xmrig | 8ff2e457508a240f2658790d6660202616ad4c7a9c4913c18c6780dd5b9fa3f9

Analysis

max time kernel
145s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
17/11/2024, 07:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8ff2e457508a240f2658790d6660202616ad4c7a9c4913c18c6780dd5b9fa3f9.exe
Size

1.4MB
MD5

8e8c2085b3042f3a64a6c87f9fe1cca2
SHA1

8863fda6c96b59c7826c0ccabf4bc00175c7a481
SHA256

8ff2e457508a240f2658790d6660202616ad4c7a9c4913c18c6780dd5b9fa3f9
SHA512

01afee543133d49aa07c08398ebe8aadb5d7d97bf462a52f9536b20a1767fa22649e0fe78c418b6df0685bedd8f3c94bb75a2aaf6d3c8c5602bdb4f544691109
SSDEEP

24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbpwlKenszbWKDNEm/5O+7MMKTbcq:GezaTF8FcNkNdfE0pZ9ozttwIRxj4c5c

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 32 IoCs

miner

resource	yara_rule
behavioral2/files/0x0010000000023ba3-3.dat	xmrig
behavioral2/files/0x0007000000023c89-8.dat	xmrig
behavioral2/files/0x0008000000023c85-9.dat	xmrig
behavioral2/files/0x0007000000023c8a-19.dat	xmrig
behavioral2/files/0x0007000000023c8b-24.dat	xmrig
behavioral2/files/0x0007000000023c8d-29.dat	xmrig
behavioral2/files/0x0007000000023c8e-34.dat	xmrig
behavioral2/files/0x0007000000023c8f-40.dat	xmrig
behavioral2/files/0x0007000000023c90-44.dat	xmrig
behavioral2/files/0x0008000000023c86-50.dat	xmrig
behavioral2/files/0x0007000000023c91-53.dat	xmrig
behavioral2/files/0x0007000000023c92-56.dat	xmrig
behavioral2/files/0x0007000000023c93-63.dat	xmrig
behavioral2/files/0x0007000000023c94-72.dat	xmrig
behavioral2/files/0x0007000000023c96-80.dat	xmrig
behavioral2/files/0x0007000000023c95-76.dat	xmrig
behavioral2/files/0x0007000000023c97-85.dat	xmrig
behavioral2/files/0x0007000000023c99-92.dat	xmrig
behavioral2/files/0x0007000000023c98-89.dat	xmrig
behavioral2/files/0x0007000000023c9b-100.dat	xmrig
behavioral2/files/0x0007000000023c9c-107.dat	xmrig
behavioral2/files/0x0007000000023c9d-106.dat	xmrig
behavioral2/files/0x0007000000023c9e-115.dat	xmrig
behavioral2/files/0x0007000000023c9f-121.dat	xmrig
behavioral2/files/0x0007000000023ca2-127.dat	xmrig
behavioral2/files/0x0007000000023ca0-132.dat	xmrig
behavioral2/files/0x0007000000023ca4-141.dat	xmrig
behavioral2/files/0x0007000000023ca3-142.dat	xmrig
behavioral2/files/0x0007000000023ca1-139.dat	xmrig
behavioral2/files/0x0007000000023ca5-149.dat	xmrig
behavioral2/files/0x000e000000023b49-154.dat	xmrig
behavioral2/files/0x000c000000023b4d-159.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
4696	UDAQVMU.exe
4844	axrWkAe.exe
4736	giKAEaI.exe
4536	jvFEiPn.exe
3372	FXMGGLZ.exe
588	VmegjiL.exe
4024	tAyKMSD.exe
964	kHxRwyh.exe
4520	PkXOVHT.exe
1916	BxwigHf.exe
220	sYVfsvo.exe
2348	vpPnTXv.exe
1564	siHNtqr.exe
4884	bkdalWy.exe
3512	wlqLZbf.exe
316	ahwwrZG.exe
3668	FsMrOZO.exe
1096	HIIJHNL.exe
3040	DdbwyvO.exe
2596	NTLqqVe.exe
4476	kCsaWmO.exe
4720	EqAuSGd.exe
4924	HSRBBTd.exe
4416	JUBXEpS.exe
3720	AHzZVMj.exe
3568	KZvqIfB.exe
2088	yVfeyNA.exe
4488	FaZNimu.exe
1164	NCaZQTl.exe
3872	tNTHZEb.exe
4464	juedElg.exe
1552	jnJQsmd.exe
4140	SDQCepY.exe
4512	AzDeZmn.exe
3348	TLWaVzz.exe
2372	qclSfqE.exe
1308	qBeXIxs.exe
1092	vYQhPJW.exe
3740	UPEFHPe.exe
3112	oXxvSOT.exe
1988	OJhNPIS.exe
1076	REjBwzW.exe
4356	kfnTUCc.exe
4216	oUqidzI.exe
2080	qkNHauD.exe
3180	AbTwUJp.exe
2884	TesyjDP.exe
4540	wHCcdIR.exe
4552	KNXknHH.exe
1676	CnthUHT.exe
4456	uEujHle.exe
4432	tvXcnBR.exe
3564	GgZXZMy.exe
3640	GLdhNie.exe
3960	RXoLaVo.exe
2532	YFDsBBL.exe
2028	zcgyHZE.exe
2140	OPcbRyl.exe
2544	ObKBOPM.exe
2172	pqMRsZW.exe
3068	DlGWtbI.exe
5032	YyKNmXu.exe
2696	tJDrCNm.exe
2352	aKqkClR.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\vFjvVQL.exe	8ff2e457508a240f2658790d6660202616ad4c7a9c4913c18c6780dd5b9fa3f9.exe
File created	C:\Windows\System\QqFZEVc.exe	8ff2e457508a240f2658790d6660202616ad4c7a9c4913c18c6780dd5b9fa3f9.exe
File created	C:\Windows\System\ZdNeoOC.exe	8ff2e457508a240f2658790d6660202616ad4c7a9c4913c18c6780dd5b9fa3f9.exe
File created	C:\Windows\System\VmegjiL.exe	8ff2e457508a240f2658790d6660202616ad4c7a9c4913c18c6780dd5b9fa3f9.exe
File created	C:\Windows\System\doeywBJ.exe	8ff2e457508a240f2658790d6660202616ad4c7a9c4913c18c6780dd5b9fa3f9.exe
File created	C:\Windows\System\uVDcVqh.exe	8ff2e457508a240f2658790d6660202616ad4c7a9c4913c18c6780dd5b9fa3f9.exe
File created	C:\Windows\System\gQuSzbx.exe	8ff2e457508a240f2658790d6660202616ad4c7a9c4913c18c6780dd5b9fa3f9.exe
File created	C:\Windows\System\MSWXMxJ.exe	8ff2e457508a240f2658790d6660202616ad4c7a9c4913c18c6780dd5b9fa3f9.exe
File created	C:\Windows\System\yQbZPhr.exe	8ff2e457508a240f2658790d6660202616ad4c7a9c4913c18c6780dd5b9fa3f9.exe
File created	C:\Windows\System\xBflSgr.exe	8ff2e457508a240f2658790d6660202616ad4c7a9c4913c18c6780dd5b9fa3f9.exe
File created	C:\Windows\System\bgNQSgI.exe	8ff2e457508a240f2658790d6660202616ad4c7a9c4913c18c6780dd5b9fa3f9.exe
File created	C:\Windows\System\lyBpzGu.exe	8ff2e457508a240f2658790d6660202616ad4c7a9c4913c18c6780dd5b9fa3f9.exe
File created	C:\Windows\System\HSRBBTd.exe	8ff2e457508a240f2658790d6660202616ad4c7a9c4913c18c6780dd5b9fa3f9.exe
File created	C:\Windows\System\yVfeyNA.exe	8ff2e457508a240f2658790d6660202616ad4c7a9c4913c18c6780dd5b9fa3f9.exe
File created	C:\Windows\System\OzoamNQ.exe	8ff2e457508a240f2658790d6660202616ad4c7a9c4913c18c6780dd5b9fa3f9.exe
File created	C:\Windows\System\PxekssI.exe	8ff2e457508a240f2658790d6660202616ad4c7a9c4913c18c6780dd5b9fa3f9.exe
File created	C:\Windows\System\yYIHtGY.exe	8ff2e457508a240f2658790d6660202616ad4c7a9c4913c18c6780dd5b9fa3f9.exe
File created	C:\Windows\System\tqgXQtF.exe	8ff2e457508a240f2658790d6660202616ad4c7a9c4913c18c6780dd5b9fa3f9.exe
File created	C:\Windows\System\RsiamBd.exe	8ff2e457508a240f2658790d6660202616ad4c7a9c4913c18c6780dd5b9fa3f9.exe
File created	C:\Windows\System\YDpXhhc.exe	8ff2e457508a240f2658790d6660202616ad4c7a9c4913c18c6780dd5b9fa3f9.exe
File created	C:\Windows\System\vMySAVQ.exe	8ff2e457508a240f2658790d6660202616ad4c7a9c4913c18c6780dd5b9fa3f9.exe
File created	C:\Windows\System\DAVWamG.exe	8ff2e457508a240f2658790d6660202616ad4c7a9c4913c18c6780dd5b9fa3f9.exe
File created	C:\Windows\System\NPafmbA.exe	8ff2e457508a240f2658790d6660202616ad4c7a9c4913c18c6780dd5b9fa3f9.exe
File created	C:\Windows\System\mxrXTkN.exe	8ff2e457508a240f2658790d6660202616ad4c7a9c4913c18c6780dd5b9fa3f9.exe
File created	C:\Windows\System\LUcSzON.exe	8ff2e457508a240f2658790d6660202616ad4c7a9c4913c18c6780dd5b9fa3f9.exe
File created	C:\Windows\System\MesZJtX.exe	8ff2e457508a240f2658790d6660202616ad4c7a9c4913c18c6780dd5b9fa3f9.exe
File created	C:\Windows\System\eCbtkhg.exe	8ff2e457508a240f2658790d6660202616ad4c7a9c4913c18c6780dd5b9fa3f9.exe
File created	C:\Windows\System\nagEgYz.exe	8ff2e457508a240f2658790d6660202616ad4c7a9c4913c18c6780dd5b9fa3f9.exe
File created	C:\Windows\System\BKlQtTM.exe	8ff2e457508a240f2658790d6660202616ad4c7a9c4913c18c6780dd5b9fa3f9.exe
File created	C:\Windows\System\DZfSpGG.exe	8ff2e457508a240f2658790d6660202616ad4c7a9c4913c18c6780dd5b9fa3f9.exe
File created	C:\Windows\System\aOqCdgV.exe	8ff2e457508a240f2658790d6660202616ad4c7a9c4913c18c6780dd5b9fa3f9.exe
File created	C:\Windows\System\jVUamfX.exe	8ff2e457508a240f2658790d6660202616ad4c7a9c4913c18c6780dd5b9fa3f9.exe
File created	C:\Windows\System\uYKvKhD.exe	8ff2e457508a240f2658790d6660202616ad4c7a9c4913c18c6780dd5b9fa3f9.exe
File created	C:\Windows\System\tbbldys.exe	8ff2e457508a240f2658790d6660202616ad4c7a9c4913c18c6780dd5b9fa3f9.exe
File created	C:\Windows\System\xbadJNl.exe	8ff2e457508a240f2658790d6660202616ad4c7a9c4913c18c6780dd5b9fa3f9.exe
File created	C:\Windows\System\wJPdTog.exe	8ff2e457508a240f2658790d6660202616ad4c7a9c4913c18c6780dd5b9fa3f9.exe
File created	C:\Windows\System\UpQEJbf.exe	8ff2e457508a240f2658790d6660202616ad4c7a9c4913c18c6780dd5b9fa3f9.exe
File created	C:\Windows\System\BPrctzz.exe	8ff2e457508a240f2658790d6660202616ad4c7a9c4913c18c6780dd5b9fa3f9.exe
File created	C:\Windows\System\POhQhol.exe	8ff2e457508a240f2658790d6660202616ad4c7a9c4913c18c6780dd5b9fa3f9.exe
File created	C:\Windows\System\pqMRsZW.exe	8ff2e457508a240f2658790d6660202616ad4c7a9c4913c18c6780dd5b9fa3f9.exe
File created	C:\Windows\System\EyEsyTW.exe	8ff2e457508a240f2658790d6660202616ad4c7a9c4913c18c6780dd5b9fa3f9.exe
File created	C:\Windows\System\VOJvHbU.exe	8ff2e457508a240f2658790d6660202616ad4c7a9c4913c18c6780dd5b9fa3f9.exe
File created	C:\Windows\System\lHeJdHj.exe	8ff2e457508a240f2658790d6660202616ad4c7a9c4913c18c6780dd5b9fa3f9.exe
File created	C:\Windows\System\vUogxBO.exe	8ff2e457508a240f2658790d6660202616ad4c7a9c4913c18c6780dd5b9fa3f9.exe
File created	C:\Windows\System\kLvMRfw.exe	8ff2e457508a240f2658790d6660202616ad4c7a9c4913c18c6780dd5b9fa3f9.exe
File created	C:\Windows\System\ajvDLsQ.exe	8ff2e457508a240f2658790d6660202616ad4c7a9c4913c18c6780dd5b9fa3f9.exe
File created	C:\Windows\System\OUHfoDf.exe	8ff2e457508a240f2658790d6660202616ad4c7a9c4913c18c6780dd5b9fa3f9.exe
File created	C:\Windows\System\CSxlFjE.exe	8ff2e457508a240f2658790d6660202616ad4c7a9c4913c18c6780dd5b9fa3f9.exe
File created	C:\Windows\System\hZbmbPC.exe	8ff2e457508a240f2658790d6660202616ad4c7a9c4913c18c6780dd5b9fa3f9.exe
File created	C:\Windows\System\LQFHfsP.exe	8ff2e457508a240f2658790d6660202616ad4c7a9c4913c18c6780dd5b9fa3f9.exe
File created	C:\Windows\System\gMUaaLK.exe	8ff2e457508a240f2658790d6660202616ad4c7a9c4913c18c6780dd5b9fa3f9.exe
File created	C:\Windows\System\qkGzoMD.exe	8ff2e457508a240f2658790d6660202616ad4c7a9c4913c18c6780dd5b9fa3f9.exe
File created	C:\Windows\System\ilPNbVt.exe	8ff2e457508a240f2658790d6660202616ad4c7a9c4913c18c6780dd5b9fa3f9.exe
File created	C:\Windows\System\DoyayJj.exe	8ff2e457508a240f2658790d6660202616ad4c7a9c4913c18c6780dd5b9fa3f9.exe
File created	C:\Windows\System\XiAlQQL.exe	8ff2e457508a240f2658790d6660202616ad4c7a9c4913c18c6780dd5b9fa3f9.exe
File created	C:\Windows\System\mFabHme.exe	8ff2e457508a240f2658790d6660202616ad4c7a9c4913c18c6780dd5b9fa3f9.exe
File created	C:\Windows\System\UPEFHPe.exe	8ff2e457508a240f2658790d6660202616ad4c7a9c4913c18c6780dd5b9fa3f9.exe
File created	C:\Windows\System\kBGVonJ.exe	8ff2e457508a240f2658790d6660202616ad4c7a9c4913c18c6780dd5b9fa3f9.exe
File created	C:\Windows\System\XvsZttR.exe	8ff2e457508a240f2658790d6660202616ad4c7a9c4913c18c6780dd5b9fa3f9.exe
File created	C:\Windows\System\sMyyqca.exe	8ff2e457508a240f2658790d6660202616ad4c7a9c4913c18c6780dd5b9fa3f9.exe
File created	C:\Windows\System\HJkEpdD.exe	8ff2e457508a240f2658790d6660202616ad4c7a9c4913c18c6780dd5b9fa3f9.exe
File created	C:\Windows\System\rHSolZA.exe	8ff2e457508a240f2658790d6660202616ad4c7a9c4913c18c6780dd5b9fa3f9.exe
File created	C:\Windows\System\BxRtwZI.exe	8ff2e457508a240f2658790d6660202616ad4c7a9c4913c18c6780dd5b9fa3f9.exe
File created	C:\Windows\System\rxKxekg.exe	8ff2e457508a240f2658790d6660202616ad4c7a9c4913c18c6780dd5b9fa3f9.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	16504	dwm.exe
Token: SeChangeNotifyPrivilege	16504	dwm.exe
Token: 33	16504	dwm.exe
Token: SeIncBasePriorityPrivilege	16504	dwm.exe
Token: SeShutdownPrivilege	16504	dwm.exe
Token: SeCreatePagefilePrivilege	16504	dwm.exe
Token: SeShutdownPrivilege	16504	dwm.exe
Token: SeCreatePagefilePrivilege	16504	dwm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4888 wrote to memory of 4696	4888	8ff2e457508a240f2658790d6660202616ad4c7a9c4913c18c6780dd5b9fa3f9.exe	84
PID 4888 wrote to memory of 4696	4888	8ff2e457508a240f2658790d6660202616ad4c7a9c4913c18c6780dd5b9fa3f9.exe	84
PID 4888 wrote to memory of 4844	4888	8ff2e457508a240f2658790d6660202616ad4c7a9c4913c18c6780dd5b9fa3f9.exe	85
PID 4888 wrote to memory of 4844	4888	8ff2e457508a240f2658790d6660202616ad4c7a9c4913c18c6780dd5b9fa3f9.exe	85
PID 4888 wrote to memory of 4736	4888	8ff2e457508a240f2658790d6660202616ad4c7a9c4913c18c6780dd5b9fa3f9.exe	86
PID 4888 wrote to memory of 4736	4888	8ff2e457508a240f2658790d6660202616ad4c7a9c4913c18c6780dd5b9fa3f9.exe	86
PID 4888 wrote to memory of 4536	4888	8ff2e457508a240f2658790d6660202616ad4c7a9c4913c18c6780dd5b9fa3f9.exe	87
PID 4888 wrote to memory of 4536	4888	8ff2e457508a240f2658790d6660202616ad4c7a9c4913c18c6780dd5b9fa3f9.exe	87
PID 4888 wrote to memory of 3372	4888	8ff2e457508a240f2658790d6660202616ad4c7a9c4913c18c6780dd5b9fa3f9.exe	88
PID 4888 wrote to memory of 3372	4888	8ff2e457508a240f2658790d6660202616ad4c7a9c4913c18c6780dd5b9fa3f9.exe	88
PID 4888 wrote to memory of 588	4888	8ff2e457508a240f2658790d6660202616ad4c7a9c4913c18c6780dd5b9fa3f9.exe	89
PID 4888 wrote to memory of 588	4888	8ff2e457508a240f2658790d6660202616ad4c7a9c4913c18c6780dd5b9fa3f9.exe	89
PID 4888 wrote to memory of 4024	4888	8ff2e457508a240f2658790d6660202616ad4c7a9c4913c18c6780dd5b9fa3f9.exe	90
PID 4888 wrote to memory of 4024	4888	8ff2e457508a240f2658790d6660202616ad4c7a9c4913c18c6780dd5b9fa3f9.exe	90
PID 4888 wrote to memory of 964	4888	8ff2e457508a240f2658790d6660202616ad4c7a9c4913c18c6780dd5b9fa3f9.exe	92
PID 4888 wrote to memory of 964	4888	8ff2e457508a240f2658790d6660202616ad4c7a9c4913c18c6780dd5b9fa3f9.exe	92
PID 4888 wrote to memory of 4520	4888	8ff2e457508a240f2658790d6660202616ad4c7a9c4913c18c6780dd5b9fa3f9.exe	93
PID 4888 wrote to memory of 4520	4888	8ff2e457508a240f2658790d6660202616ad4c7a9c4913c18c6780dd5b9fa3f9.exe	93
PID 4888 wrote to memory of 1916	4888	8ff2e457508a240f2658790d6660202616ad4c7a9c4913c18c6780dd5b9fa3f9.exe	95
PID 4888 wrote to memory of 1916	4888	8ff2e457508a240f2658790d6660202616ad4c7a9c4913c18c6780dd5b9fa3f9.exe	95
PID 4888 wrote to memory of 220	4888	8ff2e457508a240f2658790d6660202616ad4c7a9c4913c18c6780dd5b9fa3f9.exe	96
PID 4888 wrote to memory of 220	4888	8ff2e457508a240f2658790d6660202616ad4c7a9c4913c18c6780dd5b9fa3f9.exe	96
PID 4888 wrote to memory of 2348	4888	8ff2e457508a240f2658790d6660202616ad4c7a9c4913c18c6780dd5b9fa3f9.exe	97
PID 4888 wrote to memory of 2348	4888	8ff2e457508a240f2658790d6660202616ad4c7a9c4913c18c6780dd5b9fa3f9.exe	97
PID 4888 wrote to memory of 1564	4888	8ff2e457508a240f2658790d6660202616ad4c7a9c4913c18c6780dd5b9fa3f9.exe	98
PID 4888 wrote to memory of 1564	4888	8ff2e457508a240f2658790d6660202616ad4c7a9c4913c18c6780dd5b9fa3f9.exe	98
PID 4888 wrote to memory of 4884	4888	8ff2e457508a240f2658790d6660202616ad4c7a9c4913c18c6780dd5b9fa3f9.exe	99
PID 4888 wrote to memory of 4884	4888	8ff2e457508a240f2658790d6660202616ad4c7a9c4913c18c6780dd5b9fa3f9.exe	99
PID 4888 wrote to memory of 3512	4888	8ff2e457508a240f2658790d6660202616ad4c7a9c4913c18c6780dd5b9fa3f9.exe	100
PID 4888 wrote to memory of 3512	4888	8ff2e457508a240f2658790d6660202616ad4c7a9c4913c18c6780dd5b9fa3f9.exe	100
PID 4888 wrote to memory of 316	4888	8ff2e457508a240f2658790d6660202616ad4c7a9c4913c18c6780dd5b9fa3f9.exe	101
PID 4888 wrote to memory of 316	4888	8ff2e457508a240f2658790d6660202616ad4c7a9c4913c18c6780dd5b9fa3f9.exe	101
PID 4888 wrote to memory of 3668	4888	8ff2e457508a240f2658790d6660202616ad4c7a9c4913c18c6780dd5b9fa3f9.exe	102
PID 4888 wrote to memory of 3668	4888	8ff2e457508a240f2658790d6660202616ad4c7a9c4913c18c6780dd5b9fa3f9.exe	102
PID 4888 wrote to memory of 1096	4888	8ff2e457508a240f2658790d6660202616ad4c7a9c4913c18c6780dd5b9fa3f9.exe	103
PID 4888 wrote to memory of 1096	4888	8ff2e457508a240f2658790d6660202616ad4c7a9c4913c18c6780dd5b9fa3f9.exe	103
PID 4888 wrote to memory of 3040	4888	8ff2e457508a240f2658790d6660202616ad4c7a9c4913c18c6780dd5b9fa3f9.exe	104
PID 4888 wrote to memory of 3040	4888	8ff2e457508a240f2658790d6660202616ad4c7a9c4913c18c6780dd5b9fa3f9.exe	104
PID 4888 wrote to memory of 2596	4888	8ff2e457508a240f2658790d6660202616ad4c7a9c4913c18c6780dd5b9fa3f9.exe	105
PID 4888 wrote to memory of 2596	4888	8ff2e457508a240f2658790d6660202616ad4c7a9c4913c18c6780dd5b9fa3f9.exe	105
PID 4888 wrote to memory of 4720	4888	8ff2e457508a240f2658790d6660202616ad4c7a9c4913c18c6780dd5b9fa3f9.exe	106
PID 4888 wrote to memory of 4720	4888	8ff2e457508a240f2658790d6660202616ad4c7a9c4913c18c6780dd5b9fa3f9.exe	106
PID 4888 wrote to memory of 4476	4888	8ff2e457508a240f2658790d6660202616ad4c7a9c4913c18c6780dd5b9fa3f9.exe	108
PID 4888 wrote to memory of 4476	4888	8ff2e457508a240f2658790d6660202616ad4c7a9c4913c18c6780dd5b9fa3f9.exe	108
PID 4888 wrote to memory of 4924	4888	8ff2e457508a240f2658790d6660202616ad4c7a9c4913c18c6780dd5b9fa3f9.exe	109
PID 4888 wrote to memory of 4924	4888	8ff2e457508a240f2658790d6660202616ad4c7a9c4913c18c6780dd5b9fa3f9.exe	109
PID 4888 wrote to memory of 4416	4888	8ff2e457508a240f2658790d6660202616ad4c7a9c4913c18c6780dd5b9fa3f9.exe	110
PID 4888 wrote to memory of 4416	4888	8ff2e457508a240f2658790d6660202616ad4c7a9c4913c18c6780dd5b9fa3f9.exe	110
PID 4888 wrote to memory of 3720	4888	8ff2e457508a240f2658790d6660202616ad4c7a9c4913c18c6780dd5b9fa3f9.exe	111
PID 4888 wrote to memory of 3720	4888	8ff2e457508a240f2658790d6660202616ad4c7a9c4913c18c6780dd5b9fa3f9.exe	111
PID 4888 wrote to memory of 3568	4888	8ff2e457508a240f2658790d6660202616ad4c7a9c4913c18c6780dd5b9fa3f9.exe	112
PID 4888 wrote to memory of 3568	4888	8ff2e457508a240f2658790d6660202616ad4c7a9c4913c18c6780dd5b9fa3f9.exe	112
PID 4888 wrote to memory of 2088	4888	8ff2e457508a240f2658790d6660202616ad4c7a9c4913c18c6780dd5b9fa3f9.exe	113
PID 4888 wrote to memory of 2088	4888	8ff2e457508a240f2658790d6660202616ad4c7a9c4913c18c6780dd5b9fa3f9.exe	113
PID 4888 wrote to memory of 4488	4888	8ff2e457508a240f2658790d6660202616ad4c7a9c4913c18c6780dd5b9fa3f9.exe	114
PID 4888 wrote to memory of 4488	4888	8ff2e457508a240f2658790d6660202616ad4c7a9c4913c18c6780dd5b9fa3f9.exe	114
PID 4888 wrote to memory of 1164	4888	8ff2e457508a240f2658790d6660202616ad4c7a9c4913c18c6780dd5b9fa3f9.exe	115
PID 4888 wrote to memory of 1164	4888	8ff2e457508a240f2658790d6660202616ad4c7a9c4913c18c6780dd5b9fa3f9.exe	115
PID 4888 wrote to memory of 3872	4888	8ff2e457508a240f2658790d6660202616ad4c7a9c4913c18c6780dd5b9fa3f9.exe	116
PID 4888 wrote to memory of 3872	4888	8ff2e457508a240f2658790d6660202616ad4c7a9c4913c18c6780dd5b9fa3f9.exe	116
PID 4888 wrote to memory of 4464	4888	8ff2e457508a240f2658790d6660202616ad4c7a9c4913c18c6780dd5b9fa3f9.exe	117
PID 4888 wrote to memory of 4464	4888	8ff2e457508a240f2658790d6660202616ad4c7a9c4913c18c6780dd5b9fa3f9.exe	117
PID 4888 wrote to memory of 1552	4888	8ff2e457508a240f2658790d6660202616ad4c7a9c4913c18c6780dd5b9fa3f9.exe	118
PID 4888 wrote to memory of 1552	4888	8ff2e457508a240f2658790d6660202616ad4c7a9c4913c18c6780dd5b9fa3f9.exe	118

C:\Users\Admin\AppData\Local\Temp\8ff2e457508a240f2658790d6660202616ad4c7a9c4913c18c6780dd5b9fa3f9.exe
"C:\Users\Admin\AppData\Local\Temp\8ff2e457508a240f2658790d6660202616ad4c7a9c4913c18c6780dd5b9fa3f9.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4888
- C:\Windows\System\UDAQVMU.exe
  C:\Windows\System\UDAQVMU.exe
  2⤵
  - Executes dropped EXE
  PID:4696
- C:\Windows\System\axrWkAe.exe
  C:\Windows\System\axrWkAe.exe
  2⤵
  - Executes dropped EXE
  PID:4844
- C:\Windows\System\giKAEaI.exe
  C:\Windows\System\giKAEaI.exe
  2⤵
  - Executes dropped EXE
  PID:4736
- C:\Windows\System\jvFEiPn.exe
  C:\Windows\System\jvFEiPn.exe
  2⤵
  - Executes dropped EXE
  PID:4536
- C:\Windows\System\FXMGGLZ.exe
  C:\Windows\System\FXMGGLZ.exe
  2⤵
  - Executes dropped EXE
  PID:3372
- C:\Windows\System\VmegjiL.exe
  C:\Windows\System\VmegjiL.exe
  2⤵
  - Executes dropped EXE
  PID:588
- C:\Windows\System\tAyKMSD.exe
  C:\Windows\System\tAyKMSD.exe
  2⤵
  - Executes dropped EXE
  PID:4024
- C:\Windows\System\kHxRwyh.exe
  C:\Windows\System\kHxRwyh.exe
  2⤵
  - Executes dropped EXE
  PID:964
- C:\Windows\System\PkXOVHT.exe
  C:\Windows\System\PkXOVHT.exe
  2⤵
  - Executes dropped EXE
  PID:4520
- C:\Windows\System\BxwigHf.exe
  C:\Windows\System\BxwigHf.exe
  2⤵
  - Executes dropped EXE
  PID:1916
- C:\Windows\System\sYVfsvo.exe
  C:\Windows\System\sYVfsvo.exe
  2⤵
  - Executes dropped EXE
  PID:220
- C:\Windows\System\vpPnTXv.exe
  C:\Windows\System\vpPnTXv.exe
  2⤵
  - Executes dropped EXE
  PID:2348
- C:\Windows\System\siHNtqr.exe
  C:\Windows\System\siHNtqr.exe
  2⤵
  - Executes dropped EXE
  PID:1564
- C:\Windows\System\bkdalWy.exe
  C:\Windows\System\bkdalWy.exe
  2⤵
  - Executes dropped EXE
  PID:4884
- C:\Windows\System\wlqLZbf.exe
  C:\Windows\System\wlqLZbf.exe
  2⤵
  - Executes dropped EXE
  PID:3512
- C:\Windows\System\ahwwrZG.exe
  C:\Windows\System\ahwwrZG.exe
  2⤵
  - Executes dropped EXE
  PID:316
- C:\Windows\System\FsMrOZO.exe
  C:\Windows\System\FsMrOZO.exe
  2⤵
  - Executes dropped EXE
  PID:3668
- C:\Windows\System\HIIJHNL.exe
  C:\Windows\System\HIIJHNL.exe
  2⤵
  - Executes dropped EXE
  PID:1096
- C:\Windows\System\DdbwyvO.exe
  C:\Windows\System\DdbwyvO.exe
  2⤵
  - Executes dropped EXE
  PID:3040
- C:\Windows\System\NTLqqVe.exe
  C:\Windows\System\NTLqqVe.exe
  2⤵
  - Executes dropped EXE
  PID:2596
- C:\Windows\System\EqAuSGd.exe
  C:\Windows\System\EqAuSGd.exe
  2⤵
  - Executes dropped EXE
  PID:4720
- C:\Windows\System\kCsaWmO.exe
  C:\Windows\System\kCsaWmO.exe
  2⤵
  - Executes dropped EXE
  PID:4476
- C:\Windows\System\HSRBBTd.exe
  C:\Windows\System\HSRBBTd.exe
  2⤵
  - Executes dropped EXE
  PID:4924
- C:\Windows\System\JUBXEpS.exe
  C:\Windows\System\JUBXEpS.exe
  2⤵
  - Executes dropped EXE
  PID:4416
- C:\Windows\System\AHzZVMj.exe
  C:\Windows\System\AHzZVMj.exe
  2⤵
  - Executes dropped EXE
  PID:3720
- C:\Windows\System\KZvqIfB.exe
  C:\Windows\System\KZvqIfB.exe
  2⤵
  - Executes dropped EXE
  PID:3568
- C:\Windows\System\yVfeyNA.exe
  C:\Windows\System\yVfeyNA.exe
  2⤵
  - Executes dropped EXE
  PID:2088
- C:\Windows\System\FaZNimu.exe
  C:\Windows\System\FaZNimu.exe
  2⤵
  - Executes dropped EXE
  PID:4488
- C:\Windows\System\NCaZQTl.exe
  C:\Windows\System\NCaZQTl.exe
  2⤵
  - Executes dropped EXE
  PID:1164
- C:\Windows\System\tNTHZEb.exe
  C:\Windows\System\tNTHZEb.exe
  2⤵
  - Executes dropped EXE
  PID:3872
- C:\Windows\System\juedElg.exe
  C:\Windows\System\juedElg.exe
  2⤵
  - Executes dropped EXE
  PID:4464
- C:\Windows\System\jnJQsmd.exe
  C:\Windows\System\jnJQsmd.exe
  2⤵
  - Executes dropped EXE
  PID:1552
- C:\Windows\System\SDQCepY.exe
  C:\Windows\System\SDQCepY.exe
  2⤵
  - Executes dropped EXE
  PID:4140
- C:\Windows\System\AzDeZmn.exe
  C:\Windows\System\AzDeZmn.exe
  2⤵
  - Executes dropped EXE
  PID:4512
- C:\Windows\System\TLWaVzz.exe
  C:\Windows\System\TLWaVzz.exe
  2⤵
  - Executes dropped EXE
  PID:3348
- C:\Windows\System\qclSfqE.exe
  C:\Windows\System\qclSfqE.exe
  2⤵
  - Executes dropped EXE
  PID:2372
- C:\Windows\System\qBeXIxs.exe
  C:\Windows\System\qBeXIxs.exe
  2⤵
  - Executes dropped EXE
  PID:1308
- C:\Windows\System\vYQhPJW.exe
  C:\Windows\System\vYQhPJW.exe
  2⤵
  - Executes dropped EXE
  PID:1092
- C:\Windows\System\UPEFHPe.exe
  C:\Windows\System\UPEFHPe.exe
  2⤵
  - Executes dropped EXE
  PID:3740
- C:\Windows\System\oXxvSOT.exe
  C:\Windows\System\oXxvSOT.exe
  2⤵
  - Executes dropped EXE
  PID:3112
- C:\Windows\System\OJhNPIS.exe
  C:\Windows\System\OJhNPIS.exe
  2⤵
  - Executes dropped EXE
  PID:1988
- C:\Windows\System\REjBwzW.exe
  C:\Windows\System\REjBwzW.exe
  2⤵
  - Executes dropped EXE
  PID:1076
- C:\Windows\System\kfnTUCc.exe
  C:\Windows\System\kfnTUCc.exe
  2⤵
  - Executes dropped EXE
  PID:4356
- C:\Windows\System\oUqidzI.exe
  C:\Windows\System\oUqidzI.exe
  2⤵
  - Executes dropped EXE
  PID:4216
- C:\Windows\System\qkNHauD.exe
  C:\Windows\System\qkNHauD.exe
  2⤵
  - Executes dropped EXE
  PID:2080
- C:\Windows\System\AbTwUJp.exe
  C:\Windows\System\AbTwUJp.exe
  2⤵
  - Executes dropped EXE
  PID:3180
- C:\Windows\System\TesyjDP.exe
  C:\Windows\System\TesyjDP.exe
  2⤵
  - Executes dropped EXE
  PID:2884
- C:\Windows\System\wHCcdIR.exe
  C:\Windows\System\wHCcdIR.exe
  2⤵
  - Executes dropped EXE
  PID:4540
- C:\Windows\System\KNXknHH.exe
  C:\Windows\System\KNXknHH.exe
  2⤵
  - Executes dropped EXE
  PID:4552
- C:\Windows\System\CnthUHT.exe
  C:\Windows\System\CnthUHT.exe
  2⤵
  - Executes dropped EXE
  PID:1676
- C:\Windows\System\uEujHle.exe
  C:\Windows\System\uEujHle.exe
  2⤵
  - Executes dropped EXE
  PID:4456
- C:\Windows\System\tvXcnBR.exe
  C:\Windows\System\tvXcnBR.exe
  2⤵
  - Executes dropped EXE
  PID:4432
- C:\Windows\System\GgZXZMy.exe
  C:\Windows\System\GgZXZMy.exe
  2⤵
  - Executes dropped EXE
  PID:3564
- C:\Windows\System\GLdhNie.exe
  C:\Windows\System\GLdhNie.exe
  2⤵
  - Executes dropped EXE
  PID:3640
- C:\Windows\System\RXoLaVo.exe
  C:\Windows\System\RXoLaVo.exe
  2⤵
  - Executes dropped EXE
  PID:3960
- C:\Windows\System\YFDsBBL.exe
  C:\Windows\System\YFDsBBL.exe
  2⤵
  - Executes dropped EXE
  PID:2532
- C:\Windows\System\zcgyHZE.exe
  C:\Windows\System\zcgyHZE.exe
  2⤵
  - Executes dropped EXE
  PID:2028
- C:\Windows\System\OPcbRyl.exe
  C:\Windows\System\OPcbRyl.exe
  2⤵
  - Executes dropped EXE
  PID:2140
- C:\Windows\System\ObKBOPM.exe
  C:\Windows\System\ObKBOPM.exe
  2⤵
  - Executes dropped EXE
  PID:2544
- C:\Windows\System\pqMRsZW.exe
  C:\Windows\System\pqMRsZW.exe
  2⤵
  - Executes dropped EXE
  PID:2172
- C:\Windows\System\DlGWtbI.exe
  C:\Windows\System\DlGWtbI.exe
  2⤵
  - Executes dropped EXE
  PID:3068
- C:\Windows\System\YyKNmXu.exe
  C:\Windows\System\YyKNmXu.exe
  2⤵
  - Executes dropped EXE
  PID:5032
- C:\Windows\System\tJDrCNm.exe
  C:\Windows\System\tJDrCNm.exe
  2⤵
  - Executes dropped EXE
  PID:2696
- C:\Windows\System\aKqkClR.exe
  C:\Windows\System\aKqkClR.exe
  2⤵
  - Executes dropped EXE
  PID:2352
- C:\Windows\System\bjXGLpr.exe
  C:\Windows\System\bjXGLpr.exe
  2⤵
  PID:2164
- C:\Windows\System\zcbPjxt.exe
  C:\Windows\System\zcbPjxt.exe
  2⤵
  PID:4248
- C:\Windows\System\ODjBqxL.exe
  C:\Windows\System\ODjBqxL.exe
  2⤵
  PID:4344
- C:\Windows\System\mKAfwfI.exe
  C:\Windows\System\mKAfwfI.exe
  2⤵
  PID:2404
- C:\Windows\System\etGYuUj.exe
  C:\Windows\System\etGYuUj.exe
  2⤵
  PID:2156
- C:\Windows\System\xHCIfyJ.exe
  C:\Windows\System\xHCIfyJ.exe
  2⤵
  PID:872
- C:\Windows\System\nwcpdSA.exe
  C:\Windows\System\nwcpdSA.exe
  2⤵
  PID:1892
- C:\Windows\System\SomIetL.exe
  C:\Windows\System\SomIetL.exe
  2⤵
  PID:4040
- C:\Windows\System\lanBDlt.exe
  C:\Windows\System\lanBDlt.exe
  2⤵
  PID:4516
- C:\Windows\System\OeDWbdD.exe
  C:\Windows\System\OeDWbdD.exe
  2⤵
  PID:3480
- C:\Windows\System\HrvzHtn.exe
  C:\Windows\System\HrvzHtn.exe
  2⤵
  PID:5096
- C:\Windows\System\HusGuQE.exe
  C:\Windows\System\HusGuQE.exe
  2⤵
  PID:3528
- C:\Windows\System\FQAFVDz.exe
  C:\Windows\System\FQAFVDz.exe
  2⤵
  PID:3652
- C:\Windows\System\Gvdusnt.exe
  C:\Windows\System\Gvdusnt.exe
  2⤵
  PID:4940
- C:\Windows\System\khfBsqB.exe
  C:\Windows\System\khfBsqB.exe
  2⤵
  PID:1624
- C:\Windows\System\HBMHgmo.exe
  C:\Windows\System\HBMHgmo.exe
  2⤵
  PID:4436
- C:\Windows\System\sBksWFK.exe
  C:\Windows\System\sBksWFK.exe
  2⤵
  PID:4784
- C:\Windows\System\azowsIf.exe
  C:\Windows\System\azowsIf.exe
  2⤵
  PID:2332
- C:\Windows\System\EsiqwWw.exe
  C:\Windows\System\EsiqwWw.exe
  2⤵
  PID:3636
- C:\Windows\System\eOhCifq.exe
  C:\Windows\System\eOhCifq.exe
  2⤵
  PID:2656
- C:\Windows\System\yGWVuRQ.exe
  C:\Windows\System\yGWVuRQ.exe
  2⤵
  PID:4112
- C:\Windows\System\OREgPiI.exe
  C:\Windows\System\OREgPiI.exe
  2⤵
  PID:3964
- C:\Windows\System\UpQEJbf.exe
  C:\Windows\System\UpQEJbf.exe
  2⤵
  PID:2908
- C:\Windows\System\oxAzrCB.exe
  C:\Windows\System\oxAzrCB.exe
  2⤵
  PID:5100
- C:\Windows\System\csMtJrc.exe
  C:\Windows\System\csMtJrc.exe
  2⤵
  PID:1412
- C:\Windows\System\pnTQjUX.exe
  C:\Windows\System\pnTQjUX.exe
  2⤵
  PID:4020
- C:\Windows\System\kBGVonJ.exe
  C:\Windows\System\kBGVonJ.exe
  2⤵
  PID:4128
- C:\Windows\System\SiDtjMi.exe
  C:\Windows\System\SiDtjMi.exe
  2⤵
  PID:1812
- C:\Windows\System\gMUaaLK.exe
  C:\Windows\System\gMUaaLK.exe
  2⤵
  PID:3728
- C:\Windows\System\yCYbqZo.exe
  C:\Windows\System\yCYbqZo.exe
  2⤵
  PID:4500
- C:\Windows\System\scrvdcP.exe
  C:\Windows\System\scrvdcP.exe
  2⤵
  PID:3360
- C:\Windows\System\ceJTBQE.exe
  C:\Windows\System\ceJTBQE.exe
  2⤵
  PID:2740
- C:\Windows\System\cfmoZoT.exe
  C:\Windows\System\cfmoZoT.exe
  2⤵
  PID:64
- C:\Windows\System\WIetytP.exe
  C:\Windows\System\WIetytP.exe
  2⤵
  PID:1288
- C:\Windows\System\iDfFJAb.exe
  C:\Windows\System\iDfFJAb.exe
  2⤵
  PID:1572
- C:\Windows\System\BIaOpzU.exe
  C:\Windows\System\BIaOpzU.exe
  2⤵
  PID:5144
- C:\Windows\System\myNtHMh.exe
  C:\Windows\System\myNtHMh.exe
  2⤵
  PID:5180
- C:\Windows\System\gXLZPDT.exe
  C:\Windows\System\gXLZPDT.exe
  2⤵
  PID:5200
- C:\Windows\System\NhqrXmw.exe
  C:\Windows\System\NhqrXmw.exe
  2⤵
  PID:5224
- C:\Windows\System\yGysNrt.exe
  C:\Windows\System\yGysNrt.exe
  2⤵
  PID:5256
- C:\Windows\System\upGzIKC.exe
  C:\Windows\System\upGzIKC.exe
  2⤵
  PID:5280
- C:\Windows\System\xkbkDVt.exe
  C:\Windows\System\xkbkDVt.exe
  2⤵
  PID:5308
- C:\Windows\System\SaGLTBZ.exe
  C:\Windows\System\SaGLTBZ.exe
  2⤵
  PID:5336
- C:\Windows\System\VYAJGXr.exe
  C:\Windows\System\VYAJGXr.exe
  2⤵
  PID:5368
- C:\Windows\System\EbGgANU.exe
  C:\Windows\System\EbGgANU.exe
  2⤵
  PID:5388
- C:\Windows\System\sZDThtG.exe
  C:\Windows\System\sZDThtG.exe
  2⤵
  PID:5420
- C:\Windows\System\XTXNjDc.exe
  C:\Windows\System\XTXNjDc.exe
  2⤵
  PID:5452
- C:\Windows\System\AjPPZhW.exe
  C:\Windows\System\AjPPZhW.exe
  2⤵
  PID:5484
- C:\Windows\System\ZLNSbxH.exe
  C:\Windows\System\ZLNSbxH.exe
  2⤵
  PID:5516
- C:\Windows\System\VQoGvRw.exe
  C:\Windows\System\VQoGvRw.exe
  2⤵
  PID:5540
- C:\Windows\System\ZNBTzyR.exe
  C:\Windows\System\ZNBTzyR.exe
  2⤵
  PID:5560
- C:\Windows\System\eCbtkhg.exe
  C:\Windows\System\eCbtkhg.exe
  2⤵
  PID:5576
- C:\Windows\System\PUEqFvy.exe
  C:\Windows\System\PUEqFvy.exe
  2⤵
  PID:5620
- C:\Windows\System\Pucgnzn.exe
  C:\Windows\System\Pucgnzn.exe
  2⤵
  PID:5640
- C:\Windows\System\LULBNtn.exe
  C:\Windows\System\LULBNtn.exe
  2⤵
  PID:5660
- C:\Windows\System\QQAPeVP.exe
  C:\Windows\System\QQAPeVP.exe
  2⤵
  PID:5688
- C:\Windows\System\trKxGYO.exe
  C:\Windows\System\trKxGYO.exe
  2⤵
  PID:5728
- C:\Windows\System\gQuSzbx.exe
  C:\Windows\System\gQuSzbx.exe
  2⤵
  PID:5752
- C:\Windows\System\TWbMwGX.exe
  C:\Windows\System\TWbMwGX.exe
  2⤵
  PID:5788
- C:\Windows\System\AsDtzvq.exe
  C:\Windows\System\AsDtzvq.exe
  2⤵
  PID:5820
- C:\Windows\System\XvsZttR.exe
  C:\Windows\System\XvsZttR.exe
  2⤵
  PID:5848
- C:\Windows\System\aCUYhAp.exe
  C:\Windows\System\aCUYhAp.exe
  2⤵
  PID:5888
- C:\Windows\System\WHeaUhb.exe
  C:\Windows\System\WHeaUhb.exe
  2⤵
  PID:5908
- C:\Windows\System\ORXHUYK.exe
  C:\Windows\System\ORXHUYK.exe
  2⤵
  PID:5932
- C:\Windows\System\mYYtjtK.exe
  C:\Windows\System\mYYtjtK.exe
  2⤵
  PID:5964
- C:\Windows\System\qPlAanR.exe
  C:\Windows\System\qPlAanR.exe
  2⤵
  PID:5992
- C:\Windows\System\qkGzoMD.exe
  C:\Windows\System\qkGzoMD.exe
  2⤵
  PID:6020
- C:\Windows\System\QjgDSOs.exe
  C:\Windows\System\QjgDSOs.exe
  2⤵
  PID:6048
- C:\Windows\System\hdvXFzd.exe
  C:\Windows\System\hdvXFzd.exe
  2⤵
  PID:6064
- C:\Windows\System\CSjRUJh.exe
  C:\Windows\System\CSjRUJh.exe
  2⤵
  PID:6104
- C:\Windows\System\SGWGpUj.exe
  C:\Windows\System\SGWGpUj.exe
  2⤵
  PID:6132
- C:\Windows\System\mxrXTkN.exe
  C:\Windows\System\mxrXTkN.exe
  2⤵
  PID:5164
- C:\Windows\System\jVUamfX.exe
  C:\Windows\System\jVUamfX.exe
  2⤵
  PID:5236
- C:\Windows\System\JysJWHY.exe
  C:\Windows\System\JysJWHY.exe
  2⤵
  PID:5296
- C:\Windows\System\UKzDixC.exe
  C:\Windows\System\UKzDixC.exe
  2⤵
  PID:5324
- C:\Windows\System\SJOwRBF.exe
  C:\Windows\System\SJOwRBF.exe
  2⤵
  PID:5396
- C:\Windows\System\QwUlcxw.exe
  C:\Windows\System\QwUlcxw.exe
  2⤵
  PID:5464
- C:\Windows\System\kAKMYzA.exe
  C:\Windows\System\kAKMYzA.exe
  2⤵
  PID:5532
- C:\Windows\System\UrkypwN.exe
  C:\Windows\System\UrkypwN.exe
  2⤵
  PID:5596
- C:\Windows\System\KRjKVkQ.exe
  C:\Windows\System\KRjKVkQ.exe
  2⤵
  PID:5676
- C:\Windows\System\IfkjnlJ.exe
  C:\Windows\System\IfkjnlJ.exe
  2⤵
  PID:5744
- C:\Windows\System\vFjvVQL.exe
  C:\Windows\System\vFjvVQL.exe
  2⤵
  PID:5808
- C:\Windows\System\YDpXhhc.exe
  C:\Windows\System\YDpXhhc.exe
  2⤵
  PID:5884
- C:\Windows\System\YqiZhUA.exe
  C:\Windows\System\YqiZhUA.exe
  2⤵
  PID:5948
- C:\Windows\System\tZapSdC.exe
  C:\Windows\System\tZapSdC.exe
  2⤵
  PID:5976
- C:\Windows\System\fChZqFt.exe
  C:\Windows\System\fChZqFt.exe
  2⤵
  PID:6044
- C:\Windows\System\EAHSmuA.exe
  C:\Windows\System\EAHSmuA.exe
  2⤵
  PID:5128
- C:\Windows\System\lNRUuod.exe
  C:\Windows\System\lNRUuod.exe
  2⤵
  PID:5216
- C:\Windows\System\gJXafin.exe
  C:\Windows\System\gJXafin.exe
  2⤵
  PID:5500
- C:\Windows\System\WLinwmu.exe
  C:\Windows\System\WLinwmu.exe
  2⤵
  PID:5528
- C:\Windows\System\DHgwOmW.exe
  C:\Windows\System\DHgwOmW.exe
  2⤵
  PID:5632
- C:\Windows\System\rHSolZA.exe
  C:\Windows\System\rHSolZA.exe
  2⤵
  PID:5860
- C:\Windows\System\AoVIffb.exe
  C:\Windows\System\AoVIffb.exe
  2⤵
  PID:5960
- C:\Windows\System\GJKegec.exe
  C:\Windows\System\GJKegec.exe
  2⤵
  PID:5264
- C:\Windows\System\ozwXHaQ.exe
  C:\Windows\System\ozwXHaQ.exe
  2⤵
  PID:5704
- C:\Windows\System\zRXYfvj.exe
  C:\Windows\System\zRXYfvj.exe
  2⤵
  PID:5924
- C:\Windows\System\fgVJWlA.exe
  C:\Windows\System\fgVJWlA.exe
  2⤵
  PID:5320
- C:\Windows\System\CcswTKb.exe
  C:\Windows\System\CcswTKb.exe
  2⤵
  PID:5984
- C:\Windows\System\nJdBUGo.exe
  C:\Windows\System\nJdBUGo.exe
  2⤵
  PID:6164
- C:\Windows\System\nagEgYz.exe
  C:\Windows\System\nagEgYz.exe
  2⤵
  PID:6192
- C:\Windows\System\jCXIyrW.exe
  C:\Windows\System\jCXIyrW.exe
  2⤵
  PID:6216
- C:\Windows\System\UqqbxPP.exe
  C:\Windows\System\UqqbxPP.exe
  2⤵
  PID:6236
- C:\Windows\System\RxdfqkJ.exe
  C:\Windows\System\RxdfqkJ.exe
  2⤵
  PID:6268
- C:\Windows\System\DgBRItI.exe
  C:\Windows\System\DgBRItI.exe
  2⤵
  PID:6304
- C:\Windows\System\xLDneUA.exe
  C:\Windows\System\xLDneUA.exe
  2⤵
  PID:6320
- C:\Windows\System\yMaUWEQ.exe
  C:\Windows\System\yMaUWEQ.exe
  2⤵
  PID:6364
- C:\Windows\System\xHLvdRm.exe
  C:\Windows\System\xHLvdRm.exe
  2⤵
  PID:6396
- C:\Windows\System\iRqmAbV.exe
  C:\Windows\System\iRqmAbV.exe
  2⤵
  PID:6416
- C:\Windows\System\TdWuBOM.exe
  C:\Windows\System\TdWuBOM.exe
  2⤵
  PID:6444
- C:\Windows\System\JMoUkYW.exe
  C:\Windows\System\JMoUkYW.exe
  2⤵
  PID:6476
- C:\Windows\System\mBibRDw.exe
  C:\Windows\System\mBibRDw.exe
  2⤵
  PID:6504
- C:\Windows\System\ZqkGeIf.exe
  C:\Windows\System\ZqkGeIf.exe
  2⤵
  PID:6528
- C:\Windows\System\lpAOKeN.exe
  C:\Windows\System\lpAOKeN.exe
  2⤵
  PID:6556
- C:\Windows\System\vATnCkJ.exe
  C:\Windows\System\vATnCkJ.exe
  2⤵
  PID:6584
- C:\Windows\System\dSmbWMR.exe
  C:\Windows\System\dSmbWMR.exe
  2⤵
  PID:6612
- C:\Windows\System\jbTZvrO.exe
  C:\Windows\System\jbTZvrO.exe
  2⤵
  PID:6652
- C:\Windows\System\hvpCxQk.exe
  C:\Windows\System\hvpCxQk.exe
  2⤵
  PID:6672
- C:\Windows\System\snnSzPw.exe
  C:\Windows\System\snnSzPw.exe
  2⤵
  PID:6708
- C:\Windows\System\xqXKtvW.exe
  C:\Windows\System\xqXKtvW.exe
  2⤵
  PID:6724
- C:\Windows\System\eKgaDhv.exe
  C:\Windows\System\eKgaDhv.exe
  2⤵
  PID:6752
- C:\Windows\System\iHdJfqG.exe
  C:\Windows\System\iHdJfqG.exe
  2⤵
  PID:6780
- C:\Windows\System\XkiQpuL.exe
  C:\Windows\System\XkiQpuL.exe
  2⤵
  PID:6808
- C:\Windows\System\RhWrGtT.exe
  C:\Windows\System\RhWrGtT.exe
  2⤵
  PID:6836
- C:\Windows\System\jTmSkrO.exe
  C:\Windows\System\jTmSkrO.exe
  2⤵
  PID:6868
- C:\Windows\System\XiAlQQL.exe
  C:\Windows\System\XiAlQQL.exe
  2⤵
  PID:6904
- C:\Windows\System\gDqNqhW.exe
  C:\Windows\System\gDqNqhW.exe
  2⤵
  PID:6928
- C:\Windows\System\yHazXhk.exe
  C:\Windows\System\yHazXhk.exe
  2⤵
  PID:6960
- C:\Windows\System\kLvMRfw.exe
  C:\Windows\System\kLvMRfw.exe
  2⤵
  PID:6980
- C:\Windows\System\AxpndAe.exe
  C:\Windows\System\AxpndAe.exe
  2⤵
  PID:7004
- C:\Windows\System\fQatJmB.exe
  C:\Windows\System\fQatJmB.exe
  2⤵
  PID:7036
- C:\Windows\System\cckwtxc.exe
  C:\Windows\System\cckwtxc.exe
  2⤵
  PID:7076
- C:\Windows\System\eBUqDhm.exe
  C:\Windows\System\eBUqDhm.exe
  2⤵
  PID:7104
- C:\Windows\System\BZmtMDx.exe
  C:\Windows\System\BZmtMDx.exe
  2⤵
  PID:7120
- C:\Windows\System\xagwDkM.exe
  C:\Windows\System\xagwDkM.exe
  2⤵
  PID:7148
- C:\Windows\System\YkKJKGN.exe
  C:\Windows\System\YkKJKGN.exe
  2⤵
  PID:6148
- C:\Windows\System\vMySAVQ.exe
  C:\Windows\System\vMySAVQ.exe
  2⤵
  PID:6208
- C:\Windows\System\QFWpEYa.exe
  C:\Windows\System\QFWpEYa.exe
  2⤵
  PID:6256
- C:\Windows\System\hlAlkTd.exe
  C:\Windows\System\hlAlkTd.exe
  2⤵
  PID:6376
- C:\Windows\System\uPyfFSC.exe
  C:\Windows\System\uPyfFSC.exe
  2⤵
  PID:6468
- C:\Windows\System\AVwYrIQ.exe
  C:\Windows\System\AVwYrIQ.exe
  2⤵
  PID:6456
- C:\Windows\System\YMfIbcJ.exe
  C:\Windows\System\YMfIbcJ.exe
  2⤵
  PID:6548
- C:\Windows\System\upXcFBw.exe
  C:\Windows\System\upXcFBw.exe
  2⤵
  PID:6596
- C:\Windows\System\XyGhjuI.exe
  C:\Windows\System\XyGhjuI.exe
  2⤵
  PID:6668
- C:\Windows\System\ObpZFfc.exe
  C:\Windows\System\ObpZFfc.exe
  2⤵
  PID:6716
- C:\Windows\System\HuZwfsD.exe
  C:\Windows\System\HuZwfsD.exe
  2⤵
  PID:6772
- C:\Windows\System\JPASmup.exe
  C:\Windows\System\JPASmup.exe
  2⤵
  PID:6888
- C:\Windows\System\YNapeig.exe
  C:\Windows\System\YNapeig.exe
  2⤵
  PID:6944
- C:\Windows\System\oDhZMYZ.exe
  C:\Windows\System\oDhZMYZ.exe
  2⤵
  PID:7056
- C:\Windows\System\uMtgGSW.exe
  C:\Windows\System\uMtgGSW.exe
  2⤵
  PID:7072
- C:\Windows\System\MjCATTY.exe
  C:\Windows\System\MjCATTY.exe
  2⤵
  PID:7096
- C:\Windows\System\MZveegA.exe
  C:\Windows\System\MZveegA.exe
  2⤵
  PID:7164
- C:\Windows\System\AVgVdTt.exe
  C:\Windows\System\AVgVdTt.exe
  2⤵
  PID:6340
- C:\Windows\System\XAaKTDA.exe
  C:\Windows\System\XAaKTDA.exe
  2⤵
  PID:6408
- C:\Windows\System\APAeOue.exe
  C:\Windows\System\APAeOue.exe
  2⤵
  PID:6648
- C:\Windows\System\wpNXMXg.exe
  C:\Windows\System\wpNXMXg.exe
  2⤵
  PID:6848
- C:\Windows\System\kJOwxtA.exe
  C:\Windows\System\kJOwxtA.exe
  2⤵
  PID:6912
- C:\Windows\System\hYlqQgK.exe
  C:\Windows\System\hYlqQgK.exe
  2⤵
  PID:7100
- C:\Windows\System\yoEKIVy.exe
  C:\Windows\System\yoEKIVy.exe
  2⤵
  PID:6204
- C:\Windows\System\IXeNzrX.exe
  C:\Windows\System\IXeNzrX.exe
  2⤵
  PID:6856
- C:\Windows\System\ISdIUcT.exe
  C:\Windows\System\ISdIUcT.exe
  2⤵
  PID:6176
- C:\Windows\System\FzMLByg.exe
  C:\Windows\System\FzMLByg.exe
  2⤵
  PID:7048
- C:\Windows\System\AXQzswr.exe
  C:\Windows\System\AXQzswr.exe
  2⤵
  PID:7176
- C:\Windows\System\tXXNPpt.exe
  C:\Windows\System\tXXNPpt.exe
  2⤵
  PID:7196
- C:\Windows\System\hEzYBQJ.exe
  C:\Windows\System\hEzYBQJ.exe
  2⤵
  PID:7224
- C:\Windows\System\uqACJHv.exe
  C:\Windows\System\uqACJHv.exe
  2⤵
  PID:7264
- C:\Windows\System\bXWEZTh.exe
  C:\Windows\System\bXWEZTh.exe
  2⤵
  PID:7292
- C:\Windows\System\luIBppI.exe
  C:\Windows\System\luIBppI.exe
  2⤵
  PID:7316
- C:\Windows\System\htjSnkP.exe
  C:\Windows\System\htjSnkP.exe
  2⤵
  PID:7336
- C:\Windows\System\huhFGcl.exe
  C:\Windows\System\huhFGcl.exe
  2⤵
  PID:7372
- C:\Windows\System\xDHAwhQ.exe
  C:\Windows\System\xDHAwhQ.exe
  2⤵
  PID:7392
- C:\Windows\System\PUbjMXQ.exe
  C:\Windows\System\PUbjMXQ.exe
  2⤵
  PID:7420
- C:\Windows\System\qztxETd.exe
  C:\Windows\System\qztxETd.exe
  2⤵
  PID:7448
- C:\Windows\System\EyEsyTW.exe
  C:\Windows\System\EyEsyTW.exe
  2⤵
  PID:7480
- C:\Windows\System\gQyDELA.exe
  C:\Windows\System\gQyDELA.exe
  2⤵
  PID:7504
- C:\Windows\System\FtCbgVm.exe
  C:\Windows\System\FtCbgVm.exe
  2⤵
  PID:7532
- C:\Windows\System\sMyyqca.exe
  C:\Windows\System\sMyyqca.exe
  2⤵
  PID:7548
- C:\Windows\System\XBLYmju.exe
  C:\Windows\System\XBLYmju.exe
  2⤵
  PID:7572
- C:\Windows\System\BPrctzz.exe
  C:\Windows\System\BPrctzz.exe
  2⤵
  PID:7620
- C:\Windows\System\yVyPxEF.exe
  C:\Windows\System\yVyPxEF.exe
  2⤵
  PID:7640
- C:\Windows\System\kVXywFS.exe
  C:\Windows\System\kVXywFS.exe
  2⤵
  PID:7676
- C:\Windows\System\odappVZ.exe
  C:\Windows\System\odappVZ.exe
  2⤵
  PID:7700
- C:\Windows\System\ZRXOwzO.exe
  C:\Windows\System\ZRXOwzO.exe
  2⤵
  PID:7740
- C:\Windows\System\XxAFEBi.exe
  C:\Windows\System\XxAFEBi.exe
  2⤵
  PID:7768
- C:\Windows\System\qfrxwLD.exe
  C:\Windows\System\qfrxwLD.exe
  2⤵
  PID:7784
- C:\Windows\System\PokYlvp.exe
  C:\Windows\System\PokYlvp.exe
  2⤵
  PID:7816
- C:\Windows\System\BYFvWah.exe
  C:\Windows\System\BYFvWah.exe
  2⤵
  PID:7836
- C:\Windows\System\YuoOfyT.exe
  C:\Windows\System\YuoOfyT.exe
  2⤵
  PID:7860
- C:\Windows\System\Bcmenzz.exe
  C:\Windows\System\Bcmenzz.exe
  2⤵
  PID:7884
- C:\Windows\System\yPbpToy.exe
  C:\Windows\System\yPbpToy.exe
  2⤵
  PID:7916
- C:\Windows\System\aNZBJUC.exe
  C:\Windows\System\aNZBJUC.exe
  2⤵
  PID:7940
- C:\Windows\System\CcuuvTn.exe
  C:\Windows\System\CcuuvTn.exe
  2⤵
  PID:7992
- C:\Windows\System\DwVYyoy.exe
  C:\Windows\System\DwVYyoy.exe
  2⤵
  PID:8016
- C:\Windows\System\eQSORPi.exe
  C:\Windows\System\eQSORPi.exe
  2⤵
  PID:8040
- C:\Windows\System\lRNKgWS.exe
  C:\Windows\System\lRNKgWS.exe
  2⤵
  PID:8072
- C:\Windows\System\DAVWamG.exe
  C:\Windows\System\DAVWamG.exe
  2⤵
  PID:8096
- C:\Windows\System\vwNEhiL.exe
  C:\Windows\System\vwNEhiL.exe
  2⤵
  PID:8120
- C:\Windows\System\fssgugN.exe
  C:\Windows\System\fssgugN.exe
  2⤵
  PID:8160
- C:\Windows\System\doeywBJ.exe
  C:\Windows\System\doeywBJ.exe
  2⤵
  PID:8188
- C:\Windows\System\xYxLUeq.exe
  C:\Windows\System\xYxLUeq.exe
  2⤵
  PID:7212
- C:\Windows\System\mDPlYbA.exe
  C:\Windows\System\mDPlYbA.exe
  2⤵
  PID:7288
- C:\Windows\System\CHxmKIt.exe
  C:\Windows\System\CHxmKIt.exe
  2⤵
  PID:7364
- C:\Windows\System\aALdSFj.exe
  C:\Windows\System\aALdSFj.exe
  2⤵
  PID:7404
- C:\Windows\System\eLXjDES.exe
  C:\Windows\System\eLXjDES.exe
  2⤵
  PID:7468
- C:\Windows\System\rZLzGnl.exe
  C:\Windows\System\rZLzGnl.exe
  2⤵
  PID:7488
- C:\Windows\System\mzREeUf.exe
  C:\Windows\System\mzREeUf.exe
  2⤵
  PID:7604
- C:\Windows\System\QgxKQfM.exe
  C:\Windows\System\QgxKQfM.exe
  2⤵
  PID:7684
- C:\Windows\System\eSUhvOZ.exe
  C:\Windows\System\eSUhvOZ.exe
  2⤵
  PID:7760
- C:\Windows\System\YtJcofs.exe
  C:\Windows\System\YtJcofs.exe
  2⤵
  PID:7828
- C:\Windows\System\CuXAXen.exe
  C:\Windows\System\CuXAXen.exe
  2⤵
  PID:7880
- C:\Windows\System\MTEZCMP.exe
  C:\Windows\System\MTEZCMP.exe
  2⤵
  PID:7904
- C:\Windows\System\LCZbzQl.exe
  C:\Windows\System\LCZbzQl.exe
  2⤵
  PID:8012
- C:\Windows\System\BdHkWfl.exe
  C:\Windows\System\BdHkWfl.exe
  2⤵
  PID:8068
- C:\Windows\System\wqLkCQe.exe
  C:\Windows\System\wqLkCQe.exe
  2⤵
  PID:8104
- C:\Windows\System\UpEJJEG.exe
  C:\Windows\System\UpEJJEG.exe
  2⤵
  PID:8180
- C:\Windows\System\rzgobKu.exe
  C:\Windows\System\rzgobKu.exe
  2⤵
  PID:7328
- C:\Windows\System\UjmKobq.exe
  C:\Windows\System\UjmKobq.exe
  2⤵
  PID:7440
- C:\Windows\System\OrNgUYw.exe
  C:\Windows\System\OrNgUYw.exe
  2⤵
  PID:7648
- C:\Windows\System\NCYlLiK.exe
  C:\Windows\System\NCYlLiK.exe
  2⤵
  PID:7824
- C:\Windows\System\KbcuhoD.exe
  C:\Windows\System\KbcuhoD.exe
  2⤵
  PID:7960
- C:\Windows\System\cEqPCNL.exe
  C:\Windows\System\cEqPCNL.exe
  2⤵
  PID:8084
- C:\Windows\System\NbrsZXB.exe
  C:\Windows\System\NbrsZXB.exe
  2⤵
  PID:8140
- C:\Windows\System\xBflSgr.exe
  C:\Windows\System\xBflSgr.exe
  2⤵
  PID:7384
- C:\Windows\System\EEVqUny.exe
  C:\Windows\System\EEVqUny.exe
  2⤵
  PID:7928
- C:\Windows\System\iHsEsFE.exe
  C:\Windows\System\iHsEsFE.exe
  2⤵
  PID:7208
- C:\Windows\System\SKYUViD.exe
  C:\Windows\System\SKYUViD.exe
  2⤵
  PID:7324
- C:\Windows\System\TpzeoCQ.exe
  C:\Windows\System\TpzeoCQ.exe
  2⤵
  PID:8204
- C:\Windows\System\ZfPdCBz.exe
  C:\Windows\System\ZfPdCBz.exe
  2⤵
  PID:8224
- C:\Windows\System\yfauYnV.exe
  C:\Windows\System\yfauYnV.exe
  2⤵
  PID:8260
- C:\Windows\System\vgrJogt.exe
  C:\Windows\System\vgrJogt.exe
  2⤵
  PID:8276
- C:\Windows\System\mFabHme.exe
  C:\Windows\System\mFabHme.exe
  2⤵
  PID:8304
- C:\Windows\System\BAMFXNC.exe
  C:\Windows\System\BAMFXNC.exe
  2⤵
  PID:8332
- C:\Windows\System\RVMvZdv.exe
  C:\Windows\System\RVMvZdv.exe
  2⤵
  PID:8360
- C:\Windows\System\zVYiUcx.exe
  C:\Windows\System\zVYiUcx.exe
  2⤵
  PID:8380
- C:\Windows\System\RFzEiPM.exe
  C:\Windows\System\RFzEiPM.exe
  2⤵
  PID:8412
- C:\Windows\System\uYKvKhD.exe
  C:\Windows\System\uYKvKhD.exe
  2⤵
  PID:8436
- C:\Windows\System\OzoamNQ.exe
  C:\Windows\System\OzoamNQ.exe
  2⤵
  PID:8464
- C:\Windows\System\fHtWTGE.exe
  C:\Windows\System\fHtWTGE.exe
  2⤵
  PID:8496
- C:\Windows\System\wxkUSop.exe
  C:\Windows\System\wxkUSop.exe
  2⤵
  PID:8536
- C:\Windows\System\cJTFBjD.exe
  C:\Windows\System\cJTFBjD.exe
  2⤵
  PID:8564
- C:\Windows\System\ROoNplE.exe
  C:\Windows\System\ROoNplE.exe
  2⤵
  PID:8580
- C:\Windows\System\uCYkbDB.exe
  C:\Windows\System\uCYkbDB.exe
  2⤵
  PID:8600
- C:\Windows\System\ilPNbVt.exe
  C:\Windows\System\ilPNbVt.exe
  2⤵
  PID:8620
- C:\Windows\System\SoxncMK.exe
  C:\Windows\System\SoxncMK.exe
  2⤵
  PID:8640
- C:\Windows\System\snNSCOt.exe
  C:\Windows\System\snNSCOt.exe
  2⤵
  PID:8676
- C:\Windows\System\ViBxUQY.exe
  C:\Windows\System\ViBxUQY.exe
  2⤵
  PID:8720
- C:\Windows\System\NYPdvmg.exe
  C:\Windows\System\NYPdvmg.exe
  2⤵
  PID:8764
- C:\Windows\System\IqJisGu.exe
  C:\Windows\System\IqJisGu.exe
  2⤵
  PID:8788
- C:\Windows\System\zrVEMRE.exe
  C:\Windows\System\zrVEMRE.exe
  2⤵
  PID:8808
- C:\Windows\System\UKcNCzm.exe
  C:\Windows\System\UKcNCzm.exe
  2⤵
  PID:8836
- C:\Windows\System\QfyarDr.exe
  C:\Windows\System\QfyarDr.exe
  2⤵
  PID:8864
- C:\Windows\System\aTMhQkw.exe
  C:\Windows\System\aTMhQkw.exe
  2⤵
  PID:8896
- C:\Windows\System\rtHgPmk.exe
  C:\Windows\System\rtHgPmk.exe
  2⤵
  PID:8932
- C:\Windows\System\CTkpBRp.exe
  C:\Windows\System\CTkpBRp.exe
  2⤵
  PID:8960
- C:\Windows\System\UhgzqSE.exe
  C:\Windows\System\UhgzqSE.exe
  2⤵
  PID:8976
- C:\Windows\System\uZXAdZM.exe
  C:\Windows\System\uZXAdZM.exe
  2⤵
  PID:9004
- C:\Windows\System\IsucrDJ.exe
  C:\Windows\System\IsucrDJ.exe
  2⤵
  PID:9028
- C:\Windows\System\bgNQSgI.exe
  C:\Windows\System\bgNQSgI.exe
  2⤵
  PID:9060
- C:\Windows\System\pVMvSob.exe
  C:\Windows\System\pVMvSob.exe
  2⤵
  PID:9100
- C:\Windows\System\TiVIHNY.exe
  C:\Windows\System\TiVIHNY.exe
  2⤵
  PID:9128
- C:\Windows\System\MEerEbr.exe
  C:\Windows\System\MEerEbr.exe
  2⤵
  PID:9156
- C:\Windows\System\vOQKJGZ.exe
  C:\Windows\System\vOQKJGZ.exe
  2⤵
  PID:9184
- C:\Windows\System\celaGKp.exe
  C:\Windows\System\celaGKp.exe
  2⤵
  PID:9212
- C:\Windows\System\jIGqVKJ.exe
  C:\Windows\System\jIGqVKJ.exe
  2⤵
  PID:8236
- C:\Windows\System\uVDcVqh.exe
  C:\Windows\System\uVDcVqh.exe
  2⤵
  PID:8272
- C:\Windows\System\mBwVbLO.exe
  C:\Windows\System\mBwVbLO.exe
  2⤵
  PID:8352
- C:\Windows\System\mZsEIjy.exe
  C:\Windows\System\mZsEIjy.exe
  2⤵
  PID:8448
- C:\Windows\System\ojQzxHL.exe
  C:\Windows\System\ojQzxHL.exe
  2⤵
  PID:8460
- C:\Windows\System\sDPXKZJ.exe
  C:\Windows\System\sDPXKZJ.exe
  2⤵
  PID:8548
- C:\Windows\System\JlhcdeZ.exe
  C:\Windows\System\JlhcdeZ.exe
  2⤵
  PID:8592
- C:\Windows\System\VTjOZVK.exe
  C:\Windows\System\VTjOZVK.exe
  2⤵
  PID:8632
- C:\Windows\System\YfcUNlq.exe
  C:\Windows\System\YfcUNlq.exe
  2⤵
  PID:8736
- C:\Windows\System\rSPMQpC.exe
  C:\Windows\System\rSPMQpC.exe
  2⤵
  PID:8780
- C:\Windows\System\YnVRWsJ.exe
  C:\Windows\System\YnVRWsJ.exe
  2⤵
  PID:8860
- C:\Windows\System\afnQyIN.exe
  C:\Windows\System\afnQyIN.exe
  2⤵
  PID:8928
- C:\Windows\System\rWDhIPK.exe
  C:\Windows\System\rWDhIPK.exe
  2⤵
  PID:9016
- C:\Windows\System\twzJZKH.exe
  C:\Windows\System\twzJZKH.exe
  2⤵
  PID:9076
- C:\Windows\System\cufgFzb.exe
  C:\Windows\System\cufgFzb.exe
  2⤵
  PID:9116
- C:\Windows\System\YBzBAQf.exe
  C:\Windows\System\YBzBAQf.exe
  2⤵
  PID:9196
- C:\Windows\System\GeCQOav.exe
  C:\Windows\System\GeCQOav.exe
  2⤵
  PID:8316
- C:\Windows\System\yBvLOJL.exe
  C:\Windows\System\yBvLOJL.exe
  2⤵
  PID:8480
- C:\Windows\System\xwNLzoz.exe
  C:\Windows\System\xwNLzoz.exe
  2⤵
  PID:8588
- C:\Windows\System\mxrTfoj.exe
  C:\Windows\System\mxrTfoj.exe
  2⤵
  PID:8828
- C:\Windows\System\evJJxeO.exe
  C:\Windows\System\evJJxeO.exe
  2⤵
  PID:8856
- C:\Windows\System\IoHMhrB.exe
  C:\Windows\System\IoHMhrB.exe
  2⤵
  PID:9044
- C:\Windows\System\RckSVqw.exe
  C:\Windows\System\RckSVqw.exe
  2⤵
  PID:7668
- C:\Windows\System\VzXyFCb.exe
  C:\Windows\System\VzXyFCb.exe
  2⤵
  PID:8596
- C:\Windows\System\vnYUTeX.exe
  C:\Windows\System\vnYUTeX.exe
  2⤵
  PID:8692
- C:\Windows\System\WvrkpgV.exe
  C:\Windows\System\WvrkpgV.exe
  2⤵
  PID:9092
- C:\Windows\System\ozQTjhI.exe
  C:\Windows\System\ozQTjhI.exe
  2⤵
  PID:9236
- C:\Windows\System\jTslIWK.exe
  C:\Windows\System\jTslIWK.exe
  2⤵
  PID:9252
- C:\Windows\System\qzSJUSx.exe
  C:\Windows\System\qzSJUSx.exe
  2⤵
  PID:9292
- C:\Windows\System\HYBuZto.exe
  C:\Windows\System\HYBuZto.exe
  2⤵
  PID:9320
- C:\Windows\System\BKlQtTM.exe
  C:\Windows\System\BKlQtTM.exe
  2⤵
  PID:9336
- C:\Windows\System\lDvLawV.exe
  C:\Windows\System\lDvLawV.exe
  2⤵
  PID:9356
- C:\Windows\System\AYZwuhb.exe
  C:\Windows\System\AYZwuhb.exe
  2⤵
  PID:9392
- C:\Windows\System\SJIszXc.exe
  C:\Windows\System\SJIszXc.exe
  2⤵
  PID:9420
- C:\Windows\System\aOPYjeM.exe
  C:\Windows\System\aOPYjeM.exe
  2⤵
  PID:9460
- C:\Windows\System\MSWXMxJ.exe
  C:\Windows\System\MSWXMxJ.exe
  2⤵
  PID:9488
- C:\Windows\System\CPczLJq.exe
  C:\Windows\System\CPczLJq.exe
  2⤵
  PID:9504
- C:\Windows\System\qHollmx.exe
  C:\Windows\System\qHollmx.exe
  2⤵
  PID:9532
- C:\Windows\System\vvREDSf.exe
  C:\Windows\System\vvREDSf.exe
  2⤵
  PID:9560
- C:\Windows\System\HPPweJo.exe
  C:\Windows\System\HPPweJo.exe
  2⤵
  PID:9588
- C:\Windows\System\mvRZUsS.exe
  C:\Windows\System\mvRZUsS.exe
  2⤵
  PID:9616
- C:\Windows\System\XWEIIvw.exe
  C:\Windows\System\XWEIIvw.exe
  2⤵
  PID:9644
- C:\Windows\System\EsAGLlr.exe
  C:\Windows\System\EsAGLlr.exe
  2⤵
  PID:9684
- C:\Windows\System\sSZypPc.exe
  C:\Windows\System\sSZypPc.exe
  2⤵
  PID:9708
- C:\Windows\System\vxnjiCs.exe
  C:\Windows\System\vxnjiCs.exe
  2⤵
  PID:9728
- C:\Windows\System\QjHMWib.exe
  C:\Windows\System\QjHMWib.exe
  2⤵
  PID:9756
- C:\Windows\System\oGiBXAf.exe
  C:\Windows\System\oGiBXAf.exe
  2⤵
  PID:9784
- C:\Windows\System\docVgzA.exe
  C:\Windows\System\docVgzA.exe
  2⤵
  PID:9812
- C:\Windows\System\tbbldys.exe
  C:\Windows\System\tbbldys.exe
  2⤵
  PID:9836
- C:\Windows\System\GOBvMhm.exe
  C:\Windows\System\GOBvMhm.exe
  2⤵
  PID:9852
- C:\Windows\System\oBBgfHu.exe
  C:\Windows\System\oBBgfHu.exe
  2⤵
  PID:9876
- C:\Windows\System\csShMNr.exe
  C:\Windows\System\csShMNr.exe
  2⤵
  PID:9900
- C:\Windows\System\MfLIUvp.exe
  C:\Windows\System\MfLIUvp.exe
  2⤵
  PID:9924
- C:\Windows\System\VwAXtQD.exe
  C:\Windows\System\VwAXtQD.exe
  2⤵
  PID:9952
- C:\Windows\System\frExvnx.exe
  C:\Windows\System\frExvnx.exe
  2⤵
  PID:9976
- C:\Windows\System\gtweIUZ.exe
  C:\Windows\System\gtweIUZ.exe
  2⤵
  PID:10008
- C:\Windows\System\lQNjZKE.exe
  C:\Windows\System\lQNjZKE.exe
  2⤵
  PID:10036
- C:\Windows\System\Lvadvux.exe
  C:\Windows\System\Lvadvux.exe
  2⤵
  PID:10084
- C:\Windows\System\smPwsxR.exe
  C:\Windows\System\smPwsxR.exe
  2⤵
  PID:10120
- C:\Windows\System\ukAozKZ.exe
  C:\Windows\System\ukAozKZ.exe
  2⤵
  PID:10148
- C:\Windows\System\ybrePRf.exe
  C:\Windows\System\ybrePRf.exe
  2⤵
  PID:10188
- C:\Windows\System\ltMsiLt.exe
  C:\Windows\System\ltMsiLt.exe
  2⤵
  PID:10216
- C:\Windows\System\czIJWVW.exe
  C:\Windows\System\czIJWVW.exe
  2⤵
  PID:8212
- C:\Windows\System\fBwgSZA.exe
  C:\Windows\System\fBwgSZA.exe
  2⤵
  PID:9228
- C:\Windows\System\rSTrKhX.exe
  C:\Windows\System\rSTrKhX.exe
  2⤵
  PID:9312
- C:\Windows\System\lZCbUqe.exe
  C:\Windows\System\lZCbUqe.exe
  2⤵
  PID:9364
- C:\Windows\System\mBTLxZW.exe
  C:\Windows\System\mBTLxZW.exe
  2⤵
  PID:9452
- C:\Windows\System\zqAhxee.exe
  C:\Windows\System\zqAhxee.exe
  2⤵
  PID:9500
- C:\Windows\System\LtiUCfx.exe
  C:\Windows\System\LtiUCfx.exe
  2⤵
  PID:9544
- C:\Windows\System\mmfhQZY.exe
  C:\Windows\System\mmfhQZY.exe
  2⤵
  PID:9604
- C:\Windows\System\uDIAXYo.exe
  C:\Windows\System\uDIAXYo.exe
  2⤵
  PID:9660
- C:\Windows\System\SIGxslT.exe
  C:\Windows\System\SIGxslT.exe
  2⤵
  PID:9716
- C:\Windows\System\yhXxoYl.exe
  C:\Windows\System\yhXxoYl.exe
  2⤵
  PID:9780
- C:\Windows\System\VeVXjPv.exe
  C:\Windows\System\VeVXjPv.exe
  2⤵
  PID:9892
- C:\Windows\System\WKkAykf.exe
  C:\Windows\System\WKkAykf.exe
  2⤵
  PID:9972
- C:\Windows\System\NtJHmpN.exe
  C:\Windows\System\NtJHmpN.exe
  2⤵
  PID:9908
- C:\Windows\System\xxwPsTg.exe
  C:\Windows\System\xxwPsTg.exe
  2⤵
  PID:10076
- C:\Windows\System\FVbExzY.exe
  C:\Windows\System\FVbExzY.exe
  2⤵
  PID:10164
- C:\Windows\System\dyasDjk.exe
  C:\Windows\System\dyasDjk.exe
  2⤵
  PID:10212
- C:\Windows\System\baKWqYm.exe
  C:\Windows\System\baKWqYm.exe
  2⤵
  PID:9308
- C:\Windows\System\xasGKGC.exe
  C:\Windows\System\xasGKGC.exe
  2⤵
  PID:9408
- C:\Windows\System\Gxegfzm.exe
  C:\Windows\System\Gxegfzm.exe
  2⤵
  PID:9636
- C:\Windows\System\HiilrDF.exe
  C:\Windows\System\HiilrDF.exe
  2⤵
  PID:9696
- C:\Windows\System\maAXcGV.exe
  C:\Windows\System\maAXcGV.exe
  2⤵
  PID:9844
- C:\Windows\System\kOmBmWq.exe
  C:\Windows\System\kOmBmWq.exe
  2⤵
  PID:10096
- C:\Windows\System\TlVjKJu.exe
  C:\Windows\System\TlVjKJu.exe
  2⤵
  PID:10168
- C:\Windows\System\UpfcBns.exe
  C:\Windows\System\UpfcBns.exe
  2⤵
  PID:9224
- C:\Windows\System\fCntCLq.exe
  C:\Windows\System\fCntCLq.exe
  2⤵
  PID:9632
- C:\Windows\System\mSENoIy.exe
  C:\Windows\System\mSENoIy.exe
  2⤵
  PID:9772
- C:\Windows\System\rRQJNUT.exe
  C:\Windows\System\rRQJNUT.exe
  2⤵
  PID:10244
- C:\Windows\System\NdqYmvc.exe
  C:\Windows\System\NdqYmvc.exe
  2⤵
  PID:10272
- C:\Windows\System\mHEkLrU.exe
  C:\Windows\System\mHEkLrU.exe
  2⤵
  PID:10316
- C:\Windows\System\CWMRuVR.exe
  C:\Windows\System\CWMRuVR.exe
  2⤵
  PID:10344
- C:\Windows\System\vKGhzXR.exe
  C:\Windows\System\vKGhzXR.exe
  2⤵
  PID:10372
- C:\Windows\System\VOJvHbU.exe
  C:\Windows\System\VOJvHbU.exe
  2⤵
  PID:10400
- C:\Windows\System\IDMSjJj.exe
  C:\Windows\System\IDMSjJj.exe
  2⤵
  PID:10416
- C:\Windows\System\GsKNXve.exe
  C:\Windows\System\GsKNXve.exe
  2⤵
  PID:10444
- C:\Windows\System\xbadJNl.exe
  C:\Windows\System\xbadJNl.exe
  2⤵
  PID:10480
- C:\Windows\System\AZjtUUx.exe
  C:\Windows\System\AZjtUUx.exe
  2⤵
  PID:10508
- C:\Windows\System\nibYtNT.exe
  C:\Windows\System\nibYtNT.exe
  2⤵
  PID:10536
- C:\Windows\System\QdMURqy.exe
  C:\Windows\System\QdMURqy.exe
  2⤵
  PID:10576
- C:\Windows\System\dllzCrN.exe
  C:\Windows\System\dllzCrN.exe
  2⤵
  PID:10600
- C:\Windows\System\hZbmbPC.exe
  C:\Windows\System\hZbmbPC.exe
  2⤵
  PID:10620
- C:\Windows\System\iiitHlW.exe
  C:\Windows\System\iiitHlW.exe
  2⤵
  PID:10644
- C:\Windows\System\EGDfkME.exe
  C:\Windows\System\EGDfkME.exe
  2⤵
  PID:10668
- C:\Windows\System\LuyIHeo.exe
  C:\Windows\System\LuyIHeo.exe
  2⤵
  PID:10696
- C:\Windows\System\yPCvnbg.exe
  C:\Windows\System\yPCvnbg.exe
  2⤵
  PID:10724
- C:\Windows\System\YSiMSWT.exe
  C:\Windows\System\YSiMSWT.exe
  2⤵
  PID:10768
- C:\Windows\System\NCHvssW.exe
  C:\Windows\System\NCHvssW.exe
  2⤵
  PID:10820
- C:\Windows\System\nEZIfpv.exe
  C:\Windows\System\nEZIfpv.exe
  2⤵
  PID:10840
- C:\Windows\System\IyCVSNu.exe
  C:\Windows\System\IyCVSNu.exe
  2⤵
  PID:10860
- C:\Windows\System\YBufCMu.exe
  C:\Windows\System\YBufCMu.exe
  2⤵
  PID:10880
- C:\Windows\System\uutywWF.exe
  C:\Windows\System\uutywWF.exe
  2⤵
  PID:10912
- C:\Windows\System\qMEnQCx.exe
  C:\Windows\System\qMEnQCx.exe
  2⤵
  PID:10952
- C:\Windows\System\sGSFfFR.exe
  C:\Windows\System\sGSFfFR.exe
  2⤵
  PID:10976
- C:\Windows\System\OttsUUe.exe
  C:\Windows\System\OttsUUe.exe
  2⤵
  PID:11012
- C:\Windows\System\pSVcpbn.exe
  C:\Windows\System\pSVcpbn.exe
  2⤵
  PID:11044
- C:\Windows\System\OECZUGl.exe
  C:\Windows\System\OECZUGl.exe
  2⤵
  PID:11072
- C:\Windows\System\DZfSpGG.exe
  C:\Windows\System\DZfSpGG.exe
  2⤵
  PID:11100
- C:\Windows\System\ZnQMHIF.exe
  C:\Windows\System\ZnQMHIF.exe
  2⤵
  PID:11144
- C:\Windows\System\gErBfmH.exe
  C:\Windows\System\gErBfmH.exe
  2⤵
  PID:11160
- C:\Windows\System\fRwtSSl.exe
  C:\Windows\System\fRwtSSl.exe
  2⤵
  PID:11200
- C:\Windows\System\NsbyIRA.exe
  C:\Windows\System\NsbyIRA.exe
  2⤵
  PID:11216
- C:\Windows\System\BKcixGY.exe
  C:\Windows\System\BKcixGY.exe
  2⤵
  PID:11244
- C:\Windows\System\aAMIraC.exe
  C:\Windows\System\aAMIraC.exe
  2⤵
  PID:10020
- C:\Windows\System\mbDIEmq.exe
  C:\Windows\System\mbDIEmq.exe
  2⤵
  PID:10300
- C:\Windows\System\iztEsps.exe
  C:\Windows\System\iztEsps.exe
  2⤵
  PID:10360
- C:\Windows\System\VSMAQUx.exe
  C:\Windows\System\VSMAQUx.exe
  2⤵
  PID:10388
- C:\Windows\System\Idoryvz.exe
  C:\Windows\System\Idoryvz.exe
  2⤵
  PID:10452
- C:\Windows\System\ERTSskn.exe
  C:\Windows\System\ERTSskn.exe
  2⤵
  PID:10560
- C:\Windows\System\WSoCZDA.exe
  C:\Windows\System\WSoCZDA.exe
  2⤵
  PID:10592
- C:\Windows\System\BdKhirq.exe
  C:\Windows\System\BdKhirq.exe
  2⤵
  PID:10652
- C:\Windows\System\gnUAfpH.exe
  C:\Windows\System\gnUAfpH.exe
  2⤵
  PID:10712
- C:\Windows\System\zzgWUKR.exe
  C:\Windows\System\zzgWUKR.exe
  2⤵
  PID:10588
- C:\Windows\System\VbdFscE.exe
  C:\Windows\System\VbdFscE.exe
  2⤵
  PID:10904
- C:\Windows\System\WaitgIu.exe
  C:\Windows\System\WaitgIu.exe
  2⤵
  PID:10968
- C:\Windows\System\YIIpVCm.exe
  C:\Windows\System\YIIpVCm.exe
  2⤵
  PID:11036
- C:\Windows\System\PNdfBnS.exe
  C:\Windows\System\PNdfBnS.exe
  2⤵
  PID:11092
- C:\Windows\System\YSwSofr.exe
  C:\Windows\System\YSwSofr.exe
  2⤵
  PID:11136
- C:\Windows\System\JDBXRrg.exe
  C:\Windows\System\JDBXRrg.exe
  2⤵
  PID:11212
- C:\Windows\System\UEDNMtv.exe
  C:\Windows\System\UEDNMtv.exe
  2⤵
  PID:9988
- C:\Windows\System\QWQREon.exe
  C:\Windows\System\QWQREon.exe
  2⤵
  PID:10436
- C:\Windows\System\IVvsuZu.exe
  C:\Windows\System\IVvsuZu.exe
  2⤵
  PID:10596
- C:\Windows\System\jPylRKQ.exe
  C:\Windows\System\jPylRKQ.exe
  2⤵
  PID:10632
- C:\Windows\System\kfrKAlE.exe
  C:\Windows\System\kfrKAlE.exe
  2⤵
  PID:10760
- C:\Windows\System\bVwepfo.exe
  C:\Windows\System\bVwepfo.exe
  2⤵
  PID:10948
- C:\Windows\System\xFMOtVx.exe
  C:\Windows\System\xFMOtVx.exe
  2⤵
  PID:11084
- C:\Windows\System\jyhmAKH.exe
  C:\Windows\System\jyhmAKH.exe
  2⤵
  PID:8244
- C:\Windows\System\vJVMWLa.exe
  C:\Windows\System\vJVMWLa.exe
  2⤵
  PID:10744
- C:\Windows\System\OUbsECF.exe
  C:\Windows\System\OUbsECF.exe
  2⤵
  PID:11120
- C:\Windows\System\AGNaUtJ.exe
  C:\Windows\System\AGNaUtJ.exe
  2⤵
  PID:10340
- C:\Windows\System\efgCofv.exe
  C:\Windows\System\efgCofv.exe
  2⤵
  PID:10660
- C:\Windows\System\hjRAeWs.exe
  C:\Windows\System\hjRAeWs.exe
  2⤵
  PID:11288
- C:\Windows\System\XjjqoNS.exe
  C:\Windows\System\XjjqoNS.exe
  2⤵
  PID:11324
- C:\Windows\System\xIDvfJH.exe
  C:\Windows\System\xIDvfJH.exe
  2⤵
  PID:11352
- C:\Windows\System\CbDIbtr.exe
  C:\Windows\System\CbDIbtr.exe
  2⤵
  PID:11392
- C:\Windows\System\uBktYQE.exe
  C:\Windows\System\uBktYQE.exe
  2⤵
  PID:11420
- C:\Windows\System\wtDheTy.exe
  C:\Windows\System\wtDheTy.exe
  2⤵
  PID:11448
- C:\Windows\System\zWgGozk.exe
  C:\Windows\System\zWgGozk.exe
  2⤵
  PID:11476
- C:\Windows\System\WJmnNRA.exe
  C:\Windows\System\WJmnNRA.exe
  2⤵
  PID:11504
- C:\Windows\System\lGwLhNX.exe
  C:\Windows\System\lGwLhNX.exe
  2⤵
  PID:11520
- C:\Windows\System\WpSvetv.exe
  C:\Windows\System\WpSvetv.exe
  2⤵
  PID:11552
- C:\Windows\System\uQAnXRF.exe
  C:\Windows\System\uQAnXRF.exe
  2⤵
  PID:11576
- C:\Windows\System\Jpjseel.exe
  C:\Windows\System\Jpjseel.exe
  2⤵
  PID:11612
- C:\Windows\System\kqOMFsL.exe
  C:\Windows\System\kqOMFsL.exe
  2⤵
  PID:11632
- C:\Windows\System\EEGeNuY.exe
  C:\Windows\System\EEGeNuY.exe
  2⤵
  PID:11660
- C:\Windows\System\NfLcShW.exe
  C:\Windows\System\NfLcShW.exe
  2⤵
  PID:11688
- C:\Windows\System\UjqNyYf.exe
  C:\Windows\System\UjqNyYf.exe
  2⤵
  PID:11716
- C:\Windows\System\WSGPZgd.exe
  C:\Windows\System\WSGPZgd.exe
  2⤵
  PID:11776
- C:\Windows\System\ptMcWGh.exe
  C:\Windows\System\ptMcWGh.exe
  2⤵
  PID:11792
- C:\Windows\System\jDfCmAX.exe
  C:\Windows\System\jDfCmAX.exe
  2⤵
  PID:11808
- C:\Windows\System\NlNdjOo.exe
  C:\Windows\System\NlNdjOo.exe
  2⤵
  PID:11832
- C:\Windows\System\RamPWot.exe
  C:\Windows\System\RamPWot.exe
  2⤵
  PID:11872
- C:\Windows\System\OWIWCji.exe
  C:\Windows\System\OWIWCji.exe
  2⤵
  PID:11896
- C:\Windows\System\mwdJUfH.exe
  C:\Windows\System\mwdJUfH.exe
  2⤵
  PID:11924
- C:\Windows\System\vIoYmUU.exe
  C:\Windows\System\vIoYmUU.exe
  2⤵
  PID:11960
- C:\Windows\System\qigJJQo.exe
  C:\Windows\System\qigJJQo.exe
  2⤵
  PID:11980
- C:\Windows\System\IpRWfcU.exe
  C:\Windows\System\IpRWfcU.exe
  2⤵
  PID:12012
- C:\Windows\System\EvUgzzf.exe
  C:\Windows\System\EvUgzzf.exe
  2⤵
  PID:12036
- C:\Windows\System\WRzXbYP.exe
  C:\Windows\System\WRzXbYP.exe
  2⤵
  PID:12068
- C:\Windows\System\HotnQIO.exe
  C:\Windows\System\HotnQIO.exe
  2⤵
  PID:12092
- C:\Windows\System\DlcOJSF.exe
  C:\Windows\System\DlcOJSF.exe
  2⤵
  PID:12120
- C:\Windows\System\UjtmDfP.exe
  C:\Windows\System\UjtmDfP.exe
  2⤵
  PID:12144
- C:\Windows\System\BmJYFQz.exe
  C:\Windows\System\BmJYFQz.exe
  2⤵
  PID:12172
- C:\Windows\System\amaZiFl.exe
  C:\Windows\System\amaZiFl.exe
  2⤵
  PID:12204
- C:\Windows\System\JnFeygi.exe
  C:\Windows\System\JnFeygi.exe
  2⤵
  PID:12224
- C:\Windows\System\hvLSGDu.exe
  C:\Windows\System\hvLSGDu.exe
  2⤵
  PID:12252
- C:\Windows\System\OjeTimv.exe
  C:\Windows\System\OjeTimv.exe
  2⤵
  PID:12284
- C:\Windows\System\XAPzyka.exe
  C:\Windows\System\XAPzyka.exe
  2⤵
  PID:11348
- C:\Windows\System\aOqCdgV.exe
  C:\Windows\System\aOqCdgV.exe
  2⤵
  PID:11404
- C:\Windows\System\jbeANyf.exe
  C:\Windows\System\jbeANyf.exe
  2⤵
  PID:11440
- C:\Windows\System\LUcSzON.exe
  C:\Windows\System\LUcSzON.exe
  2⤵
  PID:11496
- C:\Windows\System\spCNbgO.exe
  C:\Windows\System\spCNbgO.exe
  2⤵
  PID:11548
- C:\Windows\System\qlfOXqi.exe
  C:\Windows\System\qlfOXqi.exe
  2⤵
  PID:11604
- C:\Windows\System\CwtIyPJ.exe
  C:\Windows\System\CwtIyPJ.exe
  2⤵
  PID:11672
- C:\Windows\System\yATlToS.exe
  C:\Windows\System\yATlToS.exe
  2⤵
  PID:11760
- C:\Windows\System\fQYhYje.exe
  C:\Windows\System\fQYhYje.exe
  2⤵
  PID:11852
- C:\Windows\System\QomNeVJ.exe
  C:\Windows\System\QomNeVJ.exe
  2⤵
  PID:11920
- C:\Windows\System\lHFxlQM.exe
  C:\Windows\System\lHFxlQM.exe
  2⤵
  PID:12000
- C:\Windows\System\aNmAdjc.exe
  C:\Windows\System\aNmAdjc.exe
  2⤵
  PID:12020
- C:\Windows\System\ZdNeoOC.exe
  C:\Windows\System\ZdNeoOC.exe
  2⤵
  PID:12156
- C:\Windows\System\kIDmQAp.exe
  C:\Windows\System\kIDmQAp.exe
  2⤵
  PID:12244
- C:\Windows\System\ReIynSt.exe
  C:\Windows\System\ReIynSt.exe
  2⤵
  PID:11384
- C:\Windows\System\HkrOICZ.exe
  C:\Windows\System\HkrOICZ.exe
  2⤵
  PID:11432
- C:\Windows\System\pFBoDfG.exe
  C:\Windows\System\pFBoDfG.exe
  2⤵
  PID:11560
- C:\Windows\System\LxhoQYa.exe
  C:\Windows\System\LxhoQYa.exe
  2⤵
  PID:11912
- C:\Windows\System\pjDogjg.exe
  C:\Windows\System\pjDogjg.exe
  2⤵
  PID:11988
- C:\Windows\System\iqHvRst.exe
  C:\Windows\System\iqHvRst.exe
  2⤵
  PID:12160
- C:\Windows\System\WKaUnHB.exe
  C:\Windows\System\WKaUnHB.exe
  2⤵
  PID:11512
- C:\Windows\System\SwRvibo.exe
  C:\Windows\System\SwRvibo.exe
  2⤵
  PID:11712
- C:\Windows\System\aReEdGD.exe
  C:\Windows\System\aReEdGD.exe
  2⤵
  PID:12308
- C:\Windows\System\pyPlfjq.exe
  C:\Windows\System\pyPlfjq.exe
  2⤵
  PID:12344
- C:\Windows\System\sSmsNwf.exe
  C:\Windows\System\sSmsNwf.exe
  2⤵
  PID:12384
- C:\Windows\System\RnCLcqm.exe
  C:\Windows\System\RnCLcqm.exe
  2⤵
  PID:12420
- C:\Windows\System\Gletoke.exe
  C:\Windows\System\Gletoke.exe
  2⤵
  PID:12436
- C:\Windows\System\ggRRwaO.exe
  C:\Windows\System\ggRRwaO.exe
  2⤵
  PID:12468
- C:\Windows\System\jNKoKOt.exe
  C:\Windows\System\jNKoKOt.exe
  2⤵
  PID:12488
- C:\Windows\System\TYWeDjp.exe
  C:\Windows\System\TYWeDjp.exe
  2⤵
  PID:12508
- C:\Windows\System\lsmIqps.exe
  C:\Windows\System\lsmIqps.exe
  2⤵
  PID:12568
- C:\Windows\System\DWgPFFH.exe
  C:\Windows\System\DWgPFFH.exe
  2⤵
  PID:12608
- C:\Windows\System\VCayZZZ.exe
  C:\Windows\System\VCayZZZ.exe
  2⤵
  PID:12640
- C:\Windows\System\TlogAPg.exe
  C:\Windows\System\TlogAPg.exe
  2⤵
  PID:12668
- C:\Windows\System\yFiNtZp.exe
  C:\Windows\System\yFiNtZp.exe
  2⤵
  PID:12692
- C:\Windows\System\wTlbBtX.exe
  C:\Windows\System\wTlbBtX.exe
  2⤵
  PID:12740
- C:\Windows\System\DQjEhNA.exe
  C:\Windows\System\DQjEhNA.exe
  2⤵
  PID:12772
- C:\Windows\System\gJuwvmG.exe
  C:\Windows\System\gJuwvmG.exe
  2⤵
  PID:12800
- C:\Windows\System\vodAHZH.exe
  C:\Windows\System\vodAHZH.exe
  2⤵
  PID:12836
- C:\Windows\System\ILpMWII.exe
  C:\Windows\System\ILpMWII.exe
  2⤵
  PID:12856
- C:\Windows\System\djUhijw.exe
  C:\Windows\System\djUhijw.exe
  2⤵
  PID:12892
- C:\Windows\System\PnYQFph.exe
  C:\Windows\System\PnYQFph.exe
  2⤵
  PID:12932
- C:\Windows\System\qszrhhW.exe
  C:\Windows\System\qszrhhW.exe
  2⤵
  PID:12960
- C:\Windows\System\edTuGam.exe
  C:\Windows\System\edTuGam.exe
  2⤵
  PID:12976
- C:\Windows\System\rnhNpCN.exe
  C:\Windows\System\rnhNpCN.exe
  2⤵
  PID:13016
- C:\Windows\System\ELszsbC.exe
  C:\Windows\System\ELszsbC.exe
  2⤵
  PID:13044
- C:\Windows\System\RsiamBd.exe
  C:\Windows\System\RsiamBd.exe
  2⤵
  PID:13064
- C:\Windows\System\wcDXYMo.exe
  C:\Windows\System\wcDXYMo.exe
  2⤵
  PID:13092
- C:\Windows\System\PJzsfFV.exe
  C:\Windows\System\PJzsfFV.exe
  2⤵
  PID:13112
- C:\Windows\System\ZSYeDtz.exe
  C:\Windows\System\ZSYeDtz.exe
  2⤵
  PID:13128
- C:\Windows\System\WuOtCiw.exe
  C:\Windows\System\WuOtCiw.exe
  2⤵
  PID:13144
- C:\Windows\System\ajvDLsQ.exe
  C:\Windows\System\ajvDLsQ.exe
  2⤵
  PID:13176
- C:\Windows\System\aTYjbqG.exe
  C:\Windows\System\aTYjbqG.exe
  2⤵
  PID:13216
- C:\Windows\System\UqpGWEg.exe
  C:\Windows\System\UqpGWEg.exe
  2⤵
  PID:13252
- C:\Windows\System\fGWtmMr.exe
  C:\Windows\System\fGWtmMr.exe
  2⤵
  PID:13288
- C:\Windows\System\kRPLrKg.exe
  C:\Windows\System\kRPLrKg.exe
  2⤵
  PID:11444
- C:\Windows\System\DdsPgjZ.exe
  C:\Windows\System\DdsPgjZ.exe
  2⤵
  PID:12340
- C:\Windows\System\LLbsEhQ.exe
  C:\Windows\System\LLbsEhQ.exe
  2⤵
  PID:12376
- C:\Windows\System\eoNuUVU.exe
  C:\Windows\System\eoNuUVU.exe
  2⤵
  PID:12452
- C:\Windows\System\RCznffs.exe
  C:\Windows\System\RCznffs.exe
  2⤵
  PID:12500
- C:\Windows\System\QoxvHXZ.exe
  C:\Windows\System\QoxvHXZ.exe
  2⤵
  PID:12592
- C:\Windows\System\VEJnpOA.exe
  C:\Windows\System\VEJnpOA.exe
  2⤵
  PID:12680
- C:\Windows\System\JQQZypm.exe
  C:\Windows\System\JQQZypm.exe
  2⤵
  PID:12712
- C:\Windows\System\ZnuFKkf.exe
  C:\Windows\System\ZnuFKkf.exe
  2⤵
  PID:12820
- C:\Windows\System\DTdNlvb.exe
  C:\Windows\System\DTdNlvb.exe
  2⤵
  PID:12908
- C:\Windows\System\RLyJXVv.exe
  C:\Windows\System\RLyJXVv.exe
  2⤵
  PID:12968
- C:\Windows\System\pVNzNpm.exe
  C:\Windows\System\pVNzNpm.exe
  2⤵
  PID:13076
- C:\Windows\System\cOlWgTg.exe
  C:\Windows\System\cOlWgTg.exe
  2⤵
  PID:13124
- C:\Windows\System\AipdelI.exe
  C:\Windows\System\AipdelI.exe
  2⤵
  PID:13172
- C:\Windows\System\VHihuKo.exe
  C:\Windows\System\VHihuKo.exe
  2⤵
  PID:13208
- C:\Windows\System\lrCIBPd.exe
  C:\Windows\System\lrCIBPd.exe
  2⤵
  PID:13308
- C:\Windows\System\TaXNzLw.exe
  C:\Windows\System\TaXNzLw.exe
  2⤵
  PID:12296
- C:\Windows\System\rwOJsbF.exe
  C:\Windows\System\rwOJsbF.exe
  2⤵
  PID:12624
- C:\Windows\System\seYhVbk.exe
  C:\Windows\System\seYhVbk.exe
  2⤵
  PID:12784
- C:\Windows\System\rNUCGyh.exe
  C:\Windows\System\rNUCGyh.exe
  2⤵
  PID:12924
- C:\Windows\System\mlfgpgh.exe
  C:\Windows\System\mlfgpgh.exe
  2⤵
  PID:13244
- C:\Windows\System\OHfVYal.exe
  C:\Windows\System\OHfVYal.exe
  2⤵
  PID:12536
- C:\Windows\System\iZgimpl.exe
  C:\Windows\System\iZgimpl.exe
  2⤵
  PID:12560
- C:\Windows\System\CYpskcL.exe
  C:\Windows\System\CYpskcL.exe
  2⤵
  PID:13204
- C:\Windows\System\LcQunuS.exe
  C:\Windows\System\LcQunuS.exe
  2⤵
  PID:13108
- C:\Windows\System\seKCuTS.exe
  C:\Windows\System\seKCuTS.exe
  2⤵
  PID:13320
- C:\Windows\System\tVjJRLa.exe
  C:\Windows\System\tVjJRLa.exe
  2⤵
  PID:13348
- C:\Windows\System\kdegFLA.exe
  C:\Windows\System\kdegFLA.exe
  2⤵
  PID:13372
- C:\Windows\System\UnwDAsk.exe
  C:\Windows\System\UnwDAsk.exe
  2⤵
  PID:13396
- C:\Windows\System\blCZkAI.exe
  C:\Windows\System\blCZkAI.exe
  2⤵
  PID:13428
- C:\Windows\System\KiMZyxw.exe
  C:\Windows\System\KiMZyxw.exe
  2⤵
  PID:13476
- C:\Windows\System\bGUImHh.exe
  C:\Windows\System\bGUImHh.exe
  2⤵
  PID:13492
- C:\Windows\System\qJJJCZR.exe
  C:\Windows\System\qJJJCZR.exe
  2⤵
  PID:13520
- C:\Windows\System\fPboUPR.exe
  C:\Windows\System\fPboUPR.exe
  2⤵
  PID:13552
- C:\Windows\System\jIJAlNm.exe
  C:\Windows\System\jIJAlNm.exe
  2⤵
  PID:13576
- C:\Windows\System\NPJTOsc.exe
  C:\Windows\System\NPJTOsc.exe
  2⤵
  PID:13604
- C:\Windows\System\VWjiiJt.exe
  C:\Windows\System\VWjiiJt.exe
  2⤵
  PID:13644
- C:\Windows\System\JgYPQyA.exe
  C:\Windows\System\JgYPQyA.exe
  2⤵
  PID:13672
- C:\Windows\System\GhibWmB.exe
  C:\Windows\System\GhibWmB.exe
  2⤵
  PID:13688
- C:\Windows\System\RttAyhc.exe
  C:\Windows\System\RttAyhc.exe
  2⤵
  PID:13704
- C:\Windows\System\uAQbUtD.exe
  C:\Windows\System\uAQbUtD.exe
  2⤵
  PID:13732
- C:\Windows\System\JaACWzC.exe
  C:\Windows\System\JaACWzC.exe
  2⤵
  PID:13760
- C:\Windows\System\bqupXiq.exe
  C:\Windows\System\bqupXiq.exe
  2⤵
  PID:13784
- C:\Windows\System\nbGRWoa.exe
  C:\Windows\System\nbGRWoa.exe
  2⤵
  PID:13812
- C:\Windows\System\BGNMHLR.exe
  C:\Windows\System\BGNMHLR.exe
  2⤵
  PID:13848
- C:\Windows\System\IQanqRH.exe
  C:\Windows\System\IQanqRH.exe
  2⤵
  PID:13880
- C:\Windows\System\QJoSXkl.exe
  C:\Windows\System\QJoSXkl.exe
  2⤵
  PID:13912
- C:\Windows\System\EeTbJws.exe
  C:\Windows\System\EeTbJws.exe
  2⤵
  PID:13936
- C:\Windows\System\ZhiZGQI.exe
  C:\Windows\System\ZhiZGQI.exe
  2⤵
  PID:13960
- C:\Windows\System\YWDauLS.exe
  C:\Windows\System\YWDauLS.exe
  2⤵
  PID:13992
- C:\Windows\System\hcjQnfx.exe
  C:\Windows\System\hcjQnfx.exe
  2⤵
  PID:14020
- C:\Windows\System\BxRtwZI.exe
  C:\Windows\System\BxRtwZI.exe
  2⤵
  PID:14044
- C:\Windows\System\zbImULE.exe
  C:\Windows\System\zbImULE.exe
  2⤵
  PID:14076
- C:\Windows\System\cRdGiDj.exe
  C:\Windows\System\cRdGiDj.exe
  2⤵
  PID:14104
- C:\Windows\System\tAublCw.exe
  C:\Windows\System\tAublCw.exe
  2⤵
  PID:14128
- C:\Windows\System\NDBtMgq.exe
  C:\Windows\System\NDBtMgq.exe
  2⤵
  PID:14156
- C:\Windows\System\pVUIATi.exe
  C:\Windows\System\pVUIATi.exe
  2⤵
  PID:14184
- C:\Windows\System\LPjYUjh.exe
  C:\Windows\System\LPjYUjh.exe
  2⤵
  PID:14208
- C:\Windows\System\MesZJtX.exe
  C:\Windows\System\MesZJtX.exe
  2⤵
  PID:14236
- C:\Windows\System\XHKOLjp.exe
  C:\Windows\System\XHKOLjp.exe
  2⤵
  PID:14260
- C:\Windows\System\QgXXCOW.exe
  C:\Windows\System\QgXXCOW.exe
  2⤵
  PID:14280
- C:\Windows\System\WlIGLaP.exe
  C:\Windows\System\WlIGLaP.exe
  2⤵
  PID:14312
- C:\Windows\System\RZjRcQE.exe
  C:\Windows\System\RZjRcQE.exe
  2⤵
  PID:14332
- C:\Windows\System\qehRWQR.exe
  C:\Windows\System\qehRWQR.exe
  2⤵
  PID:13380
- C:\Windows\System\LnNuSAG.exe
  C:\Windows\System\LnNuSAG.exe
  2⤵
  PID:13460
- C:\Windows\System\UhevbOl.exe
  C:\Windows\System\UhevbOl.exe
  2⤵
  PID:13516
- C:\Windows\System\XSDgsEu.exe
  C:\Windows\System\XSDgsEu.exe
  2⤵
  PID:13656
- C:\Windows\System\OUHfoDf.exe
  C:\Windows\System\OUHfoDf.exe
  2⤵
  PID:13696
- C:\Windows\System\tTVvAFA.exe
  C:\Windows\System\tTVvAFA.exe
  2⤵
  PID:13756
- C:\Windows\System\iLaTZMX.exe
  C:\Windows\System\iLaTZMX.exe
  2⤵
  PID:13836
- C:\Windows\System\mXHADKi.exe
  C:\Windows\System\mXHADKi.exe
  2⤵
  PID:13872
- C:\Windows\System\lyBpzGu.exe
  C:\Windows\System\lyBpzGu.exe
  2⤵
  PID:13952
- C:\Windows\System\NPafmbA.exe
  C:\Windows\System\NPafmbA.exe
  2⤵
  PID:14008
- C:\Windows\System\PxekssI.exe
  C:\Windows\System\PxekssI.exe
  2⤵
  PID:14060
- C:\Windows\System\hNuvjhI.exe
  C:\Windows\System\hNuvjhI.exe
  2⤵
  PID:14136
- C:\Windows\System\kPnWGgJ.exe
  C:\Windows\System\kPnWGgJ.exe
  2⤵
  PID:14168
- C:\Windows\System\aSLUeTp.exe
  C:\Windows\System\aSLUeTp.exe
  2⤵
  PID:14296
- C:\Windows\System\rxdraMY.exe
  C:\Windows\System\rxdraMY.exe
  2⤵
  PID:14276
- C:\Windows\System\mcjtgCM.exe
  C:\Windows\System\mcjtgCM.exe
  2⤵
  PID:13388
- C:\Windows\System\QrkyWOD.exe
  C:\Windows\System\QrkyWOD.exe
  2⤵
  PID:13624
- C:\Windows\System\TLBiXPS.exe
  C:\Windows\System\TLBiXPS.exe
  2⤵
  PID:13728
- C:\Windows\System\hbTKQoR.exe
  C:\Windows\System\hbTKQoR.exe
  2⤵
  PID:13876
- C:\Windows\System\wWbEhgl.exe
  C:\Windows\System\wWbEhgl.exe
  2⤵
  PID:14088
- C:\Windows\System\jfNSndC.exe
  C:\Windows\System\jfNSndC.exe
  2⤵
  PID:14200
- C:\Windows\System\ibFfBtg.exe
  C:\Windows\System\ibFfBtg.exe
  2⤵
  PID:14252
- C:\Windows\System\DRZDqRm.exe
  C:\Windows\System\DRZDqRm.exe
  2⤵
  PID:13664
- C:\Windows\System\VmQebNZ.exe
  C:\Windows\System\VmQebNZ.exe
  2⤵
  PID:13948
- C:\Windows\System\GbjwORv.exe
  C:\Windows\System\GbjwORv.exe
  2⤵
  PID:14032
- C:\Windows\System\dnAOJns.exe
  C:\Windows\System\dnAOJns.exe
  2⤵
  PID:13980
- C:\Windows\System\kGFxJfK.exe
  C:\Windows\System\kGFxJfK.exe
  2⤵
  PID:14364
- C:\Windows\System\EGaNUxu.exe
  C:\Windows\System\EGaNUxu.exe
  2⤵
  PID:14384
- C:\Windows\System\wJPdTog.exe
  C:\Windows\System\wJPdTog.exe
  2⤵
  PID:14408
- C:\Windows\System\iwChvIC.exe
  C:\Windows\System\iwChvIC.exe
  2⤵
  PID:14428
- C:\Windows\System\pGjnvMK.exe
  C:\Windows\System\pGjnvMK.exe
  2⤵
  PID:14456
- C:\Windows\System\AHGzaEc.exe
  C:\Windows\System\AHGzaEc.exe
  2⤵
  PID:14492
- C:\Windows\System\MdEfhuV.exe
  C:\Windows\System\MdEfhuV.exe
  2⤵
  PID:14552
- C:\Windows\System\DrlQxMJ.exe
  C:\Windows\System\DrlQxMJ.exe
  2⤵
  PID:14568
- C:\Windows\System\HbGonLv.exe
  C:\Windows\System\HbGonLv.exe
  2⤵
  PID:14596
- C:\Windows\System\leFUYHF.exe
  C:\Windows\System\leFUYHF.exe
  2⤵
  PID:14624
- C:\Windows\System\ypvixeL.exe
  C:\Windows\System\ypvixeL.exe
  2⤵
  PID:14652
- C:\Windows\System\rySFViq.exe
  C:\Windows\System\rySFViq.exe
  2⤵
  PID:14688
- C:\Windows\System\LwyIXRu.exe
  C:\Windows\System\LwyIXRu.exe
  2⤵
  PID:14728
- C:\Windows\System\eUqQQuO.exe
  C:\Windows\System\eUqQQuO.exe
  2⤵
  PID:14744
- C:\Windows\System\MzkdkfD.exe
  C:\Windows\System\MzkdkfD.exe
  2⤵
  PID:14760
- C:\Windows\System\rgTrGTE.exe
  C:\Windows\System\rgTrGTE.exe
  2⤵
  PID:14784
- C:\Windows\System\uagLTqz.exe
  C:\Windows\System\uagLTqz.exe
  2⤵
  PID:14832
- C:\Windows\System\aoNsLnO.exe
  C:\Windows\System\aoNsLnO.exe
  2⤵
  PID:14860
- C:\Windows\System\ZIdQeVM.exe
  C:\Windows\System\ZIdQeVM.exe
  2⤵
  PID:14888
- C:\Windows\System\qDhnKZN.exe
  C:\Windows\System\qDhnKZN.exe
  2⤵
  PID:14908
- C:\Windows\System\JxeMlck.exe
  C:\Windows\System\JxeMlck.exe
  2⤵
  PID:14948
- C:\Windows\System\ecgwbDZ.exe
  C:\Windows\System\ecgwbDZ.exe
  2⤵
  PID:14980
- C:\Windows\System\pdiAYnP.exe
  C:\Windows\System\pdiAYnP.exe
  2⤵
  PID:15004
- C:\Windows\System\rxKxekg.exe
  C:\Windows\System\rxKxekg.exe
  2⤵
  PID:15040
- C:\Windows\System\hhujexc.exe
  C:\Windows\System\hhujexc.exe
  2⤵
  PID:15060
- C:\Windows\System\abaKvsc.exe
  C:\Windows\System\abaKvsc.exe
  2⤵
  PID:15112
- C:\Windows\System\dItsmzt.exe
  C:\Windows\System\dItsmzt.exe
  2⤵
  PID:15140
- C:\Windows\System\NfaUcnF.exe
  C:\Windows\System\NfaUcnF.exe
  2⤵
  PID:15168
- C:\Windows\System\wIuJoMX.exe
  C:\Windows\System\wIuJoMX.exe
  2⤵
  PID:15184
- C:\Windows\System\joXzrZn.exe
  C:\Windows\System\joXzrZn.exe
  2⤵
  PID:15212
- C:\Windows\System\KKdGfaB.exe
  C:\Windows\System\KKdGfaB.exe
  2⤵
  PID:15236
- C:\Windows\System\buryUzQ.exe
  C:\Windows\System\buryUzQ.exe
  2⤵
  PID:15256
- C:\Windows\System\gRyFAXZ.exe
  C:\Windows\System\gRyFAXZ.exe
  2⤵
  PID:15308
- C:\Windows\System\eHVRJxm.exe
  C:\Windows\System\eHVRJxm.exe
  2⤵
  PID:15328
- C:\Windows\System\KLZWAMH.exe
  C:\Windows\System\KLZWAMH.exe
  2⤵
  PID:14344
- C:\Windows\System\iGvyPzn.exe
  C:\Windows\System\iGvyPzn.exe
  2⤵
  PID:14392
- C:\Windows\System\NkVYBiK.exe
  C:\Windows\System\NkVYBiK.exe
  2⤵
  PID:14452
- C:\Windows\System\AMxpKKx.exe
  C:\Windows\System\AMxpKKx.exe
  2⤵
  PID:14516
- C:\Windows\System\ZHFSozm.exe
  C:\Windows\System\ZHFSozm.exe
  2⤵
  PID:14608
- C:\Windows\System\kInCMMg.exe
  C:\Windows\System\kInCMMg.exe
  2⤵
  PID:14684
- C:\Windows\System\PZyzRnG.exe
  C:\Windows\System\PZyzRnG.exe
  2⤵
  PID:14724
- C:\Windows\System\bLLTGWi.exe
  C:\Windows\System\bLLTGWi.exe
  2⤵
  PID:14812
- C:\Windows\System\UPAYkbe.exe
  C:\Windows\System\UPAYkbe.exe
  2⤵
  PID:14852
- C:\Windows\System\kdYJOSG.exe
  C:\Windows\System\kdYJOSG.exe
  2⤵
  PID:14972
- C:\Windows\System\HMuZJUB.exe
  C:\Windows\System\HMuZJUB.exe
  2⤵
  PID:15032
- C:\Windows\System\NywVpzZ.exe
  C:\Windows\System\NywVpzZ.exe
  2⤵
  PID:15084
- C:\Windows\System\QZnsKDA.exe
  C:\Windows\System\QZnsKDA.exe
  2⤵
  PID:15136
- C:\Windows\System\OZHoCfl.exe
  C:\Windows\System\OZHoCfl.exe
  2⤵
  PID:15208
- C:\Windows\System\WSdfCVy.exe
  C:\Windows\System\WSdfCVy.exe
  2⤵
  PID:15252
- C:\Windows\System\fHHfcdr.exe
  C:\Windows\System\fHHfcdr.exe
  2⤵
  PID:15324
- C:\Windows\System\WIzqCZi.exe
  C:\Windows\System\WIzqCZi.exe
  2⤵
  PID:14404
- C:\Windows\System\ybVxWmB.exe
  C:\Windows\System\ybVxWmB.exe
  2⤵
  PID:14480
- C:\Windows\System\OAhHAuf.exe
  C:\Windows\System\OAhHAuf.exe
  2⤵
  PID:14776
- C:\Windows\System\wBLtWwY.exe
  C:\Windows\System\wBLtWwY.exe
  2⤵
  PID:14844
- C:\Windows\System\uUzuUrw.exe
  C:\Windows\System\uUzuUrw.exe
  2⤵
  PID:15012
- C:\Windows\System\EHKDDUI.exe
  C:\Windows\System\EHKDDUI.exe
  2⤵
  PID:15164
- C:\Windows\System\MNXTfey.exe
  C:\Windows\System\MNXTfey.exe
  2⤵
  PID:14380
- C:\Windows\System\oyLpgNl.exe
  C:\Windows\System\oyLpgNl.exe
  2⤵
  PID:14680
- C:\Windows\System\QUNDnFR.exe
  C:\Windows\System\QUNDnFR.exe
  2⤵
  PID:15000
- C:\Windows\System\FdXAwVa.exe
  C:\Windows\System\FdXAwVa.exe
  2⤵
  PID:15276
- C:\Windows\System\vFQLNrS.exe
  C:\Windows\System\vFQLNrS.exe
  2⤵
  PID:15104
- C:\Windows\System\bFfqsxS.exe
  C:\Windows\System\bFfqsxS.exe
  2⤵
  PID:15376
- C:\Windows\System\jzpWuJB.exe
  C:\Windows\System\jzpWuJB.exe
  2⤵
  PID:15408
- C:\Windows\System\wKrWqtC.exe
  C:\Windows\System\wKrWqtC.exe
  2⤵
  PID:15448
- C:\Windows\System\mQzofJX.exe
  C:\Windows\System\mQzofJX.exe
  2⤵
  PID:15476
- C:\Windows\System\ZUBGxac.exe
  C:\Windows\System\ZUBGxac.exe
  2⤵
  PID:15504
- C:\Windows\System\RhvVrOI.exe
  C:\Windows\System\RhvVrOI.exe
  2⤵
  PID:15532
- C:\Windows\System\gyFpVrC.exe
  C:\Windows\System\gyFpVrC.exe
  2⤵
  PID:15560
- C:\Windows\System\WncwYvf.exe
  C:\Windows\System\WncwYvf.exe
  2⤵
  PID:15576
- C:\Windows\System\scLxiEa.exe
  C:\Windows\System\scLxiEa.exe
  2⤵
  PID:15592
- C:\Windows\System\EwoDedz.exe
  C:\Windows\System\EwoDedz.exe
  2⤵
  PID:15624
- C:\Windows\System\HkDcbgy.exe
  C:\Windows\System\HkDcbgy.exe
  2⤵
  PID:15652
- C:\Windows\System\lGHURBW.exe
  C:\Windows\System\lGHURBW.exe
  2⤵
  PID:15672
- C:\Windows\System\utGxtMb.exe
  C:\Windows\System\utGxtMb.exe
  2⤵
  PID:15700
- C:\Windows\System\dlkRTAi.exe
  C:\Windows\System\dlkRTAi.exe
  2⤵
  PID:15724
- C:\Windows\System\UHNLCrB.exe
  C:\Windows\System\UHNLCrB.exe
  2⤵
  PID:15752
- C:\Windows\System\EhSkcbT.exe
  C:\Windows\System\EhSkcbT.exe
  2⤵
  PID:15792
- C:\Windows\System\kSghyEX.exe
  C:\Windows\System\kSghyEX.exe
  2⤵
  PID:15816
- C:\Windows\System\QqFZEVc.exe
  C:\Windows\System\QqFZEVc.exe
  2⤵
  PID:15852
- C:\Windows\System\qVILTtS.exe
  C:\Windows\System\qVILTtS.exe
  2⤵
  PID:15896
- C:\Windows\System\CoacfqV.exe
  C:\Windows\System\CoacfqV.exe
  2⤵
  PID:15912
- C:\Windows\System\ZbNVhME.exe
  C:\Windows\System\ZbNVhME.exe
  2⤵
  PID:15952
- C:\Windows\System\RxfMqyf.exe
  C:\Windows\System\RxfMqyf.exe
  2⤵
  PID:15980
- C:\Windows\System\DwhJLuc.exe
  C:\Windows\System\DwhJLuc.exe
  2⤵
  PID:16004
- C:\Windows\System\qraDuuI.exe
  C:\Windows\System\qraDuuI.exe
  2⤵
  PID:16020
- C:\Windows\System\ZGvtDEV.exe
  C:\Windows\System\ZGvtDEV.exe
  2⤵
  PID:16064
- C:\Windows\System\hMJvRku.exe
  C:\Windows\System\hMJvRku.exe
  2⤵
  PID:16084
- C:\Windows\System\rpsyRut.exe
  C:\Windows\System\rpsyRut.exe
  2⤵
  PID:16108
- C:\Windows\System\fvLIBTX.exe
  C:\Windows\System\fvLIBTX.exe
  2⤵
  PID:16148
- C:\Windows\System\QWayYQB.exe
  C:\Windows\System\QWayYQB.exe
  2⤵
  PID:16164
- C:\Windows\System\nCgPcZQ.exe
  C:\Windows\System\nCgPcZQ.exe
  2⤵
  PID:16184
- C:\Windows\System\yowctHc.exe
  C:\Windows\System\yowctHc.exe
  2⤵
  PID:16216
- C:\Windows\System\gsbxNIr.exe
  C:\Windows\System\gsbxNIr.exe
  2⤵
  PID:16248
- C:\Windows\System\LPbEMaC.exe
  C:\Windows\System\LPbEMaC.exe
  2⤵
  PID:16264
- C:\Windows\System\FLdSogj.exe
  C:\Windows\System\FLdSogj.exe
  2⤵
  PID:16288
- C:\Windows\System\zaVoowj.exe
  C:\Windows\System\zaVoowj.exe
  2⤵
  PID:16344
- C:\Windows\System\XFzyArf.exe
  C:\Windows\System\XFzyArf.exe
  2⤵
  PID:16364
- C:\Windows\System\HSbATYP.exe
  C:\Windows\System\HSbATYP.exe
  2⤵
  PID:15384
- C:\Windows\System\aWmHFPW.exe
  C:\Windows\System\aWmHFPW.exe
  2⤵
  PID:15440
- C:\Windows\System\IpIHZIn.exe
  C:\Windows\System\IpIHZIn.exe
  2⤵
  PID:15516
- C:\Windows\System\rEzHIZc.exe
  C:\Windows\System\rEzHIZc.exe
  2⤵
  PID:15548
- C:\Windows\System\tqttowv.exe
  C:\Windows\System\tqttowv.exe
  2⤵
  PID:15836
- C:\Windows\System\fJBOHNG.exe
  C:\Windows\System\fJBOHNG.exe
  2⤵
  PID:15928
- C:\Windows\System\GFLSzVb.exe
  C:\Windows\System\GFLSzVb.exe
  2⤵
  PID:16028
- C:\Windows\System\gnhnQFj.exe
  C:\Windows\System\gnhnQFj.exe
  2⤵
  PID:16072
- C:\Windows\System\KkUPeHh.exe
  C:\Windows\System\KkUPeHh.exe
  2⤵
  PID:16132
- C:\Windows\System\QxkhoYd.exe
  C:\Windows\System\QxkhoYd.exe
  2⤵
  PID:16212
- C:\Windows\System\zwMKeSb.exe
  C:\Windows\System\zwMKeSb.exe
  2⤵
  PID:16276
- C:\Windows\System\MegFbYJ.exe
  C:\Windows\System\MegFbYJ.exe
  2⤵
  PID:16256
- C:\Windows\System\KYzWzJQ.exe
  C:\Windows\System\KYzWzJQ.exe
  2⤵
  PID:16352
- C:\Windows\System\PhixyCA.exe
  C:\Windows\System\PhixyCA.exe
  2⤵
  PID:15584
- C:\Windows\System\CHkKxVD.exe
  C:\Windows\System\CHkKxVD.exe
  2⤵
  PID:15660
- C:\Windows\System\GCnNool.exe
  C:\Windows\System\GCnNool.exe
  2⤵
  PID:15696
- C:\Windows\System\ujlWPjd.exe
  C:\Windows\System\ujlWPjd.exe
  2⤵
  PID:15712
- C:\Windows\System\lHeJdHj.exe
  C:\Windows\System\lHeJdHj.exe
  2⤵
  PID:15872
- C:\Windows\System\DuorEwf.exe
  C:\Windows\System\DuorEwf.exe
  2⤵
  PID:15844
- C:\Windows\System\xFWhQkV.exe
  C:\Windows\System\xFWhQkV.exe
  2⤵
  PID:16048
- C:\Windows\System\YJatTnJ.exe
  C:\Windows\System\YJatTnJ.exe
  2⤵
  PID:16228
- C:\Windows\System\EWDsQEA.exe
  C:\Windows\System\EWDsQEA.exe
  2⤵
  PID:15428
- C:\Windows\System\XLOfuOf.exe
  C:\Windows\System\XLOfuOf.exe
  2⤵
  PID:15664
- C:\Windows\System\paesPJP.exe
  C:\Windows\System\paesPJP.exe
  2⤵
  PID:15808
- C:\Windows\System\HMHpARg.exe
  C:\Windows\System\HMHpARg.exe
  2⤵
  PID:15908
- C:\Windows\System\zIssPTz.exe
  C:\Windows\System\zIssPTz.exe
  2⤵
  PID:16316
- C:\Windows\System\fVSXokf.exe
  C:\Windows\System\fVSXokf.exe
  2⤵
  PID:16016
- C:\Windows\System\faTMqdx.exe
  C:\Windows\System\faTMqdx.exe
  2⤵
  PID:16396
- C:\Windows\System\yYIHtGY.exe
  C:\Windows\System\yYIHtGY.exe
  2⤵
  PID:16420
- C:\Windows\System\yFfyAEO.exe
  C:\Windows\System\yFfyAEO.exe
  2⤵
  PID:16436
- C:\Windows\System\kXQiQdl.exe
  C:\Windows\System\kXQiQdl.exe
  2⤵
  PID:16472
- C:\Windows\System\xWEzJIl.exe
  C:\Windows\System\xWEzJIl.exe
  2⤵
  PID:16492
- C:\Windows\System\bTpaPSA.exe
  C:\Windows\System\bTpaPSA.exe
  2⤵
  PID:16516
- C:\Windows\System\xPumYFt.exe
  C:\Windows\System\xPumYFt.exe
  2⤵
  PID:16536
- C:\Windows\System\tqgXQtF.exe
  C:\Windows\System\tqgXQtF.exe
  2⤵
  PID:16568
- C:\Windows\System\uKeLyeW.exe
  C:\Windows\System\uKeLyeW.exe
  2⤵
  PID:16596
- C:\Windows\System\evWvOtk.exe
  C:\Windows\System\evWvOtk.exe
  2⤵
  PID:16648
- C:\Windows\System\gtwSknw.exe
  C:\Windows\System\gtwSknw.exe
  2⤵
  PID:16696
- C:\Windows\System\ggMAOCz.exe
  C:\Windows\System\ggMAOCz.exe
  2⤵
  PID:16724
- C:\Windows\System\AcTQETh.exe
  C:\Windows\System\AcTQETh.exe
  2⤵
  PID:16740
- C:\Windows\System\btrBbBf.exe
  C:\Windows\System\btrBbBf.exe
  2⤵
  PID:16768
- C:\Windows\System\hVHcoTG.exe
  C:\Windows\System\hVHcoTG.exe
  2⤵
  PID:16796
- C:\Windows\System\YhhblrL.exe
  C:\Windows\System\YhhblrL.exe
  2⤵
  PID:16812
- C:\Windows\System\EjpdGAu.exe
  C:\Windows\System\EjpdGAu.exe
  2⤵
  PID:16832
- C:\Windows\System\PoFDoOl.exe
  C:\Windows\System\PoFDoOl.exe
  2⤵
  PID:16852
- C:\Windows\System\WPCXZiE.exe
  C:\Windows\System\WPCXZiE.exe
  2⤵
  PID:16872
- C:\Windows\System\qYoPZJQ.exe
  C:\Windows\System\qYoPZJQ.exe
  2⤵
  PID:16896
- C:\Windows\System\zCzADvU.exe
  C:\Windows\System\zCzADvU.exe
  2⤵
  PID:16924
- C:\Windows\System\DcJQZwy.exe
  C:\Windows\System\DcJQZwy.exe
  2⤵
  PID:16944
- C:\Windows\System\DsTXBUm.exe
  C:\Windows\System\DsTXBUm.exe
  2⤵
  PID:17032
- C:\Windows\System\zXHUSOq.exe
  C:\Windows\System\zXHUSOq.exe
  2⤵
  PID:17056
- C:\Windows\System\DWzRVUD.exe
  C:\Windows\System\DWzRVUD.exe
  2⤵
  PID:17076
- C:\Windows\System\JsZIWBv.exe
  C:\Windows\System\JsZIWBv.exe
  2⤵
  PID:17092
- C:\Windows\System\FRphgVe.exe
  C:\Windows\System\FRphgVe.exe
  2⤵
  PID:17144
- C:\Windows\System\kAFzAID.exe
  C:\Windows\System\kAFzAID.exe
  2⤵
  PID:17160
- C:\Windows\System\rsHFQfH.exe
  C:\Windows\System\rsHFQfH.exe
  2⤵
  PID:17188
- C:\Windows\System\BKSofTR.exe
  C:\Windows\System\BKSofTR.exe
  2⤵
  PID:17216
- C:\Windows\System\DoyayJj.exe
  C:\Windows\System\DoyayJj.exe
  2⤵
  PID:17244
- C:\Windows\System\myfWINu.exe
  C:\Windows\System\myfWINu.exe
  2⤵
  PID:17260
- C:\Windows\System\kOBcXPF.exe
  C:\Windows\System\kOBcXPF.exe
  2⤵
  PID:17300
- C:\Windows\System\pFhAQwe.exe
  C:\Windows\System\pFhAQwe.exe
  2⤵
  PID:17340
- C:\Windows\System\pRrTLJj.exe
  C:\Windows\System\pRrTLJj.exe
  2⤵
  PID:17368
- C:\Windows\System\ktNeDGC.exe
  C:\Windows\System\ktNeDGC.exe
  2⤵
  PID:17396
- C:\Windows\System\UbrGpRt.exe
  C:\Windows\System\UbrGpRt.exe
  2⤵
  PID:16956

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:16504

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\AHzZVMj.exe

Filesize
1.4MB

MD5
7179b128a340b601fa63179675f9102a

SHA1
9194f3d2bcfa4ec3dfd346362bb159466b8055c0

SHA256
541d553a3d688431c762aeb29e837d66c999e96fbf602416c7505c852892b666

SHA512
199042fd5869d13c3dd7b98abcb0fcf96534add9987eb7bc40be31ce9a96f204f3b17612fcddff1f99c79d1d3e69d6da80d79eaff6c78794909e5b2b29b496c2

Download Submit
C:\Windows\System\BxwigHf.exe

Filesize
1.4MB

MD5
d38adbc23f8151da3f498b1ecb442cf6

SHA1
0b8a53eeda8351b875a4d4261abd92f45f6adb05

SHA256
69583d191b323e5eac7a4aaebc2e43cc0a38a0509c71cf94627e9be00e5900cf

SHA512
4780aede8b701908067c1438ade041b89ce7580555f753f978b2be33c4256112af9398e923ab42022e8c83c18c0b10261e92ddec44d41c7be63db8864d24e8a8

Download Submit
C:\Windows\System\DdbwyvO.exe

Filesize
1.4MB

MD5
139b72e7b47133e897d244e0c9aa4443

SHA1
43e831723fef1d2c0003368e56ade6123f006af0

SHA256
17eb7087cdca9174f53a4a10c57b7e4b808356a002827a9035ade702d1258693

SHA512
dc3b8469689b59c61ff230e2f5a58410d691af14101814e521355241f88afc183016285aaa48a26177eaaad3356a0de84116a565abd4e0f2ca8417581767b80d

Download Submit
C:\Windows\System\EqAuSGd.exe

Filesize
1.4MB

MD5
86aea8117edc51f186351cc27c0c7c95

SHA1
8c37e2932adacca838e18ecd1aaf5c2d9b99b6a5

SHA256
f9c4411d61d02dc179797713efb5f3ede678af40499b9b02edfd2b7c62857adb

SHA512
7fae6e3809abbb4e9e321043d2560ad18052225e8da92255507547340bbc6411f74307c6fb76724088f4a3646fe67431e8c344fd30ced1a01dbbc97bc5de5777

Download Submit
C:\Windows\System\FXMGGLZ.exe

Filesize
1.4MB

MD5
47f1698645c2d8ab72407cd4fb26a5f1

SHA1
5613acf6f2c9320280a0ad7e648a656707b99fa9

SHA256
c03bad5ac68e11312f2d1d5bca53de090a694bfa3aa70c08f3c45fc2d623e5de

SHA512
8c8891087c2eba43a78b8594495570ae53fa74a2ac69a6c38d2825e7a728014e7d55a5637eca5ebbb90d4d20ba3b4ac85f5198b4e840d1cf101847b621cbc45a

Download Submit
C:\Windows\System\FaZNimu.exe

Filesize
1.4MB

MD5
42661128d676e079551987809123dd3e

SHA1
8b6db4162c6e7c1895543246fe02964fa7598d14

SHA256
a308e0e94105fc5d63189963dd30f9ceefc0f7809a85a5721574b57e46d0c8a5

SHA512
af8b31ba7a023cdf5d291d4e9b7121e7fd366df58ec91125870969a035ec4c704ecc1847e3e3c2f5d3011dcdb939673a2beea6f1cbedf34b234161e1a7537264

Download Submit
C:\Windows\System\FsMrOZO.exe

Filesize
1.4MB

MD5
99b909d415ab303876f7575d72a0fddd

SHA1
314e736289a8d8481e5e686fa3cd23421582bbde

SHA256
d65beb7705a577e3a06b56213bcf10e58493c862c9d5faf8be166cd6a97212d1

SHA512
4550bd57b4d18047090f75d45c29abeb41e2e4eb06e415debc858e3a4e970516d9663b569deeeaae74970f57aed2a0a9e96b7a22922f12dcf747a02d55f66446

Download Submit
C:\Windows\System\HIIJHNL.exe

Filesize
1.4MB

MD5
beb9e63f0d29fd5539edc4c14e9d1b53

SHA1
1ea84b1993d39b30f117af1e1718bd55107000e8

SHA256
94a16f64398df23038526a6732d6138c435337fcedda88169247f20dd9f6bde7

SHA512
382e1833239804d890ec139505652b5a976887122347ef4480bd7fe4cd7e079cc34fe09bfa6c35be36ef2311e1c1feee07f2d7507832e11610e73cdec2a9e2bc

Download Submit
C:\Windows\System\HSRBBTd.exe

Filesize
1.4MB

MD5
9409fbb3cca343e6d0f2a1157517075b

SHA1
2d8203c207c8e56f20271230bb3dd2453f532ce3

SHA256
0a9f94d556146f03d408608f48715d40f80512e2a69c574e9433596ce6085560

SHA512
78a00eb2db1b333eca5d7f1bc6c8e88e09439496ba0a6f3bde36b2e1c46d6a384bf2a93ed4c066d59b3dfbed66cc84287baac42a78f7b1455fb9f95c5eaa07d8

Download Submit
C:\Windows\System\JUBXEpS.exe

Filesize
1.4MB

MD5
54be9b54b8d46f0e4cdbb09cb1371dd9

SHA1
8a266082e40340892d28120953a631c7053b2eb5

SHA256
d8ca82f5d13b2b6b282fe3421d462a73bfa12d02df2dbff9a6fc4ccd95572b46

SHA512
0354f0d04f466994502b31a55597793c2a9a4668d7ed291a266a218ea7f4eb555603220835c4c74f2859205467687742c62a99037a0213eee3772e5fe4b8a65f

Download Submit
C:\Windows\System\KZvqIfB.exe

Filesize
1.4MB

MD5
87f4a79f1678bea1f5ce3a1ac395612d

SHA1
9d634c1db27fda63edb88505a68e18a297775045

SHA256
692d5049220b5d26068b048663075c2ca7568107a7721f154164f56b5cd434e5

SHA512
310070ce6c918d12eebe2b0be0236bd7d590ed861a08617036edd625208b6a6500c12526c5ddd1072f9dccb50074b49cda53313a16e289bf31ca4f5161e21824

Download Submit
C:\Windows\System\NCaZQTl.exe

Filesize
1.4MB

MD5
239cc17dbaf0744f6493ba2d2965032d

SHA1
b87a84f86b290af921da6090a5a6e4c6bf112dbe

SHA256
193d9b3891c9976f8131207b649abf939d727fc29b6bae92ba3dd51677a7b141

SHA512
b8a92e842eabb13f9549f12d76a8a4b38d9aefb4a50a3892d075fa7ed5ec703843963e63139273ef0c810fc55910e395875cc172451fa0ff35c10a22b94c0b56

Download Submit
C:\Windows\System\NTLqqVe.exe

Filesize
1.4MB

MD5
c2c469a5f353a87ba58c21b8d77cb65c

SHA1
ecba74c5dd43664565d031aab0fbba2c3d9b1cbf

SHA256
b2011af8740eb1bd304a4f7ec3607ff4e2aab08fb9e40f4becaab517ed0adaf4

SHA512
3cf71ad4f3746234f441a16516c6a0be36a1278dcd64f73feeb33c2adae2d59ccdd966e7a389fa34098c09d13e32dba1c61641c4cf7b396bcd1bf5e55a2332f0

Download Submit
C:\Windows\System\PkXOVHT.exe

Filesize
1.4MB

MD5
beb36076c444e583bb7434a456a3a0d6

SHA1
1707f9ddc28800bec2f7c6bc963ed67be9cf93a5

SHA256
ff33adeca28221ad9e9b14652e7391b7af96afea23491c478ce01b7a7055a84b

SHA512
66e92626e39c3c7e90e732a054cf54118fe87e5c65f9c703c278439980b1911d9a86514ae7dde0eec398bae9c4574c231d788b5ab691391a77c8334520ef072a

Download Submit
C:\Windows\System\UDAQVMU.exe

Filesize
1.4MB

MD5
7bafa987bdbda8bce271956e1a3dee5b

SHA1
bca467b5af28eee94b401b3140e1562fcdb7c3b1

SHA256
603994a201cd0a9bb05548a9fd6258a23971defceb5247a3e6e9c6abffc6ecfc

SHA512
c11eac3aec164139c8afc9254ff6933da342dc4b2d462ef22f0ec8bbf847aff4df924fc192311eceb418dc25ef24626979608ff6fa0cfa458630bce449902c87

Download Submit
C:\Windows\System\VmegjiL.exe

Filesize
1.4MB

MD5
f7cfcbffb1ebecdb0c561a9e3a2e57b7

SHA1
416112c16feef9329029414cad7adf952bbc9fe1

SHA256
f0b773e5304b8a45d165c88ace9e51fd331548b00b126ce6bfee5d7f8905a35b

SHA512
937a7fa32843b406f3f3249dd6a8114aba526757bd00c3e235e0559f88bdec1addd3d454aca33925a1dba07d43e2445e3917ac55f6a315861857732838527573

Download Submit
C:\Windows\System\ahwwrZG.exe

Filesize
1.4MB

MD5
5b844a3eaad1e246035279de1d98376a

SHA1
bab3697d3d6aa718ea38d40909dcbed5c851117f

SHA256
6dc9c9bde6329c3e8843e1d129d45931f7520d27413d92f9e0b6f09d1085db92

SHA512
850426d1c825082bb612657366e81dc8eef2aa2bffaa6ba28f3bed842fec13b2200235dfc567821325a78c4f64656d06af6aabdab25d2a878e356588bdb8d0ee

Download Submit
C:\Windows\System\axrWkAe.exe

Filesize
1.4MB

MD5
6b6cc3be2fb4a0b72ab5510ced525dae

SHA1
04255000e41ecd3c5e3267a6a921a0fda13eca04

SHA256
39028f41a71979eb6bc57f84ccfc088136847269467b575f2f54c7b4e1f6acf1

SHA512
603575aa3cd57131b340ec052f946774a6cbcdcc62ca7a1fe6862fb7d3373f6225bcd50a9b069115704bd6d0f699be2c39a2fd8e5822802c7750216a261904b0

Download Submit
C:\Windows\System\bkdalWy.exe

Filesize
1.4MB

MD5
fa7ec02f83429d6c52c8536830645581

SHA1
7e58b36743b51e421bf21dcb5194e6768a785534

SHA256
936149289ee5353b243d76a0044a5796bba44c541f4d39073022c314b9719803

SHA512
66978c2356874d05015f43cb19e70fb24069e51f819193984ad498c4e0a39fcfa044f421f5d70a4f1b26f99e8b87b070b3b7bd6948451278702238ebda769994

Download Submit
C:\Windows\System\giKAEaI.exe

Filesize
1.4MB

MD5
4b9e446d8840651a60c640e6675d286a

SHA1
876d60f5e87234bdf0658e326d4e83ebe78fd5d1

SHA256
b46d23d634dc2a5b51ca56cd936b936851f87c19dfb257952805efa819acd241

SHA512
f14e3e34776acf179b0e1db7a51c6633e69257f13f4d9d74ecc1c83c201764327332bc0ee7419e11917075efdd6d02e3ff87d2db754d8706386177de7e38122d

Download Submit
C:\Windows\System\jnJQsmd.exe

Filesize
1.4MB

MD5
79559cb52a2ba0e0b06aff554d83d93d

SHA1
3fe683c2796992574b9a5a374199fa91bc9bb33b

SHA256
b412cb4b75e52f69508ee84a76f35b65f943efa07070ab20c991fc927267682f

SHA512
1a3475ceb60071e83c246f3a720afebaae8bd2531d55f67918f37e3a8227ba62ff536e803fab05b264f80f8afd110dbc7251005580eed82d57956a8026a4e809

Download Submit
C:\Windows\System\juedElg.exe

Filesize
1.4MB

MD5
17597d825ed73e0853231c07ae017e7d

SHA1
f473db70a4b33a696df1c13752f3517c06d3bde5

SHA256
19b319cff780479febfd302253522f00b1a5ef2ca724b172638bccfc5fcb038c

SHA512
851fd4cfad84e2a798957a945c5b83ee126e8309f44e962b3b530bf9467a2fa61c0beda867671cd0be7b74644df7aa31990d1a256e94ed4790800426587d60f0

Download Submit
C:\Windows\System\jvFEiPn.exe

Filesize
1.4MB

MD5
be1a4a7c3143dc7b9583254187e04e68

SHA1
60670bfc0be517162dfa819d0cf75a7cc4218610

SHA256
443b44af1f91d6a208a9001251a4a2c1787c029776801b18005e9b5c3f5b22a9

SHA512
673d029fd89466b79bd97d93e92b6d5ec7d391c13cf5cbc2c82ea39639cd715c739a8c6c0dd45c1a5a623cbfe4bd33325ed97905e5858b41e55435587557b9dc

Download Submit
C:\Windows\System\kCsaWmO.exe

Filesize
1.4MB

MD5
33934b0d70f387d1e70382ead9e7b6d8

SHA1
26de2da16607d5fcae8b664e667ecce9e45a9782

SHA256
1da3203efac4c4467b59af99ac85408620662d90a4d7697ef8554298a86b5f73

SHA512
a8c8f23e0a9f38de115a830c4167510fefd73212f41fe5890104d0fbde8e2fa210304f10e6a8802341b6f241baa3224e3ccd79b070c85204aa6a41af27795723

Download Submit
C:\Windows\System\kHxRwyh.exe

Filesize
1.4MB

MD5
44af08d44e7f06581b234a4a3a8f05a8

SHA1
d33231a53011277888a7d7aadd1a97b1fc26a1b7

SHA256
1d847b64546a37135e2e78ae4c37f63cdb6edca3e019f7fb28678180f76b8b40

SHA512
e55b67a89dad199ea77c0a53c68d485c989b5d1b4a5cd43e0d8a50c9e11d74857e39783a61f62c3665c486945dcfb8ebae6bea50f287ea3786ba00bfafb85a33

Download Submit
C:\Windows\System\sYVfsvo.exe

Filesize
1.4MB

MD5
e5da4f43a6365f49d0ba82227986a4ec

SHA1
1bac48f04c32f21e21355c00ceec602ad57262df

SHA256
77fd3b536eb729a401f034e3976672f27cd288fe80ddd1b2d6f251ef0f928277

SHA512
d5784983245b4ae9f36b29482bcad3ffee640f1f9039d83e74a35629acf1e0d8b7c894bcef3cdcf8f98b855f73d0d2487fd17b294458e85d262c56ea4e9e412b

Download Submit
C:\Windows\System\siHNtqr.exe

Filesize
1.4MB

MD5
523ce950d58a69c4288b515e38d6a0d1

SHA1
2aa615e9307cbaefbeaa73849a7ae7b672975c99

SHA256
84e2c62a3ecafdffd73240176fd05e6f7aed4939752e445580b7b2aa9142b2ec

SHA512
7d257e2c5d782eb1ce0239898b09f0a8140b1d9e465b9d7d3b561b95ff3b7ea46c22be439c6f05da30bd197591525fa92eda7b9b9d62d0d3b628953b4790572f

Download Submit
C:\Windows\System\tAyKMSD.exe

Filesize
1.4MB

MD5
dc17a633fc02e8524a4dc7336c3d9d06

SHA1
53e8b7356752e45b0ba144736938b8d1336c0568

SHA256
7a5f29b675269b64796e3bebe6d6eb6d54506ec981fe1ea43edaaf9d6ace864b

SHA512
d46a75eccbfaa18cc2e77c2335350eed8835093ff8bd0320559e35df3fc0c924cff3f0b9621a90a49de93546563698f44dc57d6975cef4756d7cdf2468035474

Download Submit
C:\Windows\System\tNTHZEb.exe

Filesize
1.4MB

MD5
951b2b8b5a5d879597b4172674933f24

SHA1
65ea73f57df384d966140ed73cde88905ef0dd99

SHA256
870df40cd84705c1b3d4110198c9132a6734d8574b657e4793f6b1d2362d0fe0

SHA512
116c899939f8c17fb2125c0f1de1f3a52051d72275e2336282439242a5c3912217f123b5c9a213749c72c84cfe5c77d6a497b3848d11f44bc291367a1033c1c5

Download Submit
C:\Windows\System\vpPnTXv.exe

Filesize
1.4MB

MD5
1123cf1a14ec3b7fe386e30a3adf410d

SHA1
67c58570c24f42196493dd3b1daa9e257f0832c9

SHA256
5bc73c138c3f576605b38e4f407734005f23c210d941c1a104cb9ad76445d2f3

SHA512
e9fe3d3c4a409745e056e4a1872a64e913875f422204e17db3143e0ac05fcd2dd0fd3672185330502943b90252d5927d3d8d29e905380b87256ed2d78d1b61f9

Download Submit
C:\Windows\System\wlqLZbf.exe

Filesize
1.4MB

MD5
d70f75553e0ee66c3221e4a8778c56ed

SHA1
cd4cc9b5446c1a117c032b9d74edb2ed72cd60be

SHA256
d74e78850242a2d2d5895e02aea1f3ec62ff09d75e4205fc40d63ca79b594bb3

SHA512
3fe0d3cc9b688ae9cc24e0e338c18f47480cfc0bd1d892c02232b36904f03104ee15287c12450f8a5f403da3a17fca6eb8672748071642ff89f278cc3f1a8aa2

Download Submit
C:\Windows\System\yVfeyNA.exe

Filesize
1.4MB

MD5
00def3207a0618b38377b5ee1cf5d19a

SHA1
19cd4ff48da3dfab7ef3dd3470c92561f80aa34b

SHA256
d4f27dc4dc6a042ad000020cf9bdeb0c2d666a2ae56a0d8a9175ca4da7429a7a

SHA512
0a71012c3505fb965d7f39c03ac441b29212eb9b0425162262ff34e67b72964e331a6652c509c70af268f35452922201f4ff1f22fe74284d669cbfc4a6adcfc7

Download Submit
memory/4888-0-0x00000222F4E70000-0x00000222F4E80000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads