xmrig | 328c9f0afdee2f810bb00a60a2db59a9febffc156ec00210643178a1bcfb5a04

Analysis

max time kernel
96s
max time network
100s
platform
windows10-2004_x64
resource
win10v2004-20250129-en
resource tags

arch:x64arch:x86image:win10v2004-20250129-enlocale:en-usos:windows10-2004-x64system
submitted
02/02/2025, 21:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

328c9f0afdee2f810bb00a60a2db59a9febffc156ec00210643178a1bcfb5a04.exe
Size

1.7MB
MD5

13a22d9550c5af8bf246281f9cec9ebe
SHA1

44cabb5c6dbad246a5821ba2e5608fd604379602
SHA256

328c9f0afdee2f810bb00a60a2db59a9febffc156ec00210643178a1bcfb5a04
SHA512

4452dc435335d0747b4c56a4d54a0919a9bb33a850acdc116f761b4e625b0170bfe19505cf785694b2c9a9d21919d12a6d628024cc5a3ddede73e245cbcab5df
SSDEEP

49152:GezaTF8FcNkNdfE0pZ9ozttwIRxj4c5ybqqty1W:GemTLkNdfE0pZyc

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 35 IoCs

miner

resource	yara_rule
behavioral2/files/0x0008000000023c59-4.dat	xmrig
behavioral2/files/0x0008000000023c5c-9.dat	xmrig
behavioral2/files/0x0007000000023c5d-6.dat	xmrig
behavioral2/files/0x0007000000023c60-31.dat	xmrig
behavioral2/files/0x0007000000023c5f-46.dat	xmrig
behavioral2/files/0x0007000000023c61-60.dat	xmrig
behavioral2/files/0x0007000000023c66-69.dat	xmrig
behavioral2/files/0x0007000000023c69-76.dat	xmrig
behavioral2/files/0x0007000000023c6d-95.dat	xmrig
behavioral2/files/0x0007000000023c6c-93.dat	xmrig
behavioral2/files/0x0007000000023c6b-91.dat	xmrig
behavioral2/files/0x0007000000023c6a-89.dat	xmrig
behavioral2/files/0x0007000000023c68-73.dat	xmrig
behavioral2/files/0x0007000000023c67-71.dat	xmrig
behavioral2/files/0x0007000000023c65-66.dat	xmrig
behavioral2/files/0x0007000000023c63-61.dat	xmrig
behavioral2/files/0x0007000000023c64-57.dat	xmrig
behavioral2/files/0x0007000000023c62-50.dat	xmrig
behavioral2/files/0x0007000000023c5e-29.dat	xmrig
behavioral2/files/0x0007000000023c6e-101.dat	xmrig
behavioral2/files/0x0007000000023c6f-106.dat	xmrig
behavioral2/files/0x0007000000023c72-135.dat	xmrig
behavioral2/files/0x0007000000023c70-127.dat	xmrig
behavioral2/files/0x0007000000023c79-152.dat	xmrig
behavioral2/files/0x0007000000023c74-154.dat	xmrig
behavioral2/files/0x0007000000023c7c-169.dat	xmrig
behavioral2/files/0x0007000000023c77-167.dat	xmrig
behavioral2/files/0x0007000000023c76-164.dat	xmrig
behavioral2/files/0x0007000000023c7b-162.dat	xmrig
behavioral2/files/0x0007000000023c7a-157.dat	xmrig
behavioral2/files/0x0007000000023c73-149.dat	xmrig
behavioral2/files/0x0007000000023c78-146.dat	xmrig
behavioral2/files/0x0007000000023c75-139.dat	xmrig
behavioral2/files/0x0008000000023c5a-123.dat	xmrig
behavioral2/files/0x0007000000023c71-130.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
1980	BEcXRFX.exe
4888	aLrVKCs.exe
3656	tcLjtao.exe
2212	UltTeYo.exe
1184	bGmJNIt.exe
3696	WVfTClf.exe
2352	zAWvSXM.exe
1484	FCxUafm.exe
1620	WxLCDVn.exe
2428	jqkCKDL.exe
2956	zxPHWLZ.exe
2280	fDUUhQa.exe
3892	sxOIrGx.exe
1296	RePOUMC.exe
1812	ubXOKuJ.exe
2068	WoLxejU.exe
4748	hTmmSPE.exe
3880	MqfYxhw.exe
3524	eFDbico.exe
1864	jqyOQSC.exe
2328	GAAEpaQ.exe
3016	lZCdBCK.exe
3092	niiEdzG.exe
812	jWEFPdg.exe
1032	EQeMsFO.exe
4140	VXouKgE.exe
2512	kENnVkI.exe
2312	MJNdvPB.exe
552	MRSQIjD.exe
1768	upVKaBQ.exe
3468	TeWypWW.exe
1852	YBDHiAR.exe
3648	mgREjGV.exe
4432	mKBvjga.exe
4540	fjmbedY.exe
3580	EUYzWar.exe
2868	wbCrBhV.exe
1580	XYxPggG.exe
1972	nzQvvZY.exe
944	xdpMMYH.exe
4824	XYZohKt.exe
984	ghebtsK.exe
1976	GlEAEKw.exe
2792	yeuhDqa.exe
1560	OllmJRE.exe
1468	XmkaZqf.exe
508	HqblqnE.exe
3584	YxNpHGt.exe
4932	CMxvrLa.exe
5068	fxhGzCk.exe
4788	ltPJJIW.exe
4908	nLsbqxq.exe
5064	kGPLTSt.exe
232	zrQrblu.exe
2700	dSzZljZ.exe
3096	XZTyyVf.exe
948	BSHRzws.exe
5112	rAHGKPi.exe
4568	caqpAth.exe
3496	nSYwFRK.exe
2292	PawoCTg.exe
3512	mnuKmjz.exe
3920	YCnlZnF.exe
4020	DxevASS.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\bimHrts.exe	328c9f0afdee2f810bb00a60a2db59a9febffc156ec00210643178a1bcfb5a04.exe
File created	C:\Windows\System\lbBdvRQ.exe	328c9f0afdee2f810bb00a60a2db59a9febffc156ec00210643178a1bcfb5a04.exe
File created	C:\Windows\System\NoFpKOb.exe	328c9f0afdee2f810bb00a60a2db59a9febffc156ec00210643178a1bcfb5a04.exe
File created	C:\Windows\System\sNKpoGq.exe	328c9f0afdee2f810bb00a60a2db59a9febffc156ec00210643178a1bcfb5a04.exe
File created	C:\Windows\System\RwavqYY.exe	328c9f0afdee2f810bb00a60a2db59a9febffc156ec00210643178a1bcfb5a04.exe
File created	C:\Windows\System\GWnyJMa.exe	328c9f0afdee2f810bb00a60a2db59a9febffc156ec00210643178a1bcfb5a04.exe
File created	C:\Windows\System\PjpuhRD.exe	328c9f0afdee2f810bb00a60a2db59a9febffc156ec00210643178a1bcfb5a04.exe
File created	C:\Windows\System\biEDmqd.exe	328c9f0afdee2f810bb00a60a2db59a9febffc156ec00210643178a1bcfb5a04.exe
File created	C:\Windows\System\wIUzpZA.exe	328c9f0afdee2f810bb00a60a2db59a9febffc156ec00210643178a1bcfb5a04.exe
File created	C:\Windows\System\BWrrpmR.exe	328c9f0afdee2f810bb00a60a2db59a9febffc156ec00210643178a1bcfb5a04.exe
File created	C:\Windows\System\RtEteQE.exe	328c9f0afdee2f810bb00a60a2db59a9febffc156ec00210643178a1bcfb5a04.exe
File created	C:\Windows\System\cuZrKmE.exe	328c9f0afdee2f810bb00a60a2db59a9febffc156ec00210643178a1bcfb5a04.exe
File created	C:\Windows\System\OLJMvui.exe	328c9f0afdee2f810bb00a60a2db59a9febffc156ec00210643178a1bcfb5a04.exe
File created	C:\Windows\System\nzQvvZY.exe	328c9f0afdee2f810bb00a60a2db59a9febffc156ec00210643178a1bcfb5a04.exe
File created	C:\Windows\System\alCoHmz.exe	328c9f0afdee2f810bb00a60a2db59a9febffc156ec00210643178a1bcfb5a04.exe
File created	C:\Windows\System\VPNRrkp.exe	328c9f0afdee2f810bb00a60a2db59a9febffc156ec00210643178a1bcfb5a04.exe
File created	C:\Windows\System\VUsDtjQ.exe	328c9f0afdee2f810bb00a60a2db59a9febffc156ec00210643178a1bcfb5a04.exe
File created	C:\Windows\System\TsnuhQO.exe	328c9f0afdee2f810bb00a60a2db59a9febffc156ec00210643178a1bcfb5a04.exe
File created	C:\Windows\System\tiXkAPj.exe	328c9f0afdee2f810bb00a60a2db59a9febffc156ec00210643178a1bcfb5a04.exe
File created	C:\Windows\System\ERhIupU.exe	328c9f0afdee2f810bb00a60a2db59a9febffc156ec00210643178a1bcfb5a04.exe
File created	C:\Windows\System\uafNQvN.exe	328c9f0afdee2f810bb00a60a2db59a9febffc156ec00210643178a1bcfb5a04.exe
File created	C:\Windows\System\GAAEpaQ.exe	328c9f0afdee2f810bb00a60a2db59a9febffc156ec00210643178a1bcfb5a04.exe
File created	C:\Windows\System\cOQyMYq.exe	328c9f0afdee2f810bb00a60a2db59a9febffc156ec00210643178a1bcfb5a04.exe
File created	C:\Windows\System\QDXIHuC.exe	328c9f0afdee2f810bb00a60a2db59a9febffc156ec00210643178a1bcfb5a04.exe
File created	C:\Windows\System\bBsxBbo.exe	328c9f0afdee2f810bb00a60a2db59a9febffc156ec00210643178a1bcfb5a04.exe
File created	C:\Windows\System\MbPcqsr.exe	328c9f0afdee2f810bb00a60a2db59a9febffc156ec00210643178a1bcfb5a04.exe
File created	C:\Windows\System\sZRqBOg.exe	328c9f0afdee2f810bb00a60a2db59a9febffc156ec00210643178a1bcfb5a04.exe
File created	C:\Windows\System\KoxBNsS.exe	328c9f0afdee2f810bb00a60a2db59a9febffc156ec00210643178a1bcfb5a04.exe
File created	C:\Windows\System\OlrjflF.exe	328c9f0afdee2f810bb00a60a2db59a9febffc156ec00210643178a1bcfb5a04.exe
File created	C:\Windows\System\YusSJWs.exe	328c9f0afdee2f810bb00a60a2db59a9febffc156ec00210643178a1bcfb5a04.exe
File created	C:\Windows\System\PTJkVFl.exe	328c9f0afdee2f810bb00a60a2db59a9febffc156ec00210643178a1bcfb5a04.exe
File created	C:\Windows\System\XlViCkC.exe	328c9f0afdee2f810bb00a60a2db59a9febffc156ec00210643178a1bcfb5a04.exe
File created	C:\Windows\System\BBjxDxm.exe	328c9f0afdee2f810bb00a60a2db59a9febffc156ec00210643178a1bcfb5a04.exe
File created	C:\Windows\System\YRpPPtq.exe	328c9f0afdee2f810bb00a60a2db59a9febffc156ec00210643178a1bcfb5a04.exe
File created	C:\Windows\System\YORDGZS.exe	328c9f0afdee2f810bb00a60a2db59a9febffc156ec00210643178a1bcfb5a04.exe
File created	C:\Windows\System\twofSIE.exe	328c9f0afdee2f810bb00a60a2db59a9febffc156ec00210643178a1bcfb5a04.exe
File created	C:\Windows\System\psUkwao.exe	328c9f0afdee2f810bb00a60a2db59a9febffc156ec00210643178a1bcfb5a04.exe
File created	C:\Windows\System\PmNECrt.exe	328c9f0afdee2f810bb00a60a2db59a9febffc156ec00210643178a1bcfb5a04.exe
File created	C:\Windows\System\OuQOqCf.exe	328c9f0afdee2f810bb00a60a2db59a9febffc156ec00210643178a1bcfb5a04.exe
File created	C:\Windows\System\GWQguWw.exe	328c9f0afdee2f810bb00a60a2db59a9febffc156ec00210643178a1bcfb5a04.exe
File created	C:\Windows\System\UncnXct.exe	328c9f0afdee2f810bb00a60a2db59a9febffc156ec00210643178a1bcfb5a04.exe
File created	C:\Windows\System\CoWYbKc.exe	328c9f0afdee2f810bb00a60a2db59a9febffc156ec00210643178a1bcfb5a04.exe
File created	C:\Windows\System\HKfKvlp.exe	328c9f0afdee2f810bb00a60a2db59a9febffc156ec00210643178a1bcfb5a04.exe
File created	C:\Windows\System\ubmYqJO.exe	328c9f0afdee2f810bb00a60a2db59a9febffc156ec00210643178a1bcfb5a04.exe
File created	C:\Windows\System\AKnENTg.exe	328c9f0afdee2f810bb00a60a2db59a9febffc156ec00210643178a1bcfb5a04.exe
File created	C:\Windows\System\tyaGsle.exe	328c9f0afdee2f810bb00a60a2db59a9febffc156ec00210643178a1bcfb5a04.exe
File created	C:\Windows\System\gfljREO.exe	328c9f0afdee2f810bb00a60a2db59a9febffc156ec00210643178a1bcfb5a04.exe
File created	C:\Windows\System\HSCVTSb.exe	328c9f0afdee2f810bb00a60a2db59a9febffc156ec00210643178a1bcfb5a04.exe
File created	C:\Windows\System\GfibMUz.exe	328c9f0afdee2f810bb00a60a2db59a9febffc156ec00210643178a1bcfb5a04.exe
File created	C:\Windows\System\GkScczR.exe	328c9f0afdee2f810bb00a60a2db59a9febffc156ec00210643178a1bcfb5a04.exe
File created	C:\Windows\System\ByzWAZJ.exe	328c9f0afdee2f810bb00a60a2db59a9febffc156ec00210643178a1bcfb5a04.exe
File created	C:\Windows\System\yPtciGl.exe	328c9f0afdee2f810bb00a60a2db59a9febffc156ec00210643178a1bcfb5a04.exe
File created	C:\Windows\System\xbYQVmD.exe	328c9f0afdee2f810bb00a60a2db59a9febffc156ec00210643178a1bcfb5a04.exe
File created	C:\Windows\System\MbhhKnv.exe	328c9f0afdee2f810bb00a60a2db59a9febffc156ec00210643178a1bcfb5a04.exe
File created	C:\Windows\System\TVvmhmj.exe	328c9f0afdee2f810bb00a60a2db59a9febffc156ec00210643178a1bcfb5a04.exe
File created	C:\Windows\System\AlhVjjk.exe	328c9f0afdee2f810bb00a60a2db59a9febffc156ec00210643178a1bcfb5a04.exe
File created	C:\Windows\System\eFDbico.exe	328c9f0afdee2f810bb00a60a2db59a9febffc156ec00210643178a1bcfb5a04.exe
File created	C:\Windows\System\gUsLOpY.exe	328c9f0afdee2f810bb00a60a2db59a9febffc156ec00210643178a1bcfb5a04.exe
File created	C:\Windows\System\WsyTngv.exe	328c9f0afdee2f810bb00a60a2db59a9febffc156ec00210643178a1bcfb5a04.exe
File created	C:\Windows\System\ZlDIlUA.exe	328c9f0afdee2f810bb00a60a2db59a9febffc156ec00210643178a1bcfb5a04.exe
File created	C:\Windows\System\JtSgyhX.exe	328c9f0afdee2f810bb00a60a2db59a9febffc156ec00210643178a1bcfb5a04.exe
File created	C:\Windows\System\cIiQTDL.exe	328c9f0afdee2f810bb00a60a2db59a9febffc156ec00210643178a1bcfb5a04.exe
File created	C:\Windows\System\hkHLuUF.exe	328c9f0afdee2f810bb00a60a2db59a9febffc156ec00210643178a1bcfb5a04.exe
File created	C:\Windows\System\xgSqjpG.exe	328c9f0afdee2f810bb00a60a2db59a9febffc156ec00210643178a1bcfb5a04.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	16144	dwm.exe
Token: SeChangeNotifyPrivilege	16144	dwm.exe
Token: 33	16144	dwm.exe
Token: SeIncBasePriorityPrivilege	16144	dwm.exe
Token: SeShutdownPrivilege	16144	dwm.exe
Token: SeCreatePagefilePrivilege	16144	dwm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4068 wrote to memory of 1980	4068	328c9f0afdee2f810bb00a60a2db59a9febffc156ec00210643178a1bcfb5a04.exe	84
PID 4068 wrote to memory of 1980	4068	328c9f0afdee2f810bb00a60a2db59a9febffc156ec00210643178a1bcfb5a04.exe	84
PID 4068 wrote to memory of 4888	4068	328c9f0afdee2f810bb00a60a2db59a9febffc156ec00210643178a1bcfb5a04.exe	85
PID 4068 wrote to memory of 4888	4068	328c9f0afdee2f810bb00a60a2db59a9febffc156ec00210643178a1bcfb5a04.exe	85
PID 4068 wrote to memory of 3656	4068	328c9f0afdee2f810bb00a60a2db59a9febffc156ec00210643178a1bcfb5a04.exe	86
PID 4068 wrote to memory of 3656	4068	328c9f0afdee2f810bb00a60a2db59a9febffc156ec00210643178a1bcfb5a04.exe	86
PID 4068 wrote to memory of 2212	4068	328c9f0afdee2f810bb00a60a2db59a9febffc156ec00210643178a1bcfb5a04.exe	87
PID 4068 wrote to memory of 2212	4068	328c9f0afdee2f810bb00a60a2db59a9febffc156ec00210643178a1bcfb5a04.exe	87
PID 4068 wrote to memory of 1184	4068	328c9f0afdee2f810bb00a60a2db59a9febffc156ec00210643178a1bcfb5a04.exe	88
PID 4068 wrote to memory of 1184	4068	328c9f0afdee2f810bb00a60a2db59a9febffc156ec00210643178a1bcfb5a04.exe	88
PID 4068 wrote to memory of 3696	4068	328c9f0afdee2f810bb00a60a2db59a9febffc156ec00210643178a1bcfb5a04.exe	89
PID 4068 wrote to memory of 3696	4068	328c9f0afdee2f810bb00a60a2db59a9febffc156ec00210643178a1bcfb5a04.exe	89
PID 4068 wrote to memory of 2352	4068	328c9f0afdee2f810bb00a60a2db59a9febffc156ec00210643178a1bcfb5a04.exe	90
PID 4068 wrote to memory of 2352	4068	328c9f0afdee2f810bb00a60a2db59a9febffc156ec00210643178a1bcfb5a04.exe	90
PID 4068 wrote to memory of 1484	4068	328c9f0afdee2f810bb00a60a2db59a9febffc156ec00210643178a1bcfb5a04.exe	91
PID 4068 wrote to memory of 1484	4068	328c9f0afdee2f810bb00a60a2db59a9febffc156ec00210643178a1bcfb5a04.exe	91
PID 4068 wrote to memory of 1620	4068	328c9f0afdee2f810bb00a60a2db59a9febffc156ec00210643178a1bcfb5a04.exe	92
PID 4068 wrote to memory of 1620	4068	328c9f0afdee2f810bb00a60a2db59a9febffc156ec00210643178a1bcfb5a04.exe	92
PID 4068 wrote to memory of 2428	4068	328c9f0afdee2f810bb00a60a2db59a9febffc156ec00210643178a1bcfb5a04.exe	93
PID 4068 wrote to memory of 2428	4068	328c9f0afdee2f810bb00a60a2db59a9febffc156ec00210643178a1bcfb5a04.exe	93
PID 4068 wrote to memory of 2956	4068	328c9f0afdee2f810bb00a60a2db59a9febffc156ec00210643178a1bcfb5a04.exe	94
PID 4068 wrote to memory of 2956	4068	328c9f0afdee2f810bb00a60a2db59a9febffc156ec00210643178a1bcfb5a04.exe	94
PID 4068 wrote to memory of 2280	4068	328c9f0afdee2f810bb00a60a2db59a9febffc156ec00210643178a1bcfb5a04.exe	95
PID 4068 wrote to memory of 2280	4068	328c9f0afdee2f810bb00a60a2db59a9febffc156ec00210643178a1bcfb5a04.exe	95
PID 4068 wrote to memory of 3892	4068	328c9f0afdee2f810bb00a60a2db59a9febffc156ec00210643178a1bcfb5a04.exe	96
PID 4068 wrote to memory of 3892	4068	328c9f0afdee2f810bb00a60a2db59a9febffc156ec00210643178a1bcfb5a04.exe	96
PID 4068 wrote to memory of 1296	4068	328c9f0afdee2f810bb00a60a2db59a9febffc156ec00210643178a1bcfb5a04.exe	97
PID 4068 wrote to memory of 1296	4068	328c9f0afdee2f810bb00a60a2db59a9febffc156ec00210643178a1bcfb5a04.exe	97
PID 4068 wrote to memory of 1812	4068	328c9f0afdee2f810bb00a60a2db59a9febffc156ec00210643178a1bcfb5a04.exe	98
PID 4068 wrote to memory of 1812	4068	328c9f0afdee2f810bb00a60a2db59a9febffc156ec00210643178a1bcfb5a04.exe	98
PID 4068 wrote to memory of 2068	4068	328c9f0afdee2f810bb00a60a2db59a9febffc156ec00210643178a1bcfb5a04.exe	99
PID 4068 wrote to memory of 2068	4068	328c9f0afdee2f810bb00a60a2db59a9febffc156ec00210643178a1bcfb5a04.exe	99
PID 4068 wrote to memory of 4748	4068	328c9f0afdee2f810bb00a60a2db59a9febffc156ec00210643178a1bcfb5a04.exe	100
PID 4068 wrote to memory of 4748	4068	328c9f0afdee2f810bb00a60a2db59a9febffc156ec00210643178a1bcfb5a04.exe	100
PID 4068 wrote to memory of 3880	4068	328c9f0afdee2f810bb00a60a2db59a9febffc156ec00210643178a1bcfb5a04.exe	101
PID 4068 wrote to memory of 3880	4068	328c9f0afdee2f810bb00a60a2db59a9febffc156ec00210643178a1bcfb5a04.exe	101
PID 4068 wrote to memory of 3524	4068	328c9f0afdee2f810bb00a60a2db59a9febffc156ec00210643178a1bcfb5a04.exe	102
PID 4068 wrote to memory of 3524	4068	328c9f0afdee2f810bb00a60a2db59a9febffc156ec00210643178a1bcfb5a04.exe	102
PID 4068 wrote to memory of 1864	4068	328c9f0afdee2f810bb00a60a2db59a9febffc156ec00210643178a1bcfb5a04.exe	103
PID 4068 wrote to memory of 1864	4068	328c9f0afdee2f810bb00a60a2db59a9febffc156ec00210643178a1bcfb5a04.exe	103
PID 4068 wrote to memory of 3016	4068	328c9f0afdee2f810bb00a60a2db59a9febffc156ec00210643178a1bcfb5a04.exe	104
PID 4068 wrote to memory of 3016	4068	328c9f0afdee2f810bb00a60a2db59a9febffc156ec00210643178a1bcfb5a04.exe	104
PID 4068 wrote to memory of 2328	4068	328c9f0afdee2f810bb00a60a2db59a9febffc156ec00210643178a1bcfb5a04.exe	105
PID 4068 wrote to memory of 2328	4068	328c9f0afdee2f810bb00a60a2db59a9febffc156ec00210643178a1bcfb5a04.exe	105
PID 4068 wrote to memory of 3092	4068	328c9f0afdee2f810bb00a60a2db59a9febffc156ec00210643178a1bcfb5a04.exe	106
PID 4068 wrote to memory of 3092	4068	328c9f0afdee2f810bb00a60a2db59a9febffc156ec00210643178a1bcfb5a04.exe	106
PID 4068 wrote to memory of 812	4068	328c9f0afdee2f810bb00a60a2db59a9febffc156ec00210643178a1bcfb5a04.exe	107
PID 4068 wrote to memory of 812	4068	328c9f0afdee2f810bb00a60a2db59a9febffc156ec00210643178a1bcfb5a04.exe	107
PID 4068 wrote to memory of 1032	4068	328c9f0afdee2f810bb00a60a2db59a9febffc156ec00210643178a1bcfb5a04.exe	108
PID 4068 wrote to memory of 1032	4068	328c9f0afdee2f810bb00a60a2db59a9febffc156ec00210643178a1bcfb5a04.exe	108
PID 4068 wrote to memory of 4140	4068	328c9f0afdee2f810bb00a60a2db59a9febffc156ec00210643178a1bcfb5a04.exe	109
PID 4068 wrote to memory of 4140	4068	328c9f0afdee2f810bb00a60a2db59a9febffc156ec00210643178a1bcfb5a04.exe	109
PID 4068 wrote to memory of 2512	4068	328c9f0afdee2f810bb00a60a2db59a9febffc156ec00210643178a1bcfb5a04.exe	110
PID 4068 wrote to memory of 2512	4068	328c9f0afdee2f810bb00a60a2db59a9febffc156ec00210643178a1bcfb5a04.exe	110
PID 4068 wrote to memory of 2312	4068	328c9f0afdee2f810bb00a60a2db59a9febffc156ec00210643178a1bcfb5a04.exe	111
PID 4068 wrote to memory of 2312	4068	328c9f0afdee2f810bb00a60a2db59a9febffc156ec00210643178a1bcfb5a04.exe	111
PID 4068 wrote to memory of 552	4068	328c9f0afdee2f810bb00a60a2db59a9febffc156ec00210643178a1bcfb5a04.exe	112
PID 4068 wrote to memory of 552	4068	328c9f0afdee2f810bb00a60a2db59a9febffc156ec00210643178a1bcfb5a04.exe	112
PID 4068 wrote to memory of 1768	4068	328c9f0afdee2f810bb00a60a2db59a9febffc156ec00210643178a1bcfb5a04.exe	113
PID 4068 wrote to memory of 1768	4068	328c9f0afdee2f810bb00a60a2db59a9febffc156ec00210643178a1bcfb5a04.exe	113
PID 4068 wrote to memory of 3468	4068	328c9f0afdee2f810bb00a60a2db59a9febffc156ec00210643178a1bcfb5a04.exe	114
PID 4068 wrote to memory of 3468	4068	328c9f0afdee2f810bb00a60a2db59a9febffc156ec00210643178a1bcfb5a04.exe	114
PID 4068 wrote to memory of 1852	4068	328c9f0afdee2f810bb00a60a2db59a9febffc156ec00210643178a1bcfb5a04.exe	115
PID 4068 wrote to memory of 1852	4068	328c9f0afdee2f810bb00a60a2db59a9febffc156ec00210643178a1bcfb5a04.exe	115

C:\Users\Admin\AppData\Local\Temp\328c9f0afdee2f810bb00a60a2db59a9febffc156ec00210643178a1bcfb5a04.exe
"C:\Users\Admin\AppData\Local\Temp\328c9f0afdee2f810bb00a60a2db59a9febffc156ec00210643178a1bcfb5a04.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4068
- C:\Windows\System\BEcXRFX.exe
  C:\Windows\System\BEcXRFX.exe
  2⤵
  - Executes dropped EXE
  PID:1980
- C:\Windows\System\aLrVKCs.exe
  C:\Windows\System\aLrVKCs.exe
  2⤵
  - Executes dropped EXE
  PID:4888
- C:\Windows\System\tcLjtao.exe
  C:\Windows\System\tcLjtao.exe
  2⤵
  - Executes dropped EXE
  PID:3656
- C:\Windows\System\UltTeYo.exe
  C:\Windows\System\UltTeYo.exe
  2⤵
  - Executes dropped EXE
  PID:2212
- C:\Windows\System\bGmJNIt.exe
  C:\Windows\System\bGmJNIt.exe
  2⤵
  - Executes dropped EXE
  PID:1184
- C:\Windows\System\WVfTClf.exe
  C:\Windows\System\WVfTClf.exe
  2⤵
  - Executes dropped EXE
  PID:3696
- C:\Windows\System\zAWvSXM.exe
  C:\Windows\System\zAWvSXM.exe
  2⤵
  - Executes dropped EXE
  PID:2352
- C:\Windows\System\FCxUafm.exe
  C:\Windows\System\FCxUafm.exe
  2⤵
  - Executes dropped EXE
  PID:1484
- C:\Windows\System\WxLCDVn.exe
  C:\Windows\System\WxLCDVn.exe
  2⤵
  - Executes dropped EXE
  PID:1620
- C:\Windows\System\jqkCKDL.exe
  C:\Windows\System\jqkCKDL.exe
  2⤵
  - Executes dropped EXE
  PID:2428
- C:\Windows\System\zxPHWLZ.exe
  C:\Windows\System\zxPHWLZ.exe
  2⤵
  - Executes dropped EXE
  PID:2956
- C:\Windows\System\fDUUhQa.exe
  C:\Windows\System\fDUUhQa.exe
  2⤵
  - Executes dropped EXE
  PID:2280
- C:\Windows\System\sxOIrGx.exe
  C:\Windows\System\sxOIrGx.exe
  2⤵
  - Executes dropped EXE
  PID:3892
- C:\Windows\System\RePOUMC.exe
  C:\Windows\System\RePOUMC.exe
  2⤵
  - Executes dropped EXE
  PID:1296
- C:\Windows\System\ubXOKuJ.exe
  C:\Windows\System\ubXOKuJ.exe
  2⤵
  - Executes dropped EXE
  PID:1812
- C:\Windows\System\WoLxejU.exe
  C:\Windows\System\WoLxejU.exe
  2⤵
  - Executes dropped EXE
  PID:2068
- C:\Windows\System\hTmmSPE.exe
  C:\Windows\System\hTmmSPE.exe
  2⤵
  - Executes dropped EXE
  PID:4748
- C:\Windows\System\MqfYxhw.exe
  C:\Windows\System\MqfYxhw.exe
  2⤵
  - Executes dropped EXE
  PID:3880
- C:\Windows\System\eFDbico.exe
  C:\Windows\System\eFDbico.exe
  2⤵
  - Executes dropped EXE
  PID:3524
- C:\Windows\System\jqyOQSC.exe
  C:\Windows\System\jqyOQSC.exe
  2⤵
  - Executes dropped EXE
  PID:1864
- C:\Windows\System\lZCdBCK.exe
  C:\Windows\System\lZCdBCK.exe
  2⤵
  - Executes dropped EXE
  PID:3016
- C:\Windows\System\GAAEpaQ.exe
  C:\Windows\System\GAAEpaQ.exe
  2⤵
  - Executes dropped EXE
  PID:2328
- C:\Windows\System\niiEdzG.exe
  C:\Windows\System\niiEdzG.exe
  2⤵
  - Executes dropped EXE
  PID:3092
- C:\Windows\System\jWEFPdg.exe
  C:\Windows\System\jWEFPdg.exe
  2⤵
  - Executes dropped EXE
  PID:812
- C:\Windows\System\EQeMsFO.exe
  C:\Windows\System\EQeMsFO.exe
  2⤵
  - Executes dropped EXE
  PID:1032
- C:\Windows\System\VXouKgE.exe
  C:\Windows\System\VXouKgE.exe
  2⤵
  - Executes dropped EXE
  PID:4140
- C:\Windows\System\kENnVkI.exe
  C:\Windows\System\kENnVkI.exe
  2⤵
  - Executes dropped EXE
  PID:2512
- C:\Windows\System\MJNdvPB.exe
  C:\Windows\System\MJNdvPB.exe
  2⤵
  - Executes dropped EXE
  PID:2312
- C:\Windows\System\MRSQIjD.exe
  C:\Windows\System\MRSQIjD.exe
  2⤵
  - Executes dropped EXE
  PID:552
- C:\Windows\System\upVKaBQ.exe
  C:\Windows\System\upVKaBQ.exe
  2⤵
  - Executes dropped EXE
  PID:1768
- C:\Windows\System\TeWypWW.exe
  C:\Windows\System\TeWypWW.exe
  2⤵
  - Executes dropped EXE
  PID:3468
- C:\Windows\System\YBDHiAR.exe
  C:\Windows\System\YBDHiAR.exe
  2⤵
  - Executes dropped EXE
  PID:1852
- C:\Windows\System\mgREjGV.exe
  C:\Windows\System\mgREjGV.exe
  2⤵
  - Executes dropped EXE
  PID:3648
- C:\Windows\System\mKBvjga.exe
  C:\Windows\System\mKBvjga.exe
  2⤵
  - Executes dropped EXE
  PID:4432
- C:\Windows\System\fjmbedY.exe
  C:\Windows\System\fjmbedY.exe
  2⤵
  - Executes dropped EXE
  PID:4540
- C:\Windows\System\EUYzWar.exe
  C:\Windows\System\EUYzWar.exe
  2⤵
  - Executes dropped EXE
  PID:3580
- C:\Windows\System\wbCrBhV.exe
  C:\Windows\System\wbCrBhV.exe
  2⤵
  - Executes dropped EXE
  PID:2868
- C:\Windows\System\XYxPggG.exe
  C:\Windows\System\XYxPggG.exe
  2⤵
  - Executes dropped EXE
  PID:1580
- C:\Windows\System\nzQvvZY.exe
  C:\Windows\System\nzQvvZY.exe
  2⤵
  - Executes dropped EXE
  PID:1972
- C:\Windows\System\xdpMMYH.exe
  C:\Windows\System\xdpMMYH.exe
  2⤵
  - Executes dropped EXE
  PID:944
- C:\Windows\System\XYZohKt.exe
  C:\Windows\System\XYZohKt.exe
  2⤵
  - Executes dropped EXE
  PID:4824
- C:\Windows\System\ghebtsK.exe
  C:\Windows\System\ghebtsK.exe
  2⤵
  - Executes dropped EXE
  PID:984
- C:\Windows\System\GlEAEKw.exe
  C:\Windows\System\GlEAEKw.exe
  2⤵
  - Executes dropped EXE
  PID:1976
- C:\Windows\System\yeuhDqa.exe
  C:\Windows\System\yeuhDqa.exe
  2⤵
  - Executes dropped EXE
  PID:2792
- C:\Windows\System\OllmJRE.exe
  C:\Windows\System\OllmJRE.exe
  2⤵
  - Executes dropped EXE
  PID:1560
- C:\Windows\System\XmkaZqf.exe
  C:\Windows\System\XmkaZqf.exe
  2⤵
  - Executes dropped EXE
  PID:1468
- C:\Windows\System\HqblqnE.exe
  C:\Windows\System\HqblqnE.exe
  2⤵
  - Executes dropped EXE
  PID:508
- C:\Windows\System\YxNpHGt.exe
  C:\Windows\System\YxNpHGt.exe
  2⤵
  - Executes dropped EXE
  PID:3584
- C:\Windows\System\CMxvrLa.exe
  C:\Windows\System\CMxvrLa.exe
  2⤵
  - Executes dropped EXE
  PID:4932
- C:\Windows\System\fxhGzCk.exe
  C:\Windows\System\fxhGzCk.exe
  2⤵
  - Executes dropped EXE
  PID:5068
- C:\Windows\System\ltPJJIW.exe
  C:\Windows\System\ltPJJIW.exe
  2⤵
  - Executes dropped EXE
  PID:4788
- C:\Windows\System\nLsbqxq.exe
  C:\Windows\System\nLsbqxq.exe
  2⤵
  - Executes dropped EXE
  PID:4908
- C:\Windows\System\kGPLTSt.exe
  C:\Windows\System\kGPLTSt.exe
  2⤵
  - Executes dropped EXE
  PID:5064
- C:\Windows\System\zrQrblu.exe
  C:\Windows\System\zrQrblu.exe
  2⤵
  - Executes dropped EXE
  PID:232
- C:\Windows\System\dSzZljZ.exe
  C:\Windows\System\dSzZljZ.exe
  2⤵
  - Executes dropped EXE
  PID:2700
- C:\Windows\System\XZTyyVf.exe
  C:\Windows\System\XZTyyVf.exe
  2⤵
  - Executes dropped EXE
  PID:3096
- C:\Windows\System\BSHRzws.exe
  C:\Windows\System\BSHRzws.exe
  2⤵
  - Executes dropped EXE
  PID:948
- C:\Windows\System\rAHGKPi.exe
  C:\Windows\System\rAHGKPi.exe
  2⤵
  - Executes dropped EXE
  PID:5112
- C:\Windows\System\caqpAth.exe
  C:\Windows\System\caqpAth.exe
  2⤵
  - Executes dropped EXE
  PID:4568
- C:\Windows\System\nSYwFRK.exe
  C:\Windows\System\nSYwFRK.exe
  2⤵
  - Executes dropped EXE
  PID:3496
- C:\Windows\System\PawoCTg.exe
  C:\Windows\System\PawoCTg.exe
  2⤵
  - Executes dropped EXE
  PID:2292
- C:\Windows\System\mnuKmjz.exe
  C:\Windows\System\mnuKmjz.exe
  2⤵
  - Executes dropped EXE
  PID:3512
- C:\Windows\System\YCnlZnF.exe
  C:\Windows\System\YCnlZnF.exe
  2⤵
  - Executes dropped EXE
  PID:3920
- C:\Windows\System\DxevASS.exe
  C:\Windows\System\DxevASS.exe
  2⤵
  - Executes dropped EXE
  PID:4020
- C:\Windows\System\LgfHtDf.exe
  C:\Windows\System\LgfHtDf.exe
  2⤵
  PID:2608
- C:\Windows\System\CSIDatp.exe
  C:\Windows\System\CSIDatp.exe
  2⤵
  PID:4148
- C:\Windows\System\OgBqMMo.exe
  C:\Windows\System\OgBqMMo.exe
  2⤵
  PID:2296
- C:\Windows\System\ZWbxkZW.exe
  C:\Windows\System\ZWbxkZW.exe
  2⤵
  PID:1928
- C:\Windows\System\tldnRdB.exe
  C:\Windows\System\tldnRdB.exe
  2⤵
  PID:2620
- C:\Windows\System\otEbfAB.exe
  C:\Windows\System\otEbfAB.exe
  2⤵
  PID:4208
- C:\Windows\System\GDzoIsB.exe
  C:\Windows\System\GDzoIsB.exe
  2⤵
  PID:804
- C:\Windows\System\tjedtnX.exe
  C:\Windows\System\tjedtnX.exe
  2⤵
  PID:4396
- C:\Windows\System\NHFgCEB.exe
  C:\Windows\System\NHFgCEB.exe
  2⤵
  PID:4040
- C:\Windows\System\fGigfWz.exe
  C:\Windows\System\fGigfWz.exe
  2⤵
  PID:4880
- C:\Windows\System\hKYpLwC.exe
  C:\Windows\System\hKYpLwC.exe
  2⤵
  PID:2644
- C:\Windows\System\dqGlYpy.exe
  C:\Windows\System\dqGlYpy.exe
  2⤵
  PID:3156
- C:\Windows\System\yekNols.exe
  C:\Windows\System\yekNols.exe
  2⤵
  PID:608
- C:\Windows\System\qiSYQjg.exe
  C:\Windows\System\qiSYQjg.exe
  2⤵
  PID:2348
- C:\Windows\System\PmNECrt.exe
  C:\Windows\System\PmNECrt.exe
  2⤵
  PID:4760
- C:\Windows\System\YMttGZL.exe
  C:\Windows\System\YMttGZL.exe
  2⤵
  PID:3680
- C:\Windows\System\BvFPvHH.exe
  C:\Windows\System\BvFPvHH.exe
  2⤵
  PID:1252
- C:\Windows\System\ezpuQpa.exe
  C:\Windows\System\ezpuQpa.exe
  2⤵
  PID:544
- C:\Windows\System\TdRAOZv.exe
  C:\Windows\System\TdRAOZv.exe
  2⤵
  PID:528
- C:\Windows\System\bhHMCsT.exe
  C:\Windows\System\bhHMCsT.exe
  2⤵
  PID:4436
- C:\Windows\System\oVdunfq.exe
  C:\Windows\System\oVdunfq.exe
  2⤵
  PID:3668
- C:\Windows\System\SoOyUDb.exe
  C:\Windows\System\SoOyUDb.exe
  2⤵
  PID:1848
- C:\Windows\System\RytVSUp.exe
  C:\Windows\System\RytVSUp.exe
  2⤵
  PID:2408
- C:\Windows\System\UmKnqCe.exe
  C:\Windows\System\UmKnqCe.exe
  2⤵
  PID:4868
- C:\Windows\System\VaGqKfK.exe
  C:\Windows\System\VaGqKfK.exe
  2⤵
  PID:1324
- C:\Windows\System\MyExmFP.exe
  C:\Windows\System\MyExmFP.exe
  2⤵
  PID:4916
- C:\Windows\System\dnAjyfE.exe
  C:\Windows\System\dnAjyfE.exe
  2⤵
  PID:3928
- C:\Windows\System\kAxtxEc.exe
  C:\Windows\System\kAxtxEc.exe
  2⤵
  PID:4032
- C:\Windows\System\MREKLYg.exe
  C:\Windows\System\MREKLYg.exe
  2⤵
  PID:220
- C:\Windows\System\FTyeROA.exe
  C:\Windows\System\FTyeROA.exe
  2⤵
  PID:4688
- C:\Windows\System\NwwOzFg.exe
  C:\Windows\System\NwwOzFg.exe
  2⤵
  PID:4980
- C:\Windows\System\zCRmzCC.exe
  C:\Windows\System\zCRmzCC.exe
  2⤵
  PID:5108
- C:\Windows\System\FWsWcyq.exe
  C:\Windows\System\FWsWcyq.exe
  2⤵
  PID:1304
- C:\Windows\System\AEerquo.exe
  C:\Windows\System\AEerquo.exe
  2⤵
  PID:808
- C:\Windows\System\SiQQAHB.exe
  C:\Windows\System\SiQQAHB.exe
  2⤵
  PID:4920
- C:\Windows\System\yPtciGl.exe
  C:\Windows\System\yPtciGl.exe
  2⤵
  PID:2796
- C:\Windows\System\KaoGVXc.exe
  C:\Windows\System\KaoGVXc.exe
  2⤵
  PID:4420
- C:\Windows\System\qhalztc.exe
  C:\Windows\System\qhalztc.exe
  2⤵
  PID:2980
- C:\Windows\System\JxGNdgg.exe
  C:\Windows\System\JxGNdgg.exe
  2⤵
  PID:4404
- C:\Windows\System\DxJlqMx.exe
  C:\Windows\System\DxJlqMx.exe
  2⤵
  PID:4412
- C:\Windows\System\EJNmMZu.exe
  C:\Windows\System\EJNmMZu.exe
  2⤵
  PID:264
- C:\Windows\System\UBSGyMy.exe
  C:\Windows\System\UBSGyMy.exe
  2⤵
  PID:2888
- C:\Windows\System\VHzXmSs.exe
  C:\Windows\System\VHzXmSs.exe
  2⤵
  PID:3500
- C:\Windows\System\rAZCKNh.exe
  C:\Windows\System\rAZCKNh.exe
  2⤵
  PID:1628
- C:\Windows\System\yFCmoFp.exe
  C:\Windows\System\yFCmoFp.exe
  2⤵
  PID:4736
- C:\Windows\System\nSowFxT.exe
  C:\Windows\System\nSowFxT.exe
  2⤵
  PID:3748
- C:\Windows\System\EedGkKg.exe
  C:\Windows\System\EedGkKg.exe
  2⤵
  PID:2872
- C:\Windows\System\SZNdrFU.exe
  C:\Windows\System\SZNdrFU.exe
  2⤵
  PID:1612
- C:\Windows\System\biEDmqd.exe
  C:\Windows\System\biEDmqd.exe
  2⤵
  PID:3792
- C:\Windows\System\PJDAgNU.exe
  C:\Windows\System\PJDAgNU.exe
  2⤵
  PID:5132
- C:\Windows\System\YUwBHpr.exe
  C:\Windows\System\YUwBHpr.exe
  2⤵
  PID:5160
- C:\Windows\System\UzPIiKz.exe
  C:\Windows\System\UzPIiKz.exe
  2⤵
  PID:5188
- C:\Windows\System\zyZuNlo.exe
  C:\Windows\System\zyZuNlo.exe
  2⤵
  PID:5216
- C:\Windows\System\cZtvBYN.exe
  C:\Windows\System\cZtvBYN.exe
  2⤵
  PID:5244
- C:\Windows\System\qSXSGMz.exe
  C:\Windows\System\qSXSGMz.exe
  2⤵
  PID:5276
- C:\Windows\System\OLJMvui.exe
  C:\Windows\System\OLJMvui.exe
  2⤵
  PID:5300
- C:\Windows\System\QYAmZGn.exe
  C:\Windows\System\QYAmZGn.exe
  2⤵
  PID:5316
- C:\Windows\System\RwRaqJg.exe
  C:\Windows\System\RwRaqJg.exe
  2⤵
  PID:5356
- C:\Windows\System\NzrBZOg.exe
  C:\Windows\System\NzrBZOg.exe
  2⤵
  PID:5372
- C:\Windows\System\alCoHmz.exe
  C:\Windows\System\alCoHmz.exe
  2⤵
  PID:5400
- C:\Windows\System\hcrpXPj.exe
  C:\Windows\System\hcrpXPj.exe
  2⤵
  PID:5420
- C:\Windows\System\YcNrpCd.exe
  C:\Windows\System\YcNrpCd.exe
  2⤵
  PID:5460
- C:\Windows\System\TilQpwr.exe
  C:\Windows\System\TilQpwr.exe
  2⤵
  PID:5488
- C:\Windows\System\zrCvJRl.exe
  C:\Windows\System\zrCvJRl.exe
  2⤵
  PID:5524
- C:\Windows\System\oXQqkix.exe
  C:\Windows\System\oXQqkix.exe
  2⤵
  PID:5556
- C:\Windows\System\WiFLcPU.exe
  C:\Windows\System\WiFLcPU.exe
  2⤵
  PID:5584
- C:\Windows\System\zxXKdub.exe
  C:\Windows\System\zxXKdub.exe
  2⤵
  PID:5612
- C:\Windows\System\LuroeDs.exe
  C:\Windows\System\LuroeDs.exe
  2⤵
  PID:5640
- C:\Windows\System\LApEGNL.exe
  C:\Windows\System\LApEGNL.exe
  2⤵
  PID:5656
- C:\Windows\System\AEzjMjv.exe
  C:\Windows\System\AEzjMjv.exe
  2⤵
  PID:5684
- C:\Windows\System\bRrWqLu.exe
  C:\Windows\System\bRrWqLu.exe
  2⤵
  PID:5724
- C:\Windows\System\zqLNjmO.exe
  C:\Windows\System\zqLNjmO.exe
  2⤵
  PID:5752
- C:\Windows\System\FvNaxgg.exe
  C:\Windows\System\FvNaxgg.exe
  2⤵
  PID:5780
- C:\Windows\System\jvEUQgW.exe
  C:\Windows\System\jvEUQgW.exe
  2⤵
  PID:5808
- C:\Windows\System\okxddxi.exe
  C:\Windows\System\okxddxi.exe
  2⤵
  PID:5844
- C:\Windows\System\kjvejQr.exe
  C:\Windows\System\kjvejQr.exe
  2⤵
  PID:5864
- C:\Windows\System\QBdTVkb.exe
  C:\Windows\System\QBdTVkb.exe
  2⤵
  PID:5880
- C:\Windows\System\NWIWgWL.exe
  C:\Windows\System\NWIWgWL.exe
  2⤵
  PID:5896
- C:\Windows\System\FweepVO.exe
  C:\Windows\System\FweepVO.exe
  2⤵
  PID:5912
- C:\Windows\System\flzCiiu.exe
  C:\Windows\System\flzCiiu.exe
  2⤵
  PID:5952
- C:\Windows\System\vRcZsop.exe
  C:\Windows\System\vRcZsop.exe
  2⤵
  PID:5992
- C:\Windows\System\TubXQgw.exe
  C:\Windows\System\TubXQgw.exe
  2⤵
  PID:6008
- C:\Windows\System\MzabAiZ.exe
  C:\Windows\System\MzabAiZ.exe
  2⤵
  PID:6040
- C:\Windows\System\gnWzEDh.exe
  C:\Windows\System\gnWzEDh.exe
  2⤵
  PID:6064
- C:\Windows\System\LypOhvh.exe
  C:\Windows\System\LypOhvh.exe
  2⤵
  PID:6088
- C:\Windows\System\gTGYYFa.exe
  C:\Windows\System\gTGYYFa.exe
  2⤵
  PID:6128
- C:\Windows\System\UxexbfZ.exe
  C:\Windows\System\UxexbfZ.exe
  2⤵
  PID:1556
- C:\Windows\System\xbYQVmD.exe
  C:\Windows\System\xbYQVmD.exe
  2⤵
  PID:5180
- C:\Windows\System\LXsnguf.exe
  C:\Windows\System\LXsnguf.exe
  2⤵
  PID:5256
- C:\Windows\System\TWNGnhR.exe
  C:\Windows\System\TWNGnhR.exe
  2⤵
  PID:5336
- C:\Windows\System\yAvYsGW.exe
  C:\Windows\System\yAvYsGW.exe
  2⤵
  PID:5408
- C:\Windows\System\mazdXSz.exe
  C:\Windows\System\mazdXSz.exe
  2⤵
  PID:5440
- C:\Windows\System\oefRzLo.exe
  C:\Windows\System\oefRzLo.exe
  2⤵
  PID:5536
- C:\Windows\System\WLqbMBN.exe
  C:\Windows\System\WLqbMBN.exe
  2⤵
  PID:5596
- C:\Windows\System\tyaGsle.exe
  C:\Windows\System\tyaGsle.exe
  2⤵
  PID:5672
- C:\Windows\System\CwPLZfl.exe
  C:\Windows\System\CwPLZfl.exe
  2⤵
  PID:5712
- C:\Windows\System\XqwgFkI.exe
  C:\Windows\System\XqwgFkI.exe
  2⤵
  PID:5792
- C:\Windows\System\FukOXUh.exe
  C:\Windows\System\FukOXUh.exe
  2⤵
  PID:5860
- C:\Windows\System\NqDoYUl.exe
  C:\Windows\System\NqDoYUl.exe
  2⤵
  PID:5908
- C:\Windows\System\JdBZGiH.exe
  C:\Windows\System\JdBZGiH.exe
  2⤵
  PID:6004
- C:\Windows\System\sCacnxG.exe
  C:\Windows\System\sCacnxG.exe
  2⤵
  PID:6076
- C:\Windows\System\PGpHqvi.exe
  C:\Windows\System\PGpHqvi.exe
  2⤵
  PID:6084
- C:\Windows\System\kTDOvTk.exe
  C:\Windows\System\kTDOvTk.exe
  2⤵
  PID:5152
- C:\Windows\System\bGXYyri.exe
  C:\Windows\System\bGXYyri.exe
  2⤵
  PID:5384
- C:\Windows\System\jhnBztH.exe
  C:\Windows\System\jhnBztH.exe
  2⤵
  PID:5436
- C:\Windows\System\nPvCtAQ.exe
  C:\Windows\System\nPvCtAQ.exe
  2⤵
  PID:5772
- C:\Windows\System\DdrUBgX.exe
  C:\Windows\System\DdrUBgX.exe
  2⤵
  PID:5852
- C:\Windows\System\BJPTFUF.exe
  C:\Windows\System\BJPTFUF.exe
  2⤵
  PID:6112
- C:\Windows\System\GjhwxDR.exe
  C:\Windows\System\GjhwxDR.exe
  2⤵
  PID:5204
- C:\Windows\System\YusSJWs.exe
  C:\Windows\System\YusSJWs.exe
  2⤵
  PID:5572
- C:\Windows\System\TOFqNWO.exe
  C:\Windows\System\TOFqNWO.exe
  2⤵
  PID:5800
- C:\Windows\System\QXhIUEV.exe
  C:\Windows\System\QXhIUEV.exe
  2⤵
  PID:6136
- C:\Windows\System\WGlDFmc.exe
  C:\Windows\System\WGlDFmc.exe
  2⤵
  PID:6156
- C:\Windows\System\PSezHwa.exe
  C:\Windows\System\PSezHwa.exe
  2⤵
  PID:6192
- C:\Windows\System\ftmfDsm.exe
  C:\Windows\System\ftmfDsm.exe
  2⤵
  PID:6220
- C:\Windows\System\bXuhhTh.exe
  C:\Windows\System\bXuhhTh.exe
  2⤵
  PID:6256
- C:\Windows\System\NUTzJeD.exe
  C:\Windows\System\NUTzJeD.exe
  2⤵
  PID:6284
- C:\Windows\System\ChRvGpN.exe
  C:\Windows\System\ChRvGpN.exe
  2⤵
  PID:6300
- C:\Windows\System\rYeDyTV.exe
  C:\Windows\System\rYeDyTV.exe
  2⤵
  PID:6336
- C:\Windows\System\FXTvlCF.exe
  C:\Windows\System\FXTvlCF.exe
  2⤵
  PID:6356
- C:\Windows\System\mpnkyWG.exe
  C:\Windows\System\mpnkyWG.exe
  2⤵
  PID:6384
- C:\Windows\System\gJoNYDt.exe
  C:\Windows\System\gJoNYDt.exe
  2⤵
  PID:6404
- C:\Windows\System\WYlYAzK.exe
  C:\Windows\System\WYlYAzK.exe
  2⤵
  PID:6440
- C:\Windows\System\PTJkVFl.exe
  C:\Windows\System\PTJkVFl.exe
  2⤵
  PID:6480
- C:\Windows\System\qoKHmaI.exe
  C:\Windows\System\qoKHmaI.exe
  2⤵
  PID:6504
- C:\Windows\System\EEWwDpI.exe
  C:\Windows\System\EEWwDpI.exe
  2⤵
  PID:6524
- C:\Windows\System\vBWaITZ.exe
  C:\Windows\System\vBWaITZ.exe
  2⤵
  PID:6548
- C:\Windows\System\JeiRtzA.exe
  C:\Windows\System\JeiRtzA.exe
  2⤵
  PID:6580
- C:\Windows\System\KFASraH.exe
  C:\Windows\System\KFASraH.exe
  2⤵
  PID:6624
- C:\Windows\System\yEjtrYC.exe
  C:\Windows\System\yEjtrYC.exe
  2⤵
  PID:6652
- C:\Windows\System\InvpUeA.exe
  C:\Windows\System\InvpUeA.exe
  2⤵
  PID:6680
- C:\Windows\System\jyWOjPP.exe
  C:\Windows\System\jyWOjPP.exe
  2⤵
  PID:6708
- C:\Windows\System\INyiJYg.exe
  C:\Windows\System\INyiJYg.exe
  2⤵
  PID:6736
- C:\Windows\System\mvODVUW.exe
  C:\Windows\System\mvODVUW.exe
  2⤵
  PID:6764
- C:\Windows\System\BzZvcog.exe
  C:\Windows\System\BzZvcog.exe
  2⤵
  PID:6792
- C:\Windows\System\CmhcuZc.exe
  C:\Windows\System\CmhcuZc.exe
  2⤵
  PID:6828
- C:\Windows\System\uXZNzBD.exe
  C:\Windows\System\uXZNzBD.exe
  2⤵
  PID:6852
- C:\Windows\System\WFDGoxE.exe
  C:\Windows\System\WFDGoxE.exe
  2⤵
  PID:6876
- C:\Windows\System\muLnuuY.exe
  C:\Windows\System\muLnuuY.exe
  2⤵
  PID:6904
- C:\Windows\System\hkHLuUF.exe
  C:\Windows\System\hkHLuUF.exe
  2⤵
  PID:6932
- C:\Windows\System\dhgoFKX.exe
  C:\Windows\System\dhgoFKX.exe
  2⤵
  PID:6960
- C:\Windows\System\ZVoowHC.exe
  C:\Windows\System\ZVoowHC.exe
  2⤵
  PID:6988
- C:\Windows\System\dhZREYL.exe
  C:\Windows\System\dhZREYL.exe
  2⤵
  PID:7024
- C:\Windows\System\UHFuhyr.exe
  C:\Windows\System\UHFuhyr.exe
  2⤵
  PID:7044
- C:\Windows\System\TLgPpSh.exe
  C:\Windows\System\TLgPpSh.exe
  2⤵
  PID:7076
- C:\Windows\System\tNWJSqb.exe
  C:\Windows\System\tNWJSqb.exe
  2⤵
  PID:7104
- C:\Windows\System\BytcXZG.exe
  C:\Windows\System\BytcXZG.exe
  2⤵
  PID:7132
- C:\Windows\System\EoLuVSr.exe
  C:\Windows\System\EoLuVSr.exe
  2⤵
  PID:7160
- C:\Windows\System\lQGAeSC.exe
  C:\Windows\System\lQGAeSC.exe
  2⤵
  PID:6176
- C:\Windows\System\XlViCkC.exe
  C:\Windows\System\XlViCkC.exe
  2⤵
  PID:6208
- C:\Windows\System\ZPCqTmu.exe
  C:\Windows\System\ZPCqTmu.exe
  2⤵
  PID:6276
- C:\Windows\System\uNLOHBH.exe
  C:\Windows\System\uNLOHBH.exe
  2⤵
  PID:6348
- C:\Windows\System\LsxBpCN.exe
  C:\Windows\System\LsxBpCN.exe
  2⤵
  PID:6396
- C:\Windows\System\tUWeOMt.exe
  C:\Windows\System\tUWeOMt.exe
  2⤵
  PID:6420
- C:\Windows\System\vekUvsT.exe
  C:\Windows\System\vekUvsT.exe
  2⤵
  PID:6512
- C:\Windows\System\RwINlWX.exe
  C:\Windows\System\RwINlWX.exe
  2⤵
  PID:6560
- C:\Windows\System\IxbHJar.exe
  C:\Windows\System\IxbHJar.exe
  2⤵
  PID:6616
- C:\Windows\System\dfUgniK.exe
  C:\Windows\System\dfUgniK.exe
  2⤵
  PID:6696
- C:\Windows\System\KPyDRCI.exe
  C:\Windows\System\KPyDRCI.exe
  2⤵
  PID:6692
- C:\Windows\System\lEJmJfK.exe
  C:\Windows\System\lEJmJfK.exe
  2⤵
  PID:6816
- C:\Windows\System\OuQOqCf.exe
  C:\Windows\System\OuQOqCf.exe
  2⤵
  PID:6872
- C:\Windows\System\HKajZFk.exe
  C:\Windows\System\HKajZFk.exe
  2⤵
  PID:6916
- C:\Windows\System\EHyxVkP.exe
  C:\Windows\System\EHyxVkP.exe
  2⤵
  PID:6972
- C:\Windows\System\CyXllNb.exe
  C:\Windows\System\CyXllNb.exe
  2⤵
  PID:7060
- C:\Windows\System\BPVXnmS.exe
  C:\Windows\System\BPVXnmS.exe
  2⤵
  PID:7156
- C:\Windows\System\VyLNNTJ.exe
  C:\Windows\System\VyLNNTJ.exe
  2⤵
  PID:6188
- C:\Windows\System\JMaEwMo.exe
  C:\Windows\System\JMaEwMo.exe
  2⤵
  PID:6368
- C:\Windows\System\QpJpMhZ.exe
  C:\Windows\System\QpJpMhZ.exe
  2⤵
  PID:6540
- C:\Windows\System\nJnkxfd.exe
  C:\Windows\System\nJnkxfd.exe
  2⤵
  PID:6496
- C:\Windows\System\iCNKVvZ.exe
  C:\Windows\System\iCNKVvZ.exe
  2⤵
  PID:6788
- C:\Windows\System\cIrUSuc.exe
  C:\Windows\System\cIrUSuc.exe
  2⤵
  PID:6896
- C:\Windows\System\EZUMflJ.exe
  C:\Windows\System\EZUMflJ.exe
  2⤵
  PID:5976
- C:\Windows\System\dJzEvsP.exe
  C:\Windows\System\dJzEvsP.exe
  2⤵
  PID:7116
- C:\Windows\System\fIZMEXd.exe
  C:\Windows\System\fIZMEXd.exe
  2⤵
  PID:6752
- C:\Windows\System\spzOGMD.exe
  C:\Windows\System\spzOGMD.exe
  2⤵
  PID:6944
- C:\Windows\System\uumUotW.exe
  C:\Windows\System\uumUotW.exe
  2⤵
  PID:5456
- C:\Windows\System\aNtbYXs.exe
  C:\Windows\System\aNtbYXs.exe
  2⤵
  PID:7192
- C:\Windows\System\WkxBgdT.exe
  C:\Windows\System\WkxBgdT.exe
  2⤵
  PID:7208
- C:\Windows\System\WSpjFbR.exe
  C:\Windows\System\WSpjFbR.exe
  2⤵
  PID:7236
- C:\Windows\System\fWKpctv.exe
  C:\Windows\System\fWKpctv.exe
  2⤵
  PID:7264
- C:\Windows\System\fGyueDD.exe
  C:\Windows\System\fGyueDD.exe
  2⤵
  PID:7296
- C:\Windows\System\eJrcmvR.exe
  C:\Windows\System\eJrcmvR.exe
  2⤵
  PID:7332
- C:\Windows\System\vWrjuPn.exe
  C:\Windows\System\vWrjuPn.exe
  2⤵
  PID:7356
- C:\Windows\System\DArBqVe.exe
  C:\Windows\System\DArBqVe.exe
  2⤵
  PID:7388
- C:\Windows\System\ABlSjzy.exe
  C:\Windows\System\ABlSjzy.exe
  2⤵
  PID:7420
- C:\Windows\System\OjUlQbF.exe
  C:\Windows\System\OjUlQbF.exe
  2⤵
  PID:7444
- C:\Windows\System\WPvdBCS.exe
  C:\Windows\System\WPvdBCS.exe
  2⤵
  PID:7472
- C:\Windows\System\FcsMCxn.exe
  C:\Windows\System\FcsMCxn.exe
  2⤵
  PID:7500
- C:\Windows\System\sVyszAg.exe
  C:\Windows\System\sVyszAg.exe
  2⤵
  PID:7520
- C:\Windows\System\NoFpKOb.exe
  C:\Windows\System\NoFpKOb.exe
  2⤵
  PID:7548
- C:\Windows\System\mrphjHs.exe
  C:\Windows\System\mrphjHs.exe
  2⤵
  PID:7568
- C:\Windows\System\QaQKBZt.exe
  C:\Windows\System\QaQKBZt.exe
  2⤵
  PID:7604
- C:\Windows\System\GWnyJMa.exe
  C:\Windows\System\GWnyJMa.exe
  2⤵
  PID:7632
- C:\Windows\System\BethNNP.exe
  C:\Windows\System\BethNNP.exe
  2⤵
  PID:7664
- C:\Windows\System\krLpkeL.exe
  C:\Windows\System\krLpkeL.exe
  2⤵
  PID:7696
- C:\Windows\System\tJDtUgm.exe
  C:\Windows\System\tJDtUgm.exe
  2⤵
  PID:7728
- C:\Windows\System\pujvaaP.exe
  C:\Windows\System\pujvaaP.exe
  2⤵
  PID:7756
- C:\Windows\System\tInIeKx.exe
  C:\Windows\System\tInIeKx.exe
  2⤵
  PID:7788
- C:\Windows\System\RfmdFlv.exe
  C:\Windows\System\RfmdFlv.exe
  2⤵
  PID:7804
- C:\Windows\System\cbHYOWo.exe
  C:\Windows\System\cbHYOWo.exe
  2⤵
  PID:7840
- C:\Windows\System\WKqQxPc.exe
  C:\Windows\System\WKqQxPc.exe
  2⤵
  PID:7868
- C:\Windows\System\RsTSppI.exe
  C:\Windows\System\RsTSppI.exe
  2⤵
  PID:7896
- C:\Windows\System\bimHrts.exe
  C:\Windows\System\bimHrts.exe
  2⤵
  PID:7928
- C:\Windows\System\jEtwQVQ.exe
  C:\Windows\System\jEtwQVQ.exe
  2⤵
  PID:7948
- C:\Windows\System\WunkyrD.exe
  C:\Windows\System\WunkyrD.exe
  2⤵
  PID:7980
- C:\Windows\System\jfbKbxe.exe
  C:\Windows\System\jfbKbxe.exe
  2⤵
  PID:8008
- C:\Windows\System\GlfjToe.exe
  C:\Windows\System\GlfjToe.exe
  2⤵
  PID:8036
- C:\Windows\System\aLlENiC.exe
  C:\Windows\System\aLlENiC.exe
  2⤵
  PID:8064
- C:\Windows\System\UMoRlKJ.exe
  C:\Windows\System\UMoRlKJ.exe
  2⤵
  PID:8100
- C:\Windows\System\uyaStHC.exe
  C:\Windows\System\uyaStHC.exe
  2⤵
  PID:8120
- C:\Windows\System\ZtgIzjK.exe
  C:\Windows\System\ZtgIzjK.exe
  2⤵
  PID:8136
- C:\Windows\System\JZbwezW.exe
  C:\Windows\System\JZbwezW.exe
  2⤵
  PID:8172
- C:\Windows\System\vbIgQcq.exe
  C:\Windows\System\vbIgQcq.exe
  2⤵
  PID:6600
- C:\Windows\System\smnsFUa.exe
  C:\Windows\System\smnsFUa.exe
  2⤵
  PID:7200
- C:\Windows\System\jBgvXPf.exe
  C:\Windows\System\jBgvXPf.exe
  2⤵
  PID:7312
- C:\Windows\System\ioGXmYx.exe
  C:\Windows\System\ioGXmYx.exe
  2⤵
  PID:7376
- C:\Windows\System\FkJHaIL.exe
  C:\Windows\System\FkJHaIL.exe
  2⤵
  PID:7412
- C:\Windows\System\GWQguWw.exe
  C:\Windows\System\GWQguWw.exe
  2⤵
  PID:7488
- C:\Windows\System\EacOoxK.exe
  C:\Windows\System\EacOoxK.exe
  2⤵
  PID:7536
- C:\Windows\System\WIMRuuc.exe
  C:\Windows\System\WIMRuuc.exe
  2⤵
  PID:7600
- C:\Windows\System\rcPilME.exe
  C:\Windows\System\rcPilME.exe
  2⤵
  PID:7644
- C:\Windows\System\tuFBdjo.exe
  C:\Windows\System\tuFBdjo.exe
  2⤵
  PID:7708
- C:\Windows\System\xzkISJs.exe
  C:\Windows\System\xzkISJs.exe
  2⤵
  PID:7832
- C:\Windows\System\PxpYuen.exe
  C:\Windows\System\PxpYuen.exe
  2⤵
  PID:7884
- C:\Windows\System\mFGYKaO.exe
  C:\Windows\System\mFGYKaO.exe
  2⤵
  PID:7960
- C:\Windows\System\gfljREO.exe
  C:\Windows\System\gfljREO.exe
  2⤵
  PID:7992
- C:\Windows\System\CRPVkPk.exe
  C:\Windows\System\CRPVkPk.exe
  2⤵
  PID:8024
- C:\Windows\System\cOQyMYq.exe
  C:\Windows\System\cOQyMYq.exe
  2⤵
  PID:8076
- C:\Windows\System\BCBNdig.exe
  C:\Windows\System\BCBNdig.exe
  2⤵
  PID:8132
- C:\Windows\System\uNDYvXt.exe
  C:\Windows\System\uNDYvXt.exe
  2⤵
  PID:7176
- C:\Windows\System\gYJSZaR.exe
  C:\Windows\System\gYJSZaR.exe
  2⤵
  PID:7020
- C:\Windows\System\clkcYef.exe
  C:\Windows\System\clkcYef.exe
  2⤵
  PID:7432
- C:\Windows\System\tviOPGL.exe
  C:\Windows\System\tviOPGL.exe
  2⤵
  PID:7628
- C:\Windows\System\NdvXDVc.exe
  C:\Windows\System\NdvXDVc.exe
  2⤵
  PID:7752
- C:\Windows\System\WhkFZvM.exe
  C:\Windows\System\WhkFZvM.exe
  2⤵
  PID:8028
- C:\Windows\System\igQRFKW.exe
  C:\Windows\System\igQRFKW.exe
  2⤵
  PID:8060
- C:\Windows\System\QhnCLlM.exe
  C:\Windows\System\QhnCLlM.exe
  2⤵
  PID:7584
- C:\Windows\System\IKOqLJX.exe
  C:\Windows\System\IKOqLJX.exe
  2⤵
  PID:7576
- C:\Windows\System\uutTnLm.exe
  C:\Windows\System\uutTnLm.exe
  2⤵
  PID:8108
- C:\Windows\System\vOwjwOp.exe
  C:\Windows\System\vOwjwOp.exe
  2⤵
  PID:7340
- C:\Windows\System\gUsLOpY.exe
  C:\Windows\System\gUsLOpY.exe
  2⤵
  PID:8220
- C:\Windows\System\trJouSP.exe
  C:\Windows\System\trJouSP.exe
  2⤵
  PID:8240
- C:\Windows\System\QIBRBJV.exe
  C:\Windows\System\QIBRBJV.exe
  2⤵
  PID:8272
- C:\Windows\System\xgSqjpG.exe
  C:\Windows\System\xgSqjpG.exe
  2⤵
  PID:8300
- C:\Windows\System\VmqvFyz.exe
  C:\Windows\System\VmqvFyz.exe
  2⤵
  PID:8328
- C:\Windows\System\QUYAaZO.exe
  C:\Windows\System\QUYAaZO.exe
  2⤵
  PID:8348
- C:\Windows\System\MbPcqsr.exe
  C:\Windows\System\MbPcqsr.exe
  2⤵
  PID:8376
- C:\Windows\System\ZGKtHPJ.exe
  C:\Windows\System\ZGKtHPJ.exe
  2⤵
  PID:8408
- C:\Windows\System\JAqoUhf.exe
  C:\Windows\System\JAqoUhf.exe
  2⤵
  PID:8432
- C:\Windows\System\LCoYdnz.exe
  C:\Windows\System\LCoYdnz.exe
  2⤵
  PID:8484
- C:\Windows\System\LXfUedU.exe
  C:\Windows\System\LXfUedU.exe
  2⤵
  PID:8500
- C:\Windows\System\FAxgfJe.exe
  C:\Windows\System\FAxgfJe.exe
  2⤵
  PID:8516
- C:\Windows\System\YPzKBBj.exe
  C:\Windows\System\YPzKBBj.exe
  2⤵
  PID:8544
- C:\Windows\System\MeDWQco.exe
  C:\Windows\System\MeDWQco.exe
  2⤵
  PID:8576
- C:\Windows\System\VNvbOgM.exe
  C:\Windows\System\VNvbOgM.exe
  2⤵
  PID:8612
- C:\Windows\System\eEZoHlE.exe
  C:\Windows\System\eEZoHlE.exe
  2⤵
  PID:8644
- C:\Windows\System\rqFKTWR.exe
  C:\Windows\System\rqFKTWR.exe
  2⤵
  PID:8668
- C:\Windows\System\neMozES.exe
  C:\Windows\System\neMozES.exe
  2⤵
  PID:8692
- C:\Windows\System\gYfomgC.exe
  C:\Windows\System\gYfomgC.exe
  2⤵
  PID:8712
- C:\Windows\System\ISAkFxT.exe
  C:\Windows\System\ISAkFxT.exe
  2⤵
  PID:8740
- C:\Windows\System\GJdKMYR.exe
  C:\Windows\System\GJdKMYR.exe
  2⤵
  PID:8756
- C:\Windows\System\mZDouBZ.exe
  C:\Windows\System\mZDouBZ.exe
  2⤵
  PID:8780
- C:\Windows\System\HrqDOvj.exe
  C:\Windows\System\HrqDOvj.exe
  2⤵
  PID:8816
- C:\Windows\System\ShWOwTo.exe
  C:\Windows\System\ShWOwTo.exe
  2⤵
  PID:8848
- C:\Windows\System\aIHvrOI.exe
  C:\Windows\System\aIHvrOI.exe
  2⤵
  PID:8884
- C:\Windows\System\vJnQfNv.exe
  C:\Windows\System\vJnQfNv.exe
  2⤵
  PID:8908
- C:\Windows\System\wTppTfM.exe
  C:\Windows\System\wTppTfM.exe
  2⤵
  PID:8932
- C:\Windows\System\MbhhKnv.exe
  C:\Windows\System\MbhhKnv.exe
  2⤵
  PID:8964
- C:\Windows\System\TBHRxvh.exe
  C:\Windows\System\TBHRxvh.exe
  2⤵
  PID:8984
- C:\Windows\System\qZBECMu.exe
  C:\Windows\System\qZBECMu.exe
  2⤵
  PID:9020
- C:\Windows\System\NgAGxNA.exe
  C:\Windows\System\NgAGxNA.exe
  2⤵
  PID:9044
- C:\Windows\System\zTUAjAZ.exe
  C:\Windows\System\zTUAjAZ.exe
  2⤵
  PID:9080
- C:\Windows\System\TECzJPd.exe
  C:\Windows\System\TECzJPd.exe
  2⤵
  PID:9100
- C:\Windows\System\aTCRPnL.exe
  C:\Windows\System\aTCRPnL.exe
  2⤵
  PID:9132
- C:\Windows\System\ZqUVyJQ.exe
  C:\Windows\System\ZqUVyJQ.exe
  2⤵
  PID:9152
- C:\Windows\System\vQiTzBB.exe
  C:\Windows\System\vQiTzBB.exe
  2⤵
  PID:9184
- C:\Windows\System\MfKzglx.exe
  C:\Windows\System\MfKzglx.exe
  2⤵
  PID:9208
- C:\Windows\System\uOLDLKU.exe
  C:\Windows\System\uOLDLKU.exe
  2⤵
  PID:8204
- C:\Windows\System\TtOMnAs.exe
  C:\Windows\System\TtOMnAs.exe
  2⤵
  PID:8280
- C:\Windows\System\lFPCepi.exe
  C:\Windows\System\lFPCepi.exe
  2⤵
  PID:8340
- C:\Windows\System\YSvdbyu.exe
  C:\Windows\System\YSvdbyu.exe
  2⤵
  PID:8428
- C:\Windows\System\EefHgrm.exe
  C:\Windows\System\EefHgrm.exe
  2⤵
  PID:8464
- C:\Windows\System\IeuGPZY.exe
  C:\Windows\System\IeuGPZY.exe
  2⤵
  PID:8528
- C:\Windows\System\JQXxunF.exe
  C:\Windows\System\JQXxunF.exe
  2⤵
  PID:8640
- C:\Windows\System\dNYICxg.exe
  C:\Windows\System\dNYICxg.exe
  2⤵
  PID:8708
- C:\Windows\System\fMwXuFy.exe
  C:\Windows\System\fMwXuFy.exe
  2⤵
  PID:8776
- C:\Windows\System\aGGsyws.exe
  C:\Windows\System\aGGsyws.exe
  2⤵
  PID:8856
- C:\Windows\System\pDxvNAy.exe
  C:\Windows\System\pDxvNAy.exe
  2⤵
  PID:8880
- C:\Windows\System\snHqijp.exe
  C:\Windows\System\snHqijp.exe
  2⤵
  PID:8980
- C:\Windows\System\QNsYnHT.exe
  C:\Windows\System\QNsYnHT.exe
  2⤵
  PID:9072
- C:\Windows\System\wIUzpZA.exe
  C:\Windows\System\wIUzpZA.exe
  2⤵
  PID:9060
- C:\Windows\System\gxDHKob.exe
  C:\Windows\System\gxDHKob.exe
  2⤵
  PID:9172
- C:\Windows\System\ipNtgtG.exe
  C:\Windows\System\ipNtgtG.exe
  2⤵
  PID:8288
- C:\Windows\System\DbeKpVV.exe
  C:\Windows\System\DbeKpVV.exe
  2⤵
  PID:8396
- C:\Windows\System\NzygGNP.exe
  C:\Windows\System\NzygGNP.exe
  2⤵
  PID:8628
- C:\Windows\System\TVvmhmj.exe
  C:\Windows\System\TVvmhmj.exe
  2⤵
  PID:8660
- C:\Windows\System\hsQtthy.exe
  C:\Windows\System\hsQtthy.exe
  2⤵
  PID:8828
- C:\Windows\System\POtOSun.exe
  C:\Windows\System\POtOSun.exe
  2⤵
  PID:9124
- C:\Windows\System\HuSIJqT.exe
  C:\Windows\System\HuSIJqT.exe
  2⤵
  PID:9204
- C:\Windows\System\JzuyvRD.exe
  C:\Windows\System\JzuyvRD.exe
  2⤵
  PID:8208
- C:\Windows\System\rifrkFj.exe
  C:\Windows\System\rifrkFj.exe
  2⤵
  PID:8684
- C:\Windows\System\ynZQGZu.exe
  C:\Windows\System\ynZQGZu.exe
  2⤵
  PID:9088
- C:\Windows\System\KPVQPPt.exe
  C:\Windows\System\KPVQPPt.exe
  2⤵
  PID:8456
- C:\Windows\System\sbGMvGW.exe
  C:\Windows\System\sbGMvGW.exe
  2⤵
  PID:9232
- C:\Windows\System\kWWPbgd.exe
  C:\Windows\System\kWWPbgd.exe
  2⤵
  PID:9256
- C:\Windows\System\PnNqWed.exe
  C:\Windows\System\PnNqWed.exe
  2⤵
  PID:9288
- C:\Windows\System\NARqaWd.exe
  C:\Windows\System\NARqaWd.exe
  2⤵
  PID:9316
- C:\Windows\System\EVAbtBi.exe
  C:\Windows\System\EVAbtBi.exe
  2⤵
  PID:9340
- C:\Windows\System\qSjOpNh.exe
  C:\Windows\System\qSjOpNh.exe
  2⤵
  PID:9360
- C:\Windows\System\rSopSdn.exe
  C:\Windows\System\rSopSdn.exe
  2⤵
  PID:9384
- C:\Windows\System\LLFZaCn.exe
  C:\Windows\System\LLFZaCn.exe
  2⤵
  PID:9404
- C:\Windows\System\HJrHvoT.exe
  C:\Windows\System\HJrHvoT.exe
  2⤵
  PID:9436
- C:\Windows\System\DGmyNMg.exe
  C:\Windows\System\DGmyNMg.exe
  2⤵
  PID:9464
- C:\Windows\System\oilRkOE.exe
  C:\Windows\System\oilRkOE.exe
  2⤵
  PID:9484
- C:\Windows\System\XQCQmKu.exe
  C:\Windows\System\XQCQmKu.exe
  2⤵
  PID:9512
- C:\Windows\System\ujtEATp.exe
  C:\Windows\System\ujtEATp.exe
  2⤵
  PID:9548
- C:\Windows\System\xaYLlmQ.exe
  C:\Windows\System\xaYLlmQ.exe
  2⤵
  PID:9572
- C:\Windows\System\VUsDtjQ.exe
  C:\Windows\System\VUsDtjQ.exe
  2⤵
  PID:9596
- C:\Windows\System\eCMOkKU.exe
  C:\Windows\System\eCMOkKU.exe
  2⤵
  PID:9620
- C:\Windows\System\MWsRrly.exe
  C:\Windows\System\MWsRrly.exe
  2⤵
  PID:9648
- C:\Windows\System\uilzFNd.exe
  C:\Windows\System\uilzFNd.exe
  2⤵
  PID:9676
- C:\Windows\System\WyIgwfQ.exe
  C:\Windows\System\WyIgwfQ.exe
  2⤵
  PID:9712
- C:\Windows\System\sJgBamH.exe
  C:\Windows\System\sJgBamH.exe
  2⤵
  PID:9732
- C:\Windows\System\ZvuPVgX.exe
  C:\Windows\System\ZvuPVgX.exe
  2⤵
  PID:9748
- C:\Windows\System\iVAWIRm.exe
  C:\Windows\System\iVAWIRm.exe
  2⤵
  PID:9764
- C:\Windows\System\xhtZauW.exe
  C:\Windows\System\xhtZauW.exe
  2⤵
  PID:9796
- C:\Windows\System\WKIhiTP.exe
  C:\Windows\System\WKIhiTP.exe
  2⤵
  PID:9820
- C:\Windows\System\vtmfMPN.exe
  C:\Windows\System\vtmfMPN.exe
  2⤵
  PID:9840
- C:\Windows\System\dZyaJrC.exe
  C:\Windows\System\dZyaJrC.exe
  2⤵
  PID:9860
- C:\Windows\System\ZGsZEoE.exe
  C:\Windows\System\ZGsZEoE.exe
  2⤵
  PID:9888
- C:\Windows\System\xRdyQly.exe
  C:\Windows\System\xRdyQly.exe
  2⤵
  PID:9916
- C:\Windows\System\JVpTTTq.exe
  C:\Windows\System\JVpTTTq.exe
  2⤵
  PID:9940
- C:\Windows\System\ssfgxmK.exe
  C:\Windows\System\ssfgxmK.exe
  2⤵
  PID:9980
- C:\Windows\System\XhVuQwz.exe
  C:\Windows\System\XhVuQwz.exe
  2⤵
  PID:10008
- C:\Windows\System\mrjZQPE.exe
  C:\Windows\System\mrjZQPE.exe
  2⤵
  PID:10040
- C:\Windows\System\TJdmKNK.exe
  C:\Windows\System\TJdmKNK.exe
  2⤵
  PID:10076
- C:\Windows\System\TsnuhQO.exe
  C:\Windows\System\TsnuhQO.exe
  2⤵
  PID:10104
- C:\Windows\System\WyDFVae.exe
  C:\Windows\System\WyDFVae.exe
  2⤵
  PID:10136
- C:\Windows\System\RMMAWVU.exe
  C:\Windows\System\RMMAWVU.exe
  2⤵
  PID:10160
- C:\Windows\System\UncnXct.exe
  C:\Windows\System\UncnXct.exe
  2⤵
  PID:10192
- C:\Windows\System\yYhftKy.exe
  C:\Windows\System\yYhftKy.exe
  2⤵
  PID:10228
- C:\Windows\System\GCWBsEt.exe
  C:\Windows\System\GCWBsEt.exe
  2⤵
  PID:9224
- C:\Windows\System\ZRJJaXO.exe
  C:\Windows\System\ZRJJaXO.exe
  2⤵
  PID:9268
- C:\Windows\System\BWrrpmR.exe
  C:\Windows\System\BWrrpmR.exe
  2⤵
  PID:9324
- C:\Windows\System\ZccrLOO.exe
  C:\Windows\System\ZccrLOO.exe
  2⤵
  PID:9396
- C:\Windows\System\ETGNEoG.exe
  C:\Windows\System\ETGNEoG.exe
  2⤵
  PID:9528
- C:\Windows\System\bXokXUZ.exe
  C:\Windows\System\bXokXUZ.exe
  2⤵
  PID:9496
- C:\Windows\System\VzYRjCb.exe
  C:\Windows\System\VzYRjCb.exe
  2⤵
  PID:9656
- C:\Windows\System\fKGUVxS.exe
  C:\Windows\System\fKGUVxS.exe
  2⤵
  PID:9740
- C:\Windows\System\OxyoAVe.exe
  C:\Windows\System\OxyoAVe.exe
  2⤵
  PID:9604
- C:\Windows\System\UsWtiBo.exe
  C:\Windows\System\UsWtiBo.exe
  2⤵
  PID:9636
- C:\Windows\System\qWRxCFr.exe
  C:\Windows\System\qWRxCFr.exe
  2⤵
  PID:9760
- C:\Windows\System\kYGMplO.exe
  C:\Windows\System\kYGMplO.exe
  2⤵
  PID:9832
- C:\Windows\System\gkQniNO.exe
  C:\Windows\System\gkQniNO.exe
  2⤵
  PID:10016
- C:\Windows\System\hopjEHi.exe
  C:\Windows\System\hopjEHi.exe
  2⤵
  PID:10096
- C:\Windows\System\CQRgsqE.exe
  C:\Windows\System\CQRgsqE.exe
  2⤵
  PID:10172
- C:\Windows\System\GSWjtLq.exe
  C:\Windows\System\GSWjtLq.exe
  2⤵
  PID:10148
- C:\Windows\System\TFghvMO.exe
  C:\Windows\System\TFghvMO.exe
  2⤵
  PID:9300
- C:\Windows\System\vKlqatx.exe
  C:\Windows\System\vKlqatx.exe
  2⤵
  PID:9356
- C:\Windows\System\GTvRbua.exe
  C:\Windows\System\GTvRbua.exe
  2⤵
  PID:9332
- C:\Windows\System\uJtsmqa.exe
  C:\Windows\System\uJtsmqa.exe
  2⤵
  PID:9584
- C:\Windows\System\ZolwXWr.exe
  C:\Windows\System\ZolwXWr.exe
  2⤵
  PID:9444
- C:\Windows\System\vFIuDCA.exe
  C:\Windows\System\vFIuDCA.exe
  2⤵
  PID:9964
- C:\Windows\System\CpOcQxx.exe
  C:\Windows\System\CpOcQxx.exe
  2⤵
  PID:9884
- C:\Windows\System\tgEdsEx.exe
  C:\Windows\System\tgEdsEx.exe
  2⤵
  PID:9852
- C:\Windows\System\mXLnsqZ.exe
  C:\Windows\System\mXLnsqZ.exe
  2⤵
  PID:8688
- C:\Windows\System\ArDlvPJ.exe
  C:\Windows\System\ArDlvPJ.exe
  2⤵
  PID:10168
- C:\Windows\System\YRpPPtq.exe
  C:\Windows\System\YRpPPtq.exe
  2⤵
  PID:9704
- C:\Windows\System\RKSbxwm.exe
  C:\Windows\System\RKSbxwm.exe
  2⤵
  PID:10260
- C:\Windows\System\dtSOMZu.exe
  C:\Windows\System\dtSOMZu.exe
  2⤵
  PID:10296
- C:\Windows\System\LEZEZWe.exe
  C:\Windows\System\LEZEZWe.exe
  2⤵
  PID:10332
- C:\Windows\System\qRBFvbO.exe
  C:\Windows\System\qRBFvbO.exe
  2⤵
  PID:10360
- C:\Windows\System\rckkLPx.exe
  C:\Windows\System\rckkLPx.exe
  2⤵
  PID:10404
- C:\Windows\System\YrqdWfd.exe
  C:\Windows\System\YrqdWfd.exe
  2⤵
  PID:10428
- C:\Windows\System\YuKeNKH.exe
  C:\Windows\System\YuKeNKH.exe
  2⤵
  PID:10460
- C:\Windows\System\EFAjsAI.exe
  C:\Windows\System\EFAjsAI.exe
  2⤵
  PID:10480
- C:\Windows\System\HwskZIG.exe
  C:\Windows\System\HwskZIG.exe
  2⤵
  PID:10508
- C:\Windows\System\lEqgYsf.exe
  C:\Windows\System\lEqgYsf.exe
  2⤵
  PID:10536
- C:\Windows\System\OKXwLbq.exe
  C:\Windows\System\OKXwLbq.exe
  2⤵
  PID:10556
- C:\Windows\System\FSfdsHS.exe
  C:\Windows\System\FSfdsHS.exe
  2⤵
  PID:10584
- C:\Windows\System\RmKeTdv.exe
  C:\Windows\System\RmKeTdv.exe
  2⤵
  PID:10612
- C:\Windows\System\zovRuLW.exe
  C:\Windows\System\zovRuLW.exe
  2⤵
  PID:10644
- C:\Windows\System\VxzBdZt.exe
  C:\Windows\System\VxzBdZt.exe
  2⤵
  PID:10668
- C:\Windows\System\FtizBML.exe
  C:\Windows\System\FtizBML.exe
  2⤵
  PID:10700
- C:\Windows\System\DYnrmSW.exe
  C:\Windows\System\DYnrmSW.exe
  2⤵
  PID:10736
- C:\Windows\System\swQeqQU.exe
  C:\Windows\System\swQeqQU.exe
  2⤵
  PID:10768
- C:\Windows\System\vwSknXK.exe
  C:\Windows\System\vwSknXK.exe
  2⤵
  PID:10796
- C:\Windows\System\ADgTtEF.exe
  C:\Windows\System\ADgTtEF.exe
  2⤵
  PID:10820
- C:\Windows\System\CSLdKsl.exe
  C:\Windows\System\CSLdKsl.exe
  2⤵
  PID:10840
- C:\Windows\System\ZrieVXP.exe
  C:\Windows\System\ZrieVXP.exe
  2⤵
  PID:10872
- C:\Windows\System\HMlnmrT.exe
  C:\Windows\System\HMlnmrT.exe
  2⤵
  PID:10908
- C:\Windows\System\sJCamya.exe
  C:\Windows\System\sJCamya.exe
  2⤵
  PID:10936
- C:\Windows\System\RtEteQE.exe
  C:\Windows\System\RtEteQE.exe
  2⤵
  PID:10964
- C:\Windows\System\PBWHyBg.exe
  C:\Windows\System\PBWHyBg.exe
  2⤵
  PID:10996
- C:\Windows\System\JtSgyhX.exe
  C:\Windows\System\JtSgyhX.exe
  2⤵
  PID:11024
- C:\Windows\System\tiXkAPj.exe
  C:\Windows\System\tiXkAPj.exe
  2⤵
  PID:11048
- C:\Windows\System\EoEaTBx.exe
  C:\Windows\System\EoEaTBx.exe
  2⤵
  PID:11080
- C:\Windows\System\WIAZquo.exe
  C:\Windows\System\WIAZquo.exe
  2⤵
  PID:11100
- C:\Windows\System\cUVIFPI.exe
  C:\Windows\System\cUVIFPI.exe
  2⤵
  PID:11124
- C:\Windows\System\bEGaPGt.exe
  C:\Windows\System\bEGaPGt.exe
  2⤵
  PID:11152
- C:\Windows\System\dCmMMzE.exe
  C:\Windows\System\dCmMMzE.exe
  2⤵
  PID:11180
- C:\Windows\System\OuURSRw.exe
  C:\Windows\System\OuURSRw.exe
  2⤵
  PID:11208
- C:\Windows\System\cshijNf.exe
  C:\Windows\System\cshijNf.exe
  2⤵
  PID:11236
- C:\Windows\System\KFwyyJK.exe
  C:\Windows\System\KFwyyJK.exe
  2⤵
  PID:11260
- C:\Windows\System\OjMtglq.exe
  C:\Windows\System\OjMtglq.exe
  2⤵
  PID:10092
- C:\Windows\System\wRQcqkQ.exe
  C:\Windows\System\wRQcqkQ.exe
  2⤵
  PID:10256
- C:\Windows\System\wfAqdrp.exe
  C:\Windows\System\wfAqdrp.exe
  2⤵
  PID:10004
- C:\Windows\System\oxhORmP.exe
  C:\Windows\System\oxhORmP.exe
  2⤵
  PID:10320
- C:\Windows\System\ARvVzja.exe
  C:\Windows\System\ARvVzja.exe
  2⤵
  PID:10372
- C:\Windows\System\pdORZnJ.exe
  C:\Windows\System\pdORZnJ.exe
  2⤵
  PID:10564
- C:\Windows\System\DmPoyjY.exe
  C:\Windows\System\DmPoyjY.exe
  2⤵
  PID:10712
- C:\Windows\System\LFHSLmN.exe
  C:\Windows\System\LFHSLmN.exe
  2⤵
  PID:10660
- C:\Windows\System\hZkGZYX.exe
  C:\Windows\System\hZkGZYX.exe
  2⤵
  PID:10752
- C:\Windows\System\jhLJpZx.exe
  C:\Windows\System\jhLJpZx.exe
  2⤵
  PID:10784
- C:\Windows\System\zBsOCfV.exe
  C:\Windows\System\zBsOCfV.exe
  2⤵
  PID:10916
- C:\Windows\System\XGnEoKf.exe
  C:\Windows\System\XGnEoKf.exe
  2⤵
  PID:10924
- C:\Windows\System\CUgvYwL.exe
  C:\Windows\System\CUgvYwL.exe
  2⤵
  PID:11044
- C:\Windows\System\AlhVjjk.exe
  C:\Windows\System\AlhVjjk.exe
  2⤵
  PID:11112
- C:\Windows\System\auPNAPP.exe
  C:\Windows\System\auPNAPP.exe
  2⤵
  PID:11160
- C:\Windows\System\ZpaKqcu.exe
  C:\Windows\System\ZpaKqcu.exe
  2⤵
  PID:11140
- C:\Windows\System\pvTPbko.exe
  C:\Windows\System\pvTPbko.exe
  2⤵
  PID:9696
- C:\Windows\System\AxEzMEs.exe
  C:\Windows\System\AxEzMEs.exe
  2⤵
  PID:9988
- C:\Windows\System\yDDEKCE.exe
  C:\Windows\System\yDDEKCE.exe
  2⤵
  PID:10292
- C:\Windows\System\lqcnwok.exe
  C:\Windows\System\lqcnwok.exe
  2⤵
  PID:10596
- C:\Windows\System\RdoATwG.exe
  C:\Windows\System\RdoATwG.exe
  2⤵
  PID:10816
- C:\Windows\System\WUpTmin.exe
  C:\Windows\System\WUpTmin.exe
  2⤵
  PID:10848
- C:\Windows\System\npvKuoU.exe
  C:\Windows\System\npvKuoU.exe
  2⤵
  PID:10720
- C:\Windows\System\QFORdCb.exe
  C:\Windows\System\QFORdCb.exe
  2⤵
  PID:11088
- C:\Windows\System\jzxqxhK.exe
  C:\Windows\System\jzxqxhK.exe
  2⤵
  PID:11036
- C:\Windows\System\zyvpKMh.exe
  C:\Windows\System\zyvpKMh.exe
  2⤵
  PID:10724
- C:\Windows\System\jiMeuqh.exe
  C:\Windows\System\jiMeuqh.exe
  2⤵
  PID:11072
- C:\Windows\System\kpQptwR.exe
  C:\Windows\System\kpQptwR.exe
  2⤵
  PID:11276
- C:\Windows\System\cKQoyOM.exe
  C:\Windows\System\cKQoyOM.exe
  2⤵
  PID:11304
- C:\Windows\System\LnIoPbd.exe
  C:\Windows\System\LnIoPbd.exe
  2⤵
  PID:11344
- C:\Windows\System\AmHRBeD.exe
  C:\Windows\System\AmHRBeD.exe
  2⤵
  PID:11372
- C:\Windows\System\UZcmVKH.exe
  C:\Windows\System\UZcmVKH.exe
  2⤵
  PID:11388
- C:\Windows\System\DPNbDkk.exe
  C:\Windows\System\DPNbDkk.exe
  2⤵
  PID:11416
- C:\Windows\System\SLzeZZU.exe
  C:\Windows\System\SLzeZZU.exe
  2⤵
  PID:11452
- C:\Windows\System\CoWYbKc.exe
  C:\Windows\System\CoWYbKc.exe
  2⤵
  PID:11480
- C:\Windows\System\tOyJvvn.exe
  C:\Windows\System\tOyJvvn.exe
  2⤵
  PID:11500
- C:\Windows\System\sZRqBOg.exe
  C:\Windows\System\sZRqBOg.exe
  2⤵
  PID:11528
- C:\Windows\System\BedFvpF.exe
  C:\Windows\System\BedFvpF.exe
  2⤵
  PID:11556
- C:\Windows\System\NVgZuXc.exe
  C:\Windows\System\NVgZuXc.exe
  2⤵
  PID:11576
- C:\Windows\System\WfQNcbe.exe
  C:\Windows\System\WfQNcbe.exe
  2⤵
  PID:11616
- C:\Windows\System\hfIPCkW.exe
  C:\Windows\System\hfIPCkW.exe
  2⤵
  PID:11652
- C:\Windows\System\vkpKTQE.exe
  C:\Windows\System\vkpKTQE.exe
  2⤵
  PID:11680
- C:\Windows\System\KMJwTZW.exe
  C:\Windows\System\KMJwTZW.exe
  2⤵
  PID:11704
- C:\Windows\System\aGSsUyv.exe
  C:\Windows\System\aGSsUyv.exe
  2⤵
  PID:11732
- C:\Windows\System\hKlMvcf.exe
  C:\Windows\System\hKlMvcf.exe
  2⤵
  PID:11768
- C:\Windows\System\hzpHRRE.exe
  C:\Windows\System\hzpHRRE.exe
  2⤵
  PID:11796
- C:\Windows\System\eAsmSbh.exe
  C:\Windows\System\eAsmSbh.exe
  2⤵
  PID:11840
- C:\Windows\System\UCgyAhb.exe
  C:\Windows\System\UCgyAhb.exe
  2⤵
  PID:11864
- C:\Windows\System\tBTiBnT.exe
  C:\Windows\System\tBTiBnT.exe
  2⤵
  PID:11900
- C:\Windows\System\bZZaYSJ.exe
  C:\Windows\System\bZZaYSJ.exe
  2⤵
  PID:11928
- C:\Windows\System\xhoOpxJ.exe
  C:\Windows\System\xhoOpxJ.exe
  2⤵
  PID:11952
- C:\Windows\System\NCjOdwt.exe
  C:\Windows\System\NCjOdwt.exe
  2⤵
  PID:11984
- C:\Windows\System\jRoIKXy.exe
  C:\Windows\System\jRoIKXy.exe
  2⤵
  PID:12016
- C:\Windows\System\ItowxqP.exe
  C:\Windows\System\ItowxqP.exe
  2⤵
  PID:12036
- C:\Windows\System\BBjxDxm.exe
  C:\Windows\System\BBjxDxm.exe
  2⤵
  PID:12056
- C:\Windows\System\yabStRP.exe
  C:\Windows\System\yabStRP.exe
  2⤵
  PID:12076
- C:\Windows\System\HSCVTSb.exe
  C:\Windows\System\HSCVTSb.exe
  2⤵
  PID:12100
- C:\Windows\System\GfibMUz.exe
  C:\Windows\System\GfibMUz.exe
  2⤵
  PID:12120
- C:\Windows\System\ItJnqjo.exe
  C:\Windows\System\ItJnqjo.exe
  2⤵
  PID:12156
- C:\Windows\System\vQkMJiv.exe
  C:\Windows\System\vQkMJiv.exe
  2⤵
  PID:12188
- C:\Windows\System\ZgoLbzL.exe
  C:\Windows\System\ZgoLbzL.exe
  2⤵
  PID:12208
- C:\Windows\System\mbmOEiB.exe
  C:\Windows\System\mbmOEiB.exe
  2⤵
  PID:12232
- C:\Windows\System\WkKGiwt.exe
  C:\Windows\System\WkKGiwt.exe
  2⤵
  PID:12260
- C:\Windows\System\JiSliiH.exe
  C:\Windows\System\JiSliiH.exe
  2⤵
  PID:11164
- C:\Windows\System\DyQStgR.exe
  C:\Windows\System\DyQStgR.exe
  2⤵
  PID:11272
- C:\Windows\System\LmIXLNX.exe
  C:\Windows\System\LmIXLNX.exe
  2⤵
  PID:11360
- C:\Windows\System\hdxPAYV.exe
  C:\Windows\System\hdxPAYV.exe
  2⤵
  PID:11440
- C:\Windows\System\ilnQaJs.exe
  C:\Windows\System\ilnQaJs.exe
  2⤵
  PID:11488
- C:\Windows\System\YORDGZS.exe
  C:\Windows\System\YORDGZS.exe
  2⤵
  PID:11492
- C:\Windows\System\FgWMYmG.exe
  C:\Windows\System\FgWMYmG.exe
  2⤵
  PID:11600
- C:\Windows\System\SySmhsO.exe
  C:\Windows\System\SySmhsO.exe
  2⤵
  PID:11572
- C:\Windows\System\KyGDeqg.exe
  C:\Windows\System\KyGDeqg.exe
  2⤵
  PID:11676
- C:\Windows\System\bVnOHyH.exe
  C:\Windows\System\bVnOHyH.exe
  2⤵
  PID:11696
- C:\Windows\System\CVWbJXu.exe
  C:\Windows\System\CVWbJXu.exe
  2⤵
  PID:11728
- C:\Windows\System\NOBjddv.exe
  C:\Windows\System\NOBjddv.exe
  2⤵
  PID:11856
- C:\Windows\System\wHBusRC.exe
  C:\Windows\System\wHBusRC.exe
  2⤵
  PID:11876
- C:\Windows\System\lbBdvRQ.exe
  C:\Windows\System\lbBdvRQ.exe
  2⤵
  PID:11968
- C:\Windows\System\bmuddHo.exe
  C:\Windows\System\bmuddHo.exe
  2⤵
  PID:12008
- C:\Windows\System\XcOhZfL.exe
  C:\Windows\System\XcOhZfL.exe
  2⤵
  PID:12128
- C:\Windows\System\KWpDvYI.exe
  C:\Windows\System\KWpDvYI.exe
  2⤵
  PID:12184
- C:\Windows\System\lyBhHda.exe
  C:\Windows\System\lyBhHda.exe
  2⤵
  PID:12272
- C:\Windows\System\uJjuhdG.exe
  C:\Windows\System\uJjuhdG.exe
  2⤵
  PID:12252
- C:\Windows\System\kgMzFoU.exe
  C:\Windows\System\kgMzFoU.exe
  2⤵
  PID:11336
- C:\Windows\System\cuZrKmE.exe
  C:\Windows\System\cuZrKmE.exe
  2⤵
  PID:11316
- C:\Windows\System\WsyTngv.exe
  C:\Windows\System\WsyTngv.exe
  2⤵
  PID:11540
- C:\Windows\System\rYhJKEN.exe
  C:\Windows\System\rYhJKEN.exe
  2⤵
  PID:11884
- C:\Windows\System\fSjnbJX.exe
  C:\Windows\System\fSjnbJX.exe
  2⤵
  PID:12004
- C:\Windows\System\IBgPVQX.exe
  C:\Windows\System\IBgPVQX.exe
  2⤵
  PID:12168
- C:\Windows\System\oPLUTnZ.exe
  C:\Windows\System\oPLUTnZ.exe
  2⤵
  PID:12068
- C:\Windows\System\GkScczR.exe
  C:\Windows\System\GkScczR.exe
  2⤵
  PID:11808
- C:\Windows\System\YUEPxNq.exe
  C:\Windows\System\YUEPxNq.exe
  2⤵
  PID:11512
- C:\Windows\System\EVooklT.exe
  C:\Windows\System\EVooklT.exe
  2⤵
  PID:12176
- C:\Windows\System\kVCgvIH.exe
  C:\Windows\System\kVCgvIH.exe
  2⤵
  PID:12312
- C:\Windows\System\ofTNIIH.exe
  C:\Windows\System\ofTNIIH.exe
  2⤵
  PID:12344
- C:\Windows\System\cxcsnwS.exe
  C:\Windows\System\cxcsnwS.exe
  2⤵
  PID:12376
- C:\Windows\System\VDKXCaF.exe
  C:\Windows\System\VDKXCaF.exe
  2⤵
  PID:12400
- C:\Windows\System\gjYBhsm.exe
  C:\Windows\System\gjYBhsm.exe
  2⤵
  PID:12432
- C:\Windows\System\aimXbQc.exe
  C:\Windows\System\aimXbQc.exe
  2⤵
  PID:12460
- C:\Windows\System\lWUFiIW.exe
  C:\Windows\System\lWUFiIW.exe
  2⤵
  PID:12488
- C:\Windows\System\RIoKfKh.exe
  C:\Windows\System\RIoKfKh.exe
  2⤵
  PID:12516
- C:\Windows\System\fIowIgs.exe
  C:\Windows\System\fIowIgs.exe
  2⤵
  PID:12540
- C:\Windows\System\JCLAuhi.exe
  C:\Windows\System\JCLAuhi.exe
  2⤵
  PID:12572
- C:\Windows\System\UJeYLyy.exe
  C:\Windows\System\UJeYLyy.exe
  2⤵
  PID:12592
- C:\Windows\System\EwQiPQM.exe
  C:\Windows\System\EwQiPQM.exe
  2⤵
  PID:12616
- C:\Windows\System\AivmjWz.exe
  C:\Windows\System\AivmjWz.exe
  2⤵
  PID:12640
- C:\Windows\System\ETSEQOL.exe
  C:\Windows\System\ETSEQOL.exe
  2⤵
  PID:12668
- C:\Windows\System\EudLUXY.exe
  C:\Windows\System\EudLUXY.exe
  2⤵
  PID:12692
- C:\Windows\System\uQifZTZ.exe
  C:\Windows\System\uQifZTZ.exe
  2⤵
  PID:12724
- C:\Windows\System\ZDZcgrx.exe
  C:\Windows\System\ZDZcgrx.exe
  2⤵
  PID:12752
- C:\Windows\System\qLreyFV.exe
  C:\Windows\System\qLreyFV.exe
  2⤵
  PID:12776
- C:\Windows\System\EFMBePx.exe
  C:\Windows\System\EFMBePx.exe
  2⤵
  PID:12820
- C:\Windows\System\dxjpPIW.exe
  C:\Windows\System\dxjpPIW.exe
  2⤵
  PID:12848
- C:\Windows\System\EAPSKps.exe
  C:\Windows\System\EAPSKps.exe
  2⤵
  PID:12884
- C:\Windows\System\SmsTTZX.exe
  C:\Windows\System\SmsTTZX.exe
  2⤵
  PID:12908
- C:\Windows\System\FJycRMz.exe
  C:\Windows\System\FJycRMz.exe
  2⤵
  PID:12944
- C:\Windows\System\hRVdSqj.exe
  C:\Windows\System\hRVdSqj.exe
  2⤵
  PID:12972
- C:\Windows\System\ObPImfe.exe
  C:\Windows\System\ObPImfe.exe
  2⤵
  PID:12992
- C:\Windows\System\RtDDSus.exe
  C:\Windows\System\RtDDSus.exe
  2⤵
  PID:13020
- C:\Windows\System\FnlUskg.exe
  C:\Windows\System\FnlUskg.exe
  2⤵
  PID:13048
- C:\Windows\System\VuPwVLV.exe
  C:\Windows\System\VuPwVLV.exe
  2⤵
  PID:13080
- C:\Windows\System\CZQHorE.exe
  C:\Windows\System\CZQHorE.exe
  2⤵
  PID:13116
- C:\Windows\System\wxaalgJ.exe
  C:\Windows\System\wxaalgJ.exe
  2⤵
  PID:13136
- C:\Windows\System\WxgWzhm.exe
  C:\Windows\System\WxgWzhm.exe
  2⤵
  PID:13160
- C:\Windows\System\zlitOlE.exe
  C:\Windows\System\zlitOlE.exe
  2⤵
  PID:13188
- C:\Windows\System\KoxBNsS.exe
  C:\Windows\System\KoxBNsS.exe
  2⤵
  PID:13212
- C:\Windows\System\xixJTDp.exe
  C:\Windows\System\xixJTDp.exe
  2⤵
  PID:13236
- C:\Windows\System\FdVsvuK.exe
  C:\Windows\System\FdVsvuK.exe
  2⤵
  PID:13264
- C:\Windows\System\mOsZxpt.exe
  C:\Windows\System\mOsZxpt.exe
  2⤵
  PID:13300
- C:\Windows\System\XncxLSK.exe
  C:\Windows\System\XncxLSK.exe
  2⤵
  PID:12244
- C:\Windows\System\EbfGLHG.exe
  C:\Windows\System\EbfGLHG.exe
  2⤵
  PID:12228
- C:\Windows\System\LuJBCaJ.exe
  C:\Windows\System\LuJBCaJ.exe
  2⤵
  PID:11744
- C:\Windows\System\AOyTpTv.exe
  C:\Windows\System\AOyTpTv.exe
  2⤵
  PID:12452
- C:\Windows\System\hVeGpIo.exe
  C:\Windows\System\hVeGpIo.exe
  2⤵
  PID:12496
- C:\Windows\System\RorUFIC.exe
  C:\Windows\System\RorUFIC.exe
  2⤵
  PID:12532
- C:\Windows\System\ETmzmtP.exe
  C:\Windows\System\ETmzmtP.exe
  2⤵
  PID:12560
- C:\Windows\System\DCyHBkk.exe
  C:\Windows\System\DCyHBkk.exe
  2⤵
  PID:12632
- C:\Windows\System\kuqIjMh.exe
  C:\Windows\System\kuqIjMh.exe
  2⤵
  PID:12656
- C:\Windows\System\yfAtOqX.exe
  C:\Windows\System\yfAtOqX.exe
  2⤵
  PID:12804
- C:\Windows\System\UZZwctK.exe
  C:\Windows\System\UZZwctK.exe
  2⤵
  PID:12892
- C:\Windows\System\FNHeWcH.exe
  C:\Windows\System\FNHeWcH.exe
  2⤵
  PID:12868
- C:\Windows\System\GuoEBun.exe
  C:\Windows\System\GuoEBun.exe
  2⤵
  PID:12936
- C:\Windows\System\aRQHZqv.exe
  C:\Windows\System\aRQHZqv.exe
  2⤵
  PID:13112
- C:\Windows\System\PEZEsut.exe
  C:\Windows\System\PEZEsut.exe
  2⤵
  PID:13104
- C:\Windows\System\FKbVcdn.exe
  C:\Windows\System\FKbVcdn.exe
  2⤵
  PID:13176
- C:\Windows\System\zesZlox.exe
  C:\Windows\System\zesZlox.exe
  2⤵
  PID:13148
- C:\Windows\System\PjQppfR.exe
  C:\Windows\System\PjQppfR.exe
  2⤵
  PID:12364
- C:\Windows\System\HXrVokg.exe
  C:\Windows\System\HXrVokg.exe
  2⤵
  PID:13288
- C:\Windows\System\OrTpBjX.exe
  C:\Windows\System\OrTpBjX.exe
  2⤵
  PID:12608
- C:\Windows\System\YWaXzIh.exe
  C:\Windows\System\YWaXzIh.exe
  2⤵
  PID:12704
- C:\Windows\System\sNKpoGq.exe
  C:\Windows\System\sNKpoGq.exe
  2⤵
  PID:12900
- C:\Windows\System\XwLPuxE.exe
  C:\Windows\System\XwLPuxE.exe
  2⤵
  PID:11524
- C:\Windows\System\VQkdtfW.exe
  C:\Windows\System\VQkdtfW.exe
  2⤵
  PID:12844
- C:\Windows\System\JUedbvv.exe
  C:\Windows\System\JUedbvv.exe
  2⤵
  PID:12328
- C:\Windows\System\bhTXJfr.exe
  C:\Windows\System\bhTXJfr.exe
  2⤵
  PID:12768
- C:\Windows\System\GGaYoNb.exe
  C:\Windows\System\GGaYoNb.exe
  2⤵
  PID:12584
- C:\Windows\System\PjpuhRD.exe
  C:\Windows\System\PjpuhRD.exe
  2⤵
  PID:13248
- C:\Windows\System\WshZPAX.exe
  C:\Windows\System\WshZPAX.exe
  2⤵
  PID:13328
- C:\Windows\System\RwavqYY.exe
  C:\Windows\System\RwavqYY.exe
  2⤵
  PID:13356
- C:\Windows\System\EhTtDik.exe
  C:\Windows\System\EhTtDik.exe
  2⤵
  PID:13376
- C:\Windows\System\DBLRDLX.exe
  C:\Windows\System\DBLRDLX.exe
  2⤵
  PID:13404
- C:\Windows\System\rceNcwH.exe
  C:\Windows\System\rceNcwH.exe
  2⤵
  PID:13432
- C:\Windows\System\ERhIupU.exe
  C:\Windows\System\ERhIupU.exe
  2⤵
  PID:13464
- C:\Windows\System\HOhfomR.exe
  C:\Windows\System\HOhfomR.exe
  2⤵
  PID:13484
- C:\Windows\System\hAXwhnq.exe
  C:\Windows\System\hAXwhnq.exe
  2⤵
  PID:13508
- C:\Windows\System\fDqXPwD.exe
  C:\Windows\System\fDqXPwD.exe
  2⤵
  PID:13540
- C:\Windows\System\ByzWAZJ.exe
  C:\Windows\System\ByzWAZJ.exe
  2⤵
  PID:13564
- C:\Windows\System\CWsathG.exe
  C:\Windows\System\CWsathG.exe
  2⤵
  PID:13588
- C:\Windows\System\sgyjeHO.exe
  C:\Windows\System\sgyjeHO.exe
  2⤵
  PID:13624
- C:\Windows\System\vKTYiXG.exe
  C:\Windows\System\vKTYiXG.exe
  2⤵
  PID:13648
- C:\Windows\System\PZxmUli.exe
  C:\Windows\System\PZxmUli.exe
  2⤵
  PID:13676
- C:\Windows\System\wnILENP.exe
  C:\Windows\System\wnILENP.exe
  2⤵
  PID:13704
- C:\Windows\System\DzvQnza.exe
  C:\Windows\System\DzvQnza.exe
  2⤵
  PID:13732
- C:\Windows\System\SrXpMLo.exe
  C:\Windows\System\SrXpMLo.exe
  2⤵
  PID:13764
- C:\Windows\System\johrNIK.exe
  C:\Windows\System\johrNIK.exe
  2⤵
  PID:13800
- C:\Windows\System\mQDGQNN.exe
  C:\Windows\System\mQDGQNN.exe
  2⤵
  PID:13828
- C:\Windows\System\tyshmvh.exe
  C:\Windows\System\tyshmvh.exe
  2⤵
  PID:13856
- C:\Windows\System\TAELAKr.exe
  C:\Windows\System\TAELAKr.exe
  2⤵
  PID:13888
- C:\Windows\System\jnoMpiv.exe
  C:\Windows\System\jnoMpiv.exe
  2⤵
  PID:13924
- C:\Windows\System\TQXCIEl.exe
  C:\Windows\System\TQXCIEl.exe
  2⤵
  PID:13944
- C:\Windows\System\tZrqAGf.exe
  C:\Windows\System\tZrqAGf.exe
  2⤵
  PID:13960
- C:\Windows\System\vlJTyrB.exe
  C:\Windows\System\vlJTyrB.exe
  2⤵
  PID:13996
- C:\Windows\System\JjXDtGo.exe
  C:\Windows\System\JjXDtGo.exe
  2⤵
  PID:14024
- C:\Windows\System\oBABYKA.exe
  C:\Windows\System\oBABYKA.exe
  2⤵
  PID:14052
- C:\Windows\System\ZcxqRXz.exe
  C:\Windows\System\ZcxqRXz.exe
  2⤵
  PID:14076
- C:\Windows\System\plHHjmz.exe
  C:\Windows\System\plHHjmz.exe
  2⤵
  PID:14104
- C:\Windows\System\EKNdiQF.exe
  C:\Windows\System\EKNdiQF.exe
  2⤵
  PID:14136
- C:\Windows\System\ZoydQEU.exe
  C:\Windows\System\ZoydQEU.exe
  2⤵
  PID:14160
- C:\Windows\System\qbNHLnb.exe
  C:\Windows\System\qbNHLnb.exe
  2⤵
  PID:14180
- C:\Windows\System\JIYMnrJ.exe
  C:\Windows\System\JIYMnrJ.exe
  2⤵
  PID:14204
- C:\Windows\System\YdMegnj.exe
  C:\Windows\System\YdMegnj.exe
  2⤵
  PID:14232
- C:\Windows\System\bIbESzB.exe
  C:\Windows\System\bIbESzB.exe
  2⤵
  PID:14260
- C:\Windows\System\hxcgbsr.exe
  C:\Windows\System\hxcgbsr.exe
  2⤵
  PID:14284
- C:\Windows\System\KQmuPvi.exe
  C:\Windows\System\KQmuPvi.exe
  2⤵
  PID:14312
- C:\Windows\System\WngtHmP.exe
  C:\Windows\System\WngtHmP.exe
  2⤵
  PID:13168
- C:\Windows\System\HKfKvlp.exe
  C:\Windows\System\HKfKvlp.exe
  2⤵
  PID:13344
- C:\Windows\System\ycxhOMN.exe
  C:\Windows\System\ycxhOMN.exe
  2⤵
  PID:13032
- C:\Windows\System\pblYEsG.exe
  C:\Windows\System\pblYEsG.exe
  2⤵
  PID:13364
- C:\Windows\System\cFdWbVJ.exe
  C:\Windows\System\cFdWbVJ.exe
  2⤵
  PID:13456
- C:\Windows\System\mELpNlm.exe
  C:\Windows\System\mELpNlm.exe
  2⤵
  PID:13492
- C:\Windows\System\KhqEULc.exe
  C:\Windows\System\KhqEULc.exe
  2⤵
  PID:13664
- C:\Windows\System\pgCVAMq.exe
  C:\Windows\System\pgCVAMq.exe
  2⤵
  PID:13720
- C:\Windows\System\UNlbZeE.exe
  C:\Windows\System\UNlbZeE.exe
  2⤵
  PID:13776
- C:\Windows\System\QoLWGvN.exe
  C:\Windows\System\QoLWGvN.exe
  2⤵
  PID:13716
- C:\Windows\System\xRuUpmf.exe
  C:\Windows\System\xRuUpmf.exe
  2⤵
  PID:13756
- C:\Windows\System\sXuLbRF.exe
  C:\Windows\System\sXuLbRF.exe
  2⤵
  PID:13940
- C:\Windows\System\tcqKTxx.exe
  C:\Windows\System\tcqKTxx.exe
  2⤵
  PID:13932
- C:\Windows\System\rJdMlcW.exe
  C:\Windows\System\rJdMlcW.exe
  2⤵
  PID:14064
- C:\Windows\System\BNsOZjz.exe
  C:\Windows\System\BNsOZjz.exe
  2⤵
  PID:14116
- C:\Windows\System\WvbPkPU.exe
  C:\Windows\System\WvbPkPU.exe
  2⤵
  PID:14092
- C:\Windows\System\hBEpFmg.exe
  C:\Windows\System\hBEpFmg.exe
  2⤵
  PID:14228
- C:\Windows\System\TaxsPUB.exe
  C:\Windows\System\TaxsPUB.exe
  2⤵
  PID:14200
- C:\Windows\System\oShBWfl.exe
  C:\Windows\System\oShBWfl.exe
  2⤵
  PID:14272
- C:\Windows\System\srNWjlr.exe
  C:\Windows\System\srNWjlr.exe
  2⤵
  PID:13336
- C:\Windows\System\cwszQul.exe
  C:\Windows\System\cwszQul.exe
  2⤵
  PID:13956
- C:\Windows\System\CbshaRM.exe
  C:\Windows\System\CbshaRM.exe
  2⤵
  PID:13532
- C:\Windows\System\IuLuZXD.exe
  C:\Windows\System\IuLuZXD.exe
  2⤵
  PID:13660
- C:\Windows\System\KbpIxCI.exe
  C:\Windows\System\KbpIxCI.exe
  2⤵
  PID:14196
- C:\Windows\System\VeoJKMw.exe
  C:\Windows\System\VeoJKMw.exe
  2⤵
  PID:13880
- C:\Windows\System\musVTmK.exe
  C:\Windows\System\musVTmK.exe
  2⤵
  PID:13396
- C:\Windows\System\iFuBcxV.exe
  C:\Windows\System\iFuBcxV.exe
  2⤵
  PID:14368
- C:\Windows\System\mJoivJP.exe
  C:\Windows\System\mJoivJP.exe
  2⤵
  PID:14412
- C:\Windows\System\daFPibw.exe
  C:\Windows\System\daFPibw.exe
  2⤵
  PID:14436
- C:\Windows\System\UmeYoWI.exe
  C:\Windows\System\UmeYoWI.exe
  2⤵
  PID:14460
- C:\Windows\System\aGqDvZG.exe
  C:\Windows\System\aGqDvZG.exe
  2⤵
  PID:14488
- C:\Windows\System\XrKXkGq.exe
  C:\Windows\System\XrKXkGq.exe
  2⤵
  PID:14520
- C:\Windows\System\fihpUeE.exe
  C:\Windows\System\fihpUeE.exe
  2⤵
  PID:14548
- C:\Windows\System\eqxktiM.exe
  C:\Windows\System\eqxktiM.exe
  2⤵
  PID:14580
- C:\Windows\System\lxjxBsh.exe
  C:\Windows\System\lxjxBsh.exe
  2⤵
  PID:14608
- C:\Windows\System\Kxriaog.exe
  C:\Windows\System\Kxriaog.exe
  2⤵
  PID:14632
- C:\Windows\System\skrRjff.exe
  C:\Windows\System\skrRjff.exe
  2⤵
  PID:14652
- C:\Windows\System\EJPpASU.exe
  C:\Windows\System\EJPpASU.exe
  2⤵
  PID:14676
- C:\Windows\System\NHLgFWI.exe
  C:\Windows\System\NHLgFWI.exe
  2⤵
  PID:14692
- C:\Windows\System\OejrGvg.exe
  C:\Windows\System\OejrGvg.exe
  2⤵
  PID:14716
- C:\Windows\System\QDXIHuC.exe
  C:\Windows\System\QDXIHuC.exe
  2⤵
  PID:14744
- C:\Windows\System\lQmuZhO.exe
  C:\Windows\System\lQmuZhO.exe
  2⤵
  PID:14772
- C:\Windows\System\SHpLjrJ.exe
  C:\Windows\System\SHpLjrJ.exe
  2⤵
  PID:14808
- C:\Windows\System\uOAKccz.exe
  C:\Windows\System\uOAKccz.exe
  2⤵
  PID:14824
- C:\Windows\System\nSsGKCd.exe
  C:\Windows\System\nSsGKCd.exe
  2⤵
  PID:14844
- C:\Windows\System\wvPKcSn.exe
  C:\Windows\System\wvPKcSn.exe
  2⤵
  PID:14876
- C:\Windows\System\GfcBsgp.exe
  C:\Windows\System\GfcBsgp.exe
  2⤵
  PID:14900
- C:\Windows\System\diSmEfN.exe
  C:\Windows\System\diSmEfN.exe
  2⤵
  PID:14944
- C:\Windows\System\KOAGPku.exe
  C:\Windows\System\KOAGPku.exe
  2⤵
  PID:14964
- C:\Windows\System\zOaxehU.exe
  C:\Windows\System\zOaxehU.exe
  2⤵
  PID:14996
- C:\Windows\System\FuyKguK.exe
  C:\Windows\System\FuyKguK.exe
  2⤵
  PID:15028
- C:\Windows\System\mVxfSVO.exe
  C:\Windows\System\mVxfSVO.exe
  2⤵
  PID:15056
- C:\Windows\System\pPLHZcL.exe
  C:\Windows\System\pPLHZcL.exe
  2⤵
  PID:15076
- C:\Windows\System\vNLEtHj.exe
  C:\Windows\System\vNLEtHj.exe
  2⤵
  PID:15104
- C:\Windows\System\LWpHJoq.exe
  C:\Windows\System\LWpHJoq.exe
  2⤵
  PID:15132
- C:\Windows\System\AazdcJt.exe
  C:\Windows\System\AazdcJt.exe
  2⤵
  PID:15168
- C:\Windows\System\hyfEvCB.exe
  C:\Windows\System\hyfEvCB.exe
  2⤵
  PID:15196
- C:\Windows\System\CqzxgMa.exe
  C:\Windows\System\CqzxgMa.exe
  2⤵
  PID:15212
- C:\Windows\System\hWpcTQp.exe
  C:\Windows\System\hWpcTQp.exe
  2⤵
  PID:15236
- C:\Windows\System\xjCDVOK.exe
  C:\Windows\System\xjCDVOK.exe
  2⤵
  PID:15264
- C:\Windows\System\OiQSfSP.exe
  C:\Windows\System\OiQSfSP.exe
  2⤵
  PID:15300
- C:\Windows\System\oAnKSnL.exe
  C:\Windows\System\oAnKSnL.exe
  2⤵
  PID:15320
- C:\Windows\System\ubmYqJO.exe
  C:\Windows\System\ubmYqJO.exe
  2⤵
  PID:15344
- C:\Windows\System\xDPFIfk.exe
  C:\Windows\System\xDPFIfk.exe
  2⤵
  PID:13952
- C:\Windows\System\mekAjag.exe
  C:\Windows\System\mekAjag.exe
  2⤵
  PID:13004
- C:\Windows\System\BpEIdSD.exe
  C:\Windows\System\BpEIdSD.exe
  2⤵
  PID:14084
- C:\Windows\System\QLxUIwC.exe
  C:\Windows\System\QLxUIwC.exe
  2⤵
  PID:13228
- C:\Windows\System\OlrjflF.exe
  C:\Windows\System\OlrjflF.exe
  2⤵
  PID:13424
- C:\Windows\System\XEjHrdy.exe
  C:\Windows\System\XEjHrdy.exe
  2⤵
  PID:15068
- C:\Windows\System\sQEaiMs.exe
  C:\Windows\System\sQEaiMs.exe
  2⤵
  PID:14816
- C:\Windows\System\CEIVLoB.exe
  C:\Windows\System\CEIVLoB.exe
  2⤵
  PID:15140
- C:\Windows\System\BUXHvoh.exe
  C:\Windows\System\BUXHvoh.exe
  2⤵
  PID:15204
- C:\Windows\System\wawRZvv.exe
  C:\Windows\System\wawRZvv.exe
  2⤵
  PID:15308
- C:\Windows\System\jygfgZU.exe
  C:\Windows\System\jygfgZU.exe
  2⤵
  PID:15092
- C:\Windows\System\EhWVuXC.exe
  C:\Windows\System\EhWVuXC.exe
  2⤵
  PID:14268
- C:\Windows\System\MofKNYJ.exe
  C:\Windows\System\MofKNYJ.exe
  2⤵
  PID:15208
- C:\Windows\System\fdStmnF.exe
  C:\Windows\System\fdStmnF.exe
  2⤵
  PID:15276
- C:\Windows\System\mDOPwtl.exe
  C:\Windows\System\mDOPwtl.exe
  2⤵
  PID:15356
- C:\Windows\System\bzLsliP.exe
  C:\Windows\System\bzLsliP.exe
  2⤵
  PID:13476
- C:\Windows\System\EtfUlxd.exe
  C:\Windows\System\EtfUlxd.exe
  2⤵
  PID:14480
- C:\Windows\System\AKnENTg.exe
  C:\Windows\System\AKnENTg.exe
  2⤵
  PID:14668
- C:\Windows\System\RAejNGT.exe
  C:\Windows\System\RAejNGT.exe
  2⤵
  PID:12792
- C:\Windows\System\ZRsntqV.exe
  C:\Windows\System\ZRsntqV.exe
  2⤵
  PID:928
- C:\Windows\System\hXCCqQa.exe
  C:\Windows\System\hXCCqQa.exe
  2⤵
  PID:14852
- C:\Windows\System\UILzdmX.exe
  C:\Windows\System\UILzdmX.exe
  2⤵
  PID:14960
- C:\Windows\System\xDZWsYT.exe
  C:\Windows\System\xDZWsYT.exe
  2⤵
  PID:15120
- C:\Windows\System\tLZtIFI.exe
  C:\Windows\System\tLZtIFI.exe
  2⤵
  PID:15256
- C:\Windows\System\eatFwkD.exe
  C:\Windows\System\eatFwkD.exe
  2⤵
  PID:14356
- C:\Windows\System\tpKBmCn.exe
  C:\Windows\System\tpKBmCn.exe
  2⤵
  PID:14892
- C:\Windows\System\wmjbxFR.exe
  C:\Windows\System\wmjbxFR.exe
  2⤵
  PID:14764
- C:\Windows\System\pBQjkQj.exe
  C:\Windows\System\pBQjkQj.exe
  2⤵
  PID:5116
- C:\Windows\System\HFJjKnz.exe
  C:\Windows\System\HFJjKnz.exe
  2⤵
  PID:15380
- C:\Windows\System\xZeeUSC.exe
  C:\Windows\System\xZeeUSC.exe
  2⤵
  PID:15412
- C:\Windows\System\kwaRHKr.exe
  C:\Windows\System\kwaRHKr.exe
  2⤵
  PID:15436
- C:\Windows\System\fOsdfhR.exe
  C:\Windows\System\fOsdfhR.exe
  2⤵
  PID:15460
- C:\Windows\System\eKaLbYY.exe
  C:\Windows\System\eKaLbYY.exe
  2⤵
  PID:15488
- C:\Windows\System\ofBXJJl.exe
  C:\Windows\System\ofBXJJl.exe
  2⤵
  PID:15512
- C:\Windows\System\ipLWybT.exe
  C:\Windows\System\ipLWybT.exe
  2⤵
  PID:15528
- C:\Windows\System\IuTQawv.exe
  C:\Windows\System\IuTQawv.exe
  2⤵
  PID:15552
- C:\Windows\System\tuSwMml.exe
  C:\Windows\System\tuSwMml.exe
  2⤵
  PID:15572
- C:\Windows\System\vbfDfts.exe
  C:\Windows\System\vbfDfts.exe
  2⤵
  PID:15588
- C:\Windows\System\GoHLCet.exe
  C:\Windows\System\GoHLCet.exe
  2⤵
  PID:15604
- C:\Windows\System\tJuVLjA.exe
  C:\Windows\System\tJuVLjA.exe
  2⤵
  PID:15632
- C:\Windows\System\QsUVEKF.exe
  C:\Windows\System\QsUVEKF.exe
  2⤵
  PID:15660
- C:\Windows\System\fLfuPQu.exe
  C:\Windows\System\fLfuPQu.exe
  2⤵
  PID:15676
- C:\Windows\System\IPaqleO.exe
  C:\Windows\System\IPaqleO.exe
  2⤵
  PID:15704
- C:\Windows\System\isTMRVz.exe
  C:\Windows\System\isTMRVz.exe
  2⤵
  PID:15728
- C:\Windows\System\eAQnbKj.exe
  C:\Windows\System\eAQnbKj.exe
  2⤵
  PID:15756
- C:\Windows\System\UBbzQvz.exe
  C:\Windows\System\UBbzQvz.exe
  2⤵
  PID:15784
- C:\Windows\System\ZoUEhvU.exe
  C:\Windows\System\ZoUEhvU.exe
  2⤵
  PID:15820
- C:\Windows\System\MmuNOFR.exe
  C:\Windows\System\MmuNOFR.exe
  2⤵
  PID:15840
- C:\Windows\System\jJwMKuV.exe
  C:\Windows\System\jJwMKuV.exe
  2⤵
  PID:15864
- C:\Windows\System\mNWbEPf.exe
  C:\Windows\System\mNWbEPf.exe
  2⤵
  PID:15896
- C:\Windows\System\sgAQITo.exe
  C:\Windows\System\sgAQITo.exe
  2⤵
  PID:15924
- C:\Windows\System\wkJruQn.exe
  C:\Windows\System\wkJruQn.exe
  2⤵
  PID:15944
- C:\Windows\System\OBwLdND.exe
  C:\Windows\System\OBwLdND.exe
  2⤵
  PID:15968
- C:\Windows\System\VDwEXhg.exe
  C:\Windows\System\VDwEXhg.exe
  2⤵
  PID:16192
- C:\Windows\System\uafNQvN.exe
  C:\Windows\System\uafNQvN.exe
  2⤵
  PID:16216
- C:\Windows\System\brsSESp.exe
  C:\Windows\System\brsSESp.exe
  2⤵
  PID:16244
- C:\Windows\System\WMjBCHB.exe
  C:\Windows\System\WMjBCHB.exe
  2⤵
  PID:16268
- C:\Windows\System\sRDzrJS.exe
  C:\Windows\System\sRDzrJS.exe
  2⤵
  PID:16300
- C:\Windows\System\oHukIZJ.exe
  C:\Windows\System\oHukIZJ.exe
  2⤵
  PID:16316
- C:\Windows\System\XLVbIsq.exe
  C:\Windows\System\XLVbIsq.exe
  2⤵
  PID:16340
- C:\Windows\System\wpyuWzH.exe
  C:\Windows\System\wpyuWzH.exe
  2⤵
  PID:16364
- C:\Windows\System\YrFgckz.exe
  C:\Windows\System\YrFgckz.exe
  2⤵
  PID:14224
- C:\Windows\System\WULKcrn.exe
  C:\Windows\System\WULKcrn.exe
  2⤵
  PID:15372
- C:\Windows\System\slswTDW.exe
  C:\Windows\System\slswTDW.exe
  2⤵
  PID:15396
- C:\Windows\System\MryaUyB.exe
  C:\Windows\System\MryaUyB.exe
  2⤵
  PID:15496
- C:\Windows\System\wtjoqvV.exe
  C:\Windows\System\wtjoqvV.exe
  2⤵
  PID:15672
- C:\Windows\System\JETWmfZ.exe
  C:\Windows\System\JETWmfZ.exe
  2⤵
  PID:15600
- C:\Windows\System\VPdiIEh.exe
  C:\Windows\System\VPdiIEh.exe
  2⤵
  PID:15652
- C:\Windows\System\UdEiZgk.exe
  C:\Windows\System\UdEiZgk.exe
  2⤵
  PID:15624
- C:\Windows\System\GTGKkMa.exe
  C:\Windows\System\GTGKkMa.exe
  2⤵
  PID:15880
- C:\Windows\System\mEylwKk.exe
  C:\Windows\System\mEylwKk.exe
  2⤵
  PID:15804
- C:\Windows\System\oJBmVdP.exe
  C:\Windows\System\oJBmVdP.exe
  2⤵
  PID:15848
- C:\Windows\System\psUkwao.exe
  C:\Windows\System\psUkwao.exe
  2⤵
  PID:15996
- C:\Windows\System\tqqbkVl.exe
  C:\Windows\System\tqqbkVl.exe
  2⤵
  PID:16012
- C:\Windows\System\KvUhmoJ.exe
  C:\Windows\System\KvUhmoJ.exe
  2⤵
  PID:16044
- C:\Windows\System\InebYXf.exe
  C:\Windows\System\InebYXf.exe
  2⤵
  PID:16068
- C:\Windows\System\ZcypitZ.exe
  C:\Windows\System\ZcypitZ.exe
  2⤵
  PID:16088
- C:\Windows\System\RTZNDMo.exe
  C:\Windows\System\RTZNDMo.exe
  2⤵
  PID:16108
- C:\Windows\System\hCDkMRD.exe
  C:\Windows\System\hCDkMRD.exe
  2⤵
  PID:16136
- C:\Windows\System\SUBugKo.exe
  C:\Windows\System\SUBugKo.exe
  2⤵
  PID:16260
- C:\Windows\System\KRMLAKR.exe
  C:\Windows\System\KRMLAKR.exe
  2⤵
  PID:15908
- C:\Windows\System\tSMjQpB.exe
  C:\Windows\System\tSMjQpB.exe
  2⤵
  PID:16140
- C:\Windows\System\phFNfdd.exe
  C:\Windows\System\phFNfdd.exe
  2⤵
  PID:16288
- C:\Windows\System\SSwEOQE.exe
  C:\Windows\System\SSwEOQE.exe
  2⤵
  PID:15484
- C:\Windows\System\AbLSpwh.exe
  C:\Windows\System\AbLSpwh.exe
  2⤵
  PID:15540
- C:\Windows\System\QsaBElP.exe
  C:\Windows\System\QsaBElP.exe
  2⤵
  PID:15584
- C:\Windows\System\fRPkYZM.exe
  C:\Windows\System\fRPkYZM.exe
  2⤵
  PID:16020
- C:\Windows\System\LEqTDve.exe
  C:\Windows\System\LEqTDve.exe
  2⤵
  PID:15936
- C:\Windows\System\GPpgFuF.exe
  C:\Windows\System\GPpgFuF.exe
  2⤵
  PID:16336
- C:\Windows\System\rAIUeGq.exe
  C:\Windows\System\rAIUeGq.exe
  2⤵
  PID:16292
- C:\Windows\System\XhllKJk.exe
  C:\Windows\System\XhllKJk.exe
  2⤵
  PID:16236
- C:\Windows\System\XSbHuWH.exe
  C:\Windows\System\XSbHuWH.exe
  2⤵
  PID:16404
- C:\Windows\System\WZVUtqg.exe
  C:\Windows\System\WZVUtqg.exe
  2⤵
  PID:16424
- C:\Windows\System\JdzLnfC.exe
  C:\Windows\System\JdzLnfC.exe
  2⤵
  PID:16456
- C:\Windows\System\HoGZsNZ.exe
  C:\Windows\System\HoGZsNZ.exe
  2⤵
  PID:16484
- C:\Windows\System\OFRCTxZ.exe
  C:\Windows\System\OFRCTxZ.exe
  2⤵
  PID:16520
- C:\Windows\System\kzjZbkg.exe
  C:\Windows\System\kzjZbkg.exe
  2⤵
  PID:16540
- C:\Windows\System\PbnoqJP.exe
  C:\Windows\System\PbnoqJP.exe
  2⤵
  PID:16568
- C:\Windows\System\cXoQnhn.exe
  C:\Windows\System\cXoQnhn.exe
  2⤵
  PID:16584
- C:\Windows\System\SyWpbxX.exe
  C:\Windows\System\SyWpbxX.exe
  2⤵
  PID:16940
- C:\Windows\System\cIiQTDL.exe
  C:\Windows\System\cIiQTDL.exe
  2⤵
  PID:16956

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:16144

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\BEcXRFX.exe

Filesize
1.7MB

MD5
1ff720a47f49a5f89850463d4cdc96b8

SHA1
3f8d2258b1ae19e3c43bfedc63f7317f51b57711

SHA256
4ceee2c81685b2abd8c130a859b4ed79513c550b31059be5dcd4051ffec386c0

SHA512
34be27fb69fc3a29997ad373f17d267cb674d7ad0aeb577fa85dac676458d5a33bfcdcd38e371299d832a290d6e83e4d5a6446c7fcdc483809b1d41ceeb1bb8f

Download Submit
C:\Windows\System\EQeMsFO.exe

Filesize
1.7MB

MD5
02916668c911b5c1b9b497f7fa83f2bb

SHA1
ee7a8f526a088a52ae0d0850ebb5b791e7ec66df

SHA256
1019349cc3afbb930baa02a839e5e40f1ab5801964887c4814ae694062f013c5

SHA512
d179800d529196482bdf3c9726f9258089262211c896d3d45dbe902ccb4654ea5ae0de9597d28093a6a7f2153a0fb850c97be21cef4c0633a8434c7d2db57150

Download Submit
C:\Windows\System\FCxUafm.exe

Filesize
1.7MB

MD5
b173cf6f05b9ba0f71f32e339e550488

SHA1
de482b050457caac643776ba15efbe212c246b51

SHA256
18da4cae894095c3068c7d65d22c52c9be767159a180c3a25e0100e3993851dc

SHA512
440f9556eb1e183c6f814d2e1b396229a6dc0ecef44f183487f0aea34eeae90d3d56d09670b1f9c85068fd9bc10babcf12db96ecfa29c5071e9a109b08482ab7

Download Submit
C:\Windows\System\GAAEpaQ.exe

Filesize
1.7MB

MD5
dd6374218b6012c9a92af1f9537ff6a2

SHA1
e4e25d4389f15ca80878fa5891edb825113e20f0

SHA256
a99d032fa52f0c46a280f7ad1d96545f63726e5987b413020fef59762cf94e60

SHA512
dceeeb65bbeee7385b170a28872ef2f92137220605e7db3262086b604b17f4e5a2aa432685707da685a9e725f417658730923b60c6980ce63810b8926bbfeb77

Download Submit
C:\Windows\System\MJNdvPB.exe

Filesize
1.7MB

MD5
5afb0a989b524906bd4f94a509579d8c

SHA1
a656bae0fefd7a96dffae3ad09e9b71522dce1b6

SHA256
0e33228e3c16a25f11f7218717d5549f5b0cb3e4d7d4df617b8f8d3e98aef908

SHA512
0753d05b3837959aa3c0c1d08b38e7f8cb2ccac2dd02a7706ee6fe856eb17078032eda01c4313b8647fb4062e44abb44636aec71828b844eaefca428b8bd0dc6

Download Submit
C:\Windows\System\MRSQIjD.exe

Filesize
1.7MB

MD5
cd5a6030bfb4ecb3971bd3dbba43fd2d

SHA1
b7c0407f76b1fc7e19b501ad563ff0df7e81ed1f

SHA256
74cae9592dfe321067cda2b00f0eee93d3317bc97273be78fa79723e47a8dcea

SHA512
e5c4021fc70cadbf182d08ea7e3819420e97050d52437ab21160e5d23d11d7e46f4f57524bc43b0d89d317a544254b7a4521607c19b4909a5289448b0f600531

Download Submit
C:\Windows\System\MqfYxhw.exe

Filesize
1.7MB

MD5
20b27d24c5f60ec947bb53d98c6d1744

SHA1
33ca6bf2bbdf0d4a26d67d0672872dabda45c17c

SHA256
5dbdcca790a9d6363394f82622bbb4c13599552bf8386589dd41eb44c24e2466

SHA512
376b577b93c7be6f58418fd98d7cacb10fadb333c747c1e8ba69bbdec492e03b7169082600cbbea351ac3356fe31d944c985a7011930869139ebf18b4b9d44f0

Download Submit
C:\Windows\System\RePOUMC.exe

Filesize
1.7MB

MD5
2ee5d018992bb99430b82ecae5b14cb1

SHA1
79c2a58ddf22caa46c51ac1e86cd4087b933e490

SHA256
ecfd4572b93ad39042398f098ee42a9d355c9a247b9f5b112acd5048846e0bd9

SHA512
7c7bd77db1304877499b3f9cefe16f741fe93b2e904f44eec350b019296e38339fc6dd4e3375bc9eed4a75d8f63b1f4196ba939568fc875596ee9f401aeafe6b

Download Submit
C:\Windows\System\TeWypWW.exe

Filesize
1.7MB

MD5
a2b1c19a6ded494c9eae2a5da98cf1c4

SHA1
93cd6c36a473098fef75e36645f6fe0c4e3caa5d

SHA256
6bfb95d4e68802975ab1b1662556603bb1fcb18c04a208eae47a9f37251c77b3

SHA512
3d37635165b0463222d56cecdee870e1256ea5fbeaf8e13524b850c93f508610d33ace979b0540df2416f84084ba6c2d3790216e4eab44b9576595906c2b6282

Download Submit
C:\Windows\System\UltTeYo.exe

Filesize
1.7MB

MD5
9c0456bbf30663e6f566a0a7dae08087

SHA1
9c7b0b8b1ae5e18a795595a8212b52ebce941b00

SHA256
3a0822b054a11944e6b33deccb7a385a845ee18431cb98affe1e5efea0ad54fb

SHA512
3bb0071e78cefea8043aa02ba4c137daf76000a982978d01ca407790aa5a74918f2dcb57712a2c858b8834b66a9df82b5f492a997d35e44c06dfbe37551b19fd

Download Submit
C:\Windows\System\VXouKgE.exe

Filesize
1.7MB

MD5
4824040b74c3418df79941fa10c97a9c

SHA1
861b79a3a1114fe96736584943c83bfa5c4c159b

SHA256
bb1d554e6b610f061abf6a26af1f75731558009c95233aa32991f365f967babc

SHA512
1fa0a2af695cbc35788e4bb0b01f058e99d4eb3873f39264bab7191a6c49e63bb501c7ab344886a91ed5c4ee8b85bf1e6117e37aaaf8632ecfa8c410a75fd74a

Download Submit
C:\Windows\System\WVfTClf.exe

Filesize
1.7MB

MD5
5227c593fb660d74094b410bd8784fc1

SHA1
5f78b9487da7ce03d6fbbe4dd8c4803368055b17

SHA256
83f9b3386748a4c31446d295e927b3bce1943ab9fda7efe6f8d3163d70af62f0

SHA512
bb9d8e481e4c4a1c2f0913aabbd503f034695c9faa1661d80b5f65883b82a96fbbbb0c161f50ba5453329e403073c29bbe5d13426ef0228d4609699000c9e3d0

Download Submit
C:\Windows\System\WoLxejU.exe

Filesize
1.7MB

MD5
c9dbd556724b63bdc6d9d37e7c4f7855

SHA1
b3267cc50c9271df40bb7aa9afdc0c77a60b3514

SHA256
8b999d36afd3b0938340015aa8628a4c7d4ecc686a67d12aeb2ac59c966e52a2

SHA512
9878836cd2b76a645b6fdb7c376754f5b8b5825ae95afe51116b39e05925fb4f6171838addf695b4067803c6af729c1fb898ed8da406cfe27ebc6a9cad070efa

Download Submit
C:\Windows\System\WxLCDVn.exe

Filesize
1.7MB

MD5
0b457d5bf94610ef3ca85bfd9d4d9dc7

SHA1
8a0543f47efa1a96a67a49c557db1e9f7310a5c7

SHA256
aa4240fca78fb2590c8e129eea3b47777b3ed225f86290b9e22b77a4bef95c6c

SHA512
b483c5a872c3c0a1c9f4a064d29bb6216db5b0f54a08cee00302bca632169b65ae204519b9f54e0a1c9cce5e39d8134057dd27ad7074ebdb157176edbae5d3f7

Download Submit
C:\Windows\System\YBDHiAR.exe

Filesize
1.7MB

MD5
cb032f10152b115a9432b6fe2f38f829

SHA1
cbc6a5cbb5100c4958a47f075ac4c6dacf7a9f7d

SHA256
a430bfe6eda38d87ccb29312a3436a0253163adf6053aafd473dbe96204919d8

SHA512
ebd5089274fd7705af31df34f9ff250d4a6da4d59fbb78b34836e18757ca2f446936598ed5c42db7528dabccaf1c8407ee2dacb7314098a95b76d5326c454344

Download Submit
C:\Windows\System\aLrVKCs.exe

Filesize
1.7MB

MD5
ad05fc9900865d5f1d1ccb0ddec88445

SHA1
c4c34f45a053b502c7b9b50b24ec35e03fa00b3d

SHA256
8fc4dc33fed2a15a260268e0f79a1cc33ca63e330fac1e56e54e15f674a6c0ca

SHA512
a29913910ea9cc8749d55b6369339a16879053af6951140572a357d48785114c472b2df51c2be49819cfa09eee30d59f927f0c6064f1da54067c60086f8fd95d

Download Submit
C:\Windows\System\bGmJNIt.exe

Filesize
1.7MB

MD5
496cace2a1cc815f58bc4161ed68d3a1

SHA1
9584fdd0d3076dc1bae5319309542b6e1a3b8a83

SHA256
d61f907ab3d3e50c6734272b6a64255a31807c4553712e1c33a2ee2b9b76a1c9

SHA512
5db88154e075652ae73146575ccf3240d2653cb090713f5d3adaf8477d1ee629d67b1c12893d64fdb047526cbce34431271aa7b711bab812fb32b7bd8567f7f1

Download Submit
C:\Windows\System\eFDbico.exe

Filesize
1.7MB

MD5
17c8e0ec7a9a49e9322b652b2ccede16

SHA1
6e3a62853ad94d772c68fbfe7adcd26a56371bcf

SHA256
85f0efe9a04bff434d0b2c49c9ec5dd5044f3f9148559209cf9714cf19b8d067

SHA512
b77aeb38490f0d1499be76804447718556eb7d02972bed90f312748693d6cdedb99cb21d2727792ec9b32862e23c005ac4e0dc0b4e7d79868b7aa61cc58a1ce8

Download Submit
C:\Windows\System\fDUUhQa.exe

Filesize
1.7MB

MD5
49573e35c16cb0563a11b20523db5568

SHA1
6d216fa0454bbaed1dba17538fbb187def0cbcc4

SHA256
14fe177516f0fe36b722da78dc12fb6988f47b7cc4ec52c0dda2a926c8169d5f

SHA512
bb7b4efcd6bf76faba89946a1b55860abbc3e0230c778b431edea52dfb0abe83a0d7aa33fc5b09ac6d47d592ce30423a6e51f065f44c314ddb402c781db7caba

Download Submit
C:\Windows\System\fjmbedY.exe

Filesize
1.7MB

MD5
0eb5ec1627b6d77fff39123d6e386079

SHA1
5304175d56a425fc24f84eefc9ecff5d68e94bf8

SHA256
d420ce24fe7a7b2452ef61a97e1d9c9fe52f9a18d254672d9fd1820e8ac34f13

SHA512
29fb8f4d17503b307963c6992837cb261c896179ef1f367845e0e124424e08759a3d7d4fcc8dbf4573a01668718c8abbdd3a3189475a8550e01fa5ee2d448c99

Download Submit
C:\Windows\System\hTmmSPE.exe

Filesize
1.7MB

MD5
a53ff0693a3318cb1670372a0c08aaf6

SHA1
7eca77431e6149205e9d410cc57783ca85c4bcf8

SHA256
7333fda18ac14854c0d0e8c6735e57ec93b9ff5290c03f27150fe7a6ab510941

SHA512
9aa24bd0d8a6eebe0bcdb031086a46efbec0a6accc8bda90b30c7501961939e73d6996b7c0c06dcd9c1ba01339cfb52b400e5fb05597ba6ca788050dc887be32

Download Submit
C:\Windows\System\jWEFPdg.exe

Filesize
1.7MB

MD5
af6f729fa934cbfc0de7e9d9ed1186b2

SHA1
7df6c772a6cef92871a28d8750506c046376d430

SHA256
10bf09cbbc9f1e5d9eccdaa0db792a95896cfb8856b3c3941ecc7e854727fbdb

SHA512
5273ad82088d9c7f034e4f1f57fc7d4e64be752b970ba27030304ee0113c1989aeb05247674ce09ea55c310a1d0fe51001993b6f570ed93c44fd9fbcf4957fde

Download Submit
C:\Windows\System\jqkCKDL.exe

Filesize
1.7MB

MD5
35edfa89aa5f700c6a0607d4daa6a95d

SHA1
34b1f21cfcc9a34f7ccbd218ed6f1db6e69da8c7

SHA256
7e3f98c7fb7bf6ca9a9e436fe7c67ca3864531d3e70a9c7cba3ef68fad96eb9e

SHA512
08558fc79fac0cf251c25ab30ad62b8a9d952ade41882b0f49064c8845ceac73a24af52c6d6df3799b79c8febfa0ee4a63473f0cf657ca150412b25d762cc241

Download Submit
C:\Windows\System\jqyOQSC.exe

Filesize
1.7MB

MD5
510f191205bf1ccf2cfb87a87e1fabdc

SHA1
bc01c73a9bbd16a6a7cab1f124d6363767f919fe

SHA256
8affc61ffbfc9ced74e1a257594c32d8d3f02bc5ce5e22f50147b47b9cb3be52

SHA512
4dd9df27116bf2f2b70177af639269c6b031a8d04a0f56ab049c2ee3a4945fef636258b1d30cb216cd26908acb88819ac6e7187945ea1245b6f6c38ca69cf4ca

Download Submit
C:\Windows\System\kENnVkI.exe

Filesize
1.7MB

MD5
410bc66a92049e66d73711a25e009bbb

SHA1
071b2d6470fd3ed81be73aa8e720d8dc5ac38ee4

SHA256
ea4727c6ae7ca714c2484b3df6dfd0b3e7a40ab1cc79924d346bbbef2c85cd7d

SHA512
5b6d497f5572c7e15e1f52fb9f5ac324eeb3a7b1198b48017672a2339a81c145d5ab2a12b407938e500d28abd82337cedb3367aa7ef5e56b9eb9db9cd8b8992f

Download Submit
C:\Windows\System\lZCdBCK.exe

Filesize
1.7MB

MD5
a30a6ca677add96875ef2ca0db767bc2

SHA1
45382d9794863ab6490a27afd293e021475cf7d2

SHA256
0e8ae75bcae821c9a6e682b939a28ac09fc4c8501d12598607e2aa2de74f7506

SHA512
9dfd43ded653ab23920e095e4c5004ab06b2d21254f9819755b9664ca2f92278413f516d088d83a2741061dc811aa4f1848b3e4615b5bfc7ce24ac3204433305

Download Submit
C:\Windows\System\mKBvjga.exe

Filesize
1.7MB

MD5
8a84226810c63a5f77aaf6737cb3907f

SHA1
3ba17bfaaa2a6f101ced298fd69cd62b6138c3ea

SHA256
18a7c7e6e15e682675394950eca639483204e6da21255e3e83673428907e3ee6

SHA512
cced5066bca5e012e50ed5af64a8aad747f05b04c2886b448c1f3ee10b9d6611f5b125d24e83c462b6a79c2c90f26505023f32b6c9e6bd735734175e242b68db

Download Submit
C:\Windows\System\mgREjGV.exe

Filesize
1.7MB

MD5
081caa34e37ea0d75cd8bee72ea1a55e

SHA1
2717f9ab9bb28ca5fb578669ea1fd534c7f695ba

SHA256
1dd75c0fa11a386316db7b816957dcd575757876750bc93c73f48bd9fdcddda2

SHA512
ad26bdf7e0cf1fcdc2a8d8b9310cd40bafa0c82ec9080a5eca1aae7d18d3b41fcaf37f55ff2ca1b0312e2e5bc4844df57b43e937ce9d91142220a334532371a0

Download Submit
C:\Windows\System\niiEdzG.exe

Filesize
1.7MB

MD5
d48d8134d884a027ce4c212c6a4e7c50

SHA1
be8ff5c28c180766ede31e3e8e960fa2a8e6db70

SHA256
1b93750771c0928002eb9b9ae3297a8fafd9690f955f793b8d42657829ae48bc

SHA512
07944ec0c6c6ec3c7ce423990ac0145570238be90b55d3289643074b9cdc663c6922573a0c378d217b5ffa6d39ea20fc1b00eaa2146520c8ac19b891b8676d48

Download Submit
C:\Windows\System\sxOIrGx.exe

Filesize
1.7MB

MD5
b6d0a09e0365068b03aed5da3e0c01b6

SHA1
b77bc00c73549aeca0a4ba9f14ed886ddf32bcf0

SHA256
7e0796630b77b8ed3ded04433c1f89a720f8d8be02e930a0a2a5dab6c9c59312

SHA512
cd03e7fb8f47706cee29f0298497bdca615ee0e6ec756a0a2ecfd4f77048822211af61a3ae56eccb1de470b3c70a04921db8efcdf3736d89da7ba9d9590e44b0

Download Submit
C:\Windows\System\tcLjtao.exe

Filesize
1.7MB

MD5
0a8afe2f7ae701394fa657daebcd0874

SHA1
e5c381ea180d9a48610d2f808c6457bbbcac8898

SHA256
5847c4359178b8abf1b824765d865e20ef30daeed2baac732bb57042464834a6

SHA512
9b9eb60b1764f8be93e6088ee94c5c3234f57526c1199a5a765f8239bfb4e2a4ef8af154dd23683dbdc475cbe8fe44dba042a99be5c6d49c7fb31c3cd6f0c433

Download Submit
C:\Windows\System\ubXOKuJ.exe

Filesize
1.7MB

MD5
547cb962b06d5c1c7a40253047a99ef4

SHA1
902d33b46dc2b1495548ea221a07fea28f0caa71

SHA256
c6a4a18e8911374fd480d363c1010700dd677e40bced8c5b870ef71d37f053f3

SHA512
f59f3f8300decbbc9971a6c9495c7609f711a5d84f808e1669f1f569fd5e78de1edfe9b5a47aa2d71d938c736ccfd6c398addacb3cda589fb5141104cb1d5856

Download Submit
C:\Windows\System\upVKaBQ.exe

Filesize
1.7MB

MD5
08dc78ebe94c0e5e4160ebdadd053e09

SHA1
0270f7a792836717da2598fd445d2e61c1546a4c

SHA256
a72d15ab156cf27c23bf0e55c930a052e4761d1b3c7a47afd4e4e104ba303b49

SHA512
ce68acd7341c9883563e4e77218a7d73c17d4ae72cc6b0bba4e2aeb5f5992136a1313735957cfef2e859fcdfb081ee35d86423e8bd6921e498d9697207a80ae9

Download Submit
C:\Windows\System\zAWvSXM.exe

Filesize
1.7MB

MD5
59317d2ef01faad2c870dfb47ed1d71e

SHA1
ab2893e485c68e6e6357a509f6afc0151bc303b9

SHA256
0cca5503e5c0af9279fb99ddaf3dff56ab06ec84671210b884fc5529595d1bca

SHA512
e162db43207a71d534663435bb109d54b1a11be02a19626359507c019124a094bfc14b64c2ca044a31e75131228cf207535caf15c09e3fd420c3412a614b6059

Download Submit
C:\Windows\System\zxPHWLZ.exe

Filesize
1.7MB

MD5
609694b621dd5a13609a1d9c6fb42a0b

SHA1
c456f1c688ebaf9a314ef5712a4640a8bcefe140

SHA256
cafaae99b6920e0dd5b18d165316920c86bd5d773906fbebcfea19a6b9c6ae11

SHA512
4d01400c612faae6125759a28bf6bb93d9f001d569c8a2fa817dc1f8a5737300e1908cfc78d42fc92fb9e8acbd0d914a1c00379e6be210475e5e5df9090c1f42

Download Submit
memory/4068-0-0x0000028B76120000-0x0000028B76130000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads