xmrig | 713a8686becb682adb6e3bc6326b58989eb4f7d5015bc3d0075c41e00c002797

Analysis

max time kernel
110s
max time network
109s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
11-11-2024 23:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

713a8686becb682adb6e3bc6326b58989eb4f7d5015bc3d0075c41e00c002797.exe
Size

1.4MB
MD5

c12514b88b22ef802ebf9cf8af76a1d4
SHA1

aac283d5cc2afe6f51df4faac142e8bba5548ed6
SHA256

713a8686becb682adb6e3bc6326b58989eb4f7d5015bc3d0075c41e00c002797
SHA512

0b8e394b342618dd3cf73f25bdbf22041a2e2ef621391664105bb2ad60a5dd1c1b0f55437e84556a5bde205e05c9898880e13a007d0c20ed939bc1eeb5482dc9
SSDEEP

24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbpwlKenszbWKDNEm/5O+7MMKTbc6:GezaTF8FcNkNdfE0pZ9ozttwIRxj4c50

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 37 IoCs

miner

resource	yara_rule
behavioral2/files/0x0008000000023c84-4.dat	xmrig
behavioral2/files/0x0007000000023c89-10.dat	xmrig
behavioral2/files/0x0007000000023c88-11.dat	xmrig
behavioral2/files/0x0007000000023c8a-19.dat	xmrig
behavioral2/files/0x0007000000023c8c-27.dat	xmrig
behavioral2/files/0x0007000000023c8d-34.dat	xmrig
behavioral2/files/0x0008000000023c85-55.dat	xmrig
behavioral2/files/0x0007000000023c95-74.dat	xmrig
behavioral2/files/0x0007000000023c9e-105.dat	xmrig
behavioral2/files/0x0007000000023ca5-136.dat	xmrig
behavioral2/files/0x0007000000023ca4-163.dat	xmrig
behavioral2/files/0x0007000000023ca3-161.dat	xmrig
behavioral2/files/0x0007000000023c9f-159.dat	xmrig
behavioral2/files/0x0007000000023c96-157.dat	xmrig
behavioral2/files/0x0007000000023caa-156.dat	xmrig
behavioral2/files/0x0007000000023ca9-155.dat	xmrig
behavioral2/files/0x0007000000023ca8-152.dat	xmrig
behavioral2/files/0x0007000000023c9d-150.dat	xmrig
behavioral2/files/0x0007000000023c9a-148.dat	xmrig
behavioral2/files/0x0007000000023c99-144.dat	xmrig
behavioral2/files/0x0007000000023c98-142.dat	xmrig
behavioral2/files/0x0007000000023c97-140.dat	xmrig
behavioral2/files/0x0007000000023ca7-139.dat	xmrig
behavioral2/files/0x0007000000023ca6-138.dat	xmrig
behavioral2/files/0x0007000000023c9c-137.dat	xmrig
behavioral2/files/0x0007000000023ca2-129.dat	xmrig
behavioral2/files/0x0007000000023ca1-126.dat	xmrig
behavioral2/files/0x0007000000023ca0-125.dat	xmrig
behavioral2/files/0x0007000000023c94-121.dat	xmrig
behavioral2/files/0x0007000000023c9b-103.dat	xmrig
behavioral2/files/0x0007000000023c93-117.dat	xmrig
behavioral2/files/0x0007000000023c92-87.dat	xmrig
behavioral2/files/0x0007000000023c8f-75.dat	xmrig
behavioral2/files/0x0007000000023c91-65.dat	xmrig
behavioral2/files/0x0007000000023c8e-57.dat	xmrig
behavioral2/files/0x0007000000023c90-62.dat	xmrig
behavioral2/files/0x0007000000023c8b-28.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
4820	ZPqfZZq.exe
2220	lLmYcOs.exe
4804	NcUStNj.exe
2176	iezSnzS.exe
1564	EAFNUGQ.exe
5048	jefXOEV.exe
1448	RxbChZQ.exe
1304	SREYBJt.exe
4692	uyimOzt.exe
3912	PwgwqBL.exe
4324	fSfECAM.exe
808	ISZRpRY.exe
2952	YWnSnKG.exe
3756	omijetl.exe
1808	deJGUBd.exe
4968	xdvPavK.exe
5092	yLlYExM.exe
912	UltxMen.exe
4508	eVpPDkb.exe
3808	kzWQsGM.exe
3200	ZKEyCgX.exe
1972	bxnGPFM.exe
2716	GbqGdYP.exe
4232	LVDJOHj.exe
4568	pQWQcon.exe
432	ISmYBTr.exe
1200	vRkChZM.exe
2244	enFRdKz.exe
5036	enNWBvu.exe
1956	yMexJfa.exe
4720	xTHwLph.exe
2792	UolwzYD.exe
2324	SeouPJv.exe
4560	FYdmann.exe
2880	FdOqeHL.exe
4340	TqfMOBG.exe
4640	ocORAzd.exe
2276	kHeNNxH.exe
2780	SNnihKX.exe
3772	ypLfoHT.exe
3148	vLHXdZU.exe
3728	nDTJxnO.exe
3600	YJUFdwW.exe
3412	TopzEGT.exe
4624	jmVTOsG.exe
4212	IvXcBzI.exe
4436	qhBRLrW.exe
2512	nbOasEY.exe
3788	bVfqfNk.exe
1968	RKDxUDN.exe
4344	BPPVtgi.exe
4896	nUoyVqY.exe
1648	WvCCSvu.exe
4148	DjElEjP.exe
400	wWfYnGp.exe
752	PbNrjak.exe
4124	SnqqlbD.exe
4016	QheAUXs.exe
640	ijnzPZi.exe
2564	aRJshjP.exe
5088	NfIKFYv.exe
4628	yXqujEN.exe
1528	eycdCHD.exe
3100	YRHtkOL.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\ueSRMyX.exe	713a8686becb682adb6e3bc6326b58989eb4f7d5015bc3d0075c41e00c002797.exe
File created	C:\Windows\System\OzptBPU.exe	713a8686becb682adb6e3bc6326b58989eb4f7d5015bc3d0075c41e00c002797.exe
File created	C:\Windows\System\DfLjpda.exe	713a8686becb682adb6e3bc6326b58989eb4f7d5015bc3d0075c41e00c002797.exe
File created	C:\Windows\System\bbWxTit.exe	713a8686becb682adb6e3bc6326b58989eb4f7d5015bc3d0075c41e00c002797.exe
File created	C:\Windows\System\RCdhyAD.exe	713a8686becb682adb6e3bc6326b58989eb4f7d5015bc3d0075c41e00c002797.exe
File created	C:\Windows\System\kWvXpOO.exe	713a8686becb682adb6e3bc6326b58989eb4f7d5015bc3d0075c41e00c002797.exe
File created	C:\Windows\System\lWqziaY.exe	713a8686becb682adb6e3bc6326b58989eb4f7d5015bc3d0075c41e00c002797.exe
File created	C:\Windows\System\FbVytFh.exe	713a8686becb682adb6e3bc6326b58989eb4f7d5015bc3d0075c41e00c002797.exe
File created	C:\Windows\System\TzjlBGg.exe	713a8686becb682adb6e3bc6326b58989eb4f7d5015bc3d0075c41e00c002797.exe
File created	C:\Windows\System\abOMQzZ.exe	713a8686becb682adb6e3bc6326b58989eb4f7d5015bc3d0075c41e00c002797.exe
File created	C:\Windows\System\hEFWMrQ.exe	713a8686becb682adb6e3bc6326b58989eb4f7d5015bc3d0075c41e00c002797.exe
File created	C:\Windows\System\xTTbeeo.exe	713a8686becb682adb6e3bc6326b58989eb4f7d5015bc3d0075c41e00c002797.exe
File created	C:\Windows\System\lNYytNZ.exe	713a8686becb682adb6e3bc6326b58989eb4f7d5015bc3d0075c41e00c002797.exe
File created	C:\Windows\System\XUznasZ.exe	713a8686becb682adb6e3bc6326b58989eb4f7d5015bc3d0075c41e00c002797.exe
File created	C:\Windows\System\ssVqqjZ.exe	713a8686becb682adb6e3bc6326b58989eb4f7d5015bc3d0075c41e00c002797.exe
File created	C:\Windows\System\uAwYEuf.exe	713a8686becb682adb6e3bc6326b58989eb4f7d5015bc3d0075c41e00c002797.exe
File created	C:\Windows\System\vqrBfHu.exe	713a8686becb682adb6e3bc6326b58989eb4f7d5015bc3d0075c41e00c002797.exe
File created	C:\Windows\System\DkObOcL.exe	713a8686becb682adb6e3bc6326b58989eb4f7d5015bc3d0075c41e00c002797.exe
File created	C:\Windows\System\rLXUIHy.exe	713a8686becb682adb6e3bc6326b58989eb4f7d5015bc3d0075c41e00c002797.exe
File created	C:\Windows\System\UWUYdaU.exe	713a8686becb682adb6e3bc6326b58989eb4f7d5015bc3d0075c41e00c002797.exe
File created	C:\Windows\System\nxtnWiN.exe	713a8686becb682adb6e3bc6326b58989eb4f7d5015bc3d0075c41e00c002797.exe
File created	C:\Windows\System\fXpfTFC.exe	713a8686becb682adb6e3bc6326b58989eb4f7d5015bc3d0075c41e00c002797.exe
File created	C:\Windows\System\ArgNaoO.exe	713a8686becb682adb6e3bc6326b58989eb4f7d5015bc3d0075c41e00c002797.exe
File created	C:\Windows\System\MueHKsN.exe	713a8686becb682adb6e3bc6326b58989eb4f7d5015bc3d0075c41e00c002797.exe
File created	C:\Windows\System\FIhVeNq.exe	713a8686becb682adb6e3bc6326b58989eb4f7d5015bc3d0075c41e00c002797.exe
File created	C:\Windows\System\yrlmjjX.exe	713a8686becb682adb6e3bc6326b58989eb4f7d5015bc3d0075c41e00c002797.exe
File created	C:\Windows\System\tnxmUjD.exe	713a8686becb682adb6e3bc6326b58989eb4f7d5015bc3d0075c41e00c002797.exe
File created	C:\Windows\System\YuCPCMv.exe	713a8686becb682adb6e3bc6326b58989eb4f7d5015bc3d0075c41e00c002797.exe
File created	C:\Windows\System\QAoyVdX.exe	713a8686becb682adb6e3bc6326b58989eb4f7d5015bc3d0075c41e00c002797.exe
File created	C:\Windows\System\WAggVHt.exe	713a8686becb682adb6e3bc6326b58989eb4f7d5015bc3d0075c41e00c002797.exe
File created	C:\Windows\System\OCsgVvv.exe	713a8686becb682adb6e3bc6326b58989eb4f7d5015bc3d0075c41e00c002797.exe
File created	C:\Windows\System\FSPbpkP.exe	713a8686becb682adb6e3bc6326b58989eb4f7d5015bc3d0075c41e00c002797.exe
File created	C:\Windows\System\potJILv.exe	713a8686becb682adb6e3bc6326b58989eb4f7d5015bc3d0075c41e00c002797.exe
File created	C:\Windows\System\mXGpUWA.exe	713a8686becb682adb6e3bc6326b58989eb4f7d5015bc3d0075c41e00c002797.exe
File created	C:\Windows\System\QqHAlhP.exe	713a8686becb682adb6e3bc6326b58989eb4f7d5015bc3d0075c41e00c002797.exe
File created	C:\Windows\System\eVpPDkb.exe	713a8686becb682adb6e3bc6326b58989eb4f7d5015bc3d0075c41e00c002797.exe
File created	C:\Windows\System\AxzpKQa.exe	713a8686becb682adb6e3bc6326b58989eb4f7d5015bc3d0075c41e00c002797.exe
File created	C:\Windows\System\GGyUpJb.exe	713a8686becb682adb6e3bc6326b58989eb4f7d5015bc3d0075c41e00c002797.exe
File created	C:\Windows\System\HQrqHkf.exe	713a8686becb682adb6e3bc6326b58989eb4f7d5015bc3d0075c41e00c002797.exe
File created	C:\Windows\System\FYdmann.exe	713a8686becb682adb6e3bc6326b58989eb4f7d5015bc3d0075c41e00c002797.exe
File created	C:\Windows\System\IvXcBzI.exe	713a8686becb682adb6e3bc6326b58989eb4f7d5015bc3d0075c41e00c002797.exe
File created	C:\Windows\System\VZVJccy.exe	713a8686becb682adb6e3bc6326b58989eb4f7d5015bc3d0075c41e00c002797.exe
File created	C:\Windows\System\kHeNNxH.exe	713a8686becb682adb6e3bc6326b58989eb4f7d5015bc3d0075c41e00c002797.exe
File created	C:\Windows\System\KsYaRMF.exe	713a8686becb682adb6e3bc6326b58989eb4f7d5015bc3d0075c41e00c002797.exe
File created	C:\Windows\System\KcZmFDE.exe	713a8686becb682adb6e3bc6326b58989eb4f7d5015bc3d0075c41e00c002797.exe
File created	C:\Windows\System\MbysGsY.exe	713a8686becb682adb6e3bc6326b58989eb4f7d5015bc3d0075c41e00c002797.exe
File created	C:\Windows\System\aLnNpcR.exe	713a8686becb682adb6e3bc6326b58989eb4f7d5015bc3d0075c41e00c002797.exe
File created	C:\Windows\System\ceFYbvV.exe	713a8686becb682adb6e3bc6326b58989eb4f7d5015bc3d0075c41e00c002797.exe
File created	C:\Windows\System\LDzAgNP.exe	713a8686becb682adb6e3bc6326b58989eb4f7d5015bc3d0075c41e00c002797.exe
File created	C:\Windows\System\lRuAYFv.exe	713a8686becb682adb6e3bc6326b58989eb4f7d5015bc3d0075c41e00c002797.exe
File created	C:\Windows\System\BPmadDM.exe	713a8686becb682adb6e3bc6326b58989eb4f7d5015bc3d0075c41e00c002797.exe
File created	C:\Windows\System\FyMJBuX.exe	713a8686becb682adb6e3bc6326b58989eb4f7d5015bc3d0075c41e00c002797.exe
File created	C:\Windows\System\qdxiJdf.exe	713a8686becb682adb6e3bc6326b58989eb4f7d5015bc3d0075c41e00c002797.exe
File created	C:\Windows\System\bXbywGn.exe	713a8686becb682adb6e3bc6326b58989eb4f7d5015bc3d0075c41e00c002797.exe
File created	C:\Windows\System\wLeeeRm.exe	713a8686becb682adb6e3bc6326b58989eb4f7d5015bc3d0075c41e00c002797.exe
File created	C:\Windows\System\GFHOyAu.exe	713a8686becb682adb6e3bc6326b58989eb4f7d5015bc3d0075c41e00c002797.exe
File created	C:\Windows\System\OWrowGG.exe	713a8686becb682adb6e3bc6326b58989eb4f7d5015bc3d0075c41e00c002797.exe
File created	C:\Windows\System\HGlMhVe.exe	713a8686becb682adb6e3bc6326b58989eb4f7d5015bc3d0075c41e00c002797.exe
File created	C:\Windows\System\wWfYnGp.exe	713a8686becb682adb6e3bc6326b58989eb4f7d5015bc3d0075c41e00c002797.exe
File created	C:\Windows\System\TFNmrfT.exe	713a8686becb682adb6e3bc6326b58989eb4f7d5015bc3d0075c41e00c002797.exe
File created	C:\Windows\System\hKDKwqo.exe	713a8686becb682adb6e3bc6326b58989eb4f7d5015bc3d0075c41e00c002797.exe
File created	C:\Windows\System\eycdCHD.exe	713a8686becb682adb6e3bc6326b58989eb4f7d5015bc3d0075c41e00c002797.exe
File created	C:\Windows\System\FjgjOIE.exe	713a8686becb682adb6e3bc6326b58989eb4f7d5015bc3d0075c41e00c002797.exe
File created	C:\Windows\System\ktekcBq.exe	713a8686becb682adb6e3bc6326b58989eb4f7d5015bc3d0075c41e00c002797.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	14708	dwm.exe
Token: SeChangeNotifyPrivilege	14708	dwm.exe
Token: 33	14708	dwm.exe
Token: SeIncBasePriorityPrivilege	14708	dwm.exe
Token: SeShutdownPrivilege	14708	dwm.exe
Token: SeCreatePagefilePrivilege	14708	dwm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2476 wrote to memory of 4820	2476	713a8686becb682adb6e3bc6326b58989eb4f7d5015bc3d0075c41e00c002797.exe	84
PID 2476 wrote to memory of 4820	2476	713a8686becb682adb6e3bc6326b58989eb4f7d5015bc3d0075c41e00c002797.exe	84
PID 2476 wrote to memory of 2220	2476	713a8686becb682adb6e3bc6326b58989eb4f7d5015bc3d0075c41e00c002797.exe	85
PID 2476 wrote to memory of 2220	2476	713a8686becb682adb6e3bc6326b58989eb4f7d5015bc3d0075c41e00c002797.exe	85
PID 2476 wrote to memory of 4804	2476	713a8686becb682adb6e3bc6326b58989eb4f7d5015bc3d0075c41e00c002797.exe	86
PID 2476 wrote to memory of 4804	2476	713a8686becb682adb6e3bc6326b58989eb4f7d5015bc3d0075c41e00c002797.exe	86
PID 2476 wrote to memory of 2176	2476	713a8686becb682adb6e3bc6326b58989eb4f7d5015bc3d0075c41e00c002797.exe	87
PID 2476 wrote to memory of 2176	2476	713a8686becb682adb6e3bc6326b58989eb4f7d5015bc3d0075c41e00c002797.exe	87
PID 2476 wrote to memory of 1564	2476	713a8686becb682adb6e3bc6326b58989eb4f7d5015bc3d0075c41e00c002797.exe	88
PID 2476 wrote to memory of 1564	2476	713a8686becb682adb6e3bc6326b58989eb4f7d5015bc3d0075c41e00c002797.exe	88
PID 2476 wrote to memory of 5048	2476	713a8686becb682adb6e3bc6326b58989eb4f7d5015bc3d0075c41e00c002797.exe	89
PID 2476 wrote to memory of 5048	2476	713a8686becb682adb6e3bc6326b58989eb4f7d5015bc3d0075c41e00c002797.exe	89
PID 2476 wrote to memory of 1448	2476	713a8686becb682adb6e3bc6326b58989eb4f7d5015bc3d0075c41e00c002797.exe	90
PID 2476 wrote to memory of 1448	2476	713a8686becb682adb6e3bc6326b58989eb4f7d5015bc3d0075c41e00c002797.exe	90
PID 2476 wrote to memory of 1304	2476	713a8686becb682adb6e3bc6326b58989eb4f7d5015bc3d0075c41e00c002797.exe	91
PID 2476 wrote to memory of 1304	2476	713a8686becb682adb6e3bc6326b58989eb4f7d5015bc3d0075c41e00c002797.exe	91
PID 2476 wrote to memory of 4324	2476	713a8686becb682adb6e3bc6326b58989eb4f7d5015bc3d0075c41e00c002797.exe	92
PID 2476 wrote to memory of 4324	2476	713a8686becb682adb6e3bc6326b58989eb4f7d5015bc3d0075c41e00c002797.exe	92
PID 2476 wrote to memory of 4692	2476	713a8686becb682adb6e3bc6326b58989eb4f7d5015bc3d0075c41e00c002797.exe	93
PID 2476 wrote to memory of 4692	2476	713a8686becb682adb6e3bc6326b58989eb4f7d5015bc3d0075c41e00c002797.exe	93
PID 2476 wrote to memory of 3912	2476	713a8686becb682adb6e3bc6326b58989eb4f7d5015bc3d0075c41e00c002797.exe	94
PID 2476 wrote to memory of 3912	2476	713a8686becb682adb6e3bc6326b58989eb4f7d5015bc3d0075c41e00c002797.exe	94
PID 2476 wrote to memory of 808	2476	713a8686becb682adb6e3bc6326b58989eb4f7d5015bc3d0075c41e00c002797.exe	95
PID 2476 wrote to memory of 808	2476	713a8686becb682adb6e3bc6326b58989eb4f7d5015bc3d0075c41e00c002797.exe	95
PID 2476 wrote to memory of 2952	2476	713a8686becb682adb6e3bc6326b58989eb4f7d5015bc3d0075c41e00c002797.exe	96
PID 2476 wrote to memory of 2952	2476	713a8686becb682adb6e3bc6326b58989eb4f7d5015bc3d0075c41e00c002797.exe	96
PID 2476 wrote to memory of 3756	2476	713a8686becb682adb6e3bc6326b58989eb4f7d5015bc3d0075c41e00c002797.exe	97
PID 2476 wrote to memory of 3756	2476	713a8686becb682adb6e3bc6326b58989eb4f7d5015bc3d0075c41e00c002797.exe	97
PID 2476 wrote to memory of 1808	2476	713a8686becb682adb6e3bc6326b58989eb4f7d5015bc3d0075c41e00c002797.exe	98
PID 2476 wrote to memory of 1808	2476	713a8686becb682adb6e3bc6326b58989eb4f7d5015bc3d0075c41e00c002797.exe	98
PID 2476 wrote to memory of 4968	2476	713a8686becb682adb6e3bc6326b58989eb4f7d5015bc3d0075c41e00c002797.exe	99
PID 2476 wrote to memory of 4968	2476	713a8686becb682adb6e3bc6326b58989eb4f7d5015bc3d0075c41e00c002797.exe	99
PID 2476 wrote to memory of 5092	2476	713a8686becb682adb6e3bc6326b58989eb4f7d5015bc3d0075c41e00c002797.exe	100
PID 2476 wrote to memory of 5092	2476	713a8686becb682adb6e3bc6326b58989eb4f7d5015bc3d0075c41e00c002797.exe	100
PID 2476 wrote to memory of 912	2476	713a8686becb682adb6e3bc6326b58989eb4f7d5015bc3d0075c41e00c002797.exe	101
PID 2476 wrote to memory of 912	2476	713a8686becb682adb6e3bc6326b58989eb4f7d5015bc3d0075c41e00c002797.exe	101
PID 2476 wrote to memory of 4508	2476	713a8686becb682adb6e3bc6326b58989eb4f7d5015bc3d0075c41e00c002797.exe	102
PID 2476 wrote to memory of 4508	2476	713a8686becb682adb6e3bc6326b58989eb4f7d5015bc3d0075c41e00c002797.exe	102
PID 2476 wrote to memory of 3808	2476	713a8686becb682adb6e3bc6326b58989eb4f7d5015bc3d0075c41e00c002797.exe	103
PID 2476 wrote to memory of 3808	2476	713a8686becb682adb6e3bc6326b58989eb4f7d5015bc3d0075c41e00c002797.exe	103
PID 2476 wrote to memory of 3200	2476	713a8686becb682adb6e3bc6326b58989eb4f7d5015bc3d0075c41e00c002797.exe	104
PID 2476 wrote to memory of 3200	2476	713a8686becb682adb6e3bc6326b58989eb4f7d5015bc3d0075c41e00c002797.exe	104
PID 2476 wrote to memory of 1972	2476	713a8686becb682adb6e3bc6326b58989eb4f7d5015bc3d0075c41e00c002797.exe	105
PID 2476 wrote to memory of 1972	2476	713a8686becb682adb6e3bc6326b58989eb4f7d5015bc3d0075c41e00c002797.exe	105
PID 2476 wrote to memory of 2792	2476	713a8686becb682adb6e3bc6326b58989eb4f7d5015bc3d0075c41e00c002797.exe	106
PID 2476 wrote to memory of 2792	2476	713a8686becb682adb6e3bc6326b58989eb4f7d5015bc3d0075c41e00c002797.exe	106
PID 2476 wrote to memory of 2716	2476	713a8686becb682adb6e3bc6326b58989eb4f7d5015bc3d0075c41e00c002797.exe	107
PID 2476 wrote to memory of 2716	2476	713a8686becb682adb6e3bc6326b58989eb4f7d5015bc3d0075c41e00c002797.exe	107
PID 2476 wrote to memory of 4232	2476	713a8686becb682adb6e3bc6326b58989eb4f7d5015bc3d0075c41e00c002797.exe	108
PID 2476 wrote to memory of 4232	2476	713a8686becb682adb6e3bc6326b58989eb4f7d5015bc3d0075c41e00c002797.exe	108
PID 2476 wrote to memory of 4568	2476	713a8686becb682adb6e3bc6326b58989eb4f7d5015bc3d0075c41e00c002797.exe	109
PID 2476 wrote to memory of 4568	2476	713a8686becb682adb6e3bc6326b58989eb4f7d5015bc3d0075c41e00c002797.exe	109
PID 2476 wrote to memory of 432	2476	713a8686becb682adb6e3bc6326b58989eb4f7d5015bc3d0075c41e00c002797.exe	110
PID 2476 wrote to memory of 432	2476	713a8686becb682adb6e3bc6326b58989eb4f7d5015bc3d0075c41e00c002797.exe	110
PID 2476 wrote to memory of 1200	2476	713a8686becb682adb6e3bc6326b58989eb4f7d5015bc3d0075c41e00c002797.exe	111
PID 2476 wrote to memory of 1200	2476	713a8686becb682adb6e3bc6326b58989eb4f7d5015bc3d0075c41e00c002797.exe	111
PID 2476 wrote to memory of 2244	2476	713a8686becb682adb6e3bc6326b58989eb4f7d5015bc3d0075c41e00c002797.exe	112
PID 2476 wrote to memory of 2244	2476	713a8686becb682adb6e3bc6326b58989eb4f7d5015bc3d0075c41e00c002797.exe	112
PID 2476 wrote to memory of 5036	2476	713a8686becb682adb6e3bc6326b58989eb4f7d5015bc3d0075c41e00c002797.exe	113
PID 2476 wrote to memory of 5036	2476	713a8686becb682adb6e3bc6326b58989eb4f7d5015bc3d0075c41e00c002797.exe	113
PID 2476 wrote to memory of 1956	2476	713a8686becb682adb6e3bc6326b58989eb4f7d5015bc3d0075c41e00c002797.exe	114
PID 2476 wrote to memory of 1956	2476	713a8686becb682adb6e3bc6326b58989eb4f7d5015bc3d0075c41e00c002797.exe	114
PID 2476 wrote to memory of 4720	2476	713a8686becb682adb6e3bc6326b58989eb4f7d5015bc3d0075c41e00c002797.exe	115
PID 2476 wrote to memory of 4720	2476	713a8686becb682adb6e3bc6326b58989eb4f7d5015bc3d0075c41e00c002797.exe	115

C:\Users\Admin\AppData\Local\Temp\713a8686becb682adb6e3bc6326b58989eb4f7d5015bc3d0075c41e00c002797.exe
"C:\Users\Admin\AppData\Local\Temp\713a8686becb682adb6e3bc6326b58989eb4f7d5015bc3d0075c41e00c002797.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2476
- C:\Windows\System\ZPqfZZq.exe
  C:\Windows\System\ZPqfZZq.exe
  2⤵
  - Executes dropped EXE
  PID:4820
- C:\Windows\System\lLmYcOs.exe
  C:\Windows\System\lLmYcOs.exe
  2⤵
  - Executes dropped EXE
  PID:2220
- C:\Windows\System\NcUStNj.exe
  C:\Windows\System\NcUStNj.exe
  2⤵
  - Executes dropped EXE
  PID:4804
- C:\Windows\System\iezSnzS.exe
  C:\Windows\System\iezSnzS.exe
  2⤵
  - Executes dropped EXE
  PID:2176
- C:\Windows\System\EAFNUGQ.exe
  C:\Windows\System\EAFNUGQ.exe
  2⤵
  - Executes dropped EXE
  PID:1564
- C:\Windows\System\jefXOEV.exe
  C:\Windows\System\jefXOEV.exe
  2⤵
  - Executes dropped EXE
  PID:5048
- C:\Windows\System\RxbChZQ.exe
  C:\Windows\System\RxbChZQ.exe
  2⤵
  - Executes dropped EXE
  PID:1448
- C:\Windows\System\SREYBJt.exe
  C:\Windows\System\SREYBJt.exe
  2⤵
  - Executes dropped EXE
  PID:1304
- C:\Windows\System\fSfECAM.exe
  C:\Windows\System\fSfECAM.exe
  2⤵
  - Executes dropped EXE
  PID:4324
- C:\Windows\System\uyimOzt.exe
  C:\Windows\System\uyimOzt.exe
  2⤵
  - Executes dropped EXE
  PID:4692
- C:\Windows\System\PwgwqBL.exe
  C:\Windows\System\PwgwqBL.exe
  2⤵
  - Executes dropped EXE
  PID:3912
- C:\Windows\System\ISZRpRY.exe
  C:\Windows\System\ISZRpRY.exe
  2⤵
  - Executes dropped EXE
  PID:808
- C:\Windows\System\YWnSnKG.exe
  C:\Windows\System\YWnSnKG.exe
  2⤵
  - Executes dropped EXE
  PID:2952
- C:\Windows\System\omijetl.exe
  C:\Windows\System\omijetl.exe
  2⤵
  - Executes dropped EXE
  PID:3756
- C:\Windows\System\deJGUBd.exe
  C:\Windows\System\deJGUBd.exe
  2⤵
  - Executes dropped EXE
  PID:1808
- C:\Windows\System\xdvPavK.exe
  C:\Windows\System\xdvPavK.exe
  2⤵
  - Executes dropped EXE
  PID:4968
- C:\Windows\System\yLlYExM.exe
  C:\Windows\System\yLlYExM.exe
  2⤵
  - Executes dropped EXE
  PID:5092
- C:\Windows\System\UltxMen.exe
  C:\Windows\System\UltxMen.exe
  2⤵
  - Executes dropped EXE
  PID:912
- C:\Windows\System\eVpPDkb.exe
  C:\Windows\System\eVpPDkb.exe
  2⤵
  - Executes dropped EXE
  PID:4508
- C:\Windows\System\kzWQsGM.exe
  C:\Windows\System\kzWQsGM.exe
  2⤵
  - Executes dropped EXE
  PID:3808
- C:\Windows\System\ZKEyCgX.exe
  C:\Windows\System\ZKEyCgX.exe
  2⤵
  - Executes dropped EXE
  PID:3200
- C:\Windows\System\bxnGPFM.exe
  C:\Windows\System\bxnGPFM.exe
  2⤵
  - Executes dropped EXE
  PID:1972
- C:\Windows\System\UolwzYD.exe
  C:\Windows\System\UolwzYD.exe
  2⤵
  - Executes dropped EXE
  PID:2792
- C:\Windows\System\GbqGdYP.exe
  C:\Windows\System\GbqGdYP.exe
  2⤵
  - Executes dropped EXE
  PID:2716
- C:\Windows\System\LVDJOHj.exe
  C:\Windows\System\LVDJOHj.exe
  2⤵
  - Executes dropped EXE
  PID:4232
- C:\Windows\System\pQWQcon.exe
  C:\Windows\System\pQWQcon.exe
  2⤵
  - Executes dropped EXE
  PID:4568
- C:\Windows\System\ISmYBTr.exe
  C:\Windows\System\ISmYBTr.exe
  2⤵
  - Executes dropped EXE
  PID:432
- C:\Windows\System\vRkChZM.exe
  C:\Windows\System\vRkChZM.exe
  2⤵
  - Executes dropped EXE
  PID:1200
- C:\Windows\System\enFRdKz.exe
  C:\Windows\System\enFRdKz.exe
  2⤵
  - Executes dropped EXE
  PID:2244
- C:\Windows\System\enNWBvu.exe
  C:\Windows\System\enNWBvu.exe
  2⤵
  - Executes dropped EXE
  PID:5036
- C:\Windows\System\yMexJfa.exe
  C:\Windows\System\yMexJfa.exe
  2⤵
  - Executes dropped EXE
  PID:1956
- C:\Windows\System\xTHwLph.exe
  C:\Windows\System\xTHwLph.exe
  2⤵
  - Executes dropped EXE
  PID:4720
- C:\Windows\System\SeouPJv.exe
  C:\Windows\System\SeouPJv.exe
  2⤵
  - Executes dropped EXE
  PID:2324
- C:\Windows\System\FYdmann.exe
  C:\Windows\System\FYdmann.exe
  2⤵
  - Executes dropped EXE
  PID:4560
- C:\Windows\System\FdOqeHL.exe
  C:\Windows\System\FdOqeHL.exe
  2⤵
  - Executes dropped EXE
  PID:2880
- C:\Windows\System\TqfMOBG.exe
  C:\Windows\System\TqfMOBG.exe
  2⤵
  - Executes dropped EXE
  PID:4340
- C:\Windows\System\ocORAzd.exe
  C:\Windows\System\ocORAzd.exe
  2⤵
  - Executes dropped EXE
  PID:4640
- C:\Windows\System\kHeNNxH.exe
  C:\Windows\System\kHeNNxH.exe
  2⤵
  - Executes dropped EXE
  PID:2276
- C:\Windows\System\SNnihKX.exe
  C:\Windows\System\SNnihKX.exe
  2⤵
  - Executes dropped EXE
  PID:2780
- C:\Windows\System\ypLfoHT.exe
  C:\Windows\System\ypLfoHT.exe
  2⤵
  - Executes dropped EXE
  PID:3772
- C:\Windows\System\nDTJxnO.exe
  C:\Windows\System\nDTJxnO.exe
  2⤵
  - Executes dropped EXE
  PID:3728
- C:\Windows\System\vLHXdZU.exe
  C:\Windows\System\vLHXdZU.exe
  2⤵
  - Executes dropped EXE
  PID:3148
- C:\Windows\System\YJUFdwW.exe
  C:\Windows\System\YJUFdwW.exe
  2⤵
  - Executes dropped EXE
  PID:3600
- C:\Windows\System\TopzEGT.exe
  C:\Windows\System\TopzEGT.exe
  2⤵
  - Executes dropped EXE
  PID:3412
- C:\Windows\System\jmVTOsG.exe
  C:\Windows\System\jmVTOsG.exe
  2⤵
  - Executes dropped EXE
  PID:4624
- C:\Windows\System\IvXcBzI.exe
  C:\Windows\System\IvXcBzI.exe
  2⤵
  - Executes dropped EXE
  PID:4212
- C:\Windows\System\nbOasEY.exe
  C:\Windows\System\nbOasEY.exe
  2⤵
  - Executes dropped EXE
  PID:2512
- C:\Windows\System\qhBRLrW.exe
  C:\Windows\System\qhBRLrW.exe
  2⤵
  - Executes dropped EXE
  PID:4436
- C:\Windows\System\bVfqfNk.exe
  C:\Windows\System\bVfqfNk.exe
  2⤵
  - Executes dropped EXE
  PID:3788
- C:\Windows\System\RKDxUDN.exe
  C:\Windows\System\RKDxUDN.exe
  2⤵
  - Executes dropped EXE
  PID:1968
- C:\Windows\System\BPPVtgi.exe
  C:\Windows\System\BPPVtgi.exe
  2⤵
  - Executes dropped EXE
  PID:4344
- C:\Windows\System\nUoyVqY.exe
  C:\Windows\System\nUoyVqY.exe
  2⤵
  - Executes dropped EXE
  PID:4896
- C:\Windows\System\DjElEjP.exe
  C:\Windows\System\DjElEjP.exe
  2⤵
  - Executes dropped EXE
  PID:4148
- C:\Windows\System\wWfYnGp.exe
  C:\Windows\System\wWfYnGp.exe
  2⤵
  - Executes dropped EXE
  PID:400
- C:\Windows\System\WvCCSvu.exe
  C:\Windows\System\WvCCSvu.exe
  2⤵
  - Executes dropped EXE
  PID:1648
- C:\Windows\System\PbNrjak.exe
  C:\Windows\System\PbNrjak.exe
  2⤵
  - Executes dropped EXE
  PID:752
- C:\Windows\System\SnqqlbD.exe
  C:\Windows\System\SnqqlbD.exe
  2⤵
  - Executes dropped EXE
  PID:4124
- C:\Windows\System\aRJshjP.exe
  C:\Windows\System\aRJshjP.exe
  2⤵
  - Executes dropped EXE
  PID:2564
- C:\Windows\System\NfIKFYv.exe
  C:\Windows\System\NfIKFYv.exe
  2⤵
  - Executes dropped EXE
  PID:5088
- C:\Windows\System\QheAUXs.exe
  C:\Windows\System\QheAUXs.exe
  2⤵
  - Executes dropped EXE
  PID:4016
- C:\Windows\System\ijnzPZi.exe
  C:\Windows\System\ijnzPZi.exe
  2⤵
  - Executes dropped EXE
  PID:640
- C:\Windows\System\yXqujEN.exe
  C:\Windows\System\yXqujEN.exe
  2⤵
  - Executes dropped EXE
  PID:4628
- C:\Windows\System\rSCtXWh.exe
  C:\Windows\System\rSCtXWh.exe
  2⤵
  PID:4208
- C:\Windows\System\eycdCHD.exe
  C:\Windows\System\eycdCHD.exe
  2⤵
  - Executes dropped EXE
  PID:1528
- C:\Windows\System\YRHtkOL.exe
  C:\Windows\System\YRHtkOL.exe
  2⤵
  - Executes dropped EXE
  PID:3100
- C:\Windows\System\EKwMJqp.exe
  C:\Windows\System\EKwMJqp.exe
  2⤵
  PID:4036
- C:\Windows\System\dkDGKEA.exe
  C:\Windows\System\dkDGKEA.exe
  2⤵
  PID:4032
- C:\Windows\System\ZuOLsVW.exe
  C:\Windows\System\ZuOLsVW.exe
  2⤵
  PID:4160
- C:\Windows\System\zcasBwE.exe
  C:\Windows\System\zcasBwE.exe
  2⤵
  PID:4140
- C:\Windows\System\yNLnLsx.exe
  C:\Windows\System\yNLnLsx.exe
  2⤵
  PID:2784
- C:\Windows\System\Desxtzt.exe
  C:\Windows\System\Desxtzt.exe
  2⤵
  PID:948
- C:\Windows\System\vMAqfdP.exe
  C:\Windows\System\vMAqfdP.exe
  2⤵
  PID:4964
- C:\Windows\System\FbQPZZF.exe
  C:\Windows\System\FbQPZZF.exe
  2⤵
  PID:1828
- C:\Windows\System\hRoXILj.exe
  C:\Windows\System\hRoXILj.exe
  2⤵
  PID:4176
- C:\Windows\System\HKbFddn.exe
  C:\Windows\System\HKbFddn.exe
  2⤵
  PID:4932
- C:\Windows\System\dfcAtlE.exe
  C:\Windows\System\dfcAtlE.exe
  2⤵
  PID:4348
- C:\Windows\System\eevRkNI.exe
  C:\Windows\System\eevRkNI.exe
  2⤵
  PID:1012
- C:\Windows\System\FPWvFEs.exe
  C:\Windows\System\FPWvFEs.exe
  2⤵
  PID:3064
- C:\Windows\System\wshAmRx.exe
  C:\Windows\System\wshAmRx.exe
  2⤵
  PID:216
- C:\Windows\System\XshMjeF.exe
  C:\Windows\System\XshMjeF.exe
  2⤵
  PID:4004
- C:\Windows\System\jSsrMMF.exe
  C:\Windows\System\jSsrMMF.exe
  2⤵
  PID:1620
- C:\Windows\System\zPbDgAY.exe
  C:\Windows\System\zPbDgAY.exe
  2⤵
  PID:1248
- C:\Windows\System\VxbeOcN.exe
  C:\Windows\System\VxbeOcN.exe
  2⤵
  PID:4644
- C:\Windows\System\sXRInpL.exe
  C:\Windows\System\sXRInpL.exe
  2⤵
  PID:4716
- C:\Windows\System\FDlFSMi.exe
  C:\Windows\System\FDlFSMi.exe
  2⤵
  PID:3368
- C:\Windows\System\dOxfkfx.exe
  C:\Windows\System\dOxfkfx.exe
  2⤵
  PID:2316
- C:\Windows\System\lcWVBBe.exe
  C:\Windows\System\lcWVBBe.exe
  2⤵
  PID:3848
- C:\Windows\System\vlDmTKs.exe
  C:\Windows\System\vlDmTKs.exe
  2⤵
  PID:2288
- C:\Windows\System\gREyijx.exe
  C:\Windows\System\gREyijx.exe
  2⤵
  PID:3000
- C:\Windows\System\yCujGvU.exe
  C:\Windows\System\yCujGvU.exe
  2⤵
  PID:1524
- C:\Windows\System\aHbTTHv.exe
  C:\Windows\System\aHbTTHv.exe
  2⤵
  PID:1428
- C:\Windows\System\PGTwPIO.exe
  C:\Windows\System\PGTwPIO.exe
  2⤵
  PID:2356
- C:\Windows\System\sKuRVgx.exe
  C:\Windows\System\sKuRVgx.exe
  2⤵
  PID:5116
- C:\Windows\System\vLbITlL.exe
  C:\Windows\System\vLbITlL.exe
  2⤵
  PID:3980
- C:\Windows\System\WRQYcaL.exe
  C:\Windows\System\WRQYcaL.exe
  2⤵
  PID:3732
- C:\Windows\System\jschNSO.exe
  C:\Windows\System\jschNSO.exe
  2⤵
  PID:1392
- C:\Windows\System\DRvEFxT.exe
  C:\Windows\System\DRvEFxT.exe
  2⤵
  PID:3568
- C:\Windows\System\niyIaCm.exe
  C:\Windows\System\niyIaCm.exe
  2⤵
  PID:4316
- C:\Windows\System\NsxDYyU.exe
  C:\Windows\System\NsxDYyU.exe
  2⤵
  PID:3504
- C:\Windows\System\VIhiSqq.exe
  C:\Windows\System\VIhiSqq.exe
  2⤵
  PID:1044
- C:\Windows\System\hEFWMrQ.exe
  C:\Windows\System\hEFWMrQ.exe
  2⤵
  PID:4448
- C:\Windows\System\WTUNZUj.exe
  C:\Windows\System\WTUNZUj.exe
  2⤵
  PID:1092
- C:\Windows\System\caVTzhK.exe
  C:\Windows\System\caVTzhK.exe
  2⤵
  PID:4544
- C:\Windows\System\REnjque.exe
  C:\Windows\System\REnjque.exe
  2⤵
  PID:2232
- C:\Windows\System\hgAeZpB.exe
  C:\Windows\System\hgAeZpB.exe
  2⤵
  PID:4548
- C:\Windows\System\QTOTNzM.exe
  C:\Windows\System\QTOTNzM.exe
  2⤵
  PID:3760
- C:\Windows\System\hnpBRqR.exe
  C:\Windows\System\hnpBRqR.exe
  2⤵
  PID:5148
- C:\Windows\System\kuVBJfI.exe
  C:\Windows\System\kuVBJfI.exe
  2⤵
  PID:5176
- C:\Windows\System\IFJjToh.exe
  C:\Windows\System\IFJjToh.exe
  2⤵
  PID:5208
- C:\Windows\System\hBHaCWp.exe
  C:\Windows\System\hBHaCWp.exe
  2⤵
  PID:5236
- C:\Windows\System\QgMJpTz.exe
  C:\Windows\System\QgMJpTz.exe
  2⤵
  PID:5260
- C:\Windows\System\lNAFaHM.exe
  C:\Windows\System\lNAFaHM.exe
  2⤵
  PID:5300
- C:\Windows\System\mmAqarN.exe
  C:\Windows\System\mmAqarN.exe
  2⤵
  PID:5320
- C:\Windows\System\ArFZExX.exe
  C:\Windows\System\ArFZExX.exe
  2⤵
  PID:5364
- C:\Windows\System\bjViDfN.exe
  C:\Windows\System\bjViDfN.exe
  2⤵
  PID:5388
- C:\Windows\System\IJRrLXb.exe
  C:\Windows\System\IJRrLXb.exe
  2⤵
  PID:5416
- C:\Windows\System\XJDnONZ.exe
  C:\Windows\System\XJDnONZ.exe
  2⤵
  PID:5456
- C:\Windows\System\MRfZPzS.exe
  C:\Windows\System\MRfZPzS.exe
  2⤵
  PID:5524
- C:\Windows\System\mzjVwKL.exe
  C:\Windows\System\mzjVwKL.exe
  2⤵
  PID:5540
- C:\Windows\System\jEZQUMm.exe
  C:\Windows\System\jEZQUMm.exe
  2⤵
  PID:5556
- C:\Windows\System\DjWefwr.exe
  C:\Windows\System\DjWefwr.exe
  2⤵
  PID:5576
- C:\Windows\System\IMmiJsb.exe
  C:\Windows\System\IMmiJsb.exe
  2⤵
  PID:5604
- C:\Windows\System\wxrxBqy.exe
  C:\Windows\System\wxrxBqy.exe
  2⤵
  PID:5628
- C:\Windows\System\EldZHbw.exe
  C:\Windows\System\EldZHbw.exe
  2⤵
  PID:5652
- C:\Windows\System\MEPdEXY.exe
  C:\Windows\System\MEPdEXY.exe
  2⤵
  PID:5680
- C:\Windows\System\HbduZrc.exe
  C:\Windows\System\HbduZrc.exe
  2⤵
  PID:5712
- C:\Windows\System\GVnIcPl.exe
  C:\Windows\System\GVnIcPl.exe
  2⤵
  PID:5736
- C:\Windows\System\RTXueSz.exe
  C:\Windows\System\RTXueSz.exe
  2⤵
  PID:5756
- C:\Windows\System\TeonJtn.exe
  C:\Windows\System\TeonJtn.exe
  2⤵
  PID:5784
- C:\Windows\System\OzMMCIs.exe
  C:\Windows\System\OzMMCIs.exe
  2⤵
  PID:5812
- C:\Windows\System\siWMneH.exe
  C:\Windows\System\siWMneH.exe
  2⤵
  PID:5832
- C:\Windows\System\dqCEfpK.exe
  C:\Windows\System\dqCEfpK.exe
  2⤵
  PID:5856
- C:\Windows\System\JhDxrvO.exe
  C:\Windows\System\JhDxrvO.exe
  2⤵
  PID:5884
- C:\Windows\System\izTfiNs.exe
  C:\Windows\System\izTfiNs.exe
  2⤵
  PID:5912
- C:\Windows\System\lCedfDu.exe
  C:\Windows\System\lCedfDu.exe
  2⤵
  PID:5936
- C:\Windows\System\tSjKtDO.exe
  C:\Windows\System\tSjKtDO.exe
  2⤵
  PID:5968
- C:\Windows\System\XUznasZ.exe
  C:\Windows\System\XUznasZ.exe
  2⤵
  PID:5996
- C:\Windows\System\TOJOOeN.exe
  C:\Windows\System\TOJOOeN.exe
  2⤵
  PID:6016
- C:\Windows\System\aJdprgk.exe
  C:\Windows\System\aJdprgk.exe
  2⤵
  PID:6052
- C:\Windows\System\jMFJQyL.exe
  C:\Windows\System\jMFJQyL.exe
  2⤵
  PID:6080
- C:\Windows\System\iMeWhwE.exe
  C:\Windows\System\iMeWhwE.exe
  2⤵
  PID:6104
- C:\Windows\System\bgKjnsG.exe
  C:\Windows\System\bgKjnsG.exe
  2⤵
  PID:6128
- C:\Windows\System\zPfnuLU.exe
  C:\Windows\System\zPfnuLU.exe
  2⤵
  PID:1604
- C:\Windows\System\UldfEsR.exe
  C:\Windows\System\UldfEsR.exe
  2⤵
  PID:4856
- C:\Windows\System\gtTPSFu.exe
  C:\Windows\System\gtTPSFu.exe
  2⤵
  PID:5228
- C:\Windows\System\lSIlkGq.exe
  C:\Windows\System\lSIlkGq.exe
  2⤵
  PID:5288
- C:\Windows\System\HcQYsbR.exe
  C:\Windows\System\HcQYsbR.exe
  2⤵
  PID:5340
- C:\Windows\System\LjFIhxl.exe
  C:\Windows\System\LjFIhxl.exe
  2⤵
  PID:5380
- C:\Windows\System\WiKTtRu.exe
  C:\Windows\System\WiKTtRu.exe
  2⤵
  PID:5428
- C:\Windows\System\eusJXfB.exe
  C:\Windows\System\eusJXfB.exe
  2⤵
  PID:5520
- C:\Windows\System\CUTGcFc.exe
  C:\Windows\System\CUTGcFc.exe
  2⤵
  PID:5592
- C:\Windows\System\WJnwUEe.exe
  C:\Windows\System\WJnwUEe.exe
  2⤵
  PID:5616
- C:\Windows\System\tNZcRlz.exe
  C:\Windows\System\tNZcRlz.exe
  2⤵
  PID:5720
- C:\Windows\System\xbUNwGP.exe
  C:\Windows\System\xbUNwGP.exe
  2⤵
  PID:5748
- C:\Windows\System\SVLFmzN.exe
  C:\Windows\System\SVLFmzN.exe
  2⤵
  PID:5768
- C:\Windows\System\fCGujhG.exe
  C:\Windows\System\fCGujhG.exe
  2⤵
  PID:5904
- C:\Windows\System\lWqziaY.exe
  C:\Windows\System\lWqziaY.exe
  2⤵
  PID:5952
- C:\Windows\System\zDHjSlr.exe
  C:\Windows\System\zDHjSlr.exe
  2⤵
  PID:5988
- C:\Windows\System\fZoAUyO.exe
  C:\Windows\System\fZoAUyO.exe
  2⤵
  PID:5964
- C:\Windows\System\eKVaVeg.exe
  C:\Windows\System\eKVaVeg.exe
  2⤵
  PID:6048
- C:\Windows\System\EsHjBvz.exe
  C:\Windows\System\EsHjBvz.exe
  2⤵
  PID:4512
- C:\Windows\System\YeiBzlN.exe
  C:\Windows\System\YeiBzlN.exe
  2⤵
  PID:5384
- C:\Windows\System\LdbeNPT.exe
  C:\Windows\System\LdbeNPT.exe
  2⤵
  PID:5132
- C:\Windows\System\mFfbwxR.exe
  C:\Windows\System\mFfbwxR.exe
  2⤵
  PID:5440
- C:\Windows\System\QqfTXnx.exe
  C:\Windows\System\QqfTXnx.exe
  2⤵
  PID:5532
- C:\Windows\System\rHHdGsS.exe
  C:\Windows\System\rHHdGsS.exe
  2⤵
  PID:5696
- C:\Windows\System\WLAlCKk.exe
  C:\Windows\System\WLAlCKk.exe
  2⤵
  PID:5852
- C:\Windows\System\notQVlJ.exe
  C:\Windows\System\notQVlJ.exe
  2⤵
  PID:5136
- C:\Windows\System\nlvgsxm.exe
  C:\Windows\System\nlvgsxm.exe
  2⤵
  PID:6148
- C:\Windows\System\KsYaRMF.exe
  C:\Windows\System\KsYaRMF.exe
  2⤵
  PID:6176
- C:\Windows\System\RrNgNQZ.exe
  C:\Windows\System\RrNgNQZ.exe
  2⤵
  PID:6204
- C:\Windows\System\uXxrxNF.exe
  C:\Windows\System\uXxrxNF.exe
  2⤵
  PID:6232
- C:\Windows\System\MtoOQWR.exe
  C:\Windows\System\MtoOQWR.exe
  2⤵
  PID:6260
- C:\Windows\System\nKzphAl.exe
  C:\Windows\System\nKzphAl.exe
  2⤵
  PID:6284
- C:\Windows\System\BkAcRHm.exe
  C:\Windows\System\BkAcRHm.exe
  2⤵
  PID:6312
- C:\Windows\System\efTwVIC.exe
  C:\Windows\System\efTwVIC.exe
  2⤵
  PID:6340
- C:\Windows\System\yreSTTp.exe
  C:\Windows\System\yreSTTp.exe
  2⤵
  PID:6368
- C:\Windows\System\BhyXUfm.exe
  C:\Windows\System\BhyXUfm.exe
  2⤵
  PID:6392
- C:\Windows\System\MgmlSOp.exe
  C:\Windows\System\MgmlSOp.exe
  2⤵
  PID:6420
- C:\Windows\System\hXwwcKl.exe
  C:\Windows\System\hXwwcKl.exe
  2⤵
  PID:6452
- C:\Windows\System\hppYzbv.exe
  C:\Windows\System\hppYzbv.exe
  2⤵
  PID:6480
- C:\Windows\System\IfcadOW.exe
  C:\Windows\System\IfcadOW.exe
  2⤵
  PID:6500
- C:\Windows\System\bStdhST.exe
  C:\Windows\System\bStdhST.exe
  2⤵
  PID:6524
- C:\Windows\System\BfQIVSt.exe
  C:\Windows\System\BfQIVSt.exe
  2⤵
  PID:6556
- C:\Windows\System\kqROenK.exe
  C:\Windows\System\kqROenK.exe
  2⤵
  PID:6584
- C:\Windows\System\weiXtNg.exe
  C:\Windows\System\weiXtNg.exe
  2⤵
  PID:6612
- C:\Windows\System\RJtLJzv.exe
  C:\Windows\System\RJtLJzv.exe
  2⤵
  PID:6640
- C:\Windows\System\xcuFkxG.exe
  C:\Windows\System\xcuFkxG.exe
  2⤵
  PID:6664
- C:\Windows\System\gzWBIZT.exe
  C:\Windows\System\gzWBIZT.exe
  2⤵
  PID:6692
- C:\Windows\System\HTVLxkK.exe
  C:\Windows\System\HTVLxkK.exe
  2⤵
  PID:6716
- C:\Windows\System\BHZUwSs.exe
  C:\Windows\System\BHZUwSs.exe
  2⤵
  PID:6744
- C:\Windows\System\auRtEwf.exe
  C:\Windows\System\auRtEwf.exe
  2⤵
  PID:6764
- C:\Windows\System\yKOGYGq.exe
  C:\Windows\System\yKOGYGq.exe
  2⤵
  PID:6804
- C:\Windows\System\BGQWPbM.exe
  C:\Windows\System\BGQWPbM.exe
  2⤵
  PID:6824
- C:\Windows\System\xSkFpba.exe
  C:\Windows\System\xSkFpba.exe
  2⤵
  PID:6852
- C:\Windows\System\Atnuczg.exe
  C:\Windows\System\Atnuczg.exe
  2⤵
  PID:6880
- C:\Windows\System\ZoesMIF.exe
  C:\Windows\System\ZoesMIF.exe
  2⤵
  PID:6916
- C:\Windows\System\WlRMiYL.exe
  C:\Windows\System\WlRMiYL.exe
  2⤵
  PID:6940
- C:\Windows\System\frKRftK.exe
  C:\Windows\System\frKRftK.exe
  2⤵
  PID:6972
- C:\Windows\System\uZtJoqG.exe
  C:\Windows\System\uZtJoqG.exe
  2⤵
  PID:7000
- C:\Windows\System\pEunqQM.exe
  C:\Windows\System\pEunqQM.exe
  2⤵
  PID:7040
- C:\Windows\System\mZpToAA.exe
  C:\Windows\System\mZpToAA.exe
  2⤵
  PID:7056
- C:\Windows\System\CaDTxAO.exe
  C:\Windows\System\CaDTxAO.exe
  2⤵
  PID:7084
- C:\Windows\System\ENCuBhF.exe
  C:\Windows\System\ENCuBhF.exe
  2⤵
  PID:7112
- C:\Windows\System\ssVqqjZ.exe
  C:\Windows\System\ssVqqjZ.exe
  2⤵
  PID:7136
- C:\Windows\System\oxntrOI.exe
  C:\Windows\System\oxntrOI.exe
  2⤵
  PID:7164
- C:\Windows\System\OJtONzi.exe
  C:\Windows\System\OJtONzi.exe
  2⤵
  PID:5336
- C:\Windows\System\qgtetmC.exe
  C:\Windows\System\qgtetmC.exe
  2⤵
  PID:1320
- C:\Windows\System\WkwjuAa.exe
  C:\Windows\System\WkwjuAa.exe
  2⤵
  PID:6188
- C:\Windows\System\GDpsgvG.exe
  C:\Windows\System\GDpsgvG.exe
  2⤵
  PID:6240
- C:\Windows\System\msJkHBK.exe
  C:\Windows\System\msJkHBK.exe
  2⤵
  PID:6256
- C:\Windows\System\mSydJje.exe
  C:\Windows\System\mSydJje.exe
  2⤵
  PID:6332
- C:\Windows\System\xeZfxIM.exe
  C:\Windows\System\xeZfxIM.exe
  2⤵
  PID:6164
- C:\Windows\System\QCHnJEk.exe
  C:\Windows\System\QCHnJEk.exe
  2⤵
  PID:6412
- C:\Windows\System\HLqYuym.exe
  C:\Windows\System\HLqYuym.exe
  2⤵
  PID:6496
- C:\Windows\System\oeKQFBu.exe
  C:\Windows\System\oeKQFBu.exe
  2⤵
  PID:6472
- C:\Windows\System\CYArOZo.exe
  C:\Windows\System\CYArOZo.exe
  2⤵
  PID:6728
- C:\Windows\System\SRmZDZb.exe
  C:\Windows\System\SRmZDZb.exe
  2⤵
  PID:6600
- C:\Windows\System\gOrCsyI.exe
  C:\Windows\System\gOrCsyI.exe
  2⤵
  PID:6832
- C:\Windows\System\AxzpKQa.exe
  C:\Windows\System\AxzpKQa.exe
  2⤵
  PID:6888
- C:\Windows\System\AEJFmAU.exe
  C:\Windows\System\AEJFmAU.exe
  2⤵
  PID:6956
- C:\Windows\System\EPYWPPH.exe
  C:\Windows\System\EPYWPPH.exe
  2⤵
  PID:7024
- C:\Windows\System\UhchLQp.exe
  C:\Windows\System\UhchLQp.exe
  2⤵
  PID:7048
- C:\Windows\System\Myckgak.exe
  C:\Windows\System\Myckgak.exe
  2⤵
  PID:6876
- C:\Windows\System\RekOrKR.exe
  C:\Windows\System\RekOrKR.exe
  2⤵
  PID:6732
- C:\Windows\System\OXaUILi.exe
  C:\Windows\System\OXaUILi.exe
  2⤵
  PID:6116
- C:\Windows\System\fzxtfFT.exe
  C:\Windows\System\fzxtfFT.exe
  2⤵
  PID:7080
- C:\Windows\System\bXbywGn.exe
  C:\Windows\System\bXbywGn.exe
  2⤵
  PID:7124
- C:\Windows\System\ZCAGLzy.exe
  C:\Windows\System\ZCAGLzy.exe
  2⤵
  PID:2184
- C:\Windows\System\xTTbeeo.exe
  C:\Windows\System\xTTbeeo.exe
  2⤵
  PID:6196
- C:\Windows\System\IfMIDAG.exe
  C:\Windows\System\IfMIDAG.exe
  2⤵
  PID:6680
- C:\Windows\System\vqrBfHu.exe
  C:\Windows\System\vqrBfHu.exe
  2⤵
  PID:7172
- C:\Windows\System\ZdnTsaX.exe
  C:\Windows\System\ZdnTsaX.exe
  2⤵
  PID:7192
- C:\Windows\System\DkObOcL.exe
  C:\Windows\System\DkObOcL.exe
  2⤵
  PID:7216
- C:\Windows\System\eZsFytS.exe
  C:\Windows\System\eZsFytS.exe
  2⤵
  PID:7244
- C:\Windows\System\njAffFl.exe
  C:\Windows\System\njAffFl.exe
  2⤵
  PID:7276
- C:\Windows\System\FnGbuhb.exe
  C:\Windows\System\FnGbuhb.exe
  2⤵
  PID:7300
- C:\Windows\System\Eelllms.exe
  C:\Windows\System\Eelllms.exe
  2⤵
  PID:7328
- C:\Windows\System\BgVDaij.exe
  C:\Windows\System\BgVDaij.exe
  2⤵
  PID:7352
- C:\Windows\System\amgZsES.exe
  C:\Windows\System\amgZsES.exe
  2⤵
  PID:7384
- C:\Windows\System\pUFOulJ.exe
  C:\Windows\System\pUFOulJ.exe
  2⤵
  PID:7408
- C:\Windows\System\EJigUAK.exe
  C:\Windows\System\EJigUAK.exe
  2⤵
  PID:7432
- C:\Windows\System\ebizUQL.exe
  C:\Windows\System\ebizUQL.exe
  2⤵
  PID:7460
- C:\Windows\System\OYQxHHy.exe
  C:\Windows\System\OYQxHHy.exe
  2⤵
  PID:7488
- C:\Windows\System\GGyUpJb.exe
  C:\Windows\System\GGyUpJb.exe
  2⤵
  PID:7512
- C:\Windows\System\IpWZuCo.exe
  C:\Windows\System\IpWZuCo.exe
  2⤵
  PID:7536
- C:\Windows\System\VZVJccy.exe
  C:\Windows\System\VZVJccy.exe
  2⤵
  PID:7560
- C:\Windows\System\KzbOTDd.exe
  C:\Windows\System\KzbOTDd.exe
  2⤵
  PID:7584
- C:\Windows\System\JSgLgAp.exe
  C:\Windows\System\JSgLgAp.exe
  2⤵
  PID:7612
- C:\Windows\System\qMJbxZC.exe
  C:\Windows\System\qMJbxZC.exe
  2⤵
  PID:7640
- C:\Windows\System\YqubqgA.exe
  C:\Windows\System\YqubqgA.exe
  2⤵
  PID:7664
- C:\Windows\System\FsfPEkP.exe
  C:\Windows\System\FsfPEkP.exe
  2⤵
  PID:7700
- C:\Windows\System\WoNMkmg.exe
  C:\Windows\System\WoNMkmg.exe
  2⤵
  PID:7720
- C:\Windows\System\EnfFASv.exe
  C:\Windows\System\EnfFASv.exe
  2⤵
  PID:7748
- C:\Windows\System\MBltubS.exe
  C:\Windows\System\MBltubS.exe
  2⤵
  PID:7776
- C:\Windows\System\ZDunVGF.exe
  C:\Windows\System\ZDunVGF.exe
  2⤵
  PID:7804
- C:\Windows\System\ZfWuekU.exe
  C:\Windows\System\ZfWuekU.exe
  2⤵
  PID:7828
- C:\Windows\System\PSPrEpK.exe
  C:\Windows\System\PSPrEpK.exe
  2⤵
  PID:7856
- C:\Windows\System\EXhVzRz.exe
  C:\Windows\System\EXhVzRz.exe
  2⤵
  PID:7880
- C:\Windows\System\XZltcSO.exe
  C:\Windows\System\XZltcSO.exe
  2⤵
  PID:7900
- C:\Windows\System\nxtnWiN.exe
  C:\Windows\System\nxtnWiN.exe
  2⤵
  PID:7920
- C:\Windows\System\KTXSJZI.exe
  C:\Windows\System\KTXSJZI.exe
  2⤵
  PID:7948
- C:\Windows\System\lTepeUE.exe
  C:\Windows\System\lTepeUE.exe
  2⤵
  PID:7964
- C:\Windows\System\lqHjKgv.exe
  C:\Windows\System\lqHjKgv.exe
  2⤵
  PID:7992
- C:\Windows\System\LkjgjiT.exe
  C:\Windows\System\LkjgjiT.exe
  2⤵
  PID:8024
- C:\Windows\System\QlgIeLl.exe
  C:\Windows\System\QlgIeLl.exe
  2⤵
  PID:8048
- C:\Windows\System\FdTvkbq.exe
  C:\Windows\System\FdTvkbq.exe
  2⤵
  PID:8080
- C:\Windows\System\aNZbcqH.exe
  C:\Windows\System\aNZbcqH.exe
  2⤵
  PID:8104
- C:\Windows\System\lRuAYFv.exe
  C:\Windows\System\lRuAYFv.exe
  2⤵
  PID:8124
- C:\Windows\System\SJCClVR.exe
  C:\Windows\System\SJCClVR.exe
  2⤵
  PID:8152
- C:\Windows\System\ESQGVwz.exe
  C:\Windows\System\ESQGVwz.exe
  2⤵
  PID:8176
- C:\Windows\System\iwYSCcQ.exe
  C:\Windows\System\iwYSCcQ.exe
  2⤵
  PID:6380
- C:\Windows\System\HWOIUhV.exe
  C:\Windows\System\HWOIUhV.exe
  2⤵
  PID:7104
- C:\Windows\System\AKZbsIK.exe
  C:\Windows\System\AKZbsIK.exe
  2⤵
  PID:6756
- C:\Windows\System\cFJoeDc.exe
  C:\Windows\System\cFJoeDc.exe
  2⤵
  PID:6820
- C:\Windows\System\ydVbjDb.exe
  C:\Windows\System\ydVbjDb.exe
  2⤵
  PID:6520
- C:\Windows\System\rwUKAUa.exe
  C:\Windows\System\rwUKAUa.exe
  2⤵
  PID:7372
- C:\Windows\System\iGsZsbi.exe
  C:\Windows\System\iGsZsbi.exe
  2⤵
  PID:7404
- C:\Windows\System\YuCPCMv.exe
  C:\Windows\System\YuCPCMv.exe
  2⤵
  PID:7448
- C:\Windows\System\LVwgbGu.exe
  C:\Windows\System\LVwgbGu.exe
  2⤵
  PID:7496
- C:\Windows\System\PbIatnw.exe
  C:\Windows\System\PbIatnw.exe
  2⤵
  PID:7128
- C:\Windows\System\pcnktHv.exe
  C:\Windows\System\pcnktHv.exe
  2⤵
  PID:7580
- C:\Windows\System\UsBtzNX.exe
  C:\Windows\System\UsBtzNX.exe
  2⤵
  PID:6408
- C:\Windows\System\FUxVWox.exe
  C:\Windows\System\FUxVWox.exe
  2⤵
  PID:7728
- C:\Windows\System\NvTNOVR.exe
  C:\Windows\System\NvTNOVR.exe
  2⤵
  PID:7472
- C:\Windows\System\pmyGfix.exe
  C:\Windows\System\pmyGfix.exe
  2⤵
  PID:7844
- C:\Windows\System\dFGiAAz.exe
  C:\Windows\System\dFGiAAz.exe
  2⤵
  PID:7932
- C:\Windows\System\skbKveM.exe
  C:\Windows\System\skbKveM.exe
  2⤵
  PID:7956
- C:\Windows\System\jQiiMfD.exe
  C:\Windows\System\jQiiMfD.exe
  2⤵
  PID:7692
- C:\Windows\System\POgCeFY.exe
  C:\Windows\System\POgCeFY.exe
  2⤵
  PID:8060
- C:\Windows\System\ZTphNKt.exe
  C:\Windows\System\ZTphNKt.exe
  2⤵
  PID:8120
- C:\Windows\System\ZjkJfkc.exe
  C:\Windows\System\ZjkJfkc.exe
  2⤵
  PID:8168
- C:\Windows\System\AMoTuit.exe
  C:\Windows\System\AMoTuit.exe
  2⤵
  PID:7100
- C:\Windows\System\nrYZsRB.exe
  C:\Windows\System\nrYZsRB.exe
  2⤵
  PID:6068
- C:\Windows\System\PDxrzoC.exe
  C:\Windows\System\PDxrzoC.exe
  2⤵
  PID:7760
- C:\Windows\System\RVYYCBI.exe
  C:\Windows\System\RVYYCBI.exe
  2⤵
  PID:6564
- C:\Windows\System\HFwqfBj.exe
  C:\Windows\System\HFwqfBj.exe
  2⤵
  PID:8220
- C:\Windows\System\GFHOyAu.exe
  C:\Windows\System\GFHOyAu.exe
  2⤵
  PID:8252
- C:\Windows\System\qVedSeM.exe
  C:\Windows\System\qVedSeM.exe
  2⤵
  PID:8280
- C:\Windows\System\lbjDfzf.exe
  C:\Windows\System\lbjDfzf.exe
  2⤵
  PID:8304
- C:\Windows\System\NvCOXHF.exe
  C:\Windows\System\NvCOXHF.exe
  2⤵
  PID:8328
- C:\Windows\System\iCoRgfu.exe
  C:\Windows\System\iCoRgfu.exe
  2⤵
  PID:8364
- C:\Windows\System\mMnIROI.exe
  C:\Windows\System\mMnIROI.exe
  2⤵
  PID:8388
- C:\Windows\System\TfxtofS.exe
  C:\Windows\System\TfxtofS.exe
  2⤵
  PID:8412
- C:\Windows\System\EYKDHkv.exe
  C:\Windows\System\EYKDHkv.exe
  2⤵
  PID:8440
- C:\Windows\System\texwwdf.exe
  C:\Windows\System\texwwdf.exe
  2⤵
  PID:8468
- C:\Windows\System\njxHvSx.exe
  C:\Windows\System\njxHvSx.exe
  2⤵
  PID:8492
- C:\Windows\System\UNFDIeu.exe
  C:\Windows\System\UNFDIeu.exe
  2⤵
  PID:8516
- C:\Windows\System\QduWDCg.exe
  C:\Windows\System\QduWDCg.exe
  2⤵
  PID:8532
- C:\Windows\System\gyWYwMS.exe
  C:\Windows\System\gyWYwMS.exe
  2⤵
  PID:8548
- C:\Windows\System\KcZmFDE.exe
  C:\Windows\System\KcZmFDE.exe
  2⤵
  PID:8576
- C:\Windows\System\UhxeNnq.exe
  C:\Windows\System\UhxeNnq.exe
  2⤵
  PID:8592
- C:\Windows\System\uAwYEuf.exe
  C:\Windows\System\uAwYEuf.exe
  2⤵
  PID:8608
- C:\Windows\System\jxnBGxi.exe
  C:\Windows\System\jxnBGxi.exe
  2⤵
  PID:8632
- C:\Windows\System\hpJdPFa.exe
  C:\Windows\System\hpJdPFa.exe
  2⤵
  PID:8660
- C:\Windows\System\KbSlJJs.exe
  C:\Windows\System\KbSlJJs.exe
  2⤵
  PID:8680
- C:\Windows\System\OuHFhrS.exe
  C:\Windows\System\OuHFhrS.exe
  2⤵
  PID:8704
- C:\Windows\System\VeRTgKb.exe
  C:\Windows\System\VeRTgKb.exe
  2⤵
  PID:8720
- C:\Windows\System\zSJPGKT.exe
  C:\Windows\System\zSJPGKT.exe
  2⤵
  PID:8744
- C:\Windows\System\qdmsSXs.exe
  C:\Windows\System\qdmsSXs.exe
  2⤵
  PID:8940
- C:\Windows\System\VHfqdTm.exe
  C:\Windows\System\VHfqdTm.exe
  2⤵
  PID:8960
- C:\Windows\System\nMdGJzA.exe
  C:\Windows\System\nMdGJzA.exe
  2⤵
  PID:8988
- C:\Windows\System\BmdLBNp.exe
  C:\Windows\System\BmdLBNp.exe
  2⤵
  PID:9016
- C:\Windows\System\vLElxjG.exe
  C:\Windows\System\vLElxjG.exe
  2⤵
  PID:9068
- C:\Windows\System\rLXUIHy.exe
  C:\Windows\System\rLXUIHy.exe
  2⤵
  PID:9108
- C:\Windows\System\ecXUCXd.exe
  C:\Windows\System\ecXUCXd.exe
  2⤵
  PID:9160
- C:\Windows\System\QyIzSJL.exe
  C:\Windows\System\QyIzSJL.exe
  2⤵
  PID:9204
- C:\Windows\System\qwLfhah.exe
  C:\Windows\System\qwLfhah.exe
  2⤵
  PID:7740
- C:\Windows\System\VkoObCM.exe
  C:\Windows\System\VkoObCM.exe
  2⤵
  PID:7340
- C:\Windows\System\MLCXppb.exe
  C:\Windows\System\MLCXppb.exe
  2⤵
  PID:7520
- C:\Windows\System\OpnLGNH.exe
  C:\Windows\System\OpnLGNH.exe
  2⤵
  PID:8008
- C:\Windows\System\cBBFhwL.exe
  C:\Windows\System\cBBFhwL.exe
  2⤵
  PID:8408
- C:\Windows\System\wvLFRnq.exe
  C:\Windows\System\wvLFRnq.exe
  2⤵
  PID:7868
- C:\Windows\System\EFdFpvt.exe
  C:\Windows\System\EFdFpvt.exe
  2⤵
  PID:8460
- C:\Windows\System\wkdDUDD.exe
  C:\Windows\System\wkdDUDD.exe
  2⤵
  PID:8484
- C:\Windows\System\tmumAuI.exe
  C:\Windows\System\tmumAuI.exe
  2⤵
  PID:8072
- C:\Windows\System\potJILv.exe
  C:\Windows\System\potJILv.exe
  2⤵
  PID:6628
- C:\Windows\System\EeIMRNY.exe
  C:\Windows\System\EeIMRNY.exe
  2⤵
  PID:8656
- C:\Windows\System\QAoyVdX.exe
  C:\Windows\System\QAoyVdX.exe
  2⤵
  PID:8768
- C:\Windows\System\RoBCbES.exe
  C:\Windows\System\RoBCbES.exe
  2⤵
  PID:8540
- C:\Windows\System\SEtgcLJ.exe
  C:\Windows\System\SEtgcLJ.exe
  2⤵
  PID:8672
- C:\Windows\System\oRWJmYU.exe
  C:\Windows\System\oRWJmYU.exe
  2⤵
  PID:8436
- C:\Windows\System\WQLbUwP.exe
  C:\Windows\System\WQLbUwP.exe
  2⤵
  PID:8508
- C:\Windows\System\VGxaELk.exe
  C:\Windows\System\VGxaELk.exe
  2⤵
  PID:8528
- C:\Windows\System\tRBmGSA.exe
  C:\Windows\System\tRBmGSA.exe
  2⤵
  PID:8588
- C:\Windows\System\rZrmwlJ.exe
  C:\Windows\System\rZrmwlJ.exe
  2⤵
  PID:8628
- C:\Windows\System\bMfHFoM.exe
  C:\Windows\System\bMfHFoM.exe
  2⤵
  PID:8696
- C:\Windows\System\eHcZRRI.exe
  C:\Windows\System\eHcZRRI.exe
  2⤵
  PID:8916
- C:\Windows\System\IYUInhz.exe
  C:\Windows\System\IYUInhz.exe
  2⤵
  PID:8716
- C:\Windows\System\NVFvQaX.exe
  C:\Windows\System\NVFvQaX.exe
  2⤵
  PID:7188
- C:\Windows\System\qIdkztU.exe
  C:\Windows\System\qIdkztU.exe
  2⤵
  PID:8984
- C:\Windows\System\qTtiydy.exe
  C:\Windows\System\qTtiydy.exe
  2⤵
  PID:9076
- C:\Windows\System\sWxnjtY.exe
  C:\Windows\System\sWxnjtY.exe
  2⤵
  PID:9232
- C:\Windows\System\Szyfvav.exe
  C:\Windows\System\Szyfvav.exe
  2⤵
  PID:9252
- C:\Windows\System\pdxpzLz.exe
  C:\Windows\System\pdxpzLz.exe
  2⤵
  PID:9272
- C:\Windows\System\ecWIrrY.exe
  C:\Windows\System\ecWIrrY.exe
  2⤵
  PID:9296
- C:\Windows\System\lfcEmhI.exe
  C:\Windows\System\lfcEmhI.exe
  2⤵
  PID:9404
- C:\Windows\System\SGfXoLB.exe
  C:\Windows\System\SGfXoLB.exe
  2⤵
  PID:9420
- C:\Windows\System\lqvCgKG.exe
  C:\Windows\System\lqvCgKG.exe
  2⤵
  PID:9436
- C:\Windows\System\VOstYiL.exe
  C:\Windows\System\VOstYiL.exe
  2⤵
  PID:9456
- C:\Windows\System\Noiqnxq.exe
  C:\Windows\System\Noiqnxq.exe
  2⤵
  PID:9480
- C:\Windows\System\XDaRroz.exe
  C:\Windows\System\XDaRroz.exe
  2⤵
  PID:9500
- C:\Windows\System\kaXobmb.exe
  C:\Windows\System\kaXobmb.exe
  2⤵
  PID:9536
- C:\Windows\System\XzTzVqJ.exe
  C:\Windows\System\XzTzVqJ.exe
  2⤵
  PID:9572
- C:\Windows\System\yhTdhQp.exe
  C:\Windows\System\yhTdhQp.exe
  2⤵
  PID:9600
- C:\Windows\System\AWhGKRM.exe
  C:\Windows\System\AWhGKRM.exe
  2⤵
  PID:9628
- C:\Windows\System\gTiprvE.exe
  C:\Windows\System\gTiprvE.exe
  2⤵
  PID:9644
- C:\Windows\System\zCsUfPk.exe
  C:\Windows\System\zCsUfPk.exe
  2⤵
  PID:9660
- C:\Windows\System\IbHZqpF.exe
  C:\Windows\System\IbHZqpF.exe
  2⤵
  PID:9680
- C:\Windows\System\lNYytNZ.exe
  C:\Windows\System\lNYytNZ.exe
  2⤵
  PID:9704
- C:\Windows\System\GhEHKgl.exe
  C:\Windows\System\GhEHKgl.exe
  2⤵
  PID:9720
- C:\Windows\System\mlvWDiF.exe
  C:\Windows\System\mlvWDiF.exe
  2⤵
  PID:9744
- C:\Windows\System\FhpvBXW.exe
  C:\Windows\System\FhpvBXW.exe
  2⤵
  PID:9760
- C:\Windows\System\gLyvhnj.exe
  C:\Windows\System\gLyvhnj.exe
  2⤵
  PID:9780
- C:\Windows\System\PqrYYMW.exe
  C:\Windows\System\PqrYYMW.exe
  2⤵
  PID:9820
- C:\Windows\System\RNRqKQM.exe
  C:\Windows\System\RNRqKQM.exe
  2⤵
  PID:9840
- C:\Windows\System\XneyfSY.exe
  C:\Windows\System\XneyfSY.exe
  2⤵
  PID:9864
- C:\Windows\System\xPdyDpi.exe
  C:\Windows\System\xPdyDpi.exe
  2⤵
  PID:9900
- C:\Windows\System\wZReXBa.exe
  C:\Windows\System\wZReXBa.exe
  2⤵
  PID:9928
- C:\Windows\System\HBtbVYI.exe
  C:\Windows\System\HBtbVYI.exe
  2⤵
  PID:9948
- C:\Windows\System\oacNxkx.exe
  C:\Windows\System\oacNxkx.exe
  2⤵
  PID:9972
- C:\Windows\System\igIqbPi.exe
  C:\Windows\System\igIqbPi.exe
  2⤵
  PID:10012
- C:\Windows\System\mXGpUWA.exe
  C:\Windows\System\mXGpUWA.exe
  2⤵
  PID:10028
- C:\Windows\System\ldOzcEk.exe
  C:\Windows\System\ldOzcEk.exe
  2⤵
  PID:10052
- C:\Windows\System\FyVPfZK.exe
  C:\Windows\System\FyVPfZK.exe
  2⤵
  PID:10068
- C:\Windows\System\NLmAjsb.exe
  C:\Windows\System\NLmAjsb.exe
  2⤵
  PID:10084
- C:\Windows\System\hWAELOk.exe
  C:\Windows\System\hWAELOk.exe
  2⤵
  PID:10108
- C:\Windows\System\HGlMhVe.exe
  C:\Windows\System\HGlMhVe.exe
  2⤵
  PID:10136
- C:\Windows\System\FjgjOIE.exe
  C:\Windows\System\FjgjOIE.exe
  2⤵
  PID:10164
- C:\Windows\System\GBYKaDB.exe
  C:\Windows\System\GBYKaDB.exe
  2⤵
  PID:10188
- C:\Windows\System\GZXxdvo.exe
  C:\Windows\System\GZXxdvo.exe
  2⤵
  PID:10216
- C:\Windows\System\ZQLSkvx.exe
  C:\Windows\System\ZQLSkvx.exe
  2⤵
  PID:10236
- C:\Windows\System\HDLMRzV.exe
  C:\Windows\System\HDLMRzV.exe
  2⤵
  PID:9168
- C:\Windows\System\OWrowGG.exe
  C:\Windows\System\OWrowGG.exe
  2⤵
  PID:8200
- C:\Windows\System\QPiRhYZ.exe
  C:\Windows\System\QPiRhYZ.exe
  2⤵
  PID:8428
- C:\Windows\System\eNGgkUG.exe
  C:\Windows\System\eNGgkUG.exe
  2⤵
  PID:8996
- C:\Windows\System\sImdLsO.exe
  C:\Windows\System\sImdLsO.exe
  2⤵
  PID:7552
- C:\Windows\System\uZKQThw.exe
  C:\Windows\System\uZKQThw.exe
  2⤵
  PID:8424
- C:\Windows\System\rtLwMjm.exe
  C:\Windows\System\rtLwMjm.exe
  2⤵
  PID:9220
- C:\Windows\System\KBnklrI.exe
  C:\Windows\System\KBnklrI.exe
  2⤵
  PID:9268
- C:\Windows\System\OFBzGTZ.exe
  C:\Windows\System\OFBzGTZ.exe
  2⤵
  PID:8248
- C:\Windows\System\HkFsFxL.exe
  C:\Windows\System\HkFsFxL.exe
  2⤵
  PID:7840
- C:\Windows\System\GJyOsTL.exe
  C:\Windows\System\GJyOsTL.exe
  2⤵
  PID:9416
- C:\Windows\System\NqOllHR.exe
  C:\Windows\System\NqOllHR.exe
  2⤵
  PID:9492
- C:\Windows\System\ktekcBq.exe
  C:\Windows\System\ktekcBq.exe
  2⤵
  PID:9092
- C:\Windows\System\ToSYduZ.exe
  C:\Windows\System\ToSYduZ.exe
  2⤵
  PID:8908
- C:\Windows\System\veNzUSd.exe
  C:\Windows\System\veNzUSd.exe
  2⤵
  PID:9624
- C:\Windows\System\ghhOazf.exe
  C:\Windows\System\ghhOazf.exe
  2⤵
  PID:9432
- C:\Windows\System\eEziyrO.exe
  C:\Windows\System\eEziyrO.exe
  2⤵
  PID:9352
- C:\Windows\System\ycWuiuN.exe
  C:\Windows\System\ycWuiuN.exe
  2⤵
  PID:9884
- C:\Windows\System\zdjwwaz.exe
  C:\Windows\System\zdjwwaz.exe
  2⤵
  PID:9992
- C:\Windows\System\TSQOZdR.exe
  C:\Windows\System\TSQOZdR.exe
  2⤵
  PID:10008
- C:\Windows\System\FPtRQqz.exe
  C:\Windows\System\FPtRQqz.exe
  2⤵
  PID:10040
- C:\Windows\System\urhIYgw.exe
  C:\Windows\System\urhIYgw.exe
  2⤵
  PID:9412
- C:\Windows\System\bzNmpwI.exe
  C:\Windows\System\bzNmpwI.exe
  2⤵
  PID:10172
- C:\Windows\System\aQiwScI.exe
  C:\Windows\System\aQiwScI.exe
  2⤵
  PID:9716
- C:\Windows\System\eHJUjlA.exe
  C:\Windows\System\eHJUjlA.exe
  2⤵
  PID:9756
- C:\Windows\System\XdqqgsX.exe
  C:\Windows\System\XdqqgsX.exe
  2⤵
  PID:10248
- C:\Windows\System\kgovhzr.exe
  C:\Windows\System\kgovhzr.exe
  2⤵
  PID:10268
- C:\Windows\System\wgNFudA.exe
  C:\Windows\System\wgNFudA.exe
  2⤵
  PID:10292
- C:\Windows\System\sLWSyst.exe
  C:\Windows\System\sLWSyst.exe
  2⤵
  PID:10312
- C:\Windows\System\AAuaXpp.exe
  C:\Windows\System\AAuaXpp.exe
  2⤵
  PID:10336
- C:\Windows\System\vxnacxk.exe
  C:\Windows\System\vxnacxk.exe
  2⤵
  PID:10352
- C:\Windows\System\bVreLjb.exe
  C:\Windows\System\bVreLjb.exe
  2⤵
  PID:10372
- C:\Windows\System\krKHqnc.exe
  C:\Windows\System\krKHqnc.exe
  2⤵
  PID:10400
- C:\Windows\System\CTpucfA.exe
  C:\Windows\System\CTpucfA.exe
  2⤵
  PID:10424
- C:\Windows\System\cIUhIWH.exe
  C:\Windows\System\cIUhIWH.exe
  2⤵
  PID:10448
- C:\Windows\System\BWpwRvu.exe
  C:\Windows\System\BWpwRvu.exe
  2⤵
  PID:10472
- C:\Windows\System\CkmVLCZ.exe
  C:\Windows\System\CkmVLCZ.exe
  2⤵
  PID:10496
- C:\Windows\System\eNSjZUQ.exe
  C:\Windows\System\eNSjZUQ.exe
  2⤵
  PID:10520
- C:\Windows\System\FuLCniT.exe
  C:\Windows\System\FuLCniT.exe
  2⤵
  PID:10540
- C:\Windows\System\xCDBPdf.exe
  C:\Windows\System\xCDBPdf.exe
  2⤵
  PID:10564
- C:\Windows\System\UvOfTgW.exe
  C:\Windows\System\UvOfTgW.exe
  2⤵
  PID:10592
- C:\Windows\System\bKtDZtc.exe
  C:\Windows\System\bKtDZtc.exe
  2⤵
  PID:10616
- C:\Windows\System\XNdIdVm.exe
  C:\Windows\System\XNdIdVm.exe
  2⤵
  PID:10640
- C:\Windows\System\IRDycQD.exe
  C:\Windows\System\IRDycQD.exe
  2⤵
  PID:10656
- C:\Windows\System\gLsTnHx.exe
  C:\Windows\System\gLsTnHx.exe
  2⤵
  PID:10680
- C:\Windows\System\QvAEYNQ.exe
  C:\Windows\System\QvAEYNQ.exe
  2⤵
  PID:10700
- C:\Windows\System\JIyjtLa.exe
  C:\Windows\System\JIyjtLa.exe
  2⤵
  PID:10724
- C:\Windows\System\DOxXwkE.exe
  C:\Windows\System\DOxXwkE.exe
  2⤵
  PID:10740
- C:\Windows\System\NNUVLLM.exe
  C:\Windows\System\NNUVLLM.exe
  2⤵
  PID:10756
- C:\Windows\System\eGqSLMc.exe
  C:\Windows\System\eGqSLMc.exe
  2⤵
  PID:10772
- C:\Windows\System\WLDqoRq.exe
  C:\Windows\System\WLDqoRq.exe
  2⤵
  PID:10800
- C:\Windows\System\MUiLjkf.exe
  C:\Windows\System\MUiLjkf.exe
  2⤵
  PID:10828
- C:\Windows\System\MrArykx.exe
  C:\Windows\System\MrArykx.exe
  2⤵
  PID:10852
- C:\Windows\System\DjdGoCg.exe
  C:\Windows\System\DjdGoCg.exe
  2⤵
  PID:10868
- C:\Windows\System\hQNoJHQ.exe
  C:\Windows\System\hQNoJHQ.exe
  2⤵
  PID:10884
- C:\Windows\System\OrgNdBu.exe
  C:\Windows\System\OrgNdBu.exe
  2⤵
  PID:10908
- C:\Windows\System\MxgJPUC.exe
  C:\Windows\System\MxgJPUC.exe
  2⤵
  PID:10928
- C:\Windows\System\xUGtExk.exe
  C:\Windows\System\xUGtExk.exe
  2⤵
  PID:10944
- C:\Windows\System\WADDRSc.exe
  C:\Windows\System\WADDRSc.exe
  2⤵
  PID:10972
- C:\Windows\System\bbWxTit.exe
  C:\Windows\System\bbWxTit.exe
  2⤵
  PID:10992
- C:\Windows\System\OsEhEUE.exe
  C:\Windows\System\OsEhEUE.exe
  2⤵
  PID:11016
- C:\Windows\System\LNyyfJQ.exe
  C:\Windows\System\LNyyfJQ.exe
  2⤵
  PID:11036
- C:\Windows\System\tMXrKHA.exe
  C:\Windows\System\tMXrKHA.exe
  2⤵
  PID:11068
- C:\Windows\System\LidQyYi.exe
  C:\Windows\System\LidQyYi.exe
  2⤵
  PID:11088
- C:\Windows\System\qCPnQOM.exe
  C:\Windows\System\qCPnQOM.exe
  2⤵
  PID:11108
- C:\Windows\System\CvYVqjO.exe
  C:\Windows\System\CvYVqjO.exe
  2⤵
  PID:11136
- C:\Windows\System\hKgtMlH.exe
  C:\Windows\System\hKgtMlH.exe
  2⤵
  PID:11164
- C:\Windows\System\oIUrtWh.exe
  C:\Windows\System\oIUrtWh.exe
  2⤵
  PID:11188
- C:\Windows\System\vCRLtVn.exe
  C:\Windows\System\vCRLtVn.exe
  2⤵
  PID:11204
- C:\Windows\System\MwMUPyi.exe
  C:\Windows\System\MwMUPyi.exe
  2⤵
  PID:11228
- C:\Windows\System\ulimvRZ.exe
  C:\Windows\System\ulimvRZ.exe
  2⤵
  PID:11256
- C:\Windows\System\MyvEfvC.exe
  C:\Windows\System\MyvEfvC.exe
  2⤵
  PID:9872
- C:\Windows\System\gnuiWwN.exe
  C:\Windows\System\gnuiWwN.exe
  2⤵
  PID:9060
- C:\Windows\System\wLeeeRm.exe
  C:\Windows\System\wLeeeRm.exe
  2⤵
  PID:9984
- C:\Windows\System\SIHJnMs.exe
  C:\Windows\System\SIHJnMs.exe
  2⤵
  PID:9312
- C:\Windows\System\BwfpZQz.exe
  C:\Windows\System\BwfpZQz.exe
  2⤵
  PID:9620
- C:\Windows\System\cICzAAz.exe
  C:\Windows\System\cICzAAz.exe
  2⤵
  PID:10176
- C:\Windows\System\RayJbak.exe
  C:\Windows\System\RayJbak.exe
  2⤵
  PID:9584
- C:\Windows\System\VoEYDao.exe
  C:\Windows\System\VoEYDao.exe
  2⤵
  PID:10200
- C:\Windows\System\CZtFwDL.exe
  C:\Windows\System\CZtFwDL.exe
  2⤵
  PID:10232
- C:\Windows\System\EdGLvpY.exe
  C:\Windows\System\EdGLvpY.exe
  2⤵
  PID:9808
- C:\Windows\System\MVklFXN.exe
  C:\Windows\System\MVklFXN.exe
  2⤵
  PID:9812
- C:\Windows\System\FQzfvwi.exe
  C:\Windows\System\FQzfvwi.exe
  2⤵
  PID:9852
- C:\Windows\System\kUqgcSl.exe
  C:\Windows\System\kUqgcSl.exe
  2⤵
  PID:9916
- C:\Windows\System\ZbwNNOb.exe
  C:\Windows\System\ZbwNNOb.exe
  2⤵
  PID:9064
- C:\Windows\System\YmyCCMX.exe
  C:\Windows\System\YmyCCMX.exe
  2⤵
  PID:10456
- C:\Windows\System\JlCVkAv.exe
  C:\Windows\System\JlCVkAv.exe
  2⤵
  PID:10528
- C:\Windows\System\BPmadDM.exe
  C:\Windows\System\BPmadDM.exe
  2⤵
  PID:10512
- C:\Windows\System\QoXOOjj.exe
  C:\Windows\System\QoXOOjj.exe
  2⤵
  PID:10076
- C:\Windows\System\CpSASEo.exe
  C:\Windows\System\CpSASEo.exe
  2⤵
  PID:10648
- C:\Windows\System\sNtknbP.exe
  C:\Windows\System\sNtknbP.exe
  2⤵
  PID:10212
- C:\Windows\System\aoJevwO.exe
  C:\Windows\System\aoJevwO.exe
  2⤵
  PID:8344
- C:\Windows\System\GOMwiuT.exe
  C:\Windows\System\GOMwiuT.exe
  2⤵
  PID:10816
- C:\Windows\System\mrHKPuP.exe
  C:\Windows\System\mrHKPuP.exe
  2⤵
  PID:10860
- C:\Windows\System\WUrjaWS.exe
  C:\Windows\System\WUrjaWS.exe
  2⤵
  PID:10900
- C:\Windows\System\wWBcesA.exe
  C:\Windows\System\wWBcesA.exe
  2⤵
  PID:10332
- C:\Windows\System\iieUXrq.exe
  C:\Windows\System\iieUXrq.exe
  2⤵
  PID:10980
- C:\Windows\System\ndnhwaG.exe
  C:\Windows\System\ndnhwaG.exe
  2⤵
  PID:11048
- C:\Windows\System\iRzhdaF.exe
  C:\Windows\System\iRzhdaF.exe
  2⤵
  PID:11076
- C:\Windows\System\zxPmANj.exe
  C:\Windows\System\zxPmANj.exe
  2⤵
  PID:11268
- C:\Windows\System\gJgRxWn.exe
  C:\Windows\System\gJgRxWn.exe
  2⤵
  PID:11292
- C:\Windows\System\sMRtGWQ.exe
  C:\Windows\System\sMRtGWQ.exe
  2⤵
  PID:11336
- C:\Windows\System\WAggVHt.exe
  C:\Windows\System\WAggVHt.exe
  2⤵
  PID:11352
- C:\Windows\System\topByMD.exe
  C:\Windows\System\topByMD.exe
  2⤵
  PID:11368
- C:\Windows\System\ERmyTci.exe
  C:\Windows\System\ERmyTci.exe
  2⤵
  PID:11384
- C:\Windows\System\uIWzmVN.exe
  C:\Windows\System\uIWzmVN.exe
  2⤵
  PID:11408
- C:\Windows\System\ueSRMyX.exe
  C:\Windows\System\ueSRMyX.exe
  2⤵
  PID:11436
- C:\Windows\System\NVrCMHw.exe
  C:\Windows\System\NVrCMHw.exe
  2⤵
  PID:11456
- C:\Windows\System\lnFtJvp.exe
  C:\Windows\System\lnFtJvp.exe
  2⤵
  PID:11480
- C:\Windows\System\VcvFNXj.exe
  C:\Windows\System\VcvFNXj.exe
  2⤵
  PID:11504
- C:\Windows\System\GeZWxji.exe
  C:\Windows\System\GeZWxji.exe
  2⤵
  PID:11532
- C:\Windows\System\ABcIeso.exe
  C:\Windows\System\ABcIeso.exe
  2⤵
  PID:11552
- C:\Windows\System\OCsgVvv.exe
  C:\Windows\System\OCsgVvv.exe
  2⤵
  PID:11584
- C:\Windows\System\pYVsEPX.exe
  C:\Windows\System\pYVsEPX.exe
  2⤵
  PID:11612
- C:\Windows\System\iLAZdZQ.exe
  C:\Windows\System\iLAZdZQ.exe
  2⤵
  PID:11632
- C:\Windows\System\OqAaTOV.exe
  C:\Windows\System\OqAaTOV.exe
  2⤵
  PID:11652
- C:\Windows\System\zqjxzcW.exe
  C:\Windows\System\zqjxzcW.exe
  2⤵
  PID:11676
- C:\Windows\System\MAjCbDq.exe
  C:\Windows\System\MAjCbDq.exe
  2⤵
  PID:11700
- C:\Windows\System\FEdLHyO.exe
  C:\Windows\System\FEdLHyO.exe
  2⤵
  PID:11720
- C:\Windows\System\eOCGDSw.exe
  C:\Windows\System\eOCGDSw.exe
  2⤵
  PID:11736
- C:\Windows\System\EAIXRIR.exe
  C:\Windows\System\EAIXRIR.exe
  2⤵
  PID:11764
- C:\Windows\System\PDWMGmO.exe
  C:\Windows\System\PDWMGmO.exe
  2⤵
  PID:11792
- C:\Windows\System\ukAFPel.exe
  C:\Windows\System\ukAFPel.exe
  2⤵
  PID:11812
- C:\Windows\System\TFNmrfT.exe
  C:\Windows\System\TFNmrfT.exe
  2⤵
  PID:11840
- C:\Windows\System\knraWAg.exe
  C:\Windows\System\knraWAg.exe
  2⤵
  PID:11864
- C:\Windows\System\HVBKSIq.exe
  C:\Windows\System\HVBKSIq.exe
  2⤵
  PID:11880
- C:\Windows\System\DvgGxVv.exe
  C:\Windows\System\DvgGxVv.exe
  2⤵
  PID:11900
- C:\Windows\System\qRTwRML.exe
  C:\Windows\System\qRTwRML.exe
  2⤵
  PID:11932
- C:\Windows\System\JMAPKKj.exe
  C:\Windows\System\JMAPKKj.exe
  2⤵
  PID:11956
- C:\Windows\System\FSPbpkP.exe
  C:\Windows\System\FSPbpkP.exe
  2⤵
  PID:11984
- C:\Windows\System\xYtQDfP.exe
  C:\Windows\System\xYtQDfP.exe
  2⤵
  PID:12004
- C:\Windows\System\aCHTdZb.exe
  C:\Windows\System\aCHTdZb.exe
  2⤵
  PID:12036
- C:\Windows\System\ItLAvuJ.exe
  C:\Windows\System\ItLAvuJ.exe
  2⤵
  PID:12056
- C:\Windows\System\yDzQqYr.exe
  C:\Windows\System\yDzQqYr.exe
  2⤵
  PID:12076
- C:\Windows\System\FROBcJu.exe
  C:\Windows\System\FROBcJu.exe
  2⤵
  PID:12100
- C:\Windows\System\ZBTUBzU.exe
  C:\Windows\System\ZBTUBzU.exe
  2⤵
  PID:12128
- C:\Windows\System\OzptBPU.exe
  C:\Windows\System\OzptBPU.exe
  2⤵
  PID:12144
- C:\Windows\System\iYjzulP.exe
  C:\Windows\System\iYjzulP.exe
  2⤵
  PID:12168
- C:\Windows\System\AkvLOsX.exe
  C:\Windows\System\AkvLOsX.exe
  2⤵
  PID:12192
- C:\Windows\System\tlKRkeU.exe
  C:\Windows\System\tlKRkeU.exe
  2⤵
  PID:12208
- C:\Windows\System\CsdEwyq.exe
  C:\Windows\System\CsdEwyq.exe
  2⤵
  PID:12224
- C:\Windows\System\HQrqHkf.exe
  C:\Windows\System\HQrqHkf.exe
  2⤵
  PID:12244
- C:\Windows\System\miNRnDR.exe
  C:\Windows\System\miNRnDR.exe
  2⤵
  PID:12264
- C:\Windows\System\qCTTuCc.exe
  C:\Windows\System\qCTTuCc.exe
  2⤵
  PID:9028
- C:\Windows\System\RfSZmNM.exe
  C:\Windows\System\RfSZmNM.exe
  2⤵
  PID:11248
- C:\Windows\System\EzJCYgC.exe
  C:\Windows\System\EzJCYgC.exe
  2⤵
  PID:10672
- C:\Windows\System\qQeNGla.exe
  C:\Windows\System\qQeNGla.exe
  2⤵
  PID:9936
- C:\Windows\System\BRMahsN.exe
  C:\Windows\System\BRMahsN.exe
  2⤵
  PID:10152
- C:\Windows\System\ShLvWJF.exe
  C:\Windows\System\ShLvWJF.exe
  2⤵
  PID:9640
- C:\Windows\System\NXwZqGO.exe
  C:\Windows\System\NXwZqGO.exe
  2⤵
  PID:9848
- C:\Windows\System\CMEFxGN.exe
  C:\Windows\System\CMEFxGN.exe
  2⤵
  PID:10288
- C:\Windows\System\FbVytFh.exe
  C:\Windows\System\FbVytFh.exe
  2⤵
  PID:10384
- C:\Windows\System\WRusbLi.exe
  C:\Windows\System\WRusbLi.exe
  2⤵
  PID:10864
- C:\Windows\System\wDhhIBO.exe
  C:\Windows\System\wDhhIBO.exe
  2⤵
  PID:10904
- C:\Windows\System\DMOPpbN.exe
  C:\Windows\System\DMOPpbN.exe
  2⤵
  PID:10104
- C:\Windows\System\UjvbOkg.exe
  C:\Windows\System\UjvbOkg.exe
  2⤵
  PID:10812
- C:\Windows\System\dWZsXYa.exe
  C:\Windows\System\dWZsXYa.exe
  2⤵
  PID:11004
- C:\Windows\System\ptdeBwt.exe
  C:\Windows\System\ptdeBwt.exe
  2⤵
  PID:10464
- C:\Windows\System\RCdhyAD.exe
  C:\Windows\System\RCdhyAD.exe
  2⤵
  PID:9144
- C:\Windows\System\iEPKtdj.exe
  C:\Windows\System\iEPKtdj.exe
  2⤵
  PID:11276
- C:\Windows\System\tMoqiUG.exe
  C:\Windows\System\tMoqiUG.exe
  2⤵
  PID:11156
- C:\Windows\System\LdsTpxq.exe
  C:\Windows\System\LdsTpxq.exe
  2⤵
  PID:11364
- C:\Windows\System\qDqbmlT.exe
  C:\Windows\System\qDqbmlT.exe
  2⤵
  PID:11396
- C:\Windows\System\ycHUopy.exe
  C:\Windows\System\ycHUopy.exe
  2⤵
  PID:11244
- C:\Windows\System\snVzHzC.exe
  C:\Windows\System\snVzHzC.exe
  2⤵
  PID:11500
- C:\Windows\System\KnUgqtH.exe
  C:\Windows\System\KnUgqtH.exe
  2⤵
  PID:11576
- C:\Windows\System\kWvXpOO.exe
  C:\Windows\System\kWvXpOO.exe
  2⤵
  PID:12296
- C:\Windows\System\LIekGCA.exe
  C:\Windows\System\LIekGCA.exe
  2⤵
  PID:12316
- C:\Windows\System\QobeMqt.exe
  C:\Windows\System\QobeMqt.exe
  2⤵
  PID:12340
- C:\Windows\System\cIltbQW.exe
  C:\Windows\System\cIltbQW.exe
  2⤵
  PID:12360
- C:\Windows\System\HhukQWu.exe
  C:\Windows\System\HhukQWu.exe
  2⤵
  PID:12388
- C:\Windows\System\wkVuRIB.exe
  C:\Windows\System\wkVuRIB.exe
  2⤵
  PID:12412
- C:\Windows\System\EsOmTfr.exe
  C:\Windows\System\EsOmTfr.exe
  2⤵
  PID:12852
- C:\Windows\System\NPLmEsF.exe
  C:\Windows\System\NPLmEsF.exe
  2⤵
  PID:12868
- C:\Windows\System\MvCliZZ.exe
  C:\Windows\System\MvCliZZ.exe
  2⤵
  PID:12888
- C:\Windows\System\vVSDcTW.exe
  C:\Windows\System\vVSDcTW.exe
  2⤵
  PID:12904
- C:\Windows\System\wfZwGPt.exe
  C:\Windows\System\wfZwGPt.exe
  2⤵
  PID:12920
- C:\Windows\System\FyMJBuX.exe
  C:\Windows\System\FyMJBuX.exe
  2⤵
  PID:12936
- C:\Windows\System\ngVaCUn.exe
  C:\Windows\System\ngVaCUn.exe
  2⤵
  PID:12952
- C:\Windows\System\DfLjpda.exe
  C:\Windows\System\DfLjpda.exe
  2⤵
  PID:12968
- C:\Windows\System\zXZIkLw.exe
  C:\Windows\System\zXZIkLw.exe
  2⤵
  PID:13004
- C:\Windows\System\tyejgVW.exe
  C:\Windows\System\tyejgVW.exe
  2⤵
  PID:13036
- C:\Windows\System\coKDcrg.exe
  C:\Windows\System\coKDcrg.exe
  2⤵
  PID:13056
- C:\Windows\System\TzjlBGg.exe
  C:\Windows\System\TzjlBGg.exe
  2⤵
  PID:13080
- C:\Windows\System\QvJmJGH.exe
  C:\Windows\System\QvJmJGH.exe
  2⤵
  PID:13096
- C:\Windows\System\kIESEex.exe
  C:\Windows\System\kIESEex.exe
  2⤵
  PID:13112
- C:\Windows\System\ohdyphz.exe
  C:\Windows\System\ohdyphz.exe
  2⤵
  PID:13128
- C:\Windows\System\LGdchXR.exe
  C:\Windows\System\LGdchXR.exe
  2⤵
  PID:13148
- C:\Windows\System\ZkyuQgK.exe
  C:\Windows\System\ZkyuQgK.exe
  2⤵
  PID:13168
- C:\Windows\System\MFtuQlD.exe
  C:\Windows\System\MFtuQlD.exe
  2⤵
  PID:13208
- C:\Windows\System\aJmymwa.exe
  C:\Windows\System\aJmymwa.exe
  2⤵
  PID:13240
- C:\Windows\System\YSoTVFK.exe
  C:\Windows\System\YSoTVFK.exe
  2⤵
  PID:13272
- C:\Windows\System\HqCrDhF.exe
  C:\Windows\System\HqCrDhF.exe
  2⤵
  PID:11688
- C:\Windows\System\xOWdYRB.exe
  C:\Windows\System\xOWdYRB.exe
  2⤵
  PID:10228
- C:\Windows\System\KutWeEB.exe
  C:\Windows\System\KutWeEB.exe
  2⤵
  PID:12016
- C:\Windows\System\ZFjweWM.exe
  C:\Windows\System\ZFjweWM.exe
  2⤵
  PID:12068
- C:\Windows\System\zWwjpCV.exe
  C:\Windows\System\zWwjpCV.exe
  2⤵
  PID:10936
- C:\Windows\System\RBbZSYb.exe
  C:\Windows\System\RBbZSYb.exe
  2⤵
  PID:12124
- C:\Windows\System\BVLETWL.exe
  C:\Windows\System\BVLETWL.exe
  2⤵
  PID:12164
- C:\Windows\System\MFZJLDo.exe
  C:\Windows\System\MFZJLDo.exe
  2⤵
  PID:12188
- C:\Windows\System\oEUxeEn.exe
  C:\Windows\System\oEUxeEn.exe
  2⤵
  PID:11424
- C:\Windows\System\vbaGTQZ.exe
  C:\Windows\System\vbaGTQZ.exe
  2⤵
  PID:11524
- C:\Windows\System\UlWbldm.exe
  C:\Windows\System\UlWbldm.exe
  2⤵
  PID:11660
- C:\Windows\System\hKDKwqo.exe
  C:\Windows\System\hKDKwqo.exe
  2⤵
  PID:12312
- C:\Windows\System\mWrsJrW.exe
  C:\Windows\System\mWrsJrW.exe
  2⤵
  PID:12332
- C:\Windows\System\iiikJHl.exe
  C:\Windows\System\iiikJHl.exe
  2⤵
  PID:11772
- C:\Windows\System\szeDOut.exe
  C:\Windows\System\szeDOut.exe
  2⤵
  PID:12396
- C:\Windows\System\wqBAEJC.exe
  C:\Windows\System\wqBAEJC.exe
  2⤵
  PID:11824
- C:\Windows\System\bggrsmI.exe
  C:\Windows\System\bggrsmI.exe
  2⤵
  PID:9304
- C:\Windows\System\yyifzsV.exe
  C:\Windows\System\yyifzsV.exe
  2⤵
  PID:13372
- C:\Windows\System\JCYpZKI.exe
  C:\Windows\System\JCYpZKI.exe
  2⤵
  PID:13444
- C:\Windows\System\fTANUFP.exe
  C:\Windows\System\fTANUFP.exe
  2⤵
  PID:13500
- C:\Windows\System\qNFkrlg.exe
  C:\Windows\System\qNFkrlg.exe
  2⤵
  PID:13524
- C:\Windows\System\qNUQMRF.exe
  C:\Windows\System\qNUQMRF.exe
  2⤵
  PID:13544
- C:\Windows\System\UZsNRaX.exe
  C:\Windows\System\UZsNRaX.exe
  2⤵
  PID:13576
- C:\Windows\System\kcLkhzX.exe
  C:\Windows\System\kcLkhzX.exe
  2⤵
  PID:13608
- C:\Windows\System\MlOnmQn.exe
  C:\Windows\System\MlOnmQn.exe
  2⤵
  PID:13640
- C:\Windows\System\PqPsNhN.exe
  C:\Windows\System\PqPsNhN.exe
  2⤵
  PID:13672
- C:\Windows\System\wwTVMyE.exe
  C:\Windows\System\wwTVMyE.exe
  2⤵
  PID:13688
- C:\Windows\System\GGxRrnJ.exe
  C:\Windows\System\GGxRrnJ.exe
  2⤵
  PID:13732
- C:\Windows\System\fXpfTFC.exe
  C:\Windows\System\fXpfTFC.exe
  2⤵
  PID:13760
- C:\Windows\System\nObDCbe.exe
  C:\Windows\System\nObDCbe.exe
  2⤵
  PID:13784
- C:\Windows\System\EMwbYwP.exe
  C:\Windows\System\EMwbYwP.exe
  2⤵
  PID:13812
- C:\Windows\System\bXnyMhe.exe
  C:\Windows\System\bXnyMhe.exe
  2⤵
  PID:13844
- C:\Windows\System\EWaEzfG.exe
  C:\Windows\System\EWaEzfG.exe
  2⤵
  PID:13868
- C:\Windows\System\QWoYmnz.exe
  C:\Windows\System\QWoYmnz.exe
  2⤵
  PID:13892
- C:\Windows\System\ciMgfwf.exe
  C:\Windows\System\ciMgfwf.exe
  2⤵
  PID:13920
- C:\Windows\System\YCcTfHU.exe
  C:\Windows\System\YCcTfHU.exe
  2⤵
  PID:13944
- C:\Windows\System\mXWoNXm.exe
  C:\Windows\System\mXWoNXm.exe
  2⤵
  PID:13960
- C:\Windows\System\dBdPvlJ.exe
  C:\Windows\System\dBdPvlJ.exe
  2⤵
  PID:13984
- C:\Windows\System\tLuDzSC.exe
  C:\Windows\System\tLuDzSC.exe
  2⤵
  PID:14000
- C:\Windows\System\PFSBCUX.exe
  C:\Windows\System\PFSBCUX.exe
  2⤵
  PID:14036
- C:\Windows\System\EShWwVz.exe
  C:\Windows\System\EShWwVz.exe
  2⤵
  PID:14056
- C:\Windows\System\AiguTHx.exe
  C:\Windows\System\AiguTHx.exe
  2⤵
  PID:14072
- C:\Windows\System\qBtdnXP.exe
  C:\Windows\System\qBtdnXP.exe
  2⤵
  PID:14092
- C:\Windows\System\OPocBfQ.exe
  C:\Windows\System\OPocBfQ.exe
  2⤵
  PID:14112
- C:\Windows\System\dnFppeh.exe
  C:\Windows\System\dnFppeh.exe
  2⤵
  PID:14140
- C:\Windows\System\CbMsdmj.exe
  C:\Windows\System\CbMsdmj.exe
  2⤵
  PID:14168
- C:\Windows\System\ekkamZu.exe
  C:\Windows\System\ekkamZu.exe
  2⤵
  PID:14188
- C:\Windows\System\sjUdiiQ.exe
  C:\Windows\System\sjUdiiQ.exe
  2⤵
  PID:14220
- C:\Windows\System\uMHFJeq.exe
  C:\Windows\System\uMHFJeq.exe
  2⤵
  PID:14240
- C:\Windows\System\MbysGsY.exe
  C:\Windows\System\MbysGsY.exe
  2⤵
  PID:14260
- C:\Windows\System\vTgqfnn.exe
  C:\Windows\System\vTgqfnn.exe
  2⤵
  PID:14284
- C:\Windows\System\MwXUBfq.exe
  C:\Windows\System\MwXUBfq.exe
  2⤵
  PID:14304
- C:\Windows\System\WOmrxaL.exe
  C:\Windows\System\WOmrxaL.exe
  2⤵
  PID:11852
- C:\Windows\System\LHagHla.exe
  C:\Windows\System\LHagHla.exe
  2⤵
  PID:13388
- C:\Windows\System\InDIqup.exe
  C:\Windows\System\InDIqup.exe
  2⤵
  PID:13568
- C:\Windows\System\fqPzfdg.exe
  C:\Windows\System\fqPzfdg.exe
  2⤵
  PID:13620
- C:\Windows\System\sRHhbGM.exe
  C:\Windows\System\sRHhbGM.exe
  2⤵
  PID:13660
- C:\Windows\System\KpuPdqF.exe
  C:\Windows\System\KpuPdqF.exe
  2⤵
  PID:10096
- C:\Windows\System\jgoVMAb.exe
  C:\Windows\System\jgoVMAb.exe
  2⤵
  PID:13332
- C:\Windows\System\LHuvRsp.exe
  C:\Windows\System\LHuvRsp.exe
  2⤵
  PID:13400
- C:\Windows\System\jGfEHzA.exe
  C:\Windows\System\jGfEHzA.exe
  2⤵
  PID:13424
- C:\Windows\System\UIDIUvE.exe
  C:\Windows\System\UIDIUvE.exe
  2⤵
  PID:13956
- C:\Windows\System\JvmbtpU.exe
  C:\Windows\System\JvmbtpU.exe
  2⤵
  PID:13356
- C:\Windows\System\HIUksle.exe
  C:\Windows\System\HIUksle.exe
  2⤵
  PID:13456
- C:\Windows\System\SQVXNQP.exe
  C:\Windows\System\SQVXNQP.exe
  2⤵
  PID:13480
- C:\Windows\System\oEAFnZU.exe
  C:\Windows\System\oEAFnZU.exe
  2⤵
  PID:14068
- C:\Windows\System\tPhLBND.exe
  C:\Windows\System\tPhLBND.exe
  2⤵
  PID:13756
- C:\Windows\System\vbJtCRE.exe
  C:\Windows\System\vbJtCRE.exe
  2⤵
  PID:14132
- C:\Windows\System\JpMpjiS.exe
  C:\Windows\System\JpMpjiS.exe
  2⤵
  PID:14228
- C:\Windows\System\DzNnxFz.exe
  C:\Windows\System\DzNnxFz.exe
  2⤵
  PID:14276
- C:\Windows\System\lJhkIxr.exe
  C:\Windows\System\lJhkIxr.exe
  2⤵
  PID:13972
- C:\Windows\System\qXXmVvJ.exe
  C:\Windows\System\qXXmVvJ.exe
  2⤵
  PID:14044
- C:\Windows\System\mYlKkWJ.exe
  C:\Windows\System\mYlKkWJ.exe
  2⤵
  PID:11392
- C:\Windows\System\asgNgrh.exe
  C:\Windows\System\asgNgrh.exe
  2⤵
  PID:11404
- C:\Windows\System\qdxiJdf.exe
  C:\Windows\System\qdxiJdf.exe
  2⤵
  PID:13408
- C:\Windows\System\NnIbLvL.exe
  C:\Windows\System\NnIbLvL.exe
  2⤵
  PID:13600
- C:\Windows\System\IekzVUD.exe
  C:\Windows\System\IekzVUD.exe
  2⤵
  PID:13800
- C:\Windows\System\xfmCqwK.exe
  C:\Windows\System\xfmCqwK.exe
  2⤵
  PID:13348
- C:\Windows\System\KTVCnip.exe
  C:\Windows\System\KTVCnip.exe
  2⤵
  PID:14124
- C:\Windows\System\MueHKsN.exe
  C:\Windows\System\MueHKsN.exe
  2⤵
  PID:14356
- C:\Windows\System\RQSOsSf.exe
  C:\Windows\System\RQSOsSf.exe
  2⤵
  PID:14372
- C:\Windows\System\OIFduMo.exe
  C:\Windows\System\OIFduMo.exe
  2⤵
  PID:14396
- C:\Windows\System\eCpslDW.exe
  C:\Windows\System\eCpslDW.exe
  2⤵
  PID:14416
- C:\Windows\System\kIAgarR.exe
  C:\Windows\System\kIAgarR.exe
  2⤵
  PID:14448
- C:\Windows\System\ouCUQfL.exe
  C:\Windows\System\ouCUQfL.exe
  2⤵
  PID:14476
- C:\Windows\System\wSoPIKm.exe
  C:\Windows\System\wSoPIKm.exe
  2⤵
  PID:14492
- C:\Windows\System\xDUOHrA.exe
  C:\Windows\System\xDUOHrA.exe
  2⤵
  PID:14508
- C:\Windows\System\UEphFQa.exe
  C:\Windows\System\UEphFQa.exe
  2⤵
  PID:14532
- C:\Windows\System\ylmvUik.exe
  C:\Windows\System\ylmvUik.exe
  2⤵
  PID:14552
- C:\Windows\System\dfQabcu.exe
  C:\Windows\System\dfQabcu.exe
  2⤵
  PID:14568
- C:\Windows\System\jyCmGFs.exe
  C:\Windows\System\jyCmGFs.exe
  2⤵
  PID:14584
- C:\Windows\System\JFlkSex.exe
  C:\Windows\System\JFlkSex.exe
  2⤵
  PID:14600
- C:\Windows\System\GycsnqA.exe
  C:\Windows\System\GycsnqA.exe
  2⤵
  PID:14624
- C:\Windows\System\aLnNpcR.exe
  C:\Windows\System\aLnNpcR.exe
  2⤵
  PID:14640
- C:\Windows\System\btUWoGr.exe
  C:\Windows\System\btUWoGr.exe
  2⤵
  PID:14668
- C:\Windows\System\VFrtbEH.exe
  C:\Windows\System\VFrtbEH.exe
  2⤵
  PID:14684
- C:\Windows\System\HYWLfIA.exe
  C:\Windows\System\HYWLfIA.exe
  2⤵
  PID:14704
- C:\Windows\System\ApQcIxl.exe
  C:\Windows\System\ApQcIxl.exe
  2⤵
  PID:14724
- C:\Windows\System\NTtEdeU.exe
  C:\Windows\System\NTtEdeU.exe
  2⤵
  PID:14752
- C:\Windows\System\rUefTGG.exe
  C:\Windows\System\rUefTGG.exe
  2⤵
  PID:14768
- C:\Windows\System\GNuznTz.exe
  C:\Windows\System\GNuznTz.exe
  2⤵
  PID:14792
- C:\Windows\System\THXbDXy.exe
  C:\Windows\System\THXbDXy.exe
  2⤵
  PID:14812
- C:\Windows\System\jpDDXIh.exe
  C:\Windows\System\jpDDXIh.exe
  2⤵
  PID:14828
- C:\Windows\System\FIhVeNq.exe
  C:\Windows\System\FIhVeNq.exe
  2⤵
  PID:14848
- C:\Windows\System\IIoXmao.exe
  C:\Windows\System\IIoXmao.exe
  2⤵
  PID:14868
- C:\Windows\System\eZiCQSN.exe
  C:\Windows\System\eZiCQSN.exe
  2⤵
  PID:14892
- C:\Windows\System\kYbCXyM.exe
  C:\Windows\System\kYbCXyM.exe
  2⤵
  PID:14912
- C:\Windows\System\sCwWaLj.exe
  C:\Windows\System\sCwWaLj.exe
  2⤵
  PID:14936
- C:\Windows\System\crYzMRh.exe
  C:\Windows\System\crYzMRh.exe
  2⤵
  PID:14956
- C:\Windows\System\fiODcVY.exe
  C:\Windows\System\fiODcVY.exe
  2⤵
  PID:14972
- C:\Windows\System\IYkXoCP.exe
  C:\Windows\System\IYkXoCP.exe
  2⤵
  PID:15000
- C:\Windows\System\obslJUM.exe
  C:\Windows\System\obslJUM.exe
  2⤵
  PID:15016
- C:\Windows\System\MRaKaGr.exe
  C:\Windows\System\MRaKaGr.exe
  2⤵
  PID:15040
- C:\Windows\System\qRTOMaa.exe
  C:\Windows\System\qRTOMaa.exe
  2⤵
  PID:15056
- C:\Windows\System\tYzQphk.exe
  C:\Windows\System\tYzQphk.exe
  2⤵
  PID:15072
- - C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -u -p 15072 -s 248
    3⤵
    PID:2740
- C:\Windows\System\aJcabRF.exe
  C:\Windows\System\aJcabRF.exe
  2⤵
  PID:15092
- C:\Windows\System\zCDQnBc.exe
  C:\Windows\System\zCDQnBc.exe
  2⤵
  PID:15108
- C:\Windows\System\BUrqcfB.exe
  C:\Windows\System\BUrqcfB.exe
  2⤵
  PID:15124
- C:\Windows\System\QDHNjCe.exe
  C:\Windows\System\QDHNjCe.exe
  2⤵
  PID:15148
- C:\Windows\System\tuerFkO.exe
  C:\Windows\System\tuerFkO.exe
  2⤵
  PID:15164
- C:\Windows\System\FaTlUEM.exe
  C:\Windows\System\FaTlUEM.exe
  2⤵
  PID:15184
- C:\Windows\System\bZLGbhK.exe
  C:\Windows\System\bZLGbhK.exe
  2⤵
  PID:15200
- C:\Windows\System\ZhzLCbj.exe
  C:\Windows\System\ZhzLCbj.exe
  2⤵
  PID:15228
- C:\Windows\System\HwgyDud.exe
  C:\Windows\System\HwgyDud.exe
  2⤵
  PID:15244
- C:\Windows\System\UWUYdaU.exe
  C:\Windows\System\UWUYdaU.exe
  2⤵
  PID:15268
- C:\Windows\System\VflqePP.exe
  C:\Windows\System\VflqePP.exe
  2⤵
  PID:15284
- C:\Windows\System\oQWYuEQ.exe
  C:\Windows\System\oQWYuEQ.exe
  2⤵
  PID:15304
- C:\Windows\System\VVLsjUv.exe
  C:\Windows\System\VVLsjUv.exe
  2⤵
  PID:15324
- C:\Windows\System\dJaNVmP.exe
  C:\Windows\System\dJaNVmP.exe
  2⤵
  PID:15352
- C:\Windows\System\kstMLAl.exe
  C:\Windows\System\kstMLAl.exe
  2⤵
  PID:13912
- C:\Windows\System\vJLOZNe.exe
  C:\Windows\System\vJLOZNe.exe
  2⤵
  PID:13992
- C:\Windows\System\SFPTgxT.exe
  C:\Windows\System\SFPTgxT.exe
  2⤵
  PID:13328
- C:\Windows\System\YZzClOj.exe
  C:\Windows\System\YZzClOj.exe
  2⤵
  PID:13996
- C:\Windows\System\uNjBqcJ.exe
  C:\Windows\System\uNjBqcJ.exe
  2⤵
  PID:14184
- C:\Windows\System\RUQAcpe.exe
  C:\Windows\System\RUQAcpe.exe
  2⤵
  PID:11784
- C:\Windows\System\RvQVjWr.exe
  C:\Windows\System\RvQVjWr.exe
  2⤵
  PID:14384
- C:\Windows\System\NfXTFmS.exe
  C:\Windows\System\NfXTFmS.exe
  2⤵
  PID:14484
- C:\Windows\System\wCONdRx.exe
  C:\Windows\System\wCONdRx.exe
  2⤵
  PID:14524
- C:\Windows\System\bWTQtYV.exe
  C:\Windows\System\bWTQtYV.exe
  2⤵
  PID:14576
- C:\Windows\System\WrSqkSZ.exe
  C:\Windows\System\WrSqkSZ.exe
  2⤵
  PID:13476
- C:\Windows\System\ljNUCJV.exe
  C:\Windows\System\ljNUCJV.exe
  2⤵
  PID:14680
- C:\Windows\System\YIjBsOb.exe
  C:\Windows\System\YIjBsOb.exe
  2⤵
  PID:14160
- C:\Windows\System\gHRNlgP.exe
  C:\Windows\System\gHRNlgP.exe
  2⤵
  PID:14780
- C:\Windows\System\XNGAJDi.exe
  C:\Windows\System\XNGAJDi.exe
  2⤵
  PID:14824
- C:\Windows\System\vFaGqCp.exe
  C:\Windows\System\vFaGqCp.exe
  2⤵
  PID:14272
- C:\Windows\System\cvMbawB.exe
  C:\Windows\System\cvMbawB.exe
  2⤵
  PID:14900
- C:\Windows\System\JgRSoHu.exe
  C:\Windows\System\JgRSoHu.exe
  2⤵
  PID:15008
- C:\Windows\System\ygKsdaO.exe
  C:\Windows\System\ygKsdaO.exe
  2⤵
  PID:15080
- C:\Windows\System\IpWyVql.exe
  C:\Windows\System\IpWyVql.exe
  2⤵
  PID:15380
- C:\Windows\System\JyuAjYi.exe
  C:\Windows\System\JyuAjYi.exe
  2⤵
  PID:15396
- C:\Windows\System\nfiInSv.exe
  C:\Windows\System\nfiInSv.exe
  2⤵
  PID:15412
- C:\Windows\System\zVtFtJv.exe
  C:\Windows\System\zVtFtJv.exe
  2⤵
  PID:15436
- C:\Windows\System\gJgrfnP.exe
  C:\Windows\System\gJgrfnP.exe
  2⤵
  PID:15456
- C:\Windows\System\tVxvNYM.exe
  C:\Windows\System\tVxvNYM.exe
  2⤵
  PID:15476
- C:\Windows\System\AVIptfd.exe
  C:\Windows\System\AVIptfd.exe
  2⤵
  PID:15508
- C:\Windows\System\TPdfskY.exe
  C:\Windows\System\TPdfskY.exe
  2⤵
  PID:15524
- C:\Windows\System\EbCsULq.exe
  C:\Windows\System\EbCsULq.exe
  2⤵
  PID:15548
- C:\Windows\System\dclTWfk.exe
  C:\Windows\System\dclTWfk.exe
  2⤵
  PID:15564
- C:\Windows\System\mOdRbqd.exe
  C:\Windows\System\mOdRbqd.exe
  2⤵
  PID:15580
- C:\Windows\System\GApWnUM.exe
  C:\Windows\System\GApWnUM.exe
  2⤵
  PID:15600
- C:\Windows\System\KhHTEGW.exe
  C:\Windows\System\KhHTEGW.exe
  2⤵
  PID:15616
- C:\Windows\System\NdCqNKA.exe
  C:\Windows\System\NdCqNKA.exe
  2⤵
  PID:15640
- C:\Windows\System\DKdLqxO.exe
  C:\Windows\System\DKdLqxO.exe
  2⤵
  PID:15656
- C:\Windows\System\NtJPmHP.exe
  C:\Windows\System\NtJPmHP.exe
  2⤵
  PID:15680
- C:\Windows\System\tEhxRGK.exe
  C:\Windows\System\tEhxRGK.exe
  2⤵
  PID:15700
- C:\Windows\System\uJqcFnS.exe
  C:\Windows\System\uJqcFnS.exe
  2⤵
  PID:15716
- C:\Windows\System\JuhbKrQ.exe
  C:\Windows\System\JuhbKrQ.exe
  2⤵
  PID:15740
- - C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -u -p 15740 -s 252
    3⤵
    PID:9528
- C:\Windows\System\xQnfmaz.exe
  C:\Windows\System\xQnfmaz.exe
  2⤵
  PID:15760
- C:\Windows\System\cFpdeBB.exe
  C:\Windows\System\cFpdeBB.exe
  2⤵
  PID:15788
- C:\Windows\System\uyPYaIa.exe
  C:\Windows\System\uyPYaIa.exe
  2⤵
  PID:15808
- C:\Windows\System\rTIVrim.exe
  C:\Windows\System\rTIVrim.exe
  2⤵
  PID:15836
- C:\Windows\System\jYdIqBF.exe
  C:\Windows\System\jYdIqBF.exe
  2⤵
  PID:15860
- C:\Windows\System\WqiEPQN.exe
  C:\Windows\System\WqiEPQN.exe
  2⤵
  PID:15884
- C:\Windows\System\IZGKdCP.exe
  C:\Windows\System\IZGKdCP.exe
  2⤵
  PID:15900
- - C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -u -p 15900 -s 248
    3⤵
    PID:16884
- C:\Windows\System\agAAEkM.exe
  C:\Windows\System\agAAEkM.exe
  2⤵
  PID:15920
- C:\Windows\System\xEXcXnJ.exe
  C:\Windows\System\xEXcXnJ.exe
  2⤵
  PID:15936
- C:\Windows\System\ihGgxzW.exe
  C:\Windows\System\ihGgxzW.exe
  2⤵
  PID:15952
- C:\Windows\System\VNorhjx.exe
  C:\Windows\System\VNorhjx.exe
  2⤵
  PID:15968
- C:\Windows\System\taJRufj.exe
  C:\Windows\System\taJRufj.exe
  2⤵
  PID:15988
- C:\Windows\System\IprYnmA.exe
  C:\Windows\System\IprYnmA.exe
  2⤵
  PID:16008
- C:\Windows\System\abOMQzZ.exe
  C:\Windows\System\abOMQzZ.exe
  2⤵
  PID:16036
- C:\Windows\System\GslVkin.exe
  C:\Windows\System\GslVkin.exe
  2⤵
  PID:16052
- C:\Windows\System\EBDDiIB.exe
  C:\Windows\System\EBDDiIB.exe
  2⤵
  PID:16072
- C:\Windows\System\hcYOTrx.exe
  C:\Windows\System\hcYOTrx.exe
  2⤵
  PID:16088
- C:\Windows\System\ZMzSGfD.exe
  C:\Windows\System\ZMzSGfD.exe
  2⤵
  PID:16104
- C:\Windows\System\GCHoSoU.exe
  C:\Windows\System\GCHoSoU.exe
  2⤵
  PID:16128
- C:\Windows\System\ePRktJd.exe
  C:\Windows\System\ePRktJd.exe
  2⤵
  PID:16144
- C:\Windows\System\QgAlMvL.exe
  C:\Windows\System\QgAlMvL.exe
  2⤵
  PID:16160
- C:\Windows\System\bsHzIlN.exe
  C:\Windows\System\bsHzIlN.exe
  2⤵
  PID:16180
- C:\Windows\System\WOJguhS.exe
  C:\Windows\System\WOJguhS.exe
  2⤵
  PID:16196
- C:\Windows\System\LxcFucs.exe
  C:\Windows\System\LxcFucs.exe
  2⤵
  PID:16228
- C:\Windows\System\xOtjnnu.exe
  C:\Windows\System\xOtjnnu.exe
  2⤵
  PID:16248
- C:\Windows\System\purnEle.exe
  C:\Windows\System\purnEle.exe
  2⤵
  PID:16264
- C:\Windows\System\rFNtScG.exe
  C:\Windows\System\rFNtScG.exe
  2⤵
  PID:16280
- C:\Windows\System\KsdPoBr.exe
  C:\Windows\System\KsdPoBr.exe
  2⤵
  PID:16300
- C:\Windows\System\diDCMGN.exe
  C:\Windows\System\diDCMGN.exe
  2⤵
  PID:16324
- C:\Windows\System\pUSlMtm.exe
  C:\Windows\System\pUSlMtm.exe
  2⤵
  PID:16344
- C:\Windows\System\QqHAlhP.exe
  C:\Windows\System\QqHAlhP.exe
  2⤵
  PID:16364
- C:\Windows\System\cWJhdcg.exe
  C:\Windows\System\cWJhdcg.exe
  2⤵
  PID:13396
- C:\Windows\System\iYoThBm.exe
  C:\Windows\System\iYoThBm.exe
  2⤵
  PID:14664
- C:\Windows\System\nuGtEnq.exe
  C:\Windows\System\nuGtEnq.exe
  2⤵
  PID:13320
- C:\Windows\System\vNnFmTT.exe
  C:\Windows\System\vNnFmTT.exe
  2⤵
  PID:13604
- C:\Windows\System\mIrsYDw.exe
  C:\Windows\System\mIrsYDw.exe
  2⤵
  PID:14716
- C:\Windows\System\unaxLjL.exe
  C:\Windows\System\unaxLjL.exe
  2⤵
  PID:14348
- C:\Windows\System\vugwelN.exe
  C:\Windows\System\vugwelN.exe
  2⤵
  PID:14412
- C:\Windows\System\DoUdEOe.exe
  C:\Windows\System\DoUdEOe.exe
  2⤵
  PID:13884
- C:\Windows\System\SnVpyXd.exe
  C:\Windows\System\SnVpyXd.exe
  2⤵
  PID:14016
- C:\Windows\System\DNVBjwX.exe
  C:\Windows\System\DNVBjwX.exe
  2⤵
  PID:14984
- C:\Windows\System\ZNTqCVG.exe
  C:\Windows\System\ZNTqCVG.exe
  2⤵
  PID:14544
- C:\Windows\System\gbGbFrL.exe
  C:\Windows\System\gbGbFrL.exe
  2⤵
  PID:15048
- C:\Windows\System\yrlmjjX.exe
  C:\Windows\System\yrlmjjX.exe
  2⤵
  PID:14808
- C:\Windows\System\cMZZyzm.exe
  C:\Windows\System\cMZZyzm.exe
  2⤵
  PID:14864
- C:\Windows\System\WFVzjsD.exe
  C:\Windows\System\WFVzjsD.exe
  2⤵
  PID:15488
- C:\Windows\System\zuxBTYi.exe
  C:\Windows\System\zuxBTYi.exe
  2⤵
  PID:15516
- C:\Windows\System\hcpGNXi.exe
  C:\Windows\System\hcpGNXi.exe
  2⤵
  PID:14736
- C:\Windows\System\oXxwKyI.exe
  C:\Windows\System\oXxwKyI.exe
  2⤵
  PID:15276
- C:\Windows\System\zQwUllG.exe
  C:\Windows\System\zQwUllG.exe
  2⤵
  PID:15300
- C:\Windows\System\ShEeobS.exe
  C:\Windows\System\ShEeobS.exe
  2⤵
  PID:16392
- C:\Windows\System\neeHAVn.exe
  C:\Windows\System\neeHAVn.exe
  2⤵
  PID:16408
- C:\Windows\System\mpfjvTu.exe
  C:\Windows\System\mpfjvTu.exe
  2⤵
  PID:16432
- C:\Windows\System\UZTDdvu.exe
  C:\Windows\System\UZTDdvu.exe
  2⤵
  PID:16452
- C:\Windows\System\kxjmtMr.exe
  C:\Windows\System\kxjmtMr.exe
  2⤵
  PID:16484
- C:\Windows\System\ZnblLnD.exe
  C:\Windows\System\ZnblLnD.exe
  2⤵
  PID:16500
- C:\Windows\System\NYnOWWP.exe
  C:\Windows\System\NYnOWWP.exe
  2⤵
  PID:16520
- - C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -u -p 16520 -s 248
    3⤵
    PID:16932
- C:\Windows\System\FyNQgyz.exe
  C:\Windows\System\FyNQgyz.exe
  2⤵
  PID:16540
- C:\Windows\System\pDseSUU.exe
  C:\Windows\System\pDseSUU.exe
  2⤵
  PID:16556
- C:\Windows\System\IDcIUeR.exe
  C:\Windows\System\IDcIUeR.exe
  2⤵
  PID:16584
- C:\Windows\System\wKxIfiL.exe
  C:\Windows\System\wKxIfiL.exe
  2⤵
  PID:16600
- C:\Windows\System\hlfmQtt.exe
  C:\Windows\System\hlfmQtt.exe
  2⤵
  PID:16616
- C:\Windows\System\hKKhdpx.exe
  C:\Windows\System\hKKhdpx.exe
  2⤵
  PID:16640
- C:\Windows\System\jecFOcN.exe
  C:\Windows\System\jecFOcN.exe
  2⤵
  PID:16660
- C:\Windows\System\ceFYbvV.exe
  C:\Windows\System\ceFYbvV.exe
  2⤵
  PID:16680
- C:\Windows\System\daCzIVB.exe
  C:\Windows\System\daCzIVB.exe
  2⤵
  PID:16712
- C:\Windows\System\dYkdbuc.exe
  C:\Windows\System\dYkdbuc.exe
  2⤵
  PID:16732
- C:\Windows\System\pRgGitS.exe
  C:\Windows\System\pRgGitS.exe
  2⤵
  PID:16760
- C:\Windows\System\xCLjkcO.exe
  C:\Windows\System\xCLjkcO.exe
  2⤵
  PID:16776
- C:\Windows\System\VFDnxWf.exe
  C:\Windows\System\VFDnxWf.exe
  2⤵
  PID:16792
- C:\Windows\System\ZzyexZK.exe
  C:\Windows\System\ZzyexZK.exe
  2⤵
  PID:16812
- C:\Windows\System\lcpuCtz.exe
  C:\Windows\System\lcpuCtz.exe
  2⤵
  PID:16832
- C:\Windows\System\JbOumAn.exe
  C:\Windows\System\JbOumAn.exe
  2⤵
  PID:16856
- C:\Windows\System\hRTDqbd.exe
  C:\Windows\System\hRTDqbd.exe
  2⤵
  PID:16872
- C:\Windows\System\GKrWqku.exe
  C:\Windows\System\GKrWqku.exe
  2⤵
  PID:16896
- C:\Windows\System\HCWZMxO.exe
  C:\Windows\System\HCWZMxO.exe
  2⤵
  PID:16920
- C:\Windows\System\dFaDCUN.exe
  C:\Windows\System\dFaDCUN.exe
  2⤵
  PID:16940
- C:\Windows\System\jbtmRFA.exe
  C:\Windows\System\jbtmRFA.exe
  2⤵
  PID:16956
- C:\Windows\System\EMhQhDg.exe
  C:\Windows\System\EMhQhDg.exe
  2⤵
  PID:16972
- C:\Windows\System\YwUlDjj.exe
  C:\Windows\System\YwUlDjj.exe
  2⤵
  PID:16988
- C:\Windows\System\LjRcFWp.exe
  C:\Windows\System\LjRcFWp.exe
  2⤵
  PID:17004
- C:\Windows\System\WRJbnUt.exe
  C:\Windows\System\WRJbnUt.exe
  2⤵
  PID:17020
- C:\Windows\System\zxGscXD.exe
  C:\Windows\System\zxGscXD.exe
  2⤵
  PID:17036
- C:\Windows\System\MOmPQTI.exe
  C:\Windows\System\MOmPQTI.exe
  2⤵
  PID:17064
- C:\Windows\System\IDMyilt.exe
  C:\Windows\System\IDMyilt.exe
  2⤵
  PID:17080
- C:\Windows\System\sLShPff.exe
  C:\Windows\System\sLShPff.exe
  2⤵
  PID:17100
- C:\Windows\System\jISXEAP.exe
  C:\Windows\System\jISXEAP.exe
  2⤵
  PID:17116
- C:\Windows\System\bBScHGj.exe
  C:\Windows\System\bBScHGj.exe
  2⤵
  PID:17132
- C:\Windows\System\HSnsmul.exe
  C:\Windows\System\HSnsmul.exe
  2⤵
  PID:17152
- C:\Windows\System\wzqpMJp.exe
  C:\Windows\System\wzqpMJp.exe
  2⤵
  PID:17176
- C:\Windows\System\EPQRauV.exe
  C:\Windows\System\EPQRauV.exe
  2⤵
  PID:17192
- C:\Windows\System\guSgwFl.exe
  C:\Windows\System\guSgwFl.exe
  2⤵
  PID:17220
- C:\Windows\System\vvQRGOn.exe
  C:\Windows\System\vvQRGOn.exe
  2⤵
  PID:17240
- C:\Windows\System\hfjHugK.exe
  C:\Windows\System\hfjHugK.exe
  2⤵
  PID:17260
- C:\Windows\System\zLvfiLo.exe
  C:\Windows\System\zLvfiLo.exe
  2⤵
  PID:17276
- C:\Windows\System\ZxvXhDd.exe
  C:\Windows\System\ZxvXhDd.exe
  2⤵
  PID:17292
- C:\Windows\System\qXnPTDG.exe
  C:\Windows\System\qXnPTDG.exe
  2⤵
  PID:17308
- C:\Windows\System\CxWDtiF.exe
  C:\Windows\System\CxWDtiF.exe
  2⤵
  PID:17324
- C:\Windows\System\cOmTHdJ.exe
  C:\Windows\System\cOmTHdJ.exe
  2⤵
  PID:17352
- C:\Windows\System\OVDbsSA.exe
  C:\Windows\System\OVDbsSA.exe
  2⤵
  PID:17368
- C:\Windows\System\LDzAgNP.exe
  C:\Windows\System\LDzAgNP.exe
  2⤵
  PID:17400
- C:\Windows\System\sbXPPZV.exe
  C:\Windows\System\sbXPPZV.exe
  2⤵
  PID:14836
- C:\Windows\System\GxYpzsY.exe
  C:\Windows\System\GxYpzsY.exe
  2⤵
  PID:15780

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:14708

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\EAFNUGQ.exe

Filesize
1.4MB

MD5
f8e816cedb37f46bec660637b635f017

SHA1
381aa87b33f7a5cc4f093975c442b37de0d145ff

SHA256
ee5dd8213cc59e5fefff19caa9dc3007c731a99594515532daafd4f2ea041328

SHA512
bea25d1c9bbd808d16b0b9ac5117317e6e949d01d094e76db84ae26829b609ae0e759450705ff228b89c89fdffbba3e08f593ac9d2e56b8d90f75f4eaf5ea711

Download Submit
C:\Windows\System\FYdmann.exe

Filesize
1.4MB

MD5
bffa2389bfec9e74722e648312edeca8

SHA1
f9b685205ecdfeb2abb19e0d0213f308d4b0e829

SHA256
d947740c75706bc6d97252f79c44d56fd80369ca38fc34b9e3a07cac5afe26cc

SHA512
0b3bbbc11088d0ced6ffe0a9fa1aa5bc99f56b573c2f030c8ca59db2f245b9303780e6f837a001a0076992aa5f84fd4ac2eceeed2bbb2359ed01cc2b2a76da8b

Download Submit
C:\Windows\System\FdOqeHL.exe

Filesize
1.4MB

MD5
b14af614c26a8259a14a662b557b83a4

SHA1
ad3f83d7dbc670a350486ef9cc3f10ad81cf50bc

SHA256
4c6829c1bd7395be6b62133ee700b585767e002c939ebc44e211ef93cfa5d0dc

SHA512
91eb7ff4b57c084e3dca0ed0c273fbef976b13ef629d734c80b1e229038516baf8fa54272d165caee7864174942cd0d6809c0bdce493967f06d8a9470c59a8a6

Download Submit
C:\Windows\System\GbqGdYP.exe

Filesize
1.4MB

MD5
a045d524233dd7683e7081699cf5d872

SHA1
4228976c259b4475834ec9b416e9f86c265e8073

SHA256
d9a86cd68a07b93954f4199e8de131fb9c7391aa9320c56644838c8c7a121699

SHA512
cfd49a598d21d236c30732171bd6eeb5c829152701d3311ec7f88158c2a014ab205156a619eba9e52fe609ddaaa5207546e76d279374182731f41bc9e86df3e5

Download Submit
C:\Windows\System\ISZRpRY.exe

Filesize
1.4MB

MD5
1e1c6d760b2dab3526c58ec63a2801ba

SHA1
5f56c951c3c7732e0e1e370ca6039e5f0b784c0b

SHA256
b0a6e4389e21afc1d9045459b5e99b0bba920e73bca65c72e0f5048a6dd1194d

SHA512
78c435d87417b157baa38ee8c869ef36201c0a7df66a9191b200f00e8bbf7356ab2b89da734694165a187da4b89b29eb490a88d59546272f969f5a588a291e56

Download Submit
C:\Windows\System\ISmYBTr.exe

Filesize
1.4MB

MD5
487e118ce70762eec889ae1f24d0d41c

SHA1
1e37147a93f75cebb4fe2e9e8ddd19ca287f32bb

SHA256
a82c00128b1c2962c7ac7613934c3a89ed6be003ff883a7dc3bff0364a331ae1

SHA512
98545318f88ef308c19d6465781230911fa28ca55ee6d3626889e0bcfed0717ddb16393a91c8bdd73230f3ce4b5b18406e030057fd49d938db9f0d44b7474328

Download Submit
C:\Windows\System\LVDJOHj.exe

Filesize
1.4MB

MD5
48c4131049a3bc8eb43c10f5ca7a23b5

SHA1
c7fa1a5099fc5ed932f13404e2edea725df57eec

SHA256
2ec014b98d02ea1c198e0887b79bf6561d26577779e6252713a3fde554bf3df8

SHA512
03ba2135bc8eb72739cd34ae4fd6249326ffe6b240ef2a93fb45841a27d728cf9dd62ef557ff868046ad48020dcbfb0c879b2d11a1504a90a2c216ec17b20ad9

Download Submit
C:\Windows\System\NcUStNj.exe

Filesize
1.4MB

MD5
e0859363ef6bb2d04be2d8106d6ba1dc

SHA1
a09b8a608e117abf5531ec54025627821d55b0fb

SHA256
961797cd3757d5160d8bd1ea4ffacf637a9e01977768ff81f71f5e8613744dd9

SHA512
b2500862ea787762139bd5f8138ac0abd4b49d36cc9af6f3995dfdc611914e7bfad664cfef84fab6cdd192ea2d43f32d18e9497d3141691d71229021f398eac2

Download Submit
C:\Windows\System\PwgwqBL.exe

Filesize
1.4MB

MD5
25f95f3cbd9a25c3f1872259e9eb12b0

SHA1
2f9e5501dff8fa254a887e68a08c1114fccc887c

SHA256
a3a0c4159161e7623049a677e509adb47a92453c8787d74236e8a54f1c1c7c25

SHA512
5b23bf6afb4473aed449760d5d08287e4a21a68120ffb27538312414e3ed097a72a6d8025cc51836cccb79ea71b80b1b087e687c38b35492d05ea5a4593823f6

Download Submit
C:\Windows\System\RxbChZQ.exe

Filesize
1.4MB

MD5
fa30666b7f6ff6b61a292fefdc9f9d87

SHA1
95f2f4d4cd1b19be4dbe1dfd8ac4a70ce427e8e5

SHA256
f879f1a2779245205e019ab50bae89ffe27e8456d2ea737dec268dff63d92113

SHA512
6237a8fffc8d79f754349455e3819227b607a09f344bbeb33f4897419075764d9cb35e5067a2ce09eb31b2e5bcdbddf61d54685f819ebcd55a1487dec0f028d9

Download Submit
C:\Windows\System\SREYBJt.exe

Filesize
1.4MB

MD5
7e18efd237193215c98412fa9b140f3b

SHA1
eeb67b251f38f2e772e497e0bf28954fbbcf2b52

SHA256
44ca22dfe6a416c931b3a40c2a6a94f63505daf2ed12fa7bbb97c63d955aefa6

SHA512
cd15519d033ea69f13778f1d579266f8a73205856605c232928798c0081473a0712094668e2589bbc9ccfc033ce1c65ebd50b0c249c47ca6e1af4253d11f287e

Download Submit
C:\Windows\System\SeouPJv.exe

Filesize
1.4MB

MD5
a6b10285434e26827afd1ed820f8656d

SHA1
2c2a8824fcc2508a97686d8011368f718c1ed8d3

SHA256
03cf928a12bbd541803dcc9f4c235c6a8652b94ebc1ba2fa7645171604693ea3

SHA512
0c3cdeec9204859e69a5077b11539d2233687c802d9007bafc84442996c160513792056f94ef1d7dc9f1365f8e4a243d8a056a619ec1936d993dedf8fcdb36cd

Download Submit
C:\Windows\System\TqfMOBG.exe

Filesize
1.4MB

MD5
2b9a771d368e4e812fc0d90e582068d6

SHA1
c5833fcc9d8a009c90cf24a097a1807b2caa7099

SHA256
df87e1f816fec771301b26a84ea6f86bfbc2442c83e2bd4a3a3a57f6760e1475

SHA512
0cd14c1b23442c6e52c19fc801e9a64c28b5b1a2992838ec529ca3745437177d73cecd42659db57cd6065849f9533e7f41d4c9dba1fa69a00ff5e29106dbb514

Download Submit
C:\Windows\System\UltxMen.exe

Filesize
1.4MB

MD5
83dc862d24ae037ae7b762e09f90ca70

SHA1
a6ba7e884f26f0fae72ce60c437afd4c8db9c32c

SHA256
915f189161847a8be94036ee3c3e01325d63331e99b624ae55b80fac0e172253

SHA512
9e269ab60f3d4600cc055fc22bcdb60bfd5eeae2c8e97509ee5a11fb31f5045e6788f2ec95638aff0a09e6c6f422f3f8c086dcbb82e3a28fd418c5e3550a17d8

Download Submit
C:\Windows\System\UolwzYD.exe

Filesize
1.4MB

MD5
26976e1b27bdec330648874e25313df6

SHA1
be16ce537adf6b72b3399683f9b436d957303e4c

SHA256
5a02b5dc2769de3a67b79bdd681b5d1692641f65c202ef6916d53b403dfe7421

SHA512
953bb90e3a0f6622584913861d635016c8e0805c9644bd4e70a7930564e2acc92cdb3584ad48e6b0c19761c283bd9a12dd504968cedd602e993a324939766b36

Download Submit
C:\Windows\System\YWnSnKG.exe

Filesize
1.4MB

MD5
4717df67234914e947267c6ff33a162e

SHA1
07550a09d8bbffb215879f89b42aa3f090f61922

SHA256
6a793bfdb0fa17eaace55cbf48218cf39b0942d03fa1b168b1d59eef15af3348

SHA512
bad04a21d65c61cfcb3aa030f290a156109bcea001fbc8fb7680d64a28a5f424b5f655343367f31b1b021606e1c626192d825f1edf3fefac3611746a595ee1ea

Download Submit
C:\Windows\System\ZKEyCgX.exe

Filesize
1.4MB

MD5
53facef5116bd182ea9bf531d311b2d0

SHA1
025597c053d73a65f9bd795ef9c2de2ba7975b99

SHA256
802a2bf11fc72737aec419254439f954f3786ffabc6d12518532983d875654fe

SHA512
225a26715c66b43d8709c9a69d2c5c846c0a607a5bd0284c00998f110b519c6c208df339cfe5fdccc72d691195d61e7dc4c0d59d5ea566b86056d6f49ac0a6c2

Download Submit
C:\Windows\System\ZPqfZZq.exe

Filesize
1.4MB

MD5
9e916bbf34b7e01ffc337cf9015453e8

SHA1
21ffdd4f72eeed041dfd48759cc79386aac15943

SHA256
78430cda1e2e63c5248c70a5548194e0cba7b06c977913bf51fd4b1cf715a6e7

SHA512
229926e1c5a3497020f5f1a6847df0ae859f3e9bf554189b193182e89c0dd733957d875ae6b4181e0f4a44f068d7287f9dee9976e41548c23ef6aeef1cfc8ad1

Download Submit
C:\Windows\System\bxnGPFM.exe

Filesize
1.4MB

MD5
f7009f198b511351964c0d22364ee8a6

SHA1
9cdcd8830143868ccd2007cfd6d43111818dd578

SHA256
66f3a49697393a6f743a259eb209a37413832ba078a47e0422df32449306dcab

SHA512
573d44c882d7f8700e348225433739aee81bf7485090cfca3f454c1de4d8459a18e54b591888409e11d7f86d4a97cb32b571f907a98832aea833b9f3116a589b

Download Submit
C:\Windows\System\deJGUBd.exe

Filesize
1.4MB

MD5
2bf5c2ae9b6a3b331238f454c95a7911

SHA1
a7b24425e89899a492f413acd0749ccbae45f89b

SHA256
ee94b28eb55f2cbc0e6c6070ed63391a0471dd89c5ab133a1d63c67da301505b

SHA512
d286ce7008d317ca7a55ee6600beec0365ece53cf760d4b77683d15103553e5cc40e54dac65a0ea8bdbedb1c7d233d986777be9e69c8a860362f170a4f50701f

Download Submit
C:\Windows\System\eVpPDkb.exe

Filesize
1.4MB

MD5
87d094d082ce995d30f6a520b24360c7

SHA1
aece3395c180de9ab1156e4d9234869e370aed25

SHA256
51e39bdd3a47067eeb4b345a4d73a3d2535be26defba9007451bbd368766871c

SHA512
2fe83815709c6976b4c24020307525590b0f828eb651210af28cc3f006e7cef6983f047205e4b79b757e1f2d102a57a8e05167b68330ac6d0e6feedb8fbb787a

Download Submit
C:\Windows\System\enFRdKz.exe

Filesize
1.4MB

MD5
2e4143dc67fd108a2b43f4d8771f7e08

SHA1
dd25f629e2b865912213d64c7b522b468e1167d8

SHA256
f87caddea033a56e772ed5b8f4ab68b93cdfd21c1442cd8e43783a297ff675a1

SHA512
3be3e9747aff0adc25062ef34dd4cd4d6e7569515eb70a1c677a3285be1a00c0e0b32d68fca141cc0d72427726e1c9996cebbf8972da6e97c04e4ed8a7f3a126

Download Submit
C:\Windows\System\enNWBvu.exe

Filesize
1.4MB

MD5
1bcda8ef8d142f3862319fa55f207b32

SHA1
b9097206fe87716b561c9d8d5b8cef993c041305

SHA256
58ab5b5261a560e902969e2ee1ea79ea2ae204d22a7b48d541d8a065f2789551

SHA512
a022fff1ad22a86986bac6416a92c3b98a35b14178f66319ec6b610308b794fceaf4f7d82f3b3facd28312de9d5929a6155a6fe4f9f23513e93d40f228aa2cbb

Download Submit
C:\Windows\System\fSfECAM.exe

Filesize
1.4MB

MD5
5cc822f66ba422a837d427487c33bd1d

SHA1
6f704d0a3db127f2c5f29628904dd6e7e64865ef

SHA256
3e9c8e530c62cf0e9a84d9f720ce9a92a7a793d7717d99a4d6bb0d0cb255e6a7

SHA512
ec82046a4366c5fa878b048c844972302ee205a683a31306dc3110e9c9d82a53f4cebc2c591ffceaf0ed4e83a880284bcc81bb5eda4c313a575636cd1a47e85e

Download Submit
C:\Windows\System\iezSnzS.exe

Filesize
1.4MB

MD5
90c8a0e80d3dd6629ae6e4dbd486dfb3

SHA1
bd559937137576b20306d6b45010b5b0f95bc5b8

SHA256
db6ab94a77e7891b28d63f7c65be5e6597d06ca93389d2edd7d789c9580b50f3

SHA512
9fface873a347f3e9b0a033b0ba90b88a7d3abbc9fe558212a1d2acf8524d64704d036fa9d1e45491e64f58a855a81af40ea11ca52e043a84d2a0ce8e0da49e9

Download Submit
C:\Windows\System\jefXOEV.exe

Filesize
1.4MB

MD5
b4c9c303f07cc04e9caedd93d364e9ce

SHA1
46274250292065aea7bf40e90913319a2a41e8e8

SHA256
4845ee9327a8be429190fd17aaf445de9aa31be7f7701041b0eccda509436edf

SHA512
b60176322af8b7d2f75f2e1da423eb7769697be771e44d0287bbf782534997ad6a2b4ef4c766414a6d0a83a5b1453b2d8f4bf81e5ad1d9594943744c0f519237

Download Submit
C:\Windows\System\kzWQsGM.exe

Filesize
1.4MB

MD5
5bae0394894f317cd360ebb4c252c8df

SHA1
381671b84df6671b065c5a30cf2b6d66513b607d

SHA256
b47c06b280b0d242c49fdf806965bcede44f501f526383696c8c6e3f6ee7bd98

SHA512
43f1bd880d4a178742f39ba6631dbe36dbc9103db99d3cd59ac621d1a7d5cbb1bc866abf471aced89e5adc21fab87c63fd3a71d25203ddd6145a9e94e4417209

Download Submit
C:\Windows\System\lLmYcOs.exe

Filesize
1.4MB

MD5
c9103a31e7f85597fa00a38856a46256

SHA1
a94263f1a28b5a88c99d25b4870ea093daf39e75

SHA256
df872a5df430f78767d3dbcaa86979925c427344bf69f1b348b804ce5dd8dd5e

SHA512
635fa68838f909a952ede1f09f4c28181c66bb1dd6d43529ce45f0f8d8a06ccd4fc45cde6c93c2a3c6490829a424f3bb0d3370e26b40e4d273df6c2395db5f5b

Download Submit
C:\Windows\System\ocORAzd.exe

Filesize
1.4MB

MD5
30a1ff0be6ce2535d50f8ba010f39c27

SHA1
0132ffd13049a70d1ac8249de6c65513b2b30f7c

SHA256
4affa0425aa8d5544df7c8e2be5eacbe18d46ce2c8b2fac95bc0e8a32eb76b2d

SHA512
7f6eb83c528e34525c5965e9a255e8a25cb3ce3844cc9620c27f67ddd1ca9bc1fbc43838fb96fbd704b6bde5f1a7c6dcbed54f78bbcf32e7681f67bc59bb1462

Download Submit
C:\Windows\System\omijetl.exe

Filesize
1.4MB

MD5
5d9400e75eea1fb24f2ef635f363a9a0

SHA1
707f9bcdbd1ef38925578833f008f2c17c85f0ca

SHA256
429a4ed0ba6492c1a1399002de68fcbf4b759c530f64cf34f489eb6e0f030f20

SHA512
94c160cb43bdba5f9616b7fb5d7aae9febc341c9191a6366d9ef6ea6157e906b05bbe351d5734a7cfac31f063892bcca4ba4e63253e34c8ce155e2fe59cede6f

Download Submit
C:\Windows\System\pQWQcon.exe

Filesize
1.4MB

MD5
92a1c72a76d4688dfd7992b4dd8668e9

SHA1
4fa8037a584aee6e1099590a09bab632948287e1

SHA256
38e811bc09ead65c872b89e8a9b885d6dfdd8a70603002bc194774423a769c9b

SHA512
f5673cbf377f62693af80ac2846c915052feb065bdcd0ad621ecf2de8e40090c2ce26e9bbdfdf7d6a1abc9258baa88a0342e5589369c4641de76528742390e1c

Download Submit
C:\Windows\System\uyimOzt.exe

Filesize
1.4MB

MD5
957de63b757bcd51cf8728dfce326440

SHA1
fc61643fc77994e292e5cd9310771cb0540436d0

SHA256
8f13f3afde088ab0d80cc5becc7b189c3649152bf4b65a65e8cabda7d3cd1128

SHA512
1a38fe60fd3d18d2685f626caeaa410818339fb52825dce92cbd242341be08caff3d7620327e042964a62ef3de0ade2e3d21a0b0781faeab899a5a7dc52b3272

Download Submit
C:\Windows\System\vRkChZM.exe

Filesize
1.4MB

MD5
3893b949c57d636a369beb52d273bfb0

SHA1
d9f6d09e58715f9ad404aa29223e40105c2c012d

SHA256
29e71c19564d5d00cd1efd9deb2d143dafc0c4de6f91b1bb767785a05e50d679

SHA512
87d347277cc8692964266295723a405658149c17e47e95598cd0dbdee951f2d344db6b75994ff3ea85d7f3c9470a8c1b82ecd57ca08295008c73e8bd8a89d969

Download Submit
C:\Windows\System\xTHwLph.exe

Filesize
1.4MB

MD5
1ea96a44545d013d60f6ede395cc96b1

SHA1
4733031f7b468dde2280ad417424c80598fffd31

SHA256
0248bab830abe82c4a7d728ddbf83e62ee9fd7612cf0c6b233ea1fbf5ad7c055

SHA512
d6826a055dbf24e1f900d585ceef580f298c59d603f7d6e1142ac4e65210abb979a4f83a190b62ff9bf753a26b2f7a2f27225149e4d05fba609774f915ec5d3e

Download Submit
C:\Windows\System\xdvPavK.exe

Filesize
1.4MB

MD5
da003ccb731d45739b1ef6197344e709

SHA1
be1265f68f36695a086a419191486540f10ba668

SHA256
5d99810a9afc6a0a2ff31a160aedf6fd6e0a0ab239cfe2aba00b72b5096fb25e

SHA512
59dade1e0dbb46693808568a74a51c878fce2a2176158d43219d4a1ee905614c200de6942e1f06a56cc61569ce2bbec5ed73742e93164afc8522633f01b296d8

Download Submit
C:\Windows\System\yLlYExM.exe

Filesize
1.4MB

MD5
99b991770886dbfc59f72f2ee6591243

SHA1
2d72d737a9f9ce90a2617c13f473222568070ff4

SHA256
bd3cf3f6a9fc33ca785d4dd038df7bc83995b80f6863a22d7ed6fffd788eb6b3

SHA512
8230ce8a9ca10df3416bbc0d37ec4b9779dfaf06c8fe2545de3304a90dfb265ceb9f0ec055aa848c269ee722b235b551ef05c688dc0fc40028eb7d0e013a0f6c

Download Submit
C:\Windows\System\yMexJfa.exe

Filesize
1.4MB

MD5
a00219481285530cdad419b212dcd58f

SHA1
820aba1389ebb7a59bbbf96634551930a4281851

SHA256
e23cdd0211a21752eb50082c345edd3dc3909b24f0521dc45dbee032b5690224

SHA512
c6e89c40767b729d916fb5eede7eadb3ae40f74b82d247067a848bc1d74d07df86c9a6b8e7e04c5756136a267808aab416a3ab72568a9514213eddb9d6731754

Download Submit
memory/2476-0-0x00000118D1190000-0x00000118D11A0000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads