xmrig | 7f1219cdbea1062a8db74ea4e4e349582912e8d15792fbdc202bf921a179468c

Analysis

max time kernel
120s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
26/01/2025, 00:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7f1219cdbea1062a8db74ea4e4e349582912e8d15792fbdc202bf921a179468c.exe
Size

1.4MB
MD5

1915528220b416a0305ea9ea22df9376
SHA1

01cd8229e5c1b2eb7b327ba23629d7c798840369
SHA256

7f1219cdbea1062a8db74ea4e4e349582912e8d15792fbdc202bf921a179468c
SHA512

5ce927051dd203662621ab870fd1a7baed41305c138b4d2ee9b7ff66bca1e6b75be86ed65f552a7d25e2603c9b0fcfa9cef12943cca87ff48949c6d0ff64dd03
SSDEEP

24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbpwlKenszbWKDNEm/5ph70VwmX8U:GezaTF8FcNkNdfE0pZ9ozttwIRx2Vshq

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 32 IoCs

miner

resource	yara_rule
behavioral2/files/0x000a000000023c5f-4.dat	xmrig
behavioral2/files/0x0007000000023cca-15.dat	xmrig
behavioral2/files/0x0007000000023ccb-32.dat	xmrig
behavioral2/files/0x0007000000023cd2-47.dat	xmrig
behavioral2/files/0x0007000000023cd0-65.dat	xmrig
behavioral2/files/0x0007000000023cd7-75.dat	xmrig
behavioral2/files/0x0007000000023cd6-73.dat	xmrig
behavioral2/files/0x0007000000023cd5-71.dat	xmrig
behavioral2/files/0x0007000000023cd4-69.dat	xmrig
behavioral2/files/0x0007000000023cd3-67.dat	xmrig
behavioral2/files/0x0007000000023ccc-55.dat	xmrig
behavioral2/files/0x0007000000023cd1-48.dat	xmrig
behavioral2/files/0x0007000000023cce-40.dat	xmrig
behavioral2/files/0x0007000000023ccd-29.dat	xmrig
behavioral2/files/0x0007000000023ccf-43.dat	xmrig
behavioral2/files/0x0007000000023cd8-81.dat	xmrig
behavioral2/files/0x0007000000023cda-82.dat	xmrig
behavioral2/files/0x0008000000023cc7-89.dat	xmrig
behavioral2/files/0x0007000000023cdb-94.dat	xmrig
behavioral2/files/0x0007000000023cdd-97.dat	xmrig
behavioral2/files/0x0007000000023cde-104.dat	xmrig
behavioral2/files/0x0007000000023cdf-109.dat	xmrig
behavioral2/files/0x0007000000023ce0-127.dat	xmrig
behavioral2/files/0x0007000000023ce1-137.dat	xmrig
behavioral2/files/0x0007000000023ce7-147.dat	xmrig
behavioral2/files/0x0007000000023ce5-154.dat	xmrig
behavioral2/files/0x0007000000023ce9-160.dat	xmrig
behavioral2/files/0x0007000000023ce8-158.dat	xmrig
behavioral2/files/0x0007000000023ce6-150.dat	xmrig
behavioral2/files/0x0007000000023ce4-135.dat	xmrig
behavioral2/files/0x0007000000023ce3-131.dat	xmrig
behavioral2/files/0x0007000000023ce2-129.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
4964	cVdeWEs.exe
3704	tQlxGFO.exe
1492	nNXzsjl.exe
1160	NXmdEWy.exe
4780	AtRKqVJ.exe
224	cflTEHy.exe
4356	ZjCJqPA.exe
2028	DhoSVyb.exe
2268	mLeaYdH.exe
4024	nqANVGX.exe
2840	KhlESTK.exe
2372	puNcOJS.exe
3624	uelbiiD.exe
3760	YRLyjJB.exe
1832	jPNVzso.exe
3864	QKLRmXk.exe
1076	BZtkgrX.exe
744	XGKuVqE.exe
3004	gNVuBvt.exe
4392	ebsoElm.exe
3468	lcjhJIO.exe
3956	SssZcTR.exe
1348	NNsNLeO.exe
2228	BhiFvHy.exe
1760	aMyNpKh.exe
2104	oFgYRfk.exe
2324	ITCnVOT.exe
2544	KZIjUyV.exe
5028	FfiREfr.exe
428	agtbSBz.exe
904	PKvPXCm.exe
2408	wnUrqmE.exe
1516	PYGHfuu.exe
4724	NwXoxhl.exe
4340	rYbLuhT.exe
3360	rxQnfrR.exe
2712	OmHnTuy.exe
4856	oBevhgU.exe
3188	pyhGiKp.exe
5032	RICCdiK.exe
4580	VVoUuEB.exe
3300	tzKVmBF.exe
2828	sffhbmv.exe
1064	MVeSXRU.exe
1484	RcQXxVQ.exe
3400	gAZJULD.exe
1696	racOlmZ.exe
2488	OZEOOJr.exe
3904	FLXohzz.exe
376	bvVMkTZ.exe
4588	hvseAqv.exe
4556	izneMhc.exe
1600	XDZUaMH.exe
1564	AsOtEki.exe
3256	QeNRzCM.exe
3076	ApSgXQx.exe
4768	dtcRnjk.exe
1612	BtCfcjQ.exe
856	ObozsNx.exe
5016	FQQIYsL.exe
2100	RrFvinT.exe
4568	cacMnMY.exe
4472	gZPTpLR.exe
1052	SuPtlun.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\lpIKtOg.exe	7f1219cdbea1062a8db74ea4e4e349582912e8d15792fbdc202bf921a179468c.exe
File created	C:\Windows\System\ziCjyoZ.exe	7f1219cdbea1062a8db74ea4e4e349582912e8d15792fbdc202bf921a179468c.exe
File created	C:\Windows\System\vNuduun.exe	7f1219cdbea1062a8db74ea4e4e349582912e8d15792fbdc202bf921a179468c.exe
File created	C:\Windows\System\xxYdyDW.exe	7f1219cdbea1062a8db74ea4e4e349582912e8d15792fbdc202bf921a179468c.exe
File created	C:\Windows\System\budRAhS.exe	7f1219cdbea1062a8db74ea4e4e349582912e8d15792fbdc202bf921a179468c.exe
File created	C:\Windows\System\JhWziAs.exe	7f1219cdbea1062a8db74ea4e4e349582912e8d15792fbdc202bf921a179468c.exe
File created	C:\Windows\System\rdmTgHy.exe	7f1219cdbea1062a8db74ea4e4e349582912e8d15792fbdc202bf921a179468c.exe
File created	C:\Windows\System\snlIhip.exe	7f1219cdbea1062a8db74ea4e4e349582912e8d15792fbdc202bf921a179468c.exe
File created	C:\Windows\System\JsQYyNE.exe	7f1219cdbea1062a8db74ea4e4e349582912e8d15792fbdc202bf921a179468c.exe
File created	C:\Windows\System\wnUrqmE.exe	7f1219cdbea1062a8db74ea4e4e349582912e8d15792fbdc202bf921a179468c.exe
File created	C:\Windows\System\mPBCEjg.exe	7f1219cdbea1062a8db74ea4e4e349582912e8d15792fbdc202bf921a179468c.exe
File created	C:\Windows\System\VuiIbEK.exe	7f1219cdbea1062a8db74ea4e4e349582912e8d15792fbdc202bf921a179468c.exe
File created	C:\Windows\System\FrqMqWm.exe	7f1219cdbea1062a8db74ea4e4e349582912e8d15792fbdc202bf921a179468c.exe
File created	C:\Windows\System\qYRYvcz.exe	7f1219cdbea1062a8db74ea4e4e349582912e8d15792fbdc202bf921a179468c.exe
File created	C:\Windows\System\PrsqDAg.exe	7f1219cdbea1062a8db74ea4e4e349582912e8d15792fbdc202bf921a179468c.exe
File created	C:\Windows\System\oGOzUlP.exe	7f1219cdbea1062a8db74ea4e4e349582912e8d15792fbdc202bf921a179468c.exe
File created	C:\Windows\System\yjngpLd.exe	7f1219cdbea1062a8db74ea4e4e349582912e8d15792fbdc202bf921a179468c.exe
File created	C:\Windows\System\UmNCMZb.exe	7f1219cdbea1062a8db74ea4e4e349582912e8d15792fbdc202bf921a179468c.exe
File created	C:\Windows\System\VMJNZWt.exe	7f1219cdbea1062a8db74ea4e4e349582912e8d15792fbdc202bf921a179468c.exe
File created	C:\Windows\System\RTwetoF.exe	7f1219cdbea1062a8db74ea4e4e349582912e8d15792fbdc202bf921a179468c.exe
File created	C:\Windows\System\rIebQYh.exe	7f1219cdbea1062a8db74ea4e4e349582912e8d15792fbdc202bf921a179468c.exe
File created	C:\Windows\System\bvVMkTZ.exe	7f1219cdbea1062a8db74ea4e4e349582912e8d15792fbdc202bf921a179468c.exe
File created	C:\Windows\System\gEjMLxk.exe	7f1219cdbea1062a8db74ea4e4e349582912e8d15792fbdc202bf921a179468c.exe
File created	C:\Windows\System\UPdkpAu.exe	7f1219cdbea1062a8db74ea4e4e349582912e8d15792fbdc202bf921a179468c.exe
File created	C:\Windows\System\tUnYFZr.exe	7f1219cdbea1062a8db74ea4e4e349582912e8d15792fbdc202bf921a179468c.exe
File created	C:\Windows\System\tTNLzFl.exe	7f1219cdbea1062a8db74ea4e4e349582912e8d15792fbdc202bf921a179468c.exe
File created	C:\Windows\System\xENhJFU.exe	7f1219cdbea1062a8db74ea4e4e349582912e8d15792fbdc202bf921a179468c.exe
File created	C:\Windows\System\gbAgvht.exe	7f1219cdbea1062a8db74ea4e4e349582912e8d15792fbdc202bf921a179468c.exe
File created	C:\Windows\System\PebQnMj.exe	7f1219cdbea1062a8db74ea4e4e349582912e8d15792fbdc202bf921a179468c.exe
File created	C:\Windows\System\dbSleaD.exe	7f1219cdbea1062a8db74ea4e4e349582912e8d15792fbdc202bf921a179468c.exe
File created	C:\Windows\System\BQGkJkm.exe	7f1219cdbea1062a8db74ea4e4e349582912e8d15792fbdc202bf921a179468c.exe
File created	C:\Windows\System\DhoSVyb.exe	7f1219cdbea1062a8db74ea4e4e349582912e8d15792fbdc202bf921a179468c.exe
File created	C:\Windows\System\iCfKFwh.exe	7f1219cdbea1062a8db74ea4e4e349582912e8d15792fbdc202bf921a179468c.exe
File created	C:\Windows\System\zDLtiWI.exe	7f1219cdbea1062a8db74ea4e4e349582912e8d15792fbdc202bf921a179468c.exe
File created	C:\Windows\System\FYCQkTi.exe	7f1219cdbea1062a8db74ea4e4e349582912e8d15792fbdc202bf921a179468c.exe
File created	C:\Windows\System\WDVzJWH.exe	7f1219cdbea1062a8db74ea4e4e349582912e8d15792fbdc202bf921a179468c.exe
File created	C:\Windows\System\eqZremy.exe	7f1219cdbea1062a8db74ea4e4e349582912e8d15792fbdc202bf921a179468c.exe
File created	C:\Windows\System\SuPtlun.exe	7f1219cdbea1062a8db74ea4e4e349582912e8d15792fbdc202bf921a179468c.exe
File created	C:\Windows\System\zMsGDcH.exe	7f1219cdbea1062a8db74ea4e4e349582912e8d15792fbdc202bf921a179468c.exe
File created	C:\Windows\System\ksVSgqW.exe	7f1219cdbea1062a8db74ea4e4e349582912e8d15792fbdc202bf921a179468c.exe
File created	C:\Windows\System\CvjZYnc.exe	7f1219cdbea1062a8db74ea4e4e349582912e8d15792fbdc202bf921a179468c.exe
File created	C:\Windows\System\swoTHQe.exe	7f1219cdbea1062a8db74ea4e4e349582912e8d15792fbdc202bf921a179468c.exe
File created	C:\Windows\System\foAAiAY.exe	7f1219cdbea1062a8db74ea4e4e349582912e8d15792fbdc202bf921a179468c.exe
File created	C:\Windows\System\twDykOB.exe	7f1219cdbea1062a8db74ea4e4e349582912e8d15792fbdc202bf921a179468c.exe
File created	C:\Windows\System\aJiqOFl.exe	7f1219cdbea1062a8db74ea4e4e349582912e8d15792fbdc202bf921a179468c.exe
File created	C:\Windows\System\hfAvuBo.exe	7f1219cdbea1062a8db74ea4e4e349582912e8d15792fbdc202bf921a179468c.exe
File created	C:\Windows\System\IStAJwX.exe	7f1219cdbea1062a8db74ea4e4e349582912e8d15792fbdc202bf921a179468c.exe
File created	C:\Windows\System\GHbjAMD.exe	7f1219cdbea1062a8db74ea4e4e349582912e8d15792fbdc202bf921a179468c.exe
File created	C:\Windows\System\NZHQSJt.exe	7f1219cdbea1062a8db74ea4e4e349582912e8d15792fbdc202bf921a179468c.exe
File created	C:\Windows\System\qNgRinT.exe	7f1219cdbea1062a8db74ea4e4e349582912e8d15792fbdc202bf921a179468c.exe
File created	C:\Windows\System\XYIixah.exe	7f1219cdbea1062a8db74ea4e4e349582912e8d15792fbdc202bf921a179468c.exe
File created	C:\Windows\System\unCeyiC.exe	7f1219cdbea1062a8db74ea4e4e349582912e8d15792fbdc202bf921a179468c.exe
File created	C:\Windows\System\DnMeeVY.exe	7f1219cdbea1062a8db74ea4e4e349582912e8d15792fbdc202bf921a179468c.exe
File created	C:\Windows\System\UHGAGTy.exe	7f1219cdbea1062a8db74ea4e4e349582912e8d15792fbdc202bf921a179468c.exe
File created	C:\Windows\System\rqdJRIy.exe	7f1219cdbea1062a8db74ea4e4e349582912e8d15792fbdc202bf921a179468c.exe
File created	C:\Windows\System\tkcJHnK.exe	7f1219cdbea1062a8db74ea4e4e349582912e8d15792fbdc202bf921a179468c.exe
File created	C:\Windows\System\HjKFaJz.exe	7f1219cdbea1062a8db74ea4e4e349582912e8d15792fbdc202bf921a179468c.exe
File created	C:\Windows\System\trJzZNd.exe	7f1219cdbea1062a8db74ea4e4e349582912e8d15792fbdc202bf921a179468c.exe
File created	C:\Windows\System\cXebrmV.exe	7f1219cdbea1062a8db74ea4e4e349582912e8d15792fbdc202bf921a179468c.exe
File created	C:\Windows\System\RLbxdpH.exe	7f1219cdbea1062a8db74ea4e4e349582912e8d15792fbdc202bf921a179468c.exe
File created	C:\Windows\System\uqGLUUH.exe	7f1219cdbea1062a8db74ea4e4e349582912e8d15792fbdc202bf921a179468c.exe
File created	C:\Windows\System\NgbEXjg.exe	7f1219cdbea1062a8db74ea4e4e349582912e8d15792fbdc202bf921a179468c.exe
File created	C:\Windows\System\iwgGOLd.exe	7f1219cdbea1062a8db74ea4e4e349582912e8d15792fbdc202bf921a179468c.exe
File created	C:\Windows\System\racOlmZ.exe	7f1219cdbea1062a8db74ea4e4e349582912e8d15792fbdc202bf921a179468c.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	17272	dwm.exe
Token: SeChangeNotifyPrivilege	17272	dwm.exe
Token: 33	17272	dwm.exe
Token: SeIncBasePriorityPrivilege	17272	dwm.exe
Token: SeShutdownPrivilege	17272	dwm.exe
Token: SeCreatePagefilePrivilege	17272	dwm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2808 wrote to memory of 4964	2808	7f1219cdbea1062a8db74ea4e4e349582912e8d15792fbdc202bf921a179468c.exe	84
PID 2808 wrote to memory of 4964	2808	7f1219cdbea1062a8db74ea4e4e349582912e8d15792fbdc202bf921a179468c.exe	84
PID 2808 wrote to memory of 3704	2808	7f1219cdbea1062a8db74ea4e4e349582912e8d15792fbdc202bf921a179468c.exe	85
PID 2808 wrote to memory of 3704	2808	7f1219cdbea1062a8db74ea4e4e349582912e8d15792fbdc202bf921a179468c.exe	85
PID 2808 wrote to memory of 1492	2808	7f1219cdbea1062a8db74ea4e4e349582912e8d15792fbdc202bf921a179468c.exe	86
PID 2808 wrote to memory of 1492	2808	7f1219cdbea1062a8db74ea4e4e349582912e8d15792fbdc202bf921a179468c.exe	86
PID 2808 wrote to memory of 1160	2808	7f1219cdbea1062a8db74ea4e4e349582912e8d15792fbdc202bf921a179468c.exe	87
PID 2808 wrote to memory of 1160	2808	7f1219cdbea1062a8db74ea4e4e349582912e8d15792fbdc202bf921a179468c.exe	87
PID 2808 wrote to memory of 4356	2808	7f1219cdbea1062a8db74ea4e4e349582912e8d15792fbdc202bf921a179468c.exe	88
PID 2808 wrote to memory of 4356	2808	7f1219cdbea1062a8db74ea4e4e349582912e8d15792fbdc202bf921a179468c.exe	88
PID 2808 wrote to memory of 4780	2808	7f1219cdbea1062a8db74ea4e4e349582912e8d15792fbdc202bf921a179468c.exe	89
PID 2808 wrote to memory of 4780	2808	7f1219cdbea1062a8db74ea4e4e349582912e8d15792fbdc202bf921a179468c.exe	89
PID 2808 wrote to memory of 224	2808	7f1219cdbea1062a8db74ea4e4e349582912e8d15792fbdc202bf921a179468c.exe	90
PID 2808 wrote to memory of 224	2808	7f1219cdbea1062a8db74ea4e4e349582912e8d15792fbdc202bf921a179468c.exe	90
PID 2808 wrote to memory of 2028	2808	7f1219cdbea1062a8db74ea4e4e349582912e8d15792fbdc202bf921a179468c.exe	91
PID 2808 wrote to memory of 2028	2808	7f1219cdbea1062a8db74ea4e4e349582912e8d15792fbdc202bf921a179468c.exe	91
PID 2808 wrote to memory of 2268	2808	7f1219cdbea1062a8db74ea4e4e349582912e8d15792fbdc202bf921a179468c.exe	92
PID 2808 wrote to memory of 2268	2808	7f1219cdbea1062a8db74ea4e4e349582912e8d15792fbdc202bf921a179468c.exe	92
PID 2808 wrote to memory of 4024	2808	7f1219cdbea1062a8db74ea4e4e349582912e8d15792fbdc202bf921a179468c.exe	93
PID 2808 wrote to memory of 4024	2808	7f1219cdbea1062a8db74ea4e4e349582912e8d15792fbdc202bf921a179468c.exe	93
PID 2808 wrote to memory of 2840	2808	7f1219cdbea1062a8db74ea4e4e349582912e8d15792fbdc202bf921a179468c.exe	94
PID 2808 wrote to memory of 2840	2808	7f1219cdbea1062a8db74ea4e4e349582912e8d15792fbdc202bf921a179468c.exe	94
PID 2808 wrote to memory of 2372	2808	7f1219cdbea1062a8db74ea4e4e349582912e8d15792fbdc202bf921a179468c.exe	95
PID 2808 wrote to memory of 2372	2808	7f1219cdbea1062a8db74ea4e4e349582912e8d15792fbdc202bf921a179468c.exe	95
PID 2808 wrote to memory of 3624	2808	7f1219cdbea1062a8db74ea4e4e349582912e8d15792fbdc202bf921a179468c.exe	96
PID 2808 wrote to memory of 3624	2808	7f1219cdbea1062a8db74ea4e4e349582912e8d15792fbdc202bf921a179468c.exe	96
PID 2808 wrote to memory of 3760	2808	7f1219cdbea1062a8db74ea4e4e349582912e8d15792fbdc202bf921a179468c.exe	97
PID 2808 wrote to memory of 3760	2808	7f1219cdbea1062a8db74ea4e4e349582912e8d15792fbdc202bf921a179468c.exe	97
PID 2808 wrote to memory of 1832	2808	7f1219cdbea1062a8db74ea4e4e349582912e8d15792fbdc202bf921a179468c.exe	98
PID 2808 wrote to memory of 1832	2808	7f1219cdbea1062a8db74ea4e4e349582912e8d15792fbdc202bf921a179468c.exe	98
PID 2808 wrote to memory of 3864	2808	7f1219cdbea1062a8db74ea4e4e349582912e8d15792fbdc202bf921a179468c.exe	99
PID 2808 wrote to memory of 3864	2808	7f1219cdbea1062a8db74ea4e4e349582912e8d15792fbdc202bf921a179468c.exe	99
PID 2808 wrote to memory of 1076	2808	7f1219cdbea1062a8db74ea4e4e349582912e8d15792fbdc202bf921a179468c.exe	100
PID 2808 wrote to memory of 1076	2808	7f1219cdbea1062a8db74ea4e4e349582912e8d15792fbdc202bf921a179468c.exe	100
PID 2808 wrote to memory of 744	2808	7f1219cdbea1062a8db74ea4e4e349582912e8d15792fbdc202bf921a179468c.exe	101
PID 2808 wrote to memory of 744	2808	7f1219cdbea1062a8db74ea4e4e349582912e8d15792fbdc202bf921a179468c.exe	101
PID 2808 wrote to memory of 3004	2808	7f1219cdbea1062a8db74ea4e4e349582912e8d15792fbdc202bf921a179468c.exe	102
PID 2808 wrote to memory of 3004	2808	7f1219cdbea1062a8db74ea4e4e349582912e8d15792fbdc202bf921a179468c.exe	102
PID 2808 wrote to memory of 4392	2808	7f1219cdbea1062a8db74ea4e4e349582912e8d15792fbdc202bf921a179468c.exe	103
PID 2808 wrote to memory of 4392	2808	7f1219cdbea1062a8db74ea4e4e349582912e8d15792fbdc202bf921a179468c.exe	103
PID 2808 wrote to memory of 3468	2808	7f1219cdbea1062a8db74ea4e4e349582912e8d15792fbdc202bf921a179468c.exe	104
PID 2808 wrote to memory of 3468	2808	7f1219cdbea1062a8db74ea4e4e349582912e8d15792fbdc202bf921a179468c.exe	104
PID 2808 wrote to memory of 3956	2808	7f1219cdbea1062a8db74ea4e4e349582912e8d15792fbdc202bf921a179468c.exe	105
PID 2808 wrote to memory of 3956	2808	7f1219cdbea1062a8db74ea4e4e349582912e8d15792fbdc202bf921a179468c.exe	105
PID 2808 wrote to memory of 1348	2808	7f1219cdbea1062a8db74ea4e4e349582912e8d15792fbdc202bf921a179468c.exe	106
PID 2808 wrote to memory of 1348	2808	7f1219cdbea1062a8db74ea4e4e349582912e8d15792fbdc202bf921a179468c.exe	106
PID 2808 wrote to memory of 2228	2808	7f1219cdbea1062a8db74ea4e4e349582912e8d15792fbdc202bf921a179468c.exe	107
PID 2808 wrote to memory of 2228	2808	7f1219cdbea1062a8db74ea4e4e349582912e8d15792fbdc202bf921a179468c.exe	107
PID 2808 wrote to memory of 1760	2808	7f1219cdbea1062a8db74ea4e4e349582912e8d15792fbdc202bf921a179468c.exe	108
PID 2808 wrote to memory of 1760	2808	7f1219cdbea1062a8db74ea4e4e349582912e8d15792fbdc202bf921a179468c.exe	108
PID 2808 wrote to memory of 2104	2808	7f1219cdbea1062a8db74ea4e4e349582912e8d15792fbdc202bf921a179468c.exe	109
PID 2808 wrote to memory of 2104	2808	7f1219cdbea1062a8db74ea4e4e349582912e8d15792fbdc202bf921a179468c.exe	109
PID 2808 wrote to memory of 2324	2808	7f1219cdbea1062a8db74ea4e4e349582912e8d15792fbdc202bf921a179468c.exe	110
PID 2808 wrote to memory of 2324	2808	7f1219cdbea1062a8db74ea4e4e349582912e8d15792fbdc202bf921a179468c.exe	110
PID 2808 wrote to memory of 2544	2808	7f1219cdbea1062a8db74ea4e4e349582912e8d15792fbdc202bf921a179468c.exe	111
PID 2808 wrote to memory of 2544	2808	7f1219cdbea1062a8db74ea4e4e349582912e8d15792fbdc202bf921a179468c.exe	111
PID 2808 wrote to memory of 5028	2808	7f1219cdbea1062a8db74ea4e4e349582912e8d15792fbdc202bf921a179468c.exe	112
PID 2808 wrote to memory of 5028	2808	7f1219cdbea1062a8db74ea4e4e349582912e8d15792fbdc202bf921a179468c.exe	112
PID 2808 wrote to memory of 428	2808	7f1219cdbea1062a8db74ea4e4e349582912e8d15792fbdc202bf921a179468c.exe	113
PID 2808 wrote to memory of 428	2808	7f1219cdbea1062a8db74ea4e4e349582912e8d15792fbdc202bf921a179468c.exe	113
PID 2808 wrote to memory of 904	2808	7f1219cdbea1062a8db74ea4e4e349582912e8d15792fbdc202bf921a179468c.exe	114
PID 2808 wrote to memory of 904	2808	7f1219cdbea1062a8db74ea4e4e349582912e8d15792fbdc202bf921a179468c.exe	114
PID 2808 wrote to memory of 2408	2808	7f1219cdbea1062a8db74ea4e4e349582912e8d15792fbdc202bf921a179468c.exe	115
PID 2808 wrote to memory of 2408	2808	7f1219cdbea1062a8db74ea4e4e349582912e8d15792fbdc202bf921a179468c.exe	115

C:\Users\Admin\AppData\Local\Temp\7f1219cdbea1062a8db74ea4e4e349582912e8d15792fbdc202bf921a179468c.exe
"C:\Users\Admin\AppData\Local\Temp\7f1219cdbea1062a8db74ea4e4e349582912e8d15792fbdc202bf921a179468c.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2808
- C:\Windows\System\cVdeWEs.exe
  C:\Windows\System\cVdeWEs.exe
  2⤵
  - Executes dropped EXE
  PID:4964
- C:\Windows\System\tQlxGFO.exe
  C:\Windows\System\tQlxGFO.exe
  2⤵
  - Executes dropped EXE
  PID:3704
- C:\Windows\System\nNXzsjl.exe
  C:\Windows\System\nNXzsjl.exe
  2⤵
  - Executes dropped EXE
  PID:1492
- C:\Windows\System\NXmdEWy.exe
  C:\Windows\System\NXmdEWy.exe
  2⤵
  - Executes dropped EXE
  PID:1160
- C:\Windows\System\ZjCJqPA.exe
  C:\Windows\System\ZjCJqPA.exe
  2⤵
  - Executes dropped EXE
  PID:4356
- C:\Windows\System\AtRKqVJ.exe
  C:\Windows\System\AtRKqVJ.exe
  2⤵
  - Executes dropped EXE
  PID:4780
- C:\Windows\System\cflTEHy.exe
  C:\Windows\System\cflTEHy.exe
  2⤵
  - Executes dropped EXE
  PID:224
- C:\Windows\System\DhoSVyb.exe
  C:\Windows\System\DhoSVyb.exe
  2⤵
  - Executes dropped EXE
  PID:2028
- C:\Windows\System\mLeaYdH.exe
  C:\Windows\System\mLeaYdH.exe
  2⤵
  - Executes dropped EXE
  PID:2268
- C:\Windows\System\nqANVGX.exe
  C:\Windows\System\nqANVGX.exe
  2⤵
  - Executes dropped EXE
  PID:4024
- C:\Windows\System\KhlESTK.exe
  C:\Windows\System\KhlESTK.exe
  2⤵
  - Executes dropped EXE
  PID:2840
- C:\Windows\System\puNcOJS.exe
  C:\Windows\System\puNcOJS.exe
  2⤵
  - Executes dropped EXE
  PID:2372
- C:\Windows\System\uelbiiD.exe
  C:\Windows\System\uelbiiD.exe
  2⤵
  - Executes dropped EXE
  PID:3624
- C:\Windows\System\YRLyjJB.exe
  C:\Windows\System\YRLyjJB.exe
  2⤵
  - Executes dropped EXE
  PID:3760
- C:\Windows\System\jPNVzso.exe
  C:\Windows\System\jPNVzso.exe
  2⤵
  - Executes dropped EXE
  PID:1832
- C:\Windows\System\QKLRmXk.exe
  C:\Windows\System\QKLRmXk.exe
  2⤵
  - Executes dropped EXE
  PID:3864
- C:\Windows\System\BZtkgrX.exe
  C:\Windows\System\BZtkgrX.exe
  2⤵
  - Executes dropped EXE
  PID:1076
- C:\Windows\System\XGKuVqE.exe
  C:\Windows\System\XGKuVqE.exe
  2⤵
  - Executes dropped EXE
  PID:744
- C:\Windows\System\gNVuBvt.exe
  C:\Windows\System\gNVuBvt.exe
  2⤵
  - Executes dropped EXE
  PID:3004
- C:\Windows\System\ebsoElm.exe
  C:\Windows\System\ebsoElm.exe
  2⤵
  - Executes dropped EXE
  PID:4392
- C:\Windows\System\lcjhJIO.exe
  C:\Windows\System\lcjhJIO.exe
  2⤵
  - Executes dropped EXE
  PID:3468
- C:\Windows\System\SssZcTR.exe
  C:\Windows\System\SssZcTR.exe
  2⤵
  - Executes dropped EXE
  PID:3956
- C:\Windows\System\NNsNLeO.exe
  C:\Windows\System\NNsNLeO.exe
  2⤵
  - Executes dropped EXE
  PID:1348
- C:\Windows\System\BhiFvHy.exe
  C:\Windows\System\BhiFvHy.exe
  2⤵
  - Executes dropped EXE
  PID:2228
- C:\Windows\System\aMyNpKh.exe
  C:\Windows\System\aMyNpKh.exe
  2⤵
  - Executes dropped EXE
  PID:1760
- C:\Windows\System\oFgYRfk.exe
  C:\Windows\System\oFgYRfk.exe
  2⤵
  - Executes dropped EXE
  PID:2104
- C:\Windows\System\ITCnVOT.exe
  C:\Windows\System\ITCnVOT.exe
  2⤵
  - Executes dropped EXE
  PID:2324
- C:\Windows\System\KZIjUyV.exe
  C:\Windows\System\KZIjUyV.exe
  2⤵
  - Executes dropped EXE
  PID:2544
- C:\Windows\System\FfiREfr.exe
  C:\Windows\System\FfiREfr.exe
  2⤵
  - Executes dropped EXE
  PID:5028
- C:\Windows\System\agtbSBz.exe
  C:\Windows\System\agtbSBz.exe
  2⤵
  - Executes dropped EXE
  PID:428
- C:\Windows\System\PKvPXCm.exe
  C:\Windows\System\PKvPXCm.exe
  2⤵
  - Executes dropped EXE
  PID:904
- C:\Windows\System\wnUrqmE.exe
  C:\Windows\System\wnUrqmE.exe
  2⤵
  - Executes dropped EXE
  PID:2408
- C:\Windows\System\PYGHfuu.exe
  C:\Windows\System\PYGHfuu.exe
  2⤵
  - Executes dropped EXE
  PID:1516
- C:\Windows\System\NwXoxhl.exe
  C:\Windows\System\NwXoxhl.exe
  2⤵
  - Executes dropped EXE
  PID:4724
- C:\Windows\System\rYbLuhT.exe
  C:\Windows\System\rYbLuhT.exe
  2⤵
  - Executes dropped EXE
  PID:4340
- C:\Windows\System\rxQnfrR.exe
  C:\Windows\System\rxQnfrR.exe
  2⤵
  - Executes dropped EXE
  PID:3360
- C:\Windows\System\OmHnTuy.exe
  C:\Windows\System\OmHnTuy.exe
  2⤵
  - Executes dropped EXE
  PID:2712
- C:\Windows\System\oBevhgU.exe
  C:\Windows\System\oBevhgU.exe
  2⤵
  - Executes dropped EXE
  PID:4856
- C:\Windows\System\pyhGiKp.exe
  C:\Windows\System\pyhGiKp.exe
  2⤵
  - Executes dropped EXE
  PID:3188
- C:\Windows\System\RICCdiK.exe
  C:\Windows\System\RICCdiK.exe
  2⤵
  - Executes dropped EXE
  PID:5032
- C:\Windows\System\VVoUuEB.exe
  C:\Windows\System\VVoUuEB.exe
  2⤵
  - Executes dropped EXE
  PID:4580
- C:\Windows\System\tzKVmBF.exe
  C:\Windows\System\tzKVmBF.exe
  2⤵
  - Executes dropped EXE
  PID:3300
- C:\Windows\System\sffhbmv.exe
  C:\Windows\System\sffhbmv.exe
  2⤵
  - Executes dropped EXE
  PID:2828
- C:\Windows\System\MVeSXRU.exe
  C:\Windows\System\MVeSXRU.exe
  2⤵
  - Executes dropped EXE
  PID:1064
- C:\Windows\System\RcQXxVQ.exe
  C:\Windows\System\RcQXxVQ.exe
  2⤵
  - Executes dropped EXE
  PID:1484
- C:\Windows\System\gAZJULD.exe
  C:\Windows\System\gAZJULD.exe
  2⤵
  - Executes dropped EXE
  PID:3400
- C:\Windows\System\racOlmZ.exe
  C:\Windows\System\racOlmZ.exe
  2⤵
  - Executes dropped EXE
  PID:1696
- C:\Windows\System\OZEOOJr.exe
  C:\Windows\System\OZEOOJr.exe
  2⤵
  - Executes dropped EXE
  PID:2488
- C:\Windows\System\FLXohzz.exe
  C:\Windows\System\FLXohzz.exe
  2⤵
  - Executes dropped EXE
  PID:3904
- C:\Windows\System\bvVMkTZ.exe
  C:\Windows\System\bvVMkTZ.exe
  2⤵
  - Executes dropped EXE
  PID:376
- C:\Windows\System\hvseAqv.exe
  C:\Windows\System\hvseAqv.exe
  2⤵
  - Executes dropped EXE
  PID:4588
- C:\Windows\System\izneMhc.exe
  C:\Windows\System\izneMhc.exe
  2⤵
  - Executes dropped EXE
  PID:4556
- C:\Windows\System\XDZUaMH.exe
  C:\Windows\System\XDZUaMH.exe
  2⤵
  - Executes dropped EXE
  PID:1600
- C:\Windows\System\AsOtEki.exe
  C:\Windows\System\AsOtEki.exe
  2⤵
  - Executes dropped EXE
  PID:1564
- C:\Windows\System\QeNRzCM.exe
  C:\Windows\System\QeNRzCM.exe
  2⤵
  - Executes dropped EXE
  PID:3256
- C:\Windows\System\ApSgXQx.exe
  C:\Windows\System\ApSgXQx.exe
  2⤵
  - Executes dropped EXE
  PID:3076
- C:\Windows\System\dtcRnjk.exe
  C:\Windows\System\dtcRnjk.exe
  2⤵
  - Executes dropped EXE
  PID:4768
- C:\Windows\System\BtCfcjQ.exe
  C:\Windows\System\BtCfcjQ.exe
  2⤵
  - Executes dropped EXE
  PID:1612
- C:\Windows\System\ObozsNx.exe
  C:\Windows\System\ObozsNx.exe
  2⤵
  - Executes dropped EXE
  PID:856
- C:\Windows\System\FQQIYsL.exe
  C:\Windows\System\FQQIYsL.exe
  2⤵
  - Executes dropped EXE
  PID:5016
- C:\Windows\System\RrFvinT.exe
  C:\Windows\System\RrFvinT.exe
  2⤵
  - Executes dropped EXE
  PID:2100
- C:\Windows\System\cacMnMY.exe
  C:\Windows\System\cacMnMY.exe
  2⤵
  - Executes dropped EXE
  PID:4568
- C:\Windows\System\gZPTpLR.exe
  C:\Windows\System\gZPTpLR.exe
  2⤵
  - Executes dropped EXE
  PID:4472
- C:\Windows\System\SuPtlun.exe
  C:\Windows\System\SuPtlun.exe
  2⤵
  - Executes dropped EXE
  PID:1052
- C:\Windows\System\xPWyZUh.exe
  C:\Windows\System\xPWyZUh.exe
  2⤵
  PID:4968
- C:\Windows\System\TcdSVci.exe
  C:\Windows\System\TcdSVci.exe
  2⤵
  PID:2476
- C:\Windows\System\xMjVJcc.exe
  C:\Windows\System\xMjVJcc.exe
  2⤵
  PID:3784
- C:\Windows\System\kpsiXRN.exe
  C:\Windows\System\kpsiXRN.exe
  2⤵
  PID:1512
- C:\Windows\System\ZqcLlZP.exe
  C:\Windows\System\ZqcLlZP.exe
  2⤵
  PID:4632
- C:\Windows\System\AJVGWsQ.exe
  C:\Windows\System\AJVGWsQ.exe
  2⤵
  PID:3680
- C:\Windows\System\BMKeWJU.exe
  C:\Windows\System\BMKeWJU.exe
  2⤵
  PID:4744
- C:\Windows\System\cJTLYLX.exe
  C:\Windows\System\cJTLYLX.exe
  2⤵
  PID:3288
- C:\Windows\System\pEqQQtt.exe
  C:\Windows\System\pEqQQtt.exe
  2⤵
  PID:4132
- C:\Windows\System\SGpZNHA.exe
  C:\Windows\System\SGpZNHA.exe
  2⤵
  PID:4832
- C:\Windows\System\IBFWoZW.exe
  C:\Windows\System\IBFWoZW.exe
  2⤵
  PID:1712
- C:\Windows\System\PbNtCBd.exe
  C:\Windows\System\PbNtCBd.exe
  2⤵
  PID:704
- C:\Windows\System\CESkoKf.exe
  C:\Windows\System\CESkoKf.exe
  2⤵
  PID:1792
- C:\Windows\System\JlNrbDD.exe
  C:\Windows\System\JlNrbDD.exe
  2⤵
  PID:4808
- C:\Windows\System\UrsrkUM.exe
  C:\Windows\System\UrsrkUM.exe
  2⤵
  PID:1376
- C:\Windows\System\HiUfnlf.exe
  C:\Windows\System\HiUfnlf.exe
  2⤵
  PID:1596
- C:\Windows\System\fBlMvxl.exe
  C:\Windows\System\fBlMvxl.exe
  2⤵
  PID:1236
- C:\Windows\System\sQQCuXL.exe
  C:\Windows\System\sQQCuXL.exe
  2⤵
  PID:5064
- C:\Windows\System\CspaCxe.exe
  C:\Windows\System\CspaCxe.exe
  2⤵
  PID:2040
- C:\Windows\System\UVyfVws.exe
  C:\Windows\System\UVyfVws.exe
  2⤵
  PID:804
- C:\Windows\System\oXVhNfN.exe
  C:\Windows\System\oXVhNfN.exe
  2⤵
  PID:4728
- C:\Windows\System\uqYQXgq.exe
  C:\Windows\System\uqYQXgq.exe
  2⤵
  PID:4300
- C:\Windows\System\nQRoFEL.exe
  C:\Windows\System\nQRoFEL.exe
  2⤵
  PID:388
- C:\Windows\System\BPeNgCb.exe
  C:\Windows\System\BPeNgCb.exe
  2⤵
  PID:4272
- C:\Windows\System\vuKnfxW.exe
  C:\Windows\System\vuKnfxW.exe
  2⤵
  PID:4460
- C:\Windows\System\ncTcgHO.exe
  C:\Windows\System\ncTcgHO.exe
  2⤵
  PID:3204
- C:\Windows\System\mageCrA.exe
  C:\Windows\System\mageCrA.exe
  2⤵
  PID:4912
- C:\Windows\System\dsIIYJi.exe
  C:\Windows\System\dsIIYJi.exe
  2⤵
  PID:1424
- C:\Windows\System\IPMekGr.exe
  C:\Windows\System\IPMekGr.exe
  2⤵
  PID:2016
- C:\Windows\System\ZvQRemU.exe
  C:\Windows\System\ZvQRemU.exe
  2⤵
  PID:4208
- C:\Windows\System\hglYvxI.exe
  C:\Windows\System\hglYvxI.exe
  2⤵
  PID:4228
- C:\Windows\System\KAdcQWv.exe
  C:\Windows\System\KAdcQWv.exe
  2⤵
  PID:4388
- C:\Windows\System\wfHXzgo.exe
  C:\Windows\System\wfHXzgo.exe
  2⤵
  PID:4824
- C:\Windows\System\XWMWWLq.exe
  C:\Windows\System\XWMWWLq.exe
  2⤵
  PID:1844
- C:\Windows\System\lpIKtOg.exe
  C:\Windows\System\lpIKtOg.exe
  2⤵
  PID:2768
- C:\Windows\System\WJpMfQZ.exe
  C:\Windows\System\WJpMfQZ.exe
  2⤵
  PID:2396
- C:\Windows\System\Rpocyle.exe
  C:\Windows\System\Rpocyle.exe
  2⤵
  PID:5024
- C:\Windows\System\HmPHVhJ.exe
  C:\Windows\System\HmPHVhJ.exe
  2⤵
  PID:3100
- C:\Windows\System\LKkuyNq.exe
  C:\Windows\System\LKkuyNq.exe
  2⤵
  PID:2536
- C:\Windows\System\eyiPZjR.exe
  C:\Windows\System\eyiPZjR.exe
  2⤵
  PID:1060
- C:\Windows\System\GEWEeIa.exe
  C:\Windows\System\GEWEeIa.exe
  2⤵
  PID:4828
- C:\Windows\System\anZwufW.exe
  C:\Windows\System\anZwufW.exe
  2⤵
  PID:2300
- C:\Windows\System\VoWmNVH.exe
  C:\Windows\System\VoWmNVH.exe
  2⤵
  PID:1996
- C:\Windows\System\MFJhqpq.exe
  C:\Windows\System\MFJhqpq.exe
  2⤵
  PID:2796
- C:\Windows\System\CtpYoJu.exe
  C:\Windows\System\CtpYoJu.exe
  2⤵
  PID:4260
- C:\Windows\System\uoZQCtJ.exe
  C:\Windows\System\uoZQCtJ.exe
  2⤵
  PID:5092
- C:\Windows\System\XEXJLZi.exe
  C:\Windows\System\XEXJLZi.exe
  2⤵
  PID:4532
- C:\Windows\System\oktPuZP.exe
  C:\Windows\System\oktPuZP.exe
  2⤵
  PID:5148
- C:\Windows\System\HFXzRfi.exe
  C:\Windows\System\HFXzRfi.exe
  2⤵
  PID:5168
- C:\Windows\System\tkcJHnK.exe
  C:\Windows\System\tkcJHnK.exe
  2⤵
  PID:5192
- C:\Windows\System\UUJiDkG.exe
  C:\Windows\System\UUJiDkG.exe
  2⤵
  PID:5224
- C:\Windows\System\AyBUZLL.exe
  C:\Windows\System\AyBUZLL.exe
  2⤵
  PID:5256
- C:\Windows\System\YqeHKBe.exe
  C:\Windows\System\YqeHKBe.exe
  2⤵
  PID:5276
- C:\Windows\System\LqxPzzk.exe
  C:\Windows\System\LqxPzzk.exe
  2⤵
  PID:5312
- C:\Windows\System\nBlVzwb.exe
  C:\Windows\System\nBlVzwb.exe
  2⤵
  PID:5332
- C:\Windows\System\QqbZtfT.exe
  C:\Windows\System\QqbZtfT.exe
  2⤵
  PID:5360
- C:\Windows\System\obmSveT.exe
  C:\Windows\System\obmSveT.exe
  2⤵
  PID:5384
- C:\Windows\System\HwYmbgq.exe
  C:\Windows\System\HwYmbgq.exe
  2⤵
  PID:5420
- C:\Windows\System\bPWQovv.exe
  C:\Windows\System\bPWQovv.exe
  2⤵
  PID:5448
- C:\Windows\System\GHbjAMD.exe
  C:\Windows\System\GHbjAMD.exe
  2⤵
  PID:5484
- C:\Windows\System\IDFUgZl.exe
  C:\Windows\System\IDFUgZl.exe
  2⤵
  PID:5528
- C:\Windows\System\QUtaOlk.exe
  C:\Windows\System\QUtaOlk.exe
  2⤵
  PID:5544
- C:\Windows\System\RshwanY.exe
  C:\Windows\System\RshwanY.exe
  2⤵
  PID:5564
- C:\Windows\System\uTDgzQd.exe
  C:\Windows\System\uTDgzQd.exe
  2⤵
  PID:5600
- C:\Windows\System\SYSuKJs.exe
  C:\Windows\System\SYSuKJs.exe
  2⤵
  PID:5616
- C:\Windows\System\iUMlgZB.exe
  C:\Windows\System\iUMlgZB.exe
  2⤵
  PID:5648
- C:\Windows\System\HjKFaJz.exe
  C:\Windows\System\HjKFaJz.exe
  2⤵
  PID:5676
- C:\Windows\System\blFrQRq.exe
  C:\Windows\System\blFrQRq.exe
  2⤵
  PID:5700
- C:\Windows\System\uVTePBH.exe
  C:\Windows\System\uVTePBH.exe
  2⤵
  PID:5728
- C:\Windows\System\GPiOTfG.exe
  C:\Windows\System\GPiOTfG.exe
  2⤵
  PID:5764
- C:\Windows\System\VAkkMoM.exe
  C:\Windows\System\VAkkMoM.exe
  2⤵
  PID:5788
- C:\Windows\System\BegYWSg.exe
  C:\Windows\System\BegYWSg.exe
  2⤵
  PID:5820
- C:\Windows\System\EqCHTBd.exe
  C:\Windows\System\EqCHTBd.exe
  2⤵
  PID:5840
- C:\Windows\System\quPmAGN.exe
  C:\Windows\System\quPmAGN.exe
  2⤵
  PID:5868
- C:\Windows\System\jGzmZdC.exe
  C:\Windows\System\jGzmZdC.exe
  2⤵
  PID:5904
- C:\Windows\System\rrVqgKO.exe
  C:\Windows\System\rrVqgKO.exe
  2⤵
  PID:5924
- C:\Windows\System\jgFzVhT.exe
  C:\Windows\System\jgFzVhT.exe
  2⤵
  PID:5952
- C:\Windows\System\oMwYkRw.exe
  C:\Windows\System\oMwYkRw.exe
  2⤵
  PID:5968
- C:\Windows\System\wavuyoL.exe
  C:\Windows\System\wavuyoL.exe
  2⤵
  PID:5996
- C:\Windows\System\fKLDrzb.exe
  C:\Windows\System\fKLDrzb.exe
  2⤵
  PID:6028
- C:\Windows\System\UINyPcy.exe
  C:\Windows\System\UINyPcy.exe
  2⤵
  PID:6064
- C:\Windows\System\aTnNGHe.exe
  C:\Windows\System\aTnNGHe.exe
  2⤵
  PID:6088
- C:\Windows\System\CXjvCmL.exe
  C:\Windows\System\CXjvCmL.exe
  2⤵
  PID:6112
- C:\Windows\System\KJhIDgN.exe
  C:\Windows\System\KJhIDgN.exe
  2⤵
  PID:5124
- C:\Windows\System\PkBTUFb.exe
  C:\Windows\System\PkBTUFb.exe
  2⤵
  PID:5144
- C:\Windows\System\eZrvfyV.exe
  C:\Windows\System\eZrvfyV.exe
  2⤵
  PID:5232
- C:\Windows\System\cHLCYex.exe
  C:\Windows\System\cHLCYex.exe
  2⤵
  PID:5320
- C:\Windows\System\eaVeAxz.exe
  C:\Windows\System\eaVeAxz.exe
  2⤵
  PID:5348
- C:\Windows\System\DUbRVoo.exe
  C:\Windows\System\DUbRVoo.exe
  2⤵
  PID:5432
- C:\Windows\System\EUEqGao.exe
  C:\Windows\System\EUEqGao.exe
  2⤵
  PID:5480
- C:\Windows\System\CadKVHx.exe
  C:\Windows\System\CadKVHx.exe
  2⤵
  PID:5588
- C:\Windows\System\jXARGBW.exe
  C:\Windows\System\jXARGBW.exe
  2⤵
  PID:5640
- C:\Windows\System\JBILDEb.exe
  C:\Windows\System\JBILDEb.exe
  2⤵
  PID:5672
- C:\Windows\System\GRPRLrY.exe
  C:\Windows\System\GRPRLrY.exe
  2⤵
  PID:5740
- C:\Windows\System\phbNwrU.exe
  C:\Windows\System\phbNwrU.exe
  2⤵
  PID:5796
- C:\Windows\System\QdpuhdW.exe
  C:\Windows\System\QdpuhdW.exe
  2⤵
  PID:5892
- C:\Windows\System\wGgbcHY.exe
  C:\Windows\System\wGgbcHY.exe
  2⤵
  PID:5988
- C:\Windows\System\zMsGDcH.exe
  C:\Windows\System\zMsGDcH.exe
  2⤵
  PID:6048
- C:\Windows\System\cncrgqN.exe
  C:\Windows\System\cncrgqN.exe
  2⤵
  PID:6096
- C:\Windows\System\YrzJUmH.exe
  C:\Windows\System\YrzJUmH.exe
  2⤵
  PID:6120
- C:\Windows\System\ForyIqq.exe
  C:\Windows\System\ForyIqq.exe
  2⤵
  PID:5204
- C:\Windows\System\NRfqTrj.exe
  C:\Windows\System\NRfqTrj.exe
  2⤵
  PID:5344
- C:\Windows\System\VVECkkB.exe
  C:\Windows\System\VVECkkB.exe
  2⤵
  PID:5608
- C:\Windows\System\wBwCdiT.exe
  C:\Windows\System\wBwCdiT.exe
  2⤵
  PID:5660
- C:\Windows\System\iCRoTpd.exe
  C:\Windows\System\iCRoTpd.exe
  2⤵
  PID:5836
- C:\Windows\System\dnXMdoj.exe
  C:\Windows\System\dnXMdoj.exe
  2⤵
  PID:6040
- C:\Windows\System\DVkIZOT.exe
  C:\Windows\System\DVkIZOT.exe
  2⤵
  PID:6140
- C:\Windows\System\uAbQHKG.exe
  C:\Windows\System\uAbQHKG.exe
  2⤵
  PID:5540
- C:\Windows\System\PvVrTTA.exe
  C:\Windows\System\PvVrTTA.exe
  2⤵
  PID:5980
- C:\Windows\System\ziCjyoZ.exe
  C:\Windows\System\ziCjyoZ.exe
  2⤵
  PID:6008
- C:\Windows\System\iYeLlQW.exe
  C:\Windows\System\iYeLlQW.exe
  2⤵
  PID:5268
- C:\Windows\System\ndLmybj.exe
  C:\Windows\System\ndLmybj.exe
  2⤵
  PID:6172
- C:\Windows\System\kBXKRwM.exe
  C:\Windows\System\kBXKRwM.exe
  2⤵
  PID:6188
- C:\Windows\System\YJNcVbY.exe
  C:\Windows\System\YJNcVbY.exe
  2⤵
  PID:6224
- C:\Windows\System\EyHVJAV.exe
  C:\Windows\System\EyHVJAV.exe
  2⤵
  PID:6256
- C:\Windows\System\CPANQUp.exe
  C:\Windows\System\CPANQUp.exe
  2⤵
  PID:6284
- C:\Windows\System\WfmLoMd.exe
  C:\Windows\System\WfmLoMd.exe
  2⤵
  PID:6316
- C:\Windows\System\mPBCEjg.exe
  C:\Windows\System\mPBCEjg.exe
  2⤵
  PID:6336
- C:\Windows\System\GeohAyZ.exe
  C:\Windows\System\GeohAyZ.exe
  2⤵
  PID:6356
- C:\Windows\System\irXvDMC.exe
  C:\Windows\System\irXvDMC.exe
  2⤵
  PID:6388
- C:\Windows\System\KAYaweU.exe
  C:\Windows\System\KAYaweU.exe
  2⤵
  PID:6420
- C:\Windows\System\CYwHVVw.exe
  C:\Windows\System\CYwHVVw.exe
  2⤵
  PID:6448
- C:\Windows\System\NHWHgYo.exe
  C:\Windows\System\NHWHgYo.exe
  2⤵
  PID:6472
- C:\Windows\System\CRlRsQW.exe
  C:\Windows\System\CRlRsQW.exe
  2⤵
  PID:6500
- C:\Windows\System\NuObMiH.exe
  C:\Windows\System\NuObMiH.exe
  2⤵
  PID:6528
- C:\Windows\System\vNuduun.exe
  C:\Windows\System\vNuduun.exe
  2⤵
  PID:6552
- C:\Windows\System\JnepodZ.exe
  C:\Windows\System\JnepodZ.exe
  2⤵
  PID:6584
- C:\Windows\System\YguljUA.exe
  C:\Windows\System\YguljUA.exe
  2⤵
  PID:6620
- C:\Windows\System\twDykOB.exe
  C:\Windows\System\twDykOB.exe
  2⤵
  PID:6644
- C:\Windows\System\WugOCBg.exe
  C:\Windows\System\WugOCBg.exe
  2⤵
  PID:6672
- C:\Windows\System\ijefaQK.exe
  C:\Windows\System\ijefaQK.exe
  2⤵
  PID:6704
- C:\Windows\System\NZHQSJt.exe
  C:\Windows\System\NZHQSJt.exe
  2⤵
  PID:6728
- C:\Windows\System\JEtnoUC.exe
  C:\Windows\System\JEtnoUC.exe
  2⤵
  PID:6756
- C:\Windows\System\rwftFHl.exe
  C:\Windows\System\rwftFHl.exe
  2⤵
  PID:6796
- C:\Windows\System\PSRVIEm.exe
  C:\Windows\System\PSRVIEm.exe
  2⤵
  PID:6828
- C:\Windows\System\gEjMLxk.exe
  C:\Windows\System\gEjMLxk.exe
  2⤵
  PID:6864
- C:\Windows\System\mISoSuu.exe
  C:\Windows\System\mISoSuu.exe
  2⤵
  PID:6884
- C:\Windows\System\AvwhbUe.exe
  C:\Windows\System\AvwhbUe.exe
  2⤵
  PID:6908
- C:\Windows\System\rfHgRgH.exe
  C:\Windows\System\rfHgRgH.exe
  2⤵
  PID:6936
- C:\Windows\System\btyGjXa.exe
  C:\Windows\System\btyGjXa.exe
  2⤵
  PID:6964
- C:\Windows\System\hXKjGSD.exe
  C:\Windows\System\hXKjGSD.exe
  2⤵
  PID:6992
- C:\Windows\System\PebQnMj.exe
  C:\Windows\System\PebQnMj.exe
  2⤵
  PID:7020
- C:\Windows\System\HsBPlKv.exe
  C:\Windows\System\HsBPlKv.exe
  2⤵
  PID:7048
- C:\Windows\System\pCIEaun.exe
  C:\Windows\System\pCIEaun.exe
  2⤵
  PID:7076
- C:\Windows\System\RFFVUDt.exe
  C:\Windows\System\RFFVUDt.exe
  2⤵
  PID:7100
- C:\Windows\System\ayJFKuS.exe
  C:\Windows\System\ayJFKuS.exe
  2⤵
  PID:7124
- C:\Windows\System\uEriOCg.exe
  C:\Windows\System\uEriOCg.exe
  2⤵
  PID:7148
- C:\Windows\System\jMXaqMk.exe
  C:\Windows\System\jMXaqMk.exe
  2⤵
  PID:6076
- C:\Windows\System\gwwrCOe.exe
  C:\Windows\System\gwwrCOe.exe
  2⤵
  PID:6184
- C:\Windows\System\AYfBAce.exe
  C:\Windows\System\AYfBAce.exe
  2⤵
  PID:6212
- C:\Windows\System\tsJDwga.exe
  C:\Windows\System\tsJDwga.exe
  2⤵
  PID:6300
- C:\Windows\System\AqSFOKE.exe
  C:\Windows\System\AqSFOKE.exe
  2⤵
  PID:6368
- C:\Windows\System\XsjLQUY.exe
  C:\Windows\System\XsjLQUY.exe
  2⤵
  PID:6384
- C:\Windows\System\aUstfsO.exe
  C:\Windows\System\aUstfsO.exe
  2⤵
  PID:6496
- C:\Windows\System\LvUEYVj.exe
  C:\Windows\System\LvUEYVj.exe
  2⤵
  PID:6548
- C:\Windows\System\xENhJFU.exe
  C:\Windows\System\xENhJFU.exe
  2⤵
  PID:6668
- C:\Windows\System\KjmLZkT.exe
  C:\Windows\System\KjmLZkT.exe
  2⤵
  PID:6724
- C:\Windows\System\aJiqOFl.exe
  C:\Windows\System\aJiqOFl.exe
  2⤵
  PID:6748
- C:\Windows\System\hRcGWHy.exe
  C:\Windows\System\hRcGWHy.exe
  2⤵
  PID:6872
- C:\Windows\System\wXfOVrB.exe
  C:\Windows\System\wXfOVrB.exe
  2⤵
  PID:6928
- C:\Windows\System\LbleGmD.exe
  C:\Windows\System\LbleGmD.exe
  2⤵
  PID:6988
- C:\Windows\System\XcRoyfJ.exe
  C:\Windows\System\XcRoyfJ.exe
  2⤵
  PID:7088
- C:\Windows\System\UNdBpgS.exe
  C:\Windows\System\UNdBpgS.exe
  2⤵
  PID:7096
- C:\Windows\System\eLVtiIw.exe
  C:\Windows\System\eLVtiIw.exe
  2⤵
  PID:7160
- C:\Windows\System\KUPScCF.exe
  C:\Windows\System\KUPScCF.exe
  2⤵
  PID:6200
- C:\Windows\System\aoIBFRE.exe
  C:\Windows\System\aoIBFRE.exe
  2⤵
  PID:6264
- C:\Windows\System\xPQRiQe.exe
  C:\Windows\System\xPQRiQe.exe
  2⤵
  PID:6596
- C:\Windows\System\slpuPvu.exe
  C:\Windows\System\slpuPvu.exe
  2⤵
  PID:6776
- C:\Windows\System\CHfsMeK.exe
  C:\Windows\System\CHfsMeK.exe
  2⤵
  PID:6900
- C:\Windows\System\OALOLjN.exe
  C:\Windows\System\OALOLjN.exe
  2⤵
  PID:7000
- C:\Windows\System\OyztImU.exe
  C:\Windows\System\OyztImU.exe
  2⤵
  PID:5816
- C:\Windows\System\zKNGIMF.exe
  C:\Windows\System\zKNGIMF.exe
  2⤵
  PID:7144
- C:\Windows\System\ahPEdAS.exe
  C:\Windows\System\ahPEdAS.exe
  2⤵
  PID:6744
- C:\Windows\System\DvHFvfT.exe
  C:\Windows\System\DvHFvfT.exe
  2⤵
  PID:6784
- C:\Windows\System\FTtAhnA.exe
  C:\Windows\System\FTtAhnA.exe
  2⤵
  PID:6376
- C:\Windows\System\nCrGdUD.exe
  C:\Windows\System\nCrGdUD.exe
  2⤵
  PID:7192
- C:\Windows\System\QIDQPto.exe
  C:\Windows\System\QIDQPto.exe
  2⤵
  PID:7224
- C:\Windows\System\UKIZqNp.exe
  C:\Windows\System\UKIZqNp.exe
  2⤵
  PID:7252
- C:\Windows\System\ZJAIOPs.exe
  C:\Windows\System\ZJAIOPs.exe
  2⤵
  PID:7280
- C:\Windows\System\KAnPMHF.exe
  C:\Windows\System\KAnPMHF.exe
  2⤵
  PID:7312
- C:\Windows\System\FkXSGCz.exe
  C:\Windows\System\FkXSGCz.exe
  2⤵
  PID:7340
- C:\Windows\System\UPdkpAu.exe
  C:\Windows\System\UPdkpAu.exe
  2⤵
  PID:7364
- C:\Windows\System\gbAgvht.exe
  C:\Windows\System\gbAgvht.exe
  2⤵
  PID:7388
- C:\Windows\System\MxVyrVx.exe
  C:\Windows\System\MxVyrVx.exe
  2⤵
  PID:7420
- C:\Windows\System\zDLtiWI.exe
  C:\Windows\System\zDLtiWI.exe
  2⤵
  PID:7436
- C:\Windows\System\TQDtmkG.exe
  C:\Windows\System\TQDtmkG.exe
  2⤵
  PID:7464
- C:\Windows\System\IUEMSAC.exe
  C:\Windows\System\IUEMSAC.exe
  2⤵
  PID:7500
- C:\Windows\System\NtzriFH.exe
  C:\Windows\System\NtzriFH.exe
  2⤵
  PID:7520
- C:\Windows\System\DbtfYOZ.exe
  C:\Windows\System\DbtfYOZ.exe
  2⤵
  PID:7548
- C:\Windows\System\xYjfbtv.exe
  C:\Windows\System\xYjfbtv.exe
  2⤵
  PID:7564
- C:\Windows\System\wTkVbaQ.exe
  C:\Windows\System\wTkVbaQ.exe
  2⤵
  PID:7596
- C:\Windows\System\OOzUrjL.exe
  C:\Windows\System\OOzUrjL.exe
  2⤵
  PID:7628
- C:\Windows\System\UXYhjXZ.exe
  C:\Windows\System\UXYhjXZ.exe
  2⤵
  PID:7656
- C:\Windows\System\vfOIboI.exe
  C:\Windows\System\vfOIboI.exe
  2⤵
  PID:7680
- C:\Windows\System\DQAKVGa.exe
  C:\Windows\System\DQAKVGa.exe
  2⤵
  PID:7712
- C:\Windows\System\XPhIxVf.exe
  C:\Windows\System\XPhIxVf.exe
  2⤵
  PID:7744
- C:\Windows\System\ksVSgqW.exe
  C:\Windows\System\ksVSgqW.exe
  2⤵
  PID:7772
- C:\Windows\System\EgQQkAr.exe
  C:\Windows\System\EgQQkAr.exe
  2⤵
  PID:7808
- C:\Windows\System\hvjPxIS.exe
  C:\Windows\System\hvjPxIS.exe
  2⤵
  PID:7836
- C:\Windows\System\AGtBbBp.exe
  C:\Windows\System\AGtBbBp.exe
  2⤵
  PID:7868
- C:\Windows\System\WMHSmQe.exe
  C:\Windows\System\WMHSmQe.exe
  2⤵
  PID:7900
- C:\Windows\System\qMnmspL.exe
  C:\Windows\System\qMnmspL.exe
  2⤵
  PID:7916
- C:\Windows\System\ZBOnsRf.exe
  C:\Windows\System\ZBOnsRf.exe
  2⤵
  PID:7940
- C:\Windows\System\GueyCdf.exe
  C:\Windows\System\GueyCdf.exe
  2⤵
  PID:7960
- C:\Windows\System\tIBERGD.exe
  C:\Windows\System\tIBERGD.exe
  2⤵
  PID:7992
- C:\Windows\System\tiDYqYJ.exe
  C:\Windows\System\tiDYqYJ.exe
  2⤵
  PID:8016
- C:\Windows\System\tlptxsy.exe
  C:\Windows\System\tlptxsy.exe
  2⤵
  PID:8048
- C:\Windows\System\MAwjNpP.exe
  C:\Windows\System\MAwjNpP.exe
  2⤵
  PID:8080
- C:\Windows\System\ANRjSDC.exe
  C:\Windows\System\ANRjSDC.exe
  2⤵
  PID:8112
- C:\Windows\System\ayRqxLW.exe
  C:\Windows\System\ayRqxLW.exe
  2⤵
  PID:8132
- C:\Windows\System\sFZTBYW.exe
  C:\Windows\System\sFZTBYW.exe
  2⤵
  PID:8164
- C:\Windows\System\LqqXCBF.exe
  C:\Windows\System\LqqXCBF.exe
  2⤵
  PID:8188
- C:\Windows\System\pyQIfxl.exe
  C:\Windows\System\pyQIfxl.exe
  2⤵
  PID:6488
- C:\Windows\System\dhXOGrZ.exe
  C:\Windows\System\dhXOGrZ.exe
  2⤵
  PID:7204
- C:\Windows\System\VjyUdYV.exe
  C:\Windows\System\VjyUdYV.exe
  2⤵
  PID:7184
- C:\Windows\System\TyZWwdp.exe
  C:\Windows\System\TyZWwdp.exe
  2⤵
  PID:7236
- C:\Windows\System\ZTjsxhj.exe
  C:\Windows\System\ZTjsxhj.exe
  2⤵
  PID:7416
- C:\Windows\System\ZQJyEUU.exe
  C:\Windows\System\ZQJyEUU.exe
  2⤵
  PID:7376
- C:\Windows\System\wURfimY.exe
  C:\Windows\System\wURfimY.exe
  2⤵
  PID:7404
- C:\Windows\System\lXlQBiY.exe
  C:\Windows\System\lXlQBiY.exe
  2⤵
  PID:7540
- C:\Windows\System\NyzMKvD.exe
  C:\Windows\System\NyzMKvD.exe
  2⤵
  PID:7636
- C:\Windows\System\OMZueMV.exe
  C:\Windows\System\OMZueMV.exe
  2⤵
  PID:7688
- C:\Windows\System\QTfKarH.exe
  C:\Windows\System\QTfKarH.exe
  2⤵
  PID:7816
- C:\Windows\System\dCrvYzY.exe
  C:\Windows\System\dCrvYzY.exe
  2⤵
  PID:7828
- C:\Windows\System\dbSleaD.exe
  C:\Windows\System\dbSleaD.exe
  2⤵
  PID:7892
- C:\Windows\System\BYUvcNi.exe
  C:\Windows\System\BYUvcNi.exe
  2⤵
  PID:7928
- C:\Windows\System\VkcZJVg.exe
  C:\Windows\System\VkcZJVg.exe
  2⤵
  PID:7956
- C:\Windows\System\DrvlyPS.exe
  C:\Windows\System\DrvlyPS.exe
  2⤵
  PID:8124
- C:\Windows\System\YFmYkRp.exe
  C:\Windows\System\YFmYkRp.exe
  2⤵
  PID:7180
- C:\Windows\System\SMZscwe.exe
  C:\Windows\System\SMZscwe.exe
  2⤵
  PID:7396
- C:\Windows\System\UjfVBge.exe
  C:\Windows\System\UjfVBge.exe
  2⤵
  PID:7480
- C:\Windows\System\ctfQdzF.exe
  C:\Windows\System\ctfQdzF.exe
  2⤵
  PID:7676
- C:\Windows\System\waJDnwd.exe
  C:\Windows\System\waJDnwd.exe
  2⤵
  PID:7604
- C:\Windows\System\budRAhS.exe
  C:\Windows\System\budRAhS.exe
  2⤵
  PID:7888
- C:\Windows\System\CpojHhN.exe
  C:\Windows\System\CpojHhN.exe
  2⤵
  PID:8036
- C:\Windows\System\XKogaCp.exe
  C:\Windows\System\XKogaCp.exe
  2⤵
  PID:7984
- C:\Windows\System\yYfnGnI.exe
  C:\Windows\System\yYfnGnI.exe
  2⤵
  PID:7432
- C:\Windows\System\nyJHVqn.exe
  C:\Windows\System\nyJHVqn.exe
  2⤵
  PID:7456
- C:\Windows\System\qNgRinT.exe
  C:\Windows\System\qNgRinT.exe
  2⤵
  PID:8184
- C:\Windows\System\oUCoTkT.exe
  C:\Windows\System\oUCoTkT.exe
  2⤵
  PID:8216
- C:\Windows\System\HNPGKrW.exe
  C:\Windows\System\HNPGKrW.exe
  2⤵
  PID:8248
- C:\Windows\System\lQhQStD.exe
  C:\Windows\System\lQhQStD.exe
  2⤵
  PID:8272
- C:\Windows\System\wkzaaxY.exe
  C:\Windows\System\wkzaaxY.exe
  2⤵
  PID:8304
- C:\Windows\System\yGGfsSf.exe
  C:\Windows\System\yGGfsSf.exe
  2⤵
  PID:8324
- C:\Windows\System\BibOGHe.exe
  C:\Windows\System\BibOGHe.exe
  2⤵
  PID:8360
- C:\Windows\System\ZKJVYxC.exe
  C:\Windows\System\ZKJVYxC.exe
  2⤵
  PID:8392
- C:\Windows\System\OlczzIi.exe
  C:\Windows\System\OlczzIi.exe
  2⤵
  PID:8412
- C:\Windows\System\soVcHgg.exe
  C:\Windows\System\soVcHgg.exe
  2⤵
  PID:8448
- C:\Windows\System\fRRQZjx.exe
  C:\Windows\System\fRRQZjx.exe
  2⤵
  PID:8476
- C:\Windows\System\MJXhFKx.exe
  C:\Windows\System\MJXhFKx.exe
  2⤵
  PID:8504
- C:\Windows\System\YiQWfef.exe
  C:\Windows\System\YiQWfef.exe
  2⤵
  PID:8528
- C:\Windows\System\HwmNsee.exe
  C:\Windows\System\HwmNsee.exe
  2⤵
  PID:8556
- C:\Windows\System\ygzVjkv.exe
  C:\Windows\System\ygzVjkv.exe
  2⤵
  PID:8584
- C:\Windows\System\iiIhNwm.exe
  C:\Windows\System\iiIhNwm.exe
  2⤵
  PID:8608
- C:\Windows\System\rLjpzRC.exe
  C:\Windows\System\rLjpzRC.exe
  2⤵
  PID:8632
- C:\Windows\System\CZKIhom.exe
  C:\Windows\System\CZKIhom.exe
  2⤵
  PID:8656
- C:\Windows\System\WYisrie.exe
  C:\Windows\System\WYisrie.exe
  2⤵
  PID:8680
- C:\Windows\System\CenIHpI.exe
  C:\Windows\System\CenIHpI.exe
  2⤵
  PID:8700
- C:\Windows\System\VplrbaZ.exe
  C:\Windows\System\VplrbaZ.exe
  2⤵
  PID:8724
- C:\Windows\System\fHLcxne.exe
  C:\Windows\System\fHLcxne.exe
  2⤵
  PID:8752
- C:\Windows\System\hNzGYai.exe
  C:\Windows\System\hNzGYai.exe
  2⤵
  PID:8784
- C:\Windows\System\UmNCMZb.exe
  C:\Windows\System\UmNCMZb.exe
  2⤵
  PID:8816
- C:\Windows\System\GSZzzIF.exe
  C:\Windows\System\GSZzzIF.exe
  2⤵
  PID:8848
- C:\Windows\System\pkQcqhO.exe
  C:\Windows\System\pkQcqhO.exe
  2⤵
  PID:8868
- C:\Windows\System\KizHYel.exe
  C:\Windows\System\KizHYel.exe
  2⤵
  PID:8896
- C:\Windows\System\eiEYhoJ.exe
  C:\Windows\System\eiEYhoJ.exe
  2⤵
  PID:8928
- C:\Windows\System\QoKQqFk.exe
  C:\Windows\System\QoKQqFk.exe
  2⤵
  PID:8956
- C:\Windows\System\UeLuPMz.exe
  C:\Windows\System\UeLuPMz.exe
  2⤵
  PID:8980
- C:\Windows\System\BxiQANv.exe
  C:\Windows\System\BxiQANv.exe
  2⤵
  PID:9008
- C:\Windows\System\eAeEKwE.exe
  C:\Windows\System\eAeEKwE.exe
  2⤵
  PID:9036
- C:\Windows\System\OIUaTeb.exe
  C:\Windows\System\OIUaTeb.exe
  2⤵
  PID:9060
- C:\Windows\System\sKhIGqr.exe
  C:\Windows\System\sKhIGqr.exe
  2⤵
  PID:9088
- C:\Windows\System\boWtafl.exe
  C:\Windows\System\boWtafl.exe
  2⤵
  PID:9116
- C:\Windows\System\MCXlnzd.exe
  C:\Windows\System\MCXlnzd.exe
  2⤵
  PID:9148
- C:\Windows\System\rKBVXBb.exe
  C:\Windows\System\rKBVXBb.exe
  2⤵
  PID:9176
- C:\Windows\System\aCJwbuo.exe
  C:\Windows\System\aCJwbuo.exe
  2⤵
  PID:9204
- C:\Windows\System\kMPHTTM.exe
  C:\Windows\System\kMPHTTM.exe
  2⤵
  PID:7240
- C:\Windows\System\idXIuSS.exe
  C:\Windows\System\idXIuSS.exe
  2⤵
  PID:7696
- C:\Windows\System\zRYdvfW.exe
  C:\Windows\System\zRYdvfW.exe
  2⤵
  PID:8348
- C:\Windows\System\TnCYRvp.exe
  C:\Windows\System\TnCYRvp.exe
  2⤵
  PID:8244
- C:\Windows\System\bkIpnOj.exe
  C:\Windows\System\bkIpnOj.exe
  2⤵
  PID:8440
- C:\Windows\System\tyNNLzz.exe
  C:\Windows\System\tyNNLzz.exe
  2⤵
  PID:8500
- C:\Windows\System\rKkpbJm.exe
  C:\Windows\System\rKkpbJm.exe
  2⤵
  PID:8472
- C:\Windows\System\VuiIbEK.exe
  C:\Windows\System\VuiIbEK.exe
  2⤵
  PID:8640
- C:\Windows\System\UVtXvUo.exe
  C:\Windows\System\UVtXvUo.exe
  2⤵
  PID:8768
- C:\Windows\System\FZERejb.exe
  C:\Windows\System\FZERejb.exe
  2⤵
  PID:8812
- C:\Windows\System\FcRiqgJ.exe
  C:\Windows\System\FcRiqgJ.exe
  2⤵
  PID:8712
- C:\Windows\System\bVdbOqb.exe
  C:\Windows\System\bVdbOqb.exe
  2⤵
  PID:8748
- C:\Windows\System\epjoeLO.exe
  C:\Windows\System\epjoeLO.exe
  2⤵
  PID:8964
- C:\Windows\System\oAejeuk.exe
  C:\Windows\System\oAejeuk.exe
  2⤵
  PID:8908
- C:\Windows\System\Xkujxdt.exe
  C:\Windows\System\Xkujxdt.exe
  2⤵
  PID:9076
- C:\Windows\System\TslZarf.exe
  C:\Windows\System\TslZarf.exe
  2⤵
  PID:9052
- C:\Windows\System\bKrbDXB.exe
  C:\Windows\System\bKrbDXB.exe
  2⤵
  PID:9132
- C:\Windows\System\VEaCNQb.exe
  C:\Windows\System\VEaCNQb.exe
  2⤵
  PID:9184
- C:\Windows\System\zGXrGNf.exe
  C:\Windows\System\zGXrGNf.exe
  2⤵
  PID:8436
- C:\Windows\System\CaQMeyU.exe
  C:\Windows\System\CaQMeyU.exe
  2⤵
  PID:8092
- C:\Windows\System\KMUmXCK.exe
  C:\Windows\System\KMUmXCK.exe
  2⤵
  PID:8736
- C:\Windows\System\RddCQSQ.exe
  C:\Windows\System\RddCQSQ.exe
  2⤵
  PID:8516
- C:\Windows\System\XYIixah.exe
  C:\Windows\System\XYIixah.exe
  2⤵
  PID:8720
- C:\Windows\System\DBTJidA.exe
  C:\Windows\System\DBTJidA.exe
  2⤵
  PID:8884
- C:\Windows\System\fzJzuVy.exe
  C:\Windows\System\fzJzuVy.exe
  2⤵
  PID:8892
- C:\Windows\System\FYCQkTi.exe
  C:\Windows\System\FYCQkTi.exe
  2⤵
  PID:8316
- C:\Windows\System\bhryMMd.exe
  C:\Windows\System\bhryMMd.exe
  2⤵
  PID:8716
- C:\Windows\System\CSbrQrL.exe
  C:\Windows\System\CSbrQrL.exe
  2⤵
  PID:9224
- C:\Windows\System\dWofSSG.exe
  C:\Windows\System\dWofSSG.exe
  2⤵
  PID:9252
- C:\Windows\System\XToAGAN.exe
  C:\Windows\System\XToAGAN.exe
  2⤵
  PID:9284
- C:\Windows\System\vvwReZD.exe
  C:\Windows\System\vvwReZD.exe
  2⤵
  PID:9312
- C:\Windows\System\gotEGer.exe
  C:\Windows\System\gotEGer.exe
  2⤵
  PID:9344
- C:\Windows\System\TUYfaON.exe
  C:\Windows\System\TUYfaON.exe
  2⤵
  PID:9388
- C:\Windows\System\hHlyQfB.exe
  C:\Windows\System\hHlyQfB.exe
  2⤵
  PID:9416
- C:\Windows\System\CXMKjte.exe
  C:\Windows\System\CXMKjte.exe
  2⤵
  PID:9452
- C:\Windows\System\lXXfZZv.exe
  C:\Windows\System\lXXfZZv.exe
  2⤵
  PID:9480
- C:\Windows\System\SSsbFdt.exe
  C:\Windows\System\SSsbFdt.exe
  2⤵
  PID:9504
- C:\Windows\System\DuSusWn.exe
  C:\Windows\System\DuSusWn.exe
  2⤵
  PID:9528
- C:\Windows\System\yECCAPd.exe
  C:\Windows\System\yECCAPd.exe
  2⤵
  PID:9556
- C:\Windows\System\wpdCEUn.exe
  C:\Windows\System\wpdCEUn.exe
  2⤵
  PID:9588
- C:\Windows\System\XNbJZcx.exe
  C:\Windows\System\XNbJZcx.exe
  2⤵
  PID:9620
- C:\Windows\System\evpuFrP.exe
  C:\Windows\System\evpuFrP.exe
  2⤵
  PID:9636
- C:\Windows\System\cRpFQgZ.exe
  C:\Windows\System\cRpFQgZ.exe
  2⤵
  PID:9672
- C:\Windows\System\ipfCrsm.exe
  C:\Windows\System\ipfCrsm.exe
  2⤵
  PID:9696
- C:\Windows\System\rbTqkFK.exe
  C:\Windows\System\rbTqkFK.exe
  2⤵
  PID:9724
- C:\Windows\System\ZgKVKNL.exe
  C:\Windows\System\ZgKVKNL.exe
  2⤵
  PID:9744
- C:\Windows\System\AvwpARV.exe
  C:\Windows\System\AvwpARV.exe
  2⤵
  PID:9768
- C:\Windows\System\yKVrOBk.exe
  C:\Windows\System\yKVrOBk.exe
  2⤵
  PID:9800
- C:\Windows\System\CLrgeZi.exe
  C:\Windows\System\CLrgeZi.exe
  2⤵
  PID:9828
- C:\Windows\System\XTqINro.exe
  C:\Windows\System\XTqINro.exe
  2⤵
  PID:9852
- C:\Windows\System\ORnwGuR.exe
  C:\Windows\System\ORnwGuR.exe
  2⤵
  PID:9872
- C:\Windows\System\bLmwpfL.exe
  C:\Windows\System\bLmwpfL.exe
  2⤵
  PID:9892
- C:\Windows\System\lEQPaZF.exe
  C:\Windows\System\lEQPaZF.exe
  2⤵
  PID:9908
- C:\Windows\System\XhnMJKe.exe
  C:\Windows\System\XhnMJKe.exe
  2⤵
  PID:9924
- C:\Windows\System\LDNqjXN.exe
  C:\Windows\System\LDNqjXN.exe
  2⤵
  PID:9952
- C:\Windows\System\xMkZhzk.exe
  C:\Windows\System\xMkZhzk.exe
  2⤵
  PID:9976
- C:\Windows\System\XzlVlXk.exe
  C:\Windows\System\XzlVlXk.exe
  2⤵
  PID:10008
- C:\Windows\System\aGlncYJ.exe
  C:\Windows\System\aGlncYJ.exe
  2⤵
  PID:10036
- C:\Windows\System\WCPTVRq.exe
  C:\Windows\System\WCPTVRq.exe
  2⤵
  PID:10052
- C:\Windows\System\BkBynaD.exe
  C:\Windows\System\BkBynaD.exe
  2⤵
  PID:10072
- C:\Windows\System\IqWeqsa.exe
  C:\Windows\System\IqWeqsa.exe
  2⤵
  PID:10104
- C:\Windows\System\fXTekmJ.exe
  C:\Windows\System\fXTekmJ.exe
  2⤵
  PID:10136
- C:\Windows\System\IgXxYZt.exe
  C:\Windows\System\IgXxYZt.exe
  2⤵
  PID:10172
- C:\Windows\System\YxgUKlh.exe
  C:\Windows\System\YxgUKlh.exe
  2⤵
  PID:10196
- C:\Windows\System\EWDTPzH.exe
  C:\Windows\System\EWDTPzH.exe
  2⤵
  PID:10212
- C:\Windows\System\ykThamq.exe
  C:\Windows\System\ykThamq.exe
  2⤵
  PID:9056
- C:\Windows\System\FuaFjkl.exe
  C:\Windows\System\FuaFjkl.exe
  2⤵
  PID:9220
- C:\Windows\System\pUxYqEb.exe
  C:\Windows\System\pUxYqEb.exe
  2⤵
  PID:9280
- C:\Windows\System\kUomCwK.exe
  C:\Windows\System\kUomCwK.exe
  2⤵
  PID:9248
- C:\Windows\System\mwChitV.exe
  C:\Windows\System\mwChitV.exe
  2⤵
  PID:9292
- C:\Windows\System\bUhbzkc.exe
  C:\Windows\System\bUhbzkc.exe
  2⤵
  PID:9524
- C:\Windows\System\oPvflDu.exe
  C:\Windows\System\oPvflDu.exe
  2⤵
  PID:9564
- C:\Windows\System\JhWziAs.exe
  C:\Windows\System\JhWziAs.exe
  2⤵
  PID:9516
- C:\Windows\System\adgYMrv.exe
  C:\Windows\System\adgYMrv.exe
  2⤵
  PID:9500
- C:\Windows\System\yTHiMRi.exe
  C:\Windows\System\yTHiMRi.exe
  2⤵
  PID:9584
- C:\Windows\System\DkJjEjy.exe
  C:\Windows\System\DkJjEjy.exe
  2⤵
  PID:9860
- C:\Windows\System\vGROccT.exe
  C:\Windows\System\vGROccT.exe
  2⤵
  PID:9904
- C:\Windows\System\gSShDJi.exe
  C:\Windows\System\gSShDJi.exe
  2⤵
  PID:9720
- C:\Windows\System\WQGOgHX.exe
  C:\Windows\System\WQGOgHX.exe
  2⤵
  PID:10048
- C:\Windows\System\iNrokLC.exe
  C:\Windows\System\iNrokLC.exe
  2⤵
  PID:10160
- C:\Windows\System\vDPEBTq.exe
  C:\Windows\System\vDPEBTq.exe
  2⤵
  PID:10044
- C:\Windows\System\QarcvUS.exe
  C:\Windows\System\QarcvUS.exe
  2⤵
  PID:10236
- C:\Windows\System\AXzxzPz.exe
  C:\Windows\System\AXzxzPz.exe
  2⤵
  PID:9996
- C:\Windows\System\ccjJKAT.exe
  C:\Windows\System\ccjJKAT.exe
  2⤵
  PID:9340
- C:\Windows\System\iFjUUNV.exe
  C:\Windows\System\iFjUUNV.exe
  2⤵
  PID:8840
- C:\Windows\System\FEXNfxV.exe
  C:\Windows\System\FEXNfxV.exe
  2⤵
  PID:9404
- C:\Windows\System\FrqMqWm.exe
  C:\Windows\System\FrqMqWm.exe
  2⤵
  PID:9884
- C:\Windows\System\GrGOuVZ.exe
  C:\Windows\System\GrGOuVZ.exe
  2⤵
  PID:9816
- C:\Windows\System\VMJNZWt.exe
  C:\Windows\System\VMJNZWt.exe
  2⤵
  PID:7648
- C:\Windows\System\Llvtokm.exe
  C:\Windows\System\Llvtokm.exe
  2⤵
  PID:8952
- C:\Windows\System\DdfLjya.exe
  C:\Windows\System\DdfLjya.exe
  2⤵
  PID:10132
- C:\Windows\System\WxxNwAU.exe
  C:\Windows\System\WxxNwAU.exe
  2⤵
  PID:10248
- C:\Windows\System\OIABXmc.exe
  C:\Windows\System\OIABXmc.exe
  2⤵
  PID:10284
- C:\Windows\System\HOdBcyz.exe
  C:\Windows\System\HOdBcyz.exe
  2⤵
  PID:10300
- C:\Windows\System\EEsaEsz.exe
  C:\Windows\System\EEsaEsz.exe
  2⤵
  PID:10328
- C:\Windows\System\SAsopqW.exe
  C:\Windows\System\SAsopqW.exe
  2⤵
  PID:10360
- C:\Windows\System\RTwetoF.exe
  C:\Windows\System\RTwetoF.exe
  2⤵
  PID:10384
- C:\Windows\System\wnNLlpN.exe
  C:\Windows\System\wnNLlpN.exe
  2⤵
  PID:10408
- C:\Windows\System\tzYcNZV.exe
  C:\Windows\System\tzYcNZV.exe
  2⤵
  PID:10444
- C:\Windows\System\zKcnrRS.exe
  C:\Windows\System\zKcnrRS.exe
  2⤵
  PID:10468
- C:\Windows\System\NhyVfTv.exe
  C:\Windows\System\NhyVfTv.exe
  2⤵
  PID:10488
- C:\Windows\System\ntPKbhm.exe
  C:\Windows\System\ntPKbhm.exe
  2⤵
  PID:10520
- C:\Windows\System\QiygEvX.exe
  C:\Windows\System\QiygEvX.exe
  2⤵
  PID:10548
- C:\Windows\System\dekDZvf.exe
  C:\Windows\System\dekDZvf.exe
  2⤵
  PID:10576
- C:\Windows\System\coMeqIQ.exe
  C:\Windows\System\coMeqIQ.exe
  2⤵
  PID:10612
- C:\Windows\System\tSrntnC.exe
  C:\Windows\System\tSrntnC.exe
  2⤵
  PID:10632
- C:\Windows\System\FmLZKDD.exe
  C:\Windows\System\FmLZKDD.exe
  2⤵
  PID:10660
- C:\Windows\System\ANXigPd.exe
  C:\Windows\System\ANXigPd.exe
  2⤵
  PID:10688
- C:\Windows\System\zutUqYc.exe
  C:\Windows\System\zutUqYc.exe
  2⤵
  PID:10708
- C:\Windows\System\qouUsvj.exe
  C:\Windows\System\qouUsvj.exe
  2⤵
  PID:10732
- C:\Windows\System\sWQtwDg.exe
  C:\Windows\System\sWQtwDg.exe
  2⤵
  PID:10760
- C:\Windows\System\ZwjyQrk.exe
  C:\Windows\System\ZwjyQrk.exe
  2⤵
  PID:10952
- C:\Windows\System\pdicYWb.exe
  C:\Windows\System\pdicYWb.exe
  2⤵
  PID:11016
- C:\Windows\System\VCbOvKY.exe
  C:\Windows\System\VCbOvKY.exe
  2⤵
  PID:11048
- C:\Windows\System\WZRYaAk.exe
  C:\Windows\System\WZRYaAk.exe
  2⤵
  PID:11084
- C:\Windows\System\yfGyeAU.exe
  C:\Windows\System\yfGyeAU.exe
  2⤵
  PID:11124
- C:\Windows\System\ksMwaMj.exe
  C:\Windows\System\ksMwaMj.exe
  2⤵
  PID:11140
- C:\Windows\System\RZdRcnw.exe
  C:\Windows\System\RZdRcnw.exe
  2⤵
  PID:11156
- C:\Windows\System\UzCGkZe.exe
  C:\Windows\System\UzCGkZe.exe
  2⤵
  PID:11180
- C:\Windows\System\dJZUZzQ.exe
  C:\Windows\System\dJZUZzQ.exe
  2⤵
  PID:11200
- C:\Windows\System\pxGLGXg.exe
  C:\Windows\System\pxGLGXg.exe
  2⤵
  PID:11232
- C:\Windows\System\JSByTep.exe
  C:\Windows\System\JSByTep.exe
  2⤵
  PID:11252
- C:\Windows\System\NGKLtxn.exe
  C:\Windows\System\NGKLtxn.exe
  2⤵
  PID:10092
- C:\Windows\System\LfnCmgk.exe
  C:\Windows\System\LfnCmgk.exe
  2⤵
  PID:9240
- C:\Windows\System\VGKHAyZ.exe
  C:\Windows\System\VGKHAyZ.exe
  2⤵
  PID:10016
- C:\Windows\System\ndydorx.exe
  C:\Windows\System\ndydorx.exe
  2⤵
  PID:9472
- C:\Windows\System\JfLCAbO.exe
  C:\Windows\System\JfLCAbO.exe
  2⤵
  PID:10420
- C:\Windows\System\SWPcRXV.exe
  C:\Windows\System\SWPcRXV.exe
  2⤵
  PID:10324
- C:\Windows\System\ZROdZGW.exe
  C:\Windows\System\ZROdZGW.exe
  2⤵
  PID:10380
- C:\Windows\System\odLBMLz.exe
  C:\Windows\System\odLBMLz.exe
  2⤵
  PID:10544
- C:\Windows\System\ausFzNq.exe
  C:\Windows\System\ausFzNq.exe
  2⤵
  PID:10400
- C:\Windows\System\XOjFFsg.exe
  C:\Windows\System\XOjFFsg.exe
  2⤵
  PID:10604
- C:\Windows\System\IOBqOqr.exe
  C:\Windows\System\IOBqOqr.exe
  2⤵
  PID:10748
- C:\Windows\System\daiPrVI.exe
  C:\Windows\System\daiPrVI.exe
  2⤵
  PID:10744
- C:\Windows\System\MTpsilm.exe
  C:\Windows\System\MTpsilm.exe
  2⤵
  PID:11060
- C:\Windows\System\CWUCICF.exe
  C:\Windows\System\CWUCICF.exe
  2⤵
  PID:10960
- C:\Windows\System\bhRpBLJ.exe
  C:\Windows\System\bhRpBLJ.exe
  2⤵
  PID:11076
- C:\Windows\System\jAHfvQh.exe
  C:\Windows\System\jAHfvQh.exe
  2⤵
  PID:11004
- C:\Windows\System\zRpBLvo.exe
  C:\Windows\System\zRpBLvo.exe
  2⤵
  PID:11208
- C:\Windows\System\PZoeQHO.exe
  C:\Windows\System\PZoeQHO.exe
  2⤵
  PID:11148
- C:\Windows\System\qyOIrKi.exe
  C:\Windows\System\qyOIrKi.exe
  2⤵
  PID:9888
- C:\Windows\System\WAQxrTU.exe
  C:\Windows\System\WAQxrTU.exe
  2⤵
  PID:10264
- C:\Windows\System\rJwXOMF.exe
  C:\Windows\System\rJwXOMF.exe
  2⤵
  PID:10292
- C:\Windows\System\EIlrfEj.exe
  C:\Windows\System\EIlrfEj.exe
  2⤵
  PID:10624
- C:\Windows\System\EiAGvaO.exe
  C:\Windows\System\EiAGvaO.exe
  2⤵
  PID:10728
- C:\Windows\System\ejJqqlH.exe
  C:\Windows\System\ejJqqlH.exe
  2⤵
  PID:10648
- C:\Windows\System\hfAvuBo.exe
  C:\Windows\System\hfAvuBo.exe
  2⤵
  PID:11000
- C:\Windows\System\oOgkJwW.exe
  C:\Windows\System\oOgkJwW.exe
  2⤵
  PID:10424
- C:\Windows\System\eYBqHdW.exe
  C:\Windows\System\eYBqHdW.exe
  2⤵
  PID:11224
- C:\Windows\System\tQEdKHX.exe
  C:\Windows\System\tQEdKHX.exe
  2⤵
  PID:10560
- C:\Windows\System\JLGOegb.exe
  C:\Windows\System\JLGOegb.exe
  2⤵
  PID:11268
- C:\Windows\System\TTBuUxb.exe
  C:\Windows\System\TTBuUxb.exe
  2⤵
  PID:11292
- C:\Windows\System\YcAQARv.exe
  C:\Windows\System\YcAQARv.exe
  2⤵
  PID:11324
- C:\Windows\System\EQZKFmx.exe
  C:\Windows\System\EQZKFmx.exe
  2⤵
  PID:11348
- C:\Windows\System\mSabLsg.exe
  C:\Windows\System\mSabLsg.exe
  2⤵
  PID:11380
- C:\Windows\System\zkKLrrY.exe
  C:\Windows\System\zkKLrrY.exe
  2⤵
  PID:11404
- C:\Windows\System\aaZFZGR.exe
  C:\Windows\System\aaZFZGR.exe
  2⤵
  PID:11420
- C:\Windows\System\jnRZSLJ.exe
  C:\Windows\System\jnRZSLJ.exe
  2⤵
  PID:11448
- C:\Windows\System\uVJYiWz.exe
  C:\Windows\System\uVJYiWz.exe
  2⤵
  PID:11472
- C:\Windows\System\PHLAZDW.exe
  C:\Windows\System\PHLAZDW.exe
  2⤵
  PID:11504
- C:\Windows\System\FOyfXgI.exe
  C:\Windows\System\FOyfXgI.exe
  2⤵
  PID:11532
- C:\Windows\System\ftmYLQY.exe
  C:\Windows\System\ftmYLQY.exe
  2⤵
  PID:11568
- C:\Windows\System\cWsSwLV.exe
  C:\Windows\System\cWsSwLV.exe
  2⤵
  PID:11596
- C:\Windows\System\uzChUkJ.exe
  C:\Windows\System\uzChUkJ.exe
  2⤵
  PID:11624
- C:\Windows\System\WDVzJWH.exe
  C:\Windows\System\WDVzJWH.exe
  2⤵
  PID:11656
- C:\Windows\System\gYxGACB.exe
  C:\Windows\System\gYxGACB.exe
  2⤵
  PID:11672
- C:\Windows\System\wmFXCBF.exe
  C:\Windows\System\wmFXCBF.exe
  2⤵
  PID:11692
- C:\Windows\System\wQfrTSw.exe
  C:\Windows\System\wQfrTSw.exe
  2⤵
  PID:11712
- C:\Windows\System\fywROui.exe
  C:\Windows\System\fywROui.exe
  2⤵
  PID:11740
- C:\Windows\System\cMJYvIj.exe
  C:\Windows\System\cMJYvIj.exe
  2⤵
  PID:11756
- C:\Windows\System\oJaYmAj.exe
  C:\Windows\System\oJaYmAj.exe
  2⤵
  PID:11776
- C:\Windows\System\TBwXcso.exe
  C:\Windows\System\TBwXcso.exe
  2⤵
  PID:11808
- C:\Windows\System\GrGWWoQ.exe
  C:\Windows\System\GrGWWoQ.exe
  2⤵
  PID:11828
- C:\Windows\System\okhpKwv.exe
  C:\Windows\System\okhpKwv.exe
  2⤵
  PID:11848
- C:\Windows\System\dxvnEjA.exe
  C:\Windows\System\dxvnEjA.exe
  2⤵
  PID:11872
- C:\Windows\System\bMFVIGy.exe
  C:\Windows\System\bMFVIGy.exe
  2⤵
  PID:11896
- C:\Windows\System\pPitpeH.exe
  C:\Windows\System\pPitpeH.exe
  2⤵
  PID:11920
- C:\Windows\System\mEczLhr.exe
  C:\Windows\System\mEczLhr.exe
  2⤵
  PID:11952
- C:\Windows\System\ItzkHWZ.exe
  C:\Windows\System\ItzkHWZ.exe
  2⤵
  PID:11980
- C:\Windows\System\ucAWXrB.exe
  C:\Windows\System\ucAWXrB.exe
  2⤵
  PID:12004
- C:\Windows\System\RiJXfwr.exe
  C:\Windows\System\RiJXfwr.exe
  2⤵
  PID:12040
- C:\Windows\System\spUdqGG.exe
  C:\Windows\System\spUdqGG.exe
  2⤵
  PID:12068
- C:\Windows\System\qYRYvcz.exe
  C:\Windows\System\qYRYvcz.exe
  2⤵
  PID:12096
- C:\Windows\System\MQyqBjW.exe
  C:\Windows\System\MQyqBjW.exe
  2⤵
  PID:12120
- C:\Windows\System\NEanSdh.exe
  C:\Windows\System\NEanSdh.exe
  2⤵
  PID:12160
- C:\Windows\System\fsIVngW.exe
  C:\Windows\System\fsIVngW.exe
  2⤵
  PID:12180
- C:\Windows\System\IpiLpCT.exe
  C:\Windows\System\IpiLpCT.exe
  2⤵
  PID:12216
- C:\Windows\System\inboVRw.exe
  C:\Windows\System\inboVRw.exe
  2⤵
  PID:12248
- C:\Windows\System\dgrgKkj.exe
  C:\Windows\System\dgrgKkj.exe
  2⤵
  PID:12272
- C:\Windows\System\EnidbbJ.exe
  C:\Windows\System\EnidbbJ.exe
  2⤵
  PID:11008
- C:\Windows\System\rKiCnYg.exe
  C:\Windows\System\rKiCnYg.exe
  2⤵
  PID:10540
- C:\Windows\System\COzomny.exe
  C:\Windows\System\COzomny.exe
  2⤵
  PID:11340
- C:\Windows\System\kdrFvAG.exe
  C:\Windows\System\kdrFvAG.exe
  2⤵
  PID:11280
- C:\Windows\System\mAESTwH.exe
  C:\Windows\System\mAESTwH.exe
  2⤵
  PID:11300
- C:\Windows\System\Wwrxhfh.exe
  C:\Windows\System\Wwrxhfh.exe
  2⤵
  PID:11320
- C:\Windows\System\jlOUMKR.exe
  C:\Windows\System\jlOUMKR.exe
  2⤵
  PID:11516
- C:\Windows\System\nkGCXai.exe
  C:\Windows\System\nkGCXai.exe
  2⤵
  PID:11416
- C:\Windows\System\YBkrYsb.exe
  C:\Windows\System\YBkrYsb.exe
  2⤵
  PID:11436
- C:\Windows\System\LvaSMQQ.exe
  C:\Windows\System\LvaSMQQ.exe
  2⤵
  PID:11724
- C:\Windows\System\zshUphp.exe
  C:\Windows\System\zshUphp.exe
  2⤵
  PID:11796
- C:\Windows\System\izGxuYF.exe
  C:\Windows\System\izGxuYF.exe
  2⤵
  PID:11636
- C:\Windows\System\TVPmztJ.exe
  C:\Windows\System\TVPmztJ.exe
  2⤵
  PID:11784
- C:\Windows\System\qaYQbJJ.exe
  C:\Windows\System\qaYQbJJ.exe
  2⤵
  PID:11860
- C:\Windows\System\YycWMSt.exe
  C:\Windows\System\YycWMSt.exe
  2⤵
  PID:11932
- C:\Windows\System\pcslrgT.exe
  C:\Windows\System\pcslrgT.exe
  2⤵
  PID:12132
- C:\Windows\System\kqUTaAC.exe
  C:\Windows\System\kqUTaAC.exe
  2⤵
  PID:12176
- C:\Windows\System\ZmoVDEf.exe
  C:\Windows\System\ZmoVDEf.exe
  2⤵
  PID:12212
- C:\Windows\System\heTtPSW.exe
  C:\Windows\System\heTtPSW.exe
  2⤵
  PID:11068
- C:\Windows\System\HNcqnfG.exe
  C:\Windows\System\HNcqnfG.exe
  2⤵
  PID:12240
- C:\Windows\System\uamPOWi.exe
  C:\Windows\System\uamPOWi.exe
  2⤵
  PID:12152
- C:\Windows\System\pWctacE.exe
  C:\Windows\System\pWctacE.exe
  2⤵
  PID:11680
- C:\Windows\System\ZlnELjB.exe
  C:\Windows\System\ZlnELjB.exe
  2⤵
  PID:11524
- C:\Windows\System\hSgYmdG.exe
  C:\Windows\System\hSgYmdG.exe
  2⤵
  PID:11552
- C:\Windows\System\rIebQYh.exe
  C:\Windows\System\rIebQYh.exe
  2⤵
  PID:12172
- C:\Windows\System\lYcLFZE.exe
  C:\Windows\System\lYcLFZE.exe
  2⤵
  PID:12320
- C:\Windows\System\AeAPXuE.exe
  C:\Windows\System\AeAPXuE.exe
  2⤵
  PID:12344
- C:\Windows\System\ZuQlJDC.exe
  C:\Windows\System\ZuQlJDC.exe
  2⤵
  PID:12364
- C:\Windows\System\rqjTXId.exe
  C:\Windows\System\rqjTXId.exe
  2⤵
  PID:12384
- C:\Windows\System\IvWDwCo.exe
  C:\Windows\System\IvWDwCo.exe
  2⤵
  PID:12404
- C:\Windows\System\McZIFCp.exe
  C:\Windows\System\McZIFCp.exe
  2⤵
  PID:12432
- C:\Windows\System\aVVuQez.exe
  C:\Windows\System\aVVuQez.exe
  2⤵
  PID:12456
- C:\Windows\System\dbaxDuD.exe
  C:\Windows\System\dbaxDuD.exe
  2⤵
  PID:12480
- C:\Windows\System\BrtozyP.exe
  C:\Windows\System\BrtozyP.exe
  2⤵
  PID:12504
- C:\Windows\System\PAavbFJ.exe
  C:\Windows\System\PAavbFJ.exe
  2⤵
  PID:12536
- C:\Windows\System\mCCakXD.exe
  C:\Windows\System\mCCakXD.exe
  2⤵
  PID:12560
- C:\Windows\System\oOGcGjc.exe
  C:\Windows\System\oOGcGjc.exe
  2⤵
  PID:12580
- C:\Windows\System\OnMfUpH.exe
  C:\Windows\System\OnMfUpH.exe
  2⤵
  PID:12608
- C:\Windows\System\GorpoRg.exe
  C:\Windows\System\GorpoRg.exe
  2⤵
  PID:12636
- C:\Windows\System\nUEFFZx.exe
  C:\Windows\System\nUEFFZx.exe
  2⤵
  PID:12656
- C:\Windows\System\CvjZYnc.exe
  C:\Windows\System\CvjZYnc.exe
  2⤵
  PID:12708
- C:\Windows\System\lGVoUOH.exe
  C:\Windows\System\lGVoUOH.exe
  2⤵
  PID:12724
- C:\Windows\System\zmSrmWM.exe
  C:\Windows\System\zmSrmWM.exe
  2⤵
  PID:12744
- C:\Windows\System\KyCBhiN.exe
  C:\Windows\System\KyCBhiN.exe
  2⤵
  PID:12768
- C:\Windows\System\aFWwNlW.exe
  C:\Windows\System\aFWwNlW.exe
  2⤵
  PID:12800
- C:\Windows\System\TbEuSoY.exe
  C:\Windows\System\TbEuSoY.exe
  2⤵
  PID:12840
- C:\Windows\System\PrsqDAg.exe
  C:\Windows\System\PrsqDAg.exe
  2⤵
  PID:12872
- C:\Windows\System\gSMjmZW.exe
  C:\Windows\System\gSMjmZW.exe
  2⤵
  PID:12904
- C:\Windows\System\TxiDiYA.exe
  C:\Windows\System\TxiDiYA.exe
  2⤵
  PID:12932
- C:\Windows\System\DFQKWKs.exe
  C:\Windows\System\DFQKWKs.exe
  2⤵
  PID:12964
- C:\Windows\System\jbjzcyy.exe
  C:\Windows\System\jbjzcyy.exe
  2⤵
  PID:13004
- C:\Windows\System\mvpUJNY.exe
  C:\Windows\System\mvpUJNY.exe
  2⤵
  PID:13036
- C:\Windows\System\KRugLtz.exe
  C:\Windows\System\KRugLtz.exe
  2⤵
  PID:13060
- C:\Windows\System\FzCjWND.exe
  C:\Windows\System\FzCjWND.exe
  2⤵
  PID:13096
- C:\Windows\System\wtEbbNf.exe
  C:\Windows\System\wtEbbNf.exe
  2⤵
  PID:13120
- C:\Windows\System\JTyLptK.exe
  C:\Windows\System\JTyLptK.exe
  2⤵
  PID:13152
- C:\Windows\System\tliJzAk.exe
  C:\Windows\System\tliJzAk.exe
  2⤵
  PID:13180
- C:\Windows\System\FlqjqfU.exe
  C:\Windows\System\FlqjqfU.exe
  2⤵
  PID:13204
- C:\Windows\System\XvfsSJG.exe
  C:\Windows\System\XvfsSJG.exe
  2⤵
  PID:13228
- C:\Windows\System\uAXZBqq.exe
  C:\Windows\System\uAXZBqq.exe
  2⤵
  PID:13244
- C:\Windows\System\pCgbsCK.exe
  C:\Windows\System\pCgbsCK.exe
  2⤵
  PID:13272
- C:\Windows\System\GjFivrI.exe
  C:\Windows\System\GjFivrI.exe
  2⤵
  PID:13296
- C:\Windows\System\iAdzTJZ.exe
  C:\Windows\System\iAdzTJZ.exe
  2⤵
  PID:12284
- C:\Windows\System\EtAwqzG.exe
  C:\Windows\System\EtAwqzG.exe
  2⤵
  PID:11496
- C:\Windows\System\yqNyBBJ.exe
  C:\Windows\System\yqNyBBJ.exe
  2⤵
  PID:12256
- C:\Windows\System\naGSVAC.exe
  C:\Windows\System\naGSVAC.exe
  2⤵
  PID:12360
- C:\Windows\System\iBqTsDu.exe
  C:\Windows\System\iBqTsDu.exe
  2⤵
  PID:11684
- C:\Windows\System\vyaODUl.exe
  C:\Windows\System\vyaODUl.exe
  2⤵
  PID:12000
- C:\Windows\System\nXsWvGJ.exe
  C:\Windows\System\nXsWvGJ.exe
  2⤵
  PID:12424
- C:\Windows\System\OcNULxr.exe
  C:\Windows\System\OcNULxr.exe
  2⤵
  PID:12340
- C:\Windows\System\AcwpNym.exe
  C:\Windows\System\AcwpNym.exe
  2⤵
  PID:12496
- C:\Windows\System\RLbxdpH.exe
  C:\Windows\System\RLbxdpH.exe
  2⤵
  PID:12492
- C:\Windows\System\VxAEIye.exe
  C:\Windows\System\VxAEIye.exe
  2⤵
  PID:12468
- C:\Windows\System\unCeyiC.exe
  C:\Windows\System\unCeyiC.exe
  2⤵
  PID:12736
- C:\Windows\System\TdWOjiM.exe
  C:\Windows\System\TdWOjiM.exe
  2⤵
  PID:12516
- C:\Windows\System\DcZybAC.exe
  C:\Windows\System\DcZybAC.exe
  2⤵
  PID:12576
- C:\Windows\System\LtLAhqb.exe
  C:\Windows\System\LtLAhqb.exe
  2⤵
  PID:12644
- C:\Windows\System\QRTTEFU.exe
  C:\Windows\System\QRTTEFU.exe
  2⤵
  PID:12944
- C:\Windows\System\HPHPjXF.exe
  C:\Windows\System\HPHPjXF.exe
  2⤵
  PID:12812
- C:\Windows\System\rdmTgHy.exe
  C:\Windows\System\rdmTgHy.exe
  2⤵
  PID:12700
- C:\Windows\System\LJGCkzU.exe
  C:\Windows\System\LJGCkzU.exe
  2⤵
  PID:13116
- C:\Windows\System\foGZzOh.exe
  C:\Windows\System\foGZzOh.exe
  2⤵
  PID:12860
- C:\Windows\System\uqGLUUH.exe
  C:\Windows\System\uqGLUUH.exe
  2⤵
  PID:13136
- C:\Windows\System\LdxwXbD.exe
  C:\Windows\System\LdxwXbD.exe
  2⤵
  PID:11704
- C:\Windows\System\OkAQLwM.exe
  C:\Windows\System\OkAQLwM.exe
  2⤵
  PID:13216
- C:\Windows\System\UbYyrju.exe
  C:\Windows\System\UbYyrju.exe
  2⤵
  PID:13268
- C:\Windows\System\LoUihkx.exe
  C:\Windows\System\LoUihkx.exe
  2⤵
  PID:12332
- C:\Windows\System\vuPtGac.exe
  C:\Windows\System\vuPtGac.exe
  2⤵
  PID:11484
- C:\Windows\System\itnfAXL.exe
  C:\Windows\System\itnfAXL.exe
  2⤵
  PID:11892
- C:\Windows\System\rWcJXpK.exe
  C:\Windows\System\rWcJXpK.exe
  2⤵
  PID:13288
- C:\Windows\System\IzvCvTk.exe
  C:\Windows\System\IzvCvTk.exe
  2⤵
  PID:13336
- C:\Windows\System\mUjkGEB.exe
  C:\Windows\System\mUjkGEB.exe
  2⤵
  PID:13364
- C:\Windows\System\iHhPfDQ.exe
  C:\Windows\System\iHhPfDQ.exe
  2⤵
  PID:13384
- C:\Windows\System\VNlyaaL.exe
  C:\Windows\System\VNlyaaL.exe
  2⤵
  PID:13416
- C:\Windows\System\rhSuTzZ.exe
  C:\Windows\System\rhSuTzZ.exe
  2⤵
  PID:13444
- C:\Windows\System\ZkGCRMA.exe
  C:\Windows\System\ZkGCRMA.exe
  2⤵
  PID:13468
- C:\Windows\System\HsCMPQh.exe
  C:\Windows\System\HsCMPQh.exe
  2⤵
  PID:13484
- C:\Windows\System\VdyVqNX.exe
  C:\Windows\System\VdyVqNX.exe
  2⤵
  PID:13508
- C:\Windows\System\SUCWRrl.exe
  C:\Windows\System\SUCWRrl.exe
  2⤵
  PID:13536
- C:\Windows\System\wXwmtJn.exe
  C:\Windows\System\wXwmtJn.exe
  2⤵
  PID:13560
- C:\Windows\System\RabXvkP.exe
  C:\Windows\System\RabXvkP.exe
  2⤵
  PID:13576
- C:\Windows\System\vvBIinc.exe
  C:\Windows\System\vvBIinc.exe
  2⤵
  PID:13596
- C:\Windows\System\nNVXvlw.exe
  C:\Windows\System\nNVXvlw.exe
  2⤵
  PID:13624
- C:\Windows\System\nDjqOiV.exe
  C:\Windows\System\nDjqOiV.exe
  2⤵
  PID:13644
- C:\Windows\System\FXKtopL.exe
  C:\Windows\System\FXKtopL.exe
  2⤵
  PID:13684
- C:\Windows\System\TasXpFu.exe
  C:\Windows\System\TasXpFu.exe
  2⤵
  PID:13712
- C:\Windows\System\JqpDfXB.exe
  C:\Windows\System\JqpDfXB.exe
  2⤵
  PID:13740
- C:\Windows\System\bSCHohY.exe
  C:\Windows\System\bSCHohY.exe
  2⤵
  PID:13756
- C:\Windows\System\qIAMtww.exe
  C:\Windows\System\qIAMtww.exe
  2⤵
  PID:13784
- C:\Windows\System\FUXJYWs.exe
  C:\Windows\System\FUXJYWs.exe
  2⤵
  PID:13812
- C:\Windows\System\EkFGCHY.exe
  C:\Windows\System\EkFGCHY.exe
  2⤵
  PID:13836
- C:\Windows\System\WVCYsbO.exe
  C:\Windows\System\WVCYsbO.exe
  2⤵
  PID:13868
- C:\Windows\System\HKafWrw.exe
  C:\Windows\System\HKafWrw.exe
  2⤵
  PID:13896
- C:\Windows\System\KJInMHg.exe
  C:\Windows\System\KJInMHg.exe
  2⤵
  PID:13916
- C:\Windows\System\vRiRWvo.exe
  C:\Windows\System\vRiRWvo.exe
  2⤵
  PID:13940
- C:\Windows\System\wHVlIGo.exe
  C:\Windows\System\wHVlIGo.exe
  2⤵
  PID:13968
- C:\Windows\System\KYoZthF.exe
  C:\Windows\System\KYoZthF.exe
  2⤵
  PID:13996
- C:\Windows\System\ysISFNM.exe
  C:\Windows\System\ysISFNM.exe
  2⤵
  PID:14020
- C:\Windows\System\qLuGeSk.exe
  C:\Windows\System\qLuGeSk.exe
  2⤵
  PID:14052
- C:\Windows\System\RfTOwuz.exe
  C:\Windows\System\RfTOwuz.exe
  2⤵
  PID:14084
- C:\Windows\System\mPBkXoK.exe
  C:\Windows\System\mPBkXoK.exe
  2⤵
  PID:14104
- C:\Windows\System\CDtUocR.exe
  C:\Windows\System\CDtUocR.exe
  2⤵
  PID:14132
- C:\Windows\System\QPgGNak.exe
  C:\Windows\System\QPgGNak.exe
  2⤵
  PID:14164
- C:\Windows\System\AMPIjyf.exe
  C:\Windows\System\AMPIjyf.exe
  2⤵
  PID:14192
- C:\Windows\System\pecJqFc.exe
  C:\Windows\System\pecJqFc.exe
  2⤵
  PID:14224
- C:\Windows\System\GHdOuEE.exe
  C:\Windows\System\GHdOuEE.exe
  2⤵
  PID:14256
- C:\Windows\System\AFNsQLO.exe
  C:\Windows\System\AFNsQLO.exe
  2⤵
  PID:14284
- C:\Windows\System\jdJMTLs.exe
  C:\Windows\System\jdJMTLs.exe
  2⤵
  PID:14312
- C:\Windows\System\VyyWfWu.exe
  C:\Windows\System\VyyWfWu.exe
  2⤵
  PID:11768
- C:\Windows\System\fXlBXGY.exe
  C:\Windows\System\fXlBXGY.exe
  2⤵
  PID:13200
- C:\Windows\System\gaGSjnn.exe
  C:\Windows\System\gaGSjnn.exe
  2⤵
  PID:12592
- C:\Windows\System\XfXdnXF.exe
  C:\Windows\System\XfXdnXF.exe
  2⤵
  PID:12892
- C:\Windows\System\MsdFoZM.exe
  C:\Windows\System\MsdFoZM.exe
  2⤵
  PID:13344
- C:\Windows\System\swoTHQe.exe
  C:\Windows\System\swoTHQe.exe
  2⤵
  PID:13236
- C:\Windows\System\dAUDWyw.exe
  C:\Windows\System\dAUDWyw.exe
  2⤵
  PID:13456
- C:\Windows\System\XiIIoKC.exe
  C:\Windows\System\XiIIoKC.exe
  2⤵
  PID:13476
- C:\Windows\System\OxPTbqd.exe
  C:\Windows\System\OxPTbqd.exe
  2⤵
  PID:13604
- C:\Windows\System\rsMPOLd.exe
  C:\Windows\System\rsMPOLd.exe
  2⤵
  PID:13696
- C:\Windows\System\rUHDmXU.exe
  C:\Windows\System\rUHDmXU.exe
  2⤵
  PID:13768
- C:\Windows\System\EbalLDD.exe
  C:\Windows\System\EbalLDD.exe
  2⤵
  PID:13796
- C:\Windows\System\VzHNzFo.exe
  C:\Windows\System\VzHNzFo.exe
  2⤵
  PID:13328
- C:\Windows\System\qndlWAF.exe
  C:\Windows\System\qndlWAF.exe
  2⤵
  PID:13960
- C:\Windows\System\DKYKlbF.exe
  C:\Windows\System\DKYKlbF.exe
  2⤵
  PID:13504
- C:\Windows\System\ElEXyzD.exe
  C:\Windows\System\ElEXyzD.exe
  2⤵
  PID:13808
- C:\Windows\System\QpufhUL.exe
  C:\Windows\System\QpufhUL.exe
  2⤵
  PID:13572
- C:\Windows\System\jPKXymn.exe
  C:\Windows\System\jPKXymn.exe
  2⤵
  PID:14212
- C:\Windows\System\xxYdyDW.exe
  C:\Windows\System\xxYdyDW.exe
  2⤵
  PID:14244
- C:\Windows\System\LRJbtyo.exe
  C:\Windows\System\LRJbtyo.exe
  2⤵
  PID:14012
- C:\Windows\System\BBxQJbT.exe
  C:\Windows\System\BBxQJbT.exe
  2⤵
  PID:13732
- C:\Windows\System\yXBnJbm.exe
  C:\Windows\System\yXBnJbm.exe
  2⤵
  PID:11836
- C:\Windows\System\eMHSFAp.exe
  C:\Windows\System\eMHSFAp.exe
  2⤵
  PID:14144
- C:\Windows\System\YeLGMgT.exe
  C:\Windows\System\YeLGMgT.exe
  2⤵
  PID:13436
- C:\Windows\System\GaKsYZR.exe
  C:\Windows\System\GaKsYZR.exe
  2⤵
  PID:12796
- C:\Windows\System\KoKVoPT.exe
  C:\Windows\System\KoKVoPT.exe
  2⤵
  PID:14352
- C:\Windows\System\zXSSglV.exe
  C:\Windows\System\zXSSglV.exe
  2⤵
  PID:14376
- C:\Windows\System\FeXUiLY.exe
  C:\Windows\System\FeXUiLY.exe
  2⤵
  PID:14396
- C:\Windows\System\paTmMGN.exe
  C:\Windows\System\paTmMGN.exe
  2⤵
  PID:14416
- C:\Windows\System\lHtFGCb.exe
  C:\Windows\System\lHtFGCb.exe
  2⤵
  PID:14436
- C:\Windows\System\PbuBcOu.exe
  C:\Windows\System\PbuBcOu.exe
  2⤵
  PID:14464
- C:\Windows\System\aFbJKmf.exe
  C:\Windows\System\aFbJKmf.exe
  2⤵
  PID:14492
- C:\Windows\System\biYgmIf.exe
  C:\Windows\System\biYgmIf.exe
  2⤵
  PID:14512
- C:\Windows\System\aESwqKP.exe
  C:\Windows\System\aESwqKP.exe
  2⤵
  PID:14528
- C:\Windows\System\tDtZFio.exe
  C:\Windows\System\tDtZFio.exe
  2⤵
  PID:14552
- C:\Windows\System\PJwvoJT.exe
  C:\Windows\System\PJwvoJT.exe
  2⤵
  PID:14572
- C:\Windows\System\sszfQdU.exe
  C:\Windows\System\sszfQdU.exe
  2⤵
  PID:14600
- C:\Windows\System\WeqJYnK.exe
  C:\Windows\System\WeqJYnK.exe
  2⤵
  PID:14636
- C:\Windows\System\SEumFUH.exe
  C:\Windows\System\SEumFUH.exe
  2⤵
  PID:14656
- C:\Windows\System\FRaPgOf.exe
  C:\Windows\System\FRaPgOf.exe
  2⤵
  PID:14672
- C:\Windows\System\xsXuzze.exe
  C:\Windows\System\xsXuzze.exe
  2⤵
  PID:14692
- C:\Windows\System\moJjprk.exe
  C:\Windows\System\moJjprk.exe
  2⤵
  PID:14712
- C:\Windows\System\GBsvosx.exe
  C:\Windows\System\GBsvosx.exe
  2⤵
  PID:14740
- C:\Windows\System\BzVnlTT.exe
  C:\Windows\System\BzVnlTT.exe
  2⤵
  PID:14764
- C:\Windows\System\miGAeOr.exe
  C:\Windows\System\miGAeOr.exe
  2⤵
  PID:14800
- C:\Windows\System\SHqzvsD.exe
  C:\Windows\System\SHqzvsD.exe
  2⤵
  PID:14828
- C:\Windows\System\zPRMPIU.exe
  C:\Windows\System\zPRMPIU.exe
  2⤵
  PID:14848
- C:\Windows\System\mtYZrpg.exe
  C:\Windows\System\mtYZrpg.exe
  2⤵
  PID:14872
- C:\Windows\System\IdHdtkk.exe
  C:\Windows\System\IdHdtkk.exe
  2⤵
  PID:14892
- C:\Windows\System\vapmdTc.exe
  C:\Windows\System\vapmdTc.exe
  2⤵
  PID:14912
- C:\Windows\System\qptLVEl.exe
  C:\Windows\System\qptLVEl.exe
  2⤵
  PID:14928
- C:\Windows\System\MbQLmet.exe
  C:\Windows\System\MbQLmet.exe
  2⤵
  PID:14960
- C:\Windows\System\UCptkaG.exe
  C:\Windows\System\UCptkaG.exe
  2⤵
  PID:14976
- C:\Windows\System\GTfhCaI.exe
  C:\Windows\System\GTfhCaI.exe
  2⤵
  PID:14996
- C:\Windows\System\eBaCgVy.exe
  C:\Windows\System\eBaCgVy.exe
  2⤵
  PID:15032
- C:\Windows\System\AqNdsoS.exe
  C:\Windows\System\AqNdsoS.exe
  2⤵
  PID:15060
- C:\Windows\System\NgbEXjg.exe
  C:\Windows\System\NgbEXjg.exe
  2⤵
  PID:15092
- C:\Windows\System\HVzXJQD.exe
  C:\Windows\System\HVzXJQD.exe
  2⤵
  PID:15112
- C:\Windows\System\trJzZNd.exe
  C:\Windows\System\trJzZNd.exe
  2⤵
  PID:15136
- C:\Windows\System\URRmNho.exe
  C:\Windows\System\URRmNho.exe
  2⤵
  PID:15168
- C:\Windows\System\VUIuNpA.exe
  C:\Windows\System\VUIuNpA.exe
  2⤵
  PID:15200
- C:\Windows\System\GSVICnV.exe
  C:\Windows\System\GSVICnV.exe
  2⤵
  PID:15224
- C:\Windows\System\qLkitYT.exe
  C:\Windows\System\qLkitYT.exe
  2⤵
  PID:15252
- C:\Windows\System\YACDVDI.exe
  C:\Windows\System\YACDVDI.exe
  2⤵
  PID:15280
- C:\Windows\System\OqIfnia.exe
  C:\Windows\System\OqIfnia.exe
  2⤵
  PID:15308
- C:\Windows\System\JgehHLz.exe
  C:\Windows\System\JgehHLz.exe
  2⤵
  PID:15328
- C:\Windows\System\mmlwjUj.exe
  C:\Windows\System\mmlwjUj.exe
  2⤵
  PID:15356
- C:\Windows\System\VxPdadZ.exe
  C:\Windows\System\VxPdadZ.exe
  2⤵
  PID:13956
- C:\Windows\System\rreECEu.exe
  C:\Windows\System\rreECEu.exe
  2⤵
  PID:14004
- C:\Windows\System\iWGqMwQ.exe
  C:\Windows\System\iWGqMwQ.exe
  2⤵
  PID:12848
- C:\Windows\System\gkhPioy.exe
  C:\Windows\System\gkhPioy.exe
  2⤵
  PID:14236
- C:\Windows\System\nbCrZXb.exe
  C:\Windows\System\nbCrZXb.exe
  2⤵
  PID:14180
- C:\Windows\System\FKjTWBI.exe
  C:\Windows\System\FKjTWBI.exe
  2⤵
  PID:14252
- C:\Windows\System\UhbeKOD.exe
  C:\Windows\System\UhbeKOD.exe
  2⤵
  PID:14392
- C:\Windows\System\pPptesD.exe
  C:\Windows\System\pPptesD.exe
  2⤵
  PID:14328
- C:\Windows\System\nWmZagM.exe
  C:\Windows\System\nWmZagM.exe
  2⤵
  PID:14476
- C:\Windows\System\yUrLzMS.exe
  C:\Windows\System\yUrLzMS.exe
  2⤵
  PID:13092
- C:\Windows\System\DnMeeVY.exe
  C:\Windows\System\DnMeeVY.exe
  2⤵
  PID:13724
- C:\Windows\System\MBHzCaB.exe
  C:\Windows\System\MBHzCaB.exe
  2⤵
  PID:13264
- C:\Windows\System\UHGAGTy.exe
  C:\Windows\System\UHGAGTy.exe
  2⤵
  PID:14344
- C:\Windows\System\SdItuBt.exe
  C:\Windows\System\SdItuBt.exe
  2⤵
  PID:14680
- C:\Windows\System\ceEHYyV.exe
  C:\Windows\System\ceEHYyV.exe
  2⤵
  PID:14732
- C:\Windows\System\ELnGSSH.exe
  C:\Windows\System\ELnGSSH.exe
  2⤵
  PID:14820
- C:\Windows\System\RKHAnjg.exe
  C:\Windows\System\RKHAnjg.exe
  2⤵
  PID:14900
- C:\Windows\System\LIjQdGl.exe
  C:\Windows\System\LIjQdGl.exe
  2⤵
  PID:14984
- C:\Windows\System\cqyTYYc.exe
  C:\Windows\System\cqyTYYc.exe
  2⤵
  PID:14588
- C:\Windows\System\qxIbpak.exe
  C:\Windows\System\qxIbpak.exe
  2⤵
  PID:14688
- C:\Windows\System\cXebrmV.exe
  C:\Windows\System\cXebrmV.exe
  2⤵
  PID:15208
- C:\Windows\System\rBOfDpz.exe
  C:\Windows\System\rBOfDpz.exe
  2⤵
  PID:14868
- C:\Windows\System\iCfKFwh.exe
  C:\Windows\System\iCfKFwh.exe
  2⤵
  PID:15380
- C:\Windows\System\aquVWsY.exe
  C:\Windows\System\aquVWsY.exe
  2⤵
  PID:15408
- C:\Windows\System\lVeOBlP.exe
  C:\Windows\System\lVeOBlP.exe
  2⤵
  PID:15436
- C:\Windows\System\GExZJas.exe
  C:\Windows\System\GExZJas.exe
  2⤵
  PID:15456
- C:\Windows\System\NHJYLOe.exe
  C:\Windows\System\NHJYLOe.exe
  2⤵
  PID:15488
- C:\Windows\System\oNPDfor.exe
  C:\Windows\System\oNPDfor.exe
  2⤵
  PID:15504
- C:\Windows\System\LJghBww.exe
  C:\Windows\System\LJghBww.exe
  2⤵
  PID:15528
- C:\Windows\System\QdImMfe.exe
  C:\Windows\System\QdImMfe.exe
  2⤵
  PID:15548
- C:\Windows\System\APsRoPz.exe
  C:\Windows\System\APsRoPz.exe
  2⤵
  PID:15572
- C:\Windows\System\acJnxWV.exe
  C:\Windows\System\acJnxWV.exe
  2⤵
  PID:15596
- C:\Windows\System\jXbziAj.exe
  C:\Windows\System\jXbziAj.exe
  2⤵
  PID:15628
- C:\Windows\System\PtcynWD.exe
  C:\Windows\System\PtcynWD.exe
  2⤵
  PID:15652
- C:\Windows\System\SbuBgHr.exe
  C:\Windows\System\SbuBgHr.exe
  2⤵
  PID:15676
- C:\Windows\System\hihyXVv.exe
  C:\Windows\System\hihyXVv.exe
  2⤵
  PID:15700
- C:\Windows\System\btObfUP.exe
  C:\Windows\System\btObfUP.exe
  2⤵
  PID:15720
- C:\Windows\System\eBqVUvh.exe
  C:\Windows\System\eBqVUvh.exe
  2⤵
  PID:15752
- C:\Windows\System\OFEAlgj.exe
  C:\Windows\System\OFEAlgj.exe
  2⤵
  PID:15772
- C:\Windows\System\OyUGzWD.exe
  C:\Windows\System\OyUGzWD.exe
  2⤵
  PID:15800
- C:\Windows\System\UExcuEC.exe
  C:\Windows\System\UExcuEC.exe
  2⤵
  PID:15820
- C:\Windows\System\VTMPwxV.exe
  C:\Windows\System\VTMPwxV.exe
  2⤵
  PID:15852
- C:\Windows\System\zNNcbLD.exe
  C:\Windows\System\zNNcbLD.exe
  2⤵
  PID:15876
- C:\Windows\System\GGPYckQ.exe
  C:\Windows\System\GGPYckQ.exe
  2⤵
  PID:15892
- C:\Windows\System\KRCpHzd.exe
  C:\Windows\System\KRCpHzd.exe
  2⤵
  PID:15920
- C:\Windows\System\WTmAfLx.exe
  C:\Windows\System\WTmAfLx.exe
  2⤵
  PID:15944
- C:\Windows\System\EMoiVWl.exe
  C:\Windows\System\EMoiVWl.exe
  2⤵
  PID:15980
- C:\Windows\System\tUnYFZr.exe
  C:\Windows\System\tUnYFZr.exe
  2⤵
  PID:16008
- C:\Windows\System\gANWPwC.exe
  C:\Windows\System\gANWPwC.exe
  2⤵
  PID:16036
- C:\Windows\System\iDzpUwo.exe
  C:\Windows\System\iDzpUwo.exe
  2⤵
  PID:16060
- C:\Windows\System\lViHEHh.exe
  C:\Windows\System\lViHEHh.exe
  2⤵
  PID:16088
- C:\Windows\System\HkJENXc.exe
  C:\Windows\System\HkJENXc.exe
  2⤵
  PID:16116
- C:\Windows\System\xTSDNWi.exe
  C:\Windows\System\xTSDNWi.exe
  2⤵
  PID:16140
- C:\Windows\System\UPvpqxe.exe
  C:\Windows\System\UPvpqxe.exe
  2⤵
  PID:16156
- C:\Windows\System\pMWPRKA.exe
  C:\Windows\System\pMWPRKA.exe
  2⤵
  PID:16172
- C:\Windows\System\xhDsqkT.exe
  C:\Windows\System\xhDsqkT.exe
  2⤵
  PID:16196
- C:\Windows\System\snlIhip.exe
  C:\Windows\System\snlIhip.exe
  2⤵
  PID:16224
- C:\Windows\System\IZUjVCi.exe
  C:\Windows\System\IZUjVCi.exe
  2⤵
  PID:16248
- C:\Windows\System\tTNLzFl.exe
  C:\Windows\System\tTNLzFl.exe
  2⤵
  PID:16272
- C:\Windows\System\mJEKUvA.exe
  C:\Windows\System\mJEKUvA.exe
  2⤵
  PID:16292
- C:\Windows\System\IZvSJsC.exe
  C:\Windows\System\IZvSJsC.exe
  2⤵
  PID:16324
- C:\Windows\System\fHlZnYf.exe
  C:\Windows\System\fHlZnYf.exe
  2⤵
  PID:16340
- C:\Windows\System\MidmnGp.exe
  C:\Windows\System\MidmnGp.exe
  2⤵
  PID:16356
- C:\Windows\System\fJFukyF.exe
  C:\Windows\System\fJFukyF.exe
  2⤵
  PID:16372
- C:\Windows\System\EzQsgpV.exe
  C:\Windows\System\EzQsgpV.exe
  2⤵
  PID:13852
- C:\Windows\System\lVrnxPD.exe
  C:\Windows\System\lVrnxPD.exe
  2⤵
  PID:12900
- C:\Windows\System\OuBQSYQ.exe
  C:\Windows\System\OuBQSYQ.exe
  2⤵
  PID:15084
- C:\Windows\System\IStAJwX.exe
  C:\Windows\System\IStAJwX.exe
  2⤵
  PID:14616
- C:\Windows\System\rTvJiRL.exe
  C:\Windows\System\rTvJiRL.exe
  2⤵
  PID:15180
- C:\Windows\System\xUhFnaM.exe
  C:\Windows\System\xUhFnaM.exe
  2⤵
  PID:14940
- C:\Windows\System\voFuxAW.exe
  C:\Windows\System\voFuxAW.exe
  2⤵
  PID:14560
- C:\Windows\System\fzuVHuw.exe
  C:\Windows\System\fzuVHuw.exe
  2⤵
  PID:15048
- C:\Windows\System\GKDnFjp.exe
  C:\Windows\System\GKDnFjp.exe
  2⤵
  PID:14664
- C:\Windows\System\fUXcjPf.exe
  C:\Windows\System\fUXcjPf.exe
  2⤵
  PID:15392
- C:\Windows\System\yHnUaiq.exe
  C:\Windows\System\yHnUaiq.exe
  2⤵
  PID:15404
- C:\Windows\System\iwgGOLd.exe
  C:\Windows\System\iwgGOLd.exe
  2⤵
  PID:15476
- C:\Windows\System\foAAiAY.exe
  C:\Windows\System\foAAiAY.exe
  2⤵
  PID:14300
- C:\Windows\System\cuNJVoE.exe
  C:\Windows\System\cuNJVoE.exe
  2⤵
  PID:14220
- C:\Windows\System\nypYKcv.exe
  C:\Windows\System\nypYKcv.exe
  2⤵
  PID:16056
- C:\Windows\System\xHCbGCP.exe
  C:\Windows\System\xHCbGCP.exe
  2⤵
  PID:14836
- C:\Windows\System\ArfKkrt.exe
  C:\Windows\System\ArfKkrt.exe
  2⤵
  PID:16084
- C:\Windows\System\wWNQZes.exe
  C:\Windows\System\wWNQZes.exe
  2⤵
  PID:13936
- C:\Windows\System\EjnDhOZ.exe
  C:\Windows\System\EjnDhOZ.exe
  2⤵
  PID:14276
- C:\Windows\System\MGgmgAI.exe
  C:\Windows\System\MGgmgAI.exe
  2⤵
  PID:16208
- C:\Windows\System\woVLTJJ.exe
  C:\Windows\System\woVLTJJ.exe
  2⤵
  PID:16288
- C:\Windows\System\ZHmvCgG.exe
  C:\Windows\System\ZHmvCgG.exe
  2⤵
  PID:15796
- C:\Windows\System\rqdJRIy.exe
  C:\Windows\System\rqdJRIy.exe
  2⤵
  PID:16332
- C:\Windows\System\TrpQuri.exe
  C:\Windows\System\TrpQuri.exe
  2⤵
  PID:15936
- C:\Windows\System\pJfpvla.exe
  C:\Windows\System\pJfpvla.exe
  2⤵
  PID:16408
- C:\Windows\System\SMjIYvi.exe
  C:\Windows\System\SMjIYvi.exe
  2⤵
  PID:16464
- C:\Windows\System\rqtmcgn.exe
  C:\Windows\System\rqtmcgn.exe
  2⤵
  PID:16496
- C:\Windows\System\rzjtaBQ.exe
  C:\Windows\System\rzjtaBQ.exe
  2⤵
  PID:16516
- C:\Windows\System\jfJERHD.exe
  C:\Windows\System\jfJERHD.exe
  2⤵
  PID:16532
- C:\Windows\System\KQedFJJ.exe
  C:\Windows\System\KQedFJJ.exe
  2⤵
  PID:16548
- C:\Windows\System\QbwUpxI.exe
  C:\Windows\System\QbwUpxI.exe
  2⤵
  PID:16584
- C:\Windows\System\icdhvGI.exe
  C:\Windows\System\icdhvGI.exe
  2⤵
  PID:16612
- C:\Windows\System\ctjYExj.exe
  C:\Windows\System\ctjYExj.exe
  2⤵
  PID:16632
- C:\Windows\System\tUlgvcw.exe
  C:\Windows\System\tUlgvcw.exe
  2⤵
  PID:16660
- C:\Windows\System\cHbdILa.exe
  C:\Windows\System\cHbdILa.exe
  2⤵
  PID:16692
- C:\Windows\System\ummxXFP.exe
  C:\Windows\System\ummxXFP.exe
  2⤵
  PID:16716
- C:\Windows\System\FUFXzOW.exe
  C:\Windows\System\FUFXzOW.exe
  2⤵
  PID:16756
- C:\Windows\System\xvIaBKU.exe
  C:\Windows\System\xvIaBKU.exe
  2⤵
  PID:16784
- C:\Windows\System\XMFMjXx.exe
  C:\Windows\System\XMFMjXx.exe
  2⤵
  PID:16828
- C:\Windows\System\xusAelj.exe
  C:\Windows\System\xusAelj.exe
  2⤵
  PID:16864
- C:\Windows\System\wWIDCDN.exe
  C:\Windows\System\wWIDCDN.exe
  2⤵
  PID:16904
- C:\Windows\System\riDObBl.exe
  C:\Windows\System\riDObBl.exe
  2⤵
  PID:16932
- C:\Windows\System\OxwFoOl.exe
  C:\Windows\System\OxwFoOl.exe
  2⤵
  PID:16960
- C:\Windows\System\HeHdXGQ.exe
  C:\Windows\System\HeHdXGQ.exe
  2⤵
  PID:16988
- C:\Windows\System\WnmxapJ.exe
  C:\Windows\System\WnmxapJ.exe
  2⤵
  PID:15568
- C:\Windows\System\ljLLNcO.exe
  C:\Windows\System\ljLLNcO.exe
  2⤵
  PID:14668
- C:\Windows\System\MbsscNB.exe
  C:\Windows\System\MbsscNB.exe
  2⤵
  PID:13396
- C:\Windows\System\wnwNWoP.exe
  C:\Windows\System\wnwNWoP.exe
  2⤵
  PID:15212
- C:\Windows\System\GwOZtFW.exe
  C:\Windows\System\GwOZtFW.exe
  2⤵
  PID:16808
- C:\Windows\System\uyURvBS.exe
  C:\Windows\System\uyURvBS.exe
  2⤵
  PID:16528
- C:\Windows\System\OOyunsK.exe
  C:\Windows\System\OOyunsK.exe
  2⤵
  PID:17088

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:17272

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\AtRKqVJ.exe

Filesize
1.4MB

MD5
a0548243aca8fda0485e8647cf3eee15

SHA1
744d60aa3b4a9a77e9bb8dbfee351327e4e8704a

SHA256
c59ad255c6322319d6f54733bec91710aafcac25101eb1703a17ac00d1468da4

SHA512
7803fd91939ec9811c84067bc8de22c06251f26063ff459c0529022815e3e530f8ec1b157091beae24a8aaf931940c2671730ce81d154700d5060d6446bf9b54

Download Submit
C:\Windows\System\BZtkgrX.exe

Filesize
1.4MB

MD5
9e49482eafc770e9eb65c3c2fded7050

SHA1
35f728d8bf69dd658c06c6e4d1628eda1b53c108

SHA256
51b3614262fa5dd7631d100871a299a7f2d8f10eed1033d4b5d0b12ca0d49f17

SHA512
6e911d1c1e8bad339fcd0795503ac51790d2812b67097f664491bf8391c4c81af145210518f5cc29764d6a47797c9e19eede3ea2c739c7b7b6cdc08ccfd51327

Download Submit
C:\Windows\System\BhiFvHy.exe

Filesize
1.4MB

MD5
364c9f1b8b38329fbb9e61bab2f87c5a

SHA1
9fba51a0c792920cffaec603daab21eac3b053df

SHA256
d76f7c67762f78817147e55a95c8e4133573f3d7a34281a6e3db24becc69262d

SHA512
8b7091f0503de9d65f1d32dc6c0182378d637df2afe53973fe24eec7ffb9e2a9d568b565050c2e3f7fb8c67731dd04e30e910d349265e16f18405db5196fe5a9

Download Submit
C:\Windows\System\DhoSVyb.exe

Filesize
1.4MB

MD5
952b10c53973ea6ae67be226be437de4

SHA1
257b9fd3fb0229bbccb511bc9644996505622b18

SHA256
c4b76fb9153fbb4a71d52cac70e210a0bc5fc7929afb01e935e45195a4d7feb0

SHA512
1b84b614bacdfc08a267f8a4a124ebb2ad646f5dd0473e610784f37c12225a2cc5d0771b42265be439bd37dd553d0ee952cf88c4e46ffd4132f0dcbb54eac87a

Download Submit
C:\Windows\System\FfiREfr.exe

Filesize
1.4MB

MD5
678b8eab49ff43c8d2631c673eb8dbee

SHA1
e81e688025ffd390f69442b6e561fccc5b5b26a9

SHA256
ce4f3ebfdd832acbce36a8e191692299147d0760e8ecb34da13db63a54185117

SHA512
c9c8bdcccca4f3698c251f10fbec0354489cfaa594f45ac8653fe6f0993d1d304e800de9be7b3bcdcaf10f0a1a462dd2e78ec878a6cf63659e60f22eafc3b220

Download Submit
C:\Windows\System\ITCnVOT.exe

Filesize
1.4MB

MD5
d9f28dac438f002a1250af9649cb5ff8

SHA1
bcce7df2c1486c4acafb9e9de38573a199faa449

SHA256
9e6d5653a240f907c308e125e0f49bc07f9bcc127a51b5a848285421e4152da1

SHA512
1d606fff5e4ec5c236108cdc0da45fa533e2bed8f533df7080ad359ecef42acaaac65806a804172bf1dc9f4457dbb710a3802a4bea82bcdac591abc37f76fb37

Download Submit
C:\Windows\System\KZIjUyV.exe

Filesize
1.4MB

MD5
e2e38791a732f7b1ce3d7c6312589d02

SHA1
f4bc0a0fb8d17e49debca16de2aba6a7fad5cf20

SHA256
024f407d91cc3de546db1ef39f26e547ddfe5badef79ec53a49b0e685c8becab

SHA512
d1ba4aa690f1d4fc3c06ff7255407e138de20adc3b7aa395605c0bf647ae2604c703f5af76305748c2552e3d5ae094b57ec42b741b7d950cd3a134af6d6eb9be

Download Submit
C:\Windows\System\KhlESTK.exe

Filesize
1.4MB

MD5
d616aed791d258d22c8b7c2767974f24

SHA1
335e2dd04df634de056d397ca1d3adb3c30e5cd2

SHA256
b8d7aa65faa37ef35b01aaf697b4e4fbeda70b187459ed43fcb1f4a3236ff64b

SHA512
a0394f9829c88f7623733e4cb80634186e52e88574dfdb5654bcb0d9af559ebfc81eb59b17a5c7e1d0ce210eabbb4a09d749421e8f9c0b94c9e246f28155c5be

Download Submit
C:\Windows\System\NNsNLeO.exe

Filesize
1.4MB

MD5
2e9f9a68ca61a359e3a793a454fc33d1

SHA1
a9dd69dcfff0894e637f365d02bf85249c82260c

SHA256
88540b14b41955f421e27c6097cf9b58edb9cae1b5a2c88d3e601d683fbe1b5b

SHA512
237091c8f62c256f18276a3af8f740c2e670fad1e56185d3684735837c2f435536c1140dbec639d53357e857b7dfd7ffe92b9889dc0c9a7f724afc34218b0132

Download Submit
C:\Windows\System\NXmdEWy.exe

Filesize
1.4MB

MD5
fce3b27939c358db4836ee1fa8fec2fb

SHA1
7e1fc6c7fb9844654a6094f4ad5c1558c5af13c9

SHA256
d0da13d98da18774d1601178258b2999189fa9b8a7d2699dea2727ccdcbae1d2

SHA512
79d1dd59b625731aab9cedbf6ba26cb81045707840d7a31d6a266dcc8584bcac47d42b2eb6919151dda090becb58efe3788290f89b53672c772ef8e1159734fa

Download Submit
C:\Windows\System\PKvPXCm.exe

Filesize
1.4MB

MD5
789e3140ebfbc2597178dce3d526ddfb

SHA1
267b610d630d1ebbc235520b4415dc5284a4f410

SHA256
4f5b3fa97a17c67262801977ea0e1a08d28ac445639990da7d56e6267783ebab

SHA512
46351e213d2df2ceb95bf4efd94139c447b4316aae8236169640c2ee616a940db98787409c25013720b1cc023b425e0e6d5d5900f66be4b3583ebb2e2dca3bac

Download Submit
C:\Windows\System\QKLRmXk.exe

Filesize
1.4MB

MD5
f4bcc237f6032acfeb533ebb808c7c65

SHA1
64ce2113fea58322ae33ece8467e174167cfc5e0

SHA256
db51e4b188e735adb33d6183375d5e681642ba82864a2e6ed96ac926b468f1ed

SHA512
baf73c63ca3eea9f95f06fcee4aa596720b44ec6fa32fae0fef81a4f6d6a7d4b40d1b0f77b0043a306c836832ac848d98cd47de2d26c552c0bb9995b597c3a2c

Download Submit
C:\Windows\System\SssZcTR.exe

Filesize
1.4MB

MD5
bde0b4eb346c2b78982e74a060908e9d

SHA1
8937dabcc1b85cf1087a9de9bec6fb4cb29429c2

SHA256
b758231c2b7ef9c3bcb0131be7c6a49bf7a1f22ee98ec2667bb915f05d9a76a3

SHA512
0e1b03bdbbf5ddc9076ad348ecb07743ba6086bdd1d36815ceb7b5ac5d880cee2f541b94d61fff7594cdfd09cc4214fc127d9980bf0f077b5ac0a7e2142dba16

Download Submit
C:\Windows\System\XGKuVqE.exe

Filesize
1.4MB

MD5
41183ad71171f6c7d1be2d46bcf59454

SHA1
5013e452e547546fd1443bb5079ed914c6d0954f

SHA256
af55b2e650907fe61bce21b54d071336e322648de9c187f15ad21ea5e342b356

SHA512
236904023d112e7c57738b517d9a8b7fadbe29ea094cd577362f919479828f6e8f3bfa99c3dfc47182ea7bca607761882ad9f5cd90a9100f6242d9b8d0314de6

Download Submit
C:\Windows\System\YRLyjJB.exe

Filesize
1.4MB

MD5
c46216553bbc619599f7d1541c5c301d

SHA1
146286976711688a5989db5c51f7cf771f3f6a50

SHA256
9f75ece99bf431b5dd6eaf754a3d0647f4ac1e8d49a5b8efcd171defc8a2ac8d

SHA512
20335afdc5e225f28a7bc68f316f6d2908b77c72f044bfd52fd6ec1573bd1b431e63f5bed4952acfcd41a2aca380c3d5d33a3b5f45826f923f73b652a05706d8

Download Submit
C:\Windows\System\ZjCJqPA.exe

Filesize
1.4MB

MD5
621eb7c4b89a79cee694454419942642

SHA1
e763a13abde0bbd23e88460640caeeacc7e6ca06

SHA256
daafa633d7b2cb27ae54646534c8f41047d0fc27478ffdd27b9def06beac5ddd

SHA512
42bbecde61e8f4aeb4a34b84aaff0ff785cd031e9b7ec8a58d817294933f99b2542bdd0961fe6f3fe0097a2b861b8f44effaf22ddc473015db2ccd5cf1d43bc3

Download Submit
C:\Windows\System\aMyNpKh.exe

Filesize
1.4MB

MD5
99aa41274f285b697d2fa821382b82e4

SHA1
4c641a01c0ee071e0c813082b0329ff8f9d8c295

SHA256
ed09c2143e3cde28007f5165c7175d51b76856dd784a0445f8e8c4c9f3b10110

SHA512
a60bfdbcb04dd63c22ad09835cfa521c505d7c0d756c55a1278e78f0b3a19235781f27d4b270df0b0b6aea188d5e7f7ba14c40e38201cb0217bfe34dabc6cb85

Download Submit
C:\Windows\System\agtbSBz.exe

Filesize
1.4MB

MD5
ecf3a0da5a44052dfef86ef57346f3b1

SHA1
35a84b61e594c98e1d1975f3518dc28621a1a2bf

SHA256
a1c345650811c2ff9ceb2fcf5864e0bc37ded4a76c2b3786dee0787d226eb73e

SHA512
9455e2e3ebf113d329b6c3552e472e4da7270aeaa7bb23abb8a2e130a73d2751c63ec6db80c2e5a0695137e19505cd6b7d77a3d42ab63dcac7479d2eadf8ec65

Download Submit
C:\Windows\System\cVdeWEs.exe

Filesize
1.4MB

MD5
4278d0ae032ea20a601a975718722011

SHA1
01cd4fd338a4ff82e1271cde0539a7750f18ffea

SHA256
8f7e3bc51be24c7439cc2a8a11e40a5dd16f9a8df9a60900a4eda9b2cc6d4404

SHA512
8955de33657feed3bb4e8ae9ec266b29c0f82093ea2c8f011459eaafaadd8672ecf6693fefd280a261189efb3f2b737b3d333d21f786f754e6efa371fc86b1a6

Download Submit
C:\Windows\System\cflTEHy.exe

Filesize
1.4MB

MD5
a3723a7f8ad73170c17c62def1e52222

SHA1
d23748904527fdc9658c86def61ad107332f20b3

SHA256
b3058ee55eb88c2ec5c559b01afd251004d83fc77efe33ffd3f49afef7cc3a89

SHA512
405637b0b6874a3a4fa9ae929dc0aa732c10d5488e5e4dadb4a59bfe94ea0a27da79d7ec9dcaadfd661d4149870e03aa1bc5abe6cffb6f16bef755fe2f7c7cf9

Download Submit
C:\Windows\System\ebsoElm.exe

Filesize
1.4MB

MD5
a72ab1fc37146054de4a3ed84904c904

SHA1
11a729f49ab103034dd186d2cf69f3c7a66c9106

SHA256
97f4f044f311eaf19efd711e58a2c6194c723f3920a28c84add678f8cfabf854

SHA512
62647945f7f4de946feb5e67e61af1f085ab1a6f6dafb22e78dd47879a2468b06a33605ca21092126ef5af8c011a8570e5aa0f82f346d212a635324e8df17309

Download Submit
C:\Windows\System\gNVuBvt.exe

Filesize
1.4MB

MD5
fb4fda2b6c2f1163d27c761cd35a9fa6

SHA1
3b4002900572767aed220700892e01679a65c613

SHA256
6492920c97c13e5524d7109334e1eb4e79ba836ceff5d30f2ca179f596752e5d

SHA512
3202dce0a330c44dc4219e0579707000b4dde6036d1235047023ab0aaad7ba3a2dd56049a9125546af818f5c041ac3f31ac69f68a6e9476c611e32e397c50a23

Download Submit
C:\Windows\System\jPNVzso.exe

Filesize
1.4MB

MD5
59c3f72fb11087c9d36079712b84dc34

SHA1
abda5c566fa81a620f2a2d6394e2ac7f4bc81e8c

SHA256
bf479060e439771146b4e757583079165d6d73ebe2d4290ff4d1fd4023ede96e

SHA512
2096c1551a11832b0c588af9c7762f0c6156e5d2e2b28d4d68d2591d19db4b855b420ef35cf4861b3496a68d330ec8f0c49e76f6439efa910fa2223e3dd2cff2

Download Submit
C:\Windows\System\lcjhJIO.exe

Filesize
1.4MB

MD5
b92a93e8f4833293e0b338ee1dd6537a

SHA1
11054c4145020ca0e6b75af052ba13d43669d776

SHA256
aa12a3ec2edf5e8e4b9ff1b02c22bf25527b0968c45d6adb89646617c74724c4

SHA512
6023b9c36945788799e2679dcfb820ad42026057113ede9ea866952a0bfc3b53fac92b3b9115383624056f8b2aa32388ee1572eccbdc2193ea8ba2b398cd65cc

Download Submit
C:\Windows\System\mLeaYdH.exe

Filesize
1.4MB

MD5
5909838e63d4937a8b3e3050c28d7ddf

SHA1
ba4c36a4f0dd34c1fa59025d57195e00e816d8de

SHA256
1b98b78e8e65554fbf358f766142029d1bb4adc215f9d42e0ca9d316e42bbf9b

SHA512
b36a75043cb347b422690adc68dd02ce696d2f3d544bac084ff3c815f5ac406450ae332675b820fe7f98a6c98f4618b7fa72a1feb1016c00681cc2ad63e4eb21

Download Submit
C:\Windows\System\nNXzsjl.exe

Filesize
1.4MB

MD5
11eab67e4d282ffad60f1529d5e5a477

SHA1
80e5240565e72ed0a415d85a7eef2d119b0e49fc

SHA256
2241f57bf5d6fbf50314bc8ea3e9be14cc549a18573eb3e831903be259530607

SHA512
d4e239b987d87c56746b4204ca6a290899c61d59864e8bea53cbf2ba122d70646eec3e51c2cadab26b3cdff173f84da7ee8adcbf0cba47188d11062bf4b3bf65

Download Submit
C:\Windows\System\nqANVGX.exe

Filesize
1.4MB

MD5
48fc75a47ed45c9d1498ae6448d93eee

SHA1
44d6143b0b11ec15963bbbe160b242358310513b

SHA256
7c7ba850626ed8fbeafb9e5df1a94cfc4209a4a4c6b6117ee4c412eac6a69862

SHA512
8c969ce09965567256efb0176bb614cf2ed1b963f84bf18896c54a8d0dacd095241860d277c787ab960c467e0f25df6392559e6f291b3b3cf907300634929fb5

Download Submit
C:\Windows\System\oFgYRfk.exe

Filesize
1.4MB

MD5
f3f709611490dde25e2f51686103a004

SHA1
cfbfdafd8c616ada255557671f5f0cd49d30262f

SHA256
0f3b06924b045125f6c38d4f1eb90acc152251a3e5fdf3caf6b459cdafd0f1b6

SHA512
eaee8c875d2acae0a24cf276f9b72aad3327fb567264e6db2aa06f3fe5b80922ff9f145f705c8732a273e4e55f766cf12cba17614fcd716b01b0669159db00e9

Download Submit
C:\Windows\System\puNcOJS.exe

Filesize
1.4MB

MD5
6aed4c50fb0376873a06bb8cceecd45a

SHA1
d97c0ee5ca07ea7666c1bcf4b6d6d7536cc2e47a

SHA256
8b0b0c95cd9f0e1e3d1bbef4ea8c22e39ca25656d3d11176744fa0134aa21168

SHA512
61493e30569eaa5aea06facc8c3d8c0f76f0a110659474efc2f7fa7bd3e6ee85fcfe7b0f2edfdb90d1a54570093dbb914123b40581c078aa57bf8556a7f9046d

Download Submit
C:\Windows\System\tQlxGFO.exe

Filesize
1.4MB

MD5
2245c74850f2868f653e837638e7ba1d

SHA1
0d273c35b017593e67580fb3a7a2ba85b45b651e

SHA256
d988ddaf5770e6532fac478de09c5aa94ffd6ad4830260ccb13b188ca428fdca

SHA512
d25e167cb3d0b89aa86682cc8fa238aeb327ad45a1b44feb1652ae97d331535d57e07a9e8766132e5807d52cd5704ac8b756147a75e2b6e07c34e99661d6abba

Download Submit
C:\Windows\System\uelbiiD.exe

Filesize
1.4MB

MD5
e29a5aa5c03abe4d21a6e9b5047d9073

SHA1
c1da11ed0d40f35be31d4b011d67775081e364e0

SHA256
815668682b94508243cc7752e0e2e0ffa7d9b184ebe824c614b886d170ec3379

SHA512
c62bb2629cedfc55584733598f2acc5efc490060ce55f76ee98ac8071e0f79af4730ca7aa98534c12d7116d8313cd41bf376c3df757faf0033cea9f2cca1eb2d

Download Submit
C:\Windows\System\wnUrqmE.exe

Filesize
1.4MB

MD5
19a0eae77a9a0af93a3e0565f84c50a5

SHA1
6688c7ec3ba5af8b8411670528622a87ef59cac1

SHA256
b7d4151638f2b4cd87c8d322d20ac13f2c405ed2f4a0f64d1ee67cfb479c4240

SHA512
2b5349d337fa8b1c893a4d684feaa18b2657b7d8197c21583bd0351e7406636067e7769b2ee06bb9b5e909fb5a56102a5dc438cb589ae79c69a17d0efcc2a5e8

Download Submit
memory/2808-0-0x000002E4B9410000-0x000002E4B9420000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads