xmrig | 875b37d5aed79fe4239e73263d11000913ae3b2b7fb38fdc54443cac4e43db0e

Analysis

max time kernel
132s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20250129-en
resource tags

arch:x64arch:x86image:win10v2004-20250129-enlocale:en-usos:windows10-2004-x64system
submitted
03/02/2025, 01:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

875b37d5aed79fe4239e73263d11000913ae3b2b7fb38fdc54443cac4e43db0e.exe
Size

1.8MB
MD5

58dc095db0b65453dfd8154c65a17d5a
SHA1

d59ee7116e8ae8afa586b38483bc443e0a0383c6
SHA256

875b37d5aed79fe4239e73263d11000913ae3b2b7fb38fdc54443cac4e43db0e
SHA512

baf169aecd7d7e704137dade41f234ee600f24ceb2f98c3711876fc34bfa24f6af7bd9a8695af9cdbb47e936a28e4ebf99caa1837e4c1f18f538ffc7166611f2
SSDEEP

49152:GezaTF8FcNkNdfE0pZ9ozttwIRxj4c5yOBZnmxZ8zouZxKLFk7F:GemTLkNdfE0pZyP

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 62 IoCs

miner

resource	yara_rule
behavioral2/files/0x0008000000023c88-4.dat	xmrig
behavioral2/files/0x0008000000023c8b-9.dat	xmrig
behavioral2/files/0x0007000000023c8c-13.dat	xmrig
behavioral2/files/0x0007000000023c8d-16.dat	xmrig
behavioral2/files/0x0007000000023c90-25.dat	xmrig
behavioral2/files/0x0007000000023c91-28.dat	xmrig
behavioral2/files/0x0007000000023c93-34.dat	xmrig
behavioral2/files/0x0007000000023c94-37.dat	xmrig
behavioral2/files/0x0007000000023c99-52.dat	xmrig
behavioral2/files/0x0007000000023c9c-61.dat	xmrig
behavioral2/files/0x0007000000023c9f-70.dat	xmrig
behavioral2/files/0x0007000000023cae-115.dat	xmrig
behavioral2/files/0x0007000000023cc7-190.dat	xmrig
behavioral2/files/0x0007000000023cc6-187.dat	xmrig
behavioral2/files/0x0007000000023cc5-184.dat	xmrig
behavioral2/files/0x0007000000023cc4-181.dat	xmrig
behavioral2/files/0x0007000000023cc3-178.dat	xmrig
behavioral2/files/0x0007000000023cc2-175.dat	xmrig
behavioral2/files/0x0007000000023cc1-172.dat	xmrig
behavioral2/files/0x0007000000023cc0-169.dat	xmrig
behavioral2/files/0x0007000000023cbf-166.dat	xmrig
behavioral2/files/0x0007000000023cbe-163.dat	xmrig
behavioral2/files/0x0007000000023cbd-160.dat	xmrig
behavioral2/files/0x0007000000023cbc-157.dat	xmrig
behavioral2/files/0x0007000000023cbb-154.dat	xmrig
behavioral2/files/0x0007000000023cba-151.dat	xmrig
behavioral2/files/0x0007000000023cb9-148.dat	xmrig
behavioral2/files/0x0007000000023cb8-145.dat	xmrig
behavioral2/files/0x0007000000023cb7-142.dat	xmrig
behavioral2/files/0x0007000000023cb6-139.dat	xmrig
behavioral2/files/0x0007000000023cb5-136.dat	xmrig
behavioral2/files/0x0007000000023cb4-133.dat	xmrig
behavioral2/files/0x0007000000023cb3-130.dat	xmrig
behavioral2/files/0x0007000000023cb2-127.dat	xmrig
behavioral2/files/0x0007000000023cb1-124.dat	xmrig
behavioral2/files/0x0007000000023cb0-121.dat	xmrig
behavioral2/files/0x0007000000023caf-118.dat	xmrig
behavioral2/files/0x0007000000023cad-112.dat	xmrig
behavioral2/files/0x0007000000023cac-109.dat	xmrig
behavioral2/files/0x0007000000023cab-106.dat	xmrig
behavioral2/files/0x0007000000023caa-103.dat	xmrig
behavioral2/files/0x0007000000023ca9-100.dat	xmrig
behavioral2/files/0x0007000000023ca8-97.dat	xmrig
behavioral2/files/0x0007000000023ca7-94.dat	xmrig
behavioral2/files/0x0007000000023ca6-91.dat	xmrig
behavioral2/files/0x0007000000023ca5-88.dat	xmrig
behavioral2/files/0x0007000000023ca4-85.dat	xmrig
behavioral2/files/0x0007000000023ca3-82.dat	xmrig
behavioral2/files/0x0007000000023ca2-79.dat	xmrig
behavioral2/files/0x0007000000023ca1-76.dat	xmrig
behavioral2/files/0x0007000000023ca0-73.dat	xmrig
behavioral2/files/0x0007000000023c9e-67.dat	xmrig
behavioral2/files/0x0007000000023c9d-64.dat	xmrig
behavioral2/files/0x0007000000023c9b-58.dat	xmrig
behavioral2/files/0x0007000000023c9a-55.dat	xmrig
behavioral2/files/0x0007000000023c98-49.dat	xmrig
behavioral2/files/0x0007000000023c97-46.dat	xmrig
behavioral2/files/0x0007000000023c96-43.dat	xmrig
behavioral2/files/0x0007000000023c95-40.dat	xmrig
behavioral2/files/0x0007000000023c92-31.dat	xmrig
behavioral2/files/0x0007000000023c8f-22.dat	xmrig
behavioral2/files/0x0007000000023c8e-18.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
5080	nEeODUM.exe
3260	hDigSAg.exe
208	mEwgnbC.exe
228	MehpCkw.exe
3244	uyJuiVN.exe
3572	ZofLHCW.exe
2608	rOAboUL.exe
2580	eVHFvRd.exe
5040	womTBqn.exe
368	gLYvlow.exe
2772	wOIKNDt.exe
2684	uahByOp.exe
3480	HBSKZoO.exe
2264	HIpXkut.exe
3352	SVLzVBJ.exe
4740	PvXvJYR.exe
768	OBpTzdM.exe
4756	Eiqgtqb.exe
548	PBOLtBH.exe
2616	jXEkCFG.exe
4312	kanAqXt.exe
3956	syavdGg.exe
844	BbuUNzl.exe
1044	zRwcxuM.exe
1372	jMbIHnG.exe
1444	cBMPfAB.exe
4808	VrlAnuB.exe
3336	GDNIzEq.exe
3996	TpBPbQn.exe
3784	vSxHfDV.exe
1124	ntLYJmn.exe
1480	sfrxWHD.exe
3144	HMGDlNr.exe
3324	ZrpmLjf.exe
3864	hSCjjPc.exe
4412	smiPnon.exe
3104	RSTQszC.exe
2244	EPzoPCE.exe
1748	vdfyIBS.exe
4124	uDEuBzU.exe
4884	wNcZhWN.exe
2028	apjJGAw.exe
1972	DRuJbHr.exe
4296	AyIWMTv.exe
4472	WwUnezQ.exe
4404	dgRVTDV.exe
3316	AjpfQvW.exe
4816	nLBybvA.exe
1036	OKCMzKf.exe
2680	GBWaOeT.exe
3112	ubmHUfc.exe
1332	cKHoUef.exe
1636	Pdwxrlt.exe
4716	PfHQzVv.exe
3484	LNFwWko.exe
3616	WKecztI.exe
4608	hSHFWYX.exe
3776	ehcbOgC.exe
700	csJyjhi.exe
1632	BsUkPzu.exe
4024	ZYVIJNn.exe
5064	ARQfghZ.exe
984	ZOrkLDN.exe
440	MaEbehF.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\qPVHWVF.exe	875b37d5aed79fe4239e73263d11000913ae3b2b7fb38fdc54443cac4e43db0e.exe
File created	C:\Windows\System\sOowaaB.exe	875b37d5aed79fe4239e73263d11000913ae3b2b7fb38fdc54443cac4e43db0e.exe
File created	C:\Windows\System\mLdjTQl.exe	875b37d5aed79fe4239e73263d11000913ae3b2b7fb38fdc54443cac4e43db0e.exe
File created	C:\Windows\System\EqdeRQC.exe	875b37d5aed79fe4239e73263d11000913ae3b2b7fb38fdc54443cac4e43db0e.exe
File created	C:\Windows\System\cmAbqbx.exe	875b37d5aed79fe4239e73263d11000913ae3b2b7fb38fdc54443cac4e43db0e.exe
File created	C:\Windows\System\BbuUNzl.exe	875b37d5aed79fe4239e73263d11000913ae3b2b7fb38fdc54443cac4e43db0e.exe
File created	C:\Windows\System\gvXBlIR.exe	875b37d5aed79fe4239e73263d11000913ae3b2b7fb38fdc54443cac4e43db0e.exe
File created	C:\Windows\System\MvAoYTn.exe	875b37d5aed79fe4239e73263d11000913ae3b2b7fb38fdc54443cac4e43db0e.exe
File created	C:\Windows\System\wyJqFGJ.exe	875b37d5aed79fe4239e73263d11000913ae3b2b7fb38fdc54443cac4e43db0e.exe
File created	C:\Windows\System\cSoNvAR.exe	875b37d5aed79fe4239e73263d11000913ae3b2b7fb38fdc54443cac4e43db0e.exe
File created	C:\Windows\System\YcyxMLL.exe	875b37d5aed79fe4239e73263d11000913ae3b2b7fb38fdc54443cac4e43db0e.exe
File created	C:\Windows\System\ePDHpkK.exe	875b37d5aed79fe4239e73263d11000913ae3b2b7fb38fdc54443cac4e43db0e.exe
File created	C:\Windows\System\tYPMzJG.exe	875b37d5aed79fe4239e73263d11000913ae3b2b7fb38fdc54443cac4e43db0e.exe
File created	C:\Windows\System\ShTivwq.exe	875b37d5aed79fe4239e73263d11000913ae3b2b7fb38fdc54443cac4e43db0e.exe
File created	C:\Windows\System\RbanKEr.exe	875b37d5aed79fe4239e73263d11000913ae3b2b7fb38fdc54443cac4e43db0e.exe
File created	C:\Windows\System\VYnPKFa.exe	875b37d5aed79fe4239e73263d11000913ae3b2b7fb38fdc54443cac4e43db0e.exe
File created	C:\Windows\System\fiSFjZb.exe	875b37d5aed79fe4239e73263d11000913ae3b2b7fb38fdc54443cac4e43db0e.exe
File created	C:\Windows\System\qnpRjVn.exe	875b37d5aed79fe4239e73263d11000913ae3b2b7fb38fdc54443cac4e43db0e.exe
File created	C:\Windows\System\XViFgVM.exe	875b37d5aed79fe4239e73263d11000913ae3b2b7fb38fdc54443cac4e43db0e.exe
File created	C:\Windows\System\mdmheam.exe	875b37d5aed79fe4239e73263d11000913ae3b2b7fb38fdc54443cac4e43db0e.exe
File created	C:\Windows\System\YLwisLr.exe	875b37d5aed79fe4239e73263d11000913ae3b2b7fb38fdc54443cac4e43db0e.exe
File created	C:\Windows\System\PMxBkBk.exe	875b37d5aed79fe4239e73263d11000913ae3b2b7fb38fdc54443cac4e43db0e.exe
File created	C:\Windows\System\OOyreHx.exe	875b37d5aed79fe4239e73263d11000913ae3b2b7fb38fdc54443cac4e43db0e.exe
File created	C:\Windows\System\tgtdtKR.exe	875b37d5aed79fe4239e73263d11000913ae3b2b7fb38fdc54443cac4e43db0e.exe
File created	C:\Windows\System\HkWNXSq.exe	875b37d5aed79fe4239e73263d11000913ae3b2b7fb38fdc54443cac4e43db0e.exe
File created	C:\Windows\System\kCvhEmi.exe	875b37d5aed79fe4239e73263d11000913ae3b2b7fb38fdc54443cac4e43db0e.exe
File created	C:\Windows\System\anrtJap.exe	875b37d5aed79fe4239e73263d11000913ae3b2b7fb38fdc54443cac4e43db0e.exe
File created	C:\Windows\System\xWpubPQ.exe	875b37d5aed79fe4239e73263d11000913ae3b2b7fb38fdc54443cac4e43db0e.exe
File created	C:\Windows\System\qxdLUHe.exe	875b37d5aed79fe4239e73263d11000913ae3b2b7fb38fdc54443cac4e43db0e.exe
File created	C:\Windows\System\LJXiVVK.exe	875b37d5aed79fe4239e73263d11000913ae3b2b7fb38fdc54443cac4e43db0e.exe
File created	C:\Windows\System\HFlsNbj.exe	875b37d5aed79fe4239e73263d11000913ae3b2b7fb38fdc54443cac4e43db0e.exe
File created	C:\Windows\System\QiyzNIK.exe	875b37d5aed79fe4239e73263d11000913ae3b2b7fb38fdc54443cac4e43db0e.exe
File created	C:\Windows\System\JoRRQmL.exe	875b37d5aed79fe4239e73263d11000913ae3b2b7fb38fdc54443cac4e43db0e.exe
File created	C:\Windows\System\smiPnon.exe	875b37d5aed79fe4239e73263d11000913ae3b2b7fb38fdc54443cac4e43db0e.exe
File created	C:\Windows\System\bfxjsYn.exe	875b37d5aed79fe4239e73263d11000913ae3b2b7fb38fdc54443cac4e43db0e.exe
File created	C:\Windows\System\lvYzNAB.exe	875b37d5aed79fe4239e73263d11000913ae3b2b7fb38fdc54443cac4e43db0e.exe
File created	C:\Windows\System\BklORXN.exe	875b37d5aed79fe4239e73263d11000913ae3b2b7fb38fdc54443cac4e43db0e.exe
File created	C:\Windows\System\kFAmZnB.exe	875b37d5aed79fe4239e73263d11000913ae3b2b7fb38fdc54443cac4e43db0e.exe
File created	C:\Windows\System\InTCUbJ.exe	875b37d5aed79fe4239e73263d11000913ae3b2b7fb38fdc54443cac4e43db0e.exe
File created	C:\Windows\System\FhJfQqD.exe	875b37d5aed79fe4239e73263d11000913ae3b2b7fb38fdc54443cac4e43db0e.exe
File created	C:\Windows\System\hjjXIxe.exe	875b37d5aed79fe4239e73263d11000913ae3b2b7fb38fdc54443cac4e43db0e.exe
File created	C:\Windows\System\YJtJCjw.exe	875b37d5aed79fe4239e73263d11000913ae3b2b7fb38fdc54443cac4e43db0e.exe
File created	C:\Windows\System\mGlqstM.exe	875b37d5aed79fe4239e73263d11000913ae3b2b7fb38fdc54443cac4e43db0e.exe
File created	C:\Windows\System\mEwgnbC.exe	875b37d5aed79fe4239e73263d11000913ae3b2b7fb38fdc54443cac4e43db0e.exe
File created	C:\Windows\System\EPzoPCE.exe	875b37d5aed79fe4239e73263d11000913ae3b2b7fb38fdc54443cac4e43db0e.exe
File created	C:\Windows\System\lEPVkPq.exe	875b37d5aed79fe4239e73263d11000913ae3b2b7fb38fdc54443cac4e43db0e.exe
File created	C:\Windows\System\AjpfQvW.exe	875b37d5aed79fe4239e73263d11000913ae3b2b7fb38fdc54443cac4e43db0e.exe
File created	C:\Windows\System\Pdwxrlt.exe	875b37d5aed79fe4239e73263d11000913ae3b2b7fb38fdc54443cac4e43db0e.exe
File created	C:\Windows\System\EAcCcvj.exe	875b37d5aed79fe4239e73263d11000913ae3b2b7fb38fdc54443cac4e43db0e.exe
File created	C:\Windows\System\XkWLVpb.exe	875b37d5aed79fe4239e73263d11000913ae3b2b7fb38fdc54443cac4e43db0e.exe
File created	C:\Windows\System\RXZyyOe.exe	875b37d5aed79fe4239e73263d11000913ae3b2b7fb38fdc54443cac4e43db0e.exe
File created	C:\Windows\System\aucXgot.exe	875b37d5aed79fe4239e73263d11000913ae3b2b7fb38fdc54443cac4e43db0e.exe
File created	C:\Windows\System\xWQSHEg.exe	875b37d5aed79fe4239e73263d11000913ae3b2b7fb38fdc54443cac4e43db0e.exe
File created	C:\Windows\System\FwdAkal.exe	875b37d5aed79fe4239e73263d11000913ae3b2b7fb38fdc54443cac4e43db0e.exe
File created	C:\Windows\System\UCfGSUy.exe	875b37d5aed79fe4239e73263d11000913ae3b2b7fb38fdc54443cac4e43db0e.exe
File created	C:\Windows\System\JXkuWdg.exe	875b37d5aed79fe4239e73263d11000913ae3b2b7fb38fdc54443cac4e43db0e.exe
File created	C:\Windows\System\kUyTnMR.exe	875b37d5aed79fe4239e73263d11000913ae3b2b7fb38fdc54443cac4e43db0e.exe
File created	C:\Windows\System\uceQBiY.exe	875b37d5aed79fe4239e73263d11000913ae3b2b7fb38fdc54443cac4e43db0e.exe
File created	C:\Windows\System\fMuBZfu.exe	875b37d5aed79fe4239e73263d11000913ae3b2b7fb38fdc54443cac4e43db0e.exe
File created	C:\Windows\System\tgbLzsd.exe	875b37d5aed79fe4239e73263d11000913ae3b2b7fb38fdc54443cac4e43db0e.exe
File created	C:\Windows\System\eqVtuco.exe	875b37d5aed79fe4239e73263d11000913ae3b2b7fb38fdc54443cac4e43db0e.exe
File created	C:\Windows\System\VLeVsdn.exe	875b37d5aed79fe4239e73263d11000913ae3b2b7fb38fdc54443cac4e43db0e.exe
File created	C:\Windows\System\gonqrba.exe	875b37d5aed79fe4239e73263d11000913ae3b2b7fb38fdc54443cac4e43db0e.exe
File created	C:\Windows\System\UMzBaSE.exe	875b37d5aed79fe4239e73263d11000913ae3b2b7fb38fdc54443cac4e43db0e.exe

Checks SCSI registry key(s) 3 TTPs 18 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe

Modifies data under HKEY_USERS 54 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe

Suspicious use of AdjustPrivilegeToken 14 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	17028	dwm.exe
Token: SeChangeNotifyPrivilege	17028	dwm.exe
Token: 33	17028	dwm.exe
Token: SeIncBasePriorityPrivilege	17028	dwm.exe
Token: SeCreateGlobalPrivilege	16588	dwm.exe
Token: SeChangeNotifyPrivilege	16588	dwm.exe
Token: 33	16588	dwm.exe
Token: SeIncBasePriorityPrivilege	16588	dwm.exe
Token: SeCreateGlobalPrivilege	17004	dwm.exe
Token: SeChangeNotifyPrivilege	17004	dwm.exe
Token: 33	17004	dwm.exe
Token: SeIncBasePriorityPrivilege	17004	dwm.exe
Token: SeShutdownPrivilege	17004	dwm.exe
Token: SeCreatePagefilePrivilege	17004	dwm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2796 wrote to memory of 5080	2796	875b37d5aed79fe4239e73263d11000913ae3b2b7fb38fdc54443cac4e43db0e.exe	84
PID 2796 wrote to memory of 5080	2796	875b37d5aed79fe4239e73263d11000913ae3b2b7fb38fdc54443cac4e43db0e.exe	84
PID 2796 wrote to memory of 3260	2796	875b37d5aed79fe4239e73263d11000913ae3b2b7fb38fdc54443cac4e43db0e.exe	85
PID 2796 wrote to memory of 3260	2796	875b37d5aed79fe4239e73263d11000913ae3b2b7fb38fdc54443cac4e43db0e.exe	85
PID 2796 wrote to memory of 208	2796	875b37d5aed79fe4239e73263d11000913ae3b2b7fb38fdc54443cac4e43db0e.exe	86
PID 2796 wrote to memory of 208	2796	875b37d5aed79fe4239e73263d11000913ae3b2b7fb38fdc54443cac4e43db0e.exe	86
PID 2796 wrote to memory of 228	2796	875b37d5aed79fe4239e73263d11000913ae3b2b7fb38fdc54443cac4e43db0e.exe	87
PID 2796 wrote to memory of 228	2796	875b37d5aed79fe4239e73263d11000913ae3b2b7fb38fdc54443cac4e43db0e.exe	87
PID 2796 wrote to memory of 3244	2796	875b37d5aed79fe4239e73263d11000913ae3b2b7fb38fdc54443cac4e43db0e.exe	88
PID 2796 wrote to memory of 3244	2796	875b37d5aed79fe4239e73263d11000913ae3b2b7fb38fdc54443cac4e43db0e.exe	88
PID 2796 wrote to memory of 3572	2796	875b37d5aed79fe4239e73263d11000913ae3b2b7fb38fdc54443cac4e43db0e.exe	89
PID 2796 wrote to memory of 3572	2796	875b37d5aed79fe4239e73263d11000913ae3b2b7fb38fdc54443cac4e43db0e.exe	89
PID 2796 wrote to memory of 2608	2796	875b37d5aed79fe4239e73263d11000913ae3b2b7fb38fdc54443cac4e43db0e.exe	90
PID 2796 wrote to memory of 2608	2796	875b37d5aed79fe4239e73263d11000913ae3b2b7fb38fdc54443cac4e43db0e.exe	90
PID 2796 wrote to memory of 2580	2796	875b37d5aed79fe4239e73263d11000913ae3b2b7fb38fdc54443cac4e43db0e.exe	91
PID 2796 wrote to memory of 2580	2796	875b37d5aed79fe4239e73263d11000913ae3b2b7fb38fdc54443cac4e43db0e.exe	91
PID 2796 wrote to memory of 5040	2796	875b37d5aed79fe4239e73263d11000913ae3b2b7fb38fdc54443cac4e43db0e.exe	92
PID 2796 wrote to memory of 5040	2796	875b37d5aed79fe4239e73263d11000913ae3b2b7fb38fdc54443cac4e43db0e.exe	92
PID 2796 wrote to memory of 368	2796	875b37d5aed79fe4239e73263d11000913ae3b2b7fb38fdc54443cac4e43db0e.exe	93
PID 2796 wrote to memory of 368	2796	875b37d5aed79fe4239e73263d11000913ae3b2b7fb38fdc54443cac4e43db0e.exe	93
PID 2796 wrote to memory of 2772	2796	875b37d5aed79fe4239e73263d11000913ae3b2b7fb38fdc54443cac4e43db0e.exe	94
PID 2796 wrote to memory of 2772	2796	875b37d5aed79fe4239e73263d11000913ae3b2b7fb38fdc54443cac4e43db0e.exe	94
PID 2796 wrote to memory of 2684	2796	875b37d5aed79fe4239e73263d11000913ae3b2b7fb38fdc54443cac4e43db0e.exe	95
PID 2796 wrote to memory of 2684	2796	875b37d5aed79fe4239e73263d11000913ae3b2b7fb38fdc54443cac4e43db0e.exe	95
PID 2796 wrote to memory of 3480	2796	875b37d5aed79fe4239e73263d11000913ae3b2b7fb38fdc54443cac4e43db0e.exe	96
PID 2796 wrote to memory of 3480	2796	875b37d5aed79fe4239e73263d11000913ae3b2b7fb38fdc54443cac4e43db0e.exe	96
PID 2796 wrote to memory of 2264	2796	875b37d5aed79fe4239e73263d11000913ae3b2b7fb38fdc54443cac4e43db0e.exe	97
PID 2796 wrote to memory of 2264	2796	875b37d5aed79fe4239e73263d11000913ae3b2b7fb38fdc54443cac4e43db0e.exe	97
PID 2796 wrote to memory of 3352	2796	875b37d5aed79fe4239e73263d11000913ae3b2b7fb38fdc54443cac4e43db0e.exe	98
PID 2796 wrote to memory of 3352	2796	875b37d5aed79fe4239e73263d11000913ae3b2b7fb38fdc54443cac4e43db0e.exe	98
PID 2796 wrote to memory of 4740	2796	875b37d5aed79fe4239e73263d11000913ae3b2b7fb38fdc54443cac4e43db0e.exe	99
PID 2796 wrote to memory of 4740	2796	875b37d5aed79fe4239e73263d11000913ae3b2b7fb38fdc54443cac4e43db0e.exe	99
PID 2796 wrote to memory of 768	2796	875b37d5aed79fe4239e73263d11000913ae3b2b7fb38fdc54443cac4e43db0e.exe	100
PID 2796 wrote to memory of 768	2796	875b37d5aed79fe4239e73263d11000913ae3b2b7fb38fdc54443cac4e43db0e.exe	100
PID 2796 wrote to memory of 4756	2796	875b37d5aed79fe4239e73263d11000913ae3b2b7fb38fdc54443cac4e43db0e.exe	101
PID 2796 wrote to memory of 4756	2796	875b37d5aed79fe4239e73263d11000913ae3b2b7fb38fdc54443cac4e43db0e.exe	101
PID 2796 wrote to memory of 548	2796	875b37d5aed79fe4239e73263d11000913ae3b2b7fb38fdc54443cac4e43db0e.exe	102
PID 2796 wrote to memory of 548	2796	875b37d5aed79fe4239e73263d11000913ae3b2b7fb38fdc54443cac4e43db0e.exe	102
PID 2796 wrote to memory of 2616	2796	875b37d5aed79fe4239e73263d11000913ae3b2b7fb38fdc54443cac4e43db0e.exe	103
PID 2796 wrote to memory of 2616	2796	875b37d5aed79fe4239e73263d11000913ae3b2b7fb38fdc54443cac4e43db0e.exe	103
PID 2796 wrote to memory of 4312	2796	875b37d5aed79fe4239e73263d11000913ae3b2b7fb38fdc54443cac4e43db0e.exe	104
PID 2796 wrote to memory of 4312	2796	875b37d5aed79fe4239e73263d11000913ae3b2b7fb38fdc54443cac4e43db0e.exe	104
PID 2796 wrote to memory of 3956	2796	875b37d5aed79fe4239e73263d11000913ae3b2b7fb38fdc54443cac4e43db0e.exe	105
PID 2796 wrote to memory of 3956	2796	875b37d5aed79fe4239e73263d11000913ae3b2b7fb38fdc54443cac4e43db0e.exe	105
PID 2796 wrote to memory of 844	2796	875b37d5aed79fe4239e73263d11000913ae3b2b7fb38fdc54443cac4e43db0e.exe	106
PID 2796 wrote to memory of 844	2796	875b37d5aed79fe4239e73263d11000913ae3b2b7fb38fdc54443cac4e43db0e.exe	106
PID 2796 wrote to memory of 1044	2796	875b37d5aed79fe4239e73263d11000913ae3b2b7fb38fdc54443cac4e43db0e.exe	107
PID 2796 wrote to memory of 1044	2796	875b37d5aed79fe4239e73263d11000913ae3b2b7fb38fdc54443cac4e43db0e.exe	107
PID 2796 wrote to memory of 1372	2796	875b37d5aed79fe4239e73263d11000913ae3b2b7fb38fdc54443cac4e43db0e.exe	108
PID 2796 wrote to memory of 1372	2796	875b37d5aed79fe4239e73263d11000913ae3b2b7fb38fdc54443cac4e43db0e.exe	108
PID 2796 wrote to memory of 1444	2796	875b37d5aed79fe4239e73263d11000913ae3b2b7fb38fdc54443cac4e43db0e.exe	109
PID 2796 wrote to memory of 1444	2796	875b37d5aed79fe4239e73263d11000913ae3b2b7fb38fdc54443cac4e43db0e.exe	109
PID 2796 wrote to memory of 4808	2796	875b37d5aed79fe4239e73263d11000913ae3b2b7fb38fdc54443cac4e43db0e.exe	110
PID 2796 wrote to memory of 4808	2796	875b37d5aed79fe4239e73263d11000913ae3b2b7fb38fdc54443cac4e43db0e.exe	110
PID 2796 wrote to memory of 3336	2796	875b37d5aed79fe4239e73263d11000913ae3b2b7fb38fdc54443cac4e43db0e.exe	111
PID 2796 wrote to memory of 3336	2796	875b37d5aed79fe4239e73263d11000913ae3b2b7fb38fdc54443cac4e43db0e.exe	111
PID 2796 wrote to memory of 3996	2796	875b37d5aed79fe4239e73263d11000913ae3b2b7fb38fdc54443cac4e43db0e.exe	112
PID 2796 wrote to memory of 3996	2796	875b37d5aed79fe4239e73263d11000913ae3b2b7fb38fdc54443cac4e43db0e.exe	112
PID 2796 wrote to memory of 3784	2796	875b37d5aed79fe4239e73263d11000913ae3b2b7fb38fdc54443cac4e43db0e.exe	113
PID 2796 wrote to memory of 3784	2796	875b37d5aed79fe4239e73263d11000913ae3b2b7fb38fdc54443cac4e43db0e.exe	113
PID 2796 wrote to memory of 1124	2796	875b37d5aed79fe4239e73263d11000913ae3b2b7fb38fdc54443cac4e43db0e.exe	114
PID 2796 wrote to memory of 1124	2796	875b37d5aed79fe4239e73263d11000913ae3b2b7fb38fdc54443cac4e43db0e.exe	114
PID 2796 wrote to memory of 1480	2796	875b37d5aed79fe4239e73263d11000913ae3b2b7fb38fdc54443cac4e43db0e.exe	115
PID 2796 wrote to memory of 1480	2796	875b37d5aed79fe4239e73263d11000913ae3b2b7fb38fdc54443cac4e43db0e.exe	115

C:\Users\Admin\AppData\Local\Temp\875b37d5aed79fe4239e73263d11000913ae3b2b7fb38fdc54443cac4e43db0e.exe
"C:\Users\Admin\AppData\Local\Temp\875b37d5aed79fe4239e73263d11000913ae3b2b7fb38fdc54443cac4e43db0e.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2796
- C:\Windows\System\nEeODUM.exe
  C:\Windows\System\nEeODUM.exe
  2⤵
  - Executes dropped EXE
  PID:5080
- C:\Windows\System\hDigSAg.exe
  C:\Windows\System\hDigSAg.exe
  2⤵
  - Executes dropped EXE
  PID:3260
- C:\Windows\System\mEwgnbC.exe
  C:\Windows\System\mEwgnbC.exe
  2⤵
  - Executes dropped EXE
  PID:208
- C:\Windows\System\MehpCkw.exe
  C:\Windows\System\MehpCkw.exe
  2⤵
  - Executes dropped EXE
  PID:228
- C:\Windows\System\uyJuiVN.exe
  C:\Windows\System\uyJuiVN.exe
  2⤵
  - Executes dropped EXE
  PID:3244
- C:\Windows\System\ZofLHCW.exe
  C:\Windows\System\ZofLHCW.exe
  2⤵
  - Executes dropped EXE
  PID:3572
- C:\Windows\System\rOAboUL.exe
  C:\Windows\System\rOAboUL.exe
  2⤵
  - Executes dropped EXE
  PID:2608
- C:\Windows\System\eVHFvRd.exe
  C:\Windows\System\eVHFvRd.exe
  2⤵
  - Executes dropped EXE
  PID:2580
- C:\Windows\System\womTBqn.exe
  C:\Windows\System\womTBqn.exe
  2⤵
  - Executes dropped EXE
  PID:5040
- C:\Windows\System\gLYvlow.exe
  C:\Windows\System\gLYvlow.exe
  2⤵
  - Executes dropped EXE
  PID:368
- C:\Windows\System\wOIKNDt.exe
  C:\Windows\System\wOIKNDt.exe
  2⤵
  - Executes dropped EXE
  PID:2772
- C:\Windows\System\uahByOp.exe
  C:\Windows\System\uahByOp.exe
  2⤵
  - Executes dropped EXE
  PID:2684
- C:\Windows\System\HBSKZoO.exe
  C:\Windows\System\HBSKZoO.exe
  2⤵
  - Executes dropped EXE
  PID:3480
- C:\Windows\System\HIpXkut.exe
  C:\Windows\System\HIpXkut.exe
  2⤵
  - Executes dropped EXE
  PID:2264
- C:\Windows\System\SVLzVBJ.exe
  C:\Windows\System\SVLzVBJ.exe
  2⤵
  - Executes dropped EXE
  PID:3352
- C:\Windows\System\PvXvJYR.exe
  C:\Windows\System\PvXvJYR.exe
  2⤵
  - Executes dropped EXE
  PID:4740
- C:\Windows\System\OBpTzdM.exe
  C:\Windows\System\OBpTzdM.exe
  2⤵
  - Executes dropped EXE
  PID:768
- C:\Windows\System\Eiqgtqb.exe
  C:\Windows\System\Eiqgtqb.exe
  2⤵
  - Executes dropped EXE
  PID:4756
- C:\Windows\System\PBOLtBH.exe
  C:\Windows\System\PBOLtBH.exe
  2⤵
  - Executes dropped EXE
  PID:548
- C:\Windows\System\jXEkCFG.exe
  C:\Windows\System\jXEkCFG.exe
  2⤵
  - Executes dropped EXE
  PID:2616
- C:\Windows\System\kanAqXt.exe
  C:\Windows\System\kanAqXt.exe
  2⤵
  - Executes dropped EXE
  PID:4312
- C:\Windows\System\syavdGg.exe
  C:\Windows\System\syavdGg.exe
  2⤵
  - Executes dropped EXE
  PID:3956
- C:\Windows\System\BbuUNzl.exe
  C:\Windows\System\BbuUNzl.exe
  2⤵
  - Executes dropped EXE
  PID:844
- C:\Windows\System\zRwcxuM.exe
  C:\Windows\System\zRwcxuM.exe
  2⤵
  - Executes dropped EXE
  PID:1044
- C:\Windows\System\jMbIHnG.exe
  C:\Windows\System\jMbIHnG.exe
  2⤵
  - Executes dropped EXE
  PID:1372
- C:\Windows\System\cBMPfAB.exe
  C:\Windows\System\cBMPfAB.exe
  2⤵
  - Executes dropped EXE
  PID:1444
- C:\Windows\System\VrlAnuB.exe
  C:\Windows\System\VrlAnuB.exe
  2⤵
  - Executes dropped EXE
  PID:4808
- C:\Windows\System\GDNIzEq.exe
  C:\Windows\System\GDNIzEq.exe
  2⤵
  - Executes dropped EXE
  PID:3336
- C:\Windows\System\TpBPbQn.exe
  C:\Windows\System\TpBPbQn.exe
  2⤵
  - Executes dropped EXE
  PID:3996
- C:\Windows\System\vSxHfDV.exe
  C:\Windows\System\vSxHfDV.exe
  2⤵
  - Executes dropped EXE
  PID:3784
- C:\Windows\System\ntLYJmn.exe
  C:\Windows\System\ntLYJmn.exe
  2⤵
  - Executes dropped EXE
  PID:1124
- C:\Windows\System\sfrxWHD.exe
  C:\Windows\System\sfrxWHD.exe
  2⤵
  - Executes dropped EXE
  PID:1480
- C:\Windows\System\HMGDlNr.exe
  C:\Windows\System\HMGDlNr.exe
  2⤵
  - Executes dropped EXE
  PID:3144
- C:\Windows\System\ZrpmLjf.exe
  C:\Windows\System\ZrpmLjf.exe
  2⤵
  - Executes dropped EXE
  PID:3324
- C:\Windows\System\hSCjjPc.exe
  C:\Windows\System\hSCjjPc.exe
  2⤵
  - Executes dropped EXE
  PID:3864
- C:\Windows\System\smiPnon.exe
  C:\Windows\System\smiPnon.exe
  2⤵
  - Executes dropped EXE
  PID:4412
- C:\Windows\System\RSTQszC.exe
  C:\Windows\System\RSTQszC.exe
  2⤵
  - Executes dropped EXE
  PID:3104
- C:\Windows\System\EPzoPCE.exe
  C:\Windows\System\EPzoPCE.exe
  2⤵
  - Executes dropped EXE
  PID:2244
- C:\Windows\System\vdfyIBS.exe
  C:\Windows\System\vdfyIBS.exe
  2⤵
  - Executes dropped EXE
  PID:1748
- C:\Windows\System\uDEuBzU.exe
  C:\Windows\System\uDEuBzU.exe
  2⤵
  - Executes dropped EXE
  PID:4124
- C:\Windows\System\wNcZhWN.exe
  C:\Windows\System\wNcZhWN.exe
  2⤵
  - Executes dropped EXE
  PID:4884
- C:\Windows\System\apjJGAw.exe
  C:\Windows\System\apjJGAw.exe
  2⤵
  - Executes dropped EXE
  PID:2028
- C:\Windows\System\DRuJbHr.exe
  C:\Windows\System\DRuJbHr.exe
  2⤵
  - Executes dropped EXE
  PID:1972
- C:\Windows\System\AyIWMTv.exe
  C:\Windows\System\AyIWMTv.exe
  2⤵
  - Executes dropped EXE
  PID:4296
- C:\Windows\System\WwUnezQ.exe
  C:\Windows\System\WwUnezQ.exe
  2⤵
  - Executes dropped EXE
  PID:4472
- C:\Windows\System\dgRVTDV.exe
  C:\Windows\System\dgRVTDV.exe
  2⤵
  - Executes dropped EXE
  PID:4404
- C:\Windows\System\AjpfQvW.exe
  C:\Windows\System\AjpfQvW.exe
  2⤵
  - Executes dropped EXE
  PID:3316
- C:\Windows\System\nLBybvA.exe
  C:\Windows\System\nLBybvA.exe
  2⤵
  - Executes dropped EXE
  PID:4816
- C:\Windows\System\OKCMzKf.exe
  C:\Windows\System\OKCMzKf.exe
  2⤵
  - Executes dropped EXE
  PID:1036
- C:\Windows\System\GBWaOeT.exe
  C:\Windows\System\GBWaOeT.exe
  2⤵
  - Executes dropped EXE
  PID:2680
- C:\Windows\System\ubmHUfc.exe
  C:\Windows\System\ubmHUfc.exe
  2⤵
  - Executes dropped EXE
  PID:3112
- C:\Windows\System\cKHoUef.exe
  C:\Windows\System\cKHoUef.exe
  2⤵
  - Executes dropped EXE
  PID:1332
- C:\Windows\System\Pdwxrlt.exe
  C:\Windows\System\Pdwxrlt.exe
  2⤵
  - Executes dropped EXE
  PID:1636
- C:\Windows\System\PfHQzVv.exe
  C:\Windows\System\PfHQzVv.exe
  2⤵
  - Executes dropped EXE
  PID:4716
- C:\Windows\System\LNFwWko.exe
  C:\Windows\System\LNFwWko.exe
  2⤵
  - Executes dropped EXE
  PID:3484
- C:\Windows\System\WKecztI.exe
  C:\Windows\System\WKecztI.exe
  2⤵
  - Executes dropped EXE
  PID:3616
- C:\Windows\System\hSHFWYX.exe
  C:\Windows\System\hSHFWYX.exe
  2⤵
  - Executes dropped EXE
  PID:4608
- C:\Windows\System\ehcbOgC.exe
  C:\Windows\System\ehcbOgC.exe
  2⤵
  - Executes dropped EXE
  PID:3776
- C:\Windows\System\csJyjhi.exe
  C:\Windows\System\csJyjhi.exe
  2⤵
  - Executes dropped EXE
  PID:700
- C:\Windows\System\BsUkPzu.exe
  C:\Windows\System\BsUkPzu.exe
  2⤵
  - Executes dropped EXE
  PID:1632
- C:\Windows\System\ZYVIJNn.exe
  C:\Windows\System\ZYVIJNn.exe
  2⤵
  - Executes dropped EXE
  PID:4024
- C:\Windows\System\ARQfghZ.exe
  C:\Windows\System\ARQfghZ.exe
  2⤵
  - Executes dropped EXE
  PID:5064
- C:\Windows\System\ZOrkLDN.exe
  C:\Windows\System\ZOrkLDN.exe
  2⤵
  - Executes dropped EXE
  PID:984
- C:\Windows\System\MaEbehF.exe
  C:\Windows\System\MaEbehF.exe
  2⤵
  - Executes dropped EXE
  PID:440
- C:\Windows\System\tgtdtKR.exe
  C:\Windows\System\tgtdtKR.exe
  2⤵
  PID:400
- C:\Windows\System\DCPJaJi.exe
  C:\Windows\System\DCPJaJi.exe
  2⤵
  PID:2548
- C:\Windows\System\njsnOqz.exe
  C:\Windows\System\njsnOqz.exe
  2⤵
  PID:3444
- C:\Windows\System\RqyAogp.exe
  C:\Windows\System\RqyAogp.exe
  2⤵
  PID:1684
- C:\Windows\System\WZARItu.exe
  C:\Windows\System\WZARItu.exe
  2⤵
  PID:1088
- C:\Windows\System\CfvKyBm.exe
  C:\Windows\System\CfvKyBm.exe
  2⤵
  PID:1648
- C:\Windows\System\TIzKRhw.exe
  C:\Windows\System\TIzKRhw.exe
  2⤵
  PID:3644
- C:\Windows\System\HnDdPJZ.exe
  C:\Windows\System\HnDdPJZ.exe
  2⤵
  PID:4916
- C:\Windows\System\MJGjIvt.exe
  C:\Windows\System\MJGjIvt.exe
  2⤵
  PID:4188
- C:\Windows\System\jEaIvkA.exe
  C:\Windows\System\jEaIvkA.exe
  2⤵
  PID:1020
- C:\Windows\System\YPbActJ.exe
  C:\Windows\System\YPbActJ.exe
  2⤵
  PID:3596
- C:\Windows\System\rLQsbUQ.exe
  C:\Windows\System\rLQsbUQ.exe
  2⤵
  PID:2396
- C:\Windows\System\hgLcCyi.exe
  C:\Windows\System\hgLcCyi.exe
  2⤵
  PID:928
- C:\Windows\System\RXZyyOe.exe
  C:\Windows\System\RXZyyOe.exe
  2⤵
  PID:3800
- C:\Windows\System\GGNagzZ.exe
  C:\Windows\System\GGNagzZ.exe
  2⤵
  PID:4880
- C:\Windows\System\TJPqUZF.exe
  C:\Windows\System\TJPqUZF.exe
  2⤵
  PID:4868
- C:\Windows\System\SnEJBwh.exe
  C:\Windows\System\SnEJBwh.exe
  2⤵
  PID:3980
- C:\Windows\System\yykONzS.exe
  C:\Windows\System\yykONzS.exe
  2⤵
  PID:3860
- C:\Windows\System\qnpRjVn.exe
  C:\Windows\System\qnpRjVn.exe
  2⤵
  PID:2300
- C:\Windows\System\VYnPKFa.exe
  C:\Windows\System\VYnPKFa.exe
  2⤵
  PID:3392
- C:\Windows\System\Dhezfub.exe
  C:\Windows\System\Dhezfub.exe
  2⤵
  PID:1920
- C:\Windows\System\DIOBHyR.exe
  C:\Windows\System\DIOBHyR.exe
  2⤵
  PID:1384
- C:\Windows\System\xljbGWE.exe
  C:\Windows\System\xljbGWE.exe
  2⤵
  PID:1616
- C:\Windows\System\UMtadpR.exe
  C:\Windows\System\UMtadpR.exe
  2⤵
  PID:3220
- C:\Windows\System\jRlDmtK.exe
  C:\Windows\System\jRlDmtK.exe
  2⤵
  PID:2276
- C:\Windows\System\oMobSRn.exe
  C:\Windows\System\oMobSRn.exe
  2⤵
  PID:2476
- C:\Windows\System\uyaZsQQ.exe
  C:\Windows\System\uyaZsQQ.exe
  2⤵
  PID:2620
- C:\Windows\System\bfxjsYn.exe
  C:\Windows\System\bfxjsYn.exe
  2⤵
  PID:3712
- C:\Windows\System\EhfacKk.exe
  C:\Windows\System\EhfacKk.exe
  2⤵
  PID:3760
- C:\Windows\System\ZVWnKVU.exe
  C:\Windows\System\ZVWnKVU.exe
  2⤵
  PID:1008
- C:\Windows\System\hFuBsRE.exe
  C:\Windows\System\hFuBsRE.exe
  2⤵
  PID:3844
- C:\Windows\System\fRLgcqT.exe
  C:\Windows\System\fRLgcqT.exe
  2⤵
  PID:4352
- C:\Windows\System\lOcJcfH.exe
  C:\Windows\System\lOcJcfH.exe
  2⤵
  PID:2712
- C:\Windows\System\BiuwIle.exe
  C:\Windows\System\BiuwIle.exe
  2⤵
  PID:3756
- C:\Windows\System\UJaSQvO.exe
  C:\Windows\System\UJaSQvO.exe
  2⤵
  PID:2728
- C:\Windows\System\ZpdZzwP.exe
  C:\Windows\System\ZpdZzwP.exe
  2⤵
  PID:224
- C:\Windows\System\FvAGiSG.exe
  C:\Windows\System\FvAGiSG.exe
  2⤵
  PID:2632
- C:\Windows\System\dtCbTVc.exe
  C:\Windows\System\dtCbTVc.exe
  2⤵
  PID:2116
- C:\Windows\System\kIzjUpR.exe
  C:\Windows\System\kIzjUpR.exe
  2⤵
  PID:2128
- C:\Windows\System\UdvnjHg.exe
  C:\Windows\System\UdvnjHg.exe
  2⤵
  PID:2696
- C:\Windows\System\mLdjTQl.exe
  C:\Windows\System\mLdjTQl.exe
  2⤵
  PID:1172
- C:\Windows\System\EkjEVQC.exe
  C:\Windows\System\EkjEVQC.exe
  2⤵
  PID:3532
- C:\Windows\System\yEnCbIu.exe
  C:\Windows\System\yEnCbIu.exe
  2⤵
  PID:2340
- C:\Windows\System\vUXzQbB.exe
  C:\Windows\System\vUXzQbB.exe
  2⤵
  PID:5052
- C:\Windows\System\pXtFtjA.exe
  C:\Windows\System\pXtFtjA.exe
  2⤵
  PID:4764
- C:\Windows\System\cdVyxCz.exe
  C:\Windows\System\cdVyxCz.exe
  2⤵
  PID:3548
- C:\Windows\System\gsSIJZK.exe
  C:\Windows\System\gsSIJZK.exe
  2⤵
  PID:3536
- C:\Windows\System\jfvPRij.exe
  C:\Windows\System\jfvPRij.exe
  2⤵
  PID:1504
- C:\Windows\System\TLglGpx.exe
  C:\Windows\System\TLglGpx.exe
  2⤵
  PID:740
- C:\Windows\System\adLJwgo.exe
  C:\Windows\System\adLJwgo.exe
  2⤵
  PID:3264
- C:\Windows\System\ftiVXYt.exe
  C:\Windows\System\ftiVXYt.exe
  2⤵
  PID:2664
- C:\Windows\System\yKluphT.exe
  C:\Windows\System\yKluphT.exe
  2⤵
  PID:4512
- C:\Windows\System\qxdLUHe.exe
  C:\Windows\System\qxdLUHe.exe
  2⤵
  PID:432
- C:\Windows\System\jYPiHFU.exe
  C:\Windows\System\jYPiHFU.exe
  2⤵
  PID:3964
- C:\Windows\System\xcKlfuV.exe
  C:\Windows\System\xcKlfuV.exe
  2⤵
  PID:2928
- C:\Windows\System\wlfjuxS.exe
  C:\Windows\System\wlfjuxS.exe
  2⤵
  PID:2296
- C:\Windows\System\zIVKsNM.exe
  C:\Windows\System\zIVKsNM.exe
  2⤵
  PID:4804
- C:\Windows\System\FmqZFgH.exe
  C:\Windows\System\FmqZFgH.exe
  2⤵
  PID:4920
- C:\Windows\System\DFcdQvv.exe
  C:\Windows\System\DFcdQvv.exe
  2⤵
  PID:1916
- C:\Windows\System\Udtocdu.exe
  C:\Windows\System\Udtocdu.exe
  2⤵
  PID:2260
- C:\Windows\System\YtnbIbx.exe
  C:\Windows\System\YtnbIbx.exe
  2⤵
  PID:3924
- C:\Windows\System\XdPAeRB.exe
  C:\Windows\System\XdPAeRB.exe
  2⤵
  PID:4224
- C:\Windows\System\AtEhnSa.exe
  C:\Windows\System\AtEhnSa.exe
  2⤵
  PID:2968
- C:\Windows\System\nieEULJ.exe
  C:\Windows\System\nieEULJ.exe
  2⤵
  PID:1828
- C:\Windows\System\riObyQN.exe
  C:\Windows\System\riObyQN.exe
  2⤵
  PID:748
- C:\Windows\System\VtgTCIW.exe
  C:\Windows\System\VtgTCIW.exe
  2⤵
  PID:4904
- C:\Windows\System\sLxeqDm.exe
  C:\Windows\System\sLxeqDm.exe
  2⤵
  PID:2096
- C:\Windows\System\PJAplgy.exe
  C:\Windows\System\PJAplgy.exe
  2⤵
  PID:1596
- C:\Windows\System\CvXayYa.exe
  C:\Windows\System\CvXayYa.exe
  2⤵
  PID:1240
- C:\Windows\System\igldnsy.exe
  C:\Windows\System\igldnsy.exe
  2⤵
  PID:3076
- C:\Windows\System\HxgZFvs.exe
  C:\Windows\System\HxgZFvs.exe
  2⤵
  PID:4828
- C:\Windows\System\yRazMmm.exe
  C:\Windows\System\yRazMmm.exe
  2⤵
  PID:716
- C:\Windows\System\gQYSJfm.exe
  C:\Windows\System\gQYSJfm.exe
  2⤵
  PID:3056
- C:\Windows\System\pxUqejx.exe
  C:\Windows\System\pxUqejx.exe
  2⤵
  PID:4380
- C:\Windows\System\GsioYlH.exe
  C:\Windows\System\GsioYlH.exe
  2⤵
  PID:4652
- C:\Windows\System\EOdyKSY.exe
  C:\Windows\System\EOdyKSY.exe
  2⤵
  PID:3612
- C:\Windows\System\VzfLbif.exe
  C:\Windows\System\VzfLbif.exe
  2⤵
  PID:3332
- C:\Windows\System\HkWNXSq.exe
  C:\Windows\System\HkWNXSq.exe
  2⤵
  PID:3516
- C:\Windows\System\aqojaSd.exe
  C:\Windows\System\aqojaSd.exe
  2⤵
  PID:5096
- C:\Windows\System\OLXpfrX.exe
  C:\Windows\System\OLXpfrX.exe
  2⤵
  PID:4204
- C:\Windows\System\APJWpTe.exe
  C:\Windows\System\APJWpTe.exe
  2⤵
  PID:1508
- C:\Windows\System\bKdZZxY.exe
  C:\Windows\System\bKdZZxY.exe
  2⤵
  PID:2508
- C:\Windows\System\IhAAlsu.exe
  C:\Windows\System\IhAAlsu.exe
  2⤵
  PID:4356
- C:\Windows\System\gvXBlIR.exe
  C:\Windows\System\gvXBlIR.exe
  2⤵
  PID:3024
- C:\Windows\System\tPskwrS.exe
  C:\Windows\System\tPskwrS.exe
  2⤵
  PID:5000
- C:\Windows\System\TwofsWu.exe
  C:\Windows\System\TwofsWu.exe
  2⤵
  PID:1608
- C:\Windows\System\FddhGuH.exe
  C:\Windows\System\FddhGuH.exe
  2⤵
  PID:968
- C:\Windows\System\yXxsGKf.exe
  C:\Windows\System\yXxsGKf.exe
  2⤵
  PID:1832
- C:\Windows\System\kfQqwvV.exe
  C:\Windows\System\kfQqwvV.exe
  2⤵
  PID:3872
- C:\Windows\System\frvDycb.exe
  C:\Windows\System\frvDycb.exe
  2⤵
  PID:3748
- C:\Windows\System\NprKZFo.exe
  C:\Windows\System\NprKZFo.exe
  2⤵
  PID:4604
- C:\Windows\System\xCbJUwZ.exe
  C:\Windows\System\xCbJUwZ.exe
  2⤵
  PID:1904
- C:\Windows\System\JusjKKv.exe
  C:\Windows\System\JusjKKv.exe
  2⤵
  PID:2888
- C:\Windows\System\bWtFYAe.exe
  C:\Windows\System\bWtFYAe.exe
  2⤵
  PID:4736
- C:\Windows\System\xTWeKYk.exe
  C:\Windows\System\xTWeKYk.exe
  2⤵
  PID:1340
- C:\Windows\System\BKLoezW.exe
  C:\Windows\System\BKLoezW.exe
  2⤵
  PID:2268
- C:\Windows\System\gLsSWNz.exe
  C:\Windows\System\gLsSWNz.exe
  2⤵
  PID:3312
- C:\Windows\System\IJSSzxn.exe
  C:\Windows\System\IJSSzxn.exe
  2⤵
  PID:4856
- C:\Windows\System\qRjeKey.exe
  C:\Windows\System\qRjeKey.exe
  2⤵
  PID:1960
- C:\Windows\System\vrqaOUU.exe
  C:\Windows\System\vrqaOUU.exe
  2⤵
  PID:3424
- C:\Windows\System\YzpFYrs.exe
  C:\Windows\System\YzpFYrs.exe
  2⤵
  PID:784
- C:\Windows\System\iRedCIc.exe
  C:\Windows\System\iRedCIc.exe
  2⤵
  PID:456
- C:\Windows\System\qGgHnVv.exe
  C:\Windows\System\qGgHnVv.exe
  2⤵
  PID:4372
- C:\Windows\System\QDPpGmK.exe
  C:\Windows\System\QDPpGmK.exe
  2⤵
  PID:4648
- C:\Windows\System\xLcQbzk.exe
  C:\Windows\System\xLcQbzk.exe
  2⤵
  PID:4032
- C:\Windows\System\ioSZIWq.exe
  C:\Windows\System\ioSZIWq.exe
  2⤵
  PID:2240
- C:\Windows\System\MvAoYTn.exe
  C:\Windows\System\MvAoYTn.exe
  2⤵
  PID:2532
- C:\Windows\System\XYxvSzq.exe
  C:\Windows\System\XYxvSzq.exe
  2⤵
  PID:3556
- C:\Windows\System\jXJhQMS.exe
  C:\Windows\System\jXJhQMS.exe
  2⤵
  PID:2320
- C:\Windows\System\lvYzNAB.exe
  C:\Windows\System\lvYzNAB.exe
  2⤵
  PID:4924
- C:\Windows\System\sLohwEp.exe
  C:\Windows\System\sLohwEp.exe
  2⤵
  PID:1080
- C:\Windows\System\tPZZdkc.exe
  C:\Windows\System\tPZZdkc.exe
  2⤵
  PID:3368
- C:\Windows\System\xjMCMQq.exe
  C:\Windows\System\xjMCMQq.exe
  2⤵
  PID:5136
- C:\Windows\System\lhdwPQG.exe
  C:\Windows\System\lhdwPQG.exe
  2⤵
  PID:5152
- C:\Windows\System\iMtRjMF.exe
  C:\Windows\System\iMtRjMF.exe
  2⤵
  PID:5168
- C:\Windows\System\ScEgxVq.exe
  C:\Windows\System\ScEgxVq.exe
  2⤵
  PID:5184
- C:\Windows\System\nClKRLM.exe
  C:\Windows\System\nClKRLM.exe
  2⤵
  PID:5200
- C:\Windows\System\bzvzKlt.exe
  C:\Windows\System\bzvzKlt.exe
  2⤵
  PID:5216
- C:\Windows\System\cxhIWMp.exe
  C:\Windows\System\cxhIWMp.exe
  2⤵
  PID:5232
- C:\Windows\System\oEzeRPx.exe
  C:\Windows\System\oEzeRPx.exe
  2⤵
  PID:5248
- C:\Windows\System\qPVHWVF.exe
  C:\Windows\System\qPVHWVF.exe
  2⤵
  PID:5264
- C:\Windows\System\fLYsKiO.exe
  C:\Windows\System\fLYsKiO.exe
  2⤵
  PID:5280
- C:\Windows\System\aGbhKLm.exe
  C:\Windows\System\aGbhKLm.exe
  2⤵
  PID:5296
- C:\Windows\System\MBQkXXB.exe
  C:\Windows\System\MBQkXXB.exe
  2⤵
  PID:5312
- C:\Windows\System\uZYksEs.exe
  C:\Windows\System\uZYksEs.exe
  2⤵
  PID:5328
- C:\Windows\System\ojysrex.exe
  C:\Windows\System\ojysrex.exe
  2⤵
  PID:5344
- C:\Windows\System\QGDMqCL.exe
  C:\Windows\System\QGDMqCL.exe
  2⤵
  PID:5360
- C:\Windows\System\UCfGSUy.exe
  C:\Windows\System\UCfGSUy.exe
  2⤵
  PID:5376
- C:\Windows\System\uqFQdyl.exe
  C:\Windows\System\uqFQdyl.exe
  2⤵
  PID:5392
- C:\Windows\System\dwoCrxg.exe
  C:\Windows\System\dwoCrxg.exe
  2⤵
  PID:5408
- C:\Windows\System\vqpPmiv.exe
  C:\Windows\System\vqpPmiv.exe
  2⤵
  PID:5424
- C:\Windows\System\xKnmNdC.exe
  C:\Windows\System\xKnmNdC.exe
  2⤵
  PID:5440
- C:\Windows\System\QyCPssf.exe
  C:\Windows\System\QyCPssf.exe
  2⤵
  PID:5456
- C:\Windows\System\YQUjboW.exe
  C:\Windows\System\YQUjboW.exe
  2⤵
  PID:5472
- C:\Windows\System\Dcfeztl.exe
  C:\Windows\System\Dcfeztl.exe
  2⤵
  PID:5488
- C:\Windows\System\UwNmtuE.exe
  C:\Windows\System\UwNmtuE.exe
  2⤵
  PID:5504
- C:\Windows\System\xBEYVzv.exe
  C:\Windows\System\xBEYVzv.exe
  2⤵
  PID:5520
- C:\Windows\System\yHhhWwM.exe
  C:\Windows\System\yHhhWwM.exe
  2⤵
  PID:5536
- C:\Windows\System\HFlsNbj.exe
  C:\Windows\System\HFlsNbj.exe
  2⤵
  PID:5552
- C:\Windows\System\vHzUIoP.exe
  C:\Windows\System\vHzUIoP.exe
  2⤵
  PID:5568
- C:\Windows\System\AbXnhtG.exe
  C:\Windows\System\AbXnhtG.exe
  2⤵
  PID:5584
- C:\Windows\System\yEKjDbi.exe
  C:\Windows\System\yEKjDbi.exe
  2⤵
  PID:5600
- C:\Windows\System\XLmgzsM.exe
  C:\Windows\System\XLmgzsM.exe
  2⤵
  PID:5616
- C:\Windows\System\swLSCQj.exe
  C:\Windows\System\swLSCQj.exe
  2⤵
  PID:5632
- C:\Windows\System\qycRcfX.exe
  C:\Windows\System\qycRcfX.exe
  2⤵
  PID:5648
- C:\Windows\System\jmOCyen.exe
  C:\Windows\System\jmOCyen.exe
  2⤵
  PID:5664
- C:\Windows\System\tYPMzJG.exe
  C:\Windows\System\tYPMzJG.exe
  2⤵
  PID:5680
- C:\Windows\System\nMlPGrJ.exe
  C:\Windows\System\nMlPGrJ.exe
  2⤵
  PID:5696
- C:\Windows\System\VCPtqaA.exe
  C:\Windows\System\VCPtqaA.exe
  2⤵
  PID:5712
- C:\Windows\System\IyszkaG.exe
  C:\Windows\System\IyszkaG.exe
  2⤵
  PID:5728
- C:\Windows\System\BklORXN.exe
  C:\Windows\System\BklORXN.exe
  2⤵
  PID:5744
- C:\Windows\System\QmhEnBD.exe
  C:\Windows\System\QmhEnBD.exe
  2⤵
  PID:5760
- C:\Windows\System\FkJExiU.exe
  C:\Windows\System\FkJExiU.exe
  2⤵
  PID:5776
- C:\Windows\System\JDjxzuQ.exe
  C:\Windows\System\JDjxzuQ.exe
  2⤵
  PID:5792
- C:\Windows\System\agrdXQm.exe
  C:\Windows\System\agrdXQm.exe
  2⤵
  PID:5808
- C:\Windows\System\jOOGikF.exe
  C:\Windows\System\jOOGikF.exe
  2⤵
  PID:5824
- C:\Windows\System\vydUYEn.exe
  C:\Windows\System\vydUYEn.exe
  2⤵
  PID:5840
- C:\Windows\System\CVWjwyv.exe
  C:\Windows\System\CVWjwyv.exe
  2⤵
  PID:5856
- C:\Windows\System\NjEBysB.exe
  C:\Windows\System\NjEBysB.exe
  2⤵
  PID:5872
- C:\Windows\System\tAfVVqC.exe
  C:\Windows\System\tAfVVqC.exe
  2⤵
  PID:5888
- C:\Windows\System\TClbHXT.exe
  C:\Windows\System\TClbHXT.exe
  2⤵
  PID:5904
- C:\Windows\System\lsSpasR.exe
  C:\Windows\System\lsSpasR.exe
  2⤵
  PID:5920
- C:\Windows\System\uceQBiY.exe
  C:\Windows\System\uceQBiY.exe
  2⤵
  PID:5936
- C:\Windows\System\GSMjTZU.exe
  C:\Windows\System\GSMjTZU.exe
  2⤵
  PID:5952
- C:\Windows\System\dwZYrbw.exe
  C:\Windows\System\dwZYrbw.exe
  2⤵
  PID:5968
- C:\Windows\System\QcwTnzL.exe
  C:\Windows\System\QcwTnzL.exe
  2⤵
  PID:5984
- C:\Windows\System\RinWsxB.exe
  C:\Windows\System\RinWsxB.exe
  2⤵
  PID:6000
- C:\Windows\System\YqFwCbV.exe
  C:\Windows\System\YqFwCbV.exe
  2⤵
  PID:6016
- C:\Windows\System\hlcfntX.exe
  C:\Windows\System\hlcfntX.exe
  2⤵
  PID:6032
- C:\Windows\System\unGjIps.exe
  C:\Windows\System\unGjIps.exe
  2⤵
  PID:6048
- C:\Windows\System\EqQXZpO.exe
  C:\Windows\System\EqQXZpO.exe
  2⤵
  PID:6064
- C:\Windows\System\DqzBPLC.exe
  C:\Windows\System\DqzBPLC.exe
  2⤵
  PID:6080
- C:\Windows\System\EqdeRQC.exe
  C:\Windows\System\EqdeRQC.exe
  2⤵
  PID:6096
- C:\Windows\System\ufsGwXD.exe
  C:\Windows\System\ufsGwXD.exe
  2⤵
  PID:6112
- C:\Windows\System\uEoCOKh.exe
  C:\Windows\System\uEoCOKh.exe
  2⤵
  PID:6128
- C:\Windows\System\nfWAIXL.exe
  C:\Windows\System\nfWAIXL.exe
  2⤵
  PID:1064
- C:\Windows\System\fMuBZfu.exe
  C:\Windows\System\fMuBZfu.exe
  2⤵
  PID:3204
- C:\Windows\System\mdmheam.exe
  C:\Windows\System\mdmheam.exe
  2⤵
  PID:4516
- C:\Windows\System\kCvhEmi.exe
  C:\Windows\System\kCvhEmi.exe
  2⤵
  PID:4800
- C:\Windows\System\dwhdgsx.exe
  C:\Windows\System\dwhdgsx.exe
  2⤵
  PID:3064
- C:\Windows\System\jzJizBF.exe
  C:\Windows\System\jzJizBF.exe
  2⤵
  PID:744
- C:\Windows\System\gwannCl.exe
  C:\Windows\System\gwannCl.exe
  2⤵
  PID:2544
- C:\Windows\System\PIVPcKV.exe
  C:\Windows\System\PIVPcKV.exe
  2⤵
  PID:532
- C:\Windows\System\qYaPYXC.exe
  C:\Windows\System\qYaPYXC.exe
  2⤵
  PID:4360
- C:\Windows\System\OlveKma.exe
  C:\Windows\System\OlveKma.exe
  2⤵
  PID:4168
- C:\Windows\System\UptQzTm.exe
  C:\Windows\System\UptQzTm.exe
  2⤵
  PID:1620
- C:\Windows\System\bjFyItb.exe
  C:\Windows\System\bjFyItb.exe
  2⤵
  PID:5144
- C:\Windows\System\puoeFWH.exe
  C:\Windows\System\puoeFWH.exe
  2⤵
  PID:5176
- C:\Windows\System\qaZOhwx.exe
  C:\Windows\System\qaZOhwx.exe
  2⤵
  PID:5208
- C:\Windows\System\dHwXrKx.exe
  C:\Windows\System\dHwXrKx.exe
  2⤵
  PID:5240
- C:\Windows\System\sOgbYFf.exe
  C:\Windows\System\sOgbYFf.exe
  2⤵
  PID:5272
- C:\Windows\System\wyJqFGJ.exe
  C:\Windows\System\wyJqFGJ.exe
  2⤵
  PID:5304
- C:\Windows\System\VYVwHcJ.exe
  C:\Windows\System\VYVwHcJ.exe
  2⤵
  PID:5336
- C:\Windows\System\QnkmsJz.exe
  C:\Windows\System\QnkmsJz.exe
  2⤵
  PID:5352
- C:\Windows\System\cSoNvAR.exe
  C:\Windows\System\cSoNvAR.exe
  2⤵
  PID:5384
- C:\Windows\System\oEwRLda.exe
  C:\Windows\System\oEwRLda.exe
  2⤵
  PID:5416
- C:\Windows\System\clolQHt.exe
  C:\Windows\System\clolQHt.exe
  2⤵
  PID:5448
- C:\Windows\System\etZwqLN.exe
  C:\Windows\System\etZwqLN.exe
  2⤵
  PID:5480
- C:\Windows\System\JFXvsIA.exe
  C:\Windows\System\JFXvsIA.exe
  2⤵
  PID:5512
- C:\Windows\System\MmkxfAx.exe
  C:\Windows\System\MmkxfAx.exe
  2⤵
  PID:5544
- C:\Windows\System\zMhVooA.exe
  C:\Windows\System\zMhVooA.exe
  2⤵
  PID:5564
- C:\Windows\System\dACyyrF.exe
  C:\Windows\System\dACyyrF.exe
  2⤵
  PID:5596
- C:\Windows\System\nDfiibo.exe
  C:\Windows\System\nDfiibo.exe
  2⤵
  PID:5628
- C:\Windows\System\hCfwQiV.exe
  C:\Windows\System\hCfwQiV.exe
  2⤵
  PID:5660
- C:\Windows\System\aqrgsVO.exe
  C:\Windows\System\aqrgsVO.exe
  2⤵
  PID:5692
- C:\Windows\System\pNqUhot.exe
  C:\Windows\System\pNqUhot.exe
  2⤵
  PID:5720
- C:\Windows\System\IfBbCSD.exe
  C:\Windows\System\IfBbCSD.exe
  2⤵
  PID:5752
- C:\Windows\System\tXikTLk.exe
  C:\Windows\System\tXikTLk.exe
  2⤵
  PID:4980
- C:\Windows\System\AKlsKCc.exe
  C:\Windows\System\AKlsKCc.exe
  2⤵
  PID:5804
- C:\Windows\System\JfHTDdT.exe
  C:\Windows\System\JfHTDdT.exe
  2⤵
  PID:5832
- C:\Windows\System\YfqFSMg.exe
  C:\Windows\System\YfqFSMg.exe
  2⤵
  PID:5864
- C:\Windows\System\nbJXGXD.exe
  C:\Windows\System\nbJXGXD.exe
  2⤵
  PID:4292
- C:\Windows\System\VFtEsjz.exe
  C:\Windows\System\VFtEsjz.exe
  2⤵
  PID:5916
- C:\Windows\System\tClvevu.exe
  C:\Windows\System\tClvevu.exe
  2⤵
  PID:5948
- C:\Windows\System\TMOfXDO.exe
  C:\Windows\System\TMOfXDO.exe
  2⤵
  PID:5980
- C:\Windows\System\kFAmZnB.exe
  C:\Windows\System\kFAmZnB.exe
  2⤵
  PID:6012
- C:\Windows\System\zyIdkVP.exe
  C:\Windows\System\zyIdkVP.exe
  2⤵
  PID:6044
- C:\Windows\System\ZeybgBD.exe
  C:\Windows\System\ZeybgBD.exe
  2⤵
  PID:6076
- C:\Windows\System\DUnlhRC.exe
  C:\Windows\System\DUnlhRC.exe
  2⤵
  PID:6104
- C:\Windows\System\ShTivwq.exe
  C:\Windows\System\ShTivwq.exe
  2⤵
  PID:6124
- C:\Windows\System\ITKbGwF.exe
  C:\Windows\System\ITKbGwF.exe
  2⤵
  PID:556
- C:\Windows\System\xmYwfRB.exe
  C:\Windows\System\xmYwfRB.exe
  2⤵
  PID:3588
- C:\Windows\System\OqPflTx.exe
  C:\Windows\System\OqPflTx.exe
  2⤵
  PID:3928
- C:\Windows\System\oyGXUPb.exe
  C:\Windows\System\oyGXUPb.exe
  2⤵
  PID:2412
- C:\Windows\System\aAEnKZa.exe
  C:\Windows\System\aAEnKZa.exe
  2⤵
  PID:4332
- C:\Windows\System\dnOelsh.exe
  C:\Windows\System\dnOelsh.exe
  2⤵
  PID:4476
- C:\Windows\System\tMWiAsz.exe
  C:\Windows\System\tMWiAsz.exe
  2⤵
  PID:5164
- C:\Windows\System\BkEOCxL.exe
  C:\Windows\System\BkEOCxL.exe
  2⤵
  PID:5228
- C:\Windows\System\lBJtqFK.exe
  C:\Windows\System\lBJtqFK.exe
  2⤵
  PID:5292
- C:\Windows\System\CAsbLXm.exe
  C:\Windows\System\CAsbLXm.exe
  2⤵
  PID:4148
- C:\Windows\System\tswUhJH.exe
  C:\Windows\System\tswUhJH.exe
  2⤵
  PID:1432
- C:\Windows\System\VUotapm.exe
  C:\Windows\System\VUotapm.exe
  2⤵
  PID:5436
- C:\Windows\System\RxmaFEO.exe
  C:\Windows\System\RxmaFEO.exe
  2⤵
  PID:5496
- C:\Windows\System\YLwisLr.exe
  C:\Windows\System\YLwisLr.exe
  2⤵
  PID:5532
- C:\Windows\System\fWAAGIW.exe
  C:\Windows\System\fWAAGIW.exe
  2⤵
  PID:5592
- C:\Windows\System\UPULnQD.exe
  C:\Windows\System\UPULnQD.exe
  2⤵
  PID:1540
- C:\Windows\System\yiNYKyv.exe
  C:\Windows\System\yiNYKyv.exe
  2⤵
  PID:5676
- C:\Windows\System\TqxlChM.exe
  C:\Windows\System\TqxlChM.exe
  2⤵
  PID:5708
- C:\Windows\System\fiSFjZb.exe
  C:\Windows\System\fiSFjZb.exe
  2⤵
  PID:5772
- C:\Windows\System\mTDkNNX.exe
  C:\Windows\System\mTDkNNX.exe
  2⤵
  PID:5820
- C:\Windows\System\uwFzIfn.exe
  C:\Windows\System\uwFzIfn.exe
  2⤵
  PID:6028
- C:\Windows\System\yeyDKKz.exe
  C:\Windows\System\yeyDKKz.exe
  2⤵
  PID:6072
- C:\Windows\System\BZmbiWw.exe
  C:\Windows\System\BZmbiWw.exe
  2⤵
  PID:3208
- C:\Windows\System\Cibltgv.exe
  C:\Windows\System\Cibltgv.exe
  2⤵
  PID:1288
- C:\Windows\System\GEJDCJa.exe
  C:\Windows\System\GEJDCJa.exe
  2⤵
  PID:4072
- C:\Windows\System\yTKnuKp.exe
  C:\Windows\System\yTKnuKp.exe
  2⤵
  PID:2740
- C:\Windows\System\GiMFRht.exe
  C:\Windows\System\GiMFRht.exe
  2⤵
  PID:904
- C:\Windows\System\IPGllxZ.exe
  C:\Windows\System\IPGllxZ.exe
  2⤵
  PID:1464
- C:\Windows\System\ykCpkWP.exe
  C:\Windows\System\ykCpkWP.exe
  2⤵
  PID:3856
- C:\Windows\System\fGJGEpw.exe
  C:\Windows\System\fGJGEpw.exe
  2⤵
  PID:5196
- C:\Windows\System\rtvdDhG.exe
  C:\Windows\System\rtvdDhG.exe
  2⤵
  PID:5288
- C:\Windows\System\KiCgJsx.exe
  C:\Windows\System\KiCgJsx.exe
  2⤵
  PID:5356
- C:\Windows\System\kaVtOVQ.exe
  C:\Windows\System\kaVtOVQ.exe
  2⤵
  PID:5432
- C:\Windows\System\vFruFfs.exe
  C:\Windows\System\vFruFfs.exe
  2⤵
  PID:404
- C:\Windows\System\VLeVsdn.exe
  C:\Windows\System\VLeVsdn.exe
  2⤵
  PID:868
- C:\Windows\System\KyWjpWl.exe
  C:\Windows\System\KyWjpWl.exe
  2⤵
  PID:5612
- C:\Windows\System\WMHDszg.exe
  C:\Windows\System\WMHDszg.exe
  2⤵
  PID:5740
- C:\Windows\System\FjDDqeL.exe
  C:\Windows\System\FjDDqeL.exe
  2⤵
  PID:4784
- C:\Windows\System\FWTUVnR.exe
  C:\Windows\System\FWTUVnR.exe
  2⤵
  PID:5704
- C:\Windows\System\cNPkoid.exe
  C:\Windows\System\cNPkoid.exe
  2⤵
  PID:4260
- C:\Windows\System\fUFdbAZ.exe
  C:\Windows\System\fUFdbAZ.exe
  2⤵
  PID:4464
- C:\Windows\System\EVTgPTY.exe
  C:\Windows\System\EVTgPTY.exe
  2⤵
  PID:2236
- C:\Windows\System\KIkHrCI.exe
  C:\Windows\System\KIkHrCI.exe
  2⤵
  PID:5816
- C:\Windows\System\XMamSgH.exe
  C:\Windows\System\XMamSgH.exe
  2⤵
  PID:2280
- C:\Windows\System\KhMqBdQ.exe
  C:\Windows\System\KhMqBdQ.exe
  2⤵
  PID:4076
- C:\Windows\System\PGHHXkj.exe
  C:\Windows\System\PGHHXkj.exe
  2⤵
  PID:4580
- C:\Windows\System\JoRRQmL.exe
  C:\Windows\System\JoRRQmL.exe
  2⤵
  PID:2588
- C:\Windows\System\ZYEQnpb.exe
  C:\Windows\System\ZYEQnpb.exe
  2⤵
  PID:6164
- C:\Windows\System\SyXDXsk.exe
  C:\Windows\System\SyXDXsk.exe
  2⤵
  PID:6212
- C:\Windows\System\dJtsGEw.exe
  C:\Windows\System\dJtsGEw.exe
  2⤵
  PID:6252
- C:\Windows\System\zZdGYlm.exe
  C:\Windows\System\zZdGYlm.exe
  2⤵
  PID:6280
- C:\Windows\System\opJjMzP.exe
  C:\Windows\System\opJjMzP.exe
  2⤵
  PID:6712
- C:\Windows\System\AtnuOps.exe
  C:\Windows\System\AtnuOps.exe
  2⤵
  PID:7472
- C:\Windows\System\anrtJap.exe
  C:\Windows\System\anrtJap.exe
  2⤵
  PID:7520
- C:\Windows\System\aWgbqhr.exe
  C:\Windows\System\aWgbqhr.exe
  2⤵
  PID:7636
- C:\Windows\System\IZWvJLa.exe
  C:\Windows\System\IZWvJLa.exe
  2⤵
  PID:7664
- C:\Windows\System\ecCEsPz.exe
  C:\Windows\System\ecCEsPz.exe
  2⤵
  PID:7704
- C:\Windows\System\nQoaDDW.exe
  C:\Windows\System\nQoaDDW.exe
  2⤵
  PID:7756
- C:\Windows\System\xWpubPQ.exe
  C:\Windows\System\xWpubPQ.exe
  2⤵
  PID:7812
- C:\Windows\System\yBzwUqU.exe
  C:\Windows\System\yBzwUqU.exe
  2⤵
  PID:7872
- C:\Windows\System\ivkhKvp.exe
  C:\Windows\System\ivkhKvp.exe
  2⤵
  PID:7920
- C:\Windows\System\jeQvWHY.exe
  C:\Windows\System\jeQvWHY.exe
  2⤵
  PID:7956
- C:\Windows\System\efvatIz.exe
  C:\Windows\System\efvatIz.exe
  2⤵
  PID:8552
- C:\Windows\System\JmCFrVi.exe
  C:\Windows\System\JmCFrVi.exe
  2⤵
  PID:8596
- C:\Windows\System\YUGayCx.exe
  C:\Windows\System\YUGayCx.exe
  2⤵
  PID:8672
- C:\Windows\System\GBAEVAa.exe
  C:\Windows\System\GBAEVAa.exe
  2⤵
  PID:8732
- C:\Windows\System\nKAZTbs.exe
  C:\Windows\System\nKAZTbs.exe
  2⤵
  PID:8784
- C:\Windows\System\OtYWYzb.exe
  C:\Windows\System\OtYWYzb.exe
  2⤵
  PID:8816
- C:\Windows\System\DfVhIYZ.exe
  C:\Windows\System\DfVhIYZ.exe
  2⤵
  PID:7976
- C:\Windows\System\wzVoKDW.exe
  C:\Windows\System\wzVoKDW.exe
  2⤵
  PID:7224
- C:\Windows\System\PMxBkBk.exe
  C:\Windows\System\PMxBkBk.exe
  2⤵
  PID:6828
- C:\Windows\System\NoyYkqD.exe
  C:\Windows\System\NoyYkqD.exe
  2⤵
  PID:6940
- C:\Windows\System\zWcbXgF.exe
  C:\Windows\System\zWcbXgF.exe
  2⤵
  PID:7780
- C:\Windows\System\JvRXmzN.exe
  C:\Windows\System\JvRXmzN.exe
  2⤵
  PID:7944
- C:\Windows\System\hkjuLqU.exe
  C:\Windows\System\hkjuLqU.exe
  2⤵
  PID:640
- C:\Windows\System\unWmPux.exe
  C:\Windows\System\unWmPux.exe
  2⤵
  PID:8996
- C:\Windows\System\KnpwhfA.exe
  C:\Windows\System\KnpwhfA.exe
  2⤵
  PID:9244
- C:\Windows\System\qifaNgM.exe
  C:\Windows\System\qifaNgM.exe
  2⤵
  PID:9288
- C:\Windows\System\tigdNOn.exe
  C:\Windows\System\tigdNOn.exe
  2⤵
  PID:9320
- C:\Windows\System\iZOsFcL.exe
  C:\Windows\System\iZOsFcL.exe
  2⤵
  PID:9352
- C:\Windows\System\QWwDnRG.exe
  C:\Windows\System\QWwDnRG.exe
  2⤵
  PID:9384
- C:\Windows\System\uDlbuIp.exe
  C:\Windows\System\uDlbuIp.exe
  2⤵
  PID:9420
- C:\Windows\System\mvJfCLC.exe
  C:\Windows\System\mvJfCLC.exe
  2⤵
  PID:9456
- C:\Windows\System\JXkuWdg.exe
  C:\Windows\System\JXkuWdg.exe
  2⤵
  PID:9488
- C:\Windows\System\SyaRBGj.exe
  C:\Windows\System\SyaRBGj.exe
  2⤵
  PID:9524
- C:\Windows\System\MmyiKQS.exe
  C:\Windows\System\MmyiKQS.exe
  2⤵
  PID:9560
- C:\Windows\System\MYsSEgE.exe
  C:\Windows\System\MYsSEgE.exe
  2⤵
  PID:9604
- C:\Windows\System\zPDUFca.exe
  C:\Windows\System\zPDUFca.exe
  2⤵
  PID:9644
- C:\Windows\System\bZcKdYS.exe
  C:\Windows\System\bZcKdYS.exe
  2⤵
  PID:9668
- C:\Windows\System\AkgRFvZ.exe
  C:\Windows\System\AkgRFvZ.exe
  2⤵
  PID:9888
- C:\Windows\System\LdDKwnI.exe
  C:\Windows\System\LdDKwnI.exe
  2⤵
  PID:10092
- C:\Windows\System\cfRTGKx.exe
  C:\Windows\System\cfRTGKx.exe
  2⤵
  PID:10148
- C:\Windows\System\PmbHxrL.exe
  C:\Windows\System\PmbHxrL.exe
  2⤵
  PID:10176
- C:\Windows\System\xkisjuz.exe
  C:\Windows\System\xkisjuz.exe
  2⤵
  PID:10196
- C:\Windows\System\pTJxeXe.exe
  C:\Windows\System\pTJxeXe.exe
  2⤵
  PID:8712
- C:\Windows\System\YcyxMLL.exe
  C:\Windows\System\YcyxMLL.exe
  2⤵
  PID:8404
- C:\Windows\System\djxqvUI.exe
  C:\Windows\System\djxqvUI.exe
  2⤵
  PID:7300
- C:\Windows\System\xFbDGsT.exe
  C:\Windows\System\xFbDGsT.exe
  2⤵
  PID:8560
- C:\Windows\System\HzZjLJe.exe
  C:\Windows\System\HzZjLJe.exe
  2⤵
  PID:8828
- C:\Windows\System\nKysxlT.exe
  C:\Windows\System\nKysxlT.exe
  2⤵
  PID:6632
- C:\Windows\System\uTOenhm.exe
  C:\Windows\System\uTOenhm.exe
  2⤵
  PID:7900
- C:\Windows\System\lySJVOa.exe
  C:\Windows\System\lySJVOa.exe
  2⤵
  PID:9332
- C:\Windows\System\zGqAnNe.exe
  C:\Windows\System\zGqAnNe.exe
  2⤵
  PID:6220
- C:\Windows\System\QYIKUrQ.exe
  C:\Windows\System\QYIKUrQ.exe
  2⤵
  PID:6372
- C:\Windows\System\FLrhoLv.exe
  C:\Windows\System\FLrhoLv.exe
  2⤵
  PID:7216
- C:\Windows\System\zDPvveu.exe
  C:\Windows\System\zDPvveu.exe
  2⤵
  PID:6648
- C:\Windows\System\BZXdxwb.exe
  C:\Windows\System\BZXdxwb.exe
  2⤵
  PID:6896
- C:\Windows\System\ZLbxNGa.exe
  C:\Windows\System\ZLbxNGa.exe
  2⤵
  PID:7652
- C:\Windows\System\xcAlBuE.exe
  C:\Windows\System\xcAlBuE.exe
  2⤵
  PID:8196
- C:\Windows\System\UQDOEbf.exe
  C:\Windows\System\UQDOEbf.exe
  2⤵
  PID:9224
- C:\Windows\System\KKalHzj.exe
  C:\Windows\System\KKalHzj.exe
  2⤵
  PID:9340
- C:\Windows\System\lHvuljt.exe
  C:\Windows\System\lHvuljt.exe
  2⤵
  PID:9448
- C:\Windows\System\FeGCzlE.exe
  C:\Windows\System\FeGCzlE.exe
  2⤵
  PID:9864
- C:\Windows\System\dzxstdf.exe
  C:\Windows\System\dzxstdf.exe
  2⤵
  PID:7880
- C:\Windows\System\NBjcNkY.exe
  C:\Windows\System\NBjcNkY.exe
  2⤵
  PID:9900
- C:\Windows\System\NXXLBaH.exe
  C:\Windows\System\NXXLBaH.exe
  2⤵
  PID:9304
- C:\Windows\System\YWPoxZn.exe
  C:\Windows\System\YWPoxZn.exe
  2⤵
  PID:9348
- C:\Windows\System\GrjZECB.exe
  C:\Windows\System\GrjZECB.exe
  2⤵
  PID:9392
- C:\Windows\System\TElbDIo.exe
  C:\Windows\System\TElbDIo.exe
  2⤵
  PID:9408
- C:\Windows\System\ZItmmHI.exe
  C:\Windows\System\ZItmmHI.exe
  2⤵
  PID:9452
- C:\Windows\System\XXvFPoK.exe
  C:\Windows\System\XXvFPoK.exe
  2⤵
  PID:9596
- C:\Windows\System\pYFMngO.exe
  C:\Windows\System\pYFMngO.exe
  2⤵
  PID:9656
- C:\Windows\System\DLGxNEt.exe
  C:\Windows\System\DLGxNEt.exe
  2⤵
  PID:9812
- C:\Windows\System\khevDUV.exe
  C:\Windows\System\khevDUV.exe
  2⤵
  PID:9844
- C:\Windows\System\FmNVfuT.exe
  C:\Windows\System\FmNVfuT.exe
  2⤵
  PID:9968
- C:\Windows\System\YZaMZbW.exe
  C:\Windows\System\YZaMZbW.exe
  2⤵
  PID:10104
- C:\Windows\System\fzvskxG.exe
  C:\Windows\System\fzvskxG.exe
  2⤵
  PID:10216
- C:\Windows\System\OduIVFO.exe
  C:\Windows\System\OduIVFO.exe
  2⤵
  PID:8448
- C:\Windows\System\HAuniDC.exe
  C:\Windows\System\HAuniDC.exe
  2⤵
  PID:8612
- C:\Windows\System\qmVLJXq.exe
  C:\Windows\System\qmVLJXq.exe
  2⤵
  PID:8892
- C:\Windows\System\ptqqzyL.exe
  C:\Windows\System\ptqqzyL.exe
  2⤵
  PID:7284
- C:\Windows\System\OfLOhkL.exe
  C:\Windows\System\OfLOhkL.exe
  2⤵
  PID:6812
- C:\Windows\System\YwbzJKI.exe
  C:\Windows\System\YwbzJKI.exe
  2⤵
  PID:6472
- C:\Windows\System\hKkfPsC.exe
  C:\Windows\System\hKkfPsC.exe
  2⤵
  PID:7828
- C:\Windows\System\bcjaJoK.exe
  C:\Windows\System\bcjaJoK.exe
  2⤵
  PID:7456
- C:\Windows\System\JmleRrm.exe
  C:\Windows\System\JmleRrm.exe
  2⤵
  PID:9272
- C:\Windows\System\BHgXUKF.exe
  C:\Windows\System\BHgXUKF.exe
  2⤵
  PID:9956
- C:\Windows\System\MUkZjef.exe
  C:\Windows\System\MUkZjef.exe
  2⤵
  PID:9416
- C:\Windows\System\quDKdCN.exe
  C:\Windows\System\quDKdCN.exe
  2⤵
  PID:9576
- C:\Windows\System\pZvFwNO.exe
  C:\Windows\System\pZvFwNO.exe
  2⤵
  PID:9788
- C:\Windows\System\TUzpMau.exe
  C:\Windows\System\TUzpMau.exe
  2⤵
  PID:10160
- C:\Windows\System\OGxHbyf.exe
  C:\Windows\System\OGxHbyf.exe
  2⤵
  PID:8772
- C:\Windows\System\plHUchH.exe
  C:\Windows\System\plHUchH.exe
  2⤵
  PID:9192
- C:\Windows\System\MyCZCBm.exe
  C:\Windows\System\MyCZCBm.exe
  2⤵
  PID:9708
- C:\Windows\System\cCvDFLP.exe
  C:\Windows\System\cCvDFLP.exe
  2⤵
  PID:8668
- C:\Windows\System\keRQVfO.exe
  C:\Windows\System\keRQVfO.exe
  2⤵
  PID:9472
- C:\Windows\System\lzixsGU.exe
  C:\Windows\System\lzixsGU.exe
  2⤵
  PID:9772
- C:\Windows\System\OkMEsLQ.exe
  C:\Windows\System\OkMEsLQ.exe
  2⤵
  PID:9152
- C:\Windows\System\qCFuKyi.exe
  C:\Windows\System\qCFuKyi.exe
  2⤵
  PID:8020
- C:\Windows\System\pLaqbYu.exe
  C:\Windows\System\pLaqbYu.exe
  2⤵
  PID:7908
- C:\Windows\System\iLVeLUC.exe
  C:\Windows\System\iLVeLUC.exe
  2⤵
  PID:924
- C:\Windows\System\cFZnHvP.exe
  C:\Windows\System\cFZnHvP.exe
  2⤵
  PID:2720
- C:\Windows\System\vCXtBYL.exe
  C:\Windows\System\vCXtBYL.exe
  2⤵
  PID:9284
- C:\Windows\System\egXKGnI.exe
  C:\Windows\System\egXKGnI.exe
  2⤵
  PID:10252
- C:\Windows\System\QPhiWCv.exe
  C:\Windows\System\QPhiWCv.exe
  2⤵
  PID:10268
- C:\Windows\System\yizvsUu.exe
  C:\Windows\System\yizvsUu.exe
  2⤵
  PID:10296
- C:\Windows\System\QiyzNIK.exe
  C:\Windows\System\QiyzNIK.exe
  2⤵
  PID:10328
- C:\Windows\System\OyGctZQ.exe
  C:\Windows\System\OyGctZQ.exe
  2⤵
  PID:10352
- C:\Windows\System\qkiuybn.exe
  C:\Windows\System\qkiuybn.exe
  2⤵
  PID:10396
- C:\Windows\System\KkDdmdV.exe
  C:\Windows\System\KkDdmdV.exe
  2⤵
  PID:10412
- C:\Windows\System\hAZjGOK.exe
  C:\Windows\System\hAZjGOK.exe
  2⤵
  PID:10464
- C:\Windows\System\wEOsFxd.exe
  C:\Windows\System\wEOsFxd.exe
  2⤵
  PID:10488
- C:\Windows\System\xwDjFMB.exe
  C:\Windows\System\xwDjFMB.exe
  2⤵
  PID:10520
- C:\Windows\System\TLmXKpL.exe
  C:\Windows\System\TLmXKpL.exe
  2⤵
  PID:10536
- C:\Windows\System\gzTHxAJ.exe
  C:\Windows\System\gzTHxAJ.exe
  2⤵
  PID:10564
- C:\Windows\System\YeVoswa.exe
  C:\Windows\System\YeVoswa.exe
  2⤵
  PID:10580
- C:\Windows\System\VaMhuFG.exe
  C:\Windows\System\VaMhuFG.exe
  2⤵
  PID:10612
- C:\Windows\System\pFSfGfL.exe
  C:\Windows\System\pFSfGfL.exe
  2⤵
  PID:10632
- C:\Windows\System\aGzXBIv.exe
  C:\Windows\System\aGzXBIv.exe
  2⤵
  PID:10664
- C:\Windows\System\DbJdiSc.exe
  C:\Windows\System\DbJdiSc.exe
  2⤵
  PID:10716
- C:\Windows\System\wcwrKDK.exe
  C:\Windows\System\wcwrKDK.exe
  2⤵
  PID:10744
- C:\Windows\System\ROdQtmb.exe
  C:\Windows\System\ROdQtmb.exe
  2⤵
  PID:10768
- C:\Windows\System\YaqoYDU.exe
  C:\Windows\System\YaqoYDU.exe
  2⤵
  PID:10788
- C:\Windows\System\DmLayMA.exe
  C:\Windows\System\DmLayMA.exe
  2⤵
  PID:10816
- C:\Windows\System\ukrCOCa.exe
  C:\Windows\System\ukrCOCa.exe
  2⤵
  PID:10844
- C:\Windows\System\FNjERqD.exe
  C:\Windows\System\FNjERqD.exe
  2⤵
  PID:10872
- C:\Windows\System\GGIzDcy.exe
  C:\Windows\System\GGIzDcy.exe
  2⤵
  PID:10912
- C:\Windows\System\HTXWcqJ.exe
  C:\Windows\System\HTXWcqJ.exe
  2⤵
  PID:10928
- C:\Windows\System\lEPVkPq.exe
  C:\Windows\System\lEPVkPq.exe
  2⤵
  PID:10956
- C:\Windows\System\WSSITEF.exe
  C:\Windows\System\WSSITEF.exe
  2⤵
  PID:10976
- C:\Windows\System\sFsULJf.exe
  C:\Windows\System\sFsULJf.exe
  2⤵
  PID:11008
- C:\Windows\System\gonqrba.exe
  C:\Windows\System\gonqrba.exe
  2⤵
  PID:11028
- C:\Windows\System\yDvfgtm.exe
  C:\Windows\System\yDvfgtm.exe
  2⤵
  PID:11052
- C:\Windows\System\DyerCGN.exe
  C:\Windows\System\DyerCGN.exe
  2⤵
  PID:11088
- C:\Windows\System\aucXgot.exe
  C:\Windows\System\aucXgot.exe
  2⤵
  PID:11128
- C:\Windows\System\EfvBRpp.exe
  C:\Windows\System\EfvBRpp.exe
  2⤵
  PID:11164
- C:\Windows\System\rWErzsB.exe
  C:\Windows\System\rWErzsB.exe
  2⤵
  PID:11180
- C:\Windows\System\QoYkTfQ.exe
  C:\Windows\System\QoYkTfQ.exe
  2⤵
  PID:11204
- C:\Windows\System\xfdTKpR.exe
  C:\Windows\System\xfdTKpR.exe
  2⤵
  PID:11248
- C:\Windows\System\cNwSAFK.exe
  C:\Windows\System\cNwSAFK.exe
  2⤵
  PID:10316
- C:\Windows\System\MLmkZQe.exe
  C:\Windows\System\MLmkZQe.exe
  2⤵
  PID:10340
- C:\Windows\System\emwpOah.exe
  C:\Windows\System\emwpOah.exe
  2⤵
  PID:10384
- C:\Windows\System\INKVPNt.exe
  C:\Windows\System\INKVPNt.exe
  2⤵
  PID:10480
- C:\Windows\System\oGERkqf.exe
  C:\Windows\System\oGERkqf.exe
  2⤵
  PID:10556
- C:\Windows\System\rmTuCay.exe
  C:\Windows\System\rmTuCay.exe
  2⤵
  PID:10592
- C:\Windows\System\lahTOkC.exe
  C:\Windows\System\lahTOkC.exe
  2⤵
  PID:10620
- C:\Windows\System\ZUTNMhC.exe
  C:\Windows\System\ZUTNMhC.exe
  2⤵
  PID:10708
- C:\Windows\System\heGvkDm.exe
  C:\Windows\System\heGvkDm.exe
  2⤵
  PID:10804
- C:\Windows\System\ioOMadS.exe
  C:\Windows\System\ioOMadS.exe
  2⤵
  PID:10856
- C:\Windows\System\iSmWhsA.exe
  C:\Windows\System\iSmWhsA.exe
  2⤵
  PID:10920
- C:\Windows\System\wAibtuQ.exe
  C:\Windows\System\wAibtuQ.exe
  2⤵
  PID:10972
- C:\Windows\System\drprTyR.exe
  C:\Windows\System\drprTyR.exe
  2⤵
  PID:11048
- C:\Windows\System\PaIFQjt.exe
  C:\Windows\System\PaIFQjt.exe
  2⤵
  PID:11096
- C:\Windows\System\uoANGvb.exe
  C:\Windows\System\uoANGvb.exe
  2⤵
  PID:11200
- C:\Windows\System\hidVmZT.exe
  C:\Windows\System\hidVmZT.exe
  2⤵
  PID:10244
- C:\Windows\System\wSnOyiv.exe
  C:\Windows\System\wSnOyiv.exe
  2⤵
  PID:10376
- C:\Windows\System\IZajDjY.exe
  C:\Windows\System\IZajDjY.exe
  2⤵
  PID:10460
- C:\Windows\System\HAnQWWa.exe
  C:\Windows\System\HAnQWWa.exe
  2⤵
  PID:10508
- C:\Windows\System\jqZEsvZ.exe
  C:\Windows\System\jqZEsvZ.exe
  2⤵
  PID:10688
- C:\Windows\System\wjgYmOK.exe
  C:\Windows\System\wjgYmOK.exe
  2⤵
  PID:10888
- C:\Windows\System\NMZhBpi.exe
  C:\Windows\System\NMZhBpi.exe
  2⤵
  PID:11020
- C:\Windows\System\xYwQWLo.exe
  C:\Windows\System\xYwQWLo.exe
  2⤵
  PID:11172
- C:\Windows\System\uUluAiN.exe
  C:\Windows\System\uUluAiN.exe
  2⤵
  PID:10428
- C:\Windows\System\tjVoNLR.exe
  C:\Windows\System\tjVoNLR.exe
  2⤵
  PID:10528
- C:\Windows\System\OOyreHx.exe
  C:\Windows\System\OOyreHx.exe
  2⤵
  PID:10764
- C:\Windows\System\vuUoRQJ.exe
  C:\Windows\System\vuUoRQJ.exe
  2⤵
  PID:11268
- C:\Windows\System\pnCuWjV.exe
  C:\Windows\System\pnCuWjV.exe
  2⤵
  PID:11328
- C:\Windows\System\ClALxMv.exe
  C:\Windows\System\ClALxMv.exe
  2⤵
  PID:11356
- C:\Windows\System\FfYmHgx.exe
  C:\Windows\System\FfYmHgx.exe
  2⤵
  PID:11384
- C:\Windows\System\cSFseZG.exe
  C:\Windows\System\cSFseZG.exe
  2⤵
  PID:11412
- C:\Windows\System\DwyfEVy.exe
  C:\Windows\System\DwyfEVy.exe
  2⤵
  PID:11440
- C:\Windows\System\NIhUdef.exe
  C:\Windows\System\NIhUdef.exe
  2⤵
  PID:11464
- C:\Windows\System\NSXjDBH.exe
  C:\Windows\System\NSXjDBH.exe
  2⤵
  PID:11484
- C:\Windows\System\abqAOEu.exe
  C:\Windows\System\abqAOEu.exe
  2⤵
  PID:11512
- C:\Windows\System\sZYKhNe.exe
  C:\Windows\System\sZYKhNe.exe
  2⤵
  PID:11536
- C:\Windows\System\kAWEMeH.exe
  C:\Windows\System\kAWEMeH.exe
  2⤵
  PID:11556
- C:\Windows\System\MAiONok.exe
  C:\Windows\System\MAiONok.exe
  2⤵
  PID:11572
- C:\Windows\System\JbOPkEE.exe
  C:\Windows\System\JbOPkEE.exe
  2⤵
  PID:11608
- C:\Windows\System\iKCAGPD.exe
  C:\Windows\System\iKCAGPD.exe
  2⤵
  PID:11636
- C:\Windows\System\ZeLZsMT.exe
  C:\Windows\System\ZeLZsMT.exe
  2⤵
  PID:11664
- C:\Windows\System\hWfTBDO.exe
  C:\Windows\System\hWfTBDO.exe
  2⤵
  PID:11684
- C:\Windows\System\iZiIDlp.exe
  C:\Windows\System\iZiIDlp.exe
  2⤵
  PID:11732
- C:\Windows\System\ZlQKPfA.exe
  C:\Windows\System\ZlQKPfA.exe
  2⤵
  PID:11764
- C:\Windows\System\AlMrrGG.exe
  C:\Windows\System\AlMrrGG.exe
  2⤵
  PID:11792
- C:\Windows\System\otLcxWM.exe
  C:\Windows\System\otLcxWM.exe
  2⤵
  PID:11808
- C:\Windows\System\wsukVMy.exe
  C:\Windows\System\wsukVMy.exe
  2⤵
  PID:11832
- C:\Windows\System\FxtehQT.exe
  C:\Windows\System\FxtehQT.exe
  2⤵
  PID:11856
- C:\Windows\System\lAnbBEb.exe
  C:\Windows\System\lAnbBEb.exe
  2⤵
  PID:11888
- C:\Windows\System\sOowaaB.exe
  C:\Windows\System\sOowaaB.exe
  2⤵
  PID:11932
- C:\Windows\System\XViFgVM.exe
  C:\Windows\System\XViFgVM.exe
  2⤵
  PID:11968
- C:\Windows\System\muKdIVp.exe
  C:\Windows\System\muKdIVp.exe
  2⤵
  PID:11988
- C:\Windows\System\MdyQYcz.exe
  C:\Windows\System\MdyQYcz.exe
  2⤵
  PID:12016
- C:\Windows\System\dsUJSSj.exe
  C:\Windows\System\dsUJSSj.exe
  2⤵
  PID:12040
- C:\Windows\System\tofGWTR.exe
  C:\Windows\System\tofGWTR.exe
  2⤵
  PID:12072
- C:\Windows\System\hajLrdq.exe
  C:\Windows\System\hajLrdq.exe
  2⤵
  PID:12092
- C:\Windows\System\BpKMTTh.exe
  C:\Windows\System\BpKMTTh.exe
  2⤵
  PID:12120
- C:\Windows\System\rzIVJRz.exe
  C:\Windows\System\rzIVJRz.exe
  2⤵
  PID:12152
- C:\Windows\System\KaAIQDX.exe
  C:\Windows\System\KaAIQDX.exe
  2⤵
  PID:12184
- C:\Windows\System\AZZKEdH.exe
  C:\Windows\System\AZZKEdH.exe
  2⤵
  PID:12212
- C:\Windows\System\grzxyiv.exe
  C:\Windows\System\grzxyiv.exe
  2⤵
  PID:12240
- C:\Windows\System\jnwLbtm.exe
  C:\Windows\System\jnwLbtm.exe
  2⤵
  PID:12268
- C:\Windows\System\qgGJshM.exe
  C:\Windows\System\qgGJshM.exe
  2⤵
  PID:11236
- C:\Windows\System\VeSZwQS.exe
  C:\Windows\System\VeSZwQS.exe
  2⤵
  PID:11376
- C:\Windows\System\XxmCgFb.exe
  C:\Windows\System\XxmCgFb.exe
  2⤵
  PID:11436
- C:\Windows\System\yDIUiCZ.exe
  C:\Windows\System\yDIUiCZ.exe
  2⤵
  PID:11496
- C:\Windows\System\QqsmBPA.exe
  C:\Windows\System\QqsmBPA.exe
  2⤵
  PID:11544
- C:\Windows\System\EPZkgyF.exe
  C:\Windows\System\EPZkgyF.exe
  2⤵
  PID:11644
- C:\Windows\System\OTVXRJz.exe
  C:\Windows\System\OTVXRJz.exe
  2⤵
  PID:11660
- C:\Windows\System\zUgxfCt.exe
  C:\Windows\System\zUgxfCt.exe
  2⤵
  PID:11772
- C:\Windows\System\zITCQii.exe
  C:\Windows\System\zITCQii.exe
  2⤵
  PID:11800
- C:\Windows\System\UektWYE.exe
  C:\Windows\System\UektWYE.exe
  2⤵
  PID:11912
- C:\Windows\System\YWYMicd.exe
  C:\Windows\System\YWYMicd.exe
  2⤵
  PID:12012
- C:\Windows\System\fcLLoon.exe
  C:\Windows\System\fcLLoon.exe
  2⤵
  PID:12032
- C:\Windows\System\sZhubRS.exe
  C:\Windows\System\sZhubRS.exe
  2⤵
  PID:12112
- C:\Windows\System\HuZwvZL.exe
  C:\Windows\System\HuZwvZL.exe
  2⤵
  PID:12176
- C:\Windows\System\tsfgmmH.exe
  C:\Windows\System\tsfgmmH.exe
  2⤵
  PID:12260
- C:\Windows\System\FlvsPkx.exe
  C:\Windows\System\FlvsPkx.exe
  2⤵
  PID:11396
- C:\Windows\System\uLpGRyX.exe
  C:\Windows\System\uLpGRyX.exe
  2⤵
  PID:11552
- C:\Windows\System\DDWdvQY.exe
  C:\Windows\System\DDWdvQY.exe
  2⤵
  PID:11724
- C:\Windows\System\tqUNVZl.exe
  C:\Windows\System\tqUNVZl.exe
  2⤵
  PID:11904
- C:\Windows\System\ehtQbjm.exe
  C:\Windows\System\ehtQbjm.exe
  2⤵
  PID:11952
- C:\Windows\System\bBeeAjY.exe
  C:\Windows\System\bBeeAjY.exe
  2⤵
  PID:12108
- C:\Windows\System\pKfKsep.exe
  C:\Windows\System\pKfKsep.exe
  2⤵
  PID:11320
- C:\Windows\System\kuIjaui.exe
  C:\Windows\System\kuIjaui.exe
  2⤵
  PID:11628
- C:\Windows\System\hftlckL.exe
  C:\Windows\System\hftlckL.exe
  2⤵
  PID:11108
- C:\Windows\System\UZgpOmL.exe
  C:\Windows\System\UZgpOmL.exe
  2⤵
  PID:12456
- C:\Windows\System\UMzBaSE.exe
  C:\Windows\System\UMzBaSE.exe
  2⤵
  PID:12480
- C:\Windows\System\rwBqzLs.exe
  C:\Windows\System\rwBqzLs.exe
  2⤵
  PID:12496
- C:\Windows\System\FhjJWbW.exe
  C:\Windows\System\FhjJWbW.exe
  2⤵
  PID:12516
- C:\Windows\System\ppxBEsS.exe
  C:\Windows\System\ppxBEsS.exe
  2⤵
  PID:12540
- C:\Windows\System\iJMorTC.exe
  C:\Windows\System\iJMorTC.exe
  2⤵
  PID:12568
- C:\Windows\System\etzzbBy.exe
  C:\Windows\System\etzzbBy.exe
  2⤵
  PID:12600
- C:\Windows\System\TpxMivP.exe
  C:\Windows\System\TpxMivP.exe
  2⤵
  PID:12636
- C:\Windows\System\QSPTNkb.exe
  C:\Windows\System\QSPTNkb.exe
  2⤵
  PID:12672
- C:\Windows\System\hNwfhat.exe
  C:\Windows\System\hNwfhat.exe
  2⤵
  PID:12704
- C:\Windows\System\XixKlZv.exe
  C:\Windows\System\XixKlZv.exe
  2⤵
  PID:12724
- C:\Windows\System\LojnoqM.exe
  C:\Windows\System\LojnoqM.exe
  2⤵
  PID:12752
- C:\Windows\System\dbaGprv.exe
  C:\Windows\System\dbaGprv.exe
  2⤵
  PID:12776
- C:\Windows\System\tGDxwfn.exe
  C:\Windows\System\tGDxwfn.exe
  2⤵
  PID:12808
- C:\Windows\System\InTCUbJ.exe
  C:\Windows\System\InTCUbJ.exe
  2⤵
  PID:12844
- C:\Windows\System\wiapcsC.exe
  C:\Windows\System\wiapcsC.exe
  2⤵
  PID:12888
- C:\Windows\System\ecGQOpz.exe
  C:\Windows\System\ecGQOpz.exe
  2⤵
  PID:12916
- C:\Windows\System\EzmkxiF.exe
  C:\Windows\System\EzmkxiF.exe
  2⤵
  PID:12944
- C:\Windows\System\FhJfQqD.exe
  C:\Windows\System\FhJfQqD.exe
  2⤵
  PID:12972
- C:\Windows\System\cmAbqbx.exe
  C:\Windows\System\cmAbqbx.exe
  2⤵
  PID:12988
- C:\Windows\System\MqjHKaH.exe
  C:\Windows\System\MqjHKaH.exe
  2⤵
  PID:13020
- C:\Windows\System\WxgaZIe.exe
  C:\Windows\System\WxgaZIe.exe
  2⤵
  PID:13044
- C:\Windows\System\FNFDHOs.exe
  C:\Windows\System\FNFDHOs.exe
  2⤵
  PID:13060
- C:\Windows\System\UdDVLBm.exe
  C:\Windows\System\UdDVLBm.exe
  2⤵
  PID:13096
- C:\Windows\System\tzvWCsK.exe
  C:\Windows\System\tzvWCsK.exe
  2⤵
  PID:13128
- C:\Windows\System\hjjXIxe.exe
  C:\Windows\System\hjjXIxe.exe
  2⤵
  PID:13164
- C:\Windows\System\FSedQGk.exe
  C:\Windows\System\FSedQGk.exe
  2⤵
  PID:13184
- C:\Windows\System\dwdDjpv.exe
  C:\Windows\System\dwdDjpv.exe
  2⤵
  PID:13212
- C:\Windows\System\MWtJSwg.exe
  C:\Windows\System\MWtJSwg.exe
  2⤵
  PID:13252
- C:\Windows\System\Figkqdt.exe
  C:\Windows\System\Figkqdt.exe
  2⤵
  PID:13280
- C:\Windows\System\LBHQkVJ.exe
  C:\Windows\System\LBHQkVJ.exe
  2⤵
  PID:13308
- C:\Windows\System\aGYdapR.exe
  C:\Windows\System\aGYdapR.exe
  2⤵
  PID:11752
- C:\Windows\System\WLtpNcW.exe
  C:\Windows\System\WLtpNcW.exe
  2⤵
  PID:12308
- C:\Windows\System\necOCtY.exe
  C:\Windows\System\necOCtY.exe
  2⤵
  PID:12336
- C:\Windows\System\ZmFHIMm.exe
  C:\Windows\System\ZmFHIMm.exe
  2⤵
  PID:12364
- C:\Windows\System\YCgTAaw.exe
  C:\Windows\System\YCgTAaw.exe
  2⤵
  PID:12396
- C:\Windows\System\pQkZdjT.exe
  C:\Windows\System\pQkZdjT.exe
  2⤵
  PID:12412
- C:\Windows\System\MBBamZu.exe
  C:\Windows\System\MBBamZu.exe
  2⤵
  PID:12448
- C:\Windows\System\ACEcBju.exe
  C:\Windows\System\ACEcBju.exe
  2⤵
  PID:12452
- C:\Windows\System\TyKztit.exe
  C:\Windows\System\TyKztit.exe
  2⤵
  PID:12536
- C:\Windows\System\vcYwFRS.exe
  C:\Windows\System\vcYwFRS.exe
  2⤵
  PID:12576
- C:\Windows\System\eUEZsoT.exe
  C:\Windows\System\eUEZsoT.exe
  2⤵
  PID:12664
- C:\Windows\System\AWXmUvS.exe
  C:\Windows\System\AWXmUvS.exe
  2⤵
  PID:12788
- C:\Windows\System\gPnibpo.exe
  C:\Windows\System\gPnibpo.exe
  2⤵
  PID:12836
- C:\Windows\System\CDFhwoy.exe
  C:\Windows\System\CDFhwoy.exe
  2⤵
  PID:12884
- C:\Windows\System\agTgaRH.exe
  C:\Windows\System\agTgaRH.exe
  2⤵
  PID:12964
- C:\Windows\System\kbXHtBG.exe
  C:\Windows\System\kbXHtBG.exe
  2⤵
  PID:13028
- C:\Windows\System\LtEDzzT.exe
  C:\Windows\System\LtEDzzT.exe
  2⤵
  PID:13084
- C:\Windows\System\XDIaKqc.exe
  C:\Windows\System\XDIaKqc.exe
  2⤵
  PID:13120
- C:\Windows\System\jlTIrPd.exe
  C:\Windows\System\jlTIrPd.exe
  2⤵
  PID:13248
- C:\Windows\System\JZWqNvp.exe
  C:\Windows\System\JZWqNvp.exe
  2⤵
  PID:13292
- C:\Windows\System\fMtLmpr.exe
  C:\Windows\System\fMtLmpr.exe
  2⤵
  PID:12300
- C:\Windows\System\ulthYaY.exe
  C:\Windows\System\ulthYaY.exe
  2⤵
  PID:12324
- C:\Windows\System\cXzHall.exe
  C:\Windows\System\cXzHall.exe
  2⤵
  PID:12428
- C:\Windows\System\bXzYnCc.exe
  C:\Windows\System\bXzYnCc.exe
  2⤵
  PID:12628
- C:\Windows\System\sJMqsRh.exe
  C:\Windows\System\sJMqsRh.exe
  2⤵
  PID:12200
- C:\Windows\System\JySsczY.exe
  C:\Windows\System\JySsczY.exe
  2⤵
  PID:12876
- C:\Windows\System\TewjSbN.exe
  C:\Windows\System\TewjSbN.exe
  2⤵
  PID:13112
- C:\Windows\System\JCZCUmc.exe
  C:\Windows\System\JCZCUmc.exe
  2⤵
  PID:13180
- C:\Windows\System\ipzGsxe.exe
  C:\Windows\System\ipzGsxe.exe
  2⤵
  PID:12196
- C:\Windows\System\HALUNQn.exe
  C:\Windows\System\HALUNQn.exe
  2⤵
  PID:12392
- C:\Windows\System\RahuYKC.exe
  C:\Windows\System\RahuYKC.exe
  2⤵
  PID:12444
- C:\Windows\System\xXuNVJt.exe
  C:\Windows\System\xXuNVJt.exe
  2⤵
  PID:12904
- C:\Windows\System\GNvoCbs.exe
  C:\Windows\System\GNvoCbs.exe
  2⤵
  PID:12620
- C:\Windows\System\FqHTRGb.exe
  C:\Windows\System\FqHTRGb.exe
  2⤵
  PID:13004
- C:\Windows\System\KjCbymG.exe
  C:\Windows\System\KjCbymG.exe
  2⤵
  PID:13340
- C:\Windows\System\glrxSiK.exe
  C:\Windows\System\glrxSiK.exe
  2⤵
  PID:13356
- C:\Windows\System\HZQsHmZ.exe
  C:\Windows\System\HZQsHmZ.exe
  2⤵
  PID:13384
- C:\Windows\System\RmcIToP.exe
  C:\Windows\System\RmcIToP.exe
  2⤵
  PID:13412
- C:\Windows\System\yGOGtmg.exe
  C:\Windows\System\yGOGtmg.exe
  2⤵
  PID:13444
- C:\Windows\System\afLOMvM.exe
  C:\Windows\System\afLOMvM.exe
  2⤵
  PID:13472
- C:\Windows\System\aVXCsSp.exe
  C:\Windows\System\aVXCsSp.exe
  2⤵
  PID:13496
- C:\Windows\System\GaYyQhh.exe
  C:\Windows\System\GaYyQhh.exe
  2⤵
  PID:13536
- C:\Windows\System\dfLJJIL.exe
  C:\Windows\System\dfLJJIL.exe
  2⤵
  PID:13564
- C:\Windows\System\DInFCGp.exe
  C:\Windows\System\DInFCGp.exe
  2⤵
  PID:13592
- C:\Windows\System\gKXzaZq.exe
  C:\Windows\System\gKXzaZq.exe
  2⤵
  PID:13620
- C:\Windows\System\GxkQqqv.exe
  C:\Windows\System\GxkQqqv.exe
  2⤵
  PID:13648
- C:\Windows\System\VXKacLS.exe
  C:\Windows\System\VXKacLS.exe
  2⤵
  PID:13676
- C:\Windows\System\lEKVgFe.exe
  C:\Windows\System\lEKVgFe.exe
  2⤵
  PID:13696
- C:\Windows\System\MGtTVxs.exe
  C:\Windows\System\MGtTVxs.exe
  2⤵
  PID:13720
- C:\Windows\System\iZVKdIE.exe
  C:\Windows\System\iZVKdIE.exe
  2⤵
  PID:13756
- C:\Windows\System\vyAWvJK.exe
  C:\Windows\System\vyAWvJK.exe
  2⤵
  PID:13788
- C:\Windows\System\IhfyZGb.exe
  C:\Windows\System\IhfyZGb.exe
  2⤵
  PID:13804
- C:\Windows\System\xvqnORJ.exe
  C:\Windows\System\xvqnORJ.exe
  2⤵
  PID:13844
- C:\Windows\System\PFGhMbd.exe
  C:\Windows\System\PFGhMbd.exe
  2⤵
  PID:13872
- C:\Windows\System\TUwXEvj.exe
  C:\Windows\System\TUwXEvj.exe
  2⤵
  PID:13896
- C:\Windows\System\DjcHtWd.exe
  C:\Windows\System\DjcHtWd.exe
  2⤵
  PID:13916
- C:\Windows\System\RCMoDgP.exe
  C:\Windows\System\RCMoDgP.exe
  2⤵
  PID:13956
- C:\Windows\System\SGPIYLg.exe
  C:\Windows\System\SGPIYLg.exe
  2⤵
  PID:13984
- C:\Windows\System\DHJzzmx.exe
  C:\Windows\System\DHJzzmx.exe
  2⤵
  PID:14012
- C:\Windows\System\AsVoQhq.exe
  C:\Windows\System\AsVoQhq.exe
  2⤵
  PID:14040
- C:\Windows\System\oehAMXu.exe
  C:\Windows\System\oehAMXu.exe
  2⤵
  PID:14068
- C:\Windows\System\bqrMOPB.exe
  C:\Windows\System\bqrMOPB.exe
  2⤵
  PID:14096
- C:\Windows\System\PGawwCQ.exe
  C:\Windows\System\PGawwCQ.exe
  2⤵
  PID:14132
- C:\Windows\System\ePlomem.exe
  C:\Windows\System\ePlomem.exe
  2⤵
  PID:14160
- C:\Windows\System\PfgneEZ.exe
  C:\Windows\System\PfgneEZ.exe
  2⤵
  PID:14184
- C:\Windows\System\TySaFAZ.exe
  C:\Windows\System\TySaFAZ.exe
  2⤵
  PID:14204
- C:\Windows\System\VPOzDZa.exe
  C:\Windows\System\VPOzDZa.exe
  2⤵
  PID:14244
- C:\Windows\System\HXHrFoA.exe
  C:\Windows\System\HXHrFoA.exe
  2⤵
  PID:14264
- C:\Windows\System\DhJDPek.exe
  C:\Windows\System\DhJDPek.exe
  2⤵
  PID:14288
- C:\Windows\System\NcBUhbg.exe
  C:\Windows\System\NcBUhbg.exe
  2⤵
  PID:14328
- C:\Windows\System\LxIQwbr.exe
  C:\Windows\System\LxIQwbr.exe
  2⤵
  PID:13336
- C:\Windows\System\xPzrTUY.exe
  C:\Windows\System\xPzrTUY.exe
  2⤵
  PID:13368
- C:\Windows\System\EbxPOLV.exe
  C:\Windows\System\EbxPOLV.exe
  2⤵
  PID:13452
- C:\Windows\System\LcNsHbN.exe
  C:\Windows\System\LcNsHbN.exe
  2⤵
  PID:13464
- C:\Windows\System\QvhZjLj.exe
  C:\Windows\System\QvhZjLj.exe
  2⤵
  PID:13532
- C:\Windows\System\ASvPyjP.exe
  C:\Windows\System\ASvPyjP.exe
  2⤵
  PID:13604
- C:\Windows\System\MzxxGze.exe
  C:\Windows\System\MzxxGze.exe
  2⤵
  PID:13704
- C:\Windows\System\UnAwgZt.exe
  C:\Windows\System\UnAwgZt.exe
  2⤵
  PID:13800
- C:\Windows\System\fxyGYSz.exe
  C:\Windows\System\fxyGYSz.exe
  2⤵
  PID:13856
- C:\Windows\System\vNPLMgt.exe
  C:\Windows\System\vNPLMgt.exe
  2⤵
  PID:13904
- C:\Windows\System\XVtEqrg.exe
  C:\Windows\System\XVtEqrg.exe
  2⤵
  PID:13972
- C:\Windows\System\uSVCSEz.exe
  C:\Windows\System\uSVCSEz.exe
  2⤵
  PID:14036
- C:\Windows\System\SPoPyiC.exe
  C:\Windows\System\SPoPyiC.exe
  2⤵
  PID:14156
- C:\Windows\System\VtfxdEG.exe
  C:\Windows\System\VtfxdEG.exe
  2⤵
  PID:14200
- C:\Windows\System\GVOkBgs.exe
  C:\Windows\System\GVOkBgs.exe
  2⤵
  PID:14304
- C:\Windows\System\tgbLzsd.exe
  C:\Windows\System\tgbLzsd.exe
  2⤵
  PID:13316
- C:\Windows\System\zxkztLo.exe
  C:\Windows\System\zxkztLo.exe
  2⤵
  PID:13408
- C:\Windows\System\FJQgTex.exe
  C:\Windows\System\FJQgTex.exe
  2⤵
  PID:13664
- C:\Windows\System\LQvrgSh.exe
  C:\Windows\System\LQvrgSh.exe
  2⤵
  PID:13840
- C:\Windows\System\TJiTQHb.exe
  C:\Windows\System\TJiTQHb.exe
  2⤵
  PID:14060
- C:\Windows\System\DTTpImh.exe
  C:\Windows\System\DTTpImh.exe
  2⤵
  PID:14176
- C:\Windows\System\XPFgogh.exe
  C:\Windows\System\XPFgogh.exe
  2⤵
  PID:13396
- C:\Windows\System\dldBOWc.exe
  C:\Windows\System\dldBOWc.exe
  2⤵
  PID:13636
- C:\Windows\System\wtdpcxZ.exe
  C:\Windows\System\wtdpcxZ.exe
  2⤵
  PID:14124
- C:\Windows\System\ffGCYxd.exe
  C:\Windows\System\ffGCYxd.exe
  2⤵
  PID:13928
- C:\Windows\System\iyFaChg.exe
  C:\Windows\System\iyFaChg.exe
  2⤵
  PID:14344
- C:\Windows\System\sJzWSTZ.exe
  C:\Windows\System\sJzWSTZ.exe
  2⤵
  PID:14372
- C:\Windows\System\AjqGBNx.exe
  C:\Windows\System\AjqGBNx.exe
  2⤵
  PID:14400
- C:\Windows\System\BnnQlqw.exe
  C:\Windows\System\BnnQlqw.exe
  2⤵
  PID:14428
- C:\Windows\System\HOByyjp.exe
  C:\Windows\System\HOByyjp.exe
  2⤵
  PID:14444
- C:\Windows\System\DkABwKN.exe
  C:\Windows\System\DkABwKN.exe
  2⤵
  PID:14476
- C:\Windows\System\tVoDcwH.exe
  C:\Windows\System\tVoDcwH.exe
  2⤵
  PID:14512
- C:\Windows\System\EAcCcvj.exe
  C:\Windows\System\EAcCcvj.exe
  2⤵
  PID:14552
- C:\Windows\System\nrVIrQZ.exe
  C:\Windows\System\nrVIrQZ.exe
  2⤵
  PID:14568
- C:\Windows\System\ibLmQNG.exe
  C:\Windows\System\ibLmQNG.exe
  2⤵
  PID:14596
- C:\Windows\System\jSJSYEZ.exe
  C:\Windows\System\jSJSYEZ.exe
  2⤵
  PID:14624
- C:\Windows\System\BTsqjNZ.exe
  C:\Windows\System\BTsqjNZ.exe
  2⤵
  PID:14640
- C:\Windows\System\izSZLOA.exe
  C:\Windows\System\izSZLOA.exe
  2⤵
  PID:14680
- C:\Windows\System\UlXAJxr.exe
  C:\Windows\System\UlXAJxr.exe
  2⤵
  PID:14696
- C:\Windows\System\XSAMuZP.exe
  C:\Windows\System\XSAMuZP.exe
  2⤵
  PID:14732
- C:\Windows\System\LBMIdJn.exe
  C:\Windows\System\LBMIdJn.exe
  2⤵
  PID:14780
- C:\Windows\System\HPjSiGX.exe
  C:\Windows\System\HPjSiGX.exe
  2⤵
  PID:14808
- C:\Windows\System\ggpDFtF.exe
  C:\Windows\System\ggpDFtF.exe
  2⤵
  PID:14824
- C:\Windows\System\cmoOsVW.exe
  C:\Windows\System\cmoOsVW.exe
  2⤵
  PID:14864
- C:\Windows\System\HznQvcb.exe
  C:\Windows\System\HznQvcb.exe
  2⤵
  PID:14896
- C:\Windows\System\hKERXMm.exe
  C:\Windows\System\hKERXMm.exe
  2⤵
  PID:14924
- C:\Windows\System\lryJwZj.exe
  C:\Windows\System\lryJwZj.exe
  2⤵
  PID:14940
- C:\Windows\System\ePDHpkK.exe
  C:\Windows\System\ePDHpkK.exe
  2⤵
  PID:14980
- C:\Windows\System\eMPCwJd.exe
  C:\Windows\System\eMPCwJd.exe
  2⤵
  PID:15008
- C:\Windows\System\BMISODR.exe
  C:\Windows\System\BMISODR.exe
  2⤵
  PID:15024
- C:\Windows\System\fKkqSrt.exe
  C:\Windows\System\fKkqSrt.exe
  2⤵
  PID:15044
- C:\Windows\System\cGfwCLM.exe
  C:\Windows\System\cGfwCLM.exe
  2⤵
  PID:15080
- C:\Windows\System\VxSCYsD.exe
  C:\Windows\System\VxSCYsD.exe
  2⤵
  PID:15096
- C:\Windows\System\aaHIpbe.exe
  C:\Windows\System\aaHIpbe.exe
  2⤵
  PID:15128
- C:\Windows\System\bswJBeO.exe
  C:\Windows\System\bswJBeO.exe
  2⤵
  PID:15152
- C:\Windows\System\WxCSoSU.exe
  C:\Windows\System\WxCSoSU.exe
  2⤵
  PID:15196
- C:\Windows\System\DfrtzqH.exe
  C:\Windows\System\DfrtzqH.exe
  2⤵
  PID:15220
- C:\Windows\System\SoCPGcj.exe
  C:\Windows\System\SoCPGcj.exe
  2⤵
  PID:15248
- C:\Windows\System\RivxTnG.exe
  C:\Windows\System\RivxTnG.exe
  2⤵
  PID:15284
- C:\Windows\System\FBmPiVm.exe
  C:\Windows\System\FBmPiVm.exe
  2⤵
  PID:15304
- C:\Windows\System\YfGUfRw.exe
  C:\Windows\System\YfGUfRw.exe
  2⤵
  PID:15324
- C:\Windows\System\ccFQTeY.exe
  C:\Windows\System\ccFQTeY.exe
  2⤵
  PID:15348
- C:\Windows\System\FxEUGQN.exe
  C:\Windows\System\FxEUGQN.exe
  2⤵
  PID:14128
- C:\Windows\System\xWQSHEg.exe
  C:\Windows\System\xWQSHEg.exe
  2⤵
  PID:14416
- C:\Windows\System\tssWPzx.exe
  C:\Windows\System\tssWPzx.exe
  2⤵
  PID:14492
- C:\Windows\System\CCQVMtN.exe
  C:\Windows\System\CCQVMtN.exe
  2⤵
  PID:14484
- C:\Windows\System\eqVtuco.exe
  C:\Windows\System\eqVtuco.exe
  2⤵
  PID:14636
- C:\Windows\System\usKRZnC.exe
  C:\Windows\System\usKRZnC.exe
  2⤵
  PID:14708
- C:\Windows\System\ulmwVqz.exe
  C:\Windows\System\ulmwVqz.exe
  2⤵
  PID:14772
- C:\Windows\System\GSEyvex.exe
  C:\Windows\System\GSEyvex.exe
  2⤵
  PID:14852
- C:\Windows\System\XjyNNnN.exe
  C:\Windows\System\XjyNNnN.exe
  2⤵
  PID:14916
- C:\Windows\System\wIFqAOD.exe
  C:\Windows\System\wIFqAOD.exe
  2⤵
  PID:14972
- C:\Windows\System\vzgsrtE.exe
  C:\Windows\System\vzgsrtE.exe
  2⤵
  PID:15076
- C:\Windows\System\HhBBBEM.exe
  C:\Windows\System\HhBBBEM.exe
  2⤵
  PID:15108
- C:\Windows\System\cmsADDG.exe
  C:\Windows\System\cmsADDG.exe
  2⤵
  PID:15164
- C:\Windows\System\AJhYhkE.exe
  C:\Windows\System\AJhYhkE.exe
  2⤵
  PID:15292
- C:\Windows\System\eDKMjmf.exe
  C:\Windows\System\eDKMjmf.exe
  2⤵
  PID:15332
- C:\Windows\System\LOUChPe.exe
  C:\Windows\System\LOUChPe.exe
  2⤵
  PID:14364
- C:\Windows\System\LJXiVVK.exe
  C:\Windows\System\LJXiVVK.exe
  2⤵
  PID:14548
- C:\Windows\System\tYiQhdG.exe
  C:\Windows\System\tYiQhdG.exe
  2⤵
  PID:14760
- C:\Windows\System\SDZoJYB.exe
  C:\Windows\System\SDZoJYB.exe
  2⤵
  PID:14952
- C:\Windows\System\PwXWxzd.exe
  C:\Windows\System\PwXWxzd.exe
  2⤵
  PID:15040
- C:\Windows\System\rVTLrvg.exe
  C:\Windows\System\rVTLrvg.exe
  2⤵
  PID:15176
- C:\Windows\System\XkWLVpb.exe
  C:\Windows\System\XkWLVpb.exe
  2⤵
  PID:15232
- C:\Windows\System\XqxKICh.exe
  C:\Windows\System\XqxKICh.exe
  2⤵
  PID:14504
- C:\Windows\System\QjeTFdk.exe
  C:\Windows\System\QjeTFdk.exe
  2⤵
  PID:14816
- C:\Windows\System\CauRkAM.exe
  C:\Windows\System\CauRkAM.exe
  2⤵
  PID:15020
- C:\Windows\System\FgFUGGr.exe
  C:\Windows\System\FgFUGGr.exe
  2⤵
  PID:15236
- C:\Windows\System\dnLsmhi.exe
  C:\Windows\System\dnLsmhi.exe
  2⤵
  PID:14912
- C:\Windows\System\QQOTqEr.exe
  C:\Windows\System\QQOTqEr.exe
  2⤵
  PID:15392
- C:\Windows\System\mycvpaB.exe
  C:\Windows\System\mycvpaB.exe
  2⤵
  PID:15416
- C:\Windows\System\eQceOas.exe
  C:\Windows\System\eQceOas.exe
  2⤵
  PID:15444
- C:\Windows\System\cyKYyaO.exe
  C:\Windows\System\cyKYyaO.exe
  2⤵
  PID:15468
- C:\Windows\System\RPzoOaK.exe
  C:\Windows\System\RPzoOaK.exe
  2⤵
  PID:15496
- C:\Windows\System\eMbSulf.exe
  C:\Windows\System\eMbSulf.exe
  2⤵
  PID:15524
- C:\Windows\System\GOOxPNz.exe
  C:\Windows\System\GOOxPNz.exe
  2⤵
  PID:15552
- C:\Windows\System\pKJALuk.exe
  C:\Windows\System\pKJALuk.exe
  2⤵
  PID:15584
- C:\Windows\System\hVoJmNb.exe
  C:\Windows\System\hVoJmNb.exe
  2⤵
  PID:15616
- C:\Windows\System\SHAGfAz.exe
  C:\Windows\System\SHAGfAz.exe
  2⤵
  PID:15632
- C:\Windows\System\fPqgxpv.exe
  C:\Windows\System\fPqgxpv.exe
  2⤵
  PID:15660
- C:\Windows\System\xezXADn.exe
  C:\Windows\System\xezXADn.exe
  2⤵
  PID:15744
- C:\Windows\System\QdQGhvx.exe
  C:\Windows\System\QdQGhvx.exe
  2⤵
  PID:15760
- C:\Windows\System\GPmKkgc.exe
  C:\Windows\System\GPmKkgc.exe
  2⤵
  PID:15780
- C:\Windows\System\sRBsRcf.exe
  C:\Windows\System\sRBsRcf.exe
  2⤵
  PID:15816
- C:\Windows\System\YamzXVZ.exe
  C:\Windows\System\YamzXVZ.exe
  2⤵
  PID:15844
- C:\Windows\System\xMtOKkc.exe
  C:\Windows\System\xMtOKkc.exe
  2⤵
  PID:15864
- C:\Windows\System\SZCzwBG.exe
  C:\Windows\System\SZCzwBG.exe
  2⤵
  PID:15888
- C:\Windows\System\xTqSJQy.exe
  C:\Windows\System\xTqSJQy.exe
  2⤵
  PID:15912
- C:\Windows\System\MaQGmrv.exe
  C:\Windows\System\MaQGmrv.exe
  2⤵
  PID:15936
- C:\Windows\System\UexKxdS.exe
  C:\Windows\System\UexKxdS.exe
  2⤵
  PID:15980
- C:\Windows\System\MorcSQC.exe
  C:\Windows\System\MorcSQC.exe
  2⤵
  PID:16000
- C:\Windows\System\qTFogmz.exe
  C:\Windows\System\qTFogmz.exe
  2⤵
  PID:16028
- C:\Windows\System\zESJENI.exe
  C:\Windows\System\zESJENI.exe
  2⤵
  PID:16064
- C:\Windows\System\ESOYarO.exe
  C:\Windows\System\ESOYarO.exe
  2⤵
  PID:16080
- C:\Windows\System\FwdAkal.exe
  C:\Windows\System\FwdAkal.exe
  2⤵
  PID:16100
- C:\Windows\System\GxWNxKJ.exe
  C:\Windows\System\GxWNxKJ.exe
  2⤵
  PID:16128
- C:\Windows\System\wxMEXlY.exe
  C:\Windows\System\wxMEXlY.exe
  2⤵
  PID:16160
- C:\Windows\System\uRZyCjs.exe
  C:\Windows\System\uRZyCjs.exe
  2⤵
  PID:16196
- C:\Windows\System\LPfowTk.exe
  C:\Windows\System\LPfowTk.exe
  2⤵
  PID:16212
- C:\Windows\System\ONfzuJY.exe
  C:\Windows\System\ONfzuJY.exe
  2⤵
  PID:16248
- C:\Windows\System\VDovjXN.exe
  C:\Windows\System\VDovjXN.exe
  2⤵
  PID:16288
- C:\Windows\System\CuTxGRj.exe
  C:\Windows\System\CuTxGRj.exe
  2⤵
  PID:16308
- C:\Windows\System\LLyWADq.exe
  C:\Windows\System\LLyWADq.exe
  2⤵
  PID:16336
- C:\Windows\System\zkvinBA.exe
  C:\Windows\System\zkvinBA.exe
  2⤵
  PID:16364
- C:\Windows\System\EQkQGpe.exe
  C:\Windows\System\EQkQGpe.exe
  2⤵
  PID:16380
- C:\Windows\System\jhjiWWK.exe
  C:\Windows\System\jhjiWWK.exe
  2⤵
  PID:15424
- C:\Windows\System\JxQieoc.exe
  C:\Windows\System\JxQieoc.exe
  2⤵
  PID:15456
- C:\Windows\System\CGdkAkU.exe
  C:\Windows\System\CGdkAkU.exe
  2⤵
  PID:15544
- C:\Windows\System\xoPSrdd.exe
  C:\Windows\System\xoPSrdd.exe
  2⤵
  PID:15576
- C:\Windows\System\UPadYfS.exe
  C:\Windows\System\UPadYfS.exe
  2⤵
  PID:15608
- C:\Windows\System\Mvkiolf.exe
  C:\Windows\System\Mvkiolf.exe
  2⤵
  PID:15668
- C:\Windows\System\XtOrwdN.exe
  C:\Windows\System\XtOrwdN.exe
  2⤵
  PID:11312
- C:\Windows\System\ZUSWZqL.exe
  C:\Windows\System\ZUSWZqL.exe
  2⤵
  PID:15676
- C:\Windows\System\PvnCeSZ.exe
  C:\Windows\System\PvnCeSZ.exe
  2⤵
  PID:11316
- C:\Windows\System\QUzyEld.exe
  C:\Windows\System\QUzyEld.exe
  2⤵
  PID:15836
- C:\Windows\System\IUXsScQ.exe
  C:\Windows\System\IUXsScQ.exe
  2⤵
  PID:15880
- C:\Windows\System\JEJgLeD.exe
  C:\Windows\System\JEJgLeD.exe
  2⤵
  PID:15960
- C:\Windows\System\MPEPJXC.exe
  C:\Windows\System\MPEPJXC.exe
  2⤵
  PID:16040
- C:\Windows\System\OtsQbkz.exe
  C:\Windows\System\OtsQbkz.exe
  2⤵
  PID:16096
- C:\Windows\System\IUJvmWL.exe
  C:\Windows\System\IUJvmWL.exe
  2⤵
  PID:16148
- C:\Windows\System\zaGBIlT.exe
  C:\Windows\System\zaGBIlT.exe
  2⤵
  PID:16224
- C:\Windows\System\UaFXxFT.exe
  C:\Windows\System\UaFXxFT.exe
  2⤵
  PID:16296
- C:\Windows\System\DmfCJpm.exe
  C:\Windows\System\DmfCJpm.exe
  2⤵
  PID:16284
- C:\Windows\System\VjXtObH.exe
  C:\Windows\System\VjXtObH.exe
  2⤵
  PID:16344
- C:\Windows\System\KAaKmvb.exe
  C:\Windows\System\KAaKmvb.exe
  2⤵
  PID:15180
- C:\Windows\System\DmgoWrZ.exe
  C:\Windows\System\DmgoWrZ.exe
  2⤵
  PID:15484
- C:\Windows\System\wIFegkq.exe
  C:\Windows\System\wIFegkq.exe
  2⤵
  PID:15736
- C:\Windows\System\pcdBygC.exe
  C:\Windows\System\pcdBygC.exe
  2⤵
  PID:14120
- C:\Windows\System\QTsBDmZ.exe
  C:\Windows\System\QTsBDmZ.exe
  2⤵
  PID:15812
- C:\Windows\System\kUyTnMR.exe
  C:\Windows\System\kUyTnMR.exe
  2⤵
  PID:15932
- C:\Windows\System\qijmucl.exe
  C:\Windows\System\qijmucl.exe
  2⤵
  PID:16192
- C:\Windows\System\jujzPrc.exe
  C:\Windows\System\jujzPrc.exe
  2⤵
  PID:16264
- C:\Windows\System\NkEDwsE.exe
  C:\Windows\System\NkEDwsE.exe
  2⤵
  PID:16372
- C:\Windows\System\fklDJYV.exe
  C:\Windows\System\fklDJYV.exe
  2⤵
  PID:11324
- C:\Windows\System\hOrovqh.exe
  C:\Windows\System\hOrovqh.exe
  2⤵
  PID:16240
- C:\Windows\System\LhOTMMF.exe
  C:\Windows\System\LhOTMMF.exe
  2⤵
  PID:16360
- C:\Windows\System\UaSwyzX.exe
  C:\Windows\System\UaSwyzX.exe
  2⤵
  PID:16416
- C:\Windows\System\ipdLXDs.exe
  C:\Windows\System\ipdLXDs.exe
  2⤵
  PID:16432
- C:\Windows\System\MgWpoib.exe
  C:\Windows\System\MgWpoib.exe
  2⤵
  PID:16452
- C:\Windows\System\TBNCqlu.exe
  C:\Windows\System\TBNCqlu.exe
  2⤵
  PID:16488
- C:\Windows\System\coSCiUz.exe
  C:\Windows\System\coSCiUz.exe
  2⤵
  PID:16512
- C:\Windows\System\YJtJCjw.exe
  C:\Windows\System\YJtJCjw.exe
  2⤵
  PID:16532
- C:\Windows\System\eGEVJcn.exe
  C:\Windows\System\eGEVJcn.exe
  2⤵
  PID:16556
- C:\Windows\System\RbanKEr.exe
  C:\Windows\System\RbanKEr.exe
  2⤵
  PID:16600
- C:\Windows\System\TPbKwIx.exe
  C:\Windows\System\TPbKwIx.exe
  2⤵
  PID:16616
- C:\Windows\System\wkuRsXw.exe
  C:\Windows\System\wkuRsXw.exe
  2⤵
  PID:16660
- C:\Windows\System\mGlqstM.exe
  C:\Windows\System\mGlqstM.exe
  2⤵
  PID:16684
- C:\Windows\System\OWAiegG.exe
  C:\Windows\System\OWAiegG.exe
  2⤵
  PID:16712
- C:\Windows\System\jIbHlTU.exe
  C:\Windows\System\jIbHlTU.exe
  2⤵
  PID:16752
- C:\Windows\System\IzVBlGg.exe
  C:\Windows\System\IzVBlGg.exe
  2⤵
  PID:16780
- C:\Windows\System\Rwvcskz.exe
  C:\Windows\System\Rwvcskz.exe
  2⤵
  PID:16828

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:17028

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:16588

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:17004

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\ARQfghZ.exe

Filesize
1.8MB

MD5
893ece93b0967c11cd461896e30f327a

SHA1
13f42f3bd6e6778ca9e3a5f173ec06e62f93ed5a

SHA256
7b0b83b616c89fb7a1eacb9542ded9e811750b74642824e9eec8bed3111a437c

SHA512
2fe75156a9befc259ad598d349997f56fa5e9b6895d62b9362b664167e27a685f651a86921c168e8b24e38540b63d03201ef7c3314b1ea082b56ac3db2f3cbe7

Download Submit
C:\Windows\System\AjpfQvW.exe

Filesize
1.8MB

MD5
b3b05ac4d2e9d6da9252f7fa01ff9e40

SHA1
d77b7bdd24f4af5851d1f97a28062df4a3ce8dfc

SHA256
2fcdab3d01850efa9bd0ca5a4236c66e5b791995add800a78ddf45da043e2d92

SHA512
3f45428cf92ca6b3cd773342a301f39c9bd4f4e78215a7fa448e581c8de682039dd7358f52a2ddb17e8354c6096e8a68f9e8d3cfd1e4881827334b34e1f72ebc

Download Submit
C:\Windows\System\AyIWMTv.exe

Filesize
1.8MB

MD5
8850113f3a0bba4abfe6023bb54fa6ae

SHA1
ce950534f90d8e7e70917de3cf78cd769fc6ff4d

SHA256
a4a51cc84418bf88ee50cfc2daec4efdb1796390828db8b1ccd353e17d921914

SHA512
ac332943f7d2c4878c34b1c537e5849100e7dca6a5d80ff48e1d63d4235998750ada5107c863900ade28dd37d3f1f229a2531522d6a2fa4c1178449b35d6f773

Download Submit
C:\Windows\System\BbuUNzl.exe

Filesize
1.8MB

MD5
3106e6001e1102afbaeed00d7e333068

SHA1
ec2c2f3242daf6b74edf94eea16090bf1603476f

SHA256
10a395222c61810580f728bf42adb2bc2b1fdc7297f415754eb029a674e68453

SHA512
27a1ff4dbc12da8261834e9e2b8e1f2e1ff4a35e0e1b3c8102ba647e7fcb59f8042b912ca7c2713e8d2bbc7bb2c101d3bdae0c468efea3fd44b3580f7764d04d

Download Submit
C:\Windows\System\BsUkPzu.exe

Filesize
1.8MB

MD5
624987cf73b74af1956b6a9776a1fe87

SHA1
99f958a35c4c515567dd61b9aec608fb501c76f2

SHA256
d44d7febf53f303aec01cddf3b81c3333dc5ca72010527281ea78424bc6267ee

SHA512
245216f118a753fc816343ff9ca4760ded524ff5608071b998ad72b2defe980d49ca4fcbc33439eb86aff1fa21ec09f0a4a549a97b980f669d5f83e61629d329

Download Submit
C:\Windows\System\DRuJbHr.exe

Filesize
1.8MB

MD5
755e728b00c46679d3216e5a83367e5b

SHA1
e0b38de330d128865e75717efbf3677e1ea0f1c7

SHA256
4f8ccb1f9a996a5434a22ab2e6081ea55270b5d7400baffcc80e6c516d24ae8b

SHA512
ccdc5503709d8e79519aae5dc029a220264c50ffd1610bb1b46093bb1994066ae68b3dd1b8a94b2a7fdb915a7a8fbf787bd03fa770cb4d22b8c8ee6a5d0cecd2

Download Submit
C:\Windows\System\EPzoPCE.exe

Filesize
1.8MB

MD5
acf761ff269c8c2da291e30e9e05065d

SHA1
1e1e587e0f236a924989645f9c248d72b4359ba7

SHA256
28edfa633639241159999e75f09035329081f947421d3925d4731c536c88f6e8

SHA512
2ec1dfc26474ba926d14325a5505d53169a9f8e7aa1b2ec3e69925e2be3f0a973e2f6ac54cbc01f573473d0adeba9a453f642d22b01f11a0d8c2e726e4f77822

Download Submit
C:\Windows\System\Eiqgtqb.exe

Filesize
1.8MB

MD5
e2fcf6cc7fd48ef9db2ab3f5fe60eb46

SHA1
5cc64641e1ee0716303645129fff1e09d4dd296a

SHA256
391681acc41b5877ec8c505ae1a25a2b0913d16b79b7e0705ad03236aebdd014

SHA512
a193f14c6831b50efc401c0e06e8e94417805cf65f31cd97673eb43f620308b74ed432ae2d35d04948af8ae6f7eacb4c44c0de00cbd4754e12e16fcb3051cda9

Download Submit
C:\Windows\System\GBWaOeT.exe

Filesize
1.8MB

MD5
1729f2550abb26ced7b051d6674819cd

SHA1
5548b08a402f79358a60adac4ee6b317ccccd9d6

SHA256
68641779dcf4f62e8826ccc499d26f5ec2d642f12ae86dce9fd58487e5d0f7cc

SHA512
441be73a7f6365d3e1d4472a673aba48693deb6d9a5664b128acc3da6bff4cd26c776e55c9d7b108dc70d886d0239e9ce890cb8fdf1a65f0b9888735267a91e9

Download Submit
C:\Windows\System\GDNIzEq.exe

Filesize
1.8MB

MD5
903044dc81d2ea6f8d9dfba9012700f7

SHA1
6a61a2857be23c8e4f96a020df90b889a08510b3

SHA256
6d886bc2f67d8ba26cc959767479ef30b1929f9f17a494b8488e40177337fa0e

SHA512
39ccb67a86660172eea263c7267c7bdedd4e4de07a2708161021301f3181a1d99efb2b572cd01852366dca26f68069922ba96375f77b7d846a50a64aa2483f18

Download Submit
C:\Windows\System\HBSKZoO.exe

Filesize
1.8MB

MD5
7ec6d5bee317a680e8f154e70aa0b0bc

SHA1
dd5294e304208ec2cb692115d429966ce47beca7

SHA256
bb54fe8cb8790a8b2e93d37512f379992005e97e65e33e54bc547b7aaeb34548

SHA512
57d6d481e3452591046d6d2218e90fbc2af4f81735fe1921583ec7dbb926e24cc447d7bb1218aefbab5f7d3d4b90aa32f4343be0107b32f21d191e41589e4ecd

Download Submit
C:\Windows\System\HIpXkut.exe

Filesize
1.8MB

MD5
95a5632d040273b0c3ef78622cac14f1

SHA1
a66bcb5311fc38de7e4515c9500f27fd96540344

SHA256
f8a853828876ae3968797ce4b1737b37040f6076982a009278359810ab326300

SHA512
9d91f36c15ba15e38f7fea3332df7abe932cf77a54adf06baa2f0501e0c532ef569511e9d2b785936d1a7313fdddccc45391138375334a5ca158657552d560bf

Download Submit
C:\Windows\System\HMGDlNr.exe

Filesize
1.8MB

MD5
f74995b94a0d2b2f63aef5153d28eed1

SHA1
954a2ef39306b83985824d9122a2d70ed35e5f63

SHA256
a5489f8f584786633065c62847d17b2cf0c638984c8e23ace4f2e6637640b31b

SHA512
5604671627b3a4e9fb2fc5b1c900893d499fce72726f3a2d40f22e92ba1be8df7d1f554dc1dfe49523ce6b913f9eec89ed9f710b6266d9baa74a8dbc881ab9d9

Download Submit
C:\Windows\System\LNFwWko.exe

Filesize
1.8MB

MD5
01b16265df2cf38c2c0793493be10b18

SHA1
592b421f154e382e86d36df21e3dda2a333c089a

SHA256
2218f7ee77ba75470426eddd8af1c4ba135117551fbe3d283c315173d603774c

SHA512
4c52d2472610330c89418fd5f1f56ee8d120bde3f48f6e7e114617a22ea32ccf52ff4dfe22c2a882e6fd8d0a1b5a934a0111c346a0581edf7777b2e9b8ef8f6e

Download Submit
C:\Windows\System\MehpCkw.exe

Filesize
1.8MB

MD5
34fedfbeaae8aff7ae6256d09a365c26

SHA1
7090088bf98738f512e61920948e73f600ce6cae

SHA256
cd8c4a4dda2c8819d0d48fe4744109631a3cfac2524771f3d23a2c944d4046b0

SHA512
23d07e6d294447ac04985d094fd7b8ed89cf3b33ed3528c63698873e7e43d766ab5759eaff1e27f35cc2f681660cde7fa21483de3ef6eb2d1d66194937482ce7

Download Submit
C:\Windows\System\OBpTzdM.exe

Filesize
1.8MB

MD5
fb2135883c36678689076cbc9a530b7f

SHA1
b84b164345dcb6a460384b604ffff7963dc5f284

SHA256
e12d074babfd1e13a80a3211eaae373c70d8bf5041b2ea4aa42969e7da373373

SHA512
b4c24a48ecb27ecfeadf0455b9b02e7474d1b7bb9c2bd7b7373c86dad93cca29284641f8061057da6e3ed9175cb1414decf8471066d954b1f0fa4a8818bfa69d

Download Submit
C:\Windows\System\OKCMzKf.exe

Filesize
1.8MB

MD5
afacd99a89da5b34f73f56fe6ec1fc2b

SHA1
8591cd907e465ddcc409b8700aa2c947edccdbe0

SHA256
6dfbc5c5e03786e95795caabec7770ae516d15bb7389c073fba410788236dd83

SHA512
a0e4c490f2bc33c095137b20acba01ebb1c83cfd8aba7a10dcc83ecb39654eb1e1fd67fd729d30d59b22bda4bb792a9dcb09a9bc1784103d8dafab44c8a469a1

Download Submit
C:\Windows\System\PBOLtBH.exe

Filesize
1.8MB

MD5
ae13c2a49c46034979177698a6fbbba7

SHA1
550319fbd00466243271bc1eab6872318edb6b23

SHA256
0968339c43854bc1c2650836a2908d4ff623a0aa1eb83995c4eb3effd7a57ad1

SHA512
792dc0a21f806fbf9c45cb1fc5eb173fbdcf974d0d7d7c6b08446bb67345db85f8c698d3eb4b4aff2ea46ad8a630447ba026035198048d460f4e392e18b9deb7

Download Submit
C:\Windows\System\Pdwxrlt.exe

Filesize
1.8MB

MD5
22a17b1e49597ed7c425acd03336dfb2

SHA1
be2a48152a79a0b9431bfd57bd440a1c2ef67304

SHA256
5d7a6e7086b98c4ded4e39e354047ced3cc3dc763496ab58cf3ce05307c4fadc

SHA512
29d590b90542ec779fdf466ae0bdecf530d69ebaddf1654241e03a79764bda69f53bb4430e1aad455eaad2d100c820b6145177eb241ae3861e87d332a19b2aae

Download Submit
C:\Windows\System\PfHQzVv.exe

Filesize
1.8MB

MD5
c445a4ddf55f8a5d6438883af9dfbd1a

SHA1
7939de7950045ca5171c07774f157d2b26ff1a25

SHA256
1d4a3209483609c386c5410eb68796599053553889e986888ad1ab71eaa0e5d5

SHA512
ce43d85c0fe666f5e389a25346f64cb66871664d984762f4c9050ae6287d769428a8449ae1740a86de0402c0949a2b21231c151483555f3f34f693590b4145ab

Download Submit
C:\Windows\System\PvXvJYR.exe

Filesize
1.8MB

MD5
26a1cb78fa71765a115b0543f80b88e1

SHA1
93a597e0601f1105fcee936da1ee7a81286afa6d

SHA256
647bbaa9d49e4b7e1528f5a035dfd2e0ccb06b5da71348f4bf3f18add076a97b

SHA512
1cf271004b199ee2d6ad9c89050534e4de72526d1da5b2cfbd574a67000d3eb2c79ca394d5c06dbb37f19bc669e01c8196b974d75b453d8d26f2f4ff0e5a42fc

Download Submit
C:\Windows\System\RSTQszC.exe

Filesize
1.8MB

MD5
ab7784e9ce67f807f69f6efa315d3e78

SHA1
95279d533d182c72e5aaab611c844209735de769

SHA256
7e44f110709b806dbc7d9e49d1ceaa5ef59eeef9b39b9df9dfcd55e5a0bf8e76

SHA512
93d7e80ace1b5a88c6ff020dfafab5b1d72f9bba39413a23aee7f7e7945137b346f47123e16ff87471b5ba76d0a7a5f3b0eb117d4a765df695f50ba911ae576d

Download Submit
C:\Windows\System\SVLzVBJ.exe

Filesize
1.8MB

MD5
03123547ef822b2040e1659a6282c5e3

SHA1
e87ad27f534ef8d9882958fc2c4f83a61ca94b09

SHA256
17de72f8ccc911fa9f54cd1e1cd7bb29318eb39da880c3658e6d57595500c90b

SHA512
28443d458576dea2165eb5e25193737168343e77a8f4b5e90216353482c138f41e548e106ac87efc0e8d50013e36861d86941bada13dd6889e6cfb017e09b8ad

Download Submit
C:\Windows\System\TpBPbQn.exe

Filesize
1.8MB

MD5
86f820d786b383b114264f3e1fa21620

SHA1
47945aeff789994f3750e195b6bb75ef97242b0c

SHA256
727a93df42f9f3214697c5f9a64cb5619283a535049d04a5ae4b54e6cec8efa9

SHA512
d7267e02f9f669ea7615e750ce5cacbc1bacc22775bc73cbcb0b53f4135c198fce7183877ffb73e4dd59e9570b36cfaeecbb8a0bba32fb3ca4e60fc7c20bec59

Download Submit
C:\Windows\System\VrlAnuB.exe

Filesize
1.8MB

MD5
ea97388b09156d00d2a6ffbe887a536c

SHA1
319319bc19f67262f01357b5897cf367736c04ee

SHA256
0205dddc710cfb49b2b94747e9a46bae217ce9958882819b259489349381b7d4

SHA512
a77ff042273b65894953c2913eeaa4c3f47eda5ad7117910648e62ecb464878422608a8a56a67c779edef9828c34a3e279f81c8d1d49962b8d3c90bf0cfe47fc

Download Submit
C:\Windows\System\WKecztI.exe

Filesize
1.8MB

MD5
45cfa5d0e6dce1bf89a8e5cddb6ed927

SHA1
ed65db9870fe4e7c2081841390961bc7333f96a9

SHA256
f38ccae8754829a4acd14010adbb4ee8a922db5ff082f56f546f84642eebed4d

SHA512
84ad683f2937b3a271f6c13a882577cffdcc181aacce3c6a54dfda27770863930348d1e6e893b2b16444b91002933b9d0db32835984f7ba26260e2c96810ae38

Download Submit
C:\Windows\System\WwUnezQ.exe

Filesize
1.8MB

MD5
a2a9ef5e2b33c408a5f05587e63497ba

SHA1
ed5d931985f10b06ff73b8cab8cf88bf2dee3eda

SHA256
eeab9d25fecccbab4170884fe1609dccff6303958aeff28cb096f309e30a03dc

SHA512
fc6bd51acc04c921d048b7b3225aac8e0df9e1e06d716bd28d40436becff895c909e6be29d98cc584dfcec835890197fc8d05d88a7841f14bf83957e8d5c2445

Download Submit
C:\Windows\System\ZYVIJNn.exe

Filesize
1.8MB

MD5
c12c9158d04077cf6fac6a878745449f

SHA1
710119a61ff3e5b669639f69b13b7aaa865c3ccb

SHA256
41e567b8ba01112b5d77a7fa403fe8765f1e725ad163822214df23e0929d76d5

SHA512
a3ad0e4852969ae01169f506b9b43555fd5c2cd30eb6de1b13ac01aa34194acc1d983f5059cad92dc8543c32ef48bce3eb57624721c7f367d4b891c6a5781622

Download Submit
C:\Windows\System\ZofLHCW.exe

Filesize
1.8MB

MD5
9d7520041dc1cf663f9bed6de9d5dc1e

SHA1
035c7fe6e6dc9f2f5fcf6847b33e1fe994cddca1

SHA256
103ff41a0a22f18b9f83c2d13b1e0d7a92486033074985265ad2779ca30e4dfb

SHA512
762031a895effc96f879dc117e59b6032428d678d5856aa9fe66872144441a5f870a05debd8544c9386cabee75399441650d01adc9358bdb2f23e896e8716e5a

Download Submit
C:\Windows\System\ZrpmLjf.exe

Filesize
1.8MB

MD5
5efff812076d269a06f52c7beb771796

SHA1
6e8a48915faf555afc6e1a04972a75a79af14147

SHA256
f7a1616a824ce3e1a928cf7f81fe5a38d9e8df3bd1689852a221b931868c2256

SHA512
3f6cf2f9d1534f5f92e6f40196632f67ca0fff4402a49242f3991d9caf94a4c917449d708a88288b540c49081ee75db4dd77abffdc0c488dd6aa7705a8cc22e8

Download Submit
C:\Windows\System\apjJGAw.exe

Filesize
1.8MB

MD5
c1d7dbe1d925c17c270f76d64a4a7bac

SHA1
4b6cc5f30fce8ce225c51310d97ba1ec2b0b553a

SHA256
61ee4497ff27c42fd7993a4b5fcaff0748ab01f5836f56dba6f860561ce5da70

SHA512
c6824d5c23279110db4f626eca32a47ebae952ebf27b6a91b238680bba866aa3c1dab74e2ec5d0d5c9e5b7543e1f9db882d9d7c2f70dba0acdc08bd8d911331f

Download Submit
C:\Windows\System\cBMPfAB.exe

Filesize
1.8MB

MD5
79fe9a39f8c4152d7cb6809eba901ec1

SHA1
1614a7c45375903fff0181f22535315faab7fea2

SHA256
1d19cfd2ebcaebe0eb22b262e54766e823bd04847a019dc67ed4b3e52be84b69

SHA512
7b082379d438dee13f84d8615e3d65ad9fd7ad4d6ee4d9c5a7b41c79ab860e4d502d8817a75c69fea0acf9709861141e66cec9792cb6f20c76eead177798807e

Download Submit
C:\Windows\System\cKHoUef.exe

Filesize
1.8MB

MD5
cc5a5632fdb888431afa4fed97741b37

SHA1
f6b5643375478758b35edb7904eaf08283e0be35

SHA256
c7b6ea95e7f8168917e93ed12381981d7ec2765334336e3ef1c3d82c539ec88e

SHA512
8ad19ee9d9c0b26b3337b24315604d31efb7f83e70cb0f7fe277f8f09b0dae5e7da4456a5d860be7570b869b4ece708f4526ef7df1b15225d6de9b0542b93916

Download Submit
C:\Windows\System\csJyjhi.exe

Filesize
1.8MB

MD5
aea6beff878c94ccb486e79cff7c343a

SHA1
74b9cd28768a95de215c5557f8b552da1f6b7e5b

SHA256
1d26f7374672a73e5a7992245554811cfc45a5ce2aeafd83f7516e067f1f898b

SHA512
e6f08125ac3f7719329c6b4259d72b017cf8b71d861856a7d4a964b5bb505d3e744f31115068750589523dae36f601a28f453ef273e2dee61ec5f640cd36798f

Download Submit
C:\Windows\System\dgRVTDV.exe

Filesize
1.8MB

MD5
334de85f47abbe61efb749b46f905096

SHA1
92842e33c03d9d91cd4da329e34ec9437a849e87

SHA256
373f0e83c8a5a943219f41f47adc82fe07c4c7ab6d5e0ebaddf89fd39d853cf2

SHA512
05339c589a298c62752efa1a1b925b681978ae45648a9f2cc1405f5b3009c3059ed781a51961e86bf208ab16719f4d052c21dd564c7dcc352b2d4e380e15af5a

Download Submit
C:\Windows\System\eVHFvRd.exe

Filesize
1.8MB

MD5
8a2b2451933b866f043bd10ed631d3b0

SHA1
9e222fc60f402dddde502f6f99c35adbdf52da74

SHA256
e5ae1fdac3cb762959f71c86347e67485c7db40bdd004269742f5e8174c5c9a8

SHA512
961d7fa3f7ccea15aa1bba591769ac74fba7b35a8f9ecccd723ef6765f8b348e9c52799f1cbf6a7d3a81568512b98c8c54f64228693f0584f04491be6fd45bf0

Download Submit
C:\Windows\System\ehcbOgC.exe

Filesize
1.8MB

MD5
22322068949fa2bb5023109d2f770d7f

SHA1
bb1f07e7bc4d860fd458f5cb2f1ab3cbbf051d82

SHA256
b87c061fd1526114f187db83876c00b0819980834cd5220615c2b795b89dfedd

SHA512
58329acca28b365f342d19be66b214143f193e294927f150a23ba411ef77cb6f2769be50394b6a00b61d14221f9a4747cd3174bbc79d795d189464816566bd0d

Download Submit
C:\Windows\System\gLYvlow.exe

Filesize
1.8MB

MD5
bcf2a6d9c8c7b89b6c6b52772d25621f

SHA1
685ae76cc3bf19d21ba850dd6e45a830abf45202

SHA256
7ce1625ac05a9eca9f16a14a62d4cf4e4ed62d4c0ef36441fda7813005720d57

SHA512
3ce8b78c0771cc9360a93297d62df5bd2ff148f12abc41adcbb18a22c1b95152d39f08a93662b12752346b3d379f630469db7798691490f9b079c01835579181

Download Submit
C:\Windows\System\hDigSAg.exe

Filesize
1.8MB

MD5
dfd1ebdf85b94d30a3f537e2e16e2058

SHA1
ffd1a05290e7d85bdb03ffc52bf9b73d9b649231

SHA256
3fa9c7ab9c333d6044d4ee9e19df1d4c0d49ac346fe06156459ca9f7e7a4b9ee

SHA512
827be0cc2a7e69957bd5970f1064cb03b015456f6e0a501dfb7046796a4982405f2a4046ab827d0c3e009ea44f37cd968d19a334d8c0987e97f077400b2a63bf

Download Submit
C:\Windows\System\hSCjjPc.exe

Filesize
1.8MB

MD5
cf43f2714969b1882b86c9aab4ae8660

SHA1
e1ad4990c369d2294e5161c0a19fc0b4a9e742b6

SHA256
49724cef57311047929bdabe6bad0965c4c86a7191784302ad3ae5b4cd0d4e67

SHA512
f82b486b9683747eb7f43e843fd4aa0a1ffaa8997cc8219ee76190daf2bd7aac683cee9c0e29b435acbc77d3bd2df2b9db847106832152c6ab6801cc3d322fda

Download Submit
C:\Windows\System\hSHFWYX.exe

Filesize
1.8MB

MD5
5a688bcf7c2560702e4aa1a76f608ad4

SHA1
37bfd6d9fbf5d5642f13522b38bec0fcbe612afe

SHA256
6f467289320c91ed531d6cd8cbb6aa28bfe79611710a2458de68b0fecaed232d

SHA512
8c07c0d364fff4bc6de15fcb4d4ae600634a83275fb64c632a3717fe0894f36bf66a24096fba9c1601850c1b3ac6a82b2e75ca293678a4b53a0a145de9aade0d

Download Submit
C:\Windows\System\jMbIHnG.exe

Filesize
1.8MB

MD5
7b2029a980cb6762c2b7b4d8279dba7e

SHA1
295c051743a749d4d7edd7d34a8b5075920e331e

SHA256
ddd7d1f07221aabfc7aeaa94510396ea21ab7a8572ba21acf284abbaec316fe7

SHA512
e34cb75e4872dd8ff65aa35d4ea7f00a26768a6f0e7c1b2f7dec91b87c66a7f8d546f853c4595ac47e00cad9ea4545a07b2835ff66f39836dbcb52db9e16db9b

Download Submit
C:\Windows\System\jXEkCFG.exe

Filesize
1.8MB

MD5
b0dcf9ac80ec7dc7858d1a416759bdd9

SHA1
4ed3de7f9bf5c14e2ea345e797cceaf68c5d850c

SHA256
0d2fa64562403e6a38d87b1f1e2e7f457e1ce58f66c408b2c9a4fffb5e45ae50

SHA512
3ecb39ea2ed28891a992f327a8f61d95968378128e5d4551d50294d824dcfaa3809018c056e82e46400349fdd049e47fd820948c34f21b6fa5f4787393fa7726

Download Submit
C:\Windows\System\kanAqXt.exe

Filesize
1.8MB

MD5
85f0a5020bda2da559bba55f39eb4429

SHA1
c6dda4f8bf1004d3f4a919a45b3a8a4c734257eb

SHA256
a2e675a9a6ed3db980ea8decd74e52ebe6fb3645443a071f3ef9e451bbe83156

SHA512
7e33d66ecc7b252f6d3010e4e8f64ec0441fed336acfec8da5626ac2c32f2c57755cc0730a9360fbf6b31fd2d1af1390caf64006f596088b63f103575611a92a

Download Submit
C:\Windows\System\mEwgnbC.exe

Filesize
1.8MB

MD5
b49f8b8cdf8bb95b542969b40367356a

SHA1
96a47c5a07e731db2a9a43a5aa4d498120f75399

SHA256
be167645832edc7a2824d8611458804350b07812db29b9ae7787da090511e86d

SHA512
c55fca69516e43c04ed4d7c599d8a689b2e144533c31a9e877a0ccdc33222213e9bddd6237b70098c71d276d66ef426743447b41157263d84d25ac5fd3797e10

Download Submit
C:\Windows\System\nEeODUM.exe

Filesize
1.8MB

MD5
dd8d94479f17f85732e995799f9bd33b

SHA1
8ef10c18e41cee6b7af0ef665056be49d382474e

SHA256
0175039267d87b3f168c0df4d9f276c6f354bb199555b200934762144f241f53

SHA512
491a2ca913338502c185150a98224d6c825c7f3f282398b253f286d02fe9a8f3216508acd454d8dbcfdce669cd03e0cbb945a3063b5150b544304157601da140

Download Submit
C:\Windows\System\nLBybvA.exe

Filesize
1.8MB

MD5
3fcb3ba8c27ee2811280a0e685994757

SHA1
2766633b124197420c0f507ca109db8346cc199d

SHA256
315044c3881494260ef72352bffce8daf82a7ec78a5fd02221981e51d3e30d94

SHA512
8a33f45f0546b50ff8d9ea95f49978138cd6c962d405043d4f2e50cb5dd32efcd26246f55dde82de6fbe5b465841dcb10113074b8398bda459dfef935326b2e7

Download Submit
C:\Windows\System\ntLYJmn.exe

Filesize
1.8MB

MD5
1f22012ba1a81e7548b083e410490537

SHA1
3a33213a680aa3d8228d2a63b8b2a2e7d98444b8

SHA256
6e0d817f33340df57e4297ddf1265740e5d5f150d64b963dd57050c2ac2466ac

SHA512
1d90396d4fd388a8354a3816530811077d9399519a14fc13daf7908b1725b9baa42c90388f5050f1ef45df754b9f9708e5d8075810c30d45945b2877438956bf

Download Submit
C:\Windows\System\rOAboUL.exe

Filesize
1.8MB

MD5
656cb0b6b69883e4a62d12bc675d293e

SHA1
d7d4d17b7fa5104334150e44e1e91dba2acfdfdd

SHA256
48ee2f66c7dc6f43b5d5278f9674be79637c3e421b6f97a6ff38466ab47578c2

SHA512
8fd5cf4796918e5c77b3f321b5f9396a2909d34149465f18474315239b213f98a6370a3bb4d7b0880bb5525a3cfc88e18db579169e1d54147e595c84cde8328b

Download Submit
C:\Windows\System\sfrxWHD.exe

Filesize
1.8MB

MD5
4df29d82f83e439a40c1b1457151372f

SHA1
1ec5a51f66f176be9d229ba66329d0c395ad6bb6

SHA256
f0cf8956eae259e8cad1f537c0b2a76e15752dd0015baa6d8922bcf2acc8e1db

SHA512
4ed0551b180feee27e11c3675c82cef9429bd37dd0098f1e9d88073e2522414626c03abfa09613b08fdaa94ef27173a2bb3623c60d1002eebf3ecb8211fb9138

Download Submit
C:\Windows\System\smiPnon.exe

Filesize
1.8MB

MD5
077efb7565886b93b9b0ad431315e72b

SHA1
bad139c1d1dd4c128bf884fd8e99637327950d7d

SHA256
998343fcdd87e9b805902e10c5a3f28fb21d0b192bbf6f16aba735ad6b43d209

SHA512
76b910f6f684b21ac86afe210ab402d17773be80b5224fe748adb4e7c633a959fae6478e9daf7d7d176ab5530db85d065ce0c587ff80da3ada3d35ff37a4d564

Download Submit
C:\Windows\System\syavdGg.exe

Filesize
1.8MB

MD5
26dd564515e65a4cbccf2e44e7568483

SHA1
ff254b72c510faa401e9206e30f876eab587c635

SHA256
1814360116c2a7c74f23aa20bd2d915f4ec78b59914db1d3af81770828fb90a5

SHA512
7d180bca7cb4aebc037fed513add932779e14e7e4c1ec030029bf7e6bfa720746767323c2241dd69568ea3c8a97dbd65c7c16c02b063d91e4bb8fcf66a1f8c0d

Download Submit
C:\Windows\System\uDEuBzU.exe

Filesize
1.8MB

MD5
6eedbcb51ae9e6781c9e21b3f1fbe34d

SHA1
17a2513fec9ca72d0b1b4d89f47aca792370e021

SHA256
734fff240d761ebd7521314053198fbef5023e1cb5a3602150a4b03920a520a4

SHA512
b80997bbceeb2d35efd6b7c3c4682bb6a80dbd73699a6d43fbd7f7a5b8f6dc92e184b52e0b0806c264eb10465c473343f78225a708387bcfc8dd7bf4b885db03

Download Submit
C:\Windows\System\uahByOp.exe

Filesize
1.8MB

MD5
00b0025e3e35a710e63b020372906f92

SHA1
d8b2260e4b3547376df24dfabcf71ebf2698fc24

SHA256
61bc010eb7a5d3ad01ac08baa14e9f5a0f594b9620c59f5af89b043d533b1ddf

SHA512
93a42ecfe387c0b1aff9e887b69f0458ec4f3b2a5da5f2018c4091b9c332d5abd491f8610dd8307753087037ec76075cde2ee9630341697d85e5b5541c4eb9be

Download Submit
C:\Windows\System\ubmHUfc.exe

Filesize
1.8MB

MD5
ff18771b177fc154ba6caf526f9a6e2c

SHA1
1e6f9e6f49cf41f0cf155ed8ffcd25ef6ce01c17

SHA256
16aca65cad0bea03f909ae86a078da83285b0feb81b0225a103718ec6710a15c

SHA512
9625f0eafa63eb2d81be4315bbeb6ab56d8d78c760621e1558f672d4eca9cd96c47f0023426714e74498b222e844b54eb9834716c53295a1c88fe173d9e5268f

Download Submit
C:\Windows\System\uyJuiVN.exe

Filesize
1.8MB

MD5
ccaf42276b91fcc71588d85583ae90c4

SHA1
4b39066d245e954faf86c37ea47a4e831a6bb81f

SHA256
a3f5a9b2c8e2461c32bb103cc51767ae13bded480d2ca231400012fc0b5611e4

SHA512
728f11bef61817a13dab0d513f556c1db269d689079b2e34b86ee0cd9c732a467d50267cdb90ee0abf99712b7b99a5af122efb35f7cc261bbe6fceff87d275f7

Download Submit
C:\Windows\System\vSxHfDV.exe

Filesize
1.8MB

MD5
8a1572cc763e515debdc66a1f809d649

SHA1
885dc7b6809a7bd48b2d12245156d2a3d5416d8e

SHA256
3861ad3e34123ed57be8bb344bc4a752de2a0776dcb31587834226e7a9779114

SHA512
f28f603ad64eed1f0d452e311ce20d310553722e77f0edd9270912b723f718178bc688c4078fc4135c8f500d61c5750007f514f0c262f7712a0cdb95730f73f2

Download Submit
C:\Windows\System\vdfyIBS.exe

Filesize
1.8MB

MD5
760efe1583091a16e815788d9583a4d7

SHA1
555b9b8ce45d36d6ef3d7ae1bfd6e998bb385df6

SHA256
9d0f8115e68465648f4b9cc627fb0f74c33fd1278a19661a3432fe4215378c17

SHA512
32850efb3db612d09966a84fead2c6effcbcff2a15f4ef6419582a337862a11a640984ce49c6da9f001ffdfc9ed2ba932d35b20a399c63b3b061c76181cb14a0

Download Submit
C:\Windows\System\wNcZhWN.exe

Filesize
1.8MB

MD5
ab154dd44930952e87054d04fd747fa0

SHA1
990fb937e4aeb96e7c642efb2664c52d3e140c8d

SHA256
852fa5f430226de2334680405cd4d0dd2090cd8e99360f9cd6099d558c187913

SHA512
b687cb2de531ae1f60bf4c638d3f98693ac43487639ca2339df7f512a849f470a0c88e9858b02fe3b6cc83a94591e1416c3e240fb62ab9012c5c7cd7f2fcfe6f

Download Submit
C:\Windows\System\wOIKNDt.exe

Filesize
1.8MB

MD5
ca69fa54f99d696a9107c6eb768c8f56

SHA1
a39a7dc7b9aa3ad57bd60858d7d262ad2dd02411

SHA256
477e8cfd8a8d86f82cdc61296a37411df79f8bcc19d3c8038b34691202223c1c

SHA512
3cdb40f9c83cb2dd443858016790abbae4ab0c73d4064111776ec2ea88a43e0fabbfaab94fca636208b12be9c5b2ed35c7b21cd0b0336d0bc497bd0140fc6018

Download Submit
C:\Windows\System\womTBqn.exe

Filesize
1.8MB

MD5
87893b5cc60146660c935dea4891f566

SHA1
17032adc544616fa05d2ffb46f9b30d33dba66a3

SHA256
1520127cce071b673e77366fd7adc2a0f005eb5eed30868747489d619a5ba93c

SHA512
0aaa4b5390ea9235a620179fc9999fd79cf5a8000c6507beeb3447af30a9197146108b9d74ffd5903c1fc9096b799b6578186f098fcdf44e3fe6eee7b9897b48

Download Submit
C:\Windows\System\zRwcxuM.exe

Filesize
1.8MB

MD5
e13c8ab936e3957d25d708ba706d80ee

SHA1
75a28e5a4ac840b1168540beb9a9a61c91c90c78

SHA256
0a85fbd6150f4ef27c19be471127fd418a2bac0100e2833bb345ae9315e3a15f

SHA512
ede6e9f0a579911aa0115856438045653db7b61b38b332437d202e99f926fdb3dbe78bc7de34aa725cf870bb1e7636d320810112005a328ec9c88227bc1a847b

Download Submit
memory/2796-0-0x0000022946D50000-0x0000022946D60000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads