xmrig | a6a39693a6ea24c146b496c502fa18195db0cdfac3943ebe6d5a07d15ec1b1a8

Analysis

max time kernel
99s
max time network
134s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
15/11/2024, 01:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a6a39693a6ea24c146b496c502fa18195db0cdfac3943ebe6d5a07d15ec1b1a8.exe
Size

1.3MB
MD5

91ba5b7b8811b3fb99f37c6f96425710
SHA1

6f2c2e254f8d602516e83311329ceb1553564bf9
SHA256

a6a39693a6ea24c146b496c502fa18195db0cdfac3943ebe6d5a07d15ec1b1a8
SHA512

3ba027840ff99f5c6607324d4cb40ee5e3f60805ba5f1eb62fc1c5c6d806bda813182198ee98c82ea239e99d5e821f1c26ebec5f6f72ac8eb30436dce98d16ed
SSDEEP

24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbpwlKenszbWKDNEm/5O+7MMKTbcx:GezaTF8FcNkNdfE0pZ9ozttwIRxj4c5v

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 33 IoCs

miner

resource	yara_rule
behavioral2/files/0x0007000000023c92-7.dat	xmrig
behavioral2/files/0x0008000000023c91-8.dat	xmrig
behavioral2/files/0x0007000000023c93-18.dat	xmrig
behavioral2/files/0x0007000000023c94-20.dat	xmrig
behavioral2/files/0x0007000000023c95-30.dat	xmrig
behavioral2/files/0x000b000000023bb1-5.dat	xmrig
behavioral2/files/0x0007000000023c96-34.dat	xmrig
behavioral2/files/0x0007000000023c97-37.dat	xmrig
behavioral2/files/0x0008000000023c8f-47.dat	xmrig
behavioral2/files/0x0007000000023c98-48.dat	xmrig
behavioral2/files/0x0007000000023c99-53.dat	xmrig
behavioral2/files/0x0007000000023c9b-58.dat	xmrig
behavioral2/files/0x0007000000023c9c-64.dat	xmrig
behavioral2/files/0x0007000000023c9d-68.dat	xmrig
behavioral2/files/0x0007000000023c9e-73.dat	xmrig
behavioral2/files/0x0007000000023c9f-77.dat	xmrig
behavioral2/files/0x0007000000023ca0-84.dat	xmrig
behavioral2/files/0x0007000000023ca1-89.dat	xmrig
behavioral2/files/0x0007000000023ca2-95.dat	xmrig
behavioral2/files/0x0007000000023ca5-105.dat	xmrig
behavioral2/files/0x0007000000023ca4-103.dat	xmrig
behavioral2/files/0x0007000000023ca6-110.dat	xmrig
behavioral2/files/0x0007000000023ca8-119.dat	xmrig
behavioral2/files/0x0007000000023ca9-120.dat	xmrig
behavioral2/files/0x0007000000023caa-130.dat	xmrig
behavioral2/files/0x0007000000023cab-134.dat	xmrig
behavioral2/files/0x0007000000023cae-147.dat	xmrig
behavioral2/files/0x0007000000023caf-152.dat	xmrig
behavioral2/files/0x0007000000023cb0-157.dat	xmrig
behavioral2/files/0x0007000000023cb1-162.dat	xmrig
behavioral2/files/0x0007000000023cad-150.dat	xmrig
behavioral2/files/0x0007000000023cac-145.dat	xmrig
behavioral2/files/0x0007000000023ca7-123.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
1888	FHdqFpB.exe
440	DYdpMFU.exe
2936	gltQaTG.exe
212	wPkZBOP.exe
4684	WRHVQda.exe
4476	jWHoCCL.exe
2040	inPDWwe.exe
5096	DynaMhY.exe
3740	pjLAwqD.exe
2180	NdEdnwH.exe
112	ueiyMHO.exe
3288	kkjWsWP.exe
3156	jXOzkjC.exe
856	WXrYPyK.exe
944	CUMDoLB.exe
4708	YMjYxDX.exe
2184	yMTSbHN.exe
2420	oBAVPVE.exe
3532	IWgCxjh.exe
3660	ocbMOhe.exe
5072	qaMszzo.exe
4908	USTJOqq.exe
1328	qsvMKFD.exe
2680	riCQpAs.exe
3596	azvwphR.exe
2196	qLZFibO.exe
4524	qMUYtwy.exe
3980	qtCcxCY.exe
2472	NVlzvTc.exe
992	EVAeeWR.exe
4516	oXNhaMQ.exe
4184	TcsrvDU.exe
1236	KUQAVll.exe
1784	WaUPlUw.exe
4596	MWfBiNz.exe
3480	ZeOsRwI.exe
3476	vImTyXS.exe
4828	notzkNM.exe
4996	tuMnfww.exe
3284	BXNsbeU.exe
5004	BgIBhuG.exe
4948	lGKmzrh.exe
2876	eYbuMkr.exe
2804	VCgVEdq.exe
528	EbZDzCA.exe
1828	rNKZUrI.exe
1860	qiGtpMV.exe
2660	SjhHBgk.exe
2156	ccxnVwU.exe
1468	yfutUtk.exe
2392	cMfmCIV.exe
4456	afswtIb.exe
2104	bVUwPGJ.exe
4188	BXwjmVe.exe
2004	ULJQMOw.exe
852	LynlMST.exe
2596	rqLTtgb.exe
2340	CHeLDqr.exe
4576	ldodOJL.exe
3864	EJSNboX.exe
1772	EMfKrLG.exe
2480	vrUcYcQ.exe
4932	wYqWNpX.exe
824	NrjEWEG.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\TTXMPkH.exe	a6a39693a6ea24c146b496c502fa18195db0cdfac3943ebe6d5a07d15ec1b1a8.exe
File created	C:\Windows\System\AJZAUWS.exe	a6a39693a6ea24c146b496c502fa18195db0cdfac3943ebe6d5a07d15ec1b1a8.exe
File created	C:\Windows\System\CdxBmtS.exe	a6a39693a6ea24c146b496c502fa18195db0cdfac3943ebe6d5a07d15ec1b1a8.exe
File created	C:\Windows\System\DQIzcdg.exe	a6a39693a6ea24c146b496c502fa18195db0cdfac3943ebe6d5a07d15ec1b1a8.exe
File created	C:\Windows\System\hCPCGaq.exe	a6a39693a6ea24c146b496c502fa18195db0cdfac3943ebe6d5a07d15ec1b1a8.exe
File created	C:\Windows\System\zKUVvmG.exe	a6a39693a6ea24c146b496c502fa18195db0cdfac3943ebe6d5a07d15ec1b1a8.exe
File created	C:\Windows\System\BeNCvGY.exe	a6a39693a6ea24c146b496c502fa18195db0cdfac3943ebe6d5a07d15ec1b1a8.exe
File created	C:\Windows\System\tgGzmdJ.exe	a6a39693a6ea24c146b496c502fa18195db0cdfac3943ebe6d5a07d15ec1b1a8.exe
File created	C:\Windows\System\qtCyIgY.exe	a6a39693a6ea24c146b496c502fa18195db0cdfac3943ebe6d5a07d15ec1b1a8.exe
File created	C:\Windows\System\wVoCuWy.exe	a6a39693a6ea24c146b496c502fa18195db0cdfac3943ebe6d5a07d15ec1b1a8.exe
File created	C:\Windows\System\ZeOsRwI.exe	a6a39693a6ea24c146b496c502fa18195db0cdfac3943ebe6d5a07d15ec1b1a8.exe
File created	C:\Windows\System\obLZDXZ.exe	a6a39693a6ea24c146b496c502fa18195db0cdfac3943ebe6d5a07d15ec1b1a8.exe
File created	C:\Windows\System\YMjYxDX.exe	a6a39693a6ea24c146b496c502fa18195db0cdfac3943ebe6d5a07d15ec1b1a8.exe
File created	C:\Windows\System\ycMdpdf.exe	a6a39693a6ea24c146b496c502fa18195db0cdfac3943ebe6d5a07d15ec1b1a8.exe
File created	C:\Windows\System\hIIgXwk.exe	a6a39693a6ea24c146b496c502fa18195db0cdfac3943ebe6d5a07d15ec1b1a8.exe
File created	C:\Windows\System\xBGCsDd.exe	a6a39693a6ea24c146b496c502fa18195db0cdfac3943ebe6d5a07d15ec1b1a8.exe
File created	C:\Windows\System\SbbhNtI.exe	a6a39693a6ea24c146b496c502fa18195db0cdfac3943ebe6d5a07d15ec1b1a8.exe
File created	C:\Windows\System\KbYGmxT.exe	a6a39693a6ea24c146b496c502fa18195db0cdfac3943ebe6d5a07d15ec1b1a8.exe
File created	C:\Windows\System\vImTyXS.exe	a6a39693a6ea24c146b496c502fa18195db0cdfac3943ebe6d5a07d15ec1b1a8.exe
File created	C:\Windows\System\RYXQcjC.exe	a6a39693a6ea24c146b496c502fa18195db0cdfac3943ebe6d5a07d15ec1b1a8.exe
File created	C:\Windows\System\FhoerPU.exe	a6a39693a6ea24c146b496c502fa18195db0cdfac3943ebe6d5a07d15ec1b1a8.exe
File created	C:\Windows\System\wPkZBOP.exe	a6a39693a6ea24c146b496c502fa18195db0cdfac3943ebe6d5a07d15ec1b1a8.exe
File created	C:\Windows\System\OPDELsP.exe	a6a39693a6ea24c146b496c502fa18195db0cdfac3943ebe6d5a07d15ec1b1a8.exe
File created	C:\Windows\System\hvWfFQA.exe	a6a39693a6ea24c146b496c502fa18195db0cdfac3943ebe6d5a07d15ec1b1a8.exe
File created	C:\Windows\System\dbVFNPD.exe	a6a39693a6ea24c146b496c502fa18195db0cdfac3943ebe6d5a07d15ec1b1a8.exe
File created	C:\Windows\System\EnooHyM.exe	a6a39693a6ea24c146b496c502fa18195db0cdfac3943ebe6d5a07d15ec1b1a8.exe
File created	C:\Windows\System\vGfrQBQ.exe	a6a39693a6ea24c146b496c502fa18195db0cdfac3943ebe6d5a07d15ec1b1a8.exe
File created	C:\Windows\System\rNKZUrI.exe	a6a39693a6ea24c146b496c502fa18195db0cdfac3943ebe6d5a07d15ec1b1a8.exe
File created	C:\Windows\System\afwYSMA.exe	a6a39693a6ea24c146b496c502fa18195db0cdfac3943ebe6d5a07d15ec1b1a8.exe
File created	C:\Windows\System\QdrFUNJ.exe	a6a39693a6ea24c146b496c502fa18195db0cdfac3943ebe6d5a07d15ec1b1a8.exe
File created	C:\Windows\System\NvnbvQS.exe	a6a39693a6ea24c146b496c502fa18195db0cdfac3943ebe6d5a07d15ec1b1a8.exe
File created	C:\Windows\System\NMkcyvo.exe	a6a39693a6ea24c146b496c502fa18195db0cdfac3943ebe6d5a07d15ec1b1a8.exe
File created	C:\Windows\System\uZaYqJP.exe	a6a39693a6ea24c146b496c502fa18195db0cdfac3943ebe6d5a07d15ec1b1a8.exe
File created	C:\Windows\System\IwxqQdD.exe	a6a39693a6ea24c146b496c502fa18195db0cdfac3943ebe6d5a07d15ec1b1a8.exe
File created	C:\Windows\System\lowYypR.exe	a6a39693a6ea24c146b496c502fa18195db0cdfac3943ebe6d5a07d15ec1b1a8.exe
File created	C:\Windows\System\srwQysV.exe	a6a39693a6ea24c146b496c502fa18195db0cdfac3943ebe6d5a07d15ec1b1a8.exe
File created	C:\Windows\System\OcjUmmM.exe	a6a39693a6ea24c146b496c502fa18195db0cdfac3943ebe6d5a07d15ec1b1a8.exe
File created	C:\Windows\System\wJZIIMS.exe	a6a39693a6ea24c146b496c502fa18195db0cdfac3943ebe6d5a07d15ec1b1a8.exe
File created	C:\Windows\System\SbbwhzL.exe	a6a39693a6ea24c146b496c502fa18195db0cdfac3943ebe6d5a07d15ec1b1a8.exe
File created	C:\Windows\System\rTJFtwI.exe	a6a39693a6ea24c146b496c502fa18195db0cdfac3943ebe6d5a07d15ec1b1a8.exe
File created	C:\Windows\System\bwVEFzR.exe	a6a39693a6ea24c146b496c502fa18195db0cdfac3943ebe6d5a07d15ec1b1a8.exe
File created	C:\Windows\System\eIjczrH.exe	a6a39693a6ea24c146b496c502fa18195db0cdfac3943ebe6d5a07d15ec1b1a8.exe
File created	C:\Windows\System\PIwjRIs.exe	a6a39693a6ea24c146b496c502fa18195db0cdfac3943ebe6d5a07d15ec1b1a8.exe
File created	C:\Windows\System\ReEHMZx.exe	a6a39693a6ea24c146b496c502fa18195db0cdfac3943ebe6d5a07d15ec1b1a8.exe
File created	C:\Windows\System\FzfbvJy.exe	a6a39693a6ea24c146b496c502fa18195db0cdfac3943ebe6d5a07d15ec1b1a8.exe
File created	C:\Windows\System\notzkNM.exe	a6a39693a6ea24c146b496c502fa18195db0cdfac3943ebe6d5a07d15ec1b1a8.exe
File created	C:\Windows\System\jHGElYe.exe	a6a39693a6ea24c146b496c502fa18195db0cdfac3943ebe6d5a07d15ec1b1a8.exe
File created	C:\Windows\System\BudljMV.exe	a6a39693a6ea24c146b496c502fa18195db0cdfac3943ebe6d5a07d15ec1b1a8.exe
File created	C:\Windows\System\bSPMZMe.exe	a6a39693a6ea24c146b496c502fa18195db0cdfac3943ebe6d5a07d15ec1b1a8.exe
File created	C:\Windows\System\VMUJTct.exe	a6a39693a6ea24c146b496c502fa18195db0cdfac3943ebe6d5a07d15ec1b1a8.exe
File created	C:\Windows\System\sNYIIRM.exe	a6a39693a6ea24c146b496c502fa18195db0cdfac3943ebe6d5a07d15ec1b1a8.exe
File created	C:\Windows\System\TBldOoI.exe	a6a39693a6ea24c146b496c502fa18195db0cdfac3943ebe6d5a07d15ec1b1a8.exe
File created	C:\Windows\System\qyjLzAG.exe	a6a39693a6ea24c146b496c502fa18195db0cdfac3943ebe6d5a07d15ec1b1a8.exe
File created	C:\Windows\System\UngqwXC.exe	a6a39693a6ea24c146b496c502fa18195db0cdfac3943ebe6d5a07d15ec1b1a8.exe
File created	C:\Windows\System\eTzngMv.exe	a6a39693a6ea24c146b496c502fa18195db0cdfac3943ebe6d5a07d15ec1b1a8.exe
File created	C:\Windows\System\emUtPgL.exe	a6a39693a6ea24c146b496c502fa18195db0cdfac3943ebe6d5a07d15ec1b1a8.exe
File created	C:\Windows\System\mDDKiFQ.exe	a6a39693a6ea24c146b496c502fa18195db0cdfac3943ebe6d5a07d15ec1b1a8.exe
File created	C:\Windows\System\gltQaTG.exe	a6a39693a6ea24c146b496c502fa18195db0cdfac3943ebe6d5a07d15ec1b1a8.exe
File created	C:\Windows\System\cgBKaCi.exe	a6a39693a6ea24c146b496c502fa18195db0cdfac3943ebe6d5a07d15ec1b1a8.exe
File created	C:\Windows\System\cSXgyBd.exe	a6a39693a6ea24c146b496c502fa18195db0cdfac3943ebe6d5a07d15ec1b1a8.exe
File created	C:\Windows\System\CUAbwPD.exe	a6a39693a6ea24c146b496c502fa18195db0cdfac3943ebe6d5a07d15ec1b1a8.exe
File created	C:\Windows\System\ikhQgqt.exe	a6a39693a6ea24c146b496c502fa18195db0cdfac3943ebe6d5a07d15ec1b1a8.exe
File created	C:\Windows\System\roGNEym.exe	a6a39693a6ea24c146b496c502fa18195db0cdfac3943ebe6d5a07d15ec1b1a8.exe
File created	C:\Windows\System\jMWFWtu.exe	a6a39693a6ea24c146b496c502fa18195db0cdfac3943ebe6d5a07d15ec1b1a8.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	17292	dwm.exe
Token: SeChangeNotifyPrivilege	17292	dwm.exe
Token: 33	17292	dwm.exe
Token: SeIncBasePriorityPrivilege	17292	dwm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4044 wrote to memory of 1888	4044	a6a39693a6ea24c146b496c502fa18195db0cdfac3943ebe6d5a07d15ec1b1a8.exe	84
PID 4044 wrote to memory of 1888	4044	a6a39693a6ea24c146b496c502fa18195db0cdfac3943ebe6d5a07d15ec1b1a8.exe	84
PID 4044 wrote to memory of 440	4044	a6a39693a6ea24c146b496c502fa18195db0cdfac3943ebe6d5a07d15ec1b1a8.exe	85
PID 4044 wrote to memory of 440	4044	a6a39693a6ea24c146b496c502fa18195db0cdfac3943ebe6d5a07d15ec1b1a8.exe	85
PID 4044 wrote to memory of 2936	4044	a6a39693a6ea24c146b496c502fa18195db0cdfac3943ebe6d5a07d15ec1b1a8.exe	86
PID 4044 wrote to memory of 2936	4044	a6a39693a6ea24c146b496c502fa18195db0cdfac3943ebe6d5a07d15ec1b1a8.exe	86
PID 4044 wrote to memory of 212	4044	a6a39693a6ea24c146b496c502fa18195db0cdfac3943ebe6d5a07d15ec1b1a8.exe	87
PID 4044 wrote to memory of 212	4044	a6a39693a6ea24c146b496c502fa18195db0cdfac3943ebe6d5a07d15ec1b1a8.exe	87
PID 4044 wrote to memory of 4684	4044	a6a39693a6ea24c146b496c502fa18195db0cdfac3943ebe6d5a07d15ec1b1a8.exe	88
PID 4044 wrote to memory of 4684	4044	a6a39693a6ea24c146b496c502fa18195db0cdfac3943ebe6d5a07d15ec1b1a8.exe	88
PID 4044 wrote to memory of 4476	4044	a6a39693a6ea24c146b496c502fa18195db0cdfac3943ebe6d5a07d15ec1b1a8.exe	89
PID 4044 wrote to memory of 4476	4044	a6a39693a6ea24c146b496c502fa18195db0cdfac3943ebe6d5a07d15ec1b1a8.exe	89
PID 4044 wrote to memory of 2040	4044	a6a39693a6ea24c146b496c502fa18195db0cdfac3943ebe6d5a07d15ec1b1a8.exe	90
PID 4044 wrote to memory of 2040	4044	a6a39693a6ea24c146b496c502fa18195db0cdfac3943ebe6d5a07d15ec1b1a8.exe	90
PID 4044 wrote to memory of 5096	4044	a6a39693a6ea24c146b496c502fa18195db0cdfac3943ebe6d5a07d15ec1b1a8.exe	91
PID 4044 wrote to memory of 5096	4044	a6a39693a6ea24c146b496c502fa18195db0cdfac3943ebe6d5a07d15ec1b1a8.exe	91
PID 4044 wrote to memory of 3740	4044	a6a39693a6ea24c146b496c502fa18195db0cdfac3943ebe6d5a07d15ec1b1a8.exe	92
PID 4044 wrote to memory of 3740	4044	a6a39693a6ea24c146b496c502fa18195db0cdfac3943ebe6d5a07d15ec1b1a8.exe	92
PID 4044 wrote to memory of 2180	4044	a6a39693a6ea24c146b496c502fa18195db0cdfac3943ebe6d5a07d15ec1b1a8.exe	93
PID 4044 wrote to memory of 2180	4044	a6a39693a6ea24c146b496c502fa18195db0cdfac3943ebe6d5a07d15ec1b1a8.exe	93
PID 4044 wrote to memory of 112	4044	a6a39693a6ea24c146b496c502fa18195db0cdfac3943ebe6d5a07d15ec1b1a8.exe	94
PID 4044 wrote to memory of 112	4044	a6a39693a6ea24c146b496c502fa18195db0cdfac3943ebe6d5a07d15ec1b1a8.exe	94
PID 4044 wrote to memory of 3288	4044	a6a39693a6ea24c146b496c502fa18195db0cdfac3943ebe6d5a07d15ec1b1a8.exe	95
PID 4044 wrote to memory of 3288	4044	a6a39693a6ea24c146b496c502fa18195db0cdfac3943ebe6d5a07d15ec1b1a8.exe	95
PID 4044 wrote to memory of 3156	4044	a6a39693a6ea24c146b496c502fa18195db0cdfac3943ebe6d5a07d15ec1b1a8.exe	96
PID 4044 wrote to memory of 3156	4044	a6a39693a6ea24c146b496c502fa18195db0cdfac3943ebe6d5a07d15ec1b1a8.exe	96
PID 4044 wrote to memory of 856	4044	a6a39693a6ea24c146b496c502fa18195db0cdfac3943ebe6d5a07d15ec1b1a8.exe	97
PID 4044 wrote to memory of 856	4044	a6a39693a6ea24c146b496c502fa18195db0cdfac3943ebe6d5a07d15ec1b1a8.exe	97
PID 4044 wrote to memory of 944	4044	a6a39693a6ea24c146b496c502fa18195db0cdfac3943ebe6d5a07d15ec1b1a8.exe	98
PID 4044 wrote to memory of 944	4044	a6a39693a6ea24c146b496c502fa18195db0cdfac3943ebe6d5a07d15ec1b1a8.exe	98
PID 4044 wrote to memory of 4708	4044	a6a39693a6ea24c146b496c502fa18195db0cdfac3943ebe6d5a07d15ec1b1a8.exe	99
PID 4044 wrote to memory of 4708	4044	a6a39693a6ea24c146b496c502fa18195db0cdfac3943ebe6d5a07d15ec1b1a8.exe	99
PID 4044 wrote to memory of 2184	4044	a6a39693a6ea24c146b496c502fa18195db0cdfac3943ebe6d5a07d15ec1b1a8.exe	100
PID 4044 wrote to memory of 2184	4044	a6a39693a6ea24c146b496c502fa18195db0cdfac3943ebe6d5a07d15ec1b1a8.exe	100
PID 4044 wrote to memory of 2420	4044	a6a39693a6ea24c146b496c502fa18195db0cdfac3943ebe6d5a07d15ec1b1a8.exe	101
PID 4044 wrote to memory of 2420	4044	a6a39693a6ea24c146b496c502fa18195db0cdfac3943ebe6d5a07d15ec1b1a8.exe	101
PID 4044 wrote to memory of 3532	4044	a6a39693a6ea24c146b496c502fa18195db0cdfac3943ebe6d5a07d15ec1b1a8.exe	102
PID 4044 wrote to memory of 3532	4044	a6a39693a6ea24c146b496c502fa18195db0cdfac3943ebe6d5a07d15ec1b1a8.exe	102
PID 4044 wrote to memory of 3660	4044	a6a39693a6ea24c146b496c502fa18195db0cdfac3943ebe6d5a07d15ec1b1a8.exe	104
PID 4044 wrote to memory of 3660	4044	a6a39693a6ea24c146b496c502fa18195db0cdfac3943ebe6d5a07d15ec1b1a8.exe	104
PID 4044 wrote to memory of 5072	4044	a6a39693a6ea24c146b496c502fa18195db0cdfac3943ebe6d5a07d15ec1b1a8.exe	105
PID 4044 wrote to memory of 5072	4044	a6a39693a6ea24c146b496c502fa18195db0cdfac3943ebe6d5a07d15ec1b1a8.exe	105
PID 4044 wrote to memory of 4908	4044	a6a39693a6ea24c146b496c502fa18195db0cdfac3943ebe6d5a07d15ec1b1a8.exe	106
PID 4044 wrote to memory of 4908	4044	a6a39693a6ea24c146b496c502fa18195db0cdfac3943ebe6d5a07d15ec1b1a8.exe	106
PID 4044 wrote to memory of 1328	4044	a6a39693a6ea24c146b496c502fa18195db0cdfac3943ebe6d5a07d15ec1b1a8.exe	108
PID 4044 wrote to memory of 1328	4044	a6a39693a6ea24c146b496c502fa18195db0cdfac3943ebe6d5a07d15ec1b1a8.exe	108
PID 4044 wrote to memory of 2680	4044	a6a39693a6ea24c146b496c502fa18195db0cdfac3943ebe6d5a07d15ec1b1a8.exe	109
PID 4044 wrote to memory of 2680	4044	a6a39693a6ea24c146b496c502fa18195db0cdfac3943ebe6d5a07d15ec1b1a8.exe	109
PID 4044 wrote to memory of 3596	4044	a6a39693a6ea24c146b496c502fa18195db0cdfac3943ebe6d5a07d15ec1b1a8.exe	110
PID 4044 wrote to memory of 3596	4044	a6a39693a6ea24c146b496c502fa18195db0cdfac3943ebe6d5a07d15ec1b1a8.exe	110
PID 4044 wrote to memory of 2196	4044	a6a39693a6ea24c146b496c502fa18195db0cdfac3943ebe6d5a07d15ec1b1a8.exe	111
PID 4044 wrote to memory of 2196	4044	a6a39693a6ea24c146b496c502fa18195db0cdfac3943ebe6d5a07d15ec1b1a8.exe	111
PID 4044 wrote to memory of 4524	4044	a6a39693a6ea24c146b496c502fa18195db0cdfac3943ebe6d5a07d15ec1b1a8.exe	112
PID 4044 wrote to memory of 4524	4044	a6a39693a6ea24c146b496c502fa18195db0cdfac3943ebe6d5a07d15ec1b1a8.exe	112
PID 4044 wrote to memory of 3980	4044	a6a39693a6ea24c146b496c502fa18195db0cdfac3943ebe6d5a07d15ec1b1a8.exe	113
PID 4044 wrote to memory of 3980	4044	a6a39693a6ea24c146b496c502fa18195db0cdfac3943ebe6d5a07d15ec1b1a8.exe	113
PID 4044 wrote to memory of 2472	4044	a6a39693a6ea24c146b496c502fa18195db0cdfac3943ebe6d5a07d15ec1b1a8.exe	114
PID 4044 wrote to memory of 2472	4044	a6a39693a6ea24c146b496c502fa18195db0cdfac3943ebe6d5a07d15ec1b1a8.exe	114
PID 4044 wrote to memory of 992	4044	a6a39693a6ea24c146b496c502fa18195db0cdfac3943ebe6d5a07d15ec1b1a8.exe	115
PID 4044 wrote to memory of 992	4044	a6a39693a6ea24c146b496c502fa18195db0cdfac3943ebe6d5a07d15ec1b1a8.exe	115
PID 4044 wrote to memory of 4516	4044	a6a39693a6ea24c146b496c502fa18195db0cdfac3943ebe6d5a07d15ec1b1a8.exe	116
PID 4044 wrote to memory of 4516	4044	a6a39693a6ea24c146b496c502fa18195db0cdfac3943ebe6d5a07d15ec1b1a8.exe	116
PID 4044 wrote to memory of 4184	4044	a6a39693a6ea24c146b496c502fa18195db0cdfac3943ebe6d5a07d15ec1b1a8.exe	117
PID 4044 wrote to memory of 4184	4044	a6a39693a6ea24c146b496c502fa18195db0cdfac3943ebe6d5a07d15ec1b1a8.exe	117

C:\Users\Admin\AppData\Local\Temp\a6a39693a6ea24c146b496c502fa18195db0cdfac3943ebe6d5a07d15ec1b1a8.exe
"C:\Users\Admin\AppData\Local\Temp\a6a39693a6ea24c146b496c502fa18195db0cdfac3943ebe6d5a07d15ec1b1a8.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4044
- C:\Windows\System\FHdqFpB.exe
  C:\Windows\System\FHdqFpB.exe
  2⤵
  - Executes dropped EXE
  PID:1888
- C:\Windows\System\DYdpMFU.exe
  C:\Windows\System\DYdpMFU.exe
  2⤵
  - Executes dropped EXE
  PID:440
- C:\Windows\System\gltQaTG.exe
  C:\Windows\System\gltQaTG.exe
  2⤵
  - Executes dropped EXE
  PID:2936
- C:\Windows\System\wPkZBOP.exe
  C:\Windows\System\wPkZBOP.exe
  2⤵
  - Executes dropped EXE
  PID:212
- C:\Windows\System\WRHVQda.exe
  C:\Windows\System\WRHVQda.exe
  2⤵
  - Executes dropped EXE
  PID:4684
- C:\Windows\System\jWHoCCL.exe
  C:\Windows\System\jWHoCCL.exe
  2⤵
  - Executes dropped EXE
  PID:4476
- C:\Windows\System\inPDWwe.exe
  C:\Windows\System\inPDWwe.exe
  2⤵
  - Executes dropped EXE
  PID:2040
- C:\Windows\System\DynaMhY.exe
  C:\Windows\System\DynaMhY.exe
  2⤵
  - Executes dropped EXE
  PID:5096
- C:\Windows\System\pjLAwqD.exe
  C:\Windows\System\pjLAwqD.exe
  2⤵
  - Executes dropped EXE
  PID:3740
- C:\Windows\System\NdEdnwH.exe
  C:\Windows\System\NdEdnwH.exe
  2⤵
  - Executes dropped EXE
  PID:2180
- C:\Windows\System\ueiyMHO.exe
  C:\Windows\System\ueiyMHO.exe
  2⤵
  - Executes dropped EXE
  PID:112
- C:\Windows\System\kkjWsWP.exe
  C:\Windows\System\kkjWsWP.exe
  2⤵
  - Executes dropped EXE
  PID:3288
- C:\Windows\System\jXOzkjC.exe
  C:\Windows\System\jXOzkjC.exe
  2⤵
  - Executes dropped EXE
  PID:3156
- C:\Windows\System\WXrYPyK.exe
  C:\Windows\System\WXrYPyK.exe
  2⤵
  - Executes dropped EXE
  PID:856
- C:\Windows\System\CUMDoLB.exe
  C:\Windows\System\CUMDoLB.exe
  2⤵
  - Executes dropped EXE
  PID:944
- C:\Windows\System\YMjYxDX.exe
  C:\Windows\System\YMjYxDX.exe
  2⤵
  - Executes dropped EXE
  PID:4708
- C:\Windows\System\yMTSbHN.exe
  C:\Windows\System\yMTSbHN.exe
  2⤵
  - Executes dropped EXE
  PID:2184
- C:\Windows\System\oBAVPVE.exe
  C:\Windows\System\oBAVPVE.exe
  2⤵
  - Executes dropped EXE
  PID:2420
- C:\Windows\System\IWgCxjh.exe
  C:\Windows\System\IWgCxjh.exe
  2⤵
  - Executes dropped EXE
  PID:3532
- C:\Windows\System\ocbMOhe.exe
  C:\Windows\System\ocbMOhe.exe
  2⤵
  - Executes dropped EXE
  PID:3660
- C:\Windows\System\qaMszzo.exe
  C:\Windows\System\qaMszzo.exe
  2⤵
  - Executes dropped EXE
  PID:5072
- C:\Windows\System\USTJOqq.exe
  C:\Windows\System\USTJOqq.exe
  2⤵
  - Executes dropped EXE
  PID:4908
- C:\Windows\System\qsvMKFD.exe
  C:\Windows\System\qsvMKFD.exe
  2⤵
  - Executes dropped EXE
  PID:1328
- C:\Windows\System\riCQpAs.exe
  C:\Windows\System\riCQpAs.exe
  2⤵
  - Executes dropped EXE
  PID:2680
- C:\Windows\System\azvwphR.exe
  C:\Windows\System\azvwphR.exe
  2⤵
  - Executes dropped EXE
  PID:3596
- C:\Windows\System\qLZFibO.exe
  C:\Windows\System\qLZFibO.exe
  2⤵
  - Executes dropped EXE
  PID:2196
- C:\Windows\System\qMUYtwy.exe
  C:\Windows\System\qMUYtwy.exe
  2⤵
  - Executes dropped EXE
  PID:4524
- C:\Windows\System\qtCcxCY.exe
  C:\Windows\System\qtCcxCY.exe
  2⤵
  - Executes dropped EXE
  PID:3980
- C:\Windows\System\NVlzvTc.exe
  C:\Windows\System\NVlzvTc.exe
  2⤵
  - Executes dropped EXE
  PID:2472
- C:\Windows\System\EVAeeWR.exe
  C:\Windows\System\EVAeeWR.exe
  2⤵
  - Executes dropped EXE
  PID:992
- C:\Windows\System\oXNhaMQ.exe
  C:\Windows\System\oXNhaMQ.exe
  2⤵
  - Executes dropped EXE
  PID:4516
- C:\Windows\System\TcsrvDU.exe
  C:\Windows\System\TcsrvDU.exe
  2⤵
  - Executes dropped EXE
  PID:4184
- C:\Windows\System\KUQAVll.exe
  C:\Windows\System\KUQAVll.exe
  2⤵
  - Executes dropped EXE
  PID:1236
- C:\Windows\System\WaUPlUw.exe
  C:\Windows\System\WaUPlUw.exe
  2⤵
  - Executes dropped EXE
  PID:1784
- C:\Windows\System\MWfBiNz.exe
  C:\Windows\System\MWfBiNz.exe
  2⤵
  - Executes dropped EXE
  PID:4596
- C:\Windows\System\ZeOsRwI.exe
  C:\Windows\System\ZeOsRwI.exe
  2⤵
  - Executes dropped EXE
  PID:3480
- C:\Windows\System\vImTyXS.exe
  C:\Windows\System\vImTyXS.exe
  2⤵
  - Executes dropped EXE
  PID:3476
- C:\Windows\System\notzkNM.exe
  C:\Windows\System\notzkNM.exe
  2⤵
  - Executes dropped EXE
  PID:4828
- C:\Windows\System\tuMnfww.exe
  C:\Windows\System\tuMnfww.exe
  2⤵
  - Executes dropped EXE
  PID:4996
- C:\Windows\System\BXNsbeU.exe
  C:\Windows\System\BXNsbeU.exe
  2⤵
  - Executes dropped EXE
  PID:3284
- C:\Windows\System\BgIBhuG.exe
  C:\Windows\System\BgIBhuG.exe
  2⤵
  - Executes dropped EXE
  PID:5004
- C:\Windows\System\lGKmzrh.exe
  C:\Windows\System\lGKmzrh.exe
  2⤵
  - Executes dropped EXE
  PID:4948
- C:\Windows\System\eYbuMkr.exe
  C:\Windows\System\eYbuMkr.exe
  2⤵
  - Executes dropped EXE
  PID:2876
- C:\Windows\System\VCgVEdq.exe
  C:\Windows\System\VCgVEdq.exe
  2⤵
  - Executes dropped EXE
  PID:2804
- C:\Windows\System\EbZDzCA.exe
  C:\Windows\System\EbZDzCA.exe
  2⤵
  - Executes dropped EXE
  PID:528
- C:\Windows\System\rNKZUrI.exe
  C:\Windows\System\rNKZUrI.exe
  2⤵
  - Executes dropped EXE
  PID:1828
- C:\Windows\System\qiGtpMV.exe
  C:\Windows\System\qiGtpMV.exe
  2⤵
  - Executes dropped EXE
  PID:1860
- C:\Windows\System\SjhHBgk.exe
  C:\Windows\System\SjhHBgk.exe
  2⤵
  - Executes dropped EXE
  PID:2660
- C:\Windows\System\ccxnVwU.exe
  C:\Windows\System\ccxnVwU.exe
  2⤵
  - Executes dropped EXE
  PID:2156
- C:\Windows\System\yfutUtk.exe
  C:\Windows\System\yfutUtk.exe
  2⤵
  - Executes dropped EXE
  PID:1468
- C:\Windows\System\cMfmCIV.exe
  C:\Windows\System\cMfmCIV.exe
  2⤵
  - Executes dropped EXE
  PID:2392
- C:\Windows\System\afswtIb.exe
  C:\Windows\System\afswtIb.exe
  2⤵
  - Executes dropped EXE
  PID:4456
- C:\Windows\System\bVUwPGJ.exe
  C:\Windows\System\bVUwPGJ.exe
  2⤵
  - Executes dropped EXE
  PID:2104
- C:\Windows\System\BXwjmVe.exe
  C:\Windows\System\BXwjmVe.exe
  2⤵
  - Executes dropped EXE
  PID:4188
- C:\Windows\System\ULJQMOw.exe
  C:\Windows\System\ULJQMOw.exe
  2⤵
  - Executes dropped EXE
  PID:2004
- C:\Windows\System\LynlMST.exe
  C:\Windows\System\LynlMST.exe
  2⤵
  - Executes dropped EXE
  PID:852
- C:\Windows\System\rqLTtgb.exe
  C:\Windows\System\rqLTtgb.exe
  2⤵
  - Executes dropped EXE
  PID:2596
- C:\Windows\System\CHeLDqr.exe
  C:\Windows\System\CHeLDqr.exe
  2⤵
  - Executes dropped EXE
  PID:2340
- C:\Windows\System\ldodOJL.exe
  C:\Windows\System\ldodOJL.exe
  2⤵
  - Executes dropped EXE
  PID:4576
- C:\Windows\System\EJSNboX.exe
  C:\Windows\System\EJSNboX.exe
  2⤵
  - Executes dropped EXE
  PID:3864
- C:\Windows\System\EMfKrLG.exe
  C:\Windows\System\EMfKrLG.exe
  2⤵
  - Executes dropped EXE
  PID:1772
- C:\Windows\System\vrUcYcQ.exe
  C:\Windows\System\vrUcYcQ.exe
  2⤵
  - Executes dropped EXE
  PID:2480
- C:\Windows\System\wYqWNpX.exe
  C:\Windows\System\wYqWNpX.exe
  2⤵
  - Executes dropped EXE
  PID:4932
- C:\Windows\System\NrjEWEG.exe
  C:\Windows\System\NrjEWEG.exe
  2⤵
  - Executes dropped EXE
  PID:824
- C:\Windows\System\SUhcqHk.exe
  C:\Windows\System\SUhcqHk.exe
  2⤵
  PID:3088
- C:\Windows\System\kqVjgWt.exe
  C:\Windows\System\kqVjgWt.exe
  2⤵
  PID:5024
- C:\Windows\System\CUAbwPD.exe
  C:\Windows\System\CUAbwPD.exe
  2⤵
  PID:4972
- C:\Windows\System\wQSGPXI.exe
  C:\Windows\System\wQSGPXI.exe
  2⤵
  PID:2592
- C:\Windows\System\NUQWJTl.exe
  C:\Windows\System\NUQWJTl.exe
  2⤵
  PID:1808
- C:\Windows\System\OtiVwtA.exe
  C:\Windows\System\OtiVwtA.exe
  2⤵
  PID:1612
- C:\Windows\System\ZoelCRS.exe
  C:\Windows\System\ZoelCRS.exe
  2⤵
  PID:4660
- C:\Windows\System\LqABfNh.exe
  C:\Windows\System\LqABfNh.exe
  2⤵
  PID:3092
- C:\Windows\System\YByKlkJ.exe
  C:\Windows\System\YByKlkJ.exe
  2⤵
  PID:2336
- C:\Windows\System\tCEytaX.exe
  C:\Windows\System\tCEytaX.exe
  2⤵
  PID:2192
- C:\Windows\System\OLWMtQz.exe
  C:\Windows\System\OLWMtQz.exe
  2⤵
  PID:380
- C:\Windows\System\rWyXAaw.exe
  C:\Windows\System\rWyXAaw.exe
  2⤵
  PID:3216
- C:\Windows\System\fkbNIgq.exe
  C:\Windows\System\fkbNIgq.exe
  2⤵
  PID:3252
- C:\Windows\System\WLhoEWd.exe
  C:\Windows\System\WLhoEWd.exe
  2⤵
  PID:5064
- C:\Windows\System\hwVPiBS.exe
  C:\Windows\System\hwVPiBS.exe
  2⤵
  PID:4600
- C:\Windows\System\AVjcplj.exe
  C:\Windows\System\AVjcplj.exe
  2⤵
  PID:1996
- C:\Windows\System\WRnBTwU.exe
  C:\Windows\System\WRnBTwU.exe
  2⤵
  PID:2720
- C:\Windows\System\gRpNCgq.exe
  C:\Windows\System\gRpNCgq.exe
  2⤵
  PID:5040
- C:\Windows\System\jdWaUnU.exe
  C:\Windows\System\jdWaUnU.exe
  2⤵
  PID:5108
- C:\Windows\System\QrDkBPl.exe
  C:\Windows\System\QrDkBPl.exe
  2⤵
  PID:4712
- C:\Windows\System\jaNPaOr.exe
  C:\Windows\System\jaNPaOr.exe
  2⤵
  PID:3768
- C:\Windows\System\adOaKrH.exe
  C:\Windows\System\adOaKrH.exe
  2⤵
  PID:4092
- C:\Windows\System\IeHQOlN.exe
  C:\Windows\System\IeHQOlN.exe
  2⤵
  PID:3556
- C:\Windows\System\NgLvPpq.exe
  C:\Windows\System\NgLvPpq.exe
  2⤵
  PID:2328
- C:\Windows\System\dTijifQ.exe
  C:\Windows\System\dTijifQ.exe
  2⤵
  PID:644
- C:\Windows\System\DHJChHo.exe
  C:\Windows\System\DHJChHo.exe
  2⤵
  PID:912
- C:\Windows\System\uYhlrfl.exe
  C:\Windows\System\uYhlrfl.exe
  2⤵
  PID:3964
- C:\Windows\System\kBlehdj.exe
  C:\Windows\System\kBlehdj.exe
  2⤵
  PID:1056
- C:\Windows\System\wAGozFB.exe
  C:\Windows\System\wAGozFB.exe
  2⤵
  PID:3304
- C:\Windows\System\PGOAjOF.exe
  C:\Windows\System\PGOAjOF.exe
  2⤵
  PID:2316
- C:\Windows\System\VsluHkW.exe
  C:\Windows\System\VsluHkW.exe
  2⤵
  PID:3436
- C:\Windows\System\RugViIw.exe
  C:\Windows\System\RugViIw.exe
  2⤵
  PID:2260
- C:\Windows\System\fvpkKzn.exe
  C:\Windows\System\fvpkKzn.exe
  2⤵
  PID:3680
- C:\Windows\System\HLTdVdV.exe
  C:\Windows\System\HLTdVdV.exe
  2⤵
  PID:412
- C:\Windows\System\SPdwIyb.exe
  C:\Windows\System\SPdwIyb.exe
  2⤵
  PID:1884
- C:\Windows\System\wNuczgg.exe
  C:\Windows\System\wNuczgg.exe
  2⤵
  PID:3420
- C:\Windows\System\kJElCrQ.exe
  C:\Windows\System\kJElCrQ.exe
  2⤵
  PID:1428
- C:\Windows\System\ldiiWPo.exe
  C:\Windows\System\ldiiWPo.exe
  2⤵
  PID:2204
- C:\Windows\System\ZXfmdqx.exe
  C:\Windows\System\ZXfmdqx.exe
  2⤵
  PID:5136
- C:\Windows\System\pKFHnmt.exe
  C:\Windows\System\pKFHnmt.exe
  2⤵
  PID:5160
- C:\Windows\System\JHDLoIl.exe
  C:\Windows\System\JHDLoIl.exe
  2⤵
  PID:5188
- C:\Windows\System\dQuhwuv.exe
  C:\Windows\System\dQuhwuv.exe
  2⤵
  PID:5204
- C:\Windows\System\sCnuwSy.exe
  C:\Windows\System\sCnuwSy.exe
  2⤵
  PID:5232
- C:\Windows\System\xIiWqLc.exe
  C:\Windows\System\xIiWqLc.exe
  2⤵
  PID:5260
- C:\Windows\System\cPpZYHL.exe
  C:\Windows\System\cPpZYHL.exe
  2⤵
  PID:5288
- C:\Windows\System\cBfaTJH.exe
  C:\Windows\System\cBfaTJH.exe
  2⤵
  PID:5320
- C:\Windows\System\sUwXXFt.exe
  C:\Windows\System\sUwXXFt.exe
  2⤵
  PID:5356
- C:\Windows\System\whFNdMa.exe
  C:\Windows\System\whFNdMa.exe
  2⤵
  PID:5384
- C:\Windows\System\jHGElYe.exe
  C:\Windows\System\jHGElYe.exe
  2⤵
  PID:5412
- C:\Windows\System\Svmuwoh.exe
  C:\Windows\System\Svmuwoh.exe
  2⤵
  PID:5436
- C:\Windows\System\fefRGMJ.exe
  C:\Windows\System\fefRGMJ.exe
  2⤵
  PID:5464
- C:\Windows\System\WomWxah.exe
  C:\Windows\System\WomWxah.exe
  2⤵
  PID:5484
- C:\Windows\System\SGOwtSL.exe
  C:\Windows\System\SGOwtSL.exe
  2⤵
  PID:5524
- C:\Windows\System\GwBXTty.exe
  C:\Windows\System\GwBXTty.exe
  2⤵
  PID:5552
- C:\Windows\System\HtREfbK.exe
  C:\Windows\System\HtREfbK.exe
  2⤵
  PID:5572
- C:\Windows\System\OEHHUPh.exe
  C:\Windows\System\OEHHUPh.exe
  2⤵
  PID:5612
- C:\Windows\System\jymWdef.exe
  C:\Windows\System\jymWdef.exe
  2⤵
  PID:5636
- C:\Windows\System\VIHtNsz.exe
  C:\Windows\System\VIHtNsz.exe
  2⤵
  PID:5664
- C:\Windows\System\bKqMDik.exe
  C:\Windows\System\bKqMDik.exe
  2⤵
  PID:5680
- C:\Windows\System\EAVvRdX.exe
  C:\Windows\System\EAVvRdX.exe
  2⤵
  PID:5708
- C:\Windows\System\QzTWcla.exe
  C:\Windows\System\QzTWcla.exe
  2⤵
  PID:5724
- C:\Windows\System\QEBaQtR.exe
  C:\Windows\System\QEBaQtR.exe
  2⤵
  PID:5744
- C:\Windows\System\kvAJrVT.exe
  C:\Windows\System\kvAJrVT.exe
  2⤵
  PID:5776
- C:\Windows\System\taXQQQo.exe
  C:\Windows\System\taXQQQo.exe
  2⤵
  PID:5848
- C:\Windows\System\aZIvrAl.exe
  C:\Windows\System\aZIvrAl.exe
  2⤵
  PID:5864
- C:\Windows\System\BiYkRoZ.exe
  C:\Windows\System\BiYkRoZ.exe
  2⤵
  PID:5892
- C:\Windows\System\cMFGPEL.exe
  C:\Windows\System\cMFGPEL.exe
  2⤵
  PID:5920
- C:\Windows\System\ySgNKDP.exe
  C:\Windows\System\ySgNKDP.exe
  2⤵
  PID:5936
- C:\Windows\System\hprukKd.exe
  C:\Windows\System\hprukKd.exe
  2⤵
  PID:5968
- C:\Windows\System\zdRHSqf.exe
  C:\Windows\System\zdRHSqf.exe
  2⤵
  PID:5992
- C:\Windows\System\CBZEijk.exe
  C:\Windows\System\CBZEijk.exe
  2⤵
  PID:6020
- C:\Windows\System\YVXMUWC.exe
  C:\Windows\System\YVXMUWC.exe
  2⤵
  PID:6048
- C:\Windows\System\ekvJeox.exe
  C:\Windows\System\ekvJeox.exe
  2⤵
  PID:6064
- C:\Windows\System\XZFnacT.exe
  C:\Windows\System\XZFnacT.exe
  2⤵
  PID:6092
- C:\Windows\System\DavkNwY.exe
  C:\Windows\System\DavkNwY.exe
  2⤵
  PID:6116
- C:\Windows\System\YtwYJor.exe
  C:\Windows\System\YtwYJor.exe
  2⤵
  PID:5124
- C:\Windows\System\frtrCSh.exe
  C:\Windows\System\frtrCSh.exe
  2⤵
  PID:5156
- C:\Windows\System\wvxBVua.exe
  C:\Windows\System\wvxBVua.exe
  2⤵
  PID:5300
- C:\Windows\System\WpIEZlR.exe
  C:\Windows\System\WpIEZlR.exe
  2⤵
  PID:5352
- C:\Windows\System\IHUkYDu.exe
  C:\Windows\System\IHUkYDu.exe
  2⤵
  PID:5408
- C:\Windows\System\UGuobgV.exe
  C:\Windows\System\UGuobgV.exe
  2⤵
  PID:5456
- C:\Windows\System\ZYLFzen.exe
  C:\Windows\System\ZYLFzen.exe
  2⤵
  PID:5520
- C:\Windows\System\jmFRhzo.exe
  C:\Windows\System\jmFRhzo.exe
  2⤵
  PID:5600
- C:\Windows\System\XKqFhXa.exe
  C:\Windows\System\XKqFhXa.exe
  2⤵
  PID:5676
- C:\Windows\System\ZpjEcUD.exe
  C:\Windows\System\ZpjEcUD.exe
  2⤵
  PID:5732
- C:\Windows\System\GVtpAna.exe
  C:\Windows\System\GVtpAna.exe
  2⤵
  PID:5768
- C:\Windows\System\JErcbsE.exe
  C:\Windows\System\JErcbsE.exe
  2⤵
  PID:5844
- C:\Windows\System\dJTtnWc.exe
  C:\Windows\System\dJTtnWc.exe
  2⤵
  PID:5932
- C:\Windows\System\PTdEkKg.exe
  C:\Windows\System\PTdEkKg.exe
  2⤵
  PID:6008
- C:\Windows\System\ZmweGjN.exe
  C:\Windows\System\ZmweGjN.exe
  2⤵
  PID:6080
- C:\Windows\System\PPImbhc.exe
  C:\Windows\System\PPImbhc.exe
  2⤵
  PID:5196
- C:\Windows\System\ukYlBTn.exe
  C:\Windows\System\ukYlBTn.exe
  2⤵
  PID:5148
- C:\Windows\System\sZBMNHF.exe
  C:\Windows\System\sZBMNHF.exe
  2⤵
  PID:5396
- C:\Windows\System\xETKBBj.exe
  C:\Windows\System\xETKBBj.exe
  2⤵
  PID:5648
- C:\Windows\System\hJJfBnB.exe
  C:\Windows\System\hJJfBnB.exe
  2⤵
  PID:5564
- C:\Windows\System\zDATwrL.exe
  C:\Windows\System\zDATwrL.exe
  2⤵
  PID:5788
- C:\Windows\System\emKKnXq.exe
  C:\Windows\System\emKKnXq.exe
  2⤵
  PID:5952
- C:\Windows\System\tiYmAvR.exe
  C:\Windows\System\tiYmAvR.exe
  2⤵
  PID:6040
- C:\Windows\System\dbVFNPD.exe
  C:\Windows\System\dbVFNPD.exe
  2⤵
  PID:5224
- C:\Windows\System\mxZRSfB.exe
  C:\Windows\System\mxZRSfB.exe
  2⤵
  PID:5672
- C:\Windows\System\WXUndjl.exe
  C:\Windows\System\WXUndjl.exe
  2⤵
  PID:5984
- C:\Windows\System\KzDzwzl.exe
  C:\Windows\System\KzDzwzl.exe
  2⤵
  PID:5880
- C:\Windows\System\bUiNAuY.exe
  C:\Windows\System\bUiNAuY.exe
  2⤵
  PID:6164
- C:\Windows\System\KbadyXB.exe
  C:\Windows\System\KbadyXB.exe
  2⤵
  PID:6184
- C:\Windows\System\ReEHMZx.exe
  C:\Windows\System\ReEHMZx.exe
  2⤵
  PID:6216
- C:\Windows\System\pgcvEyo.exe
  C:\Windows\System\pgcvEyo.exe
  2⤵
  PID:6232
- C:\Windows\System\uDxAkhp.exe
  C:\Windows\System\uDxAkhp.exe
  2⤵
  PID:6260
- C:\Windows\System\kbHlEqI.exe
  C:\Windows\System\kbHlEqI.exe
  2⤵
  PID:6288
- C:\Windows\System\FMmiwQK.exe
  C:\Windows\System\FMmiwQK.exe
  2⤵
  PID:6328
- C:\Windows\System\cxIYnBx.exe
  C:\Windows\System\cxIYnBx.exe
  2⤵
  PID:6352
- C:\Windows\System\MnyPbcK.exe
  C:\Windows\System\MnyPbcK.exe
  2⤵
  PID:6368
- C:\Windows\System\LVjqzUT.exe
  C:\Windows\System\LVjqzUT.exe
  2⤵
  PID:6384
- C:\Windows\System\hCPCGaq.exe
  C:\Windows\System\hCPCGaq.exe
  2⤵
  PID:6412
- C:\Windows\System\vArlrTX.exe
  C:\Windows\System\vArlrTX.exe
  2⤵
  PID:6428
- C:\Windows\System\nSNwBPU.exe
  C:\Windows\System\nSNwBPU.exe
  2⤵
  PID:6480
- C:\Windows\System\MtrVhhN.exe
  C:\Windows\System\MtrVhhN.exe
  2⤵
  PID:6508
- C:\Windows\System\yaBXvfo.exe
  C:\Windows\System\yaBXvfo.exe
  2⤵
  PID:6536
- C:\Windows\System\tiWQhAI.exe
  C:\Windows\System\tiWQhAI.exe
  2⤵
  PID:6568
- C:\Windows\System\ZTBZmzq.exe
  C:\Windows\System\ZTBZmzq.exe
  2⤵
  PID:6592
- C:\Windows\System\CsmwuVa.exe
  C:\Windows\System\CsmwuVa.exe
  2⤵
  PID:6624
- C:\Windows\System\uepfZuY.exe
  C:\Windows\System\uepfZuY.exe
  2⤵
  PID:6660
- C:\Windows\System\NIjPlSn.exe
  C:\Windows\System\NIjPlSn.exe
  2⤵
  PID:6700
- C:\Windows\System\KCSubSp.exe
  C:\Windows\System\KCSubSp.exe
  2⤵
  PID:6720
- C:\Windows\System\isvncUk.exe
  C:\Windows\System\isvncUk.exe
  2⤵
  PID:6748
- C:\Windows\System\EXcKHrN.exe
  C:\Windows\System\EXcKHrN.exe
  2⤵
  PID:6792
- C:\Windows\System\AlPlExr.exe
  C:\Windows\System\AlPlExr.exe
  2⤵
  PID:6816
- C:\Windows\System\HyZdpCR.exe
  C:\Windows\System\HyZdpCR.exe
  2⤵
  PID:6840
- C:\Windows\System\mzomigx.exe
  C:\Windows\System\mzomigx.exe
  2⤵
  PID:6868
- C:\Windows\System\UaHUxfn.exe
  C:\Windows\System\UaHUxfn.exe
  2⤵
  PID:6896
- C:\Windows\System\rnvBuGx.exe
  C:\Windows\System\rnvBuGx.exe
  2⤵
  PID:6924
- C:\Windows\System\gfkbWhD.exe
  C:\Windows\System\gfkbWhD.exe
  2⤵
  PID:6940
- C:\Windows\System\PTiMtRz.exe
  C:\Windows\System\PTiMtRz.exe
  2⤵
  PID:6960
- C:\Windows\System\RRPsOUQ.exe
  C:\Windows\System\RRPsOUQ.exe
  2⤵
  PID:6984
- C:\Windows\System\XoEvhtP.exe
  C:\Windows\System\XoEvhtP.exe
  2⤵
  PID:7012
- C:\Windows\System\emUtPgL.exe
  C:\Windows\System\emUtPgL.exe
  2⤵
  PID:7040
- C:\Windows\System\xpbOQSy.exe
  C:\Windows\System\xpbOQSy.exe
  2⤵
  PID:7060
- C:\Windows\System\uvtBdpS.exe
  C:\Windows\System\uvtBdpS.exe
  2⤵
  PID:7088
- C:\Windows\System\BiXylem.exe
  C:\Windows\System\BiXylem.exe
  2⤵
  PID:7120
- C:\Windows\System\cMqcwVJ.exe
  C:\Windows\System\cMqcwVJ.exe
  2⤵
  PID:5380
- C:\Windows\System\VjpfuEv.exe
  C:\Windows\System\VjpfuEv.exe
  2⤵
  PID:6180
- C:\Windows\System\VDtnHXD.exe
  C:\Windows\System\VDtnHXD.exe
  2⤵
  PID:6284
- C:\Windows\System\iHqQQfY.exe
  C:\Windows\System\iHqQQfY.exe
  2⤵
  PID:6312
- C:\Windows\System\WukfEDV.exe
  C:\Windows\System\WukfEDV.exe
  2⤵
  PID:6408
- C:\Windows\System\ZoXSuZx.exe
  C:\Windows\System\ZoXSuZx.exe
  2⤵
  PID:6500
- C:\Windows\System\tLkhYZY.exe
  C:\Windows\System\tLkhYZY.exe
  2⤵
  PID:6492
- C:\Windows\System\uwsREhY.exe
  C:\Windows\System\uwsREhY.exe
  2⤵
  PID:6564
- C:\Windows\System\QpyXuKW.exe
  C:\Windows\System\QpyXuKW.exe
  2⤵
  PID:6632
- C:\Windows\System\gdxGtah.exe
  C:\Windows\System\gdxGtah.exe
  2⤵
  PID:6688
- C:\Windows\System\HWzNBmm.exe
  C:\Windows\System\HWzNBmm.exe
  2⤵
  PID:6836
- C:\Windows\System\gcINywL.exe
  C:\Windows\System\gcINywL.exe
  2⤵
  PID:6860
- C:\Windows\System\YuXKAUF.exe
  C:\Windows\System\YuXKAUF.exe
  2⤵
  PID:6908
- C:\Windows\System\VMUJTct.exe
  C:\Windows\System\VMUJTct.exe
  2⤵
  PID:6980
- C:\Windows\System\rPDZqrX.exe
  C:\Windows\System\rPDZqrX.exe
  2⤵
  PID:7076
- C:\Windows\System\TywZGfn.exe
  C:\Windows\System\TywZGfn.exe
  2⤵
  PID:7160
- C:\Windows\System\cjkSzoD.exe
  C:\Windows\System\cjkSzoD.exe
  2⤵
  PID:6176
- C:\Windows\System\hkipCDp.exe
  C:\Windows\System\hkipCDp.exe
  2⤵
  PID:6280
- C:\Windows\System\kUxYORs.exe
  C:\Windows\System\kUxYORs.exe
  2⤵
  PID:6420
- C:\Windows\System\ORciLha.exe
  C:\Windows\System\ORciLha.exe
  2⤵
  PID:6588
- C:\Windows\System\vuwGAbN.exe
  C:\Windows\System\vuwGAbN.exe
  2⤵
  PID:6776
- C:\Windows\System\upzPldG.exe
  C:\Windows\System\upzPldG.exe
  2⤵
  PID:6972
- C:\Windows\System\ExqxBBz.exe
  C:\Windows\System\ExqxBBz.exe
  2⤵
  PID:7048
- C:\Windows\System\rDOJmpt.exe
  C:\Windows\System\rDOJmpt.exe
  2⤵
  PID:6268
- C:\Windows\System\pNmWFLb.exe
  C:\Windows\System\pNmWFLb.exe
  2⤵
  PID:6800
- C:\Windows\System\SoJfmQk.exe
  C:\Windows\System\SoJfmQk.exe
  2⤵
  PID:7112
- C:\Windows\System\ZXFTuAO.exe
  C:\Windows\System\ZXFTuAO.exe
  2⤵
  PID:6468
- C:\Windows\System\xFHevtI.exe
  C:\Windows\System\xFHevtI.exe
  2⤵
  PID:7172
- C:\Windows\System\oakekkM.exe
  C:\Windows\System\oakekkM.exe
  2⤵
  PID:7200
- C:\Windows\System\TWSnfDZ.exe
  C:\Windows\System\TWSnfDZ.exe
  2⤵
  PID:7228
- C:\Windows\System\KtVIwgP.exe
  C:\Windows\System\KtVIwgP.exe
  2⤵
  PID:7248
- C:\Windows\System\VeDwiDR.exe
  C:\Windows\System\VeDwiDR.exe
  2⤵
  PID:7284
- C:\Windows\System\yBdKCwA.exe
  C:\Windows\System\yBdKCwA.exe
  2⤵
  PID:7308
- C:\Windows\System\uKlEUbZ.exe
  C:\Windows\System\uKlEUbZ.exe
  2⤵
  PID:7328
- C:\Windows\System\WsNGmZp.exe
  C:\Windows\System\WsNGmZp.exe
  2⤵
  PID:7360
- C:\Windows\System\eiEPHzj.exe
  C:\Windows\System\eiEPHzj.exe
  2⤵
  PID:7396
- C:\Windows\System\fOLUSlS.exe
  C:\Windows\System\fOLUSlS.exe
  2⤵
  PID:7424
- C:\Windows\System\qPrSokU.exe
  C:\Windows\System\qPrSokU.exe
  2⤵
  PID:7440
- C:\Windows\System\RJzRDTf.exe
  C:\Windows\System\RJzRDTf.exe
  2⤵
  PID:7472
- C:\Windows\System\IoGIpuv.exe
  C:\Windows\System\IoGIpuv.exe
  2⤵
  PID:7492
- C:\Windows\System\AcdxTXn.exe
  C:\Windows\System\AcdxTXn.exe
  2⤵
  PID:7516
- C:\Windows\System\wHgVBSu.exe
  C:\Windows\System\wHgVBSu.exe
  2⤵
  PID:7556
- C:\Windows\System\voOVzjk.exe
  C:\Windows\System\voOVzjk.exe
  2⤵
  PID:7584
- C:\Windows\System\zcjjTdb.exe
  C:\Windows\System\zcjjTdb.exe
  2⤵
  PID:7608
- C:\Windows\System\GKYblQI.exe
  C:\Windows\System\GKYblQI.exe
  2⤵
  PID:7636
- C:\Windows\System\DeJMyez.exe
  C:\Windows\System\DeJMyez.exe
  2⤵
  PID:7668
- C:\Windows\System\wajRpVg.exe
  C:\Windows\System\wajRpVg.exe
  2⤵
  PID:7704
- C:\Windows\System\ilssAwK.exe
  C:\Windows\System\ilssAwK.exe
  2⤵
  PID:7720
- C:\Windows\System\KIPQiPR.exe
  C:\Windows\System\KIPQiPR.exe
  2⤵
  PID:7752
- C:\Windows\System\PAikkBm.exe
  C:\Windows\System\PAikkBm.exe
  2⤵
  PID:7776
- C:\Windows\System\oFEBZCF.exe
  C:\Windows\System\oFEBZCF.exe
  2⤵
  PID:7804
- C:\Windows\System\OTYtsKY.exe
  C:\Windows\System\OTYtsKY.exe
  2⤵
  PID:7828
- C:\Windows\System\ZdWaUmV.exe
  C:\Windows\System\ZdWaUmV.exe
  2⤵
  PID:7860
- C:\Windows\System\HDwcVIe.exe
  C:\Windows\System\HDwcVIe.exe
  2⤵
  PID:7888
- C:\Windows\System\BkpFUMC.exe
  C:\Windows\System\BkpFUMC.exe
  2⤵
  PID:7904
- C:\Windows\System\JbFcdMB.exe
  C:\Windows\System\JbFcdMB.exe
  2⤵
  PID:7944
- C:\Windows\System\soYPbSf.exe
  C:\Windows\System\soYPbSf.exe
  2⤵
  PID:7972
- C:\Windows\System\mIHJFNE.exe
  C:\Windows\System\mIHJFNE.exe
  2⤵
  PID:8000
- C:\Windows\System\yOuGHfm.exe
  C:\Windows\System\yOuGHfm.exe
  2⤵
  PID:8024
- C:\Windows\System\JMyQcOd.exe
  C:\Windows\System\JMyQcOd.exe
  2⤵
  PID:8044
- C:\Windows\System\woiSZwA.exe
  C:\Windows\System\woiSZwA.exe
  2⤵
  PID:8068
- C:\Windows\System\SnaLOGu.exe
  C:\Windows\System\SnaLOGu.exe
  2⤵
  PID:8100
- C:\Windows\System\FqKCfBw.exe
  C:\Windows\System\FqKCfBw.exe
  2⤵
  PID:8128
- C:\Windows\System\sRMpLQd.exe
  C:\Windows\System\sRMpLQd.exe
  2⤵
  PID:8180
- C:\Windows\System\tPCHdVR.exe
  C:\Windows\System\tPCHdVR.exe
  2⤵
  PID:7072
- C:\Windows\System\sSuXzfS.exe
  C:\Windows\System\sSuXzfS.exe
  2⤵
  PID:7236
- C:\Windows\System\qyjLzAG.exe
  C:\Windows\System\qyjLzAG.exe
  2⤵
  PID:7276
- C:\Windows\System\ZwaXqiQ.exe
  C:\Windows\System\ZwaXqiQ.exe
  2⤵
  PID:7388
- C:\Windows\System\EErGxDf.exe
  C:\Windows\System\EErGxDf.exe
  2⤵
  PID:7412
- C:\Windows\System\afwYSMA.exe
  C:\Windows\System\afwYSMA.exe
  2⤵
  PID:7540
- C:\Windows\System\llLGyMo.exe
  C:\Windows\System\llLGyMo.exe
  2⤵
  PID:7564
- C:\Windows\System\DPVLeUV.exe
  C:\Windows\System\DPVLeUV.exe
  2⤵
  PID:7620
- C:\Windows\System\VDcswSl.exe
  C:\Windows\System\VDcswSl.exe
  2⤵
  PID:7676
- C:\Windows\System\wRAhymR.exe
  C:\Windows\System\wRAhymR.exe
  2⤵
  PID:7768
- C:\Windows\System\rRlxENw.exe
  C:\Windows\System\rRlxENw.exe
  2⤵
  PID:7788
- C:\Windows\System\JsSeIsV.exe
  C:\Windows\System\JsSeIsV.exe
  2⤵
  PID:7876
- C:\Windows\System\GROZWbT.exe
  C:\Windows\System\GROZWbT.exe
  2⤵
  PID:7900
- C:\Windows\System\ulSZNtq.exe
  C:\Windows\System\ulSZNtq.exe
  2⤵
  PID:8036
- C:\Windows\System\VbZgVzj.exe
  C:\Windows\System\VbZgVzj.exe
  2⤵
  PID:8032
- C:\Windows\System\WdKnYMT.exe
  C:\Windows\System\WdKnYMT.exe
  2⤵
  PID:8148
- C:\Windows\System\uiaNJPh.exe
  C:\Windows\System\uiaNJPh.exe
  2⤵
  PID:7212
- C:\Windows\System\EkxaItw.exe
  C:\Windows\System\EkxaItw.exe
  2⤵
  PID:7436
- C:\Windows\System\FiLOZIr.exe
  C:\Windows\System\FiLOZIr.exe
  2⤵
  PID:7484
- C:\Windows\System\GDBzqUL.exe
  C:\Windows\System\GDBzqUL.exe
  2⤵
  PID:7716
- C:\Windows\System\ozXqPyY.exe
  C:\Windows\System\ozXqPyY.exe
  2⤵
  PID:7852
- C:\Windows\System\yBDXkXF.exe
  C:\Windows\System\yBDXkXF.exe
  2⤵
  PID:8012
- C:\Windows\System\QdrFUNJ.exe
  C:\Windows\System\QdrFUNJ.exe
  2⤵
  PID:8176
- C:\Windows\System\iiakXvF.exe
  C:\Windows\System\iiakXvF.exe
  2⤵
  PID:7384
- C:\Windows\System\JdFOMcb.exe
  C:\Windows\System\JdFOMcb.exe
  2⤵
  PID:7592
- C:\Windows\System\kADGKXs.exe
  C:\Windows\System\kADGKXs.exe
  2⤵
  PID:8144
- C:\Windows\System\diAHapi.exe
  C:\Windows\System\diAHapi.exe
  2⤵
  PID:7416
- C:\Windows\System\zSrhTJR.exe
  C:\Windows\System\zSrhTJR.exe
  2⤵
  PID:7984
- C:\Windows\System\QPeFIgu.exe
  C:\Windows\System\QPeFIgu.exe
  2⤵
  PID:8220
- C:\Windows\System\lgvDSkt.exe
  C:\Windows\System\lgvDSkt.exe
  2⤵
  PID:8252
- C:\Windows\System\jMWFWtu.exe
  C:\Windows\System\jMWFWtu.exe
  2⤵
  PID:8292
- C:\Windows\System\OaAgDzG.exe
  C:\Windows\System\OaAgDzG.exe
  2⤵
  PID:8320
- C:\Windows\System\WViWSKS.exe
  C:\Windows\System\WViWSKS.exe
  2⤵
  PID:8340
- C:\Windows\System\eAiNwHY.exe
  C:\Windows\System\eAiNwHY.exe
  2⤵
  PID:8360
- C:\Windows\System\peNZDHH.exe
  C:\Windows\System\peNZDHH.exe
  2⤵
  PID:8412
- C:\Windows\System\HiffwDU.exe
  C:\Windows\System\HiffwDU.exe
  2⤵
  PID:8440
- C:\Windows\System\lWUarJK.exe
  C:\Windows\System\lWUarJK.exe
  2⤵
  PID:8456
- C:\Windows\System\WfwpEAw.exe
  C:\Windows\System\WfwpEAw.exe
  2⤵
  PID:8476
- C:\Windows\System\AVrhhpa.exe
  C:\Windows\System\AVrhhpa.exe
  2⤵
  PID:8508
- C:\Windows\System\aJWKRJI.exe
  C:\Windows\System\aJWKRJI.exe
  2⤵
  PID:8540
- C:\Windows\System\JhGyLTZ.exe
  C:\Windows\System\JhGyLTZ.exe
  2⤵
  PID:8572
- C:\Windows\System\MUdqbaZ.exe
  C:\Windows\System\MUdqbaZ.exe
  2⤵
  PID:8608
- C:\Windows\System\NsUHFgl.exe
  C:\Windows\System\NsUHFgl.exe
  2⤵
  PID:8636
- C:\Windows\System\MlzKuHI.exe
  C:\Windows\System\MlzKuHI.exe
  2⤵
  PID:8660
- C:\Windows\System\pwvjKQX.exe
  C:\Windows\System\pwvjKQX.exe
  2⤵
  PID:8680
- C:\Windows\System\oyHIGIU.exe
  C:\Windows\System\oyHIGIU.exe
  2⤵
  PID:8700
- C:\Windows\System\AaVUHlt.exe
  C:\Windows\System\AaVUHlt.exe
  2⤵
  PID:8732
- C:\Windows\System\jVyQyKQ.exe
  C:\Windows\System\jVyQyKQ.exe
  2⤵
  PID:8764
- C:\Windows\System\anpQPoF.exe
  C:\Windows\System\anpQPoF.exe
  2⤵
  PID:8796
- C:\Windows\System\DsLJwIb.exe
  C:\Windows\System\DsLJwIb.exe
  2⤵
  PID:8828
- C:\Windows\System\uGRDiQc.exe
  C:\Windows\System\uGRDiQc.exe
  2⤵
  PID:8848
- C:\Windows\System\aBdjhia.exe
  C:\Windows\System\aBdjhia.exe
  2⤵
  PID:8876
- C:\Windows\System\OYPFMEa.exe
  C:\Windows\System\OYPFMEa.exe
  2⤵
  PID:8900
- C:\Windows\System\pYkhAVK.exe
  C:\Windows\System\pYkhAVK.exe
  2⤵
  PID:8924
- C:\Windows\System\BhnTrPw.exe
  C:\Windows\System\BhnTrPw.exe
  2⤵
  PID:8948
- C:\Windows\System\AaUvHmM.exe
  C:\Windows\System\AaUvHmM.exe
  2⤵
  PID:8984
- C:\Windows\System\UHhjDLO.exe
  C:\Windows\System\UHhjDLO.exe
  2⤵
  PID:9012
- C:\Windows\System\IGzyxns.exe
  C:\Windows\System\IGzyxns.exe
  2⤵
  PID:9036
- C:\Windows\System\cyhgeKF.exe
  C:\Windows\System\cyhgeKF.exe
  2⤵
  PID:9072
- C:\Windows\System\bkoJohM.exe
  C:\Windows\System\bkoJohM.exe
  2⤵
  PID:9112
- C:\Windows\System\tFMJLFb.exe
  C:\Windows\System\tFMJLFb.exe
  2⤵
  PID:9128
- C:\Windows\System\pUVvnze.exe
  C:\Windows\System\pUVvnze.exe
  2⤵
  PID:9156
- C:\Windows\System\XKPtbDR.exe
  C:\Windows\System\XKPtbDR.exe
  2⤵
  PID:9188
- C:\Windows\System\juumDKM.exe
  C:\Windows\System\juumDKM.exe
  2⤵
  PID:9208
- C:\Windows\System\cUQeNaF.exe
  C:\Windows\System\cUQeNaF.exe
  2⤵
  PID:8200
- C:\Windows\System\BNDoazF.exe
  C:\Windows\System\BNDoazF.exe
  2⤵
  PID:8228
- C:\Windows\System\hgexhKE.exe
  C:\Windows\System\hgexhKE.exe
  2⤵
  PID:8352
- C:\Windows\System\rglgarB.exe
  C:\Windows\System\rglgarB.exe
  2⤵
  PID:8424
- C:\Windows\System\xtFnlFv.exe
  C:\Windows\System\xtFnlFv.exe
  2⤵
  PID:8500
- C:\Windows\System\cEmRWaq.exe
  C:\Windows\System\cEmRWaq.exe
  2⤵
  PID:8528
- C:\Windows\System\zupxMKV.exe
  C:\Windows\System\zupxMKV.exe
  2⤵
  PID:8588
- C:\Windows\System\ezJgAXh.exe
  C:\Windows\System\ezJgAXh.exe
  2⤵
  PID:8724
- C:\Windows\System\qysEaDz.exe
  C:\Windows\System\qysEaDz.exe
  2⤵
  PID:8748
- C:\Windows\System\PxftgNC.exe
  C:\Windows\System\PxftgNC.exe
  2⤵
  PID:8836
- C:\Windows\System\iWEsWAm.exe
  C:\Windows\System\iWEsWAm.exe
  2⤵
  PID:8896
- C:\Windows\System\BEsofiF.exe
  C:\Windows\System\BEsofiF.exe
  2⤵
  PID:8940
- C:\Windows\System\rTJFtwI.exe
  C:\Windows\System\rTJFtwI.exe
  2⤵
  PID:9000
- C:\Windows\System\QkaYRDG.exe
  C:\Windows\System\QkaYRDG.exe
  2⤵
  PID:9068
- C:\Windows\System\HTbztkx.exe
  C:\Windows\System\HTbztkx.exe
  2⤵
  PID:9108
- C:\Windows\System\iNRptYA.exe
  C:\Windows\System\iNRptYA.exe
  2⤵
  PID:9124
- C:\Windows\System\djJmhiX.exe
  C:\Windows\System\djJmhiX.exe
  2⤵
  PID:9196
- C:\Windows\System\FYWNDpe.exe
  C:\Windows\System\FYWNDpe.exe
  2⤵
  PID:8216
- C:\Windows\System\bpHHneC.exe
  C:\Windows\System\bpHHneC.exe
  2⤵
  PID:8648
- C:\Windows\System\LEedWVG.exe
  C:\Windows\System\LEedWVG.exe
  2⤵
  PID:8840
- C:\Windows\System\UduDPzY.exe
  C:\Windows\System\UduDPzY.exe
  2⤵
  PID:8860
- C:\Windows\System\ycMdpdf.exe
  C:\Windows\System\ycMdpdf.exe
  2⤵
  PID:9100
- C:\Windows\System\HYWikDd.exe
  C:\Windows\System\HYWikDd.exe
  2⤵
  PID:9168
- C:\Windows\System\FfofCVA.exe
  C:\Windows\System\FfofCVA.exe
  2⤵
  PID:8212
- C:\Windows\System\KbxdZKi.exe
  C:\Windows\System\KbxdZKi.exe
  2⤵
  PID:9096
- C:\Windows\System\JnuGrAW.exe
  C:\Windows\System\JnuGrAW.exe
  2⤵
  PID:9204
- C:\Windows\System\oSRxkCa.exe
  C:\Windows\System\oSRxkCa.exe
  2⤵
  PID:9228
- C:\Windows\System\wIntkvP.exe
  C:\Windows\System\wIntkvP.exe
  2⤵
  PID:9260
- C:\Windows\System\WZooAiK.exe
  C:\Windows\System\WZooAiK.exe
  2⤵
  PID:9276
- C:\Windows\System\kEhzAMF.exe
  C:\Windows\System\kEhzAMF.exe
  2⤵
  PID:9308
- C:\Windows\System\OPDELsP.exe
  C:\Windows\System\OPDELsP.exe
  2⤵
  PID:9344
- C:\Windows\System\UsPXTLv.exe
  C:\Windows\System\UsPXTLv.exe
  2⤵
  PID:9384
- C:\Windows\System\TsVOBJU.exe
  C:\Windows\System\TsVOBJU.exe
  2⤵
  PID:9404
- C:\Windows\System\hnKmwgd.exe
  C:\Windows\System\hnKmwgd.exe
  2⤵
  PID:9428
- C:\Windows\System\vOPzDtc.exe
  C:\Windows\System\vOPzDtc.exe
  2⤵
  PID:9448
- C:\Windows\System\PDTpyim.exe
  C:\Windows\System\PDTpyim.exe
  2⤵
  PID:9464
- C:\Windows\System\lRAdIyJ.exe
  C:\Windows\System\lRAdIyJ.exe
  2⤵
  PID:9484
- C:\Windows\System\eZMjzht.exe
  C:\Windows\System\eZMjzht.exe
  2⤵
  PID:9520
- C:\Windows\System\iAHiUqa.exe
  C:\Windows\System\iAHiUqa.exe
  2⤵
  PID:9544
- C:\Windows\System\BVliUMk.exe
  C:\Windows\System\BVliUMk.exe
  2⤵
  PID:9568
- C:\Windows\System\HTpKKUP.exe
  C:\Windows\System\HTpKKUP.exe
  2⤵
  PID:9596
- C:\Windows\System\uWJRpbB.exe
  C:\Windows\System\uWJRpbB.exe
  2⤵
  PID:9628
- C:\Windows\System\XaELqVV.exe
  C:\Windows\System\XaELqVV.exe
  2⤵
  PID:9656
- C:\Windows\System\rnmLtQH.exe
  C:\Windows\System\rnmLtQH.exe
  2⤵
  PID:9688
- C:\Windows\System\nHGzLeY.exe
  C:\Windows\System\nHGzLeY.exe
  2⤵
  PID:9712
- C:\Windows\System\asuyIeQ.exe
  C:\Windows\System\asuyIeQ.exe
  2⤵
  PID:9732
- C:\Windows\System\byCEFUf.exe
  C:\Windows\System\byCEFUf.exe
  2⤵
  PID:9772
- C:\Windows\System\xXWrWFL.exe
  C:\Windows\System\xXWrWFL.exe
  2⤵
  PID:9808
- C:\Windows\System\XmqoXdF.exe
  C:\Windows\System\XmqoXdF.exe
  2⤵
  PID:9832
- C:\Windows\System\CERstVJ.exe
  C:\Windows\System\CERstVJ.exe
  2⤵
  PID:9888
- C:\Windows\System\UprUdbn.exe
  C:\Windows\System\UprUdbn.exe
  2⤵
  PID:9916
- C:\Windows\System\BudljMV.exe
  C:\Windows\System\BudljMV.exe
  2⤵
  PID:9932
- C:\Windows\System\NkEAUcd.exe
  C:\Windows\System\NkEAUcd.exe
  2⤵
  PID:9948
- C:\Windows\System\EAHmBJi.exe
  C:\Windows\System\EAHmBJi.exe
  2⤵
  PID:9972
- C:\Windows\System\PntDHYT.exe
  C:\Windows\System\PntDHYT.exe
  2⤵
  PID:9996
- C:\Windows\System\oaYEfsv.exe
  C:\Windows\System\oaYEfsv.exe
  2⤵
  PID:10020
- C:\Windows\System\VwEGhMp.exe
  C:\Windows\System\VwEGhMp.exe
  2⤵
  PID:10048
- C:\Windows\System\RIrlajd.exe
  C:\Windows\System\RIrlajd.exe
  2⤵
  PID:10072
- C:\Windows\System\OrzYIwu.exe
  C:\Windows\System\OrzYIwu.exe
  2⤵
  PID:10100
- C:\Windows\System\bwVEFzR.exe
  C:\Windows\System\bwVEFzR.exe
  2⤵
  PID:10136
- C:\Windows\System\NbKVPUT.exe
  C:\Windows\System\NbKVPUT.exe
  2⤵
  PID:10168
- C:\Windows\System\sXXHHkd.exe
  C:\Windows\System\sXXHHkd.exe
  2⤵
  PID:10192
- C:\Windows\System\TtnoDQi.exe
  C:\Windows\System\TtnoDQi.exe
  2⤵
  PID:10216
- C:\Windows\System\QtRvStu.exe
  C:\Windows\System\QtRvStu.exe
  2⤵
  PID:9148
- C:\Windows\System\TMEzLXV.exe
  C:\Windows\System\TMEzLXV.exe
  2⤵
  PID:9272
- C:\Windows\System\FkcmJeP.exe
  C:\Windows\System\FkcmJeP.exe
  2⤵
  PID:9328
- C:\Windows\System\ILLHund.exe
  C:\Windows\System\ILLHund.exe
  2⤵
  PID:9400
- C:\Windows\System\ItgyGHY.exe
  C:\Windows\System\ItgyGHY.exe
  2⤵
  PID:9436
- C:\Windows\System\ZKMdniQ.exe
  C:\Windows\System\ZKMdniQ.exe
  2⤵
  PID:9580
- C:\Windows\System\fUuBHUA.exe
  C:\Windows\System\fUuBHUA.exe
  2⤵
  PID:9612
- C:\Windows\System\QkShzmN.exe
  C:\Windows\System\QkShzmN.exe
  2⤵
  PID:9672
- C:\Windows\System\ISOxYaJ.exe
  C:\Windows\System\ISOxYaJ.exe
  2⤵
  PID:9700
- C:\Windows\System\NgGoGjd.exe
  C:\Windows\System\NgGoGjd.exe
  2⤵
  PID:9756
- C:\Windows\System\cgBKaCi.exe
  C:\Windows\System\cgBKaCi.exe
  2⤵
  PID:9828
- C:\Windows\System\PZxWWfs.exe
  C:\Windows\System\PZxWWfs.exe
  2⤵
  PID:9924
- C:\Windows\System\sctHTmO.exe
  C:\Windows\System\sctHTmO.exe
  2⤵
  PID:9988
- C:\Windows\System\qeXSsjJ.exe
  C:\Windows\System\qeXSsjJ.exe
  2⤵
  PID:10060
- C:\Windows\System\SpAWNNO.exe
  C:\Windows\System\SpAWNNO.exe
  2⤵
  PID:10124
- C:\Windows\System\jgosRsc.exe
  C:\Windows\System\jgosRsc.exe
  2⤵
  PID:10144
- C:\Windows\System\uUSRtco.exe
  C:\Windows\System\uUSRtco.exe
  2⤵
  PID:8652
- C:\Windows\System\YqGQUxA.exe
  C:\Windows\System\YqGQUxA.exe
  2⤵
  PID:9296
- C:\Windows\System\NMkcyvo.exe
  C:\Windows\System\NMkcyvo.exe
  2⤵
  PID:9516
- C:\Windows\System\hnYggRh.exe
  C:\Windows\System\hnYggRh.exe
  2⤵
  PID:9652
- C:\Windows\System\QaywWAb.exe
  C:\Windows\System\QaywWAb.exe
  2⤵
  PID:9904
- C:\Windows\System\zKUVvmG.exe
  C:\Windows\System\zKUVvmG.exe
  2⤵
  PID:10068
- C:\Windows\System\PxkXSIt.exe
  C:\Windows\System\PxkXSIt.exe
  2⤵
  PID:10096
- C:\Windows\System\VcOgwrj.exe
  C:\Windows\System\VcOgwrj.exe
  2⤵
  PID:8864
- C:\Windows\System\xmocEPT.exe
  C:\Windows\System\xmocEPT.exe
  2⤵
  PID:9560
- C:\Windows\System\jjTQVbM.exe
  C:\Windows\System\jjTQVbM.exe
  2⤵
  PID:10180
- C:\Windows\System\RHkTIjm.exe
  C:\Windows\System\RHkTIjm.exe
  2⤵
  PID:8484
- C:\Windows\System\RdPTuWW.exe
  C:\Windows\System\RdPTuWW.exe
  2⤵
  PID:9912
- C:\Windows\System\nurPIwr.exe
  C:\Windows\System\nurPIwr.exe
  2⤵
  PID:10260
- C:\Windows\System\LbFgiHX.exe
  C:\Windows\System\LbFgiHX.exe
  2⤵
  PID:10296
- C:\Windows\System\nhamBZs.exe
  C:\Windows\System\nhamBZs.exe
  2⤵
  PID:10316
- C:\Windows\System\gzXoaWO.exe
  C:\Windows\System\gzXoaWO.exe
  2⤵
  PID:10340
- C:\Windows\System\WVzipkT.exe
  C:\Windows\System\WVzipkT.exe
  2⤵
  PID:10368
- C:\Windows\System\sNCxzwd.exe
  C:\Windows\System\sNCxzwd.exe
  2⤵
  PID:10400
- C:\Windows\System\CPPFOoX.exe
  C:\Windows\System\CPPFOoX.exe
  2⤵
  PID:10420
- C:\Windows\System\jNbxhyG.exe
  C:\Windows\System\jNbxhyG.exe
  2⤵
  PID:10456
- C:\Windows\System\VAWboSu.exe
  C:\Windows\System\VAWboSu.exe
  2⤵
  PID:10492
- C:\Windows\System\UloxKdl.exe
  C:\Windows\System\UloxKdl.exe
  2⤵
  PID:10516
- C:\Windows\System\vFsZLdI.exe
  C:\Windows\System\vFsZLdI.exe
  2⤵
  PID:10552
- C:\Windows\System\WkOZrJw.exe
  C:\Windows\System\WkOZrJw.exe
  2⤵
  PID:10572
- C:\Windows\System\ojgKZjs.exe
  C:\Windows\System\ojgKZjs.exe
  2⤵
  PID:10608
- C:\Windows\System\OAtFfoh.exe
  C:\Windows\System\OAtFfoh.exe
  2⤵
  PID:10624
- C:\Windows\System\SwNBPHU.exe
  C:\Windows\System\SwNBPHU.exe
  2⤵
  PID:10648
- C:\Windows\System\CKibumk.exe
  C:\Windows\System\CKibumk.exe
  2⤵
  PID:10680
- C:\Windows\System\NmBRZzT.exe
  C:\Windows\System\NmBRZzT.exe
  2⤵
  PID:10720
- C:\Windows\System\YtQtwaf.exe
  C:\Windows\System\YtQtwaf.exe
  2⤵
  PID:10736
- C:\Windows\System\YwiQIXs.exe
  C:\Windows\System\YwiQIXs.exe
  2⤵
  PID:10764
- C:\Windows\System\YjLmvBX.exe
  C:\Windows\System\YjLmvBX.exe
  2⤵
  PID:10804
- C:\Windows\System\MqUppzU.exe
  C:\Windows\System\MqUppzU.exe
  2⤵
  PID:10832
- C:\Windows\System\sCsyZmw.exe
  C:\Windows\System\sCsyZmw.exe
  2⤵
  PID:10852
- C:\Windows\System\DwSAOQM.exe
  C:\Windows\System\DwSAOQM.exe
  2⤵
  PID:10876
- C:\Windows\System\aFfILhJ.exe
  C:\Windows\System\aFfILhJ.exe
  2⤵
  PID:10904
- C:\Windows\System\vEtZaki.exe
  C:\Windows\System\vEtZaki.exe
  2⤵
  PID:10920
- C:\Windows\System\yPvMByZ.exe
  C:\Windows\System\yPvMByZ.exe
  2⤵
  PID:10952
- C:\Windows\System\PyjVYSG.exe
  C:\Windows\System\PyjVYSG.exe
  2⤵
  PID:10980
- C:\Windows\System\EIiAvzf.exe
  C:\Windows\System\EIiAvzf.exe
  2⤵
  PID:11000
- C:\Windows\System\wAeJHOG.exe
  C:\Windows\System\wAeJHOG.exe
  2⤵
  PID:11028
- C:\Windows\System\LrVPuCX.exe
  C:\Windows\System\LrVPuCX.exe
  2⤵
  PID:11052
- C:\Windows\System\saDtwpb.exe
  C:\Windows\System\saDtwpb.exe
  2⤵
  PID:11076
- C:\Windows\System\hvWfFQA.exe
  C:\Windows\System\hvWfFQA.exe
  2⤵
  PID:11100
- C:\Windows\System\RYTIujk.exe
  C:\Windows\System\RYTIujk.exe
  2⤵
  PID:11128
- C:\Windows\System\TYXWiWt.exe
  C:\Windows\System\TYXWiWt.exe
  2⤵
  PID:11160
- C:\Windows\System\vcOVhBU.exe
  C:\Windows\System\vcOVhBU.exe
  2⤵
  PID:11180
- C:\Windows\System\ChPFQea.exe
  C:\Windows\System\ChPFQea.exe
  2⤵
  PID:11204
- C:\Windows\System\QXOXQLY.exe
  C:\Windows\System\QXOXQLY.exe
  2⤵
  PID:11232
- C:\Windows\System\SqCDtsw.exe
  C:\Windows\System\SqCDtsw.exe
  2⤵
  PID:11260
- C:\Windows\System\UngqwXC.exe
  C:\Windows\System\UngqwXC.exe
  2⤵
  PID:10272
- C:\Windows\System\MkqEOti.exe
  C:\Windows\System\MkqEOti.exe
  2⤵
  PID:10356
- C:\Windows\System\sqflKER.exe
  C:\Windows\System\sqflKER.exe
  2⤵
  PID:10388
- C:\Windows\System\vwmvdsT.exe
  C:\Windows\System\vwmvdsT.exe
  2⤵
  PID:10560
- C:\Windows\System\KJLUrbO.exe
  C:\Windows\System\KJLUrbO.exe
  2⤵
  PID:10620
- C:\Windows\System\MFLODAG.exe
  C:\Windows\System\MFLODAG.exe
  2⤵
  PID:10696
- C:\Windows\System\EnooHyM.exe
  C:\Windows\System\EnooHyM.exe
  2⤵
  PID:10748
- C:\Windows\System\MMJCRna.exe
  C:\Windows\System\MMJCRna.exe
  2⤵
  PID:10828
- C:\Windows\System\UczsNIb.exe
  C:\Windows\System\UczsNIb.exe
  2⤵
  PID:10932
- C:\Windows\System\gqvXOqN.exe
  C:\Windows\System\gqvXOqN.exe
  2⤵
  PID:10940
- C:\Windows\System\VoaYAcp.exe
  C:\Windows\System\VoaYAcp.exe
  2⤵
  PID:10996
- C:\Windows\System\olZUAwd.exe
  C:\Windows\System\olZUAwd.exe
  2⤵
  PID:11124
- C:\Windows\System\UZkvzuq.exe
  C:\Windows\System\UZkvzuq.exe
  2⤵
  PID:11168
- C:\Windows\System\KMdWGaV.exe
  C:\Windows\System\KMdWGaV.exe
  2⤵
  PID:11244
- C:\Windows\System\jZllHBw.exe
  C:\Windows\System\jZllHBw.exe
  2⤵
  PID:11196
- C:\Windows\System\kIJIqMJ.exe
  C:\Windows\System\kIJIqMJ.exe
  2⤵
  PID:10328
- C:\Windows\System\ToppRMl.exe
  C:\Windows\System\ToppRMl.exe
  2⤵
  PID:10544
- C:\Windows\System\UXXQjcT.exe
  C:\Windows\System\UXXQjcT.exe
  2⤵
  PID:10668
- C:\Windows\System\jgGwzFd.exe
  C:\Windows\System\jgGwzFd.exe
  2⤵
  PID:10888
- C:\Windows\System\MMqIdXN.exe
  C:\Windows\System\MMqIdXN.exe
  2⤵
  PID:11096
- C:\Windows\System\ZcJcJrG.exe
  C:\Windows\System\ZcJcJrG.exe
  2⤵
  PID:11148
- C:\Windows\System\lUZrAtP.exe
  C:\Windows\System\lUZrAtP.exe
  2⤵
  PID:10308
- C:\Windows\System\ikhQgqt.exe
  C:\Windows\System\ikhQgqt.exe
  2⤵
  PID:10780
- C:\Windows\System\xJjBTMv.exe
  C:\Windows\System\xJjBTMv.exe
  2⤵
  PID:11156
- C:\Windows\System\YrySSZQ.exe
  C:\Windows\System\YrySSZQ.exe
  2⤵
  PID:10716
- C:\Windows\System\WevkZkZ.exe
  C:\Windows\System\WevkZkZ.exe
  2⤵
  PID:10416
- C:\Windows\System\htZBWXk.exe
  C:\Windows\System\htZBWXk.exe
  2⤵
  PID:11280
- C:\Windows\System\rcOOMxF.exe
  C:\Windows\System\rcOOMxF.exe
  2⤵
  PID:11308
- C:\Windows\System\HdjIVSy.exe
  C:\Windows\System\HdjIVSy.exe
  2⤵
  PID:11332
- C:\Windows\System\IuXFdJG.exe
  C:\Windows\System\IuXFdJG.exe
  2⤵
  PID:11388
- C:\Windows\System\FTlfGYi.exe
  C:\Windows\System\FTlfGYi.exe
  2⤵
  PID:11404
- C:\Windows\System\izMXgvG.exe
  C:\Windows\System\izMXgvG.exe
  2⤵
  PID:11432
- C:\Windows\System\XSLVwGL.exe
  C:\Windows\System\XSLVwGL.exe
  2⤵
  PID:11448
- C:\Windows\System\fJEdewD.exe
  C:\Windows\System\fJEdewD.exe
  2⤵
  PID:11464
- C:\Windows\System\mhNiDZL.exe
  C:\Windows\System\mhNiDZL.exe
  2⤵
  PID:11516
- C:\Windows\System\WIEjcjf.exe
  C:\Windows\System\WIEjcjf.exe
  2⤵
  PID:11540
- C:\Windows\System\NXqWraQ.exe
  C:\Windows\System\NXqWraQ.exe
  2⤵
  PID:11568
- C:\Windows\System\hwRoPOk.exe
  C:\Windows\System\hwRoPOk.exe
  2⤵
  PID:11588
- C:\Windows\System\snqedWP.exe
  C:\Windows\System\snqedWP.exe
  2⤵
  PID:11628
- C:\Windows\System\NvnbvQS.exe
  C:\Windows\System\NvnbvQS.exe
  2⤵
  PID:11652
- C:\Windows\System\tiFFSZz.exe
  C:\Windows\System\tiFFSZz.exe
  2⤵
  PID:11676
- C:\Windows\System\dlNhJPb.exe
  C:\Windows\System\dlNhJPb.exe
  2⤵
  PID:11704
- C:\Windows\System\lowYypR.exe
  C:\Windows\System\lowYypR.exe
  2⤵
  PID:11732
- C:\Windows\System\zYGkWYP.exe
  C:\Windows\System\zYGkWYP.exe
  2⤵
  PID:11756
- C:\Windows\System\nnsJDZc.exe
  C:\Windows\System\nnsJDZc.exe
  2⤵
  PID:11784
- C:\Windows\System\srwQysV.exe
  C:\Windows\System\srwQysV.exe
  2⤵
  PID:11836
- C:\Windows\System\HAnGXmq.exe
  C:\Windows\System\HAnGXmq.exe
  2⤵
  PID:11864
- C:\Windows\System\eIjczrH.exe
  C:\Windows\System\eIjczrH.exe
  2⤵
  PID:11888
- C:\Windows\System\HwnyUCq.exe
  C:\Windows\System\HwnyUCq.exe
  2⤵
  PID:11912
- C:\Windows\System\BoxrHUf.exe
  C:\Windows\System\BoxrHUf.exe
  2⤵
  PID:11936
- C:\Windows\System\IOYalCx.exe
  C:\Windows\System\IOYalCx.exe
  2⤵
  PID:11964
- C:\Windows\System\vLjyCWw.exe
  C:\Windows\System\vLjyCWw.exe
  2⤵
  PID:11992
- C:\Windows\System\PyxLnvR.exe
  C:\Windows\System\PyxLnvR.exe
  2⤵
  PID:12020
- C:\Windows\System\vGvCgdF.exe
  C:\Windows\System\vGvCgdF.exe
  2⤵
  PID:12044
- C:\Windows\System\NxGxslI.exe
  C:\Windows\System\NxGxslI.exe
  2⤵
  PID:12064
- C:\Windows\System\hAQgybS.exe
  C:\Windows\System\hAQgybS.exe
  2⤵
  PID:12088
- C:\Windows\System\OgDKDij.exe
  C:\Windows\System\OgDKDij.exe
  2⤵
  PID:12140
- C:\Windows\System\xBGCsDd.exe
  C:\Windows\System\xBGCsDd.exe
  2⤵
  PID:12160
- C:\Windows\System\ukDCwgI.exe
  C:\Windows\System\ukDCwgI.exe
  2⤵
  PID:12200
- C:\Windows\System\oigoyBY.exe
  C:\Windows\System\oigoyBY.exe
  2⤵
  PID:12220
- C:\Windows\System\byabmuv.exe
  C:\Windows\System\byabmuv.exe
  2⤵
  PID:12244
- C:\Windows\System\MsXqNOv.exe
  C:\Windows\System\MsXqNOv.exe
  2⤵
  PID:12264
- C:\Windows\System\aupKcap.exe
  C:\Windows\System\aupKcap.exe
  2⤵
  PID:11136
- C:\Windows\System\StZvoin.exe
  C:\Windows\System\StZvoin.exe
  2⤵
  PID:11320
- C:\Windows\System\SeXWsmS.exe
  C:\Windows\System\SeXWsmS.exe
  2⤵
  PID:11352
- C:\Windows\System\osmgYjD.exe
  C:\Windows\System\osmgYjD.exe
  2⤵
  PID:11396
- C:\Windows\System\uzipMQH.exe
  C:\Windows\System\uzipMQH.exe
  2⤵
  PID:11460
- C:\Windows\System\UtzzHVD.exe
  C:\Windows\System\UtzzHVD.exe
  2⤵
  PID:11524
- C:\Windows\System\zYKKCqz.exe
  C:\Windows\System\zYKKCqz.exe
  2⤵
  PID:11664
- C:\Windows\System\eDocnvw.exe
  C:\Windows\System\eDocnvw.exe
  2⤵
  PID:11748
- C:\Windows\System\MGBHAxU.exe
  C:\Windows\System\MGBHAxU.exe
  2⤵
  PID:11800
- C:\Windows\System\PhqoKQj.exe
  C:\Windows\System\PhqoKQj.exe
  2⤵
  PID:11908
- C:\Windows\System\OgUogRx.exe
  C:\Windows\System\OgUogRx.exe
  2⤵
  PID:11984
- C:\Windows\System\JKPLnNO.exe
  C:\Windows\System\JKPLnNO.exe
  2⤵
  PID:12040
- C:\Windows\System\dsjpFUK.exe
  C:\Windows\System\dsjpFUK.exe
  2⤵
  PID:12084
- C:\Windows\System\RYXQcjC.exe
  C:\Windows\System\RYXQcjC.exe
  2⤵
  PID:12132
- C:\Windows\System\gSZEfsO.exe
  C:\Windows\System\gSZEfsO.exe
  2⤵
  PID:12172
- C:\Windows\System\zJlpASf.exe
  C:\Windows\System\zJlpASf.exe
  2⤵
  PID:10476
- C:\Windows\System\UoxQouX.exe
  C:\Windows\System\UoxQouX.exe
  2⤵
  PID:12240
- C:\Windows\System\sbtTXTC.exe
  C:\Windows\System\sbtTXTC.exe
  2⤵
  PID:11424
- C:\Windows\System\pslLSaL.exe
  C:\Windows\System\pslLSaL.exe
  2⤵
  PID:11416
- C:\Windows\System\DpoXFXI.exe
  C:\Windows\System\DpoXFXI.exe
  2⤵
  PID:11620
- C:\Windows\System\BGRuQgU.exe
  C:\Windows\System\BGRuQgU.exe
  2⤵
  PID:11816
- C:\Windows\System\TtzwauO.exe
  C:\Windows\System\TtzwauO.exe
  2⤵
  PID:11980
- C:\Windows\System\zpXgSRL.exe
  C:\Windows\System\zpXgSRL.exe
  2⤵
  PID:12184
- C:\Windows\System\scYreWr.exe
  C:\Windows\System\scYreWr.exe
  2⤵
  PID:12252
- C:\Windows\System\TTXMPkH.exe
  C:\Windows\System\TTXMPkH.exe
  2⤵
  PID:11776
- C:\Windows\System\kBwhgaZ.exe
  C:\Windows\System\kBwhgaZ.exe
  2⤵
  PID:12036
- C:\Windows\System\lfbqVID.exe
  C:\Windows\System\lfbqVID.exe
  2⤵
  PID:12296
- C:\Windows\System\sNYIIRM.exe
  C:\Windows\System\sNYIIRM.exe
  2⤵
  PID:12316
- C:\Windows\System\xDMBYfj.exe
  C:\Windows\System\xDMBYfj.exe
  2⤵
  PID:12380
- C:\Windows\System\tGzoquK.exe
  C:\Windows\System\tGzoquK.exe
  2⤵
  PID:12396
- C:\Windows\System\obLZDXZ.exe
  C:\Windows\System\obLZDXZ.exe
  2⤵
  PID:12424
- C:\Windows\System\riiIgaM.exe
  C:\Windows\System\riiIgaM.exe
  2⤵
  PID:12452
- C:\Windows\System\ZQdgWNS.exe
  C:\Windows\System\ZQdgWNS.exe
  2⤵
  PID:12480
- C:\Windows\System\cooobbL.exe
  C:\Windows\System\cooobbL.exe
  2⤵
  PID:12508
- C:\Windows\System\dBaCaOg.exe
  C:\Windows\System\dBaCaOg.exe
  2⤵
  PID:12536
- C:\Windows\System\HwftlWv.exe
  C:\Windows\System\HwftlWv.exe
  2⤵
  PID:12564
- C:\Windows\System\hmXjfWH.exe
  C:\Windows\System\hmXjfWH.exe
  2⤵
  PID:12588
- C:\Windows\System\WAPdvbW.exe
  C:\Windows\System\WAPdvbW.exe
  2⤵
  PID:12608
- C:\Windows\System\zEmhRHT.exe
  C:\Windows\System\zEmhRHT.exe
  2⤵
  PID:12636
- C:\Windows\System\joYRLlm.exe
  C:\Windows\System\joYRLlm.exe
  2⤵
  PID:12652
- C:\Windows\System\AJZAUWS.exe
  C:\Windows\System\AJZAUWS.exe
  2⤵
  PID:12680
- C:\Windows\System\JEnseNf.exe
  C:\Windows\System\JEnseNf.exe
  2⤵
  PID:12712
- C:\Windows\System\zsUjuxh.exe
  C:\Windows\System\zsUjuxh.exe
  2⤵
  PID:12740
- C:\Windows\System\RJyHaYm.exe
  C:\Windows\System\RJyHaYm.exe
  2⤵
  PID:12768
- C:\Windows\System\UeLkXUo.exe
  C:\Windows\System\UeLkXUo.exe
  2⤵
  PID:12804
- C:\Windows\System\ZnIoVYR.exe
  C:\Windows\System\ZnIoVYR.exe
  2⤵
  PID:12824
- C:\Windows\System\LjIQdQD.exe
  C:\Windows\System\LjIQdQD.exe
  2⤵
  PID:12872
- C:\Windows\System\WgUAeBA.exe
  C:\Windows\System\WgUAeBA.exe
  2⤵
  PID:12892
- C:\Windows\System\zhkHnZb.exe
  C:\Windows\System\zhkHnZb.exe
  2⤵
  PID:12920
- C:\Windows\System\ZAklOsu.exe
  C:\Windows\System\ZAklOsu.exe
  2⤵
  PID:12948
- C:\Windows\System\lITsfpR.exe
  C:\Windows\System\lITsfpR.exe
  2⤵
  PID:12980
- C:\Windows\System\FhoerPU.exe
  C:\Windows\System\FhoerPU.exe
  2⤵
  PID:13004
- C:\Windows\System\TQosIbW.exe
  C:\Windows\System\TQosIbW.exe
  2⤵
  PID:13024
- C:\Windows\System\NXuFQUP.exe
  C:\Windows\System\NXuFQUP.exe
  2⤵
  PID:13048
- C:\Windows\System\QIYhfTM.exe
  C:\Windows\System\QIYhfTM.exe
  2⤵
  PID:13072
- C:\Windows\System\yQftaot.exe
  C:\Windows\System\yQftaot.exe
  2⤵
  PID:13092
- C:\Windows\System\nMIUhnG.exe
  C:\Windows\System\nMIUhnG.exe
  2⤵
  PID:13132
- C:\Windows\System\UEEcYxn.exe
  C:\Windows\System\UEEcYxn.exe
  2⤵
  PID:13156
- C:\Windows\System\qOOIZcp.exe
  C:\Windows\System\qOOIZcp.exe
  2⤵
  PID:13192
- C:\Windows\System\NRVTWaa.exe
  C:\Windows\System\NRVTWaa.exe
  2⤵
  PID:13224
- C:\Windows\System\uFAgHsG.exe
  C:\Windows\System\uFAgHsG.exe
  2⤵
  PID:13268
- C:\Windows\System\nQYDnXK.exe
  C:\Windows\System\nQYDnXK.exe
  2⤵
  PID:13284
- C:\Windows\System\AUNjNXt.exe
  C:\Windows\System\AUNjNXt.exe
  2⤵
  PID:11728
- C:\Windows\System\YQqFnFm.exe
  C:\Windows\System\YQqFnFm.exe
  2⤵
  PID:12196
- C:\Windows\System\zIFEHtb.exe
  C:\Windows\System\zIFEHtb.exe
  2⤵
  PID:12352
- C:\Windows\System\DLZiDTN.exe
  C:\Windows\System\DLZiDTN.exe
  2⤵
  PID:12436
- C:\Windows\System\KGXYxLZ.exe
  C:\Windows\System\KGXYxLZ.exe
  2⤵
  PID:12464
- C:\Windows\System\NVsEpRI.exe
  C:\Windows\System\NVsEpRI.exe
  2⤵
  PID:12520
- C:\Windows\System\bIAmNOP.exe
  C:\Windows\System\bIAmNOP.exe
  2⤵
  PID:12600
- C:\Windows\System\ArMEfwa.exe
  C:\Windows\System\ArMEfwa.exe
  2⤵
  PID:12620
- C:\Windows\System\vGfrQBQ.exe
  C:\Windows\System\vGfrQBQ.exe
  2⤵
  PID:12696
- C:\Windows\System\LxFDsSk.exe
  C:\Windows\System\LxFDsSk.exe
  2⤵
  PID:12776
- C:\Windows\System\VXfNwpi.exe
  C:\Windows\System\VXfNwpi.exe
  2⤵
  PID:12864
- C:\Windows\System\TBldOoI.exe
  C:\Windows\System\TBldOoI.exe
  2⤵
  PID:12916
- C:\Windows\System\rsdQcIW.exe
  C:\Windows\System\rsdQcIW.exe
  2⤵
  PID:12996
- C:\Windows\System\UnRqIEj.exe
  C:\Windows\System\UnRqIEj.exe
  2⤵
  PID:13020
- C:\Windows\System\nFHsSjI.exe
  C:\Windows\System\nFHsSjI.exe
  2⤵
  PID:13088
- C:\Windows\System\sjcQxsE.exe
  C:\Windows\System\sjcQxsE.exe
  2⤵
  PID:13128
- C:\Windows\System\AmHHCXh.exe
  C:\Windows\System\AmHHCXh.exe
  2⤵
  PID:13216
- C:\Windows\System\jyBtCsA.exe
  C:\Windows\System\jyBtCsA.exe
  2⤵
  PID:13280
- C:\Windows\System\eOTKIXW.exe
  C:\Windows\System\eOTKIXW.exe
  2⤵
  PID:12492
- C:\Windows\System\dpgyaaW.exe
  C:\Windows\System\dpgyaaW.exe
  2⤵
  PID:12628
- C:\Windows\System\EFRtnPL.exe
  C:\Windows\System\EFRtnPL.exe
  2⤵
  PID:12796
- C:\Windows\System\bVGJVue.exe
  C:\Windows\System\bVGJVue.exe
  2⤵
  PID:12732
- C:\Windows\System\RcEUGWu.exe
  C:\Windows\System\RcEUGWu.exe
  2⤵
  PID:13124
- C:\Windows\System\xngZRUs.exe
  C:\Windows\System\xngZRUs.exe
  2⤵
  PID:13240
- C:\Windows\System\ikLbSYY.exe
  C:\Windows\System\ikLbSYY.exe
  2⤵
  PID:12392
- C:\Windows\System\JQGRsZC.exe
  C:\Windows\System\JQGRsZC.exe
  2⤵
  PID:12812
- C:\Windows\System\VRkOJjV.exe
  C:\Windows\System\VRkOJjV.exe
  2⤵
  PID:13152
- C:\Windows\System\vIzhUfO.exe
  C:\Windows\System\vIzhUfO.exe
  2⤵
  PID:12668
- C:\Windows\System\BHgKMuP.exe
  C:\Windows\System\BHgKMuP.exe
  2⤵
  PID:12272
- C:\Windows\System\XOgvxeS.exe
  C:\Windows\System\XOgvxeS.exe
  2⤵
  PID:13344
- C:\Windows\System\IlKKDWM.exe
  C:\Windows\System\IlKKDWM.exe
  2⤵
  PID:13372
- C:\Windows\System\SsncmpI.exe
  C:\Windows\System\SsncmpI.exe
  2⤵
  PID:13388
- C:\Windows\System\pfoNYwH.exe
  C:\Windows\System\pfoNYwH.exe
  2⤵
  PID:13404
- C:\Windows\System\AOlrZuc.exe
  C:\Windows\System\AOlrZuc.exe
  2⤵
  PID:13424
- C:\Windows\System\VKacAmc.exe
  C:\Windows\System\VKacAmc.exe
  2⤵
  PID:13448
- C:\Windows\System\HvRkYev.exe
  C:\Windows\System\HvRkYev.exe
  2⤵
  PID:13468
- C:\Windows\System\jxVoxYT.exe
  C:\Windows\System\jxVoxYT.exe
  2⤵
  PID:13500
- C:\Windows\System\hIIgXwk.exe
  C:\Windows\System\hIIgXwk.exe
  2⤵
  PID:13520
- C:\Windows\System\nLZZTxP.exe
  C:\Windows\System\nLZZTxP.exe
  2⤵
  PID:13540
- C:\Windows\System\pwaFmdj.exe
  C:\Windows\System\pwaFmdj.exe
  2⤵
  PID:13572
- C:\Windows\System\KrkMaIV.exe
  C:\Windows\System\KrkMaIV.exe
  2⤵
  PID:13620
- C:\Windows\System\PMSTUml.exe
  C:\Windows\System\PMSTUml.exe
  2⤵
  PID:13648
- C:\Windows\System\tFGtBip.exe
  C:\Windows\System\tFGtBip.exe
  2⤵
  PID:13688
- C:\Windows\System\mzEdfGn.exe
  C:\Windows\System\mzEdfGn.exe
  2⤵
  PID:13712
- C:\Windows\System\kyDaPTs.exe
  C:\Windows\System\kyDaPTs.exe
  2⤵
  PID:13740
- C:\Windows\System\SEtQZaB.exe
  C:\Windows\System\SEtQZaB.exe
  2⤵
  PID:13784
- C:\Windows\System\CdxBmtS.exe
  C:\Windows\System\CdxBmtS.exe
  2⤵
  PID:13812
- C:\Windows\System\BqJVojQ.exe
  C:\Windows\System\BqJVojQ.exe
  2⤵
  PID:13840
- C:\Windows\System\jqmACOe.exe
  C:\Windows\System\jqmACOe.exe
  2⤵
  PID:13864
- C:\Windows\System\ANUgngB.exe
  C:\Windows\System\ANUgngB.exe
  2⤵
  PID:13888
- C:\Windows\System\DnjSijQ.exe
  C:\Windows\System\DnjSijQ.exe
  2⤵
  PID:13916
- C:\Windows\System\EjTVhqk.exe
  C:\Windows\System\EjTVhqk.exe
  2⤵
  PID:13944
- C:\Windows\System\mlvbKvR.exe
  C:\Windows\System\mlvbKvR.exe
  2⤵
  PID:13988
- C:\Windows\System\ONJrkmF.exe
  C:\Windows\System\ONJrkmF.exe
  2⤵
  PID:14008
- C:\Windows\System\VyGbJtE.exe
  C:\Windows\System\VyGbJtE.exe
  2⤵
  PID:14048
- C:\Windows\System\TTdlXcF.exe
  C:\Windows\System\TTdlXcF.exe
  2⤵
  PID:14064
- C:\Windows\System\FkZBTYL.exe
  C:\Windows\System\FkZBTYL.exe
  2⤵
  PID:14092
- C:\Windows\System\aiQlESP.exe
  C:\Windows\System\aiQlESP.exe
  2⤵
  PID:14120
- C:\Windows\System\lMvCICk.exe
  C:\Windows\System\lMvCICk.exe
  2⤵
  PID:14136
- C:\Windows\System\YpOEFyp.exe
  C:\Windows\System\YpOEFyp.exe
  2⤵
  PID:14168
- C:\Windows\System\pwlEJBB.exe
  C:\Windows\System\pwlEJBB.exe
  2⤵
  PID:14216
- C:\Windows\System\aLJImFe.exe
  C:\Windows\System\aLJImFe.exe
  2⤵
  PID:14244
- C:\Windows\System\MRQHiuF.exe
  C:\Windows\System\MRQHiuF.exe
  2⤵
  PID:14264
- C:\Windows\System\VvYPhXA.exe
  C:\Windows\System\VvYPhXA.exe
  2⤵
  PID:14288
- C:\Windows\System\SvdLPQm.exe
  C:\Windows\System\SvdLPQm.exe
  2⤵
  PID:14304
- C:\Windows\System\zENpOyy.exe
  C:\Windows\System\zENpOyy.exe
  2⤵
  PID:13340
- C:\Windows\System\GQIuNIX.exe
  C:\Windows\System\GQIuNIX.exe
  2⤵
  PID:13400
- C:\Windows\System\BUDIQsv.exe
  C:\Windows\System\BUDIQsv.exe
  2⤵
  PID:13436
- C:\Windows\System\ItuCLCB.exe
  C:\Windows\System\ItuCLCB.exe
  2⤵
  PID:13536
- C:\Windows\System\TBXqUjc.exe
  C:\Windows\System\TBXqUjc.exe
  2⤵
  PID:13588
- C:\Windows\System\eaukYSQ.exe
  C:\Windows\System\eaukYSQ.exe
  2⤵
  PID:13644
- C:\Windows\System\eNVjudR.exe
  C:\Windows\System\eNVjudR.exe
  2⤵
  PID:13708
- C:\Windows\System\cahMoYs.exe
  C:\Windows\System\cahMoYs.exe
  2⤵
  PID:13800
- C:\Windows\System\mkhLNKe.exe
  C:\Windows\System\mkhLNKe.exe
  2⤵
  PID:13852
- C:\Windows\System\CnSKXcR.exe
  C:\Windows\System\CnSKXcR.exe
  2⤵
  PID:13908
- C:\Windows\System\IkZtZpY.exe
  C:\Windows\System\IkZtZpY.exe
  2⤵
  PID:14004
- C:\Windows\System\PtKylSr.exe
  C:\Windows\System\PtKylSr.exe
  2⤵
  PID:14032
- C:\Windows\System\jjMhDwj.exe
  C:\Windows\System\jjMhDwj.exe
  2⤵
  PID:14084
- C:\Windows\System\MRrHFXE.exe
  C:\Windows\System\MRrHFXE.exe
  2⤵
  PID:2620
- C:\Windows\System\qGZGPEQ.exe
  C:\Windows\System\qGZGPEQ.exe
  2⤵
  PID:14164
- C:\Windows\System\wvEyIRL.exe
  C:\Windows\System\wvEyIRL.exe
  2⤵
  PID:14232
- C:\Windows\System\pDxmpkN.exe
  C:\Windows\System\pDxmpkN.exe
  2⤵
  PID:14300
- C:\Windows\System\ZFKjKXl.exe
  C:\Windows\System\ZFKjKXl.exe
  2⤵
  PID:13336
- C:\Windows\System\fcfnTqy.exe
  C:\Windows\System\fcfnTqy.exe
  2⤵
  PID:13608
- C:\Windows\System\LFddoJQ.exe
  C:\Windows\System\LFddoJQ.exe
  2⤵
  PID:13876
- C:\Windows\System\InyecFX.exe
  C:\Windows\System\InyecFX.exe
  2⤵
  PID:13896
- C:\Windows\System\BLzchJl.exe
  C:\Windows\System\BLzchJl.exe
  2⤵
  PID:13984
- C:\Windows\System\eJNMAXM.exe
  C:\Windows\System\eJNMAXM.exe
  2⤵
  PID:14156
- C:\Windows\System\ldtBtbQ.exe
  C:\Windows\System\ldtBtbQ.exe
  2⤵
  PID:14332
- C:\Windows\System\xwYsqNi.exe
  C:\Windows\System\xwYsqNi.exe
  2⤵
  PID:13884
- C:\Windows\System\DxyUBlG.exe
  C:\Windows\System\DxyUBlG.exe
  2⤵
  PID:13996
- C:\Windows\System\zhgUmhz.exe
  C:\Windows\System\zhgUmhz.exe
  2⤵
  PID:14236
- C:\Windows\System\XwkkwVB.exe
  C:\Windows\System\XwkkwVB.exe
  2⤵
  PID:13764
- C:\Windows\System\CRMBNsB.exe
  C:\Windows\System\CRMBNsB.exe
  2⤵
  PID:14360
- C:\Windows\System\SYkEvHq.exe
  C:\Windows\System\SYkEvHq.exe
  2⤵
  PID:14384
- C:\Windows\System\dvHxdCj.exe
  C:\Windows\System\dvHxdCj.exe
  2⤵
  PID:14412
- C:\Windows\System\vSrdfWs.exe
  C:\Windows\System\vSrdfWs.exe
  2⤵
  PID:14464
- C:\Windows\System\daQEyUh.exe
  C:\Windows\System\daQEyUh.exe
  2⤵
  PID:14488
- C:\Windows\System\ibhPhjL.exe
  C:\Windows\System\ibhPhjL.exe
  2⤵
  PID:14512
- C:\Windows\System\DkcsVyL.exe
  C:\Windows\System\DkcsVyL.exe
  2⤵
  PID:14544
- C:\Windows\System\PIwjRIs.exe
  C:\Windows\System\PIwjRIs.exe
  2⤵
  PID:14568
- C:\Windows\System\fXGqcyz.exe
  C:\Windows\System\fXGqcyz.exe
  2⤵
  PID:14588
- C:\Windows\System\QgaAkai.exe
  C:\Windows\System\QgaAkai.exe
  2⤵
  PID:14616
- C:\Windows\System\zshSXhp.exe
  C:\Windows\System\zshSXhp.exe
  2⤵
  PID:14640
- C:\Windows\System\mDDKiFQ.exe
  C:\Windows\System\mDDKiFQ.exe
  2⤵
  PID:14672
- C:\Windows\System\ikEyShJ.exe
  C:\Windows\System\ikEyShJ.exe
  2⤵
  PID:14696
- C:\Windows\System\LcwSpxD.exe
  C:\Windows\System\LcwSpxD.exe
  2⤵
  PID:14756
- C:\Windows\System\bwforuz.exe
  C:\Windows\System\bwforuz.exe
  2⤵
  PID:14780
- C:\Windows\System\zElSUAk.exe
  C:\Windows\System\zElSUAk.exe
  2⤵
  PID:14800
- C:\Windows\System\jVhUYvj.exe
  C:\Windows\System\jVhUYvj.exe
  2⤵
  PID:14836
- C:\Windows\System\qrXPwBI.exe
  C:\Windows\System\qrXPwBI.exe
  2⤵
  PID:14864
- C:\Windows\System\IOKbwHl.exe
  C:\Windows\System\IOKbwHl.exe
  2⤵
  PID:14884
- C:\Windows\System\EjRyVkk.exe
  C:\Windows\System\EjRyVkk.exe
  2⤵
  PID:14908
- C:\Windows\System\DewuUhY.exe
  C:\Windows\System\DewuUhY.exe
  2⤵
  PID:14936
- C:\Windows\System\knjlcXU.exe
  C:\Windows\System\knjlcXU.exe
  2⤵
  PID:14972
- C:\Windows\System\wkoEOXe.exe
  C:\Windows\System\wkoEOXe.exe
  2⤵
  PID:15008
- C:\Windows\System\GSjISHv.exe
  C:\Windows\System\GSjISHv.exe
  2⤵
  PID:15024
- C:\Windows\System\zGcAROm.exe
  C:\Windows\System\zGcAROm.exe
  2⤵
  PID:15060
- C:\Windows\System\tVhrqGY.exe
  C:\Windows\System\tVhrqGY.exe
  2⤵
  PID:15080
- C:\Windows\System\HDwKGPg.exe
  C:\Windows\System\HDwKGPg.exe
  2⤵
  PID:15116
- C:\Windows\System\ieHVNWp.exe
  C:\Windows\System\ieHVNWp.exe
  2⤵
  PID:15136
- C:\Windows\System\StvODmy.exe
  C:\Windows\System\StvODmy.exe
  2⤵
  PID:15164
- C:\Windows\System\IHAcFZp.exe
  C:\Windows\System\IHAcFZp.exe
  2⤵
  PID:15192
- C:\Windows\System\MdBeJgG.exe
  C:\Windows\System\MdBeJgG.exe
  2⤵
  PID:15212
- C:\Windows\System\bSPMZMe.exe
  C:\Windows\System\bSPMZMe.exe
  2⤵
  PID:15244
- C:\Windows\System\jcisdBS.exe
  C:\Windows\System\jcisdBS.exe
  2⤵
  PID:15264
- C:\Windows\System\ZGPIuib.exe
  C:\Windows\System\ZGPIuib.exe
  2⤵
  PID:15300
- C:\Windows\System\uNoljBp.exe
  C:\Windows\System\uNoljBp.exe
  2⤵
  PID:15328
- C:\Windows\System\okyKgho.exe
  C:\Windows\System\okyKgho.exe
  2⤵
  PID:15348
- C:\Windows\System\pYXWdVc.exe
  C:\Windows\System\pYXWdVc.exe
  2⤵
  PID:13960
- C:\Windows\System\JmHGpzE.exe
  C:\Windows\System\JmHGpzE.exe
  2⤵
  PID:14404
- C:\Windows\System\fuXhPWN.exe
  C:\Windows\System\fuXhPWN.exe
  2⤵
  PID:14504
- C:\Windows\System\OpMuxbq.exe
  C:\Windows\System\OpMuxbq.exe
  2⤵
  PID:14560
- C:\Windows\System\ZzAHjdb.exe
  C:\Windows\System\ZzAHjdb.exe
  2⤵
  PID:14604
- C:\Windows\System\AjrsDgP.exe
  C:\Windows\System\AjrsDgP.exe
  2⤵
  PID:14628
- C:\Windows\System\vjdGrIr.exe
  C:\Windows\System\vjdGrIr.exe
  2⤵
  PID:14736
- C:\Windows\System\iYtXXnM.exe
  C:\Windows\System\iYtXXnM.exe
  2⤵
  PID:14792
- C:\Windows\System\waoZjIK.exe
  C:\Windows\System\waoZjIK.exe
  2⤵
  PID:14924
- C:\Windows\System\oQvicIz.exe
  C:\Windows\System\oQvicIz.exe
  2⤵
  PID:14920
- C:\Windows\System\OcjUmmM.exe
  C:\Windows\System\OcjUmmM.exe
  2⤵
  PID:15000
- C:\Windows\System\uZaYqJP.exe
  C:\Windows\System\uZaYqJP.exe
  2⤵
  PID:15048
- C:\Windows\System\KFBmYnb.exe
  C:\Windows\System\KFBmYnb.exe
  2⤵
  PID:15108
- C:\Windows\System\gqLIceK.exe
  C:\Windows\System\gqLIceK.exe
  2⤵
  PID:15124
- C:\Windows\System\exiUdJC.exe
  C:\Windows\System\exiUdJC.exe
  2⤵
  PID:15260
- C:\Windows\System\CvGXYLp.exe
  C:\Windows\System\CvGXYLp.exe
  2⤵
  PID:15320
- C:\Windows\System\eAIlETJ.exe
  C:\Windows\System\eAIlETJ.exe
  2⤵
  PID:14392
- C:\Windows\System\ICfPHBn.exe
  C:\Windows\System\ICfPHBn.exe
  2⤵
  PID:14520
- C:\Windows\System\FOUUsSK.exe
  C:\Windows\System\FOUUsSK.exe
  2⤵
  PID:14600
- C:\Windows\System\julKzWD.exe
  C:\Windows\System\julKzWD.exe
  2⤵
  PID:14860
- C:\Windows\System\FQDaiYf.exe
  C:\Windows\System\FQDaiYf.exe
  2⤵
  PID:15004
- C:\Windows\System\CFtscLl.exe
  C:\Windows\System\CFtscLl.exe
  2⤵
  PID:15160
- C:\Windows\System\qjVrftq.exe
  C:\Windows\System\qjVrftq.exe
  2⤵
  PID:15296
- C:\Windows\System\FMsqHzc.exe
  C:\Windows\System\FMsqHzc.exe
  2⤵
  PID:14352
- C:\Windows\System\YkCfKgI.exe
  C:\Windows\System\YkCfKgI.exe
  2⤵
  PID:14900
- C:\Windows\System\DTNJIAb.exe
  C:\Windows\System\DTNJIAb.exe
  2⤵
  PID:14456
- C:\Windows\System\YraGfrw.exe
  C:\Windows\System\YraGfrw.exe
  2⤵
  PID:14848
- C:\Windows\System\kIoXtPt.exe
  C:\Windows\System\kIoXtPt.exe
  2⤵
  PID:15368
- C:\Windows\System\FzfbvJy.exe
  C:\Windows\System\FzfbvJy.exe
  2⤵
  PID:15396
- C:\Windows\System\SHubHLe.exe
  C:\Windows\System\SHubHLe.exe
  2⤵
  PID:15420
- C:\Windows\System\DFTPKVh.exe
  C:\Windows\System\DFTPKVh.exe
  2⤵
  PID:15444
- C:\Windows\System\JSXflDt.exe
  C:\Windows\System\JSXflDt.exe
  2⤵
  PID:15504
- C:\Windows\System\fCaZDIE.exe
  C:\Windows\System\fCaZDIE.exe
  2⤵
  PID:15520
- C:\Windows\System\gCqZoUJ.exe
  C:\Windows\System\gCqZoUJ.exe
  2⤵
  PID:15560
- C:\Windows\System\gEpCgFu.exe
  C:\Windows\System\gEpCgFu.exe
  2⤵
  PID:15576
- C:\Windows\System\dkCkRHj.exe
  C:\Windows\System\dkCkRHj.exe
  2⤵
  PID:15604
- C:\Windows\System\pISnAVP.exe
  C:\Windows\System\pISnAVP.exe
  2⤵
  PID:15624
- C:\Windows\System\faroNhd.exe
  C:\Windows\System\faroNhd.exe
  2⤵
  PID:15652
- C:\Windows\System\DMvcPzh.exe
  C:\Windows\System\DMvcPzh.exe
  2⤵
  PID:15684
- C:\Windows\System\OaUXAul.exe
  C:\Windows\System\OaUXAul.exe
  2⤵
  PID:15708
- C:\Windows\System\XlyeYTw.exe
  C:\Windows\System\XlyeYTw.exe
  2⤵
  PID:15732
- C:\Windows\System\SMwdfhp.exe
  C:\Windows\System\SMwdfhp.exe
  2⤵
  PID:15760
- C:\Windows\System\wPEfdDT.exe
  C:\Windows\System\wPEfdDT.exe
  2⤵
  PID:15808
- C:\Windows\System\obEAtib.exe
  C:\Windows\System\obEAtib.exe
  2⤵
  PID:15832
- C:\Windows\System\VIHjNZY.exe
  C:\Windows\System\VIHjNZY.exe
  2⤵
  PID:15868
- C:\Windows\System\JOYzTbl.exe
  C:\Windows\System\JOYzTbl.exe
  2⤵
  PID:15892
- C:\Windows\System\iFqCZak.exe
  C:\Windows\System\iFqCZak.exe
  2⤵
  PID:15912
- C:\Windows\System\dCWHazS.exe
  C:\Windows\System\dCWHazS.exe
  2⤵
  PID:15952
- C:\Windows\System\SbbhNtI.exe
  C:\Windows\System\SbbhNtI.exe
  2⤵
  PID:15980
- C:\Windows\System\uiBjAyg.exe
  C:\Windows\System\uiBjAyg.exe
  2⤵
  PID:15996
- C:\Windows\System\FLKPFlX.exe
  C:\Windows\System\FLKPFlX.exe
  2⤵
  PID:16024
- C:\Windows\System\kOyVqQr.exe
  C:\Windows\System\kOyVqQr.exe
  2⤵
  PID:16048
- C:\Windows\System\spscgxe.exe
  C:\Windows\System\spscgxe.exe
  2⤵
  PID:16076
- C:\Windows\System\QPjMjxF.exe
  C:\Windows\System\QPjMjxF.exe
  2⤵
  PID:16096
- C:\Windows\System\mTacqUA.exe
  C:\Windows\System\mTacqUA.exe
  2⤵
  PID:16124
- C:\Windows\System\NrwsSfP.exe
  C:\Windows\System\NrwsSfP.exe
  2⤵
  PID:16144
- C:\Windows\System\kjnouAK.exe
  C:\Windows\System\kjnouAK.exe
  2⤵
  PID:16168
- C:\Windows\System\DwaItoq.exe
  C:\Windows\System\DwaItoq.exe
  2⤵
  PID:16196
- C:\Windows\System\FvWrTSa.exe
  C:\Windows\System\FvWrTSa.exe
  2⤵
  PID:16216
- C:\Windows\System\fNpyqFM.exe
  C:\Windows\System\fNpyqFM.exe
  2⤵
  PID:16248
- C:\Windows\System\ZiNzvUa.exe
  C:\Windows\System\ZiNzvUa.exe
  2⤵
  PID:16272
- C:\Windows\System\pujqaRV.exe
  C:\Windows\System\pujqaRV.exe
  2⤵
  PID:16292
- C:\Windows\System\xfzbSVb.exe
  C:\Windows\System\xfzbSVb.exe
  2⤵
  PID:16316
- C:\Windows\System\CopovnZ.exe
  C:\Windows\System\CopovnZ.exe
  2⤵
  PID:16340
- C:\Windows\System\RUBtlBo.exe
  C:\Windows\System\RUBtlBo.exe
  2⤵
  PID:15376
- C:\Windows\System\BeNCvGY.exe
  C:\Windows\System\BeNCvGY.exe
  2⤵
  PID:15416
- C:\Windows\System\KmJdKcW.exe
  C:\Windows\System\KmJdKcW.exe
  2⤵
  PID:15500
- C:\Windows\System\ZNejDTN.exe
  C:\Windows\System\ZNejDTN.exe
  2⤵
  PID:15552
- C:\Windows\System\EvfsTsL.exe
  C:\Windows\System\EvfsTsL.exe
  2⤵
  PID:15620
- C:\Windows\System\JYoEnMI.exe
  C:\Windows\System\JYoEnMI.exe
  2⤵
  PID:15668
- C:\Windows\System\iBhiERu.exe
  C:\Windows\System\iBhiERu.exe
  2⤵
  PID:15752
- C:\Windows\System\dwHicuk.exe
  C:\Windows\System\dwHicuk.exe
  2⤵
  PID:15804
- C:\Windows\System\JcwvqdP.exe
  C:\Windows\System\JcwvqdP.exe
  2⤵
  PID:15900
- C:\Windows\System\DMqZQQA.exe
  C:\Windows\System\DMqZQQA.exe
  2⤵
  PID:15964
- C:\Windows\System\oyWKqrs.exe
  C:\Windows\System\oyWKqrs.exe
  2⤵
  PID:16008
- C:\Windows\System\nCyYICo.exe
  C:\Windows\System\nCyYICo.exe
  2⤵
  PID:16068
- C:\Windows\System\CBcjZnT.exe
  C:\Windows\System\CBcjZnT.exe
  2⤵
  PID:16212
- C:\Windows\System\qzeijDl.exe
  C:\Windows\System\qzeijDl.exe
  2⤵
  PID:16244
- C:\Windows\System\Blywsde.exe
  C:\Windows\System\Blywsde.exe
  2⤵
  PID:16304
- C:\Windows\System\PlFQfyf.exe
  C:\Windows\System\PlFQfyf.exe
  2⤵
  PID:16288
- C:\Windows\System\uFDkUvC.exe
  C:\Windows\System\uFDkUvC.exe
  2⤵
  PID:16368
- C:\Windows\System\kCaPmiN.exe
  C:\Windows\System\kCaPmiN.exe
  2⤵
  PID:15276
- C:\Windows\System\cSXgyBd.exe
  C:\Windows\System\cSXgyBd.exe
  2⤵
  PID:14708
- C:\Windows\System\DLodJZj.exe
  C:\Windows\System\DLodJZj.exe
  2⤵
  PID:15716
- C:\Windows\System\TaalWEA.exe
  C:\Windows\System\TaalWEA.exe
  2⤵
  PID:15864
- C:\Windows\System\DgDuIHP.exe
  C:\Windows\System\DgDuIHP.exe
  2⤵
  PID:16188
- C:\Windows\System\wJZIIMS.exe
  C:\Windows\System\wJZIIMS.exe
  2⤵
  PID:16284
- C:\Windows\System\qehLvyc.exe
  C:\Windows\System\qehLvyc.exe
  2⤵
  PID:15380
- C:\Windows\System\ldDklJc.exe
  C:\Windows\System\ldDklJc.exe
  2⤵
  PID:15648
- C:\Windows\System\SvSRRzg.exe
  C:\Windows\System\SvSRRzg.exe
  2⤵
  PID:16040
- C:\Windows\System\tgGzmdJ.exe
  C:\Windows\System\tgGzmdJ.exe
  2⤵
  PID:16356
- C:\Windows\System\oJEfuzn.exe
  C:\Windows\System\oJEfuzn.exe
  2⤵
  PID:16436
- C:\Windows\System\GmjzwrI.exe
  C:\Windows\System\GmjzwrI.exe
  2⤵
  PID:16460
- C:\Windows\System\NFXrYgk.exe
  C:\Windows\System\NFXrYgk.exe
  2⤵
  PID:16484
- C:\Windows\System\YDiCLuj.exe
  C:\Windows\System\YDiCLuj.exe
  2⤵
  PID:16508
- C:\Windows\System\oBdBWtC.exe
  C:\Windows\System\oBdBWtC.exe
  2⤵
  PID:16528
- C:\Windows\System\hKocxGo.exe
  C:\Windows\System\hKocxGo.exe
  2⤵
  PID:16580
- C:\Windows\System\KbYGmxT.exe
  C:\Windows\System\KbYGmxT.exe
  2⤵
  PID:16600
- C:\Windows\System\xNDUdhh.exe
  C:\Windows\System\xNDUdhh.exe
  2⤵
  PID:16616
- C:\Windows\System\iokNyji.exe
  C:\Windows\System\iokNyji.exe
  2⤵
  PID:16640
- C:\Windows\System\UTzHSvq.exe
  C:\Windows\System\UTzHSvq.exe
  2⤵
  PID:16664
- C:\Windows\System\lPQpLWz.exe
  C:\Windows\System\lPQpLWz.exe
  2⤵
  PID:16684
- C:\Windows\System\KgpLVTb.exe
  C:\Windows\System\KgpLVTb.exe
  2⤵
  PID:16712
- C:\Windows\System\fLqcoLX.exe
  C:\Windows\System\fLqcoLX.exe
  2⤵
  PID:16736
- C:\Windows\System\PBrzvCD.exe
  C:\Windows\System\PBrzvCD.exe
  2⤵
  PID:16768
- C:\Windows\System\cPBYhZy.exe
  C:\Windows\System\cPBYhZy.exe
  2⤵
  PID:16788
- C:\Windows\System\fRiFLEm.exe
  C:\Windows\System\fRiFLEm.exe
  2⤵
  PID:16808
- C:\Windows\System\tuJuUzP.exe
  C:\Windows\System\tuJuUzP.exe
  2⤵
  PID:16832
- C:\Windows\System\DRiygWa.exe
  C:\Windows\System\DRiygWa.exe
  2⤵
  PID:16856
- C:\Windows\System\yNRHnur.exe
  C:\Windows\System\yNRHnur.exe
  2⤵
  PID:16880
- C:\Windows\System\KVujinU.exe
  C:\Windows\System\KVujinU.exe
  2⤵
  PID:16904
- C:\Windows\System\IzkHDho.exe
  C:\Windows\System\IzkHDho.exe
  2⤵
  PID:16936
- C:\Windows\System\roGNEym.exe
  C:\Windows\System\roGNEym.exe
  2⤵
  PID:16956
- C:\Windows\System\gXNwqxU.exe
  C:\Windows\System\gXNwqxU.exe
  2⤵
  PID:16976
- C:\Windows\System\GbdEDHY.exe
  C:\Windows\System\GbdEDHY.exe
  2⤵
  PID:16996
- C:\Windows\System\RjJkkVo.exe
  C:\Windows\System\RjJkkVo.exe
  2⤵
  PID:17024
- C:\Windows\System\PTOjmBX.exe
  C:\Windows\System\PTOjmBX.exe
  2⤵
  PID:17044
- C:\Windows\System\mmJrWxk.exe
  C:\Windows\System\mmJrWxk.exe
  2⤵
  PID:17068
- C:\Windows\System\fHUnvaW.exe
  C:\Windows\System\fHUnvaW.exe
  2⤵
  PID:17092
- C:\Windows\System\YxFSxMI.exe
  C:\Windows\System\YxFSxMI.exe
  2⤵
  PID:17116
- C:\Windows\System\xRKIvYN.exe
  C:\Windows\System\xRKIvYN.exe
  2⤵
  PID:17136
- C:\Windows\System\AUmQInS.exe
  C:\Windows\System\AUmQInS.exe
  2⤵
  PID:17164
- C:\Windows\System\frRkUwj.exe
  C:\Windows\System\frRkUwj.exe
  2⤵
  PID:17188
- C:\Windows\System\RsViEqL.exe
  C:\Windows\System\RsViEqL.exe
  2⤵
  PID:16184
- C:\Windows\System\DNAeBpH.exe
  C:\Windows\System\DNAeBpH.exe
  2⤵
  PID:16412
- C:\Windows\System\hZcSugt.exe
  C:\Windows\System\hZcSugt.exe
  2⤵
  PID:16448
- C:\Windows\System\rhpEdCQ.exe
  C:\Windows\System\rhpEdCQ.exe
  2⤵
  PID:16544
- C:\Windows\System\iJFLqCq.exe
  C:\Windows\System\iJFLqCq.exe
  2⤵
  PID:16732

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:17292

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\CUMDoLB.exe

Filesize
1.3MB

MD5
bff57cdac90a2595edfffe1d8fdb0825

SHA1
3fa7b2e9475597747891f9a3f56e16de4b63ffc2

SHA256
03c0d4d2a9e4ef0d9f45e13c4c473fb086cdfcf89fc75de57e6c1e3ae029f91e

SHA512
492e7538e14ddf2aa9cffe2fa4129087f5ea3397b28719f109fa53f902ebd55755e2606c0f35cd52279d789138b86dbf3bc3c72f623aa363ccb8601e4950f94c

Download Submit
C:\Windows\System\DYdpMFU.exe

Filesize
1.3MB

MD5
1c06d53a014f10327dc2976ae6d0d923

SHA1
a0997e5fa09fa828bf763b9d887d0af0c4c32b87

SHA256
2d23fefd4fa57d8d449241ac19f42d2425b90aa9eb17db5bb1f0dee902489e07

SHA512
cf878014fff1f37334c82e941baf905bdfc2cedf329bfbbe385d5d1e7c1afa46a6c1f7e92ba79fb6c89a5592fbda6be39061b4c96c39d29635613fb95c9b5b49

Download Submit
C:\Windows\System\DynaMhY.exe

Filesize
1.3MB

MD5
5ed505a290983ab5bbe84687d3f66009

SHA1
2988570e3a2e94a83a185d48c49b3b2525fd05d7

SHA256
950ddfce2ae1d5b5efb8277f512b204790cc678d0ae3df5b548177b26eb5e9ee

SHA512
30a47a277abbc9092439d950f955185d7f0a6b7973b9644f926b2b8c8db9a52ad660379babe448a72820a7c0805665933983c3be61b234dd0436a5a73ea45ed7

Download Submit
C:\Windows\System\EVAeeWR.exe

Filesize
1.3MB

MD5
10db724c7f3e32de4ccacc0d4c34a0d6

SHA1
ce5d113428151d276985af2c82fae129bdbd3105

SHA256
9d97a4060b3d9ac341d6036d634a7ecd6e5c6e1de8a1e1bf4114cebbed17ae91

SHA512
ff10904b938c21be16e3950785368cd314c545f43f45c276b6ddabbba824c26f94ace7e6c22366d70672c7838558df504ab2364ca45d4d56a658714b74b22950

Download Submit
C:\Windows\System\FHdqFpB.exe

Filesize
1.3MB

MD5
3630d1364bee677aec855059831d3749

SHA1
662f58fa7e1891c53d6dfd7a84781c72cdf71b57

SHA256
fefd0ae14179c8a1d0c6b08fe539578359d6ad46fb046f394c57f1fef7979933

SHA512
4dccec8076c6482d9cf7dc117aee45d66609086610d76d601b4b5706ed876590ed4c017522258eda2fab09337c7d55a0c875ab9150ac046dafb3dda81d2a90e5

Download Submit
C:\Windows\System\IWgCxjh.exe

Filesize
1.3MB

MD5
e2bf1084b94599455efbd0e7448b877d

SHA1
3550b725eb0b43459ad20282a3290672983bc110

SHA256
52b522d34030837961fb42e04bcdf3c528eca9537881000ac3f1885066d72aa3

SHA512
5607ada9a4200b0b0dc1286bef47876407e19c7927166741cf720dadf9a028db5e5ad3a16a20e057afc6c069594bb727d809b28ff285becc6376f9a8d197b84a

Download Submit
C:\Windows\System\KUQAVll.exe

Filesize
1.3MB

MD5
58b8d1ecbd37fa2083ff0aca0794e234

SHA1
8cac8b155e765642573a1e07ae22998e6558f87a

SHA256
f6de6a5159eb5dfca1e3bc06c0a4375b2c2c2fa5980c49fde279e10a9ab286d3

SHA512
2e7d4fe0697adf40d6b97fb4044e6a87ceeb02b9d98c92b5012e923ae93143d862b99397f8af01e2b9bb324ce7358a44213b2f8b42f971cb87f3ec43cd20ef3d

Download Submit
C:\Windows\System\NVlzvTc.exe

Filesize
1.3MB

MD5
37965505a09beee1d622bd6a0ab9ef7d

SHA1
843ebb15f312235762e12e67f51523049bb26ec6

SHA256
3ff870f2fdf2ac026e3f4cc2ed45ae1c9f22464ba32e96e8a0fdc570b3c6e7e2

SHA512
a53053a7f80ba2f0169e20df29679f3ce8d00f70836b56b9164de246692282db2aa7c04f94e9e86302631052dfde08cb66bdf6e1d3276fccc56ead5baa6ab0b6

Download Submit
C:\Windows\System\NdEdnwH.exe

Filesize
1.3MB

MD5
76f1343b201efd619a75dc18c1c3746d

SHA1
35afc58a1395c1a5ffb4e8fba01a8c55c6b0bf62

SHA256
c59053e92748944f82282917e9c1382d400a04e15edbd94f6512fb964e850533

SHA512
aecc812a1452119d1daffad9ae13b0f95b6b71188c0f34d8b3dd1e578b3b9c4b676e25715cdeb878391209ccba41221a532cef66215fd053602596ecea9033f4

Download Submit
C:\Windows\System\TcsrvDU.exe

Filesize
1.3MB

MD5
253c994a65f1d5ef69037efdae8d84d3

SHA1
dae8f203adad3263da1b164a4d340ac8d1c2090b

SHA256
543949215494327b1483e6f8a4ba0577b218c46389b6c58d44dc0100174ff99b

SHA512
4e658120458ba5ae27d5c0cceedca35a5cccd28d9c8f37bee61a7fe20953a37190cf016df375f65cf963b7f6ed37dde964118ad5f67313cc5284cdd08d31ac61

Download Submit
C:\Windows\System\USTJOqq.exe

Filesize
1.3MB

MD5
0e8c8cddcc2090d64e8b3e99df587a13

SHA1
1b2b2b1e0c3fc694a5775920e75be3d9001a863a

SHA256
1c8c55122110f7e4f4aed4a83df1b8523e447aa71c70d842d580c9f7ac8f0e49

SHA512
178918c973fec636cc07e7517450ff47fbcf89ad1006a930dce0212267ec82f976c23935f8a91090b923ca2998258e094c01e807f51235fa28a52319c39b5247

Download Submit
C:\Windows\System\WRHVQda.exe

Filesize
1.3MB

MD5
0f2449711621d69d6e2429982a9fded7

SHA1
2bff41595622093a72a7e6fe2f2e9ede74811693

SHA256
8837dac5e232232cf34f6ee6bbda99ad3b8e0b9eb4e5ada4486d37e09ec86ece

SHA512
064ef90142d626fdd9019d8fa4b4e1a518937e1dfcb99a9cc31c60ef693609740b91fba9742cc73eab4cd8b52f3e3d6f9851d534bf0922004d8c04810120b848

Download Submit
C:\Windows\System\WXrYPyK.exe

Filesize
1.3MB

MD5
71525fc131af28a765c166d647472550

SHA1
a46e0534d8ec031c3a8f33bbbe5f07cb896f313d

SHA256
c623b8e9716e9a06d80047787056a615347aa8d8c67596edcc254146a1411ceb

SHA512
291edce805e6c315526404a73580cde6fbbaba5727e7c3089bfedbbf3d160e44ee3e7d6c463892df524330b951abb82d531f467e1f96743352aa7c18f3dc6cee

Download Submit
C:\Windows\System\YMjYxDX.exe

Filesize
1.3MB

MD5
6cc1b64847a780d5bc08e23c4c6d0440

SHA1
ad765776178507bcf15882c5b72705f0f4600767

SHA256
8e5d16ceb8f0a9424e0e53ee9f5759e8f876edd866b06faf901b42487203f7db

SHA512
daf914fe79008ab421be08e81818f72210417ee3bbea6f25a23181644c63ae33e3f956080e251fb783decc50fb83028042609286892871fba3f1b81f2248b4fe

Download Submit
C:\Windows\System\azvwphR.exe

Filesize
1.3MB

MD5
54f0fde08d4d36d8b0348ecf5755681e

SHA1
3d6c5e1b0f47d1643f7535803df2c4f050401561

SHA256
f77b01292bbf8b0c77313a1a107baaa46725753c6bf61f4c92e0c28bc06c134d

SHA512
db54aba4a6b06ccfaecbe601da252607c2b83c94ab50132f3197b6cd5d841e6780d1d6576017492a2a58e561e329c927ea6bc6b5b09376d095103781b8d1e7f6

Download Submit
C:\Windows\System\gltQaTG.exe

Filesize
1.3MB

MD5
881a01df5a7a2987fd035c07bf26815f

SHA1
5bfd23fcb8f85eef350341c95eb6da0d341b018c

SHA256
e50205ec61e3a3a969d9a895d46a5f906b6d0c46345901c769518a54575ba669

SHA512
19422dd9ee465fad0c2716964491a1e6c55d9c05eee9366b55e4d93f3651e24666b503ff296d61caaff15f8618b067fa4333419be8776936a52c23c4aa209de1

Download Submit
C:\Windows\System\inPDWwe.exe

Filesize
1.3MB

MD5
5e1c91d24904633d35a8d6cf626ee310

SHA1
7994fa7ffa65bc926f9fcdad9bc098a7243fc5d8

SHA256
d4f85e2247cec88610609c83c85d905f5095d649d34ce2f025230657a8f32479

SHA512
f21e357b73ddba74d22c85e55bb7f473b7806ac9581bc2a057c581a20f0e28dfeb8e896de90bbc70308f4db24d2fa601493d3ce27624c188e2dca8e3ddc306ec

Download Submit
C:\Windows\System\jWHoCCL.exe

Filesize
1.3MB

MD5
6fa5cacc7ca7069f7077944c8c341929

SHA1
9eb3902250d5803585d46e7cb02156eef0481149

SHA256
72ae0bbb15fde91ce40e5218b8d840f28f07ea8c55d1079457ee0a78552f68d6

SHA512
5244b576cdb4f232335ce7ed431be7fa79a281a3601a329bfcc03fab32d78211bbf089d38590f58a3f81d483c48cced03943822b5007a43328078ec5f5da2e26

Download Submit
C:\Windows\System\jXOzkjC.exe

Filesize
1.3MB

MD5
05714b80dd69bc3751787f6205f01253

SHA1
7deedc3604678e4ff33593501f25b18b6d782fde

SHA256
d43b2752cadf3b55bb787ccc0ffa32005622770533997d7f5843a89a4a1f6d1c

SHA512
7428bb0b25394c286a12555aaa90ac836636e7e5e9c7104053aaa02e2b1e97c392608579e6a6e62013bb037cd6f363e5f073960307f51a3c73dd4f609b6fef18

Download Submit
C:\Windows\System\kkjWsWP.exe

Filesize
1.3MB

MD5
89b5442345ca6292d4ca0858b6f94a81

SHA1
dadba78345b0ddf58a6f82d80f31ab411640baf2

SHA256
cdebf07a3974b750ecb6c0164bed5e1110b89369772d4e9010f6d82be9e58c37

SHA512
2b209f0a526ba11d220b8b0765bf8505fe6f5b88ff6ab1228baa7f76b47e0eb8b8c99d4ba6567649b0112621ee0f9f678701a5a2b616bb4192ddc77c52b39d56

Download Submit
C:\Windows\System\oBAVPVE.exe

Filesize
1.3MB

MD5
4984a58c42fd205a78dc5922d65746ca

SHA1
c60a2e4ccf22521c39ab7f74db17a035c370fd76

SHA256
e40a0dc7348c8c16251a69b6a4f2a96279a53e0fb0aaf2e7be7c162f28952bcd

SHA512
0858c319d59ef0b62c4a7183dd974075b625fd1a57da004173f88514938f79bba2beee0620a7a12126381c28bec683c78f39257f05807504394a778c992f171c

Download Submit
C:\Windows\System\oXNhaMQ.exe

Filesize
1.3MB

MD5
74768e07a5bfb4d2c1bd61b0bd99b4ae

SHA1
64611cf1130d5c6cd3a5f66f1b10e2224e838f89

SHA256
8293f6538100c248ce588530a6928657c7586e65f3ae7196f86a73afeea08aa4

SHA512
4e1fe7465c5df59aa84ae1d7457fe4b79975c2dacd37c0a310a47e4f00eee7cd431f3accda4ed3bed4e10cfbe3c79473f0b457a7592a4725b1cb2f09b6df5873

Download Submit
C:\Windows\System\ocbMOhe.exe

Filesize
1.3MB

MD5
00f90a0f4e9f6e7c7da11f17a526dd28

SHA1
228a6edec6da6be23d350f86f3228af974ba5eae

SHA256
9f5f7d753b6c95bd36569ba4f2dbcc57fafd5b6f04292b0993cb8bb17658ebf4

SHA512
ec6b4f02f6ace8eed62463eb4a6ca35894cb2892adb7decaedd0872fc5d5e0e6e0d295e06702e1e7c130f913e362d3bf5ddb284e4ae57dd7b22a20445cb4020f

Download Submit
C:\Windows\System\pjLAwqD.exe

Filesize
1.3MB

MD5
db44129bcf58ee39f044dbff89b34ddf

SHA1
dcb3a47bb882a61eacdaa21758b8cad8578a5fd6

SHA256
09bb357f172cf50ef1a1cb00487face8e1258ec24a26b1a5c2e588e98a3c820f

SHA512
e3cc8aded0e8a080f0c287db4120b4549c61a8c4a84abc96071e89592c73ec6a4abebc494e4da9d53865544ebdda34d37eb339ce4e3112f8a92039812ee81f90

Download Submit
C:\Windows\System\qLZFibO.exe

Filesize
1.3MB

MD5
1795cf716b8b35e6d5ba8914d9ddd589

SHA1
b881a378fad0069173c33b884b3f1a213e727ed7

SHA256
673e860f21ba8e41aa3898c6f9d5d8c52e4c0b72013a4fb549af6baca0737787

SHA512
c8293f770175300e89a788b61fc339f59f3b957ef14ff02d628280494418ac67dc97a9a79ab3720fa009f99bec89537dbd2ae74a834791d9880f06c36328057f

Download Submit
C:\Windows\System\qMUYtwy.exe

Filesize
1.3MB

MD5
f63d541918d57d0763be4bb5e4a1569b

SHA1
70e57e94d78e5332734b05a4574aa0ad05bb5917

SHA256
dfdde040aae84f4861bda515eabd8f595b17acae895b9d4a5db1e43ac65cc653

SHA512
b0ac0ac8e949255b0322ded4066c365c48394ff2b1ed4602a9e7a6330e5bec4c0697c25b3e23069477c985546e21fa7cb6be544815b05e6821355ba0ed459ffb

Download Submit
C:\Windows\System\qaMszzo.exe

Filesize
1.3MB

MD5
502447a64c67f70a37afe25eb63ad5b5

SHA1
bc6814169b82764f68f23af540c6bcf4529f478c

SHA256
2b13297a47c7ed98ae4190f070283bc933338ccfc751c4f661a4788d8303dcd8

SHA512
946fba27854439e6094a4ca65103680e5c761e61c5108a5eeaff50ac75cc4cde2d030d2c5b64ff12e91312001b7578d5f1b25f727d5f6bbd1e57b3416139e1b7

Download Submit
C:\Windows\System\qsvMKFD.exe

Filesize
1.3MB

MD5
3a1ac39ff6f5e0e554c546ccdaab802d

SHA1
5f6aca09d046f24f5566f35990716c73fbb419c0

SHA256
82ca521e3185613aa15177ca3ab00402b1c4ae772326097f62e4aa1b5367c5e9

SHA512
b060e331e0a73667e8410c2f3f1938b7a5bc9847821fdeaa504a3e026074390de4d376d73e07b7b99c16b7a234c80b702ef8559243dc35544d23a59e8add4fab

Download Submit
C:\Windows\System\qtCcxCY.exe

Filesize
1.3MB

MD5
dc73c44b52e23ca046cd590ee97b39cf

SHA1
b88ab879b22926a3a9725bb7c179b08b5ac39bd7

SHA256
48fb5bdb85c28e21630ea648034b6b98d7bd9f03ea66661f7b89d9ffe6fb678d

SHA512
ca49db6bfc646b647278e9ff383518d673724e0d44105dd8a3817142938d25b4821abde8a2f9d665e364b1756bb6993e0a5fd7176e97497c89d381e0949f19e3

Download Submit
C:\Windows\System\riCQpAs.exe

Filesize
1.3MB

MD5
e265958b5ed177f567f0ca1b967d1b49

SHA1
72c96546f78e16c8ea2bcd77cf32b938a451d648

SHA256
18ecf590abb52ef02d25f8a57def4b4e5efd59d4790c256c31a714a050b675db

SHA512
8a950e7fea3bd96963ce1f8a4fd631c5cc7cf6c2a6ff8ac53551fbbecd5ac073617642feed1f605132d2f2c7f54010593611caefa0debf9e47a38f4816ad5f2e

Download Submit
C:\Windows\System\ueiyMHO.exe

Filesize
1.3MB

MD5
f7b0ed92bf8b14c5dbadfa113950a1f4

SHA1
ea63cc61700c8c16af057e24ef91cf6978cd1e40

SHA256
a81f3e08fb600b57d94b5edc22664970600a0631145db4e7a4161dc8693ed7b0

SHA512
abf7f69d119df004caeaa9924393613623ec1e60e0874e453b79e9b60d12c44baaff786dd161d6cca43f1eaeaee1bc1e1c0513ce21ca3aca97fb4f4e03983303

Download Submit
C:\Windows\System\wPkZBOP.exe

Filesize
1.3MB

MD5
52e76437e4222dc16eb99494a2df70dc

SHA1
98aaa412d4f4d7a97dcee1d3da70c2a694263d4b

SHA256
05fdef2eb44caa08dc04a2bb0c1f00a8134f58af7a6b7d2acb18f802290af809

SHA512
7727d60d4e8a9bdec7189cde149ff67884d0cb0c4096c0147b6b96e6dd37e764ac057788b7e23e346fe8b06c5ddf1f66b58d29aa403db5fed7b6b09fe78b53d5

Download Submit
C:\Windows\System\yMTSbHN.exe

Filesize
1.3MB

MD5
5669792c75252f5287c0a3d02601de02

SHA1
ba522066dc9a20325924c4fa15dba8061866e889

SHA256
91c93f2f452248eafec672c938afdd308ccc901db1d4d3fb2b67493964156509

SHA512
02d3a0425d9539f839d924933dc4366fe126ce0343aa82f02c35f418257dbda1d818e345cb4a85a45d7b2ecf8de9e72d410b6cbe1f8f66f6b651eb3411c1807e

Download Submit
memory/4044-0-0x000001B725DC0000-0x000001B725DD0000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads