xmrig | 25775db770ea199843210bb4357b2c6e45bfeed99ae9434c4aa36f4f0005845d

Analysis

max time kernel
135s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
19/11/2024, 20:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

25775db770ea199843210bb4357b2c6e45bfeed99ae9434c4aa36f4f0005845d.exe
Size

1000KB
MD5

391e949397581941b35acef960c7ce53
SHA1

20c6b1992c6cdf87ab7ca1ea9e52685c75bb5d67
SHA256

25775db770ea199843210bb4357b2c6e45bfeed99ae9434c4aa36f4f0005845d
SHA512

ae588871fad771471dba7321f6f87a8369eaefa9a83ee19cae3d8aac05f54e54a56b2477168aea27119869c5829eea66db9ee83254c3581e6a4462174b454306
SSDEEP

24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbpwlKenszTp3doNjJKv:GezaTF8FcNkNdfE0pZ9ozttwIRTV

Score

10^/10

xmrig miner persistence privilege_escalation

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 32 IoCs

miner

resource	yara_rule
behavioral2/files/0x000d000000023af9-4.dat	xmrig
behavioral2/files/0x000a000000023b86-18.dat	xmrig
behavioral2/files/0x000a000000023b9c-74.dat	xmrig
behavioral2/files/0x0009000000023bb2-113.dat	xmrig
behavioral2/files/0x0008000000023bbd-143.dat	xmrig
behavioral2/files/0x0008000000023bee-155.dat	xmrig
behavioral2/files/0x0008000000023bbf-153.dat	xmrig
behavioral2/files/0x0008000000023bbe-151.dat	xmrig
behavioral2/files/0x0008000000023bbc-149.dat	xmrig
behavioral2/files/0x0008000000023bb9-147.dat	xmrig
behavioral2/files/0x000e000000023bb7-145.dat	xmrig
behavioral2/files/0x0009000000023bb3-141.dat	xmrig
behavioral2/files/0x000a000000023b91-138.dat	xmrig
behavioral2/files/0x0009000000023bb1-133.dat	xmrig
behavioral2/files/0x000b000000023b94-123.dat	xmrig
behavioral2/files/0x000b000000023b92-116.dat	xmrig
behavioral2/files/0x000a000000023b8b-106.dat	xmrig
behavioral2/files/0x000a000000023b8f-102.dat	xmrig
behavioral2/files/0x0008000000023bef-159.dat	xmrig
behavioral2/files/0x000a000000023b90-100.dat	xmrig
behavioral2/files/0x000b000000023b93-94.dat	xmrig
behavioral2/files/0x0008000000023bac-93.dat	xmrig
behavioral2/files/0x000e000000023ba3-90.dat	xmrig
behavioral2/files/0x000a000000023b8e-87.dat	xmrig
behavioral2/files/0x000a000000023b8d-84.dat	xmrig
behavioral2/files/0x000a000000023b8a-79.dat	xmrig
behavioral2/files/0x000a000000023b89-69.dat	xmrig
behavioral2/files/0x000a000000023b8c-65.dat	xmrig
behavioral2/files/0x000a000000023b88-62.dat	xmrig
behavioral2/files/0x000a000000023b87-41.dat	xmrig
behavioral2/files/0x000a000000023b85-22.dat	xmrig
behavioral2/files/0x000a000000023b84-9.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2136	uggDqBT.exe
956	vboSPNa.exe
2652	NXmRkBA.exe
2568	GltQMLq.exe
3112	bcejoCY.exe
4388	xxQIsvW.exe
756	mssKhlA.exe
4316	qdOLlZR.exe
3564	eTPUdUp.exe
1788	frbNyTk.exe
864	sTnUQBP.exe
4848	ilRXMIl.exe
2188	txpyxiv.exe
3544	rbfQesZ.exe
2468	teFZNae.exe
676	NTzNBpu.exe
2156	YbpPsCL.exe
1240	SyfQJBB.exe
1268	ULOfwhf.exe
1652	hcMjSvx.exe
1628	sDgtJzI.exe
3128	qxTjapf.exe
4672	qluyXoH.exe
1072	QdfCSCT.exe
3492	BoiyjoD.exe
1504	dFyBHig.exe
3580	qVmcHBH.exe
2732	PvvHRVc.exe
1936	YcsAxYK.exe
1560	wGwyAhw.exe
644	KmyGOsK.exe
4056	TuDdfRe.exe
4452	dStHFNI.exe
2948	ZEAtiba.exe
2640	QfTywkg.exe
2596	uvLgyoO.exe
1052	oTruzTM.exe
1424	ALIqVYd.exe
4144	bypRLFR.exe
4028	jyFpfQP.exe
4004	pFEyzMD.exe
4480	NBmfnMW.exe
1200	paEHCyo.exe
4044	bZWNFou.exe
1104	yDHnrcZ.exe
2336	eIndguZ.exe
4160	ZcbJrBA.exe
3932	uiuXcvq.exe
3944	ylcttaS.exe
4396	zcrrTmw.exe
2084	thTIruR.exe
2592	CAlXRTQ.exe
3176	spdpejZ.exe
1192	WqWMQpu.exe
1204	psaJNnK.exe
4348	IAORdIM.exe
2564	zILrfPg.exe
2348	CdcwQtD.exe
1216	zjBAQCR.exe
2632	LmmdhJK.exe
3928	PAaRRhh.exe
4692	NVxKYVu.exe
4632	MtdHAIH.exe
432	wIIxgQF.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\MSeCIrQ.exe	25775db770ea199843210bb4357b2c6e45bfeed99ae9434c4aa36f4f0005845d.exe
File created	C:\Windows\System\OcEnzpE.exe	25775db770ea199843210bb4357b2c6e45bfeed99ae9434c4aa36f4f0005845d.exe
File created	C:\Windows\System\KQigIwp.exe	25775db770ea199843210bb4357b2c6e45bfeed99ae9434c4aa36f4f0005845d.exe
File created	C:\Windows\System\XPNcnGd.exe	25775db770ea199843210bb4357b2c6e45bfeed99ae9434c4aa36f4f0005845d.exe
File created	C:\Windows\System\jXCnixv.exe	25775db770ea199843210bb4357b2c6e45bfeed99ae9434c4aa36f4f0005845d.exe
File created	C:\Windows\System\eoIUozH.exe	25775db770ea199843210bb4357b2c6e45bfeed99ae9434c4aa36f4f0005845d.exe
File created	C:\Windows\System\sHmXUHD.exe	25775db770ea199843210bb4357b2c6e45bfeed99ae9434c4aa36f4f0005845d.exe
File created	C:\Windows\System\BaKdyKB.exe	25775db770ea199843210bb4357b2c6e45bfeed99ae9434c4aa36f4f0005845d.exe
File created	C:\Windows\System\qpeKpvG.exe	25775db770ea199843210bb4357b2c6e45bfeed99ae9434c4aa36f4f0005845d.exe
File created	C:\Windows\System\WlcXnTP.exe	25775db770ea199843210bb4357b2c6e45bfeed99ae9434c4aa36f4f0005845d.exe
File created	C:\Windows\System\sOcKkTJ.exe	25775db770ea199843210bb4357b2c6e45bfeed99ae9434c4aa36f4f0005845d.exe
File created	C:\Windows\System\npcyEmt.exe	25775db770ea199843210bb4357b2c6e45bfeed99ae9434c4aa36f4f0005845d.exe
File created	C:\Windows\System\uqVdXCb.exe	25775db770ea199843210bb4357b2c6e45bfeed99ae9434c4aa36f4f0005845d.exe
File created	C:\Windows\System\tVQqqnJ.exe	25775db770ea199843210bb4357b2c6e45bfeed99ae9434c4aa36f4f0005845d.exe
File created	C:\Windows\System\bJJsXEw.exe	25775db770ea199843210bb4357b2c6e45bfeed99ae9434c4aa36f4f0005845d.exe
File created	C:\Windows\System\yZwMTHg.exe	25775db770ea199843210bb4357b2c6e45bfeed99ae9434c4aa36f4f0005845d.exe
File created	C:\Windows\System\iFjtFGv.exe	25775db770ea199843210bb4357b2c6e45bfeed99ae9434c4aa36f4f0005845d.exe
File created	C:\Windows\System\avrJQFl.exe	25775db770ea199843210bb4357b2c6e45bfeed99ae9434c4aa36f4f0005845d.exe
File created	C:\Windows\System\qoeGlpL.exe	25775db770ea199843210bb4357b2c6e45bfeed99ae9434c4aa36f4f0005845d.exe
File created	C:\Windows\System\oHBKBQY.exe	25775db770ea199843210bb4357b2c6e45bfeed99ae9434c4aa36f4f0005845d.exe
File created	C:\Windows\System\eJaGaNd.exe	25775db770ea199843210bb4357b2c6e45bfeed99ae9434c4aa36f4f0005845d.exe
File created	C:\Windows\System\NTzNBpu.exe	25775db770ea199843210bb4357b2c6e45bfeed99ae9434c4aa36f4f0005845d.exe
File created	C:\Windows\System\kpWcWWF.exe	25775db770ea199843210bb4357b2c6e45bfeed99ae9434c4aa36f4f0005845d.exe
File created	C:\Windows\System\tmNTCdc.exe	25775db770ea199843210bb4357b2c6e45bfeed99ae9434c4aa36f4f0005845d.exe
File created	C:\Windows\System\AwLYqWj.exe	25775db770ea199843210bb4357b2c6e45bfeed99ae9434c4aa36f4f0005845d.exe
File created	C:\Windows\System\PsvNCVW.exe	25775db770ea199843210bb4357b2c6e45bfeed99ae9434c4aa36f4f0005845d.exe
File created	C:\Windows\System\iBFhtSQ.exe	25775db770ea199843210bb4357b2c6e45bfeed99ae9434c4aa36f4f0005845d.exe
File created	C:\Windows\System\ovwMPgk.exe	25775db770ea199843210bb4357b2c6e45bfeed99ae9434c4aa36f4f0005845d.exe
File created	C:\Windows\System\ejwrqwV.exe	25775db770ea199843210bb4357b2c6e45bfeed99ae9434c4aa36f4f0005845d.exe
File created	C:\Windows\System\MWURgkZ.exe	25775db770ea199843210bb4357b2c6e45bfeed99ae9434c4aa36f4f0005845d.exe
File created	C:\Windows\System\fQPLRqa.exe	25775db770ea199843210bb4357b2c6e45bfeed99ae9434c4aa36f4f0005845d.exe
File created	C:\Windows\System\mNNBTas.exe	25775db770ea199843210bb4357b2c6e45bfeed99ae9434c4aa36f4f0005845d.exe
File created	C:\Windows\System\evaCRoh.exe	25775db770ea199843210bb4357b2c6e45bfeed99ae9434c4aa36f4f0005845d.exe
File created	C:\Windows\System\QsPifcR.exe	25775db770ea199843210bb4357b2c6e45bfeed99ae9434c4aa36f4f0005845d.exe
File created	C:\Windows\System\BMeNYML.exe	25775db770ea199843210bb4357b2c6e45bfeed99ae9434c4aa36f4f0005845d.exe
File created	C:\Windows\System\nADEhaq.exe	25775db770ea199843210bb4357b2c6e45bfeed99ae9434c4aa36f4f0005845d.exe
File created	C:\Windows\System\LGRPMXN.exe	25775db770ea199843210bb4357b2c6e45bfeed99ae9434c4aa36f4f0005845d.exe
File created	C:\Windows\System\sULXJRR.exe	25775db770ea199843210bb4357b2c6e45bfeed99ae9434c4aa36f4f0005845d.exe
File created	C:\Windows\System\nSbDkbR.exe	25775db770ea199843210bb4357b2c6e45bfeed99ae9434c4aa36f4f0005845d.exe
File created	C:\Windows\System\oTikpdZ.exe	25775db770ea199843210bb4357b2c6e45bfeed99ae9434c4aa36f4f0005845d.exe
File created	C:\Windows\System\fZBiTQE.exe	25775db770ea199843210bb4357b2c6e45bfeed99ae9434c4aa36f4f0005845d.exe
File created	C:\Windows\System\xyHvFRh.exe	25775db770ea199843210bb4357b2c6e45bfeed99ae9434c4aa36f4f0005845d.exe
File created	C:\Windows\System\MbHZaIN.exe	25775db770ea199843210bb4357b2c6e45bfeed99ae9434c4aa36f4f0005845d.exe
File created	C:\Windows\System\gFlxkQI.exe	25775db770ea199843210bb4357b2c6e45bfeed99ae9434c4aa36f4f0005845d.exe
File created	C:\Windows\System\ojEGjoX.exe	25775db770ea199843210bb4357b2c6e45bfeed99ae9434c4aa36f4f0005845d.exe
File created	C:\Windows\System\rvMswsV.exe	25775db770ea199843210bb4357b2c6e45bfeed99ae9434c4aa36f4f0005845d.exe
File created	C:\Windows\System\odGHgDp.exe	25775db770ea199843210bb4357b2c6e45bfeed99ae9434c4aa36f4f0005845d.exe
File created	C:\Windows\System\ZiQKkGO.exe	25775db770ea199843210bb4357b2c6e45bfeed99ae9434c4aa36f4f0005845d.exe
File created	C:\Windows\System\NneZMVE.exe	25775db770ea199843210bb4357b2c6e45bfeed99ae9434c4aa36f4f0005845d.exe
File created	C:\Windows\System\PWVaeuR.exe	25775db770ea199843210bb4357b2c6e45bfeed99ae9434c4aa36f4f0005845d.exe
File created	C:\Windows\System\HdRQekV.exe	25775db770ea199843210bb4357b2c6e45bfeed99ae9434c4aa36f4f0005845d.exe
File created	C:\Windows\System\CAlXRTQ.exe	25775db770ea199843210bb4357b2c6e45bfeed99ae9434c4aa36f4f0005845d.exe
File created	C:\Windows\System\RtjGEur.exe	25775db770ea199843210bb4357b2c6e45bfeed99ae9434c4aa36f4f0005845d.exe
File created	C:\Windows\System\TarwmjS.exe	25775db770ea199843210bb4357b2c6e45bfeed99ae9434c4aa36f4f0005845d.exe
File created	C:\Windows\System\nvRxjJQ.exe	25775db770ea199843210bb4357b2c6e45bfeed99ae9434c4aa36f4f0005845d.exe
File created	C:\Windows\System\yPTLPdz.exe	25775db770ea199843210bb4357b2c6e45bfeed99ae9434c4aa36f4f0005845d.exe
File created	C:\Windows\System\LRYaEKm.exe	25775db770ea199843210bb4357b2c6e45bfeed99ae9434c4aa36f4f0005845d.exe
File created	C:\Windows\System\thTIruR.exe	25775db770ea199843210bb4357b2c6e45bfeed99ae9434c4aa36f4f0005845d.exe
File created	C:\Windows\System\eypOBmq.exe	25775db770ea199843210bb4357b2c6e45bfeed99ae9434c4aa36f4f0005845d.exe
File created	C:\Windows\System\BbTckef.exe	25775db770ea199843210bb4357b2c6e45bfeed99ae9434c4aa36f4f0005845d.exe
File created	C:\Windows\System\RrybYVD.exe	25775db770ea199843210bb4357b2c6e45bfeed99ae9434c4aa36f4f0005845d.exe
File created	C:\Windows\System\lpLWbpM.exe	25775db770ea199843210bb4357b2c6e45bfeed99ae9434c4aa36f4f0005845d.exe
File created	C:\Windows\System\izpAGQO.exe	25775db770ea199843210bb4357b2c6e45bfeed99ae9434c4aa36f4f0005845d.exe
File created	C:\Windows\System\AziwXBs.exe	25775db770ea199843210bb4357b2c6e45bfeed99ae9434c4aa36f4f0005845d.exe

Event Triggered Execution: Accessibility Features 1 TTPs
Windows contains accessibility features that may be used by adversaries to establish persistence and/or elevate privileges.
persistence privilege_escalation

Accessibility Features
T1546.008

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	17372	dwm.exe
Token: SeChangeNotifyPrivilege	17372	dwm.exe
Token: 33	17372	dwm.exe
Token: SeIncBasePriorityPrivilege	17372	dwm.exe
Token: SeShutdownPrivilege	17372	dwm.exe
Token: SeCreatePagefilePrivilege	17372	dwm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3588 wrote to memory of 2136	3588	25775db770ea199843210bb4357b2c6e45bfeed99ae9434c4aa36f4f0005845d.exe	86
PID 3588 wrote to memory of 2136	3588	25775db770ea199843210bb4357b2c6e45bfeed99ae9434c4aa36f4f0005845d.exe	86
PID 3588 wrote to memory of 956	3588	25775db770ea199843210bb4357b2c6e45bfeed99ae9434c4aa36f4f0005845d.exe	87
PID 3588 wrote to memory of 956	3588	25775db770ea199843210bb4357b2c6e45bfeed99ae9434c4aa36f4f0005845d.exe	87
PID 3588 wrote to memory of 2652	3588	25775db770ea199843210bb4357b2c6e45bfeed99ae9434c4aa36f4f0005845d.exe	88
PID 3588 wrote to memory of 2652	3588	25775db770ea199843210bb4357b2c6e45bfeed99ae9434c4aa36f4f0005845d.exe	88
PID 3588 wrote to memory of 2568	3588	25775db770ea199843210bb4357b2c6e45bfeed99ae9434c4aa36f4f0005845d.exe	89
PID 3588 wrote to memory of 2568	3588	25775db770ea199843210bb4357b2c6e45bfeed99ae9434c4aa36f4f0005845d.exe	89
PID 3588 wrote to memory of 3112	3588	25775db770ea199843210bb4357b2c6e45bfeed99ae9434c4aa36f4f0005845d.exe	90
PID 3588 wrote to memory of 3112	3588	25775db770ea199843210bb4357b2c6e45bfeed99ae9434c4aa36f4f0005845d.exe	90
PID 3588 wrote to memory of 4388	3588	25775db770ea199843210bb4357b2c6e45bfeed99ae9434c4aa36f4f0005845d.exe	91
PID 3588 wrote to memory of 4388	3588	25775db770ea199843210bb4357b2c6e45bfeed99ae9434c4aa36f4f0005845d.exe	91
PID 3588 wrote to memory of 756	3588	25775db770ea199843210bb4357b2c6e45bfeed99ae9434c4aa36f4f0005845d.exe	92
PID 3588 wrote to memory of 756	3588	25775db770ea199843210bb4357b2c6e45bfeed99ae9434c4aa36f4f0005845d.exe	92
PID 3588 wrote to memory of 4316	3588	25775db770ea199843210bb4357b2c6e45bfeed99ae9434c4aa36f4f0005845d.exe	93
PID 3588 wrote to memory of 4316	3588	25775db770ea199843210bb4357b2c6e45bfeed99ae9434c4aa36f4f0005845d.exe	93
PID 3588 wrote to memory of 3544	3588	25775db770ea199843210bb4357b2c6e45bfeed99ae9434c4aa36f4f0005845d.exe	94
PID 3588 wrote to memory of 3544	3588	25775db770ea199843210bb4357b2c6e45bfeed99ae9434c4aa36f4f0005845d.exe	94
PID 3588 wrote to memory of 3564	3588	25775db770ea199843210bb4357b2c6e45bfeed99ae9434c4aa36f4f0005845d.exe	95
PID 3588 wrote to memory of 3564	3588	25775db770ea199843210bb4357b2c6e45bfeed99ae9434c4aa36f4f0005845d.exe	95
PID 3588 wrote to memory of 1788	3588	25775db770ea199843210bb4357b2c6e45bfeed99ae9434c4aa36f4f0005845d.exe	96
PID 3588 wrote to memory of 1788	3588	25775db770ea199843210bb4357b2c6e45bfeed99ae9434c4aa36f4f0005845d.exe	96
PID 3588 wrote to memory of 864	3588	25775db770ea199843210bb4357b2c6e45bfeed99ae9434c4aa36f4f0005845d.exe	97
PID 3588 wrote to memory of 864	3588	25775db770ea199843210bb4357b2c6e45bfeed99ae9434c4aa36f4f0005845d.exe	97
PID 3588 wrote to memory of 4848	3588	25775db770ea199843210bb4357b2c6e45bfeed99ae9434c4aa36f4f0005845d.exe	98
PID 3588 wrote to memory of 4848	3588	25775db770ea199843210bb4357b2c6e45bfeed99ae9434c4aa36f4f0005845d.exe	98
PID 3588 wrote to memory of 2188	3588	25775db770ea199843210bb4357b2c6e45bfeed99ae9434c4aa36f4f0005845d.exe	99
PID 3588 wrote to memory of 2188	3588	25775db770ea199843210bb4357b2c6e45bfeed99ae9434c4aa36f4f0005845d.exe	99
PID 3588 wrote to memory of 2156	3588	25775db770ea199843210bb4357b2c6e45bfeed99ae9434c4aa36f4f0005845d.exe	100
PID 3588 wrote to memory of 2156	3588	25775db770ea199843210bb4357b2c6e45bfeed99ae9434c4aa36f4f0005845d.exe	100
PID 3588 wrote to memory of 1652	3588	25775db770ea199843210bb4357b2c6e45bfeed99ae9434c4aa36f4f0005845d.exe	101
PID 3588 wrote to memory of 1652	3588	25775db770ea199843210bb4357b2c6e45bfeed99ae9434c4aa36f4f0005845d.exe	101
PID 3588 wrote to memory of 2468	3588	25775db770ea199843210bb4357b2c6e45bfeed99ae9434c4aa36f4f0005845d.exe	102
PID 3588 wrote to memory of 2468	3588	25775db770ea199843210bb4357b2c6e45bfeed99ae9434c4aa36f4f0005845d.exe	102
PID 3588 wrote to memory of 1628	3588	25775db770ea199843210bb4357b2c6e45bfeed99ae9434c4aa36f4f0005845d.exe	103
PID 3588 wrote to memory of 1628	3588	25775db770ea199843210bb4357b2c6e45bfeed99ae9434c4aa36f4f0005845d.exe	103
PID 3588 wrote to memory of 676	3588	25775db770ea199843210bb4357b2c6e45bfeed99ae9434c4aa36f4f0005845d.exe	104
PID 3588 wrote to memory of 676	3588	25775db770ea199843210bb4357b2c6e45bfeed99ae9434c4aa36f4f0005845d.exe	104
PID 3588 wrote to memory of 1240	3588	25775db770ea199843210bb4357b2c6e45bfeed99ae9434c4aa36f4f0005845d.exe	105
PID 3588 wrote to memory of 1240	3588	25775db770ea199843210bb4357b2c6e45bfeed99ae9434c4aa36f4f0005845d.exe	105
PID 3588 wrote to memory of 1268	3588	25775db770ea199843210bb4357b2c6e45bfeed99ae9434c4aa36f4f0005845d.exe	106
PID 3588 wrote to memory of 1268	3588	25775db770ea199843210bb4357b2c6e45bfeed99ae9434c4aa36f4f0005845d.exe	106
PID 3588 wrote to memory of 3128	3588	25775db770ea199843210bb4357b2c6e45bfeed99ae9434c4aa36f4f0005845d.exe	107
PID 3588 wrote to memory of 3128	3588	25775db770ea199843210bb4357b2c6e45bfeed99ae9434c4aa36f4f0005845d.exe	107
PID 3588 wrote to memory of 4672	3588	25775db770ea199843210bb4357b2c6e45bfeed99ae9434c4aa36f4f0005845d.exe	108
PID 3588 wrote to memory of 4672	3588	25775db770ea199843210bb4357b2c6e45bfeed99ae9434c4aa36f4f0005845d.exe	108
PID 3588 wrote to memory of 1072	3588	25775db770ea199843210bb4357b2c6e45bfeed99ae9434c4aa36f4f0005845d.exe	109
PID 3588 wrote to memory of 1072	3588	25775db770ea199843210bb4357b2c6e45bfeed99ae9434c4aa36f4f0005845d.exe	109
PID 3588 wrote to memory of 3492	3588	25775db770ea199843210bb4357b2c6e45bfeed99ae9434c4aa36f4f0005845d.exe	110
PID 3588 wrote to memory of 3492	3588	25775db770ea199843210bb4357b2c6e45bfeed99ae9434c4aa36f4f0005845d.exe	110
PID 3588 wrote to memory of 1504	3588	25775db770ea199843210bb4357b2c6e45bfeed99ae9434c4aa36f4f0005845d.exe	111
PID 3588 wrote to memory of 1504	3588	25775db770ea199843210bb4357b2c6e45bfeed99ae9434c4aa36f4f0005845d.exe	111
PID 3588 wrote to memory of 3580	3588	25775db770ea199843210bb4357b2c6e45bfeed99ae9434c4aa36f4f0005845d.exe	112
PID 3588 wrote to memory of 3580	3588	25775db770ea199843210bb4357b2c6e45bfeed99ae9434c4aa36f4f0005845d.exe	112
PID 3588 wrote to memory of 2732	3588	25775db770ea199843210bb4357b2c6e45bfeed99ae9434c4aa36f4f0005845d.exe	113
PID 3588 wrote to memory of 2732	3588	25775db770ea199843210bb4357b2c6e45bfeed99ae9434c4aa36f4f0005845d.exe	113
PID 3588 wrote to memory of 1936	3588	25775db770ea199843210bb4357b2c6e45bfeed99ae9434c4aa36f4f0005845d.exe	114
PID 3588 wrote to memory of 1936	3588	25775db770ea199843210bb4357b2c6e45bfeed99ae9434c4aa36f4f0005845d.exe	114
PID 3588 wrote to memory of 1560	3588	25775db770ea199843210bb4357b2c6e45bfeed99ae9434c4aa36f4f0005845d.exe	115
PID 3588 wrote to memory of 1560	3588	25775db770ea199843210bb4357b2c6e45bfeed99ae9434c4aa36f4f0005845d.exe	115
PID 3588 wrote to memory of 644	3588	25775db770ea199843210bb4357b2c6e45bfeed99ae9434c4aa36f4f0005845d.exe	116
PID 3588 wrote to memory of 644	3588	25775db770ea199843210bb4357b2c6e45bfeed99ae9434c4aa36f4f0005845d.exe	116
PID 3588 wrote to memory of 4056	3588	25775db770ea199843210bb4357b2c6e45bfeed99ae9434c4aa36f4f0005845d.exe	117
PID 3588 wrote to memory of 4056	3588	25775db770ea199843210bb4357b2c6e45bfeed99ae9434c4aa36f4f0005845d.exe	117

C:\Users\Admin\AppData\Local\Temp\25775db770ea199843210bb4357b2c6e45bfeed99ae9434c4aa36f4f0005845d.exe
"C:\Users\Admin\AppData\Local\Temp\25775db770ea199843210bb4357b2c6e45bfeed99ae9434c4aa36f4f0005845d.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3588
- C:\Windows\System\uggDqBT.exe
  C:\Windows\System\uggDqBT.exe
  2⤵
  - Executes dropped EXE
  PID:2136
- C:\Windows\System\vboSPNa.exe
  C:\Windows\System\vboSPNa.exe
  2⤵
  - Executes dropped EXE
  PID:956
- C:\Windows\System\NXmRkBA.exe
  C:\Windows\System\NXmRkBA.exe
  2⤵
  - Executes dropped EXE
  PID:2652
- C:\Windows\System\GltQMLq.exe
  C:\Windows\System\GltQMLq.exe
  2⤵
  - Executes dropped EXE
  PID:2568
- C:\Windows\System\bcejoCY.exe
  C:\Windows\System\bcejoCY.exe
  2⤵
  - Executes dropped EXE
  PID:3112
- C:\Windows\System\xxQIsvW.exe
  C:\Windows\System\xxQIsvW.exe
  2⤵
  - Executes dropped EXE
  PID:4388
- C:\Windows\System\mssKhlA.exe
  C:\Windows\System\mssKhlA.exe
  2⤵
  - Executes dropped EXE
  PID:756
- C:\Windows\System\qdOLlZR.exe
  C:\Windows\System\qdOLlZR.exe
  2⤵
  - Executes dropped EXE
  PID:4316
- C:\Windows\System\rbfQesZ.exe
  C:\Windows\System\rbfQesZ.exe
  2⤵
  - Executes dropped EXE
  PID:3544
- C:\Windows\System\eTPUdUp.exe
  C:\Windows\System\eTPUdUp.exe
  2⤵
  - Executes dropped EXE
  PID:3564
- C:\Windows\System\frbNyTk.exe
  C:\Windows\System\frbNyTk.exe
  2⤵
  - Executes dropped EXE
  PID:1788
- C:\Windows\System\sTnUQBP.exe
  C:\Windows\System\sTnUQBP.exe
  2⤵
  - Executes dropped EXE
  PID:864
- C:\Windows\System\ilRXMIl.exe
  C:\Windows\System\ilRXMIl.exe
  2⤵
  - Executes dropped EXE
  PID:4848
- C:\Windows\System\txpyxiv.exe
  C:\Windows\System\txpyxiv.exe
  2⤵
  - Executes dropped EXE
  PID:2188
- C:\Windows\System\YbpPsCL.exe
  C:\Windows\System\YbpPsCL.exe
  2⤵
  - Executes dropped EXE
  PID:2156
- C:\Windows\System\hcMjSvx.exe
  C:\Windows\System\hcMjSvx.exe
  2⤵
  - Executes dropped EXE
  PID:1652
- C:\Windows\System\teFZNae.exe
  C:\Windows\System\teFZNae.exe
  2⤵
  - Executes dropped EXE
  PID:2468
- C:\Windows\System\sDgtJzI.exe
  C:\Windows\System\sDgtJzI.exe
  2⤵
  - Executes dropped EXE
  PID:1628
- C:\Windows\System\NTzNBpu.exe
  C:\Windows\System\NTzNBpu.exe
  2⤵
  - Executes dropped EXE
  PID:676
- C:\Windows\System\SyfQJBB.exe
  C:\Windows\System\SyfQJBB.exe
  2⤵
  - Executes dropped EXE
  PID:1240
- C:\Windows\System\ULOfwhf.exe
  C:\Windows\System\ULOfwhf.exe
  2⤵
  - Executes dropped EXE
  PID:1268
- C:\Windows\System\qxTjapf.exe
  C:\Windows\System\qxTjapf.exe
  2⤵
  - Executes dropped EXE
  PID:3128
- C:\Windows\System\qluyXoH.exe
  C:\Windows\System\qluyXoH.exe
  2⤵
  - Executes dropped EXE
  PID:4672
- C:\Windows\System\QdfCSCT.exe
  C:\Windows\System\QdfCSCT.exe
  2⤵
  - Executes dropped EXE
  PID:1072
- C:\Windows\System\BoiyjoD.exe
  C:\Windows\System\BoiyjoD.exe
  2⤵
  - Executes dropped EXE
  PID:3492
- C:\Windows\System\dFyBHig.exe
  C:\Windows\System\dFyBHig.exe
  2⤵
  - Executes dropped EXE
  PID:1504
- C:\Windows\System\qVmcHBH.exe
  C:\Windows\System\qVmcHBH.exe
  2⤵
  - Executes dropped EXE
  PID:3580
- C:\Windows\System\PvvHRVc.exe
  C:\Windows\System\PvvHRVc.exe
  2⤵
  - Executes dropped EXE
  PID:2732
- C:\Windows\System\YcsAxYK.exe
  C:\Windows\System\YcsAxYK.exe
  2⤵
  - Executes dropped EXE
  PID:1936
- C:\Windows\System\wGwyAhw.exe
  C:\Windows\System\wGwyAhw.exe
  2⤵
  - Executes dropped EXE
  PID:1560
- C:\Windows\System\KmyGOsK.exe
  C:\Windows\System\KmyGOsK.exe
  2⤵
  - Executes dropped EXE
  PID:644
- C:\Windows\System\TuDdfRe.exe
  C:\Windows\System\TuDdfRe.exe
  2⤵
  - Executes dropped EXE
  PID:4056
- C:\Windows\System\dStHFNI.exe
  C:\Windows\System\dStHFNI.exe
  2⤵
  - Executes dropped EXE
  PID:4452
- C:\Windows\System\ZEAtiba.exe
  C:\Windows\System\ZEAtiba.exe
  2⤵
  - Executes dropped EXE
  PID:2948
- C:\Windows\System\QfTywkg.exe
  C:\Windows\System\QfTywkg.exe
  2⤵
  - Executes dropped EXE
  PID:2640
- C:\Windows\System\uvLgyoO.exe
  C:\Windows\System\uvLgyoO.exe
  2⤵
  - Executes dropped EXE
  PID:2596
- C:\Windows\System\oTruzTM.exe
  C:\Windows\System\oTruzTM.exe
  2⤵
  - Executes dropped EXE
  PID:1052
- C:\Windows\System\jyFpfQP.exe
  C:\Windows\System\jyFpfQP.exe
  2⤵
  - Executes dropped EXE
  PID:4028
- C:\Windows\System\ALIqVYd.exe
  C:\Windows\System\ALIqVYd.exe
  2⤵
  - Executes dropped EXE
  PID:1424
- C:\Windows\System\bypRLFR.exe
  C:\Windows\System\bypRLFR.exe
  2⤵
  - Executes dropped EXE
  PID:4144
- C:\Windows\System\paEHCyo.exe
  C:\Windows\System\paEHCyo.exe
  2⤵
  - Executes dropped EXE
  PID:1200
- C:\Windows\System\pFEyzMD.exe
  C:\Windows\System\pFEyzMD.exe
  2⤵
  - Executes dropped EXE
  PID:4004
- C:\Windows\System\NBmfnMW.exe
  C:\Windows\System\NBmfnMW.exe
  2⤵
  - Executes dropped EXE
  PID:4480
- C:\Windows\System\bZWNFou.exe
  C:\Windows\System\bZWNFou.exe
  2⤵
  - Executes dropped EXE
  PID:4044
- C:\Windows\System\yDHnrcZ.exe
  C:\Windows\System\yDHnrcZ.exe
  2⤵
  - Executes dropped EXE
  PID:1104
- C:\Windows\System\eIndguZ.exe
  C:\Windows\System\eIndguZ.exe
  2⤵
  - Executes dropped EXE
  PID:2336
- C:\Windows\System\ZcbJrBA.exe
  C:\Windows\System\ZcbJrBA.exe
  2⤵
  - Executes dropped EXE
  PID:4160
- C:\Windows\System\zcrrTmw.exe
  C:\Windows\System\zcrrTmw.exe
  2⤵
  - Executes dropped EXE
  PID:4396
- C:\Windows\System\uiuXcvq.exe
  C:\Windows\System\uiuXcvq.exe
  2⤵
  - Executes dropped EXE
  PID:3932
- C:\Windows\System\ylcttaS.exe
  C:\Windows\System\ylcttaS.exe
  2⤵
  - Executes dropped EXE
  PID:3944
- C:\Windows\System\spdpejZ.exe
  C:\Windows\System\spdpejZ.exe
  2⤵
  - Executes dropped EXE
  PID:3176
- C:\Windows\System\WqWMQpu.exe
  C:\Windows\System\WqWMQpu.exe
  2⤵
  - Executes dropped EXE
  PID:1192
- C:\Windows\System\thTIruR.exe
  C:\Windows\System\thTIruR.exe
  2⤵
  - Executes dropped EXE
  PID:2084
- C:\Windows\System\CAlXRTQ.exe
  C:\Windows\System\CAlXRTQ.exe
  2⤵
  - Executes dropped EXE
  PID:2592
- C:\Windows\System\zILrfPg.exe
  C:\Windows\System\zILrfPg.exe
  2⤵
  - Executes dropped EXE
  PID:2564
- C:\Windows\System\psaJNnK.exe
  C:\Windows\System\psaJNnK.exe
  2⤵
  - Executes dropped EXE
  PID:1204
- C:\Windows\System\IAORdIM.exe
  C:\Windows\System\IAORdIM.exe
  2⤵
  - Executes dropped EXE
  PID:4348
- C:\Windows\System\LmmdhJK.exe
  C:\Windows\System\LmmdhJK.exe
  2⤵
  - Executes dropped EXE
  PID:2632
- C:\Windows\System\CdcwQtD.exe
  C:\Windows\System\CdcwQtD.exe
  2⤵
  - Executes dropped EXE
  PID:2348
- C:\Windows\System\zjBAQCR.exe
  C:\Windows\System\zjBAQCR.exe
  2⤵
  - Executes dropped EXE
  PID:1216
- C:\Windows\System\PAaRRhh.exe
  C:\Windows\System\PAaRRhh.exe
  2⤵
  - Executes dropped EXE
  PID:3928
- C:\Windows\System\UErnjFb.exe
  C:\Windows\System\UErnjFb.exe
  2⤵
  PID:4184
- C:\Windows\System\NVxKYVu.exe
  C:\Windows\System\NVxKYVu.exe
  2⤵
  - Executes dropped EXE
  PID:4692
- C:\Windows\System\MtdHAIH.exe
  C:\Windows\System\MtdHAIH.exe
  2⤵
  - Executes dropped EXE
  PID:4632
- C:\Windows\System\wIIxgQF.exe
  C:\Windows\System\wIIxgQF.exe
  2⤵
  - Executes dropped EXE
  PID:432
- C:\Windows\System\scMjxid.exe
  C:\Windows\System\scMjxid.exe
  2⤵
  PID:4788
- C:\Windows\System\KnxzXsC.exe
  C:\Windows\System\KnxzXsC.exe
  2⤵
  PID:2280
- C:\Windows\System\UgWOkVj.exe
  C:\Windows\System\UgWOkVj.exe
  2⤵
  PID:2192
- C:\Windows\System\tuwjfQJ.exe
  C:\Windows\System\tuwjfQJ.exe
  2⤵
  PID:1768
- C:\Windows\System\drppWkI.exe
  C:\Windows\System\drppWkI.exe
  2⤵
  PID:2840
- C:\Windows\System\QxNQgyW.exe
  C:\Windows\System\QxNQgyW.exe
  2⤵
  PID:1948
- C:\Windows\System\vajpOQh.exe
  C:\Windows\System\vajpOQh.exe
  2⤵
  PID:1684
- C:\Windows\System\KAwWusD.exe
  C:\Windows\System\KAwWusD.exe
  2⤵
  PID:1452
- C:\Windows\System\qtDsWiw.exe
  C:\Windows\System\qtDsWiw.exe
  2⤵
  PID:4668
- C:\Windows\System\RqdHfxW.exe
  C:\Windows\System\RqdHfxW.exe
  2⤵
  PID:2416
- C:\Windows\System\iBFhtSQ.exe
  C:\Windows\System\iBFhtSQ.exe
  2⤵
  PID:2504
- C:\Windows\System\eUqKtgQ.exe
  C:\Windows\System\eUqKtgQ.exe
  2⤵
  PID:4844
- C:\Windows\System\JvTQkvc.exe
  C:\Windows\System\JvTQkvc.exe
  2⤵
  PID:3456
- C:\Windows\System\BPRkIub.exe
  C:\Windows\System\BPRkIub.exe
  2⤵
  PID:1080
- C:\Windows\System\KJLUIuT.exe
  C:\Windows\System\KJLUIuT.exe
  2⤵
  PID:1120
- C:\Windows\System\yPAvVWp.exe
  C:\Windows\System\yPAvVWp.exe
  2⤵
  PID:640
- C:\Windows\System\HxGyCwC.exe
  C:\Windows\System\HxGyCwC.exe
  2⤵
  PID:4444
- C:\Windows\System\FSVVxMO.exe
  C:\Windows\System\FSVVxMO.exe
  2⤵
  PID:3920
- C:\Windows\System\VcEMkeN.exe
  C:\Windows\System\VcEMkeN.exe
  2⤵
  PID:4456
- C:\Windows\System\vttOKQP.exe
  C:\Windows\System\vttOKQP.exe
  2⤵
  PID:2196
- C:\Windows\System\swHMpnL.exe
  C:\Windows\System\swHMpnL.exe
  2⤵
  PID:2052
- C:\Windows\System\jErwYXv.exe
  C:\Windows\System\jErwYXv.exe
  2⤵
  PID:2444
- C:\Windows\System\jPpUGCD.exe
  C:\Windows\System\jPpUGCD.exe
  2⤵
  PID:4180
- C:\Windows\System\IeXByeI.exe
  C:\Windows\System\IeXByeI.exe
  2⤵
  PID:3972
- C:\Windows\System\XZRWRWr.exe
  C:\Windows\System\XZRWRWr.exe
  2⤵
  PID:1984
- C:\Windows\System\fazLlyi.exe
  C:\Windows\System\fazLlyi.exe
  2⤵
  PID:4416
- C:\Windows\System\lSFAdIk.exe
  C:\Windows\System\lSFAdIk.exe
  2⤵
  PID:3408
- C:\Windows\System\oxLjhqN.exe
  C:\Windows\System\oxLjhqN.exe
  2⤵
  PID:1900
- C:\Windows\System\QdKpxck.exe
  C:\Windows\System\QdKpxck.exe
  2⤵
  PID:1660
- C:\Windows\System\uDemLdj.exe
  C:\Windows\System\uDemLdj.exe
  2⤵
  PID:2668
- C:\Windows\System\ALaIrRF.exe
  C:\Windows\System\ALaIrRF.exe
  2⤵
  PID:448
- C:\Windows\System\OhRePQH.exe
  C:\Windows\System\OhRePQH.exe
  2⤵
  PID:4012
- C:\Windows\System\jZdcZcW.exe
  C:\Windows\System\jZdcZcW.exe
  2⤵
  PID:4476
- C:\Windows\System\NjeGcoU.exe
  C:\Windows\System\NjeGcoU.exe
  2⤵
  PID:2056
- C:\Windows\System\LpAQlis.exe
  C:\Windows\System\LpAQlis.exe
  2⤵
  PID:4648
- C:\Windows\System\dXkalZs.exe
  C:\Windows\System\dXkalZs.exe
  2⤵
  PID:3532
- C:\Windows\System\tjSodwi.exe
  C:\Windows\System\tjSodwi.exe
  2⤵
  PID:2960
- C:\Windows\System\LhLHnuq.exe
  C:\Windows\System\LhLHnuq.exe
  2⤵
  PID:1020
- C:\Windows\System\FLrmuZK.exe
  C:\Windows\System\FLrmuZK.exe
  2⤵
  PID:5136
- C:\Windows\System\uLjhgAk.exe
  C:\Windows\System\uLjhgAk.exe
  2⤵
  PID:5172
- C:\Windows\System\XRQOItc.exe
  C:\Windows\System\XRQOItc.exe
  2⤵
  PID:5200
- C:\Windows\System\ZGgWspb.exe
  C:\Windows\System\ZGgWspb.exe
  2⤵
  PID:5228
- C:\Windows\System\iIpRVSW.exe
  C:\Windows\System\iIpRVSW.exe
  2⤵
  PID:5256
- C:\Windows\System\lSlwxFO.exe
  C:\Windows\System\lSlwxFO.exe
  2⤵
  PID:5296
- C:\Windows\System\evaCRoh.exe
  C:\Windows\System\evaCRoh.exe
  2⤵
  PID:5316
- C:\Windows\System\djbbXlh.exe
  C:\Windows\System\djbbXlh.exe
  2⤵
  PID:5340
- C:\Windows\System\rvMswsV.exe
  C:\Windows\System\rvMswsV.exe
  2⤵
  PID:5360
- C:\Windows\System\lRZSAQK.exe
  C:\Windows\System\lRZSAQK.exe
  2⤵
  PID:5384
- C:\Windows\System\NHKcTpu.exe
  C:\Windows\System\NHKcTpu.exe
  2⤵
  PID:5416
- C:\Windows\System\IZknPzv.exe
  C:\Windows\System\IZknPzv.exe
  2⤵
  PID:5436
- C:\Windows\System\PTzKjhz.exe
  C:\Windows\System\PTzKjhz.exe
  2⤵
  PID:5468
- C:\Windows\System\eNkvbPE.exe
  C:\Windows\System\eNkvbPE.exe
  2⤵
  PID:5508
- C:\Windows\System\XxtSnMo.exe
  C:\Windows\System\XxtSnMo.exe
  2⤵
  PID:5532
- C:\Windows\System\ewiZWcP.exe
  C:\Windows\System\ewiZWcP.exe
  2⤵
  PID:5556
- C:\Windows\System\cChumIr.exe
  C:\Windows\System\cChumIr.exe
  2⤵
  PID:5584
- C:\Windows\System\wDBQiAL.exe
  C:\Windows\System\wDBQiAL.exe
  2⤵
  PID:5608
- C:\Windows\System\KUoeCIx.exe
  C:\Windows\System\KUoeCIx.exe
  2⤵
  PID:5636
- C:\Windows\System\sULXJRR.exe
  C:\Windows\System\sULXJRR.exe
  2⤵
  PID:5660
- C:\Windows\System\GvklmLz.exe
  C:\Windows\System\GvklmLz.exe
  2⤵
  PID:5688
- C:\Windows\System\MAlyawF.exe
  C:\Windows\System\MAlyawF.exe
  2⤵
  PID:5716
- C:\Windows\System\IkhUOxh.exe
  C:\Windows\System\IkhUOxh.exe
  2⤵
  PID:5740
- C:\Windows\System\soQIZGp.exe
  C:\Windows\System\soQIZGp.exe
  2⤵
  PID:5764
- C:\Windows\System\LofPcia.exe
  C:\Windows\System\LofPcia.exe
  2⤵
  PID:5792
- C:\Windows\System\ROIaOYI.exe
  C:\Windows\System\ROIaOYI.exe
  2⤵
  PID:5816
- C:\Windows\System\GJuYsUy.exe
  C:\Windows\System\GJuYsUy.exe
  2⤵
  PID:5844
- C:\Windows\System\nvRxjJQ.exe
  C:\Windows\System\nvRxjJQ.exe
  2⤵
  PID:5864
- C:\Windows\System\cZWEbiZ.exe
  C:\Windows\System\cZWEbiZ.exe
  2⤵
  PID:5904
- C:\Windows\System\MLcTcJF.exe
  C:\Windows\System\MLcTcJF.exe
  2⤵
  PID:5932
- C:\Windows\System\bntCbQH.exe
  C:\Windows\System\bntCbQH.exe
  2⤵
  PID:5960
- C:\Windows\System\MnCYkqF.exe
  C:\Windows\System\MnCYkqF.exe
  2⤵
  PID:5984
- C:\Windows\System\FqJItQY.exe
  C:\Windows\System\FqJItQY.exe
  2⤵
  PID:6012
- C:\Windows\System\MjxULRv.exe
  C:\Windows\System\MjxULRv.exe
  2⤵
  PID:6052
- C:\Windows\System\OvRUhVl.exe
  C:\Windows\System\OvRUhVl.exe
  2⤵
  PID:6080
- C:\Windows\System\cFFCypn.exe
  C:\Windows\System\cFFCypn.exe
  2⤵
  PID:6104
- C:\Windows\System\PJhcviX.exe
  C:\Windows\System\PJhcviX.exe
  2⤵
  PID:6132
- C:\Windows\System\RMxFDze.exe
  C:\Windows\System\RMxFDze.exe
  2⤵
  PID:316
- C:\Windows\System\zjPEHrf.exe
  C:\Windows\System\zjPEHrf.exe
  2⤵
  PID:5156
- C:\Windows\System\kddnTmp.exe
  C:\Windows\System\kddnTmp.exe
  2⤵
  PID:5188
- C:\Windows\System\AqvBILz.exe
  C:\Windows\System\AqvBILz.exe
  2⤵
  PID:5248
- C:\Windows\System\odGHgDp.exe
  C:\Windows\System\odGHgDp.exe
  2⤵
  PID:3080
- C:\Windows\System\VmUTxon.exe
  C:\Windows\System\VmUTxon.exe
  2⤵
  PID:5312
- C:\Windows\System\llIuzcC.exe
  C:\Windows\System\llIuzcC.exe
  2⤵
  PID:5492
- C:\Windows\System\JLBnPTn.exe
  C:\Windows\System\JLBnPTn.exe
  2⤵
  PID:5544
- C:\Windows\System\yqllBEx.exe
  C:\Windows\System\yqllBEx.exe
  2⤵
  PID:5596
- C:\Windows\System\BMeNYML.exe
  C:\Windows\System\BMeNYML.exe
  2⤵
  PID:5668
- C:\Windows\System\bEQFVhF.exe
  C:\Windows\System\bEQFVhF.exe
  2⤵
  PID:5700
- C:\Windows\System\ZQZzdTy.exe
  C:\Windows\System\ZQZzdTy.exe
  2⤵
  PID:5836
- C:\Windows\System\xyHvFRh.exe
  C:\Windows\System\xyHvFRh.exe
  2⤵
  PID:5884
- C:\Windows\System\pVdHVot.exe
  C:\Windows\System\pVdHVot.exe
  2⤵
  PID:5808
- C:\Windows\System\PXdjxIo.exe
  C:\Windows\System\PXdjxIo.exe
  2⤵
  PID:5852
- C:\Windows\System\ZTdMEGY.exe
  C:\Windows\System\ZTdMEGY.exe
  2⤵
  PID:6020
- C:\Windows\System\lZuijdL.exe
  C:\Windows\System\lZuijdL.exe
  2⤵
  PID:6100
- C:\Windows\System\BaKdyKB.exe
  C:\Windows\System\BaKdyKB.exe
  2⤵
  PID:3052
- C:\Windows\System\jhkYHaa.exe
  C:\Windows\System\jhkYHaa.exe
  2⤵
  PID:5524
- C:\Windows\System\ScfoKDI.exe
  C:\Windows\System\ScfoKDI.exe
  2⤵
  PID:5824
- C:\Windows\System\peswOnO.exe
  C:\Windows\System\peswOnO.exe
  2⤵
  PID:5920
- C:\Windows\System\FJHQSjR.exe
  C:\Windows\System\FJHQSjR.exe
  2⤵
  PID:6004
- C:\Windows\System\RHvLRCD.exe
  C:\Windows\System\RHvLRCD.exe
  2⤵
  PID:5528
- C:\Windows\System\KxLalbb.exe
  C:\Windows\System\KxLalbb.exe
  2⤵
  PID:944
- C:\Windows\System\yPeudEA.exe
  C:\Windows\System\yPeudEA.exe
  2⤵
  PID:6164
- C:\Windows\System\eaOKeMZ.exe
  C:\Windows\System\eaOKeMZ.exe
  2⤵
  PID:6196
- C:\Windows\System\gsRTsVH.exe
  C:\Windows\System\gsRTsVH.exe
  2⤵
  PID:6220
- C:\Windows\System\jXCnixv.exe
  C:\Windows\System\jXCnixv.exe
  2⤵
  PID:6244
- C:\Windows\System\IPNqfem.exe
  C:\Windows\System\IPNqfem.exe
  2⤵
  PID:6272
- C:\Windows\System\tVQqqnJ.exe
  C:\Windows\System\tVQqqnJ.exe
  2⤵
  PID:6324
- C:\Windows\System\SHSVfYs.exe
  C:\Windows\System\SHSVfYs.exe
  2⤵
  PID:6352
- C:\Windows\System\UEDwlBT.exe
  C:\Windows\System\UEDwlBT.exe
  2⤵
  PID:6380
- C:\Windows\System\RJMdRIp.exe
  C:\Windows\System\RJMdRIp.exe
  2⤵
  PID:6396
- C:\Windows\System\tbwlKTW.exe
  C:\Windows\System\tbwlKTW.exe
  2⤵
  PID:6428
- C:\Windows\System\jXHjWVL.exe
  C:\Windows\System\jXHjWVL.exe
  2⤵
  PID:6452
- C:\Windows\System\meTqHkB.exe
  C:\Windows\System\meTqHkB.exe
  2⤵
  PID:6484
- C:\Windows\System\HqfQnTz.exe
  C:\Windows\System\HqfQnTz.exe
  2⤵
  PID:6504
- C:\Windows\System\MYdUsxZ.exe
  C:\Windows\System\MYdUsxZ.exe
  2⤵
  PID:6532
- C:\Windows\System\QsPifcR.exe
  C:\Windows\System\QsPifcR.exe
  2⤵
  PID:6552
- C:\Windows\System\npLySap.exe
  C:\Windows\System\npLySap.exe
  2⤵
  PID:6572
- C:\Windows\System\HhXKGzO.exe
  C:\Windows\System\HhXKGzO.exe
  2⤵
  PID:6592
- C:\Windows\System\CoLAKtJ.exe
  C:\Windows\System\CoLAKtJ.exe
  2⤵
  PID:6616
- C:\Windows\System\WIQZtIv.exe
  C:\Windows\System\WIQZtIv.exe
  2⤵
  PID:6632
- C:\Windows\System\jrRTSCo.exe
  C:\Windows\System\jrRTSCo.exe
  2⤵
  PID:6656
- C:\Windows\System\mYvZXAH.exe
  C:\Windows\System\mYvZXAH.exe
  2⤵
  PID:6680
- C:\Windows\System\CRGnBsy.exe
  C:\Windows\System\CRGnBsy.exe
  2⤵
  PID:6704
- C:\Windows\System\fzEIIWq.exe
  C:\Windows\System\fzEIIWq.exe
  2⤵
  PID:6728
- C:\Windows\System\bgyQYbG.exe
  C:\Windows\System\bgyQYbG.exe
  2⤵
  PID:6752
- C:\Windows\System\gwdDZQJ.exe
  C:\Windows\System\gwdDZQJ.exe
  2⤵
  PID:6776
- C:\Windows\System\TSTUlFw.exe
  C:\Windows\System\TSTUlFw.exe
  2⤵
  PID:6804
- C:\Windows\System\kBmzuyY.exe
  C:\Windows\System\kBmzuyY.exe
  2⤵
  PID:6832
- C:\Windows\System\jLGYyiJ.exe
  C:\Windows\System\jLGYyiJ.exe
  2⤵
  PID:6852
- C:\Windows\System\HdSlBWY.exe
  C:\Windows\System\HdSlBWY.exe
  2⤵
  PID:6884
- C:\Windows\System\TtISinj.exe
  C:\Windows\System\TtISinj.exe
  2⤵
  PID:6900
- C:\Windows\System\ADmAKIl.exe
  C:\Windows\System\ADmAKIl.exe
  2⤵
  PID:6924
- C:\Windows\System\qAyPzQZ.exe
  C:\Windows\System\qAyPzQZ.exe
  2⤵
  PID:6952
- C:\Windows\System\PdoHXGc.exe
  C:\Windows\System\PdoHXGc.exe
  2⤵
  PID:6976
- C:\Windows\System\nkFptsE.exe
  C:\Windows\System\nkFptsE.exe
  2⤵
  PID:7000
- C:\Windows\System\icyrfiR.exe
  C:\Windows\System\icyrfiR.exe
  2⤵
  PID:7024
- C:\Windows\System\rytHPqe.exe
  C:\Windows\System\rytHPqe.exe
  2⤵
  PID:7048
- C:\Windows\System\LPYnUFP.exe
  C:\Windows\System\LPYnUFP.exe
  2⤵
  PID:7084
- C:\Windows\System\SggJLed.exe
  C:\Windows\System\SggJLed.exe
  2⤵
  PID:7132
- C:\Windows\System\nMKmkvH.exe
  C:\Windows\System\nMKmkvH.exe
  2⤵
  PID:7160
- C:\Windows\System\eypOBmq.exe
  C:\Windows\System\eypOBmq.exe
  2⤵
  PID:5132
- C:\Windows\System\xXstgyL.exe
  C:\Windows\System\xXstgyL.exe
  2⤵
  PID:6160
- C:\Windows\System\ncvryzC.exe
  C:\Windows\System\ncvryzC.exe
  2⤵
  PID:6148
- C:\Windows\System\ZooEbFz.exe
  C:\Windows\System\ZooEbFz.exe
  2⤵
  PID:5280
- C:\Windows\System\xXADSuO.exe
  C:\Windows\System\xXADSuO.exe
  2⤵
  PID:6260
- C:\Windows\System\RtjGEur.exe
  C:\Windows\System\RtjGEur.exe
  2⤵
  PID:6388
- C:\Windows\System\cgkxnRk.exe
  C:\Windows\System\cgkxnRk.exe
  2⤵
  PID:6444
- C:\Windows\System\VExEDKg.exe
  C:\Windows\System\VExEDKg.exe
  2⤵
  PID:6416
- C:\Windows\System\cMRFmHy.exe
  C:\Windows\System\cMRFmHy.exe
  2⤵
  PID:6524
- C:\Windows\System\VkSoyLP.exe
  C:\Windows\System\VkSoyLP.exe
  2⤵
  PID:6568
- C:\Windows\System\zeUXPkJ.exe
  C:\Windows\System\zeUXPkJ.exe
  2⤵
  PID:6500
- C:\Windows\System\QNcxfXP.exe
  C:\Windows\System\QNcxfXP.exe
  2⤵
  PID:6692
- C:\Windows\System\gxqHqeg.exe
  C:\Windows\System\gxqHqeg.exe
  2⤵
  PID:6820
- C:\Windows\System\YkvkoCA.exe
  C:\Windows\System\YkvkoCA.exe
  2⤵
  PID:6824
- C:\Windows\System\PIWZTYC.exe
  C:\Windows\System\PIWZTYC.exe
  2⤵
  PID:6960
- C:\Windows\System\ovwMPgk.exe
  C:\Windows\System\ovwMPgk.exe
  2⤵
  PID:6972
- C:\Windows\System\bOBHkAu.exe
  C:\Windows\System\bOBHkAu.exe
  2⤵
  PID:6792
- C:\Windows\System\KxPGYWE.exe
  C:\Windows\System\KxPGYWE.exe
  2⤵
  PID:7076
- C:\Windows\System\tNttzQf.exe
  C:\Windows\System\tNttzQf.exe
  2⤵
  PID:7112
- C:\Windows\System\bEGhQGi.exe
  C:\Windows\System\bEGhQGi.exe
  2⤵
  PID:6292
- C:\Windows\System\rtApTCH.exe
  C:\Windows\System\rtApTCH.exe
  2⤵
  PID:6360
- C:\Windows\System\CAGVIaT.exe
  C:\Windows\System\CAGVIaT.exe
  2⤵
  PID:6232
- C:\Windows\System\yxOwBos.exe
  C:\Windows\System\yxOwBos.exe
  2⤵
  PID:5832
- C:\Windows\System\SfZpVRG.exe
  C:\Windows\System\SfZpVRG.exe
  2⤵
  PID:6848
- C:\Windows\System\gveDGYL.exe
  C:\Windows\System\gveDGYL.exe
  2⤵
  PID:7180
- C:\Windows\System\vOJDTAS.exe
  C:\Windows\System\vOJDTAS.exe
  2⤵
  PID:7208
- C:\Windows\System\yyhPIIa.exe
  C:\Windows\System\yyhPIIa.exe
  2⤵
  PID:7224
- C:\Windows\System\QFXBuHO.exe
  C:\Windows\System\QFXBuHO.exe
  2⤵
  PID:7244
- C:\Windows\System\lXuxswb.exe
  C:\Windows\System\lXuxswb.exe
  2⤵
  PID:7272
- C:\Windows\System\kMiluMW.exe
  C:\Windows\System\kMiluMW.exe
  2⤵
  PID:7292
- C:\Windows\System\fkKzDPN.exe
  C:\Windows\System\fkKzDPN.exe
  2⤵
  PID:7324
- C:\Windows\System\brCxjQX.exe
  C:\Windows\System\brCxjQX.exe
  2⤵
  PID:7344
- C:\Windows\System\AmgRcup.exe
  C:\Windows\System\AmgRcup.exe
  2⤵
  PID:7376
- C:\Windows\System\RUwbKtM.exe
  C:\Windows\System\RUwbKtM.exe
  2⤵
  PID:7396
- C:\Windows\System\bJJsXEw.exe
  C:\Windows\System\bJJsXEw.exe
  2⤵
  PID:7420
- C:\Windows\System\bFBueIC.exe
  C:\Windows\System\bFBueIC.exe
  2⤵
  PID:7448
- C:\Windows\System\yprMJNX.exe
  C:\Windows\System\yprMJNX.exe
  2⤵
  PID:7476
- C:\Windows\System\jljgzXN.exe
  C:\Windows\System\jljgzXN.exe
  2⤵
  PID:7500
- C:\Windows\System\rZqMWLL.exe
  C:\Windows\System\rZqMWLL.exe
  2⤵
  PID:7516
- C:\Windows\System\sOcKkTJ.exe
  C:\Windows\System\sOcKkTJ.exe
  2⤵
  PID:7544
- C:\Windows\System\dlrslSY.exe
  C:\Windows\System\dlrslSY.exe
  2⤵
  PID:7572
- C:\Windows\System\QQOqyYA.exe
  C:\Windows\System\QQOqyYA.exe
  2⤵
  PID:7596
- C:\Windows\System\EdBIteL.exe
  C:\Windows\System\EdBIteL.exe
  2⤵
  PID:7624
- C:\Windows\System\RXNQpII.exe
  C:\Windows\System\RXNQpII.exe
  2⤵
  PID:7648
- C:\Windows\System\uEGhAur.exe
  C:\Windows\System\uEGhAur.exe
  2⤵
  PID:7680
- C:\Windows\System\OOwlIEU.exe
  C:\Windows\System\OOwlIEU.exe
  2⤵
  PID:7700
- C:\Windows\System\eWORabT.exe
  C:\Windows\System\eWORabT.exe
  2⤵
  PID:7728
- C:\Windows\System\GtWVxwK.exe
  C:\Windows\System\GtWVxwK.exe
  2⤵
  PID:7752
- C:\Windows\System\OojWaiq.exe
  C:\Windows\System\OojWaiq.exe
  2⤵
  PID:7776
- C:\Windows\System\lArinmv.exe
  C:\Windows\System\lArinmv.exe
  2⤵
  PID:7796
- C:\Windows\System\TSYrQBR.exe
  C:\Windows\System\TSYrQBR.exe
  2⤵
  PID:7824
- C:\Windows\System\fbMKjep.exe
  C:\Windows\System\fbMKjep.exe
  2⤵
  PID:7848
- C:\Windows\System\XmypykK.exe
  C:\Windows\System\XmypykK.exe
  2⤵
  PID:7880
- C:\Windows\System\TCMLYBC.exe
  C:\Windows\System\TCMLYBC.exe
  2⤵
  PID:7908
- C:\Windows\System\xBwYGsP.exe
  C:\Windows\System\xBwYGsP.exe
  2⤵
  PID:7936
- C:\Windows\System\pPEUnAt.exe
  C:\Windows\System\pPEUnAt.exe
  2⤵
  PID:7960
- C:\Windows\System\jVoiUtV.exe
  C:\Windows\System\jVoiUtV.exe
  2⤵
  PID:7988
- C:\Windows\System\vqOgQym.exe
  C:\Windows\System\vqOgQym.exe
  2⤵
  PID:8008
- C:\Windows\System\xrffTfh.exe
  C:\Windows\System\xrffTfh.exe
  2⤵
  PID:8028
- C:\Windows\System\OKxhjWD.exe
  C:\Windows\System\OKxhjWD.exe
  2⤵
  PID:8056
- C:\Windows\System\tmNTCdc.exe
  C:\Windows\System\tmNTCdc.exe
  2⤵
  PID:8076
- C:\Windows\System\lJvGNcl.exe
  C:\Windows\System\lJvGNcl.exe
  2⤵
  PID:8104
- C:\Windows\System\WxUCGlV.exe
  C:\Windows\System\WxUCGlV.exe
  2⤵
  PID:8140
- C:\Windows\System\ZiQKkGO.exe
  C:\Windows\System\ZiQKkGO.exe
  2⤵
  PID:8160
- C:\Windows\System\ONoiXeX.exe
  C:\Windows\System\ONoiXeX.exe
  2⤵
  PID:7020
- C:\Windows\System\ZtRlbAc.exe
  C:\Windows\System\ZtRlbAc.exe
  2⤵
  PID:6564
- C:\Windows\System\hDisxXD.exe
  C:\Windows\System\hDisxXD.exe
  2⤵
  PID:7152
- C:\Windows\System\YVCNfMn.exe
  C:\Windows\System\YVCNfMn.exe
  2⤵
  PID:6468
- C:\Windows\System\LrPhvmR.exe
  C:\Windows\System\LrPhvmR.exe
  2⤵
  PID:7172
- C:\Windows\System\IaLskCh.exe
  C:\Windows\System\IaLskCh.exe
  2⤵
  PID:6816
- C:\Windows\System\rpxUKnX.exe
  C:\Windows\System\rpxUKnX.exe
  2⤵
  PID:6920
- C:\Windows\System\NeSateu.exe
  C:\Windows\System\NeSateu.exe
  2⤵
  PID:5604
- C:\Windows\System\FvhZtrZ.exe
  C:\Windows\System\FvhZtrZ.exe
  2⤵
  PID:7392
- C:\Windows\System\FooRWrg.exe
  C:\Windows\System\FooRWrg.exe
  2⤵
  PID:7456
- C:\Windows\System\QFKxqRX.exe
  C:\Windows\System\QFKxqRX.exe
  2⤵
  PID:7508
- C:\Windows\System\gJCzcpX.exe
  C:\Windows\System\gJCzcpX.exe
  2⤵
  PID:7556
- C:\Windows\System\nSbDkbR.exe
  C:\Windows\System\nSbDkbR.exe
  2⤵
  PID:7384
- C:\Windows\System\tntbPck.exe
  C:\Windows\System\tntbPck.exe
  2⤵
  PID:7696
- C:\Windows\System\NzxHDlu.exe
  C:\Windows\System\NzxHDlu.exe
  2⤵
  PID:7768
- C:\Windows\System\ZrNSrmM.exe
  C:\Windows\System\ZrNSrmM.exe
  2⤵
  PID:7436
- C:\Windows\System\EWIgwSM.exe
  C:\Windows\System\EWIgwSM.exe
  2⤵
  PID:7920
- C:\Windows\System\PddnSBM.exe
  C:\Windows\System\PddnSBM.exe
  2⤵
  PID:7996
- C:\Windows\System\axQPZpu.exe
  C:\Windows\System\axQPZpu.exe
  2⤵
  PID:7592
- C:\Windows\System\QlnZBaH.exe
  C:\Windows\System\QlnZBaH.exe
  2⤵
  PID:7836
- C:\Windows\System\xhLPeyg.exe
  C:\Windows\System\xhLPeyg.exe
  2⤵
  PID:7676
- C:\Windows\System\WoLAfEd.exe
  C:\Windows\System\WoLAfEd.exe
  2⤵
  PID:8156
- C:\Windows\System\kpWcWWF.exe
  C:\Windows\System\kpWcWWF.exe
  2⤵
  PID:7040
- C:\Windows\System\DOrfbGz.exe
  C:\Windows\System\DOrfbGz.exe
  2⤵
  PID:7204
- C:\Windows\System\XWwnupk.exe
  C:\Windows\System\XWwnupk.exe
  2⤵
  PID:7252
- C:\Windows\System\JEeMzvs.exe
  C:\Windows\System\JEeMzvs.exe
  2⤵
  PID:8120
- C:\Windows\System\jcrKHPA.exe
  C:\Windows\System\jcrKHPA.exe
  2⤵
  PID:6476
- C:\Windows\System\dQfuHwK.exe
  C:\Windows\System\dQfuHwK.exe
  2⤵
  PID:7788
- C:\Windows\System\TzHnYcJ.exe
  C:\Windows\System\TzHnYcJ.exe
  2⤵
  PID:8216
- C:\Windows\System\vzWfRty.exe
  C:\Windows\System\vzWfRty.exe
  2⤵
  PID:8240
- C:\Windows\System\RrMVxYQ.exe
  C:\Windows\System\RrMVxYQ.exe
  2⤵
  PID:8268
- C:\Windows\System\rLyVWKq.exe
  C:\Windows\System\rLyVWKq.exe
  2⤵
  PID:8292
- C:\Windows\System\uWdlIko.exe
  C:\Windows\System\uWdlIko.exe
  2⤵
  PID:8316
- C:\Windows\System\xjOOzLa.exe
  C:\Windows\System\xjOOzLa.exe
  2⤵
  PID:8344
- C:\Windows\System\WNBEdyL.exe
  C:\Windows\System\WNBEdyL.exe
  2⤵
  PID:8368
- C:\Windows\System\tBLsSDu.exe
  C:\Windows\System\tBLsSDu.exe
  2⤵
  PID:8396
- C:\Windows\System\SDcekBa.exe
  C:\Windows\System\SDcekBa.exe
  2⤵
  PID:8412
- C:\Windows\System\FtTTLSg.exe
  C:\Windows\System\FtTTLSg.exe
  2⤵
  PID:8440
- C:\Windows\System\tePxDGM.exe
  C:\Windows\System\tePxDGM.exe
  2⤵
  PID:8468
- C:\Windows\System\YgGeXLs.exe
  C:\Windows\System\YgGeXLs.exe
  2⤵
  PID:8488
- C:\Windows\System\tPySEGZ.exe
  C:\Windows\System\tPySEGZ.exe
  2⤵
  PID:8516
- C:\Windows\System\uqjLhnE.exe
  C:\Windows\System\uqjLhnE.exe
  2⤵
  PID:8536
- C:\Windows\System\EDajUKW.exe
  C:\Windows\System\EDajUKW.exe
  2⤵
  PID:8556
- C:\Windows\System\WzSWlTL.exe
  C:\Windows\System\WzSWlTL.exe
  2⤵
  PID:8588
- C:\Windows\System\RcZYgwG.exe
  C:\Windows\System\RcZYgwG.exe
  2⤵
  PID:8612
- C:\Windows\System\sXErhLL.exe
  C:\Windows\System\sXErhLL.exe
  2⤵
  PID:8640
- C:\Windows\System\XXnwCiP.exe
  C:\Windows\System\XXnwCiP.exe
  2⤵
  PID:8664
- C:\Windows\System\ZvhflNC.exe
  C:\Windows\System\ZvhflNC.exe
  2⤵
  PID:8688
- C:\Windows\System\MRbOEWA.exe
  C:\Windows\System\MRbOEWA.exe
  2⤵
  PID:8736
- C:\Windows\System\GXBpOet.exe
  C:\Windows\System\GXBpOet.exe
  2⤵
  PID:8756
- C:\Windows\System\iHoAMsS.exe
  C:\Windows\System\iHoAMsS.exe
  2⤵
  PID:8784
- C:\Windows\System\sTgXfWS.exe
  C:\Windows\System\sTgXfWS.exe
  2⤵
  PID:8808
- C:\Windows\System\usvHgwn.exe
  C:\Windows\System\usvHgwn.exe
  2⤵
  PID:8832
- C:\Windows\System\yZwMTHg.exe
  C:\Windows\System\yZwMTHg.exe
  2⤵
  PID:8860
- C:\Windows\System\PxdQhHK.exe
  C:\Windows\System\PxdQhHK.exe
  2⤵
  PID:8884
- C:\Windows\System\yWjBmlg.exe
  C:\Windows\System\yWjBmlg.exe
  2⤵
  PID:8908
- C:\Windows\System\RrybYVD.exe
  C:\Windows\System\RrybYVD.exe
  2⤵
  PID:8936
- C:\Windows\System\CWNyrrA.exe
  C:\Windows\System\CWNyrrA.exe
  2⤵
  PID:8964
- C:\Windows\System\isJvqaP.exe
  C:\Windows\System\isJvqaP.exe
  2⤵
  PID:8996
- C:\Windows\System\QpDJfBZ.exe
  C:\Windows\System\QpDJfBZ.exe
  2⤵
  PID:9024
- C:\Windows\System\DJrYnyo.exe
  C:\Windows\System\DJrYnyo.exe
  2⤵
  PID:9044
- C:\Windows\System\kdxrCIQ.exe
  C:\Windows\System\kdxrCIQ.exe
  2⤵
  PID:9068
- C:\Windows\System\iCpskVb.exe
  C:\Windows\System\iCpskVb.exe
  2⤵
  PID:9100
- C:\Windows\System\UvYDCWc.exe
  C:\Windows\System\UvYDCWc.exe
  2⤵
  PID:9120
- C:\Windows\System\FpqZJVA.exe
  C:\Windows\System\FpqZJVA.exe
  2⤵
  PID:9148
- C:\Windows\System\RULWEPD.exe
  C:\Windows\System\RULWEPD.exe
  2⤵
  PID:9180
- C:\Windows\System\Jvfkdex.exe
  C:\Windows\System\Jvfkdex.exe
  2⤵
  PID:9208
- C:\Windows\System\GnYbLDA.exe
  C:\Windows\System\GnYbLDA.exe
  2⤵
  PID:7840
- C:\Windows\System\dXGAJke.exe
  C:\Windows\System\dXGAJke.exe
  2⤵
  PID:8152
- C:\Windows\System\VJHIXgJ.exe
  C:\Windows\System\VJHIXgJ.exe
  2⤵
  PID:6720
- C:\Windows\System\CxHbEfC.exe
  C:\Windows\System\CxHbEfC.exe
  2⤵
  PID:6344
- C:\Windows\System\JctcOrD.exe
  C:\Windows\System\JctcOrD.exe
  2⤵
  PID:7748
- C:\Windows\System\EvzoRGS.exe
  C:\Windows\System\EvzoRGS.exe
  2⤵
  PID:7764
- C:\Windows\System\sJDOnoY.exe
  C:\Windows\System\sJDOnoY.exe
  2⤵
  PID:7692
- C:\Windows\System\fiGBlxv.exe
  C:\Windows\System\fiGBlxv.exe
  2⤵
  PID:8504
- C:\Windows\System\SCccSmo.exe
  C:\Windows\System\SCccSmo.exe
  2⤵
  PID:8544
- C:\Windows\System\uWaMVhJ.exe
  C:\Windows\System\uWaMVhJ.exe
  2⤵
  PID:8288
- C:\Windows\System\wMvVKhl.exe
  C:\Windows\System\wMvVKhl.exe
  2⤵
  PID:8364
- C:\Windows\System\XSYzVrq.exe
  C:\Windows\System\XSYzVrq.exe
  2⤵
  PID:8420
- C:\Windows\System\SfWIqRL.exe
  C:\Windows\System\SfWIqRL.exe
  2⤵
  PID:8744
- C:\Windows\System\uYiwEfE.exe
  C:\Windows\System\uYiwEfE.exe
  2⤵
  PID:8792
- C:\Windows\System\gIYYXhr.exe
  C:\Windows\System\gIYYXhr.exe
  2⤵
  PID:8532
- C:\Windows\System\KvtUyKa.exe
  C:\Windows\System\KvtUyKa.exe
  2⤵
  PID:8880
- C:\Windows\System\okrAOpd.exe
  C:\Windows\System\okrAOpd.exe
  2⤵
  PID:8200
- C:\Windows\System\HxGNTJA.exe
  C:\Windows\System\HxGNTJA.exe
  2⤵
  PID:8212
- C:\Windows\System\EhruyuA.exe
  C:\Windows\System\EhruyuA.exe
  2⤵
  PID:8256
- C:\Windows\System\qRXSOJK.exe
  C:\Windows\System\qRXSOJK.exe
  2⤵
  PID:8280
- C:\Windows\System\lpLWbpM.exe
  C:\Windows\System\lpLWbpM.exe
  2⤵
  PID:8340
- C:\Windows\System\JbFBuKu.exe
  C:\Windows\System\JbFBuKu.exe
  2⤵
  PID:9132
- C:\Windows\System\KvXSNSt.exe
  C:\Windows\System\KvXSNSt.exe
  2⤵
  PID:9200
- C:\Windows\System\yHckdGX.exe
  C:\Windows\System\yHckdGX.exe
  2⤵
  PID:8828
- C:\Windows\System\EMTathD.exe
  C:\Windows\System\EMTathD.exe
  2⤵
  PID:7536
- C:\Windows\System\FeFKLOk.exe
  C:\Windows\System\FeFKLOk.exe
  2⤵
  PID:9004
- C:\Windows\System\cjqXUiP.exe
  C:\Windows\System\cjqXUiP.exe
  2⤵
  PID:9076
- C:\Windows\System\USIrKUG.exe
  C:\Windows\System\USIrKUG.exe
  2⤵
  PID:9232
- C:\Windows\System\wDUvHew.exe
  C:\Windows\System\wDUvHew.exe
  2⤵
  PID:9260
- C:\Windows\System\KHFHxRw.exe
  C:\Windows\System\KHFHxRw.exe
  2⤵
  PID:9288
- C:\Windows\System\lRgedHf.exe
  C:\Windows\System\lRgedHf.exe
  2⤵
  PID:9316
- C:\Windows\System\fecEiPI.exe
  C:\Windows\System\fecEiPI.exe
  2⤵
  PID:9356
- C:\Windows\System\KWIYOBk.exe
  C:\Windows\System\KWIYOBk.exe
  2⤵
  PID:9384
- C:\Windows\System\xdSCelr.exe
  C:\Windows\System\xdSCelr.exe
  2⤵
  PID:9412
- C:\Windows\System\xbipmBA.exe
  C:\Windows\System\xbipmBA.exe
  2⤵
  PID:9444
- C:\Windows\System\xCqKqfV.exe
  C:\Windows\System\xCqKqfV.exe
  2⤵
  PID:9472
- C:\Windows\System\gGiTlhX.exe
  C:\Windows\System\gGiTlhX.exe
  2⤵
  PID:9500
- C:\Windows\System\XusiUdG.exe
  C:\Windows\System\XusiUdG.exe
  2⤵
  PID:9520
- C:\Windows\System\PgYwKXY.exe
  C:\Windows\System\PgYwKXY.exe
  2⤵
  PID:9544
- C:\Windows\System\CDaQEty.exe
  C:\Windows\System\CDaQEty.exe
  2⤵
  PID:9584
- C:\Windows\System\VRlqVqa.exe
  C:\Windows\System\VRlqVqa.exe
  2⤵
  PID:9616
- C:\Windows\System\UIYXGbs.exe
  C:\Windows\System\UIYXGbs.exe
  2⤵
  PID:9652
- C:\Windows\System\AwLYqWj.exe
  C:\Windows\System\AwLYqWj.exe
  2⤵
  PID:9692
- C:\Windows\System\LEpPPMu.exe
  C:\Windows\System\LEpPPMu.exe
  2⤵
  PID:9716
- C:\Windows\System\QQhpCzp.exe
  C:\Windows\System\QQhpCzp.exe
  2⤵
  PID:9744
- C:\Windows\System\PsvNCVW.exe
  C:\Windows\System\PsvNCVW.exe
  2⤵
  PID:9764
- C:\Windows\System\wOZUUzi.exe
  C:\Windows\System\wOZUUzi.exe
  2⤵
  PID:9788
- C:\Windows\System\TebUjfl.exe
  C:\Windows\System\TebUjfl.exe
  2⤵
  PID:9816
- C:\Windows\System\zFcLZFZ.exe
  C:\Windows\System\zFcLZFZ.exe
  2⤵
  PID:9848
- C:\Windows\System\GmhxQZX.exe
  C:\Windows\System\GmhxQZX.exe
  2⤵
  PID:9868
- C:\Windows\System\vxojBgE.exe
  C:\Windows\System\vxojBgE.exe
  2⤵
  PID:9884
- C:\Windows\System\hkjrBUg.exe
  C:\Windows\System\hkjrBUg.exe
  2⤵
  PID:9908
- C:\Windows\System\zMMarNS.exe
  C:\Windows\System\zMMarNS.exe
  2⤵
  PID:9936
- C:\Windows\System\qOqDEeK.exe
  C:\Windows\System\qOqDEeK.exe
  2⤵
  PID:9956
- C:\Windows\System\xGBcsyM.exe
  C:\Windows\System\xGBcsyM.exe
  2⤵
  PID:9988
- C:\Windows\System\oeOPsdz.exe
  C:\Windows\System\oeOPsdz.exe
  2⤵
  PID:10008
- C:\Windows\System\xGAUeMB.exe
  C:\Windows\System\xGAUeMB.exe
  2⤵
  PID:10036
- C:\Windows\System\tAFFLVk.exe
  C:\Windows\System\tAFFLVk.exe
  2⤵
  PID:10056
- C:\Windows\System\GaiDnCE.exe
  C:\Windows\System\GaiDnCE.exe
  2⤵
  PID:10092
- C:\Windows\System\SjMWATh.exe
  C:\Windows\System\SjMWATh.exe
  2⤵
  PID:10116
- C:\Windows\System\nJAQWFV.exe
  C:\Windows\System\nJAQWFV.exe
  2⤵
  PID:10140
- C:\Windows\System\jvkrnAj.exe
  C:\Windows\System\jvkrnAj.exe
  2⤵
  PID:10164
- C:\Windows\System\tdGsIzG.exe
  C:\Windows\System\tdGsIzG.exe
  2⤵
  PID:10192
- C:\Windows\System\IqsDIRg.exe
  C:\Windows\System\IqsDIRg.exe
  2⤵
  PID:10216
- C:\Windows\System\drkJzRy.exe
  C:\Windows\System\drkJzRy.exe
  2⤵
  PID:9172
- C:\Windows\System\zjzESkz.exe
  C:\Windows\System\zjzESkz.exe
  2⤵
  PID:8584
- C:\Windows\System\tiZjzju.exe
  C:\Windows\System\tiZjzju.exe
  2⤵
  PID:8004
- C:\Windows\System\NRqngBs.exe
  C:\Windows\System\NRqngBs.exe
  2⤵
  PID:9092
- C:\Windows\System\dStYUSf.exe
  C:\Windows\System\dStYUSf.exe
  2⤵
  PID:8436
- C:\Windows\System\xZsFoVB.exe
  C:\Windows\System\xZsFoVB.exe
  2⤵
  PID:8816
- C:\Windows\System\vNvfDHz.exe
  C:\Windows\System\vNvfDHz.exe
  2⤵
  PID:8236
- C:\Windows\System\AheogUA.exe
  C:\Windows\System\AheogUA.exe
  2⤵
  PID:9060
- C:\Windows\System\iUhkYvy.exe
  C:\Windows\System\iUhkYvy.exe
  2⤵
  PID:9168
- C:\Windows\System\eGSxheJ.exe
  C:\Windows\System\eGSxheJ.exe
  2⤵
  PID:9420
- C:\Windows\System\ZLrFhmv.exe
  C:\Windows\System\ZLrFhmv.exe
  2⤵
  PID:7672
- C:\Windows\System\aIpqKww.exe
  C:\Windows\System\aIpqKww.exe
  2⤵
  PID:8508
- C:\Windows\System\PqNiCKK.exe
  C:\Windows\System\PqNiCKK.exe
  2⤵
  PID:9512
- C:\Windows\System\vsLekwd.exe
  C:\Windows\System\vsLekwd.exe
  2⤵
  PID:9568
- C:\Windows\System\xfImiUx.exe
  C:\Windows\System\xfImiUx.exe
  2⤵
  PID:9240
- C:\Windows\System\sHmXUHD.exe
  C:\Windows\System\sHmXUHD.exe
  2⤵
  PID:9632
- C:\Windows\System\GBCNzgd.exe
  C:\Windows\System\GBCNzgd.exe
  2⤵
  PID:9284
- C:\Windows\System\dtDUiFo.exe
  C:\Windows\System\dtDUiFo.exe
  2⤵
  PID:9332
- C:\Windows\System\covSlbI.exe
  C:\Windows\System\covSlbI.exe
  2⤵
  PID:9740
- C:\Windows\System\oEuYTbR.exe
  C:\Windows\System\oEuYTbR.exe
  2⤵
  PID:9836
- C:\Windows\System\iEEtFxw.exe
  C:\Windows\System\iEEtFxw.exe
  2⤵
  PID:9976
- C:\Windows\System\YlhePmW.exe
  C:\Windows\System\YlhePmW.exe
  2⤵
  PID:10052
- C:\Windows\System\gBWVdoB.exe
  C:\Windows\System\gBWVdoB.exe
  2⤵
  PID:10084
- C:\Windows\System\AcpoLwf.exe
  C:\Windows\System\AcpoLwf.exe
  2⤵
  PID:10176
- C:\Windows\System\yieQzOG.exe
  C:\Windows\System\yieQzOG.exe
  2⤵
  PID:10204
- C:\Windows\System\npcyEmt.exe
  C:\Windows\System\npcyEmt.exe
  2⤵
  PID:8948
- C:\Windows\System\HlAOXfi.exe
  C:\Windows\System\HlAOXfi.exe
  2⤵
  PID:8484
- C:\Windows\System\KUBCxAQ.exe
  C:\Windows\System\KUBCxAQ.exe
  2⤵
  PID:9272
- C:\Windows\System\dKjYWPt.exe
  C:\Windows\System\dKjYWPt.exe
  2⤵
  PID:9380
- C:\Windows\System\kazVReJ.exe
  C:\Windows\System\kazVReJ.exe
  2⤵
  PID:9400
- C:\Windows\System\eGrqBsz.exe
  C:\Windows\System\eGrqBsz.exe
  2⤵
  PID:10244
- C:\Windows\System\flHasvl.exe
  C:\Windows\System\flHasvl.exe
  2⤵
  PID:10264
- C:\Windows\System\sVYPeHq.exe
  C:\Windows\System\sVYPeHq.exe
  2⤵
  PID:10292
- C:\Windows\System\BeRGaYv.exe
  C:\Windows\System\BeRGaYv.exe
  2⤵
  PID:10328
- C:\Windows\System\sGkNrvu.exe
  C:\Windows\System\sGkNrvu.exe
  2⤵
  PID:10360
- C:\Windows\System\QOZNDSw.exe
  C:\Windows\System\QOZNDSw.exe
  2⤵
  PID:10384
- C:\Windows\System\NneZMVE.exe
  C:\Windows\System\NneZMVE.exe
  2⤵
  PID:10412
- C:\Windows\System\zPZtncV.exe
  C:\Windows\System\zPZtncV.exe
  2⤵
  PID:10440
- C:\Windows\System\JKbmkJj.exe
  C:\Windows\System\JKbmkJj.exe
  2⤵
  PID:10460
- C:\Windows\System\yQRgzZY.exe
  C:\Windows\System\yQRgzZY.exe
  2⤵
  PID:10484
- C:\Windows\System\KcsFdJq.exe
  C:\Windows\System\KcsFdJq.exe
  2⤵
  PID:10516
- C:\Windows\System\nIFzGch.exe
  C:\Windows\System\nIFzGch.exe
  2⤵
  PID:10536
- C:\Windows\System\vABMDRb.exe
  C:\Windows\System\vABMDRb.exe
  2⤵
  PID:10564
- C:\Windows\System\IokDOnE.exe
  C:\Windows\System\IokDOnE.exe
  2⤵
  PID:10592
- C:\Windows\System\HpCEuSu.exe
  C:\Windows\System\HpCEuSu.exe
  2⤵
  PID:10620
- C:\Windows\System\JwZnAQu.exe
  C:\Windows\System\JwZnAQu.exe
  2⤵
  PID:10644
- C:\Windows\System\NpuRoqi.exe
  C:\Windows\System\NpuRoqi.exe
  2⤵
  PID:10676
- C:\Windows\System\miKzXOt.exe
  C:\Windows\System\miKzXOt.exe
  2⤵
  PID:10704
- C:\Windows\System\EguBGwV.exe
  C:\Windows\System\EguBGwV.exe
  2⤵
  PID:10740
- C:\Windows\System\izpAGQO.exe
  C:\Windows\System\izpAGQO.exe
  2⤵
  PID:10768
- C:\Windows\System\iHvdNec.exe
  C:\Windows\System\iHvdNec.exe
  2⤵
  PID:10796
- C:\Windows\System\EPGEHOB.exe
  C:\Windows\System\EPGEHOB.exe
  2⤵
  PID:10824
- C:\Windows\System\pPFgKek.exe
  C:\Windows\System\pPFgKek.exe
  2⤵
  PID:10852
- C:\Windows\System\BjGdJBO.exe
  C:\Windows\System\BjGdJBO.exe
  2⤵
  PID:10888
- C:\Windows\System\JGSQwmY.exe
  C:\Windows\System\JGSQwmY.exe
  2⤵
  PID:10912
- C:\Windows\System\JWWsmbY.exe
  C:\Windows\System\JWWsmbY.exe
  2⤵
  PID:10940
- C:\Windows\System\HhEyyrq.exe
  C:\Windows\System\HhEyyrq.exe
  2⤵
  PID:10972
- C:\Windows\System\PvNTZtW.exe
  C:\Windows\System\PvNTZtW.exe
  2⤵
  PID:10996
- C:\Windows\System\OJWxZRt.exe
  C:\Windows\System\OJWxZRt.exe
  2⤵
  PID:11020
- C:\Windows\System\XbfJGfi.exe
  C:\Windows\System\XbfJGfi.exe
  2⤵
  PID:11048
- C:\Windows\System\baVqsNu.exe
  C:\Windows\System\baVqsNu.exe
  2⤵
  PID:11068
- C:\Windows\System\SXgwmTr.exe
  C:\Windows\System\SXgwmTr.exe
  2⤵
  PID:11096
- C:\Windows\System\CLmTtGf.exe
  C:\Windows\System\CLmTtGf.exe
  2⤵
  PID:11124
- C:\Windows\System\kNMIAfY.exe
  C:\Windows\System\kNMIAfY.exe
  2⤵
  PID:11144
- C:\Windows\System\DhfJfHJ.exe
  C:\Windows\System\DhfJfHJ.exe
  2⤵
  PID:11172
- C:\Windows\System\puEAhFT.exe
  C:\Windows\System\puEAhFT.exe
  2⤵
  PID:11196
- C:\Windows\System\iMbAsNU.exe
  C:\Windows\System\iMbAsNU.exe
  2⤵
  PID:11224
- C:\Windows\System\kRfvixx.exe
  C:\Windows\System\kRfvixx.exe
  2⤵
  PID:11252
- C:\Windows\System\efVQJyq.exe
  C:\Windows\System\efVQJyq.exe
  2⤵
  PID:9612
- C:\Windows\System\gFlxkQI.exe
  C:\Windows\System\gFlxkQI.exe
  2⤵
  PID:8576
- C:\Windows\System\zlVRNUO.exe
  C:\Windows\System\zlVRNUO.exe
  2⤵
  PID:7916
- C:\Windows\System\DthJUjS.exe
  C:\Windows\System\DthJUjS.exe
  2⤵
  PID:10004
- C:\Windows\System\MAheeDB.exe
  C:\Windows\System\MAheeDB.exe
  2⤵
  PID:9488
- C:\Windows\System\RFXfCDT.exe
  C:\Windows\System\RFXfCDT.exe
  2⤵
  PID:7264
- C:\Windows\System\BbTckef.exe
  C:\Windows\System\BbTckef.exe
  2⤵
  PID:9560
- C:\Windows\System\wWDDoOW.exe
  C:\Windows\System\wWDDoOW.exe
  2⤵
  PID:10344
- C:\Windows\System\IdlKdQD.exe
  C:\Windows\System\IdlKdQD.exe
  2⤵
  PID:10420
- C:\Windows\System\epnXhsv.exe
  C:\Windows\System\epnXhsv.exe
  2⤵
  PID:9928
- C:\Windows\System\nZWwDnH.exe
  C:\Windows\System\nZWwDnH.exe
  2⤵
  PID:10560
- C:\Windows\System\QYulBcO.exe
  C:\Windows\System\QYulBcO.exe
  2⤵
  PID:10616
- C:\Windows\System\HzcxEHZ.exe
  C:\Windows\System\HzcxEHZ.exe
  2⤵
  PID:9408
- C:\Windows\System\bMFvTqq.exe
  C:\Windows\System\bMFvTqq.exe
  2⤵
  PID:10712
- C:\Windows\System\pBZScst.exe
  C:\Windows\System\pBZScst.exe
  2⤵
  PID:10764
- C:\Windows\System\vaCfChU.exe
  C:\Windows\System\vaCfChU.exe
  2⤵
  PID:10868
- C:\Windows\System\LOOtdbL.exe
  C:\Windows\System\LOOtdbL.exe
  2⤵
  PID:10924
- C:\Windows\System\axwiHJe.exe
  C:\Windows\System\axwiHJe.exe
  2⤵
  PID:11008
- C:\Windows\System\tKCwoTc.exe
  C:\Windows\System\tKCwoTc.exe
  2⤵
  PID:11080
- C:\Windows\System\vDAvqKB.exe
  C:\Windows\System\vDAvqKB.exe
  2⤵
  PID:11108
- C:\Windows\System\pKMlZSF.exe
  C:\Windows\System\pKMlZSF.exe
  2⤵
  PID:11192
- C:\Windows\System\hnBaXzJ.exe
  C:\Windows\System\hnBaXzJ.exe
  2⤵
  PID:10588
- C:\Windows\System\AJWsrXh.exe
  C:\Windows\System\AJWsrXh.exe
  2⤵
  PID:9800
- C:\Windows\System\tCXZizU.exe
  C:\Windows\System\tCXZizU.exe
  2⤵
  PID:11288
- C:\Windows\System\rxHLriV.exe
  C:\Windows\System\rxHLriV.exe
  2⤵
  PID:11308
- C:\Windows\System\MHJQtyA.exe
  C:\Windows\System\MHJQtyA.exe
  2⤵
  PID:11336
- C:\Windows\System\WkIKIfa.exe
  C:\Windows\System\WkIKIfa.exe
  2⤵
  PID:11356
- C:\Windows\System\QuxiJkU.exe
  C:\Windows\System\QuxiJkU.exe
  2⤵
  PID:11380
- C:\Windows\System\xuTwXAW.exe
  C:\Windows\System\xuTwXAW.exe
  2⤵
  PID:11404
- C:\Windows\System\iDBerEO.exe
  C:\Windows\System\iDBerEO.exe
  2⤵
  PID:11428
- C:\Windows\System\AziwXBs.exe
  C:\Windows\System\AziwXBs.exe
  2⤵
  PID:11452
- C:\Windows\System\feunaiP.exe
  C:\Windows\System\feunaiP.exe
  2⤵
  PID:11472
- C:\Windows\System\xIfziuR.exe
  C:\Windows\System\xIfziuR.exe
  2⤵
  PID:11504
- C:\Windows\System\NpFyHeJ.exe
  C:\Windows\System\NpFyHeJ.exe
  2⤵
  PID:11532
- C:\Windows\System\yYbNFIZ.exe
  C:\Windows\System\yYbNFIZ.exe
  2⤵
  PID:11556
- C:\Windows\System\EHQnukq.exe
  C:\Windows\System\EHQnukq.exe
  2⤵
  PID:11588
- C:\Windows\System\FlRiJzc.exe
  C:\Windows\System\FlRiJzc.exe
  2⤵
  PID:11608
- C:\Windows\System\rTefUPt.exe
  C:\Windows\System\rTefUPt.exe
  2⤵
  PID:11640
- C:\Windows\System\XlSSJjt.exe
  C:\Windows\System\XlSSJjt.exe
  2⤵
  PID:11660
- C:\Windows\System\wEQsgsZ.exe
  C:\Windows\System\wEQsgsZ.exe
  2⤵
  PID:11688
- C:\Windows\System\iOMTXbn.exe
  C:\Windows\System\iOMTXbn.exe
  2⤵
  PID:11712
- C:\Windows\System\ZKTLiKq.exe
  C:\Windows\System\ZKTLiKq.exe
  2⤵
  PID:11736
- C:\Windows\System\uXExWrJ.exe
  C:\Windows\System\uXExWrJ.exe
  2⤵
  PID:11756
- C:\Windows\System\TUvcTcy.exe
  C:\Windows\System\TUvcTcy.exe
  2⤵
  PID:11784
- C:\Windows\System\Xdounua.exe
  C:\Windows\System\Xdounua.exe
  2⤵
  PID:11812
- C:\Windows\System\HMtkyYU.exe
  C:\Windows\System\HMtkyYU.exe
  2⤵
  PID:11836
- C:\Windows\System\vWRtkDC.exe
  C:\Windows\System\vWRtkDC.exe
  2⤵
  PID:11860
- C:\Windows\System\OhetgmO.exe
  C:\Windows\System\OhetgmO.exe
  2⤵
  PID:11884
- C:\Windows\System\WBYiHtg.exe
  C:\Windows\System\WBYiHtg.exe
  2⤵
  PID:11908
- C:\Windows\System\xqJyGBv.exe
  C:\Windows\System\xqJyGBv.exe
  2⤵
  PID:11936
- C:\Windows\System\NuULNkO.exe
  C:\Windows\System\NuULNkO.exe
  2⤵
  PID:11964
- C:\Windows\System\bvJtNNW.exe
  C:\Windows\System\bvJtNNW.exe
  2⤵
  PID:11992
- C:\Windows\System\sxYqeVH.exe
  C:\Windows\System\sxYqeVH.exe
  2⤵
  PID:12028
- C:\Windows\System\KRielbE.exe
  C:\Windows\System\KRielbE.exe
  2⤵
  PID:12056
- C:\Windows\System\YVZeeDj.exe
  C:\Windows\System\YVZeeDj.exe
  2⤵
  PID:12080
- C:\Windows\System\raopmQu.exe
  C:\Windows\System\raopmQu.exe
  2⤵
  PID:12104
- C:\Windows\System\KuslgaS.exe
  C:\Windows\System\KuslgaS.exe
  2⤵
  PID:12120
- C:\Windows\System\XQEPIJQ.exe
  C:\Windows\System\XQEPIJQ.exe
  2⤵
  PID:12152
- C:\Windows\System\mUTuxek.exe
  C:\Windows\System\mUTuxek.exe
  2⤵
  PID:12172
- C:\Windows\System\bTgAUJB.exe
  C:\Windows\System\bTgAUJB.exe
  2⤵
  PID:12208
- C:\Windows\System\KQigIwp.exe
  C:\Windows\System\KQigIwp.exe
  2⤵
  PID:12236
- C:\Windows\System\zVnReYq.exe
  C:\Windows\System\zVnReYq.exe
  2⤵
  PID:12264
- C:\Windows\System\eoIUozH.exe
  C:\Windows\System\eoIUozH.exe
  2⤵
  PID:10024
- C:\Windows\System\ckExCSR.exe
  C:\Windows\System\ckExCSR.exe
  2⤵
  PID:10272
- C:\Windows\System\SUrAUgx.exe
  C:\Windows\System\SUrAUgx.exe
  2⤵
  PID:10532
- C:\Windows\System\emALIqw.exe
  C:\Windows\System\emALIqw.exe
  2⤵
  PID:10956
- C:\Windows\System\PkDMNKX.exe
  C:\Windows\System\PkDMNKX.exe
  2⤵
  PID:9752
- C:\Windows\System\cfyJraB.exe
  C:\Windows\System\cfyJraB.exe
  2⤵
  PID:10936
- C:\Windows\System\IGoPwkV.exe
  C:\Windows\System\IGoPwkV.exe
  2⤵
  PID:11164
- C:\Windows\System\UEWyBiZ.exe
  C:\Windows\System\UEWyBiZ.exe
  2⤵
  PID:11140
- C:\Windows\System\StuGUCH.exe
  C:\Windows\System\StuGUCH.exe
  2⤵
  PID:10664
- C:\Windows\System\fwhMthb.exe
  C:\Windows\System\fwhMthb.exe
  2⤵
  PID:11120
- C:\Windows\System\hQRNiIr.exe
  C:\Windows\System\hQRNiIr.exe
  2⤵
  PID:11772
- C:\Windows\System\jTqrNIz.exe
  C:\Windows\System\jTqrNIz.exe
  2⤵
  PID:12232
- C:\Windows\System\YXgXGRX.exe
  C:\Windows\System\YXgXGRX.exe
  2⤵
  PID:11796
- C:\Windows\System\GnFBvYp.exe
  C:\Windows\System\GnFBvYp.exe
  2⤵
  PID:11328
- C:\Windows\System\xGqjOZv.exe
  C:\Windows\System\xGqjOZv.exe
  2⤵
  PID:12036
- C:\Windows\System\lLFrneQ.exe
  C:\Windows\System\lLFrneQ.exe
  2⤵
  PID:12116
- C:\Windows\System\yPTLPdz.exe
  C:\Windows\System\yPTLPdz.exe
  2⤵
  PID:12168
- C:\Windows\System\FASmgeu.exe
  C:\Windows\System\FASmgeu.exe
  2⤵
  PID:12304
- C:\Windows\System\dPmebzx.exe
  C:\Windows\System\dPmebzx.exe
  2⤵
  PID:12344
- C:\Windows\System\iLbcgFs.exe
  C:\Windows\System\iLbcgFs.exe
  2⤵
  PID:12404
- C:\Windows\System\HAeswYu.exe
  C:\Windows\System\HAeswYu.exe
  2⤵
  PID:12432
- C:\Windows\System\pHzxsoL.exe
  C:\Windows\System\pHzxsoL.exe
  2⤵
  PID:12464
- C:\Windows\System\XPNcnGd.exe
  C:\Windows\System\XPNcnGd.exe
  2⤵
  PID:12488
- C:\Windows\System\IFWPzlQ.exe
  C:\Windows\System\IFWPzlQ.exe
  2⤵
  PID:12520
- C:\Windows\System\TarwmjS.exe
  C:\Windows\System\TarwmjS.exe
  2⤵
  PID:12568
- C:\Windows\System\nfOhxzg.exe
  C:\Windows\System\nfOhxzg.exe
  2⤵
  PID:12592
- C:\Windows\System\EzIufCc.exe
  C:\Windows\System\EzIufCc.exe
  2⤵
  PID:12616
- C:\Windows\System\vlWfumz.exe
  C:\Windows\System\vlWfumz.exe
  2⤵
  PID:12648
- C:\Windows\System\SlOEkMR.exe
  C:\Windows\System\SlOEkMR.exe
  2⤵
  PID:12668
- C:\Windows\System\EYxpTYE.exe
  C:\Windows\System\EYxpTYE.exe
  2⤵
  PID:12688
- C:\Windows\System\EoVozGT.exe
  C:\Windows\System\EoVozGT.exe
  2⤵
  PID:12708
- C:\Windows\System\CoDfrFp.exe
  C:\Windows\System\CoDfrFp.exe
  2⤵
  PID:12740
- C:\Windows\System\nKKFjfM.exe
  C:\Windows\System\nKKFjfM.exe
  2⤵
  PID:12768
- C:\Windows\System\vlwzfEQ.exe
  C:\Windows\System\vlwzfEQ.exe
  2⤵
  PID:12792
- C:\Windows\System\eJaGaNd.exe
  C:\Windows\System\eJaGaNd.exe
  2⤵
  PID:12816
- C:\Windows\System\ixwiKJe.exe
  C:\Windows\System\ixwiKJe.exe
  2⤵
  PID:12836
- C:\Windows\System\khQARxG.exe
  C:\Windows\System\khQARxG.exe
  2⤵
  PID:12860
- C:\Windows\System\ssRMGCy.exe
  C:\Windows\System\ssRMGCy.exe
  2⤵
  PID:12884
- C:\Windows\System\qoeGlpL.exe
  C:\Windows\System\qoeGlpL.exe
  2⤵
  PID:12908
- C:\Windows\System\yiZgVLs.exe
  C:\Windows\System\yiZgVLs.exe
  2⤵
  PID:12924
- C:\Windows\System\iDPTatY.exe
  C:\Windows\System\iDPTatY.exe
  2⤵
  PID:12948
- C:\Windows\System\FzCxEmG.exe
  C:\Windows\System\FzCxEmG.exe
  2⤵
  PID:12972
- C:\Windows\System\COgYPeH.exe
  C:\Windows\System\COgYPeH.exe
  2⤵
  PID:13000
- C:\Windows\System\fBgGRkA.exe
  C:\Windows\System\fBgGRkA.exe
  2⤵
  PID:13024
- C:\Windows\System\ARPDuxP.exe
  C:\Windows\System\ARPDuxP.exe
  2⤵
  PID:13048
- C:\Windows\System\eQgYHWE.exe
  C:\Windows\System\eQgYHWE.exe
  2⤵
  PID:13072
- C:\Windows\System\oHBKBQY.exe
  C:\Windows\System\oHBKBQY.exe
  2⤵
  PID:13096
- C:\Windows\System\nADEhaq.exe
  C:\Windows\System\nADEhaq.exe
  2⤵
  PID:13116
- C:\Windows\System\GXuwPnV.exe
  C:\Windows\System\GXuwPnV.exe
  2⤵
  PID:13144
- C:\Windows\System\cXTCDPd.exe
  C:\Windows\System\cXTCDPd.exe
  2⤵
  PID:13168
- C:\Windows\System\YyYVeFc.exe
  C:\Windows\System\YyYVeFc.exe
  2⤵
  PID:13192
- C:\Windows\System\MbHZaIN.exe
  C:\Windows\System\MbHZaIN.exe
  2⤵
  PID:13212
- C:\Windows\System\EVwzNHU.exe
  C:\Windows\System\EVwzNHU.exe
  2⤵
  PID:13236
- C:\Windows\System\oebIEud.exe
  C:\Windows\System\oebIEud.exe
  2⤵
  PID:13264
- C:\Windows\System\rbKQjHj.exe
  C:\Windows\System\rbKQjHj.exe
  2⤵
  PID:13292
- C:\Windows\System\MnItbWh.exe
  C:\Windows\System\MnItbWh.exe
  2⤵
  PID:11448
- C:\Windows\System\krXuIFu.exe
  C:\Windows\System\krXuIFu.exe
  2⤵
  PID:10864
- C:\Windows\System\EllSkrR.exe
  C:\Windows\System\EllSkrR.exe
  2⤵
  PID:10732
- C:\Windows\System\ZPkdjmM.exe
  C:\Windows\System\ZPkdjmM.exe
  2⤵
  PID:12252
- C:\Windows\System\DHyUnKK.exe
  C:\Windows\System\DHyUnKK.exe
  2⤵
  PID:12132
- C:\Windows\System\vxVNuXQ.exe
  C:\Windows\System\vxVNuXQ.exe
  2⤵
  PID:11980
- C:\Windows\System\MSeCIrQ.exe
  C:\Windows\System\MSeCIrQ.exe
  2⤵
  PID:11276
- C:\Windows\System\QNgJwRz.exe
  C:\Windows\System\QNgJwRz.exe
  2⤵
  PID:8404
- C:\Windows\System\OMvyVwk.exe
  C:\Windows\System\OMvyVwk.exe
  2⤵
  PID:12076
- C:\Windows\System\HKATskP.exe
  C:\Windows\System\HKATskP.exe
  2⤵
  PID:12368
- C:\Windows\System\XzbKMBc.exe
  C:\Windows\System\XzbKMBc.exe
  2⤵
  PID:11804
- C:\Windows\System\bsjhlAm.exe
  C:\Windows\System\bsjhlAm.exe
  2⤵
  PID:11616
- C:\Windows\System\NRvRnYu.exe
  C:\Windows\System\NRvRnYu.exe
  2⤵
  PID:12944
- C:\Windows\System\njTwzGY.exe
  C:\Windows\System\njTwzGY.exe
  2⤵
  PID:12656
- C:\Windows\System\oTnYXFd.exe
  C:\Windows\System\oTnYXFd.exe
  2⤵
  PID:13036
- C:\Windows\System\fhPSyDC.exe
  C:\Windows\System\fhPSyDC.exe
  2⤵
  PID:12808
- C:\Windows\System\IbRJPTO.exe
  C:\Windows\System\IbRJPTO.exe
  2⤵
  PID:12484
- C:\Windows\System\asESXiV.exe
  C:\Windows\System\asESXiV.exe
  2⤵
  PID:12880
- C:\Windows\System\SRplYni.exe
  C:\Windows\System\SRplYni.exe
  2⤵
  PID:13260
- C:\Windows\System\LGfmdGD.exe
  C:\Windows\System\LGfmdGD.exe
  2⤵
  PID:13012
- C:\Windows\System\KEZZWAr.exe
  C:\Windows\System\KEZZWAr.exe
  2⤵
  PID:13228
- C:\Windows\System\WlcXnTP.exe
  C:\Windows\System\WlcXnTP.exe
  2⤵
  PID:13084
- C:\Windows\System\vbXpxLq.exe
  C:\Windows\System\vbXpxLq.exe
  2⤵
  PID:13344
- C:\Windows\System\xYWIvjp.exe
  C:\Windows\System\xYWIvjp.exe
  2⤵
  PID:13372
- C:\Windows\System\IphIMDJ.exe
  C:\Windows\System\IphIMDJ.exe
  2⤵
  PID:13392
- C:\Windows\System\kDfcLFL.exe
  C:\Windows\System\kDfcLFL.exe
  2⤵
  PID:13424
- C:\Windows\System\oeMeQcv.exe
  C:\Windows\System\oeMeQcv.exe
  2⤵
  PID:13468
- C:\Windows\System\XBKYEwC.exe
  C:\Windows\System\XBKYEwC.exe
  2⤵
  PID:13492
- C:\Windows\System\EKYVZzb.exe
  C:\Windows\System\EKYVZzb.exe
  2⤵
  PID:13520
- C:\Windows\System\loQZXKs.exe
  C:\Windows\System\loQZXKs.exe
  2⤵
  PID:13536
- C:\Windows\System\FNxBjhL.exe
  C:\Windows\System\FNxBjhL.exe
  2⤵
  PID:13560
- C:\Windows\System\zOdKtOj.exe
  C:\Windows\System\zOdKtOj.exe
  2⤵
  PID:13580
- C:\Windows\System\XOJkzaf.exe
  C:\Windows\System\XOJkzaf.exe
  2⤵
  PID:13604
- C:\Windows\System\UFWvSHE.exe
  C:\Windows\System\UFWvSHE.exe
  2⤵
  PID:13632
- C:\Windows\System\OAeqDYO.exe
  C:\Windows\System\OAeqDYO.exe
  2⤵
  PID:13656
- C:\Windows\System\ZROFsgi.exe
  C:\Windows\System\ZROFsgi.exe
  2⤵
  PID:13696
- C:\Windows\System\vQLrWSQ.exe
  C:\Windows\System\vQLrWSQ.exe
  2⤵
  PID:13728
- C:\Windows\System\HBxGHKy.exe
  C:\Windows\System\HBxGHKy.exe
  2⤵
  PID:13752
- C:\Windows\System\OcpTNnt.exe
  C:\Windows\System\OcpTNnt.exe
  2⤵
  PID:13772
- C:\Windows\System\obeHzKN.exe
  C:\Windows\System\obeHzKN.exe
  2⤵
  PID:13788
- C:\Windows\System\icFtBBz.exe
  C:\Windows\System\icFtBBz.exe
  2⤵
  PID:13820
- C:\Windows\System\ziRdDEJ.exe
  C:\Windows\System\ziRdDEJ.exe
  2⤵
  PID:13844
- C:\Windows\System\ejwrqwV.exe
  C:\Windows\System\ejwrqwV.exe
  2⤵
  PID:13868
- C:\Windows\System\qxCKAtE.exe
  C:\Windows\System\qxCKAtE.exe
  2⤵
  PID:13892
- C:\Windows\System\YbKcmmA.exe
  C:\Windows\System\YbKcmmA.exe
  2⤵
  PID:13916
- C:\Windows\System\iWrMqMu.exe
  C:\Windows\System\iWrMqMu.exe
  2⤵
  PID:13932
- C:\Windows\System\HuqECFv.exe
  C:\Windows\System\HuqECFv.exe
  2⤵
  PID:13952
- C:\Windows\System\OgGVZir.exe
  C:\Windows\System\OgGVZir.exe
  2⤵
  PID:13980
- C:\Windows\System\WYluPMa.exe
  C:\Windows\System\WYluPMa.exe
  2⤵
  PID:14000
- C:\Windows\System\WgiPMWg.exe
  C:\Windows\System\WgiPMWg.exe
  2⤵
  PID:14024
- C:\Windows\System\WuQjJeB.exe
  C:\Windows\System\WuQjJeB.exe
  2⤵
  PID:14052
- C:\Windows\System\lWQwdTK.exe
  C:\Windows\System\lWQwdTK.exe
  2⤵
  PID:14084
- C:\Windows\System\zbgMkhP.exe
  C:\Windows\System\zbgMkhP.exe
  2⤵
  PID:14104
- C:\Windows\System\CibxsVI.exe
  C:\Windows\System\CibxsVI.exe
  2⤵
  PID:14124
- C:\Windows\System\oNjDTzf.exe
  C:\Windows\System\oNjDTzf.exe
  2⤵
  PID:14148
- C:\Windows\System\IshoCCf.exe
  C:\Windows\System\IshoCCf.exe
  2⤵
  PID:14164
- C:\Windows\System\PlmptOS.exe
  C:\Windows\System\PlmptOS.exe
  2⤵
  PID:14192
- C:\Windows\System\TaOqPTR.exe
  C:\Windows\System\TaOqPTR.exe
  2⤵
  PID:14220
- C:\Windows\System\LRxAkWk.exe
  C:\Windows\System\LRxAkWk.exe
  2⤵
  PID:14244
- C:\Windows\System\mXBlofL.exe
  C:\Windows\System\mXBlofL.exe
  2⤵
  PID:14264
- C:\Windows\System\OtYknHh.exe
  C:\Windows\System\OtYknHh.exe
  2⤵
  PID:14296
- C:\Windows\System\wfgcPVd.exe
  C:\Windows\System\wfgcPVd.exe
  2⤵
  PID:14316
- C:\Windows\System\DLohuQJ.exe
  C:\Windows\System\DLohuQJ.exe
  2⤵
  PID:13272
- C:\Windows\System\ojEGjoX.exe
  C:\Windows\System\ojEGjoX.exe
  2⤵
  PID:12624
- C:\Windows\System\HUsRTLl.exe
  C:\Windows\System\HUsRTLl.exe
  2⤵
  PID:10400
- C:\Windows\System\OTVMNyT.exe
  C:\Windows\System\OTVMNyT.exe
  2⤵
  PID:12192
- C:\Windows\System\JgwTZDv.exe
  C:\Windows\System\JgwTZDv.exe
  2⤵
  PID:11732
- C:\Windows\System\NTlBviu.exe
  C:\Windows\System\NTlBviu.exe
  2⤵
  PID:13020
- C:\Windows\System\YgYcxot.exe
  C:\Windows\System\YgYcxot.exe
  2⤵
  PID:13332
- C:\Windows\System\AdtJWyP.exe
  C:\Windows\System\AdtJWyP.exe
  2⤵
  PID:13784
- C:\Windows\System\XXvAcsv.exe
  C:\Windows\System\XXvAcsv.exe
  2⤵
  PID:13404
- C:\Windows\System\gPNhNqh.exe
  C:\Windows\System\gPNhNqh.exe
  2⤵
  PID:12696
- C:\Windows\System\gOcwSGp.exe
  C:\Windows\System\gOcwSGp.exe
  2⤵
  PID:13924
- C:\Windows\System\rFzodiI.exe
  C:\Windows\System\rFzodiI.exe
  2⤵
  PID:13624
- C:\Windows\System\bKGhBpj.exe
  C:\Windows\System\bKGhBpj.exe
  2⤵
  PID:14180
- C:\Windows\System\IoPrsdK.exe
  C:\Windows\System\IoPrsdK.exe
  2⤵
  PID:14188
- C:\Windows\System\rqdhPuA.exe
  C:\Windows\System\rqdhPuA.exe
  2⤵
  PID:13912
- C:\Windows\System\nlsEwIj.exe
  C:\Windows\System\nlsEwIj.exe
  2⤵
  PID:14012
- C:\Windows\System\NEfZjzb.exe
  C:\Windows\System\NEfZjzb.exe
  2⤵
  PID:14020
- C:\Windows\System\TCIsljA.exe
  C:\Windows\System\TCIsljA.exe
  2⤵
  PID:14252
- C:\Windows\System\slaFmCG.exe
  C:\Windows\System\slaFmCG.exe
  2⤵
  PID:14204
- C:\Windows\System\AqBdvRv.exe
  C:\Windows\System\AqBdvRv.exe
  2⤵
  PID:14036
- C:\Windows\System\pWTXBZB.exe
  C:\Windows\System\pWTXBZB.exe
  2⤵
  PID:14076
- C:\Windows\System\gkzHChi.exe
  C:\Windows\System\gkzHChi.exe
  2⤵
  PID:14212
- C:\Windows\System\vOiinLB.exe
  C:\Windows\System\vOiinLB.exe
  2⤵
  PID:13160
- C:\Windows\System\nqcEOUG.exe
  C:\Windows\System\nqcEOUG.exe
  2⤵
  PID:13740
- C:\Windows\System\phQSnWY.exe
  C:\Windows\System\phQSnWY.exe
  2⤵
  PID:13972
- C:\Windows\System\oTikpdZ.exe
  C:\Windows\System\oTikpdZ.exe
  2⤵
  PID:14160
- C:\Windows\System\iLWxgVN.exe
  C:\Windows\System\iLWxgVN.exe
  2⤵
  PID:13888
- C:\Windows\System\oBjXGhT.exe
  C:\Windows\System\oBjXGhT.exe
  2⤵
  PID:6628
- C:\Windows\System\WYPSaUf.exe
  C:\Windows\System\WYPSaUf.exe
  2⤵
  PID:13860
- C:\Windows\System\FCcifSG.exe
  C:\Windows\System\FCcifSG.exe
  2⤵
  PID:14356
- C:\Windows\System\kzttmSn.exe
  C:\Windows\System\kzttmSn.exe
  2⤵
  PID:14384
- C:\Windows\System\PdTSMKc.exe
  C:\Windows\System\PdTSMKc.exe
  2⤵
  PID:14400
- C:\Windows\System\zNekmqP.exe
  C:\Windows\System\zNekmqP.exe
  2⤵
  PID:14436
- C:\Windows\System\BOcTABW.exe
  C:\Windows\System\BOcTABW.exe
  2⤵
  PID:14464
- C:\Windows\System\lsdiowV.exe
  C:\Windows\System\lsdiowV.exe
  2⤵
  PID:14484
- C:\Windows\System\radZeuP.exe
  C:\Windows\System\radZeuP.exe
  2⤵
  PID:14500
- C:\Windows\System\lpQzSrM.exe
  C:\Windows\System\lpQzSrM.exe
  2⤵
  PID:14528
- C:\Windows\System\LTiaoYU.exe
  C:\Windows\System\LTiaoYU.exe
  2⤵
  PID:14548
- C:\Windows\System\CeyTbpW.exe
  C:\Windows\System\CeyTbpW.exe
  2⤵
  PID:14572
- C:\Windows\System\ERlsMyX.exe
  C:\Windows\System\ERlsMyX.exe
  2⤵
  PID:14596
- C:\Windows\System\GKcIXGX.exe
  C:\Windows\System\GKcIXGX.exe
  2⤵
  PID:14616
- C:\Windows\System\QxDEUPI.exe
  C:\Windows\System\QxDEUPI.exe
  2⤵
  PID:14632
- C:\Windows\System\PMJYSWk.exe
  C:\Windows\System\PMJYSWk.exe
  2⤵
  PID:14660
- C:\Windows\System\mcgUcZi.exe
  C:\Windows\System\mcgUcZi.exe
  2⤵
  PID:14680
- C:\Windows\System\SWccMFB.exe
  C:\Windows\System\SWccMFB.exe
  2⤵
  PID:14696
- C:\Windows\System\rReOYom.exe
  C:\Windows\System\rReOYom.exe
  2⤵
  PID:14716
- C:\Windows\System\xyAlyUH.exe
  C:\Windows\System\xyAlyUH.exe
  2⤵
  PID:14752
- C:\Windows\System\kyuMZZJ.exe
  C:\Windows\System\kyuMZZJ.exe
  2⤵
  PID:14780
- C:\Windows\System\PWVaeuR.exe
  C:\Windows\System\PWVaeuR.exe
  2⤵
  PID:14796
- C:\Windows\System\DmxyKIk.exe
  C:\Windows\System\DmxyKIk.exe
  2⤵
  PID:14812
- C:\Windows\System\OmqoUwA.exe
  C:\Windows\System\OmqoUwA.exe
  2⤵
  PID:14852
- C:\Windows\System\ROVFeby.exe
  C:\Windows\System\ROVFeby.exe
  2⤵
  PID:14872
- C:\Windows\System\DhACJgQ.exe
  C:\Windows\System\DhACJgQ.exe
  2⤵
  PID:14908
- C:\Windows\System\hGSWeph.exe
  C:\Windows\System\hGSWeph.exe
  2⤵
  PID:14932
- C:\Windows\System\lxzouWP.exe
  C:\Windows\System\lxzouWP.exe
  2⤵
  PID:14952
- C:\Windows\System\rHUsluk.exe
  C:\Windows\System\rHUsluk.exe
  2⤵
  PID:14972
- C:\Windows\System\jYakTME.exe
  C:\Windows\System\jYakTME.exe
  2⤵
  PID:15004
- C:\Windows\System\RFwVEoU.exe
  C:\Windows\System\RFwVEoU.exe
  2⤵
  PID:15024
- C:\Windows\System\URmbQDm.exe
  C:\Windows\System\URmbQDm.exe
  2⤵
  PID:15044
- C:\Windows\System\zyCeOjK.exe
  C:\Windows\System\zyCeOjK.exe
  2⤵
  PID:15068
- C:\Windows\System\KytXDaR.exe
  C:\Windows\System\KytXDaR.exe
  2⤵
  PID:15088
- C:\Windows\System\jULBMWx.exe
  C:\Windows\System\jULBMWx.exe
  2⤵
  PID:15112
- C:\Windows\System\ppsMsht.exe
  C:\Windows\System\ppsMsht.exe
  2⤵
  PID:15132
- C:\Windows\System\kmGKybt.exe
  C:\Windows\System\kmGKybt.exe
  2⤵
  PID:15152
- C:\Windows\System\EStJJYu.exe
  C:\Windows\System\EStJJYu.exe
  2⤵
  PID:15180
- C:\Windows\System\LUFmgBA.exe
  C:\Windows\System\LUFmgBA.exe
  2⤵
  PID:15212
- C:\Windows\System\ehUdFWR.exe
  C:\Windows\System\ehUdFWR.exe
  2⤵
  PID:15236
- C:\Windows\System\vMppjfY.exe
  C:\Windows\System\vMppjfY.exe
  2⤵
  PID:15260
- C:\Windows\System\OnIgrdV.exe
  C:\Windows\System\OnIgrdV.exe
  2⤵
  PID:15284
- C:\Windows\System\MeKhulb.exe
  C:\Windows\System\MeKhulb.exe
  2⤵
  PID:15316
- C:\Windows\System\YyRbYVl.exe
  C:\Windows\System\YyRbYVl.exe
  2⤵
  PID:15336
- C:\Windows\System\olxWorx.exe
  C:\Windows\System\olxWorx.exe
  2⤵
  PID:15352
- C:\Windows\System\kdkPsBQ.exe
  C:\Windows\System\kdkPsBQ.exe
  2⤵
  PID:13304
- C:\Windows\System\KAUkuat.exe
  C:\Windows\System\KAUkuat.exe
  2⤵
  PID:13672
- C:\Windows\System\fQPLRqa.exe
  C:\Windows\System\fQPLRqa.exe
  2⤵
  PID:13736
- C:\Windows\System\JBdEpen.exe
  C:\Windows\System\JBdEpen.exe
  2⤵
  PID:13456
- C:\Windows\System\LALYXHA.exe
  C:\Windows\System\LALYXHA.exe
  2⤵
  PID:14432
- C:\Windows\System\ZQAKpIu.exe
  C:\Windows\System\ZQAKpIu.exe
  2⤵
  PID:14456
- C:\Windows\System\fAGXnTU.exe
  C:\Windows\System\fAGXnTU.exe
  2⤵
  PID:13388
- C:\Windows\System\DgioavK.exe
  C:\Windows\System\DgioavK.exe
  2⤵
  PID:14520
- C:\Windows\System\xqHxvcR.exe
  C:\Windows\System\xqHxvcR.exe
  2⤵
  PID:14556
- C:\Windows\System\mNNBTas.exe
  C:\Windows\System\mNNBTas.exe
  2⤵
  PID:14984
- C:\Windows\System\MDjSoOh.exe
  C:\Windows\System\MDjSoOh.exe
  2⤵
  PID:15228
- C:\Windows\System\kcyDDMv.exe
  C:\Windows\System\kcyDDMv.exe
  2⤵
  PID:14920
- C:\Windows\System\sWRiYGs.exe
  C:\Windows\System\sWRiYGs.exe
  2⤵
  PID:14608
- C:\Windows\System\iFjtFGv.exe
  C:\Windows\System\iFjtFGv.exe
  2⤵
  PID:14668
- C:\Windows\System\aBHWLWf.exe
  C:\Windows\System\aBHWLWf.exe
  2⤵
  PID:14708
- C:\Windows\System\RfidAOY.exe
  C:\Windows\System\RfidAOY.exe
  2⤵
  PID:14832
- C:\Windows\System\aJNrBdz.exe
  C:\Windows\System\aJNrBdz.exe
  2⤵
  PID:14868
- C:\Windows\System\kTRivym.exe
  C:\Windows\System\kTRivym.exe
  2⤵
  PID:15000
- C:\Windows\System\pVFbaFA.exe
  C:\Windows\System\pVFbaFA.exe
  2⤵
  PID:15064
- C:\Windows\System\uUKEGtl.exe
  C:\Windows\System\uUKEGtl.exe
  2⤵
  PID:14900
- C:\Windows\System\FZrvutq.exe
  C:\Windows\System\FZrvutq.exe
  2⤵
  PID:14968
- C:\Windows\System\mCyQfvC.exe
  C:\Windows\System\mCyQfvC.exe
  2⤵
  PID:14808
- C:\Windows\System\buhXrIU.exe
  C:\Windows\System\buhXrIU.exe
  2⤵
  PID:15364
- C:\Windows\System\JhkUbco.exe
  C:\Windows\System\JhkUbco.exe
  2⤵
  PID:15400
- C:\Windows\System\jOexFHd.exe
  C:\Windows\System\jOexFHd.exe
  2⤵
  PID:15428
- C:\Windows\System\dYnyqQd.exe
  C:\Windows\System\dYnyqQd.exe
  2⤵
  PID:15456
- C:\Windows\System\sRqZXPl.exe
  C:\Windows\System\sRqZXPl.exe
  2⤵
  PID:15488
- C:\Windows\System\lkQpGdf.exe
  C:\Windows\System\lkQpGdf.exe
  2⤵
  PID:15512
- C:\Windows\System\UlyZIct.exe
  C:\Windows\System\UlyZIct.exe
  2⤵
  PID:15532
- C:\Windows\System\tEOTGdB.exe
  C:\Windows\System\tEOTGdB.exe
  2⤵
  PID:15576
- C:\Windows\System\jZANEYZ.exe
  C:\Windows\System\jZANEYZ.exe
  2⤵
  PID:15604
- C:\Windows\System\xlKXHYG.exe
  C:\Windows\System\xlKXHYG.exe
  2⤵
  PID:15636
- C:\Windows\System\wBeHOpq.exe
  C:\Windows\System\wBeHOpq.exe
  2⤵
  PID:15656
- C:\Windows\System\FYegtzQ.exe
  C:\Windows\System\FYegtzQ.exe
  2⤵
  PID:15680
- C:\Windows\System\jAqTkUj.exe
  C:\Windows\System\jAqTkUj.exe
  2⤵
  PID:15856
- C:\Windows\System\vMOxZJB.exe
  C:\Windows\System\vMOxZJB.exe
  2⤵
  PID:15884
- C:\Windows\System\KQltvgI.exe
  C:\Windows\System\KQltvgI.exe
  2⤵
  PID:15920
- C:\Windows\System\MZkquzf.exe
  C:\Windows\System\MZkquzf.exe
  2⤵
  PID:15948
- C:\Windows\System\UHMxbJb.exe
  C:\Windows\System\UHMxbJb.exe
  2⤵
  PID:16004
- C:\Windows\System\ieXBbPr.exe
  C:\Windows\System\ieXBbPr.exe
  2⤵
  PID:16028
- C:\Windows\System\yIAMCAs.exe
  C:\Windows\System\yIAMCAs.exe
  2⤵
  PID:16052
- C:\Windows\System\vlTemQm.exe
  C:\Windows\System\vlTemQm.exe
  2⤵
  PID:16068
- C:\Windows\System\OcEnzpE.exe
  C:\Windows\System\OcEnzpE.exe
  2⤵
  PID:16092
- C:\Windows\System\GRfmcQo.exe
  C:\Windows\System\GRfmcQo.exe
  2⤵
  PID:16116
- C:\Windows\System\UHhJTrh.exe
  C:\Windows\System\UHhJTrh.exe
  2⤵
  PID:16148
- C:\Windows\System\AZpMMVa.exe
  C:\Windows\System\AZpMMVa.exe
  2⤵
  PID:16168
- C:\Windows\System\yKZftbt.exe
  C:\Windows\System\yKZftbt.exe
  2⤵
  PID:16196
- C:\Windows\System\VEuzrdg.exe
  C:\Windows\System\VEuzrdg.exe
  2⤵
  PID:16212
- C:\Windows\System\hYwUbFh.exe
  C:\Windows\System\hYwUbFh.exe
  2⤵
  PID:16244
- C:\Windows\System\tVbFuZd.exe
  C:\Windows\System\tVbFuZd.exe
  2⤵
  PID:16268
- C:\Windows\System\gIHRVah.exe
  C:\Windows\System\gIHRVah.exe
  2⤵
  PID:16300
- C:\Windows\System\AgkhSik.exe
  C:\Windows\System\AgkhSik.exe
  2⤵
  PID:16328
- C:\Windows\System\dTmfIdu.exe
  C:\Windows\System\dTmfIdu.exe
  2⤵
  PID:16348
- C:\Windows\System\qpeKpvG.exe
  C:\Windows\System\qpeKpvG.exe
  2⤵
  PID:16372
- C:\Windows\System\mOXgKzH.exe
  C:\Windows\System\mOXgKzH.exe
  2⤵
  PID:13544
- C:\Windows\System\JHhgcog.exe
  C:\Windows\System\JHhgcog.exe
  2⤵
  PID:14140
- C:\Windows\System\nmkUExY.exe
  C:\Windows\System\nmkUExY.exe
  2⤵
  PID:14260
- C:\Windows\System\YjpAsKK.exe
  C:\Windows\System\YjpAsKK.exe
  2⤵
  PID:13928
- C:\Windows\System\xCdeBDv.exe
  C:\Windows\System\xCdeBDv.exe
  2⤵
  PID:13620
- C:\Windows\System\dzddRIX.exe
  C:\Windows\System\dzddRIX.exe
  2⤵
  PID:15148
- C:\Windows\System\HphTkVZ.exe
  C:\Windows\System\HphTkVZ.exe
  2⤵
  PID:14724
- C:\Windows\System\EpeqfRL.exe
  C:\Windows\System\EpeqfRL.exe
  2⤵
  PID:15096
- C:\Windows\System\uqVdXCb.exe
  C:\Windows\System\uqVdXCb.exe
  2⤵
  PID:15696
- C:\Windows\System\dBbQQZG.exe
  C:\Windows\System\dBbQQZG.exe
  2⤵
  PID:15380
- C:\Windows\System\LRYaEKm.exe
  C:\Windows\System\LRYaEKm.exe
  2⤵
  PID:15424
- C:\Windows\System\DdopmmK.exe
  C:\Windows\System\DdopmmK.exe
  2⤵
  PID:15904
- C:\Windows\System\lJyeeTF.exe
  C:\Windows\System\lJyeeTF.exe
  2⤵
  PID:15504
- C:\Windows\System\RUKnmbC.exe
  C:\Windows\System\RUKnmbC.exe
  2⤵
  PID:15768
- C:\Windows\System\LGRPMXN.exe
  C:\Windows\System\LGRPMXN.exe
  2⤵
  PID:15788
- C:\Windows\System\avrJQFl.exe
  C:\Windows\System\avrJQFl.exe
  2⤵
  PID:15616
- C:\Windows\System\VYGwwQt.exe
  C:\Windows\System\VYGwwQt.exe
  2⤵
  PID:16112
- C:\Windows\System\fZBiTQE.exe
  C:\Windows\System\fZBiTQE.exe
  2⤵
  PID:15912
- C:\Windows\System\WrlzLmZ.exe
  C:\Windows\System\WrlzLmZ.exe
  2⤵
  PID:15816
- C:\Windows\System\HdRQekV.exe
  C:\Windows\System\HdRQekV.exe
  2⤵
  PID:16012
- C:\Windows\System\MZCbYAD.exe
  C:\Windows\System\MZCbYAD.exe
  2⤵
  PID:16236
- C:\Windows\System\ytFfXvw.exe
  C:\Windows\System\ytFfXvw.exe
  2⤵
  PID:16292
- C:\Windows\System\figOtMt.exe
  C:\Windows\System\figOtMt.exe
  2⤵
  PID:16360
- C:\Windows\System\ACofWUk.exe
  C:\Windows\System\ACofWUk.exe
  2⤵
  PID:16164
- C:\Windows\System\YzroAFT.exe
  C:\Windows\System\YzroAFT.exe
  2⤵
  PID:15060
- C:\Windows\System\PTNKTGZ.exe
  C:\Windows\System\PTNKTGZ.exe
  2⤵
  PID:16228
- C:\Windows\System\pakWIoX.exe
  C:\Windows\System\pakWIoX.exe
  2⤵
  PID:16264
- C:\Windows\System\PuyTpXg.exe
  C:\Windows\System\PuyTpXg.exe
  2⤵
  PID:15252
- C:\Windows\System\vusCCnH.exe
  C:\Windows\System\vusCCnH.exe
  2⤵
  PID:15304
- C:\Windows\System\bhgdeco.exe
  C:\Windows\System\bhgdeco.exe
  2⤵
  PID:14044
- C:\Windows\System\MWURgkZ.exe
  C:\Windows\System\MWURgkZ.exe
  2⤵
  PID:16400
- C:\Windows\System\VbWPWVs.exe
  C:\Windows\System\VbWPWVs.exe
  2⤵
  PID:16428
- C:\Windows\System\HWkMYyW.exe
  C:\Windows\System\HWkMYyW.exe
  2⤵
  PID:16452
- C:\Windows\System\nhNKwfK.exe
  C:\Windows\System\nhNKwfK.exe
  2⤵
  PID:16468
- C:\Windows\System\pRVBkzo.exe
  C:\Windows\System\pRVBkzo.exe
  2⤵
  PID:16484
- C:\Windows\System\AkQcNLC.exe
  C:\Windows\System\AkQcNLC.exe
  2⤵
  PID:16504
- C:\Windows\System\vdwkwsh.exe
  C:\Windows\System\vdwkwsh.exe
  2⤵
  PID:16528
- C:\Windows\System\ojxAmHI.exe
  C:\Windows\System\ojxAmHI.exe
  2⤵
  PID:16556
- C:\Windows\System\LRWsPbh.exe
  C:\Windows\System\LRWsPbh.exe
  2⤵
  PID:16584
- C:\Windows\System\bVMQqsE.exe
  C:\Windows\System\bVMQqsE.exe
  2⤵
  PID:16600
- C:\Windows\System\qxiCxyJ.exe
  C:\Windows\System\qxiCxyJ.exe
  2⤵
  PID:16620
- C:\Windows\System\CYoDsLd.exe
  C:\Windows\System\CYoDsLd.exe
  2⤵
  PID:16644
- C:\Windows\System\UFYMEzG.exe
  C:\Windows\System\UFYMEzG.exe
  2⤵
  PID:16668
- C:\Windows\System\AMFiqHW.exe
  C:\Windows\System\AMFiqHW.exe
  2⤵
  PID:16700
- C:\Windows\System\IXseAYy.exe
  C:\Windows\System\IXseAYy.exe
  2⤵
  PID:16716
- C:\Windows\System\KZHVRqy.exe
  C:\Windows\System\KZHVRqy.exe
  2⤵
  PID:16736
- C:\Windows\System\uGwftcS.exe
  C:\Windows\System\uGwftcS.exe
  2⤵
  PID:16768
- C:\Windows\System\xQbITFI.exe
  C:\Windows\System\xQbITFI.exe
  2⤵
  PID:16928
- C:\Windows\System\VqsEfWd.exe
  C:\Windows\System\VqsEfWd.exe
  2⤵
  PID:16944
- C:\Windows\System\VKsrSmx.exe
  C:\Windows\System\VKsrSmx.exe
  2⤵
  PID:16960
- C:\Windows\System\ODKHyZw.exe
  C:\Windows\System\ODKHyZw.exe
  2⤵
  PID:16976
- C:\Windows\System\BKJVXpl.exe
  C:\Windows\System\BKJVXpl.exe
  2⤵
  PID:17008
- C:\Windows\System\SWwGozY.exe
  C:\Windows\System\SWwGozY.exe
  2⤵
  PID:17028
- C:\Windows\System\BiYxKAU.exe
  C:\Windows\System\BiYxKAU.exe
  2⤵
  PID:17052
- C:\Windows\System\pNrpMAe.exe
  C:\Windows\System\pNrpMAe.exe
  2⤵
  PID:17088
- C:\Windows\System\UoNjgyz.exe
  C:\Windows\System\UoNjgyz.exe
  2⤵
  PID:17128
- C:\Windows\System\gADVovz.exe
  C:\Windows\System\gADVovz.exe
  2⤵
  PID:17172

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:17372

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Accessibility Features

T1546.008

Privilege Escalation

Event Triggered Execution

T1546

Accessibility Features

T1546.008

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\BoiyjoD.exe

Filesize
1005KB

MD5
2d351aeee8cba69512e72b1041e4a30f

SHA1
abe3fa1c0cb8a4a891a2638b87f28a8f34a1613d

SHA256
73567faf02eda06a4f967df541454f73082ec417ba42b940af82bedf3f742fa1

SHA512
003d4c0a42a140f18c11a6280c3b12748dec2ccc6e30240601db671003a3dd39f00ed411c404f1d2e95c1447d3215e504b975733f71f76dc9fbb752a7351db38

Download Submit
C:\Windows\System\GltQMLq.exe

Filesize
1000KB

MD5
97a1f09c1212b89c981babf8ec8b322d

SHA1
7c8baccdc58b2b085f76b9a32b850ba39c5d6bcd

SHA256
b48e6a080258f78c0570364f84fd66cd2f2f1b05a6ceb925968b54aae64d9972

SHA512
0b31d9b677e6f4fdac07fb21a9817b28b2138143aff287a450180aa8acf74d67b99948e8edd608701c9eb5043856d4da0aaccaeb281bdacf7a57fddb6f2d05a0

Download Submit
C:\Windows\System\KmyGOsK.exe

Filesize
1007KB

MD5
9be8350e84e3245f7ae84560a414cddb

SHA1
7222e6df4250b62a7c9919bf0f2773e39ea361e6

SHA256
f550f0fa79bda6b562a473a71ef7740b2829ea8655979872d5fd98eae9c6bfa5

SHA512
7ab2f97d280ad336a6511f7623add2eea2a87c7dac0cbb9dd349b4bf66ebf2f0676d9df648f57d31291b015ce504f1db5c3ae4ac2373e2d41e497f06d19d4481

Download Submit
C:\Windows\System\NTzNBpu.exe

Filesize
1004KB

MD5
38089c040b8a58feb94273b062b2521b

SHA1
2e578c4acaf41dd3ddd6c0c3064115f9719e5194

SHA256
bbd611d5c512a666ee9eab4ae031fd685f225eb59dfacf2144937eaf54ac3141

SHA512
361a7e24d48805f272d6ce0909a7f981536b3a25646afc4c2e7d4920f838f52c2ffe622328a5830818abb03c6ea680fd8bc4703f74abf8926c74b38f56ae4a50

Download Submit
C:\Windows\System\NXmRkBA.exe

Filesize
1000KB

MD5
ba2c8e182598946316879b44ce138750

SHA1
db67645b720167aacbf9028703a84286a121d00d

SHA256
6be0374186faa62ef7aa7ce3685c537866986123e6fa8c85af1f5d289cdd096b

SHA512
85270f4ab6f7c775c7ae2170fedb3e0fe92d518bd57d22b0d217c0d70391f36899e4767314dbb46652851f4c8cd22ef8901747707f3a0923e0ef01dcc4e0265a

Download Submit
C:\Windows\System\PvvHRVc.exe

Filesize
1006KB

MD5
20314d789fb39f9bf30951885e961eb5

SHA1
2ee484b0355721c67c07f3b1d9136e467489dd5f

SHA256
47462f1484fe8fac0144f63662c9ffa8093711d6fe82f1e33493b0c40c01c8c2

SHA512
87c2c262c9366332e1a886074f9501a96b5e98ed6ee236f740fab12e8817950fd5654aac23e7981bc3d7719992faaa7a11060ce5365211aacc508f71d6663950

Download Submit
C:\Windows\System\QdfCSCT.exe

Filesize
1005KB

MD5
1d0300966d15f7f4bcbc7ff87128d9f3

SHA1
4e74cf323e4af092ea31f13400bd797d7d897a38

SHA256
f1165b1c2f3953160f148ac14634632f5cfd0bca4e8412a395e0c377c52b938c

SHA512
af912b7824a71ef5db18350c2c0ed14024e7bf3387f37ae37e86176bf22e3d52c205128af6e6cfd157860fd0f78d345c0686bb8c683f961fe570fec562f61046

Download Submit
C:\Windows\System\SyfQJBB.exe

Filesize
1004KB

MD5
1c0ac21c394b9c81795a24ab69c2f703

SHA1
3ed115c88128ab0bd74b5dad22cd44750b91b178

SHA256
f59ffbeed3932f3d9fe9388f0bca229f012d4751a9327cc937be023ca8b3bcb3

SHA512
42def5472d4e8878c894501bc4ed317f55cb2f0a72abe98a44e5a97cff9989d5dab9e0efd62ccb0b7c84a0c4694fe05913f2ab1558de028ab0388870c5858095

Download Submit
C:\Windows\System\TuDdfRe.exe

Filesize
1007KB

MD5
1c95c190b3de87be172df4ab52806441

SHA1
6188149dcdf4d957d063604837be07ce2a6991e4

SHA256
1119659f5a723460516c2daf2466c829661e8e2016f6b4b22cbd2f5612424432

SHA512
246f1790b8ff7a200042460ed2a27ee64e243f583a4c11967b970a6b6360be3e24e5b1bb44ff11d36d419c14189fdceb2db6731b1702fc6a17c4592c77e6531d

Download Submit
C:\Windows\System\ULOfwhf.exe

Filesize
1004KB

MD5
c935c68020b845c14ed04e10e892912b

SHA1
86e249104bb4a6d30aa30b73be87929c84ee2cb3

SHA256
ebd93fcba22a4426a35edaea5edd8d8c21b8a5dab43e8b724c1d6e11cc6414d9

SHA512
b6f436f03b80c10ff293e618dc0079aa7887248e51c333b2754df3edf6241e379bc2cd75041ee207de201c4ffad617f77225aef7bb83f393e96545af5cdc0f59

Download Submit
C:\Windows\System\YbpPsCL.exe

Filesize
1003KB

MD5
dce32f37ca717e8660854b58c4319c4e

SHA1
ec917cf84b4c495d63e46d3db57b66b323b9bc82

SHA256
dbc77d70ee3141b37157f506de2708070d38b4f2a84e3d6c5856c6c0c7fda672

SHA512
0fe35a70a008df0ca004b28edfdb7deafe39d375198ed499b21fbc494316d5833109a670f1dd8ca6972b6fe9e14eb4d8f9f7e7adb843e450b85e1469df389b02

Download Submit
C:\Windows\System\YcsAxYK.exe

Filesize
1006KB

MD5
460ab97629a227d6f15617ac9ec1d277

SHA1
779263a8658a40bf120589ef30036350dcd81f53

SHA256
6e554fc9afc0ab45234846be203a2cd134e0206e739a5cb89a578d516cd2f92a

SHA512
1263d62ffae90909ce91c0722dc3a56dabab01827dfe280a7f08476bc728acb55287f6d3c8a708219b3597deb72ef31cabc9389a88b7f1c288e2684e7b401999

Download Submit
C:\Windows\System\bcejoCY.exe

Filesize
1001KB

MD5
454c8e411491c9bbe5882ded1e3efd93

SHA1
c550df3242c90620eb302d442e57a6cc15fc20a2

SHA256
a07e13461813594c4ed4b92ff925a06aa223381637e926a0c59d9b7985d4784f

SHA512
4cf3b4d2289ae66955fdbd857ac96e7c88f50fcb1ff0e0b540c23f70964d162f737f106e285793d75c5830279c6c21813b8e1db185c43275a9308b0b794e3e86

Download Submit
C:\Windows\System\dFyBHig.exe

Filesize
1006KB

MD5
964f9c87ddbbbb4bb106aa90342762b5

SHA1
14f5c23f4a573c9d44106131c9df1f5e6d0b3e78

SHA256
06e6a1f6cfc0da6cc681700419e2a38aa99394edfcf8fb8154dc69da99a133d3

SHA512
15b4233cf877d0ed56d69a92921233f78f43cfc501c0bf57ce61bac121f6dae28a472f04f00b192efb8d5f9e079b88db93cff05b37e0a082faad305ac316937b

Download Submit
C:\Windows\System\eTPUdUp.exe

Filesize
1002KB

MD5
aad4b029555a4f83585bbd1e871ee5c4

SHA1
c7b3a296003d6eccea818941d063cfa877ed7cd0

SHA256
efeff55e815913d956142de16cc3a6986e43f1c8feb5a84b45f93f01539368f9

SHA512
9bd192c4e6017b41164501e92c9ee4a6e8f48a1dcecfb21ab8f4f5335bc751a4292a8cf80a35d3971037c7d9a476bb29052d7091ca14094a0e327be293f4ecf3

Download Submit
C:\Windows\System\frbNyTk.exe

Filesize
1002KB

MD5
b9a68acdfaa61de03234c3790cd1ec24

SHA1
11cdca21b3a12fddab47953acbd756b873c7bb94

SHA256
6afb9f3d5792b0ac46a6d130279f3af2129fb295569065d3a7f0e23f016601e0

SHA512
9205a81d5902ee02584dc093378a8484b5c505a722b2b544f85447d663dd648b18fb96b929406c98a8c592470b1f70a3ef6ea45125d5f5e9dc8aca50fda674ae

Download Submit
C:\Windows\System\hcMjSvx.exe

Filesize
1003KB

MD5
2b024a358a0da000852bc8ea973f6c42

SHA1
adf3b2692c364dbec28b7fdb3411c2d2cb3bee92

SHA256
f1a3e9868985739d59590bb2806d6d6b4e160dbc9d83aae9c8c29a736fa08d75

SHA512
7f66a1058101dcd4128cc22c1b03590e57b3ac33c6509176064e20f816d35bbb192f28a483c62d4ee082301a55896a1acc3613a111f397ca81d82113a236aa80

Download Submit
C:\Windows\System\ilRXMIl.exe

Filesize
1003KB

MD5
037a2b41c94a6ebba96e5c391344e2b0

SHA1
551079f9c70c69a7dc547c583ba4af828d90f1d2

SHA256
490ae3a3ba2a7c19ea889132885a2c4ddd604b515df9b16acca76315f5984987

SHA512
cf565b0298ec300ddcdbf6190de0eb399913a98ce7646a19e99676771beb51033dd746bb6b8040002e19b11fd99bc01548f1385af6ec828e681dcb1438d59cbe

Download Submit
C:\Windows\System\mssKhlA.exe

Filesize
1001KB

MD5
0c055b67cdaee659da512442b051ae89

SHA1
80d84eab67672a751b1bf86905dcaeb1d7ab782e

SHA256
3e8c06b00043a6644d9002733beb8b18c6277c8532143fd3c7c2211653adb853

SHA512
bfd079998e5dbb426ecfd179653b097462f3314c4ee4498ed94389c64a92d5ccc8982f98a295288770ee4b4246f4b8a697dbe94a1ce54daea975d881654e104f

Download Submit
C:\Windows\System\qVmcHBH.exe

Filesize
1006KB

MD5
1822f87e80eee0b9c4d6f48367245451

SHA1
aa000ce9b8d9353b175fa79e93c65daf5c38c885

SHA256
d5734e1d557ce6956414cb4aab20e95c0654cb25dfb70608794ede2f06dd26fa

SHA512
3c5f4dad0fdcc752fbce7fb915793ba3e21a3f2532c1bf71d3cbe389232c3bfedf7379ea08b21ad37aa19ac55c17d177ad4948d941dc8ad8f029b2ad90d41cac

Download Submit
C:\Windows\System\qdOLlZR.exe

Filesize
1001KB

MD5
2fd462ef4462ec75a7df076140930e93

SHA1
54bb0fc75971c0f8a932f652581d19b3b71ca0cf

SHA256
10bc6fd6ccf774612b2702ea17a55c348bf193d2e5d84f625ee71cf8eb622661

SHA512
059de1f8b20eda4f170d0932681cd832ea0d09b5d5592c1cbcabbe0d47aa0c45c26436af7ad2beca717a56d669f27d7086fa9828ee93fd1c6568da956ce74312

Download Submit
C:\Windows\System\qluyXoH.exe

Filesize
1005KB

MD5
2ffa626a2a73814a3c7d36f2d1c43a17

SHA1
ed7207d6c4c78d658c0f07c4d95ded3f01b3d9ae

SHA256
b71a6e220dcaa139bf83b5073975bda75aaa98c5ea6f5e892f5aec747e9d3296

SHA512
f3b053b5486cddb06fddfb283c3930a559db72721de9e02e8fe641d8bf477857c329117ff2ab73ad3e5ef5b0a70d6829e324ff8e49841b5ee3bc2177c0173c87

Download Submit
C:\Windows\System\qxTjapf.exe

Filesize
1005KB

MD5
bdfbffeed1758c81e3b765498779a3c8

SHA1
c65dcf8f265c5142b5e48e6dfd7830b1c54b36f7

SHA256
bf25955f19e5f641b6de2880191c64a3381a02c1f851d4ba6cb60d12488a2fd4

SHA512
30e07cf0abc1be4bae14575ccf1c48033b72de010a6a1cfc71214cba031eb584fb0229b3efae0b82e7557f9aa1aa791f47f0e2a3595952dce8245447e972002e

Download Submit
C:\Windows\System\rbfQesZ.exe

Filesize
1002KB

MD5
6d7f23d3ca26a67cb2914c4cde2899f0

SHA1
abef2a251d14e89e862dc1258c0873730432c7d6

SHA256
30618aaa4523c1a3937b0befdc61a198dcdd0be9fa7480da5521a16ffc66be1f

SHA512
03dc1bda1a5db9479aec7332762e04aaacbd2e0a31034881590c2cded0f91a8a2860419eeee1ba98b32b62afc83a7bfa40452441665521910c5c15fce2298630

Download Submit
C:\Windows\System\sDgtJzI.exe

Filesize
1004KB

MD5
da8a2834b93cb15b53c47c51a8c890bd

SHA1
7eaefa512abbfb5e8cf3224dc0e0bf70cacec5cb

SHA256
45858f5988950f7f782099a84f2a8167968b844c78846346e49192035396d772

SHA512
7cf6b89948476ee9307f18100e9648be6f92363689b666c2d9e78aa71685110c5d23448eb052705d442e7bf726cc7bacaab77cfad169c05dbf2e9221c074e31f

Download Submit
C:\Windows\System\sTnUQBP.exe

Filesize
1002KB

MD5
56cfd5283f4079a67a7e16cd4a554acb

SHA1
67d944ff299a2ff01f1562e987e9cf4736d5d993

SHA256
af52c029e1af6a248dde8b0cc7abd3e822adcfb67c01859bf7ebb5cf1fe19046

SHA512
c0f13ddb27d1726c4d3a33af616ce4fda04974e155485e23e62691006e0205b688b3d523c3a5e2a56cfd7b80fac9ca336b11eada55b33164a7b5571f5b35289c

Download Submit
C:\Windows\System\teFZNae.exe

Filesize
1003KB

MD5
2fe4284a77fb16097075c130acd22b4c

SHA1
b5f3e4701216c96c4b3274c043993a76c31363ec

SHA256
7e0f642b58bcda5b1f323bc1d87dea4a8b0e12d0fbae6dfc7d016900189e7dff

SHA512
27965e1e64be13600293fe276cc7e114b4992b3451c16bd62c9f0011e376d08c70c97c901fbc5329a4b71d13b066ba9ef9f7fa3a648f5019b6ff2d7ae076d4de

Download Submit
C:\Windows\System\txpyxiv.exe

Filesize
1003KB

MD5
3872cf3d560253baa283140e59a9302d

SHA1
aeec72c100cfba3cf0c4cda7345eb598da482465

SHA256
72161ff31f9bb9d268874553de6fa7f594157c5b48a2d9cbb53f787311b708af

SHA512
cfe1addf4d024a91569cebb77fa303471288b1a82cdece72922161ad61fea129579a86858b6d0dfbde27f5251f1dae5d5996b70690fa2225fee5cec038d8178d

Download Submit
C:\Windows\System\uggDqBT.exe

Filesize
1000KB

MD5
1dafa5aad8d1d8c39df39923d173f7df

SHA1
269a92ad509d9703cc23bf496b044e8b06c83d0d

SHA256
f732f0a2655bccf86126677adaae4feb860882d7ce5c7076a2d23a87cb80bbfb

SHA512
88e06e0b3dd549196f9812c9c9f2f525d5bb7709a38f1093ef224e9a937cbff78320ef97c3265293de0be88074fbf1e357c0247e0ee8eaf9f84800f9edc5cf3e

Download Submit
C:\Windows\System\vboSPNa.exe

Filesize
1000KB

MD5
eeeb4cd240522bb4cbf6cb6b299cb1e2

SHA1
f0c34fba4eee9cecb8ef9e7fdc9bbef076eb3e66

SHA256
2d1e2a1ebaeea897a83cf485b967238a6d22a696f827703a400b214d88be0754

SHA512
583fb25e386dbf1b41b94dcdfa9f9ff922a7ab69c9d3dbd0f6391832f9de9aa30bfabcb8fa8835c73d0a77d09b649a3befa3854cb7e9b042153408aadae0a401

Download Submit
C:\Windows\System\wGwyAhw.exe

Filesize
1007KB

MD5
ac5433dfa47475808684101fb2fde8c3

SHA1
9a5c93a7a93fbe0ccef066214bd9a4870ab7d103

SHA256
3fcc4e422a061b625591a97a3fd99c0a3bb087f7602119c662b0c962a7f5ac1d

SHA512
a975ed18d3e3da3e3c9d1c4d812e755695080545e76f5dc4faf639cdcf4fbe9808ccf6e02474d08162f3a0521588640ab91e4a821dad28950a464017b14fe005

Download Submit
C:\Windows\System\xxQIsvW.exe

Filesize
1001KB

MD5
4d377e64dcfe006580c4ca32928c1ac8

SHA1
45f7102b3098da8cd1bf2f964e7a1f832a0be7ce

SHA256
651d6f4550036746d037abd9415de6311233a4d36dfa142e60673bfe7cc50a46

SHA512
36cc554a1504c253ce739743437af438f175faca9784234f630b38b4ab219b8f3a70a075d16051ee72abe45e4ef1e621d127b09ac0bcc997d7c4ca73064e8a21

Download Submit
memory/3588-0-0x000001FD06C30000-0x000001FD06C40000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads