xmrig | dcf43f8d74715ff6395afc690f3fe9f8ce2a566ac17b39c2f0389deeefe36d7a

Analysis

max time kernel
95s
max time network
98s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
14/11/2024, 04:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
dcf43f8d74715ff6395afc690f3fe9f8ce2a566ac17b39c2f0389deeefe36d7aN.exe
Size 1.8MB
Sample241114-etb1favbqq
SHA256 dcf43f8d74715ff6395afc690f3fe9f8ce2a566ac17b39c2f0389deeefe36d7a
MD5 3ec21ffd8099372b379879d9e9cd56a0
SHA1 0d783a4503384c2d6b5ea518413877e25be664da
SHA512 ad6b7806e98d458fbb758ff253ef5f0f85391e59c2d57a24a7609e66647803733c50aa7aa9ece5c95286fb267fc654c182457d42a16ef3439f4bc05454ad7e7f
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9ozttwIRxj4c5yOBZnQbZLoQBc:GemTLkNdfE0pZyr
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 32 IoCs

miner

resource	yara_rule
behavioral2/files/0x000c000000023ba4-4.dat	xmrig
behavioral2/files/0x0007000000023c88-6.dat	xmrig
behavioral2/files/0x0008000000023c87-9.dat	xmrig
behavioral2/files/0x0007000000023c89-20.dat	xmrig
behavioral2/files/0x0007000000023c8b-24.dat	xmrig
behavioral2/files/0x0007000000023c8d-34.dat	xmrig
behavioral2/files/0x0007000000023c8e-38.dat	xmrig
behavioral2/files/0x0007000000023c8f-44.dat	xmrig
behavioral2/files/0x0007000000023c8c-30.dat	xmrig
behavioral2/files/0x0007000000023c90-49.dat	xmrig
behavioral2/files/0x0008000000023c85-53.dat	xmrig
behavioral2/files/0x0007000000023c91-59.dat	xmrig
behavioral2/files/0x0007000000023c92-63.dat	xmrig
behavioral2/files/0x0007000000023c94-75.dat	xmrig
behavioral2/files/0x0007000000023c95-74.dat	xmrig
behavioral2/files/0x0007000000023c97-87.dat	xmrig
behavioral2/files/0x0007000000023c9c-112.dat	xmrig
behavioral2/files/0x0007000000023c9f-122.dat	xmrig
behavioral2/files/0x0007000000023c9d-142.dat	xmrig
behavioral2/files/0x0007000000023ca4-149.dat	xmrig
behavioral2/files/0x0007000000023ca3-147.dat	xmrig
behavioral2/files/0x0007000000023ca2-146.dat	xmrig
behavioral2/files/0x0007000000023ca1-144.dat	xmrig
behavioral2/files/0x0007000000023ca0-140.dat	xmrig
behavioral2/files/0x0007000000023c9e-138.dat	xmrig
behavioral2/files/0x0007000000023c9b-119.dat	xmrig
behavioral2/files/0x0007000000023c98-103.dat	xmrig
behavioral2/files/0x0007000000023c9a-109.dat	xmrig
behavioral2/files/0x0007000000023c96-88.dat	xmrig
behavioral2/files/0x0007000000023c93-76.dat	xmrig
behavioral2/files/0x0007000000023ca6-160.dat	xmrig
behavioral2/files/0x0007000000023ca5-155.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
5004	gvFOHWL.exe
4424	pfdeUaN.exe
820	pczDzOb.exe
2280	cXxFlcM.exe
4208	GnTJpIc.exe
4844	fCRHTGa.exe
3984	UKIRMmA.exe
2168	LDnNiGD.exe
2888	rzgVzuU.exe
2040	TiuqQxw.exe
4256	FklAPTQ.exe
4264	JJhIwmv.exe
2808	jddJTlH.exe
4544	GuNYSGL.exe
4504	AIiScMb.exe
1532	huzJDSx.exe
4480	ZbMIYJH.exe
3252	baZQmUb.exe
1524	Kppzmkh.exe
5052	voEsLlq.exe
2836	MYVJPkb.exe
3088	epsAnPN.exe
3600	MMaHdKP.exe
4280	vlNvzPB.exe
2776	gFUcLjh.exe
2740	YrSPJmb.exe
5088	HNzxghU.exe
4672	UsDEvjR.exe
2172	ObNvPFm.exe
416	tCzPamI.exe
1136	ABWwZzw.exe
436	hKvREwT.exe
2032	wWsGiRz.exe
1172	OCeNmLg.exe
2952	cCeQWnN.exe
3524	SviOBBP.exe
4552	SozYtkJ.exe
2924	pVdVwZE.exe
1280	ujOEwug.exe
4180	IOOBOHS.exe
872	ibJJCXZ.exe
4972	krnnhys.exe
892	ZfxffEm.exe
4332	YlVymsz.exe
2204	SarpKoJ.exe
5084	ZqRNNgX.exe
4900	hXiWhik.exe
3100	kVyBeuP.exe
396	rfuczXS.exe
1236	QEBOSxt.exe
4992	yqcYUrH.exe
2660	kaVftut.exe
2768	zwCvkQR.exe
4364	aReKhKS.exe
4268	HEhTcCz.exe
1832	sjaiehX.exe
1668	CZJijyd.exe
1824	mRgxkGm.exe
3640	dVuCDxq.exe
2908	eYdFPbg.exe
3180	VXmjYgT.exe
1748	wtIMQbK.exe
4496	xpvxADh.exe
1808	bmbfOaw.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\UefiWwl.exe	dcf43f8d74715ff6395afc690f3fe9f8ce2a566ac17b39c2f0389deeefe36d7aN.exe
File created	C:\Windows\System\veDpbRf.exe	dcf43f8d74715ff6395afc690f3fe9f8ce2a566ac17b39c2f0389deeefe36d7aN.exe
File created	C:\Windows\System\UBViBpY.exe	dcf43f8d74715ff6395afc690f3fe9f8ce2a566ac17b39c2f0389deeefe36d7aN.exe
File created	C:\Windows\System\wWsGiRz.exe	dcf43f8d74715ff6395afc690f3fe9f8ce2a566ac17b39c2f0389deeefe36d7aN.exe
File created	C:\Windows\System\fRedlSo.exe	dcf43f8d74715ff6395afc690f3fe9f8ce2a566ac17b39c2f0389deeefe36d7aN.exe
File created	C:\Windows\System\rWMltjl.exe	dcf43f8d74715ff6395afc690f3fe9f8ce2a566ac17b39c2f0389deeefe36d7aN.exe
File created	C:\Windows\System\NnFnChe.exe	dcf43f8d74715ff6395afc690f3fe9f8ce2a566ac17b39c2f0389deeefe36d7aN.exe
File created	C:\Windows\System\xvJrKcF.exe	dcf43f8d74715ff6395afc690f3fe9f8ce2a566ac17b39c2f0389deeefe36d7aN.exe
File created	C:\Windows\System\jKaJcqI.exe	dcf43f8d74715ff6395afc690f3fe9f8ce2a566ac17b39c2f0389deeefe36d7aN.exe
File created	C:\Windows\System\AYWIzuF.exe	dcf43f8d74715ff6395afc690f3fe9f8ce2a566ac17b39c2f0389deeefe36d7aN.exe
File created	C:\Windows\System\Kppzmkh.exe	dcf43f8d74715ff6395afc690f3fe9f8ce2a566ac17b39c2f0389deeefe36d7aN.exe
File created	C:\Windows\System\ibJJCXZ.exe	dcf43f8d74715ff6395afc690f3fe9f8ce2a566ac17b39c2f0389deeefe36d7aN.exe
File created	C:\Windows\System\LkbdJdd.exe	dcf43f8d74715ff6395afc690f3fe9f8ce2a566ac17b39c2f0389deeefe36d7aN.exe
File created	C:\Windows\System\aDCaRkz.exe	dcf43f8d74715ff6395afc690f3fe9f8ce2a566ac17b39c2f0389deeefe36d7aN.exe
File created	C:\Windows\System\SbkRjJC.exe	dcf43f8d74715ff6395afc690f3fe9f8ce2a566ac17b39c2f0389deeefe36d7aN.exe
File created	C:\Windows\System\pQufeUF.exe	dcf43f8d74715ff6395afc690f3fe9f8ce2a566ac17b39c2f0389deeefe36d7aN.exe
File created	C:\Windows\System\lAOWeeZ.exe	dcf43f8d74715ff6395afc690f3fe9f8ce2a566ac17b39c2f0389deeefe36d7aN.exe
File created	C:\Windows\System\vdclpEr.exe	dcf43f8d74715ff6395afc690f3fe9f8ce2a566ac17b39c2f0389deeefe36d7aN.exe
File created	C:\Windows\System\VxvQxbK.exe	dcf43f8d74715ff6395afc690f3fe9f8ce2a566ac17b39c2f0389deeefe36d7aN.exe
File created	C:\Windows\System\ZwgXCQV.exe	dcf43f8d74715ff6395afc690f3fe9f8ce2a566ac17b39c2f0389deeefe36d7aN.exe
File created	C:\Windows\System\IsKrMFG.exe	dcf43f8d74715ff6395afc690f3fe9f8ce2a566ac17b39c2f0389deeefe36d7aN.exe
File created	C:\Windows\System\yaIeLBd.exe	dcf43f8d74715ff6395afc690f3fe9f8ce2a566ac17b39c2f0389deeefe36d7aN.exe
File created	C:\Windows\System\YtKzsgS.exe	dcf43f8d74715ff6395afc690f3fe9f8ce2a566ac17b39c2f0389deeefe36d7aN.exe
File created	C:\Windows\System\ElwnVSE.exe	dcf43f8d74715ff6395afc690f3fe9f8ce2a566ac17b39c2f0389deeefe36d7aN.exe
File created	C:\Windows\System\VhTKkaW.exe	dcf43f8d74715ff6395afc690f3fe9f8ce2a566ac17b39c2f0389deeefe36d7aN.exe
File created	C:\Windows\System\gMmDgkm.exe	dcf43f8d74715ff6395afc690f3fe9f8ce2a566ac17b39c2f0389deeefe36d7aN.exe
File created	C:\Windows\System\VYSkrPl.exe	dcf43f8d74715ff6395afc690f3fe9f8ce2a566ac17b39c2f0389deeefe36d7aN.exe
File created	C:\Windows\System\KCgAVJb.exe	dcf43f8d74715ff6395afc690f3fe9f8ce2a566ac17b39c2f0389deeefe36d7aN.exe
File created	C:\Windows\System\MQAXFjd.exe	dcf43f8d74715ff6395afc690f3fe9f8ce2a566ac17b39c2f0389deeefe36d7aN.exe
File created	C:\Windows\System\EXeaoXs.exe	dcf43f8d74715ff6395afc690f3fe9f8ce2a566ac17b39c2f0389deeefe36d7aN.exe
File created	C:\Windows\System\yJNTjaO.exe	dcf43f8d74715ff6395afc690f3fe9f8ce2a566ac17b39c2f0389deeefe36d7aN.exe
File created	C:\Windows\System\mjTTTqC.exe	dcf43f8d74715ff6395afc690f3fe9f8ce2a566ac17b39c2f0389deeefe36d7aN.exe
File created	C:\Windows\System\tYgwWMO.exe	dcf43f8d74715ff6395afc690f3fe9f8ce2a566ac17b39c2f0389deeefe36d7aN.exe
File created	C:\Windows\System\qnftEex.exe	dcf43f8d74715ff6395afc690f3fe9f8ce2a566ac17b39c2f0389deeefe36d7aN.exe
File created	C:\Windows\System\yoGeLjq.exe	dcf43f8d74715ff6395afc690f3fe9f8ce2a566ac17b39c2f0389deeefe36d7aN.exe
File created	C:\Windows\System\wcexDnk.exe	dcf43f8d74715ff6395afc690f3fe9f8ce2a566ac17b39c2f0389deeefe36d7aN.exe
File created	C:\Windows\System\vpnxdhq.exe	dcf43f8d74715ff6395afc690f3fe9f8ce2a566ac17b39c2f0389deeefe36d7aN.exe
File created	C:\Windows\System\XQQGcDZ.exe	dcf43f8d74715ff6395afc690f3fe9f8ce2a566ac17b39c2f0389deeefe36d7aN.exe
File created	C:\Windows\System\prtqtKG.exe	dcf43f8d74715ff6395afc690f3fe9f8ce2a566ac17b39c2f0389deeefe36d7aN.exe
File created	C:\Windows\System\rwVpTDL.exe	dcf43f8d74715ff6395afc690f3fe9f8ce2a566ac17b39c2f0389deeefe36d7aN.exe
File created	C:\Windows\System\PhNvZuL.exe	dcf43f8d74715ff6395afc690f3fe9f8ce2a566ac17b39c2f0389deeefe36d7aN.exe
File created	C:\Windows\System\aHhQmAy.exe	dcf43f8d74715ff6395afc690f3fe9f8ce2a566ac17b39c2f0389deeefe36d7aN.exe
File created	C:\Windows\System\qRsMoWz.exe	dcf43f8d74715ff6395afc690f3fe9f8ce2a566ac17b39c2f0389deeefe36d7aN.exe
File created	C:\Windows\System\pBKzbJA.exe	dcf43f8d74715ff6395afc690f3fe9f8ce2a566ac17b39c2f0389deeefe36d7aN.exe
File created	C:\Windows\System\loFXsDi.exe	dcf43f8d74715ff6395afc690f3fe9f8ce2a566ac17b39c2f0389deeefe36d7aN.exe
File created	C:\Windows\System\tXDrfoj.exe	dcf43f8d74715ff6395afc690f3fe9f8ce2a566ac17b39c2f0389deeefe36d7aN.exe
File created	C:\Windows\System\fKDqRcF.exe	dcf43f8d74715ff6395afc690f3fe9f8ce2a566ac17b39c2f0389deeefe36d7aN.exe
File created	C:\Windows\System\KaaYqmL.exe	dcf43f8d74715ff6395afc690f3fe9f8ce2a566ac17b39c2f0389deeefe36d7aN.exe
File created	C:\Windows\System\AjGzWnu.exe	dcf43f8d74715ff6395afc690f3fe9f8ce2a566ac17b39c2f0389deeefe36d7aN.exe
File created	C:\Windows\System\ehtCebo.exe	dcf43f8d74715ff6395afc690f3fe9f8ce2a566ac17b39c2f0389deeefe36d7aN.exe
File created	C:\Windows\System\tCOfAqY.exe	dcf43f8d74715ff6395afc690f3fe9f8ce2a566ac17b39c2f0389deeefe36d7aN.exe
File created	C:\Windows\System\ITCJjMZ.exe	dcf43f8d74715ff6395afc690f3fe9f8ce2a566ac17b39c2f0389deeefe36d7aN.exe
File created	C:\Windows\System\vDEGaAg.exe	dcf43f8d74715ff6395afc690f3fe9f8ce2a566ac17b39c2f0389deeefe36d7aN.exe
File created	C:\Windows\System\bzeLUCU.exe	dcf43f8d74715ff6395afc690f3fe9f8ce2a566ac17b39c2f0389deeefe36d7aN.exe
File created	C:\Windows\System\nsnZNeu.exe	dcf43f8d74715ff6395afc690f3fe9f8ce2a566ac17b39c2f0389deeefe36d7aN.exe
File created	C:\Windows\System\fQzmqhB.exe	dcf43f8d74715ff6395afc690f3fe9f8ce2a566ac17b39c2f0389deeefe36d7aN.exe
File created	C:\Windows\System\edLbEcf.exe	dcf43f8d74715ff6395afc690f3fe9f8ce2a566ac17b39c2f0389deeefe36d7aN.exe
File created	C:\Windows\System\WQPxLlj.exe	dcf43f8d74715ff6395afc690f3fe9f8ce2a566ac17b39c2f0389deeefe36d7aN.exe
File created	C:\Windows\System\lMhXqnf.exe	dcf43f8d74715ff6395afc690f3fe9f8ce2a566ac17b39c2f0389deeefe36d7aN.exe
File created	C:\Windows\System\oPqhleK.exe	dcf43f8d74715ff6395afc690f3fe9f8ce2a566ac17b39c2f0389deeefe36d7aN.exe
File created	C:\Windows\System\fXmltFX.exe	dcf43f8d74715ff6395afc690f3fe9f8ce2a566ac17b39c2f0389deeefe36d7aN.exe
File created	C:\Windows\System\RCyXEnQ.exe	dcf43f8d74715ff6395afc690f3fe9f8ce2a566ac17b39c2f0389deeefe36d7aN.exe
File created	C:\Windows\System\ciWHGJc.exe	dcf43f8d74715ff6395afc690f3fe9f8ce2a566ac17b39c2f0389deeefe36d7aN.exe
File created	C:\Windows\System\RlOvTGZ.exe	dcf43f8d74715ff6395afc690f3fe9f8ce2a566ac17b39c2f0389deeefe36d7aN.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	4384	dwm.exe
Token: SeChangeNotifyPrivilege	4384	dwm.exe
Token: 33	4384	dwm.exe
Token: SeIncBasePriorityPrivilege	4384	dwm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 408 wrote to memory of 5004	408	dcf43f8d74715ff6395afc690f3fe9f8ce2a566ac17b39c2f0389deeefe36d7aN.exe	84
PID 408 wrote to memory of 5004	408	dcf43f8d74715ff6395afc690f3fe9f8ce2a566ac17b39c2f0389deeefe36d7aN.exe	84
PID 408 wrote to memory of 4424	408	dcf43f8d74715ff6395afc690f3fe9f8ce2a566ac17b39c2f0389deeefe36d7aN.exe	85
PID 408 wrote to memory of 4424	408	dcf43f8d74715ff6395afc690f3fe9f8ce2a566ac17b39c2f0389deeefe36d7aN.exe	85
PID 408 wrote to memory of 820	408	dcf43f8d74715ff6395afc690f3fe9f8ce2a566ac17b39c2f0389deeefe36d7aN.exe	86
PID 408 wrote to memory of 820	408	dcf43f8d74715ff6395afc690f3fe9f8ce2a566ac17b39c2f0389deeefe36d7aN.exe	86
PID 408 wrote to memory of 2280	408	dcf43f8d74715ff6395afc690f3fe9f8ce2a566ac17b39c2f0389deeefe36d7aN.exe	87
PID 408 wrote to memory of 2280	408	dcf43f8d74715ff6395afc690f3fe9f8ce2a566ac17b39c2f0389deeefe36d7aN.exe	87
PID 408 wrote to memory of 4208	408	dcf43f8d74715ff6395afc690f3fe9f8ce2a566ac17b39c2f0389deeefe36d7aN.exe	88
PID 408 wrote to memory of 4208	408	dcf43f8d74715ff6395afc690f3fe9f8ce2a566ac17b39c2f0389deeefe36d7aN.exe	88
PID 408 wrote to memory of 4844	408	dcf43f8d74715ff6395afc690f3fe9f8ce2a566ac17b39c2f0389deeefe36d7aN.exe	89
PID 408 wrote to memory of 4844	408	dcf43f8d74715ff6395afc690f3fe9f8ce2a566ac17b39c2f0389deeefe36d7aN.exe	89
PID 408 wrote to memory of 3984	408	dcf43f8d74715ff6395afc690f3fe9f8ce2a566ac17b39c2f0389deeefe36d7aN.exe	90
PID 408 wrote to memory of 3984	408	dcf43f8d74715ff6395afc690f3fe9f8ce2a566ac17b39c2f0389deeefe36d7aN.exe	90
PID 408 wrote to memory of 2168	408	dcf43f8d74715ff6395afc690f3fe9f8ce2a566ac17b39c2f0389deeefe36d7aN.exe	91
PID 408 wrote to memory of 2168	408	dcf43f8d74715ff6395afc690f3fe9f8ce2a566ac17b39c2f0389deeefe36d7aN.exe	91
PID 408 wrote to memory of 2888	408	dcf43f8d74715ff6395afc690f3fe9f8ce2a566ac17b39c2f0389deeefe36d7aN.exe	92
PID 408 wrote to memory of 2888	408	dcf43f8d74715ff6395afc690f3fe9f8ce2a566ac17b39c2f0389deeefe36d7aN.exe	92
PID 408 wrote to memory of 2040	408	dcf43f8d74715ff6395afc690f3fe9f8ce2a566ac17b39c2f0389deeefe36d7aN.exe	93
PID 408 wrote to memory of 2040	408	dcf43f8d74715ff6395afc690f3fe9f8ce2a566ac17b39c2f0389deeefe36d7aN.exe	93
PID 408 wrote to memory of 4256	408	dcf43f8d74715ff6395afc690f3fe9f8ce2a566ac17b39c2f0389deeefe36d7aN.exe	95
PID 408 wrote to memory of 4256	408	dcf43f8d74715ff6395afc690f3fe9f8ce2a566ac17b39c2f0389deeefe36d7aN.exe	95
PID 408 wrote to memory of 4264	408	dcf43f8d74715ff6395afc690f3fe9f8ce2a566ac17b39c2f0389deeefe36d7aN.exe	96
PID 408 wrote to memory of 4264	408	dcf43f8d74715ff6395afc690f3fe9f8ce2a566ac17b39c2f0389deeefe36d7aN.exe	96
PID 408 wrote to memory of 2808	408	dcf43f8d74715ff6395afc690f3fe9f8ce2a566ac17b39c2f0389deeefe36d7aN.exe	97
PID 408 wrote to memory of 2808	408	dcf43f8d74715ff6395afc690f3fe9f8ce2a566ac17b39c2f0389deeefe36d7aN.exe	97
PID 408 wrote to memory of 4544	408	dcf43f8d74715ff6395afc690f3fe9f8ce2a566ac17b39c2f0389deeefe36d7aN.exe	98
PID 408 wrote to memory of 4544	408	dcf43f8d74715ff6395afc690f3fe9f8ce2a566ac17b39c2f0389deeefe36d7aN.exe	98
PID 408 wrote to memory of 1532	408	dcf43f8d74715ff6395afc690f3fe9f8ce2a566ac17b39c2f0389deeefe36d7aN.exe	99
PID 408 wrote to memory of 1532	408	dcf43f8d74715ff6395afc690f3fe9f8ce2a566ac17b39c2f0389deeefe36d7aN.exe	99
PID 408 wrote to memory of 4504	408	dcf43f8d74715ff6395afc690f3fe9f8ce2a566ac17b39c2f0389deeefe36d7aN.exe	100
PID 408 wrote to memory of 4504	408	dcf43f8d74715ff6395afc690f3fe9f8ce2a566ac17b39c2f0389deeefe36d7aN.exe	100
PID 408 wrote to memory of 4480	408	dcf43f8d74715ff6395afc690f3fe9f8ce2a566ac17b39c2f0389deeefe36d7aN.exe	101
PID 408 wrote to memory of 4480	408	dcf43f8d74715ff6395afc690f3fe9f8ce2a566ac17b39c2f0389deeefe36d7aN.exe	101
PID 408 wrote to memory of 3252	408	dcf43f8d74715ff6395afc690f3fe9f8ce2a566ac17b39c2f0389deeefe36d7aN.exe	102
PID 408 wrote to memory of 3252	408	dcf43f8d74715ff6395afc690f3fe9f8ce2a566ac17b39c2f0389deeefe36d7aN.exe	102
PID 408 wrote to memory of 1524	408	dcf43f8d74715ff6395afc690f3fe9f8ce2a566ac17b39c2f0389deeefe36d7aN.exe	103
PID 408 wrote to memory of 1524	408	dcf43f8d74715ff6395afc690f3fe9f8ce2a566ac17b39c2f0389deeefe36d7aN.exe	103
PID 408 wrote to memory of 5052	408	dcf43f8d74715ff6395afc690f3fe9f8ce2a566ac17b39c2f0389deeefe36d7aN.exe	104
PID 408 wrote to memory of 5052	408	dcf43f8d74715ff6395afc690f3fe9f8ce2a566ac17b39c2f0389deeefe36d7aN.exe	104
PID 408 wrote to memory of 2836	408	dcf43f8d74715ff6395afc690f3fe9f8ce2a566ac17b39c2f0389deeefe36d7aN.exe	105
PID 408 wrote to memory of 2836	408	dcf43f8d74715ff6395afc690f3fe9f8ce2a566ac17b39c2f0389deeefe36d7aN.exe	105
PID 408 wrote to memory of 3088	408	dcf43f8d74715ff6395afc690f3fe9f8ce2a566ac17b39c2f0389deeefe36d7aN.exe	106
PID 408 wrote to memory of 3088	408	dcf43f8d74715ff6395afc690f3fe9f8ce2a566ac17b39c2f0389deeefe36d7aN.exe	106
PID 408 wrote to memory of 3600	408	dcf43f8d74715ff6395afc690f3fe9f8ce2a566ac17b39c2f0389deeefe36d7aN.exe	107
PID 408 wrote to memory of 3600	408	dcf43f8d74715ff6395afc690f3fe9f8ce2a566ac17b39c2f0389deeefe36d7aN.exe	107
PID 408 wrote to memory of 4280	408	dcf43f8d74715ff6395afc690f3fe9f8ce2a566ac17b39c2f0389deeefe36d7aN.exe	108
PID 408 wrote to memory of 4280	408	dcf43f8d74715ff6395afc690f3fe9f8ce2a566ac17b39c2f0389deeefe36d7aN.exe	108
PID 408 wrote to memory of 2776	408	dcf43f8d74715ff6395afc690f3fe9f8ce2a566ac17b39c2f0389deeefe36d7aN.exe	109
PID 408 wrote to memory of 2776	408	dcf43f8d74715ff6395afc690f3fe9f8ce2a566ac17b39c2f0389deeefe36d7aN.exe	109
PID 408 wrote to memory of 2740	408	dcf43f8d74715ff6395afc690f3fe9f8ce2a566ac17b39c2f0389deeefe36d7aN.exe	110
PID 408 wrote to memory of 2740	408	dcf43f8d74715ff6395afc690f3fe9f8ce2a566ac17b39c2f0389deeefe36d7aN.exe	110
PID 408 wrote to memory of 5088	408	dcf43f8d74715ff6395afc690f3fe9f8ce2a566ac17b39c2f0389deeefe36d7aN.exe	111
PID 408 wrote to memory of 5088	408	dcf43f8d74715ff6395afc690f3fe9f8ce2a566ac17b39c2f0389deeefe36d7aN.exe	111
PID 408 wrote to memory of 4672	408	dcf43f8d74715ff6395afc690f3fe9f8ce2a566ac17b39c2f0389deeefe36d7aN.exe	112
PID 408 wrote to memory of 4672	408	dcf43f8d74715ff6395afc690f3fe9f8ce2a566ac17b39c2f0389deeefe36d7aN.exe	112
PID 408 wrote to memory of 2172	408	dcf43f8d74715ff6395afc690f3fe9f8ce2a566ac17b39c2f0389deeefe36d7aN.exe	113
PID 408 wrote to memory of 2172	408	dcf43f8d74715ff6395afc690f3fe9f8ce2a566ac17b39c2f0389deeefe36d7aN.exe	113
PID 408 wrote to memory of 416	408	dcf43f8d74715ff6395afc690f3fe9f8ce2a566ac17b39c2f0389deeefe36d7aN.exe	114
PID 408 wrote to memory of 416	408	dcf43f8d74715ff6395afc690f3fe9f8ce2a566ac17b39c2f0389deeefe36d7aN.exe	114
PID 408 wrote to memory of 1136	408	dcf43f8d74715ff6395afc690f3fe9f8ce2a566ac17b39c2f0389deeefe36d7aN.exe	115
PID 408 wrote to memory of 1136	408	dcf43f8d74715ff6395afc690f3fe9f8ce2a566ac17b39c2f0389deeefe36d7aN.exe	115
PID 408 wrote to memory of 436	408	dcf43f8d74715ff6395afc690f3fe9f8ce2a566ac17b39c2f0389deeefe36d7aN.exe	117
PID 408 wrote to memory of 436	408	dcf43f8d74715ff6395afc690f3fe9f8ce2a566ac17b39c2f0389deeefe36d7aN.exe	117

C:\Users\Admin\AppData\Local\Temp\dcf43f8d74715ff6395afc690f3fe9f8ce2a566ac17b39c2f0389deeefe36d7aN.exe
"C:\Users\Admin\AppData\Local\Temp\dcf43f8d74715ff6395afc690f3fe9f8ce2a566ac17b39c2f0389deeefe36d7aN.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:408
- C:\Windows\System\gvFOHWL.exe
  C:\Windows\System\gvFOHWL.exe
  2⤵
  - Executes dropped EXE
  PID:5004
- C:\Windows\System\pfdeUaN.exe
  C:\Windows\System\pfdeUaN.exe
  2⤵
  - Executes dropped EXE
  PID:4424
- C:\Windows\System\pczDzOb.exe
  C:\Windows\System\pczDzOb.exe
  2⤵
  - Executes dropped EXE
  PID:820
- C:\Windows\System\cXxFlcM.exe
  C:\Windows\System\cXxFlcM.exe
  2⤵
  - Executes dropped EXE
  PID:2280
- C:\Windows\System\GnTJpIc.exe
  C:\Windows\System\GnTJpIc.exe
  2⤵
  - Executes dropped EXE
  PID:4208
- C:\Windows\System\fCRHTGa.exe
  C:\Windows\System\fCRHTGa.exe
  2⤵
  - Executes dropped EXE
  PID:4844
- C:\Windows\System\UKIRMmA.exe
  C:\Windows\System\UKIRMmA.exe
  2⤵
  - Executes dropped EXE
  PID:3984
- C:\Windows\System\LDnNiGD.exe
  C:\Windows\System\LDnNiGD.exe
  2⤵
  - Executes dropped EXE
  PID:2168
- C:\Windows\System\rzgVzuU.exe
  C:\Windows\System\rzgVzuU.exe
  2⤵
  - Executes dropped EXE
  PID:2888
- C:\Windows\System\TiuqQxw.exe
  C:\Windows\System\TiuqQxw.exe
  2⤵
  - Executes dropped EXE
  PID:2040
- C:\Windows\System\FklAPTQ.exe
  C:\Windows\System\FklAPTQ.exe
  2⤵
  - Executes dropped EXE
  PID:4256
- C:\Windows\System\JJhIwmv.exe
  C:\Windows\System\JJhIwmv.exe
  2⤵
  - Executes dropped EXE
  PID:4264
- C:\Windows\System\jddJTlH.exe
  C:\Windows\System\jddJTlH.exe
  2⤵
  - Executes dropped EXE
  PID:2808
- C:\Windows\System\GuNYSGL.exe
  C:\Windows\System\GuNYSGL.exe
  2⤵
  - Executes dropped EXE
  PID:4544
- C:\Windows\System\huzJDSx.exe
  C:\Windows\System\huzJDSx.exe
  2⤵
  - Executes dropped EXE
  PID:1532
- C:\Windows\System\AIiScMb.exe
  C:\Windows\System\AIiScMb.exe
  2⤵
  - Executes dropped EXE
  PID:4504
- C:\Windows\System\ZbMIYJH.exe
  C:\Windows\System\ZbMIYJH.exe
  2⤵
  - Executes dropped EXE
  PID:4480
- C:\Windows\System\baZQmUb.exe
  C:\Windows\System\baZQmUb.exe
  2⤵
  - Executes dropped EXE
  PID:3252
- C:\Windows\System\Kppzmkh.exe
  C:\Windows\System\Kppzmkh.exe
  2⤵
  - Executes dropped EXE
  PID:1524
- C:\Windows\System\voEsLlq.exe
  C:\Windows\System\voEsLlq.exe
  2⤵
  - Executes dropped EXE
  PID:5052
- C:\Windows\System\MYVJPkb.exe
  C:\Windows\System\MYVJPkb.exe
  2⤵
  - Executes dropped EXE
  PID:2836
- C:\Windows\System\epsAnPN.exe
  C:\Windows\System\epsAnPN.exe
  2⤵
  - Executes dropped EXE
  PID:3088
- C:\Windows\System\MMaHdKP.exe
  C:\Windows\System\MMaHdKP.exe
  2⤵
  - Executes dropped EXE
  PID:3600
- C:\Windows\System\vlNvzPB.exe
  C:\Windows\System\vlNvzPB.exe
  2⤵
  - Executes dropped EXE
  PID:4280
- C:\Windows\System\gFUcLjh.exe
  C:\Windows\System\gFUcLjh.exe
  2⤵
  - Executes dropped EXE
  PID:2776
- C:\Windows\System\YrSPJmb.exe
  C:\Windows\System\YrSPJmb.exe
  2⤵
  - Executes dropped EXE
  PID:2740
- C:\Windows\System\HNzxghU.exe
  C:\Windows\System\HNzxghU.exe
  2⤵
  - Executes dropped EXE
  PID:5088
- C:\Windows\System\UsDEvjR.exe
  C:\Windows\System\UsDEvjR.exe
  2⤵
  - Executes dropped EXE
  PID:4672
- C:\Windows\System\ObNvPFm.exe
  C:\Windows\System\ObNvPFm.exe
  2⤵
  - Executes dropped EXE
  PID:2172
- C:\Windows\System\tCzPamI.exe
  C:\Windows\System\tCzPamI.exe
  2⤵
  - Executes dropped EXE
  PID:416
- C:\Windows\System\ABWwZzw.exe
  C:\Windows\System\ABWwZzw.exe
  2⤵
  - Executes dropped EXE
  PID:1136
- C:\Windows\System\hKvREwT.exe
  C:\Windows\System\hKvREwT.exe
  2⤵
  - Executes dropped EXE
  PID:436
- C:\Windows\System\wWsGiRz.exe
  C:\Windows\System\wWsGiRz.exe
  2⤵
  - Executes dropped EXE
  PID:2032
- C:\Windows\System\OCeNmLg.exe
  C:\Windows\System\OCeNmLg.exe
  2⤵
  - Executes dropped EXE
  PID:1172
- C:\Windows\System\cCeQWnN.exe
  C:\Windows\System\cCeQWnN.exe
  2⤵
  - Executes dropped EXE
  PID:2952
- C:\Windows\System\SviOBBP.exe
  C:\Windows\System\SviOBBP.exe
  2⤵
  - Executes dropped EXE
  PID:3524
- C:\Windows\System\SozYtkJ.exe
  C:\Windows\System\SozYtkJ.exe
  2⤵
  - Executes dropped EXE
  PID:4552
- C:\Windows\System\pVdVwZE.exe
  C:\Windows\System\pVdVwZE.exe
  2⤵
  - Executes dropped EXE
  PID:2924
- C:\Windows\System\ujOEwug.exe
  C:\Windows\System\ujOEwug.exe
  2⤵
  - Executes dropped EXE
  PID:1280
- C:\Windows\System\IOOBOHS.exe
  C:\Windows\System\IOOBOHS.exe
  2⤵
  - Executes dropped EXE
  PID:4180
- C:\Windows\System\ibJJCXZ.exe
  C:\Windows\System\ibJJCXZ.exe
  2⤵
  - Executes dropped EXE
  PID:872
- C:\Windows\System\krnnhys.exe
  C:\Windows\System\krnnhys.exe
  2⤵
  - Executes dropped EXE
  PID:4972
- C:\Windows\System\ZfxffEm.exe
  C:\Windows\System\ZfxffEm.exe
  2⤵
  - Executes dropped EXE
  PID:892
- C:\Windows\System\YlVymsz.exe
  C:\Windows\System\YlVymsz.exe
  2⤵
  - Executes dropped EXE
  PID:4332
- C:\Windows\System\SarpKoJ.exe
  C:\Windows\System\SarpKoJ.exe
  2⤵
  - Executes dropped EXE
  PID:2204
- C:\Windows\System\ZqRNNgX.exe
  C:\Windows\System\ZqRNNgX.exe
  2⤵
  - Executes dropped EXE
  PID:5084
- C:\Windows\System\hXiWhik.exe
  C:\Windows\System\hXiWhik.exe
  2⤵
  - Executes dropped EXE
  PID:4900
- C:\Windows\System\kVyBeuP.exe
  C:\Windows\System\kVyBeuP.exe
  2⤵
  - Executes dropped EXE
  PID:3100
- C:\Windows\System\rfuczXS.exe
  C:\Windows\System\rfuczXS.exe
  2⤵
  - Executes dropped EXE
  PID:396
- C:\Windows\System\QEBOSxt.exe
  C:\Windows\System\QEBOSxt.exe
  2⤵
  - Executes dropped EXE
  PID:1236
- C:\Windows\System\yqcYUrH.exe
  C:\Windows\System\yqcYUrH.exe
  2⤵
  - Executes dropped EXE
  PID:4992
- C:\Windows\System\kaVftut.exe
  C:\Windows\System\kaVftut.exe
  2⤵
  - Executes dropped EXE
  PID:2660
- C:\Windows\System\zwCvkQR.exe
  C:\Windows\System\zwCvkQR.exe
  2⤵
  - Executes dropped EXE
  PID:2768
- C:\Windows\System\aReKhKS.exe
  C:\Windows\System\aReKhKS.exe
  2⤵
  - Executes dropped EXE
  PID:4364
- C:\Windows\System\HEhTcCz.exe
  C:\Windows\System\HEhTcCz.exe
  2⤵
  - Executes dropped EXE
  PID:4268
- C:\Windows\System\sjaiehX.exe
  C:\Windows\System\sjaiehX.exe
  2⤵
  - Executes dropped EXE
  PID:1832
- C:\Windows\System\CZJijyd.exe
  C:\Windows\System\CZJijyd.exe
  2⤵
  - Executes dropped EXE
  PID:1668
- C:\Windows\System\mRgxkGm.exe
  C:\Windows\System\mRgxkGm.exe
  2⤵
  - Executes dropped EXE
  PID:1824
- C:\Windows\System\dVuCDxq.exe
  C:\Windows\System\dVuCDxq.exe
  2⤵
  - Executes dropped EXE
  PID:3640
- C:\Windows\System\eYdFPbg.exe
  C:\Windows\System\eYdFPbg.exe
  2⤵
  - Executes dropped EXE
  PID:2908
- C:\Windows\System\VXmjYgT.exe
  C:\Windows\System\VXmjYgT.exe
  2⤵
  - Executes dropped EXE
  PID:3180
- C:\Windows\System\wtIMQbK.exe
  C:\Windows\System\wtIMQbK.exe
  2⤵
  - Executes dropped EXE
  PID:1748
- C:\Windows\System\xpvxADh.exe
  C:\Windows\System\xpvxADh.exe
  2⤵
  - Executes dropped EXE
  PID:4496
- C:\Windows\System\bmbfOaw.exe
  C:\Windows\System\bmbfOaw.exe
  2⤵
  - Executes dropped EXE
  PID:1808
- C:\Windows\System\lMhXqnf.exe
  C:\Windows\System\lMhXqnf.exe
  2⤵
  PID:548
- C:\Windows\System\Iomrlhy.exe
  C:\Windows\System\Iomrlhy.exe
  2⤵
  PID:1100
- C:\Windows\System\rqMFurC.exe
  C:\Windows\System\rqMFurC.exe
  2⤵
  PID:1388
- C:\Windows\System\WLxxDuO.exe
  C:\Windows\System\WLxxDuO.exe
  2⤵
  PID:2244
- C:\Windows\System\vcdmXBM.exe
  C:\Windows\System\vcdmXBM.exe
  2⤵
  PID:4060
- C:\Windows\System\gUoTLIE.exe
  C:\Windows\System\gUoTLIE.exe
  2⤵
  PID:4760
- C:\Windows\System\twebsAt.exe
  C:\Windows\System\twebsAt.exe
  2⤵
  PID:4584
- C:\Windows\System\cZZvKAW.exe
  C:\Windows\System\cZZvKAW.exe
  2⤵
  PID:3672
- C:\Windows\System\sUeHYtX.exe
  C:\Windows\System\sUeHYtX.exe
  2⤵
  PID:4708
- C:\Windows\System\sYxXRLY.exe
  C:\Windows\System\sYxXRLY.exe
  2⤵
  PID:3232
- C:\Windows\System\HjTNfCH.exe
  C:\Windows\System\HjTNfCH.exe
  2⤵
  PID:3292
- C:\Windows\System\zQBAOhJ.exe
  C:\Windows\System\zQBAOhJ.exe
  2⤵
  PID:4920
- C:\Windows\System\LrDVagO.exe
  C:\Windows\System\LrDVagO.exe
  2⤵
  PID:4500
- C:\Windows\System\hIZkXCe.exe
  C:\Windows\System\hIZkXCe.exe
  2⤵
  PID:1556
- C:\Windows\System\sXqKMDn.exe
  C:\Windows\System\sXqKMDn.exe
  2⤵
  PID:3464
- C:\Windows\System\Tyaxons.exe
  C:\Windows\System\Tyaxons.exe
  2⤵
  PID:3212
- C:\Windows\System\RigTRqL.exe
  C:\Windows\System\RigTRqL.exe
  2⤵
  PID:1536
- C:\Windows\System\AzyuVxx.exe
  C:\Windows\System\AzyuVxx.exe
  2⤵
  PID:748
- C:\Windows\System\VxIGtme.exe
  C:\Windows\System\VxIGtme.exe
  2⤵
  PID:3500
- C:\Windows\System\YbuoqUa.exe
  C:\Windows\System\YbuoqUa.exe
  2⤵
  PID:4864
- C:\Windows\System\jkeJojL.exe
  C:\Windows\System\jkeJojL.exe
  2⤵
  PID:1852
- C:\Windows\System\IQZzGOb.exe
  C:\Windows\System\IQZzGOb.exe
  2⤵
  PID:1684
- C:\Windows\System\QJcQpdc.exe
  C:\Windows\System\QJcQpdc.exe
  2⤵
  PID:2356
- C:\Windows\System\LHbFDgJ.exe
  C:\Windows\System\LHbFDgJ.exe
  2⤵
  PID:2364
- C:\Windows\System\YRzlLzM.exe
  C:\Windows\System\YRzlLzM.exe
  2⤵
  PID:4444
- C:\Windows\System\USrGRXM.exe
  C:\Windows\System\USrGRXM.exe
  2⤵
  PID:1148
- C:\Windows\System\pNpLxsk.exe
  C:\Windows\System\pNpLxsk.exe
  2⤵
  PID:936
- C:\Windows\System\GajPBGH.exe
  C:\Windows\System\GajPBGH.exe
  2⤵
  PID:4284
- C:\Windows\System\oUzTFWy.exe
  C:\Windows\System\oUzTFWy.exe
  2⤵
  PID:1592
- C:\Windows\System\MPXGfud.exe
  C:\Windows\System\MPXGfud.exe
  2⤵
  PID:2652
- C:\Windows\System\YAkScRx.exe
  C:\Windows\System\YAkScRx.exe
  2⤵
  PID:3444
- C:\Windows\System\SPGQSVw.exe
  C:\Windows\System\SPGQSVw.exe
  2⤵
  PID:2104
- C:\Windows\System\IAoZrQB.exe
  C:\Windows\System\IAoZrQB.exe
  2⤵
  PID:4276
- C:\Windows\System\QNoFmhA.exe
  C:\Windows\System\QNoFmhA.exe
  2⤵
  PID:5136
- C:\Windows\System\tldAgQS.exe
  C:\Windows\System\tldAgQS.exe
  2⤵
  PID:5200
- C:\Windows\System\SLboLxP.exe
  C:\Windows\System\SLboLxP.exe
  2⤵
  PID:5220
- C:\Windows\System\MCJmyaF.exe
  C:\Windows\System\MCJmyaF.exe
  2⤵
  PID:5244
- C:\Windows\System\AwETQis.exe
  C:\Windows\System\AwETQis.exe
  2⤵
  PID:5280
- C:\Windows\System\LxnyyEg.exe
  C:\Windows\System\LxnyyEg.exe
  2⤵
  PID:5324
- C:\Windows\System\UKSybJz.exe
  C:\Windows\System\UKSybJz.exe
  2⤵
  PID:5360
- C:\Windows\System\bzeLUCU.exe
  C:\Windows\System\bzeLUCU.exe
  2⤵
  PID:5388
- C:\Windows\System\aJXxwVF.exe
  C:\Windows\System\aJXxwVF.exe
  2⤵
  PID:5428
- C:\Windows\System\tymQVpS.exe
  C:\Windows\System\tymQVpS.exe
  2⤵
  PID:5472
- C:\Windows\System\nvXdhPx.exe
  C:\Windows\System\nvXdhPx.exe
  2⤵
  PID:5508
- C:\Windows\System\NWiIxNX.exe
  C:\Windows\System\NWiIxNX.exe
  2⤵
  PID:5536
- C:\Windows\System\oTYscDm.exe
  C:\Windows\System\oTYscDm.exe
  2⤵
  PID:5568
- C:\Windows\System\KaaYqmL.exe
  C:\Windows\System\KaaYqmL.exe
  2⤵
  PID:5608
- C:\Windows\System\oPqhleK.exe
  C:\Windows\System\oPqhleK.exe
  2⤵
  PID:5636
- C:\Windows\System\ZjKRrac.exe
  C:\Windows\System\ZjKRrac.exe
  2⤵
  PID:5668
- C:\Windows\System\wSnntJK.exe
  C:\Windows\System\wSnntJK.exe
  2⤵
  PID:5700
- C:\Windows\System\woNOvQj.exe
  C:\Windows\System\woNOvQj.exe
  2⤵
  PID:5740
- C:\Windows\System\YKPwLvf.exe
  C:\Windows\System\YKPwLvf.exe
  2⤵
  PID:5772
- C:\Windows\System\DonQfkV.exe
  C:\Windows\System\DonQfkV.exe
  2⤵
  PID:5796
- C:\Windows\System\uytSPva.exe
  C:\Windows\System\uytSPva.exe
  2⤵
  PID:5812
- C:\Windows\System\zITnKdJ.exe
  C:\Windows\System\zITnKdJ.exe
  2⤵
  PID:5844
- C:\Windows\System\EzWDCkV.exe
  C:\Windows\System\EzWDCkV.exe
  2⤵
  PID:5876
- C:\Windows\System\LwyzMiR.exe
  C:\Windows\System\LwyzMiR.exe
  2⤵
  PID:5908
- C:\Windows\System\HhoxLRE.exe
  C:\Windows\System\HhoxLRE.exe
  2⤵
  PID:5936
- C:\Windows\System\glAceVX.exe
  C:\Windows\System\glAceVX.exe
  2⤵
  PID:5960
- C:\Windows\System\wloXdin.exe
  C:\Windows\System\wloXdin.exe
  2⤵
  PID:6000
- C:\Windows\System\DntZjgG.exe
  C:\Windows\System\DntZjgG.exe
  2⤵
  PID:6040
- C:\Windows\System\bgHbjEa.exe
  C:\Windows\System\bgHbjEa.exe
  2⤵
  PID:6072
- C:\Windows\System\wcexDnk.exe
  C:\Windows\System\wcexDnk.exe
  2⤵
  PID:6100
- C:\Windows\System\hjuCvry.exe
  C:\Windows\System\hjuCvry.exe
  2⤵
  PID:6136
- C:\Windows\System\HPSTfAO.exe
  C:\Windows\System\HPSTfAO.exe
  2⤵
  PID:3656
- C:\Windows\System\lAOWeeZ.exe
  C:\Windows\System\lAOWeeZ.exe
  2⤵
  PID:5212
- C:\Windows\System\EkFvhGS.exe
  C:\Windows\System\EkFvhGS.exe
  2⤵
  PID:5276
- C:\Windows\System\AobAYDT.exe
  C:\Windows\System\AobAYDT.exe
  2⤵
  PID:5372
- C:\Windows\System\uybRSsd.exe
  C:\Windows\System\uybRSsd.exe
  2⤵
  PID:5452
- C:\Windows\System\FFwzWfi.exe
  C:\Windows\System\FFwzWfi.exe
  2⤵
  PID:5552
- C:\Windows\System\edSAQeW.exe
  C:\Windows\System\edSAQeW.exe
  2⤵
  PID:5620
- C:\Windows\System\wUzqHMO.exe
  C:\Windows\System\wUzqHMO.exe
  2⤵
  PID:5676
- C:\Windows\System\VYSkrPl.exe
  C:\Windows\System\VYSkrPl.exe
  2⤵
  PID:5784
- C:\Windows\System\bWkGiWi.exe
  C:\Windows\System\bWkGiWi.exe
  2⤵
  PID:5824
- C:\Windows\System\rXIqsIc.exe
  C:\Windows\System\rXIqsIc.exe
  2⤵
  PID:5924
- C:\Windows\System\HeTfCHK.exe
  C:\Windows\System\HeTfCHK.exe
  2⤵
  PID:5992
- C:\Windows\System\FEMGCMv.exe
  C:\Windows\System\FEMGCMv.exe
  2⤵
  PID:6096
- C:\Windows\System\lUmTHhi.exe
  C:\Windows\System\lUmTHhi.exe
  2⤵
  PID:2236
- C:\Windows\System\zXWpDpI.exe
  C:\Windows\System\zXWpDpI.exe
  2⤵
  PID:5268
- C:\Windows\System\JcWBFjD.exe
  C:\Windows\System\JcWBFjD.exe
  2⤵
  PID:5380
- C:\Windows\System\tGIhhHS.exe
  C:\Windows\System\tGIhhHS.exe
  2⤵
  PID:5460
- C:\Windows\System\wzOZZsM.exe
  C:\Windows\System\wzOZZsM.exe
  2⤵
  PID:5656
- C:\Windows\System\fxLLmGZ.exe
  C:\Windows\System\fxLLmGZ.exe
  2⤵
  PID:5760
- C:\Windows\System\fsgDXDV.exe
  C:\Windows\System\fsgDXDV.exe
  2⤵
  PID:5904
- C:\Windows\System\BBrvBDT.exe
  C:\Windows\System\BBrvBDT.exe
  2⤵
  PID:6056
- C:\Windows\System\QSFQcMl.exe
  C:\Windows\System\QSFQcMl.exe
  2⤵
  PID:5292
- C:\Windows\System\ApFwkAK.exe
  C:\Windows\System\ApFwkAK.exe
  2⤵
  PID:5860
- C:\Windows\System\eqcYbTW.exe
  C:\Windows\System\eqcYbTW.exe
  2⤵
  PID:6164
- C:\Windows\System\VrTwqDL.exe
  C:\Windows\System\VrTwqDL.exe
  2⤵
  PID:6196
- C:\Windows\System\HVSCjrX.exe
  C:\Windows\System\HVSCjrX.exe
  2⤵
  PID:6224
- C:\Windows\System\xhjeqWe.exe
  C:\Windows\System\xhjeqWe.exe
  2⤵
  PID:6252
- C:\Windows\System\dGJhtuW.exe
  C:\Windows\System\dGJhtuW.exe
  2⤵
  PID:6280
- C:\Windows\System\NioEAVL.exe
  C:\Windows\System\NioEAVL.exe
  2⤵
  PID:6312
- C:\Windows\System\DFdLXbF.exe
  C:\Windows\System\DFdLXbF.exe
  2⤵
  PID:6340
- C:\Windows\System\dBDMbPW.exe
  C:\Windows\System\dBDMbPW.exe
  2⤵
  PID:6368
- C:\Windows\System\yQknhzu.exe
  C:\Windows\System\yQknhzu.exe
  2⤵
  PID:6396
- C:\Windows\System\MsDLwjm.exe
  C:\Windows\System\MsDLwjm.exe
  2⤵
  PID:6428
- C:\Windows\System\ADyHzdR.exe
  C:\Windows\System\ADyHzdR.exe
  2⤵
  PID:6452
- C:\Windows\System\ZZshoWh.exe
  C:\Windows\System\ZZshoWh.exe
  2⤵
  PID:6484
- C:\Windows\System\yNxETUq.exe
  C:\Windows\System\yNxETUq.exe
  2⤵
  PID:6520
- C:\Windows\System\FTzJsXP.exe
  C:\Windows\System\FTzJsXP.exe
  2⤵
  PID:6540
- C:\Windows\System\jGRUejL.exe
  C:\Windows\System\jGRUejL.exe
  2⤵
  PID:6580
- C:\Windows\System\ZxWSLSF.exe
  C:\Windows\System\ZxWSLSF.exe
  2⤵
  PID:6608
- C:\Windows\System\gvlvssT.exe
  C:\Windows\System\gvlvssT.exe
  2⤵
  PID:6640
- C:\Windows\System\dCtrdtS.exe
  C:\Windows\System\dCtrdtS.exe
  2⤵
  PID:6668
- C:\Windows\System\SDJEDqP.exe
  C:\Windows\System\SDJEDqP.exe
  2⤵
  PID:6696
- C:\Windows\System\exnzYMk.exe
  C:\Windows\System\exnzYMk.exe
  2⤵
  PID:6724
- C:\Windows\System\XQscnWK.exe
  C:\Windows\System\XQscnWK.exe
  2⤵
  PID:6752
- C:\Windows\System\LuJXeZC.exe
  C:\Windows\System\LuJXeZC.exe
  2⤵
  PID:6776
- C:\Windows\System\gaIDZjp.exe
  C:\Windows\System\gaIDZjp.exe
  2⤵
  PID:6812
- C:\Windows\System\fqDpgea.exe
  C:\Windows\System\fqDpgea.exe
  2⤵
  PID:6836
- C:\Windows\System\whBmskt.exe
  C:\Windows\System\whBmskt.exe
  2⤵
  PID:6872
- C:\Windows\System\XQvUKJV.exe
  C:\Windows\System\XQvUKJV.exe
  2⤵
  PID:6900
- C:\Windows\System\TZlYKDU.exe
  C:\Windows\System\TZlYKDU.exe
  2⤵
  PID:6932
- C:\Windows\System\BetBkLk.exe
  C:\Windows\System\BetBkLk.exe
  2⤵
  PID:6960
- C:\Windows\System\BYvEzRQ.exe
  C:\Windows\System\BYvEzRQ.exe
  2⤵
  PID:6988
- C:\Windows\System\dBkmWVm.exe
  C:\Windows\System\dBkmWVm.exe
  2⤵
  PID:7024
- C:\Windows\System\IxtZQfB.exe
  C:\Windows\System\IxtZQfB.exe
  2⤵
  PID:7052
- C:\Windows\System\YbqyGka.exe
  C:\Windows\System\YbqyGka.exe
  2⤵
  PID:7080
- C:\Windows\System\moJAWSV.exe
  C:\Windows\System\moJAWSV.exe
  2⤵
  PID:7108
- C:\Windows\System\slVChOM.exe
  C:\Windows\System\slVChOM.exe
  2⤵
  PID:7136
- C:\Windows\System\fAXlXhM.exe
  C:\Windows\System\fAXlXhM.exe
  2⤵
  PID:7164
- C:\Windows\System\FuCExMi.exe
  C:\Windows\System\FuCExMi.exe
  2⤵
  PID:6160
- C:\Windows\System\rQJwjWZ.exe
  C:\Windows\System\rQJwjWZ.exe
  2⤵
  PID:5836
- C:\Windows\System\rmUJWSG.exe
  C:\Windows\System\rmUJWSG.exe
  2⤵
  PID:6260
- C:\Windows\System\KCcUogC.exe
  C:\Windows\System\KCcUogC.exe
  2⤵
  PID:6352
- C:\Windows\System\wCLQYST.exe
  C:\Windows\System\wCLQYST.exe
  2⤵
  PID:6348
- C:\Windows\System\eEFyxDB.exe
  C:\Windows\System\eEFyxDB.exe
  2⤵
  PID:6508
- C:\Windows\System\SFdDbFV.exe
  C:\Windows\System\SFdDbFV.exe
  2⤵
  PID:6548
- C:\Windows\System\BtGyTlh.exe
  C:\Windows\System\BtGyTlh.exe
  2⤵
  PID:6652
- C:\Windows\System\AuxvUkE.exe
  C:\Windows\System\AuxvUkE.exe
  2⤵
  PID:6680
- C:\Windows\System\CfqqrQc.exe
  C:\Windows\System\CfqqrQc.exe
  2⤵
  PID:6748
- C:\Windows\System\dHxgutI.exe
  C:\Windows\System\dHxgutI.exe
  2⤵
  PID:6856
- C:\Windows\System\yvxNUBf.exe
  C:\Windows\System\yvxNUBf.exe
  2⤵
  PID:6924
- C:\Windows\System\MsHEKwW.exe
  C:\Windows\System\MsHEKwW.exe
  2⤵
  PID:6980
- C:\Windows\System\nbQuRHo.exe
  C:\Windows\System\nbQuRHo.exe
  2⤵
  PID:7040
- C:\Windows\System\cJzYxmr.exe
  C:\Windows\System\cJzYxmr.exe
  2⤵
  PID:7120
- C:\Windows\System\AMSiAVV.exe
  C:\Windows\System\AMSiAVV.exe
  2⤵
  PID:1604
- C:\Windows\System\eOwNKtK.exe
  C:\Windows\System\eOwNKtK.exe
  2⤵
  PID:6240
- C:\Windows\System\fRedlSo.exe
  C:\Windows\System\fRedlSo.exe
  2⤵
  PID:6384
- C:\Windows\System\CaZcfvJ.exe
  C:\Windows\System\CaZcfvJ.exe
  2⤵
  PID:6632
- C:\Windows\System\dGRlutt.exe
  C:\Windows\System\dGRlutt.exe
  2⤵
  PID:6784
- C:\Windows\System\nokMZTV.exe
  C:\Windows\System\nokMZTV.exe
  2⤵
  PID:6956
- C:\Windows\System\RWpDuKI.exe
  C:\Windows\System\RWpDuKI.exe
  2⤵
  PID:7076
- C:\Windows\System\hFzHTwx.exe
  C:\Windows\System\hFzHTwx.exe
  2⤵
  PID:6188
- C:\Windows\System\WAOByGl.exe
  C:\Windows\System\WAOByGl.exe
  2⤵
  PID:6604
- C:\Windows\System\fBhVyEJ.exe
  C:\Windows\System\fBhVyEJ.exe
  2⤵
  PID:5164
- C:\Windows\System\mvxIPnE.exe
  C:\Windows\System\mvxIPnE.exe
  2⤵
  PID:6504
- C:\Windows\System\ARMGfmO.exe
  C:\Windows\System\ARMGfmO.exe
  2⤵
  PID:6192
- C:\Windows\System\PrmMszq.exe
  C:\Windows\System\PrmMszq.exe
  2⤵
  PID:7184
- C:\Windows\System\dmKGGfL.exe
  C:\Windows\System\dmKGGfL.exe
  2⤵
  PID:7212
- C:\Windows\System\EVtMYAM.exe
  C:\Windows\System\EVtMYAM.exe
  2⤵
  PID:7240
- C:\Windows\System\nHlzUzq.exe
  C:\Windows\System\nHlzUzq.exe
  2⤵
  PID:7268
- C:\Windows\System\ANejxIk.exe
  C:\Windows\System\ANejxIk.exe
  2⤵
  PID:7296
- C:\Windows\System\kOMuPNa.exe
  C:\Windows\System\kOMuPNa.exe
  2⤵
  PID:7324
- C:\Windows\System\AEcyHOw.exe
  C:\Windows\System\AEcyHOw.exe
  2⤵
  PID:7352
- C:\Windows\System\loFXsDi.exe
  C:\Windows\System\loFXsDi.exe
  2⤵
  PID:7380
- C:\Windows\System\eSAVlPh.exe
  C:\Windows\System\eSAVlPh.exe
  2⤵
  PID:7408
- C:\Windows\System\bYRsDBb.exe
  C:\Windows\System\bYRsDBb.exe
  2⤵
  PID:7436
- C:\Windows\System\UdzgRHm.exe
  C:\Windows\System\UdzgRHm.exe
  2⤵
  PID:7464
- C:\Windows\System\FiiUPqD.exe
  C:\Windows\System\FiiUPqD.exe
  2⤵
  PID:7492
- C:\Windows\System\rWMltjl.exe
  C:\Windows\System\rWMltjl.exe
  2⤵
  PID:7520
- C:\Windows\System\QGGvrrW.exe
  C:\Windows\System\QGGvrrW.exe
  2⤵
  PID:7548
- C:\Windows\System\rCFkpwB.exe
  C:\Windows\System\rCFkpwB.exe
  2⤵
  PID:7576
- C:\Windows\System\VlpVidr.exe
  C:\Windows\System\VlpVidr.exe
  2⤵
  PID:7604
- C:\Windows\System\XdoIPLC.exe
  C:\Windows\System\XdoIPLC.exe
  2⤵
  PID:7632
- C:\Windows\System\HnGmqss.exe
  C:\Windows\System\HnGmqss.exe
  2⤵
  PID:7660
- C:\Windows\System\qggtatk.exe
  C:\Windows\System\qggtatk.exe
  2⤵
  PID:7688
- C:\Windows\System\ArNPEYA.exe
  C:\Windows\System\ArNPEYA.exe
  2⤵
  PID:7716
- C:\Windows\System\BBgJsZr.exe
  C:\Windows\System\BBgJsZr.exe
  2⤵
  PID:7744
- C:\Windows\System\vRDScZn.exe
  C:\Windows\System\vRDScZn.exe
  2⤵
  PID:7772
- C:\Windows\System\vuOiTJn.exe
  C:\Windows\System\vuOiTJn.exe
  2⤵
  PID:7800
- C:\Windows\System\zuUsTTU.exe
  C:\Windows\System\zuUsTTU.exe
  2⤵
  PID:7828
- C:\Windows\System\BMuNZSQ.exe
  C:\Windows\System\BMuNZSQ.exe
  2⤵
  PID:7856
- C:\Windows\System\FJVuiGp.exe
  C:\Windows\System\FJVuiGp.exe
  2⤵
  PID:7884
- C:\Windows\System\dnNEQMb.exe
  C:\Windows\System\dnNEQMb.exe
  2⤵
  PID:7912
- C:\Windows\System\WMzroci.exe
  C:\Windows\System\WMzroci.exe
  2⤵
  PID:7948
- C:\Windows\System\tXDrfoj.exe
  C:\Windows\System\tXDrfoj.exe
  2⤵
  PID:7980
- C:\Windows\System\RsNaxEf.exe
  C:\Windows\System\RsNaxEf.exe
  2⤵
  PID:8004
- C:\Windows\System\aAcgHuB.exe
  C:\Windows\System\aAcgHuB.exe
  2⤵
  PID:8044
- C:\Windows\System\yaIeLBd.exe
  C:\Windows\System\yaIeLBd.exe
  2⤵
  PID:8076
- C:\Windows\System\yKPbsAE.exe
  C:\Windows\System\yKPbsAE.exe
  2⤵
  PID:8104
- C:\Windows\System\VYuZdvn.exe
  C:\Windows\System\VYuZdvn.exe
  2⤵
  PID:8132
- C:\Windows\System\Tdorbyq.exe
  C:\Windows\System\Tdorbyq.exe
  2⤵
  PID:8168
- C:\Windows\System\KsyFnGu.exe
  C:\Windows\System\KsyFnGu.exe
  2⤵
  PID:7180
- C:\Windows\System\GrifDQC.exe
  C:\Windows\System\GrifDQC.exe
  2⤵
  PID:7252
- C:\Windows\System\pmPBtJC.exe
  C:\Windows\System\pmPBtJC.exe
  2⤵
  PID:7316
- C:\Windows\System\rNTdOiH.exe
  C:\Windows\System\rNTdOiH.exe
  2⤵
  PID:7376
- C:\Windows\System\KuPqWun.exe
  C:\Windows\System\KuPqWun.exe
  2⤵
  PID:7460
- C:\Windows\System\aKKxbxm.exe
  C:\Windows\System\aKKxbxm.exe
  2⤵
  PID:7512
- C:\Windows\System\ELpyIia.exe
  C:\Windows\System\ELpyIia.exe
  2⤵
  PID:7572
- C:\Windows\System\WJTYbYK.exe
  C:\Windows\System\WJTYbYK.exe
  2⤵
  PID:7644
- C:\Windows\System\dcaKZSA.exe
  C:\Windows\System\dcaKZSA.exe
  2⤵
  PID:7712
- C:\Windows\System\PhNvZuL.exe
  C:\Windows\System\PhNvZuL.exe
  2⤵
  PID:7768
- C:\Windows\System\WwNjBsn.exe
  C:\Windows\System\WwNjBsn.exe
  2⤵
  PID:7820
- C:\Windows\System\KNDLNGk.exe
  C:\Windows\System\KNDLNGk.exe
  2⤵
  PID:7932
- C:\Windows\System\KxOBWBN.exe
  C:\Windows\System\KxOBWBN.exe
  2⤵
  PID:8000
- C:\Windows\System\Vccjwgo.exe
  C:\Windows\System\Vccjwgo.exe
  2⤵
  PID:8064
- C:\Windows\System\mprsvmx.exe
  C:\Windows\System\mprsvmx.exe
  2⤵
  PID:8156
- C:\Windows\System\RyBrzYM.exe
  C:\Windows\System\RyBrzYM.exe
  2⤵
  PID:7236
- C:\Windows\System\aJisJxM.exe
  C:\Windows\System\aJisJxM.exe
  2⤵
  PID:7348
- C:\Windows\System\NnFnChe.exe
  C:\Windows\System\NnFnChe.exe
  2⤵
  PID:7504
- C:\Windows\System\gZASQfG.exe
  C:\Windows\System\gZASQfG.exe
  2⤵
  PID:7624
- C:\Windows\System\sTHKmdk.exe
  C:\Windows\System\sTHKmdk.exe
  2⤵
  PID:7868
- C:\Windows\System\mEyrQYd.exe
  C:\Windows\System\mEyrQYd.exe
  2⤵
  PID:7988
- C:\Windows\System\zqWXnIH.exe
  C:\Windows\System\zqWXnIH.exe
  2⤵
  PID:8152
- C:\Windows\System\fQzmqhB.exe
  C:\Windows\System\fQzmqhB.exe
  2⤵
  PID:7428
- C:\Windows\System\IIIxwzO.exe
  C:\Windows\System\IIIxwzO.exe
  2⤵
  PID:7740
- C:\Windows\System\CqzbYRY.exe
  C:\Windows\System\CqzbYRY.exe
  2⤵
  PID:8116
- C:\Windows\System\HUVKruP.exe
  C:\Windows\System\HUVKruP.exe
  2⤵
  PID:7812
- C:\Windows\System\mZPUsgf.exe
  C:\Windows\System\mZPUsgf.exe
  2⤵
  PID:7700
- C:\Windows\System\tIbtabe.exe
  C:\Windows\System\tIbtabe.exe
  2⤵
  PID:8216
- C:\Windows\System\PeQqNDm.exe
  C:\Windows\System\PeQqNDm.exe
  2⤵
  PID:8244
- C:\Windows\System\MJtoraz.exe
  C:\Windows\System\MJtoraz.exe
  2⤵
  PID:8272
- C:\Windows\System\XqWVrLP.exe
  C:\Windows\System\XqWVrLP.exe
  2⤵
  PID:8300
- C:\Windows\System\sAaFJHE.exe
  C:\Windows\System\sAaFJHE.exe
  2⤵
  PID:8332
- C:\Windows\System\xdgyAXg.exe
  C:\Windows\System\xdgyAXg.exe
  2⤵
  PID:8360
- C:\Windows\System\AMldfoW.exe
  C:\Windows\System\AMldfoW.exe
  2⤵
  PID:8384
- C:\Windows\System\ZGJECLL.exe
  C:\Windows\System\ZGJECLL.exe
  2⤵
  PID:8412
- C:\Windows\System\EMteYiG.exe
  C:\Windows\System\EMteYiG.exe
  2⤵
  PID:8448
- C:\Windows\System\DKNeJum.exe
  C:\Windows\System\DKNeJum.exe
  2⤵
  PID:8472
- C:\Windows\System\GlZBekl.exe
  C:\Windows\System\GlZBekl.exe
  2⤵
  PID:8500
- C:\Windows\System\ChoUPnv.exe
  C:\Windows\System\ChoUPnv.exe
  2⤵
  PID:8524
- C:\Windows\System\MidmlKk.exe
  C:\Windows\System\MidmlKk.exe
  2⤵
  PID:8556
- C:\Windows\System\GWUghhg.exe
  C:\Windows\System\GWUghhg.exe
  2⤵
  PID:8584
- C:\Windows\System\EMJhvrl.exe
  C:\Windows\System\EMJhvrl.exe
  2⤵
  PID:8612
- C:\Windows\System\daXTkqg.exe
  C:\Windows\System\daXTkqg.exe
  2⤵
  PID:8640
- C:\Windows\System\BYnTzfD.exe
  C:\Windows\System\BYnTzfD.exe
  2⤵
  PID:8668
- C:\Windows\System\jryzUhF.exe
  C:\Windows\System\jryzUhF.exe
  2⤵
  PID:8696
- C:\Windows\System\srYbuEV.exe
  C:\Windows\System\srYbuEV.exe
  2⤵
  PID:8724
- C:\Windows\System\yXUZkGY.exe
  C:\Windows\System\yXUZkGY.exe
  2⤵
  PID:8752
- C:\Windows\System\vpnxdhq.exe
  C:\Windows\System\vpnxdhq.exe
  2⤵
  PID:8780
- C:\Windows\System\jVrGyTR.exe
  C:\Windows\System\jVrGyTR.exe
  2⤵
  PID:8808
- C:\Windows\System\HcWOcDB.exe
  C:\Windows\System\HcWOcDB.exe
  2⤵
  PID:8836
- C:\Windows\System\CcbvkdP.exe
  C:\Windows\System\CcbvkdP.exe
  2⤵
  PID:8864
- C:\Windows\System\AvpLOnY.exe
  C:\Windows\System\AvpLOnY.exe
  2⤵
  PID:8888
- C:\Windows\System\WeWJIby.exe
  C:\Windows\System\WeWJIby.exe
  2⤵
  PID:8920
- C:\Windows\System\mnZOYGi.exe
  C:\Windows\System\mnZOYGi.exe
  2⤵
  PID:8936
- C:\Windows\System\cFutSan.exe
  C:\Windows\System\cFutSan.exe
  2⤵
  PID:8960
- C:\Windows\System\eFDTICm.exe
  C:\Windows\System\eFDTICm.exe
  2⤵
  PID:8976
- C:\Windows\System\GCjNVDi.exe
  C:\Windows\System\GCjNVDi.exe
  2⤵
  PID:8996
- C:\Windows\System\pmAfgDl.exe
  C:\Windows\System\pmAfgDl.exe
  2⤵
  PID:9016
- C:\Windows\System\vrtrLwk.exe
  C:\Windows\System\vrtrLwk.exe
  2⤵
  PID:9048
- C:\Windows\System\TinKRkl.exe
  C:\Windows\System\TinKRkl.exe
  2⤵
  PID:9076
- C:\Windows\System\muoqXvm.exe
  C:\Windows\System\muoqXvm.exe
  2⤵
  PID:9104
- C:\Windows\System\xmGMGdb.exe
  C:\Windows\System\xmGMGdb.exe
  2⤵
  PID:9124
- C:\Windows\System\natubCr.exe
  C:\Windows\System\natubCr.exe
  2⤵
  PID:9152
- C:\Windows\System\uebnhwh.exe
  C:\Windows\System\uebnhwh.exe
  2⤵
  PID:9180
- C:\Windows\System\EyQuhWE.exe
  C:\Windows\System\EyQuhWE.exe
  2⤵
  PID:8208
- C:\Windows\System\zzJGYBN.exe
  C:\Windows\System\zzJGYBN.exe
  2⤵
  PID:8268
- C:\Windows\System\YfsPKAY.exe
  C:\Windows\System\YfsPKAY.exe
  2⤵
  PID:8320
- C:\Windows\System\XsbQJqs.exe
  C:\Windows\System\XsbQJqs.exe
  2⤵
  PID:8376
- C:\Windows\System\PbpwvBv.exe
  C:\Windows\System\PbpwvBv.exe
  2⤵
  PID:8456
- C:\Windows\System\DLadqpl.exe
  C:\Windows\System\DLadqpl.exe
  2⤵
  PID:8508
- C:\Windows\System\hJdfDjw.exe
  C:\Windows\System\hJdfDjw.exe
  2⤵
  PID:8568
- C:\Windows\System\AiAylUc.exe
  C:\Windows\System\AiAylUc.exe
  2⤵
  PID:8636
- C:\Windows\System\IZwXOkq.exe
  C:\Windows\System\IZwXOkq.exe
  2⤵
  PID:8684
- C:\Windows\System\oaYiQOv.exe
  C:\Windows\System\oaYiQOv.exe
  2⤵
  PID:8744
- C:\Windows\System\TWVNalI.exe
  C:\Windows\System\TWVNalI.exe
  2⤵
  PID:8796
- C:\Windows\System\qJZXWkZ.exe
  C:\Windows\System\qJZXWkZ.exe
  2⤵
  PID:8896
- C:\Windows\System\tLHDzKD.exe
  C:\Windows\System\tLHDzKD.exe
  2⤵
  PID:8948
- C:\Windows\System\ArNgjvF.exe
  C:\Windows\System\ArNgjvF.exe
  2⤵
  PID:9024
- C:\Windows\System\JpvauFZ.exe
  C:\Windows\System\JpvauFZ.exe
  2⤵
  PID:9088
- C:\Windows\System\JZpxmSe.exe
  C:\Windows\System\JZpxmSe.exe
  2⤵
  PID:9092
- C:\Windows\System\WjvCsQh.exe
  C:\Windows\System\WjvCsQh.exe
  2⤵
  PID:8240
- C:\Windows\System\cVOBtzp.exe
  C:\Windows\System\cVOBtzp.exe
  2⤵
  PID:8396
- C:\Windows\System\kJgLmPr.exe
  C:\Windows\System\kJgLmPr.exe
  2⤵
  PID:8552
- C:\Windows\System\xvJrKcF.exe
  C:\Windows\System\xvJrKcF.exe
  2⤵
  PID:8492
- C:\Windows\System\giyfePz.exe
  C:\Windows\System\giyfePz.exe
  2⤵
  PID:8708
- C:\Windows\System\shsTnUi.exe
  C:\Windows\System\shsTnUi.exe
  2⤵
  PID:8884
- C:\Windows\System\MmsrGTF.exe
  C:\Windows\System\MmsrGTF.exe
  2⤵
  PID:9012
- C:\Windows\System\KyjtLvi.exe
  C:\Windows\System\KyjtLvi.exe
  2⤵
  PID:8292
- C:\Windows\System\MNQTAju.exe
  C:\Windows\System\MNQTAju.exe
  2⤵
  PID:9144
- C:\Windows\System\vdclpEr.exe
  C:\Windows\System\vdclpEr.exe
  2⤵
  PID:8736
- C:\Windows\System\rZUwufW.exe
  C:\Windows\System\rZUwufW.exe
  2⤵
  PID:9228
- C:\Windows\System\NPfajSU.exe
  C:\Windows\System\NPfajSU.exe
  2⤵
  PID:9256
- C:\Windows\System\cbgPJGf.exe
  C:\Windows\System\cbgPJGf.exe
  2⤵
  PID:9284
- C:\Windows\System\VFVnlBD.exe
  C:\Windows\System\VFVnlBD.exe
  2⤵
  PID:9316
- C:\Windows\System\tQTaCSz.exe
  C:\Windows\System\tQTaCSz.exe
  2⤵
  PID:9340
- C:\Windows\System\XrCsjEu.exe
  C:\Windows\System\XrCsjEu.exe
  2⤵
  PID:9372
- C:\Windows\System\nKtfjvq.exe
  C:\Windows\System\nKtfjvq.exe
  2⤵
  PID:9392
- C:\Windows\System\XcMxqmC.exe
  C:\Windows\System\XcMxqmC.exe
  2⤵
  PID:9424
- C:\Windows\System\pryehPu.exe
  C:\Windows\System\pryehPu.exe
  2⤵
  PID:9456
- C:\Windows\System\cGMBQub.exe
  C:\Windows\System\cGMBQub.exe
  2⤵
  PID:9480
- C:\Windows\System\wUZWeDk.exe
  C:\Windows\System\wUZWeDk.exe
  2⤵
  PID:9508
- C:\Windows\System\XqMQmJk.exe
  C:\Windows\System\XqMQmJk.exe
  2⤵
  PID:9536
- C:\Windows\System\ldAflNX.exe
  C:\Windows\System\ldAflNX.exe
  2⤵
  PID:9572
- C:\Windows\System\UwqkyPz.exe
  C:\Windows\System\UwqkyPz.exe
  2⤵
  PID:9592
- C:\Windows\System\slzkVNM.exe
  C:\Windows\System\slzkVNM.exe
  2⤵
  PID:9628
- C:\Windows\System\pbuKCJI.exe
  C:\Windows\System\pbuKCJI.exe
  2⤵
  PID:9656
- C:\Windows\System\BSlnJPM.exe
  C:\Windows\System\BSlnJPM.exe
  2⤵
  PID:9684
- C:\Windows\System\ndiNTjt.exe
  C:\Windows\System\ndiNTjt.exe
  2⤵
  PID:9708
- C:\Windows\System\QZaJAoQ.exe
  C:\Windows\System\QZaJAoQ.exe
  2⤵
  PID:9736
- C:\Windows\System\BztagVz.exe
  C:\Windows\System\BztagVz.exe
  2⤵
  PID:9764
- C:\Windows\System\FCwjNhf.exe
  C:\Windows\System\FCwjNhf.exe
  2⤵
  PID:9792
- C:\Windows\System\LSFOIje.exe
  C:\Windows\System\LSFOIje.exe
  2⤵
  PID:9824
- C:\Windows\System\XimUaqm.exe
  C:\Windows\System\XimUaqm.exe
  2⤵
  PID:9848
- C:\Windows\System\HnDtiep.exe
  C:\Windows\System\HnDtiep.exe
  2⤵
  PID:9872
- C:\Windows\System\nsnZNeu.exe
  C:\Windows\System\nsnZNeu.exe
  2⤵
  PID:9900
- C:\Windows\System\euSTsjM.exe
  C:\Windows\System\euSTsjM.exe
  2⤵
  PID:9924
- C:\Windows\System\vqwgutr.exe
  C:\Windows\System\vqwgutr.exe
  2⤵
  PID:9956
- C:\Windows\System\okyGhaV.exe
  C:\Windows\System\okyGhaV.exe
  2⤵
  PID:9980
- C:\Windows\System\zAokVWJ.exe
  C:\Windows\System\zAokVWJ.exe
  2⤵
  PID:10012
- C:\Windows\System\ZsunZif.exe
  C:\Windows\System\ZsunZif.exe
  2⤵
  PID:10040
- C:\Windows\System\qyKHcrD.exe
  C:\Windows\System\qyKHcrD.exe
  2⤵
  PID:10064
- C:\Windows\System\MxNoGkj.exe
  C:\Windows\System\MxNoGkj.exe
  2⤵
  PID:10088
- C:\Windows\System\jlMudBC.exe
  C:\Windows\System\jlMudBC.exe
  2⤵
  PID:10116
- C:\Windows\System\CrHMNSR.exe
  C:\Windows\System\CrHMNSR.exe
  2⤵
  PID:10144
- C:\Windows\System\FLfkNPl.exe
  C:\Windows\System\FLfkNPl.exe
  2⤵
  PID:10172
- C:\Windows\System\gLgAHWR.exe
  C:\Windows\System\gLgAHWR.exe
  2⤵
  PID:10208
- C:\Windows\System\JnpHvKv.exe
  C:\Windows\System\JnpHvKv.exe
  2⤵
  PID:10232
- C:\Windows\System\ZnlwIpe.exe
  C:\Windows\System\ZnlwIpe.exe
  2⤵
  PID:9072
- C:\Windows\System\jtcDpSS.exe
  C:\Windows\System\jtcDpSS.exe
  2⤵
  PID:9268
- C:\Windows\System\DPsCCoC.exe
  C:\Windows\System\DPsCCoC.exe
  2⤵
  PID:9332
- C:\Windows\System\VLcufoo.exe
  C:\Windows\System\VLcufoo.exe
  2⤵
  PID:9304
- C:\Windows\System\zxBfymB.exe
  C:\Windows\System\zxBfymB.exe
  2⤵
  PID:9440
- C:\Windows\System\MDrzQJj.exe
  C:\Windows\System\MDrzQJj.exe
  2⤵
  PID:9532
- C:\Windows\System\cTsvKCo.exe
  C:\Windows\System\cTsvKCo.exe
  2⤵
  PID:9580
- C:\Windows\System\ChCTZDJ.exe
  C:\Windows\System\ChCTZDJ.exe
  2⤵
  PID:9648
- C:\Windows\System\QYCdIyg.exe
  C:\Windows\System\QYCdIyg.exe
  2⤵
  PID:9616
- C:\Windows\System\tNQcWxg.exe
  C:\Windows\System\tNQcWxg.exe
  2⤵
  PID:9760
- C:\Windows\System\bLfNDHQ.exe
  C:\Windows\System\bLfNDHQ.exe
  2⤵
  PID:9756
- C:\Windows\System\ilUILlT.exe
  C:\Windows\System\ilUILlT.exe
  2⤵
  PID:9916
- C:\Windows\System\WeFnJut.exe
  C:\Windows\System\WeFnJut.exe
  2⤵
  PID:9944
- C:\Windows\System\bhgqVuf.exe
  C:\Windows\System\bhgqVuf.exe
  2⤵
  PID:10004
- C:\Windows\System\fUoQYyN.exe
  C:\Windows\System\fUoQYyN.exe
  2⤵
  PID:9948
- C:\Windows\System\RCyXEnQ.exe
  C:\Windows\System\RCyXEnQ.exe
  2⤵
  PID:10160
- C:\Windows\System\kcFoWPJ.exe
  C:\Windows\System\kcFoWPJ.exe
  2⤵
  PID:10204
- C:\Windows\System\aHhQmAy.exe
  C:\Windows\System\aHhQmAy.exe
  2⤵
  PID:9300
- C:\Windows\System\ZkYFtfV.exe
  C:\Windows\System\ZkYFtfV.exe
  2⤵
  PID:9240
- C:\Windows\System\DdDFSSK.exe
  C:\Windows\System\DdDFSSK.exe
  2⤵
  PID:9524
- C:\Windows\System\rMpuZrB.exe
  C:\Windows\System\rMpuZrB.exe
  2⤵
  PID:9500
- C:\Windows\System\lxNcRUi.exe
  C:\Windows\System\lxNcRUi.exe
  2⤵
  PID:9720
- C:\Windows\System\rpgHywH.exe
  C:\Windows\System\rpgHywH.exe
  2⤵
  PID:9908
- C:\Windows\System\pxbbMut.exe
  C:\Windows\System\pxbbMut.exe
  2⤵
  PID:9060
- C:\Windows\System\KxZVPYE.exe
  C:\Windows\System\KxZVPYE.exe
  2⤵
  PID:9748
- C:\Windows\System\jKUJbgg.exe
  C:\Windows\System\jKUJbgg.exe
  2⤵
  PID:10056
- C:\Windows\System\tKzJcgF.exe
  C:\Windows\System\tKzJcgF.exe
  2⤵
  PID:10264
- C:\Windows\System\fipRBfz.exe
  C:\Windows\System\fipRBfz.exe
  2⤵
  PID:10292
- C:\Windows\System\iwoRLmC.exe
  C:\Windows\System\iwoRLmC.exe
  2⤵
  PID:10324
- C:\Windows\System\AgXFIPS.exe
  C:\Windows\System\AgXFIPS.exe
  2⤵
  PID:10360
- C:\Windows\System\eAbENQf.exe
  C:\Windows\System\eAbENQf.exe
  2⤵
  PID:10388
- C:\Windows\System\AMOaTyr.exe
  C:\Windows\System\AMOaTyr.exe
  2⤵
  PID:10428
- C:\Windows\System\wyGAKHC.exe
  C:\Windows\System\wyGAKHC.exe
  2⤵
  PID:10492
- C:\Windows\System\vIALULg.exe
  C:\Windows\System\vIALULg.exe
  2⤵
  PID:10524
- C:\Windows\System\APKlKOs.exe
  C:\Windows\System\APKlKOs.exe
  2⤵
  PID:10548
- C:\Windows\System\DQyWkxG.exe
  C:\Windows\System\DQyWkxG.exe
  2⤵
  PID:10576
- C:\Windows\System\FWhzfSE.exe
  C:\Windows\System\FWhzfSE.exe
  2⤵
  PID:10608
- C:\Windows\System\PaBITjg.exe
  C:\Windows\System\PaBITjg.exe
  2⤵
  PID:10632
- C:\Windows\System\lFoesGz.exe
  C:\Windows\System\lFoesGz.exe
  2⤵
  PID:10664
- C:\Windows\System\MWKdGsj.exe
  C:\Windows\System\MWKdGsj.exe
  2⤵
  PID:10704
- C:\Windows\System\CRzEQeY.exe
  C:\Windows\System\CRzEQeY.exe
  2⤵
  PID:10732
- C:\Windows\System\PRHmEwA.exe
  C:\Windows\System\PRHmEwA.exe
  2⤵
  PID:10768
- C:\Windows\System\DqjEqaA.exe
  C:\Windows\System\DqjEqaA.exe
  2⤵
  PID:10788
- C:\Windows\System\QDKFzKt.exe
  C:\Windows\System\QDKFzKt.exe
  2⤵
  PID:10820
- C:\Windows\System\ugbqRvL.exe
  C:\Windows\System\ugbqRvL.exe
  2⤵
  PID:10848
- C:\Windows\System\XHfxwMo.exe
  C:\Windows\System\XHfxwMo.exe
  2⤵
  PID:10884
- C:\Windows\System\DpZzZmd.exe
  C:\Windows\System\DpZzZmd.exe
  2⤵
  PID:10916
- C:\Windows\System\JCFQUzi.exe
  C:\Windows\System\JCFQUzi.exe
  2⤵
  PID:10940
- C:\Windows\System\lnHQAng.exe
  C:\Windows\System\lnHQAng.exe
  2⤵
  PID:10976
- C:\Windows\System\nSjJZZy.exe
  C:\Windows\System\nSjJZZy.exe
  2⤵
  PID:11000
- C:\Windows\System\SdoxQIG.exe
  C:\Windows\System\SdoxQIG.exe
  2⤵
  PID:11020
- C:\Windows\System\AYWIzuF.exe
  C:\Windows\System\AYWIzuF.exe
  2⤵
  PID:11064
- C:\Windows\System\EfZWgyU.exe
  C:\Windows\System\EfZWgyU.exe
  2⤵
  PID:11092
- C:\Windows\System\TyiMJlV.exe
  C:\Windows\System\TyiMJlV.exe
  2⤵
  PID:11124
- C:\Windows\System\nUJdZWm.exe
  C:\Windows\System\nUJdZWm.exe
  2⤵
  PID:11160
- C:\Windows\System\PZTlGqO.exe
  C:\Windows\System\PZTlGqO.exe
  2⤵
  PID:11192
- C:\Windows\System\eOMoPgR.exe
  C:\Windows\System\eOMoPgR.exe
  2⤵
  PID:11216
- C:\Windows\System\rYWDZqy.exe
  C:\Windows\System\rYWDZqy.exe
  2⤵
  PID:11248
- C:\Windows\System\xAlupno.exe
  C:\Windows\System\xAlupno.exe
  2⤵
  PID:9704
- C:\Windows\System\HrbOEBi.exe
  C:\Windows\System\HrbOEBi.exe
  2⤵
  PID:10284
- C:\Windows\System\VBKpUoA.exe
  C:\Windows\System\VBKpUoA.exe
  2⤵
  PID:10280
- C:\Windows\System\qkvvvVp.exe
  C:\Windows\System\qkvvvVp.exe
  2⤵
  PID:10344
- C:\Windows\System\YPWbiHn.exe
  C:\Windows\System\YPWbiHn.exe
  2⤵
  PID:10508
- C:\Windows\System\Aiefmyn.exe
  C:\Windows\System\Aiefmyn.exe
  2⤵
  PID:10532
- C:\Windows\System\xQnWHPk.exe
  C:\Windows\System\xQnWHPk.exe
  2⤵
  PID:10440
- C:\Windows\System\XvGLsqg.exe
  C:\Windows\System\XvGLsqg.exe
  2⤵
  PID:10644
- C:\Windows\System\SSyjsJs.exe
  C:\Windows\System\SSyjsJs.exe
  2⤵
  PID:10784
- C:\Windows\System\xcQKREh.exe
  C:\Windows\System\xcQKREh.exe
  2⤵
  PID:10804
- C:\Windows\System\FtYNuuG.exe
  C:\Windows\System\FtYNuuG.exe
  2⤵
  PID:10836
- C:\Windows\System\ebwTKAW.exe
  C:\Windows\System\ebwTKAW.exe
  2⤵
  PID:10844
- C:\Windows\System\GlfJenn.exe
  C:\Windows\System\GlfJenn.exe
  2⤵
  PID:10900
- C:\Windows\System\EMRPZXr.exe
  C:\Windows\System\EMRPZXr.exe
  2⤵
  PID:11136
- C:\Windows\System\ApLOsKO.exe
  C:\Windows\System\ApLOsKO.exe
  2⤵
  PID:11184
- C:\Windows\System\qilcgnO.exe
  C:\Windows\System\qilcgnO.exe
  2⤵
  PID:11112
- C:\Windows\System\ZIxtjXr.exe
  C:\Windows\System\ZIxtjXr.exe
  2⤵
  PID:10332
- C:\Windows\System\ArfIJfj.exe
  C:\Windows\System\ArfIJfj.exe
  2⤵
  PID:10384
- C:\Windows\System\viXhHgo.exe
  C:\Windows\System\viXhHgo.exe
  2⤵
  PID:10424
- C:\Windows\System\YXMavzs.exe
  C:\Windows\System\YXMavzs.exe
  2⤵
  PID:10816
- C:\Windows\System\zbIXwqB.exe
  C:\Windows\System\zbIXwqB.exe
  2⤵
  PID:10880
- C:\Windows\System\NWKAhOC.exe
  C:\Windows\System\NWKAhOC.exe
  2⤵
  PID:9620
- C:\Windows\System\RfNROOd.exe
  C:\Windows\System\RfNROOd.exe
  2⤵
  PID:11076
- C:\Windows\System\HpRdXTq.exe
  C:\Windows\System\HpRdXTq.exe
  2⤵
  PID:10124
- C:\Windows\System\WrdRVGv.exe
  C:\Windows\System\WrdRVGv.exe
  2⤵
  PID:10376
- C:\Windows\System\JRWFSWP.exe
  C:\Windows\System\JRWFSWP.exe
  2⤵
  PID:10716
- C:\Windows\System\RgfFXaJ.exe
  C:\Windows\System\RgfFXaJ.exe
  2⤵
  PID:11280
- C:\Windows\System\sfxfczH.exe
  C:\Windows\System\sfxfczH.exe
  2⤵
  PID:11296
- C:\Windows\System\qEeJDMZ.exe
  C:\Windows\System\qEeJDMZ.exe
  2⤵
  PID:11312
- C:\Windows\System\jPUWwAU.exe
  C:\Windows\System\jPUWwAU.exe
  2⤵
  PID:11332
- C:\Windows\System\hXbfDDL.exe
  C:\Windows\System\hXbfDDL.exe
  2⤵
  PID:11356
- C:\Windows\System\yJNTjaO.exe
  C:\Windows\System\yJNTjaO.exe
  2⤵
  PID:11392
- C:\Windows\System\CnptfCg.exe
  C:\Windows\System\CnptfCg.exe
  2⤵
  PID:11420
- C:\Windows\System\eKOIgeG.exe
  C:\Windows\System\eKOIgeG.exe
  2⤵
  PID:11436
- C:\Windows\System\nIvjSio.exe
  C:\Windows\System\nIvjSio.exe
  2⤵
  PID:11452
- C:\Windows\System\rhWkBqn.exe
  C:\Windows\System\rhWkBqn.exe
  2⤵
  PID:11480
- C:\Windows\System\ZIqNTkP.exe
  C:\Windows\System\ZIqNTkP.exe
  2⤵
  PID:11512
- C:\Windows\System\nKmNwJL.exe
  C:\Windows\System\nKmNwJL.exe
  2⤵
  PID:11528
- C:\Windows\System\YZyAZRT.exe
  C:\Windows\System\YZyAZRT.exe
  2⤵
  PID:11560
- C:\Windows\System\nVMfgkp.exe
  C:\Windows\System\nVMfgkp.exe
  2⤵
  PID:11584
- C:\Windows\System\cHgXXov.exe
  C:\Windows\System\cHgXXov.exe
  2⤵
  PID:11612
- C:\Windows\System\hgibkpo.exe
  C:\Windows\System\hgibkpo.exe
  2⤵
  PID:11648
- C:\Windows\System\HxfBseV.exe
  C:\Windows\System\HxfBseV.exe
  2⤵
  PID:11672
- C:\Windows\System\NdcbFVJ.exe
  C:\Windows\System\NdcbFVJ.exe
  2⤵
  PID:11704
- C:\Windows\System\jySsJfh.exe
  C:\Windows\System\jySsJfh.exe
  2⤵
  PID:11732
- C:\Windows\System\FmiyBuq.exe
  C:\Windows\System\FmiyBuq.exe
  2⤵
  PID:11764
- C:\Windows\System\GLEZaDO.exe
  C:\Windows\System\GLEZaDO.exe
  2⤵
  PID:11796
- C:\Windows\System\mMycewb.exe
  C:\Windows\System\mMycewb.exe
  2⤵
  PID:11832
- C:\Windows\System\plXLqBS.exe
  C:\Windows\System\plXLqBS.exe
  2⤵
  PID:12020
- C:\Windows\System\JDmvavU.exe
  C:\Windows\System\JDmvavU.exe
  2⤵
  PID:12036
- C:\Windows\System\ehtCebo.exe
  C:\Windows\System\ehtCebo.exe
  2⤵
  PID:12052
- C:\Windows\System\OVzdAri.exe
  C:\Windows\System\OVzdAri.exe
  2⤵
  PID:12080
- C:\Windows\System\NxeolYb.exe
  C:\Windows\System\NxeolYb.exe
  2⤵
  PID:12108
- C:\Windows\System\KVAUSWs.exe
  C:\Windows\System\KVAUSWs.exe
  2⤵
  PID:12136
- C:\Windows\System\hQYDkNc.exe
  C:\Windows\System\hQYDkNc.exe
  2⤵
  PID:12164
- C:\Windows\System\UPmWHtC.exe
  C:\Windows\System\UPmWHtC.exe
  2⤵
  PID:12184
- C:\Windows\System\Ectmano.exe
  C:\Windows\System\Ectmano.exe
  2⤵
  PID:12212
- C:\Windows\System\aTBktbT.exe
  C:\Windows\System\aTBktbT.exe
  2⤵
  PID:12240
- C:\Windows\System\XmlMWxn.exe
  C:\Windows\System\XmlMWxn.exe
  2⤵
  PID:12264
- C:\Windows\System\ynzJsbZ.exe
  C:\Windows\System\ynzJsbZ.exe
  2⤵
  PID:12280
- C:\Windows\System\CCyUMKn.exe
  C:\Windows\System\CCyUMKn.exe
  2⤵
  PID:10680
- C:\Windows\System\LMASeHz.exe
  C:\Windows\System\LMASeHz.exe
  2⤵
  PID:11272
- C:\Windows\System\DNyWFhh.exe
  C:\Windows\System\DNyWFhh.exe
  2⤵
  PID:11348
- C:\Windows\System\UYAKhyi.exe
  C:\Windows\System\UYAKhyi.exe
  2⤵
  PID:11404
- C:\Windows\System\KXNmlMK.exe
  C:\Windows\System\KXNmlMK.exe
  2⤵
  PID:11308
- C:\Windows\System\tCOfAqY.exe
  C:\Windows\System\tCOfAqY.exe
  2⤵
  PID:11444
- C:\Windows\System\ZJWwKOw.exe
  C:\Windows\System\ZJWwKOw.exe
  2⤵
  PID:11608
- C:\Windows\System\KuaTqJC.exe
  C:\Windows\System\KuaTqJC.exe
  2⤵
  PID:11664
- C:\Windows\System\dNbyURo.exe
  C:\Windows\System\dNbyURo.exe
  2⤵
  PID:11572
- C:\Windows\System\wntOYRK.exe
  C:\Windows\System\wntOYRK.exe
  2⤵
  PID:11544
- C:\Windows\System\VKkyukY.exe
  C:\Windows\System\VKkyukY.exe
  2⤵
  PID:11792
- C:\Windows\System\PXBidrh.exe
  C:\Windows\System\PXBidrh.exe
  2⤵
  PID:11756
- C:\Windows\System\TyElzsU.exe
  C:\Windows\System\TyElzsU.exe
  2⤵
  PID:11932
- C:\Windows\System\LxsYvJw.exe
  C:\Windows\System\LxsYvJw.exe
  2⤵
  PID:11992
- C:\Windows\System\bqJqYSP.exe
  C:\Windows\System\bqJqYSP.exe
  2⤵
  PID:12072
- C:\Windows\System\UEFUFpK.exe
  C:\Windows\System\UEFUFpK.exe
  2⤵
  PID:12124
- C:\Windows\System\AeAzMkF.exe
  C:\Windows\System\AeAzMkF.exe
  2⤵
  PID:12204
- C:\Windows\System\vUiNDIM.exe
  C:\Windows\System\vUiNDIM.exe
  2⤵
  PID:12252
- C:\Windows\System\anXzBEF.exe
  C:\Windows\System\anXzBEF.exe
  2⤵
  PID:11176
- C:\Windows\System\fuUIBgz.exe
  C:\Windows\System\fuUIBgz.exe
  2⤵
  PID:12276
- C:\Windows\System\edLbEcf.exe
  C:\Windows\System\edLbEcf.exe
  2⤵
  PID:11504
- C:\Windows\System\pClOYUJ.exe
  C:\Windows\System\pClOYUJ.exe
  2⤵
  PID:11388
- C:\Windows\System\lQeDnuH.exe
  C:\Windows\System\lQeDnuH.exe
  2⤵
  PID:11684
- C:\Windows\System\ERjDyzX.exe
  C:\Windows\System\ERjDyzX.exe
  2⤵
  PID:11880
- C:\Windows\System\UoGZXVg.exe
  C:\Windows\System\UoGZXVg.exe
  2⤵
  PID:11604
- C:\Windows\System\GfzQYIs.exe
  C:\Windows\System\GfzQYIs.exe
  2⤵
  PID:12228
- C:\Windows\System\pzQyvHg.exe
  C:\Windows\System\pzQyvHg.exe
  2⤵
  PID:11292
- C:\Windows\System\Yqbsafu.exe
  C:\Windows\System\Yqbsafu.exe
  2⤵
  PID:12196
- C:\Windows\System\QKOrOHa.exe
  C:\Windows\System\QKOrOHa.exe
  2⤵
  PID:12316
- C:\Windows\System\xQVJGdx.exe
  C:\Windows\System\xQVJGdx.exe
  2⤵
  PID:12344
- C:\Windows\System\gmmnDiM.exe
  C:\Windows\System\gmmnDiM.exe
  2⤵
  PID:12364
- C:\Windows\System\aKkznRW.exe
  C:\Windows\System\aKkznRW.exe
  2⤵
  PID:12388
- C:\Windows\System\pZFvjIq.exe
  C:\Windows\System\pZFvjIq.exe
  2⤵
  PID:12412
- C:\Windows\System\CIaJwjH.exe
  C:\Windows\System\CIaJwjH.exe
  2⤵
  PID:12436
- C:\Windows\System\LOkmbND.exe
  C:\Windows\System\LOkmbND.exe
  2⤵
  PID:12464
- C:\Windows\System\KyvQrsz.exe
  C:\Windows\System\KyvQrsz.exe
  2⤵
  PID:12496
- C:\Windows\System\FsXLLCJ.exe
  C:\Windows\System\FsXLLCJ.exe
  2⤵
  PID:12524
- C:\Windows\System\XjafQeq.exe
  C:\Windows\System\XjafQeq.exe
  2⤵
  PID:12544
- C:\Windows\System\deMVvPt.exe
  C:\Windows\System\deMVvPt.exe
  2⤵
  PID:12572
- C:\Windows\System\QeZJCPC.exe
  C:\Windows\System\QeZJCPC.exe
  2⤵
  PID:12596
- C:\Windows\System\AfXpdba.exe
  C:\Windows\System\AfXpdba.exe
  2⤵
  PID:12632
- C:\Windows\System\HykYGlS.exe
  C:\Windows\System\HykYGlS.exe
  2⤵
  PID:12656
- C:\Windows\System\DBNGVYl.exe
  C:\Windows\System\DBNGVYl.exe
  2⤵
  PID:12692
- C:\Windows\System\fgKBfci.exe
  C:\Windows\System\fgKBfci.exe
  2⤵
  PID:12712
- C:\Windows\System\mHVqAkE.exe
  C:\Windows\System\mHVqAkE.exe
  2⤵
  PID:12732
- C:\Windows\System\ZZyZpDQ.exe
  C:\Windows\System\ZZyZpDQ.exe
  2⤵
  PID:12768
- C:\Windows\System\FhuZnbJ.exe
  C:\Windows\System\FhuZnbJ.exe
  2⤵
  PID:12804
- C:\Windows\System\ujLTchc.exe
  C:\Windows\System\ujLTchc.exe
  2⤵
  PID:12832
- C:\Windows\System\uZCBkov.exe
  C:\Windows\System\uZCBkov.exe
  2⤵
  PID:12860
- C:\Windows\System\aXMafRd.exe
  C:\Windows\System\aXMafRd.exe
  2⤵
  PID:12880
- C:\Windows\System\SNMIVWv.exe
  C:\Windows\System\SNMIVWv.exe
  2⤵
  PID:12912
- C:\Windows\System\yNKwOMq.exe
  C:\Windows\System\yNKwOMq.exe
  2⤵
  PID:12948
- C:\Windows\System\pBDLHxd.exe
  C:\Windows\System\pBDLHxd.exe
  2⤵
  PID:12980
- C:\Windows\System\FsbHNWF.exe
  C:\Windows\System\FsbHNWF.exe
  2⤵
  PID:13000
- C:\Windows\System\WoJFqrF.exe
  C:\Windows\System\WoJFqrF.exe
  2⤵
  PID:13016
- C:\Windows\System\iXezRsu.exe
  C:\Windows\System\iXezRsu.exe
  2⤵
  PID:13048
- C:\Windows\System\MsQUzVg.exe
  C:\Windows\System\MsQUzVg.exe
  2⤵
  PID:13080
- C:\Windows\System\XVAjnBe.exe
  C:\Windows\System\XVAjnBe.exe
  2⤵
  PID:13104
- C:\Windows\System\ZaRrBxl.exe
  C:\Windows\System\ZaRrBxl.exe
  2⤵
  PID:13132
- C:\Windows\System\mqCJroa.exe
  C:\Windows\System\mqCJroa.exe
  2⤵
  PID:13156
- C:\Windows\System\gDeAeVg.exe
  C:\Windows\System\gDeAeVg.exe
  2⤵
  PID:13172
- C:\Windows\System\wvvhcfq.exe
  C:\Windows\System\wvvhcfq.exe
  2⤵
  PID:13196
- C:\Windows\System\mXrpwVO.exe
  C:\Windows\System\mXrpwVO.exe
  2⤵
  PID:13228
- C:\Windows\System\DjnTQgO.exe
  C:\Windows\System\DjnTQgO.exe
  2⤵
  PID:13256
- C:\Windows\System\Gdcxtas.exe
  C:\Windows\System\Gdcxtas.exe
  2⤵
  PID:13288
- C:\Windows\System\AxTmxvw.exe
  C:\Windows\System\AxTmxvw.exe
  2⤵
  PID:12272
- C:\Windows\System\GnTiAgq.exe
  C:\Windows\System\GnTiAgq.exe
  2⤵
  PID:12152
- C:\Windows\System\eHvtMqB.exe
  C:\Windows\System\eHvtMqB.exe
  2⤵
  PID:11476
- C:\Windows\System\UzRedrq.exe
  C:\Windows\System\UzRedrq.exe
  2⤵
  PID:12432
- C:\Windows\System\ZNYVwGH.exe
  C:\Windows\System\ZNYVwGH.exe
  2⤵
  PID:12520
- C:\Windows\System\VIvvvoy.exe
  C:\Windows\System\VIvvvoy.exe
  2⤵
  PID:12032
- C:\Windows\System\oHUgJcm.exe
  C:\Windows\System\oHUgJcm.exe
  2⤵
  PID:12420
- C:\Windows\System\CoVvxOR.exe
  C:\Windows\System\CoVvxOR.exe
  2⤵
  PID:12356
- C:\Windows\System\xOOAwNl.exe
  C:\Windows\System\xOOAwNl.exe
  2⤵
  PID:12684
- C:\Windows\System\HrVeHCO.exe
  C:\Windows\System\HrVeHCO.exe
  2⤵
  PID:12508
- C:\Windows\System\QxRslsp.exe
  C:\Windows\System\QxRslsp.exe
  2⤵
  PID:12532
- C:\Windows\System\rahNaBy.exe
  C:\Windows\System\rahNaBy.exe
  2⤵
  PID:12792
- C:\Windows\System\UefiWwl.exe
  C:\Windows\System\UefiWwl.exe
  2⤵
  PID:12728
- C:\Windows\System\hGratPD.exe
  C:\Windows\System\hGratPD.exe
  2⤵
  PID:12996
- C:\Windows\System\sUiPYsE.exe
  C:\Windows\System\sUiPYsE.exe
  2⤵
  PID:12892
- C:\Windows\System\bgyLdlj.exe
  C:\Windows\System\bgyLdlj.exe
  2⤵
  PID:12992
- C:\Windows\System\yroLtko.exe
  C:\Windows\System\yroLtko.exe
  2⤵
  PID:13300
- C:\Windows\System\aMQOmQe.exe
  C:\Windows\System\aMQOmQe.exe
  2⤵
  PID:13012
- C:\Windows\System\RIZGFSM.exe
  C:\Windows\System\RIZGFSM.exe
  2⤵
  PID:13220
- C:\Windows\System\WXlqJAm.exe
  C:\Windows\System\WXlqJAm.exe
  2⤵
  PID:13296
- C:\Windows\System\cRjQfut.exe
  C:\Windows\System\cRjQfut.exe
  2⤵
  PID:13144
- C:\Windows\System\YdzEOQq.exe
  C:\Windows\System\YdzEOQq.exe
  2⤵
  PID:13184
- C:\Windows\System\OcXdeBQ.exe
  C:\Windows\System\OcXdeBQ.exe
  2⤵
  PID:12652
- C:\Windows\System\NMVnYkj.exe
  C:\Windows\System\NMVnYkj.exe
  2⤵
  PID:12972
- C:\Windows\System\AjGzWnu.exe
  C:\Windows\System\AjGzWnu.exe
  2⤵
  PID:12784
- C:\Windows\System\gGjdYCv.exe
  C:\Windows\System\gGjdYCv.exe
  2⤵
  PID:12476
- C:\Windows\System\iEOzfOO.exe
  C:\Windows\System\iEOzfOO.exe
  2⤵
  PID:13332
- C:\Windows\System\ahKlcKT.exe
  C:\Windows\System\ahKlcKT.exe
  2⤵
  PID:13364
- C:\Windows\System\sJvLEKp.exe
  C:\Windows\System\sJvLEKp.exe
  2⤵
  PID:13388
- C:\Windows\System\kjfcFBj.exe
  C:\Windows\System\kjfcFBj.exe
  2⤵
  PID:13408
- C:\Windows\System\zEKzEwq.exe
  C:\Windows\System\zEKzEwq.exe
  2⤵
  PID:13440
- C:\Windows\System\dsucZMX.exe
  C:\Windows\System\dsucZMX.exe
  2⤵
  PID:13460
- C:\Windows\System\quZyqJS.exe
  C:\Windows\System\quZyqJS.exe
  2⤵
  PID:13492
- C:\Windows\System\rRuSVNq.exe
  C:\Windows\System\rRuSVNq.exe
  2⤵
  PID:13524
- C:\Windows\System\KyDwdhI.exe
  C:\Windows\System\KyDwdhI.exe
  2⤵
  PID:13548
- C:\Windows\System\vOkGnEs.exe
  C:\Windows\System\vOkGnEs.exe
  2⤵
  PID:13564
- C:\Windows\System\fgyAsJQ.exe
  C:\Windows\System\fgyAsJQ.exe
  2⤵
  PID:13588
- C:\Windows\System\UpiZKPR.exe
  C:\Windows\System\UpiZKPR.exe
  2⤵
  PID:13612
- C:\Windows\System\bEjjMrW.exe
  C:\Windows\System\bEjjMrW.exe
  2⤵
  PID:13656
- C:\Windows\System\jceUlnh.exe
  C:\Windows\System\jceUlnh.exe
  2⤵
  PID:13676
- C:\Windows\System\gMYegRI.exe
  C:\Windows\System\gMYegRI.exe
  2⤵
  PID:13708
- C:\Windows\System\YQkpamm.exe
  C:\Windows\System\YQkpamm.exe
  2⤵
  PID:13736
- C:\Windows\System\glujUxX.exe
  C:\Windows\System\glujUxX.exe
  2⤵
  PID:13768
- C:\Windows\System\IrHOVvW.exe
  C:\Windows\System\IrHOVvW.exe
  2⤵
  PID:13796
- C:\Windows\System\fDtYOXy.exe
  C:\Windows\System\fDtYOXy.exe
  2⤵
  PID:13824
- C:\Windows\System\AsjxSjZ.exe
  C:\Windows\System\AsjxSjZ.exe
  2⤵
  PID:13840
- C:\Windows\System\tmZAIXR.exe
  C:\Windows\System\tmZAIXR.exe
  2⤵
  PID:13864
- C:\Windows\System\FznJCRd.exe
  C:\Windows\System\FznJCRd.exe
  2⤵
  PID:13892
- C:\Windows\System\vHDRUXr.exe
  C:\Windows\System\vHDRUXr.exe
  2⤵
  PID:13912
- C:\Windows\System\MWNLcbM.exe
  C:\Windows\System\MWNLcbM.exe
  2⤵
  PID:13948
- C:\Windows\System\KIrEtox.exe
  C:\Windows\System\KIrEtox.exe
  2⤵
  PID:13976
- C:\Windows\System\YYOYVAe.exe
  C:\Windows\System\YYOYVAe.exe
  2⤵
  PID:13996
- C:\Windows\System\URmEQnj.exe
  C:\Windows\System\URmEQnj.exe
  2⤵
  PID:14024
- C:\Windows\System\LefrQoq.exe
  C:\Windows\System\LefrQoq.exe
  2⤵
  PID:14044
- C:\Windows\System\Wepubnc.exe
  C:\Windows\System\Wepubnc.exe
  2⤵
  PID:14064
- C:\Windows\System\AwkTDnp.exe
  C:\Windows\System\AwkTDnp.exe
  2⤵
  PID:14092
- C:\Windows\System\ZouyiEg.exe
  C:\Windows\System\ZouyiEg.exe
  2⤵
  PID:14128
- C:\Windows\System\DPWAjnc.exe
  C:\Windows\System\DPWAjnc.exe
  2⤵
  PID:14148
- C:\Windows\System\tYgwWMO.exe
  C:\Windows\System\tYgwWMO.exe
  2⤵
  PID:14168
- C:\Windows\System\jGmvtdG.exe
  C:\Windows\System\jGmvtdG.exe
  2⤵
  PID:14212
- C:\Windows\System\kcVjAhj.exe
  C:\Windows\System\kcVjAhj.exe
  2⤵
  PID:14236
- C:\Windows\System\iGrycId.exe
  C:\Windows\System\iGrycId.exe
  2⤵
  PID:14256
- C:\Windows\System\fAAbtGR.exe
  C:\Windows\System\fAAbtGR.exe
  2⤵
  PID:14280
- C:\Windows\System\LzXygWZ.exe
  C:\Windows\System\LzXygWZ.exe
  2⤵
  PID:14308
- C:\Windows\System\WxgJGUA.exe
  C:\Windows\System\WxgJGUA.exe
  2⤵
  PID:13216
- C:\Windows\System\jiUfsEJ.exe
  C:\Windows\System\jiUfsEJ.exe
  2⤵
  PID:13168
- C:\Windows\System\VTUuGGD.exe
  C:\Windows\System\VTUuGGD.exe
  2⤵
  PID:12968
- C:\Windows\System\KCgAVJb.exe
  C:\Windows\System\KCgAVJb.exe
  2⤵
  PID:13324
- C:\Windows\System\IMtwpYP.exe
  C:\Windows\System\IMtwpYP.exe
  2⤵
  PID:13152
- C:\Windows\System\aNyamGx.exe
  C:\Windows\System\aNyamGx.exe
  2⤵
  PID:1656
- C:\Windows\System\ZUKOZMq.exe
  C:\Windows\System\ZUKOZMq.exe
  2⤵
  PID:13540
- C:\Windows\System\IiAsscG.exe
  C:\Windows\System\IiAsscG.exe
  2⤵
  PID:13640
- C:\Windows\System\esNVPpQ.exe
  C:\Windows\System\esNVPpQ.exe
  2⤵
  PID:13600
- C:\Windows\System\rBCjvrx.exe
  C:\Windows\System\rBCjvrx.exe
  2⤵
  PID:13476
- C:\Windows\System\RRsqIkq.exe
  C:\Windows\System\RRsqIkq.exe
  2⤵
  PID:13704
- C:\Windows\System\NSedCVp.exe
  C:\Windows\System\NSedCVp.exe
  2⤵
  PID:13784
- C:\Windows\System\QPOSyVr.exe
  C:\Windows\System\QPOSyVr.exe
  2⤵
  PID:13684
- C:\Windows\System\BULeFEK.exe
  C:\Windows\System\BULeFEK.exe
  2⤵
  PID:13992
- C:\Windows\System\CZKmQRv.exe
  C:\Windows\System\CZKmQRv.exe
  2⤵
  PID:14036
- C:\Windows\System\XpWqcbY.exe
  C:\Windows\System\XpWqcbY.exe
  2⤵
  PID:13928
- C:\Windows\System\GgwckBV.exe
  C:\Windows\System\GgwckBV.exe
  2⤵
  PID:14124
- C:\Windows\System\OmfCsWp.exe
  C:\Windows\System\OmfCsWp.exe
  2⤵
  PID:14220
- C:\Windows\System\EgkrnsJ.exe
  C:\Windows\System\EgkrnsJ.exe
  2⤵
  PID:13900
- C:\Windows\System\gESaXiZ.exe
  C:\Windows\System\gESaXiZ.exe
  2⤵
  PID:12004
- C:\Windows\System\icJMjea.exe
  C:\Windows\System\icJMjea.exe
  2⤵
  PID:13560
- C:\Windows\System\LHBQUGQ.exe
  C:\Windows\System\LHBQUGQ.exe
  2⤵
  PID:13448
- C:\Windows\System\SyyRiVq.exe
  C:\Windows\System\SyyRiVq.exe
  2⤵
  PID:12780
- C:\Windows\System\rtWXwAG.exe
  C:\Windows\System\rtWXwAG.exe
  2⤵
  PID:14136
- C:\Windows\System\eprVySI.exe
  C:\Windows\System\eprVySI.exe
  2⤵
  PID:14176
- C:\Windows\System\NuCtakF.exe
  C:\Windows\System\NuCtakF.exe
  2⤵
  PID:14232
- C:\Windows\System\hZLNfed.exe
  C:\Windows\System\hZLNfed.exe
  2⤵
  PID:13520
- C:\Windows\System\iQeBqqe.exe
  C:\Windows\System\iQeBqqe.exe
  2⤵
  PID:13584
- C:\Windows\System\JhpGpFb.exe
  C:\Windows\System\JhpGpFb.exe
  2⤵
  PID:13516
- C:\Windows\System\YFpATlF.exe
  C:\Windows\System\YFpATlF.exe
  2⤵
  PID:14372
- C:\Windows\System\yTwJpmM.exe
  C:\Windows\System\yTwJpmM.exe
  2⤵
  PID:14408
- C:\Windows\System\qhIxyNn.exe
  C:\Windows\System\qhIxyNn.exe
  2⤵
  PID:14436
- C:\Windows\System\yifLicI.exe
  C:\Windows\System\yifLicI.exe
  2⤵
  PID:14460
- C:\Windows\System\GEmDeHK.exe
  C:\Windows\System\GEmDeHK.exe
  2⤵
  PID:14484
- C:\Windows\System\bfpPqHs.exe
  C:\Windows\System\bfpPqHs.exe
  2⤵
  PID:14512
- C:\Windows\System\kbdDYhw.exe
  C:\Windows\System\kbdDYhw.exe
  2⤵
  PID:14532
- C:\Windows\System\NRKuSiw.exe
  C:\Windows\System\NRKuSiw.exe
  2⤵
  PID:14560
- C:\Windows\System\jPCptrN.exe
  C:\Windows\System\jPCptrN.exe
  2⤵
  PID:14580
- C:\Windows\System\ypBFSAL.exe
  C:\Windows\System\ypBFSAL.exe
  2⤵
  PID:14600
- C:\Windows\System\rvLvjiE.exe
  C:\Windows\System\rvLvjiE.exe
  2⤵
  PID:14624
- C:\Windows\System\uNhScRf.exe
  C:\Windows\System\uNhScRf.exe
  2⤵
  PID:14656
- C:\Windows\System\YsupTiP.exe
  C:\Windows\System\YsupTiP.exe
  2⤵
  PID:14676
- C:\Windows\System\mMTscGT.exe
  C:\Windows\System\mMTscGT.exe
  2⤵
  PID:14708
- C:\Windows\System\Horzcfa.exe
  C:\Windows\System\Horzcfa.exe
  2⤵
  PID:14728
- C:\Windows\System\AQXkIiR.exe
  C:\Windows\System\AQXkIiR.exe
  2⤵
  PID:14756
- C:\Windows\System\DFqILko.exe
  C:\Windows\System\DFqILko.exe
  2⤵
  PID:14792
- C:\Windows\System\nFIyQnz.exe
  C:\Windows\System\nFIyQnz.exe
  2⤵
  PID:14808
- C:\Windows\System\dGOjvba.exe
  C:\Windows\System\dGOjvba.exe
  2⤵
  PID:14832
- C:\Windows\System\NVrcLqt.exe
  C:\Windows\System\NVrcLqt.exe
  2⤵
  PID:14856
- C:\Windows\System\kQkosuc.exe
  C:\Windows\System\kQkosuc.exe
  2⤵
  PID:14876
- C:\Windows\System\jRGHSMr.exe
  C:\Windows\System\jRGHSMr.exe
  2⤵
  PID:15060
- C:\Windows\System\ZnpTLhg.exe
  C:\Windows\System\ZnpTLhg.exe
  2⤵
  PID:15100
- C:\Windows\System\JumGxjP.exe
  C:\Windows\System\JumGxjP.exe
  2⤵
  PID:15136
- C:\Windows\System\IBaxBYu.exe
  C:\Windows\System\IBaxBYu.exe
  2⤵
  PID:15192
- C:\Windows\System\cwYCeUz.exe
  C:\Windows\System\cwYCeUz.exe
  2⤵
  PID:15244
- C:\Windows\System\ITCJjMZ.exe
  C:\Windows\System\ITCJjMZ.exe
  2⤵
  PID:15268
- C:\Windows\System\ndunEPJ.exe
  C:\Windows\System\ndunEPJ.exe
  2⤵
  PID:15296
- C:\Windows\System\DlPKWQA.exe
  C:\Windows\System\DlPKWQA.exe
  2⤵
  PID:15328
- C:\Windows\System\DbcNLgZ.exe
  C:\Windows\System\DbcNLgZ.exe
  2⤵
  PID:15348
- C:\Windows\System\MSOjeHq.exe
  C:\Windows\System\MSOjeHq.exe
  2⤵
  PID:13984
- C:\Windows\System\zQXPMxx.exe
  C:\Windows\System\zQXPMxx.exe
  2⤵
  PID:12756
- C:\Windows\System\vDEGaAg.exe
  C:\Windows\System\vDEGaAg.exe
  2⤵
  PID:13628
- C:\Windows\System\upALiDa.exe
  C:\Windows\System\upALiDa.exe
  2⤵
  PID:14032
- C:\Windows\System\gHNNTHl.exe
  C:\Windows\System\gHNNTHl.exe
  2⤵
  PID:14328
- C:\Windows\System\ciWHGJc.exe
  C:\Windows\System\ciWHGJc.exe
  2⤵
  PID:13724
- C:\Windows\System\nZpAori.exe
  C:\Windows\System\nZpAori.exe
  2⤵
  PID:14292
- C:\Windows\System\kuKfWOa.exe
  C:\Windows\System\kuKfWOa.exe
  2⤵
  PID:14352
- C:\Windows\System\KpHDTsm.exe
  C:\Windows\System\KpHDTsm.exe
  2⤵
  PID:14664
- C:\Windows\System\KjbZCIi.exe
  C:\Windows\System\KjbZCIi.exe
  2⤵
  PID:12816
- C:\Windows\System\jsPPbpT.exe
  C:\Windows\System\jsPPbpT.exe
  2⤵
  PID:14804
- C:\Windows\System\huslWnB.exe
  C:\Windows\System\huslWnB.exe
  2⤵
  PID:14644
- C:\Windows\System\ebNQWKC.exe
  C:\Windows\System\ebNQWKC.exe
  2⤵
  PID:14716
- C:\Windows\System\bHVdEpq.exe
  C:\Windows\System\bHVdEpq.exe
  2⤵
  PID:14508
- C:\Windows\System\nSCulyS.exe
  C:\Windows\System\nSCulyS.exe
  2⤵
  PID:14696
- C:\Windows\System\LfMqVlq.exe
  C:\Windows\System\LfMqVlq.exe
  2⤵
  PID:14780
- C:\Windows\System\mjTTTqC.exe
  C:\Windows\System\mjTTTqC.exe
  2⤵
  PID:14848
- C:\Windows\System\rkBumlv.exe
  C:\Windows\System\rkBumlv.exe
  2⤵
  PID:15256
- C:\Windows\System\oEZEDMC.exe
  C:\Windows\System\oEZEDMC.exe
  2⤵
  PID:15096
- C:\Windows\System\jCizsEc.exe
  C:\Windows\System\jCizsEc.exe
  2⤵
  PID:14976
- C:\Windows\System\vTIpeUB.exe
  C:\Windows\System\vTIpeUB.exe
  2⤵
  PID:15180
- C:\Windows\System\qDVMLWI.exe
  C:\Windows\System\qDVMLWI.exe
  2⤵
  PID:15040
- C:\Windows\System\DAbjCzN.exe
  C:\Windows\System\DAbjCzN.exe
  2⤵
  PID:15124
- C:\Windows\System\cSwEUmJ.exe
  C:\Windows\System\cSwEUmJ.exe
  2⤵
  PID:15212
- C:\Windows\System\gOXXhGj.exe
  C:\Windows\System\gOXXhGj.exe
  2⤵
  PID:13936
- C:\Windows\System\CXiAwFE.exe
  C:\Windows\System\CXiAwFE.exe
  2⤵
  PID:14576
- C:\Windows\System\afGbgFG.exe
  C:\Windows\System\afGbgFG.exe
  2⤵
  PID:14572
- C:\Windows\System\CtBVHQa.exe
  C:\Windows\System\CtBVHQa.exe
  2⤵
  PID:14892
- C:\Windows\System\GlpjzIc.exe
  C:\Windows\System\GlpjzIc.exe
  2⤵
  PID:14924
- C:\Windows\System\pxuyxKR.exe
  C:\Windows\System\pxuyxKR.exe
  2⤵
  PID:15008
- C:\Windows\System\tNUmZfM.exe
  C:\Windows\System\tNUmZfM.exe
  2⤵
  PID:12380
- C:\Windows\System\QfBfGyo.exe
  C:\Windows\System\QfBfGyo.exe
  2⤵
  PID:14888
- C:\Windows\System\prtqtKG.exe
  C:\Windows\System\prtqtKG.exe
  2⤵
  PID:15380
- C:\Windows\System\VhTKkaW.exe
  C:\Windows\System\VhTKkaW.exe
  2⤵
  PID:15400
- C:\Windows\System\JhhzLto.exe
  C:\Windows\System\JhhzLto.exe
  2⤵
  PID:15668
- C:\Windows\System\MOKUWhX.exe
  C:\Windows\System\MOKUWhX.exe
  2⤵
  PID:15684
- C:\Windows\System\IYQcKBn.exe
  C:\Windows\System\IYQcKBn.exe
  2⤵
  PID:15700
- C:\Windows\System\yJODFjR.exe
  C:\Windows\System\yJODFjR.exe
  2⤵
  PID:15716
- C:\Windows\System\gXXidrP.exe
  C:\Windows\System\gXXidrP.exe
  2⤵
  PID:15744
- C:\Windows\System\hzUSGCw.exe
  C:\Windows\System\hzUSGCw.exe
  2⤵
  PID:15768
- C:\Windows\System\HZqcGfh.exe
  C:\Windows\System\HZqcGfh.exe
  2⤵
  PID:15788
- C:\Windows\System\bWRpnBN.exe
  C:\Windows\System\bWRpnBN.exe
  2⤵
  PID:15816
- C:\Windows\System\rjEIiAV.exe
  C:\Windows\System\rjEIiAV.exe
  2⤵
  PID:15832
- C:\Windows\System\vDTRJYX.exe
  C:\Windows\System\vDTRJYX.exe
  2⤵
  PID:15848
- C:\Windows\System\AUBoVqe.exe
  C:\Windows\System\AUBoVqe.exe
  2⤵
  PID:15864
- C:\Windows\System\cXUubtt.exe
  C:\Windows\System\cXUubtt.exe
  2⤵
  PID:15884
- C:\Windows\System\vMIOJoT.exe
  C:\Windows\System\vMIOJoT.exe
  2⤵
  PID:15912
- C:\Windows\System\JZeMKfW.exe
  C:\Windows\System\JZeMKfW.exe
  2⤵
  PID:15928
- C:\Windows\System\qUgZDmE.exe
  C:\Windows\System\qUgZDmE.exe
  2⤵
  PID:15944
- C:\Windows\System\URWpHzZ.exe
  C:\Windows\System\URWpHzZ.exe
  2⤵
  PID:15960
- C:\Windows\System\UsLaOhL.exe
  C:\Windows\System\UsLaOhL.exe
  2⤵
  PID:15984
- C:\Windows\System\XoddFhv.exe
  C:\Windows\System\XoddFhv.exe
  2⤵
  PID:16000
- C:\Windows\System\mAbWmgT.exe
  C:\Windows\System\mAbWmgT.exe
  2⤵
  PID:16024
- C:\Windows\System\UNGdRhX.exe
  C:\Windows\System\UNGdRhX.exe
  2⤵
  PID:16040
- C:\Windows\System\fWPhRwR.exe
  C:\Windows\System\fWPhRwR.exe
  2⤵
  PID:16068
- C:\Windows\System\NMjxKUR.exe
  C:\Windows\System\NMjxKUR.exe
  2⤵
  PID:16092
- C:\Windows\System\NfwKCQA.exe
  C:\Windows\System\NfwKCQA.exe
  2⤵
  PID:16112
- C:\Windows\System\pvVZKxB.exe
  C:\Windows\System\pvVZKxB.exe
  2⤵
  PID:16140
- C:\Windows\System\ySjNltu.exe
  C:\Windows\System\ySjNltu.exe
  2⤵
  PID:16168
- C:\Windows\System\MTfzlLM.exe
  C:\Windows\System\MTfzlLM.exe
  2⤵
  PID:16200
- C:\Windows\System\FbuyMiZ.exe
  C:\Windows\System\FbuyMiZ.exe
  2⤵
  PID:16220
- C:\Windows\System\LwXQMmu.exe
  C:\Windows\System\LwXQMmu.exe
  2⤵
  PID:16248
- C:\Windows\System\rvbSBKe.exe
  C:\Windows\System\rvbSBKe.exe
  2⤵
  PID:16280
- C:\Windows\System\TFNqsEj.exe
  C:\Windows\System\TFNqsEj.exe
  2⤵
  PID:16304
- C:\Windows\System\AJtNvLr.exe
  C:\Windows\System\AJtNvLr.exe
  2⤵
  PID:16340
- C:\Windows\System\MQAXFjd.exe
  C:\Windows\System\MQAXFjd.exe
  2⤵
  PID:16376
- C:\Windows\System\ETjoMYS.exe
  C:\Windows\System\ETjoMYS.exe
  2⤵
  PID:15084
- C:\Windows\System\fOkQMVw.exe
  C:\Windows\System\fOkQMVw.exe
  2⤵
  PID:14196
- C:\Windows\System\GqrYcoJ.exe
  C:\Windows\System\GqrYcoJ.exe
  2⤵
  PID:14824
- C:\Windows\System\jKaJcqI.exe
  C:\Windows\System\jKaJcqI.exe
  2⤵
  PID:15044
- C:\Windows\System\ugVPVwR.exe
  C:\Windows\System\ugVPVwR.exe
  2⤵
  PID:13240
- C:\Windows\System\wXTbpuD.exe
  C:\Windows\System\wXTbpuD.exe
  2⤵
  PID:15516
- C:\Windows\System\kZOuZGK.exe
  C:\Windows\System\kZOuZGK.exe
  2⤵
  PID:15492
- C:\Windows\System\nGICIiS.exe
  C:\Windows\System\nGICIiS.exe
  2⤵
  PID:15616
- C:\Windows\System\JdNDQgp.exe
  C:\Windows\System\JdNDQgp.exe
  2⤵
  PID:15428
- C:\Windows\System\vcVNLsF.exe
  C:\Windows\System\vcVNLsF.exe
  2⤵
  PID:15732
- C:\Windows\System\FBEjvTC.exe
  C:\Windows\System\FBEjvTC.exe
  2⤵
  PID:15784
- C:\Windows\System\udeVQhE.exe
  C:\Windows\System\udeVQhE.exe
  2⤵
  PID:15908
- C:\Windows\System\gISeLnw.exe
  C:\Windows\System\gISeLnw.exe
  2⤵
  PID:15956
- C:\Windows\System\OrKVxWF.exe
  C:\Windows\System\OrKVxWF.exe
  2⤵
  PID:15824
- C:\Windows\System\qnftEex.exe
  C:\Windows\System\qnftEex.exe
  2⤵
  PID:15900
- C:\Windows\System\guDQTDo.exe
  C:\Windows\System\guDQTDo.exe
  2⤵
  PID:16104
- C:\Windows\System\NagGktF.exe
  C:\Windows\System\NagGktF.exe
  2⤵
  PID:16208
- C:\Windows\System\fXmltFX.exe
  C:\Windows\System\fXmltFX.exe
  2⤵
  PID:16296
- C:\Windows\System\UUnGbqK.exe
  C:\Windows\System\UUnGbqK.exe
  2⤵
  PID:16188
- C:\Windows\System\XIJXgnA.exe
  C:\Windows\System\XIJXgnA.exe
  2⤵
  PID:14636
- C:\Windows\System\oaaRxZr.exe
  C:\Windows\System\oaaRxZr.exe
  2⤵
  PID:14872
- C:\Windows\System\kDpYbpB.exe
  C:\Windows\System\kDpYbpB.exe
  2⤵
  PID:15420
- C:\Windows\System\nnnlFAG.exe
  C:\Windows\System\nnnlFAG.exe
  2⤵
  PID:14936
- C:\Windows\System\xajiFqp.exe
  C:\Windows\System\xajiFqp.exe
  2⤵
  PID:11760
- C:\Windows\System\LWjZPYk.exe
  C:\Windows\System\LWjZPYk.exe
  2⤵
  PID:15308
- C:\Windows\System\LzPzAkc.exe
  C:\Windows\System\LzPzAkc.exe
  2⤵
  PID:15680
- C:\Windows\System\JjNGkUW.exe
  C:\Windows\System\JjNGkUW.exe
  2⤵
  PID:15760
- C:\Windows\System\QDCabJV.exe
  C:\Windows\System\QDCabJV.exe
  2⤵
  PID:15844
- C:\Windows\System\kNSosZB.exe
  C:\Windows\System\kNSosZB.exe
  2⤵
  PID:15876
- C:\Windows\System\MQxHwGG.exe
  C:\Windows\System\MQxHwGG.exe
  2⤵
  PID:15860
- C:\Windows\System\eHIUInY.exe
  C:\Windows\System\eHIUInY.exe
  2⤵
  PID:16396
- C:\Windows\System\cuAHTxv.exe
  C:\Windows\System\cuAHTxv.exe
  2⤵
  PID:16420
- C:\Windows\System\LkbdJdd.exe
  C:\Windows\System\LkbdJdd.exe
  2⤵
  PID:16436
- C:\Windows\System\UtMcEXI.exe
  C:\Windows\System\UtMcEXI.exe
  2⤵
  PID:16468
- C:\Windows\System\GlWqgOz.exe
  C:\Windows\System\GlWqgOz.exe
  2⤵
  PID:16488
- C:\Windows\System\kpGiDaD.exe
  C:\Windows\System\kpGiDaD.exe
  2⤵
  PID:16512
- C:\Windows\System\smvlsNS.exe
  C:\Windows\System\smvlsNS.exe
  2⤵
  PID:16532
- C:\Windows\System\zNlrAMU.exe
  C:\Windows\System\zNlrAMU.exe
  2⤵
  PID:16552
- C:\Windows\System\ZyGaoUB.exe
  C:\Windows\System\ZyGaoUB.exe
  2⤵
  PID:16584
- C:\Windows\System\WzgJCLQ.exe
  C:\Windows\System\WzgJCLQ.exe
  2⤵
  PID:16608
- C:\Windows\System\vhLqxoZ.exe
  C:\Windows\System\vhLqxoZ.exe
  2⤵
  PID:16636
- C:\Windows\System\edQGMik.exe
  C:\Windows\System\edQGMik.exe
  2⤵
  PID:16656
- C:\Windows\System\JsAxUOM.exe
  C:\Windows\System\JsAxUOM.exe
  2⤵
  PID:16684
- C:\Windows\System\qAAVMeG.exe
  C:\Windows\System\qAAVMeG.exe
  2⤵
  PID:16716
- C:\Windows\System\souBXgo.exe
  C:\Windows\System\souBXgo.exe
  2⤵
  PID:16736
- C:\Windows\System\YtKzsgS.exe
  C:\Windows\System\YtKzsgS.exe
  2⤵
  PID:16764
- C:\Windows\System\bsEcSik.exe
  C:\Windows\System\bsEcSik.exe
  2⤵
  PID:16796
- C:\Windows\System\OLUwSJX.exe
  C:\Windows\System\OLUwSJX.exe
  2⤵
  PID:16824
- C:\Windows\System\YJBngGm.exe
  C:\Windows\System\YJBngGm.exe
  2⤵
  PID:16840
- C:\Windows\System\zzPJGBg.exe
  C:\Windows\System\zzPJGBg.exe
  2⤵
  PID:16876
- C:\Windows\System\jEFbEav.exe
  C:\Windows\System\jEFbEav.exe
  2⤵
  PID:16900
- C:\Windows\System\UTeGVEY.exe
  C:\Windows\System\UTeGVEY.exe
  2⤵
  PID:16936
- C:\Windows\System\hJeoaAv.exe
  C:\Windows\System\hJeoaAv.exe
  2⤵
  PID:16956
- C:\Windows\System\cOyDRgH.exe
  C:\Windows\System\cOyDRgH.exe
  2⤵
  PID:16972
- C:\Windows\System\AXKHRqO.exe
  C:\Windows\System\AXKHRqO.exe
  2⤵
  PID:17012
- C:\Windows\System\DkgSzEA.exe
  C:\Windows\System\DkgSzEA.exe
  2⤵
  PID:17028
- C:\Windows\System\hWGJvZd.exe
  C:\Windows\System\hWGJvZd.exe
  2⤵
  PID:17060
- C:\Windows\System\PexJtxW.exe
  C:\Windows\System\PexJtxW.exe
  2⤵
  PID:17084
- C:\Windows\System\fKDqRcF.exe
  C:\Windows\System\fKDqRcF.exe
  2⤵
  PID:17104
- C:\Windows\System\GBSErma.exe
  C:\Windows\System\GBSErma.exe
  2⤵
  PID:17136
- C:\Windows\System\gVmXQvl.exe
  C:\Windows\System\gVmXQvl.exe
  2⤵
  PID:17152
- C:\Windows\System\jRomSky.exe
  C:\Windows\System\jRomSky.exe
  2⤵
  PID:17184
- C:\Windows\System\rBIndZm.exe
  C:\Windows\System\rBIndZm.exe
  2⤵
  PID:17208
- C:\Windows\System\YdJlWfT.exe
  C:\Windows\System\YdJlWfT.exe
  2⤵
  PID:17236
- C:\Windows\System\qtYajIj.exe
  C:\Windows\System\qtYajIj.exe
  2⤵
  PID:17264
- C:\Windows\System\jTHzDuc.exe
  C:\Windows\System\jTHzDuc.exe
  2⤵
  PID:17288
- C:\Windows\System\kGYSzEQ.exe
  C:\Windows\System\kGYSzEQ.exe
  2⤵
  PID:17304
- C:\Windows\System\noDRyrz.exe
  C:\Windows\System\noDRyrz.exe
  2⤵
  PID:17328
- C:\Windows\System\AohLSAB.exe
  C:\Windows\System\AohLSAB.exe
  2⤵
  PID:17352
- C:\Windows\System\BWUSGvN.exe
  C:\Windows\System\BWUSGvN.exe
  2⤵
  PID:17372
- C:\Windows\System\uRITLiR.exe
  C:\Windows\System\uRITLiR.exe
  2⤵
  PID:17396
- C:\Windows\System\veDpbRf.exe
  C:\Windows\System\veDpbRf.exe
  2⤵
  PID:16852
- C:\Windows\System\aBzKnQn.exe
  C:\Windows\System\aBzKnQn.exe
  2⤵
  PID:16912
- C:\Windows\System\MRwGbcY.exe
  C:\Windows\System\MRwGbcY.exe
  2⤵
  PID:17196
- C:\Windows\System\WQPxLlj.exe
  C:\Windows\System\WQPxLlj.exe
  2⤵
  PID:16196
- C:\Windows\System\eObVhbn.exe
  C:\Windows\System\eObVhbn.exe
  2⤵
  PID:17280
- C:\Windows\System\VxvQxbK.exe
  C:\Windows\System\VxvQxbK.exe
  2⤵
  PID:17040
- C:\Windows\System\VxVwvYU.exe
  C:\Windows\System\VxVwvYU.exe
  2⤵
  PID:17364

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4384

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ABWwZzw.exe

Path C:\Windows\System\ABWwZzw.exe
Size 1.8MB
SHA256 4f7d339f372d5cef5a890817c5f0cc76a7f91c794b1def480117e547b5578186
MD5 fd6f9a7a11926466cf14691a48f5219d
SHA1 a5d28d89e05a05142eb1d6831271bca7d74cd16a
SHA512 c3bfae4554b2710e067f7d08d12059dc5a76d7a0cb46325227da2e36c8983bc97f33837d435f680e8e33e4deb3b054b5737c0000590110d13472883a9061bcf5
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9ozttwIRxj4c5yOBZnQbZLoQBB:GemTLkNdfE0pZy+
MD5 SHA1 SHA512 SSDEEP

Submit Download

AIiScMb.exe

Path C:\Windows\System\AIiScMb.exe
Size 1.8MB
SHA256 9f7b8e04d6627be5875aa9dc3eced10bb1f02c535567a0bd8a84153bc4937270
MD5 39b7c77d50d2a75a22db80fc4d2139ff
SHA1 30d0c821d612f0580464c97a19bfc0d56a336071
SHA512 d8147194c6b9b3bb437a6d64b021276b0ab6086d8af59ec460b332eb6491a0e9d4686fb0975859f66de89aebe916224d669ffe16751a1e012cb131bb20be79c8
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9ozttwIRxj4c5yOBZnQbZLoQB4:GemTLkNdfE0pZyd
MD5 SHA1 SHA512 SSDEEP

Submit Download

FklAPTQ.exe

Path C:\Windows\System\FklAPTQ.exe
Size 1.8MB
SHA256 7018c5a37c61bb3e4e3ad80374f0795e0799e712b645e2c1fb1c8cea8b2554c5
MD5 a1d24cd0c44c8cc3b9dc0f0826207d59
SHA1 0128c1b45f033c093ee729d0389de32aec00e0b4
SHA512 9aea86135fbbff50cd876cc94d3f33663f31e56563ea48951c376d6d6b3e09a16f322567f05f4200c551f45758c352452cd38fe23930fd98262c91e5c3850119
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9ozttwIRxj4c5yOBZnQbZLoQBc:GemTLkNdfE0pZyv
MD5 SHA1 SHA512 SSDEEP

Submit Download

GnTJpIc.exe

Path C:\Windows\System\GnTJpIc.exe
Size 1.8MB
SHA256 289f5d729db8a3175947c1bf62c0271ce1e7ee655fd9bcf0976f04fe7a7d880a
MD5 e44951e0fdcefe6071a9b1ee2e2ce1c4
SHA1 918c60c53e845ba3e2eee15e8e7691c98e6c65ed
SHA512 77f904296844559c6f7ff9ecb6bc5cf41b0f4ad2d80da3af8e3fb888b8c3d25302a7d38bc9a72b4efc952b2dd46f2b54af9da5058a09a550ea6b324554ad4ec5
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9ozttwIRxj4c5yOBZnQbZLoQBS:GemTLkNdfE0pZyd
MD5 SHA1 SHA512 SSDEEP

Submit Download

GuNYSGL.exe

Path C:\Windows\System\GuNYSGL.exe
Size 1.8MB
SHA256 fdcbc6c54b6ae879eca94335441c36f0ab329ed538313ab11a448b5eecc35ec2
MD5 9f02ea797f05e1744462b140f0f86338
SHA1 bbdb8e42fe0bc0d3a3295b137f7598011c8078e1
SHA512 cd1415f31db88124082f0aa28fe44bdf46422f6e55658fe37c465b917e8b2a2748c05a11eae22a1d3aed1a7e9a6b6077abe8fb097a376ebb9ddb8fdc14a49e48
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9ozttwIRxj4c5yOBZnQbZLoQBG:GemTLkNdfE0pZyb
MD5 SHA1 SHA512 SSDEEP

Submit Download

HNzxghU.exe

Path C:\Windows\System\HNzxghU.exe
Size 1.8MB
SHA256 05f18d866aa177a7682e9541c5bd85d1a4ad7763513cd36451302f645e98a08f
MD5 7c0aaf5277ea9d357522370a0cb6ffa4
SHA1 7f426268d88bb32c2b6693771e668d874ff2a861
SHA512 b11ccd026566e22c6c0fad0f977f0cb0e291a33fecfd7fc62f1d5569de45b0f4db3e030f32f826b74449602e0f423fc15ef344219f3a4589c28ca4325dc374d0
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9ozttwIRxj4c5yOBZnQbZLoQBb:GemTLkNdfE0pZy4
MD5 SHA1 SHA512 SSDEEP

Submit Download

JJhIwmv.exe

Path C:\Windows\System\JJhIwmv.exe
Size 1.8MB
SHA256 0bcf712abb7a50b3ff146c2b9c0798ae7e05b072b93ea6fa5df5c96adf4f734e
MD5 f79aa3a810b7e7e021f19a13e7c8a4c6
SHA1 a61c029f0cd420fb60796d00b4eeb15b5ee5178c
SHA512 6c50997205d9489a4a34a9043f60982fa3d4dbacc463d385993bd21563ecf62ad11ad205154435f39ea980669c64de10b2bc61205221206b19afe76208181f3e
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9ozttwIRxj4c5yOBZnQbZLoQBq:GemTLkNdfE0pZyr
MD5 SHA1 SHA512 SSDEEP

Submit Download

Kppzmkh.exe

Path C:\Windows\System\Kppzmkh.exe
Size 1.8MB
SHA256 2563b4bd2a5f5a93d93a34512b3c8a0810150284aed172867917a7990bda8fdd
MD5 0a16f421f5520dc0e1d419942a7a5cc2
SHA1 5d14cbe7fe72be73d83350e6bb2487833eb4e0d9
SHA512 9e1d8f9b2be2b109ba9f6a10751e33dfdaced43fc48f8b7a6a0a0c8f3cd182c276960e7d0514540608475814cf7577f18e7477b2e3e28d0b96152513b7c775f7
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9ozttwIRxj4c5yOBZnQbZLoQB8:GemTLkNdfE0pZyf
MD5 SHA1 SHA512 SSDEEP

Submit Download

LDnNiGD.exe

Path C:\Windows\System\LDnNiGD.exe
Size 1.8MB
SHA256 e02d3845a51a4de7764f1737335cb303d475cce9943bf734eeab3b4ae2d738e7
MD5 ba0a67b37c37887283aa4faa6cc90c5a
SHA1 f553854bece9deb2e87cae64cbd84ebd51250da6
SHA512 e74878ff0516b74157a89f77837fa59b1a139037234c4ce8240a0a178dea603f25403d08d8965a7310de9dc1f0bea5b9e6b522bdba672f5d23c23a065b400acf
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9ozttwIRxj4c5yOBZnQbZLoQBj:GemTLkNdfE0pZy2
MD5 SHA1 SHA512 SSDEEP

Submit Download

MMaHdKP.exe

Path C:\Windows\System\MMaHdKP.exe
Size 1.8MB
SHA256 79305d890d539a38cea3f635f69c531be3dedbe8f1876d5f19622db57c968d96
MD5 b44837320a32b6eda5b88f93fb8adeac
SHA1 b74ec368fa042c41c1f7a8d91c7df41213c323c2
SHA512 911e6f33f63bb722ffd020d80cdf8884b32a455a01fae0b0a14eb7a7eae863bb31bbb9c7381c655ce175113e847f52a3aa133c59f860c9a7ba6d6fcfdbed2c5e
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9ozttwIRxj4c5yOBZnQbZLoQBZg:GemTLkNdfE0pZyF
MD5 SHA1 SHA512 SSDEEP

Submit Download

MYVJPkb.exe

Path C:\Windows\System\MYVJPkb.exe
Size 1.8MB
SHA256 bc26d65288570cfd744c111f8fcd88b8180552b18fc039fa9fb5a6c08554f17c
MD5 9b24fa3da93ad2f13405baff2dcae496
SHA1 4fbf394f4fb5197698a26424ffcb01c51f8b98a8
SHA512 eeb6c692adf17f542950c15122a007728080f0355a60cf552d3a93ec0fd335b8777f9cdebc043550e4d54480c8bb6540bab495d8e8d512b18f35b4efd011f5bb
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9ozttwIRxj4c5yOBZnQbZLoQBi:GemTLkNdfE0pZy1
MD5 SHA1 SHA512 SSDEEP

Submit Download

ObNvPFm.exe

Path C:\Windows\System\ObNvPFm.exe
Size 1.8MB
SHA256 833735cd245e0a85c3830102a047a88310191120bd1ff7d3f386aa0802440435
MD5 c356c0789622c75e2793476a153d8567
SHA1 43ca0ee6787d7f0d14011e41bdfda475fc5ce726
SHA512 ff06d51520bf1f89dd2dc4bc62d28faddadb5c6335574665617c875f3256627ad8215918e7cd9dc87f0b898136316589e989be83df04bbdf2ae448a2524151d1
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9ozttwIRxj4c5yOBZnQbZLoQBI:GemTLkNdfE0pZy7
MD5 SHA1 SHA512 SSDEEP

Submit Download

TiuqQxw.exe

Path C:\Windows\System\TiuqQxw.exe
Size 1.8MB
SHA256 364a6e2c1ef1f168b470eeaac3ac10a73e9ab1ec9330bf4475594f316b1e158e
MD5 40d673b5e371cd4e249e6c236435061d
SHA1 fad8e05d66bd32310366f4cf0a6aeb4db4f48d90
SHA512 fb16de74f5baefd7f27d004528ce5a23820a888c9424c15c936d5f32ccca3a067db9f8164883fe46f8957ed47e39ac6e4a4b487b95ac290d839244d32d4d0e27
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9ozttwIRxj4c5yOBZnQbZLoQBC:GemTLkNdfE0pZy/
MD5 SHA1 SHA512 SSDEEP

Submit Download

UKIRMmA.exe

Path C:\Windows\System\UKIRMmA.exe
Size 1.8MB
SHA256 0248b9c7cd39fc00d067c104726a8f5660de2dce428ec7eb809228d483553968
MD5 fcc344e8885b0532fdb573032996edb6
SHA1 42536f19dec76c579248b1973ecd9811d3f23eb5
SHA512 5852a33103c6b3662f5b5bcff52d4ee1021eb40f1b8cc8ea55af9e203299c20f4af9acf549b94207d17d81ed0b2f37e829aa49bfcfac9306da896d7293756780
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9ozttwIRxj4c5yOBZnQbZLoQBe:GemTLkNdfE0pZyx
MD5 SHA1 SHA512 SSDEEP

Submit Download

UsDEvjR.exe

Path C:\Windows\System\UsDEvjR.exe
Size 1.8MB
SHA256 ee2f41082fa148fddcc8ff652c085246e15acc49a6b8b9564d3fb31bc5a6d72d
MD5 e11daee348f77ae7aef1cb31929b04ab
SHA1 1e8ecd497fca85c5ea78dff91cb9aa6ebd669eaf
SHA512 897d704674098df937cef205935605b1c610edcc6ae2739091be03819fd4c51bb2e6a2c6f553ce6294027d71852de1f1aa73c5b442f6925d8e465064be7690c8
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9ozttwIRxj4c5yOBZnQbZLoQBz:GemTLkNdfE0pZyi
MD5 SHA1 SHA512 SSDEEP

Submit Download

YrSPJmb.exe

Path C:\Windows\System\YrSPJmb.exe
Size 1.8MB
SHA256 d88bc2dfed93c7b69da40021bd5038b67ba2b491f535bde7ea9ca389eefaa713
MD5 2298556c686ac479aa142b61c18fc9d5
SHA1 fe76fdc3744e66918d239a8f344ad37046a13070
SHA512 41472f3a7f3194693e7f27db439e0a5fb5640009a60eb735fc31905c76a247770c75b5e5dbde654a81852043c3bc3405169384df8df3f2dc31ff0f1c99f251e2
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9ozttwIRxj4c5yOBZnQbZLoQBU:GemTLkNdfE0pZyB
MD5 SHA1 SHA512 SSDEEP

Submit Download

ZbMIYJH.exe

Path C:\Windows\System\ZbMIYJH.exe
Size 1.8MB
SHA256 7c95f7c71e791c06b6821f55291e9f6b01531cf502c74a2811d4d00c358ce5c6
MD5 f9599193e6e425f9772da42413c1a108
SHA1 f78acca12c41deb63ad70eb2f6be5588f5d6d53b
SHA512 acc99831dd878fef5d85fb5ff102b91d8ad094eff1a27bd1a6580131fae0791dae29c6dd8b2b6e7c7f1276010f38b3e8630cba50dede71a471ddfb22eb53a445
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9ozttwIRxj4c5yOBZnQbZLoQBf:GemTLkNdfE0pZyQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

baZQmUb.exe

Path C:\Windows\System\baZQmUb.exe
Size 1.8MB
SHA256 a11b505122ebb77f5ac1f4bb39de16bc0c259b4393a083ae25f88df9be940cc0
MD5 2679ba14ccf0cfc52876e3c3dd3cdace
SHA1 963e034cf9682dbf6b3a3701a7d3336b66b73013
SHA512 3c229a6da9e76726d6de16b646e07b09b4ad101e859e421e1a6ac1e76d0bd1a4fbf719ddedfffa5388fd4119f8d14954dd7c8719ee5d02dd031aee0355489747
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9ozttwIRxj4c5yOBZnQbZLoQBj:GemTLkNdfE0pZy2
MD5 SHA1 SHA512 SSDEEP

Submit Download

cXxFlcM.exe

Path C:\Windows\System\cXxFlcM.exe
Size 1.8MB
SHA256 5f6d0f67882333f9287fd419608587858d9616867841d6322b41d7541a1e322f
MD5 c732d354c529218a4cab59efa8238c6c
SHA1 dfc6c348d35bf1013501a271a0c1f46e24fc7d40
SHA512 dd02cead3fe39184e9c3c96c70018c3cffcde2b47263f50749bf079ab8aa661cc65c1292caa92b77a7b238362afc016fc3b5aa9a8ceb8174264ff11b52ee8bfd
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9ozttwIRxj4c5yOBZnQbZLoQBB:GemTLkNdfE0pZyQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

epsAnPN.exe

Path C:\Windows\System\epsAnPN.exe
Size 1.8MB
SHA256 66a5aaf5d2c2b0c7017f8627b4129b7da42b22200714abe467e86420fbf1886c
MD5 60c557e95ea3bbce01c4a0f1a70424be
SHA1 9f2392b0ee1664ede1043307f74aa879eefb70a7
SHA512 a8da221768c13795e6caeb45bf65745973edb7c7803b58a06292d95675f15f8a1a5960afea4d4918c41851306ea6e7c76b4d7ad67d33b6725cdb7fd2bcd95abb
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9ozttwIRxj4c5yOBZnQbZLoQBU:GemTLkNdfE0pZyd
MD5 SHA1 SHA512 SSDEEP

Submit Download

fCRHTGa.exe

Path C:\Windows\System\fCRHTGa.exe
Size 1.8MB
SHA256 1d2432364c25b0aa2773b42cf7cacfece74129c51e49de337317ad9f154590fd
MD5 296d7c81935735063ae5468a72a9b4ad
SHA1 e850a853e55c2636dc8996be91125883f04a657f
SHA512 7c9aa58cc10faf6036dcaba2174d63ac355cd78bfdd283a1f41e7748a3c7068c6fff754acff0049a7a5710e0d8da563351c34affee4846949613d30631a9501a
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9ozttwIRxj4c5yOBZnQbZLoQBR:GemTLkNdfE0pZyg
MD5 SHA1 SHA512 SSDEEP

Submit Download

gFUcLjh.exe

Path C:\Windows\System\gFUcLjh.exe
Size 1.8MB
SHA256 3d9300ea0926a88126a66a8c1081d269d46f01fc7fe9a5e2f291a1ec20b14b78
MD5 d6dbfeb52957b8ac625ef949989b839b
SHA1 b043717e439f507456fccd53855a28bdc3535164
SHA512 daa0d3319cf56062dbb108f6b93c66e8905d0bf9e0c71fe8a7a434343009cef38e0762025e7ed3104e1577228629cf364deb3adee61963eb0322edc59bf16049
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9ozttwIRxj4c5yOBZnQbZLoQBk:GemTLkNdfE0pZyn
MD5 SHA1 SHA512 SSDEEP

Submit Download

gvFOHWL.exe

Path C:\Windows\System\gvFOHWL.exe
Size 1.8MB
SHA256 fb56bcd163c1b0b1a8fc6fd444b8e6a2f5ec97cb34a9728fd084a4f49ea33c5f
MD5 e1a67fdd0af232bdaac64c281ec28bf0
SHA1 52e6a640bd318271660c5481ad16188e8993dec3
SHA512 877d8b19928e4007eaf51ee9b8f45fa6ab274cda19ecbc057fa7019bab638307e0ba18d0fe425c27f10d8d6eaa3a86ac25f17fe60e8c5b810b93eac7320fb002
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9ozttwIRxj4c5yOBZnQbZLoQBt:GemTLkNdfE0pZyS
MD5 SHA1 SHA512 SSDEEP

Submit Download

hKvREwT.exe

Path C:\Windows\System\hKvREwT.exe
Size 1.8MB
SHA256 dcc71f34c0408f609102173c35aad890ba19cbf25b3112e0f1f4e7b866bf142a
MD5 aa1ebda256d69898c689408c41942f7d
SHA1 abea07f7628a309a06b13ee861a6a00fd936ecdd
SHA512 c5e3af121aab703560681746e1da6e1677a730e64b3a529c2a4d5a405b64d3003f84f76a4e1e14977252c240abc19f071375459c95d8dd400e7e670b8b1fb158
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9ozttwIRxj4c5yOBZnQbZLoQBS:GemTLkNdfE0pZyn
MD5 SHA1 SHA512 SSDEEP

Submit Download

huzJDSx.exe

Path C:\Windows\System\huzJDSx.exe
Size 1.8MB
SHA256 e88cdff0f1ef4da32ea5799c04ce66692cc9f2583f048c24b52cac5d8d0ee4ee
MD5 4a66a92e64164c1ea0c1a3c0bf189d38
SHA1 5fb89606c37cedbf870f91ad275ade7bb7437bac
SHA512 6950629aaae628f885d68e7a81dd1e6973fad4ef2f42ec27566c16ab74b564012fab3bb03f26e72fa7b3078dd42df44aa1f1d371887ff43e96e423a06e7bde89
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9ozttwIRxj4c5yOBZnQbZLoQBl:GemTLkNdfE0pZyu
MD5 SHA1 SHA512 SSDEEP

Submit Download

jddJTlH.exe

Path C:\Windows\System\jddJTlH.exe
Size 1.8MB
SHA256 3922ee81ef803f07555e7dab69908bd39009549e2b53abeababee31a0c9b72d7
MD5 65e73d0fd2f14668ed1e38178809df43
SHA1 63f2f21ba1d6daf32f4debbc6d6609320871b459
SHA512 d836a33330216df337ca42c28c279a6121b2c591c4bcbfc0b8f37f4dc8ce3bda7578188e81d78a5f6e0f6e426ae82f97efdf4b616680b63fabe537d956908528
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9ozttwIRxj4c5yOBZnQbZLoQB+:GemTLkNdfE0pZyd
MD5 SHA1 SHA512 SSDEEP

Submit Download

pczDzOb.exe

Path C:\Windows\System\pczDzOb.exe
Size 1.8MB
SHA256 045c342d13aea998ccd97fce88534d70a3831e7cb3eaf0d55545514d5d902a40
MD5 0a3c05509a1d67cb1145aa55f7c79ed9
SHA1 ed071f9ce217b6bc72bdd9ff92ab048756821d0a
SHA512 d09711dfb15389ff59dbdfaf738f75569993f99e42103d8a8d6ec9c913fac62b617855b8ad54d21073f6497939098707e9d538702d5f663a2024f97a07ac0d11
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9ozttwIRxj4c5yOBZnQbZLoQBu:GemTLkNdfE0pZyl
MD5 SHA1 SHA512 SSDEEP

Submit Download

pfdeUaN.exe

Path C:\Windows\System\pfdeUaN.exe
Size 1.8MB
SHA256 497c39c428021c08a40ab9cc3e82b2d49f7cc61c19a5ec78b3dd64d8312b6f76
MD5 56bb652adc154505e0ddea1a91340af2
SHA1 4168b749f204e3c2f391c8a0a460a1984c6d86e4
SHA512 bebb48ac25b28eb7f0fb4a281572232f78c4811a99a4208d5c0907eaac187b235c4b548c50207340dff1e9269c7eb1821abb5e81fdaf4f7734df50201c676f3d
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9ozttwIRxj4c5yOBZnQbZLoQBk:GemTLkNdfE0pZyh
MD5 SHA1 SHA512 SSDEEP

Submit Download

rzgVzuU.exe

Path C:\Windows\System\rzgVzuU.exe
Size 1.8MB
SHA256 70447d20d6e2891dad323979a8f65fe119e06d53d32d643ffcb301ce631f0145
MD5 d23f2d7882af6e671c7150eb48bd672b
SHA1 f8222783f25495ed5b781d4191199e3fab4b5742
SHA512 b4e680804dcc42b9ef56f00cf83e464e4d9ad4a9df78e9f4fe3f86c0f8307573f4e8d8ddc41e04d5248cca02ead9f1e0de807539848932409690639a7d9725bf
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9ozttwIRxj4c5yOBZnQbZLoQB5:GemTLkNdfE0pZy+
MD5 SHA1 SHA512 SSDEEP

Submit Download

tCzPamI.exe

Path C:\Windows\System\tCzPamI.exe
Size 1.8MB
SHA256 2b2ed05c872c4cc84d5b8b6dec6f5e7b773107f486f928fb2774c9c8fa9cdb42
MD5 f7f7568816ff6c150e72127198884c14
SHA1 b525602237bcba8d349d033df298628e0643aba5
SHA512 6b29c12a8e287d342679989d405c3ef32a2dc45885865c28c00fa21e1075f2d86849b339dee970c63b7a29b05b7770871a33b60fba8bb7b20b926682e601996a
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9ozttwIRxj4c5yOBZnQbZLoQB9:GemTLkNdfE0pZyY
MD5 SHA1 SHA512 SSDEEP

Submit Download

vlNvzPB.exe

Path C:\Windows\System\vlNvzPB.exe
Size 1.8MB
SHA256 6af06b9f1815c38faee3b9f91c44b728e53bcd375ccee397296dddc7cc8542a3
MD5 30f78856bc59a4702b81621220bc1fd5
SHA1 ba5b03416946d7062c64ae3bc46f7b4bd96f8e8a
SHA512 e8859f1e9c7cdd8fd80af0de57507b15dffc8244fed5370e7c8281cd46dc8073279d5f26e214b61f275fb2a38f41125ae2a2b522e46b6e99510b8d8350a0121a
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9ozttwIRxj4c5yOBZnQbZLoQBn:GemTLkNdfE0pZyS
MD5 SHA1 SHA512 SSDEEP

Submit Download

voEsLlq.exe

Path C:\Windows\System\voEsLlq.exe
Size 1.8MB
SHA256 47ba78d8f0d7ddffd8b547a73bc335c4e83bff97fb97f6e8fd4473699b455f30
MD5 b232c18abd95022141cd5243cc0020cf
SHA1 7b14cf6cb1d0fb70966c4eeba44d734cf30a1fdf
SHA512 b032f42903760dff4ea7bb2c7da929fd0f1216a5b11636a5b39f7c6df5724d1284f21e1f66a1d5e95cbdb30336149e1338c3decd3f564f1f86fecc97ca44599d
SSDEEP 49152:GezaTF8FcNkNdfE0pZ9ozttwIRxj4c5yOBZnQbZLoQBI:GemTLkNdfE0pZyh
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/408-0-0x0000022A80190000-0x0000022A801A0000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads