xmrig | 48e25990bac9b43dcdc92976656e33e1c12c2ef11209350a625f05223a829a8c

Analysis

max time kernel
141s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
17-11-2024 04:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

48e25990bac9b43dcdc92976656e33e1c12c2ef11209350a625f05223a829a8c.exe
Size

1.5MB
MD5

a2a377ba915ae54b823dd65dcc1fe674
SHA1

cb31ea7e483cf1583b7ca18a449bceabebde4ae5
SHA256

48e25990bac9b43dcdc92976656e33e1c12c2ef11209350a625f05223a829a8c
SHA512

9e2d0777381693b2c2a18b51f76c6f532cb550a867a28adce1358ea5aa0c918ffef861046cd8cc0ff9481ee95c7a061467f42668fa6f50d364334d27e2e840f6
SSDEEP

24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbpwlKenszbWKDNEm/5O+7MMKTbc2:GezaTF8FcNkNdfE0pZ9ozttwIRxj4c5U

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 33 IoCs

miner

resource	yara_rule
behavioral2/files/0x000c000000023b2c-4.dat	xmrig
behavioral2/files/0x000a000000023b38-7.dat	xmrig
behavioral2/files/0x000a000000023b39-17.dat	xmrig
behavioral2/files/0x000a000000023b3c-26.dat	xmrig
behavioral2/files/0x000a000000023b44-55.dat	xmrig
behavioral2/files/0x000a000000023b47-65.dat	xmrig
behavioral2/files/0x000a000000023b4a-93.dat	xmrig
behavioral2/files/0x000a000000023b54-161.dat	xmrig
behavioral2/files/0x000a000000023b4d-159.dat	xmrig
behavioral2/files/0x000a000000023b53-157.dat	xmrig
behavioral2/files/0x000a000000023b52-155.dat	xmrig
behavioral2/files/0x000a000000023b51-153.dat	xmrig
behavioral2/files/0x000a000000023b4f-151.dat	xmrig
behavioral2/files/0x000a000000023b50-149.dat	xmrig
behavioral2/files/0x000a000000023b4c-147.dat	xmrig
behavioral2/files/0x000a000000023b56-145.dat	xmrig
behavioral2/files/0x000a000000023b4b-143.dat	xmrig
behavioral2/files/0x000a000000023b4e-141.dat	xmrig
behavioral2/files/0x000a000000023b55-140.dat	xmrig
behavioral2/files/0x000a000000023b49-130.dat	xmrig
behavioral2/files/0x000a000000023b48-128.dat	xmrig
behavioral2/files/0x000a000000023b41-112.dat	xmrig
behavioral2/files/0x000a000000023b3f-111.dat	xmrig
behavioral2/files/0x000a000000023b3e-106.dat	xmrig
behavioral2/files/0x000a000000023b45-97.dat	xmrig
behavioral2/files/0x000a000000023b43-92.dat	xmrig
behavioral2/files/0x000a000000023b40-86.dat	xmrig
behavioral2/files/0x000a000000023b3b-80.dat	xmrig
behavioral2/files/0x000a000000023b3a-78.dat	xmrig
behavioral2/files/0x000a000000023b46-72.dat	xmrig
behavioral2/files/0x000a000000023b42-87.dat	xmrig
behavioral2/files/0x000a000000023b3d-85.dat	xmrig
behavioral2/files/0x000a000000023b37-13.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
316	QifTxlC.exe
3364	ZmbKSAG.exe
3504	xWVeRXb.exe
1976	cYLvrYL.exe
3972	pFnpZMv.exe
4520	QxaavWI.exe
3768	PjZbaJu.exe
2148	ZKTDqKg.exe
4364	LKWRgwY.exe
872	pgVDpcD.exe
4352	bxYpICT.exe
4152	iWRdfzh.exe
4772	EkTivCD.exe
4808	oTINUMx.exe
3128	ayXfXwU.exe
984	CDffhCL.exe
3020	tQJXfiA.exe
2604	ZmPSMkC.exe
4724	XuuwmFN.exe
1368	nWyjgnp.exe
1440	JAzNxRl.exe
2260	AMMoTFx.exe
1696	dBZoCfd.exe
764	EyHxFnM.exe
3980	cgACXgW.exe
220	yvLWJbm.exe
2744	cbKzOcd.exe
5092	sRsbtQc.exe
1188	jnakcSV.exe
4336	PQgjExe.exe
1792	XoEmxpX.exe
3672	UWwwRbS.exe
4412	dDTvahS.exe
3916	GrCNbUH.exe
5056	eLIwkhz.exe
3048	zcrLkKN.exe
3568	VRPigtU.exe
1192	NuVwXmn.exe
4816	gwQVHKG.exe
1000	WkvWuYW.exe
4784	lLhEICx.exe
2276	kkkPXDo.exe
1156	dkuCWqR.exe
3760	UOFWIPV.exe
1116	kKwPPak.exe
4088	iimzaYk.exe
1040	yNEJMJf.exe
4472	qxWqCbb.exe
4332	rDUPLUe.exe
640	wRILVqs.exe
928	vmlshKc.exe
1968	jRWfbgz.exe
4828	LMBROGv.exe
2384	DKUhBNw.exe
2236	OWemdHd.exe
2992	esksfNj.exe
1328	pRTJQZD.exe
4368	EfCVkDX.exe
4952	aIhZuHq.exe
3424	Jbqzeel.exe
4968	BsJygMv.exe
3204	yjBfQlH.exe
524	FbtzNks.exe
384	wtQMMsU.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\FnMHgKl.exe	48e25990bac9b43dcdc92976656e33e1c12c2ef11209350a625f05223a829a8c.exe
File created	C:\Windows\System\TRIXLYO.exe	48e25990bac9b43dcdc92976656e33e1c12c2ef11209350a625f05223a829a8c.exe
File created	C:\Windows\System\HHlyGUU.exe	48e25990bac9b43dcdc92976656e33e1c12c2ef11209350a625f05223a829a8c.exe
File created	C:\Windows\System\hkcKtmJ.exe	48e25990bac9b43dcdc92976656e33e1c12c2ef11209350a625f05223a829a8c.exe
File created	C:\Windows\System\DKUhBNw.exe	48e25990bac9b43dcdc92976656e33e1c12c2ef11209350a625f05223a829a8c.exe
File created	C:\Windows\System\ehUEsmY.exe	48e25990bac9b43dcdc92976656e33e1c12c2ef11209350a625f05223a829a8c.exe
File created	C:\Windows\System\wrqIpol.exe	48e25990bac9b43dcdc92976656e33e1c12c2ef11209350a625f05223a829a8c.exe
File created	C:\Windows\System\JKhbOuF.exe	48e25990bac9b43dcdc92976656e33e1c12c2ef11209350a625f05223a829a8c.exe
File created	C:\Windows\System\ZKTDqKg.exe	48e25990bac9b43dcdc92976656e33e1c12c2ef11209350a625f05223a829a8c.exe
File created	C:\Windows\System\AwBwrLa.exe	48e25990bac9b43dcdc92976656e33e1c12c2ef11209350a625f05223a829a8c.exe
File created	C:\Windows\System\bWXOJOE.exe	48e25990bac9b43dcdc92976656e33e1c12c2ef11209350a625f05223a829a8c.exe
File created	C:\Windows\System\nTBubhM.exe	48e25990bac9b43dcdc92976656e33e1c12c2ef11209350a625f05223a829a8c.exe
File created	C:\Windows\System\wtQMMsU.exe	48e25990bac9b43dcdc92976656e33e1c12c2ef11209350a625f05223a829a8c.exe
File created	C:\Windows\System\dSVDDdj.exe	48e25990bac9b43dcdc92976656e33e1c12c2ef11209350a625f05223a829a8c.exe
File created	C:\Windows\System\PhkVgnA.exe	48e25990bac9b43dcdc92976656e33e1c12c2ef11209350a625f05223a829a8c.exe
File created	C:\Windows\System\wdSWCnX.exe	48e25990bac9b43dcdc92976656e33e1c12c2ef11209350a625f05223a829a8c.exe
File created	C:\Windows\System\wkvljWQ.exe	48e25990bac9b43dcdc92976656e33e1c12c2ef11209350a625f05223a829a8c.exe
File created	C:\Windows\System\GSTcYTn.exe	48e25990bac9b43dcdc92976656e33e1c12c2ef11209350a625f05223a829a8c.exe
File created	C:\Windows\System\jKuouEP.exe	48e25990bac9b43dcdc92976656e33e1c12c2ef11209350a625f05223a829a8c.exe
File created	C:\Windows\System\VEbOSKO.exe	48e25990bac9b43dcdc92976656e33e1c12c2ef11209350a625f05223a829a8c.exe
File created	C:\Windows\System\ItJoLhj.exe	48e25990bac9b43dcdc92976656e33e1c12c2ef11209350a625f05223a829a8c.exe
File created	C:\Windows\System\NbgMjfc.exe	48e25990bac9b43dcdc92976656e33e1c12c2ef11209350a625f05223a829a8c.exe
File created	C:\Windows\System\NZPQtsZ.exe	48e25990bac9b43dcdc92976656e33e1c12c2ef11209350a625f05223a829a8c.exe
File created	C:\Windows\System\fdjeiPh.exe	48e25990bac9b43dcdc92976656e33e1c12c2ef11209350a625f05223a829a8c.exe
File created	C:\Windows\System\PfhrypV.exe	48e25990bac9b43dcdc92976656e33e1c12c2ef11209350a625f05223a829a8c.exe
File created	C:\Windows\System\CMpBKoO.exe	48e25990bac9b43dcdc92976656e33e1c12c2ef11209350a625f05223a829a8c.exe
File created	C:\Windows\System\hvVpvoO.exe	48e25990bac9b43dcdc92976656e33e1c12c2ef11209350a625f05223a829a8c.exe
File created	C:\Windows\System\QVArdYx.exe	48e25990bac9b43dcdc92976656e33e1c12c2ef11209350a625f05223a829a8c.exe
File created	C:\Windows\System\NViskga.exe	48e25990bac9b43dcdc92976656e33e1c12c2ef11209350a625f05223a829a8c.exe
File created	C:\Windows\System\PrEBGbR.exe	48e25990bac9b43dcdc92976656e33e1c12c2ef11209350a625f05223a829a8c.exe
File created	C:\Windows\System\jHQRndR.exe	48e25990bac9b43dcdc92976656e33e1c12c2ef11209350a625f05223a829a8c.exe
File created	C:\Windows\System\DiTQmAg.exe	48e25990bac9b43dcdc92976656e33e1c12c2ef11209350a625f05223a829a8c.exe
File created	C:\Windows\System\fIiNPmu.exe	48e25990bac9b43dcdc92976656e33e1c12c2ef11209350a625f05223a829a8c.exe
File created	C:\Windows\System\YNtVbFn.exe	48e25990bac9b43dcdc92976656e33e1c12c2ef11209350a625f05223a829a8c.exe
File created	C:\Windows\System\CtkAFgW.exe	48e25990bac9b43dcdc92976656e33e1c12c2ef11209350a625f05223a829a8c.exe
File created	C:\Windows\System\XikUTcY.exe	48e25990bac9b43dcdc92976656e33e1c12c2ef11209350a625f05223a829a8c.exe
File created	C:\Windows\System\QXsnauq.exe	48e25990bac9b43dcdc92976656e33e1c12c2ef11209350a625f05223a829a8c.exe
File created	C:\Windows\System\LyOvKea.exe	48e25990bac9b43dcdc92976656e33e1c12c2ef11209350a625f05223a829a8c.exe
File created	C:\Windows\System\OqgOffO.exe	48e25990bac9b43dcdc92976656e33e1c12c2ef11209350a625f05223a829a8c.exe
File created	C:\Windows\System\ybzcBdT.exe	48e25990bac9b43dcdc92976656e33e1c12c2ef11209350a625f05223a829a8c.exe
File created	C:\Windows\System\NMcQARJ.exe	48e25990bac9b43dcdc92976656e33e1c12c2ef11209350a625f05223a829a8c.exe
File created	C:\Windows\System\VVslEbT.exe	48e25990bac9b43dcdc92976656e33e1c12c2ef11209350a625f05223a829a8c.exe
File created	C:\Windows\System\VPzjbTh.exe	48e25990bac9b43dcdc92976656e33e1c12c2ef11209350a625f05223a829a8c.exe
File created	C:\Windows\System\gjmfnqT.exe	48e25990bac9b43dcdc92976656e33e1c12c2ef11209350a625f05223a829a8c.exe
File created	C:\Windows\System\hvYAQlu.exe	48e25990bac9b43dcdc92976656e33e1c12c2ef11209350a625f05223a829a8c.exe
File created	C:\Windows\System\sLYiIld.exe	48e25990bac9b43dcdc92976656e33e1c12c2ef11209350a625f05223a829a8c.exe
File created	C:\Windows\System\cYLvrYL.exe	48e25990bac9b43dcdc92976656e33e1c12c2ef11209350a625f05223a829a8c.exe
File created	C:\Windows\System\HdMuxFt.exe	48e25990bac9b43dcdc92976656e33e1c12c2ef11209350a625f05223a829a8c.exe
File created	C:\Windows\System\AmPCfEb.exe	48e25990bac9b43dcdc92976656e33e1c12c2ef11209350a625f05223a829a8c.exe
File created	C:\Windows\System\wsQKKZu.exe	48e25990bac9b43dcdc92976656e33e1c12c2ef11209350a625f05223a829a8c.exe
File created	C:\Windows\System\NQncvvt.exe	48e25990bac9b43dcdc92976656e33e1c12c2ef11209350a625f05223a829a8c.exe
File created	C:\Windows\System\gfnGxIp.exe	48e25990bac9b43dcdc92976656e33e1c12c2ef11209350a625f05223a829a8c.exe
File created	C:\Windows\System\jpWoVpR.exe	48e25990bac9b43dcdc92976656e33e1c12c2ef11209350a625f05223a829a8c.exe
File created	C:\Windows\System\wyAjHih.exe	48e25990bac9b43dcdc92976656e33e1c12c2ef11209350a625f05223a829a8c.exe
File created	C:\Windows\System\EkTivCD.exe	48e25990bac9b43dcdc92976656e33e1c12c2ef11209350a625f05223a829a8c.exe
File created	C:\Windows\System\HDhvWtV.exe	48e25990bac9b43dcdc92976656e33e1c12c2ef11209350a625f05223a829a8c.exe
File created	C:\Windows\System\hVVaTlW.exe	48e25990bac9b43dcdc92976656e33e1c12c2ef11209350a625f05223a829a8c.exe
File created	C:\Windows\System\rbymkHK.exe	48e25990bac9b43dcdc92976656e33e1c12c2ef11209350a625f05223a829a8c.exe
File created	C:\Windows\System\TPiLeOa.exe	48e25990bac9b43dcdc92976656e33e1c12c2ef11209350a625f05223a829a8c.exe
File created	C:\Windows\System\jPqKpQV.exe	48e25990bac9b43dcdc92976656e33e1c12c2ef11209350a625f05223a829a8c.exe
File created	C:\Windows\System\VDYtCRX.exe	48e25990bac9b43dcdc92976656e33e1c12c2ef11209350a625f05223a829a8c.exe
File created	C:\Windows\System\lnHnwqy.exe	48e25990bac9b43dcdc92976656e33e1c12c2ef11209350a625f05223a829a8c.exe
File created	C:\Windows\System\swLHjCW.exe	48e25990bac9b43dcdc92976656e33e1c12c2ef11209350a625f05223a829a8c.exe
File created	C:\Windows\System\dCwHrOz.exe	48e25990bac9b43dcdc92976656e33e1c12c2ef11209350a625f05223a829a8c.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	16164	dwm.exe
Token: SeChangeNotifyPrivilege	16164	dwm.exe
Token: 33	16164	dwm.exe
Token: SeIncBasePriorityPrivilege	16164	dwm.exe
Token: SeShutdownPrivilege	16164	dwm.exe
Token: SeCreatePagefilePrivilege	16164	dwm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3064 wrote to memory of 316	3064	48e25990bac9b43dcdc92976656e33e1c12c2ef11209350a625f05223a829a8c.exe	83
PID 3064 wrote to memory of 316	3064	48e25990bac9b43dcdc92976656e33e1c12c2ef11209350a625f05223a829a8c.exe	83
PID 3064 wrote to memory of 3364	3064	48e25990bac9b43dcdc92976656e33e1c12c2ef11209350a625f05223a829a8c.exe	84
PID 3064 wrote to memory of 3364	3064	48e25990bac9b43dcdc92976656e33e1c12c2ef11209350a625f05223a829a8c.exe	84
PID 3064 wrote to memory of 3504	3064	48e25990bac9b43dcdc92976656e33e1c12c2ef11209350a625f05223a829a8c.exe	85
PID 3064 wrote to memory of 3504	3064	48e25990bac9b43dcdc92976656e33e1c12c2ef11209350a625f05223a829a8c.exe	85
PID 3064 wrote to memory of 1976	3064	48e25990bac9b43dcdc92976656e33e1c12c2ef11209350a625f05223a829a8c.exe	86
PID 3064 wrote to memory of 1976	3064	48e25990bac9b43dcdc92976656e33e1c12c2ef11209350a625f05223a829a8c.exe	86
PID 3064 wrote to memory of 3972	3064	48e25990bac9b43dcdc92976656e33e1c12c2ef11209350a625f05223a829a8c.exe	87
PID 3064 wrote to memory of 3972	3064	48e25990bac9b43dcdc92976656e33e1c12c2ef11209350a625f05223a829a8c.exe	87
PID 3064 wrote to memory of 4520	3064	48e25990bac9b43dcdc92976656e33e1c12c2ef11209350a625f05223a829a8c.exe	88
PID 3064 wrote to memory of 4520	3064	48e25990bac9b43dcdc92976656e33e1c12c2ef11209350a625f05223a829a8c.exe	88
PID 3064 wrote to memory of 3768	3064	48e25990bac9b43dcdc92976656e33e1c12c2ef11209350a625f05223a829a8c.exe	89
PID 3064 wrote to memory of 3768	3064	48e25990bac9b43dcdc92976656e33e1c12c2ef11209350a625f05223a829a8c.exe	89
PID 3064 wrote to memory of 2148	3064	48e25990bac9b43dcdc92976656e33e1c12c2ef11209350a625f05223a829a8c.exe	90
PID 3064 wrote to memory of 2148	3064	48e25990bac9b43dcdc92976656e33e1c12c2ef11209350a625f05223a829a8c.exe	90
PID 3064 wrote to memory of 4364	3064	48e25990bac9b43dcdc92976656e33e1c12c2ef11209350a625f05223a829a8c.exe	91
PID 3064 wrote to memory of 4364	3064	48e25990bac9b43dcdc92976656e33e1c12c2ef11209350a625f05223a829a8c.exe	91
PID 3064 wrote to memory of 872	3064	48e25990bac9b43dcdc92976656e33e1c12c2ef11209350a625f05223a829a8c.exe	92
PID 3064 wrote to memory of 872	3064	48e25990bac9b43dcdc92976656e33e1c12c2ef11209350a625f05223a829a8c.exe	92
PID 3064 wrote to memory of 4352	3064	48e25990bac9b43dcdc92976656e33e1c12c2ef11209350a625f05223a829a8c.exe	93
PID 3064 wrote to memory of 4352	3064	48e25990bac9b43dcdc92976656e33e1c12c2ef11209350a625f05223a829a8c.exe	93
PID 3064 wrote to memory of 4152	3064	48e25990bac9b43dcdc92976656e33e1c12c2ef11209350a625f05223a829a8c.exe	94
PID 3064 wrote to memory of 4152	3064	48e25990bac9b43dcdc92976656e33e1c12c2ef11209350a625f05223a829a8c.exe	94
PID 3064 wrote to memory of 4772	3064	48e25990bac9b43dcdc92976656e33e1c12c2ef11209350a625f05223a829a8c.exe	95
PID 3064 wrote to memory of 4772	3064	48e25990bac9b43dcdc92976656e33e1c12c2ef11209350a625f05223a829a8c.exe	95
PID 3064 wrote to memory of 4808	3064	48e25990bac9b43dcdc92976656e33e1c12c2ef11209350a625f05223a829a8c.exe	96
PID 3064 wrote to memory of 4808	3064	48e25990bac9b43dcdc92976656e33e1c12c2ef11209350a625f05223a829a8c.exe	96
PID 3064 wrote to memory of 3128	3064	48e25990bac9b43dcdc92976656e33e1c12c2ef11209350a625f05223a829a8c.exe	97
PID 3064 wrote to memory of 3128	3064	48e25990bac9b43dcdc92976656e33e1c12c2ef11209350a625f05223a829a8c.exe	97
PID 3064 wrote to memory of 984	3064	48e25990bac9b43dcdc92976656e33e1c12c2ef11209350a625f05223a829a8c.exe	98
PID 3064 wrote to memory of 984	3064	48e25990bac9b43dcdc92976656e33e1c12c2ef11209350a625f05223a829a8c.exe	98
PID 3064 wrote to memory of 3020	3064	48e25990bac9b43dcdc92976656e33e1c12c2ef11209350a625f05223a829a8c.exe	99
PID 3064 wrote to memory of 3020	3064	48e25990bac9b43dcdc92976656e33e1c12c2ef11209350a625f05223a829a8c.exe	99
PID 3064 wrote to memory of 2604	3064	48e25990bac9b43dcdc92976656e33e1c12c2ef11209350a625f05223a829a8c.exe	100
PID 3064 wrote to memory of 2604	3064	48e25990bac9b43dcdc92976656e33e1c12c2ef11209350a625f05223a829a8c.exe	100
PID 3064 wrote to memory of 4724	3064	48e25990bac9b43dcdc92976656e33e1c12c2ef11209350a625f05223a829a8c.exe	101
PID 3064 wrote to memory of 4724	3064	48e25990bac9b43dcdc92976656e33e1c12c2ef11209350a625f05223a829a8c.exe	101
PID 3064 wrote to memory of 1368	3064	48e25990bac9b43dcdc92976656e33e1c12c2ef11209350a625f05223a829a8c.exe	102
PID 3064 wrote to memory of 1368	3064	48e25990bac9b43dcdc92976656e33e1c12c2ef11209350a625f05223a829a8c.exe	102
PID 3064 wrote to memory of 1440	3064	48e25990bac9b43dcdc92976656e33e1c12c2ef11209350a625f05223a829a8c.exe	103
PID 3064 wrote to memory of 1440	3064	48e25990bac9b43dcdc92976656e33e1c12c2ef11209350a625f05223a829a8c.exe	103
PID 3064 wrote to memory of 2260	3064	48e25990bac9b43dcdc92976656e33e1c12c2ef11209350a625f05223a829a8c.exe	104
PID 3064 wrote to memory of 2260	3064	48e25990bac9b43dcdc92976656e33e1c12c2ef11209350a625f05223a829a8c.exe	104
PID 3064 wrote to memory of 1696	3064	48e25990bac9b43dcdc92976656e33e1c12c2ef11209350a625f05223a829a8c.exe	105
PID 3064 wrote to memory of 1696	3064	48e25990bac9b43dcdc92976656e33e1c12c2ef11209350a625f05223a829a8c.exe	105
PID 3064 wrote to memory of 764	3064	48e25990bac9b43dcdc92976656e33e1c12c2ef11209350a625f05223a829a8c.exe	106
PID 3064 wrote to memory of 764	3064	48e25990bac9b43dcdc92976656e33e1c12c2ef11209350a625f05223a829a8c.exe	106
PID 3064 wrote to memory of 3980	3064	48e25990bac9b43dcdc92976656e33e1c12c2ef11209350a625f05223a829a8c.exe	107
PID 3064 wrote to memory of 3980	3064	48e25990bac9b43dcdc92976656e33e1c12c2ef11209350a625f05223a829a8c.exe	107
PID 3064 wrote to memory of 220	3064	48e25990bac9b43dcdc92976656e33e1c12c2ef11209350a625f05223a829a8c.exe	108
PID 3064 wrote to memory of 220	3064	48e25990bac9b43dcdc92976656e33e1c12c2ef11209350a625f05223a829a8c.exe	108
PID 3064 wrote to memory of 2744	3064	48e25990bac9b43dcdc92976656e33e1c12c2ef11209350a625f05223a829a8c.exe	109
PID 3064 wrote to memory of 2744	3064	48e25990bac9b43dcdc92976656e33e1c12c2ef11209350a625f05223a829a8c.exe	109
PID 3064 wrote to memory of 5092	3064	48e25990bac9b43dcdc92976656e33e1c12c2ef11209350a625f05223a829a8c.exe	110
PID 3064 wrote to memory of 5092	3064	48e25990bac9b43dcdc92976656e33e1c12c2ef11209350a625f05223a829a8c.exe	110
PID 3064 wrote to memory of 1188	3064	48e25990bac9b43dcdc92976656e33e1c12c2ef11209350a625f05223a829a8c.exe	111
PID 3064 wrote to memory of 1188	3064	48e25990bac9b43dcdc92976656e33e1c12c2ef11209350a625f05223a829a8c.exe	111
PID 3064 wrote to memory of 4336	3064	48e25990bac9b43dcdc92976656e33e1c12c2ef11209350a625f05223a829a8c.exe	112
PID 3064 wrote to memory of 4336	3064	48e25990bac9b43dcdc92976656e33e1c12c2ef11209350a625f05223a829a8c.exe	112
PID 3064 wrote to memory of 1792	3064	48e25990bac9b43dcdc92976656e33e1c12c2ef11209350a625f05223a829a8c.exe	113
PID 3064 wrote to memory of 1792	3064	48e25990bac9b43dcdc92976656e33e1c12c2ef11209350a625f05223a829a8c.exe	113
PID 3064 wrote to memory of 3672	3064	48e25990bac9b43dcdc92976656e33e1c12c2ef11209350a625f05223a829a8c.exe	114
PID 3064 wrote to memory of 3672	3064	48e25990bac9b43dcdc92976656e33e1c12c2ef11209350a625f05223a829a8c.exe	114

C:\Users\Admin\AppData\Local\Temp\48e25990bac9b43dcdc92976656e33e1c12c2ef11209350a625f05223a829a8c.exe
"C:\Users\Admin\AppData\Local\Temp\48e25990bac9b43dcdc92976656e33e1c12c2ef11209350a625f05223a829a8c.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3064
- C:\Windows\System\QifTxlC.exe
  C:\Windows\System\QifTxlC.exe
  2⤵
  - Executes dropped EXE
  PID:316
- C:\Windows\System\ZmbKSAG.exe
  C:\Windows\System\ZmbKSAG.exe
  2⤵
  - Executes dropped EXE
  PID:3364
- C:\Windows\System\xWVeRXb.exe
  C:\Windows\System\xWVeRXb.exe
  2⤵
  - Executes dropped EXE
  PID:3504
- C:\Windows\System\cYLvrYL.exe
  C:\Windows\System\cYLvrYL.exe
  2⤵
  - Executes dropped EXE
  PID:1976
- C:\Windows\System\pFnpZMv.exe
  C:\Windows\System\pFnpZMv.exe
  2⤵
  - Executes dropped EXE
  PID:3972
- C:\Windows\System\QxaavWI.exe
  C:\Windows\System\QxaavWI.exe
  2⤵
  - Executes dropped EXE
  PID:4520
- C:\Windows\System\PjZbaJu.exe
  C:\Windows\System\PjZbaJu.exe
  2⤵
  - Executes dropped EXE
  PID:3768
- C:\Windows\System\ZKTDqKg.exe
  C:\Windows\System\ZKTDqKg.exe
  2⤵
  - Executes dropped EXE
  PID:2148
- C:\Windows\System\LKWRgwY.exe
  C:\Windows\System\LKWRgwY.exe
  2⤵
  - Executes dropped EXE
  PID:4364
- C:\Windows\System\pgVDpcD.exe
  C:\Windows\System\pgVDpcD.exe
  2⤵
  - Executes dropped EXE
  PID:872
- C:\Windows\System\bxYpICT.exe
  C:\Windows\System\bxYpICT.exe
  2⤵
  - Executes dropped EXE
  PID:4352
- C:\Windows\System\iWRdfzh.exe
  C:\Windows\System\iWRdfzh.exe
  2⤵
  - Executes dropped EXE
  PID:4152
- C:\Windows\System\EkTivCD.exe
  C:\Windows\System\EkTivCD.exe
  2⤵
  - Executes dropped EXE
  PID:4772
- C:\Windows\System\oTINUMx.exe
  C:\Windows\System\oTINUMx.exe
  2⤵
  - Executes dropped EXE
  PID:4808
- C:\Windows\System\ayXfXwU.exe
  C:\Windows\System\ayXfXwU.exe
  2⤵
  - Executes dropped EXE
  PID:3128
- C:\Windows\System\CDffhCL.exe
  C:\Windows\System\CDffhCL.exe
  2⤵
  - Executes dropped EXE
  PID:984
- C:\Windows\System\tQJXfiA.exe
  C:\Windows\System\tQJXfiA.exe
  2⤵
  - Executes dropped EXE
  PID:3020
- C:\Windows\System\ZmPSMkC.exe
  C:\Windows\System\ZmPSMkC.exe
  2⤵
  - Executes dropped EXE
  PID:2604
- C:\Windows\System\XuuwmFN.exe
  C:\Windows\System\XuuwmFN.exe
  2⤵
  - Executes dropped EXE
  PID:4724
- C:\Windows\System\nWyjgnp.exe
  C:\Windows\System\nWyjgnp.exe
  2⤵
  - Executes dropped EXE
  PID:1368
- C:\Windows\System\JAzNxRl.exe
  C:\Windows\System\JAzNxRl.exe
  2⤵
  - Executes dropped EXE
  PID:1440
- C:\Windows\System\AMMoTFx.exe
  C:\Windows\System\AMMoTFx.exe
  2⤵
  - Executes dropped EXE
  PID:2260
- C:\Windows\System\dBZoCfd.exe
  C:\Windows\System\dBZoCfd.exe
  2⤵
  - Executes dropped EXE
  PID:1696
- C:\Windows\System\EyHxFnM.exe
  C:\Windows\System\EyHxFnM.exe
  2⤵
  - Executes dropped EXE
  PID:764
- C:\Windows\System\cgACXgW.exe
  C:\Windows\System\cgACXgW.exe
  2⤵
  - Executes dropped EXE
  PID:3980
- C:\Windows\System\yvLWJbm.exe
  C:\Windows\System\yvLWJbm.exe
  2⤵
  - Executes dropped EXE
  PID:220
- C:\Windows\System\cbKzOcd.exe
  C:\Windows\System\cbKzOcd.exe
  2⤵
  - Executes dropped EXE
  PID:2744
- C:\Windows\System\sRsbtQc.exe
  C:\Windows\System\sRsbtQc.exe
  2⤵
  - Executes dropped EXE
  PID:5092
- C:\Windows\System\jnakcSV.exe
  C:\Windows\System\jnakcSV.exe
  2⤵
  - Executes dropped EXE
  PID:1188
- C:\Windows\System\PQgjExe.exe
  C:\Windows\System\PQgjExe.exe
  2⤵
  - Executes dropped EXE
  PID:4336
- C:\Windows\System\XoEmxpX.exe
  C:\Windows\System\XoEmxpX.exe
  2⤵
  - Executes dropped EXE
  PID:1792
- C:\Windows\System\UWwwRbS.exe
  C:\Windows\System\UWwwRbS.exe
  2⤵
  - Executes dropped EXE
  PID:3672
- C:\Windows\System\dDTvahS.exe
  C:\Windows\System\dDTvahS.exe
  2⤵
  - Executes dropped EXE
  PID:4412
- C:\Windows\System\GrCNbUH.exe
  C:\Windows\System\GrCNbUH.exe
  2⤵
  - Executes dropped EXE
  PID:3916
- C:\Windows\System\eLIwkhz.exe
  C:\Windows\System\eLIwkhz.exe
  2⤵
  - Executes dropped EXE
  PID:5056
- C:\Windows\System\zcrLkKN.exe
  C:\Windows\System\zcrLkKN.exe
  2⤵
  - Executes dropped EXE
  PID:3048
- C:\Windows\System\VRPigtU.exe
  C:\Windows\System\VRPigtU.exe
  2⤵
  - Executes dropped EXE
  PID:3568
- C:\Windows\System\NuVwXmn.exe
  C:\Windows\System\NuVwXmn.exe
  2⤵
  - Executes dropped EXE
  PID:1192
- C:\Windows\System\gwQVHKG.exe
  C:\Windows\System\gwQVHKG.exe
  2⤵
  - Executes dropped EXE
  PID:4816
- C:\Windows\System\WkvWuYW.exe
  C:\Windows\System\WkvWuYW.exe
  2⤵
  - Executes dropped EXE
  PID:1000
- C:\Windows\System\lLhEICx.exe
  C:\Windows\System\lLhEICx.exe
  2⤵
  - Executes dropped EXE
  PID:4784
- C:\Windows\System\kkkPXDo.exe
  C:\Windows\System\kkkPXDo.exe
  2⤵
  - Executes dropped EXE
  PID:2276
- C:\Windows\System\dkuCWqR.exe
  C:\Windows\System\dkuCWqR.exe
  2⤵
  - Executes dropped EXE
  PID:1156
- C:\Windows\System\UOFWIPV.exe
  C:\Windows\System\UOFWIPV.exe
  2⤵
  - Executes dropped EXE
  PID:3760
- C:\Windows\System\kKwPPak.exe
  C:\Windows\System\kKwPPak.exe
  2⤵
  - Executes dropped EXE
  PID:1116
- C:\Windows\System\iimzaYk.exe
  C:\Windows\System\iimzaYk.exe
  2⤵
  - Executes dropped EXE
  PID:4088
- C:\Windows\System\yNEJMJf.exe
  C:\Windows\System\yNEJMJf.exe
  2⤵
  - Executes dropped EXE
  PID:1040
- C:\Windows\System\qxWqCbb.exe
  C:\Windows\System\qxWqCbb.exe
  2⤵
  - Executes dropped EXE
  PID:4472
- C:\Windows\System\rDUPLUe.exe
  C:\Windows\System\rDUPLUe.exe
  2⤵
  - Executes dropped EXE
  PID:4332
- C:\Windows\System\wRILVqs.exe
  C:\Windows\System\wRILVqs.exe
  2⤵
  - Executes dropped EXE
  PID:640
- C:\Windows\System\vmlshKc.exe
  C:\Windows\System\vmlshKc.exe
  2⤵
  - Executes dropped EXE
  PID:928
- C:\Windows\System\jRWfbgz.exe
  C:\Windows\System\jRWfbgz.exe
  2⤵
  - Executes dropped EXE
  PID:1968
- C:\Windows\System\LMBROGv.exe
  C:\Windows\System\LMBROGv.exe
  2⤵
  - Executes dropped EXE
  PID:4828
- C:\Windows\System\OWemdHd.exe
  C:\Windows\System\OWemdHd.exe
  2⤵
  - Executes dropped EXE
  PID:2236
- C:\Windows\System\DKUhBNw.exe
  C:\Windows\System\DKUhBNw.exe
  2⤵
  - Executes dropped EXE
  PID:2384
- C:\Windows\System\EfCVkDX.exe
  C:\Windows\System\EfCVkDX.exe
  2⤵
  - Executes dropped EXE
  PID:4368
- C:\Windows\System\esksfNj.exe
  C:\Windows\System\esksfNj.exe
  2⤵
  - Executes dropped EXE
  PID:2992
- C:\Windows\System\pRTJQZD.exe
  C:\Windows\System\pRTJQZD.exe
  2⤵
  - Executes dropped EXE
  PID:1328
- C:\Windows\System\aIhZuHq.exe
  C:\Windows\System\aIhZuHq.exe
  2⤵
  - Executes dropped EXE
  PID:4952
- C:\Windows\System\Jbqzeel.exe
  C:\Windows\System\Jbqzeel.exe
  2⤵
  - Executes dropped EXE
  PID:3424
- C:\Windows\System\BsJygMv.exe
  C:\Windows\System\BsJygMv.exe
  2⤵
  - Executes dropped EXE
  PID:4968
- C:\Windows\System\yjBfQlH.exe
  C:\Windows\System\yjBfQlH.exe
  2⤵
  - Executes dropped EXE
  PID:3204
- C:\Windows\System\wtQMMsU.exe
  C:\Windows\System\wtQMMsU.exe
  2⤵
  - Executes dropped EXE
  PID:384
- C:\Windows\System\FbtzNks.exe
  C:\Windows\System\FbtzNks.exe
  2⤵
  - Executes dropped EXE
  PID:524
- C:\Windows\System\tBxrJyD.exe
  C:\Windows\System\tBxrJyD.exe
  2⤵
  PID:3292
- C:\Windows\System\YVeRMSz.exe
  C:\Windows\System\YVeRMSz.exe
  2⤵
  PID:3616
- C:\Windows\System\vEKSGNn.exe
  C:\Windows\System\vEKSGNn.exe
  2⤵
  PID:4264
- C:\Windows\System\jpWoVpR.exe
  C:\Windows\System\jpWoVpR.exe
  2⤵
  PID:1596
- C:\Windows\System\ONQPBzd.exe
  C:\Windows\System\ONQPBzd.exe
  2⤵
  PID:2008
- C:\Windows\System\ZQmyYui.exe
  C:\Windows\System\ZQmyYui.exe
  2⤵
  PID:4500
- C:\Windows\System\aAiWALH.exe
  C:\Windows\System\aAiWALH.exe
  2⤵
  PID:1896
- C:\Windows\System\TVnPYJu.exe
  C:\Windows\System\TVnPYJu.exe
  2⤵
  PID:3112
- C:\Windows\System\bDsORfw.exe
  C:\Windows\System\bDsORfw.exe
  2⤵
  PID:1620
- C:\Windows\System\dxCtiYu.exe
  C:\Windows\System\dxCtiYu.exe
  2⤵
  PID:4752
- C:\Windows\System\CSTGHXx.exe
  C:\Windows\System\CSTGHXx.exe
  2⤵
  PID:5112
- C:\Windows\System\oNzRtzx.exe
  C:\Windows\System\oNzRtzx.exe
  2⤵
  PID:4756
- C:\Windows\System\UtbfjfR.exe
  C:\Windows\System\UtbfjfR.exe
  2⤵
  PID:2908
- C:\Windows\System\rCDNypZ.exe
  C:\Windows\System\rCDNypZ.exe
  2⤵
  PID:4708
- C:\Windows\System\GbZVwhO.exe
  C:\Windows\System\GbZVwhO.exe
  2⤵
  PID:3928
- C:\Windows\System\TUoybaV.exe
  C:\Windows\System\TUoybaV.exe
  2⤵
  PID:3668
- C:\Windows\System\akjMqtM.exe
  C:\Windows\System\akjMqtM.exe
  2⤵
  PID:2772
- C:\Windows\System\GPIqTQc.exe
  C:\Windows\System\GPIqTQc.exe
  2⤵
  PID:940
- C:\Windows\System\iQXXCHk.exe
  C:\Windows\System\iQXXCHk.exe
  2⤵
  PID:228
- C:\Windows\System\DKbmpnz.exe
  C:\Windows\System\DKbmpnz.exe
  2⤵
  PID:4696
- C:\Windows\System\HterYZu.exe
  C:\Windows\System\HterYZu.exe
  2⤵
  PID:2628
- C:\Windows\System\tztNLQB.exe
  C:\Windows\System\tztNLQB.exe
  2⤵
  PID:884
- C:\Windows\System\pxziuwN.exe
  C:\Windows\System\pxziuwN.exe
  2⤵
  PID:4444
- C:\Windows\System\MoimkxO.exe
  C:\Windows\System\MoimkxO.exe
  2⤵
  PID:2708
- C:\Windows\System\VvjVbmZ.exe
  C:\Windows\System\VvjVbmZ.exe
  2⤵
  PID:1404
- C:\Windows\System\tTEvHvn.exe
  C:\Windows\System\tTEvHvn.exe
  2⤵
  PID:2740
- C:\Windows\System\uspVLsc.exe
  C:\Windows\System\uspVLsc.exe
  2⤵
  PID:2372
- C:\Windows\System\uOXgiyE.exe
  C:\Windows\System\uOXgiyE.exe
  2⤵
  PID:4324
- C:\Windows\System\RzLTldT.exe
  C:\Windows\System\RzLTldT.exe
  2⤵
  PID:2504
- C:\Windows\System\zpgWdxd.exe
  C:\Windows\System\zpgWdxd.exe
  2⤵
  PID:5100
- C:\Windows\System\HiyxsjS.exe
  C:\Windows\System\HiyxsjS.exe
  2⤵
  PID:4320
- C:\Windows\System\tkygblA.exe
  C:\Windows\System\tkygblA.exe
  2⤵
  PID:2492
- C:\Windows\System\jPqKpQV.exe
  C:\Windows\System\jPqKpQV.exe
  2⤵
  PID:844
- C:\Windows\System\DgbdBBX.exe
  C:\Windows\System\DgbdBBX.exe
  2⤵
  PID:4436
- C:\Windows\System\iLUcsiH.exe
  C:\Windows\System\iLUcsiH.exe
  2⤵
  PID:5156
- C:\Windows\System\TRIXLYO.exe
  C:\Windows\System\TRIXLYO.exe
  2⤵
  PID:5192
- C:\Windows\System\mUZWNRr.exe
  C:\Windows\System\mUZWNRr.exe
  2⤵
  PID:5224
- C:\Windows\System\vqzAvAL.exe
  C:\Windows\System\vqzAvAL.exe
  2⤵
  PID:5256
- C:\Windows\System\qkliNzj.exe
  C:\Windows\System\qkliNzj.exe
  2⤵
  PID:5288
- C:\Windows\System\iOizguz.exe
  C:\Windows\System\iOizguz.exe
  2⤵
  PID:5316
- C:\Windows\System\pzuytZG.exe
  C:\Windows\System\pzuytZG.exe
  2⤵
  PID:5352
- C:\Windows\System\NYqkdMl.exe
  C:\Windows\System\NYqkdMl.exe
  2⤵
  PID:5392
- C:\Windows\System\kxFJqYE.exe
  C:\Windows\System\kxFJqYE.exe
  2⤵
  PID:5420
- C:\Windows\System\ZMmqCGe.exe
  C:\Windows\System\ZMmqCGe.exe
  2⤵
  PID:5440
- C:\Windows\System\SuuQTql.exe
  C:\Windows\System\SuuQTql.exe
  2⤵
  PID:5512
- C:\Windows\System\sgshQNc.exe
  C:\Windows\System\sgshQNc.exe
  2⤵
  PID:5528
- C:\Windows\System\PDAjHYv.exe
  C:\Windows\System\PDAjHYv.exe
  2⤵
  PID:5548
- C:\Windows\System\iNnjdUT.exe
  C:\Windows\System\iNnjdUT.exe
  2⤵
  PID:5576
- C:\Windows\System\dIzrLhQ.exe
  C:\Windows\System\dIzrLhQ.exe
  2⤵
  PID:5600
- C:\Windows\System\swLHjCW.exe
  C:\Windows\System\swLHjCW.exe
  2⤵
  PID:5616
- C:\Windows\System\UGcXMLC.exe
  C:\Windows\System\UGcXMLC.exe
  2⤵
  PID:5648
- C:\Windows\System\ZxEGreL.exe
  C:\Windows\System\ZxEGreL.exe
  2⤵
  PID:5672
- C:\Windows\System\REZZvHC.exe
  C:\Windows\System\REZZvHC.exe
  2⤵
  PID:5700
- C:\Windows\System\crMuXko.exe
  C:\Windows\System\crMuXko.exe
  2⤵
  PID:5736
- C:\Windows\System\OpdXWNk.exe
  C:\Windows\System\OpdXWNk.exe
  2⤵
  PID:5756
- C:\Windows\System\iSjzmAO.exe
  C:\Windows\System\iSjzmAO.exe
  2⤵
  PID:5784
- C:\Windows\System\GmTIbvr.exe
  C:\Windows\System\GmTIbvr.exe
  2⤵
  PID:5816
- C:\Windows\System\NMcQARJ.exe
  C:\Windows\System\NMcQARJ.exe
  2⤵
  PID:5848
- C:\Windows\System\kNwOYEX.exe
  C:\Windows\System\kNwOYEX.exe
  2⤵
  PID:5872
- C:\Windows\System\jHQRndR.exe
  C:\Windows\System\jHQRndR.exe
  2⤵
  PID:5904
- C:\Windows\System\xBNpUqd.exe
  C:\Windows\System\xBNpUqd.exe
  2⤵
  PID:5940
- C:\Windows\System\pnEHtxa.exe
  C:\Windows\System\pnEHtxa.exe
  2⤵
  PID:5956
- C:\Windows\System\ZsUiBwy.exe
  C:\Windows\System\ZsUiBwy.exe
  2⤵
  PID:5980
- C:\Windows\System\mUQQTbz.exe
  C:\Windows\System\mUQQTbz.exe
  2⤵
  PID:6008
- C:\Windows\System\oqGROPp.exe
  C:\Windows\System\oqGROPp.exe
  2⤵
  PID:6032
- C:\Windows\System\gAhNNtX.exe
  C:\Windows\System\gAhNNtX.exe
  2⤵
  PID:6056
- C:\Windows\System\afMCWEK.exe
  C:\Windows\System\afMCWEK.exe
  2⤵
  PID:6096
- C:\Windows\System\lekXrxs.exe
  C:\Windows\System\lekXrxs.exe
  2⤵
  PID:6120
- C:\Windows\System\ngjdwTR.exe
  C:\Windows\System\ngjdwTR.exe
  2⤵
  PID:5132
- C:\Windows\System\AsWlGXh.exe
  C:\Windows\System\AsWlGXh.exe
  2⤵
  PID:5200
- C:\Windows\System\TbecGXs.exe
  C:\Windows\System\TbecGXs.exe
  2⤵
  PID:5280
- C:\Windows\System\FtxUdOL.exe
  C:\Windows\System\FtxUdOL.exe
  2⤵
  PID:5380
- C:\Windows\System\CBMqvZd.exe
  C:\Windows\System\CBMqvZd.exe
  2⤵
  PID:5448
- C:\Windows\System\ehUEsmY.exe
  C:\Windows\System\ehUEsmY.exe
  2⤵
  PID:5456
- C:\Windows\System\pogPAaa.exe
  C:\Windows\System\pogPAaa.exe
  2⤵
  PID:5596
- C:\Windows\System\IWMWnqf.exe
  C:\Windows\System\IWMWnqf.exe
  2⤵
  PID:5636
- C:\Windows\System\BnfZymW.exe
  C:\Windows\System\BnfZymW.exe
  2⤵
  PID:5748
- C:\Windows\System\hSBNbii.exe
  C:\Windows\System\hSBNbii.exe
  2⤵
  PID:5768
- C:\Windows\System\llnzsFQ.exe
  C:\Windows\System\llnzsFQ.exe
  2⤵
  PID:5832
- C:\Windows\System\LFdWXFN.exe
  C:\Windows\System\LFdWXFN.exe
  2⤵
  PID:5884
- C:\Windows\System\FnsLcMg.exe
  C:\Windows\System\FnsLcMg.exe
  2⤵
  PID:5996
- C:\Windows\System\kUtTMrh.exe
  C:\Windows\System\kUtTMrh.exe
  2⤵
  PID:6072
- C:\Windows\System\NWBKIKa.exe
  C:\Windows\System\NWBKIKa.exe
  2⤵
  PID:6104
- C:\Windows\System\ivKUjDb.exe
  C:\Windows\System\ivKUjDb.exe
  2⤵
  PID:5208
- C:\Windows\System\JxChSWX.exe
  C:\Windows\System\JxChSWX.exe
  2⤵
  PID:5496
- C:\Windows\System\rlApOqm.exe
  C:\Windows\System\rlApOqm.exe
  2⤵
  PID:5588
- C:\Windows\System\bWsVfDa.exe
  C:\Windows\System\bWsVfDa.exe
  2⤵
  PID:5668
- C:\Windows\System\IhltYsY.exe
  C:\Windows\System\IhltYsY.exe
  2⤵
  PID:5892
- C:\Windows\System\UwUOjfR.exe
  C:\Windows\System\UwUOjfR.exe
  2⤵
  PID:5948
- C:\Windows\System\EmxMvMT.exe
  C:\Windows\System\EmxMvMT.exe
  2⤵
  PID:5300
- C:\Windows\System\AURYOGT.exe
  C:\Windows\System\AURYOGT.exe
  2⤵
  PID:5628
- C:\Windows\System\jqVbfll.exe
  C:\Windows\System\jqVbfll.exe
  2⤵
  PID:5952
- C:\Windows\System\QamSUGN.exe
  C:\Windows\System\QamSUGN.exe
  2⤵
  PID:5776
- C:\Windows\System\BcablZZ.exe
  C:\Windows\System\BcablZZ.exe
  2⤵
  PID:6168
- C:\Windows\System\dCwHrOz.exe
  C:\Windows\System\dCwHrOz.exe
  2⤵
  PID:6200
- C:\Windows\System\TtagyRs.exe
  C:\Windows\System\TtagyRs.exe
  2⤵
  PID:6220
- C:\Windows\System\XpFYTKq.exe
  C:\Windows\System\XpFYTKq.exe
  2⤵
  PID:6248
- C:\Windows\System\VVslEbT.exe
  C:\Windows\System\VVslEbT.exe
  2⤵
  PID:6264
- C:\Windows\System\rHVFnkd.exe
  C:\Windows\System\rHVFnkd.exe
  2⤵
  PID:6284
- C:\Windows\System\hMnePGj.exe
  C:\Windows\System\hMnePGj.exe
  2⤵
  PID:6316
- C:\Windows\System\jkdzhGV.exe
  C:\Windows\System\jkdzhGV.exe
  2⤵
  PID:6340
- C:\Windows\System\MmYLGuJ.exe
  C:\Windows\System\MmYLGuJ.exe
  2⤵
  PID:6368
- C:\Windows\System\ydoqHYW.exe
  C:\Windows\System\ydoqHYW.exe
  2⤵
  PID:6388
- C:\Windows\System\aDiwnRo.exe
  C:\Windows\System\aDiwnRo.exe
  2⤵
  PID:6412
- C:\Windows\System\KhfjqTH.exe
  C:\Windows\System\KhfjqTH.exe
  2⤵
  PID:6448
- C:\Windows\System\dwYdcCF.exe
  C:\Windows\System\dwYdcCF.exe
  2⤵
  PID:6484
- C:\Windows\System\jyOkEHi.exe
  C:\Windows\System\jyOkEHi.exe
  2⤵
  PID:6512
- C:\Windows\System\ojHhMSA.exe
  C:\Windows\System\ojHhMSA.exe
  2⤵
  PID:6544
- C:\Windows\System\RlJLRnW.exe
  C:\Windows\System\RlJLRnW.exe
  2⤵
  PID:6560
- C:\Windows\System\BTGhNpm.exe
  C:\Windows\System\BTGhNpm.exe
  2⤵
  PID:6592
- C:\Windows\System\bGPkdqx.exe
  C:\Windows\System\bGPkdqx.exe
  2⤵
  PID:6616
- C:\Windows\System\iSKSxXV.exe
  C:\Windows\System\iSKSxXV.exe
  2⤵
  PID:6648
- C:\Windows\System\RwiCYtP.exe
  C:\Windows\System\RwiCYtP.exe
  2⤵
  PID:6672
- C:\Windows\System\TqfkzXC.exe
  C:\Windows\System\TqfkzXC.exe
  2⤵
  PID:6696
- C:\Windows\System\RuBTCRo.exe
  C:\Windows\System\RuBTCRo.exe
  2⤵
  PID:6716
- C:\Windows\System\krSbnoR.exe
  C:\Windows\System\krSbnoR.exe
  2⤵
  PID:6744
- C:\Windows\System\vMaeidM.exe
  C:\Windows\System\vMaeidM.exe
  2⤵
  PID:6776
- C:\Windows\System\AtkadrQ.exe
  C:\Windows\System\AtkadrQ.exe
  2⤵
  PID:6800
- C:\Windows\System\zdeArQq.exe
  C:\Windows\System\zdeArQq.exe
  2⤵
  PID:6824
- C:\Windows\System\gNdyWuz.exe
  C:\Windows\System\gNdyWuz.exe
  2⤵
  PID:6860
- C:\Windows\System\QNkXEEk.exe
  C:\Windows\System\QNkXEEk.exe
  2⤵
  PID:6892
- C:\Windows\System\wjWPFLP.exe
  C:\Windows\System\wjWPFLP.exe
  2⤵
  PID:6928
- C:\Windows\System\qZAYczH.exe
  C:\Windows\System\qZAYczH.exe
  2⤵
  PID:6956
- C:\Windows\System\LpaiFjv.exe
  C:\Windows\System\LpaiFjv.exe
  2⤵
  PID:6984
- C:\Windows\System\SnCliVH.exe
  C:\Windows\System\SnCliVH.exe
  2⤵
  PID:7012
- C:\Windows\System\nUTlGwf.exe
  C:\Windows\System\nUTlGwf.exe
  2⤵
  PID:7036
- C:\Windows\System\YgbkOxa.exe
  C:\Windows\System\YgbkOxa.exe
  2⤵
  PID:7064
- C:\Windows\System\nqgDXgN.exe
  C:\Windows\System\nqgDXgN.exe
  2⤵
  PID:7096
- C:\Windows\System\dNnSODp.exe
  C:\Windows\System\dNnSODp.exe
  2⤵
  PID:7132
- C:\Windows\System\HrNhfjH.exe
  C:\Windows\System\HrNhfjH.exe
  2⤵
  PID:7148
- C:\Windows\System\NUPrkRE.exe
  C:\Windows\System\NUPrkRE.exe
  2⤵
  PID:5408
- C:\Windows\System\kqFlplo.exe
  C:\Windows\System\kqFlplo.exe
  2⤵
  PID:6212
- C:\Windows\System\cfvvcBJ.exe
  C:\Windows\System\cfvvcBJ.exe
  2⤵
  PID:6280
- C:\Windows\System\iNwngWd.exe
  C:\Windows\System\iNwngWd.exe
  2⤵
  PID:6332
- C:\Windows\System\ffVxMMr.exe
  C:\Windows\System\ffVxMMr.exe
  2⤵
  PID:6464
- C:\Windows\System\bAjaXAH.exe
  C:\Windows\System\bAjaXAH.exe
  2⤵
  PID:6556
- C:\Windows\System\TtlkojI.exe
  C:\Windows\System\TtlkojI.exe
  2⤵
  PID:6552
- C:\Windows\System\yxHQNVC.exe
  C:\Windows\System\yxHQNVC.exe
  2⤵
  PID:6624
- C:\Windows\System\RNJxHmC.exe
  C:\Windows\System\RNJxHmC.exe
  2⤵
  PID:6760
- C:\Windows\System\CAIHdFR.exe
  C:\Windows\System\CAIHdFR.exe
  2⤵
  PID:6768
- C:\Windows\System\tYsIrCC.exe
  C:\Windows\System\tYsIrCC.exe
  2⤵
  PID:6908
- C:\Windows\System\ZVPDlKY.exe
  C:\Windows\System\ZVPDlKY.exe
  2⤵
  PID:6876
- C:\Windows\System\uBwvdKk.exe
  C:\Windows\System\uBwvdKk.exe
  2⤵
  PID:7004
- C:\Windows\System\HdMuxFt.exe
  C:\Windows\System\HdMuxFt.exe
  2⤵
  PID:7048
- C:\Windows\System\hvQlPuG.exe
  C:\Windows\System\hvQlPuG.exe
  2⤵
  PID:7120
- C:\Windows\System\iocIjep.exe
  C:\Windows\System\iocIjep.exe
  2⤵
  PID:7124
- C:\Windows\System\EcRWpDT.exe
  C:\Windows\System\EcRWpDT.exe
  2⤵
  PID:7160
- C:\Windows\System\rqRYBPr.exe
  C:\Windows\System\rqRYBPr.exe
  2⤵
  PID:6236
- C:\Windows\System\bBDIGFm.exe
  C:\Windows\System\bBDIGFm.exe
  2⤵
  PID:6520
- C:\Windows\System\QIOcKQc.exe
  C:\Windows\System\QIOcKQc.exe
  2⤵
  PID:6336
- C:\Windows\System\LFUUIro.exe
  C:\Windows\System\LFUUIro.exe
  2⤵
  PID:6688
- C:\Windows\System\AiyHjlZ.exe
  C:\Windows\System\AiyHjlZ.exe
  2⤵
  PID:6844
- C:\Windows\System\iqZqgYz.exe
  C:\Windows\System\iqZqgYz.exe
  2⤵
  PID:6992
- C:\Windows\System\gpIqFDa.exe
  C:\Windows\System\gpIqFDa.exe
  2⤵
  PID:6304
- C:\Windows\System\GgyALat.exe
  C:\Windows\System\GgyALat.exe
  2⤵
  PID:6148
- C:\Windows\System\qmClcfr.exe
  C:\Windows\System\qmClcfr.exe
  2⤵
  PID:6608
- C:\Windows\System\exlZyoO.exe
  C:\Windows\System\exlZyoO.exe
  2⤵
  PID:7172
- C:\Windows\System\JsUuKUe.exe
  C:\Windows\System\JsUuKUe.exe
  2⤵
  PID:7196
- C:\Windows\System\yzcklsO.exe
  C:\Windows\System\yzcklsO.exe
  2⤵
  PID:7224
- C:\Windows\System\IWSNzWc.exe
  C:\Windows\System\IWSNzWc.exe
  2⤵
  PID:7252
- C:\Windows\System\yJvNaQM.exe
  C:\Windows\System\yJvNaQM.exe
  2⤵
  PID:7280
- C:\Windows\System\nhbxOUK.exe
  C:\Windows\System\nhbxOUK.exe
  2⤵
  PID:7312
- C:\Windows\System\AveekjT.exe
  C:\Windows\System\AveekjT.exe
  2⤵
  PID:7336
- C:\Windows\System\dkqfDcS.exe
  C:\Windows\System\dkqfDcS.exe
  2⤵
  PID:7372
- C:\Windows\System\BitUisu.exe
  C:\Windows\System\BitUisu.exe
  2⤵
  PID:7404
- C:\Windows\System\qtYkqoL.exe
  C:\Windows\System\qtYkqoL.exe
  2⤵
  PID:7428
- C:\Windows\System\NZPQtsZ.exe
  C:\Windows\System\NZPQtsZ.exe
  2⤵
  PID:7452
- C:\Windows\System\ykDWono.exe
  C:\Windows\System\ykDWono.exe
  2⤵
  PID:7476
- C:\Windows\System\mjyHkBm.exe
  C:\Windows\System\mjyHkBm.exe
  2⤵
  PID:7508
- C:\Windows\System\pAUfaKw.exe
  C:\Windows\System\pAUfaKw.exe
  2⤵
  PID:7532
- C:\Windows\System\SbpQtUk.exe
  C:\Windows\System\SbpQtUk.exe
  2⤵
  PID:7560
- C:\Windows\System\qhvPmoj.exe
  C:\Windows\System\qhvPmoj.exe
  2⤵
  PID:7580
- C:\Windows\System\jINxJuq.exe
  C:\Windows\System\jINxJuq.exe
  2⤵
  PID:7620
- C:\Windows\System\wkvljWQ.exe
  C:\Windows\System\wkvljWQ.exe
  2⤵
  PID:7640
- C:\Windows\System\xTlHIEP.exe
  C:\Windows\System\xTlHIEP.exe
  2⤵
  PID:7672
- C:\Windows\System\zyVRwQG.exe
  C:\Windows\System\zyVRwQG.exe
  2⤵
  PID:7696
- C:\Windows\System\bZMPtJY.exe
  C:\Windows\System\bZMPtJY.exe
  2⤵
  PID:7724
- C:\Windows\System\ncACBpW.exe
  C:\Windows\System\ncACBpW.exe
  2⤵
  PID:7760
- C:\Windows\System\qRXzttE.exe
  C:\Windows\System\qRXzttE.exe
  2⤵
  PID:7796
- C:\Windows\System\KnynvdE.exe
  C:\Windows\System\KnynvdE.exe
  2⤵
  PID:7820
- C:\Windows\System\ykTDLJV.exe
  C:\Windows\System\ykTDLJV.exe
  2⤵
  PID:7844
- C:\Windows\System\lxAYfPN.exe
  C:\Windows\System\lxAYfPN.exe
  2⤵
  PID:7868
- C:\Windows\System\OWlsQfE.exe
  C:\Windows\System\OWlsQfE.exe
  2⤵
  PID:7900
- C:\Windows\System\GcQdwhY.exe
  C:\Windows\System\GcQdwhY.exe
  2⤵
  PID:7932
- C:\Windows\System\hvYAQlu.exe
  C:\Windows\System\hvYAQlu.exe
  2⤵
  PID:7964
- C:\Windows\System\AatnYXo.exe
  C:\Windows\System\AatnYXo.exe
  2⤵
  PID:7992
- C:\Windows\System\EACiaPT.exe
  C:\Windows\System\EACiaPT.exe
  2⤵
  PID:8016
- C:\Windows\System\thalyUR.exe
  C:\Windows\System\thalyUR.exe
  2⤵
  PID:8040
- C:\Windows\System\evgpXnf.exe
  C:\Windows\System\evgpXnf.exe
  2⤵
  PID:8068
- C:\Windows\System\ioUquwt.exe
  C:\Windows\System\ioUquwt.exe
  2⤵
  PID:8100
- C:\Windows\System\iDtQeBb.exe
  C:\Windows\System\iDtQeBb.exe
  2⤵
  PID:8124
- C:\Windows\System\dPEWqKO.exe
  C:\Windows\System\dPEWqKO.exe
  2⤵
  PID:8156
- C:\Windows\System\dxOivLN.exe
  C:\Windows\System\dxOivLN.exe
  2⤵
  PID:8184
- C:\Windows\System\fhvCcmZ.exe
  C:\Windows\System\fhvCcmZ.exe
  2⤵
  PID:7052
- C:\Windows\System\gmTNMfC.exe
  C:\Windows\System\gmTNMfC.exe
  2⤵
  PID:7220
- C:\Windows\System\hvVpvoO.exe
  C:\Windows\System\hvVpvoO.exe
  2⤵
  PID:7272
- C:\Windows\System\ZJYvGUL.exe
  C:\Windows\System\ZJYvGUL.exe
  2⤵
  PID:7388
- C:\Windows\System\dxWUWin.exe
  C:\Windows\System\dxWUWin.exe
  2⤵
  PID:7360
- C:\Windows\System\ERvRycD.exe
  C:\Windows\System\ERvRycD.exe
  2⤵
  PID:7444
- C:\Windows\System\RWDQrUG.exe
  C:\Windows\System\RWDQrUG.exe
  2⤵
  PID:7572
- C:\Windows\System\VDYtCRX.exe
  C:\Windows\System\VDYtCRX.exe
  2⤵
  PID:7544
- C:\Windows\System\LJcYkKe.exe
  C:\Windows\System\LJcYkKe.exe
  2⤵
  PID:7732
- C:\Windows\System\QVArdYx.exe
  C:\Windows\System\QVArdYx.exe
  2⤵
  PID:7776
- C:\Windows\System\HQMqrUh.exe
  C:\Windows\System\HQMqrUh.exe
  2⤵
  PID:7836
- C:\Windows\System\ShenKgp.exe
  C:\Windows\System\ShenKgp.exe
  2⤵
  PID:7960
- C:\Windows\System\KwTfnjD.exe
  C:\Windows\System\KwTfnjD.exe
  2⤵
  PID:7952
- C:\Windows\System\hHQlWVZ.exe
  C:\Windows\System\hHQlWVZ.exe
  2⤵
  PID:8116
- C:\Windows\System\MxpMBOo.exe
  C:\Windows\System\MxpMBOo.exe
  2⤵
  PID:8088
- C:\Windows\System\gRUiekp.exe
  C:\Windows\System\gRUiekp.exe
  2⤵
  PID:7216
- C:\Windows\System\gYwSMgc.exe
  C:\Windows\System\gYwSMgc.exe
  2⤵
  PID:6160
- C:\Windows\System\XdxTDev.exe
  C:\Windows\System\XdxTDev.exe
  2⤵
  PID:7496
- C:\Windows\System\iigXnGV.exe
  C:\Windows\System\iigXnGV.exe
  2⤵
  PID:7880
- C:\Windows\System\OIeXgmw.exe
  C:\Windows\System\OIeXgmw.exe
  2⤵
  PID:7956
- C:\Windows\System\fZPtGRA.exe
  C:\Windows\System\fZPtGRA.exe
  2⤵
  PID:8076
- C:\Windows\System\ddfZRmj.exe
  C:\Windows\System\ddfZRmj.exe
  2⤵
  PID:7816
- C:\Windows\System\FLMTArJ.exe
  C:\Windows\System\FLMTArJ.exe
  2⤵
  PID:8000
- C:\Windows\System\FTdZpNG.exe
  C:\Windows\System\FTdZpNG.exe
  2⤵
  PID:7912
- C:\Windows\System\XDvgyPQ.exe
  C:\Windows\System\XDvgyPQ.exe
  2⤵
  PID:8208
- C:\Windows\System\pTwtGnG.exe
  C:\Windows\System\pTwtGnG.exe
  2⤵
  PID:8228
- C:\Windows\System\PRiOGYO.exe
  C:\Windows\System\PRiOGYO.exe
  2⤵
  PID:8264
- C:\Windows\System\dcauRpC.exe
  C:\Windows\System\dcauRpC.exe
  2⤵
  PID:8280
- C:\Windows\System\MCasjPM.exe
  C:\Windows\System\MCasjPM.exe
  2⤵
  PID:8296
- C:\Windows\System\gOUDEmd.exe
  C:\Windows\System\gOUDEmd.exe
  2⤵
  PID:8328
- C:\Windows\System\WnXivVL.exe
  C:\Windows\System\WnXivVL.exe
  2⤵
  PID:8356
- C:\Windows\System\KuYcRSv.exe
  C:\Windows\System\KuYcRSv.exe
  2⤵
  PID:8376
- C:\Windows\System\dtnGixM.exe
  C:\Windows\System\dtnGixM.exe
  2⤵
  PID:8396
- C:\Windows\System\tKBrPYs.exe
  C:\Windows\System\tKBrPYs.exe
  2⤵
  PID:8420
- C:\Windows\System\MuIjfRe.exe
  C:\Windows\System\MuIjfRe.exe
  2⤵
  PID:8452
- C:\Windows\System\qcThdQT.exe
  C:\Windows\System\qcThdQT.exe
  2⤵
  PID:8472
- C:\Windows\System\qZvbudP.exe
  C:\Windows\System\qZvbudP.exe
  2⤵
  PID:8500
- C:\Windows\System\RhBEvEG.exe
  C:\Windows\System\RhBEvEG.exe
  2⤵
  PID:8532
- C:\Windows\System\ncadsun.exe
  C:\Windows\System\ncadsun.exe
  2⤵
  PID:8552
- C:\Windows\System\MMxVFnm.exe
  C:\Windows\System\MMxVFnm.exe
  2⤵
  PID:8580
- C:\Windows\System\KEJaasG.exe
  C:\Windows\System\KEJaasG.exe
  2⤵
  PID:8608
- C:\Windows\System\ePMlUrY.exe
  C:\Windows\System\ePMlUrY.exe
  2⤵
  PID:8640
- C:\Windows\System\tzyPYzH.exe
  C:\Windows\System\tzyPYzH.exe
  2⤵
  PID:8668
- C:\Windows\System\iyyFnyN.exe
  C:\Windows\System\iyyFnyN.exe
  2⤵
  PID:8696
- C:\Windows\System\BKLqZGA.exe
  C:\Windows\System\BKLqZGA.exe
  2⤵
  PID:8728
- C:\Windows\System\NdrJDGv.exe
  C:\Windows\System\NdrJDGv.exe
  2⤵
  PID:8748
- C:\Windows\System\vRmMJvf.exe
  C:\Windows\System\vRmMJvf.exe
  2⤵
  PID:8768
- C:\Windows\System\HDhvWtV.exe
  C:\Windows\System\HDhvWtV.exe
  2⤵
  PID:8796
- C:\Windows\System\zGzBFix.exe
  C:\Windows\System\zGzBFix.exe
  2⤵
  PID:8816
- C:\Windows\System\TILcvnY.exe
  C:\Windows\System\TILcvnY.exe
  2⤵
  PID:8844
- C:\Windows\System\eAKJPex.exe
  C:\Windows\System\eAKJPex.exe
  2⤵
  PID:8868
- C:\Windows\System\gXiNGaF.exe
  C:\Windows\System\gXiNGaF.exe
  2⤵
  PID:8900
- C:\Windows\System\tXzYBez.exe
  C:\Windows\System\tXzYBez.exe
  2⤵
  PID:8924
- C:\Windows\System\ntgXpyE.exe
  C:\Windows\System\ntgXpyE.exe
  2⤵
  PID:8952
- C:\Windows\System\ZmBFATz.exe
  C:\Windows\System\ZmBFATz.exe
  2⤵
  PID:8980
- C:\Windows\System\XasgxNJ.exe
  C:\Windows\System\XasgxNJ.exe
  2⤵
  PID:9012
- C:\Windows\System\npyYdEc.exe
  C:\Windows\System\npyYdEc.exe
  2⤵
  PID:9032
- C:\Windows\System\LoEhqVx.exe
  C:\Windows\System\LoEhqVx.exe
  2⤵
  PID:9068
- C:\Windows\System\pqiDTWx.exe
  C:\Windows\System\pqiDTWx.exe
  2⤵
  PID:9092
- C:\Windows\System\bEbhlen.exe
  C:\Windows\System\bEbhlen.exe
  2⤵
  PID:9116
- C:\Windows\System\nBNyLyg.exe
  C:\Windows\System\nBNyLyg.exe
  2⤵
  PID:9140
- C:\Windows\System\BGmqrYU.exe
  C:\Windows\System\BGmqrYU.exe
  2⤵
  PID:9156
- C:\Windows\System\KXytWFG.exe
  C:\Windows\System\KXytWFG.exe
  2⤵
  PID:9184
- C:\Windows\System\WntRgDX.exe
  C:\Windows\System\WntRgDX.exe
  2⤵
  PID:9200
- C:\Windows\System\zeJrnaD.exe
  C:\Windows\System\zeJrnaD.exe
  2⤵
  PID:7140
- C:\Windows\System\vvlPyPK.exe
  C:\Windows\System\vvlPyPK.exe
  2⤵
  PID:8276
- C:\Windows\System\BVtwtjs.exe
  C:\Windows\System\BVtwtjs.exe
  2⤵
  PID:8320
- C:\Windows\System\fjyfXVF.exe
  C:\Windows\System\fjyfXVF.exe
  2⤵
  PID:8368
- C:\Windows\System\OGfHEZd.exe
  C:\Windows\System\OGfHEZd.exe
  2⤵
  PID:8492
- C:\Windows\System\IpRXQcU.exe
  C:\Windows\System\IpRXQcU.exe
  2⤵
  PID:8480
- C:\Windows\System\EdsfieV.exe
  C:\Windows\System\EdsfieV.exe
  2⤵
  PID:8516
- C:\Windows\System\aWGVrOM.exe
  C:\Windows\System\aWGVrOM.exe
  2⤵
  PID:8568
- C:\Windows\System\ckBlpIG.exe
  C:\Windows\System\ckBlpIG.exe
  2⤵
  PID:8660
- C:\Windows\System\LScWdXH.exe
  C:\Windows\System\LScWdXH.exe
  2⤵
  PID:8760
- C:\Windows\System\JKaYmuG.exe
  C:\Windows\System\JKaYmuG.exe
  2⤵
  PID:8836
- C:\Windows\System\TJevHrc.exe
  C:\Windows\System\TJevHrc.exe
  2⤵
  PID:8860
- C:\Windows\System\vOmWtyT.exe
  C:\Windows\System\vOmWtyT.exe
  2⤵
  PID:8916
- C:\Windows\System\aCbmDpn.exe
  C:\Windows\System\aCbmDpn.exe
  2⤵
  PID:8992
- C:\Windows\System\tcyFLtW.exe
  C:\Windows\System\tcyFLtW.exe
  2⤵
  PID:9060
- C:\Windows\System\twSNldF.exe
  C:\Windows\System\twSNldF.exe
  2⤵
  PID:9084
- C:\Windows\System\yvtZkHz.exe
  C:\Windows\System\yvtZkHz.exe
  2⤵
  PID:8272
- C:\Windows\System\GSTcYTn.exe
  C:\Windows\System\GSTcYTn.exe
  2⤵
  PID:8316
- C:\Windows\System\zQBhhpc.exe
  C:\Windows\System\zQBhhpc.exe
  2⤵
  PID:8588
- C:\Windows\System\AfNgEAG.exe
  C:\Windows\System\AfNgEAG.exe
  2⤵
  PID:8200
- C:\Windows\System\sHgxfWp.exe
  C:\Windows\System\sHgxfWp.exe
  2⤵
  PID:8808
- C:\Windows\System\xHVdPdQ.exe
  C:\Windows\System\xHVdPdQ.exe
  2⤵
  PID:8840
- C:\Windows\System\VPzjbTh.exe
  C:\Windows\System\VPzjbTh.exe
  2⤵
  PID:8892
- C:\Windows\System\fYECVxV.exe
  C:\Windows\System\fYECVxV.exe
  2⤵
  PID:9236
- C:\Windows\System\TmIvABS.exe
  C:\Windows\System\TmIvABS.exe
  2⤵
  PID:9272
- C:\Windows\System\rqPWTCl.exe
  C:\Windows\System\rqPWTCl.exe
  2⤵
  PID:9292
- C:\Windows\System\GJmBjtW.exe
  C:\Windows\System\GJmBjtW.exe
  2⤵
  PID:9316
- C:\Windows\System\wyAjHih.exe
  C:\Windows\System\wyAjHih.exe
  2⤵
  PID:9348
- C:\Windows\System\JyaJsCI.exe
  C:\Windows\System\JyaJsCI.exe
  2⤵
  PID:9376
- C:\Windows\System\NjrJLvl.exe
  C:\Windows\System\NjrJLvl.exe
  2⤵
  PID:9456
- C:\Windows\System\XLKEcyZ.exe
  C:\Windows\System\XLKEcyZ.exe
  2⤵
  PID:9496
- C:\Windows\System\xRBiEMo.exe
  C:\Windows\System\xRBiEMo.exe
  2⤵
  PID:9520
- C:\Windows\System\TcZQcVd.exe
  C:\Windows\System\TcZQcVd.exe
  2⤵
  PID:9552
- C:\Windows\System\qpdOhrc.exe
  C:\Windows\System\qpdOhrc.exe
  2⤵
  PID:9576
- C:\Windows\System\xJZdMiv.exe
  C:\Windows\System\xJZdMiv.exe
  2⤵
  PID:9608
- C:\Windows\System\rKGgHmW.exe
  C:\Windows\System\rKGgHmW.exe
  2⤵
  PID:9632
- C:\Windows\System\BDRejKQ.exe
  C:\Windows\System\BDRejKQ.exe
  2⤵
  PID:9656
- C:\Windows\System\IkKYiED.exe
  C:\Windows\System\IkKYiED.exe
  2⤵
  PID:9680
- C:\Windows\System\DkFwWOd.exe
  C:\Windows\System\DkFwWOd.exe
  2⤵
  PID:9704
- C:\Windows\System\AmPCfEb.exe
  C:\Windows\System\AmPCfEb.exe
  2⤵
  PID:9724
- C:\Windows\System\TDHhEDz.exe
  C:\Windows\System\TDHhEDz.exe
  2⤵
  PID:9756
- C:\Windows\System\xDEWsHM.exe
  C:\Windows\System\xDEWsHM.exe
  2⤵
  PID:9780
- C:\Windows\System\DUoqHtZ.exe
  C:\Windows\System\DUoqHtZ.exe
  2⤵
  PID:9808
- C:\Windows\System\JUgNnRf.exe
  C:\Windows\System\JUgNnRf.exe
  2⤵
  PID:9836
- C:\Windows\System\QSSTfJZ.exe
  C:\Windows\System\QSSTfJZ.exe
  2⤵
  PID:9864
- C:\Windows\System\bpYVqPX.exe
  C:\Windows\System\bpYVqPX.exe
  2⤵
  PID:9884
- C:\Windows\System\oIccVea.exe
  C:\Windows\System\oIccVea.exe
  2⤵
  PID:9904
- C:\Windows\System\NDdJfww.exe
  C:\Windows\System\NDdJfww.exe
  2⤵
  PID:9928
- C:\Windows\System\bgOosPb.exe
  C:\Windows\System\bgOosPb.exe
  2⤵
  PID:9960
- C:\Windows\System\AbTGDOv.exe
  C:\Windows\System\AbTGDOv.exe
  2⤵
  PID:9988
- C:\Windows\System\xnRibTu.exe
  C:\Windows\System\xnRibTu.exe
  2⤵
  PID:10012
- C:\Windows\System\fOSjnVE.exe
  C:\Windows\System\fOSjnVE.exe
  2⤵
  PID:10032
- C:\Windows\System\IWOHXxK.exe
  C:\Windows\System\IWOHXxK.exe
  2⤵
  PID:10060
- C:\Windows\System\OCuAOdV.exe
  C:\Windows\System\OCuAOdV.exe
  2⤵
  PID:10092
- C:\Windows\System\bsbtSmy.exe
  C:\Windows\System\bsbtSmy.exe
  2⤵
  PID:10112
- C:\Windows\System\wOOTmlu.exe
  C:\Windows\System\wOOTmlu.exe
  2⤵
  PID:10132
- C:\Windows\System\jbHdtzv.exe
  C:\Windows\System\jbHdtzv.exe
  2⤵
  PID:10160
- C:\Windows\System\RfYkEhX.exe
  C:\Windows\System\RfYkEhX.exe
  2⤵
  PID:10188
- C:\Windows\System\nlFMFPB.exe
  C:\Windows\System\nlFMFPB.exe
  2⤵
  PID:10216
- C:\Windows\System\UwcfCSO.exe
  C:\Windows\System\UwcfCSO.exe
  2⤵
  PID:8664
- C:\Windows\System\jzFgAJw.exe
  C:\Windows\System\jzFgAJw.exe
  2⤵
  PID:8440
- C:\Windows\System\zcDLMHH.exe
  C:\Windows\System\zcDLMHH.exe
  2⤵
  PID:8344
- C:\Windows\System\wnxeZDy.exe
  C:\Windows\System\wnxeZDy.exe
  2⤵
  PID:9260
- C:\Windows\System\KnzuxGm.exe
  C:\Windows\System\KnzuxGm.exe
  2⤵
  PID:8468
- C:\Windows\System\nXZVcJE.exe
  C:\Windows\System\nXZVcJE.exe
  2⤵
  PID:9384
- C:\Windows\System\brbRGda.exe
  C:\Windows\System\brbRGda.exe
  2⤵
  PID:9300
- C:\Windows\System\bWoGzCc.exe
  C:\Windows\System\bWoGzCc.exe
  2⤵
  PID:9412
- C:\Windows\System\ctVXOni.exe
  C:\Windows\System\ctVXOni.exe
  2⤵
  PID:9516
- C:\Windows\System\CsTRicM.exe
  C:\Windows\System\CsTRicM.exe
  2⤵
  PID:9464
- C:\Windows\System\heBkbDP.exe
  C:\Windows\System\heBkbDP.exe
  2⤵
  PID:9588
- C:\Windows\System\GCGrHBG.exe
  C:\Windows\System\GCGrHBG.exe
  2⤵
  PID:9676
- C:\Windows\System\eonPxvp.exe
  C:\Windows\System\eonPxvp.exe
  2⤵
  PID:9616
- C:\Windows\System\sLYiIld.exe
  C:\Windows\System\sLYiIld.exe
  2⤵
  PID:9824
- C:\Windows\System\bBpJvkY.exe
  C:\Windows\System\bBpJvkY.exe
  2⤵
  PID:9820
- C:\Windows\System\ulYUYUE.exe
  C:\Windows\System\ulYUYUE.exe
  2⤵
  PID:9940
- C:\Windows\System\shrTGsV.exe
  C:\Windows\System\shrTGsV.exe
  2⤵
  PID:9896
- C:\Windows\System\JRdILSR.exe
  C:\Windows\System\JRdILSR.exe
  2⤵
  PID:10204
- C:\Windows\System\xOJaoUC.exe
  C:\Windows\System\xOJaoUC.exe
  2⤵
  PID:10236
- C:\Windows\System\NPgQDOD.exe
  C:\Windows\System\NPgQDOD.exe
  2⤵
  PID:8632
- C:\Windows\System\dZULoGi.exe
  C:\Windows\System\dZULoGi.exe
  2⤵
  PID:8964
- C:\Windows\System\ErDkajM.exe
  C:\Windows\System\ErDkajM.exe
  2⤵
  PID:9232
- C:\Windows\System\BrOmvhV.exe
  C:\Windows\System\BrOmvhV.exe
  2⤵
  PID:9336
- C:\Windows\System\nYFxQEb.exe
  C:\Windows\System\nYFxQEb.exe
  2⤵
  PID:9536
- C:\Windows\System\jKuouEP.exe
  C:\Windows\System\jKuouEP.exe
  2⤵
  PID:8776
- C:\Windows\System\HHorTze.exe
  C:\Windows\System\HHorTze.exe
  2⤵
  PID:10104
- C:\Windows\System\rPubIDJ.exe
  C:\Windows\System\rPubIDJ.exe
  2⤵
  PID:9192
- C:\Windows\System\quowJFb.exe
  C:\Windows\System\quowJFb.exe
  2⤵
  PID:10256
- C:\Windows\System\msKCaFG.exe
  C:\Windows\System\msKCaFG.exe
  2⤵
  PID:10280
- C:\Windows\System\zICLFBb.exe
  C:\Windows\System\zICLFBb.exe
  2⤵
  PID:10308
- C:\Windows\System\WJvDiit.exe
  C:\Windows\System\WJvDiit.exe
  2⤵
  PID:10336
- C:\Windows\System\AWwblub.exe
  C:\Windows\System\AWwblub.exe
  2⤵
  PID:10364
- C:\Windows\System\vEjsGWc.exe
  C:\Windows\System\vEjsGWc.exe
  2⤵
  PID:10396
- C:\Windows\System\TwVdBgZ.exe
  C:\Windows\System\TwVdBgZ.exe
  2⤵
  PID:10420
- C:\Windows\System\EFBBXUv.exe
  C:\Windows\System\EFBBXUv.exe
  2⤵
  PID:10448
- C:\Windows\System\NbBGEMu.exe
  C:\Windows\System\NbBGEMu.exe
  2⤵
  PID:10476
- C:\Windows\System\lVoSXFR.exe
  C:\Windows\System\lVoSXFR.exe
  2⤵
  PID:10500
- C:\Windows\System\lnHnwqy.exe
  C:\Windows\System\lnHnwqy.exe
  2⤵
  PID:10532
- C:\Windows\System\QvmdMYb.exe
  C:\Windows\System\QvmdMYb.exe
  2⤵
  PID:10556
- C:\Windows\System\nTZSUCJ.exe
  C:\Windows\System\nTZSUCJ.exe
  2⤵
  PID:10580
- C:\Windows\System\BImaXhB.exe
  C:\Windows\System\BImaXhB.exe
  2⤵
  PID:10616
- C:\Windows\System\aeXfreO.exe
  C:\Windows\System\aeXfreO.exe
  2⤵
  PID:10644
- C:\Windows\System\JciaQfS.exe
  C:\Windows\System\JciaQfS.exe
  2⤵
  PID:10668
- C:\Windows\System\gIKcZwi.exe
  C:\Windows\System\gIKcZwi.exe
  2⤵
  PID:10696
- C:\Windows\System\fuwthpi.exe
  C:\Windows\System\fuwthpi.exe
  2⤵
  PID:10720
- C:\Windows\System\IKjNUQM.exe
  C:\Windows\System\IKjNUQM.exe
  2⤵
  PID:10760
- C:\Windows\System\VLekXZn.exe
  C:\Windows\System\VLekXZn.exe
  2⤵
  PID:10788
- C:\Windows\System\bSGYRfL.exe
  C:\Windows\System\bSGYRfL.exe
  2⤵
  PID:10808
- C:\Windows\System\zGPmBIo.exe
  C:\Windows\System\zGPmBIo.exe
  2⤵
  PID:10836
- C:\Windows\System\lwwCtID.exe
  C:\Windows\System\lwwCtID.exe
  2⤵
  PID:10860
- C:\Windows\System\MSXsJAR.exe
  C:\Windows\System\MSXsJAR.exe
  2⤵
  PID:10888
- C:\Windows\System\dPzRyEp.exe
  C:\Windows\System\dPzRyEp.exe
  2⤵
  PID:10912
- C:\Windows\System\lZgCUPX.exe
  C:\Windows\System\lZgCUPX.exe
  2⤵
  PID:10936
- C:\Windows\System\zInbtPs.exe
  C:\Windows\System\zInbtPs.exe
  2⤵
  PID:10964
- C:\Windows\System\uiUoNLp.exe
  C:\Windows\System\uiUoNLp.exe
  2⤵
  PID:10996
- C:\Windows\System\tnXKHfM.exe
  C:\Windows\System\tnXKHfM.exe
  2⤵
  PID:11036
- C:\Windows\System\VEbOSKO.exe
  C:\Windows\System\VEbOSKO.exe
  2⤵
  PID:11068
- C:\Windows\System\YGfBGvS.exe
  C:\Windows\System\YGfBGvS.exe
  2⤵
  PID:11092
- C:\Windows\System\LVDzsvj.exe
  C:\Windows\System\LVDzsvj.exe
  2⤵
  PID:11112
- C:\Windows\System\GSuyXWs.exe
  C:\Windows\System\GSuyXWs.exe
  2⤵
  PID:11152
- C:\Windows\System\XtooTJf.exe
  C:\Windows\System\XtooTJf.exe
  2⤵
  PID:11176
- C:\Windows\System\HAWbfvV.exe
  C:\Windows\System\HAWbfvV.exe
  2⤵
  PID:11204
- C:\Windows\System\wxJYNuP.exe
  C:\Windows\System\wxJYNuP.exe
  2⤵
  PID:11236
- C:\Windows\System\oxrTyPD.exe
  C:\Windows\System\oxrTyPD.exe
  2⤵
  PID:11256
- C:\Windows\System\VnJIFJw.exe
  C:\Windows\System\VnJIFJw.exe
  2⤵
  PID:9508
- C:\Windows\System\VzDkdPJ.exe
  C:\Windows\System\VzDkdPJ.exe
  2⤵
  PID:10200
- C:\Windows\System\XrCjeCD.exe
  C:\Windows\System\XrCjeCD.exe
  2⤵
  PID:9592
- C:\Windows\System\aXGuiak.exe
  C:\Windows\System\aXGuiak.exe
  2⤵
  PID:10264
- C:\Windows\System\wsQKKZu.exe
  C:\Windows\System\wsQKKZu.exe
  2⤵
  PID:3992
- C:\Windows\System\rweAMlj.exe
  C:\Windows\System\rweAMlj.exe
  2⤵
  PID:8940
- C:\Windows\System\SkbxVYB.exe
  C:\Windows\System\SkbxVYB.exe
  2⤵
  PID:10248
- C:\Windows\System\vcBiaIA.exe
  C:\Windows\System\vcBiaIA.exe
  2⤵
  PID:10596
- C:\Windows\System\CreJiHa.exe
  C:\Windows\System\CreJiHa.exe
  2⤵
  PID:10468
- C:\Windows\System\AMaRZeZ.exe
  C:\Windows\System\AMaRZeZ.exe
  2⤵
  PID:10520
- C:\Windows\System\ZZBjZqa.exe
  C:\Windows\System\ZZBjZqa.exe
  2⤵
  PID:10344
- C:\Windows\System\JgtbayL.exe
  C:\Windows\System\JgtbayL.exe
  2⤵
  PID:10588
- C:\Windows\System\XikUTcY.exe
  C:\Windows\System\XikUTcY.exe
  2⤵
  PID:10820
- C:\Windows\System\RyEgJXT.exe
  C:\Windows\System\RyEgJXT.exe
  2⤵
  PID:10492
- C:\Windows\System\fdjeiPh.exe
  C:\Windows\System\fdjeiPh.exe
  2⤵
  PID:10976
- C:\Windows\System\dSVDDdj.exe
  C:\Windows\System\dSVDDdj.exe
  2⤵
  PID:10796
- C:\Windows\System\Ukxsnay.exe
  C:\Windows\System\Ukxsnay.exe
  2⤵
  PID:10896
- C:\Windows\System\lFvRhVf.exe
  C:\Windows\System\lFvRhVf.exe
  2⤵
  PID:11056
- C:\Windows\System\XlrsFnT.exe
  C:\Windows\System\XlrsFnT.exe
  2⤵
  PID:10156
- C:\Windows\System\CGUrpgQ.exe
  C:\Windows\System\CGUrpgQ.exe
  2⤵
  PID:9668
- C:\Windows\System\KAZTvLE.exe
  C:\Windows\System\KAZTvLE.exe
  2⤵
  PID:11160
- C:\Windows\System\qZGUtSR.exe
  C:\Windows\System\qZGUtSR.exe
  2⤵
  PID:11252
- C:\Windows\System\lbWsYkz.exe
  C:\Windows\System\lbWsYkz.exe
  2⤵
  PID:11088
- C:\Windows\System\olVFKic.exe
  C:\Windows\System\olVFKic.exe
  2⤵
  PID:2776
- C:\Windows\System\uMriOyC.exe
  C:\Windows\System\uMriOyC.exe
  2⤵
  PID:11288
- C:\Windows\System\NQncvvt.exe
  C:\Windows\System\NQncvvt.exe
  2⤵
  PID:11316
- C:\Windows\System\DAXomBI.exe
  C:\Windows\System\DAXomBI.exe
  2⤵
  PID:11356
- C:\Windows\System\HattIEx.exe
  C:\Windows\System\HattIEx.exe
  2⤵
  PID:11380
- C:\Windows\System\MBEAXoh.exe
  C:\Windows\System\MBEAXoh.exe
  2⤵
  PID:11396
- C:\Windows\System\zZNnbKO.exe
  C:\Windows\System\zZNnbKO.exe
  2⤵
  PID:11440
- C:\Windows\System\QnpCIQf.exe
  C:\Windows\System\QnpCIQf.exe
  2⤵
  PID:11488
- C:\Windows\System\vSOEWih.exe
  C:\Windows\System\vSOEWih.exe
  2⤵
  PID:11512
- C:\Windows\System\eKHbwLh.exe
  C:\Windows\System\eKHbwLh.exe
  2⤵
  PID:11548
- C:\Windows\System\QXsnauq.exe
  C:\Windows\System\QXsnauq.exe
  2⤵
  PID:11564
- C:\Windows\System\VtOkqtd.exe
  C:\Windows\System\VtOkqtd.exe
  2⤵
  PID:11584
- C:\Windows\System\rzKySkC.exe
  C:\Windows\System\rzKySkC.exe
  2⤵
  PID:11620
- C:\Windows\System\QfidLhD.exe
  C:\Windows\System\QfidLhD.exe
  2⤵
  PID:11648
- C:\Windows\System\XqOqmRd.exe
  C:\Windows\System\XqOqmRd.exe
  2⤵
  PID:11676
- C:\Windows\System\xJRxxyO.exe
  C:\Windows\System\xJRxxyO.exe
  2⤵
  PID:11696
- C:\Windows\System\kdkeEHp.exe
  C:\Windows\System\kdkeEHp.exe
  2⤵
  PID:11716
- C:\Windows\System\blPapSG.exe
  C:\Windows\System\blPapSG.exe
  2⤵
  PID:11760
- C:\Windows\System\FnMHgKl.exe
  C:\Windows\System\FnMHgKl.exe
  2⤵
  PID:11784
- C:\Windows\System\LyOvKea.exe
  C:\Windows\System\LyOvKea.exe
  2⤵
  PID:11808
- C:\Windows\System\hnfovke.exe
  C:\Windows\System\hnfovke.exe
  2⤵
  PID:11828
- C:\Windows\System\HoIDXJR.exe
  C:\Windows\System\HoIDXJR.exe
  2⤵
  PID:11848
- C:\Windows\System\VEjteDL.exe
  C:\Windows\System\VEjteDL.exe
  2⤵
  PID:11880
- C:\Windows\System\ACxuQVZ.exe
  C:\Windows\System\ACxuQVZ.exe
  2⤵
  PID:11904
- C:\Windows\System\JWGsQkf.exe
  C:\Windows\System\JWGsQkf.exe
  2⤵
  PID:11920
- C:\Windows\System\nsXnxmY.exe
  C:\Windows\System\nsXnxmY.exe
  2⤵
  PID:11940
- C:\Windows\System\AwBwrLa.exe
  C:\Windows\System\AwBwrLa.exe
  2⤵
  PID:11964
- C:\Windows\System\CuOqZgs.exe
  C:\Windows\System\CuOqZgs.exe
  2⤵
  PID:11996
- C:\Windows\System\yCzqxbP.exe
  C:\Windows\System\yCzqxbP.exe
  2⤵
  PID:12020
- C:\Windows\System\PJuWpeg.exe
  C:\Windows\System\PJuWpeg.exe
  2⤵
  PID:12040
- C:\Windows\System\IdEPbgg.exe
  C:\Windows\System\IdEPbgg.exe
  2⤵
  PID:12064
- C:\Windows\System\nsjXtNu.exe
  C:\Windows\System\nsjXtNu.exe
  2⤵
  PID:12092
- C:\Windows\System\PhkVgnA.exe
  C:\Windows\System\PhkVgnA.exe
  2⤵
  PID:12116
- C:\Windows\System\oOCKzQQ.exe
  C:\Windows\System\oOCKzQQ.exe
  2⤵
  PID:12140
- C:\Windows\System\GJLVEdw.exe
  C:\Windows\System\GJLVEdw.exe
  2⤵
  PID:12164
- C:\Windows\System\vpjCltr.exe
  C:\Windows\System\vpjCltr.exe
  2⤵
  PID:12188
- C:\Windows\System\wrqIpol.exe
  C:\Windows\System\wrqIpol.exe
  2⤵
  PID:12220
- C:\Windows\System\rNhcIMi.exe
  C:\Windows\System\rNhcIMi.exe
  2⤵
  PID:12244
- C:\Windows\System\bGBaHdy.exe
  C:\Windows\System\bGBaHdy.exe
  2⤵
  PID:12268
- C:\Windows\System\fjXpTRb.exe
  C:\Windows\System\fjXpTRb.exe
  2⤵
  PID:9804
- C:\Windows\System\GUcxoXK.exe
  C:\Windows\System\GUcxoXK.exe
  2⤵
  PID:10004
- C:\Windows\System\yvorVsN.exe
  C:\Windows\System\yvorVsN.exe
  2⤵
  PID:10320
- C:\Windows\System\ZVxcXVE.exe
  C:\Windows\System\ZVxcXVE.exe
  2⤵
  PID:2408
- C:\Windows\System\VbFVHtw.exe
  C:\Windows\System\VbFVHtw.exe
  2⤵
  PID:11368
- C:\Windows\System\ImPYxCi.exe
  C:\Windows\System\ImPYxCi.exe
  2⤵
  PID:10984
- C:\Windows\System\vvAcgXr.exe
  C:\Windows\System\vvAcgXr.exe
  2⤵
  PID:10932
- C:\Windows\System\IhEUlyu.exe
  C:\Windows\System\IhEUlyu.exe
  2⤵
  PID:10120
- C:\Windows\System\WEkRhBf.exe
  C:\Windows\System\WEkRhBf.exe
  2⤵
  PID:11600
- C:\Windows\System\NfqBkea.exe
  C:\Windows\System\NfqBkea.exe
  2⤵
  PID:11776
- C:\Windows\System\gEHrxtJ.exe
  C:\Windows\System\gEHrxtJ.exe
  2⤵
  PID:10324
- C:\Windows\System\kCUsjMn.exe
  C:\Windows\System\kCUsjMn.exe
  2⤵
  PID:12132
- C:\Windows\System\PGQZMRH.exe
  C:\Windows\System\PGQZMRH.exe
  2⤵
  PID:12176
- C:\Windows\System\ItJoLhj.exe
  C:\Windows\System\ItJoLhj.exe
  2⤵
  PID:4988
- C:\Windows\System\uykItQk.exe
  C:\Windows\System\uykItQk.exe
  2⤵
  PID:12260
- C:\Windows\System\iYZnMeU.exe
  C:\Windows\System\iYZnMeU.exe
  2⤵
  PID:2176
- C:\Windows\System\SYGmFnc.exe
  C:\Windows\System\SYGmFnc.exe
  2⤵
  PID:10664
- C:\Windows\System\mFpsWqD.exe
  C:\Windows\System\mFpsWqD.exe
  2⤵
  PID:11308
- C:\Windows\System\icfWbnS.exe
  C:\Windows\System\icfWbnS.exe
  2⤵
  PID:3480
- C:\Windows\System\vErMDvf.exe
  C:\Windows\System\vErMDvf.exe
  2⤵
  PID:11684
- C:\Windows\System\SVrCHNA.exe
  C:\Windows\System\SVrCHNA.exe
  2⤵
  PID:11856
- C:\Windows\System\PcYbqEv.exe
  C:\Windows\System\PcYbqEv.exe
  2⤵
  PID:11660
- C:\Windows\System\FsgCvwj.exe
  C:\Windows\System\FsgCvwj.exe
  2⤵
  PID:11892
- C:\Windows\System\QIKNLaR.exe
  C:\Windows\System\QIKNLaR.exe
  2⤵
  PID:4428
- C:\Windows\System\ADfsjGv.exe
  C:\Windows\System\ADfsjGv.exe
  2⤵
  PID:11900
- C:\Windows\System\bUXWxEX.exe
  C:\Windows\System\bUXWxEX.exe
  2⤵
  PID:12160
- C:\Windows\System\xKWARtV.exe
  C:\Windows\System\xKWARtV.exe
  2⤵
  PID:10304
- C:\Windows\System\IsJcofd.exe
  C:\Windows\System\IsJcofd.exe
  2⤵
  PID:8812
- C:\Windows\System\CfuEfuk.exe
  C:\Windows\System\CfuEfuk.exe
  2⤵
  PID:2248
- C:\Windows\System\LRbzFtF.exe
  C:\Windows\System\LRbzFtF.exe
  2⤵
  PID:12128
- C:\Windows\System\UQcyozI.exe
  C:\Windows\System\UQcyozI.exe
  2⤵
  PID:12300
- C:\Windows\System\fqlYwlJ.exe
  C:\Windows\System\fqlYwlJ.exe
  2⤵
  PID:12332
- C:\Windows\System\PhbdPgA.exe
  C:\Windows\System\PhbdPgA.exe
  2⤵
  PID:12352
- C:\Windows\System\FbffAmJ.exe
  C:\Windows\System\FbffAmJ.exe
  2⤵
  PID:12376
- C:\Windows\System\RTUNsxy.exe
  C:\Windows\System\RTUNsxy.exe
  2⤵
  PID:12396
- C:\Windows\System\XblQbbN.exe
  C:\Windows\System\XblQbbN.exe
  2⤵
  PID:12424
- C:\Windows\System\MeSeVJh.exe
  C:\Windows\System\MeSeVJh.exe
  2⤵
  PID:12452
- C:\Windows\System\tSAxuNB.exe
  C:\Windows\System\tSAxuNB.exe
  2⤵
  PID:12468
- C:\Windows\System\FnQzCGL.exe
  C:\Windows\System\FnQzCGL.exe
  2⤵
  PID:12492
- C:\Windows\System\CgjNDdv.exe
  C:\Windows\System\CgjNDdv.exe
  2⤵
  PID:12520
- C:\Windows\System\TroxpdX.exe
  C:\Windows\System\TroxpdX.exe
  2⤵
  PID:12552
- C:\Windows\System\babgpKN.exe
  C:\Windows\System\babgpKN.exe
  2⤵
  PID:12576
- C:\Windows\System\Fipmwtz.exe
  C:\Windows\System\Fipmwtz.exe
  2⤵
  PID:12656
- C:\Windows\System\CuXpgqW.exe
  C:\Windows\System\CuXpgqW.exe
  2⤵
  PID:12676
- C:\Windows\System\dNgWZYH.exe
  C:\Windows\System\dNgWZYH.exe
  2⤵
  PID:12696
- C:\Windows\System\KWiObZZ.exe
  C:\Windows\System\KWiObZZ.exe
  2⤵
  PID:12716
- C:\Windows\System\BznUBpp.exe
  C:\Windows\System\BznUBpp.exe
  2⤵
  PID:12744
- C:\Windows\System\OqgOffO.exe
  C:\Windows\System\OqgOffO.exe
  2⤵
  PID:12764
- C:\Windows\System\QxIFDmq.exe
  C:\Windows\System\QxIFDmq.exe
  2⤵
  PID:12796
- C:\Windows\System\tvFbjVc.exe
  C:\Windows\System\tvFbjVc.exe
  2⤵
  PID:12824
- C:\Windows\System\CBBNEBX.exe
  C:\Windows\System\CBBNEBX.exe
  2⤵
  PID:12848
- C:\Windows\System\ChBkNmm.exe
  C:\Windows\System\ChBkNmm.exe
  2⤵
  PID:12872
- C:\Windows\System\TyszUVY.exe
  C:\Windows\System\TyszUVY.exe
  2⤵
  PID:12900
- C:\Windows\System\zAcIvMY.exe
  C:\Windows\System\zAcIvMY.exe
  2⤵
  PID:12932
- C:\Windows\System\sCPAjgW.exe
  C:\Windows\System\sCPAjgW.exe
  2⤵
  PID:12960
- C:\Windows\System\sRDQcbf.exe
  C:\Windows\System\sRDQcbf.exe
  2⤵
  PID:12988
- C:\Windows\System\VtmefBS.exe
  C:\Windows\System\VtmefBS.exe
  2⤵
  PID:13016
- C:\Windows\System\UNcBRrJ.exe
  C:\Windows\System\UNcBRrJ.exe
  2⤵
  PID:13040
- C:\Windows\System\DchWvsM.exe
  C:\Windows\System\DchWvsM.exe
  2⤵
  PID:13056
- C:\Windows\System\rhrUrji.exe
  C:\Windows\System\rhrUrji.exe
  2⤵
  PID:13080
- C:\Windows\System\gjmfnqT.exe
  C:\Windows\System\gjmfnqT.exe
  2⤵
  PID:13112
- C:\Windows\System\rcveOcl.exe
  C:\Windows\System\rcveOcl.exe
  2⤵
  PID:13140
- C:\Windows\System\uqlyhnu.exe
  C:\Windows\System\uqlyhnu.exe
  2⤵
  PID:13160
- C:\Windows\System\rPmhIdD.exe
  C:\Windows\System\rPmhIdD.exe
  2⤵
  PID:13192
- C:\Windows\System\eNCGgui.exe
  C:\Windows\System\eNCGgui.exe
  2⤵
  PID:13212
- C:\Windows\System\jjNmCzG.exe
  C:\Windows\System\jjNmCzG.exe
  2⤵
  PID:13228
- C:\Windows\System\rWkKUGV.exe
  C:\Windows\System\rWkKUGV.exe
  2⤵
  PID:13244
- C:\Windows\System\jFjCIiv.exe
  C:\Windows\System\jFjCIiv.exe
  2⤵
  PID:13268
- C:\Windows\System\dBLuIHr.exe
  C:\Windows\System\dBLuIHr.exe
  2⤵
  PID:13296
- C:\Windows\System\ShpWCoP.exe
  C:\Windows\System\ShpWCoP.exe
  2⤵
  PID:10412
- C:\Windows\System\iXnlRlZ.exe
  C:\Windows\System\iXnlRlZ.exe
  2⤵
  PID:4740
- C:\Windows\System\MxboMxw.exe
  C:\Windows\System\MxboMxw.exe
  2⤵
  PID:11220
- C:\Windows\System\tjitgHw.exe
  C:\Windows\System\tjitgHw.exe
  2⤵
  PID:11984
- C:\Windows\System\BkePbDd.exe
  C:\Windows\System\BkePbDd.exe
  2⤵
  PID:12608
- C:\Windows\System\iQeBmNj.exe
  C:\Windows\System\iQeBmNj.exe
  2⤵
  PID:12364
- C:\Windows\System\aSlGCFK.exe
  C:\Windows\System\aSlGCFK.exe
  2⤵
  PID:12404
- C:\Windows\System\vEiNXHs.exe
  C:\Windows\System\vEiNXHs.exe
  2⤵
  PID:560
- C:\Windows\System\GOCtStO.exe
  C:\Windows\System\GOCtStO.exe
  2⤵
  PID:12480
- C:\Windows\System\QoCajQZ.exe
  C:\Windows\System\QoCajQZ.exe
  2⤵
  PID:12588
- C:\Windows\System\YijCKfk.exe
  C:\Windows\System\YijCKfk.exe
  2⤵
  PID:12724
- C:\Windows\System\ybzcBdT.exe
  C:\Windows\System\ybzcBdT.exe
  2⤵
  PID:12644
- C:\Windows\System\lJotVnU.exe
  C:\Windows\System\lJotVnU.exe
  2⤵
  PID:12976
- C:\Windows\System\TeQkAZh.exe
  C:\Windows\System\TeQkAZh.exe
  2⤵
  PID:13032
- C:\Windows\System\UTDpGiv.exe
  C:\Windows\System\UTDpGiv.exe
  2⤵
  PID:12784
- C:\Windows\System\gujtsjf.exe
  C:\Windows\System\gujtsjf.exe
  2⤵
  PID:12812
- C:\Windows\System\heaPBOC.exe
  C:\Windows\System\heaPBOC.exe
  2⤵
  PID:13236
- C:\Windows\System\DiTQmAg.exe
  C:\Windows\System\DiTQmAg.exe
  2⤵
  PID:13124
- C:\Windows\System\LGAaLnk.exe
  C:\Windows\System\LGAaLnk.exe
  2⤵
  PID:12080
- C:\Windows\System\EqJPsUD.exe
  C:\Windows\System\EqJPsUD.exe
  2⤵
  PID:12736
- C:\Windows\System\dBZGTxu.exe
  C:\Windows\System\dBZGTxu.exe
  2⤵
  PID:12340
- C:\Windows\System\YImWxec.exe
  C:\Windows\System\YImWxec.exe
  2⤵
  PID:12672
- C:\Windows\System\WMiqsqe.exe
  C:\Windows\System\WMiqsqe.exe
  2⤵
  PID:12944
- C:\Windows\System\ToViZYx.exe
  C:\Windows\System\ToViZYx.exe
  2⤵
  PID:13188
- C:\Windows\System\gfnGxIp.exe
  C:\Windows\System\gfnGxIp.exe
  2⤵
  PID:12504
- C:\Windows\System\eAoReWw.exe
  C:\Windows\System\eAoReWw.exe
  2⤵
  PID:13052
- C:\Windows\System\IrnlLpH.exe
  C:\Windows\System\IrnlLpH.exe
  2⤵
  PID:13320
- C:\Windows\System\CTfkJZx.exe
  C:\Windows\System\CTfkJZx.exe
  2⤵
  PID:13348
- C:\Windows\System\MNflSSC.exe
  C:\Windows\System\MNflSSC.exe
  2⤵
  PID:13368
- C:\Windows\System\wLLpSWy.exe
  C:\Windows\System\wLLpSWy.exe
  2⤵
  PID:13396
- C:\Windows\System\AdyTJFl.exe
  C:\Windows\System\AdyTJFl.exe
  2⤵
  PID:13416
- C:\Windows\System\pVaeNla.exe
  C:\Windows\System\pVaeNla.exe
  2⤵
  PID:13444
- C:\Windows\System\EVbCUQP.exe
  C:\Windows\System\EVbCUQP.exe
  2⤵
  PID:13476
- C:\Windows\System\EgpPWyM.exe
  C:\Windows\System\EgpPWyM.exe
  2⤵
  PID:13492
- C:\Windows\System\wKFuxLp.exe
  C:\Windows\System\wKFuxLp.exe
  2⤵
  PID:13508
- C:\Windows\System\xshajnQ.exe
  C:\Windows\System\xshajnQ.exe
  2⤵
  PID:13532
- C:\Windows\System\poIFCqy.exe
  C:\Windows\System\poIFCqy.exe
  2⤵
  PID:13556
- C:\Windows\System\DCIHLFz.exe
  C:\Windows\System\DCIHLFz.exe
  2⤵
  PID:13576
- C:\Windows\System\VKmyVmj.exe
  C:\Windows\System\VKmyVmj.exe
  2⤵
  PID:13604
- C:\Windows\System\YCZgwWC.exe
  C:\Windows\System\YCZgwWC.exe
  2⤵
  PID:13624
- C:\Windows\System\LomPBwo.exe
  C:\Windows\System\LomPBwo.exe
  2⤵
  PID:13652
- C:\Windows\System\yTmoglH.exe
  C:\Windows\System\yTmoglH.exe
  2⤵
  PID:13680
- C:\Windows\System\TcLcRNc.exe
  C:\Windows\System\TcLcRNc.exe
  2⤵
  PID:13700
- C:\Windows\System\YENVhlq.exe
  C:\Windows\System\YENVhlq.exe
  2⤵
  PID:13728
- C:\Windows\System\DyMlitp.exe
  C:\Windows\System\DyMlitp.exe
  2⤵
  PID:13748
- C:\Windows\System\RVzcYCG.exe
  C:\Windows\System\RVzcYCG.exe
  2⤵
  PID:13784
- C:\Windows\System\CLhzIUz.exe
  C:\Windows\System\CLhzIUz.exe
  2⤵
  PID:13808
- C:\Windows\System\pZeakEF.exe
  C:\Windows\System\pZeakEF.exe
  2⤵
  PID:13836
- C:\Windows\System\AWeLfOc.exe
  C:\Windows\System\AWeLfOc.exe
  2⤵
  PID:13864
- C:\Windows\System\ikYhAqR.exe
  C:\Windows\System\ikYhAqR.exe
  2⤵
  PID:13892
- C:\Windows\System\hVzyDjG.exe
  C:\Windows\System\hVzyDjG.exe
  2⤵
  PID:13912
- C:\Windows\System\KefGvDe.exe
  C:\Windows\System\KefGvDe.exe
  2⤵
  PID:13936
- C:\Windows\System\DrPhVSO.exe
  C:\Windows\System\DrPhVSO.exe
  2⤵
  PID:13968
- C:\Windows\System\aJKfkCw.exe
  C:\Windows\System\aJKfkCw.exe
  2⤵
  PID:13996
- C:\Windows\System\xGFOlYG.exe
  C:\Windows\System\xGFOlYG.exe
  2⤵
  PID:14016
- C:\Windows\System\YWkGhHB.exe
  C:\Windows\System\YWkGhHB.exe
  2⤵
  PID:14048
- C:\Windows\System\KslZkho.exe
  C:\Windows\System\KslZkho.exe
  2⤵
  PID:14072
- C:\Windows\System\YRcjqNf.exe
  C:\Windows\System\YRcjqNf.exe
  2⤵
  PID:14148
- C:\Windows\System\wnMpJOa.exe
  C:\Windows\System\wnMpJOa.exe
  2⤵
  PID:14168
- C:\Windows\System\dnqIrwY.exe
  C:\Windows\System\dnqIrwY.exe
  2⤵
  PID:14188
- C:\Windows\System\dZIpEzH.exe
  C:\Windows\System\dZIpEzH.exe
  2⤵
  PID:14204
- C:\Windows\System\wUxaOFg.exe
  C:\Windows\System\wUxaOFg.exe
  2⤵
  PID:14228
- C:\Windows\System\zmfDBzs.exe
  C:\Windows\System\zmfDBzs.exe
  2⤵
  PID:14276
- C:\Windows\System\rVsCWcO.exe
  C:\Windows\System\rVsCWcO.exe
  2⤵
  PID:14304
- C:\Windows\System\lAZRJMP.exe
  C:\Windows\System\lAZRJMP.exe
  2⤵
  PID:1008
- C:\Windows\System\GFNZHjQ.exe
  C:\Windows\System\GFNZHjQ.exe
  2⤵
  PID:12536
- C:\Windows\System\FBsoSuG.exe
  C:\Windows\System\FBsoSuG.exe
  2⤵
  PID:12832
- C:\Windows\System\tGlbhTg.exe
  C:\Windows\System\tGlbhTg.exe
  2⤵
  PID:12868
- C:\Windows\System\PfhrypV.exe
  C:\Windows\System\PfhrypV.exe
  2⤵
  PID:13460
- C:\Windows\System\MsOYZSd.exe
  C:\Windows\System\MsOYZSd.exe
  2⤵
  PID:13600
- C:\Windows\System\efayRTu.exe
  C:\Windows\System\efayRTu.exe
  2⤵
  PID:13660
- C:\Windows\System\WUzNlpL.exe
  C:\Windows\System\WUzNlpL.exe
  2⤵
  PID:13472
- C:\Windows\System\SCFrTjc.exe
  C:\Windows\System\SCFrTjc.exe
  2⤵
  PID:13620
- C:\Windows\System\YsEaePj.exe
  C:\Windows\System\YsEaePj.exe
  2⤵
  PID:13816
- C:\Windows\System\RvCSRmM.exe
  C:\Windows\System\RvCSRmM.exe
  2⤵
  PID:13832
- C:\Windows\System\WVgGvVh.exe
  C:\Windows\System\WVgGvVh.exe
  2⤵
  PID:13884
- C:\Windows\System\WLSDYbT.exe
  C:\Windows\System\WLSDYbT.exe
  2⤵
  PID:13928
- C:\Windows\System\kpVjEoj.exe
  C:\Windows\System\kpVjEoj.exe
  2⤵
  PID:14004
- C:\Windows\System\ztWSgvB.exe
  C:\Windows\System\ztWSgvB.exe
  2⤵
  PID:13740
- C:\Windows\System\UORHyNS.exe
  C:\Windows\System\UORHyNS.exe
  2⤵
  PID:13768
- C:\Windows\System\ibdYhNg.exe
  C:\Windows\System\ibdYhNg.exe
  2⤵
  PID:14032
- C:\Windows\System\LlNoCPB.exe
  C:\Windows\System\LlNoCPB.exe
  2⤵
  PID:13980
- C:\Windows\System\lHOcRSO.exe
  C:\Windows\System\lHOcRSO.exe
  2⤵
  PID:14124
- C:\Windows\System\cxdkAxS.exe
  C:\Windows\System\cxdkAxS.exe
  2⤵
  PID:14104
- C:\Windows\System\BbmhOeu.exe
  C:\Windows\System\BbmhOeu.exe
  2⤵
  PID:14176
- C:\Windows\System\XJLawwN.exe
  C:\Windows\System\XJLawwN.exe
  2⤵
  PID:14216
- C:\Windows\System\hDOrpZh.exe
  C:\Windows\System\hDOrpZh.exe
  2⤵
  PID:13540
- C:\Windows\System\RafrnsP.exe
  C:\Windows\System\RafrnsP.exe
  2⤵
  PID:14316
- C:\Windows\System\duYRHMU.exe
  C:\Windows\System\duYRHMU.exe
  2⤵
  PID:13344
- C:\Windows\System\yaGoTRm.exe
  C:\Windows\System\yaGoTRm.exe
  2⤵
  PID:13848
- C:\Windows\System\oXBzozw.exe
  C:\Windows\System\oXBzozw.exe
  2⤵
  PID:13592
- C:\Windows\System\xAjVBUw.exe
  C:\Windows\System\xAjVBUw.exe
  2⤵
  PID:13984
- C:\Windows\System\exqxQpj.exe
  C:\Windows\System\exqxQpj.exe
  2⤵
  PID:13692
- C:\Windows\System\HgyZeYo.exe
  C:\Windows\System\HgyZeYo.exe
  2⤵
  PID:13640
- C:\Windows\System\nNOhWFK.exe
  C:\Windows\System\nNOhWFK.exe
  2⤵
  PID:14340
- C:\Windows\System\cawFsBk.exe
  C:\Windows\System\cawFsBk.exe
  2⤵
  PID:14368
- C:\Windows\System\yjnTNNx.exe
  C:\Windows\System\yjnTNNx.exe
  2⤵
  PID:14384
- C:\Windows\System\yzditlm.exe
  C:\Windows\System\yzditlm.exe
  2⤵
  PID:14412
- C:\Windows\System\bAEfeLa.exe
  C:\Windows\System\bAEfeLa.exe
  2⤵
  PID:14436
- C:\Windows\System\aRqrDdQ.exe
  C:\Windows\System\aRqrDdQ.exe
  2⤵
  PID:14460
- C:\Windows\System\MztRHtB.exe
  C:\Windows\System\MztRHtB.exe
  2⤵
  PID:14488
- C:\Windows\System\dGUQDHC.exe
  C:\Windows\System\dGUQDHC.exe
  2⤵
  PID:14508
- C:\Windows\System\CkQpSMB.exe
  C:\Windows\System\CkQpSMB.exe
  2⤵
  PID:14532
- C:\Windows\System\xRqEXMx.exe
  C:\Windows\System\xRqEXMx.exe
  2⤵
  PID:14564
- C:\Windows\System\wDrOGVW.exe
  C:\Windows\System\wDrOGVW.exe
  2⤵
  PID:14580
- C:\Windows\System\RSbeuEG.exe
  C:\Windows\System\RSbeuEG.exe
  2⤵
  PID:14608
- C:\Windows\System\pRTeatx.exe
  C:\Windows\System\pRTeatx.exe
  2⤵
  PID:14624
- C:\Windows\System\gCrecRi.exe
  C:\Windows\System\gCrecRi.exe
  2⤵
  PID:14648
- C:\Windows\System\fridFxY.exe
  C:\Windows\System\fridFxY.exe
  2⤵
  PID:14684
- C:\Windows\System\wxzPbUD.exe
  C:\Windows\System\wxzPbUD.exe
  2⤵
  PID:14712
- C:\Windows\System\ncQJKdO.exe
  C:\Windows\System\ncQJKdO.exe
  2⤵
  PID:14744
- C:\Windows\System\Ktqfrwz.exe
  C:\Windows\System\Ktqfrwz.exe
  2⤵
  PID:14772
- C:\Windows\System\ujaewvQ.exe
  C:\Windows\System\ujaewvQ.exe
  2⤵
  PID:14800
- C:\Windows\System\HtApunB.exe
  C:\Windows\System\HtApunB.exe
  2⤵
  PID:14828
- C:\Windows\System\ptUQNJb.exe
  C:\Windows\System\ptUQNJb.exe
  2⤵
  PID:14860
- C:\Windows\System\QnVTxqY.exe
  C:\Windows\System\QnVTxqY.exe
  2⤵
  PID:14876
- C:\Windows\System\IGGfGFJ.exe
  C:\Windows\System\IGGfGFJ.exe
  2⤵
  PID:14892
- C:\Windows\System\RSzZQdP.exe
  C:\Windows\System\RSzZQdP.exe
  2⤵
  PID:14920
- C:\Windows\System\iGryIdz.exe
  C:\Windows\System\iGryIdz.exe
  2⤵
  PID:14944
- C:\Windows\System\aDKQPMD.exe
  C:\Windows\System\aDKQPMD.exe
  2⤵
  PID:14960
- C:\Windows\System\Wocphgf.exe
  C:\Windows\System\Wocphgf.exe
  2⤵
  PID:14984
- C:\Windows\System\PiPfEUZ.exe
  C:\Windows\System\PiPfEUZ.exe
  2⤵
  PID:15004
- C:\Windows\System\krLpfBF.exe
  C:\Windows\System\krLpfBF.exe
  2⤵
  PID:15032
- C:\Windows\System\UgPuYcF.exe
  C:\Windows\System\UgPuYcF.exe
  2⤵
  PID:15056
- C:\Windows\System\SEHzWGi.exe
  C:\Windows\System\SEHzWGi.exe
  2⤵
  PID:15076
- C:\Windows\System\SqfyNeK.exe
  C:\Windows\System\SqfyNeK.exe
  2⤵
  PID:15104
- C:\Windows\System\FUeKnkx.exe
  C:\Windows\System\FUeKnkx.exe
  2⤵
  PID:15240
- C:\Windows\System\TvYkMaH.exe
  C:\Windows\System\TvYkMaH.exe
  2⤵
  PID:15256
- C:\Windows\System\rmiEvGG.exe
  C:\Windows\System\rmiEvGG.exe
  2⤵
  PID:15272
- C:\Windows\System\wRDTBYo.exe
  C:\Windows\System\wRDTBYo.exe
  2⤵
  PID:15300
- C:\Windows\System\CMpBKoO.exe
  C:\Windows\System\CMpBKoO.exe
  2⤵
  PID:15320
- C:\Windows\System\hxtQMZH.exe
  C:\Windows\System\hxtQMZH.exe
  2⤵
  PID:15336
- C:\Windows\System\LIHKpVG.exe
  C:\Windows\System\LIHKpVG.exe
  2⤵
  PID:15352
- C:\Windows\System\mITkLUx.exe
  C:\Windows\System\mITkLUx.exe
  2⤵
  PID:13456
- C:\Windows\System\ENJtUXL.exe
  C:\Windows\System\ENJtUXL.exe
  2⤵
  PID:13900
- C:\Windows\System\WZjOcTr.exe
  C:\Windows\System\WZjOcTr.exe
  2⤵
  PID:12948
- C:\Windows\System\VmseuaF.exe
  C:\Windows\System\VmseuaF.exe
  2⤵
  PID:13204
- C:\Windows\System\dBpmgOX.exe
  C:\Windows\System\dBpmgOX.exe
  2⤵
  PID:13760
- C:\Windows\System\rkKbfii.exe
  C:\Windows\System\rkKbfii.exe
  2⤵
  PID:14500
- C:\Windows\System\TXjRvee.exe
  C:\Windows\System\TXjRvee.exe
  2⤵
  PID:14644
- C:\Windows\System\CSkZPTi.exe
  C:\Windows\System\CSkZPTi.exe
  2⤵
  PID:14432
- C:\Windows\System\qLDfuhU.exe
  C:\Windows\System\qLDfuhU.exe
  2⤵
  PID:14736
- C:\Windows\System\LkdhrJs.exe
  C:\Windows\System\LkdhrJs.exe
  2⤵
  PID:13736
- C:\Windows\System\Rnncseb.exe
  C:\Windows\System\Rnncseb.exe
  2⤵
  PID:14408
- C:\Windows\System\jtpdQWR.exe
  C:\Windows\System\jtpdQWR.exe
  2⤵
  PID:15040
- C:\Windows\System\YWHPRKw.exe
  C:\Windows\System\YWHPRKw.exe
  2⤵
  PID:14756
- C:\Windows\System\wdSWCnX.exe
  C:\Windows\System\wdSWCnX.exe
  2⤵
  PID:14768
- C:\Windows\System\QsRhBXk.exe
  C:\Windows\System\QsRhBXk.exe
  2⤵
  PID:14556
- C:\Windows\System\fLOntDA.exe
  C:\Windows\System\fLOntDA.exe
  2⤵
  PID:14572
- C:\Windows\System\CFZOBYd.exe
  C:\Windows\System\CFZOBYd.exe
  2⤵
  PID:14928
- C:\Windows\System\HHlyGUU.exe
  C:\Windows\System\HHlyGUU.exe
  2⤵
  PID:15024
- C:\Windows\System\KSciBNy.exe
  C:\Windows\System\KSciBNy.exe
  2⤵
  PID:14848
- C:\Windows\System\fIiNPmu.exe
  C:\Windows\System\fIiNPmu.exe
  2⤵
  PID:14884
- C:\Windows\System\pVYhgqY.exe
  C:\Windows\System\pVYhgqY.exe
  2⤵
  PID:13828
- C:\Windows\System\kThSYLx.exe
  C:\Windows\System\kThSYLx.exe
  2⤵
  PID:14056
- C:\Windows\System\YNtVbFn.exe
  C:\Windows\System\YNtVbFn.exe
  2⤵
  PID:15116
- C:\Windows\System\abYJqoK.exe
  C:\Windows\System\abYJqoK.exe
  2⤵
  PID:14524
- C:\Windows\System\vUPydXe.exe
  C:\Windows\System\vUPydXe.exe
  2⤵
  PID:15368
- C:\Windows\System\JjZqsid.exe
  C:\Windows\System\JjZqsid.exe
  2⤵
  PID:15392
- C:\Windows\System\hAqXIgT.exe
  C:\Windows\System\hAqXIgT.exe
  2⤵
  PID:15416
- C:\Windows\System\ElQRzTp.exe
  C:\Windows\System\ElQRzTp.exe
  2⤵
  PID:15440
- C:\Windows\System\NbwklwJ.exe
  C:\Windows\System\NbwklwJ.exe
  2⤵
  PID:15468
- C:\Windows\System\CtkAFgW.exe
  C:\Windows\System\CtkAFgW.exe
  2⤵
  PID:15492
- C:\Windows\System\wOpehCO.exe
  C:\Windows\System\wOpehCO.exe
  2⤵
  PID:15520
- C:\Windows\System\VclTQjR.exe
  C:\Windows\System\VclTQjR.exe
  2⤵
  PID:15544
- C:\Windows\System\fmyOZSc.exe
  C:\Windows\System\fmyOZSc.exe
  2⤵
  PID:15564
- C:\Windows\System\pXBUDjV.exe
  C:\Windows\System\pXBUDjV.exe
  2⤵
  PID:15580
- C:\Windows\System\UdeDmll.exe
  C:\Windows\System\UdeDmll.exe
  2⤵
  PID:15600
- C:\Windows\System\xMJpAna.exe
  C:\Windows\System\xMJpAna.exe
  2⤵
  PID:15632
- C:\Windows\System\aSIahnq.exe
  C:\Windows\System\aSIahnq.exe
  2⤵
  PID:15656
- C:\Windows\System\umcBhmV.exe
  C:\Windows\System\umcBhmV.exe
  2⤵
  PID:15680
- C:\Windows\System\dIiTRDA.exe
  C:\Windows\System\dIiTRDA.exe
  2⤵
  PID:15696
- C:\Windows\System\iNDcElB.exe
  C:\Windows\System\iNDcElB.exe
  2⤵
  PID:15728
- C:\Windows\System\AJsPIIU.exe
  C:\Windows\System\AJsPIIU.exe
  2⤵
  PID:15756
- C:\Windows\System\TWRlRjl.exe
  C:\Windows\System\TWRlRjl.exe
  2⤵
  PID:15808
- C:\Windows\System\pzdXbTj.exe
  C:\Windows\System\pzdXbTj.exe
  2⤵
  PID:15832
- C:\Windows\System\jguCAga.exe
  C:\Windows\System\jguCAga.exe
  2⤵
  PID:15856
- C:\Windows\System\mmSvYYq.exe
  C:\Windows\System\mmSvYYq.exe
  2⤵
  PID:15880
- C:\Windows\System\qYTfsdo.exe
  C:\Windows\System\qYTfsdo.exe
  2⤵
  PID:15904
- C:\Windows\System\WEMoyTS.exe
  C:\Windows\System\WEMoyTS.exe
  2⤵
  PID:15932
- C:\Windows\System\OyrEHEV.exe
  C:\Windows\System\OyrEHEV.exe
  2⤵
  PID:15956
- C:\Windows\System\ZPWfSmI.exe
  C:\Windows\System\ZPWfSmI.exe
  2⤵
  PID:15980
- C:\Windows\System\FLQRXeF.exe
  C:\Windows\System\FLQRXeF.exe
  2⤵
  PID:16000
- C:\Windows\System\eOWxtQz.exe
  C:\Windows\System\eOWxtQz.exe
  2⤵
  PID:16032
- C:\Windows\System\lYxpQBo.exe
  C:\Windows\System\lYxpQBo.exe
  2⤵
  PID:16048
- C:\Windows\System\ogAxFxc.exe
  C:\Windows\System\ogAxFxc.exe
  2⤵
  PID:16068
- C:\Windows\System\FXXSTtn.exe
  C:\Windows\System\FXXSTtn.exe
  2⤵
  PID:16096
- C:\Windows\System\TwGCPxF.exe
  C:\Windows\System\TwGCPxF.exe
  2⤵
  PID:16116
- C:\Windows\System\BsMrEwZ.exe
  C:\Windows\System\BsMrEwZ.exe
  2⤵
  PID:16144
- C:\Windows\System\Tcanygw.exe
  C:\Windows\System\Tcanygw.exe
  2⤵
  PID:16176
- C:\Windows\System\ypZAtoY.exe
  C:\Windows\System\ypZAtoY.exe
  2⤵
  PID:16212
- C:\Windows\System\CeXpODc.exe
  C:\Windows\System\CeXpODc.exe
  2⤵
  PID:16240
- C:\Windows\System\CYUkWdY.exe
  C:\Windows\System\CYUkWdY.exe
  2⤵
  PID:16260
- C:\Windows\System\YSbEeNS.exe
  C:\Windows\System\YSbEeNS.exe
  2⤵
  PID:16296
- C:\Windows\System\afEPDcF.exe
  C:\Windows\System\afEPDcF.exe
  2⤵
  PID:16316
- C:\Windows\System\FPuvZsu.exe
  C:\Windows\System\FPuvZsu.exe
  2⤵
  PID:16336
- C:\Windows\System\OmpskCh.exe
  C:\Windows\System\OmpskCh.exe
  2⤵
  PID:16364
- C:\Windows\System\EQFACFZ.exe
  C:\Windows\System\EQFACFZ.exe
  2⤵
  PID:13948
- C:\Windows\System\xxkaXUl.exe
  C:\Windows\System\xxkaXUl.exe
  2⤵
  PID:15144
- C:\Windows\System\EcWHQEQ.exe
  C:\Windows\System\EcWHQEQ.exe
  2⤵
  PID:15280
- C:\Windows\System\MuxuMXR.exe
  C:\Windows\System\MuxuMXR.exe
  2⤵
  PID:15312
- C:\Windows\System\pcaIHhP.exe
  C:\Windows\System\pcaIHhP.exe
  2⤵
  PID:14484
- C:\Windows\System\QVfEfYU.exe
  C:\Windows\System\QVfEfYU.exe
  2⤵
  PID:14604
- C:\Windows\System\TBOcOJa.exe
  C:\Windows\System\TBOcOJa.exe
  2⤵
  PID:15528
- C:\Windows\System\PjYlKTr.exe
  C:\Windows\System\PjYlKTr.exe
  2⤵
  PID:14904
- C:\Windows\System\HtSDmEY.exe
  C:\Windows\System\HtSDmEY.exe
  2⤵
  PID:15652
- C:\Windows\System\mNCaKWg.exe
  C:\Windows\System\mNCaKWg.exe
  2⤵
  PID:15692
- C:\Windows\System\dNIcinx.exe
  C:\Windows\System\dNIcinx.exe
  2⤵
  PID:14444
- C:\Windows\System\RhyAxpw.exe
  C:\Windows\System\RhyAxpw.exe
  2⤵
  PID:15388
- C:\Windows\System\UlLdFRI.exe
  C:\Windows\System\UlLdFRI.exe
  2⤵
  PID:15476
- C:\Windows\System\jqnFMCj.exe
  C:\Windows\System\jqnFMCj.exe
  2⤵
  PID:14700
- C:\Windows\System\oaLOJbp.exe
  C:\Windows\System\oaLOJbp.exe
  2⤵
  PID:15572
- C:\Windows\System\rwtrofW.exe
  C:\Windows\System\rwtrofW.exe
  2⤵
  PID:14972
- C:\Windows\System\VydSsql.exe
  C:\Windows\System\VydSsql.exe
  2⤵
  PID:16024
- C:\Windows\System\PVsVDyJ.exe
  C:\Windows\System\PVsVDyJ.exe
  2⤵
  PID:15740
- C:\Windows\System\lrQIHpi.exe
  C:\Windows\System\lrQIHpi.exe
  2⤵
  PID:15432
- C:\Windows\System\oJxddWb.exe
  C:\Windows\System\oJxddWb.exe
  2⤵
  PID:16224
- C:\Windows\System\lLRQuow.exe
  C:\Windows\System\lLRQuow.exe
  2⤵
  PID:15892
- C:\Windows\System\lvCNVAk.exe
  C:\Windows\System\lvCNVAk.exe
  2⤵
  PID:15948
- C:\Windows\System\oOgTbvt.exe
  C:\Windows\System\oOgTbvt.exe
  2⤵
  PID:15612
- C:\Windows\System\oPFKNaC.exe
  C:\Windows\System\oPFKNaC.exe
  2⤵
  PID:14616
- C:\Windows\System\jTUTNsv.exe
  C:\Windows\System\jTUTNsv.exe
  2⤵
  PID:16396
- C:\Windows\System\gSLNaGM.exe
  C:\Windows\System\gSLNaGM.exe
  2⤵
  PID:16424
- - C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -u -p 16424 -s 248
    3⤵
    PID:15720
- C:\Windows\System\ZgPrQXz.exe
  C:\Windows\System\ZgPrQXz.exe
  2⤵
  PID:16452
- C:\Windows\System\rrDrcrp.exe
  C:\Windows\System\rrDrcrp.exe
  2⤵
  PID:16484
- C:\Windows\System\SZaYtvl.exe
  C:\Windows\System\SZaYtvl.exe
  2⤵
  PID:16504
- C:\Windows\System\YOdXqDp.exe
  C:\Windows\System\YOdXqDp.exe
  2⤵
  PID:16524
- C:\Windows\System\jGNgFMg.exe
  C:\Windows\System\jGNgFMg.exe
  2⤵
  PID:16572
- C:\Windows\System\RbYQlxG.exe
  C:\Windows\System\RbYQlxG.exe
  2⤵
  PID:16596
- C:\Windows\System\KBcNavx.exe
  C:\Windows\System\KBcNavx.exe
  2⤵
  PID:16620
- C:\Windows\System\HIlActG.exe
  C:\Windows\System\HIlActG.exe
  2⤵
  PID:16648
- C:\Windows\System\OfRtJun.exe
  C:\Windows\System\OfRtJun.exe
  2⤵
  PID:16676
- C:\Windows\System\mugYFrm.exe
  C:\Windows\System\mugYFrm.exe
  2⤵
  PID:16696
- C:\Windows\System\MTXmbxb.exe
  C:\Windows\System\MTXmbxb.exe
  2⤵
  PID:16716
- C:\Windows\System\UqWYKFw.exe
  C:\Windows\System\UqWYKFw.exe
  2⤵
  PID:16732
- C:\Windows\System\ZtXURnG.exe
  C:\Windows\System\ZtXURnG.exe
  2⤵
  PID:16760
- C:\Windows\System\mNPFYpK.exe
  C:\Windows\System\mNPFYpK.exe
  2⤵
  PID:16780
- C:\Windows\System\kpCIHNM.exe
  C:\Windows\System\kpCIHNM.exe
  2⤵
  PID:16804
- C:\Windows\System\NViskga.exe
  C:\Windows\System\NViskga.exe
  2⤵
  PID:16832
- C:\Windows\System\aiQGzaH.exe
  C:\Windows\System\aiQGzaH.exe
  2⤵
  PID:16856
- C:\Windows\System\pNQOGQQ.exe
  C:\Windows\System\pNQOGQQ.exe
  2⤵
  PID:16880
- C:\Windows\System\TqkESZN.exe
  C:\Windows\System\TqkESZN.exe
  2⤵
  PID:16908
- C:\Windows\System\fyCmNWQ.exe
  C:\Windows\System\fyCmNWQ.exe
  2⤵
  PID:16928
- C:\Windows\System\IAkaJun.exe
  C:\Windows\System\IAkaJun.exe
  2⤵
  PID:16956
- C:\Windows\System\spQMUqT.exe
  C:\Windows\System\spQMUqT.exe
  2⤵
  PID:16980
- C:\Windows\System\AvySOlB.exe
  C:\Windows\System\AvySOlB.exe
  2⤵
  PID:17000
- C:\Windows\System\KVoyeGw.exe
  C:\Windows\System\KVoyeGw.exe
  2⤵
  PID:17020
- C:\Windows\System\cOGUDIk.exe
  C:\Windows\System\cOGUDIk.exe
  2⤵
  PID:17044
- C:\Windows\System\QbmCxHB.exe
  C:\Windows\System\QbmCxHB.exe
  2⤵
  PID:17068
- C:\Windows\System\MsUmrrI.exe
  C:\Windows\System\MsUmrrI.exe
  2⤵
  PID:17092
- C:\Windows\System\ReoAlAA.exe
  C:\Windows\System\ReoAlAA.exe
  2⤵
  PID:17112
- C:\Windows\System\GdVFkYd.exe
  C:\Windows\System\GdVFkYd.exe
  2⤵
  PID:17132
- C:\Windows\System\aCtGPTC.exe
  C:\Windows\System\aCtGPTC.exe
  2⤵
  PID:17148
- C:\Windows\System\ptelqQp.exe
  C:\Windows\System\ptelqQp.exe
  2⤵
  PID:17360
- C:\Windows\System\cjLErcw.exe
  C:\Windows\System\cjLErcw.exe
  2⤵
  PID:17388
- C:\Windows\System\vDtBQfH.exe
  C:\Windows\System\vDtBQfH.exe
  2⤵
  PID:15552
- C:\Windows\System\gmqJASR.exe
  C:\Windows\System\gmqJASR.exe
  2⤵
  PID:16196
- C:\Windows\System\sqFyNYa.exe
  C:\Windows\System\sqFyNYa.exe
  2⤵
  PID:17088
- C:\Windows\System\SDZzpBn.exe
  C:\Windows\System\SDZzpBn.exe
  2⤵
  PID:16704
- C:\Windows\System\YmtetsK.exe
  C:\Windows\System\YmtetsK.exe
  2⤵
  PID:14028
- C:\Windows\System\qIagkOv.exe
  C:\Windows\System\qIagkOv.exe
  2⤵
  PID:17008
- C:\Windows\System\lVapZtX.exe
  C:\Windows\System\lVapZtX.exe
  2⤵
  PID:17016
- C:\Windows\System\ZkUCAlL.exe
  C:\Windows\System\ZkUCAlL.exe
  2⤵
  PID:16968
- C:\Windows\System\jNxRDty.exe
  C:\Windows\System\jNxRDty.exe
  2⤵
  PID:17340
- C:\Windows\System\laIzEbK.exe
  C:\Windows\System\laIzEbK.exe
  2⤵
  PID:14636

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:16164

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\AMMoTFx.exe

Filesize
1.5MB

MD5
0743072911c2107478a846406be5f5c1

SHA1
ef3edd201533355be12f8c59006b26e88c727c53

SHA256
f7f87fcc3a80efaef9c986c1237dda6662ac8ab0c767e730502476128e7e58c5

SHA512
1b92a2b0c448c4f7bb5aef446458a1717811c25c67d1d1376efd382867716df291680644187a3871d06bb49e6a0b57f51f31fd39e55f238320ce5daa4d70e4de

Download Submit
C:\Windows\System\CDffhCL.exe

Filesize
1.5MB

MD5
f31890883cf31b4de3f7249c596497cd

SHA1
96ff05dfe54745af56d41a2fa40fbc109fdbc091

SHA256
04cc55c3adafc4ca83863a3f2c0d63b4cf6e5671e8e1560a168f9a72020d8bf1

SHA512
c166fb180532aa61f0bc829c610ea07c2c67449ed34dd6fbef17ec1a43f1546c95581b87b93831c109fa682a2649df26f591f73cb6026caa43442dd226037093

Download Submit
C:\Windows\System\EkTivCD.exe

Filesize
1.5MB

MD5
5f76c1517a6f81bc3d8f0bc849ec028e

SHA1
5aa97d576dd4eb07bd60a4933bf99402205c2a22

SHA256
8ea1e0391fe7a3e0487dfdb23b004e2c6d1c2bf0f72a1b479d82fecf316ebcc6

SHA512
9807d49f0fd9926c13b532cf7737061410fd101c26736cfce32a3711fc0d30cf8668ccbe0cc2dc83a6a7ab33d76c46594f8b633c82acc62f39f1ec23ecaace77

Download Submit
C:\Windows\System\EyHxFnM.exe

Filesize
1.5MB

MD5
cc2ee0a2decd6f9f75f36e66a5f6b748

SHA1
d3cab75e3ae21b5edacbf510cecb3242171430e2

SHA256
d8233c19c9e200c65e995ffb9fffb83bd7a2a75c1a6f2fddf0edd74a05f25699

SHA512
315487f52be7dab778e5213f79049be31c4354c1208e81318eb0dbf47ce307e07f92063c8540e591e80921d6151b191a14c96365a519c876aa8771b63fb8e9e8

Download Submit
C:\Windows\System\JAzNxRl.exe

Filesize
1.5MB

MD5
5af9c96f95516a3c85e10b5c819529ac

SHA1
ff3e4ccd88614e707cfb9d892c51dd5f50f103ce

SHA256
35b08ac4cbac3070a7af9c23848baf24ce4fc334279ea4fd93e6b8f80509369f

SHA512
b436f89a8d865de9a3a385d550f1e1f2c53c1f49162d28a70c808e81c49cd96ce44c4bb82a80a6ec39f5f2a9e80666665ecbd261c890cc02b7fbeb71baffbb7e

Download Submit
C:\Windows\System\LKWRgwY.exe

Filesize
1.5MB

MD5
a6d340fd9c8e1ec0ac4468f894584e91

SHA1
83b8a81afe2941fafc3bb24247a5a00effadbda2

SHA256
83cfefbf3484ab501e42f020f6c60c80848956f4bc994c17a941b6cd6c821c0b

SHA512
2815b84ebf4569849f8d7bf17996792eea99118e3fa3eda8999e070be80c1bf470a40fdce1bf8cd22d221ea7720dfc0d639bcd4395430ad0aac69777483ef612

Download Submit
C:\Windows\System\PQgjExe.exe

Filesize
1.5MB

MD5
3439784f1254ba55dd38f083d5ce1261

SHA1
6d77969f7515e5178e18b081396daa386e902925

SHA256
466e164abac1e5f918896a29eed303f99447fe448410bf32c2aeef312bb31d69

SHA512
8045863706379d898c21bf5920b6a485b3851fc67f2089167863afb9d51b6dc2b5c7eaf097ecf0d1f22d8c652b712feb2e5243bc791668938e46992267619be4

Download Submit
C:\Windows\System\PjZbaJu.exe

Filesize
1.5MB

MD5
80bb442dfd81f8df1b1907e5e9fedca2

SHA1
e9103652b7c0b71450d6694e80b32fddaf09a054

SHA256
1a46c736ae43d35bdcf29a32f8ae0827cf142acf0a712dbc60e4fc189931686e

SHA512
c22a0f92cc1879696606cef1888c49a174ed1242969f9a2b18cb3b9d942e5a17c873dec419b35fb01dff10d632df8065055d76f7de8b444df622f8b4fe71cd2f

Download Submit
C:\Windows\System\QifTxlC.exe

Filesize
1.5MB

MD5
c354eb720394651ef4135aa75062ca06

SHA1
71adbb4dd1698c554862e97e75fb0da986de7962

SHA256
9911d5217156d207cef700dee237a316b448fd2f3239a775326c78c12d264a06

SHA512
08a2abd22c990f25211254dcaa84e111f2dca4352d17f9937740a9b707edbea2e2f42bd4a9ac3364bc04ffc17cfe9669402305dfec5546d91997b41b92571df9

Download Submit
C:\Windows\System\QxaavWI.exe

Filesize
1.5MB

MD5
f714d266e544e7dbac5ecd8a6fe9d173

SHA1
31972c25ef45929ebc9fd96874132fea7b340efc

SHA256
ff4a7b00496203ed86698994dffc5a4b674574dfcca38c021a17236f641f5b5d

SHA512
89219441693439dcba2fc6dd01a8f36c185a9fb373c695759b05974de246100e62f161802c17b8208d071855e9f0d2126f3a874befc9f8732ce780a9b3329a99

Download Submit
C:\Windows\System\UWwwRbS.exe

Filesize
1.5MB

MD5
7e0678aff4c377a60327faaccbe3305c

SHA1
f9d59522c8a9607eec5077b7704fe341f3e68d08

SHA256
f23e6b9ffe8fad5d0a1c4e66343cbd9a74e76f406329bcf408c44d8d620e360e

SHA512
7ae26053ee9d9ec2fac3a99ae70c30fd47bf2c73c67f6e0d00606c71f835741e1c7df05e4702909c454d55acf37047a9a8241ddb61d3593488254de58bbb6804

Download Submit
C:\Windows\System\XoEmxpX.exe

Filesize
1.5MB

MD5
380f584ff644d8e1952a0ebe0685dff9

SHA1
7abd18e1fa1afc47ca7447f6f8d731e995f14877

SHA256
8d410a837144ca3d358c12303d5beee8565c183baf1bc319058de61ca22adae7

SHA512
e3475f1aa7843d240cdcaed74aa85c8c8595bfaebc83f5f886aeafc4212999c1e6da981252bf912c3766623a8a060f087125641d04122fdb59f63e23d408e81e

Download Submit
C:\Windows\System\XuuwmFN.exe

Filesize
1.5MB

MD5
1e94727451b1d5c89f0a9566dc26315d

SHA1
d826763d59748125d6e2b6430fcbf85aebd17368

SHA256
dc9879020f3bef251fbf7ecfb1d65cba3942f1ec22055777813d8da92ed40252

SHA512
96495eeb4551e2549fcb068de7d714b88ffc4e741e6330263b97f4976e53479f9d0e62643240a137fefc6487f49300b05cb69207b122445e29763f4b29498fa2

Download Submit
C:\Windows\System\ZKTDqKg.exe

Filesize
1.5MB

MD5
297c16f6b361232eadd569b4ad02b3ff

SHA1
0993a55f815152888ff1469537442c77ee84233f

SHA256
5fd4e011bc2353085934b108876b141dfbc1ea3f8148d55c2faa46164488b8ac

SHA512
dd63a6526fe99047eb6df9b6c2f0832a42936a98888f15a9f881ab632cf519bffe3ad9db16ab62354d60117b1c662e4c045062d2348d4121285013139e9581b7

Download Submit
C:\Windows\System\ZmPSMkC.exe

Filesize
1.5MB

MD5
5a4a69a55cb2fee85f534459dc9ecb5e

SHA1
d02cfdfc1ef68cc5b84b56509d0ab41793725a58

SHA256
1d947387a2a557122de09c110250a5e8ea66b2358ada0290580cb667254c458d

SHA512
2de351a9ff1d21bbfa469a193c5c178f10d5e05d848d942a2b0f1549e70f9137bbc9fc11ee42a4d37f585044e8fc709ea6d3edbd9f559a3b6ed0a3559394b94d

Download Submit
C:\Windows\System\ZmbKSAG.exe

Filesize
1.5MB

MD5
d1437c6b94381efa8e336588f8d7cf7f

SHA1
63548cc2312d886c65bc2d32d01288b7eefd68fb

SHA256
0d10f2d0e655ca35032e62740edc380d41b42a5843a0bb074793b2abe27ef8ac

SHA512
c07ab0cdeb5f5a56b405b195efabb794667421ca7dcf546072c5c0292fbb1bed780d64509d223a14470ce92c29b8b43dfc6729d70d98a19bd7d7e49ccfdb0b64

Download Submit
C:\Windows\System\ayXfXwU.exe

Filesize
1.5MB

MD5
3e00494ee12873ada233e616b37e04e4

SHA1
c1be1e94581678903ceb8e16fa4ba4eb5108c33d

SHA256
7a83f526dfe8373993195234e74eb17432f98d15760226a5543194d037d97086

SHA512
6880428591593da8c819da2fb07e19fb947a533e44f0eb37af477ce8b7008a06c9a751495d84ce53408aa18a2599abe86da8247e7a0cd49721a4fc72b09c5fdc

Download Submit
C:\Windows\System\bxYpICT.exe

Filesize
1.5MB

MD5
3927e8598eea3c14ec543593aea57715

SHA1
5119d30754e8ddf87534e19aa1c574c2e6ba46e7

SHA256
722dc34ab64841bb6e699d3ba5c5694498b3e70d9d5422b7c77d8c20c22fbfa9

SHA512
d34b01500d8b34512bc8b31c6ef194a544841422d10002a4f2840c7901d95d46faa8a1ac1ff0a2938531bec59893b7e9727b56fae9f5de2553d7084e55684ec4

Download Submit
C:\Windows\System\cYLvrYL.exe

Filesize
1.5MB

MD5
97671055e4a2b70be4eb2b0894ecb05a

SHA1
7c8172cb62e767c2b76efe60dde622760a7e669c

SHA256
ee2282608cad721570e37b6b3c155f375d5f1978815eebc4d32825cc821e961c

SHA512
e80407ccc811748b67f3e8537910b9b66228e25002e4741139d19c17809e65882172cf51bcb4de9c14c9767cc537ae359652bea69738615c92d60aaa24971f90

Download Submit
C:\Windows\System\cbKzOcd.exe

Filesize
1.5MB

MD5
18f982aa1e3e1f3261d018b555ba2083

SHA1
89ed2bf857e4150404cda09a4509538ecef937b0

SHA256
5f7b3919a067ac9af6b39463a68f0bb077820342f828cd8c9ec5b299a5a5e09e

SHA512
901ddeaf6a72a4624ecd1babc6d9c69c6ba2a107fcda0cb052d01cb83ef468e08f7849b555ec591fae58972d416d98a234ff1e3af1f3f5ad8ea3127eeca710f9

Download Submit
C:\Windows\System\cgACXgW.exe

Filesize
1.5MB

MD5
9fa0073464862b504aa2feeb443e1c6d

SHA1
aa8a970d5755ddfe507998313b683d2ef979d640

SHA256
f77f0308337a302780d2aba30a8bd66507b0fbd0de5b9e3854c74ec0e904bf07

SHA512
c5bd3b603e1baeebbed21a1216c95422d3ef7ab9cfb26a41adee2fe2cdacdd235c4e8621156557d5b74b9d0839c798d4a425e05bf6a7d050f66e20f1fa3a8d8a

Download Submit
C:\Windows\System\dBZoCfd.exe

Filesize
1.5MB

MD5
16003f982cd46fb2ccc30f64268ca108

SHA1
fe829811587f46c933e5898d745670a80e13d562

SHA256
71f34d810425c71aaa841509196798e56b55fc73ec7227c521c49089ed9357b8

SHA512
a29adfe5b9b9ca0dc6a92a3b46dbcc16c0b08a0e1d4f03e9c108c2959fc2292c6755225b110b55a30c8ef964d26bf93659c03aafb523638344f34aad3c18ce25

Download Submit
C:\Windows\System\dDTvahS.exe

Filesize
1.5MB

MD5
f25eb918297e1b500b42758d226d9c00

SHA1
c62e59e3980753da51856b26a94d40baca2372d1

SHA256
4d0aecf8b2f0b737a7c2ecc3740d3f56189a3aad0bedc7c37da5a19546b280e2

SHA512
45d90ded4711a6c45d4d863f05864228eb14622d715acc3f6c75b26c51836808e4b4681fee1bc1b5b9fba3ab4932491e4e16a0f134326b02d805aaabac9d9aca

Download Submit
C:\Windows\System\iWRdfzh.exe

Filesize
1.5MB

MD5
1151f2f283639367484ba6c8b5975d6b

SHA1
3a7a9baa9feb6f5fea2684e7455fe84b7d46e2fb

SHA256
43beb84ce738a1343213d08726d0f7152a8527b16730ceff197a73b396ae6d29

SHA512
d06ee8b2ac245f18ed23795bf52d8f0a90eb9d6903aae16888f20cbf47971e640f9e92cff541cc542667a4dd282678e4fa9ce0b607df5ce0908a6fb067aface0

Download Submit
C:\Windows\System\jnakcSV.exe

Filesize
1.5MB

MD5
9278b2da34a9a7a8399e1cdcc20dcdfd

SHA1
86a81e9a17647df477d01315a02b1cf418fa7967

SHA256
091f3901332e0ddf8e1a1305b2aeee05ff4646b702e976bbf0132a09f50290aa

SHA512
2760f16541726ed750020de90247b2abede2e70e22030ff632e7d142b54d6194c2c328c0eec50299b807176c80f474a0ed47ffff340fe57661186401ea73b973

Download Submit
C:\Windows\System\nWyjgnp.exe

Filesize
1.5MB

MD5
d89d96a197ba32c3f8cba6cdb4c97478

SHA1
51a1c590f6d3de7b048768ad22667f0ec53da12d

SHA256
818591859c2aae0f29b6f3c7568043d048464a6ef34887b6dfa0834333df6fdd

SHA512
15563d63b7a9744f9bd0845106b73a227b458a54a9721624247cebff4aa7306e1b74e68f7d790cb1e32a832a2e57ee63fd175746d92a42fd6ee20e512bc5a450

Download Submit
C:\Windows\System\oTINUMx.exe

Filesize
1.5MB

MD5
a11a3c09260595cafe9496c8f0c3902c

SHA1
099fd1a227bd7f4235492328ef7d4e99ece4f929

SHA256
a52efd9676786aca8aea3bdf17b597d93d6abe2c159926af2554ddc32e209966

SHA512
f38b0694b4f7f0d075f3dda48140f995f843886e9f811c1841c96f2d90ef9142f46d2d0f70ce6dc6fa4b7ecb8ad71de985fe59ec853d70c0b37b098376bde043

Download Submit
C:\Windows\System\pFnpZMv.exe

Filesize
1.5MB

MD5
fd6871886ca5a3c71437620077857e22

SHA1
734323d6836a198d2a5d6d25aa36dd72836076e6

SHA256
b840fe5c128026c3db56381c4090c35da7b57fb03233c0b273cc47e9b6e04a24

SHA512
15804db2e7daeffa965d612a9f3c65ebf60344de9321936f720b23ab38366e715ea93b1c83904d9544065e9fffe61eeae52c1220ac42cefa39cdfefcba4531f3

Download Submit
C:\Windows\System\pgVDpcD.exe

Filesize
1.5MB

MD5
f8bcad8d9fe527530ba5bbe487e4eb1a

SHA1
606693f9ed1256a3424b349a120ef405da4ab2f3

SHA256
c554ca86a77df918f747b5ca17fab4dda980c6b4540af514a5c5553f0804af3d

SHA512
a15fd449b69bb47cbbc262498d70fb354cfa967987b3419ed762f3ded6938e912fe0c2a049830e3a4eef32123463a557758421f611fecb2f25bcaf68682208b7

Download Submit
C:\Windows\System\sRsbtQc.exe

Filesize
1.5MB

MD5
6a8ee0716540d0fada1c80405d123127

SHA1
185c3f55454b8af893d2461f211629b2f80d8944

SHA256
0be1498e0dacee09207b5af53c473e91730462b51ab6141e1be6b43bf7463ce9

SHA512
33e0eb1235faee93271eebb08a037322dcee69bd4e1bd66de52cdcbb809f0695b08aff199a1f60a3300fa418adbc214474f2de779f6f901af7e1711140472552

Download Submit
C:\Windows\System\tQJXfiA.exe

Filesize
1.5MB

MD5
61608b58596335e32278a097d89261ed

SHA1
57f8f3b61ec08038d84419861244fe0fa75157b1

SHA256
b6eaa0f73309031c8397b6af8a95a8147547e9abb46647e8f03e432eb0ab4c92

SHA512
07c56dbda4cc269cfaeb0bedbb67abe2dfae60bfddc96b455f962d8cc3c3295ec578f0eabdc9f89d9e04704af5b22b93325b61cf839a78d2da847e21c3d8734c

Download Submit
C:\Windows\System\xWVeRXb.exe

Filesize
1.5MB

MD5
7c373f5f53f93c1a0a5bce7587c3ca21

SHA1
733055b22bf97c108913bef37dce5d832ce2b2dc

SHA256
3333065443b6dcaedae6137eb69f386d48db76a4e9ef23066ff97439255692b2

SHA512
410d24a6f22ca60e8ae46bfb472700c8ee70e96a199f5ff721488d6347760aaca82fc92f4483756be97fe338741153647d2fb91d0a75ce34bc854d1b203989ab

Download Submit
C:\Windows\System\yvLWJbm.exe

Filesize
1.5MB

MD5
611dea780511f16f51d657914aea0b39

SHA1
6af2d960bc54e9fe023dadfd7395120937e35a3a

SHA256
3b95f05733d3f59cabd71ec2f824161a641a0f4fe8db8c69d953be0d335e3e0f

SHA512
b043d8d95446b0ea01c3ec680fdd4c4f283d16a6459806aed7fed730af580c0fca22523244d5949da6f8a9cd83b7b7f65461cc1dfaf45830d7ac2add3bd33089

Download Submit
memory/3064-0-0x0000026174FA0000-0x0000026174FB0000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads