xmrig | f05c300f6986d2f6532cfc2c399ba4d572be29236e6eefefef81040ca03dd212

Analysis

max time kernel
94s
max time network
105s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
05/09/2024, 17:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9284a0b8fe98317abe5e992378db8fe0N.exe
Size

1.5MB
MD5

9284a0b8fe98317abe5e992378db8fe0
SHA1

284175ec951d0cb2de7056116435029a3f4c1701
SHA256

f05c300f6986d2f6532cfc2c399ba4d572be29236e6eefefef81040ca03dd212
SHA512

2df2a59954e8ece769aab20fafb80dcb8199b795eccf903df46c5d721959f0a459a59b9e11560c55311fec789c1ff624ff9d3cce2667e513ffe7f74665add9dc
SSDEEP

49152:GezaTF8FcNkNdfE0pZ9ozttwIRxj4c5yOBZnQ8:GemTLkNdfE0pZyV

Score

10^/10

xmrig miner

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 35 IoCs

miner

resource	yara_rule
behavioral2/files/0x00090000000233e7-4.dat	xmrig
behavioral2/files/0x000700000002344a-8.dat	xmrig
behavioral2/files/0x000700000002344b-25.dat	xmrig
behavioral2/files/0x000700000002344c-23.dat	xmrig
behavioral2/files/0x0009000000023446-10.dat	xmrig
behavioral2/files/0x000700000002344d-29.dat	xmrig
behavioral2/files/0x000700000002344f-32.dat	xmrig
behavioral2/files/0x0007000000023452-47.dat	xmrig
behavioral2/files/0x0007000000023453-62.dat	xmrig
behavioral2/files/0x0009000000023447-67.dat	xmrig
behavioral2/files/0x0007000000023457-78.dat	xmrig
behavioral2/files/0x0007000000023456-80.dat	xmrig
behavioral2/files/0x0007000000023455-76.dat	xmrig
behavioral2/files/0x0007000000023454-74.dat	xmrig
behavioral2/files/0x0007000000023451-59.dat	xmrig
behavioral2/files/0x0007000000023450-48.dat	xmrig
behavioral2/files/0x0007000000023458-86.dat	xmrig
behavioral2/files/0x0007000000023459-87.dat	xmrig
behavioral2/files/0x000700000002345a-98.dat	xmrig
behavioral2/files/0x000700000002345b-97.dat	xmrig
behavioral2/files/0x000700000002345c-104.dat	xmrig
behavioral2/files/0x0007000000023460-120.dat	xmrig
behavioral2/files/0x000700000002345f-148.dat	xmrig
behavioral2/files/0x000700000002346a-177.dat	xmrig
behavioral2/files/0x0007000000023469-174.dat	xmrig
behavioral2/files/0x0007000000023464-168.dat	xmrig
behavioral2/files/0x0007000000023463-166.dat	xmrig
behavioral2/files/0x0007000000023468-165.dat	xmrig
behavioral2/files/0x0007000000023467-161.dat	xmrig
behavioral2/files/0x0007000000023462-160.dat	xmrig
behavioral2/files/0x0007000000023466-147.dat	xmrig
behavioral2/files/0x0007000000023465-143.dat	xmrig
behavioral2/files/0x000700000002345e-142.dat	xmrig
behavioral2/files/0x0007000000023461-131.dat	xmrig
behavioral2/files/0x000700000002345d-125.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2560	tCBnzUZ.exe
2224	ZLjvTQB.exe
4264	vljTLPA.exe
3924	SWvKfxR.exe
3272	QnEvQWR.exe
2608	xWrYGWp.exe
4192	fXZKFOz.exe
2504	JTSKgDv.exe
3100	DNSuWEm.exe
4384	UjrKkgk.exe
4964	EFnCRey.exe
2044	AAkcixG.exe
3160	ISYgaDc.exe
396	iVcUYMt.exe
2032	xSZVzmY.exe
3312	OdrSCqM.exe
5084	soMeFiP.exe
4260	FEdEDSz.exe
1416	rOAoHQL.exe
4716	AJsLBOa.exe
4268	oDQVJtF.exe
1464	PXPnygI.exe
364	AgFyxJY.exe
4624	ZkroPJv.exe
1608	qBdzKnO.exe
2796	qtDToQc.exe
4440	ANjpgjI.exe
3500	cLaizTb.exe
4172	iMenYnB.exe
404	cdYhoAF.exe
1612	tIGvenB.exe
988	pUPfgMv.exe
4584	NWUTNBK.exe
2336	HKIOuhf.exe
2320	NgFdpIS.exe
3720	lXyNsTP.exe
1468	qBvlYtF.exe
3224	pPbmCRY.exe
4960	GTaZptE.exe
3052	ETlOFiE.exe
2348	DnCaina.exe
3148	DnsdKPq.exe
2096	drJeMwD.exe
4740	kjzsfGb.exe
3172	cwakZgK.exe
4400	jPFxvsA.exe
2544	WlMFsEQ.exe
1572	AweLUMd.exe
5012	gjGKaxl.exe
4636	qyvNaAw.exe
4644	GCEohkt.exe
4920	MinbLXW.exe
1512	HiRPKmi.exe
4232	BAxcijO.exe
5088	xDEBBZX.exe
772	wXTAkHN.exe
184	mcrmBaB.exe
2240	VSmAmrO.exe
4008	PHFAswj.exe
2196	oXOwmkB.exe
3416	tUldvKX.exe
1784	zGmuhQw.exe
3196	dvgjNHZ.exe
3396	ExJYTIM.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\ygHUlaL.exe	9284a0b8fe98317abe5e992378db8fe0N.exe
File created	C:\Windows\System\uxgGipm.exe	9284a0b8fe98317abe5e992378db8fe0N.exe
File created	C:\Windows\System\RWNnnAj.exe	9284a0b8fe98317abe5e992378db8fe0N.exe
File created	C:\Windows\System\aCRoUVt.exe	9284a0b8fe98317abe5e992378db8fe0N.exe
File created	C:\Windows\System\lxTdDpq.exe	9284a0b8fe98317abe5e992378db8fe0N.exe
File created	C:\Windows\System\ExJYTIM.exe	9284a0b8fe98317abe5e992378db8fe0N.exe
File created	C:\Windows\System\LsxbuFi.exe	9284a0b8fe98317abe5e992378db8fe0N.exe
File created	C:\Windows\System\SWFzLkP.exe	9284a0b8fe98317abe5e992378db8fe0N.exe
File created	C:\Windows\System\dnWszJI.exe	9284a0b8fe98317abe5e992378db8fe0N.exe
File created	C:\Windows\System\tnqMEDq.exe	9284a0b8fe98317abe5e992378db8fe0N.exe
File created	C:\Windows\System\qOBZLLS.exe	9284a0b8fe98317abe5e992378db8fe0N.exe
File created	C:\Windows\System\nYSKpkm.exe	9284a0b8fe98317abe5e992378db8fe0N.exe
File created	C:\Windows\System\CjRxhQE.exe	9284a0b8fe98317abe5e992378db8fe0N.exe
File created	C:\Windows\System\vUCFPFW.exe	9284a0b8fe98317abe5e992378db8fe0N.exe
File created	C:\Windows\System\HCPpCfA.exe	9284a0b8fe98317abe5e992378db8fe0N.exe
File created	C:\Windows\System\qEUcSVh.exe	9284a0b8fe98317abe5e992378db8fe0N.exe
File created	C:\Windows\System\cZLpeps.exe	9284a0b8fe98317abe5e992378db8fe0N.exe
File created	C:\Windows\System\PXznXUR.exe	9284a0b8fe98317abe5e992378db8fe0N.exe
File created	C:\Windows\System\mrdcbtz.exe	9284a0b8fe98317abe5e992378db8fe0N.exe
File created	C:\Windows\System\yEMlWzZ.exe	9284a0b8fe98317abe5e992378db8fe0N.exe
File created	C:\Windows\System\NIwKYZr.exe	9284a0b8fe98317abe5e992378db8fe0N.exe
File created	C:\Windows\System\QnEvQWR.exe	9284a0b8fe98317abe5e992378db8fe0N.exe
File created	C:\Windows\System\pLiudqb.exe	9284a0b8fe98317abe5e992378db8fe0N.exe
File created	C:\Windows\System\KAXvmKb.exe	9284a0b8fe98317abe5e992378db8fe0N.exe
File created	C:\Windows\System\xdfbTJa.exe	9284a0b8fe98317abe5e992378db8fe0N.exe
File created	C:\Windows\System\BeUFtiz.exe	9284a0b8fe98317abe5e992378db8fe0N.exe
File created	C:\Windows\System\tIGvenB.exe	9284a0b8fe98317abe5e992378db8fe0N.exe
File created	C:\Windows\System\jorxDVl.exe	9284a0b8fe98317abe5e992378db8fe0N.exe
File created	C:\Windows\System\TcpbBOl.exe	9284a0b8fe98317abe5e992378db8fe0N.exe
File created	C:\Windows\System\SccEhnE.exe	9284a0b8fe98317abe5e992378db8fe0N.exe
File created	C:\Windows\System\QOYObCP.exe	9284a0b8fe98317abe5e992378db8fe0N.exe
File created	C:\Windows\System\pcJyrzp.exe	9284a0b8fe98317abe5e992378db8fe0N.exe
File created	C:\Windows\System\UnoxoFD.exe	9284a0b8fe98317abe5e992378db8fe0N.exe
File created	C:\Windows\System\ANjpgjI.exe	9284a0b8fe98317abe5e992378db8fe0N.exe
File created	C:\Windows\System\lBIdFff.exe	9284a0b8fe98317abe5e992378db8fe0N.exe
File created	C:\Windows\System\baTMfPw.exe	9284a0b8fe98317abe5e992378db8fe0N.exe
File created	C:\Windows\System\kukJBDh.exe	9284a0b8fe98317abe5e992378db8fe0N.exe
File created	C:\Windows\System\bRSxeLJ.exe	9284a0b8fe98317abe5e992378db8fe0N.exe
File created	C:\Windows\System\xIFwwDN.exe	9284a0b8fe98317abe5e992378db8fe0N.exe
File created	C:\Windows\System\ymlpclW.exe	9284a0b8fe98317abe5e992378db8fe0N.exe
File created	C:\Windows\System\ZLjvTQB.exe	9284a0b8fe98317abe5e992378db8fe0N.exe
File created	C:\Windows\System\AJsLBOa.exe	9284a0b8fe98317abe5e992378db8fe0N.exe
File created	C:\Windows\System\vCKoBah.exe	9284a0b8fe98317abe5e992378db8fe0N.exe
File created	C:\Windows\System\wMeiSsS.exe	9284a0b8fe98317abe5e992378db8fe0N.exe
File created	C:\Windows\System\gzHqYsB.exe	9284a0b8fe98317abe5e992378db8fe0N.exe
File created	C:\Windows\System\LHZyUcZ.exe	9284a0b8fe98317abe5e992378db8fe0N.exe
File created	C:\Windows\System\AGfsJbH.exe	9284a0b8fe98317abe5e992378db8fe0N.exe
File created	C:\Windows\System\wKedIDh.exe	9284a0b8fe98317abe5e992378db8fe0N.exe
File created	C:\Windows\System\YOwjHii.exe	9284a0b8fe98317abe5e992378db8fe0N.exe
File created	C:\Windows\System\ojBJVuT.exe	9284a0b8fe98317abe5e992378db8fe0N.exe
File created	C:\Windows\System\zZzOBEB.exe	9284a0b8fe98317abe5e992378db8fe0N.exe
File created	C:\Windows\System\PFOZYAu.exe	9284a0b8fe98317abe5e992378db8fe0N.exe
File created	C:\Windows\System\CdgkGYs.exe	9284a0b8fe98317abe5e992378db8fe0N.exe
File created	C:\Windows\System\eGGyqPZ.exe	9284a0b8fe98317abe5e992378db8fe0N.exe
File created	C:\Windows\System\ZArpXnw.exe	9284a0b8fe98317abe5e992378db8fe0N.exe
File created	C:\Windows\System\OIvQwPQ.exe	9284a0b8fe98317abe5e992378db8fe0N.exe
File created	C:\Windows\System\kbHePTR.exe	9284a0b8fe98317abe5e992378db8fe0N.exe
File created	C:\Windows\System\vIsLwHq.exe	9284a0b8fe98317abe5e992378db8fe0N.exe
File created	C:\Windows\System\fLSSQqc.exe	9284a0b8fe98317abe5e992378db8fe0N.exe
File created	C:\Windows\System\NwSHJZk.exe	9284a0b8fe98317abe5e992378db8fe0N.exe
File created	C:\Windows\System\wtJGzvW.exe	9284a0b8fe98317abe5e992378db8fe0N.exe
File created	C:\Windows\System\HVNLNWU.exe	9284a0b8fe98317abe5e992378db8fe0N.exe
File created	C:\Windows\System\sxnTnRP.exe	9284a0b8fe98317abe5e992378db8fe0N.exe
File created	C:\Windows\System\gNvHCph.exe	9284a0b8fe98317abe5e992378db8fe0N.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	17120	dwm.exe
Token: SeChangeNotifyPrivilege	17120	dwm.exe
Token: 33	17120	dwm.exe
Token: SeIncBasePriorityPrivilege	17120	dwm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 8 wrote to memory of 2560	8	9284a0b8fe98317abe5e992378db8fe0N.exe	84
PID 8 wrote to memory of 2560	8	9284a0b8fe98317abe5e992378db8fe0N.exe	84
PID 8 wrote to memory of 2224	8	9284a0b8fe98317abe5e992378db8fe0N.exe	85
PID 8 wrote to memory of 2224	8	9284a0b8fe98317abe5e992378db8fe0N.exe	85
PID 8 wrote to memory of 4264	8	9284a0b8fe98317abe5e992378db8fe0N.exe	86
PID 8 wrote to memory of 4264	8	9284a0b8fe98317abe5e992378db8fe0N.exe	86
PID 8 wrote to memory of 3924	8	9284a0b8fe98317abe5e992378db8fe0N.exe	87
PID 8 wrote to memory of 3924	8	9284a0b8fe98317abe5e992378db8fe0N.exe	87
PID 8 wrote to memory of 3272	8	9284a0b8fe98317abe5e992378db8fe0N.exe	88
PID 8 wrote to memory of 3272	8	9284a0b8fe98317abe5e992378db8fe0N.exe	88
PID 8 wrote to memory of 2608	8	9284a0b8fe98317abe5e992378db8fe0N.exe	89
PID 8 wrote to memory of 2608	8	9284a0b8fe98317abe5e992378db8fe0N.exe	89
PID 8 wrote to memory of 4192	8	9284a0b8fe98317abe5e992378db8fe0N.exe	90
PID 8 wrote to memory of 4192	8	9284a0b8fe98317abe5e992378db8fe0N.exe	90
PID 8 wrote to memory of 2504	8	9284a0b8fe98317abe5e992378db8fe0N.exe	91
PID 8 wrote to memory of 2504	8	9284a0b8fe98317abe5e992378db8fe0N.exe	91
PID 8 wrote to memory of 3100	8	9284a0b8fe98317abe5e992378db8fe0N.exe	92
PID 8 wrote to memory of 3100	8	9284a0b8fe98317abe5e992378db8fe0N.exe	92
PID 8 wrote to memory of 4384	8	9284a0b8fe98317abe5e992378db8fe0N.exe	93
PID 8 wrote to memory of 4384	8	9284a0b8fe98317abe5e992378db8fe0N.exe	93
PID 8 wrote to memory of 4964	8	9284a0b8fe98317abe5e992378db8fe0N.exe	94
PID 8 wrote to memory of 4964	8	9284a0b8fe98317abe5e992378db8fe0N.exe	94
PID 8 wrote to memory of 2044	8	9284a0b8fe98317abe5e992378db8fe0N.exe	95
PID 8 wrote to memory of 2044	8	9284a0b8fe98317abe5e992378db8fe0N.exe	95
PID 8 wrote to memory of 3160	8	9284a0b8fe98317abe5e992378db8fe0N.exe	96
PID 8 wrote to memory of 3160	8	9284a0b8fe98317abe5e992378db8fe0N.exe	96
PID 8 wrote to memory of 396	8	9284a0b8fe98317abe5e992378db8fe0N.exe	97
PID 8 wrote to memory of 396	8	9284a0b8fe98317abe5e992378db8fe0N.exe	97
PID 8 wrote to memory of 2032	8	9284a0b8fe98317abe5e992378db8fe0N.exe	98
PID 8 wrote to memory of 2032	8	9284a0b8fe98317abe5e992378db8fe0N.exe	98
PID 8 wrote to memory of 3312	8	9284a0b8fe98317abe5e992378db8fe0N.exe	99
PID 8 wrote to memory of 3312	8	9284a0b8fe98317abe5e992378db8fe0N.exe	99
PID 8 wrote to memory of 5084	8	9284a0b8fe98317abe5e992378db8fe0N.exe	100
PID 8 wrote to memory of 5084	8	9284a0b8fe98317abe5e992378db8fe0N.exe	100
PID 8 wrote to memory of 4260	8	9284a0b8fe98317abe5e992378db8fe0N.exe	101
PID 8 wrote to memory of 4260	8	9284a0b8fe98317abe5e992378db8fe0N.exe	101
PID 8 wrote to memory of 1416	8	9284a0b8fe98317abe5e992378db8fe0N.exe	103
PID 8 wrote to memory of 1416	8	9284a0b8fe98317abe5e992378db8fe0N.exe	103
PID 8 wrote to memory of 4716	8	9284a0b8fe98317abe5e992378db8fe0N.exe	104
PID 8 wrote to memory of 4716	8	9284a0b8fe98317abe5e992378db8fe0N.exe	104
PID 8 wrote to memory of 4268	8	9284a0b8fe98317abe5e992378db8fe0N.exe	105
PID 8 wrote to memory of 4268	8	9284a0b8fe98317abe5e992378db8fe0N.exe	105
PID 8 wrote to memory of 1464	8	9284a0b8fe98317abe5e992378db8fe0N.exe	106
PID 8 wrote to memory of 1464	8	9284a0b8fe98317abe5e992378db8fe0N.exe	106
PID 8 wrote to memory of 364	8	9284a0b8fe98317abe5e992378db8fe0N.exe	107
PID 8 wrote to memory of 364	8	9284a0b8fe98317abe5e992378db8fe0N.exe	107
PID 8 wrote to memory of 4624	8	9284a0b8fe98317abe5e992378db8fe0N.exe	108
PID 8 wrote to memory of 4624	8	9284a0b8fe98317abe5e992378db8fe0N.exe	108
PID 8 wrote to memory of 1608	8	9284a0b8fe98317abe5e992378db8fe0N.exe	109
PID 8 wrote to memory of 1608	8	9284a0b8fe98317abe5e992378db8fe0N.exe	109
PID 8 wrote to memory of 2796	8	9284a0b8fe98317abe5e992378db8fe0N.exe	110
PID 8 wrote to memory of 2796	8	9284a0b8fe98317abe5e992378db8fe0N.exe	110
PID 8 wrote to memory of 4440	8	9284a0b8fe98317abe5e992378db8fe0N.exe	111
PID 8 wrote to memory of 4440	8	9284a0b8fe98317abe5e992378db8fe0N.exe	111
PID 8 wrote to memory of 3500	8	9284a0b8fe98317abe5e992378db8fe0N.exe	112
PID 8 wrote to memory of 3500	8	9284a0b8fe98317abe5e992378db8fe0N.exe	112
PID 8 wrote to memory of 4172	8	9284a0b8fe98317abe5e992378db8fe0N.exe	113
PID 8 wrote to memory of 4172	8	9284a0b8fe98317abe5e992378db8fe0N.exe	113
PID 8 wrote to memory of 404	8	9284a0b8fe98317abe5e992378db8fe0N.exe	114
PID 8 wrote to memory of 404	8	9284a0b8fe98317abe5e992378db8fe0N.exe	114
PID 8 wrote to memory of 1612	8	9284a0b8fe98317abe5e992378db8fe0N.exe	115
PID 8 wrote to memory of 1612	8	9284a0b8fe98317abe5e992378db8fe0N.exe	115
PID 8 wrote to memory of 988	8	9284a0b8fe98317abe5e992378db8fe0N.exe	116
PID 8 wrote to memory of 988	8	9284a0b8fe98317abe5e992378db8fe0N.exe	116

C:\Users\Admin\AppData\Local\Temp\9284a0b8fe98317abe5e992378db8fe0N.exe
"C:\Users\Admin\AppData\Local\Temp\9284a0b8fe98317abe5e992378db8fe0N.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:8
- C:\Windows\System\tCBnzUZ.exe
  C:\Windows\System\tCBnzUZ.exe
  2⤵
  - Executes dropped EXE
  PID:2560
- C:\Windows\System\ZLjvTQB.exe
  C:\Windows\System\ZLjvTQB.exe
  2⤵
  - Executes dropped EXE
  PID:2224
- C:\Windows\System\vljTLPA.exe
  C:\Windows\System\vljTLPA.exe
  2⤵
  - Executes dropped EXE
  PID:4264
- C:\Windows\System\SWvKfxR.exe
  C:\Windows\System\SWvKfxR.exe
  2⤵
  - Executes dropped EXE
  PID:3924
- C:\Windows\System\QnEvQWR.exe
  C:\Windows\System\QnEvQWR.exe
  2⤵
  - Executes dropped EXE
  PID:3272
- C:\Windows\System\xWrYGWp.exe
  C:\Windows\System\xWrYGWp.exe
  2⤵
  - Executes dropped EXE
  PID:2608
- C:\Windows\System\fXZKFOz.exe
  C:\Windows\System\fXZKFOz.exe
  2⤵
  - Executes dropped EXE
  PID:4192
- C:\Windows\System\JTSKgDv.exe
  C:\Windows\System\JTSKgDv.exe
  2⤵
  - Executes dropped EXE
  PID:2504
- C:\Windows\System\DNSuWEm.exe
  C:\Windows\System\DNSuWEm.exe
  2⤵
  - Executes dropped EXE
  PID:3100
- C:\Windows\System\UjrKkgk.exe
  C:\Windows\System\UjrKkgk.exe
  2⤵
  - Executes dropped EXE
  PID:4384
- C:\Windows\System\EFnCRey.exe
  C:\Windows\System\EFnCRey.exe
  2⤵
  - Executes dropped EXE
  PID:4964
- C:\Windows\System\AAkcixG.exe
  C:\Windows\System\AAkcixG.exe
  2⤵
  - Executes dropped EXE
  PID:2044
- C:\Windows\System\ISYgaDc.exe
  C:\Windows\System\ISYgaDc.exe
  2⤵
  - Executes dropped EXE
  PID:3160
- C:\Windows\System\iVcUYMt.exe
  C:\Windows\System\iVcUYMt.exe
  2⤵
  - Executes dropped EXE
  PID:396
- C:\Windows\System\xSZVzmY.exe
  C:\Windows\System\xSZVzmY.exe
  2⤵
  - Executes dropped EXE
  PID:2032
- C:\Windows\System\OdrSCqM.exe
  C:\Windows\System\OdrSCqM.exe
  2⤵
  - Executes dropped EXE
  PID:3312
- C:\Windows\System\soMeFiP.exe
  C:\Windows\System\soMeFiP.exe
  2⤵
  - Executes dropped EXE
  PID:5084
- C:\Windows\System\FEdEDSz.exe
  C:\Windows\System\FEdEDSz.exe
  2⤵
  - Executes dropped EXE
  PID:4260
- C:\Windows\System\rOAoHQL.exe
  C:\Windows\System\rOAoHQL.exe
  2⤵
  - Executes dropped EXE
  PID:1416
- C:\Windows\System\AJsLBOa.exe
  C:\Windows\System\AJsLBOa.exe
  2⤵
  - Executes dropped EXE
  PID:4716
- C:\Windows\System\oDQVJtF.exe
  C:\Windows\System\oDQVJtF.exe
  2⤵
  - Executes dropped EXE
  PID:4268
- C:\Windows\System\PXPnygI.exe
  C:\Windows\System\PXPnygI.exe
  2⤵
  - Executes dropped EXE
  PID:1464
- C:\Windows\System\AgFyxJY.exe
  C:\Windows\System\AgFyxJY.exe
  2⤵
  - Executes dropped EXE
  PID:364
- C:\Windows\System\ZkroPJv.exe
  C:\Windows\System\ZkroPJv.exe
  2⤵
  - Executes dropped EXE
  PID:4624
- C:\Windows\System\qBdzKnO.exe
  C:\Windows\System\qBdzKnO.exe
  2⤵
  - Executes dropped EXE
  PID:1608
- C:\Windows\System\qtDToQc.exe
  C:\Windows\System\qtDToQc.exe
  2⤵
  - Executes dropped EXE
  PID:2796
- C:\Windows\System\ANjpgjI.exe
  C:\Windows\System\ANjpgjI.exe
  2⤵
  - Executes dropped EXE
  PID:4440
- C:\Windows\System\cLaizTb.exe
  C:\Windows\System\cLaizTb.exe
  2⤵
  - Executes dropped EXE
  PID:3500
- C:\Windows\System\iMenYnB.exe
  C:\Windows\System\iMenYnB.exe
  2⤵
  - Executes dropped EXE
  PID:4172
- C:\Windows\System\cdYhoAF.exe
  C:\Windows\System\cdYhoAF.exe
  2⤵
  - Executes dropped EXE
  PID:404
- C:\Windows\System\tIGvenB.exe
  C:\Windows\System\tIGvenB.exe
  2⤵
  - Executes dropped EXE
  PID:1612
- C:\Windows\System\pUPfgMv.exe
  C:\Windows\System\pUPfgMv.exe
  2⤵
  - Executes dropped EXE
  PID:988
- C:\Windows\System\NWUTNBK.exe
  C:\Windows\System\NWUTNBK.exe
  2⤵
  - Executes dropped EXE
  PID:4584
- C:\Windows\System\HKIOuhf.exe
  C:\Windows\System\HKIOuhf.exe
  2⤵
  - Executes dropped EXE
  PID:2336
- C:\Windows\System\NgFdpIS.exe
  C:\Windows\System\NgFdpIS.exe
  2⤵
  - Executes dropped EXE
  PID:2320
- C:\Windows\System\lXyNsTP.exe
  C:\Windows\System\lXyNsTP.exe
  2⤵
  - Executes dropped EXE
  PID:3720
- C:\Windows\System\qBvlYtF.exe
  C:\Windows\System\qBvlYtF.exe
  2⤵
  - Executes dropped EXE
  PID:1468
- C:\Windows\System\kjzsfGb.exe
  C:\Windows\System\kjzsfGb.exe
  2⤵
  - Executes dropped EXE
  PID:4740
- C:\Windows\System\pPbmCRY.exe
  C:\Windows\System\pPbmCRY.exe
  2⤵
  - Executes dropped EXE
  PID:3224
- C:\Windows\System\GTaZptE.exe
  C:\Windows\System\GTaZptE.exe
  2⤵
  - Executes dropped EXE
  PID:4960
- C:\Windows\System\ETlOFiE.exe
  C:\Windows\System\ETlOFiE.exe
  2⤵
  - Executes dropped EXE
  PID:3052
- C:\Windows\System\DnCaina.exe
  C:\Windows\System\DnCaina.exe
  2⤵
  - Executes dropped EXE
  PID:2348
- C:\Windows\System\DnsdKPq.exe
  C:\Windows\System\DnsdKPq.exe
  2⤵
  - Executes dropped EXE
  PID:3148
- C:\Windows\System\drJeMwD.exe
  C:\Windows\System\drJeMwD.exe
  2⤵
  - Executes dropped EXE
  PID:2096
- C:\Windows\System\cwakZgK.exe
  C:\Windows\System\cwakZgK.exe
  2⤵
  - Executes dropped EXE
  PID:3172
- C:\Windows\System\jPFxvsA.exe
  C:\Windows\System\jPFxvsA.exe
  2⤵
  - Executes dropped EXE
  PID:4400
- C:\Windows\System\WlMFsEQ.exe
  C:\Windows\System\WlMFsEQ.exe
  2⤵
  - Executes dropped EXE
  PID:2544
- C:\Windows\System\AweLUMd.exe
  C:\Windows\System\AweLUMd.exe
  2⤵
  - Executes dropped EXE
  PID:1572
- C:\Windows\System\gjGKaxl.exe
  C:\Windows\System\gjGKaxl.exe
  2⤵
  - Executes dropped EXE
  PID:5012
- C:\Windows\System\qyvNaAw.exe
  C:\Windows\System\qyvNaAw.exe
  2⤵
  - Executes dropped EXE
  PID:4636
- C:\Windows\System\GCEohkt.exe
  C:\Windows\System\GCEohkt.exe
  2⤵
  - Executes dropped EXE
  PID:4644
- C:\Windows\System\MinbLXW.exe
  C:\Windows\System\MinbLXW.exe
  2⤵
  - Executes dropped EXE
  PID:4920
- C:\Windows\System\HiRPKmi.exe
  C:\Windows\System\HiRPKmi.exe
  2⤵
  - Executes dropped EXE
  PID:1512
- C:\Windows\System\BAxcijO.exe
  C:\Windows\System\BAxcijO.exe
  2⤵
  - Executes dropped EXE
  PID:4232
- C:\Windows\System\wXTAkHN.exe
  C:\Windows\System\wXTAkHN.exe
  2⤵
  - Executes dropped EXE
  PID:772
- C:\Windows\System\xDEBBZX.exe
  C:\Windows\System\xDEBBZX.exe
  2⤵
  - Executes dropped EXE
  PID:5088
- C:\Windows\System\mcrmBaB.exe
  C:\Windows\System\mcrmBaB.exe
  2⤵
  - Executes dropped EXE
  PID:184
- C:\Windows\System\VSmAmrO.exe
  C:\Windows\System\VSmAmrO.exe
  2⤵
  - Executes dropped EXE
  PID:2240
- C:\Windows\System\PHFAswj.exe
  C:\Windows\System\PHFAswj.exe
  2⤵
  - Executes dropped EXE
  PID:4008
- C:\Windows\System\oXOwmkB.exe
  C:\Windows\System\oXOwmkB.exe
  2⤵
  - Executes dropped EXE
  PID:2196
- C:\Windows\System\tUldvKX.exe
  C:\Windows\System\tUldvKX.exe
  2⤵
  - Executes dropped EXE
  PID:3416
- C:\Windows\System\zGmuhQw.exe
  C:\Windows\System\zGmuhQw.exe
  2⤵
  - Executes dropped EXE
  PID:1784
- C:\Windows\System\dvgjNHZ.exe
  C:\Windows\System\dvgjNHZ.exe
  2⤵
  - Executes dropped EXE
  PID:3196
- C:\Windows\System\ExJYTIM.exe
  C:\Windows\System\ExJYTIM.exe
  2⤵
  - Executes dropped EXE
  PID:3396
- C:\Windows\System\IZKUDci.exe
  C:\Windows\System\IZKUDci.exe
  2⤵
  PID:4764
- C:\Windows\System\cvUVVJA.exe
  C:\Windows\System\cvUVVJA.exe
  2⤵
  PID:2688
- C:\Windows\System\LGdTueU.exe
  C:\Windows\System\LGdTueU.exe
  2⤵
  PID:1380
- C:\Windows\System\UuwOCjY.exe
  C:\Windows\System\UuwOCjY.exe
  2⤵
  PID:3704
- C:\Windows\System\rjHWXkU.exe
  C:\Windows\System\rjHWXkU.exe
  2⤵
  PID:3016
- C:\Windows\System\ObFCjtH.exe
  C:\Windows\System\ObFCjtH.exe
  2⤵
  PID:2136
- C:\Windows\System\JSxvClv.exe
  C:\Windows\System\JSxvClv.exe
  2⤵
  PID:5008
- C:\Windows\System\pLiudqb.exe
  C:\Windows\System\pLiudqb.exe
  2⤵
  PID:4612
- C:\Windows\System\FsbmVba.exe
  C:\Windows\System\FsbmVba.exe
  2⤵
  PID:1932
- C:\Windows\System\veEUKEA.exe
  C:\Windows\System\veEUKEA.exe
  2⤵
  PID:4620
- C:\Windows\System\ghCGZHg.exe
  C:\Windows\System\ghCGZHg.exe
  2⤵
  PID:2548
- C:\Windows\System\HbLWxpS.exe
  C:\Windows\System\HbLWxpS.exe
  2⤵
  PID:4128
- C:\Windows\System\jrfBdes.exe
  C:\Windows\System\jrfBdes.exe
  2⤵
  PID:812
- C:\Windows\System\oRVQmkk.exe
  C:\Windows\System\oRVQmkk.exe
  2⤵
  PID:2940
- C:\Windows\System\UuLsBFg.exe
  C:\Windows\System\UuLsBFg.exe
  2⤵
  PID:1284
- C:\Windows\System\cWUUihh.exe
  C:\Windows\System\cWUUihh.exe
  2⤵
  PID:1076
- C:\Windows\System\ULsyWYU.exe
  C:\Windows\System\ULsyWYU.exe
  2⤵
  PID:3056
- C:\Windows\System\RXOcqYv.exe
  C:\Windows\System\RXOcqYv.exe
  2⤵
  PID:1212
- C:\Windows\System\JQkDVic.exe
  C:\Windows\System\JQkDVic.exe
  2⤵
  PID:5116
- C:\Windows\System\YkmneEP.exe
  C:\Windows\System\YkmneEP.exe
  2⤵
  PID:2588
- C:\Windows\System\ORKrswv.exe
  C:\Windows\System\ORKrswv.exe
  2⤵
  PID:4460
- C:\Windows\System\bdwQfeF.exe
  C:\Windows\System\bdwQfeF.exe
  2⤵
  PID:864
- C:\Windows\System\LDIsXzx.exe
  C:\Windows\System\LDIsXzx.exe
  2⤵
  PID:1672
- C:\Windows\System\ZDfxihL.exe
  C:\Windows\System\ZDfxihL.exe
  2⤵
  PID:1988
- C:\Windows\System\glDmXNG.exe
  C:\Windows\System\glDmXNG.exe
  2⤵
  PID:1420
- C:\Windows\System\mwAszFu.exe
  C:\Windows\System\mwAszFu.exe
  2⤵
  PID:3220
- C:\Windows\System\KAXvmKb.exe
  C:\Windows\System\KAXvmKb.exe
  2⤵
  PID:4940
- C:\Windows\System\MrlMMLf.exe
  C:\Windows\System\MrlMMLf.exe
  2⤵
  PID:2516
- C:\Windows\System\VEIOcAG.exe
  C:\Windows\System\VEIOcAG.exe
  2⤵
  PID:2720
- C:\Windows\System\gWKQgIF.exe
  C:\Windows\System\gWKQgIF.exe
  2⤵
  PID:408
- C:\Windows\System\sFIMkhd.exe
  C:\Windows\System\sFIMkhd.exe
  2⤵
  PID:1708
- C:\Windows\System\inQJkPf.exe
  C:\Windows\System\inQJkPf.exe
  2⤵
  PID:4184
- C:\Windows\System\SLuPIsA.exe
  C:\Windows\System\SLuPIsA.exe
  2⤵
  PID:4024
- C:\Windows\System\FSbBUmd.exe
  C:\Windows\System\FSbBUmd.exe
  2⤵
  PID:3000
- C:\Windows\System\wBNQQDM.exe
  C:\Windows\System\wBNQQDM.exe
  2⤵
  PID:5128
- C:\Windows\System\CdgkGYs.exe
  C:\Windows\System\CdgkGYs.exe
  2⤵
  PID:5168
- C:\Windows\System\maNttnN.exe
  C:\Windows\System\maNttnN.exe
  2⤵
  PID:5188
- C:\Windows\System\inVpSVa.exe
  C:\Windows\System\inVpSVa.exe
  2⤵
  PID:5208
- C:\Windows\System\rmgxsRv.exe
  C:\Windows\System\rmgxsRv.exe
  2⤵
  PID:5252
- C:\Windows\System\xTXJPxj.exe
  C:\Windows\System\xTXJPxj.exe
  2⤵
  PID:5284
- C:\Windows\System\KmlTpKD.exe
  C:\Windows\System\KmlTpKD.exe
  2⤵
  PID:5320
- C:\Windows\System\XopDaBu.exe
  C:\Windows\System\XopDaBu.exe
  2⤵
  PID:5352
- C:\Windows\System\wcGeoyE.exe
  C:\Windows\System\wcGeoyE.exe
  2⤵
  PID:5368
- C:\Windows\System\rHuVVXa.exe
  C:\Windows\System\rHuVVXa.exe
  2⤵
  PID:5388
- C:\Windows\System\JVaawYp.exe
  C:\Windows\System\JVaawYp.exe
  2⤵
  PID:5424
- C:\Windows\System\yfUyGDD.exe
  C:\Windows\System\yfUyGDD.exe
  2⤵
  PID:5452
- C:\Windows\System\nkWncrK.exe
  C:\Windows\System\nkWncrK.exe
  2⤵
  PID:5484
- C:\Windows\System\rLXHCOC.exe
  C:\Windows\System\rLXHCOC.exe
  2⤵
  PID:5520
- C:\Windows\System\oBnEmnP.exe
  C:\Windows\System\oBnEmnP.exe
  2⤵
  PID:5548
- C:\Windows\System\dQGVdrS.exe
  C:\Windows\System\dQGVdrS.exe
  2⤵
  PID:5576
- C:\Windows\System\XjlbnWR.exe
  C:\Windows\System\XjlbnWR.exe
  2⤵
  PID:5608
- C:\Windows\System\SDiGDxZ.exe
  C:\Windows\System\SDiGDxZ.exe
  2⤵
  PID:5636
- C:\Windows\System\WdeIrDB.exe
  C:\Windows\System\WdeIrDB.exe
  2⤵
  PID:5676
- C:\Windows\System\TIbnxkJ.exe
  C:\Windows\System\TIbnxkJ.exe
  2⤵
  PID:5704
- C:\Windows\System\TEdunKh.exe
  C:\Windows\System\TEdunKh.exe
  2⤵
  PID:5740
- C:\Windows\System\kWpKDKW.exe
  C:\Windows\System\kWpKDKW.exe
  2⤵
  PID:5784
- C:\Windows\System\NkHerVw.exe
  C:\Windows\System\NkHerVw.exe
  2⤵
  PID:5816
- C:\Windows\System\WubnPnk.exe
  C:\Windows\System\WubnPnk.exe
  2⤵
  PID:5832
- C:\Windows\System\tMkTkdS.exe
  C:\Windows\System\tMkTkdS.exe
  2⤵
  PID:5864
- C:\Windows\System\LEUKfSt.exe
  C:\Windows\System\LEUKfSt.exe
  2⤵
  PID:5900
- C:\Windows\System\zgMsiva.exe
  C:\Windows\System\zgMsiva.exe
  2⤵
  PID:5928
- C:\Windows\System\uountCn.exe
  C:\Windows\System\uountCn.exe
  2⤵
  PID:5956
- C:\Windows\System\NmJvGEz.exe
  C:\Windows\System\NmJvGEz.exe
  2⤵
  PID:5984
- C:\Windows\System\jhtslyw.exe
  C:\Windows\System\jhtslyw.exe
  2⤵
  PID:6016
- C:\Windows\System\yFMXVmt.exe
  C:\Windows\System\yFMXVmt.exe
  2⤵
  PID:6032
- C:\Windows\System\SahAzjI.exe
  C:\Windows\System\SahAzjI.exe
  2⤵
  PID:6060
- C:\Windows\System\MebCpFM.exe
  C:\Windows\System\MebCpFM.exe
  2⤵
  PID:6076
- C:\Windows\System\CQSfnwX.exe
  C:\Windows\System\CQSfnwX.exe
  2⤵
  PID:6108
- C:\Windows\System\PqNgGAw.exe
  C:\Windows\System\PqNgGAw.exe
  2⤵
  PID:6136
- C:\Windows\System\KCgdhib.exe
  C:\Windows\System\KCgdhib.exe
  2⤵
  PID:5184
- C:\Windows\System\vZBHkOB.exe
  C:\Windows\System\vZBHkOB.exe
  2⤵
  PID:5268
- C:\Windows\System\mPEmeGE.exe
  C:\Windows\System\mPEmeGE.exe
  2⤵
  PID:5308
- C:\Windows\System\PwBTCEE.exe
  C:\Windows\System\PwBTCEE.exe
  2⤵
  PID:5404
- C:\Windows\System\zoSjfQt.exe
  C:\Windows\System\zoSjfQt.exe
  2⤵
  PID:5396
- C:\Windows\System\CQYaJoC.exe
  C:\Windows\System\CQYaJoC.exe
  2⤵
  PID:5508
- C:\Windows\System\RwbSqtg.exe
  C:\Windows\System\RwbSqtg.exe
  2⤵
  PID:5572
- C:\Windows\System\LUIOPLl.exe
  C:\Windows\System\LUIOPLl.exe
  2⤵
  PID:5644
- C:\Windows\System\fGXqGgq.exe
  C:\Windows\System\fGXqGgq.exe
  2⤵
  PID:2628
- C:\Windows\System\CjRxhQE.exe
  C:\Windows\System\CjRxhQE.exe
  2⤵
  PID:5780
- C:\Windows\System\zrVWSJe.exe
  C:\Windows\System\zrVWSJe.exe
  2⤵
  PID:5844
- C:\Windows\System\yIxvgNP.exe
  C:\Windows\System\yIxvgNP.exe
  2⤵
  PID:5912
- C:\Windows\System\XVGfdLT.exe
  C:\Windows\System\XVGfdLT.exe
  2⤵
  PID:2968
- C:\Windows\System\pWfWTxW.exe
  C:\Windows\System\pWfWTxW.exe
  2⤵
  PID:5980
- C:\Windows\System\YvitGmP.exe
  C:\Windows\System\YvitGmP.exe
  2⤵
  PID:2696
- C:\Windows\System\WVzWLQa.exe
  C:\Windows\System\WVzWLQa.exe
  2⤵
  PID:6044
- C:\Windows\System\IQquhGh.exe
  C:\Windows\System\IQquhGh.exe
  2⤵
  PID:1620
- C:\Windows\System\eUFjDcA.exe
  C:\Windows\System\eUFjDcA.exe
  2⤵
  PID:6096
- C:\Windows\System\nuFKgTI.exe
  C:\Windows\System\nuFKgTI.exe
  2⤵
  PID:5216
- C:\Windows\System\jSRDJyp.exe
  C:\Windows\System\jSRDJyp.exe
  2⤵
  PID:5408
- C:\Windows\System\sOjtqIE.exe
  C:\Windows\System\sOjtqIE.exe
  2⤵
  PID:5476
- C:\Windows\System\ZbpNTCu.exe
  C:\Windows\System\ZbpNTCu.exe
  2⤵
  PID:5624
- C:\Windows\System\DhJDjLO.exe
  C:\Windows\System\DhJDjLO.exe
  2⤵
  PID:5732
- C:\Windows\System\mrdcbtz.exe
  C:\Windows\System\mrdcbtz.exe
  2⤵
  PID:5952
- C:\Windows\System\rgceRsj.exe
  C:\Windows\System\rgceRsj.exe
  2⤵
  PID:808
- C:\Windows\System\iitQAKQ.exe
  C:\Windows\System\iitQAKQ.exe
  2⤵
  PID:6072
- C:\Windows\System\ddPOsAU.exe
  C:\Windows\System\ddPOsAU.exe
  2⤵
  PID:5152
- C:\Windows\System\uuYRZKl.exe
  C:\Windows\System\uuYRZKl.exe
  2⤵
  PID:5664
- C:\Windows\System\actraQD.exe
  C:\Windows\System\actraQD.exe
  2⤵
  PID:2876
- C:\Windows\System\gVocLrS.exe
  C:\Windows\System\gVocLrS.exe
  2⤵
  PID:3960
- C:\Windows\System\WdikepQ.exe
  C:\Windows\System\WdikepQ.exe
  2⤵
  PID:3476
- C:\Windows\System\vCXyahZ.exe
  C:\Windows\System\vCXyahZ.exe
  2⤵
  PID:6164
- C:\Windows\System\cUAIjST.exe
  C:\Windows\System\cUAIjST.exe
  2⤵
  PID:6180
- C:\Windows\System\wqHWfsp.exe
  C:\Windows\System\wqHWfsp.exe
  2⤵
  PID:6208
- C:\Windows\System\pPSdgRO.exe
  C:\Windows\System\pPSdgRO.exe
  2⤵
  PID:6236
- C:\Windows\System\rLtynNx.exe
  C:\Windows\System\rLtynNx.exe
  2⤵
  PID:6264
- C:\Windows\System\MXDEtQb.exe
  C:\Windows\System\MXDEtQb.exe
  2⤵
  PID:6288
- C:\Windows\System\XdDEBqn.exe
  C:\Windows\System\XdDEBqn.exe
  2⤵
  PID:6308
- C:\Windows\System\JkBLHEo.exe
  C:\Windows\System\JkBLHEo.exe
  2⤵
  PID:6336
- C:\Windows\System\MBIbOtZ.exe
  C:\Windows\System\MBIbOtZ.exe
  2⤵
  PID:6360
- C:\Windows\System\btlVKIM.exe
  C:\Windows\System\btlVKIM.exe
  2⤵
  PID:6392
- C:\Windows\System\LsxbuFi.exe
  C:\Windows\System\LsxbuFi.exe
  2⤵
  PID:6424
- C:\Windows\System\cZHHzxL.exe
  C:\Windows\System\cZHHzxL.exe
  2⤵
  PID:6460
- C:\Windows\System\BEERvAT.exe
  C:\Windows\System\BEERvAT.exe
  2⤵
  PID:6496
- C:\Windows\System\WhTgzCw.exe
  C:\Windows\System\WhTgzCw.exe
  2⤵
  PID:6528
- C:\Windows\System\JAaaJVx.exe
  C:\Windows\System\JAaaJVx.exe
  2⤵
  PID:6556
- C:\Windows\System\MtlwFji.exe
  C:\Windows\System\MtlwFji.exe
  2⤵
  PID:6576
- C:\Windows\System\ToKoUOw.exe
  C:\Windows\System\ToKoUOw.exe
  2⤵
  PID:6608
- C:\Windows\System\NtplWUa.exe
  C:\Windows\System\NtplWUa.exe
  2⤵
  PID:6644
- C:\Windows\System\BxcrMFP.exe
  C:\Windows\System\BxcrMFP.exe
  2⤵
  PID:6672
- C:\Windows\System\FYEPlwi.exe
  C:\Windows\System\FYEPlwi.exe
  2⤵
  PID:6696
- C:\Windows\System\HOwFKcm.exe
  C:\Windows\System\HOwFKcm.exe
  2⤵
  PID:6728
- C:\Windows\System\ZmNOcIK.exe
  C:\Windows\System\ZmNOcIK.exe
  2⤵
  PID:6756
- C:\Windows\System\BgSzkXS.exe
  C:\Windows\System\BgSzkXS.exe
  2⤵
  PID:6784
- C:\Windows\System\yHajHbf.exe
  C:\Windows\System\yHajHbf.exe
  2⤵
  PID:6812
- C:\Windows\System\OTqOymW.exe
  C:\Windows\System\OTqOymW.exe
  2⤵
  PID:6836
- C:\Windows\System\drChTXh.exe
  C:\Windows\System\drChTXh.exe
  2⤵
  PID:6864
- C:\Windows\System\NmDettX.exe
  C:\Windows\System\NmDettX.exe
  2⤵
  PID:6888
- C:\Windows\System\jBDcmtJ.exe
  C:\Windows\System\jBDcmtJ.exe
  2⤵
  PID:6912
- C:\Windows\System\dmnkFPU.exe
  C:\Windows\System\dmnkFPU.exe
  2⤵
  PID:6948
- C:\Windows\System\FUbvQyB.exe
  C:\Windows\System\FUbvQyB.exe
  2⤵
  PID:6964
- C:\Windows\System\HmTyQeA.exe
  C:\Windows\System\HmTyQeA.exe
  2⤵
  PID:7000
- C:\Windows\System\oahLRoM.exe
  C:\Windows\System\oahLRoM.exe
  2⤵
  PID:7028
- C:\Windows\System\NwSHJZk.exe
  C:\Windows\System\NwSHJZk.exe
  2⤵
  PID:7052
- C:\Windows\System\axfXsHm.exe
  C:\Windows\System\axfXsHm.exe
  2⤵
  PID:7088
- C:\Windows\System\gSaeoGP.exe
  C:\Windows\System\gSaeoGP.exe
  2⤵
  PID:7108
- C:\Windows\System\NCxmHzO.exe
  C:\Windows\System\NCxmHzO.exe
  2⤵
  PID:7144
- C:\Windows\System\gqMHdBB.exe
  C:\Windows\System\gqMHdBB.exe
  2⤵
  PID:5824
- C:\Windows\System\pdoyzVu.exe
  C:\Windows\System\pdoyzVu.exe
  2⤵
  PID:6176
- C:\Windows\System\ymIBYDx.exe
  C:\Windows\System\ymIBYDx.exe
  2⤵
  PID:6232
- C:\Windows\System\PefYxcJ.exe
  C:\Windows\System\PefYxcJ.exe
  2⤵
  PID:6296
- C:\Windows\System\Ifjkisb.exe
  C:\Windows\System\Ifjkisb.exe
  2⤵
  PID:6328
- C:\Windows\System\wtJGzvW.exe
  C:\Windows\System\wtJGzvW.exe
  2⤵
  PID:6420
- C:\Windows\System\kiIZWBe.exe
  C:\Windows\System\kiIZWBe.exe
  2⤵
  PID:6488
- C:\Windows\System\taEYNis.exe
  C:\Windows\System\taEYNis.exe
  2⤵
  PID:6568
- C:\Windows\System\wxTekGQ.exe
  C:\Windows\System\wxTekGQ.exe
  2⤵
  PID:6596
- C:\Windows\System\SWFzLkP.exe
  C:\Windows\System\SWFzLkP.exe
  2⤵
  PID:6664
- C:\Windows\System\fGlZtkF.exe
  C:\Windows\System\fGlZtkF.exe
  2⤵
  PID:6716
- C:\Windows\System\wAxVCXa.exe
  C:\Windows\System\wAxVCXa.exe
  2⤵
  PID:6796
- C:\Windows\System\cNygdBe.exe
  C:\Windows\System\cNygdBe.exe
  2⤵
  PID:6852
- C:\Windows\System\MXYXpCo.exe
  C:\Windows\System\MXYXpCo.exe
  2⤵
  PID:6920
- C:\Windows\System\sieBpRW.exe
  C:\Windows\System\sieBpRW.exe
  2⤵
  PID:6980
- C:\Windows\System\qXWESVu.exe
  C:\Windows\System\qXWESVu.exe
  2⤵
  PID:7044
- C:\Windows\System\FBcfpfm.exe
  C:\Windows\System\FBcfpfm.exe
  2⤵
  PID:7096
- C:\Windows\System\ovZOhgC.exe
  C:\Windows\System\ovZOhgC.exe
  2⤵
  PID:6196
- C:\Windows\System\ONaGhrO.exe
  C:\Windows\System\ONaGhrO.exe
  2⤵
  PID:6228
- C:\Windows\System\egqNbaM.exe
  C:\Windows\System\egqNbaM.exe
  2⤵
  PID:6324
- C:\Windows\System\cGUOSUZ.exe
  C:\Windows\System\cGUOSUZ.exe
  2⤵
  PID:6444
- C:\Windows\System\hIipwnM.exe
  C:\Windows\System\hIipwnM.exe
  2⤵
  PID:6548
- C:\Windows\System\MVDVVOt.exe
  C:\Windows\System\MVDVVOt.exe
  2⤵
  PID:6704
- C:\Windows\System\SuBxEFN.exe
  C:\Windows\System\SuBxEFN.exe
  2⤵
  PID:6876
- C:\Windows\System\uefpIPZ.exe
  C:\Windows\System\uefpIPZ.exe
  2⤵
  PID:7020
- C:\Windows\System\ouFSnYS.exe
  C:\Windows\System\ouFSnYS.exe
  2⤵
  PID:7156
- C:\Windows\System\WExQRNB.exe
  C:\Windows\System\WExQRNB.exe
  2⤵
  PID:6152
- C:\Windows\System\NGRTjoa.exe
  C:\Windows\System\NGRTjoa.exe
  2⤵
  PID:6588
- C:\Windows\System\CWDbOQq.exe
  C:\Windows\System\CWDbOQq.exe
  2⤵
  PID:7068
- C:\Windows\System\ymUlZyv.exe
  C:\Windows\System\ymUlZyv.exe
  2⤵
  PID:7184
- C:\Windows\System\JTOSsKq.exe
  C:\Windows\System\JTOSsKq.exe
  2⤵
  PID:7208
- C:\Windows\System\zJJRcPO.exe
  C:\Windows\System\zJJRcPO.exe
  2⤵
  PID:7232
- C:\Windows\System\ktibrvl.exe
  C:\Windows\System\ktibrvl.exe
  2⤵
  PID:7260
- C:\Windows\System\vCwpTEp.exe
  C:\Windows\System\vCwpTEp.exe
  2⤵
  PID:7296
- C:\Windows\System\LIrKWXe.exe
  C:\Windows\System\LIrKWXe.exe
  2⤵
  PID:7324
- C:\Windows\System\ryvmmEo.exe
  C:\Windows\System\ryvmmEo.exe
  2⤵
  PID:7344
- C:\Windows\System\IApoFQJ.exe
  C:\Windows\System\IApoFQJ.exe
  2⤵
  PID:7376
- C:\Windows\System\JUlWlVI.exe
  C:\Windows\System\JUlWlVI.exe
  2⤵
  PID:7404
- C:\Windows\System\XxIRWiy.exe
  C:\Windows\System\XxIRWiy.exe
  2⤵
  PID:7432
- C:\Windows\System\CSVPwox.exe
  C:\Windows\System\CSVPwox.exe
  2⤵
  PID:7456
- C:\Windows\System\NwOXOka.exe
  C:\Windows\System\NwOXOka.exe
  2⤵
  PID:7488
- C:\Windows\System\AGfsJbH.exe
  C:\Windows\System\AGfsJbH.exe
  2⤵
  PID:7516
- C:\Windows\System\pMhNiia.exe
  C:\Windows\System\pMhNiia.exe
  2⤵
  PID:7544
- C:\Windows\System\VwZXZvC.exe
  C:\Windows\System\VwZXZvC.exe
  2⤵
  PID:7568
- C:\Windows\System\NJZdMhs.exe
  C:\Windows\System\NJZdMhs.exe
  2⤵
  PID:7600
- C:\Windows\System\fnrklfC.exe
  C:\Windows\System\fnrklfC.exe
  2⤵
  PID:7628
- C:\Windows\System\nbzxafN.exe
  C:\Windows\System\nbzxafN.exe
  2⤵
  PID:7664
- C:\Windows\System\npiUWHy.exe
  C:\Windows\System\npiUWHy.exe
  2⤵
  PID:7700
- C:\Windows\System\VNtpHeD.exe
  C:\Windows\System\VNtpHeD.exe
  2⤵
  PID:7728
- C:\Windows\System\ZZTdduZ.exe
  C:\Windows\System\ZZTdduZ.exe
  2⤵
  PID:7756
- C:\Windows\System\fUSXPvG.exe
  C:\Windows\System\fUSXPvG.exe
  2⤵
  PID:7776
- C:\Windows\System\BqpmIbw.exe
  C:\Windows\System\BqpmIbw.exe
  2⤵
  PID:7796
- C:\Windows\System\LdrVBRe.exe
  C:\Windows\System\LdrVBRe.exe
  2⤵
  PID:7812
- C:\Windows\System\kbHePTR.exe
  C:\Windows\System\kbHePTR.exe
  2⤵
  PID:7828
- C:\Windows\System\RfyyRdq.exe
  C:\Windows\System\RfyyRdq.exe
  2⤵
  PID:7860
- C:\Windows\System\EcMQIxG.exe
  C:\Windows\System\EcMQIxG.exe
  2⤵
  PID:7884
- C:\Windows\System\bFKPuUM.exe
  C:\Windows\System\bFKPuUM.exe
  2⤵
  PID:7920
- C:\Windows\System\aCFVVei.exe
  C:\Windows\System\aCFVVei.exe
  2⤵
  PID:7936
- C:\Windows\System\EsSymUt.exe
  C:\Windows\System\EsSymUt.exe
  2⤵
  PID:7972
- C:\Windows\System\lBIdFff.exe
  C:\Windows\System\lBIdFff.exe
  2⤵
  PID:7996
- C:\Windows\System\BBJmnbZ.exe
  C:\Windows\System\BBJmnbZ.exe
  2⤵
  PID:8016
- C:\Windows\System\SCjgBTs.exe
  C:\Windows\System\SCjgBTs.exe
  2⤵
  PID:8048
- C:\Windows\System\tbDGKOn.exe
  C:\Windows\System\tbDGKOn.exe
  2⤵
  PID:8076
- C:\Windows\System\mIhWXaY.exe
  C:\Windows\System\mIhWXaY.exe
  2⤵
  PID:8108
- C:\Windows\System\IgcFtsQ.exe
  C:\Windows\System\IgcFtsQ.exe
  2⤵
  PID:8132
- C:\Windows\System\xiEpEsk.exe
  C:\Windows\System\xiEpEsk.exe
  2⤵
  PID:8160
- C:\Windows\System\XvHdDmt.exe
  C:\Windows\System\XvHdDmt.exe
  2⤵
  PID:8188
- C:\Windows\System\Fkosqad.exe
  C:\Windows\System\Fkosqad.exe
  2⤵
  PID:6976
- C:\Windows\System\wKedIDh.exe
  C:\Windows\System\wKedIDh.exe
  2⤵
  PID:7200
- C:\Windows\System\KYxAKFl.exe
  C:\Windows\System\KYxAKFl.exe
  2⤵
  PID:7280
- C:\Windows\System\iVwCAWy.exe
  C:\Windows\System\iVwCAWy.exe
  2⤵
  PID:7284
- C:\Windows\System\cRaKIgn.exe
  C:\Windows\System\cRaKIgn.exe
  2⤵
  PID:1376
- C:\Windows\System\ikVEOVh.exe
  C:\Windows\System\ikVEOVh.exe
  2⤵
  PID:7412
- C:\Windows\System\baajhRJ.exe
  C:\Windows\System\baajhRJ.exe
  2⤵
  PID:7468
- C:\Windows\System\WlqYyRR.exe
  C:\Windows\System\WlqYyRR.exe
  2⤵
  PID:7496
- C:\Windows\System\jpaYpPr.exe
  C:\Windows\System\jpaYpPr.exe
  2⤵
  PID:7528
- C:\Windows\System\vIsLwHq.exe
  C:\Windows\System\vIsLwHq.exe
  2⤵
  PID:7552
- C:\Windows\System\jorxDVl.exe
  C:\Windows\System\jorxDVl.exe
  2⤵
  PID:7744
- C:\Windows\System\qJDRQEv.exe
  C:\Windows\System\qJDRQEv.exe
  2⤵
  PID:7788
- C:\Windows\System\vIdZfFo.exe
  C:\Windows\System\vIdZfFo.exe
  2⤵
  PID:7848
- C:\Windows\System\eEYALOO.exe
  C:\Windows\System\eEYALOO.exe
  2⤵
  PID:7964
- C:\Windows\System\BbynPQV.exe
  C:\Windows\System\BbynPQV.exe
  2⤵
  PID:7992
- C:\Windows\System\UCuISkD.exe
  C:\Windows\System\UCuISkD.exe
  2⤵
  PID:8060
- C:\Windows\System\YwzZVvQ.exe
  C:\Windows\System\YwzZVvQ.exe
  2⤵
  PID:8168
- C:\Windows\System\TzyBhQA.exe
  C:\Windows\System\TzyBhQA.exe
  2⤵
  PID:6740
- C:\Windows\System\sJifcdM.exe
  C:\Windows\System\sJifcdM.exe
  2⤵
  PID:6516
- C:\Windows\System\Rdydcuh.exe
  C:\Windows\System\Rdydcuh.exe
  2⤵
  PID:7452
- C:\Windows\System\AehjXQG.exe
  C:\Windows\System\AehjXQG.exe
  2⤵
  PID:7592
- C:\Windows\System\mrTnQLn.exe
  C:\Windows\System\mrTnQLn.exe
  2⤵
  PID:7420
- C:\Windows\System\HjQhoRJ.exe
  C:\Windows\System\HjQhoRJ.exe
  2⤵
  PID:8072
- C:\Windows\System\JSNdHzV.exe
  C:\Windows\System\JSNdHzV.exe
  2⤵
  PID:8040
- C:\Windows\System\YotcWXj.exe
  C:\Windows\System\YotcWXj.exe
  2⤵
  PID:7880
- C:\Windows\System\fkNEeYH.exe
  C:\Windows\System\fkNEeYH.exe
  2⤵
  PID:8148
- C:\Windows\System\MdcENyy.exe
  C:\Windows\System\MdcENyy.exe
  2⤵
  PID:7912
- C:\Windows\System\KyKLabJ.exe
  C:\Windows\System\KyKLabJ.exe
  2⤵
  PID:7472
- C:\Windows\System\OuCCIWf.exe
  C:\Windows\System\OuCCIWf.exe
  2⤵
  PID:7352
- C:\Windows\System\BgAekUb.exe
  C:\Windows\System\BgAekUb.exe
  2⤵
  PID:8200
- C:\Windows\System\jkImNpj.exe
  C:\Windows\System\jkImNpj.exe
  2⤵
  PID:8228
- C:\Windows\System\NrFEDpu.exe
  C:\Windows\System\NrFEDpu.exe
  2⤵
  PID:8264
- C:\Windows\System\VFjToAb.exe
  C:\Windows\System\VFjToAb.exe
  2⤵
  PID:8296
- C:\Windows\System\WSVWCrp.exe
  C:\Windows\System\WSVWCrp.exe
  2⤵
  PID:8324
- C:\Windows\System\KQTdJJS.exe
  C:\Windows\System\KQTdJJS.exe
  2⤵
  PID:8360
- C:\Windows\System\WLICAeL.exe
  C:\Windows\System\WLICAeL.exe
  2⤵
  PID:8400
- C:\Windows\System\SeuLVFs.exe
  C:\Windows\System\SeuLVFs.exe
  2⤵
  PID:8420
- C:\Windows\System\hFwEPGE.exe
  C:\Windows\System\hFwEPGE.exe
  2⤵
  PID:8452
- C:\Windows\System\celYPZf.exe
  C:\Windows\System\celYPZf.exe
  2⤵
  PID:8476
- C:\Windows\System\baTMfPw.exe
  C:\Windows\System\baTMfPw.exe
  2⤵
  PID:8512
- C:\Windows\System\SUqcWbp.exe
  C:\Windows\System\SUqcWbp.exe
  2⤵
  PID:8544
- C:\Windows\System\JBGSgew.exe
  C:\Windows\System\JBGSgew.exe
  2⤵
  PID:8568
- C:\Windows\System\QSyWdSI.exe
  C:\Windows\System\QSyWdSI.exe
  2⤵
  PID:8588
- C:\Windows\System\NDzaWgl.exe
  C:\Windows\System\NDzaWgl.exe
  2⤵
  PID:8604
- C:\Windows\System\HFPmHje.exe
  C:\Windows\System\HFPmHje.exe
  2⤵
  PID:8632
- C:\Windows\System\OizcBbS.exe
  C:\Windows\System\OizcBbS.exe
  2⤵
  PID:8656
- C:\Windows\System\PWLgdqM.exe
  C:\Windows\System\PWLgdqM.exe
  2⤵
  PID:8680
- C:\Windows\System\uGRbJvX.exe
  C:\Windows\System\uGRbJvX.exe
  2⤵
  PID:8716
- C:\Windows\System\zLkjLKQ.exe
  C:\Windows\System\zLkjLKQ.exe
  2⤵
  PID:8744
- C:\Windows\System\VuKnvCT.exe
  C:\Windows\System\VuKnvCT.exe
  2⤵
  PID:8780
- C:\Windows\System\SNdwozk.exe
  C:\Windows\System\SNdwozk.exe
  2⤵
  PID:8808
- C:\Windows\System\UmFZvEw.exe
  C:\Windows\System\UmFZvEw.exe
  2⤵
  PID:8836
- C:\Windows\System\nmwowKo.exe
  C:\Windows\System\nmwowKo.exe
  2⤵
  PID:8864
- C:\Windows\System\IshchIQ.exe
  C:\Windows\System\IshchIQ.exe
  2⤵
  PID:8896
- C:\Windows\System\AWRsSns.exe
  C:\Windows\System\AWRsSns.exe
  2⤵
  PID:8916
- C:\Windows\System\mijbQOr.exe
  C:\Windows\System\mijbQOr.exe
  2⤵
  PID:8948
- C:\Windows\System\eWQBvRa.exe
  C:\Windows\System\eWQBvRa.exe
  2⤵
  PID:8980
- C:\Windows\System\nlPthxr.exe
  C:\Windows\System\nlPthxr.exe
  2⤵
  PID:9000
- C:\Windows\System\RLvCkeY.exe
  C:\Windows\System\RLvCkeY.exe
  2⤵
  PID:9032
- C:\Windows\System\ZWRwRQJ.exe
  C:\Windows\System\ZWRwRQJ.exe
  2⤵
  PID:9064
- C:\Windows\System\sxnTnRP.exe
  C:\Windows\System\sxnTnRP.exe
  2⤵
  PID:9088
- C:\Windows\System\tLMGPrW.exe
  C:\Windows\System\tLMGPrW.exe
  2⤵
  PID:9116
- C:\Windows\System\GOLkwPK.exe
  C:\Windows\System\GOLkwPK.exe
  2⤵
  PID:9148
- C:\Windows\System\yEMlWzZ.exe
  C:\Windows\System\yEMlWzZ.exe
  2⤵
  PID:9176
- C:\Windows\System\mcibkzX.exe
  C:\Windows\System\mcibkzX.exe
  2⤵
  PID:9208
- C:\Windows\System\JQfvZfE.exe
  C:\Windows\System\JQfvZfE.exe
  2⤵
  PID:7808
- C:\Windows\System\vZMozfn.exe
  C:\Windows\System\vZMozfn.exe
  2⤵
  PID:8216
- C:\Windows\System\Dighsql.exe
  C:\Windows\System\Dighsql.exe
  2⤵
  PID:8344
- C:\Windows\System\cuSRPQG.exe
  C:\Windows\System\cuSRPQG.exe
  2⤵
  PID:8444
- C:\Windows\System\UgkUhUI.exe
  C:\Windows\System\UgkUhUI.exe
  2⤵
  PID:8436
- C:\Windows\System\WJuPfAf.exe
  C:\Windows\System\WJuPfAf.exe
  2⤵
  PID:8560
- C:\Windows\System\CMlXTAV.exe
  C:\Windows\System\CMlXTAV.exe
  2⤵
  PID:8472
- C:\Windows\System\ygHUlaL.exe
  C:\Windows\System\ygHUlaL.exe
  2⤵
  PID:8692
- C:\Windows\System\wCsiJKT.exe
  C:\Windows\System\wCsiJKT.exe
  2⤵
  PID:8644
- C:\Windows\System\eGGyqPZ.exe
  C:\Windows\System\eGGyqPZ.exe
  2⤵
  PID:8704
- C:\Windows\System\wphDQuK.exe
  C:\Windows\System\wphDQuK.exe
  2⤵
  PID:8888
- C:\Windows\System\JITjQSD.exe
  C:\Windows\System\JITjQSD.exe
  2⤵
  PID:8972
- C:\Windows\System\MJYMOdZ.exe
  C:\Windows\System\MJYMOdZ.exe
  2⤵
  PID:8956
- C:\Windows\System\vCKoBah.exe
  C:\Windows\System\vCKoBah.exe
  2⤵
  PID:8936
- C:\Windows\System\wyMWeMg.exe
  C:\Windows\System\wyMWeMg.exe
  2⤵
  PID:9128
- C:\Windows\System\CClbRYH.exe
  C:\Windows\System\CClbRYH.exe
  2⤵
  PID:9184
- C:\Windows\System\dgrQEhP.exe
  C:\Windows\System\dgrQEhP.exe
  2⤵
  PID:7620
- C:\Windows\System\uPqzCmu.exe
  C:\Windows\System\uPqzCmu.exe
  2⤵
  PID:8240
- C:\Windows\System\mGurloE.exe
  C:\Windows\System\mGurloE.exe
  2⤵
  PID:8464
- C:\Windows\System\kukJBDh.exe
  C:\Windows\System\kukJBDh.exe
  2⤵
  PID:8740
- C:\Windows\System\KRrbiCP.exe
  C:\Windows\System\KRrbiCP.exe
  2⤵
  PID:8648
- C:\Windows\System\gXNUwep.exe
  C:\Windows\System\gXNUwep.exe
  2⤵
  PID:8908
- C:\Windows\System\yHkhZeZ.exe
  C:\Windows\System\yHkhZeZ.exe
  2⤵
  PID:8848
- C:\Windows\System\TDxHLhP.exe
  C:\Windows\System\TDxHLhP.exe
  2⤵
  PID:9100
- C:\Windows\System\BCetOWF.exe
  C:\Windows\System\BCetOWF.exe
  2⤵
  PID:8212
- C:\Windows\System\pxNNfxY.exe
  C:\Windows\System\pxNNfxY.exe
  2⤵
  PID:8392
- C:\Windows\System\fJyGznf.exe
  C:\Windows\System\fJyGznf.exe
  2⤵
  PID:8876
- C:\Windows\System\fLSSQqc.exe
  C:\Windows\System\fLSSQqc.exe
  2⤵
  PID:9228
- C:\Windows\System\pUzYOFs.exe
  C:\Windows\System\pUzYOFs.exe
  2⤵
  PID:9256
- C:\Windows\System\dVavbje.exe
  C:\Windows\System\dVavbje.exe
  2⤵
  PID:9276
- C:\Windows\System\IBCSDcW.exe
  C:\Windows\System\IBCSDcW.exe
  2⤵
  PID:9308
- C:\Windows\System\uyfXrKt.exe
  C:\Windows\System\uyfXrKt.exe
  2⤵
  PID:9340
- C:\Windows\System\GAbgsPS.exe
  C:\Windows\System\GAbgsPS.exe
  2⤵
  PID:9360
- C:\Windows\System\LVRmqPX.exe
  C:\Windows\System\LVRmqPX.exe
  2⤵
  PID:9384
- C:\Windows\System\ZuBQjtc.exe
  C:\Windows\System\ZuBQjtc.exe
  2⤵
  PID:9408
- C:\Windows\System\HhWbCHc.exe
  C:\Windows\System\HhWbCHc.exe
  2⤵
  PID:9448
- C:\Windows\System\sUAXNQE.exe
  C:\Windows\System\sUAXNQE.exe
  2⤵
  PID:9480
- C:\Windows\System\awbslUf.exe
  C:\Windows\System\awbslUf.exe
  2⤵
  PID:9520
- C:\Windows\System\LUnEIOi.exe
  C:\Windows\System\LUnEIOi.exe
  2⤵
  PID:9548
- C:\Windows\System\DGHgdiu.exe
  C:\Windows\System\DGHgdiu.exe
  2⤵
  PID:9580
- C:\Windows\System\TxeDsMd.exe
  C:\Windows\System\TxeDsMd.exe
  2⤵
  PID:9600
- C:\Windows\System\JLyOPTa.exe
  C:\Windows\System\JLyOPTa.exe
  2⤵
  PID:9636
- C:\Windows\System\unDNbUj.exe
  C:\Windows\System\unDNbUj.exe
  2⤵
  PID:9668
- C:\Windows\System\gAODwBI.exe
  C:\Windows\System\gAODwBI.exe
  2⤵
  PID:9692
- C:\Windows\System\bfWlqnA.exe
  C:\Windows\System\bfWlqnA.exe
  2⤵
  PID:9720
- C:\Windows\System\qPmLISA.exe
  C:\Windows\System\qPmLISA.exe
  2⤵
  PID:9752
- C:\Windows\System\PsXfUVZ.exe
  C:\Windows\System\PsXfUVZ.exe
  2⤵
  PID:9776
- C:\Windows\System\ZVROnNC.exe
  C:\Windows\System\ZVROnNC.exe
  2⤵
  PID:9800
- C:\Windows\System\FywCKnw.exe
  C:\Windows\System\FywCKnw.exe
  2⤵
  PID:9832
- C:\Windows\System\TzfZTeS.exe
  C:\Windows\System\TzfZTeS.exe
  2⤵
  PID:9856
- C:\Windows\System\DdtuGmc.exe
  C:\Windows\System\DdtuGmc.exe
  2⤵
  PID:9888
- C:\Windows\System\YfiddcT.exe
  C:\Windows\System\YfiddcT.exe
  2⤵
  PID:9916
- C:\Windows\System\udqPmfW.exe
  C:\Windows\System\udqPmfW.exe
  2⤵
  PID:9936
- C:\Windows\System\YOwjHii.exe
  C:\Windows\System\YOwjHii.exe
  2⤵
  PID:9972
- C:\Windows\System\OvYDmzK.exe
  C:\Windows\System\OvYDmzK.exe
  2⤵
  PID:9996
- C:\Windows\System\HMEDinH.exe
  C:\Windows\System\HMEDinH.exe
  2⤵
  PID:10024
- C:\Windows\System\SkMkeCF.exe
  C:\Windows\System\SkMkeCF.exe
  2⤵
  PID:10052
- C:\Windows\System\gegOdRS.exe
  C:\Windows\System\gegOdRS.exe
  2⤵
  PID:10072
- C:\Windows\System\uWktGCS.exe
  C:\Windows\System\uWktGCS.exe
  2⤵
  PID:10104
- C:\Windows\System\EhoEvye.exe
  C:\Windows\System\EhoEvye.exe
  2⤵
  PID:10136
- C:\Windows\System\dohwatH.exe
  C:\Windows\System\dohwatH.exe
  2⤵
  PID:10168
- C:\Windows\System\pcgsnAe.exe
  C:\Windows\System\pcgsnAe.exe
  2⤵
  PID:10196
- C:\Windows\System\WHAFUJK.exe
  C:\Windows\System\WHAFUJK.exe
  2⤵
  PID:10220
- C:\Windows\System\vuQDQbA.exe
  C:\Windows\System\vuQDQbA.exe
  2⤵
  PID:3300
- C:\Windows\System\Thedycs.exe
  C:\Windows\System\Thedycs.exe
  2⤵
  PID:8084
- C:\Windows\System\XKpzmjL.exe
  C:\Windows\System\XKpzmjL.exe
  2⤵
  PID:9264
- C:\Windows\System\EgJLeFL.exe
  C:\Windows\System\EgJLeFL.exe
  2⤵
  PID:9300
- C:\Windows\System\bnZLtwm.exe
  C:\Windows\System\bnZLtwm.exe
  2⤵
  PID:9368
- C:\Windows\System\NhYyihG.exe
  C:\Windows\System\NhYyihG.exe
  2⤵
  PID:9464
- C:\Windows\System\uDEXgDl.exe
  C:\Windows\System\uDEXgDl.exe
  2⤵
  PID:9544
- C:\Windows\System\BtmOHjx.exe
  C:\Windows\System\BtmOHjx.exe
  2⤵
  PID:9564
- C:\Windows\System\lAYrrlC.exe
  C:\Windows\System\lAYrrlC.exe
  2⤵
  PID:9660
- C:\Windows\System\iXnxXyk.exe
  C:\Windows\System\iXnxXyk.exe
  2⤵
  PID:9716
- C:\Windows\System\VRzVXUr.exe
  C:\Windows\System\VRzVXUr.exe
  2⤵
  PID:9744
- C:\Windows\System\pOoXLIU.exe
  C:\Windows\System\pOoXLIU.exe
  2⤵
  PID:9852
- C:\Windows\System\yDwMsIn.exe
  C:\Windows\System\yDwMsIn.exe
  2⤵
  PID:9984
- C:\Windows\System\QTpabzm.exe
  C:\Windows\System\QTpabzm.exe
  2⤵
  PID:10020
- C:\Windows\System\kpEFapR.exe
  C:\Windows\System\kpEFapR.exe
  2⤵
  PID:9952
- C:\Windows\System\mxtYmIa.exe
  C:\Windows\System\mxtYmIa.exe
  2⤵
  PID:10152
- C:\Windows\System\gYrfqkZ.exe
  C:\Windows\System\gYrfqkZ.exe
  2⤵
  PID:10092
- C:\Windows\System\wMeiSsS.exe
  C:\Windows\System\wMeiSsS.exe
  2⤵
  PID:2244
- C:\Windows\System\vmeYGmL.exe
  C:\Windows\System\vmeYGmL.exe
  2⤵
  PID:8652
- C:\Windows\System\DUujbmG.exe
  C:\Windows\System\DUujbmG.exe
  2⤵
  PID:9500
- C:\Windows\System\SAqHTog.exe
  C:\Windows\System\SAqHTog.exe
  2⤵
  PID:9576
- C:\Windows\System\lQrBVlb.exe
  C:\Windows\System\lQrBVlb.exe
  2⤵
  PID:9588
- C:\Windows\System\PedXdRq.exe
  C:\Windows\System\PedXdRq.exe
  2⤵
  PID:9796
- C:\Windows\System\hMWlibO.exe
  C:\Windows\System\hMWlibO.exe
  2⤵
  PID:9960
- C:\Windows\System\SLeIhSZ.exe
  C:\Windows\System\SLeIhSZ.exe
  2⤵
  PID:10232
- C:\Windows\System\VbyWpdb.exe
  C:\Windows\System\VbyWpdb.exe
  2⤵
  PID:10212
- C:\Windows\System\iXCJqqg.exe
  C:\Windows\System\iXCJqqg.exe
  2⤵
  PID:9244
- C:\Windows\System\bpXcIqj.exe
  C:\Windows\System\bpXcIqj.exe
  2⤵
  PID:9436
- C:\Windows\System\izITsgi.exe
  C:\Windows\System\izITsgi.exe
  2⤵
  PID:10064
- C:\Windows\System\BNOTDwo.exe
  C:\Windows\System\BNOTDwo.exe
  2⤵
  PID:9788
- C:\Windows\System\hGWZUiu.exe
  C:\Windows\System\hGWZUiu.exe
  2⤵
  PID:10256
- C:\Windows\System\aqBELxL.exe
  C:\Windows\System\aqBELxL.exe
  2⤵
  PID:10296
- C:\Windows\System\ajjQTwF.exe
  C:\Windows\System\ajjQTwF.exe
  2⤵
  PID:10320
- C:\Windows\System\nggCxpU.exe
  C:\Windows\System\nggCxpU.exe
  2⤵
  PID:10344
- C:\Windows\System\TwMGJxT.exe
  C:\Windows\System\TwMGJxT.exe
  2⤵
  PID:10368
- C:\Windows\System\gHSFHUn.exe
  C:\Windows\System\gHSFHUn.exe
  2⤵
  PID:10392
- C:\Windows\System\uIEkOuU.exe
  C:\Windows\System\uIEkOuU.exe
  2⤵
  PID:10416
- C:\Windows\System\HjccNGz.exe
  C:\Windows\System\HjccNGz.exe
  2⤵
  PID:10444
- C:\Windows\System\ximIOMY.exe
  C:\Windows\System\ximIOMY.exe
  2⤵
  PID:10476
- C:\Windows\System\MqCTcSB.exe
  C:\Windows\System\MqCTcSB.exe
  2⤵
  PID:10504
- C:\Windows\System\vwxhCsG.exe
  C:\Windows\System\vwxhCsG.exe
  2⤵
  PID:10528
- C:\Windows\System\CAYMvrL.exe
  C:\Windows\System\CAYMvrL.exe
  2⤵
  PID:10564
- C:\Windows\System\qZjcTgF.exe
  C:\Windows\System\qZjcTgF.exe
  2⤵
  PID:10596
- C:\Windows\System\LhAqKfE.exe
  C:\Windows\System\LhAqKfE.exe
  2⤵
  PID:10628
- C:\Windows\System\fvgRYLi.exe
  C:\Windows\System\fvgRYLi.exe
  2⤵
  PID:10656
- C:\Windows\System\IZxIfrd.exe
  C:\Windows\System\IZxIfrd.exe
  2⤵
  PID:10684
- C:\Windows\System\gzHqYsB.exe
  C:\Windows\System\gzHqYsB.exe
  2⤵
  PID:10704
- C:\Windows\System\GprLGIj.exe
  C:\Windows\System\GprLGIj.exe
  2⤵
  PID:10736
- C:\Windows\System\DQBrFab.exe
  C:\Windows\System\DQBrFab.exe
  2⤵
  PID:10768
- C:\Windows\System\rRdZsyG.exe
  C:\Windows\System\rRdZsyG.exe
  2⤵
  PID:10800
- C:\Windows\System\tnqMEDq.exe
  C:\Windows\System\tnqMEDq.exe
  2⤵
  PID:10836
- C:\Windows\System\qOBZLLS.exe
  C:\Windows\System\qOBZLLS.exe
  2⤵
  PID:10856
- C:\Windows\System\HbfxRsK.exe
  C:\Windows\System\HbfxRsK.exe
  2⤵
  PID:10876
- C:\Windows\System\fXTlodS.exe
  C:\Windows\System\fXTlodS.exe
  2⤵
  PID:10904
- C:\Windows\System\CAWHLNt.exe
  C:\Windows\System\CAWHLNt.exe
  2⤵
  PID:10924
- C:\Windows\System\LDmrLAp.exe
  C:\Windows\System\LDmrLAp.exe
  2⤵
  PID:10948
- C:\Windows\System\bShvjoK.exe
  C:\Windows\System\bShvjoK.exe
  2⤵
  PID:10972
- C:\Windows\System\CXXTPPo.exe
  C:\Windows\System\CXXTPPo.exe
  2⤵
  PID:11000
- C:\Windows\System\ayuNjmk.exe
  C:\Windows\System\ayuNjmk.exe
  2⤵
  PID:11032
- C:\Windows\System\VbfkZzu.exe
  C:\Windows\System\VbfkZzu.exe
  2⤵
  PID:11056
- C:\Windows\System\BUEguUm.exe
  C:\Windows\System\BUEguUm.exe
  2⤵
  PID:11088
- C:\Windows\System\oiaMXuS.exe
  C:\Windows\System\oiaMXuS.exe
  2⤵
  PID:11112
- C:\Windows\System\SiorSeO.exe
  C:\Windows\System\SiorSeO.exe
  2⤵
  PID:11140
- C:\Windows\System\sOPNycD.exe
  C:\Windows\System\sOPNycD.exe
  2⤵
  PID:11168
- C:\Windows\System\zgHaduA.exe
  C:\Windows\System\zgHaduA.exe
  2⤵
  PID:11196
- C:\Windows\System\HBFbLas.exe
  C:\Windows\System\HBFbLas.exe
  2⤵
  PID:11220
- C:\Windows\System\LhGbiaC.exe
  C:\Windows\System\LhGbiaC.exe
  2⤵
  PID:11248
- C:\Windows\System\dvPSKjE.exe
  C:\Windows\System\dvPSKjE.exe
  2⤵
  PID:9248
- C:\Windows\System\eLjNnWC.exe
  C:\Windows\System\eLjNnWC.exe
  2⤵
  PID:10336
- C:\Windows\System\yjwpNGu.exe
  C:\Windows\System\yjwpNGu.exe
  2⤵
  PID:10308
- C:\Windows\System\cZpLJsk.exe
  C:\Windows\System\cZpLJsk.exe
  2⤵
  PID:10380
- C:\Windows\System\pWnObfW.exe
  C:\Windows\System\pWnObfW.exe
  2⤵
  PID:10424
- C:\Windows\System\npXQGiH.exe
  C:\Windows\System\npXQGiH.exe
  2⤵
  PID:10608
- C:\Windows\System\OXNcMAC.exe
  C:\Windows\System\OXNcMAC.exe
  2⤵
  PID:10500
- C:\Windows\System\nVXWRIY.exe
  C:\Windows\System\nVXWRIY.exe
  2⤵
  PID:10556
- C:\Windows\System\dlMdTIM.exe
  C:\Windows\System\dlMdTIM.exe
  2⤵
  PID:10716
- C:\Windows\System\zJbGwHj.exe
  C:\Windows\System\zJbGwHj.exe
  2⤵
  PID:10828
- C:\Windows\System\lWWWCwm.exe
  C:\Windows\System\lWWWCwm.exe
  2⤵
  PID:10912
- C:\Windows\System\aOArUti.exe
  C:\Windows\System\aOArUti.exe
  2⤵
  PID:10968
- C:\Windows\System\Grormxx.exe
  C:\Windows\System\Grormxx.exe
  2⤵
  PID:11024
- C:\Windows\System\NLHZhXd.exe
  C:\Windows\System\NLHZhXd.exe
  2⤵
  PID:11136
- C:\Windows\System\cacJnPf.exe
  C:\Windows\System\cacJnPf.exe
  2⤵
  PID:11080
- C:\Windows\System\MuzkYhP.exe
  C:\Windows\System\MuzkYhP.exe
  2⤵
  PID:11108
- C:\Windows\System\gzHNzHC.exe
  C:\Windows\System\gzHNzHC.exe
  2⤵
  PID:10120
- C:\Windows\System\BCWaReH.exe
  C:\Windows\System\BCWaReH.exe
  2⤵
  PID:11212
- C:\Windows\System\bJVGmGF.exe
  C:\Windows\System\bJVGmGF.exe
  2⤵
  PID:10356
- C:\Windows\System\sUsyAJA.exe
  C:\Windows\System\sUsyAJA.exe
  2⤵
  PID:10548
- C:\Windows\System\hnOivxf.exe
  C:\Windows\System\hnOivxf.exe
  2⤵
  PID:10640
- C:\Windows\System\QZTvBHa.exe
  C:\Windows\System\QZTvBHa.exe
  2⤵
  PID:11160
- C:\Windows\System\yzljYQi.exe
  C:\Windows\System\yzljYQi.exe
  2⤵
  PID:10892
- C:\Windows\System\ytcWTbL.exe
  C:\Windows\System\ytcWTbL.exe
  2⤵
  PID:10248
- C:\Windows\System\mfNssNr.exe
  C:\Windows\System\mfNssNr.exe
  2⤵
  PID:11072
- C:\Windows\System\GqhYvmQ.exe
  C:\Windows\System\GqhYvmQ.exe
  2⤵
  PID:11296
- C:\Windows\System\oblQdrb.exe
  C:\Windows\System\oblQdrb.exe
  2⤵
  PID:11324
- C:\Windows\System\XdOSlvq.exe
  C:\Windows\System\XdOSlvq.exe
  2⤵
  PID:11348
- C:\Windows\System\cOfqTWd.exe
  C:\Windows\System\cOfqTWd.exe
  2⤵
  PID:11368
- C:\Windows\System\KydAGFQ.exe
  C:\Windows\System\KydAGFQ.exe
  2⤵
  PID:11400
- C:\Windows\System\CsskNsT.exe
  C:\Windows\System\CsskNsT.exe
  2⤵
  PID:11428
- C:\Windows\System\zTfLKud.exe
  C:\Windows\System\zTfLKud.exe
  2⤵
  PID:11452
- C:\Windows\System\qEUcSVh.exe
  C:\Windows\System\qEUcSVh.exe
  2⤵
  PID:11484
- C:\Windows\System\TFZsKXx.exe
  C:\Windows\System\TFZsKXx.exe
  2⤵
  PID:11508
- C:\Windows\System\aoUnSSd.exe
  C:\Windows\System\aoUnSSd.exe
  2⤵
  PID:11532
- C:\Windows\System\CftkvOa.exe
  C:\Windows\System\CftkvOa.exe
  2⤵
  PID:11564
- C:\Windows\System\HKAjwDR.exe
  C:\Windows\System\HKAjwDR.exe
  2⤵
  PID:11592
- C:\Windows\System\rUYVMFM.exe
  C:\Windows\System\rUYVMFM.exe
  2⤵
  PID:11620
- C:\Windows\System\bRSxeLJ.exe
  C:\Windows\System\bRSxeLJ.exe
  2⤵
  PID:11656
- C:\Windows\System\qXkMEHI.exe
  C:\Windows\System\qXkMEHI.exe
  2⤵
  PID:11680
- C:\Windows\System\gkKOzVo.exe
  C:\Windows\System\gkKOzVo.exe
  2⤵
  PID:11712
- C:\Windows\System\DFNHYng.exe
  C:\Windows\System\DFNHYng.exe
  2⤵
  PID:11744
- C:\Windows\System\sRhZzFk.exe
  C:\Windows\System\sRhZzFk.exe
  2⤵
  PID:11772
- C:\Windows\System\WyTOeya.exe
  C:\Windows\System\WyTOeya.exe
  2⤵
  PID:11796
- C:\Windows\System\elZLLIK.exe
  C:\Windows\System\elZLLIK.exe
  2⤵
  PID:11824
- C:\Windows\System\okTyhTr.exe
  C:\Windows\System\okTyhTr.exe
  2⤵
  PID:11852
- C:\Windows\System\OIIQJOB.exe
  C:\Windows\System\OIIQJOB.exe
  2⤵
  PID:11884
- C:\Windows\System\uPSlWcd.exe
  C:\Windows\System\uPSlWcd.exe
  2⤵
  PID:11908
- C:\Windows\System\EoyrOQs.exe
  C:\Windows\System\EoyrOQs.exe
  2⤵
  PID:11932
- C:\Windows\System\zaveosW.exe
  C:\Windows\System\zaveosW.exe
  2⤵
  PID:11964
- C:\Windows\System\fupYEeu.exe
  C:\Windows\System\fupYEeu.exe
  2⤵
  PID:11996
- C:\Windows\System\FGSmeap.exe
  C:\Windows\System\FGSmeap.exe
  2⤵
  PID:12024
- C:\Windows\System\WyXEPyJ.exe
  C:\Windows\System\WyXEPyJ.exe
  2⤵
  PID:12060
- C:\Windows\System\XCnNqHk.exe
  C:\Windows\System\XCnNqHk.exe
  2⤵
  PID:12092
- C:\Windows\System\NIwKYZr.exe
  C:\Windows\System\NIwKYZr.exe
  2⤵
  PID:12124
- C:\Windows\System\cLcFOzU.exe
  C:\Windows\System\cLcFOzU.exe
  2⤵
  PID:12144
- C:\Windows\System\RtHIRjN.exe
  C:\Windows\System\RtHIRjN.exe
  2⤵
  PID:12172
- C:\Windows\System\gPuNhfb.exe
  C:\Windows\System\gPuNhfb.exe
  2⤵
  PID:12200
- C:\Windows\System\QtEbWzo.exe
  C:\Windows\System\QtEbWzo.exe
  2⤵
  PID:12224
- C:\Windows\System\EbHfpte.exe
  C:\Windows\System\EbHfpte.exe
  2⤵
  PID:12252
- C:\Windows\System\zrRebMJ.exe
  C:\Windows\System\zrRebMJ.exe
  2⤵
  PID:12280
- C:\Windows\System\zbHzoRS.exe
  C:\Windows\System\zbHzoRS.exe
  2⤵
  PID:11188
- C:\Windows\System\NstRHdt.exe
  C:\Windows\System\NstRHdt.exe
  2⤵
  PID:10792
- C:\Windows\System\zlfmrBo.exe
  C:\Windows\System\zlfmrBo.exe
  2⤵
  PID:10988
- C:\Windows\System\hbtMzoL.exe
  C:\Windows\System\hbtMzoL.exe
  2⤵
  PID:11320
- C:\Windows\System\saDANtv.exe
  C:\Windows\System\saDANtv.exe
  2⤵
  PID:11472
- C:\Windows\System\mSNMteh.exe
  C:\Windows\System\mSNMteh.exe
  2⤵
  PID:11548
- C:\Windows\System\EiNXiSk.exe
  C:\Windows\System\EiNXiSk.exe
  2⤵
  PID:11604
- C:\Windows\System\WumlPVs.exe
  C:\Windows\System\WumlPVs.exe
  2⤵
  PID:11528
- C:\Windows\System\xkGyjHb.exe
  C:\Windows\System\xkGyjHb.exe
  2⤵
  PID:11640
- C:\Windows\System\YOuPUnR.exe
  C:\Windows\System\YOuPUnR.exe
  2⤵
  PID:11644
- C:\Windows\System\OPlddfI.exe
  C:\Windows\System\OPlddfI.exe
  2⤵
  PID:11836
- C:\Windows\System\mYAVAoc.exe
  C:\Windows\System\mYAVAoc.exe
  2⤵
  PID:11892
- C:\Windows\System\LyJokzE.exe
  C:\Windows\System\LyJokzE.exe
  2⤵
  PID:11896
- C:\Windows\System\ZilEqgY.exe
  C:\Windows\System\ZilEqgY.exe
  2⤵
  PID:11952
- C:\Windows\System\NvYYQzE.exe
  C:\Windows\System\NvYYQzE.exe
  2⤵
  PID:11972
- C:\Windows\System\DtqxpHs.exe
  C:\Windows\System\DtqxpHs.exe
  2⤵
  PID:12040
- C:\Windows\System\uAaGxFw.exe
  C:\Windows\System\uAaGxFw.exe
  2⤵
  PID:12152
- C:\Windows\System\SccEhnE.exe
  C:\Windows\System\SccEhnE.exe
  2⤵
  PID:12120
- C:\Windows\System\tXZrnAp.exe
  C:\Windows\System\tXZrnAp.exe
  2⤵
  PID:12272
- C:\Windows\System\sAciMrg.exe
  C:\Windows\System\sAciMrg.exe
  2⤵
  PID:11104
- C:\Windows\System\WDxxTtH.exe
  C:\Windows\System\WDxxTtH.exe
  2⤵
  PID:11276
- C:\Windows\System\mOrdZft.exe
  C:\Windows\System\mOrdZft.exe
  2⤵
  PID:11448
- C:\Windows\System\CmeuAjp.exe
  C:\Windows\System\CmeuAjp.exe
  2⤵
  PID:11520
- C:\Windows\System\bqESkTR.exe
  C:\Windows\System\bqESkTR.exe
  2⤵
  PID:11820
- C:\Windows\System\lnFFeqV.exe
  C:\Windows\System\lnFFeqV.exe
  2⤵
  PID:12116
- C:\Windows\System\lKSsThO.exe
  C:\Windows\System\lKSsThO.exe
  2⤵
  PID:12164
- C:\Windows\System\mVrCNnQ.exe
  C:\Windows\System\mVrCNnQ.exe
  2⤵
  PID:11924
- C:\Windows\System\xWLVhCo.exe
  C:\Windows\System\xWLVhCo.exe
  2⤵
  PID:11876
- C:\Windows\System\AEQldJb.exe
  C:\Windows\System\AEQldJb.exe
  2⤵
  PID:12292
- C:\Windows\System\TyycAVo.exe
  C:\Windows\System\TyycAVo.exe
  2⤵
  PID:12316
- C:\Windows\System\CYYYOMn.exe
  C:\Windows\System\CYYYOMn.exe
  2⤵
  PID:12340
- C:\Windows\System\ddIEGRg.exe
  C:\Windows\System\ddIEGRg.exe
  2⤵
  PID:12364
- C:\Windows\System\qSWexpW.exe
  C:\Windows\System\qSWexpW.exe
  2⤵
  PID:12392
- C:\Windows\System\HTmqmDu.exe
  C:\Windows\System\HTmqmDu.exe
  2⤵
  PID:12420
- C:\Windows\System\DXXHxDG.exe
  C:\Windows\System\DXXHxDG.exe
  2⤵
  PID:12436
- C:\Windows\System\oTHQSCt.exe
  C:\Windows\System\oTHQSCt.exe
  2⤵
  PID:12456
- C:\Windows\System\ZGhZJgS.exe
  C:\Windows\System\ZGhZJgS.exe
  2⤵
  PID:12484
- C:\Windows\System\EWVEVVl.exe
  C:\Windows\System\EWVEVVl.exe
  2⤵
  PID:12504
- C:\Windows\System\kIaNXEU.exe
  C:\Windows\System\kIaNXEU.exe
  2⤵
  PID:12532
- C:\Windows\System\zVcqEFt.exe
  C:\Windows\System\zVcqEFt.exe
  2⤵
  PID:12556
- C:\Windows\System\zJDfwhq.exe
  C:\Windows\System\zJDfwhq.exe
  2⤵
  PID:12576
- C:\Windows\System\FCFHEIs.exe
  C:\Windows\System\FCFHEIs.exe
  2⤵
  PID:12600
- C:\Windows\System\aDumXit.exe
  C:\Windows\System\aDumXit.exe
  2⤵
  PID:12636
- C:\Windows\System\skErqOL.exe
  C:\Windows\System\skErqOL.exe
  2⤵
  PID:12656
- C:\Windows\System\ShoFUUj.exe
  C:\Windows\System\ShoFUUj.exe
  2⤵
  PID:12700
- C:\Windows\System\Eatkszu.exe
  C:\Windows\System\Eatkszu.exe
  2⤵
  PID:12716
- C:\Windows\System\TxCqpis.exe
  C:\Windows\System\TxCqpis.exe
  2⤵
  PID:12732
- C:\Windows\System\UYPMwZK.exe
  C:\Windows\System\UYPMwZK.exe
  2⤵
  PID:12756
- C:\Windows\System\NBhcOLx.exe
  C:\Windows\System\NBhcOLx.exe
  2⤵
  PID:12788
- C:\Windows\System\vpuXyrM.exe
  C:\Windows\System\vpuXyrM.exe
  2⤵
  PID:12816
- C:\Windows\System\SdGlikr.exe
  C:\Windows\System\SdGlikr.exe
  2⤵
  PID:12844
- C:\Windows\System\CPAGafU.exe
  C:\Windows\System\CPAGafU.exe
  2⤵
  PID:12868
- C:\Windows\System\AZhPQGP.exe
  C:\Windows\System\AZhPQGP.exe
  2⤵
  PID:12892
- C:\Windows\System\XGTOtav.exe
  C:\Windows\System\XGTOtav.exe
  2⤵
  PID:12912
- C:\Windows\System\irMJVAJ.exe
  C:\Windows\System\irMJVAJ.exe
  2⤵
  PID:12948
- C:\Windows\System\zUDpgJJ.exe
  C:\Windows\System\zUDpgJJ.exe
  2⤵
  PID:12976
- C:\Windows\System\yTJaOCx.exe
  C:\Windows\System\yTJaOCx.exe
  2⤵
  PID:12996
- C:\Windows\System\EJxBMRb.exe
  C:\Windows\System\EJxBMRb.exe
  2⤵
  PID:13028
- C:\Windows\System\CpbkgyO.exe
  C:\Windows\System\CpbkgyO.exe
  2⤵
  PID:13052
- C:\Windows\System\sFYjHOm.exe
  C:\Windows\System\sFYjHOm.exe
  2⤵
  PID:13076
- C:\Windows\System\VIDCfHE.exe
  C:\Windows\System\VIDCfHE.exe
  2⤵
  PID:13100
- C:\Windows\System\OhmIXeE.exe
  C:\Windows\System\OhmIXeE.exe
  2⤵
  PID:13124
- C:\Windows\System\EDAKcNb.exe
  C:\Windows\System\EDAKcNb.exe
  2⤵
  PID:13152
- C:\Windows\System\lohCMpw.exe
  C:\Windows\System\lohCMpw.exe
  2⤵
  PID:13172
- C:\Windows\System\DDXSZmX.exe
  C:\Windows\System\DDXSZmX.exe
  2⤵
  PID:13204
- C:\Windows\System\ErpbzeW.exe
  C:\Windows\System\ErpbzeW.exe
  2⤵
  PID:13232
- C:\Windows\System\rSaWKXs.exe
  C:\Windows\System\rSaWKXs.exe
  2⤵
  PID:13256
- C:\Windows\System\lUQEysw.exe
  C:\Windows\System\lUQEysw.exe
  2⤵
  PID:13292
- C:\Windows\System\bwSLqld.exe
  C:\Windows\System\bwSLqld.exe
  2⤵
  PID:11740
- C:\Windows\System\CXWgbZS.exe
  C:\Windows\System\CXWgbZS.exe
  2⤵
  PID:11392
- C:\Windows\System\hhHsKNl.exe
  C:\Windows\System\hhHsKNl.exe
  2⤵
  PID:12220
- C:\Windows\System\VpDdawj.exe
  C:\Windows\System\VpDdawj.exe
  2⤵
  PID:11648
- C:\Windows\System\mvRDyWp.exe
  C:\Windows\System\mvRDyWp.exe
  2⤵
  PID:12432
- C:\Windows\System\HVNLNWU.exe
  C:\Windows\System\HVNLNWU.exe
  2⤵
  PID:12376
- C:\Windows\System\DlzuTxG.exe
  C:\Windows\System\DlzuTxG.exe
  2⤵
  PID:12548
- C:\Windows\System\OFAsTnl.exe
  C:\Windows\System\OFAsTnl.exe
  2⤵
  PID:12804
- C:\Windows\System\IGhynQG.exe
  C:\Windows\System\IGhynQG.exe
  2⤵
  PID:12684
- C:\Windows\System\NjDgUXV.exe
  C:\Windows\System\NjDgUXV.exe
  2⤵
  PID:12572
- C:\Windows\System\zjSmptO.exe
  C:\Windows\System\zjSmptO.exe
  2⤵
  PID:12612
- C:\Windows\System\lyzHMjQ.exe
  C:\Windows\System\lyzHMjQ.exe
  2⤵
  PID:12940
- C:\Windows\System\rSDwPve.exe
  C:\Windows\System\rSDwPve.exe
  2⤵
  PID:12880
- C:\Windows\System\mmMgCJp.exe
  C:\Windows\System\mmMgCJp.exe
  2⤵
  PID:13108
- C:\Windows\System\xdfbTJa.exe
  C:\Windows\System\xdfbTJa.exe
  2⤵
  PID:13148
- C:\Windows\System\npqYPau.exe
  C:\Windows\System\npqYPau.exe
  2⤵
  PID:13064
- C:\Windows\System\NbXLwSQ.exe
  C:\Windows\System\NbXLwSQ.exe
  2⤵
  PID:13088
- C:\Windows\System\oVBBtDY.exe
  C:\Windows\System\oVBBtDY.exe
  2⤵
  PID:13132
- C:\Windows\System\dyKpnRc.exe
  C:\Windows\System\dyKpnRc.exe
  2⤵
  PID:12100
- C:\Windows\System\vgdnoXk.exe
  C:\Windows\System\vgdnoXk.exe
  2⤵
  PID:12516
- C:\Windows\System\HHAANgn.exe
  C:\Windows\System\HHAANgn.exe
  2⤵
  PID:13288
- C:\Windows\System\aBFetjD.exe
  C:\Windows\System\aBFetjD.exe
  2⤵
  PID:12308
- C:\Windows\System\hhScZbM.exe
  C:\Windows\System\hhScZbM.exe
  2⤵
  PID:12512
- C:\Windows\System\giqdPLh.exe
  C:\Windows\System\giqdPLh.exe
  2⤵
  PID:12588
- C:\Windows\System\DFWKgmX.exe
  C:\Windows\System\DFWKgmX.exe
  2⤵
  PID:12628
- C:\Windows\System\qDXedWc.exe
  C:\Windows\System\qDXedWc.exe
  2⤵
  PID:13184
- C:\Windows\System\qJQSmfY.exe
  C:\Windows\System\qJQSmfY.exe
  2⤵
  PID:12400
- C:\Windows\System\rELDJlT.exe
  C:\Windows\System\rELDJlT.exe
  2⤵
  PID:13324
- C:\Windows\System\KjVuTgG.exe
  C:\Windows\System\KjVuTgG.exe
  2⤵
  PID:13360
- C:\Windows\System\ZYDMBAK.exe
  C:\Windows\System\ZYDMBAK.exe
  2⤵
  PID:13380
- C:\Windows\System\OpPRRqu.exe
  C:\Windows\System\OpPRRqu.exe
  2⤵
  PID:13408
- C:\Windows\System\KvibTKw.exe
  C:\Windows\System\KvibTKw.exe
  2⤵
  PID:13432
- C:\Windows\System\xmfewKY.exe
  C:\Windows\System\xmfewKY.exe
  2⤵
  PID:13460
- C:\Windows\System\qNDzyIA.exe
  C:\Windows\System\qNDzyIA.exe
  2⤵
  PID:13488
- C:\Windows\System\ofitbsO.exe
  C:\Windows\System\ofitbsO.exe
  2⤵
  PID:13532
- C:\Windows\System\JUzijoa.exe
  C:\Windows\System\JUzijoa.exe
  2⤵
  PID:13552
- C:\Windows\System\uafrVIJ.exe
  C:\Windows\System\uafrVIJ.exe
  2⤵
  PID:13584
- C:\Windows\System\NqMcaiI.exe
  C:\Windows\System\NqMcaiI.exe
  2⤵
  PID:13604
- C:\Windows\System\JUMqYQw.exe
  C:\Windows\System\JUMqYQw.exe
  2⤵
  PID:13632
- C:\Windows\System\QNvjmzw.exe
  C:\Windows\System\QNvjmzw.exe
  2⤵
  PID:13664
- C:\Windows\System\ulujzVz.exe
  C:\Windows\System\ulujzVz.exe
  2⤵
  PID:13688
- C:\Windows\System\YTSFaMm.exe
  C:\Windows\System\YTSFaMm.exe
  2⤵
  PID:13716
- C:\Windows\System\BqvdfDr.exe
  C:\Windows\System\BqvdfDr.exe
  2⤵
  PID:13740
- C:\Windows\System\XWvspDK.exe
  C:\Windows\System\XWvspDK.exe
  2⤵
  PID:13768
- C:\Windows\System\JvQzRWm.exe
  C:\Windows\System\JvQzRWm.exe
  2⤵
  PID:13792
- C:\Windows\System\SWWGXFg.exe
  C:\Windows\System\SWWGXFg.exe
  2⤵
  PID:13812
- C:\Windows\System\aEyaXbf.exe
  C:\Windows\System\aEyaXbf.exe
  2⤵
  PID:13836
- C:\Windows\System\sbSckiG.exe
  C:\Windows\System\sbSckiG.exe
  2⤵
  PID:13864
- C:\Windows\System\wGmLfxc.exe
  C:\Windows\System\wGmLfxc.exe
  2⤵
  PID:13892
- C:\Windows\System\LvKaMlY.exe
  C:\Windows\System\LvKaMlY.exe
  2⤵
  PID:13924
- C:\Windows\System\wTKpMWS.exe
  C:\Windows\System\wTKpMWS.exe
  2⤵
  PID:13952
- C:\Windows\System\mFaqkuK.exe
  C:\Windows\System\mFaqkuK.exe
  2⤵
  PID:13988
- C:\Windows\System\WNgQcMA.exe
  C:\Windows\System\WNgQcMA.exe
  2⤵
  PID:14008
- C:\Windows\System\mVMlExg.exe
  C:\Windows\System\mVMlExg.exe
  2⤵
  PID:14024
- C:\Windows\System\cZLpeps.exe
  C:\Windows\System\cZLpeps.exe
  2⤵
  PID:14060
- C:\Windows\System\nVZgSEp.exe
  C:\Windows\System\nVZgSEp.exe
  2⤵
  PID:14084
- C:\Windows\System\nxmDSIi.exe
  C:\Windows\System\nxmDSIi.exe
  2⤵
  PID:14108
- C:\Windows\System\NSafdYn.exe
  C:\Windows\System\NSafdYn.exe
  2⤵
  PID:14144
- C:\Windows\System\RycaiSF.exe
  C:\Windows\System\RycaiSF.exe
  2⤵
  PID:14160
- C:\Windows\System\XcXHtQn.exe
  C:\Windows\System\XcXHtQn.exe
  2⤵
  PID:14184
- C:\Windows\System\GBUfDnr.exe
  C:\Windows\System\GBUfDnr.exe
  2⤵
  PID:14208
- C:\Windows\System\ZArpXnw.exe
  C:\Windows\System\ZArpXnw.exe
  2⤵
  PID:14240
- C:\Windows\System\qEIVbIb.exe
  C:\Windows\System\qEIVbIb.exe
  2⤵
  PID:14276
- C:\Windows\System\gnMaqoI.exe
  C:\Windows\System\gnMaqoI.exe
  2⤵
  PID:14300
- C:\Windows\System\QOYObCP.exe
  C:\Windows\System\QOYObCP.exe
  2⤵
  PID:14324
- C:\Windows\System\mMEWyXy.exe
  C:\Windows\System\mMEWyXy.exe
  2⤵
  PID:12564
- C:\Windows\System\gocsCte.exe
  C:\Windows\System\gocsCte.exe
  2⤵
  PID:12016
- C:\Windows\System\qvgJZbe.exe
  C:\Windows\System\qvgJZbe.exe
  2⤵
  PID:12668
- C:\Windows\System\XzxmqJm.exe
  C:\Windows\System\XzxmqJm.exe
  2⤵
  PID:12412
- C:\Windows\System\wTSGNDM.exe
  C:\Windows\System\wTSGNDM.exe
  2⤵
  PID:13200
- C:\Windows\System\QFqmSHr.exe
  C:\Windows\System\QFqmSHr.exe
  2⤵
  PID:13428
- C:\Windows\System\BmqwcJW.exe
  C:\Windows\System\BmqwcJW.exe
  2⤵
  PID:12648
- C:\Windows\System\rGskvbo.exe
  C:\Windows\System\rGskvbo.exe
  2⤵
  PID:13600
- C:\Windows\System\kyfHHRh.exe
  C:\Windows\System\kyfHHRh.exe
  2⤵
  PID:13672
- C:\Windows\System\FeGwBlV.exe
  C:\Windows\System\FeGwBlV.exe
  2⤵
  PID:13392
- C:\Windows\System\hxqiPAM.exe
  C:\Windows\System\hxqiPAM.exe
  2⤵
  PID:13640
- C:\Windows\System\PhglnLi.exe
  C:\Windows\System\PhglnLi.exe
  2⤵
  PID:13656
- C:\Windows\System\biRTKsX.exe
  C:\Windows\System\biRTKsX.exe
  2⤵
  PID:13700
- C:\Windows\System\BtqdWqy.exe
  C:\Windows\System\BtqdWqy.exe
  2⤵
  PID:13572
- C:\Windows\System\jMdBAwO.exe
  C:\Windows\System\jMdBAwO.exe
  2⤵
  PID:13828
- C:\Windows\System\hqLeMLK.exe
  C:\Windows\System\hqLeMLK.exe
  2⤵
  PID:13752
- C:\Windows\System\BpEsTia.exe
  C:\Windows\System\BpEsTia.exe
  2⤵
  PID:14092
- C:\Windows\System\vWkVyQr.exe
  C:\Windows\System\vWkVyQr.exe
  2⤵
  PID:14216
- C:\Windows\System\ssFEQYb.exe
  C:\Windows\System\ssFEQYb.exe
  2⤵
  PID:14296
- C:\Windows\System\nTfCSyc.exe
  C:\Windows\System\nTfCSyc.exe
  2⤵
  PID:13044
- C:\Windows\System\wmYvbKk.exe
  C:\Windows\System\wmYvbKk.exe
  2⤵
  PID:14172
- C:\Windows\System\VTKMDxu.exe
  C:\Windows\System\VTKMDxu.exe
  2⤵
  PID:14000
- C:\Windows\System\XvVQHbc.exe
  C:\Windows\System\XvVQHbc.exe
  2⤵
  PID:14604
- C:\Windows\System\EFHbdoz.exe
  C:\Windows\System\EFHbdoz.exe
  2⤵
  PID:14620
- C:\Windows\System\QFMaUaW.exe
  C:\Windows\System\QFMaUaW.exe
  2⤵
  PID:14648
- C:\Windows\System\EKkrmHu.exe
  C:\Windows\System\EKkrmHu.exe
  2⤵
  PID:14664
- C:\Windows\System\PtlasSS.exe
  C:\Windows\System\PtlasSS.exe
  2⤵
  PID:14680
- C:\Windows\System\xBYcCiF.exe
  C:\Windows\System\xBYcCiF.exe
  2⤵
  PID:14696
- C:\Windows\System\JOGSByS.exe
  C:\Windows\System\JOGSByS.exe
  2⤵
  PID:14716
- C:\Windows\System\hkJZGsg.exe
  C:\Windows\System\hkJZGsg.exe
  2⤵
  PID:14760
- C:\Windows\System\nMqZudS.exe
  C:\Windows\System\nMqZudS.exe
  2⤵
  PID:14780
- C:\Windows\System\XdIzfeb.exe
  C:\Windows\System\XdIzfeb.exe
  2⤵
  PID:14804
- C:\Windows\System\PVFhwiN.exe
  C:\Windows\System\PVFhwiN.exe
  2⤵
  PID:14836
- C:\Windows\System\uxgGipm.exe
  C:\Windows\System\uxgGipm.exe
  2⤵
  PID:14860
- C:\Windows\System\RmNihNT.exe
  C:\Windows\System\RmNihNT.exe
  2⤵
  PID:14884
- C:\Windows\System\RpDhMms.exe
  C:\Windows\System\RpDhMms.exe
  2⤵
  PID:14912
- C:\Windows\System\LmVyAKM.exe
  C:\Windows\System\LmVyAKM.exe
  2⤵
  PID:14932
- C:\Windows\System\BHfJGVW.exe
  C:\Windows\System\BHfJGVW.exe
  2⤵
  PID:14964
- C:\Windows\System\nwbgrmb.exe
  C:\Windows\System\nwbgrmb.exe
  2⤵
  PID:15004
- C:\Windows\System\nMqJKYM.exe
  C:\Windows\System\nMqJKYM.exe
  2⤵
  PID:15024
- C:\Windows\System\LKcVaLR.exe
  C:\Windows\System\LKcVaLR.exe
  2⤵
  PID:15052
- C:\Windows\System\YTfBFJK.exe
  C:\Windows\System\YTfBFJK.exe
  2⤵
  PID:15076
- C:\Windows\System\ojBJVuT.exe
  C:\Windows\System\ojBJVuT.exe
  2⤵
  PID:15112
- C:\Windows\System\hqHtRMx.exe
  C:\Windows\System\hqHtRMx.exe
  2⤵
  PID:15132
- C:\Windows\System\SyBGzhc.exe
  C:\Windows\System\SyBGzhc.exe
  2⤵
  PID:15152
- C:\Windows\System\iMAhuJG.exe
  C:\Windows\System\iMAhuJG.exe
  2⤵
  PID:15172
- C:\Windows\System\ZYJngAI.exe
  C:\Windows\System\ZYJngAI.exe
  2⤵
  PID:15188
- C:\Windows\System\RLuMxtC.exe
  C:\Windows\System\RLuMxtC.exe
  2⤵
  PID:15204
- C:\Windows\System\CJhIJgD.exe
  C:\Windows\System\CJhIJgD.exe
  2⤵
  PID:15240
- C:\Windows\System\omeILSY.exe
  C:\Windows\System\omeILSY.exe
  2⤵
  PID:15264
- C:\Windows\System\OivDzPo.exe
  C:\Windows\System\OivDzPo.exe
  2⤵
  PID:15280
- C:\Windows\System\YRgRXuy.exe
  C:\Windows\System\YRgRXuy.exe
  2⤵
  PID:15304
- C:\Windows\System\xIFwwDN.exe
  C:\Windows\System\xIFwwDN.exe
  2⤵
  PID:15344
- C:\Windows\System\lhTArrY.exe
  C:\Windows\System\lhTArrY.exe
  2⤵
  PID:13788
- C:\Windows\System\FvvffuA.exe
  C:\Windows\System\FvvffuA.exe
  2⤵
  PID:12452
- C:\Windows\System\HBspTeZ.exe
  C:\Windows\System\HBspTeZ.exe
  2⤵
  PID:13472
- C:\Windows\System\HMiwEyN.exe
  C:\Windows\System\HMiwEyN.exe
  2⤵
  PID:13944
- C:\Windows\System\oZfSIJz.exe
  C:\Windows\System\oZfSIJz.exe
  2⤵
  PID:14116
- C:\Windows\System\oTlQdTf.exe
  C:\Windows\System\oTlQdTf.exe
  2⤵
  PID:13016
- C:\Windows\System\pcJyrzp.exe
  C:\Windows\System\pcJyrzp.exe
  2⤵
  PID:14352
- C:\Windows\System\gxgLiqz.exe
  C:\Windows\System\gxgLiqz.exe
  2⤵
  PID:13524
- C:\Windows\System\VgMGeQU.exe
  C:\Windows\System\VgMGeQU.exe
  2⤵
  PID:14384
- C:\Windows\System\nGkicef.exe
  C:\Windows\System\nGkicef.exe
  2⤵
  PID:14548
- C:\Windows\System\SaspfAG.exe
  C:\Windows\System\SaspfAG.exe
  2⤵
  PID:14592
- C:\Windows\System\tDzfPgV.exe
  C:\Windows\System\tDzfPgV.exe
  2⤵
  PID:14640
- C:\Windows\System\BeUFtiz.exe
  C:\Windows\System\BeUFtiz.exe
  2⤵
  PID:14732
- C:\Windows\System\RMmFYAe.exe
  C:\Windows\System\RMmFYAe.exe
  2⤵
  PID:14828
- C:\Windows\System\wBOgYTm.exe
  C:\Windows\System\wBOgYTm.exe
  2⤵
  PID:14796
- C:\Windows\System\TPfeYtQ.exe
  C:\Windows\System\TPfeYtQ.exe
  2⤵
  PID:14920
- C:\Windows\System\RWNnnAj.exe
  C:\Windows\System\RWNnnAj.exe
  2⤵
  PID:14872
- C:\Windows\System\AtsrzWp.exe
  C:\Windows\System\AtsrzWp.exe
  2⤵
  PID:14928
- C:\Windows\System\LQieJmP.exe
  C:\Windows\System\LQieJmP.exe
  2⤵
  PID:15072
- C:\Windows\System\LRjXwSL.exe
  C:\Windows\System\LRjXwSL.exe
  2⤵
  PID:15068
- C:\Windows\System\aANiQdJ.exe
  C:\Windows\System\aANiQdJ.exe
  2⤵
  PID:15168
- C:\Windows\System\jcsdFxN.exe
  C:\Windows\System\jcsdFxN.exe
  2⤵
  PID:15292
- C:\Windows\System\LVJfQzw.exe
  C:\Windows\System\LVJfQzw.exe
  2⤵
  PID:15316
- C:\Windows\System\utOWisy.exe
  C:\Windows\System\utOWisy.exe
  2⤵
  PID:15160
- C:\Windows\System\pVSONCg.exe
  C:\Windows\System\pVSONCg.exe
  2⤵
  PID:15328
- C:\Windows\System\WQYbLtQ.exe
  C:\Windows\System\WQYbLtQ.exe
  2⤵
  PID:12500
- C:\Windows\System\boyhltc.exe
  C:\Windows\System\boyhltc.exe
  2⤵
  PID:13276
- C:\Windows\System\nBkdysD.exe
  C:\Windows\System\nBkdysD.exe
  2⤵
  PID:14692
- C:\Windows\System\OVNUUxb.exe
  C:\Windows\System\OVNUUxb.exe
  2⤵
  PID:14748
- C:\Windows\System\jUUJvzv.exe
  C:\Windows\System\jUUJvzv.exe
  2⤵
  PID:14492
- C:\Windows\System\wFvJUDL.exe
  C:\Windows\System\wFvJUDL.exe
  2⤵
  PID:14868
- C:\Windows\System\ompJYDx.exe
  C:\Windows\System\ompJYDx.exe
  2⤵
  PID:15092
- C:\Windows\System\bOKWiqY.exe
  C:\Windows\System\bOKWiqY.exe
  2⤵
  PID:14344
- C:\Windows\System\NZJcZud.exe
  C:\Windows\System\NZJcZud.exe
  2⤵
  PID:13908
- C:\Windows\System\fMXYXvo.exe
  C:\Windows\System\fMXYXvo.exe
  2⤵
  PID:15388
- C:\Windows\System\aDCcdxD.exe
  C:\Windows\System\aDCcdxD.exe
  2⤵
  PID:15412
- C:\Windows\System\Uqdxisx.exe
  C:\Windows\System\Uqdxisx.exe
  2⤵
  PID:15444
- C:\Windows\System\oWmAaUW.exe
  C:\Windows\System\oWmAaUW.exe
  2⤵
  PID:15460
- C:\Windows\System\UwgUDMq.exe
  C:\Windows\System\UwgUDMq.exe
  2⤵
  PID:15496
- C:\Windows\System\WKQFsRb.exe
  C:\Windows\System\WKQFsRb.exe
  2⤵
  PID:15516
- C:\Windows\System\sMyjqSA.exe
  C:\Windows\System\sMyjqSA.exe
  2⤵
  PID:15556
- C:\Windows\System\cCSArrO.exe
  C:\Windows\System\cCSArrO.exe
  2⤵
  PID:15580
- C:\Windows\System\OjfcpbO.exe
  C:\Windows\System\OjfcpbO.exe
  2⤵
  PID:15608
- C:\Windows\System\cSgIgOy.exe
  C:\Windows\System\cSgIgOy.exe
  2⤵
  PID:15632
- C:\Windows\System\lfdrSqe.exe
  C:\Windows\System\lfdrSqe.exe
  2⤵
  PID:15664
- C:\Windows\System\qOReUuJ.exe
  C:\Windows\System\qOReUuJ.exe
  2⤵
  PID:15688
- C:\Windows\System\fGNSJox.exe
  C:\Windows\System\fGNSJox.exe
  2⤵
  PID:15728
- C:\Windows\System\bIkHdGp.exe
  C:\Windows\System\bIkHdGp.exe
  2⤵
  PID:15744
- C:\Windows\System\zGjZymn.exe
  C:\Windows\System\zGjZymn.exe
  2⤵
  PID:15760
- C:\Windows\System\qLHgnFy.exe
  C:\Windows\System\qLHgnFy.exe
  2⤵
  PID:15780
- C:\Windows\System\aCRoUVt.exe
  C:\Windows\System\aCRoUVt.exe
  2⤵
  PID:15800
- C:\Windows\System\OCmmwev.exe
  C:\Windows\System\OCmmwev.exe
  2⤵
  PID:15828
- C:\Windows\System\mONxixC.exe
  C:\Windows\System\mONxixC.exe
  2⤵
  PID:15860
- C:\Windows\System\jMLmRaE.exe
  C:\Windows\System\jMLmRaE.exe
  2⤵
  PID:15884
- C:\Windows\System\dvLhMlT.exe
  C:\Windows\System\dvLhMlT.exe
  2⤵
  PID:15908
- C:\Windows\System\gNztPBZ.exe
  C:\Windows\System\gNztPBZ.exe
  2⤵
  PID:15944
- C:\Windows\System\uZmLLXD.exe
  C:\Windows\System\uZmLLXD.exe
  2⤵
  PID:15968
- C:\Windows\System\xOVBBZn.exe
  C:\Windows\System\xOVBBZn.exe
  2⤵
  PID:15988
- C:\Windows\System\HPgSHmY.exe
  C:\Windows\System\HPgSHmY.exe
  2⤵
  PID:16008
- C:\Windows\System\xtdkTNJ.exe
  C:\Windows\System\xtdkTNJ.exe
  2⤵
  PID:16028
- C:\Windows\System\ypIEdMi.exe
  C:\Windows\System\ypIEdMi.exe
  2⤵
  PID:16048
- C:\Windows\System\PdDQnWG.exe
  C:\Windows\System\PdDQnWG.exe
  2⤵
  PID:16064
- C:\Windows\System\TJYMcGT.exe
  C:\Windows\System\TJYMcGT.exe
  2⤵
  PID:16096
- C:\Windows\System\iCqMzar.exe
  C:\Windows\System\iCqMzar.exe
  2⤵
  PID:16136
- C:\Windows\System\FbMtVEu.exe
  C:\Windows\System\FbMtVEu.exe
  2⤵
  PID:16172
- C:\Windows\System\jdhRKuF.exe
  C:\Windows\System\jdhRKuF.exe
  2⤵
  PID:16188
- C:\Windows\System\sAlytec.exe
  C:\Windows\System\sAlytec.exe
  2⤵
  PID:16216
- C:\Windows\System\NbqPKbh.exe
  C:\Windows\System\NbqPKbh.exe
  2⤵
  PID:16232
- C:\Windows\System\NiAKpMC.exe
  C:\Windows\System\NiAKpMC.exe
  2⤵
  PID:16252
- C:\Windows\System\yhYoxcE.exe
  C:\Windows\System\yhYoxcE.exe
  2⤵
  PID:16280
- C:\Windows\System\EoDfhJh.exe
  C:\Windows\System\EoDfhJh.exe
  2⤵
  PID:16308
- C:\Windows\System\gMPuFJe.exe
  C:\Windows\System\gMPuFJe.exe
  2⤵
  PID:16332
- C:\Windows\System\LUwdqvM.exe
  C:\Windows\System\LUwdqvM.exe
  2⤵
  PID:16352
- C:\Windows\System\SbAxkMB.exe
  C:\Windows\System\SbAxkMB.exe
  2⤵
  PID:16372
- C:\Windows\System\qOLknTW.exe
  C:\Windows\System\qOLknTW.exe
  2⤵
  PID:15236
- C:\Windows\System\MSqNCJD.exe
  C:\Windows\System\MSqNCJD.exe
  2⤵
  PID:14660
- C:\Windows\System\vzCaotS.exe
  C:\Windows\System\vzCaotS.exe
  2⤵
  PID:15016
- C:\Windows\System\BgsROSS.exe
  C:\Windows\System\BgsROSS.exe
  2⤵
  PID:14076
- C:\Windows\System\oMDjjIY.exe
  C:\Windows\System\oMDjjIY.exe
  2⤵
  PID:15600
- C:\Windows\System\rHtOHkG.exe
  C:\Windows\System\rHtOHkG.exe
  2⤵
  PID:15484
- C:\Windows\System\yblLuTZ.exe
  C:\Windows\System\yblLuTZ.exe
  2⤵
  PID:15364
- C:\Windows\System\vdqMvLG.exe
  C:\Windows\System\vdqMvLG.exe
  2⤵
  PID:15564
- C:\Windows\System\xCHhXLG.exe
  C:\Windows\System\xCHhXLG.exe
  2⤵
  PID:15656
- C:\Windows\System\WOHSvzc.exe
  C:\Windows\System\WOHSvzc.exe
  2⤵
  PID:15504
- C:\Windows\System\YFTsnbV.exe
  C:\Windows\System\YFTsnbV.exe
  2⤵
  PID:15720
- C:\Windows\System\Dipcfgr.exe
  C:\Windows\System\Dipcfgr.exe
  2⤵
  PID:15756
- C:\Windows\System\KeLErVS.exe
  C:\Windows\System\KeLErVS.exe
  2⤵
  PID:16020
- C:\Windows\System\fkVGmti.exe
  C:\Windows\System\fkVGmti.exe
  2⤵
  PID:16044
- C:\Windows\System\EHCRrpA.exe
  C:\Windows\System\EHCRrpA.exe
  2⤵
  PID:16168
- C:\Windows\System\sokwPWh.exe
  C:\Windows\System\sokwPWh.exe
  2⤵
  PID:15844
- C:\Windows\System\iinRBFT.exe
  C:\Windows\System\iinRBFT.exe
  2⤵
  PID:16056
- - C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -u -p 16056 -s 248
    3⤵
    PID:17348
- C:\Windows\System\TvlInhq.exe
  C:\Windows\System\TvlInhq.exe
  2⤵
  PID:15956
- C:\Windows\System\yztwWWw.exe
  C:\Windows\System\yztwWWw.exe
  2⤵
  PID:15976
- C:\Windows\System\PAhCWmE.exe
  C:\Windows\System\PAhCWmE.exe
  2⤵
  PID:16228
- C:\Windows\System\YwMbQHV.exe
  C:\Windows\System\YwMbQHV.exe
  2⤵
  PID:15596
- C:\Windows\System\WaoHRkk.exe
  C:\Windows\System\WaoHRkk.exe
  2⤵
  PID:15376
- C:\Windows\System\euPirTj.exe
  C:\Windows\System\euPirTj.exe
  2⤵
  PID:16324
- C:\Windows\System\nYSKpkm.exe
  C:\Windows\System\nYSKpkm.exe
  2⤵
  PID:15812
- C:\Windows\System\zPNqMbi.exe
  C:\Windows\System\zPNqMbi.exe
  2⤵
  PID:16392
- C:\Windows\System\LHVYjvr.exe
  C:\Windows\System\LHVYjvr.exe
  2⤵
  PID:16416
- C:\Windows\System\uNqQhiM.exe
  C:\Windows\System\uNqQhiM.exe
  2⤵
  PID:16456
- C:\Windows\System\LOJzITH.exe
  C:\Windows\System\LOJzITH.exe
  2⤵
  PID:16472
- C:\Windows\System\CZQvJou.exe
  C:\Windows\System\CZQvJou.exe
  2⤵
  PID:16492
- C:\Windows\System\pBtrPGd.exe
  C:\Windows\System\pBtrPGd.exe
  2⤵
  PID:16516
- C:\Windows\System\Wxdbzfc.exe
  C:\Windows\System\Wxdbzfc.exe
  2⤵
  PID:16536
- C:\Windows\System\MRzBpYx.exe
  C:\Windows\System\MRzBpYx.exe
  2⤵
  PID:16568
- C:\Windows\System\vUCFPFW.exe
  C:\Windows\System\vUCFPFW.exe
  2⤵
  PID:16584
- C:\Windows\System\hEQWdGU.exe
  C:\Windows\System\hEQWdGU.exe
  2⤵
  PID:16620
- C:\Windows\System\WHIHpFK.exe
  C:\Windows\System\WHIHpFK.exe
  2⤵
  PID:16644
- C:\Windows\System\pWsqKhg.exe
  C:\Windows\System\pWsqKhg.exe
  2⤵
  PID:16676
- C:\Windows\System\VbuQrIc.exe
  C:\Windows\System\VbuQrIc.exe
  2⤵
  PID:16704
- C:\Windows\System\Adudiom.exe
  C:\Windows\System\Adudiom.exe
  2⤵
  PID:16724
- - C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -u -p 16724 -s 248
    3⤵
    PID:17020
- C:\Windows\System\yircrRb.exe
  C:\Windows\System\yircrRb.exe
  2⤵
  PID:16740
- C:\Windows\System\VQgOLDb.exe
  C:\Windows\System\VQgOLDb.exe
  2⤵
  PID:16760
- C:\Windows\System\rgPWWii.exe
  C:\Windows\System\rgPWWii.exe
  2⤵
  PID:16788
- C:\Windows\System\UQBSUEX.exe
  C:\Windows\System\UQBSUEX.exe
  2⤵
  PID:16804
- C:\Windows\System\lxTdDpq.exe
  C:\Windows\System\lxTdDpq.exe
  2⤵
  PID:16832
- C:\Windows\System\rXqbJcC.exe
  C:\Windows\System\rXqbJcC.exe
  2⤵
  PID:16864
- C:\Windows\System\gRTLXZM.exe
  C:\Windows\System\gRTLXZM.exe
  2⤵
  PID:16880
- C:\Windows\System\kDHZrjX.exe
  C:\Windows\System\kDHZrjX.exe
  2⤵
  PID:16896
- C:\Windows\System\RzgLBTb.exe
  C:\Windows\System\RzgLBTb.exe
  2⤵
  PID:16936
- C:\Windows\System\ymlpclW.exe
  C:\Windows\System\ymlpclW.exe
  2⤵
  PID:16956
- C:\Windows\System\PhtDxwX.exe
  C:\Windows\System\PhtDxwX.exe
  2⤵
  PID:16988
- C:\Windows\System\AVyynCl.exe
  C:\Windows\System\AVyynCl.exe
  2⤵
  PID:17012
- C:\Windows\System\JWtEPKp.exe
  C:\Windows\System\JWtEPKp.exe
  2⤵
  PID:17032
- C:\Windows\System\PIppyqJ.exe
  C:\Windows\System\PIppyqJ.exe
  2⤵
  PID:17060
- C:\Windows\System\dPhRPxC.exe
  C:\Windows\System\dPhRPxC.exe
  2⤵
  PID:17080
- C:\Windows\System\UnNIyay.exe
  C:\Windows\System\UnNIyay.exe
  2⤵
  PID:17096
- C:\Windows\System\qFNohsD.exe
  C:\Windows\System\qFNohsD.exe
  2⤵
  PID:17112
- C:\Windows\System\wdEIyiI.exe
  C:\Windows\System\wdEIyiI.exe
  2⤵
  PID:17132
- C:\Windows\System\PFOZYAu.exe
  C:\Windows\System\PFOZYAu.exe
  2⤵
  PID:16060
- C:\Windows\System\zixlWYY.exe
  C:\Windows\System\zixlWYY.exe
  2⤵
  PID:17044
- C:\Windows\System\bnEamOE.exe
  C:\Windows\System\bnEamOE.exe
  2⤵
  PID:16748
- C:\Windows\System\xVGEGlk.exe
  C:\Windows\System\xVGEGlk.exe
  2⤵
  PID:16796
- C:\Windows\System\JksFWFB.exe
  C:\Windows\System\JksFWFB.exe
  2⤵
  PID:17200
- C:\Windows\System\phxmKRp.exe
  C:\Windows\System\phxmKRp.exe
  2⤵
  PID:16948
- C:\Windows\System\mEeKGMa.exe
  C:\Windows\System\mEeKGMa.exe
  2⤵
  PID:17048
- C:\Windows\System\IeiTbbv.exe
  C:\Windows\System\IeiTbbv.exe
  2⤵
  PID:17164
- C:\Windows\System\ffVyFhj.exe
  C:\Windows\System\ffVyFhj.exe
  2⤵
  PID:17076

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:17120

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\AAkcixG.exe

Filesize
1.5MB

MD5
a7f04ebbf5dfd3799bba4bdb81d8efa3

SHA1
5a36e3afd4480c0abb29cfba3c00746765573337

SHA256
c7835551a5e1ae9da97fe8a8af915fe4a5756824fd053cc54963b4f1b0c36cb7

SHA512
124e873defed79eed5f3537c5ad5eb36e830c64a0554601b0d6e268270c9a6f73cb01f50f477dc08b02df9196991c2277440bee8c9134d2188dd299ac08c57cf

Download Submit
C:\Windows\System\AJsLBOa.exe

Filesize
1.5MB

MD5
6e8ee8654d360b4b4021fe0d2d9b3a64

SHA1
245e745beea702a12fb992fda6107c947e4e2dd3

SHA256
668f914ad39d928b4610ba81d9c3e72f56c71a7695ddef53e2caed40c74a26b4

SHA512
98f1538d4dce51b6c49a45e035cf8197b62841fff75b780cb4685b748ce17fde8848ff30879716c9947cb5b9eb85a12bed52a3993b5803f51ba928b6ccc46855

Download Submit
C:\Windows\System\ANjpgjI.exe

Filesize
1.5MB

MD5
cc229bde7d078fc69a483be636dd8196

SHA1
4b1cdc6771109a642ac18e4d9d5d2bf8d0d9d9dc

SHA256
ad94cffdd6b75446961bb7afe5d446d16dade42111f368915ea49f98d2c5baae

SHA512
99b5aa17201f261d6699f4483fe1aedefeda5e20c5103f59971353514b4bd61dbd5c32b3465a315581b8ae0ecc099db9d11a386e818eba008ba82d6aaf98dd2f

Download Submit
C:\Windows\System\AgFyxJY.exe

Filesize
1.5MB

MD5
162679f1d99ae69a92ef7db9c9234215

SHA1
fa7f58a39cf18656d906055efa717dce37ea6a78

SHA256
b196e5b08d38cbdec23dcd4cb99574e3fde4c2659439572b83e8a08486e9a1bc

SHA512
18434ff272d5521cbdbbbba61e9a5af5c657c6662918a65894dbb9689fdebd016b9bd7f57c9cb3b216f040a91ce685cb118697112d122f57beb71ad568bd03f1

Download Submit
C:\Windows\System\DNSuWEm.exe

Filesize
1.5MB

MD5
b481b9f8621b5017779e541144134191

SHA1
b5937210b1a4ea76f8f013265d3d8027846612fa

SHA256
eb0401c7a3549f911c09a6b68ce97d3f837083a6cab74a899ed1bfca7401768b

SHA512
e7a37e1ddb538bece9e3ada748ce62d22dc10210be6f8c3f3f44e7531fda372b501975ef2c8d58c2a11d0746598bde89e626001c91ac27ac6ba0ac5b42d2c825

Download Submit
C:\Windows\System\EFnCRey.exe

Filesize
1.5MB

MD5
7633df868763a741f3027ece0395d9b9

SHA1
3de02ff4277b702c08434ea26ff397f33dd0fd7b

SHA256
1d58b977349f464fa08c3b6ec853c00ee5aa23546d0be36d98f4683278e02495

SHA512
8260f5877c8f9b2cb27a235f769e8ac18028144726f4e537c82763f863ac49bde08a6736255f6cf4a60c6df85f6ed0fec2629ffb61fdb3cf60ed97000dd69e77

Download Submit
C:\Windows\System\FEdEDSz.exe

Filesize
1.5MB

MD5
60040075bc78038960a392e396c26500

SHA1
151d9f558b9d34a00d5d608bcdeb77274abda216

SHA256
2fe789fbbd3b6c6575ffe03307a98025d88885353ce74b0d23396ec8cf91053f

SHA512
32f5b96e0e44a11f8ef1c32706f223006e1afc497d0c1c586946f46c314a6a1d6b5ef98da771d8a30c498512c0fbbd7b455d7ad57b8e3769eba50714adf35cea

Download Submit
C:\Windows\System\HKIOuhf.exe

Filesize
1.5MB

MD5
ec6901ffc070946e6885beb0ff474171

SHA1
1d07327fa773ef500563931e70f031e30276a254

SHA256
5af6f8dc7925623caa5e04ed5fe07369261445428dc9181db630ecc674ab6cb3

SHA512
8045597643d0b7f0dfca822b5532454233b1763c8309973c136cd5c62ae76ea1fa7108fecc3c93fb87b3322ff4c0750aac967ce0b9253c861aa82d3499358e9a

Download Submit
C:\Windows\System\ISYgaDc.exe

Filesize
1.5MB

MD5
aa3b02e8ddd492133d05a20378e26b56

SHA1
df4669f10e299610ad9e1e39be74ddbb0923d5ba

SHA256
153fe38bc24856844ebc3a045b888bd2c523a295eb738ab9e17683afe7b4345a

SHA512
d3b16ab44783a96af6d122423be5758354842bc8f973d7fb0370a379fc7ae18fa777ffbcbc3a18c2bfc924f6b0cfe09b70b4b0fea62b6651d3c6ff122199c4d1

Download Submit
C:\Windows\System\JTSKgDv.exe

Filesize
1.5MB

MD5
8a51ca82bd9feb61d8e05a1f47dbb532

SHA1
4f94460a252594293d9fb73c8c70997ab1a285cf

SHA256
ce18c21cbb6e762a338986124e3a9030cdc4181392e3f1e4f40237622412171f

SHA512
f1f72cd83ecfd16aa84117e053e0baab1992af00773f9e80ae152a8bcbc05382fa40948e5c60a83d68cc89001a00d4830c87c16a59fde04de8f388312faf35f6

Download Submit
C:\Windows\System\NWUTNBK.exe

Filesize
1.5MB

MD5
65b76ad1a5a0be8bb3d7664c7e90a7b1

SHA1
96814a28f0f10a4674b69ce3efb09825ba1ae91f

SHA256
21e4256b899f8637e86273624b473c35c412693be1421262909aa5f11543f59e

SHA512
5289fb3adaf4a70f46f3d38e6f31bb070107e6fe17bf65c0bd2dcc611d3e4f7a031be39f4272b806a96529c17cb58c5290df28d0a49841ed4735808dd97f57f6

Download Submit
C:\Windows\System\NgFdpIS.exe

Filesize
1.5MB

MD5
1ca319175e2afc9f10793e4850bba1c7

SHA1
387478662fab3314b5511d350054aef8d35ebe59

SHA256
0eab678722d754e08614b6d44a94ef71ce92cc3dd5ad778947ed39c414b4a10e

SHA512
466f5c0306e4382ccd31855d13e63d8bd6913cf7bc31b488a50e307d0772a7dce171d16834bd6ce767aa2143eabf3a405fd3e1c606e43f165ff4a4cce8445ea7

Download Submit
C:\Windows\System\OdrSCqM.exe

Filesize
1.5MB

MD5
ee2587c52d9be4dfa9254f73e85c3de3

SHA1
351a9a058cf0b8191d1548457168f10c2d5187a5

SHA256
af59446ecdea1c40a50d6c1810468109d05bc0a75d7a355c00b46df4c8687325

SHA512
ec0573c01b3927c167220c3b0205892ee7d575bf56b0556c85c15a9b30c5101fd1dd72da613de17c1310aaedf84b6b4c9ebc66b7cb5fe7e3826be7ec8bcccf93

Download Submit
C:\Windows\System\PXPnygI.exe

Filesize
1.5MB

MD5
8c14ffcd04924bbbe0844e10314115b8

SHA1
a8cabf44ac64d7a36aa3f00f909a21cac6f5a8bd

SHA256
146d0bd00fb2b469dc98a325efcf6f57063199f05f68db704097e20a27dbea32

SHA512
e4da630ed84aea2bfa49c8e9a8f4ab32c1f3548b686a3309df7aa45b11fb07363c28af889f3347109adce25f87cdcc00f5df2b6764598ab95551bca83730f8c2

Download Submit
C:\Windows\System\QnEvQWR.exe

Filesize
1.5MB

MD5
33dad1a2ee1cd36a3d4722d3206eb8c1

SHA1
06bcce046bde95442f7e7fdac090fd0c4ae3f112

SHA256
e1581cbd26cc81d971c230579911b632daac3f87722bcef216a317fb8cc1421e

SHA512
6ffd479960dfbd60b5e2aba90f7bd09db2bf33c1e9fb9af1f01f135e020a46f59b1495cba5fd5d50f5506659ead9a5879da82124a6c1a5106b0e847a418afded

Download Submit
C:\Windows\System\SWvKfxR.exe

Filesize
1.5MB

MD5
f3f95b8845eda4f9b318253ac87e616c

SHA1
26058f0e4f8e4332506f59c314b0fe43658054b5

SHA256
92893e1c31c55af83914ba3f34655d093c9a11fbc07a8b95ffbea4ca64e2dd52

SHA512
3359d1cc2574be7d8f3048101e9c492f0db078a9f000b56c9f04060f925a8a0298fb91e93ddb2e5900656f3ad04f10ca8d79abcfc6cd121f97ac210581b7013d

Download Submit
C:\Windows\System\UjrKkgk.exe

Filesize
1.5MB

MD5
48abbb88e809a172a3ed2cfa2ac34af5

SHA1
7ac0c6abb870348863fc4f74f3e83f6b6858d5c7

SHA256
217d650596fea5a7c983c545a71361761942b391fd3e471a49721a54b5d610f9

SHA512
8d2f30eb241287d171eec48f6fee1b7f8e1a6a20258ac66187ea2efe1b1a253d278e3952fed0571479e617381c5fa520c1e67562cd0ee4c6c52ca6b4dc2a2033

Download Submit
C:\Windows\System\ZLjvTQB.exe

Filesize
1.5MB

MD5
5460929777d9c14b66036ab445d8d54a

SHA1
5f7163e6dfbcb95fc4262a0467df8909c8903fa3

SHA256
f6e21bc93b31d2d0e758be70a63d354ff911e03b88cb16ae995885d420189baf

SHA512
8151bf0bc0e443211be92b620058026bd8186016e8d71da57834309383e3197b909fa3539a6845e630ac38df98dfed1e0d9f46d7e7de33117b304a3453eceb33

Download Submit
C:\Windows\System\ZkroPJv.exe

Filesize
1.5MB

MD5
d365ef4492c44705e817843064f3eaeb

SHA1
bf2354d91054104936955dc5005296191daad082

SHA256
8eff03df21b2af5c3618a0acf05051d0257cff35216370daed8df34d886e4a94

SHA512
c3beae773be6c090d1d1927e9cb386286c68a0d76e43094e4a6ddd5e9ff7c9e5be5db485ec80dc78ff4ddd84e3c24775046df4512d3a7522743faf3af961a6f5

Download Submit
C:\Windows\System\cLaizTb.exe

Filesize
1.5MB

MD5
46f76e338be9107d7c72c66fb5012b59

SHA1
fc7a181aa1f5528a1de81a8f1f663588bcc223f9

SHA256
4eca3b3497e8c95f4f688c9dc761ae9c707e0fcc1ff005baa9a6920e2aff6227

SHA512
567ef0cb331fdf91aadf21fdf32368883319318ad5e7ae4848fb7ca1a35a3a414f8aa01a913c4e87c263e11de5462d56e06a5011ed771665300a91010aeda5ae

Download Submit
C:\Windows\System\cdYhoAF.exe

Filesize
1.5MB

MD5
09bbe3aa39ed74ec5a29772e5c3409ad

SHA1
26ac057585776532ebd86dfd7b307fded41dda44

SHA256
0f16cc1fb179443ba35a8690b00ee681f9b19a0e2e808994d8f0c3ca5375f60c

SHA512
df568fc8b45e6f299369e12d9936f4dd0abda8929fec9a5d7ee9aaa18536d5fabebd03db5a0231d48a899bfbcf370d5767a550c4a20a692ccb3bd9f8fdcb7713

Download Submit
C:\Windows\System\fXZKFOz.exe

Filesize
1.5MB

MD5
6daa6331ec22cf8b0ab65dd9f1bf0193

SHA1
54deec9cfb0dbdb60be31cd82d0f15beb4aa5c3e

SHA256
a1db63147294f628f20ea2173eb34bc8295680c487c471c2f1c2dbe39b81cec5

SHA512
c15e82e1128fc41a83498f6d578e62e240fc2a6f7b987547b7ab99d9802a4c8b46090d751ba119a202965fe8636c4277665e42873bb0407f83ee248575ab46a2

Download Submit
C:\Windows\System\iMenYnB.exe

Filesize
1.5MB

MD5
672d3d7f05aa1cbdbfecfe01d09750ce

SHA1
d874d288d27f8d922e913e156624191d976feadc

SHA256
52e8ca8f4812ba22370d3f06ab00a58ab50b548b7b5d380eb43f106b9537d394

SHA512
d431450d10abcabc8f6849ff5c1ce6c8472117908e32f24d3586470adadde261ac5a6f80e976f8329f8b50d5ded9be54100d4b53c1f70625e550dad02c054bf5

Download Submit
C:\Windows\System\iVcUYMt.exe

Filesize
1.5MB

MD5
eaf6a5635e0d3d319f9a684cd2ce43d6

SHA1
8bd106a5c431a6d304fbb136ee3493fa48eec180

SHA256
b7ede21d588663b90b7202d094576deebc4e9a34ef657f06408f8e1d52727cd5

SHA512
a6e5185265c3104d46fec2bf13764482fcc65d46afb2ea4a9cfa7c50dd7ecab0a04319a07afaa3254795f2b09bbb20513b043abeeaa18bcbf802f4be2404d770

Download Submit
C:\Windows\System\oDQVJtF.exe

Filesize
1.5MB

MD5
3eee951a55a898a1c09a4241d00ba738

SHA1
921f71887c077f79ef240a4be388251d064e5dbf

SHA256
3d51dd329177bee44c9dbf9688b189b74a8bdb9278ea8844f4191925da6968fa

SHA512
e8d20ac0b247055c7a31b76522bdad759e524bbfba5848b42b210c716b91ec2ab3ef9857ad5945c6f7cf1219ea9563bbdbfd562342dafef300a3f451fc862cbd

Download Submit
C:\Windows\System\pUPfgMv.exe

Filesize
1.5MB

MD5
ea6050a15cbbe586289985136e976457

SHA1
841d5c169ad0c29ca0acb05a63a719c5208c13d6

SHA256
55ce68b223f3550a2f8c0209ffdc247091fbf9a086a58be256d617ec4ce35a7e

SHA512
f3b73af2b333250078df80ba1d09fb80e2337eb8abed423c446f397b4f573e3e6b108f0e3c0f6fcaf868c68384f8366e833015e6e083c68016ae22b9a4e7568a

Download Submit
C:\Windows\System\qBdzKnO.exe

Filesize
1.5MB

MD5
172b65d7a436d84281002f5df04970e0

SHA1
81541ac6917d60ec3e32bf8adb543993c71d2811

SHA256
170ea2c9b2ae9089c98401bb0726528e5c333eff5dc58afbccb610fdb5688df2

SHA512
16ac6ffa88088d01b5c1d3644d0a9c6a2bf732c2ab556e72e7063fea8327efa015deeae9db3936ea86199b540b811168ca409304f937bb4f1ddcbb6e3fdb9557

Download Submit
C:\Windows\System\qtDToQc.exe

Filesize
1.5MB

MD5
fcde0ed12fcc94001e4f8c3febb57465

SHA1
5de1da834131f49a864b9aff59e17a343045c296

SHA256
8b23fac9490e9ccd152ec54e502e26abeb8ad5082bebf955fae5870bf334f2fc

SHA512
07cc9fd4cd12df08215cc2349cf3b9d4915d2aa5c11ad09141a805297bdaac8e60b7352fa4e37e835c709488da1ddd1d34f67a457d183e0be4422485d838f8e6

Download Submit
C:\Windows\System\rOAoHQL.exe

Filesize
1.5MB

MD5
38223dcec5520cc2a00373aede049a9d

SHA1
a8f537ec10110abfd3f78fc2521e98babfdb21a4

SHA256
535e41a1b6229df042557e82b1f674780be4e0225c3f23518946b8b8a0cbd607

SHA512
1e4b9b375ef13d7cf341a1ec6715b430f6612d337c0e102e426d90432c748d8aed5eee73fc67d6d6d96727ef9ff16c08ce4921f8085d6766352ced036a5b15c1

Download Submit
C:\Windows\System\soMeFiP.exe

Filesize
1.5MB

MD5
5966d85fb019aabb0e0dc115006b52b1

SHA1
f385bd0285569b5dc956ca720fa4a83e4f2487dc

SHA256
bce0151f8749c3ca847ca8ba3c001a883142517cdbf894b2e3fab4e0febb51a1

SHA512
08b8e9fa61af6e0a74364c47c97cfda51d5b263d3cfd607aeff245850ac18cfc83934a46de50ea2c681196725d0ceb43d580c534545fe0dff2fca5e721e4678f

Download Submit
C:\Windows\System\tCBnzUZ.exe

Filesize
1.5MB

MD5
cacb135dd37a1e0c3f51763d17d1f644

SHA1
6cd4a98bfa8eec0d8285a767fb948b36cde91ad7

SHA256
81c3211d00a09141f237ff8802d5f7a903cb24abab44754bc523597fedb57d00

SHA512
ed20ee0cee53c73b59ac793494f6dc9aa84bd60d9d8184c2f91a495abe5adf0f86667cb1731bb341aa5ba2827041fec65f2ec224f6779c6768b875280033d55b

Download Submit
C:\Windows\System\tIGvenB.exe

Filesize
1.5MB

MD5
4a780b263b0e8af78d486ec2bbcf936e

SHA1
3c7b9d4f4669c88ab3c1758f2c4bce2be37eafef

SHA256
1d67d5b2330a046e2a519b2bc8d60babb43f5ffd181bf390275b045f1c621b6a

SHA512
119ccc14130b0d5de5dd7d741bc5ca47fa61af644cd702373679edf15345e7f2d636599af5c2d8af8104fe9510ae1c3840bc5a88a58c879be1a138adfd855e09

Download Submit
C:\Windows\System\vljTLPA.exe

Filesize
1.5MB

MD5
e276f90e0c5fbbde2bb8f1d593ceabf3

SHA1
4c4c43f2d3ccfd55a2cda72ec4c96cf3d0edd716

SHA256
c5e3744b44babd1cf90455535dd05275e42c9b91cca0fa74b4c0c4362adc5012

SHA512
b6eefb2e3ca92e9e7aef3d80a693d7014570b03f1025cc0f2d3d457a04eb1f4de5f9cfe4d35884cde2832efa227d7007f73ba638f73c4bafa6d4ff6ecb80cb78

Download Submit
C:\Windows\System\xSZVzmY.exe

Filesize
1.5MB

MD5
f60215409d04daafd6066d01a5b1b8dd

SHA1
f18e1baa727ca4183472e7bbb59a9395ec7c9207

SHA256
a0cd20d27e95e126cf177e8f73000e063279803d03c2a700390dd882585d2c03

SHA512
ca2f556d68624835123c8836cd25a30376a948c2fd8de85be4a0349fea6b7131c46fd0144ccaf83d41d425226e0730797d2eb554c60e6d65f07138740de70990

Download Submit
C:\Windows\System\xWrYGWp.exe

Filesize
1.5MB

MD5
f09098d33e966c69dbe3fec871a15dc3

SHA1
4c5d669e7343fd14fc2ad930d034ece6e5cf4952

SHA256
74ea40790a33eec1b1a5fd4b5c8c7dfb0142b4813adabe2b89bf7bb633837621

SHA512
55cfec87daf4a1c4c1a72f496e85b39ae7b057d4482132575bae08e605314435033e01fa049a1784ff8761f62c7e8c3ac0b44b83f2be284d45e90b25f50b1b27

Download Submit
memory/8-0-0x0000021FF8460000-0x0000021FF8470000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads