfoeyKD.exe
  2⤵
  PID:14224
- C:\Windows\System\hinFqWh.exe
  C:\Windows\System\hinFqWh.exe
  2⤵
  PID:14248
- C:\Windows\System\QplRrqk.exe
  C:\Windows\System\QplRrqk.exe
  2⤵
  PID:14272
- C:\Windows\System\uvcffRk.exe
  C:\Windows\System\uvcffRk.exe
  2⤵
  PID:14296
- C:\Windows\System\gyrTEdw.exe
  C:\Windows\System\gyrTEdw.exe
  2⤵
  PID:14320
- C:\Windows\System\ECrjUzb.exe
  C:\Windows\System\ECrjUzb.exe
  2⤵
  PID:13188
- C:\Windows\System\blYfXoI.exe
  C:\Windows\System\blYfXoI.exe
  2⤵
  PID:13324
- C:\Windows\System\XfGTHzu.exe
  C:\Windows\System\XfGTHzu.exe
  2⤵
  PID:13456
- C:\Windows\System\NGfwdmO.exe
  C:\Windows\System\NGfwdmO.exe
  2⤵
  PID:13468
- C:\Windows\System\mxmbiai.exe
  C:\Windows\System\mxmbiai.exe
  2⤵
  PID:13556
- C:\Windows\System\YjZryvp.exe
  C:\Windows\System\YjZryvp.exe
  2⤵
  PID:13552
- C:\Windows\System\BIKXeop.exe
  C:\Windows\System\BIKXeop.exe
  2⤵
  PID:13640
- C:\Windows\System\GFWhndG.exe
  C:\Windows\System\GFWhndG.exe
  2⤵
  PID:13716
- C:\Windows\System\yUMKSLP.exe
  C:\Windows\System\yUMKSLP.exe
  2⤵
  PID:13792
- C:\Windows\System\qvYcGAc.exe
  C:\Windows\System\qvYcGAc.exe
  2⤵
  PID:13836
- C:\Windows\System\fNmctFg.exe
  C:\Windows\System\fNmctFg.exe
  2⤵
  PID:13884
- C:\Windows\System\ywSNuUZ.exe
  C:\Windows\System\ywSNuUZ.exe
  2⤵
  PID:14060
- C:\Windows\System\aMBzpBf.exe
  C:\Windows\System\aMBzpBf.exe
  2⤵
  PID:14140
- C:\Windows\System\tzVrjCK.exe
  C:\Windows\System\tzVrjCK.exe
  2⤵
  PID:14232
- C:\Windows\System\voPHvKw.exe
  C:\Windows\System\voPHvKw.exe
  2⤵
  PID:12960
- C:\Windows\System\YRIXrjC.exe
  C:\Windows\System\YRIXrjC.exe
  2⤵
  PID:12548
- C:\Windows\System\ZgrACfr.exe
  C:\Windows\System\ZgrACfr.exe
  2⤵
  PID:12600
- C:\Windows\System\zWrkFyO.exe
  C:\Windows\System\zWrkFyO.exe
  2⤵
  PID:13584
- C:\Windows\System\uDbnuOL.exe
  C:\Windows\System\uDbnuOL.exe
  2⤵
  PID:13656
- C:\Windows\System\qYMsxwT.exe
  C:\Windows\System\qYMsxwT.exe
  2⤵
  PID:13896
- C:\Windows\System\pbVFEXh.exe
  C:\Windows\System\pbVFEXh.exe
  2⤵
  PID:14056
- C:\Windows\System\cZLHXaN.exe
  C:\Windows\System\cZLHXaN.exe
  2⤵
  PID:14128
- C:\Windows\System\qthalhG.exe
  C:\Windows\System\qthalhG.exe
  2⤵
  PID:14208
- C:\Windows\System\BcbMjOx.exe
  C:\Windows\System\BcbMjOx.exe
  2⤵
  PID:13364
- C:\Windows\System\UqqEKBB.exe
  C:\Windows\System\UqqEKBB.exe
  2⤵
  PID:13828
- C:\Windows\System\YKAIwTY.exe
  C:\Windows\System\YKAIwTY.exe
  2⤵
  PID:14236
- C:\Windows\System\OFkywEg.exe
  C:\Windows\System\OFkywEg.exe
  2⤵
  PID:13812
- C:\Windows\System\kmPGKxD.exe
  C:\Windows\System\kmPGKxD.exe
  2⤵
  PID:14348
- C:\Windows\System\bXqsJMK.exe
  C:\Windows\System\bXqsJMK.exe
  2⤵
  PID:14368
- C:\Windows\System\oPKacdF.exe
  C:\Windows\System\oPKacdF.exe
  2⤵
  PID:14388
- C:\Windows\System\OpvOVtS.exe
  C:\Windows\System\OpvOVtS.exe
  2⤵
  PID:14420
- C:\Windows\System\sADsvyF.exe
  C:\Windows\System\sADsvyF.exe
  2⤵
  PID:14452
- C:\Windows\System\lrKtXRT.exe
  C:\Windows\System\lrKtXRT.exe
  2⤵
  PID:14496
- C:\Windows\System\JeuOQiy.exe
  C:\Windows\System\JeuOQiy.exe
  2⤵
  PID:14524
- C:\Windows\System\RIfyXEI.exe
  C:\Windows\System\RIfyXEI.exe
  2⤵
  PID:14548
- C:\Windows\System\kJvULmd.exe
  C:\Windows\System\kJvULmd.exe
  2⤵
  PID:14572
- C:\Windows\System\eTsVqSj.exe
  C:\Windows\System\eTsVqSj.exe
  2⤵
  PID:14628
- C:\Windows\System\MaICAxO.exe
  C:\Windows\System\MaICAxO.exe
  2⤵
  PID:14648
- C:\Windows\System\vwlgrdK.exe
  C:\Windows\System\vwlgrdK.exe
  2⤵
  PID:14676
- C:\Windows\System\NuOASVZ.exe
  C:\Windows\System\NuOASVZ.exe
  2⤵
  PID:14692
- C:\Windows\System\tkgtgbE.exe
  C:\Windows\System\tkgtgbE.exe
  2⤵
  PID:14720
- C:\Windows\System\EGCVblI.exe
  C:\Windows\System\EGCVblI.exe
  2⤵
  PID:14744
- C:\Windows\System\VpiEYCl.exe
  C:\Windows\System\VpiEYCl.exe
  2⤵
  PID:14784
- C:\Windows\System\Tzapeez.exe
  C:\Windows\System\Tzapeez.exe
  2⤵
  PID:14804
- C:\Windows\System\ionKdYk.exe
  C:\Windows\System\ionKdYk.exe
  2⤵
  PID:14844
- C:\Windows\System\gRJvWGe.exe
  C:\Windows\System\gRJvWGe.exe
  2⤵
  PID:14876
- C:\Windows\System\diXKfpE.exe
  C:\Windows\System\diXKfpE.exe
  2⤵
  PID:14892
- C:\Windows\System\FURWDvv.exe
  C:\Windows\System\FURWDvv.exe
  2⤵
  PID:14932
- C:\Windows\System\FzwfntX.exe
  C:\Windows\System\FzwfntX.exe
  2⤵
  PID:14972
- C:\Windows\System\QHZfVzx.exe
  C:\Windows\System\QHZfVzx.exe
  2⤵
  PID:14992
- C:\Windows\System\uLwirYV.exe
  C:\Windows\System\uLwirYV.exe
  2⤵
  PID:15016
- C:\Windows\System\LgyGNat.exe
  C:\Windows\System\LgyGNat.exe
  2⤵
  PID:15056
- C:\Windows\System\KiiCmOa.exe
  C:\Windows\System\KiiCmOa.exe
  2⤵
  PID:15076
- C:\Windows\System\LOVlwsj.exe
  C:\Windows\System\LOVlwsj.exe
  2⤵
  PID:15100
- C:\Windows\System\iPNtzCl.exe
  C:\Windows\System\iPNtzCl.exe
  2⤵
  PID:15120
- C:\Windows\System\UHQiOnP.exe
  C:\Windows\System\UHQiOnP.exe
  2⤵
  PID:15148
- C:\Windows\System\gFrgBeU.exe
  C:\Windows\System\gFrgBeU.exe
  2⤵
  PID:15172
- C:\Windows\System\GRhJpXz.exe
  C:\Windows\System\GRhJpXz.exe
  2⤵
  PID:15192
- C:\Windows\System\TDZBZJG.exe
  C:\Windows\System\TDZBZJG.exe
  2⤵
  PID:15212
- C:\Windows\System\ptCNiip.exe
  C:\Windows\System\ptCNiip.exe
  2⤵
  PID:15280
- C:\Windows\System\ZvAonFY.exe
  C:\Windows\System\ZvAonFY.exe
  2⤵
  PID:15296
- C:\Windows\System\TNApzTF.exe
  C:\Windows\System\TNApzTF.exe
  2⤵
  PID:15336
- C:\Windows\System\KnICdhk.exe
  C:\Windows\System\KnICdhk.exe
  2⤵
  PID:15352
- C:\Windows\System\FzdrXAZ.exe
  C:\Windows\System\FzdrXAZ.exe
  2⤵
  PID:14164
- C:\Windows\System\BJqMolk.exe
  C:\Windows\System\BJqMolk.exe
  2⤵
  PID:14436
- C:\Windows\System\ywIvbeD.exe
  C:\Windows\System\ywIvbeD.exe
  2⤵
  PID:14428
- C:\Windows\System\umdEUKZ.exe
  C:\Windows\System\umdEUKZ.exe
  2⤵
  PID:14532
- C:\Windows\System\LtVhHyN.exe
  C:\Windows\System\LtVhHyN.exe
  2⤵
  PID:14560
- C:\Windows\System\iweyqyV.exe
  C:\Windows\System\iweyqyV.exe
  2⤵
  PID:14636
- C:\Windows\System\IhumKIB.exe
  C:\Windows\System\IhumKIB.exe
  2⤵
  PID:14756
- C:\Windows\System\PQpnOHK.exe
  C:\Windows\System\PQpnOHK.exe
  2⤵
  PID:14688
- C:\Windows\System\QmwMjKN.exe
  C:\Windows\System\QmwMjKN.exe
  2⤵
  PID:14824
- C:\Windows\System\UKIPZqa.exe
  C:\Windows\System\UKIPZqa.exe
  2⤵
  PID:14792
- C:\Windows\System\ILzNFJL.exe
  C:\Windows\System\ILzNFJL.exe
  2⤵
  PID:14888
- C:\Windows\System\IdVVKcA.exe
  C:\Windows\System\IdVVKcA.exe
  2⤵
  PID:14980
- C:\Windows\System\CiDOUdB.exe
  C:\Windows\System\CiDOUdB.exe
  2⤵
  PID:15128
- C:\Windows\System\cBiDOhI.exe
  C:\Windows\System\cBiDOhI.exe
  2⤵
  PID:15168
- C:\Windows\System\sgXFpMr.exe
  C:\Windows\System\sgXFpMr.exe
  2⤵
  PID:15236
- C:\Windows\System\xHnsSqX.exe
  C:\Windows\System\xHnsSqX.exe
  2⤵
  PID:15292
- C:\Windows\System\tpAXVKp.exe
  C:\Windows\System\tpAXVKp.exe
  2⤵
  PID:15316
- C:\Windows\System\nMhphnZ.exe
  C:\Windows\System\nMhphnZ.exe
  2⤵
  PID:14384
- C:\Windows\System\pvNHXuF.exe
  C:\Windows\System\pvNHXuF.exe
  2⤵
  PID:14668
- C:\Windows\System\nCaCflI.exe
  C:\Windows\System\nCaCflI.exe
  2⤵
  PID:14736
- C:\Windows\System\fLvxEQC.exe
  C:\Windows\System\fLvxEQC.exe
  2⤵
  PID:14964
- C:\Windows\System\TbheFMn.exe
  C:\Windows\System\TbheFMn.exe
  2⤵
  PID:15084
- C:\Windows\System\YVPgqJf.exe
  C:\Windows\System\YVPgqJf.exe
  2⤵
  PID:15208
- C:\Windows\System\OkMKRCy.exe
  C:\Windows\System\OkMKRCy.exe
  2⤵
  PID:15256
- C:\Windows\System\eGnuJCN.exe
  C:\Windows\System\eGnuJCN.exe
  2⤵
  PID:14684
- C:\Windows\System\zXuZGny.exe
  C:\Windows\System\zXuZGny.exe
  2⤵
  PID:14968
- C:\Windows\System\yZekaco.exe
  C:\Windows\System\yZekaco.exe
  2⤵
  PID:15204
- C:\Windows\System\XgGbwCN.exe
  C:\Windows\System\XgGbwCN.exe
  2⤵
  PID:14712
- C:\Windows\System\WrgOJpZ.exe
  C:\Windows\System\WrgOJpZ.exe
  2⤵
  PID:15380
- C:\Windows\System\wLhzgKY.exe
  C:\Windows\System\wLhzgKY.exe
  2⤵
  PID:15404
- C:\Windows\System\hHLgzuA.exe
  C:\Windows\System\hHLgzuA.exe
  2⤵
  PID:15448
- C:\Windows\System\JSXhcnL.exe
  C:\Windows\System\JSXhcnL.exe
  2⤵
  PID:15488
- C:\Windows\System\fxbPyuX.exe
  C:\Windows\System\fxbPyuX.exe
  2⤵
  PID:15504
- C:\Windows\System\xoZGoNp.exe
  C:\Windows\System\xoZGoNp.exe
  2⤵
  PID:15544
- C:\Windows\System\cLkWKDU.exe
  C:\Windows\System\cLkWKDU.exe
  2⤵
  PID:15572
- C:\Windows\System\OlfkOid.exe
  C:\Windows\System\OlfkOid.exe
  2⤵
  PID:15604
- C:\Windows\System\quhYBgq.exe
  C:\Windows\System\quhYBgq.exe
  2⤵
  PID:15628
- C:\Windows\System\QSTTRSG.exe
  C:\Windows\System\QSTTRSG.exe
  2⤵
  PID:15648
- C:\Windows\System\vmmYtUz.exe
  C:\Windows\System\vmmYtUz.exe
  2⤵
  PID:15680
- C:\Windows\System\TgDaSMy.exe
  C:\Windows\System\TgDaSMy.exe
  2⤵
  PID:15700
- C:\Windows\System\rhhYoKT.exe
  C:\Windows\System\rhhYoKT.exe
  2⤵
  PID:15716
- C:\Windows\System\QOHAWTO.exe
  C:\Windows\System\QOHAWTO.exe
  2⤵
  PID:15764
- C:\Windows\System\keMcxAX.exe
  C:\Windows\System\keMcxAX.exe
  2⤵
  PID:15792
- C:\Windows\System\UmwIpuV.exe
  C:\Windows\System\UmwIpuV.exe
  2⤵
  PID:15816
- C:\Windows\System\AxwXUse.exe
  C:\Windows\System\AxwXUse.exe
  2⤵
  PID:15840
- C:\Windows\System\gYtOjLv.exe
  C:\Windows\System\gYtOjLv.exe
  2⤵
  PID:15856
- C:\Windows\System\VBYSPtS.exe
  C:\Windows\System\VBYSPtS.exe
  2⤵
  PID:15872
- C:\Windows\System\PDQKPnl.exe
  C:\Windows\System\PDQKPnl.exe
  2⤵
  PID:15892
- C:\Windows\System\QYVxVYu.exe
  C:\Windows\System\QYVxVYu.exe
  2⤵
  PID:15912
- C:\Windows\System\WBeDrva.exe
  C:\Windows\System\WBeDrva.exe
  2⤵
  PID:15940
- C:\Windows\System\eKwnASL.exe
  C:\Windows\System\eKwnASL.exe
  2⤵
  PID:15976
- C:\Windows\System\ERbdtvQ.exe
  C:\Windows\System\ERbdtvQ.exe
  2⤵
  PID:16008
- C:\Windows\System\gkBQcJN.exe
  C:\Windows\System\gkBQcJN.exe
  2⤵
  PID:16032
- C:\Windows\System\HSuOuRQ.exe
  C:\Windows\System\HSuOuRQ.exe
  2⤵
  PID:16088
- C:\Windows\System\rDFnEqB.exe
  C:\Windows\System\rDFnEqB.exe
  2⤵
  PID:16128
- C:\Windows\System\PKeziMo.exe
  C:\Windows\System\PKeziMo.exe
  2⤵
  PID:16152
- C:\Windows\System\xjxsVGh.exe
  C:\Windows\System\xjxsVGh.exe
  2⤵
  PID:16180
- C:\Windows\System\xBKLsQA.exe
  C:\Windows\System\xBKLsQA.exe
  2⤵
  PID:16208
- C:\Windows\System\TVGNqRY.exe
  C:\Windows\System\TVGNqRY.exe
  2⤵
  PID:16244
- C:\Windows\System\WvVVFNA.exe
  C:\Windows\System\WvVVFNA.exe
  2⤵
  PID:16264
- C:\Windows\System\wekDEva.exe
  C:\Windows\System\wekDEva.exe
  2⤵
  PID:16280
- C:\Windows\System\rdEATHM.exe
  C:\Windows\System\rdEATHM.exe
  2⤵
  PID:16324
- C:\Windows\System\ZYXosds.exe
  C:\Windows\System\ZYXosds.exe
  2⤵
  PID:16372
- C:\Windows\System\kuUalKO.exe
  C:\Windows\System\kuUalKO.exe
  2⤵
  PID:15012
- C:\Windows\System\yodsGWL.exe
  C:\Windows\System\yodsGWL.exe
  2⤵
  PID:13448
- C:\Windows\System\JPShFbq.exe
  C:\Windows\System\JPShFbq.exe
  2⤵
  PID:15396
- C:\Windows\System\JvHgiqP.exe
  C:\Windows\System\JvHgiqP.exe
  2⤵
  PID:15472
- C:\Windows\System\bKuzUAI.exe
  C:\Windows\System\bKuzUAI.exe
  2⤵
  PID:15556
- C:\Windows\System\UbGhKzz.exe
  C:\Windows\System\UbGhKzz.exe
  2⤵
  PID:15620
- C:\Windows\System\nIESBzM.exe
  C:\Windows\System\nIESBzM.exe
  2⤵
  PID:15712
- C:\Windows\System\vGzgzeO.exe
  C:\Windows\System\vGzgzeO.exe
  2⤵
  PID:15688
- C:\Windows\System\VHJzPaZ.exe
  C:\Windows\System\VHJzPaZ.exe
  2⤵
  PID:15784
- C:\Windows\System\fPdcnKd.exe
  C:\Windows\System\fPdcnKd.exe
  2⤵
  PID:15848
- C:\Windows\System\sooMCyf.exe
  C:\Windows\System\sooMCyf.exe
  2⤵
  PID:15924
- C:\Windows\System\XoIGnxT.exe
  C:\Windows\System\XoIGnxT.exe
  2⤵
  PID:15864
- C:\Windows\System\uiGQXxs.exe
  C:\Windows\System\uiGQXxs.exe
  2⤵
  PID:15988
- C:\Windows\System\dTjWELu.exe
  C:\Windows\System\dTjWELu.exe
  2⤵
  PID:16004
- C:\Windows\System\LzZkOTB.exe
  C:\Windows\System\LzZkOTB.exe
  2⤵
  PID:16072
- C:\Windows\System\egYKxzv.exe
  C:\Windows\System\egYKxzv.exe
  2⤵
  PID:16204
- C:\Windows\System\HuMQfzV.exe
  C:\Windows\System\HuMQfzV.exe
  2⤵
  PID:16292
- C:\Windows\System\OxjZqME.exe
  C:\Windows\System\OxjZqME.exe
  2⤵
  PID:16344
- C:\Windows\System\cQrpmPp.exe
  C:\Windows\System\cQrpmPp.exe
  2⤵
  PID:15428
- C:\Windows\System\vMxEshV.exe
  C:\Windows\System\vMxEshV.exe
  2⤵
  PID:15600
- C:\Windows\System\xmjaPMh.exe
  C:\Windows\System\xmjaPMh.exe
  2⤵
  PID:15708
- C:\Windows\System\XQCucVX.exe
  C:\Windows\System\XQCucVX.exe
  2⤵
  PID:15904
- C:\Windows\System\mwENdkd.exe
  C:\Windows\System\mwENdkd.exe
  2⤵
  PID:15832
- C:\Windows\System\IQfBLle.exe
  C:\Windows\System\IQfBLle.exe
  2⤵
  PID:16016
- C:\Windows\System\llsWWAT.exe
  C:\Windows\System\llsWWAT.exe
  2⤵
  PID:15516
- C:\Windows\System\kOdRKgM.exe
  C:\Windows\System\kOdRKgM.exe
  2⤵
  PID:15484
- C:\Windows\System\VfTObGq.exe
  C:\Windows\System\VfTObGq.exe
  2⤵
  PID:16044
- C:\Windows\System\VRybXrJ.exe
  C:\Windows\System\VRybXrJ.exe
  2⤵
  PID:15812
- C:\Windows\System\tBKCrfy.exe
  C:\Windows\System\tBKCrfy.exe
  2⤵
  PID:16332
- C:\Windows\System\mWAmZiV.exe
  C:\Windows\System\mWAmZiV.exe
  2⤵
  PID:16116
- C:\Windows\System\yzpIGvV.exe
  C:\Windows\System\yzpIGvV.exe
  2⤵
  PID:16416
- C:\Windows\System\FJVhfMa.exe
  C:\Windows\System\FJVhfMa.exe
  2⤵
  PID:16448
- C:\Windows\System\PbPAEOC.exe
  C:\Windows\System\PbPAEOC.exe
  2⤵
  PID:16484
- C:\Windows\System\fnmXpJR.exe
  C:\Windows\System\fnmXpJR.exe
  2⤵
  PID:16516
- C:\Windows\System\VPgnutQ.exe
  C:\Windows\System\VPgnutQ.exe
  2⤵
  PID:16540
- C:\Windows\System\lkfoXSG.exe
  C:\Windows\System\lkfoXSG.exe
  2⤵
  PID:16568
- C:\Windows\System\zvdIEzC.exe
  C:\Windows\System\zvdIEzC.exe
  2⤵
  PID:16584
- C:\Windows\System\nJuEsng.exe
  C:\Windows\System\nJuEsng.exe
  2⤵
  PID:16608
- C:\Windows\System\IewbQds.exe
  C:\Windows\System\IewbQds.exe
  2⤵
  PID:16632
- C:\Windows\System\iEDWPpC.exe
  C:\Windows\System\iEDWPpC.exe
  2⤵
  PID:16660
- C:\Windows\System\RSAMtgA.exe
  C:\Windows\System\RSAMtgA.exe
  2⤵
  PID:16684
- C:\Windows\System\SkLQYtB.exe
  C:\Windows\System\SkLQYtB.exe
  2⤵
  PID:16712
- C:\Windows\System\RfprirK.exe
  C:\Windows\System\RfprirK.exe
  2⤵
  PID:16736
- C:\Windows\System\OrpsSVr.exe
  C:\Windows\System\OrpsSVr.exe
  2⤵
  PID:16816
- C:\Windows\System\EXMeRBW.exe
  C:\Windows\System\EXMeRBW.exe
  2⤵
  PID:16836
- C:\Windows\System\cxndSKO.exe
  C:\Windows\System\cxndSKO.exe
  2⤵
  PID:16864
- C:\Windows\System\kQZhRBm.exe
  C:\Windows\System\kQZhRBm.exe
  2⤵
  PID:16880
- C:\Windows\System\IInVJop.exe
  C:\Windows\System\IInVJop.exe
  2⤵
  PID:16912
- C:\Windows\System\MXhCQef.exe
  C:\Windows\System\MXhCQef.exe
  2⤵
  PID:16948
- C:\Windows\System\oAmuCem.exe
  C:\Windows\System\oAmuCem.exe
  2⤵
  PID:16988
- C:\Windows\System\rqQOdij.exe
  C:\Windows\System\rqQOdij.exe
  2⤵
  PID:17004
- C:\Windows\System\lBVlLAl.exe
  C:\Windows\System\lBVlLAl.exe
  2⤵
  PID:17044

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:16404

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\CONBMqY.exe

Filesize
1.1MB

MD5
bde60848e3812157045374ab50ff3278

SHA1
96ed03c95fd30140bcea7b374d36477e4e2b3391

SHA256
9ac5da54cea702a4ebd05b92fad39d1eee30fdac0ccdf600eee6daa111521943

SHA512
a530482c3d82c93ab233287c8ccc9cf2610d1492dd9d9e69c728f864a22b09178bea60c0f03e7292211ccf5d87e4223e72dcea81ab561ee5e52cb4aaeebd80f3

Download Submit
C:\Windows\System\FTApmwJ.exe

Filesize
1.1MB

MD5
a85c36d52044a1ac8c815a7cdba237e4

SHA1
f1472a819e5ea1b77e3c75384196e67dbcaec5e5

SHA256
7444282229559f59c994d8019771b0f40c9d733a79571aceffa52ed823e632ca

SHA512
75dd0cddaff0ca92008327cab01ac109273202e08507573a554d288c7cd71340e6ba1ddeca7d4644124238318a9d96d17d2f85a8e9f343d9cd5ae2e0e86000ab

Download Submit
C:\Windows\System\IgkCkUG.exe

Filesize
1.1MB

MD5
56d29363c6b579985eac7fed0ccb5a03

SHA1
4a38ad4af942af19eceeac7218f9e6ce61dfe43f

SHA256
1e017a19153fa0b468bf592ef83054fe981e355fb4e72f22617c92742c760e20

SHA512
6137edd425e864a8e93188157cc27239aa5a52c177be47836c3a528fc0adb6c638f88ebba3b8e87996ab42243c94ca31c6dc8d49e30ec8a2c21ebc7290460af4

Download Submit
C:\Windows\System\KTjncqM.exe

Filesize
1.1MB

MD5
614ec1fb58fc04b158b52c14896a49e5

SHA1
98179395d56bb2705ee809ab19462ea885a6ddfd

SHA256
cb46ee4905a5b0bb2c703907301fd2e6358c8a515484415d8f0a7dccd9a8b059

SHA512
d9f0a426af0269cb1a07def601210c58bf331cd29ef02ec48d201d18281b35523fa56aff432cc8bdb677d404f7132735572c9c039a98f41c6fef2746fd45f7e9

Download Submit
C:\Windows\System\KeWSrNU.exe

Filesize
1.1MB

MD5
838647eb8c03c5d3653a39ad11847de8

SHA1
d92e05455fa18fc9aa6c395792656db7ec4ab705

SHA256
4598280f63b51e124ab7df4194ee8acbf2bf16e0d8c0ae0ffa4006d08f829b14

SHA512
88388571589e214d076634cfaed7204082db4a8be7f9b38fc4369fc1b19dc1a6b30d61d95bdecf4ca6b458420d82dec9e149513da9625ca60d5e915d7ea1b65f

Download Submit
C:\Windows\System\MKZEBng.exe

Filesize
1.1MB

MD5
a7396e2af71ff131bf5c471d531c0fbb

SHA1
5dbfd8d1ee7be582b83a4b072f768dfc0f9a367c

SHA256
59b115b2723b03150c264c73eb085b7eb1bab1b26f406f7861ae776ca48839ca

SHA512
79d31844e263c83950d332723d1553e3b53c73082d0a21b3253d03a1dbe16e14fdd3d2f182985caa2cd011e3db77186bbaea978000225033dc1af7d48cb1ebbc

Download Submit
C:\Windows\System\NOiyNEG.exe

Filesize
1.1MB

MD5
ed284bcabc59879ffa4a79b2b6ca5b49

SHA1
1b58e77f1846bf6b37d7fdb581f3da97e3b25deb

SHA256
bb4462cd05e8495e3f119647f7142ebc51d0ad30c89e578f2129999487ebb87a

SHA512
66c04ba2d5a7cfbde1fffb646ef007fb2e00c4f65f6eeab447bd4374211f77067ed46c0c2ac5047c2e18b5fea6d54823ca537c57a486e2886a4e3e04258d8fb0

Download Submit
C:\Windows\System\PmXNQQL.exe

Filesize
1.1MB

MD5
ed0c5e5ec45224121736a5ad6fd748d2

SHA1
702d8bec28d28ed7199f157289ad4e8ddd0927a8

SHA256
372e93799db8564615b67a3c5fdb1964f42d823545783d301c650d3bd982ee40

SHA512
d7bd2674c60274703cfa9980e58dc7c78ebf0355bbe3ef24798e4d3d49716c86cc64fe50e2f2aaf6bfd6cc60b026a97ae93f80efbfb1744686ce910ef2fa6fab

Download Submit
C:\Windows\System\RbPubib.exe

Filesize
1.1MB

MD5
03c7ad4fd6759efaeaa77a06c3327def

SHA1
dc6f88e8a078e005a04d4ae1564322d68b774160

SHA256
cd9f2f982d76334dc52bfb3c8016eb22f86074b52034fb6bdb5c3f8588fb16d7

SHA512
32d5f83b1faed9a06a93a92905029aa4c977ccefe3837131f36ef5b11ac11d7efd1d66034be8438f8a586bf8d9ed13741b0be20144e9a10e603e04c4342c243a

Download Submit
C:\Windows\System\SKBFArv.exe

Filesize
1.1MB

MD5
bceea280deafe5939c872f2ebee795f6

SHA1
55a62a4bbe8db01dd35c95f5260fad9cffce785d

SHA256
71299d777121af6143bb9d7580d5c4f243c4d165c40d406a3027570a5741f7ed

SHA512
e06372ab2838623646d058490a81ada2f58aec104b5c4fcc0c2b91964e7fa0d8e511bed7e4b9f208507f69515839692ba55fec475b6f22919a60bb4ee6c0b16b

Download Submit
C:\Windows\System\SchpzGt.exe

Filesize
1.1MB

MD5
b6d292dc901870eae508824bebff140d

SHA1
a30b4673935a67ba74dad05963258f2ee1d235e1

SHA256
51f472ca856ba19b925e0fa8f7e8357ab4856b6a562e2dd529c379a93ddb8b63

SHA512
c55659ba6177af8698174ac9901c8e3786c83b17d881f01b272d1c841014a19236fdd1cb439874cce79ca2f67eba53278a4fa3d3280dda90367cae2f200f762b

Download Submit
C:\Windows\System\SzCiMHW.exe

Filesize
1.1MB

MD5
091c7613e83fbbf56367bf8a0c516e50

SHA1
8700a2ce06f4638dabd3f7fed0630d62deea120c

SHA256
6d61cbd19b2f8314f662eae50b42ca7cffd524f8fd19f82b910df98b96043f91

SHA512
dd7e3f1cf3d55a6163aecb4c17523faef1cc61e9db0fbe40241e8ec528e2d2d4b8ab8cd58d6d4b2af055603f6ccc5f76495f38ddd468f245c4721cd77b2e8297

Download Submit
C:\Windows\System\TriElFc.exe

Filesize
1.1MB

MD5
06a1810ec4f574824174970ff03e6199

SHA1
bf0c606855b08f690c46715f776e78bc0973b2c6

SHA256
edec83e2a296965a913d8fe3809d0ad2f79c39449dccc4cf31be1d25b9395777

SHA512
f554328cf7cdc59189236b39da6a92b7b049f192008ccba0d679a7548673a21d67824bce9d6ede9d1817858106b27c5c7507df3f12e36945652e022e1919eeb7

Download Submit
C:\Windows\System\TsXKSoE.exe

Filesize
1.1MB

MD5
9af1548c587c71ebaa7977cf1b32d306

SHA1
e4340edf0c4b2cf176c8e315e23de0a336cdcbc0

SHA256
b02e02263c30b6168fbc99d181c47a9840abbc78b8ac66484f22e6b537d5276c

SHA512
f08d1cb04635c8a7583a753e1a7fc41b0f032cbb05cbd27df351712115ced8afbc9f7a31153853fca9b1fcdabd54a9cf9d43e5eb35deb492453f9f869939c153

Download Submit
C:\Windows\System\bFJhfOH.exe

Filesize
1.1MB

MD5
af1f03d0574538a3f4485a08506b8d5c

SHA1
fdd4c9e62f6c0790aab721425d38aa192e6fb17c

SHA256
9eeedbe0c33c8e1431944f17fc0177366c63afb34850992460829182e8fe3a1f

SHA512
e4295b2e95430d8fd29df6054b01ceb2616365ea99319173f3c3d370bef4095a8332c27c815550af0ff6ab34124a6a001df16c54e3f7b71a2a02d6afc2defeee

Download Submit
C:\Windows\System\cPIkwCV.exe

Filesize
1.1MB

MD5
d4d20b0872abd9359c70e893666d63d5

SHA1
e885abd60997ebfbc77edb8d5b0e3ab30698b84f

SHA256
e1551b2eae6411d8a32c0abad9705fc149813bc74e44f17c423382572e63e2a0

SHA512
8775c6d663a8d6a3ec23bdf2363c3ca301a3e6aa1e8d160488c82f0619f4a8f799beedf479df8b3715f302ccdde101249e4db6b57efe046b40e8d449302490ac

Download Submit
C:\Windows\System\chJGBgS.exe

Filesize
1.1MB

MD5
25abcff83d18236e448e8d834b4cd6d7

SHA1
036b6664dea60d94e89d8cf3f8a2faf10cf1a92a

SHA256
7b2eac6c277073c03f8086b93d0aa426ec62810da59faa67eab1ba1c551a7ab3

SHA512
383423aebc0772abf16e3b7582aa0a7f16a016728de288b3cb033f6778f02db9852b926f3d43f2e8848ec7b318292295192e0feccd5a93746f8c079e98b3905c

Download Submit
C:\Windows\System\ctrrLsq.exe

Filesize
1.1MB

MD5
8b29b8fc294789a5ed1743a83b955dd2

SHA1
18a5ff9e1d132b3c513ced113eacce234396a2de

SHA256
37a4aea4cd5b56bc13717e38982abd24d31c8d1bc602c52056d4604073144f46

SHA512
79f72c5ef820dec1ebce0473fa552051738123358db8ae4b96cacbb332a16b326517cc420b49b2321d7145382171fcc56bf835c1704e51319e4873d10b81343b

Download Submit
C:\Windows\System\dEFaVMl.exe

Filesize
1.1MB

MD5
851174f23d441a535c4a0d523fd891f8

SHA1
f3cd98135c21c223d34a18a569657d6f191fd9c3

SHA256
8bdbbd99e698ffb411c55e808f4914f9ab57fab8bc411e5837d9289f7bca405e

SHA512
60a3389ea1cc6c8454c2fecadcb055755959206d1d2f0ad8c777e5a499d1376b91159dacfb778b98ddd45e1f7b1da5dab71e46c20d089f80098eed92ae53f0f0

Download Submit
C:\Windows\System\gahvXej.exe

Filesize
1.1MB

MD5
894ef698f5d3e3bafee495ff698eb971

SHA1
d2a73ee1335204ed888b2771c22ce627aecc069a

SHA256
83e554b044fbe6681b519ba3341b4845ecbe37303d7849e106aa7dfa3e5c24c4

SHA512
00b069e90f778612249926568d9a6b64fa1ec1bf3fa46a6aa769976beecd40e3a1a46c0d5382a75d48a5d57afb64609531dad47b9a4a4e4e49643567e4618900

Download Submit
C:\Windows\System\hTYPIGd.exe

Filesize
1.1MB

MD5
e9bcaff97209c70ba3f6b4f5962ef740

SHA1
19138f08229fe16c27eaf8d753b89178c988c856

SHA256
41c991c1100817ef5db76f4da4023a574eda3bb4829b8fb379cad4a7de1da6c7

SHA512
e38b95709d18572d7bf4b3b6d2d28521accfcad1b2a3f8caaba80f8c47eae4f731be6b18cac02d11b4d3e0eeb62af27b35745e442dbac82bea76bc14a7f5eb92

Download Submit
C:\Windows\System\iNXxGJL.exe

Filesize
1.1MB

MD5
3b9dcea50cb855404e7cef080e4dc94b

SHA1
e36ce30775d9ab3c67f961125594dc01d50fdc28

SHA256
0bfce86e75f33fc63bb97280d2ecf44d7e48c663eb43f4d662ef0fbdae853127

SHA512
aac3a3d99770e3614b335916a78cc4f52cd632bac3ee486f22095acefd075cff30f645702a3342676e951b20b27cbaa033539498bfbe8eeeeb2d5ae678bd1fb9

Download Submit
C:\Windows\System\luGfOwo.exe

Filesize
1.1MB

MD5
fb1ebf29d2525817bcb289a2978714f9

SHA1
3317bd926476d947fb273c4c58800d03964203ec

SHA256
2f3ef9b97497017c4f49d862e2ee970ab5f7d21e26b4f18040d429f9d9a3880d

SHA512
1ff6329c2a63fc96378c64706989ddf92de5f01546584cf53e6700c704cfb961dbf0a8591c38524d79c4202ff0ff0406cd7e8888a5e4ffd5430b896e869c06ed

Download Submit
C:\Windows\System\luQQrca.exe

Filesize
1.1MB

MD5
8297d80c15d15b044f082d6f1e9a54b3

SHA1
b60b2376d0304673570089a81519b8d464709f73

SHA256
cc00b3f397362306d2850c653cf305e8111f219702c5950f9684a59a238e8de3

SHA512
01a4ab41623103cca88df19249539e7314ec685457565b72b04ce28a222b0097fd91a14fdcc1e95e19c382a06e8e8bbc4f7ea4894902c253b173ca67efc040cf

Download Submit
C:\Windows\System\nwmzvLc.exe

Filesize
1.1MB

MD5
c8f7d858de0b77007889d9724a079f26

SHA1
cedac45b3d0f4d1828381e0944b24fa8f3c7348a

SHA256
58bedd02b3f3067d01ee14983fe9875c777a572d3d733445692d70bba9a748df

SHA512
d4399aa20121b4578ce5283e94723dbc5cb8e440228eba100e843bc9a34625a59aa38b99bd6f2b35ee74e8027933cdfbfe0185e7ea38012c6f39e2a7d00bf2c1

Download Submit
C:\Windows\System\pTovbnN.exe

Filesize
1.1MB

MD5
c195a79f07cf58a51af9dc5696a4d585

SHA1
1fa4531e361512212cd393b9381bebe928f0ee97

SHA256
560483fb280462220163e77ca9c750906672078879f52cb52cec7f6a1d53aafe

SHA512
ce3ddbed0bcce9fbf82e75efa2cb4a15c00e09890b169888c51e579be315ca37bcfc90a25e43cfc6aec0e9d8a3a8a15337e8bb1bde6d9ee3cbb76489faee9bf7

Download Submit
C:\Windows\System\pngjymF.exe

Filesize
1.1MB

MD5
0fe3fe4866c5eba4ab9c55ca55785dbb

SHA1
82dffb8f2c6be277f3608bb1e7d4715e4e763d00

SHA256
40c90df12aa5c9fd8fc7221c1248af46817962caacc8ffb588898bec8a2faba2

SHA512
1c59d71396a2e29a09889dcf92f91d01247b8c12d5904a2bae17b5cfa6085d23671b9c0186e0b4938491baf42ce3d5a02e8f242242f9ee7adbba9370d1d1b4d8

Download Submit
C:\Windows\System\pxyEcVM.exe

Filesize
1.1MB

MD5
f206b2cec59929980d54dcd87002928e

SHA1
62ef0c6c8637142100cd19d375a408b364f3e1b7

SHA256
ad19ca4638c503ed9379802bd39fc41362f22dd94d29880afbb8ac65524ade4e

SHA512
0d6673d0d0187051fcbe362d1bd7e8d4f93bb9f001ee7b8b7184554dfcbfc3aa22e2552debe39fd681529376e0eea1eaedb206cbd3f133ead6e04892d32835fa

Download Submit
C:\Windows\System\tBnySIG.exe

Filesize
1.1MB

MD5
66d8f2acf47631abbbff352e423ed33b

SHA1
51100843d56bfccbc525433109febe8c85e657d8

SHA256
1c67a553f758667d52b31e31129a6cd02ad33e522b6a616e05dd4c65f9caeef3

SHA512
e856be4b08804658e455f85ebeecc7eb73f653e42049667778399bbd389679fc73cef8dbc58de7456875a1f50dcc6d21d5eaf1fe8297d6f38aa2720af14ad67a

Download Submit
C:\Windows\System\txeXTtm.exe

Filesize
1.1MB

MD5
71355b89a72abf3ab59f516cb78200da

SHA1
71cdafa9c3a58773ef84ad5c3a38dd9aa7cd4f36

SHA256
11b6cf4f67699570dc116b0cfb18de1903bbfe1ee18cc2ee5850ac35adf492e4

SHA512
b48b9cf06a7dde616cdba6e2b0677cfd275a3410b70ac304806bebc96bded5ec684986887da5309388be46f1ff2773a497df11d1d09f7fe0def0dc117b07b453

Download Submit
C:\Windows\System\wxmgEOq.exe

Filesize
1.1MB

MD5
e3b84486e622ae3d843ecd33792e9ef6

SHA1
5112bf51281542a7deee4c7479c00a0b07d76e70

SHA256
cf3600a272c19912af0c142cb777ab5ed51a5acbf868a3de1096bfe5d66dc00b

SHA512
d5d0e84f329aa079c52860d4095abf661c31fea4f4b9f44396b605c7e2e4ca5e1d28b4435641a783db4fc7828092c8c116f1b07f8e3b4a35b2565e67253d469a

Download Submit
C:\Windows\System\yCGWDTu.exe

Filesize
1.1MB

MD5
09df001f53cdf2c1418a4f40ae5bb56a

SHA1
4528e39dc9772c4eb067c5212068c36088a7bad8

SHA256
01399a230306b4b329cbbd6743f976ae2f73d72e9ac333505bb08513dcb22fa3

SHA512
426e89c0252b1dd637a254e43fea342ac880abb795afd9467abfc5398e7a18921fa57e75c7042d7b11af11bfebacdc3ec5714a11c646d27b71359f6846a15321

Download Submit
C:\Windows\System\yDnxaiP.exe

Filesize
1.1MB

MD5
7f1f4ea133b8cb4a482cefa58258f5e6

SHA1
3b646d93569a2fef6c79856a63b41e715ea4cbc4

SHA256
ddc505da17d67f0a6841b60eb670386091e57adc6bbacd36c95e84521d105299

SHA512
51f96ecb1a915c4ad69f9c9b5c2c7b2ebf0082a776d2fad6c7125097654e8f245c33ca475434a24becb7a9db62871784a4fe826aa1e59b0101ae55dc297f42b0

Download Submit
memory/2816-0-0x000002561BAB0000-0x000002561BAC0000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads