xmrig | cb1f2fa5f4d91d9f929bc5fafd8884fb63d8515cc73b8aea3891fa2bf36e1926

Analysis

max time kernel
121s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
21-12-2024 04:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cb1f2fa5f4d91d9f929bc5fafd8884fb63d8515cc73b8aea3891fa2bf36e1926.exe
Size

1.5MB
MD5

2c142c9357ad8f2ce24acddb0eaba4f2
SHA1

e2a46cc30f6ded0081f90b79563698b7376daaa8
SHA256

cb1f2fa5f4d91d9f929bc5fafd8884fb63d8515cc73b8aea3891fa2bf36e1926
SHA512

c77180fc7c8c4fa23cfc074dff77ca7c37475f6dab9bb836fcd932e1fd3c233a6b8193189d42f0e7ef8e58a150f7b68d77ea934f8283a70147f47738789ed94a
SSDEEP

49152:GezaTF8FcNkNdfE0pZ9ozttwIRxj4c5yOYFu4/qa8/:GemTLkNdfE0pZyR

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 33 IoCs

miner

resource	yara_rule
behavioral2/files/0x000c000000023b6e-4.dat	xmrig
behavioral2/files/0x000a000000023b78-8.dat	xmrig
behavioral2/files/0x000a000000023b7a-23.dat	xmrig
behavioral2/files/0x000a000000023b7d-43.dat	xmrig
behavioral2/files/0x000a000000023b81-57.dat	xmrig
behavioral2/files/0x000a000000023b88-94.dat	xmrig
behavioral2/files/0x000a000000023b8c-117.dat	xmrig
behavioral2/files/0x000b000000023b93-153.dat	xmrig
behavioral2/files/0x000e000000023ba3-162.dat	xmrig
behavioral2/files/0x000b000000023b94-158.dat	xmrig
behavioral2/files/0x000a000000023b9c-157.dat	xmrig
behavioral2/files/0x000b000000023b92-148.dat	xmrig
behavioral2/files/0x000a000000023b91-143.dat	xmrig
behavioral2/files/0x000a000000023b90-138.dat	xmrig
behavioral2/files/0x000a000000023b8f-133.dat	xmrig
behavioral2/files/0x000a000000023b8e-127.dat	xmrig
behavioral2/files/0x000a000000023b8d-123.dat	xmrig
behavioral2/files/0x000a000000023b8b-113.dat	xmrig
behavioral2/files/0x000a000000023b8a-108.dat	xmrig
behavioral2/files/0x000a000000023b89-103.dat	xmrig
behavioral2/files/0x000a000000023b87-92.dat	xmrig
behavioral2/files/0x000a000000023b86-88.dat	xmrig
behavioral2/files/0x000a000000023b85-82.dat	xmrig
behavioral2/files/0x000a000000023b84-78.dat	xmrig
behavioral2/files/0x000a000000023b83-72.dat	xmrig
behavioral2/files/0x000a000000023b82-68.dat	xmrig
behavioral2/files/0x000a000000023b80-58.dat	xmrig
behavioral2/files/0x000a000000023b7f-53.dat	xmrig
behavioral2/files/0x000a000000023b7e-48.dat	xmrig
behavioral2/files/0x000a000000023b7c-40.dat	xmrig
behavioral2/files/0x000a000000023b7b-32.dat	xmrig
behavioral2/files/0x000a000000023b79-21.dat	xmrig
behavioral2/files/0x000b000000023b74-10.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
1136	fRPQGqe.exe
2644	IlKYefM.exe
3164	yngpnrG.exe
2296	nuBLYSt.exe
2652	vYjJkwK.exe
2356	dtorqQt.exe
2352	APdFIsy.exe
2060	QpGKPdQ.exe
3228	kHsJxPv.exe
1944	GVOfgKU.exe
2148	GlGWRgl.exe
4816	npMmSvD.exe
3540	RUadOCx.exe
4328	YTLahDK.exe
1312	BOOsqxi.exe
1592	MsPiDzu.exe
3836	FjkRKlb.exe
2184	AyGxYqf.exe
2548	eqyBolD.exe
5008	PCqMpHG.exe
3612	chGnwvZ.exe
1392	xlCFHgC.exe
4912	xvFQyua.exe
220	LnzcSWN.exe
4172	wHhDfDA.exe
5112	KIHnCCq.exe
5012	DXXnRCe.exe
4456	NTdisco.exe
2276	VkXFYti.exe
1456	nljjhrl.exe
2428	lTlmMPz.exe
1460	jZkiyAe.exe
4792	PgSYIuQ.exe
4336	gKoALhe.exe
2988	onDLPAN.exe
2480	DRiKNvI.exe
5048	bOtIifH.exe
3508	hYwAHVv.exe
2072	jXwivZi.exe
424	QlkDlTv.exe
4644	itafGvm.exe
4640	iiJMSTD.exe
4528	WwZtAaN.exe
2264	KNUSwLT.exe
3616	qzyYUkv.exe
2844	UNgdvXC.exe
4412	bDieqrG.exe
4444	WPvuFCs.exe
4976	rKzuFug.exe
4560	axYyobB.exe
1896	aNxGnSn.exe
4324	uujXZHm.exe
3112	WwFzDkg.exe
2164	okCQtWb.exe
4688	xbivRZd.exe
1652	QRQvbSQ.exe
3488	MYHmVWP.exe
2740	fATrEcK.exe
2980	wKGXsBO.exe
4804	rDFKjbs.exe
2872	flCVGaN.exe
2308	UzuxeJw.exe
4320	yowClvC.exe
4372	ktdDVdV.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\rwnTNvI.exe	cb1f2fa5f4d91d9f929bc5fafd8884fb63d8515cc73b8aea3891fa2bf36e1926.exe
File created	C:\Windows\System\ulLYeqK.exe	cb1f2fa5f4d91d9f929bc5fafd8884fb63d8515cc73b8aea3891fa2bf36e1926.exe
File created	C:\Windows\System\rjdVtoQ.exe	cb1f2fa5f4d91d9f929bc5fafd8884fb63d8515cc73b8aea3891fa2bf36e1926.exe
File created	C:\Windows\System\WINYpiR.exe	cb1f2fa5f4d91d9f929bc5fafd8884fb63d8515cc73b8aea3891fa2bf36e1926.exe
File created	C:\Windows\System\gxVNVKZ.exe	cb1f2fa5f4d91d9f929bc5fafd8884fb63d8515cc73b8aea3891fa2bf36e1926.exe
File created	C:\Windows\System\fzIFMSD.exe	cb1f2fa5f4d91d9f929bc5fafd8884fb63d8515cc73b8aea3891fa2bf36e1926.exe
File created	C:\Windows\System\vYjJkwK.exe	cb1f2fa5f4d91d9f929bc5fafd8884fb63d8515cc73b8aea3891fa2bf36e1926.exe
File created	C:\Windows\System\szOujsn.exe	cb1f2fa5f4d91d9f929bc5fafd8884fb63d8515cc73b8aea3891fa2bf36e1926.exe
File created	C:\Windows\System\MUfFCmn.exe	cb1f2fa5f4d91d9f929bc5fafd8884fb63d8515cc73b8aea3891fa2bf36e1926.exe
File created	C:\Windows\System\IKIzRnR.exe	cb1f2fa5f4d91d9f929bc5fafd8884fb63d8515cc73b8aea3891fa2bf36e1926.exe
File created	C:\Windows\System\xvkLdoT.exe	cb1f2fa5f4d91d9f929bc5fafd8884fb63d8515cc73b8aea3891fa2bf36e1926.exe
File created	C:\Windows\System\bLvxnTe.exe	cb1f2fa5f4d91d9f929bc5fafd8884fb63d8515cc73b8aea3891fa2bf36e1926.exe
File created	C:\Windows\System\FixhHxE.exe	cb1f2fa5f4d91d9f929bc5fafd8884fb63d8515cc73b8aea3891fa2bf36e1926.exe
File created	C:\Windows\System\uMPsqNK.exe	cb1f2fa5f4d91d9f929bc5fafd8884fb63d8515cc73b8aea3891fa2bf36e1926.exe
File created	C:\Windows\System\fATrEcK.exe	cb1f2fa5f4d91d9f929bc5fafd8884fb63d8515cc73b8aea3891fa2bf36e1926.exe
File created	C:\Windows\System\xzYJYre.exe	cb1f2fa5f4d91d9f929bc5fafd8884fb63d8515cc73b8aea3891fa2bf36e1926.exe
File created	C:\Windows\System\yBMjLLM.exe	cb1f2fa5f4d91d9f929bc5fafd8884fb63d8515cc73b8aea3891fa2bf36e1926.exe
File created	C:\Windows\System\VBeQvDt.exe	cb1f2fa5f4d91d9f929bc5fafd8884fb63d8515cc73b8aea3891fa2bf36e1926.exe
File created	C:\Windows\System\POxrSDS.exe	cb1f2fa5f4d91d9f929bc5fafd8884fb63d8515cc73b8aea3891fa2bf36e1926.exe
File created	C:\Windows\System\uwPoghj.exe	cb1f2fa5f4d91d9f929bc5fafd8884fb63d8515cc73b8aea3891fa2bf36e1926.exe
File created	C:\Windows\System\VGAnoPl.exe	cb1f2fa5f4d91d9f929bc5fafd8884fb63d8515cc73b8aea3891fa2bf36e1926.exe
File created	C:\Windows\System\TscOthr.exe	cb1f2fa5f4d91d9f929bc5fafd8884fb63d8515cc73b8aea3891fa2bf36e1926.exe
File created	C:\Windows\System\gyeDiZT.exe	cb1f2fa5f4d91d9f929bc5fafd8884fb63d8515cc73b8aea3891fa2bf36e1926.exe
File created	C:\Windows\System\nJAxhsl.exe	cb1f2fa5f4d91d9f929bc5fafd8884fb63d8515cc73b8aea3891fa2bf36e1926.exe
File created	C:\Windows\System\PHuVRmu.exe	cb1f2fa5f4d91d9f929bc5fafd8884fb63d8515cc73b8aea3891fa2bf36e1926.exe
File created	C:\Windows\System\AFgcgZF.exe	cb1f2fa5f4d91d9f929bc5fafd8884fb63d8515cc73b8aea3891fa2bf36e1926.exe
File created	C:\Windows\System\uujXZHm.exe	cb1f2fa5f4d91d9f929bc5fafd8884fb63d8515cc73b8aea3891fa2bf36e1926.exe
File created	C:\Windows\System\xjoEdJt.exe	cb1f2fa5f4d91d9f929bc5fafd8884fb63d8515cc73b8aea3891fa2bf36e1926.exe
File created	C:\Windows\System\byGgSTo.exe	cb1f2fa5f4d91d9f929bc5fafd8884fb63d8515cc73b8aea3891fa2bf36e1926.exe
File created	C:\Windows\System\UMSxdKs.exe	cb1f2fa5f4d91d9f929bc5fafd8884fb63d8515cc73b8aea3891fa2bf36e1926.exe
File created	C:\Windows\System\vBltWTq.exe	cb1f2fa5f4d91d9f929bc5fafd8884fb63d8515cc73b8aea3891fa2bf36e1926.exe
File created	C:\Windows\System\HBaOWrp.exe	cb1f2fa5f4d91d9f929bc5fafd8884fb63d8515cc73b8aea3891fa2bf36e1926.exe
File created	C:\Windows\System\mYCaXXu.exe	cb1f2fa5f4d91d9f929bc5fafd8884fb63d8515cc73b8aea3891fa2bf36e1926.exe
File created	C:\Windows\System\NjfSoJF.exe	cb1f2fa5f4d91d9f929bc5fafd8884fb63d8515cc73b8aea3891fa2bf36e1926.exe
File created	C:\Windows\System\vJgpcCr.exe	cb1f2fa5f4d91d9f929bc5fafd8884fb63d8515cc73b8aea3891fa2bf36e1926.exe
File created	C:\Windows\System\CypanAe.exe	cb1f2fa5f4d91d9f929bc5fafd8884fb63d8515cc73b8aea3891fa2bf36e1926.exe
File created	C:\Windows\System\wimvVpY.exe	cb1f2fa5f4d91d9f929bc5fafd8884fb63d8515cc73b8aea3891fa2bf36e1926.exe
File created	C:\Windows\System\dWzmWqm.exe	cb1f2fa5f4d91d9f929bc5fafd8884fb63d8515cc73b8aea3891fa2bf36e1926.exe
File created	C:\Windows\System\mHBwlhV.exe	cb1f2fa5f4d91d9f929bc5fafd8884fb63d8515cc73b8aea3891fa2bf36e1926.exe
File created	C:\Windows\System\wEfAsAZ.exe	cb1f2fa5f4d91d9f929bc5fafd8884fb63d8515cc73b8aea3891fa2bf36e1926.exe
File created	C:\Windows\System\eqKDEmw.exe	cb1f2fa5f4d91d9f929bc5fafd8884fb63d8515cc73b8aea3891fa2bf36e1926.exe
File created	C:\Windows\System\OMSlLwF.exe	cb1f2fa5f4d91d9f929bc5fafd8884fb63d8515cc73b8aea3891fa2bf36e1926.exe
File created	C:\Windows\System\wkNqbXS.exe	cb1f2fa5f4d91d9f929bc5fafd8884fb63d8515cc73b8aea3891fa2bf36e1926.exe
File created	C:\Windows\System\geuORsu.exe	cb1f2fa5f4d91d9f929bc5fafd8884fb63d8515cc73b8aea3891fa2bf36e1926.exe
File created	C:\Windows\System\othJgIY.exe	cb1f2fa5f4d91d9f929bc5fafd8884fb63d8515cc73b8aea3891fa2bf36e1926.exe
File created	C:\Windows\System\pwgmYgB.exe	cb1f2fa5f4d91d9f929bc5fafd8884fb63d8515cc73b8aea3891fa2bf36e1926.exe
File created	C:\Windows\System\ouxlAGQ.exe	cb1f2fa5f4d91d9f929bc5fafd8884fb63d8515cc73b8aea3891fa2bf36e1926.exe
File created	C:\Windows\System\VBcKdio.exe	cb1f2fa5f4d91d9f929bc5fafd8884fb63d8515cc73b8aea3891fa2bf36e1926.exe
File created	C:\Windows\System\rwTBgJH.exe	cb1f2fa5f4d91d9f929bc5fafd8884fb63d8515cc73b8aea3891fa2bf36e1926.exe
File created	C:\Windows\System\UbqEPNd.exe	cb1f2fa5f4d91d9f929bc5fafd8884fb63d8515cc73b8aea3891fa2bf36e1926.exe
File created	C:\Windows\System\JOCbqeH.exe	cb1f2fa5f4d91d9f929bc5fafd8884fb63d8515cc73b8aea3891fa2bf36e1926.exe
File created	C:\Windows\System\lkBLxWv.exe	cb1f2fa5f4d91d9f929bc5fafd8884fb63d8515cc73b8aea3891fa2bf36e1926.exe
File created	C:\Windows\System\dZeWNDJ.exe	cb1f2fa5f4d91d9f929bc5fafd8884fb63d8515cc73b8aea3891fa2bf36e1926.exe
File created	C:\Windows\System\UCrDFXG.exe	cb1f2fa5f4d91d9f929bc5fafd8884fb63d8515cc73b8aea3891fa2bf36e1926.exe
File created	C:\Windows\System\YhASCEI.exe	cb1f2fa5f4d91d9f929bc5fafd8884fb63d8515cc73b8aea3891fa2bf36e1926.exe
File created	C:\Windows\System\mzwkopz.exe	cb1f2fa5f4d91d9f929bc5fafd8884fb63d8515cc73b8aea3891fa2bf36e1926.exe
File created	C:\Windows\System\MaJImLu.exe	cb1f2fa5f4d91d9f929bc5fafd8884fb63d8515cc73b8aea3891fa2bf36e1926.exe
File created	C:\Windows\System\wjGdhUh.exe	cb1f2fa5f4d91d9f929bc5fafd8884fb63d8515cc73b8aea3891fa2bf36e1926.exe
File created	C:\Windows\System\qgozxZb.exe	cb1f2fa5f4d91d9f929bc5fafd8884fb63d8515cc73b8aea3891fa2bf36e1926.exe
File created	C:\Windows\System\MRXEjxZ.exe	cb1f2fa5f4d91d9f929bc5fafd8884fb63d8515cc73b8aea3891fa2bf36e1926.exe
File created	C:\Windows\System\vSyptXv.exe	cb1f2fa5f4d91d9f929bc5fafd8884fb63d8515cc73b8aea3891fa2bf36e1926.exe
File created	C:\Windows\System\hBlkjVC.exe	cb1f2fa5f4d91d9f929bc5fafd8884fb63d8515cc73b8aea3891fa2bf36e1926.exe
File created	C:\Windows\System\DOHKlEG.exe	cb1f2fa5f4d91d9f929bc5fafd8884fb63d8515cc73b8aea3891fa2bf36e1926.exe
File created	C:\Windows\System\xSmLkFv.exe	cb1f2fa5f4d91d9f929bc5fafd8884fb63d8515cc73b8aea3891fa2bf36e1926.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	17364	dwm.exe
Token: SeChangeNotifyPrivilege	17364	dwm.exe
Token: 33	17364	dwm.exe
Token: SeIncBasePriorityPrivilege	17364	dwm.exe
Token: SeShutdownPrivilege	17364	dwm.exe
Token: SeCreatePagefilePrivilege	17364	dwm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4836 wrote to memory of 1136	4836	cb1f2fa5f4d91d9f929bc5fafd8884fb63d8515cc73b8aea3891fa2bf36e1926.exe	84
PID 4836 wrote to memory of 1136	4836	cb1f2fa5f4d91d9f929bc5fafd8884fb63d8515cc73b8aea3891fa2bf36e1926.exe	84
PID 4836 wrote to memory of 2644	4836	cb1f2fa5f4d91d9f929bc5fafd8884fb63d8515cc73b8aea3891fa2bf36e1926.exe	85
PID 4836 wrote to memory of 2644	4836	cb1f2fa5f4d91d9f929bc5fafd8884fb63d8515cc73b8aea3891fa2bf36e1926.exe	85
PID 4836 wrote to memory of 3164	4836	cb1f2fa5f4d91d9f929bc5fafd8884fb63d8515cc73b8aea3891fa2bf36e1926.exe	86
PID 4836 wrote to memory of 3164	4836	cb1f2fa5f4d91d9f929bc5fafd8884fb63d8515cc73b8aea3891fa2bf36e1926.exe	86
PID 4836 wrote to memory of 2296	4836	cb1f2fa5f4d91d9f929bc5fafd8884fb63d8515cc73b8aea3891fa2bf36e1926.exe	87
PID 4836 wrote to memory of 2296	4836	cb1f2fa5f4d91d9f929bc5fafd8884fb63d8515cc73b8aea3891fa2bf36e1926.exe	87
PID 4836 wrote to memory of 2652	4836	cb1f2fa5f4d91d9f929bc5fafd8884fb63d8515cc73b8aea3891fa2bf36e1926.exe	88
PID 4836 wrote to memory of 2652	4836	cb1f2fa5f4d91d9f929bc5fafd8884fb63d8515cc73b8aea3891fa2bf36e1926.exe	88
PID 4836 wrote to memory of 2356	4836	cb1f2fa5f4d91d9f929bc5fafd8884fb63d8515cc73b8aea3891fa2bf36e1926.exe	89
PID 4836 wrote to memory of 2356	4836	cb1f2fa5f4d91d9f929bc5fafd8884fb63d8515cc73b8aea3891fa2bf36e1926.exe	89
PID 4836 wrote to memory of 2352	4836	cb1f2fa5f4d91d9f929bc5fafd8884fb63d8515cc73b8aea3891fa2bf36e1926.exe	90
PID 4836 wrote to memory of 2352	4836	cb1f2fa5f4d91d9f929bc5fafd8884fb63d8515cc73b8aea3891fa2bf36e1926.exe	90
PID 4836 wrote to memory of 2060	4836	cb1f2fa5f4d91d9f929bc5fafd8884fb63d8515cc73b8aea3891fa2bf36e1926.exe	91
PID 4836 wrote to memory of 2060	4836	cb1f2fa5f4d91d9f929bc5fafd8884fb63d8515cc73b8aea3891fa2bf36e1926.exe	91
PID 4836 wrote to memory of 3228	4836	cb1f2fa5f4d91d9f929bc5fafd8884fb63d8515cc73b8aea3891fa2bf36e1926.exe	92
PID 4836 wrote to memory of 3228	4836	cb1f2fa5f4d91d9f929bc5fafd8884fb63d8515cc73b8aea3891fa2bf36e1926.exe	92
PID 4836 wrote to memory of 1944	4836	cb1f2fa5f4d91d9f929bc5fafd8884fb63d8515cc73b8aea3891fa2bf36e1926.exe	93
PID 4836 wrote to memory of 1944	4836	cb1f2fa5f4d91d9f929bc5fafd8884fb63d8515cc73b8aea3891fa2bf36e1926.exe	93
PID 4836 wrote to memory of 2148	4836	cb1f2fa5f4d91d9f929bc5fafd8884fb63d8515cc73b8aea3891fa2bf36e1926.exe	94
PID 4836 wrote to memory of 2148	4836	cb1f2fa5f4d91d9f929bc5fafd8884fb63d8515cc73b8aea3891fa2bf36e1926.exe	94
PID 4836 wrote to memory of 4816	4836	cb1f2fa5f4d91d9f929bc5fafd8884fb63d8515cc73b8aea3891fa2bf36e1926.exe	95
PID 4836 wrote to memory of 4816	4836	cb1f2fa5f4d91d9f929bc5fafd8884fb63d8515cc73b8aea3891fa2bf36e1926.exe	95
PID 4836 wrote to memory of 3540	4836	cb1f2fa5f4d91d9f929bc5fafd8884fb63d8515cc73b8aea3891fa2bf36e1926.exe	96
PID 4836 wrote to memory of 3540	4836	cb1f2fa5f4d91d9f929bc5fafd8884fb63d8515cc73b8aea3891fa2bf36e1926.exe	96
PID 4836 wrote to memory of 4328	4836	cb1f2fa5f4d91d9f929bc5fafd8884fb63d8515cc73b8aea3891fa2bf36e1926.exe	97
PID 4836 wrote to memory of 4328	4836	cb1f2fa5f4d91d9f929bc5fafd8884fb63d8515cc73b8aea3891fa2bf36e1926.exe	97
PID 4836 wrote to memory of 1312	4836	cb1f2fa5f4d91d9f929bc5fafd8884fb63d8515cc73b8aea3891fa2bf36e1926.exe	98
PID 4836 wrote to memory of 1312	4836	cb1f2fa5f4d91d9f929bc5fafd8884fb63d8515cc73b8aea3891fa2bf36e1926.exe	98
PID 4836 wrote to memory of 1592	4836	cb1f2fa5f4d91d9f929bc5fafd8884fb63d8515cc73b8aea3891fa2bf36e1926.exe	99
PID 4836 wrote to memory of 1592	4836	cb1f2fa5f4d91d9f929bc5fafd8884fb63d8515cc73b8aea3891fa2bf36e1926.exe	99
PID 4836 wrote to memory of 3836	4836	cb1f2fa5f4d91d9f929bc5fafd8884fb63d8515cc73b8aea3891fa2bf36e1926.exe	100
PID 4836 wrote to memory of 3836	4836	cb1f2fa5f4d91d9f929bc5fafd8884fb63d8515cc73b8aea3891fa2bf36e1926.exe	100
PID 4836 wrote to memory of 2184	4836	cb1f2fa5f4d91d9f929bc5fafd8884fb63d8515cc73b8aea3891fa2bf36e1926.exe	101
PID 4836 wrote to memory of 2184	4836	cb1f2fa5f4d91d9f929bc5fafd8884fb63d8515cc73b8aea3891fa2bf36e1926.exe	101
PID 4836 wrote to memory of 2548	4836	cb1f2fa5f4d91d9f929bc5fafd8884fb63d8515cc73b8aea3891fa2bf36e1926.exe	102
PID 4836 wrote to memory of 2548	4836	cb1f2fa5f4d91d9f929bc5fafd8884fb63d8515cc73b8aea3891fa2bf36e1926.exe	102
PID 4836 wrote to memory of 5008	4836	cb1f2fa5f4d91d9f929bc5fafd8884fb63d8515cc73b8aea3891fa2bf36e1926.exe	103
PID 4836 wrote to memory of 5008	4836	cb1f2fa5f4d91d9f929bc5fafd8884fb63d8515cc73b8aea3891fa2bf36e1926.exe	103
PID 4836 wrote to memory of 3612	4836	cb1f2fa5f4d91d9f929bc5fafd8884fb63d8515cc73b8aea3891fa2bf36e1926.exe	104
PID 4836 wrote to memory of 3612	4836	cb1f2fa5f4d91d9f929bc5fafd8884fb63d8515cc73b8aea3891fa2bf36e1926.exe	104
PID 4836 wrote to memory of 1392	4836	cb1f2fa5f4d91d9f929bc5fafd8884fb63d8515cc73b8aea3891fa2bf36e1926.exe	105
PID 4836 wrote to memory of 1392	4836	cb1f2fa5f4d91d9f929bc5fafd8884fb63d8515cc73b8aea3891fa2bf36e1926.exe	105
PID 4836 wrote to memory of 4912	4836	cb1f2fa5f4d91d9f929bc5fafd8884fb63d8515cc73b8aea3891fa2bf36e1926.exe	106
PID 4836 wrote to memory of 4912	4836	cb1f2fa5f4d91d9f929bc5fafd8884fb63d8515cc73b8aea3891fa2bf36e1926.exe	106
PID 4836 wrote to memory of 220	4836	cb1f2fa5f4d91d9f929bc5fafd8884fb63d8515cc73b8aea3891fa2bf36e1926.exe	107
PID 4836 wrote to memory of 220	4836	cb1f2fa5f4d91d9f929bc5fafd8884fb63d8515cc73b8aea3891fa2bf36e1926.exe	107
PID 4836 wrote to memory of 4172	4836	cb1f2fa5f4d91d9f929bc5fafd8884fb63d8515cc73b8aea3891fa2bf36e1926.exe	108
PID 4836 wrote to memory of 4172	4836	cb1f2fa5f4d91d9f929bc5fafd8884fb63d8515cc73b8aea3891fa2bf36e1926.exe	108
PID 4836 wrote to memory of 5112	4836	cb1f2fa5f4d91d9f929bc5fafd8884fb63d8515cc73b8aea3891fa2bf36e1926.exe	109
PID 4836 wrote to memory of 5112	4836	cb1f2fa5f4d91d9f929bc5fafd8884fb63d8515cc73b8aea3891fa2bf36e1926.exe	109
PID 4836 wrote to memory of 5012	4836	cb1f2fa5f4d91d9f929bc5fafd8884fb63d8515cc73b8aea3891fa2bf36e1926.exe	110
PID 4836 wrote to memory of 5012	4836	cb1f2fa5f4d91d9f929bc5fafd8884fb63d8515cc73b8aea3891fa2bf36e1926.exe	110
PID 4836 wrote to memory of 4456	4836	cb1f2fa5f4d91d9f929bc5fafd8884fb63d8515cc73b8aea3891fa2bf36e1926.exe	111
PID 4836 wrote to memory of 4456	4836	cb1f2fa5f4d91d9f929bc5fafd8884fb63d8515cc73b8aea3891fa2bf36e1926.exe	111
PID 4836 wrote to memory of 2276	4836	cb1f2fa5f4d91d9f929bc5fafd8884fb63d8515cc73b8aea3891fa2bf36e1926.exe	112
PID 4836 wrote to memory of 2276	4836	cb1f2fa5f4d91d9f929bc5fafd8884fb63d8515cc73b8aea3891fa2bf36e1926.exe	112
PID 4836 wrote to memory of 1456	4836	cb1f2fa5f4d91d9f929bc5fafd8884fb63d8515cc73b8aea3891fa2bf36e1926.exe	113
PID 4836 wrote to memory of 1456	4836	cb1f2fa5f4d91d9f929bc5fafd8884fb63d8515cc73b8aea3891fa2bf36e1926.exe	113
PID 4836 wrote to memory of 2428	4836	cb1f2fa5f4d91d9f929bc5fafd8884fb63d8515cc73b8aea3891fa2bf36e1926.exe	114
PID 4836 wrote to memory of 2428	4836	cb1f2fa5f4d91d9f929bc5fafd8884fb63d8515cc73b8aea3891fa2bf36e1926.exe	114
PID 4836 wrote to memory of 1460	4836	cb1f2fa5f4d91d9f929bc5fafd8884fb63d8515cc73b8aea3891fa2bf36e1926.exe	115
PID 4836 wrote to memory of 1460	4836	cb1f2fa5f4d91d9f929bc5fafd8884fb63d8515cc73b8aea3891fa2bf36e1926.exe	115

C:\Users\Admin\AppData\Local\Temp\cb1f2fa5f4d91d9f929bc5fafd8884fb63d8515cc73b8aea3891fa2bf36e1926.exe
"C:\Users\Admin\AppData\Local\Temp\cb1f2fa5f4d91d9f929bc5fafd8884fb63d8515cc73b8aea3891fa2bf36e1926.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4836
- C:\Windows\System\fRPQGqe.exe
  C:\Windows\System\fRPQGqe.exe
  2⤵
  - Executes dropped EXE
  PID:1136
- C:\Windows\System\IlKYefM.exe
  C:\Windows\System\IlKYefM.exe
  2⤵
  - Executes dropped EXE
  PID:2644
- C:\Windows\System\yngpnrG.exe
  C:\Windows\System\yngpnrG.exe
  2⤵
  - Executes dropped EXE
  PID:3164
- C:\Windows\System\nuBLYSt.exe
  C:\Windows\System\nuBLYSt.exe
  2⤵
  - Executes dropped EXE
  PID:2296
- C:\Windows\System\vYjJkwK.exe
  C:\Windows\System\vYjJkwK.exe
  2⤵
  - Executes dropped EXE
  PID:2652
- C:\Windows\System\dtorqQt.exe
  C:\Windows\System\dtorqQt.exe
  2⤵
  - Executes dropped EXE
  PID:2356
- C:\Windows\System\APdFIsy.exe
  C:\Windows\System\APdFIsy.exe
  2⤵
  - Executes dropped EXE
  PID:2352
- C:\Windows\System\QpGKPdQ.exe
  C:\Windows\System\QpGKPdQ.exe
  2⤵
  - Executes dropped EXE
  PID:2060
- C:\Windows\System\kHsJxPv.exe
  C:\Windows\System\kHsJxPv.exe
  2⤵
  - Executes dropped EXE
  PID:3228
- C:\Windows\System\GVOfgKU.exe
  C:\Windows\System\GVOfgKU.exe
  2⤵
  - Executes dropped EXE
  PID:1944
- C:\Windows\System\GlGWRgl.exe
  C:\Windows\System\GlGWRgl.exe
  2⤵
  - Executes dropped EXE
  PID:2148
- C:\Windows\System\npMmSvD.exe
  C:\Windows\System\npMmSvD.exe
  2⤵
  - Executes dropped EXE
  PID:4816
- C:\Windows\System\RUadOCx.exe
  C:\Windows\System\RUadOCx.exe
  2⤵
  - Executes dropped EXE
  PID:3540
- C:\Windows\System\YTLahDK.exe
  C:\Windows\System\YTLahDK.exe
  2⤵
  - Executes dropped EXE
  PID:4328
- C:\Windows\System\BOOsqxi.exe
  C:\Windows\System\BOOsqxi.exe
  2⤵
  - Executes dropped EXE
  PID:1312
- C:\Windows\System\MsPiDzu.exe
  C:\Windows\System\MsPiDzu.exe
  2⤵
  - Executes dropped EXE
  PID:1592
- C:\Windows\System\FjkRKlb.exe
  C:\Windows\System\FjkRKlb.exe
  2⤵
  - Executes dropped EXE
  PID:3836
- C:\Windows\System\AyGxYqf.exe
  C:\Windows\System\AyGxYqf.exe
  2⤵
  - Executes dropped EXE
  PID:2184
- C:\Windows\System\eqyBolD.exe
  C:\Windows\System\eqyBolD.exe
  2⤵
  - Executes dropped EXE
  PID:2548
- C:\Windows\System\PCqMpHG.exe
  C:\Windows\System\PCqMpHG.exe
  2⤵
  - Executes dropped EXE
  PID:5008
- C:\Windows\System\chGnwvZ.exe
  C:\Windows\System\chGnwvZ.exe
  2⤵
  - Executes dropped EXE
  PID:3612
- C:\Windows\System\xlCFHgC.exe
  C:\Windows\System\xlCFHgC.exe
  2⤵
  - Executes dropped EXE
  PID:1392
- C:\Windows\System\xvFQyua.exe
  C:\Windows\System\xvFQyua.exe
  2⤵
  - Executes dropped EXE
  PID:4912
- C:\Windows\System\LnzcSWN.exe
  C:\Windows\System\LnzcSWN.exe
  2⤵
  - Executes dropped EXE
  PID:220
- C:\Windows\System\wHhDfDA.exe
  C:\Windows\System\wHhDfDA.exe
  2⤵
  - Executes dropped EXE
  PID:4172
- C:\Windows\System\KIHnCCq.exe
  C:\Windows\System\KIHnCCq.exe
  2⤵
  - Executes dropped EXE
  PID:5112
- C:\Windows\System\DXXnRCe.exe
  C:\Windows\System\DXXnRCe.exe
  2⤵
  - Executes dropped EXE
  PID:5012
- C:\Windows\System\NTdisco.exe
  C:\Windows\System\NTdisco.exe
  2⤵
  - Executes dropped EXE
  PID:4456
- C:\Windows\System\VkXFYti.exe
  C:\Windows\System\VkXFYti.exe
  2⤵
  - Executes dropped EXE
  PID:2276
- C:\Windows\System\nljjhrl.exe
  C:\Windows\System\nljjhrl.exe
  2⤵
  - Executes dropped EXE
  PID:1456
- C:\Windows\System\lTlmMPz.exe
  C:\Windows\System\lTlmMPz.exe
  2⤵
  - Executes dropped EXE
  PID:2428
- C:\Windows\System\jZkiyAe.exe
  C:\Windows\System\jZkiyAe.exe
  2⤵
  - Executes dropped EXE
  PID:1460
- C:\Windows\System\PgSYIuQ.exe
  C:\Windows\System\PgSYIuQ.exe
  2⤵
  - Executes dropped EXE
  PID:4792
- C:\Windows\System\gKoALhe.exe
  C:\Windows\System\gKoALhe.exe
  2⤵
  - Executes dropped EXE
  PID:4336
- C:\Windows\System\onDLPAN.exe
  C:\Windows\System\onDLPAN.exe
  2⤵
  - Executes dropped EXE
  PID:2988
- C:\Windows\System\DRiKNvI.exe
  C:\Windows\System\DRiKNvI.exe
  2⤵
  - Executes dropped EXE
  PID:2480
- C:\Windows\System\bOtIifH.exe
  C:\Windows\System\bOtIifH.exe
  2⤵
  - Executes dropped EXE
  PID:5048
- C:\Windows\System\hYwAHVv.exe
  C:\Windows\System\hYwAHVv.exe
  2⤵
  - Executes dropped EXE
  PID:3508
- C:\Windows\System\jXwivZi.exe
  C:\Windows\System\jXwivZi.exe
  2⤵
  - Executes dropped EXE
  PID:2072
- C:\Windows\System\QlkDlTv.exe
  C:\Windows\System\QlkDlTv.exe
  2⤵
  - Executes dropped EXE
  PID:424
- C:\Windows\System\itafGvm.exe
  C:\Windows\System\itafGvm.exe
  2⤵
  - Executes dropped EXE
  PID:4644
- C:\Windows\System\iiJMSTD.exe
  C:\Windows\System\iiJMSTD.exe
  2⤵
  - Executes dropped EXE
  PID:4640
- C:\Windows\System\WwZtAaN.exe
  C:\Windows\System\WwZtAaN.exe
  2⤵
  - Executes dropped EXE
  PID:4528
- C:\Windows\System\KNUSwLT.exe
  C:\Windows\System\KNUSwLT.exe
  2⤵
  - Executes dropped EXE
  PID:2264
- C:\Windows\System\qzyYUkv.exe
  C:\Windows\System\qzyYUkv.exe
  2⤵
  - Executes dropped EXE
  PID:3616
- C:\Windows\System\UNgdvXC.exe
  C:\Windows\System\UNgdvXC.exe
  2⤵
  - Executes dropped EXE
  PID:2844
- C:\Windows\System\bDieqrG.exe
  C:\Windows\System\bDieqrG.exe
  2⤵
  - Executes dropped EXE
  PID:4412
- C:\Windows\System\WPvuFCs.exe
  C:\Windows\System\WPvuFCs.exe
  2⤵
  - Executes dropped EXE
  PID:4444
- C:\Windows\System\rKzuFug.exe
  C:\Windows\System\rKzuFug.exe
  2⤵
  - Executes dropped EXE
  PID:4976
- C:\Windows\System\axYyobB.exe
  C:\Windows\System\axYyobB.exe
  2⤵
  - Executes dropped EXE
  PID:4560
- C:\Windows\System\aNxGnSn.exe
  C:\Windows\System\aNxGnSn.exe
  2⤵
  - Executes dropped EXE
  PID:1896
- C:\Windows\System\uujXZHm.exe
  C:\Windows\System\uujXZHm.exe
  2⤵
  - Executes dropped EXE
  PID:4324
- C:\Windows\System\WwFzDkg.exe
  C:\Windows\System\WwFzDkg.exe
  2⤵
  - Executes dropped EXE
  PID:3112
- C:\Windows\System\okCQtWb.exe
  C:\Windows\System\okCQtWb.exe
  2⤵
  - Executes dropped EXE
  PID:2164
- C:\Windows\System\xbivRZd.exe
  C:\Windows\System\xbivRZd.exe
  2⤵
  - Executes dropped EXE
  PID:4688
- C:\Windows\System\QRQvbSQ.exe
  C:\Windows\System\QRQvbSQ.exe
  2⤵
  - Executes dropped EXE
  PID:1652
- C:\Windows\System\MYHmVWP.exe
  C:\Windows\System\MYHmVWP.exe
  2⤵
  - Executes dropped EXE
  PID:3488
- C:\Windows\System\fATrEcK.exe
  C:\Windows\System\fATrEcK.exe
  2⤵
  - Executes dropped EXE
  PID:2740
- C:\Windows\System\wKGXsBO.exe
  C:\Windows\System\wKGXsBO.exe
  2⤵
  - Executes dropped EXE
  PID:2980
- C:\Windows\System\rDFKjbs.exe
  C:\Windows\System\rDFKjbs.exe
  2⤵
  - Executes dropped EXE
  PID:4804
- C:\Windows\System\flCVGaN.exe
  C:\Windows\System\flCVGaN.exe
  2⤵
  - Executes dropped EXE
  PID:2872
- C:\Windows\System\UzuxeJw.exe
  C:\Windows\System\UzuxeJw.exe
  2⤵
  - Executes dropped EXE
  PID:2308
- C:\Windows\System\yowClvC.exe
  C:\Windows\System\yowClvC.exe
  2⤵
  - Executes dropped EXE
  PID:4320
- C:\Windows\System\ktdDVdV.exe
  C:\Windows\System\ktdDVdV.exe
  2⤵
  - Executes dropped EXE
  PID:4372
- C:\Windows\System\tRQIdqu.exe
  C:\Windows\System\tRQIdqu.exe
  2⤵
  PID:1932
- C:\Windows\System\sfmPeio.exe
  C:\Windows\System\sfmPeio.exe
  2⤵
  PID:3716
- C:\Windows\System\avSROgJ.exe
  C:\Windows\System\avSROgJ.exe
  2⤵
  PID:2316
- C:\Windows\System\sWjUBwm.exe
  C:\Windows\System\sWjUBwm.exe
  2⤵
  PID:1876
- C:\Windows\System\UMqSvvU.exe
  C:\Windows\System\UMqSvvU.exe
  2⤵
  PID:4596
- C:\Windows\System\jcsyOao.exe
  C:\Windows\System\jcsyOao.exe
  2⤵
  PID:2292
- C:\Windows\System\ikyTJpV.exe
  C:\Windows\System\ikyTJpV.exe
  2⤵
  PID:3252
- C:\Windows\System\pwgmYgB.exe
  C:\Windows\System\pwgmYgB.exe
  2⤵
  PID:3452
- C:\Windows\System\OWpYfTC.exe
  C:\Windows\System\OWpYfTC.exe
  2⤵
  PID:3416
- C:\Windows\System\KHdplLQ.exe
  C:\Windows\System\KHdplLQ.exe
  2⤵
  PID:5148
- C:\Windows\System\TZQgWql.exe
  C:\Windows\System\TZQgWql.exe
  2⤵
  PID:5176
- C:\Windows\System\KjvyAZW.exe
  C:\Windows\System\KjvyAZW.exe
  2⤵
  PID:5204
- C:\Windows\System\FTFPOdb.exe
  C:\Windows\System\FTFPOdb.exe
  2⤵
  PID:5232
- C:\Windows\System\jcxvjoX.exe
  C:\Windows\System\jcxvjoX.exe
  2⤵
  PID:5260
- C:\Windows\System\iQUTcwv.exe
  C:\Windows\System\iQUTcwv.exe
  2⤵
  PID:5284
- C:\Windows\System\wMoTkVq.exe
  C:\Windows\System\wMoTkVq.exe
  2⤵
  PID:5316
- C:\Windows\System\eqKDEmw.exe
  C:\Windows\System\eqKDEmw.exe
  2⤵
  PID:5344
- C:\Windows\System\xRAdZRV.exe
  C:\Windows\System\xRAdZRV.exe
  2⤵
  PID:5372
- C:\Windows\System\IuGVIjW.exe
  C:\Windows\System\IuGVIjW.exe
  2⤵
  PID:5400
- C:\Windows\System\uyCWJFP.exe
  C:\Windows\System\uyCWJFP.exe
  2⤵
  PID:5428
- C:\Windows\System\INUEzsU.exe
  C:\Windows\System\INUEzsU.exe
  2⤵
  PID:5452
- C:\Windows\System\TjrzUfq.exe
  C:\Windows\System\TjrzUfq.exe
  2⤵
  PID:5480
- C:\Windows\System\QPblTlM.exe
  C:\Windows\System\QPblTlM.exe
  2⤵
  PID:5512
- C:\Windows\System\szOujsn.exe
  C:\Windows\System\szOujsn.exe
  2⤵
  PID:5540
- C:\Windows\System\yODyFRJ.exe
  C:\Windows\System\yODyFRJ.exe
  2⤵
  PID:5568
- C:\Windows\System\ZcFWwIh.exe
  C:\Windows\System\ZcFWwIh.exe
  2⤵
  PID:5596
- C:\Windows\System\MOfMDEM.exe
  C:\Windows\System\MOfMDEM.exe
  2⤵
  PID:5620
- C:\Windows\System\sFNRaoZ.exe
  C:\Windows\System\sFNRaoZ.exe
  2⤵
  PID:5648
- C:\Windows\System\NYOAlca.exe
  C:\Windows\System\NYOAlca.exe
  2⤵
  PID:5680
- C:\Windows\System\FyjgsmJ.exe
  C:\Windows\System\FyjgsmJ.exe
  2⤵
  PID:5708
- C:\Windows\System\FHfMhjl.exe
  C:\Windows\System\FHfMhjl.exe
  2⤵
  PID:5736
- C:\Windows\System\SBJDWMv.exe
  C:\Windows\System\SBJDWMv.exe
  2⤵
  PID:5764
- C:\Windows\System\tYOzZGg.exe
  C:\Windows\System\tYOzZGg.exe
  2⤵
  PID:5792
- C:\Windows\System\qgozxZb.exe
  C:\Windows\System\qgozxZb.exe
  2⤵
  PID:5820
- C:\Windows\System\mfIIEnh.exe
  C:\Windows\System\mfIIEnh.exe
  2⤵
  PID:5844
- C:\Windows\System\ocXXoCR.exe
  C:\Windows\System\ocXXoCR.exe
  2⤵
  PID:5876
- C:\Windows\System\HlhcCZg.exe
  C:\Windows\System\HlhcCZg.exe
  2⤵
  PID:5900
- C:\Windows\System\UCrDFXG.exe
  C:\Windows\System\UCrDFXG.exe
  2⤵
  PID:5932
- C:\Windows\System\opahMQQ.exe
  C:\Windows\System\opahMQQ.exe
  2⤵
  PID:5960
- C:\Windows\System\zsaIbeF.exe
  C:\Windows\System\zsaIbeF.exe
  2⤵
  PID:5988
- C:\Windows\System\mVsIHUv.exe
  C:\Windows\System\mVsIHUv.exe
  2⤵
  PID:6016
- C:\Windows\System\paWQTne.exe
  C:\Windows\System\paWQTne.exe
  2⤵
  PID:6044
- C:\Windows\System\NyxaCvU.exe
  C:\Windows\System\NyxaCvU.exe
  2⤵
  PID:6068
- C:\Windows\System\HdXjprT.exe
  C:\Windows\System\HdXjprT.exe
  2⤵
  PID:6096
- C:\Windows\System\zGsrHEC.exe
  C:\Windows\System\zGsrHEC.exe
  2⤵
  PID:6124
- C:\Windows\System\wHnwkCO.exe
  C:\Windows\System\wHnwkCO.exe
  2⤵
  PID:2840
- C:\Windows\System\tkLEhPL.exe
  C:\Windows\System\tkLEhPL.exe
  2⤵
  PID:4668
- C:\Windows\System\tFypmne.exe
  C:\Windows\System\tFypmne.exe
  2⤵
  PID:2248
- C:\Windows\System\gAXwFPR.exe
  C:\Windows\System\gAXwFPR.exe
  2⤵
  PID:1612
- C:\Windows\System\AzlPTrA.exe
  C:\Windows\System\AzlPTrA.exe
  2⤵
  PID:1528
- C:\Windows\System\dUJaiJS.exe
  C:\Windows\System\dUJaiJS.exe
  2⤵
  PID:5032
- C:\Windows\System\NSnERZm.exe
  C:\Windows\System\NSnERZm.exe
  2⤵
  PID:5240
- C:\Windows\System\GSNPywJ.exe
  C:\Windows\System\GSNPywJ.exe
  2⤵
  PID:5276
- C:\Windows\System\mNxNjBY.exe
  C:\Windows\System\mNxNjBY.exe
  2⤵
  PID:5304
- C:\Windows\System\yQlOiWE.exe
  C:\Windows\System\yQlOiWE.exe
  2⤵
  PID:5364
- C:\Windows\System\vpkNOlX.exe
  C:\Windows\System\vpkNOlX.exe
  2⤵
  PID:5416
- C:\Windows\System\ocCuTKS.exe
  C:\Windows\System\ocCuTKS.exe
  2⤵
  PID:5468
- C:\Windows\System\CimZmkj.exe
  C:\Windows\System\CimZmkj.exe
  2⤵
  PID:5532
- C:\Windows\System\oSMeSTU.exe
  C:\Windows\System\oSMeSTU.exe
  2⤵
  PID:5604
- C:\Windows\System\oqWPtua.exe
  C:\Windows\System\oqWPtua.exe
  2⤵
  PID:5664
- C:\Windows\System\gxVNVKZ.exe
  C:\Windows\System\gxVNVKZ.exe
  2⤵
  PID:5728
- C:\Windows\System\gFyHgfl.exe
  C:\Windows\System\gFyHgfl.exe
  2⤵
  PID:4504
- C:\Windows\System\zYhPMzQ.exe
  C:\Windows\System\zYhPMzQ.exe
  2⤵
  PID:5860
- C:\Windows\System\RbQelxQ.exe
  C:\Windows\System\RbQelxQ.exe
  2⤵
  PID:5920
- C:\Windows\System\rAUXLyZ.exe
  C:\Windows\System\rAUXLyZ.exe
  2⤵
  PID:6008
- C:\Windows\System\HZmsrDi.exe
  C:\Windows\System\HZmsrDi.exe
  2⤵
  PID:6120
- C:\Windows\System\UgXGxTW.exe
  C:\Windows\System\UgXGxTW.exe
  2⤵
  PID:4700
- C:\Windows\System\iTPMafc.exe
  C:\Windows\System\iTPMafc.exe
  2⤵
  PID:4028
- C:\Windows\System\kMcdHAX.exe
  C:\Windows\System\kMcdHAX.exe
  2⤵
  PID:3516
- C:\Windows\System\LFudmYo.exe
  C:\Windows\System\LFudmYo.exe
  2⤵
  PID:5464
- C:\Windows\System\SXQURCN.exe
  C:\Windows\System\SXQURCN.exe
  2⤵
  PID:5584
- C:\Windows\System\SeCHQRU.exe
  C:\Windows\System\SeCHQRU.exe
  2⤵
  PID:5716
- C:\Windows\System\gfPafPZ.exe
  C:\Windows\System\gfPafPZ.exe
  2⤵
  PID:3304
- C:\Windows\System\HtsMqKN.exe
  C:\Windows\System\HtsMqKN.exe
  2⤵
  PID:5884
- C:\Windows\System\ZOeLrCz.exe
  C:\Windows\System\ZOeLrCz.exe
  2⤵
  PID:5996
- C:\Windows\System\xHTdgsX.exe
  C:\Windows\System\xHTdgsX.exe
  2⤵
  PID:2632
- C:\Windows\System\UamevCu.exe
  C:\Windows\System\UamevCu.exe
  2⤵
  PID:1660
- C:\Windows\System\tYFEMRZ.exe
  C:\Windows\System\tYFEMRZ.exe
  2⤵
  PID:3476
- C:\Windows\System\ngPBwvU.exe
  C:\Windows\System\ngPBwvU.exe
  2⤵
  PID:4672
- C:\Windows\System\WQFsRRs.exe
  C:\Windows\System\WQFsRRs.exe
  2⤵
  PID:756
- C:\Windows\System\zHiZtaQ.exe
  C:\Windows\System\zHiZtaQ.exe
  2⤵
  PID:5392
- C:\Windows\System\zooLCFQ.exe
  C:\Windows\System\zooLCFQ.exe
  2⤵
  PID:1232
- C:\Windows\System\shiVRsu.exe
  C:\Windows\System\shiVRsu.exe
  2⤵
  PID:3656
- C:\Windows\System\ZFcXDLH.exe
  C:\Windows\System\ZFcXDLH.exe
  2⤵
  PID:5636
- C:\Windows\System\nZyviIA.exe
  C:\Windows\System\nZyviIA.exe
  2⤵
  PID:4392
- C:\Windows\System\qSFbGyj.exe
  C:\Windows\System\qSFbGyj.exe
  2⤵
  PID:2220
- C:\Windows\System\rRrWooR.exe
  C:\Windows\System\rRrWooR.exe
  2⤵
  PID:6060
- C:\Windows\System\gydBshf.exe
  C:\Windows\System\gydBshf.exe
  2⤵
  PID:6080
- C:\Windows\System\wDrEGHm.exe
  C:\Windows\System\wDrEGHm.exe
  2⤵
  PID:3908
- C:\Windows\System\wAxLGTE.exe
  C:\Windows\System\wAxLGTE.exe
  2⤵
  PID:4924
- C:\Windows\System\vMnpiJw.exe
  C:\Windows\System\vMnpiJw.exe
  2⤵
  PID:4556
- C:\Windows\System\MRXEjxZ.exe
  C:\Windows\System\MRXEjxZ.exe
  2⤵
  PID:4192
- C:\Windows\System\cAdpCIf.exe
  C:\Windows\System\cAdpCIf.exe
  2⤵
  PID:5576
- C:\Windows\System\IVgYFqU.exe
  C:\Windows\System\IVgYFqU.exe
  2⤵
  PID:3216
- C:\Windows\System\yhjcRAf.exe
  C:\Windows\System\yhjcRAf.exe
  2⤵
  PID:1320
- C:\Windows\System\LtGgGHN.exe
  C:\Windows\System\LtGgGHN.exe
  2⤵
  PID:244
- C:\Windows\System\nFEJLFH.exe
  C:\Windows\System\nFEJLFH.exe
  2⤵
  PID:2144
- C:\Windows\System\XyHIkzq.exe
  C:\Windows\System\XyHIkzq.exe
  2⤵
  PID:4904
- C:\Windows\System\KYpJNnr.exe
  C:\Windows\System\KYpJNnr.exe
  2⤵
  PID:3444
- C:\Windows\System\yVWfWcO.exe
  C:\Windows\System\yVWfWcO.exe
  2⤵
  PID:652
- C:\Windows\System\HPhxypW.exe
  C:\Windows\System\HPhxypW.exe
  2⤵
  PID:4656
- C:\Windows\System\MagsRFx.exe
  C:\Windows\System\MagsRFx.exe
  2⤵
  PID:2212
- C:\Windows\System\JFZDrvJ.exe
  C:\Windows\System\JFZDrvJ.exe
  2⤵
  PID:6228
- C:\Windows\System\xbwCLoN.exe
  C:\Windows\System\xbwCLoN.exe
  2⤵
  PID:6244
- C:\Windows\System\ysvfmuY.exe
  C:\Windows\System\ysvfmuY.exe
  2⤵
  PID:6260
- C:\Windows\System\qaHZpsu.exe
  C:\Windows\System\qaHZpsu.exe
  2⤵
  PID:6280
- C:\Windows\System\zchjHjp.exe
  C:\Windows\System\zchjHjp.exe
  2⤵
  PID:6296
- C:\Windows\System\JmYcNAr.exe
  C:\Windows\System\JmYcNAr.exe
  2⤵
  PID:6324
- C:\Windows\System\cZpmjKD.exe
  C:\Windows\System\cZpmjKD.exe
  2⤵
  PID:6356
- C:\Windows\System\pnISYuB.exe
  C:\Windows\System\pnISYuB.exe
  2⤵
  PID:6372
- C:\Windows\System\ibBWjSr.exe
  C:\Windows\System\ibBWjSr.exe
  2⤵
  PID:6428
- C:\Windows\System\nQZloOz.exe
  C:\Windows\System\nQZloOz.exe
  2⤵
  PID:6480
- C:\Windows\System\OMSlLwF.exe
  C:\Windows\System\OMSlLwF.exe
  2⤵
  PID:6508
- C:\Windows\System\ESpJSBA.exe
  C:\Windows\System\ESpJSBA.exe
  2⤵
  PID:6544
- C:\Windows\System\rQJvGrk.exe
  C:\Windows\System\rQJvGrk.exe
  2⤵
  PID:6568
- C:\Windows\System\xzYJYre.exe
  C:\Windows\System\xzYJYre.exe
  2⤵
  PID:6632
- C:\Windows\System\IkBIJzQ.exe
  C:\Windows\System\IkBIJzQ.exe
  2⤵
  PID:6676
- C:\Windows\System\FwmiDhL.exe
  C:\Windows\System\FwmiDhL.exe
  2⤵
  PID:6700
- C:\Windows\System\rACRuMv.exe
  C:\Windows\System\rACRuMv.exe
  2⤵
  PID:6720
- C:\Windows\System\kAeIljI.exe
  C:\Windows\System\kAeIljI.exe
  2⤵
  PID:6736
- C:\Windows\System\xWKKfyB.exe
  C:\Windows\System\xWKKfyB.exe
  2⤵
  PID:6760
- C:\Windows\System\kNoFhXG.exe
  C:\Windows\System\kNoFhXG.exe
  2⤵
  PID:6784
- C:\Windows\System\vSyptXv.exe
  C:\Windows\System\vSyptXv.exe
  2⤵
  PID:6812
- C:\Windows\System\OLsMJcU.exe
  C:\Windows\System\OLsMJcU.exe
  2⤵
  PID:6856
- C:\Windows\System\wtDWhTz.exe
  C:\Windows\System\wtDWhTz.exe
  2⤵
  PID:6884
- C:\Windows\System\BdIFFsO.exe
  C:\Windows\System\BdIFFsO.exe
  2⤵
  PID:6912
- C:\Windows\System\ItgsBwp.exe
  C:\Windows\System\ItgsBwp.exe
  2⤵
  PID:6940
- C:\Windows\System\yeaeieR.exe
  C:\Windows\System\yeaeieR.exe
  2⤵
  PID:6996
- C:\Windows\System\JYUtbtN.exe
  C:\Windows\System\JYUtbtN.exe
  2⤵
  PID:7020
- C:\Windows\System\dPphFSi.exe
  C:\Windows\System\dPphFSi.exe
  2⤵
  PID:7052
- C:\Windows\System\aIfhBhd.exe
  C:\Windows\System\aIfhBhd.exe
  2⤵
  PID:7076
- C:\Windows\System\lwEgQaF.exe
  C:\Windows\System\lwEgQaF.exe
  2⤵
  PID:7104
- C:\Windows\System\XoVorjh.exe
  C:\Windows\System\XoVorjh.exe
  2⤵
  PID:7140
- C:\Windows\System\LRNeHKa.exe
  C:\Windows\System\LRNeHKa.exe
  2⤵
  PID:7160
- C:\Windows\System\WLogrTY.exe
  C:\Windows\System\WLogrTY.exe
  2⤵
  PID:4884
- C:\Windows\System\dNQKCoo.exe
  C:\Windows\System\dNQKCoo.exe
  2⤵
  PID:1428
- C:\Windows\System\LLPTSrT.exe
  C:\Windows\System\LLPTSrT.exe
  2⤵
  PID:3264
- C:\Windows\System\QEnbwKJ.exe
  C:\Windows\System\QEnbwKJ.exe
  2⤵
  PID:6164
- C:\Windows\System\HuPvBdy.exe
  C:\Windows\System\HuPvBdy.exe
  2⤵
  PID:6268
- C:\Windows\System\ayYrnSp.exe
  C:\Windows\System\ayYrnSp.exe
  2⤵
  PID:6352
- C:\Windows\System\ehgfNVL.exe
  C:\Windows\System\ehgfNVL.exe
  2⤵
  PID:6368
- C:\Windows\System\BRCfEfu.exe
  C:\Windows\System\BRCfEfu.exe
  2⤵
  PID:6240
- C:\Windows\System\yBMjLLM.exe
  C:\Windows\System\yBMjLLM.exe
  2⤵
  PID:6476
- C:\Windows\System\ncJHvPP.exe
  C:\Windows\System\ncJHvPP.exe
  2⤵
  PID:6536
- C:\Windows\System\tCzSxHc.exe
  C:\Windows\System\tCzSxHc.exe
  2⤵
  PID:6692
- C:\Windows\System\lboZzUK.exe
  C:\Windows\System\lboZzUK.exe
  2⤵
  PID:6608
- C:\Windows\System\fRiDjDE.exe
  C:\Windows\System\fRiDjDE.exe
  2⤵
  PID:6732
- C:\Windows\System\YtoHnZv.exe
  C:\Windows\System\YtoHnZv.exe
  2⤵
  PID:6820
- C:\Windows\System\JZcXhhF.exe
  C:\Windows\System\JZcXhhF.exe
  2⤵
  PID:6848
- C:\Windows\System\REFwEZq.exe
  C:\Windows\System\REFwEZq.exe
  2⤵
  PID:6924
- C:\Windows\System\bBZSjEi.exe
  C:\Windows\System\bBZSjEi.exe
  2⤵
  PID:7012
- C:\Windows\System\LWvYhnp.exe
  C:\Windows\System\LWvYhnp.exe
  2⤵
  PID:7036
- C:\Windows\System\jyAxRNu.exe
  C:\Windows\System\jyAxRNu.exe
  2⤵
  PID:7100
- C:\Windows\System\lYKxqoG.exe
  C:\Windows\System\lYKxqoG.exe
  2⤵
  PID:7148
- C:\Windows\System\ReOTVki.exe
  C:\Windows\System\ReOTVki.exe
  2⤵
  PID:5916
- C:\Windows\System\wfiiTdQ.exe
  C:\Windows\System\wfiiTdQ.exe
  2⤵
  PID:6312
- C:\Windows\System\WcnqIPt.exe
  C:\Windows\System\WcnqIPt.exe
  2⤵
  PID:6468
- C:\Windows\System\wanzhVr.exe
  C:\Windows\System\wanzhVr.exe
  2⤵
  PID:6440
- C:\Windows\System\MqJQMss.exe
  C:\Windows\System\MqJQMss.exe
  2⤵
  PID:6696
- C:\Windows\System\ShWPLLp.exe
  C:\Windows\System\ShWPLLp.exe
  2⤵
  PID:6844
- C:\Windows\System\OVcbVxS.exe
  C:\Windows\System\OVcbVxS.exe
  2⤵
  PID:7064
- C:\Windows\System\OEqGMHW.exe
  C:\Windows\System\OEqGMHW.exe
  2⤵
  PID:7156
- C:\Windows\System\MVWkXNC.exe
  C:\Windows\System\MVWkXNC.exe
  2⤵
  PID:6220
- C:\Windows\System\JoiWaLf.exe
  C:\Windows\System\JoiWaLf.exe
  2⤵
  PID:6560
- C:\Windows\System\ZFJSjjq.exe
  C:\Windows\System\ZFJSjjq.exe
  2⤵
  PID:6948
- C:\Windows\System\oRmZQAE.exe
  C:\Windows\System\oRmZQAE.exe
  2⤵
  PID:2488
- C:\Windows\System\PHuVRmu.exe
  C:\Windows\System\PHuVRmu.exe
  2⤵
  PID:5724
- C:\Windows\System\Ndptmpq.exe
  C:\Windows\System\Ndptmpq.exe
  2⤵
  PID:6892
- C:\Windows\System\chjuJME.exe
  C:\Windows\System\chjuJME.exe
  2⤵
  PID:4212
- C:\Windows\System\RWYDksk.exe
  C:\Windows\System\RWYDksk.exe
  2⤵
  PID:7184
- C:\Windows\System\ErYiuET.exe
  C:\Windows\System\ErYiuET.exe
  2⤵
  PID:7220
- C:\Windows\System\AuTEPgu.exe
  C:\Windows\System\AuTEPgu.exe
  2⤵
  PID:7244
- C:\Windows\System\ngmLneZ.exe
  C:\Windows\System\ngmLneZ.exe
  2⤵
  PID:7264
- C:\Windows\System\jiePTRc.exe
  C:\Windows\System\jiePTRc.exe
  2⤵
  PID:7292
- C:\Windows\System\FwxzgRr.exe
  C:\Windows\System\FwxzgRr.exe
  2⤵
  PID:7320
- C:\Windows\System\fqfyCPx.exe
  C:\Windows\System\fqfyCPx.exe
  2⤵
  PID:7372
- C:\Windows\System\oPWGUZl.exe
  C:\Windows\System\oPWGUZl.exe
  2⤵
  PID:7392
- C:\Windows\System\TSpIKge.exe
  C:\Windows\System\TSpIKge.exe
  2⤵
  PID:7416
- C:\Windows\System\XoIFSnO.exe
  C:\Windows\System\XoIFSnO.exe
  2⤵
  PID:7432
- C:\Windows\System\wjGZuRi.exe
  C:\Windows\System\wjGZuRi.exe
  2⤵
  PID:7472
- C:\Windows\System\VDkOtjw.exe
  C:\Windows\System\VDkOtjw.exe
  2⤵
  PID:7500
- C:\Windows\System\RVdlloD.exe
  C:\Windows\System\RVdlloD.exe
  2⤵
  PID:7516
- C:\Windows\System\KJwGgdO.exe
  C:\Windows\System\KJwGgdO.exe
  2⤵
  PID:7532
- C:\Windows\System\sUpJZyq.exe
  C:\Windows\System\sUpJZyq.exe
  2⤵
  PID:7596
- C:\Windows\System\jvIsyCL.exe
  C:\Windows\System\jvIsyCL.exe
  2⤵
  PID:7620
- C:\Windows\System\YHrZBvm.exe
  C:\Windows\System\YHrZBvm.exe
  2⤵
  PID:7648
- C:\Windows\System\MzjKxtH.exe
  C:\Windows\System\MzjKxtH.exe
  2⤵
  PID:7676
- C:\Windows\System\VGAnoPl.exe
  C:\Windows\System\VGAnoPl.exe
  2⤵
  PID:7720
- C:\Windows\System\nBBkBbK.exe
  C:\Windows\System\nBBkBbK.exe
  2⤵
  PID:7736
- C:\Windows\System\XfAmQCH.exe
  C:\Windows\System\XfAmQCH.exe
  2⤵
  PID:7776
- C:\Windows\System\qokDZUC.exe
  C:\Windows\System\qokDZUC.exe
  2⤵
  PID:7792
- C:\Windows\System\JEQwzuo.exe
  C:\Windows\System\JEQwzuo.exe
  2⤵
  PID:7816
- C:\Windows\System\FzLHGxk.exe
  C:\Windows\System\FzLHGxk.exe
  2⤵
  PID:7856
- C:\Windows\System\qlwErzz.exe
  C:\Windows\System\qlwErzz.exe
  2⤵
  PID:7888
- C:\Windows\System\qlgUpwh.exe
  C:\Windows\System\qlgUpwh.exe
  2⤵
  PID:7916
- C:\Windows\System\kWHTmVF.exe
  C:\Windows\System\kWHTmVF.exe
  2⤵
  PID:7944
- C:\Windows\System\gBPYBEH.exe
  C:\Windows\System\gBPYBEH.exe
  2⤵
  PID:7976
- C:\Windows\System\jSSSQFR.exe
  C:\Windows\System\jSSSQFR.exe
  2⤵
  PID:8004
- C:\Windows\System\KuuTcom.exe
  C:\Windows\System\KuuTcom.exe
  2⤵
  PID:8020
- C:\Windows\System\eENOYde.exe
  C:\Windows\System\eENOYde.exe
  2⤵
  PID:8048
- C:\Windows\System\fJEkDbx.exe
  C:\Windows\System\fJEkDbx.exe
  2⤵
  PID:8076
- C:\Windows\System\HipkjZJ.exe
  C:\Windows\System\HipkjZJ.exe
  2⤵
  PID:8104
- C:\Windows\System\vOYMsBw.exe
  C:\Windows\System\vOYMsBw.exe
  2⤵
  PID:8124
- C:\Windows\System\XbopVJq.exe
  C:\Windows\System\XbopVJq.exe
  2⤵
  PID:8156
- C:\Windows\System\XYxcnGq.exe
  C:\Windows\System\XYxcnGq.exe
  2⤵
  PID:7172
- C:\Windows\System\NRlylZO.exe
  C:\Windows\System\NRlylZO.exe
  2⤵
  PID:7216
- C:\Windows\System\NRHTluY.exe
  C:\Windows\System\NRHTluY.exe
  2⤵
  PID:7336
- C:\Windows\System\zFFKhzM.exe
  C:\Windows\System\zFFKhzM.exe
  2⤵
  PID:7380
- C:\Windows\System\nHiWQEs.exe
  C:\Windows\System\nHiWQEs.exe
  2⤵
  PID:7428
- C:\Windows\System\ZqUVpBg.exe
  C:\Windows\System\ZqUVpBg.exe
  2⤵
  PID:7528
- C:\Windows\System\IQRJOgD.exe
  C:\Windows\System\IQRJOgD.exe
  2⤵
  PID:7556
- C:\Windows\System\ZkCviTm.exe
  C:\Windows\System\ZkCviTm.exe
  2⤵
  PID:7692
- C:\Windows\System\hFxPdBp.exe
  C:\Windows\System\hFxPdBp.exe
  2⤵
  PID:7708
- C:\Windows\System\NcKXIRq.exe
  C:\Windows\System\NcKXIRq.exe
  2⤵
  PID:7784
- C:\Windows\System\Qgolxzv.exe
  C:\Windows\System\Qgolxzv.exe
  2⤵
  PID:7832
- C:\Windows\System\MCGKEoM.exe
  C:\Windows\System\MCGKEoM.exe
  2⤵
  PID:7900
- C:\Windows\System\bLvxnTe.exe
  C:\Windows\System\bLvxnTe.exe
  2⤵
  PID:7964
- C:\Windows\System\hZSsWMF.exe
  C:\Windows\System\hZSsWMF.exe
  2⤵
  PID:8032
- C:\Windows\System\WNxvRJK.exe
  C:\Windows\System\WNxvRJK.exe
  2⤵
  PID:4188
- C:\Windows\System\xLPbRqL.exe
  C:\Windows\System\xLPbRqL.exe
  2⤵
  PID:8140
- C:\Windows\System\mQBVjPB.exe
  C:\Windows\System\mQBVjPB.exe
  2⤵
  PID:8172
- C:\Windows\System\sVvdAtO.exe
  C:\Windows\System\sVvdAtO.exe
  2⤵
  PID:7360
- C:\Windows\System\CEIzZVI.exe
  C:\Windows\System\CEIzZVI.exe
  2⤵
  PID:7424
- C:\Windows\System\dKSbVWy.exe
  C:\Windows\System\dKSbVWy.exe
  2⤵
  PID:2876
- C:\Windows\System\mHBwlhV.exe
  C:\Windows\System\mHBwlhV.exe
  2⤵
  PID:7584
- C:\Windows\System\ouxlAGQ.exe
  C:\Windows\System\ouxlAGQ.exe
  2⤵
  PID:7760
- C:\Windows\System\ZNGsOen.exe
  C:\Windows\System\ZNGsOen.exe
  2⤵
  PID:7836
- C:\Windows\System\xFndtGf.exe
  C:\Windows\System\xFndtGf.exe
  2⤵
  PID:8036
- C:\Windows\System\CLYCwHo.exe
  C:\Windows\System\CLYCwHo.exe
  2⤵
  PID:8068
- C:\Windows\System\FZSROOa.exe
  C:\Windows\System\FZSROOa.exe
  2⤵
  PID:7252
- C:\Windows\System\CDVONiS.exe
  C:\Windows\System\CDVONiS.exe
  2⤵
  PID:7576
- C:\Windows\System\sQSVbPd.exe
  C:\Windows\System\sQSVbPd.exe
  2⤵
  PID:7704
- C:\Windows\System\mjxYxbI.exe
  C:\Windows\System\mjxYxbI.exe
  2⤵
  PID:7868
- C:\Windows\System\kLAnXCQ.exe
  C:\Windows\System\kLAnXCQ.exe
  2⤵
  PID:7256
- C:\Windows\System\rlHaJMr.exe
  C:\Windows\System\rlHaJMr.exe
  2⤵
  PID:7400
- C:\Windows\System\nAzHwFx.exe
  C:\Windows\System\nAzHwFx.exe
  2⤵
  PID:8216
- C:\Windows\System\tDXtbxk.exe
  C:\Windows\System\tDXtbxk.exe
  2⤵
  PID:8252
- C:\Windows\System\duWjgZi.exe
  C:\Windows\System\duWjgZi.exe
  2⤵
  PID:8272
- C:\Windows\System\UbWfKlv.exe
  C:\Windows\System\UbWfKlv.exe
  2⤵
  PID:8304
- C:\Windows\System\KJhANbd.exe
  C:\Windows\System\KJhANbd.exe
  2⤵
  PID:8328
- C:\Windows\System\zjrhkuR.exe
  C:\Windows\System\zjrhkuR.exe
  2⤵
  PID:8368
- C:\Windows\System\QtVceil.exe
  C:\Windows\System\QtVceil.exe
  2⤵
  PID:8384
- C:\Windows\System\yDscXNn.exe
  C:\Windows\System\yDscXNn.exe
  2⤵
  PID:8416
- C:\Windows\System\VBeQvDt.exe
  C:\Windows\System\VBeQvDt.exe
  2⤵
  PID:8440
- C:\Windows\System\oRbuOOG.exe
  C:\Windows\System\oRbuOOG.exe
  2⤵
  PID:8476
- C:\Windows\System\xMlQDTS.exe
  C:\Windows\System\xMlQDTS.exe
  2⤵
  PID:8508
- C:\Windows\System\VBcKdio.exe
  C:\Windows\System\VBcKdio.exe
  2⤵
  PID:8528
- C:\Windows\System\uobPFcX.exe
  C:\Windows\System\uobPFcX.exe
  2⤵
  PID:8560
- C:\Windows\System\ZpAGnbl.exe
  C:\Windows\System\ZpAGnbl.exe
  2⤵
  PID:8580
- C:\Windows\System\PugPFmc.exe
  C:\Windows\System\PugPFmc.exe
  2⤵
  PID:8604
- C:\Windows\System\cvMEhdh.exe
  C:\Windows\System\cvMEhdh.exe
  2⤵
  PID:8628
- C:\Windows\System\FPeKWGW.exe
  C:\Windows\System\FPeKWGW.exe
  2⤵
  PID:8656
- C:\Windows\System\xZLoCFv.exe
  C:\Windows\System\xZLoCFv.exe
  2⤵
  PID:8684
- C:\Windows\System\OPBBSzs.exe
  C:\Windows\System\OPBBSzs.exe
  2⤵
  PID:8716
- C:\Windows\System\YuCGERP.exe
  C:\Windows\System\YuCGERP.exe
  2⤵
  PID:8744
- C:\Windows\System\WfSCJEU.exe
  C:\Windows\System\WfSCJEU.exe
  2⤵
  PID:8776
- C:\Windows\System\RAbvbhe.exe
  C:\Windows\System\RAbvbhe.exe
  2⤵
  PID:8816
- C:\Windows\System\xXHXhfG.exe
  C:\Windows\System\xXHXhfG.exe
  2⤵
  PID:8832
- C:\Windows\System\ASIhSWa.exe
  C:\Windows\System\ASIhSWa.exe
  2⤵
  PID:8864
- C:\Windows\System\QeXkGAJ.exe
  C:\Windows\System\QeXkGAJ.exe
  2⤵
  PID:8888
- C:\Windows\System\YhASCEI.exe
  C:\Windows\System\YhASCEI.exe
  2⤵
  PID:8904
- C:\Windows\System\VKFiDvn.exe
  C:\Windows\System\VKFiDvn.exe
  2⤵
  PID:8932
- C:\Windows\System\fvRBMyx.exe
  C:\Windows\System\fvRBMyx.exe
  2⤵
  PID:8960
- C:\Windows\System\TCWbjZi.exe
  C:\Windows\System\TCWbjZi.exe
  2⤵
  PID:8988
- C:\Windows\System\zVjbnjP.exe
  C:\Windows\System\zVjbnjP.exe
  2⤵
  PID:9012
- C:\Windows\System\otzqvmE.exe
  C:\Windows\System\otzqvmE.exe
  2⤵
  PID:9036
- C:\Windows\System\FTRjXQa.exe
  C:\Windows\System\FTRjXQa.exe
  2⤵
  PID:9072
- C:\Windows\System\IdtNBMv.exe
  C:\Windows\System\IdtNBMv.exe
  2⤵
  PID:9104
- C:\Windows\System\ybqWXaf.exe
  C:\Windows\System\ybqWXaf.exe
  2⤵
  PID:9132
- C:\Windows\System\JOCbqeH.exe
  C:\Windows\System\JOCbqeH.exe
  2⤵
  PID:9156
- C:\Windows\System\wzLmZun.exe
  C:\Windows\System\wzLmZun.exe
  2⤵
  PID:9184
- C:\Windows\System\tGdXUGv.exe
  C:\Windows\System\tGdXUGv.exe
  2⤵
  PID:2092
- C:\Windows\System\yqaBNVz.exe
  C:\Windows\System\yqaBNVz.exe
  2⤵
  PID:8268
- C:\Windows\System\kqwSIQR.exe
  C:\Windows\System\kqwSIQR.exe
  2⤵
  PID:8356
- C:\Windows\System\ZgAlZzk.exe
  C:\Windows\System\ZgAlZzk.exe
  2⤵
  PID:8400
- C:\Windows\System\GlkNINJ.exe
  C:\Windows\System\GlkNINJ.exe
  2⤵
  PID:8484
- C:\Windows\System\LaalejV.exe
  C:\Windows\System\LaalejV.exe
  2⤵
  PID:8544
- C:\Windows\System\hjJJWAB.exe
  C:\Windows\System\hjJJWAB.exe
  2⤵
  PID:8576
- C:\Windows\System\lkBLxWv.exe
  C:\Windows\System\lkBLxWv.exe
  2⤵
  PID:8708
- C:\Windows\System\sKjcabd.exe
  C:\Windows\System\sKjcabd.exe
  2⤵
  PID:8652
- C:\Windows\System\vzvAsFy.exe
  C:\Windows\System\vzvAsFy.exe
  2⤵
  PID:8732
- C:\Windows\System\PlKVrFq.exe
  C:\Windows\System\PlKVrFq.exe
  2⤵
  PID:8828
- C:\Windows\System\xvkLdoT.exe
  C:\Windows\System\xvkLdoT.exe
  2⤵
  PID:8944
- C:\Windows\System\POxrSDS.exe
  C:\Windows\System\POxrSDS.exe
  2⤵
  PID:8984
- C:\Windows\System\MUfFCmn.exe
  C:\Windows\System\MUfFCmn.exe
  2⤵
  PID:9032
- C:\Windows\System\RyRLFBA.exe
  C:\Windows\System\RyRLFBA.exe
  2⤵
  PID:9056
- C:\Windows\System\AtkitZZ.exe
  C:\Windows\System\AtkitZZ.exe
  2⤵
  PID:9172
- C:\Windows\System\izVMXzB.exe
  C:\Windows\System\izVMXzB.exe
  2⤵
  PID:9176
- C:\Windows\System\mzwkopz.exe
  C:\Windows\System\mzwkopz.exe
  2⤵
  PID:8228
- C:\Windows\System\MQgBhzQ.exe
  C:\Windows\System\MQgBhzQ.exe
  2⤵
  PID:8396
- C:\Windows\System\dmuhhkC.exe
  C:\Windows\System\dmuhhkC.exe
  2⤵
  PID:8572
- C:\Windows\System\tgfOWNj.exe
  C:\Windows\System\tgfOWNj.exe
  2⤵
  PID:8756
- C:\Windows\System\lenymSH.exe
  C:\Windows\System\lenymSH.exe
  2⤵
  PID:8824
- C:\Windows\System\jMPcaZE.exe
  C:\Windows\System\jMPcaZE.exe
  2⤵
  PID:9004
- C:\Windows\System\qVVJgVK.exe
  C:\Windows\System\qVVJgVK.exe
  2⤵
  PID:9128
- C:\Windows\System\enDbYzd.exe
  C:\Windows\System\enDbYzd.exe
  2⤵
  PID:8288
- C:\Windows\System\IkRNNVH.exe
  C:\Windows\System\IkRNNVH.exe
  2⤵
  PID:8804
- C:\Windows\System\BUPPziF.exe
  C:\Windows\System\BUPPziF.exe
  2⤵
  PID:8520
- C:\Windows\System\lYyjwBR.exe
  C:\Windows\System\lYyjwBR.exe
  2⤵
  PID:8676
- C:\Windows\System\fsldnuw.exe
  C:\Windows\System\fsldnuw.exe
  2⤵
  PID:9224
- C:\Windows\System\xjoEdJt.exe
  C:\Windows\System\xjoEdJt.exe
  2⤵
  PID:9252
- C:\Windows\System\AxXCERQ.exe
  C:\Windows\System\AxXCERQ.exe
  2⤵
  PID:9280
- C:\Windows\System\cYCWAdC.exe
  C:\Windows\System\cYCWAdC.exe
  2⤵
  PID:9308
- C:\Windows\System\APSrIIK.exe
  C:\Windows\System\APSrIIK.exe
  2⤵
  PID:9348
- C:\Windows\System\KZHsjTs.exe
  C:\Windows\System\KZHsjTs.exe
  2⤵
  PID:9380
- C:\Windows\System\wkNqbXS.exe
  C:\Windows\System\wkNqbXS.exe
  2⤵
  PID:9408
- C:\Windows\System\MfywgNY.exe
  C:\Windows\System\MfywgNY.exe
  2⤵
  PID:9428
- C:\Windows\System\WdEWOtc.exe
  C:\Windows\System\WdEWOtc.exe
  2⤵
  PID:9456
- C:\Windows\System\mYCaXXu.exe
  C:\Windows\System\mYCaXXu.exe
  2⤵
  PID:9492
- C:\Windows\System\eBDGnnR.exe
  C:\Windows\System\eBDGnnR.exe
  2⤵
  PID:9520
- C:\Windows\System\geuORsu.exe
  C:\Windows\System\geuORsu.exe
  2⤵
  PID:9548
- C:\Windows\System\ocoNrks.exe
  C:\Windows\System\ocoNrks.exe
  2⤵
  PID:9576
- C:\Windows\System\DVlDnbK.exe
  C:\Windows\System\DVlDnbK.exe
  2⤵
  PID:9604
- C:\Windows\System\ggSyiGn.exe
  C:\Windows\System\ggSyiGn.exe
  2⤵
  PID:9632
- C:\Windows\System\ecMIWvV.exe
  C:\Windows\System\ecMIWvV.exe
  2⤵
  PID:9648
- C:\Windows\System\lPxsSZT.exe
  C:\Windows\System\lPxsSZT.exe
  2⤵
  PID:9680
- C:\Windows\System\hBlkjVC.exe
  C:\Windows\System\hBlkjVC.exe
  2⤵
  PID:9700
- C:\Windows\System\ZhYkaVo.exe
  C:\Windows\System\ZhYkaVo.exe
  2⤵
  PID:9724
- C:\Windows\System\PtqHlCv.exe
  C:\Windows\System\PtqHlCv.exe
  2⤵
  PID:9744
- C:\Windows\System\PuTavvV.exe
  C:\Windows\System\PuTavvV.exe
  2⤵
  PID:9772
- C:\Windows\System\xXxmHJM.exe
  C:\Windows\System\xXxmHJM.exe
  2⤵
  PID:9792
- C:\Windows\System\aqNgtpG.exe
  C:\Windows\System\aqNgtpG.exe
  2⤵
  PID:9816
- C:\Windows\System\ZHjysdi.exe
  C:\Windows\System\ZHjysdi.exe
  2⤵
  PID:9844
- C:\Windows\System\IImJJvp.exe
  C:\Windows\System\IImJJvp.exe
  2⤵
  PID:9864
- C:\Windows\System\viYtlhi.exe
  C:\Windows\System\viYtlhi.exe
  2⤵
  PID:9896
- C:\Windows\System\vYdksqZ.exe
  C:\Windows\System\vYdksqZ.exe
  2⤵
  PID:9928
- C:\Windows\System\ZWiymbX.exe
  C:\Windows\System\ZWiymbX.exe
  2⤵
  PID:9972
- C:\Windows\System\xBWJGyf.exe
  C:\Windows\System\xBWJGyf.exe
  2⤵
  PID:10004
- C:\Windows\System\cbIKeUk.exe
  C:\Windows\System\cbIKeUk.exe
  2⤵
  PID:10028
- C:\Windows\System\dLcpnOU.exe
  C:\Windows\System\dLcpnOU.exe
  2⤵
  PID:10060
- C:\Windows\System\nUtKjly.exe
  C:\Windows\System\nUtKjly.exe
  2⤵
  PID:10088
- C:\Windows\System\KKnxELU.exe
  C:\Windows\System\KKnxELU.exe
  2⤵
  PID:10120
- C:\Windows\System\rCKKSrZ.exe
  C:\Windows\System\rCKKSrZ.exe
  2⤵
  PID:10164
- C:\Windows\System\TyEsVoX.exe
  C:\Windows\System\TyEsVoX.exe
  2⤵
  PID:10196
- C:\Windows\System\UjNJcKr.exe
  C:\Windows\System\UjNJcKr.exe
  2⤵
  PID:10224
- C:\Windows\System\WucJkCP.exe
  C:\Windows\System\WucJkCP.exe
  2⤵
  PID:3408
- C:\Windows\System\GcgvVyy.exe
  C:\Windows\System\GcgvVyy.exe
  2⤵
  PID:9248
- C:\Windows\System\dpPwwVm.exe
  C:\Windows\System\dpPwwVm.exe
  2⤵
  PID:9324
- C:\Windows\System\rUuyFcv.exe
  C:\Windows\System\rUuyFcv.exe
  2⤵
  PID:9400
- C:\Windows\System\HstnUXY.exe
  C:\Windows\System\HstnUXY.exe
  2⤵
  PID:9452
- C:\Windows\System\hTisMzA.exe
  C:\Windows\System\hTisMzA.exe
  2⤵
  PID:9544
- C:\Windows\System\CnGCcgT.exe
  C:\Windows\System\CnGCcgT.exe
  2⤵
  PID:9596
- C:\Windows\System\jPnkUeD.exe
  C:\Windows\System\jPnkUeD.exe
  2⤵
  PID:9640
- C:\Windows\System\eWhrukg.exe
  C:\Windows\System\eWhrukg.exe
  2⤵
  PID:9708
- C:\Windows\System\EIFacsl.exe
  C:\Windows\System\EIFacsl.exe
  2⤵
  PID:9768
- C:\Windows\System\QihuIto.exe
  C:\Windows\System\QihuIto.exe
  2⤵
  PID:9828
- C:\Windows\System\jOGtixp.exe
  C:\Windows\System\jOGtixp.exe
  2⤵
  PID:9876
- C:\Windows\System\teRDqIs.exe
  C:\Windows\System\teRDqIs.exe
  2⤵
  PID:10000
- C:\Windows\System\WVklarT.exe
  C:\Windows\System\WVklarT.exe
  2⤵
  PID:10016
- C:\Windows\System\ypVnRNK.exe
  C:\Windows\System\ypVnRNK.exe
  2⤵
  PID:10080
- C:\Windows\System\kTfrwuJ.exe
  C:\Windows\System\kTfrwuJ.exe
  2⤵
  PID:10136
- C:\Windows\System\trwHqaJ.exe
  C:\Windows\System\trwHqaJ.exe
  2⤵
  PID:10208
- C:\Windows\System\rNlXJWt.exe
  C:\Windows\System\rNlXJWt.exe
  2⤵
  PID:9272
- C:\Windows\System\zvajPht.exe
  C:\Windows\System\zvajPht.exe
  2⤵
  PID:9376
- C:\Windows\System\MPpHtNK.exe
  C:\Windows\System\MPpHtNK.exe
  2⤵
  PID:9504
- C:\Windows\System\NiEKqBv.exe
  C:\Windows\System\NiEKqBv.exe
  2⤵
  PID:9644
- C:\Windows\System\HxlDRGM.exe
  C:\Windows\System\HxlDRGM.exe
  2⤵
  PID:9908
- C:\Windows\System\dZeWNDJ.exe
  C:\Windows\System\dZeWNDJ.exe
  2⤵
  PID:9992
- C:\Windows\System\Cxfkixu.exe
  C:\Windows\System\Cxfkixu.exe
  2⤵
  PID:10048
- C:\Windows\System\ieLhmOL.exe
  C:\Windows\System\ieLhmOL.exe
  2⤵
  PID:9240
- C:\Windows\System\DXbdjru.exe
  C:\Windows\System\DXbdjru.exe
  2⤵
  PID:9620
- C:\Windows\System\YwPRLww.exe
  C:\Windows\System\YwPRLww.exe
  2⤵
  PID:9924
- C:\Windows\System\eXotwJM.exe
  C:\Windows\System\eXotwJM.exe
  2⤵
  PID:9568
- C:\Windows\System\XWYKmLq.exe
  C:\Windows\System\XWYKmLq.exe
  2⤵
  PID:10040
- C:\Windows\System\IaUQvsI.exe
  C:\Windows\System\IaUQvsI.exe
  2⤵
  PID:10264
- C:\Windows\System\AKOESdK.exe
  C:\Windows\System\AKOESdK.exe
  2⤵
  PID:10288
- C:\Windows\System\QruoQxp.exe
  C:\Windows\System\QruoQxp.exe
  2⤵
  PID:10336
- C:\Windows\System\kOrwEwB.exe
  C:\Windows\System\kOrwEwB.exe
  2⤵
  PID:10352
- C:\Windows\System\SWEGAcT.exe
  C:\Windows\System\SWEGAcT.exe
  2⤵
  PID:10368
- C:\Windows\System\jkzABdR.exe
  C:\Windows\System\jkzABdR.exe
  2⤵
  PID:10392
- C:\Windows\System\ofVKiAw.exe
  C:\Windows\System\ofVKiAw.exe
  2⤵
  PID:10428
- C:\Windows\System\EDErEbi.exe
  C:\Windows\System\EDErEbi.exe
  2⤵
  PID:10456
- C:\Windows\System\rLwgdeD.exe
  C:\Windows\System\rLwgdeD.exe
  2⤵
  PID:10496
- C:\Windows\System\XgevlXL.exe
  C:\Windows\System\XgevlXL.exe
  2⤵
  PID:10532
- C:\Windows\System\FixhHxE.exe
  C:\Windows\System\FixhHxE.exe
  2⤵
  PID:10560
- C:\Windows\System\fwNFMKA.exe
  C:\Windows\System\fwNFMKA.exe
  2⤵
  PID:10588
- C:\Windows\System\nYQvmzD.exe
  C:\Windows\System\nYQvmzD.exe
  2⤵
  PID:10616
- C:\Windows\System\NjfSoJF.exe
  C:\Windows\System\NjfSoJF.exe
  2⤵
  PID:10632
- C:\Windows\System\QJcQbXb.exe
  C:\Windows\System\QJcQbXb.exe
  2⤵
  PID:10660
- C:\Windows\System\NketFwT.exe
  C:\Windows\System\NketFwT.exe
  2⤵
  PID:10688
- C:\Windows\System\XeulKfy.exe
  C:\Windows\System\XeulKfy.exe
  2⤵
  PID:10712
- C:\Windows\System\dKkDuTz.exe
  C:\Windows\System\dKkDuTz.exe
  2⤵
  PID:10736
- C:\Windows\System\STToBvj.exe
  C:\Windows\System\STToBvj.exe
  2⤵
  PID:10772
- C:\Windows\System\xAgXOJN.exe
  C:\Windows\System\xAgXOJN.exe
  2⤵
  PID:10804
- C:\Windows\System\CIwlqmC.exe
  C:\Windows\System\CIwlqmC.exe
  2⤵
  PID:10844
- C:\Windows\System\fMPygwY.exe
  C:\Windows\System\fMPygwY.exe
  2⤵
  PID:10872
- C:\Windows\System\FYnFuHn.exe
  C:\Windows\System\FYnFuHn.exe
  2⤵
  PID:10900
- C:\Windows\System\BJdBKiI.exe
  C:\Windows\System\BJdBKiI.exe
  2⤵
  PID:10928
- C:\Windows\System\wfJNspW.exe
  C:\Windows\System\wfJNspW.exe
  2⤵
  PID:10956
- C:\Windows\System\pobmdBK.exe
  C:\Windows\System\pobmdBK.exe
  2⤵
  PID:10972
- C:\Windows\System\wQNnjZg.exe
  C:\Windows\System\wQNnjZg.exe
  2⤵
  PID:11000
- C:\Windows\System\LtmUqiu.exe
  C:\Windows\System\LtmUqiu.exe
  2⤵
  PID:11020
- C:\Windows\System\OfqIPEd.exe
  C:\Windows\System\OfqIPEd.exe
  2⤵
  PID:11056
- C:\Windows\System\QuSawTt.exe
  C:\Windows\System\QuSawTt.exe
  2⤵
  PID:11088
- C:\Windows\System\PBBbUPs.exe
  C:\Windows\System\PBBbUPs.exe
  2⤵
  PID:11112
- C:\Windows\System\VdAbxCM.exe
  C:\Windows\System\VdAbxCM.exe
  2⤵
  PID:11140
- C:\Windows\System\smyjPPI.exe
  C:\Windows\System\smyjPPI.exe
  2⤵
  PID:11168
- C:\Windows\System\UAQwHWi.exe
  C:\Windows\System\UAQwHWi.exe
  2⤵
  PID:11188
- C:\Windows\System\NSBihSJ.exe
  C:\Windows\System\NSBihSJ.exe
  2⤵
  PID:11212
- C:\Windows\System\lzTQgJV.exe
  C:\Windows\System\lzTQgJV.exe
  2⤵
  PID:11244
- C:\Windows\System\ODgErsJ.exe
  C:\Windows\System\ODgErsJ.exe
  2⤵
  PID:10296
- C:\Windows\System\RdiPwdy.exe
  C:\Windows\System\RdiPwdy.exe
  2⤵
  PID:10364
- C:\Windows\System\tMJYBcb.exe
  C:\Windows\System\tMJYBcb.exe
  2⤵
  PID:10408
- C:\Windows\System\xNbYTKu.exe
  C:\Windows\System\xNbYTKu.exe
  2⤵
  PID:10444
- C:\Windows\System\UTboWRc.exe
  C:\Windows\System\UTboWRc.exe
  2⤵
  PID:10516
- C:\Windows\System\cZovcYF.exe
  C:\Windows\System\cZovcYF.exe
  2⤵
  PID:10576
- C:\Windows\System\mgPoSqm.exe
  C:\Windows\System\mgPoSqm.exe
  2⤵
  PID:10680
- C:\Windows\System\byGgSTo.exe
  C:\Windows\System\byGgSTo.exe
  2⤵
  PID:10704
- C:\Windows\System\GwxECKg.exe
  C:\Windows\System\GwxECKg.exe
  2⤵
  PID:10800
- C:\Windows\System\PnQdyrA.exe
  C:\Windows\System\PnQdyrA.exe
  2⤵
  PID:10840
- C:\Windows\System\ExAYgZm.exe
  C:\Windows\System\ExAYgZm.exe
  2⤵
  PID:10920
- C:\Windows\System\oVzJcJi.exe
  C:\Windows\System\oVzJcJi.exe
  2⤵
  PID:10992
- C:\Windows\System\yVlbOig.exe
  C:\Windows\System\yVlbOig.exe
  2⤵
  PID:11068
- C:\Windows\System\kLKzYJz.exe
  C:\Windows\System\kLKzYJz.exe
  2⤵
  PID:11124
- C:\Windows\System\rwnTNvI.exe
  C:\Windows\System\rwnTNvI.exe
  2⤵
  PID:11176
- C:\Windows\System\zgDGRDA.exe
  C:\Windows\System\zgDGRDA.exe
  2⤵
  PID:11260
- C:\Windows\System\MRTZCyL.exe
  C:\Windows\System\MRTZCyL.exe
  2⤵
  PID:10324
- C:\Windows\System\tJLhFik.exe
  C:\Windows\System\tJLhFik.exe
  2⤵
  PID:10388
- C:\Windows\System\pkcrGQA.exe
  C:\Windows\System\pkcrGQA.exe
  2⤵
  PID:10556
- C:\Windows\System\DOHKlEG.exe
  C:\Windows\System\DOHKlEG.exe
  2⤵
  PID:10668
- C:\Windows\System\rwTBgJH.exe
  C:\Windows\System\rwTBgJH.exe
  2⤵
  PID:10940
- C:\Windows\System\gMDYDSa.exe
  C:\Windows\System\gMDYDSa.exe
  2⤵
  PID:11028
- C:\Windows\System\qzSiaot.exe
  C:\Windows\System\qzSiaot.exe
  2⤵
  PID:11128
- C:\Windows\System\JZfRkib.exe
  C:\Windows\System\JZfRkib.exe
  2⤵
  PID:11236
- C:\Windows\System\jgCBjKx.exe
  C:\Windows\System\jgCBjKx.exe
  2⤵
  PID:10484
- C:\Windows\System\nlBUwVA.exe
  C:\Windows\System\nlBUwVA.exe
  2⤵
  PID:11044
- C:\Windows\System\tiWIpbA.exe
  C:\Windows\System\tiWIpbA.exe
  2⤵
  PID:11200
- C:\Windows\System\MKOWCEI.exe
  C:\Windows\System\MKOWCEI.exe
  2⤵
  PID:10700
- C:\Windows\System\uygidAZ.exe
  C:\Windows\System\uygidAZ.exe
  2⤵
  PID:11284
- C:\Windows\System\QJjyYFD.exe
  C:\Windows\System\QJjyYFD.exe
  2⤵
  PID:11332
- C:\Windows\System\dkdtTtU.exe
  C:\Windows\System\dkdtTtU.exe
  2⤵
  PID:11356
- C:\Windows\System\TloqVtK.exe
  C:\Windows\System\TloqVtK.exe
  2⤵
  PID:11384
- C:\Windows\System\TEyjHhl.exe
  C:\Windows\System\TEyjHhl.exe
  2⤵
  PID:11412
- C:\Windows\System\UbqEPNd.exe
  C:\Windows\System\UbqEPNd.exe
  2⤵
  PID:11432
- C:\Windows\System\jDfhRAJ.exe
  C:\Windows\System\jDfhRAJ.exe
  2⤵
  PID:11456
- C:\Windows\System\vnlscmI.exe
  C:\Windows\System\vnlscmI.exe
  2⤵
  PID:11500
- C:\Windows\System\OJSuPfy.exe
  C:\Windows\System\OJSuPfy.exe
  2⤵
  PID:11536
- C:\Windows\System\lmsHjSp.exe
  C:\Windows\System\lmsHjSp.exe
  2⤵
  PID:11564
- C:\Windows\System\aMevQTp.exe
  C:\Windows\System\aMevQTp.exe
  2⤵
  PID:11580
- C:\Windows\System\yAmWvKh.exe
  C:\Windows\System\yAmWvKh.exe
  2⤵
  PID:11620
- C:\Windows\System\zNcOToo.exe
  C:\Windows\System\zNcOToo.exe
  2⤵
  PID:11648
- C:\Windows\System\YqwLCmP.exe
  C:\Windows\System\YqwLCmP.exe
  2⤵
  PID:11676
- C:\Windows\System\sGQKVCy.exe
  C:\Windows\System\sGQKVCy.exe
  2⤵
  PID:11704
- C:\Windows\System\vgZNanD.exe
  C:\Windows\System\vgZNanD.exe
  2⤵
  PID:11732
- C:\Windows\System\JumYAzs.exe
  C:\Windows\System\JumYAzs.exe
  2⤵
  PID:11760
- C:\Windows\System\RIiAPBe.exe
  C:\Windows\System\RIiAPBe.exe
  2⤵
  PID:11776
- C:\Windows\System\jTmwfQq.exe
  C:\Windows\System\jTmwfQq.exe
  2⤵
  PID:11796
- C:\Windows\System\XfhFWqu.exe
  C:\Windows\System\XfhFWqu.exe
  2⤵
  PID:11828
- C:\Windows\System\YDlTISL.exe
  C:\Windows\System\YDlTISL.exe
  2⤵
  PID:11872
- C:\Windows\System\GjQFNuo.exe
  C:\Windows\System\GjQFNuo.exe
  2⤵
  PID:11900
- C:\Windows\System\DRRNpLF.exe
  C:\Windows\System\DRRNpLF.exe
  2⤵
  PID:11916
- C:\Windows\System\GwXgieb.exe
  C:\Windows\System\GwXgieb.exe
  2⤵
  PID:11956
- C:\Windows\System\wQohzvT.exe
  C:\Windows\System\wQohzvT.exe
  2⤵
  PID:11972
- C:\Windows\System\gyevIfH.exe
  C:\Windows\System\gyevIfH.exe
  2⤵
  PID:12000
- C:\Windows\System\XzZjfrB.exe
  C:\Windows\System\XzZjfrB.exe
  2⤵
  PID:12028
- C:\Windows\System\rMOwjje.exe
  C:\Windows\System\rMOwjje.exe
  2⤵
  PID:12056
- C:\Windows\System\Epqsrdy.exe
  C:\Windows\System\Epqsrdy.exe
  2⤵
  PID:12076
- C:\Windows\System\tROXFyo.exe
  C:\Windows\System\tROXFyo.exe
  2⤵
  PID:12104
- C:\Windows\System\VWRFFsw.exe
  C:\Windows\System\VWRFFsw.exe
  2⤵
  PID:12136
- C:\Windows\System\FvadtFk.exe
  C:\Windows\System\FvadtFk.exe
  2⤵
  PID:12164
- C:\Windows\System\XadhDAa.exe
  C:\Windows\System\XadhDAa.exe
  2⤵
  PID:12188
- C:\Windows\System\rEKvwQh.exe
  C:\Windows\System\rEKvwQh.exe
  2⤵
  PID:12220
- C:\Windows\System\OeOvaOU.exe
  C:\Windows\System\OeOvaOU.exe
  2⤵
  PID:12244
- C:\Windows\System\sMZkRVc.exe
  C:\Windows\System\sMZkRVc.exe
  2⤵
  PID:12264
- C:\Windows\System\btZBwdT.exe
  C:\Windows\System\btZBwdT.exe
  2⤵
  PID:12284
- C:\Windows\System\osgrkyP.exe
  C:\Windows\System\osgrkyP.exe
  2⤵
  PID:11380
- C:\Windows\System\tVufCpB.exe
  C:\Windows\System\tVufCpB.exe
  2⤵
  PID:11444
- C:\Windows\System\UUbYlgQ.exe
  C:\Windows\System\UUbYlgQ.exe
  2⤵
  PID:11516
- C:\Windows\System\XEOKhhi.exe
  C:\Windows\System\XEOKhhi.exe
  2⤵
  PID:11560
- C:\Windows\System\iOwnmDz.exe
  C:\Windows\System\iOwnmDz.exe
  2⤵
  PID:11644
- C:\Windows\System\JfJESJR.exe
  C:\Windows\System\JfJESJR.exe
  2⤵
  PID:11692
- C:\Windows\System\ruulXwa.exe
  C:\Windows\System\ruulXwa.exe
  2⤵
  PID:11804
- C:\Windows\System\AmypuFG.exe
  C:\Windows\System\AmypuFG.exe
  2⤵
  PID:11816
- C:\Windows\System\WErQELm.exe
  C:\Windows\System\WErQELm.exe
  2⤵
  PID:11884
- C:\Windows\System\fUZQqmw.exe
  C:\Windows\System\fUZQqmw.exe
  2⤵
  PID:11964
- C:\Windows\System\EWSLVyk.exe
  C:\Windows\System\EWSLVyk.exe
  2⤵
  PID:12016
- C:\Windows\System\wCFTbAP.exe
  C:\Windows\System\wCFTbAP.exe
  2⤵
  PID:12048
- C:\Windows\System\zCpadhU.exe
  C:\Windows\System\zCpadhU.exe
  2⤵
  PID:12120
- C:\Windows\System\kbZPNUU.exe
  C:\Windows\System\kbZPNUU.exe
  2⤵
  PID:12172
- C:\Windows\System\QJluxGn.exe
  C:\Windows\System\QJluxGn.exe
  2⤵
  PID:12240
- C:\Windows\System\yjyqAys.exe
  C:\Windows\System\yjyqAys.exe
  2⤵
  PID:11340
- C:\Windows\System\tYRJMtN.exe
  C:\Windows\System\tYRJMtN.exe
  2⤵
  PID:11452
- C:\Windows\System\luvrrNX.exe
  C:\Windows\System\luvrrNX.exe
  2⤵
  PID:11672
- C:\Windows\System\pnfdqUR.exe
  C:\Windows\System\pnfdqUR.exe
  2⤵
  PID:10732
- C:\Windows\System\LzZZoCn.exe
  C:\Windows\System\LzZZoCn.exe
  2⤵
  PID:12092
- C:\Windows\System\vlFAHBX.exe
  C:\Windows\System\vlFAHBX.exe
  2⤵
  PID:12068
- C:\Windows\System\YwfcFQI.exe
  C:\Windows\System\YwfcFQI.exe
  2⤵
  PID:12232
- C:\Windows\System\GRfuXNo.exe
  C:\Windows\System\GRfuXNo.exe
  2⤵
  PID:11440
- C:\Windows\System\HkDvjFg.exe
  C:\Windows\System\HkDvjFg.exe
  2⤵
  PID:11848
- C:\Windows\System\raskmLK.exe
  C:\Windows\System\raskmLK.exe
  2⤵
  PID:12260
- C:\Windows\System\HNPAPbX.exe
  C:\Windows\System\HNPAPbX.exe
  2⤵
  PID:12312
- C:\Windows\System\qkgpOuC.exe
  C:\Windows\System\qkgpOuC.exe
  2⤵
  PID:12336
- C:\Windows\System\SGLMdXn.exe
  C:\Windows\System\SGLMdXn.exe
  2⤵
  PID:12372
- C:\Windows\System\xKFzjVs.exe
  C:\Windows\System\xKFzjVs.exe
  2⤵
  PID:12408
- C:\Windows\System\vwlpZBa.exe
  C:\Windows\System\vwlpZBa.exe
  2⤵
  PID:12424
- C:\Windows\System\IcsoKFQ.exe
  C:\Windows\System\IcsoKFQ.exe
  2⤵
  PID:12452
- C:\Windows\System\ElSnezX.exe
  C:\Windows\System\ElSnezX.exe
  2⤵
  PID:12480
- C:\Windows\System\EbMJCwf.exe
  C:\Windows\System\EbMJCwf.exe
  2⤵
  PID:12508
- C:\Windows\System\YAwEcPM.exe
  C:\Windows\System\YAwEcPM.exe
  2⤵
  PID:12540
- C:\Windows\System\mhDXzwa.exe
  C:\Windows\System\mhDXzwa.exe
  2⤵
  PID:12576
- C:\Windows\System\kkoaWvT.exe
  C:\Windows\System\kkoaWvT.exe
  2⤵
  PID:12604
- C:\Windows\System\gxiKuOr.exe
  C:\Windows\System\gxiKuOr.exe
  2⤵
  PID:12620
- C:\Windows\System\vAQswdK.exe
  C:\Windows\System\vAQswdK.exe
  2⤵
  PID:12648
- C:\Windows\System\vIjoasP.exe
  C:\Windows\System\vIjoasP.exe
  2⤵
  PID:12688
- C:\Windows\System\jjuELRg.exe
  C:\Windows\System\jjuELRg.exe
  2⤵
  PID:12716
- C:\Windows\System\VVEZFxw.exe
  C:\Windows\System\VVEZFxw.exe
  2⤵
  PID:12732
- C:\Windows\System\ifTYkWT.exe
  C:\Windows\System\ifTYkWT.exe
  2⤵
  PID:12760
- C:\Windows\System\MaJImLu.exe
  C:\Windows\System\MaJImLu.exe
  2⤵
  PID:12788
- C:\Windows\System\ZfWIYFc.exe
  C:\Windows\System\ZfWIYFc.exe
  2⤵
  PID:12804
- C:\Windows\System\WtWYUDh.exe
  C:\Windows\System\WtWYUDh.exe
  2⤵
  PID:12820
- C:\Windows\System\zVOzZVx.exe
  C:\Windows\System\zVOzZVx.exe
  2⤵
  PID:12884
- C:\Windows\System\DfdgbMg.exe
  C:\Windows\System\DfdgbMg.exe
  2⤵
  PID:12900
- C:\Windows\System\SsjoYvo.exe
  C:\Windows\System\SsjoYvo.exe
  2⤵
  PID:12940
- C:\Windows\System\ziZteiu.exe
  C:\Windows\System\ziZteiu.exe
  2⤵
  PID:12968
- C:\Windows\System\ZKcCchG.exe
  C:\Windows\System\ZKcCchG.exe
  2⤵
  PID:12984
- C:\Windows\System\lxKfZuC.exe
  C:\Windows\System\lxKfZuC.exe
  2⤵
  PID:13012
- C:\Windows\System\zBkQDiu.exe
  C:\Windows\System\zBkQDiu.exe
  2⤵
  PID:13032
- C:\Windows\System\UycLJmr.exe
  C:\Windows\System\UycLJmr.exe
  2⤵
  PID:13068
- C:\Windows\System\iNPZhJm.exe
  C:\Windows\System\iNPZhJm.exe
  2⤵
  PID:13088
- C:\Windows\System\ObliYbE.exe
  C:\Windows\System\ObliYbE.exe
  2⤵
  PID:13120
- C:\Windows\System\ulLYeqK.exe
  C:\Windows\System\ulLYeqK.exe
  2⤵
  PID:13144
- C:\Windows\System\FALWrIl.exe
  C:\Windows\System\FALWrIl.exe
  2⤵
  PID:13168
- C:\Windows\System\GLkTLDl.exe
  C:\Windows\System\GLkTLDl.exe
  2⤵
  PID:13184
- C:\Windows\System\BuNOsJL.exe
  C:\Windows\System\BuNOsJL.exe
  2⤵
  PID:13220
- C:\Windows\System\AdwYFkx.exe
  C:\Windows\System\AdwYFkx.exe
  2⤵
  PID:13256
- C:\Windows\System\ieZVnHU.exe
  C:\Windows\System\ieZVnHU.exe
  2⤵
  PID:13308
- C:\Windows\System\wFRjsGa.exe
  C:\Windows\System\wFRjsGa.exe
  2⤵
  PID:11820
- C:\Windows\System\oRPObAp.exe
  C:\Windows\System\oRPObAp.exe
  2⤵
  PID:12352
- C:\Windows\System\lVYlcul.exe
  C:\Windows\System\lVYlcul.exe
  2⤵
  PID:12368
- C:\Windows\System\xUKhiKq.exe
  C:\Windows\System\xUKhiKq.exe
  2⤵
  PID:12444
- C:\Windows\System\AFgcgZF.exe
  C:\Windows\System\AFgcgZF.exe
  2⤵
  PID:12504
- C:\Windows\System\fNpzpji.exe
  C:\Windows\System\fNpzpji.exe
  2⤵
  PID:12560
- C:\Windows\System\wtyIMId.exe
  C:\Windows\System\wtyIMId.exe
  2⤵
  PID:12640
- C:\Windows\System\tMCdnjp.exe
  C:\Windows\System\tMCdnjp.exe
  2⤵
  PID:12708
- C:\Windows\System\VUwytto.exe
  C:\Windows\System\VUwytto.exe
  2⤵
  PID:12776
- C:\Windows\System\RHnMMfN.exe
  C:\Windows\System\RHnMMfN.exe
  2⤵
  PID:12816
- C:\Windows\System\nOVEFso.exe
  C:\Windows\System\nOVEFso.exe
  2⤵
  PID:12896
- C:\Windows\System\ytZBDNF.exe
  C:\Windows\System\ytZBDNF.exe
  2⤵
  PID:12952
- C:\Windows\System\lrShxGX.exe
  C:\Windows\System\lrShxGX.exe
  2⤵
  PID:13056
- C:\Windows\System\wEfAsAZ.exe
  C:\Windows\System\wEfAsAZ.exe
  2⤵
  PID:13160
- C:\Windows\System\yfBrNLv.exe
  C:\Windows\System\yfBrNLv.exe
  2⤵
  PID:13128
- C:\Windows\System\WMGswJV.exe
  C:\Windows\System\WMGswJV.exe
  2⤵
  PID:13180
- C:\Windows\System\dMUKTNX.exe
  C:\Windows\System\dMUKTNX.exe
  2⤵
  PID:12304
- C:\Windows\System\EvHoWPp.exe
  C:\Windows\System\EvHoWPp.exe
  2⤵
  PID:12328
- C:\Windows\System\ZLYfyfc.exe
  C:\Windows\System\ZLYfyfc.exe
  2⤵
  PID:12532
- C:\Windows\System\ALWBTWf.exe
  C:\Windows\System\ALWBTWf.exe
  2⤵
  PID:12680
- C:\Windows\System\rjdVtoQ.exe
  C:\Windows\System\rjdVtoQ.exe
  2⤵
  PID:12756
- C:\Windows\System\HntPGXP.exe
  C:\Windows\System\HntPGXP.exe
  2⤵
  PID:12976
- C:\Windows\System\cWayJNx.exe
  C:\Windows\System\cWayJNx.exe
  2⤵
  PID:13076
- C:\Windows\System\rAdIusv.exe
  C:\Windows\System\rAdIusv.exe
  2⤵
  PID:12052
- C:\Windows\System\uyeEPQL.exe
  C:\Windows\System\uyeEPQL.exe
  2⤵
  PID:12396
- C:\Windows\System\CQmkGWX.exe
  C:\Windows\System\CQmkGWX.exe
  2⤵
  PID:12684
- C:\Windows\System\YtlFQgK.exe
  C:\Windows\System\YtlFQgK.exe
  2⤵
  PID:13008
- C:\Windows\System\XLOlMcW.exe
  C:\Windows\System\XLOlMcW.exe
  2⤵
  PID:12324
- C:\Windows\System\TscOthr.exe
  C:\Windows\System\TscOthr.exe
  2⤵
  PID:13240
- C:\Windows\System\kMRckHf.exe
  C:\Windows\System\kMRckHf.exe
  2⤵
  PID:13236
- C:\Windows\System\ltqAoMj.exe
  C:\Windows\System\ltqAoMj.exe
  2⤵
  PID:13324
- C:\Windows\System\iFBCeBp.exe
  C:\Windows\System\iFBCeBp.exe
  2⤵
  PID:13356
- C:\Windows\System\lReVdJL.exe
  C:\Windows\System\lReVdJL.exe
  2⤵
  PID:13428
- C:\Windows\System\MEUEgbg.exe
  C:\Windows\System\MEUEgbg.exe
  2⤵
  PID:13468
- C:\Windows\System\CEQOLQZ.exe
  C:\Windows\System\CEQOLQZ.exe
  2⤵
  PID:13488
- C:\Windows\System\fHOrqUD.exe
  C:\Windows\System\fHOrqUD.exe
  2⤵
  PID:13520
- C:\Windows\System\MAlpgHJ.exe
  C:\Windows\System\MAlpgHJ.exe
  2⤵
  PID:13540
- C:\Windows\System\BFvqFTU.exe
  C:\Windows\System\BFvqFTU.exe
  2⤵
  PID:13568
- C:\Windows\System\oLVreEh.exe
  C:\Windows\System\oLVreEh.exe
  2⤵
  PID:13608
- C:\Windows\System\rXXYFeM.exe
  C:\Windows\System\rXXYFeM.exe
  2⤵
  PID:13636
- C:\Windows\System\JWsAGTW.exe
  C:\Windows\System\JWsAGTW.exe
  2⤵
  PID:13660
- C:\Windows\System\nBXoSZc.exe
  C:\Windows\System\nBXoSZc.exe
  2⤵
  PID:13684
- C:\Windows\System\UMSxdKs.exe
  C:\Windows\System\UMSxdKs.exe
  2⤵
  PID:13708
- C:\Windows\System\NkIccOe.exe
  C:\Windows\System\NkIccOe.exe
  2⤵
  PID:13748
- C:\Windows\System\LcmUjNd.exe
  C:\Windows\System\LcmUjNd.exe
  2⤵
  PID:13776
- C:\Windows\System\LGGyVed.exe
  C:\Windows\System\LGGyVed.exe
  2⤵
  PID:13792
- C:\Windows\System\XIWEoyp.exe
  C:\Windows\System\XIWEoyp.exe
  2⤵
  PID:13820
- C:\Windows\System\Lrnszeo.exe
  C:\Windows\System\Lrnszeo.exe
  2⤵
  PID:13836
- C:\Windows\System\BddqMus.exe
  C:\Windows\System\BddqMus.exe
  2⤵
  PID:13864
- C:\Windows\System\WWdwYwx.exe
  C:\Windows\System\WWdwYwx.exe
  2⤵
  PID:13892
- C:\Windows\System\RssjOHV.exe
  C:\Windows\System\RssjOHV.exe
  2⤵
  PID:13920
- C:\Windows\System\zdeyYdl.exe
  C:\Windows\System\zdeyYdl.exe
  2⤵
  PID:13952
- C:\Windows\System\kUigIGn.exe
  C:\Windows\System\kUigIGn.exe
  2⤵
  PID:13984
- C:\Windows\System\wbXICdU.exe
  C:\Windows\System\wbXICdU.exe
  2⤵
  PID:14016
- C:\Windows\System\EODDMYr.exe
  C:\Windows\System\EODDMYr.exe
  2⤵
  PID:14048
- C:\Windows\System\ZMiehGU.exe
  C:\Windows\System\ZMiehGU.exe
  2⤵
  PID:14068
- C:\Windows\System\HQDrKzi.exe
  C:\Windows\System\HQDrKzi.exe
  2⤵
  PID:14088
- C:\Windows\System\zPoQKtU.exe
  C:\Windows\System\zPoQKtU.exe
  2⤵
  PID:14128
- C:\Windows\System\GUrHLfG.exe
  C:\Windows\System\GUrHLfG.exe
  2⤵
  PID:14160
- C:\Windows\System\kPfdyoo.exe
  C:\Windows\System\kPfdyoo.exe
  2⤵
  PID:14180
- C:\Windows\System\ysLnVpU.exe
  C:\Windows\System\ysLnVpU.exe
  2⤵
  PID:14208
- C:\Windows\System\NfyKBIy.exe
  C:\Windows\System\NfyKBIy.exe
  2⤵
  PID:14228
- C:\Windows\System\olHgPSp.exe
  C:\Windows\System\olHgPSp.exe
  2⤵
  PID:14272
- C:\Windows\System\OyRacdm.exe
  C:\Windows\System\OyRacdm.exe
  2⤵
  PID:14296
- C:\Windows\System\rNhmyWn.exe
  C:\Windows\System\rNhmyWn.exe
  2⤵
  PID:12744
- C:\Windows\System\ErBcNtM.exe
  C:\Windows\System\ErBcNtM.exe
  2⤵
  PID:12868
- C:\Windows\System\zrRzyMn.exe
  C:\Windows\System\zrRzyMn.exe
  2⤵
  PID:13352
- C:\Windows\System\ZkkjILa.exe
  C:\Windows\System\ZkkjILa.exe
  2⤵
  PID:13420
- C:\Windows\System\VBVVaCC.exe
  C:\Windows\System\VBVVaCC.exe
  2⤵
  PID:13484
- C:\Windows\System\vJgpcCr.exe
  C:\Windows\System\vJgpcCr.exe
  2⤵
  PID:13564
- C:\Windows\System\MzdDYoK.exe
  C:\Windows\System\MzdDYoK.exe
  2⤵
  PID:13600
- C:\Windows\System\lVVXnoO.exe
  C:\Windows\System\lVVXnoO.exe
  2⤵
  PID:13680
- C:\Windows\System\VTNcelW.exe
  C:\Windows\System\VTNcelW.exe
  2⤵
  PID:13724
- C:\Windows\System\qfDQuRr.exe
  C:\Windows\System\qfDQuRr.exe
  2⤵
  PID:13804
- C:\Windows\System\zIlfzTy.exe
  C:\Windows\System\zIlfzTy.exe
  2⤵
  PID:13884
- C:\Windows\System\GyDbPZC.exe
  C:\Windows\System\GyDbPZC.exe
  2⤵
  PID:13912
- C:\Windows\System\NiPkNoJ.exe
  C:\Windows\System\NiPkNoJ.exe
  2⤵
  PID:13976
- C:\Windows\System\JFOLqxm.exe
  C:\Windows\System\JFOLqxm.exe
  2⤵
  PID:14112
- C:\Windows\System\tkNoLhJ.exe
  C:\Windows\System\tkNoLhJ.exe
  2⤵
  PID:14108
- C:\Windows\System\KEEdjdd.exe
  C:\Windows\System\KEEdjdd.exe
  2⤵
  PID:14240
- C:\Windows\System\jUxHkHF.exe
  C:\Windows\System\jUxHkHF.exe
  2⤵
  PID:14324
- C:\Windows\System\KYlHXns.exe
  C:\Windows\System\KYlHXns.exe
  2⤵
  PID:13456
- C:\Windows\System\MyjiJMp.exe
  C:\Windows\System\MyjiJMp.exe
  2⤵
  PID:13504
- C:\Windows\System\xSmLkFv.exe
  C:\Windows\System\xSmLkFv.exe
  2⤵
  PID:13588
- C:\Windows\System\YhjITCz.exe
  C:\Windows\System\YhjITCz.exe
  2⤵
  PID:13644
- C:\Windows\System\yxcEFvZ.exe
  C:\Windows\System\yxcEFvZ.exe
  2⤵
  PID:13880
- C:\Windows\System\BlrneKU.exe
  C:\Windows\System\BlrneKU.exe
  2⤵
  PID:13972
- C:\Windows\System\QNrCDHP.exe
  C:\Windows\System\QNrCDHP.exe
  2⤵
  PID:14204
- C:\Windows\System\EPSTbgl.exe
  C:\Windows\System\EPSTbgl.exe
  2⤵
  PID:13376
- C:\Windows\System\lstnepX.exe
  C:\Windows\System\lstnepX.exe
  2⤵
  PID:13692
- C:\Windows\System\OZVlRLD.exe
  C:\Windows\System\OZVlRLD.exe
  2⤵
  PID:13832
- C:\Windows\System\FFsHnXD.exe
  C:\Windows\System\FFsHnXD.exe
  2⤵
  PID:14308
- C:\Windows\System\GrxIkGg.exe
  C:\Windows\System\GrxIkGg.exe
  2⤵
  PID:14344
- C:\Windows\System\LLzBgpk.exe
  C:\Windows\System\LLzBgpk.exe
  2⤵
  PID:14392
- C:\Windows\System\rRNEdro.exe
  C:\Windows\System\rRNEdro.exe
  2⤵
  PID:14408
- C:\Windows\System\sGeVXKJ.exe
  C:\Windows\System\sGeVXKJ.exe
  2⤵
  PID:14436
- C:\Windows\System\YlmbXph.exe
  C:\Windows\System\YlmbXph.exe
  2⤵
  PID:14464
- C:\Windows\System\jDzlqLR.exe
  C:\Windows\System\jDzlqLR.exe
  2⤵
  PID:14492
- C:\Windows\System\sxHAeyG.exe
  C:\Windows\System\sxHAeyG.exe
  2⤵
  PID:14532
- C:\Windows\System\gfAyarA.exe
  C:\Windows\System\gfAyarA.exe
  2⤵
  PID:14560
- C:\Windows\System\DJCLBSj.exe
  C:\Windows\System\DJCLBSj.exe
  2⤵
  PID:14576
- C:\Windows\System\WINYpiR.exe
  C:\Windows\System\WINYpiR.exe
  2⤵
  PID:14616
- C:\Windows\System\vDKtOUJ.exe
  C:\Windows\System\vDKtOUJ.exe
  2⤵
  PID:14632
- C:\Windows\System\PvVqWbh.exe
  C:\Windows\System\PvVqWbh.exe
  2⤵
  PID:14660
- C:\Windows\System\gyeDiZT.exe
  C:\Windows\System\gyeDiZT.exe
  2⤵
  PID:14700
- C:\Windows\System\JhmgWva.exe
  C:\Windows\System\JhmgWva.exe
  2⤵
  PID:14728
- C:\Windows\System\abrCDzD.exe
  C:\Windows\System\abrCDzD.exe
  2⤵
  PID:14744
- C:\Windows\System\Qjoxkpa.exe
  C:\Windows\System\Qjoxkpa.exe
  2⤵
  PID:14772
- C:\Windows\System\TqhlreB.exe
  C:\Windows\System\TqhlreB.exe
  2⤵
  PID:14800
- C:\Windows\System\Koqkmis.exe
  C:\Windows\System\Koqkmis.exe
  2⤵
  PID:14828
- C:\Windows\System\slySsUU.exe
  C:\Windows\System\slySsUU.exe
  2⤵
  PID:14856
- C:\Windows\System\uQWGcAm.exe
  C:\Windows\System\uQWGcAm.exe
  2⤵
  PID:14884
- C:\Windows\System\TjgbnPO.exe
  C:\Windows\System\TjgbnPO.exe
  2⤵
  PID:14924
- C:\Windows\System\XVctBLv.exe
  C:\Windows\System\XVctBLv.exe
  2⤵
  PID:14952
- C:\Windows\System\ttJDjwZ.exe
  C:\Windows\System\ttJDjwZ.exe
  2⤵
  PID:14968
- C:\Windows\System\msWseZp.exe
  C:\Windows\System\msWseZp.exe
  2⤵
  PID:14988
- C:\Windows\System\bNYThMP.exe
  C:\Windows\System\bNYThMP.exe
  2⤵
  PID:15024
- C:\Windows\System\vwpxCli.exe
  C:\Windows\System\vwpxCli.exe
  2⤵
  PID:15044
- C:\Windows\System\wzCbucJ.exe
  C:\Windows\System\wzCbucJ.exe
  2⤵
  PID:15092
- C:\Windows\System\uwPoghj.exe
  C:\Windows\System\uwPoghj.exe
  2⤵
  PID:15120
- C:\Windows\System\zWMENpu.exe
  C:\Windows\System\zWMENpu.exe
  2⤵
  PID:15136
- C:\Windows\System\bmXQMtZ.exe
  C:\Windows\System\bmXQMtZ.exe
  2⤵
  PID:15176
- C:\Windows\System\ecXevQp.exe
  C:\Windows\System\ecXevQp.exe
  2⤵
  PID:15192
- C:\Windows\System\tfGeVho.exe
  C:\Windows\System\tfGeVho.exe
  2⤵
  PID:15220
- C:\Windows\System\othJgIY.exe
  C:\Windows\System\othJgIY.exe
  2⤵
  PID:15248
- C:\Windows\System\LXdNBkQ.exe
  C:\Windows\System\LXdNBkQ.exe
  2⤵
  PID:15276
- C:\Windows\System\LlmRaaY.exe
  C:\Windows\System\LlmRaaY.exe
  2⤵
  PID:15292
- C:\Windows\System\aNwvBLM.exe
  C:\Windows\System\aNwvBLM.exe
  2⤵
  PID:15316
- C:\Windows\System\yccQGXU.exe
  C:\Windows\System\yccQGXU.exe
  2⤵
  PID:15336
- C:\Windows\System\aEaIkoU.exe
  C:\Windows\System\aEaIkoU.exe
  2⤵
  PID:14028
- C:\Windows\System\aXDlbCU.exe
  C:\Windows\System\aXDlbCU.exe
  2⤵
  PID:14420
- C:\Windows\System\zMpbObJ.exe
  C:\Windows\System\zMpbObJ.exe
  2⤵
  PID:14480
- C:\Windows\System\FahItWF.exe
  C:\Windows\System\FahItWF.exe
  2⤵
  PID:14548
- C:\Windows\System\UakayYU.exe
  C:\Windows\System\UakayYU.exe
  2⤵
  PID:14624
- C:\Windows\System\eoTkhzl.exe
  C:\Windows\System\eoTkhzl.exe
  2⤵
  PID:14696
- C:\Windows\System\JIiQSAn.exe
  C:\Windows\System\JIiQSAn.exe
  2⤵
  PID:14736
- C:\Windows\System\WYUFiaw.exe
  C:\Windows\System\WYUFiaw.exe
  2⤵
  PID:14788
- C:\Windows\System\mMqVNId.exe
  C:\Windows\System\mMqVNId.exe
  2⤵
  PID:14912
- C:\Windows\System\PgwxQaj.exe
  C:\Windows\System\PgwxQaj.exe
  2⤵
  PID:14936
- C:\Windows\System\kLEeHLN.exe
  C:\Windows\System\kLEeHLN.exe
  2⤵
  PID:14984
- C:\Windows\System\kWnXpsX.exe
  C:\Windows\System\kWnXpsX.exe
  2⤵
  PID:15052
- C:\Windows\System\epyeaPD.exe
  C:\Windows\System\epyeaPD.exe
  2⤵
  PID:15132
- C:\Windows\System\whAbuAN.exe
  C:\Windows\System\whAbuAN.exe
  2⤵
  PID:15204
- C:\Windows\System\DWzhgql.exe
  C:\Windows\System\DWzhgql.exe
  2⤵
  PID:15304
- C:\Windows\System\tNHUMkz.exe
  C:\Windows\System\tNHUMkz.exe
  2⤵
  PID:15328
- C:\Windows\System\qNWXNER.exe
  C:\Windows\System\qNWXNER.exe
  2⤵
  PID:14472
- C:\Windows\System\QqzlIsN.exe
  C:\Windows\System\QqzlIsN.exe
  2⤵
  PID:14544
- C:\Windows\System\GFWGUrc.exe
  C:\Windows\System\GFWGUrc.exe
  2⤵
  PID:14596
- C:\Windows\System\YChDChD.exe
  C:\Windows\System\YChDChD.exe
  2⤵
  PID:14824
- C:\Windows\System\uNxoiHn.exe
  C:\Windows\System\uNxoiHn.exe
  2⤵
  PID:15184
- C:\Windows\System\sAHOYFV.exe
  C:\Windows\System\sAHOYFV.exe
  2⤵
  PID:15188
- C:\Windows\System\dtqkDmj.exe
  C:\Windows\System\dtqkDmj.exe
  2⤵
  PID:15312
- C:\Windows\System\kekqRhj.exe
  C:\Windows\System\kekqRhj.exe
  2⤵
  PID:14520
- C:\Windows\System\WPXHfeZ.exe
  C:\Windows\System\WPXHfeZ.exe
  2⤵
  PID:14740
- C:\Windows\System\YempIis.exe
  C:\Windows\System\YempIis.exe
  2⤵
  PID:15080
- C:\Windows\System\CypanAe.exe
  C:\Windows\System\CypanAe.exe
  2⤵
  PID:14404
- C:\Windows\System\wGRYvQk.exe
  C:\Windows\System\wGRYvQk.exe
  2⤵
  PID:14216
- C:\Windows\System\PYyKkaE.exe
  C:\Windows\System\PYyKkaE.exe
  2⤵
  PID:15384
- C:\Windows\System\fFvquAb.exe
  C:\Windows\System\fFvquAb.exe
  2⤵
  PID:15404
- C:\Windows\System\HCynSKx.exe
  C:\Windows\System\HCynSKx.exe
  2⤵
  PID:15448
- C:\Windows\System\ULLhFWq.exe
  C:\Windows\System\ULLhFWq.exe
  2⤵
  PID:15464
- C:\Windows\System\wimvVpY.exe
  C:\Windows\System\wimvVpY.exe
  2⤵
  PID:15484
- C:\Windows\System\rYsuNcf.exe
  C:\Windows\System\rYsuNcf.exe
  2⤵
  PID:15520
- C:\Windows\System\bHVmjsv.exe
  C:\Windows\System\bHVmjsv.exe
  2⤵
  PID:15548
- C:\Windows\System\klDSCHa.exe
  C:\Windows\System\klDSCHa.exe
  2⤵
  PID:15584
- C:\Windows\System\zVpFsdp.exe
  C:\Windows\System\zVpFsdp.exe
  2⤵
  PID:15628
- C:\Windows\System\lKGkfFi.exe
  C:\Windows\System\lKGkfFi.exe
  2⤵
  PID:15656
- C:\Windows\System\jFEqyjK.exe
  C:\Windows\System\jFEqyjK.exe
  2⤵
  PID:15684
- C:\Windows\System\vBltWTq.exe
  C:\Windows\System\vBltWTq.exe
  2⤵
  PID:15712
- C:\Windows\System\WaGiXAh.exe
  C:\Windows\System\WaGiXAh.exe
  2⤵
  PID:15740
- C:\Windows\System\JcyFOon.exe
  C:\Windows\System\JcyFOon.exe
  2⤵
  PID:15756
- C:\Windows\System\Nrrztfr.exe
  C:\Windows\System\Nrrztfr.exe
  2⤵
  PID:15772
- C:\Windows\System\FDvHzxP.exe
  C:\Windows\System\FDvHzxP.exe
  2⤵
  PID:15812
- C:\Windows\System\uMPsqNK.exe
  C:\Windows\System\uMPsqNK.exe
  2⤵
  PID:15840
- C:\Windows\System\UmNxehs.exe
  C:\Windows\System\UmNxehs.exe
  2⤵
  PID:15868
- C:\Windows\System\pfLQZDQ.exe
  C:\Windows\System\pfLQZDQ.exe
  2⤵
  PID:15900
- C:\Windows\System\eouYQhU.exe
  C:\Windows\System\eouYQhU.exe
  2⤵
  PID:15932
- C:\Windows\System\ztXDEMu.exe
  C:\Windows\System\ztXDEMu.exe
  2⤵
  PID:15964
- C:\Windows\System\hphhjVB.exe
  C:\Windows\System\hphhjVB.exe
  2⤵
  PID:15984
- C:\Windows\System\srashbY.exe
  C:\Windows\System\srashbY.exe
  2⤵
  PID:16020
- C:\Windows\System\rLhoiQc.exe
  C:\Windows\System\rLhoiQc.exe
  2⤵
  PID:16048
- C:\Windows\System\PINkQRQ.exe
  C:\Windows\System\PINkQRQ.exe
  2⤵
  PID:16076
- C:\Windows\System\WUklMPV.exe
  C:\Windows\System\WUklMPV.exe
  2⤵
  PID:16096
- C:\Windows\System\THtKpgr.exe
  C:\Windows\System\THtKpgr.exe
  2⤵
  PID:16128
- C:\Windows\System\ZCDEvrS.exe
  C:\Windows\System\ZCDEvrS.exe
  2⤵
  PID:16148
- C:\Windows\System\hGJNTLA.exe
  C:\Windows\System\hGJNTLA.exe
  2⤵
  PID:16176
- C:\Windows\System\OXqvNtk.exe
  C:\Windows\System\OXqvNtk.exe
  2⤵
  PID:16192
- C:\Windows\System\RmpMVxG.exe
  C:\Windows\System\RmpMVxG.exe
  2⤵
  PID:16216
- C:\Windows\System\prvvMqy.exe
  C:\Windows\System\prvvMqy.exe
  2⤵
  PID:16248
- C:\Windows\System\dJScocv.exe
  C:\Windows\System\dJScocv.exe
  2⤵
  PID:16304
- C:\Windows\System\lZsvVlP.exe
  C:\Windows\System\lZsvVlP.exe
  2⤵
  PID:16332
- C:\Windows\System\PZUyoWW.exe
  C:\Windows\System\PZUyoWW.exe
  2⤵
  PID:16360
- C:\Windows\System\yxHysHB.exe
  C:\Windows\System\yxHysHB.exe
  2⤵
  PID:15244
- C:\Windows\System\SSDYrRe.exe
  C:\Windows\System\SSDYrRe.exe
  2⤵
  PID:15396
- C:\Windows\System\ZFDmHUw.exe
  C:\Windows\System\ZFDmHUw.exe
  2⤵
  PID:15440
- C:\Windows\System\wQqcNlY.exe
  C:\Windows\System\wQqcNlY.exe
  2⤵
  PID:15504
- C:\Windows\System\orqbsAW.exe
  C:\Windows\System\orqbsAW.exe
  2⤵
  PID:15576
- C:\Windows\System\FuXvSjs.exe
  C:\Windows\System\FuXvSjs.exe
  2⤵
  PID:15676
- C:\Windows\System\HBaOWrp.exe
  C:\Windows\System\HBaOWrp.exe
  2⤵
  PID:15724
- C:\Windows\System\apgkLgr.exe
  C:\Windows\System\apgkLgr.exe
  2⤵
  PID:15784
- C:\Windows\System\QAkpZiB.exe
  C:\Windows\System\QAkpZiB.exe
  2⤵
  PID:15832
- C:\Windows\System\EZtLMmC.exe
  C:\Windows\System\EZtLMmC.exe
  2⤵
  PID:15916
- C:\Windows\System\MyvGHtM.exe
  C:\Windows\System\MyvGHtM.exe
  2⤵
  PID:16000
- C:\Windows\System\cdRasoZ.exe
  C:\Windows\System\cdRasoZ.exe
  2⤵
  PID:16060
- C:\Windows\System\mlXgyOA.exe
  C:\Windows\System\mlXgyOA.exe
  2⤵
  PID:16092
- C:\Windows\System\xasYSVP.exe
  C:\Windows\System\xasYSVP.exe
  2⤵
  PID:16204
- C:\Windows\System\dWzmWqm.exe
  C:\Windows\System\dWzmWqm.exe
  2⤵
  PID:16236
- C:\Windows\System\UapUrXV.exe
  C:\Windows\System\UapUrXV.exe
  2⤵
  PID:16348
- C:\Windows\System\UwPgCKN.exe
  C:\Windows\System\UwPgCKN.exe
  2⤵
  PID:16380
- C:\Windows\System\iTngYQf.exe
  C:\Windows\System\iTngYQf.exe
  2⤵
  PID:15436
- C:\Windows\System\NZSnxVR.exe
  C:\Windows\System\NZSnxVR.exe
  2⤵
  PID:15612
- C:\Windows\System\AIeiayv.exe
  C:\Windows\System\AIeiayv.exe
  2⤵
  PID:15764
- C:\Windows\System\iUuseap.exe
  C:\Windows\System\iUuseap.exe
  2⤵
  PID:15864
- C:\Windows\System\qwQvCXA.exe
  C:\Windows\System\qwQvCXA.exe
  2⤵
  PID:16140
- C:\Windows\System\aAIaaCo.exe
  C:\Windows\System\aAIaaCo.exe
  2⤵
  PID:16316
- C:\Windows\System\DCDlCWi.exe
  C:\Windows\System\DCDlCWi.exe
  2⤵
  PID:16300
- C:\Windows\System\TDMcbFo.exe
  C:\Windows\System\TDMcbFo.exe
  2⤵
  PID:15648
- C:\Windows\System\CfFdxVx.exe
  C:\Windows\System\CfFdxVx.exe
  2⤵
  PID:16172
- C:\Windows\System\fKuIOFB.exe
  C:\Windows\System\fKuIOFB.exe
  2⤵
  PID:16260
- C:\Windows\System\xryXDnj.exe
  C:\Windows\System\xryXDnj.exe
  2⤵
  PID:16392
- C:\Windows\System\QuZtjFh.exe
  C:\Windows\System\QuZtjFh.exe
  2⤵
  PID:16420
- C:\Windows\System\bKLyOoc.exe
  C:\Windows\System\bKLyOoc.exe
  2⤵
  PID:16448
- C:\Windows\System\ZqNJkLc.exe
  C:\Windows\System\ZqNJkLc.exe
  2⤵
  PID:16476
- C:\Windows\System\mjGwZDM.exe
  C:\Windows\System\mjGwZDM.exe
  2⤵
  PID:16492
- C:\Windows\System\gbFaBGb.exe
  C:\Windows\System\gbFaBGb.exe
  2⤵
  PID:16532
- C:\Windows\System\AKBLJtt.exe
  C:\Windows\System\AKBLJtt.exe
  2⤵
  PID:16548
- C:\Windows\System\LuLaZeQ.exe
  C:\Windows\System\LuLaZeQ.exe
  2⤵
  PID:16564
- C:\Windows\System\uXxAFbA.exe
  C:\Windows\System\uXxAFbA.exe
  2⤵
  PID:16616
- C:\Windows\System\EabOAmM.exe
  C:\Windows\System\EabOAmM.exe
  2⤵
  PID:16632
- C:\Windows\System\wjGdhUh.exe
  C:\Windows\System\wjGdhUh.exe
  2⤵
  PID:16660
- C:\Windows\System\JqKtBJm.exe
  C:\Windows\System\JqKtBJm.exe
  2⤵
  PID:16688
- C:\Windows\System\pROqsna.exe
  C:\Windows\System\pROqsna.exe
  2⤵
  PID:16704
- C:\Windows\System\LZaLsKi.exe
  C:\Windows\System\LZaLsKi.exe
  2⤵
  PID:16732
- C:\Windows\System\pTRotfm.exe
  C:\Windows\System\pTRotfm.exe
  2⤵
  PID:16776
- C:\Windows\System\AwnQhtF.exe
  C:\Windows\System\AwnQhtF.exe
  2⤵
  PID:16796
- C:\Windows\System\peSpCSy.exe
  C:\Windows\System\peSpCSy.exe
  2⤵
  PID:16832
- C:\Windows\System\eFpCZSa.exe
  C:\Windows\System\eFpCZSa.exe
  2⤵
  PID:16876
- C:\Windows\System\WCpkhZg.exe
  C:\Windows\System\WCpkhZg.exe
  2⤵
  PID:16904
- C:\Windows\System\XDAanUm.exe
  C:\Windows\System\XDAanUm.exe
  2⤵
  PID:16920
- C:\Windows\System\wkNJEFZ.exe
  C:\Windows\System\wkNJEFZ.exe
  2⤵
  PID:16960
- C:\Windows\System\peNjXLa.exe
  C:\Windows\System\peNjXLa.exe
  2⤵
  PID:16988
- C:\Windows\System\GEqDqOf.exe
  C:\Windows\System\GEqDqOf.exe
  2⤵
  PID:17004
- C:\Windows\System\uHiCeOI.exe
  C:\Windows\System\uHiCeOI.exe
  2⤵
  PID:17044
- C:\Windows\System\gOaRJUM.exe
  C:\Windows\System\gOaRJUM.exe
  2⤵
  PID:17060
- C:\Windows\System\XpqFwnH.exe
  C:\Windows\System\XpqFwnH.exe
  2⤵
  PID:17100
- C:\Windows\System\IFfvatJ.exe
  C:\Windows\System\IFfvatJ.exe
  2⤵
  PID:17128

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:17364

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\APdFIsy.exe

Filesize
1.5MB

MD5
6e7b146ec5540539093a2ed3dd4f8c56

SHA1
c7c78a9b6d01f1e7087e7dfec210b9695735f2e9

SHA256
8075874ead003ea6321ef76aa485617129a6dbf6d1b8a5f661d6c9fc515d4349

SHA512
35ef72b132365699da53427e019c381872b026d400f11c49e09b2a548da5419abb9c9614986dcc46ccf5b79bf34f7843bc1ad31a6cd6c9013802f467b7c0021b

Download Submit
C:\Windows\System\AyGxYqf.exe

Filesize
1.5MB

MD5
2f5a29fea73b5746b60350a7243998f8

SHA1
0e4d951ca26d8db156c8e3bb007cecd1e5b9be3f

SHA256
7967298d99fd30b870419ba30afe85411b88297a5842dc1768b72c03a12f3f79

SHA512
806ef2a574cd66ec74e485d90d136103ce6a9e5ec63cbb5a1111961d688e135cb8dc395afc6a1f6fbdf360b3a2668972e003e08c41dc9931779e70801d2cb8ac

Download Submit
C:\Windows\System\BOOsqxi.exe

Filesize
1.5MB

MD5
52b2ed860d3acada0f6a9a1a6c73f13c

SHA1
2fe4107172e38ae9c2b89479e468074952e1f5ca

SHA256
97df258a94659e25f44d68398bcea47e4e9d89fc21909b761b3f362ae6245bd1

SHA512
cbee53bc0fa08fa3889d1ac4df8ab3a87183434fcfa88b7d4a73a0b62fea54917492fac3cb6b488db88857a57b0746db83ea2d0da0ab9865c10ac00bd4e949aa

Download Submit
C:\Windows\System\DXXnRCe.exe

Filesize
1.5MB

MD5
382d69599656d20b4cdd6fef84beb6a2

SHA1
aa9d3209ea640b68e5fa9e913f0bc1f286041446

SHA256
13c0e28c6b0d5ee6d9afc7f4b4c8046694570741c69a51b572d7803058e77a3b

SHA512
ef3933b53af916f910b4d49280a59201b5e8ab53647a56a590d0aceb557ae1d410e11c5639ab189e30df9750626e10106c06633c10a46207729bbc4d241c099f

Download Submit
C:\Windows\System\FjkRKlb.exe

Filesize
1.5MB

MD5
9d6bd3e9921700b1c25f69695a843a02

SHA1
f6ec9d6fa09644067156e0de7dc2e13c7e167e9b

SHA256
693f61248f4c09a5c6b4c66e1b9cf857426673bda2628aa74e60c494ff136231

SHA512
beb1ff59ad6d7306f3017d3a75b8980449a50f3796beba06a5acb89602672b9a29173d9aafe626e71f70603d4b8da40ce008a2348c798d42db80175622b8d35f

Download Submit
C:\Windows\System\GVOfgKU.exe

Filesize
1.5MB

MD5
e9de64962ba8c7d1a07871a9f01f3d04

SHA1
7420e4a29dd2427a34a9502fac728ab28af664ed

SHA256
f6aee246a9b9da3dc2d3879bf1b9a24767ca18913120a40f858c4bfab0e4940b

SHA512
ff2b2931c2d103b14fa864e2c25db6ee1a577e3561890e10d7f1255415fe9f1b182e94093869b4d50262da3b541310848d91dc8fb88da45ec715f54348ca27fd

Download Submit
C:\Windows\System\GlGWRgl.exe

Filesize
1.5MB

MD5
4eb6de6e03585ad28dcc0d04bc00e5b6

SHA1
25e09cf9fc62f270dc99431ffd57e7bf8b2ac9cd

SHA256
2abc306db8d548345dbb6ba171969e21103baa6aab2d3b3fb7af46f8acfd7eeb

SHA512
82e1048e99e41effefa47f965bab71092d9f8e18d23640fa4fda3024a6f3d0b82e77bcb59e168e7bf12fb707f653c43e177ed98cd9fcf446e0afb22dba0235ec

Download Submit
C:\Windows\System\IlKYefM.exe

Filesize
1.5MB

MD5
e34d1d17bdf3e797ad34986421b3d015

SHA1
cc3eb7f0ed461d87a30b68d4849e5493d2df1410

SHA256
9cfcc9ad48e7f3ab13fd7969a469df201bc024d16e19646bfae6e9d321916b2c

SHA512
ddfc33fd9723eccd820030ca5daedb41ac5c2db00cc7d3fb1e005393398d4cb7df500d8d9f0fee0cf41d237e5123ff249f1c353ea399dc7e108ef99ae25500df

Download Submit
C:\Windows\System\KIHnCCq.exe

Filesize
1.5MB

MD5
ffd59f6ba651865cab2b1b12f6daa60b

SHA1
93c77a93dfca79fe0a5e6e69bc99bf9333018ef8

SHA256
81868bdf0945c338a02956d77fb64a1dd6b07bcd2d10ebb2d887b7f4cc1bd48e

SHA512
c8193d2f096b79a307e39da14ec30c4cc868a1053f26afbf19a17d815691018ea7f1d1b50e4b0f78eb3a70f3c3816670e66872e83c2f81d1cf2b7c2135bd3edb

Download Submit
C:\Windows\System\LnzcSWN.exe

Filesize
1.5MB

MD5
e47422adea80857fc113424b43db407a

SHA1
f13af4f61971bccc69dd268005af0a830b40cfbe

SHA256
a2ef72227b740dd7468c487f6dc3bb532c5763455ea37596186d37b9b26133c5

SHA512
2b3ec953ca8a5a4c0addaa6a3ebd954f5d8db8cbfad2086c1be431a04daf417b2a301e65f41679375c32c83773b29dfc0f47047be8ed6bdfacfa30b6034c7871

Download Submit
C:\Windows\System\MsPiDzu.exe

Filesize
1.5MB

MD5
b06ef2cbdb258c9596993c2d09940447

SHA1
599b227854439ce0f448196bbf0c5f92af723e91

SHA256
d3c743eca24efdd7458f5278971fba9c42c43696b39b605ea1f415151ed235f8

SHA512
b1d4ab69eb568a9cf3a82675e6edd3410755e2071546be9b12fb809120ceb3c6b1dc883c15db08609d967345ed6faf93f4d55f60c1f93e8d946cb959628801ca

Download Submit
C:\Windows\System\NTdisco.exe

Filesize
1.5MB

MD5
33fe712af837c678cb11f323465ac388

SHA1
c037165ab32564c88767b7ccf2607546c1ce6459

SHA256
8b69492ebf0b0f0d7fda4e6a799c4f3bb55c7471caac2a828e253fdef11e0d68

SHA512
795b2c2357e9d844334e30cccc088b662b00e990c8803c4e9d01a29b09f8df66b027d354382a4788a1ef1fdfb31fd7af4312c87466994d1c5696578e8f32fa20

Download Submit
C:\Windows\System\PCqMpHG.exe

Filesize
1.5MB

MD5
e4d5082d4ed2f3d3d04b23b131823144

SHA1
716947934d0ef114814b58e373b03fd00c8ca42f

SHA256
2e925160fe50061fd6c5db10ad96697a2610717d2f8e463567c5bec364c3bfc7

SHA512
5a95ed2f71797c3c4aaaa8a247c2c6e41af44651dfee993f04392eb89bc3e7c6d3c434c749702507853603a85acb9cdc034b8ffabb8b965c82a40c7df7298dce

Download Submit
C:\Windows\System\PgSYIuQ.exe

Filesize
1.5MB

MD5
583d72312fcff5929334777a2783913d

SHA1
e87491eb83bcda76ff534f41581e77fcd5afea77

SHA256
c1d06ab9b75dd3815e4d0088c256ded6a0fef5097977372e457740e14434b10d

SHA512
80fe93ac99e35c86679428b8a7a8d4825683f5ff8da21f0418de64c43488951e42107ca4955e02a355fabd78f929c8353000641d7314f758de3cb3151754332f

Download Submit
C:\Windows\System\QpGKPdQ.exe

Filesize
1.5MB

MD5
6f45fc2e6f1978f4549a3c083f18bda3

SHA1
3da795a0747ae57d0a31641bfff897fe46c4e39e

SHA256
6b544bdb91abe4a437fb7f95c0c329792184e61b38d93bb6aa8b3aa05b33ba18

SHA512
4d00bc76e7c162245077eeeda4ce1ca81c0a53d6fb172ea5c1c810d18bc736ec079762e113d7a8ac5b184c0ceb06053daca6b97f2934ecb28d692c348fefe6d5

Download Submit
C:\Windows\System\RUadOCx.exe

Filesize
1.5MB

MD5
90c7e3163ea2f89135dccfb7f5ff11b3

SHA1
e0dc74573c4b4db3fae4abbda424805d98516d0c

SHA256
5ea8b8f868e7e42233203974720caf76c8085e4ea3c0cb3ddb64970663954647

SHA512
cca3e87e081d9a7f92752a4cb3fc792d863331cb39fdb04778305ecd05fa625bf20b9e686bb3f19e8cbbb4fe9933fe3da0165d5245ea08cb26362c4733f03599

Download Submit
C:\Windows\System\VkXFYti.exe

Filesize
1.5MB

MD5
2a72851b2f604641d3147eea901d9b49

SHA1
c02db5c9c5070b69654d1bf675cd3d52736ce8cd

SHA256
7d4571c9024987641c41876f7f20e73e8eb6a66e71f9c3d97acc0ccad6a1aef6

SHA512
747ba43c4602f46e45d5843ce02064faf06cb622af531817efafec9d0f2d8990b48cee12698c8fe63bef2694e600752e3da164550cce6cf1ecca84cfb5462b6c

Download Submit
C:\Windows\System\YTLahDK.exe

Filesize
1.5MB

MD5
5ebb985e667374d35a8b773f52b67f81

SHA1
21ec355adcbd72e16126b13fcb2094a521c27b89

SHA256
8a04a2ee27061dac3bb10d88c8b2a33adceedddbf76e96f3122e400ae91614b3

SHA512
b07d5523360d93d28741871e309ef1f2039c6cf625bcc86eafcd8d2ebedb04b27bd895218c8e37c3e42e0318fde73e3e0555e0d1964ed93f2889ae06079ef6ed

Download Submit
C:\Windows\System\chGnwvZ.exe

Filesize
1.5MB

MD5
7382443dde82e1d440beb193911f09ce

SHA1
2820800fcf0d85c1eb414deb28cde9633b3044d0

SHA256
520a366f116bbef255239a309079089cd4b7e2b32f2ddd05e7ed2f2e81d6d938

SHA512
0e2704045362b08c154ffabf3c4f3736a215429a1485a6a1a3c5cd234245411ee66ac689972a88b35b0e9f253626c6975361e42b822c8d4a81496fdc24a61689

Download Submit
C:\Windows\System\dtorqQt.exe

Filesize
1.5MB

MD5
4e6d13d165a736ccae9bb7c857e48444

SHA1
4d934ec44240ca7186d06d000c8061a3ccebb571

SHA256
f0957636d5750129130ab5c66a7d52823286fdab7239f4564ccd24a18baf2042

SHA512
f8da6b1748c31cc0e416f77d3b1bd3e2de1e786eab8c51dbba1b9af63456a1b8796b70361ab4c031dd983fa78101360eda0bc17b500af68b1c42ab31833e056c

Download Submit
C:\Windows\System\eqyBolD.exe

Filesize
1.5MB

MD5
23583e9d71f5388b085f5e96db511c1b

SHA1
6290621eeff098ef8beb7eb702a10b825e9ffb9d

SHA256
c314ea75e7c1d8cf947e1a2d2ff3eaa7077635f818de713bd4bad60a6bd1aa03

SHA512
e36a48b6cbe4f70e831ca26f41e85b36da56802b57f41bbc6e8a016b72625d2ba1724b5a3929288d55869a6f70fb49260ffbf6dba12115386e82b0df02ab3a51

Download Submit
C:\Windows\System\fRPQGqe.exe

Filesize
1.5MB

MD5
51094cc7edf980a046bdc060ba30b566

SHA1
9a73e9fbe043f1a65610e06ba374510cf5118895

SHA256
83d9020bb672dabf3bd4c13c4b6c978d88f883c56cf53f99f39ee6c3ae9a21a8

SHA512
4c5788ae7c8e7dd318a46dc81b43c2675c2c262db9d3bc1dc8cdacdc994833b7cfe096a3f7a180b54f181688199cdaba4e7402efba4623753d4e051346c10f77

Download Submit
C:\Windows\System\jZkiyAe.exe

Filesize
1.5MB

MD5
d2a6cdcf72c807bded2d9ed7d8ae39b3

SHA1
0293c3ffa97b3e6b0350bd8500b74ee0fef53673

SHA256
e8e2715e829fee98bd6f62a196c63ae8103876f0fc9552b76c28a9f5bea06293

SHA512
656338358a478dffc1ecd78dacc079674f82e6f5530de761f11fa17067f2c2fab1fda83db929de00e2c873c127560d8c8250af38b67a2ec19c53565f2a45b89c

Download Submit
C:\Windows\System\kHsJxPv.exe

Filesize
1.5MB

MD5
46874a7aa10d6577a43f656a821463d1

SHA1
2091bef3f771fc781f4edeeeb91854ee05888c33

SHA256
a77567cd9e9c12a326e458215fee3be163d89e6e10c66a7458fe052b38713eef

SHA512
c7397dedab750cf680f68199163b5641dff4cb46612a2a74f570ec206ff8a2e506da47b29257b4963fa62e5008a66c4f970fa6a01cf00946ff99bd8041800214

Download Submit
C:\Windows\System\lTlmMPz.exe

Filesize
1.5MB

MD5
caa52de75c94fdcfc6573dcc5cc14cc6

SHA1
83db336915b634a7ab9493a9ede9ccef441afc89

SHA256
3acade56216b7e1d901a48569d071628a70e2bdc5151bb559632f4c5fe067dbb

SHA512
ea9fb701561c3ffb0a2f16a8c9cd255d8aaf0a4d93ee3a6c68384bcf64196bd43a9db3a5786660225f317dbff3b9c2e7bb7d03112ce52e89a19736916bd5dbe6

Download Submit
C:\Windows\System\nljjhrl.exe

Filesize
1.5MB

MD5
d126b1bf338ba7c40dd461391ff4a653

SHA1
951fbc477d2f0c046af0af21bf25cf25a81896da

SHA256
4d1bf7e983b149d41925c60aaff601e2a062680909dc638c9e1d07f328ba64bc

SHA512
cebbdfc896a5c640f75eeaed28792984270f5d8f5d2f591b82530071f444dc00f4805c75738120a7e2ceb84c59898068cc72741b42079368874774b837b7a28d

Download Submit
C:\Windows\System\npMmSvD.exe

Filesize
1.5MB

MD5
27ac08d5e084fc06994444259e61ccb4

SHA1
c7f18de15d2a476707d0564a8b1e2caf502e69ca

SHA256
33db6ad04ea6677d11763e6d27ec0f52464f1898406f353b48bddce27c934317

SHA512
660489e57cd74dc68c49e6307b75e12e5b3e1e0ca223da6162a14bd8fa046724fb93f21d9487c77dbafb15076bcc0860fd190005b1f6d796b0582e18c1ee8215

Download Submit
C:\Windows\System\nuBLYSt.exe

Filesize
1.5MB

MD5
d40396d628bd9bce21125fd441182ca5

SHA1
f76389fa64bf2c0a9b47e635e6abdc7a0124110b

SHA256
239b7d2d2b16cb2883b54dbeccf064f95144e6e414e90c3acdb5ed927bd3ca62

SHA512
bf4f354bab778286c4e58d2a635314c4888e600ea2d54a87b5eaa477f77dbafe84035d8671dbdbf5b1547a8735c4f46d59b61c2f0785baaea7d937aedea0ec7a

Download Submit
C:\Windows\System\vYjJkwK.exe

Filesize
1.5MB

MD5
45d169e9d96161b23a0f513fe9322473

SHA1
ddaac5926838046658cf6b0b82df03de2c5792e1

SHA256
e11ee423790d4ecbd4e9b1ea45ebb3fe3cefe8f51d560ff29a31d9ea1688fbac

SHA512
2aa6151eee00f67c0f50eaa7759f40a3821a247055a06b02ae2ac52ac2be1d1a31e6c4ae2cbc3dc0b786711c168f3dfd2ccabcecb70593fc24dee32c364dcc20

Download Submit
C:\Windows\System\wHhDfDA.exe

Filesize
1.5MB

MD5
4a1ac6389aa08dd36afa2320964f3b9c

SHA1
e5a09857bb4945f29cf38c9927ad2eaa3e49af88

SHA256
ae02329d10391fa523f3fc1e3268f8e1111fdfa69d58405d1d76c0bd4a9d5882

SHA512
9c9d94f2c28010ad0953e39e18a225feb522b0c212e0225d9ff939482d09ec6bd15293363d43f7706a0b3efe94bc0db561af0cbe91b06576eb1f501d4ae0f16d

Download Submit
C:\Windows\System\xlCFHgC.exe

Filesize
1.5MB

MD5
726ce529736872002df97e968aab3c34

SHA1
e92baab3aa32a0336024e1e01f5d4cabc9d157f7

SHA256
6d0d16fa391c91355e6d5c847972b95122409548bb813bc8cf322fe651f428f3

SHA512
b38f5fc0ad3a765069fa06d45963cbc056c10ecaf25842362024b634bbf2a2439df6a425dfe91808207df6a1a6c4349de7af85abdeefd02fe54ed472dd113104

Download Submit
C:\Windows\System\xvFQyua.exe

Filesize
1.5MB

MD5
dd1b92fe97d77e03044d1abfe503b184

SHA1
f13403db711b99ad60daad5c6c425ad348d8c16d

SHA256
62a94796caf5d33e535cce0c6b3fc7668236d857afdcf5340eb4e8301dfd526b

SHA512
4613c9b446ddf6e44230b68c551af77add239f819e06d3514d63d0211f3aa452b5a6d98116c17270e8233f487f0189a0aeee141e2c43c14041ce6c2b5f0f6034

Download Submit
C:\Windows\System\yngpnrG.exe

Filesize
1.5MB

MD5
3692f2a9947008d2ad1d14587be065a9

SHA1
e48d7b1b19f97f9c43adeacb3776aa01210a0727

SHA256
a24a95ac2ec3b264cf3d492b922f88084b063dd9c823b11beb208adcb9d57156

SHA512
394fab912e6e0f9de25d5b73aeb72c6b4605e71c60d81183b277573985a54efa92e44de7ead3de4394875465f63bf3bb44ac269903719470f759ea92a351faca

Download Submit
memory/4836-0-0x000001FAD9390000-0x000001FAD93A0000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads