xmrig | 248d84391bfcb8ce2637caa440df63a401a8ba50f790baeb0e03924a80dc12cc

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
25-01-2025 20:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

248d84391bfcb8ce2637caa440df63a401a8ba50f790baeb0e03924a80dc12cc.exe
Size

1.7MB
MD5

043445a43a65e13e00a71a6c94077776
SHA1

1efec0bbf414eddc163e31d99690cfb3fb834220
SHA256

248d84391bfcb8ce2637caa440df63a401a8ba50f790baeb0e03924a80dc12cc
SHA512

3465a8f0897fe1481f3147bade2c29f47bffa09ee3682ad9bb0198fed0b5ee8b3fdcfe0316f73b81198dc7e030dc092bce71b99577a913fc07da3127296a85b1
SSDEEP

49152:GezaTF8FcNkNdfE0pZ9ozttwIRxj4c5yOBZ/e3Qpc:GemTLkNdfE0pZyS

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 33 IoCs

miner

resource	yara_rule
behavioral2/files/0x000a000000023c1f-4.dat	xmrig
behavioral2/files/0x0008000000023cab-9.dat	xmrig
behavioral2/files/0x0007000000023caf-8.dat	xmrig
behavioral2/files/0x0007000000023cb0-20.dat	xmrig
behavioral2/files/0x0007000000023cb8-63.dat	xmrig
behavioral2/files/0x0007000000023cc3-117.dat	xmrig
behavioral2/files/0x0007000000023cc8-143.dat	xmrig
behavioral2/files/0x0007000000023ccd-162.dat	xmrig
behavioral2/files/0x0007000000023ccc-159.dat	xmrig
behavioral2/files/0x0007000000023ccb-157.dat	xmrig
behavioral2/files/0x0007000000023cca-153.dat	xmrig
behavioral2/files/0x0007000000023cc9-147.dat	xmrig
behavioral2/files/0x0007000000023cc7-135.dat	xmrig
behavioral2/files/0x0007000000023cc6-133.dat	xmrig
behavioral2/files/0x0007000000023cc5-127.dat	xmrig
behavioral2/files/0x0007000000023cc4-123.dat	xmrig
behavioral2/files/0x0007000000023cc2-113.dat	xmrig
behavioral2/files/0x0007000000023cc1-107.dat	xmrig
behavioral2/files/0x0007000000023cc0-103.dat	xmrig
behavioral2/files/0x0007000000023cbf-97.dat	xmrig
behavioral2/files/0x0007000000023cbe-93.dat	xmrig
behavioral2/files/0x0007000000023cbd-87.dat	xmrig
behavioral2/files/0x0007000000023cbc-83.dat	xmrig
behavioral2/files/0x0007000000023cbb-77.dat	xmrig
behavioral2/files/0x0007000000023cba-73.dat	xmrig
behavioral2/files/0x0007000000023cb9-67.dat	xmrig
behavioral2/files/0x0007000000023cb7-57.dat	xmrig
behavioral2/files/0x0007000000023cb6-53.dat	xmrig
behavioral2/files/0x0007000000023cb5-45.dat	xmrig
behavioral2/files/0x0007000000023cb4-40.dat	xmrig
behavioral2/files/0x0007000000023cb3-35.dat	xmrig
behavioral2/files/0x0007000000023cb2-30.dat	xmrig
behavioral2/files/0x0007000000023cb1-24.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
5068	XGNlzJI.exe
5116	VfJAuKr.exe
1716	BbdjlEc.exe
532	RVNpPOt.exe
4576	sREmFtg.exe
228	FGONylU.exe
536	ldJyPjH.exe
3488	wXaSXAb.exe
4192	INHlKyV.exe
2240	JEYbCta.exe
3140	tfZdAMd.exe
3412	JJbzyOU.exe
3116	ehPgTfc.exe
516	SIaBZim.exe
2376	GZqEHyZ.exe
2872	pqBekbs.exe
1952	dMpfrKp.exe
4384	sUPfWOo.exe
4320	oJPtVTl.exe
2300	zfoJWrB.exe
4224	edXxSZL.exe
4456	RATgSYb.exe
1388	idGmRsd.exe
2380	ZVWKYyW.exe
2508	AvUfRlH.exe
4572	wacqzbu.exe
1764	qhQOdAz.exe
1844	LfwbiOJ.exe
876	gNhRQsD.exe
2260	xRCBwGs.exe
2624	zIHUmpo.exe
2368	wQeRGmA.exe
3984	JcgjgcT.exe
2492	xFIflwN.exe
3428	cWLkaer.exe
4688	vtutFcr.exe
940	Hjvxwtj.exe
1012	ufdjruE.exe
3708	lVYDhBN.exe
4404	feBpfCK.exe
3288	VgAUMLX.exe
708	uXiiVnw.exe
3204	intCTpf.exe
3352	RaFxvoR.exe
2004	gyGpUfb.exe
3396	AdrIMlm.exe
1432	PIYUQHv.exe
3332	wqIuCyr.exe
1736	laMEFHj.exe
4936	anmlwzS.exe
812	NKdqKYx.exe
4016	dJuByfn.exe
4904	LoPthPg.exe
1968	ABMlAje.exe
3492	zWTuPoU.exe
1128	axFnfnd.exe
4284	pgkjsOV.exe
3124	yuWRSjQ.exe
4512	ZQcbbee.exe
2052	NOueVpx.exe
4064	mLLEPry.exe
2132	ArgKHzm.exe
1820	XPUDUQG.exe
2440	RBaOpzw.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\nvkNvjW.exe	248d84391bfcb8ce2637caa440df63a401a8ba50f790baeb0e03924a80dc12cc.exe
File created	C:\Windows\System\dHTwgEl.exe	248d84391bfcb8ce2637caa440df63a401a8ba50f790baeb0e03924a80dc12cc.exe
File created	C:\Windows\System\WdRwSHe.exe	248d84391bfcb8ce2637caa440df63a401a8ba50f790baeb0e03924a80dc12cc.exe
File created	C:\Windows\System\SnQqodV.exe	248d84391bfcb8ce2637caa440df63a401a8ba50f790baeb0e03924a80dc12cc.exe
File created	C:\Windows\System\RTRsMZR.exe	248d84391bfcb8ce2637caa440df63a401a8ba50f790baeb0e03924a80dc12cc.exe
File created	C:\Windows\System\RMucruh.exe	248d84391bfcb8ce2637caa440df63a401a8ba50f790baeb0e03924a80dc12cc.exe
File created	C:\Windows\System\JnJTayg.exe	248d84391bfcb8ce2637caa440df63a401a8ba50f790baeb0e03924a80dc12cc.exe
File created	C:\Windows\System\SDuYNxG.exe	248d84391bfcb8ce2637caa440df63a401a8ba50f790baeb0e03924a80dc12cc.exe
File created	C:\Windows\System\xvBoLoP.exe	248d84391bfcb8ce2637caa440df63a401a8ba50f790baeb0e03924a80dc12cc.exe
File created	C:\Windows\System\GbKthew.exe	248d84391bfcb8ce2637caa440df63a401a8ba50f790baeb0e03924a80dc12cc.exe
File created	C:\Windows\System\hXZXNav.exe	248d84391bfcb8ce2637caa440df63a401a8ba50f790baeb0e03924a80dc12cc.exe
File created	C:\Windows\System\iYsfHjO.exe	248d84391bfcb8ce2637caa440df63a401a8ba50f790baeb0e03924a80dc12cc.exe
File created	C:\Windows\System\JJbzyOU.exe	248d84391bfcb8ce2637caa440df63a401a8ba50f790baeb0e03924a80dc12cc.exe
File created	C:\Windows\System\hMOxzMV.exe	248d84391bfcb8ce2637caa440df63a401a8ba50f790baeb0e03924a80dc12cc.exe
File created	C:\Windows\System\DlJGEcA.exe	248d84391bfcb8ce2637caa440df63a401a8ba50f790baeb0e03924a80dc12cc.exe
File created	C:\Windows\System\YByJQaF.exe	248d84391bfcb8ce2637caa440df63a401a8ba50f790baeb0e03924a80dc12cc.exe
File created	C:\Windows\System\bPYeojp.exe	248d84391bfcb8ce2637caa440df63a401a8ba50f790baeb0e03924a80dc12cc.exe
File created	C:\Windows\System\ipdnXDL.exe	248d84391bfcb8ce2637caa440df63a401a8ba50f790baeb0e03924a80dc12cc.exe
File created	C:\Windows\System\gQfRWvw.exe	248d84391bfcb8ce2637caa440df63a401a8ba50f790baeb0e03924a80dc12cc.exe
File created	C:\Windows\System\KcxcXci.exe	248d84391bfcb8ce2637caa440df63a401a8ba50f790baeb0e03924a80dc12cc.exe
File created	C:\Windows\System\RBaOpzw.exe	248d84391bfcb8ce2637caa440df63a401a8ba50f790baeb0e03924a80dc12cc.exe
File created	C:\Windows\System\TUmInpk.exe	248d84391bfcb8ce2637caa440df63a401a8ba50f790baeb0e03924a80dc12cc.exe
File created	C:\Windows\System\zIHUmpo.exe	248d84391bfcb8ce2637caa440df63a401a8ba50f790baeb0e03924a80dc12cc.exe
File created	C:\Windows\System\dIyZriB.exe	248d84391bfcb8ce2637caa440df63a401a8ba50f790baeb0e03924a80dc12cc.exe
File created	C:\Windows\System\iDtHguD.exe	248d84391bfcb8ce2637caa440df63a401a8ba50f790baeb0e03924a80dc12cc.exe
File created	C:\Windows\System\sparGsm.exe	248d84391bfcb8ce2637caa440df63a401a8ba50f790baeb0e03924a80dc12cc.exe
File created	C:\Windows\System\UixEsZl.exe	248d84391bfcb8ce2637caa440df63a401a8ba50f790baeb0e03924a80dc12cc.exe
File created	C:\Windows\System\dZSQVxf.exe	248d84391bfcb8ce2637caa440df63a401a8ba50f790baeb0e03924a80dc12cc.exe
File created	C:\Windows\System\XPUDUQG.exe	248d84391bfcb8ce2637caa440df63a401a8ba50f790baeb0e03924a80dc12cc.exe
File created	C:\Windows\System\PcCVtAF.exe	248d84391bfcb8ce2637caa440df63a401a8ba50f790baeb0e03924a80dc12cc.exe
File created	C:\Windows\System\kLQwrCz.exe	248d84391bfcb8ce2637caa440df63a401a8ba50f790baeb0e03924a80dc12cc.exe
File created	C:\Windows\System\oIsvUoe.exe	248d84391bfcb8ce2637caa440df63a401a8ba50f790baeb0e03924a80dc12cc.exe
File created	C:\Windows\System\wqIuCyr.exe	248d84391bfcb8ce2637caa440df63a401a8ba50f790baeb0e03924a80dc12cc.exe
File created	C:\Windows\System\bUsKBii.exe	248d84391bfcb8ce2637caa440df63a401a8ba50f790baeb0e03924a80dc12cc.exe
File created	C:\Windows\System\ONWETSo.exe	248d84391bfcb8ce2637caa440df63a401a8ba50f790baeb0e03924a80dc12cc.exe
File created	C:\Windows\System\rywXvkP.exe	248d84391bfcb8ce2637caa440df63a401a8ba50f790baeb0e03924a80dc12cc.exe
File created	C:\Windows\System\PIYUQHv.exe	248d84391bfcb8ce2637caa440df63a401a8ba50f790baeb0e03924a80dc12cc.exe
File created	C:\Windows\System\nuJeJrN.exe	248d84391bfcb8ce2637caa440df63a401a8ba50f790baeb0e03924a80dc12cc.exe
File created	C:\Windows\System\uzOORvB.exe	248d84391bfcb8ce2637caa440df63a401a8ba50f790baeb0e03924a80dc12cc.exe
File created	C:\Windows\System\kTbsXxI.exe	248d84391bfcb8ce2637caa440df63a401a8ba50f790baeb0e03924a80dc12cc.exe
File created	C:\Windows\System\GRMauDW.exe	248d84391bfcb8ce2637caa440df63a401a8ba50f790baeb0e03924a80dc12cc.exe
File created	C:\Windows\System\JdXDCtq.exe	248d84391bfcb8ce2637caa440df63a401a8ba50f790baeb0e03924a80dc12cc.exe
File created	C:\Windows\System\zPtDxtC.exe	248d84391bfcb8ce2637caa440df63a401a8ba50f790baeb0e03924a80dc12cc.exe
File created	C:\Windows\System\tJdTfDv.exe	248d84391bfcb8ce2637caa440df63a401a8ba50f790baeb0e03924a80dc12cc.exe
File created	C:\Windows\System\HoYsaRr.exe	248d84391bfcb8ce2637caa440df63a401a8ba50f790baeb0e03924a80dc12cc.exe
File created	C:\Windows\System\mGOZjBA.exe	248d84391bfcb8ce2637caa440df63a401a8ba50f790baeb0e03924a80dc12cc.exe
File created	C:\Windows\System\AloOzny.exe	248d84391bfcb8ce2637caa440df63a401a8ba50f790baeb0e03924a80dc12cc.exe
File created	C:\Windows\System\IzwujiQ.exe	248d84391bfcb8ce2637caa440df63a401a8ba50f790baeb0e03924a80dc12cc.exe
File created	C:\Windows\System\gpzgCWo.exe	248d84391bfcb8ce2637caa440df63a401a8ba50f790baeb0e03924a80dc12cc.exe
File created	C:\Windows\System\lXWWVUn.exe	248d84391bfcb8ce2637caa440df63a401a8ba50f790baeb0e03924a80dc12cc.exe
File created	C:\Windows\System\YdHUDHu.exe	248d84391bfcb8ce2637caa440df63a401a8ba50f790baeb0e03924a80dc12cc.exe
File created	C:\Windows\System\nTvnfFM.exe	248d84391bfcb8ce2637caa440df63a401a8ba50f790baeb0e03924a80dc12cc.exe
File created	C:\Windows\System\rjcgjQD.exe	248d84391bfcb8ce2637caa440df63a401a8ba50f790baeb0e03924a80dc12cc.exe
File created	C:\Windows\System\FEkDWGD.exe	248d84391bfcb8ce2637caa440df63a401a8ba50f790baeb0e03924a80dc12cc.exe
File created	C:\Windows\System\RaFxvoR.exe	248d84391bfcb8ce2637caa440df63a401a8ba50f790baeb0e03924a80dc12cc.exe
File created	C:\Windows\System\hKEKeDH.exe	248d84391bfcb8ce2637caa440df63a401a8ba50f790baeb0e03924a80dc12cc.exe
File created	C:\Windows\System\iTrCGUB.exe	248d84391bfcb8ce2637caa440df63a401a8ba50f790baeb0e03924a80dc12cc.exe
File created	C:\Windows\System\FGONylU.exe	248d84391bfcb8ce2637caa440df63a401a8ba50f790baeb0e03924a80dc12cc.exe
File created	C:\Windows\System\PHAhWnp.exe	248d84391bfcb8ce2637caa440df63a401a8ba50f790baeb0e03924a80dc12cc.exe
File created	C:\Windows\System\hhFXAbD.exe	248d84391bfcb8ce2637caa440df63a401a8ba50f790baeb0e03924a80dc12cc.exe
File created	C:\Windows\System\lAhpjDJ.exe	248d84391bfcb8ce2637caa440df63a401a8ba50f790baeb0e03924a80dc12cc.exe
File created	C:\Windows\System\ROZFtCn.exe	248d84391bfcb8ce2637caa440df63a401a8ba50f790baeb0e03924a80dc12cc.exe
File created	C:\Windows\System\cQoEAyT.exe	248d84391bfcb8ce2637caa440df63a401a8ba50f790baeb0e03924a80dc12cc.exe
File created	C:\Windows\System\XZHJtot.exe	248d84391bfcb8ce2637caa440df63a401a8ba50f790baeb0e03924a80dc12cc.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	17380	dwm.exe
Token: SeChangeNotifyPrivilege	17380	dwm.exe
Token: 33	17380	dwm.exe
Token: SeIncBasePriorityPrivilege	17380	dwm.exe
Token: SeShutdownPrivilege	17380	dwm.exe
Token: SeCreatePagefilePrivilege	17380	dwm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4536 wrote to memory of 5068	4536	248d84391bfcb8ce2637caa440df63a401a8ba50f790baeb0e03924a80dc12cc.exe	84
PID 4536 wrote to memory of 5068	4536	248d84391bfcb8ce2637caa440df63a401a8ba50f790baeb0e03924a80dc12cc.exe	84
PID 4536 wrote to memory of 5116	4536	248d84391bfcb8ce2637caa440df63a401a8ba50f790baeb0e03924a80dc12cc.exe	85
PID 4536 wrote to memory of 5116	4536	248d84391bfcb8ce2637caa440df63a401a8ba50f790baeb0e03924a80dc12cc.exe	85
PID 4536 wrote to memory of 1716	4536	248d84391bfcb8ce2637caa440df63a401a8ba50f790baeb0e03924a80dc12cc.exe	86
PID 4536 wrote to memory of 1716	4536	248d84391bfcb8ce2637caa440df63a401a8ba50f790baeb0e03924a80dc12cc.exe	86
PID 4536 wrote to memory of 532	4536	248d84391bfcb8ce2637caa440df63a401a8ba50f790baeb0e03924a80dc12cc.exe	87
PID 4536 wrote to memory of 532	4536	248d84391bfcb8ce2637caa440df63a401a8ba50f790baeb0e03924a80dc12cc.exe	87
PID 4536 wrote to memory of 4576	4536	248d84391bfcb8ce2637caa440df63a401a8ba50f790baeb0e03924a80dc12cc.exe	88
PID 4536 wrote to memory of 4576	4536	248d84391bfcb8ce2637caa440df63a401a8ba50f790baeb0e03924a80dc12cc.exe	88
PID 4536 wrote to memory of 228	4536	248d84391bfcb8ce2637caa440df63a401a8ba50f790baeb0e03924a80dc12cc.exe	89
PID 4536 wrote to memory of 228	4536	248d84391bfcb8ce2637caa440df63a401a8ba50f790baeb0e03924a80dc12cc.exe	89
PID 4536 wrote to memory of 536	4536	248d84391bfcb8ce2637caa440df63a401a8ba50f790baeb0e03924a80dc12cc.exe	90
PID 4536 wrote to memory of 536	4536	248d84391bfcb8ce2637caa440df63a401a8ba50f790baeb0e03924a80dc12cc.exe	90
PID 4536 wrote to memory of 3488	4536	248d84391bfcb8ce2637caa440df63a401a8ba50f790baeb0e03924a80dc12cc.exe	91
PID 4536 wrote to memory of 3488	4536	248d84391bfcb8ce2637caa440df63a401a8ba50f790baeb0e03924a80dc12cc.exe	91
PID 4536 wrote to memory of 4192	4536	248d84391bfcb8ce2637caa440df63a401a8ba50f790baeb0e03924a80dc12cc.exe	92
PID 4536 wrote to memory of 4192	4536	248d84391bfcb8ce2637caa440df63a401a8ba50f790baeb0e03924a80dc12cc.exe	92
PID 4536 wrote to memory of 2240	4536	248d84391bfcb8ce2637caa440df63a401a8ba50f790baeb0e03924a80dc12cc.exe	93
PID 4536 wrote to memory of 2240	4536	248d84391bfcb8ce2637caa440df63a401a8ba50f790baeb0e03924a80dc12cc.exe	93
PID 4536 wrote to memory of 3140	4536	248d84391bfcb8ce2637caa440df63a401a8ba50f790baeb0e03924a80dc12cc.exe	94
PID 4536 wrote to memory of 3140	4536	248d84391bfcb8ce2637caa440df63a401a8ba50f790baeb0e03924a80dc12cc.exe	94
PID 4536 wrote to memory of 3412	4536	248d84391bfcb8ce2637caa440df63a401a8ba50f790baeb0e03924a80dc12cc.exe	95
PID 4536 wrote to memory of 3412	4536	248d84391bfcb8ce2637caa440df63a401a8ba50f790baeb0e03924a80dc12cc.exe	95
PID 4536 wrote to memory of 3116	4536	248d84391bfcb8ce2637caa440df63a401a8ba50f790baeb0e03924a80dc12cc.exe	96
PID 4536 wrote to memory of 3116	4536	248d84391bfcb8ce2637caa440df63a401a8ba50f790baeb0e03924a80dc12cc.exe	96
PID 4536 wrote to memory of 516	4536	248d84391bfcb8ce2637caa440df63a401a8ba50f790baeb0e03924a80dc12cc.exe	97
PID 4536 wrote to memory of 516	4536	248d84391bfcb8ce2637caa440df63a401a8ba50f790baeb0e03924a80dc12cc.exe	97
PID 4536 wrote to memory of 2376	4536	248d84391bfcb8ce2637caa440df63a401a8ba50f790baeb0e03924a80dc12cc.exe	98
PID 4536 wrote to memory of 2376	4536	248d84391bfcb8ce2637caa440df63a401a8ba50f790baeb0e03924a80dc12cc.exe	98
PID 4536 wrote to memory of 2872	4536	248d84391bfcb8ce2637caa440df63a401a8ba50f790baeb0e03924a80dc12cc.exe	99
PID 4536 wrote to memory of 2872	4536	248d84391bfcb8ce2637caa440df63a401a8ba50f790baeb0e03924a80dc12cc.exe	99
PID 4536 wrote to memory of 1952	4536	248d84391bfcb8ce2637caa440df63a401a8ba50f790baeb0e03924a80dc12cc.exe	100
PID 4536 wrote to memory of 1952	4536	248d84391bfcb8ce2637caa440df63a401a8ba50f790baeb0e03924a80dc12cc.exe	100
PID 4536 wrote to memory of 4384	4536	248d84391bfcb8ce2637caa440df63a401a8ba50f790baeb0e03924a80dc12cc.exe	101
PID 4536 wrote to memory of 4384	4536	248d84391bfcb8ce2637caa440df63a401a8ba50f790baeb0e03924a80dc12cc.exe	101
PID 4536 wrote to memory of 4320	4536	248d84391bfcb8ce2637caa440df63a401a8ba50f790baeb0e03924a80dc12cc.exe	102
PID 4536 wrote to memory of 4320	4536	248d84391bfcb8ce2637caa440df63a401a8ba50f790baeb0e03924a80dc12cc.exe	102
PID 4536 wrote to memory of 2300	4536	248d84391bfcb8ce2637caa440df63a401a8ba50f790baeb0e03924a80dc12cc.exe	103
PID 4536 wrote to memory of 2300	4536	248d84391bfcb8ce2637caa440df63a401a8ba50f790baeb0e03924a80dc12cc.exe	103
PID 4536 wrote to memory of 4224	4536	248d84391bfcb8ce2637caa440df63a401a8ba50f790baeb0e03924a80dc12cc.exe	104
PID 4536 wrote to memory of 4224	4536	248d84391bfcb8ce2637caa440df63a401a8ba50f790baeb0e03924a80dc12cc.exe	104
PID 4536 wrote to memory of 4456	4536	248d84391bfcb8ce2637caa440df63a401a8ba50f790baeb0e03924a80dc12cc.exe	105
PID 4536 wrote to memory of 4456	4536	248d84391bfcb8ce2637caa440df63a401a8ba50f790baeb0e03924a80dc12cc.exe	105
PID 4536 wrote to memory of 1388	4536	248d84391bfcb8ce2637caa440df63a401a8ba50f790baeb0e03924a80dc12cc.exe	106
PID 4536 wrote to memory of 1388	4536	248d84391bfcb8ce2637caa440df63a401a8ba50f790baeb0e03924a80dc12cc.exe	106
PID 4536 wrote to memory of 2380	4536	248d84391bfcb8ce2637caa440df63a401a8ba50f790baeb0e03924a80dc12cc.exe	107
PID 4536 wrote to memory of 2380	4536	248d84391bfcb8ce2637caa440df63a401a8ba50f790baeb0e03924a80dc12cc.exe	107
PID 4536 wrote to memory of 2508	4536	248d84391bfcb8ce2637caa440df63a401a8ba50f790baeb0e03924a80dc12cc.exe	108
PID 4536 wrote to memory of 2508	4536	248d84391bfcb8ce2637caa440df63a401a8ba50f790baeb0e03924a80dc12cc.exe	108
PID 4536 wrote to memory of 4572	4536	248d84391bfcb8ce2637caa440df63a401a8ba50f790baeb0e03924a80dc12cc.exe	109
PID 4536 wrote to memory of 4572	4536	248d84391bfcb8ce2637caa440df63a401a8ba50f790baeb0e03924a80dc12cc.exe	109
PID 4536 wrote to memory of 1764	4536	248d84391bfcb8ce2637caa440df63a401a8ba50f790baeb0e03924a80dc12cc.exe	110
PID 4536 wrote to memory of 1764	4536	248d84391bfcb8ce2637caa440df63a401a8ba50f790baeb0e03924a80dc12cc.exe	110
PID 4536 wrote to memory of 1844	4536	248d84391bfcb8ce2637caa440df63a401a8ba50f790baeb0e03924a80dc12cc.exe	111
PID 4536 wrote to memory of 1844	4536	248d84391bfcb8ce2637caa440df63a401a8ba50f790baeb0e03924a80dc12cc.exe	111
PID 4536 wrote to memory of 876	4536	248d84391bfcb8ce2637caa440df63a401a8ba50f790baeb0e03924a80dc12cc.exe	112
PID 4536 wrote to memory of 876	4536	248d84391bfcb8ce2637caa440df63a401a8ba50f790baeb0e03924a80dc12cc.exe	112
PID 4536 wrote to memory of 2260	4536	248d84391bfcb8ce2637caa440df63a401a8ba50f790baeb0e03924a80dc12cc.exe	113
PID 4536 wrote to memory of 2260	4536	248d84391bfcb8ce2637caa440df63a401a8ba50f790baeb0e03924a80dc12cc.exe	113
PID 4536 wrote to memory of 2624	4536	248d84391bfcb8ce2637caa440df63a401a8ba50f790baeb0e03924a80dc12cc.exe	114
PID 4536 wrote to memory of 2624	4536	248d84391bfcb8ce2637caa440df63a401a8ba50f790baeb0e03924a80dc12cc.exe	114
PID 4536 wrote to memory of 2368	4536	248d84391bfcb8ce2637caa440df63a401a8ba50f790baeb0e03924a80dc12cc.exe	115
PID 4536 wrote to memory of 2368	4536	248d84391bfcb8ce2637caa440df63a401a8ba50f790baeb0e03924a80dc12cc.exe	115

C:\Users\Admin\AppData\Local\Temp\248d84391bfcb8ce2637caa440df63a401a8ba50f790baeb0e03924a80dc12cc.exe
"C:\Users\Admin\AppData\Local\Temp\248d84391bfcb8ce2637caa440df63a401a8ba50f790baeb0e03924a80dc12cc.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4536
- C:\Windows\System\XGNlzJI.exe
  C:\Windows\System\XGNlzJI.exe
  2⤵
  - Executes dropped EXE
  PID:5068
- C:\Windows\System\VfJAuKr.exe
  C:\Windows\System\VfJAuKr.exe
  2⤵
  - Executes dropped EXE
  PID:5116
- C:\Windows\System\BbdjlEc.exe
  C:\Windows\System\BbdjlEc.exe
  2⤵
  - Executes dropped EXE
  PID:1716
- C:\Windows\System\RVNpPOt.exe
  C:\Windows\System\RVNpPOt.exe
  2⤵
  - Executes dropped EXE
  PID:532
- C:\Windows\System\sREmFtg.exe
  C:\Windows\System\sREmFtg.exe
  2⤵
  - Executes dropped EXE
  PID:4576
- C:\Windows\System\FGONylU.exe
  C:\Windows\System\FGONylU.exe
  2⤵
  - Executes dropped EXE
  PID:228
- C:\Windows\System\ldJyPjH.exe
  C:\Windows\System\ldJyPjH.exe
  2⤵
  - Executes dropped EXE
  PID:536
- C:\Windows\System\wXaSXAb.exe
  C:\Windows\System\wXaSXAb.exe
  2⤵
  - Executes dropped EXE
  PID:3488
- C:\Windows\System\INHlKyV.exe
  C:\Windows\System\INHlKyV.exe
  2⤵
  - Executes dropped EXE
  PID:4192
- C:\Windows\System\JEYbCta.exe
  C:\Windows\System\JEYbCta.exe
  2⤵
  - Executes dropped EXE
  PID:2240
- C:\Windows\System\tfZdAMd.exe
  C:\Windows\System\tfZdAMd.exe
  2⤵
  - Executes dropped EXE
  PID:3140
- C:\Windows\System\JJbzyOU.exe
  C:\Windows\System\JJbzyOU.exe
  2⤵
  - Executes dropped EXE
  PID:3412
- C:\Windows\System\ehPgTfc.exe
  C:\Windows\System\ehPgTfc.exe
  2⤵
  - Executes dropped EXE
  PID:3116
- C:\Windows\System\SIaBZim.exe
  C:\Windows\System\SIaBZim.exe
  2⤵
  - Executes dropped EXE
  PID:516
- C:\Windows\System\GZqEHyZ.exe
  C:\Windows\System\GZqEHyZ.exe
  2⤵
  - Executes dropped EXE
  PID:2376
- C:\Windows\System\pqBekbs.exe
  C:\Windows\System\pqBekbs.exe
  2⤵
  - Executes dropped EXE
  PID:2872
- C:\Windows\System\dMpfrKp.exe
  C:\Windows\System\dMpfrKp.exe
  2⤵
  - Executes dropped EXE
  PID:1952
- C:\Windows\System\sUPfWOo.exe
  C:\Windows\System\sUPfWOo.exe
  2⤵
  - Executes dropped EXE
  PID:4384
- C:\Windows\System\oJPtVTl.exe
  C:\Windows\System\oJPtVTl.exe
  2⤵
  - Executes dropped EXE
  PID:4320
- C:\Windows\System\zfoJWrB.exe
  C:\Windows\System\zfoJWrB.exe
  2⤵
  - Executes dropped EXE
  PID:2300
- C:\Windows\System\edXxSZL.exe
  C:\Windows\System\edXxSZL.exe
  2⤵
  - Executes dropped EXE
  PID:4224
- C:\Windows\System\RATgSYb.exe
  C:\Windows\System\RATgSYb.exe
  2⤵
  - Executes dropped EXE
  PID:4456
- C:\Windows\System\idGmRsd.exe
  C:\Windows\System\idGmRsd.exe
  2⤵
  - Executes dropped EXE
  PID:1388
- C:\Windows\System\ZVWKYyW.exe
  C:\Windows\System\ZVWKYyW.exe
  2⤵
  - Executes dropped EXE
  PID:2380
- C:\Windows\System\AvUfRlH.exe
  C:\Windows\System\AvUfRlH.exe
  2⤵
  - Executes dropped EXE
  PID:2508
- C:\Windows\System\wacqzbu.exe
  C:\Windows\System\wacqzbu.exe
  2⤵
  - Executes dropped EXE
  PID:4572
- C:\Windows\System\qhQOdAz.exe
  C:\Windows\System\qhQOdAz.exe
  2⤵
  - Executes dropped EXE
  PID:1764
- C:\Windows\System\LfwbiOJ.exe
  C:\Windows\System\LfwbiOJ.exe
  2⤵
  - Executes dropped EXE
  PID:1844
- C:\Windows\System\gNhRQsD.exe
  C:\Windows\System\gNhRQsD.exe
  2⤵
  - Executes dropped EXE
  PID:876
- C:\Windows\System\xRCBwGs.exe
  C:\Windows\System\xRCBwGs.exe
  2⤵
  - Executes dropped EXE
  PID:2260
- C:\Windows\System\zIHUmpo.exe
  C:\Windows\System\zIHUmpo.exe
  2⤵
  - Executes dropped EXE
  PID:2624
- C:\Windows\System\wQeRGmA.exe
  C:\Windows\System\wQeRGmA.exe
  2⤵
  - Executes dropped EXE
  PID:2368
- C:\Windows\System\JcgjgcT.exe
  C:\Windows\System\JcgjgcT.exe
  2⤵
  - Executes dropped EXE
  PID:3984
- C:\Windows\System\xFIflwN.exe
  C:\Windows\System\xFIflwN.exe
  2⤵
  - Executes dropped EXE
  PID:2492
- C:\Windows\System\cWLkaer.exe
  C:\Windows\System\cWLkaer.exe
  2⤵
  - Executes dropped EXE
  PID:3428
- C:\Windows\System\vtutFcr.exe
  C:\Windows\System\vtutFcr.exe
  2⤵
  - Executes dropped EXE
  PID:4688
- C:\Windows\System\Hjvxwtj.exe
  C:\Windows\System\Hjvxwtj.exe
  2⤵
  - Executes dropped EXE
  PID:940
- C:\Windows\System\ufdjruE.exe
  C:\Windows\System\ufdjruE.exe
  2⤵
  - Executes dropped EXE
  PID:1012
- C:\Windows\System\lVYDhBN.exe
  C:\Windows\System\lVYDhBN.exe
  2⤵
  - Executes dropped EXE
  PID:3708
- C:\Windows\System\feBpfCK.exe
  C:\Windows\System\feBpfCK.exe
  2⤵
  - Executes dropped EXE
  PID:4404
- C:\Windows\System\VgAUMLX.exe
  C:\Windows\System\VgAUMLX.exe
  2⤵
  - Executes dropped EXE
  PID:3288
- C:\Windows\System\uXiiVnw.exe
  C:\Windows\System\uXiiVnw.exe
  2⤵
  - Executes dropped EXE
  PID:708
- C:\Windows\System\intCTpf.exe
  C:\Windows\System\intCTpf.exe
  2⤵
  - Executes dropped EXE
  PID:3204
- C:\Windows\System\RaFxvoR.exe
  C:\Windows\System\RaFxvoR.exe
  2⤵
  - Executes dropped EXE
  PID:3352
- C:\Windows\System\gyGpUfb.exe
  C:\Windows\System\gyGpUfb.exe
  2⤵
  - Executes dropped EXE
  PID:2004
- C:\Windows\System\AdrIMlm.exe
  C:\Windows\System\AdrIMlm.exe
  2⤵
  - Executes dropped EXE
  PID:3396
- C:\Windows\System\PIYUQHv.exe
  C:\Windows\System\PIYUQHv.exe
  2⤵
  - Executes dropped EXE
  PID:1432
- C:\Windows\System\wqIuCyr.exe
  C:\Windows\System\wqIuCyr.exe
  2⤵
  - Executes dropped EXE
  PID:3332
- C:\Windows\System\laMEFHj.exe
  C:\Windows\System\laMEFHj.exe
  2⤵
  - Executes dropped EXE
  PID:1736
- C:\Windows\System\anmlwzS.exe
  C:\Windows\System\anmlwzS.exe
  2⤵
  - Executes dropped EXE
  PID:4936
- C:\Windows\System\NKdqKYx.exe
  C:\Windows\System\NKdqKYx.exe
  2⤵
  - Executes dropped EXE
  PID:812
- C:\Windows\System\dJuByfn.exe
  C:\Windows\System\dJuByfn.exe
  2⤵
  - Executes dropped EXE
  PID:4016
- C:\Windows\System\LoPthPg.exe
  C:\Windows\System\LoPthPg.exe
  2⤵
  - Executes dropped EXE
  PID:4904
- C:\Windows\System\ABMlAje.exe
  C:\Windows\System\ABMlAje.exe
  2⤵
  - Executes dropped EXE
  PID:1968
- C:\Windows\System\zWTuPoU.exe
  C:\Windows\System\zWTuPoU.exe
  2⤵
  - Executes dropped EXE
  PID:3492
- C:\Windows\System\axFnfnd.exe
  C:\Windows\System\axFnfnd.exe
  2⤵
  - Executes dropped EXE
  PID:1128
- C:\Windows\System\pgkjsOV.exe
  C:\Windows\System\pgkjsOV.exe
  2⤵
  - Executes dropped EXE
  PID:4284
- C:\Windows\System\yuWRSjQ.exe
  C:\Windows\System\yuWRSjQ.exe
  2⤵
  - Executes dropped EXE
  PID:3124
- C:\Windows\System\ZQcbbee.exe
  C:\Windows\System\ZQcbbee.exe
  2⤵
  - Executes dropped EXE
  PID:4512
- C:\Windows\System\NOueVpx.exe
  C:\Windows\System\NOueVpx.exe
  2⤵
  - Executes dropped EXE
  PID:2052
- C:\Windows\System\mLLEPry.exe
  C:\Windows\System\mLLEPry.exe
  2⤵
  - Executes dropped EXE
  PID:4064
- C:\Windows\System\ArgKHzm.exe
  C:\Windows\System\ArgKHzm.exe
  2⤵
  - Executes dropped EXE
  PID:2132
- C:\Windows\System\XPUDUQG.exe
  C:\Windows\System\XPUDUQG.exe
  2⤵
  - Executes dropped EXE
  PID:1820
- C:\Windows\System\RBaOpzw.exe
  C:\Windows\System\RBaOpzw.exe
  2⤵
  - Executes dropped EXE
  PID:2440
- C:\Windows\System\gkzuEDH.exe
  C:\Windows\System\gkzuEDH.exe
  2⤵
  PID:348
- C:\Windows\System\kTbsXxI.exe
  C:\Windows\System\kTbsXxI.exe
  2⤵
  PID:2808
- C:\Windows\System\VdQGuBP.exe
  C:\Windows\System\VdQGuBP.exe
  2⤵
  PID:1616
- C:\Windows\System\TUmInpk.exe
  C:\Windows\System\TUmInpk.exe
  2⤵
  PID:4728
- C:\Windows\System\TkZUEhi.exe
  C:\Windows\System\TkZUEhi.exe
  2⤵
  PID:4092
- C:\Windows\System\BRDDWsW.exe
  C:\Windows\System\BRDDWsW.exe
  2⤵
  PID:4756
- C:\Windows\System\qKVchSd.exe
  C:\Windows\System\qKVchSd.exe
  2⤵
  PID:3820
- C:\Windows\System\IGqaIdf.exe
  C:\Windows\System\IGqaIdf.exe
  2⤵
  PID:4184
- C:\Windows\System\RpdipYP.exe
  C:\Windows\System\RpdipYP.exe
  2⤵
  PID:2236
- C:\Windows\System\HkGFUVS.exe
  C:\Windows\System\HkGFUVS.exe
  2⤵
  PID:3044
- C:\Windows\System\qJZGTPZ.exe
  C:\Windows\System\qJZGTPZ.exe
  2⤵
  PID:1692
- C:\Windows\System\JCthihk.exe
  C:\Windows\System\JCthihk.exe
  2⤵
  PID:2740
- C:\Windows\System\gXgODnr.exe
  C:\Windows\System\gXgODnr.exe
  2⤵
  PID:3468
- C:\Windows\System\dFNZmdq.exe
  C:\Windows\System\dFNZmdq.exe
  2⤵
  PID:1028
- C:\Windows\System\pzoQuTz.exe
  C:\Windows\System\pzoQuTz.exe
  2⤵
  PID:4660
- C:\Windows\System\jvbjFcf.exe
  C:\Windows\System\jvbjFcf.exe
  2⤵
  PID:3624
- C:\Windows\System\dgYAHCY.exe
  C:\Windows\System\dgYAHCY.exe
  2⤵
  PID:3064
- C:\Windows\System\EULoMRK.exe
  C:\Windows\System\EULoMRK.exe
  2⤵
  PID:1680
- C:\Windows\System\mmBgQqU.exe
  C:\Windows\System\mmBgQqU.exe
  2⤵
  PID:4280
- C:\Windows\System\uOMdkdz.exe
  C:\Windows\System\uOMdkdz.exe
  2⤵
  PID:620
- C:\Windows\System\oIsvUoe.exe
  C:\Windows\System\oIsvUoe.exe
  2⤵
  PID:3952
- C:\Windows\System\EVIhOlm.exe
  C:\Windows\System\EVIhOlm.exe
  2⤵
  PID:4040
- C:\Windows\System\DJYQgZV.exe
  C:\Windows\System\DJYQgZV.exe
  2⤵
  PID:4412
- C:\Windows\System\hmXwdfw.exe
  C:\Windows\System\hmXwdfw.exe
  2⤵
  PID:3480
- C:\Windows\System\KLPMVeO.exe
  C:\Windows\System\KLPMVeO.exe
  2⤵
  PID:5144
- C:\Windows\System\DcjrTcd.exe
  C:\Windows\System\DcjrTcd.exe
  2⤵
  PID:5176
- C:\Windows\System\DZpCJHW.exe
  C:\Windows\System\DZpCJHW.exe
  2⤵
  PID:5204
- C:\Windows\System\GvToPML.exe
  C:\Windows\System\GvToPML.exe
  2⤵
  PID:5228
- C:\Windows\System\FwKpQXb.exe
  C:\Windows\System\FwKpQXb.exe
  2⤵
  PID:5256
- C:\Windows\System\luqIfwW.exe
  C:\Windows\System\luqIfwW.exe
  2⤵
  PID:5288
- C:\Windows\System\ZcNbgDj.exe
  C:\Windows\System\ZcNbgDj.exe
  2⤵
  PID:5312
- C:\Windows\System\klQuSxg.exe
  C:\Windows\System\klQuSxg.exe
  2⤵
  PID:5344
- C:\Windows\System\WdRwSHe.exe
  C:\Windows\System\WdRwSHe.exe
  2⤵
  PID:5368
- C:\Windows\System\ygjEBUH.exe
  C:\Windows\System\ygjEBUH.exe
  2⤵
  PID:5400
- C:\Windows\System\ahmABwD.exe
  C:\Windows\System\ahmABwD.exe
  2⤵
  PID:5424
- C:\Windows\System\VjeIDfB.exe
  C:\Windows\System\VjeIDfB.exe
  2⤵
  PID:5456
- C:\Windows\System\hMOxzMV.exe
  C:\Windows\System\hMOxzMV.exe
  2⤵
  PID:5480
- C:\Windows\System\SBYVcKV.exe
  C:\Windows\System\SBYVcKV.exe
  2⤵
  PID:5516
- C:\Windows\System\JnJTayg.exe
  C:\Windows\System\JnJTayg.exe
  2⤵
  PID:5544
- C:\Windows\System\FFYueNH.exe
  C:\Windows\System\FFYueNH.exe
  2⤵
  PID:5576
- C:\Windows\System\VVyXKrD.exe
  C:\Windows\System\VVyXKrD.exe
  2⤵
  PID:5596
- C:\Windows\System\cxKvgjH.exe
  C:\Windows\System\cxKvgjH.exe
  2⤵
  PID:5620
- C:\Windows\System\qPzGKum.exe
  C:\Windows\System\qPzGKum.exe
  2⤵
  PID:5640
- C:\Windows\System\eoXpSxS.exe
  C:\Windows\System\eoXpSxS.exe
  2⤵
  PID:5668
- C:\Windows\System\fEaDOgv.exe
  C:\Windows\System\fEaDOgv.exe
  2⤵
  PID:5696
- C:\Windows\System\qPbasGb.exe
  C:\Windows\System\qPbasGb.exe
  2⤵
  PID:5720
- C:\Windows\System\PdcQAlJ.exe
  C:\Windows\System\PdcQAlJ.exe
  2⤵
  PID:5784
- C:\Windows\System\NJEBPRF.exe
  C:\Windows\System\NJEBPRF.exe
  2⤵
  PID:5800
- C:\Windows\System\WJFcynz.exe
  C:\Windows\System\WJFcynz.exe
  2⤵
  PID:5816
- C:\Windows\System\LYpTEnN.exe
  C:\Windows\System\LYpTEnN.exe
  2⤵
  PID:5840
- C:\Windows\System\EQfpzIo.exe
  C:\Windows\System\EQfpzIo.exe
  2⤵
  PID:5868
- C:\Windows\System\MXsFZuR.exe
  C:\Windows\System\MXsFZuR.exe
  2⤵
  PID:5896
- C:\Windows\System\cVytEYC.exe
  C:\Windows\System\cVytEYC.exe
  2⤵
  PID:5924
- C:\Windows\System\oJUBBYE.exe
  C:\Windows\System\oJUBBYE.exe
  2⤵
  PID:5952
- C:\Windows\System\mHZikwG.exe
  C:\Windows\System\mHZikwG.exe
  2⤵
  PID:5980
- C:\Windows\System\nGlFuZc.exe
  C:\Windows\System\nGlFuZc.exe
  2⤵
  PID:6008
- C:\Windows\System\wlUJPpf.exe
  C:\Windows\System\wlUJPpf.exe
  2⤵
  PID:6036
- C:\Windows\System\FOUomXF.exe
  C:\Windows\System\FOUomXF.exe
  2⤵
  PID:6064
- C:\Windows\System\hvDBQIr.exe
  C:\Windows\System\hvDBQIr.exe
  2⤵
  PID:6092
- C:\Windows\System\PcCVtAF.exe
  C:\Windows\System\PcCVtAF.exe
  2⤵
  PID:6120
- C:\Windows\System\BWkciYf.exe
  C:\Windows\System\BWkciYf.exe
  2⤵
  PID:1788
- C:\Windows\System\qlJsULq.exe
  C:\Windows\System\qlJsULq.exe
  2⤵
  PID:2632
- C:\Windows\System\yDNVnuJ.exe
  C:\Windows\System\yDNVnuJ.exe
  2⤵
  PID:1696
- C:\Windows\System\dcONNpH.exe
  C:\Windows\System\dcONNpH.exe
  2⤵
  PID:3676
- C:\Windows\System\SvXILOx.exe
  C:\Windows\System\SvXILOx.exe
  2⤵
  PID:4984
- C:\Windows\System\bSiBlia.exe
  C:\Windows\System\bSiBlia.exe
  2⤵
  PID:964
- C:\Windows\System\tQrKwxr.exe
  C:\Windows\System\tQrKwxr.exe
  2⤵
  PID:4208
- C:\Windows\System\RAxutpv.exe
  C:\Windows\System\RAxutpv.exe
  2⤵
  PID:4640
- C:\Windows\System\NsKewjO.exe
  C:\Windows\System\NsKewjO.exe
  2⤵
  PID:5184
- C:\Windows\System\KSRkdcY.exe
  C:\Windows\System\KSRkdcY.exe
  2⤵
  PID:5244
- C:\Windows\System\cQjOptu.exe
  C:\Windows\System\cQjOptu.exe
  2⤵
  PID:5308
- C:\Windows\System\yatIJRV.exe
  C:\Windows\System\yatIJRV.exe
  2⤵
  PID:5364
- C:\Windows\System\HUXqrMQ.exe
  C:\Windows\System\HUXqrMQ.exe
  2⤵
  PID:5436
- C:\Windows\System\okDNzoM.exe
  C:\Windows\System\okDNzoM.exe
  2⤵
  PID:5500
- C:\Windows\System\BIEIvLa.exe
  C:\Windows\System\BIEIvLa.exe
  2⤵
  PID:5584
- C:\Windows\System\FqwJsQb.exe
  C:\Windows\System\FqwJsQb.exe
  2⤵
  PID:5648
- C:\Windows\System\RpUFExz.exe
  C:\Windows\System\RpUFExz.exe
  2⤵
  PID:5684
- C:\Windows\System\SYRlqMu.exe
  C:\Windows\System\SYRlqMu.exe
  2⤵
  PID:5752
- C:\Windows\System\hLzTHcJ.exe
  C:\Windows\System\hLzTHcJ.exe
  2⤵
  PID:5808
- C:\Windows\System\wopsSnE.exe
  C:\Windows\System\wopsSnE.exe
  2⤵
  PID:5864
- C:\Windows\System\uCEYmaH.exe
  C:\Windows\System\uCEYmaH.exe
  2⤵
  PID:5944
- C:\Windows\System\edyTONu.exe
  C:\Windows\System\edyTONu.exe
  2⤵
  PID:5996
- C:\Windows\System\XQTfIOo.exe
  C:\Windows\System\XQTfIOo.exe
  2⤵
  PID:6056
- C:\Windows\System\CLGccsw.exe
  C:\Windows\System\CLGccsw.exe
  2⤵
  PID:6116
- C:\Windows\System\EzEtHwT.exe
  C:\Windows\System\EzEtHwT.exe
  2⤵
  PID:1956
- C:\Windows\System\YByJQaF.exe
  C:\Windows\System\YByJQaF.exe
  2⤵
  PID:2084
- C:\Windows\System\NgradXM.exe
  C:\Windows\System\NgradXM.exe
  2⤵
  PID:2060
- C:\Windows\System\XajTOin.exe
  C:\Windows\System\XajTOin.exe
  2⤵
  PID:5220
- C:\Windows\System\YdHUDHu.exe
  C:\Windows\System\YdHUDHu.exe
  2⤵
  PID:4580
- C:\Windows\System\djzxnfN.exe
  C:\Windows\System\djzxnfN.exe
  2⤵
  PID:5540
- C:\Windows\System\vVPyTUR.exe
  C:\Windows\System\vVPyTUR.exe
  2⤵
  PID:5660
- C:\Windows\System\GWkxadU.exe
  C:\Windows\System\GWkxadU.exe
  2⤵
  PID:5792
- C:\Windows\System\KLsNFVx.exe
  C:\Windows\System\KLsNFVx.exe
  2⤵
  PID:5920
- C:\Windows\System\donXXFE.exe
  C:\Windows\System\donXXFE.exe
  2⤵
  PID:6088
- C:\Windows\System\VfRJlJC.exe
  C:\Windows\System\VfRJlJC.exe
  2⤵
  PID:6164
- C:\Windows\System\YGOruXZ.exe
  C:\Windows\System\YGOruXZ.exe
  2⤵
  PID:6192
- C:\Windows\System\oLcJOaA.exe
  C:\Windows\System\oLcJOaA.exe
  2⤵
  PID:6220
- C:\Windows\System\GsYudyi.exe
  C:\Windows\System\GsYudyi.exe
  2⤵
  PID:6248
- C:\Windows\System\CPcUVUo.exe
  C:\Windows\System\CPcUVUo.exe
  2⤵
  PID:6272
- C:\Windows\System\bjYSXfc.exe
  C:\Windows\System\bjYSXfc.exe
  2⤵
  PID:6304
- C:\Windows\System\eONqXxI.exe
  C:\Windows\System\eONqXxI.exe
  2⤵
  PID:6332
- C:\Windows\System\XlhtEiP.exe
  C:\Windows\System\XlhtEiP.exe
  2⤵
  PID:6364
- C:\Windows\System\VfkfaXv.exe
  C:\Windows\System\VfkfaXv.exe
  2⤵
  PID:6392
- C:\Windows\System\dMrYhSe.exe
  C:\Windows\System\dMrYhSe.exe
  2⤵
  PID:6420
- C:\Windows\System\JVxdHVi.exe
  C:\Windows\System\JVxdHVi.exe
  2⤵
  PID:6448
- C:\Windows\System\wjFNLAL.exe
  C:\Windows\System\wjFNLAL.exe
  2⤵
  PID:6476
- C:\Windows\System\RDEGbhK.exe
  C:\Windows\System\RDEGbhK.exe
  2⤵
  PID:6504
- C:\Windows\System\xcwzIan.exe
  C:\Windows\System\xcwzIan.exe
  2⤵
  PID:6532
- C:\Windows\System\xOTfRDw.exe
  C:\Windows\System\xOTfRDw.exe
  2⤵
  PID:6556
- C:\Windows\System\IToSoXx.exe
  C:\Windows\System\IToSoXx.exe
  2⤵
  PID:6584
- C:\Windows\System\EAiPuOP.exe
  C:\Windows\System\EAiPuOP.exe
  2⤵
  PID:6612
- C:\Windows\System\lEcVNXN.exe
  C:\Windows\System\lEcVNXN.exe
  2⤵
  PID:6640
- C:\Windows\System\PzYzGfy.exe
  C:\Windows\System\PzYzGfy.exe
  2⤵
  PID:6668
- C:\Windows\System\eVUiNkN.exe
  C:\Windows\System\eVUiNkN.exe
  2⤵
  PID:6700
- C:\Windows\System\HqtlVyt.exe
  C:\Windows\System\HqtlVyt.exe
  2⤵
  PID:6724
- C:\Windows\System\APJjDkG.exe
  C:\Windows\System\APJjDkG.exe
  2⤵
  PID:6756
- C:\Windows\System\cSIvXgV.exe
  C:\Windows\System\cSIvXgV.exe
  2⤵
  PID:6780
- C:\Windows\System\EMaUgJL.exe
  C:\Windows\System\EMaUgJL.exe
  2⤵
  PID:6812
- C:\Windows\System\HHCZtLS.exe
  C:\Windows\System\HHCZtLS.exe
  2⤵
  PID:6840
- C:\Windows\System\uqxYOWk.exe
  C:\Windows\System\uqxYOWk.exe
  2⤵
  PID:6868
- C:\Windows\System\ZVdrtIc.exe
  C:\Windows\System\ZVdrtIc.exe
  2⤵
  PID:6896
- C:\Windows\System\eeJBqNJ.exe
  C:\Windows\System\eeJBqNJ.exe
  2⤵
  PID:6924
- C:\Windows\System\VNvQJQJ.exe
  C:\Windows\System\VNvQJQJ.exe
  2⤵
  PID:6948
- C:\Windows\System\VHvDnXs.exe
  C:\Windows\System\VHvDnXs.exe
  2⤵
  PID:6980
- C:\Windows\System\XGpxJnJ.exe
  C:\Windows\System\XGpxJnJ.exe
  2⤵
  PID:7008
- C:\Windows\System\lkLUwWp.exe
  C:\Windows\System\lkLUwWp.exe
  2⤵
  PID:7036
- C:\Windows\System\uAHzhpE.exe
  C:\Windows\System\uAHzhpE.exe
  2⤵
  PID:7064
- C:\Windows\System\ccWhuer.exe
  C:\Windows\System\ccWhuer.exe
  2⤵
  PID:7092
- C:\Windows\System\AZEkdhz.exe
  C:\Windows\System\AZEkdhz.exe
  2⤵
  PID:7120
- C:\Windows\System\EuHXslC.exe
  C:\Windows\System\EuHXslC.exe
  2⤵
  PID:5140
- C:\Windows\System\ObWzuSh.exe
  C:\Windows\System\ObWzuSh.exe
  2⤵
  PID:3652
- C:\Windows\System\ovmYDVx.exe
  C:\Windows\System\ovmYDVx.exe
  2⤵
  PID:5616
- C:\Windows\System\ZfHWwkU.exe
  C:\Windows\System\ZfHWwkU.exe
  2⤵
  PID:4020
- C:\Windows\System\DJBcuYJ.exe
  C:\Windows\System\DJBcuYJ.exe
  2⤵
  PID:6176
- C:\Windows\System\ndHEJQe.exe
  C:\Windows\System\ndHEJQe.exe
  2⤵
  PID:6232
- C:\Windows\System\IRMKXzp.exe
  C:\Windows\System\IRMKXzp.exe
  2⤵
  PID:6260
- C:\Windows\System\mUoifTJ.exe
  C:\Windows\System\mUoifTJ.exe
  2⤵
  PID:6296
- C:\Windows\System\EEsyjkw.exe
  C:\Windows\System\EEsyjkw.exe
  2⤵
  PID:6412
- C:\Windows\System\DGzQkJd.exe
  C:\Windows\System\DGzQkJd.exe
  2⤵
  PID:6464
- C:\Windows\System\erBOeIS.exe
  C:\Windows\System\erBOeIS.exe
  2⤵
  PID:6552
- C:\Windows\System\YDpytZV.exe
  C:\Windows\System\YDpytZV.exe
  2⤵
  PID:6608
- C:\Windows\System\yBLbBod.exe
  C:\Windows\System\yBLbBod.exe
  2⤵
  PID:6656
- C:\Windows\System\CZPSeqj.exe
  C:\Windows\System\CZPSeqj.exe
  2⤵
  PID:1748
- C:\Windows\System\zSnyQIT.exe
  C:\Windows\System\zSnyQIT.exe
  2⤵
  PID:2072
- C:\Windows\System\PeOXUiu.exe
  C:\Windows\System\PeOXUiu.exe
  2⤵
  PID:208
- C:\Windows\System\fSUaNsD.exe
  C:\Windows\System\fSUaNsD.exe
  2⤵
  PID:220
- C:\Windows\System\HVcYYNZ.exe
  C:\Windows\System\HVcYYNZ.exe
  2⤵
  PID:6832
- C:\Windows\System\CrhWjzO.exe
  C:\Windows\System\CrhWjzO.exe
  2⤵
  PID:6884
- C:\Windows\System\LCFFKLl.exe
  C:\Windows\System\LCFFKLl.exe
  2⤵
  PID:6936
- C:\Windows\System\ETOnlPT.exe
  C:\Windows\System\ETOnlPT.exe
  2⤵
  PID:4708
- C:\Windows\System\kAATBYS.exe
  C:\Windows\System\kAATBYS.exe
  2⤵
  PID:7024
- C:\Windows\System\ouDrIwl.exe
  C:\Windows\System\ouDrIwl.exe
  2⤵
  PID:7048
- C:\Windows\System\bZdzkkt.exe
  C:\Windows\System\bZdzkkt.exe
  2⤵
  PID:7084
- C:\Windows\System\JhVUAQf.exe
  C:\Windows\System\JhVUAQf.exe
  2⤵
  PID:3712
- C:\Windows\System\KawMkfD.exe
  C:\Windows\System\KawMkfD.exe
  2⤵
  PID:2228
- C:\Windows\System\LzLpEfJ.exe
  C:\Windows\System\LzLpEfJ.exe
  2⤵
  PID:2412
- C:\Windows\System\VmVjfhw.exe
  C:\Windows\System\VmVjfhw.exe
  2⤵
  PID:5296
- C:\Windows\System\mBOBPWp.exe
  C:\Windows\System\mBOBPWp.exe
  2⤵
  PID:3176
- C:\Windows\System\VrCWckt.exe
  C:\Windows\System\VrCWckt.exe
  2⤵
  PID:6212
- C:\Windows\System\uokScuw.exe
  C:\Windows\System\uokScuw.exe
  2⤵
  PID:6240
- C:\Windows\System\voMdiFy.exe
  C:\Windows\System\voMdiFy.exe
  2⤵
  PID:6440
- C:\Windows\System\tYaYaCj.exe
  C:\Windows\System\tYaYaCj.exe
  2⤵
  PID:6496
- C:\Windows\System\tGXWKHH.exe
  C:\Windows\System\tGXWKHH.exe
  2⤵
  PID:6692
- C:\Windows\System\OlLbtfu.exe
  C:\Windows\System\OlLbtfu.exe
  2⤵
  PID:6768
- C:\Windows\System\qLbUDcU.exe
  C:\Windows\System\qLbUDcU.exe
  2⤵
  PID:6880
- C:\Windows\System\JzoBWfE.exe
  C:\Windows\System\JzoBWfE.exe
  2⤵
  PID:7052
- C:\Windows\System\uZBxdUZ.exe
  C:\Windows\System\uZBxdUZ.exe
  2⤵
  PID:7164
- C:\Windows\System\boyHxZG.exe
  C:\Windows\System\boyHxZG.exe
  2⤵
  PID:5052
- C:\Windows\System\WHmCzmh.exe
  C:\Windows\System\WHmCzmh.exe
  2⤵
  PID:2152
- C:\Windows\System\vxYUHYG.exe
  C:\Windows\System\vxYUHYG.exe
  2⤵
  PID:1040
- C:\Windows\System\eslEIzU.exe
  C:\Windows\System\eslEIzU.exe
  2⤵
  PID:4740
- C:\Windows\System\UbuBhcA.exe
  C:\Windows\System\UbuBhcA.exe
  2⤵
  PID:6824
- C:\Windows\System\SFGglBb.exe
  C:\Windows\System\SFGglBb.exe
  2⤵
  PID:7112
- C:\Windows\System\HmSuShu.exe
  C:\Windows\System\HmSuShu.exe
  2⤵
  PID:6492
- C:\Windows\System\xJeJXcB.exe
  C:\Windows\System\xJeJXcB.exe
  2⤵
  PID:6636
- C:\Windows\System\gUricfb.exe
  C:\Windows\System\gUricfb.exe
  2⤵
  PID:6152
- C:\Windows\System\UaRqtfE.exe
  C:\Windows\System\UaRqtfE.exe
  2⤵
  PID:3920
- C:\Windows\System\oOziyws.exe
  C:\Windows\System\oOziyws.exe
  2⤵
  PID:7180
- C:\Windows\System\kvuyYaT.exe
  C:\Windows\System\kvuyYaT.exe
  2⤵
  PID:7208
- C:\Windows\System\ICeBPjz.exe
  C:\Windows\System\ICeBPjz.exe
  2⤵
  PID:7248
- C:\Windows\System\OcKROyK.exe
  C:\Windows\System\OcKROyK.exe
  2⤵
  PID:7272
- C:\Windows\System\NtdfaKl.exe
  C:\Windows\System\NtdfaKl.exe
  2⤵
  PID:7300
- C:\Windows\System\cQoEAyT.exe
  C:\Windows\System\cQoEAyT.exe
  2⤵
  PID:7316
- C:\Windows\System\dTRlaoe.exe
  C:\Windows\System\dTRlaoe.exe
  2⤵
  PID:7344
- C:\Windows\System\SGXTGbd.exe
  C:\Windows\System\SGXTGbd.exe
  2⤵
  PID:7392
- C:\Windows\System\eeZOTxF.exe
  C:\Windows\System\eeZOTxF.exe
  2⤵
  PID:7424
- C:\Windows\System\PYVEAaW.exe
  C:\Windows\System\PYVEAaW.exe
  2⤵
  PID:7440
- C:\Windows\System\AWnptTv.exe
  C:\Windows\System\AWnptTv.exe
  2⤵
  PID:7468
- C:\Windows\System\YBKDpbl.exe
  C:\Windows\System\YBKDpbl.exe
  2⤵
  PID:7488
- C:\Windows\System\UmjQnho.exe
  C:\Windows\System\UmjQnho.exe
  2⤵
  PID:7516
- C:\Windows\System\GMrnuPG.exe
  C:\Windows\System\GMrnuPG.exe
  2⤵
  PID:7556
- C:\Windows\System\pbtewIh.exe
  C:\Windows\System\pbtewIh.exe
  2⤵
  PID:7592
- C:\Windows\System\XZXnFcI.exe
  C:\Windows\System\XZXnFcI.exe
  2⤵
  PID:7612
- C:\Windows\System\ISxCzqs.exe
  C:\Windows\System\ISxCzqs.exe
  2⤵
  PID:7648
- C:\Windows\System\bxQiReF.exe
  C:\Windows\System\bxQiReF.exe
  2⤵
  PID:7664
- C:\Windows\System\HoYsaRr.exe
  C:\Windows\System\HoYsaRr.exe
  2⤵
  PID:7692
- C:\Windows\System\gKSKQSg.exe
  C:\Windows\System\gKSKQSg.exe
  2⤵
  PID:7712
- C:\Windows\System\BrunddG.exe
  C:\Windows\System\BrunddG.exe
  2⤵
  PID:7736
- C:\Windows\System\CwFIKfz.exe
  C:\Windows\System\CwFIKfz.exe
  2⤵
  PID:7756
- C:\Windows\System\YVDaFfm.exe
  C:\Windows\System\YVDaFfm.exe
  2⤵
  PID:7788
- C:\Windows\System\tjKYaGq.exe
  C:\Windows\System\tjKYaGq.exe
  2⤵
  PID:7832
- C:\Windows\System\uIkfHrp.exe
  C:\Windows\System\uIkfHrp.exe
  2⤵
  PID:7860
- C:\Windows\System\cRGUJCK.exe
  C:\Windows\System\cRGUJCK.exe
  2⤵
  PID:7900
- C:\Windows\System\PHAhWnp.exe
  C:\Windows\System\PHAhWnp.exe
  2⤵
  PID:7932
- C:\Windows\System\aSMXoTM.exe
  C:\Windows\System\aSMXoTM.exe
  2⤵
  PID:7960
- C:\Windows\System\AZiEWvU.exe
  C:\Windows\System\AZiEWvU.exe
  2⤵
  PID:7980
- C:\Windows\System\QJWPJQx.exe
  C:\Windows\System\QJWPJQx.exe
  2⤵
  PID:8004
- C:\Windows\System\lbUyTLH.exe
  C:\Windows\System\lbUyTLH.exe
  2⤵
  PID:8044
- C:\Windows\System\JVBFguo.exe
  C:\Windows\System\JVBFguo.exe
  2⤵
  PID:8072
- C:\Windows\System\CzHflZu.exe
  C:\Windows\System\CzHflZu.exe
  2⤵
  PID:8088
- C:\Windows\System\ZLdaNTM.exe
  C:\Windows\System\ZLdaNTM.exe
  2⤵
  PID:8116
- C:\Windows\System\iYmMYCm.exe
  C:\Windows\System\iYmMYCm.exe
  2⤵
  PID:8156
- C:\Windows\System\xedGKkN.exe
  C:\Windows\System\xedGKkN.exe
  2⤵
  PID:8188
- C:\Windows\System\qbAVgoo.exe
  C:\Windows\System\qbAVgoo.exe
  2⤵
  PID:7232
- C:\Windows\System\nTvnfFM.exe
  C:\Windows\System\nTvnfFM.exe
  2⤵
  PID:7268
- C:\Windows\System\ILfbbbz.exe
  C:\Windows\System\ILfbbbz.exe
  2⤵
  PID:7308
- C:\Windows\System\mvMxsaj.exe
  C:\Windows\System\mvMxsaj.exe
  2⤵
  PID:7400
- C:\Windows\System\ETMMpnT.exe
  C:\Windows\System\ETMMpnT.exe
  2⤵
  PID:7420
- C:\Windows\System\PnouzMy.exe
  C:\Windows\System\PnouzMy.exe
  2⤵
  PID:7504
- C:\Windows\System\dKfcpwN.exe
  C:\Windows\System\dKfcpwN.exe
  2⤵
  PID:7580
- C:\Windows\System\zOtuxTd.exe
  C:\Windows\System\zOtuxTd.exe
  2⤵
  PID:7600
- C:\Windows\System\LQPHZwm.exe
  C:\Windows\System\LQPHZwm.exe
  2⤵
  PID:7676
- C:\Windows\System\hKEKeDH.exe
  C:\Windows\System\hKEKeDH.exe
  2⤵
  PID:7816
- C:\Windows\System\vxluWkJ.exe
  C:\Windows\System\vxluWkJ.exe
  2⤵
  PID:7876
- C:\Windows\System\ijibzYH.exe
  C:\Windows\System\ijibzYH.exe
  2⤵
  PID:7948
- C:\Windows\System\ugHoAoR.exe
  C:\Windows\System\ugHoAoR.exe
  2⤵
  PID:8040
- C:\Windows\System\LxMtPXv.exe
  C:\Windows\System\LxMtPXv.exe
  2⤵
  PID:8084
- C:\Windows\System\yBovqGU.exe
  C:\Windows\System\yBovqGU.exe
  2⤵
  PID:8100
- C:\Windows\System\UltXkdj.exe
  C:\Windows\System\UltXkdj.exe
  2⤵
  PID:8180
- C:\Windows\System\XEkgLbI.exe
  C:\Windows\System\XEkgLbI.exe
  2⤵
  PID:7256
- C:\Windows\System\jBXrqGf.exe
  C:\Windows\System\jBXrqGf.exe
  2⤵
  PID:7356
- C:\Windows\System\NIJHiGQ.exe
  C:\Windows\System\NIJHiGQ.exe
  2⤵
  PID:7464
- C:\Windows\System\zCNCxzn.exe
  C:\Windows\System\zCNCxzn.exe
  2⤵
  PID:7660
- C:\Windows\System\RMucruh.exe
  C:\Windows\System\RMucruh.exe
  2⤵
  PID:7896
- C:\Windows\System\KBujRHP.exe
  C:\Windows\System\KBujRHP.exe
  2⤵
  PID:8136
- C:\Windows\System\THZZkKF.exe
  C:\Windows\System\THZZkKF.exe
  2⤵
  PID:7408
- C:\Windows\System\lXWWVUn.exe
  C:\Windows\System\lXWWVUn.exe
  2⤵
  PID:7480
- C:\Windows\System\fqedSyX.exe
  C:\Windows\System\fqedSyX.exe
  2⤵
  PID:7988
- C:\Windows\System\vQfenii.exe
  C:\Windows\System\vQfenii.exe
  2⤵
  PID:7456
- C:\Windows\System\KnCIrpe.exe
  C:\Windows\System\KnCIrpe.exe
  2⤵
  PID:7824
- C:\Windows\System\PXTErDW.exe
  C:\Windows\System\PXTErDW.exe
  2⤵
  PID:8204
- C:\Windows\System\ZLpTEGA.exe
  C:\Windows\System\ZLpTEGA.exe
  2⤵
  PID:8264
- C:\Windows\System\DVzQkkT.exe
  C:\Windows\System\DVzQkkT.exe
  2⤵
  PID:8292
- C:\Windows\System\xCWCyaQ.exe
  C:\Windows\System\xCWCyaQ.exe
  2⤵
  PID:8320
- C:\Windows\System\LFcgalB.exe
  C:\Windows\System\LFcgalB.exe
  2⤵
  PID:8348
- C:\Windows\System\KcxcXci.exe
  C:\Windows\System\KcxcXci.exe
  2⤵
  PID:8376
- C:\Windows\System\pQfNOeT.exe
  C:\Windows\System\pQfNOeT.exe
  2⤵
  PID:8404
- C:\Windows\System\ufcGnpp.exe
  C:\Windows\System\ufcGnpp.exe
  2⤵
  PID:8436
- C:\Windows\System\QxTftLx.exe
  C:\Windows\System\QxTftLx.exe
  2⤵
  PID:8464
- C:\Windows\System\kbitBjo.exe
  C:\Windows\System\kbitBjo.exe
  2⤵
  PID:8480
- C:\Windows\System\jqMqyec.exe
  C:\Windows\System\jqMqyec.exe
  2⤵
  PID:8508
- C:\Windows\System\gukJdLp.exe
  C:\Windows\System\gukJdLp.exe
  2⤵
  PID:8528
- C:\Windows\System\DgCzSyD.exe
  C:\Windows\System\DgCzSyD.exe
  2⤵
  PID:8556
- C:\Windows\System\YOhiYBb.exe
  C:\Windows\System\YOhiYBb.exe
  2⤵
  PID:8604
- C:\Windows\System\bBxLNat.exe
  C:\Windows\System\bBxLNat.exe
  2⤵
  PID:8632
- C:\Windows\System\FScRGxF.exe
  C:\Windows\System\FScRGxF.exe
  2⤵
  PID:8648
- C:\Windows\System\bPYeojp.exe
  C:\Windows\System\bPYeojp.exe
  2⤵
  PID:8688
- C:\Windows\System\riCbHxX.exe
  C:\Windows\System\riCbHxX.exe
  2⤵
  PID:8724
- C:\Windows\System\SAptIUa.exe
  C:\Windows\System\SAptIUa.exe
  2⤵
  PID:8740
- C:\Windows\System\nooMVcw.exe
  C:\Windows\System\nooMVcw.exe
  2⤵
  PID:8768
- C:\Windows\System\eSmACaZ.exe
  C:\Windows\System\eSmACaZ.exe
  2⤵
  PID:8796
- C:\Windows\System\caVSAxa.exe
  C:\Windows\System\caVSAxa.exe
  2⤵
  PID:8820
- C:\Windows\System\yisDXPS.exe
  C:\Windows\System\yisDXPS.exe
  2⤵
  PID:8852
- C:\Windows\System\WAhHAdd.exe
  C:\Windows\System\WAhHAdd.exe
  2⤵
  PID:8868
- C:\Windows\System\ZQxWoBa.exe
  C:\Windows\System\ZQxWoBa.exe
  2⤵
  PID:8892
- C:\Windows\System\DlJGEcA.exe
  C:\Windows\System\DlJGEcA.exe
  2⤵
  PID:8924
- C:\Windows\System\TIsSrNs.exe
  C:\Windows\System\TIsSrNs.exe
  2⤵
  PID:8944
- C:\Windows\System\hhFXAbD.exe
  C:\Windows\System\hhFXAbD.exe
  2⤵
  PID:8980
- C:\Windows\System\HsjOiYa.exe
  C:\Windows\System\HsjOiYa.exe
  2⤵
  PID:9008
- C:\Windows\System\eCHRCjj.exe
  C:\Windows\System\eCHRCjj.exe
  2⤵
  PID:9036
- C:\Windows\System\SDuYNxG.exe
  C:\Windows\System\SDuYNxG.exe
  2⤵
  PID:9076
- C:\Windows\System\CotjHoF.exe
  C:\Windows\System\CotjHoF.exe
  2⤵
  PID:9100
- C:\Windows\System\UFWePGi.exe
  C:\Windows\System\UFWePGi.exe
  2⤵
  PID:9132
- C:\Windows\System\lsRlBkf.exe
  C:\Windows\System\lsRlBkf.exe
  2⤵
  PID:9160
- C:\Windows\System\OJSxDyh.exe
  C:\Windows\System\OJSxDyh.exe
  2⤵
  PID:9188
- C:\Windows\System\jwEwwBb.exe
  C:\Windows\System\jwEwwBb.exe
  2⤵
  PID:8108
- C:\Windows\System\NOsAjXD.exe
  C:\Windows\System\NOsAjXD.exe
  2⤵
  PID:8256
- C:\Windows\System\nFgfqtq.exe
  C:\Windows\System\nFgfqtq.exe
  2⤵
  PID:8308
- C:\Windows\System\vnsysvC.exe
  C:\Windows\System\vnsysvC.exe
  2⤵
  PID:8368
- C:\Windows\System\CIySSZI.exe
  C:\Windows\System\CIySSZI.exe
  2⤵
  PID:8388
- C:\Windows\System\OkNuTjJ.exe
  C:\Windows\System\OkNuTjJ.exe
  2⤵
  PID:8448
- C:\Windows\System\mGOZjBA.exe
  C:\Windows\System\mGOZjBA.exe
  2⤵
  PID:8540
- C:\Windows\System\XrcOSXb.exe
  C:\Windows\System\XrcOSXb.exe
  2⤵
  PID:8588
- C:\Windows\System\DExyYGN.exe
  C:\Windows\System\DExyYGN.exe
  2⤵
  PID:8672
- C:\Windows\System\bVeiILL.exe
  C:\Windows\System\bVeiILL.exe
  2⤵
  PID:8784
- C:\Windows\System\Vddztxv.exe
  C:\Windows\System\Vddztxv.exe
  2⤵
  PID:8860
- C:\Windows\System\bqtRDdd.exe
  C:\Windows\System\bqtRDdd.exe
  2⤵
  PID:8932
- C:\Windows\System\GfKzwkn.exe
  C:\Windows\System\GfKzwkn.exe
  2⤵
  PID:8880
- C:\Windows\System\SsVpInY.exe
  C:\Windows\System\SsVpInY.exe
  2⤵
  PID:8940
- C:\Windows\System\CpIduRC.exe
  C:\Windows\System\CpIduRC.exe
  2⤵
  PID:9056
- C:\Windows\System\AUWKxGx.exe
  C:\Windows\System\AUWKxGx.exe
  2⤵
  PID:9172
- C:\Windows\System\bXfWaHR.exe
  C:\Windows\System\bXfWaHR.exe
  2⤵
  PID:8200
- C:\Windows\System\xKCMKlT.exe
  C:\Windows\System\xKCMKlT.exe
  2⤵
  PID:8680
- C:\Windows\System\iCqKHTp.exe
  C:\Windows\System\iCqKHTp.exe
  2⤵
  PID:8644
- C:\Windows\System\pvHwlHR.exe
  C:\Windows\System\pvHwlHR.exe
  2⤵
  PID:8912
- C:\Windows\System\AzDxAVU.exe
  C:\Windows\System\AzDxAVU.exe
  2⤵
  PID:9120
- C:\Windows\System\CcSlWdu.exe
  C:\Windows\System\CcSlWdu.exe
  2⤵
  PID:9212
- C:\Windows\System\teQKxuf.exe
  C:\Windows\System\teQKxuf.exe
  2⤵
  PID:9204
- C:\Windows\System\NFqbwws.exe
  C:\Windows\System\NFqbwws.exe
  2⤵
  PID:9020
- C:\Windows\System\AiudGUN.exe
  C:\Windows\System\AiudGUN.exe
  2⤵
  PID:8864
- C:\Windows\System\bdBhKWB.exe
  C:\Windows\System\bdBhKWB.exe
  2⤵
  PID:9224
- C:\Windows\System\zhwPKIc.exe
  C:\Windows\System\zhwPKIc.exe
  2⤵
  PID:9260
- C:\Windows\System\NtSqhnL.exe
  C:\Windows\System\NtSqhnL.exe
  2⤵
  PID:9300
- C:\Windows\System\RnVDrCO.exe
  C:\Windows\System\RnVDrCO.exe
  2⤵
  PID:9340
- C:\Windows\System\yrjsDLE.exe
  C:\Windows\System\yrjsDLE.exe
  2⤵
  PID:9368
- C:\Windows\System\dIyZriB.exe
  C:\Windows\System\dIyZriB.exe
  2⤵
  PID:9392
- C:\Windows\System\dHTwgEl.exe
  C:\Windows\System\dHTwgEl.exe
  2⤵
  PID:9424
- C:\Windows\System\eRTqHRI.exe
  C:\Windows\System\eRTqHRI.exe
  2⤵
  PID:9464
- C:\Windows\System\LrFlncO.exe
  C:\Windows\System\LrFlncO.exe
  2⤵
  PID:9492
- C:\Windows\System\xdEFaJj.exe
  C:\Windows\System\xdEFaJj.exe
  2⤵
  PID:9508
- C:\Windows\System\UqlSeVe.exe
  C:\Windows\System\UqlSeVe.exe
  2⤵
  PID:9544
- C:\Windows\System\NcvVkcG.exe
  C:\Windows\System\NcvVkcG.exe
  2⤵
  PID:9568
- C:\Windows\System\eLJGGux.exe
  C:\Windows\System\eLJGGux.exe
  2⤵
  PID:9588
- C:\Windows\System\xvBoLoP.exe
  C:\Windows\System\xvBoLoP.exe
  2⤵
  PID:9616
- C:\Windows\System\iJeEqMz.exe
  C:\Windows\System\iJeEqMz.exe
  2⤵
  PID:9640
- C:\Windows\System\FUeJLvr.exe
  C:\Windows\System\FUeJLvr.exe
  2⤵
  PID:9660
- C:\Windows\System\IUGrLnG.exe
  C:\Windows\System\IUGrLnG.exe
  2⤵
  PID:9708
- C:\Windows\System\IAsAoJx.exe
  C:\Windows\System\IAsAoJx.exe
  2⤵
  PID:9744
- C:\Windows\System\tVgGnRG.exe
  C:\Windows\System\tVgGnRG.exe
  2⤵
  PID:9776
- C:\Windows\System\Yercxge.exe
  C:\Windows\System\Yercxge.exe
  2⤵
  PID:9792
- C:\Windows\System\jjODqye.exe
  C:\Windows\System\jjODqye.exe
  2⤵
  PID:9820
- C:\Windows\System\kjKcAfw.exe
  C:\Windows\System\kjKcAfw.exe
  2⤵
  PID:9848
- C:\Windows\System\Ybqehbp.exe
  C:\Windows\System\Ybqehbp.exe
  2⤵
  PID:9884
- C:\Windows\System\cdiXCRm.exe
  C:\Windows\System\cdiXCRm.exe
  2⤵
  PID:9916
- C:\Windows\System\aWNjMFs.exe
  C:\Windows\System\aWNjMFs.exe
  2⤵
  PID:9944
- C:\Windows\System\bcKDRKP.exe
  C:\Windows\System\bcKDRKP.exe
  2⤵
  PID:9972
- C:\Windows\System\GRMauDW.exe
  C:\Windows\System\GRMauDW.exe
  2⤵
  PID:10004
- C:\Windows\System\XwnZoqS.exe
  C:\Windows\System\XwnZoqS.exe
  2⤵
  PID:10028
- C:\Windows\System\NzrjwBG.exe
  C:\Windows\System\NzrjwBG.exe
  2⤵
  PID:10048
- C:\Windows\System\HptilTw.exe
  C:\Windows\System\HptilTw.exe
  2⤵
  PID:10076
- C:\Windows\System\RWywGuE.exe
  C:\Windows\System\RWywGuE.exe
  2⤵
  PID:10112
- C:\Windows\System\vAvAlvV.exe
  C:\Windows\System\vAvAlvV.exe
  2⤵
  PID:10140
- C:\Windows\System\GbKthew.exe
  C:\Windows\System\GbKthew.exe
  2⤵
  PID:10168
- C:\Windows\System\wSqIxOx.exe
  C:\Windows\System\wSqIxOx.exe
  2⤵
  PID:10200
- C:\Windows\System\BXnrZba.exe
  C:\Windows\System\BXnrZba.exe
  2⤵
  PID:10228
- C:\Windows\System\lmSknrd.exe
  C:\Windows\System\lmSknrd.exe
  2⤵
  PID:8640
- C:\Windows\System\nkVmcmU.exe
  C:\Windows\System\nkVmcmU.exe
  2⤵
  PID:9292
- C:\Windows\System\ZqGseht.exe
  C:\Windows\System\ZqGseht.exe
  2⤵
  PID:9360
- C:\Windows\System\BvWlVXv.exe
  C:\Windows\System\BvWlVXv.exe
  2⤵
  PID:9456
- C:\Windows\System\xuMcjcH.exe
  C:\Windows\System\xuMcjcH.exe
  2⤵
  PID:9536
- C:\Windows\System\AJPPkUS.exe
  C:\Windows\System\AJPPkUS.exe
  2⤵
  PID:9580
- C:\Windows\System\ipdnXDL.exe
  C:\Windows\System\ipdnXDL.exe
  2⤵
  PID:9688
- C:\Windows\System\EaeRUZf.exe
  C:\Windows\System\EaeRUZf.exe
  2⤵
  PID:9736
- C:\Windows\System\fthRuxC.exe
  C:\Windows\System\fthRuxC.exe
  2⤵
  PID:9812
- C:\Windows\System\vywPsRH.exe
  C:\Windows\System\vywPsRH.exe
  2⤵
  PID:9804
- C:\Windows\System\qsgbCwP.exe
  C:\Windows\System\qsgbCwP.exe
  2⤵
  PID:9932
- C:\Windows\System\tcITehh.exe
  C:\Windows\System\tcITehh.exe
  2⤵
  PID:9956
- C:\Windows\System\pnUzawh.exe
  C:\Windows\System\pnUzawh.exe
  2⤵
  PID:10024
- C:\Windows\System\eRVrHFX.exe
  C:\Windows\System\eRVrHFX.exe
  2⤵
  PID:10120
- C:\Windows\System\kcJyBPj.exe
  C:\Windows\System\kcJyBPj.exe
  2⤵
  PID:10164
- C:\Windows\System\RFvcOgr.exe
  C:\Windows\System\RFvcOgr.exe
  2⤵
  PID:10196
- C:\Windows\System\MAmpIFb.exe
  C:\Windows\System\MAmpIFb.exe
  2⤵
  PID:8492
- C:\Windows\System\mXiTXaU.exe
  C:\Windows\System\mXiTXaU.exe
  2⤵
  PID:9532
- C:\Windows\System\ABYAtIn.exe
  C:\Windows\System\ABYAtIn.exe
  2⤵
  PID:9876
- C:\Windows\System\fbTDELd.exe
  C:\Windows\System\fbTDELd.exe
  2⤵
  PID:9868
- C:\Windows\System\koLBZry.exe
  C:\Windows\System\koLBZry.exe
  2⤵
  PID:10124
- C:\Windows\System\ZsPRQLg.exe
  C:\Windows\System\ZsPRQLg.exe
  2⤵
  PID:10064
- C:\Windows\System\mvZXpYA.exe
  C:\Windows\System\mvZXpYA.exe
  2⤵
  PID:9408
- C:\Windows\System\AjEMHVe.exe
  C:\Windows\System\AjEMHVe.exe
  2⤵
  PID:10044
- C:\Windows\System\HfcPmDi.exe
  C:\Windows\System\HfcPmDi.exe
  2⤵
  PID:9276
- C:\Windows\System\ApMLmeb.exe
  C:\Windows\System\ApMLmeb.exe
  2⤵
  PID:9096
- C:\Windows\System\wFuIuMq.exe
  C:\Windows\System\wFuIuMq.exe
  2⤵
  PID:10268
- C:\Windows\System\KOCEqcv.exe
  C:\Windows\System\KOCEqcv.exe
  2⤵
  PID:10284
- C:\Windows\System\IbRUOxM.exe
  C:\Windows\System\IbRUOxM.exe
  2⤵
  PID:10324
- C:\Windows\System\IEgWcNI.exe
  C:\Windows\System\IEgWcNI.exe
  2⤵
  PID:10348
- C:\Windows\System\AdkQIWg.exe
  C:\Windows\System\AdkQIWg.exe
  2⤵
  PID:10396
- C:\Windows\System\UdGFCFA.exe
  C:\Windows\System\UdGFCFA.exe
  2⤵
  PID:10412
- C:\Windows\System\MuYPzAV.exe
  C:\Windows\System\MuYPzAV.exe
  2⤵
  PID:10440
- C:\Windows\System\dAUEifK.exe
  C:\Windows\System\dAUEifK.exe
  2⤵
  PID:10456
- C:\Windows\System\rtgpOII.exe
  C:\Windows\System\rtgpOII.exe
  2⤵
  PID:10484
- C:\Windows\System\uybQwTQ.exe
  C:\Windows\System\uybQwTQ.exe
  2⤵
  PID:10504
- C:\Windows\System\hqixklk.exe
  C:\Windows\System\hqixklk.exe
  2⤵
  PID:10552
- C:\Windows\System\hlODVYI.exe
  C:\Windows\System\hlODVYI.exe
  2⤵
  PID:10568
- C:\Windows\System\LYfxATU.exe
  C:\Windows\System\LYfxATU.exe
  2⤵
  PID:10584
- C:\Windows\System\zJrypZq.exe
  C:\Windows\System\zJrypZq.exe
  2⤵
  PID:10620
- C:\Windows\System\HJulXwR.exe
  C:\Windows\System\HJulXwR.exe
  2⤵
  PID:10656
- C:\Windows\System\tixUjCJ.exe
  C:\Windows\System\tixUjCJ.exe
  2⤵
  PID:10688
- C:\Windows\System\RgFFWGV.exe
  C:\Windows\System\RgFFWGV.exe
  2⤵
  PID:10712
- C:\Windows\System\YYYIeZY.exe
  C:\Windows\System\YYYIeZY.exe
  2⤵
  PID:10740
- C:\Windows\System\usbUIXQ.exe
  C:\Windows\System\usbUIXQ.exe
  2⤵
  PID:10768
- C:\Windows\System\VnKBJfb.exe
  C:\Windows\System\VnKBJfb.exe
  2⤵
  PID:10796
- C:\Windows\System\FsFBHtr.exe
  C:\Windows\System\FsFBHtr.exe
  2⤵
  PID:10812
- C:\Windows\System\bnZcsEY.exe
  C:\Windows\System\bnZcsEY.exe
  2⤵
  PID:10832
- C:\Windows\System\deNJoVE.exe
  C:\Windows\System\deNJoVE.exe
  2⤵
  PID:10860
- C:\Windows\System\ItCIOqm.exe
  C:\Windows\System\ItCIOqm.exe
  2⤵
  PID:10884
- C:\Windows\System\bbXfVbj.exe
  C:\Windows\System\bbXfVbj.exe
  2⤵
  PID:10912
- C:\Windows\System\sLDEaVW.exe
  C:\Windows\System\sLDEaVW.exe
  2⤵
  PID:10940
- C:\Windows\System\tAZICZi.exe
  C:\Windows\System\tAZICZi.exe
  2⤵
  PID:10972
- C:\Windows\System\FaMHWyc.exe
  C:\Windows\System\FaMHWyc.exe
  2⤵
  PID:11000
- C:\Windows\System\HvcsgSy.exe
  C:\Windows\System\HvcsgSy.exe
  2⤵
  PID:11060
- C:\Windows\System\nGPDnKZ.exe
  C:\Windows\System\nGPDnKZ.exe
  2⤵
  PID:11076
- C:\Windows\System\zAgIAMA.exe
  C:\Windows\System\zAgIAMA.exe
  2⤵
  PID:11112
- C:\Windows\System\fQpKXhm.exe
  C:\Windows\System\fQpKXhm.exe
  2⤵
  PID:11144
- C:\Windows\System\ZGQfnIe.exe
  C:\Windows\System\ZGQfnIe.exe
  2⤵
  PID:11172
- C:\Windows\System\BRcARBC.exe
  C:\Windows\System\BRcARBC.exe
  2⤵
  PID:11200
- C:\Windows\System\PKWZNrP.exe
  C:\Windows\System\PKWZNrP.exe
  2⤵
  PID:11216
- C:\Windows\System\ExZSdPh.exe
  C:\Windows\System\ExZSdPh.exe
  2⤵
  PID:11240
- C:\Windows\System\EEqzaqv.exe
  C:\Windows\System\EEqzaqv.exe
  2⤵
  PID:10248
- C:\Windows\System\UmneDtz.exe
  C:\Windows\System\UmneDtz.exe
  2⤵
  PID:10340
- C:\Windows\System\XkmfPFG.exe
  C:\Windows\System\XkmfPFG.exe
  2⤵
  PID:9520
- C:\Windows\System\DppOsCd.exe
  C:\Windows\System\DppOsCd.exe
  2⤵
  PID:10452
- C:\Windows\System\trLcfgp.exe
  C:\Windows\System\trLcfgp.exe
  2⤵
  PID:10468
- C:\Windows\System\TieGcjT.exe
  C:\Windows\System\TieGcjT.exe
  2⤵
  PID:10512
- C:\Windows\System\AipmJXj.exe
  C:\Windows\System\AipmJXj.exe
  2⤵
  PID:10644
- C:\Windows\System\FlSfeHj.exe
  C:\Windows\System\FlSfeHj.exe
  2⤵
  PID:10696
- C:\Windows\System\hzHGGRX.exe
  C:\Windows\System\hzHGGRX.exe
  2⤵
  PID:10728
- C:\Windows\System\dnVuWjw.exe
  C:\Windows\System\dnVuWjw.exe
  2⤵
  PID:10788
- C:\Windows\System\KCTBCnx.exe
  C:\Windows\System\KCTBCnx.exe
  2⤵
  PID:10848
- C:\Windows\System\MPMenyB.exe
  C:\Windows\System\MPMenyB.exe
  2⤵
  PID:10924
- C:\Windows\System\hXZXNav.exe
  C:\Windows\System\hXZXNav.exe
  2⤵
  PID:10988
- C:\Windows\System\jZsVasR.exe
  C:\Windows\System\jZsVasR.exe
  2⤵
  PID:11016
- C:\Windows\System\ZoFvauN.exe
  C:\Windows\System\ZoFvauN.exe
  2⤵
  PID:11196
- C:\Windows\System\kYZdThl.exe
  C:\Windows\System\kYZdThl.exe
  2⤵
  PID:11236
- C:\Windows\System\IhfNWxv.exe
  C:\Windows\System\IhfNWxv.exe
  2⤵
  PID:10336
- C:\Windows\System\rOPNQzQ.exe
  C:\Windows\System\rOPNQzQ.exe
  2⤵
  PID:9448
- C:\Windows\System\oaXsDRZ.exe
  C:\Windows\System\oaXsDRZ.exe
  2⤵
  PID:10448
- C:\Windows\System\nMpLRWY.exe
  C:\Windows\System\nMpLRWY.exe
  2⤵
  PID:10604
- C:\Windows\System\ZVVfpQv.exe
  C:\Windows\System\ZVVfpQv.exe
  2⤵
  PID:10872
- C:\Windows\System\pOUdXWX.exe
  C:\Windows\System\pOUdXWX.exe
  2⤵
  PID:10904
- C:\Windows\System\JatOWzL.exe
  C:\Windows\System\JatOWzL.exe
  2⤵
  PID:11128
- C:\Windows\System\DqAsLGP.exe
  C:\Windows\System\DqAsLGP.exe
  2⤵
  PID:11232
- C:\Windows\System\uSGruYw.exe
  C:\Windows\System\uSGruYw.exe
  2⤵
  PID:4012
- C:\Windows\System\PyzTkTf.exe
  C:\Windows\System\PyzTkTf.exe
  2⤵
  PID:10896
- C:\Windows\System\UHubkKV.exe
  C:\Windows\System\UHubkKV.exe
  2⤵
  PID:11044
- C:\Windows\System\AzjVsQZ.exe
  C:\Windows\System\AzjVsQZ.exe
  2⤵
  PID:11256
- C:\Windows\System\KobcBAf.exe
  C:\Windows\System\KobcBAf.exe
  2⤵
  PID:10732
- C:\Windows\System\arpneyM.exe
  C:\Windows\System\arpneyM.exe
  2⤵
  PID:11272
- C:\Windows\System\mieOKMw.exe
  C:\Windows\System\mieOKMw.exe
  2⤵
  PID:11296
- C:\Windows\System\zvmbOzZ.exe
  C:\Windows\System\zvmbOzZ.exe
  2⤵
  PID:11316
- C:\Windows\System\GwtJQEf.exe
  C:\Windows\System\GwtJQEf.exe
  2⤵
  PID:11352
- C:\Windows\System\gCMrxQs.exe
  C:\Windows\System\gCMrxQs.exe
  2⤵
  PID:11368
- C:\Windows\System\VeSJYtV.exe
  C:\Windows\System\VeSJYtV.exe
  2⤵
  PID:11384
- C:\Windows\System\mIkTfYX.exe
  C:\Windows\System\mIkTfYX.exe
  2⤵
  PID:11416
- C:\Windows\System\jfddxEt.exe
  C:\Windows\System\jfddxEt.exe
  2⤵
  PID:11444
- C:\Windows\System\KIKOebt.exe
  C:\Windows\System\KIKOebt.exe
  2⤵
  PID:11504
- C:\Windows\System\DReTWgX.exe
  C:\Windows\System\DReTWgX.exe
  2⤵
  PID:11532
- C:\Windows\System\GnnVjGr.exe
  C:\Windows\System\GnnVjGr.exe
  2⤵
  PID:11548
- C:\Windows\System\vShcRMM.exe
  C:\Windows\System\vShcRMM.exe
  2⤵
  PID:11576
- C:\Windows\System\CvIZqhw.exe
  C:\Windows\System\CvIZqhw.exe
  2⤵
  PID:11600
- C:\Windows\System\sCUONvO.exe
  C:\Windows\System\sCUONvO.exe
  2⤵
  PID:11616
- C:\Windows\System\QIWlFmE.exe
  C:\Windows\System\QIWlFmE.exe
  2⤵
  PID:11644
- C:\Windows\System\rxwXqPw.exe
  C:\Windows\System\rxwXqPw.exe
  2⤵
  PID:11692
- C:\Windows\System\JfxEavX.exe
  C:\Windows\System\JfxEavX.exe
  2⤵
  PID:11716
- C:\Windows\System\fXxWcva.exe
  C:\Windows\System\fXxWcva.exe
  2⤵
  PID:11744
- C:\Windows\System\nDpDTIq.exe
  C:\Windows\System\nDpDTIq.exe
  2⤵
  PID:11768
- C:\Windows\System\DPIBMhh.exe
  C:\Windows\System\DPIBMhh.exe
  2⤵
  PID:11800
- C:\Windows\System\GTbtvzN.exe
  C:\Windows\System\GTbtvzN.exe
  2⤵
  PID:11840
- C:\Windows\System\JeHvdcN.exe
  C:\Windows\System\JeHvdcN.exe
  2⤵
  PID:11872
- C:\Windows\System\tRUQJxW.exe
  C:\Windows\System\tRUQJxW.exe
  2⤵
  PID:11892
- C:\Windows\System\qkKzvwH.exe
  C:\Windows\System\qkKzvwH.exe
  2⤵
  PID:11928
- C:\Windows\System\kigLTdA.exe
  C:\Windows\System\kigLTdA.exe
  2⤵
  PID:11956
- C:\Windows\System\PaKNYFr.exe
  C:\Windows\System\PaKNYFr.exe
  2⤵
  PID:11984
- C:\Windows\System\OiXEmlS.exe
  C:\Windows\System\OiXEmlS.exe
  2⤵
  PID:12012
- C:\Windows\System\PtYEfnC.exe
  C:\Windows\System\PtYEfnC.exe
  2⤵
  PID:12028
- C:\Windows\System\BOrMDKM.exe
  C:\Windows\System\BOrMDKM.exe
  2⤵
  PID:12068
- C:\Windows\System\CkhsVpE.exe
  C:\Windows\System\CkhsVpE.exe
  2⤵
  PID:12100
- C:\Windows\System\oAGlhgp.exe
  C:\Windows\System\oAGlhgp.exe
  2⤵
  PID:12128
- C:\Windows\System\iTrCGUB.exe
  C:\Windows\System\iTrCGUB.exe
  2⤵
  PID:12156
- C:\Windows\System\wYBphSx.exe
  C:\Windows\System\wYBphSx.exe
  2⤵
  PID:12172
- C:\Windows\System\qevtQnE.exe
  C:\Windows\System\qevtQnE.exe
  2⤵
  PID:12200
- C:\Windows\System\dwLAOOz.exe
  C:\Windows\System\dwLAOOz.exe
  2⤵
  PID:12216
- C:\Windows\System\vnYhiOF.exe
  C:\Windows\System\vnYhiOF.exe
  2⤵
  PID:12252
- C:\Windows\System\sGfYIkb.exe
  C:\Windows\System\sGfYIkb.exe
  2⤵
  PID:12276
- C:\Windows\System\fyOrtUt.exe
  C:\Windows\System\fyOrtUt.exe
  2⤵
  PID:11324
- C:\Windows\System\ovPJHXq.exe
  C:\Windows\System\ovPJHXq.exe
  2⤵
  PID:11304
- C:\Windows\System\PdwBJVv.exe
  C:\Windows\System\PdwBJVv.exe
  2⤵
  PID:11432
- C:\Windows\System\MoBksEN.exe
  C:\Windows\System\MoBksEN.exe
  2⤵
  PID:11436
- C:\Windows\System\XYFMpLG.exe
  C:\Windows\System\XYFMpLG.exe
  2⤵
  PID:11544
- C:\Windows\System\mhoJIgZ.exe
  C:\Windows\System\mhoJIgZ.exe
  2⤵
  PID:11596
- C:\Windows\System\pIcNUmI.exe
  C:\Windows\System\pIcNUmI.exe
  2⤵
  PID:11704
- C:\Windows\System\zmbnHIl.exe
  C:\Windows\System\zmbnHIl.exe
  2⤵
  PID:11780
- C:\Windows\System\gLNTsvS.exe
  C:\Windows\System\gLNTsvS.exe
  2⤵
  PID:11868
- C:\Windows\System\iqWNRky.exe
  C:\Windows\System\iqWNRky.exe
  2⤵
  PID:11912
- C:\Windows\System\vSybdKZ.exe
  C:\Windows\System\vSybdKZ.exe
  2⤵
  PID:12000
- C:\Windows\System\muTAXya.exe
  C:\Windows\System\muTAXya.exe
  2⤵
  PID:12044
- C:\Windows\System\xgATqAI.exe
  C:\Windows\System\xgATqAI.exe
  2⤵
  PID:12096
- C:\Windows\System\YAQcsPR.exe
  C:\Windows\System\YAQcsPR.exe
  2⤵
  PID:12188
- C:\Windows\System\IVWXLXG.exe
  C:\Windows\System\IVWXLXG.exe
  2⤵
  PID:12272
- C:\Windows\System\KJMyszd.exe
  C:\Windows\System\KJMyszd.exe
  2⤵
  PID:12264
- C:\Windows\System\wcSRUPM.exe
  C:\Windows\System\wcSRUPM.exe
  2⤵
  PID:11464
- C:\Windows\System\pwVmJtE.exe
  C:\Windows\System\pwVmJtE.exe
  2⤵
  PID:11568
- C:\Windows\System\tiIzJDs.exe
  C:\Windows\System\tiIzJDs.exe
  2⤵
  PID:11832
- C:\Windows\System\RSsByXu.exe
  C:\Windows\System\RSsByXu.exe
  2⤵
  PID:12004
- C:\Windows\System\kPtjpjv.exe
  C:\Windows\System\kPtjpjv.exe
  2⤵
  PID:12064
- C:\Windows\System\YEQvmsY.exe
  C:\Windows\System\YEQvmsY.exe
  2⤵
  PID:11360
- C:\Windows\System\nHpiOZP.exe
  C:\Windows\System\nHpiOZP.exe
  2⤵
  PID:11592
- C:\Windows\System\HukGglk.exe
  C:\Windows\System\HukGglk.exe
  2⤵
  PID:11948
- C:\Windows\System\sovLYcN.exe
  C:\Windows\System\sovLYcN.exe
  2⤵
  PID:11488
- C:\Windows\System\UztFdeu.exe
  C:\Windows\System\UztFdeu.exe
  2⤵
  PID:11916
- C:\Windows\System\uXENIfR.exe
  C:\Windows\System\uXENIfR.exe
  2⤵
  PID:12292
- C:\Windows\System\odYeyXa.exe
  C:\Windows\System\odYeyXa.exe
  2⤵
  PID:12328
- C:\Windows\System\kLQwrCz.exe
  C:\Windows\System\kLQwrCz.exe
  2⤵
  PID:12348
- C:\Windows\System\RZcSpvY.exe
  C:\Windows\System\RZcSpvY.exe
  2⤵
  PID:12372
- C:\Windows\System\stfsryr.exe
  C:\Windows\System\stfsryr.exe
  2⤵
  PID:12392
- C:\Windows\System\sictzaw.exe
  C:\Windows\System\sictzaw.exe
  2⤵
  PID:12424
- C:\Windows\System\pmTPqri.exe
  C:\Windows\System\pmTPqri.exe
  2⤵
  PID:12452
- C:\Windows\System\iCQSvAf.exe
  C:\Windows\System\iCQSvAf.exe
  2⤵
  PID:12484
- C:\Windows\System\bQdbaTT.exe
  C:\Windows\System\bQdbaTT.exe
  2⤵
  PID:12504
- C:\Windows\System\ISWNwKj.exe
  C:\Windows\System\ISWNwKj.exe
  2⤵
  PID:12528
- C:\Windows\System\jisVczT.exe
  C:\Windows\System\jisVczT.exe
  2⤵
  PID:12580
- C:\Windows\System\hFThJGY.exe
  C:\Windows\System\hFThJGY.exe
  2⤵
  PID:12608
- C:\Windows\System\PJMSYyV.exe
  C:\Windows\System\PJMSYyV.exe
  2⤵
  PID:12636
- C:\Windows\System\GsyzTxf.exe
  C:\Windows\System\GsyzTxf.exe
  2⤵
  PID:12664
- C:\Windows\System\okqMtNY.exe
  C:\Windows\System\okqMtNY.exe
  2⤵
  PID:12692
- C:\Windows\System\VYRWzWD.exe
  C:\Windows\System\VYRWzWD.exe
  2⤵
  PID:12720
- C:\Windows\System\IabqaaV.exe
  C:\Windows\System\IabqaaV.exe
  2⤵
  PID:12748
- C:\Windows\System\czuKcQz.exe
  C:\Windows\System\czuKcQz.exe
  2⤵
  PID:12764
- C:\Windows\System\iYsfHjO.exe
  C:\Windows\System\iYsfHjO.exe
  2⤵
  PID:12788
- C:\Windows\System\ZHgLaji.exe
  C:\Windows\System\ZHgLaji.exe
  2⤵
  PID:12816
- C:\Windows\System\ZXIZwtq.exe
  C:\Windows\System\ZXIZwtq.exe
  2⤵
  PID:12840
- C:\Windows\System\BVoNUyu.exe
  C:\Windows\System\BVoNUyu.exe
  2⤵
  PID:12868
- C:\Windows\System\gywSdxr.exe
  C:\Windows\System\gywSdxr.exe
  2⤵
  PID:12916
- C:\Windows\System\TQLXrhi.exe
  C:\Windows\System\TQLXrhi.exe
  2⤵
  PID:12944
- C:\Windows\System\roCECUl.exe
  C:\Windows\System\roCECUl.exe
  2⤵
  PID:12972
- C:\Windows\System\ZhkDJQM.exe
  C:\Windows\System\ZhkDJQM.exe
  2⤵
  PID:13000
- C:\Windows\System\iloyleH.exe
  C:\Windows\System\iloyleH.exe
  2⤵
  PID:13016
- C:\Windows\System\LqFyVtu.exe
  C:\Windows\System\LqFyVtu.exe
  2⤵
  PID:13052
- C:\Windows\System\tBNeIEc.exe
  C:\Windows\System\tBNeIEc.exe
  2⤵
  PID:13080
- C:\Windows\System\zjMMWGK.exe
  C:\Windows\System\zjMMWGK.exe
  2⤵
  PID:13112
- C:\Windows\System\zBqVvvl.exe
  C:\Windows\System\zBqVvvl.exe
  2⤵
  PID:13140
- C:\Windows\System\fRcEVEQ.exe
  C:\Windows\System\fRcEVEQ.exe
  2⤵
  PID:13156
- C:\Windows\System\usqFupz.exe
  C:\Windows\System\usqFupz.exe
  2⤵
  PID:13184
- C:\Windows\System\SoSDlti.exe
  C:\Windows\System\SoSDlti.exe
  2⤵
  PID:13212
- C:\Windows\System\fhGHZXQ.exe
  C:\Windows\System\fhGHZXQ.exe
  2⤵
  PID:13244
- C:\Windows\System\wDBnTni.exe
  C:\Windows\System\wDBnTni.exe
  2⤵
  PID:13260
- C:\Windows\System\IBXOgKC.exe
  C:\Windows\System\IBXOgKC.exe
  2⤵
  PID:13292
- C:\Windows\System\JpeNHOy.exe
  C:\Windows\System\JpeNHOy.exe
  2⤵
  PID:12320
- C:\Windows\System\bkhhXOt.exe
  C:\Windows\System\bkhhXOt.exe
  2⤵
  PID:12356
- C:\Windows\System\NUbqowT.exe
  C:\Windows\System\NUbqowT.exe
  2⤵
  PID:12368
- C:\Windows\System\LCZXMNq.exe
  C:\Windows\System\LCZXMNq.exe
  2⤵
  PID:12500
- C:\Windows\System\UPUMUQU.exe
  C:\Windows\System\UPUMUQU.exe
  2⤵
  PID:12568
- C:\Windows\System\XgiNDaR.exe
  C:\Windows\System\XgiNDaR.exe
  2⤵
  PID:12624
- C:\Windows\System\cKGXjIx.exe
  C:\Windows\System\cKGXjIx.exe
  2⤵
  PID:12684
- C:\Windows\System\FWurtwP.exe
  C:\Windows\System\FWurtwP.exe
  2⤵
  PID:12732
- C:\Windows\System\ZnKmmnp.exe
  C:\Windows\System\ZnKmmnp.exe
  2⤵
  PID:12776
- C:\Windows\System\JwrdZph.exe
  C:\Windows\System\JwrdZph.exe
  2⤵
  PID:12824
- C:\Windows\System\snGPGmv.exe
  C:\Windows\System\snGPGmv.exe
  2⤵
  PID:12992
- C:\Windows\System\XZHJtot.exe
  C:\Windows\System\XZHJtot.exe
  2⤵
  PID:13012
- C:\Windows\System\tQqRNxu.exe
  C:\Windows\System\tQqRNxu.exe
  2⤵
  PID:13072
- C:\Windows\System\ZKspPba.exe
  C:\Windows\System\ZKspPba.exe
  2⤵
  PID:13152
- C:\Windows\System\nwvwZUK.exe
  C:\Windows\System\nwvwZUK.exe
  2⤵
  PID:13232
- C:\Windows\System\QyzrCll.exe
  C:\Windows\System\QyzrCll.exe
  2⤵
  PID:13276
- C:\Windows\System\CybCzGi.exe
  C:\Windows\System\CybCzGi.exe
  2⤵
  PID:12344
- C:\Windows\System\xGSyJMt.exe
  C:\Windows\System\xGSyJMt.exe
  2⤵
  PID:12492
- C:\Windows\System\jNrhwNc.exe
  C:\Windows\System\jNrhwNc.exe
  2⤵
  PID:12660
- C:\Windows\System\bnYROUq.exe
  C:\Windows\System\bnYROUq.exe
  2⤵
  PID:12760
- C:\Windows\System\AloOzny.exe
  C:\Windows\System\AloOzny.exe
  2⤵
  PID:12912
- C:\Windows\System\baKqEEf.exe
  C:\Windows\System\baKqEEf.exe
  2⤵
  PID:13124
- C:\Windows\System\rjcgjQD.exe
  C:\Windows\System\rjcgjQD.exe
  2⤵
  PID:13252
- C:\Windows\System\UuVBgqu.exe
  C:\Windows\System\UuVBgqu.exe
  2⤵
  PID:12716
- C:\Windows\System\wBerSjo.exe
  C:\Windows\System\wBerSjo.exe
  2⤵
  PID:13032
- C:\Windows\System\KYfVnfX.exe
  C:\Windows\System\KYfVnfX.exe
  2⤵
  PID:12544
- C:\Windows\System\teAlxIO.exe
  C:\Windows\System\teAlxIO.exe
  2⤵
  PID:13308
- C:\Windows\System\FmIHnPR.exe
  C:\Windows\System\FmIHnPR.exe
  2⤵
  PID:13324
- C:\Windows\System\JirvLtt.exe
  C:\Windows\System\JirvLtt.exe
  2⤵
  PID:13364
- C:\Windows\System\TqDQskB.exe
  C:\Windows\System\TqDQskB.exe
  2⤵
  PID:13384
- C:\Windows\System\KYiRMJR.exe
  C:\Windows\System\KYiRMJR.exe
  2⤵
  PID:13404
- C:\Windows\System\LgorhQe.exe
  C:\Windows\System\LgorhQe.exe
  2⤵
  PID:13424
- C:\Windows\System\VbBBcwX.exe
  C:\Windows\System\VbBBcwX.exe
  2⤵
  PID:13476
- C:\Windows\System\kmIbogd.exe
  C:\Windows\System\kmIbogd.exe
  2⤵
  PID:13504
- C:\Windows\System\YivfCRI.exe
  C:\Windows\System\YivfCRI.exe
  2⤵
  PID:13532
- C:\Windows\System\sKamzTT.exe
  C:\Windows\System\sKamzTT.exe
  2⤵
  PID:13548
- C:\Windows\System\QxwpCzX.exe
  C:\Windows\System\QxwpCzX.exe
  2⤵
  PID:13576
- C:\Windows\System\vashwrt.exe
  C:\Windows\System\vashwrt.exe
  2⤵
  PID:13600
- C:\Windows\System\XfnSZxr.exe
  C:\Windows\System\XfnSZxr.exe
  2⤵
  PID:13620
- C:\Windows\System\DzRXKwQ.exe
  C:\Windows\System\DzRXKwQ.exe
  2⤵
  PID:13656
- C:\Windows\System\TSGgdtd.exe
  C:\Windows\System\TSGgdtd.exe
  2⤵
  PID:13700
- C:\Windows\System\qhjbhUL.exe
  C:\Windows\System\qhjbhUL.exe
  2⤵
  PID:13720
- C:\Windows\System\tyBhjut.exe
  C:\Windows\System\tyBhjut.exe
  2⤵
  PID:13756
- C:\Windows\System\rTpXTDc.exe
  C:\Windows\System\rTpXTDc.exe
  2⤵
  PID:13784
- C:\Windows\System\aOKRuLd.exe
  C:\Windows\System\aOKRuLd.exe
  2⤵
  PID:13812
- C:\Windows\System\EmRTIrj.exe
  C:\Windows\System\EmRTIrj.exe
  2⤵
  PID:13840
- C:\Windows\System\RzrsKlE.exe
  C:\Windows\System\RzrsKlE.exe
  2⤵
  PID:13856
- C:\Windows\System\IOdfmBr.exe
  C:\Windows\System\IOdfmBr.exe
  2⤵
  PID:13872
- C:\Windows\System\VNJllaW.exe
  C:\Windows\System\VNJllaW.exe
  2⤵
  PID:13916
- C:\Windows\System\laOubse.exe
  C:\Windows\System\laOubse.exe
  2⤵
  PID:13940
- C:\Windows\System\ygwtjRh.exe
  C:\Windows\System\ygwtjRh.exe
  2⤵
  PID:13964
- C:\Windows\System\uRVyRuk.exe
  C:\Windows\System\uRVyRuk.exe
  2⤵
  PID:13996
- C:\Windows\System\yNMNUwB.exe
  C:\Windows\System\yNMNUwB.exe
  2⤵
  PID:14016
- C:\Windows\System\lfwxZyu.exe
  C:\Windows\System\lfwxZyu.exe
  2⤵
  PID:14048
- C:\Windows\System\tumJCFj.exe
  C:\Windows\System\tumJCFj.exe
  2⤵
  PID:14072
- C:\Windows\System\OTpUrdH.exe
  C:\Windows\System\OTpUrdH.exe
  2⤵
  PID:14112
- C:\Windows\System\iTTPADM.exe
  C:\Windows\System\iTTPADM.exe
  2⤵
  PID:14144
- C:\Windows\System\WpWUNcE.exe
  C:\Windows\System\WpWUNcE.exe
  2⤵
  PID:14164
- C:\Windows\System\adUpAYK.exe
  C:\Windows\System\adUpAYK.exe
  2⤵
  PID:14204
- C:\Windows\System\MJEpOZC.exe
  C:\Windows\System\MJEpOZC.exe
  2⤵
  PID:14232
- C:\Windows\System\XniiuCU.exe
  C:\Windows\System\XniiuCU.exe
  2⤵
  PID:14248
- C:\Windows\System\IlvtMgB.exe
  C:\Windows\System\IlvtMgB.exe
  2⤵
  PID:14280
- C:\Windows\System\iqSoBOH.exe
  C:\Windows\System\iqSoBOH.exe
  2⤵
  PID:14312
- C:\Windows\System\dCpatby.exe
  C:\Windows\System\dCpatby.exe
  2⤵
  PID:12984
- C:\Windows\System\mWeZdEC.exe
  C:\Windows\System\mWeZdEC.exe
  2⤵
  PID:13360
- C:\Windows\System\YucHdGz.exe
  C:\Windows\System\YucHdGz.exe
  2⤵
  PID:13420
- C:\Windows\System\DgofYUf.exe
  C:\Windows\System\DgofYUf.exe
  2⤵
  PID:13492
- C:\Windows\System\qcBjbav.exe
  C:\Windows\System\qcBjbav.exe
  2⤵
  PID:13524
- C:\Windows\System\NRnQFWl.exe
  C:\Windows\System\NRnQFWl.exe
  2⤵
  PID:13568
- C:\Windows\System\TCERlST.exe
  C:\Windows\System\TCERlST.exe
  2⤵
  PID:13684
- C:\Windows\System\qqgbfCz.exe
  C:\Windows\System\qqgbfCz.exe
  2⤵
  PID:13768
- C:\Windows\System\iDtHguD.exe
  C:\Windows\System\iDtHguD.exe
  2⤵
  PID:13796
- C:\Windows\System\UHGlwNV.exe
  C:\Windows\System\UHGlwNV.exe
  2⤵
  PID:13852
- C:\Windows\System\FeoNEFu.exe
  C:\Windows\System\FeoNEFu.exe
  2⤵
  PID:13900
- C:\Windows\System\cOPsisX.exe
  C:\Windows\System\cOPsisX.exe
  2⤵
  PID:13956
- C:\Windows\System\iMfoOgK.exe
  C:\Windows\System\iMfoOgK.exe
  2⤵
  PID:13240
- C:\Windows\System\qdYmvPD.exe
  C:\Windows\System\qdYmvPD.exe
  2⤵
  PID:14036
- C:\Windows\System\naSLUlY.exe
  C:\Windows\System\naSLUlY.exe
  2⤵
  PID:14156
- C:\Windows\System\wEVqDLU.exe
  C:\Windows\System\wEVqDLU.exe
  2⤵
  PID:14200
- C:\Windows\System\KSmzcEo.exe
  C:\Windows\System\KSmzcEo.exe
  2⤵
  PID:14320
- C:\Windows\System\uWLtNJq.exe
  C:\Windows\System\uWLtNJq.exe
  2⤵
  PID:13336
- C:\Windows\System\yMNhvuf.exe
  C:\Windows\System\yMNhvuf.exe
  2⤵
  PID:13592
- C:\Windows\System\mhfWlhr.exe
  C:\Windows\System\mhfWlhr.exe
  2⤵
  PID:13648
- C:\Windows\System\cQKYfPS.exe
  C:\Windows\System\cQKYfPS.exe
  2⤵
  PID:13908
- C:\Windows\System\WtvUEoB.exe
  C:\Windows\System\WtvUEoB.exe
  2⤵
  PID:14024
- C:\Windows\System\GPFJRNa.exe
  C:\Windows\System\GPFJRNa.exe
  2⤵
  PID:14124
- C:\Windows\System\VFQqXOf.exe
  C:\Windows\System\VFQqXOf.exe
  2⤵
  PID:5092
- C:\Windows\System\rzDGhPQ.exe
  C:\Windows\System\rzDGhPQ.exe
  2⤵
  PID:14328
- C:\Windows\System\VGaEztI.exe
  C:\Windows\System\VGaEztI.exe
  2⤵
  PID:13728
- C:\Windows\System\rwXUoFT.exe
  C:\Windows\System\rwXUoFT.exe
  2⤵
  PID:14240
- C:\Windows\System\emIETmn.exe
  C:\Windows\System\emIETmn.exe
  2⤵
  PID:14272
- C:\Windows\System\DNJeUyj.exe
  C:\Windows\System\DNJeUyj.exe
  2⤵
  PID:14344
- C:\Windows\System\tjFdwFu.exe
  C:\Windows\System\tjFdwFu.exe
  2⤵
  PID:14368
- C:\Windows\System\igpIzeT.exe
  C:\Windows\System\igpIzeT.exe
  2⤵
  PID:14396
- C:\Windows\System\ZQrKxNH.exe
  C:\Windows\System\ZQrKxNH.exe
  2⤵
  PID:14424
- C:\Windows\System\GNukeuI.exe
  C:\Windows\System\GNukeuI.exe
  2⤵
  PID:14472
- C:\Windows\System\nvkNvjW.exe
  C:\Windows\System\nvkNvjW.exe
  2⤵
  PID:14496
- C:\Windows\System\pbFYjXO.exe
  C:\Windows\System\pbFYjXO.exe
  2⤵
  PID:14528
- C:\Windows\System\ygPfvSw.exe
  C:\Windows\System\ygPfvSw.exe
  2⤵
  PID:14544
- C:\Windows\System\hUhaIip.exe
  C:\Windows\System\hUhaIip.exe
  2⤵
  PID:14572
- C:\Windows\System\TAPGlWZ.exe
  C:\Windows\System\TAPGlWZ.exe
  2⤵
  PID:14612
- C:\Windows\System\IPBNink.exe
  C:\Windows\System\IPBNink.exe
  2⤵
  PID:14628
- C:\Windows\System\YyiVFuk.exe
  C:\Windows\System\YyiVFuk.exe
  2⤵
  PID:14656
- C:\Windows\System\VazTaWz.exe
  C:\Windows\System\VazTaWz.exe
  2⤵
  PID:14696
- C:\Windows\System\kKnVPNH.exe
  C:\Windows\System\kKnVPNH.exe
  2⤵
  PID:14712
- C:\Windows\System\OGQHuxJ.exe
  C:\Windows\System\OGQHuxJ.exe
  2⤵
  PID:14732
- C:\Windows\System\rGHMaOr.exe
  C:\Windows\System\rGHMaOr.exe
  2⤵
  PID:14764
- C:\Windows\System\lEXEcOM.exe
  C:\Windows\System\lEXEcOM.exe
  2⤵
  PID:14788
- C:\Windows\System\SZWNAAF.exe
  C:\Windows\System\SZWNAAF.exe
  2⤵
  PID:14820
- C:\Windows\System\wfAuHYL.exe
  C:\Windows\System\wfAuHYL.exe
  2⤵
  PID:14868
- C:\Windows\System\QflmuJb.exe
  C:\Windows\System\QflmuJb.exe
  2⤵
  PID:14884
- C:\Windows\System\oTtQTFk.exe
  C:\Windows\System\oTtQTFk.exe
  2⤵
  PID:14912
- C:\Windows\System\SkZrsNO.exe
  C:\Windows\System\SkZrsNO.exe
  2⤵
  PID:14940
- C:\Windows\System\NOizZmU.exe
  C:\Windows\System\NOizZmU.exe
  2⤵
  PID:14968
- C:\Windows\System\pTCuixk.exe
  C:\Windows\System\pTCuixk.exe
  2⤵
  PID:14992
- C:\Windows\System\QmUplfB.exe
  C:\Windows\System\QmUplfB.exe
  2⤵
  PID:15016
- C:\Windows\System\YJPXPKw.exe
  C:\Windows\System\YJPXPKw.exe
  2⤵
  PID:15044
- C:\Windows\System\xrWPLLa.exe
  C:\Windows\System\xrWPLLa.exe
  2⤵
  PID:15092
- C:\Windows\System\TbMKjOy.exe
  C:\Windows\System\TbMKjOy.exe
  2⤵
  PID:15112
- C:\Windows\System\NQtyNiV.exe
  C:\Windows\System\NQtyNiV.exe
  2⤵
  PID:15136
- C:\Windows\System\pJYNEzW.exe
  C:\Windows\System\pJYNEzW.exe
  2⤵
  PID:15176
- C:\Windows\System\VmGfAzx.exe
  C:\Windows\System\VmGfAzx.exe
  2⤵
  PID:15204
- C:\Windows\System\JzBNxkM.exe
  C:\Windows\System\JzBNxkM.exe
  2⤵
  PID:15220
- C:\Windows\System\hWuvuqC.exe
  C:\Windows\System\hWuvuqC.exe
  2⤵
  PID:15248
- C:\Windows\System\azuOcSc.exe
  C:\Windows\System\azuOcSc.exe
  2⤵
  PID:15280
- C:\Windows\System\azFmzQZ.exe
  C:\Windows\System\azFmzQZ.exe
  2⤵
  PID:15304
- C:\Windows\System\eRXhDfe.exe
  C:\Windows\System\eRXhDfe.exe
  2⤵
  PID:15332
- C:\Windows\System\bAHFpbz.exe
  C:\Windows\System\bAHFpbz.exe
  2⤵
  PID:14060
- C:\Windows\System\sEElibE.exe
  C:\Windows\System\sEElibE.exe
  2⤵
  PID:14244
- C:\Windows\System\tcfWQIT.exe
  C:\Windows\System\tcfWQIT.exe
  2⤵
  PID:14384
- C:\Windows\System\JdXDCtq.exe
  C:\Windows\System\JdXDCtq.exe
  2⤵
  PID:14512
- C:\Windows\System\MeYnzKh.exe
  C:\Windows\System\MeYnzKh.exe
  2⤵
  PID:14536
- C:\Windows\System\akFaniw.exe
  C:\Windows\System\akFaniw.exe
  2⤵
  PID:14584
- C:\Windows\System\YfssBGW.exe
  C:\Windows\System\YfssBGW.exe
  2⤵
  PID:14688
- C:\Windows\System\yeVUnlq.exe
  C:\Windows\System\yeVUnlq.exe
  2⤵
  PID:14752
- C:\Windows\System\sparGsm.exe
  C:\Windows\System\sparGsm.exe
  2⤵
  PID:14856
- C:\Windows\System\UEZPhbN.exe
  C:\Windows\System\UEZPhbN.exe
  2⤵
  PID:14932
- C:\Windows\System\fblanEE.exe
  C:\Windows\System\fblanEE.exe
  2⤵
  PID:14976
- C:\Windows\System\XzKwcWf.exe
  C:\Windows\System\XzKwcWf.exe
  2⤵
  PID:15040
- C:\Windows\System\DzPQUGt.exe
  C:\Windows\System\DzPQUGt.exe
  2⤵
  PID:15088
- C:\Windows\System\CPelyvd.exe
  C:\Windows\System\CPelyvd.exe
  2⤵
  PID:15152
- C:\Windows\System\gguovMG.exe
  C:\Windows\System\gguovMG.exe
  2⤵
  PID:15240
- C:\Windows\System\gQfRWvw.exe
  C:\Windows\System\gQfRWvw.exe
  2⤵
  PID:15268
- C:\Windows\System\fEiOwCi.exe
  C:\Windows\System\fEiOwCi.exe
  2⤵
  PID:15344
- C:\Windows\System\bzxzNpG.exe
  C:\Windows\System\bzxzNpG.exe
  2⤵
  PID:15340
- C:\Windows\System\tfjUxLH.exe
  C:\Windows\System\tfjUxLH.exe
  2⤵
  PID:14420
- C:\Windows\System\OTgDeVB.exe
  C:\Windows\System\OTgDeVB.exe
  2⤵
  PID:14560
- C:\Windows\System\zpFHFMo.exe
  C:\Windows\System\zpFHFMo.exe
  2⤵
  PID:14812
- C:\Windows\System\mNPPeXx.exe
  C:\Windows\System\mNPPeXx.exe
  2⤵
  PID:3736
- C:\Windows\System\euCnoJZ.exe
  C:\Windows\System\euCnoJZ.exe
  2⤵
  PID:15064
- C:\Windows\System\yTjNxbg.exe
  C:\Windows\System\yTjNxbg.exe
  2⤵
  PID:15132
- C:\Windows\System\NqTjUIK.exe
  C:\Windows\System\NqTjUIK.exe
  2⤵
  PID:14364
- C:\Windows\System\bRUjisP.exe
  C:\Windows\System\bRUjisP.exe
  2⤵
  PID:14704
- C:\Windows\System\rBTstFB.exe
  C:\Windows\System\rBTstFB.exe
  2⤵
  PID:15084
- C:\Windows\System\sxTNkwO.exe
  C:\Windows\System\sxTNkwO.exe
  2⤵
  PID:15124
- C:\Windows\System\bUsKBii.exe
  C:\Windows\System\bUsKBii.exe
  2⤵
  PID:14952
- C:\Windows\System\sRnXmkl.exe
  C:\Windows\System\sRnXmkl.exe
  2⤵
  PID:15368
- C:\Windows\System\SnQqodV.exe
  C:\Windows\System\SnQqodV.exe
  2⤵
  PID:15384
- C:\Windows\System\HzQoxAm.exe
  C:\Windows\System\HzQoxAm.exe
  2⤵
  PID:15416
- C:\Windows\System\uhxdNVe.exe
  C:\Windows\System\uhxdNVe.exe
  2⤵
  PID:15468
- C:\Windows\System\BtNQhlN.exe
  C:\Windows\System\BtNQhlN.exe
  2⤵
  PID:15496
- C:\Windows\System\IjeSukp.exe
  C:\Windows\System\IjeSukp.exe
  2⤵
  PID:15512
- C:\Windows\System\ZZkbnjj.exe
  C:\Windows\System\ZZkbnjj.exe
  2⤵
  PID:15552
- C:\Windows\System\wGVbjbg.exe
  C:\Windows\System\wGVbjbg.exe
  2⤵
  PID:15572
- C:\Windows\System\diNMBnB.exe
  C:\Windows\System\diNMBnB.exe
  2⤵
  PID:15596
- C:\Windows\System\pOUczem.exe
  C:\Windows\System\pOUczem.exe
  2⤵
  PID:15624
- C:\Windows\System\jsREZEe.exe
  C:\Windows\System\jsREZEe.exe
  2⤵
  PID:15640
- C:\Windows\System\jMrrmgO.exe
  C:\Windows\System\jMrrmgO.exe
  2⤵
  PID:15664
- C:\Windows\System\ONWETSo.exe
  C:\Windows\System\ONWETSo.exe
  2⤵
  PID:15700
- C:\Windows\System\eUtVfFU.exe
  C:\Windows\System\eUtVfFU.exe
  2⤵
  PID:15724
- C:\Windows\System\xZrRnKh.exe
  C:\Windows\System\xZrRnKh.exe
  2⤵
  PID:15780
- C:\Windows\System\uJFueoJ.exe
  C:\Windows\System\uJFueoJ.exe
  2⤵
  PID:15800
- C:\Windows\System\tVCmjzW.exe
  C:\Windows\System\tVCmjzW.exe
  2⤵
  PID:15824
- C:\Windows\System\gesBqIr.exe
  C:\Windows\System\gesBqIr.exe
  2⤵
  PID:15856
- C:\Windows\System\pjLNHOo.exe
  C:\Windows\System\pjLNHOo.exe
  2⤵
  PID:15876
- C:\Windows\System\MtmpDSc.exe
  C:\Windows\System\MtmpDSc.exe
  2⤵
  PID:15908
- C:\Windows\System\rkatltB.exe
  C:\Windows\System\rkatltB.exe
  2⤵
  PID:15932
- C:\Windows\System\jCjdnhC.exe
  C:\Windows\System\jCjdnhC.exe
  2⤵
  PID:15976
- C:\Windows\System\hMCqIhy.exe
  C:\Windows\System\hMCqIhy.exe
  2⤵
  PID:16004
- C:\Windows\System\xzGGVNk.exe
  C:\Windows\System\xzGGVNk.exe
  2⤵
  PID:16020
- C:\Windows\System\WNSCDbF.exe
  C:\Windows\System\WNSCDbF.exe
  2⤵
  PID:16048
- C:\Windows\System\eBdVMMB.exe
  C:\Windows\System\eBdVMMB.exe
  2⤵
  PID:16064
- C:\Windows\System\zPtDxtC.exe
  C:\Windows\System\zPtDxtC.exe
  2⤵
  PID:16084
- C:\Windows\System\MmUSaDj.exe
  C:\Windows\System\MmUSaDj.exe
  2⤵
  PID:16112
- C:\Windows\System\OdmWCfP.exe
  C:\Windows\System\OdmWCfP.exe
  2⤵
  PID:16164
- C:\Windows\System\WiqAkUL.exe
  C:\Windows\System\WiqAkUL.exe
  2⤵
  PID:16200
- C:\Windows\System\BacBWFe.exe
  C:\Windows\System\BacBWFe.exe
  2⤵
  PID:16216
- C:\Windows\System\IzwujiQ.exe
  C:\Windows\System\IzwujiQ.exe
  2⤵
  PID:16232
- C:\Windows\System\TWWcaHC.exe
  C:\Windows\System\TWWcaHC.exe
  2⤵
  PID:16264
- C:\Windows\System\wURXwpo.exe
  C:\Windows\System\wURXwpo.exe
  2⤵
  PID:16292
- C:\Windows\System\FEkDWGD.exe
  C:\Windows\System\FEkDWGD.exe
  2⤵
  PID:16316
- C:\Windows\System\ZswYUnP.exe
  C:\Windows\System\ZswYUnP.exe
  2⤵
  PID:16348
- C:\Windows\System\mVzDpSj.exe
  C:\Windows\System\mVzDpSj.exe
  2⤵
  PID:16372
- C:\Windows\System\ILNTkYY.exe
  C:\Windows\System\ILNTkYY.exe
  2⤵
  PID:15380
- C:\Windows\System\wQfGHGm.exe
  C:\Windows\System\wQfGHGm.exe
  2⤵
  PID:15460
- C:\Windows\System\ZYbBwgx.exe
  C:\Windows\System\ZYbBwgx.exe
  2⤵
  PID:15536
- C:\Windows\System\NPjBNAo.exe
  C:\Windows\System\NPjBNAo.exe
  2⤵
  PID:15616
- C:\Windows\System\WSSnnpX.exe
  C:\Windows\System\WSSnnpX.exe
  2⤵
  PID:15656
- C:\Windows\System\cjyycLz.exe
  C:\Windows\System\cjyycLz.exe
  2⤵
  PID:15720
- C:\Windows\System\mqZiWXB.exe
  C:\Windows\System\mqZiWXB.exe
  2⤵
  PID:15820
- C:\Windows\System\EcwwkRc.exe
  C:\Windows\System\EcwwkRc.exe
  2⤵
  PID:15868
- C:\Windows\System\jlxgCMM.exe
  C:\Windows\System\jlxgCMM.exe
  2⤵
  PID:15896
- C:\Windows\System\wnmDFRe.exe
  C:\Windows\System\wnmDFRe.exe
  2⤵
  PID:15968
- C:\Windows\System\LmaxzPJ.exe
  C:\Windows\System\LmaxzPJ.exe
  2⤵
  PID:16032
- C:\Windows\System\IoAkFul.exe
  C:\Windows\System\IoAkFul.exe
  2⤵
  PID:16108
- C:\Windows\System\jELgkCE.exe
  C:\Windows\System\jELgkCE.exe
  2⤵
  PID:16212
- C:\Windows\System\PQcMFaa.exe
  C:\Windows\System\PQcMFaa.exe
  2⤵
  PID:16288
- C:\Windows\System\yYwUrcI.exe
  C:\Windows\System\yYwUrcI.exe
  2⤵
  PID:16312
- C:\Windows\System\RTRsMZR.exe
  C:\Windows\System\RTRsMZR.exe
  2⤵
  PID:16360
- C:\Windows\System\bJVhsZh.exe
  C:\Windows\System\bJVhsZh.exe
  2⤵
  PID:15508
- C:\Windows\System\SqvvwBw.exe
  C:\Windows\System\SqvvwBw.exe
  2⤵
  PID:15652
- C:\Windows\System\yenkAIo.exe
  C:\Windows\System\yenkAIo.exe
  2⤵
  PID:15796
- C:\Windows\System\VNRbgZe.exe
  C:\Windows\System\VNRbgZe.exe
  2⤵
  PID:15960
- C:\Windows\System\HPIkOiM.exe
  C:\Windows\System\HPIkOiM.exe
  2⤵
  PID:16096
- C:\Windows\System\pmSZLhg.exe
  C:\Windows\System\pmSZLhg.exe
  2⤵
  PID:16188
- C:\Windows\System\NkErmuk.exe
  C:\Windows\System\NkErmuk.exe
  2⤵
  PID:16228
- C:\Windows\System\dSfGAya.exe
  C:\Windows\System\dSfGAya.exe
  2⤵
  PID:14852
- C:\Windows\System\BWfGPHc.exe
  C:\Windows\System\BWfGPHc.exe
  2⤵
  PID:16104
- C:\Windows\System\eeOzDOu.exe
  C:\Windows\System\eeOzDOu.exe
  2⤵
  PID:15464
- C:\Windows\System\VbIPKJn.exe
  C:\Windows\System\VbIPKJn.exe
  2⤵
  PID:15892
- C:\Windows\System\MCsLVNW.exe
  C:\Windows\System\MCsLVNW.exe
  2⤵
  PID:16412
- C:\Windows\System\PFYAhAL.exe
  C:\Windows\System\PFYAhAL.exe
  2⤵
  PID:16440
- C:\Windows\System\rywXvkP.exe
  C:\Windows\System\rywXvkP.exe
  2⤵
  PID:16464
- C:\Windows\System\POKFKTA.exe
  C:\Windows\System\POKFKTA.exe
  2⤵
  PID:16484
- C:\Windows\System\kNvWmgP.exe
  C:\Windows\System\kNvWmgP.exe
  2⤵
  PID:16504
- C:\Windows\System\PzWpiXt.exe
  C:\Windows\System\PzWpiXt.exe
  2⤵
  PID:16528
- C:\Windows\System\YrwRFUK.exe
  C:\Windows\System\YrwRFUK.exe
  2⤵
  PID:16580
- C:\Windows\System\iQMRyNR.exe
  C:\Windows\System\iQMRyNR.exe
  2⤵
  PID:16608
- C:\Windows\System\OpDQOWt.exe
  C:\Windows\System\OpDQOWt.exe
  2⤵
  PID:16632
- C:\Windows\System\roRZDqn.exe
  C:\Windows\System\roRZDqn.exe
  2⤵
  PID:16652
- C:\Windows\System\pjIoilS.exe
  C:\Windows\System\pjIoilS.exe
  2⤵
  PID:16692
- C:\Windows\System\lAhpjDJ.exe
  C:\Windows\System\lAhpjDJ.exe
  2⤵
  PID:16708
- C:\Windows\System\tJHPJmh.exe
  C:\Windows\System\tJHPJmh.exe
  2⤵
  PID:16748
- C:\Windows\System\naNPBOw.exe
  C:\Windows\System\naNPBOw.exe
  2⤵
  PID:16776
- C:\Windows\System\EJYSDST.exe
  C:\Windows\System\EJYSDST.exe
  2⤵
  PID:16804
- C:\Windows\System\uzOORvB.exe
  C:\Windows\System\uzOORvB.exe
  2⤵
  PID:16820
- C:\Windows\System\SheQTQR.exe
  C:\Windows\System\SheQTQR.exe
  2⤵
  PID:16836
- C:\Windows\System\RkOmXJq.exe
  C:\Windows\System\RkOmXJq.exe
  2⤵
  PID:16860
- C:\Windows\System\docmAyD.exe
  C:\Windows\System\docmAyD.exe
  2⤵
  PID:16888
- C:\Windows\System\pCYlJaM.exe
  C:\Windows\System\pCYlJaM.exe
  2⤵
  PID:16916
- C:\Windows\System\hjgBSFg.exe
  C:\Windows\System\hjgBSFg.exe
  2⤵
  PID:16944
- C:\Windows\System\sfzpbDn.exe
  C:\Windows\System\sfzpbDn.exe
  2⤵
  PID:16960

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:17380

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\AvUfRlH.exe

Filesize
1.7MB

MD5
d91779be723f5c69ca5d1be965c7200b

SHA1
12becf4a31ddda2b296af0d1d2c68b71b8b3dbc0

SHA256
c336369270e8c6ae1408ab6bf46a88ce4e33c98e17d2519544e87ccc760c421a

SHA512
871cde30cf48b6f62ae3afd00b7d721e083bb7a70ce6072a90d10ce8f5501447c54047f30181dea09743b7aeaa74f755e8bd3f519cfa199f6ccb2c23843c93ed

Download Submit
C:\Windows\System\BbdjlEc.exe

Filesize
1.7MB

MD5
5ac1d77800680eb7ce6390f09e2fdb49

SHA1
b7afa574b90e8bd15bcb2f8b620c1d8ab258c421

SHA256
641561a53f904a98551e45f4cd49bb3c323d986155f4f05817c7e29ad6ba61ec

SHA512
e1b043969c94855fe0485b5e352d53a4ed8d68df8fdb716d964031f8f5f1eac06ba9aafbe89038b0adbfbf9d63b1958466c2f8bb2f43e2d2f69bb81f821418a4

Download Submit
C:\Windows\System\FGONylU.exe

Filesize
1.7MB

MD5
9f3a1603ecea318f3ef14fe72c8aa0dd

SHA1
3adb758262867b5a35d80f4212cd4926499b9f5b

SHA256
7cbd3af62f1f0c756852d9c0a6a166c96e7000f536333d60a11ce0ac0bb0d825

SHA512
f6c551af365da7d9979a6a4beb619b45094a5e6680c64fac8c860f8a6bc9d3fdb3ae1523c2568413693538831e53134ce22494acfe41cea954ba0f8462506f86

Download Submit
C:\Windows\System\GZqEHyZ.exe

Filesize
1.7MB

MD5
7a559aab459ce6f65cfe76a5a38b8591

SHA1
9b99377d820d0bdb3473ca4ca534b98ec21d8aa5

SHA256
2e251de7e485b07dac8e333ce3facb30f211418997379d21d7296fabdfc402ab

SHA512
7d4879fdc69cee14dce40db03f138bf38706ba6a7ff61731d96afa04e524c8bb96c89d29837db2720f7880b48663c69ae6e66b824defee3c111653d63f3984ee

Download Submit
C:\Windows\System\INHlKyV.exe

Filesize
1.7MB

MD5
63f1950724cd40512d8da1e76ca90aef

SHA1
3338f8c15949844f3a39bf1e70fe81fba692b1fe

SHA256
9a90990d22875a8521da558715ad10934001e9e448f6dcdc2de105e69f4fc29d

SHA512
9c3aa427feb9d785048cc141d65667b5eb0787aeb2b14fdc6499322e053d2c28fdff50ed800910dc8e45b7aed7891d641a2cb559d9b7269273cc2cc2ba409a23

Download Submit
C:\Windows\System\JEYbCta.exe

Filesize
1.7MB

MD5
1283d72efae90743a4d2b86c1221a626

SHA1
aff552e158f42f468c5e6414be9e4251d076aead

SHA256
308de680f708f702bc50b7e1e0e2d38463df960ee5736e2a11ce5f44712750f0

SHA512
f6eec29da6b7990b11bbb23964b761f6560499b8250c074884a6b5fe5309f371dd2c90bed80b3a20f1b6caf80bdc9d4399e5938d1c1fc9e0c7948e92d16b990c

Download Submit
C:\Windows\System\JJbzyOU.exe

Filesize
1.7MB

MD5
5c05fbfe11b73b90a701bd9ea155b137

SHA1
e8f665139646d0cb699919e467116b5348531bde

SHA256
406227e9ba9653fcd5dcc0f86e6abb488acc58ee6c0a1fcbceae84007fce4b12

SHA512
42788ad01aada5fd8b9b04c6ea10008dbedb692e88bfc977f6350f665ce6a99292321749d7c2f21978397069db6c7704bd6e2ae59ab0e047f6550cc57524ed91

Download Submit
C:\Windows\System\JcgjgcT.exe

Filesize
1.7MB

MD5
e0228467859acfe779f4631701cf5587

SHA1
7f199d03c3b6c29f9153813682223e5542c50f21

SHA256
436b5c50c3c8e6f5d339e10101841085855652b201cf4dc1e10a58a1c7c422d5

SHA512
74150ca0de5da8f0ee55fc7502b928af56c1accdaab50165a6a34315aad059427c9b97d4d8af674939d9f18547866ed3e4c1bb4db21d131a1038dff97ca85db6

Download Submit
C:\Windows\System\LfwbiOJ.exe

Filesize
1.7MB

MD5
da61985227a9cb1900242d932a527207

SHA1
1141a4f2438585a1724a176c78d5ab99334ef289

SHA256
908f3f0a8d0543c82a7277959d210e5e789c96609d77febe66d97b1d5c9c75f3

SHA512
7bd938301693069051464831829589742743a29d641c813dc6624765e1da9f158fa4a757e11788346caf79f455a35731a0eaaea9c110f91f45ffc9db01659b51

Download Submit
C:\Windows\System\RATgSYb.exe

Filesize
1.7MB

MD5
2daacc38344b47d3870b2dbd9bd1b7a2

SHA1
0f958341e35e10abf3e240c4e7935e282cab36bc

SHA256
05bdb76661cfb085065d7128314361b87d1a61e6605254cb8ad0b754ea414b0d

SHA512
10e73b830f2cdeec7051ad11782930533d68d5a38975284c5b46cca413e7a81c849203b940152fc08555e8ff665742ed1bdef3596f84be517fffc92858d3ba2b

Download Submit
C:\Windows\System\RVNpPOt.exe

Filesize
1.7MB

MD5
cddde3982d8e1b6f010fecb95c379680

SHA1
4428ddcb4f10a387831d57125d3aafa98beadfe1

SHA256
eda96c9b95072fbecf93b8bc3b30ce25c29f96bfd234554aa4131d5bb8d0cf48

SHA512
273a592079e265febca4c7f03e0a1669f21ffcd14b299d128bed95d23a3ea7f4b1bd0bcdff3e4baa1539d418b0a186d15372f3da77baec153047fbb0db073ba4

Download Submit
C:\Windows\System\SIaBZim.exe

Filesize
1.7MB

MD5
8e91c28b76a9703456fca144e5127ecc

SHA1
b2751de082fce88a1ddd3598e42b356b64f1e299

SHA256
86d5aa85ec145f1df6ee61d1031ace26d5af3f212bb2e89b0a1cd4ce08937b53

SHA512
fe514c09f7c3f0df9c89c6c176951e137bbdf4a57ba15423c4bf61c5a3347a26716efa95f6ace703df754924b77e5a2012f2c1e3c10648358c81d4a8aada8603

Download Submit
C:\Windows\System\VfJAuKr.exe

Filesize
1.7MB

MD5
05d5fd08d767e70d197c8331a5377d74

SHA1
daf7dc7c3916447fdab4be7cb11e9755f2eafb45

SHA256
75266d45097fd7cd62fb9d8b9daec8a7e5c3a493550fa8f11b651fa46cdc12c0

SHA512
c0900c894763ecc87c68348e0b7773ccd241908cce3a585737a090dcbad64441e23a0d8e89837abcaf3010b85b8680cdaf8a0eb21982622c0c25140d34a1b658

Download Submit
C:\Windows\System\XGNlzJI.exe

Filesize
1.7MB

MD5
ba694d98b605d05fdbba01202477e16a

SHA1
cef6ea05cb99f3a7b08689bdbfcee9b72d389f91

SHA256
3be1d6c7e3099c07b0423193e8e61b1719a94801a5c3a7e2f240c48216d58f71

SHA512
55c45df7edc5e9781de92f8a3a561dc4514cf32bcf8f4de83de1936befa364a3cb8721abb001ac26aa87fa754e50f56d72a4fda5b44da0c9691b0f84411d82b9

Download Submit
C:\Windows\System\ZVWKYyW.exe

Filesize
1.7MB

MD5
ba04a7cb3b2f8a4c999f04f82c7d2653

SHA1
a23c4e28dd44b82967a8cf26d60216922a42f7d1

SHA256
18ac3eef91ef67e6fe1f54e0fcac8a50b125b98cddb906f41a72a21d86d390ef

SHA512
467e322bbb650d3262fe812b0a884b647c45c4f8f039a299b525b904d7c9cccf8bf5e10d3d1a38f5da0d20c98a6cba061cbbff3386825337f64b039bf6f4298e

Download Submit
C:\Windows\System\dMpfrKp.exe

Filesize
1.7MB

MD5
2d3d2aa35f4371fbb38b6c398a2f4e64

SHA1
a3c33b84dc81b81cca5fe9dd518f179359a3209c

SHA256
1a62a398f1dbabbb746fa76f8f8c06efe73d31c26aebe3ad413d219c256d3bbb

SHA512
d5b0a44f43e4ab34a0ccbda3d30dc0b5ddeeece09812336ae185bf494e9b042c2c4722cd3ed1a8a56f5618cf8457e1cd635e845e6384843b06c77bbbc6f271b3

Download Submit
C:\Windows\System\edXxSZL.exe

Filesize
1.7MB

MD5
705942626b629d39ef77625e36cd0b10

SHA1
c17e08a37c1c28f3dc9f4c0f97c46b1d1049cca1

SHA256
5786c7854e56ef9307ccbea945639d91ff51e91f0624302aff5a2c13aedb5f46

SHA512
a990b55b257e3315cb9fa4d313a21a63eeb3843b30a0654f8c95231ac295536e4ab3dfb0bae2c27b6f725d0055bbdd8a02ef4b58e8a594bf366623fc0dc9bed9

Download Submit
C:\Windows\System\ehPgTfc.exe

Filesize
1.7MB

MD5
40102bbef2c2d3d692b744f1a7ccbfec

SHA1
a9415abeccdfba1e0290e3f93b1e6d5c8208a011

SHA256
09a8da072767244571a55623286a16e62fba5a7b0f848c249de73776cbd1333b

SHA512
20c48032a6a30caffab40699c800e75b4301b60d38390c48de04704de0a2c39afe1d0856a534d2a946070b1316950476e9ef3591933e390e880723b982834987

Download Submit
C:\Windows\System\gNhRQsD.exe

Filesize
1.7MB

MD5
c45200af343e2c200105abac172861dc

SHA1
8e5ad3a27b0901cb2998ce05d074f49f4c4a12f6

SHA256
5b64673e2375309c8aa01b36286f9184ed7ebd0872b1866dee16948873693eeb

SHA512
f68cd05e22855d526dd7bcc060fd07fc35a9250b1e765cbe17ef27cde2458447639d523e26dfed9ee99ceb797f0edf0a21f4967a66d6392c06f937fbfc626623

Download Submit
C:\Windows\System\idGmRsd.exe

Filesize
1.7MB

MD5
a74eb13fb0deb8ddde3c277df8d1b8d8

SHA1
7a72e9d30965716e293d674274ccf52be86d963f

SHA256
9d5aed3fe80b8e8a7a76bc8c0c64267f30cb0383811db029c14b373733ddcd05

SHA512
bce990504b2ba54b3717c01ec7d45d632a302283ecde2e4a59edb10d1ac045fdeb320b6d41bd8a962b79b0060913cabae07e44fc355a6f6bb2bae7fa812a01a7

Download Submit
C:\Windows\System\ldJyPjH.exe

Filesize
1.7MB

MD5
1bc1e64637fe08d386d5c65a149dd625

SHA1
856270eaa7684adf673ce3d2992d1380b9efdccc

SHA256
e14dd0d88a64d54abfcdfba1dc3bbd20fac80bb086826e99befdf653f8b03c7e

SHA512
e8b1c049a1520fd4cecdf4d5646a57c8c6e83fbc12bb727b350167e2e9f66807a9fd2e23cf46a8d83eb9a9e0ce9221288cf7232b50f73c14d719db5bc4c12ae8

Download Submit
C:\Windows\System\oJPtVTl.exe

Filesize
1.7MB

MD5
5b9d0685dbf16a87cffeac307d1a2659

SHA1
ec58bb2d07ba13e9f7588d6688a26347f3df8f2b

SHA256
3607d86d283633ab92718dfc2f05e7f932ae3154be886973ac63c1c07fdbb4c7

SHA512
ac97fa760cb2b6c8eb73802da9a45576fc269ae26dee8dadcfb3126da73289584f66f92145c7313e6a301bdb93975d17c4dfe758d5bedcca9daf47b859649a85

Download Submit
C:\Windows\System\pqBekbs.exe

Filesize
1.7MB

MD5
8e303b91bb47b3628e11c23a2eedcce5

SHA1
77d6e179bce5c7563e4547302b5d70a9b18f2b4a

SHA256
3a5199fc9e5dc520ab13f123ca11829cd4850761ffbe28c1cb71adfc5f1bd958

SHA512
f27ed9d735f4c03b0721f2e98d0896254ac179178c4e882faddc822f062c30467083518b66503633ed3a7ab7dfcd9afd3022299230a8147e343bcc1b9235a06e

Download Submit
C:\Windows\System\qhQOdAz.exe

Filesize
1.7MB

MD5
9e2efb3eaeb0bde1d18f4823fa353bee

SHA1
14fbdb402205ddadbfef31ffd22fd8e2cbdbcf62

SHA256
c3fa82a73cd667830dbf48a48cef585d764b6022f54e0369eada2d8a23a31082

SHA512
deb11b94555e70f27633d88b7031a7cdb27b45b31a3aae20bfec250db7c35358cb5bcfb9dfe2836a0cbf2312884a82bbee4abdb2c6e83597aa56c645dfd2caf2

Download Submit
C:\Windows\System\sREmFtg.exe

Filesize
1.7MB

MD5
19feae6c54f637fddd95e4c8d7d249d4

SHA1
55e6c2b5a75f0caa6e883cea813c01db7f2e0b7a

SHA256
9d8fd4779aa3d255e5a7afd2aec83d5139f3da58dd12ddb3f63f7029fc775a08

SHA512
8a7406153b406591c7282fb423fb053c7ad3ea54c51d6a6c5a9838127d72bdd76062a80f6b6fd1de7611526a99941f9f1b5b7986ec59897ae562da17cc168b8f

Download Submit
C:\Windows\System\sUPfWOo.exe

Filesize
1.7MB

MD5
43b43196e9e658cef31b92fa4483d7b7

SHA1
356bdd7a76de56b653c5acb5b585a025f2063755

SHA256
01b2467e0420bfbf53f2726628f71bb9eb8a929e88fa8ded553a8d83b7b7fa85

SHA512
d02b260b02d82d261f1593c1efc8586168207c214e68204c83399f900fcbbc497f312244c7bd4f6c909dee94a69b1dabacba3caa6a079079ccd74e5eca284a57

Download Submit
C:\Windows\System\tfZdAMd.exe

Filesize
1.7MB

MD5
0d7e9baaaab72c7a50d7f2b89fb3bbec

SHA1
ae73d2ace71cd8318732631d5a400d3875caf56c

SHA256
124bc4ffae342bd80ef2509ec474f19b25613dad56c155f9fc4b2ead76a5ebb3

SHA512
2a729d269109973cd6d9cd014fc44007b2a8c9f4b588d377ebb11d9d1a216a416e355f9b870ed3db6cb97f57bd60a82751f6e4324fb0be55812a54f8136c4562

Download Submit
C:\Windows\System\wQeRGmA.exe

Filesize
1.7MB

MD5
f463ad9d7338ffa51e39ad19a701584d

SHA1
873631d4c0399fc265e03cea553b4fbd28a0be5e

SHA256
a1cb0ae635a0c81e5f040af93f0ff260996ec65b3384c4902fb6f1a1593ef2aa

SHA512
5770a166af7ebe2148b7c4061785085964343ce975f0b90023da3455540c2e1ec6b911e0313a226cf07ae3e99864c321986e42d67601ba52613f04c77aaab797

Download Submit
C:\Windows\System\wXaSXAb.exe

Filesize
1.7MB

MD5
4ace640eb94caa5a7513aafa512e0175

SHA1
3dfe39d25d15a5dde9e0fb5e82a79ac5bd87f79d

SHA256
c9f8e8e20c6fbf9041959e6172a523c6d0dbb2f7ce638e1b299d399ae3af5d75

SHA512
b052e8d2dfa57ff1258c15ce08e6295526b983511b6869fa49b1a48a491d1d07da3d5aab4f14c11021f286c79d903a3d03f3b4fdd8ea61007986d8c9339cae86

Download Submit
C:\Windows\System\wacqzbu.exe

Filesize
1.7MB

MD5
af4d0d34976578d1071cb597b3ad2342

SHA1
8dec7497e3de3e5b204652a4d3da18ef20cb9145

SHA256
6efc54bb481194081b5150ffb66d7f023e2b989f5641373332ce7b662fb9d94d

SHA512
3cc2ff252a1cb0e26bef81b7afa5cfbdd9cd7de28bf685e0a630f7a95b61a7ebf1322bb70fa47ebd529e7cccfa642a0b988a589b96e81edc0b3804c43df66d44

Download Submit
C:\Windows\System\xRCBwGs.exe

Filesize
1.7MB

MD5
5a3d41f72c2dee343ca4a741469cc14e

SHA1
33674657529f7fd445da37014d60fbb838f12e94

SHA256
b39a8ac0e0f51db865da251e81ddb6e78028c7728e3a90b9c3d760b30bbcbbc8

SHA512
eeaea5815d6dbbd38103ef64b720fe6918304996df369604a6ea023b0d555d673bfe4e443d5dd4d91a55857aad0dbfed9fa37ee990e38f5a94d4f3054d7f5b75

Download Submit
C:\Windows\System\zIHUmpo.exe

Filesize
1.7MB

MD5
b314724bcf089dbd526c55f646745ae3

SHA1
8f7d6b2aceed30d4227759a6ed7d586d906cfd54

SHA256
5c9e80c2e7b5d67c882a057f29c9892c2297b4545635ee2a9cb97151901bff31

SHA512
ea131df3f5b557b6443e12900b6fbd16330edcbe352e33eeab1bb880139a135c40196c18d9f722819392a705190dbc5a3bc9e42fe5b7506f59d80a97533bb10f

Download Submit
C:\Windows\System\zfoJWrB.exe

Filesize
1.7MB

MD5
cb193472b66861434ef7b159e12e3eb3

SHA1
712099ca2d053e1285b87c57505f1da55dc8ded8

SHA256
0085d81839a0a434a28f912e77b256842f6a3922a4f44963a6726b214b45886a

SHA512
1b2bc4e120b53fb4c927a5690eeed4be3365668d09e2b9cdb387c8494c46d8851bde464620920966b6a61ae93510ccb03deb545b34b12717dcecf4ee41440547

Download Submit
memory/4536-0-0x000001C4C7A80000-0x000001C4C7A90000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads