xmrig | 7e840a526cc780e0fef4c0decb80b31c9421a0f4c366904fb189f9c023006865

Analysis

max time kernel
125s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
17-11-2024 06:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7e840a526cc780e0fef4c0decb80b31c9421a0f4c366904fb189f9c023006865.exe
Size

1.1MB
MD5

e4131657d8c1073ef97ccb516fbb061e
SHA1

a524d04b8fd3b91031dc62477a539d0d34b84fc6
SHA256

7e840a526cc780e0fef4c0decb80b31c9421a0f4c366904fb189f9c023006865
SHA512

719a6013bf46c693538b7d016eafa1f83f5a2a74b891e6cc367e99fd0ab545b8ee7290494524379cee500202e4f8210d41fc48c02ce86c65a5796c087c1e3d6e
SSDEEP

24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbpwlKenszbWKDNEm/5ph70VwXd:GezaTF8FcNkNdfE0pZ9ozttwIRx2VO

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 33 IoCs

miner

resource	yara_rule
behavioral2/files/0x000b000000023b73-4.dat	xmrig
behavioral2/files/0x000a000000023b77-9.dat	xmrig
behavioral2/files/0x000a000000023b78-10.dat	xmrig
behavioral2/files/0x000a000000023b79-19.dat	xmrig
behavioral2/files/0x000a000000023b7a-24.dat	xmrig
behavioral2/files/0x000a000000023b7b-29.dat	xmrig
behavioral2/files/0x000a000000023b7c-34.dat	xmrig
behavioral2/files/0x000a000000023b7d-43.dat	xmrig
behavioral2/files/0x000a000000023b81-55.dat	xmrig
behavioral2/files/0x000a000000023b82-61.dat	xmrig
behavioral2/files/0x000a000000023b85-77.dat	xmrig
behavioral2/files/0x000a000000023b88-100.dat	xmrig
behavioral2/files/0x000a000000023b8f-129.dat	xmrig
behavioral2/files/0x000b000000023b92-142.dat	xmrig
behavioral2/files/0x000e000000023ba3-162.dat	xmrig
behavioral2/files/0x000b000000023b94-160.dat	xmrig
behavioral2/files/0x000a000000023b9c-157.dat	xmrig
behavioral2/files/0x000b000000023b93-155.dat	xmrig
behavioral2/files/0x000a000000023b91-145.dat	xmrig
behavioral2/files/0x000a000000023b90-140.dat	xmrig
behavioral2/files/0x000a000000023b8e-127.dat	xmrig
behavioral2/files/0x000a000000023b8c-123.dat	xmrig
behavioral2/files/0x000a000000023b8d-121.dat	xmrig
behavioral2/files/0x000a000000023b8b-115.dat	xmrig
behavioral2/files/0x000a000000023b8a-110.dat	xmrig
behavioral2/files/0x000a000000023b89-105.dat	xmrig
behavioral2/files/0x000a000000023b87-95.dat	xmrig
behavioral2/files/0x000a000000023b86-90.dat	xmrig
behavioral2/files/0x000a000000023b84-80.dat	xmrig
behavioral2/files/0x000a000000023b83-70.dat	xmrig
behavioral2/files/0x000a000000023b80-65.dat	xmrig
behavioral2/files/0x000a000000023b7f-59.dat	xmrig
behavioral2/files/0x000a000000023b7e-53.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2260	JTNJUjt.exe
3040	ULAXYMs.exe
4160	mLyKTKw.exe
4488	AAqUuNm.exe
3948	kUjeess.exe
3872	hIgMPkR.exe
1788	pKRKyfw.exe
656	ZGmsNwm.exe
4984	TxQbFzC.exe
5112	ArQhmiT.exe
3912	zobYFNu.exe
3416	hkTVtbb.exe
5064	dWcxJYi.exe
4644	EtRSXSm.exe
4612	gHwXkYP.exe
3744	UcKHtzY.exe
1848	yCbTPdj.exe
3364	gDVJQAi.exe
2092	BMpwyuy.exe
3644	GlRJbwA.exe
2952	NgDnLks.exe
1400	BSmiWYX.exe
4816	eAutbvW.exe
1604	PdFKIrv.exe
4988	zkRvuJu.exe
2688	TwDQZFI.exe
4740	Jattdyz.exe
3656	TyfCAfs.exe
3360	TfptdRy.exe
1004	EybORGo.exe
4736	tLqYggu.exe
4884	BLIDAEL.exe
3904	jEymoGT.exe
4724	izAtgCN.exe
1256	xMtwgkq.exe
3780	DUrdkWr.exe
5040	RWoHVhx.exe
3652	ZiXriXG.exe
3216	rzBYNEn.exe
4344	aCBIuGF.exe
5012	lupzQAc.exe
2768	aCBZDbj.exe
4840	vCdzQNu.exe
3632	dbbiDuM.exe
2112	gzmgPSm.exe
1800	mPFHqHs.exe
2600	IeiyUCR.exe
1540	vCvLFBK.exe
4636	HyOWljy.exe
3636	ZOHMEid.exe
4416	HlTiXWg.exe
4296	xxFhPOQ.exe
4032	eYstbZc.exe
4268	NuaufiR.exe
2992	mwKGeYh.exe
924	ZYbTIrg.exe
2492	gJYYDkO.exe
3512	zNWoqIb.exe
3348	TVCLohC.exe
4144	YamQwws.exe
3604	ADpOTQw.exe
4008	ECXyADj.exe
3824	ZUvlvxO.exe
1580	OkNUKZd.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\usmwPiV.exe	7e840a526cc780e0fef4c0decb80b31c9421a0f4c366904fb189f9c023006865.exe
File created	C:\Windows\System\VYzVMcL.exe	7e840a526cc780e0fef4c0decb80b31c9421a0f4c366904fb189f9c023006865.exe
File created	C:\Windows\System\aKEeKzw.exe	7e840a526cc780e0fef4c0decb80b31c9421a0f4c366904fb189f9c023006865.exe
File created	C:\Windows\System\KrqYfdG.exe	7e840a526cc780e0fef4c0decb80b31c9421a0f4c366904fb189f9c023006865.exe
File created	C:\Windows\System\olvDhFj.exe	7e840a526cc780e0fef4c0decb80b31c9421a0f4c366904fb189f9c023006865.exe
File created	C:\Windows\System\gDVJQAi.exe	7e840a526cc780e0fef4c0decb80b31c9421a0f4c366904fb189f9c023006865.exe
File created	C:\Windows\System\fynUIgP.exe	7e840a526cc780e0fef4c0decb80b31c9421a0f4c366904fb189f9c023006865.exe
File created	C:\Windows\System\IfeoDLE.exe	7e840a526cc780e0fef4c0decb80b31c9421a0f4c366904fb189f9c023006865.exe
File created	C:\Windows\System\tLqYggu.exe	7e840a526cc780e0fef4c0decb80b31c9421a0f4c366904fb189f9c023006865.exe
File created	C:\Windows\System\pMVUoOT.exe	7e840a526cc780e0fef4c0decb80b31c9421a0f4c366904fb189f9c023006865.exe
File created	C:\Windows\System\jHOEydE.exe	7e840a526cc780e0fef4c0decb80b31c9421a0f4c366904fb189f9c023006865.exe
File created	C:\Windows\System\AgSLMXM.exe	7e840a526cc780e0fef4c0decb80b31c9421a0f4c366904fb189f9c023006865.exe
File created	C:\Windows\System\boCCPhR.exe	7e840a526cc780e0fef4c0decb80b31c9421a0f4c366904fb189f9c023006865.exe
File created	C:\Windows\System\RaTdfue.exe	7e840a526cc780e0fef4c0decb80b31c9421a0f4c366904fb189f9c023006865.exe
File created	C:\Windows\System\ZMjAvoR.exe	7e840a526cc780e0fef4c0decb80b31c9421a0f4c366904fb189f9c023006865.exe
File created	C:\Windows\System\kgDvsCa.exe	7e840a526cc780e0fef4c0decb80b31c9421a0f4c366904fb189f9c023006865.exe
File created	C:\Windows\System\KiHabES.exe	7e840a526cc780e0fef4c0decb80b31c9421a0f4c366904fb189f9c023006865.exe
File created	C:\Windows\System\EtRSXSm.exe	7e840a526cc780e0fef4c0decb80b31c9421a0f4c366904fb189f9c023006865.exe
File created	C:\Windows\System\IeiyUCR.exe	7e840a526cc780e0fef4c0decb80b31c9421a0f4c366904fb189f9c023006865.exe
File created	C:\Windows\System\kFvCqoD.exe	7e840a526cc780e0fef4c0decb80b31c9421a0f4c366904fb189f9c023006865.exe
File created	C:\Windows\System\SQVubMo.exe	7e840a526cc780e0fef4c0decb80b31c9421a0f4c366904fb189f9c023006865.exe
File created	C:\Windows\System\xHuqITF.exe	7e840a526cc780e0fef4c0decb80b31c9421a0f4c366904fb189f9c023006865.exe
File created	C:\Windows\System\NDMExCy.exe	7e840a526cc780e0fef4c0decb80b31c9421a0f4c366904fb189f9c023006865.exe
File created	C:\Windows\System\YBSDBjB.exe	7e840a526cc780e0fef4c0decb80b31c9421a0f4c366904fb189f9c023006865.exe
File created	C:\Windows\System\EpeKQNs.exe	7e840a526cc780e0fef4c0decb80b31c9421a0f4c366904fb189f9c023006865.exe
File created	C:\Windows\System\kYMHgOQ.exe	7e840a526cc780e0fef4c0decb80b31c9421a0f4c366904fb189f9c023006865.exe
File created	C:\Windows\System\LSDVYwJ.exe	7e840a526cc780e0fef4c0decb80b31c9421a0f4c366904fb189f9c023006865.exe
File created	C:\Windows\System\GTaaBtL.exe	7e840a526cc780e0fef4c0decb80b31c9421a0f4c366904fb189f9c023006865.exe
File created	C:\Windows\System\gUSFMsE.exe	7e840a526cc780e0fef4c0decb80b31c9421a0f4c366904fb189f9c023006865.exe
File created	C:\Windows\System\acJNLpZ.exe	7e840a526cc780e0fef4c0decb80b31c9421a0f4c366904fb189f9c023006865.exe
File created	C:\Windows\System\NSSCTIA.exe	7e840a526cc780e0fef4c0decb80b31c9421a0f4c366904fb189f9c023006865.exe
File created	C:\Windows\System\VOckKdY.exe	7e840a526cc780e0fef4c0decb80b31c9421a0f4c366904fb189f9c023006865.exe
File created	C:\Windows\System\jwoZPOG.exe	7e840a526cc780e0fef4c0decb80b31c9421a0f4c366904fb189f9c023006865.exe
File created	C:\Windows\System\hTLwzwY.exe	7e840a526cc780e0fef4c0decb80b31c9421a0f4c366904fb189f9c023006865.exe
File created	C:\Windows\System\UcKHtzY.exe	7e840a526cc780e0fef4c0decb80b31c9421a0f4c366904fb189f9c023006865.exe
File created	C:\Windows\System\qYbfRYV.exe	7e840a526cc780e0fef4c0decb80b31c9421a0f4c366904fb189f9c023006865.exe
File created	C:\Windows\System\OkNUKZd.exe	7e840a526cc780e0fef4c0decb80b31c9421a0f4c366904fb189f9c023006865.exe
File created	C:\Windows\System\emzwmFv.exe	7e840a526cc780e0fef4c0decb80b31c9421a0f4c366904fb189f9c023006865.exe
File created	C:\Windows\System\EmCtTLX.exe	7e840a526cc780e0fef4c0decb80b31c9421a0f4c366904fb189f9c023006865.exe
File created	C:\Windows\System\dbbiDuM.exe	7e840a526cc780e0fef4c0decb80b31c9421a0f4c366904fb189f9c023006865.exe
File created	C:\Windows\System\WpkEjGi.exe	7e840a526cc780e0fef4c0decb80b31c9421a0f4c366904fb189f9c023006865.exe
File created	C:\Windows\System\iGwqAxn.exe	7e840a526cc780e0fef4c0decb80b31c9421a0f4c366904fb189f9c023006865.exe
File created	C:\Windows\System\ijTBTiu.exe	7e840a526cc780e0fef4c0decb80b31c9421a0f4c366904fb189f9c023006865.exe
File created	C:\Windows\System\aecsqqh.exe	7e840a526cc780e0fef4c0decb80b31c9421a0f4c366904fb189f9c023006865.exe
File created	C:\Windows\System\cbjgioj.exe	7e840a526cc780e0fef4c0decb80b31c9421a0f4c366904fb189f9c023006865.exe
File created	C:\Windows\System\HnxDqUP.exe	7e840a526cc780e0fef4c0decb80b31c9421a0f4c366904fb189f9c023006865.exe
File created	C:\Windows\System\GkmmXqv.exe	7e840a526cc780e0fef4c0decb80b31c9421a0f4c366904fb189f9c023006865.exe
File created	C:\Windows\System\jgVdBcA.exe	7e840a526cc780e0fef4c0decb80b31c9421a0f4c366904fb189f9c023006865.exe
File created	C:\Windows\System\tMBXKPj.exe	7e840a526cc780e0fef4c0decb80b31c9421a0f4c366904fb189f9c023006865.exe
File created	C:\Windows\System\qCzuQhU.exe	7e840a526cc780e0fef4c0decb80b31c9421a0f4c366904fb189f9c023006865.exe
File created	C:\Windows\System\jEymoGT.exe	7e840a526cc780e0fef4c0decb80b31c9421a0f4c366904fb189f9c023006865.exe
File created	C:\Windows\System\lDluiJo.exe	7e840a526cc780e0fef4c0decb80b31c9421a0f4c366904fb189f9c023006865.exe
File created	C:\Windows\System\KFAMDQA.exe	7e840a526cc780e0fef4c0decb80b31c9421a0f4c366904fb189f9c023006865.exe
File created	C:\Windows\System\RQudkOy.exe	7e840a526cc780e0fef4c0decb80b31c9421a0f4c366904fb189f9c023006865.exe
File created	C:\Windows\System\XmlbTPO.exe	7e840a526cc780e0fef4c0decb80b31c9421a0f4c366904fb189f9c023006865.exe
File created	C:\Windows\System\fpJpULR.exe	7e840a526cc780e0fef4c0decb80b31c9421a0f4c366904fb189f9c023006865.exe
File created	C:\Windows\System\RXCbXyD.exe	7e840a526cc780e0fef4c0decb80b31c9421a0f4c366904fb189f9c023006865.exe
File created	C:\Windows\System\sDlNzNA.exe	7e840a526cc780e0fef4c0decb80b31c9421a0f4c366904fb189f9c023006865.exe
File created	C:\Windows\System\yDxDEjA.exe	7e840a526cc780e0fef4c0decb80b31c9421a0f4c366904fb189f9c023006865.exe
File created	C:\Windows\System\rxbISog.exe	7e840a526cc780e0fef4c0decb80b31c9421a0f4c366904fb189f9c023006865.exe
File created	C:\Windows\System\tCuryYK.exe	7e840a526cc780e0fef4c0decb80b31c9421a0f4c366904fb189f9c023006865.exe
File created	C:\Windows\System\YamQwws.exe	7e840a526cc780e0fef4c0decb80b31c9421a0f4c366904fb189f9c023006865.exe
File created	C:\Windows\System\eewNkgm.exe	7e840a526cc780e0fef4c0decb80b31c9421a0f4c366904fb189f9c023006865.exe
File created	C:\Windows\System\nGmMOmH.exe	7e840a526cc780e0fef4c0decb80b31c9421a0f4c366904fb189f9c023006865.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	16776	dwm.exe
Token: SeChangeNotifyPrivilege	16776	dwm.exe
Token: 33	16776	dwm.exe
Token: SeIncBasePriorityPrivilege	16776	dwm.exe
Token: SeShutdownPrivilege	16776	dwm.exe
Token: SeCreatePagefilePrivilege	16776	dwm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 552 wrote to memory of 2260	552	7e840a526cc780e0fef4c0decb80b31c9421a0f4c366904fb189f9c023006865.exe	84
PID 552 wrote to memory of 2260	552	7e840a526cc780e0fef4c0decb80b31c9421a0f4c366904fb189f9c023006865.exe	84
PID 552 wrote to memory of 3040	552	7e840a526cc780e0fef4c0decb80b31c9421a0f4c366904fb189f9c023006865.exe	85
PID 552 wrote to memory of 3040	552	7e840a526cc780e0fef4c0decb80b31c9421a0f4c366904fb189f9c023006865.exe	85
PID 552 wrote to memory of 4160	552	7e840a526cc780e0fef4c0decb80b31c9421a0f4c366904fb189f9c023006865.exe	86
PID 552 wrote to memory of 4160	552	7e840a526cc780e0fef4c0decb80b31c9421a0f4c366904fb189f9c023006865.exe	86
PID 552 wrote to memory of 4488	552	7e840a526cc780e0fef4c0decb80b31c9421a0f4c366904fb189f9c023006865.exe	87
PID 552 wrote to memory of 4488	552	7e840a526cc780e0fef4c0decb80b31c9421a0f4c366904fb189f9c023006865.exe	87
PID 552 wrote to memory of 3948	552	7e840a526cc780e0fef4c0decb80b31c9421a0f4c366904fb189f9c023006865.exe	88
PID 552 wrote to memory of 3948	552	7e840a526cc780e0fef4c0decb80b31c9421a0f4c366904fb189f9c023006865.exe	88
PID 552 wrote to memory of 3872	552	7e840a526cc780e0fef4c0decb80b31c9421a0f4c366904fb189f9c023006865.exe	89
PID 552 wrote to memory of 3872	552	7e840a526cc780e0fef4c0decb80b31c9421a0f4c366904fb189f9c023006865.exe	89
PID 552 wrote to memory of 1788	552	7e840a526cc780e0fef4c0decb80b31c9421a0f4c366904fb189f9c023006865.exe	90
PID 552 wrote to memory of 1788	552	7e840a526cc780e0fef4c0decb80b31c9421a0f4c366904fb189f9c023006865.exe	90
PID 552 wrote to memory of 656	552	7e840a526cc780e0fef4c0decb80b31c9421a0f4c366904fb189f9c023006865.exe	93
PID 552 wrote to memory of 656	552	7e840a526cc780e0fef4c0decb80b31c9421a0f4c366904fb189f9c023006865.exe	93
PID 552 wrote to memory of 4984	552	7e840a526cc780e0fef4c0decb80b31c9421a0f4c366904fb189f9c023006865.exe	94
PID 552 wrote to memory of 4984	552	7e840a526cc780e0fef4c0decb80b31c9421a0f4c366904fb189f9c023006865.exe	94
PID 552 wrote to memory of 5112	552	7e840a526cc780e0fef4c0decb80b31c9421a0f4c366904fb189f9c023006865.exe	95
PID 552 wrote to memory of 5112	552	7e840a526cc780e0fef4c0decb80b31c9421a0f4c366904fb189f9c023006865.exe	95
PID 552 wrote to memory of 3912	552	7e840a526cc780e0fef4c0decb80b31c9421a0f4c366904fb189f9c023006865.exe	96
PID 552 wrote to memory of 3912	552	7e840a526cc780e0fef4c0decb80b31c9421a0f4c366904fb189f9c023006865.exe	96
PID 552 wrote to memory of 3416	552	7e840a526cc780e0fef4c0decb80b31c9421a0f4c366904fb189f9c023006865.exe	97
PID 552 wrote to memory of 3416	552	7e840a526cc780e0fef4c0decb80b31c9421a0f4c366904fb189f9c023006865.exe	97
PID 552 wrote to memory of 5064	552	7e840a526cc780e0fef4c0decb80b31c9421a0f4c366904fb189f9c023006865.exe	98
PID 552 wrote to memory of 5064	552	7e840a526cc780e0fef4c0decb80b31c9421a0f4c366904fb189f9c023006865.exe	98
PID 552 wrote to memory of 4644	552	7e840a526cc780e0fef4c0decb80b31c9421a0f4c366904fb189f9c023006865.exe	99
PID 552 wrote to memory of 4644	552	7e840a526cc780e0fef4c0decb80b31c9421a0f4c366904fb189f9c023006865.exe	99
PID 552 wrote to memory of 4612	552	7e840a526cc780e0fef4c0decb80b31c9421a0f4c366904fb189f9c023006865.exe	100
PID 552 wrote to memory of 4612	552	7e840a526cc780e0fef4c0decb80b31c9421a0f4c366904fb189f9c023006865.exe	100
PID 552 wrote to memory of 3744	552	7e840a526cc780e0fef4c0decb80b31c9421a0f4c366904fb189f9c023006865.exe	102
PID 552 wrote to memory of 3744	552	7e840a526cc780e0fef4c0decb80b31c9421a0f4c366904fb189f9c023006865.exe	102
PID 552 wrote to memory of 1848	552	7e840a526cc780e0fef4c0decb80b31c9421a0f4c366904fb189f9c023006865.exe	103
PID 552 wrote to memory of 1848	552	7e840a526cc780e0fef4c0decb80b31c9421a0f4c366904fb189f9c023006865.exe	103
PID 552 wrote to memory of 3364	552	7e840a526cc780e0fef4c0decb80b31c9421a0f4c366904fb189f9c023006865.exe	104
PID 552 wrote to memory of 3364	552	7e840a526cc780e0fef4c0decb80b31c9421a0f4c366904fb189f9c023006865.exe	104
PID 552 wrote to memory of 2092	552	7e840a526cc780e0fef4c0decb80b31c9421a0f4c366904fb189f9c023006865.exe	105
PID 552 wrote to memory of 2092	552	7e840a526cc780e0fef4c0decb80b31c9421a0f4c366904fb189f9c023006865.exe	105
PID 552 wrote to memory of 3644	552	7e840a526cc780e0fef4c0decb80b31c9421a0f4c366904fb189f9c023006865.exe	106
PID 552 wrote to memory of 3644	552	7e840a526cc780e0fef4c0decb80b31c9421a0f4c366904fb189f9c023006865.exe	106
PID 552 wrote to memory of 2952	552	7e840a526cc780e0fef4c0decb80b31c9421a0f4c366904fb189f9c023006865.exe	107
PID 552 wrote to memory of 2952	552	7e840a526cc780e0fef4c0decb80b31c9421a0f4c366904fb189f9c023006865.exe	107
PID 552 wrote to memory of 1400	552	7e840a526cc780e0fef4c0decb80b31c9421a0f4c366904fb189f9c023006865.exe	108
PID 552 wrote to memory of 1400	552	7e840a526cc780e0fef4c0decb80b31c9421a0f4c366904fb189f9c023006865.exe	108
PID 552 wrote to memory of 4816	552	7e840a526cc780e0fef4c0decb80b31c9421a0f4c366904fb189f9c023006865.exe	109
PID 552 wrote to memory of 4816	552	7e840a526cc780e0fef4c0decb80b31c9421a0f4c366904fb189f9c023006865.exe	109
PID 552 wrote to memory of 1604	552	7e840a526cc780e0fef4c0decb80b31c9421a0f4c366904fb189f9c023006865.exe	110
PID 552 wrote to memory of 1604	552	7e840a526cc780e0fef4c0decb80b31c9421a0f4c366904fb189f9c023006865.exe	110
PID 552 wrote to memory of 4988	552	7e840a526cc780e0fef4c0decb80b31c9421a0f4c366904fb189f9c023006865.exe	111
PID 552 wrote to memory of 4988	552	7e840a526cc780e0fef4c0decb80b31c9421a0f4c366904fb189f9c023006865.exe	111
PID 552 wrote to memory of 2688	552	7e840a526cc780e0fef4c0decb80b31c9421a0f4c366904fb189f9c023006865.exe	112
PID 552 wrote to memory of 2688	552	7e840a526cc780e0fef4c0decb80b31c9421a0f4c366904fb189f9c023006865.exe	112
PID 552 wrote to memory of 4740	552	7e840a526cc780e0fef4c0decb80b31c9421a0f4c366904fb189f9c023006865.exe	113
PID 552 wrote to memory of 4740	552	7e840a526cc780e0fef4c0decb80b31c9421a0f4c366904fb189f9c023006865.exe	113
PID 552 wrote to memory of 3656	552	7e840a526cc780e0fef4c0decb80b31c9421a0f4c366904fb189f9c023006865.exe	114
PID 552 wrote to memory of 3656	552	7e840a526cc780e0fef4c0decb80b31c9421a0f4c366904fb189f9c023006865.exe	114
PID 552 wrote to memory of 3360	552	7e840a526cc780e0fef4c0decb80b31c9421a0f4c366904fb189f9c023006865.exe	115
PID 552 wrote to memory of 3360	552	7e840a526cc780e0fef4c0decb80b31c9421a0f4c366904fb189f9c023006865.exe	115
PID 552 wrote to memory of 1004	552	7e840a526cc780e0fef4c0decb80b31c9421a0f4c366904fb189f9c023006865.exe	116
PID 552 wrote to memory of 1004	552	7e840a526cc780e0fef4c0decb80b31c9421a0f4c366904fb189f9c023006865.exe	116
PID 552 wrote to memory of 4736	552	7e840a526cc780e0fef4c0decb80b31c9421a0f4c366904fb189f9c023006865.exe	117
PID 552 wrote to memory of 4736	552	7e840a526cc780e0fef4c0decb80b31c9421a0f4c366904fb189f9c023006865.exe	117
PID 552 wrote to memory of 4884	552	7e840a526cc780e0fef4c0decb80b31c9421a0f4c366904fb189f9c023006865.exe	118
PID 552 wrote to memory of 4884	552	7e840a526cc780e0fef4c0decb80b31c9421a0f4c366904fb189f9c023006865.exe	118

C:\Users\Admin\AppData\Local\Temp\7e840a526cc780e0fef4c0decb80b31c9421a0f4c366904fb189f9c023006865.exe
"C:\Users\Admin\AppData\Local\Temp\7e840a526cc780e0fef4c0decb80b31c9421a0f4c366904fb189f9c023006865.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:552
- C:\Windows\System\JTNJUjt.exe
  C:\Windows\System\JTNJUjt.exe
  2⤵
  - Executes dropped EXE
  PID:2260
- C:\Windows\System\ULAXYMs.exe
  C:\Windows\System\ULAXYMs.exe
  2⤵
  - Executes dropped EXE
  PID:3040
- C:\Windows\System\mLyKTKw.exe
  C:\Windows\System\mLyKTKw.exe
  2⤵
  - Executes dropped EXE
  PID:4160
- C:\Windows\System\AAqUuNm.exe
  C:\Windows\System\AAqUuNm.exe
  2⤵
  - Executes dropped EXE
  PID:4488
- C:\Windows\System\kUjeess.exe
  C:\Windows\System\kUjeess.exe
  2⤵
  - Executes dropped EXE
  PID:3948
- C:\Windows\System\hIgMPkR.exe
  C:\Windows\System\hIgMPkR.exe
  2⤵
  - Executes dropped EXE
  PID:3872
- C:\Windows\System\pKRKyfw.exe
  C:\Windows\System\pKRKyfw.exe
  2⤵
  - Executes dropped EXE
  PID:1788
- C:\Windows\System\ZGmsNwm.exe
  C:\Windows\System\ZGmsNwm.exe
  2⤵
  - Executes dropped EXE
  PID:656
- C:\Windows\System\TxQbFzC.exe
  C:\Windows\System\TxQbFzC.exe
  2⤵
  - Executes dropped EXE
  PID:4984
- C:\Windows\System\ArQhmiT.exe
  C:\Windows\System\ArQhmiT.exe
  2⤵
  - Executes dropped EXE
  PID:5112
- C:\Windows\System\zobYFNu.exe
  C:\Windows\System\zobYFNu.exe
  2⤵
  - Executes dropped EXE
  PID:3912
- C:\Windows\System\hkTVtbb.exe
  C:\Windows\System\hkTVtbb.exe
  2⤵
  - Executes dropped EXE
  PID:3416
- C:\Windows\System\dWcxJYi.exe
  C:\Windows\System\dWcxJYi.exe
  2⤵
  - Executes dropped EXE
  PID:5064
- C:\Windows\System\EtRSXSm.exe
  C:\Windows\System\EtRSXSm.exe
  2⤵
  - Executes dropped EXE
  PID:4644
- C:\Windows\System\gHwXkYP.exe
  C:\Windows\System\gHwXkYP.exe
  2⤵
  - Executes dropped EXE
  PID:4612
- C:\Windows\System\UcKHtzY.exe
  C:\Windows\System\UcKHtzY.exe
  2⤵
  - Executes dropped EXE
  PID:3744
- C:\Windows\System\yCbTPdj.exe
  C:\Windows\System\yCbTPdj.exe
  2⤵
  - Executes dropped EXE
  PID:1848
- C:\Windows\System\gDVJQAi.exe
  C:\Windows\System\gDVJQAi.exe
  2⤵
  - Executes dropped EXE
  PID:3364
- C:\Windows\System\BMpwyuy.exe
  C:\Windows\System\BMpwyuy.exe
  2⤵
  - Executes dropped EXE
  PID:2092
- C:\Windows\System\GlRJbwA.exe
  C:\Windows\System\GlRJbwA.exe
  2⤵
  - Executes dropped EXE
  PID:3644
- C:\Windows\System\NgDnLks.exe
  C:\Windows\System\NgDnLks.exe
  2⤵
  - Executes dropped EXE
  PID:2952
- C:\Windows\System\BSmiWYX.exe
  C:\Windows\System\BSmiWYX.exe
  2⤵
  - Executes dropped EXE
  PID:1400
- C:\Windows\System\eAutbvW.exe
  C:\Windows\System\eAutbvW.exe
  2⤵
  - Executes dropped EXE
  PID:4816
- C:\Windows\System\PdFKIrv.exe
  C:\Windows\System\PdFKIrv.exe
  2⤵
  - Executes dropped EXE
  PID:1604
- C:\Windows\System\zkRvuJu.exe
  C:\Windows\System\zkRvuJu.exe
  2⤵
  - Executes dropped EXE
  PID:4988
- C:\Windows\System\TwDQZFI.exe
  C:\Windows\System\TwDQZFI.exe
  2⤵
  - Executes dropped EXE
  PID:2688
- C:\Windows\System\Jattdyz.exe
  C:\Windows\System\Jattdyz.exe
  2⤵
  - Executes dropped EXE
  PID:4740
- C:\Windows\System\TyfCAfs.exe
  C:\Windows\System\TyfCAfs.exe
  2⤵
  - Executes dropped EXE
  PID:3656
- C:\Windows\System\TfptdRy.exe
  C:\Windows\System\TfptdRy.exe
  2⤵
  - Executes dropped EXE
  PID:3360
- C:\Windows\System\EybORGo.exe
  C:\Windows\System\EybORGo.exe
  2⤵
  - Executes dropped EXE
  PID:1004
- C:\Windows\System\tLqYggu.exe
  C:\Windows\System\tLqYggu.exe
  2⤵
  - Executes dropped EXE
  PID:4736
- C:\Windows\System\BLIDAEL.exe
  C:\Windows\System\BLIDAEL.exe
  2⤵
  - Executes dropped EXE
  PID:4884
- C:\Windows\System\jEymoGT.exe
  C:\Windows\System\jEymoGT.exe
  2⤵
  - Executes dropped EXE
  PID:3904
- C:\Windows\System\izAtgCN.exe
  C:\Windows\System\izAtgCN.exe
  2⤵
  - Executes dropped EXE
  PID:4724
- C:\Windows\System\xMtwgkq.exe
  C:\Windows\System\xMtwgkq.exe
  2⤵
  - Executes dropped EXE
  PID:1256
- C:\Windows\System\DUrdkWr.exe
  C:\Windows\System\DUrdkWr.exe
  2⤵
  - Executes dropped EXE
  PID:3780
- C:\Windows\System\RWoHVhx.exe
  C:\Windows\System\RWoHVhx.exe
  2⤵
  - Executes dropped EXE
  PID:5040
- C:\Windows\System\ZiXriXG.exe
  C:\Windows\System\ZiXriXG.exe
  2⤵
  - Executes dropped EXE
  PID:3652
- C:\Windows\System\rzBYNEn.exe
  C:\Windows\System\rzBYNEn.exe
  2⤵
  - Executes dropped EXE
  PID:3216
- C:\Windows\System\aCBIuGF.exe
  C:\Windows\System\aCBIuGF.exe
  2⤵
  - Executes dropped EXE
  PID:4344
- C:\Windows\System\lupzQAc.exe
  C:\Windows\System\lupzQAc.exe
  2⤵
  - Executes dropped EXE
  PID:5012
- C:\Windows\System\aCBZDbj.exe
  C:\Windows\System\aCBZDbj.exe
  2⤵
  - Executes dropped EXE
  PID:2768
- C:\Windows\System\vCdzQNu.exe
  C:\Windows\System\vCdzQNu.exe
  2⤵
  - Executes dropped EXE
  PID:4840
- C:\Windows\System\dbbiDuM.exe
  C:\Windows\System\dbbiDuM.exe
  2⤵
  - Executes dropped EXE
  PID:3632
- C:\Windows\System\gzmgPSm.exe
  C:\Windows\System\gzmgPSm.exe
  2⤵
  - Executes dropped EXE
  PID:2112
- C:\Windows\System\mPFHqHs.exe
  C:\Windows\System\mPFHqHs.exe
  2⤵
  - Executes dropped EXE
  PID:1800
- C:\Windows\System\IeiyUCR.exe
  C:\Windows\System\IeiyUCR.exe
  2⤵
  - Executes dropped EXE
  PID:2600
- C:\Windows\System\vCvLFBK.exe
  C:\Windows\System\vCvLFBK.exe
  2⤵
  - Executes dropped EXE
  PID:1540
- C:\Windows\System\HyOWljy.exe
  C:\Windows\System\HyOWljy.exe
  2⤵
  - Executes dropped EXE
  PID:4636
- C:\Windows\System\ZOHMEid.exe
  C:\Windows\System\ZOHMEid.exe
  2⤵
  - Executes dropped EXE
  PID:3636
- C:\Windows\System\HlTiXWg.exe
  C:\Windows\System\HlTiXWg.exe
  2⤵
  - Executes dropped EXE
  PID:4416
- C:\Windows\System\xxFhPOQ.exe
  C:\Windows\System\xxFhPOQ.exe
  2⤵
  - Executes dropped EXE
  PID:4296
- C:\Windows\System\eYstbZc.exe
  C:\Windows\System\eYstbZc.exe
  2⤵
  - Executes dropped EXE
  PID:4032
- C:\Windows\System\NuaufiR.exe
  C:\Windows\System\NuaufiR.exe
  2⤵
  - Executes dropped EXE
  PID:4268
- C:\Windows\System\mwKGeYh.exe
  C:\Windows\System\mwKGeYh.exe
  2⤵
  - Executes dropped EXE
  PID:2992
- C:\Windows\System\ZYbTIrg.exe
  C:\Windows\System\ZYbTIrg.exe
  2⤵
  - Executes dropped EXE
  PID:924
- C:\Windows\System\gJYYDkO.exe
  C:\Windows\System\gJYYDkO.exe
  2⤵
  - Executes dropped EXE
  PID:2492
- C:\Windows\System\zNWoqIb.exe
  C:\Windows\System\zNWoqIb.exe
  2⤵
  - Executes dropped EXE
  PID:3512
- C:\Windows\System\TVCLohC.exe
  C:\Windows\System\TVCLohC.exe
  2⤵
  - Executes dropped EXE
  PID:3348
- C:\Windows\System\YamQwws.exe
  C:\Windows\System\YamQwws.exe
  2⤵
  - Executes dropped EXE
  PID:4144
- C:\Windows\System\ADpOTQw.exe
  C:\Windows\System\ADpOTQw.exe
  2⤵
  - Executes dropped EXE
  PID:3604
- C:\Windows\System\ECXyADj.exe
  C:\Windows\System\ECXyADj.exe
  2⤵
  - Executes dropped EXE
  PID:4008
- C:\Windows\System\ZUvlvxO.exe
  C:\Windows\System\ZUvlvxO.exe
  2⤵
  - Executes dropped EXE
  PID:3824
- C:\Windows\System\OkNUKZd.exe
  C:\Windows\System\OkNUKZd.exe
  2⤵
  - Executes dropped EXE
  PID:1580
- C:\Windows\System\UjkcUEx.exe
  C:\Windows\System\UjkcUEx.exe
  2⤵
  PID:5092
- C:\Windows\System\NXurOtE.exe
  C:\Windows\System\NXurOtE.exe
  2⤵
  PID:3764
- C:\Windows\System\IrYbpMl.exe
  C:\Windows\System\IrYbpMl.exe
  2⤵
  PID:4536
- C:\Windows\System\yqlwBca.exe
  C:\Windows\System\yqlwBca.exe
  2⤵
  PID:4940
- C:\Windows\System\uWKQAwS.exe
  C:\Windows\System\uWKQAwS.exe
  2⤵
  PID:5140
- C:\Windows\System\JJGrRpD.exe
  C:\Windows\System\JJGrRpD.exe
  2⤵
  PID:5172
- C:\Windows\System\schCYwD.exe
  C:\Windows\System\schCYwD.exe
  2⤵
  PID:5200
- C:\Windows\System\lDluiJo.exe
  C:\Windows\System\lDluiJo.exe
  2⤵
  PID:5224
- C:\Windows\System\TOluIek.exe
  C:\Windows\System\TOluIek.exe
  2⤵
  PID:5256
- C:\Windows\System\dJTWiqG.exe
  C:\Windows\System\dJTWiqG.exe
  2⤵
  PID:5280
- C:\Windows\System\uyAjuar.exe
  C:\Windows\System\uyAjuar.exe
  2⤵
  PID:5312
- C:\Windows\System\FacrIAa.exe
  C:\Windows\System\FacrIAa.exe
  2⤵
  PID:5336
- C:\Windows\System\HclTpOz.exe
  C:\Windows\System\HclTpOz.exe
  2⤵
  PID:5368
- C:\Windows\System\FWTuzoQ.exe
  C:\Windows\System\FWTuzoQ.exe
  2⤵
  PID:5396
- C:\Windows\System\SoUMfxq.exe
  C:\Windows\System\SoUMfxq.exe
  2⤵
  PID:5420
- C:\Windows\System\nYukvtj.exe
  C:\Windows\System\nYukvtj.exe
  2⤵
  PID:5452
- C:\Windows\System\yAoBwXt.exe
  C:\Windows\System\yAoBwXt.exe
  2⤵
  PID:5480
- C:\Windows\System\DIBpEMl.exe
  C:\Windows\System\DIBpEMl.exe
  2⤵
  PID:5504
- C:\Windows\System\Wrooslx.exe
  C:\Windows\System\Wrooslx.exe
  2⤵
  PID:5536
- C:\Windows\System\yDwpdqg.exe
  C:\Windows\System\yDwpdqg.exe
  2⤵
  PID:5564
- C:\Windows\System\QxzoRKY.exe
  C:\Windows\System\QxzoRKY.exe
  2⤵
  PID:5588
- C:\Windows\System\jSSOZyD.exe
  C:\Windows\System\jSSOZyD.exe
  2⤵
  PID:5620
- C:\Windows\System\XaZgDSP.exe
  C:\Windows\System\XaZgDSP.exe
  2⤵
  PID:5644
- C:\Windows\System\cbjgioj.exe
  C:\Windows\System\cbjgioj.exe
  2⤵
  PID:5676
- C:\Windows\System\YDENYhf.exe
  C:\Windows\System\YDENYhf.exe
  2⤵
  PID:5704
- C:\Windows\System\ysqoYZq.exe
  C:\Windows\System\ysqoYZq.exe
  2⤵
  PID:5728
- C:\Windows\System\qxSuFrU.exe
  C:\Windows\System\qxSuFrU.exe
  2⤵
  PID:5760
- C:\Windows\System\VwQomVT.exe
  C:\Windows\System\VwQomVT.exe
  2⤵
  PID:5784
- C:\Windows\System\WpkEjGi.exe
  C:\Windows\System\WpkEjGi.exe
  2⤵
  PID:5816
- C:\Windows\System\GyACTCS.exe
  C:\Windows\System\GyACTCS.exe
  2⤵
  PID:5844
- C:\Windows\System\AmcrNxb.exe
  C:\Windows\System\AmcrNxb.exe
  2⤵
  PID:5868
- C:\Windows\System\TbyMzcA.exe
  C:\Windows\System\TbyMzcA.exe
  2⤵
  PID:5900
- C:\Windows\System\FSXMQiB.exe
  C:\Windows\System\FSXMQiB.exe
  2⤵
  PID:5924
- C:\Windows\System\gOssUyJ.exe
  C:\Windows\System\gOssUyJ.exe
  2⤵
  PID:5952
- C:\Windows\System\XzqFoZP.exe
  C:\Windows\System\XzqFoZP.exe
  2⤵
  PID:5980
- C:\Windows\System\MFkHzpy.exe
  C:\Windows\System\MFkHzpy.exe
  2⤵
  PID:6004
- C:\Windows\System\WUHfGTh.exe
  C:\Windows\System\WUHfGTh.exe
  2⤵
  PID:6040
- C:\Windows\System\ZOmYcTy.exe
  C:\Windows\System\ZOmYcTy.exe
  2⤵
  PID:6064
- C:\Windows\System\YhFNWzb.exe
  C:\Windows\System\YhFNWzb.exe
  2⤵
  PID:6092
- C:\Windows\System\SBwdUUa.exe
  C:\Windows\System\SBwdUUa.exe
  2⤵
  PID:6120
- C:\Windows\System\anOSVEr.exe
  C:\Windows\System\anOSVEr.exe
  2⤵
  PID:1940
- C:\Windows\System\tBlJuNL.exe
  C:\Windows\System\tBlJuNL.exe
  2⤵
  PID:4616
- C:\Windows\System\woMrNMV.exe
  C:\Windows\System\woMrNMV.exe
  2⤵
  PID:2432
- C:\Windows\System\bKZVFMo.exe
  C:\Windows\System\bKZVFMo.exe
  2⤵
  PID:3572
- C:\Windows\System\GYRaMcK.exe
  C:\Windows\System\GYRaMcK.exe
  2⤵
  PID:2436
- C:\Windows\System\AcnMZyX.exe
  C:\Windows\System\AcnMZyX.exe
  2⤵
  PID:5132
- C:\Windows\System\GxAJEuK.exe
  C:\Windows\System\GxAJEuK.exe
  2⤵
  PID:5196
- C:\Windows\System\wnIWCJH.exe
  C:\Windows\System\wnIWCJH.exe
  2⤵
  PID:5244
- C:\Windows\System\WSZHmMv.exe
  C:\Windows\System\WSZHmMv.exe
  2⤵
  PID:5320
- C:\Windows\System\LmmYOBc.exe
  C:\Windows\System\LmmYOBc.exe
  2⤵
  PID:5388
- C:\Windows\System\ASwZXIK.exe
  C:\Windows\System\ASwZXIK.exe
  2⤵
  PID:3508
- C:\Windows\System\ZdGTVLk.exe
  C:\Windows\System\ZdGTVLk.exe
  2⤵
  PID:5552
- C:\Windows\System\HicIUey.exe
  C:\Windows\System\HicIUey.exe
  2⤵
  PID:5604
- C:\Windows\System\WcMGyng.exe
  C:\Windows\System\WcMGyng.exe
  2⤵
  PID:5656
- C:\Windows\System\INFlxkU.exe
  C:\Windows\System\INFlxkU.exe
  2⤵
  PID:5720
- C:\Windows\System\CZwpEvo.exe
  C:\Windows\System\CZwpEvo.exe
  2⤵
  PID:5780
- C:\Windows\System\TVAGbFs.exe
  C:\Windows\System\TVAGbFs.exe
  2⤵
  PID:5880
- C:\Windows\System\AaCOQir.exe
  C:\Windows\System\AaCOQir.exe
  2⤵
  PID:5936
- C:\Windows\System\FdwSzwB.exe
  C:\Windows\System\FdwSzwB.exe
  2⤵
  PID:5968
- C:\Windows\System\zEXqUXQ.exe
  C:\Windows\System\zEXqUXQ.exe
  2⤵
  PID:6020
- C:\Windows\System\HgPktdE.exe
  C:\Windows\System\HgPktdE.exe
  2⤵
  PID:3972
- C:\Windows\System\XOhahwa.exe
  C:\Windows\System\XOhahwa.exe
  2⤵
  PID:1076
- C:\Windows\System\LBKLkCe.exe
  C:\Windows\System\LBKLkCe.exe
  2⤵
  PID:2892
- C:\Windows\System\XBEbgzU.exe
  C:\Windows\System\XBEbgzU.exe
  2⤵
  PID:4672
- C:\Windows\System\qPOhEPX.exe
  C:\Windows\System\qPOhEPX.exe
  2⤵
  PID:3748
- C:\Windows\System\jRYRjpI.exe
  C:\Windows\System\jRYRjpI.exe
  2⤵
  PID:1548
- C:\Windows\System\KlIkWtG.exe
  C:\Windows\System\KlIkWtG.exe
  2⤵
  PID:5096
- C:\Windows\System\akfolZz.exe
  C:\Windows\System\akfolZz.exe
  2⤵
  PID:2204
- C:\Windows\System\ZNNQIUU.exe
  C:\Windows\System\ZNNQIUU.exe
  2⤵
  PID:1068
- C:\Windows\System\NnPSglO.exe
  C:\Windows\System\NnPSglO.exe
  2⤵
  PID:3056
- C:\Windows\System\zvZknYf.exe
  C:\Windows\System\zvZknYf.exe
  2⤵
  PID:3956
- C:\Windows\System\peaCVPN.exe
  C:\Windows\System\peaCVPN.exe
  2⤵
  PID:4748
- C:\Windows\System\qCtZsTf.exe
  C:\Windows\System\qCtZsTf.exe
  2⤵
  PID:1516
- C:\Windows\System\GCgfkCM.exe
  C:\Windows\System\GCgfkCM.exe
  2⤵
  PID:3768
- C:\Windows\System\FSwCWic.exe
  C:\Windows\System\FSwCWic.exe
  2⤵
  PID:384
- C:\Windows\System\YtKuFmH.exe
  C:\Windows\System\YtKuFmH.exe
  2⤵
  PID:5296
- C:\Windows\System\GYjxnsA.exe
  C:\Windows\System\GYjxnsA.exe
  2⤵
  PID:1988
- C:\Windows\System\MTBgMZp.exe
  C:\Windows\System\MTBgMZp.exe
  2⤵
  PID:5348
- C:\Windows\System\UNfKExa.exe
  C:\Windows\System\UNfKExa.exe
  2⤵
  PID:5496
- C:\Windows\System\yalEvga.exe
  C:\Windows\System\yalEvga.exe
  2⤵
  PID:2584
- C:\Windows\System\ISRgyaB.exe
  C:\Windows\System\ISRgyaB.exe
  2⤵
  PID:5544
- C:\Windows\System\iKOZKzf.exe
  C:\Windows\System\iKOZKzf.exe
  2⤵
  PID:5692
- C:\Windows\System\nHIAoon.exe
  C:\Windows\System\nHIAoon.exe
  2⤵
  PID:5832
- C:\Windows\System\RiuKrCq.exe
  C:\Windows\System\RiuKrCq.exe
  2⤵
  PID:5940
- C:\Windows\System\zEANKYb.exe
  C:\Windows\System\zEANKYb.exe
  2⤵
  PID:840
- C:\Windows\System\vBdgNep.exe
  C:\Windows\System\vBdgNep.exe
  2⤵
  PID:1972
- C:\Windows\System\SHXNQzL.exe
  C:\Windows\System\SHXNQzL.exe
  2⤵
  PID:2156
- C:\Windows\System\deeWPEv.exe
  C:\Windows\System\deeWPEv.exe
  2⤵
  PID:4012
- C:\Windows\System\VDPYywq.exe
  C:\Windows\System\VDPYywq.exe
  2⤵
  PID:2820
- C:\Windows\System\xKaORNI.exe
  C:\Windows\System\xKaORNI.exe
  2⤵
  PID:2104
- C:\Windows\System\XaVCjnt.exe
  C:\Windows\System\XaVCjnt.exe
  2⤵
  PID:5220
- C:\Windows\System\eqcSYRr.exe
  C:\Windows\System\eqcSYRr.exe
  2⤵
  PID:5068
- C:\Windows\System\GCxSGnS.exe
  C:\Windows\System\GCxSGnS.exe
  2⤵
  PID:2672
- C:\Windows\System\LGhXywm.exe
  C:\Windows\System\LGhXywm.exe
  2⤵
  PID:1744
- C:\Windows\System\CdOAjlt.exe
  C:\Windows\System\CdOAjlt.exe
  2⤵
  PID:4544
- C:\Windows\System\KBiUMEt.exe
  C:\Windows\System\KBiUMEt.exe
  2⤵
  PID:5600
- C:\Windows\System\qYbfRYV.exe
  C:\Windows\System\qYbfRYV.exe
  2⤵
  PID:5916
- C:\Windows\System\SvOCqnV.exe
  C:\Windows\System\SvOCqnV.exe
  2⤵
  PID:4252
- C:\Windows\System\lcxFSXs.exe
  C:\Windows\System\lcxFSXs.exe
  2⤵
  PID:1228
- C:\Windows\System\ERwzmRm.exe
  C:\Windows\System\ERwzmRm.exe
  2⤵
  PID:4880
- C:\Windows\System\rdkhOKw.exe
  C:\Windows\System\rdkhOKw.exe
  2⤵
  PID:3288
- C:\Windows\System\wNZKbSA.exe
  C:\Windows\System\wNZKbSA.exe
  2⤵
  PID:4780
- C:\Windows\System\QAEbjbr.exe
  C:\Windows\System\QAEbjbr.exe
  2⤵
  PID:4128
- C:\Windows\System\SXPFRtL.exe
  C:\Windows\System\SXPFRtL.exe
  2⤵
  PID:4484
- C:\Windows\System\GkmmXqv.exe
  C:\Windows\System\GkmmXqv.exe
  2⤵
  PID:1112
- C:\Windows\System\gGCfcWn.exe
  C:\Windows\System\gGCfcWn.exe
  2⤵
  PID:6168
- C:\Windows\System\ZRUHIKw.exe
  C:\Windows\System\ZRUHIKw.exe
  2⤵
  PID:6196
- C:\Windows\System\PAyozgG.exe
  C:\Windows\System\PAyozgG.exe
  2⤵
  PID:6224
- C:\Windows\System\RXCbXyD.exe
  C:\Windows\System\RXCbXyD.exe
  2⤵
  PID:6260
- C:\Windows\System\RhVaMQB.exe
  C:\Windows\System\RhVaMQB.exe
  2⤵
  PID:6284
- C:\Windows\System\voBGFBt.exe
  C:\Windows\System\voBGFBt.exe
  2⤵
  PID:6308
- C:\Windows\System\VOckKdY.exe
  C:\Windows\System\VOckKdY.exe
  2⤵
  PID:6328
- C:\Windows\System\TKXEgGG.exe
  C:\Windows\System\TKXEgGG.exe
  2⤵
  PID:6356
- C:\Windows\System\qcWzeBD.exe
  C:\Windows\System\qcWzeBD.exe
  2⤵
  PID:6380
- C:\Windows\System\luzAsbU.exe
  C:\Windows\System\luzAsbU.exe
  2⤵
  PID:6396
- C:\Windows\System\LyeLIeQ.exe
  C:\Windows\System\LyeLIeQ.exe
  2⤵
  PID:6420
- C:\Windows\System\omuDwuc.exe
  C:\Windows\System\omuDwuc.exe
  2⤵
  PID:6436
- C:\Windows\System\NRFaiKN.exe
  C:\Windows\System\NRFaiKN.exe
  2⤵
  PID:6472
- C:\Windows\System\pPsqFqA.exe
  C:\Windows\System\pPsqFqA.exe
  2⤵
  PID:6504
- C:\Windows\System\EnGuPrU.exe
  C:\Windows\System\EnGuPrU.exe
  2⤵
  PID:6528
- C:\Windows\System\JtDaHls.exe
  C:\Windows\System\JtDaHls.exe
  2⤵
  PID:6560
- C:\Windows\System\uIzOVAG.exe
  C:\Windows\System\uIzOVAG.exe
  2⤵
  PID:6616
- C:\Windows\System\RTMXBGr.exe
  C:\Windows\System\RTMXBGr.exe
  2⤵
  PID:6640
- C:\Windows\System\hJfxJwV.exe
  C:\Windows\System\hJfxJwV.exe
  2⤵
  PID:6668
- C:\Windows\System\oMnimKL.exe
  C:\Windows\System\oMnimKL.exe
  2⤵
  PID:6700
- C:\Windows\System\yidgzTe.exe
  C:\Windows\System\yidgzTe.exe
  2⤵
  PID:6728
- C:\Windows\System\FKamaZf.exe
  C:\Windows\System\FKamaZf.exe
  2⤵
  PID:6756
- C:\Windows\System\pMVUoOT.exe
  C:\Windows\System\pMVUoOT.exe
  2⤵
  PID:6780
- C:\Windows\System\ufRXSZu.exe
  C:\Windows\System\ufRXSZu.exe
  2⤵
  PID:6800
- C:\Windows\System\xdJLbqL.exe
  C:\Windows\System\xdJLbqL.exe
  2⤵
  PID:6840
- C:\Windows\System\dOeXynf.exe
  C:\Windows\System\dOeXynf.exe
  2⤵
  PID:6872
- C:\Windows\System\NvhiRti.exe
  C:\Windows\System\NvhiRti.exe
  2⤵
  PID:6904
- C:\Windows\System\FvTsHMm.exe
  C:\Windows\System\FvTsHMm.exe
  2⤵
  PID:6940
- C:\Windows\System\zEsXzaD.exe
  C:\Windows\System\zEsXzaD.exe
  2⤵
  PID:6972
- C:\Windows\System\PtsmjGo.exe
  C:\Windows\System\PtsmjGo.exe
  2⤵
  PID:6996
- C:\Windows\System\WfsmXQy.exe
  C:\Windows\System\WfsmXQy.exe
  2⤵
  PID:7016
- C:\Windows\System\vbRmIaA.exe
  C:\Windows\System\vbRmIaA.exe
  2⤵
  PID:7044
- C:\Windows\System\okfsGWJ.exe
  C:\Windows\System\okfsGWJ.exe
  2⤵
  PID:7068
- C:\Windows\System\ozJnVPF.exe
  C:\Windows\System\ozJnVPF.exe
  2⤵
  PID:7100
- C:\Windows\System\hwzLtnO.exe
  C:\Windows\System\hwzLtnO.exe
  2⤵
  PID:7116
- C:\Windows\System\FmTxQGE.exe
  C:\Windows\System\FmTxQGE.exe
  2⤵
  PID:7144
- C:\Windows\System\yhrGqXH.exe
  C:\Windows\System\yhrGqXH.exe
  2⤵
  PID:4472
- C:\Windows\System\rOqRNrL.exe
  C:\Windows\System\rOqRNrL.exe
  2⤵
  PID:2316
- C:\Windows\System\hTRYOCR.exe
  C:\Windows\System\hTRYOCR.exe
  2⤵
  PID:6216
- C:\Windows\System\RINUUsW.exe
  C:\Windows\System\RINUUsW.exe
  2⤵
  PID:6272
- C:\Windows\System\tLtrcDu.exe
  C:\Windows\System\tLtrcDu.exe
  2⤵
  PID:6352
- C:\Windows\System\pWWajXo.exe
  C:\Windows\System\pWWajXo.exe
  2⤵
  PID:6388
- C:\Windows\System\XgcMSMy.exe
  C:\Windows\System\XgcMSMy.exe
  2⤵
  PID:6468
- C:\Windows\System\eRbJNzr.exe
  C:\Windows\System\eRbJNzr.exe
  2⤵
  PID:6628
- C:\Windows\System\hpUTeoc.exe
  C:\Windows\System\hpUTeoc.exe
  2⤵
  PID:6696
- C:\Windows\System\BAummms.exe
  C:\Windows\System\BAummms.exe
  2⤵
  PID:6748
- C:\Windows\System\XsLTDdf.exe
  C:\Windows\System\XsLTDdf.exe
  2⤵
  PID:6808
- C:\Windows\System\Ejqcgxm.exe
  C:\Windows\System\Ejqcgxm.exe
  2⤵
  PID:6868
- C:\Windows\System\pSIwVNG.exe
  C:\Windows\System\pSIwVNG.exe
  2⤵
  PID:6900
- C:\Windows\System\gRddBoR.exe
  C:\Windows\System\gRddBoR.exe
  2⤵
  PID:6964
- C:\Windows\System\JbgujYx.exe
  C:\Windows\System\JbgujYx.exe
  2⤵
  PID:7012
- C:\Windows\System\nAgAFcp.exe
  C:\Windows\System\nAgAFcp.exe
  2⤵
  PID:7112
- C:\Windows\System\LSJRqYv.exe
  C:\Windows\System\LSJRqYv.exe
  2⤵
  PID:6208
- C:\Windows\System\vMjNJsZ.exe
  C:\Windows\System\vMjNJsZ.exe
  2⤵
  PID:6484
- C:\Windows\System\iBkjcsB.exe
  C:\Windows\System\iBkjcsB.exe
  2⤵
  PID:6460
- C:\Windows\System\iGzcygD.exe
  C:\Windows\System\iGzcygD.exe
  2⤵
  PID:6660
- C:\Windows\System\tvRcbUE.exe
  C:\Windows\System\tvRcbUE.exe
  2⤵
  PID:6864
- C:\Windows\System\sDlNzNA.exe
  C:\Windows\System\sDlNzNA.exe
  2⤵
  PID:6836
- C:\Windows\System\yqffnEA.exe
  C:\Windows\System\yqffnEA.exe
  2⤵
  PID:6920
- C:\Windows\System\VfiCgYA.exe
  C:\Windows\System\VfiCgYA.exe
  2⤵
  PID:7056
- C:\Windows\System\lxcFzqM.exe
  C:\Windows\System\lxcFzqM.exe
  2⤵
  PID:6676
- C:\Windows\System\KigxJOy.exe
  C:\Windows\System\KigxJOy.exe
  2⤵
  PID:7032
- C:\Windows\System\DHZZcLs.exe
  C:\Windows\System\DHZZcLs.exe
  2⤵
  PID:6296
- C:\Windows\System\FJeoaqg.exe
  C:\Windows\System\FJeoaqg.exe
  2⤵
  PID:7172
- C:\Windows\System\wCKZdhy.exe
  C:\Windows\System\wCKZdhy.exe
  2⤵
  PID:7200
- C:\Windows\System\HQySmBu.exe
  C:\Windows\System\HQySmBu.exe
  2⤵
  PID:7216
- C:\Windows\System\ijTBTiu.exe
  C:\Windows\System\ijTBTiu.exe
  2⤵
  PID:7240
- C:\Windows\System\tNBXhUb.exe
  C:\Windows\System\tNBXhUb.exe
  2⤵
  PID:7272
- C:\Windows\System\cKGhADL.exe
  C:\Windows\System\cKGhADL.exe
  2⤵
  PID:7300
- C:\Windows\System\ybWwyaF.exe
  C:\Windows\System\ybWwyaF.exe
  2⤵
  PID:7316
- C:\Windows\System\PIslgGg.exe
  C:\Windows\System\PIslgGg.exe
  2⤵
  PID:7340
- C:\Windows\System\XmlbTPO.exe
  C:\Windows\System\XmlbTPO.exe
  2⤵
  PID:7368
- C:\Windows\System\CQQVYhF.exe
  C:\Windows\System\CQQVYhF.exe
  2⤵
  PID:7396
- C:\Windows\System\DcoWNOl.exe
  C:\Windows\System\DcoWNOl.exe
  2⤵
  PID:7420
- C:\Windows\System\wepQTTf.exe
  C:\Windows\System\wepQTTf.exe
  2⤵
  PID:7448
- C:\Windows\System\usmwPiV.exe
  C:\Windows\System\usmwPiV.exe
  2⤵
  PID:7508
- C:\Windows\System\rXOQDHD.exe
  C:\Windows\System\rXOQDHD.exe
  2⤵
  PID:7536
- C:\Windows\System\BoiZxTK.exe
  C:\Windows\System\BoiZxTK.exe
  2⤵
  PID:7564
- C:\Windows\System\SQVubMo.exe
  C:\Windows\System\SQVubMo.exe
  2⤵
  PID:7592
- C:\Windows\System\pFCiMvx.exe
  C:\Windows\System\pFCiMvx.exe
  2⤵
  PID:7628
- C:\Windows\System\sVuhEuW.exe
  C:\Windows\System\sVuhEuW.exe
  2⤵
  PID:7648
- C:\Windows\System\RUhAClG.exe
  C:\Windows\System\RUhAClG.exe
  2⤵
  PID:7676
- C:\Windows\System\CXntOgY.exe
  C:\Windows\System\CXntOgY.exe
  2⤵
  PID:7704
- C:\Windows\System\UionWry.exe
  C:\Windows\System\UionWry.exe
  2⤵
  PID:7744
- C:\Windows\System\jHyStIE.exe
  C:\Windows\System\jHyStIE.exe
  2⤵
  PID:7772
- C:\Windows\System\gnYmQuq.exe
  C:\Windows\System\gnYmQuq.exe
  2⤵
  PID:7800
- C:\Windows\System\TBHtzsN.exe
  C:\Windows\System\TBHtzsN.exe
  2⤵
  PID:7816
- C:\Windows\System\RfCqXki.exe
  C:\Windows\System\RfCqXki.exe
  2⤵
  PID:7836
- C:\Windows\System\wsfUJrm.exe
  C:\Windows\System\wsfUJrm.exe
  2⤵
  PID:7868
- C:\Windows\System\goNqEhH.exe
  C:\Windows\System\goNqEhH.exe
  2⤵
  PID:7888
- C:\Windows\System\bejxNuL.exe
  C:\Windows\System\bejxNuL.exe
  2⤵
  PID:7920
- C:\Windows\System\BnCbkxD.exe
  C:\Windows\System\BnCbkxD.exe
  2⤵
  PID:7940
- C:\Windows\System\nGZJniC.exe
  C:\Windows\System\nGZJniC.exe
  2⤵
  PID:7964
- C:\Windows\System\TXXVrRk.exe
  C:\Windows\System\TXXVrRk.exe
  2⤵
  PID:7988
- C:\Windows\System\jKYZoiq.exe
  C:\Windows\System\jKYZoiq.exe
  2⤵
  PID:8028
- C:\Windows\System\vEAsdDb.exe
  C:\Windows\System\vEAsdDb.exe
  2⤵
  PID:8056
- C:\Windows\System\CYXndaq.exe
  C:\Windows\System\CYXndaq.exe
  2⤵
  PID:8080
- C:\Windows\System\MXYvCMh.exe
  C:\Windows\System\MXYvCMh.exe
  2⤵
  PID:8112
- C:\Windows\System\OfgYLzy.exe
  C:\Windows\System\OfgYLzy.exe
  2⤵
  PID:8152
- C:\Windows\System\VvpZnkn.exe
  C:\Windows\System\VvpZnkn.exe
  2⤵
  PID:8184
- C:\Windows\System\jCgKUMu.exe
  C:\Windows\System\jCgKUMu.exe
  2⤵
  PID:7188
- C:\Windows\System\inNxSSK.exe
  C:\Windows\System\inNxSSK.exe
  2⤵
  PID:7212
- C:\Windows\System\KqKCYgT.exe
  C:\Windows\System\KqKCYgT.exe
  2⤵
  PID:7336
- C:\Windows\System\IWltDoa.exe
  C:\Windows\System\IWltDoa.exe
  2⤵
  PID:7392
- C:\Windows\System\JqOBXbI.exe
  C:\Windows\System\JqOBXbI.exe
  2⤵
  PID:7440
- C:\Windows\System\QDawRei.exe
  C:\Windows\System\QDawRei.exe
  2⤵
  PID:7528
- C:\Windows\System\HnxDqUP.exe
  C:\Windows\System\HnxDqUP.exe
  2⤵
  PID:7576
- C:\Windows\System\XkLITdK.exe
  C:\Windows\System\XkLITdK.exe
  2⤵
  PID:7640
- C:\Windows\System\vEyDLEx.exe
  C:\Windows\System\vEyDLEx.exe
  2⤵
  PID:7696
- C:\Windows\System\eewNkgm.exe
  C:\Windows\System\eewNkgm.exe
  2⤵
  PID:1132
- C:\Windows\System\iDxOBZb.exe
  C:\Windows\System\iDxOBZb.exe
  2⤵
  PID:7760
- C:\Windows\System\trtpbrk.exe
  C:\Windows\System\trtpbrk.exe
  2⤵
  PID:7852
- C:\Windows\System\SsspThL.exe
  C:\Windows\System\SsspThL.exe
  2⤵
  PID:7880
- C:\Windows\System\PnPbNZd.exe
  C:\Windows\System\PnPbNZd.exe
  2⤵
  PID:7980
- C:\Windows\System\jdEePJh.exe
  C:\Windows\System\jdEePJh.exe
  2⤵
  PID:8076
- C:\Windows\System\kFUgqqv.exe
  C:\Windows\System\kFUgqqv.exe
  2⤵
  PID:8144
- C:\Windows\System\VPGUnKK.exe
  C:\Windows\System\VPGUnKK.exe
  2⤵
  PID:7208
- C:\Windows\System\WUncIYf.exe
  C:\Windows\System\WUncIYf.exe
  2⤵
  PID:7364
- C:\Windows\System\HvriuBB.exe
  C:\Windows\System\HvriuBB.exe
  2⤵
  PID:7436
- C:\Windows\System\MFzBAnv.exe
  C:\Windows\System\MFzBAnv.exe
  2⤵
  PID:7556
- C:\Windows\System\QwmxXsf.exe
  C:\Windows\System\QwmxXsf.exe
  2⤵
  PID:7724
- C:\Windows\System\UVbbWnh.exe
  C:\Windows\System\UVbbWnh.exe
  2⤵
  PID:7812
- C:\Windows\System\fynUIgP.exe
  C:\Windows\System\fynUIgP.exe
  2⤵
  PID:7864
- C:\Windows\System\oUGzgOX.exe
  C:\Windows\System\oUGzgOX.exe
  2⤵
  PID:8048
- C:\Windows\System\FsOenFZ.exe
  C:\Windows\System\FsOenFZ.exe
  2⤵
  PID:8168
- C:\Windows\System\CZPtAHq.exe
  C:\Windows\System\CZPtAHq.exe
  2⤵
  PID:7548
- C:\Windows\System\Fqojqpo.exe
  C:\Windows\System\Fqojqpo.exe
  2⤵
  PID:7688
- C:\Windows\System\qOVWxwE.exe
  C:\Windows\System\qOVWxwE.exe
  2⤵
  PID:7936
- C:\Windows\System\xHuqITF.exe
  C:\Windows\System\xHuqITF.exe
  2⤵
  PID:7660
- C:\Windows\System\hBGsusA.exe
  C:\Windows\System\hBGsusA.exe
  2⤵
  PID:8204
- C:\Windows\System\sawLymD.exe
  C:\Windows\System\sawLymD.exe
  2⤵
  PID:8224
- C:\Windows\System\eIRrueW.exe
  C:\Windows\System\eIRrueW.exe
  2⤵
  PID:8280
- C:\Windows\System\WoLhhNo.exe
  C:\Windows\System\WoLhhNo.exe
  2⤵
  PID:8312
- C:\Windows\System\rezuYwD.exe
  C:\Windows\System\rezuYwD.exe
  2⤵
  PID:8364
- C:\Windows\System\uYnFZuc.exe
  C:\Windows\System\uYnFZuc.exe
  2⤵
  PID:8384
- C:\Windows\System\GWDjqGo.exe
  C:\Windows\System\GWDjqGo.exe
  2⤵
  PID:8408
- C:\Windows\System\DKbXdJe.exe
  C:\Windows\System\DKbXdJe.exe
  2⤵
  PID:8432
- C:\Windows\System\qITXYRW.exe
  C:\Windows\System\qITXYRW.exe
  2⤵
  PID:8468
- C:\Windows\System\UjMZbGG.exe
  C:\Windows\System\UjMZbGG.exe
  2⤵
  PID:8520
- C:\Windows\System\FJnoAzS.exe
  C:\Windows\System\FJnoAzS.exe
  2⤵
  PID:8536
- C:\Windows\System\gpeaIrn.exe
  C:\Windows\System\gpeaIrn.exe
  2⤵
  PID:8560
- C:\Windows\System\rCTMJFR.exe
  C:\Windows\System\rCTMJFR.exe
  2⤵
  PID:8592
- C:\Windows\System\lyPybNb.exe
  C:\Windows\System\lyPybNb.exe
  2⤵
  PID:8608
- C:\Windows\System\oVIsOPM.exe
  C:\Windows\System\oVIsOPM.exe
  2⤵
  PID:8628
- C:\Windows\System\rQOwKwx.exe
  C:\Windows\System\rQOwKwx.exe
  2⤵
  PID:8668
- C:\Windows\System\OOMEdYr.exe
  C:\Windows\System\OOMEdYr.exe
  2⤵
  PID:8684
- C:\Windows\System\pdemMqI.exe
  C:\Windows\System\pdemMqI.exe
  2⤵
  PID:8708
- C:\Windows\System\eCHTwgs.exe
  C:\Windows\System\eCHTwgs.exe
  2⤵
  PID:8724
- C:\Windows\System\fjaiwHQ.exe
  C:\Windows\System\fjaiwHQ.exe
  2⤵
  PID:8740
- C:\Windows\System\zFrfnFi.exe
  C:\Windows\System\zFrfnFi.exe
  2⤵
  PID:8756
- C:\Windows\System\KMDlxSr.exe
  C:\Windows\System\KMDlxSr.exe
  2⤵
  PID:8792
- C:\Windows\System\aTEeKZV.exe
  C:\Windows\System\aTEeKZV.exe
  2⤵
  PID:8840
- C:\Windows\System\wYztaUd.exe
  C:\Windows\System\wYztaUd.exe
  2⤵
  PID:8880
- C:\Windows\System\YdWQZnv.exe
  C:\Windows\System\YdWQZnv.exe
  2⤵
  PID:8900
- C:\Windows\System\TgIJSud.exe
  C:\Windows\System\TgIJSud.exe
  2⤵
  PID:8924
- C:\Windows\System\iQjekRn.exe
  C:\Windows\System\iQjekRn.exe
  2⤵
  PID:8944
- C:\Windows\System\PIdUXcG.exe
  C:\Windows\System\PIdUXcG.exe
  2⤵
  PID:8972
- C:\Windows\System\BSiGYjd.exe
  C:\Windows\System\BSiGYjd.exe
  2⤵
  PID:8996
- C:\Windows\System\truTTvu.exe
  C:\Windows\System\truTTvu.exe
  2⤵
  PID:9020
- C:\Windows\System\hZEvbSz.exe
  C:\Windows\System\hZEvbSz.exe
  2⤵
  PID:9040
- C:\Windows\System\dPdpYOz.exe
  C:\Windows\System\dPdpYOz.exe
  2⤵
  PID:9072
- C:\Windows\System\ZdMrWpM.exe
  C:\Windows\System\ZdMrWpM.exe
  2⤵
  PID:9128
- C:\Windows\System\IeUyNMA.exe
  C:\Windows\System\IeUyNMA.exe
  2⤵
  PID:9152
- C:\Windows\System\eBYkpTn.exe
  C:\Windows\System\eBYkpTn.exe
  2⤵
  PID:9168
- C:\Windows\System\SQxvPXv.exe
  C:\Windows\System\SQxvPXv.exe
  2⤵
  PID:7844
- C:\Windows\System\rAHrMsz.exe
  C:\Windows\System\rAHrMsz.exe
  2⤵
  PID:8244
- C:\Windows\System\TSykgLx.exe
  C:\Windows\System\TSykgLx.exe
  2⤵
  PID:8216
- C:\Windows\System\ChMPPSO.exe
  C:\Windows\System\ChMPPSO.exe
  2⤵
  PID:8328
- C:\Windows\System\SnQeaDh.exe
  C:\Windows\System\SnQeaDh.exe
  2⤵
  PID:8400
- C:\Windows\System\LSbwKhO.exe
  C:\Windows\System\LSbwKhO.exe
  2⤵
  PID:8444
- C:\Windows\System\WCubzqy.exe
  C:\Windows\System\WCubzqy.exe
  2⤵
  PID:8548
- C:\Windows\System\oKeuMUQ.exe
  C:\Windows\System\oKeuMUQ.exe
  2⤵
  PID:8640
- C:\Windows\System\OEItkfE.exe
  C:\Windows\System\OEItkfE.exe
  2⤵
  PID:8736
- C:\Windows\System\tbRVDHP.exe
  C:\Windows\System\tbRVDHP.exe
  2⤵
  PID:8752
- C:\Windows\System\ttiZaaW.exe
  C:\Windows\System\ttiZaaW.exe
  2⤵
  PID:8768
- C:\Windows\System\BTLbjEM.exe
  C:\Windows\System\BTLbjEM.exe
  2⤵
  PID:8860
- C:\Windows\System\vclVEdM.exe
  C:\Windows\System\vclVEdM.exe
  2⤵
  PID:8888
- C:\Windows\System\ayrhnih.exe
  C:\Windows\System\ayrhnih.exe
  2⤵
  PID:8956
- C:\Windows\System\IbHMDDa.exe
  C:\Windows\System\IbHMDDa.exe
  2⤵
  PID:8964
- C:\Windows\System\ucVUure.exe
  C:\Windows\System\ucVUure.exe
  2⤵
  PID:8984
- C:\Windows\System\aXREIWW.exe
  C:\Windows\System\aXREIWW.exe
  2⤵
  PID:9136
- C:\Windows\System\LHETfqu.exe
  C:\Windows\System\LHETfqu.exe
  2⤵
  PID:9124
- C:\Windows\System\MUffbdJ.exe
  C:\Windows\System\MUffbdJ.exe
  2⤵
  PID:7312
- C:\Windows\System\IfeoDLE.exe
  C:\Windows\System\IfeoDLE.exe
  2⤵
  PID:8288
- C:\Windows\System\UgNMlFF.exe
  C:\Windows\System\UgNMlFF.exe
  2⤵
  PID:8420
- C:\Windows\System\EQjlAWo.exe
  C:\Windows\System\EQjlAWo.exe
  2⤵
  PID:8644
- C:\Windows\System\OjufpHF.exe
  C:\Windows\System\OjufpHF.exe
  2⤵
  PID:8892
- C:\Windows\System\DzELrlR.exe
  C:\Windows\System\DzELrlR.exe
  2⤵
  PID:9144
- C:\Windows\System\kYMHgOQ.exe
  C:\Windows\System\kYMHgOQ.exe
  2⤵
  PID:8584
- C:\Windows\System\ObdLrWQ.exe
  C:\Windows\System\ObdLrWQ.exe
  2⤵
  PID:9164
- C:\Windows\System\oWMNnKM.exe
  C:\Windows\System\oWMNnKM.exe
  2⤵
  PID:8532
- C:\Windows\System\OHEupZB.exe
  C:\Windows\System\OHEupZB.exe
  2⤵
  PID:9220
- C:\Windows\System\avtJuxk.exe
  C:\Windows\System\avtJuxk.exe
  2⤵
  PID:9244
- C:\Windows\System\McDlJPm.exe
  C:\Windows\System\McDlJPm.exe
  2⤵
  PID:9272
- C:\Windows\System\cdoOTAd.exe
  C:\Windows\System\cdoOTAd.exe
  2⤵
  PID:9300
- C:\Windows\System\jpvNpJx.exe
  C:\Windows\System\jpvNpJx.exe
  2⤵
  PID:9328
- C:\Windows\System\jdYrKVK.exe
  C:\Windows\System\jdYrKVK.exe
  2⤵
  PID:9344
- C:\Windows\System\sKDyjBL.exe
  C:\Windows\System\sKDyjBL.exe
  2⤵
  PID:9372
- C:\Windows\System\lGzEhzI.exe
  C:\Windows\System\lGzEhzI.exe
  2⤵
  PID:9388
- C:\Windows\System\IboveDM.exe
  C:\Windows\System\IboveDM.exe
  2⤵
  PID:9432
- C:\Windows\System\YmsXJVU.exe
  C:\Windows\System\YmsXJVU.exe
  2⤵
  PID:9468
- C:\Windows\System\emzwmFv.exe
  C:\Windows\System\emzwmFv.exe
  2⤵
  PID:9488
- C:\Windows\System\yUHgEUM.exe
  C:\Windows\System\yUHgEUM.exe
  2⤵
  PID:9524
- C:\Windows\System\UbecIoO.exe
  C:\Windows\System\UbecIoO.exe
  2⤵
  PID:9544
- C:\Windows\System\bXCmDQA.exe
  C:\Windows\System\bXCmDQA.exe
  2⤵
  PID:9580
- C:\Windows\System\kXVoXRH.exe
  C:\Windows\System\kXVoXRH.exe
  2⤵
  PID:9604
- C:\Windows\System\lXysRaC.exe
  C:\Windows\System\lXysRaC.exe
  2⤵
  PID:9632
- C:\Windows\System\RJWHIpI.exe
  C:\Windows\System\RJWHIpI.exe
  2⤵
  PID:9656
- C:\Windows\System\uyguWXb.exe
  C:\Windows\System\uyguWXb.exe
  2⤵
  PID:9692
- C:\Windows\System\rLdXPPZ.exe
  C:\Windows\System\rLdXPPZ.exe
  2⤵
  PID:9720
- C:\Windows\System\HsdMjGm.exe
  C:\Windows\System\HsdMjGm.exe
  2⤵
  PID:9740
- C:\Windows\System\gkDaheX.exe
  C:\Windows\System\gkDaheX.exe
  2⤵
  PID:9776
- C:\Windows\System\Zklurcx.exe
  C:\Windows\System\Zklurcx.exe
  2⤵
  PID:9804
- C:\Windows\System\MWxdTTY.exe
  C:\Windows\System\MWxdTTY.exe
  2⤵
  PID:9832
- C:\Windows\System\hGkglBQ.exe
  C:\Windows\System\hGkglBQ.exe
  2⤵
  PID:9860
- C:\Windows\System\WMtPphw.exe
  C:\Windows\System\WMtPphw.exe
  2⤵
  PID:9880
- C:\Windows\System\QDYQlJz.exe
  C:\Windows\System\QDYQlJz.exe
  2⤵
  PID:9908
- C:\Windows\System\JLhlsaX.exe
  C:\Windows\System\JLhlsaX.exe
  2⤵
  PID:9932
- C:\Windows\System\KDdWwMB.exe
  C:\Windows\System\KDdWwMB.exe
  2⤵
  PID:9960
- C:\Windows\System\nBNXbmQ.exe
  C:\Windows\System\nBNXbmQ.exe
  2⤵
  PID:9988
- C:\Windows\System\ZeZgNko.exe
  C:\Windows\System\ZeZgNko.exe
  2⤵
  PID:10020
- C:\Windows\System\hZszBLz.exe
  C:\Windows\System\hZszBLz.exe
  2⤵
  PID:10048
- C:\Windows\System\sOWoJBu.exe
  C:\Windows\System\sOWoJBu.exe
  2⤵
  PID:10076
- C:\Windows\System\OGazFIZ.exe
  C:\Windows\System\OGazFIZ.exe
  2⤵
  PID:10108
- C:\Windows\System\dkMTBvU.exe
  C:\Windows\System\dkMTBvU.exe
  2⤵
  PID:10128
- C:\Windows\System\TKCCwug.exe
  C:\Windows\System\TKCCwug.exe
  2⤵
  PID:10164
- C:\Windows\System\mhgWYzD.exe
  C:\Windows\System\mhgWYzD.exe
  2⤵
  PID:10196
- C:\Windows\System\bqJaiti.exe
  C:\Windows\System\bqJaiti.exe
  2⤵
  PID:10212
- C:\Windows\System\UJRxfcO.exe
  C:\Windows\System\UJRxfcO.exe
  2⤵
  PID:8512
- C:\Windows\System\OmNtbkq.exe
  C:\Windows\System\OmNtbkq.exe
  2⤵
  PID:9292
- C:\Windows\System\whrZHqK.exe
  C:\Windows\System\whrZHqK.exe
  2⤵
  PID:9340
- C:\Windows\System\PvvnjWF.exe
  C:\Windows\System\PvvnjWF.exe
  2⤵
  PID:9408
- C:\Windows\System\MOAOLbi.exe
  C:\Windows\System\MOAOLbi.exe
  2⤵
  PID:9464
- C:\Windows\System\rYeolEz.exe
  C:\Windows\System\rYeolEz.exe
  2⤵
  PID:9480
- C:\Windows\System\nxbJgvy.exe
  C:\Windows\System\nxbJgvy.exe
  2⤵
  PID:9572
- C:\Windows\System\KhdbHXT.exe
  C:\Windows\System\KhdbHXT.exe
  2⤵
  PID:9640
- C:\Windows\System\JAyLrDE.exe
  C:\Windows\System\JAyLrDE.exe
  2⤵
  PID:9752
- C:\Windows\System\oNWOLEJ.exe
  C:\Windows\System\oNWOLEJ.exe
  2⤵
  PID:9796
- C:\Windows\System\JBXThnU.exe
  C:\Windows\System\JBXThnU.exe
  2⤵
  PID:9872
- C:\Windows\System\UvtOEbl.exe
  C:\Windows\System\UvtOEbl.exe
  2⤵
  PID:9920
- C:\Windows\System\AKjhcNc.exe
  C:\Windows\System\AKjhcNc.exe
  2⤵
  PID:10000
- C:\Windows\System\RwQlMrc.exe
  C:\Windows\System\RwQlMrc.exe
  2⤵
  PID:10028
- C:\Windows\System\zeynAkF.exe
  C:\Windows\System\zeynAkF.exe
  2⤵
  PID:10064
- C:\Windows\System\glIfIRg.exe
  C:\Windows\System\glIfIRg.exe
  2⤵
  PID:10188
- C:\Windows\System\aMJtBhp.exe
  C:\Windows\System\aMJtBhp.exe
  2⤵
  PID:10208
- C:\Windows\System\kDrInPX.exe
  C:\Windows\System\kDrInPX.exe
  2⤵
  PID:8776
- C:\Windows\System\WyeYLKh.exe
  C:\Windows\System\WyeYLKh.exe
  2⤵
  PID:9384
- C:\Windows\System\AWBPime.exe
  C:\Windows\System\AWBPime.exe
  2⤵
  PID:9532
- C:\Windows\System\pmdTqDL.exe
  C:\Windows\System\pmdTqDL.exe
  2⤵
  PID:9676
- C:\Windows\System\RmMdZAI.exe
  C:\Windows\System\RmMdZAI.exe
  2⤵
  PID:9956
- C:\Windows\System\ZwMXIEb.exe
  C:\Windows\System\ZwMXIEb.exe
  2⤵
  PID:10044
- C:\Windows\System\zobORcn.exe
  C:\Windows\System\zobORcn.exe
  2⤵
  PID:10184
- C:\Windows\System\lciGddN.exe
  C:\Windows\System\lciGddN.exe
  2⤵
  PID:9460
- C:\Windows\System\POfBfzb.exe
  C:\Windows\System\POfBfzb.exe
  2⤵
  PID:9756
- C:\Windows\System\HMzCuUE.exe
  C:\Windows\System\HMzCuUE.exe
  2⤵
  PID:10016
- C:\Windows\System\EUHyKkI.exe
  C:\Windows\System\EUHyKkI.exe
  2⤵
  PID:9616
- C:\Windows\System\ohlxqba.exe
  C:\Windows\System\ohlxqba.exe
  2⤵
  PID:10264
- C:\Windows\System\kVZNLyH.exe
  C:\Windows\System\kVZNLyH.exe
  2⤵
  PID:10304
- C:\Windows\System\XJwqodR.exe
  C:\Windows\System\XJwqodR.exe
  2⤵
  PID:10324
- C:\Windows\System\oBXHDnc.exe
  C:\Windows\System\oBXHDnc.exe
  2⤵
  PID:10348
- C:\Windows\System\eLIFMXl.exe
  C:\Windows\System\eLIFMXl.exe
  2⤵
  PID:10372
- C:\Windows\System\LZPcuJk.exe
  C:\Windows\System\LZPcuJk.exe
  2⤵
  PID:10392
- C:\Windows\System\BJpOrQz.exe
  C:\Windows\System\BJpOrQz.exe
  2⤵
  PID:10408
- C:\Windows\System\EHdBeih.exe
  C:\Windows\System\EHdBeih.exe
  2⤵
  PID:10424
- C:\Windows\System\OsXnwVF.exe
  C:\Windows\System\OsXnwVF.exe
  2⤵
  PID:10444
- C:\Windows\System\qKEfmkn.exe
  C:\Windows\System\qKEfmkn.exe
  2⤵
  PID:10480
- C:\Windows\System\DxGUNLP.exe
  C:\Windows\System\DxGUNLP.exe
  2⤵
  PID:10520
- C:\Windows\System\IgbKLpu.exe
  C:\Windows\System\IgbKLpu.exe
  2⤵
  PID:10556
- C:\Windows\System\lFRPtYL.exe
  C:\Windows\System\lFRPtYL.exe
  2⤵
  PID:10580
- C:\Windows\System\oxqWFYh.exe
  C:\Windows\System\oxqWFYh.exe
  2⤵
  PID:10604
- C:\Windows\System\NGqeuzM.exe
  C:\Windows\System\NGqeuzM.exe
  2⤵
  PID:10672
- C:\Windows\System\hNrPXdf.exe
  C:\Windows\System\hNrPXdf.exe
  2⤵
  PID:10692
- C:\Windows\System\ytPThhN.exe
  C:\Windows\System\ytPThhN.exe
  2⤵
  PID:10716
- C:\Windows\System\RaTdfue.exe
  C:\Windows\System\RaTdfue.exe
  2⤵
  PID:10740
- C:\Windows\System\faAMCki.exe
  C:\Windows\System\faAMCki.exe
  2⤵
  PID:10764
- C:\Windows\System\jgVdBcA.exe
  C:\Windows\System\jgVdBcA.exe
  2⤵
  PID:10788
- C:\Windows\System\KFAMDQA.exe
  C:\Windows\System\KFAMDQA.exe
  2⤵
  PID:10816
- C:\Windows\System\LgTZnPM.exe
  C:\Windows\System\LgTZnPM.exe
  2⤵
  PID:10848
- C:\Windows\System\hRDCggO.exe
  C:\Windows\System\hRDCggO.exe
  2⤵
  PID:10876
- C:\Windows\System\lgihgii.exe
  C:\Windows\System\lgihgii.exe
  2⤵
  PID:10904
- C:\Windows\System\xkraDqd.exe
  C:\Windows\System\xkraDqd.exe
  2⤵
  PID:10932
- C:\Windows\System\qsZRGsC.exe
  C:\Windows\System\qsZRGsC.exe
  2⤵
  PID:10956
- C:\Windows\System\jqVFfof.exe
  C:\Windows\System\jqVFfof.exe
  2⤵
  PID:10980
- C:\Windows\System\yDxDEjA.exe
  C:\Windows\System\yDxDEjA.exe
  2⤵
  PID:11000
- C:\Windows\System\BIYZaWf.exe
  C:\Windows\System\BIYZaWf.exe
  2⤵
  PID:11028
- C:\Windows\System\wsGKoNv.exe
  C:\Windows\System\wsGKoNv.exe
  2⤵
  PID:11052
- C:\Windows\System\rITRpXy.exe
  C:\Windows\System\rITRpXy.exe
  2⤵
  PID:11076
- C:\Windows\System\WQFkkQx.exe
  C:\Windows\System\WQFkkQx.exe
  2⤵
  PID:11108
- C:\Windows\System\ZLNTRrs.exe
  C:\Windows\System\ZLNTRrs.exe
  2⤵
  PID:11136
- C:\Windows\System\tMBXKPj.exe
  C:\Windows\System\tMBXKPj.exe
  2⤵
  PID:11164
- C:\Windows\System\WIcbXFk.exe
  C:\Windows\System\WIcbXFk.exe
  2⤵
  PID:11180
- C:\Windows\System\VsLnxUw.exe
  C:\Windows\System\VsLnxUw.exe
  2⤵
  PID:11208
- C:\Windows\System\RjJQnnb.exe
  C:\Windows\System\RjJQnnb.exe
  2⤵
  PID:11236
- C:\Windows\System\VsjZLyu.exe
  C:\Windows\System\VsjZLyu.exe
  2⤵
  PID:10152
- C:\Windows\System\OutxhMv.exe
  C:\Windows\System\OutxhMv.exe
  2⤵
  PID:10344
- C:\Windows\System\aWCPQog.exe
  C:\Windows\System\aWCPQog.exe
  2⤵
  PID:10400
- C:\Windows\System\OwlebLH.exe
  C:\Windows\System\OwlebLH.exe
  2⤵
  PID:10472
- C:\Windows\System\fzKvKAb.exe
  C:\Windows\System\fzKvKAb.exe
  2⤵
  PID:10516
- C:\Windows\System\EsTbpFU.exe
  C:\Windows\System\EsTbpFU.exe
  2⤵
  PID:10540
- C:\Windows\System\AfffVdE.exe
  C:\Windows\System\AfffVdE.exe
  2⤵
  PID:10704
- C:\Windows\System\CoDDiKe.exe
  C:\Windows\System\CoDDiKe.exe
  2⤵
  PID:10708
- C:\Windows\System\hTLwzwY.exe
  C:\Windows\System\hTLwzwY.exe
  2⤵
  PID:10736
- C:\Windows\System\JrzErMP.exe
  C:\Windows\System\JrzErMP.exe
  2⤵
  PID:10860
- C:\Windows\System\xICLJhY.exe
  C:\Windows\System\xICLJhY.exe
  2⤵
  PID:10948
- C:\Windows\System\jOIDGiY.exe
  C:\Windows\System\jOIDGiY.exe
  2⤵
  PID:10996
- C:\Windows\System\VYzVMcL.exe
  C:\Windows\System\VYzVMcL.exe
  2⤵
  PID:11068
- C:\Windows\System\AYcvhDx.exe
  C:\Windows\System\AYcvhDx.exe
  2⤵
  PID:11096
- C:\Windows\System\YUNEBeJ.exe
  C:\Windows\System\YUNEBeJ.exe
  2⤵
  PID:11176
- C:\Windows\System\gNwrAto.exe
  C:\Windows\System\gNwrAto.exe
  2⤵
  PID:11248
- C:\Windows\System\HCXKQua.exe
  C:\Windows\System\HCXKQua.exe
  2⤵
  PID:10336
- C:\Windows\System\EndExvY.exe
  C:\Windows\System\EndExvY.exe
  2⤵
  PID:10404
- C:\Windows\System\GgPsajD.exe
  C:\Windows\System\GgPsajD.exe
  2⤵
  PID:10592
- C:\Windows\System\SRzxBEx.exe
  C:\Windows\System\SRzxBEx.exe
  2⤵
  PID:10784
- C:\Windows\System\nCbFsWT.exe
  C:\Windows\System\nCbFsWT.exe
  2⤵
  PID:10872
- C:\Windows\System\FNqIGrI.exe
  C:\Windows\System\FNqIGrI.exe
  2⤵
  PID:11128
- C:\Windows\System\XIwgWjl.exe
  C:\Windows\System\XIwgWjl.exe
  2⤵
  PID:10280
- C:\Windows\System\JQniwyj.exe
  C:\Windows\System\JQniwyj.exe
  2⤵
  PID:10832
- C:\Windows\System\sttczuE.exe
  C:\Windows\System\sttczuE.exe
  2⤵
  PID:11256
- C:\Windows\System\WxyyYjf.exe
  C:\Windows\System\WxyyYjf.exe
  2⤵
  PID:10364
- C:\Windows\System\lCBcnAA.exe
  C:\Windows\System\lCBcnAA.exe
  2⤵
  PID:11268
- C:\Windows\System\HFjfBCE.exe
  C:\Windows\System\HFjfBCE.exe
  2⤵
  PID:11292
- C:\Windows\System\wJSIUVr.exe
  C:\Windows\System\wJSIUVr.exe
  2⤵
  PID:11324
- C:\Windows\System\IEHfRbT.exe
  C:\Windows\System\IEHfRbT.exe
  2⤵
  PID:11344
- C:\Windows\System\mzonwiH.exe
  C:\Windows\System\mzonwiH.exe
  2⤵
  PID:11384
- C:\Windows\System\kVgVbbm.exe
  C:\Windows\System\kVgVbbm.exe
  2⤵
  PID:11408
- C:\Windows\System\EJmGSyr.exe
  C:\Windows\System\EJmGSyr.exe
  2⤵
  PID:11428
- C:\Windows\System\xYsgsQC.exe
  C:\Windows\System\xYsgsQC.exe
  2⤵
  PID:11460
- C:\Windows\System\OMhNDvM.exe
  C:\Windows\System\OMhNDvM.exe
  2⤵
  PID:11480
- C:\Windows\System\glnShtF.exe
  C:\Windows\System\glnShtF.exe
  2⤵
  PID:11500
- C:\Windows\System\zJwhlIL.exe
  C:\Windows\System\zJwhlIL.exe
  2⤵
  PID:11524
- C:\Windows\System\ySgSXRw.exe
  C:\Windows\System\ySgSXRw.exe
  2⤵
  PID:11568
- C:\Windows\System\RPFckFm.exe
  C:\Windows\System\RPFckFm.exe
  2⤵
  PID:11588
- C:\Windows\System\xfQdMFw.exe
  C:\Windows\System\xfQdMFw.exe
  2⤵
  PID:11636
- C:\Windows\System\KrqYfdG.exe
  C:\Windows\System\KrqYfdG.exe
  2⤵
  PID:11660
- C:\Windows\System\SbdWCsX.exe
  C:\Windows\System\SbdWCsX.exe
  2⤵
  PID:11676
- C:\Windows\System\AmQMabW.exe
  C:\Windows\System\AmQMabW.exe
  2⤵
  PID:11704
- C:\Windows\System\bCJCLwz.exe
  C:\Windows\System\bCJCLwz.exe
  2⤵
  PID:11756
- C:\Windows\System\zDCiKxe.exe
  C:\Windows\System\zDCiKxe.exe
  2⤵
  PID:11780
- C:\Windows\System\SAOUmAn.exe
  C:\Windows\System\SAOUmAn.exe
  2⤵
  PID:11800
- C:\Windows\System\qGBSThC.exe
  C:\Windows\System\qGBSThC.exe
  2⤵
  PID:11820
- C:\Windows\System\BRXjkeJ.exe
  C:\Windows\System\BRXjkeJ.exe
  2⤵
  PID:11856
- C:\Windows\System\uKQpAkN.exe
  C:\Windows\System\uKQpAkN.exe
  2⤵
  PID:11884
- C:\Windows\System\arIcRfq.exe
  C:\Windows\System\arIcRfq.exe
  2⤵
  PID:11924
- C:\Windows\System\qNaldCR.exe
  C:\Windows\System\qNaldCR.exe
  2⤵
  PID:11940
- C:\Windows\System\bfUwgYX.exe
  C:\Windows\System\bfUwgYX.exe
  2⤵
  PID:11980
- C:\Windows\System\IPakzHp.exe
  C:\Windows\System\IPakzHp.exe
  2⤵
  PID:12000
- C:\Windows\System\zWxoWmK.exe
  C:\Windows\System\zWxoWmK.exe
  2⤵
  PID:12028
- C:\Windows\System\YjbXEsv.exe
  C:\Windows\System\YjbXEsv.exe
  2⤵
  PID:12052
- C:\Windows\System\UafYFmo.exe
  C:\Windows\System\UafYFmo.exe
  2⤵
  PID:12080
- C:\Windows\System\qPAKiqx.exe
  C:\Windows\System\qPAKiqx.exe
  2⤵
  PID:12112
- C:\Windows\System\HfhcpyV.exe
  C:\Windows\System\HfhcpyV.exe
  2⤵
  PID:12152
- C:\Windows\System\BNPGIVC.exe
  C:\Windows\System\BNPGIVC.exe
  2⤵
  PID:12180
- C:\Windows\System\WknPXYY.exe
  C:\Windows\System\WknPXYY.exe
  2⤵
  PID:12204
- C:\Windows\System\jYnkVsp.exe
  C:\Windows\System\jYnkVsp.exe
  2⤵
  PID:12224
- C:\Windows\System\dgvxfsj.exe
  C:\Windows\System\dgvxfsj.exe
  2⤵
  PID:12244
- C:\Windows\System\MVHDLSz.exe
  C:\Windows\System\MVHDLSz.exe
  2⤵
  PID:12276
- C:\Windows\System\MplQkQt.exe
  C:\Windows\System\MplQkQt.exe
  2⤵
  PID:11736
- C:\Windows\System\qxsinHH.exe
  C:\Windows\System\qxsinHH.exe
  2⤵
  PID:11748
- C:\Windows\System\hdFANvA.exe
  C:\Windows\System\hdFANvA.exe
  2⤵
  PID:11796
- C:\Windows\System\IlIdlwq.exe
  C:\Windows\System\IlIdlwq.exe
  2⤵
  PID:11844
- C:\Windows\System\IjgkpvM.exe
  C:\Windows\System\IjgkpvM.exe
  2⤵
  PID:11868
- C:\Windows\System\sQZZHnv.exe
  C:\Windows\System\sQZZHnv.exe
  2⤵
  PID:11956
- C:\Windows\System\ObDXcac.exe
  C:\Windows\System\ObDXcac.exe
  2⤵
  PID:12036
- C:\Windows\System\XvmONQO.exe
  C:\Windows\System\XvmONQO.exe
  2⤵
  PID:12128
- C:\Windows\System\OUAnhKB.exe
  C:\Windows\System\OUAnhKB.exe
  2⤵
  PID:12220
- C:\Windows\System\YtAbsCF.exe
  C:\Windows\System\YtAbsCF.exe
  2⤵
  PID:11284
- C:\Windows\System\mnQsUFw.exe
  C:\Windows\System\mnQsUFw.exe
  2⤵
  PID:11392
- C:\Windows\System\ZMjAvoR.exe
  C:\Windows\System\ZMjAvoR.exe
  2⤵
  PID:11436
- C:\Windows\System\eBCBTWM.exe
  C:\Windows\System\eBCBTWM.exe
  2⤵
  PID:11492
- C:\Windows\System\aecsqqh.exe
  C:\Windows\System\aecsqqh.exe
  2⤵
  PID:11608
- C:\Windows\System\NeqIXcL.exe
  C:\Windows\System\NeqIXcL.exe
  2⤵
  PID:11808
- C:\Windows\System\XqMJUIu.exe
  C:\Windows\System\XqMJUIu.exe
  2⤵
  PID:11876
- C:\Windows\System\tSnjDwO.exe
  C:\Windows\System\tSnjDwO.exe
  2⤵
  PID:10476
- C:\Windows\System\wWGhROq.exe
  C:\Windows\System\wWGhROq.exe
  2⤵
  PID:11360
- C:\Windows\System\PNLiOMe.exe
  C:\Windows\System\PNLiOMe.exe
  2⤵
  PID:11404
- C:\Windows\System\STyGXlF.exe
  C:\Windows\System\STyGXlF.exe
  2⤵
  PID:11520
- C:\Windows\System\QHCODtC.exe
  C:\Windows\System\QHCODtC.exe
  2⤵
  PID:11644
- C:\Windows\System\NoHUeVN.exe
  C:\Windows\System\NoHUeVN.exe
  2⤵
  PID:11040
- C:\Windows\System\dbYayAm.exe
  C:\Windows\System\dbYayAm.exe
  2⤵
  PID:11316
- C:\Windows\System\gtCxFmK.exe
  C:\Windows\System\gtCxFmK.exe
  2⤵
  PID:12168
- C:\Windows\System\HsYzKJr.exe
  C:\Windows\System\HsYzKJr.exe
  2⤵
  PID:12296
- C:\Windows\System\fcKhYXe.exe
  C:\Windows\System\fcKhYXe.exe
  2⤵
  PID:12328
- C:\Windows\System\rfMJEhW.exe
  C:\Windows\System\rfMJEhW.exe
  2⤵
  PID:12352
- C:\Windows\System\VbLPVbK.exe
  C:\Windows\System\VbLPVbK.exe
  2⤵
  PID:12376
- C:\Windows\System\OjScWlu.exe
  C:\Windows\System\OjScWlu.exe
  2⤵
  PID:12408
- C:\Windows\System\VyITzJY.exe
  C:\Windows\System\VyITzJY.exe
  2⤵
  PID:12444
- C:\Windows\System\QICOckv.exe
  C:\Windows\System\QICOckv.exe
  2⤵
  PID:12460
- C:\Windows\System\NbLLrBF.exe
  C:\Windows\System\NbLLrBF.exe
  2⤵
  PID:12500
- C:\Windows\System\BjIWORR.exe
  C:\Windows\System\BjIWORR.exe
  2⤵
  PID:12528
- C:\Windows\System\NhllCdH.exe
  C:\Windows\System\NhllCdH.exe
  2⤵
  PID:12548
- C:\Windows\System\acJNLpZ.exe
  C:\Windows\System\acJNLpZ.exe
  2⤵
  PID:12572
- C:\Windows\System\DpBBlvE.exe
  C:\Windows\System\DpBBlvE.exe
  2⤵
  PID:12592
- C:\Windows\System\THRoYSC.exe
  C:\Windows\System\THRoYSC.exe
  2⤵
  PID:12628
- C:\Windows\System\Mthnnvu.exe
  C:\Windows\System\Mthnnvu.exe
  2⤵
  PID:12644
- C:\Windows\System\sLukSIX.exe
  C:\Windows\System\sLukSIX.exe
  2⤵
  PID:12672
- C:\Windows\System\CoVxAvF.exe
  C:\Windows\System\CoVxAvF.exe
  2⤵
  PID:12704
- C:\Windows\System\wdTgstK.exe
  C:\Windows\System\wdTgstK.exe
  2⤵
  PID:12732
- C:\Windows\System\rxbISog.exe
  C:\Windows\System\rxbISog.exe
  2⤵
  PID:12760
- C:\Windows\System\rmZWAxY.exe
  C:\Windows\System\rmZWAxY.exe
  2⤵
  PID:12808
- C:\Windows\System\JeZWabY.exe
  C:\Windows\System\JeZWabY.exe
  2⤵
  PID:12836
- C:\Windows\System\IqfmbGB.exe
  C:\Windows\System\IqfmbGB.exe
  2⤵
  PID:12864
- C:\Windows\System\iGwqAxn.exe
  C:\Windows\System\iGwqAxn.exe
  2⤵
  PID:12884
- C:\Windows\System\UHAGGuG.exe
  C:\Windows\System\UHAGGuG.exe
  2⤵
  PID:12920
- C:\Windows\System\GnSjEPH.exe
  C:\Windows\System\GnSjEPH.exe
  2⤵
  PID:12944
- C:\Windows\System\jqWzJVH.exe
  C:\Windows\System\jqWzJVH.exe
  2⤵
  PID:12960
- C:\Windows\System\mTtreIU.exe
  C:\Windows\System\mTtreIU.exe
  2⤵
  PID:12988
- C:\Windows\System\nGmMOmH.exe
  C:\Windows\System\nGmMOmH.exe
  2⤵
  PID:13012
- C:\Windows\System\GCWBlIy.exe
  C:\Windows\System\GCWBlIy.exe
  2⤵
  PID:13032
- C:\Windows\System\FgmFfRs.exe
  C:\Windows\System\FgmFfRs.exe
  2⤵
  PID:13060
- C:\Windows\System\qEunKxc.exe
  C:\Windows\System\qEunKxc.exe
  2⤵
  PID:13088
- C:\Windows\System\mRJdqif.exe
  C:\Windows\System\mRJdqif.exe
  2⤵
  PID:13112
- C:\Windows\System\cZuRSxG.exe
  C:\Windows\System\cZuRSxG.exe
  2⤵
  PID:13160
- C:\Windows\System\GIyXEkX.exe
  C:\Windows\System\GIyXEkX.exe
  2⤵
  PID:13180
- C:\Windows\System\jexTqok.exe
  C:\Windows\System\jexTqok.exe
  2⤵
  PID:13200
- C:\Windows\System\EFiXasz.exe
  C:\Windows\System\EFiXasz.exe
  2⤵
  PID:13224
- C:\Windows\System\VzxmYtY.exe
  C:\Windows\System\VzxmYtY.exe
  2⤵
  PID:13248
- C:\Windows\System\bvMyIsD.exe
  C:\Windows\System\bvMyIsD.exe
  2⤵
  PID:12264
- C:\Windows\System\LPJYEGf.exe
  C:\Windows\System\LPJYEGf.exe
  2⤵
  PID:12344
- C:\Windows\System\KLKMQir.exe
  C:\Windows\System\KLKMQir.exe
  2⤵
  PID:12072
- C:\Windows\System\nMBPIxt.exe
  C:\Windows\System\nMBPIxt.exe
  2⤵
  PID:12452
- C:\Windows\System\iHBeFTM.exe
  C:\Windows\System\iHBeFTM.exe
  2⤵
  PID:12524
- C:\Windows\System\BflcTdT.exe
  C:\Windows\System\BflcTdT.exe
  2⤵
  PID:12568
- C:\Windows\System\RXjmcSI.exe
  C:\Windows\System\RXjmcSI.exe
  2⤵
  PID:11952
- C:\Windows\System\oMaQnjN.exe
  C:\Windows\System\oMaQnjN.exe
  2⤵
  PID:12756
- C:\Windows\System\EtpKykc.exe
  C:\Windows\System\EtpKykc.exe
  2⤵
  PID:12820
- C:\Windows\System\usgfKLu.exe
  C:\Windows\System\usgfKLu.exe
  2⤵
  PID:12872
- C:\Windows\System\UvDsbFd.exe
  C:\Windows\System\UvDsbFd.exe
  2⤵
  PID:12932
- C:\Windows\System\WpbZoMf.exe
  C:\Windows\System\WpbZoMf.exe
  2⤵
  PID:13028
- C:\Windows\System\sVRlulP.exe
  C:\Windows\System\sVRlulP.exe
  2⤵
  PID:12976
- C:\Windows\System\CzonyiY.exe
  C:\Windows\System\CzonyiY.exe
  2⤵
  PID:13104
- C:\Windows\System\wFbkoLi.exe
  C:\Windows\System\wFbkoLi.exe
  2⤵
  PID:13188
- C:\Windows\System\olvDhFj.exe
  C:\Windows\System\olvDhFj.exe
  2⤵
  PID:13236
- C:\Windows\System\xpttbnr.exe
  C:\Windows\System\xpttbnr.exe
  2⤵
  PID:12416
- C:\Windows\System\EmCtTLX.exe
  C:\Windows\System\EmCtTLX.exe
  2⤵
  PID:12440
- C:\Windows\System\IdUyCIL.exe
  C:\Windows\System\IdUyCIL.exe
  2⤵
  PID:12612
- C:\Windows\System\MdQFPez.exe
  C:\Windows\System\MdQFPez.exe
  2⤵
  PID:12856
- C:\Windows\System\JnpoqNp.exe
  C:\Windows\System\JnpoqNp.exe
  2⤵
  PID:13004
- C:\Windows\System\MmFWDdQ.exe
  C:\Windows\System\MmFWDdQ.exe
  2⤵
  PID:13156
- C:\Windows\System\KOGgFdc.exe
  C:\Windows\System\KOGgFdc.exe
  2⤵
  PID:13208
- C:\Windows\System\RmvBwic.exe
  C:\Windows\System\RmvBwic.exe
  2⤵
  PID:12316
- C:\Windows\System\SAnPMnv.exe
  C:\Windows\System\SAnPMnv.exe
  2⤵
  PID:13008
- C:\Windows\System\gEyCbgA.exe
  C:\Windows\System\gEyCbgA.exe
  2⤵
  PID:13132
- C:\Windows\System\ToGNCje.exe
  C:\Windows\System\ToGNCje.exe
  2⤵
  PID:12432
- C:\Windows\System\SsWNPBb.exe
  C:\Windows\System\SsWNPBb.exe
  2⤵
  PID:13340
- C:\Windows\System\YZBBuyx.exe
  C:\Windows\System\YZBBuyx.exe
  2⤵
  PID:13356
- C:\Windows\System\FDXmOjT.exe
  C:\Windows\System\FDXmOjT.exe
  2⤵
  PID:13376
- C:\Windows\System\jgDzXnY.exe
  C:\Windows\System\jgDzXnY.exe
  2⤵
  PID:13404
- C:\Windows\System\bVwfcEl.exe
  C:\Windows\System\bVwfcEl.exe
  2⤵
  PID:13428
- C:\Windows\System\enrorDH.exe
  C:\Windows\System\enrorDH.exe
  2⤵
  PID:13452
- C:\Windows\System\fOcZwMA.exe
  C:\Windows\System\fOcZwMA.exe
  2⤵
  PID:13480
- C:\Windows\System\zHhNHns.exe
  C:\Windows\System\zHhNHns.exe
  2⤵
  PID:13524
- C:\Windows\System\pZcSxAi.exe
  C:\Windows\System\pZcSxAi.exe
  2⤵
  PID:13564
- C:\Windows\System\wZfApqe.exe
  C:\Windows\System\wZfApqe.exe
  2⤵
  PID:13592
- C:\Windows\System\jJIqfDq.exe
  C:\Windows\System\jJIqfDq.exe
  2⤵
  PID:13620
- C:\Windows\System\oCvMSCv.exe
  C:\Windows\System\oCvMSCv.exe
  2⤵
  PID:13640
- C:\Windows\System\nOlOTou.exe
  C:\Windows\System\nOlOTou.exe
  2⤵
  PID:13672
- C:\Windows\System\jwoZPOG.exe
  C:\Windows\System\jwoZPOG.exe
  2⤵
  PID:13700
- C:\Windows\System\mQHsnLm.exe
  C:\Windows\System\mQHsnLm.exe
  2⤵
  PID:13720
- C:\Windows\System\hNHjNeT.exe
  C:\Windows\System\hNHjNeT.exe
  2⤵
  PID:13748
- C:\Windows\System\sfXJWEY.exe
  C:\Windows\System\sfXJWEY.exe
  2⤵
  PID:13768
- C:\Windows\System\OPuhRTO.exe
  C:\Windows\System\OPuhRTO.exe
  2⤵
  PID:13792
- C:\Windows\System\ivrdCFD.exe
  C:\Windows\System\ivrdCFD.exe
  2⤵
  PID:13828
- C:\Windows\System\RQudkOy.exe
  C:\Windows\System\RQudkOy.exe
  2⤵
  PID:13848
- C:\Windows\System\NXuZvSS.exe
  C:\Windows\System\NXuZvSS.exe
  2⤵
  PID:13872
- C:\Windows\System\SwYkGVK.exe
  C:\Windows\System\SwYkGVK.exe
  2⤵
  PID:13928
- C:\Windows\System\uLbJMQT.exe
  C:\Windows\System\uLbJMQT.exe
  2⤵
  PID:13956
- C:\Windows\System\gBixvib.exe
  C:\Windows\System\gBixvib.exe
  2⤵
  PID:13972
- C:\Windows\System\XZBaoRr.exe
  C:\Windows\System\XZBaoRr.exe
  2⤵
  PID:14012
- C:\Windows\System\YgkwPDP.exe
  C:\Windows\System\YgkwPDP.exe
  2⤵
  PID:14028
- C:\Windows\System\WRGqcOR.exe
  C:\Windows\System\WRGqcOR.exe
  2⤵
  PID:14048
- C:\Windows\System\ZAWckRH.exe
  C:\Windows\System\ZAWckRH.exe
  2⤵
  PID:14072
- C:\Windows\System\ILOjDIM.exe
  C:\Windows\System\ILOjDIM.exe
  2⤵
  PID:14096
- C:\Windows\System\UnWFpbh.exe
  C:\Windows\System\UnWFpbh.exe
  2⤵
  PID:14140
- C:\Windows\System\VrzoAUa.exe
  C:\Windows\System\VrzoAUa.exe
  2⤵
  PID:14168
- C:\Windows\System\bEMKWQh.exe
  C:\Windows\System\bEMKWQh.exe
  2⤵
  PID:14184
- C:\Windows\System\YmnfbSZ.exe
  C:\Windows\System\YmnfbSZ.exe
  2⤵
  PID:14212
- C:\Windows\System\aKYIAEw.exe
  C:\Windows\System\aKYIAEw.exe
  2⤵
  PID:14236
- C:\Windows\System\WRRhmoZ.exe
  C:\Windows\System\WRRhmoZ.exe
  2⤵
  PID:14264
- C:\Windows\System\dpoVfWx.exe
  C:\Windows\System\dpoVfWx.exe
  2⤵
  PID:14312
- C:\Windows\System\JVGyVXt.exe
  C:\Windows\System\JVGyVXt.exe
  2⤵
  PID:12940
- C:\Windows\System\NQRILtO.exe
  C:\Windows\System\NQRILtO.exe
  2⤵
  PID:13352
- C:\Windows\System\zMykpbZ.exe
  C:\Windows\System\zMykpbZ.exe
  2⤵
  PID:13396
- C:\Windows\System\eHgglal.exe
  C:\Windows\System\eHgglal.exe
  2⤵
  PID:13448
- C:\Windows\System\XxAdDIe.exe
  C:\Windows\System\XxAdDIe.exe
  2⤵
  PID:13556
- C:\Windows\System\KJsIDgl.exe
  C:\Windows\System\KJsIDgl.exe
  2⤵
  PID:13628
- C:\Windows\System\DJWnliY.exe
  C:\Windows\System\DJWnliY.exe
  2⤵
  PID:13736
- C:\Windows\System\RqKvNOE.exe
  C:\Windows\System\RqKvNOE.exe
  2⤵
  PID:13756
- C:\Windows\System\wDjYeDq.exe
  C:\Windows\System\wDjYeDq.exe
  2⤵
  PID:13784
- C:\Windows\System\kFvCqoD.exe
  C:\Windows\System\kFvCqoD.exe
  2⤵
  PID:13864
- C:\Windows\System\cOOzbTt.exe
  C:\Windows\System\cOOzbTt.exe
  2⤵
  PID:13964
- C:\Windows\System\wGmGCxc.exe
  C:\Windows\System\wGmGCxc.exe
  2⤵
  PID:14020
- C:\Windows\System\OhFKyrg.exe
  C:\Windows\System\OhFKyrg.exe
  2⤵
  PID:14088
- C:\Windows\System\BtFwKmZ.exe
  C:\Windows\System\BtFwKmZ.exe
  2⤵
  PID:14160
- C:\Windows\System\LSDVYwJ.exe
  C:\Windows\System\LSDVYwJ.exe
  2⤵
  PID:14200
- C:\Windows\System\jmfSCMT.exe
  C:\Windows\System\jmfSCMT.exe
  2⤵
  PID:14276
- C:\Windows\System\JWIDoBz.exe
  C:\Windows\System\JWIDoBz.exe
  2⤵
  PID:13280
- C:\Windows\System\KgjdpoS.exe
  C:\Windows\System\KgjdpoS.exe
  2⤵
  PID:13604
- C:\Windows\System\WcuWrdJ.exe
  C:\Windows\System\WcuWrdJ.exe
  2⤵
  PID:13552
- C:\Windows\System\hgNqZht.exe
  C:\Windows\System\hgNqZht.exe
  2⤵
  PID:13840
- C:\Windows\System\JPiBEkr.exe
  C:\Windows\System\JPiBEkr.exe
  2⤵
  PID:13896
- C:\Windows\System\TMvliEe.exe
  C:\Windows\System\TMvliEe.exe
  2⤵
  PID:14156
- C:\Windows\System\zCzXNSn.exe
  C:\Windows\System\zCzXNSn.exe
  2⤵
  PID:13020
- C:\Windows\System\btTmXOS.exe
  C:\Windows\System\btTmXOS.exe
  2⤵
  PID:14288
- C:\Windows\System\bdZquBS.exe
  C:\Windows\System\bdZquBS.exe
  2⤵
  PID:13464
- C:\Windows\System\NSSCTIA.exe
  C:\Windows\System\NSSCTIA.exe
  2⤵
  PID:13816
- C:\Windows\System\zWdLiTG.exe
  C:\Windows\System\zWdLiTG.exe
  2⤵
  PID:14260
- C:\Windows\System\ktTJbJT.exe
  C:\Windows\System\ktTJbJT.exe
  2⤵
  PID:14352
- C:\Windows\System\kKYonIg.exe
  C:\Windows\System\kKYonIg.exe
  2⤵
  PID:14372
- C:\Windows\System\wJtYKqE.exe
  C:\Windows\System\wJtYKqE.exe
  2⤵
  PID:14412
- C:\Windows\System\JPgJsgA.exe
  C:\Windows\System\JPgJsgA.exe
  2⤵
  PID:14448
- C:\Windows\System\NDMExCy.exe
  C:\Windows\System\NDMExCy.exe
  2⤵
  PID:14464
- C:\Windows\System\MzFIrXH.exe
  C:\Windows\System\MzFIrXH.exe
  2⤵
  PID:14488
- C:\Windows\System\eZOQGyI.exe
  C:\Windows\System\eZOQGyI.exe
  2⤵
  PID:14544
- C:\Windows\System\FIlRtMb.exe
  C:\Windows\System\FIlRtMb.exe
  2⤵
  PID:14560
- C:\Windows\System\sfHmKYL.exe
  C:\Windows\System\sfHmKYL.exe
  2⤵
  PID:14592
- C:\Windows\System\ZdaUinQ.exe
  C:\Windows\System\ZdaUinQ.exe
  2⤵
  PID:14620
- C:\Windows\System\OzyPiUM.exe
  C:\Windows\System\OzyPiUM.exe
  2⤵
  PID:14636
- C:\Windows\System\BhKzBaR.exe
  C:\Windows\System\BhKzBaR.exe
  2⤵
  PID:14664
- C:\Windows\System\COAHicV.exe
  C:\Windows\System\COAHicV.exe
  2⤵
  PID:14688
- C:\Windows\System\GbxZiIZ.exe
  C:\Windows\System\GbxZiIZ.exe
  2⤵
  PID:14716
- C:\Windows\System\nrJhEPZ.exe
  C:\Windows\System\nrJhEPZ.exe
  2⤵
  PID:14744
- C:\Windows\System\YJXMiHs.exe
  C:\Windows\System\YJXMiHs.exe
  2⤵
  PID:14776
- C:\Windows\System\UKUsZeg.exe
  C:\Windows\System\UKUsZeg.exe
  2⤵
  PID:14832
- C:\Windows\System\aASYzhu.exe
  C:\Windows\System\aASYzhu.exe
  2⤵
  PID:14848
- C:\Windows\System\aKEeKzw.exe
  C:\Windows\System\aKEeKzw.exe
  2⤵
  PID:14864
- C:\Windows\System\waaTDIU.exe
  C:\Windows\System\waaTDIU.exe
  2⤵
  PID:14880
- C:\Windows\System\YrlTAMr.exe
  C:\Windows\System\YrlTAMr.exe
  2⤵
  PID:14932
- C:\Windows\System\YkutgTr.exe
  C:\Windows\System\YkutgTr.exe
  2⤵
  PID:14960
- C:\Windows\System\VXSZoEj.exe
  C:\Windows\System\VXSZoEj.exe
  2⤵
  PID:15000
- C:\Windows\System\vSkgzIK.exe
  C:\Windows\System\vSkgzIK.exe
  2⤵
  PID:15016
- C:\Windows\System\HQnxddF.exe
  C:\Windows\System\HQnxddF.exe
  2⤵
  PID:15040
- C:\Windows\System\IuOJmHU.exe
  C:\Windows\System\IuOJmHU.exe
  2⤵
  PID:15064
- C:\Windows\System\YBSDBjB.exe
  C:\Windows\System\YBSDBjB.exe
  2⤵
  PID:15088
- C:\Windows\System\QvqpnKf.exe
  C:\Windows\System\QvqpnKf.exe
  2⤵
  PID:15104
- C:\Windows\System\zUwGikn.exe
  C:\Windows\System\zUwGikn.exe
  2⤵
  PID:15128
- C:\Windows\System\aEpeJqg.exe
  C:\Windows\System\aEpeJqg.exe
  2⤵
  PID:15144
- C:\Windows\System\HYEMqAl.exe
  C:\Windows\System\HYEMqAl.exe
  2⤵
  PID:15164
- C:\Windows\System\dtxpJrD.exe
  C:\Windows\System\dtxpJrD.exe
  2⤵
  PID:15192
- C:\Windows\System\nAvRXde.exe
  C:\Windows\System\nAvRXde.exe
  2⤵
  PID:15216
- C:\Windows\System\EBqkDgs.exe
  C:\Windows\System\EBqkDgs.exe
  2⤵
  PID:15248
- C:\Windows\System\hxmFoDB.exe
  C:\Windows\System\hxmFoDB.exe
  2⤵
  PID:15308
- C:\Windows\System\PMaRSjg.exe
  C:\Windows\System\PMaRSjg.exe
  2⤵
  PID:15344
- C:\Windows\System\bTHNClj.exe
  C:\Windows\System\bTHNClj.exe
  2⤵
  PID:14036
- C:\Windows\System\XSfQmET.exe
  C:\Windows\System\XSfQmET.exe
  2⤵
  PID:14388
- C:\Windows\System\EPtZWix.exe
  C:\Windows\System\EPtZWix.exe
  2⤵
  PID:14484
- C:\Windows\System\TWUGAVm.exe
  C:\Windows\System\TWUGAVm.exe
  2⤵
  PID:14516
- C:\Windows\System\UfWRzgN.exe
  C:\Windows\System\UfWRzgN.exe
  2⤵
  PID:14580
- C:\Windows\System\PQFXNzP.exe
  C:\Windows\System\PQFXNzP.exe
  2⤵
  PID:14608
- C:\Windows\System\VnOgyQw.exe
  C:\Windows\System\VnOgyQw.exe
  2⤵
  PID:14672
- C:\Windows\System\QHeDjkC.exe
  C:\Windows\System\QHeDjkC.exe
  2⤵
  PID:14724
- C:\Windows\System\tPPgtlo.exe
  C:\Windows\System\tPPgtlo.exe
  2⤵
  PID:14824
- C:\Windows\System\dKVBpeU.exe
  C:\Windows\System\dKVBpeU.exe
  2⤵
  PID:14856
- C:\Windows\System\cnvGEBH.exe
  C:\Windows\System\cnvGEBH.exe
  2⤵
  PID:14948
- C:\Windows\System\zBhiHjY.exe
  C:\Windows\System\zBhiHjY.exe
  2⤵
  PID:14984
- C:\Windows\System\aOJZKgE.exe
  C:\Windows\System\aOJZKgE.exe
  2⤵
  PID:15096
- C:\Windows\System\bjpTSSY.exe
  C:\Windows\System\bjpTSSY.exe
  2⤵
  PID:15136
- C:\Windows\System\hqtAsZq.exe
  C:\Windows\System\hqtAsZq.exe
  2⤵
  PID:15272
- C:\Windows\System\WMvTDsz.exe
  C:\Windows\System\WMvTDsz.exe
  2⤵
  PID:15340
- C:\Windows\System\poVkGCI.exe
  C:\Windows\System\poVkGCI.exe
  2⤵
  PID:14120
- C:\Windows\System\FmQMXLM.exe
  C:\Windows\System\FmQMXLM.exe
  2⤵
  PID:14476
- C:\Windows\System\rpycWNY.exe
  C:\Windows\System\rpycWNY.exe
  2⤵
  PID:14628
- C:\Windows\System\BUsqVuO.exe
  C:\Windows\System\BUsqVuO.exe
  2⤵
  PID:14808
- C:\Windows\System\GTaaBtL.exe
  C:\Windows\System\GTaaBtL.exe
  2⤵
  PID:14976
- C:\Windows\System\quVHrmI.exe
  C:\Windows\System\quVHrmI.exe
  2⤵
  PID:14916
- C:\Windows\System\DpwkvZI.exe
  C:\Windows\System\DpwkvZI.exe
  2⤵
  PID:15120
- C:\Windows\System\BqtlYKo.exe
  C:\Windows\System\BqtlYKo.exe
  2⤵
  PID:15124
- C:\Windows\System\XyhSInQ.exe
  C:\Windows\System\XyhSInQ.exe
  2⤵
  PID:15320
- C:\Windows\System\AgSLMXM.exe
  C:\Windows\System\AgSLMXM.exe
  2⤵
  PID:15048
- C:\Windows\System\diiVtuk.exe
  C:\Windows\System\diiVtuk.exe
  2⤵
  PID:15236
- C:\Windows\System\HfjXkOn.exe
  C:\Windows\System\HfjXkOn.exe
  2⤵
  PID:15116
- C:\Windows\System\zXwnkMu.exe
  C:\Windows\System\zXwnkMu.exe
  2⤵
  PID:15380
- C:\Windows\System\HKQbSQk.exe
  C:\Windows\System\HKQbSQk.exe
  2⤵
  PID:15404
- C:\Windows\System\CmoIyTt.exe
  C:\Windows\System\CmoIyTt.exe
  2⤵
  PID:15444
- C:\Windows\System\ouUBPEU.exe
  C:\Windows\System\ouUBPEU.exe
  2⤵
  PID:15464
- C:\Windows\System\rkGEJog.exe
  C:\Windows\System\rkGEJog.exe
  2⤵
  PID:15488
- C:\Windows\System\boCCPhR.exe
  C:\Windows\System\boCCPhR.exe
  2⤵
  PID:15528
- C:\Windows\System\bSWLfBk.exe
  C:\Windows\System\bSWLfBk.exe
  2⤵
  PID:15556
- C:\Windows\System\wkIBwfX.exe
  C:\Windows\System\wkIBwfX.exe
  2⤵
  PID:15584
- C:\Windows\System\QztsGLb.exe
  C:\Windows\System\QztsGLb.exe
  2⤵
  PID:15604
- C:\Windows\System\uHitVyJ.exe
  C:\Windows\System\uHitVyJ.exe
  2⤵
  PID:15628
- C:\Windows\System\yewDjpD.exe
  C:\Windows\System\yewDjpD.exe
  2⤵
  PID:15652
- C:\Windows\System\xVIanwP.exe
  C:\Windows\System\xVIanwP.exe
  2⤵
  PID:15672
- C:\Windows\System\hdZtCVS.exe
  C:\Windows\System\hdZtCVS.exe
  2⤵
  PID:15696
- C:\Windows\System\TAHwStb.exe
  C:\Windows\System\TAHwStb.exe
  2⤵
  PID:15728
- C:\Windows\System\YEsgTIE.exe
  C:\Windows\System\YEsgTIE.exe
  2⤵
  PID:15768
- C:\Windows\System\IEJvTTD.exe
  C:\Windows\System\IEJvTTD.exe
  2⤵
  PID:15792
- C:\Windows\System\iYZqOUk.exe
  C:\Windows\System\iYZqOUk.exe
  2⤵
  PID:15836
- C:\Windows\System\RLuOvDZ.exe
  C:\Windows\System\RLuOvDZ.exe
  2⤵
  PID:15860
- C:\Windows\System\pQJFgxT.exe
  C:\Windows\System\pQJFgxT.exe
  2⤵
  PID:15888
- C:\Windows\System\xUJmwlD.exe
  C:\Windows\System\xUJmwlD.exe
  2⤵
  PID:15920
- C:\Windows\System\ndSAmif.exe
  C:\Windows\System\ndSAmif.exe
  2⤵
  PID:15948
- C:\Windows\System\xNxvmJJ.exe
  C:\Windows\System\xNxvmJJ.exe
  2⤵
  PID:15964
- C:\Windows\System\YhGKsTr.exe
  C:\Windows\System\YhGKsTr.exe
  2⤵
  PID:15984
- C:\Windows\System\wrSCJkF.exe
  C:\Windows\System\wrSCJkF.exe
  2⤵
  PID:16012
- C:\Windows\System\JrMSbtp.exe
  C:\Windows\System\JrMSbtp.exe
  2⤵
  PID:16040
- C:\Windows\System\SRYTbxL.exe
  C:\Windows\System\SRYTbxL.exe
  2⤵
  PID:16092
- C:\Windows\System\qCzuQhU.exe
  C:\Windows\System\qCzuQhU.exe
  2⤵
  PID:16108
- C:\Windows\System\tCuryYK.exe
  C:\Windows\System\tCuryYK.exe
  2⤵
  PID:16148
- C:\Windows\System\zCfEaIa.exe
  C:\Windows\System\zCfEaIa.exe
  2⤵
  PID:16176
- C:\Windows\System\lBgagXm.exe
  C:\Windows\System\lBgagXm.exe
  2⤵
  PID:16196
- C:\Windows\System\nsLadip.exe
  C:\Windows\System\nsLadip.exe
  2⤵
  PID:16220
- C:\Windows\System\VMedQGB.exe
  C:\Windows\System\VMedQGB.exe
  2⤵
  PID:16236
- C:\Windows\System\yHxVZTz.exe
  C:\Windows\System\yHxVZTz.exe
  2⤵
  PID:16260
- C:\Windows\System\RpKIJZq.exe
  C:\Windows\System\RpKIJZq.exe
  2⤵
  PID:16288
- C:\Windows\System\rMUgpkh.exe
  C:\Windows\System\rMUgpkh.exe
  2⤵
  PID:16336
- C:\Windows\System\gUSFMsE.exe
  C:\Windows\System\gUSFMsE.exe
  2⤵
  PID:16360
- C:\Windows\System\pzExvAJ.exe
  C:\Windows\System\pzExvAJ.exe
  2⤵
  PID:16376
- C:\Windows\System\kgDvsCa.exe
  C:\Windows\System\kgDvsCa.exe
  2⤵
  PID:15428
- C:\Windows\System\zNupCjL.exe
  C:\Windows\System\zNupCjL.exe
  2⤵
  PID:15500
- C:\Windows\System\YToXKrQ.exe
  C:\Windows\System\YToXKrQ.exe
  2⤵
  PID:15540
- C:\Windows\System\iHgflse.exe
  C:\Windows\System\iHgflse.exe
  2⤵
  PID:15576
- C:\Windows\System\MpEvxPg.exe
  C:\Windows\System\MpEvxPg.exe
  2⤵
  PID:15648
- C:\Windows\System\PqEoVep.exe
  C:\Windows\System\PqEoVep.exe
  2⤵
  PID:15712
- C:\Windows\System\oaRsVln.exe
  C:\Windows\System\oaRsVln.exe
  2⤵
  PID:15788
- C:\Windows\System\XviIooH.exe
  C:\Windows\System\XviIooH.exe
  2⤵
  PID:15832
- C:\Windows\System\CdlfRXo.exe
  C:\Windows\System\CdlfRXo.exe
  2⤵
  PID:15900
- C:\Windows\System\RvRZVmW.exe
  C:\Windows\System\RvRZVmW.exe
  2⤵
  PID:15956
- C:\Windows\System\mXBRWLC.exe
  C:\Windows\System\mXBRWLC.exe
  2⤵
  PID:16060
- C:\Windows\System\oRrlnCK.exe
  C:\Windows\System\oRrlnCK.exe
  2⤵
  PID:16104
- C:\Windows\System\NzajJug.exe
  C:\Windows\System\NzajJug.exe
  2⤵
  PID:16204
- C:\Windows\System\PCUVKuo.exe
  C:\Windows\System\PCUVKuo.exe
  2⤵
  PID:16284
- C:\Windows\System\cDqfuSa.exe
  C:\Windows\System\cDqfuSa.exe
  2⤵
  PID:16304
- C:\Windows\System\lxdJKrU.exe
  C:\Windows\System\lxdJKrU.exe
  2⤵
  PID:15436
- C:\Windows\System\sTbiAfz.exe
  C:\Windows\System\sTbiAfz.exe
  2⤵
  PID:15548
- C:\Windows\System\ooeSROy.exe
  C:\Windows\System\ooeSROy.exe
  2⤵
  PID:15688
- C:\Windows\System\AbHmewH.exe
  C:\Windows\System\AbHmewH.exe
  2⤵
  PID:15872
- C:\Windows\System\EdvcqWA.exe
  C:\Windows\System\EdvcqWA.exe
  2⤵
  PID:15940
- C:\Windows\System\QUSJdED.exe
  C:\Windows\System\QUSJdED.exe
  2⤵
  PID:16164
- C:\Windows\System\jHdoxgY.exe
  C:\Windows\System\jHdoxgY.exe
  2⤵
  PID:15376
- C:\Windows\System\FebhkPr.exe
  C:\Windows\System\FebhkPr.exe
  2⤵
  PID:15484
- C:\Windows\System\JJhxrpJ.exe
  C:\Windows\System\JJhxrpJ.exe
  2⤵
  PID:15856
- C:\Windows\System\XfnRrOF.exe
  C:\Windows\System\XfnRrOF.exe
  2⤵
  PID:16036
- C:\Windows\System\tBoCeYI.exe
  C:\Windows\System\tBoCeYI.exe
  2⤵
  PID:15820
- C:\Windows\System\EpeKQNs.exe
  C:\Windows\System\EpeKQNs.exe
  2⤵
  PID:16388
- C:\Windows\System\tRAdKCW.exe
  C:\Windows\System\tRAdKCW.exe
  2⤵
  PID:16428
- C:\Windows\System\LoEcQnQ.exe
  C:\Windows\System\LoEcQnQ.exe
  2⤵
  PID:16452
- C:\Windows\System\fncmYnT.exe
  C:\Windows\System\fncmYnT.exe
  2⤵
  PID:16472
- C:\Windows\System\WaIiXCx.exe
  C:\Windows\System\WaIiXCx.exe
  2⤵
  PID:16500
- C:\Windows\System\yXGMIrl.exe
  C:\Windows\System\yXGMIrl.exe
  2⤵
  PID:16528
- C:\Windows\System\KiHabES.exe
  C:\Windows\System\KiHabES.exe
  2⤵
  PID:16544
- C:\Windows\System\RoIwnkw.exe
  C:\Windows\System\RoIwnkw.exe
  2⤵
  PID:16572
- C:\Windows\System\MWoIdnR.exe
  C:\Windows\System\MWoIdnR.exe
  2⤵
  PID:16600
- C:\Windows\System\yrHfvQt.exe
  C:\Windows\System\yrHfvQt.exe
  2⤵
  PID:16624
- C:\Windows\System\nnrVSZt.exe
  C:\Windows\System\nnrVSZt.exe
  2⤵
  PID:16644
- C:\Windows\System\lASMoLl.exe
  C:\Windows\System\lASMoLl.exe
  2⤵
  PID:16668
- C:\Windows\System\oxSmasS.exe
  C:\Windows\System\oxSmasS.exe
  2⤵
  PID:16684
- C:\Windows\System\ZShzAjf.exe
  C:\Windows\System\ZShzAjf.exe
  2⤵
  PID:16720
- C:\Windows\System\vFKxSdW.exe
  C:\Windows\System\vFKxSdW.exe
  2⤵
  PID:16780
- C:\Windows\System\RblTddv.exe
  C:\Windows\System\RblTddv.exe
  2⤵
  PID:16796
- C:\Windows\System\fpJpULR.exe
  C:\Windows\System\fpJpULR.exe
  2⤵
  PID:16824
- C:\Windows\System\PSRgrQF.exe
  C:\Windows\System\PSRgrQF.exe
  2⤵
  PID:16868
- C:\Windows\System\JItUpQC.exe
  C:\Windows\System\JItUpQC.exe
  2⤵
  PID:16908
- C:\Windows\System\jHOEydE.exe
  C:\Windows\System\jHOEydE.exe
  2⤵
  PID:16936
- C:\Windows\System\YjQGmgs.exe
  C:\Windows\System\YjQGmgs.exe
  2⤵
  PID:16952
- C:\Windows\System\PEZdSvj.exe
  C:\Windows\System\PEZdSvj.exe
  2⤵
  PID:16988
- C:\Windows\System\tCNWgCd.exe
  C:\Windows\System\tCNWgCd.exe
  2⤵
  PID:17016
- C:\Windows\System\kZTFzSr.exe
  C:\Windows\System\kZTFzSr.exe
  2⤵
  PID:17040
- C:\Windows\System\BXiCNoI.exe
  C:\Windows\System\BXiCNoI.exe
  2⤵
  PID:17064
- C:\Windows\System\lCMEmsi.exe
  C:\Windows\System\lCMEmsi.exe
  2⤵
  PID:17084
- C:\Windows\System\JRoMCIL.exe
  C:\Windows\System\JRoMCIL.exe
  2⤵
  PID:17108
- C:\Windows\System\eYUvsKg.exe
  C:\Windows\System\eYUvsKg.exe
  2⤵
  PID:17144
- C:\Windows\System\IIplKtE.exe
  C:\Windows\System\IIplKtE.exe
  2⤵
  PID:17172
- C:\Windows\System\imoNcbN.exe
  C:\Windows\System\imoNcbN.exe
  2⤵
  PID:17200
- C:\Windows\System\YvWbDhp.exe
  C:\Windows\System\YvWbDhp.exe
  2⤵
  PID:17244
- C:\Windows\System\AxrrTEh.exe
  C:\Windows\System\AxrrTEh.exe
  2⤵
  PID:17264

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:16776

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\AAqUuNm.exe

Filesize
1.1MB

MD5
17e5e7bd711122b874b474748901bf73

SHA1
e934d4c5a9f2586c83916e6b96153e1b0026c3a3

SHA256
29d4758b8fb966a973ac401bf3a07a268af92a40f0cb586e12a9c5cc66c5b4c9

SHA512
104cc78f69894739ab74fd42bf2589fc672d912d8b5f4763a3621933265e6e1226d024b03490d8634ebdad94c66daed1bff10c10491f5f6e66502b4321089e6c

Download Submit
C:\Windows\System\ArQhmiT.exe

Filesize
1.1MB

MD5
42cf1df2a2ea9c4f5dcdfbc82b412bc1

SHA1
396bca5ca6615515aea4e167caa061a037d286a1

SHA256
42eab94e8d84c4388b7f0eed08d434771d3f839fc14b498c903dc1734cc92931

SHA512
cf8a1b48038c2f3a3a23a5c64b86b51b5de70e3ed6b1e3d81e476a061fd2f71b3dd8727d09e9bc1a759d52039ed98b789b1bc1c3544ac990035121dee5a713bb

Download Submit
C:\Windows\System\BLIDAEL.exe

Filesize
1.1MB

MD5
36950383f810b09910ea3e019e51d4fa

SHA1
d38752e4fc4c0d5f0c06c03d23a6feebd6c1ebc2

SHA256
b4d5165468f890593b7280a608929d37bd57b22b403a2002edb250894788809b

SHA512
a9d4b7f6891be1a3cc0747f8c60fc7fdf8225a337f9fbb1ae8ddd39bfd50d828631d95f8242466b039c6eb42f521a4c3f4263a546ebae69fd0296b31130bb84f

Download Submit
C:\Windows\System\BMpwyuy.exe

Filesize
1.1MB

MD5
1ef3bc1383b55677d0d9f40083424b43

SHA1
b57071a1991c01b8b85824ed402b9f11b3a88a8a

SHA256
4c279b3c98827413a7442029957100d66b4bf2b0b37703a2b7311f263e5bf41a

SHA512
5f5e8986e215f97025039757816284e1082ec6621b12e7cf8dd88a37a25a8e5baf3e8a675e03f2df800fcbace612b86919607654c5f8d4cdbc102e283daa76f8

Download Submit
C:\Windows\System\BSmiWYX.exe

Filesize
1.1MB

MD5
a7e557b9fb2aa984e7852582d7981167

SHA1
d3bb8e3ea8738db3c02f61b748c80caefb0b16c7

SHA256
e2f24b79d01e1d0b52af9719675c2a9094ddd7a22e397834ac4af19632c47e8c

SHA512
7328abf978b69a3b1d82c8a095e3ed445f41c4df0b320a3efef09637ad37db2696b54993509d7b83765cb9476a00c4e48d7114a31cd4e21661c3856a7ae9a64f

Download Submit
C:\Windows\System\EtRSXSm.exe

Filesize
1.1MB

MD5
3dcd716c46709e3a0b48c0d9ae27c3fc

SHA1
5202c0d76ffff2121ade129c8cbe72436dad6d81

SHA256
354976f3d6f3c5e3d3ac557cbdef8766b0e50b3939dab6e4c756bb0b9e7da4d3

SHA512
bd441878579a9ac76782099010a25e3830f93de433404d1593db9044506d67841dafdfb03faa3f417e78c65a46bf0a2fa5df3ec53ade39609853c6d390a55aa7

Download Submit
C:\Windows\System\EybORGo.exe

Filesize
1.1MB

MD5
3e2816ae05cbb7b7c5e45cc71099f202

SHA1
a7b89f6340e6a72c13aabd7704af9395fade16fc

SHA256
d0744725ca5aa8351a3cc7ca57c6b288d55beaef88118a87721b5debbaaa544c

SHA512
4bb170130b99976008e4356b3bc919270a4233d6106bae88e5235387095c00990f19387fc6ece9dc17e63d12e8e8a50004086fea2d2757ce89e87a0d551100bb

Download Submit
C:\Windows\System\GlRJbwA.exe

Filesize
1.1MB

MD5
b70603d6ecbe92a54040b33c8f57f26f

SHA1
e24f951fa8a62c124c38fdf9dfeee0cb39654231

SHA256
d64b37a88f7855682ecd04c4f696a60bd0b098d447790acee071e8d81f3d19ea

SHA512
54731c62b796d3971ea1223c6c1bdd97e8a1da9dd14b0a06417f971d3659022861e7fced2665b945e33db5bcb1add990f67db21e5a2da47a465579579ae1ebde

Download Submit
C:\Windows\System\JTNJUjt.exe

Filesize
1.1MB

MD5
02f8f8f2dbc039a48c321f6f1e04a799

SHA1
a8d12edad9567209499cbd3c5b2436aca3b8e454

SHA256
2f8966e507923d237024e2a243a2ec8672df7a86eaaa2fa147152e4cb7ffc4e8

SHA512
a8ad92f17134058858e1113f2ed7c0fe86035e5adbd9354a55ceb9f8781aa3500a54ae435d8fda4a9ea1007b29c72b8df1bd9347ec248a4e1ad15231b1e088d4

Download Submit
C:\Windows\System\Jattdyz.exe

Filesize
1.1MB

MD5
05dcc0777f5a73f77d43e928e7bd2993

SHA1
0228f94996e5fea61191462dc3642ba7337dfa60

SHA256
a4df923f6d1d181e1d21d13d9435bbf1936e7ae0d6c8132686464ead2717d6f7

SHA512
cdddd2d251a7b96a31b9036cf29fdf7571fc89999bb1d0cda3e8807f8161096d25fe93103ed73e970f79e849b87d27cc64be983d43fe5246c53eb625a93d555c

Download Submit
C:\Windows\System\NgDnLks.exe

Filesize
1.1MB

MD5
25f4c1b753259d973ca58f03b12ed9fc

SHA1
3bce84fbacc88e5b0e0c2e462de0766a3ee76679

SHA256
ec7c09fb171d13a8dbed363a631ab47ed2383d9a8efbdfb79499d92b3e191ea6

SHA512
6b795c582b86f5747be44220f02a7c4d5ff40d2790cba516c637a991654684d90b10afb2c8de5e7673c73eee5cb4a0dd7ec6660b2a345075b7304ae619b47118

Download Submit
C:\Windows\System\PdFKIrv.exe

Filesize
1.1MB

MD5
44541e1a970634d00f06418701cc7fd8

SHA1
13adcc046494fef7b96c96f00811d3a02a03cc15

SHA256
c5dd767c61de8c454b22c9ec99cc105c6128a3a4e08b07dd2f9b1ea562ac031e

SHA512
2e13e5f2f24052c8b29c6576485dce2a68ecfb6891ae65a2a3e0b4b11d5facb13e066b006a6c58e4f97309a9e2c53f2d8e2749ac5a81101b1a51d84557befba1

Download Submit
C:\Windows\System\TfptdRy.exe

Filesize
1.1MB

MD5
28231dee33c4dff395740bfbbd07f5fe

SHA1
df038111362864e773ce5a2127eca8569df2335e

SHA256
71aff0b2aa24cf36345cadd777e20ade90fc8bd6f969c5ddcbca746d952fe7f3

SHA512
8be6fb0dacb415110824add299c180e1946c74a1e2c41829de3500bbfa42a7f6624105a8c35526965f8b26835816fb792c419f85952881198ed7bb8cd16f19b9

Download Submit
C:\Windows\System\TwDQZFI.exe

Filesize
1.1MB

MD5
d809f9a6d1174f73659cf2560a54ee68

SHA1
f39fd471a1dc2527e956caed85278bdcdce1730a

SHA256
dcb98b0bee28b06d4cb8c809f456a9865e995b1f43a9753aacbf6b88314ef45b

SHA512
1307eb9c57c692653174e156d38fd4309d3f5aaf5d934a1145e80e218b6bfd3f28b885f4856a9e83923dece9e9b7ae16695ee19f5cf58b6a73a97b4daa97d165

Download Submit
C:\Windows\System\TxQbFzC.exe

Filesize
1.1MB

MD5
80fba5d6749b21f372a3686cea7399f2

SHA1
34b4a0519f20f1c10b2aeb27bb4425e402263b08

SHA256
76767e5536f764b4717ffbd3c909202f0c8814d8f4a71a09ee284081d8937521

SHA512
6a71199dc5c5d5b4265eb6cbf973ce83ddbb405032b38743d899f251b04038c59f0092e2b6f85ec2675cecb54bb685ec243a10e76cc85c5b0270d18300ecf9e6

Download Submit
C:\Windows\System\TyfCAfs.exe

Filesize
1.1MB

MD5
9f03774cf193a9a2182a7c20c8dec35b

SHA1
970e73f19bc639e84661640444638b9a13ba12f7

SHA256
401ee9212cb35b3447e2d55d8a1c208aae9dde488acaadeff83fa09e41cc64d0

SHA512
9f4e956f7aa205d832c147a352b54e6b59f11dc09b8852f9fc861a603d2b315e75f4b1b7f6f3c83bc8f7ab795d983314d0dc02606665b9fdf1015de6ed980e60

Download Submit
C:\Windows\System\ULAXYMs.exe

Filesize
1.1MB

MD5
ceac1f49eaf42a6456301b552c8da93b

SHA1
dc0343bafe26c744fb229168b6a9455e46d7da83

SHA256
dd35d9dbe4729e6e7b815e927fefe2bb29199e20ea2ebbd7d2b75cb1e04a4053

SHA512
4d16a855db1dbc3cc016f8b8fd7dfa21ac737e1dd4e77d89b3e1675c69df97293b5607d96565f4ea788e5bb56d7ee2beb24cdcdb7e732ba00a19592ec71d4492

Download Submit
C:\Windows\System\UcKHtzY.exe

Filesize
1.1MB

MD5
c1a55acb41f7c800d62afdea853c01bc

SHA1
370d0d7322f0cf2cb8eea6b01a76bc83904b89fd

SHA256
5df4c8dc2a6e14507fedc7ddcdc25e175e35e4bc732f0bea2b72d32d44f4c37a

SHA512
2ccf8600802fc650269926b311f94841d009d7ae36d3cc3e382da9d8ad6918fadb95a34c52bbb0bc5716a6f1ae7e46a990bf75aec8ac0d088d92210f827903f3

Download Submit
C:\Windows\System\ZGmsNwm.exe

Filesize
1.1MB

MD5
7a8feb395a955ef5a1744396d20defd6

SHA1
d535000a60c1121bff456ad799a1def445a9693e

SHA256
559a380d0cbd8e63fe34d7404ecde5b8dbe921c1d075e2101b1fe1df79268f16

SHA512
4e4483e65919c34372bc68737ce5c068fbf7588179105739c2cb8963d93919dc15e1b0423fa95a6df9d7ed4f52792a114fa5568a1eb729579fcf8ecc35468150

Download Submit
C:\Windows\System\dWcxJYi.exe

Filesize
1.1MB

MD5
1835a88b80eb2399bd2261d090b5e048

SHA1
8de254f4c3af6a8e439834a2f7a476ae89caa8bf

SHA256
cc743968034439b781dba2cd4db64f680cada9260d7460f16a1467bbeea8821f

SHA512
74ae3d2cad99ffff4229b8035a6225af09e4b53b7458ae63e47de882d391e63b78fa56b78d9eabe4bb7f62e0ff2fe72a672510b1dd5bb835b67bb694e77da751

Download Submit
C:\Windows\System\eAutbvW.exe

Filesize
1.1MB

MD5
dedb53a8296432805b7819ff0a547ab1

SHA1
fd74bf6dc0c10768b7c74bc61f3b76f80ac683a4

SHA256
e1068b6677f64d1f1a97fffb037e0a3b51b84f88634242d320df12b39aa6539c

SHA512
e74ded1235a2b6984ef1e92016d7474f57048b9dc79854acf4ae064c7ec8d753c715faa294846d0ee31c7e76a2328a638a6d347690924d002f5e99e15f915b39

Download Submit
C:\Windows\System\gDVJQAi.exe

Filesize
1.1MB

MD5
cca7b4653c8af9cd78269d7b27bd75bb

SHA1
0c37283aa2b15ddfcb5d5e26b4a26ce78a8fecf6

SHA256
813b911b59e9f198b1f4134719d5e660379cf1862751ab09b5d75df6f44a2ec2

SHA512
8146efc9a975390332dd0267cd70baf197eaa18a06b6cd2235f62c00fa6dc1111fd54cf40ac7cc1d4920f82451bda36481ec18e44aa4179d9daf778d0ed28757

Download Submit
C:\Windows\System\gHwXkYP.exe

Filesize
1.1MB

MD5
1bf4d3d6e0192ff2513e0b2308a0fe5f

SHA1
663718e9a07ed4cff7c49a464a1cb5fd98cb2648

SHA256
450da1eeb6102b5f49856b1ffa5aef9646d89ae56a24e1c298ae84b6198e0859

SHA512
94f9848dfd2700a5e4c980047bbc80b76a27c70ca4773216d97afaed2b4ae2d6594b3a8ae84850b4c01414551f784d46a0dddfc48689211487787968e14a5c10

Download Submit
C:\Windows\System\hIgMPkR.exe

Filesize
1.1MB

MD5
ecd600f86556b4dc233caec0085cd26f

SHA1
e7b3f6a56362a84abf0a2ac9c85e1adaf6919d23

SHA256
d5acfad441194824cf8d639901819be83352ea81545445e3c9bb845b5068179d

SHA512
b782569a98ac2eb05930d9d1bccd8b08c5bba12966d49811a02b83b55735083d884687194ce4e2815823cfa966438d1d86f6383263baebd113bc084edcdc8e53

Download Submit
C:\Windows\System\hkTVtbb.exe

Filesize
1.1MB

MD5
6bffaf8da0d47a48aedf3d29ec31999a

SHA1
a8cf314baffd4185f502bc271a8914e89a5c5533

SHA256
e8a81e71c5fd46fa691c64820a8e25df7f57c548f9cb34a48ec7857d2aff21ed

SHA512
8a71b1e02c3effdd966337c208f0d92bbaeadab59c734fc01022b075e2a47f6a2137ad1e2b77a8e348ccf47de20c7eff467a184ae4120b9846341ee3e350a0ff

Download Submit
C:\Windows\System\jEymoGT.exe

Filesize
1.1MB

MD5
af2557d33526acd69121fc9113a4d908

SHA1
124a8c09d3559ea43e4472dd22f018b623910663

SHA256
b493554b4ecec26f54274fda8aca90aed031cd0d77abe0860c73d05f09d74151

SHA512
064656e4bbda678d027d891e796917c659f6b261a9d252246202a7c423bc0995110625a50f6a71d439fc84eefb6cbd0537f0475ea1b1c596e88ae7b5f7983001

Download Submit
C:\Windows\System\kUjeess.exe

Filesize
1.1MB

MD5
258aef087c753102ea0bdd829594ce07

SHA1
ae79b3925351b12e9a68f1ecd1e708df6061bff6

SHA256
967aef8c2f2d47e041fa21f10862a81b17ff497af7a4572e6a4e14c09f90d9af

SHA512
e89989ff35694d76b33fea8089234a430519f2c8799a76c93584094356c3a9d128560db8444495c4108a44c790233defafba993520e3ef54a30d38f3060ae6f6

Download Submit
C:\Windows\System\mLyKTKw.exe

Filesize
1.1MB

MD5
b2828ba4c29c6209b62e259442c499ad

SHA1
f688f1e8b7036bef76e1e5af1c3d010f6c88e27b

SHA256
fac0b5e43396addd9b18dc553644cac9ab3056d308c4c25cf3b0e3520163a3d3

SHA512
d42b3428d9c9d008df3e86f7cbf0b4def1dae4fc98ef786d24d30f632e9f72b8e49b7458c7fbabbbff35be734657b46ff0429e8a46a3dd61ff641a62f4ef4c91

Download Submit
C:\Windows\System\pKRKyfw.exe

Filesize
1.1MB

MD5
66721f1a23e33ba70b7dfbac4628bc03

SHA1
0515032c62716e3289d136a4c2230dc253831ec2

SHA256
020fea2d88430f89f03a3571bfc77a7f81ca09159b5bf7bef84d51efd383979d

SHA512
4ac3110cf88119e0fc5c856007bf68f9a1f345297c51432cba0d2d92514fe057cda48e9c92ca5ab9fcf6d55f1d7337aaab30d774f744fc430cc923bc1b62794a

Download Submit
C:\Windows\System\tLqYggu.exe

Filesize
1.1MB

MD5
3a0ed5f9683c4765008ca7e190624b7b

SHA1
b96067599151fee6ec1803d47e51441bfa304b0d

SHA256
1dfc92d8f500ea5cf121e92ac58aa047874ab4d98b1acbfb5ccd318460bab9f8

SHA512
339d273b23f0f7dc1437599c6bb2d51cedc1394cc9e99dd3217fce04dc259bced185369d14ee79089b59866a90ef7e0ae5555a08e03b7aab8f9504cbe0c5fe9a

Download Submit
C:\Windows\System\yCbTPdj.exe

Filesize
1.1MB

MD5
e37c88c5692daf94f5a112f53938b248

SHA1
82b8660a8c06ce737de9d2d38234039f67c62b57

SHA256
1e915d19736cba472c5ea0ecbb1ea021d226aeeae1c18bc464abd8b73f16b9d9

SHA512
284070fbcc9d409bf832b94406cd16b907c9e6c1ac1a2748f4810b7d06b7aa9d786737e60b9379ca30f04956c87a63516800b2244dfa3114c3d03daab4031dca

Download Submit
C:\Windows\System\zkRvuJu.exe

Filesize
1.1MB

MD5
57d2039e9cf0625a52c8089d4c4d8e8e

SHA1
2fb81aaa36bd3c75ade8907b57357f8022228190

SHA256
02d2721f51c7cd0d681694a36be1e1cdf4bcd368cbdea6137c123f35a202cba7

SHA512
8cf41fa6beb47d2f58ee2c269949ead63c1feca8d232763206670e0e37790266d0da0667a6fe83d11410316800b5746919ee7904adfc59ca26979592e518419e

Download Submit
C:\Windows\System\zobYFNu.exe

Filesize
1.1MB

MD5
ca84f30ab67cedc84ffbc349d3e5d8be

SHA1
bc4d882f84bee8d05b308d61348911822618a6de

SHA256
adb19653dc06e46691cd013970671118c78a9f0d8acdd6998a581dcd7c0324db

SHA512
2c9e82774a2ebbeed7be03ef6c313377f5ae25c37bc875459178bd4411447d6632748884bb7f35cb0f8c5da1142c9487ccd164f24e3750ed2f32cde936a541f8

Download Submit
memory/552-0-0x0000020BEC730000-0x0000020BEC740000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads