xmrig | 7fa22eb684d1044384b70d5d22f6108b1b778be8737f2f8faab8f97ee462cae3

Analysis

max time kernel
141s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
21-12-2024 01:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7fa22eb684d1044384b70d5d22f6108b1b778be8737f2f8faab8f97ee462cae3.exe
Size

1023KB
MD5

1b031fe86ac7c39c00ff8a89eb22f531
SHA1

c2af95b2d33ed3675f5f4ceb1b51efc9d30a6abf
SHA256

7fa22eb684d1044384b70d5d22f6108b1b778be8737f2f8faab8f97ee462cae3
SHA512

ab45225b46e0e25101a565568eb0769abeac7f05625c3d3f8a06e9f9596e9acc7e7bce2f729514450c467a3d54d65786752d6b64c6132f7338f6d4c0dcabd181
SSDEEP

24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbpwlKensziXoSPhK:GezaTF8FcNkNdfE0pZ9ozttwIRRyK

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 33 IoCs

miner

resource	yara_rule
behavioral2/files/0x000b000000023bb1-4.dat	xmrig
behavioral2/files/0x0008000000023c8e-9.dat	xmrig
behavioral2/files/0x0007000000023c92-7.dat	xmrig
behavioral2/files/0x0007000000023c93-18.dat	xmrig
behavioral2/files/0x0007000000023c94-23.dat	xmrig
behavioral2/files/0x0007000000023c95-29.dat	xmrig
behavioral2/files/0x0007000000023c98-40.dat	xmrig
behavioral2/files/0x0007000000023c9a-47.dat	xmrig
behavioral2/files/0x0007000000023c9b-57.dat	xmrig
behavioral2/files/0x0007000000023c9d-67.dat	xmrig
behavioral2/files/0x0007000000023c9f-77.dat	xmrig
behavioral2/files/0x0007000000023ca3-92.dat	xmrig
behavioral2/files/0x0007000000023ca4-105.dat	xmrig
behavioral2/files/0x0007000000023caa-135.dat	xmrig
behavioral2/files/0x0007000000023caf-160.dat	xmrig
behavioral2/files/0x0007000000023cb1-162.dat	xmrig
behavioral2/files/0x0007000000023cb0-157.dat	xmrig
behavioral2/files/0x0007000000023cae-155.dat	xmrig
behavioral2/files/0x0007000000023cad-150.dat	xmrig
behavioral2/files/0x0007000000023cac-145.dat	xmrig
behavioral2/files/0x0007000000023cab-140.dat	xmrig
behavioral2/files/0x0007000000023ca9-130.dat	xmrig
behavioral2/files/0x0007000000023ca8-125.dat	xmrig
behavioral2/files/0x0007000000023ca7-120.dat	xmrig
behavioral2/files/0x0007000000023ca6-115.dat	xmrig
behavioral2/files/0x0007000000023ca5-110.dat	xmrig
behavioral2/files/0x0007000000023ca2-95.dat	xmrig
behavioral2/files/0x0007000000023ca1-90.dat	xmrig
behavioral2/files/0x0007000000023ca0-85.dat	xmrig
behavioral2/files/0x0007000000023c9e-73.dat	xmrig
behavioral2/files/0x0007000000023c9c-63.dat	xmrig
behavioral2/files/0x0007000000023c99-48.dat	xmrig
behavioral2/files/0x0007000000023c97-35.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
3632	VTQngYy.exe
4100	atUijhV.exe
2360	BEpKoPg.exe
440	vaQMQVZ.exe
2056	uTAvasU.exe
3340	ajyIkCU.exe
1932	KyebQBp.exe
4688	fkRqEqW.exe
412	MnifKpO.exe
3772	XyRNBkU.exe
3936	uXldjPr.exe
1540	jwLKfKW.exe
3540	ovZOKWX.exe
1676	mzDHbky.exe
4696	hLmzJbZ.exe
2156	MHakOuP.exe
4976	iRdFSfX.exe
640	KOQvVCI.exe
4144	XVlRcmr.exe
3204	qPbZoJA.exe
1852	GQihRRr.exe
4748	udDUNRm.exe
4960	ovoyCqX.exe
1544	MBXRfrB.exe
2296	ihxZlKT.exe
2992	ZJtJvIs.exe
4036	ozFPRxC.exe
408	XxkRbwo.exe
3192	Dsghdxg.exe
2396	LOvOCIZ.exe
760	kMDDzyz.exe
2176	kGbmcSz.exe
1412	XfddDzq.exe
3348	JoFXxjC.exe
5112	MHaGvXA.exe
2932	NPKWaok.exe
1076	cWkKwUa.exe
4304	PyBQqAZ.exe
5036	OchXqKq.exe
512	uaVDodS.exe
1348	SXSTORh.exe
912	DuulCYV.exe
4724	lLwnQUO.exe
1816	cPNHuGu.exe
1736	kTRndTU.exe
2072	rysJFlC.exe
432	MrObtsr.exe
4452	MofLxzQ.exe
4588	axQVpyT.exe
2756	BxJLZhY.exe
4684	zpYaxLL.exe
2876	QILWfME.exe
2180	vxyoAqc.exe
1744	KveEUbr.exe
4192	wYIDAKY.exe
3292	LjjFwhd.exe
4188	lZUuMPt.exe
224	DOopQxu.exe
948	lrqeubD.exe
4740	tcBIAQD.exe
5008	ccTOZeM.exe
4752	Tvdblfa.exe
116	GzvYsrG.exe
3636	PMcjEIH.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\vGJkIGj.exe	7fa22eb684d1044384b70d5d22f6108b1b778be8737f2f8faab8f97ee462cae3.exe
File created	C:\Windows\System\WaMiBDu.exe	7fa22eb684d1044384b70d5d22f6108b1b778be8737f2f8faab8f97ee462cae3.exe
File created	C:\Windows\System\GjlTpOF.exe	7fa22eb684d1044384b70d5d22f6108b1b778be8737f2f8faab8f97ee462cae3.exe
File created	C:\Windows\System\ZPshNDK.exe	7fa22eb684d1044384b70d5d22f6108b1b778be8737f2f8faab8f97ee462cae3.exe
File created	C:\Windows\System\CRGXDyH.exe	7fa22eb684d1044384b70d5d22f6108b1b778be8737f2f8faab8f97ee462cae3.exe
File created	C:\Windows\System\kXAMhqv.exe	7fa22eb684d1044384b70d5d22f6108b1b778be8737f2f8faab8f97ee462cae3.exe
File created	C:\Windows\System\cPNHuGu.exe	7fa22eb684d1044384b70d5d22f6108b1b778be8737f2f8faab8f97ee462cae3.exe
File created	C:\Windows\System\FIfBFBv.exe	7fa22eb684d1044384b70d5d22f6108b1b778be8737f2f8faab8f97ee462cae3.exe
File created	C:\Windows\System\PjAirak.exe	7fa22eb684d1044384b70d5d22f6108b1b778be8737f2f8faab8f97ee462cae3.exe
File created	C:\Windows\System\LKaryKv.exe	7fa22eb684d1044384b70d5d22f6108b1b778be8737f2f8faab8f97ee462cae3.exe
File created	C:\Windows\System\MTuIGVS.exe	7fa22eb684d1044384b70d5d22f6108b1b778be8737f2f8faab8f97ee462cae3.exe
File created	C:\Windows\System\tcTjpUj.exe	7fa22eb684d1044384b70d5d22f6108b1b778be8737f2f8faab8f97ee462cae3.exe
File created	C:\Windows\System\DOopQxu.exe	7fa22eb684d1044384b70d5d22f6108b1b778be8737f2f8faab8f97ee462cae3.exe
File created	C:\Windows\System\zQIgmcG.exe	7fa22eb684d1044384b70d5d22f6108b1b778be8737f2f8faab8f97ee462cae3.exe
File created	C:\Windows\System\LuDqDiK.exe	7fa22eb684d1044384b70d5d22f6108b1b778be8737f2f8faab8f97ee462cae3.exe
File created	C:\Windows\System\yoJFxMb.exe	7fa22eb684d1044384b70d5d22f6108b1b778be8737f2f8faab8f97ee462cae3.exe
File created	C:\Windows\System\DpPxQqF.exe	7fa22eb684d1044384b70d5d22f6108b1b778be8737f2f8faab8f97ee462cae3.exe
File created	C:\Windows\System\kccxUpQ.exe	7fa22eb684d1044384b70d5d22f6108b1b778be8737f2f8faab8f97ee462cae3.exe
File created	C:\Windows\System\dMNPdwF.exe	7fa22eb684d1044384b70d5d22f6108b1b778be8737f2f8faab8f97ee462cae3.exe
File created	C:\Windows\System\ynrOIzY.exe	7fa22eb684d1044384b70d5d22f6108b1b778be8737f2f8faab8f97ee462cae3.exe
File created	C:\Windows\System\MNAEEoC.exe	7fa22eb684d1044384b70d5d22f6108b1b778be8737f2f8faab8f97ee462cae3.exe
File created	C:\Windows\System\NPKWaok.exe	7fa22eb684d1044384b70d5d22f6108b1b778be8737f2f8faab8f97ee462cae3.exe
File created	C:\Windows\System\mxCKTIC.exe	7fa22eb684d1044384b70d5d22f6108b1b778be8737f2f8faab8f97ee462cae3.exe
File created	C:\Windows\System\XUlCbwM.exe	7fa22eb684d1044384b70d5d22f6108b1b778be8737f2f8faab8f97ee462cae3.exe
File created	C:\Windows\System\utHLkPD.exe	7fa22eb684d1044384b70d5d22f6108b1b778be8737f2f8faab8f97ee462cae3.exe
File created	C:\Windows\System\eLOduGN.exe	7fa22eb684d1044384b70d5d22f6108b1b778be8737f2f8faab8f97ee462cae3.exe
File created	C:\Windows\System\VaAsBvr.exe	7fa22eb684d1044384b70d5d22f6108b1b778be8737f2f8faab8f97ee462cae3.exe
File created	C:\Windows\System\DVDMIDd.exe	7fa22eb684d1044384b70d5d22f6108b1b778be8737f2f8faab8f97ee462cae3.exe
File created	C:\Windows\System\BxJLZhY.exe	7fa22eb684d1044384b70d5d22f6108b1b778be8737f2f8faab8f97ee462cae3.exe
File created	C:\Windows\System\Tvdblfa.exe	7fa22eb684d1044384b70d5d22f6108b1b778be8737f2f8faab8f97ee462cae3.exe
File created	C:\Windows\System\PqKaUJc.exe	7fa22eb684d1044384b70d5d22f6108b1b778be8737f2f8faab8f97ee462cae3.exe
File created	C:\Windows\System\JkSPFYJ.exe	7fa22eb684d1044384b70d5d22f6108b1b778be8737f2f8faab8f97ee462cae3.exe
File created	C:\Windows\System\fHRIGMB.exe	7fa22eb684d1044384b70d5d22f6108b1b778be8737f2f8faab8f97ee462cae3.exe
File created	C:\Windows\System\WINWgnO.exe	7fa22eb684d1044384b70d5d22f6108b1b778be8737f2f8faab8f97ee462cae3.exe
File created	C:\Windows\System\ROtfeoz.exe	7fa22eb684d1044384b70d5d22f6108b1b778be8737f2f8faab8f97ee462cae3.exe
File created	C:\Windows\System\BrsMAuD.exe	7fa22eb684d1044384b70d5d22f6108b1b778be8737f2f8faab8f97ee462cae3.exe
File created	C:\Windows\System\dQXTwpT.exe	7fa22eb684d1044384b70d5d22f6108b1b778be8737f2f8faab8f97ee462cae3.exe
File created	C:\Windows\System\frdxOUX.exe	7fa22eb684d1044384b70d5d22f6108b1b778be8737f2f8faab8f97ee462cae3.exe
File created	C:\Windows\System\uxIOrwW.exe	7fa22eb684d1044384b70d5d22f6108b1b778be8737f2f8faab8f97ee462cae3.exe
File created	C:\Windows\System\lKBUwdC.exe	7fa22eb684d1044384b70d5d22f6108b1b778be8737f2f8faab8f97ee462cae3.exe
File created	C:\Windows\System\mILhVwm.exe	7fa22eb684d1044384b70d5d22f6108b1b778be8737f2f8faab8f97ee462cae3.exe
File created	C:\Windows\System\jHQsVIx.exe	7fa22eb684d1044384b70d5d22f6108b1b778be8737f2f8faab8f97ee462cae3.exe
File created	C:\Windows\System\BNHsCyN.exe	7fa22eb684d1044384b70d5d22f6108b1b778be8737f2f8faab8f97ee462cae3.exe
File created	C:\Windows\System\FdHLxUq.exe	7fa22eb684d1044384b70d5d22f6108b1b778be8737f2f8faab8f97ee462cae3.exe
File created	C:\Windows\System\hszHrbS.exe	7fa22eb684d1044384b70d5d22f6108b1b778be8737f2f8faab8f97ee462cae3.exe
File created	C:\Windows\System\hWOFQQD.exe	7fa22eb684d1044384b70d5d22f6108b1b778be8737f2f8faab8f97ee462cae3.exe
File created	C:\Windows\System\bpKaqfY.exe	7fa22eb684d1044384b70d5d22f6108b1b778be8737f2f8faab8f97ee462cae3.exe
File created	C:\Windows\System\SnfchaP.exe	7fa22eb684d1044384b70d5d22f6108b1b778be8737f2f8faab8f97ee462cae3.exe
File created	C:\Windows\System\bASnUBL.exe	7fa22eb684d1044384b70d5d22f6108b1b778be8737f2f8faab8f97ee462cae3.exe
File created	C:\Windows\System\LUoaqGI.exe	7fa22eb684d1044384b70d5d22f6108b1b778be8737f2f8faab8f97ee462cae3.exe
File created	C:\Windows\System\srjgCdK.exe	7fa22eb684d1044384b70d5d22f6108b1b778be8737f2f8faab8f97ee462cae3.exe
File created	C:\Windows\System\DKgkJIa.exe	7fa22eb684d1044384b70d5d22f6108b1b778be8737f2f8faab8f97ee462cae3.exe
File created	C:\Windows\System\hLmzJbZ.exe	7fa22eb684d1044384b70d5d22f6108b1b778be8737f2f8faab8f97ee462cae3.exe
File created	C:\Windows\System\hIrPIkl.exe	7fa22eb684d1044384b70d5d22f6108b1b778be8737f2f8faab8f97ee462cae3.exe
File created	C:\Windows\System\bfIWzVf.exe	7fa22eb684d1044384b70d5d22f6108b1b778be8737f2f8faab8f97ee462cae3.exe
File created	C:\Windows\System\KNTblgA.exe	7fa22eb684d1044384b70d5d22f6108b1b778be8737f2f8faab8f97ee462cae3.exe
File created	C:\Windows\System\brQyyUO.exe	7fa22eb684d1044384b70d5d22f6108b1b778be8737f2f8faab8f97ee462cae3.exe
File created	C:\Windows\System\prlfVLr.exe	7fa22eb684d1044384b70d5d22f6108b1b778be8737f2f8faab8f97ee462cae3.exe
File created	C:\Windows\System\XhdcDeG.exe	7fa22eb684d1044384b70d5d22f6108b1b778be8737f2f8faab8f97ee462cae3.exe
File created	C:\Windows\System\OHGEVhi.exe	7fa22eb684d1044384b70d5d22f6108b1b778be8737f2f8faab8f97ee462cae3.exe
File created	C:\Windows\System\GWBUmeb.exe	7fa22eb684d1044384b70d5d22f6108b1b778be8737f2f8faab8f97ee462cae3.exe
File created	C:\Windows\System\kHiHXwA.exe	7fa22eb684d1044384b70d5d22f6108b1b778be8737f2f8faab8f97ee462cae3.exe
File created	C:\Windows\System\FUkyQGP.exe	7fa22eb684d1044384b70d5d22f6108b1b778be8737f2f8faab8f97ee462cae3.exe
File created	C:\Windows\System\gmjsxTB.exe	7fa22eb684d1044384b70d5d22f6108b1b778be8737f2f8faab8f97ee462cae3.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	17280	dwm.exe
Token: SeChangeNotifyPrivilege	17280	dwm.exe
Token: 33	17280	dwm.exe
Token: SeIncBasePriorityPrivilege	17280	dwm.exe
Token: SeShutdownPrivilege	17280	dwm.exe
Token: SeCreatePagefilePrivilege	17280	dwm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2112 wrote to memory of 3632	2112	7fa22eb684d1044384b70d5d22f6108b1b778be8737f2f8faab8f97ee462cae3.exe	84
PID 2112 wrote to memory of 3632	2112	7fa22eb684d1044384b70d5d22f6108b1b778be8737f2f8faab8f97ee462cae3.exe	84
PID 2112 wrote to memory of 4100	2112	7fa22eb684d1044384b70d5d22f6108b1b778be8737f2f8faab8f97ee462cae3.exe	85
PID 2112 wrote to memory of 4100	2112	7fa22eb684d1044384b70d5d22f6108b1b778be8737f2f8faab8f97ee462cae3.exe	85
PID 2112 wrote to memory of 2360	2112	7fa22eb684d1044384b70d5d22f6108b1b778be8737f2f8faab8f97ee462cae3.exe	86
PID 2112 wrote to memory of 2360	2112	7fa22eb684d1044384b70d5d22f6108b1b778be8737f2f8faab8f97ee462cae3.exe	86
PID 2112 wrote to memory of 440	2112	7fa22eb684d1044384b70d5d22f6108b1b778be8737f2f8faab8f97ee462cae3.exe	87
PID 2112 wrote to memory of 440	2112	7fa22eb684d1044384b70d5d22f6108b1b778be8737f2f8faab8f97ee462cae3.exe	87
PID 2112 wrote to memory of 2056	2112	7fa22eb684d1044384b70d5d22f6108b1b778be8737f2f8faab8f97ee462cae3.exe	88
PID 2112 wrote to memory of 2056	2112	7fa22eb684d1044384b70d5d22f6108b1b778be8737f2f8faab8f97ee462cae3.exe	88
PID 2112 wrote to memory of 3340	2112	7fa22eb684d1044384b70d5d22f6108b1b778be8737f2f8faab8f97ee462cae3.exe	89
PID 2112 wrote to memory of 3340	2112	7fa22eb684d1044384b70d5d22f6108b1b778be8737f2f8faab8f97ee462cae3.exe	89
PID 2112 wrote to memory of 1932	2112	7fa22eb684d1044384b70d5d22f6108b1b778be8737f2f8faab8f97ee462cae3.exe	90
PID 2112 wrote to memory of 1932	2112	7fa22eb684d1044384b70d5d22f6108b1b778be8737f2f8faab8f97ee462cae3.exe	90
PID 2112 wrote to memory of 4688	2112	7fa22eb684d1044384b70d5d22f6108b1b778be8737f2f8faab8f97ee462cae3.exe	91
PID 2112 wrote to memory of 4688	2112	7fa22eb684d1044384b70d5d22f6108b1b778be8737f2f8faab8f97ee462cae3.exe	91
PID 2112 wrote to memory of 412	2112	7fa22eb684d1044384b70d5d22f6108b1b778be8737f2f8faab8f97ee462cae3.exe	92
PID 2112 wrote to memory of 412	2112	7fa22eb684d1044384b70d5d22f6108b1b778be8737f2f8faab8f97ee462cae3.exe	92
PID 2112 wrote to memory of 3772	2112	7fa22eb684d1044384b70d5d22f6108b1b778be8737f2f8faab8f97ee462cae3.exe	93
PID 2112 wrote to memory of 3772	2112	7fa22eb684d1044384b70d5d22f6108b1b778be8737f2f8faab8f97ee462cae3.exe	93
PID 2112 wrote to memory of 3936	2112	7fa22eb684d1044384b70d5d22f6108b1b778be8737f2f8faab8f97ee462cae3.exe	94
PID 2112 wrote to memory of 3936	2112	7fa22eb684d1044384b70d5d22f6108b1b778be8737f2f8faab8f97ee462cae3.exe	94
PID 2112 wrote to memory of 1540	2112	7fa22eb684d1044384b70d5d22f6108b1b778be8737f2f8faab8f97ee462cae3.exe	95
PID 2112 wrote to memory of 1540	2112	7fa22eb684d1044384b70d5d22f6108b1b778be8737f2f8faab8f97ee462cae3.exe	95
PID 2112 wrote to memory of 3540	2112	7fa22eb684d1044384b70d5d22f6108b1b778be8737f2f8faab8f97ee462cae3.exe	96
PID 2112 wrote to memory of 3540	2112	7fa22eb684d1044384b70d5d22f6108b1b778be8737f2f8faab8f97ee462cae3.exe	96
PID 2112 wrote to memory of 1676	2112	7fa22eb684d1044384b70d5d22f6108b1b778be8737f2f8faab8f97ee462cae3.exe	97
PID 2112 wrote to memory of 1676	2112	7fa22eb684d1044384b70d5d22f6108b1b778be8737f2f8faab8f97ee462cae3.exe	97
PID 2112 wrote to memory of 4696	2112	7fa22eb684d1044384b70d5d22f6108b1b778be8737f2f8faab8f97ee462cae3.exe	98
PID 2112 wrote to memory of 4696	2112	7fa22eb684d1044384b70d5d22f6108b1b778be8737f2f8faab8f97ee462cae3.exe	98
PID 2112 wrote to memory of 2156	2112	7fa22eb684d1044384b70d5d22f6108b1b778be8737f2f8faab8f97ee462cae3.exe	99
PID 2112 wrote to memory of 2156	2112	7fa22eb684d1044384b70d5d22f6108b1b778be8737f2f8faab8f97ee462cae3.exe	99
PID 2112 wrote to memory of 4976	2112	7fa22eb684d1044384b70d5d22f6108b1b778be8737f2f8faab8f97ee462cae3.exe	100
PID 2112 wrote to memory of 4976	2112	7fa22eb684d1044384b70d5d22f6108b1b778be8737f2f8faab8f97ee462cae3.exe	100
PID 2112 wrote to memory of 640	2112	7fa22eb684d1044384b70d5d22f6108b1b778be8737f2f8faab8f97ee462cae3.exe	101
PID 2112 wrote to memory of 640	2112	7fa22eb684d1044384b70d5d22f6108b1b778be8737f2f8faab8f97ee462cae3.exe	101
PID 2112 wrote to memory of 4144	2112	7fa22eb684d1044384b70d5d22f6108b1b778be8737f2f8faab8f97ee462cae3.exe	102
PID 2112 wrote to memory of 4144	2112	7fa22eb684d1044384b70d5d22f6108b1b778be8737f2f8faab8f97ee462cae3.exe	102
PID 2112 wrote to memory of 3204	2112	7fa22eb684d1044384b70d5d22f6108b1b778be8737f2f8faab8f97ee462cae3.exe	103
PID 2112 wrote to memory of 3204	2112	7fa22eb684d1044384b70d5d22f6108b1b778be8737f2f8faab8f97ee462cae3.exe	103
PID 2112 wrote to memory of 1852	2112	7fa22eb684d1044384b70d5d22f6108b1b778be8737f2f8faab8f97ee462cae3.exe	104
PID 2112 wrote to memory of 1852	2112	7fa22eb684d1044384b70d5d22f6108b1b778be8737f2f8faab8f97ee462cae3.exe	104
PID 2112 wrote to memory of 4748	2112	7fa22eb684d1044384b70d5d22f6108b1b778be8737f2f8faab8f97ee462cae3.exe	105
PID 2112 wrote to memory of 4748	2112	7fa22eb684d1044384b70d5d22f6108b1b778be8737f2f8faab8f97ee462cae3.exe	105
PID 2112 wrote to memory of 4960	2112	7fa22eb684d1044384b70d5d22f6108b1b778be8737f2f8faab8f97ee462cae3.exe	106
PID 2112 wrote to memory of 4960	2112	7fa22eb684d1044384b70d5d22f6108b1b778be8737f2f8faab8f97ee462cae3.exe	106
PID 2112 wrote to memory of 1544	2112	7fa22eb684d1044384b70d5d22f6108b1b778be8737f2f8faab8f97ee462cae3.exe	107
PID 2112 wrote to memory of 1544	2112	7fa22eb684d1044384b70d5d22f6108b1b778be8737f2f8faab8f97ee462cae3.exe	107
PID 2112 wrote to memory of 2296	2112	7fa22eb684d1044384b70d5d22f6108b1b778be8737f2f8faab8f97ee462cae3.exe	108
PID 2112 wrote to memory of 2296	2112	7fa22eb684d1044384b70d5d22f6108b1b778be8737f2f8faab8f97ee462cae3.exe	108
PID 2112 wrote to memory of 2992	2112	7fa22eb684d1044384b70d5d22f6108b1b778be8737f2f8faab8f97ee462cae3.exe	109
PID 2112 wrote to memory of 2992	2112	7fa22eb684d1044384b70d5d22f6108b1b778be8737f2f8faab8f97ee462cae3.exe	109
PID 2112 wrote to memory of 4036	2112	7fa22eb684d1044384b70d5d22f6108b1b778be8737f2f8faab8f97ee462cae3.exe	110
PID 2112 wrote to memory of 4036	2112	7fa22eb684d1044384b70d5d22f6108b1b778be8737f2f8faab8f97ee462cae3.exe	110
PID 2112 wrote to memory of 408	2112	7fa22eb684d1044384b70d5d22f6108b1b778be8737f2f8faab8f97ee462cae3.exe	111
PID 2112 wrote to memory of 408	2112	7fa22eb684d1044384b70d5d22f6108b1b778be8737f2f8faab8f97ee462cae3.exe	111
PID 2112 wrote to memory of 3192	2112	7fa22eb684d1044384b70d5d22f6108b1b778be8737f2f8faab8f97ee462cae3.exe	112
PID 2112 wrote to memory of 3192	2112	7fa22eb684d1044384b70d5d22f6108b1b778be8737f2f8faab8f97ee462cae3.exe	112
PID 2112 wrote to memory of 2396	2112	7fa22eb684d1044384b70d5d22f6108b1b778be8737f2f8faab8f97ee462cae3.exe	113
PID 2112 wrote to memory of 2396	2112	7fa22eb684d1044384b70d5d22f6108b1b778be8737f2f8faab8f97ee462cae3.exe	113
PID 2112 wrote to memory of 760	2112	7fa22eb684d1044384b70d5d22f6108b1b778be8737f2f8faab8f97ee462cae3.exe	114
PID 2112 wrote to memory of 760	2112	7fa22eb684d1044384b70d5d22f6108b1b778be8737f2f8faab8f97ee462cae3.exe	114
PID 2112 wrote to memory of 2176	2112	7fa22eb684d1044384b70d5d22f6108b1b778be8737f2f8faab8f97ee462cae3.exe	115
PID 2112 wrote to memory of 2176	2112	7fa22eb684d1044384b70d5d22f6108b1b778be8737f2f8faab8f97ee462cae3.exe	115

C:\Users\Admin\AppData\Local\Temp\7fa22eb684d1044384b70d5d22f6108b1b778be8737f2f8faab8f97ee462cae3.exe
"C:\Users\Admin\AppData\Local\Temp\7fa22eb684d1044384b70d5d22f6108b1b778be8737f2f8faab8f97ee462cae3.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2112
- C:\Windows\System\VTQngYy.exe
  C:\Windows\System\VTQngYy.exe
  2⤵
  - Executes dropped EXE
  PID:3632
- C:\Windows\System\atUijhV.exe
  C:\Windows\System\atUijhV.exe
  2⤵
  - Executes dropped EXE
  PID:4100
- C:\Windows\System\BEpKoPg.exe
  C:\Windows\System\BEpKoPg.exe
  2⤵
  - Executes dropped EXE
  PID:2360
- C:\Windows\System\vaQMQVZ.exe
  C:\Windows\System\vaQMQVZ.exe
  2⤵
  - Executes dropped EXE
  PID:440
- C:\Windows\System\uTAvasU.exe
  C:\Windows\System\uTAvasU.exe
  2⤵
  - Executes dropped EXE
  PID:2056
- C:\Windows\System\ajyIkCU.exe
  C:\Windows\System\ajyIkCU.exe
  2⤵
  - Executes dropped EXE
  PID:3340
- C:\Windows\System\KyebQBp.exe
  C:\Windows\System\KyebQBp.exe
  2⤵
  - Executes dropped EXE
  PID:1932
- C:\Windows\System\fkRqEqW.exe
  C:\Windows\System\fkRqEqW.exe
  2⤵
  - Executes dropped EXE
  PID:4688
- C:\Windows\System\MnifKpO.exe
  C:\Windows\System\MnifKpO.exe
  2⤵
  - Executes dropped EXE
  PID:412
- C:\Windows\System\XyRNBkU.exe
  C:\Windows\System\XyRNBkU.exe
  2⤵
  - Executes dropped EXE
  PID:3772
- C:\Windows\System\uXldjPr.exe
  C:\Windows\System\uXldjPr.exe
  2⤵
  - Executes dropped EXE
  PID:3936
- C:\Windows\System\jwLKfKW.exe
  C:\Windows\System\jwLKfKW.exe
  2⤵
  - Executes dropped EXE
  PID:1540
- C:\Windows\System\ovZOKWX.exe
  C:\Windows\System\ovZOKWX.exe
  2⤵
  - Executes dropped EXE
  PID:3540
- C:\Windows\System\mzDHbky.exe
  C:\Windows\System\mzDHbky.exe
  2⤵
  - Executes dropped EXE
  PID:1676
- C:\Windows\System\hLmzJbZ.exe
  C:\Windows\System\hLmzJbZ.exe
  2⤵
  - Executes dropped EXE
  PID:4696
- C:\Windows\System\MHakOuP.exe
  C:\Windows\System\MHakOuP.exe
  2⤵
  - Executes dropped EXE
  PID:2156
- C:\Windows\System\iRdFSfX.exe
  C:\Windows\System\iRdFSfX.exe
  2⤵
  - Executes dropped EXE
  PID:4976
- C:\Windows\System\KOQvVCI.exe
  C:\Windows\System\KOQvVCI.exe
  2⤵
  - Executes dropped EXE
  PID:640
- C:\Windows\System\XVlRcmr.exe
  C:\Windows\System\XVlRcmr.exe
  2⤵
  - Executes dropped EXE
  PID:4144
- C:\Windows\System\qPbZoJA.exe
  C:\Windows\System\qPbZoJA.exe
  2⤵
  - Executes dropped EXE
  PID:3204
- C:\Windows\System\GQihRRr.exe
  C:\Windows\System\GQihRRr.exe
  2⤵
  - Executes dropped EXE
  PID:1852
- C:\Windows\System\udDUNRm.exe
  C:\Windows\System\udDUNRm.exe
  2⤵
  - Executes dropped EXE
  PID:4748
- C:\Windows\System\ovoyCqX.exe
  C:\Windows\System\ovoyCqX.exe
  2⤵
  - Executes dropped EXE
  PID:4960
- C:\Windows\System\MBXRfrB.exe
  C:\Windows\System\MBXRfrB.exe
  2⤵
  - Executes dropped EXE
  PID:1544
- C:\Windows\System\ihxZlKT.exe
  C:\Windows\System\ihxZlKT.exe
  2⤵
  - Executes dropped EXE
  PID:2296
- C:\Windows\System\ZJtJvIs.exe
  C:\Windows\System\ZJtJvIs.exe
  2⤵
  - Executes dropped EXE
  PID:2992
- C:\Windows\System\ozFPRxC.exe
  C:\Windows\System\ozFPRxC.exe
  2⤵
  - Executes dropped EXE
  PID:4036
- C:\Windows\System\XxkRbwo.exe
  C:\Windows\System\XxkRbwo.exe
  2⤵
  - Executes dropped EXE
  PID:408
- C:\Windows\System\Dsghdxg.exe
  C:\Windows\System\Dsghdxg.exe
  2⤵
  - Executes dropped EXE
  PID:3192
- C:\Windows\System\LOvOCIZ.exe
  C:\Windows\System\LOvOCIZ.exe
  2⤵
  - Executes dropped EXE
  PID:2396
- C:\Windows\System\kMDDzyz.exe
  C:\Windows\System\kMDDzyz.exe
  2⤵
  - Executes dropped EXE
  PID:760
- C:\Windows\System\kGbmcSz.exe
  C:\Windows\System\kGbmcSz.exe
  2⤵
  - Executes dropped EXE
  PID:2176
- C:\Windows\System\XfddDzq.exe
  C:\Windows\System\XfddDzq.exe
  2⤵
  - Executes dropped EXE
  PID:1412
- C:\Windows\System\JoFXxjC.exe
  C:\Windows\System\JoFXxjC.exe
  2⤵
  - Executes dropped EXE
  PID:3348
- C:\Windows\System\MHaGvXA.exe
  C:\Windows\System\MHaGvXA.exe
  2⤵
  - Executes dropped EXE
  PID:5112
- C:\Windows\System\NPKWaok.exe
  C:\Windows\System\NPKWaok.exe
  2⤵
  - Executes dropped EXE
  PID:2932
- C:\Windows\System\cWkKwUa.exe
  C:\Windows\System\cWkKwUa.exe
  2⤵
  - Executes dropped EXE
  PID:1076
- C:\Windows\System\PyBQqAZ.exe
  C:\Windows\System\PyBQqAZ.exe
  2⤵
  - Executes dropped EXE
  PID:4304
- C:\Windows\System\OchXqKq.exe
  C:\Windows\System\OchXqKq.exe
  2⤵
  - Executes dropped EXE
  PID:5036
- C:\Windows\System\uaVDodS.exe
  C:\Windows\System\uaVDodS.exe
  2⤵
  - Executes dropped EXE
  PID:512
- C:\Windows\System\SXSTORh.exe
  C:\Windows\System\SXSTORh.exe
  2⤵
  - Executes dropped EXE
  PID:1348
- C:\Windows\System\DuulCYV.exe
  C:\Windows\System\DuulCYV.exe
  2⤵
  - Executes dropped EXE
  PID:912
- C:\Windows\System\lLwnQUO.exe
  C:\Windows\System\lLwnQUO.exe
  2⤵
  - Executes dropped EXE
  PID:4724
- C:\Windows\System\cPNHuGu.exe
  C:\Windows\System\cPNHuGu.exe
  2⤵
  - Executes dropped EXE
  PID:1816
- C:\Windows\System\kTRndTU.exe
  C:\Windows\System\kTRndTU.exe
  2⤵
  - Executes dropped EXE
  PID:1736
- C:\Windows\System\rysJFlC.exe
  C:\Windows\System\rysJFlC.exe
  2⤵
  - Executes dropped EXE
  PID:2072
- C:\Windows\System\MrObtsr.exe
  C:\Windows\System\MrObtsr.exe
  2⤵
  - Executes dropped EXE
  PID:432
- C:\Windows\System\MofLxzQ.exe
  C:\Windows\System\MofLxzQ.exe
  2⤵
  - Executes dropped EXE
  PID:4452
- C:\Windows\System\axQVpyT.exe
  C:\Windows\System\axQVpyT.exe
  2⤵
  - Executes dropped EXE
  PID:4588
- C:\Windows\System\BxJLZhY.exe
  C:\Windows\System\BxJLZhY.exe
  2⤵
  - Executes dropped EXE
  PID:2756
- C:\Windows\System\zpYaxLL.exe
  C:\Windows\System\zpYaxLL.exe
  2⤵
  - Executes dropped EXE
  PID:4684
- C:\Windows\System\QILWfME.exe
  C:\Windows\System\QILWfME.exe
  2⤵
  - Executes dropped EXE
  PID:2876
- C:\Windows\System\vxyoAqc.exe
  C:\Windows\System\vxyoAqc.exe
  2⤵
  - Executes dropped EXE
  PID:2180
- C:\Windows\System\KveEUbr.exe
  C:\Windows\System\KveEUbr.exe
  2⤵
  - Executes dropped EXE
  PID:1744
- C:\Windows\System\wYIDAKY.exe
  C:\Windows\System\wYIDAKY.exe
  2⤵
  - Executes dropped EXE
  PID:4192
- C:\Windows\System\LjjFwhd.exe
  C:\Windows\System\LjjFwhd.exe
  2⤵
  - Executes dropped EXE
  PID:3292
- C:\Windows\System\lZUuMPt.exe
  C:\Windows\System\lZUuMPt.exe
  2⤵
  - Executes dropped EXE
  PID:4188
- C:\Windows\System\DOopQxu.exe
  C:\Windows\System\DOopQxu.exe
  2⤵
  - Executes dropped EXE
  PID:224
- C:\Windows\System\lrqeubD.exe
  C:\Windows\System\lrqeubD.exe
  2⤵
  - Executes dropped EXE
  PID:948
- C:\Windows\System\tcBIAQD.exe
  C:\Windows\System\tcBIAQD.exe
  2⤵
  - Executes dropped EXE
  PID:4740
- C:\Windows\System\ccTOZeM.exe
  C:\Windows\System\ccTOZeM.exe
  2⤵
  - Executes dropped EXE
  PID:5008
- C:\Windows\System\Tvdblfa.exe
  C:\Windows\System\Tvdblfa.exe
  2⤵
  - Executes dropped EXE
  PID:4752
- C:\Windows\System\GzvYsrG.exe
  C:\Windows\System\GzvYsrG.exe
  2⤵
  - Executes dropped EXE
  PID:116
- C:\Windows\System\PMcjEIH.exe
  C:\Windows\System\PMcjEIH.exe
  2⤵
  - Executes dropped EXE
  PID:3636
- C:\Windows\System\jFSrQbL.exe
  C:\Windows\System\jFSrQbL.exe
  2⤵
  PID:4516
- C:\Windows\System\mcDjCzj.exe
  C:\Windows\System\mcDjCzj.exe
  2⤵
  PID:5068
- C:\Windows\System\wOdnZcP.exe
  C:\Windows\System\wOdnZcP.exe
  2⤵
  PID:1140
- C:\Windows\System\NwjAmEY.exe
  C:\Windows\System\NwjAmEY.exe
  2⤵
  PID:1536
- C:\Windows\System\qhskZbn.exe
  C:\Windows\System\qhskZbn.exe
  2⤵
  PID:1100
- C:\Windows\System\aUKilnb.exe
  C:\Windows\System\aUKilnb.exe
  2⤵
  PID:5032
- C:\Windows\System\EyBrLIj.exe
  C:\Windows\System\EyBrLIj.exe
  2⤵
  PID:2152
- C:\Windows\System\wQoxObs.exe
  C:\Windows\System\wQoxObs.exe
  2⤵
  PID:112
- C:\Windows\System\DZRvAHT.exe
  C:\Windows\System\DZRvAHT.exe
  2⤵
  PID:3644
- C:\Windows\System\dcNrkjH.exe
  C:\Windows\System\dcNrkjH.exe
  2⤵
  PID:3032
- C:\Windows\System\fLyhzVJ.exe
  C:\Windows\System\fLyhzVJ.exe
  2⤵
  PID:2680
- C:\Windows\System\jiMzoau.exe
  C:\Windows\System\jiMzoau.exe
  2⤵
  PID:5144
- C:\Windows\System\pgNhbWd.exe
  C:\Windows\System\pgNhbWd.exe
  2⤵
  PID:5168
- C:\Windows\System\nCwvCLs.exe
  C:\Windows\System\nCwvCLs.exe
  2⤵
  PID:5200
- C:\Windows\System\vxmENAS.exe
  C:\Windows\System\vxmENAS.exe
  2⤵
  PID:5228
- C:\Windows\System\hPTUtmW.exe
  C:\Windows\System\hPTUtmW.exe
  2⤵
  PID:5256
- C:\Windows\System\CQreYkm.exe
  C:\Windows\System\CQreYkm.exe
  2⤵
  PID:5280
- C:\Windows\System\MXtaBsT.exe
  C:\Windows\System\MXtaBsT.exe
  2⤵
  PID:5312
- C:\Windows\System\qsWKTjM.exe
  C:\Windows\System\qsWKTjM.exe
  2⤵
  PID:5336
- C:\Windows\System\ywIcSff.exe
  C:\Windows\System\ywIcSff.exe
  2⤵
  PID:5368
- C:\Windows\System\HfkZrFW.exe
  C:\Windows\System\HfkZrFW.exe
  2⤵
  PID:5392
- C:\Windows\System\CLfWZoT.exe
  C:\Windows\System\CLfWZoT.exe
  2⤵
  PID:5424
- C:\Windows\System\fKkglMs.exe
  C:\Windows\System\fKkglMs.exe
  2⤵
  PID:5448
- C:\Windows\System\afpeZJw.exe
  C:\Windows\System\afpeZJw.exe
  2⤵
  PID:5480
- C:\Windows\System\ZllGbMj.exe
  C:\Windows\System\ZllGbMj.exe
  2⤵
  PID:5508
- C:\Windows\System\SLYBEvg.exe
  C:\Windows\System\SLYBEvg.exe
  2⤵
  PID:5532
- C:\Windows\System\AVFmTbu.exe
  C:\Windows\System\AVFmTbu.exe
  2⤵
  PID:5564
- C:\Windows\System\TyVfGzn.exe
  C:\Windows\System\TyVfGzn.exe
  2⤵
  PID:5592
- C:\Windows\System\fzaluXO.exe
  C:\Windows\System\fzaluXO.exe
  2⤵
  PID:5616
- C:\Windows\System\goUcMOH.exe
  C:\Windows\System\goUcMOH.exe
  2⤵
  PID:5648
- C:\Windows\System\FnKNiRb.exe
  C:\Windows\System\FnKNiRb.exe
  2⤵
  PID:5672
- C:\Windows\System\yWimbzO.exe
  C:\Windows\System\yWimbzO.exe
  2⤵
  PID:5704
- C:\Windows\System\pChAZIx.exe
  C:\Windows\System\pChAZIx.exe
  2⤵
  PID:5728
- C:\Windows\System\fteYftQ.exe
  C:\Windows\System\fteYftQ.exe
  2⤵
  PID:5760
- C:\Windows\System\pDBovmy.exe
  C:\Windows\System\pDBovmy.exe
  2⤵
  PID:5784
- C:\Windows\System\ZJXmntB.exe
  C:\Windows\System\ZJXmntB.exe
  2⤵
  PID:5816
- C:\Windows\System\YLpRAbr.exe
  C:\Windows\System\YLpRAbr.exe
  2⤵
  PID:5844
- C:\Windows\System\ckGFeWG.exe
  C:\Windows\System\ckGFeWG.exe
  2⤵
  PID:5868
- C:\Windows\System\bLkVReF.exe
  C:\Windows\System\bLkVReF.exe
  2⤵
  PID:5896
- C:\Windows\System\MsfSVIQ.exe
  C:\Windows\System\MsfSVIQ.exe
  2⤵
  PID:5924
- C:\Windows\System\AXlvRva.exe
  C:\Windows\System\AXlvRva.exe
  2⤵
  PID:5956
- C:\Windows\System\mxCKTIC.exe
  C:\Windows\System\mxCKTIC.exe
  2⤵
  PID:5984
- C:\Windows\System\CfZGpvm.exe
  C:\Windows\System\CfZGpvm.exe
  2⤵
  PID:6012
- C:\Windows\System\HwMqumm.exe
  C:\Windows\System\HwMqumm.exe
  2⤵
  PID:6036
- C:\Windows\System\AGneRxC.exe
  C:\Windows\System\AGneRxC.exe
  2⤵
  PID:6068
- C:\Windows\System\iQcSlUx.exe
  C:\Windows\System\iQcSlUx.exe
  2⤵
  PID:6092
- C:\Windows\System\SxWrMHn.exe
  C:\Windows\System\SxWrMHn.exe
  2⤵
  PID:6124
- C:\Windows\System\cDCKCPZ.exe
  C:\Windows\System\cDCKCPZ.exe
  2⤵
  PID:1408
- C:\Windows\System\AGTtZdU.exe
  C:\Windows\System\AGTtZdU.exe
  2⤵
  PID:1732
- C:\Windows\System\FUkyQGP.exe
  C:\Windows\System\FUkyQGP.exe
  2⤵
  PID:1960
- C:\Windows\System\oCDvHHn.exe
  C:\Windows\System\oCDvHHn.exe
  2⤵
  PID:1280
- C:\Windows\System\hmZEwla.exe
  C:\Windows\System\hmZEwla.exe
  2⤵
  PID:1988
- C:\Windows\System\lzRYjrs.exe
  C:\Windows\System\lzRYjrs.exe
  2⤵
  PID:1432
- C:\Windows\System\zakiWrW.exe
  C:\Windows\System\zakiWrW.exe
  2⤵
  PID:5152
- C:\Windows\System\uxIOrwW.exe
  C:\Windows\System\uxIOrwW.exe
  2⤵
  PID:5188
- C:\Windows\System\ffYiCXD.exe
  C:\Windows\System\ffYiCXD.exe
  2⤵
  PID:5272
- C:\Windows\System\zQIgmcG.exe
  C:\Windows\System\zQIgmcG.exe
  2⤵
  PID:5328
- C:\Windows\System\poABWMt.exe
  C:\Windows\System\poABWMt.exe
  2⤵
  PID:2052
- C:\Windows\System\diiepFR.exe
  C:\Windows\System\diiepFR.exe
  2⤵
  PID:5460
- C:\Windows\System\JUZoLnC.exe
  C:\Windows\System\JUZoLnC.exe
  2⤵
  PID:5524
- C:\Windows\System\WaMiBDu.exe
  C:\Windows\System\WaMiBDu.exe
  2⤵
  PID:5580
- C:\Windows\System\LMtCTds.exe
  C:\Windows\System\LMtCTds.exe
  2⤵
  PID:5684
- C:\Windows\System\wfcGBAY.exe
  C:\Windows\System\wfcGBAY.exe
  2⤵
  PID:5096
- C:\Windows\System\RYgxomA.exe
  C:\Windows\System\RYgxomA.exe
  2⤵
  PID:5800
- C:\Windows\System\uRLCACw.exe
  C:\Windows\System\uRLCACw.exe
  2⤵
  PID:5912
- C:\Windows\System\JDvhYAh.exe
  C:\Windows\System\JDvhYAh.exe
  2⤵
  PID:5992
- C:\Windows\System\DpPxQqF.exe
  C:\Windows\System\DpPxQqF.exe
  2⤵
  PID:6032
- C:\Windows\System\iPaEMSI.exe
  C:\Windows\System\iPaEMSI.exe
  2⤵
  PID:6084
- C:\Windows\System\fquJlwF.exe
  C:\Windows\System\fquJlwF.exe
  2⤵
  PID:3528
- C:\Windows\System\MbdfXvm.exe
  C:\Windows\System\MbdfXvm.exe
  2⤵
  PID:1516
- C:\Windows\System\kIISfTH.exe
  C:\Windows\System\kIISfTH.exe
  2⤵
  PID:5124
- C:\Windows\System\wTNBRJt.exe
  C:\Windows\System\wTNBRJt.exe
  2⤵
  PID:3284
- C:\Windows\System\UogsTNZ.exe
  C:\Windows\System\UogsTNZ.exe
  2⤵
  PID:3136
- C:\Windows\System\cHyranN.exe
  C:\Windows\System\cHyranN.exe
  2⤵
  PID:1532
- C:\Windows\System\UjEKiVi.exe
  C:\Windows\System\UjEKiVi.exe
  2⤵
  PID:3252
- C:\Windows\System\EizDJeO.exe
  C:\Windows\System\EizDJeO.exe
  2⤵
  PID:2044
- C:\Windows\System\PROMurm.exe
  C:\Windows\System\PROMurm.exe
  2⤵
  PID:2660
- C:\Windows\System\uscCqmf.exe
  C:\Windows\System\uscCqmf.exe
  2⤵
  PID:3396
- C:\Windows\System\bMQAaNY.exe
  C:\Windows\System\bMQAaNY.exe
  2⤵
  PID:1368
- C:\Windows\System\WlOtSDB.exe
  C:\Windows\System\WlOtSDB.exe
  2⤵
  PID:2908
- C:\Windows\System\CtUZCMh.exe
  C:\Windows\System\CtUZCMh.exe
  2⤵
  PID:5320
- C:\Windows\System\pArdQzK.exe
  C:\Windows\System\pArdQzK.exe
  2⤵
  PID:5440
- C:\Windows\System\JWTbMCN.exe
  C:\Windows\System\JWTbMCN.exe
  2⤵
  PID:5548
- C:\Windows\System\QKEeIeL.exe
  C:\Windows\System\QKEeIeL.exe
  2⤵
  PID:5636
- C:\Windows\System\NAfLsvM.exe
  C:\Windows\System\NAfLsvM.exe
  2⤵
  PID:3976
- C:\Windows\System\szFMZKh.exe
  C:\Windows\System\szFMZKh.exe
  2⤵
  PID:5780
- C:\Windows\System\MaAsTmD.exe
  C:\Windows\System\MaAsTmD.exe
  2⤵
  PID:4228
- C:\Windows\System\ZwkTBaS.exe
  C:\Windows\System\ZwkTBaS.exe
  2⤵
  PID:5976
- C:\Windows\System\DmxGFFE.exe
  C:\Windows\System\DmxGFFE.exe
  2⤵
  PID:6028
- C:\Windows\System\zIQXPjk.exe
  C:\Windows\System\zIQXPjk.exe
  2⤵
  PID:6108
- C:\Windows\System\YcOsrqZ.exe
  C:\Windows\System\YcOsrqZ.exe
  2⤵
  PID:4832
- C:\Windows\System\eAVdGhH.exe
  C:\Windows\System\eAVdGhH.exe
  2⤵
  PID:5028
- C:\Windows\System\rHdlWmM.exe
  C:\Windows\System\rHdlWmM.exe
  2⤵
  PID:3824
- C:\Windows\System\MsJkvMN.exe
  C:\Windows\System\MsJkvMN.exe
  2⤵
  PID:2944
- C:\Windows\System\hQkysEz.exe
  C:\Windows\System\hQkysEz.exe
  2⤵
  PID:5236
- C:\Windows\System\oimDTed.exe
  C:\Windows\System\oimDTed.exe
  2⤵
  PID:1884
- C:\Windows\System\iPsLPUY.exe
  C:\Windows\System\iPsLPUY.exe
  2⤵
  PID:3944
- C:\Windows\System\tZlnAIm.exe
  C:\Windows\System\tZlnAIm.exe
  2⤵
  PID:4652
- C:\Windows\System\GnBSAQH.exe
  C:\Windows\System\GnBSAQH.exe
  2⤵
  PID:2488
- C:\Windows\System\ylTtjhE.exe
  C:\Windows\System\ylTtjhE.exe
  2⤵
  PID:3500
- C:\Windows\System\FIfBFBv.exe
  C:\Windows\System\FIfBFBv.exe
  2⤵
  PID:4524
- C:\Windows\System\bXXROEQ.exe
  C:\Windows\System\bXXROEQ.exe
  2⤵
  PID:5944
- C:\Windows\System\ucqltRF.exe
  C:\Windows\System\ucqltRF.exe
  2⤵
  PID:3696
- C:\Windows\System\XpuuQZQ.exe
  C:\Windows\System\XpuuQZQ.exe
  2⤵
  PID:1528
- C:\Windows\System\QhbGftZ.exe
  C:\Windows\System\QhbGftZ.exe
  2⤵
  PID:3968
- C:\Windows\System\EzvwaxF.exe
  C:\Windows\System\EzvwaxF.exe
  2⤵
  PID:4292
- C:\Windows\System\nuHBgjp.exe
  C:\Windows\System\nuHBgjp.exe
  2⤵
  PID:2532
- C:\Windows\System\oXnvriT.exe
  C:\Windows\System\oXnvriT.exe
  2⤵
  PID:5656
- C:\Windows\System\URLqPJO.exe
  C:\Windows\System\URLqPJO.exe
  2⤵
  PID:556
- C:\Windows\System\IkfiJiE.exe
  C:\Windows\System\IkfiJiE.exe
  2⤵
  PID:3428
- C:\Windows\System\DtenzVA.exe
  C:\Windows\System\DtenzVA.exe
  2⤵
  PID:1704
- C:\Windows\System\JWBhQyK.exe
  C:\Windows\System\JWBhQyK.exe
  2⤵
  PID:2352
- C:\Windows\System\UQWoVDG.exe
  C:\Windows\System\UQWoVDG.exe
  2⤵
  PID:5836
- C:\Windows\System\BeVWRjC.exe
  C:\Windows\System\BeVWRjC.exe
  2⤵
  PID:6148
- C:\Windows\System\dibYTgn.exe
  C:\Windows\System\dibYTgn.exe
  2⤵
  PID:6180
- C:\Windows\System\URDJsJh.exe
  C:\Windows\System\URDJsJh.exe
  2⤵
  PID:6204
- C:\Windows\System\iYATQOk.exe
  C:\Windows\System\iYATQOk.exe
  2⤵
  PID:6224
- C:\Windows\System\RHkbLbH.exe
  C:\Windows\System\RHkbLbH.exe
  2⤵
  PID:6244
- C:\Windows\System\BNHsCyN.exe
  C:\Windows\System\BNHsCyN.exe
  2⤵
  PID:6272
- C:\Windows\System\kKFzpOt.exe
  C:\Windows\System\kKFzpOt.exe
  2⤵
  PID:6300
- C:\Windows\System\kccxUpQ.exe
  C:\Windows\System\kccxUpQ.exe
  2⤵
  PID:6316
- C:\Windows\System\CZMkLZe.exe
  C:\Windows\System\CZMkLZe.exe
  2⤵
  PID:6336
- C:\Windows\System\RcwQCdR.exe
  C:\Windows\System\RcwQCdR.exe
  2⤵
  PID:6360
- C:\Windows\System\mJRmjRS.exe
  C:\Windows\System\mJRmjRS.exe
  2⤵
  PID:6416
- C:\Windows\System\PqKaUJc.exe
  C:\Windows\System\PqKaUJc.exe
  2⤵
  PID:6432
- C:\Windows\System\ynRMquH.exe
  C:\Windows\System\ynRMquH.exe
  2⤵
  PID:6460
- C:\Windows\System\sZLudtj.exe
  C:\Windows\System\sZLudtj.exe
  2⤵
  PID:6484
- C:\Windows\System\nIFgSCQ.exe
  C:\Windows\System\nIFgSCQ.exe
  2⤵
  PID:6512
- C:\Windows\System\wSrDYgq.exe
  C:\Windows\System\wSrDYgq.exe
  2⤵
  PID:6564
- C:\Windows\System\lpwQQGi.exe
  C:\Windows\System\lpwQQGi.exe
  2⤵
  PID:6592
- C:\Windows\System\GjlTpOF.exe
  C:\Windows\System\GjlTpOF.exe
  2⤵
  PID:6612
- C:\Windows\System\tQjNboF.exe
  C:\Windows\System\tQjNboF.exe
  2⤵
  PID:6636
- C:\Windows\System\Xudjcin.exe
  C:\Windows\System\Xudjcin.exe
  2⤵
  PID:6688
- C:\Windows\System\dwjOlKP.exe
  C:\Windows\System\dwjOlKP.exe
  2⤵
  PID:6720
- C:\Windows\System\aoJTXiP.exe
  C:\Windows\System\aoJTXiP.exe
  2⤵
  PID:6744
- C:\Windows\System\VDGmXBp.exe
  C:\Windows\System\VDGmXBp.exe
  2⤵
  PID:6772
- C:\Windows\System\jNuhKXA.exe
  C:\Windows\System\jNuhKXA.exe
  2⤵
  PID:6788
- C:\Windows\System\GRHLeNq.exe
  C:\Windows\System\GRHLeNq.exe
  2⤵
  PID:6808
- C:\Windows\System\JyXnCOq.exe
  C:\Windows\System\JyXnCOq.exe
  2⤵
  PID:6828
- C:\Windows\System\koFxxZo.exe
  C:\Windows\System\koFxxZo.exe
  2⤵
  PID:6856
- C:\Windows\System\lKBUwdC.exe
  C:\Windows\System\lKBUwdC.exe
  2⤵
  PID:6900
- C:\Windows\System\ifabSMQ.exe
  C:\Windows\System\ifabSMQ.exe
  2⤵
  PID:6960
- C:\Windows\System\AhpLyhv.exe
  C:\Windows\System\AhpLyhv.exe
  2⤵
  PID:6988
- C:\Windows\System\vImeKDf.exe
  C:\Windows\System\vImeKDf.exe
  2⤵
  PID:7020
- C:\Windows\System\vkAcsYO.exe
  C:\Windows\System\vkAcsYO.exe
  2⤵
  PID:7060
- C:\Windows\System\boKQMvL.exe
  C:\Windows\System\boKQMvL.exe
  2⤵
  PID:7076
- C:\Windows\System\UUyYkSM.exe
  C:\Windows\System\UUyYkSM.exe
  2⤵
  PID:7104
- C:\Windows\System\JyrCDIB.exe
  C:\Windows\System\JyrCDIB.exe
  2⤵
  PID:7124
- C:\Windows\System\Cinpqjt.exe
  C:\Windows\System\Cinpqjt.exe
  2⤵
  PID:7152
- C:\Windows\System\wxPTdXk.exe
  C:\Windows\System\wxPTdXk.exe
  2⤵
  PID:1828
- C:\Windows\System\fAOkKwy.exe
  C:\Windows\System\fAOkKwy.exe
  2⤵
  PID:6056
- C:\Windows\System\UpkgUAX.exe
  C:\Windows\System\UpkgUAX.exe
  2⤵
  PID:6260
- C:\Windows\System\rpskzNX.exe
  C:\Windows\System\rpskzNX.exe
  2⤵
  PID:6348
- C:\Windows\System\VtdhYcP.exe
  C:\Windows\System\VtdhYcP.exe
  2⤵
  PID:6440
- C:\Windows\System\gmYQtfT.exe
  C:\Windows\System\gmYQtfT.exe
  2⤵
  PID:6480
- C:\Windows\System\aAAdCXI.exe
  C:\Windows\System\aAAdCXI.exe
  2⤵
  PID:6476
- C:\Windows\System\TJCiYnV.exe
  C:\Windows\System\TJCiYnV.exe
  2⤵
  PID:6544
- C:\Windows\System\ZdMrthJ.exe
  C:\Windows\System\ZdMrthJ.exe
  2⤵
  PID:6576
- C:\Windows\System\yiNVLiF.exe
  C:\Windows\System\yiNVLiF.exe
  2⤵
  PID:6624
- C:\Windows\System\CVUBCfT.exe
  C:\Windows\System\CVUBCfT.exe
  2⤵
  PID:6736
- C:\Windows\System\VZmvuEx.exe
  C:\Windows\System\VZmvuEx.exe
  2⤵
  PID:6768
- C:\Windows\System\nRYSTFm.exe
  C:\Windows\System\nRYSTFm.exe
  2⤵
  PID:6880
- C:\Windows\System\GfmhwqH.exe
  C:\Windows\System\GfmhwqH.exe
  2⤵
  PID:2160
- C:\Windows\System\mniWYFU.exe
  C:\Windows\System\mniWYFU.exe
  2⤵
  PID:7016
- C:\Windows\System\mILhVwm.exe
  C:\Windows\System\mILhVwm.exe
  2⤵
  PID:7140
- C:\Windows\System\xBrPqaD.exe
  C:\Windows\System\xBrPqaD.exe
  2⤵
  PID:60
- C:\Windows\System\gmjsxTB.exe
  C:\Windows\System\gmjsxTB.exe
  2⤵
  PID:6240
- C:\Windows\System\WbuTdIA.exe
  C:\Windows\System\WbuTdIA.exe
  2⤵
  PID:6324
- C:\Windows\System\KxtAqTV.exe
  C:\Windows\System\KxtAqTV.exe
  2⤵
  PID:6428
- C:\Windows\System\nsKqjgQ.exe
  C:\Windows\System\nsKqjgQ.exe
  2⤵
  PID:6732
- C:\Windows\System\MpPwWJD.exe
  C:\Windows\System\MpPwWJD.exe
  2⤵
  PID:6660
- C:\Windows\System\rgVecxB.exe
  C:\Windows\System\rgVecxB.exe
  2⤵
  PID:6924
- C:\Windows\System\gwkmjDK.exe
  C:\Windows\System\gwkmjDK.exe
  2⤵
  PID:464
- C:\Windows\System\guxYAQi.exe
  C:\Windows\System\guxYAQi.exe
  2⤵
  PID:6952
- C:\Windows\System\mDdkpMp.exe
  C:\Windows\System\mDdkpMp.exe
  2⤵
  PID:6528
- C:\Windows\System\KIugEeJ.exe
  C:\Windows\System\KIugEeJ.exe
  2⤵
  PID:7136
- C:\Windows\System\CnzRqhh.exe
  C:\Windows\System\CnzRqhh.exe
  2⤵
  PID:6764
- C:\Windows\System\oIfqUbz.exe
  C:\Windows\System\oIfqUbz.exe
  2⤵
  PID:7204
- C:\Windows\System\eddCiwO.exe
  C:\Windows\System\eddCiwO.exe
  2⤵
  PID:7244
- C:\Windows\System\GyjdBJh.exe
  C:\Windows\System\GyjdBJh.exe
  2⤵
  PID:7264
- C:\Windows\System\IOtYUaL.exe
  C:\Windows\System\IOtYUaL.exe
  2⤵
  PID:7288
- C:\Windows\System\OSjuWWU.exe
  C:\Windows\System\OSjuWWU.exe
  2⤵
  PID:7316
- C:\Windows\System\DZJsZAO.exe
  C:\Windows\System\DZJsZAO.exe
  2⤵
  PID:7336
- C:\Windows\System\ldkZGDV.exe
  C:\Windows\System\ldkZGDV.exe
  2⤵
  PID:7356
- C:\Windows\System\fuGNOaL.exe
  C:\Windows\System\fuGNOaL.exe
  2⤵
  PID:7384
- C:\Windows\System\YRKlxEm.exe
  C:\Windows\System\YRKlxEm.exe
  2⤵
  PID:7408
- C:\Windows\System\FWrFBPd.exe
  C:\Windows\System\FWrFBPd.exe
  2⤵
  PID:7436
- C:\Windows\System\aIrYPHQ.exe
  C:\Windows\System\aIrYPHQ.exe
  2⤵
  PID:7456
- C:\Windows\System\FnFcZxk.exe
  C:\Windows\System\FnFcZxk.exe
  2⤵
  PID:7484
- C:\Windows\System\ivVktHo.exe
  C:\Windows\System\ivVktHo.exe
  2⤵
  PID:7512
- C:\Windows\System\GIeQWNf.exe
  C:\Windows\System\GIeQWNf.exe
  2⤵
  PID:7536
- C:\Windows\System\dzLgeAI.exe
  C:\Windows\System\dzLgeAI.exe
  2⤵
  PID:7564
- C:\Windows\System\cJrvAde.exe
  C:\Windows\System\cJrvAde.exe
  2⤵
  PID:7592
- C:\Windows\System\JLufxWK.exe
  C:\Windows\System\JLufxWK.exe
  2⤵
  PID:7620
- C:\Windows\System\wENicYZ.exe
  C:\Windows\System\wENicYZ.exe
  2⤵
  PID:7648
- C:\Windows\System\eKzxlyX.exe
  C:\Windows\System\eKzxlyX.exe
  2⤵
  PID:7668
- C:\Windows\System\ouVSNiD.exe
  C:\Windows\System\ouVSNiD.exe
  2⤵
  PID:7688
- C:\Windows\System\HGZQLCR.exe
  C:\Windows\System\HGZQLCR.exe
  2⤵
  PID:7712
- C:\Windows\System\vVSozsQ.exe
  C:\Windows\System\vVSozsQ.exe
  2⤵
  PID:7736
- C:\Windows\System\aptXvul.exe
  C:\Windows\System\aptXvul.exe
  2⤵
  PID:7756
- C:\Windows\System\RPTwdUc.exe
  C:\Windows\System\RPTwdUc.exe
  2⤵
  PID:7856
- C:\Windows\System\piazwNm.exe
  C:\Windows\System\piazwNm.exe
  2⤵
  PID:7884
- C:\Windows\System\rJzlAxm.exe
  C:\Windows\System\rJzlAxm.exe
  2⤵
  PID:7904
- C:\Windows\System\CDLOSsr.exe
  C:\Windows\System\CDLOSsr.exe
  2⤵
  PID:7936
- C:\Windows\System\TXkMfCK.exe
  C:\Windows\System\TXkMfCK.exe
  2⤵
  PID:7964
- C:\Windows\System\BLwfNqq.exe
  C:\Windows\System\BLwfNqq.exe
  2⤵
  PID:8040
- C:\Windows\System\AANojtT.exe
  C:\Windows\System\AANojtT.exe
  2⤵
  PID:8056
- C:\Windows\System\EWkkzHg.exe
  C:\Windows\System\EWkkzHg.exe
  2⤵
  PID:8080
- C:\Windows\System\WBQseYk.exe
  C:\Windows\System\WBQseYk.exe
  2⤵
  PID:8100
- C:\Windows\System\JHXRqCQ.exe
  C:\Windows\System\JHXRqCQ.exe
  2⤵
  PID:8116
- C:\Windows\System\fOivdwr.exe
  C:\Windows\System\fOivdwr.exe
  2⤵
  PID:8144
- C:\Windows\System\HwNtdxY.exe
  C:\Windows\System\HwNtdxY.exe
  2⤵
  PID:8176
- C:\Windows\System\kfJMywm.exe
  C:\Windows\System\kfJMywm.exe
  2⤵
  PID:7196
- C:\Windows\System\ydQOpMA.exe
  C:\Windows\System\ydQOpMA.exe
  2⤵
  PID:7180
- C:\Windows\System\YQgtKBz.exe
  C:\Windows\System\YQgtKBz.exe
  2⤵
  PID:7252
- C:\Windows\System\HWFztMr.exe
  C:\Windows\System\HWFztMr.exe
  2⤵
  PID:6836
- C:\Windows\System\sSmtpmv.exe
  C:\Windows\System\sSmtpmv.exe
  2⤵
  PID:7324
- C:\Windows\System\DVDMIDd.exe
  C:\Windows\System\DVDMIDd.exe
  2⤵
  PID:7380
- C:\Windows\System\AQEUddY.exe
  C:\Windows\System\AQEUddY.exe
  2⤵
  PID:7444
- C:\Windows\System\VyLXChS.exe
  C:\Windows\System\VyLXChS.exe
  2⤵
  PID:7612
- C:\Windows\System\XrzfQKJ.exe
  C:\Windows\System\XrzfQKJ.exe
  2⤵
  PID:7560
- C:\Windows\System\NETUUqq.exe
  C:\Windows\System\NETUUqq.exe
  2⤵
  PID:7728
- C:\Windows\System\ROtfeoz.exe
  C:\Windows\System\ROtfeoz.exe
  2⤵
  PID:7788
- C:\Windows\System\AgqXfdX.exe
  C:\Windows\System\AgqXfdX.exe
  2⤵
  PID:7876
- C:\Windows\System\utHLkPD.exe
  C:\Windows\System\utHLkPD.exe
  2⤵
  PID:7928
- C:\Windows\System\ZJBtcYy.exe
  C:\Windows\System\ZJBtcYy.exe
  2⤵
  PID:8008
- C:\Windows\System\oSpoOLz.exe
  C:\Windows\System\oSpoOLz.exe
  2⤵
  PID:7916
- C:\Windows\System\tuIhswp.exe
  C:\Windows\System\tuIhswp.exe
  2⤵
  PID:8108
- C:\Windows\System\rgXiTJo.exe
  C:\Windows\System\rgXiTJo.exe
  2⤵
  PID:8132
- C:\Windows\System\szVUKLM.exe
  C:\Windows\System\szVUKLM.exe
  2⤵
  PID:4600
- C:\Windows\System\rPbWxho.exe
  C:\Windows\System\rPbWxho.exe
  2⤵
  PID:7220
- C:\Windows\System\RnYlMwL.exe
  C:\Windows\System\RnYlMwL.exe
  2⤵
  PID:7308
- C:\Windows\System\bqGtKoG.exe
  C:\Windows\System\bqGtKoG.exe
  2⤵
  PID:7556
- C:\Windows\System\hyFhOtC.exe
  C:\Windows\System\hyFhOtC.exe
  2⤵
  PID:7708
- C:\Windows\System\hoMJppM.exe
  C:\Windows\System\hoMJppM.exe
  2⤵
  PID:7772
- C:\Windows\System\QGiYZnN.exe
  C:\Windows\System\QGiYZnN.exe
  2⤵
  PID:8052
- C:\Windows\System\cqyCeKl.exe
  C:\Windows\System\cqyCeKl.exe
  2⤵
  PID:6980
- C:\Windows\System\uxzWUic.exe
  C:\Windows\System\uxzWUic.exe
  2⤵
  PID:8188
- C:\Windows\System\bPLlgyA.exe
  C:\Windows\System\bPLlgyA.exe
  2⤵
  PID:7424
- C:\Windows\System\kaAhzfQ.exe
  C:\Windows\System\kaAhzfQ.exe
  2⤵
  PID:7780
- C:\Windows\System\ncwZqyB.exe
  C:\Windows\System\ncwZqyB.exe
  2⤵
  PID:8096
- C:\Windows\System\cSqayMj.exe
  C:\Windows\System\cSqayMj.exe
  2⤵
  PID:7696
- C:\Windows\System\nNrhysZ.exe
  C:\Windows\System\nNrhysZ.exe
  2⤵
  PID:8220
- C:\Windows\System\FdHLxUq.exe
  C:\Windows\System\FdHLxUq.exe
  2⤵
  PID:8240
- C:\Windows\System\GGTRxFJ.exe
  C:\Windows\System\GGTRxFJ.exe
  2⤵
  PID:8308
- C:\Windows\System\ZiCgQNr.exe
  C:\Windows\System\ZiCgQNr.exe
  2⤵
  PID:8344
- C:\Windows\System\bASnUBL.exe
  C:\Windows\System\bASnUBL.exe
  2⤵
  PID:8376
- C:\Windows\System\eoLQWON.exe
  C:\Windows\System\eoLQWON.exe
  2⤵
  PID:8400
- C:\Windows\System\MWzbkSn.exe
  C:\Windows\System\MWzbkSn.exe
  2⤵
  PID:8420
- C:\Windows\System\axduNQW.exe
  C:\Windows\System\axduNQW.exe
  2⤵
  PID:8440
- C:\Windows\System\NrPcmWU.exe
  C:\Windows\System\NrPcmWU.exe
  2⤵
  PID:8484
- C:\Windows\System\PFtTvpK.exe
  C:\Windows\System\PFtTvpK.exe
  2⤵
  PID:8508
- C:\Windows\System\gPJZkHM.exe
  C:\Windows\System\gPJZkHM.exe
  2⤵
  PID:8548
- C:\Windows\System\hIrPIkl.exe
  C:\Windows\System\hIrPIkl.exe
  2⤵
  PID:8576
- C:\Windows\System\jRslbRc.exe
  C:\Windows\System\jRslbRc.exe
  2⤵
  PID:8604
- C:\Windows\System\nyqVszi.exe
  C:\Windows\System\nyqVszi.exe
  2⤵
  PID:8624
- C:\Windows\System\GmhuNHm.exe
  C:\Windows\System\GmhuNHm.exe
  2⤵
  PID:8648
- C:\Windows\System\dMNPdwF.exe
  C:\Windows\System\dMNPdwF.exe
  2⤵
  PID:8672
- C:\Windows\System\IqOOBLw.exe
  C:\Windows\System\IqOOBLw.exe
  2⤵
  PID:8704
- C:\Windows\System\VOnoULf.exe
  C:\Windows\System\VOnoULf.exe
  2⤵
  PID:8748
- C:\Windows\System\hWOFQQD.exe
  C:\Windows\System\hWOFQQD.exe
  2⤵
  PID:8776
- C:\Windows\System\YppUlYA.exe
  C:\Windows\System\YppUlYA.exe
  2⤵
  PID:8796
- C:\Windows\System\NsqyzyP.exe
  C:\Windows\System\NsqyzyP.exe
  2⤵
  PID:8832
- C:\Windows\System\zkdxVhX.exe
  C:\Windows\System\zkdxVhX.exe
  2⤵
  PID:8860
- C:\Windows\System\ozYqwJK.exe
  C:\Windows\System\ozYqwJK.exe
  2⤵
  PID:8876
- C:\Windows\System\EfisQvm.exe
  C:\Windows\System\EfisQvm.exe
  2⤵
  PID:8892
- C:\Windows\System\QPBgVWI.exe
  C:\Windows\System\QPBgVWI.exe
  2⤵
  PID:8916
- C:\Windows\System\fIfiTjf.exe
  C:\Windows\System\fIfiTjf.exe
  2⤵
  PID:8964
- C:\Windows\System\dHhBMoU.exe
  C:\Windows\System\dHhBMoU.exe
  2⤵
  PID:8988
- C:\Windows\System\fhJFtIo.exe
  C:\Windows\System\fhJFtIo.exe
  2⤵
  PID:9008
- C:\Windows\System\qAFIIJd.exe
  C:\Windows\System\qAFIIJd.exe
  2⤵
  PID:9040
- C:\Windows\System\xUiHvOY.exe
  C:\Windows\System\xUiHvOY.exe
  2⤵
  PID:9060
- C:\Windows\System\oHuEtjG.exe
  C:\Windows\System\oHuEtjG.exe
  2⤵
  PID:9112
- C:\Windows\System\PjAirak.exe
  C:\Windows\System\PjAirak.exe
  2⤵
  PID:9140
- C:\Windows\System\yroyBAQ.exe
  C:\Windows\System\yroyBAQ.exe
  2⤵
  PID:9168
- C:\Windows\System\Ekufcqb.exe
  C:\Windows\System\Ekufcqb.exe
  2⤵
  PID:9196
- C:\Windows\System\KknfxjF.exe
  C:\Windows\System\KknfxjF.exe
  2⤵
  PID:9212
- C:\Windows\System\SWgTFVZ.exe
  C:\Windows\System\SWgTFVZ.exe
  2⤵
  PID:8248
- C:\Windows\System\jVcyNaN.exe
  C:\Windows\System\jVcyNaN.exe
  2⤵
  PID:8232
- C:\Windows\System\STXmPhT.exe
  C:\Windows\System\STXmPhT.exe
  2⤵
  PID:8328
- C:\Windows\System\QNjoLuH.exe
  C:\Windows\System\QNjoLuH.exe
  2⤵
  PID:8432
- C:\Windows\System\kBnzJQa.exe
  C:\Windows\System\kBnzJQa.exe
  2⤵
  PID:8460
- C:\Windows\System\JZUNrRE.exe
  C:\Windows\System\JZUNrRE.exe
  2⤵
  PID:8504
- C:\Windows\System\dxsciDp.exe
  C:\Windows\System\dxsciDp.exe
  2⤵
  PID:8592
- C:\Windows\System\bpKaqfY.exe
  C:\Windows\System\bpKaqfY.exe
  2⤵
  PID:8660
- C:\Windows\System\usJRvKw.exe
  C:\Windows\System\usJRvKw.exe
  2⤵
  PID:8684
- C:\Windows\System\vEBPhWX.exe
  C:\Windows\System\vEBPhWX.exe
  2⤵
  PID:8744
- C:\Windows\System\fTSOjdL.exe
  C:\Windows\System\fTSOjdL.exe
  2⤵
  PID:8788
- C:\Windows\System\ZaPpGvS.exe
  C:\Windows\System\ZaPpGvS.exe
  2⤵
  PID:8828
- C:\Windows\System\HkHproo.exe
  C:\Windows\System\HkHproo.exe
  2⤵
  PID:8904
- C:\Windows\System\tVscqtJ.exe
  C:\Windows\System\tVscqtJ.exe
  2⤵
  PID:8984
- C:\Windows\System\JHNvdfr.exe
  C:\Windows\System\JHNvdfr.exe
  2⤵
  PID:9056
- C:\Windows\System\DMpLHPl.exe
  C:\Windows\System\DMpLHPl.exe
  2⤵
  PID:9192
- C:\Windows\System\CkzoWzN.exe
  C:\Windows\System\CkzoWzN.exe
  2⤵
  PID:3628
- C:\Windows\System\lEreCfz.exe
  C:\Windows\System\lEreCfz.exe
  2⤵
  PID:8360
- C:\Windows\System\YwuTNuF.exe
  C:\Windows\System\YwuTNuF.exe
  2⤵
  PID:8480
- C:\Windows\System\JhRYNlg.exe
  C:\Windows\System\JhRYNlg.exe
  2⤵
  PID:8700
- C:\Windows\System\IrqJzzu.exe
  C:\Windows\System\IrqJzzu.exe
  2⤵
  PID:8884
- C:\Windows\System\HCyKHrc.exe
  C:\Windows\System\HCyKHrc.exe
  2⤵
  PID:8912
- C:\Windows\System\zCGJKiF.exe
  C:\Windows\System\zCGJKiF.exe
  2⤵
  PID:9204
- C:\Windows\System\gUlsCbf.exe
  C:\Windows\System\gUlsCbf.exe
  2⤵
  PID:688
- C:\Windows\System\uivtYzz.exe
  C:\Windows\System\uivtYzz.exe
  2⤵
  PID:8560
- C:\Windows\System\WIIUPzg.exe
  C:\Windows\System\WIIUPzg.exe
  2⤵
  PID:8760
- C:\Windows\System\dbSqQXZ.exe
  C:\Windows\System\dbSqQXZ.exe
  2⤵
  PID:9016
- C:\Windows\System\djYESHT.exe
  C:\Windows\System\djYESHT.exe
  2⤵
  PID:8352
- C:\Windows\System\pnGYxjL.exe
  C:\Windows\System\pnGYxjL.exe
  2⤵
  PID:9252
- C:\Windows\System\oorMZDK.exe
  C:\Windows\System\oorMZDK.exe
  2⤵
  PID:9268
- C:\Windows\System\PtegOPA.exe
  C:\Windows\System\PtegOPA.exe
  2⤵
  PID:9296
- C:\Windows\System\wrmihQW.exe
  C:\Windows\System\wrmihQW.exe
  2⤵
  PID:9320
- C:\Windows\System\ngYoyAb.exe
  C:\Windows\System\ngYoyAb.exe
  2⤵
  PID:9356
- C:\Windows\System\dwihzVJ.exe
  C:\Windows\System\dwihzVJ.exe
  2⤵
  PID:9380
- C:\Windows\System\niIzQeU.exe
  C:\Windows\System\niIzQeU.exe
  2⤵
  PID:9404
- C:\Windows\System\DfIMWNs.exe
  C:\Windows\System\DfIMWNs.exe
  2⤵
  PID:9436
- C:\Windows\System\vFFnENM.exe
  C:\Windows\System\vFFnENM.exe
  2⤵
  PID:9456
- C:\Windows\System\icorhvC.exe
  C:\Windows\System\icorhvC.exe
  2⤵
  PID:9488
- C:\Windows\System\vrOiHOK.exe
  C:\Windows\System\vrOiHOK.exe
  2⤵
  PID:9520
- C:\Windows\System\eHHAxiC.exe
  C:\Windows\System\eHHAxiC.exe
  2⤵
  PID:9544
- C:\Windows\System\BksZHgI.exe
  C:\Windows\System\BksZHgI.exe
  2⤵
  PID:9592
- C:\Windows\System\qTcZsgP.exe
  C:\Windows\System\qTcZsgP.exe
  2⤵
  PID:9608
- C:\Windows\System\KcaiYTg.exe
  C:\Windows\System\KcaiYTg.exe
  2⤵
  PID:9636
- C:\Windows\System\WgnnBbk.exe
  C:\Windows\System\WgnnBbk.exe
  2⤵
  PID:9684
- C:\Windows\System\pBCbYjv.exe
  C:\Windows\System\pBCbYjv.exe
  2⤵
  PID:9700
- C:\Windows\System\LqUbQgq.exe
  C:\Windows\System\LqUbQgq.exe
  2⤵
  PID:9716
- C:\Windows\System\XUlCbwM.exe
  C:\Windows\System\XUlCbwM.exe
  2⤵
  PID:9740
- C:\Windows\System\Gdkldzi.exe
  C:\Windows\System\Gdkldzi.exe
  2⤵
  PID:9796
- C:\Windows\System\GDAzsnw.exe
  C:\Windows\System\GDAzsnw.exe
  2⤵
  PID:9820
- C:\Windows\System\CkdwoMH.exe
  C:\Windows\System\CkdwoMH.exe
  2⤵
  PID:9844
- C:\Windows\System\kyCDyeF.exe
  C:\Windows\System\kyCDyeF.exe
  2⤵
  PID:9876
- C:\Windows\System\WZvubGk.exe
  C:\Windows\System\WZvubGk.exe
  2⤵
  PID:9908
- C:\Windows\System\LUoaqGI.exe
  C:\Windows\System\LUoaqGI.exe
  2⤵
  PID:9928
- C:\Windows\System\xFDbkIq.exe
  C:\Windows\System\xFDbkIq.exe
  2⤵
  PID:9956
- C:\Windows\System\lvnAwJU.exe
  C:\Windows\System\lvnAwJU.exe
  2⤵
  PID:9976
- C:\Windows\System\QqCbcMB.exe
  C:\Windows\System\QqCbcMB.exe
  2⤵
  PID:10016
- C:\Windows\System\uhpqtZk.exe
  C:\Windows\System\uhpqtZk.exe
  2⤵
  PID:10032
- C:\Windows\System\rCkGRwv.exe
  C:\Windows\System\rCkGRwv.exe
  2⤵
  PID:10056
- C:\Windows\System\LhNaNiz.exe
  C:\Windows\System\LhNaNiz.exe
  2⤵
  PID:10084
- C:\Windows\System\LuDqDiK.exe
  C:\Windows\System\LuDqDiK.exe
  2⤵
  PID:10120
- C:\Windows\System\dOfLCjz.exe
  C:\Windows\System\dOfLCjz.exe
  2⤵
  PID:10140
- C:\Windows\System\dXSRjBx.exe
  C:\Windows\System\dXSRjBx.exe
  2⤵
  PID:10172
- C:\Windows\System\fdHvnXM.exe
  C:\Windows\System\fdHvnXM.exe
  2⤵
  PID:10204
- C:\Windows\System\cETTJMM.exe
  C:\Windows\System\cETTJMM.exe
  2⤵
  PID:10224
- C:\Windows\System\UlQDqZb.exe
  C:\Windows\System\UlQDqZb.exe
  2⤵
  PID:8524
- C:\Windows\System\gYolAGw.exe
  C:\Windows\System\gYolAGw.exe
  2⤵
  PID:9332
- C:\Windows\System\xfmFkcZ.exe
  C:\Windows\System\xfmFkcZ.exe
  2⤵
  PID:9372
- C:\Windows\System\PVrmdZt.exe
  C:\Windows\System\PVrmdZt.exe
  2⤵
  PID:9368
- C:\Windows\System\mRLjVrK.exe
  C:\Windows\System\mRLjVrK.exe
  2⤵
  PID:9480
- C:\Windows\System\FOmSLHE.exe
  C:\Windows\System\FOmSLHE.exe
  2⤵
  PID:9556
- C:\Windows\System\EChYmcd.exe
  C:\Windows\System\EChYmcd.exe
  2⤵
  PID:9600
- C:\Windows\System\MTuIGVS.exe
  C:\Windows\System\MTuIGVS.exe
  2⤵
  PID:9628
- C:\Windows\System\mDRvXqv.exe
  C:\Windows\System\mDRvXqv.exe
  2⤵
  PID:9760
- C:\Windows\System\rDPTAHM.exe
  C:\Windows\System\rDPTAHM.exe
  2⤵
  PID:9840
- C:\Windows\System\dJSxQmG.exe
  C:\Windows\System\dJSxQmG.exe
  2⤵
  PID:9872
- C:\Windows\System\CWmZBlD.exe
  C:\Windows\System\CWmZBlD.exe
  2⤵
  PID:9972
- C:\Windows\System\tTeukCO.exe
  C:\Windows\System\tTeukCO.exe
  2⤵
  PID:10000
- C:\Windows\System\yoJFxMb.exe
  C:\Windows\System\yoJFxMb.exe
  2⤵
  PID:10052
- C:\Windows\System\nJZwKmC.exe
  C:\Windows\System\nJZwKmC.exe
  2⤵
  PID:10092
- C:\Windows\System\pPwNtzm.exe
  C:\Windows\System\pPwNtzm.exe
  2⤵
  PID:10192
- C:\Windows\System\KmQSyME.exe
  C:\Windows\System\KmQSyME.exe
  2⤵
  PID:9004
- C:\Windows\System\BXdoCBH.exe
  C:\Windows\System\BXdoCBH.exe
  2⤵
  PID:9392
- C:\Windows\System\zMuBclK.exe
  C:\Windows\System\zMuBclK.exe
  2⤵
  PID:9500
- C:\Windows\System\uaYBgZf.exe
  C:\Windows\System\uaYBgZf.exe
  2⤵
  PID:9648
- C:\Windows\System\HLQJOLu.exe
  C:\Windows\System\HLQJOLu.exe
  2⤵
  PID:9788
- C:\Windows\System\AwlzzSf.exe
  C:\Windows\System\AwlzzSf.exe
  2⤵
  PID:9916
- C:\Windows\System\szyNrkb.exe
  C:\Windows\System\szyNrkb.exe
  2⤵
  PID:4552
- C:\Windows\System\AhdOBOQ.exe
  C:\Windows\System\AhdOBOQ.exe
  2⤵
  PID:9424
- C:\Windows\System\FpvARYU.exe
  C:\Windows\System\FpvARYU.exe
  2⤵
  PID:9452
- C:\Windows\System\brQyyUO.exe
  C:\Windows\System\brQyyUO.exe
  2⤵
  PID:9660
- C:\Windows\System\eFmLDQy.exe
  C:\Windows\System\eFmLDQy.exe
  2⤵
  PID:9924
- C:\Windows\System\aszFXYF.exe
  C:\Windows\System\aszFXYF.exe
  2⤵
  PID:9316
- C:\Windows\System\VQbdHPl.exe
  C:\Windows\System\VQbdHPl.exe
  2⤵
  PID:10244
- C:\Windows\System\pGkUOLi.exe
  C:\Windows\System\pGkUOLi.exe
  2⤵
  PID:10268
- C:\Windows\System\HXorLuM.exe
  C:\Windows\System\HXorLuM.exe
  2⤵
  PID:10296
- C:\Windows\System\KXeduae.exe
  C:\Windows\System\KXeduae.exe
  2⤵
  PID:10316
- C:\Windows\System\SgFnYmr.exe
  C:\Windows\System\SgFnYmr.exe
  2⤵
  PID:10340
- C:\Windows\System\iOqJzuV.exe
  C:\Windows\System\iOqJzuV.exe
  2⤵
  PID:10368
- C:\Windows\System\AUavkUu.exe
  C:\Windows\System\AUavkUu.exe
  2⤵
  PID:10432
- C:\Windows\System\gOcHYtz.exe
  C:\Windows\System\gOcHYtz.exe
  2⤵
  PID:10452
- C:\Windows\System\VpiChwm.exe
  C:\Windows\System\VpiChwm.exe
  2⤵
  PID:10480
- C:\Windows\System\epyvSdz.exe
  C:\Windows\System\epyvSdz.exe
  2⤵
  PID:10500
- C:\Windows\System\dvvLjrP.exe
  C:\Windows\System\dvvLjrP.exe
  2⤵
  PID:10560
- C:\Windows\System\YmlXADQ.exe
  C:\Windows\System\YmlXADQ.exe
  2⤵
  PID:10588
- C:\Windows\System\MptpSIc.exe
  C:\Windows\System\MptpSIc.exe
  2⤵
  PID:10616
- C:\Windows\System\mssoxrC.exe
  C:\Windows\System\mssoxrC.exe
  2⤵
  PID:10636
- C:\Windows\System\ciHXKas.exe
  C:\Windows\System\ciHXKas.exe
  2⤵
  PID:10664
- C:\Windows\System\ksgnqoj.exe
  C:\Windows\System\ksgnqoj.exe
  2⤵
  PID:10700
- C:\Windows\System\qiXNULx.exe
  C:\Windows\System\qiXNULx.exe
  2⤵
  PID:10728
- C:\Windows\System\SnfchaP.exe
  C:\Windows\System\SnfchaP.exe
  2⤵
  PID:10748
- C:\Windows\System\GvLyStV.exe
  C:\Windows\System\GvLyStV.exe
  2⤵
  PID:10776
- C:\Windows\System\HdURIIk.exe
  C:\Windows\System\HdURIIk.exe
  2⤵
  PID:10800
- C:\Windows\System\TWfpypR.exe
  C:\Windows\System\TWfpypR.exe
  2⤵
  PID:10820
- C:\Windows\System\xWTEkZc.exe
  C:\Windows\System\xWTEkZc.exe
  2⤵
  PID:10836
- C:\Windows\System\pgMKUYa.exe
  C:\Windows\System\pgMKUYa.exe
  2⤵
  PID:10860
- C:\Windows\System\xghdTCk.exe
  C:\Windows\System\xghdTCk.exe
  2⤵
  PID:10912
- C:\Windows\System\SISYqWy.exe
  C:\Windows\System\SISYqWy.exe
  2⤵
  PID:10932
- C:\Windows\System\jPDbxsD.exe
  C:\Windows\System\jPDbxsD.exe
  2⤵
  PID:10956
- C:\Windows\System\lTyktHC.exe
  C:\Windows\System\lTyktHC.exe
  2⤵
  PID:10976
- C:\Windows\System\upplidm.exe
  C:\Windows\System\upplidm.exe
  2⤵
  PID:11012
- C:\Windows\System\HqxWKeJ.exe
  C:\Windows\System\HqxWKeJ.exe
  2⤵
  PID:11052
- C:\Windows\System\xSRriDL.exe
  C:\Windows\System\xSRriDL.exe
  2⤵
  PID:11084
- C:\Windows\System\kGeqJQW.exe
  C:\Windows\System\kGeqJQW.exe
  2⤵
  PID:11112
- C:\Windows\System\hsAWagk.exe
  C:\Windows\System\hsAWagk.exe
  2⤵
  PID:11136
- C:\Windows\System\HgPGyOR.exe
  C:\Windows\System\HgPGyOR.exe
  2⤵
  PID:11156
- C:\Windows\System\QwZdfwh.exe
  C:\Windows\System\QwZdfwh.exe
  2⤵
  PID:11180
- C:\Windows\System\EDSiCQO.exe
  C:\Windows\System\EDSiCQO.exe
  2⤵
  PID:11228
- C:\Windows\System\movUICG.exe
  C:\Windows\System\movUICG.exe
  2⤵
  PID:11252
- C:\Windows\System\wleRGBb.exe
  C:\Windows\System\wleRGBb.exe
  2⤵
  PID:10260
- C:\Windows\System\nRnLILY.exe
  C:\Windows\System\nRnLILY.exe
  2⤵
  PID:10280
- C:\Windows\System\MOTlXlD.exe
  C:\Windows\System\MOTlXlD.exe
  2⤵
  PID:10308
- C:\Windows\System\HnizEso.exe
  C:\Windows\System\HnizEso.exe
  2⤵
  PID:8724
- C:\Windows\System\VAJnXvN.exe
  C:\Windows\System\VAJnXvN.exe
  2⤵
  PID:10496
- C:\Windows\System\GWBUmeb.exe
  C:\Windows\System\GWBUmeb.exe
  2⤵
  PID:10584
- C:\Windows\System\xFcPaIf.exe
  C:\Windows\System\xFcPaIf.exe
  2⤵
  PID:10652
- C:\Windows\System\IALAwEQ.exe
  C:\Windows\System\IALAwEQ.exe
  2⤵
  PID:10720
- C:\Windows\System\wqVpSqw.exe
  C:\Windows\System\wqVpSqw.exe
  2⤵
  PID:10768
- C:\Windows\System\RsxUjge.exe
  C:\Windows\System\RsxUjge.exe
  2⤵
  PID:10812
- C:\Windows\System\cTsJrNN.exe
  C:\Windows\System\cTsJrNN.exe
  2⤵
  PID:10828
- C:\Windows\System\RWkxokM.exe
  C:\Windows\System\RWkxokM.exe
  2⤵
  PID:10908
- C:\Windows\System\rdKPLqf.exe
  C:\Windows\System\rdKPLqf.exe
  2⤵
  PID:11008
- C:\Windows\System\jqjXtdA.exe
  C:\Windows\System\jqjXtdA.exe
  2⤵
  PID:11128
- C:\Windows\System\IxwsPca.exe
  C:\Windows\System\IxwsPca.exe
  2⤵
  PID:11152
- C:\Windows\System\aWIsFlR.exe
  C:\Windows\System\aWIsFlR.exe
  2⤵
  PID:11216
- C:\Windows\System\jyEHncD.exe
  C:\Windows\System\jyEHncD.exe
  2⤵
  PID:10080
- C:\Windows\System\asruSKs.exe
  C:\Windows\System\asruSKs.exe
  2⤵
  PID:10400
- C:\Windows\System\CjepmOj.exe
  C:\Windows\System\CjepmOj.exe
  2⤵
  PID:10444
- C:\Windows\System\FsWysRP.exe
  C:\Windows\System\FsWysRP.exe
  2⤵
  PID:10604
- C:\Windows\System\mrrpfAe.exe
  C:\Windows\System\mrrpfAe.exe
  2⤵
  PID:10792
- C:\Windows\System\aiNdZaW.exe
  C:\Windows\System\aiNdZaW.exe
  2⤵
  PID:10944
- C:\Windows\System\cGIvwJd.exe
  C:\Windows\System\cGIvwJd.exe
  2⤵
  PID:11044
- C:\Windows\System\VemIOGo.exe
  C:\Windows\System\VemIOGo.exe
  2⤵
  PID:11204
- C:\Windows\System\RxOBtNd.exe
  C:\Windows\System\RxOBtNd.exe
  2⤵
  PID:10672
- C:\Windows\System\XnoCGNs.exe
  C:\Windows\System\XnoCGNs.exe
  2⤵
  PID:10884
- C:\Windows\System\MBshUKa.exe
  C:\Windows\System\MBshUKa.exe
  2⤵
  PID:11200
- C:\Windows\System\pyeBkwJ.exe
  C:\Windows\System\pyeBkwJ.exe
  2⤵
  PID:11276
- C:\Windows\System\pQJwTZv.exe
  C:\Windows\System\pQJwTZv.exe
  2⤵
  PID:11312
- C:\Windows\System\HEqxNwS.exe
  C:\Windows\System\HEqxNwS.exe
  2⤵
  PID:11348
- C:\Windows\System\NqlywkQ.exe
  C:\Windows\System\NqlywkQ.exe
  2⤵
  PID:11364
- C:\Windows\System\srjgCdK.exe
  C:\Windows\System\srjgCdK.exe
  2⤵
  PID:11388
- C:\Windows\System\jdNZHIp.exe
  C:\Windows\System\jdNZHIp.exe
  2⤵
  PID:11432
- C:\Windows\System\AtUYKyu.exe
  C:\Windows\System\AtUYKyu.exe
  2⤵
  PID:11460
- C:\Windows\System\pWVMKzf.exe
  C:\Windows\System\pWVMKzf.exe
  2⤵
  PID:11492
- C:\Windows\System\vrGJXAm.exe
  C:\Windows\System\vrGJXAm.exe
  2⤵
  PID:11516
- C:\Windows\System\UwEModX.exe
  C:\Windows\System\UwEModX.exe
  2⤵
  PID:11556
- C:\Windows\System\LKaryKv.exe
  C:\Windows\System\LKaryKv.exe
  2⤵
  PID:11572
- C:\Windows\System\BEOPrLJ.exe
  C:\Windows\System\BEOPrLJ.exe
  2⤵
  PID:11612
- C:\Windows\System\nBpLqtZ.exe
  C:\Windows\System\nBpLqtZ.exe
  2⤵
  PID:11640
- C:\Windows\System\dfkbtcM.exe
  C:\Windows\System\dfkbtcM.exe
  2⤵
  PID:11656
- C:\Windows\System\dpwhfiL.exe
  C:\Windows\System\dpwhfiL.exe
  2⤵
  PID:11684
- C:\Windows\System\bMuOrpA.exe
  C:\Windows\System\bMuOrpA.exe
  2⤵
  PID:11704
- C:\Windows\System\MZMWHcn.exe
  C:\Windows\System\MZMWHcn.exe
  2⤵
  PID:11732
- C:\Windows\System\yqqOOSR.exe
  C:\Windows\System\yqqOOSR.exe
  2⤵
  PID:11756
- C:\Windows\System\yHzZBaU.exe
  C:\Windows\System\yHzZBaU.exe
  2⤵
  PID:11780
- C:\Windows\System\kQMpdZk.exe
  C:\Windows\System\kQMpdZk.exe
  2⤵
  PID:11832
- C:\Windows\System\YDUCxyx.exe
  C:\Windows\System\YDUCxyx.exe
  2⤵
  PID:11864
- C:\Windows\System\WyBxRbP.exe
  C:\Windows\System\WyBxRbP.exe
  2⤵
  PID:11892
- C:\Windows\System\SSIalyK.exe
  C:\Windows\System\SSIalyK.exe
  2⤵
  PID:11912
- C:\Windows\System\fRsONcG.exe
  C:\Windows\System\fRsONcG.exe
  2⤵
  PID:11936
- C:\Windows\System\nRfTSSZ.exe
  C:\Windows\System\nRfTSSZ.exe
  2⤵
  PID:11976
- C:\Windows\System\hACHBgq.exe
  C:\Windows\System\hACHBgq.exe
  2⤵
  PID:12000
- C:\Windows\System\dQXTwpT.exe
  C:\Windows\System\dQXTwpT.exe
  2⤵
  PID:12016
- C:\Windows\System\khwgrUN.exe
  C:\Windows\System\khwgrUN.exe
  2⤵
  PID:12048
- C:\Windows\System\tMpsykC.exe
  C:\Windows\System\tMpsykC.exe
  2⤵
  PID:12076
- C:\Windows\System\rpLdGiY.exe
  C:\Windows\System\rpLdGiY.exe
  2⤵
  PID:12092
- C:\Windows\System\ZHKnkic.exe
  C:\Windows\System\ZHKnkic.exe
  2⤵
  PID:12116
- C:\Windows\System\GDEebnX.exe
  C:\Windows\System\GDEebnX.exe
  2⤵
  PID:12136
- C:\Windows\System\ZPshNDK.exe
  C:\Windows\System\ZPshNDK.exe
  2⤵
  PID:12156
- C:\Windows\System\aKTpRTr.exe
  C:\Windows\System\aKTpRTr.exe
  2⤵
  PID:12224
- C:\Windows\System\EIKaBcU.exe
  C:\Windows\System\EIKaBcU.exe
  2⤵
  PID:12248
- C:\Windows\System\zHpXJUa.exe
  C:\Windows\System\zHpXJUa.exe
  2⤵
  PID:12272
- C:\Windows\System\RAhlRSi.exe
  C:\Windows\System\RAhlRSi.exe
  2⤵
  PID:10448
- C:\Windows\System\bfIWzVf.exe
  C:\Windows\System\bfIWzVf.exe
  2⤵
  PID:11268
- C:\Windows\System\drpnvCF.exe
  C:\Windows\System\drpnvCF.exe
  2⤵
  PID:11344
- C:\Windows\System\AKsuUTD.exe
  C:\Windows\System\AKsuUTD.exe
  2⤵
  PID:11468
- C:\Windows\System\FqRWCLM.exe
  C:\Windows\System\FqRWCLM.exe
  2⤵
  PID:11480
- C:\Windows\System\jvAdTEc.exe
  C:\Windows\System\jvAdTEc.exe
  2⤵
  PID:11532
- C:\Windows\System\HrJjifA.exe
  C:\Windows\System\HrJjifA.exe
  2⤵
  PID:11596
- C:\Windows\System\wprMiNp.exe
  C:\Windows\System\wprMiNp.exe
  2⤵
  PID:11672
- C:\Windows\System\ZxVwFWU.exe
  C:\Windows\System\ZxVwFWU.exe
  2⤵
  PID:11716
- C:\Windows\System\kQVxNJp.exe
  C:\Windows\System\kQVxNJp.exe
  2⤵
  PID:11812
- C:\Windows\System\AfRxbMJ.exe
  C:\Windows\System\AfRxbMJ.exe
  2⤵
  PID:11876
- C:\Windows\System\OFfSlme.exe
  C:\Windows\System\OFfSlme.exe
  2⤵
  PID:11932
- C:\Windows\System\CRGXDyH.exe
  C:\Windows\System\CRGXDyH.exe
  2⤵
  PID:11992
- C:\Windows\System\agLRZDn.exe
  C:\Windows\System\agLRZDn.exe
  2⤵
  PID:12060
- C:\Windows\System\hcBkwAQ.exe
  C:\Windows\System\hcBkwAQ.exe
  2⤵
  PID:12124
- C:\Windows\System\ynrOIzY.exe
  C:\Windows\System\ynrOIzY.exe
  2⤵
  PID:12164
- C:\Windows\System\LMBsAEc.exe
  C:\Windows\System\LMBsAEc.exe
  2⤵
  PID:12216
- C:\Windows\System\ArkfAzY.exe
  C:\Windows\System\ArkfAzY.exe
  2⤵
  PID:12280
- C:\Windows\System\CfsKPWT.exe
  C:\Windows\System\CfsKPWT.exe
  2⤵
  PID:10948
- C:\Windows\System\aeEFVte.exe
  C:\Windows\System\aeEFVte.exe
  2⤵
  PID:11512
- C:\Windows\System\BUjNbJd.exe
  C:\Windows\System\BUjNbJd.exe
  2⤵
  PID:11768
- C:\Windows\System\OHjjDPU.exe
  C:\Windows\System\OHjjDPU.exe
  2⤵
  PID:11908
- C:\Windows\System\sDeopFD.exe
  C:\Windows\System\sDeopFD.exe
  2⤵
  PID:12148
- C:\Windows\System\dbmPSzt.exe
  C:\Windows\System\dbmPSzt.exe
  2⤵
  PID:12212
- C:\Windows\System\prlfVLr.exe
  C:\Windows\System\prlfVLr.exe
  2⤵
  PID:11380
- C:\Windows\System\kXYpxJA.exe
  C:\Windows\System\kXYpxJA.exe
  2⤵
  PID:11720
- C:\Windows\System\IxCdZZP.exe
  C:\Windows\System\IxCdZZP.exe
  2⤵
  PID:12024
- C:\Windows\System\OGeEHOB.exe
  C:\Windows\System\OGeEHOB.exe
  2⤵
  PID:12088
- C:\Windows\System\GKfgpYC.exe
  C:\Windows\System\GKfgpYC.exe
  2⤵
  PID:12312
- C:\Windows\System\aktzZcs.exe
  C:\Windows\System\aktzZcs.exe
  2⤵
  PID:12336
- C:\Windows\System\cSFOOgx.exe
  C:\Windows\System\cSFOOgx.exe
  2⤵
  PID:12384
- C:\Windows\System\ZXVqZaq.exe
  C:\Windows\System\ZXVqZaq.exe
  2⤵
  PID:12432
- C:\Windows\System\jyZjUeU.exe
  C:\Windows\System\jyZjUeU.exe
  2⤵
  PID:12452
- C:\Windows\System\zkkJKRV.exe
  C:\Windows\System\zkkJKRV.exe
  2⤵
  PID:12472
- C:\Windows\System\NWuCWdf.exe
  C:\Windows\System\NWuCWdf.exe
  2⤵
  PID:12504
- C:\Windows\System\frdxOUX.exe
  C:\Windows\System\frdxOUX.exe
  2⤵
  PID:12524
- C:\Windows\System\RlUuumX.exe
  C:\Windows\System\RlUuumX.exe
  2⤵
  PID:12544
- C:\Windows\System\OLHYRcr.exe
  C:\Windows\System\OLHYRcr.exe
  2⤵
  PID:12568
- C:\Windows\System\wiGczXu.exe
  C:\Windows\System\wiGczXu.exe
  2⤵
  PID:12612
- C:\Windows\System\LbgVAgA.exe
  C:\Windows\System\LbgVAgA.exe
  2⤵
  PID:12632
- C:\Windows\System\dMpfpVN.exe
  C:\Windows\System\dMpfpVN.exe
  2⤵
  PID:12660
- C:\Windows\System\QkjxtLK.exe
  C:\Windows\System\QkjxtLK.exe
  2⤵
  PID:12692
- C:\Windows\System\eRSEwIZ.exe
  C:\Windows\System\eRSEwIZ.exe
  2⤵
  PID:12724
- C:\Windows\System\ipdFSDn.exe
  C:\Windows\System\ipdFSDn.exe
  2⤵
  PID:12748
- C:\Windows\System\zQfXPws.exe
  C:\Windows\System\zQfXPws.exe
  2⤵
  PID:12800
- C:\Windows\System\GONFzep.exe
  C:\Windows\System\GONFzep.exe
  2⤵
  PID:12820
- C:\Windows\System\BXRUWQP.exe
  C:\Windows\System\BXRUWQP.exe
  2⤵
  PID:12848
- C:\Windows\System\zeESMRA.exe
  C:\Windows\System\zeESMRA.exe
  2⤵
  PID:12884
- C:\Windows\System\eOWwhSF.exe
  C:\Windows\System\eOWwhSF.exe
  2⤵
  PID:12912
- C:\Windows\System\XhKcLcz.exe
  C:\Windows\System\XhKcLcz.exe
  2⤵
  PID:12928
- C:\Windows\System\lnRwxmd.exe
  C:\Windows\System\lnRwxmd.exe
  2⤵
  PID:12956
- C:\Windows\System\YugeDJZ.exe
  C:\Windows\System\YugeDJZ.exe
  2⤵
  PID:12980
- C:\Windows\System\TMMnaKj.exe
  C:\Windows\System\TMMnaKj.exe
  2⤵
  PID:13004
- C:\Windows\System\AoOvlEe.exe
  C:\Windows\System\AoOvlEe.exe
  2⤵
  PID:13032
- C:\Windows\System\zdpIZkC.exe
  C:\Windows\System\zdpIZkC.exe
  2⤵
  PID:13052
- C:\Windows\System\hMxuIhK.exe
  C:\Windows\System\hMxuIhK.exe
  2⤵
  PID:13076
- C:\Windows\System\LvmzQAN.exe
  C:\Windows\System\LvmzQAN.exe
  2⤵
  PID:13100
- C:\Windows\System\omMeTav.exe
  C:\Windows\System\omMeTav.exe
  2⤵
  PID:13152
- C:\Windows\System\ASSlZgG.exe
  C:\Windows\System\ASSlZgG.exe
  2⤵
  PID:13180
- C:\Windows\System\kHiHXwA.exe
  C:\Windows\System\kHiHXwA.exe
  2⤵
  PID:13196
- C:\Windows\System\zbvHYgJ.exe
  C:\Windows\System\zbvHYgJ.exe
  2⤵
  PID:13220
- C:\Windows\System\cclIyhb.exe
  C:\Windows\System\cclIyhb.exe
  2⤵
  PID:13264
- C:\Windows\System\kXAMhqv.exe
  C:\Windows\System\kXAMhqv.exe
  2⤵
  PID:13280
- C:\Windows\System\UFTDccW.exe
  C:\Windows\System\UFTDccW.exe
  2⤵
  PID:13308
- C:\Windows\System\HrIHsTm.exe
  C:\Windows\System\HrIHsTm.exe
  2⤵
  PID:11400
- C:\Windows\System\nbsKscx.exe
  C:\Windows\System\nbsKscx.exe
  2⤵
  PID:12300
- C:\Windows\System\Ejymvyw.exe
  C:\Windows\System\Ejymvyw.exe
  2⤵
  PID:12352
- C:\Windows\System\LVXIDDv.exe
  C:\Windows\System\LVXIDDv.exe
  2⤵
  PID:12484
- C:\Windows\System\OHGEVhi.exe
  C:\Windows\System\OHGEVhi.exe
  2⤵
  PID:12604
- C:\Windows\System\tWASFUN.exe
  C:\Windows\System\tWASFUN.exe
  2⤵
  PID:12628
- C:\Windows\System\DKSeZSF.exe
  C:\Windows\System\DKSeZSF.exe
  2⤵
  PID:12736
- C:\Windows\System\lnJHHZh.exe
  C:\Windows\System\lnJHHZh.exe
  2⤵
  PID:12764
- C:\Windows\System\ZVJwrFo.exe
  C:\Windows\System\ZVJwrFo.exe
  2⤵
  PID:12788
- C:\Windows\System\yvvrJoI.exe
  C:\Windows\System\yvvrJoI.exe
  2⤵
  PID:12828
- C:\Windows\System\fHRIGMB.exe
  C:\Windows\System\fHRIGMB.exe
  2⤵
  PID:12972
- C:\Windows\System\pynvNUa.exe
  C:\Windows\System\pynvNUa.exe
  2⤵
  PID:13044
- C:\Windows\System\qULThLi.exe
  C:\Windows\System\qULThLi.exe
  2⤵
  PID:13060
- C:\Windows\System\wVFIIer.exe
  C:\Windows\System\wVFIIer.exe
  2⤵
  PID:13092
- C:\Windows\System\fehnEZD.exe
  C:\Windows\System\fehnEZD.exe
  2⤵
  PID:13160
- C:\Windows\System\nGMHBgG.exe
  C:\Windows\System\nGMHBgG.exe
  2⤵
  PID:13216
- C:\Windows\System\JPjoEBW.exe
  C:\Windows\System\JPjoEBW.exe
  2⤵
  PID:12284
- C:\Windows\System\OuWlEKe.exe
  C:\Windows\System\OuWlEKe.exe
  2⤵
  PID:12328
- C:\Windows\System\BrsMAuD.exe
  C:\Windows\System\BrsMAuD.exe
  2⤵
  PID:12532
- C:\Windows\System\JlbpDNx.exe
  C:\Windows\System\JlbpDNx.exe
  2⤵
  PID:12620
- C:\Windows\System\RRIufQX.exe
  C:\Windows\System\RRIufQX.exe
  2⤵
  PID:12776
- C:\Windows\System\pbApAwp.exe
  C:\Windows\System\pbApAwp.exe
  2⤵
  PID:13016
- C:\Windows\System\mDEYrxg.exe
  C:\Windows\System\mDEYrxg.exe
  2⤵
  PID:13128
- C:\Windows\System\VFrnzzK.exe
  C:\Windows\System\VFrnzzK.exe
  2⤵
  PID:13188
- C:\Windows\System\mXcLCvO.exe
  C:\Windows\System\mXcLCvO.exe
  2⤵
  PID:13296
- C:\Windows\System\ofdTyxI.exe
  C:\Windows\System\ofdTyxI.exe
  2⤵
  PID:12540
- C:\Windows\System\EVYrYBg.exe
  C:\Windows\System\EVYrYBg.exe
  2⤵
  PID:12952
- C:\Windows\System\zyRnQII.exe
  C:\Windows\System\zyRnQII.exe
  2⤵
  PID:13332
- C:\Windows\System\dLjxKjI.exe
  C:\Windows\System\dLjxKjI.exe
  2⤵
  PID:13356
- C:\Windows\System\qQRThtA.exe
  C:\Windows\System\qQRThtA.exe
  2⤵
  PID:13412
- C:\Windows\System\OjtgtNq.exe
  C:\Windows\System\OjtgtNq.exe
  2⤵
  PID:13432
- C:\Windows\System\XaJWDQN.exe
  C:\Windows\System\XaJWDQN.exe
  2⤵
  PID:13460
- C:\Windows\System\xBZHMMm.exe
  C:\Windows\System\xBZHMMm.exe
  2⤵
  PID:13484
- C:\Windows\System\VwyQsaF.exe
  C:\Windows\System\VwyQsaF.exe
  2⤵
  PID:13504
- C:\Windows\System\bhrayEK.exe
  C:\Windows\System\bhrayEK.exe
  2⤵
  PID:13520
- C:\Windows\System\kcGHUjH.exe
  C:\Windows\System\kcGHUjH.exe
  2⤵
  PID:13548
- C:\Windows\System\sxBFUld.exe
  C:\Windows\System\sxBFUld.exe
  2⤵
  PID:13572
- C:\Windows\System\MNAEEoC.exe
  C:\Windows\System\MNAEEoC.exe
  2⤵
  PID:13620
- C:\Windows\System\hRUaHjl.exe
  C:\Windows\System\hRUaHjl.exe
  2⤵
  PID:13652
- C:\Windows\System\XwqWQTA.exe
  C:\Windows\System\XwqWQTA.exe
  2⤵
  PID:13684
- C:\Windows\System\EezQfHN.exe
  C:\Windows\System\EezQfHN.exe
  2⤵
  PID:13716
- C:\Windows\System\lKdBQOW.exe
  C:\Windows\System\lKdBQOW.exe
  2⤵
  PID:13740
- C:\Windows\System\ZaTnhuP.exe
  C:\Windows\System\ZaTnhuP.exe
  2⤵
  PID:13764
- C:\Windows\System\IaCISaV.exe
  C:\Windows\System\IaCISaV.exe
  2⤵
  PID:13792
- C:\Windows\System\MZdPdLK.exe
  C:\Windows\System\MZdPdLK.exe
  2⤵
  PID:13820
- C:\Windows\System\XWCcJTg.exe
  C:\Windows\System\XWCcJTg.exe
  2⤵
  PID:13840
- C:\Windows\System\lCnvSTa.exe
  C:\Windows\System\lCnvSTa.exe
  2⤵
  PID:13880
- C:\Windows\System\xyfioQV.exe
  C:\Windows\System\xyfioQV.exe
  2⤵
  PID:13896
- C:\Windows\System\LnEqmUZ.exe
  C:\Windows\System\LnEqmUZ.exe
  2⤵
  PID:13928
- C:\Windows\System\HYauShT.exe
  C:\Windows\System\HYauShT.exe
  2⤵
  PID:13956
- C:\Windows\System\CacMGKN.exe
  C:\Windows\System\CacMGKN.exe
  2⤵
  PID:13984
- C:\Windows\System\WvyTMMD.exe
  C:\Windows\System\WvyTMMD.exe
  2⤵
  PID:14016
- C:\Windows\System\tAQmWtO.exe
  C:\Windows\System\tAQmWtO.exe
  2⤵
  PID:14048
- C:\Windows\System\MTgrUet.exe
  C:\Windows\System\MTgrUet.exe
  2⤵
  PID:14072
- C:\Windows\System\FaYSYVI.exe
  C:\Windows\System\FaYSYVI.exe
  2⤵
  PID:14092
- C:\Windows\System\XtmyaSv.exe
  C:\Windows\System\XtmyaSv.exe
  2⤵
  PID:14116
- C:\Windows\System\SBMHEDf.exe
  C:\Windows\System\SBMHEDf.exe
  2⤵
  PID:14144
- C:\Windows\System\MwdpHuL.exe
  C:\Windows\System\MwdpHuL.exe
  2⤵
  PID:14180
- C:\Windows\System\lSmKbex.exe
  C:\Windows\System\lSmKbex.exe
  2⤵
  PID:14204
- C:\Windows\System\pTaxZGY.exe
  C:\Windows\System\pTaxZGY.exe
  2⤵
  PID:14252
- C:\Windows\System\XhdcDeG.exe
  C:\Windows\System\XhdcDeG.exe
  2⤵
  PID:14272
- C:\Windows\System\TqVcalX.exe
  C:\Windows\System\TqVcalX.exe
  2⤵
  PID:14296
- C:\Windows\System\XnqWnWE.exe
  C:\Windows\System\XnqWnWE.exe
  2⤵
  PID:14316
- C:\Windows\System\fhAmgLf.exe
  C:\Windows\System\fhAmgLf.exe
  2⤵
  PID:13212
- C:\Windows\System\WiAhlry.exe
  C:\Windows\System\WiAhlry.exe
  2⤵
  PID:13208
- C:\Windows\System\iAIUErg.exe
  C:\Windows\System\iAIUErg.exe
  2⤵
  PID:13408
- C:\Windows\System\WUjrHFn.exe
  C:\Windows\System\WUjrHFn.exe
  2⤵
  PID:13448
- C:\Windows\System\TXbOdpe.exe
  C:\Windows\System\TXbOdpe.exe
  2⤵
  PID:13516
- C:\Windows\System\USvhIXE.exe
  C:\Windows\System\USvhIXE.exe
  2⤵
  PID:13512
- C:\Windows\System\fcZJZJS.exe
  C:\Windows\System\fcZJZJS.exe
  2⤵
  PID:13612
- C:\Windows\System\YqoGWmJ.exe
  C:\Windows\System\YqoGWmJ.exe
  2⤵
  PID:13632
- C:\Windows\System\xWaJQMC.exe
  C:\Windows\System\xWaJQMC.exe
  2⤵
  PID:13816
- C:\Windows\System\SFdesRL.exe
  C:\Windows\System\SFdesRL.exe
  2⤵
  PID:13908
- C:\Windows\System\eocJgPw.exe
  C:\Windows\System\eocJgPw.exe
  2⤵
  PID:13916
- C:\Windows\System\nRUdqAf.exe
  C:\Windows\System\nRUdqAf.exe
  2⤵
  PID:13972
- C:\Windows\System\sLgtvQW.exe
  C:\Windows\System\sLgtvQW.exe
  2⤵
  PID:14068
- C:\Windows\System\sieyNdf.exe
  C:\Windows\System\sieyNdf.exe
  2⤵
  PID:14108
- C:\Windows\System\TPJfWax.exe
  C:\Windows\System\TPJfWax.exe
  2⤵
  PID:14176
- C:\Windows\System\UDOWPHt.exe
  C:\Windows\System\UDOWPHt.exe
  2⤵
  PID:14192
- C:\Windows\System\iHFqDBO.exe
  C:\Windows\System\iHFqDBO.exe
  2⤵
  PID:14268
- C:\Windows\System\KwuUDor.exe
  C:\Windows\System\KwuUDor.exe
  2⤵
  PID:12492
- C:\Windows\System\uXwqZhd.exe
  C:\Windows\System\uXwqZhd.exe
  2⤵
  PID:13384
- C:\Windows\System\tdzBlmf.exe
  C:\Windows\System\tdzBlmf.exe
  2⤵
  PID:13588
- C:\Windows\System\hszHrbS.exe
  C:\Windows\System\hszHrbS.exe
  2⤵
  PID:13668
- C:\Windows\System\CAzrTXD.exe
  C:\Windows\System\CAzrTXD.exe
  2⤵
  PID:13812
- C:\Windows\System\cGuPAyK.exe
  C:\Windows\System\cGuPAyK.exe
  2⤵
  PID:13976
- C:\Windows\System\QckIbio.exe
  C:\Windows\System\QckIbio.exe
  2⤵
  PID:14240
- C:\Windows\System\PtyBBsI.exe
  C:\Windows\System\PtyBBsI.exe
  2⤵
  PID:13420
- C:\Windows\System\njNkhwn.exe
  C:\Windows\System\njNkhwn.exe
  2⤵
  PID:13708
- C:\Windows\System\fkFQiNF.exe
  C:\Windows\System\fkFQiNF.exe
  2⤵
  PID:14064
- C:\Windows\System\qGsngRq.exe
  C:\Windows\System\qGsngRq.exe
  2⤵
  PID:13864
- C:\Windows\System\lqegXvh.exe
  C:\Windows\System\lqegXvh.exe
  2⤵
  PID:14352
- C:\Windows\System\aWvkPXj.exe
  C:\Windows\System\aWvkPXj.exe
  2⤵
  PID:14388
- C:\Windows\System\vnHjfQT.exe
  C:\Windows\System\vnHjfQT.exe
  2⤵
  PID:14412
- C:\Windows\System\cRbaiLf.exe
  C:\Windows\System\cRbaiLf.exe
  2⤵
  PID:14432
- C:\Windows\System\sCjwEhJ.exe
  C:\Windows\System\sCjwEhJ.exe
  2⤵
  PID:14464
- C:\Windows\System\QwpoOcC.exe
  C:\Windows\System\QwpoOcC.exe
  2⤵
  PID:14488
- C:\Windows\System\oCXFXnG.exe
  C:\Windows\System\oCXFXnG.exe
  2⤵
  PID:14536
- C:\Windows\System\cBXNafe.exe
  C:\Windows\System\cBXNafe.exe
  2⤵
  PID:14560
- C:\Windows\System\GUJVBwF.exe
  C:\Windows\System\GUJVBwF.exe
  2⤵
  PID:14600
- C:\Windows\System\OuKzTuw.exe
  C:\Windows\System\OuKzTuw.exe
  2⤵
  PID:14628
- C:\Windows\System\TPZBZqQ.exe
  C:\Windows\System\TPZBZqQ.exe
  2⤵
  PID:14644
- C:\Windows\System\SQTYtUD.exe
  C:\Windows\System\SQTYtUD.exe
  2⤵
  PID:14660
- C:\Windows\System\qCeitPC.exe
  C:\Windows\System\qCeitPC.exe
  2⤵
  PID:14684
- C:\Windows\System\XMiuazj.exe
  C:\Windows\System\XMiuazj.exe
  2⤵
  PID:14704
- C:\Windows\System\dhOzIIu.exe
  C:\Windows\System\dhOzIIu.exe
  2⤵
  PID:14720
- C:\Windows\System\TFUgbnH.exe
  C:\Windows\System\TFUgbnH.exe
  2⤵
  PID:14768
- C:\Windows\System\PbbwtjK.exe
  C:\Windows\System\PbbwtjK.exe
  2⤵
  PID:14804
- C:\Windows\System\eLOduGN.exe
  C:\Windows\System\eLOduGN.exe
  2⤵
  PID:14832
- C:\Windows\System\MtwnCqW.exe
  C:\Windows\System\MtwnCqW.exe
  2⤵
  PID:14884
- C:\Windows\System\hFbusEA.exe
  C:\Windows\System\hFbusEA.exe
  2⤵
  PID:14908
- C:\Windows\System\NUiJnDk.exe
  C:\Windows\System\NUiJnDk.exe
  2⤵
  PID:14928
- C:\Windows\System\dBoVyfX.exe
  C:\Windows\System\dBoVyfX.exe
  2⤵
  PID:14948
- C:\Windows\System\cOZuFOx.exe
  C:\Windows\System\cOZuFOx.exe
  2⤵
  PID:14972
- C:\Windows\System\lvzGPOC.exe
  C:\Windows\System\lvzGPOC.exe
  2⤵
  PID:15016
- C:\Windows\System\znIkzJM.exe
  C:\Windows\System\znIkzJM.exe
  2⤵
  PID:15040
- C:\Windows\System\aCzUaQe.exe
  C:\Windows\System\aCzUaQe.exe
  2⤵
  PID:15080
- C:\Windows\System\zaHsxtr.exe
  C:\Windows\System\zaHsxtr.exe
  2⤵
  PID:15100
- C:\Windows\System\DKgkJIa.exe
  C:\Windows\System\DKgkJIa.exe
  2⤵
  PID:15128
- C:\Windows\System\sQxywyW.exe
  C:\Windows\System\sQxywyW.exe
  2⤵
  PID:15152
- C:\Windows\System\xzjAiaM.exe
  C:\Windows\System\xzjAiaM.exe
  2⤵
  PID:15188
- C:\Windows\System\yklPoVt.exe
  C:\Windows\System\yklPoVt.exe
  2⤵
  PID:15208
- C:\Windows\System\nYsmYzB.exe
  C:\Windows\System\nYsmYzB.exe
  2⤵
  PID:15236
- C:\Windows\System\jCLLSvn.exe
  C:\Windows\System\jCLLSvn.exe
  2⤵
  PID:15264
- C:\Windows\System\pdyXurH.exe
  C:\Windows\System\pdyXurH.exe
  2⤵
  PID:15292
- C:\Windows\System\iLBVrHF.exe
  C:\Windows\System\iLBVrHF.exe
  2⤵
  PID:15320
- C:\Windows\System\HJqsjzN.exe
  C:\Windows\System\HJqsjzN.exe
  2⤵
  PID:15348
- C:\Windows\System\dqYHXuO.exe
  C:\Windows\System\dqYHXuO.exe
  2⤵
  PID:13944
- C:\Windows\System\kgJYoHA.exe
  C:\Windows\System\kgJYoHA.exe
  2⤵
  PID:14380
- C:\Windows\System\fDzdxCc.exe
  C:\Windows\System\fDzdxCc.exe
  2⤵
  PID:14404
- C:\Windows\System\eTWQzPw.exe
  C:\Windows\System\eTWQzPw.exe
  2⤵
  PID:14544
- C:\Windows\System\PtscUAQ.exe
  C:\Windows\System\PtscUAQ.exe
  2⤵
  PID:14576
- C:\Windows\System\lWisDBo.exe
  C:\Windows\System\lWisDBo.exe
  2⤵
  PID:14676
- C:\Windows\System\GCbIbPq.exe
  C:\Windows\System\GCbIbPq.exe
  2⤵
  PID:14680
- C:\Windows\System\KNTblgA.exe
  C:\Windows\System\KNTblgA.exe
  2⤵
  PID:14744
- C:\Windows\System\GTSqojI.exe
  C:\Windows\System\GTSqojI.exe
  2⤵
  PID:14760
- C:\Windows\System\vBPoafl.exe
  C:\Windows\System\vBPoafl.exe
  2⤵
  PID:14840
- C:\Windows\System\FWlNMFY.exe
  C:\Windows\System\FWlNMFY.exe
  2⤵
  PID:14900
- C:\Windows\System\FQyCWfh.exe
  C:\Windows\System\FQyCWfh.exe
  2⤵
  PID:14968
- C:\Windows\System\PTDPbSN.exe
  C:\Windows\System\PTDPbSN.exe
  2⤵
  PID:15036
- C:\Windows\System\ftBMYVl.exe
  C:\Windows\System\ftBMYVl.exe
  2⤵
  PID:15072
- C:\Windows\System\asZjmYO.exe
  C:\Windows\System\asZjmYO.exe
  2⤵
  PID:15140
- C:\Windows\System\WINWgnO.exe
  C:\Windows\System\WINWgnO.exe
  2⤵
  PID:15196
- C:\Windows\System\vGJkIGj.exe
  C:\Windows\System\vGJkIGj.exe
  2⤵
  PID:15276
- C:\Windows\System\MSztIQj.exe
  C:\Windows\System\MSztIQj.exe
  2⤵
  PID:15316
- C:\Windows\System\gloWCnK.exe
  C:\Windows\System\gloWCnK.exe
  2⤵
  PID:14376
- C:\Windows\System\nodpCqR.exe
  C:\Windows\System\nodpCqR.exe
  2⤵
  PID:14636
- C:\Windows\System\VaAsBvr.exe
  C:\Windows\System\VaAsBvr.exe
  2⤵
  PID:14736
- C:\Windows\System\BdqpnSo.exe
  C:\Windows\System\BdqpnSo.exe
  2⤵
  PID:14876
- C:\Windows\System\EAOKKyZ.exe
  C:\Windows\System\EAOKKyZ.exe
  2⤵
  PID:14964
- C:\Windows\System\CoMUepK.exe
  C:\Windows\System\CoMUepK.exe
  2⤵
  PID:15224
- C:\Windows\System\bKtRnUE.exe
  C:\Windows\System\bKtRnUE.exe
  2⤵
  PID:15060
- C:\Windows\System\ULvVKSo.exe
  C:\Windows\System\ULvVKSo.exe
  2⤵
  PID:14480
- C:\Windows\System\UmwUToD.exe
  C:\Windows\System\UmwUToD.exe
  2⤵
  PID:13380
- C:\Windows\System\apYCEss.exe
  C:\Windows\System\apYCEss.exe
  2⤵
  PID:14904
- C:\Windows\System\XRbwFwZ.exe
  C:\Windows\System\XRbwFwZ.exe
  2⤵
  PID:15388
- C:\Windows\System\drmvMFv.exe
  C:\Windows\System\drmvMFv.exe
  2⤵
  PID:15416
- C:\Windows\System\smqwQxt.exe
  C:\Windows\System\smqwQxt.exe
  2⤵
  PID:15452
- C:\Windows\System\alFlOTP.exe
  C:\Windows\System\alFlOTP.exe
  2⤵
  PID:15476
- C:\Windows\System\yIpMemi.exe
  C:\Windows\System\yIpMemi.exe
  2⤵
  PID:15516
- C:\Windows\System\DevNjhm.exe
  C:\Windows\System\DevNjhm.exe
  2⤵
  PID:15540
- C:\Windows\System\KiIlard.exe
  C:\Windows\System\KiIlard.exe
  2⤵
  PID:15560
- C:\Windows\System\DrmvGlI.exe
  C:\Windows\System\DrmvGlI.exe
  2⤵
  PID:15576
- C:\Windows\System\sMswzZn.exe
  C:\Windows\System\sMswzZn.exe
  2⤵
  PID:15600
- C:\Windows\System\OJdPqcs.exe
  C:\Windows\System\OJdPqcs.exe
  2⤵
  PID:15644
- C:\Windows\System\lwcKwFW.exe
  C:\Windows\System\lwcKwFW.exe
  2⤵
  PID:15664
- C:\Windows\System\DPqDhmX.exe
  C:\Windows\System\DPqDhmX.exe
  2⤵
  PID:15700
- C:\Windows\System\GSSAaiI.exe
  C:\Windows\System\GSSAaiI.exe
  2⤵
  PID:15716
- C:\Windows\System\aZKgkIk.exe
  C:\Windows\System\aZKgkIk.exe
  2⤵
  PID:15748
- C:\Windows\System\OWCNAaD.exe
  C:\Windows\System\OWCNAaD.exe
  2⤵
  PID:15784
- C:\Windows\System\aBLrJsw.exe
  C:\Windows\System\aBLrJsw.exe
  2⤵
  PID:15800
- C:\Windows\System\OXKlmdO.exe
  C:\Windows\System\OXKlmdO.exe
  2⤵
  PID:15824
- C:\Windows\System\vPzKTli.exe
  C:\Windows\System\vPzKTli.exe
  2⤵
  PID:15848
- C:\Windows\System\dsnPJTX.exe
  C:\Windows\System\dsnPJTX.exe
  2⤵
  PID:15876
- C:\Windows\System\lbkmAfQ.exe
  C:\Windows\System\lbkmAfQ.exe
  2⤵
  PID:15896
- C:\Windows\System\jrvyfyn.exe
  C:\Windows\System\jrvyfyn.exe
  2⤵
  PID:15920
- C:\Windows\System\vWFZcIJ.exe
  C:\Windows\System\vWFZcIJ.exe
  2⤵
  PID:15976
- C:\Windows\System\PZXNwug.exe
  C:\Windows\System\PZXNwug.exe
  2⤵
  PID:16008
- C:\Windows\System\TZNvomh.exe
  C:\Windows\System\TZNvomh.exe
  2⤵
  PID:16028
- C:\Windows\System\dzYvUQs.exe
  C:\Windows\System\dzYvUQs.exe
  2⤵
  PID:16056
- C:\Windows\System\shdoSeY.exe
  C:\Windows\System\shdoSeY.exe
  2⤵
  PID:16080
- C:\Windows\System\HhHuoWI.exe
  C:\Windows\System\HhHuoWI.exe
  2⤵
  PID:16104
- C:\Windows\System\ZpVbVwS.exe
  C:\Windows\System\ZpVbVwS.exe
  2⤵
  PID:16148
- C:\Windows\System\PcIwmCi.exe
  C:\Windows\System\PcIwmCi.exe
  2⤵
  PID:16176
- C:\Windows\System\UgkaOIo.exe
  C:\Windows\System\UgkaOIo.exe
  2⤵
  PID:16200
- C:\Windows\System\qucUFUI.exe
  C:\Windows\System\qucUFUI.exe
  2⤵
  PID:16232
- C:\Windows\System\IolQegH.exe
  C:\Windows\System\IolQegH.exe
  2⤵
  PID:16248
- C:\Windows\System\eFhCUgp.exe
  C:\Windows\System\eFhCUgp.exe
  2⤵
  PID:16280
- C:\Windows\System\KOiFdvO.exe
  C:\Windows\System\KOiFdvO.exe
  2⤵
  PID:16300
- C:\Windows\System\dgWCCKX.exe
  C:\Windows\System\dgWCCKX.exe
  2⤵
  PID:16332
- C:\Windows\System\jMrwKmE.exe
  C:\Windows\System\jMrwKmE.exe
  2⤵
  PID:16348
- C:\Windows\System\wFjzTxa.exe
  C:\Windows\System\wFjzTxa.exe
  2⤵
  PID:16372
- C:\Windows\System\DmnUKiR.exe
  C:\Windows\System\DmnUKiR.exe
  2⤵
  PID:14944
- C:\Windows\System\aDVYnEN.exe
  C:\Windows\System\aDVYnEN.exe
  2⤵
  PID:15444
- C:\Windows\System\EAdaDee.exe
  C:\Windows\System\EAdaDee.exe
  2⤵
  PID:15464
- C:\Windows\System\yzqkSRp.exe
  C:\Windows\System\yzqkSRp.exe
  2⤵
  PID:15572
- C:\Windows\System\UwxKqmo.exe
  C:\Windows\System\UwxKqmo.exe
  2⤵
  PID:15616
- C:\Windows\System\ZnuIcjt.exe
  C:\Windows\System\ZnuIcjt.exe
  2⤵
  PID:15684
- C:\Windows\System\boYYKXP.exe
  C:\Windows\System\boYYKXP.exe
  2⤵
  PID:15728
- C:\Windows\System\eaaqFGX.exe
  C:\Windows\System\eaaqFGX.exe
  2⤵
  PID:15840
- C:\Windows\System\AohqnLu.exe
  C:\Windows\System\AohqnLu.exe
  2⤵
  PID:15936
- C:\Windows\System\VGEPYnS.exe
  C:\Windows\System\VGEPYnS.exe
  2⤵
  PID:15960
- C:\Windows\System\qaPplqN.exe
  C:\Windows\System\qaPplqN.exe
  2⤵
  PID:16064
- C:\Windows\System\OHSOFpj.exe
  C:\Windows\System\OHSOFpj.exe
  2⤵
  PID:16100
- C:\Windows\System\RiHQTqY.exe
  C:\Windows\System\RiHQTqY.exe
  2⤵
  PID:16136
- C:\Windows\System\hwHEsAD.exe
  C:\Windows\System\hwHEsAD.exe
  2⤵
  PID:16196
- C:\Windows\System\IkozPkK.exe
  C:\Windows\System\IkozPkK.exe
  2⤵
  PID:16296
- C:\Windows\System\aCwNKbN.exe
  C:\Windows\System\aCwNKbN.exe
  2⤵
  PID:16324
- C:\Windows\System\qzcvfiS.exe
  C:\Windows\System\qzcvfiS.exe
  2⤵
  PID:14860
- C:\Windows\System\hlccrub.exe
  C:\Windows\System\hlccrub.exe
  2⤵
  PID:15624
- C:\Windows\System\EBKcHFs.exe
  C:\Windows\System\EBKcHFs.exe
  2⤵
  PID:15768
- C:\Windows\System\tcTjpUj.exe
  C:\Windows\System\tcTjpUj.exe
  2⤵
  PID:15856
- C:\Windows\System\SLfLfYK.exe
  C:\Windows\System\SLfLfYK.exe
  2⤵
  PID:16000
- C:\Windows\System\cTGaKcA.exe
  C:\Windows\System\cTGaKcA.exe
  2⤵
  PID:16124
- C:\Windows\System\kfmeqil.exe
  C:\Windows\System\kfmeqil.exe
  2⤵
  PID:16316
- C:\Windows\System\JuEoBsM.exe
  C:\Windows\System\JuEoBsM.exe
  2⤵
  PID:15632
- C:\Windows\System\BCKqKDs.exe
  C:\Windows\System\BCKqKDs.exe
  2⤵
  PID:16092
- C:\Windows\System\vnDyYnC.exe
  C:\Windows\System\vnDyYnC.exe
  2⤵
  PID:16360
- C:\Windows\System\cFDgkTs.exe
  C:\Windows\System\cFDgkTs.exe
  2⤵
  PID:15436
- C:\Windows\System\KUaxhfh.exe
  C:\Windows\System\KUaxhfh.exe
  2⤵
  PID:16240
- C:\Windows\System\HdncFQk.exe
  C:\Windows\System\HdncFQk.exe
  2⤵
  PID:16416
- C:\Windows\System\VkimGXH.exe
  C:\Windows\System\VkimGXH.exe
  2⤵
  PID:16444
- C:\Windows\System\QNxZfhP.exe
  C:\Windows\System\QNxZfhP.exe
  2⤵
  PID:16472
- C:\Windows\System\DsCgrWw.exe
  C:\Windows\System\DsCgrWw.exe
  2⤵
  PID:16488
- C:\Windows\System\JkSPFYJ.exe
  C:\Windows\System\JkSPFYJ.exe
  2⤵
  PID:16516
- C:\Windows\System\OTTEGjM.exe
  C:\Windows\System\OTTEGjM.exe
  2⤵
  PID:16580
- C:\Windows\System\MWsLGce.exe
  C:\Windows\System\MWsLGce.exe
  2⤵
  PID:16596
- C:\Windows\System\mcFgYdU.exe
  C:\Windows\System\mcFgYdU.exe
  2⤵
  PID:16616
- C:\Windows\System\gGzqFVJ.exe
  C:\Windows\System\gGzqFVJ.exe
  2⤵
  PID:16644
- C:\Windows\System\AOYcyma.exe
  C:\Windows\System\AOYcyma.exe
  2⤵
  PID:16668
- C:\Windows\System\xCfOLqT.exe
  C:\Windows\System\xCfOLqT.exe
  2⤵
  PID:16692
- C:\Windows\System\JMtVzAw.exe
  C:\Windows\System\JMtVzAw.exe
  2⤵
  PID:16744
- C:\Windows\System\xqHbYCd.exe
  C:\Windows\System\xqHbYCd.exe
  2⤵
  PID:16768
- C:\Windows\System\yNtskgu.exe
  C:\Windows\System\yNtskgu.exe
  2⤵
  PID:16796
- C:\Windows\System\wnuFHFD.exe
  C:\Windows\System\wnuFHFD.exe
  2⤵
  PID:16820
- C:\Windows\System\CbqXFRm.exe
  C:\Windows\System\CbqXFRm.exe
  2⤵
  PID:16840
- C:\Windows\System\iBTesfA.exe
  C:\Windows\System\iBTesfA.exe
  2⤵
  PID:16864
- C:\Windows\System\qaUIiin.exe
  C:\Windows\System\qaUIiin.exe
  2⤵
  PID:16880

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:17280

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\BEpKoPg.exe

Filesize
1023KB

MD5
b2adfee7180c053e0df926b384ae690f

SHA1
520a3de32cc40f349b0b1690297207b9e504d437

SHA256
2b38f69cef46cad5068e873a4c1262b66f36a3f0484cb39e3d43d07ea3f5d7ae

SHA512
694c7a6e32c96b5d9307613748a0d6d0a3870ce2233cefddab9f23c6cbd9dbe791c8b2ef14f69ab2d16b167aabf7918f270602a09fcb5c72773c9ec0bbe09194

Download Submit
C:\Windows\System\Dsghdxg.exe

Filesize
1.0MB

MD5
9332dd48502b82a02dcf240f30603fa0

SHA1
5c963ada837a2fdcb05c44ad570de162546c772f

SHA256
4c1017b212b490464904b3e9c473332082893545fd911c28f0b029bf59bb1a9e

SHA512
ed041cb19d6435d79a2df671fbfa81fd22efd2519292f3a09cfd7d0eee534436c04d74c02626c868fc2b18dee2b86a8bda1ceabd624d4e1c937a2084b2b1fef1

Download Submit
C:\Windows\System\GQihRRr.exe

Filesize
1.0MB

MD5
b9d9c56f6e3167cd4d7ad6bba7668d8e

SHA1
6edc2784f214b50fc31109ca3c5244000655fb76

SHA256
ccaf1c5a5c81114e3f154ea50b56fa55f0d508875d2ef21443efa3895ce0623b

SHA512
0f8c416d3e8fe53f9ba45bc09f695faa6eea1f99773ee793e62886af4fd752a3415afce0813c1a4ce52fca8eceb2a20c8ead5cf326269b24352a761f26cc1bc4

Download Submit
C:\Windows\System\KOQvVCI.exe

Filesize
1.0MB

MD5
3913c94cce22da787a745fa7d95d0ecb

SHA1
bc4fc65d89039a56985870de7c7bed8a52170aea

SHA256
2ad3e60f3bdbb40b5c7eede469a5e39322641e968552cbebcdb6b20890c8e2a6

SHA512
5f5963c495b491450c3143da0c3f883eb0e8b9cd9728db6f035d34646e43b67abfd3f4cc85209e869f84dd47846d7f7e4b63ad020ac5f51d936b03add2d13bea

Download Submit
C:\Windows\System\KyebQBp.exe

Filesize
1.0MB

MD5
b9b310c3664135eff6524f165037e31e

SHA1
e2ed837333ef1d7533719cae6d5f30f7265197c2

SHA256
883e2ec5b3602482654b3f336fc24f89d48f3fd80f54fa3f8a004e3ad299b021

SHA512
c3f4beecc3466e4ec707915a8e2c471b2531ae78df597338a3bfd042aaa62a572ea7cecabdbf0a9cf89200dcecc00e4f397afc2d158da91df06c44ad882f2750

Download Submit
C:\Windows\System\LOvOCIZ.exe

Filesize
1.0MB

MD5
1cc6c52a610b4f3a4a4db66c00b78ac5

SHA1
5eff1dad8fc632a7e2076858a785f1a80b2bfede

SHA256
ca755d72767d47fa5fe3fce3b0cdfc1308e6db9c36049a5896ca63e8f62b0e08

SHA512
30957db39be61805d05af5d1c2f3e23a8531669b41fe5ce8c7d4e19212c8f29b399941a43529ac5de420472e6dddf891abbe049b65dc9b11dfbfcebc620500ff

Download Submit
C:\Windows\System\MBXRfrB.exe

Filesize
1.0MB

MD5
6020c50c58282503647a8f62a3227c49

SHA1
f492bbecdc35ac7549e29a28108cf2b64eca357c

SHA256
b2bf9f9f97b18bb84b7a9e5f64c924a50ec23f1b24213631f519501f8a65dcd6

SHA512
0597c6aff045bd9a4f34e226e2a535b04dc056b45c323cb05c5065da7f9e7e441afc8e9234c4db3586c236b1e099d7d1e30d61135da72f8a47eb6069e04a8ec0

Download Submit
C:\Windows\System\MHakOuP.exe

Filesize
1.0MB

MD5
c5c6aaec4513e11cdf24b8e214fb7714

SHA1
08b679a91b508c2dcc54edab3222970de56f0305

SHA256
349a0a8ae7967fcf390ae70c285330c08618156db286f625949fb8d5d94a7ef7

SHA512
df797151694d8b7bf179255fd2b5759cc29ed1e40bed77586ac065126456787db1e88a0dc0693ba3001647336dae94e11d4bdbed3342e9c1beab98c215bcc8b0

Download Submit
C:\Windows\System\MnifKpO.exe

Filesize
1.0MB

MD5
aa0bb7a5f68e5e489ac5238272146155

SHA1
18d0a199a34daf52093451b7249d44b5b5a07fa7

SHA256
3d5193d17f7f77149145e03bf6b76ea337d7dbd32b49ba8aecf4ddeca1775515

SHA512
b935d3bce550dcad462733c7e041e4b41f76f3f53e8c59de70dc4a89743487983279209cfdbaf7828e3e92143eb4c3d9d37370880d1a7bd42a872139cb46f808

Download Submit
C:\Windows\System\VTQngYy.exe

Filesize
1023KB

MD5
0f91a74f7e6b564992ebd65e5a2171e9

SHA1
f0667b2f04b339ec5b9d343d74bbbe814ce6ef9a

SHA256
840493a72afd649afd30dd2c58f5b792ad6f779d20c2ca305f3c6f99ff13ab11

SHA512
0aac4ab3eee65c961f2285d844b7983d92dfb70e49472ebabda4e0f171bb6a0e322561b6c50845865b3b47d4bd4aabd9a944cb4705f7e6b94cd949da78c9a907

Download Submit
C:\Windows\System\XVlRcmr.exe

Filesize
1.0MB

MD5
7b8bfd0f7a44e62b7f89854f8199c442

SHA1
338fddb4a7b5388c56cbd1a345f36043d16ecb5d

SHA256
1e16a4b55d24f2380a62b9dfe7720ff5a967f0d5d10dd9087bd22c7db5cb38dd

SHA512
cc35dc747710d019272cb87eaa195ed3e7c811513b47e3c0e552ac29f5a91233e5f6b2f8b4d125263cf94fcba563130ae1256882e0aa1478e409cd0bfcc3429a

Download Submit
C:\Windows\System\XfddDzq.exe

Filesize
1.0MB

MD5
8dbbd451a2388e08b012fae71823c0fa

SHA1
1584c2024296592a5db51f27c4922331e451afa2

SHA256
8f0a7f6623fad7dda0190d879e76d9b39c50a0fde6324c2b24e40906fb7ffa50

SHA512
fd4b717a41ce44240cab0b4de601efae2db87e31fde997c612036c96fd55e44735da43767f3aa55110fc35c500a2d82ab5f27f73f9bbc22ad5c50b9bf04cf30a

Download Submit
C:\Windows\System\XxkRbwo.exe

Filesize
1.0MB

MD5
caa971ec0f297e9b05efeb4c02bff28f

SHA1
6084db1ecde6b42a98156a7ecd4f494f4c6054e7

SHA256
7e253e68dff198216b46ca04c807b9450ec68a7ac4336d2727a6e5c0c602e450

SHA512
af18fe7d2ba1845d708f8ee9237a21e0b54797077734083fff7f3052f89ca4b68dba8997bd352c100a518fc3b9e3357686ed49afbe7671bbbc777fc43be37cf5

Download Submit
C:\Windows\System\XyRNBkU.exe

Filesize
1.0MB

MD5
7962b5f7e04fa36f41e6dbe1f8e5427e

SHA1
540cc7f463b8ea7d566fdb454848f38df8e49f4c

SHA256
fc996226d90a5af81aa68356d41d7631d40a11af60ee91b140e61814c63cc5a3

SHA512
15096efae0358748399feb9cbbc7f5489ab54b1b901f76cdfbaf81b30e94572d8adcb514770b3f3e014587ff2c6908ba612fa023facf4ec1dc57bebb850404af

Download Submit
C:\Windows\System\ZJtJvIs.exe

Filesize
1.0MB

MD5
99de10359bb301d509fe3d3e18ae196c

SHA1
8de1f7d02bda224f894219c12d9e3044c8cfedb0

SHA256
f6dacf63e96b52e962c4df3b1b2879aa72d2efed3ba5f405dfa37308d3421400

SHA512
6b0ff37acb360845fd1f369454597daab2942499e02111fcd1eb7f4725af02cd2767adead5d719bf00274a995d019c8aa030a1c4580e76b716ef07f085c40b35

Download Submit
C:\Windows\System\ajyIkCU.exe

Filesize
1.0MB

MD5
af71811606e13c8e33e8de28de11a903

SHA1
b4811b1cf8404f0581815fb2e427824f739702bf

SHA256
29a4ac2548dd738b94b1db7e148e209ac4aff957d3ba115d47c9ea6a26ae83db

SHA512
5b4f49942212e392a36f19dde3e8376057aeffa7b647b3d94571f5f91b8717e5146311c84eb89f42951a4728665bfe7e28476e6e3f69423fd5fb6f4143416257

Download Submit
C:\Windows\System\atUijhV.exe

Filesize
1023KB

MD5
cb2761e4cf3d79a2efbc0fe7bb4f30cd

SHA1
db956f21f4561b8627cdb6ed7ca11be321324ac4

SHA256
3b236e3e0dae933c72bb2ad1eb54d45d34fbba4d83410f70cc3106675f6f0ee0

SHA512
279278f45352c81a11c86807fd673c47f5aa269161f868e61a4ca4d878319528e7ea0218abd2cab16db567e489dc9e6ffb4ced999dad35c622c693c1ba7d150f

Download Submit
C:\Windows\System\fkRqEqW.exe

Filesize
1.0MB

MD5
002170ff23b1a57aa4dd679630fb04f9

SHA1
c6e0d694a455785255160cbe4274ca4f40896e52

SHA256
5e91c5caedff32deed4eefd9f6a9a4b8f19e8e81f3819e06313d33d5ec680144

SHA512
7b2f9101fd0d413ab520b520a588b33d4add3e7c46c506a42ee80a42fd6062fc49884f628079f41c48b945ed0762bf4c5d9188ea571933521874e450f497ab54

Download Submit
C:\Windows\System\hLmzJbZ.exe

Filesize
1.0MB

MD5
dbafa5b82b0320cda3273a7dd2ab632c

SHA1
ee7776ac79a4e7f9f604bd725e47ad6420a9cbf6

SHA256
83e49d575d685a1a29e64b44ab4958381ec9b39fd993aceb181a373bd2087af2

SHA512
d8940b47ab24b440bcd96a87f883a0b1c6b6bbbaacbe6b671753dd1aaa0f51c418d0dc3714a456d752ca49b8e812fadb7ee0f025f93b7a5091f3347e969444e5

Download Submit
C:\Windows\System\iRdFSfX.exe

Filesize
1.0MB

MD5
c5a33844ab89ab0d28c23929290f731b

SHA1
75f8a6c81e9fea9c091ed2d658d783fe23a6274b

SHA256
4aab355a6396e43ba90f4e1a7c22243a34639d1f99847e413d1487b86a5a53e2

SHA512
aba96dba1395d5ed7f13ad12b84222bc12e2bb10c1c219f3431e7b19758d34a4bc1839cbc6b3463749b42fbc3cff84b57597f9098fd80a95cc7714fcf8a5f46a

Download Submit
C:\Windows\System\ihxZlKT.exe

Filesize
1.0MB

MD5
7c939e384c17d507961f2be1966852fa

SHA1
93883e6cac3737927252f76954e8890ae4487d86

SHA256
ce983e620de3f8bf6c0e55aad2c33b42f8a9eba8f88b1a8a73a671fb75a3a942

SHA512
59df4c4d78ae524df64e1821908bfcc5a0a71bbf7bd083e06a92a26aa88bf35a67fdf0116d45e1ae73c03042ef19a1de00b299a11d89cad7eb2697b1c2f09527

Download Submit
C:\Windows\System\jwLKfKW.exe

Filesize
1.0MB

MD5
ac470fd14e33093facd5f949358036f2

SHA1
bba4b54d7eb117ffb6418698d802a0429ae739e2

SHA256
9476035d2366c8e2ca09c7165745e253b87608f7f69e06c11b4bd156e7f43b77

SHA512
d33e97b5703ec8f6fa597468133e80aa7b6dc1720adb798d294f24eba26e6b22df4dbe35b407f0840721a817fc4931108272bd0af5e0cd6fa3ba605d5b7d669d

Download Submit
C:\Windows\System\kGbmcSz.exe

Filesize
1.0MB

MD5
acb1edbbd109d2a87a1d25b0ca414543

SHA1
195b9d2cf8e70a7a6a15a02cf0eb214161dd4048

SHA256
7fd934f5c4ebb59c7d07ab5204e406ad5d591f863fd49c0a7ea00826d3018466

SHA512
9b37361123f86548fc37d1566b2723c239b841a97b2357877e6e72c5d26268f0423c6df9b91614b5b5ab96bdc78de162b8e82062a3e7653a8349595291a0d1e5

Download Submit
C:\Windows\System\kMDDzyz.exe

Filesize
1.0MB

MD5
8717c38986f7b701e424b6abb60e016a

SHA1
bb71f374621278ccf4025af0decc279af173d7cf

SHA256
6e13ad3a7c8f9499d2ff99856da45b6656408515558671edec209e4cd8895403

SHA512
1853027c135ef943055173f0ba5f6fa5b53c9acdfa6f5d8a151e590d683bfce0fef233268ec8626f30b67e763afab9ea75aeaa123fce57448237b92505a32d9b

Download Submit
C:\Windows\System\mzDHbky.exe

Filesize
1.0MB

MD5
b4a0b31cc91114a6f8e43a946ef58f0a

SHA1
77eb0e2d5ccc0544c1e45c7c736fb9824b3f9370

SHA256
c03b876775d044d98e24fdc252daa0563800d6e164e151e85aff6165f1112edf

SHA512
a853efb949119a2507031ed39753fb30f3051566db2942dc652b008ae28e66cff08da250c2860561cef6b1c926fc168d62af351aac1126ef2e2a8fe486dacea7

Download Submit
C:\Windows\System\ovZOKWX.exe

Filesize
1.0MB

MD5
fc2f85ab35d0489b292eb53a3c0fff56

SHA1
bbbbef60a5fae0a05d81161afcfd529d097fbfb7

SHA256
3d9690c499f9703c1aa882551552c0414cd33d8d7d66b9570ce8c6052f77dccb

SHA512
3b13eff22fcedcfd619a9727dd578b59a0a0457987d36ba57fbd5fed2b0029d3f90c9a796c749d2089e2b23939955426ad73612310e65ff04ec43bc858aac140

Download Submit
C:\Windows\System\ovoyCqX.exe

Filesize
1.0MB

MD5
2f65ff2e13da49d579a290a183b4b237

SHA1
b4ccb91373175896b8cb0902705136c85ba9613c

SHA256
e609bf2d8e98051f79dfa7df670d53d16e69dfdd8b30b6d2d0ec84b84aaf581c

SHA512
9b4cb06901a43fce0f12e9492900d00bddb2dab46583c77ba9be843331a8eb8f76850c50f56123b99ef198ccba0c37012d2678213a1a57d1b88e4a34eb2c610d

Download Submit
C:\Windows\System\ozFPRxC.exe

Filesize
1.0MB

MD5
36e4c02db01e243ebbb8e1c0d253bc7f

SHA1
2d8df16db3b7e2e9841d3879256b8fde0368cfbc

SHA256
1f6ebb0182183974ee62b18bd64a9fff9f03f1ac10bc6695c5754cc0fadc2987

SHA512
15c423ffd63481e7e56fa538af8b18486aa0409d14d4a8e32127f5f977934db6d3f60ec3d97baa112a9da50ff8c88ce3b250a74969498bf59ba85bdb773849ab

Download Submit
C:\Windows\System\qPbZoJA.exe

Filesize
1.0MB

MD5
90bac8ea457ed1d6ee6e69a92d82db95

SHA1
3f14a6f383fd9f8da82688c8c4147512173a6ef7

SHA256
6e186cb8f524353c3062935c99be562912acb29ce3c66640fde0af6a5ef3fc76

SHA512
bc366005e7629453cac78e38326a16e4ace5f9bb961d278b06089f341e6599b9bb798ae02c250db8c94c03f994d3f288089a4cfbbeaa6595cba708e47cb57b95

Download Submit
C:\Windows\System\uTAvasU.exe

Filesize
1.0MB

MD5
ea173d3403553396a184832c98db6127

SHA1
a86ba9334332fbba6f57ce49ce2f44de46614fe8

SHA256
414dc3b0a52fa769101470cc457e3b095848e9f8830b9b9dd2756da11eb494a1

SHA512
b154d2089ef4e313b1cc9e0047adb569eca0c82849a10f526b545e9bde7db85bab36a453b4d005598e06d60c69b98800588c4998f6ea8701163d271c90c187df

Download Submit
C:\Windows\System\uXldjPr.exe

Filesize
1.0MB

MD5
3750abeeacb73fe11c18e4ddff6cb8a9

SHA1
0026beb2222cbe9657136a5160f1cf565e88dcab

SHA256
477274a1c43a6efeab91eff07cbb0d8229e9b0abf0f6cada28eb6c4f8b315678

SHA512
3a0581c27526570c99e5064cad4adc8c5fa8fd5fb18b528fee65d53fcdcf936cc13669202275790cda6f66f55bb38438f02cd28857784a65a03018d4636918ad

Download Submit
C:\Windows\System\udDUNRm.exe

Filesize
1.0MB

MD5
c5b12aeefdfd9f179df3aca5769240d0

SHA1
b6f41c2e4f230765f31bb446640ca95b10a942ad

SHA256
3970a82cc3c6dc3f3a7f77461bdb4db61a36cc81263a076a6b09eba0a909cd83

SHA512
d4b9b6a21701e0edc8d5178a48cee43ac0bbf89d96f252325360da892be977db7eb074437f7f157796fefcd9ab3166e831e0efc0686695864f11b9af053a65cf

Download Submit
C:\Windows\System\vaQMQVZ.exe

Filesize
1.0MB

MD5
d2d26b7466630d8624a88508cca78db9

SHA1
b965db5cf36fae6991171ef769fba91ffc98ca19

SHA256
ad8cf0538e9395eb61d062e083a6fd874a146ef658e24b569683c1ce76c1cb15

SHA512
10db42bdf1b50ce6331c14154cd7f4b1fa8ae656878d13060aaa474b498ae7283d53b06047a493af50999ffde02b7bdc0a4da6fb2752dbdd7333693fa4f02b5e

Download Submit
memory/2112-0-0x0000022F582F0000-0x0000022F58300000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads