xmrig | 26120c2a9aed3b2fad928503d9c79cb918c4216484ef7d17f0fb32a1318ba7f2

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
17/11/2024, 03:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

26120c2a9aed3b2fad928503d9c79cb918c4216484ef7d17f0fb32a1318ba7f2.exe
Size

1.1MB
MD5

3bef60da6ebdc7ce8972e004509c25ed
SHA1

731497145d76bed5a4169728d2afd81bb84b7658
SHA256

26120c2a9aed3b2fad928503d9c79cb918c4216484ef7d17f0fb32a1318ba7f2
SHA512

87b9b6f6085d7ff60ad4319c718453d274df44da7da591b474ed6560acf88a2274778785d3896f9902779a84dbd7c2c98981632cc31f2877a3d9e4af8bc3c8b2
SSDEEP

24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbpwlKensziXoSP3DVk1YjXGaar4:GezaTF8FcNkNdfE0pZ9ozttwIRRq51

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 33 IoCs

miner

resource	yara_rule
behavioral2/files/0x000c000000023b21-4.dat	xmrig
behavioral2/files/0x000a000000023b84-7.dat	xmrig
behavioral2/files/0x000b000000023b83-8.dat	xmrig
behavioral2/files/0x000a000000023b85-19.dat	xmrig
behavioral2/files/0x000a000000023b86-23.dat	xmrig
behavioral2/files/0x000a000000023b87-29.dat	xmrig
behavioral2/files/0x000a000000023b88-33.dat	xmrig
behavioral2/files/0x000a000000023b89-39.dat	xmrig
behavioral2/files/0x000a000000023b8a-44.dat	xmrig
behavioral2/files/0x000a000000023b8b-45.dat	xmrig
behavioral2/files/0x000a000000023b8c-49.dat	xmrig
behavioral2/files/0x000a000000023b8d-57.dat	xmrig
behavioral2/files/0x000a000000023b8f-73.dat	xmrig
behavioral2/files/0x000a000000023b92-95.dat	xmrig
behavioral2/files/0x000a000000023b98-117.dat	xmrig
behavioral2/files/0x000a000000023b9c-137.dat	xmrig
behavioral2/files/0x000a000000023b9f-152.dat	xmrig
behavioral2/files/0x000a000000023ba1-162.dat	xmrig
behavioral2/files/0x000a000000023ba0-157.dat	xmrig
behavioral2/files/0x000a000000023b9e-155.dat	xmrig
behavioral2/files/0x000a000000023b9d-150.dat	xmrig
behavioral2/files/0x000a000000023b9b-140.dat	xmrig
behavioral2/files/0x000a000000023b9a-135.dat	xmrig
behavioral2/files/0x000a000000023b99-130.dat	xmrig
behavioral2/files/0x000a000000023b97-120.dat	xmrig
behavioral2/files/0x000a000000023b96-115.dat	xmrig
behavioral2/files/0x000a000000023b95-110.dat	xmrig
behavioral2/files/0x000a000000023b94-105.dat	xmrig
behavioral2/files/0x000a000000023b93-100.dat	xmrig
behavioral2/files/0x0032000000023b81-88.dat	xmrig
behavioral2/files/0x000a000000023b91-83.dat	xmrig
behavioral2/files/0x000a000000023b90-77.dat	xmrig
behavioral2/files/0x000a000000023b8e-70.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
4092	dxCoEih.exe
1208	DLKsRZV.exe
2936	hcPXHAW.exe
1416	WhEvgMU.exe
3816	ccLdmlb.exe
4152	SIcHdMA.exe
3688	DrROtnK.exe
3188	gMcTmDU.exe
1792	QdyTnzY.exe
836	ucdrpAi.exe
2688	FUSZuGu.exe
4992	lPDNqks.exe
4556	WxkbLGC.exe
3396	XXEWGWR.exe
3828	mHFMmYv.exe
2296	ExcGYPl.exe
4028	QANnfOb.exe
3472	mYxgGhD.exe
3036	APlFpRX.exe
3664	WflauIj.exe
2392	FKmUSBw.exe
3124	QdQfCrw.exe
3476	VyxydFW.exe
2096	QkzSceR.exe
4224	bYcGIHX.exe
3044	XqFCfql.exe
4912	tJNBWkO.exe
2440	xOcNFaA.exe
1532	rajpjhM.exe
2636	oXlUdBh.exe
2028	aWndquN.exe
2292	IjoPogp.exe
4560	DNvWmfj.exe
4980	fOWTHzm.exe
4976	uDlaCuA.exe
972	QgoNnpA.exe
5100	EMIcfnY.exe
3768	BYGPMie.exe
4728	tayxEjR.exe
540	KDNCuEu.exe
4756	oQAVrzt.exe
4312	JmIAMwi.exe
4840	KQTCyMf.exe
1312	jLJgauD.exe
4052	XdGMdTr.exe
448	NoZGxPZ.exe
2248	zjJhGZH.exe
2500	AXCplSw.exe
3512	VXiCKrp.exe
1124	TvQHHRQ.exe
2264	THUxtBv.exe
2956	oOXCzOY.exe
3132	MxBPsRz.exe
1908	OnOgCFW.exe
3184	VpcjDmA.exe
2092	jbFBUoU.exe
1008	ecSUvCd.exe
4488	waIyXOC.exe
4544	EdbZKlc.exe
2044	GHOPyHk.exe
220	RyMyJfZ.exe
2460	kQQhoqf.exe
2584	eUbXfnl.exe
3068	jgwZzLt.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\gZhVicU.exe	26120c2a9aed3b2fad928503d9c79cb918c4216484ef7d17f0fb32a1318ba7f2.exe
File created	C:\Windows\System\CrKZZeo.exe	26120c2a9aed3b2fad928503d9c79cb918c4216484ef7d17f0fb32a1318ba7f2.exe
File created	C:\Windows\System\gWZVaVh.exe	26120c2a9aed3b2fad928503d9c79cb918c4216484ef7d17f0fb32a1318ba7f2.exe
File created	C:\Windows\System\qweDNdg.exe	26120c2a9aed3b2fad928503d9c79cb918c4216484ef7d17f0fb32a1318ba7f2.exe
File created	C:\Windows\System\KDNCuEu.exe	26120c2a9aed3b2fad928503d9c79cb918c4216484ef7d17f0fb32a1318ba7f2.exe
File created	C:\Windows\System\ulcxawg.exe	26120c2a9aed3b2fad928503d9c79cb918c4216484ef7d17f0fb32a1318ba7f2.exe
File created	C:\Windows\System\OKFRqKV.exe	26120c2a9aed3b2fad928503d9c79cb918c4216484ef7d17f0fb32a1318ba7f2.exe
File created	C:\Windows\System\HtzPrad.exe	26120c2a9aed3b2fad928503d9c79cb918c4216484ef7d17f0fb32a1318ba7f2.exe
File created	C:\Windows\System\QESSEjs.exe	26120c2a9aed3b2fad928503d9c79cb918c4216484ef7d17f0fb32a1318ba7f2.exe
File created	C:\Windows\System\CXmHxka.exe	26120c2a9aed3b2fad928503d9c79cb918c4216484ef7d17f0fb32a1318ba7f2.exe
File created	C:\Windows\System\cegTxdF.exe	26120c2a9aed3b2fad928503d9c79cb918c4216484ef7d17f0fb32a1318ba7f2.exe
File created	C:\Windows\System\tKmgLvP.exe	26120c2a9aed3b2fad928503d9c79cb918c4216484ef7d17f0fb32a1318ba7f2.exe
File created	C:\Windows\System\YalmMNp.exe	26120c2a9aed3b2fad928503d9c79cb918c4216484ef7d17f0fb32a1318ba7f2.exe
File created	C:\Windows\System\ywoYrhH.exe	26120c2a9aed3b2fad928503d9c79cb918c4216484ef7d17f0fb32a1318ba7f2.exe
File created	C:\Windows\System\HoJGYez.exe	26120c2a9aed3b2fad928503d9c79cb918c4216484ef7d17f0fb32a1318ba7f2.exe
File created	C:\Windows\System\qkVMOjj.exe	26120c2a9aed3b2fad928503d9c79cb918c4216484ef7d17f0fb32a1318ba7f2.exe
File created	C:\Windows\System\Rpirdzp.exe	26120c2a9aed3b2fad928503d9c79cb918c4216484ef7d17f0fb32a1318ba7f2.exe
File created	C:\Windows\System\puVFQrY.exe	26120c2a9aed3b2fad928503d9c79cb918c4216484ef7d17f0fb32a1318ba7f2.exe
File created	C:\Windows\System\EYhqeEx.exe	26120c2a9aed3b2fad928503d9c79cb918c4216484ef7d17f0fb32a1318ba7f2.exe
File created	C:\Windows\System\pQPzvAW.exe	26120c2a9aed3b2fad928503d9c79cb918c4216484ef7d17f0fb32a1318ba7f2.exe
File created	C:\Windows\System\KUxEmOp.exe	26120c2a9aed3b2fad928503d9c79cb918c4216484ef7d17f0fb32a1318ba7f2.exe
File created	C:\Windows\System\DpoYGiX.exe	26120c2a9aed3b2fad928503d9c79cb918c4216484ef7d17f0fb32a1318ba7f2.exe
File created	C:\Windows\System\qolEQZt.exe	26120c2a9aed3b2fad928503d9c79cb918c4216484ef7d17f0fb32a1318ba7f2.exe
File created	C:\Windows\System\uBDxtdY.exe	26120c2a9aed3b2fad928503d9c79cb918c4216484ef7d17f0fb32a1318ba7f2.exe
File created	C:\Windows\System\ARbEGey.exe	26120c2a9aed3b2fad928503d9c79cb918c4216484ef7d17f0fb32a1318ba7f2.exe
File created	C:\Windows\System\xSHiPOE.exe	26120c2a9aed3b2fad928503d9c79cb918c4216484ef7d17f0fb32a1318ba7f2.exe
File created	C:\Windows\System\PPqSiJs.exe	26120c2a9aed3b2fad928503d9c79cb918c4216484ef7d17f0fb32a1318ba7f2.exe
File created	C:\Windows\System\saMQhWC.exe	26120c2a9aed3b2fad928503d9c79cb918c4216484ef7d17f0fb32a1318ba7f2.exe
File created	C:\Windows\System\YqKPJeI.exe	26120c2a9aed3b2fad928503d9c79cb918c4216484ef7d17f0fb32a1318ba7f2.exe
File created	C:\Windows\System\MAStAnO.exe	26120c2a9aed3b2fad928503d9c79cb918c4216484ef7d17f0fb32a1318ba7f2.exe
File created	C:\Windows\System\NipgDzj.exe	26120c2a9aed3b2fad928503d9c79cb918c4216484ef7d17f0fb32a1318ba7f2.exe
File created	C:\Windows\System\TZvjMpR.exe	26120c2a9aed3b2fad928503d9c79cb918c4216484ef7d17f0fb32a1318ba7f2.exe
File created	C:\Windows\System\eXorkPs.exe	26120c2a9aed3b2fad928503d9c79cb918c4216484ef7d17f0fb32a1318ba7f2.exe
File created	C:\Windows\System\JGwKdfw.exe	26120c2a9aed3b2fad928503d9c79cb918c4216484ef7d17f0fb32a1318ba7f2.exe
File created	C:\Windows\System\QAgLrzH.exe	26120c2a9aed3b2fad928503d9c79cb918c4216484ef7d17f0fb32a1318ba7f2.exe
File created	C:\Windows\System\TMHhQwD.exe	26120c2a9aed3b2fad928503d9c79cb918c4216484ef7d17f0fb32a1318ba7f2.exe
File created	C:\Windows\System\WflauIj.exe	26120c2a9aed3b2fad928503d9c79cb918c4216484ef7d17f0fb32a1318ba7f2.exe
File created	C:\Windows\System\QapDlsA.exe	26120c2a9aed3b2fad928503d9c79cb918c4216484ef7d17f0fb32a1318ba7f2.exe
File created	C:\Windows\System\qayRMdg.exe	26120c2a9aed3b2fad928503d9c79cb918c4216484ef7d17f0fb32a1318ba7f2.exe
File created	C:\Windows\System\lmzMvYj.exe	26120c2a9aed3b2fad928503d9c79cb918c4216484ef7d17f0fb32a1318ba7f2.exe
File created	C:\Windows\System\AKbNLAJ.exe	26120c2a9aed3b2fad928503d9c79cb918c4216484ef7d17f0fb32a1318ba7f2.exe
File created	C:\Windows\System\nSvACUw.exe	26120c2a9aed3b2fad928503d9c79cb918c4216484ef7d17f0fb32a1318ba7f2.exe
File created	C:\Windows\System\lFoAACX.exe	26120c2a9aed3b2fad928503d9c79cb918c4216484ef7d17f0fb32a1318ba7f2.exe
File created	C:\Windows\System\kvTstuV.exe	26120c2a9aed3b2fad928503d9c79cb918c4216484ef7d17f0fb32a1318ba7f2.exe
File created	C:\Windows\System\RocRYKE.exe	26120c2a9aed3b2fad928503d9c79cb918c4216484ef7d17f0fb32a1318ba7f2.exe
File created	C:\Windows\System\wbTcPef.exe	26120c2a9aed3b2fad928503d9c79cb918c4216484ef7d17f0fb32a1318ba7f2.exe
File created	C:\Windows\System\QpuKAJM.exe	26120c2a9aed3b2fad928503d9c79cb918c4216484ef7d17f0fb32a1318ba7f2.exe
File created	C:\Windows\System\hLuRtDE.exe	26120c2a9aed3b2fad928503d9c79cb918c4216484ef7d17f0fb32a1318ba7f2.exe
File created	C:\Windows\System\EMIcfnY.exe	26120c2a9aed3b2fad928503d9c79cb918c4216484ef7d17f0fb32a1318ba7f2.exe
File created	C:\Windows\System\hJQxQIB.exe	26120c2a9aed3b2fad928503d9c79cb918c4216484ef7d17f0fb32a1318ba7f2.exe
File created	C:\Windows\System\jBsMdgW.exe	26120c2a9aed3b2fad928503d9c79cb918c4216484ef7d17f0fb32a1318ba7f2.exe
File created	C:\Windows\System\msCsbVW.exe	26120c2a9aed3b2fad928503d9c79cb918c4216484ef7d17f0fb32a1318ba7f2.exe
File created	C:\Windows\System\VFtqwCh.exe	26120c2a9aed3b2fad928503d9c79cb918c4216484ef7d17f0fb32a1318ba7f2.exe
File created	C:\Windows\System\pSRwzMU.exe	26120c2a9aed3b2fad928503d9c79cb918c4216484ef7d17f0fb32a1318ba7f2.exe
File created	C:\Windows\System\YJUFoLm.exe	26120c2a9aed3b2fad928503d9c79cb918c4216484ef7d17f0fb32a1318ba7f2.exe
File created	C:\Windows\System\EzmGqcP.exe	26120c2a9aed3b2fad928503d9c79cb918c4216484ef7d17f0fb32a1318ba7f2.exe
File created	C:\Windows\System\FKmUSBw.exe	26120c2a9aed3b2fad928503d9c79cb918c4216484ef7d17f0fb32a1318ba7f2.exe
File created	C:\Windows\System\uGYkMGq.exe	26120c2a9aed3b2fad928503d9c79cb918c4216484ef7d17f0fb32a1318ba7f2.exe
File created	C:\Windows\System\BiZeuLn.exe	26120c2a9aed3b2fad928503d9c79cb918c4216484ef7d17f0fb32a1318ba7f2.exe
File created	C:\Windows\System\PZuDtxa.exe	26120c2a9aed3b2fad928503d9c79cb918c4216484ef7d17f0fb32a1318ba7f2.exe
File created	C:\Windows\System\fdOvNUl.exe	26120c2a9aed3b2fad928503d9c79cb918c4216484ef7d17f0fb32a1318ba7f2.exe
File created	C:\Windows\System\pLTOZBA.exe	26120c2a9aed3b2fad928503d9c79cb918c4216484ef7d17f0fb32a1318ba7f2.exe
File created	C:\Windows\System\sjVcFIi.exe	26120c2a9aed3b2fad928503d9c79cb918c4216484ef7d17f0fb32a1318ba7f2.exe
File created	C:\Windows\System\HdKXAhu.exe	26120c2a9aed3b2fad928503d9c79cb918c4216484ef7d17f0fb32a1318ba7f2.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	16848	dwm.exe
Token: SeChangeNotifyPrivilege	16848	dwm.exe
Token: 33	16848	dwm.exe
Token: SeIncBasePriorityPrivilege	16848	dwm.exe
Token: SeShutdownPrivilege	16848	dwm.exe
Token: SeCreatePagefilePrivilege	16848	dwm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4140 wrote to memory of 4092	4140	26120c2a9aed3b2fad928503d9c79cb918c4216484ef7d17f0fb32a1318ba7f2.exe	86
PID 4140 wrote to memory of 4092	4140	26120c2a9aed3b2fad928503d9c79cb918c4216484ef7d17f0fb32a1318ba7f2.exe	86
PID 4140 wrote to memory of 1208	4140	26120c2a9aed3b2fad928503d9c79cb918c4216484ef7d17f0fb32a1318ba7f2.exe	87
PID 4140 wrote to memory of 1208	4140	26120c2a9aed3b2fad928503d9c79cb918c4216484ef7d17f0fb32a1318ba7f2.exe	87
PID 4140 wrote to memory of 2936	4140	26120c2a9aed3b2fad928503d9c79cb918c4216484ef7d17f0fb32a1318ba7f2.exe	88
PID 4140 wrote to memory of 2936	4140	26120c2a9aed3b2fad928503d9c79cb918c4216484ef7d17f0fb32a1318ba7f2.exe	88
PID 4140 wrote to memory of 1416	4140	26120c2a9aed3b2fad928503d9c79cb918c4216484ef7d17f0fb32a1318ba7f2.exe	89
PID 4140 wrote to memory of 1416	4140	26120c2a9aed3b2fad928503d9c79cb918c4216484ef7d17f0fb32a1318ba7f2.exe	89
PID 4140 wrote to memory of 3816	4140	26120c2a9aed3b2fad928503d9c79cb918c4216484ef7d17f0fb32a1318ba7f2.exe	90
PID 4140 wrote to memory of 3816	4140	26120c2a9aed3b2fad928503d9c79cb918c4216484ef7d17f0fb32a1318ba7f2.exe	90
PID 4140 wrote to memory of 4152	4140	26120c2a9aed3b2fad928503d9c79cb918c4216484ef7d17f0fb32a1318ba7f2.exe	91
PID 4140 wrote to memory of 4152	4140	26120c2a9aed3b2fad928503d9c79cb918c4216484ef7d17f0fb32a1318ba7f2.exe	91
PID 4140 wrote to memory of 3688	4140	26120c2a9aed3b2fad928503d9c79cb918c4216484ef7d17f0fb32a1318ba7f2.exe	93
PID 4140 wrote to memory of 3688	4140	26120c2a9aed3b2fad928503d9c79cb918c4216484ef7d17f0fb32a1318ba7f2.exe	93
PID 4140 wrote to memory of 3188	4140	26120c2a9aed3b2fad928503d9c79cb918c4216484ef7d17f0fb32a1318ba7f2.exe	94
PID 4140 wrote to memory of 3188	4140	26120c2a9aed3b2fad928503d9c79cb918c4216484ef7d17f0fb32a1318ba7f2.exe	94
PID 4140 wrote to memory of 1792	4140	26120c2a9aed3b2fad928503d9c79cb918c4216484ef7d17f0fb32a1318ba7f2.exe	95
PID 4140 wrote to memory of 1792	4140	26120c2a9aed3b2fad928503d9c79cb918c4216484ef7d17f0fb32a1318ba7f2.exe	95
PID 4140 wrote to memory of 836	4140	26120c2a9aed3b2fad928503d9c79cb918c4216484ef7d17f0fb32a1318ba7f2.exe	96
PID 4140 wrote to memory of 836	4140	26120c2a9aed3b2fad928503d9c79cb918c4216484ef7d17f0fb32a1318ba7f2.exe	96
PID 4140 wrote to memory of 2688	4140	26120c2a9aed3b2fad928503d9c79cb918c4216484ef7d17f0fb32a1318ba7f2.exe	97
PID 4140 wrote to memory of 2688	4140	26120c2a9aed3b2fad928503d9c79cb918c4216484ef7d17f0fb32a1318ba7f2.exe	97
PID 4140 wrote to memory of 4992	4140	26120c2a9aed3b2fad928503d9c79cb918c4216484ef7d17f0fb32a1318ba7f2.exe	98
PID 4140 wrote to memory of 4992	4140	26120c2a9aed3b2fad928503d9c79cb918c4216484ef7d17f0fb32a1318ba7f2.exe	98
PID 4140 wrote to memory of 4556	4140	26120c2a9aed3b2fad928503d9c79cb918c4216484ef7d17f0fb32a1318ba7f2.exe	99
PID 4140 wrote to memory of 4556	4140	26120c2a9aed3b2fad928503d9c79cb918c4216484ef7d17f0fb32a1318ba7f2.exe	99
PID 4140 wrote to memory of 3396	4140	26120c2a9aed3b2fad928503d9c79cb918c4216484ef7d17f0fb32a1318ba7f2.exe	100
PID 4140 wrote to memory of 3396	4140	26120c2a9aed3b2fad928503d9c79cb918c4216484ef7d17f0fb32a1318ba7f2.exe	100
PID 4140 wrote to memory of 3828	4140	26120c2a9aed3b2fad928503d9c79cb918c4216484ef7d17f0fb32a1318ba7f2.exe	101
PID 4140 wrote to memory of 3828	4140	26120c2a9aed3b2fad928503d9c79cb918c4216484ef7d17f0fb32a1318ba7f2.exe	101
PID 4140 wrote to memory of 2296	4140	26120c2a9aed3b2fad928503d9c79cb918c4216484ef7d17f0fb32a1318ba7f2.exe	102
PID 4140 wrote to memory of 2296	4140	26120c2a9aed3b2fad928503d9c79cb918c4216484ef7d17f0fb32a1318ba7f2.exe	102
PID 4140 wrote to memory of 4028	4140	26120c2a9aed3b2fad928503d9c79cb918c4216484ef7d17f0fb32a1318ba7f2.exe	103
PID 4140 wrote to memory of 4028	4140	26120c2a9aed3b2fad928503d9c79cb918c4216484ef7d17f0fb32a1318ba7f2.exe	103
PID 4140 wrote to memory of 3472	4140	26120c2a9aed3b2fad928503d9c79cb918c4216484ef7d17f0fb32a1318ba7f2.exe	104
PID 4140 wrote to memory of 3472	4140	26120c2a9aed3b2fad928503d9c79cb918c4216484ef7d17f0fb32a1318ba7f2.exe	104
PID 4140 wrote to memory of 3036	4140	26120c2a9aed3b2fad928503d9c79cb918c4216484ef7d17f0fb32a1318ba7f2.exe	105
PID 4140 wrote to memory of 3036	4140	26120c2a9aed3b2fad928503d9c79cb918c4216484ef7d17f0fb32a1318ba7f2.exe	105
PID 4140 wrote to memory of 3664	4140	26120c2a9aed3b2fad928503d9c79cb918c4216484ef7d17f0fb32a1318ba7f2.exe	106
PID 4140 wrote to memory of 3664	4140	26120c2a9aed3b2fad928503d9c79cb918c4216484ef7d17f0fb32a1318ba7f2.exe	106
PID 4140 wrote to memory of 2392	4140	26120c2a9aed3b2fad928503d9c79cb918c4216484ef7d17f0fb32a1318ba7f2.exe	107
PID 4140 wrote to memory of 2392	4140	26120c2a9aed3b2fad928503d9c79cb918c4216484ef7d17f0fb32a1318ba7f2.exe	107
PID 4140 wrote to memory of 3124	4140	26120c2a9aed3b2fad928503d9c79cb918c4216484ef7d17f0fb32a1318ba7f2.exe	108
PID 4140 wrote to memory of 3124	4140	26120c2a9aed3b2fad928503d9c79cb918c4216484ef7d17f0fb32a1318ba7f2.exe	108
PID 4140 wrote to memory of 3476	4140	26120c2a9aed3b2fad928503d9c79cb918c4216484ef7d17f0fb32a1318ba7f2.exe	109
PID 4140 wrote to memory of 3476	4140	26120c2a9aed3b2fad928503d9c79cb918c4216484ef7d17f0fb32a1318ba7f2.exe	109
PID 4140 wrote to memory of 2096	4140	26120c2a9aed3b2fad928503d9c79cb918c4216484ef7d17f0fb32a1318ba7f2.exe	110
PID 4140 wrote to memory of 2096	4140	26120c2a9aed3b2fad928503d9c79cb918c4216484ef7d17f0fb32a1318ba7f2.exe	110
PID 4140 wrote to memory of 4224	4140	26120c2a9aed3b2fad928503d9c79cb918c4216484ef7d17f0fb32a1318ba7f2.exe	111
PID 4140 wrote to memory of 4224	4140	26120c2a9aed3b2fad928503d9c79cb918c4216484ef7d17f0fb32a1318ba7f2.exe	111
PID 4140 wrote to memory of 3044	4140	26120c2a9aed3b2fad928503d9c79cb918c4216484ef7d17f0fb32a1318ba7f2.exe	112
PID 4140 wrote to memory of 3044	4140	26120c2a9aed3b2fad928503d9c79cb918c4216484ef7d17f0fb32a1318ba7f2.exe	112
PID 4140 wrote to memory of 4912	4140	26120c2a9aed3b2fad928503d9c79cb918c4216484ef7d17f0fb32a1318ba7f2.exe	113
PID 4140 wrote to memory of 4912	4140	26120c2a9aed3b2fad928503d9c79cb918c4216484ef7d17f0fb32a1318ba7f2.exe	113
PID 4140 wrote to memory of 2440	4140	26120c2a9aed3b2fad928503d9c79cb918c4216484ef7d17f0fb32a1318ba7f2.exe	114
PID 4140 wrote to memory of 2440	4140	26120c2a9aed3b2fad928503d9c79cb918c4216484ef7d17f0fb32a1318ba7f2.exe	114
PID 4140 wrote to memory of 1532	4140	26120c2a9aed3b2fad928503d9c79cb918c4216484ef7d17f0fb32a1318ba7f2.exe	115
PID 4140 wrote to memory of 1532	4140	26120c2a9aed3b2fad928503d9c79cb918c4216484ef7d17f0fb32a1318ba7f2.exe	115
PID 4140 wrote to memory of 2636	4140	26120c2a9aed3b2fad928503d9c79cb918c4216484ef7d17f0fb32a1318ba7f2.exe	116
PID 4140 wrote to memory of 2636	4140	26120c2a9aed3b2fad928503d9c79cb918c4216484ef7d17f0fb32a1318ba7f2.exe	116
PID 4140 wrote to memory of 2028	4140	26120c2a9aed3b2fad928503d9c79cb918c4216484ef7d17f0fb32a1318ba7f2.exe	117
PID 4140 wrote to memory of 2028	4140	26120c2a9aed3b2fad928503d9c79cb918c4216484ef7d17f0fb32a1318ba7f2.exe	117
PID 4140 wrote to memory of 2292	4140	26120c2a9aed3b2fad928503d9c79cb918c4216484ef7d17f0fb32a1318ba7f2.exe	118
PID 4140 wrote to memory of 2292	4140	26120c2a9aed3b2fad928503d9c79cb918c4216484ef7d17f0fb32a1318ba7f2.exe	118

C:\Users\Admin\AppData\Local\Temp\26120c2a9aed3b2fad928503d9c79cb918c4216484ef7d17f0fb32a1318ba7f2.exe
"C:\Users\Admin\AppData\Local\Temp\26120c2a9aed3b2fad928503d9c79cb918c4216484ef7d17f0fb32a1318ba7f2.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4140
- C:\Windows\System\dxCoEih.exe
  C:\Windows\System\dxCoEih.exe
  2⤵
  - Executes dropped EXE
  PID:4092
- C:\Windows\System\DLKsRZV.exe
  C:\Windows\System\DLKsRZV.exe
  2⤵
  - Executes dropped EXE
  PID:1208
- C:\Windows\System\hcPXHAW.exe
  C:\Windows\System\hcPXHAW.exe
  2⤵
  - Executes dropped EXE
  PID:2936
- C:\Windows\System\WhEvgMU.exe
  C:\Windows\System\WhEvgMU.exe
  2⤵
  - Executes dropped EXE
  PID:1416
- C:\Windows\System\ccLdmlb.exe
  C:\Windows\System\ccLdmlb.exe
  2⤵
  - Executes dropped EXE
  PID:3816
- C:\Windows\System\SIcHdMA.exe
  C:\Windows\System\SIcHdMA.exe
  2⤵
  - Executes dropped EXE
  PID:4152
- C:\Windows\System\DrROtnK.exe
  C:\Windows\System\DrROtnK.exe
  2⤵
  - Executes dropped EXE
  PID:3688
- C:\Windows\System\gMcTmDU.exe
  C:\Windows\System\gMcTmDU.exe
  2⤵
  - Executes dropped EXE
  PID:3188
- C:\Windows\System\QdyTnzY.exe
  C:\Windows\System\QdyTnzY.exe
  2⤵
  - Executes dropped EXE
  PID:1792
- C:\Windows\System\ucdrpAi.exe
  C:\Windows\System\ucdrpAi.exe
  2⤵
  - Executes dropped EXE
  PID:836
- C:\Windows\System\FUSZuGu.exe
  C:\Windows\System\FUSZuGu.exe
  2⤵
  - Executes dropped EXE
  PID:2688
- C:\Windows\System\lPDNqks.exe
  C:\Windows\System\lPDNqks.exe
  2⤵
  - Executes dropped EXE
  PID:4992
- C:\Windows\System\WxkbLGC.exe
  C:\Windows\System\WxkbLGC.exe
  2⤵
  - Executes dropped EXE
  PID:4556
- C:\Windows\System\XXEWGWR.exe
  C:\Windows\System\XXEWGWR.exe
  2⤵
  - Executes dropped EXE
  PID:3396
- C:\Windows\System\mHFMmYv.exe
  C:\Windows\System\mHFMmYv.exe
  2⤵
  - Executes dropped EXE
  PID:3828
- C:\Windows\System\ExcGYPl.exe
  C:\Windows\System\ExcGYPl.exe
  2⤵
  - Executes dropped EXE
  PID:2296
- C:\Windows\System\QANnfOb.exe
  C:\Windows\System\QANnfOb.exe
  2⤵
  - Executes dropped EXE
  PID:4028
- C:\Windows\System\mYxgGhD.exe
  C:\Windows\System\mYxgGhD.exe
  2⤵
  - Executes dropped EXE
  PID:3472
- C:\Windows\System\APlFpRX.exe
  C:\Windows\System\APlFpRX.exe
  2⤵
  - Executes dropped EXE
  PID:3036
- C:\Windows\System\WflauIj.exe
  C:\Windows\System\WflauIj.exe
  2⤵
  - Executes dropped EXE
  PID:3664
- C:\Windows\System\FKmUSBw.exe
  C:\Windows\System\FKmUSBw.exe
  2⤵
  - Executes dropped EXE
  PID:2392
- C:\Windows\System\QdQfCrw.exe
  C:\Windows\System\QdQfCrw.exe
  2⤵
  - Executes dropped EXE
  PID:3124
- C:\Windows\System\VyxydFW.exe
  C:\Windows\System\VyxydFW.exe
  2⤵
  - Executes dropped EXE
  PID:3476
- C:\Windows\System\QkzSceR.exe
  C:\Windows\System\QkzSceR.exe
  2⤵
  - Executes dropped EXE
  PID:2096
- C:\Windows\System\bYcGIHX.exe
  C:\Windows\System\bYcGIHX.exe
  2⤵
  - Executes dropped EXE
  PID:4224
- C:\Windows\System\XqFCfql.exe
  C:\Windows\System\XqFCfql.exe
  2⤵
  - Executes dropped EXE
  PID:3044
- C:\Windows\System\tJNBWkO.exe
  C:\Windows\System\tJNBWkO.exe
  2⤵
  - Executes dropped EXE
  PID:4912
- C:\Windows\System\xOcNFaA.exe
  C:\Windows\System\xOcNFaA.exe
  2⤵
  - Executes dropped EXE
  PID:2440
- C:\Windows\System\rajpjhM.exe
  C:\Windows\System\rajpjhM.exe
  2⤵
  - Executes dropped EXE
  PID:1532
- C:\Windows\System\oXlUdBh.exe
  C:\Windows\System\oXlUdBh.exe
  2⤵
  - Executes dropped EXE
  PID:2636
- C:\Windows\System\aWndquN.exe
  C:\Windows\System\aWndquN.exe
  2⤵
  - Executes dropped EXE
  PID:2028
- C:\Windows\System\IjoPogp.exe
  C:\Windows\System\IjoPogp.exe
  2⤵
  - Executes dropped EXE
  PID:2292
- C:\Windows\System\DNvWmfj.exe
  C:\Windows\System\DNvWmfj.exe
  2⤵
  - Executes dropped EXE
  PID:4560
- C:\Windows\System\fOWTHzm.exe
  C:\Windows\System\fOWTHzm.exe
  2⤵
  - Executes dropped EXE
  PID:4980
- C:\Windows\System\uDlaCuA.exe
  C:\Windows\System\uDlaCuA.exe
  2⤵
  - Executes dropped EXE
  PID:4976
- C:\Windows\System\QgoNnpA.exe
  C:\Windows\System\QgoNnpA.exe
  2⤵
  - Executes dropped EXE
  PID:972
- C:\Windows\System\EMIcfnY.exe
  C:\Windows\System\EMIcfnY.exe
  2⤵
  - Executes dropped EXE
  PID:5100
- C:\Windows\System\BYGPMie.exe
  C:\Windows\System\BYGPMie.exe
  2⤵
  - Executes dropped EXE
  PID:3768
- C:\Windows\System\tayxEjR.exe
  C:\Windows\System\tayxEjR.exe
  2⤵
  - Executes dropped EXE
  PID:4728
- C:\Windows\System\KDNCuEu.exe
  C:\Windows\System\KDNCuEu.exe
  2⤵
  - Executes dropped EXE
  PID:540
- C:\Windows\System\oQAVrzt.exe
  C:\Windows\System\oQAVrzt.exe
  2⤵
  - Executes dropped EXE
  PID:4756
- C:\Windows\System\JmIAMwi.exe
  C:\Windows\System\JmIAMwi.exe
  2⤵
  - Executes dropped EXE
  PID:4312
- C:\Windows\System\KQTCyMf.exe
  C:\Windows\System\KQTCyMf.exe
  2⤵
  - Executes dropped EXE
  PID:4840
- C:\Windows\System\jLJgauD.exe
  C:\Windows\System\jLJgauD.exe
  2⤵
  - Executes dropped EXE
  PID:1312
- C:\Windows\System\XdGMdTr.exe
  C:\Windows\System\XdGMdTr.exe
  2⤵
  - Executes dropped EXE
  PID:4052
- C:\Windows\System\NoZGxPZ.exe
  C:\Windows\System\NoZGxPZ.exe
  2⤵
  - Executes dropped EXE
  PID:448
- C:\Windows\System\zjJhGZH.exe
  C:\Windows\System\zjJhGZH.exe
  2⤵
  - Executes dropped EXE
  PID:2248
- C:\Windows\System\AXCplSw.exe
  C:\Windows\System\AXCplSw.exe
  2⤵
  - Executes dropped EXE
  PID:2500
- C:\Windows\System\VXiCKrp.exe
  C:\Windows\System\VXiCKrp.exe
  2⤵
  - Executes dropped EXE
  PID:3512
- C:\Windows\System\TvQHHRQ.exe
  C:\Windows\System\TvQHHRQ.exe
  2⤵
  - Executes dropped EXE
  PID:1124
- C:\Windows\System\THUxtBv.exe
  C:\Windows\System\THUxtBv.exe
  2⤵
  - Executes dropped EXE
  PID:2264
- C:\Windows\System\oOXCzOY.exe
  C:\Windows\System\oOXCzOY.exe
  2⤵
  - Executes dropped EXE
  PID:2956
- C:\Windows\System\MxBPsRz.exe
  C:\Windows\System\MxBPsRz.exe
  2⤵
  - Executes dropped EXE
  PID:3132
- C:\Windows\System\OnOgCFW.exe
  C:\Windows\System\OnOgCFW.exe
  2⤵
  - Executes dropped EXE
  PID:1908
- C:\Windows\System\VpcjDmA.exe
  C:\Windows\System\VpcjDmA.exe
  2⤵
  - Executes dropped EXE
  PID:3184
- C:\Windows\System\jbFBUoU.exe
  C:\Windows\System\jbFBUoU.exe
  2⤵
  - Executes dropped EXE
  PID:2092
- C:\Windows\System\ecSUvCd.exe
  C:\Windows\System\ecSUvCd.exe
  2⤵
  - Executes dropped EXE
  PID:1008
- C:\Windows\System\waIyXOC.exe
  C:\Windows\System\waIyXOC.exe
  2⤵
  - Executes dropped EXE
  PID:4488
- C:\Windows\System\EdbZKlc.exe
  C:\Windows\System\EdbZKlc.exe
  2⤵
  - Executes dropped EXE
  PID:4544
- C:\Windows\System\GHOPyHk.exe
  C:\Windows\System\GHOPyHk.exe
  2⤵
  - Executes dropped EXE
  PID:2044
- C:\Windows\System\RyMyJfZ.exe
  C:\Windows\System\RyMyJfZ.exe
  2⤵
  - Executes dropped EXE
  PID:220
- C:\Windows\System\kQQhoqf.exe
  C:\Windows\System\kQQhoqf.exe
  2⤵
  - Executes dropped EXE
  PID:2460
- C:\Windows\System\eUbXfnl.exe
  C:\Windows\System\eUbXfnl.exe
  2⤵
  - Executes dropped EXE
  PID:2584
- C:\Windows\System\jgwZzLt.exe
  C:\Windows\System\jgwZzLt.exe
  2⤵
  - Executes dropped EXE
  PID:3068
- C:\Windows\System\UMgSblC.exe
  C:\Windows\System\UMgSblC.exe
  2⤵
  PID:1380
- C:\Windows\System\PWewNuY.exe
  C:\Windows\System\PWewNuY.exe
  2⤵
  PID:2080
- C:\Windows\System\ebAGOPk.exe
  C:\Windows\System\ebAGOPk.exe
  2⤵
  PID:556
- C:\Windows\System\OepVBHl.exe
  C:\Windows\System\OepVBHl.exe
  2⤵
  PID:3140
- C:\Windows\System\KsqIsha.exe
  C:\Windows\System\KsqIsha.exe
  2⤵
  PID:4920
- C:\Windows\System\bawqfRF.exe
  C:\Windows\System\bawqfRF.exe
  2⤵
  PID:4812
- C:\Windows\System\NXGnBXo.exe
  C:\Windows\System\NXGnBXo.exe
  2⤵
  PID:4936
- C:\Windows\System\yxuoAHg.exe
  C:\Windows\System\yxuoAHg.exe
  2⤵
  PID:5152
- C:\Windows\System\cegTxdF.exe
  C:\Windows\System\cegTxdF.exe
  2⤵
  PID:5180
- C:\Windows\System\dOccRZU.exe
  C:\Windows\System\dOccRZU.exe
  2⤵
  PID:5208
- C:\Windows\System\KJBhwIN.exe
  C:\Windows\System\KJBhwIN.exe
  2⤵
  PID:5232
- C:\Windows\System\HNSkgxa.exe
  C:\Windows\System\HNSkgxa.exe
  2⤵
  PID:5260
- C:\Windows\System\YiEOXYS.exe
  C:\Windows\System\YiEOXYS.exe
  2⤵
  PID:5288
- C:\Windows\System\jpnNKRm.exe
  C:\Windows\System\jpnNKRm.exe
  2⤵
  PID:5312
- C:\Windows\System\KfYIgdL.exe
  C:\Windows\System\KfYIgdL.exe
  2⤵
  PID:5344
- C:\Windows\System\YalmMNp.exe
  C:\Windows\System\YalmMNp.exe
  2⤵
  PID:5372
- C:\Windows\System\jKVNzXZ.exe
  C:\Windows\System\jKVNzXZ.exe
  2⤵
  PID:5396
- C:\Windows\System\OVbGmjk.exe
  C:\Windows\System\OVbGmjk.exe
  2⤵
  PID:5428
- C:\Windows\System\QmjJfKV.exe
  C:\Windows\System\QmjJfKV.exe
  2⤵
  PID:5452
- C:\Windows\System\XmifuLk.exe
  C:\Windows\System\XmifuLk.exe
  2⤵
  PID:5484
- C:\Windows\System\jrGJrJA.exe
  C:\Windows\System\jrGJrJA.exe
  2⤵
  PID:5508
- C:\Windows\System\xaaSEqH.exe
  C:\Windows\System\xaaSEqH.exe
  2⤵
  PID:5540
- C:\Windows\System\ArtHiAk.exe
  C:\Windows\System\ArtHiAk.exe
  2⤵
  PID:5568
- C:\Windows\System\qjcFPLA.exe
  C:\Windows\System\qjcFPLA.exe
  2⤵
  PID:5596
- C:\Windows\System\UdQTUUL.exe
  C:\Windows\System\UdQTUUL.exe
  2⤵
  PID:5628
- C:\Windows\System\QDvGWVT.exe
  C:\Windows\System\QDvGWVT.exe
  2⤵
  PID:5652
- C:\Windows\System\nSvACUw.exe
  C:\Windows\System\nSvACUw.exe
  2⤵
  PID:5680
- C:\Windows\System\gcdCUqR.exe
  C:\Windows\System\gcdCUqR.exe
  2⤵
  PID:5708
- C:\Windows\System\kthugoa.exe
  C:\Windows\System\kthugoa.exe
  2⤵
  PID:5736
- C:\Windows\System\iCWYSjt.exe
  C:\Windows\System\iCWYSjt.exe
  2⤵
  PID:5768
- C:\Windows\System\epbdIRn.exe
  C:\Windows\System\epbdIRn.exe
  2⤵
  PID:5792
- C:\Windows\System\wSbgUVK.exe
  C:\Windows\System\wSbgUVK.exe
  2⤵
  PID:5824
- C:\Windows\System\ARSqgUy.exe
  C:\Windows\System\ARSqgUy.exe
  2⤵
  PID:5848
- C:\Windows\System\bLcxDwP.exe
  C:\Windows\System\bLcxDwP.exe
  2⤵
  PID:5880
- C:\Windows\System\yUIkmAV.exe
  C:\Windows\System\yUIkmAV.exe
  2⤵
  PID:5904
- C:\Windows\System\aWbZUhT.exe
  C:\Windows\System\aWbZUhT.exe
  2⤵
  PID:5932
- C:\Windows\System\rsfcbQs.exe
  C:\Windows\System\rsfcbQs.exe
  2⤵
  PID:5960
- C:\Windows\System\sKDXyWt.exe
  C:\Windows\System\sKDXyWt.exe
  2⤵
  PID:5992
- C:\Windows\System\WSaudrj.exe
  C:\Windows\System\WSaudrj.exe
  2⤵
  PID:6016
- C:\Windows\System\YqpKVUS.exe
  C:\Windows\System\YqpKVUS.exe
  2⤵
  PID:6040
- C:\Windows\System\kvNNnhO.exe
  C:\Windows\System\kvNNnhO.exe
  2⤵
  PID:6064
- C:\Windows\System\OoLREyM.exe
  C:\Windows\System\OoLREyM.exe
  2⤵
  PID:6124
- C:\Windows\System\tKuDmPD.exe
  C:\Windows\System\tKuDmPD.exe
  2⤵
  PID:3020
- C:\Windows\System\dZKXZjJ.exe
  C:\Windows\System\dZKXZjJ.exe
  2⤵
  PID:3520
- C:\Windows\System\otHlJBO.exe
  C:\Windows\System\otHlJBO.exe
  2⤵
  PID:3852
- C:\Windows\System\tpqtruZ.exe
  C:\Windows\System\tpqtruZ.exe
  2⤵
  PID:4932
- C:\Windows\System\KAsTfUl.exe
  C:\Windows\System\KAsTfUl.exe
  2⤵
  PID:5168
- C:\Windows\System\CoLFLpd.exe
  C:\Windows\System\CoLFLpd.exe
  2⤵
  PID:5224
- C:\Windows\System\WKaRqWh.exe
  C:\Windows\System\WKaRqWh.exe
  2⤵
  PID:5304
- C:\Windows\System\bGMfAmj.exe
  C:\Windows\System\bGMfAmj.exe
  2⤵
  PID:5360
- C:\Windows\System\ywoYrhH.exe
  C:\Windows\System\ywoYrhH.exe
  2⤵
  PID:5444
- C:\Windows\System\weUIDPf.exe
  C:\Windows\System\weUIDPf.exe
  2⤵
  PID:5496
- C:\Windows\System\SiJAwxA.exe
  C:\Windows\System\SiJAwxA.exe
  2⤵
  PID:4360
- C:\Windows\System\lFoAACX.exe
  C:\Windows\System\lFoAACX.exe
  2⤵
  PID:5588
- C:\Windows\System\PJXciFl.exe
  C:\Windows\System\PJXciFl.exe
  2⤵
  PID:5664
- C:\Windows\System\pQPzvAW.exe
  C:\Windows\System\pQPzvAW.exe
  2⤵
  PID:5700
- C:\Windows\System\oURoIzA.exe
  C:\Windows\System\oURoIzA.exe
  2⤵
  PID:5752
- C:\Windows\System\SjOicGc.exe
  C:\Windows\System\SjOicGc.exe
  2⤵
  PID:868
- C:\Windows\System\ghsFIev.exe
  C:\Windows\System\ghsFIev.exe
  2⤵
  PID:5860
- C:\Windows\System\dxGcXIZ.exe
  C:\Windows\System\dxGcXIZ.exe
  2⤵
  PID:1540
- C:\Windows\System\mPwhNRq.exe
  C:\Windows\System\mPwhNRq.exe
  2⤵
  PID:3324
- C:\Windows\System\eyclzEa.exe
  C:\Windows\System\eyclzEa.exe
  2⤵
  PID:1676
- C:\Windows\System\hJQxQIB.exe
  C:\Windows\System\hJQxQIB.exe
  2⤵
  PID:4836
- C:\Windows\System\UnWPsac.exe
  C:\Windows\System\UnWPsac.exe
  2⤵
  PID:3480
- C:\Windows\System\kZAARVu.exe
  C:\Windows\System\kZAARVu.exe
  2⤵
  PID:4548
- C:\Windows\System\KdmUJNb.exe
  C:\Windows\System\KdmUJNb.exe
  2⤵
  PID:3160
- C:\Windows\System\pSCvukH.exe
  C:\Windows\System\pSCvukH.exe
  2⤵
  PID:1740
- C:\Windows\System\WZlbBpt.exe
  C:\Windows\System\WZlbBpt.exe
  2⤵
  PID:6052
- C:\Windows\System\qkVMOjj.exe
  C:\Windows\System\qkVMOjj.exe
  2⤵
  PID:4432
- C:\Windows\System\MWWrkvC.exe
  C:\Windows\System\MWWrkvC.exe
  2⤵
  PID:3176
- C:\Windows\System\filbIHq.exe
  C:\Windows\System\filbIHq.exe
  2⤵
  PID:1584
- C:\Windows\System\bigyDiD.exe
  C:\Windows\System\bigyDiD.exe
  2⤵
  PID:1700
- C:\Windows\System\FQrutDp.exe
  C:\Windows\System\FQrutDp.exe
  2⤵
  PID:4296
- C:\Windows\System\nEsFLgf.exe
  C:\Windows\System\nEsFLgf.exe
  2⤵
  PID:1924
- C:\Windows\System\yOfODVq.exe
  C:\Windows\System\yOfODVq.exe
  2⤵
  PID:4524
- C:\Windows\System\paaDRyI.exe
  C:\Windows\System\paaDRyI.exe
  2⤵
  PID:5196
- C:\Windows\System\LQvpjlj.exe
  C:\Windows\System\LQvpjlj.exe
  2⤵
  PID:5416
- C:\Windows\System\UFPcsAB.exe
  C:\Windows\System\UFPcsAB.exe
  2⤵
  PID:4872
- C:\Windows\System\DZQYMie.exe
  C:\Windows\System\DZQYMie.exe
  2⤵
  PID:5616
- C:\Windows\System\gEyartD.exe
  C:\Windows\System\gEyartD.exe
  2⤵
  PID:228
- C:\Windows\System\rbimKUs.exe
  C:\Windows\System\rbimKUs.exe
  2⤵
  PID:1160
- C:\Windows\System\uGYkMGq.exe
  C:\Windows\System\uGYkMGq.exe
  2⤵
  PID:2232
- C:\Windows\System\dVkuuOl.exe
  C:\Windows\System\dVkuuOl.exe
  2⤵
  PID:1460
- C:\Windows\System\VXVClSE.exe
  C:\Windows\System\VXVClSE.exe
  2⤵
  PID:3040
- C:\Windows\System\XUWSOay.exe
  C:\Windows\System\XUWSOay.exe
  2⤵
  PID:6008
- C:\Windows\System\KlRTiiq.exe
  C:\Windows\System\KlRTiiq.exe
  2⤵
  PID:6028
- C:\Windows\System\bGaInMZ.exe
  C:\Windows\System\bGaInMZ.exe
  2⤵
  PID:3936
- C:\Windows\System\QeXuEGF.exe
  C:\Windows\System\QeXuEGF.exe
  2⤵
  PID:4740
- C:\Windows\System\qcBzyxx.exe
  C:\Windows\System\qcBzyxx.exe
  2⤵
  PID:3908
- C:\Windows\System\zwODqSm.exe
  C:\Windows\System\zwODqSm.exe
  2⤵
  PID:2648
- C:\Windows\System\ViYFveg.exe
  C:\Windows\System\ViYFveg.exe
  2⤵
  PID:4576
- C:\Windows\System\fJUBvPS.exe
  C:\Windows\System\fJUBvPS.exe
  2⤵
  PID:5560
- C:\Windows\System\lYxQxlF.exe
  C:\Windows\System\lYxQxlF.exe
  2⤵
  PID:5068
- C:\Windows\System\YvhLrdP.exe
  C:\Windows\System\YvhLrdP.exe
  2⤵
  PID:4824
- C:\Windows\System\PLdEAsA.exe
  C:\Windows\System\PLdEAsA.exe
  2⤵
  PID:4428
- C:\Windows\System\rkVygdV.exe
  C:\Windows\System\rkVygdV.exe
  2⤵
  PID:6112
- C:\Windows\System\CrKZZeo.exe
  C:\Windows\System\CrKZZeo.exe
  2⤵
  PID:4344
- C:\Windows\System\dwVYXeJ.exe
  C:\Windows\System\dwVYXeJ.exe
  2⤵
  PID:5840
- C:\Windows\System\ElEQKkD.exe
  C:\Windows\System\ElEQKkD.exe
  2⤵
  PID:1612
- C:\Windows\System\snPIjjR.exe
  C:\Windows\System\snPIjjR.exe
  2⤵
  PID:6152
- C:\Windows\System\MAStAnO.exe
  C:\Windows\System\MAStAnO.exe
  2⤵
  PID:6172
- C:\Windows\System\PPqSiJs.exe
  C:\Windows\System\PPqSiJs.exe
  2⤵
  PID:6200
- C:\Windows\System\ZHEJGLV.exe
  C:\Windows\System\ZHEJGLV.exe
  2⤵
  PID:6224
- C:\Windows\System\gmZmMJj.exe
  C:\Windows\System\gmZmMJj.exe
  2⤵
  PID:6244
- C:\Windows\System\Rpirdzp.exe
  C:\Windows\System\Rpirdzp.exe
  2⤵
  PID:6268
- C:\Windows\System\xqebLfh.exe
  C:\Windows\System\xqebLfh.exe
  2⤵
  PID:6292
- C:\Windows\System\enMVTRp.exe
  C:\Windows\System\enMVTRp.exe
  2⤵
  PID:6324
- C:\Windows\System\kUdtTlj.exe
  C:\Windows\System\kUdtTlj.exe
  2⤵
  PID:6348
- C:\Windows\System\rsYTZkZ.exe
  C:\Windows\System\rsYTZkZ.exe
  2⤵
  PID:6376
- C:\Windows\System\XhWyXZU.exe
  C:\Windows\System\XhWyXZU.exe
  2⤵
  PID:6404
- C:\Windows\System\BrusuLj.exe
  C:\Windows\System\BrusuLj.exe
  2⤵
  PID:6432
- C:\Windows\System\WecGBmH.exe
  C:\Windows\System\WecGBmH.exe
  2⤵
  PID:6456
- C:\Windows\System\lYMcLyh.exe
  C:\Windows\System\lYMcLyh.exe
  2⤵
  PID:6492
- C:\Windows\System\uxLJFBg.exe
  C:\Windows\System\uxLJFBg.exe
  2⤵
  PID:6524
- C:\Windows\System\ndzsTUu.exe
  C:\Windows\System\ndzsTUu.exe
  2⤵
  PID:6556
- C:\Windows\System\EQclVsN.exe
  C:\Windows\System\EQclVsN.exe
  2⤵
  PID:6580
- C:\Windows\System\Lbpulkb.exe
  C:\Windows\System\Lbpulkb.exe
  2⤵
  PID:6604
- C:\Windows\System\QapDlsA.exe
  C:\Windows\System\QapDlsA.exe
  2⤵
  PID:6628
- C:\Windows\System\jLnkgAq.exe
  C:\Windows\System\jLnkgAq.exe
  2⤵
  PID:6656
- C:\Windows\System\qmMGguB.exe
  C:\Windows\System\qmMGguB.exe
  2⤵
  PID:6680
- C:\Windows\System\OClgQID.exe
  C:\Windows\System\OClgQID.exe
  2⤵
  PID:6704
- C:\Windows\System\XhFLOIs.exe
  C:\Windows\System\XhFLOIs.exe
  2⤵
  PID:6736
- C:\Windows\System\GZBiLqI.exe
  C:\Windows\System\GZBiLqI.exe
  2⤵
  PID:6760
- C:\Windows\System\lJDrbMR.exe
  C:\Windows\System\lJDrbMR.exe
  2⤵
  PID:6792
- C:\Windows\System\SYeNbiU.exe
  C:\Windows\System\SYeNbiU.exe
  2⤵
  PID:6812
- C:\Windows\System\EeqnBaU.exe
  C:\Windows\System\EeqnBaU.exe
  2⤵
  PID:6836
- C:\Windows\System\ojSSwJl.exe
  C:\Windows\System\ojSSwJl.exe
  2⤵
  PID:6876
- C:\Windows\System\tODVTyk.exe
  C:\Windows\System\tODVTyk.exe
  2⤵
  PID:6900
- C:\Windows\System\wsFpRMO.exe
  C:\Windows\System\wsFpRMO.exe
  2⤵
  PID:6936
- C:\Windows\System\PphOJWN.exe
  C:\Windows\System\PphOJWN.exe
  2⤵
  PID:6996
- C:\Windows\System\XNqhWYY.exe
  C:\Windows\System\XNqhWYY.exe
  2⤵
  PID:7028
- C:\Windows\System\SjCUUZi.exe
  C:\Windows\System\SjCUUZi.exe
  2⤵
  PID:7060
- C:\Windows\System\doXtxfx.exe
  C:\Windows\System\doXtxfx.exe
  2⤵
  PID:7112
- C:\Windows\System\OkKQHVr.exe
  C:\Windows\System\OkKQHVr.exe
  2⤵
  PID:7140
- C:\Windows\System\BPmuWUk.exe
  C:\Windows\System\BPmuWUk.exe
  2⤵
  PID:1272
- C:\Windows\System\ucdmXWW.exe
  C:\Windows\System\ucdmXWW.exe
  2⤵
  PID:6232
- C:\Windows\System\uBDxtdY.exe
  C:\Windows\System\uBDxtdY.exe
  2⤵
  PID:6256
- C:\Windows\System\kvTstuV.exe
  C:\Windows\System\kvTstuV.exe
  2⤵
  PID:6284
- C:\Windows\System\kohAawE.exe
  C:\Windows\System\kohAawE.exe
  2⤵
  PID:6336
- C:\Windows\System\EAopQfO.exe
  C:\Windows\System\EAopQfO.exe
  2⤵
  PID:6416
- C:\Windows\System\KpVKrft.exe
  C:\Windows\System\KpVKrft.exe
  2⤵
  PID:6440
- C:\Windows\System\ecdBCgd.exe
  C:\Windows\System\ecdBCgd.exe
  2⤵
  PID:6448
- C:\Windows\System\glueGTe.exe
  C:\Windows\System\glueGTe.exe
  2⤵
  PID:6568
- C:\Windows\System\uJLsgHK.exe
  C:\Windows\System\uJLsgHK.exe
  2⤵
  PID:6616
- C:\Windows\System\sdAXLae.exe
  C:\Windows\System\sdAXLae.exe
  2⤵
  PID:6752
- C:\Windows\System\sjVcFIi.exe
  C:\Windows\System\sjVcFIi.exe
  2⤵
  PID:6692
- C:\Windows\System\yVUAtnO.exe
  C:\Windows\System\yVUAtnO.exe
  2⤵
  PID:6872
- C:\Windows\System\gWZVaVh.exe
  C:\Windows\System\gWZVaVh.exe
  2⤵
  PID:6944
- C:\Windows\System\JpJxlmS.exe
  C:\Windows\System\JpJxlmS.exe
  2⤵
  PID:6984
- C:\Windows\System\YrmsyFt.exe
  C:\Windows\System\YrmsyFt.exe
  2⤵
  PID:7108
- C:\Windows\System\nXBkunF.exe
  C:\Windows\System\nXBkunF.exe
  2⤵
  PID:7152
- C:\Windows\System\wCvnIjb.exe
  C:\Windows\System\wCvnIjb.exe
  2⤵
  PID:3644
- C:\Windows\System\cRwCvPw.exe
  C:\Windows\System\cRwCvPw.exe
  2⤵
  PID:3260
- C:\Windows\System\tBXgOtK.exe
  C:\Windows\System\tBXgOtK.exe
  2⤵
  PID:756
- C:\Windows\System\hPlaBOa.exe
  C:\Windows\System\hPlaBOa.exe
  2⤵
  PID:4820
- C:\Windows\System\PIsocPO.exe
  C:\Windows\System\PIsocPO.exe
  2⤵
  PID:6340
- C:\Windows\System\cUKOzke.exe
  C:\Windows\System\cUKOzke.exe
  2⤵
  PID:6476
- C:\Windows\System\DyllyIC.exe
  C:\Windows\System\DyllyIC.exe
  2⤵
  PID:6748
- C:\Windows\System\RmIDXfW.exe
  C:\Windows\System\RmIDXfW.exe
  2⤵
  PID:6756
- C:\Windows\System\tbyZgiu.exe
  C:\Windows\System\tbyZgiu.exe
  2⤵
  PID:7004
- C:\Windows\System\pvwnlrq.exe
  C:\Windows\System\pvwnlrq.exe
  2⤵
  PID:4104
- C:\Windows\System\BiSdsyl.exe
  C:\Windows\System\BiSdsyl.exe
  2⤵
  PID:2104
- C:\Windows\System\ZiaoebK.exe
  C:\Windows\System\ZiaoebK.exe
  2⤵
  PID:6508
- C:\Windows\System\HltbpUH.exe
  C:\Windows\System\HltbpUH.exe
  2⤵
  PID:6784
- C:\Windows\System\sgMClIF.exe
  C:\Windows\System\sgMClIF.exe
  2⤵
  PID:6772
- C:\Windows\System\TeuIUZj.exe
  C:\Windows\System\TeuIUZj.exe
  2⤵
  PID:7172
- C:\Windows\System\kLHgUEy.exe
  C:\Windows\System\kLHgUEy.exe
  2⤵
  PID:7192
- C:\Windows\System\CpYAQNu.exe
  C:\Windows\System\CpYAQNu.exe
  2⤵
  PID:7220
- C:\Windows\System\TYileRp.exe
  C:\Windows\System\TYileRp.exe
  2⤵
  PID:7248
- C:\Windows\System\vNJCMZL.exe
  C:\Windows\System\vNJCMZL.exe
  2⤵
  PID:7272
- C:\Windows\System\RFasAJw.exe
  C:\Windows\System\RFasAJw.exe
  2⤵
  PID:7300
- C:\Windows\System\LmGDIKs.exe
  C:\Windows\System\LmGDIKs.exe
  2⤵
  PID:7332
- C:\Windows\System\snoSyOz.exe
  C:\Windows\System\snoSyOz.exe
  2⤵
  PID:7360
- C:\Windows\System\VKqjpoH.exe
  C:\Windows\System\VKqjpoH.exe
  2⤵
  PID:7380
- C:\Windows\System\RocRYKE.exe
  C:\Windows\System\RocRYKE.exe
  2⤵
  PID:7400
- C:\Windows\System\enQcgRT.exe
  C:\Windows\System\enQcgRT.exe
  2⤵
  PID:7428
- C:\Windows\System\gbbiHpt.exe
  C:\Windows\System\gbbiHpt.exe
  2⤵
  PID:7460
- C:\Windows\System\HdKXAhu.exe
  C:\Windows\System\HdKXAhu.exe
  2⤵
  PID:7480
- C:\Windows\System\ybhgGpm.exe
  C:\Windows\System\ybhgGpm.exe
  2⤵
  PID:7516
- C:\Windows\System\dkxtGpr.exe
  C:\Windows\System\dkxtGpr.exe
  2⤵
  PID:7544
- C:\Windows\System\rUYNupb.exe
  C:\Windows\System\rUYNupb.exe
  2⤵
  PID:7592
- C:\Windows\System\hkOBcuV.exe
  C:\Windows\System\hkOBcuV.exe
  2⤵
  PID:7616
- C:\Windows\System\bHIPcsy.exe
  C:\Windows\System\bHIPcsy.exe
  2⤵
  PID:7636
- C:\Windows\System\pbeuFTS.exe
  C:\Windows\System\pbeuFTS.exe
  2⤵
  PID:7660
- C:\Windows\System\FejGSGp.exe
  C:\Windows\System\FejGSGp.exe
  2⤵
  PID:7680
- C:\Windows\System\GOeGFAp.exe
  C:\Windows\System\GOeGFAp.exe
  2⤵
  PID:7708
- C:\Windows\System\oWaxPPK.exe
  C:\Windows\System\oWaxPPK.exe
  2⤵
  PID:7736
- C:\Windows\System\RzmlVkl.exe
  C:\Windows\System\RzmlVkl.exe
  2⤵
  PID:7760
- C:\Windows\System\MuNfFcs.exe
  C:\Windows\System\MuNfFcs.exe
  2⤵
  PID:7784
- C:\Windows\System\UAZtNFX.exe
  C:\Windows\System\UAZtNFX.exe
  2⤵
  PID:7812
- C:\Windows\System\EkmabWY.exe
  C:\Windows\System\EkmabWY.exe
  2⤵
  PID:7860
- C:\Windows\System\YsFhyNp.exe
  C:\Windows\System\YsFhyNp.exe
  2⤵
  PID:7888
- C:\Windows\System\tdMpQky.exe
  C:\Windows\System\tdMpQky.exe
  2⤵
  PID:7932
- C:\Windows\System\bcENzWQ.exe
  C:\Windows\System\bcENzWQ.exe
  2⤵
  PID:7956
- C:\Windows\System\bhLknFe.exe
  C:\Windows\System\bhLknFe.exe
  2⤵
  PID:7976
- C:\Windows\System\QDkQikR.exe
  C:\Windows\System\QDkQikR.exe
  2⤵
  PID:8012
- C:\Windows\System\qolEQZt.exe
  C:\Windows\System\qolEQZt.exe
  2⤵
  PID:8028
- C:\Windows\System\kIbwROP.exe
  C:\Windows\System\kIbwROP.exe
  2⤵
  PID:8068
- C:\Windows\System\AdQwewh.exe
  C:\Windows\System\AdQwewh.exe
  2⤵
  PID:8104
- C:\Windows\System\MVuuDlI.exe
  C:\Windows\System\MVuuDlI.exe
  2⤵
  PID:8124
- C:\Windows\System\QbiSbwH.exe
  C:\Windows\System\QbiSbwH.exe
  2⤵
  PID:8148
- C:\Windows\System\TVVnoBA.exe
  C:\Windows\System\TVVnoBA.exe
  2⤵
  PID:8172
- C:\Windows\System\tmvQKgc.exe
  C:\Windows\System\tmvQKgc.exe
  2⤵
  PID:7180
- C:\Windows\System\cJnuWRH.exe
  C:\Windows\System\cJnuWRH.exe
  2⤵
  PID:7216
- C:\Windows\System\DuAYdEq.exe
  C:\Windows\System\DuAYdEq.exe
  2⤵
  PID:7316
- C:\Windows\System\QYpdGbA.exe
  C:\Windows\System\QYpdGbA.exe
  2⤵
  PID:7440
- C:\Windows\System\GXVkTwx.exe
  C:\Windows\System\GXVkTwx.exe
  2⤵
  PID:7416
- C:\Windows\System\KbjDZvD.exe
  C:\Windows\System\KbjDZvD.exe
  2⤵
  PID:7564
- C:\Windows\System\NCJPioT.exe
  C:\Windows\System\NCJPioT.exe
  2⤵
  PID:7608
- C:\Windows\System\IhCJMcv.exe
  C:\Windows\System\IhCJMcv.exe
  2⤵
  PID:7644
- C:\Windows\System\pMtseDN.exe
  C:\Windows\System\pMtseDN.exe
  2⤵
  PID:7692
- C:\Windows\System\UjrnnsI.exe
  C:\Windows\System\UjrnnsI.exe
  2⤵
  PID:7800
- C:\Windows\System\OqEEIwP.exe
  C:\Windows\System\OqEEIwP.exe
  2⤵
  PID:7840
- C:\Windows\System\bHNjIlX.exe
  C:\Windows\System\bHNjIlX.exe
  2⤵
  PID:7876
- C:\Windows\System\rzFrjqJ.exe
  C:\Windows\System\rzFrjqJ.exe
  2⤵
  PID:7952
- C:\Windows\System\iZZeKmb.exe
  C:\Windows\System\iZZeKmb.exe
  2⤵
  PID:8064
- C:\Windows\System\PRFFTYe.exe
  C:\Windows\System\PRFFTYe.exe
  2⤵
  PID:8180
- C:\Windows\System\CGlzLGx.exe
  C:\Windows\System\CGlzLGx.exe
  2⤵
  PID:4480
- C:\Windows\System\PHZBbop.exe
  C:\Windows\System\PHZBbop.exe
  2⤵
  PID:7348
- C:\Windows\System\cWaqrUW.exe
  C:\Windows\System\cWaqrUW.exe
  2⤵
  PID:7472
- C:\Windows\System\KPSidJp.exe
  C:\Windows\System\KPSidJp.exe
  2⤵
  PID:7624
- C:\Windows\System\mjYfbGA.exe
  C:\Windows\System\mjYfbGA.exe
  2⤵
  PID:7780
- C:\Windows\System\zAZAdOS.exe
  C:\Windows\System\zAZAdOS.exe
  2⤵
  PID:7872
- C:\Windows\System\FWzxaSM.exe
  C:\Windows\System\FWzxaSM.exe
  2⤵
  PID:8020
- C:\Windows\System\hKchzVX.exe
  C:\Windows\System\hKchzVX.exe
  2⤵
  PID:8168
- C:\Windows\System\FwfSadH.exe
  C:\Windows\System\FwfSadH.exe
  2⤵
  PID:7600
- C:\Windows\System\FsgWoXz.exe
  C:\Windows\System\FsgWoXz.exe
  2⤵
  PID:7724
- C:\Windows\System\PacoSNJ.exe
  C:\Windows\System\PacoSNJ.exe
  2⤵
  PID:8132
- C:\Windows\System\DQydvYl.exe
  C:\Windows\System\DQydvYl.exe
  2⤵
  PID:7720
- C:\Windows\System\kwEiupB.exe
  C:\Windows\System\kwEiupB.exe
  2⤵
  PID:8208
- C:\Windows\System\zVAOmIT.exe
  C:\Windows\System\zVAOmIT.exe
  2⤵
  PID:8232
- C:\Windows\System\UtvDNLG.exe
  C:\Windows\System\UtvDNLG.exe
  2⤵
  PID:8256
- C:\Windows\System\lWzmtMU.exe
  C:\Windows\System\lWzmtMU.exe
  2⤵
  PID:8288
- C:\Windows\System\jPMWJaz.exe
  C:\Windows\System\jPMWJaz.exe
  2⤵
  PID:8320
- C:\Windows\System\gmsUbXM.exe
  C:\Windows\System\gmsUbXM.exe
  2⤵
  PID:8360
- C:\Windows\System\TBUIbYV.exe
  C:\Windows\System\TBUIbYV.exe
  2⤵
  PID:8380
- C:\Windows\System\BDISnWq.exe
  C:\Windows\System\BDISnWq.exe
  2⤵
  PID:8416
- C:\Windows\System\ridjrki.exe
  C:\Windows\System\ridjrki.exe
  2⤵
  PID:8436
- C:\Windows\System\tjtgcat.exe
  C:\Windows\System\tjtgcat.exe
  2⤵
  PID:8460
- C:\Windows\System\oZkQPet.exe
  C:\Windows\System\oZkQPet.exe
  2⤵
  PID:8492
- C:\Windows\System\rJgAOtA.exe
  C:\Windows\System\rJgAOtA.exe
  2⤵
  PID:8520
- C:\Windows\System\vcZnilf.exe
  C:\Windows\System\vcZnilf.exe
  2⤵
  PID:8544
- C:\Windows\System\tcnejEv.exe
  C:\Windows\System\tcnejEv.exe
  2⤵
  PID:8564
- C:\Windows\System\HHcxtaw.exe
  C:\Windows\System\HHcxtaw.exe
  2⤵
  PID:8592
- C:\Windows\System\eyzBUfJ.exe
  C:\Windows\System\eyzBUfJ.exe
  2⤵
  PID:8612
- C:\Windows\System\iVeCGvx.exe
  C:\Windows\System\iVeCGvx.exe
  2⤵
  PID:8672
- C:\Windows\System\AmcOPbG.exe
  C:\Windows\System\AmcOPbG.exe
  2⤵
  PID:8692
- C:\Windows\System\btCjLll.exe
  C:\Windows\System\btCjLll.exe
  2⤵
  PID:8716
- C:\Windows\System\AIucnnT.exe
  C:\Windows\System\AIucnnT.exe
  2⤵
  PID:8740
- C:\Windows\System\ZjMJQuI.exe
  C:\Windows\System\ZjMJQuI.exe
  2⤵
  PID:8768
- C:\Windows\System\wbTcPef.exe
  C:\Windows\System\wbTcPef.exe
  2⤵
  PID:8788
- C:\Windows\System\DoXnqxp.exe
  C:\Windows\System\DoXnqxp.exe
  2⤵
  PID:8816
- C:\Windows\System\dvnJMcl.exe
  C:\Windows\System\dvnJMcl.exe
  2⤵
  PID:8868
- C:\Windows\System\bIKOsvY.exe
  C:\Windows\System\bIKOsvY.exe
  2⤵
  PID:8896
- C:\Windows\System\NbsZETS.exe
  C:\Windows\System\NbsZETS.exe
  2⤵
  PID:8916
- C:\Windows\System\FnCRZig.exe
  C:\Windows\System\FnCRZig.exe
  2⤵
  PID:8940
- C:\Windows\System\DpwMKzF.exe
  C:\Windows\System\DpwMKzF.exe
  2⤵
  PID:8964
- C:\Windows\System\GgvMZsI.exe
  C:\Windows\System\GgvMZsI.exe
  2⤵
  PID:8988
- C:\Windows\System\SYbtBFC.exe
  C:\Windows\System\SYbtBFC.exe
  2⤵
  PID:9012
- C:\Windows\System\RwMPabR.exe
  C:\Windows\System\RwMPabR.exe
  2⤵
  PID:9040
- C:\Windows\System\ScPXMxG.exe
  C:\Windows\System\ScPXMxG.exe
  2⤵
  PID:9068
- C:\Windows\System\zSGTWYP.exe
  C:\Windows\System\zSGTWYP.exe
  2⤵
  PID:9092
- C:\Windows\System\gyoBoFC.exe
  C:\Windows\System\gyoBoFC.exe
  2⤵
  PID:9120
- C:\Windows\System\xPvEwaX.exe
  C:\Windows\System\xPvEwaX.exe
  2⤵
  PID:9152
- C:\Windows\System\DwyjECa.exe
  C:\Windows\System\DwyjECa.exe
  2⤵
  PID:9196
- C:\Windows\System\szwEvPQ.exe
  C:\Windows\System\szwEvPQ.exe
  2⤵
  PID:8144
- C:\Windows\System\hboBmTV.exe
  C:\Windows\System\hboBmTV.exe
  2⤵
  PID:8252
- C:\Windows\System\QAgLrzH.exe
  C:\Windows\System\QAgLrzH.exe
  2⤵
  PID:8352
- C:\Windows\System\ucKSTXQ.exe
  C:\Windows\System\ucKSTXQ.exe
  2⤵
  PID:8404
- C:\Windows\System\zHalcTb.exe
  C:\Windows\System\zHalcTb.exe
  2⤵
  PID:8472
- C:\Windows\System\dcrlbmX.exe
  C:\Windows\System\dcrlbmX.exe
  2⤵
  PID:8516
- C:\Windows\System\ehDDbKW.exe
  C:\Windows\System\ehDDbKW.exe
  2⤵
  PID:8600
- C:\Windows\System\DFThoNs.exe
  C:\Windows\System\DFThoNs.exe
  2⤵
  PID:8580
- C:\Windows\System\IrTDPSS.exe
  C:\Windows\System\IrTDPSS.exe
  2⤵
  PID:8708
- C:\Windows\System\mvdgClV.exe
  C:\Windows\System\mvdgClV.exe
  2⤵
  PID:8760
- C:\Windows\System\gnnIRTM.exe
  C:\Windows\System\gnnIRTM.exe
  2⤵
  PID:8844
- C:\Windows\System\GvXhQQO.exe
  C:\Windows\System\GvXhQQO.exe
  2⤵
  PID:8892
- C:\Windows\System\mYZiJJl.exe
  C:\Windows\System\mYZiJJl.exe
  2⤵
  PID:9004
- C:\Windows\System\kwPJMul.exe
  C:\Windows\System\kwPJMul.exe
  2⤵
  PID:9060
- C:\Windows\System\oFYOUrg.exe
  C:\Windows\System\oFYOUrg.exe
  2⤵
  PID:9116
- C:\Windows\System\nWrCxiE.exe
  C:\Windows\System\nWrCxiE.exe
  2⤵
  PID:9172
- C:\Windows\System\GoCrkFh.exe
  C:\Windows\System\GoCrkFh.exe
  2⤵
  PID:7492
- C:\Windows\System\pIOhxdi.exe
  C:\Windows\System\pIOhxdi.exe
  2⤵
  PID:8336
- C:\Windows\System\RhVjiYa.exe
  C:\Windows\System\RhVjiYa.exe
  2⤵
  PID:8560
- C:\Windows\System\WXmkopJ.exe
  C:\Windows\System\WXmkopJ.exe
  2⤵
  PID:8732
- C:\Windows\System\CmfbEdF.exe
  C:\Windows\System\CmfbEdF.exe
  2⤵
  PID:8952
- C:\Windows\System\qIkpyiT.exe
  C:\Windows\System\qIkpyiT.exe
  2⤵
  PID:8996
- C:\Windows\System\AlEakoM.exe
  C:\Windows\System\AlEakoM.exe
  2⤵
  PID:9148
- C:\Windows\System\puVFQrY.exe
  C:\Windows\System\puVFQrY.exe
  2⤵
  PID:8200
- C:\Windows\System\nlHkYqO.exe
  C:\Windows\System\nlHkYqO.exe
  2⤵
  PID:8452
- C:\Windows\System\PJKReqS.exe
  C:\Windows\System\PJKReqS.exe
  2⤵
  PID:8836
- C:\Windows\System\rxJlNSO.exe
  C:\Windows\System\rxJlNSO.exe
  2⤵
  PID:8688
- C:\Windows\System\QtrZtFY.exe
  C:\Windows\System\QtrZtFY.exe
  2⤵
  PID:9248
- C:\Windows\System\GLYCldf.exe
  C:\Windows\System\GLYCldf.exe
  2⤵
  PID:9272
- C:\Windows\System\nNryiRM.exe
  C:\Windows\System\nNryiRM.exe
  2⤵
  PID:9304
- C:\Windows\System\ooevmLI.exe
  C:\Windows\System\ooevmLI.exe
  2⤵
  PID:9332
- C:\Windows\System\IuqXjqb.exe
  C:\Windows\System\IuqXjqb.exe
  2⤵
  PID:9360
- C:\Windows\System\iGKYeFs.exe
  C:\Windows\System\iGKYeFs.exe
  2⤵
  PID:9396
- C:\Windows\System\dEBNlvf.exe
  C:\Windows\System\dEBNlvf.exe
  2⤵
  PID:9420
- C:\Windows\System\EfsApNm.exe
  C:\Windows\System\EfsApNm.exe
  2⤵
  PID:9452
- C:\Windows\System\QqEMecj.exe
  C:\Windows\System\QqEMecj.exe
  2⤵
  PID:9488
- C:\Windows\System\Dklzjkt.exe
  C:\Windows\System\Dklzjkt.exe
  2⤵
  PID:9516
- C:\Windows\System\CpzXHFh.exe
  C:\Windows\System\CpzXHFh.exe
  2⤵
  PID:9532
- C:\Windows\System\ATooPKw.exe
  C:\Windows\System\ATooPKw.exe
  2⤵
  PID:9560
- C:\Windows\System\TFXMwdD.exe
  C:\Windows\System\TFXMwdD.exe
  2⤵
  PID:9580
- C:\Windows\System\eIjPSWA.exe
  C:\Windows\System\eIjPSWA.exe
  2⤵
  PID:9612
- C:\Windows\System\SmxuUNf.exe
  C:\Windows\System\SmxuUNf.exe
  2⤵
  PID:9640
- C:\Windows\System\tbIfjkC.exe
  C:\Windows\System\tbIfjkC.exe
  2⤵
  PID:9676
- C:\Windows\System\TXBDSMN.exe
  C:\Windows\System\TXBDSMN.exe
  2⤵
  PID:9692
- C:\Windows\System\zQTHiZh.exe
  C:\Windows\System\zQTHiZh.exe
  2⤵
  PID:9716
- C:\Windows\System\RGVjJTq.exe
  C:\Windows\System\RGVjJTq.exe
  2⤵
  PID:9740
- C:\Windows\System\cCDyBdt.exe
  C:\Windows\System\cCDyBdt.exe
  2⤵
  PID:9812
- C:\Windows\System\wtYFPRR.exe
  C:\Windows\System\wtYFPRR.exe
  2⤵
  PID:9832
- C:\Windows\System\VFtqwCh.exe
  C:\Windows\System\VFtqwCh.exe
  2⤵
  PID:9860
- C:\Windows\System\OHvBsco.exe
  C:\Windows\System\OHvBsco.exe
  2⤵
  PID:9888
- C:\Windows\System\Milzeyw.exe
  C:\Windows\System\Milzeyw.exe
  2⤵
  PID:9916
- C:\Windows\System\thsRzLE.exe
  C:\Windows\System\thsRzLE.exe
  2⤵
  PID:9944
- C:\Windows\System\UisiuKC.exe
  C:\Windows\System\UisiuKC.exe
  2⤵
  PID:9964
- C:\Windows\System\SAXDLdp.exe
  C:\Windows\System\SAXDLdp.exe
  2⤵
  PID:10000
- C:\Windows\System\ximbBYd.exe
  C:\Windows\System\ximbBYd.exe
  2⤵
  PID:10028
- C:\Windows\System\BWXuuXo.exe
  C:\Windows\System\BWXuuXo.exe
  2⤵
  PID:10056
- C:\Windows\System\zMVVvfa.exe
  C:\Windows\System\zMVVvfa.exe
  2⤵
  PID:10076
- C:\Windows\System\oozynmQ.exe
  C:\Windows\System\oozynmQ.exe
  2⤵
  PID:10100
- C:\Windows\System\QESSEjs.exe
  C:\Windows\System\QESSEjs.exe
  2⤵
  PID:10140
- C:\Windows\System\RhcchgB.exe
  C:\Windows\System\RhcchgB.exe
  2⤵
  PID:10168
- C:\Windows\System\LmGNZKT.exe
  C:\Windows\System\LmGNZKT.exe
  2⤵
  PID:10188
- C:\Windows\System\BZFthly.exe
  C:\Windows\System\BZFthly.exe
  2⤵
  PID:10212
- C:\Windows\System\gtbimlQ.exe
  C:\Windows\System\gtbimlQ.exe
  2⤵
  PID:8480
- C:\Windows\System\GnvefhZ.exe
  C:\Windows\System\GnvefhZ.exe
  2⤵
  PID:9232
- C:\Windows\System\lqeOvLe.exe
  C:\Windows\System\lqeOvLe.exe
  2⤵
  PID:9268
- C:\Windows\System\zJVCDtA.exe
  C:\Windows\System\zJVCDtA.exe
  2⤵
  PID:9376
- C:\Windows\System\dFfmykE.exe
  C:\Windows\System\dFfmykE.exe
  2⤵
  PID:9416
- C:\Windows\System\JKPOZYX.exe
  C:\Windows\System\JKPOZYX.exe
  2⤵
  PID:9468
- C:\Windows\System\KUxEmOp.exe
  C:\Windows\System\KUxEmOp.exe
  2⤵
  PID:9544
- C:\Windows\System\QmRlBDB.exe
  C:\Windows\System\QmRlBDB.exe
  2⤵
  PID:9596
- C:\Windows\System\jfTsVqm.exe
  C:\Windows\System\jfTsVqm.exe
  2⤵
  PID:9668
- C:\Windows\System\NymzhzR.exe
  C:\Windows\System\NymzhzR.exe
  2⤵
  PID:9728
- C:\Windows\System\aUDjrHi.exe
  C:\Windows\System\aUDjrHi.exe
  2⤵
  PID:9788
- C:\Windows\System\zvMesuX.exe
  C:\Windows\System\zvMesuX.exe
  2⤵
  PID:9900
- C:\Windows\System\sgEcLPn.exe
  C:\Windows\System\sgEcLPn.exe
  2⤵
  PID:9960
- C:\Windows\System\AdtnNGm.exe
  C:\Windows\System\AdtnNGm.exe
  2⤵
  PID:10024
- C:\Windows\System\WobQdpr.exe
  C:\Windows\System\WobQdpr.exe
  2⤵
  PID:10092
- C:\Windows\System\uUXOLGs.exe
  C:\Windows\System\uUXOLGs.exe
  2⤵
  PID:10136
- C:\Windows\System\sJKbrDz.exe
  C:\Windows\System\sJKbrDz.exe
  2⤵
  PID:10232
- C:\Windows\System\MtryCYZ.exe
  C:\Windows\System\MtryCYZ.exe
  2⤵
  PID:9280
- C:\Windows\System\ARbEGey.exe
  C:\Windows\System\ARbEGey.exe
  2⤵
  PID:9388
- C:\Windows\System\gtlCAst.exe
  C:\Windows\System\gtlCAst.exe
  2⤵
  PID:9572
- C:\Windows\System\POmfrFl.exe
  C:\Windows\System\POmfrFl.exe
  2⤵
  PID:9708
- C:\Windows\System\VeFCUyT.exe
  C:\Windows\System\VeFCUyT.exe
  2⤵
  PID:9844
- C:\Windows\System\PMFTLny.exe
  C:\Windows\System\PMFTLny.exe
  2⤵
  PID:9984
- C:\Windows\System\pWotlBb.exe
  C:\Windows\System\pWotlBb.exe
  2⤵
  PID:10176
- C:\Windows\System\VkIYKMe.exe
  C:\Windows\System\VkIYKMe.exe
  2⤵
  PID:9356
- C:\Windows\System\NpQBQtt.exe
  C:\Windows\System\NpQBQtt.exe
  2⤵
  PID:9636
- C:\Windows\System\rbLkjxv.exe
  C:\Windows\System\rbLkjxv.exe
  2⤵
  PID:10016
- C:\Windows\System\cDwNASX.exe
  C:\Windows\System\cDwNASX.exe
  2⤵
  PID:9648
- C:\Windows\System\wCjdvkX.exe
  C:\Windows\System\wCjdvkX.exe
  2⤵
  PID:9228
- C:\Windows\System\IVojglY.exe
  C:\Windows\System\IVojglY.exe
  2⤵
  PID:10256
- C:\Windows\System\wwpmQtE.exe
  C:\Windows\System\wwpmQtE.exe
  2⤵
  PID:10276
- C:\Windows\System\YLXWQiM.exe
  C:\Windows\System\YLXWQiM.exe
  2⤵
  PID:10300
- C:\Windows\System\eEMhIsD.exe
  C:\Windows\System\eEMhIsD.exe
  2⤵
  PID:10332
- C:\Windows\System\oAaaTJx.exe
  C:\Windows\System\oAaaTJx.exe
  2⤵
  PID:10364
- C:\Windows\System\wsPeMtj.exe
  C:\Windows\System\wsPeMtj.exe
  2⤵
  PID:10384
- C:\Windows\System\AOlcBRX.exe
  C:\Windows\System\AOlcBRX.exe
  2⤵
  PID:10404
- C:\Windows\System\tzhPuXy.exe
  C:\Windows\System\tzhPuXy.exe
  2⤵
  PID:10444
- C:\Windows\System\pSTCIIx.exe
  C:\Windows\System\pSTCIIx.exe
  2⤵
  PID:10468
- C:\Windows\System\GwrBxfL.exe
  C:\Windows\System\GwrBxfL.exe
  2⤵
  PID:10492
- C:\Windows\System\QJmEJwR.exe
  C:\Windows\System\QJmEJwR.exe
  2⤵
  PID:10520
- C:\Windows\System\TVfOUrZ.exe
  C:\Windows\System\TVfOUrZ.exe
  2⤵
  PID:10548
- C:\Windows\System\kLzLURh.exe
  C:\Windows\System\kLzLURh.exe
  2⤵
  PID:10580
- C:\Windows\System\vghBmRE.exe
  C:\Windows\System\vghBmRE.exe
  2⤵
  PID:10596
- C:\Windows\System\JnWKKoQ.exe
  C:\Windows\System\JnWKKoQ.exe
  2⤵
  PID:10620
- C:\Windows\System\IOKBANS.exe
  C:\Windows\System\IOKBANS.exe
  2⤵
  PID:10636
- C:\Windows\System\KkPVZnS.exe
  C:\Windows\System\KkPVZnS.exe
  2⤵
  PID:10656
- C:\Windows\System\ZtauSPo.exe
  C:\Windows\System\ZtauSPo.exe
  2⤵
  PID:10700
- C:\Windows\System\rtPEtDp.exe
  C:\Windows\System\rtPEtDp.exe
  2⤵
  PID:10724
- C:\Windows\System\TMHhQwD.exe
  C:\Windows\System\TMHhQwD.exe
  2⤵
  PID:10764
- C:\Windows\System\FTSVJGe.exe
  C:\Windows\System\FTSVJGe.exe
  2⤵
  PID:10796
- C:\Windows\System\UahXERs.exe
  C:\Windows\System\UahXERs.exe
  2⤵
  PID:10824
- C:\Windows\System\TsmeeQI.exe
  C:\Windows\System\TsmeeQI.exe
  2⤵
  PID:10860
- C:\Windows\System\nvhzIGD.exe
  C:\Windows\System\nvhzIGD.exe
  2⤵
  PID:10880
- C:\Windows\System\TzZWbfF.exe
  C:\Windows\System\TzZWbfF.exe
  2⤵
  PID:10912
- C:\Windows\System\dvElKhz.exe
  C:\Windows\System\dvElKhz.exe
  2⤵
  PID:10956
- C:\Windows\System\wDZxymG.exe
  C:\Windows\System\wDZxymG.exe
  2⤵
  PID:10984
- C:\Windows\System\khaWatz.exe
  C:\Windows\System\khaWatz.exe
  2⤵
  PID:11012
- C:\Windows\System\oiujdHu.exe
  C:\Windows\System\oiujdHu.exe
  2⤵
  PID:11032
- C:\Windows\System\DgHouhK.exe
  C:\Windows\System\DgHouhK.exe
  2⤵
  PID:11056
- C:\Windows\System\YXudyGf.exe
  C:\Windows\System\YXudyGf.exe
  2⤵
  PID:11096
- C:\Windows\System\LShPuWL.exe
  C:\Windows\System\LShPuWL.exe
  2⤵
  PID:11116
- C:\Windows\System\WFZGGwC.exe
  C:\Windows\System\WFZGGwC.exe
  2⤵
  PID:11152
- C:\Windows\System\TZMCbQu.exe
  C:\Windows\System\TZMCbQu.exe
  2⤵
  PID:11176
- C:\Windows\System\qiQhBWS.exe
  C:\Windows\System\qiQhBWS.exe
  2⤵
  PID:11196
- C:\Windows\System\WjzOMCu.exe
  C:\Windows\System\WjzOMCu.exe
  2⤵
  PID:11220
- C:\Windows\System\GgbJNIL.exe
  C:\Windows\System\GgbJNIL.exe
  2⤵
  PID:11252
- C:\Windows\System\AIzZXZy.exe
  C:\Windows\System\AIzZXZy.exe
  2⤵
  PID:10248
- C:\Windows\System\ozCJhcV.exe
  C:\Windows\System\ozCJhcV.exe
  2⤵
  PID:10372
- C:\Windows\System\LYXBwuw.exe
  C:\Windows\System\LYXBwuw.exe
  2⤵
  PID:10392
- C:\Windows\System\eXorkPs.exe
  C:\Windows\System\eXorkPs.exe
  2⤵
  PID:10480
- C:\Windows\System\jDKqiqL.exe
  C:\Windows\System\jDKqiqL.exe
  2⤵
  PID:10564
- C:\Windows\System\ojeEWpH.exe
  C:\Windows\System\ojeEWpH.exe
  2⤵
  PID:10644
- C:\Windows\System\QpuKAJM.exe
  C:\Windows\System\QpuKAJM.exe
  2⤵
  PID:10680
- C:\Windows\System\ghzUNlR.exe
  C:\Windows\System\ghzUNlR.exe
  2⤵
  PID:10684
- C:\Windows\System\CGGbLVR.exe
  C:\Windows\System\CGGbLVR.exe
  2⤵
  PID:10788
- C:\Windows\System\KjoluIz.exe
  C:\Windows\System\KjoluIz.exe
  2⤵
  PID:10840
- C:\Windows\System\iMnjTrB.exe
  C:\Windows\System\iMnjTrB.exe
  2⤵
  PID:10908
- C:\Windows\System\xSHiPOE.exe
  C:\Windows\System\xSHiPOE.exe
  2⤵
  PID:10936
- C:\Windows\System\qayRMdg.exe
  C:\Windows\System\qayRMdg.exe
  2⤵
  PID:11040
- C:\Windows\System\IRxismf.exe
  C:\Windows\System\IRxismf.exe
  2⤵
  PID:11112
- C:\Windows\System\ulcxawg.exe
  C:\Windows\System\ulcxawg.exe
  2⤵
  PID:11164
- C:\Windows\System\AHJietW.exe
  C:\Windows\System\AHJietW.exe
  2⤵
  PID:11244
- C:\Windows\System\YzHDVaB.exe
  C:\Windows\System\YzHDVaB.exe
  2⤵
  PID:10484
- C:\Windows\System\TORkMAN.exe
  C:\Windows\System\TORkMAN.exe
  2⤵
  PID:10516
- C:\Windows\System\CCtjyuc.exe
  C:\Windows\System\CCtjyuc.exe
  2⤵
  PID:10736
- C:\Windows\System\yGcZwuf.exe
  C:\Windows\System\yGcZwuf.exe
  2⤵
  PID:10888
- C:\Windows\System\cXTVYeD.exe
  C:\Windows\System\cXTVYeD.exe
  2⤵
  PID:11088
- C:\Windows\System\JeOkyFn.exe
  C:\Windows\System\JeOkyFn.exe
  2⤵
  PID:11184
- C:\Windows\System\ujEcNmp.exe
  C:\Windows\System\ujEcNmp.exe
  2⤵
  PID:10340
- C:\Windows\System\TFNMeDB.exe
  C:\Windows\System\TFNMeDB.exe
  2⤵
  PID:10752
- C:\Windows\System\KxbQCJC.exe
  C:\Windows\System\KxbQCJC.exe
  2⤵
  PID:11044
- C:\Windows\System\wZdSgBt.exe
  C:\Windows\System\wZdSgBt.exe
  2⤵
  PID:10696
- C:\Windows\System\dJUwsaf.exe
  C:\Windows\System\dJUwsaf.exe
  2⤵
  PID:10508
- C:\Windows\System\HeVZEeZ.exe
  C:\Windows\System\HeVZEeZ.exe
  2⤵
  PID:11268
- C:\Windows\System\ioslFxt.exe
  C:\Windows\System\ioslFxt.exe
  2⤵
  PID:11308
- C:\Windows\System\iXBxpLc.exe
  C:\Windows\System\iXBxpLc.exe
  2⤵
  PID:11336
- C:\Windows\System\fYdDyJV.exe
  C:\Windows\System\fYdDyJV.exe
  2⤵
  PID:11364
- C:\Windows\System\ckIAPgj.exe
  C:\Windows\System\ckIAPgj.exe
  2⤵
  PID:11392
- C:\Windows\System\kztaTEM.exe
  C:\Windows\System\kztaTEM.exe
  2⤵
  PID:11420
- C:\Windows\System\qweDNdg.exe
  C:\Windows\System\qweDNdg.exe
  2⤵
  PID:11452
- C:\Windows\System\mJYllpF.exe
  C:\Windows\System\mJYllpF.exe
  2⤵
  PID:11480
- C:\Windows\System\qGyqcaF.exe
  C:\Windows\System\qGyqcaF.exe
  2⤵
  PID:11508
- C:\Windows\System\nyqeLbR.exe
  C:\Windows\System\nyqeLbR.exe
  2⤵
  PID:11528
- C:\Windows\System\CSAZhYU.exe
  C:\Windows\System\CSAZhYU.exe
  2⤵
  PID:11552
- C:\Windows\System\hLuRtDE.exe
  C:\Windows\System\hLuRtDE.exe
  2⤵
  PID:11580
- C:\Windows\System\enhqnNE.exe
  C:\Windows\System\enhqnNE.exe
  2⤵
  PID:11596
- C:\Windows\System\bEjMKXp.exe
  C:\Windows\System\bEjMKXp.exe
  2⤵
  PID:11616
- C:\Windows\System\ARkXgNe.exe
  C:\Windows\System\ARkXgNe.exe
  2⤵
  PID:11664
- C:\Windows\System\IyOufDH.exe
  C:\Windows\System\IyOufDH.exe
  2⤵
  PID:11692
- C:\Windows\System\pihRBpB.exe
  C:\Windows\System\pihRBpB.exe
  2⤵
  PID:11720
- C:\Windows\System\wUqVbyD.exe
  C:\Windows\System\wUqVbyD.exe
  2⤵
  PID:11760
- C:\Windows\System\emnQkbA.exe
  C:\Windows\System\emnQkbA.exe
  2⤵
  PID:11788
- C:\Windows\System\hWWmoMr.exe
  C:\Windows\System\hWWmoMr.exe
  2⤵
  PID:11816
- C:\Windows\System\iondGcX.exe
  C:\Windows\System\iondGcX.exe
  2⤵
  PID:11844
- C:\Windows\System\CMxWpBI.exe
  C:\Windows\System\CMxWpBI.exe
  2⤵
  PID:11864
- C:\Windows\System\PitlEaB.exe
  C:\Windows\System\PitlEaB.exe
  2⤵
  PID:11888
- C:\Windows\System\WBKqBzS.exe
  C:\Windows\System\WBKqBzS.exe
  2⤵
  PID:11908
- C:\Windows\System\EtuQUWw.exe
  C:\Windows\System\EtuQUWw.exe
  2⤵
  PID:11940
- C:\Windows\System\mVSLtws.exe
  C:\Windows\System\mVSLtws.exe
  2⤵
  PID:11976
- C:\Windows\System\OIjhXcA.exe
  C:\Windows\System\OIjhXcA.exe
  2⤵
  PID:12000
- C:\Windows\System\OoyKoln.exe
  C:\Windows\System\OoyKoln.exe
  2⤵
  PID:12040
- C:\Windows\System\wvYLmEY.exe
  C:\Windows\System\wvYLmEY.exe
  2⤵
  PID:12068
- C:\Windows\System\ywcLapo.exe
  C:\Windows\System\ywcLapo.exe
  2⤵
  PID:12096
- C:\Windows\System\HPRUBQM.exe
  C:\Windows\System\HPRUBQM.exe
  2⤵
  PID:12124
- C:\Windows\System\bCGAiSF.exe
  C:\Windows\System\bCGAiSF.exe
  2⤵
  PID:12152
- C:\Windows\System\OiFMcTE.exe
  C:\Windows\System\OiFMcTE.exe
  2⤵
  PID:12180
- C:\Windows\System\ExQyPaN.exe
  C:\Windows\System\ExQyPaN.exe
  2⤵
  PID:12204
- C:\Windows\System\AyVwUrO.exe
  C:\Windows\System\AyVwUrO.exe
  2⤵
  PID:12224
- C:\Windows\System\uNrrnNy.exe
  C:\Windows\System\uNrrnNy.exe
  2⤵
  PID:12240
- C:\Windows\System\qEXHJPV.exe
  C:\Windows\System\qEXHJPV.exe
  2⤵
  PID:12256
- C:\Windows\System\pHsFUdk.exe
  C:\Windows\System\pHsFUdk.exe
  2⤵
  PID:11300
- C:\Windows\System\rVqxwBg.exe
  C:\Windows\System\rVqxwBg.exe
  2⤵
  PID:11356
- C:\Windows\System\JdZeocT.exe
  C:\Windows\System\JdZeocT.exe
  2⤵
  PID:11408
- C:\Windows\System\ZhdOkEL.exe
  C:\Windows\System\ZhdOkEL.exe
  2⤵
  PID:11472
- C:\Windows\System\bEQPceQ.exe
  C:\Windows\System\bEQPceQ.exe
  2⤵
  PID:11536
- C:\Windows\System\BCQGuqV.exe
  C:\Windows\System\BCQGuqV.exe
  2⤵
  PID:11548
- C:\Windows\System\DIUFwpf.exe
  C:\Windows\System\DIUFwpf.exe
  2⤵
  PID:11636
- C:\Windows\System\MSSIXIp.exe
  C:\Windows\System\MSSIXIp.exe
  2⤵
  PID:11688
- C:\Windows\System\hwaNkqd.exe
  C:\Windows\System\hwaNkqd.exe
  2⤵
  PID:11756
- C:\Windows\System\DXKtdIM.exe
  C:\Windows\System\DXKtdIM.exe
  2⤵
  PID:11836
- C:\Windows\System\AdLJRGX.exe
  C:\Windows\System\AdLJRGX.exe
  2⤵
  PID:11884
- C:\Windows\System\JIYixUs.exe
  C:\Windows\System\JIYixUs.exe
  2⤵
  PID:11956
- C:\Windows\System\vSgtdJF.exe
  C:\Windows\System\vSgtdJF.exe
  2⤵
  PID:12020
- C:\Windows\System\DZsasiq.exe
  C:\Windows\System\DZsasiq.exe
  2⤵
  PID:12084
- C:\Windows\System\HtZoOUf.exe
  C:\Windows\System\HtZoOUf.exe
  2⤵
  PID:12148
- C:\Windows\System\SPABcjv.exe
  C:\Windows\System\SPABcjv.exe
  2⤵
  PID:12212
- C:\Windows\System\zJjWQTq.exe
  C:\Windows\System\zJjWQTq.exe
  2⤵
  PID:12272
- C:\Windows\System\MbAMJnX.exe
  C:\Windows\System\MbAMJnX.exe
  2⤵
  PID:11376
- C:\Windows\System\xEBFAvy.exe
  C:\Windows\System\xEBFAvy.exe
  2⤵
  PID:11496
- C:\Windows\System\DaXexzw.exe
  C:\Windows\System\DaXexzw.exe
  2⤵
  PID:11572
- C:\Windows\System\ydErkVI.exe
  C:\Windows\System\ydErkVI.exe
  2⤵
  PID:11988
- C:\Windows\System\qptKygO.exe
  C:\Windows\System\qptKygO.exe
  2⤵
  PID:11972
- C:\Windows\System\saMQhWC.exe
  C:\Windows\System\saMQhWC.exe
  2⤵
  PID:12248
- C:\Windows\System\VAnybll.exe
  C:\Windows\System\VAnybll.exe
  2⤵
  PID:11564
- C:\Windows\System\UvymSVq.exe
  C:\Windows\System\UvymSVq.exe
  2⤵
  PID:11504
- C:\Windows\System\mPaQvSR.exe
  C:\Windows\System\mPaQvSR.exe
  2⤵
  PID:12120
- C:\Windows\System\cSNWDXU.exe
  C:\Windows\System\cSNWDXU.exe
  2⤵
  PID:11476
- C:\Windows\System\sSOQASg.exe
  C:\Windows\System\sSOQASg.exe
  2⤵
  PID:12088
- C:\Windows\System\axNHZpC.exe
  C:\Windows\System\axNHZpC.exe
  2⤵
  PID:12316
- C:\Windows\System\QKEQFkA.exe
  C:\Windows\System\QKEQFkA.exe
  2⤵
  PID:12348
- C:\Windows\System\HQHaRXj.exe
  C:\Windows\System\HQHaRXj.exe
  2⤵
  PID:12388
- C:\Windows\System\JGwKdfw.exe
  C:\Windows\System\JGwKdfw.exe
  2⤵
  PID:12444
- C:\Windows\System\vmaGfFu.exe
  C:\Windows\System\vmaGfFu.exe
  2⤵
  PID:12464
- C:\Windows\System\rqOkaYP.exe
  C:\Windows\System\rqOkaYP.exe
  2⤵
  PID:12492
- C:\Windows\System\BWpirzd.exe
  C:\Windows\System\BWpirzd.exe
  2⤵
  PID:12520
- C:\Windows\System\YexPkif.exe
  C:\Windows\System\YexPkif.exe
  2⤵
  PID:12536
- C:\Windows\System\sSfDuDi.exe
  C:\Windows\System\sSfDuDi.exe
  2⤵
  PID:12564
- C:\Windows\System\VSHlIcI.exe
  C:\Windows\System\VSHlIcI.exe
  2⤵
  PID:12588
- C:\Windows\System\pSRwzMU.exe
  C:\Windows\System\pSRwzMU.exe
  2⤵
  PID:12612
- C:\Windows\System\UJJUMZB.exe
  C:\Windows\System\UJJUMZB.exe
  2⤵
  PID:12636
- C:\Windows\System\BMgYkSE.exe
  C:\Windows\System\BMgYkSE.exe
  2⤵
  PID:12664
- C:\Windows\System\UnwyPZi.exe
  C:\Windows\System\UnwyPZi.exe
  2⤵
  PID:12688
- C:\Windows\System\strdVVT.exe
  C:\Windows\System\strdVVT.exe
  2⤵
  PID:12716
- C:\Windows\System\KsqeGcF.exe
  C:\Windows\System\KsqeGcF.exe
  2⤵
  PID:12748
- C:\Windows\System\sNkCwQZ.exe
  C:\Windows\System\sNkCwQZ.exe
  2⤵
  PID:12776
- C:\Windows\System\NBljmTK.exe
  C:\Windows\System\NBljmTK.exe
  2⤵
  PID:12832
- C:\Windows\System\RgyQoLA.exe
  C:\Windows\System\RgyQoLA.exe
  2⤵
  PID:12856
- C:\Windows\System\QXVzFmf.exe
  C:\Windows\System\QXVzFmf.exe
  2⤵
  PID:12896
- C:\Windows\System\HuNqvgl.exe
  C:\Windows\System\HuNqvgl.exe
  2⤵
  PID:12912
- C:\Windows\System\WHwdbKX.exe
  C:\Windows\System\WHwdbKX.exe
  2⤵
  PID:12952
- C:\Windows\System\dyOMMpQ.exe
  C:\Windows\System\dyOMMpQ.exe
  2⤵
  PID:12968
- C:\Windows\System\zLfTZXI.exe
  C:\Windows\System\zLfTZXI.exe
  2⤵
  PID:13000
- C:\Windows\System\daFxWzs.exe
  C:\Windows\System\daFxWzs.exe
  2⤵
  PID:13032
- C:\Windows\System\FIbhaSZ.exe
  C:\Windows\System\FIbhaSZ.exe
  2⤵
  PID:13052
- C:\Windows\System\qISXCGZ.exe
  C:\Windows\System\qISXCGZ.exe
  2⤵
  PID:13092
- C:\Windows\System\EnvzCAK.exe
  C:\Windows\System\EnvzCAK.exe
  2⤵
  PID:13120
- C:\Windows\System\HQdDTDD.exe
  C:\Windows\System\HQdDTDD.exe
  2⤵
  PID:13148
- C:\Windows\System\YjHpiAX.exe
  C:\Windows\System\YjHpiAX.exe
  2⤵
  PID:13176
- C:\Windows\System\HBRjoun.exe
  C:\Windows\System\HBRjoun.exe
  2⤵
  PID:13196
- C:\Windows\System\RDCMHEc.exe
  C:\Windows\System\RDCMHEc.exe
  2⤵
  PID:13220
- C:\Windows\System\KMVWalA.exe
  C:\Windows\System\KMVWalA.exe
  2⤵
  PID:13256
- C:\Windows\System\KjnRFgJ.exe
  C:\Windows\System\KjnRFgJ.exe
  2⤵
  PID:13276
- C:\Windows\System\GruZGWQ.exe
  C:\Windows\System\GruZGWQ.exe
  2⤵
  PID:13292
- C:\Windows\System\XViMsCG.exe
  C:\Windows\System\XViMsCG.exe
  2⤵
  PID:12312
- C:\Windows\System\BiZeuLn.exe
  C:\Windows\System\BiZeuLn.exe
  2⤵
  PID:12432
- C:\Windows\System\lkhvTVU.exe
  C:\Windows\System\lkhvTVU.exe
  2⤵
  PID:11444
- C:\Windows\System\PEFHTua.exe
  C:\Windows\System\PEFHTua.exe
  2⤵
  PID:12500
- C:\Windows\System\bDtBsIw.exe
  C:\Windows\System\bDtBsIw.exe
  2⤵
  PID:12652
- C:\Windows\System\BvMnFui.exe
  C:\Windows\System\BvMnFui.exe
  2⤵
  PID:12632
- C:\Windows\System\eDIkgEG.exe
  C:\Windows\System\eDIkgEG.exe
  2⤵
  PID:12708
- C:\Windows\System\JuPuQEc.exe
  C:\Windows\System\JuPuQEc.exe
  2⤵
  PID:12800
- C:\Windows\System\QhWMsmJ.exe
  C:\Windows\System\QhWMsmJ.exe
  2⤵
  PID:12848
- C:\Windows\System\bDJXSYy.exe
  C:\Windows\System\bDJXSYy.exe
  2⤵
  PID:12904
- C:\Windows\System\HXFyYXj.exe
  C:\Windows\System\HXFyYXj.exe
  2⤵
  PID:12940
- C:\Windows\System\SNJrmOF.exe
  C:\Windows\System\SNJrmOF.exe
  2⤵
  PID:13028
- C:\Windows\System\XWtTgUt.exe
  C:\Windows\System\XWtTgUt.exe
  2⤵
  PID:13112
- C:\Windows\System\plucAGx.exe
  C:\Windows\System\plucAGx.exe
  2⤵
  PID:13168
- C:\Windows\System\nfcMjeA.exe
  C:\Windows\System\nfcMjeA.exe
  2⤵
  PID:13248
- C:\Windows\System\bJjgKSr.exe
  C:\Windows\System\bJjgKSr.exe
  2⤵
  PID:11292
- C:\Windows\System\YZZbNFP.exe
  C:\Windows\System\YZZbNFP.exe
  2⤵
  PID:12428
- C:\Windows\System\ljjXonx.exe
  C:\Windows\System\ljjXonx.exe
  2⤵
  PID:12576
- C:\Windows\System\IMLsCMG.exe
  C:\Windows\System\IMLsCMG.exe
  2⤵
  PID:12740
- C:\Windows\System\VgTjRoE.exe
  C:\Windows\System\VgTjRoE.exe
  2⤵
  PID:12764
- C:\Windows\System\NipgDzj.exe
  C:\Windows\System\NipgDzj.exe
  2⤵
  PID:13048
- C:\Windows\System\hZSAXcM.exe
  C:\Windows\System\hZSAXcM.exe
  2⤵
  PID:13184
- C:\Windows\System\fdOvNUl.exe
  C:\Windows\System\fdOvNUl.exe
  2⤵
  PID:12324
- C:\Windows\System\SKLuRsF.exe
  C:\Windows\System\SKLuRsF.exe
  2⤵
  PID:12644
- C:\Windows\System\fVfDiEM.exe
  C:\Windows\System\fVfDiEM.exe
  2⤵
  PID:13080
- C:\Windows\System\FFxtDCE.exe
  C:\Windows\System\FFxtDCE.exe
  2⤵
  PID:12384
- C:\Windows\System\nVKfIJO.exe
  C:\Windows\System\nVKfIJO.exe
  2⤵
  PID:12984
- C:\Windows\System\maNbBZP.exe
  C:\Windows\System\maNbBZP.exe
  2⤵
  PID:13216
- C:\Windows\System\AvSFNsd.exe
  C:\Windows\System\AvSFNsd.exe
  2⤵
  PID:13328
- C:\Windows\System\xxXgXFG.exe
  C:\Windows\System\xxXgXFG.exe
  2⤵
  PID:13356
- C:\Windows\System\aahVApz.exe
  C:\Windows\System\aahVApz.exe
  2⤵
  PID:13400
- C:\Windows\System\mkMzhLM.exe
  C:\Windows\System\mkMzhLM.exe
  2⤵
  PID:13428
- C:\Windows\System\WvRPxGi.exe
  C:\Windows\System\WvRPxGi.exe
  2⤵
  PID:13456
- C:\Windows\System\hRKwrpW.exe
  C:\Windows\System\hRKwrpW.exe
  2⤵
  PID:13480
- C:\Windows\System\WJpKHAs.exe
  C:\Windows\System\WJpKHAs.exe
  2⤵
  PID:13524
- C:\Windows\System\YUDiDJg.exe
  C:\Windows\System\YUDiDJg.exe
  2⤵
  PID:13540
- C:\Windows\System\umjRVtS.exe
  C:\Windows\System\umjRVtS.exe
  2⤵
  PID:13572
- C:\Windows\System\GQybVwb.exe
  C:\Windows\System\GQybVwb.exe
  2⤵
  PID:13596
- C:\Windows\System\YgzQWcv.exe
  C:\Windows\System\YgzQWcv.exe
  2⤵
  PID:13628
- C:\Windows\System\MwbByoe.exe
  C:\Windows\System\MwbByoe.exe
  2⤵
  PID:13656
- C:\Windows\System\iuugcGX.exe
  C:\Windows\System\iuugcGX.exe
  2⤵
  PID:13680
- C:\Windows\System\CAZpWcY.exe
  C:\Windows\System\CAZpWcY.exe
  2⤵
  PID:13716
- C:\Windows\System\ApJVXOE.exe
  C:\Windows\System\ApJVXOE.exe
  2⤵
  PID:13736
- C:\Windows\System\tyywNzn.exe
  C:\Windows\System\tyywNzn.exe
  2⤵
  PID:13764
- C:\Windows\System\VuXbfRY.exe
  C:\Windows\System\VuXbfRY.exe
  2⤵
  PID:13780
- C:\Windows\System\MUbLXCQ.exe
  C:\Windows\System\MUbLXCQ.exe
  2⤵
  PID:13808
- C:\Windows\System\xWdpGHI.exe
  C:\Windows\System\xWdpGHI.exe
  2⤵
  PID:13828
- C:\Windows\System\ASwCNIn.exe
  C:\Windows\System\ASwCNIn.exe
  2⤵
  PID:13856
- C:\Windows\System\rIFYPYP.exe
  C:\Windows\System\rIFYPYP.exe
  2⤵
  PID:13904
- C:\Windows\System\iMRjxJw.exe
  C:\Windows\System\iMRjxJw.exe
  2⤵
  PID:13924
- C:\Windows\System\rEnCCYP.exe
  C:\Windows\System\rEnCCYP.exe
  2⤵
  PID:13944
- C:\Windows\System\NdmRbmC.exe
  C:\Windows\System\NdmRbmC.exe
  2⤵
  PID:13984
- C:\Windows\System\JhvPHuB.exe
  C:\Windows\System\JhvPHuB.exe
  2⤵
  PID:14000
- C:\Windows\System\EJqhjGM.exe
  C:\Windows\System\EJqhjGM.exe
  2⤵
  PID:14028
- C:\Windows\System\dFhUAcS.exe
  C:\Windows\System\dFhUAcS.exe
  2⤵
  PID:14052
- C:\Windows\System\QbtJUpg.exe
  C:\Windows\System\QbtJUpg.exe
  2⤵
  PID:14076
- C:\Windows\System\ZxzdNgr.exe
  C:\Windows\System\ZxzdNgr.exe
  2⤵
  PID:14104
- C:\Windows\System\KcaRwoz.exe
  C:\Windows\System\KcaRwoz.exe
  2⤵
  PID:14128
- C:\Windows\System\tXOHuKv.exe
  C:\Windows\System\tXOHuKv.exe
  2⤵
  PID:14148
- C:\Windows\System\IdBKhqh.exe
  C:\Windows\System\IdBKhqh.exe
  2⤵
  PID:14184
- C:\Windows\System\OcRZiLG.exe
  C:\Windows\System\OcRZiLG.exe
  2⤵
  PID:14220
- C:\Windows\System\YJUFoLm.exe
  C:\Windows\System\YJUFoLm.exe
  2⤵
  PID:14248
- C:\Windows\System\pLTOZBA.exe
  C:\Windows\System\pLTOZBA.exe
  2⤵
  PID:14264
- C:\Windows\System\DpoYGiX.exe
  C:\Windows\System\DpoYGiX.exe
  2⤵
  PID:14312
- C:\Windows\System\dsWlKpz.exe
  C:\Windows\System\dsWlKpz.exe
  2⤵
  PID:13320
- C:\Windows\System\YdNVJLD.exe
  C:\Windows\System\YdNVJLD.exe
  2⤵
  PID:13384
- C:\Windows\System\OKFRqKV.exe
  C:\Windows\System\OKFRqKV.exe
  2⤵
  PID:13444
- C:\Windows\System\HKCndpR.exe
  C:\Windows\System\HKCndpR.exe
  2⤵
  PID:13588
- C:\Windows\System\UlNCpRG.exe
  C:\Windows\System\UlNCpRG.exe
  2⤵
  PID:13616
- C:\Windows\System\PNVmVfO.exe
  C:\Windows\System\PNVmVfO.exe
  2⤵
  PID:13704
- C:\Windows\System\wuVkhOO.exe
  C:\Windows\System\wuVkhOO.exe
  2⤵
  PID:13844
- C:\Windows\System\JYhDBVj.exe
  C:\Windows\System\JYhDBVj.exe
  2⤵
  PID:13896
- C:\Windows\System\tXxeTAI.exe
  C:\Windows\System\tXxeTAI.exe
  2⤵
  PID:13980
- C:\Windows\System\TZvjMpR.exe
  C:\Windows\System\TZvjMpR.exe
  2⤵
  PID:14092
- C:\Windows\System\irvYcLU.exe
  C:\Windows\System\irvYcLU.exe
  2⤵
  PID:14036
- C:\Windows\System\hrJvKGX.exe
  C:\Windows\System\hrJvKGX.exe
  2⤵
  PID:14228
- C:\Windows\System\YACqfvQ.exe
  C:\Windows\System\YACqfvQ.exe
  2⤵
  PID:14284
- C:\Windows\System\HtzPrad.exe
  C:\Windows\System\HtzPrad.exe
  2⤵
  PID:14304
- C:\Windows\System\XHzqBSC.exe
  C:\Windows\System\XHzqBSC.exe
  2⤵
  PID:13352
- C:\Windows\System\tZHeYmk.exe
  C:\Windows\System\tZHeYmk.exe
  2⤵
  PID:13564
- C:\Windows\System\vZcoAwb.exe
  C:\Windows\System\vZcoAwb.exe
  2⤵
  PID:13756
- C:\Windows\System\WdeUNxx.exe
  C:\Windows\System\WdeUNxx.exe
  2⤵
  PID:13888
- C:\Windows\System\SStaoEn.exe
  C:\Windows\System\SStaoEn.exe
  2⤵
  PID:14120
- C:\Windows\System\myvHJVi.exe
  C:\Windows\System\myvHJVi.exe
  2⤵
  PID:14172
- C:\Windows\System\PKnOFJb.exe
  C:\Windows\System\PKnOFJb.exe
  2⤵
  PID:13512
- C:\Windows\System\EzaAdAg.exe
  C:\Windows\System\EzaAdAg.exe
  2⤵
  PID:384
- C:\Windows\System\Nctbnos.exe
  C:\Windows\System\Nctbnos.exe
  2⤵
  PID:14216
- C:\Windows\System\mladutd.exe
  C:\Windows\System\mladutd.exe
  2⤵
  PID:14164
- C:\Windows\System\SQEnAOH.exe
  C:\Windows\System\SQEnAOH.exe
  2⤵
  PID:14348
- C:\Windows\System\cMLRpNs.exe
  C:\Windows\System\cMLRpNs.exe
  2⤵
  PID:14376
- C:\Windows\System\yXmAtiV.exe
  C:\Windows\System\yXmAtiV.exe
  2⤵
  PID:14396
- C:\Windows\System\mXGsprv.exe
  C:\Windows\System\mXGsprv.exe
  2⤵
  PID:14416
- C:\Windows\System\HMZSSMz.exe
  C:\Windows\System\HMZSSMz.exe
  2⤵
  PID:14436
- C:\Windows\System\enfMEyu.exe
  C:\Windows\System\enfMEyu.exe
  2⤵
  PID:14464
- C:\Windows\System\WNopROR.exe
  C:\Windows\System\WNopROR.exe
  2⤵
  PID:14532
- C:\Windows\System\HJQhRii.exe
  C:\Windows\System\HJQhRii.exe
  2⤵
  PID:14556
- C:\Windows\System\otgKspi.exe
  C:\Windows\System\otgKspi.exe
  2⤵
  PID:14576
- C:\Windows\System\ZgmncOn.exe
  C:\Windows\System\ZgmncOn.exe
  2⤵
  PID:14616
- C:\Windows\System\QbksNzP.exe
  C:\Windows\System\QbksNzP.exe
  2⤵
  PID:14644
- C:\Windows\System\IJjyeEW.exe
  C:\Windows\System\IJjyeEW.exe
  2⤵
  PID:14664
- C:\Windows\System\yeBEGlf.exe
  C:\Windows\System\yeBEGlf.exe
  2⤵
  PID:14688
- C:\Windows\System\sBiVKgw.exe
  C:\Windows\System\sBiVKgw.exe
  2⤵
  PID:14728
- C:\Windows\System\EYhqeEx.exe
  C:\Windows\System\EYhqeEx.exe
  2⤵
  PID:14748
- C:\Windows\System\ejxopmq.exe
  C:\Windows\System\ejxopmq.exe
  2⤵
  PID:14772
- C:\Windows\System\OsJgjyw.exe
  C:\Windows\System\OsJgjyw.exe
  2⤵
  PID:14800
- C:\Windows\System\uRpUYUe.exe
  C:\Windows\System\uRpUYUe.exe
  2⤵
  PID:14820
- C:\Windows\System\GLYCTCX.exe
  C:\Windows\System\GLYCTCX.exe
  2⤵
  PID:14860
- C:\Windows\System\PZuDtxa.exe
  C:\Windows\System\PZuDtxa.exe
  2⤵
  PID:14896
- C:\Windows\System\PIDakhb.exe
  C:\Windows\System\PIDakhb.exe
  2⤵
  PID:14924
- C:\Windows\System\oysTwxR.exe
  C:\Windows\System\oysTwxR.exe
  2⤵
  PID:14952
- C:\Windows\System\JtKmoLK.exe
  C:\Windows\System\JtKmoLK.exe
  2⤵
  PID:14980
- C:\Windows\System\ORzWCXz.exe
  C:\Windows\System\ORzWCXz.exe
  2⤵
  PID:15008
- C:\Windows\System\yrSJYnj.exe
  C:\Windows\System\yrSJYnj.exe
  2⤵
  PID:15024
- C:\Windows\System\EqQCgvp.exe
  C:\Windows\System\EqQCgvp.exe
  2⤵
  PID:15064
- C:\Windows\System\OeZwGIZ.exe
  C:\Windows\System\OeZwGIZ.exe
  2⤵
  PID:15084
- C:\Windows\System\eyNlTnk.exe
  C:\Windows\System\eyNlTnk.exe
  2⤵
  PID:15112
- C:\Windows\System\GfylJbZ.exe
  C:\Windows\System\GfylJbZ.exe
  2⤵
  PID:15136
- C:\Windows\System\niRJplT.exe
  C:\Windows\System\niRJplT.exe
  2⤵
  PID:15156
- C:\Windows\System\tZRihWK.exe
  C:\Windows\System\tZRihWK.exe
  2⤵
  PID:15180
- C:\Windows\System\mjTtcPV.exe
  C:\Windows\System\mjTtcPV.exe
  2⤵
  PID:15204
- C:\Windows\System\jlWzWdc.exe
  C:\Windows\System\jlWzWdc.exe
  2⤵
  PID:15248
- C:\Windows\System\ZUGDhiW.exe
  C:\Windows\System\ZUGDhiW.exe
  2⤵
  PID:15288
- C:\Windows\System\bYTSASl.exe
  C:\Windows\System\bYTSASl.exe
  2⤵
  PID:15316
- C:\Windows\System\Owbgdee.exe
  C:\Windows\System\Owbgdee.exe
  2⤵
  PID:15336
- C:\Windows\System\CtNkGgh.exe
  C:\Windows\System\CtNkGgh.exe
  2⤵
  PID:14300
- C:\Windows\System\HoJGYez.exe
  C:\Windows\System\HoJGYez.exe
  2⤵
  PID:14388
- C:\Windows\System\NQQOnTD.exe
  C:\Windows\System\NQQOnTD.exe
  2⤵
  PID:14408
- C:\Windows\System\YDzQTbM.exe
  C:\Windows\System\YDzQTbM.exe
  2⤵
  PID:14460
- C:\Windows\System\HWYYXUU.exe
  C:\Windows\System\HWYYXUU.exe
  2⤵
  PID:14600
- C:\Windows\System\CcRoEOZ.exe
  C:\Windows\System\CcRoEOZ.exe
  2⤵
  PID:14628
- C:\Windows\System\dgMMeyQ.exe
  C:\Windows\System\dgMMeyQ.exe
  2⤵
  PID:14684
- C:\Windows\System\HFxqyrr.exe
  C:\Windows\System\HFxqyrr.exe
  2⤵
  PID:14788
- C:\Windows\System\ootPrZd.exe
  C:\Windows\System\ootPrZd.exe
  2⤵
  PID:14844
- C:\Windows\System\OIwczHP.exe
  C:\Windows\System\OIwczHP.exe
  2⤵
  PID:14892
- C:\Windows\System\OrcEsoT.exe
  C:\Windows\System\OrcEsoT.exe
  2⤵
  PID:14940
- C:\Windows\System\EzmGqcP.exe
  C:\Windows\System\EzmGqcP.exe
  2⤵
  PID:15052
- C:\Windows\System\vPErFXr.exe
  C:\Windows\System\vPErFXr.exe
  2⤵
  PID:15124
- C:\Windows\System\WDVsPsq.exe
  C:\Windows\System\WDVsPsq.exe
  2⤵
  PID:15168
- C:\Windows\System\AXBDVqi.exe
  C:\Windows\System\AXBDVqi.exe
  2⤵
  PID:15244
- C:\Windows\System\pvSnpOs.exe
  C:\Windows\System\pvSnpOs.exe
  2⤵
  PID:15312
- C:\Windows\System\nmelnEF.exe
  C:\Windows\System\nmelnEF.exe
  2⤵
  PID:15348
- C:\Windows\System\ezZIQLh.exe
  C:\Windows\System\ezZIQLh.exe
  2⤵
  PID:14424
- C:\Windows\System\YqKPJeI.exe
  C:\Windows\System\YqKPJeI.exe
  2⤵
  PID:14524
- C:\Windows\System\vKIotQE.exe
  C:\Windows\System\vKIotQE.exe
  2⤵
  PID:14756
- C:\Windows\System\rXoEmCf.exe
  C:\Windows\System\rXoEmCf.exe
  2⤵
  PID:14852
- C:\Windows\System\pbxHKVe.exe
  C:\Windows\System\pbxHKVe.exe
  2⤵
  PID:14064
- C:\Windows\System\fTrpmBW.exe
  C:\Windows\System\fTrpmBW.exe
  2⤵
  PID:15300
- C:\Windows\System\DmkPrrj.exe
  C:\Windows\System\DmkPrrj.exe
  2⤵
  PID:14372
- C:\Windows\System\TXxWgOV.exe
  C:\Windows\System\TXxWgOV.exe
  2⤵
  PID:14652
- C:\Windows\System\EvsjFHP.exe
  C:\Windows\System\EvsjFHP.exe
  2⤵
  PID:15100
- C:\Windows\System\UJtLzIO.exe
  C:\Windows\System\UJtLzIO.exe
  2⤵
  PID:14636
- C:\Windows\System\wZBVEzi.exe
  C:\Windows\System\wZBVEzi.exe
  2⤵
  PID:14572
- C:\Windows\System\KhfOlda.exe
  C:\Windows\System\KhfOlda.exe
  2⤵
  PID:15380
- C:\Windows\System\xeuqzPh.exe
  C:\Windows\System\xeuqzPh.exe
  2⤵
  PID:15420
- C:\Windows\System\AxedHVe.exe
  C:\Windows\System\AxedHVe.exe
  2⤵
  PID:15440
- C:\Windows\System\KrdbJNS.exe
  C:\Windows\System\KrdbJNS.exe
  2⤵
  PID:15464
- C:\Windows\System\ABQdgaD.exe
  C:\Windows\System\ABQdgaD.exe
  2⤵
  PID:15504
- C:\Windows\System\fXITEbO.exe
  C:\Windows\System\fXITEbO.exe
  2⤵
  PID:15532
- C:\Windows\System\aGIJkPY.exe
  C:\Windows\System\aGIJkPY.exe
  2⤵
  PID:15548
- C:\Windows\System\yRIsmOt.exe
  C:\Windows\System\yRIsmOt.exe
  2⤵
  PID:15568
- C:\Windows\System\XKFdSJj.exe
  C:\Windows\System\XKFdSJj.exe
  2⤵
  PID:15596
- C:\Windows\System\DnqrJSa.exe
  C:\Windows\System\DnqrJSa.exe
  2⤵
  PID:15624
- C:\Windows\System\lmzMvYj.exe
  C:\Windows\System\lmzMvYj.exe
  2⤵
  PID:15652
- C:\Windows\System\QHtoIaU.exe
  C:\Windows\System\QHtoIaU.exe
  2⤵
  PID:15684
- C:\Windows\System\VWGUUQB.exe
  C:\Windows\System\VWGUUQB.exe
  2⤵
  PID:15720
- C:\Windows\System\fXIfCgA.exe
  C:\Windows\System\fXIfCgA.exe
  2⤵
  PID:15744
- C:\Windows\System\JfZjRsP.exe
  C:\Windows\System\JfZjRsP.exe
  2⤵
  PID:15784
- C:\Windows\System\yNqnRKX.exe
  C:\Windows\System\yNqnRKX.exe
  2⤵
  PID:15812
- C:\Windows\System\aROfEjI.exe
  C:\Windows\System\aROfEjI.exe
  2⤵
  PID:15840
- C:\Windows\System\kNVDXOx.exe
  C:\Windows\System\kNVDXOx.exe
  2⤵
  PID:15868
- C:\Windows\System\nesQIMY.exe
  C:\Windows\System\nesQIMY.exe
  2⤵
  PID:15896
- C:\Windows\System\RGgQajp.exe
  C:\Windows\System\RGgQajp.exe
  2⤵
  PID:15924
- C:\Windows\System\EyDevLN.exe
  C:\Windows\System\EyDevLN.exe
  2⤵
  PID:15940
- C:\Windows\System\aZfqtIz.exe
  C:\Windows\System\aZfqtIz.exe
  2⤵
  PID:15972
- C:\Windows\System\WidnWDD.exe
  C:\Windows\System\WidnWDD.exe
  2⤵
  PID:15992
- C:\Windows\System\XDxQdEZ.exe
  C:\Windows\System\XDxQdEZ.exe
  2⤵
  PID:16036
- C:\Windows\System\GMllrJu.exe
  C:\Windows\System\GMllrJu.exe
  2⤵
  PID:16060
- C:\Windows\System\MQzNPcE.exe
  C:\Windows\System\MQzNPcE.exe
  2⤵
  PID:16084
- C:\Windows\System\tPbLXet.exe
  C:\Windows\System\tPbLXet.exe
  2⤵
  PID:16108
- C:\Windows\System\otZBPFN.exe
  C:\Windows\System\otZBPFN.exe
  2⤵
  PID:16148
- C:\Windows\System\hdefcGh.exe
  C:\Windows\System\hdefcGh.exe
  2⤵
  PID:16176
- C:\Windows\System\rlxLHtC.exe
  C:\Windows\System\rlxLHtC.exe
  2⤵
  PID:16192
- C:\Windows\System\CXmHxka.exe
  C:\Windows\System\CXmHxka.exe
  2⤵
  PID:16232
- C:\Windows\System\aLCJYOM.exe
  C:\Windows\System\aLCJYOM.exe
  2⤵
  PID:16272
- C:\Windows\System\ZLlcGJB.exe
  C:\Windows\System\ZLlcGJB.exe
  2⤵
  PID:16296
- C:\Windows\System\GdOvsjy.exe
  C:\Windows\System\GdOvsjy.exe
  2⤵
  PID:16328
- C:\Windows\System\lQpuKEU.exe
  C:\Windows\System\lQpuKEU.exe
  2⤵
  PID:16348
- C:\Windows\System\QMaRkqz.exe
  C:\Windows\System\QMaRkqz.exe
  2⤵
  PID:16372
- C:\Windows\System\EqYnePm.exe
  C:\Windows\System\EqYnePm.exe
  2⤵
  PID:15372
- C:\Windows\System\qZPPvAN.exe
  C:\Windows\System\qZPPvAN.exe
  2⤵
  PID:15428
- C:\Windows\System\pYHawgh.exe
  C:\Windows\System\pYHawgh.exe
  2⤵
  PID:15544
- C:\Windows\System\TmlGUba.exe
  C:\Windows\System\TmlGUba.exe
  2⤵
  PID:15612
- C:\Windows\System\aSzGeLs.exe
  C:\Windows\System\aSzGeLs.exe
  2⤵
  PID:15736
- C:\Windows\System\CMhpzuR.exe
  C:\Windows\System\CMhpzuR.exe
  2⤵
  PID:15804
- C:\Windows\System\zHPJjAZ.exe
  C:\Windows\System\zHPJjAZ.exe
  2⤵
  PID:15824
- C:\Windows\System\nHJMJtp.exe
  C:\Windows\System\nHJMJtp.exe
  2⤵
  PID:15932
- C:\Windows\System\yuAmBOn.exe
  C:\Windows\System\yuAmBOn.exe
  2⤵
  PID:15984
- C:\Windows\System\hGxiYPn.exe
  C:\Windows\System\hGxiYPn.exe
  2⤵
  PID:16056
- C:\Windows\System\FGkTyKD.exe
  C:\Windows\System\FGkTyKD.exe
  2⤵
  PID:16144
- C:\Windows\System\BuYOIth.exe
  C:\Windows\System\BuYOIth.exe
  2⤵
  PID:16228
- C:\Windows\System\tYhklph.exe
  C:\Windows\System\tYhklph.exe
  2⤵
  PID:16252
- C:\Windows\System\wWHeORI.exe
  C:\Windows\System\wWHeORI.exe
  2⤵
  PID:16344
- C:\Windows\System\MLmAqTG.exe
  C:\Windows\System\MLmAqTG.exe
  2⤵
  PID:15416
- C:\Windows\System\iltaufl.exe
  C:\Windows\System\iltaufl.exe
  2⤵
  PID:15528
- C:\Windows\System\NQOiPaz.exe
  C:\Windows\System\NQOiPaz.exe
  2⤵
  PID:15728
- C:\Windows\System\qIEBTkU.exe
  C:\Windows\System\qIEBTkU.exe
  2⤵
  PID:15860
- C:\Windows\System\disLbnt.exe
  C:\Windows\System\disLbnt.exe
  2⤵
  PID:15980
- C:\Windows\System\SyTIccU.exe
  C:\Windows\System\SyTIccU.exe
  2⤵
  PID:16188
- C:\Windows\System\jjBfrwC.exe
  C:\Windows\System\jjBfrwC.exe
  2⤵
  PID:16336
- C:\Windows\System\GOEvEDq.exe
  C:\Windows\System\GOEvEDq.exe
  2⤵
  PID:16312
- C:\Windows\System\jBsMdgW.exe
  C:\Windows\System\jBsMdgW.exe
  2⤵
  PID:15832
- C:\Windows\System\BEvenwk.exe
  C:\Windows\System\BEvenwk.exe
  2⤵
  PID:16208
- C:\Windows\System\yzOHToN.exe
  C:\Windows\System\yzOHToN.exe
  2⤵
  PID:15364
- C:\Windows\System\RhvBfnW.exe
  C:\Windows\System\RhvBfnW.exe
  2⤵
  PID:16392
- C:\Windows\System\TzbVeJY.exe
  C:\Windows\System\TzbVeJY.exe
  2⤵
  PID:16420
- C:\Windows\System\yIPWCoO.exe
  C:\Windows\System\yIPWCoO.exe
  2⤵
  PID:16452
- C:\Windows\System\WEUlcfQ.exe
  C:\Windows\System\WEUlcfQ.exe
  2⤵
  PID:16468
- C:\Windows\System\epTlZKY.exe
  C:\Windows\System\epTlZKY.exe
  2⤵
  PID:16492
- C:\Windows\System\tQZklLQ.exe
  C:\Windows\System\tQZklLQ.exe
  2⤵
  PID:16512
- C:\Windows\System\OZxmqIw.exe
  C:\Windows\System\OZxmqIw.exe
  2⤵
  PID:16540
- C:\Windows\System\YHnpTTl.exe
  C:\Windows\System\YHnpTTl.exe
  2⤵
  PID:16564
- C:\Windows\System\thHeafR.exe
  C:\Windows\System\thHeafR.exe
  2⤵
  PID:16588
- C:\Windows\System\msCsbVW.exe
  C:\Windows\System\msCsbVW.exe
  2⤵
  PID:16612
- C:\Windows\System\pWQnMhH.exe
  C:\Windows\System\pWQnMhH.exe
  2⤵
  PID:16644
- C:\Windows\System\GlXXeUX.exe
  C:\Windows\System\GlXXeUX.exe
  2⤵
  PID:16668
- C:\Windows\System\tKmgLvP.exe
  C:\Windows\System\tKmgLvP.exe
  2⤵
  PID:16692
- C:\Windows\System\kUmlDbA.exe
  C:\Windows\System\kUmlDbA.exe
  2⤵
  PID:16716
- C:\Windows\System\xEguctG.exe
  C:\Windows\System\xEguctG.exe
  2⤵
  PID:16736
- C:\Windows\System\ujfNfFh.exe
  C:\Windows\System\ujfNfFh.exe
  2⤵
  PID:16764
- C:\Windows\System\jkDAMFo.exe
  C:\Windows\System\jkDAMFo.exe
  2⤵
  PID:16784
- C:\Windows\System\PneTqch.exe
  C:\Windows\System\PneTqch.exe
  2⤵
  PID:16804
- C:\Windows\System\xMbjZNO.exe
  C:\Windows\System\xMbjZNO.exe
  2⤵
  PID:16832
- C:\Windows\System\GsAqkDV.exe
  C:\Windows\System\GsAqkDV.exe
  2⤵
  PID:16852
- C:\Windows\System\hiVwPSm.exe
  C:\Windows\System\hiVwPSm.exe
  2⤵
  PID:16876
- C:\Windows\System\CcnnqIP.exe
  C:\Windows\System\CcnnqIP.exe
  2⤵
  PID:16904
- C:\Windows\System\AxAwrBf.exe
  C:\Windows\System\AxAwrBf.exe
  2⤵
  PID:16920
- C:\Windows\System\wUfoJus.exe
  C:\Windows\System\wUfoJus.exe
  2⤵
  PID:16948
- C:\Windows\System\ILAQoSY.exe
  C:\Windows\System\ILAQoSY.exe
  2⤵
  PID:16968
- C:\Windows\System\EpFqycg.exe
  C:\Windows\System\EpFqycg.exe
  2⤵
  PID:17036
- - C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -u -p 17036 -s 248
    3⤵
    PID:17236
- C:\Windows\System\ByjqrPp.exe
  C:\Windows\System\ByjqrPp.exe
  2⤵
  PID:17064
- C:\Windows\System\iHhDpYB.exe
  C:\Windows\System\iHhDpYB.exe
  2⤵
  PID:17112
- C:\Windows\System\XntVTEo.exe
  C:\Windows\System\XntVTEo.exe
  2⤵
  PID:17144
- C:\Windows\System\uxQQtnC.exe
  C:\Windows\System\uxQQtnC.exe
  2⤵
  PID:17168
- C:\Windows\System\GWbrdCZ.exe
  C:\Windows\System\GWbrdCZ.exe
  2⤵
  PID:17192
- C:\Windows\System\zkNHsPc.exe
  C:\Windows\System\zkNHsPc.exe
  2⤵
  PID:17220
- C:\Windows\System\AKbNLAJ.exe
  C:\Windows\System\AKbNLAJ.exe
  2⤵
  PID:17248
- C:\Windows\System\rLBDPum.exe
  C:\Windows\System\rLBDPum.exe
  2⤵
  PID:17264
- C:\Windows\System\YmYHgso.exe
  C:\Windows\System\YmYHgso.exe
  2⤵
  PID:17288
- C:\Windows\System\TsTMJGR.exe
  C:\Windows\System\TsTMJGR.exe
  2⤵
  PID:17312

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:16848

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\APlFpRX.exe

Filesize
1.1MB

MD5
837e71b34ad9c91c00f163ab2e70f721

SHA1
791d6a0c80ba3d901ced7cc0d2d4f4d8037a717a

SHA256
198630f041bfd10828722f894dd64da9c027de3cdf08e22d9da0d73c3c1644e7

SHA512
5d257c96106e41c9d272b68cd68d31eef6af6ea311b8557e96e083e4ba489818c9c5b51f199e4938b6d858e42d5761c2a7102dab5a400d789e4f0af22ed3808a

Download Submit
C:\Windows\System\DLKsRZV.exe

Filesize
1.1MB

MD5
117097dd5c68348ca6ccd673399e4395

SHA1
76e94988336b4c2eb4bdde8a8c4094fd93028a67

SHA256
bfef9a791426c7c472825d98fb1ca0d5c038fc381f9703e93f13cc3eded97d66

SHA512
42f1cd1fc50f9512cd0e369cfcd40fd00a71d29427e5a995c9e24148161fd607b741689789e3ded39b1c33f10a67acfaf4bd8b946135bd2f4d0463d8cd68aad3

Download Submit
C:\Windows\System\DNvWmfj.exe

Filesize
1.1MB

MD5
e0aede8de3d564def86d1a6c2697133e

SHA1
bac9a001c8a9fd0cdabe8365b7721205472a5523

SHA256
326a42a659fa4c67d53f8dab6501e5f5fc60f0eeb51f62a5521ea364df549cc8

SHA512
8a21c32abd8a5de7aaf9ed8da8b036b38e2b343c0b0a85320fee49c30490d41c95f69a315083d65cf3114f7ab30b634c6742fc915e7b844b133ab2026fa586db

Download Submit
C:\Windows\System\DrROtnK.exe

Filesize
1.1MB

MD5
dab5da0794d50c5699ccdee656cb2708

SHA1
a1f9365704088fc00643cbb08d41a2daf3219ca2

SHA256
4aa65743ab13ae5d9a94d4b0319512bea5c06cad0eb182f50fd30d30b649d40d

SHA512
39c1bbbf05cdd65f5f40639a295db50f98fcbcea9fa63325fd0fa9d40a38e246f31584481a1a10a9c89290b221490870e4b2091c1541d424a03a98e2d62a5b78

Download Submit
C:\Windows\System\ExcGYPl.exe

Filesize
1.1MB

MD5
3df09475ce109d9795ae4a3be894c9ed

SHA1
f1403bdbf29f1a599fa938198fa39a0ffe1b7f49

SHA256
878ce48c5a91ffb83cd04df4e4ede2667209408c3338e471ca038d350c422fa2

SHA512
a8c736412352b6d00f5318babbb78de61fc544e212cfa703aeac65b86c1f6e695eb8294f528ca8c67669b2e7c687dd7e0af68953ecd77ee4feb6129ff0459c04

Download Submit
C:\Windows\System\FKmUSBw.exe

Filesize
1.1MB

MD5
e8dce591fc6b97c8d740f66d984f7d9d

SHA1
fb0c3142494f3cdcb3931ef7059599d9d8bda402

SHA256
8b4e7e451dcb497eab7f4d7e011509dc3c2fc27c5011f1e7f43fae4881b0f431

SHA512
dd7b8b9525bc8c95af877607723b21e03bf37505f12539602c08c11512570f85d5e85223c5eeb3d98303e17098b2c685aad7f90fd3614e6194b15c034d5641e8

Download Submit
C:\Windows\System\FUSZuGu.exe

Filesize
1.1MB

MD5
483e0bea319c3c9664e98ffef3f02195

SHA1
0c8cf2e32af6fe120626a9f69e6b76f88b902adf

SHA256
8c7d855ed9713a08a216a132dad805952efd4b2f9afe02bdde638e3d19934cc7

SHA512
0173a66d48e465a7b1f95c44d43a4079c3dd844cbe6bf137a044048b34e1f801b81656d0d419322d24e6519554f8135a308f6ad61465ae78cfa1da53fad77f4f

Download Submit
C:\Windows\System\IjoPogp.exe

Filesize
1.1MB

MD5
126a546bdc31dc8cd7d8d4dd9cb59aa4

SHA1
1e23c6d9ad2fc5d8e928c8f977850a52ecfb1828

SHA256
fdca9d5d9055bc1fea2151742af6845b207c2a3b310f83cd8fc3a20303ad73cb

SHA512
7eb8bdc3c798d4c085db7f4d2727ab30b1228885d32eb494265e53e7c3d689e58087c8499ca28930455cf79ca067d636d75b9e17e8bfd17d7a24f05fc86a07dd

Download Submit
C:\Windows\System\QANnfOb.exe

Filesize
1.1MB

MD5
88225c803c30435ee71a8e635e3c2026

SHA1
64901409bde09fb931f9c45a59da871fd50f63c7

SHA256
28693f9f284d1d3d5337f2a832c156eabbf0e2c62bcdf7ec534abad850fd81a3

SHA512
da29a3782ba94bdce00fd25cfc59edbfe18c532b7bab67604fcdfe92ac78f383853c26abec494e7cf360dff5d01b390f974a90d671f5af372b0afc39a63a3b39

Download Submit
C:\Windows\System\QdQfCrw.exe

Filesize
1.1MB

MD5
38246ef5e541523127370150dd1674fd

SHA1
ee8a6779d7808f6473c3053fbd416c275807bdf0

SHA256
17014d6ab3302e6289605a2ecabe0e1b5c355f648f1eb5f5439a2140f0a86f3a

SHA512
81675a8bef6a0d934f15867638d0672eb511984af539462d8555bebd457a2a14afa80c250ab668aadce47b4501dbdc677e4ab5fc40722294e39f61780b101b13

Download Submit
C:\Windows\System\QdyTnzY.exe

Filesize
1.1MB

MD5
ffa82a09705b0c8ec0491fa712afc3bd

SHA1
198a12e8aec83951f919d6e1c30f62a5267332e9

SHA256
7c55823bc4b108d449883dfe1175082829e1374e8ac6d29c36bf29e4e6b7ab10

SHA512
86eb7fa3258cfbf5a767e3cdea286a5171c92466818ab031c53f371c89e06bab98c3614d9bc8494289e9948df051d60e54eea6712e1f177b4e6341de385a573f

Download Submit
C:\Windows\System\QkzSceR.exe

Filesize
1.1MB

MD5
feb778622f1620ad563a1d2d2a6579e6

SHA1
301ff264b8d0d325812e32612b840c8fd3e1a9c9

SHA256
a7a2069a6cda302c66555a175efc530e7644886d7b0502981d80bc828b796f89

SHA512
82454fa3a50605e4e95138fcf639a2200c1d1a588e36aaf84a5f9f897f2092369094bbdb473450dc3bff2a0669469631025dd1efc33e34b69d2036075e264b72

Download Submit
C:\Windows\System\SIcHdMA.exe

Filesize
1.1MB

MD5
9132105575c83a3bb8e7a22a4aa8d37f

SHA1
dbb6dbe1b8ac0c91dbe2892fbb8002e838ca0d65

SHA256
0d2bb66197bcb03e25be4ecfa3ef2a7f2cf462d5ab817dc88e5a149032574a94

SHA512
e25b4a6c216549178ef09067738d6f68af28793068bcf4efa9ff880a1c36af28d68879926313a75158731000a748f8f70998bf649e514764f73820d4b845dbfc

Download Submit
C:\Windows\System\VyxydFW.exe

Filesize
1.1MB

MD5
f2e86b3af28432f684f9a1763ef0ece9

SHA1
1b32e53a954d358ddba8b6b0ab4a20b4e3042e62

SHA256
042d24194fc1679881fbb8b50c1925ad80c4b9546c0096aa80751ca8edc29519

SHA512
c44ba41e5fcf2132e97541f05b77ed3795e41d5b5843eac31ab3ff71ffbcb65500426904fbd58141d5cdba8010383071646b444e2ddf368129e197b72e715853

Download Submit
C:\Windows\System\WflauIj.exe

Filesize
1.1MB

MD5
b2389ad823601b31c95adea49b70c148

SHA1
793dd76b275e5be7095949e0545ecf7278b65a35

SHA256
7e193d2750f533f05d3324530783a64d58eb3eba6dc13a26b7499c94311a39ef

SHA512
a8fa1adb5f91747de4e29856c6d34cf64b5d02d221d41084c2ab8a4f946af76965fdc54f6bfe7797b120a5d84669fd787263cb80a406f588ef9a9ccf6f3ca3af

Download Submit
C:\Windows\System\WhEvgMU.exe

Filesize
1.1MB

MD5
60b2d06ae944f9042ac332f7508a992b

SHA1
eddbe636cf7c02b884ebe9f19bc90441c3920c2a

SHA256
75de7297a594ed378d6eb7c165d06562bd2a1b58ba96dc1de02cc74e2c366397

SHA512
5a2a0f648f5265d29747b1b9e0cb0974281461c8be1e8d543539da2f98b9cf247fc61074e3919f4271df9092561459feef296a9ce9dcf8cdb586904b9bb3a89a

Download Submit
C:\Windows\System\WxkbLGC.exe

Filesize
1.1MB

MD5
828e5cd3b1cbfbb71b4e3673381500f3

SHA1
00647bf2068770242434f68a4395cf1cd774b786

SHA256
cfff05a7489d9f564db08703f8831425c5407f9b7494e50faa9f0312dcbea11f

SHA512
8ad238f148718796e5e359c2a285588a520eb667a37017f6b9d28a6141b73a7be2dc3da452978192100f0d2bc0eaf16683b6db4858568d15e7167d8cd094d5fa

Download Submit
C:\Windows\System\XXEWGWR.exe

Filesize
1.1MB

MD5
18d3fafb5ab6cfc28d36d913b771889f

SHA1
b3f60b7bfa95b1b5e7524c4d088bc9544dbc5731

SHA256
654b514b54f82cce921db9b0c45d5d0e99c6670a946cbb8905588961055e7bd4

SHA512
f4bf528cd8cabd42bdbcc1ecdf3111402fad40456ea64e6d675f5c98230619a7898228d92bfa7ae10fa05e31560ba7d3609439089b25a2b50e50079e34e1e14f

Download Submit
C:\Windows\System\XqFCfql.exe

Filesize
1.1MB

MD5
66ef20468ee3a68a0378adab7aef79e4

SHA1
04127a171a1eb9d88583e9caa1f2b678e60bdf26

SHA256
6b59d8dc9aa6ca3e7b38cb5773fbf179a4daf77215d54cfe66064cd419a7fce2

SHA512
8cd133c41ca202a3a90a23c1248afd10162e4d25d99647fb54b73c5f1a63eef077a9b5869abd49aaeb3ae89557d923976d0f974fffe93ab02b65b952a693403d

Download Submit
C:\Windows\System\aWndquN.exe

Filesize
1.1MB

MD5
74c03d1aa76482b2eb5e160dbc40a183

SHA1
b9ea4aae5d96a67759056c6a3b76a26dc7809777

SHA256
3bcf3e1c521dbadd127174cd3ae7e5fc9abaae2899fdfaf08c2648a8f3eccce2

SHA512
4351eb11307d91f0ff736a48ef212f737e2ef26846bf0bbcec4ea95e379d8d27404e177a984a05fde78b13d79cb0ddb5428c0a099edf622f667ea7730d4dbc13

Download Submit
C:\Windows\System\bYcGIHX.exe

Filesize
1.1MB

MD5
3f6fcd6ff1e6ef6fc3abe5eb265c0fa5

SHA1
0da77fb6b96fb9da770bd28aa925623786ae5b3c

SHA256
c6504fabcdf18e22e5f5784f34c760ab03e2dd1efc5e0f927359435a8cf01dd9

SHA512
bf152d588fcde8ffeae5332d10e6fbbf4279330f70391b8745e5c91af578b439a1f187e5a9377adafddcae922571528d9064547784f50d88bddbb300564a80f1

Download Submit
C:\Windows\System\ccLdmlb.exe

Filesize
1.1MB

MD5
b5b64db223a19026a916d32943297677

SHA1
9928a1fa7a171c19b7aba96e0b59ee1ac219c5ee

SHA256
4822240eac499aa08a97a36fb4abc2726e92dafa211ac4625bde72744f6d9a2e

SHA512
e4d361870edab814e57106f022777272330d1a006e0f04eaf9c3244a4538879bc4344318b65b1bba3cffaad5e98ae999a10803e2b23945769719963a75682e49

Download Submit
C:\Windows\System\dxCoEih.exe

Filesize
1.1MB

MD5
6648412628f3ca2860999ab85a65ce4d

SHA1
9393f16955af9da5d7c59ccce603dab78f5e7baa

SHA256
d583e7cbe83756ac469cf5f9fab23ea9aa715460503ac19ce6ea6ace01d28410

SHA512
d8bc416ed63883be24e1d700d4cedaf95b4a2b508f3ee88e2255f95cd93b9a54f355589615e7eb06e31d224fd4acef80b36e80f45b6ab7930a2d0308ed22caea

Download Submit
C:\Windows\System\gMcTmDU.exe

Filesize
1.1MB

MD5
ac8ab3e5ac7b8f188edc4bf9129599a6

SHA1
0766cc54a0083ce73a8d8bf739e0b0ce57a67d2e

SHA256
33237fdd7bcf736ada3aa5dffe8832f329fba4d3fc0290f54aa03984f671d9a6

SHA512
4dff20027b1c21cfca80e68acba78e140ab3efb6a2e54013a0bbe539d59079182c257df883e8dbe0fd20d3aab9c18d716231a8f51fa856515633d7a73c339e1c

Download Submit
C:\Windows\System\hcPXHAW.exe

Filesize
1.1MB

MD5
e566e42fb87cfefee9a51d211ceeb721

SHA1
cfcb28e29e8f08e17e010a62c113091a050e8e43

SHA256
9c19c66d9c2adca385fb4d8957ab5a2dc07e701c00fd6d0e68e1de3af5eb863c

SHA512
c237f96706bedfd3855feb3a8adb6b281f1cfac413d49e369bd7d9fa5e540022bf7ce8de9446336e708f8c7fe766fd7efb14ee51a49734fd336e463690eb6bb9

Download Submit
C:\Windows\System\lPDNqks.exe

Filesize
1.1MB

MD5
af3ff144a6c0ac990ccf67413bb76943

SHA1
95b3b8a08e106af298f4e6156846358b1755398c

SHA256
12f9994e64b15aa160481520dc74d52df42020c82f0af413dd009a7213512355

SHA512
c69dac8c1e95a90651bec948c3292a845dbffe14950ea4e39d10ef6f2aa34bef60e6eed52e313ad31766d36fa435be6b8112e0dabd2930941f21d197b021d6ba

Download Submit
C:\Windows\System\mHFMmYv.exe

Filesize
1.1MB

MD5
91325ad787b2f237dfbfa9e51ac16c20

SHA1
d046ad05b24272b25fe1c570bb985e4dbb87176a

SHA256
76fe66211f1370dae3bdb8a1856fa7558a3be92beaee5b01ea1dbd0b4d8b776b

SHA512
48031534bb4932bb4c2c9138b30c2315626c2e1627568245763a917f5ee8e9b655b95a7ec29c49f297cdb9a418784b1b04d2dd92bc192ea23c21bd8b23379335

Download Submit
C:\Windows\System\mYxgGhD.exe

Filesize
1.1MB

MD5
2f4d8805cce7ec71eed264898c3017ed

SHA1
e137c97576b32befc5a63b612ebd005455324bfb

SHA256
e9855a00bfb73f02cb357d0c73fb1839998d03d8ba900b4820d5315d479441f7

SHA512
7e64ecfc4f8eb0ab278d2592b1320dffa3664876ddeaeaf6cedafbfb8cb1489b8b38570fe2e5dc46d447658bafe19c52da49f4242e39e8f72176c363c166cb2d

Download Submit
C:\Windows\System\oXlUdBh.exe

Filesize
1.1MB

MD5
3f13d2b9988150b4526f48f3174f102b

SHA1
77add939abf1a07e5d199aeda9ff43db667f1b6d

SHA256
6686b3fe1694a21e264e7bd7c0a00e9b30d562ca84ee99f074f3f97f8f7990eb

SHA512
102ac44bfee4111eac381a5155368d49230a84b615fecf778678eeed2b4592f04eb964176c7acf50e346ec400b299a50c1d3e4cd125b2d7d61dd107befacb54a

Download Submit
C:\Windows\System\rajpjhM.exe

Filesize
1.1MB

MD5
547e0b6ac0f6974e3c3d0a2e91ba6fca

SHA1
c275b87dbd65c8c8b1e8197b550459dcde802316

SHA256
15ed3d5d703a6b652415a2a52adc9dc10573f1177a867050e8b420e4b208e7e9

SHA512
579f73151d1ad24bd3db6a77666f1e3304bfcff8bca172d61caa3391314b43721f90d1e50bc8cca4277f2965ca2e7a8970d0af6c406349a409eddaee9d0c9696

Download Submit
C:\Windows\System\tJNBWkO.exe

Filesize
1.1MB

MD5
f1ce888e6d64723f8668f294dad0db43

SHA1
e523d8d9a768ed16cf61f311c268bcafb7b76799

SHA256
4d1d371d7092e064ce062d0079d46b6261263d2f203fa7861eb11609e0234430

SHA512
606cac0b1b4bf72b161fd86aeef3c58334c4c51e5ec1077a69deecf7eae412df1581e85db290c32b7c4c36d1ee85b2a092d1fa7915b7e88a3c3752c8997617df

Download Submit
C:\Windows\System\ucdrpAi.exe

Filesize
1.1MB

MD5
bf0d384db403cd4b46adf791849256c6

SHA1
e6db1eaa9120aa401f363a4c13650b14117f5a20

SHA256
f8aa7748bef24a7079fe0f745022e4aea1d0f7b917b8fd7d9df2219d0487e3bd

SHA512
a30c2b5a487a5dcb5cdeb7c3dcbd4bf39ac08dde18dd643b1f11aaff947f4d47b9dc12b803079461291e145ec21d3f9923de4ad29ad5742be0fce8f894a4feda

Download Submit
C:\Windows\System\xOcNFaA.exe

Filesize
1.1MB

MD5
74b36299238e8f5fac1cb8b096dda5ce

SHA1
d30fadef4e79d0b1bc4f21021aaadb4457082f7a

SHA256
32516443128b22eb9e98393e4d1ff97945cee6388ddaf46bffedaf2bca13bb37

SHA512
eb846618a431a84bb64d0f3fad577a595895f06599d874cb93ba1c49508c23575662ff2f0ee46986b4fd9d54ee4d24217c3af67807fbde031b61c3563a5f311c

Download Submit
memory/4140-0-0x0000027AD1880000-0x0000027AD1890000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads