xmrig | c905851cb705b27f1d3dfecbe63ef95693c36136c9c9dfcf637c6030b0227e18

Analysis

max time kernel
121s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
17-11-2024 09:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c905851cb705b27f1d3dfecbe63ef95693c36136c9c9dfcf637c6030b0227e18.exe
Size

1.1MB
MD5

8778bdc52c14b8548f8db73fa8cdb6e0
SHA1

96187f9f5c3614275b9edf313ea9b04ac20c2afc
SHA256

c905851cb705b27f1d3dfecbe63ef95693c36136c9c9dfcf637c6030b0227e18
SHA512

7fa5d2ddb7a1e9ed2af53cbbd7fa2b9bc82483dc066f85fe0dfe12d59dd46f2e65088af0d63546c5da15e7f59db0bf05871c82176f32d1b8ae92a3b510dfc253
SSDEEP

24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbpwlKenszaDw4BgyeIb/qoGy:GezaTF8FcNkNdfE0pZ9ozttwIRakGZbF

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 33 IoCs

miner

resource	yara_rule
behavioral2/files/0x000a000000023b90-6.dat	xmrig
behavioral2/files/0x000c000000023b33-8.dat	xmrig
behavioral2/files/0x000a000000023b92-18.dat	xmrig
behavioral2/files/0x000a000000023b91-17.dat	xmrig
behavioral2/files/0x000b000000023b8c-7.dat	xmrig
behavioral2/files/0x000a000000023b95-35.dat	xmrig
behavioral2/files/0x000a000000023b97-39.dat	xmrig
behavioral2/files/0x000a000000023b98-63.dat	xmrig
behavioral2/files/0x000a000000023b9b-69.dat	xmrig
behavioral2/files/0x000a000000023b9a-67.dat	xmrig
behavioral2/files/0x000a000000023b99-65.dat	xmrig
behavioral2/files/0x000a000000023b96-47.dat	xmrig
behavioral2/files/0x000a000000023b94-45.dat	xmrig
behavioral2/files/0x000a000000023b93-42.dat	xmrig
behavioral2/files/0x000a000000023b9d-82.dat	xmrig
behavioral2/files/0x000a000000023b9c-87.dat	xmrig
behavioral2/files/0x000a000000023b9f-105.dat	xmrig
behavioral2/files/0x000a000000023ba4-117.dat	xmrig
behavioral2/files/0x000a000000023ba7-133.dat	xmrig
behavioral2/files/0x000a000000023bac-145.dat	xmrig
behavioral2/files/0x000a000000023bad-152.dat	xmrig
behavioral2/files/0x000a000000023bab-160.dat	xmrig
behavioral2/files/0x000a000000023baa-159.dat	xmrig
behavioral2/files/0x000a000000023ba9-158.dat	xmrig
behavioral2/files/0x000a000000023ba8-157.dat	xmrig
behavioral2/files/0x000a000000023ba6-149.dat	xmrig
behavioral2/files/0x000a000000023ba5-146.dat	xmrig
behavioral2/files/0x000a000000023ba3-141.dat	xmrig
behavioral2/files/0x000a000000023ba1-128.dat	xmrig
behavioral2/files/0x000a000000023ba2-121.dat	xmrig
behavioral2/files/0x000a000000023ba0-113.dat	xmrig
behavioral2/files/0x000a000000023b9e-98.dat	xmrig
behavioral2/files/0x000b000000023b8d-86.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2176	jNNNfNM.exe
1008	CRxEgLW.exe
2564	DnamoNK.exe
5084	vNHSvCd.exe
1140	OqRXESW.exe
4508	fJJtPvK.exe
1840	hrDHNtB.exe
1984	XZLUJOz.exe
3132	nEmjpHy.exe
2184	kpUEzKz.exe
4928	fFoQgXP.exe
3960	IEnbTor.exe
544	dyxgzMq.exe
2384	lUCGsaf.exe
3080	RNLsxDs.exe
1780	NgPjRWx.exe
1128	jbbeovI.exe
992	usilndj.exe
4912	mljgXek.exe
1608	ZKiQSSn.exe
4956	XtoBHKp.exe
8	sefBNBy.exe
3880	wgCiLIE.exe
1720	GkLvWRh.exe
4452	NGwkDWd.exe
1920	KFjKcqB.exe
2612	wuSqxuD.exe
4076	CRZNPjq.exe
1448	uPnUejk.exe
4108	fARQrWL.exe
2716	heeFsDt.exe
1612	OUnTTpU.exe
4800	HGnkesS.exe
4596	UHEPsUq.exe
1860	OGhmXLY.exe
4828	eSqxlpq.exe
4164	lPBnUuq.exe
4312	tERpAUP.exe
964	ymaRBna.exe
852	QXCeelv.exe
3568	xGCyqCq.exe
3316	EPVlhxf.exe
564	cJRNINF.exe
4188	BJClPAh.exe
3948	dIoGyAk.exe
776	FGwrjvO.exe
3716	VrCuIOO.exe
1820	dqQJrgR.exe
4024	nDqhKTp.exe
3096	ExYhdNy.exe
548	xHjtHtH.exe
4040	DKqbfCx.exe
3976	xfaIQEk.exe
216	CzGJtZY.exe
3648	lxfTqDl.exe
4920	WcMiVYy.exe
3196	BQbPNSa.exe
232	ouCsotX.exe
1900	iHuaTAp.exe
4748	fUMfRRf.exe
4948	eegcxNx.exe
2544	woosiwN.exe
4612	uBaRPBV.exe
684	pfymPHg.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\RNLsxDs.exe	c905851cb705b27f1d3dfecbe63ef95693c36136c9c9dfcf637c6030b0227e18.exe
File created	C:\Windows\System\FGToWYM.exe	c905851cb705b27f1d3dfecbe63ef95693c36136c9c9dfcf637c6030b0227e18.exe
File created	C:\Windows\System\hRqRtaF.exe	c905851cb705b27f1d3dfecbe63ef95693c36136c9c9dfcf637c6030b0227e18.exe
File created	C:\Windows\System\yYYIMNP.exe	c905851cb705b27f1d3dfecbe63ef95693c36136c9c9dfcf637c6030b0227e18.exe
File created	C:\Windows\System\JFerECO.exe	c905851cb705b27f1d3dfecbe63ef95693c36136c9c9dfcf637c6030b0227e18.exe
File created	C:\Windows\System\dssESzh.exe	c905851cb705b27f1d3dfecbe63ef95693c36136c9c9dfcf637c6030b0227e18.exe
File created	C:\Windows\System\KhdlOCW.exe	c905851cb705b27f1d3dfecbe63ef95693c36136c9c9dfcf637c6030b0227e18.exe
File created	C:\Windows\System\fJJtPvK.exe	c905851cb705b27f1d3dfecbe63ef95693c36136c9c9dfcf637c6030b0227e18.exe
File created	C:\Windows\System\RQpkDFl.exe	c905851cb705b27f1d3dfecbe63ef95693c36136c9c9dfcf637c6030b0227e18.exe
File created	C:\Windows\System\ACzXFLb.exe	c905851cb705b27f1d3dfecbe63ef95693c36136c9c9dfcf637c6030b0227e18.exe
File created	C:\Windows\System\CqRDvcS.exe	c905851cb705b27f1d3dfecbe63ef95693c36136c9c9dfcf637c6030b0227e18.exe
File created	C:\Windows\System\PwxpQDa.exe	c905851cb705b27f1d3dfecbe63ef95693c36136c9c9dfcf637c6030b0227e18.exe
File created	C:\Windows\System\KcsznTF.exe	c905851cb705b27f1d3dfecbe63ef95693c36136c9c9dfcf637c6030b0227e18.exe
File created	C:\Windows\System\NQOlxwo.exe	c905851cb705b27f1d3dfecbe63ef95693c36136c9c9dfcf637c6030b0227e18.exe
File created	C:\Windows\System\fzuJJtx.exe	c905851cb705b27f1d3dfecbe63ef95693c36136c9c9dfcf637c6030b0227e18.exe
File created	C:\Windows\System\uoPPZeF.exe	c905851cb705b27f1d3dfecbe63ef95693c36136c9c9dfcf637c6030b0227e18.exe
File created	C:\Windows\System\gDPbAIg.exe	c905851cb705b27f1d3dfecbe63ef95693c36136c9c9dfcf637c6030b0227e18.exe
File created	C:\Windows\System\umsbIHK.exe	c905851cb705b27f1d3dfecbe63ef95693c36136c9c9dfcf637c6030b0227e18.exe
File created	C:\Windows\System\YPJzNOH.exe	c905851cb705b27f1d3dfecbe63ef95693c36136c9c9dfcf637c6030b0227e18.exe
File created	C:\Windows\System\hFLnoSj.exe	c905851cb705b27f1d3dfecbe63ef95693c36136c9c9dfcf637c6030b0227e18.exe
File created	C:\Windows\System\oTCvwaP.exe	c905851cb705b27f1d3dfecbe63ef95693c36136c9c9dfcf637c6030b0227e18.exe
File created	C:\Windows\System\bnrznJW.exe	c905851cb705b27f1d3dfecbe63ef95693c36136c9c9dfcf637c6030b0227e18.exe
File created	C:\Windows\System\QnjjpMz.exe	c905851cb705b27f1d3dfecbe63ef95693c36136c9c9dfcf637c6030b0227e18.exe
File created	C:\Windows\System\ddjBmhG.exe	c905851cb705b27f1d3dfecbe63ef95693c36136c9c9dfcf637c6030b0227e18.exe
File created	C:\Windows\System\dFvlZxu.exe	c905851cb705b27f1d3dfecbe63ef95693c36136c9c9dfcf637c6030b0227e18.exe
File created	C:\Windows\System\SGhlsJI.exe	c905851cb705b27f1d3dfecbe63ef95693c36136c9c9dfcf637c6030b0227e18.exe
File created	C:\Windows\System\fSpJCFy.exe	c905851cb705b27f1d3dfecbe63ef95693c36136c9c9dfcf637c6030b0227e18.exe
File created	C:\Windows\System\DOUUYLk.exe	c905851cb705b27f1d3dfecbe63ef95693c36136c9c9dfcf637c6030b0227e18.exe
File created	C:\Windows\System\NQYuFRQ.exe	c905851cb705b27f1d3dfecbe63ef95693c36136c9c9dfcf637c6030b0227e18.exe
File created	C:\Windows\System\wuSqxuD.exe	c905851cb705b27f1d3dfecbe63ef95693c36136c9c9dfcf637c6030b0227e18.exe
File created	C:\Windows\System\AvvIRhp.exe	c905851cb705b27f1d3dfecbe63ef95693c36136c9c9dfcf637c6030b0227e18.exe
File created	C:\Windows\System\XCSnuJB.exe	c905851cb705b27f1d3dfecbe63ef95693c36136c9c9dfcf637c6030b0227e18.exe
File created	C:\Windows\System\KdQPsjP.exe	c905851cb705b27f1d3dfecbe63ef95693c36136c9c9dfcf637c6030b0227e18.exe
File created	C:\Windows\System\RqlhxaV.exe	c905851cb705b27f1d3dfecbe63ef95693c36136c9c9dfcf637c6030b0227e18.exe
File created	C:\Windows\System\QcaPVgx.exe	c905851cb705b27f1d3dfecbe63ef95693c36136c9c9dfcf637c6030b0227e18.exe
File created	C:\Windows\System\aGWWnAH.exe	c905851cb705b27f1d3dfecbe63ef95693c36136c9c9dfcf637c6030b0227e18.exe
File created	C:\Windows\System\WNNaCna.exe	c905851cb705b27f1d3dfecbe63ef95693c36136c9c9dfcf637c6030b0227e18.exe
File created	C:\Windows\System\WiJrviW.exe	c905851cb705b27f1d3dfecbe63ef95693c36136c9c9dfcf637c6030b0227e18.exe
File created	C:\Windows\System\WyKLoQV.exe	c905851cb705b27f1d3dfecbe63ef95693c36136c9c9dfcf637c6030b0227e18.exe
File created	C:\Windows\System\PddOiXA.exe	c905851cb705b27f1d3dfecbe63ef95693c36136c9c9dfcf637c6030b0227e18.exe
File created	C:\Windows\System\lUCGsaf.exe	c905851cb705b27f1d3dfecbe63ef95693c36136c9c9dfcf637c6030b0227e18.exe
File created	C:\Windows\System\fyptone.exe	c905851cb705b27f1d3dfecbe63ef95693c36136c9c9dfcf637c6030b0227e18.exe
File created	C:\Windows\System\YsAfFXa.exe	c905851cb705b27f1d3dfecbe63ef95693c36136c9c9dfcf637c6030b0227e18.exe
File created	C:\Windows\System\QYAVkJQ.exe	c905851cb705b27f1d3dfecbe63ef95693c36136c9c9dfcf637c6030b0227e18.exe
File created	C:\Windows\System\CdDfzOX.exe	c905851cb705b27f1d3dfecbe63ef95693c36136c9c9dfcf637c6030b0227e18.exe
File created	C:\Windows\System\clYBBDD.exe	c905851cb705b27f1d3dfecbe63ef95693c36136c9c9dfcf637c6030b0227e18.exe
File created	C:\Windows\System\DvIaKUy.exe	c905851cb705b27f1d3dfecbe63ef95693c36136c9c9dfcf637c6030b0227e18.exe
File created	C:\Windows\System\buWCMMj.exe	c905851cb705b27f1d3dfecbe63ef95693c36136c9c9dfcf637c6030b0227e18.exe
File created	C:\Windows\System\vUSaDmq.exe	c905851cb705b27f1d3dfecbe63ef95693c36136c9c9dfcf637c6030b0227e18.exe
File created	C:\Windows\System\IegXiYC.exe	c905851cb705b27f1d3dfecbe63ef95693c36136c9c9dfcf637c6030b0227e18.exe
File created	C:\Windows\System\lzMDYtE.exe	c905851cb705b27f1d3dfecbe63ef95693c36136c9c9dfcf637c6030b0227e18.exe
File created	C:\Windows\System\ClVDbHw.exe	c905851cb705b27f1d3dfecbe63ef95693c36136c9c9dfcf637c6030b0227e18.exe
File created	C:\Windows\System\dIoGyAk.exe	c905851cb705b27f1d3dfecbe63ef95693c36136c9c9dfcf637c6030b0227e18.exe
File created	C:\Windows\System\AGiAOse.exe	c905851cb705b27f1d3dfecbe63ef95693c36136c9c9dfcf637c6030b0227e18.exe
File created	C:\Windows\System\osyGkYF.exe	c905851cb705b27f1d3dfecbe63ef95693c36136c9c9dfcf637c6030b0227e18.exe
File created	C:\Windows\System\sNfxKnh.exe	c905851cb705b27f1d3dfecbe63ef95693c36136c9c9dfcf637c6030b0227e18.exe
File created	C:\Windows\System\fnUlFfg.exe	c905851cb705b27f1d3dfecbe63ef95693c36136c9c9dfcf637c6030b0227e18.exe
File created	C:\Windows\System\YgSkwnT.exe	c905851cb705b27f1d3dfecbe63ef95693c36136c9c9dfcf637c6030b0227e18.exe
File created	C:\Windows\System\EdxIueg.exe	c905851cb705b27f1d3dfecbe63ef95693c36136c9c9dfcf637c6030b0227e18.exe
File created	C:\Windows\System\VpKUEPu.exe	c905851cb705b27f1d3dfecbe63ef95693c36136c9c9dfcf637c6030b0227e18.exe
File created	C:\Windows\System\buKRYPX.exe	c905851cb705b27f1d3dfecbe63ef95693c36136c9c9dfcf637c6030b0227e18.exe
File created	C:\Windows\System\SJAaVQO.exe	c905851cb705b27f1d3dfecbe63ef95693c36136c9c9dfcf637c6030b0227e18.exe
File created	C:\Windows\System\gIbiZYO.exe	c905851cb705b27f1d3dfecbe63ef95693c36136c9c9dfcf637c6030b0227e18.exe
File created	C:\Windows\System\lxfTqDl.exe	c905851cb705b27f1d3dfecbe63ef95693c36136c9c9dfcf637c6030b0227e18.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	16628	dwm.exe
Token: SeChangeNotifyPrivilege	16628	dwm.exe
Token: 33	16628	dwm.exe
Token: SeIncBasePriorityPrivilege	16628	dwm.exe
Token: SeShutdownPrivilege	16628	dwm.exe
Token: SeCreatePagefilePrivilege	16628	dwm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1216 wrote to memory of 2176	1216	c905851cb705b27f1d3dfecbe63ef95693c36136c9c9dfcf637c6030b0227e18.exe	84
PID 1216 wrote to memory of 2176	1216	c905851cb705b27f1d3dfecbe63ef95693c36136c9c9dfcf637c6030b0227e18.exe	84
PID 1216 wrote to memory of 1008	1216	c905851cb705b27f1d3dfecbe63ef95693c36136c9c9dfcf637c6030b0227e18.exe	85
PID 1216 wrote to memory of 1008	1216	c905851cb705b27f1d3dfecbe63ef95693c36136c9c9dfcf637c6030b0227e18.exe	85
PID 1216 wrote to memory of 2564	1216	c905851cb705b27f1d3dfecbe63ef95693c36136c9c9dfcf637c6030b0227e18.exe	86
PID 1216 wrote to memory of 2564	1216	c905851cb705b27f1d3dfecbe63ef95693c36136c9c9dfcf637c6030b0227e18.exe	86
PID 1216 wrote to memory of 5084	1216	c905851cb705b27f1d3dfecbe63ef95693c36136c9c9dfcf637c6030b0227e18.exe	87
PID 1216 wrote to memory of 5084	1216	c905851cb705b27f1d3dfecbe63ef95693c36136c9c9dfcf637c6030b0227e18.exe	87
PID 1216 wrote to memory of 1140	1216	c905851cb705b27f1d3dfecbe63ef95693c36136c9c9dfcf637c6030b0227e18.exe	88
PID 1216 wrote to memory of 1140	1216	c905851cb705b27f1d3dfecbe63ef95693c36136c9c9dfcf637c6030b0227e18.exe	88
PID 1216 wrote to memory of 4508	1216	c905851cb705b27f1d3dfecbe63ef95693c36136c9c9dfcf637c6030b0227e18.exe	89
PID 1216 wrote to memory of 4508	1216	c905851cb705b27f1d3dfecbe63ef95693c36136c9c9dfcf637c6030b0227e18.exe	89
PID 1216 wrote to memory of 1840	1216	c905851cb705b27f1d3dfecbe63ef95693c36136c9c9dfcf637c6030b0227e18.exe	90
PID 1216 wrote to memory of 1840	1216	c905851cb705b27f1d3dfecbe63ef95693c36136c9c9dfcf637c6030b0227e18.exe	90
PID 1216 wrote to memory of 1984	1216	c905851cb705b27f1d3dfecbe63ef95693c36136c9c9dfcf637c6030b0227e18.exe	91
PID 1216 wrote to memory of 1984	1216	c905851cb705b27f1d3dfecbe63ef95693c36136c9c9dfcf637c6030b0227e18.exe	91
PID 1216 wrote to memory of 3132	1216	c905851cb705b27f1d3dfecbe63ef95693c36136c9c9dfcf637c6030b0227e18.exe	92
PID 1216 wrote to memory of 3132	1216	c905851cb705b27f1d3dfecbe63ef95693c36136c9c9dfcf637c6030b0227e18.exe	92
PID 1216 wrote to memory of 2184	1216	c905851cb705b27f1d3dfecbe63ef95693c36136c9c9dfcf637c6030b0227e18.exe	93
PID 1216 wrote to memory of 2184	1216	c905851cb705b27f1d3dfecbe63ef95693c36136c9c9dfcf637c6030b0227e18.exe	93
PID 1216 wrote to memory of 4928	1216	c905851cb705b27f1d3dfecbe63ef95693c36136c9c9dfcf637c6030b0227e18.exe	94
PID 1216 wrote to memory of 4928	1216	c905851cb705b27f1d3dfecbe63ef95693c36136c9c9dfcf637c6030b0227e18.exe	94
PID 1216 wrote to memory of 3960	1216	c905851cb705b27f1d3dfecbe63ef95693c36136c9c9dfcf637c6030b0227e18.exe	95
PID 1216 wrote to memory of 3960	1216	c905851cb705b27f1d3dfecbe63ef95693c36136c9c9dfcf637c6030b0227e18.exe	95
PID 1216 wrote to memory of 544	1216	c905851cb705b27f1d3dfecbe63ef95693c36136c9c9dfcf637c6030b0227e18.exe	96
PID 1216 wrote to memory of 544	1216	c905851cb705b27f1d3dfecbe63ef95693c36136c9c9dfcf637c6030b0227e18.exe	96
PID 1216 wrote to memory of 2384	1216	c905851cb705b27f1d3dfecbe63ef95693c36136c9c9dfcf637c6030b0227e18.exe	97
PID 1216 wrote to memory of 2384	1216	c905851cb705b27f1d3dfecbe63ef95693c36136c9c9dfcf637c6030b0227e18.exe	97
PID 1216 wrote to memory of 1780	1216	c905851cb705b27f1d3dfecbe63ef95693c36136c9c9dfcf637c6030b0227e18.exe	98
PID 1216 wrote to memory of 1780	1216	c905851cb705b27f1d3dfecbe63ef95693c36136c9c9dfcf637c6030b0227e18.exe	98
PID 1216 wrote to memory of 3080	1216	c905851cb705b27f1d3dfecbe63ef95693c36136c9c9dfcf637c6030b0227e18.exe	99
PID 1216 wrote to memory of 3080	1216	c905851cb705b27f1d3dfecbe63ef95693c36136c9c9dfcf637c6030b0227e18.exe	99
PID 1216 wrote to memory of 1128	1216	c905851cb705b27f1d3dfecbe63ef95693c36136c9c9dfcf637c6030b0227e18.exe	100
PID 1216 wrote to memory of 1128	1216	c905851cb705b27f1d3dfecbe63ef95693c36136c9c9dfcf637c6030b0227e18.exe	100
PID 1216 wrote to memory of 992	1216	c905851cb705b27f1d3dfecbe63ef95693c36136c9c9dfcf637c6030b0227e18.exe	101
PID 1216 wrote to memory of 992	1216	c905851cb705b27f1d3dfecbe63ef95693c36136c9c9dfcf637c6030b0227e18.exe	101
PID 1216 wrote to memory of 4912	1216	c905851cb705b27f1d3dfecbe63ef95693c36136c9c9dfcf637c6030b0227e18.exe	102
PID 1216 wrote to memory of 4912	1216	c905851cb705b27f1d3dfecbe63ef95693c36136c9c9dfcf637c6030b0227e18.exe	102
PID 1216 wrote to memory of 1608	1216	c905851cb705b27f1d3dfecbe63ef95693c36136c9c9dfcf637c6030b0227e18.exe	103
PID 1216 wrote to memory of 1608	1216	c905851cb705b27f1d3dfecbe63ef95693c36136c9c9dfcf637c6030b0227e18.exe	103
PID 1216 wrote to memory of 8	1216	c905851cb705b27f1d3dfecbe63ef95693c36136c9c9dfcf637c6030b0227e18.exe	104
PID 1216 wrote to memory of 8	1216	c905851cb705b27f1d3dfecbe63ef95693c36136c9c9dfcf637c6030b0227e18.exe	104
PID 1216 wrote to memory of 4956	1216	c905851cb705b27f1d3dfecbe63ef95693c36136c9c9dfcf637c6030b0227e18.exe	105
PID 1216 wrote to memory of 4956	1216	c905851cb705b27f1d3dfecbe63ef95693c36136c9c9dfcf637c6030b0227e18.exe	105
PID 1216 wrote to memory of 3880	1216	c905851cb705b27f1d3dfecbe63ef95693c36136c9c9dfcf637c6030b0227e18.exe	106
PID 1216 wrote to memory of 3880	1216	c905851cb705b27f1d3dfecbe63ef95693c36136c9c9dfcf637c6030b0227e18.exe	106
PID 1216 wrote to memory of 1720	1216	c905851cb705b27f1d3dfecbe63ef95693c36136c9c9dfcf637c6030b0227e18.exe	107
PID 1216 wrote to memory of 1720	1216	c905851cb705b27f1d3dfecbe63ef95693c36136c9c9dfcf637c6030b0227e18.exe	107
PID 1216 wrote to memory of 4452	1216	c905851cb705b27f1d3dfecbe63ef95693c36136c9c9dfcf637c6030b0227e18.exe	108
PID 1216 wrote to memory of 4452	1216	c905851cb705b27f1d3dfecbe63ef95693c36136c9c9dfcf637c6030b0227e18.exe	108
PID 1216 wrote to memory of 1920	1216	c905851cb705b27f1d3dfecbe63ef95693c36136c9c9dfcf637c6030b0227e18.exe	109
PID 1216 wrote to memory of 1920	1216	c905851cb705b27f1d3dfecbe63ef95693c36136c9c9dfcf637c6030b0227e18.exe	109
PID 1216 wrote to memory of 2612	1216	c905851cb705b27f1d3dfecbe63ef95693c36136c9c9dfcf637c6030b0227e18.exe	110
PID 1216 wrote to memory of 2612	1216	c905851cb705b27f1d3dfecbe63ef95693c36136c9c9dfcf637c6030b0227e18.exe	110
PID 1216 wrote to memory of 4076	1216	c905851cb705b27f1d3dfecbe63ef95693c36136c9c9dfcf637c6030b0227e18.exe	111
PID 1216 wrote to memory of 4076	1216	c905851cb705b27f1d3dfecbe63ef95693c36136c9c9dfcf637c6030b0227e18.exe	111
PID 1216 wrote to memory of 1448	1216	c905851cb705b27f1d3dfecbe63ef95693c36136c9c9dfcf637c6030b0227e18.exe	112
PID 1216 wrote to memory of 1448	1216	c905851cb705b27f1d3dfecbe63ef95693c36136c9c9dfcf637c6030b0227e18.exe	112
PID 1216 wrote to memory of 4108	1216	c905851cb705b27f1d3dfecbe63ef95693c36136c9c9dfcf637c6030b0227e18.exe	113
PID 1216 wrote to memory of 4108	1216	c905851cb705b27f1d3dfecbe63ef95693c36136c9c9dfcf637c6030b0227e18.exe	113
PID 1216 wrote to memory of 2716	1216	c905851cb705b27f1d3dfecbe63ef95693c36136c9c9dfcf637c6030b0227e18.exe	114
PID 1216 wrote to memory of 2716	1216	c905851cb705b27f1d3dfecbe63ef95693c36136c9c9dfcf637c6030b0227e18.exe	114
PID 1216 wrote to memory of 1612	1216	c905851cb705b27f1d3dfecbe63ef95693c36136c9c9dfcf637c6030b0227e18.exe	115
PID 1216 wrote to memory of 1612	1216	c905851cb705b27f1d3dfecbe63ef95693c36136c9c9dfcf637c6030b0227e18.exe	115

C:\Users\Admin\AppData\Local\Temp\c905851cb705b27f1d3dfecbe63ef95693c36136c9c9dfcf637c6030b0227e18.exe
"C:\Users\Admin\AppData\Local\Temp\c905851cb705b27f1d3dfecbe63ef95693c36136c9c9dfcf637c6030b0227e18.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1216
- C:\Windows\System\jNNNfNM.exe
  C:\Windows\System\jNNNfNM.exe
  2⤵
  - Executes dropped EXE
  PID:2176
- C:\Windows\System\CRxEgLW.exe
  C:\Windows\System\CRxEgLW.exe
  2⤵
  - Executes dropped EXE
  PID:1008
- C:\Windows\System\DnamoNK.exe
  C:\Windows\System\DnamoNK.exe
  2⤵
  - Executes dropped EXE
  PID:2564
- C:\Windows\System\vNHSvCd.exe
  C:\Windows\System\vNHSvCd.exe
  2⤵
  - Executes dropped EXE
  PID:5084
- C:\Windows\System\OqRXESW.exe
  C:\Windows\System\OqRXESW.exe
  2⤵
  - Executes dropped EXE
  PID:1140
- C:\Windows\System\fJJtPvK.exe
  C:\Windows\System\fJJtPvK.exe
  2⤵
  - Executes dropped EXE
  PID:4508
- C:\Windows\System\hrDHNtB.exe
  C:\Windows\System\hrDHNtB.exe
  2⤵
  - Executes dropped EXE
  PID:1840
- C:\Windows\System\XZLUJOz.exe
  C:\Windows\System\XZLUJOz.exe
  2⤵
  - Executes dropped EXE
  PID:1984
- C:\Windows\System\nEmjpHy.exe
  C:\Windows\System\nEmjpHy.exe
  2⤵
  - Executes dropped EXE
  PID:3132
- C:\Windows\System\kpUEzKz.exe
  C:\Windows\System\kpUEzKz.exe
  2⤵
  - Executes dropped EXE
  PID:2184
- C:\Windows\System\fFoQgXP.exe
  C:\Windows\System\fFoQgXP.exe
  2⤵
  - Executes dropped EXE
  PID:4928
- C:\Windows\System\IEnbTor.exe
  C:\Windows\System\IEnbTor.exe
  2⤵
  - Executes dropped EXE
  PID:3960
- C:\Windows\System\dyxgzMq.exe
  C:\Windows\System\dyxgzMq.exe
  2⤵
  - Executes dropped EXE
  PID:544
- C:\Windows\System\lUCGsaf.exe
  C:\Windows\System\lUCGsaf.exe
  2⤵
  - Executes dropped EXE
  PID:2384
- C:\Windows\System\NgPjRWx.exe
  C:\Windows\System\NgPjRWx.exe
  2⤵
  - Executes dropped EXE
  PID:1780
- C:\Windows\System\RNLsxDs.exe
  C:\Windows\System\RNLsxDs.exe
  2⤵
  - Executes dropped EXE
  PID:3080
- C:\Windows\System\jbbeovI.exe
  C:\Windows\System\jbbeovI.exe
  2⤵
  - Executes dropped EXE
  PID:1128
- C:\Windows\System\usilndj.exe
  C:\Windows\System\usilndj.exe
  2⤵
  - Executes dropped EXE
  PID:992
- C:\Windows\System\mljgXek.exe
  C:\Windows\System\mljgXek.exe
  2⤵
  - Executes dropped EXE
  PID:4912
- C:\Windows\System\ZKiQSSn.exe
  C:\Windows\System\ZKiQSSn.exe
  2⤵
  - Executes dropped EXE
  PID:1608
- C:\Windows\System\sefBNBy.exe
  C:\Windows\System\sefBNBy.exe
  2⤵
  - Executes dropped EXE
  PID:8
- C:\Windows\System\XtoBHKp.exe
  C:\Windows\System\XtoBHKp.exe
  2⤵
  - Executes dropped EXE
  PID:4956
- C:\Windows\System\wgCiLIE.exe
  C:\Windows\System\wgCiLIE.exe
  2⤵
  - Executes dropped EXE
  PID:3880
- C:\Windows\System\GkLvWRh.exe
  C:\Windows\System\GkLvWRh.exe
  2⤵
  - Executes dropped EXE
  PID:1720
- C:\Windows\System\NGwkDWd.exe
  C:\Windows\System\NGwkDWd.exe
  2⤵
  - Executes dropped EXE
  PID:4452
- C:\Windows\System\KFjKcqB.exe
  C:\Windows\System\KFjKcqB.exe
  2⤵
  - Executes dropped EXE
  PID:1920
- C:\Windows\System\wuSqxuD.exe
  C:\Windows\System\wuSqxuD.exe
  2⤵
  - Executes dropped EXE
  PID:2612
- C:\Windows\System\CRZNPjq.exe
  C:\Windows\System\CRZNPjq.exe
  2⤵
  - Executes dropped EXE
  PID:4076
- C:\Windows\System\uPnUejk.exe
  C:\Windows\System\uPnUejk.exe
  2⤵
  - Executes dropped EXE
  PID:1448
- C:\Windows\System\fARQrWL.exe
  C:\Windows\System\fARQrWL.exe
  2⤵
  - Executes dropped EXE
  PID:4108
- C:\Windows\System\heeFsDt.exe
  C:\Windows\System\heeFsDt.exe
  2⤵
  - Executes dropped EXE
  PID:2716
- C:\Windows\System\OUnTTpU.exe
  C:\Windows\System\OUnTTpU.exe
  2⤵
  - Executes dropped EXE
  PID:1612
- C:\Windows\System\HGnkesS.exe
  C:\Windows\System\HGnkesS.exe
  2⤵
  - Executes dropped EXE
  PID:4800
- C:\Windows\System\UHEPsUq.exe
  C:\Windows\System\UHEPsUq.exe
  2⤵
  - Executes dropped EXE
  PID:4596
- C:\Windows\System\OGhmXLY.exe
  C:\Windows\System\OGhmXLY.exe
  2⤵
  - Executes dropped EXE
  PID:1860
- C:\Windows\System\eSqxlpq.exe
  C:\Windows\System\eSqxlpq.exe
  2⤵
  - Executes dropped EXE
  PID:4828
- C:\Windows\System\lPBnUuq.exe
  C:\Windows\System\lPBnUuq.exe
  2⤵
  - Executes dropped EXE
  PID:4164
- C:\Windows\System\tERpAUP.exe
  C:\Windows\System\tERpAUP.exe
  2⤵
  - Executes dropped EXE
  PID:4312
- C:\Windows\System\ymaRBna.exe
  C:\Windows\System\ymaRBna.exe
  2⤵
  - Executes dropped EXE
  PID:964
- C:\Windows\System\QXCeelv.exe
  C:\Windows\System\QXCeelv.exe
  2⤵
  - Executes dropped EXE
  PID:852
- C:\Windows\System\xGCyqCq.exe
  C:\Windows\System\xGCyqCq.exe
  2⤵
  - Executes dropped EXE
  PID:3568
- C:\Windows\System\EPVlhxf.exe
  C:\Windows\System\EPVlhxf.exe
  2⤵
  - Executes dropped EXE
  PID:3316
- C:\Windows\System\cJRNINF.exe
  C:\Windows\System\cJRNINF.exe
  2⤵
  - Executes dropped EXE
  PID:564
- C:\Windows\System\BJClPAh.exe
  C:\Windows\System\BJClPAh.exe
  2⤵
  - Executes dropped EXE
  PID:4188
- C:\Windows\System\dIoGyAk.exe
  C:\Windows\System\dIoGyAk.exe
  2⤵
  - Executes dropped EXE
  PID:3948
- C:\Windows\System\FGwrjvO.exe
  C:\Windows\System\FGwrjvO.exe
  2⤵
  - Executes dropped EXE
  PID:776
- C:\Windows\System\VrCuIOO.exe
  C:\Windows\System\VrCuIOO.exe
  2⤵
  - Executes dropped EXE
  PID:3716
- C:\Windows\System\dqQJrgR.exe
  C:\Windows\System\dqQJrgR.exe
  2⤵
  - Executes dropped EXE
  PID:1820
- C:\Windows\System\nDqhKTp.exe
  C:\Windows\System\nDqhKTp.exe
  2⤵
  - Executes dropped EXE
  PID:4024
- C:\Windows\System\ExYhdNy.exe
  C:\Windows\System\ExYhdNy.exe
  2⤵
  - Executes dropped EXE
  PID:3096
- C:\Windows\System\xHjtHtH.exe
  C:\Windows\System\xHjtHtH.exe
  2⤵
  - Executes dropped EXE
  PID:548
- C:\Windows\System\xfaIQEk.exe
  C:\Windows\System\xfaIQEk.exe
  2⤵
  - Executes dropped EXE
  PID:3976
- C:\Windows\System\DKqbfCx.exe
  C:\Windows\System\DKqbfCx.exe
  2⤵
  - Executes dropped EXE
  PID:4040
- C:\Windows\System\CzGJtZY.exe
  C:\Windows\System\CzGJtZY.exe
  2⤵
  - Executes dropped EXE
  PID:216
- C:\Windows\System\lxfTqDl.exe
  C:\Windows\System\lxfTqDl.exe
  2⤵
  - Executes dropped EXE
  PID:3648
- C:\Windows\System\WcMiVYy.exe
  C:\Windows\System\WcMiVYy.exe
  2⤵
  - Executes dropped EXE
  PID:4920
- C:\Windows\System\BQbPNSa.exe
  C:\Windows\System\BQbPNSa.exe
  2⤵
  - Executes dropped EXE
  PID:3196
- C:\Windows\System\ouCsotX.exe
  C:\Windows\System\ouCsotX.exe
  2⤵
  - Executes dropped EXE
  PID:232
- C:\Windows\System\fUMfRRf.exe
  C:\Windows\System\fUMfRRf.exe
  2⤵
  - Executes dropped EXE
  PID:4748
- C:\Windows\System\eegcxNx.exe
  C:\Windows\System\eegcxNx.exe
  2⤵
  - Executes dropped EXE
  PID:4948
- C:\Windows\System\iHuaTAp.exe
  C:\Windows\System\iHuaTAp.exe
  2⤵
  - Executes dropped EXE
  PID:1900
- C:\Windows\System\woosiwN.exe
  C:\Windows\System\woosiwN.exe
  2⤵
  - Executes dropped EXE
  PID:2544
- C:\Windows\System\uBaRPBV.exe
  C:\Windows\System\uBaRPBV.exe
  2⤵
  - Executes dropped EXE
  PID:4612
- C:\Windows\System\pfymPHg.exe
  C:\Windows\System\pfymPHg.exe
  2⤵
  - Executes dropped EXE
  PID:684
- C:\Windows\System\gmgwNrt.exe
  C:\Windows\System\gmgwNrt.exe
  2⤵
  PID:2620
- C:\Windows\System\jvtoddJ.exe
  C:\Windows\System\jvtoddJ.exe
  2⤵
  PID:1396
- C:\Windows\System\Uhvfhev.exe
  C:\Windows\System\Uhvfhev.exe
  2⤵
  PID:3300
- C:\Windows\System\BDwmrcl.exe
  C:\Windows\System\BDwmrcl.exe
  2⤵
  PID:2200
- C:\Windows\System\AvvIRhp.exe
  C:\Windows\System\AvvIRhp.exe
  2⤵
  PID:2364
- C:\Windows\System\paxuGdL.exe
  C:\Windows\System\paxuGdL.exe
  2⤵
  PID:1888
- C:\Windows\System\LEXsDht.exe
  C:\Windows\System\LEXsDht.exe
  2⤵
  PID:1332
- C:\Windows\System\mIllrXG.exe
  C:\Windows\System\mIllrXG.exe
  2⤵
  PID:1476
- C:\Windows\System\paWbHdZ.exe
  C:\Windows\System\paWbHdZ.exe
  2⤵
  PID:1108
- C:\Windows\System\JXKBLdE.exe
  C:\Windows\System\JXKBLdE.exe
  2⤵
  PID:1508
- C:\Windows\System\DdTrhra.exe
  C:\Windows\System\DdTrhra.exe
  2⤵
  PID:1192
- C:\Windows\System\TBLAOrd.exe
  C:\Windows\System\TBLAOrd.exe
  2⤵
  PID:1388
- C:\Windows\System\BHiSOyS.exe
  C:\Windows\System\BHiSOyS.exe
  2⤵
  PID:1040
- C:\Windows\System\XVhOfjY.exe
  C:\Windows\System\XVhOfjY.exe
  2⤵
  PID:3520
- C:\Windows\System\NQOlxwo.exe
  C:\Windows\System\NQOlxwo.exe
  2⤵
  PID:2468
- C:\Windows\System\yknJoOn.exe
  C:\Windows\System\yknJoOn.exe
  2⤵
  PID:468
- C:\Windows\System\KpvAmjp.exe
  C:\Windows\System\KpvAmjp.exe
  2⤵
  PID:3744
- C:\Windows\System\EABMsdM.exe
  C:\Windows\System\EABMsdM.exe
  2⤵
  PID:3652
- C:\Windows\System\dfWeqrd.exe
  C:\Windows\System\dfWeqrd.exe
  2⤵
  PID:4444
- C:\Windows\System\knpQkkR.exe
  C:\Windows\System\knpQkkR.exe
  2⤵
  PID:3576
- C:\Windows\System\uQHoMVN.exe
  C:\Windows\System\uQHoMVN.exe
  2⤵
  PID:1188
- C:\Windows\System\cfRlkes.exe
  C:\Windows\System\cfRlkes.exe
  2⤵
  PID:3488
- C:\Windows\System\RLUGWTQ.exe
  C:\Windows\System\RLUGWTQ.exe
  2⤵
  PID:4668
- C:\Windows\System\uJsiHlD.exe
  C:\Windows\System\uJsiHlD.exe
  2⤵
  PID:2160
- C:\Windows\System\ttVHfyE.exe
  C:\Windows\System\ttVHfyE.exe
  2⤵
  PID:952
- C:\Windows\System\hexXhMl.exe
  C:\Windows\System\hexXhMl.exe
  2⤵
  PID:632
- C:\Windows\System\aEVYdCN.exe
  C:\Windows\System\aEVYdCN.exe
  2⤵
  PID:336
- C:\Windows\System\wwPeAVE.exe
  C:\Windows\System\wwPeAVE.exe
  2⤵
  PID:3036
- C:\Windows\System\zVohkLF.exe
  C:\Windows\System\zVohkLF.exe
  2⤵
  PID:1660
- C:\Windows\System\pTuQcho.exe
  C:\Windows\System\pTuQcho.exe
  2⤵
  PID:3224
- C:\Windows\System\oolWtbv.exe
  C:\Windows\System\oolWtbv.exe
  2⤵
  PID:1256
- C:\Windows\System\anCeENQ.exe
  C:\Windows\System\anCeENQ.exe
  2⤵
  PID:2276
- C:\Windows\System\aGWWnAH.exe
  C:\Windows\System\aGWWnAH.exe
  2⤵
  PID:3128
- C:\Windows\System\BbpvZDq.exe
  C:\Windows\System\BbpvZDq.exe
  2⤵
  PID:392
- C:\Windows\System\lJTPWWi.exe
  C:\Windows\System\lJTPWWi.exe
  2⤵
  PID:4428
- C:\Windows\System\fspQUIn.exe
  C:\Windows\System\fspQUIn.exe
  2⤵
  PID:1784
- C:\Windows\System\JPBiztc.exe
  C:\Windows\System\JPBiztc.exe
  2⤵
  PID:1928
- C:\Windows\System\DRURwwY.exe
  C:\Windows\System\DRURwwY.exe
  2⤵
  PID:2476
- C:\Windows\System\UazfdLc.exe
  C:\Windows\System\UazfdLc.exe
  2⤵
  PID:1644
- C:\Windows\System\HMTTIos.exe
  C:\Windows\System\HMTTIos.exe
  2⤵
  PID:4448
- C:\Windows\System\jWmOFDz.exe
  C:\Windows\System\jWmOFDz.exe
  2⤵
  PID:1400
- C:\Windows\System\bNhwFIv.exe
  C:\Windows\System\bNhwFIv.exe
  2⤵
  PID:3456
- C:\Windows\System\NMdtbin.exe
  C:\Windows\System\NMdtbin.exe
  2⤵
  PID:1808
- C:\Windows\System\VwPHIHB.exe
  C:\Windows\System\VwPHIHB.exe
  2⤵
  PID:5124
- C:\Windows\System\hKmLxox.exe
  C:\Windows\System\hKmLxox.exe
  2⤵
  PID:5168
- C:\Windows\System\cWEQkoB.exe
  C:\Windows\System\cWEQkoB.exe
  2⤵
  PID:5184
- C:\Windows\System\hEkQwlV.exe
  C:\Windows\System\hEkQwlV.exe
  2⤵
  PID:5208
- C:\Windows\System\UHezAaL.exe
  C:\Windows\System\UHezAaL.exe
  2⤵
  PID:5236
- C:\Windows\System\kZRSAdZ.exe
  C:\Windows\System\kZRSAdZ.exe
  2⤵
  PID:5276
- C:\Windows\System\qeTcbfY.exe
  C:\Windows\System\qeTcbfY.exe
  2⤵
  PID:5296
- C:\Windows\System\XCSnuJB.exe
  C:\Windows\System\XCSnuJB.exe
  2⤵
  PID:5324
- C:\Windows\System\GlEzCja.exe
  C:\Windows\System\GlEzCja.exe
  2⤵
  PID:5340
- C:\Windows\System\KDkEtuX.exe
  C:\Windows\System\KDkEtuX.exe
  2⤵
  PID:5360
- C:\Windows\System\ZRtopKM.exe
  C:\Windows\System\ZRtopKM.exe
  2⤵
  PID:5384
- C:\Windows\System\rHeovFm.exe
  C:\Windows\System\rHeovFm.exe
  2⤵
  PID:5412
- C:\Windows\System\Snlprmk.exe
  C:\Windows\System\Snlprmk.exe
  2⤵
  PID:5436
- C:\Windows\System\CSWXuiv.exe
  C:\Windows\System\CSWXuiv.exe
  2⤵
  PID:5464
- C:\Windows\System\EqdnXgj.exe
  C:\Windows\System\EqdnXgj.exe
  2⤵
  PID:5500
- C:\Windows\System\GZQAxtA.exe
  C:\Windows\System\GZQAxtA.exe
  2⤵
  PID:5528
- C:\Windows\System\cYeSoOp.exe
  C:\Windows\System\cYeSoOp.exe
  2⤵
  PID:5560
- C:\Windows\System\eKSrZys.exe
  C:\Windows\System\eKSrZys.exe
  2⤵
  PID:5588
- C:\Windows\System\rqiMsiE.exe
  C:\Windows\System\rqiMsiE.exe
  2⤵
  PID:5612
- C:\Windows\System\ETkRnKD.exe
  C:\Windows\System\ETkRnKD.exe
  2⤵
  PID:5644
- C:\Windows\System\bqumqvf.exe
  C:\Windows\System\bqumqvf.exe
  2⤵
  PID:5672
- C:\Windows\System\JfSyZwz.exe
  C:\Windows\System\JfSyZwz.exe
  2⤵
  PID:5692
- C:\Windows\System\LcKJUnz.exe
  C:\Windows\System\LcKJUnz.exe
  2⤵
  PID:5716
- C:\Windows\System\zmlIUEu.exe
  C:\Windows\System\zmlIUEu.exe
  2⤵
  PID:5744
- C:\Windows\System\NqOgKRW.exe
  C:\Windows\System\NqOgKRW.exe
  2⤵
  PID:5776
- C:\Windows\System\tjttHBK.exe
  C:\Windows\System\tjttHBK.exe
  2⤵
  PID:5796
- C:\Windows\System\pcvZtKr.exe
  C:\Windows\System\pcvZtKr.exe
  2⤵
  PID:5820
- C:\Windows\System\meaGJYM.exe
  C:\Windows\System\meaGJYM.exe
  2⤵
  PID:5844
- C:\Windows\System\xOeFppg.exe
  C:\Windows\System\xOeFppg.exe
  2⤵
  PID:5872
- C:\Windows\System\sEMgkGc.exe
  C:\Windows\System\sEMgkGc.exe
  2⤵
  PID:5892
- C:\Windows\System\ZwzixhI.exe
  C:\Windows\System\ZwzixhI.exe
  2⤵
  PID:5924
- C:\Windows\System\ajtdjcP.exe
  C:\Windows\System\ajtdjcP.exe
  2⤵
  PID:5944
- C:\Windows\System\nrBLlxm.exe
  C:\Windows\System\nrBLlxm.exe
  2⤵
  PID:5968
- C:\Windows\System\dSgPXoY.exe
  C:\Windows\System\dSgPXoY.exe
  2⤵
  PID:5996
- C:\Windows\System\PfnctCF.exe
  C:\Windows\System\PfnctCF.exe
  2⤵
  PID:6020
- C:\Windows\System\fZbmxFe.exe
  C:\Windows\System\fZbmxFe.exe
  2⤵
  PID:6060
- C:\Windows\System\WRUdrNh.exe
  C:\Windows\System\WRUdrNh.exe
  2⤵
  PID:6088
- C:\Windows\System\yfdUnxF.exe
  C:\Windows\System\yfdUnxF.exe
  2⤵
  PID:6124
- C:\Windows\System\FTpkuVa.exe
  C:\Windows\System\FTpkuVa.exe
  2⤵
  PID:1176
- C:\Windows\System\jkBzLFs.exe
  C:\Windows\System\jkBzLFs.exe
  2⤵
  PID:5156
- C:\Windows\System\rBOGqJP.exe
  C:\Windows\System\rBOGqJP.exe
  2⤵
  PID:5232
- C:\Windows\System\zAbKNKX.exe
  C:\Windows\System\zAbKNKX.exe
  2⤵
  PID:5312
- C:\Windows\System\yygKbJE.exe
  C:\Windows\System\yygKbJE.exe
  2⤵
  PID:5448
- C:\Windows\System\zEkkdxH.exe
  C:\Windows\System\zEkkdxH.exe
  2⤵
  PID:5404
- C:\Windows\System\dVtGxFm.exe
  C:\Windows\System\dVtGxFm.exe
  2⤵
  PID:5480
- C:\Windows\System\keNQhpK.exe
  C:\Windows\System\keNQhpK.exe
  2⤵
  PID:5636
- C:\Windows\System\DhvjTHH.exe
  C:\Windows\System\DhvjTHH.exe
  2⤵
  PID:5656
- C:\Windows\System\WlHiMSE.exe
  C:\Windows\System\WlHiMSE.exe
  2⤵
  PID:5680
- C:\Windows\System\LQOQtxJ.exe
  C:\Windows\System\LQOQtxJ.exe
  2⤵
  PID:5816
- C:\Windows\System\gaphvrJ.exe
  C:\Windows\System\gaphvrJ.exe
  2⤵
  PID:5836
- C:\Windows\System\YjJNQDJ.exe
  C:\Windows\System\YjJNQDJ.exe
  2⤵
  PID:5976
- C:\Windows\System\MCOJJRt.exe
  C:\Windows\System\MCOJJRt.exe
  2⤵
  PID:5952
- C:\Windows\System\qQsTBxq.exe
  C:\Windows\System\qQsTBxq.exe
  2⤵
  PID:6044
- C:\Windows\System\CrCHnSV.exe
  C:\Windows\System\CrCHnSV.exe
  2⤵
  PID:6084
- C:\Windows\System\ROBklgw.exe
  C:\Windows\System\ROBklgw.exe
  2⤵
  PID:1632
- C:\Windows\System\YYNzRbi.exe
  C:\Windows\System\YYNzRbi.exe
  2⤵
  PID:5284
- C:\Windows\System\hAzhfTQ.exe
  C:\Windows\System\hAzhfTQ.exe
  2⤵
  PID:5368
- C:\Windows\System\DKRdcNU.exe
  C:\Windows\System\DKRdcNU.exe
  2⤵
  PID:5544
- C:\Windows\System\hHpfmiY.exe
  C:\Windows\System\hHpfmiY.exe
  2⤵
  PID:5704
- C:\Windows\System\UCzKvZl.exe
  C:\Windows\System\UCzKvZl.exe
  2⤵
  PID:5900
- C:\Windows\System\hLJbrxX.exe
  C:\Windows\System\hLJbrxX.exe
  2⤵
  PID:5916
- C:\Windows\System\iDlQrzf.exe
  C:\Windows\System\iDlQrzf.exe
  2⤵
  PID:5196
- C:\Windows\System\hJNSRMy.exe
  C:\Windows\System\hJNSRMy.exe
  2⤵
  PID:5580
- C:\Windows\System\qBOtbnb.exe
  C:\Windows\System\qBOtbnb.exe
  2⤵
  PID:5908
- C:\Windows\System\JpGbMgh.exe
  C:\Windows\System\JpGbMgh.exe
  2⤵
  PID:5784
- C:\Windows\System\JjUpKFA.exe
  C:\Windows\System\JjUpKFA.exe
  2⤵
  PID:6160
- C:\Windows\System\IuyTXec.exe
  C:\Windows\System\IuyTXec.exe
  2⤵
  PID:6252
- C:\Windows\System\VtHbzLc.exe
  C:\Windows\System\VtHbzLc.exe
  2⤵
  PID:6268
- C:\Windows\System\FMVBmmM.exe
  C:\Windows\System\FMVBmmM.exe
  2⤵
  PID:6284
- C:\Windows\System\fzuJJtx.exe
  C:\Windows\System\fzuJJtx.exe
  2⤵
  PID:6300
- C:\Windows\System\eGTLNGk.exe
  C:\Windows\System\eGTLNGk.exe
  2⤵
  PID:6320
- C:\Windows\System\RQpkDFl.exe
  C:\Windows\System\RQpkDFl.exe
  2⤵
  PID:6336
- C:\Windows\System\IjJILNw.exe
  C:\Windows\System\IjJILNw.exe
  2⤵
  PID:6364
- C:\Windows\System\cSGoAcg.exe
  C:\Windows\System\cSGoAcg.exe
  2⤵
  PID:6380
- C:\Windows\System\mQbscmw.exe
  C:\Windows\System\mQbscmw.exe
  2⤵
  PID:6408
- C:\Windows\System\dJLPMyU.exe
  C:\Windows\System\dJLPMyU.exe
  2⤵
  PID:6424
- C:\Windows\System\UDeMJcQ.exe
  C:\Windows\System\UDeMJcQ.exe
  2⤵
  PID:6444
- C:\Windows\System\ldWJGpT.exe
  C:\Windows\System\ldWJGpT.exe
  2⤵
  PID:6472
- C:\Windows\System\gsxtQfk.exe
  C:\Windows\System\gsxtQfk.exe
  2⤵
  PID:6496
- C:\Windows\System\UplYWFn.exe
  C:\Windows\System\UplYWFn.exe
  2⤵
  PID:6520
- C:\Windows\System\MOntGCp.exe
  C:\Windows\System\MOntGCp.exe
  2⤵
  PID:6548
- C:\Windows\System\OljPBEF.exe
  C:\Windows\System\OljPBEF.exe
  2⤵
  PID:6568
- C:\Windows\System\acKuewr.exe
  C:\Windows\System\acKuewr.exe
  2⤵
  PID:6600
- C:\Windows\System\aisHHpZ.exe
  C:\Windows\System\aisHHpZ.exe
  2⤵
  PID:6628
- C:\Windows\System\NrzyScc.exe
  C:\Windows\System\NrzyScc.exe
  2⤵
  PID:6656
- C:\Windows\System\wQShJQo.exe
  C:\Windows\System\wQShJQo.exe
  2⤵
  PID:6676
- C:\Windows\System\GUCFnmm.exe
  C:\Windows\System\GUCFnmm.exe
  2⤵
  PID:6696
- C:\Windows\System\FmHkYKX.exe
  C:\Windows\System\FmHkYKX.exe
  2⤵
  PID:6728
- C:\Windows\System\emPPsBw.exe
  C:\Windows\System\emPPsBw.exe
  2⤵
  PID:6764
- C:\Windows\System\ddjBmhG.exe
  C:\Windows\System\ddjBmhG.exe
  2⤵
  PID:6788
- C:\Windows\System\ySXaDSk.exe
  C:\Windows\System\ySXaDSk.exe
  2⤵
  PID:6824
- C:\Windows\System\qhrGdSM.exe
  C:\Windows\System\qhrGdSM.exe
  2⤵
  PID:6848
- C:\Windows\System\qSgFFsA.exe
  C:\Windows\System\qSgFFsA.exe
  2⤵
  PID:6876
- C:\Windows\System\MrjTzNW.exe
  C:\Windows\System\MrjTzNW.exe
  2⤵
  PID:6900
- C:\Windows\System\VLFmkGW.exe
  C:\Windows\System\VLFmkGW.exe
  2⤵
  PID:6920
- C:\Windows\System\UrgfRaT.exe
  C:\Windows\System\UrgfRaT.exe
  2⤵
  PID:6936
- C:\Windows\System\EdxIueg.exe
  C:\Windows\System\EdxIueg.exe
  2⤵
  PID:6960
- C:\Windows\System\whCoETB.exe
  C:\Windows\System\whCoETB.exe
  2⤵
  PID:6976
- C:\Windows\System\AGiAOse.exe
  C:\Windows\System\AGiAOse.exe
  2⤵
  PID:7000
- C:\Windows\System\ynGsnIx.exe
  C:\Windows\System\ynGsnIx.exe
  2⤵
  PID:7016
- C:\Windows\System\dANtIVB.exe
  C:\Windows\System\dANtIVB.exe
  2⤵
  PID:7040
- C:\Windows\System\fyptone.exe
  C:\Windows\System\fyptone.exe
  2⤵
  PID:7068
- C:\Windows\System\VgEuheT.exe
  C:\Windows\System\VgEuheT.exe
  2⤵
  PID:7104
- C:\Windows\System\wfFEooZ.exe
  C:\Windows\System\wfFEooZ.exe
  2⤵
  PID:7128
- C:\Windows\System\cUZyTEN.exe
  C:\Windows\System\cUZyTEN.exe
  2⤵
  PID:7148
- C:\Windows\System\XTbpCfj.exe
  C:\Windows\System\XTbpCfj.exe
  2⤵
  PID:6012
- C:\Windows\System\lBwZCac.exe
  C:\Windows\System\lBwZCac.exe
  2⤵
  PID:6216
- C:\Windows\System\OMfkTJb.exe
  C:\Windows\System\OMfkTJb.exe
  2⤵
  PID:6280
- C:\Windows\System\wblRMRP.exe
  C:\Windows\System\wblRMRP.exe
  2⤵
  PID:6352
- C:\Windows\System\DPeOart.exe
  C:\Windows\System\DPeOart.exe
  2⤵
  PID:6436
- C:\Windows\System\MfhzibE.exe
  C:\Windows\System\MfhzibE.exe
  2⤵
  PID:6516
- C:\Windows\System\uYaQLnq.exe
  C:\Windows\System\uYaQLnq.exe
  2⤵
  PID:6536
- C:\Windows\System\fhAcspj.exe
  C:\Windows\System\fhAcspj.exe
  2⤵
  PID:6492
- C:\Windows\System\DaOVwsP.exe
  C:\Windows\System\DaOVwsP.exe
  2⤵
  PID:6584
- C:\Windows\System\okRsrcm.exe
  C:\Windows\System\okRsrcm.exe
  2⤵
  PID:6864
- C:\Windows\System\BZViUuv.exe
  C:\Windows\System\BZViUuv.exe
  2⤵
  PID:6908
- C:\Windows\System\ZZLpwaq.exe
  C:\Windows\System\ZZLpwaq.exe
  2⤵
  PID:6748
- C:\Windows\System\QdVoSDy.exe
  C:\Windows\System\QdVoSDy.exe
  2⤵
  PID:6776
- C:\Windows\System\fWKvxFo.exe
  C:\Windows\System\fWKvxFo.exe
  2⤵
  PID:7032
- C:\Windows\System\ucovOvN.exe
  C:\Windows\System\ucovOvN.exe
  2⤵
  PID:6988
- C:\Windows\System\IkPDMnB.exe
  C:\Windows\System\IkPDMnB.exe
  2⤵
  PID:7120
- C:\Windows\System\FQhjuOP.exe
  C:\Windows\System\FQhjuOP.exe
  2⤵
  PID:7012
- C:\Windows\System\tqhqwnN.exe
  C:\Windows\System\tqhqwnN.exe
  2⤵
  PID:7084
- C:\Windows\System\YPJzNOH.exe
  C:\Windows\System\YPJzNOH.exe
  2⤵
  PID:6188
- C:\Windows\System\CdDfzOX.exe
  C:\Windows\System\CdDfzOX.exe
  2⤵
  PID:7192
- C:\Windows\System\nUyUANc.exe
  C:\Windows\System\nUyUANc.exe
  2⤵
  PID:7220
- C:\Windows\System\ifUIXpn.exe
  C:\Windows\System\ifUIXpn.exe
  2⤵
  PID:7248
- C:\Windows\System\dFvlZxu.exe
  C:\Windows\System\dFvlZxu.exe
  2⤵
  PID:7276
- C:\Windows\System\DtDQfwN.exe
  C:\Windows\System\DtDQfwN.exe
  2⤵
  PID:7308
- C:\Windows\System\DjyWsiy.exe
  C:\Windows\System\DjyWsiy.exe
  2⤵
  PID:7332
- C:\Windows\System\qrHLCYn.exe
  C:\Windows\System\qrHLCYn.exe
  2⤵
  PID:7356
- C:\Windows\System\ecRwRnH.exe
  C:\Windows\System\ecRwRnH.exe
  2⤵
  PID:7380
- C:\Windows\System\GnbbhWv.exe
  C:\Windows\System\GnbbhWv.exe
  2⤵
  PID:7408
- C:\Windows\System\TWiFVby.exe
  C:\Windows\System\TWiFVby.exe
  2⤵
  PID:7436
- C:\Windows\System\OZqGkVp.exe
  C:\Windows\System\OZqGkVp.exe
  2⤵
  PID:7468
- C:\Windows\System\yIcFtmP.exe
  C:\Windows\System\yIcFtmP.exe
  2⤵
  PID:7492
- C:\Windows\System\kKzvYRK.exe
  C:\Windows\System\kKzvYRK.exe
  2⤵
  PID:7520
- C:\Windows\System\yYYIMNP.exe
  C:\Windows\System\yYYIMNP.exe
  2⤵
  PID:7544
- C:\Windows\System\okTpmNb.exe
  C:\Windows\System\okTpmNb.exe
  2⤵
  PID:7568
- C:\Windows\System\lQXbUSG.exe
  C:\Windows\System\lQXbUSG.exe
  2⤵
  PID:7592
- C:\Windows\System\avXnUQS.exe
  C:\Windows\System\avXnUQS.exe
  2⤵
  PID:7616
- C:\Windows\System\ZcYYVyM.exe
  C:\Windows\System\ZcYYVyM.exe
  2⤵
  PID:7632
- C:\Windows\System\faxjiXr.exe
  C:\Windows\System\faxjiXr.exe
  2⤵
  PID:7660
- C:\Windows\System\BAKfnKg.exe
  C:\Windows\System\BAKfnKg.exe
  2⤵
  PID:7692
- C:\Windows\System\FVOOjJJ.exe
  C:\Windows\System\FVOOjJJ.exe
  2⤵
  PID:7720
- C:\Windows\System\qKILbbc.exe
  C:\Windows\System\qKILbbc.exe
  2⤵
  PID:7752
- C:\Windows\System\DvIaKUy.exe
  C:\Windows\System\DvIaKUy.exe
  2⤵
  PID:7776
- C:\Windows\System\qROyObv.exe
  C:\Windows\System\qROyObv.exe
  2⤵
  PID:7800
- C:\Windows\System\hCQhLNU.exe
  C:\Windows\System\hCQhLNU.exe
  2⤵
  PID:7832
- C:\Windows\System\paEJzam.exe
  C:\Windows\System\paEJzam.exe
  2⤵
  PID:7852
- C:\Windows\System\lWXgodT.exe
  C:\Windows\System\lWXgodT.exe
  2⤵
  PID:7876
- C:\Windows\System\jsmglNb.exe
  C:\Windows\System\jsmglNb.exe
  2⤵
  PID:7904
- C:\Windows\System\XmWshDJ.exe
  C:\Windows\System\XmWshDJ.exe
  2⤵
  PID:7936
- C:\Windows\System\AWxxPSH.exe
  C:\Windows\System\AWxxPSH.exe
  2⤵
  PID:7956
- C:\Windows\System\VpCMMwR.exe
  C:\Windows\System\VpCMMwR.exe
  2⤵
  PID:7980
- C:\Windows\System\LgGsciw.exe
  C:\Windows\System\LgGsciw.exe
  2⤵
  PID:8004
- C:\Windows\System\DiuUxTa.exe
  C:\Windows\System\DiuUxTa.exe
  2⤵
  PID:8024
- C:\Windows\System\VSNjuvt.exe
  C:\Windows\System\VSNjuvt.exe
  2⤵
  PID:8052
- C:\Windows\System\vBPqMbp.exe
  C:\Windows\System\vBPqMbp.exe
  2⤵
  PID:8076
- C:\Windows\System\FGToWYM.exe
  C:\Windows\System\FGToWYM.exe
  2⤵
  PID:8100
- C:\Windows\System\OgAWDRq.exe
  C:\Windows\System\OgAWDRq.exe
  2⤵
  PID:8124
- C:\Windows\System\axstuOP.exe
  C:\Windows\System\axstuOP.exe
  2⤵
  PID:8148
- C:\Windows\System\aVMdCBT.exe
  C:\Windows\System\aVMdCBT.exe
  2⤵
  PID:8176
- C:\Windows\System\SGqTxew.exe
  C:\Windows\System\SGqTxew.exe
  2⤵
  PID:6508
- C:\Windows\System\QXJcpqq.exe
  C:\Windows\System\QXJcpqq.exe
  2⤵
  PID:6348
- C:\Windows\System\uBQYDTO.exe
  C:\Windows\System\uBQYDTO.exe
  2⤵
  PID:6468
- C:\Windows\System\woUpobu.exe
  C:\Windows\System\woUpobu.exe
  2⤵
  PID:6564
- C:\Windows\System\dgwlSXs.exe
  C:\Windows\System\dgwlSXs.exe
  2⤵
  PID:7140
- C:\Windows\System\ujDXTJM.exe
  C:\Windows\System\ujDXTJM.exe
  2⤵
  PID:6844
- C:\Windows\System\uoPPZeF.exe
  C:\Windows\System\uoPPZeF.exe
  2⤵
  PID:7368
- C:\Windows\System\iqftMCr.exe
  C:\Windows\System\iqftMCr.exe
  2⤵
  PID:7156
- C:\Windows\System\SmfVhoP.exe
  C:\Windows\System\SmfVhoP.exe
  2⤵
  PID:7320
- C:\Windows\System\JsWTYjS.exe
  C:\Windows\System\JsWTYjS.exe
  2⤵
  PID:7344
- C:\Windows\System\btRqTgY.exe
  C:\Windows\System\btRqTgY.exe
  2⤵
  PID:7536
- C:\Windows\System\AoKTbnC.exe
  C:\Windows\System\AoKTbnC.exe
  2⤵
  PID:7400
- C:\Windows\System\NmtlTAO.exe
  C:\Windows\System\NmtlTAO.exe
  2⤵
  PID:7640
- C:\Windows\System\FaoKTOt.exe
  C:\Windows\System\FaoKTOt.exe
  2⤵
  PID:7512
- C:\Windows\System\OJrMiqD.exe
  C:\Windows\System\OJrMiqD.exe
  2⤵
  PID:7448
- C:\Windows\System\eywQpkX.exe
  C:\Windows\System\eywQpkX.exe
  2⤵
  PID:7676
- C:\Windows\System\EVPAvKB.exe
  C:\Windows\System\EVPAvKB.exe
  2⤵
  PID:7744
- C:\Windows\System\osyGkYF.exe
  C:\Windows\System\osyGkYF.exe
  2⤵
  PID:8012
- C:\Windows\System\KwCYtOw.exe
  C:\Windows\System\KwCYtOw.exe
  2⤵
  PID:8020
- C:\Windows\System\tyazePn.exe
  C:\Windows\System\tyazePn.exe
  2⤵
  PID:8072
- C:\Windows\System\XwimrFR.exe
  C:\Windows\System\XwimrFR.exe
  2⤵
  PID:8164
- C:\Windows\System\QQFSFbK.exe
  C:\Windows\System\QQFSFbK.exe
  2⤵
  PID:7808
- C:\Windows\System\GAKBZbT.exe
  C:\Windows\System\GAKBZbT.exe
  2⤵
  PID:8120
- C:\Windows\System\WNKnUWO.exe
  C:\Windows\System\WNKnUWO.exe
  2⤵
  PID:8112
- C:\Windows\System\ioBhmmF.exe
  C:\Windows\System\ioBhmmF.exe
  2⤵
  PID:7972
- C:\Windows\System\aFpGETC.exe
  C:\Windows\System\aFpGETC.exe
  2⤵
  PID:8096
- C:\Windows\System\IGVdBOd.exe
  C:\Windows\System\IGVdBOd.exe
  2⤵
  PID:8204
- C:\Windows\System\KcQeBPu.exe
  C:\Windows\System\KcQeBPu.exe
  2⤵
  PID:8228
- C:\Windows\System\ULkgsUu.exe
  C:\Windows\System\ULkgsUu.exe
  2⤵
  PID:8252
- C:\Windows\System\BzzEail.exe
  C:\Windows\System\BzzEail.exe
  2⤵
  PID:8268
- C:\Windows\System\QJcuzbd.exe
  C:\Windows\System\QJcuzbd.exe
  2⤵
  PID:8296
- C:\Windows\System\pRVZkUq.exe
  C:\Windows\System\pRVZkUq.exe
  2⤵
  PID:8324
- C:\Windows\System\hGlWWHu.exe
  C:\Windows\System\hGlWWHu.exe
  2⤵
  PID:8348
- C:\Windows\System\mwCkNPI.exe
  C:\Windows\System\mwCkNPI.exe
  2⤵
  PID:8380
- C:\Windows\System\YWLrwwD.exe
  C:\Windows\System\YWLrwwD.exe
  2⤵
  PID:8400
- C:\Windows\System\oGOAZZB.exe
  C:\Windows\System\oGOAZZB.exe
  2⤵
  PID:8420
- C:\Windows\System\NPXVQrX.exe
  C:\Windows\System\NPXVQrX.exe
  2⤵
  PID:8448
- C:\Windows\System\YGMbjEh.exe
  C:\Windows\System\YGMbjEh.exe
  2⤵
  PID:8464
- C:\Windows\System\WZGMtAg.exe
  C:\Windows\System\WZGMtAg.exe
  2⤵
  PID:8492
- C:\Windows\System\XlNVQaH.exe
  C:\Windows\System\XlNVQaH.exe
  2⤵
  PID:8516
- C:\Windows\System\aIsheIX.exe
  C:\Windows\System\aIsheIX.exe
  2⤵
  PID:8536
- C:\Windows\System\clYBBDD.exe
  C:\Windows\System\clYBBDD.exe
  2⤵
  PID:8560
- C:\Windows\System\qwxMoed.exe
  C:\Windows\System\qwxMoed.exe
  2⤵
  PID:8580
- C:\Windows\System\hlVchgN.exe
  C:\Windows\System\hlVchgN.exe
  2⤵
  PID:8600
- C:\Windows\System\aZfOScb.exe
  C:\Windows\System\aZfOScb.exe
  2⤵
  PID:8632
- C:\Windows\System\LkvEHSZ.exe
  C:\Windows\System\LkvEHSZ.exe
  2⤵
  PID:8652
- C:\Windows\System\cCduNbl.exe
  C:\Windows\System\cCduNbl.exe
  2⤵
  PID:8680
- C:\Windows\System\dLsHmvt.exe
  C:\Windows\System\dLsHmvt.exe
  2⤵
  PID:8708
- C:\Windows\System\fxjDwkp.exe
  C:\Windows\System\fxjDwkp.exe
  2⤵
  PID:8736
- C:\Windows\System\BYhgaDt.exe
  C:\Windows\System\BYhgaDt.exe
  2⤵
  PID:8764
- C:\Windows\System\ipYsJnE.exe
  C:\Windows\System\ipYsJnE.exe
  2⤵
  PID:8788
- C:\Windows\System\CTYneBP.exe
  C:\Windows\System\CTYneBP.exe
  2⤵
  PID:8812
- C:\Windows\System\zoQLUlI.exe
  C:\Windows\System\zoQLUlI.exe
  2⤵
  PID:8844
- C:\Windows\System\CjXKxjy.exe
  C:\Windows\System\CjXKxjy.exe
  2⤵
  PID:8868
- C:\Windows\System\eZrBckn.exe
  C:\Windows\System\eZrBckn.exe
  2⤵
  PID:8888
- C:\Windows\System\MRikcZq.exe
  C:\Windows\System\MRikcZq.exe
  2⤵
  PID:8912
- C:\Windows\System\JkLrfFA.exe
  C:\Windows\System\JkLrfFA.exe
  2⤵
  PID:8932
- C:\Windows\System\HfkkLji.exe
  C:\Windows\System\HfkkLji.exe
  2⤵
  PID:8956
- C:\Windows\System\zeJWMQk.exe
  C:\Windows\System\zeJWMQk.exe
  2⤵
  PID:8984
- C:\Windows\System\VJxpeVH.exe
  C:\Windows\System\VJxpeVH.exe
  2⤵
  PID:9008
- C:\Windows\System\tYKtfvw.exe
  C:\Windows\System\tYKtfvw.exe
  2⤵
  PID:9032
- C:\Windows\System\NsYiHHw.exe
  C:\Windows\System\NsYiHHw.exe
  2⤵
  PID:9064
- C:\Windows\System\nxGhCOk.exe
  C:\Windows\System\nxGhCOk.exe
  2⤵
  PID:9084
- C:\Windows\System\JZLIuhQ.exe
  C:\Windows\System\JZLIuhQ.exe
  2⤵
  PID:9108
- C:\Windows\System\TJSZBes.exe
  C:\Windows\System\TJSZBes.exe
  2⤵
  PID:9136
- C:\Windows\System\RECDofm.exe
  C:\Windows\System\RECDofm.exe
  2⤵
  PID:9164
- C:\Windows\System\FNNNWVL.exe
  C:\Windows\System\FNNNWVL.exe
  2⤵
  PID:9184
- C:\Windows\System\nbQfeej.exe
  C:\Windows\System\nbQfeej.exe
  2⤵
  PID:9200
- C:\Windows\System\sNfxKnh.exe
  C:\Windows\System\sNfxKnh.exe
  2⤵
  PID:7188
- C:\Windows\System\CLCuKma.exe
  C:\Windows\System\CLCuKma.exe
  2⤵
  PID:6420
- C:\Windows\System\YkQoJod.exe
  C:\Windows\System\YkQoJod.exe
  2⤵
  PID:7144
- C:\Windows\System\LCcMVQr.exe
  C:\Windows\System\LCcMVQr.exe
  2⤵
  PID:6736
- C:\Windows\System\cYOQVdj.exe
  C:\Windows\System\cYOQVdj.exe
  2⤵
  PID:6996
- C:\Windows\System\aXQxddo.exe
  C:\Windows\System\aXQxddo.exe
  2⤵
  PID:7236
- C:\Windows\System\YHrfbzf.exe
  C:\Windows\System\YHrfbzf.exe
  2⤵
  PID:8412
- C:\Windows\System\ozhmYUf.exe
  C:\Windows\System\ozhmYUf.exe
  2⤵
  PID:8480
- C:\Windows\System\PCwqxmh.exe
  C:\Windows\System\PCwqxmh.exe
  2⤵
  PID:7700
- C:\Windows\System\LcyVwHP.exe
  C:\Windows\System\LcyVwHP.exe
  2⤵
  PID:8280
- C:\Windows\System\UCowowV.exe
  C:\Windows\System\UCowowV.exe
  2⤵
  PID:8308
- C:\Windows\System\YouLKKc.exe
  C:\Windows\System\YouLKKc.exe
  2⤵
  PID:7796
- C:\Windows\System\PdHTcAP.exe
  C:\Windows\System\PdHTcAP.exe
  2⤵
  PID:8676
- C:\Windows\System\hloHlCF.exe
  C:\Windows\System\hloHlCF.exe
  2⤵
  PID:8752
- C:\Windows\System\iXVhmxi.exe
  C:\Windows\System\iXVhmxi.exe
  2⤵
  PID:8220
- C:\Windows\System\uYzasxT.exe
  C:\Windows\System\uYzasxT.exe
  2⤵
  PID:8568
- C:\Windows\System\HusGCuQ.exe
  C:\Windows\System\HusGCuQ.exe
  2⤵
  PID:8364
- C:\Windows\System\ylJHpZU.exe
  C:\Windows\System\ylJHpZU.exe
  2⤵
  PID:8416
- C:\Windows\System\KKKmldG.exe
  C:\Windows\System\KKKmldG.exe
  2⤵
  PID:9144
- C:\Windows\System\HxCicsL.exe
  C:\Windows\System\HxCicsL.exe
  2⤵
  PID:8592
- C:\Windows\System\lXjKWkX.exe
  C:\Windows\System\lXjKWkX.exe
  2⤵
  PID:8648
- C:\Windows\System\qEHlrFj.exe
  C:\Windows\System\qEHlrFj.exe
  2⤵
  PID:8688
- C:\Windows\System\HUmwcGS.exe
  C:\Windows\System\HUmwcGS.exe
  2⤵
  PID:8704
- C:\Windows\System\lUEnxBH.exe
  C:\Windows\System\lUEnxBH.exe
  2⤵
  PID:9056
- C:\Windows\System\OQlDrPp.exe
  C:\Windows\System\OQlDrPp.exe
  2⤵
  PID:9104
- C:\Windows\System\pBwkrDZ.exe
  C:\Windows\System\pBwkrDZ.exe
  2⤵
  PID:8796
- C:\Windows\System\dKuuXCX.exe
  C:\Windows\System\dKuuXCX.exe
  2⤵
  PID:9228
- C:\Windows\System\cjyNVzV.exe
  C:\Windows\System\cjyNVzV.exe
  2⤵
  PID:9252
- C:\Windows\System\tqjWKsl.exe
  C:\Windows\System\tqjWKsl.exe
  2⤵
  PID:9284
- C:\Windows\System\JwVlCNb.exe
  C:\Windows\System\JwVlCNb.exe
  2⤵
  PID:9304
- C:\Windows\System\KWXGOEc.exe
  C:\Windows\System\KWXGOEc.exe
  2⤵
  PID:9336
- C:\Windows\System\mGmKfxI.exe
  C:\Windows\System\mGmKfxI.exe
  2⤵
  PID:9360
- C:\Windows\System\cpjRcBR.exe
  C:\Windows\System\cpjRcBR.exe
  2⤵
  PID:9376
- C:\Windows\System\yCqASaz.exe
  C:\Windows\System\yCqASaz.exe
  2⤵
  PID:9400
- C:\Windows\System\KdQPsjP.exe
  C:\Windows\System\KdQPsjP.exe
  2⤵
  PID:9432
- C:\Windows\System\jqxeoSj.exe
  C:\Windows\System\jqxeoSj.exe
  2⤵
  PID:9460
- C:\Windows\System\YEgxUxh.exe
  C:\Windows\System\YEgxUxh.exe
  2⤵
  PID:9480
- C:\Windows\System\MaZfzri.exe
  C:\Windows\System\MaZfzri.exe
  2⤵
  PID:9504
- C:\Windows\System\rFQnREK.exe
  C:\Windows\System\rFQnREK.exe
  2⤵
  PID:9520
- C:\Windows\System\ukBpJlI.exe
  C:\Windows\System\ukBpJlI.exe
  2⤵
  PID:9536
- C:\Windows\System\JpZZGrs.exe
  C:\Windows\System\JpZZGrs.exe
  2⤵
  PID:9564
- C:\Windows\System\KISEuyh.exe
  C:\Windows\System\KISEuyh.exe
  2⤵
  PID:9596
- C:\Windows\System\FdKdAIg.exe
  C:\Windows\System\FdKdAIg.exe
  2⤵
  PID:9620
- C:\Windows\System\AEqCZkg.exe
  C:\Windows\System\AEqCZkg.exe
  2⤵
  PID:9644
- C:\Windows\System\NqqZlsz.exe
  C:\Windows\System\NqqZlsz.exe
  2⤵
  PID:9672
- C:\Windows\System\ENdXJOZ.exe
  C:\Windows\System\ENdXJOZ.exe
  2⤵
  PID:9696
- C:\Windows\System\otaXGLG.exe
  C:\Windows\System\otaXGLG.exe
  2⤵
  PID:9716
- C:\Windows\System\LmtGRCI.exe
  C:\Windows\System\LmtGRCI.exe
  2⤵
  PID:9736
- C:\Windows\System\XgLmDVM.exe
  C:\Windows\System\XgLmDVM.exe
  2⤵
  PID:9760
- C:\Windows\System\KciagHA.exe
  C:\Windows\System\KciagHA.exe
  2⤵
  PID:9784
- C:\Windows\System\wTiQbqE.exe
  C:\Windows\System\wTiQbqE.exe
  2⤵
  PID:9808
- C:\Windows\System\IZldgpn.exe
  C:\Windows\System\IZldgpn.exe
  2⤵
  PID:9832
- C:\Windows\System\cwewwnA.exe
  C:\Windows\System\cwewwnA.exe
  2⤵
  PID:9848
- C:\Windows\System\WwqeiXc.exe
  C:\Windows\System\WwqeiXc.exe
  2⤵
  PID:9872
- C:\Windows\System\GngNFzY.exe
  C:\Windows\System\GngNFzY.exe
  2⤵
  PID:9896
- C:\Windows\System\qpPwcHI.exe
  C:\Windows\System\qpPwcHI.exe
  2⤵
  PID:9916
- C:\Windows\System\toaexXJ.exe
  C:\Windows\System\toaexXJ.exe
  2⤵
  PID:9932
- C:\Windows\System\SMnLCTP.exe
  C:\Windows\System\SMnLCTP.exe
  2⤵
  PID:9964
- C:\Windows\System\vTghCaD.exe
  C:\Windows\System\vTghCaD.exe
  2⤵
  PID:9980
- C:\Windows\System\KiNUgzx.exe
  C:\Windows\System\KiNUgzx.exe
  2⤵
  PID:10004
- C:\Windows\System\ZhTItJb.exe
  C:\Windows\System\ZhTItJb.exe
  2⤵
  PID:10024
- C:\Windows\System\WLbpshV.exe
  C:\Windows\System\WLbpshV.exe
  2⤵
  PID:10052
- C:\Windows\System\mljzAyA.exe
  C:\Windows\System\mljzAyA.exe
  2⤵
  PID:10072
- C:\Windows\System\scMFYIW.exe
  C:\Windows\System\scMFYIW.exe
  2⤵
  PID:10100
- C:\Windows\System\GgjhPfI.exe
  C:\Windows\System\GgjhPfI.exe
  2⤵
  PID:10120
- C:\Windows\System\uYoqcFg.exe
  C:\Windows\System\uYoqcFg.exe
  2⤵
  PID:10144
- C:\Windows\System\ZHkhqof.exe
  C:\Windows\System\ZHkhqof.exe
  2⤵
  PID:10176
- C:\Windows\System\CgsLtSD.exe
  C:\Windows\System\CgsLtSD.exe
  2⤵
  PID:10200
- C:\Windows\System\XWDMkpv.exe
  C:\Windows\System\XWDMkpv.exe
  2⤵
  PID:10220
- C:\Windows\System\yxJDrzA.exe
  C:\Windows\System\yxJDrzA.exe
  2⤵
  PID:7552
- C:\Windows\System\zmrLaNi.exe
  C:\Windows\System\zmrLaNi.exe
  2⤵
  PID:8284
- C:\Windows\System\yNvZfil.exe
  C:\Windows\System\yNvZfil.exe
  2⤵
  PID:9212
- C:\Windows\System\YpkPLNh.exe
  C:\Windows\System\YpkPLNh.exe
  2⤵
  PID:8444
- C:\Windows\System\rOeupKy.exe
  C:\Windows\System\rOeupKy.exe
  2⤵
  PID:8928
- C:\Windows\System\Yadjgjx.exe
  C:\Windows\System\Yadjgjx.exe
  2⤵
  PID:9528
- C:\Windows\System\cLRWqTi.exe
  C:\Windows\System\cLRWqTi.exe
  2⤵
  PID:9636
- C:\Windows\System\EqchJIa.exe
  C:\Windows\System\EqchJIa.exe
  2⤵
  PID:8260
- C:\Windows\System\lZTLnlg.exe
  C:\Windows\System\lZTLnlg.exe
  2⤵
  PID:8316
- C:\Windows\System\fTDPXxE.exe
  C:\Windows\System\fTDPXxE.exe
  2⤵
  PID:9416
- C:\Windows\System\PVEUUAa.exe
  C:\Windows\System\PVEUUAa.exe
  2⤵
  PID:9476
- C:\Windows\System\CevtypB.exe
  C:\Windows\System\CevtypB.exe
  2⤵
  PID:8556
- C:\Windows\System\MLnGglV.exe
  C:\Windows\System\MLnGglV.exe
  2⤵
  PID:10196
- C:\Windows\System\RUCXnEz.exe
  C:\Windows\System\RUCXnEz.exe
  2⤵
  PID:9744
- C:\Windows\System\SiUODxQ.exe
  C:\Windows\System\SiUODxQ.exe
  2⤵
  PID:9792
- C:\Windows\System\EhbzdJF.exe
  C:\Windows\System\EhbzdJF.exe
  2⤵
  PID:9868
- C:\Windows\System\wyWcKsT.exe
  C:\Windows\System\wyWcKsT.exe
  2⤵
  PID:9892
- C:\Windows\System\DjWhrxk.exe
  C:\Windows\System\DjWhrxk.exe
  2⤵
  PID:9532
- C:\Windows\System\XblQOgW.exe
  C:\Windows\System\XblQOgW.exe
  2⤵
  PID:9604
- C:\Windows\System\HIbqUTO.exe
  C:\Windows\System\HIbqUTO.exe
  2⤵
  PID:10260
- C:\Windows\System\mbwrMrp.exe
  C:\Windows\System\mbwrMrp.exe
  2⤵
  PID:10280
- C:\Windows\System\hhwGsAT.exe
  C:\Windows\System\hhwGsAT.exe
  2⤵
  PID:10300
- C:\Windows\System\RqsqtEY.exe
  C:\Windows\System\RqsqtEY.exe
  2⤵
  PID:10328
- C:\Windows\System\hqYkelF.exe
  C:\Windows\System\hqYkelF.exe
  2⤵
  PID:10344
- C:\Windows\System\fnUlFfg.exe
  C:\Windows\System\fnUlFfg.exe
  2⤵
  PID:10368
- C:\Windows\System\trpPjPx.exe
  C:\Windows\System\trpPjPx.exe
  2⤵
  PID:10400
- C:\Windows\System\jpigFiI.exe
  C:\Windows\System\jpigFiI.exe
  2⤵
  PID:10428
- C:\Windows\System\KljtZwy.exe
  C:\Windows\System\KljtZwy.exe
  2⤵
  PID:10452
- C:\Windows\System\pvHQwaO.exe
  C:\Windows\System\pvHQwaO.exe
  2⤵
  PID:10484
- C:\Windows\System\lbHqPfB.exe
  C:\Windows\System\lbHqPfB.exe
  2⤵
  PID:10508
- C:\Windows\System\MUEEscA.exe
  C:\Windows\System\MUEEscA.exe
  2⤵
  PID:10544
- C:\Windows\System\XNiWRQA.exe
  C:\Windows\System\XNiWRQA.exe
  2⤵
  PID:10572
- C:\Windows\System\rhaxSgK.exe
  C:\Windows\System\rhaxSgK.exe
  2⤵
  PID:10592
- C:\Windows\System\nWxbhZw.exe
  C:\Windows\System\nWxbhZw.exe
  2⤵
  PID:10624
- C:\Windows\System\WNNaCna.exe
  C:\Windows\System\WNNaCna.exe
  2⤵
  PID:10644
- C:\Windows\System\szOoDWX.exe
  C:\Windows\System\szOoDWX.exe
  2⤵
  PID:10664
- C:\Windows\System\SVTWJgR.exe
  C:\Windows\System\SVTWJgR.exe
  2⤵
  PID:10696
- C:\Windows\System\muwgxNh.exe
  C:\Windows\System\muwgxNh.exe
  2⤵
  PID:10724
- C:\Windows\System\MJyfCYU.exe
  C:\Windows\System\MJyfCYU.exe
  2⤵
  PID:10748
- C:\Windows\System\YHWJByu.exe
  C:\Windows\System\YHWJByu.exe
  2⤵
  PID:10768
- C:\Windows\System\yZvtapj.exe
  C:\Windows\System\yZvtapj.exe
  2⤵
  PID:11000
- C:\Windows\System\YVzlKJw.exe
  C:\Windows\System\YVzlKJw.exe
  2⤵
  PID:11032
- C:\Windows\System\KFSVhDY.exe
  C:\Windows\System\KFSVhDY.exe
  2⤵
  PID:11056
- C:\Windows\System\GWJBwaO.exe
  C:\Windows\System\GWJBwaO.exe
  2⤵
  PID:11084
- C:\Windows\System\vabYvNB.exe
  C:\Windows\System\vabYvNB.exe
  2⤵
  PID:11124
- C:\Windows\System\UwcrjtY.exe
  C:\Windows\System\UwcrjtY.exe
  2⤵
  PID:11164
- C:\Windows\System\GuGcSns.exe
  C:\Windows\System\GuGcSns.exe
  2⤵
  PID:11188
- C:\Windows\System\JRbbFHs.exe
  C:\Windows\System\JRbbFHs.exe
  2⤵
  PID:11208
- C:\Windows\System\MzdBzgM.exe
  C:\Windows\System\MzdBzgM.exe
  2⤵
  PID:11236
- C:\Windows\System\qcozCwr.exe
  C:\Windows\System\qcozCwr.exe
  2⤵
  PID:10208
- C:\Windows\System\WiJrviW.exe
  C:\Windows\System\WiJrviW.exe
  2⤵
  PID:9768
- C:\Windows\System\vrNCEbh.exe
  C:\Windows\System\vrNCEbh.exe
  2⤵
  PID:6592
- C:\Windows\System\HlQacmZ.exe
  C:\Windows\System\HlQacmZ.exe
  2⤵
  PID:10016
- C:\Windows\System\ioylEUw.exe
  C:\Windows\System\ioylEUw.exe
  2⤵
  PID:9016
- C:\Windows\System\TXJmWHn.exe
  C:\Windows\System\TXJmWHn.exe
  2⤵
  PID:10152
- C:\Windows\System\VpKUEPu.exe
  C:\Windows\System\VpKUEPu.exe
  2⤵
  PID:9776
- C:\Windows\System\GNszdbB.exe
  C:\Windows\System\GNszdbB.exe
  2⤵
  PID:10060
- C:\Windows\System\ojgTpeh.exe
  C:\Windows\System\ojgTpeh.exe
  2⤵
  PID:10012
- C:\Windows\System\pMcifAs.exe
  C:\Windows\System\pMcifAs.exe
  2⤵
  PID:10356
- C:\Windows\System\YtilwYu.exe
  C:\Windows\System\YtilwYu.exe
  2⤵
  PID:8432
- C:\Windows\System\XhIsZOD.exe
  C:\Windows\System\XhIsZOD.exe
  2⤵
  PID:9844
- C:\Windows\System\qQZucYM.exe
  C:\Windows\System\qQZucYM.exe
  2⤵
  PID:10684
- C:\Windows\System\SGhlsJI.exe
  C:\Windows\System\SGhlsJI.exe
  2⤵
  PID:10820
- C:\Windows\System\OFxaLQr.exe
  C:\Windows\System\OFxaLQr.exe
  2⤵
  PID:10420
- C:\Windows\System\laKAmTC.exe
  C:\Windows\System\laKAmTC.exe
  2⤵
  PID:10476
- C:\Windows\System\HFtTYtq.exe
  C:\Windows\System\HFtTYtq.exe
  2⤵
  PID:10532
- C:\Windows\System\olRcvoC.exe
  C:\Windows\System\olRcvoC.exe
  2⤵
  PID:8808
- C:\Windows\System\IDXDDAL.exe
  C:\Windows\System\IDXDDAL.exe
  2⤵
  PID:8780
- C:\Windows\System\AVtVRgw.exe
  C:\Windows\System\AVtVRgw.exe
  2⤵
  PID:9688
- C:\Windows\System\EQSBduI.exe
  C:\Windows\System\EQSBduI.exe
  2⤵
  PID:9560
- C:\Windows\System\BmGEFmv.exe
  C:\Windows\System\BmGEFmv.exe
  2⤵
  PID:11016
- C:\Windows\System\NgswNYY.exe
  C:\Windows\System\NgswNYY.exe
  2⤵
  PID:10336
- C:\Windows\System\twHoDZx.exe
  C:\Windows\System\twHoDZx.exe
  2⤵
  PID:10504
- C:\Windows\System\hjGsyJO.exe
  C:\Windows\System\hjGsyJO.exe
  2⤵
  PID:10636
- C:\Windows\System\CNFrkvn.exe
  C:\Windows\System\CNFrkvn.exe
  2⤵
  PID:11276
- C:\Windows\System\pCqHbYY.exe
  C:\Windows\System\pCqHbYY.exe
  2⤵
  PID:11296
- C:\Windows\System\AVPjClb.exe
  C:\Windows\System\AVPjClb.exe
  2⤵
  PID:11316
- C:\Windows\System\PEjEpTi.exe
  C:\Windows\System\PEjEpTi.exe
  2⤵
  PID:11336
- C:\Windows\System\yTkwxVK.exe
  C:\Windows\System\yTkwxVK.exe
  2⤵
  PID:11360
- C:\Windows\System\JlifsUr.exe
  C:\Windows\System\JlifsUr.exe
  2⤵
  PID:11388
- C:\Windows\System\aWEqXLM.exe
  C:\Windows\System\aWEqXLM.exe
  2⤵
  PID:11412
- C:\Windows\System\snHLVeh.exe
  C:\Windows\System\snHLVeh.exe
  2⤵
  PID:11432
- C:\Windows\System\ZYtUwvf.exe
  C:\Windows\System\ZYtUwvf.exe
  2⤵
  PID:11464
- C:\Windows\System\XiUsqjZ.exe
  C:\Windows\System\XiUsqjZ.exe
  2⤵
  PID:11488
- C:\Windows\System\MueGnhy.exe
  C:\Windows\System\MueGnhy.exe
  2⤵
  PID:11512
- C:\Windows\System\rHydvkp.exe
  C:\Windows\System\rHydvkp.exe
  2⤵
  PID:11540
- C:\Windows\System\bWNwAIQ.exe
  C:\Windows\System\bWNwAIQ.exe
  2⤵
  PID:11568
- C:\Windows\System\DjKzMws.exe
  C:\Windows\System\DjKzMws.exe
  2⤵
  PID:11604
- C:\Windows\System\pZPRUJb.exe
  C:\Windows\System\pZPRUJb.exe
  2⤵
  PID:11624
- C:\Windows\System\pIxCUsO.exe
  C:\Windows\System\pIxCUsO.exe
  2⤵
  PID:11652
- C:\Windows\System\zeixxwu.exe
  C:\Windows\System\zeixxwu.exe
  2⤵
  PID:11668
- C:\Windows\System\gYaVorM.exe
  C:\Windows\System\gYaVorM.exe
  2⤵
  PID:11684
- C:\Windows\System\xZyAcJM.exe
  C:\Windows\System\xZyAcJM.exe
  2⤵
  PID:11712
- C:\Windows\System\nziBArY.exe
  C:\Windows\System\nziBArY.exe
  2⤵
  PID:11736
- C:\Windows\System\TGYdjZY.exe
  C:\Windows\System\TGYdjZY.exe
  2⤵
  PID:11756
- C:\Windows\System\oDCFtaa.exe
  C:\Windows\System\oDCFtaa.exe
  2⤵
  PID:11776
- C:\Windows\System\GncamCp.exe
  C:\Windows\System\GncamCp.exe
  2⤵
  PID:11796
- C:\Windows\System\jwzMltN.exe
  C:\Windows\System\jwzMltN.exe
  2⤵
  PID:11968
- C:\Windows\System\JFerECO.exe
  C:\Windows\System\JFerECO.exe
  2⤵
  PID:11984
- C:\Windows\System\GQfGCdZ.exe
  C:\Windows\System\GQfGCdZ.exe
  2⤵
  PID:12012
- C:\Windows\System\ICDxCRu.exe
  C:\Windows\System\ICDxCRu.exe
  2⤵
  PID:12032
- C:\Windows\System\tNReyaJ.exe
  C:\Windows\System\tNReyaJ.exe
  2⤵
  PID:12056
- C:\Windows\System\Bypdrzz.exe
  C:\Windows\System\Bypdrzz.exe
  2⤵
  PID:12076
- C:\Windows\System\wFpncew.exe
  C:\Windows\System\wFpncew.exe
  2⤵
  PID:12108
- C:\Windows\System\vXoTAFu.exe
  C:\Windows\System\vXoTAFu.exe
  2⤵
  PID:12128
- C:\Windows\System\gVdkaOC.exe
  C:\Windows\System\gVdkaOC.exe
  2⤵
  PID:12156
- C:\Windows\System\dxfDWdi.exe
  C:\Windows\System\dxfDWdi.exe
  2⤵
  PID:12188
- C:\Windows\System\QOIzBAC.exe
  C:\Windows\System\QOIzBAC.exe
  2⤵
  PID:12220
- C:\Windows\System\mpDjIZX.exe
  C:\Windows\System\mpDjIZX.exe
  2⤵
  PID:12244
- C:\Windows\System\AjLekFu.exe
  C:\Windows\System\AjLekFu.exe
  2⤵
  PID:12280
- C:\Windows\System\soBRsHh.exe
  C:\Windows\System\soBRsHh.exe
  2⤵
  PID:10272
- C:\Windows\System\SjfHhBc.exe
  C:\Windows\System\SjfHhBc.exe
  2⤵
  PID:10716
- C:\Windows\System\hFLnoSj.exe
  C:\Windows\System\hFLnoSj.exe
  2⤵
  PID:10832
- C:\Windows\System\MGTuFpu.exe
  C:\Windows\System\MGTuFpu.exe
  2⤵
  PID:10900
- C:\Windows\System\pnEVsae.exe
  C:\Windows\System\pnEVsae.exe
  2⤵
  PID:10792
- C:\Windows\System\NxYGtIr.exe
  C:\Windows\System\NxYGtIr.exe
  2⤵
  PID:11116
- C:\Windows\System\GDLrVUT.exe
  C:\Windows\System\GDLrVUT.exe
  2⤵
  PID:10948
- C:\Windows\System\UbhQvhb.exe
  C:\Windows\System\UbhQvhb.exe
  2⤵
  PID:9860
- C:\Windows\System\atDxDHs.exe
  C:\Windows\System\atDxDHs.exe
  2⤵
  PID:9456
- C:\Windows\System\JuIuyve.exe
  C:\Windows\System\JuIuyve.exe
  2⤵
  PID:11324
- C:\Windows\System\dGdZjKL.exe
  C:\Windows\System\dGdZjKL.exe
  2⤵
  PID:9196
- C:\Windows\System\iwHoNpm.exe
  C:\Windows\System\iwHoNpm.exe
  2⤵
  PID:11076
- C:\Windows\System\YyMHUUD.exe
  C:\Windows\System\YyMHUUD.exe
  2⤵
  PID:11152
- C:\Windows\System\ZuuULat.exe
  C:\Windows\System\ZuuULat.exe
  2⤵
  PID:11224
- C:\Windows\System\CHSYdXu.exe
  C:\Windows\System\CHSYdXu.exe
  2⤵
  PID:11640
- C:\Windows\System\tAhrvki.exe
  C:\Windows\System\tAhrvki.exe
  2⤵
  PID:11292
- C:\Windows\System\bEBEXAw.exe
  C:\Windows\System\bEBEXAw.exe
  2⤵
  PID:11772
- C:\Windows\System\fBaidCA.exe
  C:\Windows\System\fBaidCA.exe
  2⤵
  PID:11404
- C:\Windows\System\bhwdXWl.exe
  C:\Windows\System\bhwdXWl.exe
  2⤵
  PID:11480
- C:\Windows\System\HZtGpwx.exe
  C:\Windows\System\HZtGpwx.exe
  2⤵
  PID:9044
- C:\Windows\System\loHyMrR.exe
  C:\Windows\System\loHyMrR.exe
  2⤵
  PID:9752
- C:\Windows\System\gDPbAIg.exe
  C:\Windows\System\gDPbAIg.exe
  2⤵
  PID:11704
- C:\Windows\System\OpZVoIK.exe
  C:\Windows\System\OpZVoIK.exe
  2⤵
  PID:11804
- C:\Windows\System\IJAzDiI.exe
  C:\Windows\System\IJAzDiI.exe
  2⤵
  PID:12020
- C:\Windows\System\WyKLoQV.exe
  C:\Windows\System\WyKLoQV.exe
  2⤵
  PID:11524
- C:\Windows\System\AiGorWf.exe
  C:\Windows\System\AiGorWf.exe
  2⤵
  PID:11584
- C:\Windows\System\kJWnnNM.exe
  C:\Windows\System\kJWnnNM.exe
  2⤵
  PID:11664
- C:\Windows\System\UkceRPs.exe
  C:\Windows\System\UkceRPs.exe
  2⤵
  PID:11720
- C:\Windows\System\FfWtCAu.exe
  C:\Windows\System\FfWtCAu.exe
  2⤵
  PID:12252
- C:\Windows\System\iMcZmwN.exe
  C:\Windows\System\iMcZmwN.exe
  2⤵
  PID:11936
- C:\Windows\System\pEeVDPd.exe
  C:\Windows\System\pEeVDPd.exe
  2⤵
  PID:9972
- C:\Windows\System\gSsAkXf.exe
  C:\Windows\System\gSsAkXf.exe
  2⤵
  PID:11856
- C:\Windows\System\wliTizj.exe
  C:\Windows\System\wliTizj.exe
  2⤵
  PID:10188
- C:\Windows\System\kBCMFaS.exe
  C:\Windows\System\kBCMFaS.exe
  2⤵
  PID:10872
- C:\Windows\System\DBHwVLs.exe
  C:\Windows\System\DBHwVLs.exe
  2⤵
  PID:11676
- C:\Windows\System\ezDnKxr.exe
  C:\Windows\System\ezDnKxr.exe
  2⤵
  PID:11880
- C:\Windows\System\yHRQfDT.exe
  C:\Windows\System\yHRQfDT.exe
  2⤵
  PID:10692
- C:\Windows\System\CzayhYm.exe
  C:\Windows\System\CzayhYm.exe
  2⤵
  PID:12304
- C:\Windows\System\keecmqS.exe
  C:\Windows\System\keecmqS.exe
  2⤵
  PID:12332
- C:\Windows\System\lUpsCct.exe
  C:\Windows\System\lUpsCct.exe
  2⤵
  PID:12364
- C:\Windows\System\iWYxOfg.exe
  C:\Windows\System\iWYxOfg.exe
  2⤵
  PID:12388
- C:\Windows\System\GQDMCpE.exe
  C:\Windows\System\GQDMCpE.exe
  2⤵
  PID:12408
- C:\Windows\System\dlfYJxt.exe
  C:\Windows\System\dlfYJxt.exe
  2⤵
  PID:12436
- C:\Windows\System\rHvGHAf.exe
  C:\Windows\System\rHvGHAf.exe
  2⤵
  PID:12460
- C:\Windows\System\PpyyyXb.exe
  C:\Windows\System\PpyyyXb.exe
  2⤵
  PID:12476
- C:\Windows\System\oaeoTLV.exe
  C:\Windows\System\oaeoTLV.exe
  2⤵
  PID:12492
- C:\Windows\System\mnTHcvf.exe
  C:\Windows\System\mnTHcvf.exe
  2⤵
  PID:12516
- C:\Windows\System\IegXiYC.exe
  C:\Windows\System\IegXiYC.exe
  2⤵
  PID:12540
- C:\Windows\System\uFDftZA.exe
  C:\Windows\System\uFDftZA.exe
  2⤵
  PID:12584
- C:\Windows\System\JBohRzU.exe
  C:\Windows\System\JBohRzU.exe
  2⤵
  PID:12604
- C:\Windows\System\HIFLDkS.exe
  C:\Windows\System\HIFLDkS.exe
  2⤵
  PID:12624
- C:\Windows\System\YmlkEHH.exe
  C:\Windows\System\YmlkEHH.exe
  2⤵
  PID:12652
- C:\Windows\System\PDKbkVI.exe
  C:\Windows\System\PDKbkVI.exe
  2⤵
  PID:12684
- C:\Windows\System\TsVfpac.exe
  C:\Windows\System\TsVfpac.exe
  2⤵
  PID:12712
- C:\Windows\System\uYIWnRq.exe
  C:\Windows\System\uYIWnRq.exe
  2⤵
  PID:12736
- C:\Windows\System\QQyoZle.exe
  C:\Windows\System\QQyoZle.exe
  2⤵
  PID:12760
- C:\Windows\System\ABxtDEb.exe
  C:\Windows\System\ABxtDEb.exe
  2⤵
  PID:12792
- C:\Windows\System\NXWzHOX.exe
  C:\Windows\System\NXWzHOX.exe
  2⤵
  PID:12816
- C:\Windows\System\nQZAfRI.exe
  C:\Windows\System\nQZAfRI.exe
  2⤵
  PID:12840
- C:\Windows\System\mbulolc.exe
  C:\Windows\System\mbulolc.exe
  2⤵
  PID:12860
- C:\Windows\System\LVwZVzi.exe
  C:\Windows\System\LVwZVzi.exe
  2⤵
  PID:12888
- C:\Windows\System\txjRQes.exe
  C:\Windows\System\txjRQes.exe
  2⤵
  PID:13096
- C:\Windows\System\ZIcgZBd.exe
  C:\Windows\System\ZIcgZBd.exe
  2⤵
  PID:13120
- C:\Windows\System\zNqQCNS.exe
  C:\Windows\System\zNqQCNS.exe
  2⤵
  PID:13144
- C:\Windows\System\gOiPonX.exe
  C:\Windows\System\gOiPonX.exe
  2⤵
  PID:13164
- C:\Windows\System\Jhctsrx.exe
  C:\Windows\System\Jhctsrx.exe
  2⤵
  PID:13188
- C:\Windows\System\qVGpWgn.exe
  C:\Windows\System\qVGpWgn.exe
  2⤵
  PID:13220
- C:\Windows\System\ChHrbAK.exe
  C:\Windows\System\ChHrbAK.exe
  2⤵
  PID:13260
- C:\Windows\System\jGezSOl.exe
  C:\Windows\System\jGezSOl.exe
  2⤵
  PID:13280
- C:\Windows\System\KtwijpH.exe
  C:\Windows\System\KtwijpH.exe
  2⤵
  PID:13296
- C:\Windows\System\OZgtqgW.exe
  C:\Windows\System\OZgtqgW.exe
  2⤵
  PID:9820
- C:\Windows\System\qpTLroU.exe
  C:\Windows\System\qpTLroU.exe
  2⤵
  PID:11792
- C:\Windows\System\ZYbDmBa.exe
  C:\Windows\System\ZYbDmBa.exe
  2⤵
  PID:11476
- C:\Windows\System\HUnKDiW.exe
  C:\Windows\System\HUnKDiW.exe
  2⤵
  PID:11708
- C:\Windows\System\HxDXOCg.exe
  C:\Windows\System\HxDXOCg.exe
  2⤵
  PID:11916
- C:\Windows\System\GborEuk.exe
  C:\Windows\System\GborEuk.exe
  2⤵
  PID:12116
- C:\Windows\System\DzoENsl.exe
  C:\Windows\System\DzoENsl.exe
  2⤵
  PID:11228
- C:\Windows\System\ZYqXYAL.exe
  C:\Windows\System\ZYqXYAL.exe
  2⤵
  PID:12772
- C:\Windows\System\hRqRtaF.exe
  C:\Windows\System\hRqRtaF.exe
  2⤵
  PID:12828
- C:\Windows\System\oTCvwaP.exe
  C:\Windows\System\oTCvwaP.exe
  2⤵
  PID:12848
- C:\Windows\System\dAKtgVN.exe
  C:\Windows\System\dAKtgVN.exe
  2⤵
  PID:12896
- C:\Windows\System\NiRjRiQ.exe
  C:\Windows\System\NiRjRiQ.exe
  2⤵
  PID:12548
- C:\Windows\System\ErtyVvn.exe
  C:\Windows\System\ErtyVvn.exe
  2⤵
  PID:12640
- C:\Windows\System\ZWTGRiV.exe
  C:\Windows\System\ZWTGRiV.exe
  2⤵
  PID:11372
- C:\Windows\System\dGGcanq.exe
  C:\Windows\System\dGGcanq.exe
  2⤵
  PID:12724
- C:\Windows\System\qWOPati.exe
  C:\Windows\System\qWOPati.exe
  2⤵
  PID:12320
- C:\Windows\System\ttUOmDd.exe
  C:\Windows\System\ttUOmDd.exe
  2⤵
  PID:12452
- C:\Windows\System\uhZlLnf.exe
  C:\Windows\System\uhZlLnf.exe
  2⤵
  PID:12472
- C:\Windows\System\FDrfKQK.exe
  C:\Windows\System\FDrfKQK.exe
  2⤵
  PID:12524
- C:\Windows\System\oNWutSZ.exe
  C:\Windows\System\oNWutSZ.exe
  2⤵
  PID:13212
- C:\Windows\System\lFZTNyp.exe
  C:\Windows\System\lFZTNyp.exe
  2⤵
  PID:13248
- C:\Windows\System\RKfxjYC.exe
  C:\Windows\System\RKfxjYC.exe
  2⤵
  PID:12780
- C:\Windows\System\KPICJcj.exe
  C:\Windows\System\KPICJcj.exe
  2⤵
  PID:13056
- C:\Windows\System\vsvvxkI.exe
  C:\Windows\System\vsvvxkI.exe
  2⤵
  PID:13084
- C:\Windows\System\HouQHrP.exe
  C:\Windows\System\HouQHrP.exe
  2⤵
  PID:9412
- C:\Windows\System\xcRodzK.exe
  C:\Windows\System\xcRodzK.exe
  2⤵
  PID:12384
- C:\Windows\System\eLiEzTA.exe
  C:\Windows\System\eLiEzTA.exe
  2⤵
  PID:12904
- C:\Windows\System\PddOiXA.exe
  C:\Windows\System\PddOiXA.exe
  2⤵
  PID:7028
- C:\Windows\System\LLtVAMJ.exe
  C:\Windows\System\LLtVAMJ.exe
  2⤵
  PID:13324
- C:\Windows\System\locUOkY.exe
  C:\Windows\System\locUOkY.exe
  2⤵
  PID:13360
- C:\Windows\System\dymEsEA.exe
  C:\Windows\System\dymEsEA.exe
  2⤵
  PID:13396
- C:\Windows\System\Innrpyp.exe
  C:\Windows\System\Innrpyp.exe
  2⤵
  PID:13432
- C:\Windows\System\QDMzgyr.exe
  C:\Windows\System\QDMzgyr.exe
  2⤵
  PID:13488
- C:\Windows\System\Wfbnbdv.exe
  C:\Windows\System\Wfbnbdv.exe
  2⤵
  PID:13504
- C:\Windows\System\CLezMsf.exe
  C:\Windows\System\CLezMsf.exe
  2⤵
  PID:13524
- C:\Windows\System\jWpnXec.exe
  C:\Windows\System\jWpnXec.exe
  2⤵
  PID:13544
- C:\Windows\System\lXOkHRU.exe
  C:\Windows\System\lXOkHRU.exe
  2⤵
  PID:13568
- C:\Windows\System\xJLAKyx.exe
  C:\Windows\System\xJLAKyx.exe
  2⤵
  PID:13584
- C:\Windows\System\VgyulKp.exe
  C:\Windows\System\VgyulKp.exe
  2⤵
  PID:13608
- C:\Windows\System\buWCMMj.exe
  C:\Windows\System\buWCMMj.exe
  2⤵
  PID:13640
- C:\Windows\System\IWiDDbq.exe
  C:\Windows\System\IWiDDbq.exe
  2⤵
  PID:13664
- C:\Windows\System\sIrhBiy.exe
  C:\Windows\System\sIrhBiy.exe
  2⤵
  PID:13704
- C:\Windows\System\jJfKKDZ.exe
  C:\Windows\System\jJfKKDZ.exe
  2⤵
  PID:13720
- C:\Windows\System\oUEnviH.exe
  C:\Windows\System\oUEnviH.exe
  2⤵
  PID:13740
- C:\Windows\System\MDnPpXR.exe
  C:\Windows\System\MDnPpXR.exe
  2⤵
  PID:13756
- C:\Windows\System\zxgBOAY.exe
  C:\Windows\System\zxgBOAY.exe
  2⤵
  PID:13800
- C:\Windows\System\JcbWYlo.exe
  C:\Windows\System\JcbWYlo.exe
  2⤵
  PID:13816
- C:\Windows\System\rKDFqOO.exe
  C:\Windows\System\rKDFqOO.exe
  2⤵
  PID:13832
- C:\Windows\System\mTgRDjP.exe
  C:\Windows\System\mTgRDjP.exe
  2⤵
  PID:13848
- C:\Windows\System\SJAaVQO.exe
  C:\Windows\System\SJAaVQO.exe
  2⤵
  PID:13868
- C:\Windows\System\bYUGXMP.exe
  C:\Windows\System\bYUGXMP.exe
  2⤵
  PID:13892
- C:\Windows\System\wSiXMLa.exe
  C:\Windows\System\wSiXMLa.exe
  2⤵
  PID:13916
- C:\Windows\System\nHTajmp.exe
  C:\Windows\System\nHTajmp.exe
  2⤵
  PID:13944
- C:\Windows\System\NRIXGnH.exe
  C:\Windows\System\NRIXGnH.exe
  2⤵
  PID:13972
- C:\Windows\System\hjpqwac.exe
  C:\Windows\System\hjpqwac.exe
  2⤵
  PID:13992
- C:\Windows\System\lLWrwoE.exe
  C:\Windows\System\lLWrwoE.exe
  2⤵
  PID:14008
- C:\Windows\System\eIkqxuf.exe
  C:\Windows\System\eIkqxuf.exe
  2⤵
  PID:14028
- C:\Windows\System\RqlhxaV.exe
  C:\Windows\System\RqlhxaV.exe
  2⤵
  PID:14056
- C:\Windows\System\FRNzIlU.exe
  C:\Windows\System\FRNzIlU.exe
  2⤵
  PID:14084
- C:\Windows\System\dssESzh.exe
  C:\Windows\System\dssESzh.exe
  2⤵
  PID:14108
- C:\Windows\System\ZQFaObG.exe
  C:\Windows\System\ZQFaObG.exe
  2⤵
  PID:14140
- C:\Windows\System\GsyVNxi.exe
  C:\Windows\System\GsyVNxi.exe
  2⤵
  PID:14164
- C:\Windows\System\cHhYRDR.exe
  C:\Windows\System\cHhYRDR.exe
  2⤵
  PID:14192
- C:\Windows\System\toctGHe.exe
  C:\Windows\System\toctGHe.exe
  2⤵
  PID:14212
- C:\Windows\System\nsPJZTJ.exe
  C:\Windows\System\nsPJZTJ.exe
  2⤵
  PID:14228
- C:\Windows\System\buKRYPX.exe
  C:\Windows\System\buKRYPX.exe
  2⤵
  PID:14248
- C:\Windows\System\mvdSdJg.exe
  C:\Windows\System\mvdSdJg.exe
  2⤵
  PID:14272
- C:\Windows\System\OChrYEa.exe
  C:\Windows\System\OChrYEa.exe
  2⤵
  PID:14304
- C:\Windows\System\AfUgzOz.exe
  C:\Windows\System\AfUgzOz.exe
  2⤵
  PID:14328
- C:\Windows\System\IuYsGZp.exe
  C:\Windows\System\IuYsGZp.exe
  2⤵
  PID:13132
- C:\Windows\System\NTZIkOU.exe
  C:\Windows\System\NTZIkOU.exe
  2⤵
  PID:13116
- C:\Windows\System\kaSFFzn.exe
  C:\Windows\System\kaSFFzn.exe
  2⤵
  PID:10032
- C:\Windows\System\WkUMQDo.exe
  C:\Windows\System\WkUMQDo.exe
  2⤵
  PID:13444
- C:\Windows\System\pgDCZQi.exe
  C:\Windows\System\pgDCZQi.exe
  2⤵
  PID:11012
- C:\Windows\System\goSPVUl.exe
  C:\Windows\System\goSPVUl.exe
  2⤵
  PID:13352
- C:\Windows\System\MTfGpgN.exe
  C:\Windows\System\MTfGpgN.exe
  2⤵
  PID:13408
- C:\Windows\System\IcvWPgA.exe
  C:\Windows\System\IcvWPgA.exe
  2⤵
  PID:13424
- C:\Windows\System\EobsJup.exe
  C:\Windows\System\EobsJup.exe
  2⤵
  PID:12984
- C:\Windows\System\YWNJJPB.exe
  C:\Windows\System\YWNJJPB.exe
  2⤵
  PID:13376
- C:\Windows\System\oUqedGT.exe
  C:\Windows\System\oUqedGT.exe
  2⤵
  PID:13616
- C:\Windows\System\leMOQkk.exe
  C:\Windows\System\leMOQkk.exe
  2⤵
  PID:13656
- C:\Windows\System\DXbqzsQ.exe
  C:\Windows\System\DXbqzsQ.exe
  2⤵
  PID:13692
- C:\Windows\System\JgDlagI.exe
  C:\Windows\System\JgDlagI.exe
  2⤵
  PID:13908
- C:\Windows\System\ZgoaupI.exe
  C:\Windows\System\ZgoaupI.exe
  2⤵
  PID:13540
- C:\Windows\System\GYdRTXg.exe
  C:\Windows\System\GYdRTXg.exe
  2⤵
  PID:14016
- C:\Windows\System\eExCcfl.exe
  C:\Windows\System\eExCcfl.exe
  2⤵
  PID:13888
- C:\Windows\System\TjNHpuy.exe
  C:\Windows\System\TjNHpuy.exe
  2⤵
  PID:13928
- C:\Windows\System\Pnqgxad.exe
  C:\Windows\System\Pnqgxad.exe
  2⤵
  PID:14244
- C:\Windows\System\eAJaraV.exe
  C:\Windows\System\eAJaraV.exe
  2⤵
  PID:14024
- C:\Windows\System\ofukvYX.exe
  C:\Windows\System\ofukvYX.exe
  2⤵
  PID:14044
- C:\Windows\System\GaALOvy.exe
  C:\Windows\System\GaALOvy.exe
  2⤵
  PID:12812
- C:\Windows\System\XXyjWmP.exe
  C:\Windows\System\XXyjWmP.exe
  2⤵
  PID:12380
- C:\Windows\System\CHQXEJx.exe
  C:\Windows\System\CHQXEJx.exe
  2⤵
  PID:14204
- C:\Windows\System\RGYAdJW.exe
  C:\Windows\System\RGYAdJW.exe
  2⤵
  PID:13160
- C:\Windows\System\cbXkNZQ.exe
  C:\Windows\System\cbXkNZQ.exe
  2⤵
  PID:14052
- C:\Windows\System\WNNEnxC.exe
  C:\Windows\System\WNNEnxC.exe
  2⤵
  PID:14364
- C:\Windows\System\BwMAlYQ.exe
  C:\Windows\System\BwMAlYQ.exe
  2⤵
  PID:14388
- C:\Windows\System\LVqhoyD.exe
  C:\Windows\System\LVqhoyD.exe
  2⤵
  PID:14408
- C:\Windows\System\IMBTUAn.exe
  C:\Windows\System\IMBTUAn.exe
  2⤵
  PID:14516
- C:\Windows\System\YYCHmEw.exe
  C:\Windows\System\YYCHmEw.exe
  2⤵
  PID:14536
- C:\Windows\System\opiquRW.exe
  C:\Windows\System\opiquRW.exe
  2⤵
  PID:14564
- C:\Windows\System\tptkAfC.exe
  C:\Windows\System\tptkAfC.exe
  2⤵
  PID:14588
- C:\Windows\System\fBjaoVy.exe
  C:\Windows\System\fBjaoVy.exe
  2⤵
  PID:14612
- C:\Windows\System\GFCwWlE.exe
  C:\Windows\System\GFCwWlE.exe
  2⤵
  PID:14640
- C:\Windows\System\EpvVqSF.exe
  C:\Windows\System\EpvVqSF.exe
  2⤵
  PID:14664
- C:\Windows\System\MhuCJEf.exe
  C:\Windows\System\MhuCJEf.exe
  2⤵
  PID:14692
- C:\Windows\System\YFyzKUl.exe
  C:\Windows\System\YFyzKUl.exe
  2⤵
  PID:14720
- C:\Windows\System\njuztcm.exe
  C:\Windows\System\njuztcm.exe
  2⤵
  PID:14748
- C:\Windows\System\QdBXcKT.exe
  C:\Windows\System\QdBXcKT.exe
  2⤵
  PID:14768
- C:\Windows\System\eRxfbQC.exe
  C:\Windows\System\eRxfbQC.exe
  2⤵
  PID:14792
- C:\Windows\System\eEECexm.exe
  C:\Windows\System\eEECexm.exe
  2⤵
  PID:14824
- C:\Windows\System\qXVSfkK.exe
  C:\Windows\System\qXVSfkK.exe
  2⤵
  PID:14856
- C:\Windows\System\jOeRtMc.exe
  C:\Windows\System\jOeRtMc.exe
  2⤵
  PID:14872
- C:\Windows\System\fMybyjA.exe
  C:\Windows\System\fMybyjA.exe
  2⤵
  PID:14892
- C:\Windows\System\IrlxVrz.exe
  C:\Windows\System\IrlxVrz.exe
  2⤵
  PID:14920
- C:\Windows\System\POPaZsJ.exe
  C:\Windows\System\POPaZsJ.exe
  2⤵
  PID:15184
- C:\Windows\System\NlcikwX.exe
  C:\Windows\System\NlcikwX.exe
  2⤵
  PID:15216
- C:\Windows\System\JTtrOMF.exe
  C:\Windows\System\JTtrOMF.exe
  2⤵
  PID:15244
- C:\Windows\System\JrPXZOQ.exe
  C:\Windows\System\JrPXZOQ.exe
  2⤵
  PID:15264
- C:\Windows\System\YkdANQz.exe
  C:\Windows\System\YkdANQz.exe
  2⤵
  PID:15296
- C:\Windows\System\bpibQTt.exe
  C:\Windows\System\bpibQTt.exe
  2⤵
  PID:15332
- C:\Windows\System\qtozmDB.exe
  C:\Windows\System\qtozmDB.exe
  2⤵
  PID:14100
- C:\Windows\System\XwqQPpm.exe
  C:\Windows\System\XwqQPpm.exe
  2⤵
  PID:11748
- C:\Windows\System\CkKlwdO.exe
  C:\Windows\System\CkKlwdO.exe
  2⤵
  PID:14344
- C:\Windows\System\cNzjSTS.exe
  C:\Windows\System\cNzjSTS.exe
  2⤵
  PID:13772
- C:\Windows\System\zIPVCuh.exe
  C:\Windows\System\zIPVCuh.exe
  2⤵
  PID:13752
- C:\Windows\System\NQYuFRQ.exe
  C:\Windows\System\NQYuFRQ.exe
  2⤵
  PID:13824
- C:\Windows\System\UGcoJKe.exe
  C:\Windows\System\UGcoJKe.exe
  2⤵
  PID:13596
- C:\Windows\System\lzMDYtE.exe
  C:\Windows\System\lzMDYtE.exe
  2⤵
  PID:13952
- C:\Windows\System\ClVDbHw.exe
  C:\Windows\System\ClVDbHw.exe
  2⤵
  PID:13748
- C:\Windows\System\oGNqjcS.exe
  C:\Windows\System\oGNqjcS.exe
  2⤵
  PID:14156
- C:\Windows\System\ZtxSPom.exe
  C:\Windows\System\ZtxSPom.exe
  2⤵
  PID:14260
- C:\Windows\System\Ekiocbf.exe
  C:\Windows\System\Ekiocbf.exe
  2⤵
  PID:14624
- C:\Windows\System\OqVDDUX.exe
  C:\Windows\System\OqVDDUX.exe
  2⤵
  PID:14732
- C:\Windows\System\yJtIoIa.exe
  C:\Windows\System\yJtIoIa.exe
  2⤵
  PID:14348
- C:\Windows\System\CSmjDnQ.exe
  C:\Windows\System\CSmjDnQ.exe
  2⤵
  PID:14420
- C:\Windows\System\MUkphrf.exe
  C:\Windows\System\MUkphrf.exe
  2⤵
  PID:14544
- C:\Windows\System\ukcpomj.exe
  C:\Windows\System\ukcpomj.exe
  2⤵
  PID:8772
- C:\Windows\System\YsAfFXa.exe
  C:\Windows\System\YsAfFXa.exe
  2⤵
  PID:14788
- C:\Windows\System\ZJqaZaJ.exe
  C:\Windows\System\ZJqaZaJ.exe
  2⤵
  PID:14508
- C:\Windows\System\AHxGHSy.exe
  C:\Windows\System\AHxGHSy.exe
  2⤵
  PID:14672
- C:\Windows\System\UievzZo.exe
  C:\Windows\System\UievzZo.exe
  2⤵
  PID:14764
- C:\Windows\System\qhLuxLr.exe
  C:\Windows\System\qhLuxLr.exe
  2⤵
  PID:14820
- C:\Windows\System\dMCdlgK.exe
  C:\Windows\System\dMCdlgK.exe
  2⤵
  PID:14888
- C:\Windows\System\usTrMpL.exe
  C:\Windows\System\usTrMpL.exe
  2⤵
  PID:14972
- C:\Windows\System\ogxbJif.exe
  C:\Windows\System\ogxbJif.exe
  2⤵
  PID:15236
- C:\Windows\System\fSpJCFy.exe
  C:\Windows\System\fSpJCFy.exe
  2⤵
  PID:15312
- C:\Windows\System\bElQDnP.exe
  C:\Windows\System\bElQDnP.exe
  2⤵
  PID:15348
- C:\Windows\System\PdcovFV.exe
  C:\Windows\System\PdcovFV.exe
  2⤵
  PID:15124
- C:\Windows\System\ZvdpgZv.exe
  C:\Windows\System\ZvdpgZv.exe
  2⤵
  PID:14256
- C:\Windows\System\zdnsWsX.exe
  C:\Windows\System\zdnsWsX.exe
  2⤵
  PID:14524
- C:\Windows\System\yJaZDrJ.exe
  C:\Windows\System\yJaZDrJ.exe
  2⤵
  PID:14068
- C:\Windows\System\SxytNEj.exe
  C:\Windows\System\SxytNEj.exe
  2⤵
  PID:14784
- C:\Windows\System\HazLaCu.exe
  C:\Windows\System\HazLaCu.exe
  2⤵
  PID:14700
- C:\Windows\System\aqsnopk.exe
  C:\Windows\System\aqsnopk.exe
  2⤵
  PID:14620
- C:\Windows\System\xgcYRQS.exe
  C:\Windows\System\xgcYRQS.exe
  2⤵
  PID:13884
- C:\Windows\System\ACzXFLb.exe
  C:\Windows\System\ACzXFLb.exe
  2⤵
  PID:15232
- C:\Windows\System\nYKYrMg.exe
  C:\Windows\System\nYKYrMg.exe
  2⤵
  PID:15372
- C:\Windows\System\umsbIHK.exe
  C:\Windows\System\umsbIHK.exe
  2⤵
  PID:15388
- C:\Windows\System\iabFJQm.exe
  C:\Windows\System\iabFJQm.exe
  2⤵
  PID:15408
- C:\Windows\System\wtfyRNh.exe
  C:\Windows\System\wtfyRNh.exe
  2⤵
  PID:15428
- C:\Windows\System\CqRDvcS.exe
  C:\Windows\System\CqRDvcS.exe
  2⤵
  PID:15444
- C:\Windows\System\uuyogKf.exe
  C:\Windows\System\uuyogKf.exe
  2⤵
  PID:15464
- C:\Windows\System\GkplRWg.exe
  C:\Windows\System\GkplRWg.exe
  2⤵
  PID:15628
- C:\Windows\System\KhdlOCW.exe
  C:\Windows\System\KhdlOCW.exe
  2⤵
  PID:15672
- C:\Windows\System\WBixRvg.exe
  C:\Windows\System\WBixRvg.exe
  2⤵
  PID:15708
- C:\Windows\System\nIEmYxV.exe
  C:\Windows\System\nIEmYxV.exe
  2⤵
  PID:15724
- C:\Windows\System\AmKChrv.exe
  C:\Windows\System\AmKChrv.exe
  2⤵
  PID:15740
- C:\Windows\System\IZPQnrw.exe
  C:\Windows\System\IZPQnrw.exe
  2⤵
  PID:15768
- C:\Windows\System\CgNrubv.exe
  C:\Windows\System\CgNrubv.exe
  2⤵
  PID:15804
- C:\Windows\System\nWTqNUS.exe
  C:\Windows\System\nWTqNUS.exe
  2⤵
  PID:15832
- C:\Windows\System\IbbABtk.exe
  C:\Windows\System\IbbABtk.exe
  2⤵
  PID:15852
- C:\Windows\System\TqHrRWK.exe
  C:\Windows\System\TqHrRWK.exe
  2⤵
  PID:15880
- C:\Windows\System\HNNjLKg.exe
  C:\Windows\System\HNNjLKg.exe
  2⤵
  PID:15912
- C:\Windows\System\xmQAdSH.exe
  C:\Windows\System\xmQAdSH.exe
  2⤵
  PID:15932
- C:\Windows\System\IuPKWis.exe
  C:\Windows\System\IuPKWis.exe
  2⤵
  PID:15960
- C:\Windows\System\dGyjrjV.exe
  C:\Windows\System\dGyjrjV.exe
  2⤵
  PID:15980
- C:\Windows\System\DOUUYLk.exe
  C:\Windows\System\DOUUYLk.exe
  2⤵
  PID:15996
- C:\Windows\System\ujoyeAH.exe
  C:\Windows\System\ujoyeAH.exe
  2⤵
  PID:16024
- C:\Windows\System\gneWNDQ.exe
  C:\Windows\System\gneWNDQ.exe
  2⤵
  PID:16056
- C:\Windows\System\LCmbDCH.exe
  C:\Windows\System\LCmbDCH.exe
  2⤵
  PID:16072
- C:\Windows\System\qCEhefs.exe
  C:\Windows\System\qCEhefs.exe
  2⤵
  PID:16112
- C:\Windows\System\EjgDCPz.exe
  C:\Windows\System\EjgDCPz.exe
  2⤵
  PID:16132
- C:\Windows\System\rrcALUT.exe
  C:\Windows\System\rrcALUT.exe
  2⤵
  PID:16152
- C:\Windows\System\OSisaOz.exe
  C:\Windows\System\OSisaOz.exe
  2⤵
  PID:16172
- C:\Windows\System\GDLsPtf.exe
  C:\Windows\System\GDLsPtf.exe
  2⤵
  PID:16188
- C:\Windows\System\qsCbFtM.exe
  C:\Windows\System\qsCbFtM.exe
  2⤵
  PID:16212
- C:\Windows\System\YgSkwnT.exe
  C:\Windows\System\YgSkwnT.exe
  2⤵
  PID:16236
- C:\Windows\System\WdqgsHp.exe
  C:\Windows\System\WdqgsHp.exe
  2⤵
  PID:16264
- C:\Windows\System\RFaSioZ.exe
  C:\Windows\System\RFaSioZ.exe
  2⤵
  PID:16288
- C:\Windows\System\kaDiizp.exe
  C:\Windows\System\kaDiizp.exe
  2⤵
  PID:16312
- C:\Windows\System\bmoHXpx.exe
  C:\Windows\System\bmoHXpx.exe
  2⤵
  PID:16332
- C:\Windows\System\sbEiCpL.exe
  C:\Windows\System\sbEiCpL.exe
  2⤵
  PID:16348
- C:\Windows\System\BLIVWng.exe
  C:\Windows\System\BLIVWng.exe
  2⤵
  PID:16364
- C:\Windows\System\nHcgxaM.exe
  C:\Windows\System\nHcgxaM.exe
  2⤵
  PID:15288
- C:\Windows\System\upbrerq.exe
  C:\Windows\System\upbrerq.exe
  2⤵
  PID:15204
- C:\Windows\System\MzYRXgq.exe
  C:\Windows\System\MzYRXgq.exe
  2⤵
  PID:14928
- C:\Windows\System\RaMLgxp.exe
  C:\Windows\System\RaMLgxp.exe
  2⤵
  PID:15460
- C:\Windows\System\iKuEluu.exe
  C:\Windows\System\iKuEluu.exe
  2⤵
  PID:14576
- C:\Windows\System\bdaFGzc.exe
  C:\Windows\System\bdaFGzc.exe
  2⤵
  PID:15520
- C:\Windows\System\Xhzbqaa.exe
  C:\Windows\System\Xhzbqaa.exe
  2⤵
  PID:15260
- C:\Windows\System\SmlsURO.exe
  C:\Windows\System\SmlsURO.exe
  2⤵
  PID:15420
- C:\Windows\System\uJMsoEP.exe
  C:\Windows\System\uJMsoEP.exe
  2⤵
  PID:15780
- C:\Windows\System\mHwEDlS.exe
  C:\Windows\System\mHwEDlS.exe
  2⤵
  PID:15820
- C:\Windows\System\KdjBgEu.exe
  C:\Windows\System\KdjBgEu.exe
  2⤵
  PID:15524
- C:\Windows\System\CsyklKQ.exe
  C:\Windows\System\CsyklKQ.exe
  2⤵
  PID:15716
- C:\Windows\System\rOivCBa.exe
  C:\Windows\System\rOivCBa.exe
  2⤵
  PID:15736
- C:\Windows\System\ZnGXWTv.exe
  C:\Windows\System\ZnGXWTv.exe
  2⤵
  PID:15584
- C:\Windows\System\JSQqIYa.exe
  C:\Windows\System\JSQqIYa.exe
  2⤵
  PID:15900
- C:\Windows\System\IrHEfgs.exe
  C:\Windows\System\IrHEfgs.exe
  2⤵
  PID:15944
- C:\Windows\System\VchXdaM.exe
  C:\Windows\System\VchXdaM.exe
  2⤵
  PID:16048
- C:\Windows\System\WlPTaQi.exe
  C:\Windows\System\WlPTaQi.exe
  2⤵
  PID:16088
- C:\Windows\System\SFECssJ.exe
  C:\Windows\System\SFECssJ.exe
  2⤵
  PID:16308
- C:\Windows\System\IKnRfii.exe
  C:\Windows\System\IKnRfii.exe
  2⤵
  PID:2928
- C:\Windows\System\ipEZlfX.exe
  C:\Windows\System\ipEZlfX.exe
  2⤵
  PID:15948
- C:\Windows\System\YxxOiqq.exe
  C:\Windows\System\YxxOiqq.exe
  2⤵
  PID:15988
- C:\Windows\System\jDtdHJJ.exe
  C:\Windows\System\jDtdHJJ.exe
  2⤵
  PID:16124
- C:\Windows\System\NrwymME.exe
  C:\Windows\System\NrwymME.exe
  2⤵
  PID:15564
- C:\Windows\System\UWfBqZO.exe
  C:\Windows\System\UWfBqZO.exe
  2⤵
  PID:16328
- C:\Windows\System\knJYDlV.exe
  C:\Windows\System\knJYDlV.exe
  2⤵
  PID:15080
- C:\Windows\System\JkCMfmP.exe
  C:\Windows\System\JkCMfmP.exe
  2⤵
  PID:16064
- C:\Windows\System\VXOXluK.exe
  C:\Windows\System\VXOXluK.exe
  2⤵
  PID:16416
- C:\Windows\System\nUxtvVC.exe
  C:\Windows\System\nUxtvVC.exe
  2⤵
  PID:16440
- C:\Windows\System\OiVJJjH.exe
  C:\Windows\System\OiVJJjH.exe
  2⤵
  PID:16472
- C:\Windows\System\gIbiZYO.exe
  C:\Windows\System\gIbiZYO.exe
  2⤵
  PID:16496
- C:\Windows\System\kBMBnPW.exe
  C:\Windows\System\kBMBnPW.exe
  2⤵
  PID:16520
- C:\Windows\System\iZybTMj.exe
  C:\Windows\System\iZybTMj.exe
  2⤵
  PID:16544
- - C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -u -p 16544 -s 248
    3⤵
    PID:17328
- C:\Windows\System\KUGgQOM.exe
  C:\Windows\System\KUGgQOM.exe
  2⤵
  PID:16564
- C:\Windows\System\CzBzfEk.exe
  C:\Windows\System\CzBzfEk.exe
  2⤵
  PID:16580
- C:\Windows\System\IVcUZRF.exe
  C:\Windows\System\IVcUZRF.exe
  2⤵
  PID:16612
- C:\Windows\System\nfEBSKy.exe
  C:\Windows\System\nfEBSKy.exe
  2⤵
  PID:16636
- C:\Windows\System\sGbEdOY.exe
  C:\Windows\System\sGbEdOY.exe
  2⤵
  PID:16656
- C:\Windows\System\OmUBgvc.exe
  C:\Windows\System\OmUBgvc.exe
  2⤵
  PID:16696
- C:\Windows\System\cyVUFex.exe
  C:\Windows\System\cyVUFex.exe
  2⤵
  PID:16716
- C:\Windows\System\vXeyUuj.exe
  C:\Windows\System\vXeyUuj.exe
  2⤵
  PID:16740
- C:\Windows\System\yQRnFsb.exe
  C:\Windows\System\yQRnFsb.exe
  2⤵
  PID:16764
- C:\Windows\System\RRRmmPr.exe
  C:\Windows\System\RRRmmPr.exe
  2⤵
  PID:16780
- C:\Windows\System\lmGNWfa.exe
  C:\Windows\System\lmGNWfa.exe
  2⤵
  PID:16804
- C:\Windows\System\snljJoh.exe
  C:\Windows\System\snljJoh.exe
  2⤵
  PID:16824
- C:\Windows\System\yRZrWhU.exe
  C:\Windows\System\yRZrWhU.exe
  2⤵
  PID:16852
- C:\Windows\System\MLoiVZi.exe
  C:\Windows\System\MLoiVZi.exe
  2⤵
  PID:16876
- C:\Windows\System\CXyQPwW.exe
  C:\Windows\System\CXyQPwW.exe
  2⤵
  PID:16896
- C:\Windows\System\BUpQfAD.exe
  C:\Windows\System\BUpQfAD.exe
  2⤵
  PID:16916
- C:\Windows\System\uUIcvNf.exe
  C:\Windows\System\uUIcvNf.exe
  2⤵
  PID:16936
- C:\Windows\System\HZoruZm.exe
  C:\Windows\System\HZoruZm.exe
  2⤵
  PID:16952
- C:\Windows\System\IaxcpJr.exe
  C:\Windows\System\IaxcpJr.exe
  2⤵
  PID:16984
- C:\Windows\System\jFioJUj.exe
  C:\Windows\System\jFioJUj.exe
  2⤵
  PID:17000
- C:\Windows\System\AFgNzUe.exe
  C:\Windows\System\AFgNzUe.exe
  2⤵
  PID:17036
- C:\Windows\System\tSNIDDh.exe
  C:\Windows\System\tSNIDDh.exe
  2⤵
  PID:17368
- C:\Windows\System\vfwEEAl.exe
  C:\Windows\System\vfwEEAl.exe
  2⤵
  PID:15484
- C:\Windows\System\fTEUoZm.exe
  C:\Windows\System\fTEUoZm.exe
  2⤵
  PID:15840
- C:\Windows\System\OdtEyhR.exe
  C:\Windows\System\OdtEyhR.exe
  2⤵
  PID:15800
- C:\Windows\System\odthZGC.exe
  C:\Windows\System\odthZGC.exe
  2⤵
  PID:16536
- C:\Windows\System\RkrJYXU.exe
  C:\Windows\System\RkrJYXU.exe
  2⤵
  PID:16644

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:16628

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\CRZNPjq.exe

Filesize
1.1MB

MD5
c9e54cd07064dd51c155b7ff6fc8b88a

SHA1
8086bc1164449d785ba316d1cc74173abde86701

SHA256
24af9d01fc8dcf1f4b16912b57db904eb00b5c490dc46022f23b00fce320b120

SHA512
76a3a66fd0faec094964a19119902318d1e8bb7e6afb26442680228f4bb999d8d67ffafe493124e4b8baca702481fe77c6839af5426baccda716bfbd012a017a

Download Submit
C:\Windows\System\CRxEgLW.exe

Filesize
1.1MB

MD5
c79875b8ae4052b72dd19d801f21bf1c

SHA1
9fd240e7b5720243119592c7273e4aa0d5c7a7cb

SHA256
9464f714020865970faa7400495b14d82840c3d6cb575c0b088ec97dece792e1

SHA512
2f20b6b8c405cf4b55adcbd1129d2858fb29e2367ad3d55300306f52dad03fa5ea0c75775b64d011ad124b6589eab99d86e087f0a66c36fba88527d07f054f3f

Download Submit
C:\Windows\System\DnamoNK.exe

Filesize
1.1MB

MD5
31eb382c8ff4068c58e2ad6cda337482

SHA1
c367fece7474943b0296e9b203a380e590a303c6

SHA256
835bac1a8d1687e2c087c2eb3eb0abcf70a2fc13e65298106d7566130cb41345

SHA512
905b41f981d11c2de9fe016f415f77faaf8d857e1edc9ce9554de0ba13f7c252d7e8d128060ee3cb908c92126222b231aa8ebce13c000adc8a09fc5a776473c8

Download Submit
C:\Windows\System\GkLvWRh.exe

Filesize
1.1MB

MD5
c8c60e37e33e84a548c2b8e5124cb3af

SHA1
aef46cf2fd9e14f4d1997b904a9f5e068296497a

SHA256
3dfd94483a850f6e2bf5fe32a9eb36cf43619e050b205430c67ee3236eea28c4

SHA512
a3f0d109a66940cd63d6d748a5b548c2557b58864a2d098062cf20922bfb170c74285117bda64d567f515a31f524973357b30cbe366612c74c90490fbea677a2

Download Submit
C:\Windows\System\HGnkesS.exe

Filesize
1.1MB

MD5
d03029679083a7c81bfb8d7651ea2719

SHA1
4eb3344f683a87af5bdbda98c84fe1caeb909fef

SHA256
66d2971285ad4cf7e31a26be0cd9dfddf9606acf2287e8bf49d57c619df325ab

SHA512
ed1002661c8cd0b105e53a9dd0be253f125bef33192f64dc7a6510e8402e4decac19c7e6e8f2bfcfab6469c2089486e5f9f5965e9412153e56e531eaf2610fad

Download Submit
C:\Windows\System\IEnbTor.exe

Filesize
1.1MB

MD5
32d3664fc93d8578bd971d96571d873d

SHA1
56afb52b3cf4266ed66d129892c0d0f8528d1834

SHA256
e090454fdd61aaff2d0eefa58db4640e4c7d84f428cf8babc287e6cc94e13b85

SHA512
66127d34daf67ce9b2bc6ee1b981f694229f70d5e0bc95b97dd147fd5a37c5fc33b20d8fada66b70e627f25cfe60acf2ea634380b1857692b880002e0fbc4f16

Download Submit
C:\Windows\System\KFjKcqB.exe

Filesize
1.1MB

MD5
f47699e9bc1b1f652b0ec7a14b9b7610

SHA1
003406d3d8c3c2068e11ea1b677bb8858c94e07f

SHA256
623f200b1f4d028aa597056346abac038b4f378cb7377e1f5e8e97ea78e408f6

SHA512
c13e3a38320fb25aa8c23657d3e67dd9e642abc6e60b67d265b61c32829e28dfc6873191d1c744ae75c946a502dd978ea50948da51a3608e81f30c9af2239454

Download Submit
C:\Windows\System\NGwkDWd.exe

Filesize
1.1MB

MD5
24547a5ec89dffca5595baaafd98a2ac

SHA1
b6e41aa4559e626a830df060e322d4bff07b7872

SHA256
41bb3bed51341267b631681f6a7b163328859ba1db322ad51f3ed97f3b06a86c

SHA512
a224f2994908ad50fc73782b6093d9d5ef1709fd81df6e2f6df8d1e224657abf9275f45b6b726344dd555fe740097a9a099161e9e40da2f067d9e6545c5f96f8

Download Submit
C:\Windows\System\NgPjRWx.exe

Filesize
1.1MB

MD5
b30b1a884e8f14f3889ccfbc797d2505

SHA1
366db0a57d01feecae025401c5eb3b03ffa78619

SHA256
f8357a443e8181573375932348c00dfaf5cd489961afb643392e50d78fe286d1

SHA512
53c0bb9f7719e59837eab7b7bcdcf8cfbde81cd2cc23c178d017555edc933aa395b443de9038e21f720b45e7702b1d50a361db77cb0b3fdb3d60c636de4d9901

Download Submit
C:\Windows\System\OUnTTpU.exe

Filesize
1.1MB

MD5
2dd6f61535f4d2294b701bd09fa766ea

SHA1
1745f417f3216d1ad046516460701dbe2da6dd85

SHA256
61792da9e0e622edd7b6d73321ce07cbc8cce93dffddbc9d006786042ca91eed

SHA512
ce993c9a5075d89756099efc854bd79687bed6a74de3c5ab65299fb5c1c3a664f5514952555b94c7f63f19d934331cd5cd3a33c66d5ed21bb2739253a4a17479

Download Submit
C:\Windows\System\OqRXESW.exe

Filesize
1.1MB

MD5
014c7d9e21aeae8f0f9c3006f0a640bd

SHA1
e66a26faffa45fdaa87150f20954fd7f6ffdad90

SHA256
dd536ba45423e8402e6aab01fb8ed0d217d0e4070c23bd6b3bde621dc4b9b8b7

SHA512
590482716808c3ce05b0850cbff8afd44185e2040affb77d759a636e17e1d53fbcb679801115d2c9762111a8c13e2f705470ef2ba6569a552ab8cbf30e8b4926

Download Submit
C:\Windows\System\RNLsxDs.exe

Filesize
1.1MB

MD5
b554c94b6682b923e3571594bdde8c24

SHA1
dfa01cac5e93a63874a8eaa39f85fc8436ed2929

SHA256
8ed98ff9f1dc2c9422932f4365341cdd61c8ec72767f0571bec91b73e5efc5ad

SHA512
9eea0cb3fbd55aa747e26617127982aace74f4c9b97352c58abf8e1019f7dc3535418972dffac08961310e6a542dcd4dfc5231d4d741da05ec3d187e26a77e0b

Download Submit
C:\Windows\System\XZLUJOz.exe

Filesize
1.1MB

MD5
371417ee5601be0b1a15cde560ce25ce

SHA1
7af91fd45e6be034b0c16ae55c58c92b59214215

SHA256
0b670cceeaaf353cdeb359d085f2ee213184c2662eb573526ffbe10df1436655

SHA512
8f08d2693e4755d152da61903712461827979c0bb7a4007ea5f2563a6385a35e020d65bf2f77eb8c5ab7980241a1b486ee9ca72a134c48eed2af2dc23052f998

Download Submit
C:\Windows\System\XtoBHKp.exe

Filesize
1.1MB

MD5
55879ee063276014afd8fb97b182911f

SHA1
6001ad577c09a2bd055f877ca00800095e235590

SHA256
a12ab932ea4eb1b096bc5b77d34f9712b8ef0614305e2435b12055f632f31bfc

SHA512
1a84f5150f4fbef2043bf06aadc3896d91c84c83f31048842d6123912242dd864be89809ebcafb7758f5876f1d7c8fa950d7e986a15e45cca5efb7725aeab713

Download Submit
C:\Windows\System\ZKiQSSn.exe

Filesize
1.1MB

MD5
a0ea6fb469587400845f25255e826d37

SHA1
f5c203ad40fce32c46a874aefaf049a2277c932d

SHA256
2375237fad12baa471246fdc4480ab113b3cec52fed2c45b44079b4150b25e26

SHA512
d4979aa6a540c4fb4e02e9496e8b4092be8e2dae861edc3af2b5695b8948af746cf44ec53d6176ee0903c7fc6045b50467167ed3e7bf590034df584a6a238e0e

Download Submit
C:\Windows\System\dyxgzMq.exe

Filesize
1.1MB

MD5
534506e0791d6c7fae4c392ae502167f

SHA1
db148431188592099f6d2c2739fd942f17683b1a

SHA256
c9763465957fa80f9b3a575435c299283227c413973f17989df69bacc827f5b4

SHA512
947ae1ae02e4d27449e609fd12af08cd81466347e2f93f968174e1fe1d48b34653cc1268edc6c499b28838e619ca72b6f4f35dd57ed57823917b0e72b0e25ccc

Download Submit
C:\Windows\System\fARQrWL.exe

Filesize
1.1MB

MD5
5bf0e105b2a4190114712722fe2f361e

SHA1
1f8a91572a0ed4d5ad2830df2423d9a4266e66c5

SHA256
f9f6d88499a62dbdde5e1e924f33994a629751a5fbf7e3d878996c505260918f

SHA512
04849f375ce9e5b5ed3c376ba4f96002f055b84a2013efeea483206241e5a307e4de45e98e0ccf5b41ec1097f172777249621068c181cc7ceba13e2d5be66a48

Download Submit
C:\Windows\System\fFoQgXP.exe

Filesize
1.1MB

MD5
b24342719b0fdc52b0aaa20d41e90263

SHA1
29218769372e3b99db3e4022e29465837eee02c0

SHA256
d37c2244a4bb807ff983f6a1e8903b12bfcf08df967533c3f34f8bb77c946f5b

SHA512
69332e513af3d8549cfc6941ea740f87b520b1081fca6c3a6861ca0e4dafc8a78e2b6e398a3170acf2843e4823f939d0480bb557de18958bf8502a09e4701105

Download Submit
C:\Windows\System\fJJtPvK.exe

Filesize
1.1MB

MD5
8360f3c08b3ba89c6ad89f1dcbed809b

SHA1
7947951ba3946e7a9b1e94d27879d83fd43fb098

SHA256
fbe485ac9378ef012c6497c6aa12e728bcba7f294b0bc5503f87c533ada71682

SHA512
5fa91a4d5a69504e15a59fe506ea2b0dfeb254a79f46c26c893a648fa7e4376180d231806b57d9d1f8f25198ef44ccb59ad56bd0438fb66d3b60c7d1e74fa189

Download Submit
C:\Windows\System\heeFsDt.exe

Filesize
1.1MB

MD5
82ace47a0e8037bed4dbe7a64c4f9735

SHA1
542d347584985a1438b6a7ca72d1c8a993b697df

SHA256
fcf3eee224676b853d5e7e3a8877e4c468b94a69359bbe1c9c6fed6deca4644b

SHA512
f49d48a44c7a822ab381d065eb2a092f6668f3432cdfb3756eb57ba011074149195ff3903dae39532b0cdf6b4c29ebc43e0a9ba22a4d789dedff0e60e5a86d4d

Download Submit
C:\Windows\System\hrDHNtB.exe

Filesize
1.1MB

MD5
c26a8ca1de749ce19312d775dd8af22c

SHA1
e3f1f7b7d874a539e0b184a2ce9117859db30f96

SHA256
6332bce49ba98a96299d9e90674484173f9efc3c95d780baab5674f479c016ef

SHA512
9557ee930c715834cdc7eb288b23e813227111f96daa6fce053ee1dcdc29d48215634da1617bf202c237799a20c63837b1eebab7f0dd1d61eb7d527e4e7b0466

Download Submit
C:\Windows\System\jNNNfNM.exe

Filesize
1.1MB

MD5
8a568b47107a46e684edee660c7aa2a3

SHA1
9d15d387da0340011127bd02626740a97f79035a

SHA256
5cf4b6354c86df8cdc3ff944b56bad31ffb0940b84788ad0427ee1a6e708c339

SHA512
bc62a1c4efd3316cfc9982e3234d31aa16c1860fcfdb90ac9406743110c429c36d6ac0dfd8bc134b0d4fc9a242227aea8e51239053b35004a55a9d1a6ce20a09

Download Submit
C:\Windows\System\jbbeovI.exe

Filesize
1.1MB

MD5
83f1bc230498e1f81e42198fb0861dad

SHA1
804dcec3f9a22fb198ed000bf16c56f7c4d5b893

SHA256
8606bc64ef4d5705301ab6bbb40aa1f7dd0d7ac331cf185a66c0142a2d43bbf5

SHA512
313e7ad686b7cef61ceb8c72c587f9480a50e282575c1c81b450ee60ec110eb5774cb5435f36b285a35134934f2dc0c4cfe5cc24cd88423205c154fe207d359e

Download Submit
C:\Windows\System\kpUEzKz.exe

Filesize
1.1MB

MD5
8d9c6849f46add09b34bc1cbe335af52

SHA1
5c6885423416a140d3b2ee0f79943e5ea6e8ca68

SHA256
ad9dade67ce2aa88c0279428854eb8523ed3c94f3413a7d82af3dc26f02e8a2e

SHA512
9a7d8dffff3c46955ede02bcac0773d35d7fa7c04d5f2306805f5f2e2f0a9d6cc6735ba73d0c2b72412320575d3361462e54bb5027cf5ad75a958b6c90aae729

Download Submit
C:\Windows\System\lUCGsaf.exe

Filesize
1.1MB

MD5
724607b9015e032577e6a0fcc2e936b1

SHA1
0157fccd31e9fc948f0ce559492d4811036e773d

SHA256
516d9077fc71a3c6a34e386364865319ddc2e362aee420b9b820e9d8fb02f1b7

SHA512
a7240c3b693a5e0a5a75dd0292a7c9c315276c73e546308715422326380528f62aae0979d764a5cf8dd36567ef93d703498fcd758537e966ada75ebc6617352d

Download Submit
C:\Windows\System\mljgXek.exe

Filesize
1.1MB

MD5
3e0e0aad635b1565486c5d6501e2af36

SHA1
0626daf1b60145aca280261cdf557dc85c379cbb

SHA256
ea2719c1d80f22e541432af5027aec2d065d9f55c340a28bcfc5323ec0ad67ca

SHA512
b7f119f14a416825fbc533058fc511d245adffd0d0a520d51fadcbba8e81747639b691179a980be410f4bf1f3b87538360be8d1e1190875921f06f3acea15ade

Download Submit
C:\Windows\System\nEmjpHy.exe

Filesize
1.1MB

MD5
ee9cc6dbae420188f5ee55430be489d8

SHA1
905268f50cc51c37a97bdf305d28cf723fd99aa9

SHA256
83122f624096ff9c8507603fc11b23cfdb9f5f2bcb89bb5664e215c3db8abb2b

SHA512
d59127aa51f7e620792d1978a278384defb8191643cd235953d2d75790630b6fbe44c0c53a328880b4d11fc237c20773b7185ef6efdab19e11e048012021b78d

Download Submit
C:\Windows\System\sefBNBy.exe

Filesize
1.1MB

MD5
5aaec2546a229c94190df3846ccf1350

SHA1
26487a9501e7be86a578863c197d6fc7a9d63675

SHA256
36d70aebab9dee74022a47a887a8657d94d291511935232b3fdfb5016ae24279

SHA512
cd8f46a3c3bbd5d32f797f72b2f45f40ec00dfab2c5e04a293885bbe6559d9b2b6e4830020d16a3eb5b27dd458de9af10e462a6727e30a834477bde06c063c4f

Download Submit
C:\Windows\System\uPnUejk.exe

Filesize
1.1MB

MD5
a6facc82b80705ba1f5397ae2d1c1f10

SHA1
812faae330f43767601f05523d025ae98afa3972

SHA256
12b1665cd077f5db62d5731ad023ba1c48c412441ccc82308cdecde02569bf7d

SHA512
0111aad106dc1b0c092bf05e1d42a6bb21bee2dcbb088e6e0814eccb72120d6fcf9ae683a6cab06f52351036ad7a9ee653fc2a4035b5e3b8a40485500f1fe044

Download Submit
C:\Windows\System\usilndj.exe

Filesize
1.1MB

MD5
9a58192c72347f9bb9e6725a604411af

SHA1
967922a4c7ee9a0c73e8e5176c5bb6867648231f

SHA256
aeadd16668a532da0286558792680d35651c1ffbe12548c08e38d0e29a14df95

SHA512
a160cf1f817e94c273bdce846ac57d2e2f6d2a56d9b2c1ce14fdb0be8ecbbd4a292ac7c191782b1a1f4252d863fb24b98b9fc80bab914472506b744c5033e13b

Download Submit
C:\Windows\System\vNHSvCd.exe

Filesize
1.1MB

MD5
bdc5890fe1ff32989b71dbc9af2449a0

SHA1
82b624d570b47184ab978a397a223ff33ea1afb9

SHA256
091e430ed36dd4f7468eabf7a35fcc689a22d19e542164edfebea1a1296a597c

SHA512
9eab246868d0712e1d43099d42f3a4e8405acc92c1b9e8949bc5c8a90679ca04b30a3c8fdaf65975d05f26fa522f8d727405c29487d85c6328da61d6ac4eb42f

Download Submit
C:\Windows\System\wgCiLIE.exe

Filesize
1.1MB

MD5
44b300375b42f87a00be4f679c4259ed

SHA1
a7499a60eed771bc6c2bda34536bae0a1582cbb1

SHA256
b9afbcc40ac6a4d2fec1a17396e6b81384bd8180bc71e0859b679bb5aba8bf10

SHA512
de4fddf9fe69050970e06a0d7da91584594102c645b3027c6dc617d5b36ff8085d47414c74d7e5a60f36c9dfb1cfde265a805e61eca477d0c1909e95bd7ccaef

Download Submit
C:\Windows\System\wuSqxuD.exe

Filesize
1.1MB

MD5
2a3b07819616527786c839dcae459009

SHA1
e73a76094f345f7537b2ecb96e05e8644f1d5c04

SHA256
8e1a6ad4ba35df47820f6a7f10e5185f6398af021daf8f965b4b6401730b0f37

SHA512
02a9ea748e8a4e685fd4d17bcc47800f4b8685807e7305aab936b2f2097a1cda6cddbc30167c0b8b43de5f24dcfc10fb511e1df472992b5f745d4ccaf30ca585

Download Submit
memory/1216-0-0x000001F822E20000-0x000001F822E30000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads