xmrig | ce34ef5222ce404bbdd70f1fd29dcb7102c5c43f7c24ee3bb1d2e55a6a842f5f

Analysis

max time kernel
130s
max time network
130s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
17-11-2024 09:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ce34ef5222ce404bbdd70f1fd29dcb7102c5c43f7c24ee3bb1d2e55a6a842f5f.exe
Size

1.4MB
MD5

aa0efdf17ffe2044041a857e7aaf9083
SHA1

6fb45591e7f085368ead6e2459b292bbcfea3514
SHA256

ce34ef5222ce404bbdd70f1fd29dcb7102c5c43f7c24ee3bb1d2e55a6a842f5f
SHA512

32909c68a4c77653eac4c4c1e9a7b3699538a36ea9c4e847a81d022811b6a952a3d953294fda7dd62f4c3bbfe411653ed84a605e3663ce41ff9eae9c0921cf34
SSDEEP

24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbpwlKenszbWKDNEm/5O+7MMKTbcc:GezaTF8FcNkNdfE0pZ9ozttwIRxj4c5S

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 33 IoCs

miner

resource	yara_rule
behavioral2/files/0x000c000000023b42-4.dat	xmrig
behavioral2/files/0x000a000000023b89-7.dat	xmrig
behavioral2/files/0x000c000000023b84-9.dat	xmrig
behavioral2/files/0x000a000000023b8a-20.dat	xmrig
behavioral2/files/0x000a000000023b8b-24.dat	xmrig
behavioral2/files/0x000a000000023b8e-37.dat	xmrig
behavioral2/files/0x000a000000023b90-47.dat	xmrig
behavioral2/files/0x000a000000023b91-52.dat	xmrig
behavioral2/files/0x000a000000023b93-70.dat	xmrig
behavioral2/files/0x000a000000023b97-82.dat	xmrig
behavioral2/files/0x000a000000023b9a-105.dat	xmrig
behavioral2/files/0x000a000000023b9f-130.dat	xmrig
behavioral2/files/0x000a000000023ba7-162.dat	xmrig
behavioral2/files/0x000a000000023ba5-160.dat	xmrig
behavioral2/files/0x000a000000023ba6-157.dat	xmrig
behavioral2/files/0x000a000000023ba4-155.dat	xmrig
behavioral2/files/0x000a000000023ba3-150.dat	xmrig
behavioral2/files/0x000a000000023ba2-145.dat	xmrig
behavioral2/files/0x000a000000023ba1-140.dat	xmrig
behavioral2/files/0x000a000000023ba0-135.dat	xmrig
behavioral2/files/0x000a000000023b9e-125.dat	xmrig
behavioral2/files/0x000a000000023b9d-120.dat	xmrig
behavioral2/files/0x000a000000023b9c-115.dat	xmrig
behavioral2/files/0x000a000000023b9b-110.dat	xmrig
behavioral2/files/0x000a000000023b99-100.dat	xmrig
behavioral2/files/0x000a000000023b98-95.dat	xmrig
behavioral2/files/0x000a000000023b96-85.dat	xmrig
behavioral2/files/0x000a000000023b95-80.dat	xmrig
behavioral2/files/0x000a000000023b94-75.dat	xmrig
behavioral2/files/0x000a000000023b92-65.dat	xmrig
behavioral2/files/0x000a000000023b8f-50.dat	xmrig
behavioral2/files/0x000a000000023b8d-38.dat	xmrig
behavioral2/files/0x000a000000023b8c-32.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
912	jvZHTSB.exe
756	IvsRAgB.exe
1396	rKrXfBG.exe
2980	oRmggUi.exe
3500	SWiqhRi.exe
1932	vzdvVul.exe
2132	pxDWdcr.exe
3704	CvNpTZH.exe
628	FFXPCAb.exe
4904	AcsAKhB.exe
1080	WLxNwFW.exe
4960	ovQGEux.exe
1892	QESaonk.exe
2984	GPEmVEE.exe
2788	VhgTAYL.exe
4992	DgArdIY.exe
2952	jssraSK.exe
2028	VPoBvvF.exe
2668	KHnZaMC.exe
4944	rraueFK.exe
4844	avtyHIg.exe
2644	qILFTrt.exe
944	pEIcJuD.exe
1048	qoGTsNC.exe
4580	BtabctV.exe
3180	YVyuFXR.exe
2348	IWIwdfR.exe
4748	JTfRlRM.exe
1380	UynNQPT.exe
4764	hODNSDb.exe
1900	cyeHeTx.exe
4852	zvzisiq.exe
4352	IuhAORl.exe
1596	jqHFqgn.exe
1152	SmNOYtM.exe
2944	ilCUIgv.exe
4768	HADzUlq.exe
380	uKtwGNj.exe
3668	QzJgATV.exe
3684	qkvwXnV.exe
1344	ouSzVlZ.exe
3424	ApunCNv.exe
2592	wxTZZBV.exe
3408	vMkfzcL.exe
456	jplVFXB.exe
1472	iaqbKak.exe
3396	sqYVerF.exe
1776	DbeoTSA.exe
2304	GfCMQSw.exe
3964	oTSDnEA.exe
340	tJZfdOr.exe
4424	BwWIOfu.exe
3536	nYTzLmC.exe
3832	UUNWoSZ.exe
4736	IkxdkED.exe
3516	FJKMdwS.exe
1092	RjGktPY.exe
2844	ynoNxJH.exe
1336	IRaKCMl.exe
1936	FRQSSxi.exe
4344	HskHLoo.exe
2392	dzIIjwF.exe
1132	qDMxcei.exe
2216	KonTifv.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\BjdFfsH.exe	ce34ef5222ce404bbdd70f1fd29dcb7102c5c43f7c24ee3bb1d2e55a6a842f5f.exe
File created	C:\Windows\System\iovkrjn.exe	ce34ef5222ce404bbdd70f1fd29dcb7102c5c43f7c24ee3bb1d2e55a6a842f5f.exe
File created	C:\Windows\System\LaENxdi.exe	ce34ef5222ce404bbdd70f1fd29dcb7102c5c43f7c24ee3bb1d2e55a6a842f5f.exe
File created	C:\Windows\System\Tnyrgdm.exe	ce34ef5222ce404bbdd70f1fd29dcb7102c5c43f7c24ee3bb1d2e55a6a842f5f.exe
File created	C:\Windows\System\gknrUuf.exe	ce34ef5222ce404bbdd70f1fd29dcb7102c5c43f7c24ee3bb1d2e55a6a842f5f.exe
File created	C:\Windows\System\AhqGbIP.exe	ce34ef5222ce404bbdd70f1fd29dcb7102c5c43f7c24ee3bb1d2e55a6a842f5f.exe
File created	C:\Windows\System\wYdFyGq.exe	ce34ef5222ce404bbdd70f1fd29dcb7102c5c43f7c24ee3bb1d2e55a6a842f5f.exe
File created	C:\Windows\System\MWajoTf.exe	ce34ef5222ce404bbdd70f1fd29dcb7102c5c43f7c24ee3bb1d2e55a6a842f5f.exe
File created	C:\Windows\System\sHmODPc.exe	ce34ef5222ce404bbdd70f1fd29dcb7102c5c43f7c24ee3bb1d2e55a6a842f5f.exe
File created	C:\Windows\System\lRnnTJE.exe	ce34ef5222ce404bbdd70f1fd29dcb7102c5c43f7c24ee3bb1d2e55a6a842f5f.exe
File created	C:\Windows\System\dMnwbQN.exe	ce34ef5222ce404bbdd70f1fd29dcb7102c5c43f7c24ee3bb1d2e55a6a842f5f.exe
File created	C:\Windows\System\qNGmGIO.exe	ce34ef5222ce404bbdd70f1fd29dcb7102c5c43f7c24ee3bb1d2e55a6a842f5f.exe
File created	C:\Windows\System\amtmLYP.exe	ce34ef5222ce404bbdd70f1fd29dcb7102c5c43f7c24ee3bb1d2e55a6a842f5f.exe
File created	C:\Windows\System\RLyBJIr.exe	ce34ef5222ce404bbdd70f1fd29dcb7102c5c43f7c24ee3bb1d2e55a6a842f5f.exe
File created	C:\Windows\System\wdDPFhK.exe	ce34ef5222ce404bbdd70f1fd29dcb7102c5c43f7c24ee3bb1d2e55a6a842f5f.exe
File created	C:\Windows\System\atmxrlN.exe	ce34ef5222ce404bbdd70f1fd29dcb7102c5c43f7c24ee3bb1d2e55a6a842f5f.exe
File created	C:\Windows\System\aBZCNvn.exe	ce34ef5222ce404bbdd70f1fd29dcb7102c5c43f7c24ee3bb1d2e55a6a842f5f.exe
File created	C:\Windows\System\Sfajmvt.exe	ce34ef5222ce404bbdd70f1fd29dcb7102c5c43f7c24ee3bb1d2e55a6a842f5f.exe
File created	C:\Windows\System\zqWjQre.exe	ce34ef5222ce404bbdd70f1fd29dcb7102c5c43f7c24ee3bb1d2e55a6a842f5f.exe
File created	C:\Windows\System\KDxgMLH.exe	ce34ef5222ce404bbdd70f1fd29dcb7102c5c43f7c24ee3bb1d2e55a6a842f5f.exe
File created	C:\Windows\System\URAEOqc.exe	ce34ef5222ce404bbdd70f1fd29dcb7102c5c43f7c24ee3bb1d2e55a6a842f5f.exe
File created	C:\Windows\System\tJZfdOr.exe	ce34ef5222ce404bbdd70f1fd29dcb7102c5c43f7c24ee3bb1d2e55a6a842f5f.exe
File created	C:\Windows\System\FuaKuVm.exe	ce34ef5222ce404bbdd70f1fd29dcb7102c5c43f7c24ee3bb1d2e55a6a842f5f.exe
File created	C:\Windows\System\QmuJsNk.exe	ce34ef5222ce404bbdd70f1fd29dcb7102c5c43f7c24ee3bb1d2e55a6a842f5f.exe
File created	C:\Windows\System\YnDEFGQ.exe	ce34ef5222ce404bbdd70f1fd29dcb7102c5c43f7c24ee3bb1d2e55a6a842f5f.exe
File created	C:\Windows\System\mtluFoD.exe	ce34ef5222ce404bbdd70f1fd29dcb7102c5c43f7c24ee3bb1d2e55a6a842f5f.exe
File created	C:\Windows\System\IsRAfEW.exe	ce34ef5222ce404bbdd70f1fd29dcb7102c5c43f7c24ee3bb1d2e55a6a842f5f.exe
File created	C:\Windows\System\yslXFKE.exe	ce34ef5222ce404bbdd70f1fd29dcb7102c5c43f7c24ee3bb1d2e55a6a842f5f.exe
File created	C:\Windows\System\KnCdtaZ.exe	ce34ef5222ce404bbdd70f1fd29dcb7102c5c43f7c24ee3bb1d2e55a6a842f5f.exe
File created	C:\Windows\System\qQxukcz.exe	ce34ef5222ce404bbdd70f1fd29dcb7102c5c43f7c24ee3bb1d2e55a6a842f5f.exe
File created	C:\Windows\System\NOkdoyf.exe	ce34ef5222ce404bbdd70f1fd29dcb7102c5c43f7c24ee3bb1d2e55a6a842f5f.exe
File created	C:\Windows\System\iPJIjvV.exe	ce34ef5222ce404bbdd70f1fd29dcb7102c5c43f7c24ee3bb1d2e55a6a842f5f.exe
File created	C:\Windows\System\iwXfxWZ.exe	ce34ef5222ce404bbdd70f1fd29dcb7102c5c43f7c24ee3bb1d2e55a6a842f5f.exe
File created	C:\Windows\System\XhYYhRD.exe	ce34ef5222ce404bbdd70f1fd29dcb7102c5c43f7c24ee3bb1d2e55a6a842f5f.exe
File created	C:\Windows\System\UrdgZrN.exe	ce34ef5222ce404bbdd70f1fd29dcb7102c5c43f7c24ee3bb1d2e55a6a842f5f.exe
File created	C:\Windows\System\oTizUvw.exe	ce34ef5222ce404bbdd70f1fd29dcb7102c5c43f7c24ee3bb1d2e55a6a842f5f.exe
File created	C:\Windows\System\UUNWoSZ.exe	ce34ef5222ce404bbdd70f1fd29dcb7102c5c43f7c24ee3bb1d2e55a6a842f5f.exe
File created	C:\Windows\System\OYWxVdx.exe	ce34ef5222ce404bbdd70f1fd29dcb7102c5c43f7c24ee3bb1d2e55a6a842f5f.exe
File created	C:\Windows\System\lywDfix.exe	ce34ef5222ce404bbdd70f1fd29dcb7102c5c43f7c24ee3bb1d2e55a6a842f5f.exe
File created	C:\Windows\System\BtabctV.exe	ce34ef5222ce404bbdd70f1fd29dcb7102c5c43f7c24ee3bb1d2e55a6a842f5f.exe
File created	C:\Windows\System\ykoeQQD.exe	ce34ef5222ce404bbdd70f1fd29dcb7102c5c43f7c24ee3bb1d2e55a6a842f5f.exe
File created	C:\Windows\System\hfgQBBM.exe	ce34ef5222ce404bbdd70f1fd29dcb7102c5c43f7c24ee3bb1d2e55a6a842f5f.exe
File created	C:\Windows\System\wnuwGHn.exe	ce34ef5222ce404bbdd70f1fd29dcb7102c5c43f7c24ee3bb1d2e55a6a842f5f.exe
File created	C:\Windows\System\qaYtBFv.exe	ce34ef5222ce404bbdd70f1fd29dcb7102c5c43f7c24ee3bb1d2e55a6a842f5f.exe
File created	C:\Windows\System\itlPDnJ.exe	ce34ef5222ce404bbdd70f1fd29dcb7102c5c43f7c24ee3bb1d2e55a6a842f5f.exe
File created	C:\Windows\System\CLCIHYI.exe	ce34ef5222ce404bbdd70f1fd29dcb7102c5c43f7c24ee3bb1d2e55a6a842f5f.exe
File created	C:\Windows\System\iaqbKak.exe	ce34ef5222ce404bbdd70f1fd29dcb7102c5c43f7c24ee3bb1d2e55a6a842f5f.exe
File created	C:\Windows\System\VgQaYsC.exe	ce34ef5222ce404bbdd70f1fd29dcb7102c5c43f7c24ee3bb1d2e55a6a842f5f.exe
File created	C:\Windows\System\TSYEpJe.exe	ce34ef5222ce404bbdd70f1fd29dcb7102c5c43f7c24ee3bb1d2e55a6a842f5f.exe
File created	C:\Windows\System\fRaqtkE.exe	ce34ef5222ce404bbdd70f1fd29dcb7102c5c43f7c24ee3bb1d2e55a6a842f5f.exe
File created	C:\Windows\System\PVJsGXD.exe	ce34ef5222ce404bbdd70f1fd29dcb7102c5c43f7c24ee3bb1d2e55a6a842f5f.exe
File created	C:\Windows\System\lcqgNAs.exe	ce34ef5222ce404bbdd70f1fd29dcb7102c5c43f7c24ee3bb1d2e55a6a842f5f.exe
File created	C:\Windows\System\MRjZQkd.exe	ce34ef5222ce404bbdd70f1fd29dcb7102c5c43f7c24ee3bb1d2e55a6a842f5f.exe
File created	C:\Windows\System\NLhufGy.exe	ce34ef5222ce404bbdd70f1fd29dcb7102c5c43f7c24ee3bb1d2e55a6a842f5f.exe
File created	C:\Windows\System\sBHUDDt.exe	ce34ef5222ce404bbdd70f1fd29dcb7102c5c43f7c24ee3bb1d2e55a6a842f5f.exe
File created	C:\Windows\System\IVaguDa.exe	ce34ef5222ce404bbdd70f1fd29dcb7102c5c43f7c24ee3bb1d2e55a6a842f5f.exe
File created	C:\Windows\System\RFHEUxQ.exe	ce34ef5222ce404bbdd70f1fd29dcb7102c5c43f7c24ee3bb1d2e55a6a842f5f.exe
File created	C:\Windows\System\StPAWmO.exe	ce34ef5222ce404bbdd70f1fd29dcb7102c5c43f7c24ee3bb1d2e55a6a842f5f.exe
File created	C:\Windows\System\swDOaSj.exe	ce34ef5222ce404bbdd70f1fd29dcb7102c5c43f7c24ee3bb1d2e55a6a842f5f.exe
File created	C:\Windows\System\bisDIiG.exe	ce34ef5222ce404bbdd70f1fd29dcb7102c5c43f7c24ee3bb1d2e55a6a842f5f.exe
File created	C:\Windows\System\ThhifRd.exe	ce34ef5222ce404bbdd70f1fd29dcb7102c5c43f7c24ee3bb1d2e55a6a842f5f.exe
File created	C:\Windows\System\TgBHeXu.exe	ce34ef5222ce404bbdd70f1fd29dcb7102c5c43f7c24ee3bb1d2e55a6a842f5f.exe
File created	C:\Windows\System\GcxjWxC.exe	ce34ef5222ce404bbdd70f1fd29dcb7102c5c43f7c24ee3bb1d2e55a6a842f5f.exe
File created	C:\Windows\System\VjFfuRf.exe	ce34ef5222ce404bbdd70f1fd29dcb7102c5c43f7c24ee3bb1d2e55a6a842f5f.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	16844	dwm.exe
Token: SeChangeNotifyPrivilege	16844	dwm.exe
Token: 33	16844	dwm.exe
Token: SeIncBasePriorityPrivilege	16844	dwm.exe
Token: SeShutdownPrivilege	16844	dwm.exe
Token: SeCreatePagefilePrivilege	16844	dwm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2768 wrote to memory of 912	2768	ce34ef5222ce404bbdd70f1fd29dcb7102c5c43f7c24ee3bb1d2e55a6a842f5f.exe	84
PID 2768 wrote to memory of 912	2768	ce34ef5222ce404bbdd70f1fd29dcb7102c5c43f7c24ee3bb1d2e55a6a842f5f.exe	84
PID 2768 wrote to memory of 756	2768	ce34ef5222ce404bbdd70f1fd29dcb7102c5c43f7c24ee3bb1d2e55a6a842f5f.exe	85
PID 2768 wrote to memory of 756	2768	ce34ef5222ce404bbdd70f1fd29dcb7102c5c43f7c24ee3bb1d2e55a6a842f5f.exe	85
PID 2768 wrote to memory of 1396	2768	ce34ef5222ce404bbdd70f1fd29dcb7102c5c43f7c24ee3bb1d2e55a6a842f5f.exe	86
PID 2768 wrote to memory of 1396	2768	ce34ef5222ce404bbdd70f1fd29dcb7102c5c43f7c24ee3bb1d2e55a6a842f5f.exe	86
PID 2768 wrote to memory of 2980	2768	ce34ef5222ce404bbdd70f1fd29dcb7102c5c43f7c24ee3bb1d2e55a6a842f5f.exe	87
PID 2768 wrote to memory of 2980	2768	ce34ef5222ce404bbdd70f1fd29dcb7102c5c43f7c24ee3bb1d2e55a6a842f5f.exe	87
PID 2768 wrote to memory of 3500	2768	ce34ef5222ce404bbdd70f1fd29dcb7102c5c43f7c24ee3bb1d2e55a6a842f5f.exe	88
PID 2768 wrote to memory of 3500	2768	ce34ef5222ce404bbdd70f1fd29dcb7102c5c43f7c24ee3bb1d2e55a6a842f5f.exe	88
PID 2768 wrote to memory of 1932	2768	ce34ef5222ce404bbdd70f1fd29dcb7102c5c43f7c24ee3bb1d2e55a6a842f5f.exe	89
PID 2768 wrote to memory of 1932	2768	ce34ef5222ce404bbdd70f1fd29dcb7102c5c43f7c24ee3bb1d2e55a6a842f5f.exe	89
PID 2768 wrote to memory of 2132	2768	ce34ef5222ce404bbdd70f1fd29dcb7102c5c43f7c24ee3bb1d2e55a6a842f5f.exe	90
PID 2768 wrote to memory of 2132	2768	ce34ef5222ce404bbdd70f1fd29dcb7102c5c43f7c24ee3bb1d2e55a6a842f5f.exe	90
PID 2768 wrote to memory of 3704	2768	ce34ef5222ce404bbdd70f1fd29dcb7102c5c43f7c24ee3bb1d2e55a6a842f5f.exe	91
PID 2768 wrote to memory of 3704	2768	ce34ef5222ce404bbdd70f1fd29dcb7102c5c43f7c24ee3bb1d2e55a6a842f5f.exe	91
PID 2768 wrote to memory of 628	2768	ce34ef5222ce404bbdd70f1fd29dcb7102c5c43f7c24ee3bb1d2e55a6a842f5f.exe	92
PID 2768 wrote to memory of 628	2768	ce34ef5222ce404bbdd70f1fd29dcb7102c5c43f7c24ee3bb1d2e55a6a842f5f.exe	92
PID 2768 wrote to memory of 4904	2768	ce34ef5222ce404bbdd70f1fd29dcb7102c5c43f7c24ee3bb1d2e55a6a842f5f.exe	93
PID 2768 wrote to memory of 4904	2768	ce34ef5222ce404bbdd70f1fd29dcb7102c5c43f7c24ee3bb1d2e55a6a842f5f.exe	93
PID 2768 wrote to memory of 1080	2768	ce34ef5222ce404bbdd70f1fd29dcb7102c5c43f7c24ee3bb1d2e55a6a842f5f.exe	94
PID 2768 wrote to memory of 1080	2768	ce34ef5222ce404bbdd70f1fd29dcb7102c5c43f7c24ee3bb1d2e55a6a842f5f.exe	94
PID 2768 wrote to memory of 4960	2768	ce34ef5222ce404bbdd70f1fd29dcb7102c5c43f7c24ee3bb1d2e55a6a842f5f.exe	95
PID 2768 wrote to memory of 4960	2768	ce34ef5222ce404bbdd70f1fd29dcb7102c5c43f7c24ee3bb1d2e55a6a842f5f.exe	95
PID 2768 wrote to memory of 1892	2768	ce34ef5222ce404bbdd70f1fd29dcb7102c5c43f7c24ee3bb1d2e55a6a842f5f.exe	96
PID 2768 wrote to memory of 1892	2768	ce34ef5222ce404bbdd70f1fd29dcb7102c5c43f7c24ee3bb1d2e55a6a842f5f.exe	96
PID 2768 wrote to memory of 2984	2768	ce34ef5222ce404bbdd70f1fd29dcb7102c5c43f7c24ee3bb1d2e55a6a842f5f.exe	97
PID 2768 wrote to memory of 2984	2768	ce34ef5222ce404bbdd70f1fd29dcb7102c5c43f7c24ee3bb1d2e55a6a842f5f.exe	97
PID 2768 wrote to memory of 2788	2768	ce34ef5222ce404bbdd70f1fd29dcb7102c5c43f7c24ee3bb1d2e55a6a842f5f.exe	98
PID 2768 wrote to memory of 2788	2768	ce34ef5222ce404bbdd70f1fd29dcb7102c5c43f7c24ee3bb1d2e55a6a842f5f.exe	98
PID 2768 wrote to memory of 4992	2768	ce34ef5222ce404bbdd70f1fd29dcb7102c5c43f7c24ee3bb1d2e55a6a842f5f.exe	99
PID 2768 wrote to memory of 4992	2768	ce34ef5222ce404bbdd70f1fd29dcb7102c5c43f7c24ee3bb1d2e55a6a842f5f.exe	99
PID 2768 wrote to memory of 2952	2768	ce34ef5222ce404bbdd70f1fd29dcb7102c5c43f7c24ee3bb1d2e55a6a842f5f.exe	100
PID 2768 wrote to memory of 2952	2768	ce34ef5222ce404bbdd70f1fd29dcb7102c5c43f7c24ee3bb1d2e55a6a842f5f.exe	100
PID 2768 wrote to memory of 2028	2768	ce34ef5222ce404bbdd70f1fd29dcb7102c5c43f7c24ee3bb1d2e55a6a842f5f.exe	101
PID 2768 wrote to memory of 2028	2768	ce34ef5222ce404bbdd70f1fd29dcb7102c5c43f7c24ee3bb1d2e55a6a842f5f.exe	101
PID 2768 wrote to memory of 2668	2768	ce34ef5222ce404bbdd70f1fd29dcb7102c5c43f7c24ee3bb1d2e55a6a842f5f.exe	102
PID 2768 wrote to memory of 2668	2768	ce34ef5222ce404bbdd70f1fd29dcb7102c5c43f7c24ee3bb1d2e55a6a842f5f.exe	102
PID 2768 wrote to memory of 4944	2768	ce34ef5222ce404bbdd70f1fd29dcb7102c5c43f7c24ee3bb1d2e55a6a842f5f.exe	103
PID 2768 wrote to memory of 4944	2768	ce34ef5222ce404bbdd70f1fd29dcb7102c5c43f7c24ee3bb1d2e55a6a842f5f.exe	103
PID 2768 wrote to memory of 4844	2768	ce34ef5222ce404bbdd70f1fd29dcb7102c5c43f7c24ee3bb1d2e55a6a842f5f.exe	104
PID 2768 wrote to memory of 4844	2768	ce34ef5222ce404bbdd70f1fd29dcb7102c5c43f7c24ee3bb1d2e55a6a842f5f.exe	104
PID 2768 wrote to memory of 2644	2768	ce34ef5222ce404bbdd70f1fd29dcb7102c5c43f7c24ee3bb1d2e55a6a842f5f.exe	105
PID 2768 wrote to memory of 2644	2768	ce34ef5222ce404bbdd70f1fd29dcb7102c5c43f7c24ee3bb1d2e55a6a842f5f.exe	105
PID 2768 wrote to memory of 944	2768	ce34ef5222ce404bbdd70f1fd29dcb7102c5c43f7c24ee3bb1d2e55a6a842f5f.exe	106
PID 2768 wrote to memory of 944	2768	ce34ef5222ce404bbdd70f1fd29dcb7102c5c43f7c24ee3bb1d2e55a6a842f5f.exe	106
PID 2768 wrote to memory of 1048	2768	ce34ef5222ce404bbdd70f1fd29dcb7102c5c43f7c24ee3bb1d2e55a6a842f5f.exe	107
PID 2768 wrote to memory of 1048	2768	ce34ef5222ce404bbdd70f1fd29dcb7102c5c43f7c24ee3bb1d2e55a6a842f5f.exe	107
PID 2768 wrote to memory of 4580	2768	ce34ef5222ce404bbdd70f1fd29dcb7102c5c43f7c24ee3bb1d2e55a6a842f5f.exe	108
PID 2768 wrote to memory of 4580	2768	ce34ef5222ce404bbdd70f1fd29dcb7102c5c43f7c24ee3bb1d2e55a6a842f5f.exe	108
PID 2768 wrote to memory of 3180	2768	ce34ef5222ce404bbdd70f1fd29dcb7102c5c43f7c24ee3bb1d2e55a6a842f5f.exe	109
PID 2768 wrote to memory of 3180	2768	ce34ef5222ce404bbdd70f1fd29dcb7102c5c43f7c24ee3bb1d2e55a6a842f5f.exe	109
PID 2768 wrote to memory of 2348	2768	ce34ef5222ce404bbdd70f1fd29dcb7102c5c43f7c24ee3bb1d2e55a6a842f5f.exe	110
PID 2768 wrote to memory of 2348	2768	ce34ef5222ce404bbdd70f1fd29dcb7102c5c43f7c24ee3bb1d2e55a6a842f5f.exe	110
PID 2768 wrote to memory of 4748	2768	ce34ef5222ce404bbdd70f1fd29dcb7102c5c43f7c24ee3bb1d2e55a6a842f5f.exe	111
PID 2768 wrote to memory of 4748	2768	ce34ef5222ce404bbdd70f1fd29dcb7102c5c43f7c24ee3bb1d2e55a6a842f5f.exe	111
PID 2768 wrote to memory of 1380	2768	ce34ef5222ce404bbdd70f1fd29dcb7102c5c43f7c24ee3bb1d2e55a6a842f5f.exe	112
PID 2768 wrote to memory of 1380	2768	ce34ef5222ce404bbdd70f1fd29dcb7102c5c43f7c24ee3bb1d2e55a6a842f5f.exe	112
PID 2768 wrote to memory of 4764	2768	ce34ef5222ce404bbdd70f1fd29dcb7102c5c43f7c24ee3bb1d2e55a6a842f5f.exe	113
PID 2768 wrote to memory of 4764	2768	ce34ef5222ce404bbdd70f1fd29dcb7102c5c43f7c24ee3bb1d2e55a6a842f5f.exe	113
PID 2768 wrote to memory of 1900	2768	ce34ef5222ce404bbdd70f1fd29dcb7102c5c43f7c24ee3bb1d2e55a6a842f5f.exe	114
PID 2768 wrote to memory of 1900	2768	ce34ef5222ce404bbdd70f1fd29dcb7102c5c43f7c24ee3bb1d2e55a6a842f5f.exe	114
PID 2768 wrote to memory of 4852	2768	ce34ef5222ce404bbdd70f1fd29dcb7102c5c43f7c24ee3bb1d2e55a6a842f5f.exe	115
PID 2768 wrote to memory of 4852	2768	ce34ef5222ce404bbdd70f1fd29dcb7102c5c43f7c24ee3bb1d2e55a6a842f5f.exe	115

C:\Users\Admin\AppData\Local\Temp\ce34ef5222ce404bbdd70f1fd29dcb7102c5c43f7c24ee3bb1d2e55a6a842f5f.exe
"C:\Users\Admin\AppData\Local\Temp\ce34ef5222ce404bbdd70f1fd29dcb7102c5c43f7c24ee3bb1d2e55a6a842f5f.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2768
- C:\Windows\System\jvZHTSB.exe
  C:\Windows\System\jvZHTSB.exe
  2⤵
  - Executes dropped EXE
  PID:912
- C:\Windows\System\IvsRAgB.exe
  C:\Windows\System\IvsRAgB.exe
  2⤵
  - Executes dropped EXE
  PID:756
- C:\Windows\System\rKrXfBG.exe
  C:\Windows\System\rKrXfBG.exe
  2⤵
  - Executes dropped EXE
  PID:1396
- C:\Windows\System\oRmggUi.exe
  C:\Windows\System\oRmggUi.exe
  2⤵
  - Executes dropped EXE
  PID:2980
- C:\Windows\System\SWiqhRi.exe
  C:\Windows\System\SWiqhRi.exe
  2⤵
  - Executes dropped EXE
  PID:3500
- C:\Windows\System\vzdvVul.exe
  C:\Windows\System\vzdvVul.exe
  2⤵
  - Executes dropped EXE
  PID:1932
- C:\Windows\System\pxDWdcr.exe
  C:\Windows\System\pxDWdcr.exe
  2⤵
  - Executes dropped EXE
  PID:2132
- C:\Windows\System\CvNpTZH.exe
  C:\Windows\System\CvNpTZH.exe
  2⤵
  - Executes dropped EXE
  PID:3704
- C:\Windows\System\FFXPCAb.exe
  C:\Windows\System\FFXPCAb.exe
  2⤵
  - Executes dropped EXE
  PID:628
- C:\Windows\System\AcsAKhB.exe
  C:\Windows\System\AcsAKhB.exe
  2⤵
  - Executes dropped EXE
  PID:4904
- C:\Windows\System\WLxNwFW.exe
  C:\Windows\System\WLxNwFW.exe
  2⤵
  - Executes dropped EXE
  PID:1080
- C:\Windows\System\ovQGEux.exe
  C:\Windows\System\ovQGEux.exe
  2⤵
  - Executes dropped EXE
  PID:4960
- C:\Windows\System\QESaonk.exe
  C:\Windows\System\QESaonk.exe
  2⤵
  - Executes dropped EXE
  PID:1892
- C:\Windows\System\GPEmVEE.exe
  C:\Windows\System\GPEmVEE.exe
  2⤵
  - Executes dropped EXE
  PID:2984
- C:\Windows\System\VhgTAYL.exe
  C:\Windows\System\VhgTAYL.exe
  2⤵
  - Executes dropped EXE
  PID:2788
- C:\Windows\System\DgArdIY.exe
  C:\Windows\System\DgArdIY.exe
  2⤵
  - Executes dropped EXE
  PID:4992
- C:\Windows\System\jssraSK.exe
  C:\Windows\System\jssraSK.exe
  2⤵
  - Executes dropped EXE
  PID:2952
- C:\Windows\System\VPoBvvF.exe
  C:\Windows\System\VPoBvvF.exe
  2⤵
  - Executes dropped EXE
  PID:2028
- C:\Windows\System\KHnZaMC.exe
  C:\Windows\System\KHnZaMC.exe
  2⤵
  - Executes dropped EXE
  PID:2668
- C:\Windows\System\rraueFK.exe
  C:\Windows\System\rraueFK.exe
  2⤵
  - Executes dropped EXE
  PID:4944
- C:\Windows\System\avtyHIg.exe
  C:\Windows\System\avtyHIg.exe
  2⤵
  - Executes dropped EXE
  PID:4844
- C:\Windows\System\qILFTrt.exe
  C:\Windows\System\qILFTrt.exe
  2⤵
  - Executes dropped EXE
  PID:2644
- C:\Windows\System\pEIcJuD.exe
  C:\Windows\System\pEIcJuD.exe
  2⤵
  - Executes dropped EXE
  PID:944
- C:\Windows\System\qoGTsNC.exe
  C:\Windows\System\qoGTsNC.exe
  2⤵
  - Executes dropped EXE
  PID:1048
- C:\Windows\System\BtabctV.exe
  C:\Windows\System\BtabctV.exe
  2⤵
  - Executes dropped EXE
  PID:4580
- C:\Windows\System\YVyuFXR.exe
  C:\Windows\System\YVyuFXR.exe
  2⤵
  - Executes dropped EXE
  PID:3180
- C:\Windows\System\IWIwdfR.exe
  C:\Windows\System\IWIwdfR.exe
  2⤵
  - Executes dropped EXE
  PID:2348
- C:\Windows\System\JTfRlRM.exe
  C:\Windows\System\JTfRlRM.exe
  2⤵
  - Executes dropped EXE
  PID:4748
- C:\Windows\System\UynNQPT.exe
  C:\Windows\System\UynNQPT.exe
  2⤵
  - Executes dropped EXE
  PID:1380
- C:\Windows\System\hODNSDb.exe
  C:\Windows\System\hODNSDb.exe
  2⤵
  - Executes dropped EXE
  PID:4764
- C:\Windows\System\cyeHeTx.exe
  C:\Windows\System\cyeHeTx.exe
  2⤵
  - Executes dropped EXE
  PID:1900
- C:\Windows\System\zvzisiq.exe
  C:\Windows\System\zvzisiq.exe
  2⤵
  - Executes dropped EXE
  PID:4852
- C:\Windows\System\IuhAORl.exe
  C:\Windows\System\IuhAORl.exe
  2⤵
  - Executes dropped EXE
  PID:4352
- C:\Windows\System\jqHFqgn.exe
  C:\Windows\System\jqHFqgn.exe
  2⤵
  - Executes dropped EXE
  PID:1596
- C:\Windows\System\SmNOYtM.exe
  C:\Windows\System\SmNOYtM.exe
  2⤵
  - Executes dropped EXE
  PID:1152
- C:\Windows\System\ilCUIgv.exe
  C:\Windows\System\ilCUIgv.exe
  2⤵
  - Executes dropped EXE
  PID:2944
- C:\Windows\System\HADzUlq.exe
  C:\Windows\System\HADzUlq.exe
  2⤵
  - Executes dropped EXE
  PID:4768
- C:\Windows\System\uKtwGNj.exe
  C:\Windows\System\uKtwGNj.exe
  2⤵
  - Executes dropped EXE
  PID:380
- C:\Windows\System\QzJgATV.exe
  C:\Windows\System\QzJgATV.exe
  2⤵
  - Executes dropped EXE
  PID:3668
- C:\Windows\System\qkvwXnV.exe
  C:\Windows\System\qkvwXnV.exe
  2⤵
  - Executes dropped EXE
  PID:3684
- C:\Windows\System\ouSzVlZ.exe
  C:\Windows\System\ouSzVlZ.exe
  2⤵
  - Executes dropped EXE
  PID:1344
- C:\Windows\System\ApunCNv.exe
  C:\Windows\System\ApunCNv.exe
  2⤵
  - Executes dropped EXE
  PID:3424
- C:\Windows\System\wxTZZBV.exe
  C:\Windows\System\wxTZZBV.exe
  2⤵
  - Executes dropped EXE
  PID:2592
- C:\Windows\System\vMkfzcL.exe
  C:\Windows\System\vMkfzcL.exe
  2⤵
  - Executes dropped EXE
  PID:3408
- C:\Windows\System\jplVFXB.exe
  C:\Windows\System\jplVFXB.exe
  2⤵
  - Executes dropped EXE
  PID:456
- C:\Windows\System\iaqbKak.exe
  C:\Windows\System\iaqbKak.exe
  2⤵
  - Executes dropped EXE
  PID:1472
- C:\Windows\System\sqYVerF.exe
  C:\Windows\System\sqYVerF.exe
  2⤵
  - Executes dropped EXE
  PID:3396
- C:\Windows\System\DbeoTSA.exe
  C:\Windows\System\DbeoTSA.exe
  2⤵
  - Executes dropped EXE
  PID:1776
- C:\Windows\System\GfCMQSw.exe
  C:\Windows\System\GfCMQSw.exe
  2⤵
  - Executes dropped EXE
  PID:2304
- C:\Windows\System\oTSDnEA.exe
  C:\Windows\System\oTSDnEA.exe
  2⤵
  - Executes dropped EXE
  PID:3964
- C:\Windows\System\tJZfdOr.exe
  C:\Windows\System\tJZfdOr.exe
  2⤵
  - Executes dropped EXE
  PID:340
- C:\Windows\System\BwWIOfu.exe
  C:\Windows\System\BwWIOfu.exe
  2⤵
  - Executes dropped EXE
  PID:4424
- C:\Windows\System\nYTzLmC.exe
  C:\Windows\System\nYTzLmC.exe
  2⤵
  - Executes dropped EXE
  PID:3536
- C:\Windows\System\UUNWoSZ.exe
  C:\Windows\System\UUNWoSZ.exe
  2⤵
  - Executes dropped EXE
  PID:3832
- C:\Windows\System\IkxdkED.exe
  C:\Windows\System\IkxdkED.exe
  2⤵
  - Executes dropped EXE
  PID:4736
- C:\Windows\System\FJKMdwS.exe
  C:\Windows\System\FJKMdwS.exe
  2⤵
  - Executes dropped EXE
  PID:3516
- C:\Windows\System\RjGktPY.exe
  C:\Windows\System\RjGktPY.exe
  2⤵
  - Executes dropped EXE
  PID:1092
- C:\Windows\System\ynoNxJH.exe
  C:\Windows\System\ynoNxJH.exe
  2⤵
  - Executes dropped EXE
  PID:2844
- C:\Windows\System\IRaKCMl.exe
  C:\Windows\System\IRaKCMl.exe
  2⤵
  - Executes dropped EXE
  PID:1336
- C:\Windows\System\FRQSSxi.exe
  C:\Windows\System\FRQSSxi.exe
  2⤵
  - Executes dropped EXE
  PID:1936
- C:\Windows\System\HskHLoo.exe
  C:\Windows\System\HskHLoo.exe
  2⤵
  - Executes dropped EXE
  PID:4344
- C:\Windows\System\dzIIjwF.exe
  C:\Windows\System\dzIIjwF.exe
  2⤵
  - Executes dropped EXE
  PID:2392
- C:\Windows\System\qDMxcei.exe
  C:\Windows\System\qDMxcei.exe
  2⤵
  - Executes dropped EXE
  PID:1132
- C:\Windows\System\KonTifv.exe
  C:\Windows\System\KonTifv.exe
  2⤵
  - Executes dropped EXE
  PID:2216
- C:\Windows\System\XPGfUeO.exe
  C:\Windows\System\XPGfUeO.exe
  2⤵
  PID:2244
- C:\Windows\System\zIUborQ.exe
  C:\Windows\System\zIUborQ.exe
  2⤵
  PID:2544
- C:\Windows\System\VgQaYsC.exe
  C:\Windows\System\VgQaYsC.exe
  2⤵
  PID:2880
- C:\Windows\System\WXFicvK.exe
  C:\Windows\System\WXFicvK.exe
  2⤵
  PID:1712
- C:\Windows\System\bAYZmbN.exe
  C:\Windows\System\bAYZmbN.exe
  2⤵
  PID:4536
- C:\Windows\System\nEKyrCJ.exe
  C:\Windows\System\nEKyrCJ.exe
  2⤵
  PID:4528
- C:\Windows\System\lRBCjbX.exe
  C:\Windows\System\lRBCjbX.exe
  2⤵
  PID:1096
- C:\Windows\System\XdcbEeF.exe
  C:\Windows\System\XdcbEeF.exe
  2⤵
  PID:3948
- C:\Windows\System\GWrdVRq.exe
  C:\Windows\System\GWrdVRq.exe
  2⤵
  PID:1628
- C:\Windows\System\FuaKuVm.exe
  C:\Windows\System\FuaKuVm.exe
  2⤵
  PID:4384
- C:\Windows\System\JodRJiv.exe
  C:\Windows\System\JodRJiv.exe
  2⤵
  PID:3624
- C:\Windows\System\THlMFgE.exe
  C:\Windows\System\THlMFgE.exe
  2⤵
  PID:2776
- C:\Windows\System\KoUGSyU.exe
  C:\Windows\System\KoUGSyU.exe
  2⤵
  PID:2596
- C:\Windows\System\ifzOgDO.exe
  C:\Windows\System\ifzOgDO.exe
  2⤵
  PID:3432
- C:\Windows\System\AqkqSOX.exe
  C:\Windows\System\AqkqSOX.exe
  2⤵
  PID:4872
- C:\Windows\System\QmuJsNk.exe
  C:\Windows\System\QmuJsNk.exe
  2⤵
  PID:4436
- C:\Windows\System\CHZVMOg.exe
  C:\Windows\System\CHZVMOg.exe
  2⤵
  PID:3940
- C:\Windows\System\xciWIWw.exe
  C:\Windows\System\xciWIWw.exe
  2⤵
  PID:5152
- C:\Windows\System\nzhUddl.exe
  C:\Windows\System\nzhUddl.exe
  2⤵
  PID:5180
- C:\Windows\System\bGOZJSe.exe
  C:\Windows\System\bGOZJSe.exe
  2⤵
  PID:5208
- C:\Windows\System\AkvWPYb.exe
  C:\Windows\System\AkvWPYb.exe
  2⤵
  PID:5232
- C:\Windows\System\OsDPfaj.exe
  C:\Windows\System\OsDPfaj.exe
  2⤵
  PID:5264
- C:\Windows\System\FDivxGa.exe
  C:\Windows\System\FDivxGa.exe
  2⤵
  PID:5292
- C:\Windows\System\FleEeZM.exe
  C:\Windows\System\FleEeZM.exe
  2⤵
  PID:5324
- C:\Windows\System\CxHQuaT.exe
  C:\Windows\System\CxHQuaT.exe
  2⤵
  PID:5360
- C:\Windows\System\sDLYjgz.exe
  C:\Windows\System\sDLYjgz.exe
  2⤵
  PID:5388
- C:\Windows\System\yjiIGVg.exe
  C:\Windows\System\yjiIGVg.exe
  2⤵
  PID:5412
- C:\Windows\System\tGAyRbF.exe
  C:\Windows\System\tGAyRbF.exe
  2⤵
  PID:5444
- C:\Windows\System\sFAbzpP.exe
  C:\Windows\System\sFAbzpP.exe
  2⤵
  PID:5476
- C:\Windows\System\xOWksXT.exe
  C:\Windows\System\xOWksXT.exe
  2⤵
  PID:5500
- C:\Windows\System\maNIJMv.exe
  C:\Windows\System\maNIJMv.exe
  2⤵
  PID:5532
- C:\Windows\System\ovadWey.exe
  C:\Windows\System\ovadWey.exe
  2⤵
  PID:5560
- C:\Windows\System\AVGaEGg.exe
  C:\Windows\System\AVGaEGg.exe
  2⤵
  PID:5588
- C:\Windows\System\LMhyVZk.exe
  C:\Windows\System\LMhyVZk.exe
  2⤵
  PID:5612
- C:\Windows\System\YRwkQeH.exe
  C:\Windows\System\YRwkQeH.exe
  2⤵
  PID:5648
- C:\Windows\System\xDdqAZt.exe
  C:\Windows\System\xDdqAZt.exe
  2⤵
  PID:5668
- C:\Windows\System\jlozdSH.exe
  C:\Windows\System\jlozdSH.exe
  2⤵
  PID:5700
- C:\Windows\System\KnCdtaZ.exe
  C:\Windows\System\KnCdtaZ.exe
  2⤵
  PID:5724
- C:\Windows\System\uUiIVwd.exe
  C:\Windows\System\uUiIVwd.exe
  2⤵
  PID:5752
- C:\Windows\System\cSPxPyV.exe
  C:\Windows\System\cSPxPyV.exe
  2⤵
  PID:5780
- C:\Windows\System\bAZhTQI.exe
  C:\Windows\System\bAZhTQI.exe
  2⤵
  PID:5808
- C:\Windows\System\ECkvDwk.exe
  C:\Windows\System\ECkvDwk.exe
  2⤵
  PID:5840
- C:\Windows\System\moSOGKo.exe
  C:\Windows\System\moSOGKo.exe
  2⤵
  PID:5864
- C:\Windows\System\FiMGPVR.exe
  C:\Windows\System\FiMGPVR.exe
  2⤵
  PID:5896
- C:\Windows\System\WdtgGPT.exe
  C:\Windows\System\WdtgGPT.exe
  2⤵
  PID:5924
- C:\Windows\System\BMkrAkx.exe
  C:\Windows\System\BMkrAkx.exe
  2⤵
  PID:5948
- C:\Windows\System\LTkPQhz.exe
  C:\Windows\System\LTkPQhz.exe
  2⤵
  PID:5980
- C:\Windows\System\vTgnyDN.exe
  C:\Windows\System\vTgnyDN.exe
  2⤵
  PID:6004
- C:\Windows\System\RaXJPuY.exe
  C:\Windows\System\RaXJPuY.exe
  2⤵
  PID:6036
- C:\Windows\System\lVBUqoR.exe
  C:\Windows\System\lVBUqoR.exe
  2⤵
  PID:6064
- C:\Windows\System\jhPpPZY.exe
  C:\Windows\System\jhPpPZY.exe
  2⤵
  PID:6092
- C:\Windows\System\oHWFqNg.exe
  C:\Windows\System\oHWFqNg.exe
  2⤵
  PID:6116
- C:\Windows\System\IwNQeSt.exe
  C:\Windows\System\IwNQeSt.exe
  2⤵
  PID:2200
- C:\Windows\System\vUKqEqA.exe
  C:\Windows\System\vUKqEqA.exe
  2⤵
  PID:1008
- C:\Windows\System\VFScbyC.exe
  C:\Windows\System\VFScbyC.exe
  2⤵
  PID:752
- C:\Windows\System\pfEodqK.exe
  C:\Windows\System\pfEodqK.exe
  2⤵
  PID:1580
- C:\Windows\System\wYdFyGq.exe
  C:\Windows\System\wYdFyGq.exe
  2⤵
  PID:3252
- C:\Windows\System\NcdEftS.exe
  C:\Windows\System\NcdEftS.exe
  2⤵
  PID:5028
- C:\Windows\System\dAcDbOY.exe
  C:\Windows\System\dAcDbOY.exe
  2⤵
  PID:376
- C:\Windows\System\TSYEpJe.exe
  C:\Windows\System\TSYEpJe.exe
  2⤵
  PID:5172
- C:\Windows\System\AfKoHgn.exe
  C:\Windows\System\AfKoHgn.exe
  2⤵
  PID:5244
- C:\Windows\System\btCMsbS.exe
  C:\Windows\System\btCMsbS.exe
  2⤵
  PID:5352
- C:\Windows\System\kUklsUd.exe
  C:\Windows\System\kUklsUd.exe
  2⤵
  PID:5460
- C:\Windows\System\PfmfQHn.exe
  C:\Windows\System\PfmfQHn.exe
  2⤵
  PID:5520
- C:\Windows\System\uGUnLIq.exe
  C:\Windows\System\uGUnLIq.exe
  2⤵
  PID:5708
- C:\Windows\System\YnDEFGQ.exe
  C:\Windows\System\YnDEFGQ.exe
  2⤵
  PID:5764
- C:\Windows\System\kIRfyjs.exe
  C:\Windows\System\kIRfyjs.exe
  2⤵
  PID:5820
- C:\Windows\System\RAMalVt.exe
  C:\Windows\System\RAMalVt.exe
  2⤵
  PID:1972
- C:\Windows\System\jsEWygq.exe
  C:\Windows\System\jsEWygq.exe
  2⤵
  PID:5932
- C:\Windows\System\PAAuLHB.exe
  C:\Windows\System\PAAuLHB.exe
  2⤵
  PID:5968
- C:\Windows\System\IMcCiXe.exe
  C:\Windows\System\IMcCiXe.exe
  2⤵
  PID:6056
- C:\Windows\System\bUZEiKL.exe
  C:\Windows\System\bUZEiKL.exe
  2⤵
  PID:6112
- C:\Windows\System\TVdXPPB.exe
  C:\Windows\System\TVdXPPB.exe
  2⤵
  PID:6136
- C:\Windows\System\cFIXrcb.exe
  C:\Windows\System\cFIXrcb.exe
  2⤵
  PID:3316
- C:\Windows\System\DKXQlHO.exe
  C:\Windows\System\DKXQlHO.exe
  2⤵
  PID:5060
- C:\Windows\System\fqwvZbN.exe
  C:\Windows\System\fqwvZbN.exe
  2⤵
  PID:1852
- C:\Windows\System\vBaYNIu.exe
  C:\Windows\System\vBaYNIu.exe
  2⤵
  PID:5200
- C:\Windows\System\nrwWCMb.exe
  C:\Windows\System\nrwWCMb.exe
  2⤵
  PID:5272
- C:\Windows\System\noZyVBr.exe
  C:\Windows\System\noZyVBr.exe
  2⤵
  PID:3644
- C:\Windows\System\IpYdzxu.exe
  C:\Windows\System\IpYdzxu.exe
  2⤵
  PID:5516
- C:\Windows\System\QlaEtbC.exe
  C:\Windows\System\QlaEtbC.exe
  2⤵
  PID:8
- C:\Windows\System\kGvJxAQ.exe
  C:\Windows\System\kGvJxAQ.exe
  2⤵
  PID:208
- C:\Windows\System\aglylxR.exe
  C:\Windows\System\aglylxR.exe
  2⤵
  PID:3504
- C:\Windows\System\OYWxVdx.exe
  C:\Windows\System\OYWxVdx.exe
  2⤵
  PID:2236
- C:\Windows\System\UHExqsw.exe
  C:\Windows\System\UHExqsw.exe
  2⤵
  PID:1760
- C:\Windows\System\dgoZsnF.exe
  C:\Windows\System\dgoZsnF.exe
  2⤵
  PID:6024
- C:\Windows\System\daOjPHv.exe
  C:\Windows\System\daOjPHv.exe
  2⤵
  PID:5016
- C:\Windows\System\ScunjGr.exe
  C:\Windows\System\ScunjGr.exe
  2⤵
  PID:2808
- C:\Windows\System\LRxmOAJ.exe
  C:\Windows\System\LRxmOAJ.exe
  2⤵
  PID:3232
- C:\Windows\System\eTbNlkm.exe
  C:\Windows\System\eTbNlkm.exe
  2⤵
  PID:760
- C:\Windows\System\iRYuguh.exe
  C:\Windows\System\iRYuguh.exe
  2⤵
  PID:3772
- C:\Windows\System\sBHUDDt.exe
  C:\Windows\System\sBHUDDt.exe
  2⤵
  PID:5400
- C:\Windows\System\GKzsVsZ.exe
  C:\Windows\System\GKzsVsZ.exe
  2⤵
  PID:5552
- C:\Windows\System\iCjTwYr.exe
  C:\Windows\System\iCjTwYr.exe
  2⤵
  PID:3416
- C:\Windows\System\MPtjbaQ.exe
  C:\Windows\System\MPtjbaQ.exe
  2⤵
  PID:5912
- C:\Windows\System\sodnEur.exe
  C:\Windows\System\sodnEur.exe
  2⤵
  PID:3492
- C:\Windows\System\DdJBUoZ.exe
  C:\Windows\System\DdJBUoZ.exe
  2⤵
  PID:5492
- C:\Windows\System\BAtPElP.exe
  C:\Windows\System\BAtPElP.exe
  2⤵
  PID:956
- C:\Windows\System\paaYDOj.exe
  C:\Windows\System\paaYDOj.exe
  2⤵
  PID:6080
- C:\Windows\System\kgxzvvS.exe
  C:\Windows\System\kgxzvvS.exe
  2⤵
  PID:2460
- C:\Windows\System\OQIWpbk.exe
  C:\Windows\System\OQIWpbk.exe
  2⤵
  PID:3976
- C:\Windows\System\jjtPacC.exe
  C:\Windows\System\jjtPacC.exe
  2⤵
  PID:6172
- C:\Windows\System\MdgxHMr.exe
  C:\Windows\System\MdgxHMr.exe
  2⤵
  PID:6220
- C:\Windows\System\sKmVmAW.exe
  C:\Windows\System\sKmVmAW.exe
  2⤵
  PID:6244
- C:\Windows\System\qZQLkFr.exe
  C:\Windows\System\qZQLkFr.exe
  2⤵
  PID:6260
- C:\Windows\System\agdhfIr.exe
  C:\Windows\System\agdhfIr.exe
  2⤵
  PID:6276
- C:\Windows\System\btkGrmz.exe
  C:\Windows\System\btkGrmz.exe
  2⤵
  PID:6292
- C:\Windows\System\OXVtGLy.exe
  C:\Windows\System\OXVtGLy.exe
  2⤵
  PID:6308
- C:\Windows\System\wjIdbUP.exe
  C:\Windows\System\wjIdbUP.exe
  2⤵
  PID:6328
- C:\Windows\System\gBrMtjC.exe
  C:\Windows\System\gBrMtjC.exe
  2⤵
  PID:6348
- C:\Windows\System\SgStBJB.exe
  C:\Windows\System\SgStBJB.exe
  2⤵
  PID:6368
- C:\Windows\System\GFyZhjv.exe
  C:\Windows\System\GFyZhjv.exe
  2⤵
  PID:6388
- C:\Windows\System\wElOdcH.exe
  C:\Windows\System\wElOdcH.exe
  2⤵
  PID:6404
- C:\Windows\System\FwLKlRU.exe
  C:\Windows\System\FwLKlRU.exe
  2⤵
  PID:6480
- C:\Windows\System\jzBawHq.exe
  C:\Windows\System\jzBawHq.exe
  2⤵
  PID:6496
- C:\Windows\System\QFHLANB.exe
  C:\Windows\System\QFHLANB.exe
  2⤵
  PID:6540
- C:\Windows\System\fhthyqu.exe
  C:\Windows\System\fhthyqu.exe
  2⤵
  PID:6568
- C:\Windows\System\nzzeDnn.exe
  C:\Windows\System\nzzeDnn.exe
  2⤵
  PID:6632
- C:\Windows\System\Hadwkin.exe
  C:\Windows\System\Hadwkin.exe
  2⤵
  PID:6656
- C:\Windows\System\jftbpMv.exe
  C:\Windows\System\jftbpMv.exe
  2⤵
  PID:6696
- C:\Windows\System\zSRvVrP.exe
  C:\Windows\System\zSRvVrP.exe
  2⤵
  PID:6724
- C:\Windows\System\aDlmQVR.exe
  C:\Windows\System\aDlmQVR.exe
  2⤵
  PID:6748
- C:\Windows\System\RqlrJTt.exe
  C:\Windows\System\RqlrJTt.exe
  2⤵
  PID:6792
- C:\Windows\System\srhmioW.exe
  C:\Windows\System\srhmioW.exe
  2⤵
  PID:6828
- C:\Windows\System\XEbEsEj.exe
  C:\Windows\System\XEbEsEj.exe
  2⤵
  PID:6848
- C:\Windows\System\iPJIjvV.exe
  C:\Windows\System\iPJIjvV.exe
  2⤵
  PID:6872
- C:\Windows\System\SHAyyXA.exe
  C:\Windows\System\SHAyyXA.exe
  2⤵
  PID:6900
- C:\Windows\System\iTwPySR.exe
  C:\Windows\System\iTwPySR.exe
  2⤵
  PID:6920
- C:\Windows\System\iBLQIHh.exe
  C:\Windows\System\iBLQIHh.exe
  2⤵
  PID:6948
- C:\Windows\System\fghvrEF.exe
  C:\Windows\System\fghvrEF.exe
  2⤵
  PID:6988
- C:\Windows\System\WahjPhO.exe
  C:\Windows\System\WahjPhO.exe
  2⤵
  PID:7008
- C:\Windows\System\QtMKZgE.exe
  C:\Windows\System\QtMKZgE.exe
  2⤵
  PID:7028
- C:\Windows\System\pKYefNs.exe
  C:\Windows\System\pKYefNs.exe
  2⤵
  PID:7056
- C:\Windows\System\wgPuWCo.exe
  C:\Windows\System\wgPuWCo.exe
  2⤵
  PID:7096
- C:\Windows\System\gWNPLlY.exe
  C:\Windows\System\gWNPLlY.exe
  2⤵
  PID:7124
- C:\Windows\System\slKDoGT.exe
  C:\Windows\System\slKDoGT.exe
  2⤵
  PID:7152
- C:\Windows\System\UhzKaSG.exe
  C:\Windows\System\UhzKaSG.exe
  2⤵
  PID:6160
- C:\Windows\System\uicuszm.exe
  C:\Windows\System\uicuszm.exe
  2⤵
  PID:6228
- C:\Windows\System\SdBJWrO.exe
  C:\Windows\System\SdBJWrO.exe
  2⤵
  PID:6268
- C:\Windows\System\ukzuOoq.exe
  C:\Windows\System\ukzuOoq.exe
  2⤵
  PID:6320
- C:\Windows\System\KfKAkuY.exe
  C:\Windows\System\KfKAkuY.exe
  2⤵
  PID:6384
- C:\Windows\System\caVDyKP.exe
  C:\Windows\System\caVDyKP.exe
  2⤵
  PID:6464
- C:\Windows\System\WgjTvpB.exe
  C:\Windows\System\WgjTvpB.exe
  2⤵
  PID:6556
- C:\Windows\System\BmdnWJN.exe
  C:\Windows\System\BmdnWJN.exe
  2⤵
  PID:6596
- C:\Windows\System\DnIHHVH.exe
  C:\Windows\System\DnIHHVH.exe
  2⤵
  PID:6676
- C:\Windows\System\cSezumK.exe
  C:\Windows\System\cSezumK.exe
  2⤵
  PID:6812
- C:\Windows\System\XnYWINm.exe
  C:\Windows\System\XnYWINm.exe
  2⤵
  PID:6820
- C:\Windows\System\qaYtBFv.exe
  C:\Windows\System\qaYtBFv.exe
  2⤵
  PID:6884
- C:\Windows\System\ujdnuAZ.exe
  C:\Windows\System\ujdnuAZ.exe
  2⤵
  PID:6928
- C:\Windows\System\kjTPIht.exe
  C:\Windows\System\kjTPIht.exe
  2⤵
  PID:6956
- C:\Windows\System\lRnnTJE.exe
  C:\Windows\System\lRnnTJE.exe
  2⤵
  PID:7072
- C:\Windows\System\NQsJZKi.exe
  C:\Windows\System\NQsJZKi.exe
  2⤵
  PID:6152
- C:\Windows\System\cgXAUIJ.exe
  C:\Windows\System\cgXAUIJ.exe
  2⤵
  PID:6200
- C:\Windows\System\iYfgCMD.exe
  C:\Windows\System\iYfgCMD.exe
  2⤵
  PID:6360
- C:\Windows\System\sJUjegu.exe
  C:\Windows\System\sJUjegu.exe
  2⤵
  PID:6432
- C:\Windows\System\YUCbjIV.exe
  C:\Windows\System\YUCbjIV.exe
  2⤵
  PID:6716
- C:\Windows\System\KwtTgmb.exe
  C:\Windows\System\KwtTgmb.exe
  2⤵
  PID:6784
- C:\Windows\System\PVJsGXD.exe
  C:\Windows\System\PVJsGXD.exe
  2⤵
  PID:6860
- C:\Windows\System\Pqieeix.exe
  C:\Windows\System\Pqieeix.exe
  2⤵
  PID:7016
- C:\Windows\System\LACHKdx.exe
  C:\Windows\System\LACHKdx.exe
  2⤵
  PID:6216
- C:\Windows\System\XUUUucm.exe
  C:\Windows\System\XUUUucm.exe
  2⤵
  PID:5108
- C:\Windows\System\hlRtEpC.exe
  C:\Windows\System\hlRtEpC.exe
  2⤵
  PID:6864
- C:\Windows\System\bYEPDeU.exe
  C:\Windows\System\bYEPDeU.exe
  2⤵
  PID:7044
- C:\Windows\System\alGajLr.exe
  C:\Windows\System\alGajLr.exe
  2⤵
  PID:6256
- C:\Windows\System\fBTnWYv.exe
  C:\Windows\System\fBTnWYv.exe
  2⤵
  PID:7212
- C:\Windows\System\PjEuBPG.exe
  C:\Windows\System\PjEuBPG.exe
  2⤵
  PID:7244
- C:\Windows\System\SZDqvph.exe
  C:\Windows\System\SZDqvph.exe
  2⤵
  PID:7260
- C:\Windows\System\fYxAqqs.exe
  C:\Windows\System\fYxAqqs.exe
  2⤵
  PID:7288
- C:\Windows\System\tnSLyzA.exe
  C:\Windows\System\tnSLyzA.exe
  2⤵
  PID:7320
- C:\Windows\System\LgBysuW.exe
  C:\Windows\System\LgBysuW.exe
  2⤵
  PID:7340
- C:\Windows\System\ifOtwKr.exe
  C:\Windows\System\ifOtwKr.exe
  2⤵
  PID:7364
- C:\Windows\System\ATLkqve.exe
  C:\Windows\System\ATLkqve.exe
  2⤵
  PID:7416
- C:\Windows\System\kyWJkco.exe
  C:\Windows\System\kyWJkco.exe
  2⤵
  PID:7444
- C:\Windows\System\OSblINe.exe
  C:\Windows\System\OSblINe.exe
  2⤵
  PID:7472
- C:\Windows\System\itEwEux.exe
  C:\Windows\System\itEwEux.exe
  2⤵
  PID:7492
- C:\Windows\System\qZixITT.exe
  C:\Windows\System\qZixITT.exe
  2⤵
  PID:7528
- C:\Windows\System\vOEPEfB.exe
  C:\Windows\System\vOEPEfB.exe
  2⤵
  PID:7548
- C:\Windows\System\epIAwMs.exe
  C:\Windows\System\epIAwMs.exe
  2⤵
  PID:7584
- C:\Windows\System\CXGWykK.exe
  C:\Windows\System\CXGWykK.exe
  2⤵
  PID:7608
- C:\Windows\System\wDuewSZ.exe
  C:\Windows\System\wDuewSZ.exe
  2⤵
  PID:7628
- C:\Windows\System\IcFcCOc.exe
  C:\Windows\System\IcFcCOc.exe
  2⤵
  PID:7668
- C:\Windows\System\aeavcLd.exe
  C:\Windows\System\aeavcLd.exe
  2⤵
  PID:7684
- C:\Windows\System\lLcEXTX.exe
  C:\Windows\System\lLcEXTX.exe
  2⤵
  PID:7728
- C:\Windows\System\DwJsxel.exe
  C:\Windows\System\DwJsxel.exe
  2⤵
  PID:7760
- C:\Windows\System\WvftKOr.exe
  C:\Windows\System\WvftKOr.exe
  2⤵
  PID:7788
- C:\Windows\System\NvEvGBm.exe
  C:\Windows\System\NvEvGBm.exe
  2⤵
  PID:7820
- C:\Windows\System\Ooplbgz.exe
  C:\Windows\System\Ooplbgz.exe
  2⤵
  PID:7848
- C:\Windows\System\OnrZZwd.exe
  C:\Windows\System\OnrZZwd.exe
  2⤵
  PID:7864
- C:\Windows\System\UDHaRwF.exe
  C:\Windows\System\UDHaRwF.exe
  2⤵
  PID:7880
- C:\Windows\System\JkRMJwQ.exe
  C:\Windows\System\JkRMJwQ.exe
  2⤵
  PID:7932
- C:\Windows\System\pDmzXYy.exe
  C:\Windows\System\pDmzXYy.exe
  2⤵
  PID:7952
- C:\Windows\System\HlZkFRn.exe
  C:\Windows\System\HlZkFRn.exe
  2⤵
  PID:7976
- C:\Windows\System\ykoeQQD.exe
  C:\Windows\System\ykoeQQD.exe
  2⤵
  PID:8016
- C:\Windows\System\MemRMaz.exe
  C:\Windows\System\MemRMaz.exe
  2⤵
  PID:8032
- C:\Windows\System\FNzZByq.exe
  C:\Windows\System\FNzZByq.exe
  2⤵
  PID:8072
- C:\Windows\System\fyCOKkK.exe
  C:\Windows\System\fyCOKkK.exe
  2⤵
  PID:8100
- C:\Windows\System\MNeNrlT.exe
  C:\Windows\System\MNeNrlT.exe
  2⤵
  PID:8116
- C:\Windows\System\MgjPyDV.exe
  C:\Windows\System\MgjPyDV.exe
  2⤵
  PID:8148
- C:\Windows\System\YJTpzBp.exe
  C:\Windows\System\YJTpzBp.exe
  2⤵
  PID:8172
- C:\Windows\System\wPixOeb.exe
  C:\Windows\System\wPixOeb.exe
  2⤵
  PID:6616
- C:\Windows\System\ZsbZQoj.exe
  C:\Windows\System\ZsbZQoj.exe
  2⤵
  PID:7240
- C:\Windows\System\mxccNpT.exe
  C:\Windows\System\mxccNpT.exe
  2⤵
  PID:7328
- C:\Windows\System\kXmxfrj.exe
  C:\Windows\System\kXmxfrj.exe
  2⤵
  PID:7352
- C:\Windows\System\KPceyeu.exe
  C:\Windows\System\KPceyeu.exe
  2⤵
  PID:7432
- C:\Windows\System\ODSHDgk.exe
  C:\Windows\System\ODSHDgk.exe
  2⤵
  PID:7456
- C:\Windows\System\URQFTGb.exe
  C:\Windows\System\URQFTGb.exe
  2⤵
  PID:7524
- C:\Windows\System\tdyRgPn.exe
  C:\Windows\System\tdyRgPn.exe
  2⤵
  PID:7544
- C:\Windows\System\xQhhShR.exe
  C:\Windows\System\xQhhShR.exe
  2⤵
  PID:7644
- C:\Windows\System\GFMbAND.exe
  C:\Windows\System\GFMbAND.exe
  2⤵
  PID:7700
- C:\Windows\System\LHxMjQs.exe
  C:\Windows\System\LHxMjQs.exe
  2⤵
  PID:7776
- C:\Windows\System\CIvFodA.exe
  C:\Windows\System\CIvFodA.exe
  2⤵
  PID:7840
- C:\Windows\System\CTjaWfp.exe
  C:\Windows\System\CTjaWfp.exe
  2⤵
  PID:7900
- C:\Windows\System\XVUfhPX.exe
  C:\Windows\System\XVUfhPX.exe
  2⤵
  PID:7948
- C:\Windows\System\cVyHSNx.exe
  C:\Windows\System\cVyHSNx.exe
  2⤵
  PID:8028
- C:\Windows\System\hfgQBBM.exe
  C:\Windows\System\hfgQBBM.exe
  2⤵
  PID:8112
- C:\Windows\System\uuqRzBL.exe
  C:\Windows\System\uuqRzBL.exe
  2⤵
  PID:8136
- C:\Windows\System\RPnysWR.exe
  C:\Windows\System\RPnysWR.exe
  2⤵
  PID:7208
- C:\Windows\System\UXBGEHE.exe
  C:\Windows\System\UXBGEHE.exe
  2⤵
  PID:7412
- C:\Windows\System\JfYukAQ.exe
  C:\Windows\System\JfYukAQ.exe
  2⤵
  PID:7540
- C:\Windows\System\EmrmZbE.exe
  C:\Windows\System\EmrmZbE.exe
  2⤵
  PID:7756
- C:\Windows\System\xvfZPbz.exe
  C:\Windows\System\xvfZPbz.exe
  2⤵
  PID:7660
- C:\Windows\System\ggvlLvZ.exe
  C:\Windows\System\ggvlLvZ.exe
  2⤵
  PID:7908
- C:\Windows\System\xisNYsB.exe
  C:\Windows\System\xisNYsB.exe
  2⤵
  PID:8132
- C:\Windows\System\jBzutDw.exe
  C:\Windows\System\jBzutDw.exe
  2⤵
  PID:7300
- C:\Windows\System\HaNdSWx.exe
  C:\Windows\System\HaNdSWx.exe
  2⤵
  PID:7360
- C:\Windows\System\bYYHfdT.exe
  C:\Windows\System\bYYHfdT.exe
  2⤵
  PID:4172
- C:\Windows\System\IwQAKJj.exe
  C:\Windows\System\IwQAKJj.exe
  2⤵
  PID:7992
- C:\Windows\System\xBskGUe.exe
  C:\Windows\System\xBskGUe.exe
  2⤵
  PID:8200
- C:\Windows\System\tTprfAy.exe
  C:\Windows\System\tTprfAy.exe
  2⤵
  PID:8224
- C:\Windows\System\gXJKDtx.exe
  C:\Windows\System\gXJKDtx.exe
  2⤵
  PID:8248
- C:\Windows\System\gBfkerh.exe
  C:\Windows\System\gBfkerh.exe
  2⤵
  PID:8288
- C:\Windows\System\kPKJmvD.exe
  C:\Windows\System\kPKJmvD.exe
  2⤵
  PID:8316
- C:\Windows\System\ULIiPrU.exe
  C:\Windows\System\ULIiPrU.exe
  2⤵
  PID:8332
- C:\Windows\System\mtluFoD.exe
  C:\Windows\System\mtluFoD.exe
  2⤵
  PID:8372
- C:\Windows\System\GHWSkKZ.exe
  C:\Windows\System\GHWSkKZ.exe
  2⤵
  PID:8388
- C:\Windows\System\KPSMZQS.exe
  C:\Windows\System\KPSMZQS.exe
  2⤵
  PID:8424
- C:\Windows\System\tLzolbW.exe
  C:\Windows\System\tLzolbW.exe
  2⤵
  PID:8444
- C:\Windows\System\FbskJTZ.exe
  C:\Windows\System\FbskJTZ.exe
  2⤵
  PID:8460
- C:\Windows\System\lxMQNFA.exe
  C:\Windows\System\lxMQNFA.exe
  2⤵
  PID:8488
- C:\Windows\System\RuusDnD.exe
  C:\Windows\System\RuusDnD.exe
  2⤵
  PID:8524
- C:\Windows\System\ebQSqov.exe
  C:\Windows\System\ebQSqov.exe
  2⤵
  PID:8564
- C:\Windows\System\mPBUvAh.exe
  C:\Windows\System\mPBUvAh.exe
  2⤵
  PID:8596
- C:\Windows\System\SBqUPWm.exe
  C:\Windows\System\SBqUPWm.exe
  2⤵
  PID:8620
- C:\Windows\System\sgpFWlE.exe
  C:\Windows\System\sgpFWlE.exe
  2⤵
  PID:8640
- C:\Windows\System\ncURVhb.exe
  C:\Windows\System\ncURVhb.exe
  2⤵
  PID:8672
- C:\Windows\System\qVadvzX.exe
  C:\Windows\System\qVadvzX.exe
  2⤵
  PID:8696
- C:\Windows\System\nvwhEuL.exe
  C:\Windows\System\nvwhEuL.exe
  2⤵
  PID:8728
- C:\Windows\System\OLoUZzh.exe
  C:\Windows\System\OLoUZzh.exe
  2⤵
  PID:8752
- C:\Windows\System\NIhwVLa.exe
  C:\Windows\System\NIhwVLa.exe
  2⤵
  PID:8780
- C:\Windows\System\fRaqtkE.exe
  C:\Windows\System\fRaqtkE.exe
  2⤵
  PID:8820
- C:\Windows\System\VxEOlkW.exe
  C:\Windows\System\VxEOlkW.exe
  2⤵
  PID:8848
- C:\Windows\System\cUDoemA.exe
  C:\Windows\System\cUDoemA.exe
  2⤵
  PID:8876
- C:\Windows\System\gUGTqDT.exe
  C:\Windows\System\gUGTqDT.exe
  2⤵
  PID:8904
- C:\Windows\System\kVXysgi.exe
  C:\Windows\System\kVXysgi.exe
  2⤵
  PID:8920
- C:\Windows\System\raVlJSo.exe
  C:\Windows\System\raVlJSo.exe
  2⤵
  PID:8944
- C:\Windows\System\eVFJjwP.exe
  C:\Windows\System\eVFJjwP.exe
  2⤵
  PID:8980
- C:\Windows\System\OapQhig.exe
  C:\Windows\System\OapQhig.exe
  2⤵
  PID:9016
- C:\Windows\System\jVSypry.exe
  C:\Windows\System\jVSypry.exe
  2⤵
  PID:9044
- C:\Windows\System\LipqHjX.exe
  C:\Windows\System\LipqHjX.exe
  2⤵
  PID:9072
- C:\Windows\System\umFECaX.exe
  C:\Windows\System\umFECaX.exe
  2⤵
  PID:9100
- C:\Windows\System\euEywNo.exe
  C:\Windows\System\euEywNo.exe
  2⤵
  PID:9116
- C:\Windows\System\drxRYBG.exe
  C:\Windows\System\drxRYBG.exe
  2⤵
  PID:9156
- C:\Windows\System\FLdLVXW.exe
  C:\Windows\System\FLdLVXW.exe
  2⤵
  PID:9184
- C:\Windows\System\uMhxMFN.exe
  C:\Windows\System\uMhxMFN.exe
  2⤵
  PID:9212
- C:\Windows\System\KKkaEWL.exe
  C:\Windows\System\KKkaEWL.exe
  2⤵
  PID:8208
- C:\Windows\System\LxjxSfY.exe
  C:\Windows\System\LxjxSfY.exe
  2⤵
  PID:8268
- C:\Windows\System\IlmQAWR.exe
  C:\Windows\System\IlmQAWR.exe
  2⤵
  PID:8324
- C:\Windows\System\qVpbgfh.exe
  C:\Windows\System\qVpbgfh.exe
  2⤵
  PID:8408
- C:\Windows\System\pxJpWpc.exe
  C:\Windows\System\pxJpWpc.exe
  2⤵
  PID:8436
- C:\Windows\System\dMnwbQN.exe
  C:\Windows\System\dMnwbQN.exe
  2⤵
  PID:8484
- C:\Windows\System\RNiDqXo.exe
  C:\Windows\System\RNiDqXo.exe
  2⤵
  PID:8580
- C:\Windows\System\TMcdltC.exe
  C:\Windows\System\TMcdltC.exe
  2⤵
  PID:8684
- C:\Windows\System\dSonvPq.exe
  C:\Windows\System\dSonvPq.exe
  2⤵
  PID:8716
- C:\Windows\System\kjrftps.exe
  C:\Windows\System\kjrftps.exe
  2⤵
  PID:8796
- C:\Windows\System\Eaovccv.exe
  C:\Windows\System\Eaovccv.exe
  2⤵
  PID:8868
- C:\Windows\System\SBDTBnm.exe
  C:\Windows\System\SBDTBnm.exe
  2⤵
  PID:8916
- C:\Windows\System\FUeSFmj.exe
  C:\Windows\System\FUeSFmj.exe
  2⤵
  PID:8972
- C:\Windows\System\swDOaSj.exe
  C:\Windows\System\swDOaSj.exe
  2⤵
  PID:9004
- C:\Windows\System\hxQdRfv.exe
  C:\Windows\System\hxQdRfv.exe
  2⤵
  PID:9036
- C:\Windows\System\yenYBQB.exe
  C:\Windows\System\yenYBQB.exe
  2⤵
  PID:9144
- C:\Windows\System\PlUGKJj.exe
  C:\Windows\System\PlUGKJj.exe
  2⤵
  PID:9200
- C:\Windows\System\lIXyHiS.exe
  C:\Windows\System\lIXyHiS.exe
  2⤵
  PID:8300
- C:\Windows\System\HuHwORE.exe
  C:\Windows\System\HuHwORE.exe
  2⤵
  PID:8512
- C:\Windows\System\PgFlxsd.exe
  C:\Windows\System\PgFlxsd.exe
  2⤵
  PID:8664
- C:\Windows\System\BwsFyQI.exe
  C:\Windows\System\BwsFyQI.exe
  2⤵
  PID:8764
- C:\Windows\System\xCvLBtC.exe
  C:\Windows\System\xCvLBtC.exe
  2⤵
  PID:8840
- C:\Windows\System\LRgSobD.exe
  C:\Windows\System\LRgSobD.exe
  2⤵
  PID:9064
- C:\Windows\System\pDzAXSJ.exe
  C:\Windows\System\pDzAXSJ.exe
  2⤵
  PID:8280
- C:\Windows\System\nwLxBNM.exe
  C:\Windows\System\nwLxBNM.exe
  2⤵
  PID:8680
- C:\Windows\System\QVZXqQV.exe
  C:\Windows\System\QVZXqQV.exe
  2⤵
  PID:9084
- C:\Windows\System\jGvRmci.exe
  C:\Windows\System\jGvRmci.exe
  2⤵
  PID:8932
- C:\Windows\System\BxgEnro.exe
  C:\Windows\System\BxgEnro.exe
  2⤵
  PID:9224
- C:\Windows\System\iLmKrYz.exe
  C:\Windows\System\iLmKrYz.exe
  2⤵
  PID:9248
- C:\Windows\System\ViTaKsE.exe
  C:\Windows\System\ViTaKsE.exe
  2⤵
  PID:9268
- C:\Windows\System\itlPDnJ.exe
  C:\Windows\System\itlPDnJ.exe
  2⤵
  PID:9292
- C:\Windows\System\rsfVDAA.exe
  C:\Windows\System\rsfVDAA.exe
  2⤵
  PID:9308
- C:\Windows\System\zonjyZk.exe
  C:\Windows\System\zonjyZk.exe
  2⤵
  PID:9336
- C:\Windows\System\vknEHyR.exe
  C:\Windows\System\vknEHyR.exe
  2⤵
  PID:9404
- C:\Windows\System\VdyWGNY.exe
  C:\Windows\System\VdyWGNY.exe
  2⤵
  PID:9444
- C:\Windows\System\EvaNSjM.exe
  C:\Windows\System\EvaNSjM.exe
  2⤵
  PID:9472
- C:\Windows\System\JCkByGp.exe
  C:\Windows\System\JCkByGp.exe
  2⤵
  PID:9488
- C:\Windows\System\ksKGMcX.exe
  C:\Windows\System\ksKGMcX.exe
  2⤵
  PID:9516
- C:\Windows\System\lBwhNqv.exe
  C:\Windows\System\lBwhNqv.exe
  2⤵
  PID:9544
- C:\Windows\System\qBsNHex.exe
  C:\Windows\System\qBsNHex.exe
  2⤵
  PID:9572
- C:\Windows\System\ZUZoyzk.exe
  C:\Windows\System\ZUZoyzk.exe
  2⤵
  PID:9596
- C:\Windows\System\AzFjXrT.exe
  C:\Windows\System\AzFjXrT.exe
  2⤵
  PID:9628
- C:\Windows\System\kwBxJfs.exe
  C:\Windows\System\kwBxJfs.exe
  2⤵
  PID:9668
- C:\Windows\System\wpuwOJC.exe
  C:\Windows\System\wpuwOJC.exe
  2⤵
  PID:9696
- C:\Windows\System\RLyBJIr.exe
  C:\Windows\System\RLyBJIr.exe
  2⤵
  PID:9728
- C:\Windows\System\CjPTEyP.exe
  C:\Windows\System\CjPTEyP.exe
  2⤵
  PID:9756
- C:\Windows\System\eOKHPzt.exe
  C:\Windows\System\eOKHPzt.exe
  2⤵
  PID:9784
- C:\Windows\System\eHiOxod.exe
  C:\Windows\System\eHiOxod.exe
  2⤵
  PID:9812
- C:\Windows\System\dQxQvNU.exe
  C:\Windows\System\dQxQvNU.exe
  2⤵
  PID:9832
- C:\Windows\System\iovkrjn.exe
  C:\Windows\System\iovkrjn.exe
  2⤵
  PID:9856
- C:\Windows\System\vvPlLdC.exe
  C:\Windows\System\vvPlLdC.exe
  2⤵
  PID:9888
- C:\Windows\System\ifrkKJx.exe
  C:\Windows\System\ifrkKJx.exe
  2⤵
  PID:9912
- C:\Windows\System\tCwDHCD.exe
  C:\Windows\System\tCwDHCD.exe
  2⤵
  PID:9936
- C:\Windows\System\vVtYaYj.exe
  C:\Windows\System\vVtYaYj.exe
  2⤵
  PID:9968
- C:\Windows\System\GltHSSI.exe
  C:\Windows\System\GltHSSI.exe
  2⤵
  PID:9996
- C:\Windows\System\Tqxodyg.exe
  C:\Windows\System\Tqxodyg.exe
  2⤵
  PID:10036
- C:\Windows\System\iwXfxWZ.exe
  C:\Windows\System\iwXfxWZ.exe
  2⤵
  PID:10052
- C:\Windows\System\BjdFfsH.exe
  C:\Windows\System\BjdFfsH.exe
  2⤵
  PID:10080
- C:\Windows\System\LJeFFkN.exe
  C:\Windows\System\LJeFFkN.exe
  2⤵
  PID:10100
- C:\Windows\System\xCJeoyn.exe
  C:\Windows\System\xCJeoyn.exe
  2⤵
  PID:10140
- C:\Windows\System\CNxyRxB.exe
  C:\Windows\System\CNxyRxB.exe
  2⤵
  PID:10164
- C:\Windows\System\Ginjxhi.exe
  C:\Windows\System\Ginjxhi.exe
  2⤵
  PID:10188
- C:\Windows\System\hIlOBSp.exe
  C:\Windows\System\hIlOBSp.exe
  2⤵
  PID:10208
- C:\Windows\System\ClrASck.exe
  C:\Windows\System\ClrASck.exe
  2⤵
  PID:10236
- C:\Windows\System\UceieTG.exe
  C:\Windows\System\UceieTG.exe
  2⤵
  PID:8964
- C:\Windows\System\fvdxLZS.exe
  C:\Windows\System\fvdxLZS.exe
  2⤵
  PID:9332
- C:\Windows\System\WidFVNR.exe
  C:\Windows\System\WidFVNR.exe
  2⤵
  PID:9388
- C:\Windows\System\aqEcEon.exe
  C:\Windows\System\aqEcEon.exe
  2⤵
  PID:8196
- C:\Windows\System\SNbWtaq.exe
  C:\Windows\System\SNbWtaq.exe
  2⤵
  PID:9504
- C:\Windows\System\CeEzBvb.exe
  C:\Windows\System\CeEzBvb.exe
  2⤵
  PID:9540
- C:\Windows\System\sdTmCRk.exe
  C:\Windows\System\sdTmCRk.exe
  2⤵
  PID:9644
- C:\Windows\System\HSeQcAo.exe
  C:\Windows\System\HSeQcAo.exe
  2⤵
  PID:9708
- C:\Windows\System\MXeFwPE.exe
  C:\Windows\System\MXeFwPE.exe
  2⤵
  PID:9796
- C:\Windows\System\eTxBeeU.exe
  C:\Windows\System\eTxBeeU.exe
  2⤵
  PID:9844
- C:\Windows\System\nOtPoyf.exe
  C:\Windows\System\nOtPoyf.exe
  2⤵
  PID:9928
- C:\Windows\System\TJoRywl.exe
  C:\Windows\System\TJoRywl.exe
  2⤵
  PID:9988
- C:\Windows\System\iZETFFg.exe
  C:\Windows\System\iZETFFg.exe
  2⤵
  PID:10024
- C:\Windows\System\wOkzwmx.exe
  C:\Windows\System\wOkzwmx.exe
  2⤵
  PID:10132
- C:\Windows\System\lywDfix.exe
  C:\Windows\System\lywDfix.exe
  2⤵
  PID:10180
- C:\Windows\System\LrragzN.exe
  C:\Windows\System\LrragzN.exe
  2⤵
  PID:10220
- C:\Windows\System\kreeXiB.exe
  C:\Windows\System\kreeXiB.exe
  2⤵
  PID:9368
- C:\Windows\System\LaENxdi.exe
  C:\Windows\System\LaENxdi.exe
  2⤵
  PID:9440
- C:\Windows\System\QXAdElc.exe
  C:\Windows\System\QXAdElc.exe
  2⤵
  PID:9664
- C:\Windows\System\DBYaECW.exe
  C:\Windows\System\DBYaECW.exe
  2⤵
  PID:9692
- C:\Windows\System\IvDVJhO.exe
  C:\Windows\System\IvDVJhO.exe
  2⤵
  PID:9876
- C:\Windows\System\ygEZGlj.exe
  C:\Windows\System\ygEZGlj.exe
  2⤵
  PID:10028
- C:\Windows\System\ynwCach.exe
  C:\Windows\System\ynwCach.exe
  2⤵
  PID:10112
- C:\Windows\System\xbuEegy.exe
  C:\Windows\System\xbuEegy.exe
  2⤵
  PID:9556
- C:\Windows\System\keWzJGK.exe
  C:\Windows\System\keWzJGK.exe
  2⤵
  PID:9956
- C:\Windows\System\mniJefY.exe
  C:\Windows\System\mniJefY.exe
  2⤵
  PID:10064
- C:\Windows\System\IVaguDa.exe
  C:\Windows\System\IVaguDa.exe
  2⤵
  PID:9828
- C:\Windows\System\EhIECAO.exe
  C:\Windows\System\EhIECAO.exe
  2⤵
  PID:10276
- C:\Windows\System\JsHfYAl.exe
  C:\Windows\System\JsHfYAl.exe
  2⤵
  PID:10304
- C:\Windows\System\xtKaIQK.exe
  C:\Windows\System\xtKaIQK.exe
  2⤵
  PID:10332
- C:\Windows\System\xkfCShk.exe
  C:\Windows\System\xkfCShk.exe
  2⤵
  PID:10352
- C:\Windows\System\ofeLzVJ.exe
  C:\Windows\System\ofeLzVJ.exe
  2⤵
  PID:10388
- C:\Windows\System\ToYEvcq.exe
  C:\Windows\System\ToYEvcq.exe
  2⤵
  PID:10404
- C:\Windows\System\mxVEAoc.exe
  C:\Windows\System\mxVEAoc.exe
  2⤵
  PID:10424
- C:\Windows\System\yAAYLks.exe
  C:\Windows\System\yAAYLks.exe
  2⤵
  PID:10448
- C:\Windows\System\WqTrtny.exe
  C:\Windows\System\WqTrtny.exe
  2⤵
  PID:10476
- C:\Windows\System\ribkDNS.exe
  C:\Windows\System\ribkDNS.exe
  2⤵
  PID:10508
- C:\Windows\System\LQFyVeA.exe
  C:\Windows\System\LQFyVeA.exe
  2⤵
  PID:10532
- C:\Windows\System\ARGeWAQ.exe
  C:\Windows\System\ARGeWAQ.exe
  2⤵
  PID:10572
- C:\Windows\System\FuGZWVI.exe
  C:\Windows\System\FuGZWVI.exe
  2⤵
  PID:10596
- C:\Windows\System\wFUQYzz.exe
  C:\Windows\System\wFUQYzz.exe
  2⤵
  PID:10616
- C:\Windows\System\sIPAKeX.exe
  C:\Windows\System\sIPAKeX.exe
  2⤵
  PID:10632
- C:\Windows\System\RJoZPPH.exe
  C:\Windows\System\RJoZPPH.exe
  2⤵
  PID:10648
- C:\Windows\System\NqXFRbP.exe
  C:\Windows\System\NqXFRbP.exe
  2⤵
  PID:10672
- C:\Windows\System\gaYcFak.exe
  C:\Windows\System\gaYcFak.exe
  2⤵
  PID:10704
- C:\Windows\System\OIOqDiu.exe
  C:\Windows\System\OIOqDiu.exe
  2⤵
  PID:10760
- C:\Windows\System\MuBlRNn.exe
  C:\Windows\System\MuBlRNn.exe
  2⤵
  PID:10796
- C:\Windows\System\BNwnJlT.exe
  C:\Windows\System\BNwnJlT.exe
  2⤵
  PID:10824
- C:\Windows\System\IsRAfEW.exe
  C:\Windows\System\IsRAfEW.exe
  2⤵
  PID:10852
- C:\Windows\System\XhYYhRD.exe
  C:\Windows\System\XhYYhRD.exe
  2⤵
  PID:10876
- C:\Windows\System\ijIshcD.exe
  C:\Windows\System\ijIshcD.exe
  2⤵
  PID:10916
- C:\Windows\System\wXlRfqi.exe
  C:\Windows\System\wXlRfqi.exe
  2⤵
  PID:10944
- C:\Windows\System\hJRSllf.exe
  C:\Windows\System\hJRSllf.exe
  2⤵
  PID:10964
- C:\Windows\System\aBZCNvn.exe
  C:\Windows\System\aBZCNvn.exe
  2⤵
  PID:10988
- C:\Windows\System\EEuDpcD.exe
  C:\Windows\System\EEuDpcD.exe
  2⤵
  PID:11020
- C:\Windows\System\LhvNoEa.exe
  C:\Windows\System\LhvNoEa.exe
  2⤵
  PID:11052
- C:\Windows\System\PyvjCkA.exe
  C:\Windows\System\PyvjCkA.exe
  2⤵
  PID:11076
- C:\Windows\System\QqAvINw.exe
  C:\Windows\System\QqAvINw.exe
  2⤵
  PID:11104
- C:\Windows\System\JlazTBk.exe
  C:\Windows\System\JlazTBk.exe
  2⤵
  PID:11144
- C:\Windows\System\RxWUcMK.exe
  C:\Windows\System\RxWUcMK.exe
  2⤵
  PID:11160
- C:\Windows\System\kpRUGYo.exe
  C:\Windows\System\kpRUGYo.exe
  2⤵
  PID:11176
- C:\Windows\System\zpbWweG.exe
  C:\Windows\System\zpbWweG.exe
  2⤵
  PID:11192
- C:\Windows\System\FZGSmyc.exe
  C:\Windows\System\FZGSmyc.exe
  2⤵
  PID:11220
- C:\Windows\System\UpAWkbY.exe
  C:\Windows\System\UpAWkbY.exe
  2⤵
  PID:11256
- C:\Windows\System\NiNwKVg.exe
  C:\Windows\System\NiNwKVg.exe
  2⤵
  PID:10252
- C:\Windows\System\NiaLNXC.exe
  C:\Windows\System\NiaLNXC.exe
  2⤵
  PID:10320
- C:\Windows\System\SszdaYN.exe
  C:\Windows\System\SszdaYN.exe
  2⤵
  PID:10460
- C:\Windows\System\OXIOWcV.exe
  C:\Windows\System\OXIOWcV.exe
  2⤵
  PID:10556
- C:\Windows\System\VWAlIPZ.exe
  C:\Windows\System\VWAlIPZ.exe
  2⤵
  PID:10540
- C:\Windows\System\cYSjuEs.exe
  C:\Windows\System\cYSjuEs.exe
  2⤵
  PID:10624
- C:\Windows\System\QQBNdIf.exe
  C:\Windows\System\QQBNdIf.exe
  2⤵
  PID:10700
- C:\Windows\System\NpIlkbQ.exe
  C:\Windows\System\NpIlkbQ.exe
  2⤵
  PID:10692
- C:\Windows\System\wnNqDMV.exe
  C:\Windows\System\wnNqDMV.exe
  2⤵
  PID:10752
- C:\Windows\System\cOJuQWi.exe
  C:\Windows\System\cOJuQWi.exe
  2⤵
  PID:10840
- C:\Windows\System\hsBmUFQ.exe
  C:\Windows\System\hsBmUFQ.exe
  2⤵
  PID:10932
- C:\Windows\System\HCjASvo.exe
  C:\Windows\System\HCjASvo.exe
  2⤵
  PID:10976
- C:\Windows\System\UrdgZrN.exe
  C:\Windows\System\UrdgZrN.exe
  2⤵
  PID:11036
- C:\Windows\System\gTHMYGu.exe
  C:\Windows\System\gTHMYGu.exe
  2⤵
  PID:11092
- C:\Windows\System\qQxukcz.exe
  C:\Windows\System\qQxukcz.exe
  2⤵
  PID:11204
- C:\Windows\System\DeWWWpV.exe
  C:\Windows\System\DeWWWpV.exe
  2⤵
  PID:10364
- C:\Windows\System\qNGmGIO.exe
  C:\Windows\System\qNGmGIO.exe
  2⤵
  PID:8832
- C:\Windows\System\wKIDzfP.exe
  C:\Windows\System\wKIDzfP.exe
  2⤵
  PID:10496
- C:\Windows\System\SOpJmEq.exe
  C:\Windows\System\SOpJmEq.exe
  2⤵
  PID:10816
- C:\Windows\System\czcrQOu.exe
  C:\Windows\System\czcrQOu.exe
  2⤵
  PID:10668
- C:\Windows\System\AcymJiJ.exe
  C:\Windows\System\AcymJiJ.exe
  2⤵
  PID:11068
- C:\Windows\System\XWDgcyK.exe
  C:\Windows\System\XWDgcyK.exe
  2⤵
  PID:11244
- C:\Windows\System\pSWcCnS.exe
  C:\Windows\System\pSWcCnS.exe
  2⤵
  PID:10288
- C:\Windows\System\sFInAVd.exe
  C:\Windows\System\sFInAVd.exe
  2⤵
  PID:10416
- C:\Windows\System\kUCQEYX.exe
  C:\Windows\System\kUCQEYX.exe
  2⤵
  PID:10908
- C:\Windows\System\TLOXilY.exe
  C:\Windows\System\TLOXilY.exe
  2⤵
  PID:11228
- C:\Windows\System\bejNqtQ.exe
  C:\Windows\System\bejNqtQ.exe
  2⤵
  PID:11284
- C:\Windows\System\PUiZLCD.exe
  C:\Windows\System\PUiZLCD.exe
  2⤵
  PID:11308
- C:\Windows\System\bDGvuzM.exe
  C:\Windows\System\bDGvuzM.exe
  2⤵
  PID:11336
- C:\Windows\System\aPiLAXe.exe
  C:\Windows\System\aPiLAXe.exe
  2⤵
  PID:11364
- C:\Windows\System\jDzSPlO.exe
  C:\Windows\System\jDzSPlO.exe
  2⤵
  PID:11404
- C:\Windows\System\nnxcfVw.exe
  C:\Windows\System\nnxcfVw.exe
  2⤵
  PID:11432
- C:\Windows\System\yrxmyZI.exe
  C:\Windows\System\yrxmyZI.exe
  2⤵
  PID:11448
- C:\Windows\System\rvlgNtM.exe
  C:\Windows\System\rvlgNtM.exe
  2⤵
  PID:11476
- C:\Windows\System\CxGBsmh.exe
  C:\Windows\System\CxGBsmh.exe
  2⤵
  PID:11504
- C:\Windows\System\IJaheeb.exe
  C:\Windows\System\IJaheeb.exe
  2⤵
  PID:11532
- C:\Windows\System\soufxnP.exe
  C:\Windows\System\soufxnP.exe
  2⤵
  PID:11560
- C:\Windows\System\nDmuYaZ.exe
  C:\Windows\System\nDmuYaZ.exe
  2⤵
  PID:11580
- C:\Windows\System\MABfWkt.exe
  C:\Windows\System\MABfWkt.exe
  2⤵
  PID:11608
- C:\Windows\System\SwfMeoY.exe
  C:\Windows\System\SwfMeoY.exe
  2⤵
  PID:11656
- C:\Windows\System\zFPUcRW.exe
  C:\Windows\System\zFPUcRW.exe
  2⤵
  PID:11672
- C:\Windows\System\SgVcWYL.exe
  C:\Windows\System\SgVcWYL.exe
  2⤵
  PID:11700
- C:\Windows\System\ETdTZTn.exe
  C:\Windows\System\ETdTZTn.exe
  2⤵
  PID:11728
- C:\Windows\System\ReuCuTo.exe
  C:\Windows\System\ReuCuTo.exe
  2⤵
  PID:11756
- C:\Windows\System\yowKxkP.exe
  C:\Windows\System\yowKxkP.exe
  2⤵
  PID:11776
- C:\Windows\System\qqxVEvZ.exe
  C:\Windows\System\qqxVEvZ.exe
  2⤵
  PID:11812
- C:\Windows\System\HMpogJQ.exe
  C:\Windows\System\HMpogJQ.exe
  2⤵
  PID:11828
- C:\Windows\System\dlEfCta.exe
  C:\Windows\System\dlEfCta.exe
  2⤵
  PID:11844
- C:\Windows\System\cDrBAau.exe
  C:\Windows\System\cDrBAau.exe
  2⤵
  PID:11868
- C:\Windows\System\vorLknB.exe
  C:\Windows\System\vorLknB.exe
  2⤵
  PID:11888
- C:\Windows\System\wcBsTIx.exe
  C:\Windows\System\wcBsTIx.exe
  2⤵
  PID:11920
- C:\Windows\System\CdLavlh.exe
  C:\Windows\System\CdLavlh.exe
  2⤵
  PID:11992
- C:\Windows\System\Sfajmvt.exe
  C:\Windows\System\Sfajmvt.exe
  2⤵
  PID:12008
- C:\Windows\System\xEeObfW.exe
  C:\Windows\System\xEeObfW.exe
  2⤵
  PID:12036
- C:\Windows\System\PSwqWju.exe
  C:\Windows\System\PSwqWju.exe
  2⤵
  PID:12068
- C:\Windows\System\JeBizta.exe
  C:\Windows\System\JeBizta.exe
  2⤵
  PID:12104
- C:\Windows\System\njYTeXD.exe
  C:\Windows\System\njYTeXD.exe
  2⤵
  PID:12132
- C:\Windows\System\GCicSxb.exe
  C:\Windows\System\GCicSxb.exe
  2⤵
  PID:12148
- C:\Windows\System\KetYRFw.exe
  C:\Windows\System\KetYRFw.exe
  2⤵
  PID:12172
- C:\Windows\System\gNYDyHc.exe
  C:\Windows\System\gNYDyHc.exe
  2⤵
  PID:12204
- C:\Windows\System\hGwNvHz.exe
  C:\Windows\System\hGwNvHz.exe
  2⤵
  PID:12228
- C:\Windows\System\QPTGIVA.exe
  C:\Windows\System\QPTGIVA.exe
  2⤵
  PID:12260
- C:\Windows\System\mqcyDxB.exe
  C:\Windows\System\mqcyDxB.exe
  2⤵
  PID:11268
- C:\Windows\System\weVuThl.exe
  C:\Windows\System\weVuThl.exe
  2⤵
  PID:11304
- C:\Windows\System\bsZSMRx.exe
  C:\Windows\System\bsZSMRx.exe
  2⤵
  PID:11356
- C:\Windows\System\tPCzyUe.exe
  C:\Windows\System\tPCzyUe.exe
  2⤵
  PID:11400
- C:\Windows\System\FcJTASH.exe
  C:\Windows\System\FcJTASH.exe
  2⤵
  PID:11472
- C:\Windows\System\msZYKhx.exe
  C:\Windows\System\msZYKhx.exe
  2⤵
  PID:11524
- C:\Windows\System\fNZmEjZ.exe
  C:\Windows\System\fNZmEjZ.exe
  2⤵
  PID:11688
- C:\Windows\System\FipHQjs.exe
  C:\Windows\System\FipHQjs.exe
  2⤵
  PID:11796
- C:\Windows\System\MnJhZVK.exe
  C:\Windows\System\MnJhZVK.exe
  2⤵
  PID:11820
- C:\Windows\System\dKMJsZs.exe
  C:\Windows\System\dKMJsZs.exe
  2⤵
  PID:11912
- C:\Windows\System\HcVFwyS.exe
  C:\Windows\System\HcVFwyS.exe
  2⤵
  PID:11944
- C:\Windows\System\fqAVyfh.exe
  C:\Windows\System\fqAVyfh.exe
  2⤵
  PID:12000
- C:\Windows\System\VTQLgjr.exe
  C:\Windows\System\VTQLgjr.exe
  2⤵
  PID:12096
- C:\Windows\System\zqWjQre.exe
  C:\Windows\System\zqWjQre.exe
  2⤵
  PID:12144
- C:\Windows\System\NwpChJo.exe
  C:\Windows\System\NwpChJo.exe
  2⤵
  PID:12200
- C:\Windows\System\sADGLty.exe
  C:\Windows\System\sADGLty.exe
  2⤵
  PID:12276
- C:\Windows\System\bUPNrqX.exe
  C:\Windows\System\bUPNrqX.exe
  2⤵
  PID:11328
- C:\Windows\System\ECchsHK.exe
  C:\Windows\System\ECchsHK.exe
  2⤵
  PID:11468
- C:\Windows\System\fTucCdC.exe
  C:\Windows\System\fTucCdC.exe
  2⤵
  PID:11668
- C:\Windows\System\KbzXyVh.exe
  C:\Windows\System\KbzXyVh.exe
  2⤵
  PID:11772
- C:\Windows\System\vOObFXR.exe
  C:\Windows\System\vOObFXR.exe
  2⤵
  PID:11988
- C:\Windows\System\gjaILDu.exe
  C:\Windows\System\gjaILDu.exe
  2⤵
  PID:12064
- C:\Windows\System\bisDIiG.exe
  C:\Windows\System\bisDIiG.exe
  2⤵
  PID:12168
- C:\Windows\System\AUaXRBZ.exe
  C:\Windows\System\AUaXRBZ.exe
  2⤵
  PID:11384
- C:\Windows\System\IAJCIHi.exe
  C:\Windows\System\IAJCIHi.exe
  2⤵
  PID:11860
- C:\Windows\System\VMSljnx.exe
  C:\Windows\System\VMSljnx.exe
  2⤵
  PID:10728
- C:\Windows\System\sJEjtRf.exe
  C:\Windows\System\sJEjtRf.exe
  2⤵
  PID:12216
- C:\Windows\System\BkeHxgJ.exe
  C:\Windows\System\BkeHxgJ.exe
  2⤵
  PID:12304
- C:\Windows\System\RJcZqTr.exe
  C:\Windows\System\RJcZqTr.exe
  2⤵
  PID:12332
- C:\Windows\System\PzUqWSy.exe
  C:\Windows\System\PzUqWSy.exe
  2⤵
  PID:12384
- C:\Windows\System\mnZxnSA.exe
  C:\Windows\System\mnZxnSA.exe
  2⤵
  PID:12400
- C:\Windows\System\QZvtSzu.exe
  C:\Windows\System\QZvtSzu.exe
  2⤵
  PID:12428
- C:\Windows\System\yKbqymI.exe
  C:\Windows\System\yKbqymI.exe
  2⤵
  PID:12456
- C:\Windows\System\cdjcIxn.exe
  C:\Windows\System\cdjcIxn.exe
  2⤵
  PID:12496
- C:\Windows\System\uzUEMsx.exe
  C:\Windows\System\uzUEMsx.exe
  2⤵
  PID:12524
- C:\Windows\System\GjtunOR.exe
  C:\Windows\System\GjtunOR.exe
  2⤵
  PID:12552
- C:\Windows\System\rUDhukj.exe
  C:\Windows\System\rUDhukj.exe
  2⤵
  PID:12572
- C:\Windows\System\ekFkZiX.exe
  C:\Windows\System\ekFkZiX.exe
  2⤵
  PID:12600
- C:\Windows\System\GUwESRq.exe
  C:\Windows\System\GUwESRq.exe
  2⤵
  PID:12624
- C:\Windows\System\KjbbVHQ.exe
  C:\Windows\System\KjbbVHQ.exe
  2⤵
  PID:12648
- C:\Windows\System\sHJqbeR.exe
  C:\Windows\System\sHJqbeR.exe
  2⤵
  PID:12680
- C:\Windows\System\xozdSqt.exe
  C:\Windows\System\xozdSqt.exe
  2⤵
  PID:12720
- C:\Windows\System\rNAZbMY.exe
  C:\Windows\System\rNAZbMY.exe
  2⤵
  PID:12736
- C:\Windows\System\moWOeSB.exe
  C:\Windows\System\moWOeSB.exe
  2⤵
  PID:12756
- C:\Windows\System\oTizUvw.exe
  C:\Windows\System\oTizUvw.exe
  2⤵
  PID:12784
- C:\Windows\System\GyKbYUM.exe
  C:\Windows\System\GyKbYUM.exe
  2⤵
  PID:12832
- C:\Windows\System\yXbyCCS.exe
  C:\Windows\System\yXbyCCS.exe
  2⤵
  PID:12860
- C:\Windows\System\iTthUzC.exe
  C:\Windows\System\iTthUzC.exe
  2⤵
  PID:12876
- C:\Windows\System\xnZACDQ.exe
  C:\Windows\System\xnZACDQ.exe
  2⤵
  PID:12900
- C:\Windows\System\EqwFmpi.exe
  C:\Windows\System\EqwFmpi.exe
  2⤵
  PID:12928
- C:\Windows\System\MDWqgVe.exe
  C:\Windows\System\MDWqgVe.exe
  2⤵
  PID:12944
- C:\Windows\System\xUOBKRr.exe
  C:\Windows\System\xUOBKRr.exe
  2⤵
  PID:12964
- C:\Windows\System\MvsUqnB.exe
  C:\Windows\System\MvsUqnB.exe
  2⤵
  PID:13012
- C:\Windows\System\QofEpBs.exe
  C:\Windows\System\QofEpBs.exe
  2⤵
  PID:13032
- C:\Windows\System\SKCeQVI.exe
  C:\Windows\System\SKCeQVI.exe
  2⤵
  PID:13060
- C:\Windows\System\NYYdThA.exe
  C:\Windows\System\NYYdThA.exe
  2⤵
  PID:13084
- C:\Windows\System\ivUTlUf.exe
  C:\Windows\System\ivUTlUf.exe
  2⤵
  PID:13120
- C:\Windows\System\YMShtmK.exe
  C:\Windows\System\YMShtmK.exe
  2⤵
  PID:13144
- C:\Windows\System\wAqAwUl.exe
  C:\Windows\System\wAqAwUl.exe
  2⤵
  PID:13180
- C:\Windows\System\VtuzARH.exe
  C:\Windows\System\VtuzARH.exe
  2⤵
  PID:13224
- C:\Windows\System\weYsLht.exe
  C:\Windows\System\weYsLht.exe
  2⤵
  PID:13252
- C:\Windows\System\EnPbmol.exe
  C:\Windows\System\EnPbmol.exe
  2⤵
  PID:13268
- C:\Windows\System\vympAWI.exe
  C:\Windows\System\vympAWI.exe
  2⤵
  PID:13296
- C:\Windows\System\pVxirSt.exe
  C:\Windows\System\pVxirSt.exe
  2⤵
  PID:11552
- C:\Windows\System\rPEKZQa.exe
  C:\Windows\System\rPEKZQa.exe
  2⤵
  PID:12328
- C:\Windows\System\SdYROqL.exe
  C:\Windows\System\SdYROqL.exe
  2⤵
  PID:12396
- C:\Windows\System\FFShFeC.exe
  C:\Windows\System\FFShFeC.exe
  2⤵
  PID:12472
- C:\Windows\System\YKqjcIw.exe
  C:\Windows\System\YKqjcIw.exe
  2⤵
  PID:12588
- C:\Windows\System\VlpgtgR.exe
  C:\Windows\System\VlpgtgR.exe
  2⤵
  PID:12640
- C:\Windows\System\fVDDIMM.exe
  C:\Windows\System\fVDDIMM.exe
  2⤵
  PID:12696
- C:\Windows\System\KxMzLyC.exe
  C:\Windows\System\KxMzLyC.exe
  2⤵
  PID:12776
- C:\Windows\System\KDxgMLH.exe
  C:\Windows\System\KDxgMLH.exe
  2⤵
  PID:12828
- C:\Windows\System\ceahszP.exe
  C:\Windows\System\ceahszP.exe
  2⤵
  PID:12892
- C:\Windows\System\nhMnczW.exe
  C:\Windows\System\nhMnczW.exe
  2⤵
  PID:12952
- C:\Windows\System\bTSAczN.exe
  C:\Windows\System\bTSAczN.exe
  2⤵
  PID:12960
- C:\Windows\System\QTrDnSV.exe
  C:\Windows\System\QTrDnSV.exe
  2⤵
  PID:13004
- C:\Windows\System\jLSLApO.exe
  C:\Windows\System\jLSLApO.exe
  2⤵
  PID:3864
- C:\Windows\System\IVvfXyz.exe
  C:\Windows\System\IVvfXyz.exe
  2⤵
  PID:13140
- C:\Windows\System\URAEOqc.exe
  C:\Windows\System\URAEOqc.exe
  2⤵
  PID:13168
- C:\Windows\System\MpgQnNO.exe
  C:\Windows\System\MpgQnNO.exe
  2⤵
  PID:13280
- C:\Windows\System\rNvpfjf.exe
  C:\Windows\System\rNvpfjf.exe
  2⤵
  PID:12356
- C:\Windows\System\UwdDPdB.exe
  C:\Windows\System\UwdDPdB.exe
  2⤵
  PID:12660
- C:\Windows\System\BMspRCh.exe
  C:\Windows\System\BMspRCh.exe
  2⤵
  PID:12676
- C:\Windows\System\TDNuNmo.exe
  C:\Windows\System\TDNuNmo.exe
  2⤵
  PID:12804
- C:\Windows\System\eXtLbeh.exe
  C:\Windows\System\eXtLbeh.exe
  2⤵
  PID:12872
- C:\Windows\System\IowvEao.exe
  C:\Windows\System\IowvEao.exe
  2⤵
  PID:13028
- C:\Windows\System\UeqyMNn.exe
  C:\Windows\System\UeqyMNn.exe
  2⤵
  PID:13236
- C:\Windows\System\KNyoAOr.exe
  C:\Windows\System\KNyoAOr.exe
  2⤵
  PID:12444
- C:\Windows\System\vpVdsMh.exe
  C:\Windows\System\vpVdsMh.exe
  2⤵
  PID:12732
- C:\Windows\System\IVWJuEK.exe
  C:\Windows\System\IVWJuEK.exe
  2⤵
  PID:12936
- C:\Windows\System\hRaqPez.exe
  C:\Windows\System\hRaqPez.exe
  2⤵
  PID:12560
- C:\Windows\System\enERtVg.exe
  C:\Windows\System\enERtVg.exe
  2⤵
  PID:13000
- C:\Windows\System\cRYUbVv.exe
  C:\Windows\System\cRYUbVv.exe
  2⤵
  PID:13340
- C:\Windows\System\CacZDkl.exe
  C:\Windows\System\CacZDkl.exe
  2⤵
  PID:13364
- C:\Windows\System\XiDKgoq.exe
  C:\Windows\System\XiDKgoq.exe
  2⤵
  PID:13384
- C:\Windows\System\RDlgCER.exe
  C:\Windows\System\RDlgCER.exe
  2⤵
  PID:13412
- C:\Windows\System\pQlbjQs.exe
  C:\Windows\System\pQlbjQs.exe
  2⤵
  PID:13452
- C:\Windows\System\vkcKUdc.exe
  C:\Windows\System\vkcKUdc.exe
  2⤵
  PID:13472
- C:\Windows\System\emYvDcx.exe
  C:\Windows\System\emYvDcx.exe
  2⤵
  PID:13500
- C:\Windows\System\rkUyxiz.exe
  C:\Windows\System\rkUyxiz.exe
  2⤵
  PID:13524
- C:\Windows\System\SwPLfKC.exe
  C:\Windows\System\SwPLfKC.exe
  2⤵
  PID:13552
- C:\Windows\System\gGeHjvG.exe
  C:\Windows\System\gGeHjvG.exe
  2⤵
  PID:13584
- C:\Windows\System\CpNjgfy.exe
  C:\Windows\System\CpNjgfy.exe
  2⤵
  PID:13616
- C:\Windows\System\eGWUhSf.exe
  C:\Windows\System\eGWUhSf.exe
  2⤵
  PID:13640
- C:\Windows\System\MFWgHJY.exe
  C:\Windows\System\MFWgHJY.exe
  2⤵
  PID:13676
- C:\Windows\System\npeFKsr.exe
  C:\Windows\System\npeFKsr.exe
  2⤵
  PID:13716
- C:\Windows\System\ThhifRd.exe
  C:\Windows\System\ThhifRd.exe
  2⤵
  PID:13736
- C:\Windows\System\kHmwqkj.exe
  C:\Windows\System\kHmwqkj.exe
  2⤵
  PID:13760
- C:\Windows\System\TgBHeXu.exe
  C:\Windows\System\TgBHeXu.exe
  2⤵
  PID:13800
- C:\Windows\System\qhvxVjO.exe
  C:\Windows\System\qhvxVjO.exe
  2⤵
  PID:13828
- C:\Windows\System\wnuwGHn.exe
  C:\Windows\System\wnuwGHn.exe
  2⤵
  PID:13856
- C:\Windows\System\mHjmFMf.exe
  C:\Windows\System\mHjmFMf.exe
  2⤵
  PID:13872
- C:\Windows\System\kZgYqSH.exe
  C:\Windows\System\kZgYqSH.exe
  2⤵
  PID:13912
- C:\Windows\System\VZrqjYz.exe
  C:\Windows\System\VZrqjYz.exe
  2⤵
  PID:13940
- C:\Windows\System\stiRqZw.exe
  C:\Windows\System\stiRqZw.exe
  2⤵
  PID:13968
- C:\Windows\System\pSwJJiH.exe
  C:\Windows\System\pSwJJiH.exe
  2⤵
  PID:13992
- C:\Windows\System\OTnKFZZ.exe
  C:\Windows\System\OTnKFZZ.exe
  2⤵
  PID:14024
- C:\Windows\System\zSEjAPS.exe
  C:\Windows\System\zSEjAPS.exe
  2⤵
  PID:14048
- C:\Windows\System\wigBZHc.exe
  C:\Windows\System\wigBZHc.exe
  2⤵
  PID:14072
- C:\Windows\System\wiLKxUy.exe
  C:\Windows\System\wiLKxUy.exe
  2⤵
  PID:14096
- C:\Windows\System\hNgobfU.exe
  C:\Windows\System\hNgobfU.exe
  2⤵
  PID:14124
- C:\Windows\System\SUOysvA.exe
  C:\Windows\System\SUOysvA.exe
  2⤵
  PID:14152
- C:\Windows\System\kxxukHR.exe
  C:\Windows\System\kxxukHR.exe
  2⤵
  PID:14192
- C:\Windows\System\LBapmsU.exe
  C:\Windows\System\LBapmsU.exe
  2⤵
  PID:14208
- C:\Windows\System\tTROBEg.exe
  C:\Windows\System\tTROBEg.exe
  2⤵
  PID:14236
- C:\Windows\System\zuvDReC.exe
  C:\Windows\System\zuvDReC.exe
  2⤵
  PID:14264
- C:\Windows\System\HbIQCwq.exe
  C:\Windows\System\HbIQCwq.exe
  2⤵
  PID:14292
- C:\Windows\System\KLAHgwK.exe
  C:\Windows\System\KLAHgwK.exe
  2⤵
  PID:14320
- C:\Windows\System\bLMgNmq.exe
  C:\Windows\System\bLMgNmq.exe
  2⤵
  PID:2272
- C:\Windows\System\jpPLQoT.exe
  C:\Windows\System\jpPLQoT.exe
  2⤵
  PID:13372
- C:\Windows\System\bRQgvlx.exe
  C:\Windows\System\bRQgvlx.exe
  2⤵
  PID:13440
- C:\Windows\System\YGUZWMn.exe
  C:\Windows\System\YGUZWMn.exe
  2⤵
  PID:13492
- C:\Windows\System\vYpjnmh.exe
  C:\Windows\System\vYpjnmh.exe
  2⤵
  PID:13600
- C:\Windows\System\HdKntkb.exe
  C:\Windows\System\HdKntkb.exe
  2⤵
  PID:13652
- C:\Windows\System\DDyOLiw.exe
  C:\Windows\System\DDyOLiw.exe
  2⤵
  PID:13708
- C:\Windows\System\cPyqrdp.exe
  C:\Windows\System\cPyqrdp.exe
  2⤵
  PID:13776
- C:\Windows\System\cAHjlTU.exe
  C:\Windows\System\cAHjlTU.exe
  2⤵
  PID:13820
- C:\Windows\System\MRjZQkd.exe
  C:\Windows\System\MRjZQkd.exe
  2⤵
  PID:13892
- C:\Windows\System\PPdPJlc.exe
  C:\Windows\System\PPdPJlc.exe
  2⤵
  PID:13984
- C:\Windows\System\rPAEWye.exe
  C:\Windows\System\rPAEWye.exe
  2⤵
  PID:14008
- C:\Windows\System\vGPedeT.exe
  C:\Windows\System\vGPedeT.exe
  2⤵
  PID:14084
- C:\Windows\System\ZBYHhJc.exe
  C:\Windows\System\ZBYHhJc.exe
  2⤵
  PID:14140
- C:\Windows\System\xZqwWgt.exe
  C:\Windows\System\xZqwWgt.exe
  2⤵
  PID:14204
- C:\Windows\System\YKyfGns.exe
  C:\Windows\System\YKyfGns.exe
  2⤵
  PID:14288
- C:\Windows\System\sZQCuUq.exe
  C:\Windows\System\sZQCuUq.exe
  2⤵
  PID:4604
- C:\Windows\System\OEJzWCM.exe
  C:\Windows\System\OEJzWCM.exe
  2⤵
  PID:13468
- C:\Windows\System\LgecqOc.exe
  C:\Windows\System\LgecqOc.exe
  2⤵
  PID:13696
- C:\Windows\System\CLCIHYI.exe
  C:\Windows\System\CLCIHYI.exe
  2⤵
  PID:13816
- C:\Windows\System\XXfDKJi.exe
  C:\Windows\System\XXfDKJi.exe
  2⤵
  PID:13888
- C:\Windows\System\pEklHvR.exe
  C:\Windows\System\pEklHvR.exe
  2⤵
  PID:14032
- C:\Windows\System\Tnyrgdm.exe
  C:\Windows\System\Tnyrgdm.exe
  2⤵
  PID:14248
- C:\Windows\System\UhgUhYs.exe
  C:\Windows\System\UhgUhYs.exe
  2⤵
  PID:13436
- C:\Windows\System\GKqsqgk.exe
  C:\Windows\System\GKqsqgk.exe
  2⤵
  PID:13748
- C:\Windows\System\lcqgNAs.exe
  C:\Windows\System\lcqgNAs.exe
  2⤵
  PID:13952
- C:\Windows\System\yaCKNKd.exe
  C:\Windows\System\yaCKNKd.exe
  2⤵
  PID:1540
- C:\Windows\System\psxiFvz.exe
  C:\Windows\System\psxiFvz.exe
  2⤵
  PID:992
- C:\Windows\System\SPfBrmE.exe
  C:\Windows\System\SPfBrmE.exe
  2⤵
  PID:14184
- C:\Windows\System\KgFXrLb.exe
  C:\Windows\System\KgFXrLb.exe
  2⤵
  PID:13332
- C:\Windows\System\fOIGeOo.exe
  C:\Windows\System\fOIGeOo.exe
  2⤵
  PID:14352
- C:\Windows\System\WcBTYDz.exe
  C:\Windows\System\WcBTYDz.exe
  2⤵
  PID:14380
- C:\Windows\System\ziAZPVk.exe
  C:\Windows\System\ziAZPVk.exe
  2⤵
  PID:14408
- C:\Windows\System\haMXNgS.exe
  C:\Windows\System\haMXNgS.exe
  2⤵
  PID:14436
- C:\Windows\System\yslXFKE.exe
  C:\Windows\System\yslXFKE.exe
  2⤵
  PID:14464
- C:\Windows\System\jgKWHuC.exe
  C:\Windows\System\jgKWHuC.exe
  2⤵
  PID:14480
- C:\Windows\System\ohSAhbD.exe
  C:\Windows\System\ohSAhbD.exe
  2⤵
  PID:14500
- C:\Windows\System\PwsnGSE.exe
  C:\Windows\System\PwsnGSE.exe
  2⤵
  PID:14520
- C:\Windows\System\loteZAe.exe
  C:\Windows\System\loteZAe.exe
  2⤵
  PID:14548
- C:\Windows\System\VwayLTd.exe
  C:\Windows\System\VwayLTd.exe
  2⤵
  PID:14576
- C:\Windows\System\QPNsBJG.exe
  C:\Windows\System\QPNsBJG.exe
  2⤵
  PID:14632
- C:\Windows\System\GcxjWxC.exe
  C:\Windows\System\GcxjWxC.exe
  2⤵
  PID:14660
- C:\Windows\System\OAcAaYd.exe
  C:\Windows\System\OAcAaYd.exe
  2⤵
  PID:14676
- C:\Windows\System\VjFfuRf.exe
  C:\Windows\System\VjFfuRf.exe
  2⤵
  PID:14716
- C:\Windows\System\RkktQeh.exe
  C:\Windows\System\RkktQeh.exe
  2⤵
  PID:14744
- C:\Windows\System\DMVsokM.exe
  C:\Windows\System\DMVsokM.exe
  2⤵
  PID:14772
- C:\Windows\System\IGImLUE.exe
  C:\Windows\System\IGImLUE.exe
  2⤵
  PID:14800
- C:\Windows\System\jwqzhmX.exe
  C:\Windows\System\jwqzhmX.exe
  2⤵
  PID:14820
- C:\Windows\System\HjnBkvS.exe
  C:\Windows\System\HjnBkvS.exe
  2⤵
  PID:14848
- C:\Windows\System\wFFiMvB.exe
  C:\Windows\System\wFFiMvB.exe
  2⤵
  PID:14872
- C:\Windows\System\YUMnmsO.exe
  C:\Windows\System\YUMnmsO.exe
  2⤵
  PID:14912
- C:\Windows\System\PGpYgrD.exe
  C:\Windows\System\PGpYgrD.exe
  2⤵
  PID:14940
- C:\Windows\System\amtmLYP.exe
  C:\Windows\System\amtmLYP.exe
  2⤵
  PID:14968
- C:\Windows\System\JAuuWvv.exe
  C:\Windows\System\JAuuWvv.exe
  2⤵
  PID:14992
- C:\Windows\System\ElCVTQZ.exe
  C:\Windows\System\ElCVTQZ.exe
  2⤵
  PID:15016
- C:\Windows\System\wdDPFhK.exe
  C:\Windows\System\wdDPFhK.exe
  2⤵
  PID:15044
- C:\Windows\System\MGiaCPk.exe
  C:\Windows\System\MGiaCPk.exe
  2⤵
  PID:15068
- C:\Windows\System\mGlqXbK.exe
  C:\Windows\System\mGlqXbK.exe
  2⤵
  PID:15108
- C:\Windows\System\RtVMqHJ.exe
  C:\Windows\System\RtVMqHJ.exe
  2⤵
  PID:15124
- C:\Windows\System\fqRxgwe.exe
  C:\Windows\System\fqRxgwe.exe
  2⤵
  PID:15148
- C:\Windows\System\ztaeEjH.exe
  C:\Windows\System\ztaeEjH.exe
  2⤵
  PID:15184
- C:\Windows\System\XMZcFWG.exe
  C:\Windows\System\XMZcFWG.exe
  2⤵
  PID:15208
- C:\Windows\System\GyIpHuV.exe
  C:\Windows\System\GyIpHuV.exe
  2⤵
  PID:15236
- C:\Windows\System\IgoIYEW.exe
  C:\Windows\System\IgoIYEW.exe
  2⤵
  PID:15260
- C:\Windows\System\EelakpN.exe
  C:\Windows\System\EelakpN.exe
  2⤵
  PID:15284
- C:\Windows\System\FTBLPJn.exe
  C:\Windows\System\FTBLPJn.exe
  2⤵
  PID:15332
- C:\Windows\System\NCAoQyQ.exe
  C:\Windows\System\NCAoQyQ.exe
  2⤵
  PID:15348
- C:\Windows\System\rYSZcYf.exe
  C:\Windows\System\rYSZcYf.exe
  2⤵
  PID:14364
- C:\Windows\System\YgQSdvK.exe
  C:\Windows\System\YgQSdvK.exe
  2⤵
  PID:14432
- C:\Windows\System\wgDTfOR.exe
  C:\Windows\System\wgDTfOR.exe
  2⤵
  PID:14472
- C:\Windows\System\bPkjLRU.exe
  C:\Windows\System\bPkjLRU.exe
  2⤵
  PID:14508
- C:\Windows\System\SsJoYEa.exe
  C:\Windows\System\SsJoYEa.exe
  2⤵
  PID:14568
- C:\Windows\System\gGeZUIn.exe
  C:\Windows\System\gGeZUIn.exe
  2⤵
  PID:14652
- C:\Windows\System\iHpAUqo.exe
  C:\Windows\System\iHpAUqo.exe
  2⤵
  PID:14712
- C:\Windows\System\uSAsdsO.exe
  C:\Windows\System\uSAsdsO.exe
  2⤵
  PID:14844
- C:\Windows\System\BotvgdB.exe
  C:\Windows\System\BotvgdB.exe
  2⤵
  PID:14884
- C:\Windows\System\BGUPdHt.exe
  C:\Windows\System\BGUPdHt.exe
  2⤵
  PID:14936
- C:\Windows\System\eIbAZjX.exe
  C:\Windows\System\eIbAZjX.exe
  2⤵
  PID:14988
- C:\Windows\System\UCXWjss.exe
  C:\Windows\System\UCXWjss.exe
  2⤵
  PID:15084
- C:\Windows\System\piSbaSd.exe
  C:\Windows\System\piSbaSd.exe
  2⤵
  PID:15144
- C:\Windows\System\ZghrDIn.exe
  C:\Windows\System\ZghrDIn.exe
  2⤵
  PID:15180
- C:\Windows\System\iFRyBTp.exe
  C:\Windows\System\iFRyBTp.exe
  2⤵
  PID:15280
- C:\Windows\System\hEeLyvB.exe
  C:\Windows\System\hEeLyvB.exe
  2⤵
  PID:3592
- C:\Windows\System\HyHAqYJ.exe
  C:\Windows\System\HyHAqYJ.exe
  2⤵
  PID:14340
- C:\Windows\System\uEdQtbI.exe
  C:\Windows\System\uEdQtbI.exe
  2⤵
  PID:14672
- C:\Windows\System\JzoZMxS.exe
  C:\Windows\System\JzoZMxS.exe
  2⤵
  PID:14620
- C:\Windows\System\sOdvnMt.exe
  C:\Windows\System\sOdvnMt.exe
  2⤵
  PID:14860
- C:\Windows\System\tCvylko.exe
  C:\Windows\System\tCvylko.exe
  2⤵
  PID:14960
- C:\Windows\System\xzkYjpR.exe
  C:\Windows\System\xzkYjpR.exe
  2⤵
  PID:15120
- C:\Windows\System\IAQtwgz.exe
  C:\Windows\System\IAQtwgz.exe
  2⤵
  PID:15192
- C:\Windows\System\jGKvQrj.exe
  C:\Windows\System\jGKvQrj.exe
  2⤵
  PID:14740
- C:\Windows\System\OiuminU.exe
  C:\Windows\System\OiuminU.exe
  2⤵
  PID:14840
- C:\Windows\System\RShJQTy.exe
  C:\Windows\System\RShJQTy.exe
  2⤵
  PID:15232
- C:\Windows\System\GmnSYfF.exe
  C:\Windows\System\GmnSYfF.exe
  2⤵
  PID:15168
- C:\Windows\System\pnYMHYc.exe
  C:\Windows\System\pnYMHYc.exe
  2⤵
  PID:14908
- C:\Windows\System\sVRrEwd.exe
  C:\Windows\System\sVRrEwd.exe
  2⤵
  PID:15388
- C:\Windows\System\SQYfsXq.exe
  C:\Windows\System\SQYfsXq.exe
  2⤵
  PID:15416
- C:\Windows\System\AMMnKHZ.exe
  C:\Windows\System\AMMnKHZ.exe
  2⤵
  PID:15456
- C:\Windows\System\KajDkZG.exe
  C:\Windows\System\KajDkZG.exe
  2⤵
  PID:15472
- C:\Windows\System\gknrUuf.exe
  C:\Windows\System\gknrUuf.exe
  2⤵
  PID:15500
- C:\Windows\System\cRJELAc.exe
  C:\Windows\System\cRJELAc.exe
  2⤵
  PID:15528
- C:\Windows\System\aizYgjd.exe
  C:\Windows\System\aizYgjd.exe
  2⤵
  PID:15552
- C:\Windows\System\CMkuzpg.exe
  C:\Windows\System\CMkuzpg.exe
  2⤵
  PID:15596
- C:\Windows\System\ZaPgyBm.exe
  C:\Windows\System\ZaPgyBm.exe
  2⤵
  PID:15624
- C:\Windows\System\UpMgRAr.exe
  C:\Windows\System\UpMgRAr.exe
  2⤵
  PID:15652
- C:\Windows\System\YlScaKz.exe
  C:\Windows\System\YlScaKz.exe
  2⤵
  PID:15680
- C:\Windows\System\SLsTfBp.exe
  C:\Windows\System\SLsTfBp.exe
  2⤵
  PID:15696
- C:\Windows\System\HtkWKeE.exe
  C:\Windows\System\HtkWKeE.exe
  2⤵
  PID:15712
- C:\Windows\System\stOFzsm.exe
  C:\Windows\System\stOFzsm.exe
  2⤵
  PID:15740
- C:\Windows\System\wLFMlOl.exe
  C:\Windows\System\wLFMlOl.exe
  2⤵
  PID:15776
- C:\Windows\System\iCpKfIn.exe
  C:\Windows\System\iCpKfIn.exe
  2⤵
  PID:15796
- C:\Windows\System\PASBLea.exe
  C:\Windows\System\PASBLea.exe
  2⤵
  PID:15820
- C:\Windows\System\eMHPctD.exe
  C:\Windows\System\eMHPctD.exe
  2⤵
  PID:15864
- C:\Windows\System\RDGohCx.exe
  C:\Windows\System\RDGohCx.exe
  2⤵
  PID:15888
- C:\Windows\System\MWajoTf.exe
  C:\Windows\System\MWajoTf.exe
  2⤵
  PID:15920
- C:\Windows\System\fjFZXIt.exe
  C:\Windows\System\fjFZXIt.exe
  2⤵
  PID:15948
- C:\Windows\System\UNapGqO.exe
  C:\Windows\System\UNapGqO.exe
  2⤵
  PID:15976
- C:\Windows\System\AhqGbIP.exe
  C:\Windows\System\AhqGbIP.exe
  2⤵
  PID:16008
- C:\Windows\System\iQTZVhf.exe
  C:\Windows\System\iQTZVhf.exe
  2⤵
  PID:16032
- C:\Windows\System\ETspgYG.exe
  C:\Windows\System\ETspgYG.exe
  2⤵
  PID:16072
- C:\Windows\System\MOgggNf.exe
  C:\Windows\System\MOgggNf.exe
  2⤵
  PID:16096
- C:\Windows\System\Uxvlfvu.exe
  C:\Windows\System\Uxvlfvu.exe
  2⤵
  PID:16116
- C:\Windows\System\OluGexR.exe
  C:\Windows\System\OluGexR.exe
  2⤵
  PID:16144
- C:\Windows\System\RBDAmip.exe
  C:\Windows\System\RBDAmip.exe
  2⤵
  PID:16164
- C:\Windows\System\UaCirdk.exe
  C:\Windows\System\UaCirdk.exe
  2⤵
  PID:16184
- C:\Windows\System\XpcmUjM.exe
  C:\Windows\System\XpcmUjM.exe
  2⤵
  PID:16204
- C:\Windows\System\PekYZzJ.exe
  C:\Windows\System\PekYZzJ.exe
  2⤵
  PID:16228
- C:\Windows\System\KVhqhCR.exe
  C:\Windows\System\KVhqhCR.exe
  2⤵
  PID:16256
- C:\Windows\System\NOkdoyf.exe
  C:\Windows\System\NOkdoyf.exe
  2⤵
  PID:16284
- C:\Windows\System\KOlWiRp.exe
  C:\Windows\System\KOlWiRp.exe
  2⤵
  PID:16324
- C:\Windows\System\jKtlWom.exe
  C:\Windows\System\jKtlWom.exe
  2⤵
  PID:16372
- C:\Windows\System\ncfYqIE.exe
  C:\Windows\System\ncfYqIE.exe
  2⤵
  PID:15380
- C:\Windows\System\XPJjbYM.exe
  C:\Windows\System\XPJjbYM.exe
  2⤵
  PID:15464
- C:\Windows\System\EcYwYxe.exe
  C:\Windows\System\EcYwYxe.exe
  2⤵
  PID:15512
- C:\Windows\System\NMZrjkk.exe
  C:\Windows\System\NMZrjkk.exe
  2⤵
  PID:15548
- C:\Windows\System\wAQLDJz.exe
  C:\Windows\System\wAQLDJz.exe
  2⤵
  PID:15620
- C:\Windows\System\tzeHBci.exe
  C:\Windows\System\tzeHBci.exe
  2⤵
  PID:15688
- C:\Windows\System\HDyHIOJ.exe
  C:\Windows\System\HDyHIOJ.exe
  2⤵
  PID:15764
- C:\Windows\System\OQlRrRL.exe
  C:\Windows\System\OQlRrRL.exe
  2⤵
  PID:15852
- C:\Windows\System\xyNAGgw.exe
  C:\Windows\System\xyNAGgw.exe
  2⤵
  PID:15900
- C:\Windows\System\twbviXE.exe
  C:\Windows\System\twbviXE.exe
  2⤵
  PID:15964
- C:\Windows\System\XeXicGO.exe
  C:\Windows\System\XeXicGO.exe
  2⤵
  PID:16024
- C:\Windows\System\dlwYERP.exe
  C:\Windows\System\dlwYERP.exe
  2⤵
  PID:16084
- C:\Windows\System\pZabdDG.exe
  C:\Windows\System\pZabdDG.exe
  2⤵
  PID:16176
- C:\Windows\System\ezMlmhw.exe
  C:\Windows\System\ezMlmhw.exe
  2⤵
  PID:16152
- C:\Windows\System\coUwYIT.exe
  C:\Windows\System\coUwYIT.exe
  2⤵
  PID:16272
- C:\Windows\System\zsHnfRG.exe
  C:\Windows\System\zsHnfRG.exe
  2⤵
  PID:16380
- C:\Windows\System\uWCXBRL.exe
  C:\Windows\System\uWCXBRL.exe
  2⤵
  PID:15452
- C:\Windows\System\waKhIIr.exe
  C:\Windows\System\waKhIIr.exe
  2⤵
  PID:15516
- C:\Windows\System\aOSZntW.exe
  C:\Windows\System\aOSZntW.exe
  2⤵
  PID:15724
- C:\Windows\System\PjIafyS.exe
  C:\Windows\System\PjIafyS.exe
  2⤵
  PID:15732
- C:\Windows\System\bteceBH.exe
  C:\Windows\System\bteceBH.exe
  2⤵
  PID:15912
- C:\Windows\System\cnTRtrC.exe
  C:\Windows\System\cnTRtrC.exe
  2⤵
  PID:16128
- C:\Windows\System\VaCZLgr.exe
  C:\Windows\System\VaCZLgr.exe
  2⤵
  PID:16292
- C:\Windows\System\sVcgRtP.exe
  C:\Windows\System\sVcgRtP.exe
  2⤵
  PID:15488
- C:\Windows\System\dSWQyoi.exe
  C:\Windows\System\dSWQyoi.exe
  2⤵
  PID:15644
- C:\Windows\System\fPrgond.exe
  C:\Windows\System\fPrgond.exe
  2⤵
  PID:16268
- C:\Windows\System\evaqsah.exe
  C:\Windows\System\evaqsah.exe
  2⤵
  PID:16224
- C:\Windows\System\QuPhFpw.exe
  C:\Windows\System\QuPhFpw.exe
  2⤵
  PID:16248
- C:\Windows\System\deLfuiZ.exe
  C:\Windows\System\deLfuiZ.exe
  2⤵
  PID:16396
- C:\Windows\System\atZmAmI.exe
  C:\Windows\System\atZmAmI.exe
  2⤵
  PID:16420
- C:\Windows\System\atmxrlN.exe
  C:\Windows\System\atmxrlN.exe
  2⤵
  PID:16448
- C:\Windows\System\mEmwSST.exe
  C:\Windows\System\mEmwSST.exe
  2⤵
  PID:16504
- C:\Windows\System\IXgYPhx.exe
  C:\Windows\System\IXgYPhx.exe
  2⤵
  PID:16528
- C:\Windows\System\euKKlZn.exe
  C:\Windows\System\euKKlZn.exe
  2⤵
  PID:16568
- C:\Windows\System\YTnxrxq.exe
  C:\Windows\System\YTnxrxq.exe
  2⤵
  PID:16588
- C:\Windows\System\wuyudJn.exe
  C:\Windows\System\wuyudJn.exe
  2⤵
  PID:16612
- C:\Windows\System\xUpMgNO.exe
  C:\Windows\System\xUpMgNO.exe
  2⤵
  PID:16656
- C:\Windows\System\JiRlnkE.exe
  C:\Windows\System\JiRlnkE.exe
  2⤵
  PID:16676
- C:\Windows\System\AnnIWHc.exe
  C:\Windows\System\AnnIWHc.exe
  2⤵
  PID:16700
- C:\Windows\System\OiVmNfD.exe
  C:\Windows\System\OiVmNfD.exe
  2⤵
  PID:16732
- C:\Windows\System\AUtTPqW.exe
  C:\Windows\System\AUtTPqW.exe
  2⤵
  PID:16768
- C:\Windows\System\xLbZefL.exe
  C:\Windows\System\xLbZefL.exe
  2⤵
  PID:16800
- C:\Windows\System\lxJUIyB.exe
  C:\Windows\System\lxJUIyB.exe
  2⤵
  PID:16828
- C:\Windows\System\GrhsQJb.exe
  C:\Windows\System\GrhsQJb.exe
  2⤵
  PID:16848
- C:\Windows\System\sTbAGsI.exe
  C:\Windows\System\sTbAGsI.exe
  2⤵
  PID:16872
- C:\Windows\System\txJxuFg.exe
  C:\Windows\System\txJxuFg.exe
  2⤵
  PID:16900
- C:\Windows\System\kTutaYZ.exe
  C:\Windows\System\kTutaYZ.exe
  2⤵
  PID:16940
- C:\Windows\System\UYtLppL.exe
  C:\Windows\System\UYtLppL.exe
  2⤵
  PID:16960
- C:\Windows\System\JKQVOsY.exe
  C:\Windows\System\JKQVOsY.exe
  2⤵
  PID:16984
- C:\Windows\System\QnXLtHG.exe
  C:\Windows\System\QnXLtHG.exe
  2⤵
  PID:17004
- C:\Windows\System\Hmeehmy.exe
  C:\Windows\System\Hmeehmy.exe
  2⤵
  PID:17040
- C:\Windows\System\bWLPbFD.exe
  C:\Windows\System\bWLPbFD.exe
  2⤵
  PID:17056
- C:\Windows\System\UZObEgx.exe
  C:\Windows\System\UZObEgx.exe
  2⤵
  PID:17088
- C:\Windows\System\TvYHTgR.exe
  C:\Windows\System\TvYHTgR.exe
  2⤵
  PID:17108
- - C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -u -p 17108 -s 252
    3⤵
    PID:16584
- C:\Windows\System\xlZmibv.exe
  C:\Windows\System\xlZmibv.exe
  2⤵
  PID:17128
- C:\Windows\System\nYoOwob.exe
  C:\Windows\System\nYoOwob.exe
  2⤵
  PID:17160

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:16844

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\AcsAKhB.exe

Filesize
1.4MB

MD5
85627aee6e309840c9afa014f837eee2

SHA1
04100195150a8c35cbececd0318fe0721802b2d0

SHA256
b20b3782a534897e7819dafb52a791095cf8d16c8d53244be29e563f2650dbb9

SHA512
fa2b1bda17091d3e660023e44231c088cfab32b094441b21beb0a2704a572f0691ea0d025045d823cc3b11f9d0a5a86b13fa70e08c52270fa0d13ff75242bac3

Download Submit
C:\Windows\System\BtabctV.exe

Filesize
1.4MB

MD5
476f504124f4797f746d1281d3dd0fcd

SHA1
df8bca11bd734a11678e4ed98caec37793f2408b

SHA256
bf6ffbcd0b83aa34b402a3d4d1366ae58a4edc3e4e491d3c10c9fbe929dab38a

SHA512
9f0c93619ab9a51d4c15a6c2c10a2e8e54da2e6a872d54c6f1ba235627d5e0ae4ba9afef1dc67031a5dfe6f4cf82e310a89487b56455bf08b1d647f55faa0e1e

Download Submit
C:\Windows\System\CvNpTZH.exe

Filesize
1.4MB

MD5
a4f143b8378e2ff626a2fe29b45e9900

SHA1
dbaaf97bdca40ccfef3b483236d7af6d0ff8c29c

SHA256
58b5b5cb56160f3c5f2834a77574d51ca5694c0f72b38c0d8224c191aa128302

SHA512
ffbb5beae32280cf5821473d71619baa2978ffba0bcba3fd34268dca68b6c9eeb14b0e728ef062569fe8067a5c5cc0965da675615fd5d074cb01842f3f0983aa

Download Submit
C:\Windows\System\DgArdIY.exe

Filesize
1.4MB

MD5
a34573c68b55c4cd0486b5cc0d3cb94b

SHA1
bc0d8948b69839833bf29972de5582a7021a0576

SHA256
79c1a568a05ce1bf3b7407de44a15c5768ebffa83871de275d92bade0d734f2d

SHA512
baf33356081acd6033fb7a65f24115a7db5800886bf7b3efd9698282a657cad4a7c57a32a400959a395ef485e1bec773646725bc96eb2674c79af381d7d1e4c7

Download Submit
C:\Windows\System\FFXPCAb.exe

Filesize
1.4MB

MD5
00603e95f162d272dac9917fea070dd6

SHA1
2717676ac10a97591045a09e48698e177206f5e9

SHA256
0feca39bc97763fef73bca20e8892a1f1dd1e95acba8413b0b623c013d3c1805

SHA512
e0f0d7f397e9de67e483adb74644f00b14ebbb6888e199280959ca5c498a95ecca19832e3e5862984492f74477c53201666d36478b66a3714709e92cdc6f27f4

Download Submit
C:\Windows\System\GPEmVEE.exe

Filesize
1.4MB

MD5
b269ac98d25ef4d96485bcfe80d3f984

SHA1
46eabbfdfc602723dee0633ef254e15e06c1b4bd

SHA256
e53cc99cb3a30fc414a9dfce5d5e338b473524a9d6777834029352d7d334858c

SHA512
b31f56fd5bee989458d2bfc980a762ef42c8b97af06ff6d92bcc86e8d1ee5ee3f3f20bd98afb1d6ffa32387ddbf7aaa4b1c078ac0a157273ea5a4ab0ba436aa6

Download Submit
C:\Windows\System\IWIwdfR.exe

Filesize
1.4MB

MD5
9f0cf9455b852b987b9f7e23a0e5bfdb

SHA1
fced261c3706e7d96f737560c53f9661285c5fe4

SHA256
d7d3dd677f0da1c867c18b33c8ae05e2227507d927cfc8c27684bcdc4fd3b08b

SHA512
beeaa9d5a3596c8da5554f5d2e2041c0ea362cf43984cd85c366e673bb3bea11a870c9529169c742142874a274f314f14f258b8f2cb7116b29b15b6cae197db2

Download Submit
C:\Windows\System\IuhAORl.exe

Filesize
1.4MB

MD5
e8ffb60524a7d147125333492f0d8d12

SHA1
89de0f18228ea42e90b508eee0129a20dfe2ce99

SHA256
0891c954a68cd7aa98ca88df7aed271665b5268e2f0abcf7bd8f8c31d6db9d9b

SHA512
45cdbb178a0f623ef62e522f9bace0fe42054402cdd2ceb6d137f03db5a6c512dc897b38ef3b03c302264ad20fd74ea18aa05ec7c33b13c1ebd3068bedc5fa20

Download Submit
C:\Windows\System\IvsRAgB.exe

Filesize
1.4MB

MD5
0cf338f7baccb1aff8f8c30f44b2a5e1

SHA1
679edabbdae46e43aca39e2833dcfcb4643d3202

SHA256
6ebd9ea140bbfa7030c9235c0f20c09d5c8d1569abe5651723dafeca543504a9

SHA512
85a23ca0d64652fe2e71ac1c98484330a608068a6540c318eb5e905159b25c2797fdd534abf4b973bd7f1195f15f92f3da3c6c45270c9066a2cef2c372af91b6

Download Submit
C:\Windows\System\JTfRlRM.exe

Filesize
1.4MB

MD5
d001cd65aa9ad88d8e47812d537200bb

SHA1
394531a882180a1135a6ad1354d8ad53afd33bcf

SHA256
89dfd85ae0414b80b61cf8deaa3f83069584ac787ac76416692559eb4d806733

SHA512
10e4754dface1ede068dae254a50c8db9e20c2393e2e4516d495f39394d6df7b36812326165488a681d2f7a7ea981e020eb5f6e1056fe45f7b39dc4552b3c89f

Download Submit
C:\Windows\System\KHnZaMC.exe

Filesize
1.4MB

MD5
754d0e8e117097b2b9dfc76143ef24a3

SHA1
ce51691af0ce376dbcb4a1607fd7d32151df9e11

SHA256
1159313e006e0d3e5c122b0432b45ce3595ceceda085f1447a26c3f045dde59c

SHA512
aa273d4dcac779f94fda2c3e039cb114d6f2efb5c67488d31c6dd08e6b6ce4e89403c9f18e359bb62defa09f7b5014efc6d79c4f0029e319baef2d96c18fd8e4

Download Submit
C:\Windows\System\QESaonk.exe

Filesize
1.4MB

MD5
81dab099cc41fb2e000045f2dcd58664

SHA1
0e4105bc47e7d13f230956d9cfa7b608ed5f5d9b

SHA256
123088b1a790490e2f857fcb48febff84ca487b1df958c1376e9f0307a89e432

SHA512
b8061eb826f3db95c5a4014e7ae7603881f2a4a9658fc374b20726ee6afe7b8cdbc0617ba577438702168a2fd4d7565c4e1c776252c706805352ae1dc584ac46

Download Submit
C:\Windows\System\SWiqhRi.exe

Filesize
1.4MB

MD5
8703cdbe9ba356bc278f0248daa923ec

SHA1
58ee4a0ec57a516769289d8fdfe5ddcfbb80c2e4

SHA256
bba85983f6e56a2a82c45d4a28ead3408c953db2028c61d3d960df2773d164cb

SHA512
ded788fb218b8e971bc9548c0e29faecbf5362693f40be3280817a455ba5088df16ebebfb008a4160d409ceda677b8bdf820d26def8be4a749249cf565df9aed

Download Submit
C:\Windows\System\UynNQPT.exe

Filesize
1.4MB

MD5
2d3c4ef85d2386b180781910229171bd

SHA1
2e44acc93f985b4bef03ab035525bd756ec598b6

SHA256
e7488e5c6dfb3ce410e5e40b2e7c083699059d86326c7e8474ea3b43f5312aea

SHA512
1092567e83925f724660a0c55293a3e349f122b3c30252b144f151737c92666b560b2c4a46d13059f26d0a2fe3654d43f7835c6461138700e6c210552d4217a8

Download Submit
C:\Windows\System\VPoBvvF.exe

Filesize
1.4MB

MD5
1138f7b120c3a7d8786a1fcfebdcdcf2

SHA1
9689fa347888573f185c85ae33efb8615cfaffa3

SHA256
9f447c0c47dabc8ae90cc5ccef5a8cfc56f45867703811dc83d6a55a4207d9f1

SHA512
71a11422d54355fc4b05174e81ed128af471cb253f4fd17e8c92699199a31e39897e1e4d2ddf474cdf6b39d331e5a101033456e61297418daeb7c7be9aea785e

Download Submit
C:\Windows\System\VhgTAYL.exe

Filesize
1.4MB

MD5
2e234ae32395124066861ee832b7d92d

SHA1
090a7235baae77b442a3b87e2232a0ac2b460ea0

SHA256
781568e9c0e37df074f2c3722017140ccd51afb4eb165b80a212a80bf84d36d0

SHA512
f46d753bbbcf7c5b194b4d57bd612bdde5525664867d0485a10d4537957d1adfa9e2d2a952f34bc7d59e681003c31a5596556814ad42c5b3081f8a8858262283

Download Submit
C:\Windows\System\WLxNwFW.exe

Filesize
1.4MB

MD5
c9637e48f7447cae5f1e16dc1f8382fe

SHA1
38dce4fcf86ec05dc759db280f1404ab97a71698

SHA256
13fb9a3b47663decaf975fe738d219afb04fd6fbfe77562a581c5c7bd1938dd1

SHA512
656d57dac26741dd0447552415596260c7b7a8896debd2a864612310255df45616d99fcaba73ab3ec1a5ed6301cbbde4a00b36f046eae2e49c30b33cf1cff6d8

Download Submit
C:\Windows\System\YVyuFXR.exe

Filesize
1.4MB

MD5
4b10ac0637548e080390c701faaca8b4

SHA1
c1bc15c1f204196b8e691c04f1854e3f924545e6

SHA256
b1bb722916a423f8d4427c6b630aa75a365eab6b1ae703314ccdd93bd6843d7a

SHA512
c706f94018a0c1019a71682c1f43346b5ee3bb4fbc01153486b53a59ee70e6adbb18a5aaf67912c17d6d9387ca24a397ffd458794e54c89ae0730e39395e4c3a

Download Submit
C:\Windows\System\avtyHIg.exe

Filesize
1.4MB

MD5
a47b1a8316c9ed6d02c9c614ffdcf151

SHA1
ff060b7bab411e5f5621725be1592aeac10e8f21

SHA256
1828e3bc128ba21a31cfdcc199379e5b15a5962f2e427bc09e3c783f1ba05c20

SHA512
450e4b84bba7e415ae35e875951c2062c10b25191c7ad53fc83b1624e71a3c634f10c7f0849b8610a9604c5eb7f0f477fd5ac8320ea7c91b5d7b6cafbd8359c0

Download Submit
C:\Windows\System\cyeHeTx.exe

Filesize
1.4MB

MD5
551d4fee1861ad35114b33bcd81afbcb

SHA1
f039ab23c29a1f002b97ca77d5f6e9be94980ff0

SHA256
28fa07c9955f4c1668bdd604018f60ff45e063ee03449d38a6e4bc41e0290fc9

SHA512
0d7337d2160e08d1f5a7d34621cf146d8830d8c0da84cf925b6e44e6221e6a81bd3861e77a34cd68a2e8255efb30949a6dea60809310d6d39dede4bfcc4e6797

Download Submit
C:\Windows\System\hODNSDb.exe

Filesize
1.4MB

MD5
94e1109491cb8e391180032633605076

SHA1
66e3f8766540bd821c2291a30bffb14fc749ab0a

SHA256
2aae7ca1195cb538ca85731eb1e9a0bf9d67f9ba3e38f9ce5b37e807e7ec67dd

SHA512
345bbe30a97d9a79d45a4670cd21d6370d874cab33c79f739f99144eae79dc6b224bb027fba4be6747d5150786a14ae13f91423670d47e964cac9532cf7080cf

Download Submit
C:\Windows\System\jssraSK.exe

Filesize
1.4MB

MD5
3e18a44f45ddb9b1b9d8bd4176614eda

SHA1
4c7bfbf1a04dcf37d3a56b105f17ffb36db5c3ec

SHA256
4ba23bb2a542f6d80433f2375bc76409cd74f7eb61838e18c5f3a91343d7bb0a

SHA512
1bc474d00d4a07573194ba9756c5bfd032d8d669da44d1af0df6cae7b7d664a73cd6203ead1ff9a4e26299d8957e34d7d25d3ecdc94909601443638730dc7dd6

Download Submit
C:\Windows\System\jvZHTSB.exe

Filesize
1.4MB

MD5
f1791c4d8383db3ea6009651fa5e84a6

SHA1
9d1b7baded5d89bf082f6d53571ac1a7a8969922

SHA256
3b1eed3d9d815bf03a7fdc340caf18a322d73a9c2b7bb04b60853eeac4c44519

SHA512
cb186c05315883e2c3be28b275587a3077313c63f7debea2068a7e46449a711945d325c26848b5f415aafbc832db0af5e336bf8b03739c628633c13a42389f5e

Download Submit
C:\Windows\System\oRmggUi.exe

Filesize
1.4MB

MD5
d35c2073a37b00a327e0284e4f632c1a

SHA1
b8da97b9b2d9352580e11629f174ac96a7811d46

SHA256
c138f2d1e13e06e9d33d351fdd93657cb84a2c70382c6b9ccda6ade78d02d6ea

SHA512
9cb0d04cfb8077f12f4966302cda0aa0505a5246e649f37fb45b846320f6be0ba4092f42e1670a847f2c58d264708326fed5d42f5bd57a6d62de262a45c35ac3

Download Submit
C:\Windows\System\ovQGEux.exe

Filesize
1.4MB

MD5
69c8d0ce118f4c75f4817243f1061012

SHA1
e3c171ba842ce7806e4aa815e72cbfd1bde7e3de

SHA256
c9165a2e5f19d8573339eaf8eda1e09b5fd11dda34f800b302e2ce6493257bf4

SHA512
ddb820d283937ac0a1b51f92addfdf1c6e3c3c7aba585e72d7d4e6395c69ef8cc463f9857fa2715384c3314881b72156dd7664a70cb4a8ad163a0204cec4de77

Download Submit
C:\Windows\System\pEIcJuD.exe

Filesize
1.4MB

MD5
a1ed51b5e2c67d9f1520290ef15dd44b

SHA1
5d5e09178ba8597a5cc9e543d4c7b2e3b47e9320

SHA256
0d403b5b7043ace4da8487221037a1c40050a11e4a2b24652d4f3b8ebe74131c

SHA512
c019409f2b845e1f44a5155343d0becca2c5d03a44079ad2f8bacad9074719db97af3bc75a94d3708e14328d35c14bce74334dc28034e1b07ba67bbc366181b1

Download Submit
C:\Windows\System\pxDWdcr.exe

Filesize
1.4MB

MD5
4c35cf5066ef9de5cafa02a41911a0ad

SHA1
8072cc551fdbd274f2fb3f73fa12c7732a6c8deb

SHA256
a3d399d9669a9f8973c2811d01d23f3882fcf4beaf670b02fe7526ebbd4117de

SHA512
d5557bfc49cf949ddeebb272220748d3c89e2109569b694296f5db4446aa86ef53723da800a2d0a4eae39a9059ac4fefe7133887bd4cb37e8b701a853fe52152

Download Submit
C:\Windows\System\qILFTrt.exe

Filesize
1.4MB

MD5
cdfc8773fcbc58735a68751299ce7416

SHA1
90da8ab2d0143b276b3b0689f62007e42323bc21

SHA256
fef3068bbde922f5bdd731804d3acac5a7ab8112e364986828153dd8e17808a5

SHA512
d2ca746f443530f72f130a4f27f0aee381cee718e5ff1d4da5cbaa5313a5ce920ccb99c340f4044bbe06594eb349c59b42e10491e146cd4bbd267e834eee0489

Download Submit
C:\Windows\System\qoGTsNC.exe

Filesize
1.4MB

MD5
f2179b5c8e9080e71ba9901b068802af

SHA1
dfbfe71a8c3439d3112ed3054832ee57c79e9688

SHA256
7b991e6a482afa5279b3680ef818069301cdd1d0c574caa7753b1b0ffa7516fd

SHA512
2a8a4522b4d2e3a89390e7ce73f92cdc393464eba4a276e9143ab1eef1de5e6e40d51ed254bec6b118a15daa36c563156b5f606a75b3d87659d173a3b300f780

Download Submit
C:\Windows\System\rKrXfBG.exe

Filesize
1.4MB

MD5
2f7e6e4411883927ba56a277fd2d8436

SHA1
d286a02fcf65d758d81fea2bec1a2bb0f3601913

SHA256
4d3082c216c26323e0645cabcf8f5d61747469fceb9792eb8a43536f511322bb

SHA512
c03dc89a20dff8492cc7b25e821000b6827d6b06d4ce5011470088988f6be8348a65bc570ce550fa86a7c175cbe4786066db3eedd208b9a845d3b6226050cca8

Download Submit
C:\Windows\System\rraueFK.exe

Filesize
1.4MB

MD5
2caea4024aade38485fc7fc91688bdb3

SHA1
ee6dfbc61a6945ae8a47742e7a20fdd2f8b556da

SHA256
2309b0424c6b5ebb04334cde9a85202e9c09ee1448fdd40c716522a897082e30

SHA512
5f1ca56d662386ba11a40f8034d6c8255821e9027a394ad4b40854b960bca39b1e25c94c722b4202265a89e3fe2591cb59e0556fc0a1b79527ec195c7e6c8096

Download Submit
C:\Windows\System\vzdvVul.exe

Filesize
1.4MB

MD5
65112a3fe4ce8ba2ded9d2c68cbdea9a

SHA1
57b59f1645a2d2ccea6302e064b8bfcc9d2c4c2a

SHA256
d535fa795cdba71cec07ee945ff9b0364e48d851426a50ed3d34eeca8321084d

SHA512
13a02e8b876c1d1f53a23430f4f19274b5dd54c184621689482e807f9ebc961251a748851a010d8d112079aa0bb8ecbe74f7ccbb48fe08c42a21d4c83db57c4e

Download Submit
C:\Windows\System\zvzisiq.exe

Filesize
1.4MB

MD5
53bd213e57f293894bf114bec67fc590

SHA1
e5cfa2e0a2c94e016002bf69b22135c8b00bcfb3

SHA256
e63e8eab65dec7acf201e2303fd2adca7d83b2d9cad824f1ef436b95034018b5

SHA512
b410e3ad064b370120421d4f769dcc7c92e6efbf2bb4cb02d8d5513a6e6523eeb278510276d401e270ab66b496da4f39f958c783ef76ca399f7b3cab81835e7d

Download Submit
memory/2768-0-0x0000013760100000-0x0000013760110000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads