xmrig | 9668de0f15ae72f60a884c3fff89fa143135d87df9f99220132ea1d55b709ccf

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
18-11-2024 02:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9668de0f15ae72f60a884c3fff89fa143135d87df9f99220132ea1d55b709ccf.exe
Size

1.5MB
MD5

b56fa0a121f3309edbd0f4fc164f75de
SHA1

d60b90f34bab825cec1947122b141e6fe26a52d0
SHA256

9668de0f15ae72f60a884c3fff89fa143135d87df9f99220132ea1d55b709ccf
SHA512

a0b11bce724feeb5914537edb505bf009d44d57bd516767307bc7b273e7592efdcaed14a5d1a070592009c6e725d3c4ac9be01e65e0317db2eba25baa1b6761c
SSDEEP

49152:GezaTF8FcNkNdfE0pZ9ozttwIRxjaXdbxRv:GemTLkNdfE0pZyC

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 33 IoCs

miner

resource	yara_rule
behavioral2/files/0x000c000000023b2f-4.dat	xmrig
behavioral2/files/0x000a000000023b92-6.dat	xmrig
behavioral2/files/0x000b000000023b8e-9.dat	xmrig
behavioral2/files/0x000a000000023b94-24.dat	xmrig
behavioral2/files/0x000a000000023b95-33.dat	xmrig
behavioral2/files/0x000a000000023b98-44.dat	xmrig
behavioral2/files/0x000a000000023b97-54.dat	xmrig
behavioral2/files/0x000a000000023b9c-65.dat	xmrig
behavioral2/files/0x000a000000023b99-63.dat	xmrig
behavioral2/files/0x000a000000023b9b-61.dat	xmrig
behavioral2/files/0x000a000000023b9a-59.dat	xmrig
behavioral2/files/0x000a000000023b96-35.dat	xmrig
behavioral2/files/0x000a000000023b93-22.dat	xmrig
behavioral2/files/0x000a000000023b9d-69.dat	xmrig
behavioral2/files/0x000a000000023ba0-76.dat	xmrig
behavioral2/files/0x000a000000023ba2-85.dat	xmrig
behavioral2/files/0x000a000000023ba1-88.dat	xmrig
behavioral2/files/0x000a000000023ba6-104.dat	xmrig
behavioral2/files/0x000a000000023ba5-107.dat	xmrig
behavioral2/files/0x000b000000023ba9-119.dat	xmrig
behavioral2/files/0x000a000000023bb3-134.dat	xmrig
behavioral2/files/0x000b000000023bab-138.dat	xmrig
behavioral2/files/0x000b000000023baa-136.dat	xmrig
behavioral2/files/0x000a000000023ba8-127.dat	xmrig
behavioral2/files/0x000a000000023ba7-125.dat	xmrig
behavioral2/files/0x000a000000023ba3-113.dat	xmrig
behavioral2/files/0x000a000000023ba4-110.dat	xmrig
behavioral2/files/0x000b000000023b8f-96.dat	xmrig
behavioral2/files/0x0009000000023bc8-153.dat	xmrig
behavioral2/files/0x0008000000023bc3-161.dat	xmrig
behavioral2/files/0x0009000000023bca-162.dat	xmrig
behavioral2/files/0x000e000000023bba-158.dat	xmrig
behavioral2/files/0x0009000000023bc9-156.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2640	ZSdWDDe.exe
980	XqWVNZy.exe
2952	bZoscmI.exe
1660	mUaouQT.exe
1180	ArCgqDl.exe
2512	ehokRgP.exe
2900	aYJiUcK.exe
2264	ASjAIwZ.exe
1796	KmUzHSh.exe
696	hXHdaJm.exe
1740	LPmitlF.exe
3944	DEHMtso.exe
4988	QPtzgDN.exe
3660	cbGRkgK.exe
2384	BFiGaTE.exe
1080	SPopyqG.exe
2904	ZxlPAic.exe
2472	TYCHYIN.exe
3596	uQNmxZN.exe
1536	RRoEiSc.exe
4672	gwBOOLw.exe
3832	WztAxpD.exe
2132	lUXnHFy.exe
4908	IEvyVFn.exe
4896	FMkvjqK.exe
4304	WCPHBCl.exe
4172	NyOpbqQ.exe
4632	cGLRAlQ.exe
2888	izOQXJX.exe
4100	ztLIwiY.exe
460	ZNkxItw.exe
1696	YeYzGus.exe
5036	QArVAnv.exe
628	LALVXCl.exe
4200	olNPWmU.exe
5108	HlSkWuk.exe
1880	rqHBBVA.exe
4412	GXZxoEe.exe
3992	vlAtEXt.exe
2064	svmGnbr.exe
2792	UYEXUeP.exe
1172	ZkskzES.exe
2740	qnPwVLN.exe
2528	tbBKnBp.exe
1920	NbrbUQE.exe
1436	xEzrQMT.exe
4360	HQYcoMZ.exe
1620	gmNBKgL.exe
1700	yybvSoa.exe
4532	iDFdrkq.exe
4016	LIpPaps.exe
2848	QYXUOro.exe
1012	cwChUkS.exe
712	QKcBvEA.exe
4300	KyqheOq.exe
3756	oEkyuvH.exe
4920	QJWVLbG.exe
3228	FszOAjT.exe
4748	MKKEFJH.exe
1476	MsbFeOD.exe
3040	upRSgCd.exe
1688	PrMyqke.exe
3912	MYxyeLw.exe
5020	YJMjnOC.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\FSapUHQ.exe	9668de0f15ae72f60a884c3fff89fa143135d87df9f99220132ea1d55b709ccf.exe
File created	C:\Windows\System\WVnmIsd.exe	9668de0f15ae72f60a884c3fff89fa143135d87df9f99220132ea1d55b709ccf.exe
File created	C:\Windows\System\NAjEcnv.exe	9668de0f15ae72f60a884c3fff89fa143135d87df9f99220132ea1d55b709ccf.exe
File created	C:\Windows\System\ahPfFFc.exe	9668de0f15ae72f60a884c3fff89fa143135d87df9f99220132ea1d55b709ccf.exe
File created	C:\Windows\System\uTxSgQh.exe	9668de0f15ae72f60a884c3fff89fa143135d87df9f99220132ea1d55b709ccf.exe
File created	C:\Windows\System\kriuFBW.exe	9668de0f15ae72f60a884c3fff89fa143135d87df9f99220132ea1d55b709ccf.exe
File created	C:\Windows\System\JzAZTyS.exe	9668de0f15ae72f60a884c3fff89fa143135d87df9f99220132ea1d55b709ccf.exe
File created	C:\Windows\System\gYvBPAS.exe	9668de0f15ae72f60a884c3fff89fa143135d87df9f99220132ea1d55b709ccf.exe
File created	C:\Windows\System\kigijxY.exe	9668de0f15ae72f60a884c3fff89fa143135d87df9f99220132ea1d55b709ccf.exe
File created	C:\Windows\System\cSHXapk.exe	9668de0f15ae72f60a884c3fff89fa143135d87df9f99220132ea1d55b709ccf.exe
File created	C:\Windows\System\XBYkvKl.exe	9668de0f15ae72f60a884c3fff89fa143135d87df9f99220132ea1d55b709ccf.exe
File created	C:\Windows\System\vewmuQc.exe	9668de0f15ae72f60a884c3fff89fa143135d87df9f99220132ea1d55b709ccf.exe
File created	C:\Windows\System\EsycpTb.exe	9668de0f15ae72f60a884c3fff89fa143135d87df9f99220132ea1d55b709ccf.exe
File created	C:\Windows\System\XLMkUOB.exe	9668de0f15ae72f60a884c3fff89fa143135d87df9f99220132ea1d55b709ccf.exe
File created	C:\Windows\System\WnlFgzI.exe	9668de0f15ae72f60a884c3fff89fa143135d87df9f99220132ea1d55b709ccf.exe
File created	C:\Windows\System\MUGMRbs.exe	9668de0f15ae72f60a884c3fff89fa143135d87df9f99220132ea1d55b709ccf.exe
File created	C:\Windows\System\cFAbOpm.exe	9668de0f15ae72f60a884c3fff89fa143135d87df9f99220132ea1d55b709ccf.exe
File created	C:\Windows\System\bzFTUUO.exe	9668de0f15ae72f60a884c3fff89fa143135d87df9f99220132ea1d55b709ccf.exe
File created	C:\Windows\System\XiqHdaJ.exe	9668de0f15ae72f60a884c3fff89fa143135d87df9f99220132ea1d55b709ccf.exe
File created	C:\Windows\System\PxyHvpx.exe	9668de0f15ae72f60a884c3fff89fa143135d87df9f99220132ea1d55b709ccf.exe
File created	C:\Windows\System\TxmvrUu.exe	9668de0f15ae72f60a884c3fff89fa143135d87df9f99220132ea1d55b709ccf.exe
File created	C:\Windows\System\XMZBBWp.exe	9668de0f15ae72f60a884c3fff89fa143135d87df9f99220132ea1d55b709ccf.exe
File created	C:\Windows\System\BMaOZco.exe	9668de0f15ae72f60a884c3fff89fa143135d87df9f99220132ea1d55b709ccf.exe
File created	C:\Windows\System\BbDhnVN.exe	9668de0f15ae72f60a884c3fff89fa143135d87df9f99220132ea1d55b709ccf.exe
File created	C:\Windows\System\enxzRQY.exe	9668de0f15ae72f60a884c3fff89fa143135d87df9f99220132ea1d55b709ccf.exe
File created	C:\Windows\System\NrHYUjX.exe	9668de0f15ae72f60a884c3fff89fa143135d87df9f99220132ea1d55b709ccf.exe
File created	C:\Windows\System\yybvSoa.exe	9668de0f15ae72f60a884c3fff89fa143135d87df9f99220132ea1d55b709ccf.exe
File created	C:\Windows\System\OXCvUaQ.exe	9668de0f15ae72f60a884c3fff89fa143135d87df9f99220132ea1d55b709ccf.exe
File created	C:\Windows\System\pjVuzNg.exe	9668de0f15ae72f60a884c3fff89fa143135d87df9f99220132ea1d55b709ccf.exe
File created	C:\Windows\System\AzCNAFs.exe	9668de0f15ae72f60a884c3fff89fa143135d87df9f99220132ea1d55b709ccf.exe
File created	C:\Windows\System\DcPprVp.exe	9668de0f15ae72f60a884c3fff89fa143135d87df9f99220132ea1d55b709ccf.exe
File created	C:\Windows\System\SmrGpJY.exe	9668de0f15ae72f60a884c3fff89fa143135d87df9f99220132ea1d55b709ccf.exe
File created	C:\Windows\System\qPaCkmn.exe	9668de0f15ae72f60a884c3fff89fa143135d87df9f99220132ea1d55b709ccf.exe
File created	C:\Windows\System\RDvanDC.exe	9668de0f15ae72f60a884c3fff89fa143135d87df9f99220132ea1d55b709ccf.exe
File created	C:\Windows\System\IEvyVFn.exe	9668de0f15ae72f60a884c3fff89fa143135d87df9f99220132ea1d55b709ccf.exe
File created	C:\Windows\System\hrAuUlU.exe	9668de0f15ae72f60a884c3fff89fa143135d87df9f99220132ea1d55b709ccf.exe
File created	C:\Windows\System\ROISuHQ.exe	9668de0f15ae72f60a884c3fff89fa143135d87df9f99220132ea1d55b709ccf.exe
File created	C:\Windows\System\WUxiSSU.exe	9668de0f15ae72f60a884c3fff89fa143135d87df9f99220132ea1d55b709ccf.exe
File created	C:\Windows\System\SPopyqG.exe	9668de0f15ae72f60a884c3fff89fa143135d87df9f99220132ea1d55b709ccf.exe
File created	C:\Windows\System\iMvgYnh.exe	9668de0f15ae72f60a884c3fff89fa143135d87df9f99220132ea1d55b709ccf.exe
File created	C:\Windows\System\GmxipGj.exe	9668de0f15ae72f60a884c3fff89fa143135d87df9f99220132ea1d55b709ccf.exe
File created	C:\Windows\System\qiUieAq.exe	9668de0f15ae72f60a884c3fff89fa143135d87df9f99220132ea1d55b709ccf.exe
File created	C:\Windows\System\BawBWsz.exe	9668de0f15ae72f60a884c3fff89fa143135d87df9f99220132ea1d55b709ccf.exe
File created	C:\Windows\System\XPUwpHg.exe	9668de0f15ae72f60a884c3fff89fa143135d87df9f99220132ea1d55b709ccf.exe
File created	C:\Windows\System\IDDMsxF.exe	9668de0f15ae72f60a884c3fff89fa143135d87df9f99220132ea1d55b709ccf.exe
File created	C:\Windows\System\qfQUCvU.exe	9668de0f15ae72f60a884c3fff89fa143135d87df9f99220132ea1d55b709ccf.exe
File created	C:\Windows\System\RgBSltI.exe	9668de0f15ae72f60a884c3fff89fa143135d87df9f99220132ea1d55b709ccf.exe
File created	C:\Windows\System\ShRoOpE.exe	9668de0f15ae72f60a884c3fff89fa143135d87df9f99220132ea1d55b709ccf.exe
File created	C:\Windows\System\aaOZNpl.exe	9668de0f15ae72f60a884c3fff89fa143135d87df9f99220132ea1d55b709ccf.exe
File created	C:\Windows\System\URlZFhh.exe	9668de0f15ae72f60a884c3fff89fa143135d87df9f99220132ea1d55b709ccf.exe
File created	C:\Windows\System\VJPajIU.exe	9668de0f15ae72f60a884c3fff89fa143135d87df9f99220132ea1d55b709ccf.exe
File created	C:\Windows\System\oCtGQHH.exe	9668de0f15ae72f60a884c3fff89fa143135d87df9f99220132ea1d55b709ccf.exe
File created	C:\Windows\System\ieEmzOn.exe	9668de0f15ae72f60a884c3fff89fa143135d87df9f99220132ea1d55b709ccf.exe
File created	C:\Windows\System\gDTioMB.exe	9668de0f15ae72f60a884c3fff89fa143135d87df9f99220132ea1d55b709ccf.exe
File created	C:\Windows\System\JhXisUj.exe	9668de0f15ae72f60a884c3fff89fa143135d87df9f99220132ea1d55b709ccf.exe
File created	C:\Windows\System\MwFxMpD.exe	9668de0f15ae72f60a884c3fff89fa143135d87df9f99220132ea1d55b709ccf.exe
File created	C:\Windows\System\AcuVoBS.exe	9668de0f15ae72f60a884c3fff89fa143135d87df9f99220132ea1d55b709ccf.exe
File created	C:\Windows\System\XzIzqMu.exe	9668de0f15ae72f60a884c3fff89fa143135d87df9f99220132ea1d55b709ccf.exe
File created	C:\Windows\System\sawPchW.exe	9668de0f15ae72f60a884c3fff89fa143135d87df9f99220132ea1d55b709ccf.exe
File created	C:\Windows\System\QvmXFpd.exe	9668de0f15ae72f60a884c3fff89fa143135d87df9f99220132ea1d55b709ccf.exe
File created	C:\Windows\System\gynFPWh.exe	9668de0f15ae72f60a884c3fff89fa143135d87df9f99220132ea1d55b709ccf.exe
File created	C:\Windows\System\RYrfmNY.exe	9668de0f15ae72f60a884c3fff89fa143135d87df9f99220132ea1d55b709ccf.exe
File created	C:\Windows\System\vqTUgGR.exe	9668de0f15ae72f60a884c3fff89fa143135d87df9f99220132ea1d55b709ccf.exe
File created	C:\Windows\System\YVFTFvP.exe	9668de0f15ae72f60a884c3fff89fa143135d87df9f99220132ea1d55b709ccf.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	17400	dwm.exe
Token: SeChangeNotifyPrivilege	17400	dwm.exe
Token: 33	17400	dwm.exe
Token: SeIncBasePriorityPrivilege	17400	dwm.exe
Token: SeShutdownPrivilege	17400	dwm.exe
Token: SeCreatePagefilePrivilege	17400	dwm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1672 wrote to memory of 2640	1672	9668de0f15ae72f60a884c3fff89fa143135d87df9f99220132ea1d55b709ccf.exe	84
PID 1672 wrote to memory of 2640	1672	9668de0f15ae72f60a884c3fff89fa143135d87df9f99220132ea1d55b709ccf.exe	84
PID 1672 wrote to memory of 980	1672	9668de0f15ae72f60a884c3fff89fa143135d87df9f99220132ea1d55b709ccf.exe	85
PID 1672 wrote to memory of 980	1672	9668de0f15ae72f60a884c3fff89fa143135d87df9f99220132ea1d55b709ccf.exe	85
PID 1672 wrote to memory of 2952	1672	9668de0f15ae72f60a884c3fff89fa143135d87df9f99220132ea1d55b709ccf.exe	86
PID 1672 wrote to memory of 2952	1672	9668de0f15ae72f60a884c3fff89fa143135d87df9f99220132ea1d55b709ccf.exe	86
PID 1672 wrote to memory of 1660	1672	9668de0f15ae72f60a884c3fff89fa143135d87df9f99220132ea1d55b709ccf.exe	87
PID 1672 wrote to memory of 1660	1672	9668de0f15ae72f60a884c3fff89fa143135d87df9f99220132ea1d55b709ccf.exe	87
PID 1672 wrote to memory of 1180	1672	9668de0f15ae72f60a884c3fff89fa143135d87df9f99220132ea1d55b709ccf.exe	88
PID 1672 wrote to memory of 1180	1672	9668de0f15ae72f60a884c3fff89fa143135d87df9f99220132ea1d55b709ccf.exe	88
PID 1672 wrote to memory of 2512	1672	9668de0f15ae72f60a884c3fff89fa143135d87df9f99220132ea1d55b709ccf.exe	89
PID 1672 wrote to memory of 2512	1672	9668de0f15ae72f60a884c3fff89fa143135d87df9f99220132ea1d55b709ccf.exe	89
PID 1672 wrote to memory of 2900	1672	9668de0f15ae72f60a884c3fff89fa143135d87df9f99220132ea1d55b709ccf.exe	90
PID 1672 wrote to memory of 2900	1672	9668de0f15ae72f60a884c3fff89fa143135d87df9f99220132ea1d55b709ccf.exe	90
PID 1672 wrote to memory of 2264	1672	9668de0f15ae72f60a884c3fff89fa143135d87df9f99220132ea1d55b709ccf.exe	91
PID 1672 wrote to memory of 2264	1672	9668de0f15ae72f60a884c3fff89fa143135d87df9f99220132ea1d55b709ccf.exe	91
PID 1672 wrote to memory of 1796	1672	9668de0f15ae72f60a884c3fff89fa143135d87df9f99220132ea1d55b709ccf.exe	92
PID 1672 wrote to memory of 1796	1672	9668de0f15ae72f60a884c3fff89fa143135d87df9f99220132ea1d55b709ccf.exe	92
PID 1672 wrote to memory of 696	1672	9668de0f15ae72f60a884c3fff89fa143135d87df9f99220132ea1d55b709ccf.exe	93
PID 1672 wrote to memory of 696	1672	9668de0f15ae72f60a884c3fff89fa143135d87df9f99220132ea1d55b709ccf.exe	93
PID 1672 wrote to memory of 1740	1672	9668de0f15ae72f60a884c3fff89fa143135d87df9f99220132ea1d55b709ccf.exe	94
PID 1672 wrote to memory of 1740	1672	9668de0f15ae72f60a884c3fff89fa143135d87df9f99220132ea1d55b709ccf.exe	94
PID 1672 wrote to memory of 3944	1672	9668de0f15ae72f60a884c3fff89fa143135d87df9f99220132ea1d55b709ccf.exe	95
PID 1672 wrote to memory of 3944	1672	9668de0f15ae72f60a884c3fff89fa143135d87df9f99220132ea1d55b709ccf.exe	95
PID 1672 wrote to memory of 4988	1672	9668de0f15ae72f60a884c3fff89fa143135d87df9f99220132ea1d55b709ccf.exe	96
PID 1672 wrote to memory of 4988	1672	9668de0f15ae72f60a884c3fff89fa143135d87df9f99220132ea1d55b709ccf.exe	96
PID 1672 wrote to memory of 3660	1672	9668de0f15ae72f60a884c3fff89fa143135d87df9f99220132ea1d55b709ccf.exe	97
PID 1672 wrote to memory of 3660	1672	9668de0f15ae72f60a884c3fff89fa143135d87df9f99220132ea1d55b709ccf.exe	97
PID 1672 wrote to memory of 2384	1672	9668de0f15ae72f60a884c3fff89fa143135d87df9f99220132ea1d55b709ccf.exe	98
PID 1672 wrote to memory of 2384	1672	9668de0f15ae72f60a884c3fff89fa143135d87df9f99220132ea1d55b709ccf.exe	98
PID 1672 wrote to memory of 2904	1672	9668de0f15ae72f60a884c3fff89fa143135d87df9f99220132ea1d55b709ccf.exe	99
PID 1672 wrote to memory of 2904	1672	9668de0f15ae72f60a884c3fff89fa143135d87df9f99220132ea1d55b709ccf.exe	99
PID 1672 wrote to memory of 1080	1672	9668de0f15ae72f60a884c3fff89fa143135d87df9f99220132ea1d55b709ccf.exe	100
PID 1672 wrote to memory of 1080	1672	9668de0f15ae72f60a884c3fff89fa143135d87df9f99220132ea1d55b709ccf.exe	100
PID 1672 wrote to memory of 2472	1672	9668de0f15ae72f60a884c3fff89fa143135d87df9f99220132ea1d55b709ccf.exe	101
PID 1672 wrote to memory of 2472	1672	9668de0f15ae72f60a884c3fff89fa143135d87df9f99220132ea1d55b709ccf.exe	101
PID 1672 wrote to memory of 3596	1672	9668de0f15ae72f60a884c3fff89fa143135d87df9f99220132ea1d55b709ccf.exe	102
PID 1672 wrote to memory of 3596	1672	9668de0f15ae72f60a884c3fff89fa143135d87df9f99220132ea1d55b709ccf.exe	102
PID 1672 wrote to memory of 1536	1672	9668de0f15ae72f60a884c3fff89fa143135d87df9f99220132ea1d55b709ccf.exe	103
PID 1672 wrote to memory of 1536	1672	9668de0f15ae72f60a884c3fff89fa143135d87df9f99220132ea1d55b709ccf.exe	103
PID 1672 wrote to memory of 4672	1672	9668de0f15ae72f60a884c3fff89fa143135d87df9f99220132ea1d55b709ccf.exe	104
PID 1672 wrote to memory of 4672	1672	9668de0f15ae72f60a884c3fff89fa143135d87df9f99220132ea1d55b709ccf.exe	104
PID 1672 wrote to memory of 3832	1672	9668de0f15ae72f60a884c3fff89fa143135d87df9f99220132ea1d55b709ccf.exe	105
PID 1672 wrote to memory of 3832	1672	9668de0f15ae72f60a884c3fff89fa143135d87df9f99220132ea1d55b709ccf.exe	105
PID 1672 wrote to memory of 2132	1672	9668de0f15ae72f60a884c3fff89fa143135d87df9f99220132ea1d55b709ccf.exe	106
PID 1672 wrote to memory of 2132	1672	9668de0f15ae72f60a884c3fff89fa143135d87df9f99220132ea1d55b709ccf.exe	106
PID 1672 wrote to memory of 4908	1672	9668de0f15ae72f60a884c3fff89fa143135d87df9f99220132ea1d55b709ccf.exe	108
PID 1672 wrote to memory of 4908	1672	9668de0f15ae72f60a884c3fff89fa143135d87df9f99220132ea1d55b709ccf.exe	108
PID 1672 wrote to memory of 4896	1672	9668de0f15ae72f60a884c3fff89fa143135d87df9f99220132ea1d55b709ccf.exe	109
PID 1672 wrote to memory of 4896	1672	9668de0f15ae72f60a884c3fff89fa143135d87df9f99220132ea1d55b709ccf.exe	109
PID 1672 wrote to memory of 4304	1672	9668de0f15ae72f60a884c3fff89fa143135d87df9f99220132ea1d55b709ccf.exe	110
PID 1672 wrote to memory of 4304	1672	9668de0f15ae72f60a884c3fff89fa143135d87df9f99220132ea1d55b709ccf.exe	110
PID 1672 wrote to memory of 4172	1672	9668de0f15ae72f60a884c3fff89fa143135d87df9f99220132ea1d55b709ccf.exe	111
PID 1672 wrote to memory of 4172	1672	9668de0f15ae72f60a884c3fff89fa143135d87df9f99220132ea1d55b709ccf.exe	111
PID 1672 wrote to memory of 4632	1672	9668de0f15ae72f60a884c3fff89fa143135d87df9f99220132ea1d55b709ccf.exe	112
PID 1672 wrote to memory of 4632	1672	9668de0f15ae72f60a884c3fff89fa143135d87df9f99220132ea1d55b709ccf.exe	112
PID 1672 wrote to memory of 2888	1672	9668de0f15ae72f60a884c3fff89fa143135d87df9f99220132ea1d55b709ccf.exe	113
PID 1672 wrote to memory of 2888	1672	9668de0f15ae72f60a884c3fff89fa143135d87df9f99220132ea1d55b709ccf.exe	113
PID 1672 wrote to memory of 4100	1672	9668de0f15ae72f60a884c3fff89fa143135d87df9f99220132ea1d55b709ccf.exe	115
PID 1672 wrote to memory of 4100	1672	9668de0f15ae72f60a884c3fff89fa143135d87df9f99220132ea1d55b709ccf.exe	115
PID 1672 wrote to memory of 460	1672	9668de0f15ae72f60a884c3fff89fa143135d87df9f99220132ea1d55b709ccf.exe	116
PID 1672 wrote to memory of 460	1672	9668de0f15ae72f60a884c3fff89fa143135d87df9f99220132ea1d55b709ccf.exe	116
PID 1672 wrote to memory of 1696	1672	9668de0f15ae72f60a884c3fff89fa143135d87df9f99220132ea1d55b709ccf.exe	117
PID 1672 wrote to memory of 1696	1672	9668de0f15ae72f60a884c3fff89fa143135d87df9f99220132ea1d55b709ccf.exe	117

C:\Users\Admin\AppData\Local\Temp\9668de0f15ae72f60a884c3fff89fa143135d87df9f99220132ea1d55b709ccf.exe
"C:\Users\Admin\AppData\Local\Temp\9668de0f15ae72f60a884c3fff89fa143135d87df9f99220132ea1d55b709ccf.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1672
- C:\Windows\System\ZSdWDDe.exe
  C:\Windows\System\ZSdWDDe.exe
  2⤵
  - Executes dropped EXE
  PID:2640
- C:\Windows\System\XqWVNZy.exe
  C:\Windows\System\XqWVNZy.exe
  2⤵
  - Executes dropped EXE
  PID:980
- C:\Windows\System\bZoscmI.exe
  C:\Windows\System\bZoscmI.exe
  2⤵
  - Executes dropped EXE
  PID:2952
- C:\Windows\System\mUaouQT.exe
  C:\Windows\System\mUaouQT.exe
  2⤵
  - Executes dropped EXE
  PID:1660
- C:\Windows\System\ArCgqDl.exe
  C:\Windows\System\ArCgqDl.exe
  2⤵
  - Executes dropped EXE
  PID:1180
- C:\Windows\System\ehokRgP.exe
  C:\Windows\System\ehokRgP.exe
  2⤵
  - Executes dropped EXE
  PID:2512
- C:\Windows\System\aYJiUcK.exe
  C:\Windows\System\aYJiUcK.exe
  2⤵
  - Executes dropped EXE
  PID:2900
- C:\Windows\System\ASjAIwZ.exe
  C:\Windows\System\ASjAIwZ.exe
  2⤵
  - Executes dropped EXE
  PID:2264
- C:\Windows\System\KmUzHSh.exe
  C:\Windows\System\KmUzHSh.exe
  2⤵
  - Executes dropped EXE
  PID:1796
- C:\Windows\System\hXHdaJm.exe
  C:\Windows\System\hXHdaJm.exe
  2⤵
  - Executes dropped EXE
  PID:696
- C:\Windows\System\LPmitlF.exe
  C:\Windows\System\LPmitlF.exe
  2⤵
  - Executes dropped EXE
  PID:1740
- C:\Windows\System\DEHMtso.exe
  C:\Windows\System\DEHMtso.exe
  2⤵
  - Executes dropped EXE
  PID:3944
- C:\Windows\System\QPtzgDN.exe
  C:\Windows\System\QPtzgDN.exe
  2⤵
  - Executes dropped EXE
  PID:4988
- C:\Windows\System\cbGRkgK.exe
  C:\Windows\System\cbGRkgK.exe
  2⤵
  - Executes dropped EXE
  PID:3660
- C:\Windows\System\BFiGaTE.exe
  C:\Windows\System\BFiGaTE.exe
  2⤵
  - Executes dropped EXE
  PID:2384
- C:\Windows\System\ZxlPAic.exe
  C:\Windows\System\ZxlPAic.exe
  2⤵
  - Executes dropped EXE
  PID:2904
- C:\Windows\System\SPopyqG.exe
  C:\Windows\System\SPopyqG.exe
  2⤵
  - Executes dropped EXE
  PID:1080
- C:\Windows\System\TYCHYIN.exe
  C:\Windows\System\TYCHYIN.exe
  2⤵
  - Executes dropped EXE
  PID:2472
- C:\Windows\System\uQNmxZN.exe
  C:\Windows\System\uQNmxZN.exe
  2⤵
  - Executes dropped EXE
  PID:3596
- C:\Windows\System\RRoEiSc.exe
  C:\Windows\System\RRoEiSc.exe
  2⤵
  - Executes dropped EXE
  PID:1536
- C:\Windows\System\gwBOOLw.exe
  C:\Windows\System\gwBOOLw.exe
  2⤵
  - Executes dropped EXE
  PID:4672
- C:\Windows\System\WztAxpD.exe
  C:\Windows\System\WztAxpD.exe
  2⤵
  - Executes dropped EXE
  PID:3832
- C:\Windows\System\lUXnHFy.exe
  C:\Windows\System\lUXnHFy.exe
  2⤵
  - Executes dropped EXE
  PID:2132
- C:\Windows\System\IEvyVFn.exe
  C:\Windows\System\IEvyVFn.exe
  2⤵
  - Executes dropped EXE
  PID:4908
- C:\Windows\System\FMkvjqK.exe
  C:\Windows\System\FMkvjqK.exe
  2⤵
  - Executes dropped EXE
  PID:4896
- C:\Windows\System\WCPHBCl.exe
  C:\Windows\System\WCPHBCl.exe
  2⤵
  - Executes dropped EXE
  PID:4304
- C:\Windows\System\NyOpbqQ.exe
  C:\Windows\System\NyOpbqQ.exe
  2⤵
  - Executes dropped EXE
  PID:4172
- C:\Windows\System\cGLRAlQ.exe
  C:\Windows\System\cGLRAlQ.exe
  2⤵
  - Executes dropped EXE
  PID:4632
- C:\Windows\System\izOQXJX.exe
  C:\Windows\System\izOQXJX.exe
  2⤵
  - Executes dropped EXE
  PID:2888
- C:\Windows\System\ztLIwiY.exe
  C:\Windows\System\ztLIwiY.exe
  2⤵
  - Executes dropped EXE
  PID:4100
- C:\Windows\System\ZNkxItw.exe
  C:\Windows\System\ZNkxItw.exe
  2⤵
  - Executes dropped EXE
  PID:460
- C:\Windows\System\YeYzGus.exe
  C:\Windows\System\YeYzGus.exe
  2⤵
  - Executes dropped EXE
  PID:1696
- C:\Windows\System\QArVAnv.exe
  C:\Windows\System\QArVAnv.exe
  2⤵
  - Executes dropped EXE
  PID:5036
- C:\Windows\System\LALVXCl.exe
  C:\Windows\System\LALVXCl.exe
  2⤵
  - Executes dropped EXE
  PID:628
- C:\Windows\System\olNPWmU.exe
  C:\Windows\System\olNPWmU.exe
  2⤵
  - Executes dropped EXE
  PID:4200
- C:\Windows\System\HlSkWuk.exe
  C:\Windows\System\HlSkWuk.exe
  2⤵
  - Executes dropped EXE
  PID:5108
- C:\Windows\System\rqHBBVA.exe
  C:\Windows\System\rqHBBVA.exe
  2⤵
  - Executes dropped EXE
  PID:1880
- C:\Windows\System\GXZxoEe.exe
  C:\Windows\System\GXZxoEe.exe
  2⤵
  - Executes dropped EXE
  PID:4412
- C:\Windows\System\vlAtEXt.exe
  C:\Windows\System\vlAtEXt.exe
  2⤵
  - Executes dropped EXE
  PID:3992
- C:\Windows\System\svmGnbr.exe
  C:\Windows\System\svmGnbr.exe
  2⤵
  - Executes dropped EXE
  PID:2064
- C:\Windows\System\UYEXUeP.exe
  C:\Windows\System\UYEXUeP.exe
  2⤵
  - Executes dropped EXE
  PID:2792
- C:\Windows\System\ZkskzES.exe
  C:\Windows\System\ZkskzES.exe
  2⤵
  - Executes dropped EXE
  PID:1172
- C:\Windows\System\qnPwVLN.exe
  C:\Windows\System\qnPwVLN.exe
  2⤵
  - Executes dropped EXE
  PID:2740
- C:\Windows\System\tbBKnBp.exe
  C:\Windows\System\tbBKnBp.exe
  2⤵
  - Executes dropped EXE
  PID:2528
- C:\Windows\System\NbrbUQE.exe
  C:\Windows\System\NbrbUQE.exe
  2⤵
  - Executes dropped EXE
  PID:1920
- C:\Windows\System\xEzrQMT.exe
  C:\Windows\System\xEzrQMT.exe
  2⤵
  - Executes dropped EXE
  PID:1436
- C:\Windows\System\HQYcoMZ.exe
  C:\Windows\System\HQYcoMZ.exe
  2⤵
  - Executes dropped EXE
  PID:4360
- C:\Windows\System\gmNBKgL.exe
  C:\Windows\System\gmNBKgL.exe
  2⤵
  - Executes dropped EXE
  PID:1620
- C:\Windows\System\yybvSoa.exe
  C:\Windows\System\yybvSoa.exe
  2⤵
  - Executes dropped EXE
  PID:1700
- C:\Windows\System\iDFdrkq.exe
  C:\Windows\System\iDFdrkq.exe
  2⤵
  - Executes dropped EXE
  PID:4532
- C:\Windows\System\LIpPaps.exe
  C:\Windows\System\LIpPaps.exe
  2⤵
  - Executes dropped EXE
  PID:4016
- C:\Windows\System\QYXUOro.exe
  C:\Windows\System\QYXUOro.exe
  2⤵
  - Executes dropped EXE
  PID:2848
- C:\Windows\System\cwChUkS.exe
  C:\Windows\System\cwChUkS.exe
  2⤵
  - Executes dropped EXE
  PID:1012
- C:\Windows\System\QKcBvEA.exe
  C:\Windows\System\QKcBvEA.exe
  2⤵
  - Executes dropped EXE
  PID:712
- C:\Windows\System\KyqheOq.exe
  C:\Windows\System\KyqheOq.exe
  2⤵
  - Executes dropped EXE
  PID:4300
- C:\Windows\System\oEkyuvH.exe
  C:\Windows\System\oEkyuvH.exe
  2⤵
  - Executes dropped EXE
  PID:3756
- C:\Windows\System\QJWVLbG.exe
  C:\Windows\System\QJWVLbG.exe
  2⤵
  - Executes dropped EXE
  PID:4920
- C:\Windows\System\FszOAjT.exe
  C:\Windows\System\FszOAjT.exe
  2⤵
  - Executes dropped EXE
  PID:3228
- C:\Windows\System\MKKEFJH.exe
  C:\Windows\System\MKKEFJH.exe
  2⤵
  - Executes dropped EXE
  PID:4748
- C:\Windows\System\MsbFeOD.exe
  C:\Windows\System\MsbFeOD.exe
  2⤵
  - Executes dropped EXE
  PID:1476
- C:\Windows\System\upRSgCd.exe
  C:\Windows\System\upRSgCd.exe
  2⤵
  - Executes dropped EXE
  PID:3040
- C:\Windows\System\PrMyqke.exe
  C:\Windows\System\PrMyqke.exe
  2⤵
  - Executes dropped EXE
  PID:1688
- C:\Windows\System\MYxyeLw.exe
  C:\Windows\System\MYxyeLw.exe
  2⤵
  - Executes dropped EXE
  PID:3912
- C:\Windows\System\YJMjnOC.exe
  C:\Windows\System\YJMjnOC.exe
  2⤵
  - Executes dropped EXE
  PID:5020
- C:\Windows\System\iNNwwEB.exe
  C:\Windows\System\iNNwwEB.exe
  2⤵
  PID:3412
- C:\Windows\System\eewPCGt.exe
  C:\Windows\System\eewPCGt.exe
  2⤵
  PID:4012
- C:\Windows\System\BzPSlFR.exe
  C:\Windows\System\BzPSlFR.exe
  2⤵
  PID:452
- C:\Windows\System\ghGrtRG.exe
  C:\Windows\System\ghGrtRG.exe
  2⤵
  PID:1432
- C:\Windows\System\UdIvTyj.exe
  C:\Windows\System\UdIvTyj.exe
  2⤵
  PID:4812
- C:\Windows\System\WUrmaae.exe
  C:\Windows\System\WUrmaae.exe
  2⤵
  PID:4940
- C:\Windows\System\aMGZbJY.exe
  C:\Windows\System\aMGZbJY.exe
  2⤵
  PID:4600
- C:\Windows\System\enxzRQY.exe
  C:\Windows\System\enxzRQY.exe
  2⤵
  PID:4592
- C:\Windows\System\dpRcOMe.exe
  C:\Windows\System\dpRcOMe.exe
  2⤵
  PID:4372
- C:\Windows\System\dIfSijf.exe
  C:\Windows\System\dIfSijf.exe
  2⤵
  PID:3016
- C:\Windows\System\HaJikiZ.exe
  C:\Windows\System\HaJikiZ.exe
  2⤵
  PID:3500
- C:\Windows\System\OsGubxC.exe
  C:\Windows\System\OsGubxC.exe
  2⤵
  PID:4020
- C:\Windows\System\loJoQWF.exe
  C:\Windows\System\loJoQWF.exe
  2⤵
  PID:3160
- C:\Windows\System\GZSRQuS.exe
  C:\Windows\System\GZSRQuS.exe
  2⤵
  PID:4544
- C:\Windows\System\uLpbEMy.exe
  C:\Windows\System\uLpbEMy.exe
  2⤵
  PID:448
- C:\Windows\System\TAISURJ.exe
  C:\Windows\System\TAISURJ.exe
  2⤵
  PID:4416
- C:\Windows\System\muZWzxw.exe
  C:\Windows\System\muZWzxw.exe
  2⤵
  PID:4696
- C:\Windows\System\yiKfOpS.exe
  C:\Windows\System\yiKfOpS.exe
  2⤵
  PID:2796
- C:\Windows\System\ymBsabu.exe
  C:\Windows\System\ymBsabu.exe
  2⤵
  PID:4524
- C:\Windows\System\VfsBEjj.exe
  C:\Windows\System\VfsBEjj.exe
  2⤵
  PID:1804
- C:\Windows\System\kigijxY.exe
  C:\Windows\System\kigijxY.exe
  2⤵
  PID:3672
- C:\Windows\System\iuSSSFo.exe
  C:\Windows\System\iuSSSFo.exe
  2⤵
  PID:3180
- C:\Windows\System\ORazxVH.exe
  C:\Windows\System\ORazxVH.exe
  2⤵
  PID:916
- C:\Windows\System\rQznftV.exe
  C:\Windows\System\rQznftV.exe
  2⤵
  PID:2832
- C:\Windows\System\twMByPG.exe
  C:\Windows\System\twMByPG.exe
  2⤵
  PID:4832
- C:\Windows\System\rduinOt.exe
  C:\Windows\System\rduinOt.exe
  2⤵
  PID:2316
- C:\Windows\System\rfcZrJo.exe
  C:\Windows\System\rfcZrJo.exe
  2⤵
  PID:4420
- C:\Windows\System\UmxhghB.exe
  C:\Windows\System\UmxhghB.exe
  2⤵
  PID:4944
- C:\Windows\System\sawPchW.exe
  C:\Windows\System\sawPchW.exe
  2⤵
  PID:744
- C:\Windows\System\evtFbbj.exe
  C:\Windows\System\evtFbbj.exe
  2⤵
  PID:3460
- C:\Windows\System\CuBiPTA.exe
  C:\Windows\System\CuBiPTA.exe
  2⤵
  PID:2584
- C:\Windows\System\arIbSoq.exe
  C:\Windows\System\arIbSoq.exe
  2⤵
  PID:2628
- C:\Windows\System\rVrZVaM.exe
  C:\Windows\System\rVrZVaM.exe
  2⤵
  PID:4676
- C:\Windows\System\VueCVib.exe
  C:\Windows\System\VueCVib.exe
  2⤵
  PID:3688
- C:\Windows\System\FKKXksz.exe
  C:\Windows\System\FKKXksz.exe
  2⤵
  PID:5144
- C:\Windows\System\AzCNAFs.exe
  C:\Windows\System\AzCNAFs.exe
  2⤵
  PID:5180
- C:\Windows\System\MwFxMpD.exe
  C:\Windows\System\MwFxMpD.exe
  2⤵
  PID:5216
- C:\Windows\System\RkBxwZn.exe
  C:\Windows\System\RkBxwZn.exe
  2⤵
  PID:5240
- C:\Windows\System\HFvIpUn.exe
  C:\Windows\System\HFvIpUn.exe
  2⤵
  PID:5264
- C:\Windows\System\aCGflqx.exe
  C:\Windows\System\aCGflqx.exe
  2⤵
  PID:5292
- C:\Windows\System\XywgoIs.exe
  C:\Windows\System\XywgoIs.exe
  2⤵
  PID:5308
- C:\Windows\System\qpjtCcX.exe
  C:\Windows\System\qpjtCcX.exe
  2⤵
  PID:5348
- C:\Windows\System\oRekOYi.exe
  C:\Windows\System\oRekOYi.exe
  2⤵
  PID:5376
- C:\Windows\System\MCeUaeG.exe
  C:\Windows\System\MCeUaeG.exe
  2⤵
  PID:5396
- C:\Windows\System\WuNChnQ.exe
  C:\Windows\System\WuNChnQ.exe
  2⤵
  PID:5420
- C:\Windows\System\XxenqaT.exe
  C:\Windows\System\XxenqaT.exe
  2⤵
  PID:5456
- C:\Windows\System\CfdPmil.exe
  C:\Windows\System\CfdPmil.exe
  2⤵
  PID:5488
- C:\Windows\System\kJUFQcR.exe
  C:\Windows\System\kJUFQcR.exe
  2⤵
  PID:5516
- C:\Windows\System\siderdA.exe
  C:\Windows\System\siderdA.exe
  2⤵
  PID:5540
- C:\Windows\System\UzfMuwm.exe
  C:\Windows\System\UzfMuwm.exe
  2⤵
  PID:5564
- C:\Windows\System\XYXPTSQ.exe
  C:\Windows\System\XYXPTSQ.exe
  2⤵
  PID:5600
- C:\Windows\System\rjfzgeA.exe
  C:\Windows\System\rjfzgeA.exe
  2⤵
  PID:5616
- C:\Windows\System\oLsyPjj.exe
  C:\Windows\System\oLsyPjj.exe
  2⤵
  PID:5656
- C:\Windows\System\WSuMDqD.exe
  C:\Windows\System\WSuMDqD.exe
  2⤵
  PID:5680
- C:\Windows\System\brEBQTv.exe
  C:\Windows\System\brEBQTv.exe
  2⤵
  PID:5704
- C:\Windows\System\mlGxFTg.exe
  C:\Windows\System\mlGxFTg.exe
  2⤵
  PID:5732
- C:\Windows\System\pslfQUK.exe
  C:\Windows\System\pslfQUK.exe
  2⤵
  PID:5748
- C:\Windows\System\UbtHREA.exe
  C:\Windows\System\UbtHREA.exe
  2⤵
  PID:5784
- C:\Windows\System\fDgkkZz.exe
  C:\Windows\System\fDgkkZz.exe
  2⤵
  PID:5812
- C:\Windows\System\ADckLvM.exe
  C:\Windows\System\ADckLvM.exe
  2⤵
  PID:5840
- C:\Windows\System\LaVUCRH.exe
  C:\Windows\System\LaVUCRH.exe
  2⤵
  PID:5872
- C:\Windows\System\iBNmqtN.exe
  C:\Windows\System\iBNmqtN.exe
  2⤵
  PID:5900
- C:\Windows\System\bffwprl.exe
  C:\Windows\System\bffwprl.exe
  2⤵
  PID:5928
- C:\Windows\System\XNDMZpZ.exe
  C:\Windows\System\XNDMZpZ.exe
  2⤵
  PID:5956
- C:\Windows\System\jnqYQeI.exe
  C:\Windows\System\jnqYQeI.exe
  2⤵
  PID:6020
- C:\Windows\System\PCuVMBS.exe
  C:\Windows\System\PCuVMBS.exe
  2⤵
  PID:6048
- C:\Windows\System\JVHVcTr.exe
  C:\Windows\System\JVHVcTr.exe
  2⤵
  PID:6068
- C:\Windows\System\jDXNTWE.exe
  C:\Windows\System\jDXNTWE.exe
  2⤵
  PID:6096
- C:\Windows\System\Kzmkoeg.exe
  C:\Windows\System\Kzmkoeg.exe
  2⤵
  PID:6124
- C:\Windows\System\rWAORoZ.exe
  C:\Windows\System\rWAORoZ.exe
  2⤵
  PID:2916
- C:\Windows\System\GvcoyHS.exe
  C:\Windows\System\GvcoyHS.exe
  2⤵
  PID:5164
- C:\Windows\System\PxyHvpx.exe
  C:\Windows\System\PxyHvpx.exe
  2⤵
  PID:5232
- C:\Windows\System\duIRnqD.exe
  C:\Windows\System\duIRnqD.exe
  2⤵
  PID:5276
- C:\Windows\System\TxmvrUu.exe
  C:\Windows\System\TxmvrUu.exe
  2⤵
  PID:5356
- C:\Windows\System\LZrrzlz.exe
  C:\Windows\System\LZrrzlz.exe
  2⤵
  PID:5432
- C:\Windows\System\dVesYLj.exe
  C:\Windows\System\dVesYLj.exe
  2⤵
  PID:5480
- C:\Windows\System\xJBGdrE.exe
  C:\Windows\System\xJBGdrE.exe
  2⤵
  PID:5532
- C:\Windows\System\MNrlvki.exe
  C:\Windows\System\MNrlvki.exe
  2⤵
  PID:5556
- C:\Windows\System\LQfMSEg.exe
  C:\Windows\System\LQfMSEg.exe
  2⤵
  PID:5636
- C:\Windows\System\UUyCRKr.exe
  C:\Windows\System\UUyCRKr.exe
  2⤵
  PID:5688
- C:\Windows\System\nHwLccE.exe
  C:\Windows\System\nHwLccE.exe
  2⤵
  PID:5772
- C:\Windows\System\woSEYpx.exe
  C:\Windows\System\woSEYpx.exe
  2⤵
  PID:5832
- C:\Windows\System\yVQnrON.exe
  C:\Windows\System\yVQnrON.exe
  2⤵
  PID:5916
- C:\Windows\System\uzJBpws.exe
  C:\Windows\System\uzJBpws.exe
  2⤵
  PID:5936
- C:\Windows\System\mBGMgFd.exe
  C:\Windows\System\mBGMgFd.exe
  2⤵
  PID:6032
- C:\Windows\System\brYvWiZ.exe
  C:\Windows\System\brYvWiZ.exe
  2⤵
  PID:2084
- C:\Windows\System\kEunNSs.exe
  C:\Windows\System\kEunNSs.exe
  2⤵
  PID:6112
- C:\Windows\System\UPOhTXg.exe
  C:\Windows\System\UPOhTXg.exe
  2⤵
  PID:5228
- C:\Windows\System\SqdeZMx.exe
  C:\Windows\System\SqdeZMx.exe
  2⤵
  PID:5340
- C:\Windows\System\zpknmVv.exe
  C:\Windows\System\zpknmVv.exe
  2⤵
  PID:5584
- C:\Windows\System\URlZFhh.exe
  C:\Windows\System\URlZFhh.exe
  2⤵
  PID:5712
- C:\Windows\System\cEUbnuR.exe
  C:\Windows\System\cEUbnuR.exe
  2⤵
  PID:5744
- C:\Windows\System\gBFbbvr.exe
  C:\Windows\System\gBFbbvr.exe
  2⤵
  PID:5892
- C:\Windows\System\tAZVvUS.exe
  C:\Windows\System\tAZVvUS.exe
  2⤵
  PID:5964
- C:\Windows\System\HmEexRg.exe
  C:\Windows\System\HmEexRg.exe
  2⤵
  PID:5404
- C:\Windows\System\DcPprVp.exe
  C:\Windows\System\DcPprVp.exe
  2⤵
  PID:5156
- C:\Windows\System\igpLEiF.exe
  C:\Windows\System\igpLEiF.exe
  2⤵
  PID:5608
- C:\Windows\System\hIKTSwe.exe
  C:\Windows\System\hIKTSwe.exe
  2⤵
  PID:5856
- C:\Windows\System\tWAovJM.exe
  C:\Windows\System\tWAovJM.exe
  2⤵
  PID:5388
- C:\Windows\System\tiFZSYU.exe
  C:\Windows\System\tiFZSYU.exe
  2⤵
  PID:6152
- C:\Windows\System\rtOyvbc.exe
  C:\Windows\System\rtOyvbc.exe
  2⤵
  PID:6188
- C:\Windows\System\cSHXapk.exe
  C:\Windows\System\cSHXapk.exe
  2⤵
  PID:6220
- C:\Windows\System\IzIOVyF.exe
  C:\Windows\System\IzIOVyF.exe
  2⤵
  PID:6240
- C:\Windows\System\SChCrKs.exe
  C:\Windows\System\SChCrKs.exe
  2⤵
  PID:6268
- C:\Windows\System\HOONeek.exe
  C:\Windows\System\HOONeek.exe
  2⤵
  PID:6292
- C:\Windows\System\ZWCXJaH.exe
  C:\Windows\System\ZWCXJaH.exe
  2⤵
  PID:6324
- C:\Windows\System\AkQafEd.exe
  C:\Windows\System\AkQafEd.exe
  2⤵
  PID:6344
- C:\Windows\System\obGFoUT.exe
  C:\Windows\System\obGFoUT.exe
  2⤵
  PID:6368
- C:\Windows\System\lteDePR.exe
  C:\Windows\System\lteDePR.exe
  2⤵
  PID:6388
- C:\Windows\System\WUKGuIm.exe
  C:\Windows\System\WUKGuIm.exe
  2⤵
  PID:6420
- C:\Windows\System\WNjhLJN.exe
  C:\Windows\System\WNjhLJN.exe
  2⤵
  PID:6448
- C:\Windows\System\WlaeLqo.exe
  C:\Windows\System\WlaeLqo.exe
  2⤵
  PID:6480
- C:\Windows\System\stBtGGf.exe
  C:\Windows\System\stBtGGf.exe
  2⤵
  PID:6512
- C:\Windows\System\prsPlfI.exe
  C:\Windows\System\prsPlfI.exe
  2⤵
  PID:6540
- C:\Windows\System\GZQpVxe.exe
  C:\Windows\System\GZQpVxe.exe
  2⤵
  PID:6564
- C:\Windows\System\qkZIcGk.exe
  C:\Windows\System\qkZIcGk.exe
  2⤵
  PID:6596
- C:\Windows\System\PCeQDcZ.exe
  C:\Windows\System\PCeQDcZ.exe
  2⤵
  PID:6624
- C:\Windows\System\NYByKoS.exe
  C:\Windows\System\NYByKoS.exe
  2⤵
  PID:6648
- C:\Windows\System\VxbUiTI.exe
  C:\Windows\System\VxbUiTI.exe
  2⤵
  PID:6684
- C:\Windows\System\KmvKAMW.exe
  C:\Windows\System\KmvKAMW.exe
  2⤵
  PID:6712
- C:\Windows\System\iBNooBp.exe
  C:\Windows\System\iBNooBp.exe
  2⤵
  PID:6744
- C:\Windows\System\lXzAmgf.exe
  C:\Windows\System\lXzAmgf.exe
  2⤵
  PID:6784
- C:\Windows\System\dNBtHKN.exe
  C:\Windows\System\dNBtHKN.exe
  2⤵
  PID:6820
- C:\Windows\System\dcuWzDU.exe
  C:\Windows\System\dcuWzDU.exe
  2⤵
  PID:6856
- C:\Windows\System\rvsOVGf.exe
  C:\Windows\System\rvsOVGf.exe
  2⤵
  PID:6884
- C:\Windows\System\mAHCEmb.exe
  C:\Windows\System\mAHCEmb.exe
  2⤵
  PID:6916
- C:\Windows\System\XoiWagT.exe
  C:\Windows\System\XoiWagT.exe
  2⤵
  PID:6944
- C:\Windows\System\RiLuwvC.exe
  C:\Windows\System\RiLuwvC.exe
  2⤵
  PID:6976
- C:\Windows\System\kvlFLzu.exe
  C:\Windows\System\kvlFLzu.exe
  2⤵
  PID:7004
- C:\Windows\System\jizVCyA.exe
  C:\Windows\System\jizVCyA.exe
  2⤵
  PID:7040
- C:\Windows\System\REZFfGz.exe
  C:\Windows\System\REZFfGz.exe
  2⤵
  PID:7068
- C:\Windows\System\rEDXYEp.exe
  C:\Windows\System\rEDXYEp.exe
  2⤵
  PID:7096
- C:\Windows\System\DgrledR.exe
  C:\Windows\System\DgrledR.exe
  2⤵
  PID:7120
- C:\Windows\System\ACjGDeY.exe
  C:\Windows\System\ACjGDeY.exe
  2⤵
  PID:7140
- C:\Windows\System\HoHOnwo.exe
  C:\Windows\System\HoHOnwo.exe
  2⤵
  PID:7160
- C:\Windows\System\qKbkiNn.exe
  C:\Windows\System\qKbkiNn.exe
  2⤵
  PID:5948
- C:\Windows\System\pmYgmEb.exe
  C:\Windows\System\pmYgmEb.exe
  2⤵
  PID:6176
- C:\Windows\System\oRRiYTC.exe
  C:\Windows\System\oRRiYTC.exe
  2⤵
  PID:6232
- C:\Windows\System\lDdRPuO.exe
  C:\Windows\System\lDdRPuO.exe
  2⤵
  PID:6304
- C:\Windows\System\hBxYLUY.exe
  C:\Windows\System\hBxYLUY.exe
  2⤵
  PID:6336
- C:\Windows\System\EOwZLeY.exe
  C:\Windows\System\EOwZLeY.exe
  2⤵
  PID:6460
- C:\Windows\System\rrubRul.exe
  C:\Windows\System\rrubRul.exe
  2⤵
  PID:6416
- C:\Windows\System\lmSTSUR.exe
  C:\Windows\System\lmSTSUR.exe
  2⤵
  PID:6464
- C:\Windows\System\YoIDSmH.exe
  C:\Windows\System\YoIDSmH.exe
  2⤵
  PID:6636
- C:\Windows\System\RPEPXYp.exe
  C:\Windows\System\RPEPXYp.exe
  2⤵
  PID:6704
- C:\Windows\System\MaFqEKS.exe
  C:\Windows\System\MaFqEKS.exe
  2⤵
  PID:6660
- C:\Windows\System\QvmXFpd.exe
  C:\Windows\System\QvmXFpd.exe
  2⤵
  PID:6728
- C:\Windows\System\UNgcMuK.exe
  C:\Windows\System\UNgcMuK.exe
  2⤵
  PID:6872
- C:\Windows\System\agAjqoc.exe
  C:\Windows\System\agAjqoc.exe
  2⤵
  PID:6900
- C:\Windows\System\QWEqseW.exe
  C:\Windows\System\QWEqseW.exe
  2⤵
  PID:7000
- C:\Windows\System\WekRjLN.exe
  C:\Windows\System\WekRjLN.exe
  2⤵
  PID:7112
- C:\Windows\System\kbQsisV.exe
  C:\Windows\System\kbQsisV.exe
  2⤵
  PID:7152
- C:\Windows\System\IWwfWlZ.exe
  C:\Windows\System\IWwfWlZ.exe
  2⤵
  PID:6148
- C:\Windows\System\aFuxaVL.exe
  C:\Windows\System\aFuxaVL.exe
  2⤵
  PID:6276
- C:\Windows\System\DjmHPQT.exe
  C:\Windows\System\DjmHPQT.exe
  2⤵
  PID:6644
- C:\Windows\System\dMBwomh.exe
  C:\Windows\System\dMBwomh.exe
  2⤵
  PID:6352
- C:\Windows\System\noqoNvy.exe
  C:\Windows\System\noqoNvy.exe
  2⤵
  PID:6800
- C:\Windows\System\SDClvNQ.exe
  C:\Windows\System\SDClvNQ.exe
  2⤵
  PID:6760
- C:\Windows\System\lIVFyTL.exe
  C:\Windows\System\lIVFyTL.exe
  2⤵
  PID:7052
- C:\Windows\System\bwOnpcK.exe
  C:\Windows\System\bwOnpcK.exe
  2⤵
  PID:6172
- C:\Windows\System\WxRBFNJ.exe
  C:\Windows\System\WxRBFNJ.exe
  2⤵
  PID:6780
- C:\Windows\System\oGRVdYf.exe
  C:\Windows\System\oGRVdYf.exe
  2⤵
  PID:6696
- C:\Windows\System\orAWaPj.exe
  C:\Windows\System\orAWaPj.exe
  2⤵
  PID:6376
- C:\Windows\System\rsBImwH.exe
  C:\Windows\System\rsBImwH.exe
  2⤵
  PID:7176
- C:\Windows\System\NrHYUjX.exe
  C:\Windows\System\NrHYUjX.exe
  2⤵
  PID:7200
- C:\Windows\System\DnignxJ.exe
  C:\Windows\System\DnignxJ.exe
  2⤵
  PID:7232
- C:\Windows\System\RzGIrbW.exe
  C:\Windows\System\RzGIrbW.exe
  2⤵
  PID:7264
- C:\Windows\System\QKTBmph.exe
  C:\Windows\System\QKTBmph.exe
  2⤵
  PID:7296
- C:\Windows\System\YlJoHMA.exe
  C:\Windows\System\YlJoHMA.exe
  2⤵
  PID:7320
- C:\Windows\System\gHdbZGg.exe
  C:\Windows\System\gHdbZGg.exe
  2⤵
  PID:7348
- C:\Windows\System\QzmBtHx.exe
  C:\Windows\System\QzmBtHx.exe
  2⤵
  PID:7368
- C:\Windows\System\whvtVtI.exe
  C:\Windows\System\whvtVtI.exe
  2⤵
  PID:7396
- C:\Windows\System\yUbcgZt.exe
  C:\Windows\System\yUbcgZt.exe
  2⤵
  PID:7424
- C:\Windows\System\hJAsJmK.exe
  C:\Windows\System\hJAsJmK.exe
  2⤵
  PID:7456
- C:\Windows\System\SsbGCzc.exe
  C:\Windows\System\SsbGCzc.exe
  2⤵
  PID:7488
- C:\Windows\System\HxIQnuY.exe
  C:\Windows\System\HxIQnuY.exe
  2⤵
  PID:7516
- C:\Windows\System\sRmaJwJ.exe
  C:\Windows\System\sRmaJwJ.exe
  2⤵
  PID:7552
- C:\Windows\System\hjZIAvD.exe
  C:\Windows\System\hjZIAvD.exe
  2⤵
  PID:7580
- C:\Windows\System\XBYkvKl.exe
  C:\Windows\System\XBYkvKl.exe
  2⤵
  PID:7608
- C:\Windows\System\uTZRmxb.exe
  C:\Windows\System\uTZRmxb.exe
  2⤵
  PID:7632
- C:\Windows\System\RNYcrcV.exe
  C:\Windows\System\RNYcrcV.exe
  2⤵
  PID:7668
- C:\Windows\System\xAuPYvx.exe
  C:\Windows\System\xAuPYvx.exe
  2⤵
  PID:7696
- C:\Windows\System\YucaOAY.exe
  C:\Windows\System\YucaOAY.exe
  2⤵
  PID:7728
- C:\Windows\System\iMvgYnh.exe
  C:\Windows\System\iMvgYnh.exe
  2⤵
  PID:7764
- C:\Windows\System\ocuwPeM.exe
  C:\Windows\System\ocuwPeM.exe
  2⤵
  PID:7796
- C:\Windows\System\tHBHkhr.exe
  C:\Windows\System\tHBHkhr.exe
  2⤵
  PID:7828
- C:\Windows\System\OXCvUaQ.exe
  C:\Windows\System\OXCvUaQ.exe
  2⤵
  PID:7852
- C:\Windows\System\qAZDNgX.exe
  C:\Windows\System\qAZDNgX.exe
  2⤵
  PID:7872
- C:\Windows\System\VMPSYFQ.exe
  C:\Windows\System\VMPSYFQ.exe
  2⤵
  PID:7900
- C:\Windows\System\fSEhpjR.exe
  C:\Windows\System\fSEhpjR.exe
  2⤵
  PID:7928
- C:\Windows\System\PDXvuYY.exe
  C:\Windows\System\PDXvuYY.exe
  2⤵
  PID:7960
- C:\Windows\System\eTxNobb.exe
  C:\Windows\System\eTxNobb.exe
  2⤵
  PID:7992
- C:\Windows\System\idFowMk.exe
  C:\Windows\System\idFowMk.exe
  2⤵
  PID:8020
- C:\Windows\System\hrAuUlU.exe
  C:\Windows\System\hrAuUlU.exe
  2⤵
  PID:8052
- C:\Windows\System\vewmuQc.exe
  C:\Windows\System\vewmuQc.exe
  2⤵
  PID:8088
- C:\Windows\System\PHcojRX.exe
  C:\Windows\System\PHcojRX.exe
  2⤵
  PID:8124
- C:\Windows\System\OCzUAiJ.exe
  C:\Windows\System\OCzUAiJ.exe
  2⤵
  PID:8148
- C:\Windows\System\GDfZjxO.exe
  C:\Windows\System\GDfZjxO.exe
  2⤵
  PID:8184
- C:\Windows\System\FLQLaqJ.exe
  C:\Windows\System\FLQLaqJ.exe
  2⤵
  PID:6508
- C:\Windows\System\kcziVbj.exe
  C:\Windows\System\kcziVbj.exe
  2⤵
  PID:7292
- C:\Windows\System\SDGTkjz.exe
  C:\Windows\System\SDGTkjz.exe
  2⤵
  PID:7252
- C:\Windows\System\sqLufJo.exe
  C:\Windows\System\sqLufJo.exe
  2⤵
  PID:7360
- C:\Windows\System\VmXsjhP.exe
  C:\Windows\System\VmXsjhP.exe
  2⤵
  PID:7408
- C:\Windows\System\JHNQpas.exe
  C:\Windows\System\JHNQpas.exe
  2⤵
  PID:7420
- C:\Windows\System\dbLdZYu.exe
  C:\Windows\System\dbLdZYu.exe
  2⤵
  PID:7568
- C:\Windows\System\HXrtWUg.exe
  C:\Windows\System\HXrtWUg.exe
  2⤵
  PID:7628
- C:\Windows\System\kriuFBW.exe
  C:\Windows\System\kriuFBW.exe
  2⤵
  PID:7620
- C:\Windows\System\nQKexLg.exe
  C:\Windows\System\nQKexLg.exe
  2⤵
  PID:7692
- C:\Windows\System\bYiiQnx.exe
  C:\Windows\System\bYiiQnx.exe
  2⤵
  PID:7780
- C:\Windows\System\oIUZXek.exe
  C:\Windows\System\oIUZXek.exe
  2⤵
  PID:7940
- C:\Windows\System\QClQshH.exe
  C:\Windows\System\QClQshH.exe
  2⤵
  PID:7952
- C:\Windows\System\SyUDujz.exe
  C:\Windows\System\SyUDujz.exe
  2⤵
  PID:7988
- C:\Windows\System\pvdzRIJ.exe
  C:\Windows\System\pvdzRIJ.exe
  2⤵
  PID:8036
- C:\Windows\System\PrKVdei.exe
  C:\Windows\System\PrKVdei.exe
  2⤵
  PID:8140
- C:\Windows\System\lVsbhLV.exe
  C:\Windows\System\lVsbhLV.exe
  2⤵
  PID:8168
- C:\Windows\System\buzlDuT.exe
  C:\Windows\System\buzlDuT.exe
  2⤵
  PID:7228
- C:\Windows\System\qUECOfz.exe
  C:\Windows\System\qUECOfz.exe
  2⤵
  PID:7472
- C:\Windows\System\PBLQyEg.exe
  C:\Windows\System\PBLQyEg.exe
  2⤵
  PID:7564
- C:\Windows\System\uhnlllk.exe
  C:\Windows\System\uhnlllk.exe
  2⤵
  PID:7792
- C:\Windows\System\XbbxDPk.exe
  C:\Windows\System\XbbxDPk.exe
  2⤵
  PID:7864
- C:\Windows\System\tHHDVpW.exe
  C:\Windows\System\tHHDVpW.exe
  2⤵
  PID:8028
- C:\Windows\System\KvNftaO.exe
  C:\Windows\System\KvNftaO.exe
  2⤵
  PID:8132
- C:\Windows\System\QEToNCm.exe
  C:\Windows\System\QEToNCm.exe
  2⤵
  PID:7240
- C:\Windows\System\thRrjxB.exe
  C:\Windows\System\thRrjxB.exe
  2⤵
  PID:7604
- C:\Windows\System\CwGZulN.exe
  C:\Windows\System\CwGZulN.exe
  2⤵
  PID:8144
- C:\Windows\System\iEoFoSa.exe
  C:\Windows\System\iEoFoSa.exe
  2⤵
  PID:8204
- C:\Windows\System\tbVaSgf.exe
  C:\Windows\System\tbVaSgf.exe
  2⤵
  PID:8228
- C:\Windows\System\WUHOFrD.exe
  C:\Windows\System\WUHOFrD.exe
  2⤵
  PID:8256
- C:\Windows\System\SlzQodD.exe
  C:\Windows\System\SlzQodD.exe
  2⤵
  PID:8284
- C:\Windows\System\gynFPWh.exe
  C:\Windows\System\gynFPWh.exe
  2⤵
  PID:8312
- C:\Windows\System\TNqQoJP.exe
  C:\Windows\System\TNqQoJP.exe
  2⤵
  PID:8344
- C:\Windows\System\yhuqyaA.exe
  C:\Windows\System\yhuqyaA.exe
  2⤵
  PID:8368
- C:\Windows\System\dRVquzY.exe
  C:\Windows\System\dRVquzY.exe
  2⤵
  PID:8396
- C:\Windows\System\ccQTJIP.exe
  C:\Windows\System\ccQTJIP.exe
  2⤵
  PID:8424
- C:\Windows\System\piIYEPD.exe
  C:\Windows\System\piIYEPD.exe
  2⤵
  PID:8456
- C:\Windows\System\FSapUHQ.exe
  C:\Windows\System\FSapUHQ.exe
  2⤵
  PID:8476
- C:\Windows\System\PvcfbWl.exe
  C:\Windows\System\PvcfbWl.exe
  2⤵
  PID:8504
- C:\Windows\System\VJPajIU.exe
  C:\Windows\System\VJPajIU.exe
  2⤵
  PID:8536
- C:\Windows\System\beQeMmf.exe
  C:\Windows\System\beQeMmf.exe
  2⤵
  PID:8560
- C:\Windows\System\jhtLzxO.exe
  C:\Windows\System\jhtLzxO.exe
  2⤵
  PID:8588
- C:\Windows\System\cgYfiZX.exe
  C:\Windows\System\cgYfiZX.exe
  2⤵
  PID:8616
- C:\Windows\System\IEStZec.exe
  C:\Windows\System\IEStZec.exe
  2⤵
  PID:8636
- C:\Windows\System\zyoHHtF.exe
  C:\Windows\System\zyoHHtF.exe
  2⤵
  PID:8668
- C:\Windows\System\PFqBEEO.exe
  C:\Windows\System\PFqBEEO.exe
  2⤵
  PID:8688
- C:\Windows\System\mwRUYuj.exe
  C:\Windows\System\mwRUYuj.exe
  2⤵
  PID:8716
- C:\Windows\System\FbMEMRn.exe
  C:\Windows\System\FbMEMRn.exe
  2⤵
  PID:8732
- C:\Windows\System\jkCYUZQ.exe
  C:\Windows\System\jkCYUZQ.exe
  2⤵
  PID:8764
- C:\Windows\System\waPnNUG.exe
  C:\Windows\System\waPnNUG.exe
  2⤵
  PID:8788
- C:\Windows\System\WZBvInb.exe
  C:\Windows\System\WZBvInb.exe
  2⤵
  PID:8816
- C:\Windows\System\nfWyLBB.exe
  C:\Windows\System\nfWyLBB.exe
  2⤵
  PID:8844
- C:\Windows\System\WxuaoQl.exe
  C:\Windows\System\WxuaoQl.exe
  2⤵
  PID:8868
- C:\Windows\System\klybuBm.exe
  C:\Windows\System\klybuBm.exe
  2⤵
  PID:8896
- C:\Windows\System\CVqrUaH.exe
  C:\Windows\System\CVqrUaH.exe
  2⤵
  PID:8928
- C:\Windows\System\oaOXsNH.exe
  C:\Windows\System\oaOXsNH.exe
  2⤵
  PID:8960
- C:\Windows\System\IwOXRJh.exe
  C:\Windows\System\IwOXRJh.exe
  2⤵
  PID:8992
- C:\Windows\System\SwMJVNz.exe
  C:\Windows\System\SwMJVNz.exe
  2⤵
  PID:9012
- C:\Windows\System\RpTSDqG.exe
  C:\Windows\System\RpTSDqG.exe
  2⤵
  PID:9040
- C:\Windows\System\GnIUUTa.exe
  C:\Windows\System\GnIUUTa.exe
  2⤵
  PID:9064
- C:\Windows\System\LJSgmYT.exe
  C:\Windows\System\LJSgmYT.exe
  2⤵
  PID:9092
- C:\Windows\System\ggagJSH.exe
  C:\Windows\System\ggagJSH.exe
  2⤵
  PID:9116
- C:\Windows\System\NgLYkSe.exe
  C:\Windows\System\NgLYkSe.exe
  2⤵
  PID:9140
- C:\Windows\System\wXUTOnU.exe
  C:\Windows\System\wXUTOnU.exe
  2⤵
  PID:9180
- C:\Windows\System\IJvHJUK.exe
  C:\Windows\System\IJvHJUK.exe
  2⤵
  PID:9204
- C:\Windows\System\NGLplXB.exe
  C:\Windows\System\NGLplXB.exe
  2⤵
  PID:8200
- C:\Windows\System\onKlNNa.exe
  C:\Windows\System\onKlNNa.exe
  2⤵
  PID:8136
- C:\Windows\System\qbCvJYD.exe
  C:\Windows\System\qbCvJYD.exe
  2⤵
  PID:8252
- C:\Windows\System\gNARMfW.exe
  C:\Windows\System\gNARMfW.exe
  2⤵
  PID:8272
- C:\Windows\System\bHaXqYU.exe
  C:\Windows\System\bHaXqYU.exe
  2⤵
  PID:8388
- C:\Windows\System\FkZysoO.exe
  C:\Windows\System\FkZysoO.exe
  2⤵
  PID:8448
- C:\Windows\System\wmhWlqj.exe
  C:\Windows\System\wmhWlqj.exe
  2⤵
  PID:8484
- C:\Windows\System\bdBbaZv.exe
  C:\Windows\System\bdBbaZv.exe
  2⤵
  PID:8600
- C:\Windows\System\QUPFvbr.exe
  C:\Windows\System\QUPFvbr.exe
  2⤵
  PID:8648
- C:\Windows\System\KEFshHI.exe
  C:\Windows\System\KEFshHI.exe
  2⤵
  PID:8748
- C:\Windows\System\RSaFsgA.exe
  C:\Windows\System\RSaFsgA.exe
  2⤵
  PID:8828
- C:\Windows\System\PBzOnDv.exe
  C:\Windows\System\PBzOnDv.exe
  2⤵
  PID:8784
- C:\Windows\System\JkytHxo.exe
  C:\Windows\System\JkytHxo.exe
  2⤵
  PID:8808
- C:\Windows\System\XSvsYLc.exe
  C:\Windows\System\XSvsYLc.exe
  2⤵
  PID:8988
- C:\Windows\System\dfJfNnG.exe
  C:\Windows\System\dfJfNnG.exe
  2⤵
  PID:9080
- C:\Windows\System\dzdkdQJ.exe
  C:\Windows\System\dzdkdQJ.exe
  2⤵
  PID:9024
- C:\Windows\System\oCtGQHH.exe
  C:\Windows\System\oCtGQHH.exe
  2⤵
  PID:9132
- C:\Windows\System\dwuxIoK.exe
  C:\Windows\System\dwuxIoK.exe
  2⤵
  PID:9200
- C:\Windows\System\HltBLZT.exe
  C:\Windows\System\HltBLZT.exe
  2⤵
  PID:8380
- C:\Windows\System\ibbRVrm.exe
  C:\Windows\System\ibbRVrm.exe
  2⤵
  PID:8308
- C:\Windows\System\ZrHtxcT.exe
  C:\Windows\System\ZrHtxcT.exe
  2⤵
  PID:8548
- C:\Windows\System\SmrGpJY.exe
  C:\Windows\System\SmrGpJY.exe
  2⤵
  PID:8404
- C:\Windows\System\gOiZODo.exe
  C:\Windows\System\gOiZODo.exe
  2⤵
  PID:9108
- C:\Windows\System\kralTlg.exe
  C:\Windows\System\kralTlg.exe
  2⤵
  PID:8864
- C:\Windows\System\FPvASMW.exe
  C:\Windows\System\FPvASMW.exe
  2⤵
  PID:8332
- C:\Windows\System\XtNNNgE.exe
  C:\Windows\System\XtNNNgE.exe
  2⤵
  PID:7260
- C:\Windows\System\GbadwzG.exe
  C:\Windows\System\GbadwzG.exe
  2⤵
  PID:8336
- C:\Windows\System\lsVfDjV.exe
  C:\Windows\System\lsVfDjV.exe
  2⤵
  PID:9220
- C:\Windows\System\RCWYart.exe
  C:\Windows\System\RCWYart.exe
  2⤵
  PID:9244
- C:\Windows\System\KbDcupJ.exe
  C:\Windows\System\KbDcupJ.exe
  2⤵
  PID:9276
- C:\Windows\System\YnyZhCl.exe
  C:\Windows\System\YnyZhCl.exe
  2⤵
  PID:9300
- C:\Windows\System\KaIQAvM.exe
  C:\Windows\System\KaIQAvM.exe
  2⤵
  PID:9336
- C:\Windows\System\pNAzmph.exe
  C:\Windows\System\pNAzmph.exe
  2⤵
  PID:9372
- C:\Windows\System\DIskwBz.exe
  C:\Windows\System\DIskwBz.exe
  2⤵
  PID:9400
- C:\Windows\System\cxOcKkL.exe
  C:\Windows\System\cxOcKkL.exe
  2⤵
  PID:9432
- C:\Windows\System\GhpqDlC.exe
  C:\Windows\System\GhpqDlC.exe
  2⤵
  PID:9452
- C:\Windows\System\iRqDihU.exe
  C:\Windows\System\iRqDihU.exe
  2⤵
  PID:9476
- C:\Windows\System\OmUSWhn.exe
  C:\Windows\System\OmUSWhn.exe
  2⤵
  PID:9500
- C:\Windows\System\ieEmzOn.exe
  C:\Windows\System\ieEmzOn.exe
  2⤵
  PID:9532
- C:\Windows\System\BOPBhMl.exe
  C:\Windows\System\BOPBhMl.exe
  2⤵
  PID:9560
- C:\Windows\System\OljPsxm.exe
  C:\Windows\System\OljPsxm.exe
  2⤵
  PID:9596
- C:\Windows\System\aJBmVrh.exe
  C:\Windows\System\aJBmVrh.exe
  2⤵
  PID:9624
- C:\Windows\System\hkugCXX.exe
  C:\Windows\System\hkugCXX.exe
  2⤵
  PID:9656
- C:\Windows\System\qfQUCvU.exe
  C:\Windows\System\qfQUCvU.exe
  2⤵
  PID:9696
- C:\Windows\System\MUYZkEd.exe
  C:\Windows\System\MUYZkEd.exe
  2⤵
  PID:9728
- C:\Windows\System\JfKWlJS.exe
  C:\Windows\System\JfKWlJS.exe
  2⤵
  PID:9764
- C:\Windows\System\GLkHbws.exe
  C:\Windows\System\GLkHbws.exe
  2⤵
  PID:9796
- C:\Windows\System\LdqYlOI.exe
  C:\Windows\System\LdqYlOI.exe
  2⤵
  PID:9816
- C:\Windows\System\MQbLGEt.exe
  C:\Windows\System\MQbLGEt.exe
  2⤵
  PID:9844
- C:\Windows\System\VUelzdJ.exe
  C:\Windows\System\VUelzdJ.exe
  2⤵
  PID:9860
- C:\Windows\System\srfjODt.exe
  C:\Windows\System\srfjODt.exe
  2⤵
  PID:9892
- C:\Windows\System\ITKeycM.exe
  C:\Windows\System\ITKeycM.exe
  2⤵
  PID:9912
- C:\Windows\System\vNBWJip.exe
  C:\Windows\System\vNBWJip.exe
  2⤵
  PID:9944
- C:\Windows\System\CTYtsVU.exe
  C:\Windows\System\CTYtsVU.exe
  2⤵
  PID:9988
- C:\Windows\System\uwVAGec.exe
  C:\Windows\System\uwVAGec.exe
  2⤵
  PID:10020
- C:\Windows\System\KcfOaGh.exe
  C:\Windows\System\KcfOaGh.exe
  2⤵
  PID:10052
- C:\Windows\System\ABOHyds.exe
  C:\Windows\System\ABOHyds.exe
  2⤵
  PID:10068
- C:\Windows\System\UHHTeQb.exe
  C:\Windows\System\UHHTeQb.exe
  2⤵
  PID:10100
- C:\Windows\System\mfwHomt.exe
  C:\Windows\System\mfwHomt.exe
  2⤵
  PID:10124
- C:\Windows\System\fUIjXGU.exe
  C:\Windows\System\fUIjXGU.exe
  2⤵
  PID:10156
- C:\Windows\System\pTKTGwA.exe
  C:\Windows\System\pTKTGwA.exe
  2⤵
  PID:10188
- C:\Windows\System\tfTIPnY.exe
  C:\Windows\System\tfTIPnY.exe
  2⤵
  PID:10216
- C:\Windows\System\ghAhkqG.exe
  C:\Windows\System\ghAhkqG.exe
  2⤵
  PID:9236
- C:\Windows\System\rgsKtaG.exe
  C:\Windows\System\rgsKtaG.exe
  2⤵
  PID:8744
- C:\Windows\System\oEDFJdQ.exe
  C:\Windows\System\oEDFJdQ.exe
  2⤵
  PID:9048
- C:\Windows\System\uxPqozt.exe
  C:\Windows\System\uxPqozt.exe
  2⤵
  PID:8804
- C:\Windows\System\nNXpVtJ.exe
  C:\Windows\System\nNXpVtJ.exe
  2⤵
  PID:9368
- C:\Windows\System\itlCCOO.exe
  C:\Windows\System\itlCCOO.exe
  2⤵
  PID:9440
- C:\Windows\System\UBlpliQ.exe
  C:\Windows\System\UBlpliQ.exe
  2⤵
  PID:9508
- C:\Windows\System\LqTwIZz.exe
  C:\Windows\System\LqTwIZz.exe
  2⤵
  PID:9540
- C:\Windows\System\MqZCDth.exe
  C:\Windows\System\MqZCDth.exe
  2⤵
  PID:9720
- C:\Windows\System\jCMseOv.exe
  C:\Windows\System\jCMseOv.exe
  2⤵
  PID:9676
- C:\Windows\System\EkMyiwo.exe
  C:\Windows\System\EkMyiwo.exe
  2⤵
  PID:9744
- C:\Windows\System\KqmlgSo.exe
  C:\Windows\System\KqmlgSo.exe
  2⤵
  PID:9928
- C:\Windows\System\qRcHhoy.exe
  C:\Windows\System\qRcHhoy.exe
  2⤵
  PID:9932
- C:\Windows\System\dcZSjIk.exe
  C:\Windows\System\dcZSjIk.exe
  2⤵
  PID:9996
- C:\Windows\System\VlRNKKo.exe
  C:\Windows\System\VlRNKKo.exe
  2⤵
  PID:10032
- C:\Windows\System\jpTywkQ.exe
  C:\Windows\System\jpTywkQ.exe
  2⤵
  PID:10084
- C:\Windows\System\VICQLUl.exe
  C:\Windows\System\VICQLUl.exe
  2⤵
  PID:10212
- C:\Windows\System\BbQUjxo.exe
  C:\Windows\System\BbQUjxo.exe
  2⤵
  PID:8576
- C:\Windows\System\AOONVVM.exe
  C:\Windows\System\AOONVVM.exe
  2⤵
  PID:9396
- C:\Windows\System\UCtrBqI.exe
  C:\Windows\System\UCtrBqI.exe
  2⤵
  PID:9232
- C:\Windows\System\ZSVuAAQ.exe
  C:\Windows\System\ZSVuAAQ.exe
  2⤵
  PID:9520
- C:\Windows\System\WVnmIsd.exe
  C:\Windows\System\WVnmIsd.exe
  2⤵
  PID:9804
- C:\Windows\System\gCIYeVC.exe
  C:\Windows\System\gCIYeVC.exe
  2⤵
  PID:9904
- C:\Windows\System\UafLqvQ.exe
  C:\Windows\System\UafLqvQ.exe
  2⤵
  PID:10060
- C:\Windows\System\ivolZxZ.exe
  C:\Windows\System\ivolZxZ.exe
  2⤵
  PID:9416
- C:\Windows\System\UvgeojT.exe
  C:\Windows\System\UvgeojT.exe
  2⤵
  PID:9688
- C:\Windows\System\RgBSltI.exe
  C:\Windows\System\RgBSltI.exe
  2⤵
  PID:10252
- C:\Windows\System\hAJEacc.exe
  C:\Windows\System\hAJEacc.exe
  2⤵
  PID:10280
- C:\Windows\System\lhQjoRw.exe
  C:\Windows\System\lhQjoRw.exe
  2⤵
  PID:10308
- C:\Windows\System\MFAkYQF.exe
  C:\Windows\System\MFAkYQF.exe
  2⤵
  PID:10328
- C:\Windows\System\dKHkiPg.exe
  C:\Windows\System\dKHkiPg.exe
  2⤵
  PID:10360
- C:\Windows\System\cmvBYTA.exe
  C:\Windows\System\cmvBYTA.exe
  2⤵
  PID:10380
- C:\Windows\System\KeiQqDU.exe
  C:\Windows\System\KeiQqDU.exe
  2⤵
  PID:10416
- C:\Windows\System\RYrfmNY.exe
  C:\Windows\System\RYrfmNY.exe
  2⤵
  PID:10444
- C:\Windows\System\YJBibWz.exe
  C:\Windows\System\YJBibWz.exe
  2⤵
  PID:10468
- C:\Windows\System\CNcchMC.exe
  C:\Windows\System\CNcchMC.exe
  2⤵
  PID:10488
- C:\Windows\System\aejHQPp.exe
  C:\Windows\System\aejHQPp.exe
  2⤵
  PID:10516
- C:\Windows\System\NYSkzej.exe
  C:\Windows\System\NYSkzej.exe
  2⤵
  PID:10536
- C:\Windows\System\QDIhrXs.exe
  C:\Windows\System\QDIhrXs.exe
  2⤵
  PID:10564
- C:\Windows\System\oasPSKn.exe
  C:\Windows\System\oasPSKn.exe
  2⤵
  PID:10592
- C:\Windows\System\DKLlapx.exe
  C:\Windows\System\DKLlapx.exe
  2⤵
  PID:10616
- C:\Windows\System\LkkUELf.exe
  C:\Windows\System\LkkUELf.exe
  2⤵
  PID:10636
- C:\Windows\System\LZHsCoI.exe
  C:\Windows\System\LZHsCoI.exe
  2⤵
  PID:10656
- C:\Windows\System\AcuVoBS.exe
  C:\Windows\System\AcuVoBS.exe
  2⤵
  PID:10688
- C:\Windows\System\AtawLGk.exe
  C:\Windows\System\AtawLGk.exe
  2⤵
  PID:10716
- C:\Windows\System\zAgSvGw.exe
  C:\Windows\System\zAgSvGw.exe
  2⤵
  PID:10744
- C:\Windows\System\WSJfSoL.exe
  C:\Windows\System\WSJfSoL.exe
  2⤵
  PID:10776
- C:\Windows\System\fSjFMLP.exe
  C:\Windows\System\fSjFMLP.exe
  2⤵
  PID:10808
- C:\Windows\System\weCqVmu.exe
  C:\Windows\System\weCqVmu.exe
  2⤵
  PID:10828
- C:\Windows\System\fggUBLz.exe
  C:\Windows\System\fggUBLz.exe
  2⤵
  PID:10848
- C:\Windows\System\vqTUgGR.exe
  C:\Windows\System\vqTUgGR.exe
  2⤵
  PID:10892
- C:\Windows\System\FCcvmKi.exe
  C:\Windows\System\FCcvmKi.exe
  2⤵
  PID:10908
- C:\Windows\System\gYkhWDi.exe
  C:\Windows\System\gYkhWDi.exe
  2⤵
  PID:10936
- C:\Windows\System\tZuYIul.exe
  C:\Windows\System\tZuYIul.exe
  2⤵
  PID:10968
- C:\Windows\System\WnlFgzI.exe
  C:\Windows\System\WnlFgzI.exe
  2⤵
  PID:10996
- C:\Windows\System\EsycpTb.exe
  C:\Windows\System\EsycpTb.exe
  2⤵
  PID:11016
- C:\Windows\System\gACsTsB.exe
  C:\Windows\System\gACsTsB.exe
  2⤵
  PID:11052
- C:\Windows\System\IFNMiqZ.exe
  C:\Windows\System\IFNMiqZ.exe
  2⤵
  PID:11076
- C:\Windows\System\hKXagvv.exe
  C:\Windows\System\hKXagvv.exe
  2⤵
  PID:11104
- C:\Windows\System\UMscqmU.exe
  C:\Windows\System\UMscqmU.exe
  2⤵
  PID:11132
- C:\Windows\System\EkUQAkK.exe
  C:\Windows\System\EkUQAkK.exe
  2⤵
  PID:11160
- C:\Windows\System\kDxrlmy.exe
  C:\Windows\System\kDxrlmy.exe
  2⤵
  PID:11188
- C:\Windows\System\HokxVCg.exe
  C:\Windows\System\HokxVCg.exe
  2⤵
  PID:11216
- C:\Windows\System\hJTjMaN.exe
  C:\Windows\System\hJTjMaN.exe
  2⤵
  PID:11240
- C:\Windows\System\fhldUpn.exe
  C:\Windows\System\fhldUpn.exe
  2⤵
  PID:9832
- C:\Windows\System\GVaddMH.exe
  C:\Windows\System\GVaddMH.exe
  2⤵
  PID:10248
- C:\Windows\System\aGOvOVh.exe
  C:\Windows\System\aGOvOVh.exe
  2⤵
  PID:10232
- C:\Windows\System\BJeGqWM.exe
  C:\Windows\System\BJeGqWM.exe
  2⤵
  PID:10376
- C:\Windows\System\eShgxtD.exe
  C:\Windows\System\eShgxtD.exe
  2⤵
  PID:10436
- C:\Windows\System\qEGtkoE.exe
  C:\Windows\System\qEGtkoE.exe
  2⤵
  PID:10508
- C:\Windows\System\flafvkv.exe
  C:\Windows\System\flafvkv.exe
  2⤵
  PID:10576
- C:\Windows\System\EPFgwpl.exe
  C:\Windows\System\EPFgwpl.exe
  2⤵
  PID:10632
- C:\Windows\System\epKRTvb.exe
  C:\Windows\System\epKRTvb.exe
  2⤵
  PID:10756
- C:\Windows\System\EJqcgbz.exe
  C:\Windows\System\EJqcgbz.exe
  2⤵
  PID:10816
- C:\Windows\System\aoAEyAC.exe
  C:\Windows\System\aoAEyAC.exe
  2⤵
  PID:10840
- C:\Windows\System\GmxipGj.exe
  C:\Windows\System\GmxipGj.exe
  2⤵
  PID:10824
- C:\Windows\System\VzSJDSl.exe
  C:\Windows\System\VzSJDSl.exe
  2⤵
  PID:11028
- C:\Windows\System\qPaCkmn.exe
  C:\Windows\System\qPaCkmn.exe
  2⤵
  PID:11068
- C:\Windows\System\tQvFwMY.exe
  C:\Windows\System\tQvFwMY.exe
  2⤵
  PID:11088
- C:\Windows\System\HtUVpTJ.exe
  C:\Windows\System\HtUVpTJ.exe
  2⤵
  PID:11180
- C:\Windows\System\oAIMIIF.exe
  C:\Windows\System\oAIMIIF.exe
  2⤵
  PID:11172
- C:\Windows\System\qRIXQSP.exe
  C:\Windows\System\qRIXQSP.exe
  2⤵
  PID:9588
- C:\Windows\System\WCgkwGw.exe
  C:\Windows\System\WCgkwGw.exe
  2⤵
  PID:9716
- C:\Windows\System\oHrUpHJ.exe
  C:\Windows\System\oHrUpHJ.exe
  2⤵
  PID:10116
- C:\Windows\System\aGesPJu.exe
  C:\Windows\System\aGesPJu.exe
  2⤵
  PID:10452
- C:\Windows\System\UwTwBbS.exe
  C:\Windows\System\UwTwBbS.exe
  2⤵
  PID:10552
- C:\Windows\System\offCmmg.exe
  C:\Windows\System\offCmmg.exe
  2⤵
  PID:10804
- C:\Windows\System\aKHFDQx.exe
  C:\Windows\System\aKHFDQx.exe
  2⤵
  PID:10844
- C:\Windows\System\JzAZTyS.exe
  C:\Windows\System\JzAZTyS.exe
  2⤵
  PID:10760
- C:\Windows\System\cODOryU.exe
  C:\Windows\System\cODOryU.exe
  2⤵
  PID:11228
- C:\Windows\System\HpeVdIz.exe
  C:\Windows\System\HpeVdIz.exe
  2⤵
  PID:11236
- C:\Windows\System\PSfeyYa.exe
  C:\Windows\System\PSfeyYa.exe
  2⤵
  PID:11048
- C:\Windows\System\HslqxOQ.exe
  C:\Windows\System\HslqxOQ.exe
  2⤵
  PID:10432
- C:\Windows\System\RqzLOzu.exe
  C:\Windows\System\RqzLOzu.exe
  2⤵
  PID:11300
- C:\Windows\System\tRuIMaa.exe
  C:\Windows\System\tRuIMaa.exe
  2⤵
  PID:11328
- C:\Windows\System\MIuUbox.exe
  C:\Windows\System\MIuUbox.exe
  2⤵
  PID:11352
- C:\Windows\System\gjkGKMP.exe
  C:\Windows\System\gjkGKMP.exe
  2⤵
  PID:11380
- C:\Windows\System\lYghXPM.exe
  C:\Windows\System\lYghXPM.exe
  2⤵
  PID:11400
- C:\Windows\System\FFmqAmi.exe
  C:\Windows\System\FFmqAmi.exe
  2⤵
  PID:11432
- C:\Windows\System\BYNckKQ.exe
  C:\Windows\System\BYNckKQ.exe
  2⤵
  PID:11464
- C:\Windows\System\LsUnOog.exe
  C:\Windows\System\LsUnOog.exe
  2⤵
  PID:11484
- C:\Windows\System\bkurUoy.exe
  C:\Windows\System\bkurUoy.exe
  2⤵
  PID:11516
- C:\Windows\System\LCTeedH.exe
  C:\Windows\System\LCTeedH.exe
  2⤵
  PID:11548
- C:\Windows\System\AKfNuBZ.exe
  C:\Windows\System\AKfNuBZ.exe
  2⤵
  PID:11580
- C:\Windows\System\NAjEcnv.exe
  C:\Windows\System\NAjEcnv.exe
  2⤵
  PID:11612
- C:\Windows\System\CQWVqyF.exe
  C:\Windows\System\CQWVqyF.exe
  2⤵
  PID:11644
- C:\Windows\System\aWwmMVH.exe
  C:\Windows\System\aWwmMVH.exe
  2⤵
  PID:11668
- C:\Windows\System\aBSLQTu.exe
  C:\Windows\System\aBSLQTu.exe
  2⤵
  PID:11704
- C:\Windows\System\fBxtpLy.exe
  C:\Windows\System\fBxtpLy.exe
  2⤵
  PID:11724
- C:\Windows\System\fxXSMUt.exe
  C:\Windows\System\fxXSMUt.exe
  2⤵
  PID:11760
- C:\Windows\System\JarYIER.exe
  C:\Windows\System\JarYIER.exe
  2⤵
  PID:11796
- C:\Windows\System\POjFrva.exe
  C:\Windows\System\POjFrva.exe
  2⤵
  PID:11820
- C:\Windows\System\mWdkdNe.exe
  C:\Windows\System\mWdkdNe.exe
  2⤵
  PID:11840
- C:\Windows\System\QhLSskO.exe
  C:\Windows\System\QhLSskO.exe
  2⤵
  PID:11864
- C:\Windows\System\FYKWHyH.exe
  C:\Windows\System\FYKWHyH.exe
  2⤵
  PID:11896
- C:\Windows\System\dpQzncQ.exe
  C:\Windows\System\dpQzncQ.exe
  2⤵
  PID:11920
- C:\Windows\System\bkogiNR.exe
  C:\Windows\System\bkogiNR.exe
  2⤵
  PID:11948
- C:\Windows\System\MkVGruX.exe
  C:\Windows\System\MkVGruX.exe
  2⤵
  PID:11972
- C:\Windows\System\OeryMEq.exe
  C:\Windows\System\OeryMEq.exe
  2⤵
  PID:11996
- C:\Windows\System\ViXkbyu.exe
  C:\Windows\System\ViXkbyu.exe
  2⤵
  PID:12016
- C:\Windows\System\HrVQGFe.exe
  C:\Windows\System\HrVQGFe.exe
  2⤵
  PID:12044
- C:\Windows\System\DFVKYvp.exe
  C:\Windows\System\DFVKYvp.exe
  2⤵
  PID:12064
- C:\Windows\System\UspVWXU.exe
  C:\Windows\System\UspVWXU.exe
  2⤵
  PID:12096
- C:\Windows\System\ZmnEirV.exe
  C:\Windows\System\ZmnEirV.exe
  2⤵
  PID:12128
- C:\Windows\System\hZbBubk.exe
  C:\Windows\System\hZbBubk.exe
  2⤵
  PID:12168
- C:\Windows\System\tKqNTYe.exe
  C:\Windows\System\tKqNTYe.exe
  2⤵
  PID:12196
- C:\Windows\System\OTYOHQA.exe
  C:\Windows\System\OTYOHQA.exe
  2⤵
  PID:12224
- C:\Windows\System\vHqSxQX.exe
  C:\Windows\System\vHqSxQX.exe
  2⤵
  PID:12260
- C:\Windows\System\gUANDMQ.exe
  C:\Windows\System\gUANDMQ.exe
  2⤵
  PID:10484
- C:\Windows\System\HRFGvKa.exe
  C:\Windows\System\HRFGvKa.exe
  2⤵
  PID:10464
- C:\Windows\System\KEZlUcH.exe
  C:\Windows\System\KEZlUcH.exe
  2⤵
  PID:10652
- C:\Windows\System\YfGaLly.exe
  C:\Windows\System\YfGaLly.exe
  2⤵
  PID:11344
- C:\Windows\System\MUGMRbs.exe
  C:\Windows\System\MUGMRbs.exe
  2⤵
  PID:11492
- C:\Windows\System\xnalzbz.exe
  C:\Windows\System\xnalzbz.exe
  2⤵
  PID:11528
- C:\Windows\System\iMgXvGu.exe
  C:\Windows\System\iMgXvGu.exe
  2⤵
  PID:11544
- C:\Windows\System\HRiMpji.exe
  C:\Windows\System\HRiMpji.exe
  2⤵
  PID:11608
- C:\Windows\System\seZviWo.exe
  C:\Windows\System\seZviWo.exe
  2⤵
  PID:11716
- C:\Windows\System\tqNvRoG.exe
  C:\Windows\System\tqNvRoG.exe
  2⤵
  PID:11804
- C:\Windows\System\rthfzmO.exe
  C:\Windows\System\rthfzmO.exe
  2⤵
  PID:11884
- C:\Windows\System\XMZBBWp.exe
  C:\Windows\System\XMZBBWp.exe
  2⤵
  PID:11936
- C:\Windows\System\qajpBeS.exe
  C:\Windows\System\qajpBeS.exe
  2⤵
  PID:11960
- C:\Windows\System\JmHYRrP.exe
  C:\Windows\System\JmHYRrP.exe
  2⤵
  PID:12012
- C:\Windows\System\CdGchOs.exe
  C:\Windows\System\CdGchOs.exe
  2⤵
  PID:12104
- C:\Windows\System\wEMKasZ.exe
  C:\Windows\System\wEMKasZ.exe
  2⤵
  PID:12184
- C:\Windows\System\JawUEZz.exe
  C:\Windows\System\JawUEZz.exe
  2⤵
  PID:12232
- C:\Windows\System\rVPJMoy.exe
  C:\Windows\System\rVPJMoy.exe
  2⤵
  PID:11284
- C:\Windows\System\sTFRmhR.exe
  C:\Windows\System\sTFRmhR.exe
  2⤵
  PID:11424
- C:\Windows\System\RBtIHZy.exe
  C:\Windows\System\RBtIHZy.exe
  2⤵
  PID:11320
- C:\Windows\System\yqqkZQx.exe
  C:\Windows\System\yqqkZQx.exe
  2⤵
  PID:11372
- C:\Windows\System\NuefSpJ.exe
  C:\Windows\System\NuefSpJ.exe
  2⤵
  PID:11700
- C:\Windows\System\YSkvorO.exe
  C:\Windows\System\YSkvorO.exe
  2⤵
  PID:11912
- C:\Windows\System\SVuzVKU.exe
  C:\Windows\System\SVuzVKU.exe
  2⤵
  PID:12052
- C:\Windows\System\MAVEQwu.exe
  C:\Windows\System\MAVEQwu.exe
  2⤵
  PID:12060
- C:\Windows\System\WSfslxm.exe
  C:\Windows\System\WSfslxm.exe
  2⤵
  PID:11656
- C:\Windows\System\UPbGuNg.exe
  C:\Windows\System\UPbGuNg.exe
  2⤵
  PID:11388
- C:\Windows\System\upvoBoh.exe
  C:\Windows\System\upvoBoh.exe
  2⤵
  PID:12188
- C:\Windows\System\fHLGvct.exe
  C:\Windows\System\fHLGvct.exe
  2⤵
  PID:12312
- C:\Windows\System\EDKvYYh.exe
  C:\Windows\System\EDKvYYh.exe
  2⤵
  PID:12336
- C:\Windows\System\CxibeOH.exe
  C:\Windows\System\CxibeOH.exe
  2⤵
  PID:12356
- C:\Windows\System\krhIOyk.exe
  C:\Windows\System\krhIOyk.exe
  2⤵
  PID:12388
- C:\Windows\System\zzHngVx.exe
  C:\Windows\System\zzHngVx.exe
  2⤵
  PID:12408
- C:\Windows\System\eLuKSKY.exe
  C:\Windows\System\eLuKSKY.exe
  2⤵
  PID:12440
- C:\Windows\System\FlDMmzn.exe
  C:\Windows\System\FlDMmzn.exe
  2⤵
  PID:12464
- C:\Windows\System\cFAbOpm.exe
  C:\Windows\System\cFAbOpm.exe
  2⤵
  PID:12488
- C:\Windows\System\eVtwlOp.exe
  C:\Windows\System\eVtwlOp.exe
  2⤵
  PID:12524
- C:\Windows\System\nfGrxNK.exe
  C:\Windows\System\nfGrxNK.exe
  2⤵
  PID:12556
- C:\Windows\System\zfVSXfa.exe
  C:\Windows\System\zfVSXfa.exe
  2⤵
  PID:12592
- C:\Windows\System\npascKY.exe
  C:\Windows\System\npascKY.exe
  2⤵
  PID:12620
- C:\Windows\System\ocBmQCI.exe
  C:\Windows\System\ocBmQCI.exe
  2⤵
  PID:12680
- C:\Windows\System\liWSqxu.exe
  C:\Windows\System\liWSqxu.exe
  2⤵
  PID:12712
- C:\Windows\System\ViUODUn.exe
  C:\Windows\System\ViUODUn.exe
  2⤵
  PID:12748
- C:\Windows\System\NczQQZb.exe
  C:\Windows\System\NczQQZb.exe
  2⤵
  PID:12840
- C:\Windows\System\rGAoAzt.exe
  C:\Windows\System\rGAoAzt.exe
  2⤵
  PID:12860
- C:\Windows\System\VOKuFrY.exe
  C:\Windows\System\VOKuFrY.exe
  2⤵
  PID:12888
- C:\Windows\System\gYvBPAS.exe
  C:\Windows\System\gYvBPAS.exe
  2⤵
  PID:12904
- C:\Windows\System\GNPeWVW.exe
  C:\Windows\System\GNPeWVW.exe
  2⤵
  PID:12932
- C:\Windows\System\dBWIwQX.exe
  C:\Windows\System\dBWIwQX.exe
  2⤵
  PID:12952
- C:\Windows\System\WNwAhJs.exe
  C:\Windows\System\WNwAhJs.exe
  2⤵
  PID:12980
- C:\Windows\System\COUmGEb.exe
  C:\Windows\System\COUmGEb.exe
  2⤵
  PID:13020
- C:\Windows\System\yHyjmaZ.exe
  C:\Windows\System\yHyjmaZ.exe
  2⤵
  PID:13044
- C:\Windows\System\chrwTmK.exe
  C:\Windows\System\chrwTmK.exe
  2⤵
  PID:13072
- C:\Windows\System\qiUieAq.exe
  C:\Windows\System\qiUieAq.exe
  2⤵
  PID:13096
- C:\Windows\System\SgLLIxn.exe
  C:\Windows\System\SgLLIxn.exe
  2⤵
  PID:13120
- C:\Windows\System\RMMGlQY.exe
  C:\Windows\System\RMMGlQY.exe
  2⤵
  PID:13140
- C:\Windows\System\jTdysza.exe
  C:\Windows\System\jTdysza.exe
  2⤵
  PID:13168
- C:\Windows\System\LquedEc.exe
  C:\Windows\System\LquedEc.exe
  2⤵
  PID:13188
- C:\Windows\System\iJeyJSq.exe
  C:\Windows\System\iJeyJSq.exe
  2⤵
  PID:13212
- C:\Windows\System\WroSMCx.exe
  C:\Windows\System\WroSMCx.exe
  2⤵
  PID:13240
- C:\Windows\System\lBWMsRo.exe
  C:\Windows\System\lBWMsRo.exe
  2⤵
  PID:13260
- C:\Windows\System\omLzOUo.exe
  C:\Windows\System\omLzOUo.exe
  2⤵
  PID:13284
- C:\Windows\System\VNBWsGj.exe
  C:\Windows\System\VNBWsGj.exe
  2⤵
  PID:13308
- C:\Windows\System\vmVCeXK.exe
  C:\Windows\System\vmVCeXK.exe
  2⤵
  PID:11860
- C:\Windows\System\FgInInE.exe
  C:\Windows\System\FgInInE.exe
  2⤵
  PID:11908
- C:\Windows\System\crXrklG.exe
  C:\Windows\System\crXrklG.exe
  2⤵
  PID:12424
- C:\Windows\System\BawBWsz.exe
  C:\Windows\System\BawBWsz.exe
  2⤵
  PID:12460
- C:\Windows\System\ZPkoWwk.exe
  C:\Windows\System\ZPkoWwk.exe
  2⤵
  PID:12548
- C:\Windows\System\JJvCGLu.exe
  C:\Windows\System\JJvCGLu.exe
  2⤵
  PID:12520
- C:\Windows\System\DLGKbVF.exe
  C:\Windows\System\DLGKbVF.exe
  2⤵
  PID:12604
- C:\Windows\System\FIgGeEh.exe
  C:\Windows\System\FIgGeEh.exe
  2⤵
  PID:12696
- C:\Windows\System\SvnqeIM.exe
  C:\Windows\System\SvnqeIM.exe
  2⤵
  PID:12704
- C:\Windows\System\vJKsbVV.exe
  C:\Windows\System\vJKsbVV.exe
  2⤵
  PID:12820
- C:\Windows\System\jamOBhl.exe
  C:\Windows\System\jamOBhl.exe
  2⤵
  PID:12884
- C:\Windows\System\zJMHEir.exe
  C:\Windows\System\zJMHEir.exe
  2⤵
  PID:12944
- C:\Windows\System\cErMQyH.exe
  C:\Windows\System\cErMQyH.exe
  2⤵
  PID:13056
- C:\Windows\System\OlUCYdA.exe
  C:\Windows\System\OlUCYdA.exe
  2⤵
  PID:13136
- C:\Windows\System\TZLfbCF.exe
  C:\Windows\System\TZLfbCF.exe
  2⤵
  PID:13156
- C:\Windows\System\TQOOwgr.exe
  C:\Windows\System\TQOOwgr.exe
  2⤵
  PID:13200
- C:\Windows\System\IgTwvXx.exe
  C:\Windows\System\IgTwvXx.exe
  2⤵
  PID:13236
- C:\Windows\System\eeWmaie.exe
  C:\Windows\System\eeWmaie.exe
  2⤵
  PID:11836
- C:\Windows\System\hrWTWRk.exe
  C:\Windows\System\hrWTWRk.exe
  2⤵
  PID:11780
- C:\Windows\System\DTdnCCn.exe
  C:\Windows\System\DTdnCCn.exe
  2⤵
  PID:12452
- C:\Windows\System\yambErn.exe
  C:\Windows\System\yambErn.exe
  2⤵
  PID:12368
- C:\Windows\System\cPZxNuz.exe
  C:\Windows\System\cPZxNuz.exe
  2⤵
  PID:12612
- C:\Windows\System\UJALsIW.exe
  C:\Windows\System\UJALsIW.exe
  2⤵
  PID:12968
- C:\Windows\System\VnvTodL.exe
  C:\Windows\System\VnvTodL.exe
  2⤵
  PID:13220
- C:\Windows\System\BZJLUXU.exe
  C:\Windows\System\BZJLUXU.exe
  2⤵
  PID:13128
- C:\Windows\System\MLUGzyu.exe
  C:\Windows\System\MLUGzyu.exe
  2⤵
  PID:13036
- C:\Windows\System\IlBCpxb.exe
  C:\Windows\System\IlBCpxb.exe
  2⤵
  PID:13316
- C:\Windows\System\PMcrnRf.exe
  C:\Windows\System\PMcrnRf.exe
  2⤵
  PID:13348
- C:\Windows\System\KDlEfQv.exe
  C:\Windows\System\KDlEfQv.exe
  2⤵
  PID:13368
- C:\Windows\System\ahPfFFc.exe
  C:\Windows\System\ahPfFFc.exe
  2⤵
  PID:13392
- C:\Windows\System\HlNwncF.exe
  C:\Windows\System\HlNwncF.exe
  2⤵
  PID:13420
- C:\Windows\System\IEIhduk.exe
  C:\Windows\System\IEIhduk.exe
  2⤵
  PID:13440
- C:\Windows\System\idQhars.exe
  C:\Windows\System\idQhars.exe
  2⤵
  PID:13472
- C:\Windows\System\OwNjByk.exe
  C:\Windows\System\OwNjByk.exe
  2⤵
  PID:13504
- C:\Windows\System\DgOqgoL.exe
  C:\Windows\System\DgOqgoL.exe
  2⤵
  PID:13528
- C:\Windows\System\TWLCtbq.exe
  C:\Windows\System\TWLCtbq.exe
  2⤵
  PID:13548
- C:\Windows\System\xAJRqQE.exe
  C:\Windows\System\xAJRqQE.exe
  2⤵
  PID:13576
- C:\Windows\System\EPyCFXo.exe
  C:\Windows\System\EPyCFXo.exe
  2⤵
  PID:13596
- C:\Windows\System\qTiBTcE.exe
  C:\Windows\System\qTiBTcE.exe
  2⤵
  PID:13628
- C:\Windows\System\jrrtgVA.exe
  C:\Windows\System\jrrtgVA.exe
  2⤵
  PID:13652
- C:\Windows\System\sRlRNZF.exe
  C:\Windows\System\sRlRNZF.exe
  2⤵
  PID:13672
- C:\Windows\System\DWwDHpZ.exe
  C:\Windows\System\DWwDHpZ.exe
  2⤵
  PID:13696
- C:\Windows\System\VqgKuUb.exe
  C:\Windows\System\VqgKuUb.exe
  2⤵
  PID:13720
- C:\Windows\System\SjDjqVO.exe
  C:\Windows\System\SjDjqVO.exe
  2⤵
  PID:13752
- C:\Windows\System\ZViAGLr.exe
  C:\Windows\System\ZViAGLr.exe
  2⤵
  PID:13772
- C:\Windows\System\vTzHfwi.exe
  C:\Windows\System\vTzHfwi.exe
  2⤵
  PID:13812
- C:\Windows\System\CkAvnNl.exe
  C:\Windows\System\CkAvnNl.exe
  2⤵
  PID:13828
- C:\Windows\System\sgMAiQP.exe
  C:\Windows\System\sgMAiQP.exe
  2⤵
  PID:13860
- C:\Windows\System\AFKgqaA.exe
  C:\Windows\System\AFKgqaA.exe
  2⤵
  PID:13888
- C:\Windows\System\xyEYBrn.exe
  C:\Windows\System\xyEYBrn.exe
  2⤵
  PID:13920
- C:\Windows\System\pOKxoHm.exe
  C:\Windows\System\pOKxoHm.exe
  2⤵
  PID:13952
- C:\Windows\System\JNPyeQA.exe
  C:\Windows\System\JNPyeQA.exe
  2⤵
  PID:13980
- C:\Windows\System\gPZuswq.exe
  C:\Windows\System\gPZuswq.exe
  2⤵
  PID:14004
- C:\Windows\System\zFjpxQA.exe
  C:\Windows\System\zFjpxQA.exe
  2⤵
  PID:14032
- C:\Windows\System\jVjTukA.exe
  C:\Windows\System\jVjTukA.exe
  2⤵
  PID:14052
- C:\Windows\System\gwEzKiV.exe
  C:\Windows\System\gwEzKiV.exe
  2⤵
  PID:14080
- C:\Windows\System\juFYYIT.exe
  C:\Windows\System\juFYYIT.exe
  2⤵
  PID:14108
- C:\Windows\System\bRnQwZi.exe
  C:\Windows\System\bRnQwZi.exe
  2⤵
  PID:14124
- C:\Windows\System\XiNShmn.exe
  C:\Windows\System\XiNShmn.exe
  2⤵
  PID:14148
- C:\Windows\System\bHWQlmJ.exe
  C:\Windows\System\bHWQlmJ.exe
  2⤵
  PID:14180
- C:\Windows\System\IuaYBwh.exe
  C:\Windows\System\IuaYBwh.exe
  2⤵
  PID:14208
- C:\Windows\System\XmxjCtS.exe
  C:\Windows\System\XmxjCtS.exe
  2⤵
  PID:14228
- C:\Windows\System\yVDHxnj.exe
  C:\Windows\System\yVDHxnj.exe
  2⤵
  PID:14252
- C:\Windows\System\xhnuLwO.exe
  C:\Windows\System\xhnuLwO.exe
  2⤵
  PID:14272
- C:\Windows\System\HVjjdhz.exe
  C:\Windows\System\HVjjdhz.exe
  2⤵
  PID:14304
- C:\Windows\System\WLShEKg.exe
  C:\Windows\System\WLShEKg.exe
  2⤵
  PID:14332
- C:\Windows\System\VfWSXrx.exe
  C:\Windows\System\VfWSXrx.exe
  2⤵
  PID:11572
- C:\Windows\System\TpOClnx.exe
  C:\Windows\System\TpOClnx.exe
  2⤵
  PID:12948
- C:\Windows\System\NNQywvm.exe
  C:\Windows\System\NNQywvm.exe
  2⤵
  PID:12916
- C:\Windows\System\IDDMsxF.exe
  C:\Windows\System\IDDMsxF.exe
  2⤵
  PID:12740
- C:\Windows\System\rvpInZb.exe
  C:\Windows\System\rvpInZb.exe
  2⤵
  PID:13544
- C:\Windows\System\WTeNEjf.exe
  C:\Windows\System\WTeNEjf.exe
  2⤵
  PID:13460
- C:\Windows\System\WtkNsmL.exe
  C:\Windows\System\WtkNsmL.exe
  2⤵
  PID:13488
- C:\Windows\System\rOUdUMW.exe
  C:\Windows\System\rOUdUMW.exe
  2⤵
  PID:13612
- C:\Windows\System\ZjojEOY.exe
  C:\Windows\System\ZjojEOY.exe
  2⤵
  PID:13780
- C:\Windows\System\dqgcCQy.exe
  C:\Windows\System\dqgcCQy.exe
  2⤵
  PID:13844
- C:\Windows\System\rqjJenV.exe
  C:\Windows\System\rqjJenV.exe
  2⤵
  PID:13760
- C:\Windows\System\tUhMAFQ.exe
  C:\Windows\System\tUhMAFQ.exe
  2⤵
  PID:13960
- C:\Windows\System\vpcPiPl.exe
  C:\Windows\System\vpcPiPl.exe
  2⤵
  PID:13856
- C:\Windows\System\GhgzeSK.exe
  C:\Windows\System\GhgzeSK.exe
  2⤵
  PID:14016
- C:\Windows\System\vIPGWgc.exe
  C:\Windows\System\vIPGWgc.exe
  2⤵
  PID:13936
- C:\Windows\System\gctMHkY.exe
  C:\Windows\System\gctMHkY.exe
  2⤵
  PID:13996
- C:\Windows\System\kMoLjvW.exe
  C:\Windows\System\kMoLjvW.exe
  2⤵
  PID:14040
- C:\Windows\System\ivJSiVz.exe
  C:\Windows\System\ivJSiVz.exe
  2⤵
  PID:14328
- C:\Windows\System\MNImndA.exe
  C:\Windows\System\MNImndA.exe
  2⤵
  PID:14120
- C:\Windows\System\dEwqtpK.exe
  C:\Windows\System\dEwqtpK.exe
  2⤵
  PID:13092
- C:\Windows\System\KvnNuJI.exe
  C:\Windows\System\KvnNuJI.exe
  2⤵
  PID:12988
- C:\Windows\System\CuTOEuk.exe
  C:\Windows\System\CuTOEuk.exe
  2⤵
  PID:13624
- C:\Windows\System\PBLcvmu.exe
  C:\Windows\System\PBLcvmu.exe
  2⤵
  PID:14268
- C:\Windows\System\xpdbBEe.exe
  C:\Windows\System\xpdbBEe.exe
  2⤵
  PID:13356
- C:\Windows\System\iuFApUn.exe
  C:\Windows\System\iuFApUn.exe
  2⤵
  PID:13304
- C:\Windows\System\ZqIJxTM.exe
  C:\Windows\System\ZqIJxTM.exe
  2⤵
  PID:14344
- C:\Windows\System\ODsbbIk.exe
  C:\Windows\System\ODsbbIk.exe
  2⤵
  PID:14364
- C:\Windows\System\wsIhcQg.exe
  C:\Windows\System\wsIhcQg.exe
  2⤵
  PID:14392
- C:\Windows\System\EubbTtr.exe
  C:\Windows\System\EubbTtr.exe
  2⤵
  PID:14416
- C:\Windows\System\KorSIHl.exe
  C:\Windows\System\KorSIHl.exe
  2⤵
  PID:14448
- C:\Windows\System\OMqbKCm.exe
  C:\Windows\System\OMqbKCm.exe
  2⤵
  PID:14476
- C:\Windows\System\GwLiMbK.exe
  C:\Windows\System\GwLiMbK.exe
  2⤵
  PID:14500
- C:\Windows\System\lPkBJzG.exe
  C:\Windows\System\lPkBJzG.exe
  2⤵
  PID:14532
- C:\Windows\System\wmUdsQb.exe
  C:\Windows\System\wmUdsQb.exe
  2⤵
  PID:14548
- C:\Windows\System\qicqWPC.exe
  C:\Windows\System\qicqWPC.exe
  2⤵
  PID:14580
- C:\Windows\System\ZFGdlKR.exe
  C:\Windows\System\ZFGdlKR.exe
  2⤵
  PID:14612
- C:\Windows\System\bCBomhv.exe
  C:\Windows\System\bCBomhv.exe
  2⤵
  PID:14636
- C:\Windows\System\TlUXbgi.exe
  C:\Windows\System\TlUXbgi.exe
  2⤵
  PID:14656
- C:\Windows\System\spjGkab.exe
  C:\Windows\System\spjGkab.exe
  2⤵
  PID:14688
- C:\Windows\System\TGqfxgx.exe
  C:\Windows\System\TGqfxgx.exe
  2⤵
  PID:14712
- C:\Windows\System\iVPxrUc.exe
  C:\Windows\System\iVPxrUc.exe
  2⤵
  PID:14740
- C:\Windows\System\ZAyEvkS.exe
  C:\Windows\System\ZAyEvkS.exe
  2⤵
  PID:14764
- C:\Windows\System\dMuPPJO.exe
  C:\Windows\System\dMuPPJO.exe
  2⤵
  PID:14796
- C:\Windows\System\xghUDwp.exe
  C:\Windows\System\xghUDwp.exe
  2⤵
  PID:14820
- C:\Windows\System\ORWuGlU.exe
  C:\Windows\System\ORWuGlU.exe
  2⤵
  PID:14848
- C:\Windows\System\EOnDLMM.exe
  C:\Windows\System\EOnDLMM.exe
  2⤵
  PID:14872
- C:\Windows\System\MVVLrIP.exe
  C:\Windows\System\MVVLrIP.exe
  2⤵
  PID:14896
- C:\Windows\System\dNUgJnz.exe
  C:\Windows\System\dNUgJnz.exe
  2⤵
  PID:14920
- C:\Windows\System\gFKlPYg.exe
  C:\Windows\System\gFKlPYg.exe
  2⤵
  PID:14948
- C:\Windows\System\qLJMmyX.exe
  C:\Windows\System\qLJMmyX.exe
  2⤵
  PID:15320
- C:\Windows\System\qcezVGm.exe
  C:\Windows\System\qcezVGm.exe
  2⤵
  PID:15340
- C:\Windows\System\lOqIvJY.exe
  C:\Windows\System\lOqIvJY.exe
  2⤵
  PID:15356
- C:\Windows\System\KcJNLvT.exe
  C:\Windows\System\KcJNLvT.exe
  2⤵
  PID:13972
- C:\Windows\System\dDLOSwu.exe
  C:\Windows\System\dDLOSwu.exe
  2⤵
  PID:13992
- C:\Windows\System\AwNMUyY.exe
  C:\Windows\System\AwNMUyY.exe
  2⤵
  PID:13784
- C:\Windows\System\gyfBUHK.exe
  C:\Windows\System\gyfBUHK.exe
  2⤵
  PID:14436
- C:\Windows\System\wMSkInN.exe
  C:\Windows\System\wMSkInN.exe
  2⤵
  PID:14132
- C:\Windows\System\WpWLVZr.exe
  C:\Windows\System\WpWLVZr.exe
  2⤵
  PID:14340
- C:\Windows\System\nvKZwmZ.exe
  C:\Windows\System\nvKZwmZ.exe
  2⤵
  PID:14400
- C:\Windows\System\AXjMhjx.exe
  C:\Windows\System\AXjMhjx.exe
  2⤵
  PID:14672
- C:\Windows\System\yZLspLM.exe
  C:\Windows\System\yZLspLM.exe
  2⤵
  PID:13584
- C:\Windows\System\mWsMcGF.exe
  C:\Windows\System\mWsMcGF.exe
  2⤵
  PID:14404
- C:\Windows\System\NEhyfle.exe
  C:\Windows\System\NEhyfle.exe
  2⤵
  PID:14488
- C:\Windows\System\pjVuzNg.exe
  C:\Windows\System\pjVuzNg.exe
  2⤵
  PID:14708
- C:\Windows\System\HtqdZab.exe
  C:\Windows\System\HtqdZab.exe
  2⤵
  PID:14604
- C:\Windows\System\XPUwpHg.exe
  C:\Windows\System\XPUwpHg.exe
  2⤵
  PID:14596
- C:\Windows\System\bWhWwmf.exe
  C:\Windows\System\bWhWwmf.exe
  2⤵
  PID:14696
- C:\Windows\System\ipnsndu.exe
  C:\Windows\System\ipnsndu.exe
  2⤵
  PID:14760
- C:\Windows\System\yCYrsTE.exe
  C:\Windows\System\yCYrsTE.exe
  2⤵
  PID:14844
- C:\Windows\System\vINPQBp.exe
  C:\Windows\System\vINPQBp.exe
  2⤵
  PID:14928
- C:\Windows\System\mncxbyt.exe
  C:\Windows\System\mncxbyt.exe
  2⤵
  PID:15084
- C:\Windows\System\PhwAijr.exe
  C:\Windows\System\PhwAijr.exe
  2⤵
  PID:15096
- C:\Windows\System\orEbhMe.exe
  C:\Windows\System\orEbhMe.exe
  2⤵
  PID:15284
- C:\Windows\System\yrHfIwr.exe
  C:\Windows\System\yrHfIwr.exe
  2⤵
  PID:15348
- C:\Windows\System\NfgymzK.exe
  C:\Windows\System\NfgymzK.exe
  2⤵
  PID:13744
- C:\Windows\System\bzFTUUO.exe
  C:\Windows\System\bzFTUUO.exe
  2⤵
  PID:14028
- C:\Windows\System\asngRiG.exe
  C:\Windows\System\asngRiG.exe
  2⤵
  PID:14320
- C:\Windows\System\YEMMGZp.exe
  C:\Windows\System\YEMMGZp.exe
  2⤵
  PID:4368
- C:\Windows\System\BMaOZco.exe
  C:\Windows\System\BMaOZco.exe
  2⤵
  PID:14360
- C:\Windows\System\aMKgChp.exe
  C:\Windows\System\aMKgChp.exe
  2⤵
  PID:14624
- C:\Windows\System\TWXzbcg.exe
  C:\Windows\System\TWXzbcg.exe
  2⤵
  PID:14516
- C:\Windows\System\DAdfbyx.exe
  C:\Windows\System\DAdfbyx.exe
  2⤵
  PID:15016
- C:\Windows\System\ymYrpbk.exe
  C:\Windows\System\ymYrpbk.exe
  2⤵
  PID:14780
- C:\Windows\System\kpTFhPC.exe
  C:\Windows\System\kpTFhPC.exe
  2⤵
  PID:13492
- C:\Windows\System\emFLtJo.exe
  C:\Windows\System\emFLtJo.exe
  2⤵
  PID:14316
- C:\Windows\System\sTQhaUl.exe
  C:\Windows\System\sTQhaUl.exe
  2⤵
  PID:15352
- C:\Windows\System\zBFPrXG.exe
  C:\Windows\System\zBFPrXG.exe
  2⤵
  PID:15388
- C:\Windows\System\eNzIVKd.exe
  C:\Windows\System\eNzIVKd.exe
  2⤵
  PID:15424
- C:\Windows\System\ptOsmLI.exe
  C:\Windows\System\ptOsmLI.exe
  2⤵
  PID:15448
- C:\Windows\System\FkAVguq.exe
  C:\Windows\System\FkAVguq.exe
  2⤵
  PID:15480
- C:\Windows\System\bJkOxti.exe
  C:\Windows\System\bJkOxti.exe
  2⤵
  PID:15516
- C:\Windows\System\osssbeD.exe
  C:\Windows\System\osssbeD.exe
  2⤵
  PID:15556
- C:\Windows\System\cMguzJf.exe
  C:\Windows\System\cMguzJf.exe
  2⤵
  PID:15584
- C:\Windows\System\BLAulbi.exe
  C:\Windows\System\BLAulbi.exe
  2⤵
  PID:15600
- C:\Windows\System\pDkioXW.exe
  C:\Windows\System\pDkioXW.exe
  2⤵
  PID:15616
- C:\Windows\System\DBsxmUH.exe
  C:\Windows\System\DBsxmUH.exe
  2⤵
  PID:15648
- C:\Windows\System\covrsNF.exe
  C:\Windows\System\covrsNF.exe
  2⤵
  PID:15672
- C:\Windows\System\gDTioMB.exe
  C:\Windows\System\gDTioMB.exe
  2⤵
  PID:15692
- C:\Windows\System\oxMazur.exe
  C:\Windows\System\oxMazur.exe
  2⤵
  PID:15712
- C:\Windows\System\onmZmEn.exe
  C:\Windows\System\onmZmEn.exe
  2⤵
  PID:15740
- C:\Windows\System\QuUHVkE.exe
  C:\Windows\System\QuUHVkE.exe
  2⤵
  PID:15768
- C:\Windows\System\EYWcEfQ.exe
  C:\Windows\System\EYWcEfQ.exe
  2⤵
  PID:15792
- C:\Windows\System\beRRnmL.exe
  C:\Windows\System\beRRnmL.exe
  2⤵
  PID:15832
- C:\Windows\System\jAASdHS.exe
  C:\Windows\System\jAASdHS.exe
  2⤵
  PID:15856
- C:\Windows\System\PNMvADA.exe
  C:\Windows\System\PNMvADA.exe
  2⤵
  PID:15892
- C:\Windows\System\LwNfLhP.exe
  C:\Windows\System\LwNfLhP.exe
  2⤵
  PID:15912
- C:\Windows\System\GCAKOoN.exe
  C:\Windows\System\GCAKOoN.exe
  2⤵
  PID:15940
- C:\Windows\System\ytHpQNS.exe
  C:\Windows\System\ytHpQNS.exe
  2⤵
  PID:15968
- C:\Windows\System\MHQKGfQ.exe
  C:\Windows\System\MHQKGfQ.exe
  2⤵
  PID:15996
- C:\Windows\System\BbDhnVN.exe
  C:\Windows\System\BbDhnVN.exe
  2⤵
  PID:16016
- C:\Windows\System\zpMXccA.exe
  C:\Windows\System\zpMXccA.exe
  2⤵
  PID:16040
- C:\Windows\System\ZHSeEuG.exe
  C:\Windows\System\ZHSeEuG.exe
  2⤵
  PID:16064
- C:\Windows\System\XLMkUOB.exe
  C:\Windows\System\XLMkUOB.exe
  2⤵
  PID:16084
- C:\Windows\System\TCiLbuI.exe
  C:\Windows\System\TCiLbuI.exe
  2⤵
  PID:16120
- C:\Windows\System\pcQwZoi.exe
  C:\Windows\System\pcQwZoi.exe
  2⤵
  PID:16136
- C:\Windows\System\mXJXKXZ.exe
  C:\Windows\System\mXJXKXZ.exe
  2⤵
  PID:16176
- C:\Windows\System\YbPksIf.exe
  C:\Windows\System\YbPksIf.exe
  2⤵
  PID:16204
- C:\Windows\System\ofXwGai.exe
  C:\Windows\System\ofXwGai.exe
  2⤵
  PID:16224
- C:\Windows\System\fiNpASa.exe
  C:\Windows\System\fiNpASa.exe
  2⤵
  PID:16252
- C:\Windows\System\qdAhVdh.exe
  C:\Windows\System\qdAhVdh.exe
  2⤵
  PID:16288
- C:\Windows\System\KAUCJJn.exe
  C:\Windows\System\KAUCJJn.exe
  2⤵
  PID:16320
- C:\Windows\System\wDybCOS.exe
  C:\Windows\System\wDybCOS.exe
  2⤵
  PID:16340
- C:\Windows\System\CyLZKxs.exe
  C:\Windows\System\CyLZKxs.exe
  2⤵
  PID:15412
- C:\Windows\System\LRJGhnu.exe
  C:\Windows\System\LRJGhnu.exe
  2⤵
  PID:14736
- C:\Windows\System\ZEniCif.exe
  C:\Windows\System\ZEniCif.exe
  2⤵
  PID:15552
- C:\Windows\System\vuOGZlL.exe
  C:\Windows\System\vuOGZlL.exe
  2⤵
  PID:15532
- C:\Windows\System\RDvanDC.exe
  C:\Windows\System\RDvanDC.exe
  2⤵
  PID:15460
- C:\Windows\System\UaaipdD.exe
  C:\Windows\System\UaaipdD.exe
  2⤵
  PID:15580
- C:\Windows\System\KpwXKtm.exe
  C:\Windows\System\KpwXKtm.exe
  2⤵
  PID:15704
- C:\Windows\System\GOdXtqt.exe
  C:\Windows\System\GOdXtqt.exe
  2⤵
  PID:15784
- C:\Windows\System\VQQmrpM.exe
  C:\Windows\System\VQQmrpM.exe
  2⤵
  PID:15816
- C:\Windows\System\iXWdmrl.exe
  C:\Windows\System\iXWdmrl.exe
  2⤵
  PID:15956
- C:\Windows\System\ACHkNvN.exe
  C:\Windows\System\ACHkNvN.exe
  2⤵
  PID:15960
- C:\Windows\System\YvSUDEO.exe
  C:\Windows\System\YvSUDEO.exe
  2⤵
  PID:16112
- C:\Windows\System\YdMqmdr.exe
  C:\Windows\System\YdMqmdr.exe
  2⤵
  PID:16220
- C:\Windows\System\oemTweH.exe
  C:\Windows\System\oemTweH.exe
  2⤵
  PID:16132
- C:\Windows\System\EQCLglY.exe
  C:\Windows\System\EQCLglY.exe
  2⤵
  PID:16196
- C:\Windows\System\WsKSzne.exe
  C:\Windows\System\WsKSzne.exe
  2⤵
  PID:15068
- C:\Windows\System\JhXisUj.exe
  C:\Windows\System\JhXisUj.exe
  2⤵
  PID:15472
- C:\Windows\System\XCwTNkR.exe
  C:\Windows\System\XCwTNkR.exe
  2⤵
  PID:14468
- C:\Windows\System\UsTmZjt.exe
  C:\Windows\System\UsTmZjt.exe
  2⤵
  PID:15684
- C:\Windows\System\YVFTFvP.exe
  C:\Windows\System\YVFTFvP.exe
  2⤵
  PID:16028
- C:\Windows\System\RMcnEJK.exe
  C:\Windows\System\RMcnEJK.exe
  2⤵
  PID:16108
- C:\Windows\System\eWZgwWW.exe
  C:\Windows\System\eWZgwWW.exe
  2⤵
  PID:16168
- C:\Windows\System\zjXiduJ.exe
  C:\Windows\System\zjXiduJ.exe
  2⤵
  PID:16328
- C:\Windows\System\eRgUwSQ.exe
  C:\Windows\System\eRgUwSQ.exe
  2⤵
  PID:15872
- C:\Windows\System\ShRoOpE.exe
  C:\Windows\System\ShRoOpE.exe
  2⤵
  PID:16296
- C:\Windows\System\zCihfvR.exe
  C:\Windows\System\zCihfvR.exe
  2⤵
  PID:16360
- C:\Windows\System\adqvlnd.exe
  C:\Windows\System\adqvlnd.exe
  2⤵
  PID:15464
- C:\Windows\System\nzcPGJF.exe
  C:\Windows\System\nzcPGJF.exe
  2⤵
  PID:16404
- C:\Windows\System\SirCrOn.exe
  C:\Windows\System\SirCrOn.exe
  2⤵
  PID:16424
- C:\Windows\System\gHXTYgg.exe
  C:\Windows\System\gHXTYgg.exe
  2⤵
  PID:16448
- C:\Windows\System\JqBTLbb.exe
  C:\Windows\System\JqBTLbb.exe
  2⤵
  PID:16472
- C:\Windows\System\ducqHEW.exe
  C:\Windows\System\ducqHEW.exe
  2⤵
  PID:16496
- C:\Windows\System\EBCsLRv.exe
  C:\Windows\System\EBCsLRv.exe
  2⤵
  PID:16528
- C:\Windows\System\HrTxvJi.exe
  C:\Windows\System\HrTxvJi.exe
  2⤵
  PID:16556
- C:\Windows\System\iiiDkmg.exe
  C:\Windows\System\iiiDkmg.exe
  2⤵
  PID:16588
- C:\Windows\System\xALpFAG.exe
  C:\Windows\System\xALpFAG.exe
  2⤵
  PID:16604
- C:\Windows\System\PuROFWP.exe
  C:\Windows\System\PuROFWP.exe
  2⤵
  PID:16620
- C:\Windows\System\AtCmDyE.exe
  C:\Windows\System\AtCmDyE.exe
  2⤵
  PID:16644
- C:\Windows\System\HXEtWgf.exe
  C:\Windows\System\HXEtWgf.exe
  2⤵
  PID:16688
- C:\Windows\System\KQqXUOx.exe
  C:\Windows\System\KQqXUOx.exe
  2⤵
  PID:16704
- C:\Windows\System\aTiiUSL.exe
  C:\Windows\System\aTiiUSL.exe
  2⤵
  PID:16736
- C:\Windows\System\WhpCXfi.exe
  C:\Windows\System\WhpCXfi.exe
  2⤵
  PID:16752
- C:\Windows\System\jOOYhRn.exe
  C:\Windows\System\jOOYhRn.exe
  2⤵
  PID:16824
- C:\Windows\System\aaOZNpl.exe
  C:\Windows\System\aaOZNpl.exe
  2⤵
  PID:16844
- C:\Windows\System\tSLEGnp.exe
  C:\Windows\System\tSLEGnp.exe
  2⤵
  PID:16868
- C:\Windows\System\MAhogKF.exe
  C:\Windows\System\MAhogKF.exe
  2⤵
  PID:16892
- C:\Windows\System\FYmIDzI.exe
  C:\Windows\System\FYmIDzI.exe
  2⤵
  PID:16920
- C:\Windows\System\IBkDFZW.exe
  C:\Windows\System\IBkDFZW.exe
  2⤵
  PID:16944
- C:\Windows\System\INYTcOc.exe
  C:\Windows\System\INYTcOc.exe
  2⤵
  PID:16964
- C:\Windows\System\pXFMhVg.exe
  C:\Windows\System\pXFMhVg.exe
  2⤵
  PID:16988
- C:\Windows\System\lAtSagF.exe
  C:\Windows\System\lAtSagF.exe
  2⤵
  PID:17008
- C:\Windows\System\TZBCBRB.exe
  C:\Windows\System\TZBCBRB.exe
  2⤵
  PID:17028
- C:\Windows\System\IdWBCjz.exe
  C:\Windows\System\IdWBCjz.exe
  2⤵
  PID:17052
- C:\Windows\System\XiqHdaJ.exe
  C:\Windows\System\XiqHdaJ.exe
  2⤵
  PID:17076
- C:\Windows\System\EnILDcq.exe
  C:\Windows\System\EnILDcq.exe
  2⤵
  PID:17096
- C:\Windows\System\dNrjppm.exe
  C:\Windows\System\dNrjppm.exe
  2⤵
  PID:17124
- C:\Windows\System\wftxHSh.exe
  C:\Windows\System\wftxHSh.exe
  2⤵
  PID:17152
- C:\Windows\System\WkzUCEg.exe
  C:\Windows\System\WkzUCEg.exe
  2⤵
  PID:17168
- C:\Windows\System\MugIaqh.exe
  C:\Windows\System\MugIaqh.exe
  2⤵
  PID:17188
- C:\Windows\System\bWZhUni.exe
  C:\Windows\System\bWZhUni.exe
  2⤵
  PID:17216
- C:\Windows\System\hwEPtgH.exe
  C:\Windows\System\hwEPtgH.exe
  2⤵
  PID:17236
- C:\Windows\System\qXMEVFC.exe
  C:\Windows\System\qXMEVFC.exe
  2⤵
  PID:15924
- C:\Windows\System\ondtZnJ.exe
  C:\Windows\System\ondtZnJ.exe
  2⤵
  PID:16432

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:17400

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\ASjAIwZ.exe

Filesize
1.5MB

MD5
d61d6645e6904d7f456fbedfbaff6af1

SHA1
08e32e8c92eae34f2429454a271ea61ac8482699

SHA256
d825fa26109bd261d48c6fa23dbef51687c92f36a0c93661a24cdc3931d65751

SHA512
46e448bc401d036ece1488c6bd79987ebcf9cf6875e62e5acefa3c51c8b305329c1136e8291bd62cc408e7bdc7c54c14d1fc26a92070e238627afca05659bb3c

Download Submit
C:\Windows\System\ArCgqDl.exe

Filesize
1.5MB

MD5
566c5e745c7c0b7fe7abd45e8a15c926

SHA1
a05f13d9eeb61027b9e8e9769b8706727ba9b10e

SHA256
4154c435c6958348d5494d79e538a6b81052c05b15aef784782d76b506ea3b6d

SHA512
447ff0403128ba2c6386b7dd7632da20e02269dd18ff6d6bccd8abb4bc1300b11192b2f975b6791bf325539dd090ff3b1cf2999711133ae8c5cd62e9b3afaf38

Download Submit
C:\Windows\System\BFiGaTE.exe

Filesize
1.5MB

MD5
bdf8bd42bb56904893d4f860612e4796

SHA1
ae711d69894a20b0de297757bf51b265bff097ee

SHA256
643fe4eb34d7d3d54499c0e8b85ce87580b23f1511adb5ee4f7dd596e62061bb

SHA512
a4079ef36fb7f4952288a035d57c2790055d0c013ddc3b3137693590990736eb8c02f0d08a8c1bdc6a61908433d3be933dab3f76435d3634a419bc2a1985bb58

Download Submit
C:\Windows\System\DEHMtso.exe

Filesize
1.5MB

MD5
a86787a6aa8a053762d70676c7ddc0d1

SHA1
1338aeb6019b91c3673b807319893e4a63b96d82

SHA256
666af819875bbe87a4758957aeb55dd1ead9e5b6dfb91a2db350a62e562a619b

SHA512
17ff8ae2a7db2fdbeda494038cd66779adae25c0ca2a303ed161b156509ed6b2476a10ddc6b02a1cf78c1b17a6398632327f2731ff423c62d004bb9fccc8d2d0

Download Submit
C:\Windows\System\FMkvjqK.exe

Filesize
1.5MB

MD5
56b2596132655288c0eb63a9f8147d5c

SHA1
c82ae6bbd3214efd497cb4a9a74c474a3f9b23a9

SHA256
11136a981bd41406b6bd4452d7352d07833faa08c9bed349b78d765034f8f85a

SHA512
a377b7c4da0317b03c3e61fadb3d5cbd32ba29eeb1d27a3fe60bccf0d560937ae6cd1175baacc25c978f58eaee2dccbae109b37183c6bbe6c413be80b3be0aec

Download Submit
C:\Windows\System\IEvyVFn.exe

Filesize
1.5MB

MD5
ed9cd0e566a70f39712f3f0b273be0a8

SHA1
36ade1ffd59ed0f98baaeb731575550420b06cae

SHA256
c8b9bb73fb014efe434c4769a6c62ca0c5269872dc3ebaae7b20be1148de37a0

SHA512
28f4bb903f5f103bd01e36b3ddc0f061128a01686438ef538585141e87c99ec7b900edc166cb11f3f3692445a7f54d393b24e5b4c9f05de5bef124944540451a

Download Submit
C:\Windows\System\KmUzHSh.exe

Filesize
1.5MB

MD5
185671721556d8bd162571715b5b0d44

SHA1
ed49baaadad7f8b4aa46f0ec61aa0e5e2a87a231

SHA256
842e866d0c5ac1e0ca78642b606da0b3b8ed57fd4b2c4fe49745cb9ae203b8ca

SHA512
97798e03c4c34b87201031eab899cae637449b1092dd556049398bfb9540552904a1ecfbf3e939a09b0cfb69911169d8e1ebf5b00657f66db2aba9db32c714fb

Download Submit
C:\Windows\System\LPmitlF.exe

Filesize
1.5MB

MD5
655562e980d7cdcd1e3f8d955fe9c711

SHA1
20d7623d30f0cd6c6871c2729d6f92af566f9fd4

SHA256
408f8c038228c2d91c200b7bfd0b8fca1c6948530d7fd2aa82b90899e1ad97ef

SHA512
5eda806842f1ef966cd1b5f4e2fde485126915c3b5e39d2643b4cda6f3e6b117b48eb041112e923642acaa37d1085397da9050bce1c54fc17d39f0d85d5cdec1

Download Submit
C:\Windows\System\NyOpbqQ.exe

Filesize
1.5MB

MD5
9d086947fb1e98e5f40b0ac45e8147a6

SHA1
2e312aae9789f643d4ae45bcc8909b9db82e90ac

SHA256
bb225ebaf0e26aa9d438722023e4382d875e607b41c9fb57ad4a408e085ab348

SHA512
aaa24e1d38c908ffed5142a43a744da8ca9ced9600787965a1fd50f26a8df2b932ad040bbddbdee85894af6689f3b5543e284d00a5c28579fac5e70704b2b238

Download Submit
C:\Windows\System\QArVAnv.exe

Filesize
1.5MB

MD5
af639bc3f96110a24458b65fa496af2a

SHA1
0d744cf6af4a0e7b9b83d47455ed2ac7615fe556

SHA256
115d79c3e78398cfc9f9886d4043da1db537350994477e7799b7becf6801a1d5

SHA512
15407a53e9f39754470571fa6cdb78d67f624cdeffdde90b1a6d5b3a7c910a3ae3a0dc01c734ac765379c04972e5d1a22f27f9bc641c2d268972acd66c69875a

Download Submit
C:\Windows\System\QPtzgDN.exe

Filesize
1.5MB

MD5
2d56014cbc712ca4c17f75262f7cf485

SHA1
f911056561b512c918e633069d37a69b8cb351bb

SHA256
a294cf795ce3cbd32427168bea3c1ebe2f60f865b9684e680bfc0e40363aeab6

SHA512
20ba7af8b78cdb75db1b8af447bf3d36a239eccf6848677e1724d3b5c72eaa5671e284ff909a9139658bb59394774badf6cef4bfa0bff621ecc092db166f63b8

Download Submit
C:\Windows\System\RRoEiSc.exe

Filesize
1.5MB

MD5
f16ac15855e8d5c9fab35802ea52612d

SHA1
0bb8fa5ec34c32005b3ad7ca5f0d6231a8c2d4ec

SHA256
eda33063979052904ffdd0d85896a9b3d7a9705b5595fac4554ea8eb9c9d8529

SHA512
c6696475a6208cefffa72f7549fa38cc6ffc2d4d9d0dd1409d833e9d7e2b9f10cc843e0f0ee05a4ff98195e8d6debd261fefd08c48579fa02790f6611dd75adc

Download Submit
C:\Windows\System\SPopyqG.exe

Filesize
1.5MB

MD5
1324a32ef6aa0b86fc5c84c8fc46af1f

SHA1
339a53bed5c2ef92b38e1082c2abe704e4fa2141

SHA256
4f2e4ff44a302c346efbd52b0a86badacc0c79e8df4bc8d8be78c81fa394a8ab

SHA512
69b6b0b2ec011bef2758588d55a3befe3ac231db8344bdb806c2ee85e31374eaf33074c15a55da2a32b8bd418b063d0407f91974d534b282411ec88a8207b9f5

Download Submit
C:\Windows\System\TYCHYIN.exe

Filesize
1.5MB

MD5
c8f0d78797d9d3685b41bc93de4ea7a1

SHA1
815986679f6b81f419722d6f039b016db1ad7b93

SHA256
b892ef9f0072256f4e0726bdd487efc5280a7d8b27fc0a51649a9cc196e469b0

SHA512
ee66b3e4216051359d84ca7c650e32fe24c419df95e33c033f9985f2c7fed97c23b77cebc977017e9d226d592be2aae15b9f259d3001b7c175a321eb9acfdfdb

Download Submit
C:\Windows\System\WCPHBCl.exe

Filesize
1.5MB

MD5
6ea6210586b44f2858947d919413d200

SHA1
d56e3eff0fe6b90b7d6321e40e33ed69f5986c0a

SHA256
f777f6641c254eb3cc60dbc19fd828f33eb981f6ffafb26fe2457b064ad1455b

SHA512
d6872951e60c877f3b53e409e3d2976ed149f7f403dfd3000692ca70322b3f5b825d8dadf32dba00f59d79c6cab69a75a47eedc6cd01339274353e7a251ba3be

Download Submit
C:\Windows\System\WztAxpD.exe

Filesize
1.5MB

MD5
dddc821b9b1b0bf18a6740fe1846024b

SHA1
486fe1cf4d650d209bc4d3842a3c2536b1466eb0

SHA256
2df43fdd47f22ba7561b299c3ab59f89827140bbda077a88f398d1b9649ad06e

SHA512
24e1464efcf4bce4e9b3e0835193aaf32f82db477d9f946a9d72ee97b0a88d9f86fa17a55ac8b36867ada32d06f4275854e147ee8bc43a28e7728edf67e9f46d

Download Submit
C:\Windows\System\XqWVNZy.exe

Filesize
1.5MB

MD5
bc3f873008924247fda4ac203510e9e7

SHA1
76dc2e280138fe39af040df6c9104ce377b54b53

SHA256
4b51a761d808a7112b2de6ed1efa8ac15006352eb7aca6e5ea62f50db5ba4fae

SHA512
e1164d90242c5768add0196ae8f32af945ee762ced642f856abad0a04b9a631bb9cba628eaa5f39d2e06759c31b62cd3ed3da479c1d43c1fbdfe93c0236e2a4a

Download Submit
C:\Windows\System\YeYzGus.exe

Filesize
1.5MB

MD5
57b4f56665cf9c41caf54787582c6454

SHA1
498739f10774b44968601f067c1bf3e76ad64458

SHA256
9e9402ca9ca5373391c6221991964eb854667db15db82579be904116113d48bc

SHA512
f9da43c66e94a5fa686e5af855da02dedcc0e03ce7c86ab7a265ee11bc423caf71d0c4c66d6008ab2a8544ea4b91c8480330938800bf22ef29ecab950f51f873

Download Submit
C:\Windows\System\ZNkxItw.exe

Filesize
1.5MB

MD5
57966013203b264cfd36a137d04e4dbf

SHA1
7e89e128aeb1ed456ca20fce3589808cf22bd879

SHA256
d9255034ce9f5146cb70017e02971a94d7e07e4056c1eaf5d763511f6e01bc8c

SHA512
5b2b85924f530119defcd25e6f5c96b1350976118a2f15f3b9e089ca7ef9e05779748e3153c72fbf9159f9bc4274a030db0305114ce52650d717de9f8ce6480a

Download Submit
C:\Windows\System\ZSdWDDe.exe

Filesize
1.5MB

MD5
da75dc80b195ca6309f6a0b76d0862d1

SHA1
ff2174e489374ea0d9fa110e2a7f0a6beff129a6

SHA256
fc46c1bcc4b36c1afd6a1d4aa34a9851d42a79d9b6ece196d1b138a7b43db5a1

SHA512
d9d1f806917849f7e86907aa8bfdbfebb0c6a0a9d165bbb52a6bfeda0486c0cc205895b31b18ac8de647c81d11d30b06a49f9e3cdd2254f310b98b69ed5a947d

Download Submit
C:\Windows\System\ZxlPAic.exe

Filesize
1.5MB

MD5
af5e5844afb848e5ad8c9d3f4f0da573

SHA1
2f526318cd70a295e305cf9d784c885f65635095

SHA256
15ba735783da4c9c0e2cfdda84840a03cd43fc17de145a7cc0dce0aebd3a0954

SHA512
26cf9173caf7f2cce329882aa8b852e960e4bfe9d991ab5fa349e54a93f52d819c71ac4bc495d2daf8dc97cc5c70db500d1f1a8d4c89916fa7552600f5049cdd

Download Submit
C:\Windows\System\aYJiUcK.exe

Filesize
1.5MB

MD5
f768e15185b3036804853e708c035f41

SHA1
979b10c9f0286080a71052838a4cd451860c9b33

SHA256
0e991669115939eb035de323d80257b487724a3b87657a613371b5fdb6751e2e

SHA512
2659f1b0e1631538bb80936c90a5801f97a0e36665bbd887e8068e985097a1bf780868d284f9c12a936f08dab758ebbde536cc650215f99ae7947ee98f9dbab9

Download Submit
C:\Windows\System\bZoscmI.exe

Filesize
1.5MB

MD5
5672c5a79ec7bf0b7c45589e7d46cb3e

SHA1
660096162db35873df7598ee4b6267d3b101518d

SHA256
acd8ab5ebdac4764bc42f9dd14d8d75552a4f018b7b1c9a3ca9544bc83e14b92

SHA512
9f6bd11fd5a62c87ef18caad93e5d0c6d498680d266739f2519bdd569576ee41f263f82761bcf9fa069d57e24bd217a8f9018f5793073cf567b18104b0255569

Download Submit
C:\Windows\System\cGLRAlQ.exe

Filesize
1.5MB

MD5
4c7b797a43be053dd7798ce83af4f798

SHA1
f5a36a0a7c1e9953455b23eb8004fdbba5b6c4a7

SHA256
8c7f10b09841573160a40eb0327de8df65255fbfa48319ff491f38e990e286eb

SHA512
0510749fb77c054dfec3789ab7e27a1600adf14607a84393d1e2e68099e2e57492a5418c2c2f24a59d2afed9210a8a046403bd98f0bcfa622653106b87aaba2f

Download Submit
C:\Windows\System\cbGRkgK.exe

Filesize
1.5MB

MD5
a79f9bb9cb4288edf19311eed653d165

SHA1
b6d9dca90c7006791764ad4688d4705c8a9710fc

SHA256
ce475afd47f7c081224e4bf06972d494506c0c8c1a9d225c359c66ba524ba637

SHA512
705eab9121536a9d1c5ba16673f090135cddd22f736cca8d434decd45350a2745482352db43d3ce1a356cae2107129fa9484abdfe248b10607739f0e10afa9b4

Download Submit
C:\Windows\System\ehokRgP.exe

Filesize
1.5MB

MD5
d69c3d96ce27471690500630d4bb8aa4

SHA1
fb1c97979b22fd3df7319f2283c09ef0eaebbb0b

SHA256
c456850202b9f789240e50e65de0a408aab9df9e8eeb2e27f697a4f3bc8e1c4a

SHA512
89675b3f8d0db27f621639c0d9e9330dedcedb421977a1758af41c6dc3a809518cc10e2d615a08d9679ff1aebdf27a08d4587db6a1909c5b9969cff6eee2d2f4

Download Submit
C:\Windows\System\gwBOOLw.exe

Filesize
1.5MB

MD5
aa86126fd1fd05cac842ed6f33a53acb

SHA1
51427e9df02c110eae10a7f64f9d5a497eb199ea

SHA256
5f0985c5ed1b42442b5ff94473e34898bb2ea97c2b1be3e9d9f712347d30474a

SHA512
9ef8fe28f6bb5fe77ed93b63ddf60ba1d9f73c1be445611499e95eac568d343cf820a1ee86161dbac84764e0c0d29740acfecc5aa4fbef9d44888a1e0ffdc1bf

Download Submit
C:\Windows\System\hXHdaJm.exe

Filesize
1.5MB

MD5
a6f070132f4935f2642abbca75299dc5

SHA1
2c7303a16a7605b4e8c7f11565d85e802d5d4afd

SHA256
3d3eab04c748e2b08ec4df099c5a0e92c0e64f64f0e9069bb1342afbffa66c61

SHA512
f81a597381391d640eb539dd7dfaf4002fe1a27f527d326737449f1a349df4a478a4293a3752a095da595e9fb6237c9c5e7f2b46eb17d776c2ae04feafb56736

Download Submit
C:\Windows\System\izOQXJX.exe

Filesize
1.5MB

MD5
5eb2bac6e81cb69a24a16052018d655f

SHA1
e6480bc012eae82a015fe8d5106212d960fe74f7

SHA256
78311a381783afc73551495ee34f66ac697421590e24c51519ae07dde1ecdc4d

SHA512
f71976171ec26fd86a9ead141eee7b2652483955c55f8340552da044046c887c937e759e3474ac38a0a002fea37786eccebc8860aa19d587bea8864519de9252

Download Submit
C:\Windows\System\lUXnHFy.exe

Filesize
1.5MB

MD5
ea297a4a36092215a6b3bd00d39c29e3

SHA1
09c55c7500ed14d75ce2b67e30177db406f01646

SHA256
676d85c54ce887d92d8c265b344e7037f9ede636477bdd07302ae380c854eb98

SHA512
1a29f54518da24db28a0d2c81688d007edcf13230b59396a126eb4de10fa0182282609beef56a07504e63c097dd10b606a1b3e6b72e71cc42b225a780e94358b

Download Submit
C:\Windows\System\mUaouQT.exe

Filesize
1.5MB

MD5
f8c55f0e8ed5559a9755483478d761df

SHA1
467734bf95ddb735bc2c351e92fc1bc3adaab74c

SHA256
b66ef51ccadafa676096cce23efe4c8d519f01e8a0d03469f622e5a963bd2444

SHA512
6ebba48e47c5e802f96311830da9c968e30cfefebc64ecfd7e63c5813cf65333d3a7c5741679b75075c4733bfbddcf48a5f850cdf9d30469dea7e98dd3a4efce

Download Submit
C:\Windows\System\uQNmxZN.exe

Filesize
1.5MB

MD5
380ffdff86fcbc572621760886195404

SHA1
14c8446b6537accfc49db9121b381c6da9798b2b

SHA256
ee3b83763467e957b6278ae225c38aa1a043adce8df2671d2772b874aa50b3d8

SHA512
69f1c2b0b3ef9ab690b0f989b548a65330ab13681dca558a78ee3dbcb685fdfa9df578034e687f904808776acc2f868c6ed00d733683ba647f48447dbbecf080

Download Submit
C:\Windows\System\ztLIwiY.exe

Filesize
1.5MB

MD5
d923b39afa3fe1d1f9f0e8f40ed7959f

SHA1
f55baa9d614ff2c3902323c7c4f508f76139cfb5

SHA256
690499734b920a80d73a7435f5a3c49f4f39d6d491b597aa0d53daa26132cd73

SHA512
a07966e32d78933600206a235048c7a57d34a55dee73433c6def7a69a64513c9f8d77d01186148a61a888ecd4b862fbccd0306d1b5effafb6cfbab40782e79c5

Download Submit
memory/1672-0-0x0000022F16ED0000-0x0000022F16EE0000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads