xmrig | 8d73afc8dfa5715a3aabc07da6deab69130395a224cb09761d6a79ad86bc5a16

Analysis

max time kernel
95s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
13/11/2024, 12:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
8d73afc8dfa5715a3aabc07da6deab69130395a224cb09761d6a79ad86bc5a16N.exe
Size 1.5MB
Sample241113-pvcngasbme
SHA256 8d73afc8dfa5715a3aabc07da6deab69130395a224cb09761d6a79ad86bc5a16
MD5 7b16af1620469bfed35e85e824939940
SHA1 12b62983ba7c26e9c5727db332092c84f671568d
SHA512 dba2bc256c4eded46ac2c4ca9986de05df599ce3e8b87c87a22e2fc89a874ab51fefb1a18c5cb0c219ac072e9c638e59a30b63823142f26a210b7ed2341b06c2
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbpwlKenszaDw4B/Os/IOyr7oKKPl:GezaTF8FcNkNdfE0pZ9ozttwIRakGN8A
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 32 IoCs

miner

resource	yara_rule
behavioral2/files/0x000a000000023bbd-4.dat	xmrig
behavioral2/files/0x0007000000023c91-7.dat	xmrig
behavioral2/files/0x0008000000023c8d-10.dat	xmrig
behavioral2/files/0x0007000000023c93-18.dat	xmrig
behavioral2/files/0x0007000000023c94-23.dat	xmrig
behavioral2/files/0x0007000000023c95-29.dat	xmrig
behavioral2/files/0x0007000000023c96-34.dat	xmrig
behavioral2/files/0x0007000000023c97-40.dat	xmrig
behavioral2/files/0x0007000000023c98-44.dat	xmrig
behavioral2/files/0x0007000000023c99-50.dat	xmrig
behavioral2/files/0x0007000000023c9b-60.dat	xmrig
behavioral2/files/0x0007000000023c9c-64.dat	xmrig
behavioral2/files/0x0007000000023c9d-72.dat	xmrig
behavioral2/files/0x0007000000023c9e-74.dat	xmrig
behavioral2/files/0x0007000000023c9f-80.dat	xmrig
behavioral2/files/0x0007000000023c9a-55.dat	xmrig
behavioral2/files/0x0007000000023ca0-83.dat	xmrig
behavioral2/files/0x0007000000023ca1-89.dat	xmrig
behavioral2/files/0x0007000000023ca2-96.dat	xmrig
behavioral2/files/0x0007000000023ca4-100.dat	xmrig
behavioral2/files/0x0007000000023ca6-112.dat	xmrig
behavioral2/files/0x0007000000023ca7-120.dat	xmrig
behavioral2/files/0x0007000000023ca5-118.dat	xmrig
behavioral2/files/0x0007000000023ca8-125.dat	xmrig
behavioral2/files/0x0007000000023ca3-107.dat	xmrig
behavioral2/files/0x0007000000023ca9-129.dat	xmrig
behavioral2/files/0x0006000000023080-133.dat	xmrig
behavioral2/files/0x00050000000230d8-139.dat	xmrig
behavioral2/files/0x0007000000023caa-145.dat	xmrig
behavioral2/files/0x0007000000023cab-149.dat	xmrig
behavioral2/files/0x000f000000023b50-154.dat	xmrig
behavioral2/files/0x000c000000023b4e-159.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
5008	efbSFLb.exe
4840	gMwCytS.exe
5116	iQFCIjj.exe
1636	DoobUGd.exe
3940	lPdkaKR.exe
1988	DCqRtXn.exe
4280	krFOyZZ.exe
4596	tYwhYIN.exe
1216	IHBGALY.exe
2444	tTKEKGF.exe
1420	tvaeSpd.exe
4780	jwNLdAK.exe
4852	qerfaRF.exe
3172	kIAlFGK.exe
4808	gZOjSOF.exe
4484	UNUUZEy.exe
3844	FRzCkOj.exe
1000	MEIKrQI.exe
4724	YOpCSTF.exe
4924	flpniaf.exe
1120	qsaWsgf.exe
1712	RYzGSUs.exe
4956	ZZAkcoW.exe
4536	YYOoHFu.exe
3952	JboKkId.exe
2300	CpVQjBk.exe
4568	OpDTkMC.exe
4912	RPyArHQ.exe
2544	NHECvWY.exe
2160	kLHaToz.exe
1392	tskVODz.exe
2112	tVwwEZe.exe
1808	NJmpHhe.exe
5060	QxsdlML.exe
3108	xokLgfn.exe
2472	vvUOAYH.exe
920	NUjOQFZ.exe
1056	mGHnVkc.exe
1144	sLxkqyY.exe
1124	lmDreRD.exe
4480	ByCczjC.exe
2644	cJrpIVO.exe
2432	xHFMWUk.exe
4864	HPfePSf.exe
2504	pVlgeNR.exe
3868	GkVtvUU.exe
4584	BESmrHW.exe
1840	qUAzItl.exe
1924	sLDHpRG.exe
4180	mpiLXtu.exe
3912	SwmkgPG.exe
3632	URvlBtK.exe
540	SyTUgVG.exe
2264	XLpVRCO.exe
1984	klXQYvk.exe
4056	KMvahVl.exe
348	rkWsWTZ.exe
4544	MeDEyEf.exe
764	dhgYSMf.exe
1664	JgZPzIr.exe
1804	esjELct.exe
4120	lTLENAF.exe
1488	KOAumFp.exe
1136	TVmghUr.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\wVnaOob.exe	8d73afc8dfa5715a3aabc07da6deab69130395a224cb09761d6a79ad86bc5a16N.exe
File created	C:\Windows\System\gcGQeCx.exe	8d73afc8dfa5715a3aabc07da6deab69130395a224cb09761d6a79ad86bc5a16N.exe
File created	C:\Windows\System\BORpddr.exe	8d73afc8dfa5715a3aabc07da6deab69130395a224cb09761d6a79ad86bc5a16N.exe
File created	C:\Windows\System\HRAtGRK.exe	8d73afc8dfa5715a3aabc07da6deab69130395a224cb09761d6a79ad86bc5a16N.exe
File created	C:\Windows\System\IOMcaSC.exe	8d73afc8dfa5715a3aabc07da6deab69130395a224cb09761d6a79ad86bc5a16N.exe
File created	C:\Windows\System\WvtDRWx.exe	8d73afc8dfa5715a3aabc07da6deab69130395a224cb09761d6a79ad86bc5a16N.exe
File created	C:\Windows\System\BGwxgDt.exe	8d73afc8dfa5715a3aabc07da6deab69130395a224cb09761d6a79ad86bc5a16N.exe
File created	C:\Windows\System\xQjRxxe.exe	8d73afc8dfa5715a3aabc07da6deab69130395a224cb09761d6a79ad86bc5a16N.exe
File created	C:\Windows\System\HjxUpYm.exe	8d73afc8dfa5715a3aabc07da6deab69130395a224cb09761d6a79ad86bc5a16N.exe
File created	C:\Windows\System\skzDeJy.exe	8d73afc8dfa5715a3aabc07da6deab69130395a224cb09761d6a79ad86bc5a16N.exe
File created	C:\Windows\System\TWqxpms.exe	8d73afc8dfa5715a3aabc07da6deab69130395a224cb09761d6a79ad86bc5a16N.exe
File created	C:\Windows\System\tAQVOkg.exe	8d73afc8dfa5715a3aabc07da6deab69130395a224cb09761d6a79ad86bc5a16N.exe
File created	C:\Windows\System\pHPdLEr.exe	8d73afc8dfa5715a3aabc07da6deab69130395a224cb09761d6a79ad86bc5a16N.exe
File created	C:\Windows\System\HCucxnX.exe	8d73afc8dfa5715a3aabc07da6deab69130395a224cb09761d6a79ad86bc5a16N.exe
File created	C:\Windows\System\gMwCytS.exe	8d73afc8dfa5715a3aabc07da6deab69130395a224cb09761d6a79ad86bc5a16N.exe
File created	C:\Windows\System\eQFslgC.exe	8d73afc8dfa5715a3aabc07da6deab69130395a224cb09761d6a79ad86bc5a16N.exe
File created	C:\Windows\System\tRtgOPP.exe	8d73afc8dfa5715a3aabc07da6deab69130395a224cb09761d6a79ad86bc5a16N.exe
File created	C:\Windows\System\fptrfKA.exe	8d73afc8dfa5715a3aabc07da6deab69130395a224cb09761d6a79ad86bc5a16N.exe
File created	C:\Windows\System\sMAerJC.exe	8d73afc8dfa5715a3aabc07da6deab69130395a224cb09761d6a79ad86bc5a16N.exe
File created	C:\Windows\System\CkZQiGs.exe	8d73afc8dfa5715a3aabc07da6deab69130395a224cb09761d6a79ad86bc5a16N.exe
File created	C:\Windows\System\RpJvlfY.exe	8d73afc8dfa5715a3aabc07da6deab69130395a224cb09761d6a79ad86bc5a16N.exe
File created	C:\Windows\System\LfRAiXe.exe	8d73afc8dfa5715a3aabc07da6deab69130395a224cb09761d6a79ad86bc5a16N.exe
File created	C:\Windows\System\cUZVCNi.exe	8d73afc8dfa5715a3aabc07da6deab69130395a224cb09761d6a79ad86bc5a16N.exe
File created	C:\Windows\System\oSImNuS.exe	8d73afc8dfa5715a3aabc07da6deab69130395a224cb09761d6a79ad86bc5a16N.exe
File created	C:\Windows\System\lQtmXos.exe	8d73afc8dfa5715a3aabc07da6deab69130395a224cb09761d6a79ad86bc5a16N.exe
File created	C:\Windows\System\ViGhCfW.exe	8d73afc8dfa5715a3aabc07da6deab69130395a224cb09761d6a79ad86bc5a16N.exe
File created	C:\Windows\System\hHbluqg.exe	8d73afc8dfa5715a3aabc07da6deab69130395a224cb09761d6a79ad86bc5a16N.exe
File created	C:\Windows\System\UoVpubu.exe	8d73afc8dfa5715a3aabc07da6deab69130395a224cb09761d6a79ad86bc5a16N.exe
File created	C:\Windows\System\dqAFikg.exe	8d73afc8dfa5715a3aabc07da6deab69130395a224cb09761d6a79ad86bc5a16N.exe
File created	C:\Windows\System\GrdiUbt.exe	8d73afc8dfa5715a3aabc07da6deab69130395a224cb09761d6a79ad86bc5a16N.exe
File created	C:\Windows\System\yTaXyRY.exe	8d73afc8dfa5715a3aabc07da6deab69130395a224cb09761d6a79ad86bc5a16N.exe
File created	C:\Windows\System\MXehZjO.exe	8d73afc8dfa5715a3aabc07da6deab69130395a224cb09761d6a79ad86bc5a16N.exe
File created	C:\Windows\System\CKMkYcD.exe	8d73afc8dfa5715a3aabc07da6deab69130395a224cb09761d6a79ad86bc5a16N.exe
File created	C:\Windows\System\enDnics.exe	8d73afc8dfa5715a3aabc07da6deab69130395a224cb09761d6a79ad86bc5a16N.exe
File created	C:\Windows\System\ByCczjC.exe	8d73afc8dfa5715a3aabc07da6deab69130395a224cb09761d6a79ad86bc5a16N.exe
File created	C:\Windows\System\wHZWEFH.exe	8d73afc8dfa5715a3aabc07da6deab69130395a224cb09761d6a79ad86bc5a16N.exe
File created	C:\Windows\System\ixNbvNq.exe	8d73afc8dfa5715a3aabc07da6deab69130395a224cb09761d6a79ad86bc5a16N.exe
File created	C:\Windows\System\fFbSHnP.exe	8d73afc8dfa5715a3aabc07da6deab69130395a224cb09761d6a79ad86bc5a16N.exe
File created	C:\Windows\System\SHwiren.exe	8d73afc8dfa5715a3aabc07da6deab69130395a224cb09761d6a79ad86bc5a16N.exe
File created	C:\Windows\System\qPVhCdt.exe	8d73afc8dfa5715a3aabc07da6deab69130395a224cb09761d6a79ad86bc5a16N.exe
File created	C:\Windows\System\RCveHcU.exe	8d73afc8dfa5715a3aabc07da6deab69130395a224cb09761d6a79ad86bc5a16N.exe
File created	C:\Windows\System\JtAQEKu.exe	8d73afc8dfa5715a3aabc07da6deab69130395a224cb09761d6a79ad86bc5a16N.exe
File created	C:\Windows\System\GwAuRKL.exe	8d73afc8dfa5715a3aabc07da6deab69130395a224cb09761d6a79ad86bc5a16N.exe
File created	C:\Windows\System\rkWsWTZ.exe	8d73afc8dfa5715a3aabc07da6deab69130395a224cb09761d6a79ad86bc5a16N.exe
File created	C:\Windows\System\qERIhLx.exe	8d73afc8dfa5715a3aabc07da6deab69130395a224cb09761d6a79ad86bc5a16N.exe
File created	C:\Windows\System\INWikBb.exe	8d73afc8dfa5715a3aabc07da6deab69130395a224cb09761d6a79ad86bc5a16N.exe
File created	C:\Windows\System\qerfaRF.exe	8d73afc8dfa5715a3aabc07da6deab69130395a224cb09761d6a79ad86bc5a16N.exe
File created	C:\Windows\System\cpJcYHu.exe	8d73afc8dfa5715a3aabc07da6deab69130395a224cb09761d6a79ad86bc5a16N.exe
File created	C:\Windows\System\heyUZKA.exe	8d73afc8dfa5715a3aabc07da6deab69130395a224cb09761d6a79ad86bc5a16N.exe
File created	C:\Windows\System\MNpdnQT.exe	8d73afc8dfa5715a3aabc07da6deab69130395a224cb09761d6a79ad86bc5a16N.exe
File created	C:\Windows\System\pdGzHOD.exe	8d73afc8dfa5715a3aabc07da6deab69130395a224cb09761d6a79ad86bc5a16N.exe
File created	C:\Windows\System\IUSlMFq.exe	8d73afc8dfa5715a3aabc07da6deab69130395a224cb09761d6a79ad86bc5a16N.exe
File created	C:\Windows\System\FDjzVsE.exe	8d73afc8dfa5715a3aabc07da6deab69130395a224cb09761d6a79ad86bc5a16N.exe
File created	C:\Windows\System\AWGMjJB.exe	8d73afc8dfa5715a3aabc07da6deab69130395a224cb09761d6a79ad86bc5a16N.exe
File created	C:\Windows\System\FRzCkOj.exe	8d73afc8dfa5715a3aabc07da6deab69130395a224cb09761d6a79ad86bc5a16N.exe
File created	C:\Windows\System\iOvBGTX.exe	8d73afc8dfa5715a3aabc07da6deab69130395a224cb09761d6a79ad86bc5a16N.exe
File created	C:\Windows\System\YkJPNLv.exe	8d73afc8dfa5715a3aabc07da6deab69130395a224cb09761d6a79ad86bc5a16N.exe
File created	C:\Windows\System\abCQDtt.exe	8d73afc8dfa5715a3aabc07da6deab69130395a224cb09761d6a79ad86bc5a16N.exe
File created	C:\Windows\System\qwSusGf.exe	8d73afc8dfa5715a3aabc07da6deab69130395a224cb09761d6a79ad86bc5a16N.exe
File created	C:\Windows\System\WpAVnZm.exe	8d73afc8dfa5715a3aabc07da6deab69130395a224cb09761d6a79ad86bc5a16N.exe
File created	C:\Windows\System\Awapkfo.exe	8d73afc8dfa5715a3aabc07da6deab69130395a224cb09761d6a79ad86bc5a16N.exe
File created	C:\Windows\System\EcDftpH.exe	8d73afc8dfa5715a3aabc07da6deab69130395a224cb09761d6a79ad86bc5a16N.exe
File created	C:\Windows\System\YWhOjWx.exe	8d73afc8dfa5715a3aabc07da6deab69130395a224cb09761d6a79ad86bc5a16N.exe
File created	C:\Windows\System\vuhRnGP.exe	8d73afc8dfa5715a3aabc07da6deab69130395a224cb09761d6a79ad86bc5a16N.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\Local Settings\MuiCache	StartMenuExperienceHost.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	6720	dwm.exe
Token: SeChangeNotifyPrivilege	6720	dwm.exe
Token: 33	6720	dwm.exe
Token: SeIncBasePriorityPrivilege	6720	dwm.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
17212	StartMenuExperienceHost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1256 wrote to memory of 5008	1256	8d73afc8dfa5715a3aabc07da6deab69130395a224cb09761d6a79ad86bc5a16N.exe	84
PID 1256 wrote to memory of 5008	1256	8d73afc8dfa5715a3aabc07da6deab69130395a224cb09761d6a79ad86bc5a16N.exe	84
PID 1256 wrote to memory of 4840	1256	8d73afc8dfa5715a3aabc07da6deab69130395a224cb09761d6a79ad86bc5a16N.exe	85
PID 1256 wrote to memory of 4840	1256	8d73afc8dfa5715a3aabc07da6deab69130395a224cb09761d6a79ad86bc5a16N.exe	85
PID 1256 wrote to memory of 5116	1256	8d73afc8dfa5715a3aabc07da6deab69130395a224cb09761d6a79ad86bc5a16N.exe	86
PID 1256 wrote to memory of 5116	1256	8d73afc8dfa5715a3aabc07da6deab69130395a224cb09761d6a79ad86bc5a16N.exe	86
PID 1256 wrote to memory of 1636	1256	8d73afc8dfa5715a3aabc07da6deab69130395a224cb09761d6a79ad86bc5a16N.exe	87
PID 1256 wrote to memory of 1636	1256	8d73afc8dfa5715a3aabc07da6deab69130395a224cb09761d6a79ad86bc5a16N.exe	87
PID 1256 wrote to memory of 3940	1256	8d73afc8dfa5715a3aabc07da6deab69130395a224cb09761d6a79ad86bc5a16N.exe	88
PID 1256 wrote to memory of 3940	1256	8d73afc8dfa5715a3aabc07da6deab69130395a224cb09761d6a79ad86bc5a16N.exe	88
PID 1256 wrote to memory of 1988	1256	8d73afc8dfa5715a3aabc07da6deab69130395a224cb09761d6a79ad86bc5a16N.exe	90
PID 1256 wrote to memory of 1988	1256	8d73afc8dfa5715a3aabc07da6deab69130395a224cb09761d6a79ad86bc5a16N.exe	90
PID 1256 wrote to memory of 4280	1256	8d73afc8dfa5715a3aabc07da6deab69130395a224cb09761d6a79ad86bc5a16N.exe	92
PID 1256 wrote to memory of 4280	1256	8d73afc8dfa5715a3aabc07da6deab69130395a224cb09761d6a79ad86bc5a16N.exe	92
PID 1256 wrote to memory of 4596	1256	8d73afc8dfa5715a3aabc07da6deab69130395a224cb09761d6a79ad86bc5a16N.exe	93
PID 1256 wrote to memory of 4596	1256	8d73afc8dfa5715a3aabc07da6deab69130395a224cb09761d6a79ad86bc5a16N.exe	93
PID 1256 wrote to memory of 1216	1256	8d73afc8dfa5715a3aabc07da6deab69130395a224cb09761d6a79ad86bc5a16N.exe	94
PID 1256 wrote to memory of 1216	1256	8d73afc8dfa5715a3aabc07da6deab69130395a224cb09761d6a79ad86bc5a16N.exe	94
PID 1256 wrote to memory of 2444	1256	8d73afc8dfa5715a3aabc07da6deab69130395a224cb09761d6a79ad86bc5a16N.exe	95
PID 1256 wrote to memory of 2444	1256	8d73afc8dfa5715a3aabc07da6deab69130395a224cb09761d6a79ad86bc5a16N.exe	95
PID 1256 wrote to memory of 1420	1256	8d73afc8dfa5715a3aabc07da6deab69130395a224cb09761d6a79ad86bc5a16N.exe	97
PID 1256 wrote to memory of 1420	1256	8d73afc8dfa5715a3aabc07da6deab69130395a224cb09761d6a79ad86bc5a16N.exe	97
PID 1256 wrote to memory of 4780	1256	8d73afc8dfa5715a3aabc07da6deab69130395a224cb09761d6a79ad86bc5a16N.exe	98
PID 1256 wrote to memory of 4780	1256	8d73afc8dfa5715a3aabc07da6deab69130395a224cb09761d6a79ad86bc5a16N.exe	98
PID 1256 wrote to memory of 4852	1256	8d73afc8dfa5715a3aabc07da6deab69130395a224cb09761d6a79ad86bc5a16N.exe	99
PID 1256 wrote to memory of 4852	1256	8d73afc8dfa5715a3aabc07da6deab69130395a224cb09761d6a79ad86bc5a16N.exe	99
PID 1256 wrote to memory of 3172	1256	8d73afc8dfa5715a3aabc07da6deab69130395a224cb09761d6a79ad86bc5a16N.exe	100
PID 1256 wrote to memory of 3172	1256	8d73afc8dfa5715a3aabc07da6deab69130395a224cb09761d6a79ad86bc5a16N.exe	100
PID 1256 wrote to memory of 4808	1256	8d73afc8dfa5715a3aabc07da6deab69130395a224cb09761d6a79ad86bc5a16N.exe	101
PID 1256 wrote to memory of 4808	1256	8d73afc8dfa5715a3aabc07da6deab69130395a224cb09761d6a79ad86bc5a16N.exe	101
PID 1256 wrote to memory of 4484	1256	8d73afc8dfa5715a3aabc07da6deab69130395a224cb09761d6a79ad86bc5a16N.exe	102
PID 1256 wrote to memory of 4484	1256	8d73afc8dfa5715a3aabc07da6deab69130395a224cb09761d6a79ad86bc5a16N.exe	102
PID 1256 wrote to memory of 3844	1256	8d73afc8dfa5715a3aabc07da6deab69130395a224cb09761d6a79ad86bc5a16N.exe	103
PID 1256 wrote to memory of 3844	1256	8d73afc8dfa5715a3aabc07da6deab69130395a224cb09761d6a79ad86bc5a16N.exe	103
PID 1256 wrote to memory of 1000	1256	8d73afc8dfa5715a3aabc07da6deab69130395a224cb09761d6a79ad86bc5a16N.exe	104
PID 1256 wrote to memory of 1000	1256	8d73afc8dfa5715a3aabc07da6deab69130395a224cb09761d6a79ad86bc5a16N.exe	104
PID 1256 wrote to memory of 4724	1256	8d73afc8dfa5715a3aabc07da6deab69130395a224cb09761d6a79ad86bc5a16N.exe	105
PID 1256 wrote to memory of 4724	1256	8d73afc8dfa5715a3aabc07da6deab69130395a224cb09761d6a79ad86bc5a16N.exe	105
PID 1256 wrote to memory of 4924	1256	8d73afc8dfa5715a3aabc07da6deab69130395a224cb09761d6a79ad86bc5a16N.exe	106
PID 1256 wrote to memory of 4924	1256	8d73afc8dfa5715a3aabc07da6deab69130395a224cb09761d6a79ad86bc5a16N.exe	106
PID 1256 wrote to memory of 1120	1256	8d73afc8dfa5715a3aabc07da6deab69130395a224cb09761d6a79ad86bc5a16N.exe	107
PID 1256 wrote to memory of 1120	1256	8d73afc8dfa5715a3aabc07da6deab69130395a224cb09761d6a79ad86bc5a16N.exe	107
PID 1256 wrote to memory of 1712	1256	8d73afc8dfa5715a3aabc07da6deab69130395a224cb09761d6a79ad86bc5a16N.exe	108
PID 1256 wrote to memory of 1712	1256	8d73afc8dfa5715a3aabc07da6deab69130395a224cb09761d6a79ad86bc5a16N.exe	108
PID 1256 wrote to memory of 4956	1256	8d73afc8dfa5715a3aabc07da6deab69130395a224cb09761d6a79ad86bc5a16N.exe	109
PID 1256 wrote to memory of 4956	1256	8d73afc8dfa5715a3aabc07da6deab69130395a224cb09761d6a79ad86bc5a16N.exe	109
PID 1256 wrote to memory of 4536	1256	8d73afc8dfa5715a3aabc07da6deab69130395a224cb09761d6a79ad86bc5a16N.exe	110
PID 1256 wrote to memory of 4536	1256	8d73afc8dfa5715a3aabc07da6deab69130395a224cb09761d6a79ad86bc5a16N.exe	110
PID 1256 wrote to memory of 3952	1256	8d73afc8dfa5715a3aabc07da6deab69130395a224cb09761d6a79ad86bc5a16N.exe	111
PID 1256 wrote to memory of 3952	1256	8d73afc8dfa5715a3aabc07da6deab69130395a224cb09761d6a79ad86bc5a16N.exe	111
PID 1256 wrote to memory of 2300	1256	8d73afc8dfa5715a3aabc07da6deab69130395a224cb09761d6a79ad86bc5a16N.exe	112
PID 1256 wrote to memory of 2300	1256	8d73afc8dfa5715a3aabc07da6deab69130395a224cb09761d6a79ad86bc5a16N.exe	112
PID 1256 wrote to memory of 4568	1256	8d73afc8dfa5715a3aabc07da6deab69130395a224cb09761d6a79ad86bc5a16N.exe	113
PID 1256 wrote to memory of 4568	1256	8d73afc8dfa5715a3aabc07da6deab69130395a224cb09761d6a79ad86bc5a16N.exe	113
PID 1256 wrote to memory of 4912	1256	8d73afc8dfa5715a3aabc07da6deab69130395a224cb09761d6a79ad86bc5a16N.exe	114
PID 1256 wrote to memory of 4912	1256	8d73afc8dfa5715a3aabc07da6deab69130395a224cb09761d6a79ad86bc5a16N.exe	114
PID 1256 wrote to memory of 2544	1256	8d73afc8dfa5715a3aabc07da6deab69130395a224cb09761d6a79ad86bc5a16N.exe	115
PID 1256 wrote to memory of 2544	1256	8d73afc8dfa5715a3aabc07da6deab69130395a224cb09761d6a79ad86bc5a16N.exe	115
PID 1256 wrote to memory of 2160	1256	8d73afc8dfa5715a3aabc07da6deab69130395a224cb09761d6a79ad86bc5a16N.exe	116
PID 1256 wrote to memory of 2160	1256	8d73afc8dfa5715a3aabc07da6deab69130395a224cb09761d6a79ad86bc5a16N.exe	116
PID 1256 wrote to memory of 1392	1256	8d73afc8dfa5715a3aabc07da6deab69130395a224cb09761d6a79ad86bc5a16N.exe	117
PID 1256 wrote to memory of 1392	1256	8d73afc8dfa5715a3aabc07da6deab69130395a224cb09761d6a79ad86bc5a16N.exe	117
PID 1256 wrote to memory of 2112	1256	8d73afc8dfa5715a3aabc07da6deab69130395a224cb09761d6a79ad86bc5a16N.exe	118
PID 1256 wrote to memory of 2112	1256	8d73afc8dfa5715a3aabc07da6deab69130395a224cb09761d6a79ad86bc5a16N.exe	118

C:\Users\Admin\AppData\Local\Temp\8d73afc8dfa5715a3aabc07da6deab69130395a224cb09761d6a79ad86bc5a16N.exe
"C:\Users\Admin\AppData\Local\Temp\8d73afc8dfa5715a3aabc07da6deab69130395a224cb09761d6a79ad86bc5a16N.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1256
- C:\Windows\System\efbSFLb.exe
  C:\Windows\System\efbSFLb.exe
  2⤵
  - Executes dropped EXE
  PID:5008
- C:\Windows\System\gMwCytS.exe
  C:\Windows\System\gMwCytS.exe
  2⤵
  - Executes dropped EXE
  PID:4840
- C:\Windows\System\iQFCIjj.exe
  C:\Windows\System\iQFCIjj.exe
  2⤵
  - Executes dropped EXE
  PID:5116
- C:\Windows\System\DoobUGd.exe
  C:\Windows\System\DoobUGd.exe
  2⤵
  - Executes dropped EXE
  PID:1636
- C:\Windows\System\lPdkaKR.exe
  C:\Windows\System\lPdkaKR.exe
  2⤵
  - Executes dropped EXE
  PID:3940
- C:\Windows\System\DCqRtXn.exe
  C:\Windows\System\DCqRtXn.exe
  2⤵
  - Executes dropped EXE
  PID:1988
- C:\Windows\System\krFOyZZ.exe
  C:\Windows\System\krFOyZZ.exe
  2⤵
  - Executes dropped EXE
  PID:4280
- C:\Windows\System\tYwhYIN.exe
  C:\Windows\System\tYwhYIN.exe
  2⤵
  - Executes dropped EXE
  PID:4596
- C:\Windows\System\IHBGALY.exe
  C:\Windows\System\IHBGALY.exe
  2⤵
  - Executes dropped EXE
  PID:1216
- C:\Windows\System\tTKEKGF.exe
  C:\Windows\System\tTKEKGF.exe
  2⤵
  - Executes dropped EXE
  PID:2444
- C:\Windows\System\tvaeSpd.exe
  C:\Windows\System\tvaeSpd.exe
  2⤵
  - Executes dropped EXE
  PID:1420
- C:\Windows\System\jwNLdAK.exe
  C:\Windows\System\jwNLdAK.exe
  2⤵
  - Executes dropped EXE
  PID:4780
- C:\Windows\System\qerfaRF.exe
  C:\Windows\System\qerfaRF.exe
  2⤵
  - Executes dropped EXE
  PID:4852
- C:\Windows\System\kIAlFGK.exe
  C:\Windows\System\kIAlFGK.exe
  2⤵
  - Executes dropped EXE
  PID:3172
- C:\Windows\System\gZOjSOF.exe
  C:\Windows\System\gZOjSOF.exe
  2⤵
  - Executes dropped EXE
  PID:4808
- C:\Windows\System\UNUUZEy.exe
  C:\Windows\System\UNUUZEy.exe
  2⤵
  - Executes dropped EXE
  PID:4484
- C:\Windows\System\FRzCkOj.exe
  C:\Windows\System\FRzCkOj.exe
  2⤵
  - Executes dropped EXE
  PID:3844
- C:\Windows\System\MEIKrQI.exe
  C:\Windows\System\MEIKrQI.exe
  2⤵
  - Executes dropped EXE
  PID:1000
- C:\Windows\System\YOpCSTF.exe
  C:\Windows\System\YOpCSTF.exe
  2⤵
  - Executes dropped EXE
  PID:4724
- C:\Windows\System\flpniaf.exe
  C:\Windows\System\flpniaf.exe
  2⤵
  - Executes dropped EXE
  PID:4924
- C:\Windows\System\qsaWsgf.exe
  C:\Windows\System\qsaWsgf.exe
  2⤵
  - Executes dropped EXE
  PID:1120
- C:\Windows\System\RYzGSUs.exe
  C:\Windows\System\RYzGSUs.exe
  2⤵
  - Executes dropped EXE
  PID:1712
- C:\Windows\System\ZZAkcoW.exe
  C:\Windows\System\ZZAkcoW.exe
  2⤵
  - Executes dropped EXE
  PID:4956
- C:\Windows\System\YYOoHFu.exe
  C:\Windows\System\YYOoHFu.exe
  2⤵
  - Executes dropped EXE
  PID:4536
- C:\Windows\System\JboKkId.exe
  C:\Windows\System\JboKkId.exe
  2⤵
  - Executes dropped EXE
  PID:3952
- C:\Windows\System\CpVQjBk.exe
  C:\Windows\System\CpVQjBk.exe
  2⤵
  - Executes dropped EXE
  PID:2300
- C:\Windows\System\OpDTkMC.exe
  C:\Windows\System\OpDTkMC.exe
  2⤵
  - Executes dropped EXE
  PID:4568
- C:\Windows\System\RPyArHQ.exe
  C:\Windows\System\RPyArHQ.exe
  2⤵
  - Executes dropped EXE
  PID:4912
- C:\Windows\System\NHECvWY.exe
  C:\Windows\System\NHECvWY.exe
  2⤵
  - Executes dropped EXE
  PID:2544
- C:\Windows\System\kLHaToz.exe
  C:\Windows\System\kLHaToz.exe
  2⤵
  - Executes dropped EXE
  PID:2160
- C:\Windows\System\tskVODz.exe
  C:\Windows\System\tskVODz.exe
  2⤵
  - Executes dropped EXE
  PID:1392
- C:\Windows\System\tVwwEZe.exe
  C:\Windows\System\tVwwEZe.exe
  2⤵
  - Executes dropped EXE
  PID:2112
- C:\Windows\System\NJmpHhe.exe
  C:\Windows\System\NJmpHhe.exe
  2⤵
  - Executes dropped EXE
  PID:1808
- C:\Windows\System\QxsdlML.exe
  C:\Windows\System\QxsdlML.exe
  2⤵
  - Executes dropped EXE
  PID:5060
- C:\Windows\System\xokLgfn.exe
  C:\Windows\System\xokLgfn.exe
  2⤵
  - Executes dropped EXE
  PID:3108
- C:\Windows\System\vvUOAYH.exe
  C:\Windows\System\vvUOAYH.exe
  2⤵
  - Executes dropped EXE
  PID:2472
- C:\Windows\System\NUjOQFZ.exe
  C:\Windows\System\NUjOQFZ.exe
  2⤵
  - Executes dropped EXE
  PID:920
- C:\Windows\System\mGHnVkc.exe
  C:\Windows\System\mGHnVkc.exe
  2⤵
  - Executes dropped EXE
  PID:1056
- C:\Windows\System\sLxkqyY.exe
  C:\Windows\System\sLxkqyY.exe
  2⤵
  - Executes dropped EXE
  PID:1144
- C:\Windows\System\lmDreRD.exe
  C:\Windows\System\lmDreRD.exe
  2⤵
  - Executes dropped EXE
  PID:1124
- C:\Windows\System\ByCczjC.exe
  C:\Windows\System\ByCczjC.exe
  2⤵
  - Executes dropped EXE
  PID:4480
- C:\Windows\System\cJrpIVO.exe
  C:\Windows\System\cJrpIVO.exe
  2⤵
  - Executes dropped EXE
  PID:2644
- C:\Windows\System\xHFMWUk.exe
  C:\Windows\System\xHFMWUk.exe
  2⤵
  - Executes dropped EXE
  PID:2432
- C:\Windows\System\HPfePSf.exe
  C:\Windows\System\HPfePSf.exe
  2⤵
  - Executes dropped EXE
  PID:4864
- C:\Windows\System\pVlgeNR.exe
  C:\Windows\System\pVlgeNR.exe
  2⤵
  - Executes dropped EXE
  PID:2504
- C:\Windows\System\GkVtvUU.exe
  C:\Windows\System\GkVtvUU.exe
  2⤵
  - Executes dropped EXE
  PID:3868
- C:\Windows\System\BESmrHW.exe
  C:\Windows\System\BESmrHW.exe
  2⤵
  - Executes dropped EXE
  PID:4584
- C:\Windows\System\qUAzItl.exe
  C:\Windows\System\qUAzItl.exe
  2⤵
  - Executes dropped EXE
  PID:1840
- C:\Windows\System\sLDHpRG.exe
  C:\Windows\System\sLDHpRG.exe
  2⤵
  - Executes dropped EXE
  PID:1924
- C:\Windows\System\mpiLXtu.exe
  C:\Windows\System\mpiLXtu.exe
  2⤵
  - Executes dropped EXE
  PID:4180
- C:\Windows\System\SwmkgPG.exe
  C:\Windows\System\SwmkgPG.exe
  2⤵
  - Executes dropped EXE
  PID:3912
- C:\Windows\System\URvlBtK.exe
  C:\Windows\System\URvlBtK.exe
  2⤵
  - Executes dropped EXE
  PID:3632
- C:\Windows\System\SyTUgVG.exe
  C:\Windows\System\SyTUgVG.exe
  2⤵
  - Executes dropped EXE
  PID:540
- C:\Windows\System\XLpVRCO.exe
  C:\Windows\System\XLpVRCO.exe
  2⤵
  - Executes dropped EXE
  PID:2264
- C:\Windows\System\klXQYvk.exe
  C:\Windows\System\klXQYvk.exe
  2⤵
  - Executes dropped EXE
  PID:1984
- C:\Windows\System\KMvahVl.exe
  C:\Windows\System\KMvahVl.exe
  2⤵
  - Executes dropped EXE
  PID:4056
- C:\Windows\System\rkWsWTZ.exe
  C:\Windows\System\rkWsWTZ.exe
  2⤵
  - Executes dropped EXE
  PID:348
- C:\Windows\System\MeDEyEf.exe
  C:\Windows\System\MeDEyEf.exe
  2⤵
  - Executes dropped EXE
  PID:4544
- C:\Windows\System\dhgYSMf.exe
  C:\Windows\System\dhgYSMf.exe
  2⤵
  - Executes dropped EXE
  PID:764
- C:\Windows\System\JgZPzIr.exe
  C:\Windows\System\JgZPzIr.exe
  2⤵
  - Executes dropped EXE
  PID:1664
- C:\Windows\System\esjELct.exe
  C:\Windows\System\esjELct.exe
  2⤵
  - Executes dropped EXE
  PID:1804
- C:\Windows\System\lTLENAF.exe
  C:\Windows\System\lTLENAF.exe
  2⤵
  - Executes dropped EXE
  PID:4120
- C:\Windows\System\KOAumFp.exe
  C:\Windows\System\KOAumFp.exe
  2⤵
  - Executes dropped EXE
  PID:1488
- C:\Windows\System\TVmghUr.exe
  C:\Windows\System\TVmghUr.exe
  2⤵
  - Executes dropped EXE
  PID:1136
- C:\Windows\System\hvDhAfz.exe
  C:\Windows\System\hvDhAfz.exe
  2⤵
  PID:1600
- C:\Windows\System\tAQVOkg.exe
  C:\Windows\System\tAQVOkg.exe
  2⤵
  PID:4608
- C:\Windows\System\yzaCCNx.exe
  C:\Windows\System\yzaCCNx.exe
  2⤵
  PID:2208
- C:\Windows\System\jjjVdtT.exe
  C:\Windows\System\jjjVdtT.exe
  2⤵
  PID:1760
- C:\Windows\System\ujfmkNE.exe
  C:\Windows\System\ujfmkNE.exe
  2⤵
  PID:3052
- C:\Windows\System\GSLmsNw.exe
  C:\Windows\System\GSLmsNw.exe
  2⤵
  PID:1956
- C:\Windows\System\sCWuuOx.exe
  C:\Windows\System\sCWuuOx.exe
  2⤵
  PID:3608
- C:\Windows\System\JOYxPWr.exe
  C:\Windows\System\JOYxPWr.exe
  2⤵
  PID:3568
- C:\Windows\System\ZOqrYbE.exe
  C:\Windows\System\ZOqrYbE.exe
  2⤵
  PID:4932
- C:\Windows\System\HiHlVOv.exe
  C:\Windows\System\HiHlVOv.exe
  2⤵
  PID:2192
- C:\Windows\System\SiezADe.exe
  C:\Windows\System\SiezADe.exe
  2⤵
  PID:3148
- C:\Windows\System\ydyIYCa.exe
  C:\Windows\System\ydyIYCa.exe
  2⤵
  PID:1400
- C:\Windows\System\gMaNTnd.exe
  C:\Windows\System\gMaNTnd.exe
  2⤵
  PID:5016
- C:\Windows\System\vSZXbev.exe
  C:\Windows\System\vSZXbev.exe
  2⤵
  PID:4224
- C:\Windows\System\ApKTsFT.exe
  C:\Windows\System\ApKTsFT.exe
  2⤵
  PID:744
- C:\Windows\System\PgFrmJc.exe
  C:\Windows\System\PgFrmJc.exe
  2⤵
  PID:3956
- C:\Windows\System\KnLzuKv.exe
  C:\Windows\System\KnLzuKv.exe
  2⤵
  PID:432
- C:\Windows\System\sMAerJC.exe
  C:\Windows\System\sMAerJC.exe
  2⤵
  PID:3740
- C:\Windows\System\EktUllF.exe
  C:\Windows\System\EktUllF.exe
  2⤵
  PID:2392
- C:\Windows\System\TcZCcaH.exe
  C:\Windows\System\TcZCcaH.exe
  2⤵
  PID:3340
- C:\Windows\System\RXYOQER.exe
  C:\Windows\System\RXYOQER.exe
  2⤵
  PID:1160
- C:\Windows\System\taMcISS.exe
  C:\Windows\System\taMcISS.exe
  2⤵
  PID:4876
- C:\Windows\System\hDuyzSW.exe
  C:\Windows\System\hDuyzSW.exe
  2⤵
  PID:3968
- C:\Windows\System\heyUZKA.exe
  C:\Windows\System\heyUZKA.exe
  2⤵
  PID:4356
- C:\Windows\System\FRaOHtX.exe
  C:\Windows\System\FRaOHtX.exe
  2⤵
  PID:1344
- C:\Windows\System\vhOaaoI.exe
  C:\Windows\System\vhOaaoI.exe
  2⤵
  PID:4600
- C:\Windows\System\GVspLqY.exe
  C:\Windows\System\GVspLqY.exe
  2⤵
  PID:2072
- C:\Windows\System\TfrsRBx.exe
  C:\Windows\System\TfrsRBx.exe
  2⤵
  PID:4592
- C:\Windows\System\KBTgnbU.exe
  C:\Windows\System\KBTgnbU.exe
  2⤵
  PID:3380
- C:\Windows\System\ODgbNxe.exe
  C:\Windows\System\ODgbNxe.exe
  2⤵
  PID:2328
- C:\Windows\System\EdfbDqZ.exe
  C:\Windows\System\EdfbDqZ.exe
  2⤵
  PID:2748
- C:\Windows\System\lHjyDfn.exe
  C:\Windows\System\lHjyDfn.exe
  2⤵
  PID:2448
- C:\Windows\System\iOvBGTX.exe
  C:\Windows\System\iOvBGTX.exe
  2⤵
  PID:1140
- C:\Windows\System\gSCHyhs.exe
  C:\Windows\System\gSCHyhs.exe
  2⤵
  PID:4524
- C:\Windows\System\QZXpbUE.exe
  C:\Windows\System\QZXpbUE.exe
  2⤵
  PID:5148
- C:\Windows\System\hIAOhpq.exe
  C:\Windows\System\hIAOhpq.exe
  2⤵
  PID:5176
- C:\Windows\System\ccdoglx.exe
  C:\Windows\System\ccdoglx.exe
  2⤵
  PID:5204
- C:\Windows\System\jjdmkoX.exe
  C:\Windows\System\jjdmkoX.exe
  2⤵
  PID:5236
- C:\Windows\System\JJFzTnf.exe
  C:\Windows\System\JJFzTnf.exe
  2⤵
  PID:5268
- C:\Windows\System\ESJhxHY.exe
  C:\Windows\System\ESJhxHY.exe
  2⤵
  PID:5296
- C:\Windows\System\qYWAbyT.exe
  C:\Windows\System\qYWAbyT.exe
  2⤵
  PID:5316
- C:\Windows\System\nEvqVed.exe
  C:\Windows\System\nEvqVed.exe
  2⤵
  PID:5348
- C:\Windows\System\zigyXXa.exe
  C:\Windows\System\zigyXXa.exe
  2⤵
  PID:5380
- C:\Windows\System\eESmLrf.exe
  C:\Windows\System\eESmLrf.exe
  2⤵
  PID:5400
- C:\Windows\System\qaWgzqo.exe
  C:\Windows\System\qaWgzqo.exe
  2⤵
  PID:5440
- C:\Windows\System\SxMLCMi.exe
  C:\Windows\System\SxMLCMi.exe
  2⤵
  PID:5456
- C:\Windows\System\TYLsZYm.exe
  C:\Windows\System\TYLsZYm.exe
  2⤵
  PID:5484
- C:\Windows\System\abknjXw.exe
  C:\Windows\System\abknjXw.exe
  2⤵
  PID:5528
- C:\Windows\System\fWopqzI.exe
  C:\Windows\System\fWopqzI.exe
  2⤵
  PID:5556
- C:\Windows\System\RbQZeZn.exe
  C:\Windows\System\RbQZeZn.exe
  2⤵
  PID:5584
- C:\Windows\System\OAchroS.exe
  C:\Windows\System\OAchroS.exe
  2⤵
  PID:5612
- C:\Windows\System\mdwJbIQ.exe
  C:\Windows\System\mdwJbIQ.exe
  2⤵
  PID:5648
- C:\Windows\System\jBwVOCs.exe
  C:\Windows\System\jBwVOCs.exe
  2⤵
  PID:5680
- C:\Windows\System\iyydqCK.exe
  C:\Windows\System\iyydqCK.exe
  2⤵
  PID:5720
- C:\Windows\System\geMWhKI.exe
  C:\Windows\System\geMWhKI.exe
  2⤵
  PID:5748
- C:\Windows\System\nscVvhG.exe
  C:\Windows\System\nscVvhG.exe
  2⤵
  PID:5776
- C:\Windows\System\LBunSga.exe
  C:\Windows\System\LBunSga.exe
  2⤵
  PID:5796
- C:\Windows\System\qyMLPgI.exe
  C:\Windows\System\qyMLPgI.exe
  2⤵
  PID:5820
- C:\Windows\System\GUofrrp.exe
  C:\Windows\System\GUofrrp.exe
  2⤵
  PID:5864
- C:\Windows\System\YPhafvo.exe
  C:\Windows\System\YPhafvo.exe
  2⤵
  PID:5884
- C:\Windows\System\ewAFLIN.exe
  C:\Windows\System\ewAFLIN.exe
  2⤵
  PID:5912
- C:\Windows\System\LySdtpL.exe
  C:\Windows\System\LySdtpL.exe
  2⤵
  PID:5940
- C:\Windows\System\TkdNlSw.exe
  C:\Windows\System\TkdNlSw.exe
  2⤵
  PID:5976
- C:\Windows\System\VHNuerm.exe
  C:\Windows\System\VHNuerm.exe
  2⤵
  PID:6004
- C:\Windows\System\ciSOhiW.exe
  C:\Windows\System\ciSOhiW.exe
  2⤵
  PID:6032
- C:\Windows\System\pHPdLEr.exe
  C:\Windows\System\pHPdLEr.exe
  2⤵
  PID:6048
- C:\Windows\System\POXrllt.exe
  C:\Windows\System\POXrllt.exe
  2⤵
  PID:6080
- C:\Windows\System\UZErxwx.exe
  C:\Windows\System\UZErxwx.exe
  2⤵
  PID:6100
- C:\Windows\System\CkZQiGs.exe
  C:\Windows\System\CkZQiGs.exe
  2⤵
  PID:5132
- C:\Windows\System\ptdSmSZ.exe
  C:\Windows\System\ptdSmSZ.exe
  2⤵
  PID:5196
- C:\Windows\System\lTCwtTQ.exe
  C:\Windows\System\lTCwtTQ.exe
  2⤵
  PID:5256
- C:\Windows\System\aMPOjHG.exe
  C:\Windows\System\aMPOjHG.exe
  2⤵
  PID:5328
- C:\Windows\System\qYxbFuN.exe
  C:\Windows\System\qYxbFuN.exe
  2⤵
  PID:5392
- C:\Windows\System\jxPLkIX.exe
  C:\Windows\System\jxPLkIX.exe
  2⤵
  PID:5436
- C:\Windows\System\lQtmXos.exe
  C:\Windows\System\lQtmXos.exe
  2⤵
  PID:5504
- C:\Windows\System\GZYoqvt.exe
  C:\Windows\System\GZYoqvt.exe
  2⤵
  PID:5568
- C:\Windows\System\tnNYpTr.exe
  C:\Windows\System\tnNYpTr.exe
  2⤵
  PID:5672
- C:\Windows\System\TCnUoiI.exe
  C:\Windows\System\TCnUoiI.exe
  2⤵
  PID:5768
- C:\Windows\System\tGgrVUZ.exe
  C:\Windows\System\tGgrVUZ.exe
  2⤵
  PID:5816
- C:\Windows\System\ELkfEww.exe
  C:\Windows\System\ELkfEww.exe
  2⤵
  PID:5892
- C:\Windows\System\DXdOyli.exe
  C:\Windows\System\DXdOyli.exe
  2⤵
  PID:5948
- C:\Windows\System\CDkmjMy.exe
  C:\Windows\System\CDkmjMy.exe
  2⤵
  PID:6040
- C:\Windows\System\PtQYmuP.exe
  C:\Windows\System\PtQYmuP.exe
  2⤵
  PID:6072
- C:\Windows\System\whfbVvm.exe
  C:\Windows\System\whfbVvm.exe
  2⤵
  PID:6092
- C:\Windows\System\DHVQkDs.exe
  C:\Windows\System\DHVQkDs.exe
  2⤵
  PID:5160
- C:\Windows\System\atRqkfT.exe
  C:\Windows\System\atRqkfT.exe
  2⤵
  PID:5252
- C:\Windows\System\BuugVZy.exe
  C:\Windows\System\BuugVZy.exe
  2⤵
  PID:5472
- C:\Windows\System\mIidAOU.exe
  C:\Windows\System\mIidAOU.exe
  2⤵
  PID:5668
- C:\Windows\System\VttdxdU.exe
  C:\Windows\System\VttdxdU.exe
  2⤵
  PID:5872
- C:\Windows\System\HRAtGRK.exe
  C:\Windows\System\HRAtGRK.exe
  2⤵
  PID:6016
- C:\Windows\System\FEkNeKz.exe
  C:\Windows\System\FEkNeKz.exe
  2⤵
  PID:5308
- C:\Windows\System\XxOCHsG.exe
  C:\Windows\System\XxOCHsG.exe
  2⤵
  PID:5804
- C:\Windows\System\tgeXgNu.exe
  C:\Windows\System\tgeXgNu.exe
  2⤵
  PID:5996
- C:\Windows\System\BJyTJTb.exe
  C:\Windows\System\BJyTJTb.exe
  2⤵
  PID:5988
- C:\Windows\System\DoYgitL.exe
  C:\Windows\System\DoYgitL.exe
  2⤵
  PID:6156
- C:\Windows\System\MNpdnQT.exe
  C:\Windows\System\MNpdnQT.exe
  2⤵
  PID:6188
- C:\Windows\System\AWGMjJB.exe
  C:\Windows\System\AWGMjJB.exe
  2⤵
  PID:6208
- C:\Windows\System\AXgmvFm.exe
  C:\Windows\System\AXgmvFm.exe
  2⤵
  PID:6232
- C:\Windows\System\ViGhCfW.exe
  C:\Windows\System\ViGhCfW.exe
  2⤵
  PID:6264
- C:\Windows\System\IuNlYZW.exe
  C:\Windows\System\IuNlYZW.exe
  2⤵
  PID:6288
- C:\Windows\System\dtnPNbq.exe
  C:\Windows\System\dtnPNbq.exe
  2⤵
  PID:6316
- C:\Windows\System\EHMvxzO.exe
  C:\Windows\System\EHMvxzO.exe
  2⤵
  PID:6344
- C:\Windows\System\WpAVnZm.exe
  C:\Windows\System\WpAVnZm.exe
  2⤵
  PID:6384
- C:\Windows\System\hmXkhzW.exe
  C:\Windows\System\hmXkhzW.exe
  2⤵
  PID:6412
- C:\Windows\System\cRIsuGX.exe
  C:\Windows\System\cRIsuGX.exe
  2⤵
  PID:6428
- C:\Windows\System\FnsdWIy.exe
  C:\Windows\System\FnsdWIy.exe
  2⤵
  PID:6460
- C:\Windows\System\IMTVccZ.exe
  C:\Windows\System\IMTVccZ.exe
  2⤵
  PID:6496
- C:\Windows\System\yiElKdi.exe
  C:\Windows\System\yiElKdi.exe
  2⤵
  PID:6512
- C:\Windows\System\mOveJmV.exe
  C:\Windows\System\mOveJmV.exe
  2⤵
  PID:6548
- C:\Windows\System\eQFslgC.exe
  C:\Windows\System\eQFslgC.exe
  2⤵
  PID:6580
- C:\Windows\System\fbJMYFV.exe
  C:\Windows\System\fbJMYFV.exe
  2⤵
  PID:6608
- C:\Windows\System\BDAjjoV.exe
  C:\Windows\System\BDAjjoV.exe
  2⤵
  PID:6640
- C:\Windows\System\bXqeShR.exe
  C:\Windows\System\bXqeShR.exe
  2⤵
  PID:6668
- C:\Windows\System\zIRYTTS.exe
  C:\Windows\System\zIRYTTS.exe
  2⤵
  PID:6700
- C:\Windows\System\rTgXkrG.exe
  C:\Windows\System\rTgXkrG.exe
  2⤵
  PID:6736
- C:\Windows\System\tYzoHvF.exe
  C:\Windows\System\tYzoHvF.exe
  2⤵
  PID:6756
- C:\Windows\System\WcVoNCZ.exe
  C:\Windows\System\WcVoNCZ.exe
  2⤵
  PID:6780
- C:\Windows\System\qPVhCdt.exe
  C:\Windows\System\qPVhCdt.exe
  2⤵
  PID:6808
- C:\Windows\System\QgbLpcv.exe
  C:\Windows\System\QgbLpcv.exe
  2⤵
  PID:6836
- C:\Windows\System\HAuserJ.exe
  C:\Windows\System\HAuserJ.exe
  2⤵
  PID:6864
- C:\Windows\System\LkwaccX.exe
  C:\Windows\System\LkwaccX.exe
  2⤵
  PID:6888
- C:\Windows\System\IGxqxqa.exe
  C:\Windows\System\IGxqxqa.exe
  2⤵
  PID:6912
- C:\Windows\System\XAwMAjB.exe
  C:\Windows\System\XAwMAjB.exe
  2⤵
  PID:6964
- C:\Windows\System\HsngOSA.exe
  C:\Windows\System\HsngOSA.exe
  2⤵
  PID:6984
- C:\Windows\System\UBpTYiy.exe
  C:\Windows\System\UBpTYiy.exe
  2⤵
  PID:7004
- C:\Windows\System\zcrVzSZ.exe
  C:\Windows\System\zcrVzSZ.exe
  2⤵
  PID:7036
- C:\Windows\System\AMnEwrc.exe
  C:\Windows\System\AMnEwrc.exe
  2⤵
  PID:7076
- C:\Windows\System\hVsWMVS.exe
  C:\Windows\System\hVsWMVS.exe
  2⤵
  PID:7096
- C:\Windows\System\MbirRCq.exe
  C:\Windows\System\MbirRCq.exe
  2⤵
  PID:7120
- C:\Windows\System\gufipzY.exe
  C:\Windows\System\gufipzY.exe
  2⤵
  PID:7152
- C:\Windows\System\caIetqu.exe
  C:\Windows\System\caIetqu.exe
  2⤵
  PID:5968
- C:\Windows\System\ZtiEAei.exe
  C:\Windows\System\ZtiEAei.exe
  2⤵
  PID:6216
- C:\Windows\System\RgHoZRa.exe
  C:\Windows\System\RgHoZRa.exe
  2⤵
  PID:6244
- C:\Windows\System\chxpjsa.exe
  C:\Windows\System\chxpjsa.exe
  2⤵
  PID:6380
- C:\Windows\System\vWTOywy.exe
  C:\Windows\System\vWTOywy.exe
  2⤵
  PID:6420
- C:\Windows\System\fOPnDeM.exe
  C:\Windows\System\fOPnDeM.exe
  2⤵
  PID:6488
- C:\Windows\System\XnpHieQ.exe
  C:\Windows\System\XnpHieQ.exe
  2⤵
  PID:6540
- C:\Windows\System\VIcHwgp.exe
  C:\Windows\System\VIcHwgp.exe
  2⤵
  PID:6596
- C:\Windows\System\nawqSSI.exe
  C:\Windows\System\nawqSSI.exe
  2⤵
  PID:6684
- C:\Windows\System\rPkPfKZ.exe
  C:\Windows\System\rPkPfKZ.exe
  2⤵
  PID:6848
- C:\Windows\System\odcYnRG.exe
  C:\Windows\System\odcYnRG.exe
  2⤵
  PID:6932
- C:\Windows\System\Awapkfo.exe
  C:\Windows\System\Awapkfo.exe
  2⤵
  PID:7052
- C:\Windows\System\jqHRsHW.exe
  C:\Windows\System\jqHRsHW.exe
  2⤵
  PID:7136
- C:\Windows\System\IOMcaSC.exe
  C:\Windows\System\IOMcaSC.exe
  2⤵
  PID:6168
- C:\Windows\System\xactdlh.exe
  C:\Windows\System\xactdlh.exe
  2⤵
  PID:5604
- C:\Windows\System\YeTAjWv.exe
  C:\Windows\System\YeTAjWv.exe
  2⤵
  PID:6508
- C:\Windows\System\oWCIWAT.exe
  C:\Windows\System\oWCIWAT.exe
  2⤵
  PID:6628
- C:\Windows\System\NhPgVEx.exe
  C:\Windows\System\NhPgVEx.exe
  2⤵
  PID:6900
- C:\Windows\System\zOZPiTi.exe
  C:\Windows\System\zOZPiTi.exe
  2⤵
  PID:6256
- C:\Windows\System\wHZWEFH.exe
  C:\Windows\System\wHZWEFH.exe
  2⤵
  PID:6908
- C:\Windows\System\qcrQWnJ.exe
  C:\Windows\System\qcrQWnJ.exe
  2⤵
  PID:7188
- C:\Windows\System\leZDrnG.exe
  C:\Windows\System\leZDrnG.exe
  2⤵
  PID:7228
- C:\Windows\System\WvtDRWx.exe
  C:\Windows\System\WvtDRWx.exe
  2⤵
  PID:7260
- C:\Windows\System\RBZqGwh.exe
  C:\Windows\System\RBZqGwh.exe
  2⤵
  PID:7288
- C:\Windows\System\jgwKVTg.exe
  C:\Windows\System\jgwKVTg.exe
  2⤵
  PID:7316
- C:\Windows\System\CJPUfkW.exe
  C:\Windows\System\CJPUfkW.exe
  2⤵
  PID:7344
- C:\Windows\System\TqFEtia.exe
  C:\Windows\System\TqFEtia.exe
  2⤵
  PID:7384
- C:\Windows\System\VCyPpUp.exe
  C:\Windows\System\VCyPpUp.exe
  2⤵
  PID:7412
- C:\Windows\System\rdjNAog.exe
  C:\Windows\System\rdjNAog.exe
  2⤵
  PID:7440
- C:\Windows\System\OnMizXM.exe
  C:\Windows\System\OnMizXM.exe
  2⤵
  PID:7468
- C:\Windows\System\SELXiip.exe
  C:\Windows\System\SELXiip.exe
  2⤵
  PID:7492
- C:\Windows\System\CUNWNTW.exe
  C:\Windows\System\CUNWNTW.exe
  2⤵
  PID:7508
- C:\Windows\System\AklSCTa.exe
  C:\Windows\System\AklSCTa.exe
  2⤵
  PID:7560
- C:\Windows\System\fnczSCo.exe
  C:\Windows\System\fnczSCo.exe
  2⤵
  PID:7576
- C:\Windows\System\lVAwffN.exe
  C:\Windows\System\lVAwffN.exe
  2⤵
  PID:7600
- C:\Windows\System\qERIhLx.exe
  C:\Windows\System\qERIhLx.exe
  2⤵
  PID:7632
- C:\Windows\System\kXvnVyI.exe
  C:\Windows\System\kXvnVyI.exe
  2⤵
  PID:7656
- C:\Windows\System\lKAkqwq.exe
  C:\Windows\System\lKAkqwq.exe
  2⤵
  PID:7684
- C:\Windows\System\mDvzMVS.exe
  C:\Windows\System\mDvzMVS.exe
  2⤵
  PID:7720
- C:\Windows\System\pWbFJdB.exe
  C:\Windows\System\pWbFJdB.exe
  2⤵
  PID:7748
- C:\Windows\System\bPGlucJ.exe
  C:\Windows\System\bPGlucJ.exe
  2⤵
  PID:7800
- C:\Windows\System\THfEUox.exe
  C:\Windows\System\THfEUox.exe
  2⤵
  PID:7820
- C:\Windows\System\NvMFbnj.exe
  C:\Windows\System\NvMFbnj.exe
  2⤵
  PID:7856
- C:\Windows\System\DxjQiRj.exe
  C:\Windows\System\DxjQiRj.exe
  2⤵
  PID:7884
- C:\Windows\System\TUaoPag.exe
  C:\Windows\System\TUaoPag.exe
  2⤵
  PID:7908
- C:\Windows\System\OezNoSL.exe
  C:\Windows\System\OezNoSL.exe
  2⤵
  PID:7928
- C:\Windows\System\fTmiEny.exe
  C:\Windows\System\fTmiEny.exe
  2⤵
  PID:7956
- C:\Windows\System\cxKwoga.exe
  C:\Windows\System\cxKwoga.exe
  2⤵
  PID:7976
- C:\Windows\System\AWNqdgt.exe
  C:\Windows\System\AWNqdgt.exe
  2⤵
  PID:8004
- C:\Windows\System\hIvyGSe.exe
  C:\Windows\System\hIvyGSe.exe
  2⤵
  PID:8020
- C:\Windows\System\YkJPNLv.exe
  C:\Windows\System\YkJPNLv.exe
  2⤵
  PID:8040
- C:\Windows\System\OOBLFJL.exe
  C:\Windows\System\OOBLFJL.exe
  2⤵
  PID:8072
- C:\Windows\System\VVfrfyb.exe
  C:\Windows\System\VVfrfyb.exe
  2⤵
  PID:8096
- C:\Windows\System\ZETJKUm.exe
  C:\Windows\System\ZETJKUm.exe
  2⤵
  PID:8124
- C:\Windows\System\dFAEtlc.exe
  C:\Windows\System\dFAEtlc.exe
  2⤵
  PID:8148
- C:\Windows\System\jjCInPr.exe
  C:\Windows\System\jjCInPr.exe
  2⤵
  PID:8168
- C:\Windows\System\OLwReSP.exe
  C:\Windows\System\OLwReSP.exe
  2⤵
  PID:6624
- C:\Windows\System\foOGbxA.exe
  C:\Windows\System\foOGbxA.exe
  2⤵
  PID:7184
- C:\Windows\System\eJmqCGo.exe
  C:\Windows\System\eJmqCGo.exe
  2⤵
  PID:7332
- C:\Windows\System\DzWAngm.exe
  C:\Windows\System\DzWAngm.exe
  2⤵
  PID:7432
- C:\Windows\System\KTmOVIL.exe
  C:\Windows\System\KTmOVIL.exe
  2⤵
  PID:7452
- C:\Windows\System\gYqXnxc.exe
  C:\Windows\System\gYqXnxc.exe
  2⤵
  PID:7588
- C:\Windows\System\FKjDIyw.exe
  C:\Windows\System\FKjDIyw.exe
  2⤵
  PID:7652
- C:\Windows\System\JaCFjQP.exe
  C:\Windows\System\JaCFjQP.exe
  2⤵
  PID:7740
- C:\Windows\System\bNwhRCN.exe
  C:\Windows\System\bNwhRCN.exe
  2⤵
  PID:7808
- C:\Windows\System\XyyYqhW.exe
  C:\Windows\System\XyyYqhW.exe
  2⤵
  PID:7844
- C:\Windows\System\yoMZJyi.exe
  C:\Windows\System\yoMZJyi.exe
  2⤵
  PID:7904
- C:\Windows\System\hAPruJn.exe
  C:\Windows\System\hAPruJn.exe
  2⤵
  PID:8012
- C:\Windows\System\xwJrZag.exe
  C:\Windows\System\xwJrZag.exe
  2⤵
  PID:8088
- C:\Windows\System\ikmqIvT.exe
  C:\Windows\System\ikmqIvT.exe
  2⤵
  PID:8144
- C:\Windows\System\SlrxwNw.exe
  C:\Windows\System\SlrxwNw.exe
  2⤵
  PID:7268
- C:\Windows\System\PMzDFex.exe
  C:\Windows\System\PMzDFex.exe
  2⤵
  PID:7220
- C:\Windows\System\cpufOix.exe
  C:\Windows\System\cpufOix.exe
  2⤵
  PID:7372
- C:\Windows\System\UDyNWoI.exe
  C:\Windows\System\UDyNWoI.exe
  2⤵
  PID:7568
- C:\Windows\System\asDlhyP.exe
  C:\Windows\System\asDlhyP.exe
  2⤵
  PID:7768
- C:\Windows\System\RgsZePp.exe
  C:\Windows\System\RgsZePp.exe
  2⤵
  PID:7832
- C:\Windows\System\hkwXGej.exe
  C:\Windows\System\hkwXGej.exe
  2⤵
  PID:8036
- C:\Windows\System\fCzmdpx.exe
  C:\Windows\System\fCzmdpx.exe
  2⤵
  PID:7396
- C:\Windows\System\sSFGmdY.exe
  C:\Windows\System\sSFGmdY.exe
  2⤵
  PID:7624
- C:\Windows\System\kOqOtde.exe
  C:\Windows\System\kOqOtde.exe
  2⤵
  PID:8084
- C:\Windows\System\TrEqUko.exe
  C:\Windows\System\TrEqUko.exe
  2⤵
  PID:8212
- C:\Windows\System\buEsTVT.exe
  C:\Windows\System\buEsTVT.exe
  2⤵
  PID:8256
- C:\Windows\System\GphbImh.exe
  C:\Windows\System\GphbImh.exe
  2⤵
  PID:8280
- C:\Windows\System\XniWxqo.exe
  C:\Windows\System\XniWxqo.exe
  2⤵
  PID:8312
- C:\Windows\System\LoCkGCs.exe
  C:\Windows\System\LoCkGCs.exe
  2⤵
  PID:8336
- C:\Windows\System\LoceLqd.exe
  C:\Windows\System\LoceLqd.exe
  2⤵
  PID:8360
- C:\Windows\System\vrgwHKt.exe
  C:\Windows\System\vrgwHKt.exe
  2⤵
  PID:8392
- C:\Windows\System\yaxbOeG.exe
  C:\Windows\System\yaxbOeG.exe
  2⤵
  PID:8420
- C:\Windows\System\PXDgBbr.exe
  C:\Windows\System\PXDgBbr.exe
  2⤵
  PID:8468
- C:\Windows\System\jUxRCjm.exe
  C:\Windows\System\jUxRCjm.exe
  2⤵
  PID:8484
- C:\Windows\System\QVnxzlg.exe
  C:\Windows\System\QVnxzlg.exe
  2⤵
  PID:8516
- C:\Windows\System\xYkhndO.exe
  C:\Windows\System\xYkhndO.exe
  2⤵
  PID:8544
- C:\Windows\System\rxnkYvQ.exe
  C:\Windows\System\rxnkYvQ.exe
  2⤵
  PID:8580
- C:\Windows\System\CqiXQQn.exe
  C:\Windows\System\CqiXQQn.exe
  2⤵
  PID:8600
- C:\Windows\System\xwegwsW.exe
  C:\Windows\System\xwegwsW.exe
  2⤵
  PID:8636
- C:\Windows\System\KieDjjj.exe
  C:\Windows\System\KieDjjj.exe
  2⤵
  PID:8664
- C:\Windows\System\DdjMKOU.exe
  C:\Windows\System\DdjMKOU.exe
  2⤵
  PID:8680
- C:\Windows\System\EehZPrn.exe
  C:\Windows\System\EehZPrn.exe
  2⤵
  PID:8708
- C:\Windows\System\EWpBVRt.exe
  C:\Windows\System\EWpBVRt.exe
  2⤵
  PID:8724
- C:\Windows\System\ZccPoTD.exe
  C:\Windows\System\ZccPoTD.exe
  2⤵
  PID:8752
- C:\Windows\System\jgRXKfa.exe
  C:\Windows\System\jgRXKfa.exe
  2⤵
  PID:8784
- C:\Windows\System\XjImzEE.exe
  C:\Windows\System\XjImzEE.exe
  2⤵
  PID:8808
- C:\Windows\System\MkMlUNN.exe
  C:\Windows\System\MkMlUNN.exe
  2⤵
  PID:8840
- C:\Windows\System\YJrmToJ.exe
  C:\Windows\System\YJrmToJ.exe
  2⤵
  PID:8880
- C:\Windows\System\BuVqUBD.exe
  C:\Windows\System\BuVqUBD.exe
  2⤵
  PID:8904
- C:\Windows\System\JCjeMuk.exe
  C:\Windows\System\JCjeMuk.exe
  2⤵
  PID:8920
- C:\Windows\System\mkwBOHa.exe
  C:\Windows\System\mkwBOHa.exe
  2⤵
  PID:8948
- C:\Windows\System\EcDftpH.exe
  C:\Windows\System\EcDftpH.exe
  2⤵
  PID:8964
- C:\Windows\System\nvbQQkb.exe
  C:\Windows\System\nvbQQkb.exe
  2⤵
  PID:8992
- C:\Windows\System\KGakNmY.exe
  C:\Windows\System\KGakNmY.exe
  2⤵
  PID:9056
- C:\Windows\System\ksstRtW.exe
  C:\Windows\System\ksstRtW.exe
  2⤵
  PID:9072
- C:\Windows\System\LPHeGKs.exe
  C:\Windows\System\LPHeGKs.exe
  2⤵
  PID:9096
- C:\Windows\System\LKJrbgN.exe
  C:\Windows\System\LKJrbgN.exe
  2⤵
  PID:9128
- C:\Windows\System\hWyEcxO.exe
  C:\Windows\System\hWyEcxO.exe
  2⤵
  PID:9156
- C:\Windows\System\IfNIBPD.exe
  C:\Windows\System\IfNIBPD.exe
  2⤵
  PID:9188
- C:\Windows\System\fTvcmph.exe
  C:\Windows\System\fTvcmph.exe
  2⤵
  PID:8116
- C:\Windows\System\XgBnzJa.exe
  C:\Windows\System\XgBnzJa.exe
  2⤵
  PID:6744
- C:\Windows\System\asvGqSc.exe
  C:\Windows\System\asvGqSc.exe
  2⤵
  PID:8252
- C:\Windows\System\SEFhteM.exe
  C:\Windows\System\SEFhteM.exe
  2⤵
  PID:8324
- C:\Windows\System\mjvGOqg.exe
  C:\Windows\System\mjvGOqg.exe
  2⤵
  PID:8400
- C:\Windows\System\frbgMLP.exe
  C:\Windows\System\frbgMLP.exe
  2⤵
  PID:8456
- C:\Windows\System\EVverNQ.exe
  C:\Windows\System\EVverNQ.exe
  2⤵
  PID:8540
- C:\Windows\System\ZCyOMgo.exe
  C:\Windows\System\ZCyOMgo.exe
  2⤵
  PID:8576
- C:\Windows\System\PxDmPhz.exe
  C:\Windows\System\PxDmPhz.exe
  2⤵
  PID:8648
- C:\Windows\System\xDrLRRV.exe
  C:\Windows\System\xDrLRRV.exe
  2⤵
  PID:8716
- C:\Windows\System\OSoxens.exe
  C:\Windows\System\OSoxens.exe
  2⤵
  PID:8744
- C:\Windows\System\qDSuSmT.exe
  C:\Windows\System\qDSuSmT.exe
  2⤵
  PID:8860
- C:\Windows\System\tRtgOPP.exe
  C:\Windows\System\tRtgOPP.exe
  2⤵
  PID:8916
- C:\Windows\System\xYkqiEG.exe
  C:\Windows\System\xYkqiEG.exe
  2⤵
  PID:9020
- C:\Windows\System\SuPPuEf.exe
  C:\Windows\System\SuPPuEf.exe
  2⤵
  PID:9040
- C:\Windows\System\WJhfeFf.exe
  C:\Windows\System\WJhfeFf.exe
  2⤵
  PID:9068
- C:\Windows\System\KgjAcDj.exe
  C:\Windows\System\KgjAcDj.exe
  2⤵
  PID:9092
- C:\Windows\System\sThTUra.exe
  C:\Windows\System\sThTUra.exe
  2⤵
  PID:9196
- C:\Windows\System\IWEmaev.exe
  C:\Windows\System\IWEmaev.exe
  2⤵
  PID:8276
- C:\Windows\System\dEfveVn.exe
  C:\Windows\System\dEfveVn.exe
  2⤵
  PID:8476
- C:\Windows\System\LzDIeGq.exe
  C:\Windows\System\LzDIeGq.exe
  2⤵
  PID:8620
- C:\Windows\System\jktQfxA.exe
  C:\Windows\System\jktQfxA.exe
  2⤵
  PID:8776
- C:\Windows\System\exiWwKa.exe
  C:\Windows\System\exiWwKa.exe
  2⤵
  PID:8888
- C:\Windows\System\bvJzFxZ.exe
  C:\Windows\System\bvJzFxZ.exe
  2⤵
  PID:9052
- C:\Windows\System\qWPwjok.exe
  C:\Windows\System\qWPwjok.exe
  2⤵
  PID:9164
- C:\Windows\System\wIPDCKv.exe
  C:\Windows\System\wIPDCKv.exe
  2⤵
  PID:8440
- C:\Windows\System\kVmuAqS.exe
  C:\Windows\System\kVmuAqS.exe
  2⤵
  PID:8848
- C:\Windows\System\DVjbmxm.exe
  C:\Windows\System\DVjbmxm.exe
  2⤵
  PID:9172
- C:\Windows\System\ClBSTTj.exe
  C:\Windows\System\ClBSTTj.exe
  2⤵
  PID:8572
- C:\Windows\System\qRKxSnL.exe
  C:\Windows\System\qRKxSnL.exe
  2⤵
  PID:8436
- C:\Windows\System\CCvGoiS.exe
  C:\Windows\System\CCvGoiS.exe
  2⤵
  PID:9244
- C:\Windows\System\MpppuaJ.exe
  C:\Windows\System\MpppuaJ.exe
  2⤵
  PID:9268
- C:\Windows\System\eudVOgY.exe
  C:\Windows\System\eudVOgY.exe
  2⤵
  PID:9292
- C:\Windows\System\NWCvDcH.exe
  C:\Windows\System\NWCvDcH.exe
  2⤵
  PID:9320
- C:\Windows\System\jjmWogG.exe
  C:\Windows\System\jjmWogG.exe
  2⤵
  PID:9344
- C:\Windows\System\GNIRMLZ.exe
  C:\Windows\System\GNIRMLZ.exe
  2⤵
  PID:9404
- C:\Windows\System\SGSaMGR.exe
  C:\Windows\System\SGSaMGR.exe
  2⤵
  PID:9432
- C:\Windows\System\OzPgClf.exe
  C:\Windows\System\OzPgClf.exe
  2⤵
  PID:9448
- C:\Windows\System\MUlpfed.exe
  C:\Windows\System\MUlpfed.exe
  2⤵
  PID:9468
- C:\Windows\System\TstYNXr.exe
  C:\Windows\System\TstYNXr.exe
  2⤵
  PID:9492
- C:\Windows\System\qVfHjvn.exe
  C:\Windows\System\qVfHjvn.exe
  2⤵
  PID:9508
- C:\Windows\System\YWhOjWx.exe
  C:\Windows\System\YWhOjWx.exe
  2⤵
  PID:9540
- C:\Windows\System\ZlfeBfL.exe
  C:\Windows\System\ZlfeBfL.exe
  2⤵
  PID:9580
- C:\Windows\System\wWypFLu.exe
  C:\Windows\System\wWypFLu.exe
  2⤵
  PID:9616
- C:\Windows\System\GAGRedW.exe
  C:\Windows\System\GAGRedW.exe
  2⤵
  PID:9636
- C:\Windows\System\APVbvbX.exe
  C:\Windows\System\APVbvbX.exe
  2⤵
  PID:9664
- C:\Windows\System\QrzyvYN.exe
  C:\Windows\System\QrzyvYN.exe
  2⤵
  PID:9700
- C:\Windows\System\xiKUQZX.exe
  C:\Windows\System\xiKUQZX.exe
  2⤵
  PID:9716
- C:\Windows\System\guAyZDF.exe
  C:\Windows\System\guAyZDF.exe
  2⤵
  PID:9768
- C:\Windows\System\GGbvWdE.exe
  C:\Windows\System\GGbvWdE.exe
  2⤵
  PID:9796
- C:\Windows\System\wPdIVqH.exe
  C:\Windows\System\wPdIVqH.exe
  2⤵
  PID:9824
- C:\Windows\System\beGaXhk.exe
  C:\Windows\System\beGaXhk.exe
  2⤵
  PID:9852
- C:\Windows\System\BJaYbqr.exe
  C:\Windows\System\BJaYbqr.exe
  2⤵
  PID:9880
- C:\Windows\System\WQjJLxb.exe
  C:\Windows\System\WQjJLxb.exe
  2⤵
  PID:9904
- C:\Windows\System\LrhWrsq.exe
  C:\Windows\System\LrhWrsq.exe
  2⤵
  PID:9936
- C:\Windows\System\ihkimgQ.exe
  C:\Windows\System\ihkimgQ.exe
  2⤵
  PID:9956
- C:\Windows\System\XtZaIuS.exe
  C:\Windows\System\XtZaIuS.exe
  2⤵
  PID:9992
- C:\Windows\System\IsbukJp.exe
  C:\Windows\System\IsbukJp.exe
  2⤵
  PID:10020
- C:\Windows\System\ZZNQihF.exe
  C:\Windows\System\ZZNQihF.exe
  2⤵
  PID:10040
- C:\Windows\System\WkfEUXy.exe
  C:\Windows\System\WkfEUXy.exe
  2⤵
  PID:10064
- C:\Windows\System\dRXwEHn.exe
  C:\Windows\System\dRXwEHn.exe
  2⤵
  PID:10084
- C:\Windows\System\UxJoZJT.exe
  C:\Windows\System\UxJoZJT.exe
  2⤵
  PID:10124
- C:\Windows\System\SPtEwYy.exe
  C:\Windows\System\SPtEwYy.exe
  2⤵
  PID:10148
- C:\Windows\System\HHhuegY.exe
  C:\Windows\System\HHhuegY.exe
  2⤵
  PID:10176
- C:\Windows\System\kHjRCtD.exe
  C:\Windows\System\kHjRCtD.exe
  2⤵
  PID:10204
- C:\Windows\System\utoVqww.exe
  C:\Windows\System\utoVqww.exe
  2⤵
  PID:10232
- C:\Windows\System\OVEtfrT.exe
  C:\Windows\System\OVEtfrT.exe
  2⤵
  PID:9240
- C:\Windows\System\pdgBsbc.exe
  C:\Windows\System\pdgBsbc.exe
  2⤵
  PID:9308
- C:\Windows\System\fTTtCmg.exe
  C:\Windows\System\fTTtCmg.exe
  2⤵
  PID:9400
- C:\Windows\System\vbWkvOk.exe
  C:\Windows\System\vbWkvOk.exe
  2⤵
  PID:9476
- C:\Windows\System\dNuiiUH.exe
  C:\Windows\System\dNuiiUH.exe
  2⤵
  PID:9500
- C:\Windows\System\QvqbfoK.exe
  C:\Windows\System\QvqbfoK.exe
  2⤵
  PID:9608
- C:\Windows\System\RpJvlfY.exe
  C:\Windows\System\RpJvlfY.exe
  2⤵
  PID:9572
- C:\Windows\System\QeCXXHf.exe
  C:\Windows\System\QeCXXHf.exe
  2⤵
  PID:9684
- C:\Windows\System\uRplqbt.exe
  C:\Windows\System\uRplqbt.exe
  2⤵
  PID:9792
- C:\Windows\System\TiPUWOd.exe
  C:\Windows\System\TiPUWOd.exe
  2⤵
  PID:9844
- C:\Windows\System\ElDdNpV.exe
  C:\Windows\System\ElDdNpV.exe
  2⤵
  PID:9864
- C:\Windows\System\RcQTTQk.exe
  C:\Windows\System\RcQTTQk.exe
  2⤵
  PID:9972
- C:\Windows\System\Npqlhsi.exe
  C:\Windows\System\Npqlhsi.exe
  2⤵
  PID:10004
- C:\Windows\System\Baxufyl.exe
  C:\Windows\System\Baxufyl.exe
  2⤵
  PID:10060
- C:\Windows\System\zfkkctm.exe
  C:\Windows\System\zfkkctm.exe
  2⤵
  PID:10116
- C:\Windows\System\sFvWhVz.exe
  C:\Windows\System\sFvWhVz.exe
  2⤵
  PID:10192
- C:\Windows\System\wROnsPB.exe
  C:\Windows\System\wROnsPB.exe
  2⤵
  PID:9256
- C:\Windows\System\QmYISBK.exe
  C:\Windows\System\QmYISBK.exe
  2⤵
  PID:9520
- C:\Windows\System\qPuzLgF.exe
  C:\Windows\System\qPuzLgF.exe
  2⤵
  PID:8508
- C:\Windows\System\FLiskRQ.exe
  C:\Windows\System\FLiskRQ.exe
  2⤵
  PID:9840
- C:\Windows\System\QtHvINY.exe
  C:\Windows\System\QtHvINY.exe
  2⤵
  PID:9924
- C:\Windows\System\mWunFVC.exe
  C:\Windows\System\mWunFVC.exe
  2⤵
  PID:10056
- C:\Windows\System\RCveHcU.exe
  C:\Windows\System\RCveHcU.exe
  2⤵
  PID:10220
- C:\Windows\System\wyLTVNH.exe
  C:\Windows\System\wyLTVNH.exe
  2⤵
  PID:9624
- C:\Windows\System\AhkOQyx.exe
  C:\Windows\System\AhkOQyx.exe
  2⤵
  PID:9916
- C:\Windows\System\LiIHVpk.exe
  C:\Windows\System\LiIHVpk.exe
  2⤵
  PID:10248
- C:\Windows\System\kBfTJPV.exe
  C:\Windows\System\kBfTJPV.exe
  2⤵
  PID:10276
- C:\Windows\System\XPEpUcj.exe
  C:\Windows\System\XPEpUcj.exe
  2⤵
  PID:10304
- C:\Windows\System\BzMdbLv.exe
  C:\Windows\System\BzMdbLv.exe
  2⤵
  PID:10320
- C:\Windows\System\oBQfadj.exe
  C:\Windows\System\oBQfadj.exe
  2⤵
  PID:10348
- C:\Windows\System\RuKrlez.exe
  C:\Windows\System\RuKrlez.exe
  2⤵
  PID:10392
- C:\Windows\System\cCdJEvR.exe
  C:\Windows\System\cCdJEvR.exe
  2⤵
  PID:10420
- C:\Windows\System\yJwAZHM.exe
  C:\Windows\System\yJwAZHM.exe
  2⤵
  PID:10436
- C:\Windows\System\kdKEEwg.exe
  C:\Windows\System\kdKEEwg.exe
  2⤵
  PID:10476
- C:\Windows\System\YHleWHd.exe
  C:\Windows\System\YHleWHd.exe
  2⤵
  PID:10492
- C:\Windows\System\gvpggCV.exe
  C:\Windows\System\gvpggCV.exe
  2⤵
  PID:10524
- C:\Windows\System\hrWwLOk.exe
  C:\Windows\System\hrWwLOk.exe
  2⤵
  PID:10548
- C:\Windows\System\pfvooif.exe
  C:\Windows\System\pfvooif.exe
  2⤵
  PID:10588
- C:\Windows\System\DYQLrNj.exe
  C:\Windows\System\DYQLrNj.exe
  2⤵
  PID:10616
- C:\Windows\System\KWVwBah.exe
  C:\Windows\System\KWVwBah.exe
  2⤵
  PID:10636
- C:\Windows\System\HPlOfYN.exe
  C:\Windows\System\HPlOfYN.exe
  2⤵
  PID:10660
- C:\Windows\System\YjbYwVe.exe
  C:\Windows\System\YjbYwVe.exe
  2⤵
  PID:10688
- C:\Windows\System\gpSIaCP.exe
  C:\Windows\System\gpSIaCP.exe
  2⤵
  PID:10728
- C:\Windows\System\XYaXdzQ.exe
  C:\Windows\System\XYaXdzQ.exe
  2⤵
  PID:10756
- C:\Windows\System\KKPpNuX.exe
  C:\Windows\System\KKPpNuX.exe
  2⤵
  PID:10772
- C:\Windows\System\JLCTjPC.exe
  C:\Windows\System\JLCTjPC.exe
  2⤵
  PID:10792
- C:\Windows\System\slGEZHj.exe
  C:\Windows\System\slGEZHj.exe
  2⤵
  PID:10820
- C:\Windows\System\WLsqgHB.exe
  C:\Windows\System\WLsqgHB.exe
  2⤵
  PID:10852
- C:\Windows\System\gUloLnM.exe
  C:\Windows\System\gUloLnM.exe
  2⤵
  PID:10872
- C:\Windows\System\DnuzAhn.exe
  C:\Windows\System\DnuzAhn.exe
  2⤵
  PID:10924
- C:\Windows\System\xEFTDNH.exe
  C:\Windows\System\xEFTDNH.exe
  2⤵
  PID:10952
- C:\Windows\System\JXQxbSs.exe
  C:\Windows\System\JXQxbSs.exe
  2⤵
  PID:10968
- C:\Windows\System\iKRWVbI.exe
  C:\Windows\System\iKRWVbI.exe
  2⤵
  PID:10996
- C:\Windows\System\IeskWIf.exe
  C:\Windows\System\IeskWIf.exe
  2⤵
  PID:11024
- C:\Windows\System\NNIXBjh.exe
  C:\Windows\System\NNIXBjh.exe
  2⤵
  PID:11064
- C:\Windows\System\SjMHaXf.exe
  C:\Windows\System\SjMHaXf.exe
  2⤵
  PID:11092
- C:\Windows\System\qtbtoyB.exe
  C:\Windows\System\qtbtoyB.exe
  2⤵
  PID:11112
- C:\Windows\System\cOEpSlW.exe
  C:\Windows\System\cOEpSlW.exe
  2⤵
  PID:11136
- C:\Windows\System\iDLgjCA.exe
  C:\Windows\System\iDLgjCA.exe
  2⤵
  PID:11176
- C:\Windows\System\lRkLclu.exe
  C:\Windows\System\lRkLclu.exe
  2⤵
  PID:11204
- C:\Windows\System\AKjAWDi.exe
  C:\Windows\System\AKjAWDi.exe
  2⤵
  PID:11232
- C:\Windows\System\UzERggr.exe
  C:\Windows\System\UzERggr.exe
  2⤵
  PID:11252
- C:\Windows\System\GgEdApN.exe
  C:\Windows\System\GgEdApN.exe
  2⤵
  PID:10292
- C:\Windows\System\pQNLciK.exe
  C:\Windows\System\pQNLciK.exe
  2⤵
  PID:10376
- C:\Windows\System\EZbBNeZ.exe
  C:\Windows\System\EZbBNeZ.exe
  2⤵
  PID:10432
- C:\Windows\System\gVQMVkr.exe
  C:\Windows\System\gVQMVkr.exe
  2⤵
  PID:10488
- C:\Windows\System\OgKpext.exe
  C:\Windows\System\OgKpext.exe
  2⤵
  PID:10564
- C:\Windows\System\CzVBPsn.exe
  C:\Windows\System\CzVBPsn.exe
  2⤵
  PID:10604
- C:\Windows\System\bDyhDny.exe
  C:\Windows\System\bDyhDny.exe
  2⤵
  PID:10644
- C:\Windows\System\BUBVSjm.exe
  C:\Windows\System\BUBVSjm.exe
  2⤵
  PID:10720
- C:\Windows\System\rDdjhlA.exe
  C:\Windows\System\rDdjhlA.exe
  2⤵
  PID:10764
- C:\Windows\System\AiTGoYF.exe
  C:\Windows\System\AiTGoYF.exe
  2⤵
  PID:10836
- C:\Windows\System\RIOlKxL.exe
  C:\Windows\System\RIOlKxL.exe
  2⤵
  PID:10900
- C:\Windows\System\OwCtdvi.exe
  C:\Windows\System\OwCtdvi.exe
  2⤵
  PID:10964
- C:\Windows\System\txNXdwA.exe
  C:\Windows\System\txNXdwA.exe
  2⤵
  PID:11060
- C:\Windows\System\MQrmdvz.exe
  C:\Windows\System\MQrmdvz.exe
  2⤵
  PID:11080
- C:\Windows\System\IVvXaXm.exe
  C:\Windows\System\IVvXaXm.exe
  2⤵
  PID:11216
- C:\Windows\System\yehTdJO.exe
  C:\Windows\System\yehTdJO.exe
  2⤵
  PID:10260
- C:\Windows\System\BMGMnve.exe
  C:\Windows\System\BMGMnve.exe
  2⤵
  PID:10404
- C:\Windows\System\wEOlAfI.exe
  C:\Windows\System\wEOlAfI.exe
  2⤵
  PID:10484
- C:\Windows\System\LzseuCB.exe
  C:\Windows\System\LzseuCB.exe
  2⤵
  PID:10656
- C:\Windows\System\hyDARFI.exe
  C:\Windows\System\hyDARFI.exe
  2⤵
  PID:10816
- C:\Windows\System\jWUPOgV.exe
  C:\Windows\System\jWUPOgV.exe
  2⤵
  PID:11040
- C:\Windows\System\FqEsiYS.exe
  C:\Windows\System\FqEsiYS.exe
  2⤵
  PID:11192
- C:\Windows\System\rrdWrHe.exe
  C:\Windows\System\rrdWrHe.exe
  2⤵
  PID:10332
- C:\Windows\System\MdkYJwr.exe
  C:\Windows\System\MdkYJwr.exe
  2⤵
  PID:10532
- C:\Windows\System\sVZbJNL.exe
  C:\Windows\System\sVZbJNL.exe
  2⤵
  PID:11156
- C:\Windows\System\YqlSfJD.exe
  C:\Windows\System\YqlSfJD.exe
  2⤵
  PID:10580
- C:\Windows\System\fRWokIB.exe
  C:\Windows\System\fRWokIB.exe
  2⤵
  PID:11132
- C:\Windows\System\MtNWvqV.exe
  C:\Windows\System\MtNWvqV.exe
  2⤵
  PID:11280
- C:\Windows\System\MlpdsFh.exe
  C:\Windows\System\MlpdsFh.exe
  2⤵
  PID:11300
- C:\Windows\System\qUJaPWe.exe
  C:\Windows\System\qUJaPWe.exe
  2⤵
  PID:11320
- C:\Windows\System\dDWKlkR.exe
  C:\Windows\System\dDWKlkR.exe
  2⤵
  PID:11344
- C:\Windows\System\XNDnNqP.exe
  C:\Windows\System\XNDnNqP.exe
  2⤵
  PID:11376
- C:\Windows\System\qVwFnsX.exe
  C:\Windows\System\qVwFnsX.exe
  2⤵
  PID:11436
- C:\Windows\System\EcMmXGf.exe
  C:\Windows\System\EcMmXGf.exe
  2⤵
  PID:11464
- C:\Windows\System\IEqWnFM.exe
  C:\Windows\System\IEqWnFM.exe
  2⤵
  PID:11492
- C:\Windows\System\coNnXJE.exe
  C:\Windows\System\coNnXJE.exe
  2⤵
  PID:11512
- C:\Windows\System\ZrlzQfT.exe
  C:\Windows\System\ZrlzQfT.exe
  2⤵
  PID:11536
- C:\Windows\System\YLopCsZ.exe
  C:\Windows\System\YLopCsZ.exe
  2⤵
  PID:11564
- C:\Windows\System\YURDyJP.exe
  C:\Windows\System\YURDyJP.exe
  2⤵
  PID:11596
- C:\Windows\System\BGwxgDt.exe
  C:\Windows\System\BGwxgDt.exe
  2⤵
  PID:11632
- C:\Windows\System\KRfLhHT.exe
  C:\Windows\System\KRfLhHT.exe
  2⤵
  PID:11648
- C:\Windows\System\MwythSk.exe
  C:\Windows\System\MwythSk.exe
  2⤵
  PID:11676
- C:\Windows\System\rGOrOXg.exe
  C:\Windows\System\rGOrOXg.exe
  2⤵
  PID:11708
- C:\Windows\System\BxiLbnV.exe
  C:\Windows\System\BxiLbnV.exe
  2⤵
  PID:11732
- C:\Windows\System\IPScaMB.exe
  C:\Windows\System\IPScaMB.exe
  2⤵
  PID:11760
- C:\Windows\System\mCDtcwa.exe
  C:\Windows\System\mCDtcwa.exe
  2⤵
  PID:11800
- C:\Windows\System\UkZwVTI.exe
  C:\Windows\System\UkZwVTI.exe
  2⤵
  PID:11828
- C:\Windows\System\skCQvUc.exe
  C:\Windows\System\skCQvUc.exe
  2⤵
  PID:11856
- C:\Windows\System\MTltozw.exe
  C:\Windows\System\MTltozw.exe
  2⤵
  PID:11872
- C:\Windows\System\TqykpdS.exe
  C:\Windows\System\TqykpdS.exe
  2⤵
  PID:11900
- C:\Windows\System\aMsxOxf.exe
  C:\Windows\System\aMsxOxf.exe
  2⤵
  PID:11928
- C:\Windows\System\wGgGgFd.exe
  C:\Windows\System\wGgGgFd.exe
  2⤵
  PID:11956
- C:\Windows\System\AkDvgSQ.exe
  C:\Windows\System\AkDvgSQ.exe
  2⤵
  PID:11996
- C:\Windows\System\vuhRnGP.exe
  C:\Windows\System\vuhRnGP.exe
  2⤵
  PID:12012
- C:\Windows\System\xQjRxxe.exe
  C:\Windows\System\xQjRxxe.exe
  2⤵
  PID:12040
- C:\Windows\System\pbrPnKU.exe
  C:\Windows\System\pbrPnKU.exe
  2⤵
  PID:12080
- C:\Windows\System\JatswoY.exe
  C:\Windows\System\JatswoY.exe
  2⤵
  PID:12108
- C:\Windows\System\komgvwI.exe
  C:\Windows\System\komgvwI.exe
  2⤵
  PID:12124
- C:\Windows\System\ixNbvNq.exe
  C:\Windows\System\ixNbvNq.exe
  2⤵
  PID:12144
- C:\Windows\System\HuTCfrh.exe
  C:\Windows\System\HuTCfrh.exe
  2⤵
  PID:12176
- C:\Windows\System\ddXwerj.exe
  C:\Windows\System\ddXwerj.exe
  2⤵
  PID:12200
- C:\Windows\System\fFbSHnP.exe
  C:\Windows\System\fFbSHnP.exe
  2⤵
  PID:12220
- C:\Windows\System\GrdiUbt.exe
  C:\Windows\System\GrdiUbt.exe
  2⤵
  PID:12244
- C:\Windows\System\hHbluqg.exe
  C:\Windows\System\hHbluqg.exe
  2⤵
  PID:12264
- C:\Windows\System\ZgvTlFO.exe
  C:\Windows\System\ZgvTlFO.exe
  2⤵
  PID:11084
- C:\Windows\System\piHjdpE.exe
  C:\Windows\System\piHjdpE.exe
  2⤵
  PID:11316
- C:\Windows\System\xWPOzak.exe
  C:\Windows\System\xWPOzak.exe
  2⤵
  PID:11416
- C:\Windows\System\ECLihRm.exe
  C:\Windows\System\ECLihRm.exe
  2⤵
  PID:11476
- C:\Windows\System\pdGzHOD.exe
  C:\Windows\System\pdGzHOD.exe
  2⤵
  PID:11580
- C:\Windows\System\IbjHzjP.exe
  C:\Windows\System\IbjHzjP.exe
  2⤵
  PID:11640
- C:\Windows\System\WOkiHTY.exe
  C:\Windows\System\WOkiHTY.exe
  2⤵
  PID:11724
- C:\Windows\System\BhAFynj.exe
  C:\Windows\System\BhAFynj.exe
  2⤵
  PID:11792
- C:\Windows\System\NDSroDA.exe
  C:\Windows\System\NDSroDA.exe
  2⤵
  PID:11868
- C:\Windows\System\hRpkoSC.exe
  C:\Windows\System\hRpkoSC.exe
  2⤵
  PID:11940
- C:\Windows\System\iXvOvCA.exe
  C:\Windows\System\iXvOvCA.exe
  2⤵
  PID:11972
- C:\Windows\System\FTyGCDb.exe
  C:\Windows\System\FTyGCDb.exe
  2⤵
  PID:12024
- C:\Windows\System\RhOKmJl.exe
  C:\Windows\System\RhOKmJl.exe
  2⤵
  PID:12120
- C:\Windows\System\loqyozx.exe
  C:\Windows\System\loqyozx.exe
  2⤵
  PID:12156
- C:\Windows\System\FXBfqSF.exe
  C:\Windows\System\FXBfqSF.exe
  2⤵
  PID:12256
- C:\Windows\System\CHpoPbw.exe
  C:\Windows\System\CHpoPbw.exe
  2⤵
  PID:11352
- C:\Windows\System\EbfvpJJ.exe
  C:\Windows\System\EbfvpJJ.exe
  2⤵
  PID:11484
- C:\Windows\System\JmgKCZx.exe
  C:\Windows\System\JmgKCZx.exe
  2⤵
  PID:11616
- C:\Windows\System\pORVSbi.exe
  C:\Windows\System\pORVSbi.exe
  2⤵
  PID:11840
- C:\Windows\System\hIUfKRK.exe
  C:\Windows\System\hIUfKRK.exe
  2⤵
  PID:11948
- C:\Windows\System\HCucxnX.exe
  C:\Windows\System\HCucxnX.exe
  2⤵
  PID:12076
- C:\Windows\System\QNpVlFq.exe
  C:\Windows\System\QNpVlFq.exe
  2⤵
  PID:12196
- C:\Windows\System\zgipxKD.exe
  C:\Windows\System\zgipxKD.exe
  2⤵
  PID:12284
- C:\Windows\System\kARxGBH.exe
  C:\Windows\System\kARxGBH.exe
  2⤵
  PID:11688
- C:\Windows\System\nxNziSW.exe
  C:\Windows\System\nxNziSW.exe
  2⤵
  PID:12132
- C:\Windows\System\YVgYvlK.exe
  C:\Windows\System\YVgYvlK.exe
  2⤵
  PID:11360
- C:\Windows\System\wVnaOob.exe
  C:\Windows\System\wVnaOob.exe
  2⤵
  PID:12292
- C:\Windows\System\hCxsbWK.exe
  C:\Windows\System\hCxsbWK.exe
  2⤵
  PID:12320
- C:\Windows\System\KpSBEtG.exe
  C:\Windows\System\KpSBEtG.exe
  2⤵
  PID:12340
- C:\Windows\System\AGuEjXt.exe
  C:\Windows\System\AGuEjXt.exe
  2⤵
  PID:12364
- C:\Windows\System\SBuiuKW.exe
  C:\Windows\System\SBuiuKW.exe
  2⤵
  PID:12380
- C:\Windows\System\ZNSfuhY.exe
  C:\Windows\System\ZNSfuhY.exe
  2⤵
  PID:12440
- C:\Windows\System\ztXdvON.exe
  C:\Windows\System\ztXdvON.exe
  2⤵
  PID:12464
- C:\Windows\System\QxaOFNp.exe
  C:\Windows\System\QxaOFNp.exe
  2⤵
  PID:12484
- C:\Windows\System\cjrqSZu.exe
  C:\Windows\System\cjrqSZu.exe
  2⤵
  PID:12512
- C:\Windows\System\oEGJUXO.exe
  C:\Windows\System\oEGJUXO.exe
  2⤵
  PID:12536
- C:\Windows\System\NMEJLtC.exe
  C:\Windows\System\NMEJLtC.exe
  2⤵
  PID:12568
- C:\Windows\System\SLqUQIO.exe
  C:\Windows\System\SLqUQIO.exe
  2⤵
  PID:12592
- C:\Windows\System\abCQDtt.exe
  C:\Windows\System\abCQDtt.exe
  2⤵
  PID:12640
- C:\Windows\System\wVRroLt.exe
  C:\Windows\System\wVRroLt.exe
  2⤵
  PID:12672
- C:\Windows\System\gMXKJlW.exe
  C:\Windows\System\gMXKJlW.exe
  2⤵
  PID:12696
- C:\Windows\System\fnNxolI.exe
  C:\Windows\System\fnNxolI.exe
  2⤵
  PID:12724
- C:\Windows\System\KJSJiFW.exe
  C:\Windows\System\KJSJiFW.exe
  2⤵
  PID:12752
- C:\Windows\System\qSHljac.exe
  C:\Windows\System\qSHljac.exe
  2⤵
  PID:12780
- C:\Windows\System\npVSjFx.exe
  C:\Windows\System\npVSjFx.exe
  2⤵
  PID:12808
- C:\Windows\System\HMUfvrK.exe
  C:\Windows\System\HMUfvrK.exe
  2⤵
  PID:12836
- C:\Windows\System\TjsqNBR.exe
  C:\Windows\System\TjsqNBR.exe
  2⤵
  PID:12864
- C:\Windows\System\NdiOQbu.exe
  C:\Windows\System\NdiOQbu.exe
  2⤵
  PID:12892
- C:\Windows\System\xUKtlvJ.exe
  C:\Windows\System\xUKtlvJ.exe
  2⤵
  PID:12920
- C:\Windows\System\AeCJIXC.exe
  C:\Windows\System\AeCJIXC.exe
  2⤵
  PID:12948
- C:\Windows\System\rlzzatb.exe
  C:\Windows\System\rlzzatb.exe
  2⤵
  PID:12976
- C:\Windows\System\ZTvxzpH.exe
  C:\Windows\System\ZTvxzpH.exe
  2⤵
  PID:12992
- C:\Windows\System\RopMBKD.exe
  C:\Windows\System\RopMBKD.exe
  2⤵
  PID:13020
- C:\Windows\System\nmezgws.exe
  C:\Windows\System\nmezgws.exe
  2⤵
  PID:13044
- C:\Windows\System\RLOwQkb.exe
  C:\Windows\System\RLOwQkb.exe
  2⤵
  PID:13068
- C:\Windows\System\BAdjIaO.exe
  C:\Windows\System\BAdjIaO.exe
  2⤵
  PID:13100
- C:\Windows\System\tecEOtH.exe
  C:\Windows\System\tecEOtH.exe
  2⤵
  PID:13152
- C:\Windows\System\ckjzSmZ.exe
  C:\Windows\System\ckjzSmZ.exe
  2⤵
  PID:13180
- C:\Windows\System\QNSunGU.exe
  C:\Windows\System\QNSunGU.exe
  2⤵
  PID:13204
- C:\Windows\System\CEflies.exe
  C:\Windows\System\CEflies.exe
  2⤵
  PID:13232
- C:\Windows\System\bfuGSeD.exe
  C:\Windows\System\bfuGSeD.exe
  2⤵
  PID:13256
- C:\Windows\System\NxajEfV.exe
  C:\Windows\System\NxajEfV.exe
  2⤵
  PID:13284
- C:\Windows\System\VaSwkak.exe
  C:\Windows\System\VaSwkak.exe
  2⤵
  PID:12328
- C:\Windows\System\PrRulyG.exe
  C:\Windows\System\PrRulyG.exe
  2⤵
  PID:12412
- C:\Windows\System\ApItBpW.exe
  C:\Windows\System\ApItBpW.exe
  2⤵
  PID:12472
- C:\Windows\System\ZRsbQch.exe
  C:\Windows\System\ZRsbQch.exe
  2⤵
  PID:12580
- C:\Windows\System\pHyFONs.exe
  C:\Windows\System\pHyFONs.exe
  2⤵
  PID:12624
- C:\Windows\System\kKqznOV.exe
  C:\Windows\System\kKqznOV.exe
  2⤵
  PID:12668
- C:\Windows\System\FSleFRz.exe
  C:\Windows\System\FSleFRz.exe
  2⤵
  PID:12772
- C:\Windows\System\oXkyUsF.exe
  C:\Windows\System\oXkyUsF.exe
  2⤵
  PID:12804
- C:\Windows\System\RUfDmHu.exe
  C:\Windows\System\RUfDmHu.exe
  2⤵
  PID:12856
- C:\Windows\System\nyzOHaR.exe
  C:\Windows\System\nyzOHaR.exe
  2⤵
  PID:12968
- C:\Windows\System\IpBlupT.exe
  C:\Windows\System\IpBlupT.exe
  2⤵
  PID:13036
- C:\Windows\System\mysyOsQ.exe
  C:\Windows\System\mysyOsQ.exe
  2⤵
  PID:13064
- C:\Windows\System\KqHNZsm.exe
  C:\Windows\System\KqHNZsm.exe
  2⤵
  PID:13164
- C:\Windows\System\MZTVagg.exe
  C:\Windows\System\MZTVagg.exe
  2⤵
  PID:13276
- C:\Windows\System\jJnGbZE.exe
  C:\Windows\System\jJnGbZE.exe
  2⤵
  PID:12416
- C:\Windows\System\JUsLnZw.exe
  C:\Windows\System\JUsLnZw.exe
  2⤵
  PID:12720
- C:\Windows\System\SkZnROY.exe
  C:\Windows\System\SkZnROY.exe
  2⤵
  PID:12932
- C:\Windows\System\lkwiufH.exe
  C:\Windows\System\lkwiufH.exe
  2⤵
  PID:12988
- C:\Windows\System\ckMgKEj.exe
  C:\Windows\System\ckMgKEj.exe
  2⤵
  PID:13248
- C:\Windows\System\zqebbbN.exe
  C:\Windows\System\zqebbbN.exe
  2⤵
  PID:12800
- C:\Windows\System\ZJuhqXJ.exe
  C:\Windows\System\ZJuhqXJ.exe
  2⤵
  PID:13088
- C:\Windows\System\zYaxqmH.exe
  C:\Windows\System\zYaxqmH.exe
  2⤵
  PID:13280
- C:\Windows\System\hKkxYIb.exe
  C:\Windows\System\hKkxYIb.exe
  2⤵
  PID:13336
- C:\Windows\System\mgWsgIQ.exe
  C:\Windows\System\mgWsgIQ.exe
  2⤵
  PID:13396
- C:\Windows\System\DeoWZZU.exe
  C:\Windows\System\DeoWZZU.exe
  2⤵
  PID:13412
- C:\Windows\System\zPtsEUY.exe
  C:\Windows\System\zPtsEUY.exe
  2⤵
  PID:13436
- C:\Windows\System\EUiiRTU.exe
  C:\Windows\System\EUiiRTU.exe
  2⤵
  PID:13472
- C:\Windows\System\aRhpmAx.exe
  C:\Windows\System\aRhpmAx.exe
  2⤵
  PID:13496
- C:\Windows\System\AJteXmK.exe
  C:\Windows\System\AJteXmK.exe
  2⤵
  PID:13528
- C:\Windows\System\HxuBJDv.exe
  C:\Windows\System\HxuBJDv.exe
  2⤵
  PID:13544
- C:\Windows\System\vVTddzV.exe
  C:\Windows\System\vVTddzV.exe
  2⤵
  PID:13572
- C:\Windows\System\VoaXACb.exe
  C:\Windows\System\VoaXACb.exe
  2⤵
  PID:13588
- C:\Windows\System\bBvtJzL.exe
  C:\Windows\System\bBvtJzL.exe
  2⤵
  PID:13612
- C:\Windows\System\RRYhHGs.exe
  C:\Windows\System\RRYhHGs.exe
  2⤵
  PID:13636
- C:\Windows\System\osBMTFM.exe
  C:\Windows\System\osBMTFM.exe
  2⤵
  PID:13672
- C:\Windows\System\ovdqWUe.exe
  C:\Windows\System\ovdqWUe.exe
  2⤵
  PID:13736
- C:\Windows\System\HdgHVbd.exe
  C:\Windows\System\HdgHVbd.exe
  2⤵
  PID:13768
- C:\Windows\System\YTwmfEx.exe
  C:\Windows\System\YTwmfEx.exe
  2⤵
  PID:13804
- C:\Windows\System\fxzQHKb.exe
  C:\Windows\System\fxzQHKb.exe
  2⤵
  PID:13824
- C:\Windows\System\YknAIPB.exe
  C:\Windows\System\YknAIPB.exe
  2⤵
  PID:13848
- C:\Windows\System\qgctrpD.exe
  C:\Windows\System\qgctrpD.exe
  2⤵
  PID:13876
- C:\Windows\System\KxhahYP.exe
  C:\Windows\System\KxhahYP.exe
  2⤵
  PID:13908
- C:\Windows\System\cpJcYHu.exe
  C:\Windows\System\cpJcYHu.exe
  2⤵
  PID:13932
- C:\Windows\System\KJusVRy.exe
  C:\Windows\System\KJusVRy.exe
  2⤵
  PID:13948
- C:\Windows\System\LsSYSog.exe
  C:\Windows\System\LsSYSog.exe
  2⤵
  PID:13976
- C:\Windows\System\wsOKOob.exe
  C:\Windows\System\wsOKOob.exe
  2⤵
  PID:14008
- C:\Windows\System\FYQZFTa.exe
  C:\Windows\System\FYQZFTa.exe
  2⤵
  PID:14044
- C:\Windows\System\imMnehY.exe
  C:\Windows\System\imMnehY.exe
  2⤵
  PID:14068
- C:\Windows\System\WRVUnSe.exe
  C:\Windows\System\WRVUnSe.exe
  2⤵
  PID:14088
- C:\Windows\System\dOJddzP.exe
  C:\Windows\System\dOJddzP.exe
  2⤵
  PID:14116
- C:\Windows\System\LapMADN.exe
  C:\Windows\System\LapMADN.exe
  2⤵
  PID:14140
- C:\Windows\System\iNolnpy.exe
  C:\Windows\System\iNolnpy.exe
  2⤵
  PID:14164
- C:\Windows\System\aqOyaQJ.exe
  C:\Windows\System\aqOyaQJ.exe
  2⤵
  PID:14204
- C:\Windows\System\fOoeNOU.exe
  C:\Windows\System\fOoeNOU.exe
  2⤵
  PID:14224
- C:\Windows\System\NkXXfgP.exe
  C:\Windows\System\NkXXfgP.exe
  2⤵
  PID:14248
- C:\Windows\System\CRXuFcO.exe
  C:\Windows\System\CRXuFcO.exe
  2⤵
  PID:14308
- C:\Windows\System\uNrhGTY.exe
  C:\Windows\System\uNrhGTY.exe
  2⤵
  PID:14324
- C:\Windows\System\HlgtSUC.exe
  C:\Windows\System\HlgtSUC.exe
  2⤵
  PID:12884
- C:\Windows\System\pwoHTax.exe
  C:\Windows\System\pwoHTax.exe
  2⤵
  PID:13356
- C:\Windows\System\vVpOtEi.exe
  C:\Windows\System\vVpOtEi.exe
  2⤵
  PID:13372
- C:\Windows\System\KZTjTxs.exe
  C:\Windows\System\KZTjTxs.exe
  2⤵
  PID:13452
- C:\Windows\System\ysRccxD.exe
  C:\Windows\System\ysRccxD.exe
  2⤵
  PID:13608
- C:\Windows\System\HdNFbHF.exe
  C:\Windows\System\HdNFbHF.exe
  2⤵
  PID:13580
- C:\Windows\System\pdUBotW.exe
  C:\Windows\System\pdUBotW.exe
  2⤵
  PID:13656
- C:\Windows\System\QfQRWaO.exe
  C:\Windows\System\QfQRWaO.exe
  2⤵
  PID:13780
- C:\Windows\System\tfTpwIW.exe
  C:\Windows\System\tfTpwIW.exe
  2⤵
  PID:13820
- C:\Windows\System\INWikBb.exe
  C:\Windows\System\INWikBb.exe
  2⤵
  PID:13844
- C:\Windows\System\CzOSuMi.exe
  C:\Windows\System\CzOSuMi.exe
  2⤵
  PID:13992
- C:\Windows\System\LfRAiXe.exe
  C:\Windows\System\LfRAiXe.exe
  2⤵
  PID:14100
- C:\Windows\System\RzEoQYT.exe
  C:\Windows\System\RzEoQYT.exe
  2⤵
  PID:14052
- C:\Windows\System\hDbFLuJ.exe
  C:\Windows\System\hDbFLuJ.exe
  2⤵
  PID:14152
- C:\Windows\System\vAeGGod.exe
  C:\Windows\System\vAeGGod.exe
  2⤵
  PID:14236
- C:\Windows\System\hdQbrns.exe
  C:\Windows\System\hdQbrns.exe
  2⤵
  PID:14296
- C:\Windows\System\EUxDMTq.exe
  C:\Windows\System\EUxDMTq.exe
  2⤵
  PID:14316
- C:\Windows\System\UZmfTXa.exe
  C:\Windows\System\UZmfTXa.exe
  2⤵
  PID:13368
- C:\Windows\System\oROyfms.exe
  C:\Windows\System\oROyfms.exe
  2⤵
  PID:13752
- C:\Windows\System\xlHprFF.exe
  C:\Windows\System\xlHprFF.exe
  2⤵
  PID:13928
- C:\Windows\System\NgPEZIV.exe
  C:\Windows\System\NgPEZIV.exe
  2⤵
  PID:14028
- C:\Windows\System\UxwvBvE.exe
  C:\Windows\System\UxwvBvE.exe
  2⤵
  PID:14080
- C:\Windows\System\cETRnis.exe
  C:\Windows\System\cETRnis.exe
  2⤵
  PID:14264
- C:\Windows\System\rajdeKK.exe
  C:\Windows\System\rajdeKK.exe
  2⤵
  PID:13424
- C:\Windows\System\CivixAN.exe
  C:\Windows\System\CivixAN.exe
  2⤵
  PID:13792
- C:\Windows\System\IEUZdKF.exe
  C:\Windows\System\IEUZdKF.exe
  2⤵
  PID:14136
- C:\Windows\System\VYKWjVt.exe
  C:\Windows\System\VYKWjVt.exe
  2⤵
  PID:13744
- C:\Windows\System\skzDeJy.exe
  C:\Windows\System\skzDeJy.exe
  2⤵
  PID:14356
- C:\Windows\System\lGKChSo.exe
  C:\Windows\System\lGKChSo.exe
  2⤵
  PID:14384
- C:\Windows\System\TWqxpms.exe
  C:\Windows\System\TWqxpms.exe
  2⤵
  PID:14412
- C:\Windows\System\jgSrQZv.exe
  C:\Windows\System\jgSrQZv.exe
  2⤵
  PID:14428
- C:\Windows\System\UbTrUQd.exe
  C:\Windows\System\UbTrUQd.exe
  2⤵
  PID:14444
- C:\Windows\System\lrBkeGz.exe
  C:\Windows\System\lrBkeGz.exe
  2⤵
  PID:14484
- C:\Windows\System\txhtwEK.exe
  C:\Windows\System\txhtwEK.exe
  2⤵
  PID:14508
- C:\Windows\System\YoQeLgA.exe
  C:\Windows\System\YoQeLgA.exe
  2⤵
  PID:14536
- C:\Windows\System\mVRXqqf.exe
  C:\Windows\System\mVRXqqf.exe
  2⤵
  PID:14560
- C:\Windows\System\tGJyHIX.exe
  C:\Windows\System\tGJyHIX.exe
  2⤵
  PID:14608
- C:\Windows\System\DKAmSPy.exe
  C:\Windows\System\DKAmSPy.exe
  2⤵
  PID:14636
- C:\Windows\System\xeOMBsS.exe
  C:\Windows\System\xeOMBsS.exe
  2⤵
  PID:14664
- C:\Windows\System\dbSIvtP.exe
  C:\Windows\System\dbSIvtP.exe
  2⤵
  PID:14680
- C:\Windows\System\sxawhJg.exe
  C:\Windows\System\sxawhJg.exe
  2⤵
  PID:14700
- C:\Windows\System\nxsXInq.exe
  C:\Windows\System\nxsXInq.exe
  2⤵
  PID:14732
- C:\Windows\System\qMiwZTG.exe
  C:\Windows\System\qMiwZTG.exe
  2⤵
  PID:14776
- C:\Windows\System\IEMRQvi.exe
  C:\Windows\System\IEMRQvi.exe
  2⤵
  PID:14804
- C:\Windows\System\OTUiydX.exe
  C:\Windows\System\OTUiydX.exe
  2⤵
  PID:14832
- C:\Windows\System\EKZZDsq.exe
  C:\Windows\System\EKZZDsq.exe
  2⤵
  PID:14852
- C:\Windows\System\IsUxksl.exe
  C:\Windows\System\IsUxksl.exe
  2⤵
  PID:14880
- C:\Windows\System\OjMcNBh.exe
  C:\Windows\System\OjMcNBh.exe
  2⤵
  PID:14900
- C:\Windows\System\yUJSPMO.exe
  C:\Windows\System\yUJSPMO.exe
  2⤵
  PID:14928
- C:\Windows\System\UBEqWps.exe
  C:\Windows\System\UBEqWps.exe
  2⤵
  PID:14952
- C:\Windows\System\CaQKSlt.exe
  C:\Windows\System\CaQKSlt.exe
  2⤵
  PID:14968
- C:\Windows\System\gcGQeCx.exe
  C:\Windows\System\gcGQeCx.exe
  2⤵
  PID:15032
- C:\Windows\System\TFeugjV.exe
  C:\Windows\System\TFeugjV.exe
  2⤵
  PID:15056
- C:\Windows\System\JKDUjgl.exe
  C:\Windows\System\JKDUjgl.exe
  2⤵
  PID:15088
- C:\Windows\System\QkgPjlg.exe
  C:\Windows\System\QkgPjlg.exe
  2⤵
  PID:15116
- C:\Windows\System\yNLELYe.exe
  C:\Windows\System\yNLELYe.exe
  2⤵
  PID:15144
- C:\Windows\System\jPsxDeh.exe
  C:\Windows\System\jPsxDeh.exe
  2⤵
  PID:15160
- C:\Windows\System\lCtPvsR.exe
  C:\Windows\System\lCtPvsR.exe
  2⤵
  PID:15188
- C:\Windows\System\MXrcPPi.exe
  C:\Windows\System\MXrcPPi.exe
  2⤵
  PID:15216
- C:\Windows\System\VTZCHdQ.exe
  C:\Windows\System\VTZCHdQ.exe
  2⤵
  PID:15244
- C:\Windows\System\VUnntOx.exe
  C:\Windows\System\VUnntOx.exe
  2⤵
  PID:15272
- C:\Windows\System\vIUXRft.exe
  C:\Windows\System\vIUXRft.exe
  2⤵
  PID:15300
- C:\Windows\System\wUrevXW.exe
  C:\Windows\System\wUrevXW.exe
  2⤵
  PID:15328
- C:\Windows\System\PIdpyaE.exe
  C:\Windows\System\PIdpyaE.exe
  2⤵
  PID:15356
- C:\Windows\System\kvSflJf.exe
  C:\Windows\System\kvSflJf.exe
  2⤵
  PID:14372
- C:\Windows\System\aTCRXPn.exe
  C:\Windows\System\aTCRXPn.exe
  2⤵
  PID:14476
- C:\Windows\System\zFcEtyD.exe
  C:\Windows\System\zFcEtyD.exe
  2⤵
  PID:14520
- C:\Windows\System\JtAQEKu.exe
  C:\Windows\System\JtAQEKu.exe
  2⤵
  PID:14584
- C:\Windows\System\TGRWljV.exe
  C:\Windows\System\TGRWljV.exe
  2⤵
  PID:14652
- C:\Windows\System\KfIJIaw.exe
  C:\Windows\System\KfIJIaw.exe
  2⤵
  PID:14716
- C:\Windows\System\MxugmRb.exe
  C:\Windows\System\MxugmRb.exe
  2⤵
  PID:14844
- C:\Windows\System\QOsVACR.exe
  C:\Windows\System\QOsVACR.exe
  2⤵
  PID:14848
- C:\Windows\System\tjZoQZv.exe
  C:\Windows\System\tjZoQZv.exe
  2⤵
  PID:14912
- C:\Windows\System\kvueFuy.exe
  C:\Windows\System\kvueFuy.exe
  2⤵
  PID:15016
- C:\Windows\System\EyxQOjn.exe
  C:\Windows\System\EyxQOjn.exe
  2⤵
  PID:15072
- C:\Windows\System\MRnIiKS.exe
  C:\Windows\System\MRnIiKS.exe
  2⤵
  PID:15108
- C:\Windows\System\GzHLolF.exe
  C:\Windows\System\GzHLolF.exe
  2⤵
  PID:15172
- C:\Windows\System\LwlqlCF.exe
  C:\Windows\System\LwlqlCF.exe
  2⤵
  PID:15240
- C:\Windows\System\wMfQwWW.exe
  C:\Windows\System\wMfQwWW.exe
  2⤵
  PID:15296
- C:\Windows\System\JLrDvzR.exe
  C:\Windows\System\JLrDvzR.exe
  2⤵
  PID:14376
- C:\Windows\System\kdLeuZP.exe
  C:\Windows\System\kdLeuZP.exe
  2⤵
  PID:14424
- C:\Windows\System\YoYgaNZ.exe
  C:\Windows\System\YoYgaNZ.exe
  2⤵
  PID:14624
- C:\Windows\System\ymVeqIU.exe
  C:\Windows\System\ymVeqIU.exe
  2⤵
  PID:14708
- C:\Windows\System\HoHGyzP.exe
  C:\Windows\System\HoHGyzP.exe
  2⤵
  PID:14820
- C:\Windows\System\qOvOCNV.exe
  C:\Windows\System\qOvOCNV.exe
  2⤵
  PID:15048
- C:\Windows\System\UyNZAHO.exe
  C:\Windows\System\UyNZAHO.exe
  2⤵
  PID:15228
- C:\Windows\System\ewgVUty.exe
  C:\Windows\System\ewgVUty.exe
  2⤵
  PID:14352
- C:\Windows\System\yTaXyRY.exe
  C:\Windows\System\yTaXyRY.exe
  2⤵
  PID:14800
- C:\Windows\System\NDuHKwP.exe
  C:\Windows\System\NDuHKwP.exe
  2⤵
  PID:14868
- C:\Windows\System\AxRJyVX.exe
  C:\Windows\System\AxRJyVX.exe
  2⤵
  PID:14436
- C:\Windows\System\cEkRpTN.exe
  C:\Windows\System\cEkRpTN.exe
  2⤵
  PID:15348
- C:\Windows\System\ZTTKMMk.exe
  C:\Windows\System\ZTTKMMk.exe
  2⤵
  PID:15384
- C:\Windows\System\EzneGLx.exe
  C:\Windows\System\EzneGLx.exe
  2⤵
  PID:15432
- C:\Windows\System\OejhyDX.exe
  C:\Windows\System\OejhyDX.exe
  2⤵
  PID:15460
- C:\Windows\System\OvugUxv.exe
  C:\Windows\System\OvugUxv.exe
  2⤵
  PID:15488
- C:\Windows\System\miQXVHx.exe
  C:\Windows\System\miQXVHx.exe
  2⤵
  PID:15512
- C:\Windows\System\BORpddr.exe
  C:\Windows\System\BORpddr.exe
  2⤵
  PID:15544
- C:\Windows\System\qwSusGf.exe
  C:\Windows\System\qwSusGf.exe
  2⤵
  PID:15564
- C:\Windows\System\mMBRXYO.exe
  C:\Windows\System\mMBRXYO.exe
  2⤵
  PID:15588
- C:\Windows\System\nGWmdoW.exe
  C:\Windows\System\nGWmdoW.exe
  2⤵
  PID:15616
- C:\Windows\System\QtlxCoX.exe
  C:\Windows\System\QtlxCoX.exe
  2⤵
  PID:15648
- C:\Windows\System\JCYpzxQ.exe
  C:\Windows\System\JCYpzxQ.exe
  2⤵
  PID:15680
- C:\Windows\System\TZSVfDy.exe
  C:\Windows\System\TZSVfDy.exe
  2⤵
  PID:15700
- C:\Windows\System\DLWFkzP.exe
  C:\Windows\System\DLWFkzP.exe
  2⤵
  PID:15728
- C:\Windows\System\VFrgvna.exe
  C:\Windows\System\VFrgvna.exe
  2⤵
  PID:15768
- C:\Windows\System\RoApgGQ.exe
  C:\Windows\System\RoApgGQ.exe
  2⤵
  PID:15796
- C:\Windows\System\gakeavj.exe
  C:\Windows\System\gakeavj.exe
  2⤵
  PID:15816
- C:\Windows\System\NUFwJCJ.exe
  C:\Windows\System\NUFwJCJ.exe
  2⤵
  PID:15840
- C:\Windows\System\ryOZnrx.exe
  C:\Windows\System\ryOZnrx.exe
  2⤵
  PID:15876
- C:\Windows\System\TTHeAQq.exe
  C:\Windows\System\TTHeAQq.exe
  2⤵
  PID:15908
- C:\Windows\System\HxFXIuP.exe
  C:\Windows\System\HxFXIuP.exe
  2⤵
  PID:15936
- C:\Windows\System\rwuLztq.exe
  C:\Windows\System\rwuLztq.exe
  2⤵
  PID:15964
- C:\Windows\System\lgNQBeO.exe
  C:\Windows\System\lgNQBeO.exe
  2⤵
  PID:15992
- C:\Windows\System\tOBGmHL.exe
  C:\Windows\System\tOBGmHL.exe
  2⤵
  PID:16020
- C:\Windows\System\vcAnUpr.exe
  C:\Windows\System\vcAnUpr.exe
  2⤵
  PID:16036
- C:\Windows\System\OfZdXGz.exe
  C:\Windows\System\OfZdXGz.exe
  2⤵
  PID:16064
- C:\Windows\System\GwAuRKL.exe
  C:\Windows\System\GwAuRKL.exe
  2⤵
  PID:16088
- C:\Windows\System\UoVpubu.exe
  C:\Windows\System\UoVpubu.exe
  2⤵
  PID:16112
- C:\Windows\System\xPQVnfN.exe
  C:\Windows\System\xPQVnfN.exe
  2⤵
  PID:16160
- C:\Windows\System\KevLmmW.exe
  C:\Windows\System\KevLmmW.exe
  2⤵
  PID:16176
- C:\Windows\System\UpCHNPB.exe
  C:\Windows\System\UpCHNPB.exe
  2⤵
  PID:16196
- C:\Windows\System\UlToosF.exe
  C:\Windows\System\UlToosF.exe
  2⤵
  PID:16216
- C:\Windows\System\vOfCjWp.exe
  C:\Windows\System\vOfCjWp.exe
  2⤵
  PID:16272
- C:\Windows\System\JwjzhDl.exe
  C:\Windows\System\JwjzhDl.exe
  2⤵
  PID:16292
- C:\Windows\System\czXPnvh.exe
  C:\Windows\System\czXPnvh.exe
  2⤵
  PID:16320
- C:\Windows\System\QsRDxpN.exe
  C:\Windows\System\QsRDxpN.exe
  2⤵
  PID:16344
- C:\Windows\System\Uwfkmjv.exe
  C:\Windows\System\Uwfkmjv.exe
  2⤵
  PID:16372
- C:\Windows\System\tiFdVVI.exe
  C:\Windows\System\tiFdVVI.exe
  2⤵
  PID:14984
- C:\Windows\System\gFDDkri.exe
  C:\Windows\System\gFDDkri.exe
  2⤵
  PID:15444
- C:\Windows\System\IBFOJMU.exe
  C:\Windows\System\IBFOJMU.exe
  2⤵
  PID:15536
- C:\Windows\System\sqVJxEn.exe
  C:\Windows\System\sqVJxEn.exe
  2⤵
  PID:15608
- C:\Windows\System\YqcblpS.exe
  C:\Windows\System\YqcblpS.exe
  2⤵
  PID:15676
- C:\Windows\System\svCnEar.exe
  C:\Windows\System\svCnEar.exe
  2⤵
  PID:15760
- C:\Windows\System\YWOuqAK.exe
  C:\Windows\System\YWOuqAK.exe
  2⤵
  PID:15812
- C:\Windows\System\NlPwwUv.exe
  C:\Windows\System\NlPwwUv.exe
  2⤵
  PID:15872
- C:\Windows\System\ZXlcUVu.exe
  C:\Windows\System\ZXlcUVu.exe
  2⤵
  PID:15920
- C:\Windows\System\MXehZjO.exe
  C:\Windows\System\MXehZjO.exe
  2⤵
  PID:16008
- C:\Windows\System\GXTSAzi.exe
  C:\Windows\System\GXTSAzi.exe
  2⤵
  PID:16048
- C:\Windows\System\WcixlGT.exe
  C:\Windows\System\WcixlGT.exe
  2⤵
  PID:16100
- C:\Windows\System\DWhieHb.exe
  C:\Windows\System\DWhieHb.exe
  2⤵
  PID:16204
- C:\Windows\System\lBjWOTK.exe
  C:\Windows\System\lBjWOTK.exe
  2⤵
  PID:16212
- C:\Windows\System\MZjANfy.exe
  C:\Windows\System\MZjANfy.exe
  2⤵
  PID:16264
- C:\Windows\System\MtceXqp.exe
  C:\Windows\System\MtceXqp.exe
  2⤵
  PID:15372
- C:\Windows\System\GvkZtTm.exe
  C:\Windows\System\GvkZtTm.exe
  2⤵
  PID:15420
- C:\Windows\System\KbcyoKT.exe
  C:\Windows\System\KbcyoKT.exe
  2⤵
  PID:15632
- C:\Windows\System\NoMoUbv.exe
  C:\Windows\System\NoMoUbv.exe
  2⤵
  PID:15716
- C:\Windows\System\RmpZcag.exe
  C:\Windows\System\RmpZcag.exe
  2⤵
  PID:15984
- C:\Windows\System\LAScmgC.exe
  C:\Windows\System\LAScmgC.exe
  2⤵
  PID:16084
- C:\Windows\System\bKCHaCs.exe
  C:\Windows\System\bKCHaCs.exe
  2⤵
  PID:16172
- C:\Windows\System\GSphDJS.exe
  C:\Windows\System\GSphDJS.exe
  2⤵
  PID:15560
- C:\Windows\System\aoudVym.exe
  C:\Windows\System\aoudVym.exe
  2⤵
  PID:15696
- C:\Windows\System\wiHoZBW.exe
  C:\Windows\System\wiHoZBW.exe
  2⤵
  PID:16016
- C:\Windows\System\kQgFGik.exe
  C:\Windows\System\kQgFGik.exe
  2⤵
  PID:16312
- C:\Windows\System\eVwUvTN.exe
  C:\Windows\System\eVwUvTN.exe
  2⤵
  PID:16060
- C:\Windows\System\HXwfFmI.exe
  C:\Windows\System\HXwfFmI.exe
  2⤵
  PID:16404
- C:\Windows\System\dCPSauA.exe
  C:\Windows\System\dCPSauA.exe
  2⤵
  PID:16428
- C:\Windows\System\npWOava.exe
  C:\Windows\System\npWOava.exe
  2⤵
  PID:16472
- C:\Windows\System\Nqsmnib.exe
  C:\Windows\System\Nqsmnib.exe
  2⤵
  PID:16492
- C:\Windows\System\LzFahqe.exe
  C:\Windows\System\LzFahqe.exe
  2⤵
  PID:16516
- C:\Windows\System\gHjWNGJ.exe
  C:\Windows\System\gHjWNGJ.exe
  2⤵
  PID:16544
- C:\Windows\System\geMUZrp.exe
  C:\Windows\System\geMUZrp.exe
  2⤵
  PID:16572
- C:\Windows\System\kJUjszs.exe
  C:\Windows\System\kJUjszs.exe
  2⤵
  PID:16596
- C:\Windows\System\ijPMOtI.exe
  C:\Windows\System\ijPMOtI.exe
  2⤵
  PID:16624
- C:\Windows\System\DmSdBNy.exe
  C:\Windows\System\DmSdBNy.exe
  2⤵
  PID:16648
- C:\Windows\System\cnTAxFn.exe
  C:\Windows\System\cnTAxFn.exe
  2⤵
  PID:16680
- C:\Windows\System\qSYleeg.exe
  C:\Windows\System\qSYleeg.exe
  2⤵
  PID:16700
- C:\Windows\System\ffJMJEF.exe
  C:\Windows\System\ffJMJEF.exe
  2⤵
  PID:16732
- C:\Windows\System\Wmhufpv.exe
  C:\Windows\System\Wmhufpv.exe
  2⤵
  PID:16756
- C:\Windows\System\ROBhKOK.exe
  C:\Windows\System\ROBhKOK.exe
  2⤵
  PID:16784
- C:\Windows\System\VleSbdl.exe
  C:\Windows\System\VleSbdl.exe
  2⤵
  PID:16812
- C:\Windows\System\SHwiren.exe
  C:\Windows\System\SHwiren.exe
  2⤵
  PID:16840
- C:\Windows\System\Lfskyyd.exe
  C:\Windows\System\Lfskyyd.exe
  2⤵
  PID:16864
- C:\Windows\System\ufuHeBe.exe
  C:\Windows\System\ufuHeBe.exe
  2⤵
  PID:16880
- C:\Windows\System\lJdZaDM.exe
  C:\Windows\System\lJdZaDM.exe
  2⤵
  PID:16904
- C:\Windows\System\YxSOdjX.exe
  C:\Windows\System\YxSOdjX.exe
  2⤵
  PID:16936
- C:\Windows\System\cUZVCNi.exe
  C:\Windows\System\cUZVCNi.exe
  2⤵
  PID:16976
- C:\Windows\System\jXoeUmF.exe
  C:\Windows\System\jXoeUmF.exe
  2⤵
  PID:17016
- C:\Windows\System\OKkFJSp.exe
  C:\Windows\System\OKkFJSp.exe
  2⤵
  PID:17052
- C:\Windows\System\BkFPKeF.exe
  C:\Windows\System\BkFPKeF.exe
  2⤵
  PID:17072
- C:\Windows\System\cOwcFwT.exe
  C:\Windows\System\cOwcFwT.exe
  2⤵
  PID:17088
- C:\Windows\System\apzMgpp.exe
  C:\Windows\System\apzMgpp.exe
  2⤵
  PID:17112
- C:\Windows\System\enDnics.exe
  C:\Windows\System\enDnics.exe
  2⤵
  PID:17136
- C:\Windows\System\UVzIhfL.exe
  C:\Windows\System\UVzIhfL.exe
  2⤵
  PID:17152
- C:\Windows\System\syJGEgB.exe
  C:\Windows\System\syJGEgB.exe
  2⤵
  PID:17200
- C:\Windows\System\cmgJJWy.exe
  C:\Windows\System\cmgJJWy.exe
  2⤵
  PID:17236
- C:\Windows\System\odThbNM.exe
  C:\Windows\System\odThbNM.exe
  2⤵
  PID:17284
- C:\Windows\System\PXiwRog.exe
  C:\Windows\System\PXiwRog.exe
  2⤵
  PID:17300
- C:\Windows\System\RJMqfsM.exe
  C:\Windows\System\RJMqfsM.exe
  2⤵
  PID:17324
- C:\Windows\System\gZBmQge.exe
  C:\Windows\System\gZBmQge.exe
  2⤵
  PID:17352
- C:\Windows\System\IUSlMFq.exe
  C:\Windows\System\IUSlMFq.exe
  2⤵
  PID:17372
- C:\Windows\System\HUKaFxG.exe
  C:\Windows\System\HUKaFxG.exe
  2⤵
  PID:17404
- C:\Windows\System\nqXUqRI.exe
  C:\Windows\System\nqXUqRI.exe
  2⤵
  PID:16416
- C:\Windows\System\CKMkYcD.exe
  C:\Windows\System\CKMkYcD.exe
  2⤵
  PID:16456
- C:\Windows\System\riyCZet.exe
  C:\Windows\System\riyCZet.exe
  2⤵
  PID:16564
- C:\Windows\System\CKcpbSy.exe
  C:\Windows\System\CKcpbSy.exe
  2⤵
  PID:16632
- C:\Windows\System\lSYPTDr.exe
  C:\Windows\System\lSYPTDr.exe
  2⤵
  PID:16696
- C:\Windows\System\iFIImlo.exe
  C:\Windows\System\iFIImlo.exe
  2⤵
  PID:16716
- C:\Windows\System\UwfJNTc.exe
  C:\Windows\System\UwfJNTc.exe
  2⤵
  PID:16776
- C:\Windows\System\dqAFikg.exe
  C:\Windows\System\dqAFikg.exe
  2⤵
  PID:16860
- C:\Windows\System\CHUzuuQ.exe
  C:\Windows\System\CHUzuuQ.exe
  2⤵
  PID:16924
- C:\Windows\System\NkHeGMb.exe
  C:\Windows\System\NkHeGMb.exe
  2⤵
  PID:17036
- C:\Windows\System\zVCEaHJ.exe
  C:\Windows\System\zVCEaHJ.exe
  2⤵
  PID:17064
- C:\Windows\System\dARJnCz.exe
  C:\Windows\System\dARJnCz.exe
  2⤵
  PID:17196
- C:\Windows\System\RvPhgHj.exe
  C:\Windows\System\RvPhgHj.exe
  2⤵
  PID:17252
- C:\Windows\System\HRhgnFD.exe
  C:\Windows\System\HRhgnFD.exe
  2⤵
  PID:17292

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:6720

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:17212

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CpVQjBk.exe

Path C:\Windows\System\CpVQjBk.exe
Size 1.5MB
SHA256 d7fd15c665515d803c9caa2c519ff3f381bb9b5370ce14304259ff49c047b235
MD5 0c9f1c163c413d4260b50e0778f2beb0
SHA1 89d6720bdef307cb272d195d5acdeb8d8add80e0
SHA512 7cb9cfc1a55fbe4fec136ea8a8f53bd7e7ad03f705453e2c81fe398b7439de4e6fbaceafbe86e0327fd79b7d647ad1b00fff756e4829cce31021492d68515bfb
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbpwlKenszaDw4B/Os/IOyr7oKKPY:GezaTF8FcNkNdfE0pZ9ozttwIRakGN8D
MD5 SHA1 SHA512 SSDEEP

Submit Download

DCqRtXn.exe

Path C:\Windows\System\DCqRtXn.exe
Size 1.5MB
SHA256 e06979154cf291063ce50d0b5a9f1658460e40b6cdebb79431a1d47ffc4589e3
MD5 aee2ecb939af3cd5958f41dcfa4da8b6
SHA1 dca31eefadaae65400fc53edaae04509af7d298f
SHA512 6d764a4d83458ce1d7049f8398c7705eac02cefc69d819d22dd06dda74a76ba3f9b2043109c0cf320948f54160de34ed87dcb44e7d7f3500ee3fadf526e7ef1c
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbpwlKenszaDw4B/Os/IOyr7oKKPs:GezaTF8FcNkNdfE0pZ9ozttwIRakGN8/
MD5 SHA1 SHA512 SSDEEP

Submit Download

DoobUGd.exe

Path C:\Windows\System\DoobUGd.exe
Size 1.5MB
SHA256 ab549a8d580346249dfe2cdb87d7dc5f76cf6b7c1b23786090cabc9722a08462
MD5 90472ba3d41834d2124eed2f641dec8c
SHA1 41a82ccbb78e76b3f35d339426b1769690492c27
SHA512 e8c7dcac17b2e7bf16616fda72bd8c0e090aceec04166f58663c0af6e95c02ad49d0d2d3136ecf26e3ec0b766dd7c9fa09f3697865f15bc8cf5194ab120ba0d6
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbpwlKenszaDw4B/Os/IOyr7oKKPJ:GezaTF8FcNkNdfE0pZ9ozttwIRakGN8a
MD5 SHA1 SHA512 SSDEEP

Submit Download

FRzCkOj.exe

Path C:\Windows\System\FRzCkOj.exe
Size 1.5MB
SHA256 bd827a44f07f5d849c19869810c678ab2e8105f387c9d9162283240aa9d98169
MD5 5c6c8ba534dd292dcb1a0b05648e3c93
SHA1 ca34483103f5e9ceb0c87ac33fc6b0b4c520edef
SHA512 d1a9c089482390df12090e5cc06774403175fa8156a85b813a6d2f6e9867234d7862ad9d3bc0923ea53270a4293d3d9e7d33cee2ac819321eb403ae8f871fe61
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbpwlKenszaDw4B/Os/IOyr7oKKPC:GezaTF8FcNkNdfE0pZ9ozttwIRakGN83
MD5 SHA1 SHA512 SSDEEP

Submit Download

IHBGALY.exe

Path C:\Windows\System\IHBGALY.exe
Size 1.5MB
SHA256 f034a36ad3c7bf212fbccd9ee0026b376a8d70f03fc49e7463be2b60c63f4937
MD5 eb0ab0c89293ff371c63d4188075eddc
SHA1 a1ffb971550511b94ca85298e184d8c30e194486
SHA512 27909b150f8e4c773a6a453ea9ef9069f2a823f5520fa7ae8f2af11f5dbf38296d45258a9e808a59e73b092d0fb2189b406f841887a9e4cdd74454d490272f44
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbpwlKenszaDw4B/Os/IOyr7oKKP2:GezaTF8FcNkNdfE0pZ9ozttwIRakGN8X
MD5 SHA1 SHA512 SSDEEP

Submit Download

JboKkId.exe

Path C:\Windows\System\JboKkId.exe
Size 1.5MB
SHA256 379c899df374845ebdeaea041bf3d0fbcece47d492a3536a76afdb59d10a3e6b
MD5 dd86573c3f43aeb1faf89429e1d7498a
SHA1 ed96478866afe9e940db9c5caa147e2acca2b617
SHA512 16ef4019cc62251c3fd64477f6945ab71b79513bf0d127545eadbbc34831efeea315b9045dad437f034cf356c979b74cc07f8650764a37d4ce99a8f06dacedf3
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbpwlKenszaDw4B/Os/IOyr7oKKPN:GezaTF8FcNkNdfE0pZ9ozttwIRakGN8w
MD5 SHA1 SHA512 SSDEEP

Submit Download

MEIKrQI.exe

Path C:\Windows\System\MEIKrQI.exe
Size 1.5MB
SHA256 0e08b24a3271dfda306e5fc196912dbc520bf666bdb4ca122dcb940f2b984c4a
MD5 30891efa839604d4737509752557d04f
SHA1 9d329d92fb3857a33f11a9ed3e41fe40e673d61f
SHA512 4e90e343ffd88ccccb24a01e88a9f1a32ca31cab132600cd714de99ec96a53fcc8bfe59fcaf3a091bd93313033d148e6f606c7d411569a3d00336bddfb4c8952
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbpwlKenszaDw4B/Os/IOyr7oKKPj:GezaTF8FcNkNdfE0pZ9ozttwIRakGN8c
MD5 SHA1 SHA512 SSDEEP

Submit Download

NHECvWY.exe

Path C:\Windows\System\NHECvWY.exe
Size 1.5MB
SHA256 47477abb79109dee3817ce0ec61b4e70ccad2ae89373f496bfa641e4eec0cf5e
MD5 3903608ec663581c6c83b6edc8ff9efe
SHA1 89cfe1438de2f64b5aa335aed21d65ef7c3fe8bc
SHA512 3d57378b2cc2b843c8018754cabe3e2772a23e54b95fbd1e899cb3e9d3d2c905488dfec19068c851c1decdad072940d08648c4a064b258282e826df10d24b5e5
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbpwlKenszaDw4B/Os/IOyr7oKKPg:GezaTF8FcNkNdfE0pZ9ozttwIRakGN8V
MD5 SHA1 SHA512 SSDEEP

Submit Download

OpDTkMC.exe

Path C:\Windows\System\OpDTkMC.exe
Size 1.5MB
SHA256 0be7a2a30cced09dc47914b103d4ebc8755f6d6743916f2fd86c435ec1c723d4
MD5 9d023856a8973beb8f2979d7dbd1ec4d
SHA1 9344f0c2212c519cf247befb81867d3e9031de51
SHA512 ab0815f2b238a9f0741ba434d207bd3fdc64edf6c9617677352d0eb0bdf8f6848559564d8514377f55bac4b152cdf140c4e9def154e1c70d779f42fe082771d0
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbpwlKenszaDw4B/Os/IOyr7oKKPt:GezaTF8FcNkNdfE0pZ9ozttwIRakGN8U
MD5 SHA1 SHA512 SSDEEP

Submit Download

RPyArHQ.exe

Path C:\Windows\System\RPyArHQ.exe
Size 1.5MB
SHA256 f18103d745048d0990b4db8884ecc29bb98ed99f6e8493b04624c380ed37fc39
MD5 caa8481b17efe9a4f70c914ab83cbaba
SHA1 bde51fe25a30f2338beb9b7f61e1364f0ff8790c
SHA512 e37ac0d0914ad036fd3e6c8ee1986c3b60bda4b316a71b99e431eab30f09a767226a687761a53dae5eb351d2b62cc0bcde40a57364d9a3e53b049d73cdd6b6ad
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbpwlKenszaDw4B/Os/IOyr7oKKPB:GezaTF8FcNkNdfE0pZ9ozttwIRakGN8C
MD5 SHA1 SHA512 SSDEEP

Submit Download

RYzGSUs.exe

Path C:\Windows\System\RYzGSUs.exe
Size 1.5MB
SHA256 ce17053b847cb8955e8bdff3d0c8fd216e7d4df30917dde9c1615f4557842539
MD5 9da4274cbc1a713f1374f01086cdd0fa
SHA1 ebcae03294e74c9de10b14b5b12abb4d03496675
SHA512 0fc765743cc1b0e5062f29bf913e44f63e3a5e58d83c9b28677f02f8597d4aa8ea1ed53733063fd1954f200798359b79e9fe39c6c18f0e14470a100fbe5070c1
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbpwlKenszaDw4B/Os/IOyr7oKKPv:GezaTF8FcNkNdfE0pZ9ozttwIRakGN8w
MD5 SHA1 SHA512 SSDEEP

Submit Download

UNUUZEy.exe

Path C:\Windows\System\UNUUZEy.exe
Size 1.5MB
SHA256 9741d33b7ed12ab699ba4ca5d791e081abd129792bfa785b11ecbbc6c0134cc8
MD5 a049a402c04c614a49889a8b8c9cd34e
SHA1 34704b356f497a915baf433758a7991d12bd4e2b
SHA512 a004db1b98db781dd1f3a2151d236129c8e605048f1b29d65e116a19b7a858a24240b3b61d2ffb792cd63a7635d8fc350e7173b1f837cd271369a308c2f4a603
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbpwlKenszaDw4B/Os/IOyr7oKKP+:GezaTF8FcNkNdfE0pZ9ozttwIRakGN8F
MD5 SHA1 SHA512 SSDEEP

Submit Download

YOpCSTF.exe

Path C:\Windows\System\YOpCSTF.exe
Size 1.5MB
SHA256 d985ebd9109b1fc9e5c24058a4f44133f7ecd8c5cd585f37ae2e40070c416476
MD5 1029daa3c3d32b2832f38cf153ea1ef1
SHA1 d5d60581aa6ecea3ec4bb6fb1e2a9c198c78fb1f
SHA512 9e9258baa388fdc932c643ee40d4de5950028a8725dc715eebfefe2772ce8e167db564343c1da131c9a6855e97138f525384f530275af98ac6b81a72a11d33f6
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbpwlKenszaDw4B/Os/IOyr7oKKPL:GezaTF8FcNkNdfE0pZ9ozttwIRakGN86
MD5 SHA1 SHA512 SSDEEP

Submit Download

YYOoHFu.exe

Path C:\Windows\System\YYOoHFu.exe
Size 1.5MB
SHA256 6a7fdf753ff9b03b2ba5d67583102d9a540084e546c47d2a5fc5a1f1299efbac
MD5 5ed4899142c6612fde12bf997af71a47
SHA1 41e529ae81754cf938e839cdb286710061c06a53
SHA512 e4b95ca2e191abc96881f254f2200a7a6efc1de96f048b154d92e4dda70456244b0733bac9f1f76477111667108c3845793dd08407349a6a3cb760835e5918cd
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbpwlKenszaDw4B/Os/IOyr7oKKPt:GezaTF8FcNkNdfE0pZ9ozttwIRakGN8y
MD5 SHA1 SHA512 SSDEEP

Submit Download

ZZAkcoW.exe

Path C:\Windows\System\ZZAkcoW.exe
Size 1.5MB
SHA256 fbb611d0735f8244df453c4610b45722d3fdb944f68b026677c8f762b001df73
MD5 28f8b328834b7ca11ccd815abf939596
SHA1 b332f1d70b76ce31d2176d2db9b29c0422e91089
SHA512 941cd26a76bce05962b7efa2a152c7bd75cb4c7336a5c38a9d9ce9d726d8bc20a39acbbcaa4610fcd1cc9b24c3dbb771560cf9030dc1656c5da039aaa8d69bce
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbpwlKenszaDw4B/Os/IOyr7oKKPs:GezaTF8FcNkNdfE0pZ9ozttwIRakGN8l
MD5 SHA1 SHA512 SSDEEP

Submit Download

efbSFLb.exe

Path C:\Windows\System\efbSFLb.exe
Size 1.5MB
SHA256 a3cdab6772d7cbd4f4750a3ac90cd99a74f5a36e35cd0a1eaa105012bd643388
MD5 cfb237b87df92687a2dcd35eb8451f9f
SHA1 c5893a08b664010468b24665f921c8088dc79170
SHA512 f8dd043293d9732f2f8f78a9f040caf2382abc89adcb8f53fa966ea0b7b05ff703a4564ebc043bba815956f41dc261c32c87fde652281bf540b9d5c704c5e105
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbpwlKenszaDw4B/Os/IOyr7oKKPt:GezaTF8FcNkNdfE0pZ9ozttwIRakGN84
MD5 SHA1 SHA512 SSDEEP

Submit Download

flpniaf.exe

Path C:\Windows\System\flpniaf.exe
Size 1.5MB
SHA256 8a34a2bb8d260e7d97c7f4c0fec9d654787e5395d2b9824edffb8680c5eec10d
MD5 5b98f44e26918b2f6af241b4ade30973
SHA1 8124ac7a961777d0901da1a6b424d9023f564549
SHA512 30bea5749743388430654739070a7f5d04b271f5a815c743d4d5cfc7a2aeda335fb8ef98af7e49cd209f37d62be9735908d4077874d031b8c3857cfb05cd78c2
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbpwlKenszaDw4B/Os/IOyr7oKKP5:GezaTF8FcNkNdfE0pZ9ozttwIRakGN8u
MD5 SHA1 SHA512 SSDEEP

Submit Download

gMwCytS.exe

Path C:\Windows\System\gMwCytS.exe
Size 1.5MB
SHA256 d0c98b422ed6a513a52a0bc768216a02648ad19e534c29ccc43180ef5b0576fb
MD5 80d506ed92c9010f48e49ea15a7650c5
SHA1 f7d3b92527a1139ee1f7fa6b688c66f9c89046dd
SHA512 3d4f7c814626ab9b551764c76c0c398acf1417b55557755cff337a4320707367b8b9bfaa659d19bd3651279951a2713d4824f8dfe9da88f48e3a80f36c2c9ab9
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbpwlKenszaDw4B/Os/IOyr7oKKPz:GezaTF8FcNkNdfE0pZ9ozttwIRakGN8A
MD5 SHA1 SHA512 SSDEEP

Submit Download

gZOjSOF.exe

Path C:\Windows\System\gZOjSOF.exe
Size 1.5MB
SHA256 1c794cc0533e77e3d8f388914ea92b83a5718688900afaf0fb6107ec977e0dd3
MD5 532dc0677c8ae65537b40585408d3c17
SHA1 8a423c494b2827373edbc11d4a8cbf6291d8eb3a
SHA512 5185f28c27d7270aaf75b727eaa267f1dca99069684c17533758bd7a64551e0a5de72046e28281ca31ef35b3ae379dc2a39558a60797d7003dbb7ce35340e681
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbpwlKenszaDw4B/Os/IOyr7oKKPw:GezaTF8FcNkNdfE0pZ9ozttwIRakGN8F
MD5 SHA1 SHA512 SSDEEP

Submit Download

iQFCIjj.exe

Path C:\Windows\System\iQFCIjj.exe
Size 1.5MB
SHA256 719182f8f4ccba846cead50112f8cc0578208ca75e6960d729fd189773c61573
MD5 33ec4bed8ce2dc732499a2608ce069dc
SHA1 74f6abf64fdc51d4450d7508d3fb043df84a76fe
SHA512 e1130a94bce5d379432660189f0eb66a00ee57685ebcd8c4b6ac5dd25e99f6c3a4f5efab5ce66e6619d4e5881e91b9aa203b2cffbfab928061e9522b4ef6efa5
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbpwlKenszaDw4B/Os/IOyr7oKKPH:GezaTF8FcNkNdfE0pZ9ozttwIRakGN8m
MD5 SHA1 SHA512 SSDEEP

Submit Download

jwNLdAK.exe

Path C:\Windows\System\jwNLdAK.exe
Size 1.5MB
SHA256 babe7edc41d417125976537c9a2f8e2ce1946f58fcfc3df30c535398429040ac
MD5 f676c48e69c7d31e78c8229a56214357
SHA1 66a17ba5e8185a6a1542c9ca1e8f686976fd330a
SHA512 59e2e6e60ce5d357a5e333da98b3b653bb3aea28e3614624ecc8ad123fe0c10628b7e992e6c94bb9a85b6975bd7d131ddbd5b65a4c578ad7f0b75fe183a4e951
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbpwlKenszaDw4B/Os/IOyr7oKKPS:GezaTF8FcNkNdfE0pZ9ozttwIRakGN8x
MD5 SHA1 SHA512 SSDEEP

Submit Download

kIAlFGK.exe

Path C:\Windows\System\kIAlFGK.exe
Size 1.5MB
SHA256 c747225f8c75f5ff208d89427b5e4951f4344d14e761fc4c85ca8207f05b2161
MD5 d977e7e43eed6deb9b7921aae15c5b93
SHA1 b18d412a37bd660f1cc0139ac827e037f33d1047
SHA512 28948ab6fca2a72b6c05a26ec554a376af2f3ad32dc2092d3d251be6c0bc73e897a7b386b01ff0beaf0cea1ab92a7675dd2ebfeea6b457470243629a12408c55
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbpwlKenszaDw4B/Os/IOyr7oKKPQ:GezaTF8FcNkNdfE0pZ9ozttwIRakGN8v
MD5 SHA1 SHA512 SSDEEP

Submit Download

kLHaToz.exe

Path C:\Windows\System\kLHaToz.exe
Size 1.5MB
SHA256 96dad5f05ecde6c8929e76cd8fd81625771b83832822b7fa4c50b8276759d248
MD5 523f555ca948fc1aa1aba2e4f5a7ea70
SHA1 d9b1c46d58b1053dbf47c8eeebb21d711ae1e0b7
SHA512 06e0ac6e88099de73d3ba616d83bddc90aab71fc37c6af7d2d94d613477138c6fe3878c50993a3943bad2dbf486e7141e55e17fb716b3e38ce33920427ad899c
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbpwlKenszaDw4B/Os/IOyr7oKKPs:GezaTF8FcNkNdfE0pZ9ozttwIRakGN87
MD5 SHA1 SHA512 SSDEEP

Submit Download

krFOyZZ.exe

Path C:\Windows\System\krFOyZZ.exe
Size 1.5MB
SHA256 0050a7314edb85f025fab771e46a3e3b79099812a476a470fb69758fbb84216e
MD5 c2f5a06ac564d1de99c8c55bc9967672
SHA1 615837aa81a6bcf56961e9dc7dc3853da526b971
SHA512 15c98993ad70d79b88c44d03a2c40273644c49f1e671830996c34af57e8e1004082c5e574205eab343fe33f62ccb428d13ca967f86cdc5de2eb637df4bee45e3
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbpwlKenszaDw4B/Os/IOyr7oKKPQ:GezaTF8FcNkNdfE0pZ9ozttwIRakGN8N
MD5 SHA1 SHA512 SSDEEP

Submit Download

lPdkaKR.exe

Path C:\Windows\System\lPdkaKR.exe
Size 1.5MB
SHA256 e671275d61f6aa6fd24f871626fe4804412a61723b396f2905a691436ee8e048
MD5 8f37e218aa0758dd40d35595e1e33cf6
SHA1 99ba61f539bac9c29d631a6821598aa711bc4dbd
SHA512 9b281fe599a20cd4495ea87cc5561edc3f2b0bdd93b96f9b4239929999aa1f49a627ec81c3ed41cf90195e9f489c312a05afdd1a41fbff0d818ff982310d3a8d
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbpwlKenszaDw4B/Os/IOyr7oKKP2:GezaTF8FcNkNdfE0pZ9ozttwIRakGN8f
MD5 SHA1 SHA512 SSDEEP

Submit Download

qerfaRF.exe

Path C:\Windows\System\qerfaRF.exe
Size 1.5MB
SHA256 397f4e60659f650b80711e15369d89b8b6ae5be1e3759fd4a5de22b948d22e95
MD5 b7c5c1ecd23e07e6644177440e6ffaa7
SHA1 ffa414ff6d34bd44e6529645c741e878ae6f42e8
SHA512 eedbb71d0f4ca8957f94ce9ce4175d6ab5d754d7307a77cde38a555fd6662dde669a808f68e42dce10813ed2c405efd65ced5d66d7c3e310a2984a17489796c2
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbpwlKenszaDw4B/Os/IOyr7oKKPh:GezaTF8FcNkNdfE0pZ9ozttwIRakGN8A
MD5 SHA1 SHA512 SSDEEP

Submit Download

qsaWsgf.exe

Path C:\Windows\System\qsaWsgf.exe
Size 1.5MB
SHA256 954e86ef351a55d2146852aa0cf380f3e609edc244541fed81cbc256ec099a33
MD5 aa71a95d00fc00a280f652632312b285
SHA1 fa039ded8bbc87133246c3171a9f2781e5ad698b
SHA512 ca6ce26117a1d0d7a6f4c8b1d4883d05c6a0fc9410343013fd1084c9b94494d44bc49a1fd41497149801993a4ca621fc2a723a33295191314053325f44b0b9f3
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbpwlKenszaDw4B/Os/IOyr7oKKPR:GezaTF8FcNkNdfE0pZ9ozttwIRakGN8M
MD5 SHA1 SHA512 SSDEEP

Submit Download

tTKEKGF.exe

Path C:\Windows\System\tTKEKGF.exe
Size 1.5MB
SHA256 95b4ce63ab9f055a37b31bd94bc90f223933c589dddd1da79cd71a53b6f1cd02
MD5 dcb798f1c0984be70e3f7d8482a6bc9c
SHA1 4d25e70161d273e07386e42beb10841e56d876da
SHA512 e35a90da320912d2cbccfaa56e92e81d8d964e03d5133101f49f9598a8d35bf3cfac8756156bbc60ea9b272566ffae72665f0b2b87615784c9ba7f1b173c87c9
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbpwlKenszaDw4B/Os/IOyr7oKKP3:GezaTF8FcNkNdfE0pZ9ozttwIRakGN8A
MD5 SHA1 SHA512 SSDEEP

Submit Download

tVwwEZe.exe

Path C:\Windows\System\tVwwEZe.exe
Size 1.5MB
SHA256 8223c5cbef4d4d27252ebbd9eb42e099d9c53997b2915bdfe2e53efd45fb309e
MD5 dac7200b790918cdf12f5280dea8a283
SHA1 beb409ab3c4a1b4ef3af6f9f270c18cface78298
SHA512 04bca9bfaaf374eecf05c44f6833322553a12d58af729c2c1ec4f48d90e4b36d5e1fac9d7f8af4df2abebe0bccd9fd30810deb1de98ab9410ccb2729c0b44da3
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbpwlKenszaDw4B/Os/IOyr7oKKPK:GezaTF8FcNkNdfE0pZ9ozttwIRakGN8J
MD5 SHA1 SHA512 SSDEEP

Submit Download

tYwhYIN.exe

Path C:\Windows\System\tYwhYIN.exe
Size 1.5MB
SHA256 c2ddb310d82b0ecfdb99465f91f40c2a8b897ecf003c9f238669d3a51e8477a1
MD5 c090bb60d320a2bef7949aa0d752d268
SHA1 137b87128947f6e36cab8e873632e1b6fca30d1b
SHA512 bf5520ca290788115ad0fb4a58e7182cc92bcae28cd70182a792bb020320904b14c3f3c8283baceaf5bf7bc537daab35fd0f44761801b4325a81475cc0d7087c
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbpwlKenszaDw4B/Os/IOyr7oKKP6:GezaTF8FcNkNdfE0pZ9ozttwIRakGN8N
MD5 SHA1 SHA512 SSDEEP

Submit Download

tskVODz.exe

Path C:\Windows\System\tskVODz.exe
Size 1.5MB
SHA256 f0ef61f3369ccd016332f668a38b437ce263252effea0a009de1bc6c10a0f8a7
MD5 716d6cc40489ba54e5bdbf4399c7a1ac
SHA1 f8b11cbbeb445d4b4850ce939efde829b745aedd
SHA512 b474105612760167761626ebef60ca6addf85c8dc89b1df9c82e0b665e5a958186f3a30d256e8a84916b9e2098af966e925b86c8fd32118d221125228192a320
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbpwlKenszaDw4B/Os/IOyr7oKKPD:GezaTF8FcNkNdfE0pZ9ozttwIRakGN8K
MD5 SHA1 SHA512 SSDEEP

Submit Download

tvaeSpd.exe

Path C:\Windows\System\tvaeSpd.exe
Size 1.5MB
SHA256 8fb3bafa5406fb78221691a3fd1191d086028594aa08149b590fd2e086027b4c
MD5 ac302aa26eccd6b5c74faec16843705e
SHA1 9795b9dc1c7f756c5a7d3276c2743d2368fb736d
SHA512 3edccf4978df3d54207b9c352de4d357dce8c063759fbe5909ec45a3d667827f57295acdc8b031498a22178cd22a2dcde979a7076281e84e5226b7f95649ece6
SSDEEP 24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbpwlKenszaDw4B/Os/IOyr7oKKPb:GezaTF8FcNkNdfE0pZ9ozttwIRakGN8y
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1256-0-0x0000021F770A0000-0x0000021F770B0000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads