xmrig | ab19829557721e75a700e442745dd9e01e4ec65404440c22eefee1e728201ccd

Analysis

max time kernel
121s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
18-11-2024 03:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ab19829557721e75a700e442745dd9e01e4ec65404440c22eefee1e728201ccd.exe
Size

1.6MB
MD5

ae5f8056e1668a76b4e1e0c1785e4366
SHA1

3120da3b3367a9d282e9256de1f54bdf19504d79
SHA256

ab19829557721e75a700e442745dd9e01e4ec65404440c22eefee1e728201ccd
SHA512

6fb86f1c31e5ae691255024d682cd4f5c3f103148d8c39433cb4366bd6a8b7f7d4eee51a16700ef0b9dd29e11f0e8ac2bfb4475f091d9b665c101735427b1e1c
SSDEEP

49152:GezaTF8FcNkNdfE0pZ9oztFwIHT5JbV/cIfycbBzC:GemTLkNdfE0pZaE

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 38 IoCs

miner

resource	yara_rule
behavioral2/files/0x0009000000023ccc-3.dat	xmrig
behavioral2/files/0x0007000000023cd3-7.dat	xmrig
behavioral2/files/0x0007000000023cd2-13.dat	xmrig
behavioral2/files/0x0007000000023cd6-22.dat	xmrig
behavioral2/files/0x0007000000023cd7-29.dat	xmrig
behavioral2/files/0x0007000000023cd9-44.dat	xmrig
behavioral2/files/0x0007000000023ce5-89.dat	xmrig
behavioral2/files/0x0007000000023cef-147.dat	xmrig
behavioral2/files/0x0007000000023cea-166.dat	xmrig
behavioral2/files/0x0007000000023cf6-165.dat	xmrig
behavioral2/files/0x0007000000023ce4-163.dat	xmrig
behavioral2/files/0x0007000000023cf5-162.dat	xmrig
behavioral2/files/0x0007000000023ce9-160.dat	xmrig
behavioral2/files/0x0007000000023cf4-159.dat	xmrig
behavioral2/files/0x0007000000023cf3-158.dat	xmrig
behavioral2/files/0x0007000000023cf2-155.dat	xmrig
behavioral2/files/0x0007000000023cf1-154.dat	xmrig
behavioral2/files/0x0007000000023ce7-152.dat	xmrig
behavioral2/files/0x0007000000023cf0-151.dat	xmrig
behavioral2/files/0x0007000000023cee-143.dat	xmrig
behavioral2/files/0x0007000000023ce3-139.dat	xmrig
behavioral2/files/0x0007000000023ced-135.dat	xmrig
behavioral2/files/0x0007000000023cec-133.dat	xmrig
behavioral2/files/0x0007000000023ce6-129.dat	xmrig
behavioral2/files/0x0007000000023ceb-126.dat	xmrig
behavioral2/files/0x0007000000023ce1-122.dat	xmrig
behavioral2/files/0x0007000000023cdc-119.dat	xmrig
behavioral2/files/0x0007000000023ce8-107.dat	xmrig
behavioral2/files/0x0007000000023cdf-106.dat	xmrig
behavioral2/files/0x0007000000023ce2-105.dat	xmrig
behavioral2/files/0x0007000000023ce0-101.dat	xmrig
behavioral2/files/0x0007000000023cde-99.dat	xmrig
behavioral2/files/0x0007000000023cdd-97.dat	xmrig
behavioral2/files/0x0009000000023ccf-90.dat	xmrig
behavioral2/files/0x0007000000023cdb-62.dat	xmrig
behavioral2/files/0x0007000000023cda-60.dat	xmrig
behavioral2/files/0x0007000000023cd8-48.dat	xmrig
behavioral2/files/0x0007000000023cd4-32.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
4728	ZNApLqW.exe
5064	cypiolt.exe
4736	CUWufUp.exe
3852	IguaaOj.exe
1684	TnRpaaD.exe
5048	aWxmsRA.exe
2380	oOayAOa.exe
1888	LxwuDlB.exe
1468	mpHwFtD.exe
3648	apwcLIb.exe
4348	uylybeX.exe
1712	ESlsfDu.exe
4496	lOOzkQS.exe
5044	qCycBhh.exe
3116	QaSuQAR.exe
2280	WueEqhx.exe
3248	SNwyIVY.exe
1220	ZspNlRi.exe
1604	aVrwVie.exe
4360	gYKCvJk.exe
1192	VwIjCRA.exe
2184	dPmFVhu.exe
3600	HpfuEQc.exe
4872	fyOyMds.exe
2744	UJhvayT.exe
748	nZihoAD.exe
3316	tTDkKmM.exe
4084	tpzAKpw.exe
5112	HImyooZ.exe
4016	dPcixpM.exe
2880	KYZCSRF.exe
4356	MoutOJm.exe
3692	UDQiKgh.exe
1340	OYQDFnA.exe
2692	nNUIiTz.exe
4668	wKGZmXQ.exe
4048	EUwjiCy.exe
1788	Xwudgol.exe
4544	XnhHYjK.exe
1964	pJvKRlh.exe
2664	ddvYgro.exe
1596	rLaBxws.exe
4340	QhmZwdv.exe
1876	Fwlcgfb.exe
736	bMpFtRT.exe
1844	lClGhMc.exe
1296	hsWZRAH.exe
4380	dyiKQgu.exe
1208	vMbTdlh.exe
2596	FJozsyw.exe
4980	pJmTwev.exe
1872	fODAcOa.exe
4488	DSMsLzZ.exe
1568	tHSajBX.exe
3728	gBFxkdt.exe
4764	zkAxdMb.exe
4172	MtGMOvt.exe
32	cvvhXJB.exe
4328	cMtiKaK.exe
2560	tzcYsNO.exe
1608	ddHMcxM.exe
4008	MAOCRCm.exe
4556	xBzInec.exe
4988	TpllLQK.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\wWtxrnb.exe	ab19829557721e75a700e442745dd9e01e4ec65404440c22eefee1e728201ccd.exe
File created	C:\Windows\System\fMSBhYv.exe	ab19829557721e75a700e442745dd9e01e4ec65404440c22eefee1e728201ccd.exe
File created	C:\Windows\System\xoejUsd.exe	ab19829557721e75a700e442745dd9e01e4ec65404440c22eefee1e728201ccd.exe
File created	C:\Windows\System\oOayAOa.exe	ab19829557721e75a700e442745dd9e01e4ec65404440c22eefee1e728201ccd.exe
File created	C:\Windows\System\twkNHiz.exe	ab19829557721e75a700e442745dd9e01e4ec65404440c22eefee1e728201ccd.exe
File created	C:\Windows\System\BCISpjl.exe	ab19829557721e75a700e442745dd9e01e4ec65404440c22eefee1e728201ccd.exe
File created	C:\Windows\System\sMhaZuV.exe	ab19829557721e75a700e442745dd9e01e4ec65404440c22eefee1e728201ccd.exe
File created	C:\Windows\System\HPjQQFQ.exe	ab19829557721e75a700e442745dd9e01e4ec65404440c22eefee1e728201ccd.exe
File created	C:\Windows\System\eqXCYnl.exe	ab19829557721e75a700e442745dd9e01e4ec65404440c22eefee1e728201ccd.exe
File created	C:\Windows\System\dlqOZCR.exe	ab19829557721e75a700e442745dd9e01e4ec65404440c22eefee1e728201ccd.exe
File created	C:\Windows\System\PFjjkHK.exe	ab19829557721e75a700e442745dd9e01e4ec65404440c22eefee1e728201ccd.exe
File created	C:\Windows\System\YsJCwoX.exe	ab19829557721e75a700e442745dd9e01e4ec65404440c22eefee1e728201ccd.exe
File created	C:\Windows\System\wUwbZtA.exe	ab19829557721e75a700e442745dd9e01e4ec65404440c22eefee1e728201ccd.exe
File created	C:\Windows\System\uCLfTZf.exe	ab19829557721e75a700e442745dd9e01e4ec65404440c22eefee1e728201ccd.exe
File created	C:\Windows\System\nrpTIlM.exe	ab19829557721e75a700e442745dd9e01e4ec65404440c22eefee1e728201ccd.exe
File created	C:\Windows\System\pgNqHQZ.exe	ab19829557721e75a700e442745dd9e01e4ec65404440c22eefee1e728201ccd.exe
File created	C:\Windows\System\HBKdWIi.exe	ab19829557721e75a700e442745dd9e01e4ec65404440c22eefee1e728201ccd.exe
File created	C:\Windows\System\wwVJarm.exe	ab19829557721e75a700e442745dd9e01e4ec65404440c22eefee1e728201ccd.exe
File created	C:\Windows\System\LhXCiHi.exe	ab19829557721e75a700e442745dd9e01e4ec65404440c22eefee1e728201ccd.exe
File created	C:\Windows\System\UMDyWqt.exe	ab19829557721e75a700e442745dd9e01e4ec65404440c22eefee1e728201ccd.exe
File created	C:\Windows\System\vBmYqem.exe	ab19829557721e75a700e442745dd9e01e4ec65404440c22eefee1e728201ccd.exe
File created	C:\Windows\System\JESRfLy.exe	ab19829557721e75a700e442745dd9e01e4ec65404440c22eefee1e728201ccd.exe
File created	C:\Windows\System\OdDboyC.exe	ab19829557721e75a700e442745dd9e01e4ec65404440c22eefee1e728201ccd.exe
File created	C:\Windows\System\xtSanqv.exe	ab19829557721e75a700e442745dd9e01e4ec65404440c22eefee1e728201ccd.exe
File created	C:\Windows\System\UcdQXje.exe	ab19829557721e75a700e442745dd9e01e4ec65404440c22eefee1e728201ccd.exe
File created	C:\Windows\System\GEVcXTX.exe	ab19829557721e75a700e442745dd9e01e4ec65404440c22eefee1e728201ccd.exe
File created	C:\Windows\System\iGcAsan.exe	ab19829557721e75a700e442745dd9e01e4ec65404440c22eefee1e728201ccd.exe
File created	C:\Windows\System\xEDlyho.exe	ab19829557721e75a700e442745dd9e01e4ec65404440c22eefee1e728201ccd.exe
File created	C:\Windows\System\oPbQuhU.exe	ab19829557721e75a700e442745dd9e01e4ec65404440c22eefee1e728201ccd.exe
File created	C:\Windows\System\qZDPmOt.exe	ab19829557721e75a700e442745dd9e01e4ec65404440c22eefee1e728201ccd.exe
File created	C:\Windows\System\CrPqSJZ.exe	ab19829557721e75a700e442745dd9e01e4ec65404440c22eefee1e728201ccd.exe
File created	C:\Windows\System\cvZvwjS.exe	ab19829557721e75a700e442745dd9e01e4ec65404440c22eefee1e728201ccd.exe
File created	C:\Windows\System\jDYjBwt.exe	ab19829557721e75a700e442745dd9e01e4ec65404440c22eefee1e728201ccd.exe
File created	C:\Windows\System\mcEDHWR.exe	ab19829557721e75a700e442745dd9e01e4ec65404440c22eefee1e728201ccd.exe
File created	C:\Windows\System\nAhSGQT.exe	ab19829557721e75a700e442745dd9e01e4ec65404440c22eefee1e728201ccd.exe
File created	C:\Windows\System\GYxcOnY.exe	ab19829557721e75a700e442745dd9e01e4ec65404440c22eefee1e728201ccd.exe
File created	C:\Windows\System\pLBuhJu.exe	ab19829557721e75a700e442745dd9e01e4ec65404440c22eefee1e728201ccd.exe
File created	C:\Windows\System\PvAqjNZ.exe	ab19829557721e75a700e442745dd9e01e4ec65404440c22eefee1e728201ccd.exe
File created	C:\Windows\System\AeXLnSA.exe	ab19829557721e75a700e442745dd9e01e4ec65404440c22eefee1e728201ccd.exe
File created	C:\Windows\System\sjxpyXv.exe	ab19829557721e75a700e442745dd9e01e4ec65404440c22eefee1e728201ccd.exe
File created	C:\Windows\System\hsWZRAH.exe	ab19829557721e75a700e442745dd9e01e4ec65404440c22eefee1e728201ccd.exe
File created	C:\Windows\System\QeANiYa.exe	ab19829557721e75a700e442745dd9e01e4ec65404440c22eefee1e728201ccd.exe
File created	C:\Windows\System\GECinvG.exe	ab19829557721e75a700e442745dd9e01e4ec65404440c22eefee1e728201ccd.exe
File created	C:\Windows\System\AqmgCPK.exe	ab19829557721e75a700e442745dd9e01e4ec65404440c22eefee1e728201ccd.exe
File created	C:\Windows\System\mhpDLYl.exe	ab19829557721e75a700e442745dd9e01e4ec65404440c22eefee1e728201ccd.exe
File created	C:\Windows\System\dVLvwpP.exe	ab19829557721e75a700e442745dd9e01e4ec65404440c22eefee1e728201ccd.exe
File created	C:\Windows\System\laaBFmR.exe	ab19829557721e75a700e442745dd9e01e4ec65404440c22eefee1e728201ccd.exe
File created	C:\Windows\System\tVgMojA.exe	ab19829557721e75a700e442745dd9e01e4ec65404440c22eefee1e728201ccd.exe
File created	C:\Windows\System\JvRRsiX.exe	ab19829557721e75a700e442745dd9e01e4ec65404440c22eefee1e728201ccd.exe
File created	C:\Windows\System\qmknZsA.exe	ab19829557721e75a700e442745dd9e01e4ec65404440c22eefee1e728201ccd.exe
File created	C:\Windows\System\BcQYbWw.exe	ab19829557721e75a700e442745dd9e01e4ec65404440c22eefee1e728201ccd.exe
File created	C:\Windows\System\kMSSDBx.exe	ab19829557721e75a700e442745dd9e01e4ec65404440c22eefee1e728201ccd.exe
File created	C:\Windows\System\AsXgwJn.exe	ab19829557721e75a700e442745dd9e01e4ec65404440c22eefee1e728201ccd.exe
File created	C:\Windows\System\gjOGIOg.exe	ab19829557721e75a700e442745dd9e01e4ec65404440c22eefee1e728201ccd.exe
File created	C:\Windows\System\TFYxMSZ.exe	ab19829557721e75a700e442745dd9e01e4ec65404440c22eefee1e728201ccd.exe
File created	C:\Windows\System\uuaJiZC.exe	ab19829557721e75a700e442745dd9e01e4ec65404440c22eefee1e728201ccd.exe
File created	C:\Windows\System\ZmxdUrv.exe	ab19829557721e75a700e442745dd9e01e4ec65404440c22eefee1e728201ccd.exe
File created	C:\Windows\System\YtYlesi.exe	ab19829557721e75a700e442745dd9e01e4ec65404440c22eefee1e728201ccd.exe
File created	C:\Windows\System\DeqEGZC.exe	ab19829557721e75a700e442745dd9e01e4ec65404440c22eefee1e728201ccd.exe
File created	C:\Windows\System\azsUUOk.exe	ab19829557721e75a700e442745dd9e01e4ec65404440c22eefee1e728201ccd.exe
File created	C:\Windows\System\HqOABGj.exe	ab19829557721e75a700e442745dd9e01e4ec65404440c22eefee1e728201ccd.exe
File created	C:\Windows\System\uNIlWpY.exe	ab19829557721e75a700e442745dd9e01e4ec65404440c22eefee1e728201ccd.exe
File created	C:\Windows\System\mJXCbVI.exe	ab19829557721e75a700e442745dd9e01e4ec65404440c22eefee1e728201ccd.exe
File created	C:\Windows\System\fKVgKCb.exe	ab19829557721e75a700e442745dd9e01e4ec65404440c22eefee1e728201ccd.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	16988	dwm.exe
Token: SeChangeNotifyPrivilege	16988	dwm.exe
Token: 33	16988	dwm.exe
Token: SeIncBasePriorityPrivilege	16988	dwm.exe
Token: SeShutdownPrivilege	16988	dwm.exe
Token: SeCreatePagefilePrivilege	16988	dwm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1752 wrote to memory of 4728	1752	ab19829557721e75a700e442745dd9e01e4ec65404440c22eefee1e728201ccd.exe	84
PID 1752 wrote to memory of 4728	1752	ab19829557721e75a700e442745dd9e01e4ec65404440c22eefee1e728201ccd.exe	84
PID 1752 wrote to memory of 5064	1752	ab19829557721e75a700e442745dd9e01e4ec65404440c22eefee1e728201ccd.exe	85
PID 1752 wrote to memory of 5064	1752	ab19829557721e75a700e442745dd9e01e4ec65404440c22eefee1e728201ccd.exe	85
PID 1752 wrote to memory of 4736	1752	ab19829557721e75a700e442745dd9e01e4ec65404440c22eefee1e728201ccd.exe	86
PID 1752 wrote to memory of 4736	1752	ab19829557721e75a700e442745dd9e01e4ec65404440c22eefee1e728201ccd.exe	86
PID 1752 wrote to memory of 3852	1752	ab19829557721e75a700e442745dd9e01e4ec65404440c22eefee1e728201ccd.exe	87
PID 1752 wrote to memory of 3852	1752	ab19829557721e75a700e442745dd9e01e4ec65404440c22eefee1e728201ccd.exe	87
PID 1752 wrote to memory of 1684	1752	ab19829557721e75a700e442745dd9e01e4ec65404440c22eefee1e728201ccd.exe	88
PID 1752 wrote to memory of 1684	1752	ab19829557721e75a700e442745dd9e01e4ec65404440c22eefee1e728201ccd.exe	88
PID 1752 wrote to memory of 5048	1752	ab19829557721e75a700e442745dd9e01e4ec65404440c22eefee1e728201ccd.exe	89
PID 1752 wrote to memory of 5048	1752	ab19829557721e75a700e442745dd9e01e4ec65404440c22eefee1e728201ccd.exe	89
PID 1752 wrote to memory of 2380	1752	ab19829557721e75a700e442745dd9e01e4ec65404440c22eefee1e728201ccd.exe	90
PID 1752 wrote to memory of 2380	1752	ab19829557721e75a700e442745dd9e01e4ec65404440c22eefee1e728201ccd.exe	90
PID 1752 wrote to memory of 3648	1752	ab19829557721e75a700e442745dd9e01e4ec65404440c22eefee1e728201ccd.exe	91
PID 1752 wrote to memory of 3648	1752	ab19829557721e75a700e442745dd9e01e4ec65404440c22eefee1e728201ccd.exe	91
PID 1752 wrote to memory of 1888	1752	ab19829557721e75a700e442745dd9e01e4ec65404440c22eefee1e728201ccd.exe	92
PID 1752 wrote to memory of 1888	1752	ab19829557721e75a700e442745dd9e01e4ec65404440c22eefee1e728201ccd.exe	92
PID 1752 wrote to memory of 1468	1752	ab19829557721e75a700e442745dd9e01e4ec65404440c22eefee1e728201ccd.exe	93
PID 1752 wrote to memory of 1468	1752	ab19829557721e75a700e442745dd9e01e4ec65404440c22eefee1e728201ccd.exe	93
PID 1752 wrote to memory of 4348	1752	ab19829557721e75a700e442745dd9e01e4ec65404440c22eefee1e728201ccd.exe	94
PID 1752 wrote to memory of 4348	1752	ab19829557721e75a700e442745dd9e01e4ec65404440c22eefee1e728201ccd.exe	94
PID 1752 wrote to memory of 1712	1752	ab19829557721e75a700e442745dd9e01e4ec65404440c22eefee1e728201ccd.exe	95
PID 1752 wrote to memory of 1712	1752	ab19829557721e75a700e442745dd9e01e4ec65404440c22eefee1e728201ccd.exe	95
PID 1752 wrote to memory of 4496	1752	ab19829557721e75a700e442745dd9e01e4ec65404440c22eefee1e728201ccd.exe	96
PID 1752 wrote to memory of 4496	1752	ab19829557721e75a700e442745dd9e01e4ec65404440c22eefee1e728201ccd.exe	96
PID 1752 wrote to memory of 5044	1752	ab19829557721e75a700e442745dd9e01e4ec65404440c22eefee1e728201ccd.exe	97
PID 1752 wrote to memory of 5044	1752	ab19829557721e75a700e442745dd9e01e4ec65404440c22eefee1e728201ccd.exe	97
PID 1752 wrote to memory of 1220	1752	ab19829557721e75a700e442745dd9e01e4ec65404440c22eefee1e728201ccd.exe	98
PID 1752 wrote to memory of 1220	1752	ab19829557721e75a700e442745dd9e01e4ec65404440c22eefee1e728201ccd.exe	98
PID 1752 wrote to memory of 3116	1752	ab19829557721e75a700e442745dd9e01e4ec65404440c22eefee1e728201ccd.exe	99
PID 1752 wrote to memory of 3116	1752	ab19829557721e75a700e442745dd9e01e4ec65404440c22eefee1e728201ccd.exe	99
PID 1752 wrote to memory of 2280	1752	ab19829557721e75a700e442745dd9e01e4ec65404440c22eefee1e728201ccd.exe	100
PID 1752 wrote to memory of 2280	1752	ab19829557721e75a700e442745dd9e01e4ec65404440c22eefee1e728201ccd.exe	100
PID 1752 wrote to memory of 3248	1752	ab19829557721e75a700e442745dd9e01e4ec65404440c22eefee1e728201ccd.exe	101
PID 1752 wrote to memory of 3248	1752	ab19829557721e75a700e442745dd9e01e4ec65404440c22eefee1e728201ccd.exe	101
PID 1752 wrote to memory of 1604	1752	ab19829557721e75a700e442745dd9e01e4ec65404440c22eefee1e728201ccd.exe	102
PID 1752 wrote to memory of 1604	1752	ab19829557721e75a700e442745dd9e01e4ec65404440c22eefee1e728201ccd.exe	102
PID 1752 wrote to memory of 2744	1752	ab19829557721e75a700e442745dd9e01e4ec65404440c22eefee1e728201ccd.exe	103
PID 1752 wrote to memory of 2744	1752	ab19829557721e75a700e442745dd9e01e4ec65404440c22eefee1e728201ccd.exe	103
PID 1752 wrote to memory of 4360	1752	ab19829557721e75a700e442745dd9e01e4ec65404440c22eefee1e728201ccd.exe	104
PID 1752 wrote to memory of 4360	1752	ab19829557721e75a700e442745dd9e01e4ec65404440c22eefee1e728201ccd.exe	104
PID 1752 wrote to memory of 1192	1752	ab19829557721e75a700e442745dd9e01e4ec65404440c22eefee1e728201ccd.exe	105
PID 1752 wrote to memory of 1192	1752	ab19829557721e75a700e442745dd9e01e4ec65404440c22eefee1e728201ccd.exe	105
PID 1752 wrote to memory of 2184	1752	ab19829557721e75a700e442745dd9e01e4ec65404440c22eefee1e728201ccd.exe	106
PID 1752 wrote to memory of 2184	1752	ab19829557721e75a700e442745dd9e01e4ec65404440c22eefee1e728201ccd.exe	106
PID 1752 wrote to memory of 3600	1752	ab19829557721e75a700e442745dd9e01e4ec65404440c22eefee1e728201ccd.exe	107
PID 1752 wrote to memory of 3600	1752	ab19829557721e75a700e442745dd9e01e4ec65404440c22eefee1e728201ccd.exe	107
PID 1752 wrote to memory of 4872	1752	ab19829557721e75a700e442745dd9e01e4ec65404440c22eefee1e728201ccd.exe	108
PID 1752 wrote to memory of 4872	1752	ab19829557721e75a700e442745dd9e01e4ec65404440c22eefee1e728201ccd.exe	108
PID 1752 wrote to memory of 748	1752	ab19829557721e75a700e442745dd9e01e4ec65404440c22eefee1e728201ccd.exe	109
PID 1752 wrote to memory of 748	1752	ab19829557721e75a700e442745dd9e01e4ec65404440c22eefee1e728201ccd.exe	109
PID 1752 wrote to memory of 3316	1752	ab19829557721e75a700e442745dd9e01e4ec65404440c22eefee1e728201ccd.exe	110
PID 1752 wrote to memory of 3316	1752	ab19829557721e75a700e442745dd9e01e4ec65404440c22eefee1e728201ccd.exe	110
PID 1752 wrote to memory of 4084	1752	ab19829557721e75a700e442745dd9e01e4ec65404440c22eefee1e728201ccd.exe	111
PID 1752 wrote to memory of 4084	1752	ab19829557721e75a700e442745dd9e01e4ec65404440c22eefee1e728201ccd.exe	111
PID 1752 wrote to memory of 5112	1752	ab19829557721e75a700e442745dd9e01e4ec65404440c22eefee1e728201ccd.exe	112
PID 1752 wrote to memory of 5112	1752	ab19829557721e75a700e442745dd9e01e4ec65404440c22eefee1e728201ccd.exe	112
PID 1752 wrote to memory of 4016	1752	ab19829557721e75a700e442745dd9e01e4ec65404440c22eefee1e728201ccd.exe	113
PID 1752 wrote to memory of 4016	1752	ab19829557721e75a700e442745dd9e01e4ec65404440c22eefee1e728201ccd.exe	113
PID 1752 wrote to memory of 2880	1752	ab19829557721e75a700e442745dd9e01e4ec65404440c22eefee1e728201ccd.exe	114
PID 1752 wrote to memory of 2880	1752	ab19829557721e75a700e442745dd9e01e4ec65404440c22eefee1e728201ccd.exe	114
PID 1752 wrote to memory of 4356	1752	ab19829557721e75a700e442745dd9e01e4ec65404440c22eefee1e728201ccd.exe	115
PID 1752 wrote to memory of 4356	1752	ab19829557721e75a700e442745dd9e01e4ec65404440c22eefee1e728201ccd.exe	115

C:\Users\Admin\AppData\Local\Temp\ab19829557721e75a700e442745dd9e01e4ec65404440c22eefee1e728201ccd.exe
"C:\Users\Admin\AppData\Local\Temp\ab19829557721e75a700e442745dd9e01e4ec65404440c22eefee1e728201ccd.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1752
- C:\Windows\System\ZNApLqW.exe
  C:\Windows\System\ZNApLqW.exe
  2⤵
  - Executes dropped EXE
  PID:4728
- C:\Windows\System\cypiolt.exe
  C:\Windows\System\cypiolt.exe
  2⤵
  - Executes dropped EXE
  PID:5064
- C:\Windows\System\CUWufUp.exe
  C:\Windows\System\CUWufUp.exe
  2⤵
  - Executes dropped EXE
  PID:4736
- C:\Windows\System\IguaaOj.exe
  C:\Windows\System\IguaaOj.exe
  2⤵
  - Executes dropped EXE
  PID:3852
- C:\Windows\System\TnRpaaD.exe
  C:\Windows\System\TnRpaaD.exe
  2⤵
  - Executes dropped EXE
  PID:1684
- C:\Windows\System\aWxmsRA.exe
  C:\Windows\System\aWxmsRA.exe
  2⤵
  - Executes dropped EXE
  PID:5048
- C:\Windows\System\oOayAOa.exe
  C:\Windows\System\oOayAOa.exe
  2⤵
  - Executes dropped EXE
  PID:2380
- C:\Windows\System\apwcLIb.exe
  C:\Windows\System\apwcLIb.exe
  2⤵
  - Executes dropped EXE
  PID:3648
- C:\Windows\System\LxwuDlB.exe
  C:\Windows\System\LxwuDlB.exe
  2⤵
  - Executes dropped EXE
  PID:1888
- C:\Windows\System\mpHwFtD.exe
  C:\Windows\System\mpHwFtD.exe
  2⤵
  - Executes dropped EXE
  PID:1468
- C:\Windows\System\uylybeX.exe
  C:\Windows\System\uylybeX.exe
  2⤵
  - Executes dropped EXE
  PID:4348
- C:\Windows\System\ESlsfDu.exe
  C:\Windows\System\ESlsfDu.exe
  2⤵
  - Executes dropped EXE
  PID:1712
- C:\Windows\System\lOOzkQS.exe
  C:\Windows\System\lOOzkQS.exe
  2⤵
  - Executes dropped EXE
  PID:4496
- C:\Windows\System\qCycBhh.exe
  C:\Windows\System\qCycBhh.exe
  2⤵
  - Executes dropped EXE
  PID:5044
- C:\Windows\System\ZspNlRi.exe
  C:\Windows\System\ZspNlRi.exe
  2⤵
  - Executes dropped EXE
  PID:1220
- C:\Windows\System\QaSuQAR.exe
  C:\Windows\System\QaSuQAR.exe
  2⤵
  - Executes dropped EXE
  PID:3116
- C:\Windows\System\WueEqhx.exe
  C:\Windows\System\WueEqhx.exe
  2⤵
  - Executes dropped EXE
  PID:2280
- C:\Windows\System\SNwyIVY.exe
  C:\Windows\System\SNwyIVY.exe
  2⤵
  - Executes dropped EXE
  PID:3248
- C:\Windows\System\aVrwVie.exe
  C:\Windows\System\aVrwVie.exe
  2⤵
  - Executes dropped EXE
  PID:1604
- C:\Windows\System\UJhvayT.exe
  C:\Windows\System\UJhvayT.exe
  2⤵
  - Executes dropped EXE
  PID:2744
- C:\Windows\System\gYKCvJk.exe
  C:\Windows\System\gYKCvJk.exe
  2⤵
  - Executes dropped EXE
  PID:4360
- C:\Windows\System\VwIjCRA.exe
  C:\Windows\System\VwIjCRA.exe
  2⤵
  - Executes dropped EXE
  PID:1192
- C:\Windows\System\dPmFVhu.exe
  C:\Windows\System\dPmFVhu.exe
  2⤵
  - Executes dropped EXE
  PID:2184
- C:\Windows\System\HpfuEQc.exe
  C:\Windows\System\HpfuEQc.exe
  2⤵
  - Executes dropped EXE
  PID:3600
- C:\Windows\System\fyOyMds.exe
  C:\Windows\System\fyOyMds.exe
  2⤵
  - Executes dropped EXE
  PID:4872
- C:\Windows\System\nZihoAD.exe
  C:\Windows\System\nZihoAD.exe
  2⤵
  - Executes dropped EXE
  PID:748
- C:\Windows\System\tTDkKmM.exe
  C:\Windows\System\tTDkKmM.exe
  2⤵
  - Executes dropped EXE
  PID:3316
- C:\Windows\System\tpzAKpw.exe
  C:\Windows\System\tpzAKpw.exe
  2⤵
  - Executes dropped EXE
  PID:4084
- C:\Windows\System\HImyooZ.exe
  C:\Windows\System\HImyooZ.exe
  2⤵
  - Executes dropped EXE
  PID:5112
- C:\Windows\System\dPcixpM.exe
  C:\Windows\System\dPcixpM.exe
  2⤵
  - Executes dropped EXE
  PID:4016
- C:\Windows\System\KYZCSRF.exe
  C:\Windows\System\KYZCSRF.exe
  2⤵
  - Executes dropped EXE
  PID:2880
- C:\Windows\System\MoutOJm.exe
  C:\Windows\System\MoutOJm.exe
  2⤵
  - Executes dropped EXE
  PID:4356
- C:\Windows\System\UDQiKgh.exe
  C:\Windows\System\UDQiKgh.exe
  2⤵
  - Executes dropped EXE
  PID:3692
- C:\Windows\System\OYQDFnA.exe
  C:\Windows\System\OYQDFnA.exe
  2⤵
  - Executes dropped EXE
  PID:1340
- C:\Windows\System\nNUIiTz.exe
  C:\Windows\System\nNUIiTz.exe
  2⤵
  - Executes dropped EXE
  PID:2692
- C:\Windows\System\wKGZmXQ.exe
  C:\Windows\System\wKGZmXQ.exe
  2⤵
  - Executes dropped EXE
  PID:4668
- C:\Windows\System\EUwjiCy.exe
  C:\Windows\System\EUwjiCy.exe
  2⤵
  - Executes dropped EXE
  PID:4048
- C:\Windows\System\Xwudgol.exe
  C:\Windows\System\Xwudgol.exe
  2⤵
  - Executes dropped EXE
  PID:1788
- C:\Windows\System\XnhHYjK.exe
  C:\Windows\System\XnhHYjK.exe
  2⤵
  - Executes dropped EXE
  PID:4544
- C:\Windows\System\pJvKRlh.exe
  C:\Windows\System\pJvKRlh.exe
  2⤵
  - Executes dropped EXE
  PID:1964
- C:\Windows\System\ddvYgro.exe
  C:\Windows\System\ddvYgro.exe
  2⤵
  - Executes dropped EXE
  PID:2664
- C:\Windows\System\rLaBxws.exe
  C:\Windows\System\rLaBxws.exe
  2⤵
  - Executes dropped EXE
  PID:1596
- C:\Windows\System\QhmZwdv.exe
  C:\Windows\System\QhmZwdv.exe
  2⤵
  - Executes dropped EXE
  PID:4340
- C:\Windows\System\Fwlcgfb.exe
  C:\Windows\System\Fwlcgfb.exe
  2⤵
  - Executes dropped EXE
  PID:1876
- C:\Windows\System\bMpFtRT.exe
  C:\Windows\System\bMpFtRT.exe
  2⤵
  - Executes dropped EXE
  PID:736
- C:\Windows\System\lClGhMc.exe
  C:\Windows\System\lClGhMc.exe
  2⤵
  - Executes dropped EXE
  PID:1844
- C:\Windows\System\hsWZRAH.exe
  C:\Windows\System\hsWZRAH.exe
  2⤵
  - Executes dropped EXE
  PID:1296
- C:\Windows\System\dyiKQgu.exe
  C:\Windows\System\dyiKQgu.exe
  2⤵
  - Executes dropped EXE
  PID:4380
- C:\Windows\System\vMbTdlh.exe
  C:\Windows\System\vMbTdlh.exe
  2⤵
  - Executes dropped EXE
  PID:1208
- C:\Windows\System\FJozsyw.exe
  C:\Windows\System\FJozsyw.exe
  2⤵
  - Executes dropped EXE
  PID:2596
- C:\Windows\System\pJmTwev.exe
  C:\Windows\System\pJmTwev.exe
  2⤵
  - Executes dropped EXE
  PID:4980
- C:\Windows\System\fODAcOa.exe
  C:\Windows\System\fODAcOa.exe
  2⤵
  - Executes dropped EXE
  PID:1872
- C:\Windows\System\DSMsLzZ.exe
  C:\Windows\System\DSMsLzZ.exe
  2⤵
  - Executes dropped EXE
  PID:4488
- C:\Windows\System\tHSajBX.exe
  C:\Windows\System\tHSajBX.exe
  2⤵
  - Executes dropped EXE
  PID:1568
- C:\Windows\System\gBFxkdt.exe
  C:\Windows\System\gBFxkdt.exe
  2⤵
  - Executes dropped EXE
  PID:3728
- C:\Windows\System\zkAxdMb.exe
  C:\Windows\System\zkAxdMb.exe
  2⤵
  - Executes dropped EXE
  PID:4764
- C:\Windows\System\MtGMOvt.exe
  C:\Windows\System\MtGMOvt.exe
  2⤵
  - Executes dropped EXE
  PID:4172
- C:\Windows\System\cvvhXJB.exe
  C:\Windows\System\cvvhXJB.exe
  2⤵
  - Executes dropped EXE
  PID:32
- C:\Windows\System\cMtiKaK.exe
  C:\Windows\System\cMtiKaK.exe
  2⤵
  - Executes dropped EXE
  PID:4328
- C:\Windows\System\tzcYsNO.exe
  C:\Windows\System\tzcYsNO.exe
  2⤵
  - Executes dropped EXE
  PID:2560
- C:\Windows\System\ddHMcxM.exe
  C:\Windows\System\ddHMcxM.exe
  2⤵
  - Executes dropped EXE
  PID:1608
- C:\Windows\System\MAOCRCm.exe
  C:\Windows\System\MAOCRCm.exe
  2⤵
  - Executes dropped EXE
  PID:4008
- C:\Windows\System\xBzInec.exe
  C:\Windows\System\xBzInec.exe
  2⤵
  - Executes dropped EXE
  PID:4556
- C:\Windows\System\TpllLQK.exe
  C:\Windows\System\TpllLQK.exe
  2⤵
  - Executes dropped EXE
  PID:4988
- C:\Windows\System\MAKHXIw.exe
  C:\Windows\System\MAKHXIw.exe
  2⤵
  PID:4524
- C:\Windows\System\iwaxUSq.exe
  C:\Windows\System\iwaxUSq.exe
  2⤵
  PID:2540
- C:\Windows\System\WXMAQSV.exe
  C:\Windows\System\WXMAQSV.exe
  2⤵
  PID:3592
- C:\Windows\System\NjerFto.exe
  C:\Windows\System\NjerFto.exe
  2⤵
  PID:320
- C:\Windows\System\epeTLwj.exe
  C:\Windows\System\epeTLwj.exe
  2⤵
  PID:4576
- C:\Windows\System\LmSmXMG.exe
  C:\Windows\System\LmSmXMG.exe
  2⤵
  PID:888
- C:\Windows\System\mxNcspn.exe
  C:\Windows\System\mxNcspn.exe
  2⤵
  PID:4660
- C:\Windows\System\xggUHHF.exe
  C:\Windows\System\xggUHHF.exe
  2⤵
  PID:2556
- C:\Windows\System\KMqSpbM.exe
  C:\Windows\System\KMqSpbM.exe
  2⤵
  PID:2500
- C:\Windows\System\CjWFxbV.exe
  C:\Windows\System\CjWFxbV.exe
  2⤵
  PID:2868
- C:\Windows\System\vBmYqem.exe
  C:\Windows\System\vBmYqem.exe
  2⤵
  PID:3144
- C:\Windows\System\LhXCiHi.exe
  C:\Windows\System\LhXCiHi.exe
  2⤵
  PID:3580
- C:\Windows\System\ecUpJio.exe
  C:\Windows\System\ecUpJio.exe
  2⤵
  PID:764
- C:\Windows\System\HhXkdYb.exe
  C:\Windows\System\HhXkdYb.exe
  2⤵
  PID:4760
- C:\Windows\System\ZkQLujm.exe
  C:\Windows\System\ZkQLujm.exe
  2⤵
  PID:1408
- C:\Windows\System\dEqxQOp.exe
  C:\Windows\System\dEqxQOp.exe
  2⤵
  PID:4632
- C:\Windows\System\wUwbZtA.exe
  C:\Windows\System\wUwbZtA.exe
  2⤵
  PID:212
- C:\Windows\System\DJSYcGe.exe
  C:\Windows\System\DJSYcGe.exe
  2⤵
  PID:440
- C:\Windows\System\UkPWIXB.exe
  C:\Windows\System\UkPWIXB.exe
  2⤵
  PID:3200
- C:\Windows\System\yjTWuWH.exe
  C:\Windows\System\yjTWuWH.exe
  2⤵
  PID:1348
- C:\Windows\System\tPiCyLA.exe
  C:\Windows\System\tPiCyLA.exe
  2⤵
  PID:3148
- C:\Windows\System\ZYJXMaT.exe
  C:\Windows\System\ZYJXMaT.exe
  2⤵
  PID:3476
- C:\Windows\System\nXXRBIl.exe
  C:\Windows\System\nXXRBIl.exe
  2⤵
  PID:1252
- C:\Windows\System\JDfhUfn.exe
  C:\Windows\System\JDfhUfn.exe
  2⤵
  PID:4456
- C:\Windows\System\GipIyad.exe
  C:\Windows\System\GipIyad.exe
  2⤵
  PID:964
- C:\Windows\System\nXWdVsX.exe
  C:\Windows\System\nXWdVsX.exe
  2⤵
  PID:1336
- C:\Windows\System\yytXJUJ.exe
  C:\Windows\System\yytXJUJ.exe
  2⤵
  PID:3392
- C:\Windows\System\oVhoNvB.exe
  C:\Windows\System\oVhoNvB.exe
  2⤵
  PID:4332
- C:\Windows\System\bkBiBYs.exe
  C:\Windows\System\bkBiBYs.exe
  2⤵
  PID:4912
- C:\Windows\System\RHKwOEH.exe
  C:\Windows\System\RHKwOEH.exe
  2⤵
  PID:4352
- C:\Windows\System\hcToClu.exe
  C:\Windows\System\hcToClu.exe
  2⤵
  PID:1636
- C:\Windows\System\fzuONTV.exe
  C:\Windows\System\fzuONTV.exe
  2⤵
  PID:5104
- C:\Windows\System\KjXTmVy.exe
  C:\Windows\System\KjXTmVy.exe
  2⤵
  PID:944
- C:\Windows\System\slodqYY.exe
  C:\Windows\System\slodqYY.exe
  2⤵
  PID:1452
- C:\Windows\System\YndiNBY.exe
  C:\Windows\System\YndiNBY.exe
  2⤵
  PID:5088
- C:\Windows\System\UMsBRsE.exe
  C:\Windows\System\UMsBRsE.exe
  2⤵
  PID:2472
- C:\Windows\System\UnKXyqU.exe
  C:\Windows\System\UnKXyqU.exe
  2⤵
  PID:732
- C:\Windows\System\sThfohy.exe
  C:\Windows\System\sThfohy.exe
  2⤵
  PID:3700
- C:\Windows\System\KhEmCXY.exe
  C:\Windows\System\KhEmCXY.exe
  2⤵
  PID:4824
- C:\Windows\System\QnKaWrw.exe
  C:\Windows\System\QnKaWrw.exe
  2⤵
  PID:1828
- C:\Windows\System\SXOBQKU.exe
  C:\Windows\System\SXOBQKU.exe
  2⤵
  PID:5136
- C:\Windows\System\VetDZwQ.exe
  C:\Windows\System\VetDZwQ.exe
  2⤵
  PID:5164
- C:\Windows\System\rSIhaKk.exe
  C:\Windows\System\rSIhaKk.exe
  2⤵
  PID:5192
- C:\Windows\System\BTWvRTf.exe
  C:\Windows\System\BTWvRTf.exe
  2⤵
  PID:5224
- C:\Windows\System\IFGGwYN.exe
  C:\Windows\System\IFGGwYN.exe
  2⤵
  PID:5252
- C:\Windows\System\nhSPUvb.exe
  C:\Windows\System\nhSPUvb.exe
  2⤵
  PID:5268
- C:\Windows\System\duumiqS.exe
  C:\Windows\System\duumiqS.exe
  2⤵
  PID:5308
- C:\Windows\System\QZjCUxX.exe
  C:\Windows\System\QZjCUxX.exe
  2⤵
  PID:5336
- C:\Windows\System\RNDIpAX.exe
  C:\Windows\System\RNDIpAX.exe
  2⤵
  PID:5364
- C:\Windows\System\WgdtBEl.exe
  C:\Windows\System\WgdtBEl.exe
  2⤵
  PID:5388
- C:\Windows\System\vnmpYHG.exe
  C:\Windows\System\vnmpYHG.exe
  2⤵
  PID:5412
- C:\Windows\System\FBjaYxV.exe
  C:\Windows\System\FBjaYxV.exe
  2⤵
  PID:5448
- C:\Windows\System\avNCaDT.exe
  C:\Windows\System\avNCaDT.exe
  2⤵
  PID:5464
- C:\Windows\System\QRxQmdY.exe
  C:\Windows\System\QRxQmdY.exe
  2⤵
  PID:5496
- C:\Windows\System\PdppqdQ.exe
  C:\Windows\System\PdppqdQ.exe
  2⤵
  PID:5536
- C:\Windows\System\WYfEOXP.exe
  C:\Windows\System\WYfEOXP.exe
  2⤵
  PID:5564
- C:\Windows\System\xtSanqv.exe
  C:\Windows\System\xtSanqv.exe
  2⤵
  PID:5584
- C:\Windows\System\HWPqMbz.exe
  C:\Windows\System\HWPqMbz.exe
  2⤵
  PID:5608
- C:\Windows\System\fLIGBuR.exe
  C:\Windows\System\fLIGBuR.exe
  2⤵
  PID:5640
- C:\Windows\System\hzDIhBc.exe
  C:\Windows\System\hzDIhBc.exe
  2⤵
  PID:5664
- C:\Windows\System\locobdT.exe
  C:\Windows\System\locobdT.exe
  2⤵
  PID:5696
- C:\Windows\System\qwckkNO.exe
  C:\Windows\System\qwckkNO.exe
  2⤵
  PID:5716
- C:\Windows\System\DLDdHKf.exe
  C:\Windows\System\DLDdHKf.exe
  2⤵
  PID:5744
- C:\Windows\System\oCpwFkP.exe
  C:\Windows\System\oCpwFkP.exe
  2⤵
  PID:5772
- C:\Windows\System\eOIuTXA.exe
  C:\Windows\System\eOIuTXA.exe
  2⤵
  PID:5796
- C:\Windows\System\QPxTmmT.exe
  C:\Windows\System\QPxTmmT.exe
  2⤵
  PID:5824
- C:\Windows\System\TMQFscC.exe
  C:\Windows\System\TMQFscC.exe
  2⤵
  PID:5848
- C:\Windows\System\dDZlYGj.exe
  C:\Windows\System\dDZlYGj.exe
  2⤵
  PID:5880
- C:\Windows\System\IlUUGuD.exe
  C:\Windows\System\IlUUGuD.exe
  2⤵
  PID:5904
- C:\Windows\System\LePPfop.exe
  C:\Windows\System\LePPfop.exe
  2⤵
  PID:5932
- C:\Windows\System\XjtnVSa.exe
  C:\Windows\System\XjtnVSa.exe
  2⤵
  PID:5956
- C:\Windows\System\MRhcCdw.exe
  C:\Windows\System\MRhcCdw.exe
  2⤵
  PID:5980
- C:\Windows\System\gXZAHYx.exe
  C:\Windows\System\gXZAHYx.exe
  2⤵
  PID:6004
- C:\Windows\System\nsaUMCn.exe
  C:\Windows\System\nsaUMCn.exe
  2⤵
  PID:6032
- C:\Windows\System\APMijmy.exe
  C:\Windows\System\APMijmy.exe
  2⤵
  PID:6056
- C:\Windows\System\YTQeZsb.exe
  C:\Windows\System\YTQeZsb.exe
  2⤵
  PID:6088
- C:\Windows\System\MPUKiVy.exe
  C:\Windows\System\MPUKiVy.exe
  2⤵
  PID:6124
- C:\Windows\System\ugQmqZm.exe
  C:\Windows\System\ugQmqZm.exe
  2⤵
  PID:2444
- C:\Windows\System\IdtuDXE.exe
  C:\Windows\System\IdtuDXE.exe
  2⤵
  PID:5160
- C:\Windows\System\eUsvToT.exe
  C:\Windows\System\eUsvToT.exe
  2⤵
  PID:5204
- C:\Windows\System\JzOvYDA.exe
  C:\Windows\System\JzOvYDA.exe
  2⤵
  PID:5264
- C:\Windows\System\FfFxCLX.exe
  C:\Windows\System\FfFxCLX.exe
  2⤵
  PID:5332
- C:\Windows\System\yClkNsR.exe
  C:\Windows\System\yClkNsR.exe
  2⤵
  PID:5408
- C:\Windows\System\PwErnfQ.exe
  C:\Windows\System\PwErnfQ.exe
  2⤵
  PID:5528
- C:\Windows\System\yNwAVJY.exe
  C:\Windows\System\yNwAVJY.exe
  2⤵
  PID:5592
- C:\Windows\System\PMagPZK.exe
  C:\Windows\System\PMagPZK.exe
  2⤵
  PID:5660
- C:\Windows\System\rSzdzYB.exe
  C:\Windows\System\rSzdzYB.exe
  2⤵
  PID:5760
- C:\Windows\System\cLdALvi.exe
  C:\Windows\System\cLdALvi.exe
  2⤵
  PID:5784
- C:\Windows\System\MqJiFjz.exe
  C:\Windows\System\MqJiFjz.exe
  2⤵
  PID:5840
- C:\Windows\System\Mbjdkdi.exe
  C:\Windows\System\Mbjdkdi.exe
  2⤵
  PID:5964
- C:\Windows\System\TbQckdC.exe
  C:\Windows\System\TbQckdC.exe
  2⤵
  PID:6068
- C:\Windows\System\pUMAwgn.exe
  C:\Windows\System\pUMAwgn.exe
  2⤵
  PID:6104
- C:\Windows\System\wetClUf.exe
  C:\Windows\System\wetClUf.exe
  2⤵
  PID:5212
- C:\Windows\System\LjHXbwU.exe
  C:\Windows\System\LjHXbwU.exe
  2⤵
  PID:5240
- C:\Windows\System\DhpAuso.exe
  C:\Windows\System\DhpAuso.exe
  2⤵
  PID:5480
- C:\Windows\System\mJXCbVI.exe
  C:\Windows\System\mJXCbVI.exe
  2⤵
  PID:5624
- C:\Windows\System\PoPBPPJ.exe
  C:\Windows\System\PoPBPPJ.exe
  2⤵
  PID:5872
- C:\Windows\System\XLiDacp.exe
  C:\Windows\System\XLiDacp.exe
  2⤵
  PID:5924
- C:\Windows\System\BrjSlDo.exe
  C:\Windows\System\BrjSlDo.exe
  2⤵
  PID:6080
- C:\Windows\System\kxVZhQl.exe
  C:\Windows\System\kxVZhQl.exe
  2⤵
  PID:5124
- C:\Windows\System\mYpGxWl.exe
  C:\Windows\System\mYpGxWl.exe
  2⤵
  PID:5380
- C:\Windows\System\HlAawdU.exe
  C:\Windows\System\HlAawdU.exe
  2⤵
  PID:5676
- C:\Windows\System\wrDOqtn.exe
  C:\Windows\System\wrDOqtn.exe
  2⤵
  PID:5976
- C:\Windows\System\EPqlXpa.exe
  C:\Windows\System\EPqlXpa.exe
  2⤵
  PID:5996
- C:\Windows\System\BOsrZwS.exe
  C:\Windows\System\BOsrZwS.exe
  2⤵
  PID:6164
- C:\Windows\System\ZYqMDlX.exe
  C:\Windows\System\ZYqMDlX.exe
  2⤵
  PID:6192
- C:\Windows\System\uQXwvoR.exe
  C:\Windows\System\uQXwvoR.exe
  2⤵
  PID:6220
- C:\Windows\System\IWwLfBm.exe
  C:\Windows\System\IWwLfBm.exe
  2⤵
  PID:6244
- C:\Windows\System\SrNTyDy.exe
  C:\Windows\System\SrNTyDy.exe
  2⤵
  PID:6268
- C:\Windows\System\HoahHpP.exe
  C:\Windows\System\HoahHpP.exe
  2⤵
  PID:6296
- C:\Windows\System\DEezMlX.exe
  C:\Windows\System\DEezMlX.exe
  2⤵
  PID:6332
- C:\Windows\System\bFBGKpw.exe
  C:\Windows\System\bFBGKpw.exe
  2⤵
  PID:6364
- C:\Windows\System\YWeaghW.exe
  C:\Windows\System\YWeaghW.exe
  2⤵
  PID:6396
- C:\Windows\System\ERvqQhi.exe
  C:\Windows\System\ERvqQhi.exe
  2⤵
  PID:6424
- C:\Windows\System\SQjnasx.exe
  C:\Windows\System\SQjnasx.exe
  2⤵
  PID:6452
- C:\Windows\System\ZxKthZh.exe
  C:\Windows\System\ZxKthZh.exe
  2⤵
  PID:6480
- C:\Windows\System\BpsqXwp.exe
  C:\Windows\System\BpsqXwp.exe
  2⤵
  PID:6512
- C:\Windows\System\CcQIxku.exe
  C:\Windows\System\CcQIxku.exe
  2⤵
  PID:6536
- C:\Windows\System\RklyWXm.exe
  C:\Windows\System\RklyWXm.exe
  2⤵
  PID:6564
- C:\Windows\System\UfrpuLJ.exe
  C:\Windows\System\UfrpuLJ.exe
  2⤵
  PID:6596
- C:\Windows\System\kUhBgrq.exe
  C:\Windows\System\kUhBgrq.exe
  2⤵
  PID:6624
- C:\Windows\System\PXhbLSw.exe
  C:\Windows\System\PXhbLSw.exe
  2⤵
  PID:6652
- C:\Windows\System\eNRBamo.exe
  C:\Windows\System\eNRBamo.exe
  2⤵
  PID:6680
- C:\Windows\System\wWtxrnb.exe
  C:\Windows\System\wWtxrnb.exe
  2⤵
  PID:6704
- C:\Windows\System\rFkrpNR.exe
  C:\Windows\System\rFkrpNR.exe
  2⤵
  PID:6732
- C:\Windows\System\hQFvzzM.exe
  C:\Windows\System\hQFvzzM.exe
  2⤵
  PID:6760
- C:\Windows\System\AFiqgIA.exe
  C:\Windows\System\AFiqgIA.exe
  2⤵
  PID:6776
- C:\Windows\System\xEDlyho.exe
  C:\Windows\System\xEDlyho.exe
  2⤵
  PID:6804
- C:\Windows\System\KiVrglC.exe
  C:\Windows\System\KiVrglC.exe
  2⤵
  PID:6836
- C:\Windows\System\QxSlzqL.exe
  C:\Windows\System\QxSlzqL.exe
  2⤵
  PID:6860
- C:\Windows\System\hPKVWGm.exe
  C:\Windows\System\hPKVWGm.exe
  2⤵
  PID:6892
- C:\Windows\System\oiMgpRH.exe
  C:\Windows\System\oiMgpRH.exe
  2⤵
  PID:6920
- C:\Windows\System\sjUUsRX.exe
  C:\Windows\System\sjUUsRX.exe
  2⤵
  PID:6948
- C:\Windows\System\BXnsvjq.exe
  C:\Windows\System\BXnsvjq.exe
  2⤵
  PID:6980
- C:\Windows\System\uCLfTZf.exe
  C:\Windows\System\uCLfTZf.exe
  2⤵
  PID:7008
- C:\Windows\System\ERsGcAZ.exe
  C:\Windows\System\ERsGcAZ.exe
  2⤵
  PID:7032
- C:\Windows\System\VVnSaCA.exe
  C:\Windows\System\VVnSaCA.exe
  2⤵
  PID:7060
- C:\Windows\System\ZSbTKdI.exe
  C:\Windows\System\ZSbTKdI.exe
  2⤵
  PID:7084
- C:\Windows\System\peUvAis.exe
  C:\Windows\System\peUvAis.exe
  2⤵
  PID:7104
- C:\Windows\System\xiVOFzm.exe
  C:\Windows\System\xiVOFzm.exe
  2⤵
  PID:7128
- C:\Windows\System\mpmNZsD.exe
  C:\Windows\System\mpmNZsD.exe
  2⤵
  PID:7152
- C:\Windows\System\jPgcbEE.exe
  C:\Windows\System\jPgcbEE.exe
  2⤵
  PID:6148
- C:\Windows\System\lRnWRuD.exe
  C:\Windows\System\lRnWRuD.exe
  2⤵
  PID:6240
- C:\Windows\System\YaHcZKu.exe
  C:\Windows\System\YaHcZKu.exe
  2⤵
  PID:6260
- C:\Windows\System\suDjony.exe
  C:\Windows\System\suDjony.exe
  2⤵
  PID:6348
- C:\Windows\System\kjWePZQ.exe
  C:\Windows\System\kjWePZQ.exe
  2⤵
  PID:6380
- C:\Windows\System\dZBlJOA.exe
  C:\Windows\System\dZBlJOA.exe
  2⤵
  PID:6448
- C:\Windows\System\iiEIAPv.exe
  C:\Windows\System\iiEIAPv.exe
  2⤵
  PID:6524
- C:\Windows\System\nEcCBHz.exe
  C:\Windows\System\nEcCBHz.exe
  2⤵
  PID:6548
- C:\Windows\System\QMPqWSI.exe
  C:\Windows\System\QMPqWSI.exe
  2⤵
  PID:6608
- C:\Windows\System\SmmvVzH.exe
  C:\Windows\System\SmmvVzH.exe
  2⤵
  PID:6716
- C:\Windows\System\rhhxMGB.exe
  C:\Windows\System\rhhxMGB.exe
  2⤵
  PID:6800
- C:\Windows\System\ERjyUtj.exe
  C:\Windows\System\ERjyUtj.exe
  2⤵
  PID:6856
- C:\Windows\System\CJCjaeq.exe
  C:\Windows\System\CJCjaeq.exe
  2⤵
  PID:6932
- C:\Windows\System\xyKdArX.exe
  C:\Windows\System\xyKdArX.exe
  2⤵
  PID:6976
- C:\Windows\System\dYOqIXw.exe
  C:\Windows\System\dYOqIXw.exe
  2⤵
  PID:7040
- C:\Windows\System\hTfkAAd.exe
  C:\Windows\System\hTfkAAd.exe
  2⤵
  PID:7136
- C:\Windows\System\wbwSEKa.exe
  C:\Windows\System\wbwSEKa.exe
  2⤵
  PID:6200
- C:\Windows\System\HZnQPBQ.exe
  C:\Windows\System\HZnQPBQ.exe
  2⤵
  PID:6324
- C:\Windows\System\OMuxnrC.exe
  C:\Windows\System\OMuxnrC.exe
  2⤵
  PID:6284
- C:\Windows\System\HuOUoIi.exe
  C:\Windows\System\HuOUoIi.exe
  2⤵
  PID:6520
- C:\Windows\System\rklscRx.exe
  C:\Windows\System\rklscRx.exe
  2⤵
  PID:6672
- C:\Windows\System\LBHSFBg.exe
  C:\Windows\System\LBHSFBg.exe
  2⤵
  PID:6908
- C:\Windows\System\enBTWSV.exe
  C:\Windows\System\enBTWSV.exe
  2⤵
  PID:6996
- C:\Windows\System\jzyPemf.exe
  C:\Windows\System\jzyPemf.exe
  2⤵
  PID:7140
- C:\Windows\System\JvamMvI.exe
  C:\Windows\System\JvamMvI.exe
  2⤵
  PID:6476
- C:\Windows\System\RWGzWyF.exe
  C:\Windows\System\RWGzWyF.exe
  2⤵
  PID:6748
- C:\Windows\System\YqsXKAD.exe
  C:\Windows\System\YqsXKAD.exe
  2⤵
  PID:7188
- C:\Windows\System\TdaCvry.exe
  C:\Windows\System\TdaCvry.exe
  2⤵
  PID:7220
- C:\Windows\System\tPFAEmu.exe
  C:\Windows\System\tPFAEmu.exe
  2⤵
  PID:7248
- C:\Windows\System\apUaGuG.exe
  C:\Windows\System\apUaGuG.exe
  2⤵
  PID:7280
- C:\Windows\System\edMkRqt.exe
  C:\Windows\System\edMkRqt.exe
  2⤵
  PID:7308
- C:\Windows\System\dYlCreH.exe
  C:\Windows\System\dYlCreH.exe
  2⤵
  PID:7340
- C:\Windows\System\mfKIzJh.exe
  C:\Windows\System\mfKIzJh.exe
  2⤵
  PID:7372
- C:\Windows\System\jPlCaSd.exe
  C:\Windows\System\jPlCaSd.exe
  2⤵
  PID:7396
- C:\Windows\System\DxetQhQ.exe
  C:\Windows\System\DxetQhQ.exe
  2⤵
  PID:7428
- C:\Windows\System\PIRCtcr.exe
  C:\Windows\System\PIRCtcr.exe
  2⤵
  PID:7464
- C:\Windows\System\nQfhGrf.exe
  C:\Windows\System\nQfhGrf.exe
  2⤵
  PID:7492
- C:\Windows\System\FKBLARc.exe
  C:\Windows\System\FKBLARc.exe
  2⤵
  PID:7516
- C:\Windows\System\vAstXEK.exe
  C:\Windows\System\vAstXEK.exe
  2⤵
  PID:7552
- C:\Windows\System\NGsFnca.exe
  C:\Windows\System\NGsFnca.exe
  2⤵
  PID:7584
- C:\Windows\System\qSmdgsD.exe
  C:\Windows\System\qSmdgsD.exe
  2⤵
  PID:7608
- C:\Windows\System\hkQoyCM.exe
  C:\Windows\System\hkQoyCM.exe
  2⤵
  PID:7636
- C:\Windows\System\kNpeVOQ.exe
  C:\Windows\System\kNpeVOQ.exe
  2⤵
  PID:7672
- C:\Windows\System\FMIRlPm.exe
  C:\Windows\System\FMIRlPm.exe
  2⤵
  PID:7700
- C:\Windows\System\vbhnwlp.exe
  C:\Windows\System\vbhnwlp.exe
  2⤵
  PID:7732
- C:\Windows\System\PinTyqr.exe
  C:\Windows\System\PinTyqr.exe
  2⤵
  PID:7760
- C:\Windows\System\RmKHVPN.exe
  C:\Windows\System\RmKHVPN.exe
  2⤵
  PID:7788
- C:\Windows\System\UAUZNtP.exe
  C:\Windows\System\UAUZNtP.exe
  2⤵
  PID:7824
- C:\Windows\System\souwLSP.exe
  C:\Windows\System\souwLSP.exe
  2⤵
  PID:7852
- C:\Windows\System\fMSBhYv.exe
  C:\Windows\System\fMSBhYv.exe
  2⤵
  PID:7872
- C:\Windows\System\gJHGKVo.exe
  C:\Windows\System\gJHGKVo.exe
  2⤵
  PID:7888
- C:\Windows\System\xVuBGRx.exe
  C:\Windows\System\xVuBGRx.exe
  2⤵
  PID:7904
- C:\Windows\System\UskiXza.exe
  C:\Windows\System\UskiXza.exe
  2⤵
  PID:7928
- C:\Windows\System\sQJAPla.exe
  C:\Windows\System\sQJAPla.exe
  2⤵
  PID:7948
- C:\Windows\System\laaBFmR.exe
  C:\Windows\System\laaBFmR.exe
  2⤵
  PID:7972
- C:\Windows\System\kAGTFPK.exe
  C:\Windows\System\kAGTFPK.exe
  2⤵
  PID:8004
- C:\Windows\System\qLIDUsV.exe
  C:\Windows\System\qLIDUsV.exe
  2⤵
  PID:8040
- C:\Windows\System\YJikKbJ.exe
  C:\Windows\System\YJikKbJ.exe
  2⤵
  PID:8076
- C:\Windows\System\NqdswyT.exe
  C:\Windows\System\NqdswyT.exe
  2⤵
  PID:8104
- C:\Windows\System\QMQaCfQ.exe
  C:\Windows\System\QMQaCfQ.exe
  2⤵
  PID:8128
- C:\Windows\System\HDOxKcp.exe
  C:\Windows\System\HDOxKcp.exe
  2⤵
  PID:8148
- C:\Windows\System\EMOrWyr.exe
  C:\Windows\System\EMOrWyr.exe
  2⤵
  PID:8184
- C:\Windows\System\zBqQSVn.exe
  C:\Windows\System\zBqQSVn.exe
  2⤵
  PID:7180
- C:\Windows\System\VFJkHYA.exe
  C:\Windows\System\VFJkHYA.exe
  2⤵
  PID:7264
- C:\Windows\System\nTAkOQO.exe
  C:\Windows\System\nTAkOQO.exe
  2⤵
  PID:7272
- C:\Windows\System\tRAXkqM.exe
  C:\Windows\System\tRAXkqM.exe
  2⤵
  PID:7292
- C:\Windows\System\SmANKNA.exe
  C:\Windows\System\SmANKNA.exe
  2⤵
  PID:7388
- C:\Windows\System\pyIRJxq.exe
  C:\Windows\System\pyIRJxq.exe
  2⤵
  PID:7440
- C:\Windows\System\DJpVOWI.exe
  C:\Windows\System\DJpVOWI.exe
  2⤵
  PID:7528
- C:\Windows\System\BXndnjy.exe
  C:\Windows\System\BXndnjy.exe
  2⤵
  PID:7596
- C:\Windows\System\YwFvCAP.exe
  C:\Windows\System\YwFvCAP.exe
  2⤵
  PID:7664
- C:\Windows\System\aeZnxuO.exe
  C:\Windows\System\aeZnxuO.exe
  2⤵
  PID:7812
- C:\Windows\System\QtjtTef.exe
  C:\Windows\System\QtjtTef.exe
  2⤵
  PID:7912
- C:\Windows\System\fSGBjAq.exe
  C:\Windows\System\fSGBjAq.exe
  2⤵
  PID:8024
- C:\Windows\System\TNyecCT.exe
  C:\Windows\System\TNyecCT.exe
  2⤵
  PID:7960
- C:\Windows\System\fVSToJk.exe
  C:\Windows\System\fVSToJk.exe
  2⤵
  PID:8060
- C:\Windows\System\BtTILXY.exe
  C:\Windows\System\BtTILXY.exe
  2⤵
  PID:8172
- C:\Windows\System\vjhgQND.exe
  C:\Windows\System\vjhgQND.exe
  2⤵
  PID:8120
- C:\Windows\System\HsrxRBG.exe
  C:\Windows\System\HsrxRBG.exe
  2⤵
  PID:7176
- C:\Windows\System\TpzSOAL.exe
  C:\Windows\System\TpzSOAL.exe
  2⤵
  PID:7452
- C:\Windows\System\UcdQXje.exe
  C:\Windows\System\UcdQXje.exe
  2⤵
  PID:7604
- C:\Windows\System\RNPWFYB.exe
  C:\Windows\System\RNPWFYB.exe
  2⤵
  PID:7696
- C:\Windows\System\bOqzWSg.exe
  C:\Windows\System\bOqzWSg.exe
  2⤵
  PID:7900
- C:\Windows\System\FvFUGHc.exe
  C:\Windows\System\FvFUGHc.exe
  2⤵
  PID:8016
- C:\Windows\System\PfbZJpc.exe
  C:\Windows\System\PfbZJpc.exe
  2⤵
  PID:8136
- C:\Windows\System\qRRdLoX.exe
  C:\Windows\System\qRRdLoX.exe
  2⤵
  PID:7360
- C:\Windows\System\GECinvG.exe
  C:\Windows\System\GECinvG.exe
  2⤵
  PID:7780
- C:\Windows\System\GYxcOnY.exe
  C:\Windows\System\GYxcOnY.exe
  2⤵
  PID:8144
- C:\Windows\System\dqIMxXF.exe
  C:\Windows\System\dqIMxXF.exe
  2⤵
  PID:7208
- C:\Windows\System\sVgcqwQ.exe
  C:\Windows\System\sVgcqwQ.exe
  2⤵
  PID:8212
- C:\Windows\System\pnrkPjg.exe
  C:\Windows\System\pnrkPjg.exe
  2⤵
  PID:8232
- C:\Windows\System\gYfWhdD.exe
  C:\Windows\System\gYfWhdD.exe
  2⤵
  PID:8252
- C:\Windows\System\NBNwXvJ.exe
  C:\Windows\System\NBNwXvJ.exe
  2⤵
  PID:8276
- C:\Windows\System\vASgsYi.exe
  C:\Windows\System\vASgsYi.exe
  2⤵
  PID:8308
- C:\Windows\System\ystGgRH.exe
  C:\Windows\System\ystGgRH.exe
  2⤵
  PID:8336
- C:\Windows\System\oPbQuhU.exe
  C:\Windows\System\oPbQuhU.exe
  2⤵
  PID:8356
- C:\Windows\System\nSWgDnY.exe
  C:\Windows\System\nSWgDnY.exe
  2⤵
  PID:8384
- C:\Windows\System\vVEqtWB.exe
  C:\Windows\System\vVEqtWB.exe
  2⤵
  PID:8412
- C:\Windows\System\IGvDDyM.exe
  C:\Windows\System\IGvDDyM.exe
  2⤵
  PID:8436
- C:\Windows\System\kBgKqOe.exe
  C:\Windows\System\kBgKqOe.exe
  2⤵
  PID:8464
- C:\Windows\System\CpgAaMA.exe
  C:\Windows\System\CpgAaMA.exe
  2⤵
  PID:8484
- C:\Windows\System\hreHrbG.exe
  C:\Windows\System\hreHrbG.exe
  2⤵
  PID:8508
- C:\Windows\System\loqWdYu.exe
  C:\Windows\System\loqWdYu.exe
  2⤵
  PID:8532
- C:\Windows\System\dRGouRH.exe
  C:\Windows\System\dRGouRH.exe
  2⤵
  PID:8576
- C:\Windows\System\dwUuJDh.exe
  C:\Windows\System\dwUuJDh.exe
  2⤵
  PID:8608
- C:\Windows\System\wILrPRR.exe
  C:\Windows\System\wILrPRR.exe
  2⤵
  PID:8632
- C:\Windows\System\IcRiqeK.exe
  C:\Windows\System\IcRiqeK.exe
  2⤵
  PID:8652
- C:\Windows\System\xoejUsd.exe
  C:\Windows\System\xoejUsd.exe
  2⤵
  PID:8668
- C:\Windows\System\ogHCwIO.exe
  C:\Windows\System\ogHCwIO.exe
  2⤵
  PID:8692
- C:\Windows\System\rsvMdGd.exe
  C:\Windows\System\rsvMdGd.exe
  2⤵
  PID:8724
- C:\Windows\System\FasPcdf.exe
  C:\Windows\System\FasPcdf.exe
  2⤵
  PID:8752
- C:\Windows\System\PZjefVc.exe
  C:\Windows\System\PZjefVc.exe
  2⤵
  PID:8780
- C:\Windows\System\dljdIoc.exe
  C:\Windows\System\dljdIoc.exe
  2⤵
  PID:8812
- C:\Windows\System\NSgdnSn.exe
  C:\Windows\System\NSgdnSn.exe
  2⤵
  PID:8844
- C:\Windows\System\rLoZMaM.exe
  C:\Windows\System\rLoZMaM.exe
  2⤵
  PID:8868
- C:\Windows\System\HwDbUyK.exe
  C:\Windows\System\HwDbUyK.exe
  2⤵
  PID:8896
- C:\Windows\System\sCwVFYi.exe
  C:\Windows\System\sCwVFYi.exe
  2⤵
  PID:8920
- C:\Windows\System\foZTKTV.exe
  C:\Windows\System\foZTKTV.exe
  2⤵
  PID:8948
- C:\Windows\System\BikCbhh.exe
  C:\Windows\System\BikCbhh.exe
  2⤵
  PID:8980
- C:\Windows\System\pqFOoOJ.exe
  C:\Windows\System\pqFOoOJ.exe
  2⤵
  PID:9012
- C:\Windows\System\SAXPJnR.exe
  C:\Windows\System\SAXPJnR.exe
  2⤵
  PID:9048
- C:\Windows\System\ADYzwmN.exe
  C:\Windows\System\ADYzwmN.exe
  2⤵
  PID:9076
- C:\Windows\System\KCDdflA.exe
  C:\Windows\System\KCDdflA.exe
  2⤵
  PID:9108
- C:\Windows\System\CPOGfSa.exe
  C:\Windows\System\CPOGfSa.exe
  2⤵
  PID:9128
- C:\Windows\System\aqvlBTe.exe
  C:\Windows\System\aqvlBTe.exe
  2⤵
  PID:9156
- C:\Windows\System\HslmcCR.exe
  C:\Windows\System\HslmcCR.exe
  2⤵
  PID:9180
- C:\Windows\System\ZcKbrtd.exe
  C:\Windows\System\ZcKbrtd.exe
  2⤵
  PID:7816
- C:\Windows\System\pHiWPbk.exe
  C:\Windows\System\pHiWPbk.exe
  2⤵
  PID:8220
- C:\Windows\System\emUBgsW.exe
  C:\Windows\System\emUBgsW.exe
  2⤵
  PID:8300
- C:\Windows\System\cOdKvFb.exe
  C:\Windows\System\cOdKvFb.exe
  2⤵
  PID:8292
- C:\Windows\System\VkfYUIW.exe
  C:\Windows\System\VkfYUIW.exe
  2⤵
  PID:8396
- C:\Windows\System\SNgQXCP.exe
  C:\Windows\System\SNgQXCP.exe
  2⤵
  PID:8496
- C:\Windows\System\OBNMIoF.exe
  C:\Windows\System\OBNMIoF.exe
  2⤵
  PID:8460
- C:\Windows\System\hnSIAEo.exe
  C:\Windows\System\hnSIAEo.exe
  2⤵
  PID:8520
- C:\Windows\System\FxJGlMN.exe
  C:\Windows\System\FxJGlMN.exe
  2⤵
  PID:8600
- C:\Windows\System\QawLPJR.exe
  C:\Windows\System\QawLPJR.exe
  2⤵
  PID:8800
- C:\Windows\System\yVyJjjA.exe
  C:\Windows\System\yVyJjjA.exe
  2⤵
  PID:8824
- C:\Windows\System\AShpqbT.exe
  C:\Windows\System\AShpqbT.exe
  2⤵
  PID:8864
- C:\Windows\System\rYQdWmd.exe
  C:\Windows\System\rYQdWmd.exe
  2⤵
  PID:9020
- C:\Windows\System\UFUJhfM.exe
  C:\Windows\System\UFUJhfM.exe
  2⤵
  PID:9056
- C:\Windows\System\cIFlbcn.exe
  C:\Windows\System\cIFlbcn.exe
  2⤵
  PID:9136
- C:\Windows\System\yTxLmkj.exe
  C:\Windows\System\yTxLmkj.exe
  2⤵
  PID:8284
- C:\Windows\System\oUMZbsB.exe
  C:\Windows\System\oUMZbsB.exe
  2⤵
  PID:8096
- C:\Windows\System\CpUXyNA.exe
  C:\Windows\System\CpUXyNA.exe
  2⤵
  PID:8372
- C:\Windows\System\qUuuqhs.exe
  C:\Windows\System\qUuuqhs.exe
  2⤵
  PID:8428
- C:\Windows\System\baYccVs.exe
  C:\Windows\System\baYccVs.exe
  2⤵
  PID:8684
- C:\Windows\System\QSoQABC.exe
  C:\Windows\System\QSoQABC.exe
  2⤵
  PID:8840
- C:\Windows\System\XcrGAwz.exe
  C:\Windows\System\XcrGAwz.exe
  2⤵
  PID:8972
- C:\Windows\System\oUBsQCf.exe
  C:\Windows\System\oUBsQCf.exe
  2⤵
  PID:9176
- C:\Windows\System\VTBjMea.exe
  C:\Windows\System\VTBjMea.exe
  2⤵
  PID:8444
- C:\Windows\System\tiliJho.exe
  C:\Windows\System\tiliJho.exe
  2⤵
  PID:8596
- C:\Windows\System\VwlQxkU.exe
  C:\Windows\System\VwlQxkU.exe
  2⤵
  PID:9000
- C:\Windows\System\kMSSDBx.exe
  C:\Windows\System\kMSSDBx.exe
  2⤵
  PID:8124
- C:\Windows\System\CYGAsVM.exe
  C:\Windows\System\CYGAsVM.exe
  2⤵
  PID:8936
- C:\Windows\System\TFYxMSZ.exe
  C:\Windows\System\TFYxMSZ.exe
  2⤵
  PID:9232
- C:\Windows\System\fDgjExl.exe
  C:\Windows\System\fDgjExl.exe
  2⤵
  PID:9264
- C:\Windows\System\SlOCOQn.exe
  C:\Windows\System\SlOCOQn.exe
  2⤵
  PID:9296
- C:\Windows\System\YEqQZDy.exe
  C:\Windows\System\YEqQZDy.exe
  2⤵
  PID:9320
- C:\Windows\System\JXJFISG.exe
  C:\Windows\System\JXJFISG.exe
  2⤵
  PID:9348
- C:\Windows\System\UAzeXNE.exe
  C:\Windows\System\UAzeXNE.exe
  2⤵
  PID:9368
- C:\Windows\System\XqdyJnF.exe
  C:\Windows\System\XqdyJnF.exe
  2⤵
  PID:9396
- C:\Windows\System\pguLZPP.exe
  C:\Windows\System\pguLZPP.exe
  2⤵
  PID:9428
- C:\Windows\System\ONbUxCw.exe
  C:\Windows\System\ONbUxCw.exe
  2⤵
  PID:9456
- C:\Windows\System\cWmIzVG.exe
  C:\Windows\System\cWmIzVG.exe
  2⤵
  PID:9480
- C:\Windows\System\CdPTmiM.exe
  C:\Windows\System\CdPTmiM.exe
  2⤵
  PID:9508
- C:\Windows\System\haIhOYc.exe
  C:\Windows\System\haIhOYc.exe
  2⤵
  PID:9536
- C:\Windows\System\QMwIsbP.exe
  C:\Windows\System\QMwIsbP.exe
  2⤵
  PID:9560
- C:\Windows\System\bCGOPNE.exe
  C:\Windows\System\bCGOPNE.exe
  2⤵
  PID:9592
- C:\Windows\System\vTWBmzQ.exe
  C:\Windows\System\vTWBmzQ.exe
  2⤵
  PID:9620
- C:\Windows\System\GoWkkBe.exe
  C:\Windows\System\GoWkkBe.exe
  2⤵
  PID:9648
- C:\Windows\System\JZHiCuk.exe
  C:\Windows\System\JZHiCuk.exe
  2⤵
  PID:9680
- C:\Windows\System\gJkNDbJ.exe
  C:\Windows\System\gJkNDbJ.exe
  2⤵
  PID:9712
- C:\Windows\System\JESRfLy.exe
  C:\Windows\System\JESRfLy.exe
  2⤵
  PID:9748
- C:\Windows\System\twkNHiz.exe
  C:\Windows\System\twkNHiz.exe
  2⤵
  PID:9788
- C:\Windows\System\nrpTIlM.exe
  C:\Windows\System\nrpTIlM.exe
  2⤵
  PID:9808
- C:\Windows\System\qNrDdWu.exe
  C:\Windows\System\qNrDdWu.exe
  2⤵
  PID:9840
- C:\Windows\System\lRDAhXD.exe
  C:\Windows\System\lRDAhXD.exe
  2⤵
  PID:9860
- C:\Windows\System\qZDPmOt.exe
  C:\Windows\System\qZDPmOt.exe
  2⤵
  PID:9896
- C:\Windows\System\mITcxaL.exe
  C:\Windows\System\mITcxaL.exe
  2⤵
  PID:9924
- C:\Windows\System\MDnzHeA.exe
  C:\Windows\System\MDnzHeA.exe
  2⤵
  PID:9952
- C:\Windows\System\RmuoOdp.exe
  C:\Windows\System\RmuoOdp.exe
  2⤵
  PID:9980
- C:\Windows\System\aNIIEhA.exe
  C:\Windows\System\aNIIEhA.exe
  2⤵
  PID:10000
- C:\Windows\System\HqOABGj.exe
  C:\Windows\System\HqOABGj.exe
  2⤵
  PID:10036
- C:\Windows\System\iyaDiAj.exe
  C:\Windows\System\iyaDiAj.exe
  2⤵
  PID:10060
- C:\Windows\System\wwDEzMT.exe
  C:\Windows\System\wwDEzMT.exe
  2⤵
  PID:10084
- C:\Windows\System\oGxjEUa.exe
  C:\Windows\System\oGxjEUa.exe
  2⤵
  PID:10108
- C:\Windows\System\QonZpQl.exe
  C:\Windows\System\QonZpQl.exe
  2⤵
  PID:10124
- C:\Windows\System\WTnAMHd.exe
  C:\Windows\System\WTnAMHd.exe
  2⤵
  PID:10160
- C:\Windows\System\uLCFeGS.exe
  C:\Windows\System\uLCFeGS.exe
  2⤵
  PID:10176
- C:\Windows\System\OahAkOW.exe
  C:\Windows\System\OahAkOW.exe
  2⤵
  PID:10200
- C:\Windows\System\dPGeRnd.exe
  C:\Windows\System\dPGeRnd.exe
  2⤵
  PID:10224
- C:\Windows\System\FjsriSc.exe
  C:\Windows\System\FjsriSc.exe
  2⤵
  PID:9220
- C:\Windows\System\TJTjARk.exe
  C:\Windows\System\TJTjARk.exe
  2⤵
  PID:9244
- C:\Windows\System\NLZBbaP.exe
  C:\Windows\System\NLZBbaP.exe
  2⤵
  PID:9364
- C:\Windows\System\ltHXOOX.exe
  C:\Windows\System\ltHXOOX.exe
  2⤵
  PID:9412
- C:\Windows\System\VYMoFsW.exe
  C:\Windows\System\VYMoFsW.exe
  2⤵
  PID:9464
- C:\Windows\System\HYjtEKw.exe
  C:\Windows\System\HYjtEKw.exe
  2⤵
  PID:9516
- C:\Windows\System\OdDboyC.exe
  C:\Windows\System\OdDboyC.exe
  2⤵
  PID:9604
- C:\Windows\System\MjwHgKp.exe
  C:\Windows\System\MjwHgKp.exe
  2⤵
  PID:9688
- C:\Windows\System\MsgfLPf.exe
  C:\Windows\System\MsgfLPf.exe
  2⤵
  PID:9732
- C:\Windows\System\vCuKUvG.exe
  C:\Windows\System\vCuKUvG.exe
  2⤵
  PID:9796
- C:\Windows\System\bObqmpy.exe
  C:\Windows\System\bObqmpy.exe
  2⤵
  PID:9884
- C:\Windows\System\IIoAwSP.exe
  C:\Windows\System\IIoAwSP.exe
  2⤵
  PID:9908
- C:\Windows\System\QyWUioN.exe
  C:\Windows\System\QyWUioN.exe
  2⤵
  PID:9992
- C:\Windows\System\PMxRhBh.exe
  C:\Windows\System\PMxRhBh.exe
  2⤵
  PID:10048
- C:\Windows\System\KQzNPWb.exe
  C:\Windows\System\KQzNPWb.exe
  2⤵
  PID:8988
- C:\Windows\System\QtRmBFv.exe
  C:\Windows\System\QtRmBFv.exe
  2⤵
  PID:10168
- C:\Windows\System\NYTDcNB.exe
  C:\Windows\System\NYTDcNB.exe
  2⤵
  PID:8796
- C:\Windows\System\rsOpJqb.exe
  C:\Windows\System\rsOpJqb.exe
  2⤵
  PID:10216
- C:\Windows\System\qzIAfIJ.exe
  C:\Windows\System\qzIAfIJ.exe
  2⤵
  PID:9444
- C:\Windows\System\mMspATP.exe
  C:\Windows\System\mMspATP.exe
  2⤵
  PID:9448
- C:\Windows\System\yOxIPbN.exe
  C:\Windows\System\yOxIPbN.exe
  2⤵
  PID:9704
- C:\Windows\System\NrqeLPW.exe
  C:\Windows\System\NrqeLPW.exe
  2⤵
  PID:9852
- C:\Windows\System\CwmczxF.exe
  C:\Windows\System\CwmczxF.exe
  2⤵
  PID:10008
- C:\Windows\System\rYBbTBA.exe
  C:\Windows\System\rYBbTBA.exe
  2⤵
  PID:9632
- C:\Windows\System\IJXrmUF.exe
  C:\Windows\System\IJXrmUF.exe
  2⤵
  PID:9376
- C:\Windows\System\CrPqSJZ.exe
  C:\Windows\System\CrPqSJZ.exe
  2⤵
  PID:9556
- C:\Windows\System\STbEGku.exe
  C:\Windows\System\STbEGku.exe
  2⤵
  PID:10196
- C:\Windows\System\NuLcaxW.exe
  C:\Windows\System\NuLcaxW.exe
  2⤵
  PID:10248
- C:\Windows\System\BalFTPm.exe
  C:\Windows\System\BalFTPm.exe
  2⤵
  PID:10280
- C:\Windows\System\cLmkGZl.exe
  C:\Windows\System\cLmkGZl.exe
  2⤵
  PID:10312
- C:\Windows\System\WDzgURh.exe
  C:\Windows\System\WDzgURh.exe
  2⤵
  PID:10340
- C:\Windows\System\qWlmEBy.exe
  C:\Windows\System\qWlmEBy.exe
  2⤵
  PID:10372
- C:\Windows\System\IXcbkcw.exe
  C:\Windows\System\IXcbkcw.exe
  2⤵
  PID:10396
- C:\Windows\System\uNIlWpY.exe
  C:\Windows\System\uNIlWpY.exe
  2⤵
  PID:10428
- C:\Windows\System\RDgFdXC.exe
  C:\Windows\System\RDgFdXC.exe
  2⤵
  PID:10452
- C:\Windows\System\MrggGLf.exe
  C:\Windows\System\MrggGLf.exe
  2⤵
  PID:10476
- C:\Windows\System\acgSqbj.exe
  C:\Windows\System\acgSqbj.exe
  2⤵
  PID:10508
- C:\Windows\System\jPAccIf.exe
  C:\Windows\System\jPAccIf.exe
  2⤵
  PID:10532
- C:\Windows\System\HjjnfKu.exe
  C:\Windows\System\HjjnfKu.exe
  2⤵
  PID:10564
- C:\Windows\System\rIdbwIN.exe
  C:\Windows\System\rIdbwIN.exe
  2⤵
  PID:10580
- C:\Windows\System\cdvPLec.exe
  C:\Windows\System\cdvPLec.exe
  2⤵
  PID:10608
- C:\Windows\System\vWjdTWp.exe
  C:\Windows\System\vWjdTWp.exe
  2⤵
  PID:10624
- C:\Windows\System\eEUlfHu.exe
  C:\Windows\System\eEUlfHu.exe
  2⤵
  PID:10648
- C:\Windows\System\KNaYkaN.exe
  C:\Windows\System\KNaYkaN.exe
  2⤵
  PID:10680
- C:\Windows\System\RxytqtD.exe
  C:\Windows\System\RxytqtD.exe
  2⤵
  PID:10712
- C:\Windows\System\nhHeRSe.exe
  C:\Windows\System\nhHeRSe.exe
  2⤵
  PID:10740
- C:\Windows\System\THHsjfI.exe
  C:\Windows\System\THHsjfI.exe
  2⤵
  PID:10772
- C:\Windows\System\YzdxQEq.exe
  C:\Windows\System\YzdxQEq.exe
  2⤵
  PID:10800
- C:\Windows\System\NGhetmq.exe
  C:\Windows\System\NGhetmq.exe
  2⤵
  PID:10824
- C:\Windows\System\zWjcHdn.exe
  C:\Windows\System\zWjcHdn.exe
  2⤵
  PID:10856
- C:\Windows\System\tglRiMx.exe
  C:\Windows\System\tglRiMx.exe
  2⤵
  PID:10884
- C:\Windows\System\SnfilHO.exe
  C:\Windows\System\SnfilHO.exe
  2⤵
  PID:10912
- C:\Windows\System\XvvsSlY.exe
  C:\Windows\System\XvvsSlY.exe
  2⤵
  PID:10932
- C:\Windows\System\HkJuqOr.exe
  C:\Windows\System\HkJuqOr.exe
  2⤵
  PID:10952
- C:\Windows\System\vsMRkMu.exe
  C:\Windows\System\vsMRkMu.exe
  2⤵
  PID:10984
- C:\Windows\System\RmTgPCm.exe
  C:\Windows\System\RmTgPCm.exe
  2⤵
  PID:11004
- C:\Windows\System\AhhMXrZ.exe
  C:\Windows\System\AhhMXrZ.exe
  2⤵
  PID:11024
- C:\Windows\System\JVKHqMz.exe
  C:\Windows\System\JVKHqMz.exe
  2⤵
  PID:11052
- C:\Windows\System\FpXXkUZ.exe
  C:\Windows\System\FpXXkUZ.exe
  2⤵
  PID:11076
- C:\Windows\System\yEkIprN.exe
  C:\Windows\System\yEkIprN.exe
  2⤵
  PID:11104
- C:\Windows\System\RiPLuCm.exe
  C:\Windows\System\RiPLuCm.exe
  2⤵
  PID:11124
- C:\Windows\System\uuaJiZC.exe
  C:\Windows\System\uuaJiZC.exe
  2⤵
  PID:11152
- C:\Windows\System\qmwdXrY.exe
  C:\Windows\System\qmwdXrY.exe
  2⤵
  PID:11176
- C:\Windows\System\cvZvwjS.exe
  C:\Windows\System\cvZvwjS.exe
  2⤵
  PID:11200
- C:\Windows\System\ihYUUGc.exe
  C:\Windows\System\ihYUUGc.exe
  2⤵
  PID:11232
- C:\Windows\System\zVWOksk.exe
  C:\Windows\System\zVWOksk.exe
  2⤵
  PID:11256
- C:\Windows\System\pgNqHQZ.exe
  C:\Windows\System\pgNqHQZ.exe
  2⤵
  PID:9920
- C:\Windows\System\tTtQalc.exe
  C:\Windows\System\tTtQalc.exe
  2⤵
  PID:9832
- C:\Windows\System\DcAmjZO.exe
  C:\Windows\System\DcAmjZO.exe
  2⤵
  PID:10260
- C:\Windows\System\cRHufgQ.exe
  C:\Windows\System\cRHufgQ.exe
  2⤵
  PID:10328
- C:\Windows\System\npBAmMs.exe
  C:\Windows\System\npBAmMs.exe
  2⤵
  PID:10384
- C:\Windows\System\KKDlwKf.exe
  C:\Windows\System\KKDlwKf.exe
  2⤵
  PID:10408
- C:\Windows\System\YUahiud.exe
  C:\Windows\System\YUahiud.exe
  2⤵
  PID:10460
- C:\Windows\System\zPdFqdm.exe
  C:\Windows\System\zPdFqdm.exe
  2⤵
  PID:10484
- C:\Windows\System\MKlcGUu.exe
  C:\Windows\System\MKlcGUu.exe
  2⤵
  PID:10700
- C:\Windows\System\qzuGvqY.exe
  C:\Windows\System\qzuGvqY.exe
  2⤵
  PID:10760
- C:\Windows\System\vufAIbj.exe
  C:\Windows\System\vufAIbj.exe
  2⤵
  PID:10632
- C:\Windows\System\cPCgyCK.exe
  C:\Windows\System\cPCgyCK.exe
  2⤵
  PID:10904
- C:\Windows\System\qAviawC.exe
  C:\Windows\System\qAviawC.exe
  2⤵
  PID:10940
- C:\Windows\System\vpSoztR.exe
  C:\Windows\System\vpSoztR.exe
  2⤵
  PID:10872
- C:\Windows\System\dFfaOmq.exe
  C:\Windows\System\dFfaOmq.exe
  2⤵
  PID:11048
- C:\Windows\System\bFNViFM.exe
  C:\Windows\System\bFNViFM.exe
  2⤵
  PID:10972
- C:\Windows\System\hAgNmGv.exe
  C:\Windows\System\hAgNmGv.exe
  2⤵
  PID:11020
- C:\Windows\System\EcJcTSI.exe
  C:\Windows\System\EcJcTSI.exe
  2⤵
  PID:11172
- C:\Windows\System\sXHAPAw.exe
  C:\Windows\System\sXHAPAw.exe
  2⤵
  PID:11000
- C:\Windows\System\DQsEPgU.exe
  C:\Windows\System\DQsEPgU.exe
  2⤵
  PID:10292
- C:\Windows\System\ODpYBDA.exe
  C:\Windows\System\ODpYBDA.exe
  2⤵
  PID:10268
- C:\Windows\System\QeANiYa.exe
  C:\Windows\System\QeANiYa.exe
  2⤵
  PID:10756
- C:\Windows\System\dNuVCNE.exe
  C:\Windows\System\dNuVCNE.exe
  2⤵
  PID:10528
- C:\Windows\System\qmknZsA.exe
  C:\Windows\System\qmknZsA.exe
  2⤵
  PID:11016
- C:\Windows\System\teENIJa.exe
  C:\Windows\System\teENIJa.exe
  2⤵
  PID:10704
- C:\Windows\System\UpLzMca.exe
  C:\Windows\System\UpLzMca.exe
  2⤵
  PID:10356
- C:\Windows\System\ZmxdUrv.exe
  C:\Windows\System\ZmxdUrv.exe
  2⤵
  PID:11288
- C:\Windows\System\DLXkqeb.exe
  C:\Windows\System\DLXkqeb.exe
  2⤵
  PID:11308
- C:\Windows\System\IkDLyfV.exe
  C:\Windows\System\IkDLyfV.exe
  2⤵
  PID:11336
- C:\Windows\System\SRgHdGF.exe
  C:\Windows\System\SRgHdGF.exe
  2⤵
  PID:11364
- C:\Windows\System\NQfTzko.exe
  C:\Windows\System\NQfTzko.exe
  2⤵
  PID:11388
- C:\Windows\System\PNvcZWc.exe
  C:\Windows\System\PNvcZWc.exe
  2⤵
  PID:11412
- C:\Windows\System\oaSYyJe.exe
  C:\Windows\System\oaSYyJe.exe
  2⤵
  PID:11428
- C:\Windows\System\WifYaYG.exe
  C:\Windows\System\WifYaYG.exe
  2⤵
  PID:11452
- C:\Windows\System\vdJaxmj.exe
  C:\Windows\System\vdJaxmj.exe
  2⤵
  PID:11472
- C:\Windows\System\kqLQcmD.exe
  C:\Windows\System\kqLQcmD.exe
  2⤵
  PID:11500
- C:\Windows\System\gqkcubz.exe
  C:\Windows\System\gqkcubz.exe
  2⤵
  PID:11528
- C:\Windows\System\gcuAcvu.exe
  C:\Windows\System\gcuAcvu.exe
  2⤵
  PID:11552
- C:\Windows\System\TKWHlrj.exe
  C:\Windows\System\TKWHlrj.exe
  2⤵
  PID:11572
- C:\Windows\System\ONkyxLg.exe
  C:\Windows\System\ONkyxLg.exe
  2⤵
  PID:11592
- C:\Windows\System\hcyoVvb.exe
  C:\Windows\System\hcyoVvb.exe
  2⤵
  PID:11624
- C:\Windows\System\cKuNZCa.exe
  C:\Windows\System\cKuNZCa.exe
  2⤵
  PID:11648
- C:\Windows\System\VFvmnlu.exe
  C:\Windows\System\VFvmnlu.exe
  2⤵
  PID:11680
- C:\Windows\System\pNNjBtW.exe
  C:\Windows\System\pNNjBtW.exe
  2⤵
  PID:11708
- C:\Windows\System\hPIztjh.exe
  C:\Windows\System\hPIztjh.exe
  2⤵
  PID:11736
- C:\Windows\System\UDGcVYm.exe
  C:\Windows\System\UDGcVYm.exe
  2⤵
  PID:11760
- C:\Windows\System\uiQxbXf.exe
  C:\Windows\System\uiQxbXf.exe
  2⤵
  PID:11792
- C:\Windows\System\YSaFtxc.exe
  C:\Windows\System\YSaFtxc.exe
  2⤵
  PID:11820
- C:\Windows\System\XTiZqpG.exe
  C:\Windows\System\XTiZqpG.exe
  2⤵
  PID:11844
- C:\Windows\System\fopLHsF.exe
  C:\Windows\System\fopLHsF.exe
  2⤵
  PID:11876
- C:\Windows\System\APGCixC.exe
  C:\Windows\System\APGCixC.exe
  2⤵
  PID:11900
- C:\Windows\System\WZSzMjp.exe
  C:\Windows\System\WZSzMjp.exe
  2⤵
  PID:11928
- C:\Windows\System\oqdZkPp.exe
  C:\Windows\System\oqdZkPp.exe
  2⤵
  PID:11952
- C:\Windows\System\wqUtrPK.exe
  C:\Windows\System\wqUtrPK.exe
  2⤵
  PID:11992
- C:\Windows\System\fKVgKCb.exe
  C:\Windows\System\fKVgKCb.exe
  2⤵
  PID:12020
- C:\Windows\System\oaNuJRg.exe
  C:\Windows\System\oaNuJRg.exe
  2⤵
  PID:12056
- C:\Windows\System\GFXJZuu.exe
  C:\Windows\System\GFXJZuu.exe
  2⤵
  PID:12084
- C:\Windows\System\SmvqASR.exe
  C:\Windows\System\SmvqASR.exe
  2⤵
  PID:12112
- C:\Windows\System\jpPjonh.exe
  C:\Windows\System\jpPjonh.exe
  2⤵
  PID:12140
- C:\Windows\System\jDYjBwt.exe
  C:\Windows\System\jDYjBwt.exe
  2⤵
  PID:12164
- C:\Windows\System\nUsdAHI.exe
  C:\Windows\System\nUsdAHI.exe
  2⤵
  PID:12192
- C:\Windows\System\hmQSHtN.exe
  C:\Windows\System\hmQSHtN.exe
  2⤵
  PID:12220
- C:\Windows\System\PZqfwSj.exe
  C:\Windows\System\PZqfwSj.exe
  2⤵
  PID:12260
- C:\Windows\System\aZsehSl.exe
  C:\Windows\System\aZsehSl.exe
  2⤵
  PID:12276
- C:\Windows\System\MBYkRVB.exe
  C:\Windows\System\MBYkRVB.exe
  2⤵
  PID:10968
- C:\Windows\System\uUZtJch.exe
  C:\Windows\System\uUZtJch.exe
  2⤵
  PID:11316
- C:\Windows\System\jkAQSYg.exe
  C:\Windows\System\jkAQSYg.exe
  2⤵
  PID:11168
- C:\Windows\System\xXQulav.exe
  C:\Windows\System\xXQulav.exe
  2⤵
  PID:11324
- C:\Windows\System\iDRUXFZ.exe
  C:\Windows\System\iDRUXFZ.exe
  2⤵
  PID:11376
- C:\Windows\System\WoyAsAe.exe
  C:\Windows\System\WoyAsAe.exe
  2⤵
  PID:11296
- C:\Windows\System\ZzyLUFn.exe
  C:\Windows\System\ZzyLUFn.exe
  2⤵
  PID:11644
- C:\Windows\System\RoTxJps.exe
  C:\Windows\System\RoTxJps.exe
  2⤵
  PID:11352
- C:\Windows\System\AeXLnSA.exe
  C:\Windows\System\AeXLnSA.exe
  2⤵
  PID:11436
- C:\Windows\System\YzSbCOt.exe
  C:\Windows\System\YzSbCOt.exe
  2⤵
  PID:11564
- C:\Windows\System\QHBlPzz.exe
  C:\Windows\System\QHBlPzz.exe
  2⤵
  PID:11616
- C:\Windows\System\hIquNcQ.exe
  C:\Windows\System\hIquNcQ.exe
  2⤵
  PID:11700
- C:\Windows\System\vRFeUPZ.exe
  C:\Windows\System\vRFeUPZ.exe
  2⤵
  PID:11808
- C:\Windows\System\AqmgCPK.exe
  C:\Windows\System\AqmgCPK.exe
  2⤵
  PID:11856
- C:\Windows\System\KfmsKuC.exe
  C:\Windows\System\KfmsKuC.exe
  2⤵
  PID:12072
- C:\Windows\System\JiFvKyD.exe
  C:\Windows\System\JiFvKyD.exe
  2⤵
  PID:10092
- C:\Windows\System\qNEnzZr.exe
  C:\Windows\System\qNEnzZr.exe
  2⤵
  PID:11988
- C:\Windows\System\LCwrUtl.exe
  C:\Windows\System\LCwrUtl.exe
  2⤵
  PID:10440
- C:\Windows\System\tVgMojA.exe
  C:\Windows\System\tVgMojA.exe
  2⤵
  PID:12216
- C:\Windows\System\SjvljRG.exe
  C:\Windows\System\SjvljRG.exe
  2⤵
  PID:12268
- C:\Windows\System\zXlvtCa.exe
  C:\Windows\System\zXlvtCa.exe
  2⤵
  PID:11140
- C:\Windows\System\DBbUaNi.exe
  C:\Windows\System\DBbUaNi.exe
  2⤵
  PID:11696
- C:\Windows\System\ybzroKk.exe
  C:\Windows\System\ybzroKk.exe
  2⤵
  PID:12176
- C:\Windows\System\JpYhEII.exe
  C:\Windows\System\JpYhEII.exe
  2⤵
  PID:12352
- C:\Windows\System\nhdwPof.exe
  C:\Windows\System\nhdwPof.exe
  2⤵
  PID:12368
- C:\Windows\System\nblRcny.exe
  C:\Windows\System\nblRcny.exe
  2⤵
  PID:12384
- C:\Windows\System\gNNtsCb.exe
  C:\Windows\System\gNNtsCb.exe
  2⤵
  PID:12412
- C:\Windows\System\OKZQEoE.exe
  C:\Windows\System\OKZQEoE.exe
  2⤵
  PID:12436
- C:\Windows\System\XwEBXKT.exe
  C:\Windows\System\XwEBXKT.exe
  2⤵
  PID:12464
- C:\Windows\System\BNDGShN.exe
  C:\Windows\System\BNDGShN.exe
  2⤵
  PID:12488
- C:\Windows\System\DHMioUL.exe
  C:\Windows\System\DHMioUL.exe
  2⤵
  PID:12508
- C:\Windows\System\zclpkIq.exe
  C:\Windows\System\zclpkIq.exe
  2⤵
  PID:12540
- C:\Windows\System\idMhflh.exe
  C:\Windows\System\idMhflh.exe
  2⤵
  PID:12572
- C:\Windows\System\RwXKApY.exe
  C:\Windows\System\RwXKApY.exe
  2⤵
  PID:12596
- C:\Windows\System\aTPnAYM.exe
  C:\Windows\System\aTPnAYM.exe
  2⤵
  PID:12620
- C:\Windows\System\WgHQrwB.exe
  C:\Windows\System\WgHQrwB.exe
  2⤵
  PID:12652
- C:\Windows\System\HPjQQFQ.exe
  C:\Windows\System\HPjQQFQ.exe
  2⤵
  PID:12688
- C:\Windows\System\cADlpMn.exe
  C:\Windows\System\cADlpMn.exe
  2⤵
  PID:12712
- C:\Windows\System\aFaurwr.exe
  C:\Windows\System\aFaurwr.exe
  2⤵
  PID:12748
- C:\Windows\System\EEYQcKJ.exe
  C:\Windows\System\EEYQcKJ.exe
  2⤵
  PID:12772
- C:\Windows\System\yQAHxGS.exe
  C:\Windows\System\yQAHxGS.exe
  2⤵
  PID:12800
- C:\Windows\System\nalypib.exe
  C:\Windows\System\nalypib.exe
  2⤵
  PID:12824
- C:\Windows\System\AWwPkzv.exe
  C:\Windows\System\AWwPkzv.exe
  2⤵
  PID:12856
- C:\Windows\System\ZXVavll.exe
  C:\Windows\System\ZXVavll.exe
  2⤵
  PID:12884
- C:\Windows\System\VOWkXIJ.exe
  C:\Windows\System\VOWkXIJ.exe
  2⤵
  PID:12908
- C:\Windows\System\GEVcXTX.exe
  C:\Windows\System\GEVcXTX.exe
  2⤵
  PID:12940
- C:\Windows\System\mUNbNMb.exe
  C:\Windows\System\mUNbNMb.exe
  2⤵
  PID:12960
- C:\Windows\System\TrRvZbE.exe
  C:\Windows\System\TrRvZbE.exe
  2⤵
  PID:12988
- C:\Windows\System\rKIhWbE.exe
  C:\Windows\System\rKIhWbE.exe
  2⤵
  PID:13008
- C:\Windows\System\EcFAERz.exe
  C:\Windows\System\EcFAERz.exe
  2⤵
  PID:13040
- C:\Windows\System\wqNerrN.exe
  C:\Windows\System\wqNerrN.exe
  2⤵
  PID:13068
- C:\Windows\System\BDsANcH.exe
  C:\Windows\System\BDsANcH.exe
  2⤵
  PID:13092
- C:\Windows\System\NqwQaWq.exe
  C:\Windows\System\NqwQaWq.exe
  2⤵
  PID:13124
- C:\Windows\System\ziwfbfI.exe
  C:\Windows\System\ziwfbfI.exe
  2⤵
  PID:13144
- C:\Windows\System\OZvSkxQ.exe
  C:\Windows\System\OZvSkxQ.exe
  2⤵
  PID:13180
- C:\Windows\System\SbPqpdn.exe
  C:\Windows\System\SbPqpdn.exe
  2⤵
  PID:13200
- C:\Windows\System\BcQYbWw.exe
  C:\Windows\System\BcQYbWw.exe
  2⤵
  PID:13220
- C:\Windows\System\VLMkpSI.exe
  C:\Windows\System\VLMkpSI.exe
  2⤵
  PID:13236
- C:\Windows\System\LlvAvvF.exe
  C:\Windows\System\LlvAvvF.exe
  2⤵
  PID:13260
- C:\Windows\System\UPfIqoo.exe
  C:\Windows\System\UPfIqoo.exe
  2⤵
  PID:13284
- C:\Windows\System\pQyBQcd.exe
  C:\Windows\System\pQyBQcd.exe
  2⤵
  PID:11916
- C:\Windows\System\xqHFGRS.exe
  C:\Windows\System\xqHFGRS.exe
  2⤵
  PID:11968
- C:\Windows\System\NrZSTKm.exe
  C:\Windows\System\NrZSTKm.exe
  2⤵
  PID:12364
- C:\Windows\System\fIqQyRE.exe
  C:\Windows\System\fIqQyRE.exe
  2⤵
  PID:12428
- C:\Windows\System\BqwHSti.exe
  C:\Windows\System\BqwHSti.exe
  2⤵
  PID:12452
- C:\Windows\System\InyNXjN.exe
  C:\Windows\System\InyNXjN.exe
  2⤵
  PID:12484
- C:\Windows\System\OcHUWkY.exe
  C:\Windows\System\OcHUWkY.exe
  2⤵
  PID:12560
- C:\Windows\System\zYjJyEC.exe
  C:\Windows\System\zYjJyEC.exe
  2⤵
  PID:12644
- C:\Windows\System\gvHsePK.exe
  C:\Windows\System\gvHsePK.exe
  2⤵
  PID:12632
- C:\Windows\System\JiFIhom.exe
  C:\Windows\System\JiFIhom.exe
  2⤵
  PID:12732
- C:\Windows\System\evjDNUM.exe
  C:\Windows\System\evjDNUM.exe
  2⤵
  PID:12788
- C:\Windows\System\ShCpEbD.exe
  C:\Windows\System\ShCpEbD.exe
  2⤵
  PID:12812
- C:\Windows\System\fyJUBtI.exe
  C:\Windows\System\fyJUBtI.exe
  2⤵
  PID:12848
- C:\Windows\System\TaXnXDd.exe
  C:\Windows\System\TaXnXDd.exe
  2⤵
  PID:12932
- C:\Windows\System\AXlcOmJ.exe
  C:\Windows\System\AXlcOmJ.exe
  2⤵
  PID:12952
- C:\Windows\System\imKHfVd.exe
  C:\Windows\System\imKHfVd.exe
  2⤵
  PID:13116
- C:\Windows\System\NdsVJer.exe
  C:\Windows\System\NdsVJer.exe
  2⤵
  PID:13140
- C:\Windows\System\bGJkGGk.exe
  C:\Windows\System\bGJkGGk.exe
  2⤵
  PID:13084
- C:\Windows\System\fQJpQHC.exe
  C:\Windows\System\fQJpQHC.exe
  2⤵
  PID:13168
- C:\Windows\System\mPAmQNP.exe
  C:\Windows\System\mPAmQNP.exe
  2⤵
  PID:13248
- C:\Windows\System\eqXCYnl.exe
  C:\Windows\System\eqXCYnl.exe
  2⤵
  PID:12400
- C:\Windows\System\LulpxAZ.exe
  C:\Windows\System\LulpxAZ.exe
  2⤵
  PID:13228
- C:\Windows\System\pLBuhJu.exe
  C:\Windows\System\pLBuhJu.exe
  2⤵
  PID:12504
- C:\Windows\System\NoIohfU.exe
  C:\Windows\System\NoIohfU.exe
  2⤵
  PID:12704
- C:\Windows\System\ZybOFlL.exe
  C:\Windows\System\ZybOFlL.exe
  2⤵
  PID:12844
- C:\Windows\System\sjxpyXv.exe
  C:\Windows\System\sjxpyXv.exe
  2⤵
  PID:12780
- C:\Windows\System\HrGLNnb.exe
  C:\Windows\System\HrGLNnb.exe
  2⤵
  PID:13132
- C:\Windows\System\KwlMlrC.exe
  C:\Windows\System\KwlMlrC.exe
  2⤵
  PID:13164
- C:\Windows\System\Dptnvhm.exe
  C:\Windows\System\Dptnvhm.exe
  2⤵
  PID:13256
- C:\Windows\System\vmpmfax.exe
  C:\Windows\System\vmpmfax.exe
  2⤵
  PID:12476
- C:\Windows\System\atpnuyY.exe
  C:\Windows\System\atpnuyY.exe
  2⤵
  PID:13332
- C:\Windows\System\NudrwhN.exe
  C:\Windows\System\NudrwhN.exe
  2⤵
  PID:13356
- C:\Windows\System\LFmSmJG.exe
  C:\Windows\System\LFmSmJG.exe
  2⤵
  PID:13380
- C:\Windows\System\KVxikuW.exe
  C:\Windows\System\KVxikuW.exe
  2⤵
  PID:13400
- C:\Windows\System\ZJWAMYm.exe
  C:\Windows\System\ZJWAMYm.exe
  2⤵
  PID:13424
- C:\Windows\System\aYzfjhO.exe
  C:\Windows\System\aYzfjhO.exe
  2⤵
  PID:13452
- C:\Windows\System\nwtaarl.exe
  C:\Windows\System\nwtaarl.exe
  2⤵
  PID:13476
- C:\Windows\System\FgRMhCO.exe
  C:\Windows\System\FgRMhCO.exe
  2⤵
  PID:13516
- C:\Windows\System\NtPpQkK.exe
  C:\Windows\System\NtPpQkK.exe
  2⤵
  PID:13544
- C:\Windows\System\hAoSlbA.exe
  C:\Windows\System\hAoSlbA.exe
  2⤵
  PID:13576
- C:\Windows\System\miAMZjd.exe
  C:\Windows\System\miAMZjd.exe
  2⤵
  PID:13604
- C:\Windows\System\eFXAaUv.exe
  C:\Windows\System\eFXAaUv.exe
  2⤵
  PID:13624
- C:\Windows\System\dPsAaNe.exe
  C:\Windows\System\dPsAaNe.exe
  2⤵
  PID:13660
- C:\Windows\System\AzMAkHb.exe
  C:\Windows\System\AzMAkHb.exe
  2⤵
  PID:13684
- C:\Windows\System\epZgYfC.exe
  C:\Windows\System\epZgYfC.exe
  2⤵
  PID:13708
- C:\Windows\System\OMJWDrj.exe
  C:\Windows\System\OMJWDrj.exe
  2⤵
  PID:13732
- C:\Windows\System\BCISpjl.exe
  C:\Windows\System\BCISpjl.exe
  2⤵
  PID:13752
- C:\Windows\System\pDKVpMg.exe
  C:\Windows\System\pDKVpMg.exe
  2⤵
  PID:13776
- C:\Windows\System\ormJmdS.exe
  C:\Windows\System\ormJmdS.exe
  2⤵
  PID:13800
- C:\Windows\System\vhRJVsO.exe
  C:\Windows\System\vhRJVsO.exe
  2⤵
  PID:13824
- C:\Windows\System\AsXgwJn.exe
  C:\Windows\System\AsXgwJn.exe
  2⤵
  PID:13848
- C:\Windows\System\SQsasvF.exe
  C:\Windows\System\SQsasvF.exe
  2⤵
  PID:13864
- C:\Windows\System\mhpDLYl.exe
  C:\Windows\System\mhpDLYl.exe
  2⤵
  PID:13896
- C:\Windows\System\jhXjDed.exe
  C:\Windows\System\jhXjDed.exe
  2⤵
  PID:13916
- C:\Windows\System\DKkmwka.exe
  C:\Windows\System\DKkmwka.exe
  2⤵
  PID:13944
- C:\Windows\System\Mfovcdt.exe
  C:\Windows\System\Mfovcdt.exe
  2⤵
  PID:13964
- C:\Windows\System\bQlKedU.exe
  C:\Windows\System\bQlKedU.exe
  2⤵
  PID:13984
- C:\Windows\System\oTRSPVw.exe
  C:\Windows\System\oTRSPVw.exe
  2⤵
  PID:14000
- C:\Windows\System\murJwlN.exe
  C:\Windows\System\murJwlN.exe
  2⤵
  PID:14016
- C:\Windows\System\XANIuyT.exe
  C:\Windows\System\XANIuyT.exe
  2⤵
  PID:14044
- C:\Windows\System\PnkwRoI.exe
  C:\Windows\System\PnkwRoI.exe
  2⤵
  PID:14068
- C:\Windows\System\GNOcZlD.exe
  C:\Windows\System\GNOcZlD.exe
  2⤵
  PID:14100
- C:\Windows\System\KlyyPIj.exe
  C:\Windows\System\KlyyPIj.exe
  2⤵
  PID:14116
- C:\Windows\System\KUMBqwr.exe
  C:\Windows\System\KUMBqwr.exe
  2⤵
  PID:14140
- C:\Windows\System\LXlUWVN.exe
  C:\Windows\System\LXlUWVN.exe
  2⤵
  PID:14160
- C:\Windows\System\IBBNDYs.exe
  C:\Windows\System\IBBNDYs.exe
  2⤵
  PID:14188
- C:\Windows\System\AsWzhKZ.exe
  C:\Windows\System\AsWzhKZ.exe
  2⤵
  PID:14220
- C:\Windows\System\DYYqoTg.exe
  C:\Windows\System\DYYqoTg.exe
  2⤵
  PID:14244
- C:\Windows\System\MfeLRyB.exe
  C:\Windows\System\MfeLRyB.exe
  2⤵
  PID:14268
- C:\Windows\System\GXhNzep.exe
  C:\Windows\System\GXhNzep.exe
  2⤵
  PID:14288
- C:\Windows\System\zQdgzYa.exe
  C:\Windows\System\zQdgzYa.exe
  2⤵
  PID:14316
- C:\Windows\System\yPvzlvM.exe
  C:\Windows\System\yPvzlvM.exe
  2⤵
  PID:13188
- C:\Windows\System\EBuDNpq.exe
  C:\Windows\System\EBuDNpq.exe
  2⤵
  PID:13296
- C:\Windows\System\btXRHPp.exe
  C:\Windows\System\btXRHPp.exe
  2⤵
  PID:13396
- C:\Windows\System\sJGngXJ.exe
  C:\Windows\System\sJGngXJ.exe
  2⤵
  PID:12916
- C:\Windows\System\BWEbQbc.exe
  C:\Windows\System\BWEbQbc.exe
  2⤵
  PID:13508
- C:\Windows\System\kXqlbvB.exe
  C:\Windows\System\kXqlbvB.exe
  2⤵
  PID:13352
- C:\Windows\System\zzyqDHV.exe
  C:\Windows\System\zzyqDHV.exe
  2⤵
  PID:13592
- C:\Windows\System\LomrKLQ.exe
  C:\Windows\System\LomrKLQ.exe
  2⤵
  PID:13696
- C:\Windows\System\cHZzETZ.exe
  C:\Windows\System\cHZzETZ.exe
  2⤵
  PID:13340
- C:\Windows\System\nTEEkgB.exe
  C:\Windows\System\nTEEkgB.exe
  2⤵
  PID:13416
- C:\Windows\System\lDNavMg.exe
  C:\Windows\System\lDNavMg.exe
  2⤵
  PID:13704
- C:\Windows\System\pbTeRkx.exe
  C:\Windows\System\pbTeRkx.exe
  2⤵
  PID:13976
- C:\Windows\System\KguhqCt.exe
  C:\Windows\System\KguhqCt.exe
  2⤵
  PID:13564
- C:\Windows\System\orZTBnA.exe
  C:\Windows\System\orZTBnA.exe
  2⤵
  PID:13640
- C:\Windows\System\rtfavUt.exe
  C:\Windows\System\rtfavUt.exe
  2⤵
  PID:14148
- C:\Windows\System\HBKdWIi.exe
  C:\Windows\System\HBKdWIi.exe
  2⤵
  PID:14184
- C:\Windows\System\RMLHqAh.exe
  C:\Windows\System\RMLHqAh.exe
  2⤵
  PID:14260
- C:\Windows\System\gLPfmMA.exe
  C:\Windows\System\gLPfmMA.exe
  2⤵
  PID:14008
- C:\Windows\System\NOLyPEN.exe
  C:\Windows\System\NOLyPEN.exe
  2⤵
  PID:14088
- C:\Windows\System\VVyLRti.exe
  C:\Windows\System\VVyLRti.exe
  2⤵
  PID:12664
- C:\Windows\System\mXYwqXl.exe
  C:\Windows\System\mXYwqXl.exe
  2⤵
  PID:14340
- C:\Windows\System\aQpYrQz.exe
  C:\Windows\System\aQpYrQz.exe
  2⤵
  PID:14356
- C:\Windows\System\gjOGIOg.exe
  C:\Windows\System\gjOGIOg.exe
  2⤵
  PID:14392
- C:\Windows\System\qFwmcZn.exe
  C:\Windows\System\qFwmcZn.exe
  2⤵
  PID:14416
- C:\Windows\System\yVXNIXx.exe
  C:\Windows\System\yVXNIXx.exe
  2⤵
  PID:14440
- C:\Windows\System\Lxyuggg.exe
  C:\Windows\System\Lxyuggg.exe
  2⤵
  PID:14468
- C:\Windows\System\mcEDHWR.exe
  C:\Windows\System\mcEDHWR.exe
  2⤵
  PID:14488
- C:\Windows\System\sxKFDgk.exe
  C:\Windows\System\sxKFDgk.exe
  2⤵
  PID:14512
- C:\Windows\System\jkoCsjD.exe
  C:\Windows\System\jkoCsjD.exe
  2⤵
  PID:14536
- C:\Windows\System\uHVtwki.exe
  C:\Windows\System\uHVtwki.exe
  2⤵
  PID:14568
- C:\Windows\System\GetcwnY.exe
  C:\Windows\System\GetcwnY.exe
  2⤵
  PID:14588
- C:\Windows\System\hnAJxaa.exe
  C:\Windows\System\hnAJxaa.exe
  2⤵
  PID:14616
- C:\Windows\System\QKDkZxG.exe
  C:\Windows\System\QKDkZxG.exe
  2⤵
  PID:14644
- C:\Windows\System\GoGKlZB.exe
  C:\Windows\System\GoGKlZB.exe
  2⤵
  PID:14664
- C:\Windows\System\TVbAMpU.exe
  C:\Windows\System\TVbAMpU.exe
  2⤵
  PID:14688
- C:\Windows\System\WnwFVnA.exe
  C:\Windows\System\WnwFVnA.exe
  2⤵
  PID:14712
- C:\Windows\System\iGcAsan.exe
  C:\Windows\System\iGcAsan.exe
  2⤵
  PID:14736
- C:\Windows\System\dlqOZCR.exe
  C:\Windows\System\dlqOZCR.exe
  2⤵
  PID:14764
- C:\Windows\System\ewyNYTj.exe
  C:\Windows\System\ewyNYTj.exe
  2⤵
  PID:14792
- C:\Windows\System\VXZbLNJ.exe
  C:\Windows\System\VXZbLNJ.exe
  2⤵
  PID:14820
- C:\Windows\System\lFuLcIC.exe
  C:\Windows\System\lFuLcIC.exe
  2⤵
  PID:14836
- C:\Windows\System\ZmPpRdW.exe
  C:\Windows\System\ZmPpRdW.exe
  2⤵
  PID:14852
- C:\Windows\System\HVYjEbG.exe
  C:\Windows\System\HVYjEbG.exe
  2⤵
  PID:14880
- C:\Windows\System\KyvYDKC.exe
  C:\Windows\System\KyvYDKC.exe
  2⤵
  PID:14904
- C:\Windows\System\ehSLJxE.exe
  C:\Windows\System\ehSLJxE.exe
  2⤵
  PID:14924
- C:\Windows\System\IEhWFPT.exe
  C:\Windows\System\IEhWFPT.exe
  2⤵
  PID:14948
- C:\Windows\System\dFuVBAv.exe
  C:\Windows\System\dFuVBAv.exe
  2⤵
  PID:14980
- C:\Windows\System\BumryWx.exe
  C:\Windows\System\BumryWx.exe
  2⤵
  PID:15004
- C:\Windows\System\ZmWNSXG.exe
  C:\Windows\System\ZmWNSXG.exe
  2⤵
  PID:15028
- C:\Windows\System\GYcfFoh.exe
  C:\Windows\System\GYcfFoh.exe
  2⤵
  PID:15048
- C:\Windows\System\fLoisNC.exe
  C:\Windows\System\fLoisNC.exe
  2⤵
  PID:15084
- C:\Windows\System\uhsCPAx.exe
  C:\Windows\System\uhsCPAx.exe
  2⤵
  PID:15112
- C:\Windows\System\LJDPrSq.exe
  C:\Windows\System\LJDPrSq.exe
  2⤵
  PID:15128
- C:\Windows\System\PvAqjNZ.exe
  C:\Windows\System\PvAqjNZ.exe
  2⤵
  PID:15156
- C:\Windows\System\LtyowpK.exe
  C:\Windows\System\LtyowpK.exe
  2⤵
  PID:15184
- C:\Windows\System\YddCbsH.exe
  C:\Windows\System\YddCbsH.exe
  2⤵
  PID:15212
- C:\Windows\System\psHktfR.exe
  C:\Windows\System\psHktfR.exe
  2⤵
  PID:15240
- C:\Windows\System\NbKdQOF.exe
  C:\Windows\System\NbKdQOF.exe
  2⤵
  PID:15260
- C:\Windows\System\VdPDkwg.exe
  C:\Windows\System\VdPDkwg.exe
  2⤵
  PID:15284
- C:\Windows\System\bjBUlCP.exe
  C:\Windows\System\bjBUlCP.exe
  2⤵
  PID:15312
- C:\Windows\System\VgpWevS.exe
  C:\Windows\System\VgpWevS.exe
  2⤵
  PID:15336
- C:\Windows\System\DExQMld.exe
  C:\Windows\System\DExQMld.exe
  2⤵
  PID:14212
- C:\Windows\System\FSdLRSc.exe
  C:\Windows\System\FSdLRSc.exe
  2⤵
  PID:13572
- C:\Windows\System\PQbWERJ.exe
  C:\Windows\System\PQbWERJ.exe
  2⤵
  PID:12724
- C:\Windows\System\SARcaxa.exe
  C:\Windows\System\SARcaxa.exe
  2⤵
  PID:13448
- C:\Windows\System\UWfxhvO.exe
  C:\Windows\System\UWfxhvO.exe
  2⤵
  PID:14060
- C:\Windows\System\PPUcZDp.exe
  C:\Windows\System\PPUcZDp.exe
  2⤵
  PID:14180
- C:\Windows\System\DSWmxPl.exe
  C:\Windows\System\DSWmxPl.exe
  2⤵
  PID:14240
- C:\Windows\System\fDlGApO.exe
  C:\Windows\System\fDlGApO.exe
  2⤵
  PID:14896
- C:\Windows\System\gXykafY.exe
  C:\Windows\System\gXykafY.exe
  2⤵
  PID:14920
- C:\Windows\System\HCaxpsF.exe
  C:\Windows\System\HCaxpsF.exe
  2⤵
  PID:14564
- C:\Windows\System\sVdIeLJ.exe
  C:\Windows\System\sVdIeLJ.exe
  2⤵
  PID:14612
- C:\Windows\System\LXJLHxl.exe
  C:\Windows\System\LXJLHxl.exe
  2⤵
  PID:14760
- C:\Windows\System\KnrluXD.exe
  C:\Windows\System\KnrluXD.exe
  2⤵
  PID:14832
- C:\Windows\System\GkblwUx.exe
  C:\Windows\System\GkblwUx.exe
  2⤵
  PID:15280
- C:\Windows\System\zMSVZZJ.exe
  C:\Windows\System\zMSVZZJ.exe
  2⤵
  PID:14940
- C:\Windows\System\IRAmBpw.exe
  C:\Windows\System\IRAmBpw.exe
  2⤵
  PID:14968
- C:\Windows\System\BYAkcUZ.exe
  C:\Windows\System\BYAkcUZ.exe
  2⤵
  PID:14680
- C:\Windows\System\opzaxfY.exe
  C:\Windows\System\opzaxfY.exe
  2⤵
  PID:15232
- C:\Windows\System\QfaxkeA.exe
  C:\Windows\System\QfaxkeA.exe
  2⤵
  PID:13764
- C:\Windows\System\WiYJRhi.exe
  C:\Windows\System\WiYJRhi.exe
  2⤵
  PID:15348
- C:\Windows\System\vakwTwJ.exe
  C:\Windows\System\vakwTwJ.exe
  2⤵
  PID:14012
- C:\Windows\System\EUZRQvy.exe
  C:\Windows\System\EUZRQvy.exe
  2⤵
  PID:14040
- C:\Windows\System\IhcZnGQ.exe
  C:\Windows\System\IhcZnGQ.exe
  2⤵
  PID:15020
- C:\Windows\System\VDUFPqe.exe
  C:\Windows\System\VDUFPqe.exe
  2⤵
  PID:14368
- C:\Windows\System\sMhaZuV.exe
  C:\Windows\System\sMhaZuV.exe
  2⤵
  PID:15124
- C:\Windows\System\JvRRsiX.exe
  C:\Windows\System\JvRRsiX.exe
  2⤵
  PID:14308
- C:\Windows\System\VMfSqRn.exe
  C:\Windows\System\VMfSqRn.exe
  2⤵
  PID:15252
- C:\Windows\System\PFryelm.exe
  C:\Windows\System\PFryelm.exe
  2⤵
  PID:14384
- C:\Windows\System\EmYlJTF.exe
  C:\Windows\System\EmYlJTF.exe
  2⤵
  PID:15380
- C:\Windows\System\wwVJarm.exe
  C:\Windows\System\wwVJarm.exe
  2⤵
  PID:15416
- C:\Windows\System\cSHFlMa.exe
  C:\Windows\System\cSHFlMa.exe
  2⤵
  PID:15436
- C:\Windows\System\fItaQkK.exe
  C:\Windows\System\fItaQkK.exe
  2⤵
  PID:15464
- C:\Windows\System\LiSkYqm.exe
  C:\Windows\System\LiSkYqm.exe
  2⤵
  PID:15500
- C:\Windows\System\PSGcapF.exe
  C:\Windows\System\PSGcapF.exe
  2⤵
  PID:15644
- C:\Windows\System\dpslffw.exe
  C:\Windows\System\dpslffw.exe
  2⤵
  PID:15660
- C:\Windows\System\wekhoYk.exe
  C:\Windows\System\wekhoYk.exe
  2⤵
  PID:15676
- C:\Windows\System\SEpHrEF.exe
  C:\Windows\System\SEpHrEF.exe
  2⤵
  PID:15700
- C:\Windows\System\rCPNXNP.exe
  C:\Windows\System\rCPNXNP.exe
  2⤵
  PID:15724
- C:\Windows\System\nAhSGQT.exe
  C:\Windows\System\nAhSGQT.exe
  2⤵
  PID:15744
- C:\Windows\System\YCfSlsE.exe
  C:\Windows\System\YCfSlsE.exe
  2⤵
  PID:15764
- C:\Windows\System\mOiZGCA.exe
  C:\Windows\System\mOiZGCA.exe
  2⤵
  PID:15780
- C:\Windows\System\KGVzMQz.exe
  C:\Windows\System\KGVzMQz.exe
  2⤵
  PID:15812
- C:\Windows\System\cYMEudj.exe
  C:\Windows\System\cYMEudj.exe
  2⤵
  PID:15832
- C:\Windows\System\GRuArYA.exe
  C:\Windows\System\GRuArYA.exe
  2⤵
  PID:15860
- C:\Windows\System\uDfgOap.exe
  C:\Windows\System\uDfgOap.exe
  2⤵
  PID:15912
- C:\Windows\System\ZKXzTIE.exe
  C:\Windows\System\ZKXzTIE.exe
  2⤵
  PID:15944
- C:\Windows\System\VGdLsjh.exe
  C:\Windows\System\VGdLsjh.exe
  2⤵
  PID:15964
- C:\Windows\System\WacsamI.exe
  C:\Windows\System\WacsamI.exe
  2⤵
  PID:15992
- C:\Windows\System\YsJCwoX.exe
  C:\Windows\System\YsJCwoX.exe
  2⤵
  PID:16012
- C:\Windows\System\USOnqNE.exe
  C:\Windows\System\USOnqNE.exe
  2⤵
  PID:16032
- C:\Windows\System\tHkuZTV.exe
  C:\Windows\System\tHkuZTV.exe
  2⤵
  PID:16056
- C:\Windows\System\lbtHvQe.exe
  C:\Windows\System\lbtHvQe.exe
  2⤵
  PID:16076
- C:\Windows\System\uagjDva.exe
  C:\Windows\System\uagjDva.exe
  2⤵
  PID:16108
- C:\Windows\System\mQcnCXd.exe
  C:\Windows\System\mQcnCXd.exe
  2⤵
  PID:16144
- C:\Windows\System\vOXKNrm.exe
  C:\Windows\System\vOXKNrm.exe
  2⤵
  PID:16180
- C:\Windows\System\BTYnlkt.exe
  C:\Windows\System\BTYnlkt.exe
  2⤵
  PID:16200
- C:\Windows\System\KbnYrbA.exe
  C:\Windows\System\KbnYrbA.exe
  2⤵
  PID:16232
- C:\Windows\System\UkcSJIh.exe
  C:\Windows\System\UkcSJIh.exe
  2⤵
  PID:16256
- C:\Windows\System\AEYaUSo.exe
  C:\Windows\System\AEYaUSo.exe
  2⤵
  PID:16284
- C:\Windows\System\AOnLWTT.exe
  C:\Windows\System\AOnLWTT.exe
  2⤵
  PID:14744
- C:\Windows\System\pqUyUjU.exe
  C:\Windows\System\pqUyUjU.exe
  2⤵
  PID:14872
- C:\Windows\System\BBZVFja.exe
  C:\Windows\System\BBZVFja.exe
  2⤵
  PID:15412
- C:\Windows\System\DnxQXyt.exe
  C:\Windows\System\DnxQXyt.exe
  2⤵
  PID:14304
- C:\Windows\System\GVaPKVO.exe
  C:\Windows\System\GVaPKVO.exe
  2⤵
  PID:13388
- C:\Windows\System\MqzqQLn.exe
  C:\Windows\System\MqzqQLn.exe
  2⤵
  PID:14500
- C:\Windows\System\gkbobNs.exe
  C:\Windows\System\gkbobNs.exe
  2⤵
  PID:15368
- C:\Windows\System\WYFhOcx.exe
  C:\Windows\System\WYFhOcx.exe
  2⤵
  PID:15392
- C:\Windows\System\yQJtXkE.exe
  C:\Windows\System\yQJtXkE.exe
  2⤵
  PID:15616
- C:\Windows\System\gtliteN.exe
  C:\Windows\System\gtliteN.exe
  2⤵
  PID:15740
- C:\Windows\System\aimfAmK.exe
  C:\Windows\System\aimfAmK.exe
  2⤵
  PID:15772
- C:\Windows\System\KVkEmmR.exe
  C:\Windows\System\KVkEmmR.exe
  2⤵
  PID:13856
- C:\Windows\System\wlSnFmP.exe
  C:\Windows\System\wlSnFmP.exe
  2⤵
  PID:15484
- C:\Windows\System\DIGnGRt.exe
  C:\Windows\System\DIGnGRt.exe
  2⤵
  PID:15656
- C:\Windows\System\MjgGakU.exe
  C:\Windows\System\MjgGakU.exe
  2⤵
  PID:15720
- C:\Windows\System\oeJmnAg.exe
  C:\Windows\System\oeJmnAg.exe
  2⤵
  PID:15900
- C:\Windows\System\WgCZVfZ.exe
  C:\Windows\System\WgCZVfZ.exe
  2⤵
  PID:16164
- C:\Windows\System\lJruGac.exe
  C:\Windows\System\lJruGac.exe
  2⤵
  PID:16268
- C:\Windows\System\uBuZaqM.exe
  C:\Windows\System\uBuZaqM.exe
  2⤵
  PID:15828
- C:\Windows\System\qoGEoXf.exe
  C:\Windows\System\qoGEoXf.exe
  2⤵
  PID:15956
- C:\Windows\System\ZKGkYby.exe
  C:\Windows\System\ZKGkYby.exe
  2⤵
  PID:16244
- C:\Windows\System\BaWbSYP.exe
  C:\Windows\System\BaWbSYP.exe
  2⤵
  PID:16064
- C:\Windows\System\escttGf.exe
  C:\Windows\System\escttGf.exe
  2⤵
  PID:16188
- C:\Windows\System\fpmKvan.exe
  C:\Windows\System\fpmKvan.exe
  2⤵
  PID:15880
- C:\Windows\System\TNiLbnP.exe
  C:\Windows\System\TNiLbnP.exe
  2⤵
  PID:16308
- C:\Windows\System\TDrEerW.exe
  C:\Windows\System\TDrEerW.exe
  2⤵
  PID:15952
- C:\Windows\System\hfWNCFE.exe
  C:\Windows\System\hfWNCFE.exe
  2⤵
  PID:16120
- C:\Windows\System\fffbIgC.exe
  C:\Windows\System\fffbIgC.exe
  2⤵
  PID:16396
- C:\Windows\System\uqDoZHE.exe
  C:\Windows\System\uqDoZHE.exe
  2⤵
  PID:16432
- C:\Windows\System\oYAhaZF.exe
  C:\Windows\System\oYAhaZF.exe
  2⤵
  PID:16472
- C:\Windows\System\PZFHqpR.exe
  C:\Windows\System\PZFHqpR.exe
  2⤵
  PID:16500
- C:\Windows\System\OkxbdcV.exe
  C:\Windows\System\OkxbdcV.exe
  2⤵
  PID:16520
- C:\Windows\System\sAAXSzR.exe
  C:\Windows\System\sAAXSzR.exe
  2⤵
  PID:16552
- C:\Windows\System\OqjQsOO.exe
  C:\Windows\System\OqjQsOO.exe
  2⤵
  PID:16580
- C:\Windows\System\OcTQyDw.exe
  C:\Windows\System\OcTQyDw.exe
  2⤵
  PID:16612
- C:\Windows\System\oiSdpkI.exe
  C:\Windows\System\oiSdpkI.exe
  2⤵
  PID:16632
- C:\Windows\System\FZKUKXD.exe
  C:\Windows\System\FZKUKXD.exe
  2⤵
  PID:16656
- C:\Windows\System\QSRVcHW.exe
  C:\Windows\System\QSRVcHW.exe
  2⤵
  PID:16696
- C:\Windows\System\ZYJvjSC.exe
  C:\Windows\System\ZYJvjSC.exe
  2⤵
  PID:16716
- C:\Windows\System\rMwahlI.exe
  C:\Windows\System\rMwahlI.exe
  2⤵
  PID:16736
- C:\Windows\System\QtXRWed.exe
  C:\Windows\System\QtXRWed.exe
  2⤵
  PID:16760
- C:\Windows\System\bBTwPOw.exe
  C:\Windows\System\bBTwPOw.exe
  2⤵
  PID:16788
- C:\Windows\System\JXOnmLP.exe
  C:\Windows\System\JXOnmLP.exe
  2⤵
  PID:16804
- C:\Windows\System\IogRRep.exe
  C:\Windows\System\IogRRep.exe
  2⤵
  PID:16836
- C:\Windows\System\shihOLP.exe
  C:\Windows\System\shihOLP.exe
  2⤵
  PID:16856
- C:\Windows\System\KzWxkyK.exe
  C:\Windows\System\KzWxkyK.exe
  2⤵
  PID:16880
- C:\Windows\System\DeqEGZC.exe
  C:\Windows\System\DeqEGZC.exe
  2⤵
  PID:16908
- C:\Windows\System\VVwKJnj.exe
  C:\Windows\System\VVwKJnj.exe
  2⤵
  PID:16928
- C:\Windows\System\NHCEKeQ.exe
  C:\Windows\System\NHCEKeQ.exe
  2⤵
  PID:17156
- C:\Windows\System\URsNZto.exe
  C:\Windows\System\URsNZto.exe
  2⤵
  PID:17200
- C:\Windows\System\RaTBqBK.exe
  C:\Windows\System\RaTBqBK.exe
  2⤵
  PID:17216
- C:\Windows\System\AjKVbbK.exe
  C:\Windows\System\AjKVbbK.exe
  2⤵
  PID:17240
- C:\Windows\System\MXYUODt.exe
  C:\Windows\System\MXYUODt.exe
  2⤵
  PID:17264
- C:\Windows\System\WXDcFXQ.exe
  C:\Windows\System\WXDcFXQ.exe
  2⤵
  PID:17288
- C:\Windows\System\fVWxDFY.exe
  C:\Windows\System\fVWxDFY.exe
  2⤵
  PID:17376

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:16988

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\CUWufUp.exe

Filesize
1.6MB

MD5
87e4248e888d67fd14d798bffec89c6f

SHA1
88093e7bfe02a46d07ea032bc374f127a7a9a1d2

SHA256
1f24317e7cb46013c1e723dadc7d485c418969d87810fd7fae7aa655c25df65f

SHA512
eec207ba5ccf4d0f7b6084fe80b39cbd2ac6b8167543b5851f0c3684f36aa547856d543e449e5d3616dc0dbc35bdf4ad8ffa13b82276cedcf5817f4070fa61ed

Download Submit
C:\Windows\System\ESlsfDu.exe

Filesize
1.6MB

MD5
be64233409facdb5b4bee723fde4997c

SHA1
cf3f4893f3e74de2e51eab27993341547226b0d0

SHA256
6fdbd263694bf776737b72a2663f48549d2b6f0b706c98a754d87e70594c60d5

SHA512
43848487c8aa92e690e792363dc19d7ff697606ecdac199748a0f0ae0d7157d7b9fa9821c201d3c378790014baa4953521d25820b504234873d24bfb4128cdc2

Download Submit
C:\Windows\System\EUwjiCy.exe

Filesize
1.6MB

MD5
7a109d5ac683afdbf795755d0dce0f34

SHA1
36968c8470ef82323acccaadd64f762ed1fd1edc

SHA256
1cf16156de179d30b32854dd15600dff4adae3bc9ce4e141ae8f56a61953df45

SHA512
412c49c52bb5c438d4bb73bb8aebc7b372bd3867255bc0053b7c357d12a4cd169ee7e82aaacdb5e691279708223ec4725be29cf380427d0014740767e0ed3771

Download Submit
C:\Windows\System\HImyooZ.exe

Filesize
1.6MB

MD5
c8d7fdf1ecb1cc86085009a23303ffee

SHA1
4fff98f36d7b43ddd90ff61c332a61b2aa330c79

SHA256
e58f287be41882419dba45ba427a66a600f7ba56c3c113d869cc013df1defe36

SHA512
7be83c78400d46ac0ebafe7302143d74ba464d0977770853164ff5a19e13698ad2796156ae567070655b0b20ed6e5b0662ff18de0243fc53656ffff9a871c0d5

Download Submit
C:\Windows\System\HpfuEQc.exe

Filesize
1.6MB

MD5
c7fc02471f33ec06edb504936c23106f

SHA1
9fe53a03a32b05715e243091d1dc681d5407046d

SHA256
6f85e43a3f631ee99fe40e7e05bbd91a79938bdb23ed81c4a326a571dfeee5ec

SHA512
113fe50b81e633357d333be1461ed5d3c8712d07c0f366979f70d542a7cb7aa1c4fa1c216a3508039cea1d94bf3112e27f3972d227d8b687ec00d989652422d3

Download Submit
C:\Windows\System\IguaaOj.exe

Filesize
1.6MB

MD5
216739dce9bbf79a7f91eca38c760c5b

SHA1
cda20d34a291a0ce556658f84028298a9e95ae09

SHA256
ad4e7297677917db39afd85c7ca27d5445dbb674fbf3231103c4b68e43467d0c

SHA512
2ae123561419ea5abeb4c9a63bb4a0530d19d79125612958848bf7272f27cd64c49093764a4df3ed45c70cb646ca3ead9bad149567d40c9953b4c758b4edd35f

Download Submit
C:\Windows\System\KYZCSRF.exe

Filesize
1.6MB

MD5
5afe71015c0e6360f22717b0f990936d

SHA1
4ff66bbdb958b55bc375ec9417a4f72b5390bec1

SHA256
be4d8ff22d9b157a826fdaa0792fd831b132eeef6cf61caa67f0a3a906374103

SHA512
a1411120b2e965125ccf6f1e559e0cd01345653d41e2f76da96dc6b24891267fc021c4b4e09aaa1ed0cda3151d5e98ae87ce7045875745c0d9170ccd5682ccd4

Download Submit
C:\Windows\System\LxwuDlB.exe

Filesize
1.6MB

MD5
dfb3b9c4ecad8778e77dc2e65e3b3d48

SHA1
9e21fe9522fb8ffb9fe92a14cd646f9d4f365765

SHA256
fe6e5c344829a8f2b1366daaf6be9dc4596a0f5e328eda28a0d08482125d0c26

SHA512
1fbd7817ce2691e295aec90fcd91f34f0ae99892912564fe0cec36ef76cff97fd34c16a3289f855653058d2b6ac324613b17571b86be7433d149187877031959

Download Submit
C:\Windows\System\MoutOJm.exe

Filesize
1.6MB

MD5
3fdfe49e2c6aa6f62862fc97eee558e6

SHA1
5aa3e2834a08d97e6bd57d14c891aad952386f47

SHA256
b0978d6ea3abaa05957372719b79676d56302816177b0d8a07996e25bf851677

SHA512
0321cefa0614fb02f12be14959ac49904242a01da8f0cecf85967a16df75dfd55113dc0b1599dcc092441b93ab94eb500e24a4f0be4a339b7e7448830d18af52

Download Submit
C:\Windows\System\OYQDFnA.exe

Filesize
1.6MB

MD5
7504384edac767271a529eb909c3b226

SHA1
11ac4484a2bc88cbe566704229f1e9a458b1ca79

SHA256
eb6696ce10e9e82690849f017b59df1dfbabeb0345c5f010a2dde8a45cfea7fc

SHA512
d1d23cd10ec2441879ee75d33bfec9df9a5ef3d130391c8f229076b32ace85d8e03785e953c7fe5362bfbaa2e9bb74cfde856b1568712de921c4d36dd5de215c

Download Submit
C:\Windows\System\QaSuQAR.exe

Filesize
1.6MB

MD5
58cc85bd92cdbe6dcb97bc413c98b901

SHA1
e570a23dddeda38ecc87646eeded58c342673db0

SHA256
e8a11a281b64bff81eaf269cabd8db4ad1b974af8b5255e7f4c3b5da643a8447

SHA512
5cc07f942ed6e7e21f6c406ce4c8002767b972f95fc0044588aed65762703ca720082a4271c21540057cb36a49d9cb36d2d6405a5401a2f93736a0a9f71ddf37

Download Submit
C:\Windows\System\SNwyIVY.exe

Filesize
1.6MB

MD5
883cf2e053ac0659bd2397ad578f5862

SHA1
fd1cb741416f15c0fca2258bbb880eb7744dbc84

SHA256
6d2cbf3da2340d7e7243b93efc59c6abef2bf9cc2ec426a446bdf6326c95022d

SHA512
c9ddb12075d1be58288b632ce7583a86cf7806e68d5fb1cc6b048adbf87df121d203093d8a75065dd34a59a9aacacf2a48b733ae9bfd3247d876c647156e07f1

Download Submit
C:\Windows\System\TnRpaaD.exe

Filesize
1.6MB

MD5
5a43a1dc886cd40783dfee0a97bf0685

SHA1
814f3a600214a8ffad12f87924952484c121dbe6

SHA256
fa1e9653d675b261738d462a108bebf9dcde9e7f4507761cbda31ed7be4c534c

SHA512
69998a1497f24df7e135a3a85cf667c0f0068b83dd2c5c8b516f644994b919c26198402ddda235a0464b2921ff2c8d31d348dbdfc0ce72243af4a8d501fd7899

Download Submit
C:\Windows\System\UDQiKgh.exe

Filesize
1.6MB

MD5
9df809f2f844dabefa68b1151b942c0e

SHA1
9807b02eefda825fbd4750db238afcff02da5824

SHA256
e2cf58e3eab06f5c560ba2e2a7409910445686c96f94081a59784ce76408a737

SHA512
7452db21e69df7557dc72c163476e07b6ab5491d061e54977a7d263a6159b4c7d6b696d6239703c06783d36eff2a31202a71d13d05fa015c59aa66bfd1b6e94e

Download Submit
C:\Windows\System\UJhvayT.exe

Filesize
1.6MB

MD5
a51f48f342e41203ec65b0e5efb8eff8

SHA1
ab0d0baf195fa9c7d31bf698885488c8be922cd8

SHA256
b57e2fc8916c6dca468c86d110f6d9e182b2e264283e4793d3efdaba174c59c4

SHA512
e73467a2db9ff1574d4a235013754cb8124dfd29d7b4bc1d46bf0463d36752c756bb4c472e92a488fe574ea23b23ce0faa86a2a5fc03d901f995ae73776846d5

Download Submit
C:\Windows\System\VwIjCRA.exe

Filesize
1.6MB

MD5
f9603dc6a8a9d4ad9b56dc6b853967d1

SHA1
5d893ee889731830bee09348e947dd63ef47053e

SHA256
375529b97e75e07b69b7efb74edcae5c0a47c445c4a50eddb540e89f5d78518e

SHA512
70b0f57a87abbcb7fd0d4aaa458d13597ae0c9eea784bef2c6bf22d1a909cefbd8cea8cbd68159616ad6fecac5e3525dc232d2f1dff1c9e23b7961674171c2e7

Download Submit
C:\Windows\System\WueEqhx.exe

Filesize
1.6MB

MD5
64130718949eb8f2419c8f0696485096

SHA1
cc08b5b45ebc4821f5e76cd78addda59b10b5874

SHA256
a3ac820d3c292ca15a77c1a77d081b5db60558d860bf676e3392a294cd43c5cb

SHA512
ebb39b78a468e413e8ebd3d465c09de13e1b319438f550f302c07535a401c1836cd18219f8347678e7104393fea27394e1e84d2aa075996ed889890b6912cecc

Download Submit
C:\Windows\System\Xwudgol.exe

Filesize
1.6MB

MD5
df04f2e1a6b139c6e49914ac8c677187

SHA1
b7f2bbb5b82ae19763b728fc247d9082cdab687c

SHA256
cc4a72fb96f1ffa1b6d8a32410e2d2ecfc28ffd602e3d1f631c9d23388d3a5a0

SHA512
054436ff3f4e765cca471ca25ceda631301ed6ab66a85f8a7f29a8b32bf7c0d029d6dff8907eb6d061558c9aa28c77a5b404eeff8ba18c7367656b80dd24387b

Download Submit
C:\Windows\System\ZNApLqW.exe

Filesize
1.6MB

MD5
5eff13ab89cef72f5d2d52cf4ab66daf

SHA1
e71cfdc489ab30b9c3173cc8be63039823c23a18

SHA256
116d5b33277ede6b579be58a0e0c86a159fcc3ab2bf60d93acf94bbc07df69fe

SHA512
7fb30e6e8613736cd1eeaa99a8d7dde4016024c1838a8ad3d2829108031351b6529da2abc0d5b9f10b639855097f25bf09f217c896acae1ce82642c810807162

Download Submit
C:\Windows\System\ZspNlRi.exe

Filesize
1.6MB

MD5
b742570459b74369ac67b6af3e343a9e

SHA1
2735ca1c7f04a9e216ed9c5618c83cf3323dd822

SHA256
841d4f9347861fab3da1c4d547b71e50d620233b36320cffcea17c3fa1b92c52

SHA512
fa4ed3735f2786569ab04cae16c76617f39fa4ed712748453941fa41d7be528aa2f0e72e9fd4ce913f2bec3fd6dadaeec870e0901b027ac652dae29f0c2740a0

Download Submit
C:\Windows\System\aVrwVie.exe

Filesize
1.6MB

MD5
ffc477f2f211d494af305e7e4e6f36cf

SHA1
a7769753615c0c0873446229eb760833e91969de

SHA256
a5504c4e77d11210c974142b10a6edf3546fa0f62d3c1c0d069efcd72cc5322b

SHA512
2f9ad842160b26dc31ea0d7c6a32f43946464178bba016b2062929de358cc1ca18bd9203ba6b22549b6016eb5a527b347fba42f328094026d35f4b85782d3dbf

Download Submit
C:\Windows\System\aWxmsRA.exe

Filesize
1.6MB

MD5
15fe593b4f2504a11aacb61f60359802

SHA1
2804d2e86118383733db52896c9be6a533dafa5b

SHA256
75e788fa2a01dbc30ffbbeb52bbf871fdcb9d76610bdf6c3eda81e24532de9a4

SHA512
81cf9ffb1235d6aaf7c304a1ea07fecfa9ee8f520061d60ca7704313471f68894204475c08c36a01a85826c875b43fe8b233b9bd54c18ef26decec95922a6bb5

Download Submit
C:\Windows\System\apwcLIb.exe

Filesize
1.6MB

MD5
5120f6e7f3ac2f07af0b1af02d8a31a4

SHA1
486b8531fe73eba814729e94f83b0b23c9aff312

SHA256
f5a9de5ef83d6df3707aefe6e5f4796e84d9db830dd4ae093a384bc2741760bd

SHA512
dbc80a95aa917dc9de44eb133b58f2b439dbabeb9f942fc7e91447ac5c618ca822b713cde54877af815b4e79693cd48203f58613f16ad27f2ce0313c786b5226

Download Submit
C:\Windows\System\cypiolt.exe

Filesize
1.6MB

MD5
c5378eba39688d18e290be53e4bc0bab

SHA1
59067fe76d6310a7e0c7fe9574e9bcf4da8603d5

SHA256
fbaee0fc8358bd2b1e02f93cbf7391985a363a9c7775ce9ed053dc80e0b9c707

SHA512
48ceff24ad1be31caa607d91798e29ca126ab8781282d5d723c18f2de2170e12d7657ff3b526a3acf4b94909a14900a767120717ce84e9a2004ff7867dc25cb5

Download Submit
C:\Windows\System\dPcixpM.exe

Filesize
1.6MB

MD5
43060ecdc9bf231dd0f5a5a35d8d9996

SHA1
6afc93fdf2a212df3bef99acd3f34183c4df74b6

SHA256
317f5d177d42fbca78041a5b949bacadf78e47e51fbf135b62c3c80f50ffa2e1

SHA512
9476c5d7891d8fc2260709602cc8f571e85aa4c892ff96c811d3fda52866001fc4ae7b61d2c945124f8b4ad7c4db2a77f0d12007e6f6161c21815a592a4bfff6

Download Submit
C:\Windows\System\dPmFVhu.exe

Filesize
1.6MB

MD5
66b97c876f97a24beb4a0bb1800dfdeb

SHA1
65af59072901fc2706b3c899d5ff27bd2c6780c6

SHA256
8799ade7792ef3f013d4803ef6829ddfb2d662cf6475ce860a3a866b1b09a7d7

SHA512
ede562b0986df0ef6da75db6d4a9bdb832c1e847d597239f170573a790d93d4c32b313dfef52cee2c31023452a12f70c65a14afaa2e18e7784d66af555d0eb78

Download Submit
C:\Windows\System\fyOyMds.exe

Filesize
1.6MB

MD5
f470dd905f3e127e71b555d6eafc3cf6

SHA1
b958d9c2a4a49f99e664b526c2a269e851741a66

SHA256
c2b9f9b53ab2e604aa5eee0169d1b8957ddc6b5959ba864007a1588ca5bc2bde

SHA512
a10c80b2fa62e860cb04dc8818b257a2eaade58011b26f9a28f61819d81de1a30732a052c57946c93e50b06e8027fb9f6ec74b53d9930fb33c680d0a8a3eabf2

Download Submit
C:\Windows\System\gYKCvJk.exe

Filesize
1.6MB

MD5
8360ed6677bc04784afd8e8d11731e75

SHA1
e05de203fefc16186e515b59251598a940f2aad1

SHA256
2973a02298194895ebf8e90236879b5de0065a1cc5cdbd2da449fe33787ad350

SHA512
0a8d39e81ff67137c25379ae1a579a3c736df1821a762b44cd73c7e536c80b129d318e88f9c53113ff45cfcb6a24a28456527e7fd40bbe665c1df30b96d9d512

Download Submit
C:\Windows\System\lOOzkQS.exe

Filesize
1.6MB

MD5
53fb58d2c0c444f5cf6dfd25ee01d6e0

SHA1
30853ae46a85eee98d5cae78258ca8b95b34348e

SHA256
965ed1ed62238896a3824e722ade32b40ae64018460986a477985d2573a3f0cf

SHA512
ec83412068f2e441bc8fce12f76e4b7e258c7bbce9d5424c753dcab66daf78b38645e4e32d5c9276cc440309f241cfb26f90872cf83259a5b5262d8fb3fe36ec

Download Submit
C:\Windows\System\mpHwFtD.exe

Filesize
1.6MB

MD5
df8a722bce6c695b80158e440596ea09

SHA1
8700f505485e2a230ec7e2227405b90fdb02e2e4

SHA256
5dbd225b10bc71353142a013a2efbe8a04e69bd5e38080abdd9111996846a2ee

SHA512
c28996a6cb37e9941846fa7551670c5b8e105dfb39d47f20f0cac2bfc9650d1494454e5097ea06d677c38a31cd6a90d592a48f98dc4b42041fceca4ea1018d11

Download Submit
C:\Windows\System\nNUIiTz.exe

Filesize
1.6MB

MD5
0c091ed9611d4d7f75f46c23e2682fd3

SHA1
7db76515df4cdd85aba657e29128221949c484ea

SHA256
27dc77bd2520e664864eb98153e5243aa838273e55a4f87db843b08239a5d3aa

SHA512
4369811e448f920ace46c5c410591b3ad1dd9e547118d47fca83a172af191da4abbaf72db87cb6ae8e4a82ebaf63a81652234391c9b6ddd765f6618761d4fe21

Download Submit
C:\Windows\System\nZihoAD.exe

Filesize
1.6MB

MD5
a8789d77cdf0a3732301ac62caf86626

SHA1
e8009e9085156fd5046b2186b8213d0bcdb0b551

SHA256
1ab5221fc6019e8786629955a38d1e362ab52a79b83f5cd3fb2f02c191e5a9f0

SHA512
4cb8765da8ca5d42a9f0693c9eede6143692a3ef11d7b5cb69ab12f622f5431da0764dccc07c1b994b4eba2aaa358af83be14b0e2a1bbd90afa659f516232555

Download Submit
C:\Windows\System\oOayAOa.exe

Filesize
1.6MB

MD5
991991dff2cce611d481afcb1b2f5f06

SHA1
c29eb79833ff82f343d37f675c9c9966c4e38124

SHA256
6ce43b9394b8500a6e2087245769840551881df87d2a3c231bd86434fc38efd8

SHA512
3e19aa1fbad474f09d46f9b016ccc430d9cd8324d3569fd08d11100b2acbfde062ac6fc8bd8d810fda26d97a96d99fd05f4ea794cfd532e2bf80eb3cb388a34a

Download Submit
C:\Windows\System\qCycBhh.exe

Filesize
1.6MB

MD5
34ce3ebf56175cabaf69523870f59c9a

SHA1
a37d2790b3a321b8d4c181b5ce9264be93f47443

SHA256
19cf56d75786a9f395f38312c53f9727b0fb150eb89ad96aed9f976a290db053

SHA512
c5c008455afc2c5595629295982bc09882c8d14bbb8bcd7bbd9029e01906c4756118316ac46312237359c49863a404f766b53a7a552fba974fc4c7ed8f2c11ef

Download Submit
C:\Windows\System\tTDkKmM.exe

Filesize
1.6MB

MD5
76dc8897aab8900dd8b7ea507fa013b7

SHA1
688111ced171e04a89ecbc68eb20992dd30a0928

SHA256
2cbcd1eb6cf73b469036ac291d59a4fe257a96daf7227ac37860bcf8fc62074f

SHA512
361aebfa503f785c0801b04ba60726f7b9aaa5b4ae8da1cdd71315da3304585764702c5c0cb2c70240381f481b0fd392c689a7c5c3b08b19ceb4b2f8115b32df

Download Submit
C:\Windows\System\tpzAKpw.exe

Filesize
1.6MB

MD5
ae170bf55e641a7ee41aaf68bf50ebe2

SHA1
9306d37cb42dfd889ab9f8b21b118bc7c99b43c6

SHA256
d7db3d3c14319d260d7c83e3a51fedf2ea8ff42ad0c46a51bdb1878cf4c93ff4

SHA512
ac406c5e7c46665a51114f0a99c40bf2ef8806ecce2bb4a7713c30db58d5ee1e823af40c42ea2c43dd78e272107a0fbeb92e09ee220757e3d94ad73e56f58fcd

Download Submit
C:\Windows\System\uylybeX.exe

Filesize
1.6MB

MD5
d47a9c01c7fde19d14cc6bc6f5a14d37

SHA1
789cd44d84c824d4b9012bf2056380d0471aa324

SHA256
74c05da86d4f8fec6d642716c7ec41be2e2e75fb086b2c7a30f1bffeae4da1e1

SHA512
0948d785b6980edbffcf17069b4fc229ce78f635fcec7f2ce9034e6a9db5072a18baf5728afdc1c60b1f58fd905c2923c77dafde1556b4963fc5ff0569e58dc2

Download Submit
C:\Windows\System\wKGZmXQ.exe

Filesize
1.6MB

MD5
2679a8c7bc6473612cad601f707055fa

SHA1
56c70164edff30cf963b7c8b526f2af248a7d710

SHA256
c5888bec4246207ffe68bcf5a347d020746fed9dd609022f4e6fdaa660332b35

SHA512
91453bf278073f8bfeb02a325ff864de0a4c7212cb3620fb6db54301c2f3e42c208a9d7f1026f637e6e67c251829c478c270fd0ba6146c71b5b699823cf991e9

Download Submit
memory/1752-0-0x0000028C82640000-0x0000028C82650000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads