xmrig | ee4274a8f8a43e511bb2344cab067ee28394aede64b0e0fd4549f0e898403d33

Analysis

max time kernel
105s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
20-11-2024 05:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ee4274a8f8a43e511bb2344cab067ee28394aede64b0e0fd4549f0e898403d33.exe
Size

1.5MB
MD5

4a07b195b0f310cabb274aaa8aac53c4
SHA1

19a359409cb5b6c9835c2793ea03a536453e6670
SHA256

ee4274a8f8a43e511bb2344cab067ee28394aede64b0e0fd4549f0e898403d33
SHA512

8cc0a764d7456b0eec180346c40c1a556bb332062abc39df5b8162928e160e2fd8a1c81c050e259359cbbe2ebd80dfe678f5fbd6b1fcc8c8050f93448254a86c
SSDEEP

24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbpwlKensziXoSPqZScXoiRIKdlXm:GezaTF8FcNkNdfE0pZ9ozttwIRRXRnnw

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 32 IoCs

miner

resource	yara_rule
behavioral2/files/0x000c000000023b33-3.dat	xmrig
behavioral2/files/0x000a000000023b92-8.dat	xmrig
behavioral2/files/0x000b000000023b8e-12.dat	xmrig
behavioral2/files/0x000a000000023b93-20.dat	xmrig
behavioral2/files/0x000a000000023b95-23.dat	xmrig
behavioral2/files/0x000b000000023b8f-29.dat	xmrig
behavioral2/files/0x000a000000023b96-35.dat	xmrig
behavioral2/files/0x000a000000023b97-40.dat	xmrig
behavioral2/files/0x000a000000023b98-42.dat	xmrig
behavioral2/files/0x000a000000023b99-50.dat	xmrig
behavioral2/files/0x000a000000023b9a-54.dat	xmrig
behavioral2/files/0x000a000000023ba1-82.dat	xmrig
behavioral2/files/0x000a000000023ba2-95.dat	xmrig
behavioral2/files/0x000a000000023bac-137.dat	xmrig
behavioral2/files/0x000a000000023bb0-162.dat	xmrig
behavioral2/files/0x000a000000023baf-158.dat	xmrig
behavioral2/files/0x000a000000023bae-155.dat	xmrig
behavioral2/files/0x000a000000023bad-150.dat	xmrig
behavioral2/files/0x000a000000023bab-140.dat	xmrig
behavioral2/files/0x000a000000023baa-135.dat	xmrig
behavioral2/files/0x000a000000023ba9-130.dat	xmrig
behavioral2/files/0x000a000000023ba8-125.dat	xmrig
behavioral2/files/0x000a000000023ba7-120.dat	xmrig
behavioral2/files/0x0058000000023ba6-115.dat	xmrig
behavioral2/files/0x000a000000023ba5-110.dat	xmrig
behavioral2/files/0x0031000000023ba4-105.dat	xmrig
behavioral2/files/0x000a000000023ba3-100.dat	xmrig
behavioral2/files/0x000a000000023ba0-85.dat	xmrig
behavioral2/files/0x000a000000023b9f-80.dat	xmrig
behavioral2/files/0x000a000000023b9e-75.dat	xmrig
behavioral2/files/0x000a000000023b9d-70.dat	xmrig
behavioral2/files/0x000a000000023b9b-65.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2444	mivGZTa.exe
4772	oJkVABt.exe
4844	TokLKTZ.exe
3020	JGUHipP.exe
3524	gnnfflS.exe
2080	ZTvRRLW.exe
1112	pYTPDeB.exe
2392	rpHjbuK.exe
3316	nGCHEEG.exe
3548	kSZDpbU.exe
3696	ODmcwQL.exe
3476	lRrDsQI.exe
4976	mfCOXHf.exe
2788	BDjTAGm.exe
232	ZeGnMzl.exe
1440	qXJBCko.exe
3388	CbYXowS.exe
3748	iXPPYja.exe
2380	vHAOCPi.exe
512	FlytCdn.exe
5028	QCBTseM.exe
452	sQbumGH.exe
2376	brtztHS.exe
4160	fqllNNv.exe
3880	GepuUvh.exe
3888	OGTsDmx.exe
60	JGhFSVf.exe
1808	cicQqLW.exe
352	YukhZOe.exe
3212	sGHxmCA.exe
4276	dIWbNJM.exe
3308	QXsFLrc.exe
1876	zwPLvFj.exe
4560	kEwlhiy.exe
212	GKmHBeS.exe
1676	svxhhPX.exe
3988	XQoULDZ.exe
3936	nlrzhnF.exe
3552	vyLrdmO.exe
2424	anrTUlU.exe
1688	FEeYRXJ.exe
4344	kmWxNPS.exe
4360	LYecsOC.exe
2708	AYruoqq.exe
3676	LKBYtlJ.exe
2576	bgklCqI.exe
2408	IWlxvtS.exe
4660	jirNJOd.exe
556	vPdwkOA.exe
2532	tWkfKMg.exe
664	eOlPPES.exe
3508	dddUQsN.exe
3028	srhgXYW.exe
3016	HYsxpRz.exe
2544	YYpwYXS.exe
3724	IrqsDUI.exe
4288	uBLxIcO.exe
2388	uoaxZVu.exe
908	tRPXHyU.exe
4132	xrKeOXp.exe
3248	XpFLXJR.exe
1052	ROADNpP.exe
5032	JeeRPXO.exe
3024	KluTwJs.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\mPRLGUV.exe	ee4274a8f8a43e511bb2344cab067ee28394aede64b0e0fd4549f0e898403d33.exe
File created	C:\Windows\System\AnncqUr.exe	ee4274a8f8a43e511bb2344cab067ee28394aede64b0e0fd4549f0e898403d33.exe
File created	C:\Windows\System\rmJKFyN.exe	ee4274a8f8a43e511bb2344cab067ee28394aede64b0e0fd4549f0e898403d33.exe
File created	C:\Windows\System\zJsEVYk.exe	ee4274a8f8a43e511bb2344cab067ee28394aede64b0e0fd4549f0e898403d33.exe
File created	C:\Windows\System\ualNhrT.exe	ee4274a8f8a43e511bb2344cab067ee28394aede64b0e0fd4549f0e898403d33.exe
File created	C:\Windows\System\IciwkHQ.exe	ee4274a8f8a43e511bb2344cab067ee28394aede64b0e0fd4549f0e898403d33.exe
File created	C:\Windows\System\PATiOHw.exe	ee4274a8f8a43e511bb2344cab067ee28394aede64b0e0fd4549f0e898403d33.exe
File created	C:\Windows\System\CLBzAgu.exe	ee4274a8f8a43e511bb2344cab067ee28394aede64b0e0fd4549f0e898403d33.exe
File created	C:\Windows\System\TzMszzS.exe	ee4274a8f8a43e511bb2344cab067ee28394aede64b0e0fd4549f0e898403d33.exe
File created	C:\Windows\System\OYbKPGA.exe	ee4274a8f8a43e511bb2344cab067ee28394aede64b0e0fd4549f0e898403d33.exe
File created	C:\Windows\System\uzelZPp.exe	ee4274a8f8a43e511bb2344cab067ee28394aede64b0e0fd4549f0e898403d33.exe
File created	C:\Windows\System\PWGEAfh.exe	ee4274a8f8a43e511bb2344cab067ee28394aede64b0e0fd4549f0e898403d33.exe
File created	C:\Windows\System\LtObzKL.exe	ee4274a8f8a43e511bb2344cab067ee28394aede64b0e0fd4549f0e898403d33.exe
File created	C:\Windows\System\kklDqRh.exe	ee4274a8f8a43e511bb2344cab067ee28394aede64b0e0fd4549f0e898403d33.exe
File created	C:\Windows\System\cUEkiLx.exe	ee4274a8f8a43e511bb2344cab067ee28394aede64b0e0fd4549f0e898403d33.exe
File created	C:\Windows\System\DnZrGPb.exe	ee4274a8f8a43e511bb2344cab067ee28394aede64b0e0fd4549f0e898403d33.exe
File created	C:\Windows\System\gEMFoFZ.exe	ee4274a8f8a43e511bb2344cab067ee28394aede64b0e0fd4549f0e898403d33.exe
File created	C:\Windows\System\dwzIvkd.exe	ee4274a8f8a43e511bb2344cab067ee28394aede64b0e0fd4549f0e898403d33.exe
File created	C:\Windows\System\ZquXCbU.exe	ee4274a8f8a43e511bb2344cab067ee28394aede64b0e0fd4549f0e898403d33.exe
File created	C:\Windows\System\XTuSrWH.exe	ee4274a8f8a43e511bb2344cab067ee28394aede64b0e0fd4549f0e898403d33.exe
File created	C:\Windows\System\yAvEPMI.exe	ee4274a8f8a43e511bb2344cab067ee28394aede64b0e0fd4549f0e898403d33.exe
File created	C:\Windows\System\BJRgzYq.exe	ee4274a8f8a43e511bb2344cab067ee28394aede64b0e0fd4549f0e898403d33.exe
File created	C:\Windows\System\LrxtmGc.exe	ee4274a8f8a43e511bb2344cab067ee28394aede64b0e0fd4549f0e898403d33.exe
File created	C:\Windows\System\mPQbCeq.exe	ee4274a8f8a43e511bb2344cab067ee28394aede64b0e0fd4549f0e898403d33.exe
File created	C:\Windows\System\pNYuhAj.exe	ee4274a8f8a43e511bb2344cab067ee28394aede64b0e0fd4549f0e898403d33.exe
File created	C:\Windows\System\ECszXIZ.exe	ee4274a8f8a43e511bb2344cab067ee28394aede64b0e0fd4549f0e898403d33.exe
File created	C:\Windows\System\vPdwkOA.exe	ee4274a8f8a43e511bb2344cab067ee28394aede64b0e0fd4549f0e898403d33.exe
File created	C:\Windows\System\BthTnfC.exe	ee4274a8f8a43e511bb2344cab067ee28394aede64b0e0fd4549f0e898403d33.exe
File created	C:\Windows\System\PTbPEOo.exe	ee4274a8f8a43e511bb2344cab067ee28394aede64b0e0fd4549f0e898403d33.exe
File created	C:\Windows\System\lrosCgt.exe	ee4274a8f8a43e511bb2344cab067ee28394aede64b0e0fd4549f0e898403d33.exe
File created	C:\Windows\System\qjbLzdz.exe	ee4274a8f8a43e511bb2344cab067ee28394aede64b0e0fd4549f0e898403d33.exe
File created	C:\Windows\System\nGCHEEG.exe	ee4274a8f8a43e511bb2344cab067ee28394aede64b0e0fd4549f0e898403d33.exe
File created	C:\Windows\System\kUhIiTN.exe	ee4274a8f8a43e511bb2344cab067ee28394aede64b0e0fd4549f0e898403d33.exe
File created	C:\Windows\System\VegJowY.exe	ee4274a8f8a43e511bb2344cab067ee28394aede64b0e0fd4549f0e898403d33.exe
File created	C:\Windows\System\tivWIEq.exe	ee4274a8f8a43e511bb2344cab067ee28394aede64b0e0fd4549f0e898403d33.exe
File created	C:\Windows\System\xTmfIMY.exe	ee4274a8f8a43e511bb2344cab067ee28394aede64b0e0fd4549f0e898403d33.exe
File created	C:\Windows\System\NsOexpn.exe	ee4274a8f8a43e511bb2344cab067ee28394aede64b0e0fd4549f0e898403d33.exe
File created	C:\Windows\System\FcpjOMH.exe	ee4274a8f8a43e511bb2344cab067ee28394aede64b0e0fd4549f0e898403d33.exe
File created	C:\Windows\System\EKaqugF.exe	ee4274a8f8a43e511bb2344cab067ee28394aede64b0e0fd4549f0e898403d33.exe
File created	C:\Windows\System\BRxOAXF.exe	ee4274a8f8a43e511bb2344cab067ee28394aede64b0e0fd4549f0e898403d33.exe
File created	C:\Windows\System\KFrkEkx.exe	ee4274a8f8a43e511bb2344cab067ee28394aede64b0e0fd4549f0e898403d33.exe
File created	C:\Windows\System\NtcIrYT.exe	ee4274a8f8a43e511bb2344cab067ee28394aede64b0e0fd4549f0e898403d33.exe
File created	C:\Windows\System\pPtraeb.exe	ee4274a8f8a43e511bb2344cab067ee28394aede64b0e0fd4549f0e898403d33.exe
File created	C:\Windows\System\ldPVBjq.exe	ee4274a8f8a43e511bb2344cab067ee28394aede64b0e0fd4549f0e898403d33.exe
File created	C:\Windows\System\urJVtmA.exe	ee4274a8f8a43e511bb2344cab067ee28394aede64b0e0fd4549f0e898403d33.exe
File created	C:\Windows\System\UwPpASc.exe	ee4274a8f8a43e511bb2344cab067ee28394aede64b0e0fd4549f0e898403d33.exe
File created	C:\Windows\System\ACyFbzn.exe	ee4274a8f8a43e511bb2344cab067ee28394aede64b0e0fd4549f0e898403d33.exe
File created	C:\Windows\System\DqCBFUf.exe	ee4274a8f8a43e511bb2344cab067ee28394aede64b0e0fd4549f0e898403d33.exe
File created	C:\Windows\System\vCLzfJj.exe	ee4274a8f8a43e511bb2344cab067ee28394aede64b0e0fd4549f0e898403d33.exe
File created	C:\Windows\System\BFeJFMw.exe	ee4274a8f8a43e511bb2344cab067ee28394aede64b0e0fd4549f0e898403d33.exe
File created	C:\Windows\System\PHPRcDR.exe	ee4274a8f8a43e511bb2344cab067ee28394aede64b0e0fd4549f0e898403d33.exe
File created	C:\Windows\System\fLoHTUc.exe	ee4274a8f8a43e511bb2344cab067ee28394aede64b0e0fd4549f0e898403d33.exe
File created	C:\Windows\System\FlytCdn.exe	ee4274a8f8a43e511bb2344cab067ee28394aede64b0e0fd4549f0e898403d33.exe
File created	C:\Windows\System\MOfivMy.exe	ee4274a8f8a43e511bb2344cab067ee28394aede64b0e0fd4549f0e898403d33.exe
File created	C:\Windows\System\XOesgCv.exe	ee4274a8f8a43e511bb2344cab067ee28394aede64b0e0fd4549f0e898403d33.exe
File created	C:\Windows\System\RVSJFLK.exe	ee4274a8f8a43e511bb2344cab067ee28394aede64b0e0fd4549f0e898403d33.exe
File created	C:\Windows\System\oGjZArs.exe	ee4274a8f8a43e511bb2344cab067ee28394aede64b0e0fd4549f0e898403d33.exe
File created	C:\Windows\System\knPTurh.exe	ee4274a8f8a43e511bb2344cab067ee28394aede64b0e0fd4549f0e898403d33.exe
File created	C:\Windows\System\bBEfEHx.exe	ee4274a8f8a43e511bb2344cab067ee28394aede64b0e0fd4549f0e898403d33.exe
File created	C:\Windows\System\FTWSCta.exe	ee4274a8f8a43e511bb2344cab067ee28394aede64b0e0fd4549f0e898403d33.exe
File created	C:\Windows\System\tKDLEBL.exe	ee4274a8f8a43e511bb2344cab067ee28394aede64b0e0fd4549f0e898403d33.exe
File created	C:\Windows\System\sSWybWy.exe	ee4274a8f8a43e511bb2344cab067ee28394aede64b0e0fd4549f0e898403d33.exe
File created	C:\Windows\System\LYecsOC.exe	ee4274a8f8a43e511bb2344cab067ee28394aede64b0e0fd4549f0e898403d33.exe
File created	C:\Windows\System\rzGXoaJ.exe	ee4274a8f8a43e511bb2344cab067ee28394aede64b0e0fd4549f0e898403d33.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	14080	dwm.exe
Token: SeChangeNotifyPrivilege	14080	dwm.exe
Token: 33	14080	dwm.exe
Token: SeIncBasePriorityPrivilege	14080	dwm.exe
Token: SeShutdownPrivilege	14080	dwm.exe
Token: SeCreatePagefilePrivilege	14080	dwm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4380 wrote to memory of 2444	4380	ee4274a8f8a43e511bb2344cab067ee28394aede64b0e0fd4549f0e898403d33.exe	85
PID 4380 wrote to memory of 2444	4380	ee4274a8f8a43e511bb2344cab067ee28394aede64b0e0fd4549f0e898403d33.exe	85
PID 4380 wrote to memory of 4772	4380	ee4274a8f8a43e511bb2344cab067ee28394aede64b0e0fd4549f0e898403d33.exe	86
PID 4380 wrote to memory of 4772	4380	ee4274a8f8a43e511bb2344cab067ee28394aede64b0e0fd4549f0e898403d33.exe	86
PID 4380 wrote to memory of 4844	4380	ee4274a8f8a43e511bb2344cab067ee28394aede64b0e0fd4549f0e898403d33.exe	87
PID 4380 wrote to memory of 4844	4380	ee4274a8f8a43e511bb2344cab067ee28394aede64b0e0fd4549f0e898403d33.exe	87
PID 4380 wrote to memory of 3020	4380	ee4274a8f8a43e511bb2344cab067ee28394aede64b0e0fd4549f0e898403d33.exe	88
PID 4380 wrote to memory of 3020	4380	ee4274a8f8a43e511bb2344cab067ee28394aede64b0e0fd4549f0e898403d33.exe	88
PID 4380 wrote to memory of 3524	4380	ee4274a8f8a43e511bb2344cab067ee28394aede64b0e0fd4549f0e898403d33.exe	89
PID 4380 wrote to memory of 3524	4380	ee4274a8f8a43e511bb2344cab067ee28394aede64b0e0fd4549f0e898403d33.exe	89
PID 4380 wrote to memory of 2080	4380	ee4274a8f8a43e511bb2344cab067ee28394aede64b0e0fd4549f0e898403d33.exe	90
PID 4380 wrote to memory of 2080	4380	ee4274a8f8a43e511bb2344cab067ee28394aede64b0e0fd4549f0e898403d33.exe	90
PID 4380 wrote to memory of 1112	4380	ee4274a8f8a43e511bb2344cab067ee28394aede64b0e0fd4549f0e898403d33.exe	91
PID 4380 wrote to memory of 1112	4380	ee4274a8f8a43e511bb2344cab067ee28394aede64b0e0fd4549f0e898403d33.exe	91
PID 4380 wrote to memory of 2392	4380	ee4274a8f8a43e511bb2344cab067ee28394aede64b0e0fd4549f0e898403d33.exe	92
PID 4380 wrote to memory of 2392	4380	ee4274a8f8a43e511bb2344cab067ee28394aede64b0e0fd4549f0e898403d33.exe	92
PID 4380 wrote to memory of 3316	4380	ee4274a8f8a43e511bb2344cab067ee28394aede64b0e0fd4549f0e898403d33.exe	93
PID 4380 wrote to memory of 3316	4380	ee4274a8f8a43e511bb2344cab067ee28394aede64b0e0fd4549f0e898403d33.exe	93
PID 4380 wrote to memory of 3548	4380	ee4274a8f8a43e511bb2344cab067ee28394aede64b0e0fd4549f0e898403d33.exe	94
PID 4380 wrote to memory of 3548	4380	ee4274a8f8a43e511bb2344cab067ee28394aede64b0e0fd4549f0e898403d33.exe	94
PID 4380 wrote to memory of 3696	4380	ee4274a8f8a43e511bb2344cab067ee28394aede64b0e0fd4549f0e898403d33.exe	95
PID 4380 wrote to memory of 3696	4380	ee4274a8f8a43e511bb2344cab067ee28394aede64b0e0fd4549f0e898403d33.exe	95
PID 4380 wrote to memory of 3476	4380	ee4274a8f8a43e511bb2344cab067ee28394aede64b0e0fd4549f0e898403d33.exe	96
PID 4380 wrote to memory of 3476	4380	ee4274a8f8a43e511bb2344cab067ee28394aede64b0e0fd4549f0e898403d33.exe	96
PID 4380 wrote to memory of 4976	4380	ee4274a8f8a43e511bb2344cab067ee28394aede64b0e0fd4549f0e898403d33.exe	97
PID 4380 wrote to memory of 4976	4380	ee4274a8f8a43e511bb2344cab067ee28394aede64b0e0fd4549f0e898403d33.exe	97
PID 4380 wrote to memory of 2788	4380	ee4274a8f8a43e511bb2344cab067ee28394aede64b0e0fd4549f0e898403d33.exe	98
PID 4380 wrote to memory of 2788	4380	ee4274a8f8a43e511bb2344cab067ee28394aede64b0e0fd4549f0e898403d33.exe	98
PID 4380 wrote to memory of 232	4380	ee4274a8f8a43e511bb2344cab067ee28394aede64b0e0fd4549f0e898403d33.exe	99
PID 4380 wrote to memory of 232	4380	ee4274a8f8a43e511bb2344cab067ee28394aede64b0e0fd4549f0e898403d33.exe	99
PID 4380 wrote to memory of 1440	4380	ee4274a8f8a43e511bb2344cab067ee28394aede64b0e0fd4549f0e898403d33.exe	100
PID 4380 wrote to memory of 1440	4380	ee4274a8f8a43e511bb2344cab067ee28394aede64b0e0fd4549f0e898403d33.exe	100
PID 4380 wrote to memory of 3388	4380	ee4274a8f8a43e511bb2344cab067ee28394aede64b0e0fd4549f0e898403d33.exe	101
PID 4380 wrote to memory of 3388	4380	ee4274a8f8a43e511bb2344cab067ee28394aede64b0e0fd4549f0e898403d33.exe	101
PID 4380 wrote to memory of 3748	4380	ee4274a8f8a43e511bb2344cab067ee28394aede64b0e0fd4549f0e898403d33.exe	102
PID 4380 wrote to memory of 3748	4380	ee4274a8f8a43e511bb2344cab067ee28394aede64b0e0fd4549f0e898403d33.exe	102
PID 4380 wrote to memory of 2380	4380	ee4274a8f8a43e511bb2344cab067ee28394aede64b0e0fd4549f0e898403d33.exe	103
PID 4380 wrote to memory of 2380	4380	ee4274a8f8a43e511bb2344cab067ee28394aede64b0e0fd4549f0e898403d33.exe	103
PID 4380 wrote to memory of 512	4380	ee4274a8f8a43e511bb2344cab067ee28394aede64b0e0fd4549f0e898403d33.exe	104
PID 4380 wrote to memory of 512	4380	ee4274a8f8a43e511bb2344cab067ee28394aede64b0e0fd4549f0e898403d33.exe	104
PID 4380 wrote to memory of 5028	4380	ee4274a8f8a43e511bb2344cab067ee28394aede64b0e0fd4549f0e898403d33.exe	105
PID 4380 wrote to memory of 5028	4380	ee4274a8f8a43e511bb2344cab067ee28394aede64b0e0fd4549f0e898403d33.exe	105
PID 4380 wrote to memory of 452	4380	ee4274a8f8a43e511bb2344cab067ee28394aede64b0e0fd4549f0e898403d33.exe	106
PID 4380 wrote to memory of 452	4380	ee4274a8f8a43e511bb2344cab067ee28394aede64b0e0fd4549f0e898403d33.exe	106
PID 4380 wrote to memory of 2376	4380	ee4274a8f8a43e511bb2344cab067ee28394aede64b0e0fd4549f0e898403d33.exe	107
PID 4380 wrote to memory of 2376	4380	ee4274a8f8a43e511bb2344cab067ee28394aede64b0e0fd4549f0e898403d33.exe	107
PID 4380 wrote to memory of 4160	4380	ee4274a8f8a43e511bb2344cab067ee28394aede64b0e0fd4549f0e898403d33.exe	108
PID 4380 wrote to memory of 4160	4380	ee4274a8f8a43e511bb2344cab067ee28394aede64b0e0fd4549f0e898403d33.exe	108
PID 4380 wrote to memory of 3880	4380	ee4274a8f8a43e511bb2344cab067ee28394aede64b0e0fd4549f0e898403d33.exe	109
PID 4380 wrote to memory of 3880	4380	ee4274a8f8a43e511bb2344cab067ee28394aede64b0e0fd4549f0e898403d33.exe	109
PID 4380 wrote to memory of 3888	4380	ee4274a8f8a43e511bb2344cab067ee28394aede64b0e0fd4549f0e898403d33.exe	110
PID 4380 wrote to memory of 3888	4380	ee4274a8f8a43e511bb2344cab067ee28394aede64b0e0fd4549f0e898403d33.exe	110
PID 4380 wrote to memory of 60	4380	ee4274a8f8a43e511bb2344cab067ee28394aede64b0e0fd4549f0e898403d33.exe	111
PID 4380 wrote to memory of 60	4380	ee4274a8f8a43e511bb2344cab067ee28394aede64b0e0fd4549f0e898403d33.exe	111
PID 4380 wrote to memory of 1808	4380	ee4274a8f8a43e511bb2344cab067ee28394aede64b0e0fd4549f0e898403d33.exe	112
PID 4380 wrote to memory of 1808	4380	ee4274a8f8a43e511bb2344cab067ee28394aede64b0e0fd4549f0e898403d33.exe	112
PID 4380 wrote to memory of 352	4380	ee4274a8f8a43e511bb2344cab067ee28394aede64b0e0fd4549f0e898403d33.exe	113
PID 4380 wrote to memory of 352	4380	ee4274a8f8a43e511bb2344cab067ee28394aede64b0e0fd4549f0e898403d33.exe	113
PID 4380 wrote to memory of 3212	4380	ee4274a8f8a43e511bb2344cab067ee28394aede64b0e0fd4549f0e898403d33.exe	114
PID 4380 wrote to memory of 3212	4380	ee4274a8f8a43e511bb2344cab067ee28394aede64b0e0fd4549f0e898403d33.exe	114
PID 4380 wrote to memory of 4276	4380	ee4274a8f8a43e511bb2344cab067ee28394aede64b0e0fd4549f0e898403d33.exe	115
PID 4380 wrote to memory of 4276	4380	ee4274a8f8a43e511bb2344cab067ee28394aede64b0e0fd4549f0e898403d33.exe	115
PID 4380 wrote to memory of 3308	4380	ee4274a8f8a43e511bb2344cab067ee28394aede64b0e0fd4549f0e898403d33.exe	116
PID 4380 wrote to memory of 3308	4380	ee4274a8f8a43e511bb2344cab067ee28394aede64b0e0fd4549f0e898403d33.exe	116

C:\Users\Admin\AppData\Local\Temp\ee4274a8f8a43e511bb2344cab067ee28394aede64b0e0fd4549f0e898403d33.exe
"C:\Users\Admin\AppData\Local\Temp\ee4274a8f8a43e511bb2344cab067ee28394aede64b0e0fd4549f0e898403d33.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4380
- C:\Windows\System\mivGZTa.exe
  C:\Windows\System\mivGZTa.exe
  2⤵
  - Executes dropped EXE
  PID:2444
- C:\Windows\System\oJkVABt.exe
  C:\Windows\System\oJkVABt.exe
  2⤵
  - Executes dropped EXE
  PID:4772
- C:\Windows\System\TokLKTZ.exe
  C:\Windows\System\TokLKTZ.exe
  2⤵
  - Executes dropped EXE
  PID:4844
- C:\Windows\System\JGUHipP.exe
  C:\Windows\System\JGUHipP.exe
  2⤵
  - Executes dropped EXE
  PID:3020
- C:\Windows\System\gnnfflS.exe
  C:\Windows\System\gnnfflS.exe
  2⤵
  - Executes dropped EXE
  PID:3524
- C:\Windows\System\ZTvRRLW.exe
  C:\Windows\System\ZTvRRLW.exe
  2⤵
  - Executes dropped EXE
  PID:2080
- C:\Windows\System\pYTPDeB.exe
  C:\Windows\System\pYTPDeB.exe
  2⤵
  - Executes dropped EXE
  PID:1112
- C:\Windows\System\rpHjbuK.exe
  C:\Windows\System\rpHjbuK.exe
  2⤵
  - Executes dropped EXE
  PID:2392
- C:\Windows\System\nGCHEEG.exe
  C:\Windows\System\nGCHEEG.exe
  2⤵
  - Executes dropped EXE
  PID:3316
- C:\Windows\System\kSZDpbU.exe
  C:\Windows\System\kSZDpbU.exe
  2⤵
  - Executes dropped EXE
  PID:3548
- C:\Windows\System\ODmcwQL.exe
  C:\Windows\System\ODmcwQL.exe
  2⤵
  - Executes dropped EXE
  PID:3696
- C:\Windows\System\lRrDsQI.exe
  C:\Windows\System\lRrDsQI.exe
  2⤵
  - Executes dropped EXE
  PID:3476
- C:\Windows\System\mfCOXHf.exe
  C:\Windows\System\mfCOXHf.exe
  2⤵
  - Executes dropped EXE
  PID:4976
- C:\Windows\System\BDjTAGm.exe
  C:\Windows\System\BDjTAGm.exe
  2⤵
  - Executes dropped EXE
  PID:2788
- C:\Windows\System\ZeGnMzl.exe
  C:\Windows\System\ZeGnMzl.exe
  2⤵
  - Executes dropped EXE
  PID:232
- C:\Windows\System\qXJBCko.exe
  C:\Windows\System\qXJBCko.exe
  2⤵
  - Executes dropped EXE
  PID:1440
- C:\Windows\System\CbYXowS.exe
  C:\Windows\System\CbYXowS.exe
  2⤵
  - Executes dropped EXE
  PID:3388
- C:\Windows\System\iXPPYja.exe
  C:\Windows\System\iXPPYja.exe
  2⤵
  - Executes dropped EXE
  PID:3748
- C:\Windows\System\vHAOCPi.exe
  C:\Windows\System\vHAOCPi.exe
  2⤵
  - Executes dropped EXE
  PID:2380
- C:\Windows\System\FlytCdn.exe
  C:\Windows\System\FlytCdn.exe
  2⤵
  - Executes dropped EXE
  PID:512
- C:\Windows\System\QCBTseM.exe
  C:\Windows\System\QCBTseM.exe
  2⤵
  - Executes dropped EXE
  PID:5028
- C:\Windows\System\sQbumGH.exe
  C:\Windows\System\sQbumGH.exe
  2⤵
  - Executes dropped EXE
  PID:452
- C:\Windows\System\brtztHS.exe
  C:\Windows\System\brtztHS.exe
  2⤵
  - Executes dropped EXE
  PID:2376
- C:\Windows\System\fqllNNv.exe
  C:\Windows\System\fqllNNv.exe
  2⤵
  - Executes dropped EXE
  PID:4160
- C:\Windows\System\GepuUvh.exe
  C:\Windows\System\GepuUvh.exe
  2⤵
  - Executes dropped EXE
  PID:3880
- C:\Windows\System\OGTsDmx.exe
  C:\Windows\System\OGTsDmx.exe
  2⤵
  - Executes dropped EXE
  PID:3888
- C:\Windows\System\JGhFSVf.exe
  C:\Windows\System\JGhFSVf.exe
  2⤵
  - Executes dropped EXE
  PID:60
- C:\Windows\System\cicQqLW.exe
  C:\Windows\System\cicQqLW.exe
  2⤵
  - Executes dropped EXE
  PID:1808
- C:\Windows\System\YukhZOe.exe
  C:\Windows\System\YukhZOe.exe
  2⤵
  - Executes dropped EXE
  PID:352
- C:\Windows\System\sGHxmCA.exe
  C:\Windows\System\sGHxmCA.exe
  2⤵
  - Executes dropped EXE
  PID:3212
- C:\Windows\System\dIWbNJM.exe
  C:\Windows\System\dIWbNJM.exe
  2⤵
  - Executes dropped EXE
  PID:4276
- C:\Windows\System\QXsFLrc.exe
  C:\Windows\System\QXsFLrc.exe
  2⤵
  - Executes dropped EXE
  PID:3308
- C:\Windows\System\zwPLvFj.exe
  C:\Windows\System\zwPLvFj.exe
  2⤵
  - Executes dropped EXE
  PID:1876
- C:\Windows\System\kEwlhiy.exe
  C:\Windows\System\kEwlhiy.exe
  2⤵
  - Executes dropped EXE
  PID:4560
- C:\Windows\System\GKmHBeS.exe
  C:\Windows\System\GKmHBeS.exe
  2⤵
  - Executes dropped EXE
  PID:212
- C:\Windows\System\svxhhPX.exe
  C:\Windows\System\svxhhPX.exe
  2⤵
  - Executes dropped EXE
  PID:1676
- C:\Windows\System\XQoULDZ.exe
  C:\Windows\System\XQoULDZ.exe
  2⤵
  - Executes dropped EXE
  PID:3988
- C:\Windows\System\nlrzhnF.exe
  C:\Windows\System\nlrzhnF.exe
  2⤵
  - Executes dropped EXE
  PID:3936
- C:\Windows\System\vyLrdmO.exe
  C:\Windows\System\vyLrdmO.exe
  2⤵
  - Executes dropped EXE
  PID:3552
- C:\Windows\System\anrTUlU.exe
  C:\Windows\System\anrTUlU.exe
  2⤵
  - Executes dropped EXE
  PID:2424
- C:\Windows\System\FEeYRXJ.exe
  C:\Windows\System\FEeYRXJ.exe
  2⤵
  - Executes dropped EXE
  PID:1688
- C:\Windows\System\kmWxNPS.exe
  C:\Windows\System\kmWxNPS.exe
  2⤵
  - Executes dropped EXE
  PID:4344
- C:\Windows\System\LYecsOC.exe
  C:\Windows\System\LYecsOC.exe
  2⤵
  - Executes dropped EXE
  PID:4360
- C:\Windows\System\AYruoqq.exe
  C:\Windows\System\AYruoqq.exe
  2⤵
  - Executes dropped EXE
  PID:2708
- C:\Windows\System\LKBYtlJ.exe
  C:\Windows\System\LKBYtlJ.exe
  2⤵
  - Executes dropped EXE
  PID:3676
- C:\Windows\System\bgklCqI.exe
  C:\Windows\System\bgklCqI.exe
  2⤵
  - Executes dropped EXE
  PID:2576
- C:\Windows\System\IWlxvtS.exe
  C:\Windows\System\IWlxvtS.exe
  2⤵
  - Executes dropped EXE
  PID:2408
- C:\Windows\System\jirNJOd.exe
  C:\Windows\System\jirNJOd.exe
  2⤵
  - Executes dropped EXE
  PID:4660
- C:\Windows\System\vPdwkOA.exe
  C:\Windows\System\vPdwkOA.exe
  2⤵
  - Executes dropped EXE
  PID:556
- C:\Windows\System\tWkfKMg.exe
  C:\Windows\System\tWkfKMg.exe
  2⤵
  - Executes dropped EXE
  PID:2532
- C:\Windows\System\eOlPPES.exe
  C:\Windows\System\eOlPPES.exe
  2⤵
  - Executes dropped EXE
  PID:664
- C:\Windows\System\dddUQsN.exe
  C:\Windows\System\dddUQsN.exe
  2⤵
  - Executes dropped EXE
  PID:3508
- C:\Windows\System\srhgXYW.exe
  C:\Windows\System\srhgXYW.exe
  2⤵
  - Executes dropped EXE
  PID:3028
- C:\Windows\System\HYsxpRz.exe
  C:\Windows\System\HYsxpRz.exe
  2⤵
  - Executes dropped EXE
  PID:3016
- C:\Windows\System\YYpwYXS.exe
  C:\Windows\System\YYpwYXS.exe
  2⤵
  - Executes dropped EXE
  PID:2544
- C:\Windows\System\IrqsDUI.exe
  C:\Windows\System\IrqsDUI.exe
  2⤵
  - Executes dropped EXE
  PID:3724
- C:\Windows\System\uBLxIcO.exe
  C:\Windows\System\uBLxIcO.exe
  2⤵
  - Executes dropped EXE
  PID:4288
- C:\Windows\System\uoaxZVu.exe
  C:\Windows\System\uoaxZVu.exe
  2⤵
  - Executes dropped EXE
  PID:2388
- C:\Windows\System\tRPXHyU.exe
  C:\Windows\System\tRPXHyU.exe
  2⤵
  - Executes dropped EXE
  PID:908
- C:\Windows\System\xrKeOXp.exe
  C:\Windows\System\xrKeOXp.exe
  2⤵
  - Executes dropped EXE
  PID:4132
- C:\Windows\System\XpFLXJR.exe
  C:\Windows\System\XpFLXJR.exe
  2⤵
  - Executes dropped EXE
  PID:3248
- C:\Windows\System\ROADNpP.exe
  C:\Windows\System\ROADNpP.exe
  2⤵
  - Executes dropped EXE
  PID:1052
- C:\Windows\System\JeeRPXO.exe
  C:\Windows\System\JeeRPXO.exe
  2⤵
  - Executes dropped EXE
  PID:5032
- C:\Windows\System\KluTwJs.exe
  C:\Windows\System\KluTwJs.exe
  2⤵
  - Executes dropped EXE
  PID:3024
- C:\Windows\System\BYGBrko.exe
  C:\Windows\System\BYGBrko.exe
  2⤵
  PID:3792
- C:\Windows\System\rvyyKYf.exe
  C:\Windows\System\rvyyKYf.exe
  2⤵
  PID:2704
- C:\Windows\System\YjnInQH.exe
  C:\Windows\System\YjnInQH.exe
  2⤵
  PID:3312
- C:\Windows\System\pBRpiKj.exe
  C:\Windows\System\pBRpiKj.exe
  2⤵
  PID:5140
- C:\Windows\System\cVMkyan.exe
  C:\Windows\System\cVMkyan.exe
  2⤵
  PID:5168
- C:\Windows\System\sMXzcGr.exe
  C:\Windows\System\sMXzcGr.exe
  2⤵
  PID:5196
- C:\Windows\System\uYfMMFx.exe
  C:\Windows\System\uYfMMFx.exe
  2⤵
  PID:5224
- C:\Windows\System\twldSgB.exe
  C:\Windows\System\twldSgB.exe
  2⤵
  PID:5252
- C:\Windows\System\LUOXqDR.exe
  C:\Windows\System\LUOXqDR.exe
  2⤵
  PID:5280
- C:\Windows\System\jnkshmS.exe
  C:\Windows\System\jnkshmS.exe
  2⤵
  PID:5308
- C:\Windows\System\qxJelkJ.exe
  C:\Windows\System\qxJelkJ.exe
  2⤵
  PID:5336
- C:\Windows\System\lNmqhDG.exe
  C:\Windows\System\lNmqhDG.exe
  2⤵
  PID:5368
- C:\Windows\System\CGYGlWT.exe
  C:\Windows\System\CGYGlWT.exe
  2⤵
  PID:5392
- C:\Windows\System\IUGGnqg.exe
  C:\Windows\System\IUGGnqg.exe
  2⤵
  PID:5420
- C:\Windows\System\ThpTLmQ.exe
  C:\Windows\System\ThpTLmQ.exe
  2⤵
  PID:5448
- C:\Windows\System\oGjZArs.exe
  C:\Windows\System\oGjZArs.exe
  2⤵
  PID:5476
- C:\Windows\System\IHAcxHx.exe
  C:\Windows\System\IHAcxHx.exe
  2⤵
  PID:5508
- C:\Windows\System\EuyGueE.exe
  C:\Windows\System\EuyGueE.exe
  2⤵
  PID:5532
- C:\Windows\System\OyHPFew.exe
  C:\Windows\System\OyHPFew.exe
  2⤵
  PID:5564
- C:\Windows\System\WoNUrZl.exe
  C:\Windows\System\WoNUrZl.exe
  2⤵
  PID:5588
- C:\Windows\System\HEqldmS.exe
  C:\Windows\System\HEqldmS.exe
  2⤵
  PID:5616
- C:\Windows\System\SYLnERJ.exe
  C:\Windows\System\SYLnERJ.exe
  2⤵
  PID:5644
- C:\Windows\System\tUaAPsb.exe
  C:\Windows\System\tUaAPsb.exe
  2⤵
  PID:5676
- C:\Windows\System\cdHIcyY.exe
  C:\Windows\System\cdHIcyY.exe
  2⤵
  PID:5700
- C:\Windows\System\nsbKOBa.exe
  C:\Windows\System\nsbKOBa.exe
  2⤵
  PID:5728
- C:\Windows\System\HJIANNe.exe
  C:\Windows\System\HJIANNe.exe
  2⤵
  PID:5756
- C:\Windows\System\RiRlwKa.exe
  C:\Windows\System\RiRlwKa.exe
  2⤵
  PID:5780
- C:\Windows\System\JltCFMN.exe
  C:\Windows\System\JltCFMN.exe
  2⤵
  PID:5812
- C:\Windows\System\gOYavxP.exe
  C:\Windows\System\gOYavxP.exe
  2⤵
  PID:5840
- C:\Windows\System\YHvXBYo.exe
  C:\Windows\System\YHvXBYo.exe
  2⤵
  PID:5868
- C:\Windows\System\KSSdQgw.exe
  C:\Windows\System\KSSdQgw.exe
  2⤵
  PID:5896
- C:\Windows\System\JCihMxd.exe
  C:\Windows\System\JCihMxd.exe
  2⤵
  PID:5924
- C:\Windows\System\xohCZDJ.exe
  C:\Windows\System\xohCZDJ.exe
  2⤵
  PID:5952
- C:\Windows\System\YHBztBA.exe
  C:\Windows\System\YHBztBA.exe
  2⤵
  PID:5980
- C:\Windows\System\ZFFylFt.exe
  C:\Windows\System\ZFFylFt.exe
  2⤵
  PID:6044
- C:\Windows\System\lZAvxQu.exe
  C:\Windows\System\lZAvxQu.exe
  2⤵
  PID:6060
- C:\Windows\System\WMPcuPx.exe
  C:\Windows\System\WMPcuPx.exe
  2⤵
  PID:6076
- C:\Windows\System\exRhxJW.exe
  C:\Windows\System\exRhxJW.exe
  2⤵
  PID:6092
- C:\Windows\System\fsoNNig.exe
  C:\Windows\System\fsoNNig.exe
  2⤵
  PID:6116
- C:\Windows\System\lOdCNkl.exe
  C:\Windows\System\lOdCNkl.exe
  2⤵
  PID:2648
- C:\Windows\System\FrnNGRT.exe
  C:\Windows\System\FrnNGRT.exe
  2⤵
  PID:1932
- C:\Windows\System\ulHJqwM.exe
  C:\Windows\System\ulHJqwM.exe
  2⤵
  PID:1800
- C:\Windows\System\ygSkJdG.exe
  C:\Windows\System\ygSkJdG.exe
  2⤵
  PID:2332
- C:\Windows\System\CxDalTN.exe
  C:\Windows\System\CxDalTN.exe
  2⤵
  PID:5000
- C:\Windows\System\NtYFJah.exe
  C:\Windows\System\NtYFJah.exe
  2⤵
  PID:4496
- C:\Windows\System\VegJowY.exe
  C:\Windows\System\VegJowY.exe
  2⤵
  PID:3608
- C:\Windows\System\KFrkEkx.exe
  C:\Windows\System\KFrkEkx.exe
  2⤵
  PID:5152
- C:\Windows\System\ECszXIZ.exe
  C:\Windows\System\ECszXIZ.exe
  2⤵
  PID:5216
- C:\Windows\System\ZiwRShs.exe
  C:\Windows\System\ZiwRShs.exe
  2⤵
  PID:5272
- C:\Windows\System\ldzyKAT.exe
  C:\Windows\System\ldzyKAT.exe
  2⤵
  PID:5348
- C:\Windows\System\XVXNIUY.exe
  C:\Windows\System\XVXNIUY.exe
  2⤵
  PID:5408
- C:\Windows\System\znrfHIX.exe
  C:\Windows\System\znrfHIX.exe
  2⤵
  PID:5468
- C:\Windows\System\JjIkEUH.exe
  C:\Windows\System\JjIkEUH.exe
  2⤵
  PID:5544
- C:\Windows\System\lvHtcQp.exe
  C:\Windows\System\lvHtcQp.exe
  2⤵
  PID:5600
- C:\Windows\System\EaUyFVm.exe
  C:\Windows\System\EaUyFVm.exe
  2⤵
  PID:5660
- C:\Windows\System\nzNoYjl.exe
  C:\Windows\System\nzNoYjl.exe
  2⤵
  PID:5740
- C:\Windows\System\mPRLGUV.exe
  C:\Windows\System\mPRLGUV.exe
  2⤵
  PID:5796
- C:\Windows\System\BthTnfC.exe
  C:\Windows\System\BthTnfC.exe
  2⤵
  PID:5856
- C:\Windows\System\RTRZWCa.exe
  C:\Windows\System\RTRZWCa.exe
  2⤵
  PID:5916
- C:\Windows\System\DjzKLyb.exe
  C:\Windows\System\DjzKLyb.exe
  2⤵
  PID:5992
- C:\Windows\System\dVQNvhD.exe
  C:\Windows\System\dVQNvhD.exe
  2⤵
  PID:6056
- C:\Windows\System\gEpHbxM.exe
  C:\Windows\System\gEpHbxM.exe
  2⤵
  PID:6112
- C:\Windows\System\aXsLPGS.exe
  C:\Windows\System\aXsLPGS.exe
  2⤵
  PID:224
- C:\Windows\System\JRWCtOo.exe
  C:\Windows\System\JRWCtOo.exe
  2⤵
  PID:2004
- C:\Windows\System\cffgyOm.exe
  C:\Windows\System\cffgyOm.exe
  2⤵
  PID:4484
- C:\Windows\System\USkIQhq.exe
  C:\Windows\System\USkIQhq.exe
  2⤵
  PID:5208
- C:\Windows\System\ZXjnxUX.exe
  C:\Windows\System\ZXjnxUX.exe
  2⤵
  PID:5376
- C:\Windows\System\WynWYbp.exe
  C:\Windows\System\WynWYbp.exe
  2⤵
  PID:5496
- C:\Windows\System\miNvBWG.exe
  C:\Windows\System\miNvBWG.exe
  2⤵
  PID:5636
- C:\Windows\System\mvTYiFw.exe
  C:\Windows\System\mvTYiFw.exe
  2⤵
  PID:5772
- C:\Windows\System\MLgYzfB.exe
  C:\Windows\System\MLgYzfB.exe
  2⤵
  PID:6168
- C:\Windows\System\BmWNapy.exe
  C:\Windows\System\BmWNapy.exe
  2⤵
  PID:6200
- C:\Windows\System\pxAPiTZ.exe
  C:\Windows\System\pxAPiTZ.exe
  2⤵
  PID:6224
- C:\Windows\System\dEnLiiP.exe
  C:\Windows\System\dEnLiiP.exe
  2⤵
  PID:6252
- C:\Windows\System\ACyFbzn.exe
  C:\Windows\System\ACyFbzn.exe
  2⤵
  PID:6280
- C:\Windows\System\BSTbyJX.exe
  C:\Windows\System\BSTbyJX.exe
  2⤵
  PID:6308
- C:\Windows\System\yAvEPMI.exe
  C:\Windows\System\yAvEPMI.exe
  2⤵
  PID:6336
- C:\Windows\System\VjbDkKh.exe
  C:\Windows\System\VjbDkKh.exe
  2⤵
  PID:6364
- C:\Windows\System\FvmyFkz.exe
  C:\Windows\System\FvmyFkz.exe
  2⤵
  PID:6392
- C:\Windows\System\MshnqUm.exe
  C:\Windows\System\MshnqUm.exe
  2⤵
  PID:6424
- C:\Windows\System\aMdCAtA.exe
  C:\Windows\System\aMdCAtA.exe
  2⤵
  PID:6460
- C:\Windows\System\GqZNsCh.exe
  C:\Windows\System\GqZNsCh.exe
  2⤵
  PID:6488
- C:\Windows\System\sBVRlTz.exe
  C:\Windows\System\sBVRlTz.exe
  2⤵
  PID:6504
- C:\Windows\System\MqWaXhj.exe
  C:\Windows\System\MqWaXhj.exe
  2⤵
  PID:6532
- C:\Windows\System\kabcrtJ.exe
  C:\Windows\System\kabcrtJ.exe
  2⤵
  PID:6560
- C:\Windows\System\IhcXNNj.exe
  C:\Windows\System\IhcXNNj.exe
  2⤵
  PID:6588
- C:\Windows\System\fapbTQd.exe
  C:\Windows\System\fapbTQd.exe
  2⤵
  PID:6616
- C:\Windows\System\ItmlkqT.exe
  C:\Windows\System\ItmlkqT.exe
  2⤵
  PID:6644
- C:\Windows\System\xYKJTub.exe
  C:\Windows\System\xYKJTub.exe
  2⤵
  PID:6672
- C:\Windows\System\BYlBnqZ.exe
  C:\Windows\System\BYlBnqZ.exe
  2⤵
  PID:6700
- C:\Windows\System\spJeDdP.exe
  C:\Windows\System\spJeDdP.exe
  2⤵
  PID:6728
- C:\Windows\System\dDDgSVR.exe
  C:\Windows\System\dDDgSVR.exe
  2⤵
  PID:6756
- C:\Windows\System\HmHVtiZ.exe
  C:\Windows\System\HmHVtiZ.exe
  2⤵
  PID:6784
- C:\Windows\System\sZNYjur.exe
  C:\Windows\System\sZNYjur.exe
  2⤵
  PID:6812
- C:\Windows\System\bqCbZYc.exe
  C:\Windows\System\bqCbZYc.exe
  2⤵
  PID:6836
- C:\Windows\System\oEkyFZz.exe
  C:\Windows\System\oEkyFZz.exe
  2⤵
  PID:6868
- C:\Windows\System\pvJPGYv.exe
  C:\Windows\System\pvJPGYv.exe
  2⤵
  PID:6896
- C:\Windows\System\DFHCqDQ.exe
  C:\Windows\System\DFHCqDQ.exe
  2⤵
  PID:6924
- C:\Windows\System\DlcBxle.exe
  C:\Windows\System\DlcBxle.exe
  2⤵
  PID:6952
- C:\Windows\System\atJcxFI.exe
  C:\Windows\System\atJcxFI.exe
  2⤵
  PID:6980
- C:\Windows\System\fkydBiX.exe
  C:\Windows\System\fkydBiX.exe
  2⤵
  PID:7008
- C:\Windows\System\ljpBsMf.exe
  C:\Windows\System\ljpBsMf.exe
  2⤵
  PID:7036
- C:\Windows\System\TgTjTzV.exe
  C:\Windows\System\TgTjTzV.exe
  2⤵
  PID:7064
- C:\Windows\System\yFKePhL.exe
  C:\Windows\System\yFKePhL.exe
  2⤵
  PID:7092
- C:\Windows\System\odNCSXM.exe
  C:\Windows\System\odNCSXM.exe
  2⤵
  PID:7120
- C:\Windows\System\EgkOrHH.exe
  C:\Windows\System\EgkOrHH.exe
  2⤵
  PID:7148
- C:\Windows\System\QPGBcjA.exe
  C:\Windows\System\QPGBcjA.exe
  2⤵
  PID:1548
- C:\Windows\System\dcRqIbA.exe
  C:\Windows\System\dcRqIbA.exe
  2⤵
  PID:6024
- C:\Windows\System\ZoWHdJf.exe
  C:\Windows\System\ZoWHdJf.exe
  2⤵
  PID:2920
- C:\Windows\System\XOesgCv.exe
  C:\Windows\System\XOesgCv.exe
  2⤵
  PID:4428
- C:\Windows\System\suuTPLP.exe
  C:\Windows\System\suuTPLP.exe
  2⤵
  PID:5436
- C:\Windows\System\MLYrdEm.exe
  C:\Windows\System\MLYrdEm.exe
  2⤵
  PID:5716
- C:\Windows\System\vjcWPXO.exe
  C:\Windows\System\vjcWPXO.exe
  2⤵
  PID:6184
- C:\Windows\System\XtxXvVV.exe
  C:\Windows\System\XtxXvVV.exe
  2⤵
  PID:6244
- C:\Windows\System\CjpTiqw.exe
  C:\Windows\System\CjpTiqw.exe
  2⤵
  PID:6300
- C:\Windows\System\ZYWgIMc.exe
  C:\Windows\System\ZYWgIMc.exe
  2⤵
  PID:6376
- C:\Windows\System\BDmNTNl.exe
  C:\Windows\System\BDmNTNl.exe
  2⤵
  PID:6420
- C:\Windows\System\DnuJXgP.exe
  C:\Windows\System\DnuJXgP.exe
  2⤵
  PID:6476
- C:\Windows\System\gdfnIkp.exe
  C:\Windows\System\gdfnIkp.exe
  2⤵
  PID:6524
- C:\Windows\System\onzBPcp.exe
  C:\Windows\System\onzBPcp.exe
  2⤵
  PID:6600
- C:\Windows\System\VQlMGAw.exe
  C:\Windows\System\VQlMGAw.exe
  2⤵
  PID:6660
- C:\Windows\System\LeYHJbg.exe
  C:\Windows\System\LeYHJbg.exe
  2⤵
  PID:6720
- C:\Windows\System\rteppQC.exe
  C:\Windows\System\rteppQC.exe
  2⤵
  PID:6832
- C:\Windows\System\zNWxkpk.exe
  C:\Windows\System\zNWxkpk.exe
  2⤵
  PID:6888
- C:\Windows\System\ZFUQUny.exe
  C:\Windows\System\ZFUQUny.exe
  2⤵
  PID:3928
- C:\Windows\System\WHseslB.exe
  C:\Windows\System\WHseslB.exe
  2⤵
  PID:6996
- C:\Windows\System\jfckKeV.exe
  C:\Windows\System\jfckKeV.exe
  2⤵
  PID:4580
- C:\Windows\System\IiuCrVl.exe
  C:\Windows\System\IiuCrVl.exe
  2⤵
  PID:7076
- C:\Windows\System\AQpZFXM.exe
  C:\Windows\System\AQpZFXM.exe
  2⤵
  PID:7132
- C:\Windows\System\BJRgzYq.exe
  C:\Windows\System\BJRgzYq.exe
  2⤵
  PID:4728
- C:\Windows\System\jPNrrKU.exe
  C:\Windows\System\jPNrrKU.exe
  2⤵
  PID:2476
- C:\Windows\System\oJjjJsI.exe
  C:\Windows\System\oJjjJsI.exe
  2⤵
  PID:5580
- C:\Windows\System\nlhvIYX.exe
  C:\Windows\System\nlhvIYX.exe
  2⤵
  PID:4076
- C:\Windows\System\CcKZecZ.exe
  C:\Windows\System\CcKZecZ.exe
  2⤵
  PID:6328
- C:\Windows\System\HYjWplI.exe
  C:\Windows\System\HYjWplI.exe
  2⤵
  PID:3192
- C:\Windows\System\IdvRifZ.exe
  C:\Windows\System\IdvRifZ.exe
  2⤵
  PID:2372
- C:\Windows\System\DTjJBvU.exe
  C:\Windows\System\DTjJBvU.exe
  2⤵
  PID:6748
- C:\Windows\System\KtiTclN.exe
  C:\Windows\System\KtiTclN.exe
  2⤵
  PID:2432
- C:\Windows\System\RwIBygQ.exe
  C:\Windows\System\RwIBygQ.exe
  2⤵
  PID:6628
- C:\Windows\System\PqlghIw.exe
  C:\Windows\System\PqlghIw.exe
  2⤵
  PID:4692
- C:\Windows\System\ozdOSsf.exe
  C:\Windows\System\ozdOSsf.exe
  2⤵
  PID:2128
- C:\Windows\System\tsBcUiK.exe
  C:\Windows\System\tsBcUiK.exe
  2⤵
  PID:3220
- C:\Windows\System\cUEkiLx.exe
  C:\Windows\System\cUEkiLx.exe
  2⤵
  PID:2316
- C:\Windows\System\ffvRxMe.exe
  C:\Windows\System\ffvRxMe.exe
  2⤵
  PID:1080
- C:\Windows\System\tgoWCID.exe
  C:\Windows\System\tgoWCID.exe
  2⤵
  PID:5016
- C:\Windows\System\yCryTNr.exe
  C:\Windows\System\yCryTNr.exe
  2⤵
  PID:3256
- C:\Windows\System\Bonodug.exe
  C:\Windows\System\Bonodug.exe
  2⤵
  PID:1128
- C:\Windows\System\qicHFFc.exe
  C:\Windows\System\qicHFFc.exe
  2⤵
  PID:2304
- C:\Windows\System\PQPwqJG.exe
  C:\Windows\System\PQPwqJG.exe
  2⤵
  PID:1708
- C:\Windows\System\GBrHdhx.exe
  C:\Windows\System\GBrHdhx.exe
  2⤵
  PID:4612
- C:\Windows\System\FTWSCta.exe
  C:\Windows\System\FTWSCta.exe
  2⤵
  PID:5092
- C:\Windows\System\DtoKlMX.exe
  C:\Windows\System\DtoKlMX.exe
  2⤵
  PID:1392
- C:\Windows\System\DiyHSME.exe
  C:\Windows\System\DiyHSME.exe
  2⤵
  PID:6880
- C:\Windows\System\vrZseFG.exe
  C:\Windows\System\vrZseFG.exe
  2⤵
  PID:6944
- C:\Windows\System\qdARTOy.exe
  C:\Windows\System\qdARTOy.exe
  2⤵
  PID:3152
- C:\Windows\System\nyGAJio.exe
  C:\Windows\System\nyGAJio.exe
  2⤵
  PID:2176
- C:\Windows\System\wKiVAxB.exe
  C:\Windows\System\wKiVAxB.exe
  2⤵
  PID:3200
- C:\Windows\System\ZSRwjUe.exe
  C:\Windows\System\ZSRwjUe.exe
  2⤵
  PID:3824
- C:\Windows\System\thJzeoz.exe
  C:\Windows\System\thJzeoz.exe
  2⤵
  PID:6572
- C:\Windows\System\dLGhTyD.exe
  C:\Windows\System\dLGhTyD.exe
  2⤵
  PID:3620
- C:\Windows\System\ZfuUKuh.exe
  C:\Windows\System\ZfuUKuh.exe
  2⤵
  PID:2012
- C:\Windows\System\RoYGDbV.exe
  C:\Windows\System\RoYGDbV.exe
  2⤵
  PID:5108
- C:\Windows\System\DZrGpwY.exe
  C:\Windows\System\DZrGpwY.exe
  2⤵
  PID:2284
- C:\Windows\System\fzkrXSL.exe
  C:\Windows\System\fzkrXSL.exe
  2⤵
  PID:4540
- C:\Windows\System\nYAPxPz.exe
  C:\Windows\System\nYAPxPz.exe
  2⤵
  PID:4688
- C:\Windows\System\tLGNmDD.exe
  C:\Windows\System\tLGNmDD.exe
  2⤵
  PID:6860
- C:\Windows\System\sKvrpPa.exe
  C:\Windows\System\sKvrpPa.exe
  2⤵
  PID:5184
- C:\Windows\System\fjbHmdW.exe
  C:\Windows\System\fjbHmdW.exe
  2⤵
  PID:6516
- C:\Windows\System\lIxTosh.exe
  C:\Windows\System\lIxTosh.exe
  2⤵
  PID:4800
- C:\Windows\System\MbFBFBQ.exe
  C:\Windows\System\MbFBFBQ.exe
  2⤵
  PID:4100
- C:\Windows\System\sDFIOWX.exe
  C:\Windows\System\sDFIOWX.exe
  2⤵
  PID:6916
- C:\Windows\System\NtcIrYT.exe
  C:\Windows\System\NtcIrYT.exe
  2⤵
  PID:1772
- C:\Windows\System\kPYyWyD.exe
  C:\Windows\System\kPYyWyD.exe
  2⤵
  PID:7024
- C:\Windows\System\iEVSTci.exe
  C:\Windows\System\iEVSTci.exe
  2⤵
  PID:3772
- C:\Windows\System\TZXYhSZ.exe
  C:\Windows\System\TZXYhSZ.exe
  2⤵
  PID:7184
- C:\Windows\System\KsvownQ.exe
  C:\Windows\System\KsvownQ.exe
  2⤵
  PID:7224
- C:\Windows\System\uuJxqSZ.exe
  C:\Windows\System\uuJxqSZ.exe
  2⤵
  PID:7240
- C:\Windows\System\dNTQApP.exe
  C:\Windows\System\dNTQApP.exe
  2⤵
  PID:7268
- C:\Windows\System\MiibJnm.exe
  C:\Windows\System\MiibJnm.exe
  2⤵
  PID:7308
- C:\Windows\System\UnHRUQN.exe
  C:\Windows\System\UnHRUQN.exe
  2⤵
  PID:7336
- C:\Windows\System\svwsuhl.exe
  C:\Windows\System\svwsuhl.exe
  2⤵
  PID:7352
- C:\Windows\System\mOMMwgh.exe
  C:\Windows\System\mOMMwgh.exe
  2⤵
  PID:7368
- C:\Windows\System\pPtraeb.exe
  C:\Windows\System\pPtraeb.exe
  2⤵
  PID:7392
- C:\Windows\System\QHBrKLy.exe
  C:\Windows\System\QHBrKLy.exe
  2⤵
  PID:7420
- C:\Windows\System\mnuItYv.exe
  C:\Windows\System\mnuItYv.exe
  2⤵
  PID:7468
- C:\Windows\System\EvqckNb.exe
  C:\Windows\System\EvqckNb.exe
  2⤵
  PID:7484
- C:\Windows\System\QWQSpgY.exe
  C:\Windows\System\QWQSpgY.exe
  2⤵
  PID:7504
- C:\Windows\System\CpPHewB.exe
  C:\Windows\System\CpPHewB.exe
  2⤵
  PID:7564
- C:\Windows\System\gpKYlkz.exe
  C:\Windows\System\gpKYlkz.exe
  2⤵
  PID:7584
- C:\Windows\System\ddRgYmq.exe
  C:\Windows\System\ddRgYmq.exe
  2⤵
  PID:7600
- C:\Windows\System\extIoiE.exe
  C:\Windows\System\extIoiE.exe
  2⤵
  PID:7628
- C:\Windows\System\dDZbxOM.exe
  C:\Windows\System\dDZbxOM.exe
  2⤵
  PID:7660
- C:\Windows\System\MglWpdZ.exe
  C:\Windows\System\MglWpdZ.exe
  2⤵
  PID:7688
- C:\Windows\System\vsOBadk.exe
  C:\Windows\System\vsOBadk.exe
  2⤵
  PID:7712
- C:\Windows\System\FDoRSpU.exe
  C:\Windows\System\FDoRSpU.exe
  2⤵
  PID:7748
- C:\Windows\System\iPkeAZO.exe
  C:\Windows\System\iPkeAZO.exe
  2⤵
  PID:7788
- C:\Windows\System\CLBzAgu.exe
  C:\Windows\System\CLBzAgu.exe
  2⤵
  PID:7804
- C:\Windows\System\KfmAdjN.exe
  C:\Windows\System\KfmAdjN.exe
  2⤵
  PID:7832
- C:\Windows\System\WYsMmEe.exe
  C:\Windows\System\WYsMmEe.exe
  2⤵
  PID:7848
- C:\Windows\System\isoifPa.exe
  C:\Windows\System\isoifPa.exe
  2⤵
  PID:7864
- C:\Windows\System\yggzrPO.exe
  C:\Windows\System\yggzrPO.exe
  2⤵
  PID:7880
- C:\Windows\System\KigEmZh.exe
  C:\Windows\System\KigEmZh.exe
  2⤵
  PID:7924
- C:\Windows\System\sWBORja.exe
  C:\Windows\System\sWBORja.exe
  2⤵
  PID:7952
- C:\Windows\System\kUhIiTN.exe
  C:\Windows\System\kUhIiTN.exe
  2⤵
  PID:8000
- C:\Windows\System\AWGaGeD.exe
  C:\Windows\System\AWGaGeD.exe
  2⤵
  PID:8020
- C:\Windows\System\DnZrGPb.exe
  C:\Windows\System\DnZrGPb.exe
  2⤵
  PID:8052
- C:\Windows\System\vOgpFqP.exe
  C:\Windows\System\vOgpFqP.exe
  2⤵
  PID:8072
- C:\Windows\System\RqMIcZT.exe
  C:\Windows\System\RqMIcZT.exe
  2⤵
  PID:8088
- C:\Windows\System\EKExDCJ.exe
  C:\Windows\System\EKExDCJ.exe
  2⤵
  PID:8120
- C:\Windows\System\AmVIPhG.exe
  C:\Windows\System\AmVIPhG.exe
  2⤵
  PID:8144
- C:\Windows\System\kjkVKsC.exe
  C:\Windows\System\kjkVKsC.exe
  2⤵
  PID:8168
- C:\Windows\System\afoTudF.exe
  C:\Windows\System\afoTudF.exe
  2⤵
  PID:7232
- C:\Windows\System\VKfJRMB.exe
  C:\Windows\System\VKfJRMB.exe
  2⤵
  PID:7256
- C:\Windows\System\SqfhcRy.exe
  C:\Windows\System\SqfhcRy.exe
  2⤵
  PID:7328
- C:\Windows\System\dKoQbJO.exe
  C:\Windows\System\dKoQbJO.exe
  2⤵
  PID:7388
- C:\Windows\System\MVVlywN.exe
  C:\Windows\System\MVVlywN.exe
  2⤵
  PID:7444
- C:\Windows\System\GGRxFSh.exe
  C:\Windows\System\GGRxFSh.exe
  2⤵
  PID:7556
- C:\Windows\System\DelHteA.exe
  C:\Windows\System\DelHteA.exe
  2⤵
  PID:7636
- C:\Windows\System\WdXwIVn.exe
  C:\Windows\System\WdXwIVn.exe
  2⤵
  PID:7624
- C:\Windows\System\lPXwDLq.exe
  C:\Windows\System\lPXwDLq.exe
  2⤵
  PID:7784
- C:\Windows\System\heEicvL.exe
  C:\Windows\System\heEicvL.exe
  2⤵
  PID:7824
- C:\Windows\System\vlWwiGE.exe
  C:\Windows\System\vlWwiGE.exe
  2⤵
  PID:7856
- C:\Windows\System\QWBnQIm.exe
  C:\Windows\System\QWBnQIm.exe
  2⤵
  PID:7984
- C:\Windows\System\eCTpxqp.exe
  C:\Windows\System\eCTpxqp.exe
  2⤵
  PID:8028
- C:\Windows\System\JeRkcEK.exe
  C:\Windows\System\JeRkcEK.exe
  2⤵
  PID:8112
- C:\Windows\System\tbVbhZU.exe
  C:\Windows\System\tbVbhZU.exe
  2⤵
  PID:7180
- C:\Windows\System\eZRYaxs.exe
  C:\Windows\System\eZRYaxs.exe
  2⤵
  PID:7176
- C:\Windows\System\SUQSMjY.exe
  C:\Windows\System\SUQSMjY.exe
  2⤵
  PID:7320
- C:\Windows\System\iYOzuus.exe
  C:\Windows\System\iYOzuus.exe
  2⤵
  PID:7720
- C:\Windows\System\lNVdWqg.exe
  C:\Windows\System\lNVdWqg.exe
  2⤵
  PID:7908
- C:\Windows\System\BCYrNoK.exe
  C:\Windows\System\BCYrNoK.exe
  2⤵
  PID:8084
- C:\Windows\System\daHhZWL.exe
  C:\Windows\System\daHhZWL.exe
  2⤵
  PID:7236
- C:\Windows\System\KCPmFGR.exe
  C:\Windows\System\KCPmFGR.exe
  2⤵
  PID:7700
- C:\Windows\System\bWYBkpf.exe
  C:\Windows\System\bWYBkpf.exe
  2⤵
  PID:8064
- C:\Windows\System\LLAbGsg.exe
  C:\Windows\System\LLAbGsg.exe
  2⤵
  PID:8212
- C:\Windows\System\dsAiPhu.exe
  C:\Windows\System\dsAiPhu.exe
  2⤵
  PID:8240
- C:\Windows\System\uGNukNg.exe
  C:\Windows\System\uGNukNg.exe
  2⤵
  PID:8264
- C:\Windows\System\OoqzBmA.exe
  C:\Windows\System\OoqzBmA.exe
  2⤵
  PID:8284
- C:\Windows\System\DqCBFUf.exe
  C:\Windows\System\DqCBFUf.exe
  2⤵
  PID:8312
- C:\Windows\System\rQmuQHk.exe
  C:\Windows\System\rQmuQHk.exe
  2⤵
  PID:8332
- C:\Windows\System\GDdMAVP.exe
  C:\Windows\System\GDdMAVP.exe
  2⤵
  PID:8360
- C:\Windows\System\IVhzaeE.exe
  C:\Windows\System\IVhzaeE.exe
  2⤵
  PID:8388
- C:\Windows\System\QJkcwlh.exe
  C:\Windows\System\QJkcwlh.exe
  2⤵
  PID:8420
- C:\Windows\System\QgGkekq.exe
  C:\Windows\System\QgGkekq.exe
  2⤵
  PID:8468
- C:\Windows\System\azWLFuH.exe
  C:\Windows\System\azWLFuH.exe
  2⤵
  PID:8496
- C:\Windows\System\tivWIEq.exe
  C:\Windows\System\tivWIEq.exe
  2⤵
  PID:8524
- C:\Windows\System\brcvvJy.exe
  C:\Windows\System\brcvvJy.exe
  2⤵
  PID:8544
- C:\Windows\System\OzOjFQQ.exe
  C:\Windows\System\OzOjFQQ.exe
  2⤵
  PID:8572
- C:\Windows\System\vwSzKYR.exe
  C:\Windows\System\vwSzKYR.exe
  2⤵
  PID:8596
- C:\Windows\System\EYQWUBg.exe
  C:\Windows\System\EYQWUBg.exe
  2⤵
  PID:8620
- C:\Windows\System\IUgAiyP.exe
  C:\Windows\System\IUgAiyP.exe
  2⤵
  PID:8652
- C:\Windows\System\bIdAsXN.exe
  C:\Windows\System\bIdAsXN.exe
  2⤵
  PID:8696
- C:\Windows\System\SVZyHni.exe
  C:\Windows\System\SVZyHni.exe
  2⤵
  PID:8728
- C:\Windows\System\txTJSqm.exe
  C:\Windows\System\txTJSqm.exe
  2⤵
  PID:8748
- C:\Windows\System\opUwcer.exe
  C:\Windows\System\opUwcer.exe
  2⤵
  PID:8768
- C:\Windows\System\gEMFoFZ.exe
  C:\Windows\System\gEMFoFZ.exe
  2⤵
  PID:8796
- C:\Windows\System\ldPVBjq.exe
  C:\Windows\System\ldPVBjq.exe
  2⤵
  PID:8824
- C:\Windows\System\RbruuYg.exe
  C:\Windows\System\RbruuYg.exe
  2⤵
  PID:8856
- C:\Windows\System\lfujefU.exe
  C:\Windows\System\lfujefU.exe
  2⤵
  PID:8880
- C:\Windows\System\EKfwiCL.exe
  C:\Windows\System\EKfwiCL.exe
  2⤵
  PID:8904
- C:\Windows\System\wBZlVmK.exe
  C:\Windows\System\wBZlVmK.exe
  2⤵
  PID:8924
- C:\Windows\System\vRbjayB.exe
  C:\Windows\System\vRbjayB.exe
  2⤵
  PID:8984
- C:\Windows\System\GVvGFDN.exe
  C:\Windows\System\GVvGFDN.exe
  2⤵
  PID:9008
- C:\Windows\System\qvUtpiE.exe
  C:\Windows\System\qvUtpiE.exe
  2⤵
  PID:9032
- C:\Windows\System\tGLwnXZ.exe
  C:\Windows\System\tGLwnXZ.exe
  2⤵
  PID:9056
- C:\Windows\System\EXiapAS.exe
  C:\Windows\System\EXiapAS.exe
  2⤵
  PID:9088
- C:\Windows\System\DkyUxLS.exe
  C:\Windows\System\DkyUxLS.exe
  2⤵
  PID:9104
- C:\Windows\System\romjyyF.exe
  C:\Windows\System\romjyyF.exe
  2⤵
  PID:9140
- C:\Windows\System\XdonCWx.exe
  C:\Windows\System\XdonCWx.exe
  2⤵
  PID:9172
- C:\Windows\System\ZwOCHTj.exe
  C:\Windows\System\ZwOCHTj.exe
  2⤵
  PID:9212
- C:\Windows\System\nuJRvdN.exe
  C:\Windows\System\nuJRvdN.exe
  2⤵
  PID:8068
- C:\Windows\System\FgFZste.exe
  C:\Windows\System\FgFZste.exe
  2⤵
  PID:8224
- C:\Windows\System\AOmHuVj.exe
  C:\Windows\System\AOmHuVj.exe
  2⤵
  PID:8292
- C:\Windows\System\RqmjPIw.exe
  C:\Windows\System\RqmjPIw.exe
  2⤵
  PID:8348
- C:\Windows\System\yOJisvX.exe
  C:\Windows\System\yOJisvX.exe
  2⤵
  PID:8444
- C:\Windows\System\KTxiyxJ.exe
  C:\Windows\System\KTxiyxJ.exe
  2⤵
  PID:8448
- C:\Windows\System\WBaLtEC.exe
  C:\Windows\System\WBaLtEC.exe
  2⤵
  PID:8584
- C:\Windows\System\JiBuRdD.exe
  C:\Windows\System\JiBuRdD.exe
  2⤵
  PID:8668
- C:\Windows\System\BKUFHCy.exe
  C:\Windows\System\BKUFHCy.exe
  2⤵
  PID:8736
- C:\Windows\System\MJWxECM.exe
  C:\Windows\System\MJWxECM.exe
  2⤵
  PID:8784
- C:\Windows\System\lEJddoJ.exe
  C:\Windows\System\lEJddoJ.exe
  2⤵
  PID:8868
- C:\Windows\System\WRlfJtP.exe
  C:\Windows\System\WRlfJtP.exe
  2⤵
  PID:8920
- C:\Windows\System\xVChdDh.exe
  C:\Windows\System\xVChdDh.exe
  2⤵
  PID:9016
- C:\Windows\System\DTyvcsN.exe
  C:\Windows\System\DTyvcsN.exe
  2⤵
  PID:8976
- C:\Windows\System\fiPMsfj.exe
  C:\Windows\System\fiPMsfj.exe
  2⤵
  PID:9096
- C:\Windows\System\xptyshn.exe
  C:\Windows\System\xptyshn.exe
  2⤵
  PID:9196
- C:\Windows\System\rBnaCQM.exe
  C:\Windows\System\rBnaCQM.exe
  2⤵
  PID:8236
- C:\Windows\System\kkUxBEY.exe
  C:\Windows\System\kkUxBEY.exe
  2⤵
  PID:8344
- C:\Windows\System\TGdoJuj.exe
  C:\Windows\System\TGdoJuj.exe
  2⤵
  PID:8384
- C:\Windows\System\kSBeraZ.exe
  C:\Windows\System\kSBeraZ.exe
  2⤵
  PID:8580
- C:\Windows\System\bhLWkYN.exe
  C:\Windows\System\bhLWkYN.exe
  2⤵
  PID:8840
- C:\Windows\System\JyCEDRi.exe
  C:\Windows\System\JyCEDRi.exe
  2⤵
  PID:8948
- C:\Windows\System\kJnzfHz.exe
  C:\Windows\System\kJnzfHz.exe
  2⤵
  PID:9044
- C:\Windows\System\aCNfJdj.exe
  C:\Windows\System\aCNfJdj.exe
  2⤵
  PID:7916
- C:\Windows\System\jsABzZS.exe
  C:\Windows\System\jsABzZS.exe
  2⤵
  PID:8416
- C:\Windows\System\HeXUVGK.exe
  C:\Windows\System\HeXUVGK.exe
  2⤵
  PID:8304
- C:\Windows\System\jFecABZ.exe
  C:\Windows\System\jFecABZ.exe
  2⤵
  PID:8516
- C:\Windows\System\wakxTHT.exe
  C:\Windows\System\wakxTHT.exe
  2⤵
  PID:8460
- C:\Windows\System\AnncqUr.exe
  C:\Windows\System\AnncqUr.exe
  2⤵
  PID:9236
- C:\Windows\System\yxPaTCo.exe
  C:\Windows\System\yxPaTCo.exe
  2⤵
  PID:9280
- C:\Windows\System\vRWQzGn.exe
  C:\Windows\System\vRWQzGn.exe
  2⤵
  PID:9296
- C:\Windows\System\PTgIJpy.exe
  C:\Windows\System\PTgIJpy.exe
  2⤵
  PID:9324
- C:\Windows\System\XCehREs.exe
  C:\Windows\System\XCehREs.exe
  2⤵
  PID:9348
- C:\Windows\System\qBNRkGa.exe
  C:\Windows\System\qBNRkGa.exe
  2⤵
  PID:9376
- C:\Windows\System\fCBWoUp.exe
  C:\Windows\System\fCBWoUp.exe
  2⤵
  PID:9396
- C:\Windows\System\HBKKpKa.exe
  C:\Windows\System\HBKKpKa.exe
  2⤵
  PID:9416
- C:\Windows\System\HlgDYKK.exe
  C:\Windows\System\HlgDYKK.exe
  2⤵
  PID:9460
- C:\Windows\System\QreXjYy.exe
  C:\Windows\System\QreXjYy.exe
  2⤵
  PID:9480
- C:\Windows\System\mDTgeGe.exe
  C:\Windows\System\mDTgeGe.exe
  2⤵
  PID:9508
- C:\Windows\System\CNkHWlq.exe
  C:\Windows\System\CNkHWlq.exe
  2⤵
  PID:9524
- C:\Windows\System\ttBpSUw.exe
  C:\Windows\System\ttBpSUw.exe
  2⤵
  PID:9588
- C:\Windows\System\jzLnZDV.exe
  C:\Windows\System\jzLnZDV.exe
  2⤵
  PID:9604
- C:\Windows\System\hUClmwD.exe
  C:\Windows\System\hUClmwD.exe
  2⤵
  PID:9640
- C:\Windows\System\ytptkbi.exe
  C:\Windows\System\ytptkbi.exe
  2⤵
  PID:9660
- C:\Windows\System\OqZbXzI.exe
  C:\Windows\System\OqZbXzI.exe
  2⤵
  PID:9684
- C:\Windows\System\wUoVkCB.exe
  C:\Windows\System\wUoVkCB.exe
  2⤵
  PID:9704
- C:\Windows\System\qVuUWnq.exe
  C:\Windows\System\qVuUWnq.exe
  2⤵
  PID:9732
- C:\Windows\System\yPWNHSq.exe
  C:\Windows\System\yPWNHSq.exe
  2⤵
  PID:9752
- C:\Windows\System\kiRePiN.exe
  C:\Windows\System\kiRePiN.exe
  2⤵
  PID:9788
- C:\Windows\System\OoHhTyn.exe
  C:\Windows\System\OoHhTyn.exe
  2⤵
  PID:9812
- C:\Windows\System\LtWwHxT.exe
  C:\Windows\System\LtWwHxT.exe
  2⤵
  PID:9832
- C:\Windows\System\JeDdnui.exe
  C:\Windows\System\JeDdnui.exe
  2⤵
  PID:9848
- C:\Windows\System\UckeGzL.exe
  C:\Windows\System\UckeGzL.exe
  2⤵
  PID:9900
- C:\Windows\System\IEwaHrg.exe
  C:\Windows\System\IEwaHrg.exe
  2⤵
  PID:9924
- C:\Windows\System\xbwEKSP.exe
  C:\Windows\System\xbwEKSP.exe
  2⤵
  PID:9944
- C:\Windows\System\YYmVaVp.exe
  C:\Windows\System\YYmVaVp.exe
  2⤵
  PID:9968
- C:\Windows\System\WgferCv.exe
  C:\Windows\System\WgferCv.exe
  2⤵
  PID:9984
- C:\Windows\System\hmsJvev.exe
  C:\Windows\System\hmsJvev.exe
  2⤵
  PID:10008
- C:\Windows\System\RzTbxbW.exe
  C:\Windows\System\RzTbxbW.exe
  2⤵
  PID:10028
- C:\Windows\System\AljCVRp.exe
  C:\Windows\System\AljCVRp.exe
  2⤵
  PID:10080
- C:\Windows\System\MaOwpGD.exe
  C:\Windows\System\MaOwpGD.exe
  2⤵
  PID:10124
- C:\Windows\System\KWhqRJx.exe
  C:\Windows\System\KWhqRJx.exe
  2⤵
  PID:10148
- C:\Windows\System\doohHlN.exe
  C:\Windows\System\doohHlN.exe
  2⤵
  PID:10176
- C:\Windows\System\YIGUfYn.exe
  C:\Windows\System\YIGUfYn.exe
  2⤵
  PID:10216
- C:\Windows\System\AVEAHom.exe
  C:\Windows\System\AVEAHom.exe
  2⤵
  PID:9232
- C:\Windows\System\QjuuxCf.exe
  C:\Windows\System\QjuuxCf.exe
  2⤵
  PID:9288
- C:\Windows\System\xpqFAsV.exe
  C:\Windows\System\xpqFAsV.exe
  2⤵
  PID:9360
- C:\Windows\System\tKDLEBL.exe
  C:\Windows\System\tKDLEBL.exe
  2⤵
  PID:9428
- C:\Windows\System\WpOxmdI.exe
  C:\Windows\System\WpOxmdI.exe
  2⤵
  PID:9468
- C:\Windows\System\GyIoIiB.exe
  C:\Windows\System\GyIoIiB.exe
  2⤵
  PID:9544
- C:\Windows\System\FHdCCHg.exe
  C:\Windows\System\FHdCCHg.exe
  2⤵
  PID:9600
- C:\Windows\System\eshjBOw.exe
  C:\Windows\System\eshjBOw.exe
  2⤵
  PID:9652
- C:\Windows\System\RVSJFLK.exe
  C:\Windows\System\RVSJFLK.exe
  2⤵
  PID:9764
- C:\Windows\System\qtDaCWB.exe
  C:\Windows\System\qtDaCWB.exe
  2⤵
  PID:9828
- C:\Windows\System\JEWtVbx.exe
  C:\Windows\System\JEWtVbx.exe
  2⤵
  PID:9840
- C:\Windows\System\zAclafN.exe
  C:\Windows\System\zAclafN.exe
  2⤵
  PID:9964
- C:\Windows\System\HZUumCd.exe
  C:\Windows\System\HZUumCd.exe
  2⤵
  PID:10004
- C:\Windows\System\vVbhIZC.exe
  C:\Windows\System\vVbhIZC.exe
  2⤵
  PID:10056
- C:\Windows\System\NKMHpNQ.exe
  C:\Windows\System\NKMHpNQ.exe
  2⤵
  PID:10116
- C:\Windows\System\IciwkHQ.exe
  C:\Windows\System\IciwkHQ.exe
  2⤵
  PID:10160
- C:\Windows\System\TijYigO.exe
  C:\Windows\System\TijYigO.exe
  2⤵
  PID:9228
- C:\Windows\System\ubVPMBN.exe
  C:\Windows\System\ubVPMBN.exe
  2⤵
  PID:9392
- C:\Windows\System\FZfakYr.exe
  C:\Windows\System\FZfakYr.exe
  2⤵
  PID:9564
- C:\Windows\System\ZFdRqUH.exe
  C:\Windows\System\ZFdRqUH.exe
  2⤵
  PID:9800
- C:\Windows\System\jisKzJJ.exe
  C:\Windows\System\jisKzJJ.exe
  2⤵
  PID:10000
- C:\Windows\System\sPdOBur.exe
  C:\Windows\System\sPdOBur.exe
  2⤵
  PID:10168
- C:\Windows\System\UJENMnf.exe
  C:\Windows\System\UJENMnf.exe
  2⤵
  PID:10236
- C:\Windows\System\EsPcShn.exe
  C:\Windows\System\EsPcShn.exe
  2⤵
  PID:9500
- C:\Windows\System\alxXoaa.exe
  C:\Windows\System\alxXoaa.exe
  2⤵
  PID:9680
- C:\Windows\System\vJXIufz.exe
  C:\Windows\System\vJXIufz.exe
  2⤵
  PID:10144
- C:\Windows\System\pnTuinF.exe
  C:\Windows\System\pnTuinF.exe
  2⤵
  PID:9336
- C:\Windows\System\IRfvfCI.exe
  C:\Windows\System\IRfvfCI.exe
  2⤵
  PID:10268
- C:\Windows\System\cnBWfiv.exe
  C:\Windows\System\cnBWfiv.exe
  2⤵
  PID:10292
- C:\Windows\System\bwWaFIa.exe
  C:\Windows\System\bwWaFIa.exe
  2⤵
  PID:10316
- C:\Windows\System\iAXKiab.exe
  C:\Windows\System\iAXKiab.exe
  2⤵
  PID:10344
- C:\Windows\System\YTMTUwk.exe
  C:\Windows\System\YTMTUwk.exe
  2⤵
  PID:10364
- C:\Windows\System\czIwyXt.exe
  C:\Windows\System\czIwyXt.exe
  2⤵
  PID:10388
- C:\Windows\System\NCgtpKx.exe
  C:\Windows\System\NCgtpKx.exe
  2⤵
  PID:10412
- C:\Windows\System\wzMjILW.exe
  C:\Windows\System\wzMjILW.exe
  2⤵
  PID:10440
- C:\Windows\System\gNXHcAO.exe
  C:\Windows\System\gNXHcAO.exe
  2⤵
  PID:10532
- C:\Windows\System\VARatQJ.exe
  C:\Windows\System\VARatQJ.exe
  2⤵
  PID:10552
- C:\Windows\System\oUgpvpW.exe
  C:\Windows\System\oUgpvpW.exe
  2⤵
  PID:10580
- C:\Windows\System\YQciKUb.exe
  C:\Windows\System\YQciKUb.exe
  2⤵
  PID:10596
- C:\Windows\System\vCLzfJj.exe
  C:\Windows\System\vCLzfJj.exe
  2⤵
  PID:10620
- C:\Windows\System\YRTPILy.exe
  C:\Windows\System\YRTPILy.exe
  2⤵
  PID:10648
- C:\Windows\System\DjcxKEu.exe
  C:\Windows\System\DjcxKEu.exe
  2⤵
  PID:10672
- C:\Windows\System\fxlmFct.exe
  C:\Windows\System\fxlmFct.exe
  2⤵
  PID:10700
- C:\Windows\System\eTmJeES.exe
  C:\Windows\System\eTmJeES.exe
  2⤵
  PID:10724
- C:\Windows\System\XEtLNmP.exe
  C:\Windows\System\XEtLNmP.exe
  2⤵
  PID:10748
- C:\Windows\System\dDCczhJ.exe
  C:\Windows\System\dDCczhJ.exe
  2⤵
  PID:10776
- C:\Windows\System\sdoIVuY.exe
  C:\Windows\System\sdoIVuY.exe
  2⤵
  PID:10816
- C:\Windows\System\TzMszzS.exe
  C:\Windows\System\TzMszzS.exe
  2⤵
  PID:10856
- C:\Windows\System\gbXowub.exe
  C:\Windows\System\gbXowub.exe
  2⤵
  PID:10884
- C:\Windows\System\zdZdnxr.exe
  C:\Windows\System\zdZdnxr.exe
  2⤵
  PID:10912
- C:\Windows\System\hHrykHT.exe
  C:\Windows\System\hHrykHT.exe
  2⤵
  PID:10948
- C:\Windows\System\MFrRYhZ.exe
  C:\Windows\System\MFrRYhZ.exe
  2⤵
  PID:10968
- C:\Windows\System\xYVHnVj.exe
  C:\Windows\System\xYVHnVj.exe
  2⤵
  PID:11000
- C:\Windows\System\XsCfuJJ.exe
  C:\Windows\System\XsCfuJJ.exe
  2⤵
  PID:11020
- C:\Windows\System\kWTQBJX.exe
  C:\Windows\System\kWTQBJX.exe
  2⤵
  PID:11040
- C:\Windows\System\OCfOBFI.exe
  C:\Windows\System\OCfOBFI.exe
  2⤵
  PID:11072
- C:\Windows\System\jytpgRQ.exe
  C:\Windows\System\jytpgRQ.exe
  2⤵
  PID:11092
- C:\Windows\System\aiYuKdk.exe
  C:\Windows\System\aiYuKdk.exe
  2⤵
  PID:11120
- C:\Windows\System\RmVuXQE.exe
  C:\Windows\System\RmVuXQE.exe
  2⤵
  PID:11144
- C:\Windows\System\kCMONkF.exe
  C:\Windows\System\kCMONkF.exe
  2⤵
  PID:11168
- C:\Windows\System\zguQDEq.exe
  C:\Windows\System\zguQDEq.exe
  2⤵
  PID:11192
- C:\Windows\System\GuCfOlF.exe
  C:\Windows\System\GuCfOlF.exe
  2⤵
  PID:11216
- C:\Windows\System\lAFcoFO.exe
  C:\Windows\System\lAFcoFO.exe
  2⤵
  PID:11244
- C:\Windows\System\TdaVVgq.exe
  C:\Windows\System\TdaVVgq.exe
  2⤵
  PID:10256
- C:\Windows\System\BJZbGHT.exe
  C:\Windows\System\BJZbGHT.exe
  2⤵
  PID:10288
- C:\Windows\System\dqOpqWR.exe
  C:\Windows\System\dqOpqWR.exe
  2⤵
  PID:10400
- C:\Windows\System\itnCILe.exe
  C:\Windows\System\itnCILe.exe
  2⤵
  PID:10428
- C:\Windows\System\bWEdBoL.exe
  C:\Windows\System\bWEdBoL.exe
  2⤵
  PID:10448
- C:\Windows\System\BFeJFMw.exe
  C:\Windows\System\BFeJFMw.exe
  2⤵
  PID:10612
- C:\Windows\System\rmJKFyN.exe
  C:\Windows\System\rmJKFyN.exe
  2⤵
  PID:10696
- C:\Windows\System\XGQXbQA.exe
  C:\Windows\System\XGQXbQA.exe
  2⤵
  PID:10768
- C:\Windows\System\DoqTfOM.exe
  C:\Windows\System\DoqTfOM.exe
  2⤵
  PID:10736
- C:\Windows\System\ObtAeUm.exe
  C:\Windows\System\ObtAeUm.exe
  2⤵
  PID:10844
- C:\Windows\System\zJsEVYk.exe
  C:\Windows\System\zJsEVYk.exe
  2⤵
  PID:10928
- C:\Windows\System\CuOUrps.exe
  C:\Windows\System\CuOUrps.exe
  2⤵
  PID:10992
- C:\Windows\System\vALwLOs.exe
  C:\Windows\System\vALwLOs.exe
  2⤵
  PID:11036
- C:\Windows\System\nRmlkUC.exe
  C:\Windows\System\nRmlkUC.exe
  2⤵
  PID:11064
- C:\Windows\System\PcFSemw.exe
  C:\Windows\System\PcFSemw.exe
  2⤵
  PID:11152
- C:\Windows\System\taWASga.exe
  C:\Windows\System\taWASga.exe
  2⤵
  PID:11232
- C:\Windows\System\LhoxPqm.exe
  C:\Windows\System\LhoxPqm.exe
  2⤵
  PID:10044
- C:\Windows\System\fFYGtUk.exe
  C:\Windows\System\fFYGtUk.exe
  2⤵
  PID:10424
- C:\Windows\System\qjNWlrc.exe
  C:\Windows\System\qjNWlrc.exe
  2⤵
  PID:10560
- C:\Windows\System\XyXHCSj.exe
  C:\Windows\System\XyXHCSj.exe
  2⤵
  PID:10720
- C:\Windows\System\VdheORf.exe
  C:\Windows\System\VdheORf.exe
  2⤵
  PID:10764
- C:\Windows\System\iaNwOcq.exe
  C:\Windows\System\iaNwOcq.exe
  2⤵
  PID:11088
- C:\Windows\System\ZaaeyQn.exe
  C:\Windows\System\ZaaeyQn.exe
  2⤵
  PID:11016
- C:\Windows\System\CyszTMG.exe
  C:\Windows\System\CyszTMG.exe
  2⤵
  PID:11204
- C:\Windows\System\udHdCIq.exe
  C:\Windows\System\udHdCIq.exe
  2⤵
  PID:10504
- C:\Windows\System\FMLUcjR.exe
  C:\Windows\System\FMLUcjR.exe
  2⤵
  PID:10688
- C:\Windows\System\uIzajPp.exe
  C:\Windows\System\uIzajPp.exe
  2⤵
  PID:10876
- C:\Windows\System\EPuOjhw.exe
  C:\Windows\System\EPuOjhw.exe
  2⤵
  PID:11284
- C:\Windows\System\vkmSHsw.exe
  C:\Windows\System\vkmSHsw.exe
  2⤵
  PID:11332
- C:\Windows\System\PHPRcDR.exe
  C:\Windows\System\PHPRcDR.exe
  2⤵
  PID:11368
- C:\Windows\System\phwdKJf.exe
  C:\Windows\System\phwdKJf.exe
  2⤵
  PID:11400
- C:\Windows\System\PDLipHh.exe
  C:\Windows\System\PDLipHh.exe
  2⤵
  PID:11424
- C:\Windows\System\RuBSGuB.exe
  C:\Windows\System\RuBSGuB.exe
  2⤵
  PID:11456
- C:\Windows\System\WXzGbyW.exe
  C:\Windows\System\WXzGbyW.exe
  2⤵
  PID:11488
- C:\Windows\System\FfeKDpm.exe
  C:\Windows\System\FfeKDpm.exe
  2⤵
  PID:11520
- C:\Windows\System\BXAApCv.exe
  C:\Windows\System\BXAApCv.exe
  2⤵
  PID:11552
- C:\Windows\System\YBTJIkr.exe
  C:\Windows\System\YBTJIkr.exe
  2⤵
  PID:11592
- C:\Windows\System\psteKJp.exe
  C:\Windows\System\psteKJp.exe
  2⤵
  PID:11620
- C:\Windows\System\efDeFem.exe
  C:\Windows\System\efDeFem.exe
  2⤵
  PID:11648
- C:\Windows\System\OZldQoR.exe
  C:\Windows\System\OZldQoR.exe
  2⤵
  PID:11668
- C:\Windows\System\cGvOzxn.exe
  C:\Windows\System\cGvOzxn.exe
  2⤵
  PID:11692
- C:\Windows\System\bbzzJCv.exe
  C:\Windows\System\bbzzJCv.exe
  2⤵
  PID:11712
- C:\Windows\System\SYoYHrG.exe
  C:\Windows\System\SYoYHrG.exe
  2⤵
  PID:11736
- C:\Windows\System\OspCapS.exe
  C:\Windows\System\OspCapS.exe
  2⤵
  PID:11760
- C:\Windows\System\OYbKPGA.exe
  C:\Windows\System\OYbKPGA.exe
  2⤵
  PID:11788
- C:\Windows\System\eDdwIOj.exe
  C:\Windows\System\eDdwIOj.exe
  2⤵
  PID:11832
- C:\Windows\System\ngRjAwg.exe
  C:\Windows\System\ngRjAwg.exe
  2⤵
  PID:11852
- C:\Windows\System\ualNhrT.exe
  C:\Windows\System\ualNhrT.exe
  2⤵
  PID:11876
- C:\Windows\System\lhfXRsl.exe
  C:\Windows\System\lhfXRsl.exe
  2⤵
  PID:11912
- C:\Windows\System\hxjBEap.exe
  C:\Windows\System\hxjBEap.exe
  2⤵
  PID:11944
- C:\Windows\System\PTbPEOo.exe
  C:\Windows\System\PTbPEOo.exe
  2⤵
  PID:11972
- C:\Windows\System\kDubrxf.exe
  C:\Windows\System\kDubrxf.exe
  2⤵
  PID:12020
- C:\Windows\System\dwSWaLB.exe
  C:\Windows\System\dwSWaLB.exe
  2⤵
  PID:12048
- C:\Windows\System\xgqpoCd.exe
  C:\Windows\System\xgqpoCd.exe
  2⤵
  PID:12076
- C:\Windows\System\kaOjsvG.exe
  C:\Windows\System\kaOjsvG.exe
  2⤵
  PID:12104
- C:\Windows\System\aphGzVg.exe
  C:\Windows\System\aphGzVg.exe
  2⤵
  PID:12128
- C:\Windows\System\ZtqyGgH.exe
  C:\Windows\System\ZtqyGgH.exe
  2⤵
  PID:12148
- C:\Windows\System\ZisEToq.exe
  C:\Windows\System\ZisEToq.exe
  2⤵
  PID:12168
- C:\Windows\System\CZTUxaD.exe
  C:\Windows\System\CZTUxaD.exe
  2⤵
  PID:12184
- C:\Windows\System\aXAFXgR.exe
  C:\Windows\System\aXAFXgR.exe
  2⤵
  PID:12220
- C:\Windows\System\ikFkuZb.exe
  C:\Windows\System\ikFkuZb.exe
  2⤵
  PID:12272
- C:\Windows\System\ZeyucbT.exe
  C:\Windows\System\ZeyucbT.exe
  2⤵
  PID:10260
- C:\Windows\System\KRssKYo.exe
  C:\Windows\System\KRssKYo.exe
  2⤵
  PID:11268
- C:\Windows\System\IHxEuYh.exe
  C:\Windows\System\IHxEuYh.exe
  2⤵
  PID:11312
- C:\Windows\System\LtldeJZ.exe
  C:\Windows\System\LtldeJZ.exe
  2⤵
  PID:11380
- C:\Windows\System\PsDZgvn.exe
  C:\Windows\System\PsDZgvn.exe
  2⤵
  PID:11436
- C:\Windows\System\tSyBAsp.exe
  C:\Windows\System\tSyBAsp.exe
  2⤵
  PID:11508
- C:\Windows\System\MAGdfzj.exe
  C:\Windows\System\MAGdfzj.exe
  2⤵
  PID:11584
- C:\Windows\System\FCEzUlp.exe
  C:\Windows\System\FCEzUlp.exe
  2⤵
  PID:11632
- C:\Windows\System\ToSqtKx.exe
  C:\Windows\System\ToSqtKx.exe
  2⤵
  PID:11708
- C:\Windows\System\ZkbKtfA.exe
  C:\Windows\System\ZkbKtfA.exe
  2⤵
  PID:11720
- C:\Windows\System\QBmwFbV.exe
  C:\Windows\System\QBmwFbV.exe
  2⤵
  PID:11776
- C:\Windows\System\pKNpsPs.exe
  C:\Windows\System\pKNpsPs.exe
  2⤵
  PID:11896
- C:\Windows\System\cWmaaZJ.exe
  C:\Windows\System\cWmaaZJ.exe
  2⤵
  PID:11928
- C:\Windows\System\XKQrxtY.exe
  C:\Windows\System\XKQrxtY.exe
  2⤵
  PID:12000
- C:\Windows\System\bnCqvof.exe
  C:\Windows\System\bnCqvof.exe
  2⤵
  PID:11160
- C:\Windows\System\isSYtgI.exe
  C:\Windows\System\isSYtgI.exe
  2⤵
  PID:12124
- C:\Windows\System\lhUpPkt.exe
  C:\Windows\System\lhUpPkt.exe
  2⤵
  PID:12164
- C:\Windows\System\nmJGOMR.exe
  C:\Windows\System\nmJGOMR.exe
  2⤵
  PID:12232
- C:\Windows\System\XDfRpTH.exe
  C:\Windows\System\XDfRpTH.exe
  2⤵
  PID:11280
- C:\Windows\System\LpoxxRv.exe
  C:\Windows\System\LpoxxRv.exe
  2⤵
  PID:11536
- C:\Windows\System\YaOeWhp.exe
  C:\Windows\System\YaOeWhp.exe
  2⤵
  PID:11728
- C:\Windows\System\typimHU.exe
  C:\Windows\System\typimHU.exe
  2⤵
  PID:11820
- C:\Windows\System\OJkQXkX.exe
  C:\Windows\System\OJkQXkX.exe
  2⤵
  PID:11996
- C:\Windows\System\AggPKDI.exe
  C:\Windows\System\AggPKDI.exe
  2⤵
  PID:12028
- C:\Windows\System\LjSSduA.exe
  C:\Windows\System\LjSSduA.exe
  2⤵
  PID:12284
- C:\Windows\System\urJVtmA.exe
  C:\Windows\System\urJVtmA.exe
  2⤵
  PID:11352
- C:\Windows\System\jbRrush.exe
  C:\Windows\System\jbRrush.exe
  2⤵
  PID:11844
- C:\Windows\System\xLMspcB.exe
  C:\Windows\System\xLMspcB.exe
  2⤵
  PID:11968
- C:\Windows\System\dwzIvkd.exe
  C:\Windows\System\dwzIvkd.exe
  2⤵
  PID:11688
- C:\Windows\System\XUiQFdA.exe
  C:\Windows\System\XUiQFdA.exe
  2⤵
  PID:12296
- C:\Windows\System\wxyayMX.exe
  C:\Windows\System\wxyayMX.exe
  2⤵
  PID:12324
- C:\Windows\System\kIxOQhZ.exe
  C:\Windows\System\kIxOQhZ.exe
  2⤵
  PID:12352
- C:\Windows\System\NgExOFI.exe
  C:\Windows\System\NgExOFI.exe
  2⤵
  PID:12368
- C:\Windows\System\IBXXZeY.exe
  C:\Windows\System\IBXXZeY.exe
  2⤵
  PID:12384
- C:\Windows\System\knPTurh.exe
  C:\Windows\System\knPTurh.exe
  2⤵
  PID:12420
- C:\Windows\System\rvNMmta.exe
  C:\Windows\System\rvNMmta.exe
  2⤵
  PID:12452
- C:\Windows\System\gBcniRO.exe
  C:\Windows\System\gBcniRO.exe
  2⤵
  PID:12472
- C:\Windows\System\VhTxxOl.exe
  C:\Windows\System\VhTxxOl.exe
  2⤵
  PID:12524
- C:\Windows\System\QcuTKho.exe
  C:\Windows\System\QcuTKho.exe
  2⤵
  PID:12540
- C:\Windows\System\CyEcsmW.exe
  C:\Windows\System\CyEcsmW.exe
  2⤵
  PID:12564
- C:\Windows\System\kDYEUsj.exe
  C:\Windows\System\kDYEUsj.exe
  2⤵
  PID:12592
- C:\Windows\System\sJwmOSZ.exe
  C:\Windows\System\sJwmOSZ.exe
  2⤵
  PID:12612
- C:\Windows\System\hVFJmCW.exe
  C:\Windows\System\hVFJmCW.exe
  2⤵
  PID:12636
- C:\Windows\System\yvEFxau.exe
  C:\Windows\System\yvEFxau.exe
  2⤵
  PID:12676
- C:\Windows\System\DHRHkxA.exe
  C:\Windows\System\DHRHkxA.exe
  2⤵
  PID:12708
- C:\Windows\System\bkEzFxj.exe
  C:\Windows\System\bkEzFxj.exe
  2⤵
  PID:12736
- C:\Windows\System\WOmuaJL.exe
  C:\Windows\System\WOmuaJL.exe
  2⤵
  PID:12752
- C:\Windows\System\ICPQJXA.exe
  C:\Windows\System\ICPQJXA.exe
  2⤵
  PID:12800
- C:\Windows\System\IdMffRd.exe
  C:\Windows\System\IdMffRd.exe
  2⤵
  PID:12820
- C:\Windows\System\WvJRwEr.exe
  C:\Windows\System\WvJRwEr.exe
  2⤵
  PID:12860
- C:\Windows\System\KKavtOY.exe
  C:\Windows\System\KKavtOY.exe
  2⤵
  PID:12876
- C:\Windows\System\DdUomRw.exe
  C:\Windows\System\DdUomRw.exe
  2⤵
  PID:12916
- C:\Windows\System\KZFljHS.exe
  C:\Windows\System\KZFljHS.exe
  2⤵
  PID:12944
- C:\Windows\System\FEBNxeP.exe
  C:\Windows\System\FEBNxeP.exe
  2⤵
  PID:12960
- C:\Windows\System\DxSXCPD.exe
  C:\Windows\System\DxSXCPD.exe
  2⤵
  PID:13000
- C:\Windows\System\ZMCZFak.exe
  C:\Windows\System\ZMCZFak.exe
  2⤵
  PID:13016
- C:\Windows\System\olObyoU.exe
  C:\Windows\System\olObyoU.exe
  2⤵
  PID:13044
- C:\Windows\System\VafKxZu.exe
  C:\Windows\System\VafKxZu.exe
  2⤵
  PID:13072
- C:\Windows\System\vADUiYi.exe
  C:\Windows\System\vADUiYi.exe
  2⤵
  PID:13100
- C:\Windows\System\AfehiAC.exe
  C:\Windows\System\AfehiAC.exe
  2⤵
  PID:13128
- C:\Windows\System\zAJZgXG.exe
  C:\Windows\System\zAJZgXG.exe
  2⤵
  PID:13160
- C:\Windows\System\dpKbCdQ.exe
  C:\Windows\System\dpKbCdQ.exe
  2⤵
  PID:13184
- C:\Windows\System\QqxKmxa.exe
  C:\Windows\System\QqxKmxa.exe
  2⤵
  PID:13200
- C:\Windows\System\eKhaTAT.exe
  C:\Windows\System\eKhaTAT.exe
  2⤵
  PID:13224
- C:\Windows\System\mwVkzUd.exe
  C:\Windows\System\mwVkzUd.exe
  2⤵
  PID:13248
- C:\Windows\System\LFcHVYL.exe
  C:\Windows\System\LFcHVYL.exe
  2⤵
  PID:13280
- C:\Windows\System\CzthRQN.exe
  C:\Windows\System\CzthRQN.exe
  2⤵
  PID:13308
- C:\Windows\System\LrxtmGc.exe
  C:\Windows\System\LrxtmGc.exe
  2⤵
  PID:12340
- C:\Windows\System\CdjZgaj.exe
  C:\Windows\System\CdjZgaj.exe
  2⤵
  PID:12416
- C:\Windows\System\gpWqOEH.exe
  C:\Windows\System\gpWqOEH.exe
  2⤵
  PID:12464
- C:\Windows\System\LAzotSj.exe
  C:\Windows\System\LAzotSj.exe
  2⤵
  PID:12572
- C:\Windows\System\AbovSAt.exe
  C:\Windows\System\AbovSAt.exe
  2⤵
  PID:12584
- C:\Windows\System\nIVcxqg.exe
  C:\Windows\System\nIVcxqg.exe
  2⤵
  PID:12672
- C:\Windows\System\LhfGTcj.exe
  C:\Windows\System\LhfGTcj.exe
  2⤵
  PID:12704
- C:\Windows\System\fLoHTUc.exe
  C:\Windows\System\fLoHTUc.exe
  2⤵
  PID:12816
- C:\Windows\System\HfJrXvH.exe
  C:\Windows\System\HfJrXvH.exe
  2⤵
  PID:12904
- C:\Windows\System\mnITdOk.exe
  C:\Windows\System\mnITdOk.exe
  2⤵
  PID:12980
- C:\Windows\System\FOEAxzS.exe
  C:\Windows\System\FOEAxzS.exe
  2⤵
  PID:13036
- C:\Windows\System\pWljbuC.exe
  C:\Windows\System\pWljbuC.exe
  2⤵
  PID:13088
- C:\Windows\System\vrodcgu.exe
  C:\Windows\System\vrodcgu.exe
  2⤵
  PID:13168
- C:\Windows\System\buVeLme.exe
  C:\Windows\System\buVeLme.exe
  2⤵
  PID:13244
- C:\Windows\System\gGaSCNm.exe
  C:\Windows\System\gGaSCNm.exe
  2⤵
  PID:13276
- C:\Windows\System\NPjwDDJ.exe
  C:\Windows\System\NPjwDDJ.exe
  2⤵
  PID:12336
- C:\Windows\System\sWZkdEP.exe
  C:\Windows\System\sWZkdEP.exe
  2⤵
  PID:12396
- C:\Windows\System\KGjqute.exe
  C:\Windows\System\KGjqute.exe
  2⤵
  PID:12748
- C:\Windows\System\qdgYrmi.exe
  C:\Windows\System\qdgYrmi.exe
  2⤵
  PID:12788
- C:\Windows\System\eOHEfeC.exe
  C:\Windows\System\eOHEfeC.exe
  2⤵
  PID:12928
- C:\Windows\System\pTbCHco.exe
  C:\Windows\System\pTbCHco.exe
  2⤵
  PID:13032
- C:\Windows\System\bnqVidA.exe
  C:\Windows\System\bnqVidA.exe
  2⤵
  PID:13292
- C:\Windows\System\neNsnDw.exe
  C:\Windows\System\neNsnDw.exe
  2⤵
  PID:12608
- C:\Windows\System\bQJsxxL.exe
  C:\Windows\System\bQJsxxL.exe
  2⤵
  PID:12872
- C:\Windows\System\NgnLmEb.exe
  C:\Windows\System\NgnLmEb.exe
  2⤵
  PID:13220
- C:\Windows\System\SLlHYZL.exe
  C:\Windows\System\SLlHYZL.exe
  2⤵
  PID:12868
- C:\Windows\System\TbEsjFa.exe
  C:\Windows\System\TbEsjFa.exe
  2⤵
  PID:13328
- C:\Windows\System\QloRoKi.exe
  C:\Windows\System\QloRoKi.exe
  2⤵
  PID:13352
- C:\Windows\System\EMHgWPz.exe
  C:\Windows\System\EMHgWPz.exe
  2⤵
  PID:13372
- C:\Windows\System\VIljdpt.exe
  C:\Windows\System\VIljdpt.exe
  2⤵
  PID:13400
- C:\Windows\System\DWEYHQd.exe
  C:\Windows\System\DWEYHQd.exe
  2⤵
  PID:13416
- C:\Windows\System\vTKMvIG.exe
  C:\Windows\System\vTKMvIG.exe
  2⤵
  PID:13432
- C:\Windows\System\CFyxFMz.exe
  C:\Windows\System\CFyxFMz.exe
  2⤵
  PID:13448
- C:\Windows\System\TVvjThe.exe
  C:\Windows\System\TVvjThe.exe
  2⤵
  PID:13464
- C:\Windows\System\vuVYIBJ.exe
  C:\Windows\System\vuVYIBJ.exe
  2⤵
  PID:13524
- C:\Windows\System\zMhaxBQ.exe
  C:\Windows\System\zMhaxBQ.exe
  2⤵
  PID:13588
- C:\Windows\System\DmbMlXS.exe
  C:\Windows\System\DmbMlXS.exe
  2⤵
  PID:13604
- C:\Windows\System\qDEfLJn.exe
  C:\Windows\System\qDEfLJn.exe
  2⤵
  PID:13628
- C:\Windows\System\KUrqtnA.exe
  C:\Windows\System\KUrqtnA.exe
  2⤵
  PID:13648
- C:\Windows\System\EWVedyn.exe
  C:\Windows\System\EWVedyn.exe
  2⤵
  PID:13676
- C:\Windows\System\hWMSSDi.exe
  C:\Windows\System\hWMSSDi.exe
  2⤵
  PID:13728
- C:\Windows\System\AOgWpwo.exe
  C:\Windows\System\AOgWpwo.exe
  2⤵
  PID:13756
- C:\Windows\System\WhfQoki.exe
  C:\Windows\System\WhfQoki.exe
  2⤵
  PID:13784
- C:\Windows\System\yiygFuc.exe
  C:\Windows\System\yiygFuc.exe
  2⤵
  PID:13800
- C:\Windows\System\wUPAkWp.exe
  C:\Windows\System\wUPAkWp.exe
  2⤵
  PID:13820
- C:\Windows\System\xbLqbuo.exe
  C:\Windows\System\xbLqbuo.exe
  2⤵
  PID:13848
- C:\Windows\System\qwrGzox.exe
  C:\Windows\System\qwrGzox.exe
  2⤵
  PID:13868
- C:\Windows\System\oHjyHoz.exe
  C:\Windows\System\oHjyHoz.exe
  2⤵
  PID:13932
- C:\Windows\System\mzGFiKa.exe
  C:\Windows\System\mzGFiKa.exe
  2⤵
  PID:13960
- C:\Windows\System\EMIIsvC.exe
  C:\Windows\System\EMIIsvC.exe
  2⤵
  PID:13976
- C:\Windows\System\BZylzfE.exe
  C:\Windows\System\BZylzfE.exe
  2⤵
  PID:14004
- C:\Windows\System\DJTWKWG.exe
  C:\Windows\System\DJTWKWG.exe
  2⤵
  PID:14032
- C:\Windows\System\oHgwEgw.exe
  C:\Windows\System\oHgwEgw.exe
  2⤵
  PID:14072
- C:\Windows\System\xOyXJtR.exe
  C:\Windows\System\xOyXJtR.exe
  2⤵
  PID:14096
- C:\Windows\System\vkOAsGZ.exe
  C:\Windows\System\vkOAsGZ.exe
  2⤵
  PID:14120
- C:\Windows\System\GzdsOdT.exe
  C:\Windows\System\GzdsOdT.exe
  2⤵
  PID:14140
- C:\Windows\System\sbIflgc.exe
  C:\Windows\System\sbIflgc.exe
  2⤵
  PID:14172
- C:\Windows\System\iIIytyP.exe
  C:\Windows\System\iIIytyP.exe
  2⤵
  PID:14192
- C:\Windows\System\OcsLyKq.exe
  C:\Windows\System\OcsLyKq.exe
  2⤵
  PID:14216
- C:\Windows\System\HPAyrxi.exe
  C:\Windows\System\HPAyrxi.exe
  2⤵
  PID:14244
- C:\Windows\System\eLJyNVN.exe
  C:\Windows\System\eLJyNVN.exe
  2⤵
  PID:14264
- C:\Windows\System\lrosCgt.exe
  C:\Windows\System\lrosCgt.exe
  2⤵
  PID:14296
- C:\Windows\System\lMGyarN.exe
  C:\Windows\System\lMGyarN.exe
  2⤵
  PID:13320
- C:\Windows\System\aPkEgbk.exe
  C:\Windows\System\aPkEgbk.exe
  2⤵
  PID:13348
- C:\Windows\System\NnPLUTW.exe
  C:\Windows\System\NnPLUTW.exe
  2⤵
  PID:13444
- C:\Windows\System\dcBhfiX.exe
  C:\Windows\System\dcBhfiX.exe
  2⤵
  PID:13580
- C:\Windows\System\VINAGia.exe
  C:\Windows\System\VINAGia.exe
  2⤵
  PID:13596
- C:\Windows\System\GTpWpZj.exe
  C:\Windows\System\GTpWpZj.exe
  2⤵
  PID:13636
- C:\Windows\System\mPQbCeq.exe
  C:\Windows\System\mPQbCeq.exe
  2⤵
  PID:13752
- C:\Windows\System\aQAfyws.exe
  C:\Windows\System\aQAfyws.exe
  2⤵
  PID:13828
- C:\Windows\System\ybJNYtC.exe
  C:\Windows\System\ybJNYtC.exe
  2⤵
  PID:13864
- C:\Windows\System\ZquXCbU.exe
  C:\Windows\System\ZquXCbU.exe
  2⤵
  PID:13920
- C:\Windows\System\ORjNSYi.exe
  C:\Windows\System\ORjNSYi.exe
  2⤵
  PID:13996
- C:\Windows\System\NDgQiom.exe
  C:\Windows\System\NDgQiom.exe
  2⤵
  PID:14088
- C:\Windows\System\ObfBqMS.exe
  C:\Windows\System\ObfBqMS.exe
  2⤵
  PID:14164
- C:\Windows\System\kydDpJo.exe
  C:\Windows\System\kydDpJo.exe
  2⤵
  PID:14184
- C:\Windows\System\bXGLfma.exe
  C:\Windows\System\bXGLfma.exe
  2⤵
  PID:14232
- C:\Windows\System\XqaUzmQ.exe
  C:\Windows\System\XqaUzmQ.exe
  2⤵
  PID:4340
- C:\Windows\System\SRRonXi.exe
  C:\Windows\System\SRRonXi.exe
  2⤵
  PID:13368
- C:\Windows\System\lMkHbZM.exe
  C:\Windows\System\lMkHbZM.exe
  2⤵
  PID:13552
- C:\Windows\System\eBResbc.exe
  C:\Windows\System\eBResbc.exe
  2⤵
  PID:13704
- C:\Windows\System\MrRAlmv.exe
  C:\Windows\System\MrRAlmv.exe
  2⤵
  PID:13916
- C:\Windows\System\qBTieaR.exe
  C:\Windows\System\qBTieaR.exe
  2⤵
  PID:13968
- C:\Windows\System\quXDRtZ.exe
  C:\Windows\System\quXDRtZ.exe
  2⤵
  PID:14060
- C:\Windows\System\RbdepzM.exe
  C:\Windows\System\RbdepzM.exe
  2⤵
  PID:14312
- C:\Windows\System\Cseqbji.exe
  C:\Windows\System\Cseqbji.exe
  2⤵
  PID:13428
- C:\Windows\System\lrbxrBP.exe
  C:\Windows\System\lrbxrBP.exe
  2⤵
  PID:13460
- C:\Windows\System\SBUKOZm.exe
  C:\Windows\System\SBUKOZm.exe
  2⤵
  PID:13780
- C:\Windows\System\hnsZeMJ.exe
  C:\Windows\System\hnsZeMJ.exe
  2⤵
  PID:14188
- C:\Windows\System\bscVTCl.exe
  C:\Windows\System\bscVTCl.exe
  2⤵
  PID:14344
- C:\Windows\System\iPidLHd.exe
  C:\Windows\System\iPidLHd.exe
  2⤵
  PID:14368
- C:\Windows\System\lsErFhY.exe
  C:\Windows\System\lsErFhY.exe
  2⤵
  PID:14396
- C:\Windows\System\XMIWgTA.exe
  C:\Windows\System\XMIWgTA.exe
  2⤵
  PID:14416
- C:\Windows\System\vpOhAIc.exe
  C:\Windows\System\vpOhAIc.exe
  2⤵
  PID:14452
- C:\Windows\System\rieUwat.exe
  C:\Windows\System\rieUwat.exe
  2⤵
  PID:14472
- C:\Windows\System\UqOrggN.exe
  C:\Windows\System\UqOrggN.exe
  2⤵
  PID:14500
- C:\Windows\System\meUNenj.exe
  C:\Windows\System\meUNenj.exe
  2⤵
  PID:14532
- C:\Windows\System\vjLTwpF.exe
  C:\Windows\System\vjLTwpF.exe
  2⤵
  PID:14560
- C:\Windows\System\UIiNPyf.exe
  C:\Windows\System\UIiNPyf.exe
  2⤵
  PID:14576
- C:\Windows\System\aqOvWgk.exe
  C:\Windows\System\aqOvWgk.exe
  2⤵
  PID:14608
- C:\Windows\System\DvTxrtt.exe
  C:\Windows\System\DvTxrtt.exe
  2⤵
  PID:14628
- C:\Windows\System\CXvqWkI.exe
  C:\Windows\System\CXvqWkI.exe
  2⤵
  PID:14648
- C:\Windows\System\WSDckga.exe
  C:\Windows\System\WSDckga.exe
  2⤵
  PID:14668
- C:\Windows\System\dTwhEAb.exe
  C:\Windows\System\dTwhEAb.exe
  2⤵
  PID:14684
- C:\Windows\System\EwJDekw.exe
  C:\Windows\System\EwJDekw.exe
  2⤵
  PID:14704
- C:\Windows\System\RSRkykR.exe
  C:\Windows\System\RSRkykR.exe
  2⤵
  PID:14732
- C:\Windows\System\sSWybWy.exe
  C:\Windows\System\sSWybWy.exe
  2⤵
  PID:14760
- C:\Windows\System\PATiOHw.exe
  C:\Windows\System\PATiOHw.exe
  2⤵
  PID:14780
- C:\Windows\System\fGbNsfH.exe
  C:\Windows\System\fGbNsfH.exe
  2⤵
  PID:14808
- C:\Windows\System\EWCPTVN.exe
  C:\Windows\System\EWCPTVN.exe
  2⤵
  PID:14828
- C:\Windows\System\evXGEHL.exe
  C:\Windows\System\evXGEHL.exe
  2⤵
  PID:14856
- C:\Windows\System\uQDTErf.exe
  C:\Windows\System\uQDTErf.exe
  2⤵
  PID:14880
- C:\Windows\System\isSxQnk.exe
  C:\Windows\System\isSxQnk.exe
  2⤵
  PID:14912
- C:\Windows\System\zgZSUEn.exe
  C:\Windows\System\zgZSUEn.exe
  2⤵
  PID:14936
- C:\Windows\System\hbDaCrW.exe
  C:\Windows\System\hbDaCrW.exe
  2⤵
  PID:14952
- C:\Windows\System\QwTJVod.exe
  C:\Windows\System\QwTJVod.exe
  2⤵
  PID:14984
- C:\Windows\System\lnrtsMF.exe
  C:\Windows\System\lnrtsMF.exe
  2⤵
  PID:15012
- C:\Windows\System\lDyYsjv.exe
  C:\Windows\System\lDyYsjv.exe
  2⤵
  PID:15032
- C:\Windows\System\hMDVWQJ.exe
  C:\Windows\System\hMDVWQJ.exe
  2⤵
  PID:15056
- C:\Windows\System\QqKErnQ.exe
  C:\Windows\System\QqKErnQ.exe
  2⤵
  PID:15080
- C:\Windows\System\wJfZyLS.exe
  C:\Windows\System\wJfZyLS.exe
  2⤵
  PID:15108
- C:\Windows\System\BSoKQSn.exe
  C:\Windows\System\BSoKQSn.exe
  2⤵
  PID:15128
- C:\Windows\System\yAuYwVq.exe
  C:\Windows\System\yAuYwVq.exe
  2⤵
  PID:15148
- C:\Windows\System\SHcKvGu.exe
  C:\Windows\System\SHcKvGu.exe
  2⤵
  PID:15172
- C:\Windows\System\HNFLYZQ.exe
  C:\Windows\System\HNFLYZQ.exe
  2⤵
  PID:15196
- C:\Windows\System\PejZFmy.exe
  C:\Windows\System\PejZFmy.exe
  2⤵
  PID:15220
- C:\Windows\System\LhZoGXn.exe
  C:\Windows\System\LhZoGXn.exe
  2⤵
  PID:15240
- C:\Windows\System\RivfsIn.exe
  C:\Windows\System\RivfsIn.exe
  2⤵
  PID:15256
- C:\Windows\System\uZiBRcY.exe
  C:\Windows\System\uZiBRcY.exe
  2⤵
  PID:15276
- C:\Windows\System\xtYYVmS.exe
  C:\Windows\System\xtYYVmS.exe
  2⤵
  PID:15304
- C:\Windows\System\dIjTBay.exe
  C:\Windows\System\dIjTBay.exe
  2⤵
  PID:15328
- C:\Windows\System\WQNsspX.exe
  C:\Windows\System\WQNsspX.exe
  2⤵
  PID:15352
- C:\Windows\System\vQLBaZd.exe
  C:\Windows\System\vQLBaZd.exe
  2⤵
  PID:13624
- C:\Windows\System\ngzIjcC.exe
  C:\Windows\System\ngzIjcC.exe
  2⤵
  PID:14384
- C:\Windows\System\qsEPIWE.exe
  C:\Windows\System\qsEPIWE.exe
  2⤵
  PID:14044
- C:\Windows\System\hWXISlf.exe
  C:\Windows\System\hWXISlf.exe
  2⤵
  PID:14492
- C:\Windows\System\GazZfZZ.exe
  C:\Windows\System\GazZfZZ.exe
  2⤵
  PID:14544
- C:\Windows\System\VUuPJtQ.exe
  C:\Windows\System\VUuPJtQ.exe
  2⤵
  PID:14448
- C:\Windows\System\ZAqkobv.exe
  C:\Windows\System\ZAqkobv.exe
  2⤵
  PID:14548
- C:\Windows\System\HVzKBEy.exe
  C:\Windows\System\HVzKBEy.exe
  2⤵
  PID:14680
- C:\Windows\System\RXnGHmA.exe
  C:\Windows\System\RXnGHmA.exe
  2⤵
  PID:14692
- C:\Windows\System\xTmfIMY.exe
  C:\Windows\System\xTmfIMY.exe
  2⤵
  PID:14772
- C:\Windows\System\VBCaAZC.exe
  C:\Windows\System\VBCaAZC.exe
  2⤵
  PID:14924
- C:\Windows\System\ztAADpN.exe
  C:\Windows\System\ztAADpN.exe
  2⤵
  PID:14896
- C:\Windows\System\DzxgdSv.exe
  C:\Windows\System\DzxgdSv.exe
  2⤵
  PID:15068
- C:\Windows\System\zrgmGSX.exe
  C:\Windows\System\zrgmGSX.exe
  2⤵
  PID:14968
- C:\Windows\System\NsOexpn.exe
  C:\Windows\System\NsOexpn.exe
  2⤵
  PID:15048
- C:\Windows\System\frelFYQ.exe
  C:\Windows\System\frelFYQ.exe
  2⤵
  PID:15272
- C:\Windows\System\sDYLbUb.exe
  C:\Windows\System\sDYLbUb.exe
  2⤵
  PID:14204
- C:\Windows\System\DZKvIKV.exe
  C:\Windows\System\DZKvIKV.exe
  2⤵
  PID:15120
- C:\Windows\System\MOfivMy.exe
  C:\Windows\System\MOfivMy.exe
  2⤵
  PID:15164
- C:\Windows\System\zyHymjO.exe
  C:\Windows\System\zyHymjO.exe
  2⤵
  PID:15208
- C:\Windows\System\ykiaIDi.exe
  C:\Windows\System\ykiaIDi.exe
  2⤵
  PID:15376
- C:\Windows\System\FcpjOMH.exe
  C:\Windows\System\FcpjOMH.exe
  2⤵
  PID:15404
- C:\Windows\System\HLwiygp.exe
  C:\Windows\System\HLwiygp.exe
  2⤵
  PID:15424
- C:\Windows\System\eAZggMa.exe
  C:\Windows\System\eAZggMa.exe
  2⤵
  PID:15448
- C:\Windows\System\kQqNvup.exe
  C:\Windows\System\kQqNvup.exe
  2⤵
  PID:15476
- C:\Windows\System\QOmtwNA.exe
  C:\Windows\System\QOmtwNA.exe
  2⤵
  PID:15500
- C:\Windows\System\UoaUnMh.exe
  C:\Windows\System\UoaUnMh.exe
  2⤵
  PID:15516
- C:\Windows\System\BWwfyaW.exe
  C:\Windows\System\BWwfyaW.exe
  2⤵
  PID:15544
- C:\Windows\System\iiIUCvy.exe
  C:\Windows\System\iiIUCvy.exe
  2⤵
  PID:15568
- C:\Windows\System\rXNFPQl.exe
  C:\Windows\System\rXNFPQl.exe
  2⤵
  PID:15588
- C:\Windows\System\LtObzKL.exe
  C:\Windows\System\LtObzKL.exe
  2⤵
  PID:15716
- C:\Windows\System\CmJIvQH.exe
  C:\Windows\System\CmJIvQH.exe
  2⤵
  PID:15744
- C:\Windows\System\FoWwxOw.exe
  C:\Windows\System\FoWwxOw.exe
  2⤵
  PID:15764
- C:\Windows\System\pbVzaJq.exe
  C:\Windows\System\pbVzaJq.exe
  2⤵
  PID:15780
- C:\Windows\System\uShCExw.exe
  C:\Windows\System\uShCExw.exe
  2⤵
  PID:15816
- C:\Windows\System\ZNjEYhg.exe
  C:\Windows\System\ZNjEYhg.exe
  2⤵
  PID:15844
- C:\Windows\System\EHDDQdX.exe
  C:\Windows\System\EHDDQdX.exe
  2⤵
  PID:15876
- C:\Windows\System\rFvNpHk.exe
  C:\Windows\System\rFvNpHk.exe
  2⤵
  PID:15904
- C:\Windows\System\NfpWryo.exe
  C:\Windows\System\NfpWryo.exe
  2⤵
  PID:15928
- C:\Windows\System\UgVDywL.exe
  C:\Windows\System\UgVDywL.exe
  2⤵
  PID:15952
- C:\Windows\System\dYuWoGT.exe
  C:\Windows\System\dYuWoGT.exe
  2⤵
  PID:15980
- C:\Windows\System\mpANYbU.exe
  C:\Windows\System\mpANYbU.exe
  2⤵
  PID:16008
- C:\Windows\System\eJBNEPF.exe
  C:\Windows\System\eJBNEPF.exe
  2⤵
  PID:16044
- C:\Windows\System\VlSobkZ.exe
  C:\Windows\System\VlSobkZ.exe
  2⤵
  PID:16072
- C:\Windows\System\yPPQkUC.exe
  C:\Windows\System\yPPQkUC.exe
  2⤵
  PID:16100
- C:\Windows\System\qjbLzdz.exe
  C:\Windows\System\qjbLzdz.exe
  2⤵
  PID:16116
- C:\Windows\System\PZwcJBy.exe
  C:\Windows\System\PZwcJBy.exe
  2⤵
  PID:16144
- C:\Windows\System\lMMCLnj.exe
  C:\Windows\System\lMMCLnj.exe
  2⤵
  PID:16164
- C:\Windows\System\ZPgiwCl.exe
  C:\Windows\System\ZPgiwCl.exe
  2⤵
  PID:16188
- C:\Windows\System\zUOHscH.exe
  C:\Windows\System\zUOHscH.exe
  2⤵
  PID:16224
- C:\Windows\System\UapFyzs.exe
  C:\Windows\System\UapFyzs.exe
  2⤵
  PID:16244
- C:\Windows\System\IVbaAsw.exe
  C:\Windows\System\IVbaAsw.exe
  2⤵
  PID:16268
- C:\Windows\System\hxARCsX.exe
  C:\Windows\System\hxARCsX.exe
  2⤵
  PID:16300
- C:\Windows\System\tKKBVpL.exe
  C:\Windows\System\tKKBVpL.exe
  2⤵
  PID:16324
- C:\Windows\System\wkInKbP.exe
  C:\Windows\System\wkInKbP.exe
  2⤵
  PID:16348
- C:\Windows\System\xwyJpTa.exe
  C:\Windows\System\xwyJpTa.exe
  2⤵
  PID:16368
- C:\Windows\System\MwcxDPA.exe
  C:\Windows\System\MwcxDPA.exe
  2⤵
  PID:15248
- C:\Windows\System\IMpzmdR.exe
  C:\Windows\System\IMpzmdR.exe
  2⤵
  PID:15252
- C:\Windows\System\uzelZPp.exe
  C:\Windows\System\uzelZPp.exe
  2⤵
  PID:14528
- C:\Windows\System\PWGEAfh.exe
  C:\Windows\System\PWGEAfh.exe
  2⤵
  PID:15228
- C:\Windows\System\BFzaoiO.exe
  C:\Windows\System\BFzaoiO.exe
  2⤵
  PID:15160
- C:\Windows\System\JkVqRRd.exe
  C:\Windows\System\JkVqRRd.exe
  2⤵
  PID:14412
- C:\Windows\System\YIyoOlx.exe
  C:\Windows\System\YIyoOlx.exe
  2⤵
  PID:14520
- C:\Windows\System\fXmgaFy.exe
  C:\Windows\System\fXmgaFy.exe
  2⤵
  PID:15052
- C:\Windows\System\bpKMaPS.exe
  C:\Windows\System\bpKMaPS.exe
  2⤵
  PID:15496
- C:\Windows\System\rwpJVPZ.exe
  C:\Windows\System\rwpJVPZ.exe
  2⤵
  PID:14744
- C:\Windows\System\GXcMmHi.exe
  C:\Windows\System\GXcMmHi.exe
  2⤵
  PID:15608
- C:\Windows\System\QNAamMn.exe
  C:\Windows\System\QNAamMn.exe
  2⤵
  PID:15640
- C:\Windows\System\actEquz.exe
  C:\Windows\System\actEquz.exe
  2⤵
  PID:15532
- C:\Windows\System\NcVygbe.exe
  C:\Windows\System\NcVygbe.exe
  2⤵
  PID:15008
- C:\Windows\System\sZMAqEG.exe
  C:\Windows\System\sZMAqEG.exe
  2⤵
  PID:15392
- C:\Windows\System\LqCRIPX.exe
  C:\Windows\System\LqCRIPX.exe
  2⤵
  PID:15808
- C:\Windows\System\mLISvAT.exe
  C:\Windows\System\mLISvAT.exe
  2⤵
  PID:15600
- C:\Windows\System\KEqIFNK.exe
  C:\Windows\System\KEqIFNK.exe
  2⤵
  PID:16128
- C:\Windows\System\ArozfzJ.exe
  C:\Windows\System\ArozfzJ.exe
  2⤵
  PID:15300
- C:\Windows\System\YSTmPQY.exe
  C:\Windows\System\YSTmPQY.exe
  2⤵
  PID:15144
- C:\Windows\System\aDQgNpf.exe
  C:\Windows\System\aDQgNpf.exe
  2⤵
  PID:14572
- C:\Windows\System\fgFrOzD.exe
  C:\Windows\System\fgFrOzD.exe
  2⤵
  PID:15204
- C:\Windows\System\uoseMux.exe
  C:\Windows\System\uoseMux.exe
  2⤵
  PID:16060
- C:\Windows\System\JPVSkCW.exe
  C:\Windows\System\JPVSkCW.exe
  2⤵
  PID:14428
- C:\Windows\System\dfNSVfP.exe
  C:\Windows\System\dfNSVfP.exe
  2⤵
  PID:15384
- C:\Windows\System\PapSnAG.exe
  C:\Windows\System\PapSnAG.exe
  2⤵
  PID:15948
- C:\Windows\System\TssCYaR.exe
  C:\Windows\System\TssCYaR.exe
  2⤵
  PID:15664
- C:\Windows\System\HbSqsHF.exe
  C:\Windows\System\HbSqsHF.exe
  2⤵
  PID:15752
- C:\Windows\System\fUueucc.exe
  C:\Windows\System\fUueucc.exe
  2⤵
  PID:15996
- C:\Windows\System\HhILzyd.exe
  C:\Windows\System\HhILzyd.exe
  2⤵
  PID:16424
- C:\Windows\System\XTuSrWH.exe
  C:\Windows\System\XTuSrWH.exe
  2⤵
  PID:16448
- C:\Windows\System\QrsAqDn.exe
  C:\Windows\System\QrsAqDn.exe
  2⤵
  PID:16472
- C:\Windows\System\EUXqHHh.exe
  C:\Windows\System\EUXqHHh.exe
  2⤵
  PID:16488
- C:\Windows\System\QiKdhsC.exe
  C:\Windows\System\QiKdhsC.exe
  2⤵
  PID:16516
- C:\Windows\System\xUUeRug.exe
  C:\Windows\System\xUUeRug.exe
  2⤵
  PID:16540
- C:\Windows\System\ziHppGk.exe
  C:\Windows\System\ziHppGk.exe
  2⤵
  PID:16556
- C:\Windows\System\PzSSNCO.exe
  C:\Windows\System\PzSSNCO.exe
  2⤵
  PID:16576
- C:\Windows\System\cVRPUgr.exe
  C:\Windows\System\cVRPUgr.exe
  2⤵
  PID:16664
- C:\Windows\System\xjCOwfU.exe
  C:\Windows\System\xjCOwfU.exe
  2⤵
  PID:16704
- C:\Windows\System\TAdoKMX.exe
  C:\Windows\System\TAdoKMX.exe
  2⤵
  PID:16724
- C:\Windows\System\ehIPIgS.exe
  C:\Windows\System\ehIPIgS.exe
  2⤵
  PID:16740
- C:\Windows\System\zLTVuNf.exe
  C:\Windows\System\zLTVuNf.exe
  2⤵
  PID:16756
- C:\Windows\System\OIRKYPW.exe
  C:\Windows\System\OIRKYPW.exe
  2⤵
  PID:16788
- C:\Windows\System\nmuZhIj.exe
  C:\Windows\System\nmuZhIj.exe
  2⤵
  PID:16820
- C:\Windows\System\dFvxZSp.exe
  C:\Windows\System\dFvxZSp.exe
  2⤵
  PID:16836
- C:\Windows\System\umzuWnI.exe
  C:\Windows\System\umzuWnI.exe
  2⤵
  PID:16856
- C:\Windows\System\ZQwCsYE.exe
  C:\Windows\System\ZQwCsYE.exe
  2⤵
  PID:16884
- C:\Windows\System\PKZfEJr.exe
  C:\Windows\System\PKZfEJr.exe
  2⤵
  PID:16912
- C:\Windows\System\iiNBBHF.exe
  C:\Windows\System\iiNBBHF.exe
  2⤵
  PID:16928
- C:\Windows\System\TACQOmE.exe
  C:\Windows\System\TACQOmE.exe
  2⤵
  PID:16964
- C:\Windows\System\IYQzyLn.exe
  C:\Windows\System\IYQzyLn.exe
  2⤵
  PID:16996
- C:\Windows\System\EKaqugF.exe
  C:\Windows\System\EKaqugF.exe
  2⤵
  PID:17024
- C:\Windows\System\PzSaEKX.exe
  C:\Windows\System\PzSaEKX.exe
  2⤵
  PID:17056
- C:\Windows\System\ygPAMSe.exe
  C:\Windows\System\ygPAMSe.exe
  2⤵
  PID:17084
- C:\Windows\System\XqAABBo.exe
  C:\Windows\System\XqAABBo.exe
  2⤵
  PID:17108
- C:\Windows\System\rzGXoaJ.exe
  C:\Windows\System\rzGXoaJ.exe
  2⤵
  PID:17128
- C:\Windows\System\MHeJWjR.exe
  C:\Windows\System\MHeJWjR.exe
  2⤵
  PID:17160
- C:\Windows\System\BRxOAXF.exe
  C:\Windows\System\BRxOAXF.exe
  2⤵
  PID:17228
- C:\Windows\System\krJxVxS.exe
  C:\Windows\System\krJxVxS.exe
  2⤵
  PID:17264
- C:\Windows\System\vEcVKgl.exe
  C:\Windows\System\vEcVKgl.exe
  2⤵
  PID:17280
- C:\Windows\System\nrrtYAM.exe
  C:\Windows\System\nrrtYAM.exe
  2⤵
  PID:17296
- C:\Windows\System\vPZkhCp.exe
  C:\Windows\System\vPZkhCp.exe
  2⤵
  PID:15868
- C:\Windows\System\gwZtFBn.exe
  C:\Windows\System\gwZtFBn.exe
  2⤵
  PID:15536
- C:\Windows\System\PbHigCl.exe
  C:\Windows\System\PbHigCl.exe
  2⤵
  PID:15828
- C:\Windows\System\TcCNlvc.exe
  C:\Windows\System\TcCNlvc.exe
  2⤵
  PID:16400
- C:\Windows\System\coHzboY.exe
  C:\Windows\System\coHzboY.exe
  2⤵
  PID:16532

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:14080

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\BDjTAGm.exe

Filesize
1.5MB

MD5
850bb4c0be82b3c8fa5885c76df01607

SHA1
3fe4c4c53be243910a4cdb19380a4ed8c4f225b9

SHA256
79c4f49c483bea0a82eddb01a54fbb1aeca4eb28cffd4a6afbed9a5f8d9bb152

SHA512
2f64c0c3169f7611f403e105aadfda410b5fab21d53ea2fd96ce4cca3c44c255b9876de8cb8b3a17db88034018c9ddf3086962f2f56e12d71f540f386ab241f1

Download Submit
C:\Windows\System\CbYXowS.exe

Filesize
1.5MB

MD5
8025b5cc16f09fc63986f9eca4a57d05

SHA1
6791508974056a4dc35ca88a61e6ce1326cb0238

SHA256
dd0afb4811cfac0e3568d6d7edc9f559634a240611a619da5b42f1565256be0a

SHA512
05f9a3b64f71d0e83fdb75e65486646302a31344c364a34c3b4eb34cd4882c47f772e6b65cb7d7da4f933fed0ef31047d493b2614409ccfaba761d8bdfa9a875

Download Submit
C:\Windows\System\FlytCdn.exe

Filesize
1.5MB

MD5
f856c7d624c78632ba5c130e431ce67f

SHA1
beee58c0c4899674c5f8bf3ad534686bb8c44d37

SHA256
38fa7119b971cca640b5fc8f089c5807909108ce6d5b8cf3c588d14d39643fb6

SHA512
b82792e30d8d195a2cd547574c7b827fd2a9a00bddacb39c058e74dacbdf864488f426b72e6f7f066fa5b943d5b1e407bc70c33b8c856f6c8a7a33f00e2455f7

Download Submit
C:\Windows\System\GepuUvh.exe

Filesize
1.5MB

MD5
b2a0690b37d2971544d0f4531bb95e3c

SHA1
7085db4ec57285bffe3d433121f5d672e94f14b8

SHA256
99b3cfa9511ed04eedfeaf5c36d207e96069e34c9d85e840ff8266af34fda8e6

SHA512
175b5fee5731b3d34a0694241b4c931d2e8c975422c510d30fca6a699dbee95c56b780a0e998882cbedee472b9cf4cbe071d2dc4c03fc1cf7dc34d4f184438e2

Download Submit
C:\Windows\System\JGUHipP.exe

Filesize
1.5MB

MD5
e5602d9a553ba82f7b92bdcfe906499a

SHA1
2198237ec94150721475c598a7719e9c08c8a968

SHA256
f34de149519b9ef939ba2af2dfbe67dff9870f13ae815cc7fed184e5e30d9909

SHA512
bc1409a3250f336bafbe959bf0512d479b01d115e4e4e103257ba87e35caa6a820458cc5585457166d9ce8783a1d986f865524c28cb98329265a7966cb3a1d7c

Download Submit
C:\Windows\System\JGhFSVf.exe

Filesize
1.6MB

MD5
3f85ae36012a5b40c3e3774dde5a0808

SHA1
91141ae727dfc89c8ab9f02c6c5d7243fe918579

SHA256
65bbe9e5d8be3c35640059b3c2964a07a5e6df14eb05f0e861117c0c8da5160d

SHA512
d9bc65b7ffdfaaf9bf86b8b6461db1fb15466feac525301531823d5f7ac789044d42d42ebde545341e44acded1b3a5671db05fe861e22c3f5a593197c3c014f8

Download Submit
C:\Windows\System\ODmcwQL.exe

Filesize
1.5MB

MD5
8d197f60bc1f57a4efcb848737184688

SHA1
2c5015da65bda62c0a885d7abda381407fcc306d

SHA256
0350b4f980e88e12733ef124b112f98c00c741e229be5e21cd1b9e3fedd4bac5

SHA512
96b47030dcd76858bda0d56c95f706c9212e50d6ef6f1bec93c87280cf85d542abbee5fa47dcd61eac1d745017fe7dfcdc205d9f09a70e4731153b68e44aa9a5

Download Submit
C:\Windows\System\OGTsDmx.exe

Filesize
1.6MB

MD5
658943049a33d1cf080e738abdeaedd0

SHA1
d99332d41607caa8da9ae8064466271f3334a5e9

SHA256
bef5559d4b4a94b4d282e9478cf3ed0fbc1503c6896efb10ebdb2e200ba72973

SHA512
6b98630a2b37cc4ae35def9a407a43fdd2742d41bec85d36bd1d6d88dd668cdc86a208c3d2d20c02f8431648ed84f5b16665451cf33028083b84cc18924ba9ca

Download Submit
C:\Windows\System\QCBTseM.exe

Filesize
1.5MB

MD5
84896470f97c3c973cbff3e676480382

SHA1
cc1582b6b1186d2becc741e05ac4d7d2de8182c5

SHA256
7e2ee84689ceccb42a56e436718bb76d3695f3e61960cf2c8878356bfb477caf

SHA512
3951fcc417dba3a11e60855f577b94b9319ebd24f7c04f27c9a8d492ea398cea87fe1578285d3520d97a436fe2071a767fafac785ddf3fe7657899467883b41e

Download Submit
C:\Windows\System\QXsFLrc.exe

Filesize
1.6MB

MD5
2fddaa6b164ceb60397eaa459a666455

SHA1
c45cc41144f261a6d97131cb18a28d2106a61a01

SHA256
24a91cc8ede6f9a93f566a4691737e77c7f9547be600b0952d4f78fe789b5b86

SHA512
52c7e6dd12f04fdc60dff7299100ebdfe649cf4e5a18666ca832a114afe43b3c52236084a7cc9ebe6e60cd85a32340daa7f9c54b485a6570f14462e388e80457

Download Submit
C:\Windows\System\TokLKTZ.exe

Filesize
1.5MB

MD5
e6efb694bde1cad3d6f31d71e1887951

SHA1
0ec7f945b3238b6ad2a4f13c59d35768525f3600

SHA256
bc6da0e552e762df05492373b19c7dd41873a3a18d373389922ed369fb72cc4b

SHA512
e1af815a1fe1b7aa108f1796ae008f25068b63dd8ae745ea7d7a520863790af14936bc21a250e17255052175b9a82a0d89e568bde934a924827d1d25f7159b7a

Download Submit
C:\Windows\System\YukhZOe.exe

Filesize
1.6MB

MD5
6409f262a1d480e96a7f0edb05aad8ef

SHA1
b1403f98076eb1bb7379f1b462f67a7695729d1e

SHA256
2c387958ec7d0e08746ed151c1ebb283d6eb9d3ff4994f020d7e44edc9f828c5

SHA512
f609b40a1e78c0f974067faa23551b3089b6f8b94f48bdec79ed562ebd4ee232c75bd3248005e0ba4fc4fc06e12dd16519fd7cf7bb2e286f9b8958f9a70b6c8b

Download Submit
C:\Windows\System\ZTvRRLW.exe

Filesize
1.5MB

MD5
d32e6a6882ed7902ab5e99fe55bc7049

SHA1
1e046963b574a4daff6445cbf9f74edcc8ef6397

SHA256
58a21159e241074801ecea5427a6dc3ea1cfccd26fd9919ab48d8b7c517ddcda

SHA512
80cfa9c25cb27253dc05db547c259489e232422ab02433b8a7fb512c22cc334631e06d40eb5214bea0aa6f4340d8eb95dc0fdf87c12693b8b5172a5ac62bef1c

Download Submit
C:\Windows\System\ZeGnMzl.exe

Filesize
1.5MB

MD5
b5fb68b393ff8d546f24e9763fa88b87

SHA1
edd3c12e26485ce30ee14b1fbb8f07b38b82a4f1

SHA256
b97d8e535da3e12af994dd5ee5d8846390837925880669d8192884a9c74549e7

SHA512
a28cbfd9949afddbd9b45ad305baeda66c84d0d3a795056234a64234bc9d7a87dbf78fea25ccf9484f5e1bbbb650e443a6ca8825e3c55a55da61b11f07d7f761

Download Submit
C:\Windows\System\brtztHS.exe

Filesize
1.5MB

MD5
fc3270462859ffe96e0426ec0410dc9b

SHA1
2e050d4381c0fd6a89324426365812819b136be2

SHA256
d09055f7a0b9a8a578bb3b7750bb10e1012c7cbccccd6fba8f27a4b696ac52aa

SHA512
d00b53901d00de9c7b7232de622063c04c363b6396ea07413fc0ecc1abe60c098c4ff3bdb2fe65ee0636b54e78651cbaf4b04c76508415c517b2082af3e8bb5a

Download Submit
C:\Windows\System\cicQqLW.exe

Filesize
1.6MB

MD5
c530c7a892208cabcb2404a5f64e01a0

SHA1
2f80fbaf115d93ccab8f64ee07e0e7da10ffbd12

SHA256
a61283a1122c22040159eb51f74288b606cf5a4c9d3a84b0eb54b61f108c69e8

SHA512
a7266467ef0a161da5f783646a4db7899b40a91ec0e4f26578ac2ba412b53fdc07953cf9800ded7da01ee8cd04adc9a38bc805ffd24c53fed6155dee1abd04a4

Download Submit
C:\Windows\System\dIWbNJM.exe

Filesize
1.6MB

MD5
af2ad6de6bc1fc254f4642d8d4f5d8a3

SHA1
8f21c5ac0d5a04cf867d6a5a80de2eafef01f7fe

SHA256
381c4a4299ac4ed7b42c355d8b77fe559b9c6f6577df4903e7b008c91b89e644

SHA512
edbc7951b00e7541d8ee3294086b5f02a797f397f6fdc06c567c18395eb9bd6dde6e3ece68573a27d4d23e545d0a7544054a51bf883c16772d085f76980948a8

Download Submit
C:\Windows\System\fqllNNv.exe

Filesize
1.5MB

MD5
89e38b991ffe3fd2e7c9912b4a00e2aa

SHA1
d19edb140d9e83b193f4d7aef1eec1b889cf6d88

SHA256
8f85469a13e85861e94f0c9b26ee9c7dee84b75865f10d1d0cf52fed60bb42a3

SHA512
44fda84a66d05de95da8e2c8bfd6abd78525ab8e4a94f2d238333bea306bbbdbbafb8158a7dd2b9d063ef8f1cc2b780db7538c66895ed6bb19649c9eb1b4233e

Download Submit
C:\Windows\System\gnnfflS.exe

Filesize
1.5MB

MD5
e2aa047cef30fccedb98e6dcd53b26b9

SHA1
9bb7d934dc8973bd7117b58d3b3152e04ae1868c

SHA256
7f0fd6c1c28dcd103ccb5579982f2f6de0fc08a123bb5d8bb32993a78a2c640b

SHA512
0db4b28bf8c472828c61172fd0648ccfb7e6398f4d1e2e872d62074bfa63375b0cbac6950cfb8b4e3f56ddc73de511d1994cdb6828301d798e8eeca799836993

Download Submit
C:\Windows\System\iXPPYja.exe

Filesize
1.5MB

MD5
ac4e1a1b371963162e70848c3f7c9d26

SHA1
296e04d45e36edad159ab07ed64965395a0f72ad

SHA256
c6df618b919eb665da43ef356b5ff9042bf9d032213080606ac7772e964d6ecc

SHA512
139b7911c7e788389c9d275a1196d24023fb0f0124162ed213c5dc7f00998f91bb3a354b4d46882af80f2e6b21e5927da5f453c6e1c6beca05bdf2fb6719a5a4

Download Submit
C:\Windows\System\kSZDpbU.exe

Filesize
1.5MB

MD5
2712b1629dc0dd03cbd2f3650a5a141d

SHA1
03a2bab513bf571b0146a821d246b50a08ba64e3

SHA256
6983dfdd7c5fb963b3679c9fe074a558960d4fde5f7a142a18a391a66164f54c

SHA512
56b6b97834a122429d3db3442242b4a41a524393fd5b4150615e58e66bcd6b79d023fe4ed55fcb83bccc913c580e4f8a2a7558f6ef31999ee7648034af4e0a04

Download Submit
C:\Windows\System\lRrDsQI.exe

Filesize
1.5MB

MD5
5d3e66990e4839b7ce1963f4f258485a

SHA1
4156bd3c504dda40f4d8775e911bbd0d2482db51

SHA256
bc02ce16c8bb193af37701cdf43c3d9d9770de136d40ec2b62fd2813576f55f7

SHA512
ad31edcdd937cae677fb2b629c285185c64396779e4fd909583d44a854d285f0b61ccec890370d49950fc55b820e51f977c6594c7d2de7680a1e9dc5315d4e99

Download Submit
C:\Windows\System\mfCOXHf.exe

Filesize
1.5MB

MD5
2c7e81056e7863f50c9c711f43a8fcd9

SHA1
4448a2b1498005a2e4c279ce6c167e8443d7afb3

SHA256
9cf410813a846ad0c118e30f3e5593ffbdc08cd67f028ddbce37efe46b6a9285

SHA512
31f5f0e25cf2e18cde2442fcb801fbf28f41fe0e40124b622845feca41c291bd32ce1468fbbe1f8e929a6e5fa8131debc1270dc5c583e249ce363d3440f3cfb4

Download Submit
C:\Windows\System\mivGZTa.exe

Filesize
1.5MB

MD5
1b2e4362d560c9c9ffcb9a489e9b77f8

SHA1
f30af2e1ecb63f03dfdf48fa5d93c42f853f153e

SHA256
45c735177ca2a919d26fd441f5e2020133056179b15e97a5a4fe7d760bc9f18a

SHA512
79a04996a7d2820cc9560d05837125ac5ac65ab81ebe5b48d1cd3f4ef3e217db2a156d678119072be842169d14bde047d01a86e57449890136b16cbfcccc7d7a

Download Submit
C:\Windows\System\nGCHEEG.exe

Filesize
1.5MB

MD5
4b79cb86a687dc16e21a400bbd459a4d

SHA1
34fd3cc5697cf7a16b0304af8dd1c2bafd61d9a4

SHA256
74204cc132a01369dedbff14961c899a18f5f7acd0e8ef19c82561d60bf54a57

SHA512
462ba25865ff00b8966dc46240a73c67aec16d53aa8748fdc5bf52c59162cfcd9b544129746a3ebbcdde3a147eb9ac8cb7796c14caea6f36a3df41e1c0ea4164

Download Submit
C:\Windows\System\oJkVABt.exe

Filesize
1.5MB

MD5
5fb52241401b2443d86c2a2a14bab1a7

SHA1
2c9ee42c6423dc3c34205b293ab54b91a16297b6

SHA256
8d54f3cc093d57c7c57e9167192d1cc0770abeb5cd1fcdeb79f3d4e9625217c7

SHA512
049ce2db42f247968591541a730c665e706c69820daf76b645e24b4de4044232e8b9f111333d25a7942f3458a67daf1f687d579c519aecf60fd920f4994abc58

Download Submit
C:\Windows\System\pYTPDeB.exe

Filesize
1.5MB

MD5
508ff1a3267256527f15554599102690

SHA1
896332dfa71f61640046cb250e0a13b84b6bf9ae

SHA256
28edb7ef9a11faed3a5558cfbc508d4727132075a1248b1080c7d7b4da5429ff

SHA512
e1af151f5c551681e14f565d2ba123f0c5c46c7d6052fdda3751b7262c9b133a7b3ac5b1e62c8eeb6ed7778a49a1e42d5b8a3fba33a84f677345e2709e19c943

Download Submit
C:\Windows\System\qXJBCko.exe

Filesize
1.5MB

MD5
a0c6b69f8e7336879248083148c36ad9

SHA1
18f79efc37411ed4347bbfb69a7e2e37b9c4d7c3

SHA256
eed72a6443ecedc904552c34d354173aeb7acd19e4d261153ca4cfe2bba2a1ec

SHA512
7097c99662a3c7d6d9960d21a51dfbdd7f8aacc5a6b12a09c726139cdd7fa51675a22c1929cbb1e159d53ce618a4719836fcfb1a3d8577bb6996b8e7a2df5dfe

Download Submit
C:\Windows\System\rpHjbuK.exe

Filesize
1.5MB

MD5
23b8996a8f1962de8e56f9a75d2418fc

SHA1
a19b5107e3996f236fe2b4a75500cee59bd1b780

SHA256
48796fbc4f2333490b46d8162ab39a059d71c0e53f97cada174d8e5f4403d7ef

SHA512
7d814621f355c6c7f1b7ddebefc01af3e998f227f2090d6983ef7e1bc1730f4a455525649edb20238753b9e38decb289adf6675ffee5cd7800339ef51c857ef3

Download Submit
C:\Windows\System\sGHxmCA.exe

Filesize
1.6MB

MD5
506ad85250b9ed8d5011a570bbc8927a

SHA1
024d9f5a000cce037600c4eea066ec0458dc970f

SHA256
173ab9e696dc6a17ad333833a94930063d5e812793482cb6a8ce84db30bfe487

SHA512
c1f3267f7f69c3b18dc58abffbc9b8332833d5f8af56b04338061bb85f1c7dfd8b0ec4bb8742704a56b551be7ffe30c6135bf500f44906d9af3b6de5a36c65e2

Download Submit
C:\Windows\System\sQbumGH.exe

Filesize
1.5MB

MD5
e0eb7c111f9895918d58de4d36e53510

SHA1
1f766148599bfc004d6c06f00df9c3e06bb9a485

SHA256
8b59840384b2998ea6c14e2f47d3b76d5f2022fae3f7a447d4aeb637accc287d

SHA512
bf14f46f012c050c62ec2132dcfaccbe2e26e3861287d57118fdd5efe109f7c441fb8b9790408535bbce73fda65ed10b24d0b2ea4f92d37d718f62b812360ce6

Download Submit
C:\Windows\System\vHAOCPi.exe

Filesize
1.5MB

MD5
b0613a2b5e3c7daa907622397fef3fa3

SHA1
cfa1b0cd8d8f8d27a11029cdac409ec87b6cdb06

SHA256
139b76e64f5c6ce29fc48505a63002f6321eddefae05389e33f38bce0b0d4f4d

SHA512
8006b054d4f23117b91be0d68134e54fb8432bdb6fa21853994070ef37942756d81d35014e413473e09ec1c6d7e04007da143aa723e471d29edfc31d279ac6c2

Download Submit
memory/4380-0-0x0000017673F80000-0x0000017673F90000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads