xmrig | 9b0a4be68d05687da20e67891dbfcc4e3e655f5d23fe950c8aba71e0a2225dbc

Analysis

max time kernel
123s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
26/01/2025, 02:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9b0a4be68d05687da20e67891dbfcc4e3e655f5d23fe950c8aba71e0a2225dbc.exe
Size

1.6MB
MD5

1c53e9a6e9194b5c597ccbe2647889e3
SHA1

0456e4567f4f418ecc05972a11937fd3039f1d5a
SHA256

9b0a4be68d05687da20e67891dbfcc4e3e655f5d23fe950c8aba71e0a2225dbc
SHA512

efd306335f878f1c12902e48a150c2965ff7f11ef520e3907d09308de52ecb40dc0ca292cf08043c57cef0bbe879448d0ac23f9a7627f904b1c2abadfe7d293c
SSDEEP

49152:GezaTF8FcNkNdfE0pZ9ozttwIRxjaXdbxRzyCmrBGP:GemTLkNdfE0pZyU

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 35 IoCs

miner

resource	yara_rule
behavioral2/files/0x000a000000023c07-4.dat	xmrig
behavioral2/files/0x0007000000023cae-10.dat	xmrig
behavioral2/files/0x0007000000023cb0-19.dat	xmrig
behavioral2/files/0x0007000000023caf-15.dat	xmrig
behavioral2/files/0x0007000000023cb1-23.dat	xmrig
behavioral2/files/0x0007000000023cb2-31.dat	xmrig
behavioral2/files/0x0007000000023cb4-39.dat	xmrig
behavioral2/files/0x0007000000023cb5-42.dat	xmrig
behavioral2/files/0x0007000000023cb6-48.dat	xmrig
behavioral2/files/0x0007000000023cb7-55.dat	xmrig
behavioral2/files/0x0007000000023cb3-40.dat	xmrig
behavioral2/files/0x0008000000023cab-59.dat	xmrig
behavioral2/files/0x0007000000023cb8-65.dat	xmrig
behavioral2/files/0x0007000000023cba-72.dat	xmrig
behavioral2/files/0x0007000000023cbb-78.dat	xmrig
behavioral2/files/0x0007000000023cbe-92.dat	xmrig
behavioral2/files/0x0007000000023cc3-110.dat	xmrig
behavioral2/files/0x0007000000023cc8-127.dat	xmrig
behavioral2/files/0x0007000000023cca-137.dat	xmrig
behavioral2/files/0x0007000000023cc2-159.dat	xmrig
behavioral2/files/0x0007000000023cc6-165.dat	xmrig
behavioral2/files/0x0007000000023cc5-164.dat	xmrig
behavioral2/files/0x0007000000023cc4-162.dat	xmrig
behavioral2/files/0x0007000000023cc1-157.dat	xmrig
behavioral2/files/0x0007000000023cc0-155.dat	xmrig
behavioral2/files/0x0007000000023cbf-153.dat	xmrig
behavioral2/files/0x0007000000023cce-152.dat	xmrig
behavioral2/files/0x0007000000023ccd-151.dat	xmrig
behavioral2/files/0x0007000000023ccc-145.dat	xmrig
behavioral2/files/0x0007000000023ccb-144.dat	xmrig
behavioral2/files/0x0007000000023cc7-140.dat	xmrig
behavioral2/files/0x0007000000023cc9-134.dat	xmrig
behavioral2/files/0x0007000000023cbd-96.dat	xmrig
behavioral2/files/0x0007000000023cbc-83.dat	xmrig
behavioral2/files/0x0007000000023cb9-73.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
4064	CBySDRX.exe
1296	QwbTPzD.exe
728	cYdDUfH.exe
1980	EVifddW.exe
3184	vQKaaYS.exe
1444	YacMAHa.exe
3088	OwMYEfK.exe
3704	PfirkdG.exe
1728	YxJBQLQ.exe
3488	ktrVTCu.exe
4940	WkSGsYo.exe
1000	LeIZjLv.exe
3996	cUWrkAN.exe
3460	UytGQQd.exe
2364	hWLYAgk.exe
2928	ZypnuLT.exe
1668	amakOWX.exe
4028	iZZnEMx.exe
3772	AQzAUBI.exe
4840	dXEgvce.exe
4492	lrUunsb.exe
3496	CEKCfDa.exe
1896	geBcqRJ.exe
2108	FONZdRF.exe
4384	XLzpdIo.exe
4440	jJcZAXj.exe
2172	XsxLlwM.exe
3896	dLrnXNQ.exe
4548	lonUcOf.exe
3168	GtvTtAk.exe
4692	pUdndED.exe
4260	lklWxVM.exe
4920	gNyMtNU.exe
3952	zfUGbFJ.exe
3904	pdRPEDu.exe
3124	njSqXsJ.exe
3756	hjWgwJk.exe
2824	ZIERDHe.exe
1164	edLODsj.exe
872	vDxcQjx.exe
4980	zIsWvlh.exe
4388	wFIsFuG.exe
4088	KBfyAci.exe
532	wUhBwyo.exe
4824	nmSllab.exe
3920	sBwJHTM.exe
1448	krgHaTS.exe
5000	cLlpDjp.exe
1080	eKPuZbR.exe
4368	esLVwkR.exe
552	DuyYUEv.exe
3648	CErQPtm.exe
3048	zOrcIRN.exe
2428	RtxNwue.exe
908	EKkpomC.exe
4220	KyeqYNe.exe
2692	KRANxJG.exe
3112	hwrVqYO.exe
4532	YkAhtFo.exe
4732	CzmpZcH.exe
2132	VetBNLK.exe
2604	gQuKUYn.exe
3292	aQEZLEL.exe
1976	vhsnXWC.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\nvRefLT.exe	9b0a4be68d05687da20e67891dbfcc4e3e655f5d23fe950c8aba71e0a2225dbc.exe
File created	C:\Windows\System\mITaEoT.exe	9b0a4be68d05687da20e67891dbfcc4e3e655f5d23fe950c8aba71e0a2225dbc.exe
File created	C:\Windows\System\PcFrTdE.exe	9b0a4be68d05687da20e67891dbfcc4e3e655f5d23fe950c8aba71e0a2225dbc.exe
File created	C:\Windows\System\jKsZKXh.exe	9b0a4be68d05687da20e67891dbfcc4e3e655f5d23fe950c8aba71e0a2225dbc.exe
File created	C:\Windows\System\FpLOcnW.exe	9b0a4be68d05687da20e67891dbfcc4e3e655f5d23fe950c8aba71e0a2225dbc.exe
File created	C:\Windows\System\meDTNWR.exe	9b0a4be68d05687da20e67891dbfcc4e3e655f5d23fe950c8aba71e0a2225dbc.exe
File created	C:\Windows\System\rkrFwtn.exe	9b0a4be68d05687da20e67891dbfcc4e3e655f5d23fe950c8aba71e0a2225dbc.exe
File created	C:\Windows\System\fZKFFHO.exe	9b0a4be68d05687da20e67891dbfcc4e3e655f5d23fe950c8aba71e0a2225dbc.exe
File created	C:\Windows\System\GXOGgwZ.exe	9b0a4be68d05687da20e67891dbfcc4e3e655f5d23fe950c8aba71e0a2225dbc.exe
File created	C:\Windows\System\OjCXwdU.exe	9b0a4be68d05687da20e67891dbfcc4e3e655f5d23fe950c8aba71e0a2225dbc.exe
File created	C:\Windows\System\kXJJykR.exe	9b0a4be68d05687da20e67891dbfcc4e3e655f5d23fe950c8aba71e0a2225dbc.exe
File created	C:\Windows\System\dXEgvce.exe	9b0a4be68d05687da20e67891dbfcc4e3e655f5d23fe950c8aba71e0a2225dbc.exe
File created	C:\Windows\System\jXuDAcS.exe	9b0a4be68d05687da20e67891dbfcc4e3e655f5d23fe950c8aba71e0a2225dbc.exe
File created	C:\Windows\System\urxIGSF.exe	9b0a4be68d05687da20e67891dbfcc4e3e655f5d23fe950c8aba71e0a2225dbc.exe
File created	C:\Windows\System\QrUiaFs.exe	9b0a4be68d05687da20e67891dbfcc4e3e655f5d23fe950c8aba71e0a2225dbc.exe
File created	C:\Windows\System\ISklyku.exe	9b0a4be68d05687da20e67891dbfcc4e3e655f5d23fe950c8aba71e0a2225dbc.exe
File created	C:\Windows\System\HdYHmGd.exe	9b0a4be68d05687da20e67891dbfcc4e3e655f5d23fe950c8aba71e0a2225dbc.exe
File created	C:\Windows\System\EGbQLci.exe	9b0a4be68d05687da20e67891dbfcc4e3e655f5d23fe950c8aba71e0a2225dbc.exe
File created	C:\Windows\System\ZYkhkue.exe	9b0a4be68d05687da20e67891dbfcc4e3e655f5d23fe950c8aba71e0a2225dbc.exe
File created	C:\Windows\System\JwFOjll.exe	9b0a4be68d05687da20e67891dbfcc4e3e655f5d23fe950c8aba71e0a2225dbc.exe
File created	C:\Windows\System\CBRmaNo.exe	9b0a4be68d05687da20e67891dbfcc4e3e655f5d23fe950c8aba71e0a2225dbc.exe
File created	C:\Windows\System\klRHYmb.exe	9b0a4be68d05687da20e67891dbfcc4e3e655f5d23fe950c8aba71e0a2225dbc.exe
File created	C:\Windows\System\WowgXPX.exe	9b0a4be68d05687da20e67891dbfcc4e3e655f5d23fe950c8aba71e0a2225dbc.exe
File created	C:\Windows\System\JBqPZWa.exe	9b0a4be68d05687da20e67891dbfcc4e3e655f5d23fe950c8aba71e0a2225dbc.exe
File created	C:\Windows\System\IGyISSD.exe	9b0a4be68d05687da20e67891dbfcc4e3e655f5d23fe950c8aba71e0a2225dbc.exe
File created	C:\Windows\System\OAQKCJL.exe	9b0a4be68d05687da20e67891dbfcc4e3e655f5d23fe950c8aba71e0a2225dbc.exe
File created	C:\Windows\System\wrbLGsC.exe	9b0a4be68d05687da20e67891dbfcc4e3e655f5d23fe950c8aba71e0a2225dbc.exe
File created	C:\Windows\System\gNnsqLB.exe	9b0a4be68d05687da20e67891dbfcc4e3e655f5d23fe950c8aba71e0a2225dbc.exe
File created	C:\Windows\System\StqUnuG.exe	9b0a4be68d05687da20e67891dbfcc4e3e655f5d23fe950c8aba71e0a2225dbc.exe
File created	C:\Windows\System\BwKRxyk.exe	9b0a4be68d05687da20e67891dbfcc4e3e655f5d23fe950c8aba71e0a2225dbc.exe
File created	C:\Windows\System\lklWxVM.exe	9b0a4be68d05687da20e67891dbfcc4e3e655f5d23fe950c8aba71e0a2225dbc.exe
File created	C:\Windows\System\URjsjTw.exe	9b0a4be68d05687da20e67891dbfcc4e3e655f5d23fe950c8aba71e0a2225dbc.exe
File created	C:\Windows\System\kkWTPcV.exe	9b0a4be68d05687da20e67891dbfcc4e3e655f5d23fe950c8aba71e0a2225dbc.exe
File created	C:\Windows\System\LnJlxgi.exe	9b0a4be68d05687da20e67891dbfcc4e3e655f5d23fe950c8aba71e0a2225dbc.exe
File created	C:\Windows\System\amakOWX.exe	9b0a4be68d05687da20e67891dbfcc4e3e655f5d23fe950c8aba71e0a2225dbc.exe
File created	C:\Windows\System\zcSDcDQ.exe	9b0a4be68d05687da20e67891dbfcc4e3e655f5d23fe950c8aba71e0a2225dbc.exe
File created	C:\Windows\System\cfYZxSe.exe	9b0a4be68d05687da20e67891dbfcc4e3e655f5d23fe950c8aba71e0a2225dbc.exe
File created	C:\Windows\System\XFTBuDy.exe	9b0a4be68d05687da20e67891dbfcc4e3e655f5d23fe950c8aba71e0a2225dbc.exe
File created	C:\Windows\System\TfVAqHs.exe	9b0a4be68d05687da20e67891dbfcc4e3e655f5d23fe950c8aba71e0a2225dbc.exe
File created	C:\Windows\System\CoIVdcq.exe	9b0a4be68d05687da20e67891dbfcc4e3e655f5d23fe950c8aba71e0a2225dbc.exe
File created	C:\Windows\System\iZKgqAU.exe	9b0a4be68d05687da20e67891dbfcc4e3e655f5d23fe950c8aba71e0a2225dbc.exe
File created	C:\Windows\System\XTcOusw.exe	9b0a4be68d05687da20e67891dbfcc4e3e655f5d23fe950c8aba71e0a2225dbc.exe
File created	C:\Windows\System\MwTiBaI.exe	9b0a4be68d05687da20e67891dbfcc4e3e655f5d23fe950c8aba71e0a2225dbc.exe
File created	C:\Windows\System\lxIXwSp.exe	9b0a4be68d05687da20e67891dbfcc4e3e655f5d23fe950c8aba71e0a2225dbc.exe
File created	C:\Windows\System\sqzzmji.exe	9b0a4be68d05687da20e67891dbfcc4e3e655f5d23fe950c8aba71e0a2225dbc.exe
File created	C:\Windows\System\HawSGlq.exe	9b0a4be68d05687da20e67891dbfcc4e3e655f5d23fe950c8aba71e0a2225dbc.exe
File created	C:\Windows\System\ZZJMgsq.exe	9b0a4be68d05687da20e67891dbfcc4e3e655f5d23fe950c8aba71e0a2225dbc.exe
File created	C:\Windows\System\vEtISuW.exe	9b0a4be68d05687da20e67891dbfcc4e3e655f5d23fe950c8aba71e0a2225dbc.exe
File created	C:\Windows\System\zIsWvlh.exe	9b0a4be68d05687da20e67891dbfcc4e3e655f5d23fe950c8aba71e0a2225dbc.exe
File created	C:\Windows\System\DoFkxqa.exe	9b0a4be68d05687da20e67891dbfcc4e3e655f5d23fe950c8aba71e0a2225dbc.exe
File created	C:\Windows\System\OwMYEfK.exe	9b0a4be68d05687da20e67891dbfcc4e3e655f5d23fe950c8aba71e0a2225dbc.exe
File created	C:\Windows\System\rkPpkTQ.exe	9b0a4be68d05687da20e67891dbfcc4e3e655f5d23fe950c8aba71e0a2225dbc.exe
File created	C:\Windows\System\QwbTPzD.exe	9b0a4be68d05687da20e67891dbfcc4e3e655f5d23fe950c8aba71e0a2225dbc.exe
File created	C:\Windows\System\vmrDXFh.exe	9b0a4be68d05687da20e67891dbfcc4e3e655f5d23fe950c8aba71e0a2225dbc.exe
File created	C:\Windows\System\hdDednB.exe	9b0a4be68d05687da20e67891dbfcc4e3e655f5d23fe950c8aba71e0a2225dbc.exe
File created	C:\Windows\System\CleSBXt.exe	9b0a4be68d05687da20e67891dbfcc4e3e655f5d23fe950c8aba71e0a2225dbc.exe
File created	C:\Windows\System\BYtzfTi.exe	9b0a4be68d05687da20e67891dbfcc4e3e655f5d23fe950c8aba71e0a2225dbc.exe
File created	C:\Windows\System\FpZHlbK.exe	9b0a4be68d05687da20e67891dbfcc4e3e655f5d23fe950c8aba71e0a2225dbc.exe
File created	C:\Windows\System\qIWljWn.exe	9b0a4be68d05687da20e67891dbfcc4e3e655f5d23fe950c8aba71e0a2225dbc.exe
File created	C:\Windows\System\TPhemBz.exe	9b0a4be68d05687da20e67891dbfcc4e3e655f5d23fe950c8aba71e0a2225dbc.exe
File created	C:\Windows\System\nDphjyB.exe	9b0a4be68d05687da20e67891dbfcc4e3e655f5d23fe950c8aba71e0a2225dbc.exe
File created	C:\Windows\System\BpCWIXl.exe	9b0a4be68d05687da20e67891dbfcc4e3e655f5d23fe950c8aba71e0a2225dbc.exe
File created	C:\Windows\System\cUWrkAN.exe	9b0a4be68d05687da20e67891dbfcc4e3e655f5d23fe950c8aba71e0a2225dbc.exe
File created	C:\Windows\System\ddzMmIb.exe	9b0a4be68d05687da20e67891dbfcc4e3e655f5d23fe950c8aba71e0a2225dbc.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	17184	dwm.exe
Token: SeChangeNotifyPrivilege	17184	dwm.exe
Token: 33	17184	dwm.exe
Token: SeIncBasePriorityPrivilege	17184	dwm.exe
Token: SeShutdownPrivilege	17184	dwm.exe
Token: SeCreatePagefilePrivilege	17184	dwm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4592 wrote to memory of 4064	4592	9b0a4be68d05687da20e67891dbfcc4e3e655f5d23fe950c8aba71e0a2225dbc.exe	84
PID 4592 wrote to memory of 4064	4592	9b0a4be68d05687da20e67891dbfcc4e3e655f5d23fe950c8aba71e0a2225dbc.exe	84
PID 4592 wrote to memory of 1296	4592	9b0a4be68d05687da20e67891dbfcc4e3e655f5d23fe950c8aba71e0a2225dbc.exe	85
PID 4592 wrote to memory of 1296	4592	9b0a4be68d05687da20e67891dbfcc4e3e655f5d23fe950c8aba71e0a2225dbc.exe	85
PID 4592 wrote to memory of 728	4592	9b0a4be68d05687da20e67891dbfcc4e3e655f5d23fe950c8aba71e0a2225dbc.exe	86
PID 4592 wrote to memory of 728	4592	9b0a4be68d05687da20e67891dbfcc4e3e655f5d23fe950c8aba71e0a2225dbc.exe	86
PID 4592 wrote to memory of 1980	4592	9b0a4be68d05687da20e67891dbfcc4e3e655f5d23fe950c8aba71e0a2225dbc.exe	87
PID 4592 wrote to memory of 1980	4592	9b0a4be68d05687da20e67891dbfcc4e3e655f5d23fe950c8aba71e0a2225dbc.exe	87
PID 4592 wrote to memory of 3184	4592	9b0a4be68d05687da20e67891dbfcc4e3e655f5d23fe950c8aba71e0a2225dbc.exe	88
PID 4592 wrote to memory of 3184	4592	9b0a4be68d05687da20e67891dbfcc4e3e655f5d23fe950c8aba71e0a2225dbc.exe	88
PID 4592 wrote to memory of 1444	4592	9b0a4be68d05687da20e67891dbfcc4e3e655f5d23fe950c8aba71e0a2225dbc.exe	89
PID 4592 wrote to memory of 1444	4592	9b0a4be68d05687da20e67891dbfcc4e3e655f5d23fe950c8aba71e0a2225dbc.exe	89
PID 4592 wrote to memory of 3088	4592	9b0a4be68d05687da20e67891dbfcc4e3e655f5d23fe950c8aba71e0a2225dbc.exe	90
PID 4592 wrote to memory of 3088	4592	9b0a4be68d05687da20e67891dbfcc4e3e655f5d23fe950c8aba71e0a2225dbc.exe	90
PID 4592 wrote to memory of 3704	4592	9b0a4be68d05687da20e67891dbfcc4e3e655f5d23fe950c8aba71e0a2225dbc.exe	91
PID 4592 wrote to memory of 3704	4592	9b0a4be68d05687da20e67891dbfcc4e3e655f5d23fe950c8aba71e0a2225dbc.exe	91
PID 4592 wrote to memory of 1728	4592	9b0a4be68d05687da20e67891dbfcc4e3e655f5d23fe950c8aba71e0a2225dbc.exe	92
PID 4592 wrote to memory of 1728	4592	9b0a4be68d05687da20e67891dbfcc4e3e655f5d23fe950c8aba71e0a2225dbc.exe	92
PID 4592 wrote to memory of 3488	4592	9b0a4be68d05687da20e67891dbfcc4e3e655f5d23fe950c8aba71e0a2225dbc.exe	93
PID 4592 wrote to memory of 3488	4592	9b0a4be68d05687da20e67891dbfcc4e3e655f5d23fe950c8aba71e0a2225dbc.exe	93
PID 4592 wrote to memory of 4940	4592	9b0a4be68d05687da20e67891dbfcc4e3e655f5d23fe950c8aba71e0a2225dbc.exe	94
PID 4592 wrote to memory of 4940	4592	9b0a4be68d05687da20e67891dbfcc4e3e655f5d23fe950c8aba71e0a2225dbc.exe	94
PID 4592 wrote to memory of 1000	4592	9b0a4be68d05687da20e67891dbfcc4e3e655f5d23fe950c8aba71e0a2225dbc.exe	95
PID 4592 wrote to memory of 1000	4592	9b0a4be68d05687da20e67891dbfcc4e3e655f5d23fe950c8aba71e0a2225dbc.exe	95
PID 4592 wrote to memory of 3996	4592	9b0a4be68d05687da20e67891dbfcc4e3e655f5d23fe950c8aba71e0a2225dbc.exe	96
PID 4592 wrote to memory of 3996	4592	9b0a4be68d05687da20e67891dbfcc4e3e655f5d23fe950c8aba71e0a2225dbc.exe	96
PID 4592 wrote to memory of 3460	4592	9b0a4be68d05687da20e67891dbfcc4e3e655f5d23fe950c8aba71e0a2225dbc.exe	97
PID 4592 wrote to memory of 3460	4592	9b0a4be68d05687da20e67891dbfcc4e3e655f5d23fe950c8aba71e0a2225dbc.exe	97
PID 4592 wrote to memory of 2364	4592	9b0a4be68d05687da20e67891dbfcc4e3e655f5d23fe950c8aba71e0a2225dbc.exe	98
PID 4592 wrote to memory of 2364	4592	9b0a4be68d05687da20e67891dbfcc4e3e655f5d23fe950c8aba71e0a2225dbc.exe	98
PID 4592 wrote to memory of 2928	4592	9b0a4be68d05687da20e67891dbfcc4e3e655f5d23fe950c8aba71e0a2225dbc.exe	99
PID 4592 wrote to memory of 2928	4592	9b0a4be68d05687da20e67891dbfcc4e3e655f5d23fe950c8aba71e0a2225dbc.exe	99
PID 4592 wrote to memory of 1668	4592	9b0a4be68d05687da20e67891dbfcc4e3e655f5d23fe950c8aba71e0a2225dbc.exe	100
PID 4592 wrote to memory of 1668	4592	9b0a4be68d05687da20e67891dbfcc4e3e655f5d23fe950c8aba71e0a2225dbc.exe	100
PID 4592 wrote to memory of 4028	4592	9b0a4be68d05687da20e67891dbfcc4e3e655f5d23fe950c8aba71e0a2225dbc.exe	101
PID 4592 wrote to memory of 4028	4592	9b0a4be68d05687da20e67891dbfcc4e3e655f5d23fe950c8aba71e0a2225dbc.exe	101
PID 4592 wrote to memory of 3772	4592	9b0a4be68d05687da20e67891dbfcc4e3e655f5d23fe950c8aba71e0a2225dbc.exe	102
PID 4592 wrote to memory of 3772	4592	9b0a4be68d05687da20e67891dbfcc4e3e655f5d23fe950c8aba71e0a2225dbc.exe	102
PID 4592 wrote to memory of 4840	4592	9b0a4be68d05687da20e67891dbfcc4e3e655f5d23fe950c8aba71e0a2225dbc.exe	103
PID 4592 wrote to memory of 4840	4592	9b0a4be68d05687da20e67891dbfcc4e3e655f5d23fe950c8aba71e0a2225dbc.exe	103
PID 4592 wrote to memory of 4492	4592	9b0a4be68d05687da20e67891dbfcc4e3e655f5d23fe950c8aba71e0a2225dbc.exe	104
PID 4592 wrote to memory of 4492	4592	9b0a4be68d05687da20e67891dbfcc4e3e655f5d23fe950c8aba71e0a2225dbc.exe	104
PID 4592 wrote to memory of 3496	4592	9b0a4be68d05687da20e67891dbfcc4e3e655f5d23fe950c8aba71e0a2225dbc.exe	105
PID 4592 wrote to memory of 3496	4592	9b0a4be68d05687da20e67891dbfcc4e3e655f5d23fe950c8aba71e0a2225dbc.exe	105
PID 4592 wrote to memory of 1896	4592	9b0a4be68d05687da20e67891dbfcc4e3e655f5d23fe950c8aba71e0a2225dbc.exe	106
PID 4592 wrote to memory of 1896	4592	9b0a4be68d05687da20e67891dbfcc4e3e655f5d23fe950c8aba71e0a2225dbc.exe	106
PID 4592 wrote to memory of 2108	4592	9b0a4be68d05687da20e67891dbfcc4e3e655f5d23fe950c8aba71e0a2225dbc.exe	107
PID 4592 wrote to memory of 2108	4592	9b0a4be68d05687da20e67891dbfcc4e3e655f5d23fe950c8aba71e0a2225dbc.exe	107
PID 4592 wrote to memory of 4384	4592	9b0a4be68d05687da20e67891dbfcc4e3e655f5d23fe950c8aba71e0a2225dbc.exe	108
PID 4592 wrote to memory of 4384	4592	9b0a4be68d05687da20e67891dbfcc4e3e655f5d23fe950c8aba71e0a2225dbc.exe	108
PID 4592 wrote to memory of 4440	4592	9b0a4be68d05687da20e67891dbfcc4e3e655f5d23fe950c8aba71e0a2225dbc.exe	109
PID 4592 wrote to memory of 4440	4592	9b0a4be68d05687da20e67891dbfcc4e3e655f5d23fe950c8aba71e0a2225dbc.exe	109
PID 4592 wrote to memory of 2172	4592	9b0a4be68d05687da20e67891dbfcc4e3e655f5d23fe950c8aba71e0a2225dbc.exe	110
PID 4592 wrote to memory of 2172	4592	9b0a4be68d05687da20e67891dbfcc4e3e655f5d23fe950c8aba71e0a2225dbc.exe	110
PID 4592 wrote to memory of 3896	4592	9b0a4be68d05687da20e67891dbfcc4e3e655f5d23fe950c8aba71e0a2225dbc.exe	111
PID 4592 wrote to memory of 3896	4592	9b0a4be68d05687da20e67891dbfcc4e3e655f5d23fe950c8aba71e0a2225dbc.exe	111
PID 4592 wrote to memory of 4548	4592	9b0a4be68d05687da20e67891dbfcc4e3e655f5d23fe950c8aba71e0a2225dbc.exe	112
PID 4592 wrote to memory of 4548	4592	9b0a4be68d05687da20e67891dbfcc4e3e655f5d23fe950c8aba71e0a2225dbc.exe	112
PID 4592 wrote to memory of 3168	4592	9b0a4be68d05687da20e67891dbfcc4e3e655f5d23fe950c8aba71e0a2225dbc.exe	113
PID 4592 wrote to memory of 3168	4592	9b0a4be68d05687da20e67891dbfcc4e3e655f5d23fe950c8aba71e0a2225dbc.exe	113
PID 4592 wrote to memory of 4692	4592	9b0a4be68d05687da20e67891dbfcc4e3e655f5d23fe950c8aba71e0a2225dbc.exe	114
PID 4592 wrote to memory of 4692	4592	9b0a4be68d05687da20e67891dbfcc4e3e655f5d23fe950c8aba71e0a2225dbc.exe	114
PID 4592 wrote to memory of 4260	4592	9b0a4be68d05687da20e67891dbfcc4e3e655f5d23fe950c8aba71e0a2225dbc.exe	115
PID 4592 wrote to memory of 4260	4592	9b0a4be68d05687da20e67891dbfcc4e3e655f5d23fe950c8aba71e0a2225dbc.exe	115

C:\Users\Admin\AppData\Local\Temp\9b0a4be68d05687da20e67891dbfcc4e3e655f5d23fe950c8aba71e0a2225dbc.exe
"C:\Users\Admin\AppData\Local\Temp\9b0a4be68d05687da20e67891dbfcc4e3e655f5d23fe950c8aba71e0a2225dbc.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4592
- C:\Windows\System\CBySDRX.exe
  C:\Windows\System\CBySDRX.exe
  2⤵
  - Executes dropped EXE
  PID:4064
- C:\Windows\System\QwbTPzD.exe
  C:\Windows\System\QwbTPzD.exe
  2⤵
  - Executes dropped EXE
  PID:1296
- C:\Windows\System\cYdDUfH.exe
  C:\Windows\System\cYdDUfH.exe
  2⤵
  - Executes dropped EXE
  PID:728
- C:\Windows\System\EVifddW.exe
  C:\Windows\System\EVifddW.exe
  2⤵
  - Executes dropped EXE
  PID:1980
- C:\Windows\System\vQKaaYS.exe
  C:\Windows\System\vQKaaYS.exe
  2⤵
  - Executes dropped EXE
  PID:3184
- C:\Windows\System\YacMAHa.exe
  C:\Windows\System\YacMAHa.exe
  2⤵
  - Executes dropped EXE
  PID:1444
- C:\Windows\System\OwMYEfK.exe
  C:\Windows\System\OwMYEfK.exe
  2⤵
  - Executes dropped EXE
  PID:3088
- C:\Windows\System\PfirkdG.exe
  C:\Windows\System\PfirkdG.exe
  2⤵
  - Executes dropped EXE
  PID:3704
- C:\Windows\System\YxJBQLQ.exe
  C:\Windows\System\YxJBQLQ.exe
  2⤵
  - Executes dropped EXE
  PID:1728
- C:\Windows\System\ktrVTCu.exe
  C:\Windows\System\ktrVTCu.exe
  2⤵
  - Executes dropped EXE
  PID:3488
- C:\Windows\System\WkSGsYo.exe
  C:\Windows\System\WkSGsYo.exe
  2⤵
  - Executes dropped EXE
  PID:4940
- C:\Windows\System\LeIZjLv.exe
  C:\Windows\System\LeIZjLv.exe
  2⤵
  - Executes dropped EXE
  PID:1000
- C:\Windows\System\cUWrkAN.exe
  C:\Windows\System\cUWrkAN.exe
  2⤵
  - Executes dropped EXE
  PID:3996
- C:\Windows\System\UytGQQd.exe
  C:\Windows\System\UytGQQd.exe
  2⤵
  - Executes dropped EXE
  PID:3460
- C:\Windows\System\hWLYAgk.exe
  C:\Windows\System\hWLYAgk.exe
  2⤵
  - Executes dropped EXE
  PID:2364
- C:\Windows\System\ZypnuLT.exe
  C:\Windows\System\ZypnuLT.exe
  2⤵
  - Executes dropped EXE
  PID:2928
- C:\Windows\System\amakOWX.exe
  C:\Windows\System\amakOWX.exe
  2⤵
  - Executes dropped EXE
  PID:1668
- C:\Windows\System\iZZnEMx.exe
  C:\Windows\System\iZZnEMx.exe
  2⤵
  - Executes dropped EXE
  PID:4028
- C:\Windows\System\AQzAUBI.exe
  C:\Windows\System\AQzAUBI.exe
  2⤵
  - Executes dropped EXE
  PID:3772
- C:\Windows\System\dXEgvce.exe
  C:\Windows\System\dXEgvce.exe
  2⤵
  - Executes dropped EXE
  PID:4840
- C:\Windows\System\lrUunsb.exe
  C:\Windows\System\lrUunsb.exe
  2⤵
  - Executes dropped EXE
  PID:4492
- C:\Windows\System\CEKCfDa.exe
  C:\Windows\System\CEKCfDa.exe
  2⤵
  - Executes dropped EXE
  PID:3496
- C:\Windows\System\geBcqRJ.exe
  C:\Windows\System\geBcqRJ.exe
  2⤵
  - Executes dropped EXE
  PID:1896
- C:\Windows\System\FONZdRF.exe
  C:\Windows\System\FONZdRF.exe
  2⤵
  - Executes dropped EXE
  PID:2108
- C:\Windows\System\XLzpdIo.exe
  C:\Windows\System\XLzpdIo.exe
  2⤵
  - Executes dropped EXE
  PID:4384
- C:\Windows\System\jJcZAXj.exe
  C:\Windows\System\jJcZAXj.exe
  2⤵
  - Executes dropped EXE
  PID:4440
- C:\Windows\System\XsxLlwM.exe
  C:\Windows\System\XsxLlwM.exe
  2⤵
  - Executes dropped EXE
  PID:2172
- C:\Windows\System\dLrnXNQ.exe
  C:\Windows\System\dLrnXNQ.exe
  2⤵
  - Executes dropped EXE
  PID:3896
- C:\Windows\System\lonUcOf.exe
  C:\Windows\System\lonUcOf.exe
  2⤵
  - Executes dropped EXE
  PID:4548
- C:\Windows\System\GtvTtAk.exe
  C:\Windows\System\GtvTtAk.exe
  2⤵
  - Executes dropped EXE
  PID:3168
- C:\Windows\System\pUdndED.exe
  C:\Windows\System\pUdndED.exe
  2⤵
  - Executes dropped EXE
  PID:4692
- C:\Windows\System\lklWxVM.exe
  C:\Windows\System\lklWxVM.exe
  2⤵
  - Executes dropped EXE
  PID:4260
- C:\Windows\System\gNyMtNU.exe
  C:\Windows\System\gNyMtNU.exe
  2⤵
  - Executes dropped EXE
  PID:4920
- C:\Windows\System\zfUGbFJ.exe
  C:\Windows\System\zfUGbFJ.exe
  2⤵
  - Executes dropped EXE
  PID:3952
- C:\Windows\System\pdRPEDu.exe
  C:\Windows\System\pdRPEDu.exe
  2⤵
  - Executes dropped EXE
  PID:3904
- C:\Windows\System\edLODsj.exe
  C:\Windows\System\edLODsj.exe
  2⤵
  - Executes dropped EXE
  PID:1164
- C:\Windows\System\njSqXsJ.exe
  C:\Windows\System\njSqXsJ.exe
  2⤵
  - Executes dropped EXE
  PID:3124
- C:\Windows\System\hjWgwJk.exe
  C:\Windows\System\hjWgwJk.exe
  2⤵
  - Executes dropped EXE
  PID:3756
- C:\Windows\System\ZIERDHe.exe
  C:\Windows\System\ZIERDHe.exe
  2⤵
  - Executes dropped EXE
  PID:2824
- C:\Windows\System\vDxcQjx.exe
  C:\Windows\System\vDxcQjx.exe
  2⤵
  - Executes dropped EXE
  PID:872
- C:\Windows\System\zIsWvlh.exe
  C:\Windows\System\zIsWvlh.exe
  2⤵
  - Executes dropped EXE
  PID:4980
- C:\Windows\System\wFIsFuG.exe
  C:\Windows\System\wFIsFuG.exe
  2⤵
  - Executes dropped EXE
  PID:4388
- C:\Windows\System\KBfyAci.exe
  C:\Windows\System\KBfyAci.exe
  2⤵
  - Executes dropped EXE
  PID:4088
- C:\Windows\System\wUhBwyo.exe
  C:\Windows\System\wUhBwyo.exe
  2⤵
  - Executes dropped EXE
  PID:532
- C:\Windows\System\nmSllab.exe
  C:\Windows\System\nmSllab.exe
  2⤵
  - Executes dropped EXE
  PID:4824
- C:\Windows\System\sBwJHTM.exe
  C:\Windows\System\sBwJHTM.exe
  2⤵
  - Executes dropped EXE
  PID:3920
- C:\Windows\System\krgHaTS.exe
  C:\Windows\System\krgHaTS.exe
  2⤵
  - Executes dropped EXE
  PID:1448
- C:\Windows\System\cLlpDjp.exe
  C:\Windows\System\cLlpDjp.exe
  2⤵
  - Executes dropped EXE
  PID:5000
- C:\Windows\System\eKPuZbR.exe
  C:\Windows\System\eKPuZbR.exe
  2⤵
  - Executes dropped EXE
  PID:1080
- C:\Windows\System\esLVwkR.exe
  C:\Windows\System\esLVwkR.exe
  2⤵
  - Executes dropped EXE
  PID:4368
- C:\Windows\System\DuyYUEv.exe
  C:\Windows\System\DuyYUEv.exe
  2⤵
  - Executes dropped EXE
  PID:552
- C:\Windows\System\CErQPtm.exe
  C:\Windows\System\CErQPtm.exe
  2⤵
  - Executes dropped EXE
  PID:3648
- C:\Windows\System\zOrcIRN.exe
  C:\Windows\System\zOrcIRN.exe
  2⤵
  - Executes dropped EXE
  PID:3048
- C:\Windows\System\RtxNwue.exe
  C:\Windows\System\RtxNwue.exe
  2⤵
  - Executes dropped EXE
  PID:2428
- C:\Windows\System\EKkpomC.exe
  C:\Windows\System\EKkpomC.exe
  2⤵
  - Executes dropped EXE
  PID:908
- C:\Windows\System\KyeqYNe.exe
  C:\Windows\System\KyeqYNe.exe
  2⤵
  - Executes dropped EXE
  PID:4220
- C:\Windows\System\KRANxJG.exe
  C:\Windows\System\KRANxJG.exe
  2⤵
  - Executes dropped EXE
  PID:2692
- C:\Windows\System\hwrVqYO.exe
  C:\Windows\System\hwrVqYO.exe
  2⤵
  - Executes dropped EXE
  PID:3112
- C:\Windows\System\YkAhtFo.exe
  C:\Windows\System\YkAhtFo.exe
  2⤵
  - Executes dropped EXE
  PID:4532
- C:\Windows\System\CzmpZcH.exe
  C:\Windows\System\CzmpZcH.exe
  2⤵
  - Executes dropped EXE
  PID:4732
- C:\Windows\System\VetBNLK.exe
  C:\Windows\System\VetBNLK.exe
  2⤵
  - Executes dropped EXE
  PID:2132
- C:\Windows\System\gQuKUYn.exe
  C:\Windows\System\gQuKUYn.exe
  2⤵
  - Executes dropped EXE
  PID:2604
- C:\Windows\System\aQEZLEL.exe
  C:\Windows\System\aQEZLEL.exe
  2⤵
  - Executes dropped EXE
  PID:3292
- C:\Windows\System\vhsnXWC.exe
  C:\Windows\System\vhsnXWC.exe
  2⤵
  - Executes dropped EXE
  PID:1976
- C:\Windows\System\IaVKOQZ.exe
  C:\Windows\System\IaVKOQZ.exe
  2⤵
  PID:4748
- C:\Windows\System\FYhFwhc.exe
  C:\Windows\System\FYhFwhc.exe
  2⤵
  PID:5052
- C:\Windows\System\mITaEoT.exe
  C:\Windows\System\mITaEoT.exe
  2⤵
  PID:4460
- C:\Windows\System\PqtiZas.exe
  C:\Windows\System\PqtiZas.exe
  2⤵
  PID:4436
- C:\Windows\System\lsGDDLA.exe
  C:\Windows\System\lsGDDLA.exe
  2⤵
  PID:1460
- C:\Windows\System\socPoSC.exe
  C:\Windows\System\socPoSC.exe
  2⤵
  PID:3912
- C:\Windows\System\NzOFAEN.exe
  C:\Windows\System\NzOFAEN.exe
  2⤵
  PID:3612
- C:\Windows\System\nMPrpFE.exe
  C:\Windows\System\nMPrpFE.exe
  2⤵
  PID:3752
- C:\Windows\System\XRJNKyb.exe
  C:\Windows\System\XRJNKyb.exe
  2⤵
  PID:2772
- C:\Windows\System\YgWmBop.exe
  C:\Windows\System\YgWmBop.exe
  2⤵
  PID:1104
- C:\Windows\System\QjvAuVo.exe
  C:\Windows\System\QjvAuVo.exe
  2⤵
  PID:2740
- C:\Windows\System\zVdEfDw.exe
  C:\Windows\System\zVdEfDw.exe
  2⤵
  PID:3604
- C:\Windows\System\deTGWup.exe
  C:\Windows\System\deTGWup.exe
  2⤵
  PID:3308
- C:\Windows\System\gRdZWSx.exe
  C:\Windows\System\gRdZWSx.exe
  2⤵
  PID:3804
- C:\Windows\System\nifgxKL.exe
  C:\Windows\System\nifgxKL.exe
  2⤵
  PID:1656
- C:\Windows\System\UrPQExx.exe
  C:\Windows\System\UrPQExx.exe
  2⤵
  PID:2104
- C:\Windows\System\klCVdkS.exe
  C:\Windows\System\klCVdkS.exe
  2⤵
  PID:4136
- C:\Windows\System\TAEtNLQ.exe
  C:\Windows\System\TAEtNLQ.exe
  2⤵
  PID:2328
- C:\Windows\System\byANqqk.exe
  C:\Windows\System\byANqqk.exe
  2⤵
  PID:4696
- C:\Windows\System\hfBnhXs.exe
  C:\Windows\System\hfBnhXs.exe
  2⤵
  PID:1140
- C:\Windows\System\NdMGroZ.exe
  C:\Windows\System\NdMGroZ.exe
  2⤵
  PID:4408
- C:\Windows\System\GjrmbSQ.exe
  C:\Windows\System\GjrmbSQ.exe
  2⤵
  PID:2200
- C:\Windows\System\EXMzXfH.exe
  C:\Windows\System\EXMzXfH.exe
  2⤵
  PID:3532
- C:\Windows\System\FpfBvLV.exe
  C:\Windows\System\FpfBvLV.exe
  2⤵
  PID:1312
- C:\Windows\System\DNZoovV.exe
  C:\Windows\System\DNZoovV.exe
  2⤵
  PID:3136
- C:\Windows\System\EpizzUt.exe
  C:\Windows\System\EpizzUt.exe
  2⤵
  PID:4668
- C:\Windows\System\arkzZsS.exe
  C:\Windows\System\arkzZsS.exe
  2⤵
  PID:2724
- C:\Windows\System\GcWoMeU.exe
  C:\Windows\System\GcWoMeU.exe
  2⤵
  PID:1540
- C:\Windows\System\iJmOjSA.exe
  C:\Windows\System\iJmOjSA.exe
  2⤵
  PID:4924
- C:\Windows\System\rShQYSz.exe
  C:\Windows\System\rShQYSz.exe
  2⤵
  PID:3580
- C:\Windows\System\CFKUdvs.exe
  C:\Windows\System\CFKUdvs.exe
  2⤵
  PID:1800
- C:\Windows\System\CAbibEY.exe
  C:\Windows\System\CAbibEY.exe
  2⤵
  PID:5104
- C:\Windows\System\bDYsytm.exe
  C:\Windows\System\bDYsytm.exe
  2⤵
  PID:5100
- C:\Windows\System\zkTWnJM.exe
  C:\Windows\System\zkTWnJM.exe
  2⤵
  PID:1268
- C:\Windows\System\NGgkgix.exe
  C:\Windows\System\NGgkgix.exe
  2⤵
  PID:2404
- C:\Windows\System\GieONHu.exe
  C:\Windows\System\GieONHu.exe
  2⤵
  PID:1108
- C:\Windows\System\dmdGtne.exe
  C:\Windows\System\dmdGtne.exe
  2⤵
  PID:2676
- C:\Windows\System\nVaLDxF.exe
  C:\Windows\System\nVaLDxF.exe
  2⤵
  PID:2304
- C:\Windows\System\URjsjTw.exe
  C:\Windows\System\URjsjTw.exe
  2⤵
  PID:2636
- C:\Windows\System\JUDmMxZ.exe
  C:\Windows\System\JUDmMxZ.exe
  2⤵
  PID:3040
- C:\Windows\System\SCONdCT.exe
  C:\Windows\System\SCONdCT.exe
  2⤵
  PID:4200
- C:\Windows\System\ArygNYd.exe
  C:\Windows\System\ArygNYd.exe
  2⤵
  PID:1156
- C:\Windows\System\oLuIDxZ.exe
  C:\Windows\System\oLuIDxZ.exe
  2⤵
  PID:2664
- C:\Windows\System\oRVywdY.exe
  C:\Windows\System\oRVywdY.exe
  2⤵
  PID:3728
- C:\Windows\System\eANlqDs.exe
  C:\Windows\System\eANlqDs.exe
  2⤵
  PID:2100
- C:\Windows\System\IjeSCUk.exe
  C:\Windows\System\IjeSCUk.exe
  2⤵
  PID:5136
- C:\Windows\System\HXsrJqS.exe
  C:\Windows\System\HXsrJqS.exe
  2⤵
  PID:5156
- C:\Windows\System\HfOmOBQ.exe
  C:\Windows\System\HfOmOBQ.exe
  2⤵
  PID:5184
- C:\Windows\System\uVXnzKR.exe
  C:\Windows\System\uVXnzKR.exe
  2⤵
  PID:5228
- C:\Windows\System\CJQMsqO.exe
  C:\Windows\System\CJQMsqO.exe
  2⤵
  PID:5248
- C:\Windows\System\FJULybx.exe
  C:\Windows\System\FJULybx.exe
  2⤵
  PID:5272
- C:\Windows\System\PcFrTdE.exe
  C:\Windows\System\PcFrTdE.exe
  2⤵
  PID:5300
- C:\Windows\System\gjqfuhP.exe
  C:\Windows\System\gjqfuhP.exe
  2⤵
  PID:5328
- C:\Windows\System\fIqanmV.exe
  C:\Windows\System\fIqanmV.exe
  2⤵
  PID:5356
- C:\Windows\System\jVJylbG.exe
  C:\Windows\System\jVJylbG.exe
  2⤵
  PID:5392
- C:\Windows\System\gDdbNBY.exe
  C:\Windows\System\gDdbNBY.exe
  2⤵
  PID:5412
- C:\Windows\System\NsEedjL.exe
  C:\Windows\System\NsEedjL.exe
  2⤵
  PID:5444
- C:\Windows\System\uHMrzNw.exe
  C:\Windows\System\uHMrzNw.exe
  2⤵
  PID:5480
- C:\Windows\System\MDiwuxm.exe
  C:\Windows\System\MDiwuxm.exe
  2⤵
  PID:5500
- C:\Windows\System\qVbxiIq.exe
  C:\Windows\System\qVbxiIq.exe
  2⤵
  PID:5532
- C:\Windows\System\xkJNDNG.exe
  C:\Windows\System\xkJNDNG.exe
  2⤵
  PID:5556
- C:\Windows\System\IjOBTma.exe
  C:\Windows\System\IjOBTma.exe
  2⤵
  PID:5588
- C:\Windows\System\tlpySHM.exe
  C:\Windows\System\tlpySHM.exe
  2⤵
  PID:5620
- C:\Windows\System\ckCKZOt.exe
  C:\Windows\System\ckCKZOt.exe
  2⤵
  PID:5648
- C:\Windows\System\FfMfaxc.exe
  C:\Windows\System\FfMfaxc.exe
  2⤵
  PID:5668
- C:\Windows\System\nGBdPSt.exe
  C:\Windows\System\nGBdPSt.exe
  2⤵
  PID:5708
- C:\Windows\System\cPSRTRT.exe
  C:\Windows\System\cPSRTRT.exe
  2⤵
  PID:5724
- C:\Windows\System\jfXyxpM.exe
  C:\Windows\System\jfXyxpM.exe
  2⤵
  PID:5752
- C:\Windows\System\HdYHmGd.exe
  C:\Windows\System\HdYHmGd.exe
  2⤵
  PID:5780
- C:\Windows\System\oWMEhTU.exe
  C:\Windows\System\oWMEhTU.exe
  2⤵
  PID:5808
- C:\Windows\System\HeaPkoC.exe
  C:\Windows\System\HeaPkoC.exe
  2⤵
  PID:5836
- C:\Windows\System\vahCFVB.exe
  C:\Windows\System\vahCFVB.exe
  2⤵
  PID:5856
- C:\Windows\System\cgpOleM.exe
  C:\Windows\System\cgpOleM.exe
  2⤵
  PID:5884
- C:\Windows\System\tWLHlmv.exe
  C:\Windows\System\tWLHlmv.exe
  2⤵
  PID:5912
- C:\Windows\System\Gxdynef.exe
  C:\Windows\System\Gxdynef.exe
  2⤵
  PID:5940
- C:\Windows\System\WQnMftj.exe
  C:\Windows\System\WQnMftj.exe
  2⤵
  PID:5972
- C:\Windows\System\nCvIysp.exe
  C:\Windows\System\nCvIysp.exe
  2⤵
  PID:5992
- C:\Windows\System\LhdUlaU.exe
  C:\Windows\System\LhdUlaU.exe
  2⤵
  PID:6028
- C:\Windows\System\zFvcCLr.exe
  C:\Windows\System\zFvcCLr.exe
  2⤵
  PID:6048
- C:\Windows\System\qvuEkLo.exe
  C:\Windows\System\qvuEkLo.exe
  2⤵
  PID:6088
- C:\Windows\System\YbSDxdS.exe
  C:\Windows\System\YbSDxdS.exe
  2⤵
  PID:6108
- C:\Windows\System\VORNFTH.exe
  C:\Windows\System\VORNFTH.exe
  2⤵
  PID:6132
- C:\Windows\System\LKDxDvt.exe
  C:\Windows\System\LKDxDvt.exe
  2⤵
  PID:5176
- C:\Windows\System\DTGCrMb.exe
  C:\Windows\System\DTGCrMb.exe
  2⤵
  PID:5240
- C:\Windows\System\ftKgREk.exe
  C:\Windows\System\ftKgREk.exe
  2⤵
  PID:5292
- C:\Windows\System\ZWzIwSk.exe
  C:\Windows\System\ZWzIwSk.exe
  2⤵
  PID:5348
- C:\Windows\System\eATjMnu.exe
  C:\Windows\System\eATjMnu.exe
  2⤵
  PID:5456
- C:\Windows\System\WDfsrhs.exe
  C:\Windows\System\WDfsrhs.exe
  2⤵
  PID:5492
- C:\Windows\System\RqiHwgY.exe
  C:\Windows\System\RqiHwgY.exe
  2⤵
  PID:5552
- C:\Windows\System\uDRIhyy.exe
  C:\Windows\System\uDRIhyy.exe
  2⤵
  PID:5628
- C:\Windows\System\Whphscl.exe
  C:\Windows\System\Whphscl.exe
  2⤵
  PID:5688
- C:\Windows\System\RkNfFJd.exe
  C:\Windows\System\RkNfFJd.exe
  2⤵
  PID:5748
- C:\Windows\System\MIvoFri.exe
  C:\Windows\System\MIvoFri.exe
  2⤵
  PID:5792
- C:\Windows\System\WrrWoPw.exe
  C:\Windows\System\WrrWoPw.exe
  2⤵
  PID:5852
- C:\Windows\System\qZjpTLV.exe
  C:\Windows\System\qZjpTLV.exe
  2⤵
  PID:5920
- C:\Windows\System\opkVHnX.exe
  C:\Windows\System\opkVHnX.exe
  2⤵
  PID:6004
- C:\Windows\System\CkfKsna.exe
  C:\Windows\System\CkfKsna.exe
  2⤵
  PID:6040
- C:\Windows\System\zrfESdK.exe
  C:\Windows\System\zrfESdK.exe
  2⤵
  PID:6072
- C:\Windows\System\JacAZVr.exe
  C:\Windows\System\JacAZVr.exe
  2⤵
  PID:6124
- C:\Windows\System\IjQLUDa.exe
  C:\Windows\System\IjQLUDa.exe
  2⤵
  PID:5316
- C:\Windows\System\MiNhlGw.exe
  C:\Windows\System\MiNhlGw.exe
  2⤵
  PID:5468
- C:\Windows\System\TfVAqHs.exe
  C:\Windows\System\TfVAqHs.exe
  2⤵
  PID:5596
- C:\Windows\System\VKZdkFn.exe
  C:\Windows\System\VKZdkFn.exe
  2⤵
  PID:5772
- C:\Windows\System\zcSDcDQ.exe
  C:\Windows\System\zcSDcDQ.exe
  2⤵
  PID:6020
- C:\Windows\System\uUYBAGa.exe
  C:\Windows\System\uUYBAGa.exe
  2⤵
  PID:6060
- C:\Windows\System\FwyUejT.exe
  C:\Windows\System\FwyUejT.exe
  2⤵
  PID:5432
- C:\Windows\System\LQvmySx.exe
  C:\Windows\System\LQvmySx.exe
  2⤵
  PID:5824
- C:\Windows\System\uWXRxuR.exe
  C:\Windows\System\uWXRxuR.exe
  2⤵
  PID:5832
- C:\Windows\System\SJZFOHO.exe
  C:\Windows\System\SJZFOHO.exe
  2⤵
  PID:5660
- C:\Windows\System\CokUNnJ.exe
  C:\Windows\System\CokUNnJ.exe
  2⤵
  PID:6168
- C:\Windows\System\kacEooD.exe
  C:\Windows\System\kacEooD.exe
  2⤵
  PID:6196
- C:\Windows\System\OOAWETW.exe
  C:\Windows\System\OOAWETW.exe
  2⤵
  PID:6212
- C:\Windows\System\UrmiJUO.exe
  C:\Windows\System\UrmiJUO.exe
  2⤵
  PID:6248
- C:\Windows\System\ufxuwPW.exe
  C:\Windows\System\ufxuwPW.exe
  2⤵
  PID:6280
- C:\Windows\System\rKABmiz.exe
  C:\Windows\System\rKABmiz.exe
  2⤵
  PID:6308
- C:\Windows\System\DcusAPA.exe
  C:\Windows\System\DcusAPA.exe
  2⤵
  PID:6348
- C:\Windows\System\yTThmVZ.exe
  C:\Windows\System\yTThmVZ.exe
  2⤵
  PID:6376
- C:\Windows\System\fPmMqUJ.exe
  C:\Windows\System\fPmMqUJ.exe
  2⤵
  PID:6404
- C:\Windows\System\JxFVzSE.exe
  C:\Windows\System\JxFVzSE.exe
  2⤵
  PID:6428
- C:\Windows\System\fOKMtFV.exe
  C:\Windows\System\fOKMtFV.exe
  2⤵
  PID:6448
- C:\Windows\System\vUXkpLI.exe
  C:\Windows\System\vUXkpLI.exe
  2⤵
  PID:6480
- C:\Windows\System\osubeOx.exe
  C:\Windows\System\osubeOx.exe
  2⤵
  PID:6504
- C:\Windows\System\AcxWqll.exe
  C:\Windows\System\AcxWqll.exe
  2⤵
  PID:6532
- C:\Windows\System\dEMeMRe.exe
  C:\Windows\System\dEMeMRe.exe
  2⤵
  PID:6572
- C:\Windows\System\VEbIEbR.exe
  C:\Windows\System\VEbIEbR.exe
  2⤵
  PID:6588
- C:\Windows\System\OmOmfZt.exe
  C:\Windows\System\OmOmfZt.exe
  2⤵
  PID:6604
- C:\Windows\System\SGqJOFT.exe
  C:\Windows\System\SGqJOFT.exe
  2⤵
  PID:6636
- C:\Windows\System\epBBfZx.exe
  C:\Windows\System\epBBfZx.exe
  2⤵
  PID:6660
- C:\Windows\System\xRupiEc.exe
  C:\Windows\System\xRupiEc.exe
  2⤵
  PID:6676
- C:\Windows\System\aqWJxUR.exe
  C:\Windows\System\aqWJxUR.exe
  2⤵
  PID:6708
- C:\Windows\System\WjbPUOf.exe
  C:\Windows\System\WjbPUOf.exe
  2⤵
  PID:6732
- C:\Windows\System\fMdANjZ.exe
  C:\Windows\System\fMdANjZ.exe
  2⤵
  PID:6764
- C:\Windows\System\uNbqoSm.exe
  C:\Windows\System\uNbqoSm.exe
  2⤵
  PID:6800
- C:\Windows\System\FEzlOGo.exe
  C:\Windows\System\FEzlOGo.exe
  2⤵
  PID:6836
- C:\Windows\System\gBfCKRw.exe
  C:\Windows\System\gBfCKRw.exe
  2⤵
  PID:6856
- C:\Windows\System\IKWRIZe.exe
  C:\Windows\System\IKWRIZe.exe
  2⤵
  PID:6884
- C:\Windows\System\IcYtENK.exe
  C:\Windows\System\IcYtENK.exe
  2⤵
  PID:6908
- C:\Windows\System\aVGmIFZ.exe
  C:\Windows\System\aVGmIFZ.exe
  2⤵
  PID:6944
- C:\Windows\System\BYtzfTi.exe
  C:\Windows\System\BYtzfTi.exe
  2⤵
  PID:6980
- C:\Windows\System\nHbSodL.exe
  C:\Windows\System\nHbSodL.exe
  2⤵
  PID:7004
- C:\Windows\System\VjMxePU.exe
  C:\Windows\System\VjMxePU.exe
  2⤵
  PID:7036
- C:\Windows\System\YksJMTw.exe
  C:\Windows\System\YksJMTw.exe
  2⤵
  PID:7068
- C:\Windows\System\ihvqcWt.exe
  C:\Windows\System\ihvqcWt.exe
  2⤵
  PID:7096
- C:\Windows\System\yUsgweK.exe
  C:\Windows\System\yUsgweK.exe
  2⤵
  PID:7120
- C:\Windows\System\sFljasE.exe
  C:\Windows\System\sFljasE.exe
  2⤵
  PID:7156
- C:\Windows\System\ElMpEzJ.exe
  C:\Windows\System\ElMpEzJ.exe
  2⤵
  PID:6160
- C:\Windows\System\sgPNHQo.exe
  C:\Windows\System\sgPNHQo.exe
  2⤵
  PID:6224
- C:\Windows\System\gTzraCk.exe
  C:\Windows\System\gTzraCk.exe
  2⤵
  PID:6296
- C:\Windows\System\JwFOjll.exe
  C:\Windows\System\JwFOjll.exe
  2⤵
  PID:6340
- C:\Windows\System\CNgymRx.exe
  C:\Windows\System\CNgymRx.exe
  2⤵
  PID:6412
- C:\Windows\System\zGthCUT.exe
  C:\Windows\System\zGthCUT.exe
  2⤵
  PID:6440
- C:\Windows\System\nvRefLT.exe
  C:\Windows\System\nvRefLT.exe
  2⤵
  PID:6500
- C:\Windows\System\OMMUMAY.exe
  C:\Windows\System\OMMUMAY.exe
  2⤵
  PID:6552
- C:\Windows\System\tHqYSjf.exe
  C:\Windows\System\tHqYSjf.exe
  2⤵
  PID:6596
- C:\Windows\System\KODHZUe.exe
  C:\Windows\System\KODHZUe.exe
  2⤵
  PID:6728
- C:\Windows\System\wlTvPyc.exe
  C:\Windows\System\wlTvPyc.exe
  2⤵
  PID:6812
- C:\Windows\System\DVVRBjH.exe
  C:\Windows\System\DVVRBjH.exe
  2⤵
  PID:6820
- C:\Windows\System\McoBAJq.exe
  C:\Windows\System\McoBAJq.exe
  2⤵
  PID:6868
- C:\Windows\System\ESIEVxs.exe
  C:\Windows\System\ESIEVxs.exe
  2⤵
  PID:6928
- C:\Windows\System\PBFDdfq.exe
  C:\Windows\System\PBFDdfq.exe
  2⤵
  PID:7016
- C:\Windows\System\zixQnzn.exe
  C:\Windows\System\zixQnzn.exe
  2⤵
  PID:7084
- C:\Windows\System\wMVhnsd.exe
  C:\Windows\System\wMVhnsd.exe
  2⤵
  PID:7132
- C:\Windows\System\CriUqMY.exe
  C:\Windows\System\CriUqMY.exe
  2⤵
  PID:6204
- C:\Windows\System\VBulLxJ.exe
  C:\Windows\System\VBulLxJ.exe
  2⤵
  PID:6320
- C:\Windows\System\LhDkwtM.exe
  C:\Windows\System\LhDkwtM.exe
  2⤵
  PID:6516
- C:\Windows\System\uJdGOMM.exe
  C:\Windows\System\uJdGOMM.exe
  2⤵
  PID:6788
- C:\Windows\System\MwTiBaI.exe
  C:\Windows\System\MwTiBaI.exe
  2⤵
  PID:6824
- C:\Windows\System\zJEzJlD.exe
  C:\Windows\System\zJEzJlD.exe
  2⤵
  PID:6996
- C:\Windows\System\SVlWsAX.exe
  C:\Windows\System\SVlWsAX.exe
  2⤵
  PID:6268
- C:\Windows\System\vmrDXFh.exe
  C:\Windows\System\vmrDXFh.exe
  2⤵
  PID:1436
- C:\Windows\System\OaGWrXn.exe
  C:\Windows\System\OaGWrXn.exe
  2⤵
  PID:6956
- C:\Windows\System\jvitqax.exe
  C:\Windows\System\jvitqax.exe
  2⤵
  PID:6904
- C:\Windows\System\LEjHNcL.exe
  C:\Windows\System\LEjHNcL.exe
  2⤵
  PID:7144
- C:\Windows\System\vBSrAUg.exe
  C:\Windows\System\vBSrAUg.exe
  2⤵
  PID:6600
- C:\Windows\System\BaQexUN.exe
  C:\Windows\System\BaQexUN.exe
  2⤵
  PID:7192
- C:\Windows\System\emRFYKE.exe
  C:\Windows\System\emRFYKE.exe
  2⤵
  PID:7220
- C:\Windows\System\QeFyYYR.exe
  C:\Windows\System\QeFyYYR.exe
  2⤵
  PID:7248
- C:\Windows\System\nwtwilD.exe
  C:\Windows\System\nwtwilD.exe
  2⤵
  PID:7264
- C:\Windows\System\CBRmaNo.exe
  C:\Windows\System\CBRmaNo.exe
  2⤵
  PID:7292
- C:\Windows\System\uQvBBnW.exe
  C:\Windows\System\uQvBBnW.exe
  2⤵
  PID:7320
- C:\Windows\System\cAZCNqj.exe
  C:\Windows\System\cAZCNqj.exe
  2⤵
  PID:7344
- C:\Windows\System\eObPOwX.exe
  C:\Windows\System\eObPOwX.exe
  2⤵
  PID:7384
- C:\Windows\System\NIKZSXU.exe
  C:\Windows\System\NIKZSXU.exe
  2⤵
  PID:7412
- C:\Windows\System\bvRQYqa.exe
  C:\Windows\System\bvRQYqa.exe
  2⤵
  PID:7436
- C:\Windows\System\XILfFWo.exe
  C:\Windows\System\XILfFWo.exe
  2⤵
  PID:7472
- C:\Windows\System\jXuDAcS.exe
  C:\Windows\System\jXuDAcS.exe
  2⤵
  PID:7504
- C:\Windows\System\ATCbZhq.exe
  C:\Windows\System\ATCbZhq.exe
  2⤵
  PID:7532
- C:\Windows\System\WzoJbJT.exe
  C:\Windows\System\WzoJbJT.exe
  2⤵
  PID:7564
- C:\Windows\System\WbWPPuw.exe
  C:\Windows\System\WbWPPuw.exe
  2⤵
  PID:7600
- C:\Windows\System\klRHYmb.exe
  C:\Windows\System\klRHYmb.exe
  2⤵
  PID:7628
- C:\Windows\System\imWobsn.exe
  C:\Windows\System\imWobsn.exe
  2⤵
  PID:7656
- C:\Windows\System\lctjDYM.exe
  C:\Windows\System\lctjDYM.exe
  2⤵
  PID:7688
- C:\Windows\System\XOwkjBP.exe
  C:\Windows\System\XOwkjBP.exe
  2⤵
  PID:7712
- C:\Windows\System\FFlsVWl.exe
  C:\Windows\System\FFlsVWl.exe
  2⤵
  PID:7740
- C:\Windows\System\CyRTAfO.exe
  C:\Windows\System\CyRTAfO.exe
  2⤵
  PID:7768
- C:\Windows\System\pVPLDqw.exe
  C:\Windows\System\pVPLDqw.exe
  2⤵
  PID:7796
- C:\Windows\System\STwwwta.exe
  C:\Windows\System\STwwwta.exe
  2⤵
  PID:7824
- C:\Windows\System\KyCbIgB.exe
  C:\Windows\System\KyCbIgB.exe
  2⤵
  PID:7848
- C:\Windows\System\XRPiTck.exe
  C:\Windows\System\XRPiTck.exe
  2⤵
  PID:7876
- C:\Windows\System\yxMudtb.exe
  C:\Windows\System\yxMudtb.exe
  2⤵
  PID:7912
- C:\Windows\System\HsnwsSB.exe
  C:\Windows\System\HsnwsSB.exe
  2⤵
  PID:7948
- C:\Windows\System\kLeFSYz.exe
  C:\Windows\System\kLeFSYz.exe
  2⤵
  PID:7972
- C:\Windows\System\lWCXWoN.exe
  C:\Windows\System\lWCXWoN.exe
  2⤵
  PID:8020
- C:\Windows\System\sifESAt.exe
  C:\Windows\System\sifESAt.exe
  2⤵
  PID:8048
- C:\Windows\System\cHLlgVa.exe
  C:\Windows\System\cHLlgVa.exe
  2⤵
  PID:8076
- C:\Windows\System\sLIXQjK.exe
  C:\Windows\System\sLIXQjK.exe
  2⤵
  PID:8092
- C:\Windows\System\kRSUejI.exe
  C:\Windows\System\kRSUejI.exe
  2⤵
  PID:8120
- C:\Windows\System\SsrGdMc.exe
  C:\Windows\System\SsrGdMc.exe
  2⤵
  PID:8148
- C:\Windows\System\ikTPLJM.exe
  C:\Windows\System\ikTPLJM.exe
  2⤵
  PID:8176
- C:\Windows\System\jncjZjP.exe
  C:\Windows\System\jncjZjP.exe
  2⤵
  PID:7064
- C:\Windows\System\iQhUCRb.exe
  C:\Windows\System\iQhUCRb.exe
  2⤵
  PID:6524
- C:\Windows\System\EbYpxHO.exe
  C:\Windows\System\EbYpxHO.exe
  2⤵
  PID:7308
- C:\Windows\System\IcPHDlb.exe
  C:\Windows\System\IcPHDlb.exe
  2⤵
  PID:7428
- C:\Windows\System\yoHCEej.exe
  C:\Windows\System\yoHCEej.exe
  2⤵
  PID:7364
- C:\Windows\System\LrTHhMC.exe
  C:\Windows\System\LrTHhMC.exe
  2⤵
  PID:7484
- C:\Windows\System\dlRUgxR.exe
  C:\Windows\System\dlRUgxR.exe
  2⤵
  PID:7588
- C:\Windows\System\KOMWNFr.exe
  C:\Windows\System\KOMWNFr.exe
  2⤵
  PID:7572
- C:\Windows\System\YxxcRtQ.exe
  C:\Windows\System\YxxcRtQ.exe
  2⤵
  PID:7720
- C:\Windows\System\iYzYGos.exe
  C:\Windows\System\iYzYGos.exe
  2⤵
  PID:7752
- C:\Windows\System\QimMCRk.exe
  C:\Windows\System\QimMCRk.exe
  2⤵
  PID:7808
- C:\Windows\System\WxSFLQb.exe
  C:\Windows\System\WxSFLQb.exe
  2⤵
  PID:7844
- C:\Windows\System\JWBtlRq.exe
  C:\Windows\System\JWBtlRq.exe
  2⤵
  PID:7888
- C:\Windows\System\KjoEnWF.exe
  C:\Windows\System\KjoEnWF.exe
  2⤵
  PID:8008
- C:\Windows\System\efJZjKp.exe
  C:\Windows\System\efJZjKp.exe
  2⤵
  PID:8032
- C:\Windows\System\iPGsmWb.exe
  C:\Windows\System\iPGsmWb.exe
  2⤵
  PID:8112
- C:\Windows\System\dXBOPAq.exe
  C:\Windows\System\dXBOPAq.exe
  2⤵
  PID:8160
- C:\Windows\System\QvxiRbV.exe
  C:\Windows\System\QvxiRbV.exe
  2⤵
  PID:6616
- C:\Windows\System\kaHwaSt.exe
  C:\Windows\System\kaHwaSt.exe
  2⤵
  PID:7368
- C:\Windows\System\TGniqNQ.exe
  C:\Windows\System\TGniqNQ.exe
  2⤵
  PID:7516
- C:\Windows\System\EXzZWum.exe
  C:\Windows\System\EXzZWum.exe
  2⤵
  PID:7728
- C:\Windows\System\nJddvEv.exe
  C:\Windows\System\nJddvEv.exe
  2⤵
  PID:7780
- C:\Windows\System\flmCmYh.exe
  C:\Windows\System\flmCmYh.exe
  2⤵
  PID:7928
- C:\Windows\System\cPOYsMN.exe
  C:\Windows\System\cPOYsMN.exe
  2⤵
  PID:7940
- C:\Windows\System\pHuiJUv.exe
  C:\Windows\System\pHuiJUv.exe
  2⤵
  PID:8188
- C:\Windows\System\uTuGrFy.exe
  C:\Windows\System\uTuGrFy.exe
  2⤵
  PID:7524
- C:\Windows\System\GMEvQjR.exe
  C:\Windows\System\GMEvQjR.exe
  2⤵
  PID:8000
- C:\Windows\System\cdXNegX.exe
  C:\Windows\System\cdXNegX.exe
  2⤵
  PID:7544
- C:\Windows\System\KjHUMnh.exe
  C:\Windows\System\KjHUMnh.exe
  2⤵
  PID:7792
- C:\Windows\System\POnhJSu.exe
  C:\Windows\System\POnhJSu.exe
  2⤵
  PID:8204
- C:\Windows\System\aNSDjga.exe
  C:\Windows\System\aNSDjga.exe
  2⤵
  PID:8236
- C:\Windows\System\oYjDreJ.exe
  C:\Windows\System\oYjDreJ.exe
  2⤵
  PID:8264
- C:\Windows\System\hLSwGLe.exe
  C:\Windows\System\hLSwGLe.exe
  2⤵
  PID:8292
- C:\Windows\System\inbOzAt.exe
  C:\Windows\System\inbOzAt.exe
  2⤵
  PID:8320
- C:\Windows\System\vVfcLdh.exe
  C:\Windows\System\vVfcLdh.exe
  2⤵
  PID:8348
- C:\Windows\System\zohHmqQ.exe
  C:\Windows\System\zohHmqQ.exe
  2⤵
  PID:8376
- C:\Windows\System\HtWrjSW.exe
  C:\Windows\System\HtWrjSW.exe
  2⤵
  PID:8400
- C:\Windows\System\UAhudOh.exe
  C:\Windows\System\UAhudOh.exe
  2⤵
  PID:8424
- C:\Windows\System\jWluNOe.exe
  C:\Windows\System\jWluNOe.exe
  2⤵
  PID:8448
- C:\Windows\System\SgNsfal.exe
  C:\Windows\System\SgNsfal.exe
  2⤵
  PID:8472
- C:\Windows\System\HpAKRaC.exe
  C:\Windows\System\HpAKRaC.exe
  2⤵
  PID:8508
- C:\Windows\System\tMBQHdI.exe
  C:\Windows\System\tMBQHdI.exe
  2⤵
  PID:8536
- C:\Windows\System\uPgQGsm.exe
  C:\Windows\System\uPgQGsm.exe
  2⤵
  PID:8556
- C:\Windows\System\jnnYNtW.exe
  C:\Windows\System\jnnYNtW.exe
  2⤵
  PID:8580
- C:\Windows\System\ApUyxmN.exe
  C:\Windows\System\ApUyxmN.exe
  2⤵
  PID:8612
- C:\Windows\System\QLqQjWE.exe
  C:\Windows\System\QLqQjWE.exe
  2⤵
  PID:8644
- C:\Windows\System\BJHsVQC.exe
  C:\Windows\System\BJHsVQC.exe
  2⤵
  PID:8688
- C:\Windows\System\AIdEVRP.exe
  C:\Windows\System\AIdEVRP.exe
  2⤵
  PID:8708
- C:\Windows\System\IZRmwYJ.exe
  C:\Windows\System\IZRmwYJ.exe
  2⤵
  PID:8744
- C:\Windows\System\qvZruMl.exe
  C:\Windows\System\qvZruMl.exe
  2⤵
  PID:8760
- C:\Windows\System\afEnVAF.exe
  C:\Windows\System\afEnVAF.exe
  2⤵
  PID:8792
- C:\Windows\System\yDuxLcC.exe
  C:\Windows\System\yDuxLcC.exe
  2⤵
  PID:8820
- C:\Windows\System\FIRPzjw.exe
  C:\Windows\System\FIRPzjw.exe
  2⤵
  PID:8844
- C:\Windows\System\QUnoNCe.exe
  C:\Windows\System\QUnoNCe.exe
  2⤵
  PID:8864
- C:\Windows\System\AtTngNv.exe
  C:\Windows\System\AtTngNv.exe
  2⤵
  PID:8888
- C:\Windows\System\ZMBFABP.exe
  C:\Windows\System\ZMBFABP.exe
  2⤵
  PID:8920
- C:\Windows\System\uncyymY.exe
  C:\Windows\System\uncyymY.exe
  2⤵
  PID:8948
- C:\Windows\System\BmhyDOP.exe
  C:\Windows\System\BmhyDOP.exe
  2⤵
  PID:8976
- C:\Windows\System\atfsIoZ.exe
  C:\Windows\System\atfsIoZ.exe
  2⤵
  PID:9000
- C:\Windows\System\DJbQMAx.exe
  C:\Windows\System\DJbQMAx.exe
  2⤵
  PID:9028
- C:\Windows\System\brXylRx.exe
  C:\Windows\System\brXylRx.exe
  2⤵
  PID:9060
- C:\Windows\System\ohdopSl.exe
  C:\Windows\System\ohdopSl.exe
  2⤵
  PID:9096
- C:\Windows\System\uZzINXF.exe
  C:\Windows\System\uZzINXF.exe
  2⤵
  PID:9124
- C:\Windows\System\qvWRNEB.exe
  C:\Windows\System\qvWRNEB.exe
  2⤵
  PID:9144
- C:\Windows\System\bXONpjM.exe
  C:\Windows\System\bXONpjM.exe
  2⤵
  PID:9168
- C:\Windows\System\MiYFPey.exe
  C:\Windows\System\MiYFPey.exe
  2⤵
  PID:9204
- C:\Windows\System\iQMoqLG.exe
  C:\Windows\System\iQMoqLG.exe
  2⤵
  PID:8200
- C:\Windows\System\DXSLilo.exe
  C:\Windows\System\DXSLilo.exe
  2⤵
  PID:8232
- C:\Windows\System\dkTzPVE.exe
  C:\Windows\System\dkTzPVE.exe
  2⤵
  PID:8332
- C:\Windows\System\FpZHlbK.exe
  C:\Windows\System\FpZHlbK.exe
  2⤵
  PID:8392
- C:\Windows\System\HtOcFsf.exe
  C:\Windows\System\HtOcFsf.exe
  2⤵
  PID:8384
- C:\Windows\System\swJBPhy.exe
  C:\Windows\System\swJBPhy.exe
  2⤵
  PID:8464
- C:\Windows\System\jOamzGM.exe
  C:\Windows\System\jOamzGM.exe
  2⤵
  PID:8444
- C:\Windows\System\ksNQwVp.exe
  C:\Windows\System\ksNQwVp.exe
  2⤵
  PID:8636
- C:\Windows\System\IcXyama.exe
  C:\Windows\System\IcXyama.exe
  2⤵
  PID:8628
- C:\Windows\System\lGfUsNk.exe
  C:\Windows\System\lGfUsNk.exe
  2⤵
  PID:8812
- C:\Windows\System\UXOCjwM.exe
  C:\Windows\System\UXOCjwM.exe
  2⤵
  PID:8724
- C:\Windows\System\GkcZfYE.exe
  C:\Windows\System\GkcZfYE.exe
  2⤵
  PID:8860
- C:\Windows\System\qIWljWn.exe
  C:\Windows\System\qIWljWn.exe
  2⤵
  PID:8928
- C:\Windows\System\dRAtqjX.exe
  C:\Windows\System\dRAtqjX.exe
  2⤵
  PID:8880
- C:\Windows\System\bZOGWwQ.exe
  C:\Windows\System\bZOGWwQ.exe
  2⤵
  PID:8960
- C:\Windows\System\OhSwrOe.exe
  C:\Windows\System\OhSwrOe.exe
  2⤵
  PID:9056
- C:\Windows\System\aMQRbMO.exe
  C:\Windows\System\aMQRbMO.exe
  2⤵
  PID:9180
- C:\Windows\System\DNcaKsk.exe
  C:\Windows\System\DNcaKsk.exe
  2⤵
  PID:9108
- C:\Windows\System\QyitLjS.exe
  C:\Windows\System\QyitLjS.exe
  2⤵
  PID:8228
- C:\Windows\System\IXfNiFM.exe
  C:\Windows\System\IXfNiFM.exe
  2⤵
  PID:8548
- C:\Windows\System\LiDkFGf.exe
  C:\Windows\System\LiDkFGf.exe
  2⤵
  PID:8588
- C:\Windows\System\xFCjFOW.exe
  C:\Windows\System\xFCjFOW.exe
  2⤵
  PID:8932
- C:\Windows\System\AGzTjnw.exe
  C:\Windows\System\AGzTjnw.exe
  2⤵
  PID:9072
- C:\Windows\System\bmMIZCs.exe
  C:\Windows\System\bmMIZCs.exe
  2⤵
  PID:9152
- C:\Windows\System\kZKtLbI.exe
  C:\Windows\System\kZKtLbI.exe
  2⤵
  PID:8368
- C:\Windows\System\OAQKCJL.exe
  C:\Windows\System\OAQKCJL.exe
  2⤵
  PID:8936
- C:\Windows\System\AArJJsz.exe
  C:\Windows\System\AArJJsz.exe
  2⤵
  PID:9240
- C:\Windows\System\JuRljus.exe
  C:\Windows\System\JuRljus.exe
  2⤵
  PID:9268
- C:\Windows\System\fJGVJHD.exe
  C:\Windows\System\fJGVJHD.exe
  2⤵
  PID:9296
- C:\Windows\System\WXCBoqX.exe
  C:\Windows\System\WXCBoqX.exe
  2⤵
  PID:9328
- C:\Windows\System\jIhTBpG.exe
  C:\Windows\System\jIhTBpG.exe
  2⤵
  PID:9356
- C:\Windows\System\nuIFQnO.exe
  C:\Windows\System\nuIFQnO.exe
  2⤵
  PID:9404
- C:\Windows\System\mVPnRxi.exe
  C:\Windows\System\mVPnRxi.exe
  2⤵
  PID:9432
- C:\Windows\System\fBnWazt.exe
  C:\Windows\System\fBnWazt.exe
  2⤵
  PID:9464
- C:\Windows\System\LBOpAST.exe
  C:\Windows\System\LBOpAST.exe
  2⤵
  PID:9500
- C:\Windows\System\iXBhpbI.exe
  C:\Windows\System\iXBhpbI.exe
  2⤵
  PID:9524
- C:\Windows\System\vXXMAaa.exe
  C:\Windows\System\vXXMAaa.exe
  2⤵
  PID:9556
- C:\Windows\System\TQoFZFT.exe
  C:\Windows\System\TQoFZFT.exe
  2⤵
  PID:9588
- C:\Windows\System\LQPUovu.exe
  C:\Windows\System\LQPUovu.exe
  2⤵
  PID:9612
- C:\Windows\System\LHlnzSM.exe
  C:\Windows\System\LHlnzSM.exe
  2⤵
  PID:9644
- C:\Windows\System\liwRGEL.exe
  C:\Windows\System\liwRGEL.exe
  2⤵
  PID:9664
- C:\Windows\System\NGGxusc.exe
  C:\Windows\System\NGGxusc.exe
  2⤵
  PID:9688
- C:\Windows\System\exvifDW.exe
  C:\Windows\System\exvifDW.exe
  2⤵
  PID:9720
- C:\Windows\System\KkpyhCE.exe
  C:\Windows\System\KkpyhCE.exe
  2⤵
  PID:9752
- C:\Windows\System\xIrkfMs.exe
  C:\Windows\System\xIrkfMs.exe
  2⤵
  PID:9780
- C:\Windows\System\oWyebzE.exe
  C:\Windows\System\oWyebzE.exe
  2⤵
  PID:9812
- C:\Windows\System\ZXkkmyQ.exe
  C:\Windows\System\ZXkkmyQ.exe
  2⤵
  PID:9840
- C:\Windows\System\mePnvpk.exe
  C:\Windows\System\mePnvpk.exe
  2⤵
  PID:9868
- C:\Windows\System\NQFDrET.exe
  C:\Windows\System\NQFDrET.exe
  2⤵
  PID:9892
- C:\Windows\System\fhydBEO.exe
  C:\Windows\System\fhydBEO.exe
  2⤵
  PID:9920
- C:\Windows\System\jHvUCFA.exe
  C:\Windows\System\jHvUCFA.exe
  2⤵
  PID:9956
- C:\Windows\System\dsWWgaJ.exe
  C:\Windows\System\dsWWgaJ.exe
  2⤵
  PID:9976
- C:\Windows\System\jgNqvKf.exe
  C:\Windows\System\jgNqvKf.exe
  2⤵
  PID:10012
- C:\Windows\System\pQoztKC.exe
  C:\Windows\System\pQoztKC.exe
  2⤵
  PID:10040
- C:\Windows\System\GdHLVRF.exe
  C:\Windows\System\GdHLVRF.exe
  2⤵
  PID:10064
- C:\Windows\System\igWkaHN.exe
  C:\Windows\System\igWkaHN.exe
  2⤵
  PID:10096
- C:\Windows\System\cxztLvO.exe
  C:\Windows\System\cxztLvO.exe
  2⤵
  PID:10120
- C:\Windows\System\fNpTzzL.exe
  C:\Windows\System\fNpTzzL.exe
  2⤵
  PID:10144
- C:\Windows\System\gjpeWOa.exe
  C:\Windows\System\gjpeWOa.exe
  2⤵
  PID:10168
- C:\Windows\System\rdIdJbE.exe
  C:\Windows\System\rdIdJbE.exe
  2⤵
  PID:10208
- C:\Windows\System\wlyJQOa.exe
  C:\Windows\System\wlyJQOa.exe
  2⤵
  PID:8908
- C:\Windows\System\GqIzDJM.exe
  C:\Windows\System\GqIzDJM.exe
  2⤵
  PID:8772
- C:\Windows\System\opuiHTe.exe
  C:\Windows\System\opuiHTe.exe
  2⤵
  PID:9008
- C:\Windows\System\aTueuHB.exe
  C:\Windows\System\aTueuHB.exe
  2⤵
  PID:9308
- C:\Windows\System\DpoZGQo.exe
  C:\Windows\System\DpoZGQo.exe
  2⤵
  PID:9400
- C:\Windows\System\TPiGPqI.exe
  C:\Windows\System\TPiGPqI.exe
  2⤵
  PID:9448
- C:\Windows\System\qDelKmO.exe
  C:\Windows\System\qDelKmO.exe
  2⤵
  PID:9416
- C:\Windows\System\WzKklzP.exe
  C:\Windows\System\WzKklzP.exe
  2⤵
  PID:9544
- C:\Windows\System\TvQnMCR.exe
  C:\Windows\System\TvQnMCR.exe
  2⤵
  PID:9568
- C:\Windows\System\ZqthZiw.exe
  C:\Windows\System\ZqthZiw.exe
  2⤵
  PID:9684
- C:\Windows\System\IoPIEMw.exe
  C:\Windows\System\IoPIEMw.exe
  2⤵
  PID:9744
- C:\Windows\System\qiAfKli.exe
  C:\Windows\System\qiAfKli.exe
  2⤵
  PID:9740
- C:\Windows\System\iFNZady.exe
  C:\Windows\System\iFNZady.exe
  2⤵
  PID:9884
- C:\Windows\System\eivmgmf.exe
  C:\Windows\System\eivmgmf.exe
  2⤵
  PID:9824
- C:\Windows\System\iRuFdRv.exe
  C:\Windows\System\iRuFdRv.exe
  2⤵
  PID:10036
- C:\Windows\System\ABPnrJU.exe
  C:\Windows\System\ABPnrJU.exe
  2⤵
  PID:10076
- C:\Windows\System\eOARRed.exe
  C:\Windows\System\eOARRed.exe
  2⤵
  PID:10084
- C:\Windows\System\uHQrzti.exe
  C:\Windows\System\uHQrzti.exe
  2⤵
  PID:10080
- C:\Windows\System\WgFUzQV.exe
  C:\Windows\System\WgFUzQV.exe
  2⤵
  PID:10176
- C:\Windows\System\FdlYDZT.exe
  C:\Windows\System\FdlYDZT.exe
  2⤵
  PID:8604
- C:\Windows\System\XlJmDlt.exe
  C:\Windows\System\XlJmDlt.exe
  2⤵
  PID:9392
- C:\Windows\System\wSXKBYc.exe
  C:\Windows\System\wSXKBYc.exe
  2⤵
  PID:9496
- C:\Windows\System\DwgrQBT.exe
  C:\Windows\System\DwgrQBT.exe
  2⤵
  PID:9456
- C:\Windows\System\XZsChsm.exe
  C:\Windows\System\XZsChsm.exe
  2⤵
  PID:9656
- C:\Windows\System\xGZJGxh.exe
  C:\Windows\System\xGZJGxh.exe
  2⤵
  PID:9952
- C:\Windows\System\BrKgyif.exe
  C:\Windows\System\BrKgyif.exe
  2⤵
  PID:9948
- C:\Windows\System\nPVXXmM.exe
  C:\Windows\System\nPVXXmM.exe
  2⤵
  PID:10164
- C:\Windows\System\EDcaiwF.exe
  C:\Windows\System\EDcaiwF.exe
  2⤵
  PID:10116
- C:\Windows\System\lrzEuJE.exe
  C:\Windows\System\lrzEuJE.exe
  2⤵
  PID:9680
- C:\Windows\System\UFjmNGD.exe
  C:\Windows\System\UFjmNGD.exe
  2⤵
  PID:9996
- C:\Windows\System\QCoAzfr.exe
  C:\Windows\System\QCoAzfr.exe
  2⤵
  PID:10284
- C:\Windows\System\VyUvpRf.exe
  C:\Windows\System\VyUvpRf.exe
  2⤵
  PID:10320
- C:\Windows\System\gYjNFOw.exe
  C:\Windows\System\gYjNFOw.exe
  2⤵
  PID:10348
- C:\Windows\System\mCLMssn.exe
  C:\Windows\System\mCLMssn.exe
  2⤵
  PID:10384
- C:\Windows\System\KfByHTR.exe
  C:\Windows\System\KfByHTR.exe
  2⤵
  PID:10412
- C:\Windows\System\oguwnrb.exe
  C:\Windows\System\oguwnrb.exe
  2⤵
  PID:10440
- C:\Windows\System\BCKcgTU.exe
  C:\Windows\System\BCKcgTU.exe
  2⤵
  PID:10468
- C:\Windows\System\fZKFFHO.exe
  C:\Windows\System\fZKFFHO.exe
  2⤵
  PID:10496
- C:\Windows\System\qUBnSAa.exe
  C:\Windows\System\qUBnSAa.exe
  2⤵
  PID:10532
- C:\Windows\System\KLUsxmM.exe
  C:\Windows\System\KLUsxmM.exe
  2⤵
  PID:10564
- C:\Windows\System\pqmRXTd.exe
  C:\Windows\System\pqmRXTd.exe
  2⤵
  PID:10596
- C:\Windows\System\DEOoHyM.exe
  C:\Windows\System\DEOoHyM.exe
  2⤵
  PID:10624
- C:\Windows\System\HawSGlq.exe
  C:\Windows\System\HawSGlq.exe
  2⤵
  PID:10652
- C:\Windows\System\hdDednB.exe
  C:\Windows\System\hdDednB.exe
  2⤵
  PID:10680
- C:\Windows\System\OFnSmuO.exe
  C:\Windows\System\OFnSmuO.exe
  2⤵
  PID:10704
- C:\Windows\System\vKykRDW.exe
  C:\Windows\System\vKykRDW.exe
  2⤵
  PID:10736
- C:\Windows\System\oURjyns.exe
  C:\Windows\System\oURjyns.exe
  2⤵
  PID:10764
- C:\Windows\System\JVFJbfV.exe
  C:\Windows\System\JVFJbfV.exe
  2⤵
  PID:10792
- C:\Windows\System\KxxfuQC.exe
  C:\Windows\System\KxxfuQC.exe
  2⤵
  PID:10816
- C:\Windows\System\mgPoaKX.exe
  C:\Windows\System\mgPoaKX.exe
  2⤵
  PID:10848
- C:\Windows\System\SQLQvkH.exe
  C:\Windows\System\SQLQvkH.exe
  2⤵
  PID:10876
- C:\Windows\System\XjHxfza.exe
  C:\Windows\System\XjHxfza.exe
  2⤵
  PID:10916
- C:\Windows\System\vedKLRD.exe
  C:\Windows\System\vedKLRD.exe
  2⤵
  PID:10940
- C:\Windows\System\oxsFNIG.exe
  C:\Windows\System\oxsFNIG.exe
  2⤵
  PID:10968
- C:\Windows\System\bVdSWJL.exe
  C:\Windows\System\bVdSWJL.exe
  2⤵
  PID:10996
- C:\Windows\System\bshKAsW.exe
  C:\Windows\System\bshKAsW.exe
  2⤵
  PID:11024
- C:\Windows\System\fREhIvO.exe
  C:\Windows\System\fREhIvO.exe
  2⤵
  PID:11048
- C:\Windows\System\sQaCLdn.exe
  C:\Windows\System\sQaCLdn.exe
  2⤵
  PID:11080
- C:\Windows\System\pJBjSwq.exe
  C:\Windows\System\pJBjSwq.exe
  2⤵
  PID:11100
- C:\Windows\System\AQwuIZm.exe
  C:\Windows\System\AQwuIZm.exe
  2⤵
  PID:11120
- C:\Windows\System\kkWTPcV.exe
  C:\Windows\System\kkWTPcV.exe
  2⤵
  PID:11140
- C:\Windows\System\sAxkNOs.exe
  C:\Windows\System\sAxkNOs.exe
  2⤵
  PID:11164
- C:\Windows\System\IODjvsZ.exe
  C:\Windows\System\IODjvsZ.exe
  2⤵
  PID:11188
- C:\Windows\System\MBWHKDp.exe
  C:\Windows\System\MBWHKDp.exe
  2⤵
  PID:11212
- C:\Windows\System\xPZlmhz.exe
  C:\Windows\System\xPZlmhz.exe
  2⤵
  PID:11244
- C:\Windows\System\nVFLWkl.exe
  C:\Windows\System\nVFLWkl.exe
  2⤵
  PID:10108
- C:\Windows\System\FpLOcnW.exe
  C:\Windows\System\FpLOcnW.exe
  2⤵
  PID:9252
- C:\Windows\System\GlESxdL.exe
  C:\Windows\System\GlESxdL.exe
  2⤵
  PID:10304
- C:\Windows\System\XpbWYzz.exe
  C:\Windows\System\XpbWYzz.exe
  2⤵
  PID:9728
- C:\Windows\System\TiYcDPl.exe
  C:\Windows\System\TiYcDPl.exe
  2⤵
  PID:10456
- C:\Windows\System\urxIGSF.exe
  C:\Windows\System\urxIGSF.exe
  2⤵
  PID:10408
- C:\Windows\System\mZjZtRb.exe
  C:\Windows\System\mZjZtRb.exe
  2⤵
  PID:10612
- C:\Windows\System\igxapNP.exe
  C:\Windows\System\igxapNP.exe
  2⤵
  PID:10584
- C:\Windows\System\QgVewOv.exe
  C:\Windows\System\QgVewOv.exe
  2⤵
  PID:10744
- C:\Windows\System\dRjFjWb.exe
  C:\Windows\System\dRjFjWb.exe
  2⤵
  PID:10692
- C:\Windows\System\cfYZxSe.exe
  C:\Windows\System\cfYZxSe.exe
  2⤵
  PID:10836
- C:\Windows\System\CCClyzX.exe
  C:\Windows\System\CCClyzX.exe
  2⤵
  PID:10860
- C:\Windows\System\WowgXPX.exe
  C:\Windows\System\WowgXPX.exe
  2⤵
  PID:10952
- C:\Windows\System\jjWkkzk.exe
  C:\Windows\System\jjWkkzk.exe
  2⤵
  PID:11076
- C:\Windows\System\NyubXAa.exe
  C:\Windows\System\NyubXAa.exe
  2⤵
  PID:11064
- C:\Windows\System\rmcLaSb.exe
  C:\Windows\System\rmcLaSb.exe
  2⤵
  PID:11176
- C:\Windows\System\tFBSkCO.exe
  C:\Windows\System\tFBSkCO.exe
  2⤵
  PID:11236
- C:\Windows\System\lqauORO.exe
  C:\Windows\System\lqauORO.exe
  2⤵
  PID:11200
- C:\Windows\System\FLpYShL.exe
  C:\Windows\System\FLpYShL.exe
  2⤵
  PID:10556
- C:\Windows\System\mndZBoy.exe
  C:\Windows\System\mndZBoy.exe
  2⤵
  PID:10364
- C:\Windows\System\yOIdnkz.exe
  C:\Windows\System\yOIdnkz.exe
  2⤵
  PID:10720
- C:\Windows\System\NjSJjGa.exe
  C:\Windows\System\NjSJjGa.exe
  2⤵
  PID:10636
- C:\Windows\System\FaFdtJK.exe
  C:\Windows\System\FaFdtJK.exe
  2⤵
  PID:11044
- C:\Windows\System\mIZirIu.exe
  C:\Windows\System\mIZirIu.exe
  2⤵
  PID:8804
- C:\Windows\System\HWOhokD.exe
  C:\Windows\System\HWOhokD.exe
  2⤵
  PID:11220
- C:\Windows\System\AmVneBB.exe
  C:\Windows\System\AmVneBB.exe
  2⤵
  PID:10640
- C:\Windows\System\uqZPuyD.exe
  C:\Windows\System\uqZPuyD.exe
  2⤵
  PID:11284
- C:\Windows\System\UssdKdS.exe
  C:\Windows\System\UssdKdS.exe
  2⤵
  PID:11320
- C:\Windows\System\XFTBuDy.exe
  C:\Windows\System\XFTBuDy.exe
  2⤵
  PID:11348
- C:\Windows\System\EsLotgg.exe
  C:\Windows\System\EsLotgg.exe
  2⤵
  PID:11384
- C:\Windows\System\QSCNUhw.exe
  C:\Windows\System\QSCNUhw.exe
  2⤵
  PID:11404
- C:\Windows\System\DRhNsRM.exe
  C:\Windows\System\DRhNsRM.exe
  2⤵
  PID:11436
- C:\Windows\System\ttVhKhh.exe
  C:\Windows\System\ttVhKhh.exe
  2⤵
  PID:11464
- C:\Windows\System\lAHYbuX.exe
  C:\Windows\System\lAHYbuX.exe
  2⤵
  PID:11488
- C:\Windows\System\RDxypqf.exe
  C:\Windows\System\RDxypqf.exe
  2⤵
  PID:11520
- C:\Windows\System\GXOGgwZ.exe
  C:\Windows\System\GXOGgwZ.exe
  2⤵
  PID:11552
- C:\Windows\System\wrbLGsC.exe
  C:\Windows\System\wrbLGsC.exe
  2⤵
  PID:11572
- C:\Windows\System\zMHPUYO.exe
  C:\Windows\System\zMHPUYO.exe
  2⤵
  PID:11600
- C:\Windows\System\FTrYCMu.exe
  C:\Windows\System\FTrYCMu.exe
  2⤵
  PID:11624
- C:\Windows\System\fAHqTcd.exe
  C:\Windows\System\fAHqTcd.exe
  2⤵
  PID:11652
- C:\Windows\System\qIbTnUF.exe
  C:\Windows\System\qIbTnUF.exe
  2⤵
  PID:11672
- C:\Windows\System\sWqGWfB.exe
  C:\Windows\System\sWqGWfB.exe
  2⤵
  PID:11708
- C:\Windows\System\gNnsqLB.exe
  C:\Windows\System\gNnsqLB.exe
  2⤵
  PID:11752
- C:\Windows\System\OtuVzfK.exe
  C:\Windows\System\OtuVzfK.exe
  2⤵
  PID:11776
- C:\Windows\System\LZUTHmj.exe
  C:\Windows\System\LZUTHmj.exe
  2⤵
  PID:11800
- C:\Windows\System\XYzNNRM.exe
  C:\Windows\System\XYzNNRM.exe
  2⤵
  PID:11828
- C:\Windows\System\AGcJePf.exe
  C:\Windows\System\AGcJePf.exe
  2⤵
  PID:11856
- C:\Windows\System\HREeBIj.exe
  C:\Windows\System\HREeBIj.exe
  2⤵
  PID:11888
- C:\Windows\System\bCXQxIE.exe
  C:\Windows\System\bCXQxIE.exe
  2⤵
  PID:11912
- C:\Windows\System\LPJDSmx.exe
  C:\Windows\System\LPJDSmx.exe
  2⤵
  PID:11940
- C:\Windows\System\ZKIGRQo.exe
  C:\Windows\System\ZKIGRQo.exe
  2⤵
  PID:11972
- C:\Windows\System\voFpiJJ.exe
  C:\Windows\System\voFpiJJ.exe
  2⤵
  PID:11988
- C:\Windows\System\GIrnwPx.exe
  C:\Windows\System\GIrnwPx.exe
  2⤵
  PID:12024
- C:\Windows\System\SUuJOmG.exe
  C:\Windows\System\SUuJOmG.exe
  2⤵
  PID:12052
- C:\Windows\System\lYEvAcp.exe
  C:\Windows\System\lYEvAcp.exe
  2⤵
  PID:12092
- C:\Windows\System\fAsjbfV.exe
  C:\Windows\System\fAsjbfV.exe
  2⤵
  PID:12124
- C:\Windows\System\tUnWFLN.exe
  C:\Windows\System\tUnWFLN.exe
  2⤵
  PID:12172
- C:\Windows\System\ivzGuTO.exe
  C:\Windows\System\ivzGuTO.exe
  2⤵
  PID:12192
- C:\Windows\System\WqYmlzf.exe
  C:\Windows\System\WqYmlzf.exe
  2⤵
  PID:12216
- C:\Windows\System\KYdWzLK.exe
  C:\Windows\System\KYdWzLK.exe
  2⤵
  PID:12240
- C:\Windows\System\JUuhSRJ.exe
  C:\Windows\System\JUuhSRJ.exe
  2⤵
  PID:12264
- C:\Windows\System\zmJeCgt.exe
  C:\Windows\System\zmJeCgt.exe
  2⤵
  PID:11040
- C:\Windows\System\gxcmTYL.exe
  C:\Windows\System\gxcmTYL.exe
  2⤵
  PID:10576
- C:\Windows\System\EPjwOYD.exe
  C:\Windows\System\EPjwOYD.exe
  2⤵
  PID:10700
- C:\Windows\System\YESEmyz.exe
  C:\Windows\System\YESEmyz.exe
  2⤵
  PID:11372
- C:\Windows\System\jDdmszL.exe
  C:\Windows\System\jDdmszL.exe
  2⤵
  PID:11420
- C:\Windows\System\aSdKOiJ.exe
  C:\Windows\System\aSdKOiJ.exe
  2⤵
  PID:11452
- C:\Windows\System\pGutaJw.exe
  C:\Windows\System\pGutaJw.exe
  2⤵
  PID:11512
- C:\Windows\System\pvgpdoQ.exe
  C:\Windows\System\pvgpdoQ.exe
  2⤵
  PID:11536
- C:\Windows\System\RjfAXbW.exe
  C:\Windows\System\RjfAXbW.exe
  2⤵
  PID:11640
- C:\Windows\System\YDLVbqs.exe
  C:\Windows\System\YDLVbqs.exe
  2⤵
  PID:11720
- C:\Windows\System\rSDAxIE.exe
  C:\Windows\System\rSDAxIE.exe
  2⤵
  PID:11664
- C:\Windows\System\SjkIbMb.exe
  C:\Windows\System\SjkIbMb.exe
  2⤵
  PID:11824
- C:\Windows\System\CoIVdcq.exe
  C:\Windows\System\CoIVdcq.exe
  2⤵
  PID:11796
- C:\Windows\System\AazqYTa.exe
  C:\Windows\System\AazqYTa.exe
  2⤵
  PID:11960
- C:\Windows\System\KsHvkKu.exe
  C:\Windows\System\KsHvkKu.exe
  2⤵
  PID:11920
- C:\Windows\System\sszMYcy.exe
  C:\Windows\System\sszMYcy.exe
  2⤵
  PID:11952
- C:\Windows\System\CpGRQUP.exe
  C:\Windows\System\CpGRQUP.exe
  2⤵
  PID:12120
- C:\Windows\System\BvtHwpt.exe
  C:\Windows\System\BvtHwpt.exe
  2⤵
  PID:12112
- C:\Windows\System\VtipmuE.exe
  C:\Windows\System\VtipmuE.exe
  2⤵
  PID:12280
- C:\Windows\System\TPhemBz.exe
  C:\Windows\System\TPhemBz.exe
  2⤵
  PID:12272
- C:\Windows\System\dywPBFi.exe
  C:\Windows\System\dywPBFi.exe
  2⤵
  PID:11312
- C:\Windows\System\FnHzAwC.exe
  C:\Windows\System\FnHzAwC.exe
  2⤵
  PID:11620
- C:\Windows\System\wBtNzJw.exe
  C:\Windows\System\wBtNzJw.exe
  2⤵
  PID:11392
- C:\Windows\System\MrWTbzi.exe
  C:\Windows\System\MrWTbzi.exe
  2⤵
  PID:11840
- C:\Windows\System\JJfphJv.exe
  C:\Windows\System\JJfphJv.exe
  2⤵
  PID:11496
- C:\Windows\System\GglkNIv.exe
  C:\Windows\System\GglkNIv.exe
  2⤵
  PID:12020
- C:\Windows\System\ZAGJpyr.exe
  C:\Windows\System\ZAGJpyr.exe
  2⤵
  PID:11868
- C:\Windows\System\TMJkTZM.exe
  C:\Windows\System\TMJkTZM.exe
  2⤵
  PID:12252
- C:\Windows\System\gUHGgEZ.exe
  C:\Windows\System\gUHGgEZ.exe
  2⤵
  PID:10900
- C:\Windows\System\ETInsAw.exe
  C:\Windows\System\ETInsAw.exe
  2⤵
  PID:11292
- C:\Windows\System\GeNGyTd.exe
  C:\Windows\System\GeNGyTd.exe
  2⤵
  PID:12292
- C:\Windows\System\bKKHBgF.exe
  C:\Windows\System\bKKHBgF.exe
  2⤵
  PID:12312
- C:\Windows\System\NCblzEb.exe
  C:\Windows\System\NCblzEb.exe
  2⤵
  PID:12348
- C:\Windows\System\hWfpTor.exe
  C:\Windows\System\hWfpTor.exe
  2⤵
  PID:12376
- C:\Windows\System\lcmTBso.exe
  C:\Windows\System\lcmTBso.exe
  2⤵
  PID:12408
- C:\Windows\System\vYeqQrI.exe
  C:\Windows\System\vYeqQrI.exe
  2⤵
  PID:12432
- C:\Windows\System\NzGZyst.exe
  C:\Windows\System\NzGZyst.exe
  2⤵
  PID:12452
- C:\Windows\System\nBvylqW.exe
  C:\Windows\System\nBvylqW.exe
  2⤵
  PID:12488
- C:\Windows\System\VAoBQee.exe
  C:\Windows\System\VAoBQee.exe
  2⤵
  PID:12520
- C:\Windows\System\lzuYmZl.exe
  C:\Windows\System\lzuYmZl.exe
  2⤵
  PID:12552
- C:\Windows\System\XHpMDnw.exe
  C:\Windows\System\XHpMDnw.exe
  2⤵
  PID:12568
- C:\Windows\System\LLVWUPG.exe
  C:\Windows\System\LLVWUPG.exe
  2⤵
  PID:12596
- C:\Windows\System\hjGhPlj.exe
  C:\Windows\System\hjGhPlj.exe
  2⤵
  PID:12624
- C:\Windows\System\wVsseBl.exe
  C:\Windows\System\wVsseBl.exe
  2⤵
  PID:12652
- C:\Windows\System\OfqBSOI.exe
  C:\Windows\System\OfqBSOI.exe
  2⤵
  PID:12684
- C:\Windows\System\QOElaAl.exe
  C:\Windows\System\QOElaAl.exe
  2⤵
  PID:12708
- C:\Windows\System\VwIZtBM.exe
  C:\Windows\System\VwIZtBM.exe
  2⤵
  PID:12736
- C:\Windows\System\iqEhbpM.exe
  C:\Windows\System\iqEhbpM.exe
  2⤵
  PID:12756
- C:\Windows\System\yQIoBdO.exe
  C:\Windows\System\yQIoBdO.exe
  2⤵
  PID:12784
- C:\Windows\System\NIquOqw.exe
  C:\Windows\System\NIquOqw.exe
  2⤵
  PID:12800
- C:\Windows\System\FWgjKso.exe
  C:\Windows\System\FWgjKso.exe
  2⤵
  PID:12836
- C:\Windows\System\CgDRqYj.exe
  C:\Windows\System\CgDRqYj.exe
  2⤵
  PID:12864
- C:\Windows\System\OQkyHhP.exe
  C:\Windows\System\OQkyHhP.exe
  2⤵
  PID:12892
- C:\Windows\System\zXOLSyK.exe
  C:\Windows\System\zXOLSyK.exe
  2⤵
  PID:12916
- C:\Windows\System\vWltrwo.exe
  C:\Windows\System\vWltrwo.exe
  2⤵
  PID:12936
- C:\Windows\System\hoctdvv.exe
  C:\Windows\System\hoctdvv.exe
  2⤵
  PID:12964
- C:\Windows\System\nTbRcmA.exe
  C:\Windows\System\nTbRcmA.exe
  2⤵
  PID:12984
- C:\Windows\System\tgCktet.exe
  C:\Windows\System\tgCktet.exe
  2⤵
  PID:13024
- C:\Windows\System\EZeotcw.exe
  C:\Windows\System\EZeotcw.exe
  2⤵
  PID:13040
- C:\Windows\System\lxIXwSp.exe
  C:\Windows\System\lxIXwSp.exe
  2⤵
  PID:13080
- C:\Windows\System\bwctVOG.exe
  C:\Windows\System\bwctVOG.exe
  2⤵
  PID:13100
- C:\Windows\System\QOOyVJg.exe
  C:\Windows\System\QOOyVJg.exe
  2⤵
  PID:13132
- C:\Windows\System\YHHykMk.exe
  C:\Windows\System\YHHykMk.exe
  2⤵
  PID:13160
- C:\Windows\System\LnJlxgi.exe
  C:\Windows\System\LnJlxgi.exe
  2⤵
  PID:13180
- C:\Windows\System\oCalFLH.exe
  C:\Windows\System\oCalFLH.exe
  2⤵
  PID:13204
- C:\Windows\System\DJRKAsC.exe
  C:\Windows\System\DJRKAsC.exe
  2⤵
  PID:13232
- C:\Windows\System\nZSSVTf.exe
  C:\Windows\System\nZSSVTf.exe
  2⤵
  PID:13260
- C:\Windows\System\LTTKitj.exe
  C:\Windows\System\LTTKitj.exe
  2⤵
  PID:13296
- C:\Windows\System\tcKsCkL.exe
  C:\Windows\System\tcKsCkL.exe
  2⤵
  PID:11980
- C:\Windows\System\ytbUpgO.exe
  C:\Windows\System\ytbUpgO.exe
  2⤵
  PID:11208
- C:\Windows\System\SnpQUwX.exe
  C:\Windows\System\SnpQUwX.exe
  2⤵
  PID:12400
- C:\Windows\System\SGVejdY.exe
  C:\Windows\System\SGVejdY.exe
  2⤵
  PID:12460
- C:\Windows\System\OGlGITN.exe
  C:\Windows\System\OGlGITN.exe
  2⤵
  PID:12536
- C:\Windows\System\ttTltYO.exe
  C:\Windows\System\ttTltYO.exe
  2⤵
  PID:12588
- C:\Windows\System\UvCVwPE.exe
  C:\Windows\System\UvCVwPE.exe
  2⤵
  PID:12636
- C:\Windows\System\nZPcIoy.exe
  C:\Windows\System\nZPcIoy.exe
  2⤵
  PID:12532
- C:\Windows\System\RBLIRfx.exe
  C:\Windows\System\RBLIRfx.exe
  2⤵
  PID:12820
- C:\Windows\System\krXbRsW.exe
  C:\Windows\System\krXbRsW.exe
  2⤵
  PID:12700
- C:\Windows\System\UCLhKEH.exe
  C:\Windows\System\UCLhKEH.exe
  2⤵
  PID:12792
- C:\Windows\System\mqrgUtV.exe
  C:\Windows\System\mqrgUtV.exe
  2⤵
  PID:12908
- C:\Windows\System\ITBXknT.exe
  C:\Windows\System\ITBXknT.exe
  2⤵
  PID:12948
- C:\Windows\System\Tgvlyoi.exe
  C:\Windows\System\Tgvlyoi.exe
  2⤵
  PID:12976
- C:\Windows\System\LqeapWZ.exe
  C:\Windows\System\LqeapWZ.exe
  2⤵
  PID:13012
- C:\Windows\System\cFdzYyL.exe
  C:\Windows\System\cFdzYyL.exe
  2⤵
  PID:13224
- C:\Windows\System\FgwXCWm.exe
  C:\Windows\System\FgwXCWm.exe
  2⤵
  PID:13272
- C:\Windows\System\pxSZQQa.exe
  C:\Windows\System\pxSZQQa.exe
  2⤵
  PID:12324
- C:\Windows\System\krBuWos.exe
  C:\Windows\System\krBuWos.exe
  2⤵
  PID:12616
- C:\Windows\System\zvmQObg.exe
  C:\Windows\System\zvmQObg.exe
  2⤵
  PID:13192
- C:\Windows\System\gMAddyx.exe
  C:\Windows\System\gMAddyx.exe
  2⤵
  PID:13256
- C:\Windows\System\qXJAjNS.exe
  C:\Windows\System\qXJAjNS.exe
  2⤵
  PID:12140
- C:\Windows\System\MWpYbZk.exe
  C:\Windows\System\MWpYbZk.exe
  2⤵
  PID:13320
- C:\Windows\System\nLMPizr.exe
  C:\Windows\System\nLMPizr.exe
  2⤵
  PID:13352
- C:\Windows\System\eLiPYbw.exe
  C:\Windows\System\eLiPYbw.exe
  2⤵
  PID:13372
- C:\Windows\System\HrEGhmk.exe
  C:\Windows\System\HrEGhmk.exe
  2⤵
  PID:13400
- C:\Windows\System\ngZxjTm.exe
  C:\Windows\System\ngZxjTm.exe
  2⤵
  PID:13420
- C:\Windows\System\naVxQFU.exe
  C:\Windows\System\naVxQFU.exe
  2⤵
  PID:13444
- C:\Windows\System\SgqbHBk.exe
  C:\Windows\System\SgqbHBk.exe
  2⤵
  PID:13464
- C:\Windows\System\NyESngw.exe
  C:\Windows\System\NyESngw.exe
  2⤵
  PID:13496
- C:\Windows\System\dlgNxkg.exe
  C:\Windows\System\dlgNxkg.exe
  2⤵
  PID:13520
- C:\Windows\System\vsilmow.exe
  C:\Windows\System\vsilmow.exe
  2⤵
  PID:13544
- C:\Windows\System\SpocUzT.exe
  C:\Windows\System\SpocUzT.exe
  2⤵
  PID:13576
- C:\Windows\System\atiisBB.exe
  C:\Windows\System\atiisBB.exe
  2⤵
  PID:13612
- C:\Windows\System\DtXZJXO.exe
  C:\Windows\System\DtXZJXO.exe
  2⤵
  PID:13632
- C:\Windows\System\kZewoWh.exe
  C:\Windows\System\kZewoWh.exe
  2⤵
  PID:13648
- C:\Windows\System\qPjWDnE.exe
  C:\Windows\System\qPjWDnE.exe
  2⤵
  PID:13668
- C:\Windows\System\PXDViJw.exe
  C:\Windows\System\PXDViJw.exe
  2⤵
  PID:13696
- C:\Windows\System\JBqPZWa.exe
  C:\Windows\System\JBqPZWa.exe
  2⤵
  PID:13724
- C:\Windows\System\bdxWfla.exe
  C:\Windows\System\bdxWfla.exe
  2⤵
  PID:13752
- C:\Windows\System\JXkwPse.exe
  C:\Windows\System\JXkwPse.exe
  2⤵
  PID:13776
- C:\Windows\System\sKnBdpQ.exe
  C:\Windows\System\sKnBdpQ.exe
  2⤵
  PID:13800
- C:\Windows\System\WEHWzSP.exe
  C:\Windows\System\WEHWzSP.exe
  2⤵
  PID:13824
- C:\Windows\System\nZdHiQI.exe
  C:\Windows\System\nZdHiQI.exe
  2⤵
  PID:13864
- C:\Windows\System\DIlxBXZ.exe
  C:\Windows\System\DIlxBXZ.exe
  2⤵
  PID:13884
- C:\Windows\System\YtIIKul.exe
  C:\Windows\System\YtIIKul.exe
  2⤵
  PID:13912
- C:\Windows\System\LejgmcR.exe
  C:\Windows\System\LejgmcR.exe
  2⤵
  PID:13944
- C:\Windows\System\ciOyeGj.exe
  C:\Windows\System\ciOyeGj.exe
  2⤵
  PID:13964
- C:\Windows\System\oTcogTR.exe
  C:\Windows\System\oTcogTR.exe
  2⤵
  PID:13988
- C:\Windows\System\iubSuMb.exe
  C:\Windows\System\iubSuMb.exe
  2⤵
  PID:14024
- C:\Windows\System\woEHgoR.exe
  C:\Windows\System\woEHgoR.exe
  2⤵
  PID:14056
- C:\Windows\System\krDaNUB.exe
  C:\Windows\System\krDaNUB.exe
  2⤵
  PID:14092
- C:\Windows\System\ACoGRhH.exe
  C:\Windows\System\ACoGRhH.exe
  2⤵
  PID:14120
- C:\Windows\System\QIMDCKr.exe
  C:\Windows\System\QIMDCKr.exe
  2⤵
  PID:14144
- C:\Windows\System\pgmwGZW.exe
  C:\Windows\System\pgmwGZW.exe
  2⤵
  PID:14164
- C:\Windows\System\EpdFkgq.exe
  C:\Windows\System\EpdFkgq.exe
  2⤵
  PID:14184
- C:\Windows\System\NOCWjeJ.exe
  C:\Windows\System\NOCWjeJ.exe
  2⤵
  PID:14216
- C:\Windows\System\ghhdvLQ.exe
  C:\Windows\System\ghhdvLQ.exe
  2⤵
  PID:14244
- C:\Windows\System\gDdgFTb.exe
  C:\Windows\System\gDdgFTb.exe
  2⤵
  PID:14272
- C:\Windows\System\yvyEfoL.exe
  C:\Windows\System\yvyEfoL.exe
  2⤵
  PID:14304
- C:\Windows\System\UvzCYgy.exe
  C:\Windows\System\UvzCYgy.exe
  2⤵
  PID:14320
- C:\Windows\System\IGyISSD.exe
  C:\Windows\System\IGyISSD.exe
  2⤵
  PID:13036
- C:\Windows\System\bZLkyGn.exe
  C:\Windows\System\bZLkyGn.exe
  2⤵
  PID:12956
- C:\Windows\System\hCsJLXE.exe
  C:\Windows\System\hCsJLXE.exe
  2⤵
  PID:12844
- C:\Windows\System\cOUabwS.exe
  C:\Windows\System\cOUabwS.exe
  2⤵
  PID:12728
- C:\Windows\System\rqHhwuj.exe
  C:\Windows\System\rqHhwuj.exe
  2⤵
  PID:12928
- C:\Windows\System\tsblfCH.exe
  C:\Windows\System\tsblfCH.exe
  2⤵
  PID:12580
- C:\Windows\System\VrQteGr.exe
  C:\Windows\System\VrQteGr.exe
  2⤵
  PID:13220
- C:\Windows\System\qiHwipx.exe
  C:\Windows\System\qiHwipx.exe
  2⤵
  PID:13156
- C:\Windows\System\MzHCfBa.exe
  C:\Windows\System\MzHCfBa.exe
  2⤵
  PID:10368
- C:\Windows\System\NCXxyKI.exe
  C:\Windows\System\NCXxyKI.exe
  2⤵
  PID:14112
- C:\Windows\System\GMmkYCW.exe
  C:\Windows\System\GMmkYCW.exe
  2⤵
  PID:13904
- C:\Windows\System\LAgiYlb.exe
  C:\Windows\System\LAgiYlb.exe
  2⤵
  PID:13336
- C:\Windows\System\cKdChhF.exe
  C:\Windows\System\cKdChhF.exe
  2⤵
  PID:13364
- C:\Windows\System\EwbtAbl.exe
  C:\Windows\System\EwbtAbl.exe
  2⤵
  PID:12720
- C:\Windows\System\VuNyWuH.exe
  C:\Windows\System\VuNyWuH.exe
  2⤵
  PID:12752
- C:\Windows\System\YZEyptZ.exe
  C:\Windows\System\YZEyptZ.exe
  2⤵
  PID:13416
- C:\Windows\System\IONTImR.exe
  C:\Windows\System\IONTImR.exe
  2⤵
  PID:11484
- C:\Windows\System\Ksrnirp.exe
  C:\Windows\System\Ksrnirp.exe
  2⤵
  PID:13476
- C:\Windows\System\rIUmgFD.exe
  C:\Windows\System\rIUmgFD.exe
  2⤵
  PID:13436
- C:\Windows\System\joxrtKx.exe
  C:\Windows\System\joxrtKx.exe
  2⤵
  PID:14004
- C:\Windows\System\LWbyfgJ.exe
  C:\Windows\System\LWbyfgJ.exe
  2⤵
  PID:13900
- C:\Windows\System\TVAwdCC.exe
  C:\Windows\System\TVAwdCC.exe
  2⤵
  PID:14312
- C:\Windows\System\DsXlfoO.exe
  C:\Windows\System\DsXlfoO.exe
  2⤵
  PID:12388
- C:\Windows\System\encHxqh.exe
  C:\Windows\System\encHxqh.exe
  2⤵
  PID:13960
- C:\Windows\System\kRdKkgz.exe
  C:\Windows\System\kRdKkgz.exe
  2⤵
  PID:14208
- C:\Windows\System\QLKebZM.exe
  C:\Windows\System\QLKebZM.exe
  2⤵
  PID:11340
- C:\Windows\System\ddzMmIb.exe
  C:\Windows\System\ddzMmIb.exe
  2⤵
  PID:14364
- C:\Windows\System\INjoKGI.exe
  C:\Windows\System\INjoKGI.exe
  2⤵
  PID:14380
- C:\Windows\System\vQmVgYY.exe
  C:\Windows\System\vQmVgYY.exe
  2⤵
  PID:14404
- C:\Windows\System\WZpVVFE.exe
  C:\Windows\System\WZpVVFE.exe
  2⤵
  PID:14424
- C:\Windows\System\sDXBlzm.exe
  C:\Windows\System\sDXBlzm.exe
  2⤵
  PID:14448
- C:\Windows\System\tyFSGVy.exe
  C:\Windows\System\tyFSGVy.exe
  2⤵
  PID:14480
- C:\Windows\System\orBUHvC.exe
  C:\Windows\System\orBUHvC.exe
  2⤵
  PID:14508
- C:\Windows\System\BZXGsDI.exe
  C:\Windows\System\BZXGsDI.exe
  2⤵
  PID:14532
- C:\Windows\System\ebHwGGb.exe
  C:\Windows\System\ebHwGGb.exe
  2⤵
  PID:14560
- C:\Windows\System\boWEMVR.exe
  C:\Windows\System\boWEMVR.exe
  2⤵
  PID:14588
- C:\Windows\System\mjeNRRs.exe
  C:\Windows\System\mjeNRRs.exe
  2⤵
  PID:14608
- C:\Windows\System\MytXzKr.exe
  C:\Windows\System\MytXzKr.exe
  2⤵
  PID:14636
- C:\Windows\System\uNMPBfM.exe
  C:\Windows\System\uNMPBfM.exe
  2⤵
  PID:14652
- C:\Windows\System\nDphjyB.exe
  C:\Windows\System\nDphjyB.exe
  2⤵
  PID:14676
- C:\Windows\System\tAMNRZr.exe
  C:\Windows\System\tAMNRZr.exe
  2⤵
  PID:14700
- C:\Windows\System\xVIRaDc.exe
  C:\Windows\System\xVIRaDc.exe
  2⤵
  PID:14732
- C:\Windows\System\eSmCkCp.exe
  C:\Windows\System\eSmCkCp.exe
  2⤵
  PID:14756
- C:\Windows\System\AVHuwGZ.exe
  C:\Windows\System\AVHuwGZ.exe
  2⤵
  PID:14788
- C:\Windows\System\dAvsmeI.exe
  C:\Windows\System\dAvsmeI.exe
  2⤵
  PID:14812
- C:\Windows\System\yIUwOxc.exe
  C:\Windows\System\yIUwOxc.exe
  2⤵
  PID:14840
- C:\Windows\System\gTzLUwR.exe
  C:\Windows\System\gTzLUwR.exe
  2⤵
  PID:14872
- C:\Windows\System\XpqCakV.exe
  C:\Windows\System\XpqCakV.exe
  2⤵
  PID:14908
- C:\Windows\System\zLyzakx.exe
  C:\Windows\System\zLyzakx.exe
  2⤵
  PID:14936
- C:\Windows\System\ngDPgJF.exe
  C:\Windows\System\ngDPgJF.exe
  2⤵
  PID:14952
- C:\Windows\System\BpCWIXl.exe
  C:\Windows\System\BpCWIXl.exe
  2⤵
  PID:14984
- C:\Windows\System\gYmxbyX.exe
  C:\Windows\System\gYmxbyX.exe
  2⤵
  PID:15012
- C:\Windows\System\KwgVARs.exe
  C:\Windows\System\KwgVARs.exe
  2⤵
  PID:15040
- C:\Windows\System\NarFOeH.exe
  C:\Windows\System\NarFOeH.exe
  2⤵
  PID:15072
- C:\Windows\System\UcnSIgn.exe
  C:\Windows\System\UcnSIgn.exe
  2⤵
  PID:15088
- C:\Windows\System\aFFEAVH.exe
  C:\Windows\System\aFFEAVH.exe
  2⤵
  PID:15104
- C:\Windows\System\ZZJMgsq.exe
  C:\Windows\System\ZZJMgsq.exe
  2⤵
  PID:15128
- C:\Windows\System\vObUmbo.exe
  C:\Windows\System\vObUmbo.exe
  2⤵
  PID:15152
- C:\Windows\System\VuRNccR.exe
  C:\Windows\System\VuRNccR.exe
  2⤵
  PID:15184
- C:\Windows\System\TLGuvRY.exe
  C:\Windows\System\TLGuvRY.exe
  2⤵
  PID:15200
- C:\Windows\System\cZSPslA.exe
  C:\Windows\System\cZSPslA.exe
  2⤵
  PID:15216
- C:\Windows\System\GHLOvFt.exe
  C:\Windows\System\GHLOvFt.exe
  2⤵
  PID:15244
- C:\Windows\System\hCMyfnD.exe
  C:\Windows\System\hCMyfnD.exe
  2⤵
  PID:15268
- C:\Windows\System\ubkoRCT.exe
  C:\Windows\System\ubkoRCT.exe
  2⤵
  PID:15300
- C:\Windows\System\kaHulZi.exe
  C:\Windows\System\kaHulZi.exe
  2⤵
  PID:15320
- C:\Windows\System\vEtISuW.exe
  C:\Windows\System\vEtISuW.exe
  2⤵
  PID:15340
- C:\Windows\System\RqIqdnX.exe
  C:\Windows\System\RqIqdnX.exe
  2⤵
  PID:13748
- C:\Windows\System\wHDGHFa.exe
  C:\Windows\System\wHDGHFa.exe
  2⤵
  PID:14292
- C:\Windows\System\FtQmVUg.exe
  C:\Windows\System\FtQmVUg.exe
  2⤵
  PID:14372
- C:\Windows\System\DFhHLWR.exe
  C:\Windows\System\DFhHLWR.exe
  2⤵
  PID:14472
- C:\Windows\System\YjVExHy.exe
  C:\Windows\System\YjVExHy.exe
  2⤵
  PID:14468
- C:\Windows\System\xWcEhwE.exe
  C:\Windows\System\xWcEhwE.exe
  2⤵
  PID:14524
- C:\Windows\System\iZKgqAU.exe
  C:\Windows\System\iZKgqAU.exe
  2⤵
  PID:14644
- C:\Windows\System\DTWQCxQ.exe
  C:\Windows\System\DTWQCxQ.exe
  2⤵
  PID:14668
- C:\Windows\System\UzoiyHz.exe
  C:\Windows\System\UzoiyHz.exe
  2⤵
  PID:14764
- C:\Windows\System\HpqDeIF.exe
  C:\Windows\System\HpqDeIF.exe
  2⤵
  PID:14864
- C:\Windows\System\hjMFbCE.exe
  C:\Windows\System\hjMFbCE.exe
  2⤵
  PID:14904
- C:\Windows\System\LmLKPFd.exe
  C:\Windows\System\LmLKPFd.exe
  2⤵
  PID:15008
- C:\Windows\System\ckokvcB.exe
  C:\Windows\System\ckokvcB.exe
  2⤵
  PID:15100
- C:\Windows\System\vPTWeIl.exe
  C:\Windows\System\vPTWeIl.exe
  2⤵
  PID:15148
- C:\Windows\System\QkHPgRl.exe
  C:\Windows\System\QkHPgRl.exe
  2⤵
  PID:15164
- C:\Windows\System\CleSBXt.exe
  C:\Windows\System\CleSBXt.exe
  2⤵
  PID:15240
- C:\Windows\System\BiHhrPe.exe
  C:\Windows\System\BiHhrPe.exe
  2⤵
  PID:15264
- C:\Windows\System\weMlMHJ.exe
  C:\Windows\System\weMlMHJ.exe
  2⤵
  PID:15212
- C:\Windows\System\dcGrcAD.exe
  C:\Windows\System\dcGrcAD.exe
  2⤵
  PID:15308
- C:\Windows\System\dDTvxZB.exe
  C:\Windows\System\dDTvxZB.exe
  2⤵
  PID:14572
- C:\Windows\System\zcGwkcQ.exe
  C:\Windows\System\zcGwkcQ.exe
  2⤵
  PID:14688
- C:\Windows\System\aetCqDu.exe
  C:\Windows\System\aetCqDu.exe
  2⤵
  PID:14848
- C:\Windows\System\EjYNvSp.exe
  C:\Windows\System\EjYNvSp.exe
  2⤵
  PID:14548
- C:\Windows\System\cpQvKsg.exe
  C:\Windows\System\cpQvKsg.exe
  2⤵
  PID:14804
- C:\Windows\System\FghWjrh.exe
  C:\Windows\System\FghWjrh.exe
  2⤵
  PID:15256
- C:\Windows\System\OoNMweP.exe
  C:\Windows\System\OoNMweP.exe
  2⤵
  PID:15372
- C:\Windows\System\TkqOmGM.exe
  C:\Windows\System\TkqOmGM.exe
  2⤵
  PID:15392
- C:\Windows\System\gcEawCV.exe
  C:\Windows\System\gcEawCV.exe
  2⤵
  PID:15416
- C:\Windows\System\CbaxJUk.exe
  C:\Windows\System\CbaxJUk.exe
  2⤵
  PID:15440
- C:\Windows\System\XlDiXvK.exe
  C:\Windows\System\XlDiXvK.exe
  2⤵
  PID:15476
- C:\Windows\System\dUerxAR.exe
  C:\Windows\System\dUerxAR.exe
  2⤵
  PID:15496
- C:\Windows\System\GWsmpiL.exe
  C:\Windows\System\GWsmpiL.exe
  2⤵
  PID:15512
- C:\Windows\System\wTypdvH.exe
  C:\Windows\System\wTypdvH.exe
  2⤵
  PID:15552
- C:\Windows\System\RqvSHoK.exe
  C:\Windows\System\RqvSHoK.exe
  2⤵
  PID:15576
- C:\Windows\System\WfQrtln.exe
  C:\Windows\System\WfQrtln.exe
  2⤵
  PID:15608
- C:\Windows\System\jPrphXd.exe
  C:\Windows\System\jPrphXd.exe
  2⤵
  PID:15624
- C:\Windows\System\aLLtpVG.exe
  C:\Windows\System\aLLtpVG.exe
  2⤵
  PID:15640
- C:\Windows\System\fDqpYLU.exe
  C:\Windows\System\fDqpYLU.exe
  2⤵
  PID:15672
- C:\Windows\System\ngdGojj.exe
  C:\Windows\System\ngdGojj.exe
  2⤵
  PID:15688
- C:\Windows\System\FbUCNkW.exe
  C:\Windows\System\FbUCNkW.exe
  2⤵
  PID:15716
- C:\Windows\System\HTiWWlx.exe
  C:\Windows\System\HTiWWlx.exe
  2⤵
  PID:15740
- C:\Windows\System\cqYjjBm.exe
  C:\Windows\System\cqYjjBm.exe
  2⤵
  PID:15760
- C:\Windows\System\ysiqaUO.exe
  C:\Windows\System\ysiqaUO.exe
  2⤵
  PID:15796
- C:\Windows\System\xoOcxGT.exe
  C:\Windows\System\xoOcxGT.exe
  2⤵
  PID:15820
- C:\Windows\System\iOISoLk.exe
  C:\Windows\System\iOISoLk.exe
  2⤵
  PID:15844
- C:\Windows\System\BJOdECI.exe
  C:\Windows\System\BJOdECI.exe
  2⤵
  PID:15864
- C:\Windows\System\AYfsANa.exe
  C:\Windows\System\AYfsANa.exe
  2⤵
  PID:15900
- C:\Windows\System\PkoGxtt.exe
  C:\Windows\System\PkoGxtt.exe
  2⤵
  PID:15924
- C:\Windows\System\QrUiaFs.exe
  C:\Windows\System\QrUiaFs.exe
  2⤵
  PID:15952
- C:\Windows\System\YnChQRg.exe
  C:\Windows\System\YnChQRg.exe
  2⤵
  PID:15988
- C:\Windows\System\GoIHZLo.exe
  C:\Windows\System\GoIHZLo.exe
  2⤵
  PID:16012
- C:\Windows\System\swOBoPX.exe
  C:\Windows\System\swOBoPX.exe
  2⤵
  PID:16036
- C:\Windows\System\kXJJykR.exe
  C:\Windows\System\kXJJykR.exe
  2⤵
  PID:16072
- C:\Windows\System\MkhYTHa.exe
  C:\Windows\System\MkhYTHa.exe
  2⤵
  PID:16088
- C:\Windows\System\dheNfdH.exe
  C:\Windows\System\dheNfdH.exe
  2⤵
  PID:16116
- C:\Windows\System\qxCWMMq.exe
  C:\Windows\System\qxCWMMq.exe
  2⤵
  PID:16144
- C:\Windows\System\hDFtxym.exe
  C:\Windows\System\hDFtxym.exe
  2⤵
  PID:16176
- C:\Windows\System\ONjmtFb.exe
  C:\Windows\System\ONjmtFb.exe
  2⤵
  PID:16200
- C:\Windows\System\sUdYnXE.exe
  C:\Windows\System\sUdYnXE.exe
  2⤵
  PID:16224
- C:\Windows\System\XTcOusw.exe
  C:\Windows\System\XTcOusw.exe
  2⤵
  PID:16252
- C:\Windows\System\JrwLGnm.exe
  C:\Windows\System\JrwLGnm.exe
  2⤵
  PID:16272
- C:\Windows\System\zLMXuPK.exe
  C:\Windows\System\zLMXuPK.exe
  2⤵
  PID:16296
- C:\Windows\System\jTbaBbX.exe
  C:\Windows\System\jTbaBbX.exe
  2⤵
  PID:16312
- C:\Windows\System\EUxQlNV.exe
  C:\Windows\System\EUxQlNV.exe
  2⤵
  PID:16348
- C:\Windows\System\cFXTnJs.exe
  C:\Windows\System\cFXTnJs.exe
  2⤵
  PID:16372
- C:\Windows\System\UxNKFmd.exe
  C:\Windows\System\UxNKFmd.exe
  2⤵
  PID:15352
- C:\Windows\System\wuDOQiM.exe
  C:\Windows\System\wuDOQiM.exe
  2⤵
  PID:14740
- C:\Windows\System\orSigMA.exe
  C:\Windows\System\orSigMA.exe
  2⤵
  PID:14504
- C:\Windows\System\okvumwA.exe
  C:\Windows\System\okvumwA.exe
  2⤵
  PID:15368
- C:\Windows\System\ezphsaH.exe
  C:\Windows\System\ezphsaH.exe
  2⤵
  PID:14648
- C:\Windows\System\zcpkCRY.exe
  C:\Windows\System\zcpkCRY.exe
  2⤵
  PID:15064
- C:\Windows\System\iSGWtEs.exe
  C:\Windows\System\iSGWtEs.exe
  2⤵
  PID:15600
- C:\Windows\System\wmOFMBi.exe
  C:\Windows\System\wmOFMBi.exe
  2⤵
  PID:15596
- C:\Windows\System\XMVYiiX.exe
  C:\Windows\System\XMVYiiX.exe
  2⤵
  PID:15884
- C:\Windows\System\fiBvwTy.exe
  C:\Windows\System\fiBvwTy.exe
  2⤵
  PID:15920
- C:\Windows\System\RQWLbly.exe
  C:\Windows\System\RQWLbly.exe
  2⤵
  PID:15964
- C:\Windows\System\MRGBbFT.exe
  C:\Windows\System\MRGBbFT.exe
  2⤵
  PID:15860
- C:\Windows\System\xqZbsBW.exe
  C:\Windows\System\xqZbsBW.exe
  2⤵
  PID:16168
- C:\Windows\System\aZoEnPj.exe
  C:\Windows\System\aZoEnPj.exe
  2⤵
  PID:15808
- C:\Windows\System\Wkqkkct.exe
  C:\Windows\System\Wkqkkct.exe
  2⤵
  PID:15328
- C:\Windows\System\ipKmgmy.exe
  C:\Windows\System\ipKmgmy.exe
  2⤵
  PID:15432
- C:\Windows\System\naxbRwr.exe
  C:\Windows\System\naxbRwr.exe
  2⤵
  PID:16192
- C:\Windows\System\bBKqJgx.exe
  C:\Windows\System\bBKqJgx.exe
  2⤵
  PID:16304
- C:\Windows\System\RdBDePu.exe
  C:\Windows\System\RdBDePu.exe
  2⤵
  PID:16364
- C:\Windows\System\kufHest.exe
  C:\Windows\System\kufHest.exe
  2⤵
  PID:15472
- C:\Windows\System\NqoiDid.exe
  C:\Windows\System\NqoiDid.exe
  2⤵
  PID:16336
- C:\Windows\System\EyDwuJx.exe
  C:\Windows\System\EyDwuJx.exe
  2⤵
  PID:14996
- C:\Windows\System\BywDrDT.exe
  C:\Windows\System\BywDrDT.exe
  2⤵
  PID:15756
- C:\Windows\System\YfbhggJ.exe
  C:\Windows\System\YfbhggJ.exe
  2⤵
  PID:16412
- C:\Windows\System\OWigEOp.exe
  C:\Windows\System\OWigEOp.exe
  2⤵
  PID:16432
- C:\Windows\System\MmfrLgf.exe
  C:\Windows\System\MmfrLgf.exe
  2⤵
  PID:16456
- C:\Windows\System\EGbQLci.exe
  C:\Windows\System\EGbQLci.exe
  2⤵
  PID:16480
- C:\Windows\System\gpmIfSy.exe
  C:\Windows\System\gpmIfSy.exe
  2⤵
  PID:16500
- C:\Windows\System\PzdMoLE.exe
  C:\Windows\System\PzdMoLE.exe
  2⤵
  PID:16520
- C:\Windows\System\Nlyfmjr.exe
  C:\Windows\System\Nlyfmjr.exe
  2⤵
  PID:16548
- C:\Windows\System\nCnBxeF.exe
  C:\Windows\System\nCnBxeF.exe
  2⤵
  PID:16572
- C:\Windows\System\EOGvaSc.exe
  C:\Windows\System\EOGvaSc.exe
  2⤵
  PID:16600
- C:\Windows\System\kuVLNzC.exe
  C:\Windows\System\kuVLNzC.exe
  2⤵
  PID:16624
- C:\Windows\System\XhEFgxB.exe
  C:\Windows\System\XhEFgxB.exe
  2⤵
  PID:16644
- C:\Windows\System\ZYkhkue.exe
  C:\Windows\System\ZYkhkue.exe
  2⤵
  PID:16672
- C:\Windows\System\SIwSnWs.exe
  C:\Windows\System\SIwSnWs.exe
  2⤵
  PID:16696
- C:\Windows\System\lYPqduZ.exe
  C:\Windows\System\lYPqduZ.exe
  2⤵
  PID:16720
- C:\Windows\System\zJiYAzu.exe
  C:\Windows\System\zJiYAzu.exe
  2⤵
  PID:16740
- C:\Windows\System\CvJpDmf.exe
  C:\Windows\System\CvJpDmf.exe
  2⤵
  PID:16764
- C:\Windows\System\vAVbonn.exe
  C:\Windows\System\vAVbonn.exe
  2⤵
  PID:16784
- C:\Windows\System\wcKGcwc.exe
  C:\Windows\System\wcKGcwc.exe
  2⤵
  PID:16816
- C:\Windows\System\ETNXQNd.exe
  C:\Windows\System\ETNXQNd.exe
  2⤵
  PID:16840
- C:\Windows\System\CQPglhr.exe
  C:\Windows\System\CQPglhr.exe
  2⤵
  PID:16856
- C:\Windows\System\YwyZPzo.exe
  C:\Windows\System\YwyZPzo.exe
  2⤵
  PID:16880
- C:\Windows\System\umaUyyw.exe
  C:\Windows\System\umaUyyw.exe
  2⤵
  PID:16908
- C:\Windows\System\jKsZKXh.exe
  C:\Windows\System\jKsZKXh.exe
  2⤵
  PID:16936
- C:\Windows\System\zifcRqt.exe
  C:\Windows\System\zifcRqt.exe
  2⤵
  PID:16964
- C:\Windows\System\meDTNWR.exe
  C:\Windows\System\meDTNWR.exe
  2⤵
  PID:16984
- C:\Windows\System\RYsoQUo.exe
  C:\Windows\System\RYsoQUo.exe
  2⤵
  PID:17020
- C:\Windows\System\jVtIUeU.exe
  C:\Windows\System\jVtIUeU.exe
  2⤵
  PID:17048
- C:\Windows\System\kPBmASL.exe
  C:\Windows\System\kPBmASL.exe
  2⤵
  PID:17260
- C:\Windows\System\QwAYwBw.exe
  C:\Windows\System\QwAYwBw.exe
  2⤵
  PID:16324
- C:\Windows\System\LWLaCyc.exe
  C:\Windows\System\LWLaCyc.exe
  2⤵
  PID:15616
- C:\Windows\System\TYmKpfq.exe
  C:\Windows\System\TYmKpfq.exe
  2⤵
  PID:16496
- C:\Windows\System\dsaSxcQ.exe
  C:\Windows\System\dsaSxcQ.exe
  2⤵
  PID:16080

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:17184

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\AQzAUBI.exe

Filesize
1.6MB

MD5
4783657adac05ecd6e497a6428175fa1

SHA1
18b2138d680d7beb600bc1c7d65818de1e7dedb8

SHA256
59d33e9d296ee8697f6d3d19618e40000516f74d449c640a8d1248df15a07d1b

SHA512
d5bfbda595e3c307f518b26bdde9ce1bb47376fdf65873f757c9440cc34c054eb70ebe1d114f963a0aaa731d67a671546759c183033bf15fc3a7e9463d8f91bf

Download Submit
C:\Windows\System\CBySDRX.exe

Filesize
1.6MB

MD5
a34ac8d4c155672803aea1d826eb396f

SHA1
b4b58c71598d629556e2d0ee3743c172ed75a178

SHA256
b36478271453e58dc811a08eaa9aac7414f3804577f7dbffd652f45234c8a9e7

SHA512
dcff6329cde28f410cc73ca8e2ab4d28d200216c45aa755b07bbcd7215a3d75642146f0304fd4f25399b4d222072bdbcee7e7a4d2968e5db1288483b030f10fc

Download Submit
C:\Windows\System\CEKCfDa.exe

Filesize
1.6MB

MD5
4000b3da4750193e87b8eb08abacef13

SHA1
2c58c0f8e0cc38415c8d02249a7b019c6c1bf306

SHA256
f13e28fa507975d95cb593c3597915ec5d242f8bf66f1b18d1340c6c8f1fd615

SHA512
49f2f18b38464bd752afd83b8a72e3d518d12a08111aa0421588dfed11590830c57cc3e0a43e73c91ef4bf71c253937adc84ca5f93f1023771ad1ccb15ebe372

Download Submit
C:\Windows\System\EVifddW.exe

Filesize
1.6MB

MD5
53c765ed07bbf2485a8d7e5e01a3c5a8

SHA1
16ed5fb9305cc891756c52641fe1cffb47e15dce

SHA256
22c2b16819565a16f788584e5f5dcb385b6af70bf55ba40f58cbcd7bb6cf720f

SHA512
bba70eb84b24ace7ce88c827ac8c38c76b4a89f98fd9fd51f306cf299653dd2c1740f79e6e8953983269424a6aee3a88fb2a970694a6292b655add40690e3bd7

Download Submit
C:\Windows\System\FONZdRF.exe

Filesize
1.6MB

MD5
d863439bc1656c758e73ce989cdeaa18

SHA1
15410a27cac78231f34c5d912950b5b15af3898a

SHA256
bd9169121bb97f4579a14f74333a59dfc49e530273faccf04be229c0c3b6fd7e

SHA512
57e4fc6532c161f023984afd700777207bf0b914214597216973ca21df3229228fd9e310db1b8fcbe7547f92c6dfcbd6abcbb6eec45a403dae4afc30455c8d23

Download Submit
C:\Windows\System\GtvTtAk.exe

Filesize
1.6MB

MD5
44e15cd4b1942192d0bad5cfe62d191c

SHA1
c5f9c1e200002715f83c1e6dc32b859b8b4df756

SHA256
8ac165b4c30a2e472a8940714cf20ba3ada16d8d634bcc7390619639dbe1a63d

SHA512
d45bbe78416d7e45590083b6bc4a83bc9668fb27a69e21a022aa05c06d831576c25fb813b9d87bf2453294161fe4232a5714a46872a81d07666e78c9c351141f

Download Submit
C:\Windows\System\LeIZjLv.exe

Filesize
1.6MB

MD5
c2bd1f5629de2414f403708a44b479d6

SHA1
942c74fab258d980abe5481931c4c67715cdda4d

SHA256
34c67c72103621af55c9f1e2751abeac8a55ed84aa04769f7678cd6a2e84224a

SHA512
42d0f61364e6004a778ccaf372fbcc2c08fc4670070f491f44916ef761352bca385003299f469008235141009460659326bb5b08cbc3157240abbc7385da2c34

Download Submit
C:\Windows\System\OwMYEfK.exe

Filesize
1.6MB

MD5
70c305521627e8bd780881359257a9bd

SHA1
f22ccc8038f10656af803ce3356cbb959f5d11d9

SHA256
837fc312c4f9be01e8979ea3b0fc69f923c5341e6fc5259794288360186809f1

SHA512
a2cf8c9a7d3cb04a76b1d9a711f92c38831c0e549521b36e4edab69f04fd77814f216f5c06fe3a59b6a733b4ebc7c7e3a289c20fc5e493337e324ef3fe9769ed

Download Submit
C:\Windows\System\PfirkdG.exe

Filesize
1.6MB

MD5
0a2f7da37e68705c8b328a9a9ba7ec23

SHA1
939b5098cfdbed97ecb6887403a39b25d1214611

SHA256
c64eb723d2c2222d023aff293d1be67d5ba6b6c6a506b545d85b2d3ae08f354b

SHA512
8f959c185e50be72ab7b7ff79f2fc1568c0fde5429b72c6fbfe3a0e939283879964ddd233e2f9a218ae921599bcdb6f5ea79bea75527a3f0b9516928b44381b7

Download Submit
C:\Windows\System\QwbTPzD.exe

Filesize
1.6MB

MD5
f59bfdad702291571e945aff9c3cfd8f

SHA1
309a702de5355abd6c0a9372bdbbbc6fdff5726e

SHA256
ca87150c9aaf0be5684258417c16248b2b004eb9cfb3ba2e7dfbea8e1ae0d87e

SHA512
23137e7d9f23b80705c5c8750ba7b6ad2ef32099dc6fd5aa7858b2e884b87adb3356952cf99a9bdb8ebee60b3497b86a5791db9f85b7aada7b475b2dadd9fa1f

Download Submit
C:\Windows\System\UytGQQd.exe

Filesize
1.6MB

MD5
8974d3bf762cefa9700602653fe440fc

SHA1
c90922e1b78ad97b03ce4242a8c2e0b5a0115258

SHA256
534ef63d131b6ddf0bd56c391334dbbb47416a680eb4321e849aba20cb3f6c37

SHA512
5a880d26fff0006257cecb56b85048fbe4b8a7a1e4c8bb3ba93c655472a44f4f79d6fa15f8e33ff4760225baff41a2577957c37b049862e1384ed77ccdcef441

Download Submit
C:\Windows\System\WkSGsYo.exe

Filesize
1.6MB

MD5
c378647664acd53a32c5306c19c976d8

SHA1
937f92022a5c765316976484beb3e7f8762756d9

SHA256
80e6cd002c8aa10e3ce28fe2b11a8b5944fc70bf3ac2f6a3382a660d21187cd3

SHA512
f906c5db1b86bc3b253541b3335e8afaae7d65b953cbe54beadac066224843b151b4997306f4e1fee2a0076a8831c8de8f698d04e0e6c19cb7158016f7cddb41

Download Submit
C:\Windows\System\XLzpdIo.exe

Filesize
1.6MB

MD5
31602a94415e20b114026b868e46e8e6

SHA1
6bc962346d25c1b7b27099984349599009d2c18b

SHA256
847a90fd41eb3689a7cd0a8973b4b1287cd31f0c5aeb25e807bd0a6d47acab4f

SHA512
072ff2641761ac6a5e118956e21bb16428f3f235c24d1846fe0e10215b933ed5dffe7e52b021a2e7b229910e53bc11a46f85f81ae718fcc263adcfa7e767decb

Download Submit
C:\Windows\System\XsxLlwM.exe

Filesize
1.6MB

MD5
213a25202b441eb0851ccf2c9b848a22

SHA1
286e8ce128b0b5d1704e975120bac45469b9aa12

SHA256
af6848e6dfc4c11eb1cd47847da093350a4fdb462bfe42aa08c0d533be115a42

SHA512
34ae3dd7bfa5f5140e91432871b20426418e1e68216b4ebec3e5898e6c56454fed2569c58cc7cf0477a18422129dcb6e7127e8504bf8ed470bf25fd0c6acbdcb

Download Submit
C:\Windows\System\YacMAHa.exe

Filesize
1.6MB

MD5
44d2595247ed6c9e9fdaa0bbba29cef4

SHA1
921c431ab8aa0b06a02c368b6a14633bc1af7808

SHA256
d161b8e9edc94eeb97abde216ec6907246aed86d69e48b048deeca77468db610

SHA512
3fe6cecf2540bed22deed230e9712d4720b9f4cad3f0d02514962af05e24ef95c2004a6229a439bb262052189c05d1c494fc34b0d4e64e7e75e080daa25df3cc

Download Submit
C:\Windows\System\YxJBQLQ.exe

Filesize
1.6MB

MD5
4888dd83ab6fff9e4a3bc7aaee2f67a9

SHA1
fb976eede20966ae42888752098134aa30a66b25

SHA256
3d311238f96cee54f14a6ea606defb6ecdea1d6bc6481815165f0b39ab8863ec

SHA512
3c5f9cb8c25eb979dd3cc2a7f95e15f16aa3759c0da979ee67550b31cd6444e45274bd0526a7942a5161d462a035f75a3e583a7bf9aeba8cb5e6116b52a7d392

Download Submit
C:\Windows\System\ZypnuLT.exe

Filesize
1.6MB

MD5
1715ce42a86c117077e0bedfc0ffff99

SHA1
3609967fc2a1ed5e4bc07f81897e293e4aeaae39

SHA256
5b2022c66b47878ddd98f3be3a37d85e80454a1cb5bde2c45806672535b1634d

SHA512
6ebcf0fe9ae39054271371b2273566cf6ccc8767c2cdaf74fc6252c4837016d447cf752b1aa9bc22adc34b96141482322a7b591c57497f7126ce509ef9a52290

Download Submit
C:\Windows\System\amakOWX.exe

Filesize
1.6MB

MD5
9ab7b9c630e0e23246582b7d132f8cac

SHA1
dc4b976579046fc7dcfcebf601232ef6e4b7a9ab

SHA256
91d82de3005ba4892318bf97651753b0abd90dc4a30cf830596c6559f6288065

SHA512
b9b1634bce3b06aea8ca331c75b7df21f0bd8e2493b9b752bb867b10569fdf23272b6c3f7c6ea7f4dfe9400ff56306cecf387390ef6a1036ae1c8e6a0d53bb84

Download Submit
C:\Windows\System\cUWrkAN.exe

Filesize
1.6MB

MD5
c0b6c593fa9b218be46a210aaf922d71

SHA1
dc56a88eccf714280f1cf773e44d203bfb06fd0e

SHA256
25dd21ecd2caa59e18d92babba0d63ed640dee793786592e886bbf98d93702da

SHA512
70af7da4afb6a68666548860506948390a39dac10bea1d3595148af018453ae42854d66794653d47391729b870b076ea17525a4b4025f112dd4cc45de225527f

Download Submit
C:\Windows\System\cYdDUfH.exe

Filesize
1.6MB

MD5
8d5badee10200a43f6d871f22d86491f

SHA1
fd539582c453cf6eb94e45fb7783e46536691b82

SHA256
0e9a081519640598bfaed23d68a11e7eda75dc577d852a570c3e8a8e0ade9a21

SHA512
eb896365d0dbcfc70d530cacf12d3108fe26742f5f5eb57871d161855073b1f458737c19b3b15a76b58b014f58d9d35a68daa377d162163c3e8ffe8284637f0f

Download Submit
C:\Windows\System\dLrnXNQ.exe

Filesize
1.6MB

MD5
20594e9bfb43b65416f40bcc135b94b2

SHA1
394b2550a876ec67ba7007b50013db77b8b61898

SHA256
608570891c8d6ca4fc8083b3d68ddd98276cf33b0c92cddb551adf1cf34c6f1f

SHA512
0d00a97b64e8d8f953fb1d4698bd8c1d8cf0512062d80e73f88a9f1469c39b9e1c9a3bcfc06c1f1a34b0bdb2c2236f721e99233a818983bf74133258e19fdcce

Download Submit
C:\Windows\System\dXEgvce.exe

Filesize
1.6MB

MD5
d62f7b25d100db2a9066d013f2e4f010

SHA1
65a3f2e9cf2dc7fa6a7f0018e6f89512f5e977cc

SHA256
d6f2932dabab89d7a5a33d6d3386fbfdb2a590f3574568386cbaac52af2d9d9b

SHA512
63e3a83c0755980406f52006b5d8f480b3c3764477116df891e4597e70f7def2b345661273ce294a8108c04951287e2bcf65655d260668feaa21f35a94f28e26

Download Submit
C:\Windows\System\gNyMtNU.exe

Filesize
1.6MB

MD5
db9253e8d5ff818d7a87e5574f466407

SHA1
1eda31a6d3179d44e1e722ef7d5d2cba6e675446

SHA256
3985e6319e29b0b5f2044f5e5cce23bea634a745879756c7732f05ade29dd37f

SHA512
171622a33e77162b67d7fe8622afb804b4b5ee98f239d2e979349ea11b2ed7ea1c1abeee9c5f0977c8996c09016d1ba8b2c764385f06a6cb7c969e27302aac62

Download Submit
C:\Windows\System\geBcqRJ.exe

Filesize
1.6MB

MD5
7b61d119798854d46e8287a015f728f5

SHA1
06730a9ade2f4bd946a0745c84c87007d5568253

SHA256
d45631600c80ea64656e7f0448e77b06e766189d360962c1cda1d152b3fbd519

SHA512
85c0e86cc3bf899104b8abf9ebd9659781f99105988f413946ff8401f4a215feb9c2c48926593437de6305b757f6872437cffe3a746ce1f4508a71db509207e1

Download Submit
C:\Windows\System\hWLYAgk.exe

Filesize
1.6MB

MD5
d51e16aded5d3a45c856576cd50980c8

SHA1
b9bfaac965096fa5993890b3095dc72218fcf180

SHA256
dc33993d3bd19476a046461ed1d2c743c7fe9e4930ed1fa07a65ac291da410c8

SHA512
29c2c3909c7621f6a651862714c4cf1f7731bf9fd6f9fdb4f7bd01752480ffaa14f597dde1a793d99e54056f186f431b6a74a3defe97fb86d4d17ccada0106b2

Download Submit
C:\Windows\System\iZZnEMx.exe

Filesize
1.6MB

MD5
3b5155f8089faf2ada6ad5ba1e7e52b0

SHA1
5417b7d5cf154e8034a8079f7906e8faa2c1ed56

SHA256
5fa367335c97c20f4219c3dd58cd992bc97ec9e23e6bc22de1f311dcf22414c7

SHA512
2bd0bb5663380c21ef18cf5bb0a8b2548f4698a40648cb2d0f02469b42b3e844544318a7466cc3dbe05a20b7ed0ace4be1e1e85f22db3b2c037a6171572f61a3

Download Submit
C:\Windows\System\jJcZAXj.exe

Filesize
1.6MB

MD5
9e47414c17c3ca5c60d24204c23c28c5

SHA1
d4f6271e82d9dc42611bf7352e42a09e0610542e

SHA256
fd2313d8f13ef4fac5edaa75c02181921de07f9aff4ed0eb6e4254040483c06e

SHA512
e8cf01cb04835aa5386a8a58c55244f15495a0ff26fd1549f2961137bdaef07249ad3bb19d793649a2aab8e1504b4dafcbdedee72014a739ca70c04a549dfa38

Download Submit
C:\Windows\System\ktrVTCu.exe

Filesize
1.6MB

MD5
4b8d54524275193afc064239592cc88b

SHA1
1de55e756d44bda430eff617f6d853d210121875

SHA256
dbaa171710b9fcf64312cc099c87d04f9a16226b41c20b8b573ac9297870d1d0

SHA512
f39be8bb7ed661f3f00b4fd062f81a2ec0f71757db22994ce976043d57d50e286a2305136b739c44781148cf0cbebbf5f40a6e2444a38a512353f6d8109aea87

Download Submit
C:\Windows\System\lklWxVM.exe

Filesize
1.6MB

MD5
1b40f6d02d71d1a685260aac14fa4594

SHA1
d7831f7d6a0b635e8c17e5f063ada55c94e665ab

SHA256
b9043b8381559d8bf2edddb6b191ec63cede474eabcf07d37b7d362b7c8acb61

SHA512
9cd2401f826acce7022fea9af37f73703f03423dc45898dd02b3a08a020ead11d27efb57f492bee22f760d2faf40f73bd7a53d58f1a47abc19509c9e1a0b63c1

Download Submit
C:\Windows\System\lonUcOf.exe

Filesize
1.6MB

MD5
3ad551a5cd824f6913b0b81d03e9dbca

SHA1
5d26383907989672be5003f24ffb2244acf8b1a5

SHA256
96a3e92ee29aace04f6798e1b138c832422cab0a868467bdcc798f279e497050

SHA512
c80e78217d14a5c96efb6ff573a5dfa56b5ac3c6632b32c94986f91dedca8097746f1f7bb476c67383404e4055f151d2c6088ffae88c651dcb073fa531119898

Download Submit
C:\Windows\System\lrUunsb.exe

Filesize
1.6MB

MD5
3c35ddbd29125f91fb21b4c04c84491b

SHA1
4ac820b449bd86883d1d35000f053adb2988357e

SHA256
7c6747d532133114c643c272ec205867e7e8dea9f16090539f58bdf28dd3c0c8

SHA512
30d81fd261884913237fec464e17a71edde77f7e179e1845b30c88a3f68ce0938d0566b12d3b94e8535122c91fe179afdf0547b3b542153dfef56eeb965f3067

Download Submit
C:\Windows\System\pUdndED.exe

Filesize
1.6MB

MD5
bfbc48f8aed37a1ee4986be561f3dbbe

SHA1
31fc81389a3950f47c702d8e311d4036fe7aadde

SHA256
aa8a142f2d66549f460ef14b70cf0c509eb9554c3bf6d80024dedbd9d2271074

SHA512
64ef8363ea2e218feab5821896f2199f546ae0daab0b51ee102b7c60d7ade9d6b305aa830c2b36e63f44ddbbc3700115a93c78fb538498c2fee6591f02dc5375

Download Submit
C:\Windows\System\pdRPEDu.exe

Filesize
1.6MB

MD5
cdc120a9dac2fcd5d3bf3ba35fae1345

SHA1
de98b25c1905d6dde0662e94405f18803235d406

SHA256
f1fa5a426bc381907e8ed27c17fff5c0c0fdb0a31e0bb269340783f7223fef3d

SHA512
3af9d4b5fefb85811ef2e52b20e83688a5d64b34e3b40094682f98b6fba4f36681437876161835502890c9b271d9eab8276feac3c4831f5720a0aeb872f0ec7a

Download Submit
C:\Windows\System\vQKaaYS.exe

Filesize
1.6MB

MD5
b9c51712105a43c955cac1abda27dc1d

SHA1
07d4e1bcc646299f0892215ff4d431bc74e06aab

SHA256
2a4dc4cd4d916c3ceccc02e0557a7cf33fca5c4117c0ea34ef4c397fb34ebf2d

SHA512
77dc8c06e1a7129c6c82b90a809a9a00303a31856d30cbf03c536c04d5c399fd42cc63925123bd637393be4c391c03dd1b93a895b29c9879dfcd8f1cd03c0c1e

Download Submit
C:\Windows\System\zfUGbFJ.exe

Filesize
1.6MB

MD5
161fd63edc1537ce36173bf28b3277fa

SHA1
742ee19132f9c6c47abc1f32d1f22767cc1c33b2

SHA256
f5fb640b96bc7188ccdf21fac708b9f049628607c923dd94983e0f5c4694109f

SHA512
edd5a9d250dfa2ec124d5c3b5a6e084dfabf97d8aab4a9139e1026712d50a85a427afea971619cee5d42007c8674f0648778fc7aa62337cfc906c5ad3688e80c

Download Submit
memory/4592-0-0x000001E503550000-0x000001E503560000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads