xmrig | 82b48f25d847d3a45c97868cf085d41daea33e1832be62fdc7fb7a577d0d3fd4

Analysis

max time kernel
97s
max time network
98s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
08/08/2024, 00:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

82b48f25d847d3a45c97868cf085d41daea33e1832be62fdc7fb7a577d0d3fd4.exe
Size

1.4MB
MD5

39d8bf340f28a14f16b0c194d84c601d
SHA1

ac37a75741ca0d1a419c21cabf7080a7004af3f1
SHA256

82b48f25d847d3a45c97868cf085d41daea33e1832be62fdc7fb7a577d0d3fd4
SHA512

00ad5ee049cfd496098d4ac071b54fe21922d35325b07b1a694e57dec6566db59e5e7f31a854229bc787e9879a275670399a057d354b3e3eb43b07162e88087e
SSDEEP

24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbpwlKenszbWKDNEm/5O+7MMKTbcM:GezaTF8FcNkNdfE0pZ9ozttwIRxj4c5O

Score

10^/10

xmrig miner

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 35 IoCs

miner

resource	yara_rule
behavioral2/files/0x000900000002346c-4.dat	xmrig
behavioral2/files/0x00080000000234d3-8.dat	xmrig
behavioral2/files/0x00070000000234d4-6.dat	xmrig
behavioral2/files/0x00070000000234d7-28.dat	xmrig
behavioral2/files/0x00070000000234d8-35.dat	xmrig
behavioral2/files/0x00070000000234da-45.dat	xmrig
behavioral2/files/0x00070000000234dc-55.dat	xmrig
behavioral2/files/0x00070000000234dd-59.dat	xmrig
behavioral2/files/0x00070000000234de-65.dat	xmrig
behavioral2/files/0x00070000000234e0-74.dat	xmrig
behavioral2/files/0x00070000000234e7-119.dat	xmrig
behavioral2/files/0x00070000000234ea-125.dat	xmrig
behavioral2/files/0x00070000000234e9-123.dat	xmrig
behavioral2/files/0x00070000000234e8-121.dat	xmrig
behavioral2/files/0x00070000000234e6-117.dat	xmrig
behavioral2/files/0x00070000000234e5-110.dat	xmrig
behavioral2/files/0x00070000000234e4-98.dat	xmrig
behavioral2/files/0x00070000000234e3-90.dat	xmrig
behavioral2/files/0x00070000000234e2-85.dat	xmrig
behavioral2/files/0x00070000000234e1-80.dat	xmrig
behavioral2/files/0x00070000000234df-73.dat	xmrig
behavioral2/files/0x00070000000234db-50.dat	xmrig
behavioral2/files/0x00070000000234ef-158.dat	xmrig
behavioral2/files/0x00070000000234f2-165.dat	xmrig
behavioral2/files/0x00070000000234f1-164.dat	xmrig
behavioral2/files/0x00070000000234f3-166.dat	xmrig
behavioral2/files/0x00080000000234ee-155.dat	xmrig
behavioral2/files/0x00070000000234f0-161.dat	xmrig
behavioral2/files/0x00080000000234ec-145.dat	xmrig
behavioral2/files/0x00080000000234d1-140.dat	xmrig
behavioral2/files/0x000600000001e559-135.dat	xmrig
behavioral2/files/0x00070000000234eb-130.dat	xmrig
behavioral2/files/0x00070000000234d9-40.dat	xmrig
behavioral2/files/0x00070000000234d6-24.dat	xmrig
behavioral2/files/0x00070000000234d5-20.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
1716	bSvSwYp.exe
3920	PHijtIA.exe
3784	ueCDwSJ.exe
4856	eQsvkXW.exe
3628	gcGmLGh.exe
456	RVKDUYC.exe
4976	rorneks.exe
1864	qcJizyc.exe
2648	LyIFAAF.exe
1176	HEZnUVq.exe
2516	LjZNKFL.exe
4640	neAsKYq.exe
3856	JVNPEoB.exe
1848	ijeYmVl.exe
1572	XXxogrJ.exe
2064	YGJBIgx.exe
1788	mWyZLCt.exe
3588	aOSVRXe.exe
5116	DmTCecT.exe
3600	LTwAVgL.exe
964	NkkPMzG.exe
2404	tqDmPEF.exe
2752	fkAwnhx.exe
1128	EfqgTlV.exe
1096	NvpvSBf.exe
1756	oOqWmHC.exe
1584	CJnwgHl.exe
2512	QyRmEvc.exe
1648	GvvgLNJ.exe
1856	ZycFKNC.exe
2012	GtVzwxl.exe
5044	szULMHT.exe
1524	KjDTfUk.exe
2400	yVsLrfn.exe
2780	XpeeiaP.exe
4900	LlSKBoJ.exe
1780	GFXxoqg.exe
2364	hWwWLPL.exe
1004	yVEllbF.exe
2852	XYGOaYM.exe
4544	ZsqBpSB.exe
4664	HQBYEee.exe
3288	qZwNScQ.exe
2720	rhiZpUw.exe
4408	KrVdLNw.exe
1256	TLBrHPF.exe
4164	smdblWy.exe
1052	RdVLmvV.exe
1932	cgSyUuV.exe
2060	ewlbACo.exe
3300	eTxwbNN.exe
4940	mnmJYSA.exe
2224	CikrgjC.exe
1692	acKOIgD.exe
4848	NEyXhGZ.exe
5076	qIwGHBo.exe
4356	lRyvELI.exe
1700	CZXcoqN.exe
2184	KKTNGwp.exe
4968	WZFDYyH.exe
3728	ELwIYDr.exe
3452	dhJohYh.exe
764	vjsTPhN.exe
3876	DgeiEes.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\dHOBAML.exe	82b48f25d847d3a45c97868cf085d41daea33e1832be62fdc7fb7a577d0d3fd4.exe
File created	C:\Windows\System\BUatoVB.exe	82b48f25d847d3a45c97868cf085d41daea33e1832be62fdc7fb7a577d0d3fd4.exe
File created	C:\Windows\System\XtEzrpc.exe	82b48f25d847d3a45c97868cf085d41daea33e1832be62fdc7fb7a577d0d3fd4.exe
File created	C:\Windows\System\RdVLmvV.exe	82b48f25d847d3a45c97868cf085d41daea33e1832be62fdc7fb7a577d0d3fd4.exe
File created	C:\Windows\System\FBLYbMW.exe	82b48f25d847d3a45c97868cf085d41daea33e1832be62fdc7fb7a577d0d3fd4.exe
File created	C:\Windows\System\dRwWjEI.exe	82b48f25d847d3a45c97868cf085d41daea33e1832be62fdc7fb7a577d0d3fd4.exe
File created	C:\Windows\System\yKvDvoM.exe	82b48f25d847d3a45c97868cf085d41daea33e1832be62fdc7fb7a577d0d3fd4.exe
File created	C:\Windows\System\xzjSCyP.exe	82b48f25d847d3a45c97868cf085d41daea33e1832be62fdc7fb7a577d0d3fd4.exe
File created	C:\Windows\System\OvWOMat.exe	82b48f25d847d3a45c97868cf085d41daea33e1832be62fdc7fb7a577d0d3fd4.exe
File created	C:\Windows\System\UojKNvM.exe	82b48f25d847d3a45c97868cf085d41daea33e1832be62fdc7fb7a577d0d3fd4.exe
File created	C:\Windows\System\zDlAURn.exe	82b48f25d847d3a45c97868cf085d41daea33e1832be62fdc7fb7a577d0d3fd4.exe
File created	C:\Windows\System\nXsXZRG.exe	82b48f25d847d3a45c97868cf085d41daea33e1832be62fdc7fb7a577d0d3fd4.exe
File created	C:\Windows\System\FrhNabc.exe	82b48f25d847d3a45c97868cf085d41daea33e1832be62fdc7fb7a577d0d3fd4.exe
File created	C:\Windows\System\pGAicTd.exe	82b48f25d847d3a45c97868cf085d41daea33e1832be62fdc7fb7a577d0d3fd4.exe
File created	C:\Windows\System\RVigffA.exe	82b48f25d847d3a45c97868cf085d41daea33e1832be62fdc7fb7a577d0d3fd4.exe
File created	C:\Windows\System\swcaKrd.exe	82b48f25d847d3a45c97868cf085d41daea33e1832be62fdc7fb7a577d0d3fd4.exe
File created	C:\Windows\System\dsUbvem.exe	82b48f25d847d3a45c97868cf085d41daea33e1832be62fdc7fb7a577d0d3fd4.exe
File created	C:\Windows\System\sfAQnBw.exe	82b48f25d847d3a45c97868cf085d41daea33e1832be62fdc7fb7a577d0d3fd4.exe
File created	C:\Windows\System\MgPPUfJ.exe	82b48f25d847d3a45c97868cf085d41daea33e1832be62fdc7fb7a577d0d3fd4.exe
File created	C:\Windows\System\xOqNHWG.exe	82b48f25d847d3a45c97868cf085d41daea33e1832be62fdc7fb7a577d0d3fd4.exe
File created	C:\Windows\System\zmbXxAc.exe	82b48f25d847d3a45c97868cf085d41daea33e1832be62fdc7fb7a577d0d3fd4.exe
File created	C:\Windows\System\qhQlLWn.exe	82b48f25d847d3a45c97868cf085d41daea33e1832be62fdc7fb7a577d0d3fd4.exe
File created	C:\Windows\System\mYwGdsn.exe	82b48f25d847d3a45c97868cf085d41daea33e1832be62fdc7fb7a577d0d3fd4.exe
File created	C:\Windows\System\vztEuoD.exe	82b48f25d847d3a45c97868cf085d41daea33e1832be62fdc7fb7a577d0d3fd4.exe
File created	C:\Windows\System\tvVZQzb.exe	82b48f25d847d3a45c97868cf085d41daea33e1832be62fdc7fb7a577d0d3fd4.exe
File created	C:\Windows\System\TjpkCBF.exe	82b48f25d847d3a45c97868cf085d41daea33e1832be62fdc7fb7a577d0d3fd4.exe
File created	C:\Windows\System\OAmzZdG.exe	82b48f25d847d3a45c97868cf085d41daea33e1832be62fdc7fb7a577d0d3fd4.exe
File created	C:\Windows\System\tIRksJl.exe	82b48f25d847d3a45c97868cf085d41daea33e1832be62fdc7fb7a577d0d3fd4.exe
File created	C:\Windows\System\iBUgqHM.exe	82b48f25d847d3a45c97868cf085d41daea33e1832be62fdc7fb7a577d0d3fd4.exe
File created	C:\Windows\System\BldhjyO.exe	82b48f25d847d3a45c97868cf085d41daea33e1832be62fdc7fb7a577d0d3fd4.exe
File created	C:\Windows\System\QzGODcC.exe	82b48f25d847d3a45c97868cf085d41daea33e1832be62fdc7fb7a577d0d3fd4.exe
File created	C:\Windows\System\PCCoEiY.exe	82b48f25d847d3a45c97868cf085d41daea33e1832be62fdc7fb7a577d0d3fd4.exe
File created	C:\Windows\System\ueCDwSJ.exe	82b48f25d847d3a45c97868cf085d41daea33e1832be62fdc7fb7a577d0d3fd4.exe
File created	C:\Windows\System\sGULgfn.exe	82b48f25d847d3a45c97868cf085d41daea33e1832be62fdc7fb7a577d0d3fd4.exe
File created	C:\Windows\System\VWzjIEE.exe	82b48f25d847d3a45c97868cf085d41daea33e1832be62fdc7fb7a577d0d3fd4.exe
File created	C:\Windows\System\jwFgWBj.exe	82b48f25d847d3a45c97868cf085d41daea33e1832be62fdc7fb7a577d0d3fd4.exe
File created	C:\Windows\System\gBSYvjE.exe	82b48f25d847d3a45c97868cf085d41daea33e1832be62fdc7fb7a577d0d3fd4.exe
File created	C:\Windows\System\YDvvPkR.exe	82b48f25d847d3a45c97868cf085d41daea33e1832be62fdc7fb7a577d0d3fd4.exe
File created	C:\Windows\System\fHQYWrr.exe	82b48f25d847d3a45c97868cf085d41daea33e1832be62fdc7fb7a577d0d3fd4.exe
File created	C:\Windows\System\HuQXQWR.exe	82b48f25d847d3a45c97868cf085d41daea33e1832be62fdc7fb7a577d0d3fd4.exe
File created	C:\Windows\System\fICBDMK.exe	82b48f25d847d3a45c97868cf085d41daea33e1832be62fdc7fb7a577d0d3fd4.exe
File created	C:\Windows\System\WEViTbE.exe	82b48f25d847d3a45c97868cf085d41daea33e1832be62fdc7fb7a577d0d3fd4.exe
File created	C:\Windows\System\GHkcoJK.exe	82b48f25d847d3a45c97868cf085d41daea33e1832be62fdc7fb7a577d0d3fd4.exe
File created	C:\Windows\System\jRCkMqF.exe	82b48f25d847d3a45c97868cf085d41daea33e1832be62fdc7fb7a577d0d3fd4.exe
File created	C:\Windows\System\sdiKekD.exe	82b48f25d847d3a45c97868cf085d41daea33e1832be62fdc7fb7a577d0d3fd4.exe
File created	C:\Windows\System\IBZuVvy.exe	82b48f25d847d3a45c97868cf085d41daea33e1832be62fdc7fb7a577d0d3fd4.exe
File created	C:\Windows\System\TwvZfmG.exe	82b48f25d847d3a45c97868cf085d41daea33e1832be62fdc7fb7a577d0d3fd4.exe
File created	C:\Windows\System\UsDuQVX.exe	82b48f25d847d3a45c97868cf085d41daea33e1832be62fdc7fb7a577d0d3fd4.exe
File created	C:\Windows\System\qSJzyat.exe	82b48f25d847d3a45c97868cf085d41daea33e1832be62fdc7fb7a577d0d3fd4.exe
File created	C:\Windows\System\FLjBIys.exe	82b48f25d847d3a45c97868cf085d41daea33e1832be62fdc7fb7a577d0d3fd4.exe
File created	C:\Windows\System\IeUHONu.exe	82b48f25d847d3a45c97868cf085d41daea33e1832be62fdc7fb7a577d0d3fd4.exe
File created	C:\Windows\System\TynPdtD.exe	82b48f25d847d3a45c97868cf085d41daea33e1832be62fdc7fb7a577d0d3fd4.exe
File created	C:\Windows\System\ifjtYMR.exe	82b48f25d847d3a45c97868cf085d41daea33e1832be62fdc7fb7a577d0d3fd4.exe
File created	C:\Windows\System\kauiAdx.exe	82b48f25d847d3a45c97868cf085d41daea33e1832be62fdc7fb7a577d0d3fd4.exe
File created	C:\Windows\System\IhcncDO.exe	82b48f25d847d3a45c97868cf085d41daea33e1832be62fdc7fb7a577d0d3fd4.exe
File created	C:\Windows\System\IIAQUPg.exe	82b48f25d847d3a45c97868cf085d41daea33e1832be62fdc7fb7a577d0d3fd4.exe
File created	C:\Windows\System\fLzmpQI.exe	82b48f25d847d3a45c97868cf085d41daea33e1832be62fdc7fb7a577d0d3fd4.exe
File created	C:\Windows\System\woPYfRg.exe	82b48f25d847d3a45c97868cf085d41daea33e1832be62fdc7fb7a577d0d3fd4.exe
File created	C:\Windows\System\rhiZpUw.exe	82b48f25d847d3a45c97868cf085d41daea33e1832be62fdc7fb7a577d0d3fd4.exe
File created	C:\Windows\System\gmqcTkI.exe	82b48f25d847d3a45c97868cf085d41daea33e1832be62fdc7fb7a577d0d3fd4.exe
File created	C:\Windows\System\fSumTUV.exe	82b48f25d847d3a45c97868cf085d41daea33e1832be62fdc7fb7a577d0d3fd4.exe
File created	C:\Windows\System\ewZYQmF.exe	82b48f25d847d3a45c97868cf085d41daea33e1832be62fdc7fb7a577d0d3fd4.exe
File created	C:\Windows\System\CRfrXRV.exe	82b48f25d847d3a45c97868cf085d41daea33e1832be62fdc7fb7a577d0d3fd4.exe
File created	C:\Windows\System\wymSynn.exe	82b48f25d847d3a45c97868cf085d41daea33e1832be62fdc7fb7a577d0d3fd4.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	16888	dwm.exe
Token: SeChangeNotifyPrivilege	16888	dwm.exe
Token: 33	16888	dwm.exe
Token: SeIncBasePriorityPrivilege	16888	dwm.exe
Token: SeShutdownPrivilege	16888	dwm.exe
Token: SeCreatePagefilePrivilege	16888	dwm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3464 wrote to memory of 1716	3464	82b48f25d847d3a45c97868cf085d41daea33e1832be62fdc7fb7a577d0d3fd4.exe	84
PID 3464 wrote to memory of 1716	3464	82b48f25d847d3a45c97868cf085d41daea33e1832be62fdc7fb7a577d0d3fd4.exe	84
PID 3464 wrote to memory of 3920	3464	82b48f25d847d3a45c97868cf085d41daea33e1832be62fdc7fb7a577d0d3fd4.exe	85
PID 3464 wrote to memory of 3920	3464	82b48f25d847d3a45c97868cf085d41daea33e1832be62fdc7fb7a577d0d3fd4.exe	85
PID 3464 wrote to memory of 3784	3464	82b48f25d847d3a45c97868cf085d41daea33e1832be62fdc7fb7a577d0d3fd4.exe	86
PID 3464 wrote to memory of 3784	3464	82b48f25d847d3a45c97868cf085d41daea33e1832be62fdc7fb7a577d0d3fd4.exe	86
PID 3464 wrote to memory of 4856	3464	82b48f25d847d3a45c97868cf085d41daea33e1832be62fdc7fb7a577d0d3fd4.exe	87
PID 3464 wrote to memory of 4856	3464	82b48f25d847d3a45c97868cf085d41daea33e1832be62fdc7fb7a577d0d3fd4.exe	87
PID 3464 wrote to memory of 3628	3464	82b48f25d847d3a45c97868cf085d41daea33e1832be62fdc7fb7a577d0d3fd4.exe	88
PID 3464 wrote to memory of 3628	3464	82b48f25d847d3a45c97868cf085d41daea33e1832be62fdc7fb7a577d0d3fd4.exe	88
PID 3464 wrote to memory of 456	3464	82b48f25d847d3a45c97868cf085d41daea33e1832be62fdc7fb7a577d0d3fd4.exe	89
PID 3464 wrote to memory of 456	3464	82b48f25d847d3a45c97868cf085d41daea33e1832be62fdc7fb7a577d0d3fd4.exe	89
PID 3464 wrote to memory of 4976	3464	82b48f25d847d3a45c97868cf085d41daea33e1832be62fdc7fb7a577d0d3fd4.exe	90
PID 3464 wrote to memory of 4976	3464	82b48f25d847d3a45c97868cf085d41daea33e1832be62fdc7fb7a577d0d3fd4.exe	90
PID 3464 wrote to memory of 1864	3464	82b48f25d847d3a45c97868cf085d41daea33e1832be62fdc7fb7a577d0d3fd4.exe	91
PID 3464 wrote to memory of 1864	3464	82b48f25d847d3a45c97868cf085d41daea33e1832be62fdc7fb7a577d0d3fd4.exe	91
PID 3464 wrote to memory of 2648	3464	82b48f25d847d3a45c97868cf085d41daea33e1832be62fdc7fb7a577d0d3fd4.exe	92
PID 3464 wrote to memory of 2648	3464	82b48f25d847d3a45c97868cf085d41daea33e1832be62fdc7fb7a577d0d3fd4.exe	92
PID 3464 wrote to memory of 1176	3464	82b48f25d847d3a45c97868cf085d41daea33e1832be62fdc7fb7a577d0d3fd4.exe	93
PID 3464 wrote to memory of 1176	3464	82b48f25d847d3a45c97868cf085d41daea33e1832be62fdc7fb7a577d0d3fd4.exe	93
PID 3464 wrote to memory of 2516	3464	82b48f25d847d3a45c97868cf085d41daea33e1832be62fdc7fb7a577d0d3fd4.exe	94
PID 3464 wrote to memory of 2516	3464	82b48f25d847d3a45c97868cf085d41daea33e1832be62fdc7fb7a577d0d3fd4.exe	94
PID 3464 wrote to memory of 4640	3464	82b48f25d847d3a45c97868cf085d41daea33e1832be62fdc7fb7a577d0d3fd4.exe	95
PID 3464 wrote to memory of 4640	3464	82b48f25d847d3a45c97868cf085d41daea33e1832be62fdc7fb7a577d0d3fd4.exe	95
PID 3464 wrote to memory of 3856	3464	82b48f25d847d3a45c97868cf085d41daea33e1832be62fdc7fb7a577d0d3fd4.exe	96
PID 3464 wrote to memory of 3856	3464	82b48f25d847d3a45c97868cf085d41daea33e1832be62fdc7fb7a577d0d3fd4.exe	96
PID 3464 wrote to memory of 1848	3464	82b48f25d847d3a45c97868cf085d41daea33e1832be62fdc7fb7a577d0d3fd4.exe	97
PID 3464 wrote to memory of 1848	3464	82b48f25d847d3a45c97868cf085d41daea33e1832be62fdc7fb7a577d0d3fd4.exe	97
PID 3464 wrote to memory of 1572	3464	82b48f25d847d3a45c97868cf085d41daea33e1832be62fdc7fb7a577d0d3fd4.exe	98
PID 3464 wrote to memory of 1572	3464	82b48f25d847d3a45c97868cf085d41daea33e1832be62fdc7fb7a577d0d3fd4.exe	98
PID 3464 wrote to memory of 2064	3464	82b48f25d847d3a45c97868cf085d41daea33e1832be62fdc7fb7a577d0d3fd4.exe	99
PID 3464 wrote to memory of 2064	3464	82b48f25d847d3a45c97868cf085d41daea33e1832be62fdc7fb7a577d0d3fd4.exe	99
PID 3464 wrote to memory of 1788	3464	82b48f25d847d3a45c97868cf085d41daea33e1832be62fdc7fb7a577d0d3fd4.exe	100
PID 3464 wrote to memory of 1788	3464	82b48f25d847d3a45c97868cf085d41daea33e1832be62fdc7fb7a577d0d3fd4.exe	100
PID 3464 wrote to memory of 3588	3464	82b48f25d847d3a45c97868cf085d41daea33e1832be62fdc7fb7a577d0d3fd4.exe	102
PID 3464 wrote to memory of 3588	3464	82b48f25d847d3a45c97868cf085d41daea33e1832be62fdc7fb7a577d0d3fd4.exe	102
PID 3464 wrote to memory of 5116	3464	82b48f25d847d3a45c97868cf085d41daea33e1832be62fdc7fb7a577d0d3fd4.exe	103
PID 3464 wrote to memory of 5116	3464	82b48f25d847d3a45c97868cf085d41daea33e1832be62fdc7fb7a577d0d3fd4.exe	103
PID 3464 wrote to memory of 3600	3464	82b48f25d847d3a45c97868cf085d41daea33e1832be62fdc7fb7a577d0d3fd4.exe	104
PID 3464 wrote to memory of 3600	3464	82b48f25d847d3a45c97868cf085d41daea33e1832be62fdc7fb7a577d0d3fd4.exe	104
PID 3464 wrote to memory of 964	3464	82b48f25d847d3a45c97868cf085d41daea33e1832be62fdc7fb7a577d0d3fd4.exe	105
PID 3464 wrote to memory of 964	3464	82b48f25d847d3a45c97868cf085d41daea33e1832be62fdc7fb7a577d0d3fd4.exe	105
PID 3464 wrote to memory of 2404	3464	82b48f25d847d3a45c97868cf085d41daea33e1832be62fdc7fb7a577d0d3fd4.exe	106
PID 3464 wrote to memory of 2404	3464	82b48f25d847d3a45c97868cf085d41daea33e1832be62fdc7fb7a577d0d3fd4.exe	106
PID 3464 wrote to memory of 2752	3464	82b48f25d847d3a45c97868cf085d41daea33e1832be62fdc7fb7a577d0d3fd4.exe	107
PID 3464 wrote to memory of 2752	3464	82b48f25d847d3a45c97868cf085d41daea33e1832be62fdc7fb7a577d0d3fd4.exe	107
PID 3464 wrote to memory of 1128	3464	82b48f25d847d3a45c97868cf085d41daea33e1832be62fdc7fb7a577d0d3fd4.exe	108
PID 3464 wrote to memory of 1128	3464	82b48f25d847d3a45c97868cf085d41daea33e1832be62fdc7fb7a577d0d3fd4.exe	108
PID 3464 wrote to memory of 1096	3464	82b48f25d847d3a45c97868cf085d41daea33e1832be62fdc7fb7a577d0d3fd4.exe	109
PID 3464 wrote to memory of 1096	3464	82b48f25d847d3a45c97868cf085d41daea33e1832be62fdc7fb7a577d0d3fd4.exe	109
PID 3464 wrote to memory of 1756	3464	82b48f25d847d3a45c97868cf085d41daea33e1832be62fdc7fb7a577d0d3fd4.exe	110
PID 3464 wrote to memory of 1756	3464	82b48f25d847d3a45c97868cf085d41daea33e1832be62fdc7fb7a577d0d3fd4.exe	110
PID 3464 wrote to memory of 1584	3464	82b48f25d847d3a45c97868cf085d41daea33e1832be62fdc7fb7a577d0d3fd4.exe	113
PID 3464 wrote to memory of 1584	3464	82b48f25d847d3a45c97868cf085d41daea33e1832be62fdc7fb7a577d0d3fd4.exe	113
PID 3464 wrote to memory of 2512	3464	82b48f25d847d3a45c97868cf085d41daea33e1832be62fdc7fb7a577d0d3fd4.exe	114
PID 3464 wrote to memory of 2512	3464	82b48f25d847d3a45c97868cf085d41daea33e1832be62fdc7fb7a577d0d3fd4.exe	114
PID 3464 wrote to memory of 1648	3464	82b48f25d847d3a45c97868cf085d41daea33e1832be62fdc7fb7a577d0d3fd4.exe	115
PID 3464 wrote to memory of 1648	3464	82b48f25d847d3a45c97868cf085d41daea33e1832be62fdc7fb7a577d0d3fd4.exe	115
PID 3464 wrote to memory of 1856	3464	82b48f25d847d3a45c97868cf085d41daea33e1832be62fdc7fb7a577d0d3fd4.exe	116
PID 3464 wrote to memory of 1856	3464	82b48f25d847d3a45c97868cf085d41daea33e1832be62fdc7fb7a577d0d3fd4.exe	116
PID 3464 wrote to memory of 2012	3464	82b48f25d847d3a45c97868cf085d41daea33e1832be62fdc7fb7a577d0d3fd4.exe	117
PID 3464 wrote to memory of 2012	3464	82b48f25d847d3a45c97868cf085d41daea33e1832be62fdc7fb7a577d0d3fd4.exe	117
PID 3464 wrote to memory of 5044	3464	82b48f25d847d3a45c97868cf085d41daea33e1832be62fdc7fb7a577d0d3fd4.exe	118
PID 3464 wrote to memory of 5044	3464	82b48f25d847d3a45c97868cf085d41daea33e1832be62fdc7fb7a577d0d3fd4.exe	118

C:\Users\Admin\AppData\Local\Temp\82b48f25d847d3a45c97868cf085d41daea33e1832be62fdc7fb7a577d0d3fd4.exe
"C:\Users\Admin\AppData\Local\Temp\82b48f25d847d3a45c97868cf085d41daea33e1832be62fdc7fb7a577d0d3fd4.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3464
- C:\Windows\System\bSvSwYp.exe
  C:\Windows\System\bSvSwYp.exe
  2⤵
  - Executes dropped EXE
  PID:1716
- C:\Windows\System\PHijtIA.exe
  C:\Windows\System\PHijtIA.exe
  2⤵
  - Executes dropped EXE
  PID:3920
- C:\Windows\System\ueCDwSJ.exe
  C:\Windows\System\ueCDwSJ.exe
  2⤵
  - Executes dropped EXE
  PID:3784
- C:\Windows\System\eQsvkXW.exe
  C:\Windows\System\eQsvkXW.exe
  2⤵
  - Executes dropped EXE
  PID:4856
- C:\Windows\System\gcGmLGh.exe
  C:\Windows\System\gcGmLGh.exe
  2⤵
  - Executes dropped EXE
  PID:3628
- C:\Windows\System\RVKDUYC.exe
  C:\Windows\System\RVKDUYC.exe
  2⤵
  - Executes dropped EXE
  PID:456
- C:\Windows\System\rorneks.exe
  C:\Windows\System\rorneks.exe
  2⤵
  - Executes dropped EXE
  PID:4976
- C:\Windows\System\qcJizyc.exe
  C:\Windows\System\qcJizyc.exe
  2⤵
  - Executes dropped EXE
  PID:1864
- C:\Windows\System\LyIFAAF.exe
  C:\Windows\System\LyIFAAF.exe
  2⤵
  - Executes dropped EXE
  PID:2648
- C:\Windows\System\HEZnUVq.exe
  C:\Windows\System\HEZnUVq.exe
  2⤵
  - Executes dropped EXE
  PID:1176
- C:\Windows\System\LjZNKFL.exe
  C:\Windows\System\LjZNKFL.exe
  2⤵
  - Executes dropped EXE
  PID:2516
- C:\Windows\System\neAsKYq.exe
  C:\Windows\System\neAsKYq.exe
  2⤵
  - Executes dropped EXE
  PID:4640
- C:\Windows\System\JVNPEoB.exe
  C:\Windows\System\JVNPEoB.exe
  2⤵
  - Executes dropped EXE
  PID:3856
- C:\Windows\System\ijeYmVl.exe
  C:\Windows\System\ijeYmVl.exe
  2⤵
  - Executes dropped EXE
  PID:1848
- C:\Windows\System\XXxogrJ.exe
  C:\Windows\System\XXxogrJ.exe
  2⤵
  - Executes dropped EXE
  PID:1572
- C:\Windows\System\YGJBIgx.exe
  C:\Windows\System\YGJBIgx.exe
  2⤵
  - Executes dropped EXE
  PID:2064
- C:\Windows\System\mWyZLCt.exe
  C:\Windows\System\mWyZLCt.exe
  2⤵
  - Executes dropped EXE
  PID:1788
- C:\Windows\System\aOSVRXe.exe
  C:\Windows\System\aOSVRXe.exe
  2⤵
  - Executes dropped EXE
  PID:3588
- C:\Windows\System\DmTCecT.exe
  C:\Windows\System\DmTCecT.exe
  2⤵
  - Executes dropped EXE
  PID:5116
- C:\Windows\System\LTwAVgL.exe
  C:\Windows\System\LTwAVgL.exe
  2⤵
  - Executes dropped EXE
  PID:3600
- C:\Windows\System\NkkPMzG.exe
  C:\Windows\System\NkkPMzG.exe
  2⤵
  - Executes dropped EXE
  PID:964
- C:\Windows\System\tqDmPEF.exe
  C:\Windows\System\tqDmPEF.exe
  2⤵
  - Executes dropped EXE
  PID:2404
- C:\Windows\System\fkAwnhx.exe
  C:\Windows\System\fkAwnhx.exe
  2⤵
  - Executes dropped EXE
  PID:2752
- C:\Windows\System\EfqgTlV.exe
  C:\Windows\System\EfqgTlV.exe
  2⤵
  - Executes dropped EXE
  PID:1128
- C:\Windows\System\NvpvSBf.exe
  C:\Windows\System\NvpvSBf.exe
  2⤵
  - Executes dropped EXE
  PID:1096
- C:\Windows\System\oOqWmHC.exe
  C:\Windows\System\oOqWmHC.exe
  2⤵
  - Executes dropped EXE
  PID:1756
- C:\Windows\System\CJnwgHl.exe
  C:\Windows\System\CJnwgHl.exe
  2⤵
  - Executes dropped EXE
  PID:1584
- C:\Windows\System\QyRmEvc.exe
  C:\Windows\System\QyRmEvc.exe
  2⤵
  - Executes dropped EXE
  PID:2512
- C:\Windows\System\GvvgLNJ.exe
  C:\Windows\System\GvvgLNJ.exe
  2⤵
  - Executes dropped EXE
  PID:1648
- C:\Windows\System\ZycFKNC.exe
  C:\Windows\System\ZycFKNC.exe
  2⤵
  - Executes dropped EXE
  PID:1856
- C:\Windows\System\GtVzwxl.exe
  C:\Windows\System\GtVzwxl.exe
  2⤵
  - Executes dropped EXE
  PID:2012
- C:\Windows\System\szULMHT.exe
  C:\Windows\System\szULMHT.exe
  2⤵
  - Executes dropped EXE
  PID:5044
- C:\Windows\System\KjDTfUk.exe
  C:\Windows\System\KjDTfUk.exe
  2⤵
  - Executes dropped EXE
  PID:1524
- C:\Windows\System\yVsLrfn.exe
  C:\Windows\System\yVsLrfn.exe
  2⤵
  - Executes dropped EXE
  PID:2400
- C:\Windows\System\XpeeiaP.exe
  C:\Windows\System\XpeeiaP.exe
  2⤵
  - Executes dropped EXE
  PID:2780
- C:\Windows\System\LlSKBoJ.exe
  C:\Windows\System\LlSKBoJ.exe
  2⤵
  - Executes dropped EXE
  PID:4900
- C:\Windows\System\GFXxoqg.exe
  C:\Windows\System\GFXxoqg.exe
  2⤵
  - Executes dropped EXE
  PID:1780
- C:\Windows\System\hWwWLPL.exe
  C:\Windows\System\hWwWLPL.exe
  2⤵
  - Executes dropped EXE
  PID:2364
- C:\Windows\System\yVEllbF.exe
  C:\Windows\System\yVEllbF.exe
  2⤵
  - Executes dropped EXE
  PID:1004
- C:\Windows\System\XYGOaYM.exe
  C:\Windows\System\XYGOaYM.exe
  2⤵
  - Executes dropped EXE
  PID:2852
- C:\Windows\System\ZsqBpSB.exe
  C:\Windows\System\ZsqBpSB.exe
  2⤵
  - Executes dropped EXE
  PID:4544
- C:\Windows\System\HQBYEee.exe
  C:\Windows\System\HQBYEee.exe
  2⤵
  - Executes dropped EXE
  PID:4664
- C:\Windows\System\qZwNScQ.exe
  C:\Windows\System\qZwNScQ.exe
  2⤵
  - Executes dropped EXE
  PID:3288
- C:\Windows\System\rhiZpUw.exe
  C:\Windows\System\rhiZpUw.exe
  2⤵
  - Executes dropped EXE
  PID:2720
- C:\Windows\System\KrVdLNw.exe
  C:\Windows\System\KrVdLNw.exe
  2⤵
  - Executes dropped EXE
  PID:4408
- C:\Windows\System\cgSyUuV.exe
  C:\Windows\System\cgSyUuV.exe
  2⤵
  - Executes dropped EXE
  PID:1932
- C:\Windows\System\TLBrHPF.exe
  C:\Windows\System\TLBrHPF.exe
  2⤵
  - Executes dropped EXE
  PID:1256
- C:\Windows\System\smdblWy.exe
  C:\Windows\System\smdblWy.exe
  2⤵
  - Executes dropped EXE
  PID:4164
- C:\Windows\System\RdVLmvV.exe
  C:\Windows\System\RdVLmvV.exe
  2⤵
  - Executes dropped EXE
  PID:1052
- C:\Windows\System\ewlbACo.exe
  C:\Windows\System\ewlbACo.exe
  2⤵
  - Executes dropped EXE
  PID:2060
- C:\Windows\System\eTxwbNN.exe
  C:\Windows\System\eTxwbNN.exe
  2⤵
  - Executes dropped EXE
  PID:3300
- C:\Windows\System\mnmJYSA.exe
  C:\Windows\System\mnmJYSA.exe
  2⤵
  - Executes dropped EXE
  PID:4940
- C:\Windows\System\CikrgjC.exe
  C:\Windows\System\CikrgjC.exe
  2⤵
  - Executes dropped EXE
  PID:2224
- C:\Windows\System\acKOIgD.exe
  C:\Windows\System\acKOIgD.exe
  2⤵
  - Executes dropped EXE
  PID:1692
- C:\Windows\System\NEyXhGZ.exe
  C:\Windows\System\NEyXhGZ.exe
  2⤵
  - Executes dropped EXE
  PID:4848
- C:\Windows\System\qIwGHBo.exe
  C:\Windows\System\qIwGHBo.exe
  2⤵
  - Executes dropped EXE
  PID:5076
- C:\Windows\System\lRyvELI.exe
  C:\Windows\System\lRyvELI.exe
  2⤵
  - Executes dropped EXE
  PID:4356
- C:\Windows\System\CZXcoqN.exe
  C:\Windows\System\CZXcoqN.exe
  2⤵
  - Executes dropped EXE
  PID:1700
- C:\Windows\System\KKTNGwp.exe
  C:\Windows\System\KKTNGwp.exe
  2⤵
  - Executes dropped EXE
  PID:2184
- C:\Windows\System\WZFDYyH.exe
  C:\Windows\System\WZFDYyH.exe
  2⤵
  - Executes dropped EXE
  PID:4968
- C:\Windows\System\ELwIYDr.exe
  C:\Windows\System\ELwIYDr.exe
  2⤵
  - Executes dropped EXE
  PID:3728
- C:\Windows\System\dhJohYh.exe
  C:\Windows\System\dhJohYh.exe
  2⤵
  - Executes dropped EXE
  PID:3452
- C:\Windows\System\vjsTPhN.exe
  C:\Windows\System\vjsTPhN.exe
  2⤵
  - Executes dropped EXE
  PID:764
- C:\Windows\System\DgeiEes.exe
  C:\Windows\System\DgeiEes.exe
  2⤵
  - Executes dropped EXE
  PID:3876
- C:\Windows\System\bpdqMrm.exe
  C:\Windows\System\bpdqMrm.exe
  2⤵
  PID:1120
- C:\Windows\System\oBFkZPA.exe
  C:\Windows\System\oBFkZPA.exe
  2⤵
  PID:2484
- C:\Windows\System\XLBnQEn.exe
  C:\Windows\System\XLBnQEn.exe
  2⤵
  PID:3120
- C:\Windows\System\bTCcxPz.exe
  C:\Windows\System\bTCcxPz.exe
  2⤵
  PID:2848
- C:\Windows\System\PEOEMbR.exe
  C:\Windows\System\PEOEMbR.exe
  2⤵
  PID:772
- C:\Windows\System\cffoSOq.exe
  C:\Windows\System\cffoSOq.exe
  2⤵
  PID:4816
- C:\Windows\System\rOuFlwP.exe
  C:\Windows\System\rOuFlwP.exe
  2⤵
  PID:3112
- C:\Windows\System\ZOXFnrZ.exe
  C:\Windows\System\ZOXFnrZ.exe
  2⤵
  PID:2728
- C:\Windows\System\rgbNRpR.exe
  C:\Windows\System\rgbNRpR.exe
  2⤵
  PID:4444
- C:\Windows\System\okrkBdm.exe
  C:\Windows\System\okrkBdm.exe
  2⤵
  PID:644
- C:\Windows\System\vxAOgwP.exe
  C:\Windows\System\vxAOgwP.exe
  2⤵
  PID:532
- C:\Windows\System\tHgBxuT.exe
  C:\Windows\System\tHgBxuT.exe
  2⤵
  PID:4348
- C:\Windows\System\FBLYbMW.exe
  C:\Windows\System\FBLYbMW.exe
  2⤵
  PID:4000
- C:\Windows\System\heqAffv.exe
  C:\Windows\System\heqAffv.exe
  2⤵
  PID:336
- C:\Windows\System\syRfazE.exe
  C:\Windows\System\syRfazE.exe
  2⤵
  PID:736
- C:\Windows\System\wuprrwv.exe
  C:\Windows\System\wuprrwv.exe
  2⤵
  PID:3524
- C:\Windows\System\ZeDGjZd.exe
  C:\Windows\System\ZeDGjZd.exe
  2⤵
  PID:3788
- C:\Windows\System\nYgUNdu.exe
  C:\Windows\System\nYgUNdu.exe
  2⤵
  PID:3316
- C:\Windows\System\WpHycKq.exe
  C:\Windows\System\WpHycKq.exe
  2⤵
  PID:4840
- C:\Windows\System\Bxfrkql.exe
  C:\Windows\System\Bxfrkql.exe
  2⤵
  PID:2164
- C:\Windows\System\OvWOMat.exe
  C:\Windows\System\OvWOMat.exe
  2⤵
  PID:3304
- C:\Windows\System\kVafNWx.exe
  C:\Windows\System\kVafNWx.exe
  2⤵
  PID:4780
- C:\Windows\System\vimyvCQ.exe
  C:\Windows\System\vimyvCQ.exe
  2⤵
  PID:3752
- C:\Windows\System\rNjOvuq.exe
  C:\Windows\System\rNjOvuq.exe
  2⤵
  PID:4560
- C:\Windows\System\hDEZQzC.exe
  C:\Windows\System\hDEZQzC.exe
  2⤵
  PID:5132
- C:\Windows\System\SfgfBru.exe
  C:\Windows\System\SfgfBru.exe
  2⤵
  PID:5164
- C:\Windows\System\SVOQINd.exe
  C:\Windows\System\SVOQINd.exe
  2⤵
  PID:5200
- C:\Windows\System\HuQXQWR.exe
  C:\Windows\System\HuQXQWR.exe
  2⤵
  PID:5228
- C:\Windows\System\CYArnEO.exe
  C:\Windows\System\CYArnEO.exe
  2⤵
  PID:5256
- C:\Windows\System\sQPyhhs.exe
  C:\Windows\System\sQPyhhs.exe
  2⤵
  PID:5288
- C:\Windows\System\XekiiZX.exe
  C:\Windows\System\XekiiZX.exe
  2⤵
  PID:5312
- C:\Windows\System\zXdSfhi.exe
  C:\Windows\System\zXdSfhi.exe
  2⤵
  PID:5344
- C:\Windows\System\Wnxhtdq.exe
  C:\Windows\System\Wnxhtdq.exe
  2⤵
  PID:5392
- C:\Windows\System\MFsCqSr.exe
  C:\Windows\System\MFsCqSr.exe
  2⤵
  PID:5416
- C:\Windows\System\KNFxxwt.exe
  C:\Windows\System\KNFxxwt.exe
  2⤵
  PID:5444
- C:\Windows\System\RBDOcuX.exe
  C:\Windows\System\RBDOcuX.exe
  2⤵
  PID:5472
- C:\Windows\System\pxNUGFv.exe
  C:\Windows\System\pxNUGFv.exe
  2⤵
  PID:5500
- C:\Windows\System\dRwWjEI.exe
  C:\Windows\System\dRwWjEI.exe
  2⤵
  PID:5528
- C:\Windows\System\AzoqPba.exe
  C:\Windows\System\AzoqPba.exe
  2⤵
  PID:5568
- C:\Windows\System\wYUwUGz.exe
  C:\Windows\System\wYUwUGz.exe
  2⤵
  PID:5596
- C:\Windows\System\sdiKekD.exe
  C:\Windows\System\sdiKekD.exe
  2⤵
  PID:5628
- C:\Windows\System\wAdDOIZ.exe
  C:\Windows\System\wAdDOIZ.exe
  2⤵
  PID:5660
- C:\Windows\System\FAheBkj.exe
  C:\Windows\System\FAheBkj.exe
  2⤵
  PID:5680
- C:\Windows\System\UZnGAKE.exe
  C:\Windows\System\UZnGAKE.exe
  2⤵
  PID:5708
- C:\Windows\System\kWABBtj.exe
  C:\Windows\System\kWABBtj.exe
  2⤵
  PID:5736
- C:\Windows\System\GbMyihd.exe
  C:\Windows\System\GbMyihd.exe
  2⤵
  PID:5760
- C:\Windows\System\mElQCFI.exe
  C:\Windows\System\mElQCFI.exe
  2⤵
  PID:5784
- C:\Windows\System\DXjaSIT.exe
  C:\Windows\System\DXjaSIT.exe
  2⤵
  PID:5816
- C:\Windows\System\xfNCBFG.exe
  C:\Windows\System\xfNCBFG.exe
  2⤵
  PID:5856
- C:\Windows\System\wRoNzTs.exe
  C:\Windows\System\wRoNzTs.exe
  2⤵
  PID:5872
- C:\Windows\System\XpJgLvB.exe
  C:\Windows\System\XpJgLvB.exe
  2⤵
  PID:5904
- C:\Windows\System\sGULgfn.exe
  C:\Windows\System\sGULgfn.exe
  2⤵
  PID:5932
- C:\Windows\System\zBMwJXk.exe
  C:\Windows\System\zBMwJXk.exe
  2⤵
  PID:5960
- C:\Windows\System\qRBuDBT.exe
  C:\Windows\System\qRBuDBT.exe
  2⤵
  PID:5996
- C:\Windows\System\IBZuVvy.exe
  C:\Windows\System\IBZuVvy.exe
  2⤵
  PID:6024
- C:\Windows\System\bJUTqsu.exe
  C:\Windows\System\bJUTqsu.exe
  2⤵
  PID:6056
- C:\Windows\System\ohWciOe.exe
  C:\Windows\System\ohWciOe.exe
  2⤵
  PID:6092
- C:\Windows\System\YLHekoJ.exe
  C:\Windows\System\YLHekoJ.exe
  2⤵
  PID:6124
- C:\Windows\System\KXRlGAZ.exe
  C:\Windows\System\KXRlGAZ.exe
  2⤵
  PID:2500
- C:\Windows\System\PkRMUNL.exe
  C:\Windows\System\PkRMUNL.exe
  2⤵
  PID:5184
- C:\Windows\System\qSJzyat.exe
  C:\Windows\System\qSJzyat.exe
  2⤵
  PID:5248
- C:\Windows\System\DiKVvQt.exe
  C:\Windows\System\DiKVvQt.exe
  2⤵
  PID:5320
- C:\Windows\System\BVWsvQj.exe
  C:\Windows\System\BVWsvQj.exe
  2⤵
  PID:5360
- C:\Windows\System\toerUFH.exe
  C:\Windows\System\toerUFH.exe
  2⤵
  PID:5452
- C:\Windows\System\jqfrJXU.exe
  C:\Windows\System\jqfrJXU.exe
  2⤵
  PID:5512
- C:\Windows\System\UMuaXuS.exe
  C:\Windows\System\UMuaXuS.exe
  2⤵
  PID:5584
- C:\Windows\System\IOMRZJj.exe
  C:\Windows\System\IOMRZJj.exe
  2⤵
  PID:5648
- C:\Windows\System\JwyOShG.exe
  C:\Windows\System\JwyOShG.exe
  2⤵
  PID:5720
- C:\Windows\System\RVigffA.exe
  C:\Windows\System\RVigffA.exe
  2⤵
  PID:5780
- C:\Windows\System\ljSOzBY.exe
  C:\Windows\System\ljSOzBY.exe
  2⤵
  PID:5868
- C:\Windows\System\UsDuQVX.exe
  C:\Windows\System\UsDuQVX.exe
  2⤵
  PID:5940
- C:\Windows\System\MENjIkh.exe
  C:\Windows\System\MENjIkh.exe
  2⤵
  PID:632
- C:\Windows\System\swcaKrd.exe
  C:\Windows\System\swcaKrd.exe
  2⤵
  PID:6052
- C:\Windows\System\pZyYIxV.exe
  C:\Windows\System\pZyYIxV.exe
  2⤵
  PID:6104
- C:\Windows\System\ihXgYhV.exe
  C:\Windows\System\ihXgYhV.exe
  2⤵
  PID:5220
- C:\Windows\System\FXCCIEl.exe
  C:\Windows\System\FXCCIEl.exe
  2⤵
  PID:5332
- C:\Windows\System\tuiLTYS.exe
  C:\Windows\System\tuiLTYS.exe
  2⤵
  PID:2824
- C:\Windows\System\upQcdDi.exe
  C:\Windows\System\upQcdDi.exe
  2⤵
  PID:5636
- C:\Windows\System\AUEuXME.exe
  C:\Windows\System\AUEuXME.exe
  2⤵
  PID:2492
- C:\Windows\System\vkwLtjW.exe
  C:\Windows\System\vkwLtjW.exe
  2⤵
  PID:5980
- C:\Windows\System\pOLDvCG.exe
  C:\Windows\System\pOLDvCG.exe
  2⤵
  PID:6076
- C:\Windows\System\rvAKfWv.exe
  C:\Windows\System\rvAKfWv.exe
  2⤵
  PID:4884
- C:\Windows\System\QOosUAg.exe
  C:\Windows\System\QOosUAg.exe
  2⤵
  PID:5484
- C:\Windows\System\IzkHOqh.exe
  C:\Windows\System\IzkHOqh.exe
  2⤵
  PID:5864
- C:\Windows\System\sjILLjn.exe
  C:\Windows\System\sjILLjn.exe
  2⤵
  PID:5176
- C:\Windows\System\MzEpnty.exe
  C:\Windows\System\MzEpnty.exe
  2⤵
  PID:5976
- C:\Windows\System\kijVDVv.exe
  C:\Windows\System\kijVDVv.exe
  2⤵
  PID:4052
- C:\Windows\System\WYIOURt.exe
  C:\Windows\System\WYIOURt.exe
  2⤵
  PID:6164
- C:\Windows\System\rqoylPD.exe
  C:\Windows\System\rqoylPD.exe
  2⤵
  PID:6204
- C:\Windows\System\AxDelma.exe
  C:\Windows\System\AxDelma.exe
  2⤵
  PID:6228
- C:\Windows\System\uKSxtuE.exe
  C:\Windows\System\uKSxtuE.exe
  2⤵
  PID:6256
- C:\Windows\System\nMSRUFQ.exe
  C:\Windows\System\nMSRUFQ.exe
  2⤵
  PID:6284
- C:\Windows\System\WBDFDfV.exe
  C:\Windows\System\WBDFDfV.exe
  2⤵
  PID:6312
- C:\Windows\System\BFOnvCj.exe
  C:\Windows\System\BFOnvCj.exe
  2⤵
  PID:6344
- C:\Windows\System\xOqNHWG.exe
  C:\Windows\System\xOqNHWG.exe
  2⤵
  PID:6372
- C:\Windows\System\VIzQUOZ.exe
  C:\Windows\System\VIzQUOZ.exe
  2⤵
  PID:6400
- C:\Windows\System\gmqcTkI.exe
  C:\Windows\System\gmqcTkI.exe
  2⤵
  PID:6428
- C:\Windows\System\KTBcDAv.exe
  C:\Windows\System\KTBcDAv.exe
  2⤵
  PID:6456
- C:\Windows\System\tmFmZYa.exe
  C:\Windows\System\tmFmZYa.exe
  2⤵
  PID:6484
- C:\Windows\System\TwvZfmG.exe
  C:\Windows\System\TwvZfmG.exe
  2⤵
  PID:6516
- C:\Windows\System\XzEtCeh.exe
  C:\Windows\System\XzEtCeh.exe
  2⤵
  PID:6544
- C:\Windows\System\XDDxCBW.exe
  C:\Windows\System\XDDxCBW.exe
  2⤵
  PID:6572
- C:\Windows\System\EBiMelQ.exe
  C:\Windows\System\EBiMelQ.exe
  2⤵
  PID:6600
- C:\Windows\System\pJGVgqs.exe
  C:\Windows\System\pJGVgqs.exe
  2⤵
  PID:6628
- C:\Windows\System\MRBuCSa.exe
  C:\Windows\System\MRBuCSa.exe
  2⤵
  PID:6656
- C:\Windows\System\RNSAGNH.exe
  C:\Windows\System\RNSAGNH.exe
  2⤵
  PID:6684
- C:\Windows\System\UojKNvM.exe
  C:\Windows\System\UojKNvM.exe
  2⤵
  PID:6712
- C:\Windows\System\fUSPLVM.exe
  C:\Windows\System\fUSPLVM.exe
  2⤵
  PID:6740
- C:\Windows\System\VWzjIEE.exe
  C:\Windows\System\VWzjIEE.exe
  2⤵
  PID:6768
- C:\Windows\System\tlXaPBC.exe
  C:\Windows\System\tlXaPBC.exe
  2⤵
  PID:6796
- C:\Windows\System\mojZJcU.exe
  C:\Windows\System\mojZJcU.exe
  2⤵
  PID:6824
- C:\Windows\System\qOlLwVe.exe
  C:\Windows\System\qOlLwVe.exe
  2⤵
  PID:6856
- C:\Windows\System\WgVNGQT.exe
  C:\Windows\System\WgVNGQT.exe
  2⤵
  PID:6880
- C:\Windows\System\OfAlAcn.exe
  C:\Windows\System\OfAlAcn.exe
  2⤵
  PID:6908
- C:\Windows\System\zwqJmRo.exe
  C:\Windows\System\zwqJmRo.exe
  2⤵
  PID:6944
- C:\Windows\System\QJAwpJv.exe
  C:\Windows\System\QJAwpJv.exe
  2⤵
  PID:6964
- C:\Windows\System\FKAupmN.exe
  C:\Windows\System\FKAupmN.exe
  2⤵
  PID:6992
- C:\Windows\System\npjpXiQ.exe
  C:\Windows\System\npjpXiQ.exe
  2⤵
  PID:7020
- C:\Windows\System\UVTYcmM.exe
  C:\Windows\System\UVTYcmM.exe
  2⤵
  PID:7048
- C:\Windows\System\wymSynn.exe
  C:\Windows\System\wymSynn.exe
  2⤵
  PID:7076
- C:\Windows\System\IIQSHuo.exe
  C:\Windows\System\IIQSHuo.exe
  2⤵
  PID:7104
- C:\Windows\System\WGgqItQ.exe
  C:\Windows\System\WGgqItQ.exe
  2⤵
  PID:7132
- C:\Windows\System\mkDUIDX.exe
  C:\Windows\System\mkDUIDX.exe
  2⤵
  PID:7160
- C:\Windows\System\WChaACj.exe
  C:\Windows\System\WChaACj.exe
  2⤵
  PID:6192
- C:\Windows\System\beQsCUy.exe
  C:\Windows\System\beQsCUy.exe
  2⤵
  PID:6240
- C:\Windows\System\jPmPZuW.exe
  C:\Windows\System\jPmPZuW.exe
  2⤵
  PID:6308
- C:\Windows\System\QzDtiUj.exe
  C:\Windows\System\QzDtiUj.exe
  2⤵
  PID:6364
- C:\Windows\System\ryitWgg.exe
  C:\Windows\System\ryitWgg.exe
  2⤵
  PID:6424
- C:\Windows\System\eTyUstq.exe
  C:\Windows\System\eTyUstq.exe
  2⤵
  PID:6480
- C:\Windows\System\MJbHWQq.exe
  C:\Windows\System\MJbHWQq.exe
  2⤵
  PID:6556
- C:\Windows\System\dBYtcVt.exe
  C:\Windows\System\dBYtcVt.exe
  2⤵
  PID:6620
- C:\Windows\System\AxCsCfo.exe
  C:\Windows\System\AxCsCfo.exe
  2⤵
  PID:6680
- C:\Windows\System\MTfyjKl.exe
  C:\Windows\System\MTfyjKl.exe
  2⤵
  PID:6752
- C:\Windows\System\XzIPwQC.exe
  C:\Windows\System\XzIPwQC.exe
  2⤵
  PID:6816
- C:\Windows\System\eNSvSrT.exe
  C:\Windows\System\eNSvSrT.exe
  2⤵
  PID:6872
- C:\Windows\System\jEbPOLP.exe
  C:\Windows\System\jEbPOLP.exe
  2⤵
  PID:6932
- C:\Windows\System\fUgXSix.exe
  C:\Windows\System\fUgXSix.exe
  2⤵
  PID:7004
- C:\Windows\System\NLNWEsi.exe
  C:\Windows\System\NLNWEsi.exe
  2⤵
  PID:4704
- C:\Windows\System\IaHAVuN.exe
  C:\Windows\System\IaHAVuN.exe
  2⤵
  PID:7100
- C:\Windows\System\yKvDvoM.exe
  C:\Windows\System\yKvDvoM.exe
  2⤵
  PID:6172
- C:\Windows\System\goOFFHY.exe
  C:\Windows\System\goOFFHY.exe
  2⤵
  PID:6336
- C:\Windows\System\ISBAxQR.exe
  C:\Windows\System\ISBAxQR.exe
  2⤵
  PID:6508
- C:\Windows\System\xGGWcep.exe
  C:\Windows\System\xGGWcep.exe
  2⤵
  PID:6676
- C:\Windows\System\CHFhYJF.exe
  C:\Windows\System\CHFhYJF.exe
  2⤵
  PID:6780
- C:\Windows\System\vhesjXQ.exe
  C:\Windows\System\vhesjXQ.exe
  2⤵
  PID:6928
- C:\Windows\System\GIAdTSP.exe
  C:\Windows\System\GIAdTSP.exe
  2⤵
  PID:7068
- C:\Windows\System\HUFRdJo.exe
  C:\Windows\System\HUFRdJo.exe
  2⤵
  PID:5752
- C:\Windows\System\NXkPJut.exe
  C:\Windows\System\NXkPJut.exe
  2⤵
  PID:6596
- C:\Windows\System\ZoDrHMD.exe
  C:\Windows\System\ZoDrHMD.exe
  2⤵
  PID:6900
- C:\Windows\System\KpFWcxr.exe
  C:\Windows\System\KpFWcxr.exe
  2⤵
  PID:6224
- C:\Windows\System\nuCXOYQ.exe
  C:\Windows\System\nuCXOYQ.exe
  2⤵
  PID:7032
- C:\Windows\System\xQekbwz.exe
  C:\Windows\System\xQekbwz.exe
  2⤵
  PID:7176
- C:\Windows\System\TJkoTzr.exe
  C:\Windows\System\TJkoTzr.exe
  2⤵
  PID:7204
- C:\Windows\System\JVWHKtA.exe
  C:\Windows\System\JVWHKtA.exe
  2⤵
  PID:7232
- C:\Windows\System\dQKJvjx.exe
  C:\Windows\System\dQKJvjx.exe
  2⤵
  PID:7260
- C:\Windows\System\ZGmDEOe.exe
  C:\Windows\System\ZGmDEOe.exe
  2⤵
  PID:7288
- C:\Windows\System\RIhxGcD.exe
  C:\Windows\System\RIhxGcD.exe
  2⤵
  PID:7316
- C:\Windows\System\XFOkRUT.exe
  C:\Windows\System\XFOkRUT.exe
  2⤵
  PID:7344
- C:\Windows\System\qNiMPNq.exe
  C:\Windows\System\qNiMPNq.exe
  2⤵
  PID:7372
- C:\Windows\System\bCykyaK.exe
  C:\Windows\System\bCykyaK.exe
  2⤵
  PID:7400
- C:\Windows\System\PBBTcYr.exe
  C:\Windows\System\PBBTcYr.exe
  2⤵
  PID:7428
- C:\Windows\System\EKeAhBp.exe
  C:\Windows\System\EKeAhBp.exe
  2⤵
  PID:7464
- C:\Windows\System\fICBDMK.exe
  C:\Windows\System\fICBDMK.exe
  2⤵
  PID:7484
- C:\Windows\System\kfKNxzZ.exe
  C:\Windows\System\kfKNxzZ.exe
  2⤵
  PID:7512
- C:\Windows\System\hRPQDje.exe
  C:\Windows\System\hRPQDje.exe
  2⤵
  PID:7540
- C:\Windows\System\ykYMpTw.exe
  C:\Windows\System\ykYMpTw.exe
  2⤵
  PID:7568
- C:\Windows\System\dVHVgHS.exe
  C:\Windows\System\dVHVgHS.exe
  2⤵
  PID:7596
- C:\Windows\System\iDNkqBv.exe
  C:\Windows\System\iDNkqBv.exe
  2⤵
  PID:7624
- C:\Windows\System\dQyHSGN.exe
  C:\Windows\System\dQyHSGN.exe
  2⤵
  PID:7652
- C:\Windows\System\ZkjCTxM.exe
  C:\Windows\System\ZkjCTxM.exe
  2⤵
  PID:7680
- C:\Windows\System\CONrMdk.exe
  C:\Windows\System\CONrMdk.exe
  2⤵
  PID:7708
- C:\Windows\System\XDMsBpB.exe
  C:\Windows\System\XDMsBpB.exe
  2⤵
  PID:7736
- C:\Windows\System\GyfspXg.exe
  C:\Windows\System\GyfspXg.exe
  2⤵
  PID:7764
- C:\Windows\System\eOSKwiT.exe
  C:\Windows\System\eOSKwiT.exe
  2⤵
  PID:7792
- C:\Windows\System\wnkXsZh.exe
  C:\Windows\System\wnkXsZh.exe
  2⤵
  PID:7820
- C:\Windows\System\pdEqstH.exe
  C:\Windows\System\pdEqstH.exe
  2⤵
  PID:7848
- C:\Windows\System\cAKsogN.exe
  C:\Windows\System\cAKsogN.exe
  2⤵
  PID:7876
- C:\Windows\System\feUcXsJ.exe
  C:\Windows\System\feUcXsJ.exe
  2⤵
  PID:7904
- C:\Windows\System\DwcEelV.exe
  C:\Windows\System\DwcEelV.exe
  2⤵
  PID:7936
- C:\Windows\System\WjkClkL.exe
  C:\Windows\System\WjkClkL.exe
  2⤵
  PID:7960
- C:\Windows\System\NLGzVFc.exe
  C:\Windows\System\NLGzVFc.exe
  2⤵
  PID:7976
- C:\Windows\System\VUnwKdp.exe
  C:\Windows\System\VUnwKdp.exe
  2⤵
  PID:8004
- C:\Windows\System\dsUbvem.exe
  C:\Windows\System\dsUbvem.exe
  2⤵
  PID:8032
- C:\Windows\System\UQwfMtC.exe
  C:\Windows\System\UQwfMtC.exe
  2⤵
  PID:8060
- C:\Windows\System\CWVcYvL.exe
  C:\Windows\System\CWVcYvL.exe
  2⤵
  PID:8088
- C:\Windows\System\XGekDdp.exe
  C:\Windows\System\XGekDdp.exe
  2⤵
  PID:8116
- C:\Windows\System\pfBhHpr.exe
  C:\Windows\System\pfBhHpr.exe
  2⤵
  PID:8144
- C:\Windows\System\ngOwMzE.exe
  C:\Windows\System\ngOwMzE.exe
  2⤵
  PID:8180
- C:\Windows\System\ILnbrVh.exe
  C:\Windows\System\ILnbrVh.exe
  2⤵
  PID:7188
- C:\Windows\System\sfAQnBw.exe
  C:\Windows\System\sfAQnBw.exe
  2⤵
  PID:7252
- C:\Windows\System\WgXSohb.exe
  C:\Windows\System\WgXSohb.exe
  2⤵
  PID:7312
- C:\Windows\System\ktLOJGN.exe
  C:\Windows\System\ktLOJGN.exe
  2⤵
  PID:7368
- C:\Windows\System\WfJdAfd.exe
  C:\Windows\System\WfJdAfd.exe
  2⤵
  PID:7440
- C:\Windows\System\rCECvkS.exe
  C:\Windows\System\rCECvkS.exe
  2⤵
  PID:7504
- C:\Windows\System\VidfIUy.exe
  C:\Windows\System\VidfIUy.exe
  2⤵
  PID:3428
- C:\Windows\System\mRfiPCQ.exe
  C:\Windows\System\mRfiPCQ.exe
  2⤵
  PID:7636
- C:\Windows\System\JmoKRoh.exe
  C:\Windows\System\JmoKRoh.exe
  2⤵
  PID:7700
- C:\Windows\System\MqplJtk.exe
  C:\Windows\System\MqplJtk.exe
  2⤵
  PID:7776
- C:\Windows\System\ilFtrKn.exe
  C:\Windows\System\ilFtrKn.exe
  2⤵
  PID:7844
- C:\Windows\System\NwnkqKQ.exe
  C:\Windows\System\NwnkqKQ.exe
  2⤵
  PID:7916
- C:\Windows\System\EyHPGWr.exe
  C:\Windows\System\EyHPGWr.exe
  2⤵
  PID:7968
- C:\Windows\System\tCFKaiC.exe
  C:\Windows\System\tCFKaiC.exe
  2⤵
  PID:8024
- C:\Windows\System\CUEzEyo.exe
  C:\Windows\System\CUEzEyo.exe
  2⤵
  PID:8076
- C:\Windows\System\GEqgBYP.exe
  C:\Windows\System\GEqgBYP.exe
  2⤵
  PID:8156
- C:\Windows\System\HcahUUB.exe
  C:\Windows\System\HcahUUB.exe
  2⤵
  PID:7200
- C:\Windows\System\TjpkCBF.exe
  C:\Windows\System\TjpkCBF.exe
  2⤵
  PID:7340
- C:\Windows\System\PjalwBe.exe
  C:\Windows\System\PjalwBe.exe
  2⤵
  PID:7476
- C:\Windows\System\EfGpQDq.exe
  C:\Windows\System\EfGpQDq.exe
  2⤵
  PID:7560
- C:\Windows\System\OeXxOGu.exe
  C:\Windows\System\OeXxOGu.exe
  2⤵
  PID:7720
- C:\Windows\System\WpZeQCq.exe
  C:\Windows\System\WpZeQCq.exe
  2⤵
  PID:7872
- C:\Windows\System\ZCjPAhr.exe
  C:\Windows\System\ZCjPAhr.exe
  2⤵
  PID:8028
- C:\Windows\System\YDvvPkR.exe
  C:\Windows\System\YDvvPkR.exe
  2⤵
  PID:8140
- C:\Windows\System\ifjtYMR.exe
  C:\Windows\System\ifjtYMR.exe
  2⤵
  PID:1208
- C:\Windows\System\FKMUUik.exe
  C:\Windows\System\FKMUUik.exe
  2⤵
  PID:7620
- C:\Windows\System\LFkGgRN.exe
  C:\Windows\System\LFkGgRN.exe
  2⤵
  PID:8100
- C:\Windows\System\XNoIAFg.exe
  C:\Windows\System\XNoIAFg.exe
  2⤵
  PID:7552
- C:\Windows\System\kauiAdx.exe
  C:\Windows\System\kauiAdx.exe
  2⤵
  PID:7472
- C:\Windows\System\ylDayXU.exe
  C:\Windows\System\ylDayXU.exe
  2⤵
  PID:8216
- C:\Windows\System\ULvncmt.exe
  C:\Windows\System\ULvncmt.exe
  2⤵
  PID:8244
- C:\Windows\System\lvpFHUq.exe
  C:\Windows\System\lvpFHUq.exe
  2⤵
  PID:8276
- C:\Windows\System\AbFMWVU.exe
  C:\Windows\System\AbFMWVU.exe
  2⤵
  PID:8304
- C:\Windows\System\fMuWSfG.exe
  C:\Windows\System\fMuWSfG.exe
  2⤵
  PID:8336
- C:\Windows\System\kAeAUcu.exe
  C:\Windows\System\kAeAUcu.exe
  2⤵
  PID:8364
- C:\Windows\System\QORNGex.exe
  C:\Windows\System\QORNGex.exe
  2⤵
  PID:8392
- C:\Windows\System\MOHSuNq.exe
  C:\Windows\System\MOHSuNq.exe
  2⤵
  PID:8420
- C:\Windows\System\tFoSddJ.exe
  C:\Windows\System\tFoSddJ.exe
  2⤵
  PID:8448
- C:\Windows\System\RXDamKJ.exe
  C:\Windows\System\RXDamKJ.exe
  2⤵
  PID:8476
- C:\Windows\System\ScjdXpJ.exe
  C:\Windows\System\ScjdXpJ.exe
  2⤵
  PID:8496
- C:\Windows\System\rVvBSDW.exe
  C:\Windows\System\rVvBSDW.exe
  2⤵
  PID:8524
- C:\Windows\System\bFUowbS.exe
  C:\Windows\System\bFUowbS.exe
  2⤵
  PID:8556
- C:\Windows\System\EdDvZnp.exe
  C:\Windows\System\EdDvZnp.exe
  2⤵
  PID:8588
- C:\Windows\System\GToIlrh.exe
  C:\Windows\System\GToIlrh.exe
  2⤵
  PID:8616
- C:\Windows\System\xSScSvI.exe
  C:\Windows\System\xSScSvI.exe
  2⤵
  PID:8644
- C:\Windows\System\xQunRNH.exe
  C:\Windows\System\xQunRNH.exe
  2⤵
  PID:8680
- C:\Windows\System\wIQXznq.exe
  C:\Windows\System\wIQXznq.exe
  2⤵
  PID:8700
- C:\Windows\System\hQRdHSC.exe
  C:\Windows\System\hQRdHSC.exe
  2⤵
  PID:8728
- C:\Windows\System\fQAPDAq.exe
  C:\Windows\System\fQAPDAq.exe
  2⤵
  PID:8756
- C:\Windows\System\IuXCkxB.exe
  C:\Windows\System\IuXCkxB.exe
  2⤵
  PID:8788
- C:\Windows\System\Xhwgybq.exe
  C:\Windows\System\Xhwgybq.exe
  2⤵
  PID:8816
- C:\Windows\System\zmbXxAc.exe
  C:\Windows\System\zmbXxAc.exe
  2⤵
  PID:8844
- C:\Windows\System\hHLDBxj.exe
  C:\Windows\System\hHLDBxj.exe
  2⤵
  PID:8872
- C:\Windows\System\lGZMPbp.exe
  C:\Windows\System\lGZMPbp.exe
  2⤵
  PID:8900
- C:\Windows\System\fSumTUV.exe
  C:\Windows\System\fSumTUV.exe
  2⤵
  PID:8928
- C:\Windows\System\mdeYFRo.exe
  C:\Windows\System\mdeYFRo.exe
  2⤵
  PID:8960
- C:\Windows\System\mGkFkqq.exe
  C:\Windows\System\mGkFkqq.exe
  2⤵
  PID:8996
- C:\Windows\System\imdogVr.exe
  C:\Windows\System\imdogVr.exe
  2⤵
  PID:9012
- C:\Windows\System\tPnZifW.exe
  C:\Windows\System\tPnZifW.exe
  2⤵
  PID:9036
- C:\Windows\System\QgbzjHI.exe
  C:\Windows\System\QgbzjHI.exe
  2⤵
  PID:9060
- C:\Windows\System\qzwOZJb.exe
  C:\Windows\System\qzwOZJb.exe
  2⤵
  PID:9088
- C:\Windows\System\IbEVHBp.exe
  C:\Windows\System\IbEVHBp.exe
  2⤵
  PID:9120
- C:\Windows\System\MHwowqu.exe
  C:\Windows\System\MHwowqu.exe
  2⤵
  PID:9148
- C:\Windows\System\VgDjSSG.exe
  C:\Windows\System\VgDjSSG.exe
  2⤵
  PID:9176
- C:\Windows\System\VpTQiBE.exe
  C:\Windows\System\VpTQiBE.exe
  2⤵
  PID:9208
- C:\Windows\System\vaEhoAe.exe
  C:\Windows\System\vaEhoAe.exe
  2⤵
  PID:8200
- C:\Windows\System\EQKYSHP.exe
  C:\Windows\System\EQKYSHP.exe
  2⤵
  PID:8268
- C:\Windows\System\lxcRGDk.exe
  C:\Windows\System\lxcRGDk.exe
  2⤵
  PID:8356
- C:\Windows\System\sOqmLDZ.exe
  C:\Windows\System\sOqmLDZ.exe
  2⤵
  PID:8404
- C:\Windows\System\qsiHWwU.exe
  C:\Windows\System\qsiHWwU.exe
  2⤵
  PID:8488
- C:\Windows\System\UTjTzye.exe
  C:\Windows\System\UTjTzye.exe
  2⤵
  PID:8572
- C:\Windows\System\UkUIqjg.exe
  C:\Windows\System\UkUIqjg.exe
  2⤵
  PID:8612
- C:\Windows\System\fKOgtCI.exe
  C:\Windows\System\fKOgtCI.exe
  2⤵
  PID:8696
- C:\Windows\System\hEouCwb.exe
  C:\Windows\System\hEouCwb.exe
  2⤵
  PID:3496
- C:\Windows\System\MgOPxyt.exe
  C:\Windows\System\MgOPxyt.exe
  2⤵
  PID:8804
- C:\Windows\System\TWmcMQY.exe
  C:\Windows\System\TWmcMQY.exe
  2⤵
  PID:8868
- C:\Windows\System\qsEUWkF.exe
  C:\Windows\System\qsEUWkF.exe
  2⤵
  PID:8948
- C:\Windows\System\dqVwtHM.exe
  C:\Windows\System\dqVwtHM.exe
  2⤵
  PID:9032
- C:\Windows\System\IjNrlcK.exe
  C:\Windows\System\IjNrlcK.exe
  2⤵
  PID:9076
- C:\Windows\System\qhQlLWn.exe
  C:\Windows\System\qhQlLWn.exe
  2⤵
  PID:9096
- C:\Windows\System\iozSaRJ.exe
  C:\Windows\System\iozSaRJ.exe
  2⤵
  PID:9164
- C:\Windows\System\RPbJKsB.exe
  C:\Windows\System\RPbJKsB.exe
  2⤵
  PID:9200
- C:\Windows\System\zDlAURn.exe
  C:\Windows\System\zDlAURn.exe
  2⤵
  PID:8300
- C:\Windows\System\WVcIfgJ.exe
  C:\Windows\System\WVcIfgJ.exe
  2⤵
  PID:8376
- C:\Windows\System\wPvCVid.exe
  C:\Windows\System\wPvCVid.exe
  2⤵
  PID:8492
- C:\Windows\System\gIiirlM.exe
  C:\Windows\System\gIiirlM.exe
  2⤵
  PID:8600
- C:\Windows\System\WOSQkUI.exe
  C:\Windows\System\WOSQkUI.exe
  2⤵
  PID:8716
- C:\Windows\System\IhcncDO.exe
  C:\Windows\System\IhcncDO.exe
  2⤵
  PID:8860
- C:\Windows\System\qWDcrLj.exe
  C:\Windows\System\qWDcrLj.exe
  2⤵
  PID:8992
- C:\Windows\System\TCatxJG.exe
  C:\Windows\System\TCatxJG.exe
  2⤵
  PID:9008
- C:\Windows\System\mLVNnaO.exe
  C:\Windows\System\mLVNnaO.exe
  2⤵
  PID:2748
- C:\Windows\System\xnjHyOf.exe
  C:\Windows\System\xnjHyOf.exe
  2⤵
  PID:8296
- C:\Windows\System\ObDsAEv.exe
  C:\Windows\System\ObDsAEv.exe
  2⤵
  PID:8320
- C:\Windows\System\TnvUvLj.exe
  C:\Windows\System\TnvUvLj.exe
  2⤵
  PID:8688
- C:\Windows\System\zfMMKZT.exe
  C:\Windows\System\zfMMKZT.exe
  2⤵
  PID:6848
- C:\Windows\System\abXsewC.exe
  C:\Windows\System\abXsewC.exe
  2⤵
  PID:9224
- C:\Windows\System\HExIboQ.exe
  C:\Windows\System\HExIboQ.exe
  2⤵
  PID:9248
- C:\Windows\System\hfwvHMT.exe
  C:\Windows\System\hfwvHMT.exe
  2⤵
  PID:9268
- C:\Windows\System\HVPfQlz.exe
  C:\Windows\System\HVPfQlz.exe
  2⤵
  PID:9296
- C:\Windows\System\FuRZIYQ.exe
  C:\Windows\System\FuRZIYQ.exe
  2⤵
  PID:9324
- C:\Windows\System\ufHiuXy.exe
  C:\Windows\System\ufHiuXy.exe
  2⤵
  PID:9352
- C:\Windows\System\qaLSmBo.exe
  C:\Windows\System\qaLSmBo.exe
  2⤵
  PID:9376
- C:\Windows\System\SXBBbEG.exe
  C:\Windows\System\SXBBbEG.exe
  2⤵
  PID:9396
- C:\Windows\System\NhPBoUx.exe
  C:\Windows\System\NhPBoUx.exe
  2⤵
  PID:9432
- C:\Windows\System\gJDwDxk.exe
  C:\Windows\System\gJDwDxk.exe
  2⤵
  PID:9456
- C:\Windows\System\aFqseYu.exe
  C:\Windows\System\aFqseYu.exe
  2⤵
  PID:9480
- C:\Windows\System\dAZpqcB.exe
  C:\Windows\System\dAZpqcB.exe
  2⤵
  PID:9512
- C:\Windows\System\lLNjldm.exe
  C:\Windows\System\lLNjldm.exe
  2⤵
  PID:9536
- C:\Windows\System\unRpGZM.exe
  C:\Windows\System\unRpGZM.exe
  2⤵
  PID:9556
- C:\Windows\System\BJwaird.exe
  C:\Windows\System\BJwaird.exe
  2⤵
  PID:9580
- C:\Windows\System\OUgVVns.exe
  C:\Windows\System\OUgVVns.exe
  2⤵
  PID:9604
- C:\Windows\System\xVIGxld.exe
  C:\Windows\System\xVIGxld.exe
  2⤵
  PID:9632
- C:\Windows\System\MXRXLQD.exe
  C:\Windows\System\MXRXLQD.exe
  2⤵
  PID:9660
- C:\Windows\System\UNCHoMk.exe
  C:\Windows\System\UNCHoMk.exe
  2⤵
  PID:9688
- C:\Windows\System\kbiucFY.exe
  C:\Windows\System\kbiucFY.exe
  2⤵
  PID:9724
- C:\Windows\System\JcvzdKv.exe
  C:\Windows\System\JcvzdKv.exe
  2⤵
  PID:9752
- C:\Windows\System\vmmmKMi.exe
  C:\Windows\System\vmmmKMi.exe
  2⤵
  PID:9784
- C:\Windows\System\VrbTxaI.exe
  C:\Windows\System\VrbTxaI.exe
  2⤵
  PID:9812
- C:\Windows\System\WEViTbE.exe
  C:\Windows\System\WEViTbE.exe
  2⤵
  PID:9844
- C:\Windows\System\nVaeQSN.exe
  C:\Windows\System\nVaeQSN.exe
  2⤵
  PID:9872
- C:\Windows\System\aimakzj.exe
  C:\Windows\System\aimakzj.exe
  2⤵
  PID:9904
- C:\Windows\System\MEeQaqu.exe
  C:\Windows\System\MEeQaqu.exe
  2⤵
  PID:9932
- C:\Windows\System\ewZYQmF.exe
  C:\Windows\System\ewZYQmF.exe
  2⤵
  PID:9952
- C:\Windows\System\cJOIkTd.exe
  C:\Windows\System\cJOIkTd.exe
  2⤵
  PID:9976
- C:\Windows\System\UbvAlNo.exe
  C:\Windows\System\UbvAlNo.exe
  2⤵
  PID:10004
- C:\Windows\System\ElDkpXH.exe
  C:\Windows\System\ElDkpXH.exe
  2⤵
  PID:10036
- C:\Windows\System\msoOrWY.exe
  C:\Windows\System\msoOrWY.exe
  2⤵
  PID:10064
- C:\Windows\System\NrKRxSN.exe
  C:\Windows\System\NrKRxSN.exe
  2⤵
  PID:10084
- C:\Windows\System\NZTrmYU.exe
  C:\Windows\System\NZTrmYU.exe
  2⤵
  PID:10116
- C:\Windows\System\skErxRV.exe
  C:\Windows\System\skErxRV.exe
  2⤵
  PID:10152
- C:\Windows\System\FLjBIys.exe
  C:\Windows\System\FLjBIys.exe
  2⤵
  PID:10184
- C:\Windows\System\Wmiqsrh.exe
  C:\Windows\System\Wmiqsrh.exe
  2⤵
  PID:10220
- C:\Windows\System\rVOkxXl.exe
  C:\Windows\System\rVOkxXl.exe
  2⤵
  PID:8768
- C:\Windows\System\lYJayTU.exe
  C:\Windows\System\lYJayTU.exe
  2⤵
  PID:8604
- C:\Windows\System\zqpRyUk.exe
  C:\Windows\System\zqpRyUk.exe
  2⤵
  PID:9284
- C:\Windows\System\RirmxIg.exe
  C:\Windows\System\RirmxIg.exe
  2⤵
  PID:9372
- C:\Windows\System\QLdtnGZ.exe
  C:\Windows\System\QLdtnGZ.exe
  2⤵
  PID:9312
- C:\Windows\System\tmeQSvb.exe
  C:\Windows\System\tmeQSvb.exe
  2⤵
  PID:9476
- C:\Windows\System\vztEuoD.exe
  C:\Windows\System\vztEuoD.exe
  2⤵
  PID:9544
- C:\Windows\System\FNfWkBS.exe
  C:\Windows\System\FNfWkBS.exe
  2⤵
  PID:9596
- C:\Windows\System\OtwpZHj.exe
  C:\Windows\System\OtwpZHj.exe
  2⤵
  PID:9600
- C:\Windows\System\AQWkWfR.exe
  C:\Windows\System\AQWkWfR.exe
  2⤵
  PID:9840
- C:\Windows\System\aPTCvmP.exe
  C:\Windows\System\aPTCvmP.exe
  2⤵
  PID:9928
- C:\Windows\System\ZVpeMBL.exe
  C:\Windows\System\ZVpeMBL.exe
  2⤵
  PID:9868
- C:\Windows\System\cupiUVo.exe
  C:\Windows\System\cupiUVo.exe
  2⤵
  PID:9896
- C:\Windows\System\fZwZaNq.exe
  C:\Windows\System\fZwZaNq.exe
  2⤵
  PID:10164
- C:\Windows\System\RNzwEXW.exe
  C:\Windows\System\RNzwEXW.exe
  2⤵
  PID:10232
- C:\Windows\System\gXyMXHf.exe
  C:\Windows\System\gXyMXHf.exe
  2⤵
  PID:10080
- C:\Windows\System\CDBHXrA.exe
  C:\Windows\System\CDBHXrA.exe
  2⤵
  PID:10112
- C:\Windows\System\vgMfcqs.exe
  C:\Windows\System\vgMfcqs.exe
  2⤵
  PID:10132
- C:\Windows\System\PfRvXWA.exe
  C:\Windows\System\PfRvXWA.exe
  2⤵
  PID:10172
- C:\Windows\System\GXszhOc.exe
  C:\Windows\System\GXszhOc.exe
  2⤵
  PID:8252
- C:\Windows\System\mjkyYhD.exe
  C:\Windows\System\mjkyYhD.exe
  2⤵
  PID:9240
- C:\Windows\System\BpOTZEx.exe
  C:\Windows\System\BpOTZEx.exe
  2⤵
  PID:9620
- C:\Windows\System\FwsDdts.exe
  C:\Windows\System\FwsDdts.exe
  2⤵
  PID:9552
- C:\Windows\System\GyDTKWR.exe
  C:\Windows\System\GyDTKWR.exe
  2⤵
  PID:10020
- C:\Windows\System\iWDyoAa.exe
  C:\Windows\System\iWDyoAa.exe
  2⤵
  PID:9992
- C:\Windows\System\HlAoBLl.exe
  C:\Windows\System\HlAoBLl.exe
  2⤵
  PID:10252
- C:\Windows\System\JVGGhzt.exe
  C:\Windows\System\JVGGhzt.exe
  2⤵
  PID:10276
- C:\Windows\System\RuveQsi.exe
  C:\Windows\System\RuveQsi.exe
  2⤵
  PID:10324
- C:\Windows\System\BaqGWje.exe
  C:\Windows\System\BaqGWje.exe
  2⤵
  PID:10352
- C:\Windows\System\kIQVcpA.exe
  C:\Windows\System\kIQVcpA.exe
  2⤵
  PID:10376
- C:\Windows\System\tKzjzyg.exe
  C:\Windows\System\tKzjzyg.exe
  2⤵
  PID:10400
- C:\Windows\System\qYdbPGh.exe
  C:\Windows\System\qYdbPGh.exe
  2⤵
  PID:10428
- C:\Windows\System\jTKRTHm.exe
  C:\Windows\System\jTKRTHm.exe
  2⤵
  PID:10456
- C:\Windows\System\WdGctXq.exe
  C:\Windows\System\WdGctXq.exe
  2⤵
  PID:10488
- C:\Windows\System\XkDvpZx.exe
  C:\Windows\System\XkDvpZx.exe
  2⤵
  PID:10512
- C:\Windows\System\fUVhloS.exe
  C:\Windows\System\fUVhloS.exe
  2⤵
  PID:10540
- C:\Windows\System\FfsSxvs.exe
  C:\Windows\System\FfsSxvs.exe
  2⤵
  PID:10568
- C:\Windows\System\GHkcoJK.exe
  C:\Windows\System\GHkcoJK.exe
  2⤵
  PID:10596
- C:\Windows\System\ftWiLCB.exe
  C:\Windows\System\ftWiLCB.exe
  2⤵
  PID:10624
- C:\Windows\System\BldhjyO.exe
  C:\Windows\System\BldhjyO.exe
  2⤵
  PID:10660
- C:\Windows\System\FESaFIZ.exe
  C:\Windows\System\FESaFIZ.exe
  2⤵
  PID:10680
- C:\Windows\System\oDswIRd.exe
  C:\Windows\System\oDswIRd.exe
  2⤵
  PID:10708
- C:\Windows\System\vdMcUXj.exe
  C:\Windows\System\vdMcUXj.exe
  2⤵
  PID:10732
- C:\Windows\System\StmsmAv.exe
  C:\Windows\System\StmsmAv.exe
  2⤵
  PID:10764
- C:\Windows\System\kYrSBAb.exe
  C:\Windows\System\kYrSBAb.exe
  2⤵
  PID:10788
- C:\Windows\System\mAFUIVk.exe
  C:\Windows\System\mAFUIVk.exe
  2⤵
  PID:10820
- C:\Windows\System\DDvfJhb.exe
  C:\Windows\System\DDvfJhb.exe
  2⤵
  PID:10848
- C:\Windows\System\rbgMFfg.exe
  C:\Windows\System\rbgMFfg.exe
  2⤵
  PID:10872
- C:\Windows\System\ecoROnC.exe
  C:\Windows\System\ecoROnC.exe
  2⤵
  PID:10900
- C:\Windows\System\CCBwEvp.exe
  C:\Windows\System\CCBwEvp.exe
  2⤵
  PID:10928
- C:\Windows\System\tIRksJl.exe
  C:\Windows\System\tIRksJl.exe
  2⤵
  PID:10956
- C:\Windows\System\ZcNszgb.exe
  C:\Windows\System\ZcNszgb.exe
  2⤵
  PID:10980
- C:\Windows\System\WTtxhXO.exe
  C:\Windows\System\WTtxhXO.exe
  2⤵
  PID:11004
- C:\Windows\System\IgSYIkZ.exe
  C:\Windows\System\IgSYIkZ.exe
  2⤵
  PID:11044
- C:\Windows\System\ARqTllC.exe
  C:\Windows\System\ARqTllC.exe
  2⤵
  PID:11064
- C:\Windows\System\LbaMzKU.exe
  C:\Windows\System\LbaMzKU.exe
  2⤵
  PID:11096
- C:\Windows\System\vyHmxpR.exe
  C:\Windows\System\vyHmxpR.exe
  2⤵
  PID:11124
- C:\Windows\System\UEfwYgc.exe
  C:\Windows\System\UEfwYgc.exe
  2⤵
  PID:11152
- C:\Windows\System\sKEtcCh.exe
  C:\Windows\System\sKEtcCh.exe
  2⤵
  PID:11176
- C:\Windows\System\LKwfvCn.exe
  C:\Windows\System\LKwfvCn.exe
  2⤵
  PID:11212
- C:\Windows\System\BZMNAKs.exe
  C:\Windows\System\BZMNAKs.exe
  2⤵
  PID:11236
- C:\Windows\System\qtWwBDp.exe
  C:\Windows\System\qtWwBDp.exe
  2⤵
  PID:11260
- C:\Windows\System\nySHyGO.exe
  C:\Windows\System\nySHyGO.exe
  2⤵
  PID:9824
- C:\Windows\System\jMplwKd.exe
  C:\Windows\System\jMplwKd.exe
  2⤵
  PID:10196
- C:\Windows\System\QOwpfBC.exe
  C:\Windows\System\QOwpfBC.exe
  2⤵
  PID:10272
- C:\Windows\System\jxVHwJz.exe
  C:\Windows\System\jxVHwJz.exe
  2⤵
  PID:10392
- C:\Windows\System\OGfGIMx.exe
  C:\Windows\System\OGfGIMx.exe
  2⤵
  PID:9264
- C:\Windows\System\jjdcwvC.exe
  C:\Windows\System\jjdcwvC.exe
  2⤵
  PID:10248
- C:\Windows\System\ZKgLmVp.exe
  C:\Windows\System\ZKgLmVp.exe
  2⤵
  PID:10416
- C:\Windows\System\uefOxrP.exe
  C:\Windows\System\uefOxrP.exe
  2⤵
  PID:10508
- C:\Windows\System\goXGqzx.exe
  C:\Windows\System\goXGqzx.exe
  2⤵
  PID:10472
- C:\Windows\System\elwaFmq.exe
  C:\Windows\System\elwaFmq.exe
  2⤵
  PID:10500
- C:\Windows\System\nlGTQOO.exe
  C:\Windows\System\nlGTQOO.exe
  2⤵
  PID:10524
- C:\Windows\System\jywmJet.exe
  C:\Windows\System\jywmJet.exe
  2⤵
  PID:10808
- C:\Windows\System\nEOjnsO.exe
  C:\Windows\System\nEOjnsO.exe
  2⤵
  PID:10700
- C:\Windows\System\thcomJI.exe
  C:\Windows\System\thcomJI.exe
  2⤵
  PID:10952
- C:\Windows\System\qJHglNt.exe
  C:\Windows\System\qJHglNt.exe
  2⤵
  PID:11000
- C:\Windows\System\sfYqtec.exe
  C:\Windows\System\sfYqtec.exe
  2⤵
  PID:11140
- C:\Windows\System\xMzQXdl.exe
  C:\Windows\System\xMzQXdl.exe
  2⤵
  PID:10052
- C:\Windows\System\pudnwiY.exe
  C:\Windows\System\pudnwiY.exe
  2⤵
  PID:11092
- C:\Windows\System\HDiZVNk.exe
  C:\Windows\System\HDiZVNk.exe
  2⤵
  PID:11252
- C:\Windows\System\hFOnyLz.exe
  C:\Windows\System\hFOnyLz.exe
  2⤵
  PID:9344
- C:\Windows\System\IGtMuLn.exe
  C:\Windows\System\IGtMuLn.exe
  2⤵
  PID:11228
- C:\Windows\System\hQaTGTH.exe
  C:\Windows\System\hQaTGTH.exe
  2⤵
  PID:9920
- C:\Windows\System\yQyuvLZ.exe
  C:\Windows\System\yQyuvLZ.exe
  2⤵
  PID:10264
- C:\Windows\System\SDetgZV.exe
  C:\Windows\System\SDetgZV.exe
  2⤵
  PID:10576
- C:\Windows\System\jwSmilL.exe
  C:\Windows\System\jwSmilL.exe
  2⤵
  PID:10868
- C:\Windows\System\ninCYxV.exe
  C:\Windows\System\ninCYxV.exe
  2⤵
  PID:10784
- C:\Windows\System\ghBowht.exe
  C:\Windows\System\ghBowht.exe
  2⤵
  PID:2856
- C:\Windows\System\HlaFNqJ.exe
  C:\Windows\System\HlaFNqJ.exe
  2⤵
  PID:11116
- C:\Windows\System\PLJeuMs.exe
  C:\Windows\System\PLJeuMs.exe
  2⤵
  PID:10744
- C:\Windows\System\loCUOZc.exe
  C:\Windows\System\loCUOZc.exe
  2⤵
  PID:11280
- C:\Windows\System\zNPLnlK.exe
  C:\Windows\System\zNPLnlK.exe
  2⤵
  PID:11300
- C:\Windows\System\pxoisoO.exe
  C:\Windows\System\pxoisoO.exe
  2⤵
  PID:11320
- C:\Windows\System\MuGnvZy.exe
  C:\Windows\System\MuGnvZy.exe
  2⤵
  PID:11348
- C:\Windows\System\SDukoiE.exe
  C:\Windows\System\SDukoiE.exe
  2⤵
  PID:11376
- C:\Windows\System\ZiEMvbv.exe
  C:\Windows\System\ZiEMvbv.exe
  2⤵
  PID:11404
- C:\Windows\System\jwFgWBj.exe
  C:\Windows\System\jwFgWBj.exe
  2⤵
  PID:11432
- C:\Windows\System\QjemNtM.exe
  C:\Windows\System\QjemNtM.exe
  2⤵
  PID:11460
- C:\Windows\System\uDClWBE.exe
  C:\Windows\System\uDClWBE.exe
  2⤵
  PID:11488
- C:\Windows\System\aSudNkD.exe
  C:\Windows\System\aSudNkD.exe
  2⤵
  PID:11512
- C:\Windows\System\YBcoKQP.exe
  C:\Windows\System\YBcoKQP.exe
  2⤵
  PID:11540
- C:\Windows\System\jiZEgtC.exe
  C:\Windows\System\jiZEgtC.exe
  2⤵
  PID:11568
- C:\Windows\System\AznMPuk.exe
  C:\Windows\System\AznMPuk.exe
  2⤵
  PID:11596
- C:\Windows\System\RIJnQVH.exe
  C:\Windows\System\RIJnQVH.exe
  2⤵
  PID:11624
- C:\Windows\System\DGYzHSc.exe
  C:\Windows\System\DGYzHSc.exe
  2⤵
  PID:11664
- C:\Windows\System\YKZmQlG.exe
  C:\Windows\System\YKZmQlG.exe
  2⤵
  PID:11692
- C:\Windows\System\lwDFzNz.exe
  C:\Windows\System\lwDFzNz.exe
  2⤵
  PID:11716
- C:\Windows\System\AtxYIHJ.exe
  C:\Windows\System\AtxYIHJ.exe
  2⤵
  PID:11740
- C:\Windows\System\hdeYrnM.exe
  C:\Windows\System\hdeYrnM.exe
  2⤵
  PID:11776
- C:\Windows\System\LzrVCbK.exe
  C:\Windows\System\LzrVCbK.exe
  2⤵
  PID:11796
- C:\Windows\System\QPdwsIY.exe
  C:\Windows\System\QPdwsIY.exe
  2⤵
  PID:11828
- C:\Windows\System\AoUtCQO.exe
  C:\Windows\System\AoUtCQO.exe
  2⤵
  PID:11856
- C:\Windows\System\ONESZXx.exe
  C:\Windows\System\ONESZXx.exe
  2⤵
  PID:11872
- C:\Windows\System\gNBQCGZ.exe
  C:\Windows\System\gNBQCGZ.exe
  2⤵
  PID:11900
- C:\Windows\System\OXfjOAC.exe
  C:\Windows\System\OXfjOAC.exe
  2⤵
  PID:11932
- C:\Windows\System\xutKUNA.exe
  C:\Windows\System\xutKUNA.exe
  2⤵
  PID:11964
- C:\Windows\System\VUhIuHV.exe
  C:\Windows\System\VUhIuHV.exe
  2⤵
  PID:11992
- C:\Windows\System\tpdKHFf.exe
  C:\Windows\System\tpdKHFf.exe
  2⤵
  PID:12016
- C:\Windows\System\GafdrBt.exe
  C:\Windows\System\GafdrBt.exe
  2⤵
  PID:12040
- C:\Windows\System\DkPEZDC.exe
  C:\Windows\System\DkPEZDC.exe
  2⤵
  PID:12068
- C:\Windows\System\YpXjVdk.exe
  C:\Windows\System\YpXjVdk.exe
  2⤵
  PID:12096
- C:\Windows\System\Ghlqacw.exe
  C:\Windows\System\Ghlqacw.exe
  2⤵
  PID:12124
- C:\Windows\System\mYwGdsn.exe
  C:\Windows\System\mYwGdsn.exe
  2⤵
  PID:12152
- C:\Windows\System\JrykQIK.exe
  C:\Windows\System\JrykQIK.exe
  2⤵
  PID:12176
- C:\Windows\System\hZSWFWN.exe
  C:\Windows\System\hZSWFWN.exe
  2⤵
  PID:12212
- C:\Windows\System\TXQNTXE.exe
  C:\Windows\System\TXQNTXE.exe
  2⤵
  PID:12232
- C:\Windows\System\fsVSeMw.exe
  C:\Windows\System\fsVSeMw.exe
  2⤵
  PID:12260
- C:\Windows\System\TuhTVkL.exe
  C:\Windows\System\TuhTVkL.exe
  2⤵
  PID:10372
- C:\Windows\System\xmxnPbR.exe
  C:\Windows\System\xmxnPbR.exe
  2⤵
  PID:10344
- C:\Windows\System\djHQLUR.exe
  C:\Windows\System\djHQLUR.exe
  2⤵
  PID:10332
- C:\Windows\System\bEZirPk.exe
  C:\Windows\System\bEZirPk.exe
  2⤵
  PID:9500
- C:\Windows\System\tNsASww.exe
  C:\Windows\System\tNsASww.exe
  2⤵
  PID:3256
- C:\Windows\System\tRyAlpk.exe
  C:\Windows\System\tRyAlpk.exe
  2⤵
  PID:11468
- C:\Windows\System\bpAFrqE.exe
  C:\Windows\System\bpAFrqE.exe
  2⤵
  PID:11472
- C:\Windows\System\ybmNztG.exe
  C:\Windows\System\ybmNztG.exe
  2⤵
  PID:11400
- C:\Windows\System\aMvsXbm.exe
  C:\Windows\System\aMvsXbm.exe
  2⤵
  PID:11672
- C:\Windows\System\GaruKAn.exe
  C:\Windows\System\GaruKAn.exe
  2⤵
  PID:11728
- C:\Windows\System\nfRyMcf.exe
  C:\Windows\System\nfRyMcf.exe
  2⤵
  PID:11644
- C:\Windows\System\ebuRCzq.exe
  C:\Windows\System\ebuRCzq.exe
  2⤵
  PID:11884
- C:\Windows\System\gBSYvjE.exe
  C:\Windows\System\gBSYvjE.exe
  2⤵
  PID:11580
- C:\Windows\System\SkarEwe.exe
  C:\Windows\System\SkarEwe.exe
  2⤵
  PID:12024
- C:\Windows\System\OtqcaVk.exe
  C:\Windows\System\OtqcaVk.exe
  2⤵
  PID:11896
- C:\Windows\System\OTlkzgM.exe
  C:\Windows\System\OTlkzgM.exe
  2⤵
  PID:11756
- C:\Windows\System\RFSSfUx.exe
  C:\Windows\System\RFSSfUx.exe
  2⤵
  PID:12004
- C:\Windows\System\TDudGPE.exe
  C:\Windows\System\TDudGPE.exe
  2⤵
  PID:11892
- C:\Windows\System\kpRncMQ.exe
  C:\Windows\System\kpRncMQ.exe
  2⤵
  PID:12084
- C:\Windows\System\GJbvfCi.exe
  C:\Windows\System\GJbvfCi.exe
  2⤵
  PID:12120
- C:\Windows\System\BPMxzvm.exe
  C:\Windows\System\BPMxzvm.exe
  2⤵
  PID:10368
- C:\Windows\System\MgPPUfJ.exe
  C:\Windows\System\MgPPUfJ.exe
  2⤵
  PID:12276
- C:\Windows\System\ObXWLaa.exe
  C:\Windows\System\ObXWLaa.exe
  2⤵
  PID:11136
- C:\Windows\System\QEsPPjs.exe
  C:\Windows\System\QEsPPjs.exe
  2⤵
  PID:12240
- C:\Windows\System\YDleAfN.exe
  C:\Windows\System\YDleAfN.exe
  2⤵
  PID:12292
- C:\Windows\System\HWpBPwo.exe
  C:\Windows\System\HWpBPwo.exe
  2⤵
  PID:12316
- C:\Windows\System\tnAptwX.exe
  C:\Windows\System\tnAptwX.exe
  2⤵
  PID:12340
- C:\Windows\System\DpcHQkq.exe
  C:\Windows\System\DpcHQkq.exe
  2⤵
  PID:12360
- C:\Windows\System\wBxiOOe.exe
  C:\Windows\System\wBxiOOe.exe
  2⤵
  PID:12388
- C:\Windows\System\fVCcgXZ.exe
  C:\Windows\System\fVCcgXZ.exe
  2⤵
  PID:12404
- C:\Windows\System\gZcCpdF.exe
  C:\Windows\System\gZcCpdF.exe
  2⤵
  PID:12428
- C:\Windows\System\OvkyXWq.exe
  C:\Windows\System\OvkyXWq.exe
  2⤵
  PID:12456
- C:\Windows\System\oUAImVl.exe
  C:\Windows\System\oUAImVl.exe
  2⤵
  PID:12484
- C:\Windows\System\KkqvEOm.exe
  C:\Windows\System\KkqvEOm.exe
  2⤵
  PID:12516
- C:\Windows\System\ciewjwt.exe
  C:\Windows\System\ciewjwt.exe
  2⤵
  PID:12536
- C:\Windows\System\CBKyPky.exe
  C:\Windows\System\CBKyPky.exe
  2⤵
  PID:12572
- C:\Windows\System\qKAnStd.exe
  C:\Windows\System\qKAnStd.exe
  2⤵
  PID:12600
- C:\Windows\System\QiOUbEU.exe
  C:\Windows\System\QiOUbEU.exe
  2⤵
  PID:12616
- C:\Windows\System\UHMXAao.exe
  C:\Windows\System\UHMXAao.exe
  2⤵
  PID:12636
- C:\Windows\System\GbhtREI.exe
  C:\Windows\System\GbhtREI.exe
  2⤵
  PID:12660
- C:\Windows\System\naUJqip.exe
  C:\Windows\System\naUJqip.exe
  2⤵
  PID:12688
- C:\Windows\System\xmZoYOW.exe
  C:\Windows\System\xmZoYOW.exe
  2⤵
  PID:12716
- C:\Windows\System\hdymyvn.exe
  C:\Windows\System\hdymyvn.exe
  2⤵
  PID:12748
- C:\Windows\System\piuLgHL.exe
  C:\Windows\System\piuLgHL.exe
  2⤵
  PID:12768
- C:\Windows\System\nXsXZRG.exe
  C:\Windows\System\nXsXZRG.exe
  2⤵
  PID:12792
- C:\Windows\System\eKdFiuI.exe
  C:\Windows\System\eKdFiuI.exe
  2⤵
  PID:12832
- C:\Windows\System\VWpzzly.exe
  C:\Windows\System\VWpzzly.exe
  2⤵
  PID:12852
- C:\Windows\System\JoveArn.exe
  C:\Windows\System\JoveArn.exe
  2⤵
  PID:12872
- C:\Windows\System\jcjZVSz.exe
  C:\Windows\System\jcjZVSz.exe
  2⤵
  PID:12896
- C:\Windows\System\VewfADs.exe
  C:\Windows\System\VewfADs.exe
  2⤵
  PID:12924
- C:\Windows\System\yPmqyCc.exe
  C:\Windows\System\yPmqyCc.exe
  2⤵
  PID:12952
- C:\Windows\System\HVfRUZN.exe
  C:\Windows\System\HVfRUZN.exe
  2⤵
  PID:12984
- C:\Windows\System\QlNBpHZ.exe
  C:\Windows\System\QlNBpHZ.exe
  2⤵
  PID:13012
- C:\Windows\System\AjSwzkd.exe
  C:\Windows\System\AjSwzkd.exe
  2⤵
  PID:13028
- C:\Windows\System\OYjpUnl.exe
  C:\Windows\System\OYjpUnl.exe
  2⤵
  PID:13064
- C:\Windows\System\BSgdlfy.exe
  C:\Windows\System\BSgdlfy.exe
  2⤵
  PID:13088
- C:\Windows\System\qqxPkNN.exe
  C:\Windows\System\qqxPkNN.exe
  2⤵
  PID:13112
- C:\Windows\System\PiUwwFO.exe
  C:\Windows\System\PiUwwFO.exe
  2⤵
  PID:13132
- C:\Windows\System\oVvihWF.exe
  C:\Windows\System\oVvihWF.exe
  2⤵
  PID:13160
- C:\Windows\System\bVrMnLf.exe
  C:\Windows\System\bVrMnLf.exe
  2⤵
  PID:13188
- C:\Windows\System\oNwCZQW.exe
  C:\Windows\System\oNwCZQW.exe
  2⤵
  PID:13220
- C:\Windows\System\LJBApXu.exe
  C:\Windows\System\LJBApXu.exe
  2⤵
  PID:13236
- C:\Windows\System\UodLzWv.exe
  C:\Windows\System\UodLzWv.exe
  2⤵
  PID:13260
- C:\Windows\System\GUhmyFG.exe
  C:\Windows\System\GUhmyFG.exe
  2⤵
  PID:13288
- C:\Windows\System\jOlgbMh.exe
  C:\Windows\System\jOlgbMh.exe
  2⤵
  PID:11564
- C:\Windows\System\ildgsfd.exe
  C:\Windows\System\ildgsfd.exe
  2⤵
  PID:12000
- C:\Windows\System\vFnRPLj.exe
  C:\Windows\System\vFnRPLj.exe
  2⤵
  PID:11940
- C:\Windows\System\YHsxpcm.exe
  C:\Windows\System\YHsxpcm.exe
  2⤵
  PID:12284
- C:\Windows\System\NidTIWx.exe
  C:\Windows\System\NidTIWx.exe
  2⤵
  PID:11364
- C:\Windows\System\pYgOQjK.exe
  C:\Windows\System\pYgOQjK.exe
  2⤵
  PID:12268
- C:\Windows\System\LEovfPo.exe
  C:\Windows\System\LEovfPo.exe
  2⤵
  PID:12332
- C:\Windows\System\nhEZgUk.exe
  C:\Windows\System\nhEZgUk.exe
  2⤵
  PID:12436
- C:\Windows\System\XibFpFT.exe
  C:\Windows\System\XibFpFT.exe
  2⤵
  PID:12512
- C:\Windows\System\YHeBYSE.exe
  C:\Windows\System\YHeBYSE.exe
  2⤵
  PID:12588
- C:\Windows\System\omFfXDo.exe
  C:\Windows\System\omFfXDo.exe
  2⤵
  PID:12440
- C:\Windows\System\CRfrXRV.exe
  C:\Windows\System\CRfrXRV.exe
  2⤵
  PID:12172
- C:\Windows\System\lWxzLgP.exe
  C:\Windows\System\lWxzLgP.exe
  2⤵
  PID:12376
- C:\Windows\System\OlbwDQV.exe
  C:\Windows\System\OlbwDQV.exe
  2⤵
  PID:12416
- C:\Windows\System\JdQUFGw.exe
  C:\Windows\System\JdQUFGw.exe
  2⤵
  PID:12976
- C:\Windows\System\jtRHQFm.exe
  C:\Windows\System\jtRHQFm.exe
  2⤵
  PID:12760
- C:\Windows\System\tSsUwdi.exe
  C:\Windows\System\tSsUwdi.exe
  2⤵
  PID:12532
- C:\Windows\System\ACOxTiI.exe
  C:\Windows\System\ACOxTiI.exe
  2⤵
  PID:12916
- C:\Windows\System\saacDPo.exe
  C:\Windows\System\saacDPo.exe
  2⤵
  PID:13180
- C:\Windows\System\hcTELxB.exe
  C:\Windows\System\hcTELxB.exe
  2⤵
  PID:13208
- C:\Windows\System\EfqtIPe.exe
  C:\Windows\System\EfqtIPe.exe
  2⤵
  PID:13272
- C:\Windows\System\oQIenGK.exe
  C:\Windows\System\oQIenGK.exe
  2⤵
  PID:12816
- C:\Windows\System\eKORAQq.exe
  C:\Windows\System\eKORAQq.exe
  2⤵
  PID:12864
- C:\Windows\System\QzGODcC.exe
  C:\Windows\System\QzGODcC.exe
  2⤵
  PID:11944
- C:\Windows\System\toFJbuB.exe
  C:\Windows\System\toFJbuB.exe
  2⤵
  PID:12372
- C:\Windows\System\SUcfnem.exe
  C:\Windows\System\SUcfnem.exe
  2⤵
  PID:13104
- C:\Windows\System\CMoiOHc.exe
  C:\Windows\System\CMoiOHc.exe
  2⤵
  PID:13328
- C:\Windows\System\bmsCxPw.exe
  C:\Windows\System\bmsCxPw.exe
  2⤵
  PID:13356
- C:\Windows\System\xzjSCyP.exe
  C:\Windows\System\xzjSCyP.exe
  2⤵
  PID:13380
- C:\Windows\System\IIamkwI.exe
  C:\Windows\System\IIamkwI.exe
  2⤵
  PID:13412
- C:\Windows\System\ynkCAiQ.exe
  C:\Windows\System\ynkCAiQ.exe
  2⤵
  PID:13452
- C:\Windows\System\VYeaPVv.exe
  C:\Windows\System\VYeaPVv.exe
  2⤵
  PID:13492
- C:\Windows\System\NZLgWjc.exe
  C:\Windows\System\NZLgWjc.exe
  2⤵
  PID:13508
- C:\Windows\System\aibzAGw.exe
  C:\Windows\System\aibzAGw.exe
  2⤵
  PID:13532
- C:\Windows\System\kDWbnfo.exe
  C:\Windows\System\kDWbnfo.exe
  2⤵
  PID:13552
- C:\Windows\System\USYabjp.exe
  C:\Windows\System\USYabjp.exe
  2⤵
  PID:13568
- C:\Windows\System\CrnvFkW.exe
  C:\Windows\System\CrnvFkW.exe
  2⤵
  PID:13584
- C:\Windows\System\tmHMQWS.exe
  C:\Windows\System\tmHMQWS.exe
  2⤵
  PID:13600
- C:\Windows\System\oKERzHy.exe
  C:\Windows\System\oKERzHy.exe
  2⤵
  PID:13712
- C:\Windows\System\IIAQUPg.exe
  C:\Windows\System\IIAQUPg.exe
  2⤵
  PID:13744
- C:\Windows\System\esRiUxP.exe
  C:\Windows\System\esRiUxP.exe
  2⤵
  PID:13776
- C:\Windows\System\rkWcHJG.exe
  C:\Windows\System\rkWcHJG.exe
  2⤵
  PID:13820
- C:\Windows\System\lOAReIC.exe
  C:\Windows\System\lOAReIC.exe
  2⤵
  PID:13848
- C:\Windows\System\EPAFcqv.exe
  C:\Windows\System\EPAFcqv.exe
  2⤵
  PID:13876
- C:\Windows\System\enogQiG.exe
  C:\Windows\System\enogQiG.exe
  2⤵
  PID:13904
- C:\Windows\System\VxfuIul.exe
  C:\Windows\System\VxfuIul.exe
  2⤵
  PID:13920
- C:\Windows\System\dHOBAML.exe
  C:\Windows\System\dHOBAML.exe
  2⤵
  PID:13944
- C:\Windows\System\NWCeNeA.exe
  C:\Windows\System\NWCeNeA.exe
  2⤵
  PID:13976
- C:\Windows\System\jXRcFBd.exe
  C:\Windows\System\jXRcFBd.exe
  2⤵
  PID:14012
- C:\Windows\System\kQQWEuN.exe
  C:\Windows\System\kQQWEuN.exe
  2⤵
  PID:14040
- C:\Windows\System\ImDeMhV.exe
  C:\Windows\System\ImDeMhV.exe
  2⤵
  PID:14064
- C:\Windows\System\neOgGmN.exe
  C:\Windows\System\neOgGmN.exe
  2⤵
  PID:14096
- C:\Windows\System\PtPnYds.exe
  C:\Windows\System\PtPnYds.exe
  2⤵
  PID:14128
- C:\Windows\System\oxGYHJW.exe
  C:\Windows\System\oxGYHJW.exe
  2⤵
  PID:14168
- C:\Windows\System\qGroMqX.exe
  C:\Windows\System\qGroMqX.exe
  2⤵
  PID:14196
- C:\Windows\System\fvuzVAR.exe
  C:\Windows\System\fvuzVAR.exe
  2⤵
  PID:14224
- C:\Windows\System\eKhxrpL.exe
  C:\Windows\System\eKhxrpL.exe
  2⤵
  PID:14252
- C:\Windows\System\yptjwkb.exe
  C:\Windows\System\yptjwkb.exe
  2⤵
  PID:14280
- C:\Windows\System\JfJcWLe.exe
  C:\Windows\System\JfJcWLe.exe
  2⤵
  PID:14296
- C:\Windows\System\yJoPMEA.exe
  C:\Windows\System\yJoPMEA.exe
  2⤵
  PID:14324
- C:\Windows\System\bhvWIgF.exe
  C:\Windows\System\bhvWIgF.exe
  2⤵
  PID:13184
- C:\Windows\System\KjTmtwT.exe
  C:\Windows\System\KjTmtwT.exe
  2⤵
  PID:11620
- C:\Windows\System\rvJFINP.exe
  C:\Windows\System\rvJFINP.exe
  2⤵
  PID:12228
- C:\Windows\System\KitbLuC.exe
  C:\Windows\System\KitbLuC.exe
  2⤵
  PID:12932
- C:\Windows\System\pFvuweQ.exe
  C:\Windows\System\pFvuweQ.exe
  2⤵
  PID:11700
- C:\Windows\System\gxXkfCk.exe
  C:\Windows\System\gxXkfCk.exe
  2⤵
  PID:12624
- C:\Windows\System\JAzrRZA.exe
  C:\Windows\System\JAzrRZA.exe
  2⤵
  PID:13320
- C:\Windows\System\TuazbCF.exe
  C:\Windows\System\TuazbCF.exe
  2⤵
  PID:13008
- C:\Windows\System\AUCHQDR.exe
  C:\Windows\System\AUCHQDR.exe
  2⤵
  PID:13376
- C:\Windows\System\LmcVyTI.exe
  C:\Windows\System\LmcVyTI.exe
  2⤵
  PID:12656
- C:\Windows\System\dvWdCtN.exe
  C:\Windows\System\dvWdCtN.exe
  2⤵
  PID:12848
- C:\Windows\System\zJncGNc.exe
  C:\Windows\System\zJncGNc.exe
  2⤵
  PID:13072
- C:\Windows\System\lkFfjEo.exe
  C:\Windows\System\lkFfjEo.exe
  2⤵
  PID:13400
- C:\Windows\System\GJxWfPg.exe
  C:\Windows\System\GJxWfPg.exe
  2⤵
  PID:13616
- C:\Windows\System\ojpfMCj.exe
  C:\Windows\System\ojpfMCj.exe
  2⤵
  PID:13436
- C:\Windows\System\HhutTBw.exe
  C:\Windows\System\HhutTBw.exe
  2⤵
  PID:13840
- C:\Windows\System\uYJTAZr.exe
  C:\Windows\System\uYJTAZr.exe
  2⤵
  PID:13912
- C:\Windows\System\vgWNNAl.exe
  C:\Windows\System\vgWNNAl.exe
  2⤵
  PID:13988
- C:\Windows\System\xJEcLAR.exe
  C:\Windows\System\xJEcLAR.exe
  2⤵
  PID:13580
- C:\Windows\System\TkegnmL.exe
  C:\Windows\System\TkegnmL.exe
  2⤵
  PID:13696
- C:\Windows\System\iTpeBCU.exe
  C:\Windows\System\iTpeBCU.exe
  2⤵
  PID:14320
- C:\Windows\System\FHKXWJL.exe
  C:\Windows\System\FHKXWJL.exe
  2⤵
  PID:14028
- C:\Windows\System\QPgTXSD.exe
  C:\Windows\System\QPgTXSD.exe
  2⤵
  PID:14060
- C:\Windows\System\hKFUaxS.exe
  C:\Windows\System\hKFUaxS.exe
  2⤵
  PID:12468
- C:\Windows\System\WkervBl.exe
  C:\Windows\System\WkervBl.exe
  2⤵
  PID:13856
- C:\Windows\System\Vcnktaz.exe
  C:\Windows\System\Vcnktaz.exe
  2⤵
  PID:13916
- C:\Windows\System\ZzDosbz.exe
  C:\Windows\System\ZzDosbz.exe
  2⤵
  PID:12324
- C:\Windows\System\IeUHONu.exe
  C:\Windows\System\IeUHONu.exe
  2⤵
  PID:13724
- C:\Windows\System\EkjUxjn.exe
  C:\Windows\System\EkjUxjn.exe
  2⤵
  PID:13424
- C:\Windows\System\VkYkIem.exe
  C:\Windows\System\VkYkIem.exe
  2⤵
  PID:12396
- C:\Windows\System\DWxMUBL.exe
  C:\Windows\System\DWxMUBL.exe
  2⤵
  PID:13956
- C:\Windows\System\MlvZyAz.exe
  C:\Windows\System\MlvZyAz.exe
  2⤵
  PID:14276
- C:\Windows\System\mJHxoCk.exe
  C:\Windows\System\mJHxoCk.exe
  2⤵
  PID:14360
- C:\Windows\System\hmpsfOP.exe
  C:\Windows\System\hmpsfOP.exe
  2⤵
  PID:14400
- C:\Windows\System\agrnyAE.exe
  C:\Windows\System\agrnyAE.exe
  2⤵
  PID:14428
- C:\Windows\System\wOdBFny.exe
  C:\Windows\System\wOdBFny.exe
  2⤵
  PID:14460
- C:\Windows\System\AllUFzb.exe
  C:\Windows\System\AllUFzb.exe
  2⤵
  PID:14480
- C:\Windows\System\xgsiVBI.exe
  C:\Windows\System\xgsiVBI.exe
  2⤵
  PID:14520
- C:\Windows\System\MpblEIe.exe
  C:\Windows\System\MpblEIe.exe
  2⤵
  PID:14552
- C:\Windows\System\gOxvOUA.exe
  C:\Windows\System\gOxvOUA.exe
  2⤵
  PID:14580
- C:\Windows\System\heeByWh.exe
  C:\Windows\System\heeByWh.exe
  2⤵
  PID:14620
- C:\Windows\System\XynowYM.exe
  C:\Windows\System\XynowYM.exe
  2⤵
  PID:14648
- C:\Windows\System\EsgffSR.exe
  C:\Windows\System\EsgffSR.exe
  2⤵
  PID:14672
- C:\Windows\System\KSPitgy.exe
  C:\Windows\System\KSPitgy.exe
  2⤵
  PID:14700
- C:\Windows\System\EFIMmUL.exe
  C:\Windows\System\EFIMmUL.exe
  2⤵
  PID:14716
- C:\Windows\System\pGAicTd.exe
  C:\Windows\System\pGAicTd.exe
  2⤵
  PID:14744
- C:\Windows\System\UPDdQUh.exe
  C:\Windows\System\UPDdQUh.exe
  2⤵
  PID:14764
- C:\Windows\System\DYxnwqZ.exe
  C:\Windows\System\DYxnwqZ.exe
  2⤵
  PID:14780
- C:\Windows\System\sMYTUyA.exe
  C:\Windows\System\sMYTUyA.exe
  2⤵
  PID:14812
- C:\Windows\System\dAQzuHf.exe
  C:\Windows\System\dAQzuHf.exe
  2⤵
  PID:14828
- C:\Windows\System\mwBHwBo.exe
  C:\Windows\System\mwBHwBo.exe
  2⤵
  PID:14860
- C:\Windows\System\BKBIgwA.exe
  C:\Windows\System\BKBIgwA.exe
  2⤵
  PID:14888
- C:\Windows\System\ZNBkXZL.exe
  C:\Windows\System\ZNBkXZL.exe
  2⤵
  PID:14916
- C:\Windows\System\PzIkOgV.exe
  C:\Windows\System\PzIkOgV.exe
  2⤵
  PID:14936
- C:\Windows\System\JGNsAbN.exe
  C:\Windows\System\JGNsAbN.exe
  2⤵
  PID:14960
- C:\Windows\System\EiYioBW.exe
  C:\Windows\System\EiYioBW.exe
  2⤵
  PID:14988
- C:\Windows\System\tfcqIJi.exe
  C:\Windows\System\tfcqIJi.exe
  2⤵
  PID:15012
- C:\Windows\System\OGsNUEE.exe
  C:\Windows\System\OGsNUEE.exe
  2⤵
  PID:15048
- C:\Windows\System\PziYUue.exe
  C:\Windows\System\PziYUue.exe
  2⤵
  PID:15072
- C:\Windows\System\UxwnWUq.exe
  C:\Windows\System\UxwnWUq.exe
  2⤵
  PID:15096
- C:\Windows\System\vixICeL.exe
  C:\Windows\System\vixICeL.exe
  2⤵
  PID:15120
- C:\Windows\System\BxLAWqj.exe
  C:\Windows\System\BxLAWqj.exe
  2⤵
  PID:15136
- C:\Windows\System\FRgghyE.exe
  C:\Windows\System\FRgghyE.exe
  2⤵
  PID:15152
- C:\Windows\System\aMtioJG.exe
  C:\Windows\System\aMtioJG.exe
  2⤵
  PID:15180
- C:\Windows\System\qeuMpnj.exe
  C:\Windows\System\qeuMpnj.exe
  2⤵
  PID:15208
- C:\Windows\System\ylEEoaJ.exe
  C:\Windows\System\ylEEoaJ.exe
  2⤵
  PID:15240
- C:\Windows\System\bujbHmT.exe
  C:\Windows\System\bujbHmT.exe
  2⤵
  PID:15264
- C:\Windows\System\RgnnNVs.exe
  C:\Windows\System\RgnnNVs.exe
  2⤵
  PID:15288
- C:\Windows\System\hDAocQv.exe
  C:\Windows\System\hDAocQv.exe
  2⤵
  PID:15316
- C:\Windows\System\gDABzBe.exe
  C:\Windows\System\gDABzBe.exe
  2⤵
  PID:15340
- C:\Windows\System\WZEsZSz.exe
  C:\Windows\System\WZEsZSz.exe
  2⤵
  PID:14148
- C:\Windows\System\gQeqwVd.exe
  C:\Windows\System\gQeqwVd.exe
  2⤵
  PID:12308
- C:\Windows\System\AKcKOXv.exe
  C:\Windows\System\AKcKOXv.exe
  2⤵
  PID:14156
- C:\Windows\System\yurvMUD.exe
  C:\Windows\System\yurvMUD.exe
  2⤵
  PID:13232
- C:\Windows\System\BxCodsa.exe
  C:\Windows\System\BxCodsa.exe
  2⤵
  PID:11928
- C:\Windows\System\uNvMxew.exe
  C:\Windows\System\uNvMxew.exe
  2⤵
  PID:12400
- C:\Windows\System\BUatoVB.exe
  C:\Windows\System\BUatoVB.exe
  2⤵
  PID:11680
- C:\Windows\System\ngFIYmO.exe
  C:\Windows\System\ngFIYmO.exe
  2⤵
  PID:14548
- C:\Windows\System\TNqUKzI.exe
  C:\Windows\System\TNqUKzI.exe
  2⤵
  PID:14608
- C:\Windows\System\hdIjSRT.exe
  C:\Windows\System\hdIjSRT.exe
  2⤵
  PID:14668
- C:\Windows\System\qzKyPkL.exe
  C:\Windows\System\qzKyPkL.exe
  2⤵
  PID:14732
- C:\Windows\System\GycqHah.exe
  C:\Windows\System\GycqHah.exe
  2⤵
  PID:13596
- C:\Windows\System\frjklzO.exe
  C:\Windows\System\frjklzO.exe
  2⤵
  PID:14868
- C:\Windows\System\nczTfVO.exe
  C:\Windows\System\nczTfVO.exe
  2⤵
  PID:14952
- C:\Windows\System\tyMUCtq.exe
  C:\Windows\System\tyMUCtq.exe
  2⤵
  PID:15080
- C:\Windows\System\WgXgbSw.exe
  C:\Windows\System\WgXgbSw.exe
  2⤵
  PID:15132
- C:\Windows\System\bSONNkg.exe
  C:\Windows\System\bSONNkg.exe
  2⤵
  PID:15200
- C:\Windows\System\bEiJOHP.exe
  C:\Windows\System\bEiJOHP.exe
  2⤵
  PID:15260
- C:\Windows\System\sWCQITK.exe
  C:\Windows\System\sWCQITK.exe
  2⤵
  PID:14600
- C:\Windows\System\wmpCfvB.exe
  C:\Windows\System\wmpCfvB.exe
  2⤵
  PID:14908
- C:\Windows\System\ZIswwsw.exe
  C:\Windows\System\ZIswwsw.exe
  2⤵
  PID:14980
- C:\Windows\System\kDTWKUV.exe
  C:\Windows\System\kDTWKUV.exe
  2⤵
  PID:14684
- C:\Windows\System\MYHyYos.exe
  C:\Windows\System\MYHyYos.exe
  2⤵
  PID:13480
- C:\Windows\System\bQoiiet.exe
  C:\Windows\System\bQoiiet.exe
  2⤵
  PID:11372
- C:\Windows\System\vBqFnXN.exe
  C:\Windows\System\vBqFnXN.exe
  2⤵
  PID:15168
- C:\Windows\System\XMpMTKD.exe
  C:\Windows\System\XMpMTKD.exe
  2⤵
  PID:15364
- C:\Windows\System\WxqKXoz.exe
  C:\Windows\System\WxqKXoz.exe
  2⤵
  PID:15392
- C:\Windows\System\xTzLmZs.exe
  C:\Windows\System\xTzLmZs.exe
  2⤵
  PID:15416
- C:\Windows\System\HBMTsrd.exe
  C:\Windows\System\HBMTsrd.exe
  2⤵
  PID:15440
- C:\Windows\System\fZJCYAs.exe
  C:\Windows\System\fZJCYAs.exe
  2⤵
  PID:15468
- C:\Windows\System\gVZkfEy.exe
  C:\Windows\System\gVZkfEy.exe
  2⤵
  PID:15488
- C:\Windows\System\jkrPYbT.exe
  C:\Windows\System\jkrPYbT.exe
  2⤵
  PID:15520
- C:\Windows\System\LIMRuhT.exe
  C:\Windows\System\LIMRuhT.exe
  2⤵
  PID:15540
- C:\Windows\System\ZWdANeQ.exe
  C:\Windows\System\ZWdANeQ.exe
  2⤵
  PID:15576
- C:\Windows\System\cpbpMcf.exe
  C:\Windows\System\cpbpMcf.exe
  2⤵
  PID:15596
- C:\Windows\System\AoJhwvY.exe
  C:\Windows\System\AoJhwvY.exe
  2⤵
  PID:15628
- C:\Windows\System\LiqaypY.exe
  C:\Windows\System\LiqaypY.exe
  2⤵
  PID:15648
- C:\Windows\System\ohLizgu.exe
  C:\Windows\System\ohLizgu.exe
  2⤵
  PID:15668
- C:\Windows\System\KhDybBr.exe
  C:\Windows\System\KhDybBr.exe
  2⤵
  PID:15684
- C:\Windows\System\umOVasT.exe
  C:\Windows\System\umOVasT.exe
  2⤵
  PID:15708
- C:\Windows\System\klyXjLi.exe
  C:\Windows\System\klyXjLi.exe
  2⤵
  PID:15736
- C:\Windows\System\BDUFHbz.exe
  C:\Windows\System\BDUFHbz.exe
  2⤵
  PID:16280
- C:\Windows\System\zGFlhJJ.exe
  C:\Windows\System\zGFlhJJ.exe
  2⤵
  PID:16320
- C:\Windows\System\nSUFMRe.exe
  C:\Windows\System\nSUFMRe.exe
  2⤵
  PID:16360
- C:\Windows\System\sRDSXit.exe
  C:\Windows\System\sRDSXit.exe
  2⤵
  PID:14752
- C:\Windows\System\FuActhT.exe
  C:\Windows\System\FuActhT.exe
  2⤵
  PID:15036
- C:\Windows\System\xeMcGuy.exe
  C:\Windows\System\xeMcGuy.exe
  2⤵
  PID:13592
- C:\Windows\System\yzODlgE.exe
  C:\Windows\System\yzODlgE.exe
  2⤵
  PID:15284
- C:\Windows\System\GbwZdkX.exe
  C:\Windows\System\GbwZdkX.exe
  2⤵
  PID:15144
- C:\Windows\System\jxgVttn.exe
  C:\Windows\System\jxgVttn.exe
  2⤵
  PID:15224
- C:\Windows\System\vCvcFYi.exe
  C:\Windows\System\vCvcFYi.exe
  2⤵
  PID:14468
- C:\Windows\System\CedVkAK.exe
  C:\Windows\System\CedVkAK.exe
  2⤵
  PID:15424
- C:\Windows\System\yfUjQnB.exe
  C:\Windows\System\yfUjQnB.exe
  2⤵
  PID:15456
- C:\Windows\System\eBHyJzL.exe
  C:\Windows\System\eBHyJzL.exe
  2⤵
  PID:15516
- C:\Windows\System\LpbDscH.exe
  C:\Windows\System\LpbDscH.exe
  2⤵
  PID:14424
- C:\Windows\System\biCkJzF.exe
  C:\Windows\System\biCkJzF.exe
  2⤵
  PID:15660
- C:\Windows\System\yRYiGBG.exe
  C:\Windows\System\yRYiGBG.exe
  2⤵
  PID:14756
- C:\Windows\System\IuXBNrU.exe
  C:\Windows\System\IuXBNrU.exe
  2⤵
  PID:15460
- C:\Windows\System\woPYfRg.exe
  C:\Windows\System\woPYfRg.exe
  2⤵
  PID:15476
- C:\Windows\System\FyvDiGk.exe
  C:\Windows\System\FyvDiGk.exe
  2⤵
  PID:15280
- C:\Windows\System\aAzhHcc.exe
  C:\Windows\System\aAzhHcc.exe
  2⤵
  PID:14632
- C:\Windows\System\DwdFJgO.exe
  C:\Windows\System\DwdFJgO.exe
  2⤵
  PID:15008
- C:\Windows\System\CcbOBwT.exe
  C:\Windows\System\CcbOBwT.exe
  2⤵
  PID:14572
- C:\Windows\System\htPJlvC.exe
  C:\Windows\System\htPJlvC.exe
  2⤵
  PID:15776
- C:\Windows\System\DuOjbCK.exe
  C:\Windows\System\DuOjbCK.exe
  2⤵
  PID:15572
- C:\Windows\System\GMdlZma.exe
  C:\Windows\System\GMdlZma.exe
  2⤵
  PID:15704
- C:\Windows\System\CqqUZGw.exe
  C:\Windows\System\CqqUZGw.exe
  2⤵
  PID:15752
- C:\Windows\System\giteSKi.exe
  C:\Windows\System\giteSKi.exe
  2⤵
  PID:15992
- C:\Windows\System\OSCmEZY.exe
  C:\Windows\System\OSCmEZY.exe
  2⤵
  PID:16200
- C:\Windows\System\SbnHnCm.exe
  C:\Windows\System\SbnHnCm.exe
  2⤵
  PID:16252
- C:\Windows\System\PsSCByc.exe
  C:\Windows\System\PsSCByc.exe
  2⤵
  PID:16256
- C:\Windows\System\pkaRTRj.exe
  C:\Windows\System\pkaRTRj.exe
  2⤵
  PID:1480
- C:\Windows\System\OEEvuYs.exe
  C:\Windows\System\OEEvuYs.exe
  2⤵
  PID:16292
- C:\Windows\System\xkVlqDb.exe
  C:\Windows\System\xkVlqDb.exe
  2⤵
  PID:16380
- C:\Windows\System\CfzaLjd.exe
  C:\Windows\System\CfzaLjd.exe
  2⤵
  PID:15324
- C:\Windows\System\vcprBlO.exe
  C:\Windows\System\vcprBlO.exe
  2⤵
  PID:14728
- C:\Windows\System\iBUgqHM.exe
  C:\Windows\System\iBUgqHM.exe
  2⤵
  PID:13800
- C:\Windows\System\idZgYHo.exe
  C:\Windows\System\idZgYHo.exe
  2⤵
  PID:15064
- C:\Windows\System\mVeiCBp.exe
  C:\Windows\System\mVeiCBp.exe
  2⤵
  PID:15404
- C:\Windows\System\KTheBrQ.exe
  C:\Windows\System\KTheBrQ.exe
  2⤵
  PID:15620
- C:\Windows\System\uiNAJRE.exe
  C:\Windows\System\uiNAJRE.exe
  2⤵
  PID:15188
- C:\Windows\System\bMmyhJk.exe
  C:\Windows\System\bMmyhJk.exe
  2⤵
  PID:16052
- C:\Windows\System\mySefAi.exe
  C:\Windows\System\mySefAi.exe
  2⤵
  PID:15972
- C:\Windows\System\pMdNZVs.exe
  C:\Windows\System\pMdNZVs.exe
  2⤵
  PID:16328
- C:\Windows\System\yUbHUNK.exe
  C:\Windows\System\yUbHUNK.exe
  2⤵
  PID:16180
- C:\Windows\System\ThiHfbX.exe
  C:\Windows\System\ThiHfbX.exe
  2⤵
  PID:16124
- C:\Windows\System\SqrJWTj.exe
  C:\Windows\System\SqrJWTj.exe
  2⤵
  PID:16312
- C:\Windows\System\tptOqsD.exe
  C:\Windows\System\tptOqsD.exe
  2⤵
  PID:16408
- C:\Windows\System\cVEMtXW.exe
  C:\Windows\System\cVEMtXW.exe
  2⤵
  PID:16432
- C:\Windows\System\YWljjdr.exe
  C:\Windows\System\YWljjdr.exe
  2⤵
  PID:16460
- C:\Windows\System\CJruEyN.exe
  C:\Windows\System\CJruEyN.exe
  2⤵
  PID:16480
- C:\Windows\System\GMLJYVh.exe
  C:\Windows\System\GMLJYVh.exe
  2⤵
  PID:16504
- C:\Windows\System\ioIThIK.exe
  C:\Windows\System\ioIThIK.exe
  2⤵
  PID:16532
- C:\Windows\System\RuBcpRx.exe
  C:\Windows\System\RuBcpRx.exe
  2⤵
  PID:16548
- C:\Windows\System\iXQsBGK.exe
  C:\Windows\System\iXQsBGK.exe
  2⤵
  PID:16576
- C:\Windows\System\pZmdFAQ.exe
  C:\Windows\System\pZmdFAQ.exe
  2⤵
  PID:16604
- C:\Windows\System\ykaPqEP.exe
  C:\Windows\System\ykaPqEP.exe
  2⤵
  PID:16632
- C:\Windows\System\okPtcBp.exe
  C:\Windows\System\okPtcBp.exe
  2⤵
  PID:16652
- C:\Windows\System\HaTvIpb.exe
  C:\Windows\System\HaTvIpb.exe
  2⤵
  PID:16676
- C:\Windows\System\ipmCMcv.exe
  C:\Windows\System\ipmCMcv.exe
  2⤵
  PID:16700
- C:\Windows\System\PCCoEiY.exe
  C:\Windows\System\PCCoEiY.exe
  2⤵
  PID:16720
- C:\Windows\System\tSzMvPG.exe
  C:\Windows\System\tSzMvPG.exe
  2⤵
  PID:16744
- C:\Windows\System\rkvTMbv.exe
  C:\Windows\System\rkvTMbv.exe
  2⤵
  PID:16768
- C:\Windows\System\nPazNlz.exe
  C:\Windows\System\nPazNlz.exe
  2⤵
  PID:16796
- C:\Windows\System\jRCkMqF.exe
  C:\Windows\System\jRCkMqF.exe
  2⤵
  PID:16824
- C:\Windows\System\UmSrGZN.exe
  C:\Windows\System\UmSrGZN.exe
  2⤵
  PID:16844
- C:\Windows\System\FlDthPU.exe
  C:\Windows\System\FlDthPU.exe
  2⤵
  PID:16868
- C:\Windows\System\qYyydhJ.exe
  C:\Windows\System\qYyydhJ.exe
  2⤵
  PID:16896
- C:\Windows\System\lsYQzBU.exe
  C:\Windows\System\lsYQzBU.exe
  2⤵
  PID:16924
- C:\Windows\System\cQdzgxY.exe
  C:\Windows\System\cQdzgxY.exe
  2⤵
  PID:16948
- C:\Windows\System\OvdcENF.exe
  C:\Windows\System\OvdcENF.exe
  2⤵
  PID:16976
- C:\Windows\System\cgwAjxl.exe
  C:\Windows\System\cgwAjxl.exe
  2⤵
  PID:16992
- C:\Windows\System\rdbnXlk.exe
  C:\Windows\System\rdbnXlk.exe
  2⤵
  PID:17016
- C:\Windows\System\zrTUKjN.exe
  C:\Windows\System\zrTUKjN.exe
  2⤵
  PID:17044
- C:\Windows\System\lydMBTR.exe
  C:\Windows\System\lydMBTR.exe
  2⤵
  PID:17068
- C:\Windows\System\oBBaXIt.exe
  C:\Windows\System\oBBaXIt.exe
  2⤵
  PID:17088
- C:\Windows\System\SrYTUpy.exe
  C:\Windows\System\SrYTUpy.exe
  2⤵
  PID:17116
- C:\Windows\System\fdjmxZi.exe
  C:\Windows\System\fdjmxZi.exe
  2⤵
  PID:17136
- C:\Windows\System\fLzmpQI.exe
  C:\Windows\System\fLzmpQI.exe
  2⤵
  PID:17168
- C:\Windows\System\lYSVuHm.exe
  C:\Windows\System\lYSVuHm.exe
  2⤵
  PID:17192
- C:\Windows\System\BaYmgUm.exe
  C:\Windows\System\BaYmgUm.exe
  2⤵
  PID:17216
- C:\Windows\System\zPFYdTe.exe
  C:\Windows\System\zPFYdTe.exe
  2⤵
  PID:17244
- C:\Windows\System\iUzSHuX.exe
  C:\Windows\System\iUzSHuX.exe
  2⤵
  PID:17260
- C:\Windows\System\xWclIjL.exe
  C:\Windows\System\xWclIjL.exe
  2⤵
  PID:17296
- C:\Windows\System\OJjcyzy.exe
  C:\Windows\System\OJjcyzy.exe
  2⤵
  PID:17324
- C:\Windows\System\bvMyUJL.exe
  C:\Windows\System\bvMyUJL.exe
  2⤵
  PID:16640
- C:\Windows\System\wOJxfTC.exe
  C:\Windows\System\wOJxfTC.exe
  2⤵
  PID:16688
- C:\Windows\System\tPZDDvn.exe
  C:\Windows\System\tPZDDvn.exe
  2⤵
  PID:16892
- C:\Windows\System\OAmzZdG.exe
  C:\Windows\System\OAmzZdG.exe
  2⤵
  PID:16916
- C:\Windows\System\OAcXLcB.exe
  C:\Windows\System\OAcXLcB.exe
  2⤵
  PID:16812
- C:\Windows\System\RIdXyFI.exe
  C:\Windows\System\RIdXyFI.exe
  2⤵
  PID:15656

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:16888

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\CJnwgHl.exe

Filesize
1.4MB

MD5
42df9d79f463f7b520d9dc625a4e0c7f

SHA1
460da5df8393be25a8a5da6e63d8016ab702c1f9

SHA256
896d555da609d9c2073facd4337c812d6cbbd64ecdbfc702d3854af61221e759

SHA512
a13d28da79aecd6f4ed38922138e764036acaf6c2846e2c2cd4f4a7f17e06705b2a276ce4d72054626e261827eef5ea46bb3b6c595d3ff9c3b25bea6b109f789

Download Submit
C:\Windows\System\DmTCecT.exe

Filesize
1.4MB

MD5
e912b9eb1982966659cd3385a035b8e2

SHA1
a0fc6c6fa87b7fcfb1d655ba5630f33e5eda0e38

SHA256
89b53ef72da33cdcf637c2e72875d9bf4bbd73479d85d80e67e6e3e9e7ee9f04

SHA512
4b336b07cb1b65b0205f56903a78b2173d6c3c110d0b42deb10a9bd4c260dbdf5962a7b25a3e0683f13e8be8847ced5dc02f7e6be619e8e3aeb3abe2dc4cb0c4

Download Submit
C:\Windows\System\EfqgTlV.exe

Filesize
1.4MB

MD5
3d18eb162ef150288b2d9997e0012052

SHA1
d76b4b0c364ae66dd4462caffc73ee195499d4f0

SHA256
4a651494a76f1c7f57d798e0eb8fcb6edf9110916757f75da33c065257554aa8

SHA512
7f5093ca268555280c9fc9a85380f412d7bb74dbf662516db376cecea6488e7addb3b648665acd6a07a4989a5ed177d666e8cb703a9d369f357ce5b0f16bd9ce

Download Submit
C:\Windows\System\GtVzwxl.exe

Filesize
1.4MB

MD5
1e7bb3e95608c08bfff3a9edfcd2ed36

SHA1
eec5873c541f67e6f66784cb15aef0649a95398c

SHA256
65e7b2951b9412afc2b6af28bb3a14737b3c00c9bb8a68cfef7b8c4bf1125d52

SHA512
d4eb52baef7cdadb1f8307ad9fc37e03102fab653853452dbecf377620d7d2b720bc5500c290dd5d325ce34722fc4806757cef6554a76576b609e8380c93e9fe

Download Submit
C:\Windows\System\GvvgLNJ.exe

Filesize
1.4MB

MD5
171553c68e34e2adf646279336d4bda1

SHA1
1815a0d3197655396f98dc7646766c2e5096a1b3

SHA256
92dacd678a8dddff984261ea4e32b62f113873a1e61196fea0e2837403c90e36

SHA512
6422ca01637e69cf6912b6feac795f4b8de8da239223dc2b3bbc0bdb3b5be4e77f89ea40b4263cead8bd488d38beba76c2249a46e7a73479b0ec15ada7c88bf3

Download Submit
C:\Windows\System\HEZnUVq.exe

Filesize
1.4MB

MD5
634a1469d0a37e162ca568eb8cd6411a

SHA1
eae9e5ed1dc2da19cd2f44b2b4485bcbec225884

SHA256
ff8ac30c72353f7d396fd739f7386f37d5ae7742111700cf74c3f579138a4c2a

SHA512
6dc0f2d8ba9c11562ed9409d34a897a757fdf0a4993907064daf009f55a30419c7963025a9e31b3e465d9ef6868343849b144ce33cff3b3ab4f866f262309317

Download Submit
C:\Windows\System\JVNPEoB.exe

Filesize
1.4MB

MD5
7a7b2f68bd33a44808f83193441013d0

SHA1
6c08eaa66ab55a382edd96e376d167c4a3926619

SHA256
65b523edaeabcca75f1c6684e85d1ac38eb049ff8ccbeedbb110bd19aa6f9d80

SHA512
f4f99cbdf8c1f21873e61e3949290242290e99e337fad0a2b81dfd07a7f5b0d43d1e2bb9a6af53be0388b3557bd98dbd5778770f5a431e210de960e69beee9ea

Download Submit
C:\Windows\System\KjDTfUk.exe

Filesize
1.4MB

MD5
e825f051e5a4fd06e0f95762ed01795f

SHA1
9cc270cca634253da80b2f97d3fa4ca811e2bdd8

SHA256
59e1eeaa5082585deec715173ccab642757f900591a94fe5e425bc33ca9a2490

SHA512
dbab95dd74332262c1ebd677cea86e59b2f1d62af841e087df6b032401cfc1b8422d7629c19b54fc6ffa5d78f28e9c0369e3d0c4fdfcf0d1544a4c391ed425ae

Download Submit
C:\Windows\System\LTwAVgL.exe

Filesize
1.4MB

MD5
564ba5cd13ede7fed9416480d52a46b0

SHA1
ba3b24eda7810d1128190aaca758c4222df94518

SHA256
cc280055b712e79fcc93c1389b8d94a6768b48504ff1d9f328fe88df420ed776

SHA512
9ddef028cc5c72ea6d2b53700a0ac8ca5c8b0331c9a24696dd3aae2a997298f411447165995a8c33600ad5055d2a71ccaac1400c765e9da0554e4ffabae50fe6

Download Submit
C:\Windows\System\LjZNKFL.exe

Filesize
1.4MB

MD5
8f3a062cf369f8e5d3cc312ae791eecd

SHA1
5e8e4994fb703c1388930b5f0057d290bc0ad1b3

SHA256
77dd818f1fd8e76fab8468755d2baf1557bba12bdd862092baf41fdcaa9839b0

SHA512
0294e2da81c8fe6c72fedb03228ece775efe9fb8ba051784b2cac4c263b2a07a61471174a19d3aaaf31c8cf26176dd0b22f600d31f3b7e192e7f6f6c07771f37

Download Submit
C:\Windows\System\LyIFAAF.exe

Filesize
1.4MB

MD5
590dd9550db1ff0214cf361fc4a5bc55

SHA1
59862b6de47cabb67135aa5e838c0e529c9468df

SHA256
1056e3a980eae360ed64ab1c74d57b67297804849836ab8096dd5dca6070f6ec

SHA512
36471f5032eae54ab747cc39b5f04e2f4c22f50af5928d3601b50a2f9a39fc944afb8026749fb12a578858eeec7137968d136377c52646fec287a6d7a3e53169

Download Submit
C:\Windows\System\NkkPMzG.exe

Filesize
1.4MB

MD5
ccdff3ace9d0c5ebe5bb3455337820d5

SHA1
a18d8de065cd14c798d284db4bc0bf9e3f566b86

SHA256
63cd27b3ebd5438d0d0a231932d9cdf9f6be450027ac47a1077c83dec6e8104f

SHA512
0e7857014f31f010b14aedda56ffd10e2415dbd77f5b368fd8a29ba6da9c16e4dbb20251765f3c8a27373ff5144d671f1c590e5f7e09d455e426f4d0b76f950f

Download Submit
C:\Windows\System\NvpvSBf.exe

Filesize
1.4MB

MD5
efe582409b16b80a9290739990507a75

SHA1
e410c7f860dde44f5fb98ba233ea7b6af6c66435

SHA256
084d573246fc82b299ccbff7520661d3a6fce9ef03d6e2e3c80366361ec244ca

SHA512
c1984ff6169c3c9dc1b40921f6df80405e332de4797811741b7078e08b76e19684d9d846338fef26737d71041d5390394874d537bc60df13a8e3c433c5e946d2

Download Submit
C:\Windows\System\PHijtIA.exe

Filesize
1.4MB

MD5
3ed62b408b9ba7025481c2c4dcd391b1

SHA1
eafb4ad2724af62287a98555c290eb1f1c957caf

SHA256
6bda1955a7b066fae57d3c64567bd4f7cf83f1cff1497bda887a5f7a0f154250

SHA512
e7072026b3dd1286ef6fceaf417fbdeb4db613210cbe0ca67b4e6be3f55f8933b658cace6d644a0947f61027f8fa421731589d52dbd5e6398f306ff744f7c12b

Download Submit
C:\Windows\System\QyRmEvc.exe

Filesize
1.4MB

MD5
22f95b0358aefca7c7e94507852b3329

SHA1
4b92765c11aae25beddca97be1a1fa75ea4a38e4

SHA256
453303a23db2c554c501fc148d919a86f3da310f7bd964ca1858f7e021ae0def

SHA512
f74f0eb6df53f75d43ef8f96880330998d92a9a87717ff6d33b28715ab95d9a25f2491d430a74d1134f87fedf6d693da1a3c9e6fb4714b5ca06c61c33f6513dc

Download Submit
C:\Windows\System\RVKDUYC.exe

Filesize
1.4MB

MD5
a5933a190e07172cdb156eaf48ae460a

SHA1
23a18c662fcade43a9902d6ea16f66daf0874443

SHA256
a61c63fa0521b3a86ef26e8818d1f06860cc7819888c62da5a50fbc589ee7ab5

SHA512
0f00e6aa17c4c376e3c834c837348951cc871c6014d35bd4d3871f3d9d3ae847e565b6cde320d372012afcb521db5cb730f5bb4ccf8f94ab254726ccf4a1d724

Download Submit
C:\Windows\System\XXxogrJ.exe

Filesize
1.4MB

MD5
d57ca11cd3e98f188180c862bd1f885c

SHA1
af9f84f8f526b2ef8bbf310958c83a8b9d8b0cef

SHA256
de1379b2f905e310942aa47a31b45ab7bec3d7bd55ee77aa22bfc0c91a98297f

SHA512
49a2640710ddb96dd00fa01a12c5bc559e1dabb9b184bc8412f3bd9ae0b92a209a4797533dcb0e2d256757f9b409e3a6a2c73f2cc73c31cd2db4fe8d2f536d3f

Download Submit
C:\Windows\System\XpeeiaP.exe

Filesize
1.4MB

MD5
1c1cf37740063241d7dfd43739ced85d

SHA1
50e581f41a20e3711cd38f670bee99b438f2b22b

SHA256
dcf0dcb5ab156140c5aea128c4b47db9f7ed976ca82f16ac4b5f5c6026d8c66c

SHA512
6d08ca3534fe472e401f33a84e1fa7f2a039a8f6568685442eaaea13eebb5399f34fc985b78541cb2b5def6a7272a15f113b112d35d1ba925fc3d697f676728b

Download Submit
C:\Windows\System\YGJBIgx.exe

Filesize
1.4MB

MD5
ed5a17c241d6b7e136a1a2ff24dcb7d7

SHA1
9696b6cb927afb9386f6be50e2d87c2dcac67e0b

SHA256
a7aa3bd9054b080167e4e564ea5e3f59d9763b7667cf0bc613879b04612a11e8

SHA512
bb80fea79355b3dd53086133eee0030e44c83fb36d8d2371d90918388596e1cf237228b587f881282516b57c88ea17ef4d35825569f2626d528f61d40bcfa076

Download Submit
C:\Windows\System\ZycFKNC.exe

Filesize
1.4MB

MD5
6885d258dd0d69014f6837f3331bba08

SHA1
d47fd79e05fea72e6cc4a80ac05ce0f92f104e52

SHA256
9029a193626547de62fff1c6aae4e6e894c710e9fdaffa53ecca4e1322609f08

SHA512
f106efa38b6e89d628e443e52a40a21a6fe5ffdbf96a82e984d98de39a1f2a40a03e10c7df81b3f378335c4f3b91a80e0ed3ea362d6d486613048e9c0bcaada0

Download Submit
C:\Windows\System\aOSVRXe.exe

Filesize
1.4MB

MD5
057df5386b19266c1615af75f34851ef

SHA1
48d4e7b8c8cbdfe33297f873ecfb31d5210e1471

SHA256
7800bd1e913e1dc3c29c011fbd69af7c9c73f4cba288a6e7fdf33ae4b4eb05c6

SHA512
e8292762842ddf74ce1d34246f0028364d39e3cebefc03853b9baa09aea7a2448d7f276167579d4d09bbf00bcbe997992570b6f620524d48a67134d017e826c0

Download Submit
C:\Windows\System\bSvSwYp.exe

Filesize
1.4MB

MD5
0698d5d2455f42f085b6e3c2c8be27a6

SHA1
1da2c5ce303aed66024f006ab10800aee5b0695f

SHA256
5e4ae661d5a2dafdcb636f46ff696343e158ff85d00201a8fc37490c7f6fbd76

SHA512
ff478dfc525e217952883fe7c8921b2aa69cb74948ddd60fb13b6d60ffd0cc3ce56e97b95134c758dbad440ae29feab3a03900e8761d70a486aee117b6b7af73

Download Submit
C:\Windows\System\eQsvkXW.exe

Filesize
1.4MB

MD5
e7689e33c60544eb642509b30ce13a42

SHA1
19e7c48c6edde3532d320d9917206e28ee8ab949

SHA256
86110b5e5e692655d35991aa3fa80349fb3d1bd3fd466102ab666d0ab5a1b715

SHA512
b0ac3565e9da2fbe9c05ed734c85e7fa30ddced9bff7c82ad5b0852e4112b6353746448012d61e9aaf5e09176cd4974cec15481377342e23c625b1c4c7115550

Download Submit
C:\Windows\System\fkAwnhx.exe

Filesize
1.4MB

MD5
959dfb168e87f0644996bfa07e698111

SHA1
14dce04490329d1b5d06089582b9e8cdc4d608c9

SHA256
cd510bc4c8af68b5c8b91c52530d0d2172b7e2c3900b9b83cd60d7352894cc28

SHA512
2b6e6a653a6c01ecdc869cbfc9adcd91435962f45948e141ea5a314c56be6b1441ed663a8dccd79a91dbfcb1018ed66b8fc26d408fa7a84eec6eea45b95143c0

Download Submit
C:\Windows\System\gcGmLGh.exe

Filesize
1.4MB

MD5
e67ea473a3d8fdec2d5298cb8e6f40bf

SHA1
8a3f5799b822af4c843e67f3044a7b2022529884

SHA256
04d35a488495cc4f4418b8213841463b28ed038408bbe46a7741ca101aac37d0

SHA512
89b3da00609c9b92a275cac296d8f9c0cab1f9faab049c2472674f48ff1142a575af59037d5b7c74192e05ae588aed519ec6c361f61b6a33cd0464622bb314da

Download Submit
C:\Windows\System\ijeYmVl.exe

Filesize
1.4MB

MD5
43d17c8d46179cd4d5b90fd717bdd6d2

SHA1
e652db67df9d730f7a20e5c6eff5939c53af9d18

SHA256
3f7dc6c3959e08b076159182440ed2d697ce2a2300215d1affad49b6f5f2411b

SHA512
f5d148a7cc1335e6945e742dd439e7c0c4238ae283e48dd72261a9f609c49d3a4c9c86457a62b49893a72bd1764eb9043c9d82d3b47bd6516428647094e68061

Download Submit
C:\Windows\System\mWyZLCt.exe

Filesize
1.4MB

MD5
7cff51d57b7afbf2ada26b0822c96ae0

SHA1
31e70417b00d6cd4b62982e5c94637d720d08d08

SHA256
56153f0d521cefa2c7ac1e13fa2e7b2b9c9d3122456e4c40e297300570276ea8

SHA512
f66a06667650f3639edf2e5b5682bc0bf27cd3dfdab8cf6a59609cf3afef138e6b0cd64e3b624c5dc6e3ce75b6bb19d3f5d2bcf163c5c794169e0e44d89e7148

Download Submit
C:\Windows\System\neAsKYq.exe

Filesize
1.4MB

MD5
d30d46c675571c632b93532198a1eb68

SHA1
a70195ce752a95bc7b31c041a512cbb29a220257

SHA256
4fc2a55363da9dd284eea88d4995b892c723c4634612dc31cc9cc1be6c96af53

SHA512
72b5f3a7da9978a72eb61ad910bcc7371f48ae2aacfb0d94f15016c341853aa714dbfc67ae5d01f1816c966b2ac5608ead4b374fbac83eda7944ae2d577c4128

Download Submit
C:\Windows\System\oOqWmHC.exe

Filesize
1.4MB

MD5
15173183294a750be78adef9cf33481f

SHA1
abd23a6c5a87d74e36593fae662c195c96d57131

SHA256
fe45fb2d93b2d8749beaef2e657ed7d3488273354fe20bac95f9dd7e53934770

SHA512
e14caf3ee5856c275d6484ce8926aa40e4fa879262dd97e791c26b26124a6add38ee07d3dab8b3114867e8d1fc2eb7e22e43dc02450de97c638e3f863bbc582a

Download Submit
C:\Windows\System\qcJizyc.exe

Filesize
1.4MB

MD5
5d20a368fedecb1dea2bad0148e26dbb

SHA1
3e47fed960b09363dd900a24699073982bd78c6e

SHA256
d6b01bbcdadf9239a75c22c733cb9348a19ed4c0aa02e933b14f6f2cd87e5092

SHA512
73f2a9e3969b1b911e81ff45db0018bec0950b26d8ecb69e74149a77b3a144dee7d4534161bd4681e355e56040fb0529cb0ba0ca6adfa3b3b6e6705dfb7591dd

Download Submit
C:\Windows\System\rorneks.exe

Filesize
1.4MB

MD5
e761178fa3baa9586ae0869284c0575e

SHA1
265b20eb054bbe86000410af42256805526d8ade

SHA256
9ca5fa5e83c5c7097fc61ddf9e2ebc44a3bba68ffe78159a46a357443c290454

SHA512
5c5b8a3a06003c62f4ace98e213d808bb5799a73bcd97ba03ccb3a5a7e6f08c67cabfb168cf9ed115f61b6314290e7d14cbaa5b6a657b9f01cddde8763951af7

Download Submit
C:\Windows\System\szULMHT.exe

Filesize
1.4MB

MD5
2d918a8d6b7e16ccfd1293d1a358bac2

SHA1
517574e308903ba463ef3666cd51dc4e3e106376

SHA256
934c168fa862cbdd41d933441f8eed5968fe3d0a873c0ad89dec90e84067fe61

SHA512
804eb6c0ecd3b6e1c171e8242fb87ee012b4f2ff2f27e3dbb9fa6971acb9ebc8e87678670bbc1b1b0fc1b8d332ca7da9f1953dad746647b15e49271817520eb3

Download Submit
C:\Windows\System\tqDmPEF.exe

Filesize
1.4MB

MD5
85e1db148b3d97d6adb8e5d3214ce778

SHA1
b80f4be4062ad75137cb8516a2e33173c6efc384

SHA256
e5dbd7644becc77084532f7f163df27fd4e78fcc0827a48d82506579bc5dc857

SHA512
6df10c8296ce831a421752a084775e00dc6bf33a0c842696793262399cf2598e150357eff3e3f1bd3a22eed575636ab4c92717f89744f343d30663a8c45187ea

Download Submit
C:\Windows\System\ueCDwSJ.exe

Filesize
1.4MB

MD5
0ffc2a790c25fbaba44aee6d95e66496

SHA1
607dac186adc6f7eec1c05198b804f7a3bc764c0

SHA256
8fa813b92d626e0d7f83b0d4155377d43afde9522b5cbe8f58d6e8bb6414a465

SHA512
6b50804be66ded8af23da6ef6e2e1052139201a5ae76318d581404330e3db1fceff06678dadf71a5c00a67f7aa2490a50f46f5620b45e29bf02c24a379c3a605

Download Submit
C:\Windows\System\yVsLrfn.exe

Filesize
1.4MB

MD5
7712007c2a2e50e8a424b3b8e6475a7f

SHA1
b6273fea9e35bab4f3a92b18b67279adc6e10473

SHA256
260ff5f1aa4aeb1b0f729a4e5a9347c01c3b48dd50c4e1ce9c4088c3ed3d86eb

SHA512
8a28c3c95141df3c5f983ba7261002c7ac7cfb739fbeef1c69ba2ad79b24bd285d9e9fb35ebf5e6308c5a965abf44101eba010986eadd3d64cb3709b27f28d64

Download Submit
memory/3464-0-0x0000017EFCF20000-0x0000017EFCF30000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads