xmrig | 74ab1987fb6ee84dda24fbfef5974aaab8cf84eb567966960f245a4ac5fa19bd

Analysis

max time kernel
133s
max time network
132s
platform
windows10-2004_x64
resource
win10v2004-20250129-en
resource tags

arch:x64arch:x86image:win10v2004-20250129-enlocale:en-usos:windows10-2004-x64system
submitted
03/02/2025, 00:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

74ab1987fb6ee84dda24fbfef5974aaab8cf84eb567966960f245a4ac5fa19bd.exe
Size

1.6MB
MD5

5dfa8698bae9f8f169c0bd79336a6a90
SHA1

1af95c1aa81826818fec32f5732b455ae3b8d04a
SHA256

74ab1987fb6ee84dda24fbfef5974aaab8cf84eb567966960f245a4ac5fa19bd
SHA512

0fa17361a006c88cf0962ef1637a100b78cb2f9b25dc4f707e4bfe54dea62697d298889a33ee91b56d1002fba4eb7ec2626426b4e20e10ef1c37a90ee49088d6
SSDEEP

49152:GezaTF8FcNkNdfE0pZ9ozttwIRxj4c5yOBZnQmnVwYh:GemTLkNdfE0pZyL

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 32 IoCs

miner

resource	yara_rule
behavioral2/files/0x000c000000023b4d-4.dat	xmrig
behavioral2/files/0x0008000000023c42-9.dat	xmrig
behavioral2/files/0x0007000000023c49-28.dat	xmrig
behavioral2/files/0x0007000000023c4b-31.dat	xmrig
behavioral2/files/0x0007000000023c4c-45.dat	xmrig
behavioral2/files/0x0007000000023c4d-50.dat	xmrig
behavioral2/files/0x0007000000023c4a-39.dat	xmrig
behavioral2/files/0x0007000000023c46-38.dat	xmrig
behavioral2/files/0x0007000000023c48-24.dat	xmrig
behavioral2/files/0x0007000000023c47-32.dat	xmrig
behavioral2/files/0x0007000000023c4e-54.dat	xmrig
behavioral2/files/0x0008000000023c43-58.dat	xmrig
behavioral2/files/0x0007000000023c4f-63.dat	xmrig
behavioral2/files/0x0007000000023c51-72.dat	xmrig
behavioral2/files/0x0007000000023c50-69.dat	xmrig
behavioral2/files/0x0007000000023c54-89.dat	xmrig
behavioral2/files/0x0007000000023c53-92.dat	xmrig
behavioral2/files/0x0007000000023c59-126.dat	xmrig
behavioral2/files/0x0007000000023c5c-124.dat	xmrig
behavioral2/files/0x0007000000023c60-141.dat	xmrig
behavioral2/files/0x0007000000023c62-160.dat	xmrig
behavioral2/files/0x0007000000023c61-158.dat	xmrig
behavioral2/files/0x0007000000023c5e-154.dat	xmrig
behavioral2/files/0x0007000000023c5a-152.dat	xmrig
behavioral2/files/0x0007000000023c5d-150.dat	xmrig
behavioral2/files/0x0007000000023c5f-147.dat	xmrig
behavioral2/files/0x0007000000023c58-145.dat	xmrig
behavioral2/files/0x0007000000023c5b-143.dat	xmrig
behavioral2/files/0x0007000000023c57-128.dat	xmrig
behavioral2/files/0x0007000000023c56-114.dat	xmrig
behavioral2/files/0x0007000000023c55-101.dat	xmrig
behavioral2/files/0x0007000000023c52-81.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2256	fOjnxwA.exe
624	XvTqTSP.exe
964	xQQILaU.exe
1764	KlDkrRi.exe
4764	xDRURFK.exe
3872	eSVQYWU.exe
3368	WftIpBJ.exe
3048	oTpurTY.exe
2360	hdgOGyj.exe
4252	CpPLVrz.exe
4584	ZOykIJo.exe
3280	YhCgFtH.exe
2768	lcEyidz.exe
2444	GrqYpvM.exe
636	PIBXntk.exe
1620	lCnLneC.exe
1712	BNkwRTv.exe
1700	ASqzcUC.exe
4500	hUbOuui.exe
2968	uFmZLbM.exe
5100	kqQjFAO.exe
3220	RMYuTCo.exe
2492	CKJxlWk.exe
3568	KyFdpCr.exe
3068	nQPBECk.exe
1476	xTeidnn.exe
612	Kjdykpn.exe
3900	CObnRhF.exe
4876	oaptQdt.exe
668	IhKqjMV.exe
5072	EDpBhMz.exe
2056	exdiOoi.exe
1648	YowUjZd.exe
3828	LCLoufu.exe
4752	RqRJlKq.exe
2216	DtbMlUi.exe
3916	ttggGSM.exe
2372	ddghUoI.exe
4240	fpvgPeU.exe
5008	mwnbjfR.exe
4168	nGyEIUC.exe
3408	JBgGsZl.exe
5092	ZNYjQmh.exe
2956	cgCKUen.exe
640	CymDYWs.exe
1724	oTXyRLl.exe
4684	KGDObFG.exe
3452	tdvPuHa.exe
3176	fGwYCNw.exe
4872	LFluDiU.exe
4640	jtrHJhs.exe
2972	BCFJQNH.exe
5104	HeulGaw.exe
3968	YNlqZqm.exe
2024	xekKWAB.exe
8	SkWWhHs.exe
3012	JVepBzN.exe
4928	IizWJRR.exe
2528	ypmWBKw.exe
3372	fyiCKVl.exe
1516	QkjwXiW.exe
1068	JZJogts.exe
1032	TYFXUZl.exe
4896	CbJkQyL.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\mhjwrXz.exe	74ab1987fb6ee84dda24fbfef5974aaab8cf84eb567966960f245a4ac5fa19bd.exe
File created	C:\Windows\System\RvVUhbX.exe	74ab1987fb6ee84dda24fbfef5974aaab8cf84eb567966960f245a4ac5fa19bd.exe
File created	C:\Windows\System\TUeRDzu.exe	74ab1987fb6ee84dda24fbfef5974aaab8cf84eb567966960f245a4ac5fa19bd.exe
File created	C:\Windows\System\uviJFQe.exe	74ab1987fb6ee84dda24fbfef5974aaab8cf84eb567966960f245a4ac5fa19bd.exe
File created	C:\Windows\System\CObnRhF.exe	74ab1987fb6ee84dda24fbfef5974aaab8cf84eb567966960f245a4ac5fa19bd.exe
File created	C:\Windows\System\PrOlYuJ.exe	74ab1987fb6ee84dda24fbfef5974aaab8cf84eb567966960f245a4ac5fa19bd.exe
File created	C:\Windows\System\nfaCTBN.exe	74ab1987fb6ee84dda24fbfef5974aaab8cf84eb567966960f245a4ac5fa19bd.exe
File created	C:\Windows\System\clbnmsa.exe	74ab1987fb6ee84dda24fbfef5974aaab8cf84eb567966960f245a4ac5fa19bd.exe
File created	C:\Windows\System\YUazuoM.exe	74ab1987fb6ee84dda24fbfef5974aaab8cf84eb567966960f245a4ac5fa19bd.exe
File created	C:\Windows\System\mykVxhW.exe	74ab1987fb6ee84dda24fbfef5974aaab8cf84eb567966960f245a4ac5fa19bd.exe
File created	C:\Windows\System\Upqqeqy.exe	74ab1987fb6ee84dda24fbfef5974aaab8cf84eb567966960f245a4ac5fa19bd.exe
File created	C:\Windows\System\aOMJsKg.exe	74ab1987fb6ee84dda24fbfef5974aaab8cf84eb567966960f245a4ac5fa19bd.exe
File created	C:\Windows\System\AffpttT.exe	74ab1987fb6ee84dda24fbfef5974aaab8cf84eb567966960f245a4ac5fa19bd.exe
File created	C:\Windows\System\UjGvcfQ.exe	74ab1987fb6ee84dda24fbfef5974aaab8cf84eb567966960f245a4ac5fa19bd.exe
File created	C:\Windows\System\DlgHmye.exe	74ab1987fb6ee84dda24fbfef5974aaab8cf84eb567966960f245a4ac5fa19bd.exe
File created	C:\Windows\System\UfgWXoq.exe	74ab1987fb6ee84dda24fbfef5974aaab8cf84eb567966960f245a4ac5fa19bd.exe
File created	C:\Windows\System\HQpeuzy.exe	74ab1987fb6ee84dda24fbfef5974aaab8cf84eb567966960f245a4ac5fa19bd.exe
File created	C:\Windows\System\uDYAnim.exe	74ab1987fb6ee84dda24fbfef5974aaab8cf84eb567966960f245a4ac5fa19bd.exe
File created	C:\Windows\System\pRkwUbf.exe	74ab1987fb6ee84dda24fbfef5974aaab8cf84eb567966960f245a4ac5fa19bd.exe
File created	C:\Windows\System\EDpBhMz.exe	74ab1987fb6ee84dda24fbfef5974aaab8cf84eb567966960f245a4ac5fa19bd.exe
File created	C:\Windows\System\ccnKcol.exe	74ab1987fb6ee84dda24fbfef5974aaab8cf84eb567966960f245a4ac5fa19bd.exe
File created	C:\Windows\System\KsVAvcI.exe	74ab1987fb6ee84dda24fbfef5974aaab8cf84eb567966960f245a4ac5fa19bd.exe
File created	C:\Windows\System\hAZKpRK.exe	74ab1987fb6ee84dda24fbfef5974aaab8cf84eb567966960f245a4ac5fa19bd.exe
File created	C:\Windows\System\vlzGrXS.exe	74ab1987fb6ee84dda24fbfef5974aaab8cf84eb567966960f245a4ac5fa19bd.exe
File created	C:\Windows\System\upwRfxN.exe	74ab1987fb6ee84dda24fbfef5974aaab8cf84eb567966960f245a4ac5fa19bd.exe
File created	C:\Windows\System\UWyiAHA.exe	74ab1987fb6ee84dda24fbfef5974aaab8cf84eb567966960f245a4ac5fa19bd.exe
File created	C:\Windows\System\nkeMrKj.exe	74ab1987fb6ee84dda24fbfef5974aaab8cf84eb567966960f245a4ac5fa19bd.exe
File created	C:\Windows\System\MxMFIXr.exe	74ab1987fb6ee84dda24fbfef5974aaab8cf84eb567966960f245a4ac5fa19bd.exe
File created	C:\Windows\System\pZRCOjf.exe	74ab1987fb6ee84dda24fbfef5974aaab8cf84eb567966960f245a4ac5fa19bd.exe
File created	C:\Windows\System\utFfFac.exe	74ab1987fb6ee84dda24fbfef5974aaab8cf84eb567966960f245a4ac5fa19bd.exe
File created	C:\Windows\System\lQZrBzw.exe	74ab1987fb6ee84dda24fbfef5974aaab8cf84eb567966960f245a4ac5fa19bd.exe
File created	C:\Windows\System\rHzBgTd.exe	74ab1987fb6ee84dda24fbfef5974aaab8cf84eb567966960f245a4ac5fa19bd.exe
File created	C:\Windows\System\jwNRbYb.exe	74ab1987fb6ee84dda24fbfef5974aaab8cf84eb567966960f245a4ac5fa19bd.exe
File created	C:\Windows\System\hTeSZUr.exe	74ab1987fb6ee84dda24fbfef5974aaab8cf84eb567966960f245a4ac5fa19bd.exe
File created	C:\Windows\System\HVNWntV.exe	74ab1987fb6ee84dda24fbfef5974aaab8cf84eb567966960f245a4ac5fa19bd.exe
File created	C:\Windows\System\nbHMSNI.exe	74ab1987fb6ee84dda24fbfef5974aaab8cf84eb567966960f245a4ac5fa19bd.exe
File created	C:\Windows\System\CrtoGXe.exe	74ab1987fb6ee84dda24fbfef5974aaab8cf84eb567966960f245a4ac5fa19bd.exe
File created	C:\Windows\System\ILIxZrX.exe	74ab1987fb6ee84dda24fbfef5974aaab8cf84eb567966960f245a4ac5fa19bd.exe
File created	C:\Windows\System\GeNWcnE.exe	74ab1987fb6ee84dda24fbfef5974aaab8cf84eb567966960f245a4ac5fa19bd.exe
File created	C:\Windows\System\ffFvKKz.exe	74ab1987fb6ee84dda24fbfef5974aaab8cf84eb567966960f245a4ac5fa19bd.exe
File created	C:\Windows\System\LVjlARs.exe	74ab1987fb6ee84dda24fbfef5974aaab8cf84eb567966960f245a4ac5fa19bd.exe
File created	C:\Windows\System\DODfZoa.exe	74ab1987fb6ee84dda24fbfef5974aaab8cf84eb567966960f245a4ac5fa19bd.exe
File created	C:\Windows\System\uboxlXM.exe	74ab1987fb6ee84dda24fbfef5974aaab8cf84eb567966960f245a4ac5fa19bd.exe
File created	C:\Windows\System\RmuXpav.exe	74ab1987fb6ee84dda24fbfef5974aaab8cf84eb567966960f245a4ac5fa19bd.exe
File created	C:\Windows\System\CxLZPoQ.exe	74ab1987fb6ee84dda24fbfef5974aaab8cf84eb567966960f245a4ac5fa19bd.exe
File created	C:\Windows\System\CAzkKqD.exe	74ab1987fb6ee84dda24fbfef5974aaab8cf84eb567966960f245a4ac5fa19bd.exe
File created	C:\Windows\System\CEgiUjv.exe	74ab1987fb6ee84dda24fbfef5974aaab8cf84eb567966960f245a4ac5fa19bd.exe
File created	C:\Windows\System\SQYAiSr.exe	74ab1987fb6ee84dda24fbfef5974aaab8cf84eb567966960f245a4ac5fa19bd.exe
File created	C:\Windows\System\AOnGYMQ.exe	74ab1987fb6ee84dda24fbfef5974aaab8cf84eb567966960f245a4ac5fa19bd.exe
File created	C:\Windows\System\nQSTlQj.exe	74ab1987fb6ee84dda24fbfef5974aaab8cf84eb567966960f245a4ac5fa19bd.exe
File created	C:\Windows\System\cmweosJ.exe	74ab1987fb6ee84dda24fbfef5974aaab8cf84eb567966960f245a4ac5fa19bd.exe
File created	C:\Windows\System\MoQdQWf.exe	74ab1987fb6ee84dda24fbfef5974aaab8cf84eb567966960f245a4ac5fa19bd.exe
File created	C:\Windows\System\BKSklNL.exe	74ab1987fb6ee84dda24fbfef5974aaab8cf84eb567966960f245a4ac5fa19bd.exe
File created	C:\Windows\System\ryPrGDJ.exe	74ab1987fb6ee84dda24fbfef5974aaab8cf84eb567966960f245a4ac5fa19bd.exe
File created	C:\Windows\System\VsnWzWx.exe	74ab1987fb6ee84dda24fbfef5974aaab8cf84eb567966960f245a4ac5fa19bd.exe
File created	C:\Windows\System\EbjrYgY.exe	74ab1987fb6ee84dda24fbfef5974aaab8cf84eb567966960f245a4ac5fa19bd.exe
File created	C:\Windows\System\aVDjDhq.exe	74ab1987fb6ee84dda24fbfef5974aaab8cf84eb567966960f245a4ac5fa19bd.exe
File created	C:\Windows\System\BbhgApi.exe	74ab1987fb6ee84dda24fbfef5974aaab8cf84eb567966960f245a4ac5fa19bd.exe
File created	C:\Windows\System\QScwCFV.exe	74ab1987fb6ee84dda24fbfef5974aaab8cf84eb567966960f245a4ac5fa19bd.exe
File created	C:\Windows\System\ZjpYqiT.exe	74ab1987fb6ee84dda24fbfef5974aaab8cf84eb567966960f245a4ac5fa19bd.exe
File created	C:\Windows\System\JpUpPGp.exe	74ab1987fb6ee84dda24fbfef5974aaab8cf84eb567966960f245a4ac5fa19bd.exe
File created	C:\Windows\System\EbBeMoK.exe	74ab1987fb6ee84dda24fbfef5974aaab8cf84eb567966960f245a4ac5fa19bd.exe
File created	C:\Windows\System\xHIIyjQ.exe	74ab1987fb6ee84dda24fbfef5974aaab8cf84eb567966960f245a4ac5fa19bd.exe
File created	C:\Windows\System\cLKuPOa.exe	74ab1987fb6ee84dda24fbfef5974aaab8cf84eb567966960f245a4ac5fa19bd.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	15932	dwm.exe
Token: SeChangeNotifyPrivilege	15932	dwm.exe
Token: 33	15932	dwm.exe
Token: SeIncBasePriorityPrivilege	15932	dwm.exe
Token: SeShutdownPrivilege	15932	dwm.exe
Token: SeCreatePagefilePrivilege	15932	dwm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4092 wrote to memory of 2256	4092	74ab1987fb6ee84dda24fbfef5974aaab8cf84eb567966960f245a4ac5fa19bd.exe	84
PID 4092 wrote to memory of 2256	4092	74ab1987fb6ee84dda24fbfef5974aaab8cf84eb567966960f245a4ac5fa19bd.exe	84
PID 4092 wrote to memory of 624	4092	74ab1987fb6ee84dda24fbfef5974aaab8cf84eb567966960f245a4ac5fa19bd.exe	85
PID 4092 wrote to memory of 624	4092	74ab1987fb6ee84dda24fbfef5974aaab8cf84eb567966960f245a4ac5fa19bd.exe	85
PID 4092 wrote to memory of 3872	4092	74ab1987fb6ee84dda24fbfef5974aaab8cf84eb567966960f245a4ac5fa19bd.exe	86
PID 4092 wrote to memory of 3872	4092	74ab1987fb6ee84dda24fbfef5974aaab8cf84eb567966960f245a4ac5fa19bd.exe	86
PID 4092 wrote to memory of 964	4092	74ab1987fb6ee84dda24fbfef5974aaab8cf84eb567966960f245a4ac5fa19bd.exe	87
PID 4092 wrote to memory of 964	4092	74ab1987fb6ee84dda24fbfef5974aaab8cf84eb567966960f245a4ac5fa19bd.exe	87
PID 4092 wrote to memory of 1764	4092	74ab1987fb6ee84dda24fbfef5974aaab8cf84eb567966960f245a4ac5fa19bd.exe	88
PID 4092 wrote to memory of 1764	4092	74ab1987fb6ee84dda24fbfef5974aaab8cf84eb567966960f245a4ac5fa19bd.exe	88
PID 4092 wrote to memory of 4764	4092	74ab1987fb6ee84dda24fbfef5974aaab8cf84eb567966960f245a4ac5fa19bd.exe	89
PID 4092 wrote to memory of 4764	4092	74ab1987fb6ee84dda24fbfef5974aaab8cf84eb567966960f245a4ac5fa19bd.exe	89
PID 4092 wrote to memory of 3368	4092	74ab1987fb6ee84dda24fbfef5974aaab8cf84eb567966960f245a4ac5fa19bd.exe	90
PID 4092 wrote to memory of 3368	4092	74ab1987fb6ee84dda24fbfef5974aaab8cf84eb567966960f245a4ac5fa19bd.exe	90
PID 4092 wrote to memory of 3048	4092	74ab1987fb6ee84dda24fbfef5974aaab8cf84eb567966960f245a4ac5fa19bd.exe	91
PID 4092 wrote to memory of 3048	4092	74ab1987fb6ee84dda24fbfef5974aaab8cf84eb567966960f245a4ac5fa19bd.exe	91
PID 4092 wrote to memory of 2360	4092	74ab1987fb6ee84dda24fbfef5974aaab8cf84eb567966960f245a4ac5fa19bd.exe	92
PID 4092 wrote to memory of 2360	4092	74ab1987fb6ee84dda24fbfef5974aaab8cf84eb567966960f245a4ac5fa19bd.exe	92
PID 4092 wrote to memory of 4252	4092	74ab1987fb6ee84dda24fbfef5974aaab8cf84eb567966960f245a4ac5fa19bd.exe	93
PID 4092 wrote to memory of 4252	4092	74ab1987fb6ee84dda24fbfef5974aaab8cf84eb567966960f245a4ac5fa19bd.exe	93
PID 4092 wrote to memory of 4584	4092	74ab1987fb6ee84dda24fbfef5974aaab8cf84eb567966960f245a4ac5fa19bd.exe	94
PID 4092 wrote to memory of 4584	4092	74ab1987fb6ee84dda24fbfef5974aaab8cf84eb567966960f245a4ac5fa19bd.exe	94
PID 4092 wrote to memory of 3280	4092	74ab1987fb6ee84dda24fbfef5974aaab8cf84eb567966960f245a4ac5fa19bd.exe	97
PID 4092 wrote to memory of 3280	4092	74ab1987fb6ee84dda24fbfef5974aaab8cf84eb567966960f245a4ac5fa19bd.exe	97
PID 4092 wrote to memory of 2768	4092	74ab1987fb6ee84dda24fbfef5974aaab8cf84eb567966960f245a4ac5fa19bd.exe	98
PID 4092 wrote to memory of 2768	4092	74ab1987fb6ee84dda24fbfef5974aaab8cf84eb567966960f245a4ac5fa19bd.exe	98
PID 4092 wrote to memory of 2444	4092	74ab1987fb6ee84dda24fbfef5974aaab8cf84eb567966960f245a4ac5fa19bd.exe	99
PID 4092 wrote to memory of 2444	4092	74ab1987fb6ee84dda24fbfef5974aaab8cf84eb567966960f245a4ac5fa19bd.exe	99
PID 4092 wrote to memory of 636	4092	74ab1987fb6ee84dda24fbfef5974aaab8cf84eb567966960f245a4ac5fa19bd.exe	100
PID 4092 wrote to memory of 636	4092	74ab1987fb6ee84dda24fbfef5974aaab8cf84eb567966960f245a4ac5fa19bd.exe	100
PID 4092 wrote to memory of 1620	4092	74ab1987fb6ee84dda24fbfef5974aaab8cf84eb567966960f245a4ac5fa19bd.exe	101
PID 4092 wrote to memory of 1620	4092	74ab1987fb6ee84dda24fbfef5974aaab8cf84eb567966960f245a4ac5fa19bd.exe	101
PID 4092 wrote to memory of 1712	4092	74ab1987fb6ee84dda24fbfef5974aaab8cf84eb567966960f245a4ac5fa19bd.exe	102
PID 4092 wrote to memory of 1712	4092	74ab1987fb6ee84dda24fbfef5974aaab8cf84eb567966960f245a4ac5fa19bd.exe	102
PID 4092 wrote to memory of 1700	4092	74ab1987fb6ee84dda24fbfef5974aaab8cf84eb567966960f245a4ac5fa19bd.exe	103
PID 4092 wrote to memory of 1700	4092	74ab1987fb6ee84dda24fbfef5974aaab8cf84eb567966960f245a4ac5fa19bd.exe	103
PID 4092 wrote to memory of 4500	4092	74ab1987fb6ee84dda24fbfef5974aaab8cf84eb567966960f245a4ac5fa19bd.exe	104
PID 4092 wrote to memory of 4500	4092	74ab1987fb6ee84dda24fbfef5974aaab8cf84eb567966960f245a4ac5fa19bd.exe	104
PID 4092 wrote to memory of 2968	4092	74ab1987fb6ee84dda24fbfef5974aaab8cf84eb567966960f245a4ac5fa19bd.exe	105
PID 4092 wrote to memory of 2968	4092	74ab1987fb6ee84dda24fbfef5974aaab8cf84eb567966960f245a4ac5fa19bd.exe	105
PID 4092 wrote to memory of 5100	4092	74ab1987fb6ee84dda24fbfef5974aaab8cf84eb567966960f245a4ac5fa19bd.exe	106
PID 4092 wrote to memory of 5100	4092	74ab1987fb6ee84dda24fbfef5974aaab8cf84eb567966960f245a4ac5fa19bd.exe	106
PID 4092 wrote to memory of 3068	4092	74ab1987fb6ee84dda24fbfef5974aaab8cf84eb567966960f245a4ac5fa19bd.exe	107
PID 4092 wrote to memory of 3068	4092	74ab1987fb6ee84dda24fbfef5974aaab8cf84eb567966960f245a4ac5fa19bd.exe	107
PID 4092 wrote to memory of 3220	4092	74ab1987fb6ee84dda24fbfef5974aaab8cf84eb567966960f245a4ac5fa19bd.exe	108
PID 4092 wrote to memory of 3220	4092	74ab1987fb6ee84dda24fbfef5974aaab8cf84eb567966960f245a4ac5fa19bd.exe	108
PID 4092 wrote to memory of 2492	4092	74ab1987fb6ee84dda24fbfef5974aaab8cf84eb567966960f245a4ac5fa19bd.exe	109
PID 4092 wrote to memory of 2492	4092	74ab1987fb6ee84dda24fbfef5974aaab8cf84eb567966960f245a4ac5fa19bd.exe	109
PID 4092 wrote to memory of 3568	4092	74ab1987fb6ee84dda24fbfef5974aaab8cf84eb567966960f245a4ac5fa19bd.exe	110
PID 4092 wrote to memory of 3568	4092	74ab1987fb6ee84dda24fbfef5974aaab8cf84eb567966960f245a4ac5fa19bd.exe	110
PID 4092 wrote to memory of 1476	4092	74ab1987fb6ee84dda24fbfef5974aaab8cf84eb567966960f245a4ac5fa19bd.exe	111
PID 4092 wrote to memory of 1476	4092	74ab1987fb6ee84dda24fbfef5974aaab8cf84eb567966960f245a4ac5fa19bd.exe	111
PID 4092 wrote to memory of 612	4092	74ab1987fb6ee84dda24fbfef5974aaab8cf84eb567966960f245a4ac5fa19bd.exe	112
PID 4092 wrote to memory of 612	4092	74ab1987fb6ee84dda24fbfef5974aaab8cf84eb567966960f245a4ac5fa19bd.exe	112
PID 4092 wrote to memory of 3900	4092	74ab1987fb6ee84dda24fbfef5974aaab8cf84eb567966960f245a4ac5fa19bd.exe	113
PID 4092 wrote to memory of 3900	4092	74ab1987fb6ee84dda24fbfef5974aaab8cf84eb567966960f245a4ac5fa19bd.exe	113
PID 4092 wrote to memory of 4876	4092	74ab1987fb6ee84dda24fbfef5974aaab8cf84eb567966960f245a4ac5fa19bd.exe	114
PID 4092 wrote to memory of 4876	4092	74ab1987fb6ee84dda24fbfef5974aaab8cf84eb567966960f245a4ac5fa19bd.exe	114
PID 4092 wrote to memory of 668	4092	74ab1987fb6ee84dda24fbfef5974aaab8cf84eb567966960f245a4ac5fa19bd.exe	115
PID 4092 wrote to memory of 668	4092	74ab1987fb6ee84dda24fbfef5974aaab8cf84eb567966960f245a4ac5fa19bd.exe	115
PID 4092 wrote to memory of 5072	4092	74ab1987fb6ee84dda24fbfef5974aaab8cf84eb567966960f245a4ac5fa19bd.exe	116
PID 4092 wrote to memory of 5072	4092	74ab1987fb6ee84dda24fbfef5974aaab8cf84eb567966960f245a4ac5fa19bd.exe	116
PID 4092 wrote to memory of 2056	4092	74ab1987fb6ee84dda24fbfef5974aaab8cf84eb567966960f245a4ac5fa19bd.exe	117
PID 4092 wrote to memory of 2056	4092	74ab1987fb6ee84dda24fbfef5974aaab8cf84eb567966960f245a4ac5fa19bd.exe	117

C:\Users\Admin\AppData\Local\Temp\74ab1987fb6ee84dda24fbfef5974aaab8cf84eb567966960f245a4ac5fa19bd.exe
"C:\Users\Admin\AppData\Local\Temp\74ab1987fb6ee84dda24fbfef5974aaab8cf84eb567966960f245a4ac5fa19bd.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4092
- C:\Windows\System\fOjnxwA.exe
  C:\Windows\System\fOjnxwA.exe
  2⤵
  - Executes dropped EXE
  PID:2256
- C:\Windows\System\XvTqTSP.exe
  C:\Windows\System\XvTqTSP.exe
  2⤵
  - Executes dropped EXE
  PID:624
- C:\Windows\System\eSVQYWU.exe
  C:\Windows\System\eSVQYWU.exe
  2⤵
  - Executes dropped EXE
  PID:3872
- C:\Windows\System\xQQILaU.exe
  C:\Windows\System\xQQILaU.exe
  2⤵
  - Executes dropped EXE
  PID:964
- C:\Windows\System\KlDkrRi.exe
  C:\Windows\System\KlDkrRi.exe
  2⤵
  - Executes dropped EXE
  PID:1764
- C:\Windows\System\xDRURFK.exe
  C:\Windows\System\xDRURFK.exe
  2⤵
  - Executes dropped EXE
  PID:4764
- C:\Windows\System\WftIpBJ.exe
  C:\Windows\System\WftIpBJ.exe
  2⤵
  - Executes dropped EXE
  PID:3368
- C:\Windows\System\oTpurTY.exe
  C:\Windows\System\oTpurTY.exe
  2⤵
  - Executes dropped EXE
  PID:3048
- C:\Windows\System\hdgOGyj.exe
  C:\Windows\System\hdgOGyj.exe
  2⤵
  - Executes dropped EXE
  PID:2360
- C:\Windows\System\CpPLVrz.exe
  C:\Windows\System\CpPLVrz.exe
  2⤵
  - Executes dropped EXE
  PID:4252
- C:\Windows\System\ZOykIJo.exe
  C:\Windows\System\ZOykIJo.exe
  2⤵
  - Executes dropped EXE
  PID:4584
- C:\Windows\System\YhCgFtH.exe
  C:\Windows\System\YhCgFtH.exe
  2⤵
  - Executes dropped EXE
  PID:3280
- C:\Windows\System\lcEyidz.exe
  C:\Windows\System\lcEyidz.exe
  2⤵
  - Executes dropped EXE
  PID:2768
- C:\Windows\System\GrqYpvM.exe
  C:\Windows\System\GrqYpvM.exe
  2⤵
  - Executes dropped EXE
  PID:2444
- C:\Windows\System\PIBXntk.exe
  C:\Windows\System\PIBXntk.exe
  2⤵
  - Executes dropped EXE
  PID:636
- C:\Windows\System\lCnLneC.exe
  C:\Windows\System\lCnLneC.exe
  2⤵
  - Executes dropped EXE
  PID:1620
- C:\Windows\System\BNkwRTv.exe
  C:\Windows\System\BNkwRTv.exe
  2⤵
  - Executes dropped EXE
  PID:1712
- C:\Windows\System\ASqzcUC.exe
  C:\Windows\System\ASqzcUC.exe
  2⤵
  - Executes dropped EXE
  PID:1700
- C:\Windows\System\hUbOuui.exe
  C:\Windows\System\hUbOuui.exe
  2⤵
  - Executes dropped EXE
  PID:4500
- C:\Windows\System\uFmZLbM.exe
  C:\Windows\System\uFmZLbM.exe
  2⤵
  - Executes dropped EXE
  PID:2968
- C:\Windows\System\kqQjFAO.exe
  C:\Windows\System\kqQjFAO.exe
  2⤵
  - Executes dropped EXE
  PID:5100
- C:\Windows\System\nQPBECk.exe
  C:\Windows\System\nQPBECk.exe
  2⤵
  - Executes dropped EXE
  PID:3068
- C:\Windows\System\RMYuTCo.exe
  C:\Windows\System\RMYuTCo.exe
  2⤵
  - Executes dropped EXE
  PID:3220
- C:\Windows\System\CKJxlWk.exe
  C:\Windows\System\CKJxlWk.exe
  2⤵
  - Executes dropped EXE
  PID:2492
- C:\Windows\System\KyFdpCr.exe
  C:\Windows\System\KyFdpCr.exe
  2⤵
  - Executes dropped EXE
  PID:3568
- C:\Windows\System\xTeidnn.exe
  C:\Windows\System\xTeidnn.exe
  2⤵
  - Executes dropped EXE
  PID:1476
- C:\Windows\System\Kjdykpn.exe
  C:\Windows\System\Kjdykpn.exe
  2⤵
  - Executes dropped EXE
  PID:612
- C:\Windows\System\CObnRhF.exe
  C:\Windows\System\CObnRhF.exe
  2⤵
  - Executes dropped EXE
  PID:3900
- C:\Windows\System\oaptQdt.exe
  C:\Windows\System\oaptQdt.exe
  2⤵
  - Executes dropped EXE
  PID:4876
- C:\Windows\System\IhKqjMV.exe
  C:\Windows\System\IhKqjMV.exe
  2⤵
  - Executes dropped EXE
  PID:668
- C:\Windows\System\EDpBhMz.exe
  C:\Windows\System\EDpBhMz.exe
  2⤵
  - Executes dropped EXE
  PID:5072
- C:\Windows\System\exdiOoi.exe
  C:\Windows\System\exdiOoi.exe
  2⤵
  - Executes dropped EXE
  PID:2056
- C:\Windows\System\YowUjZd.exe
  C:\Windows\System\YowUjZd.exe
  2⤵
  - Executes dropped EXE
  PID:1648
- C:\Windows\System\LCLoufu.exe
  C:\Windows\System\LCLoufu.exe
  2⤵
  - Executes dropped EXE
  PID:3828
- C:\Windows\System\RqRJlKq.exe
  C:\Windows\System\RqRJlKq.exe
  2⤵
  - Executes dropped EXE
  PID:4752
- C:\Windows\System\DtbMlUi.exe
  C:\Windows\System\DtbMlUi.exe
  2⤵
  - Executes dropped EXE
  PID:2216
- C:\Windows\System\ttggGSM.exe
  C:\Windows\System\ttggGSM.exe
  2⤵
  - Executes dropped EXE
  PID:3916
- C:\Windows\System\ddghUoI.exe
  C:\Windows\System\ddghUoI.exe
  2⤵
  - Executes dropped EXE
  PID:2372
- C:\Windows\System\fpvgPeU.exe
  C:\Windows\System\fpvgPeU.exe
  2⤵
  - Executes dropped EXE
  PID:4240
- C:\Windows\System\mwnbjfR.exe
  C:\Windows\System\mwnbjfR.exe
  2⤵
  - Executes dropped EXE
  PID:5008
- C:\Windows\System\nGyEIUC.exe
  C:\Windows\System\nGyEIUC.exe
  2⤵
  - Executes dropped EXE
  PID:4168
- C:\Windows\System\JBgGsZl.exe
  C:\Windows\System\JBgGsZl.exe
  2⤵
  - Executes dropped EXE
  PID:3408
- C:\Windows\System\ZNYjQmh.exe
  C:\Windows\System\ZNYjQmh.exe
  2⤵
  - Executes dropped EXE
  PID:5092
- C:\Windows\System\cgCKUen.exe
  C:\Windows\System\cgCKUen.exe
  2⤵
  - Executes dropped EXE
  PID:2956
- C:\Windows\System\CymDYWs.exe
  C:\Windows\System\CymDYWs.exe
  2⤵
  - Executes dropped EXE
  PID:640
- C:\Windows\System\oTXyRLl.exe
  C:\Windows\System\oTXyRLl.exe
  2⤵
  - Executes dropped EXE
  PID:1724
- C:\Windows\System\KGDObFG.exe
  C:\Windows\System\KGDObFG.exe
  2⤵
  - Executes dropped EXE
  PID:4684
- C:\Windows\System\tdvPuHa.exe
  C:\Windows\System\tdvPuHa.exe
  2⤵
  - Executes dropped EXE
  PID:3452
- C:\Windows\System\fGwYCNw.exe
  C:\Windows\System\fGwYCNw.exe
  2⤵
  - Executes dropped EXE
  PID:3176
- C:\Windows\System\LFluDiU.exe
  C:\Windows\System\LFluDiU.exe
  2⤵
  - Executes dropped EXE
  PID:4872
- C:\Windows\System\jtrHJhs.exe
  C:\Windows\System\jtrHJhs.exe
  2⤵
  - Executes dropped EXE
  PID:4640
- C:\Windows\System\BCFJQNH.exe
  C:\Windows\System\BCFJQNH.exe
  2⤵
  - Executes dropped EXE
  PID:2972
- C:\Windows\System\HeulGaw.exe
  C:\Windows\System\HeulGaw.exe
  2⤵
  - Executes dropped EXE
  PID:5104
- C:\Windows\System\YNlqZqm.exe
  C:\Windows\System\YNlqZqm.exe
  2⤵
  - Executes dropped EXE
  PID:3968
- C:\Windows\System\xekKWAB.exe
  C:\Windows\System\xekKWAB.exe
  2⤵
  - Executes dropped EXE
  PID:2024
- C:\Windows\System\SkWWhHs.exe
  C:\Windows\System\SkWWhHs.exe
  2⤵
  - Executes dropped EXE
  PID:8
- C:\Windows\System\JVepBzN.exe
  C:\Windows\System\JVepBzN.exe
  2⤵
  - Executes dropped EXE
  PID:3012
- C:\Windows\System\IizWJRR.exe
  C:\Windows\System\IizWJRR.exe
  2⤵
  - Executes dropped EXE
  PID:4928
- C:\Windows\System\ypmWBKw.exe
  C:\Windows\System\ypmWBKw.exe
  2⤵
  - Executes dropped EXE
  PID:2528
- C:\Windows\System\fyiCKVl.exe
  C:\Windows\System\fyiCKVl.exe
  2⤵
  - Executes dropped EXE
  PID:3372
- C:\Windows\System\QkjwXiW.exe
  C:\Windows\System\QkjwXiW.exe
  2⤵
  - Executes dropped EXE
  PID:1516
- C:\Windows\System\JZJogts.exe
  C:\Windows\System\JZJogts.exe
  2⤵
  - Executes dropped EXE
  PID:1068
- C:\Windows\System\TYFXUZl.exe
  C:\Windows\System\TYFXUZl.exe
  2⤵
  - Executes dropped EXE
  PID:1032
- C:\Windows\System\CbJkQyL.exe
  C:\Windows\System\CbJkQyL.exe
  2⤵
  - Executes dropped EXE
  PID:4896
- C:\Windows\System\vipszoS.exe
  C:\Windows\System\vipszoS.exe
  2⤵
  PID:1536
- C:\Windows\System\OSzzXTl.exe
  C:\Windows\System\OSzzXTl.exe
  2⤵
  PID:4992
- C:\Windows\System\OrhkhfX.exe
  C:\Windows\System\OrhkhfX.exe
  2⤵
  PID:696
- C:\Windows\System\uKFHcDI.exe
  C:\Windows\System\uKFHcDI.exe
  2⤵
  PID:2080
- C:\Windows\System\WRctuOQ.exe
  C:\Windows\System\WRctuOQ.exe
  2⤵
  PID:4548
- C:\Windows\System\oahOhpe.exe
  C:\Windows\System\oahOhpe.exe
  2⤵
  PID:4756
- C:\Windows\System\IIPWHEi.exe
  C:\Windows\System\IIPWHEi.exe
  2⤵
  PID:3036
- C:\Windows\System\fRKljok.exe
  C:\Windows\System\fRKljok.exe
  2⤵
  PID:2884
- C:\Windows\System\jPEecll.exe
  C:\Windows\System\jPEecll.exe
  2⤵
  PID:3620
- C:\Windows\System\lrmHLsx.exe
  C:\Windows\System\lrmHLsx.exe
  2⤵
  PID:1308
- C:\Windows\System\ONrnyNh.exe
  C:\Windows\System\ONrnyNh.exe
  2⤵
  PID:4232
- C:\Windows\System\ccnKcol.exe
  C:\Windows\System\ccnKcol.exe
  2⤵
  PID:2280
- C:\Windows\System\aOMJsKg.exe
  C:\Windows\System\aOMJsKg.exe
  2⤵
  PID:2636
- C:\Windows\System\mXgxESa.exe
  C:\Windows\System\mXgxESa.exe
  2⤵
  PID:2932
- C:\Windows\System\iKBnXxa.exe
  C:\Windows\System\iKBnXxa.exe
  2⤵
  PID:1276
- C:\Windows\System\wabbJko.exe
  C:\Windows\System\wabbJko.exe
  2⤵
  PID:2600
- C:\Windows\System\glBZKaG.exe
  C:\Windows\System\glBZKaG.exe
  2⤵
  PID:4648
- C:\Windows\System\CrmOPah.exe
  C:\Windows\System\CrmOPah.exe
  2⤵
  PID:916
- C:\Windows\System\KtpLBmk.exe
  C:\Windows\System\KtpLBmk.exe
  2⤵
  PID:3840
- C:\Windows\System\vYkqmvY.exe
  C:\Windows\System\vYkqmvY.exe
  2⤵
  PID:1932
- C:\Windows\System\iYBeDJP.exe
  C:\Windows\System\iYBeDJP.exe
  2⤵
  PID:464
- C:\Windows\System\pvPTfxd.exe
  C:\Windows\System\pvPTfxd.exe
  2⤵
  PID:1388
- C:\Windows\System\nTXtFBu.exe
  C:\Windows\System\nTXtFBu.exe
  2⤵
  PID:2648
- C:\Windows\System\EbjrYgY.exe
  C:\Windows\System\EbjrYgY.exe
  2⤵
  PID:4556
- C:\Windows\System\AhOPPYC.exe
  C:\Windows\System\AhOPPYC.exe
  2⤵
  PID:4940
- C:\Windows\System\pBWaMSG.exe
  C:\Windows\System\pBWaMSG.exe
  2⤵
  PID:4384
- C:\Windows\System\QeXteIx.exe
  C:\Windows\System\QeXteIx.exe
  2⤵
  PID:2456
- C:\Windows\System\GeNWcnE.exe
  C:\Windows\System\GeNWcnE.exe
  2⤵
  PID:3392
- C:\Windows\System\kuOfOWw.exe
  C:\Windows\System\kuOfOWw.exe
  2⤵
  PID:4340
- C:\Windows\System\fyxAueV.exe
  C:\Windows\System\fyxAueV.exe
  2⤵
  PID:2352
- C:\Windows\System\FMUZVjx.exe
  C:\Windows\System\FMUZVjx.exe
  2⤵
  PID:4920
- C:\Windows\System\zWAAjHk.exe
  C:\Windows\System\zWAAjHk.exe
  2⤵
  PID:3656
- C:\Windows\System\ETYbRsb.exe
  C:\Windows\System\ETYbRsb.exe
  2⤵
  PID:1776
- C:\Windows\System\KsVAvcI.exe
  C:\Windows\System\KsVAvcI.exe
  2⤵
  PID:4448
- C:\Windows\System\FiktLTB.exe
  C:\Windows\System\FiktLTB.exe
  2⤵
  PID:4320
- C:\Windows\System\uhpVeTq.exe
  C:\Windows\System\uhpVeTq.exe
  2⤵
  PID:4680
- C:\Windows\System\guGjJiT.exe
  C:\Windows\System\guGjJiT.exe
  2⤵
  PID:5160
- C:\Windows\System\LKepcUv.exe
  C:\Windows\System\LKepcUv.exe
  2⤵
  PID:5180
- C:\Windows\System\uqtmjHK.exe
  C:\Windows\System\uqtmjHK.exe
  2⤵
  PID:5208
- C:\Windows\System\RiHmYEk.exe
  C:\Windows\System\RiHmYEk.exe
  2⤵
  PID:5240
- C:\Windows\System\qgKxQYs.exe
  C:\Windows\System\qgKxQYs.exe
  2⤵
  PID:5268
- C:\Windows\System\bgsDyMc.exe
  C:\Windows\System\bgsDyMc.exe
  2⤵
  PID:5292
- C:\Windows\System\dGdMxUX.exe
  C:\Windows\System\dGdMxUX.exe
  2⤵
  PID:5320
- C:\Windows\System\WbmRumx.exe
  C:\Windows\System\WbmRumx.exe
  2⤵
  PID:5336
- C:\Windows\System\bzmZUux.exe
  C:\Windows\System\bzmZUux.exe
  2⤵
  PID:5380
- C:\Windows\System\erNIOjs.exe
  C:\Windows\System\erNIOjs.exe
  2⤵
  PID:5408
- C:\Windows\System\AGbEfgv.exe
  C:\Windows\System\AGbEfgv.exe
  2⤵
  PID:5432
- C:\Windows\System\SlHFTbi.exe
  C:\Windows\System\SlHFTbi.exe
  2⤵
  PID:5460
- C:\Windows\System\JtbLqSq.exe
  C:\Windows\System\JtbLqSq.exe
  2⤵
  PID:5488
- C:\Windows\System\hSsNUUb.exe
  C:\Windows\System\hSsNUUb.exe
  2⤵
  PID:5516
- C:\Windows\System\ZBskNpn.exe
  C:\Windows\System\ZBskNpn.exe
  2⤵
  PID:5544
- C:\Windows\System\xgVgHVR.exe
  C:\Windows\System\xgVgHVR.exe
  2⤵
  PID:5572
- C:\Windows\System\wRUWAmc.exe
  C:\Windows\System\wRUWAmc.exe
  2⤵
  PID:5588
- C:\Windows\System\NuTSEsp.exe
  C:\Windows\System\NuTSEsp.exe
  2⤵
  PID:5616
- C:\Windows\System\oIjdOAs.exe
  C:\Windows\System\oIjdOAs.exe
  2⤵
  PID:5644
- C:\Windows\System\dgPnOdQ.exe
  C:\Windows\System\dgPnOdQ.exe
  2⤵
  PID:5684
- C:\Windows\System\oELjFul.exe
  C:\Windows\System\oELjFul.exe
  2⤵
  PID:5712
- C:\Windows\System\ypwTPuS.exe
  C:\Windows\System\ypwTPuS.exe
  2⤵
  PID:5740
- C:\Windows\System\ihBjfPQ.exe
  C:\Windows\System\ihBjfPQ.exe
  2⤵
  PID:5768
- C:\Windows\System\AOnGYMQ.exe
  C:\Windows\System\AOnGYMQ.exe
  2⤵
  PID:5796
- C:\Windows\System\kUbJeQU.exe
  C:\Windows\System\kUbJeQU.exe
  2⤵
  PID:5824
- C:\Windows\System\KmMilIY.exe
  C:\Windows\System\KmMilIY.exe
  2⤵
  PID:5852
- C:\Windows\System\cLKuPOa.exe
  C:\Windows\System\cLKuPOa.exe
  2⤵
  PID:5880
- C:\Windows\System\BRBoHnj.exe
  C:\Windows\System\BRBoHnj.exe
  2⤵
  PID:5908
- C:\Windows\System\KjSVZyb.exe
  C:\Windows\System\KjSVZyb.exe
  2⤵
  PID:5932
- C:\Windows\System\tMkDJJH.exe
  C:\Windows\System\tMkDJJH.exe
  2⤵
  PID:5964
- C:\Windows\System\CSHABQL.exe
  C:\Windows\System\CSHABQL.exe
  2⤵
  PID:5992
- C:\Windows\System\BgcbWpP.exe
  C:\Windows\System\BgcbWpP.exe
  2⤵
  PID:6020
- C:\Windows\System\iQzVlsV.exe
  C:\Windows\System\iQzVlsV.exe
  2⤵
  PID:6048
- C:\Windows\System\JxSdBEP.exe
  C:\Windows\System\JxSdBEP.exe
  2⤵
  PID:6076
- C:\Windows\System\VidcxqA.exe
  C:\Windows\System\VidcxqA.exe
  2⤵
  PID:6104
- C:\Windows\System\TWJLpxO.exe
  C:\Windows\System\TWJLpxO.exe
  2⤵
  PID:6132
- C:\Windows\System\MdMDyKw.exe
  C:\Windows\System\MdMDyKw.exe
  2⤵
  PID:5136
- C:\Windows\System\McWGYRd.exe
  C:\Windows\System\McWGYRd.exe
  2⤵
  PID:5200
- C:\Windows\System\FvdpleN.exe
  C:\Windows\System\FvdpleN.exe
  2⤵
  PID:5284
- C:\Windows\System\vjbWolA.exe
  C:\Windows\System\vjbWolA.exe
  2⤵
  PID:5332
- C:\Windows\System\zeXmyyB.exe
  C:\Windows\System\zeXmyyB.exe
  2⤵
  PID:5400
- C:\Windows\System\UqenXvS.exe
  C:\Windows\System\UqenXvS.exe
  2⤵
  PID:5472
- C:\Windows\System\zjbnoHl.exe
  C:\Windows\System\zjbnoHl.exe
  2⤵
  PID:5536
- C:\Windows\System\kHkipvl.exe
  C:\Windows\System\kHkipvl.exe
  2⤵
  PID:5600
- C:\Windows\System\FJSmTnn.exe
  C:\Windows\System\FJSmTnn.exe
  2⤵
  PID:5656
- C:\Windows\System\AffpttT.exe
  C:\Windows\System\AffpttT.exe
  2⤵
  PID:5700
- C:\Windows\System\LlBgSfD.exe
  C:\Windows\System\LlBgSfD.exe
  2⤵
  PID:5788
- C:\Windows\System\jEmUBKJ.exe
  C:\Windows\System\jEmUBKJ.exe
  2⤵
  PID:5864
- C:\Windows\System\xVHIMPB.exe
  C:\Windows\System\xVHIMPB.exe
  2⤵
  PID:5920
- C:\Windows\System\VuLDGCb.exe
  C:\Windows\System\VuLDGCb.exe
  2⤵
  PID:5988
- C:\Windows\System\MtaZvNa.exe
  C:\Windows\System\MtaZvNa.exe
  2⤵
  PID:6060
- C:\Windows\System\fuuFCqU.exe
  C:\Windows\System\fuuFCqU.exe
  2⤵
  PID:6124
- C:\Windows\System\QouyxlP.exe
  C:\Windows\System\QouyxlP.exe
  2⤵
  PID:5172
- C:\Windows\System\ohsQlyB.exe
  C:\Windows\System\ohsQlyB.exe
  2⤵
  PID:5368
- C:\Windows\System\XfnvDvD.exe
  C:\Windows\System\XfnvDvD.exe
  2⤵
  PID:5508
- C:\Windows\System\RKyHHTV.exe
  C:\Windows\System\RKyHHTV.exe
  2⤵
  PID:5584
- C:\Windows\System\RppTPwm.exe
  C:\Windows\System\RppTPwm.exe
  2⤵
  PID:5728
- C:\Windows\System\lPEbGCi.exe
  C:\Windows\System\lPEbGCi.exe
  2⤵
  PID:5924
- C:\Windows\System\sCvKQoZ.exe
  C:\Windows\System\sCvKQoZ.exe
  2⤵
  PID:6096
- C:\Windows\System\dJxdRWR.exe
  C:\Windows\System\dJxdRWR.exe
  2⤵
  PID:5556
- C:\Windows\System\aVDjDhq.exe
  C:\Windows\System\aVDjDhq.exe
  2⤵
  PID:5500
- C:\Windows\System\WlxrOhu.exe
  C:\Windows\System\WlxrOhu.exe
  2⤵
  PID:5904
- C:\Windows\System\yYpAchU.exe
  C:\Windows\System\yYpAchU.exe
  2⤵
  PID:5448
- C:\Windows\System\FdzcoAj.exe
  C:\Windows\System\FdzcoAj.exe
  2⤵
  PID:6172
- C:\Windows\System\GKOYyRK.exe
  C:\Windows\System\GKOYyRK.exe
  2⤵
  PID:6204
- C:\Windows\System\okgvEFb.exe
  C:\Windows\System\okgvEFb.exe
  2⤵
  PID:6220
- C:\Windows\System\JgTdwNd.exe
  C:\Windows\System\JgTdwNd.exe
  2⤵
  PID:6260
- C:\Windows\System\hCNEjZb.exe
  C:\Windows\System\hCNEjZb.exe
  2⤵
  PID:6292
- C:\Windows\System\oqJasKs.exe
  C:\Windows\System\oqJasKs.exe
  2⤵
  PID:6316
- C:\Windows\System\ROtHZcT.exe
  C:\Windows\System\ROtHZcT.exe
  2⤵
  PID:6344
- C:\Windows\System\usggULh.exe
  C:\Windows\System\usggULh.exe
  2⤵
  PID:6372
- C:\Windows\System\GyqxLYZ.exe
  C:\Windows\System\GyqxLYZ.exe
  2⤵
  PID:6400
- C:\Windows\System\pKbuqHt.exe
  C:\Windows\System\pKbuqHt.exe
  2⤵
  PID:6428
- C:\Windows\System\OeTOUpA.exe
  C:\Windows\System\OeTOUpA.exe
  2⤵
  PID:6456
- C:\Windows\System\tFgrdRp.exe
  C:\Windows\System\tFgrdRp.exe
  2⤵
  PID:6484
- C:\Windows\System\UAyiDkK.exe
  C:\Windows\System\UAyiDkK.exe
  2⤵
  PID:6512
- C:\Windows\System\qfaXAuN.exe
  C:\Windows\System\qfaXAuN.exe
  2⤵
  PID:6540
- C:\Windows\System\gVkgrTl.exe
  C:\Windows\System\gVkgrTl.exe
  2⤵
  PID:6568
- C:\Windows\System\vkXwEeZ.exe
  C:\Windows\System\vkXwEeZ.exe
  2⤵
  PID:6596
- C:\Windows\System\oKYZKTt.exe
  C:\Windows\System\oKYZKTt.exe
  2⤵
  PID:6624
- C:\Windows\System\FCjpUtf.exe
  C:\Windows\System\FCjpUtf.exe
  2⤵
  PID:6652
- C:\Windows\System\AHRUUAG.exe
  C:\Windows\System\AHRUUAG.exe
  2⤵
  PID:6680
- C:\Windows\System\Cfeefih.exe
  C:\Windows\System\Cfeefih.exe
  2⤵
  PID:6708
- C:\Windows\System\sSlIBPb.exe
  C:\Windows\System\sSlIBPb.exe
  2⤵
  PID:6724
- C:\Windows\System\lHzamUz.exe
  C:\Windows\System\lHzamUz.exe
  2⤵
  PID:6760
- C:\Windows\System\UOibIUj.exe
  C:\Windows\System\UOibIUj.exe
  2⤵
  PID:6792
- C:\Windows\System\fjhKiMs.exe
  C:\Windows\System\fjhKiMs.exe
  2⤵
  PID:6820
- C:\Windows\System\MGEvSxK.exe
  C:\Windows\System\MGEvSxK.exe
  2⤵
  PID:6836
- C:\Windows\System\Rtchkid.exe
  C:\Windows\System\Rtchkid.exe
  2⤵
  PID:6864
- C:\Windows\System\ZXiqndO.exe
  C:\Windows\System\ZXiqndO.exe
  2⤵
  PID:6900
- C:\Windows\System\PrOlYuJ.exe
  C:\Windows\System\PrOlYuJ.exe
  2⤵
  PID:6936
- C:\Windows\System\ZFDWxjy.exe
  C:\Windows\System\ZFDWxjy.exe
  2⤵
  PID:6964
- C:\Windows\System\vbykcSR.exe
  C:\Windows\System\vbykcSR.exe
  2⤵
  PID:6980
- C:\Windows\System\ZnjSaak.exe
  C:\Windows\System\ZnjSaak.exe
  2⤵
  PID:7008
- C:\Windows\System\nfaCTBN.exe
  C:\Windows\System\nfaCTBN.exe
  2⤵
  PID:7036
- C:\Windows\System\zOMUkpn.exe
  C:\Windows\System\zOMUkpn.exe
  2⤵
  PID:7076
- C:\Windows\System\odzIOuK.exe
  C:\Windows\System\odzIOuK.exe
  2⤵
  PID:7104
- C:\Windows\System\NZpZyFH.exe
  C:\Windows\System\NZpZyFH.exe
  2⤵
  PID:7132
- C:\Windows\System\FcWEUhd.exe
  C:\Windows\System\FcWEUhd.exe
  2⤵
  PID:7160
- C:\Windows\System\LVeVyqp.exe
  C:\Windows\System\LVeVyqp.exe
  2⤵
  PID:6148
- C:\Windows\System\TMzimRp.exe
  C:\Windows\System\TMzimRp.exe
  2⤵
  PID:6216
- C:\Windows\System\JqgcHnK.exe
  C:\Windows\System\JqgcHnK.exe
  2⤵
  PID:6280
- C:\Windows\System\oSlrUng.exe
  C:\Windows\System\oSlrUng.exe
  2⤵
  PID:6336
- C:\Windows\System\tOjWkwI.exe
  C:\Windows\System\tOjWkwI.exe
  2⤵
  PID:6384
- C:\Windows\System\hQqbeXK.exe
  C:\Windows\System\hQqbeXK.exe
  2⤵
  PID:6448
- C:\Windows\System\NuXeMJj.exe
  C:\Windows\System\NuXeMJj.exe
  2⤵
  PID:6536
- C:\Windows\System\aYpBpfL.exe
  C:\Windows\System\aYpBpfL.exe
  2⤵
  PID:6580
- C:\Windows\System\MzPQMWf.exe
  C:\Windows\System\MzPQMWf.exe
  2⤵
  PID:6640
- C:\Windows\System\hevJFZx.exe
  C:\Windows\System\hevJFZx.exe
  2⤵
  PID:6748
- C:\Windows\System\MhfKhDV.exe
  C:\Windows\System\MhfKhDV.exe
  2⤵
  PID:6816
- C:\Windows\System\OODnWPo.exe
  C:\Windows\System\OODnWPo.exe
  2⤵
  PID:6860
- C:\Windows\System\JMjgMHv.exe
  C:\Windows\System\JMjgMHv.exe
  2⤵
  PID:6920
- C:\Windows\System\oHndstZ.exe
  C:\Windows\System\oHndstZ.exe
  2⤵
  PID:6948
- C:\Windows\System\XuDvGRS.exe
  C:\Windows\System\XuDvGRS.exe
  2⤵
  PID:7060
- C:\Windows\System\XchCeEU.exe
  C:\Windows\System\XchCeEU.exe
  2⤵
  PID:7100
- C:\Windows\System\ioHNOQb.exe
  C:\Windows\System\ioHNOQb.exe
  2⤵
  PID:5792
- C:\Windows\System\LQTBBvt.exe
  C:\Windows\System\LQTBBvt.exe
  2⤵
  PID:6332
- C:\Windows\System\dTjCpJP.exe
  C:\Windows\System\dTjCpJP.exe
  2⤵
  PID:6476
- C:\Windows\System\SiggqWF.exe
  C:\Windows\System\SiggqWF.exe
  2⤵
  PID:6636
- C:\Windows\System\amewQiT.exe
  C:\Windows\System\amewQiT.exe
  2⤵
  PID:6768
- C:\Windows\System\iRZnLxr.exe
  C:\Windows\System\iRZnLxr.exe
  2⤵
  PID:6960
- C:\Windows\System\CQOfewM.exe
  C:\Windows\System\CQOfewM.exe
  2⤵
  PID:7128
- C:\Windows\System\TXRYxvf.exe
  C:\Windows\System\TXRYxvf.exe
  2⤵
  PID:6256
- C:\Windows\System\LqPJHkq.exe
  C:\Windows\System\LqPJHkq.exe
  2⤵
  PID:6552
- C:\Windows\System\OIpoGEP.exe
  C:\Windows\System\OIpoGEP.exe
  2⤵
  PID:7000
- C:\Windows\System\WPLGQvr.exe
  C:\Windows\System\WPLGQvr.exe
  2⤵
  PID:6496
- C:\Windows\System\DEfGMaH.exe
  C:\Windows\System\DEfGMaH.exe
  2⤵
  PID:6848
- C:\Windows\System\ahMTXoG.exe
  C:\Windows\System\ahMTXoG.exe
  2⤵
  PID:7180
- C:\Windows\System\eAzdTtt.exe
  C:\Windows\System\eAzdTtt.exe
  2⤵
  PID:7212
- C:\Windows\System\EVOKuxC.exe
  C:\Windows\System\EVOKuxC.exe
  2⤵
  PID:7244
- C:\Windows\System\eJMuRZi.exe
  C:\Windows\System\eJMuRZi.exe
  2⤵
  PID:7280
- C:\Windows\System\BoRVBOp.exe
  C:\Windows\System\BoRVBOp.exe
  2⤵
  PID:7308
- C:\Windows\System\ZhVFSPO.exe
  C:\Windows\System\ZhVFSPO.exe
  2⤵
  PID:7336
- C:\Windows\System\DpnTgkl.exe
  C:\Windows\System\DpnTgkl.exe
  2⤵
  PID:7364
- C:\Windows\System\DlgHmye.exe
  C:\Windows\System\DlgHmye.exe
  2⤵
  PID:7380
- C:\Windows\System\MVVOmQG.exe
  C:\Windows\System\MVVOmQG.exe
  2⤵
  PID:7408
- C:\Windows\System\gcRmYba.exe
  C:\Windows\System\gcRmYba.exe
  2⤵
  PID:7444
- C:\Windows\System\UfgWXoq.exe
  C:\Windows\System\UfgWXoq.exe
  2⤵
  PID:7472
- C:\Windows\System\YQcUGFl.exe
  C:\Windows\System\YQcUGFl.exe
  2⤵
  PID:7504
- C:\Windows\System\ycahppV.exe
  C:\Windows\System\ycahppV.exe
  2⤵
  PID:7532
- C:\Windows\System\JWARqgX.exe
  C:\Windows\System\JWARqgX.exe
  2⤵
  PID:7560
- C:\Windows\System\POiZkVX.exe
  C:\Windows\System\POiZkVX.exe
  2⤵
  PID:7588
- C:\Windows\System\hUsbFCe.exe
  C:\Windows\System\hUsbFCe.exe
  2⤵
  PID:7616
- C:\Windows\System\ewXHyXj.exe
  C:\Windows\System\ewXHyXj.exe
  2⤵
  PID:7644
- C:\Windows\System\qeHcTVF.exe
  C:\Windows\System\qeHcTVF.exe
  2⤵
  PID:7672
- C:\Windows\System\mNeLkqU.exe
  C:\Windows\System\mNeLkqU.exe
  2⤵
  PID:7700
- C:\Windows\System\HRAvJSz.exe
  C:\Windows\System\HRAvJSz.exe
  2⤵
  PID:7728
- C:\Windows\System\zfFQTZv.exe
  C:\Windows\System\zfFQTZv.exe
  2⤵
  PID:7756
- C:\Windows\System\eLrbcEi.exe
  C:\Windows\System\eLrbcEi.exe
  2⤵
  PID:7784
- C:\Windows\System\PRSmDWb.exe
  C:\Windows\System\PRSmDWb.exe
  2⤵
  PID:7812
- C:\Windows\System\gbTtptv.exe
  C:\Windows\System\gbTtptv.exe
  2⤵
  PID:7840
- C:\Windows\System\eqxmFBM.exe
  C:\Windows\System\eqxmFBM.exe
  2⤵
  PID:7856
- C:\Windows\System\vFIQxPb.exe
  C:\Windows\System\vFIQxPb.exe
  2⤵
  PID:7884
- C:\Windows\System\YkETeIh.exe
  C:\Windows\System\YkETeIh.exe
  2⤵
  PID:7916
- C:\Windows\System\ECKWgUJ.exe
  C:\Windows\System\ECKWgUJ.exe
  2⤵
  PID:7952
- C:\Windows\System\WXacWgt.exe
  C:\Windows\System\WXacWgt.exe
  2⤵
  PID:7968
- C:\Windows\System\bcDHrsY.exe
  C:\Windows\System\bcDHrsY.exe
  2⤵
  PID:7996
- C:\Windows\System\ixbUpAh.exe
  C:\Windows\System\ixbUpAh.exe
  2⤵
  PID:8028
- C:\Windows\System\lufEsrs.exe
  C:\Windows\System\lufEsrs.exe
  2⤵
  PID:8064
- C:\Windows\System\zQTCbQp.exe
  C:\Windows\System\zQTCbQp.exe
  2⤵
  PID:8092
- C:\Windows\System\SPZvNwf.exe
  C:\Windows\System\SPZvNwf.exe
  2⤵
  PID:8120
- C:\Windows\System\swlebbs.exe
  C:\Windows\System\swlebbs.exe
  2⤵
  PID:8136
- C:\Windows\System\PZsloee.exe
  C:\Windows\System\PZsloee.exe
  2⤵
  PID:8156
- C:\Windows\System\MeAehzD.exe
  C:\Windows\System\MeAehzD.exe
  2⤵
  PID:8180
- C:\Windows\System\NeaddfP.exe
  C:\Windows\System\NeaddfP.exe
  2⤵
  PID:7192
- C:\Windows\System\CDrBVNe.exe
  C:\Windows\System\CDrBVNe.exe
  2⤵
  PID:7292
- C:\Windows\System\HEefBIb.exe
  C:\Windows\System\HEefBIb.exe
  2⤵
  PID:7360
- C:\Windows\System\BKSklNL.exe
  C:\Windows\System\BKSklNL.exe
  2⤵
  PID:7440
- C:\Windows\System\gRszIcW.exe
  C:\Windows\System\gRszIcW.exe
  2⤵
  PID:7488
- C:\Windows\System\VXACpmy.exe
  C:\Windows\System\VXACpmy.exe
  2⤵
  PID:7572
- C:\Windows\System\dODczmi.exe
  C:\Windows\System\dODczmi.exe
  2⤵
  PID:7628
- C:\Windows\System\YAElCln.exe
  C:\Windows\System\YAElCln.exe
  2⤵
  PID:7664
- C:\Windows\System\AvHxYel.exe
  C:\Windows\System\AvHxYel.exe
  2⤵
  PID:7724
- C:\Windows\System\bOgXMSb.exe
  C:\Windows\System\bOgXMSb.exe
  2⤵
  PID:7780
- C:\Windows\System\lWiChzu.exe
  C:\Windows\System\lWiChzu.exe
  2⤵
  PID:7848
- C:\Windows\System\XtIcIeH.exe
  C:\Windows\System\XtIcIeH.exe
  2⤵
  PID:7940
- C:\Windows\System\MTclGXy.exe
  C:\Windows\System\MTclGXy.exe
  2⤵
  PID:7992
- C:\Windows\System\lBixPnk.exe
  C:\Windows\System\lBixPnk.exe
  2⤵
  PID:8052
- C:\Windows\System\JTTpaRP.exe
  C:\Windows\System\JTTpaRP.exe
  2⤵
  PID:8128
- C:\Windows\System\mXuQdOm.exe
  C:\Windows\System\mXuQdOm.exe
  2⤵
  PID:8176
- C:\Windows\System\FvGaYcZ.exe
  C:\Windows\System\FvGaYcZ.exe
  2⤵
  PID:7268
- C:\Windows\System\esMPXFJ.exe
  C:\Windows\System\esMPXFJ.exe
  2⤵
  PID:7548
- C:\Windows\System\GnPhMNG.exe
  C:\Windows\System\GnPhMNG.exe
  2⤵
  PID:7600
- C:\Windows\System\pPXLRLa.exe
  C:\Windows\System\pPXLRLa.exe
  2⤵
  PID:7804
- C:\Windows\System\EMrCxzc.exe
  C:\Windows\System\EMrCxzc.exe
  2⤵
  PID:7852
- C:\Windows\System\upwRfxN.exe
  C:\Windows\System\upwRfxN.exe
  2⤵
  PID:8144
- C:\Windows\System\clbnmsa.exe
  C:\Windows\System\clbnmsa.exe
  2⤵
  PID:7392
- C:\Windows\System\mhjwrXz.exe
  C:\Windows\System\mhjwrXz.exe
  2⤵
  PID:7808
- C:\Windows\System\OLzeiiJ.exe
  C:\Windows\System\OLzeiiJ.exe
  2⤵
  PID:8024
- C:\Windows\System\nQSTlQj.exe
  C:\Windows\System\nQSTlQj.exe
  2⤵
  PID:7544
- C:\Windows\System\FybATHh.exe
  C:\Windows\System\FybATHh.exe
  2⤵
  PID:7252
- C:\Windows\System\WadUmWL.exe
  C:\Windows\System\WadUmWL.exe
  2⤵
  PID:8220
- C:\Windows\System\qEaFltj.exe
  C:\Windows\System\qEaFltj.exe
  2⤵
  PID:8248
- C:\Windows\System\GOvirfp.exe
  C:\Windows\System\GOvirfp.exe
  2⤵
  PID:8276
- C:\Windows\System\tDBfzQx.exe
  C:\Windows\System\tDBfzQx.exe
  2⤵
  PID:8292
- C:\Windows\System\WUCyuLj.exe
  C:\Windows\System\WUCyuLj.exe
  2⤵
  PID:8324
- C:\Windows\System\oDzuYBt.exe
  C:\Windows\System\oDzuYBt.exe
  2⤵
  PID:8348
- C:\Windows\System\LzHGBXn.exe
  C:\Windows\System\LzHGBXn.exe
  2⤵
  PID:8376
- C:\Windows\System\RsShCBX.exe
  C:\Windows\System\RsShCBX.exe
  2⤵
  PID:8408
- C:\Windows\System\WVEktuZ.exe
  C:\Windows\System\WVEktuZ.exe
  2⤵
  PID:8444
- C:\Windows\System\TnuyMQm.exe
  C:\Windows\System\TnuyMQm.exe
  2⤵
  PID:8476
- C:\Windows\System\djNrOGm.exe
  C:\Windows\System\djNrOGm.exe
  2⤵
  PID:8504
- C:\Windows\System\doAtlzr.exe
  C:\Windows\System\doAtlzr.exe
  2⤵
  PID:8520
- C:\Windows\System\hDLwOKL.exe
  C:\Windows\System\hDLwOKL.exe
  2⤵
  PID:8548
- C:\Windows\System\HxyHZoJ.exe
  C:\Windows\System\HxyHZoJ.exe
  2⤵
  PID:8576
- C:\Windows\System\LlaZtsx.exe
  C:\Windows\System\LlaZtsx.exe
  2⤵
  PID:8604
- C:\Windows\System\wHStaGL.exe
  C:\Windows\System\wHStaGL.exe
  2⤵
  PID:8624
- C:\Windows\System\naSSjBK.exe
  C:\Windows\System\naSSjBK.exe
  2⤵
  PID:8648
- C:\Windows\System\RzyVcGj.exe
  C:\Windows\System\RzyVcGj.exe
  2⤵
  PID:8680
- C:\Windows\System\ryPrGDJ.exe
  C:\Windows\System\ryPrGDJ.exe
  2⤵
  PID:8712
- C:\Windows\System\CwmWHMr.exe
  C:\Windows\System\CwmWHMr.exe
  2⤵
  PID:8732
- C:\Windows\System\IlHzfzN.exe
  C:\Windows\System\IlHzfzN.exe
  2⤵
  PID:8764
- C:\Windows\System\dSLgWuS.exe
  C:\Windows\System\dSLgWuS.exe
  2⤵
  PID:8792
- C:\Windows\System\mioVRUj.exe
  C:\Windows\System\mioVRUj.exe
  2⤵
  PID:8820
- C:\Windows\System\WxfbCmy.exe
  C:\Windows\System\WxfbCmy.exe
  2⤵
  PID:8852
- C:\Windows\System\TbZtMjF.exe
  C:\Windows\System\TbZtMjF.exe
  2⤵
  PID:8884
- C:\Windows\System\ZrQrJlj.exe
  C:\Windows\System\ZrQrJlj.exe
  2⤵
  PID:8916
- C:\Windows\System\oFGZhGS.exe
  C:\Windows\System\oFGZhGS.exe
  2⤵
  PID:8940
- C:\Windows\System\JuqXacP.exe
  C:\Windows\System\JuqXacP.exe
  2⤵
  PID:8968
- C:\Windows\System\nbHMSNI.exe
  C:\Windows\System\nbHMSNI.exe
  2⤵
  PID:9004
- C:\Windows\System\yRycrBt.exe
  C:\Windows\System\yRycrBt.exe
  2⤵
  PID:9036
- C:\Windows\System\fhFNbJG.exe
  C:\Windows\System\fhFNbJG.exe
  2⤵
  PID:9056
- C:\Windows\System\gkdlooq.exe
  C:\Windows\System\gkdlooq.exe
  2⤵
  PID:9080
- C:\Windows\System\uqWFTxB.exe
  C:\Windows\System\uqWFTxB.exe
  2⤵
  PID:9096
- C:\Windows\System\IIBYHKX.exe
  C:\Windows\System\IIBYHKX.exe
  2⤵
  PID:9128
- C:\Windows\System\tIQlaou.exe
  C:\Windows\System\tIQlaou.exe
  2⤵
  PID:9152
- C:\Windows\System\YnUnwuO.exe
  C:\Windows\System\YnUnwuO.exe
  2⤵
  PID:9192
- C:\Windows\System\tdUOkEt.exe
  C:\Windows\System\tdUOkEt.exe
  2⤵
  PID:7688
- C:\Windows\System\uJhuWWb.exe
  C:\Windows\System\uJhuWWb.exe
  2⤵
  PID:8260
- C:\Windows\System\TOkthfO.exe
  C:\Windows\System\TOkthfO.exe
  2⤵
  PID:8308
- C:\Windows\System\wINfVCS.exe
  C:\Windows\System\wINfVCS.exe
  2⤵
  PID:8388
- C:\Windows\System\PhhKSwL.exe
  C:\Windows\System\PhhKSwL.exe
  2⤵
  PID:8428
- C:\Windows\System\PPPiVRi.exe
  C:\Windows\System\PPPiVRi.exe
  2⤵
  PID:8472
- C:\Windows\System\QzVPWFa.exe
  C:\Windows\System\QzVPWFa.exe
  2⤵
  PID:8516
- C:\Windows\System\CrtoGXe.exe
  C:\Windows\System\CrtoGXe.exe
  2⤵
  PID:8560
- C:\Windows\System\WgbyecU.exe
  C:\Windows\System\WgbyecU.exe
  2⤵
  PID:8592
- C:\Windows\System\NgKCXFf.exe
  C:\Windows\System\NgKCXFf.exe
  2⤵
  PID:8672
- C:\Windows\System\YUazuoM.exe
  C:\Windows\System\YUazuoM.exe
  2⤵
  PID:8756
- C:\Windows\System\wAbULkP.exe
  C:\Windows\System\wAbULkP.exe
  2⤵
  PID:8816
- C:\Windows\System\SphGBIB.exe
  C:\Windows\System\SphGBIB.exe
  2⤵
  PID:8880
- C:\Windows\System\ZCbgnVO.exe
  C:\Windows\System\ZCbgnVO.exe
  2⤵
  PID:8956
- C:\Windows\System\VlBfEmH.exe
  C:\Windows\System\VlBfEmH.exe
  2⤵
  PID:8980
- C:\Windows\System\qCVYrFs.exe
  C:\Windows\System\qCVYrFs.exe
  2⤵
  PID:9068
- C:\Windows\System\rlCjjkB.exe
  C:\Windows\System\rlCjjkB.exe
  2⤵
  PID:9120
- C:\Windows\System\hTKMRPa.exe
  C:\Windows\System\hTKMRPa.exe
  2⤵
  PID:9188
- C:\Windows\System\IquDBxr.exe
  C:\Windows\System\IquDBxr.exe
  2⤵
  PID:8464
- C:\Windows\System\KeXMccr.exe
  C:\Windows\System\KeXMccr.exe
  2⤵
  PID:8612
- C:\Windows\System\AzKvylE.exe
  C:\Windows\System\AzKvylE.exe
  2⤵
  PID:8704
- C:\Windows\System\SRvYOpB.exe
  C:\Windows\System\SRvYOpB.exe
  2⤵
  PID:8912
- C:\Windows\System\YnmUFHe.exe
  C:\Windows\System\YnmUFHe.exe
  2⤵
  PID:9112
- C:\Windows\System\DmAHwvD.exe
  C:\Windows\System\DmAHwvD.exe
  2⤵
  PID:8216
- C:\Windows\System\xipiCez.exe
  C:\Windows\System\xipiCez.exe
  2⤵
  PID:8640
- C:\Windows\System\XyZerNF.exe
  C:\Windows\System\XyZerNF.exe
  2⤵
  PID:9208
- C:\Windows\System\ZLfMQSg.exe
  C:\Windows\System\ZLfMQSg.exe
  2⤵
  PID:9248
- C:\Windows\System\ofMEPJj.exe
  C:\Windows\System\ofMEPJj.exe
  2⤵
  PID:9264
- C:\Windows\System\wyJueFx.exe
  C:\Windows\System\wyJueFx.exe
  2⤵
  PID:9280
- C:\Windows\System\nKSYLil.exe
  C:\Windows\System\nKSYLil.exe
  2⤵
  PID:9304
- C:\Windows\System\OgEPirT.exe
  C:\Windows\System\OgEPirT.exe
  2⤵
  PID:9328
- C:\Windows\System\vBeGudN.exe
  C:\Windows\System\vBeGudN.exe
  2⤵
  PID:9352
- C:\Windows\System\AycVWgo.exe
  C:\Windows\System\AycVWgo.exe
  2⤵
  PID:9376
- C:\Windows\System\GKSjjqK.exe
  C:\Windows\System\GKSjjqK.exe
  2⤵
  PID:9400
- C:\Windows\System\LvhIVXd.exe
  C:\Windows\System\LvhIVXd.exe
  2⤵
  PID:9428
- C:\Windows\System\rwSuxxQ.exe
  C:\Windows\System\rwSuxxQ.exe
  2⤵
  PID:9456
- C:\Windows\System\CUDHVOe.exe
  C:\Windows\System\CUDHVOe.exe
  2⤵
  PID:9484
- C:\Windows\System\WgQVONZ.exe
  C:\Windows\System\WgQVONZ.exe
  2⤵
  PID:9512
- C:\Windows\System\ZjpYqiT.exe
  C:\Windows\System\ZjpYqiT.exe
  2⤵
  PID:9548
- C:\Windows\System\OAngDeC.exe
  C:\Windows\System\OAngDeC.exe
  2⤵
  PID:9576
- C:\Windows\System\BLSmGnB.exe
  C:\Windows\System\BLSmGnB.exe
  2⤵
  PID:9600
- C:\Windows\System\zwIDRiG.exe
  C:\Windows\System\zwIDRiG.exe
  2⤵
  PID:9628
- C:\Windows\System\USHhAHa.exe
  C:\Windows\System\USHhAHa.exe
  2⤵
  PID:9648
- C:\Windows\System\AwKecbw.exe
  C:\Windows\System\AwKecbw.exe
  2⤵
  PID:9664
- C:\Windows\System\WNpKMNy.exe
  C:\Windows\System\WNpKMNy.exe
  2⤵
  PID:9692
- C:\Windows\System\sjGSgyV.exe
  C:\Windows\System\sjGSgyV.exe
  2⤵
  PID:9724
- C:\Windows\System\GQABXBG.exe
  C:\Windows\System\GQABXBG.exe
  2⤵
  PID:9752
- C:\Windows\System\svDeyIZ.exe
  C:\Windows\System\svDeyIZ.exe
  2⤵
  PID:9788
- C:\Windows\System\IGGdixo.exe
  C:\Windows\System\IGGdixo.exe
  2⤵
  PID:9816
- C:\Windows\System\ymivpyx.exe
  C:\Windows\System\ymivpyx.exe
  2⤵
  PID:9848
- C:\Windows\System\OOvrGaa.exe
  C:\Windows\System\OOvrGaa.exe
  2⤵
  PID:9892
- C:\Windows\System\dKgwyHU.exe
  C:\Windows\System\dKgwyHU.exe
  2⤵
  PID:9912
- C:\Windows\System\LEwKwCH.exe
  C:\Windows\System\LEwKwCH.exe
  2⤵
  PID:9944
- C:\Windows\System\krvsnjU.exe
  C:\Windows\System\krvsnjU.exe
  2⤵
  PID:9972
- C:\Windows\System\ESMMhVR.exe
  C:\Windows\System\ESMMhVR.exe
  2⤵
  PID:10000
- C:\Windows\System\AuZCIvj.exe
  C:\Windows\System\AuZCIvj.exe
  2⤵
  PID:10040
- C:\Windows\System\NayokGS.exe
  C:\Windows\System\NayokGS.exe
  2⤵
  PID:10064
- C:\Windows\System\vCKakXA.exe
  C:\Windows\System\vCKakXA.exe
  2⤵
  PID:10080
- C:\Windows\System\lflNofm.exe
  C:\Windows\System\lflNofm.exe
  2⤵
  PID:10104
- C:\Windows\System\znqpOmU.exe
  C:\Windows\System\znqpOmU.exe
  2⤵
  PID:10124
- C:\Windows\System\cxMCHve.exe
  C:\Windows\System\cxMCHve.exe
  2⤵
  PID:10148
- C:\Windows\System\fDWJcMe.exe
  C:\Windows\System\fDWJcMe.exe
  2⤵
  PID:10184
- C:\Windows\System\BnqAgIm.exe
  C:\Windows\System\BnqAgIm.exe
  2⤵
  PID:10212
- C:\Windows\System\jhVSRIf.exe
  C:\Windows\System\jhVSRIf.exe
  2⤵
  PID:8496
- C:\Windows\System\zTqYYOi.exe
  C:\Windows\System\zTqYYOi.exe
  2⤵
  PID:8840
- C:\Windows\System\lPXMrAN.exe
  C:\Windows\System\lPXMrAN.exe
  2⤵
  PID:9272
- C:\Windows\System\NXnZlBB.exe
  C:\Windows\System\NXnZlBB.exe
  2⤵
  PID:9368
- C:\Windows\System\gquhPLt.exe
  C:\Windows\System\gquhPLt.exe
  2⤵
  PID:9364
- C:\Windows\System\VJXywhw.exe
  C:\Windows\System\VJXywhw.exe
  2⤵
  PID:9412
- C:\Windows\System\XoUtFux.exe
  C:\Windows\System\XoUtFux.exe
  2⤵
  PID:9544
- C:\Windows\System\VnNeUWo.exe
  C:\Windows\System\VnNeUWo.exe
  2⤵
  PID:9612
- C:\Windows\System\xpGJJlM.exe
  C:\Windows\System\xpGJJlM.exe
  2⤵
  PID:9716
- C:\Windows\System\fqqxBTw.exe
  C:\Windows\System\fqqxBTw.exe
  2⤵
  PID:9812
- C:\Windows\System\FNahnmC.exe
  C:\Windows\System\FNahnmC.exe
  2⤵
  PID:9740
- C:\Windows\System\BoKSKba.exe
  C:\Windows\System\BoKSKba.exe
  2⤵
  PID:9936
- C:\Windows\System\sgWMCYb.exe
  C:\Windows\System\sgWMCYb.exe
  2⤵
  PID:9992
- C:\Windows\System\JpxMKTp.exe
  C:\Windows\System\JpxMKTp.exe
  2⤵
  PID:9960
- C:\Windows\System\CqILmzd.exe
  C:\Windows\System\CqILmzd.exe
  2⤵
  PID:10076
- C:\Windows\System\HckrCQz.exe
  C:\Windows\System\HckrCQz.exe
  2⤵
  PID:10116
- C:\Windows\System\pJGEoqb.exe
  C:\Windows\System\pJGEoqb.exe
  2⤵
  PID:10208
- C:\Windows\System\ANIBYXj.exe
  C:\Windows\System\ANIBYXj.exe
  2⤵
  PID:10112
- C:\Windows\System\ALFTKoG.exe
  C:\Windows\System\ALFTKoG.exe
  2⤵
  PID:9224
- C:\Windows\System\marnolk.exe
  C:\Windows\System\marnolk.exe
  2⤵
  PID:9540
- C:\Windows\System\DotGzfH.exe
  C:\Windows\System\DotGzfH.exe
  2⤵
  PID:9420
- C:\Windows\System\toqwYiL.exe
  C:\Windows\System\toqwYiL.exe
  2⤵
  PID:9932
- C:\Windows\System\ZAEtBjB.exe
  C:\Windows\System\ZAEtBjB.exe
  2⤵
  PID:9880
- C:\Windows\System\EAvnnsK.exe
  C:\Windows\System\EAvnnsK.exe
  2⤵
  PID:9804
- C:\Windows\System\ekhliQS.exe
  C:\Windows\System\ekhliQS.exe
  2⤵
  PID:10220
- C:\Windows\System\FRQznVX.exe
  C:\Windows\System\FRQznVX.exe
  2⤵
  PID:10140
- C:\Windows\System\otaKTDL.exe
  C:\Windows\System\otaKTDL.exe
  2⤵
  PID:9324
- C:\Windows\System\rYqkyEI.exe
  C:\Windows\System\rYqkyEI.exe
  2⤵
  PID:9872
- C:\Windows\System\DJbwzKZ.exe
  C:\Windows\System\DJbwzKZ.exe
  2⤵
  PID:10260
- C:\Windows\System\xKWZvPR.exe
  C:\Windows\System\xKWZvPR.exe
  2⤵
  PID:10296
- C:\Windows\System\tGcazaD.exe
  C:\Windows\System\tGcazaD.exe
  2⤵
  PID:10324
- C:\Windows\System\mykVxhW.exe
  C:\Windows\System\mykVxhW.exe
  2⤵
  PID:10348
- C:\Windows\System\ILyFFgn.exe
  C:\Windows\System\ILyFFgn.exe
  2⤵
  PID:10384
- C:\Windows\System\XnJcoyu.exe
  C:\Windows\System\XnJcoyu.exe
  2⤵
  PID:10404
- C:\Windows\System\GdwJOwx.exe
  C:\Windows\System\GdwJOwx.exe
  2⤵
  PID:10436
- C:\Windows\System\DhlhQUW.exe
  C:\Windows\System\DhlhQUW.exe
  2⤵
  PID:10456
- C:\Windows\System\ToEiLkA.exe
  C:\Windows\System\ToEiLkA.exe
  2⤵
  PID:10472
- C:\Windows\System\gYZTlFg.exe
  C:\Windows\System\gYZTlFg.exe
  2⤵
  PID:10500
- C:\Windows\System\HgvyfWJ.exe
  C:\Windows\System\HgvyfWJ.exe
  2⤵
  PID:10524
- C:\Windows\System\HThTWpe.exe
  C:\Windows\System\HThTWpe.exe
  2⤵
  PID:10556
- C:\Windows\System\IECjXoT.exe
  C:\Windows\System\IECjXoT.exe
  2⤵
  PID:10592
- C:\Windows\System\NeHvgsT.exe
  C:\Windows\System\NeHvgsT.exe
  2⤵
  PID:10620
- C:\Windows\System\SblgJqs.exe
  C:\Windows\System\SblgJqs.exe
  2⤵
  PID:10640
- C:\Windows\System\RmuXpav.exe
  C:\Windows\System\RmuXpav.exe
  2⤵
  PID:10696
- C:\Windows\System\xrLjFEl.exe
  C:\Windows\System\xrLjFEl.exe
  2⤵
  PID:10716
- C:\Windows\System\nLTQhwF.exe
  C:\Windows\System\nLTQhwF.exe
  2⤵
  PID:10736
- C:\Windows\System\TsDyzeb.exe
  C:\Windows\System\TsDyzeb.exe
  2⤵
  PID:10756
- C:\Windows\System\cyUrhGa.exe
  C:\Windows\System\cyUrhGa.exe
  2⤵
  PID:10784
- C:\Windows\System\FeoPJad.exe
  C:\Windows\System\FeoPJad.exe
  2⤵
  PID:10812
- C:\Windows\System\itSigMu.exe
  C:\Windows\System\itSigMu.exe
  2⤵
  PID:10832
- C:\Windows\System\zWVqAUR.exe
  C:\Windows\System\zWVqAUR.exe
  2⤵
  PID:10860
- C:\Windows\System\HnUXVwR.exe
  C:\Windows\System\HnUXVwR.exe
  2⤵
  PID:10880
- C:\Windows\System\cojUYBK.exe
  C:\Windows\System\cojUYBK.exe
  2⤵
  PID:10904
- C:\Windows\System\hwvbQwn.exe
  C:\Windows\System\hwvbQwn.exe
  2⤵
  PID:10932
- C:\Windows\System\LVjlARs.exe
  C:\Windows\System\LVjlARs.exe
  2⤵
  PID:10960
- C:\Windows\System\CsdlejR.exe
  C:\Windows\System\CsdlejR.exe
  2⤵
  PID:10984
- C:\Windows\System\RqEmzzw.exe
  C:\Windows\System\RqEmzzw.exe
  2⤵
  PID:11016
- C:\Windows\System\vSafJgI.exe
  C:\Windows\System\vSafJgI.exe
  2⤵
  PID:11048
- C:\Windows\System\vHdJRcc.exe
  C:\Windows\System\vHdJRcc.exe
  2⤵
  PID:11080
- C:\Windows\System\nPmVzdS.exe
  C:\Windows\System\nPmVzdS.exe
  2⤵
  PID:11104
- C:\Windows\System\aZnsLjV.exe
  C:\Windows\System\aZnsLjV.exe
  2⤵
  PID:11136
- C:\Windows\System\MXKrEUk.exe
  C:\Windows\System\MXKrEUk.exe
  2⤵
  PID:11168
- C:\Windows\System\LZBtzPi.exe
  C:\Windows\System\LZBtzPi.exe
  2⤵
  PID:11196
- C:\Windows\System\oTZVMhs.exe
  C:\Windows\System\oTZVMhs.exe
  2⤵
  PID:11224
- C:\Windows\System\GPRvDce.exe
  C:\Windows\System\GPRvDce.exe
  2⤵
  PID:11252
- C:\Windows\System\GOFfYzr.exe
  C:\Windows\System\GOFfYzr.exe
  2⤵
  PID:9700
- C:\Windows\System\rSNjQnZ.exe
  C:\Windows\System\rSNjQnZ.exe
  2⤵
  PID:10304
- C:\Windows\System\wCXfyvU.exe
  C:\Windows\System\wCXfyvU.exe
  2⤵
  PID:10072
- C:\Windows\System\qmUjQsH.exe
  C:\Windows\System\qmUjQsH.exe
  2⤵
  PID:10312
- C:\Windows\System\lVirfBL.exe
  C:\Windows\System\lVirfBL.exe
  2⤵
  PID:10444
- C:\Windows\System\UWyiAHA.exe
  C:\Windows\System\UWyiAHA.exe
  2⤵
  PID:9020
- C:\Windows\System\sclFbCw.exe
  C:\Windows\System\sclFbCw.exe
  2⤵
  PID:10616
- C:\Windows\System\vbvrFWA.exe
  C:\Windows\System\vbvrFWA.exe
  2⤵
  PID:10628
- C:\Windows\System\iykwiqQ.exe
  C:\Windows\System\iykwiqQ.exe
  2⤵
  PID:10780
- C:\Windows\System\DOZcHxL.exe
  C:\Windows\System\DOZcHxL.exe
  2⤵
  PID:10820
- C:\Windows\System\OHMEhWa.exe
  C:\Windows\System\OHMEhWa.exe
  2⤵
  PID:10848
- C:\Windows\System\tCmINNU.exe
  C:\Windows\System\tCmINNU.exe
  2⤵
  PID:10920
- C:\Windows\System\yeJcUkS.exe
  C:\Windows\System\yeJcUkS.exe
  2⤵
  PID:10980
- C:\Windows\System\sZCssmJ.exe
  C:\Windows\System\sZCssmJ.exe
  2⤵
  PID:10916
- C:\Windows\System\RkasJcu.exe
  C:\Windows\System\RkasJcu.exe
  2⤵
  PID:11132
- C:\Windows\System\TwvaRZf.exe
  C:\Windows\System\TwvaRZf.exe
  2⤵
  PID:11064
- C:\Windows\System\KjoWPJR.exe
  C:\Windows\System\KjoWPJR.exe
  2⤵
  PID:10248
- C:\Windows\System\yvYQkMO.exe
  C:\Windows\System\yvYQkMO.exe
  2⤵
  PID:11216
- C:\Windows\System\JpUpPGp.exe
  C:\Windows\System\JpUpPGp.exe
  2⤵
  PID:10276
- C:\Windows\System\RvVUhbX.exe
  C:\Windows\System\RvVUhbX.exe
  2⤵
  PID:10488
- C:\Windows\System\whdTLdD.exe
  C:\Windows\System\whdTLdD.exe
  2⤵
  PID:10656
- C:\Windows\System\RqvZHxx.exe
  C:\Windows\System\RqvZHxx.exe
  2⤵
  PID:10872
- C:\Windows\System\kKkEinT.exe
  C:\Windows\System\kKkEinT.exe
  2⤵
  PID:11120
- C:\Windows\System\WyiHBQm.exe
  C:\Windows\System\WyiHBQm.exe
  2⤵
  PID:10396
- C:\Windows\System\qTWowNP.exe
  C:\Windows\System\qTWowNP.exe
  2⤵
  PID:10496
- C:\Windows\System\rsjoNrm.exe
  C:\Windows\System\rsjoNrm.exe
  2⤵
  PID:10452
- C:\Windows\System\mXmXKmP.exe
  C:\Windows\System\mXmXKmP.exe
  2⤵
  PID:11288
- C:\Windows\System\DODfZoa.exe
  C:\Windows\System\DODfZoa.exe
  2⤵
  PID:11316
- C:\Windows\System\JvdBMjX.exe
  C:\Windows\System\JvdBMjX.exe
  2⤵
  PID:11336
- C:\Windows\System\HYcIWmM.exe
  C:\Windows\System\HYcIWmM.exe
  2⤵
  PID:11356
- C:\Windows\System\TTsENuu.exe
  C:\Windows\System\TTsENuu.exe
  2⤵
  PID:11384
- C:\Windows\System\ISmeRVH.exe
  C:\Windows\System\ISmeRVH.exe
  2⤵
  PID:11420
- C:\Windows\System\ixrtATa.exe
  C:\Windows\System\ixrtATa.exe
  2⤵
  PID:11444
- C:\Windows\System\CwBNaZl.exe
  C:\Windows\System\CwBNaZl.exe
  2⤵
  PID:11476
- C:\Windows\System\EJiFNYH.exe
  C:\Windows\System\EJiFNYH.exe
  2⤵
  PID:11512
- C:\Windows\System\CxLZPoQ.exe
  C:\Windows\System\CxLZPoQ.exe
  2⤵
  PID:11532
- C:\Windows\System\JgLZSNM.exe
  C:\Windows\System\JgLZSNM.exe
  2⤵
  PID:11560
- C:\Windows\System\XuYDHYX.exe
  C:\Windows\System\XuYDHYX.exe
  2⤵
  PID:11580
- C:\Windows\System\EwtIfpr.exe
  C:\Windows\System\EwtIfpr.exe
  2⤵
  PID:11604
- C:\Windows\System\aYgIzwG.exe
  C:\Windows\System\aYgIzwG.exe
  2⤵
  PID:11624
- C:\Windows\System\CbOcItV.exe
  C:\Windows\System\CbOcItV.exe
  2⤵
  PID:11652
- C:\Windows\System\YiCyywD.exe
  C:\Windows\System\YiCyywD.exe
  2⤵
  PID:11672
- C:\Windows\System\PMztpJP.exe
  C:\Windows\System\PMztpJP.exe
  2⤵
  PID:11700
- C:\Windows\System\yYaaRMh.exe
  C:\Windows\System\yYaaRMh.exe
  2⤵
  PID:11732
- C:\Windows\System\cmweosJ.exe
  C:\Windows\System\cmweosJ.exe
  2⤵
  PID:11756
- C:\Windows\System\wYCREjk.exe
  C:\Windows\System\wYCREjk.exe
  2⤵
  PID:11780
- C:\Windows\System\hTArUVT.exe
  C:\Windows\System\hTArUVT.exe
  2⤵
  PID:11812
- C:\Windows\System\sqthdfK.exe
  C:\Windows\System\sqthdfK.exe
  2⤵
  PID:11848
- C:\Windows\System\ECFjYTk.exe
  C:\Windows\System\ECFjYTk.exe
  2⤵
  PID:11880
- C:\Windows\System\RyoPUsO.exe
  C:\Windows\System\RyoPUsO.exe
  2⤵
  PID:11904
- C:\Windows\System\EvnLKqE.exe
  C:\Windows\System\EvnLKqE.exe
  2⤵
  PID:11944
- C:\Windows\System\odDXpyY.exe
  C:\Windows\System\odDXpyY.exe
  2⤵
  PID:11964
- C:\Windows\System\KRmmJIM.exe
  C:\Windows\System\KRmmJIM.exe
  2⤵
  PID:11992
- C:\Windows\System\PuMwDsY.exe
  C:\Windows\System\PuMwDsY.exe
  2⤵
  PID:12032
- C:\Windows\System\yRNmrrr.exe
  C:\Windows\System\yRNmrrr.exe
  2⤵
  PID:12064
- C:\Windows\System\JqiLeOD.exe
  C:\Windows\System\JqiLeOD.exe
  2⤵
  PID:12092
- C:\Windows\System\GEUZcFd.exe
  C:\Windows\System\GEUZcFd.exe
  2⤵
  PID:12112
- C:\Windows\System\NQQuHnf.exe
  C:\Windows\System\NQQuHnf.exe
  2⤵
  PID:12136
- C:\Windows\System\qVpnpbd.exe
  C:\Windows\System\qVpnpbd.exe
  2⤵
  PID:12172
- C:\Windows\System\mcTbexa.exe
  C:\Windows\System\mcTbexa.exe
  2⤵
  PID:12192
- C:\Windows\System\nSwyunZ.exe
  C:\Windows\System\nSwyunZ.exe
  2⤵
  PID:12220
- C:\Windows\System\HsyjFNN.exe
  C:\Windows\System\HsyjFNN.exe
  2⤵
  PID:12248
- C:\Windows\System\hTTrEgM.exe
  C:\Windows\System\hTTrEgM.exe
  2⤵
  PID:12276
- C:\Windows\System\aqZIVWm.exe
  C:\Windows\System\aqZIVWm.exe
  2⤵
  PID:11072
- C:\Windows\System\lQGYaVo.exe
  C:\Windows\System\lQGYaVo.exe
  2⤵
  PID:10944
- C:\Windows\System\fBmbKNe.exe
  C:\Windows\System\fBmbKNe.exe
  2⤵
  PID:11188
- C:\Windows\System\YHJVzFi.exe
  C:\Windows\System\YHJVzFi.exe
  2⤵
  PID:11268
- C:\Windows\System\cwoYouh.exe
  C:\Windows\System\cwoYouh.exe
  2⤵
  PID:11324
- C:\Windows\System\rJvZWmY.exe
  C:\Windows\System\rJvZWmY.exe
  2⤵
  PID:11460
- C:\Windows\System\hTeSZUr.exe
  C:\Windows\System\hTeSZUr.exe
  2⤵
  PID:11592
- C:\Windows\System\HQpeuzy.exe
  C:\Windows\System\HQpeuzy.exe
  2⤵
  PID:11556
- C:\Windows\System\oNzWVRF.exe
  C:\Windows\System\oNzWVRF.exe
  2⤵
  PID:11680
- C:\Windows\System\BQrKOlf.exe
  C:\Windows\System\BQrKOlf.exe
  2⤵
  PID:11776
- C:\Windows\System\oDYYUfh.exe
  C:\Windows\System\oDYYUfh.exe
  2⤵
  PID:11876
- C:\Windows\System\xIDSyVe.exe
  C:\Windows\System\xIDSyVe.exe
  2⤵
  PID:11752
- C:\Windows\System\niYMWmM.exe
  C:\Windows\System\niYMWmM.exe
  2⤵
  PID:12012
- C:\Windows\System\tmhZLUd.exe
  C:\Windows\System\tmhZLUd.exe
  2⤵
  PID:11924
- C:\Windows\System\SyeZVMz.exe
  C:\Windows\System\SyeZVMz.exe
  2⤵
  PID:11932
- C:\Windows\System\okcSACZ.exe
  C:\Windows\System\okcSACZ.exe
  2⤵
  PID:12144
- C:\Windows\System\rHzBgTd.exe
  C:\Windows\System\rHzBgTd.exe
  2⤵
  PID:12160
- C:\Windows\System\EbBeMoK.exe
  C:\Windows\System\EbBeMoK.exe
  2⤵
  PID:12200
- C:\Windows\System\ObelSFN.exe
  C:\Windows\System\ObelSFN.exe
  2⤵
  PID:10512
- C:\Windows\System\pSQSsud.exe
  C:\Windows\System\pSQSsud.exe
  2⤵
  PID:12244
- C:\Windows\System\HViBdLL.exe
  C:\Windows\System\HViBdLL.exe
  2⤵
  PID:11600
- C:\Windows\System\uSYaLmd.exe
  C:\Windows\System\uSYaLmd.exe
  2⤵
  PID:11716
- C:\Windows\System\axTkcgJ.exe
  C:\Windows\System\axTkcgJ.exe
  2⤵
  PID:11988
- C:\Windows\System\GvByBMC.exe
  C:\Windows\System\GvByBMC.exe
  2⤵
  PID:12132
- C:\Windows\System\OYWXlBQ.exe
  C:\Windows\System\OYWXlBQ.exe
  2⤵
  PID:11836
- C:\Windows\System\TXcHOUm.exe
  C:\Windows\System\TXcHOUm.exe
  2⤵
  PID:11844
- C:\Windows\System\JDsXzVX.exe
  C:\Windows\System\JDsXzVX.exe
  2⤵
  PID:11364
- C:\Windows\System\xMMVVsO.exe
  C:\Windows\System\xMMVVsO.exe
  2⤵
  PID:11416
- C:\Windows\System\gdaUeOz.exe
  C:\Windows\System\gdaUeOz.exe
  2⤵
  PID:12316
- C:\Windows\System\fwdqOBe.exe
  C:\Windows\System\fwdqOBe.exe
  2⤵
  PID:12332
- C:\Windows\System\ZUFEzDM.exe
  C:\Windows\System\ZUFEzDM.exe
  2⤵
  PID:12356
- C:\Windows\System\MBgMtQA.exe
  C:\Windows\System\MBgMtQA.exe
  2⤵
  PID:12392
- C:\Windows\System\SIFABoM.exe
  C:\Windows\System\SIFABoM.exe
  2⤵
  PID:12408
- C:\Windows\System\xaeuvJT.exe
  C:\Windows\System\xaeuvJT.exe
  2⤵
  PID:12424
- C:\Windows\System\LjDVeYb.exe
  C:\Windows\System\LjDVeYb.exe
  2⤵
  PID:12456
- C:\Windows\System\GbhYQIb.exe
  C:\Windows\System\GbhYQIb.exe
  2⤵
  PID:12488
- C:\Windows\System\bAfoavw.exe
  C:\Windows\System\bAfoavw.exe
  2⤵
  PID:12516
- C:\Windows\System\BEJwQoe.exe
  C:\Windows\System\BEJwQoe.exe
  2⤵
  PID:12540
- C:\Windows\System\ZKLPRFa.exe
  C:\Windows\System\ZKLPRFa.exe
  2⤵
  PID:12560
- C:\Windows\System\YRdltzF.exe
  C:\Windows\System\YRdltzF.exe
  2⤵
  PID:12604
- C:\Windows\System\GsfuESW.exe
  C:\Windows\System\GsfuESW.exe
  2⤵
  PID:12628
- C:\Windows\System\HXursnO.exe
  C:\Windows\System\HXursnO.exe
  2⤵
  PID:12660
- C:\Windows\System\UBmZfVB.exe
  C:\Windows\System\UBmZfVB.exe
  2⤵
  PID:12696
- C:\Windows\System\izNmcsP.exe
  C:\Windows\System\izNmcsP.exe
  2⤵
  PID:12724
- C:\Windows\System\cbftopk.exe
  C:\Windows\System\cbftopk.exe
  2⤵
  PID:12748
- C:\Windows\System\TUeRDzu.exe
  C:\Windows\System\TUeRDzu.exe
  2⤵
  PID:12776
- C:\Windows\System\MWHPMbw.exe
  C:\Windows\System\MWHPMbw.exe
  2⤵
  PID:12800
- C:\Windows\System\IBMjQCN.exe
  C:\Windows\System\IBMjQCN.exe
  2⤵
  PID:12820
- C:\Windows\System\RxaQSdk.exe
  C:\Windows\System\RxaQSdk.exe
  2⤵
  PID:12848
- C:\Windows\System\HVNWntV.exe
  C:\Windows\System\HVNWntV.exe
  2⤵
  PID:12876
- C:\Windows\System\zWmpVzq.exe
  C:\Windows\System\zWmpVzq.exe
  2⤵
  PID:12956
- C:\Windows\System\SpPKDxu.exe
  C:\Windows\System\SpPKDxu.exe
  2⤵
  PID:12984
- C:\Windows\System\ZIdZdUu.exe
  C:\Windows\System\ZIdZdUu.exe
  2⤵
  PID:13016
- C:\Windows\System\dWhSnbf.exe
  C:\Windows\System\dWhSnbf.exe
  2⤵
  PID:13032
- C:\Windows\System\ckHrJaf.exe
  C:\Windows\System\ckHrJaf.exe
  2⤵
  PID:13064
- C:\Windows\System\WbKJNdX.exe
  C:\Windows\System\WbKJNdX.exe
  2⤵
  PID:13084
- C:\Windows\System\YmhpCeE.exe
  C:\Windows\System\YmhpCeE.exe
  2⤵
  PID:13112
- C:\Windows\System\hVLeGqK.exe
  C:\Windows\System\hVLeGqK.exe
  2⤵
  PID:13136
- C:\Windows\System\OCCvaAW.exe
  C:\Windows\System\OCCvaAW.exe
  2⤵
  PID:13168
- C:\Windows\System\iRixZFw.exe
  C:\Windows\System\iRixZFw.exe
  2⤵
  PID:13196
- C:\Windows\System\vqgoFXb.exe
  C:\Windows\System\vqgoFXb.exe
  2⤵
  PID:13220
- C:\Windows\System\JMNGcdn.exe
  C:\Windows\System\JMNGcdn.exe
  2⤵
  PID:13236
- C:\Windows\System\UpYtiMf.exe
  C:\Windows\System\UpYtiMf.exe
  2⤵
  PID:13276
- C:\Windows\System\xzwiBWJ.exe
  C:\Windows\System\xzwiBWJ.exe
  2⤵
  PID:13300
- C:\Windows\System\uwAPfWw.exe
  C:\Windows\System\uwAPfWw.exe
  2⤵
  PID:10728
- C:\Windows\System\xHIIyjQ.exe
  C:\Windows\System\xHIIyjQ.exe
  2⤵
  PID:11372
- C:\Windows\System\ekPcxFI.exe
  C:\Windows\System\ekPcxFI.exe
  2⤵
  PID:12188
- C:\Windows\System\oyheqEF.exe
  C:\Windows\System\oyheqEF.exe
  2⤵
  PID:11696
- C:\Windows\System\TsZcGoO.exe
  C:\Windows\System\TsZcGoO.exe
  2⤵
  PID:12436
- C:\Windows\System\wZlgaGO.exe
  C:\Windows\System\wZlgaGO.exe
  2⤵
  PID:12532
- C:\Windows\System\zyAmxed.exe
  C:\Windows\System\zyAmxed.exe
  2⤵
  PID:12584
- C:\Windows\System\oJYAKCB.exe
  C:\Windows\System\oJYAKCB.exe
  2⤵
  PID:12652
- C:\Windows\System\sHHbvnQ.exe
  C:\Windows\System\sHHbvnQ.exe
  2⤵
  PID:12468
- C:\Windows\System\FMkjpla.exe
  C:\Windows\System\FMkjpla.exe
  2⤵
  PID:12764
- C:\Windows\System\Upqqeqy.exe
  C:\Windows\System\Upqqeqy.exe
  2⤵
  PID:12812
- C:\Windows\System\MHEGLEO.exe
  C:\Windows\System\MHEGLEO.exe
  2⤵
  PID:12788
- C:\Windows\System\NsPCinT.exe
  C:\Windows\System\NsPCinT.exe
  2⤵
  PID:13056
- C:\Windows\System\ETQjGeN.exe
  C:\Windows\System\ETQjGeN.exe
  2⤵
  PID:12868
- C:\Windows\System\WJIREfW.exe
  C:\Windows\System\WJIREfW.exe
  2⤵
  PID:13024
- C:\Windows\System\vgZSEqX.exe
  C:\Windows\System\vgZSEqX.exe
  2⤵
  PID:13192
- C:\Windows\System\qnYVHvU.exe
  C:\Windows\System\qnYVHvU.exe
  2⤵
  PID:13308
- C:\Windows\System\MxMFIXr.exe
  C:\Windows\System\MxMFIXr.exe
  2⤵
  PID:12024
- C:\Windows\System\BTszlRp.exe
  C:\Windows\System\BTszlRp.exe
  2⤵
  PID:12472
- C:\Windows\System\FphrrqW.exe
  C:\Windows\System\FphrrqW.exe
  2⤵
  PID:12384
- C:\Windows\System\ihlJMKy.exe
  C:\Windows\System\ihlJMKy.exe
  2⤵
  PID:12512
- C:\Windows\System\DXWOvFJ.exe
  C:\Windows\System\DXWOvFJ.exe
  2⤵
  PID:12100
- C:\Windows\System\XiNeLqk.exe
  C:\Windows\System\XiNeLqk.exe
  2⤵
  PID:13208
- C:\Windows\System\OlxhhnS.exe
  C:\Windows\System\OlxhhnS.exe
  2⤵
  PID:13264
- C:\Windows\System\IaKLpJz.exe
  C:\Windows\System\IaKLpJz.exe
  2⤵
  PID:13324
- C:\Windows\System\JcYikAZ.exe
  C:\Windows\System\JcYikAZ.exe
  2⤵
  PID:13348
- C:\Windows\System\RPUSWNp.exe
  C:\Windows\System\RPUSWNp.exe
  2⤵
  PID:13376
- C:\Windows\System\VsnWzWx.exe
  C:\Windows\System\VsnWzWx.exe
  2⤵
  PID:13396
- C:\Windows\System\hJBRmkv.exe
  C:\Windows\System\hJBRmkv.exe
  2⤵
  PID:13432
- C:\Windows\System\MoQdQWf.exe
  C:\Windows\System\MoQdQWf.exe
  2⤵
  PID:13456
- C:\Windows\System\tbILjgd.exe
  C:\Windows\System\tbILjgd.exe
  2⤵
  PID:13480
- C:\Windows\System\vnnmuVA.exe
  C:\Windows\System\vnnmuVA.exe
  2⤵
  PID:13504
- C:\Windows\System\iGsPnNn.exe
  C:\Windows\System\iGsPnNn.exe
  2⤵
  PID:13520
- C:\Windows\System\BBzqRvf.exe
  C:\Windows\System\BBzqRvf.exe
  2⤵
  PID:13540
- C:\Windows\System\kOEDDhu.exe
  C:\Windows\System\kOEDDhu.exe
  2⤵
  PID:13568
- C:\Windows\System\AIxCvpL.exe
  C:\Windows\System\AIxCvpL.exe
  2⤵
  PID:13596
- C:\Windows\System\YRqyQTX.exe
  C:\Windows\System\YRqyQTX.exe
  2⤵
  PID:13620
- C:\Windows\System\oUGPCdl.exe
  C:\Windows\System\oUGPCdl.exe
  2⤵
  PID:13648
- C:\Windows\System\zMkDCio.exe
  C:\Windows\System\zMkDCio.exe
  2⤵
  PID:13672
- C:\Windows\System\uKgzLoF.exe
  C:\Windows\System\uKgzLoF.exe
  2⤵
  PID:13700
- C:\Windows\System\NIUldbA.exe
  C:\Windows\System\NIUldbA.exe
  2⤵
  PID:13724
- C:\Windows\System\tUPtysn.exe
  C:\Windows\System\tUPtysn.exe
  2⤵
  PID:13756
- C:\Windows\System\QFGBZfA.exe
  C:\Windows\System\QFGBZfA.exe
  2⤵
  PID:13772
- C:\Windows\System\pZRCOjf.exe
  C:\Windows\System\pZRCOjf.exe
  2⤵
  PID:13796
- C:\Windows\System\utFfFac.exe
  C:\Windows\System\utFfFac.exe
  2⤵
  PID:13832
- C:\Windows\System\ETnuWsR.exe
  C:\Windows\System\ETnuWsR.exe
  2⤵
  PID:13860
- C:\Windows\System\qSRpbAd.exe
  C:\Windows\System\qSRpbAd.exe
  2⤵
  PID:13880
- C:\Windows\System\aXPdolq.exe
  C:\Windows\System\aXPdolq.exe
  2⤵
  PID:13904
- C:\Windows\System\KgiBjaw.exe
  C:\Windows\System\KgiBjaw.exe
  2⤵
  PID:13948
- C:\Windows\System\uviJFQe.exe
  C:\Windows\System\uviJFQe.exe
  2⤵
  PID:13972
- C:\Windows\System\fSMgqfy.exe
  C:\Windows\System\fSMgqfy.exe
  2⤵
  PID:14004
- C:\Windows\System\dFVNqLk.exe
  C:\Windows\System\dFVNqLk.exe
  2⤵
  PID:14028
- C:\Windows\System\eJJjrOb.exe
  C:\Windows\System\eJJjrOb.exe
  2⤵
  PID:14060
- C:\Windows\System\MPjDOjw.exe
  C:\Windows\System\MPjDOjw.exe
  2⤵
  PID:14088
- C:\Windows\System\ptoJqAm.exe
  C:\Windows\System\ptoJqAm.exe
  2⤵
  PID:14112
- C:\Windows\System\TpaQDxQ.exe
  C:\Windows\System\TpaQDxQ.exe
  2⤵
  PID:14136
- C:\Windows\System\uKKFrZq.exe
  C:\Windows\System\uKKFrZq.exe
  2⤵
  PID:14168
- C:\Windows\System\iAwTfkr.exe
  C:\Windows\System\iAwTfkr.exe
  2⤵
  PID:14188
- C:\Windows\System\uboxlXM.exe
  C:\Windows\System\uboxlXM.exe
  2⤵
  PID:14212
- C:\Windows\System\CEgiUjv.exe
  C:\Windows\System\CEgiUjv.exe
  2⤵
  PID:14240
- C:\Windows\System\VmWRVNn.exe
  C:\Windows\System\VmWRVNn.exe
  2⤵
  PID:14260
- C:\Windows\System\JjmPasK.exe
  C:\Windows\System\JjmPasK.exe
  2⤵
  PID:14280
- C:\Windows\System\SRoeRyN.exe
  C:\Windows\System\SRoeRyN.exe
  2⤵
  PID:14316
- C:\Windows\System\nTVeiRj.exe
  C:\Windows\System\nTVeiRj.exe
  2⤵
  PID:13296
- C:\Windows\System\kTnqTAc.exe
  C:\Windows\System\kTnqTAc.exe
  2⤵
  PID:13124
- C:\Windows\System\KpILhZo.exe
  C:\Windows\System\KpILhZo.exe
  2⤵
  PID:12552
- C:\Windows\System\wwcvhLk.exe
  C:\Windows\System\wwcvhLk.exe
  2⤵
  PID:13420
- C:\Windows\System\YMSCjOr.exe
  C:\Windows\System\YMSCjOr.exe
  2⤵
  PID:13388
- C:\Windows\System\uPUgjSL.exe
  C:\Windows\System\uPUgjSL.exe
  2⤵
  PID:13516
- C:\Windows\System\wtShTUq.exe
  C:\Windows\System\wtShTUq.exe
  2⤵
  PID:13528
- C:\Windows\System\uPjpzzz.exe
  C:\Windows\System\uPjpzzz.exe
  2⤵
  PID:13632
- C:\Windows\System\TCnzDMh.exe
  C:\Windows\System\TCnzDMh.exe
  2⤵
  PID:13604
- C:\Windows\System\iSzMoad.exe
  C:\Windows\System\iSzMoad.exe
  2⤵
  PID:13764
- C:\Windows\System\xqvjKZs.exe
  C:\Windows\System\xqvjKZs.exe
  2⤵
  PID:13848
- C:\Windows\System\OaQVMIX.exe
  C:\Windows\System\OaQVMIX.exe
  2⤵
  PID:13872
- C:\Windows\System\LbfqpAO.exe
  C:\Windows\System\LbfqpAO.exe
  2⤵
  PID:14124
- C:\Windows\System\zxoHNQC.exe
  C:\Windows\System\zxoHNQC.exe
  2⤵
  PID:13916
- C:\Windows\System\AwPeuRD.exe
  C:\Windows\System\AwPeuRD.exe
  2⤵
  PID:13960
- C:\Windows\System\pufjGeA.exe
  C:\Windows\System\pufjGeA.exe
  2⤵
  PID:14012
- C:\Windows\System\UYOGgUG.exe
  C:\Windows\System\UYOGgUG.exe
  2⤵
  PID:13372
- C:\Windows\System\guMmqMF.exe
  C:\Windows\System\guMmqMF.exe
  2⤵
  PID:13992
- C:\Windows\System\baYTnmE.exe
  C:\Windows\System\baYTnmE.exe
  2⤵
  PID:13712
- C:\Windows\System\KbKjhCe.exe
  C:\Windows\System\KbKjhCe.exe
  2⤵
  PID:13816
- C:\Windows\System\GlvHyHp.exe
  C:\Windows\System\GlvHyHp.exe
  2⤵
  PID:14104
- C:\Windows\System\tPRgmil.exe
  C:\Windows\System\tPRgmil.exe
  2⤵
  PID:14276
- C:\Windows\System\fUMAgrL.exe
  C:\Windows\System\fUMAgrL.exe
  2⤵
  PID:14252
- C:\Windows\System\kCBUNdr.exe
  C:\Windows\System\kCBUNdr.exe
  2⤵
  PID:13828
- C:\Windows\System\ljEqeAo.exe
  C:\Windows\System\ljEqeAo.exe
  2⤵
  PID:14200
- C:\Windows\System\Vptxirk.exe
  C:\Windows\System\Vptxirk.exe
  2⤵
  PID:13364
- C:\Windows\System\sMmYjDb.exe
  C:\Windows\System\sMmYjDb.exe
  2⤵
  PID:12600
- C:\Windows\System\YaEbevB.exe
  C:\Windows\System\YaEbevB.exe
  2⤵
  PID:14352
- C:\Windows\System\edATAFE.exe
  C:\Windows\System\edATAFE.exe
  2⤵
  PID:14368
- C:\Windows\System\TwHSkaL.exe
  C:\Windows\System\TwHSkaL.exe
  2⤵
  PID:14384
- C:\Windows\System\IBzUzQB.exe
  C:\Windows\System\IBzUzQB.exe
  2⤵
  PID:14408
- C:\Windows\System\pjVyBwh.exe
  C:\Windows\System\pjVyBwh.exe
  2⤵
  PID:14432
- C:\Windows\System\Npmdoja.exe
  C:\Windows\System\Npmdoja.exe
  2⤵
  PID:14460
- C:\Windows\System\exLcEon.exe
  C:\Windows\System\exLcEon.exe
  2⤵
  PID:14488
- C:\Windows\System\OVCFytT.exe
  C:\Windows\System\OVCFytT.exe
  2⤵
  PID:14512
- C:\Windows\System\nxEeVkf.exe
  C:\Windows\System\nxEeVkf.exe
  2⤵
  PID:14540
- C:\Windows\System\fqHMEFv.exe
  C:\Windows\System\fqHMEFv.exe
  2⤵
  PID:14568
- C:\Windows\System\RFiCsbO.exe
  C:\Windows\System\RFiCsbO.exe
  2⤵
  PID:14604
- C:\Windows\System\pYnwRPm.exe
  C:\Windows\System\pYnwRPm.exe
  2⤵
  PID:14628
- C:\Windows\System\yQmhSgS.exe
  C:\Windows\System\yQmhSgS.exe
  2⤵
  PID:14652
- C:\Windows\System\jPqzmfi.exe
  C:\Windows\System\jPqzmfi.exe
  2⤵
  PID:14676
- C:\Windows\System\mIaxLZz.exe
  C:\Windows\System\mIaxLZz.exe
  2⤵
  PID:14692
- C:\Windows\System\oXnnKGL.exe
  C:\Windows\System\oXnnKGL.exe
  2⤵
  PID:14720
- C:\Windows\System\JcmiYYA.exe
  C:\Windows\System\JcmiYYA.exe
  2⤵
  PID:14748
- C:\Windows\System\hZKVCGr.exe
  C:\Windows\System\hZKVCGr.exe
  2⤵
  PID:14764
- C:\Windows\System\JQlbtEz.exe
  C:\Windows\System\JQlbtEz.exe
  2⤵
  PID:14792
- C:\Windows\System\MGXsqvO.exe
  C:\Windows\System\MGXsqvO.exe
  2⤵
  PID:14820
- C:\Windows\System\YIZZshh.exe
  C:\Windows\System\YIZZshh.exe
  2⤵
  PID:14848
- C:\Windows\System\yeWExSw.exe
  C:\Windows\System\yeWExSw.exe
  2⤵
  PID:14868
- C:\Windows\System\hAZKpRK.exe
  C:\Windows\System\hAZKpRK.exe
  2⤵
  PID:14900
- C:\Windows\System\qOKvxDi.exe
  C:\Windows\System\qOKvxDi.exe
  2⤵
  PID:14936
- C:\Windows\System\CuJMkuV.exe
  C:\Windows\System\CuJMkuV.exe
  2⤵
  PID:14956
- C:\Windows\System\grMCzKK.exe
  C:\Windows\System\grMCzKK.exe
  2⤵
  PID:14980
- C:\Windows\System\Qcijwgv.exe
  C:\Windows\System\Qcijwgv.exe
  2⤵
  PID:15012
- C:\Windows\System\oxtFtxy.exe
  C:\Windows\System\oxtFtxy.exe
  2⤵
  PID:15036
- C:\Windows\System\XbPONbJ.exe
  C:\Windows\System\XbPONbJ.exe
  2⤵
  PID:15060
- C:\Windows\System\ELlxqnv.exe
  C:\Windows\System\ELlxqnv.exe
  2⤵
  PID:15088
- C:\Windows\System\miIBkmW.exe
  C:\Windows\System\miIBkmW.exe
  2⤵
  PID:15112
- C:\Windows\System\TNLiuij.exe
  C:\Windows\System\TNLiuij.exe
  2⤵
  PID:15136
- C:\Windows\System\YNuRpIu.exe
  C:\Windows\System\YNuRpIu.exe
  2⤵
  PID:15164
- C:\Windows\System\XwQOiqV.exe
  C:\Windows\System\XwQOiqV.exe
  2⤵
  PID:15196
- C:\Windows\System\zMTgpvn.exe
  C:\Windows\System\zMTgpvn.exe
  2⤵
  PID:15220
- C:\Windows\System\QyyRWRn.exe
  C:\Windows\System\QyyRWRn.exe
  2⤵
  PID:15252
- C:\Windows\System\YfdfvNv.exe
  C:\Windows\System\YfdfvNv.exe
  2⤵
  PID:15280
- C:\Windows\System\UjGvcfQ.exe
  C:\Windows\System\UjGvcfQ.exe
  2⤵
  PID:15304
- C:\Windows\System\YplTnVN.exe
  C:\Windows\System\YplTnVN.exe
  2⤵
  PID:15332
- C:\Windows\System\DpKeTjv.exe
  C:\Windows\System\DpKeTjv.exe
  2⤵
  PID:15356
- C:\Windows\System\EPACZEW.exe
  C:\Windows\System\EPACZEW.exe
  2⤵
  PID:13500
- C:\Windows\System\avtNcpg.exe
  C:\Windows\System\avtNcpg.exe
  2⤵
  PID:14404
- C:\Windows\System\afhyXAL.exe
  C:\Windows\System\afhyXAL.exe
  2⤵
  PID:14472
- C:\Windows\System\SRbusAY.exe
  C:\Windows\System\SRbusAY.exe
  2⤵
  PID:14560
- C:\Windows\System\BWsHQpJ.exe
  C:\Windows\System\BWsHQpJ.exe
  2⤵
  PID:14596
- C:\Windows\System\JvJPIEr.exe
  C:\Windows\System\JvJPIEr.exe
  2⤵
  PID:14664
- C:\Windows\System\aoqbbbn.exe
  C:\Windows\System\aoqbbbn.exe
  2⤵
  PID:14788
- C:\Windows\System\CrbqeAz.exe
  C:\Windows\System\CrbqeAz.exe
  2⤵
  PID:14684
- C:\Windows\System\jwNRbYb.exe
  C:\Windows\System\jwNRbYb.exe
  2⤵
  PID:14760
- C:\Windows\System\zXjlvjh.exe
  C:\Windows\System\zXjlvjh.exe
  2⤵
  PID:14908
- C:\Windows\System\nwPoqZd.exe
  C:\Windows\System\nwPoqZd.exe
  2⤵
  PID:14864
- C:\Windows\System\ghRLLjP.exe
  C:\Windows\System\ghRLLjP.exe
  2⤵
  PID:14948
- C:\Windows\System\OdMpixe.exe
  C:\Windows\System\OdMpixe.exe
  2⤵
  PID:14972
- C:\Windows\System\IEPXJMj.exe
  C:\Windows\System\IEPXJMj.exe
  2⤵
  PID:15004
- C:\Windows\System\keLcCwc.exe
  C:\Windows\System\keLcCwc.exe
  2⤵
  PID:15108
- C:\Windows\System\ssqsFBF.exe
  C:\Windows\System\ssqsFBF.exe
  2⤵
  PID:15228
- C:\Windows\System\asnslCC.exe
  C:\Windows\System\asnslCC.exe
  2⤵
  PID:15244
- C:\Windows\System\TNnOnUp.exe
  C:\Windows\System\TNnOnUp.exe
  2⤵
  PID:15348
- C:\Windows\System\pzQySmb.exe
  C:\Windows\System\pzQySmb.exe
  2⤵
  PID:14556
- C:\Windows\System\ldWrlqe.exe
  C:\Windows\System\ldWrlqe.exe
  2⤵
  PID:14920
- C:\Windows\System\SACkmTB.exe
  C:\Windows\System\SACkmTB.exe
  2⤵
  PID:15132
- C:\Windows\System\vFcHYbQ.exe
  C:\Windows\System\vFcHYbQ.exe
  2⤵
  PID:15268
- C:\Windows\System\gLlIEXD.exe
  C:\Windows\System\gLlIEXD.exe
  2⤵
  PID:14916
- C:\Windows\System\jumhuXR.exe
  C:\Windows\System\jumhuXR.exe
  2⤵
  PID:15024
- C:\Windows\System\KKfiCrD.exe
  C:\Windows\System\KKfiCrD.exe
  2⤵
  PID:15380
- C:\Windows\System\vlzGrXS.exe
  C:\Windows\System\vlzGrXS.exe
  2⤵
  PID:15400
- C:\Windows\System\tWutpRf.exe
  C:\Windows\System\tWutpRf.exe
  2⤵
  PID:15420
- C:\Windows\System\yuhlLgB.exe
  C:\Windows\System\yuhlLgB.exe
  2⤵
  PID:15448
- C:\Windows\System\pKbgrtt.exe
  C:\Windows\System\pKbgrtt.exe
  2⤵
  PID:15480
- C:\Windows\System\dYZkGMd.exe
  C:\Windows\System\dYZkGMd.exe
  2⤵
  PID:15500
- C:\Windows\System\scyVHay.exe
  C:\Windows\System\scyVHay.exe
  2⤵
  PID:15528
- C:\Windows\System\sADbNfu.exe
  C:\Windows\System\sADbNfu.exe
  2⤵
  PID:15564
- C:\Windows\System\ttouoNq.exe
  C:\Windows\System\ttouoNq.exe
  2⤵
  PID:15588
- C:\Windows\System\PvTVfSm.exe
  C:\Windows\System\PvTVfSm.exe
  2⤵
  PID:15608
- C:\Windows\System\cXDWzTc.exe
  C:\Windows\System\cXDWzTc.exe
  2⤵
  PID:15628
- C:\Windows\System\RsQOEgY.exe
  C:\Windows\System\RsQOEgY.exe
  2⤵
  PID:15660
- C:\Windows\System\hGiOIOP.exe
  C:\Windows\System\hGiOIOP.exe
  2⤵
  PID:15688
- C:\Windows\System\OIpjevZ.exe
  C:\Windows\System\OIpjevZ.exe
  2⤵
  PID:15720
- C:\Windows\System\CdbauBo.exe
  C:\Windows\System\CdbauBo.exe
  2⤵
  PID:15748
- C:\Windows\System\DdHoZIv.exe
  C:\Windows\System\DdHoZIv.exe
  2⤵
  PID:15776
- C:\Windows\System\hkSwTjO.exe
  C:\Windows\System\hkSwTjO.exe
  2⤵
  PID:15796
- C:\Windows\System\NvKIEOR.exe
  C:\Windows\System\NvKIEOR.exe
  2⤵
  PID:15820
- C:\Windows\System\AqmXPJR.exe
  C:\Windows\System\AqmXPJR.exe
  2⤵
  PID:15852
- C:\Windows\System\HREDDcc.exe
  C:\Windows\System\HREDDcc.exe
  2⤵
  PID:15872
- C:\Windows\System\XADRUGM.exe
  C:\Windows\System\XADRUGM.exe
  2⤵
  PID:15896
- C:\Windows\System\FckQSmb.exe
  C:\Windows\System\FckQSmb.exe
  2⤵
  PID:15920
- C:\Windows\System\yYdZbCC.exe
  C:\Windows\System\yYdZbCC.exe
  2⤵
  PID:15944
- C:\Windows\System\nkeMrKj.exe
  C:\Windows\System\nkeMrKj.exe
  2⤵
  PID:15964
- C:\Windows\System\PnOanLV.exe
  C:\Windows\System\PnOanLV.exe
  2⤵
  PID:15992
- C:\Windows\System\kztSAVz.exe
  C:\Windows\System\kztSAVz.exe
  2⤵
  PID:16012
- C:\Windows\System\OxVDXuc.exe
  C:\Windows\System\OxVDXuc.exe
  2⤵
  PID:16040
- C:\Windows\System\Qymkcmm.exe
  C:\Windows\System\Qymkcmm.exe
  2⤵
  PID:16064
- C:\Windows\System\WUzuvWj.exe
  C:\Windows\System\WUzuvWj.exe
  2⤵
  PID:16092
- C:\Windows\System\bZcPOzL.exe
  C:\Windows\System\bZcPOzL.exe
  2⤵
  PID:16124
- C:\Windows\System\kzlzyRH.exe
  C:\Windows\System\kzlzyRH.exe
  2⤵
  PID:16152
- C:\Windows\System\AsnFgYX.exe
  C:\Windows\System\AsnFgYX.exe
  2⤵
  PID:16172
- C:\Windows\System\dzHWhrL.exe
  C:\Windows\System\dzHWhrL.exe
  2⤵
  PID:16200
- C:\Windows\System\JjtdWQv.exe
  C:\Windows\System\JjtdWQv.exe
  2⤵
  PID:16216
- C:\Windows\System\uEJPvWi.exe
  C:\Windows\System\uEJPvWi.exe
  2⤵
  PID:16244
- C:\Windows\System\BZOgaRm.exe
  C:\Windows\System\BZOgaRm.exe
  2⤵
  PID:16260
- C:\Windows\System\veACIcB.exe
  C:\Windows\System\veACIcB.exe
  2⤵
  PID:16292
- C:\Windows\System\gzaxyzu.exe
  C:\Windows\System\gzaxyzu.exe
  2⤵
  PID:16320
- C:\Windows\System\rAYlIbA.exe
  C:\Windows\System\rAYlIbA.exe
  2⤵
  PID:16348
- C:\Windows\System\BbhgApi.exe
  C:\Windows\System\BbhgApi.exe
  2⤵
  PID:16372
- C:\Windows\System\jjUjumO.exe
  C:\Windows\System\jjUjumO.exe
  2⤵
  PID:15100
- C:\Windows\System\IZFnPsh.exe
  C:\Windows\System\IZFnPsh.exe
  2⤵
  PID:14344
- C:\Windows\System\rKnnNuI.exe
  C:\Windows\System\rKnnNuI.exe
  2⤵
  PID:15396
- C:\Windows\System\nyzhemH.exe
  C:\Windows\System\nyzhemH.exe
  2⤵
  PID:14712
- C:\Windows\System\IsCIHXa.exe
  C:\Windows\System\IsCIHXa.exe
  2⤵
  PID:14704
- C:\Windows\System\SQYAiSr.exe
  C:\Windows\System\SQYAiSr.exe
  2⤵
  PID:14860
- C:\Windows\System\aLNzCfb.exe
  C:\Windows\System\aLNzCfb.exe
  2⤵
  PID:15684
- C:\Windows\System\oZwwBAY.exe
  C:\Windows\System\oZwwBAY.exe
  2⤵
  PID:15600
- C:\Windows\System\HGTynpU.exe
  C:\Windows\System\HGTynpU.exe
  2⤵
  PID:15772
- C:\Windows\System\QEJGTHU.exe
  C:\Windows\System\QEJGTHU.exe
  2⤵
  PID:15616
- C:\Windows\System\jkTbZvc.exe
  C:\Windows\System\jkTbZvc.exe
  2⤵
  PID:15544
- C:\Windows\System\WKPkYUg.exe
  C:\Windows\System\WKPkYUg.exe
  2⤵
  PID:15596
- C:\Windows\System\birjlQn.exe
  C:\Windows\System\birjlQn.exe
  2⤵
  PID:15976
- C:\Windows\System\mVPWbih.exe
  C:\Windows\System\mVPWbih.exe
  2⤵
  PID:15860
- C:\Windows\System\neCrPOU.exe
  C:\Windows\System\neCrPOU.exe
  2⤵
  PID:16116
- C:\Windows\System\tVypJEh.exe
  C:\Windows\System\tVypJEh.exe
  2⤵
  PID:16000
- C:\Windows\System\lEUeWID.exe
  C:\Windows\System\lEUeWID.exe
  2⤵
  PID:16228
- C:\Windows\System\VKtwedc.exe
  C:\Windows\System\VKtwedc.exe
  2⤵
  PID:15936
- C:\Windows\System\ORnDkKV.exe
  C:\Windows\System\ORnDkKV.exe
  2⤵
  PID:15960
- C:\Windows\System\ZHbKPoK.exe
  C:\Windows\System\ZHbKPoK.exe
  2⤵
  PID:16368
- C:\Windows\System\lYtoZGb.exe
  C:\Windows\System\lYtoZGb.exe
  2⤵
  PID:16332
- C:\Windows\System\UzXxKwx.exe
  C:\Windows\System\UzXxKwx.exe
  2⤵
  PID:16188
- C:\Windows\System\yWPEOlr.exe
  C:\Windows\System\yWPEOlr.exe
  2⤵
  PID:15160
- C:\Windows\System\SmfJPrr.exe
  C:\Windows\System\SmfJPrr.exe
  2⤵
  PID:15048
- C:\Windows\System\ymqVmFS.exe
  C:\Windows\System\ymqVmFS.exe
  2⤵
  PID:16256
- C:\Windows\System\tLTJEeb.exe
  C:\Windows\System\tLTJEeb.exe
  2⤵
  PID:14076
- C:\Windows\System\wRPDQTy.exe
  C:\Windows\System\wRPDQTy.exe
  2⤵
  PID:15648
- C:\Windows\System\bwbDTbv.exe
  C:\Windows\System\bwbDTbv.exe
  2⤵
  PID:15916
- C:\Windows\System\ivzdKyQ.exe
  C:\Windows\System\ivzdKyQ.exe
  2⤵
  PID:15276
- C:\Windows\System\UeHNxja.exe
  C:\Windows\System\UeHNxja.exe
  2⤵
  PID:16408
- C:\Windows\System\QScwCFV.exe
  C:\Windows\System\QScwCFV.exe
  2⤵
  PID:16440
- C:\Windows\System\mepUTZF.exe
  C:\Windows\System\mepUTZF.exe
  2⤵
  PID:16460
- C:\Windows\System\FEETDBK.exe
  C:\Windows\System\FEETDBK.exe
  2⤵
  PID:16624
- C:\Windows\System\nqIkVDN.exe
  C:\Windows\System\nqIkVDN.exe
  2⤵
  PID:16672
- C:\Windows\System\LWmlsLq.exe
  C:\Windows\System\LWmlsLq.exe
  2⤵
  PID:16732
- C:\Windows\System\TBUZBEp.exe
  C:\Windows\System\TBUZBEp.exe
  2⤵
  PID:16748
- C:\Windows\System\pjDrJfQ.exe
  C:\Windows\System\pjDrJfQ.exe
  2⤵
  PID:16788
- C:\Windows\System\UtyNSyy.exe
  C:\Windows\System\UtyNSyy.exe
  2⤵
  PID:16816
- C:\Windows\System\tdgZJYL.exe
  C:\Windows\System\tdgZJYL.exe
  2⤵
  PID:16856
- C:\Windows\System\vgKYPuz.exe
  C:\Windows\System\vgKYPuz.exe
  2⤵
  PID:16876
- C:\Windows\System\ggNoHcW.exe
  C:\Windows\System\ggNoHcW.exe
  2⤵
  PID:16908
- C:\Windows\System\PgyNKCQ.exe
  C:\Windows\System\PgyNKCQ.exe
  2⤵
  PID:16948
- C:\Windows\System\ByNbEGQ.exe
  C:\Windows\System\ByNbEGQ.exe
  2⤵
  PID:16972
- - C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -u -p 16972 -s 248
    3⤵
    PID:17316
- C:\Windows\System\xYDbtnU.exe
  C:\Windows\System\xYDbtnU.exe
  2⤵
  PID:16996
- C:\Windows\System\CjyTbzn.exe
  C:\Windows\System\CjyTbzn.exe
  2⤵
  PID:17028
- C:\Windows\System\fSnJkTE.exe
  C:\Windows\System\fSnJkTE.exe
  2⤵
  PID:17052
- C:\Windows\System\OgcxqBH.exe
  C:\Windows\System\OgcxqBH.exe
  2⤵
  PID:17080
- C:\Windows\System\ovJAtpi.exe
  C:\Windows\System\ovJAtpi.exe
  2⤵
  PID:17116
- C:\Windows\System\HEvkqBT.exe
  C:\Windows\System\HEvkqBT.exe
  2⤵
  PID:17136
- C:\Windows\System\khISDXn.exe
  C:\Windows\System\khISDXn.exe
  2⤵
  PID:17160
- C:\Windows\System\NEKytAo.exe
  C:\Windows\System\NEKytAo.exe
  2⤵
  PID:17180
- C:\Windows\System\STbFpRX.exe
  C:\Windows\System\STbFpRX.exe
  2⤵
  PID:17196
- C:\Windows\System\dHhmcdp.exe
  C:\Windows\System\dHhmcdp.exe
  2⤵
  PID:17224
- C:\Windows\System\NavUQSB.exe
  C:\Windows\System\NavUQSB.exe
  2⤵
  PID:4136
- C:\Windows\System\VTdltRn.exe
  C:\Windows\System\VTdltRn.exe
  2⤵
  PID:15848
- C:\Windows\System\ZwnbRcd.exe
  C:\Windows\System\ZwnbRcd.exe
  2⤵
  PID:16340
- C:\Windows\System\QbiHNrv.exe
  C:\Windows\System\QbiHNrv.exe
  2⤵
  PID:15096
- C:\Windows\System\sfQjccX.exe
  C:\Windows\System\sfQjccX.exe
  2⤵
  PID:15892

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:15932

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\ASqzcUC.exe

Filesize
1.6MB

MD5
ff1d3dc1fdbd3131d3d3be4ec22925c9

SHA1
cd8350128c9beb286d02e311bba2dbaf4c6bb306

SHA256
dbe031061c3619c2556ac6ca8058125d163ebaccd6d3db9db53f341c9a35dc27

SHA512
6f632f97efc5a1c7406a37797b70ed5d55a40bf5edb37a73d188822d907aec1c977a699632308d30a11f885fc0bd6a282af535e3754a01886b8c92e51b505862

Download Submit
C:\Windows\System\BNkwRTv.exe

Filesize
1.6MB

MD5
b4d50604a6101f2fe5d4ceddd018b8d2

SHA1
cbd37738dae49b56c03360e2a17311170edddfe7

SHA256
b9305c0f7d3c46be37c5034376a17aa6caaf5aa5567f4026d0e55fb2fe413fd2

SHA512
46decb3a6a2e6080a02e98adbebc9d9edba5d12915026425bbc2b5f55910a4ca27151cd590aefc098e3ee09b8869e5680499d5f919d757caac527f04b7ab369c

Download Submit
C:\Windows\System\CKJxlWk.exe

Filesize
1.6MB

MD5
ded43186436d458e48eb8810b6771884

SHA1
1b71ba5564c80759e8680902e516bed7c384056c

SHA256
9896e9e5875d8271b07d710ff18f6589a87a66d18c6cedf2773c198dbaec7e3a

SHA512
6e2c6e3de36579ecd2376b3f7390d04662b49d78b4530da7684c80abdd68bb1f998de6ffced19295df6514d7fe400a075f86594693245c75c31150346087c6fd

Download Submit
C:\Windows\System\CObnRhF.exe

Filesize
1.6MB

MD5
34816705fa878bae7d3b21e157f30ea4

SHA1
95b4c28ed6387c09df1f2833fa9e4d2f3400642c

SHA256
a5c525170dc1053cf0dadb1d1ed260f98361024e218268de4c932a8e91afce70

SHA512
73b990bdb967463d303cd564ef878676977937466625dacb03143ff6ea7a3e0ee63f17883e13ef387aad4a9e81e7781475dbb2ddbb63778890419e016aa6e4c8

Download Submit
C:\Windows\System\CpPLVrz.exe

Filesize
1.6MB

MD5
40d6fbf1249da4d5417aeccd1530f2f8

SHA1
a18e062e3c341a02511c0f47877f440d18db72c6

SHA256
4d10594df61006329832d05efd1aadb41fb91155b560003b1bb0988ec7a87915

SHA512
ab3f7e5574af8d665a3ca54863b3ee153f801cf27d643a9f1325fbbc39a7c1557a726cd8f52b92ebf527228ef5c0862fa3b7e5ad7aefd1e8635b6e7f481c66aa

Download Submit
C:\Windows\System\EDpBhMz.exe

Filesize
1.6MB

MD5
926d354b6a291c0fe573fb29e6e4b0dc

SHA1
d24131bca3629274873f60e36cbdb08f998bd064

SHA256
82574e5adb96dd25dc898fa956567b7251b49053766f2f31d5a24652f4d73a63

SHA512
b5d99027b07c467a405775dd3d0d6cbee81b87b92b3d8672535b2638f54e132a3284dae40f4ec2db4bcef276d34c6ebb1d6f68a8fc75154746aae391d9939f35

Download Submit
C:\Windows\System\GrqYpvM.exe

Filesize
1.6MB

MD5
ce6fa129e0a451b61c056705d3a2d8ee

SHA1
81887c5c55286f3f1c0a9ff30c61a06e641e8153

SHA256
ffb02c413b2a0bc83028f6f5f37a2ebcaeb38519738204baaf431b51cebe566e

SHA512
06ce1cb1f277cb0da43ade705d7031d5a9b0feec313e01641429fbd8656839c6102351e1cabc7cff3f3a42b58c481b94545f706e26d89c1bb5b8d61295e1321e

Download Submit
C:\Windows\System\IhKqjMV.exe

Filesize
1.6MB

MD5
b56018553a82bd1d378cf08e298c9001

SHA1
7a657987792cfeca55346dc7f69dd70604ac35e9

SHA256
3a50ad05047024747a05d88f4f8226b159e09361c1732be6627ee92cb1626df0

SHA512
9ca4ab9104ff2b6a288d4d0b4ccf0d316e26c71461578f906f8c17f2527079af7390b5fd413df4961505e62479a57d2bf3c642b3e0f755357c713564a270cc14

Download Submit
C:\Windows\System\Kjdykpn.exe

Filesize
1.6MB

MD5
c5dcf9553418eb1adc814b41ac35e08d

SHA1
8976546e56b53850dc424c7160cfe0596a74d0c8

SHA256
ebc04d288c6b92ac7648130a90feeecb736a36c0954dab07d96a04560f98ccba

SHA512
090a89dd9c2f772de5f44af8297500f4f18632d2228aef1f66818a03fedfe6a781a55f356ad231babe142378028af707b29fadffa7e3846c7174796cbb4e57c0

Download Submit
C:\Windows\System\KlDkrRi.exe

Filesize
1.6MB

MD5
e8cdc25ac4661d01b7dc0f3400e8f30b

SHA1
a15881674ce7b7e0a4117ca1a69336a5531bf4a5

SHA256
352e74a2cf73bd408684627c5cb3206cf660f6648fa6d44b73bd45f3d74e5ee1

SHA512
70a4830ee54e524369869ae58e8f4cbae49c500c6788ee7da5cb6e9e7b1160d2864d35f5a9cc0a440b33afd858ff636cf4b824489f943164889a7519e2dbe8cf

Download Submit
C:\Windows\System\KyFdpCr.exe

Filesize
1.6MB

MD5
882bea96a621b0fe2c8a7de887275db3

SHA1
16d8102b8439b631dd120b118f661b73811d5efa

SHA256
cbeaa917a259794ae7d1af1eb06841ec9f6c578dd772df68dd15fe5c8a281556

SHA512
8bfff02e2fe080f274651f590eb27043988d27613ed7877f59fbfbce6cf3f94d4714d11fa7cc941a41daffbb4a3767c6887f582e7bcdc7e507213f04dd1ebabf

Download Submit
C:\Windows\System\PIBXntk.exe

Filesize
1.6MB

MD5
62821e8cbdbbc4b6aebcbbb36257fdbd

SHA1
1a09145428afe43e114b8e14797af52e6929b454

SHA256
d23aff3343f68b13cb7bae3d417a917ef121f4f33f39a0ec2d61cc51b3d207a9

SHA512
561558b3d690dc0ec351c718bc2c2efbae699fba810a4c9ed490a94dfe9fb5f85d1573bd7bba96e787b6a1e94102ed51bdf54f09a71300be1058fc40c001e73c

Download Submit
C:\Windows\System\RMYuTCo.exe

Filesize
1.6MB

MD5
18c207779289eb0be2ca6eee43723a06

SHA1
099717e441c2d90807d00ea3d1337d5622c598de

SHA256
81c3caaa74a6654f6bab8ea865a4ef432a4b9f7df0b7b5c892b455c60e9055ea

SHA512
347699a0471b605947d99f728eac18fa8bc9f053dfe0f7b1cc4ebd3f9b6266e3f43250c2e97d904dfb4b4336a64115ae7cac09243dab9bdf8652cf5e55eb2005

Download Submit
C:\Windows\System\WftIpBJ.exe

Filesize
1.6MB

MD5
64922a4adf622bac7fc541188b2829fc

SHA1
cc9206c450af6600ddc9ac4f606bf67f9dedb637

SHA256
675013f9f312a298516416b37b31eec3e5dfb67a9e530ac15e23cdcc1c3dba0d

SHA512
1f6bd98f192042a1fbbf52de70d1c453a600e37e419bd3fd8edff02821ca64be7c15fbd39e998f75860503fea6c258a74bb81a2cabe37726f92415dae7dc65bd

Download Submit
C:\Windows\System\XvTqTSP.exe

Filesize
1.6MB

MD5
02010d782e2f30aa84e8851f2e4d7ef0

SHA1
9b4a69fba534cbbaef505da363e3b281eab297a4

SHA256
f5c03f91d83636cf44117092c383ac29aeae3a786308ab637bb190531995b3fd

SHA512
085dde984b8b26719b4e384672d555e27b164222ce40e453265a046f64f130efe89d500dec16e357826f354709597721333104d266ecc0cfe1576c00e35614f8

Download Submit
C:\Windows\System\YhCgFtH.exe

Filesize
1.6MB

MD5
7f3b09bb253b6ab1dcb93e0bbb47dd48

SHA1
b0cd64c4495f6e5ab85b5b4db8ee6fbbf49610ed

SHA256
eb6db7c2fd3c925690d20de6c1bbfd09c769aca8abd03e798a53b5072508c901

SHA512
b7dcac688e7539e36c7d4a0140a46b4d2911f103ed38f6ec3f058d0301e2e5d485402b9ff0e80c2fc89361fb9bc9697882a751a596f85a623e92cb03819375a0

Download Submit
C:\Windows\System\ZOykIJo.exe

Filesize
1.6MB

MD5
79048360f4253b2c4e790d1670109f12

SHA1
02310f355560abc68f4ff70bb4aac150f3c3f0ab

SHA256
9eb628c00987e0790446c4de1b3fb806257a2786c75030022431f785b297191a

SHA512
8d5d648efe1be1402a8407d70c02eaf10fb0ebbef3e1d7e358639095831aed7b557a88a6ba1d4b4c26ea04f5e8804ebc670a42db37012d803bd8ff61837ef261

Download Submit
C:\Windows\System\eSVQYWU.exe

Filesize
1.6MB

MD5
db2b9f2e0ba2bdf4c4001b79a0fe3110

SHA1
ef0ef715d3221fe1614253aea704e71f6d016771

SHA256
a3090e4d88655005369c1fb83d0dc436fa7ba7c97bc1f9981aa2316fe1a49077

SHA512
7ad5521cca97b2366565957e87765b91f5719c93ab2a4b4bde010182662892cf39501e70c6b1754d6c0ea752c1c97c29d748fac522ed51defc81a42755296b69

Download Submit
C:\Windows\System\exdiOoi.exe

Filesize
1.6MB

MD5
ffd5902779d0d45e44a44e097231cb1b

SHA1
277d464e4418a86bb45dccbbcf5c010a3d6a550b

SHA256
3809423ac3f3dd65bda29294fe684e95f0ad2dc894f2e8195f21233104df0a58

SHA512
f89ee75b5aebf4b787d99a39332d3f30ab707656a314006fb2d8d21847770be92ba5325ecc01f6ae0226ff6f2afa9af24368b0b4a147dfee7f789c2c73130ab2

Download Submit
C:\Windows\System\fOjnxwA.exe

Filesize
1.6MB

MD5
97b8d2e8899863bb0170474a89584ac7

SHA1
52e4adbf89b1a92994a52d75989ba5d8a0a748f6

SHA256
7c6f3e6be9f9e6485e550d2128fdd94bc4c3ce9a164666d6790c199cfae33a4a

SHA512
cd6ec5166f4dd9ec1d8059c3d0e077b18b340d8e20f5d8eed9d092c6c7a6c1c641fc3ca3940f284d1ffa80ebb91ce560bd34b7f61ed973b1b11c3f1318e34140

Download Submit
C:\Windows\System\hUbOuui.exe

Filesize
1.6MB

MD5
a710f558048220e58b7dddad9e318722

SHA1
a854f252cf9a913591b6cd5c649f0e5b6bfd1c28

SHA256
e070d1a465547cb941121d694fbaa39b9ec0d9db9c873306f0eb96e191ef0671

SHA512
6020e7f43b12e42f8b4d8dda678516e2bf49a3646c39e88d769fc3b1cd6771b025129a737ae3fe78e4c3ca2499e8326ac069ba0995563c413d0b7832e58d0637

Download Submit
C:\Windows\System\hdgOGyj.exe

Filesize
1.6MB

MD5
036f94d69c4b42b686bc82de9e46f7b4

SHA1
bbd5e6c3e36e53a232c2cd1fe64b5e7708373a98

SHA256
477db50034261b2367591847cba3fa4c387886ed714132b52269da03a288ba7e

SHA512
a04cf4a12ea3d566cfa26595496fa4f5088a7904eca47a5af16e0eec2487cfd3385e787450bbee502edb3621694875b7f6ff8d5865cc34b94f4debf345daab3a

Download Submit
C:\Windows\System\kqQjFAO.exe

Filesize
1.6MB

MD5
c1c4f5ac31bb5ca42d0a78304b6f7d1a

SHA1
30abec957199a4075e947f359049979041ad4b7c

SHA256
b12d573d283c8dd71ff87d7bd3384a1f23943822851880aafc20cb0b3055e4ce

SHA512
1e99a869288f3a50fe1fe906095f1850c7b38c639ddad0ce1a1f64b30cc287907794cdc1014055e9eba92c671e650a10764e1835ef62194f908e411d1bcebee7

Download Submit
C:\Windows\System\lCnLneC.exe

Filesize
1.6MB

MD5
800f668d0580ac967665ef5e1da1c1e4

SHA1
2fafc6eff670b589e741f54792ace9b1a677b9ed

SHA256
bb393d6d8f951b7b85b961b742bc2ca1f93d4d8a284e3b1b0ffa81fa4fdc6411

SHA512
15b588fe5b763d8947e2421bcf28e0552a4c8c5abf56dd204d78f7749579019849f2fa4d5cb373c1b0656a7e9d26f331cb8c242bf81bb7d90d0bcaac7b01b3d2

Download Submit
C:\Windows\System\lcEyidz.exe

Filesize
1.6MB

MD5
675b4f6b5c0bbb10ead909cb49bafcf9

SHA1
0d1ed426c7b79e4c18133e7139f0e3679097e026

SHA256
27b56a08298784eef6ebdc2225258bc8c5b3bfddecde8ea7e835a91aea514da3

SHA512
107636531f38de7a7bbacaa756a0a4b1cf8def2f7aa527ce7da63537aeef3a94a192bfc3c528883380832aa6909c721dede208ae0219ca38786e7e4d4e333c00

Download Submit
C:\Windows\System\nQPBECk.exe

Filesize
1.6MB

MD5
c277ba3209ce94f6e42a2745e8c35bde

SHA1
506068f5a8305c1fb3a49fe29a50962349a7e4c3

SHA256
0bb1be3223d8e4d5078320495b7c50d07c11e2795e2623b65873a504b61bc987

SHA512
64ead1036de9dd611e837169d79377bea0d910cde912dbe3eaee6545b01db96b6f80ed07603603a479f8dc0030212f7e1e49a8c598eca193b6c819e6aee2964f

Download Submit
C:\Windows\System\oTpurTY.exe

Filesize
1.6MB

MD5
7bd324ddd0074de1a5e31c1e32e4bda1

SHA1
08ea4b28a61a1944c5be92c9d5e1a36a96d59e0f

SHA256
f0e9fc9c35d5ad8b7a8198bf5144d8d485b5a6450c9c81701dccc2c4f4ce455e

SHA512
79409fb1a54e7927c7f43d88816a317ee06c3da4871179cc934f26e02057b2c3c6d9fba88de4353e5e3b2e5a739491dc3d43033a0df196d31c9b7816e2f254b0

Download Submit
C:\Windows\System\oaptQdt.exe

Filesize
1.6MB

MD5
7d70312123d7b41331071a218571ca1c

SHA1
cbb670c125167f4918ca634408b5c97bcae86bd7

SHA256
1f37f2419c7b16fee82f5f2e5615c5ce39fd4565725a95172e0e4d3ccb3abf3b

SHA512
e2ef156286a3fca01e0f805afda0d55d5f47e39067b006cad0adf16b00dd5fe48cc783e0bebee972a0646e26e5ae86940d14fd771c89142b0c6d577f03b28a78

Download Submit
C:\Windows\System\uFmZLbM.exe

Filesize
1.6MB

MD5
6e83fcbaab80020b0bbdb8ec33c4963a

SHA1
5f56961c7134c324b49f598a3d06e0b78b98f9ed

SHA256
ef8f43f4f1bae1f3ff8755d0293c795d99dd4af2c0754397270b4cb421a242f9

SHA512
74639f6e9bcf5194e9a432969570baa8fc4e6e64d1be78e1f7d52a513994df6f16d18aa2cfaf645013c0f7f0f171fced511849d6d6a1781e3fc0f2e5a8e97482

Download Submit
C:\Windows\System\xDRURFK.exe

Filesize
1.6MB

MD5
40b061d6d1b31f7df41d5cd1d419cb59

SHA1
536c8fffeb553b068cfde13e14f5fac891d89893

SHA256
37c2fb2527df2f42e1b62f0801bec788688e8ade9496f94f59d5cbb0312f8290

SHA512
f15baafb59e5ddb79e28a4151182dec8140343b7d32d482e695753ae74fab7ae42dc964b68a5cce43f4a567e3e53601348bcb6813c76c044d02cca8af8045a0a

Download Submit
C:\Windows\System\xQQILaU.exe

Filesize
1.6MB

MD5
3dba485a8182701c1ffec9874f8f61a8

SHA1
c6a05a112d525252fb5a2de8f3ccbde220e06afc

SHA256
b4ec9fc21b52639e5a87af9cf3477bc4bf654bc3c34853511d1e625d725d3b44

SHA512
8c4c01471ff87437f36c0de2a3e3e0c1586fd982ce4d99fb1c721af7f91c0a9b6b3baa4b52d1b6b3b5f9f38bad018f502b6fba74748345bcece04283420f647d

Download Submit
C:\Windows\System\xTeidnn.exe

Filesize
1.6MB

MD5
1f90c313553010c44c77be8a52a07ac9

SHA1
bcc7bcc6e49495baa02d82a73c2319b40ed2e823

SHA256
36a6bc467b2768e0defc5071871ee5ad3784ca833ee8e4bf8e0c28c3f370a536

SHA512
16386d897fb448fbb43d0f907b9b3838fac877b4a3633cb463d708b844f5848f0c90022244f890280b872e8d78ac3005c025ae08b31a98f9f7ef57e224a6b8df

Download Submit
memory/4092-0-0x0000014AE9400000-0x0000014AE9410000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads