xmrig | cbf006da97145ce54f69b467d2baa49099c5b09c4ecf682cf50b67d6251fb82a

Analysis

max time kernel
96s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
21-12-2024 04:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cbf006da97145ce54f69b467d2baa49099c5b09c4ecf682cf50b67d6251fb82a.exe
Size

1.7MB
MD5

3374601eeb2ef7e0797682119dce1c7f
SHA1

5b2fdce94e09e6eeaed1820c2e18b51311fdb15a
SHA256

cbf006da97145ce54f69b467d2baa49099c5b09c4ecf682cf50b67d6251fb82a
SHA512

b06714d93d32918dc78215471a155e5a4be0070a555688d0dd62c0ee42a2be2ccf8bfe2aef8c3f6dca95fa90104ad5db57d828880dd494f74098fed8a95c5159
SSDEEP

49152:GezaTF8FcNkNdfE0pZ9ozttwIRxj4c5yOBZnmxZ8zoIx:GemTLkNdfE0pZyb

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 32 IoCs

miner

resource	yara_rule
behavioral2/files/0x000c000000023b35-3.dat	xmrig
behavioral2/files/0x000e000000023bb7-9.dat	xmrig
behavioral2/files/0x0008000000023bb9-12.dat	xmrig
behavioral2/files/0x0008000000023bbc-20.dat	xmrig
behavioral2/files/0x0008000000023bbd-23.dat	xmrig
behavioral2/files/0x0008000000023bbe-29.dat	xmrig
behavioral2/files/0x0008000000023bbf-34.dat	xmrig
behavioral2/files/0x0008000000023bee-39.dat	xmrig
behavioral2/files/0x0008000000023bef-44.dat	xmrig
behavioral2/files/0x000a000000023bb1-53.dat	xmrig
behavioral2/files/0x0008000000023bf0-55.dat	xmrig
behavioral2/files/0x0008000000023bf1-58.dat	xmrig
behavioral2/files/0x0008000000023bf2-64.dat	xmrig
behavioral2/files/0x0008000000023bf3-68.dat	xmrig
behavioral2/files/0x0008000000023bf8-78.dat	xmrig
behavioral2/files/0x0008000000023c0c-86.dat	xmrig
behavioral2/files/0x0008000000023c13-90.dat	xmrig
behavioral2/files/0x0008000000023c14-98.dat	xmrig
behavioral2/files/0x000b000000023c2c-113.dat	xmrig
behavioral2/files/0x0008000000023c17-118.dat	xmrig
behavioral2/files/0x0008000000023c16-116.dat	xmrig
behavioral2/files/0x0008000000023c15-114.dat	xmrig
behavioral2/files/0x0008000000023c12-95.dat	xmrig
behavioral2/files/0x0008000000023bfa-80.dat	xmrig
behavioral2/files/0x0016000000023c2d-123.dat	xmrig
behavioral2/files/0x0008000000023c33-130.dat	xmrig
behavioral2/files/0x0008000000023c37-134.dat	xmrig
behavioral2/files/0x0008000000023c43-139.dat	xmrig
behavioral2/files/0x0008000000023c45-150.dat	xmrig
behavioral2/files/0x0008000000023c44-153.dat	xmrig
behavioral2/files/0x0008000000023c46-155.dat	xmrig
behavioral2/files/0x0008000000023c47-158.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2448	xcFuRzA.exe
3648	DBieXRB.exe
2548	mBxoABz.exe
1872	ibzWeQk.exe
224	MPZGbvx.exe
1976	qmeMFen.exe
3024	FVVnxFW.exe
3656	IPgZkMd.exe
4120	WLJLyvC.exe
2252	kaeAqSA.exe
3764	BoFkpfI.exe
4704	RvwpMMG.exe
3908	pkXtqoc.exe
4832	jmocyit.exe
1456	IFarFLX.exe
4576	dVVdrjo.exe
4208	WDurqrw.exe
1580	LYCRoBv.exe
2868	bKnIiFw.exe
4572	AEWblLq.exe
3692	zlbUTMJ.exe
2812	McBZFeJ.exe
4072	papxYnD.exe
1288	TASJZYs.exe
4204	ywLrUHU.exe
3088	hkIWrdx.exe
1496	EeGBmfT.exe
1056	OQIXBVj.exe
3688	yClvODT.exe
2432	huIQZKt.exe
452	QAbseTR.exe
1248	CofjTtu.exe
2552	PlURhNE.exe
1396	cQnrKLM.exe
632	RLTpLMJ.exe
2752	GmsZhDi.exe
4672	hnUXSFL.exe
3332	ZYwuOrC.exe
2808	hCYNdrm.exe
1296	TPaWxNV.exe
2300	SgAlsyb.exe
4424	fJgNexL.exe
2364	jdWzAvb.exe
3608	gTEXCez.exe
2860	rfYDcRo.exe
936	kOmIiyh.exe
32	pbofhxj.exe
1672	stfYGDr.exe
5092	pUPJvex.exe
3840	FbXoFED.exe
5000	XLFLekg.exe
2004	mrTTyYI.exe
4516	hoFeFHg.exe
3972	cJOkzZR.exe
208	HQIptxs.exe
1800	vaUmroh.exe
1488	LkPpask.exe
2076	kJgHWsr.exe
4716	pZhNkLD.exe
1548	kExBvQv.exe
4344	qmSRknw.exe
2476	NHdRiOJ.exe
1944	farzbpV.exe
1116	WvpIeOV.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\OEAuKFT.exe	cbf006da97145ce54f69b467d2baa49099c5b09c4ecf682cf50b67d6251fb82a.exe
File created	C:\Windows\System\jdWzAvb.exe	cbf006da97145ce54f69b467d2baa49099c5b09c4ecf682cf50b67d6251fb82a.exe
File created	C:\Windows\System\mjIJUfy.exe	cbf006da97145ce54f69b467d2baa49099c5b09c4ecf682cf50b67d6251fb82a.exe
File created	C:\Windows\System\qBAKbon.exe	cbf006da97145ce54f69b467d2baa49099c5b09c4ecf682cf50b67d6251fb82a.exe
File created	C:\Windows\System\xnyiiZb.exe	cbf006da97145ce54f69b467d2baa49099c5b09c4ecf682cf50b67d6251fb82a.exe
File created	C:\Windows\System\jdCDwjR.exe	cbf006da97145ce54f69b467d2baa49099c5b09c4ecf682cf50b67d6251fb82a.exe
File created	C:\Windows\System\wNQGNKx.exe	cbf006da97145ce54f69b467d2baa49099c5b09c4ecf682cf50b67d6251fb82a.exe
File created	C:\Windows\System\vaUmroh.exe	cbf006da97145ce54f69b467d2baa49099c5b09c4ecf682cf50b67d6251fb82a.exe
File created	C:\Windows\System\NmFbVgC.exe	cbf006da97145ce54f69b467d2baa49099c5b09c4ecf682cf50b67d6251fb82a.exe
File created	C:\Windows\System\IkCAXxQ.exe	cbf006da97145ce54f69b467d2baa49099c5b09c4ecf682cf50b67d6251fb82a.exe
File created	C:\Windows\System\WTaHSLl.exe	cbf006da97145ce54f69b467d2baa49099c5b09c4ecf682cf50b67d6251fb82a.exe
File created	C:\Windows\System\cjXaram.exe	cbf006da97145ce54f69b467d2baa49099c5b09c4ecf682cf50b67d6251fb82a.exe
File created	C:\Windows\System\LczIFkC.exe	cbf006da97145ce54f69b467d2baa49099c5b09c4ecf682cf50b67d6251fb82a.exe
File created	C:\Windows\System\UlLLXLq.exe	cbf006da97145ce54f69b467d2baa49099c5b09c4ecf682cf50b67d6251fb82a.exe
File created	C:\Windows\System\NBpXApr.exe	cbf006da97145ce54f69b467d2baa49099c5b09c4ecf682cf50b67d6251fb82a.exe
File created	C:\Windows\System\dVVdrjo.exe	cbf006da97145ce54f69b467d2baa49099c5b09c4ecf682cf50b67d6251fb82a.exe
File created	C:\Windows\System\jxVyZGl.exe	cbf006da97145ce54f69b467d2baa49099c5b09c4ecf682cf50b67d6251fb82a.exe
File created	C:\Windows\System\DcwCaWT.exe	cbf006da97145ce54f69b467d2baa49099c5b09c4ecf682cf50b67d6251fb82a.exe
File created	C:\Windows\System\cSGXNgB.exe	cbf006da97145ce54f69b467d2baa49099c5b09c4ecf682cf50b67d6251fb82a.exe
File created	C:\Windows\System\mScCref.exe	cbf006da97145ce54f69b467d2baa49099c5b09c4ecf682cf50b67d6251fb82a.exe
File created	C:\Windows\System\CVAnEMI.exe	cbf006da97145ce54f69b467d2baa49099c5b09c4ecf682cf50b67d6251fb82a.exe
File created	C:\Windows\System\rRFIkyT.exe	cbf006da97145ce54f69b467d2baa49099c5b09c4ecf682cf50b67d6251fb82a.exe
File created	C:\Windows\System\zqgVdAi.exe	cbf006da97145ce54f69b467d2baa49099c5b09c4ecf682cf50b67d6251fb82a.exe
File created	C:\Windows\System\bKnIiFw.exe	cbf006da97145ce54f69b467d2baa49099c5b09c4ecf682cf50b67d6251fb82a.exe
File created	C:\Windows\System\DoxNAEG.exe	cbf006da97145ce54f69b467d2baa49099c5b09c4ecf682cf50b67d6251fb82a.exe
File created	C:\Windows\System\fOspwcc.exe	cbf006da97145ce54f69b467d2baa49099c5b09c4ecf682cf50b67d6251fb82a.exe
File created	C:\Windows\System\xvFvxEN.exe	cbf006da97145ce54f69b467d2baa49099c5b09c4ecf682cf50b67d6251fb82a.exe
File created	C:\Windows\System\obMTkcT.exe	cbf006da97145ce54f69b467d2baa49099c5b09c4ecf682cf50b67d6251fb82a.exe
File created	C:\Windows\System\hcWMVUz.exe	cbf006da97145ce54f69b467d2baa49099c5b09c4ecf682cf50b67d6251fb82a.exe
File created	C:\Windows\System\WCUTRXk.exe	cbf006da97145ce54f69b467d2baa49099c5b09c4ecf682cf50b67d6251fb82a.exe
File created	C:\Windows\System\ULZELQd.exe	cbf006da97145ce54f69b467d2baa49099c5b09c4ecf682cf50b67d6251fb82a.exe
File created	C:\Windows\System\JOqYCdz.exe	cbf006da97145ce54f69b467d2baa49099c5b09c4ecf682cf50b67d6251fb82a.exe
File created	C:\Windows\System\JtWoxiJ.exe	cbf006da97145ce54f69b467d2baa49099c5b09c4ecf682cf50b67d6251fb82a.exe
File created	C:\Windows\System\djadJJC.exe	cbf006da97145ce54f69b467d2baa49099c5b09c4ecf682cf50b67d6251fb82a.exe
File created	C:\Windows\System\EnbEOxz.exe	cbf006da97145ce54f69b467d2baa49099c5b09c4ecf682cf50b67d6251fb82a.exe
File created	C:\Windows\System\nmkVTtG.exe	cbf006da97145ce54f69b467d2baa49099c5b09c4ecf682cf50b67d6251fb82a.exe
File created	C:\Windows\System\nKpPyDp.exe	cbf006da97145ce54f69b467d2baa49099c5b09c4ecf682cf50b67d6251fb82a.exe
File created	C:\Windows\System\QAbseTR.exe	cbf006da97145ce54f69b467d2baa49099c5b09c4ecf682cf50b67d6251fb82a.exe
File created	C:\Windows\System\EfOKxTW.exe	cbf006da97145ce54f69b467d2baa49099c5b09c4ecf682cf50b67d6251fb82a.exe
File created	C:\Windows\System\XcHOWQN.exe	cbf006da97145ce54f69b467d2baa49099c5b09c4ecf682cf50b67d6251fb82a.exe
File created	C:\Windows\System\rMPRome.exe	cbf006da97145ce54f69b467d2baa49099c5b09c4ecf682cf50b67d6251fb82a.exe
File created	C:\Windows\System\ULrtCxN.exe	cbf006da97145ce54f69b467d2baa49099c5b09c4ecf682cf50b67d6251fb82a.exe
File created	C:\Windows\System\wXSaAoV.exe	cbf006da97145ce54f69b467d2baa49099c5b09c4ecf682cf50b67d6251fb82a.exe
File created	C:\Windows\System\AfewTEH.exe	cbf006da97145ce54f69b467d2baa49099c5b09c4ecf682cf50b67d6251fb82a.exe
File created	C:\Windows\System\OwRYAZr.exe	cbf006da97145ce54f69b467d2baa49099c5b09c4ecf682cf50b67d6251fb82a.exe
File created	C:\Windows\System\bLWJuIM.exe	cbf006da97145ce54f69b467d2baa49099c5b09c4ecf682cf50b67d6251fb82a.exe
File created	C:\Windows\System\puGDhKr.exe	cbf006da97145ce54f69b467d2baa49099c5b09c4ecf682cf50b67d6251fb82a.exe
File created	C:\Windows\System\vSxHWcd.exe	cbf006da97145ce54f69b467d2baa49099c5b09c4ecf682cf50b67d6251fb82a.exe
File created	C:\Windows\System\ebLDbwM.exe	cbf006da97145ce54f69b467d2baa49099c5b09c4ecf682cf50b67d6251fb82a.exe
File created	C:\Windows\System\MDoKqgN.exe	cbf006da97145ce54f69b467d2baa49099c5b09c4ecf682cf50b67d6251fb82a.exe
File created	C:\Windows\System\bVstyTv.exe	cbf006da97145ce54f69b467d2baa49099c5b09c4ecf682cf50b67d6251fb82a.exe
File created	C:\Windows\System\pYqYiYv.exe	cbf006da97145ce54f69b467d2baa49099c5b09c4ecf682cf50b67d6251fb82a.exe
File created	C:\Windows\System\hHvudDo.exe	cbf006da97145ce54f69b467d2baa49099c5b09c4ecf682cf50b67d6251fb82a.exe
File created	C:\Windows\System\kvaOcDw.exe	cbf006da97145ce54f69b467d2baa49099c5b09c4ecf682cf50b67d6251fb82a.exe
File created	C:\Windows\System\cZBqicy.exe	cbf006da97145ce54f69b467d2baa49099c5b09c4ecf682cf50b67d6251fb82a.exe
File created	C:\Windows\System\JZqQroV.exe	cbf006da97145ce54f69b467d2baa49099c5b09c4ecf682cf50b67d6251fb82a.exe
File created	C:\Windows\System\EshDxHL.exe	cbf006da97145ce54f69b467d2baa49099c5b09c4ecf682cf50b67d6251fb82a.exe
File created	C:\Windows\System\IkxLfbN.exe	cbf006da97145ce54f69b467d2baa49099c5b09c4ecf682cf50b67d6251fb82a.exe
File created	C:\Windows\System\UCafoJV.exe	cbf006da97145ce54f69b467d2baa49099c5b09c4ecf682cf50b67d6251fb82a.exe
File created	C:\Windows\System\JlNPPwG.exe	cbf006da97145ce54f69b467d2baa49099c5b09c4ecf682cf50b67d6251fb82a.exe
File created	C:\Windows\System\aJQyKdP.exe	cbf006da97145ce54f69b467d2baa49099c5b09c4ecf682cf50b67d6251fb82a.exe
File created	C:\Windows\System\VGaUirm.exe	cbf006da97145ce54f69b467d2baa49099c5b09c4ecf682cf50b67d6251fb82a.exe
File created	C:\Windows\System\jxmvtZg.exe	cbf006da97145ce54f69b467d2baa49099c5b09c4ecf682cf50b67d6251fb82a.exe
File created	C:\Windows\System\qGZkZmF.exe	cbf006da97145ce54f69b467d2baa49099c5b09c4ecf682cf50b67d6251fb82a.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	17008	dwm.exe
Token: SeChangeNotifyPrivilege	17008	dwm.exe
Token: 33	17008	dwm.exe
Token: SeIncBasePriorityPrivilege	17008	dwm.exe
Token: SeShutdownPrivilege	17008	dwm.exe
Token: SeCreatePagefilePrivilege	17008	dwm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3636 wrote to memory of 2448	3636	cbf006da97145ce54f69b467d2baa49099c5b09c4ecf682cf50b67d6251fb82a.exe	84
PID 3636 wrote to memory of 2448	3636	cbf006da97145ce54f69b467d2baa49099c5b09c4ecf682cf50b67d6251fb82a.exe	84
PID 3636 wrote to memory of 3648	3636	cbf006da97145ce54f69b467d2baa49099c5b09c4ecf682cf50b67d6251fb82a.exe	85
PID 3636 wrote to memory of 3648	3636	cbf006da97145ce54f69b467d2baa49099c5b09c4ecf682cf50b67d6251fb82a.exe	85
PID 3636 wrote to memory of 2548	3636	cbf006da97145ce54f69b467d2baa49099c5b09c4ecf682cf50b67d6251fb82a.exe	86
PID 3636 wrote to memory of 2548	3636	cbf006da97145ce54f69b467d2baa49099c5b09c4ecf682cf50b67d6251fb82a.exe	86
PID 3636 wrote to memory of 1872	3636	cbf006da97145ce54f69b467d2baa49099c5b09c4ecf682cf50b67d6251fb82a.exe	87
PID 3636 wrote to memory of 1872	3636	cbf006da97145ce54f69b467d2baa49099c5b09c4ecf682cf50b67d6251fb82a.exe	87
PID 3636 wrote to memory of 224	3636	cbf006da97145ce54f69b467d2baa49099c5b09c4ecf682cf50b67d6251fb82a.exe	88
PID 3636 wrote to memory of 224	3636	cbf006da97145ce54f69b467d2baa49099c5b09c4ecf682cf50b67d6251fb82a.exe	88
PID 3636 wrote to memory of 1976	3636	cbf006da97145ce54f69b467d2baa49099c5b09c4ecf682cf50b67d6251fb82a.exe	89
PID 3636 wrote to memory of 1976	3636	cbf006da97145ce54f69b467d2baa49099c5b09c4ecf682cf50b67d6251fb82a.exe	89
PID 3636 wrote to memory of 3024	3636	cbf006da97145ce54f69b467d2baa49099c5b09c4ecf682cf50b67d6251fb82a.exe	90
PID 3636 wrote to memory of 3024	3636	cbf006da97145ce54f69b467d2baa49099c5b09c4ecf682cf50b67d6251fb82a.exe	90
PID 3636 wrote to memory of 3656	3636	cbf006da97145ce54f69b467d2baa49099c5b09c4ecf682cf50b67d6251fb82a.exe	91
PID 3636 wrote to memory of 3656	3636	cbf006da97145ce54f69b467d2baa49099c5b09c4ecf682cf50b67d6251fb82a.exe	91
PID 3636 wrote to memory of 4120	3636	cbf006da97145ce54f69b467d2baa49099c5b09c4ecf682cf50b67d6251fb82a.exe	92
PID 3636 wrote to memory of 4120	3636	cbf006da97145ce54f69b467d2baa49099c5b09c4ecf682cf50b67d6251fb82a.exe	92
PID 3636 wrote to memory of 2252	3636	cbf006da97145ce54f69b467d2baa49099c5b09c4ecf682cf50b67d6251fb82a.exe	93
PID 3636 wrote to memory of 2252	3636	cbf006da97145ce54f69b467d2baa49099c5b09c4ecf682cf50b67d6251fb82a.exe	93
PID 3636 wrote to memory of 3764	3636	cbf006da97145ce54f69b467d2baa49099c5b09c4ecf682cf50b67d6251fb82a.exe	94
PID 3636 wrote to memory of 3764	3636	cbf006da97145ce54f69b467d2baa49099c5b09c4ecf682cf50b67d6251fb82a.exe	94
PID 3636 wrote to memory of 4704	3636	cbf006da97145ce54f69b467d2baa49099c5b09c4ecf682cf50b67d6251fb82a.exe	95
PID 3636 wrote to memory of 4704	3636	cbf006da97145ce54f69b467d2baa49099c5b09c4ecf682cf50b67d6251fb82a.exe	95
PID 3636 wrote to memory of 3908	3636	cbf006da97145ce54f69b467d2baa49099c5b09c4ecf682cf50b67d6251fb82a.exe	96
PID 3636 wrote to memory of 3908	3636	cbf006da97145ce54f69b467d2baa49099c5b09c4ecf682cf50b67d6251fb82a.exe	96
PID 3636 wrote to memory of 4832	3636	cbf006da97145ce54f69b467d2baa49099c5b09c4ecf682cf50b67d6251fb82a.exe	97
PID 3636 wrote to memory of 4832	3636	cbf006da97145ce54f69b467d2baa49099c5b09c4ecf682cf50b67d6251fb82a.exe	97
PID 3636 wrote to memory of 1456	3636	cbf006da97145ce54f69b467d2baa49099c5b09c4ecf682cf50b67d6251fb82a.exe	98
PID 3636 wrote to memory of 1456	3636	cbf006da97145ce54f69b467d2baa49099c5b09c4ecf682cf50b67d6251fb82a.exe	98
PID 3636 wrote to memory of 4576	3636	cbf006da97145ce54f69b467d2baa49099c5b09c4ecf682cf50b67d6251fb82a.exe	99
PID 3636 wrote to memory of 4576	3636	cbf006da97145ce54f69b467d2baa49099c5b09c4ecf682cf50b67d6251fb82a.exe	99
PID 3636 wrote to memory of 4208	3636	cbf006da97145ce54f69b467d2baa49099c5b09c4ecf682cf50b67d6251fb82a.exe	100
PID 3636 wrote to memory of 4208	3636	cbf006da97145ce54f69b467d2baa49099c5b09c4ecf682cf50b67d6251fb82a.exe	100
PID 3636 wrote to memory of 1580	3636	cbf006da97145ce54f69b467d2baa49099c5b09c4ecf682cf50b67d6251fb82a.exe	101
PID 3636 wrote to memory of 1580	3636	cbf006da97145ce54f69b467d2baa49099c5b09c4ecf682cf50b67d6251fb82a.exe	101
PID 3636 wrote to memory of 2868	3636	cbf006da97145ce54f69b467d2baa49099c5b09c4ecf682cf50b67d6251fb82a.exe	102
PID 3636 wrote to memory of 2868	3636	cbf006da97145ce54f69b467d2baa49099c5b09c4ecf682cf50b67d6251fb82a.exe	102
PID 3636 wrote to memory of 4572	3636	cbf006da97145ce54f69b467d2baa49099c5b09c4ecf682cf50b67d6251fb82a.exe	103
PID 3636 wrote to memory of 4572	3636	cbf006da97145ce54f69b467d2baa49099c5b09c4ecf682cf50b67d6251fb82a.exe	103
PID 3636 wrote to memory of 3692	3636	cbf006da97145ce54f69b467d2baa49099c5b09c4ecf682cf50b67d6251fb82a.exe	104
PID 3636 wrote to memory of 3692	3636	cbf006da97145ce54f69b467d2baa49099c5b09c4ecf682cf50b67d6251fb82a.exe	104
PID 3636 wrote to memory of 2812	3636	cbf006da97145ce54f69b467d2baa49099c5b09c4ecf682cf50b67d6251fb82a.exe	105
PID 3636 wrote to memory of 2812	3636	cbf006da97145ce54f69b467d2baa49099c5b09c4ecf682cf50b67d6251fb82a.exe	105
PID 3636 wrote to memory of 4072	3636	cbf006da97145ce54f69b467d2baa49099c5b09c4ecf682cf50b67d6251fb82a.exe	106
PID 3636 wrote to memory of 4072	3636	cbf006da97145ce54f69b467d2baa49099c5b09c4ecf682cf50b67d6251fb82a.exe	106
PID 3636 wrote to memory of 1288	3636	cbf006da97145ce54f69b467d2baa49099c5b09c4ecf682cf50b67d6251fb82a.exe	107
PID 3636 wrote to memory of 1288	3636	cbf006da97145ce54f69b467d2baa49099c5b09c4ecf682cf50b67d6251fb82a.exe	107
PID 3636 wrote to memory of 4204	3636	cbf006da97145ce54f69b467d2baa49099c5b09c4ecf682cf50b67d6251fb82a.exe	108
PID 3636 wrote to memory of 4204	3636	cbf006da97145ce54f69b467d2baa49099c5b09c4ecf682cf50b67d6251fb82a.exe	108
PID 3636 wrote to memory of 3088	3636	cbf006da97145ce54f69b467d2baa49099c5b09c4ecf682cf50b67d6251fb82a.exe	109
PID 3636 wrote to memory of 3088	3636	cbf006da97145ce54f69b467d2baa49099c5b09c4ecf682cf50b67d6251fb82a.exe	109
PID 3636 wrote to memory of 1496	3636	cbf006da97145ce54f69b467d2baa49099c5b09c4ecf682cf50b67d6251fb82a.exe	110
PID 3636 wrote to memory of 1496	3636	cbf006da97145ce54f69b467d2baa49099c5b09c4ecf682cf50b67d6251fb82a.exe	110
PID 3636 wrote to memory of 1056	3636	cbf006da97145ce54f69b467d2baa49099c5b09c4ecf682cf50b67d6251fb82a.exe	111
PID 3636 wrote to memory of 1056	3636	cbf006da97145ce54f69b467d2baa49099c5b09c4ecf682cf50b67d6251fb82a.exe	111
PID 3636 wrote to memory of 3688	3636	cbf006da97145ce54f69b467d2baa49099c5b09c4ecf682cf50b67d6251fb82a.exe	112
PID 3636 wrote to memory of 3688	3636	cbf006da97145ce54f69b467d2baa49099c5b09c4ecf682cf50b67d6251fb82a.exe	112
PID 3636 wrote to memory of 2432	3636	cbf006da97145ce54f69b467d2baa49099c5b09c4ecf682cf50b67d6251fb82a.exe	113
PID 3636 wrote to memory of 2432	3636	cbf006da97145ce54f69b467d2baa49099c5b09c4ecf682cf50b67d6251fb82a.exe	113
PID 3636 wrote to memory of 452	3636	cbf006da97145ce54f69b467d2baa49099c5b09c4ecf682cf50b67d6251fb82a.exe	114
PID 3636 wrote to memory of 452	3636	cbf006da97145ce54f69b467d2baa49099c5b09c4ecf682cf50b67d6251fb82a.exe	114
PID 3636 wrote to memory of 1248	3636	cbf006da97145ce54f69b467d2baa49099c5b09c4ecf682cf50b67d6251fb82a.exe	115
PID 3636 wrote to memory of 1248	3636	cbf006da97145ce54f69b467d2baa49099c5b09c4ecf682cf50b67d6251fb82a.exe	115

C:\Users\Admin\AppData\Local\Temp\cbf006da97145ce54f69b467d2baa49099c5b09c4ecf682cf50b67d6251fb82a.exe
"C:\Users\Admin\AppData\Local\Temp\cbf006da97145ce54f69b467d2baa49099c5b09c4ecf682cf50b67d6251fb82a.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3636
- C:\Windows\System\xcFuRzA.exe
  C:\Windows\System\xcFuRzA.exe
  2⤵
  - Executes dropped EXE
  PID:2448
- C:\Windows\System\DBieXRB.exe
  C:\Windows\System\DBieXRB.exe
  2⤵
  - Executes dropped EXE
  PID:3648
- C:\Windows\System\mBxoABz.exe
  C:\Windows\System\mBxoABz.exe
  2⤵
  - Executes dropped EXE
  PID:2548
- C:\Windows\System\ibzWeQk.exe
  C:\Windows\System\ibzWeQk.exe
  2⤵
  - Executes dropped EXE
  PID:1872
- C:\Windows\System\MPZGbvx.exe
  C:\Windows\System\MPZGbvx.exe
  2⤵
  - Executes dropped EXE
  PID:224
- C:\Windows\System\qmeMFen.exe
  C:\Windows\System\qmeMFen.exe
  2⤵
  - Executes dropped EXE
  PID:1976
- C:\Windows\System\FVVnxFW.exe
  C:\Windows\System\FVVnxFW.exe
  2⤵
  - Executes dropped EXE
  PID:3024
- C:\Windows\System\IPgZkMd.exe
  C:\Windows\System\IPgZkMd.exe
  2⤵
  - Executes dropped EXE
  PID:3656
- C:\Windows\System\WLJLyvC.exe
  C:\Windows\System\WLJLyvC.exe
  2⤵
  - Executes dropped EXE
  PID:4120
- C:\Windows\System\kaeAqSA.exe
  C:\Windows\System\kaeAqSA.exe
  2⤵
  - Executes dropped EXE
  PID:2252
- C:\Windows\System\BoFkpfI.exe
  C:\Windows\System\BoFkpfI.exe
  2⤵
  - Executes dropped EXE
  PID:3764
- C:\Windows\System\RvwpMMG.exe
  C:\Windows\System\RvwpMMG.exe
  2⤵
  - Executes dropped EXE
  PID:4704
- C:\Windows\System\pkXtqoc.exe
  C:\Windows\System\pkXtqoc.exe
  2⤵
  - Executes dropped EXE
  PID:3908
- C:\Windows\System\jmocyit.exe
  C:\Windows\System\jmocyit.exe
  2⤵
  - Executes dropped EXE
  PID:4832
- C:\Windows\System\IFarFLX.exe
  C:\Windows\System\IFarFLX.exe
  2⤵
  - Executes dropped EXE
  PID:1456
- C:\Windows\System\dVVdrjo.exe
  C:\Windows\System\dVVdrjo.exe
  2⤵
  - Executes dropped EXE
  PID:4576
- C:\Windows\System\WDurqrw.exe
  C:\Windows\System\WDurqrw.exe
  2⤵
  - Executes dropped EXE
  PID:4208
- C:\Windows\System\LYCRoBv.exe
  C:\Windows\System\LYCRoBv.exe
  2⤵
  - Executes dropped EXE
  PID:1580
- C:\Windows\System\bKnIiFw.exe
  C:\Windows\System\bKnIiFw.exe
  2⤵
  - Executes dropped EXE
  PID:2868
- C:\Windows\System\AEWblLq.exe
  C:\Windows\System\AEWblLq.exe
  2⤵
  - Executes dropped EXE
  PID:4572
- C:\Windows\System\zlbUTMJ.exe
  C:\Windows\System\zlbUTMJ.exe
  2⤵
  - Executes dropped EXE
  PID:3692
- C:\Windows\System\McBZFeJ.exe
  C:\Windows\System\McBZFeJ.exe
  2⤵
  - Executes dropped EXE
  PID:2812
- C:\Windows\System\papxYnD.exe
  C:\Windows\System\papxYnD.exe
  2⤵
  - Executes dropped EXE
  PID:4072
- C:\Windows\System\TASJZYs.exe
  C:\Windows\System\TASJZYs.exe
  2⤵
  - Executes dropped EXE
  PID:1288
- C:\Windows\System\ywLrUHU.exe
  C:\Windows\System\ywLrUHU.exe
  2⤵
  - Executes dropped EXE
  PID:4204
- C:\Windows\System\hkIWrdx.exe
  C:\Windows\System\hkIWrdx.exe
  2⤵
  - Executes dropped EXE
  PID:3088
- C:\Windows\System\EeGBmfT.exe
  C:\Windows\System\EeGBmfT.exe
  2⤵
  - Executes dropped EXE
  PID:1496
- C:\Windows\System\OQIXBVj.exe
  C:\Windows\System\OQIXBVj.exe
  2⤵
  - Executes dropped EXE
  PID:1056
- C:\Windows\System\yClvODT.exe
  C:\Windows\System\yClvODT.exe
  2⤵
  - Executes dropped EXE
  PID:3688
- C:\Windows\System\huIQZKt.exe
  C:\Windows\System\huIQZKt.exe
  2⤵
  - Executes dropped EXE
  PID:2432
- C:\Windows\System\QAbseTR.exe
  C:\Windows\System\QAbseTR.exe
  2⤵
  - Executes dropped EXE
  PID:452
- C:\Windows\System\CofjTtu.exe
  C:\Windows\System\CofjTtu.exe
  2⤵
  - Executes dropped EXE
  PID:1248
- C:\Windows\System\PlURhNE.exe
  C:\Windows\System\PlURhNE.exe
  2⤵
  - Executes dropped EXE
  PID:2552
- C:\Windows\System\RLTpLMJ.exe
  C:\Windows\System\RLTpLMJ.exe
  2⤵
  - Executes dropped EXE
  PID:632
- C:\Windows\System\cQnrKLM.exe
  C:\Windows\System\cQnrKLM.exe
  2⤵
  - Executes dropped EXE
  PID:1396
- C:\Windows\System\GmsZhDi.exe
  C:\Windows\System\GmsZhDi.exe
  2⤵
  - Executes dropped EXE
  PID:2752
- C:\Windows\System\hnUXSFL.exe
  C:\Windows\System\hnUXSFL.exe
  2⤵
  - Executes dropped EXE
  PID:4672
- C:\Windows\System\ZYwuOrC.exe
  C:\Windows\System\ZYwuOrC.exe
  2⤵
  - Executes dropped EXE
  PID:3332
- C:\Windows\System\hCYNdrm.exe
  C:\Windows\System\hCYNdrm.exe
  2⤵
  - Executes dropped EXE
  PID:2808
- C:\Windows\System\TPaWxNV.exe
  C:\Windows\System\TPaWxNV.exe
  2⤵
  - Executes dropped EXE
  PID:1296
- C:\Windows\System\SgAlsyb.exe
  C:\Windows\System\SgAlsyb.exe
  2⤵
  - Executes dropped EXE
  PID:2300
- C:\Windows\System\fJgNexL.exe
  C:\Windows\System\fJgNexL.exe
  2⤵
  - Executes dropped EXE
  PID:4424
- C:\Windows\System\jdWzAvb.exe
  C:\Windows\System\jdWzAvb.exe
  2⤵
  - Executes dropped EXE
  PID:2364
- C:\Windows\System\gTEXCez.exe
  C:\Windows\System\gTEXCez.exe
  2⤵
  - Executes dropped EXE
  PID:3608
- C:\Windows\System\rfYDcRo.exe
  C:\Windows\System\rfYDcRo.exe
  2⤵
  - Executes dropped EXE
  PID:2860
- C:\Windows\System\kOmIiyh.exe
  C:\Windows\System\kOmIiyh.exe
  2⤵
  - Executes dropped EXE
  PID:936
- C:\Windows\System\pbofhxj.exe
  C:\Windows\System\pbofhxj.exe
  2⤵
  - Executes dropped EXE
  PID:32
- C:\Windows\System\stfYGDr.exe
  C:\Windows\System\stfYGDr.exe
  2⤵
  - Executes dropped EXE
  PID:1672
- C:\Windows\System\pUPJvex.exe
  C:\Windows\System\pUPJvex.exe
  2⤵
  - Executes dropped EXE
  PID:5092
- C:\Windows\System\FbXoFED.exe
  C:\Windows\System\FbXoFED.exe
  2⤵
  - Executes dropped EXE
  PID:3840
- C:\Windows\System\XLFLekg.exe
  C:\Windows\System\XLFLekg.exe
  2⤵
  - Executes dropped EXE
  PID:5000
- C:\Windows\System\mrTTyYI.exe
  C:\Windows\System\mrTTyYI.exe
  2⤵
  - Executes dropped EXE
  PID:2004
- C:\Windows\System\hoFeFHg.exe
  C:\Windows\System\hoFeFHg.exe
  2⤵
  - Executes dropped EXE
  PID:4516
- C:\Windows\System\cJOkzZR.exe
  C:\Windows\System\cJOkzZR.exe
  2⤵
  - Executes dropped EXE
  PID:3972
- C:\Windows\System\HQIptxs.exe
  C:\Windows\System\HQIptxs.exe
  2⤵
  - Executes dropped EXE
  PID:208
- C:\Windows\System\vaUmroh.exe
  C:\Windows\System\vaUmroh.exe
  2⤵
  - Executes dropped EXE
  PID:1800
- C:\Windows\System\LkPpask.exe
  C:\Windows\System\LkPpask.exe
  2⤵
  - Executes dropped EXE
  PID:1488
- C:\Windows\System\kJgHWsr.exe
  C:\Windows\System\kJgHWsr.exe
  2⤵
  - Executes dropped EXE
  PID:2076
- C:\Windows\System\pZhNkLD.exe
  C:\Windows\System\pZhNkLD.exe
  2⤵
  - Executes dropped EXE
  PID:4716
- C:\Windows\System\kExBvQv.exe
  C:\Windows\System\kExBvQv.exe
  2⤵
  - Executes dropped EXE
  PID:1548
- C:\Windows\System\qmSRknw.exe
  C:\Windows\System\qmSRknw.exe
  2⤵
  - Executes dropped EXE
  PID:4344
- C:\Windows\System\NHdRiOJ.exe
  C:\Windows\System\NHdRiOJ.exe
  2⤵
  - Executes dropped EXE
  PID:2476
- C:\Windows\System\farzbpV.exe
  C:\Windows\System\farzbpV.exe
  2⤵
  - Executes dropped EXE
  PID:1944
- C:\Windows\System\WvpIeOV.exe
  C:\Windows\System\WvpIeOV.exe
  2⤵
  - Executes dropped EXE
  PID:1116
- C:\Windows\System\NVYcUCu.exe
  C:\Windows\System\NVYcUCu.exe
  2⤵
  PID:4620
- C:\Windows\System\VGgRVrP.exe
  C:\Windows\System\VGgRVrP.exe
  2⤵
  PID:228
- C:\Windows\System\dJNqedF.exe
  C:\Windows\System\dJNqedF.exe
  2⤵
  PID:2852
- C:\Windows\System\RYcQnxN.exe
  C:\Windows\System\RYcQnxN.exe
  2⤵
  PID:2768
- C:\Windows\System\chDzpnZ.exe
  C:\Windows\System\chDzpnZ.exe
  2⤵
  PID:4016
- C:\Windows\System\IBcencP.exe
  C:\Windows\System\IBcencP.exe
  2⤵
  PID:3916
- C:\Windows\System\gcFTKkX.exe
  C:\Windows\System\gcFTKkX.exe
  2⤵
  PID:3456
- C:\Windows\System\KkvmGkW.exe
  C:\Windows\System\KkvmGkW.exe
  2⤵
  PID:864
- C:\Windows\System\USSEfSa.exe
  C:\Windows\System\USSEfSa.exe
  2⤵
  PID:4696
- C:\Windows\System\bebrotO.exe
  C:\Windows\System\bebrotO.exe
  2⤵
  PID:3304
- C:\Windows\System\ekjHnrJ.exe
  C:\Windows\System\ekjHnrJ.exe
  2⤵
  PID:2420
- C:\Windows\System\miOorOR.exe
  C:\Windows\System\miOorOR.exe
  2⤵
  PID:2044
- C:\Windows\System\xVSeLGn.exe
  C:\Windows\System\xVSeLGn.exe
  2⤵
  PID:4720
- C:\Windows\System\mZrodvH.exe
  C:\Windows\System\mZrodvH.exe
  2⤵
  PID:4452
- C:\Windows\System\QrepqEt.exe
  C:\Windows\System\QrepqEt.exe
  2⤵
  PID:776
- C:\Windows\System\iqAdgIO.exe
  C:\Windows\System\iqAdgIO.exe
  2⤵
  PID:400
- C:\Windows\System\DppyVTs.exe
  C:\Windows\System\DppyVTs.exe
  2⤵
  PID:992
- C:\Windows\System\BBbqMUh.exe
  C:\Windows\System\BBbqMUh.exe
  2⤵
  PID:3556
- C:\Windows\System\AlDqlhV.exe
  C:\Windows\System\AlDqlhV.exe
  2⤵
  PID:1016
- C:\Windows\System\mjIJUfy.exe
  C:\Windows\System\mjIJUfy.exe
  2⤵
  PID:3568
- C:\Windows\System\SbSaWsI.exe
  C:\Windows\System\SbSaWsI.exe
  2⤵
  PID:5028
- C:\Windows\System\DfzYryr.exe
  C:\Windows\System\DfzYryr.exe
  2⤵
  PID:2796
- C:\Windows\System\fGdTecz.exe
  C:\Windows\System\fGdTecz.exe
  2⤵
  PID:4524
- C:\Windows\System\ObrENEJ.exe
  C:\Windows\System\ObrENEJ.exe
  2⤵
  PID:1476
- C:\Windows\System\rzcnavP.exe
  C:\Windows\System\rzcnavP.exe
  2⤵
  PID:5072
- C:\Windows\System\JdAERXI.exe
  C:\Windows\System\JdAERXI.exe
  2⤵
  PID:3408
- C:\Windows\System\xJjvQgT.exe
  C:\Windows\System\xJjvQgT.exe
  2⤵
  PID:2732
- C:\Windows\System\ZZmQlQp.exe
  C:\Windows\System\ZZmQlQp.exe
  2⤵
  PID:3164
- C:\Windows\System\jAOeluO.exe
  C:\Windows\System\jAOeluO.exe
  2⤵
  PID:2412
- C:\Windows\System\PqcKBgm.exe
  C:\Windows\System\PqcKBgm.exe
  2⤵
  PID:2384
- C:\Windows\System\uaFfWQp.exe
  C:\Windows\System\uaFfWQp.exe
  2⤵
  PID:3948
- C:\Windows\System\rMfMViv.exe
  C:\Windows\System\rMfMViv.exe
  2⤵
  PID:732
- C:\Windows\System\IxgTyAg.exe
  C:\Windows\System\IxgTyAg.exe
  2⤵
  PID:1636
- C:\Windows\System\cjXaram.exe
  C:\Windows\System\cjXaram.exe
  2⤵
  PID:1072
- C:\Windows\System\NHNPqwO.exe
  C:\Windows\System\NHNPqwO.exe
  2⤵
  PID:4964
- C:\Windows\System\dFijcHV.exe
  C:\Windows\System\dFijcHV.exe
  2⤵
  PID:1048
- C:\Windows\System\paejQQl.exe
  C:\Windows\System\paejQQl.exe
  2⤵
  PID:2416
- C:\Windows\System\MBPRexh.exe
  C:\Windows\System\MBPRexh.exe
  2⤵
  PID:5112
- C:\Windows\System\TNfsJMX.exe
  C:\Windows\System\TNfsJMX.exe
  2⤵
  PID:988
- C:\Windows\System\TATgmJQ.exe
  C:\Windows\System\TATgmJQ.exe
  2⤵
  PID:1528
- C:\Windows\System\EbvNZmP.exe
  C:\Windows\System\EbvNZmP.exe
  2⤵
  PID:2108
- C:\Windows\System\CCJglvy.exe
  C:\Windows\System\CCJglvy.exe
  2⤵
  PID:1008
- C:\Windows\System\fvpXWFG.exe
  C:\Windows\System\fvpXWFG.exe
  2⤵
  PID:3444
- C:\Windows\System\nuBkBkK.exe
  C:\Windows\System\nuBkBkK.exe
  2⤵
  PID:4512
- C:\Windows\System\tABioLt.exe
  C:\Windows\System\tABioLt.exe
  2⤵
  PID:1260
- C:\Windows\System\CVcvVcv.exe
  C:\Windows\System\CVcvVcv.exe
  2⤵
  PID:4744
- C:\Windows\System\mfQVfNz.exe
  C:\Windows\System\mfQVfNz.exe
  2⤵
  PID:4532
- C:\Windows\System\pTDsLKy.exe
  C:\Windows\System\pTDsLKy.exe
  2⤵
  PID:3880
- C:\Windows\System\rMPRome.exe
  C:\Windows\System\rMPRome.exe
  2⤵
  PID:5144
- C:\Windows\System\IkxLfbN.exe
  C:\Windows\System\IkxLfbN.exe
  2⤵
  PID:5176
- C:\Windows\System\qZrTfsT.exe
  C:\Windows\System\qZrTfsT.exe
  2⤵
  PID:5200
- C:\Windows\System\xYOpnTL.exe
  C:\Windows\System\xYOpnTL.exe
  2⤵
  PID:5228
- C:\Windows\System\jXoUNyp.exe
  C:\Windows\System\jXoUNyp.exe
  2⤵
  PID:5268
- C:\Windows\System\ULZELQd.exe
  C:\Windows\System\ULZELQd.exe
  2⤵
  PID:5284
- C:\Windows\System\EdzqSUt.exe
  C:\Windows\System\EdzqSUt.exe
  2⤵
  PID:5312
- C:\Windows\System\nXbyJpo.exe
  C:\Windows\System\nXbyJpo.exe
  2⤵
  PID:5332
- C:\Windows\System\yoLAQxP.exe
  C:\Windows\System\yoLAQxP.exe
  2⤵
  PID:5368
- C:\Windows\System\UsYhkwU.exe
  C:\Windows\System\UsYhkwU.exe
  2⤵
  PID:5388
- C:\Windows\System\ulnfKDn.exe
  C:\Windows\System\ulnfKDn.exe
  2⤵
  PID:5416
- C:\Windows\System\CdjNqRV.exe
  C:\Windows\System\CdjNqRV.exe
  2⤵
  PID:5440
- C:\Windows\System\kkpCuTq.exe
  C:\Windows\System\kkpCuTq.exe
  2⤵
  PID:5472
- C:\Windows\System\RXgjSNm.exe
  C:\Windows\System\RXgjSNm.exe
  2⤵
  PID:5492
- C:\Windows\System\puGDhKr.exe
  C:\Windows\System\puGDhKr.exe
  2⤵
  PID:5516
- C:\Windows\System\OwRYAZr.exe
  C:\Windows\System\OwRYAZr.exe
  2⤵
  PID:5548
- C:\Windows\System\KoyTTZv.exe
  C:\Windows\System\KoyTTZv.exe
  2⤵
  PID:5572
- C:\Windows\System\CxOYjNE.exe
  C:\Windows\System\CxOYjNE.exe
  2⤵
  PID:5600
- C:\Windows\System\AYOUNfi.exe
  C:\Windows\System\AYOUNfi.exe
  2⤵
  PID:5640
- C:\Windows\System\dZPrYMK.exe
  C:\Windows\System\dZPrYMK.exe
  2⤵
  PID:5680
- C:\Windows\System\bSREwvP.exe
  C:\Windows\System\bSREwvP.exe
  2⤵
  PID:5700
- C:\Windows\System\osJFcVX.exe
  C:\Windows\System\osJFcVX.exe
  2⤵
  PID:5724
- C:\Windows\System\FUSgubw.exe
  C:\Windows\System\FUSgubw.exe
  2⤵
  PID:5752
- C:\Windows\System\gxiGBUE.exe
  C:\Windows\System\gxiGBUE.exe
  2⤵
  PID:5780
- C:\Windows\System\YNInDDH.exe
  C:\Windows\System\YNInDDH.exe
  2⤵
  PID:5808
- C:\Windows\System\hUwOrBG.exe
  C:\Windows\System\hUwOrBG.exe
  2⤵
  PID:5836
- C:\Windows\System\KcKWWHt.exe
  C:\Windows\System\KcKWWHt.exe
  2⤵
  PID:5864
- C:\Windows\System\khmYpeg.exe
  C:\Windows\System\khmYpeg.exe
  2⤵
  PID:5892
- C:\Windows\System\QSxXqZT.exe
  C:\Windows\System\QSxXqZT.exe
  2⤵
  PID:5924
- C:\Windows\System\ndRiPyN.exe
  C:\Windows\System\ndRiPyN.exe
  2⤵
  PID:5960
- C:\Windows\System\xdfgZgL.exe
  C:\Windows\System\xdfgZgL.exe
  2⤵
  PID:5980
- C:\Windows\System\zMTdZdK.exe
  C:\Windows\System\zMTdZdK.exe
  2⤵
  PID:6008
- C:\Windows\System\ugBzkCz.exe
  C:\Windows\System\ugBzkCz.exe
  2⤵
  PID:6036
- C:\Windows\System\lIPblcy.exe
  C:\Windows\System\lIPblcy.exe
  2⤵
  PID:6052
- C:\Windows\System\IuLbcCo.exe
  C:\Windows\System\IuLbcCo.exe
  2⤵
  PID:6072
- C:\Windows\System\CipcrlD.exe
  C:\Windows\System\CipcrlD.exe
  2⤵
  PID:6104
- C:\Windows\System\AwBLjNG.exe
  C:\Windows\System\AwBLjNG.exe
  2⤵
  PID:6128
- C:\Windows\System\QrXxAjO.exe
  C:\Windows\System\QrXxAjO.exe
  2⤵
  PID:5164
- C:\Windows\System\GXUjSgQ.exe
  C:\Windows\System\GXUjSgQ.exe
  2⤵
  PID:5248
- C:\Windows\System\bbZOXqg.exe
  C:\Windows\System\bbZOXqg.exe
  2⤵
  PID:5304
- C:\Windows\System\dIUIvyf.exe
  C:\Windows\System\dIUIvyf.exe
  2⤵
  PID:5380
- C:\Windows\System\kJcmjli.exe
  C:\Windows\System\kJcmjli.exe
  2⤵
  PID:5428
- C:\Windows\System\CKlBXbA.exe
  C:\Windows\System\CKlBXbA.exe
  2⤵
  PID:5488
- C:\Windows\System\JdrbHGj.exe
  C:\Windows\System\JdrbHGj.exe
  2⤵
  PID:5504
- C:\Windows\System\CBEBKuD.exe
  C:\Windows\System\CBEBKuD.exe
  2⤵
  PID:5596
- C:\Windows\System\eWtSUtP.exe
  C:\Windows\System\eWtSUtP.exe
  2⤵
  PID:5660
- C:\Windows\System\gdqLeAx.exe
  C:\Windows\System\gdqLeAx.exe
  2⤵
  PID:5692
- C:\Windows\System\PPDozQm.exe
  C:\Windows\System\PPDozQm.exe
  2⤵
  PID:5776
- C:\Windows\System\mCWrPpn.exe
  C:\Windows\System\mCWrPpn.exe
  2⤵
  PID:5820
- C:\Windows\System\KWnvsxN.exe
  C:\Windows\System\KWnvsxN.exe
  2⤵
  PID:5952
- C:\Windows\System\mdnyAih.exe
  C:\Windows\System\mdnyAih.exe
  2⤵
  PID:5992
- C:\Windows\System\SpjgySM.exe
  C:\Windows\System\SpjgySM.exe
  2⤵
  PID:6024
- C:\Windows\System\klcIwnQ.exe
  C:\Windows\System\klcIwnQ.exe
  2⤵
  PID:6116
- C:\Windows\System\MfdZBtP.exe
  C:\Windows\System\MfdZBtP.exe
  2⤵
  PID:5212
- C:\Windows\System\vFoodMN.exe
  C:\Windows\System\vFoodMN.exe
  2⤵
  PID:5568
- C:\Windows\System\CLECImR.exe
  C:\Windows\System\CLECImR.exe
  2⤵
  PID:5708
- C:\Windows\System\CLlqtlc.exe
  C:\Windows\System\CLlqtlc.exe
  2⤵
  PID:5740
- C:\Windows\System\kypaoFT.exe
  C:\Windows\System\kypaoFT.exe
  2⤵
  PID:6092
- C:\Windows\System\mfftuMP.exe
  C:\Windows\System\mfftuMP.exe
  2⤵
  PID:6088
- C:\Windows\System\gnFUKSV.exe
  C:\Windows\System\gnFUKSV.exe
  2⤵
  PID:5592
- C:\Windows\System\KQzFJSZ.exe
  C:\Windows\System\KQzFJSZ.exe
  2⤵
  PID:5764
- C:\Windows\System\dINbqot.exe
  C:\Windows\System\dINbqot.exe
  2⤵
  PID:5716
- C:\Windows\System\UUyFsob.exe
  C:\Windows\System\UUyFsob.exe
  2⤵
  PID:5856
- C:\Windows\System\qzWnJte.exe
  C:\Windows\System\qzWnJte.exe
  2⤵
  PID:6164
- C:\Windows\System\CVAnEMI.exe
  C:\Windows\System\CVAnEMI.exe
  2⤵
  PID:6196
- C:\Windows\System\vjPKqDZ.exe
  C:\Windows\System\vjPKqDZ.exe
  2⤵
  PID:6232
- C:\Windows\System\UCafoJV.exe
  C:\Windows\System\UCafoJV.exe
  2⤵
  PID:6248
- C:\Windows\System\hyUVTMa.exe
  C:\Windows\System\hyUVTMa.exe
  2⤵
  PID:6276
- C:\Windows\System\NhIJGBX.exe
  C:\Windows\System\NhIJGBX.exe
  2⤵
  PID:6312
- C:\Windows\System\NxuZuNS.exe
  C:\Windows\System\NxuZuNS.exe
  2⤵
  PID:6336
- C:\Windows\System\GqQNChl.exe
  C:\Windows\System\GqQNChl.exe
  2⤵
  PID:6364
- C:\Windows\System\KznSZbq.exe
  C:\Windows\System\KznSZbq.exe
  2⤵
  PID:6388
- C:\Windows\System\nZVEJaC.exe
  C:\Windows\System\nZVEJaC.exe
  2⤵
  PID:6404
- C:\Windows\System\qBAKbon.exe
  C:\Windows\System\qBAKbon.exe
  2⤵
  PID:6436
- C:\Windows\System\azNhFkV.exe
  C:\Windows\System\azNhFkV.exe
  2⤵
  PID:6460
- C:\Windows\System\NeHLQIn.exe
  C:\Windows\System\NeHLQIn.exe
  2⤵
  PID:6476
- C:\Windows\System\UwBqanG.exe
  C:\Windows\System\UwBqanG.exe
  2⤵
  PID:6508
- C:\Windows\System\TANaEoM.exe
  C:\Windows\System\TANaEoM.exe
  2⤵
  PID:6532
- C:\Windows\System\UXgAimd.exe
  C:\Windows\System\UXgAimd.exe
  2⤵
  PID:6556
- C:\Windows\System\pQGMrlI.exe
  C:\Windows\System\pQGMrlI.exe
  2⤵
  PID:6584
- C:\Windows\System\BXFstxJ.exe
  C:\Windows\System\BXFstxJ.exe
  2⤵
  PID:6616
- C:\Windows\System\qWJvyNe.exe
  C:\Windows\System\qWJvyNe.exe
  2⤵
  PID:6640
- C:\Windows\System\ayKmZtY.exe
  C:\Windows\System\ayKmZtY.exe
  2⤵
  PID:6660
- C:\Windows\System\jrtdYfv.exe
  C:\Windows\System\jrtdYfv.exe
  2⤵
  PID:6688
- C:\Windows\System\KyjwUlz.exe
  C:\Windows\System\KyjwUlz.exe
  2⤵
  PID:6728
- C:\Windows\System\AxgapJk.exe
  C:\Windows\System\AxgapJk.exe
  2⤵
  PID:6756
- C:\Windows\System\IEagFAm.exe
  C:\Windows\System\IEagFAm.exe
  2⤵
  PID:6780
- C:\Windows\System\BDZyFBc.exe
  C:\Windows\System\BDZyFBc.exe
  2⤵
  PID:6800
- C:\Windows\System\lNVTfvT.exe
  C:\Windows\System\lNVTfvT.exe
  2⤵
  PID:6828
- C:\Windows\System\TRNosqt.exe
  C:\Windows\System\TRNosqt.exe
  2⤵
  PID:6860
- C:\Windows\System\kCslLMP.exe
  C:\Windows\System\kCslLMP.exe
  2⤵
  PID:6892
- C:\Windows\System\fuNelBP.exe
  C:\Windows\System\fuNelBP.exe
  2⤵
  PID:6928
- C:\Windows\System\XZdvKQu.exe
  C:\Windows\System\XZdvKQu.exe
  2⤵
  PID:6960
- C:\Windows\System\dhoeZsY.exe
  C:\Windows\System\dhoeZsY.exe
  2⤵
  PID:6984
- C:\Windows\System\cMGkgGd.exe
  C:\Windows\System\cMGkgGd.exe
  2⤵
  PID:7012
- C:\Windows\System\HezMYbI.exe
  C:\Windows\System\HezMYbI.exe
  2⤵
  PID:7032
- C:\Windows\System\lHgVesz.exe
  C:\Windows\System\lHgVesz.exe
  2⤵
  PID:7068
- C:\Windows\System\hnrQuAl.exe
  C:\Windows\System\hnrQuAl.exe
  2⤵
  PID:7100
- C:\Windows\System\kavVcPU.exe
  C:\Windows\System\kavVcPU.exe
  2⤵
  PID:7136
- C:\Windows\System\uzYpcKM.exe
  C:\Windows\System\uzYpcKM.exe
  2⤵
  PID:5944
- C:\Windows\System\ZXcoYDp.exe
  C:\Windows\System\ZXcoYDp.exe
  2⤵
  PID:6220
- C:\Windows\System\JHlcRUI.exe
  C:\Windows\System\JHlcRUI.exe
  2⤵
  PID:6240
- C:\Windows\System\yYYQGjY.exe
  C:\Windows\System\yYYQGjY.exe
  2⤵
  PID:6320
- C:\Windows\System\IzKMtIR.exe
  C:\Windows\System\IzKMtIR.exe
  2⤵
  PID:6444
- C:\Windows\System\cJJzckO.exe
  C:\Windows\System\cJJzckO.exe
  2⤵
  PID:6468
- C:\Windows\System\XXETTPS.exe
  C:\Windows\System\XXETTPS.exe
  2⤵
  PID:6596
- C:\Windows\System\OFOvyeL.exe
  C:\Windows\System\OFOvyeL.exe
  2⤵
  PID:6648
- C:\Windows\System\uXKUBit.exe
  C:\Windows\System\uXKUBit.exe
  2⤵
  PID:6708
- C:\Windows\System\UxJPQST.exe
  C:\Windows\System\UxJPQST.exe
  2⤵
  PID:6752
- C:\Windows\System\uzpUmJw.exe
  C:\Windows\System\uzpUmJw.exe
  2⤵
  PID:6824
- C:\Windows\System\UQhJsje.exe
  C:\Windows\System\UQhJsje.exe
  2⤵
  PID:6772
- C:\Windows\System\yMEEvWY.exe
  C:\Windows\System\yMEEvWY.exe
  2⤵
  PID:6920
- C:\Windows\System\NHCtWNn.exe
  C:\Windows\System\NHCtWNn.exe
  2⤵
  PID:6884
- C:\Windows\System\crnruYO.exe
  C:\Windows\System\crnruYO.exe
  2⤵
  PID:7024
- C:\Windows\System\NyCOzkK.exe
  C:\Windows\System\NyCOzkK.exe
  2⤵
  PID:7056
- C:\Windows\System\oBBSoPr.exe
  C:\Windows\System\oBBSoPr.exe
  2⤵
  PID:7148
- C:\Windows\System\JtWoxiJ.exe
  C:\Windows\System\JtWoxiJ.exe
  2⤵
  PID:6304
- C:\Windows\System\JlNPPwG.exe
  C:\Windows\System\JlNPPwG.exe
  2⤵
  PID:6384
- C:\Windows\System\LCCqDqi.exe
  C:\Windows\System\LCCqDqi.exe
  2⤵
  PID:6504
- C:\Windows\System\hFyAqfd.exe
  C:\Windows\System\hFyAqfd.exe
  2⤵
  PID:6668
- C:\Windows\System\dvRhwmc.exe
  C:\Windows\System\dvRhwmc.exe
  2⤵
  PID:6796
- C:\Windows\System\ZsPwpgK.exe
  C:\Windows\System\ZsPwpgK.exe
  2⤵
  PID:7064
- C:\Windows\System\VfOAXLS.exe
  C:\Windows\System\VfOAXLS.exe
  2⤵
  PID:6228
- C:\Windows\System\SrKFLiR.exe
  C:\Windows\System\SrKFLiR.exe
  2⤵
  PID:6180
- C:\Windows\System\iGoHgKr.exe
  C:\Windows\System\iGoHgKr.exe
  2⤵
  PID:6848
- C:\Windows\System\mVXGrDY.exe
  C:\Windows\System\mVXGrDY.exe
  2⤵
  PID:6496
- C:\Windows\System\LSGWNVr.exe
  C:\Windows\System\LSGWNVr.exe
  2⤵
  PID:7176
- C:\Windows\System\RNaiYJZ.exe
  C:\Windows\System\RNaiYJZ.exe
  2⤵
  PID:7216
- C:\Windows\System\HikiTBB.exe
  C:\Windows\System\HikiTBB.exe
  2⤵
  PID:7240
- C:\Windows\System\sxCQCEX.exe
  C:\Windows\System\sxCQCEX.exe
  2⤵
  PID:7268
- C:\Windows\System\NdAOPHx.exe
  C:\Windows\System\NdAOPHx.exe
  2⤵
  PID:7288
- C:\Windows\System\qwEKWFx.exe
  C:\Windows\System\qwEKWFx.exe
  2⤵
  PID:7320
- C:\Windows\System\VlXyddM.exe
  C:\Windows\System\VlXyddM.exe
  2⤵
  PID:7344
- C:\Windows\System\EHhoEcG.exe
  C:\Windows\System\EHhoEcG.exe
  2⤵
  PID:7372
- C:\Windows\System\ULrtCxN.exe
  C:\Windows\System\ULrtCxN.exe
  2⤵
  PID:7400
- C:\Windows\System\lGqaqKy.exe
  C:\Windows\System\lGqaqKy.exe
  2⤵
  PID:7420
- C:\Windows\System\djadJJC.exe
  C:\Windows\System\djadJJC.exe
  2⤵
  PID:7448
- C:\Windows\System\ItcLDtL.exe
  C:\Windows\System\ItcLDtL.exe
  2⤵
  PID:7484
- C:\Windows\System\twKOOpW.exe
  C:\Windows\System\twKOOpW.exe
  2⤵
  PID:7512
- C:\Windows\System\xUNOeZl.exe
  C:\Windows\System\xUNOeZl.exe
  2⤵
  PID:7544
- C:\Windows\System\MDoKqgN.exe
  C:\Windows\System\MDoKqgN.exe
  2⤵
  PID:7568
- C:\Windows\System\NJkWCcJ.exe
  C:\Windows\System\NJkWCcJ.exe
  2⤵
  PID:7596
- C:\Windows\System\lscbSMH.exe
  C:\Windows\System\lscbSMH.exe
  2⤵
  PID:7624
- C:\Windows\System\MKWQAtW.exe
  C:\Windows\System\MKWQAtW.exe
  2⤵
  PID:7656
- C:\Windows\System\xnyiiZb.exe
  C:\Windows\System\xnyiiZb.exe
  2⤵
  PID:7680
- C:\Windows\System\pbzVTkK.exe
  C:\Windows\System\pbzVTkK.exe
  2⤵
  PID:7708
- C:\Windows\System\fGSrykk.exe
  C:\Windows\System\fGSrykk.exe
  2⤵
  PID:7736
- C:\Windows\System\xCEsTHA.exe
  C:\Windows\System\xCEsTHA.exe
  2⤵
  PID:7764
- C:\Windows\System\nEhrmPd.exe
  C:\Windows\System\nEhrmPd.exe
  2⤵
  PID:7792
- C:\Windows\System\NRNYBXM.exe
  C:\Windows\System\NRNYBXM.exe
  2⤵
  PID:7824
- C:\Windows\System\jNMELkL.exe
  C:\Windows\System\jNMELkL.exe
  2⤵
  PID:7848
- C:\Windows\System\ddtlbHz.exe
  C:\Windows\System\ddtlbHz.exe
  2⤵
  PID:7884
- C:\Windows\System\TGQZlCv.exe
  C:\Windows\System\TGQZlCv.exe
  2⤵
  PID:7908
- C:\Windows\System\MYGCRvZ.exe
  C:\Windows\System\MYGCRvZ.exe
  2⤵
  PID:7932
- C:\Windows\System\COLDARX.exe
  C:\Windows\System\COLDARX.exe
  2⤵
  PID:7960
- C:\Windows\System\zLZaNee.exe
  C:\Windows\System\zLZaNee.exe
  2⤵
  PID:7976
- C:\Windows\System\QnoDfof.exe
  C:\Windows\System\QnoDfof.exe
  2⤵
  PID:8004
- C:\Windows\System\stOHJoi.exe
  C:\Windows\System\stOHJoi.exe
  2⤵
  PID:8040
- C:\Windows\System\ksnCGqo.exe
  C:\Windows\System\ksnCGqo.exe
  2⤵
  PID:8068
- C:\Windows\System\rSryzlY.exe
  C:\Windows\System\rSryzlY.exe
  2⤵
  PID:8104
- C:\Windows\System\GPhRagr.exe
  C:\Windows\System\GPhRagr.exe
  2⤵
  PID:8128
- C:\Windows\System\sQLMlBC.exe
  C:\Windows\System\sQLMlBC.exe
  2⤵
  PID:8144
- C:\Windows\System\aJQyKdP.exe
  C:\Windows\System\aJQyKdP.exe
  2⤵
  PID:8172
- C:\Windows\System\sbxPNpd.exe
  C:\Windows\System\sbxPNpd.exe
  2⤵
  PID:7204
- C:\Windows\System\FhbVjhH.exe
  C:\Windows\System\FhbVjhH.exe
  2⤵
  PID:7224
- C:\Windows\System\gkaIonL.exe
  C:\Windows\System\gkaIonL.exe
  2⤵
  PID:7300
- C:\Windows\System\cSGXNgB.exe
  C:\Windows\System\cSGXNgB.exe
  2⤵
  PID:7356
- C:\Windows\System\QJvRlfQ.exe
  C:\Windows\System\QJvRlfQ.exe
  2⤵
  PID:7408
- C:\Windows\System\kjQjrwq.exe
  C:\Windows\System\kjQjrwq.exe
  2⤵
  PID:7500
- C:\Windows\System\ssgowqY.exe
  C:\Windows\System\ssgowqY.exe
  2⤵
  PID:7552
- C:\Windows\System\ILQszdZ.exe
  C:\Windows\System\ILQszdZ.exe
  2⤵
  PID:7616
- C:\Windows\System\ldnCqhr.exe
  C:\Windows\System\ldnCqhr.exe
  2⤵
  PID:7720
- C:\Windows\System\ZrTxfLQ.exe
  C:\Windows\System\ZrTxfLQ.exe
  2⤵
  PID:7732
- C:\Windows\System\URHgjrK.exe
  C:\Windows\System\URHgjrK.exe
  2⤵
  PID:7808
- C:\Windows\System\pcSNyQa.exe
  C:\Windows\System\pcSNyQa.exe
  2⤵
  PID:7872
- C:\Windows\System\wDlgccP.exe
  C:\Windows\System\wDlgccP.exe
  2⤵
  PID:7968
- C:\Windows\System\FtpspoT.exe
  C:\Windows\System\FtpspoT.exe
  2⤵
  PID:8000
- C:\Windows\System\RmsLZsS.exe
  C:\Windows\System\RmsLZsS.exe
  2⤵
  PID:8080
- C:\Windows\System\DRIhLje.exe
  C:\Windows\System\DRIhLje.exe
  2⤵
  PID:8156
- C:\Windows\System\iayygDW.exe
  C:\Windows\System\iayygDW.exe
  2⤵
  PID:7384
- C:\Windows\System\fZkvTjw.exe
  C:\Windows\System\fZkvTjw.exe
  2⤵
  PID:7388
- C:\Windows\System\ndnCtKE.exe
  C:\Windows\System\ndnCtKE.exe
  2⤵
  PID:7524
- C:\Windows\System\hHvudDo.exe
  C:\Windows\System\hHvudDo.exe
  2⤵
  PID:7724
- C:\Windows\System\WefdWtC.exe
  C:\Windows\System\WefdWtC.exe
  2⤵
  PID:7756
- C:\Windows\System\iEvmCOx.exe
  C:\Windows\System\iEvmCOx.exe
  2⤵
  PID:7892
- C:\Windows\System\uxUybLA.exe
  C:\Windows\System\uxUybLA.exe
  2⤵
  PID:8056
- C:\Windows\System\eZhGmLL.exe
  C:\Windows\System\eZhGmLL.exe
  2⤵
  PID:7432
- C:\Windows\System\UkibiFU.exe
  C:\Windows\System\UkibiFU.exe
  2⤵
  PID:7776
- C:\Windows\System\BPmsrWz.exe
  C:\Windows\System\BPmsrWz.exe
  2⤵
  PID:6820
- C:\Windows\System\nmkVTtG.exe
  C:\Windows\System\nmkVTtG.exe
  2⤵
  PID:7256
- C:\Windows\System\HUFBwlk.exe
  C:\Windows\System\HUFBwlk.exe
  2⤵
  PID:8212
- C:\Windows\System\AOhgAuH.exe
  C:\Windows\System\AOhgAuH.exe
  2⤵
  PID:8244
- C:\Windows\System\YVqzSJD.exe
  C:\Windows\System\YVqzSJD.exe
  2⤵
  PID:8268
- C:\Windows\System\UNgykhv.exe
  C:\Windows\System\UNgykhv.exe
  2⤵
  PID:8296
- C:\Windows\System\ZnXVUVX.exe
  C:\Windows\System\ZnXVUVX.exe
  2⤵
  PID:8324
- C:\Windows\System\kvaOcDw.exe
  C:\Windows\System\kvaOcDw.exe
  2⤵
  PID:8352
- C:\Windows\System\twmSkmD.exe
  C:\Windows\System\twmSkmD.exe
  2⤵
  PID:8384
- C:\Windows\System\bDHZtvT.exe
  C:\Windows\System\bDHZtvT.exe
  2⤵
  PID:8408
- C:\Windows\System\NmFbVgC.exe
  C:\Windows\System\NmFbVgC.exe
  2⤵
  PID:8436
- C:\Windows\System\ufxFsFI.exe
  C:\Windows\System\ufxFsFI.exe
  2⤵
  PID:8460
- C:\Windows\System\DRQkvyV.exe
  C:\Windows\System\DRQkvyV.exe
  2⤵
  PID:8480
- C:\Windows\System\ZHlAlfW.exe
  C:\Windows\System\ZHlAlfW.exe
  2⤵
  PID:8508
- C:\Windows\System\XcIvHXw.exe
  C:\Windows\System\XcIvHXw.exe
  2⤵
  PID:8548
- C:\Windows\System\GKlLeSI.exe
  C:\Windows\System\GKlLeSI.exe
  2⤵
  PID:8580
- C:\Windows\System\nZIugBF.exe
  C:\Windows\System\nZIugBF.exe
  2⤵
  PID:8608
- C:\Windows\System\FvVwzga.exe
  C:\Windows\System\FvVwzga.exe
  2⤵
  PID:8632
- C:\Windows\System\SXyHpAC.exe
  C:\Windows\System\SXyHpAC.exe
  2⤵
  PID:8660
- C:\Windows\System\trzbROn.exe
  C:\Windows\System\trzbROn.exe
  2⤵
  PID:8696
- C:\Windows\System\BnGvKbs.exe
  C:\Windows\System\BnGvKbs.exe
  2⤵
  PID:8716
- C:\Windows\System\PaRvRVN.exe
  C:\Windows\System\PaRvRVN.exe
  2⤵
  PID:8740
- C:\Windows\System\bkvfErH.exe
  C:\Windows\System\bkvfErH.exe
  2⤵
  PID:8768
- C:\Windows\System\MxWIpnl.exe
  C:\Windows\System\MxWIpnl.exe
  2⤵
  PID:8796
- C:\Windows\System\EQzXEei.exe
  C:\Windows\System\EQzXEei.exe
  2⤵
  PID:8828
- C:\Windows\System\AfAVQER.exe
  C:\Windows\System\AfAVQER.exe
  2⤵
  PID:8860
- C:\Windows\System\LfozNCR.exe
  C:\Windows\System\LfozNCR.exe
  2⤵
  PID:8880
- C:\Windows\System\kVEQRRb.exe
  C:\Windows\System\kVEQRRb.exe
  2⤵
  PID:8916
- C:\Windows\System\CLZJTvw.exe
  C:\Windows\System\CLZJTvw.exe
  2⤵
  PID:8940
- C:\Windows\System\QeDcoYn.exe
  C:\Windows\System\QeDcoYn.exe
  2⤵
  PID:8964
- C:\Windows\System\cmWJrAB.exe
  C:\Windows\System\cmWJrAB.exe
  2⤵
  PID:8988
- C:\Windows\System\xEgctKa.exe
  C:\Windows\System\xEgctKa.exe
  2⤵
  PID:9016
- C:\Windows\System\JvozZFS.exe
  C:\Windows\System\JvozZFS.exe
  2⤵
  PID:9052
- C:\Windows\System\obNdxnI.exe
  C:\Windows\System\obNdxnI.exe
  2⤵
  PID:9072
- C:\Windows\System\YkrCLCi.exe
  C:\Windows\System\YkrCLCi.exe
  2⤵
  PID:9108
- C:\Windows\System\RAmEwce.exe
  C:\Windows\System\RAmEwce.exe
  2⤵
  PID:9140
- C:\Windows\System\gXwTGrr.exe
  C:\Windows\System\gXwTGrr.exe
  2⤵
  PID:9168
- C:\Windows\System\WUkYRjd.exe
  C:\Windows\System\WUkYRjd.exe
  2⤵
  PID:9184
- C:\Windows\System\UadGhjh.exe
  C:\Windows\System\UadGhjh.exe
  2⤵
  PID:9208
- C:\Windows\System\Odwrhvv.exe
  C:\Windows\System\Odwrhvv.exe
  2⤵
  PID:7748
- C:\Windows\System\pFrZTMv.exe
  C:\Windows\System\pFrZTMv.exe
  2⤵
  PID:8252
- C:\Windows\System\geJFHEC.exe
  C:\Windows\System\geJFHEC.exe
  2⤵
  PID:8312
- C:\Windows\System\KZjcIAK.exe
  C:\Windows\System\KZjcIAK.exe
  2⤵
  PID:8396
- C:\Windows\System\jxVyZGl.exe
  C:\Windows\System\jxVyZGl.exe
  2⤵
  PID:8476
- C:\Windows\System\yRaFmzB.exe
  C:\Windows\System\yRaFmzB.exe
  2⤵
  PID:8516
- C:\Windows\System\psNQeSA.exe
  C:\Windows\System\psNQeSA.exe
  2⤵
  PID:8624
- C:\Windows\System\OcipNis.exe
  C:\Windows\System\OcipNis.exe
  2⤵
  PID:8668
- C:\Windows\System\AUGuKLi.exe
  C:\Windows\System\AUGuKLi.exe
  2⤵
  PID:8712
- C:\Windows\System\KAUqkNn.exe
  C:\Windows\System\KAUqkNn.exe
  2⤵
  PID:8784
- C:\Windows\System\SkzhQvT.exe
  C:\Windows\System\SkzhQvT.exe
  2⤵
  PID:8852
- C:\Windows\System\PUdCbkH.exe
  C:\Windows\System\PUdCbkH.exe
  2⤵
  PID:8868
- C:\Windows\System\dVtvCft.exe
  C:\Windows\System\dVtvCft.exe
  2⤵
  PID:8932
- C:\Windows\System\uIdtCmj.exe
  C:\Windows\System\uIdtCmj.exe
  2⤵
  PID:9012
- C:\Windows\System\sdMfCdD.exe
  C:\Windows\System\sdMfCdD.exe
  2⤵
  PID:9084
- C:\Windows\System\FnzfbLc.exe
  C:\Windows\System\FnzfbLc.exe
  2⤵
  PID:9136
- C:\Windows\System\KwRfECd.exe
  C:\Windows\System\KwRfECd.exe
  2⤵
  PID:9152
- C:\Windows\System\HbTWqoW.exe
  C:\Windows\System\HbTWqoW.exe
  2⤵
  PID:8336
- C:\Windows\System\WQbLJyv.exe
  C:\Windows\System\WQbLJyv.exe
  2⤵
  PID:8564
- C:\Windows\System\gdDXujC.exe
  C:\Windows\System\gdDXujC.exe
  2⤵
  PID:8684
- C:\Windows\System\jVRafku.exe
  C:\Windows\System\jVRafku.exe
  2⤵
  PID:8812
- C:\Windows\System\zuLpQFe.exe
  C:\Windows\System\zuLpQFe.exe
  2⤵
  PID:8924
- C:\Windows\System\VAhQWjo.exe
  C:\Windows\System\VAhQWjo.exe
  2⤵
  PID:9092
- C:\Windows\System\TtAodbG.exe
  C:\Windows\System\TtAodbG.exe
  2⤵
  PID:8224
- C:\Windows\System\ouMwlWI.exe
  C:\Windows\System\ouMwlWI.exe
  2⤵
  PID:8196
- C:\Windows\System\kKzikjJ.exe
  C:\Windows\System\kKzikjJ.exe
  2⤵
  PID:9040
- C:\Windows\System\KzCLOtt.exe
  C:\Windows\System\KzCLOtt.exe
  2⤵
  PID:9236
- C:\Windows\System\cimKLQU.exe
  C:\Windows\System\cimKLQU.exe
  2⤵
  PID:9264
- C:\Windows\System\yahuOki.exe
  C:\Windows\System\yahuOki.exe
  2⤵
  PID:9296
- C:\Windows\System\nreBTbh.exe
  C:\Windows\System\nreBTbh.exe
  2⤵
  PID:9328
- C:\Windows\System\sELgyqZ.exe
  C:\Windows\System\sELgyqZ.exe
  2⤵
  PID:9352
- C:\Windows\System\EshDxHL.exe
  C:\Windows\System\EshDxHL.exe
  2⤵
  PID:9384
- C:\Windows\System\zXvKSZw.exe
  C:\Windows\System\zXvKSZw.exe
  2⤵
  PID:9408
- C:\Windows\System\wWOGMjc.exe
  C:\Windows\System\wWOGMjc.exe
  2⤵
  PID:9440
- C:\Windows\System\QXPAFLI.exe
  C:\Windows\System\QXPAFLI.exe
  2⤵
  PID:9460
- C:\Windows\System\WBVjqdj.exe
  C:\Windows\System\WBVjqdj.exe
  2⤵
  PID:9484
- C:\Windows\System\nDpckoR.exe
  C:\Windows\System\nDpckoR.exe
  2⤵
  PID:9516
- C:\Windows\System\XDBxuDF.exe
  C:\Windows\System\XDBxuDF.exe
  2⤵
  PID:9544
- C:\Windows\System\GAVRLhA.exe
  C:\Windows\System\GAVRLhA.exe
  2⤵
  PID:9568
- C:\Windows\System\VyiQaCF.exe
  C:\Windows\System\VyiQaCF.exe
  2⤵
  PID:9588
- C:\Windows\System\EtPuBJq.exe
  C:\Windows\System\EtPuBJq.exe
  2⤵
  PID:9620
- C:\Windows\System\Ndglvzw.exe
  C:\Windows\System\Ndglvzw.exe
  2⤵
  PID:9660
- C:\Windows\System\eGUQGGU.exe
  C:\Windows\System\eGUQGGU.exe
  2⤵
  PID:9684
- C:\Windows\System\NVuVsQU.exe
  C:\Windows\System\NVuVsQU.exe
  2⤵
  PID:9704
- C:\Windows\System\iqoagwW.exe
  C:\Windows\System\iqoagwW.exe
  2⤵
  PID:9724
- C:\Windows\System\LczIFkC.exe
  C:\Windows\System\LczIFkC.exe
  2⤵
  PID:9756
- C:\Windows\System\Qrcccit.exe
  C:\Windows\System\Qrcccit.exe
  2⤵
  PID:9784
- C:\Windows\System\utgwQXk.exe
  C:\Windows\System\utgwQXk.exe
  2⤵
  PID:9816
- C:\Windows\System\ldOKSRK.exe
  C:\Windows\System\ldOKSRK.exe
  2⤵
  PID:9848
- C:\Windows\System\nMyikZw.exe
  C:\Windows\System\nMyikZw.exe
  2⤵
  PID:9864
- C:\Windows\System\cZBqicy.exe
  C:\Windows\System\cZBqicy.exe
  2⤵
  PID:9892
- C:\Windows\System\hdWfRXD.exe
  C:\Windows\System\hdWfRXD.exe
  2⤵
  PID:9912
- C:\Windows\System\HrYXUgC.exe
  C:\Windows\System\HrYXUgC.exe
  2⤵
  PID:9940
- C:\Windows\System\qFAmonZ.exe
  C:\Windows\System\qFAmonZ.exe
  2⤵
  PID:9964
- C:\Windows\System\uXZRYvo.exe
  C:\Windows\System\uXZRYvo.exe
  2⤵
  PID:10000
- C:\Windows\System\QzpGjOp.exe
  C:\Windows\System\QzpGjOp.exe
  2⤵
  PID:10040
- C:\Windows\System\bnRjrpx.exe
  C:\Windows\System\bnRjrpx.exe
  2⤵
  PID:10060
- C:\Windows\System\BykKguX.exe
  C:\Windows\System\BykKguX.exe
  2⤵
  PID:10096
- C:\Windows\System\NkPaHVT.exe
  C:\Windows\System\NkPaHVT.exe
  2⤵
  PID:10120
- C:\Windows\System\eRdUfkB.exe
  C:\Windows\System\eRdUfkB.exe
  2⤵
  PID:10148
- C:\Windows\System\KleKmYq.exe
  C:\Windows\System\KleKmYq.exe
  2⤵
  PID:10180
- C:\Windows\System\nhFalcT.exe
  C:\Windows\System\nhFalcT.exe
  2⤵
  PID:10204
- C:\Windows\System\TSFXeBK.exe
  C:\Windows\System\TSFXeBK.exe
  2⤵
  PID:8228
- C:\Windows\System\tilPUaI.exe
  C:\Windows\System\tilPUaI.exe
  2⤵
  PID:9228
- C:\Windows\System\uDCkMMY.exe
  C:\Windows\System\uDCkMMY.exe
  2⤵
  PID:8984
- C:\Windows\System\bseZcXd.exe
  C:\Windows\System\bseZcXd.exe
  2⤵
  PID:9368
- C:\Windows\System\JYJkJop.exe
  C:\Windows\System\JYJkJop.exe
  2⤵
  PID:9396
- C:\Windows\System\yQKXZXe.exe
  C:\Windows\System\yQKXZXe.exe
  2⤵
  PID:9480
- C:\Windows\System\dNWGTGM.exe
  C:\Windows\System\dNWGTGM.exe
  2⤵
  PID:9552
- C:\Windows\System\McFZjJF.exe
  C:\Windows\System\McFZjJF.exe
  2⤵
  PID:9600
- C:\Windows\System\gfBppTy.exe
  C:\Windows\System\gfBppTy.exe
  2⤵
  PID:9616
- C:\Windows\System\DMIthrK.exe
  C:\Windows\System\DMIthrK.exe
  2⤵
  PID:9700
- C:\Windows\System\lrwjBHh.exe
  C:\Windows\System\lrwjBHh.exe
  2⤵
  PID:9752
- C:\Windows\System\VQmDpft.exe
  C:\Windows\System\VQmDpft.exe
  2⤵
  PID:9812
- C:\Windows\System\VnGfjfh.exe
  C:\Windows\System\VnGfjfh.exe
  2⤵
  PID:9888
- C:\Windows\System\yZOtHrT.exe
  C:\Windows\System\yZOtHrT.exe
  2⤵
  PID:9948
- C:\Windows\System\hmaaqTp.exe
  C:\Windows\System\hmaaqTp.exe
  2⤵
  PID:9992
- C:\Windows\System\sTcoXOz.exe
  C:\Windows\System\sTcoXOz.exe
  2⤵
  PID:10080
- C:\Windows\System\bypfjSf.exe
  C:\Windows\System\bypfjSf.exe
  2⤵
  PID:9224
- C:\Windows\System\ZwKRKPH.exe
  C:\Windows\System\ZwKRKPH.exe
  2⤵
  PID:9428
- C:\Windows\System\LCuibDs.exe
  C:\Windows\System\LCuibDs.exe
  2⤵
  PID:9604
- C:\Windows\System\GLNRiJy.exe
  C:\Windows\System\GLNRiJy.exe
  2⤵
  PID:9636
- C:\Windows\System\qBOWRRa.exe
  C:\Windows\System\qBOWRRa.exe
  2⤵
  PID:9656
- C:\Windows\System\MLcGadQ.exe
  C:\Windows\System\MLcGadQ.exe
  2⤵
  PID:9980
- C:\Windows\System\LPGilDs.exe
  C:\Windows\System\LPGilDs.exe
  2⤵
  PID:9956
- C:\Windows\System\eEptgWu.exe
  C:\Windows\System\eEptgWu.exe
  2⤵
  PID:10176
- C:\Windows\System\QqvtbfZ.exe
  C:\Windows\System\QqvtbfZ.exe
  2⤵
  PID:9476
- C:\Windows\System\DMrNKIf.exe
  C:\Windows\System\DMrNKIf.exe
  2⤵
  PID:9804
- C:\Windows\System\RVotruv.exe
  C:\Windows\System\RVotruv.exe
  2⤵
  PID:9280
- C:\Windows\System\NRdLZkR.exe
  C:\Windows\System\NRdLZkR.exe
  2⤵
  PID:9740
- C:\Windows\System\mizeMwD.exe
  C:\Windows\System\mizeMwD.exe
  2⤵
  PID:10244
- C:\Windows\System\yFMcAlh.exe
  C:\Windows\System\yFMcAlh.exe
  2⤵
  PID:10284
- C:\Windows\System\rRFIkyT.exe
  C:\Windows\System\rRFIkyT.exe
  2⤵
  PID:10312
- C:\Windows\System\SPQJsEH.exe
  C:\Windows\System\SPQJsEH.exe
  2⤵
  PID:10328
- C:\Windows\System\CtKRClV.exe
  C:\Windows\System\CtKRClV.exe
  2⤵
  PID:10360
- C:\Windows\System\mbQVjvu.exe
  C:\Windows\System\mbQVjvu.exe
  2⤵
  PID:10384
- C:\Windows\System\wMVlGdH.exe
  C:\Windows\System\wMVlGdH.exe
  2⤵
  PID:10412
- C:\Windows\System\WupaSQP.exe
  C:\Windows\System\WupaSQP.exe
  2⤵
  PID:10440
- C:\Windows\System\lLVcxTV.exe
  C:\Windows\System\lLVcxTV.exe
  2⤵
  PID:10456
- C:\Windows\System\IkCAXxQ.exe
  C:\Windows\System\IkCAXxQ.exe
  2⤵
  PID:10484
- C:\Windows\System\CCxOkZb.exe
  C:\Windows\System\CCxOkZb.exe
  2⤵
  PID:10512
- C:\Windows\System\UjXQbSF.exe
  C:\Windows\System\UjXQbSF.exe
  2⤵
  PID:10552
- C:\Windows\System\RouYnsf.exe
  C:\Windows\System\RouYnsf.exe
  2⤵
  PID:10580
- C:\Windows\System\xCIAWhc.exe
  C:\Windows\System\xCIAWhc.exe
  2⤵
  PID:10608
- C:\Windows\System\bdUyomF.exe
  C:\Windows\System\bdUyomF.exe
  2⤵
  PID:10636
- C:\Windows\System\qgoQfiY.exe
  C:\Windows\System\qgoQfiY.exe
  2⤵
  PID:10656
- C:\Windows\System\UOleBui.exe
  C:\Windows\System\UOleBui.exe
  2⤵
  PID:10684
- C:\Windows\System\gFllBen.exe
  C:\Windows\System\gFllBen.exe
  2⤵
  PID:10716
- C:\Windows\System\eRZtcmb.exe
  C:\Windows\System\eRZtcmb.exe
  2⤵
  PID:10748
- C:\Windows\System\OarYcMV.exe
  C:\Windows\System\OarYcMV.exe
  2⤵
  PID:10764
- C:\Windows\System\xAjOUDs.exe
  C:\Windows\System\xAjOUDs.exe
  2⤵
  PID:10788
- C:\Windows\System\kxdcZjf.exe
  C:\Windows\System\kxdcZjf.exe
  2⤵
  PID:10820
- C:\Windows\System\CaoKKic.exe
  C:\Windows\System\CaoKKic.exe
  2⤵
  PID:10860
- C:\Windows\System\imZkVlt.exe
  C:\Windows\System\imZkVlt.exe
  2⤵
  PID:10888
- C:\Windows\System\pUlyLSr.exe
  C:\Windows\System\pUlyLSr.exe
  2⤵
  PID:10916
- C:\Windows\System\LjLcxup.exe
  C:\Windows\System\LjLcxup.exe
  2⤵
  PID:10956
- C:\Windows\System\QZARxUL.exe
  C:\Windows\System\QZARxUL.exe
  2⤵
  PID:10976
- C:\Windows\System\InBlciu.exe
  C:\Windows\System\InBlciu.exe
  2⤵
  PID:11000
- C:\Windows\System\syKmomn.exe
  C:\Windows\System\syKmomn.exe
  2⤵
  PID:11020
- C:\Windows\System\PUMYIGU.exe
  C:\Windows\System\PUMYIGU.exe
  2⤵
  PID:11056
- C:\Windows\System\TFgHQup.exe
  C:\Windows\System\TFgHQup.exe
  2⤵
  PID:11088
- C:\Windows\System\wzUAQHW.exe
  C:\Windows\System\wzUAQHW.exe
  2⤵
  PID:11104
- C:\Windows\System\LTncFdS.exe
  C:\Windows\System\LTncFdS.exe
  2⤵
  PID:11128
- C:\Windows\System\lTJHWgA.exe
  C:\Windows\System\lTJHWgA.exe
  2⤵
  PID:11144
- C:\Windows\System\PBKEhYR.exe
  C:\Windows\System\PBKEhYR.exe
  2⤵
  PID:11176
- C:\Windows\System\gisjfsD.exe
  C:\Windows\System\gisjfsD.exe
  2⤵
  PID:11200
- C:\Windows\System\bfdCNrR.exe
  C:\Windows\System\bfdCNrR.exe
  2⤵
  PID:11228
- C:\Windows\System\hNumxmh.exe
  C:\Windows\System\hNumxmh.exe
  2⤵
  PID:11252
- C:\Windows\System\nKpPyDp.exe
  C:\Windows\System\nKpPyDp.exe
  2⤵
  PID:10268
- C:\Windows\System\VGaUirm.exe
  C:\Windows\System\VGaUirm.exe
  2⤵
  PID:10308
- C:\Windows\System\YzUNFrA.exe
  C:\Windows\System\YzUNFrA.exe
  2⤵
  PID:10424
- C:\Windows\System\zgWzlIn.exe
  C:\Windows\System\zgWzlIn.exe
  2⤵
  PID:10468
- C:\Windows\System\ubYHWTm.exe
  C:\Windows\System\ubYHWTm.exe
  2⤵
  PID:10544
- C:\Windows\System\sfbOsVV.exe
  C:\Windows\System\sfbOsVV.exe
  2⤵
  PID:10624
- C:\Windows\System\jMiUNQq.exe
  C:\Windows\System\jMiUNQq.exe
  2⤵
  PID:10668
- C:\Windows\System\jGWBRMC.exe
  C:\Windows\System\jGWBRMC.exe
  2⤵
  PID:10680
- C:\Windows\System\fPfXzab.exe
  C:\Windows\System\fPfXzab.exe
  2⤵
  PID:10784
- C:\Windows\System\kysQEaR.exe
  C:\Windows\System\kysQEaR.exe
  2⤵
  PID:10808
- C:\Windows\System\yzScihK.exe
  C:\Windows\System\yzScihK.exe
  2⤵
  PID:10876
- C:\Windows\System\bLWJuIM.exe
  C:\Windows\System\bLWJuIM.exe
  2⤵
  PID:10996
- C:\Windows\System\cCDMqMr.exe
  C:\Windows\System\cCDMqMr.exe
  2⤵
  PID:11052
- C:\Windows\System\YTIUDVD.exe
  C:\Windows\System\YTIUDVD.exe
  2⤵
  PID:11116
- C:\Windows\System\FliOeMB.exe
  C:\Windows\System\FliOeMB.exe
  2⤵
  PID:11220
- C:\Windows\System\xvFvxEN.exe
  C:\Windows\System\xvFvxEN.exe
  2⤵
  PID:9312
- C:\Windows\System\WZQCIPs.exe
  C:\Windows\System\WZQCIPs.exe
  2⤵
  PID:10448
- C:\Windows\System\obMTkcT.exe
  C:\Windows\System\obMTkcT.exe
  2⤵
  PID:10712
- C:\Windows\System\AWaijzR.exe
  C:\Windows\System\AWaijzR.exe
  2⤵
  PID:10780
- C:\Windows\System\ByzKSOi.exe
  C:\Windows\System\ByzKSOi.exe
  2⤵
  PID:10692
- C:\Windows\System\GoImEnU.exe
  C:\Windows\System\GoImEnU.exe
  2⤵
  PID:10896
- C:\Windows\System\quNWwan.exe
  C:\Windows\System\quNWwan.exe
  2⤵
  PID:11172
- C:\Windows\System\BzIJkZF.exe
  C:\Windows\System\BzIJkZF.exe
  2⤵
  PID:10256
- C:\Windows\System\puKSTOr.exe
  C:\Windows\System\puKSTOr.exe
  2⤵
  PID:10832
- C:\Windows\System\DsCNIID.exe
  C:\Windows\System\DsCNIID.exe
  2⤵
  PID:10568
- C:\Windows\System\GpfzoDv.exe
  C:\Windows\System\GpfzoDv.exe
  2⤵
  PID:10452
- C:\Windows\System\axKjmWK.exe
  C:\Windows\System\axKjmWK.exe
  2⤵
  PID:11276
- C:\Windows\System\mlNMlFJ.exe
  C:\Windows\System\mlNMlFJ.exe
  2⤵
  PID:11304
- C:\Windows\System\POxlQQH.exe
  C:\Windows\System\POxlQQH.exe
  2⤵
  PID:11336
- C:\Windows\System\LnoTsPq.exe
  C:\Windows\System\LnoTsPq.exe
  2⤵
  PID:11364
- C:\Windows\System\UqYOnED.exe
  C:\Windows\System\UqYOnED.exe
  2⤵
  PID:11396
- C:\Windows\System\UlLLXLq.exe
  C:\Windows\System\UlLLXLq.exe
  2⤵
  PID:11428
- C:\Windows\System\lBqBCTD.exe
  C:\Windows\System\lBqBCTD.exe
  2⤵
  PID:11448
- C:\Windows\System\TVNJNHh.exe
  C:\Windows\System\TVNJNHh.exe
  2⤵
  PID:11480
- C:\Windows\System\cksZrxe.exe
  C:\Windows\System\cksZrxe.exe
  2⤵
  PID:11516
- C:\Windows\System\jYOjfch.exe
  C:\Windows\System\jYOjfch.exe
  2⤵
  PID:11532
- C:\Windows\System\RvtgZiw.exe
  C:\Windows\System\RvtgZiw.exe
  2⤵
  PID:11564
- C:\Windows\System\PSYkHnB.exe
  C:\Windows\System\PSYkHnB.exe
  2⤵
  PID:11588
- C:\Windows\System\LeGErXo.exe
  C:\Windows\System\LeGErXo.exe
  2⤵
  PID:11620
- C:\Windows\System\tiyQWRh.exe
  C:\Windows\System\tiyQWRh.exe
  2⤵
  PID:11656
- C:\Windows\System\QCWEaXY.exe
  C:\Windows\System\QCWEaXY.exe
  2⤵
  PID:11676
- C:\Windows\System\fiwPEpb.exe
  C:\Windows\System\fiwPEpb.exe
  2⤵
  PID:11712
- C:\Windows\System\HWRtTxv.exe
  C:\Windows\System\HWRtTxv.exe
  2⤵
  PID:11744
- C:\Windows\System\BVhOGeu.exe
  C:\Windows\System\BVhOGeu.exe
  2⤵
  PID:11780
- C:\Windows\System\ltqzkRa.exe
  C:\Windows\System\ltqzkRa.exe
  2⤵
  PID:11804
- C:\Windows\System\ygFBZiX.exe
  C:\Windows\System\ygFBZiX.exe
  2⤵
  PID:11832
- C:\Windows\System\wGOuZxN.exe
  C:\Windows\System\wGOuZxN.exe
  2⤵
  PID:11860
- C:\Windows\System\tUWzysA.exe
  C:\Windows\System\tUWzysA.exe
  2⤵
  PID:11880
- C:\Windows\System\xzInhNd.exe
  C:\Windows\System\xzInhNd.exe
  2⤵
  PID:11904
- C:\Windows\System\MWHeHxs.exe
  C:\Windows\System\MWHeHxs.exe
  2⤵
  PID:11936
- C:\Windows\System\znODXrI.exe
  C:\Windows\System\znODXrI.exe
  2⤵
  PID:11968
- C:\Windows\System\XzRQQgn.exe
  C:\Windows\System\XzRQQgn.exe
  2⤵
  PID:11992
- C:\Windows\System\hQrXTUm.exe
  C:\Windows\System\hQrXTUm.exe
  2⤵
  PID:12016
- C:\Windows\System\qaZZnPD.exe
  C:\Windows\System\qaZZnPD.exe
  2⤵
  PID:12036
- C:\Windows\System\WgkriRk.exe
  C:\Windows\System\WgkriRk.exe
  2⤵
  PID:12052
- C:\Windows\System\OLjommA.exe
  C:\Windows\System\OLjommA.exe
  2⤵
  PID:12084
- C:\Windows\System\jBteZKZ.exe
  C:\Windows\System\jBteZKZ.exe
  2⤵
  PID:12108
- C:\Windows\System\WvsfBeH.exe
  C:\Windows\System\WvsfBeH.exe
  2⤵
  PID:12128
- C:\Windows\System\vSxHWcd.exe
  C:\Windows\System\vSxHWcd.exe
  2⤵
  PID:12164
- C:\Windows\System\JlqbBne.exe
  C:\Windows\System\JlqbBne.exe
  2⤵
  PID:12204
- C:\Windows\System\zUyxxxp.exe
  C:\Windows\System\zUyxxxp.exe
  2⤵
  PID:12236
- C:\Windows\System\dJRhpXj.exe
  C:\Windows\System\dJRhpXj.exe
  2⤵
  PID:12260
- C:\Windows\System\aSWtEDj.exe
  C:\Windows\System\aSWtEDj.exe
  2⤵
  PID:12284
- C:\Windows\System\AGnCnuZ.exe
  C:\Windows\System\AGnCnuZ.exe
  2⤵
  PID:11100
- C:\Windows\System\FVbkTdj.exe
  C:\Windows\System\FVbkTdj.exe
  2⤵
  PID:11316
- C:\Windows\System\yqOXdwU.exe
  C:\Windows\System\yqOXdwU.exe
  2⤵
  PID:11416
- C:\Windows\System\jrJwpZf.exe
  C:\Windows\System\jrJwpZf.exe
  2⤵
  PID:11476
- C:\Windows\System\JldQJgE.exe
  C:\Windows\System\JldQJgE.exe
  2⤵
  PID:11468
- C:\Windows\System\yvGmiAl.exe
  C:\Windows\System\yvGmiAl.exe
  2⤵
  PID:11580
- C:\Windows\System\dkjRcEF.exe
  C:\Windows\System\dkjRcEF.exe
  2⤵
  PID:11652
- C:\Windows\System\NvjgShh.exe
  C:\Windows\System\NvjgShh.exe
  2⤵
  PID:11736
- C:\Windows\System\jnwxOuA.exe
  C:\Windows\System\jnwxOuA.exe
  2⤵
  PID:11800
- C:\Windows\System\eYhjYUa.exe
  C:\Windows\System\eYhjYUa.exe
  2⤵
  PID:11872
- C:\Windows\System\SXSYfmr.exe
  C:\Windows\System\SXSYfmr.exe
  2⤵
  PID:11964
- C:\Windows\System\MLxWLtk.exe
  C:\Windows\System\MLxWLtk.exe
  2⤵
  PID:11976
- C:\Windows\System\gSvzYEV.exe
  C:\Windows\System\gSvzYEV.exe
  2⤵
  PID:12028
- C:\Windows\System\XUQmzdX.exe
  C:\Windows\System\XUQmzdX.exe
  2⤵
  PID:12092
- C:\Windows\System\hAXiOKw.exe
  C:\Windows\System\hAXiOKw.exe
  2⤵
  PID:12200
- C:\Windows\System\KbnExjd.exe
  C:\Windows\System\KbnExjd.exe
  2⤵
  PID:12228
- C:\Windows\System\UxYYhld.exe
  C:\Windows\System\UxYYhld.exe
  2⤵
  PID:10368
- C:\Windows\System\hYWFFSs.exe
  C:\Windows\System\hYWFFSs.exe
  2⤵
  PID:11460
- C:\Windows\System\yVzJyGT.exe
  C:\Windows\System\yVzJyGT.exe
  2⤵
  PID:11644
- C:\Windows\System\Kktwxrw.exe
  C:\Windows\System\Kktwxrw.exe
  2⤵
  PID:11844
- C:\Windows\System\kWdIQFs.exe
  C:\Windows\System\kWdIQFs.exe
  2⤵
  PID:11916
- C:\Windows\System\EfOKxTW.exe
  C:\Windows\System\EfOKxTW.exe
  2⤵
  PID:11928
- C:\Windows\System\LuAJiYQ.exe
  C:\Windows\System\LuAJiYQ.exe
  2⤵
  PID:12144
- C:\Windows\System\OyumfXL.exe
  C:\Windows\System\OyumfXL.exe
  2⤵
  PID:11508
- C:\Windows\System\jOZTGkw.exe
  C:\Windows\System\jOZTGkw.exe
  2⤵
  PID:11600
- C:\Windows\System\isWecGX.exe
  C:\Windows\System\isWecGX.exe
  2⤵
  PID:12224
- C:\Windows\System\NBpXApr.exe
  C:\Windows\System\NBpXApr.exe
  2⤵
  PID:11828
- C:\Windows\System\QYvNKKV.exe
  C:\Windows\System\QYvNKKV.exe
  2⤵
  PID:11372
- C:\Windows\System\zqgVdAi.exe
  C:\Windows\System\zqgVdAi.exe
  2⤵
  PID:12324
- C:\Windows\System\qaZeloE.exe
  C:\Windows\System\qaZeloE.exe
  2⤵
  PID:12352
- C:\Windows\System\lQHCWxs.exe
  C:\Windows\System\lQHCWxs.exe
  2⤵
  PID:12384
- C:\Windows\System\ZsvTRcQ.exe
  C:\Windows\System\ZsvTRcQ.exe
  2⤵
  PID:12416
- C:\Windows\System\JZqQroV.exe
  C:\Windows\System\JZqQroV.exe
  2⤵
  PID:12444
- C:\Windows\System\gOwuNZW.exe
  C:\Windows\System\gOwuNZW.exe
  2⤵
  PID:12484
- C:\Windows\System\AXNAoOk.exe
  C:\Windows\System\AXNAoOk.exe
  2⤵
  PID:12500
- C:\Windows\System\cqnhdSv.exe
  C:\Windows\System\cqnhdSv.exe
  2⤵
  PID:12524
- C:\Windows\System\spkLutW.exe
  C:\Windows\System\spkLutW.exe
  2⤵
  PID:12560
- C:\Windows\System\LHBaYze.exe
  C:\Windows\System\LHBaYze.exe
  2⤵
  PID:12584
- C:\Windows\System\irXBvrV.exe
  C:\Windows\System\irXBvrV.exe
  2⤵
  PID:12612
- C:\Windows\System\VPzrNrk.exe
  C:\Windows\System\VPzrNrk.exe
  2⤵
  PID:12644
- C:\Windows\System\QgJPclo.exe
  C:\Windows\System\QgJPclo.exe
  2⤵
  PID:12672
- C:\Windows\System\NmjUfZX.exe
  C:\Windows\System\NmjUfZX.exe
  2⤵
  PID:12700
- C:\Windows\System\SuUlyBk.exe
  C:\Windows\System\SuUlyBk.exe
  2⤵
  PID:12740
- C:\Windows\System\IeCKhrp.exe
  C:\Windows\System\IeCKhrp.exe
  2⤵
  PID:12756
- C:\Windows\System\fJABWSx.exe
  C:\Windows\System\fJABWSx.exe
  2⤵
  PID:12784
- C:\Windows\System\XNPFKcb.exe
  C:\Windows\System\XNPFKcb.exe
  2⤵
  PID:12816
- C:\Windows\System\nTlXOqh.exe
  C:\Windows\System\nTlXOqh.exe
  2⤵
  PID:12852
- C:\Windows\System\PUJvbQo.exe
  C:\Windows\System\PUJvbQo.exe
  2⤵
  PID:12884
- C:\Windows\System\SBnmdin.exe
  C:\Windows\System\SBnmdin.exe
  2⤵
  PID:12908
- C:\Windows\System\xxWCkjD.exe
  C:\Windows\System\xxWCkjD.exe
  2⤵
  PID:12936
- C:\Windows\System\tBmAmzB.exe
  C:\Windows\System\tBmAmzB.exe
  2⤵
  PID:12964
- C:\Windows\System\ajCuWKN.exe
  C:\Windows\System\ajCuWKN.exe
  2⤵
  PID:12984
- C:\Windows\System\MjGkqRp.exe
  C:\Windows\System\MjGkqRp.exe
  2⤵
  PID:13016
- C:\Windows\System\EnbEOxz.exe
  C:\Windows\System\EnbEOxz.exe
  2⤵
  PID:13036
- C:\Windows\System\GyKLljc.exe
  C:\Windows\System\GyKLljc.exe
  2⤵
  PID:13052
- C:\Windows\System\ulmXVFn.exe
  C:\Windows\System\ulmXVFn.exe
  2⤵
  PID:13084
- C:\Windows\System\DprZOmL.exe
  C:\Windows\System\DprZOmL.exe
  2⤵
  PID:13124
- C:\Windows\System\pRwGRsl.exe
  C:\Windows\System\pRwGRsl.exe
  2⤵
  PID:13152
- C:\Windows\System\PuolwhH.exe
  C:\Windows\System\PuolwhH.exe
  2⤵
  PID:13188
- C:\Windows\System\HOlomBU.exe
  C:\Windows\System\HOlomBU.exe
  2⤵
  PID:13216
- C:\Windows\System\msDqGhd.exe
  C:\Windows\System\msDqGhd.exe
  2⤵
  PID:13244
- C:\Windows\System\xNfaebU.exe
  C:\Windows\System\xNfaebU.exe
  2⤵
  PID:13268
- C:\Windows\System\kEVdVJc.exe
  C:\Windows\System\kEVdVJc.exe
  2⤵
  PID:13292
- C:\Windows\System\xcnzZPS.exe
  C:\Windows\System\xcnzZPS.exe
  2⤵
  PID:11724
- C:\Windows\System\yWIJKTa.exe
  C:\Windows\System\yWIJKTa.exe
  2⤵
  PID:12272
- C:\Windows\System\ApeTLiZ.exe
  C:\Windows\System\ApeTLiZ.exe
  2⤵
  PID:12368
- C:\Windows\System\xxmeWJJ.exe
  C:\Windows\System\xxmeWJJ.exe
  2⤵
  PID:12404
- C:\Windows\System\nXIkFVm.exe
  C:\Windows\System\nXIkFVm.exe
  2⤵
  PID:12432
- C:\Windows\System\YKrswmK.exe
  C:\Windows\System\YKrswmK.exe
  2⤵
  PID:12556
- C:\Windows\System\mScCref.exe
  C:\Windows\System\mScCref.exe
  2⤵
  PID:12596
- C:\Windows\System\jsNBDtF.exe
  C:\Windows\System\jsNBDtF.exe
  2⤵
  PID:12632
- C:\Windows\System\eRjTUkR.exe
  C:\Windows\System\eRjTUkR.exe
  2⤵
  PID:12724
- C:\Windows\System\hyvMRZU.exe
  C:\Windows\System\hyvMRZU.exe
  2⤵
  PID:12800
- C:\Windows\System\GZBSJwJ.exe
  C:\Windows\System\GZBSJwJ.exe
  2⤵
  PID:12844
- C:\Windows\System\DeMEceD.exe
  C:\Windows\System\DeMEceD.exe
  2⤵
  PID:12924
- C:\Windows\System\DoxNAEG.exe
  C:\Windows\System\DoxNAEG.exe
  2⤵
  PID:12992
- C:\Windows\System\exfPmLi.exe
  C:\Windows\System\exfPmLi.exe
  2⤵
  PID:13044
- C:\Windows\System\cFWYKzp.exe
  C:\Windows\System\cFWYKzp.exe
  2⤵
  PID:13136
- C:\Windows\System\aBsBseY.exe
  C:\Windows\System\aBsBseY.exe
  2⤵
  PID:13164
- C:\Windows\System\SscGOqD.exe
  C:\Windows\System\SscGOqD.exe
  2⤵
  PID:13256
- C:\Windows\System\GxLprDc.exe
  C:\Windows\System\GxLprDc.exe
  2⤵
  PID:13288
- C:\Windows\System\FMVYVHD.exe
  C:\Windows\System\FMVYVHD.exe
  2⤵
  PID:12544
- C:\Windows\System\XNKPiKh.exe
  C:\Windows\System\XNKPiKh.exe
  2⤵
  PID:12692
- C:\Windows\System\OGBUOWj.exe
  C:\Windows\System\OGBUOWj.exe
  2⤵
  PID:12708
- C:\Windows\System\LGIANoe.exe
  C:\Windows\System\LGIANoe.exe
  2⤵
  PID:13048
- C:\Windows\System\lhQaOoG.exe
  C:\Windows\System\lhQaOoG.exe
  2⤵
  PID:13032
- C:\Windows\System\JuICoRy.exe
  C:\Windows\System\JuICoRy.exe
  2⤵
  PID:13264
- C:\Windows\System\OEAuKFT.exe
  C:\Windows\System\OEAuKFT.exe
  2⤵
  PID:12360
- C:\Windows\System\ZNMDyHA.exe
  C:\Windows\System\ZNMDyHA.exe
  2⤵
  PID:12472
- C:\Windows\System\rocRzRP.exe
  C:\Windows\System\rocRzRP.exe
  2⤵
  PID:12836
- C:\Windows\System\wnjTxde.exe
  C:\Windows\System\wnjTxde.exe
  2⤵
  PID:13324
- C:\Windows\System\wAuRuJE.exe
  C:\Windows\System\wAuRuJE.exe
  2⤵
  PID:13344
- C:\Windows\System\gLlMsNf.exe
  C:\Windows\System\gLlMsNf.exe
  2⤵
  PID:13380
- C:\Windows\System\oICzejw.exe
  C:\Windows\System\oICzejw.exe
  2⤵
  PID:13404
- C:\Windows\System\olznsGv.exe
  C:\Windows\System\olznsGv.exe
  2⤵
  PID:13440
- C:\Windows\System\RKbXwse.exe
  C:\Windows\System\RKbXwse.exe
  2⤵
  PID:13460
- C:\Windows\System\xERBJpi.exe
  C:\Windows\System\xERBJpi.exe
  2⤵
  PID:13480
- C:\Windows\System\UMdJuBW.exe
  C:\Windows\System\UMdJuBW.exe
  2⤵
  PID:13516
- C:\Windows\System\XrNeJyi.exe
  C:\Windows\System\XrNeJyi.exe
  2⤵
  PID:13540
- C:\Windows\System\NdbKRtg.exe
  C:\Windows\System\NdbKRtg.exe
  2⤵
  PID:13560
- C:\Windows\System\OnoRlkz.exe
  C:\Windows\System\OnoRlkz.exe
  2⤵
  PID:13584
- C:\Windows\System\oldHwmb.exe
  C:\Windows\System\oldHwmb.exe
  2⤵
  PID:13616
- C:\Windows\System\uEUJpWu.exe
  C:\Windows\System\uEUJpWu.exe
  2⤵
  PID:13644
- C:\Windows\System\JuESYMZ.exe
  C:\Windows\System\JuESYMZ.exe
  2⤵
  PID:13680
- C:\Windows\System\iRzHgeh.exe
  C:\Windows\System\iRzHgeh.exe
  2⤵
  PID:13704
- C:\Windows\System\oUWdPDu.exe
  C:\Windows\System\oUWdPDu.exe
  2⤵
  PID:13728
- C:\Windows\System\FpYWhBX.exe
  C:\Windows\System\FpYWhBX.exe
  2⤵
  PID:13748
- C:\Windows\System\hcWMVUz.exe
  C:\Windows\System\hcWMVUz.exe
  2⤵
  PID:13772
- C:\Windows\System\qTIKQng.exe
  C:\Windows\System\qTIKQng.exe
  2⤵
  PID:13808
- C:\Windows\System\kfAaSYC.exe
  C:\Windows\System\kfAaSYC.exe
  2⤵
  PID:13844
- C:\Windows\System\OKromuE.exe
  C:\Windows\System\OKromuE.exe
  2⤵
  PID:13872
- C:\Windows\System\NgMHuQx.exe
  C:\Windows\System\NgMHuQx.exe
  2⤵
  PID:13912
- C:\Windows\System\FlAtFFQ.exe
  C:\Windows\System\FlAtFFQ.exe
  2⤵
  PID:13944
- C:\Windows\System\WTaHSLl.exe
  C:\Windows\System\WTaHSLl.exe
  2⤵
  PID:13976
- C:\Windows\System\unlligg.exe
  C:\Windows\System\unlligg.exe
  2⤵
  PID:14004
- C:\Windows\System\aQbiVYz.exe
  C:\Windows\System\aQbiVYz.exe
  2⤵
  PID:14020
- C:\Windows\System\yvsLrFv.exe
  C:\Windows\System\yvsLrFv.exe
  2⤵
  PID:14052
- C:\Windows\System\DcwCaWT.exe
  C:\Windows\System\DcwCaWT.exe
  2⤵
  PID:14076
- C:\Windows\System\aSynLdV.exe
  C:\Windows\System\aSynLdV.exe
  2⤵
  PID:14100
- C:\Windows\System\VkEbeOM.exe
  C:\Windows\System\VkEbeOM.exe
  2⤵
  PID:14136
- C:\Windows\System\wxitqoA.exe
  C:\Windows\System\wxitqoA.exe
  2⤵
  PID:14164
- C:\Windows\System\YadzbRp.exe
  C:\Windows\System\YadzbRp.exe
  2⤵
  PID:14192
- C:\Windows\System\wIseYox.exe
  C:\Windows\System\wIseYox.exe
  2⤵
  PID:14224
- C:\Windows\System\NqXnVRT.exe
  C:\Windows\System\NqXnVRT.exe
  2⤵
  PID:14268
- C:\Windows\System\JTxmzuU.exe
  C:\Windows\System\JTxmzuU.exe
  2⤵
  PID:14288
- C:\Windows\System\HIHmtRh.exe
  C:\Windows\System\HIHmtRh.exe
  2⤵
  PID:14316
- C:\Windows\System\ffnjQZc.exe
  C:\Windows\System\ffnjQZc.exe
  2⤵
  PID:14332
- C:\Windows\System\KFhByzk.exe
  C:\Windows\System\KFhByzk.exe
  2⤵
  PID:13340
- C:\Windows\System\wAeMDdm.exe
  C:\Windows\System\wAeMDdm.exe
  2⤵
  PID:13280
- C:\Windows\System\Ndsjndj.exe
  C:\Windows\System\Ndsjndj.exe
  2⤵
  PID:13468
- C:\Windows\System\oCOQnfn.exe
  C:\Windows\System\oCOQnfn.exe
  2⤵
  PID:13456
- C:\Windows\System\NMSOXbN.exe
  C:\Windows\System\NMSOXbN.exe
  2⤵
  PID:13572
- C:\Windows\System\MwGERrv.exe
  C:\Windows\System\MwGERrv.exe
  2⤵
  PID:13488
- C:\Windows\System\kYCNitv.exe
  C:\Windows\System\kYCNitv.exe
  2⤵
  PID:13676
- C:\Windows\System\aCVHNhe.exe
  C:\Windows\System\aCVHNhe.exe
  2⤵
  PID:13724
- C:\Windows\System\OaQhkPw.exe
  C:\Windows\System\OaQhkPw.exe
  2⤵
  PID:13744
- C:\Windows\System\uQtXBlf.exe
  C:\Windows\System\uQtXBlf.exe
  2⤵
  PID:13820
- C:\Windows\System\rrCeIzE.exe
  C:\Windows\System\rrCeIzE.exe
  2⤵
  PID:13908
- C:\Windows\System\jEbkaXN.exe
  C:\Windows\System\jEbkaXN.exe
  2⤵
  PID:13932
- C:\Windows\System\vBEegaI.exe
  C:\Windows\System\vBEegaI.exe
  2⤵
  PID:14016
- C:\Windows\System\uQsMqYH.exe
  C:\Windows\System\uQsMqYH.exe
  2⤵
  PID:14048
- C:\Windows\System\BQzhCZK.exe
  C:\Windows\System\BQzhCZK.exe
  2⤵
  PID:14160
- C:\Windows\System\tLgumxN.exe
  C:\Windows\System\tLgumxN.exe
  2⤵
  PID:14172
- C:\Windows\System\iEtckaT.exe
  C:\Windows\System\iEtckaT.exe
  2⤵
  PID:14216
- C:\Windows\System\zkmmxqo.exe
  C:\Windows\System\zkmmxqo.exe
  2⤵
  PID:14328
- C:\Windows\System\LFmOJnj.exe
  C:\Windows\System\LFmOJnj.exe
  2⤵
  PID:13372
- C:\Windows\System\CANEzat.exe
  C:\Windows\System\CANEzat.exe
  2⤵
  PID:13416
- C:\Windows\System\bVstyTv.exe
  C:\Windows\System\bVstyTv.exe
  2⤵
  PID:13580
- C:\Windows\System\UreluEU.exe
  C:\Windows\System\UreluEU.exe
  2⤵
  PID:13624
- C:\Windows\System\eVqlBSp.exe
  C:\Windows\System\eVqlBSp.exe
  2⤵
  PID:14148
- C:\Windows\System\FKHxdtj.exe
  C:\Windows\System\FKHxdtj.exe
  2⤵
  PID:14032
- C:\Windows\System\pouxvIV.exe
  C:\Windows\System\pouxvIV.exe
  2⤵
  PID:13428
- C:\Windows\System\BroHbPq.exe
  C:\Windows\System\BroHbPq.exe
  2⤵
  PID:13764
- C:\Windows\System\wJgpJIH.exe
  C:\Windows\System\wJgpJIH.exe
  2⤵
  PID:14284
- C:\Windows\System\yIGPvIf.exe
  C:\Windows\System\yIGPvIf.exe
  2⤵
  PID:14352
- C:\Windows\System\strTIKz.exe
  C:\Windows\System\strTIKz.exe
  2⤵
  PID:14380
- C:\Windows\System\vNJNvxM.exe
  C:\Windows\System\vNJNvxM.exe
  2⤵
  PID:14400
- C:\Windows\System\aRKzFAS.exe
  C:\Windows\System\aRKzFAS.exe
  2⤵
  PID:14428
- C:\Windows\System\IbCddZZ.exe
  C:\Windows\System\IbCddZZ.exe
  2⤵
  PID:14452
- C:\Windows\System\QamPcRb.exe
  C:\Windows\System\QamPcRb.exe
  2⤵
  PID:14484
- C:\Windows\System\fyRBIjk.exe
  C:\Windows\System\fyRBIjk.exe
  2⤵
  PID:14512
- C:\Windows\System\wXEejXq.exe
  C:\Windows\System\wXEejXq.exe
  2⤵
  PID:14544
- C:\Windows\System\aitVrip.exe
  C:\Windows\System\aitVrip.exe
  2⤵
  PID:14576
- C:\Windows\System\bctglnm.exe
  C:\Windows\System\bctglnm.exe
  2⤵
  PID:14604
- C:\Windows\System\MhndWPB.exe
  C:\Windows\System\MhndWPB.exe
  2⤵
  PID:14640
- C:\Windows\System\guhMxYC.exe
  C:\Windows\System\guhMxYC.exe
  2⤵
  PID:14664
- C:\Windows\System\EevSzrq.exe
  C:\Windows\System\EevSzrq.exe
  2⤵
  PID:14688
- C:\Windows\System\pxJBsdV.exe
  C:\Windows\System\pxJBsdV.exe
  2⤵
  PID:14704
- C:\Windows\System\rQOlAkk.exe
  C:\Windows\System\rQOlAkk.exe
  2⤵
  PID:14728
- C:\Windows\System\bSXcGXB.exe
  C:\Windows\System\bSXcGXB.exe
  2⤵
  PID:14756
- C:\Windows\System\PasQeCM.exe
  C:\Windows\System\PasQeCM.exe
  2⤵
  PID:14780
- C:\Windows\System\HFEcYjm.exe
  C:\Windows\System\HFEcYjm.exe
  2⤵
  PID:14816
- C:\Windows\System\OZTcuUr.exe
  C:\Windows\System\OZTcuUr.exe
  2⤵
  PID:14844
- C:\Windows\System\koaDatD.exe
  C:\Windows\System\koaDatD.exe
  2⤵
  PID:14876
- C:\Windows\System\hKLScou.exe
  C:\Windows\System\hKLScou.exe
  2⤵
  PID:14900
- C:\Windows\System\ebLDbwM.exe
  C:\Windows\System\ebLDbwM.exe
  2⤵
  PID:14916
- C:\Windows\System\UXhsOsn.exe
  C:\Windows\System\UXhsOsn.exe
  2⤵
  PID:14940
- C:\Windows\System\oOFxWSH.exe
  C:\Windows\System\oOFxWSH.exe
  2⤵
  PID:14976
- C:\Windows\System\ZwVagXZ.exe
  C:\Windows\System\ZwVagXZ.exe
  2⤵
  PID:15016
- C:\Windows\System\QdrsCdU.exe
  C:\Windows\System\QdrsCdU.exe
  2⤵
  PID:15052
- C:\Windows\System\RZpbrPu.exe
  C:\Windows\System\RZpbrPu.exe
  2⤵
  PID:15072
- C:\Windows\System\NssiDoU.exe
  C:\Windows\System\NssiDoU.exe
  2⤵
  PID:15096
- C:\Windows\System\sDXYbWD.exe
  C:\Windows\System\sDXYbWD.exe
  2⤵
  PID:15128
- C:\Windows\System\EmeeDfT.exe
  C:\Windows\System\EmeeDfT.exe
  2⤵
  PID:15160
- C:\Windows\System\okKAkda.exe
  C:\Windows\System\okKAkda.exe
  2⤵
  PID:15184
- C:\Windows\System\AHpzpdx.exe
  C:\Windows\System\AHpzpdx.exe
  2⤵
  PID:15216
- C:\Windows\System\vghoAVw.exe
  C:\Windows\System\vghoAVw.exe
  2⤵
  PID:15252
- C:\Windows\System\cXfEzUa.exe
  C:\Windows\System\cXfEzUa.exe
  2⤵
  PID:15280
- C:\Windows\System\AXpLzlE.exe
  C:\Windows\System\AXpLzlE.exe
  2⤵
  PID:15312
- C:\Windows\System\MvAGMoM.exe
  C:\Windows\System\MvAGMoM.exe
  2⤵
  PID:15340
- C:\Windows\System\UYmeLHV.exe
  C:\Windows\System\UYmeLHV.exe
  2⤵
  PID:14280
- C:\Windows\System\jxmvtZg.exe
  C:\Windows\System\jxmvtZg.exe
  2⤵
  PID:12976
- C:\Windows\System\olXCobo.exe
  C:\Windows\System\olXCobo.exe
  2⤵
  PID:14392
- C:\Windows\System\eOUkdrZ.exe
  C:\Windows\System\eOUkdrZ.exe
  2⤵
  PID:14412
- C:\Windows\System\vCOquWY.exe
  C:\Windows\System\vCOquWY.exe
  2⤵
  PID:14436
- C:\Windows\System\QBNhgdx.exe
  C:\Windows\System\QBNhgdx.exe
  2⤵
  PID:14500
- C:\Windows\System\SannyTo.exe
  C:\Windows\System\SannyTo.exe
  2⤵
  PID:14588
- C:\Windows\System\qdYMdQl.exe
  C:\Windows\System\qdYMdQl.exe
  2⤵
  PID:14716
- C:\Windows\System\SEjbyAG.exe
  C:\Windows\System\SEjbyAG.exe
  2⤵
  PID:14724
- C:\Windows\System\qGZkZmF.exe
  C:\Windows\System\qGZkZmF.exe
  2⤵
  PID:14856
- C:\Windows\System\rtkKNFj.exe
  C:\Windows\System\rtkKNFj.exe
  2⤵
  PID:14812
- C:\Windows\System\JOOvjAs.exe
  C:\Windows\System\JOOvjAs.exe
  2⤵
  PID:15028
- C:\Windows\System\fNRXJEx.exe
  C:\Windows\System\fNRXJEx.exe
  2⤵
  PID:15080
- C:\Windows\System\EABFXmX.exe
  C:\Windows\System\EABFXmX.exe
  2⤵
  PID:15108
- C:\Windows\System\ncQTSPk.exe
  C:\Windows\System\ncQTSPk.exe
  2⤵
  PID:15036
- C:\Windows\System\ZOtiKIo.exe
  C:\Windows\System\ZOtiKIo.exe
  2⤵
  PID:15140
- C:\Windows\System\lpRhiGd.exe
  C:\Windows\System\lpRhiGd.exe
  2⤵
  PID:15208
- C:\Windows\System\MiyqfeF.exe
  C:\Windows\System\MiyqfeF.exe
  2⤵
  PID:15304
- C:\Windows\System\vyBuZia.exe
  C:\Windows\System\vyBuZia.exe
  2⤵
  PID:15352
- C:\Windows\System\SCapzKf.exe
  C:\Windows\System\SCapzKf.exe
  2⤵
  PID:14184
- C:\Windows\System\NyclpbQ.exe
  C:\Windows\System\NyclpbQ.exe
  2⤵
  PID:14660
- C:\Windows\System\VshwNnW.exe
  C:\Windows\System\VshwNnW.exe
  2⤵
  PID:14560
- C:\Windows\System\pYqYiYv.exe
  C:\Windows\System\pYqYiYv.exe
  2⤵
  PID:14892
- C:\Windows\System\xsYLAct.exe
  C:\Windows\System\xsYLAct.exe
  2⤵
  PID:15012
- C:\Windows\System\tgwVRIV.exe
  C:\Windows\System\tgwVRIV.exe
  2⤵
  PID:15168
- C:\Windows\System\bvwsJoK.exe
  C:\Windows\System\bvwsJoK.exe
  2⤵
  PID:14720
- C:\Windows\System\kzMKxjC.exe
  C:\Windows\System\kzMKxjC.exe
  2⤵
  PID:14764
- C:\Windows\System\TnjLjxw.exe
  C:\Windows\System\TnjLjxw.exe
  2⤵
  PID:15364
- C:\Windows\System\PfQurlB.exe
  C:\Windows\System\PfQurlB.exe
  2⤵
  PID:15396
- C:\Windows\System\ZqzKmmP.exe
  C:\Windows\System\ZqzKmmP.exe
  2⤵
  PID:15424
- C:\Windows\System\TPOgInu.exe
  C:\Windows\System\TPOgInu.exe
  2⤵
  PID:15448
- C:\Windows\System\DhrHidu.exe
  C:\Windows\System\DhrHidu.exe
  2⤵
  PID:15472
- C:\Windows\System\idnxSvg.exe
  C:\Windows\System\idnxSvg.exe
  2⤵
  PID:15500
- C:\Windows\System\ChZWVOC.exe
  C:\Windows\System\ChZWVOC.exe
  2⤵
  PID:15528
- C:\Windows\System\pCgiURZ.exe
  C:\Windows\System\pCgiURZ.exe
  2⤵
  PID:15576
- C:\Windows\System\CfxVYUO.exe
  C:\Windows\System\CfxVYUO.exe
  2⤵
  PID:15604
- C:\Windows\System\HjNirjj.exe
  C:\Windows\System\HjNirjj.exe
  2⤵
  PID:15628
- C:\Windows\System\CXtAsIT.exe
  C:\Windows\System\CXtAsIT.exe
  2⤵
  PID:15656
- C:\Windows\System\kTbGuEe.exe
  C:\Windows\System\kTbGuEe.exe
  2⤵
  PID:15680
- C:\Windows\System\jOVgjMf.exe
  C:\Windows\System\jOVgjMf.exe
  2⤵
  PID:15708
- C:\Windows\System\foBYAbK.exe
  C:\Windows\System\foBYAbK.exe
  2⤵
  PID:15728
- C:\Windows\System\IxiPpvT.exe
  C:\Windows\System\IxiPpvT.exe
  2⤵
  PID:15756
- C:\Windows\System\ziswtSG.exe
  C:\Windows\System\ziswtSG.exe
  2⤵
  PID:15772
- C:\Windows\System\gpuQsOs.exe
  C:\Windows\System\gpuQsOs.exe
  2⤵
  PID:15796
- C:\Windows\System\fWlRbsM.exe
  C:\Windows\System\fWlRbsM.exe
  2⤵
  PID:15828
- C:\Windows\System\LEQqbVY.exe
  C:\Windows\System\LEQqbVY.exe
  2⤵
  PID:15852
- C:\Windows\System\UHwjQrm.exe
  C:\Windows\System\UHwjQrm.exe
  2⤵
  PID:15888
- C:\Windows\System\vTjsbmn.exe
  C:\Windows\System\vTjsbmn.exe
  2⤵
  PID:15920
- C:\Windows\System\KvlFWEJ.exe
  C:\Windows\System\KvlFWEJ.exe
  2⤵
  PID:15948
- C:\Windows\System\OEvmEkW.exe
  C:\Windows\System\OEvmEkW.exe
  2⤵
  PID:15972
- C:\Windows\System\OonmdXR.exe
  C:\Windows\System\OonmdXR.exe
  2⤵
  PID:16000
- C:\Windows\System\MGpRqkl.exe
  C:\Windows\System\MGpRqkl.exe
  2⤵
  PID:16032
- C:\Windows\System\bjMXmil.exe
  C:\Windows\System\bjMXmil.exe
  2⤵
  PID:16064
- C:\Windows\System\aXdUbQG.exe
  C:\Windows\System\aXdUbQG.exe
  2⤵
  PID:16100
- C:\Windows\System\ZKkhObA.exe
  C:\Windows\System\ZKkhObA.exe
  2⤵
  PID:16132
- C:\Windows\System\WCUTRXk.exe
  C:\Windows\System\WCUTRXk.exe
  2⤵
  PID:16168
- C:\Windows\System\Xxzrzao.exe
  C:\Windows\System\Xxzrzao.exe
  2⤵
  PID:16184
- C:\Windows\System\iygFSJN.exe
  C:\Windows\System\iygFSJN.exe
  2⤵
  PID:16200
- C:\Windows\System\XuKEugj.exe
  C:\Windows\System\XuKEugj.exe
  2⤵
  PID:16236
- C:\Windows\System\thuTqDa.exe
  C:\Windows\System\thuTqDa.exe
  2⤵
  PID:16260
- C:\Windows\System\KeRxuWK.exe
  C:\Windows\System\KeRxuWK.exe
  2⤵
  PID:16296
- C:\Windows\System\wdSuRZx.exe
  C:\Windows\System\wdSuRZx.exe
  2⤵
  PID:16320
- C:\Windows\System\psfuOXj.exe
  C:\Windows\System\psfuOXj.exe
  2⤵
  PID:16348
- C:\Windows\System\tEMNlnt.exe
  C:\Windows\System\tEMNlnt.exe
  2⤵
  PID:16368
- C:\Windows\System\aYUnpEu.exe
  C:\Windows\System\aYUnpEu.exe
  2⤵
  PID:14424
- C:\Windows\System\jjvgJKS.exe
  C:\Windows\System\jjvgJKS.exe
  2⤵
  PID:14520
- C:\Windows\System\cFAcDaM.exe
  C:\Windows\System\cFAcDaM.exe
  2⤵
  PID:15432
- C:\Windows\System\pMCLXXD.exe
  C:\Windows\System\pMCLXXD.exe
  2⤵
  PID:15568
- C:\Windows\System\UNqEmdr.exe
  C:\Windows\System\UNqEmdr.exe
  2⤵
  PID:15640
- C:\Windows\System\vTiKtxM.exe
  C:\Windows\System\vTiKtxM.exe
  2⤵
  PID:15612
- C:\Windows\System\wRyvGZW.exe
  C:\Windows\System\wRyvGZW.exe
  2⤵
  PID:15664
- C:\Windows\System\XcHOWQN.exe
  C:\Windows\System\XcHOWQN.exe
  2⤵
  PID:15784
- C:\Windows\System\vjElDdP.exe
  C:\Windows\System\vjElDdP.exe
  2⤵
  PID:15764
- C:\Windows\System\MUnuSuY.exe
  C:\Windows\System\MUnuSuY.exe
  2⤵
  PID:15864
- C:\Windows\System\TQbUDth.exe
  C:\Windows\System\TQbUDth.exe
  2⤵
  PID:16016
- C:\Windows\System\JBQWhMj.exe
  C:\Windows\System\JBQWhMj.exe
  2⤵
  PID:15988
- C:\Windows\System\pMcqJGE.exe
  C:\Windows\System\pMcqJGE.exe
  2⤵
  PID:16336
- C:\Windows\System\qmkKtBF.exe
  C:\Windows\System\qmkKtBF.exe
  2⤵
  PID:16276
- C:\Windows\System\FhOcUaN.exe
  C:\Windows\System\FhOcUaN.exe
  2⤵
  PID:15372
- C:\Windows\System\wXSaAoV.exe
  C:\Windows\System\wXSaAoV.exe
  2⤵
  PID:16364
- C:\Windows\System\LQwlNWO.exe
  C:\Windows\System\LQwlNWO.exe
  2⤵
  PID:15464
- C:\Windows\System\OKQDnvC.exe
  C:\Windows\System\OKQDnvC.exe
  2⤵
  PID:15572
- C:\Windows\System\TaFiaFz.exe
  C:\Windows\System\TaFiaFz.exe
  2⤵
  PID:15768
- C:\Windows\System\ekruYPk.exe
  C:\Windows\System\ekruYPk.exe
  2⤵
  PID:15724
- C:\Windows\System\naHhAgQ.exe
  C:\Windows\System\naHhAgQ.exe
  2⤵
  PID:15996
- C:\Windows\System\kAsEMJi.exe
  C:\Windows\System\kAsEMJi.exe
  2⤵
  PID:16044
- C:\Windows\System\sbUpBux.exe
  C:\Windows\System\sbUpBux.exe
  2⤵
  PID:16056
- C:\Windows\System\UybBtLM.exe
  C:\Windows\System\UybBtLM.exe
  2⤵
  PID:16332
- C:\Windows\System\XuOzMUO.exe
  C:\Windows\System\XuOzMUO.exe
  2⤵
  PID:15840
- C:\Windows\System\IpWnIwI.exe
  C:\Windows\System\IpWnIwI.exe
  2⤵
  PID:16076
- C:\Windows\System\fOspwcc.exe
  C:\Windows\System\fOspwcc.exe
  2⤵
  PID:15644
- C:\Windows\System\LFDbPFI.exe
  C:\Windows\System\LFDbPFI.exe
  2⤵
  PID:16400
- C:\Windows\System\fJbAbyK.exe
  C:\Windows\System\fJbAbyK.exe
  2⤵
  PID:16424
- C:\Windows\System\IkUzvJa.exe
  C:\Windows\System\IkUzvJa.exe
  2⤵
  PID:16456
- C:\Windows\System\BaNkAgj.exe
  C:\Windows\System\BaNkAgj.exe
  2⤵
  PID:16484
- C:\Windows\System\ODEWTLw.exe
  C:\Windows\System\ODEWTLw.exe
  2⤵
  PID:16516
- C:\Windows\System\sJinpbb.exe
  C:\Windows\System\sJinpbb.exe
  2⤵
  PID:16552
- C:\Windows\System\sOlZItj.exe
  C:\Windows\System\sOlZItj.exe
  2⤵
  PID:16580
- C:\Windows\System\LpkFhsw.exe
  C:\Windows\System\LpkFhsw.exe
  2⤵
  PID:16608
- C:\Windows\System\KzUFnEW.exe
  C:\Windows\System\KzUFnEW.exe
  2⤵
  PID:16636
- C:\Windows\System\AfewTEH.exe
  C:\Windows\System\AfewTEH.exe
  2⤵
  PID:16672
- C:\Windows\System\noAauHJ.exe
  C:\Windows\System\noAauHJ.exe
  2⤵
  PID:16704
- C:\Windows\System\JHWVePA.exe
  C:\Windows\System\JHWVePA.exe
  2⤵
  PID:16732
- C:\Windows\System\qtegmEC.exe
  C:\Windows\System\qtegmEC.exe
  2⤵
  PID:16756
- C:\Windows\System\DDQkkWH.exe
  C:\Windows\System\DDQkkWH.exe
  2⤵
  PID:16772
- C:\Windows\System\OhvUQtD.exe
  C:\Windows\System\OhvUQtD.exe
  2⤵
  PID:16808
- C:\Windows\System\quTaMBO.exe
  C:\Windows\System\quTaMBO.exe
  2⤵
  PID:16828
- C:\Windows\System\WJTClnI.exe
  C:\Windows\System\WJTClnI.exe
  2⤵
  PID:16864
- C:\Windows\System\bBtdqGd.exe
  C:\Windows\System\bBtdqGd.exe
  2⤵
  PID:16880
- C:\Windows\System\IbiVNZu.exe
  C:\Windows\System\IbiVNZu.exe
  2⤵
  PID:16912
- C:\Windows\System\SmrVchS.exe
  C:\Windows\System\SmrVchS.exe
  2⤵
  PID:16944
- C:\Windows\System\eBpgKQF.exe
  C:\Windows\System\eBpgKQF.exe
  2⤵
  PID:16980
- C:\Windows\System\wAqCvjY.exe
  C:\Windows\System\wAqCvjY.exe
  2⤵
  PID:16996
- C:\Windows\System\BkiRXiF.exe
  C:\Windows\System\BkiRXiF.exe
  2⤵
  PID:17020
- C:\Windows\System\fMcLcYc.exe
  C:\Windows\System\fMcLcYc.exe
  2⤵
  PID:17052
- C:\Windows\System\sqIztpn.exe
  C:\Windows\System\sqIztpn.exe
  2⤵
  PID:17080
- C:\Windows\System\FNDLWGa.exe
  C:\Windows\System\FNDLWGa.exe
  2⤵
  PID:17108
- C:\Windows\System\adVdzSH.exe
  C:\Windows\System\adVdzSH.exe
  2⤵
  PID:17124
- C:\Windows\System\mdVMpTP.exe
  C:\Windows\System\mdVMpTP.exe
  2⤵
  PID:17148
- C:\Windows\System\eLFPRyp.exe
  C:\Windows\System\eLFPRyp.exe
  2⤵
  PID:17176
- C:\Windows\System\HPpsmYG.exe
  C:\Windows\System\HPpsmYG.exe
  2⤵
  PID:17192
- C:\Windows\System\yFioNwc.exe
  C:\Windows\System\yFioNwc.exe
  2⤵
  PID:17216
- C:\Windows\System\ZClziDO.exe
  C:\Windows\System\ZClziDO.exe
  2⤵
  PID:17236

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:17008

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\AEWblLq.exe

Filesize
1.7MB

MD5
858596e21d0a1c37bab233eec568b886

SHA1
f25506571b33f0ba9c5d735828fe2bafd33ee698

SHA256
f7d7e88e952c5683548dc474c828994d24cfa67a4e239bb5de1fbdf983e916e6

SHA512
69dfce03469eff6c7857e79a664d41530704603f1735564091349037b71e8c79e02be30d497841baefc947d68ad641be19c980fa800343b2331a24754e53f254

Download Submit
C:\Windows\System\BoFkpfI.exe

Filesize
1.7MB

MD5
78b5d702f31d70afe78367ccdd9396b6

SHA1
1db485df4670cc8fe9689f3d8343eba850cfdf49

SHA256
f223d56f77073e9a8196e3178d28fd9c9b10715129a6e1aef9847e4b53524e27

SHA512
4267ce4c4570c3acd86f082a4bbf10764f9e84ea1c7edc3c5fd5f6283dea42ee219e204c00bddfae28706067e79631bce2d962747cb926613041c4bbe7e72ff3

Download Submit
C:\Windows\System\CofjTtu.exe

Filesize
1.7MB

MD5
b92bd29cbcf12b72eb84b3c5c2f5b523

SHA1
ed5c61e3d4ea0084c77c7cc970019daaa06bab25

SHA256
28e5e4586b35da8039eedcb5fff493b4a2dca8ffe3c541aa7c4f5a3c9989150b

SHA512
6dd63bfbbdb3467a3f9954c9b73f2250e421bde2af13dfb1cdf92cb58144f5fd4798aa2b072d26fecfd1ea440da78c842b15aa4734ebb8867d9f8492922512e4

Download Submit
C:\Windows\System\DBieXRB.exe

Filesize
1.7MB

MD5
8d30f5ee519646858fdeba35014293f6

SHA1
804cc29da770cdac435cef3839a6795647f491ac

SHA256
3c987d3f1a9f1b4169d17640d3542816d0a2c25ef87ededf0fdf75d7f3830af1

SHA512
0cf7d9e8d9c56a7c898dde91d6a2a44fcb3b158f889b33cf71ab0b29c62f7ce372778fb201bcaeeeb5c00ddd8a859c9bbf759bcc36851b33cbc5a137749082d4

Download Submit
C:\Windows\System\EeGBmfT.exe

Filesize
1.7MB

MD5
1a42bec7e616c580198c6b3a04a298e5

SHA1
158e89b52b21b76d52b6c03085f2f810cff1a116

SHA256
2d1fc24e1085143f54c9198faff7dee45081da7b332b04da722f7c5325b82760

SHA512
f380e0294a46089abcb31676575847c9bd42ebca75f964410ea687ec3c6e4df663801ffa73c9585e93ae1c20ee335196735a19a8abfba399f733a908465c19a0

Download Submit
C:\Windows\System\FVVnxFW.exe

Filesize
1.7MB

MD5
dd8e4d10eacddd72015b9effdd9fc113

SHA1
e03a4fc0ee360f0fe2bb0125735126cc4b94fea7

SHA256
6d0b1699830ffdb22a7191b16ea72b0101755fd3e809c9b95b4666081e57e3ae

SHA512
ffee23676d5043e315c469a34f357d2dc1f4fc89c7e1127198c56bd65296912b7777aa5364a321faffa4245d7901030c61d18f995f101e76f08f40ff6f5aa4c5

Download Submit
C:\Windows\System\IFarFLX.exe

Filesize
1.7MB

MD5
622331431e20a37f008d646a82363ee5

SHA1
0ddb7cdb9df3a16f3f1d1382a9f97eb4cb5fdc47

SHA256
89823be1a12c0d976e15dd2fae1fadd8d5bf005d02a90bd8298ec6db8e2aee6c

SHA512
fbb4d308bde9d41739ea1cb46289f04538622cf6073e3ca5da0d5c4725f9e7f1a4a375cb3ba7857eda921cc24eef78b90372e456c451002a2f1346df6f2e84fa

Download Submit
C:\Windows\System\IPgZkMd.exe

Filesize
1.7MB

MD5
7a08638356e2ef7b6ed28ff6159e7f88

SHA1
d6f368dbdd4c583f85b34a22808ee19c873bc88e

SHA256
d121d2a08ed230804640755f90e1f7d90e21959a7038fccb264d2cade56d21f9

SHA512
ac3c1da3f269a98c53c540cbe9b30d28cb8c03c25b588145ee3f35fd9c293b65d8a451ff82bb21e3c24069e7728c6cbed99d67741722109154a40e40384e119b

Download Submit
C:\Windows\System\LYCRoBv.exe

Filesize
1.7MB

MD5
845d223e239b14a8d6b8e6a37975aa64

SHA1
91c58246e6daccf9c249085eec9be9b3c2aae586

SHA256
a3117fd7d1fd8045d3534ff4dbc0c65640e9bc7568af9b4dd8fbee2f10e0da42

SHA512
a2ec383f2f8e441bd972fcedfe699540bb0537c0f43ae4e58792e3cccf8b2aa90fefc490cb75110ff3d88596ec9fe19c083848054076ac4df5f7b86a3eb78f77

Download Submit
C:\Windows\System\MPZGbvx.exe

Filesize
1.7MB

MD5
aa887bd8c9cefb1d945afaabee044877

SHA1
3874776a08c985b7184d4b28d1688c0923c0d1b0

SHA256
aa872fdeb7f5a547eaa4a6ad915e2936fb45bf4c4f5d6c459c2c477044a5154e

SHA512
4cd110f0a34fdc3c5516fa39f26195bb741d2ed1826cd872198642810da3a17d2bd9a8df50e184a3832de6353ac6f92567d043d35a266c7e41ded5b499ce9e05

Download Submit
C:\Windows\System\McBZFeJ.exe

Filesize
1.7MB

MD5
0633459ddcee6cc74fd2cc77632cdc41

SHA1
8347fa5aab24cc7195dd71f3b15b2963b1471fd8

SHA256
c5d8947d54abdca96cf5c0d39f6d1f99c4382d9a81d4f2240adf0a5919c031d0

SHA512
6817a6e55e31b03f9d78b4d10213f9a10836e1297fce254abbd2a697c28120ed3fb38fce734acfa674c2d4c9b887ba6c596a6cd07edd486dcca1a89cc5fdb35a

Download Submit
C:\Windows\System\OQIXBVj.exe

Filesize
1.7MB

MD5
897e7685645e3096d93e4d9f4ffc4955

SHA1
9e5fb3ec7735d01697d3dbdafd563d1ba9bfc642

SHA256
b35413d27e4986774951102a2cafd086ec0e8936ca574d32eab4dc781fcf78b2

SHA512
b42a77e45c3858f04eb4be147ac5b84af96348c531aad459ea03b1993195d2d40e637ea4ab570c14dc31d04ecee25276ab163b960c2eefe3ed2409ea733af606

Download Submit
C:\Windows\System\QAbseTR.exe

Filesize
1.7MB

MD5
f1d3ae6e04c1806b91d6d1a5e4ea77f6

SHA1
d3742e32c27d67887d10ce810e697cab68a60fc5

SHA256
8b36c74626bc38e77eec6c5d9d2bc2ccc153f69c7b0ffa19bef77408e6662560

SHA512
6573b37a6ed9a7e65acf85943d784115e36cff42e0acbf84a49bdabcb511a0a3a11f10f121856c6f5139d5d5d72e0f8f72b96d0c73203a7713e7ea129cbbf930

Download Submit
C:\Windows\System\RvwpMMG.exe

Filesize
1.7MB

MD5
fffcce5bf582f6faab34734da1d4f3fb

SHA1
81ab0986a32a6dbe1ee5a87092e2b2b356380391

SHA256
0104edca1fb8a64cce75c177b81bae35e227013ca48b3943e5f8b334073dcca1

SHA512
7bb106fca6bf117924e20b7c63d103f429c107f990d0b134d9c25e197fddeaf8dbab4efdf30bc6f383ad6cecf9b46bb6406bf385c1e397f1d17072e5e617f483

Download Submit
C:\Windows\System\TASJZYs.exe

Filesize
1.7MB

MD5
a56673d51f0c836b9e2e77547aef5bba

SHA1
22903932d803685e407cc3210389ae9876f71023

SHA256
878b3d8a4406f8fa9a357493f72165edea783e3f9b42ff3cf7be342e0f369b7a

SHA512
b7c32d4912f76896de8442cc767dc97d2c0c1cad10e11393301cce2c4fe35dd77e8b9a13e00bbcd24332bee750282108da558b50d803c1286fab9f5688488c9f

Download Submit
C:\Windows\System\WDurqrw.exe

Filesize
1.7MB

MD5
fe11310ba0f4e6ce1bd2e6161101d975

SHA1
9a8de049ced6eee40f3c6f56fb93c45ef0809f00

SHA256
7dcd78824c2dd3194ff9a6986829b50fddb31f535e8b3fa8d1542316d951fb5c

SHA512
3e05e533de4518e0426a068d276d7fdca6a56e9e9e979e40c000f66e27a9014a667744c56a5a824d9fe03a7cfc2ebe28fa82f14fc01ab0b4a331d054000a1b35

Download Submit
C:\Windows\System\WLJLyvC.exe

Filesize
1.7MB

MD5
0fd9005a3854705922695c9fca01c3cf

SHA1
71ca28a8b60238036708420bcdb08d5e5cc0e816

SHA256
3ff3ff7eb631a7582ad41b22311d629441e0b2f7618eab4c2e1ace0b1aa471e5

SHA512
0fcbc1483596d218425d33884da870d9ca24ad47da386bbaaeba30b3002eabdebfc990d0706d26d465a94cf1f0a2f3efa5b754391f247b9f71bb3dea6a1d52dd

Download Submit
C:\Windows\System\bKnIiFw.exe

Filesize
1.7MB

MD5
b191ba6c7860d32c17c7d666b4acac50

SHA1
c6139d7fe7055d0a17a40ae00f39a8697d5920aa

SHA256
663ab1e419cbe141205535ebb5d6ec74ef55a29e0a584e0e2bc65e0ad17cde18

SHA512
ed4725e0ba9c5c55df850c0f610087a49a5c75e07b30c2ca25846dbe23792d5f2baef5cb13fc04781774b8eb728abb885c2c2209abe4432e2a334afb7e827398

Download Submit
C:\Windows\System\dVVdrjo.exe

Filesize
1.7MB

MD5
625aaa774609e917e601c03af2c504ec

SHA1
fcecaa68f44c6eaced307b2e7289ee940f99bcb8

SHA256
e4e6ebeeef96914f91ea830108c9953d8c8814f5d7849bebf8e728ee6c54e218

SHA512
449b6a619e086d6b45663e46298143bc5e94102e008365a78a4ee03941ecb96b1d85dd5bcafb6b04f873a9e2bf546dd3917c16d793c78fc1cc0ddb4601e9e010

Download Submit
C:\Windows\System\hkIWrdx.exe

Filesize
1.7MB

MD5
62d03300c642fd8d0a0b3f4eaab54064

SHA1
320d808537e1cf040574331dcc55341de843c800

SHA256
11dbf4b1c6e8c9fb0072e1c9cfcfe7f33d148a5042ff7c85efa3a381e445b699

SHA512
de63404b6431053fe201dbe4ec5c14974966a4c898c46e7e5f318d7322f083aec12af0f51ffbcf74060a64b476ea96bd4ca49b1f71b86d1d83e1b8a02892fe09

Download Submit
C:\Windows\System\huIQZKt.exe

Filesize
1.7MB

MD5
dffbb6544b80efb93497925808a98666

SHA1
1cb78b88c613812562c1142a24238581eb496744

SHA256
f08e90e2efd1e2567727a7b787a00cf89a9cbf109eb2d9659e74da9309227882

SHA512
c20d3e34829a8b08e0f1a03c3739977c6ac5a251ee6dc13eb55af891cf897e8172438b7d84000dde50157af5d7f3bb4bf6689ea3ea991dd39a65b9d12bfbff73

Download Submit
C:\Windows\System\ibzWeQk.exe

Filesize
1.7MB

MD5
7680814525ec5e813883363a642aa554

SHA1
1235f80f0e1ec9cedf29b4c8acde88c2a958c965

SHA256
b327b5082c57c1015cf7bd907f5227d98d3c1202187e8dca5543032bd5cbc240

SHA512
7b74b28ed2519fee65001c8f97ef053675fe5dd8a34a77eff81dfda706137497498ee9888ecf352353c5bbe801af9bcac3d02ae8df44a24e9be1ed66e406de2a

Download Submit
C:\Windows\System\jmocyit.exe

Filesize
1.7MB

MD5
914b87c82334245f59dabe060aa50432

SHA1
4a8a0f59a1e4a4e5812a0fdfad7d17b7ae6b7900

SHA256
5853b8a0de621c3319fccc357e49b8070186c7c781c5c12e02f7949f607e609f

SHA512
92c616b3173408fb62406f63a810a783ddf416fe0069286743dd8998793253ca40da1b26451739846caf27d0f4f9c9e636fd17bd9942c042aed923519539cbbf

Download Submit
C:\Windows\System\kaeAqSA.exe

Filesize
1.7MB

MD5
02a0610550f3f1ebfc9ad40f33d15856

SHA1
3aaff1dd2353adfbf43bb8cd9c22b7d482327f6d

SHA256
e4c0e70b52ae4efa53e6b97d02370169bdfd48e7ee5c5fad90f5aa3096d6eb95

SHA512
00ce77e93e9d5cbe02ab25108b6e7138e7fc632f4524c156e6dedd063915b8d16917fc78b6738444546406d1100b2b57988daa89c4700c195a1993da15cdadda

Download Submit
C:\Windows\System\mBxoABz.exe

Filesize
1.7MB

MD5
fc5043f7228f4c8261d2c761e285ac92

SHA1
e201a5c5902e49a14398cd4c49f34362220368fc

SHA256
0656fc2368448e67b0b3efa367c50d572b2a93a5eb05e529a2033065bda4c11d

SHA512
52edf4353d28b0811f786ff223c848fe86f94cba34a77dbadb61f4edc4c526de73e82c157333d119f3688b2f10886fd60bd66d2dee3349436371c66646813ff6

Download Submit
C:\Windows\System\papxYnD.exe

Filesize
1.7MB

MD5
3e50e314dd2c678ed4c0491c2e9351d9

SHA1
a3975de465b86a35e6bd9399c2c90c69778ac400

SHA256
2b275ad460701b86ecb7c13e785f662845967273727615a4f5e509394610ce62

SHA512
c703d3e89b3cf16405d69c53125283c9e67ac2d0b9962b04b70391e1f39fbd3eb77b34bdcb1cb78b89a883950da3677c1a7be9b261445d9ea1b01a6cf51c1ae2

Download Submit
C:\Windows\System\pkXtqoc.exe

Filesize
1.7MB

MD5
74e928767e5c2e738f598f31bde56ac1

SHA1
fc67eccc1f3de88034d09ec81baf5a131820223d

SHA256
ba15b21738cc7b5843ce167dfd7f9973bae09f8400e34cc6bfdd8ac13f3009e8

SHA512
575a42a6ecb5c380f40279f982ca616c87ff3ba2e5c50ac87b422796e9fdbe2336a1adc8b95bfb7576c045aaa1e0ee2beac8282a3c18052b730c35256ba5e31a

Download Submit
C:\Windows\System\qmeMFen.exe

Filesize
1.7MB

MD5
f9f4aea3a06fb28093ac9a5078775645

SHA1
9d7a3235b0c2d52bcdf9549b6019c364b0ab6c7c

SHA256
671cab9749515098e9e9344131c0f6e72c0efb2bbee8b2b6212cdba473cc22ad

SHA512
ef35d5fdb726d7c0e69af277b66073aee19919ae46fb9eb0b4214ca44189a0b0a8a114824729e6bd3b08bbd219ac14bc2db13755777fd939864e712939c20b51

Download Submit
C:\Windows\System\xcFuRzA.exe

Filesize
1.7MB

MD5
66d7560c6c650b56c7dfbe4727525359

SHA1
dae40fb81a6d6484d8639ed83aca1c1dc441e423

SHA256
8875c4df5088e9e800640d15efc1e742404805eb52948f92196b759c85df0e37

SHA512
3fbc996dad6df6e552fc96121b2171b44469c57982e45ff70191e3f060d19fe66ed3901d7cb0b28ac725fb411c9249199a6e7e5b445c4eda2400c2339152e855

Download Submit
C:\Windows\System\yClvODT.exe

Filesize
1.7MB

MD5
f0ce292d869fe4819e617f513c8d43ac

SHA1
80c5a8dd37823ad7aa5d869fb0099645d0118738

SHA256
ce21ae2e4f6ec7fb036423b78be515e551748997b3ad0b47752936d43a4fa148

SHA512
7e014268615ed8cf05485d18ba704aa69a950e81b1529f9c1504022c19b869f6b4f06985708870a307cc7a0cb907f666f46546dbbd23ae11fe2ec4bc7320fdbb

Download Submit
C:\Windows\System\ywLrUHU.exe

Filesize
1.7MB

MD5
791d4867b68790e1c8de9f9352789e0e

SHA1
30e042e0260ec7fada8f3b4e3ffdd9cff4a3e5a6

SHA256
7b753b14b09650ac3505eeaaa7759c9e9520f2de045caacb27fa737210df4132

SHA512
e2e957ba5f3ab5cb732d60e3011417dd39a054cdad3e055171b92b7cdef5d3c7e19595bc59117f5e60941b4fa162921c10461b9a8e50425699f325ec554b7635

Download Submit
C:\Windows\System\zlbUTMJ.exe

Filesize
1.7MB

MD5
152bfab77d9f43b4cefb157c8274b818

SHA1
9c8fa91bce562571a30ebc38add81f0ba6f4a8b3

SHA256
85d310dd1a9da46929791e952d5b613a3ce59c9bdeba959c5816235d13119c44

SHA512
d2d2e4b30e61c469ee59e96f0e4307774349fb8cd2a5033932c731f5b1c94616d8879023f25ef9acbfc1c8c9c24ba268a8335ac14eef65746cdde86a9dc5035d

Download Submit
memory/3636-0-0x000001BBD4CE0000-0x000001BBD4CF0000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads