xmrig | 4e0b36ae948ce462871b9c0833519dc2211484e6feb2e8401fa40a19656950f0

Analysis

max time kernel
120s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
22-12-2024 22:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4e0b36ae948ce462871b9c0833519dc2211484e6feb2e8401fa40a19656950f0.exe
Size

1.0MB
MD5

649882327ba0d21bd9354ea685c1b94a
SHA1

89b101eba445762c4afd9b99f25f18e8cec8b500
SHA256

4e0b36ae948ce462871b9c0833519dc2211484e6feb2e8401fa40a19656950f0
SHA512

ddc8814bdcd3b243c8dc2074318f62ca66bc46d7744e192fc1fd60788b182a9fcdb22429861659bb13238981e5b36944173915c055155882b606f0a8d2df034f
SSDEEP

24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbpwlKenszbWKDNEm/5QbRgE3:GezaTF8FcNkNdfE0pZ9ozttwIRx2n

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 32 IoCs

miner

resource	yara_rule
behavioral2/files/0x000c000000023b31-3.dat	xmrig
behavioral2/files/0x000a000000023b8d-7.dat	xmrig
behavioral2/files/0x000b000000023b88-24.dat	xmrig
behavioral2/files/0x000a000000023b8f-28.dat	xmrig
behavioral2/files/0x000a000000023b91-35.dat	xmrig
behavioral2/files/0x000a000000023b93-43.dat	xmrig
behavioral2/files/0x000a000000023b92-48.dat	xmrig
behavioral2/files/0x000a000000023b98-67.dat	xmrig
behavioral2/files/0x000a000000023b97-82.dat	xmrig
behavioral2/files/0x000a000000023b9f-102.dat	xmrig
behavioral2/files/0x000a000000023ba5-135.dat	xmrig
behavioral2/files/0x000a000000023ba4-133.dat	xmrig
behavioral2/files/0x000a000000023ba3-131.dat	xmrig
behavioral2/files/0x000a000000023b9e-127.dat	xmrig
behavioral2/files/0x000a000000023b9c-125.dat	xmrig
behavioral2/files/0x000a000000023ba2-123.dat	xmrig
behavioral2/files/0x000a000000023ba1-121.dat	xmrig
behavioral2/files/0x000a000000023ba0-119.dat	xmrig
behavioral2/files/0x000a000000023b9d-116.dat	xmrig
behavioral2/files/0x000a000000023b9b-112.dat	xmrig
behavioral2/files/0x000a000000023b9a-107.dat	xmrig
behavioral2/files/0x000a000000023b99-97.dat	xmrig
behavioral2/files/0x000a000000023b95-76.dat	xmrig
behavioral2/files/0x000a000000023ba6-139.dat	xmrig
behavioral2/files/0x000a000000023ba8-143.dat	xmrig
behavioral2/files/0x000b000000023b89-151.dat	xmrig
behavioral2/files/0x000a000000023ba9-158.dat	xmrig
behavioral2/files/0x000a000000023baa-160.dat	xmrig
behavioral2/files/0x000a000000023b96-63.dat	xmrig
behavioral2/files/0x000a000000023b94-50.dat	xmrig
behavioral2/files/0x000a000000023b90-32.dat	xmrig
behavioral2/files/0x000a000000023b8e-26.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
608	hPqrLTH.exe
1836	kJVVGQV.exe
4860	BBdNZLH.exe
2244	CEdfLTc.exe
1556	sQykzXY.exe
3816	EjAKMFG.exe
4396	MaybNdO.exe
3640	ZapWTGo.exe
1076	FmGZpNr.exe
2144	mqpWrZt.exe
680	fEXDUmc.exe
3060	TYRLAUo.exe
3396	mVCCQbX.exe
3496	rXEhrNb.exe
2056	qnTXbCM.exe
2428	BbWjFer.exe
4960	VOcsehV.exe
4964	ygZtJLI.exe
2340	yMfVtsg.exe
4012	gGSPqAc.exe
1460	tlvXDbR.exe
5024	GIqBeFh.exe
3884	coovslj.exe
3820	ZrwswCe.exe
3900	CZiEhwe.exe
2188	dPtqzQL.exe
2272	OffOkuv.exe
2516	waIPNYm.exe
3832	BPJDOlV.exe
4800	PBLRdjV.exe
2580	QzFuPlE.exe
4920	ibrkGkI.exe
2696	bfceCZg.exe
4064	HbRDdiw.exe
2308	AqCzQtw.exe
4180	wsJtGJD.exe
2760	AQCMxwf.exe
1436	ePeGBuT.exe
4844	rsOkXfF.exe
1588	DJpPjbP.exe
2100	lRNlxHi.exe
4704	QgvUHfY.exe
4436	fhwonCL.exe
3516	TsRJptI.exe
3312	GDmkKIB.exe
4968	wmVcTSf.exe
4500	SlkVBZK.exe
4872	ifpSUzk.exe
4548	qgqyTMQ.exe
1048	dyjjooy.exe
1228	YkesTik.exe
1112	qUsphAC.exe
5020	HucpqRP.exe
1008	RzuFRGP.exe
4692	PYQIOQl.exe
2980	LiQUTLP.exe
3440	SLAGUSo.exe
4916	jrMrfFE.exe
4924	PtIDPGg.exe
652	KmOdmqp.exe
1860	NQCKMpl.exe
3084	hVUxnBh.exe
3908	LlOGWSi.exe
2368	DkClgvv.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\vxGMHfo.exe	4e0b36ae948ce462871b9c0833519dc2211484e6feb2e8401fa40a19656950f0.exe
File created	C:\Windows\System\UTxczoE.exe	4e0b36ae948ce462871b9c0833519dc2211484e6feb2e8401fa40a19656950f0.exe
File created	C:\Windows\System\SCQFclB.exe	4e0b36ae948ce462871b9c0833519dc2211484e6feb2e8401fa40a19656950f0.exe
File created	C:\Windows\System\hUZgHIL.exe	4e0b36ae948ce462871b9c0833519dc2211484e6feb2e8401fa40a19656950f0.exe
File created	C:\Windows\System\ranIwYV.exe	4e0b36ae948ce462871b9c0833519dc2211484e6feb2e8401fa40a19656950f0.exe
File created	C:\Windows\System\PMPTFKU.exe	4e0b36ae948ce462871b9c0833519dc2211484e6feb2e8401fa40a19656950f0.exe
File created	C:\Windows\System\cxDImRH.exe	4e0b36ae948ce462871b9c0833519dc2211484e6feb2e8401fa40a19656950f0.exe
File created	C:\Windows\System\SDkRSGy.exe	4e0b36ae948ce462871b9c0833519dc2211484e6feb2e8401fa40a19656950f0.exe
File created	C:\Windows\System\BBdNZLH.exe	4e0b36ae948ce462871b9c0833519dc2211484e6feb2e8401fa40a19656950f0.exe
File created	C:\Windows\System\ePeGBuT.exe	4e0b36ae948ce462871b9c0833519dc2211484e6feb2e8401fa40a19656950f0.exe
File created	C:\Windows\System\RpDabHi.exe	4e0b36ae948ce462871b9c0833519dc2211484e6feb2e8401fa40a19656950f0.exe
File created	C:\Windows\System\cAQRDMj.exe	4e0b36ae948ce462871b9c0833519dc2211484e6feb2e8401fa40a19656950f0.exe
File created	C:\Windows\System\KsDEZSm.exe	4e0b36ae948ce462871b9c0833519dc2211484e6feb2e8401fa40a19656950f0.exe
File created	C:\Windows\System\nbtgBPw.exe	4e0b36ae948ce462871b9c0833519dc2211484e6feb2e8401fa40a19656950f0.exe
File created	C:\Windows\System\IPxvREt.exe	4e0b36ae948ce462871b9c0833519dc2211484e6feb2e8401fa40a19656950f0.exe
File created	C:\Windows\System\eOuMIjs.exe	4e0b36ae948ce462871b9c0833519dc2211484e6feb2e8401fa40a19656950f0.exe
File created	C:\Windows\System\YQwbnVX.exe	4e0b36ae948ce462871b9c0833519dc2211484e6feb2e8401fa40a19656950f0.exe
File created	C:\Windows\System\mBsFEOL.exe	4e0b36ae948ce462871b9c0833519dc2211484e6feb2e8401fa40a19656950f0.exe
File created	C:\Windows\System\PsGjdwi.exe	4e0b36ae948ce462871b9c0833519dc2211484e6feb2e8401fa40a19656950f0.exe
File created	C:\Windows\System\UIcBRYr.exe	4e0b36ae948ce462871b9c0833519dc2211484e6feb2e8401fa40a19656950f0.exe
File created	C:\Windows\System\XYtPKIf.exe	4e0b36ae948ce462871b9c0833519dc2211484e6feb2e8401fa40a19656950f0.exe
File created	C:\Windows\System\LMDRglM.exe	4e0b36ae948ce462871b9c0833519dc2211484e6feb2e8401fa40a19656950f0.exe
File created	C:\Windows\System\wsJtGJD.exe	4e0b36ae948ce462871b9c0833519dc2211484e6feb2e8401fa40a19656950f0.exe
File created	C:\Windows\System\IRqkhSi.exe	4e0b36ae948ce462871b9c0833519dc2211484e6feb2e8401fa40a19656950f0.exe
File created	C:\Windows\System\HVNliNs.exe	4e0b36ae948ce462871b9c0833519dc2211484e6feb2e8401fa40a19656950f0.exe
File created	C:\Windows\System\imfYzgT.exe	4e0b36ae948ce462871b9c0833519dc2211484e6feb2e8401fa40a19656950f0.exe
File created	C:\Windows\System\DlfUaSD.exe	4e0b36ae948ce462871b9c0833519dc2211484e6feb2e8401fa40a19656950f0.exe
File created	C:\Windows\System\omeQDfw.exe	4e0b36ae948ce462871b9c0833519dc2211484e6feb2e8401fa40a19656950f0.exe
File created	C:\Windows\System\cRrnxAb.exe	4e0b36ae948ce462871b9c0833519dc2211484e6feb2e8401fa40a19656950f0.exe
File created	C:\Windows\System\cdHZNXZ.exe	4e0b36ae948ce462871b9c0833519dc2211484e6feb2e8401fa40a19656950f0.exe
File created	C:\Windows\System\TYGvEHy.exe	4e0b36ae948ce462871b9c0833519dc2211484e6feb2e8401fa40a19656950f0.exe
File created	C:\Windows\System\VqxUVWI.exe	4e0b36ae948ce462871b9c0833519dc2211484e6feb2e8401fa40a19656950f0.exe
File created	C:\Windows\System\uKWgDny.exe	4e0b36ae948ce462871b9c0833519dc2211484e6feb2e8401fa40a19656950f0.exe
File created	C:\Windows\System\qOOkyQa.exe	4e0b36ae948ce462871b9c0833519dc2211484e6feb2e8401fa40a19656950f0.exe
File created	C:\Windows\System\KNrsYCG.exe	4e0b36ae948ce462871b9c0833519dc2211484e6feb2e8401fa40a19656950f0.exe
File created	C:\Windows\System\DfVyMpd.exe	4e0b36ae948ce462871b9c0833519dc2211484e6feb2e8401fa40a19656950f0.exe
File created	C:\Windows\System\MQMKRLO.exe	4e0b36ae948ce462871b9c0833519dc2211484e6feb2e8401fa40a19656950f0.exe
File created	C:\Windows\System\VnmpUxj.exe	4e0b36ae948ce462871b9c0833519dc2211484e6feb2e8401fa40a19656950f0.exe
File created	C:\Windows\System\GLnLcWS.exe	4e0b36ae948ce462871b9c0833519dc2211484e6feb2e8401fa40a19656950f0.exe
File created	C:\Windows\System\tfLeemb.exe	4e0b36ae948ce462871b9c0833519dc2211484e6feb2e8401fa40a19656950f0.exe
File created	C:\Windows\System\GBjRNsp.exe	4e0b36ae948ce462871b9c0833519dc2211484e6feb2e8401fa40a19656950f0.exe
File created	C:\Windows\System\uEwlhQB.exe	4e0b36ae948ce462871b9c0833519dc2211484e6feb2e8401fa40a19656950f0.exe
File created	C:\Windows\System\stWERrU.exe	4e0b36ae948ce462871b9c0833519dc2211484e6feb2e8401fa40a19656950f0.exe
File created	C:\Windows\System\fjCLwDj.exe	4e0b36ae948ce462871b9c0833519dc2211484e6feb2e8401fa40a19656950f0.exe
File created	C:\Windows\System\cSoLFEM.exe	4e0b36ae948ce462871b9c0833519dc2211484e6feb2e8401fa40a19656950f0.exe
File created	C:\Windows\System\fFuaGGF.exe	4e0b36ae948ce462871b9c0833519dc2211484e6feb2e8401fa40a19656950f0.exe
File created	C:\Windows\System\KOsdJOS.exe	4e0b36ae948ce462871b9c0833519dc2211484e6feb2e8401fa40a19656950f0.exe
File created	C:\Windows\System\dthWoGy.exe	4e0b36ae948ce462871b9c0833519dc2211484e6feb2e8401fa40a19656950f0.exe
File created	C:\Windows\System\zYQiXzX.exe	4e0b36ae948ce462871b9c0833519dc2211484e6feb2e8401fa40a19656950f0.exe
File created	C:\Windows\System\hULtjPp.exe	4e0b36ae948ce462871b9c0833519dc2211484e6feb2e8401fa40a19656950f0.exe
File created	C:\Windows\System\OiZHqQq.exe	4e0b36ae948ce462871b9c0833519dc2211484e6feb2e8401fa40a19656950f0.exe
File created	C:\Windows\System\ZczGgBj.exe	4e0b36ae948ce462871b9c0833519dc2211484e6feb2e8401fa40a19656950f0.exe
File created	C:\Windows\System\VUCAUoC.exe	4e0b36ae948ce462871b9c0833519dc2211484e6feb2e8401fa40a19656950f0.exe
File created	C:\Windows\System\XWoxovK.exe	4e0b36ae948ce462871b9c0833519dc2211484e6feb2e8401fa40a19656950f0.exe
File created	C:\Windows\System\wSuJdnG.exe	4e0b36ae948ce462871b9c0833519dc2211484e6feb2e8401fa40a19656950f0.exe
File created	C:\Windows\System\wpOufsX.exe	4e0b36ae948ce462871b9c0833519dc2211484e6feb2e8401fa40a19656950f0.exe
File created	C:\Windows\System\fUxFFvB.exe	4e0b36ae948ce462871b9c0833519dc2211484e6feb2e8401fa40a19656950f0.exe
File created	C:\Windows\System\jxoTKMx.exe	4e0b36ae948ce462871b9c0833519dc2211484e6feb2e8401fa40a19656950f0.exe
File created	C:\Windows\System\VCiwnnq.exe	4e0b36ae948ce462871b9c0833519dc2211484e6feb2e8401fa40a19656950f0.exe
File created	C:\Windows\System\rNTDWCp.exe	4e0b36ae948ce462871b9c0833519dc2211484e6feb2e8401fa40a19656950f0.exe
File created	C:\Windows\System\dVMZFuk.exe	4e0b36ae948ce462871b9c0833519dc2211484e6feb2e8401fa40a19656950f0.exe
File created	C:\Windows\System\LopRerY.exe	4e0b36ae948ce462871b9c0833519dc2211484e6feb2e8401fa40a19656950f0.exe
File created	C:\Windows\System\rTYfVpY.exe	4e0b36ae948ce462871b9c0833519dc2211484e6feb2e8401fa40a19656950f0.exe
File created	C:\Windows\System\qkMJeYL.exe	4e0b36ae948ce462871b9c0833519dc2211484e6feb2e8401fa40a19656950f0.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	15848	dwm.exe
Token: SeChangeNotifyPrivilege	15848	dwm.exe
Token: 33	15848	dwm.exe
Token: SeIncBasePriorityPrivilege	15848	dwm.exe
Token: SeShutdownPrivilege	15848	dwm.exe
Token: SeCreatePagefilePrivilege	15848	dwm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2436 wrote to memory of 608	2436	4e0b36ae948ce462871b9c0833519dc2211484e6feb2e8401fa40a19656950f0.exe	84
PID 2436 wrote to memory of 608	2436	4e0b36ae948ce462871b9c0833519dc2211484e6feb2e8401fa40a19656950f0.exe	84
PID 2436 wrote to memory of 1836	2436	4e0b36ae948ce462871b9c0833519dc2211484e6feb2e8401fa40a19656950f0.exe	85
PID 2436 wrote to memory of 1836	2436	4e0b36ae948ce462871b9c0833519dc2211484e6feb2e8401fa40a19656950f0.exe	85
PID 2436 wrote to memory of 4860	2436	4e0b36ae948ce462871b9c0833519dc2211484e6feb2e8401fa40a19656950f0.exe	86
PID 2436 wrote to memory of 4860	2436	4e0b36ae948ce462871b9c0833519dc2211484e6feb2e8401fa40a19656950f0.exe	86
PID 2436 wrote to memory of 2244	2436	4e0b36ae948ce462871b9c0833519dc2211484e6feb2e8401fa40a19656950f0.exe	87
PID 2436 wrote to memory of 2244	2436	4e0b36ae948ce462871b9c0833519dc2211484e6feb2e8401fa40a19656950f0.exe	87
PID 2436 wrote to memory of 1556	2436	4e0b36ae948ce462871b9c0833519dc2211484e6feb2e8401fa40a19656950f0.exe	88
PID 2436 wrote to memory of 1556	2436	4e0b36ae948ce462871b9c0833519dc2211484e6feb2e8401fa40a19656950f0.exe	88
PID 2436 wrote to memory of 3816	2436	4e0b36ae948ce462871b9c0833519dc2211484e6feb2e8401fa40a19656950f0.exe	89
PID 2436 wrote to memory of 3816	2436	4e0b36ae948ce462871b9c0833519dc2211484e6feb2e8401fa40a19656950f0.exe	89
PID 2436 wrote to memory of 4396	2436	4e0b36ae948ce462871b9c0833519dc2211484e6feb2e8401fa40a19656950f0.exe	90
PID 2436 wrote to memory of 4396	2436	4e0b36ae948ce462871b9c0833519dc2211484e6feb2e8401fa40a19656950f0.exe	90
PID 2436 wrote to memory of 3640	2436	4e0b36ae948ce462871b9c0833519dc2211484e6feb2e8401fa40a19656950f0.exe	91
PID 2436 wrote to memory of 3640	2436	4e0b36ae948ce462871b9c0833519dc2211484e6feb2e8401fa40a19656950f0.exe	91
PID 2436 wrote to memory of 1076	2436	4e0b36ae948ce462871b9c0833519dc2211484e6feb2e8401fa40a19656950f0.exe	92
PID 2436 wrote to memory of 1076	2436	4e0b36ae948ce462871b9c0833519dc2211484e6feb2e8401fa40a19656950f0.exe	92
PID 2436 wrote to memory of 2144	2436	4e0b36ae948ce462871b9c0833519dc2211484e6feb2e8401fa40a19656950f0.exe	93
PID 2436 wrote to memory of 2144	2436	4e0b36ae948ce462871b9c0833519dc2211484e6feb2e8401fa40a19656950f0.exe	93
PID 2436 wrote to memory of 680	2436	4e0b36ae948ce462871b9c0833519dc2211484e6feb2e8401fa40a19656950f0.exe	94
PID 2436 wrote to memory of 680	2436	4e0b36ae948ce462871b9c0833519dc2211484e6feb2e8401fa40a19656950f0.exe	94
PID 2436 wrote to memory of 3060	2436	4e0b36ae948ce462871b9c0833519dc2211484e6feb2e8401fa40a19656950f0.exe	95
PID 2436 wrote to memory of 3060	2436	4e0b36ae948ce462871b9c0833519dc2211484e6feb2e8401fa40a19656950f0.exe	95
PID 2436 wrote to memory of 3396	2436	4e0b36ae948ce462871b9c0833519dc2211484e6feb2e8401fa40a19656950f0.exe	96
PID 2436 wrote to memory of 3396	2436	4e0b36ae948ce462871b9c0833519dc2211484e6feb2e8401fa40a19656950f0.exe	96
PID 2436 wrote to memory of 3496	2436	4e0b36ae948ce462871b9c0833519dc2211484e6feb2e8401fa40a19656950f0.exe	97
PID 2436 wrote to memory of 3496	2436	4e0b36ae948ce462871b9c0833519dc2211484e6feb2e8401fa40a19656950f0.exe	97
PID 2436 wrote to memory of 2056	2436	4e0b36ae948ce462871b9c0833519dc2211484e6feb2e8401fa40a19656950f0.exe	98
PID 2436 wrote to memory of 2056	2436	4e0b36ae948ce462871b9c0833519dc2211484e6feb2e8401fa40a19656950f0.exe	98
PID 2436 wrote to memory of 2428	2436	4e0b36ae948ce462871b9c0833519dc2211484e6feb2e8401fa40a19656950f0.exe	99
PID 2436 wrote to memory of 2428	2436	4e0b36ae948ce462871b9c0833519dc2211484e6feb2e8401fa40a19656950f0.exe	99
PID 2436 wrote to memory of 4960	2436	4e0b36ae948ce462871b9c0833519dc2211484e6feb2e8401fa40a19656950f0.exe	100
PID 2436 wrote to memory of 4960	2436	4e0b36ae948ce462871b9c0833519dc2211484e6feb2e8401fa40a19656950f0.exe	100
PID 2436 wrote to memory of 4964	2436	4e0b36ae948ce462871b9c0833519dc2211484e6feb2e8401fa40a19656950f0.exe	101
PID 2436 wrote to memory of 4964	2436	4e0b36ae948ce462871b9c0833519dc2211484e6feb2e8401fa40a19656950f0.exe	101
PID 2436 wrote to memory of 2340	2436	4e0b36ae948ce462871b9c0833519dc2211484e6feb2e8401fa40a19656950f0.exe	102
PID 2436 wrote to memory of 2340	2436	4e0b36ae948ce462871b9c0833519dc2211484e6feb2e8401fa40a19656950f0.exe	102
PID 2436 wrote to memory of 4012	2436	4e0b36ae948ce462871b9c0833519dc2211484e6feb2e8401fa40a19656950f0.exe	103
PID 2436 wrote to memory of 4012	2436	4e0b36ae948ce462871b9c0833519dc2211484e6feb2e8401fa40a19656950f0.exe	103
PID 2436 wrote to memory of 1460	2436	4e0b36ae948ce462871b9c0833519dc2211484e6feb2e8401fa40a19656950f0.exe	104
PID 2436 wrote to memory of 1460	2436	4e0b36ae948ce462871b9c0833519dc2211484e6feb2e8401fa40a19656950f0.exe	104
PID 2436 wrote to memory of 5024	2436	4e0b36ae948ce462871b9c0833519dc2211484e6feb2e8401fa40a19656950f0.exe	105
PID 2436 wrote to memory of 5024	2436	4e0b36ae948ce462871b9c0833519dc2211484e6feb2e8401fa40a19656950f0.exe	105
PID 2436 wrote to memory of 3884	2436	4e0b36ae948ce462871b9c0833519dc2211484e6feb2e8401fa40a19656950f0.exe	106
PID 2436 wrote to memory of 3884	2436	4e0b36ae948ce462871b9c0833519dc2211484e6feb2e8401fa40a19656950f0.exe	106
PID 2436 wrote to memory of 3820	2436	4e0b36ae948ce462871b9c0833519dc2211484e6feb2e8401fa40a19656950f0.exe	107
PID 2436 wrote to memory of 3820	2436	4e0b36ae948ce462871b9c0833519dc2211484e6feb2e8401fa40a19656950f0.exe	107
PID 2436 wrote to memory of 3900	2436	4e0b36ae948ce462871b9c0833519dc2211484e6feb2e8401fa40a19656950f0.exe	108
PID 2436 wrote to memory of 3900	2436	4e0b36ae948ce462871b9c0833519dc2211484e6feb2e8401fa40a19656950f0.exe	108
PID 2436 wrote to memory of 2188	2436	4e0b36ae948ce462871b9c0833519dc2211484e6feb2e8401fa40a19656950f0.exe	109
PID 2436 wrote to memory of 2188	2436	4e0b36ae948ce462871b9c0833519dc2211484e6feb2e8401fa40a19656950f0.exe	109
PID 2436 wrote to memory of 2272	2436	4e0b36ae948ce462871b9c0833519dc2211484e6feb2e8401fa40a19656950f0.exe	110
PID 2436 wrote to memory of 2272	2436	4e0b36ae948ce462871b9c0833519dc2211484e6feb2e8401fa40a19656950f0.exe	110
PID 2436 wrote to memory of 2516	2436	4e0b36ae948ce462871b9c0833519dc2211484e6feb2e8401fa40a19656950f0.exe	111
PID 2436 wrote to memory of 2516	2436	4e0b36ae948ce462871b9c0833519dc2211484e6feb2e8401fa40a19656950f0.exe	111
PID 2436 wrote to memory of 3832	2436	4e0b36ae948ce462871b9c0833519dc2211484e6feb2e8401fa40a19656950f0.exe	112
PID 2436 wrote to memory of 3832	2436	4e0b36ae948ce462871b9c0833519dc2211484e6feb2e8401fa40a19656950f0.exe	112
PID 2436 wrote to memory of 4800	2436	4e0b36ae948ce462871b9c0833519dc2211484e6feb2e8401fa40a19656950f0.exe	113
PID 2436 wrote to memory of 4800	2436	4e0b36ae948ce462871b9c0833519dc2211484e6feb2e8401fa40a19656950f0.exe	113
PID 2436 wrote to memory of 2580	2436	4e0b36ae948ce462871b9c0833519dc2211484e6feb2e8401fa40a19656950f0.exe	114
PID 2436 wrote to memory of 2580	2436	4e0b36ae948ce462871b9c0833519dc2211484e6feb2e8401fa40a19656950f0.exe	114
PID 2436 wrote to memory of 4920	2436	4e0b36ae948ce462871b9c0833519dc2211484e6feb2e8401fa40a19656950f0.exe	115
PID 2436 wrote to memory of 4920	2436	4e0b36ae948ce462871b9c0833519dc2211484e6feb2e8401fa40a19656950f0.exe	115

C:\Users\Admin\AppData\Local\Temp\4e0b36ae948ce462871b9c0833519dc2211484e6feb2e8401fa40a19656950f0.exe
"C:\Users\Admin\AppData\Local\Temp\4e0b36ae948ce462871b9c0833519dc2211484e6feb2e8401fa40a19656950f0.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2436
- C:\Windows\System\hPqrLTH.exe
  C:\Windows\System\hPqrLTH.exe
  2⤵
  - Executes dropped EXE
  PID:608
- C:\Windows\System\kJVVGQV.exe
  C:\Windows\System\kJVVGQV.exe
  2⤵
  - Executes dropped EXE
  PID:1836
- C:\Windows\System\BBdNZLH.exe
  C:\Windows\System\BBdNZLH.exe
  2⤵
  - Executes dropped EXE
  PID:4860
- C:\Windows\System\CEdfLTc.exe
  C:\Windows\System\CEdfLTc.exe
  2⤵
  - Executes dropped EXE
  PID:2244
- C:\Windows\System\sQykzXY.exe
  C:\Windows\System\sQykzXY.exe
  2⤵
  - Executes dropped EXE
  PID:1556
- C:\Windows\System\EjAKMFG.exe
  C:\Windows\System\EjAKMFG.exe
  2⤵
  - Executes dropped EXE
  PID:3816
- C:\Windows\System\MaybNdO.exe
  C:\Windows\System\MaybNdO.exe
  2⤵
  - Executes dropped EXE
  PID:4396
- C:\Windows\System\ZapWTGo.exe
  C:\Windows\System\ZapWTGo.exe
  2⤵
  - Executes dropped EXE
  PID:3640
- C:\Windows\System\FmGZpNr.exe
  C:\Windows\System\FmGZpNr.exe
  2⤵
  - Executes dropped EXE
  PID:1076
- C:\Windows\System\mqpWrZt.exe
  C:\Windows\System\mqpWrZt.exe
  2⤵
  - Executes dropped EXE
  PID:2144
- C:\Windows\System\fEXDUmc.exe
  C:\Windows\System\fEXDUmc.exe
  2⤵
  - Executes dropped EXE
  PID:680
- C:\Windows\System\TYRLAUo.exe
  C:\Windows\System\TYRLAUo.exe
  2⤵
  - Executes dropped EXE
  PID:3060
- C:\Windows\System\mVCCQbX.exe
  C:\Windows\System\mVCCQbX.exe
  2⤵
  - Executes dropped EXE
  PID:3396
- C:\Windows\System\rXEhrNb.exe
  C:\Windows\System\rXEhrNb.exe
  2⤵
  - Executes dropped EXE
  PID:3496
- C:\Windows\System\qnTXbCM.exe
  C:\Windows\System\qnTXbCM.exe
  2⤵
  - Executes dropped EXE
  PID:2056
- C:\Windows\System\BbWjFer.exe
  C:\Windows\System\BbWjFer.exe
  2⤵
  - Executes dropped EXE
  PID:2428
- C:\Windows\System\VOcsehV.exe
  C:\Windows\System\VOcsehV.exe
  2⤵
  - Executes dropped EXE
  PID:4960
- C:\Windows\System\ygZtJLI.exe
  C:\Windows\System\ygZtJLI.exe
  2⤵
  - Executes dropped EXE
  PID:4964
- C:\Windows\System\yMfVtsg.exe
  C:\Windows\System\yMfVtsg.exe
  2⤵
  - Executes dropped EXE
  PID:2340
- C:\Windows\System\gGSPqAc.exe
  C:\Windows\System\gGSPqAc.exe
  2⤵
  - Executes dropped EXE
  PID:4012
- C:\Windows\System\tlvXDbR.exe
  C:\Windows\System\tlvXDbR.exe
  2⤵
  - Executes dropped EXE
  PID:1460
- C:\Windows\System\GIqBeFh.exe
  C:\Windows\System\GIqBeFh.exe
  2⤵
  - Executes dropped EXE
  PID:5024
- C:\Windows\System\coovslj.exe
  C:\Windows\System\coovslj.exe
  2⤵
  - Executes dropped EXE
  PID:3884
- C:\Windows\System\ZrwswCe.exe
  C:\Windows\System\ZrwswCe.exe
  2⤵
  - Executes dropped EXE
  PID:3820
- C:\Windows\System\CZiEhwe.exe
  C:\Windows\System\CZiEhwe.exe
  2⤵
  - Executes dropped EXE
  PID:3900
- C:\Windows\System\dPtqzQL.exe
  C:\Windows\System\dPtqzQL.exe
  2⤵
  - Executes dropped EXE
  PID:2188
- C:\Windows\System\OffOkuv.exe
  C:\Windows\System\OffOkuv.exe
  2⤵
  - Executes dropped EXE
  PID:2272
- C:\Windows\System\waIPNYm.exe
  C:\Windows\System\waIPNYm.exe
  2⤵
  - Executes dropped EXE
  PID:2516
- C:\Windows\System\BPJDOlV.exe
  C:\Windows\System\BPJDOlV.exe
  2⤵
  - Executes dropped EXE
  PID:3832
- C:\Windows\System\PBLRdjV.exe
  C:\Windows\System\PBLRdjV.exe
  2⤵
  - Executes dropped EXE
  PID:4800
- C:\Windows\System\QzFuPlE.exe
  C:\Windows\System\QzFuPlE.exe
  2⤵
  - Executes dropped EXE
  PID:2580
- C:\Windows\System\ibrkGkI.exe
  C:\Windows\System\ibrkGkI.exe
  2⤵
  - Executes dropped EXE
  PID:4920
- C:\Windows\System\bfceCZg.exe
  C:\Windows\System\bfceCZg.exe
  2⤵
  - Executes dropped EXE
  PID:2696
- C:\Windows\System\AqCzQtw.exe
  C:\Windows\System\AqCzQtw.exe
  2⤵
  - Executes dropped EXE
  PID:2308
- C:\Windows\System\HbRDdiw.exe
  C:\Windows\System\HbRDdiw.exe
  2⤵
  - Executes dropped EXE
  PID:4064
- C:\Windows\System\wsJtGJD.exe
  C:\Windows\System\wsJtGJD.exe
  2⤵
  - Executes dropped EXE
  PID:4180
- C:\Windows\System\AQCMxwf.exe
  C:\Windows\System\AQCMxwf.exe
  2⤵
  - Executes dropped EXE
  PID:2760
- C:\Windows\System\ePeGBuT.exe
  C:\Windows\System\ePeGBuT.exe
  2⤵
  - Executes dropped EXE
  PID:1436
- C:\Windows\System\rsOkXfF.exe
  C:\Windows\System\rsOkXfF.exe
  2⤵
  - Executes dropped EXE
  PID:4844
- C:\Windows\System\DJpPjbP.exe
  C:\Windows\System\DJpPjbP.exe
  2⤵
  - Executes dropped EXE
  PID:1588
- C:\Windows\System\lRNlxHi.exe
  C:\Windows\System\lRNlxHi.exe
  2⤵
  - Executes dropped EXE
  PID:2100
- C:\Windows\System\QgvUHfY.exe
  C:\Windows\System\QgvUHfY.exe
  2⤵
  - Executes dropped EXE
  PID:4704
- C:\Windows\System\fhwonCL.exe
  C:\Windows\System\fhwonCL.exe
  2⤵
  - Executes dropped EXE
  PID:4436
- C:\Windows\System\TsRJptI.exe
  C:\Windows\System\TsRJptI.exe
  2⤵
  - Executes dropped EXE
  PID:3516
- C:\Windows\System\ifpSUzk.exe
  C:\Windows\System\ifpSUzk.exe
  2⤵
  - Executes dropped EXE
  PID:4872
- C:\Windows\System\GDmkKIB.exe
  C:\Windows\System\GDmkKIB.exe
  2⤵
  - Executes dropped EXE
  PID:3312
- C:\Windows\System\wmVcTSf.exe
  C:\Windows\System\wmVcTSf.exe
  2⤵
  - Executes dropped EXE
  PID:4968
- C:\Windows\System\SlkVBZK.exe
  C:\Windows\System\SlkVBZK.exe
  2⤵
  - Executes dropped EXE
  PID:4500
- C:\Windows\System\qgqyTMQ.exe
  C:\Windows\System\qgqyTMQ.exe
  2⤵
  - Executes dropped EXE
  PID:4548
- C:\Windows\System\dyjjooy.exe
  C:\Windows\System\dyjjooy.exe
  2⤵
  - Executes dropped EXE
  PID:1048
- C:\Windows\System\YkesTik.exe
  C:\Windows\System\YkesTik.exe
  2⤵
  - Executes dropped EXE
  PID:1228
- C:\Windows\System\qUsphAC.exe
  C:\Windows\System\qUsphAC.exe
  2⤵
  - Executes dropped EXE
  PID:1112
- C:\Windows\System\HucpqRP.exe
  C:\Windows\System\HucpqRP.exe
  2⤵
  - Executes dropped EXE
  PID:5020
- C:\Windows\System\LiQUTLP.exe
  C:\Windows\System\LiQUTLP.exe
  2⤵
  - Executes dropped EXE
  PID:2980
- C:\Windows\System\SLAGUSo.exe
  C:\Windows\System\SLAGUSo.exe
  2⤵
  - Executes dropped EXE
  PID:3440
- C:\Windows\System\RzuFRGP.exe
  C:\Windows\System\RzuFRGP.exe
  2⤵
  - Executes dropped EXE
  PID:1008
- C:\Windows\System\PYQIOQl.exe
  C:\Windows\System\PYQIOQl.exe
  2⤵
  - Executes dropped EXE
  PID:4692
- C:\Windows\System\jrMrfFE.exe
  C:\Windows\System\jrMrfFE.exe
  2⤵
  - Executes dropped EXE
  PID:4916
- C:\Windows\System\PtIDPGg.exe
  C:\Windows\System\PtIDPGg.exe
  2⤵
  - Executes dropped EXE
  PID:4924
- C:\Windows\System\KNrsYCG.exe
  C:\Windows\System\KNrsYCG.exe
  2⤵
  PID:2688
- C:\Windows\System\sKSSbYI.exe
  C:\Windows\System\sKSSbYI.exe
  2⤵
  PID:2296
- C:\Windows\System\KmOdmqp.exe
  C:\Windows\System\KmOdmqp.exe
  2⤵
  - Executes dropped EXE
  PID:652
- C:\Windows\System\dVMZFuk.exe
  C:\Windows\System\dVMZFuk.exe
  2⤵
  PID:1212
- C:\Windows\System\NQCKMpl.exe
  C:\Windows\System\NQCKMpl.exe
  2⤵
  - Executes dropped EXE
  PID:1860
- C:\Windows\System\hVUxnBh.exe
  C:\Windows\System\hVUxnBh.exe
  2⤵
  - Executes dropped EXE
  PID:3084
- C:\Windows\System\LlOGWSi.exe
  C:\Windows\System\LlOGWSi.exe
  2⤵
  - Executes dropped EXE
  PID:3908
- C:\Windows\System\DkClgvv.exe
  C:\Windows\System\DkClgvv.exe
  2⤵
  - Executes dropped EXE
  PID:2368
- C:\Windows\System\lJbJAhz.exe
  C:\Windows\System\lJbJAhz.exe
  2⤵
  PID:4536
- C:\Windows\System\tppoyjc.exe
  C:\Windows\System\tppoyjc.exe
  2⤵
  PID:432
- C:\Windows\System\EItVthM.exe
  C:\Windows\System\EItVthM.exe
  2⤵
  PID:1244
- C:\Windows\System\UrJBBmg.exe
  C:\Windows\System\UrJBBmg.exe
  2⤵
  PID:2160
- C:\Windows\System\ZBADZZi.exe
  C:\Windows\System\ZBADZZi.exe
  2⤵
  PID:2164
- C:\Windows\System\ZczGgBj.exe
  C:\Windows\System\ZczGgBj.exe
  2⤵
  PID:2016
- C:\Windows\System\cRrnxAb.exe
  C:\Windows\System\cRrnxAb.exe
  2⤵
  PID:1736
- C:\Windows\System\wQAQBBs.exe
  C:\Windows\System\wQAQBBs.exe
  2⤵
  PID:4248
- C:\Windows\System\JKhKzrz.exe
  C:\Windows\System\JKhKzrz.exe
  2⤵
  PID:208
- C:\Windows\System\UkoutxU.exe
  C:\Windows\System\UkoutxU.exe
  2⤵
  PID:4484
- C:\Windows\System\OraunXc.exe
  C:\Windows\System\OraunXc.exe
  2⤵
  PID:1276
- C:\Windows\System\QOrKrLA.exe
  C:\Windows\System\QOrKrLA.exe
  2⤵
  PID:3824
- C:\Windows\System\RcHTjNk.exe
  C:\Windows\System\RcHTjNk.exe
  2⤵
  PID:2092
- C:\Windows\System\ZfkJJXt.exe
  C:\Windows\System\ZfkJJXt.exe
  2⤵
  PID:4636
- C:\Windows\System\jdIfiWI.exe
  C:\Windows\System\jdIfiWI.exe
  2⤵
  PID:1808
- C:\Windows\System\ZZbJQih.exe
  C:\Windows\System\ZZbJQih.exe
  2⤵
  PID:3260
- C:\Windows\System\lDFEcke.exe
  C:\Windows\System\lDFEcke.exe
  2⤵
  PID:428
- C:\Windows\System\YgOTXao.exe
  C:\Windows\System\YgOTXao.exe
  2⤵
  PID:4684
- C:\Windows\System\WceVLuw.exe
  C:\Windows\System\WceVLuw.exe
  2⤵
  PID:2636
- C:\Windows\System\RpDabHi.exe
  C:\Windows\System\RpDabHi.exe
  2⤵
  PID:232
- C:\Windows\System\zqwZHhf.exe
  C:\Windows\System\zqwZHhf.exe
  2⤵
  PID:2784
- C:\Windows\System\fcSSwZX.exe
  C:\Windows\System\fcSSwZX.exe
  2⤵
  PID:436
- C:\Windows\System\uLxkTEO.exe
  C:\Windows\System\uLxkTEO.exe
  2⤵
  PID:1856
- C:\Windows\System\fbStoqs.exe
  C:\Windows\System\fbStoqs.exe
  2⤵
  PID:4796
- C:\Windows\System\gcYPJIj.exe
  C:\Windows\System\gcYPJIj.exe
  2⤵
  PID:1996
- C:\Windows\System\aSEQjvA.exe
  C:\Windows\System\aSEQjvA.exe
  2⤵
  PID:4612
- C:\Windows\System\LhhIIKA.exe
  C:\Windows\System\LhhIIKA.exe
  2⤵
  PID:828
- C:\Windows\System\utoJOGM.exe
  C:\Windows\System\utoJOGM.exe
  2⤵
  PID:4820
- C:\Windows\System\wzErxTz.exe
  C:\Windows\System\wzErxTz.exe
  2⤵
  PID:2876
- C:\Windows\System\iNJbFUz.exe
  C:\Windows\System\iNJbFUz.exe
  2⤵
  PID:3984
- C:\Windows\System\rgnoYum.exe
  C:\Windows\System\rgnoYum.exe
  2⤵
  PID:3240
- C:\Windows\System\FIyvBoc.exe
  C:\Windows\System\FIyvBoc.exe
  2⤵
  PID:1564
- C:\Windows\System\FcbCDVr.exe
  C:\Windows\System\FcbCDVr.exe
  2⤵
  PID:1148
- C:\Windows\System\XvYGXIi.exe
  C:\Windows\System\XvYGXIi.exe
  2⤵
  PID:1420
- C:\Windows\System\lEZgXoB.exe
  C:\Windows\System\lEZgXoB.exe
  2⤵
  PID:4592
- C:\Windows\System\rDxbrLx.exe
  C:\Windows\System\rDxbrLx.exe
  2⤵
  PID:2776
- C:\Windows\System\iNwURRx.exe
  C:\Windows\System\iNwURRx.exe
  2⤵
  PID:4404
- C:\Windows\System\yizreLc.exe
  C:\Windows\System\yizreLc.exe
  2⤵
  PID:5068
- C:\Windows\System\nvfOciF.exe
  C:\Windows\System\nvfOciF.exe
  2⤵
  PID:4316
- C:\Windows\System\GZGTbFH.exe
  C:\Windows\System\GZGTbFH.exe
  2⤵
  PID:3508
- C:\Windows\System\OJXJiXt.exe
  C:\Windows\System\OJXJiXt.exe
  2⤵
  PID:1080
- C:\Windows\System\EIYqFeB.exe
  C:\Windows\System\EIYqFeB.exe
  2⤵
  PID:1608
- C:\Windows\System\eueibyQ.exe
  C:\Windows\System\eueibyQ.exe
  2⤵
  PID:4232
- C:\Windows\System\UOIVbJz.exe
  C:\Windows\System\UOIVbJz.exe
  2⤵
  PID:4392
- C:\Windows\System\fWfKOtB.exe
  C:\Windows\System\fWfKOtB.exe
  2⤵
  PID:5152
- C:\Windows\System\NWqmSjo.exe
  C:\Windows\System\NWqmSjo.exe
  2⤵
  PID:5184
- C:\Windows\System\aUulytf.exe
  C:\Windows\System\aUulytf.exe
  2⤵
  PID:5204
- C:\Windows\System\qvyPbzi.exe
  C:\Windows\System\qvyPbzi.exe
  2⤵
  PID:5232
- C:\Windows\System\NyqcXxY.exe
  C:\Windows\System\NyqcXxY.exe
  2⤵
  PID:5264
- C:\Windows\System\fFZnFYJ.exe
  C:\Windows\System\fFZnFYJ.exe
  2⤵
  PID:5288
- C:\Windows\System\yjzDTli.exe
  C:\Windows\System\yjzDTli.exe
  2⤵
  PID:5316
- C:\Windows\System\LKoSADx.exe
  C:\Windows\System\LKoSADx.exe
  2⤵
  PID:5340
- C:\Windows\System\nPeqhQJ.exe
  C:\Windows\System\nPeqhQJ.exe
  2⤵
  PID:5380
- C:\Windows\System\hlxOLks.exe
  C:\Windows\System\hlxOLks.exe
  2⤵
  PID:5400
- C:\Windows\System\nSVbGFa.exe
  C:\Windows\System\nSVbGFa.exe
  2⤵
  PID:5432
- C:\Windows\System\ZtZYpGs.exe
  C:\Windows\System\ZtZYpGs.exe
  2⤵
  PID:5464
- C:\Windows\System\SCQFclB.exe
  C:\Windows\System\SCQFclB.exe
  2⤵
  PID:5492
- C:\Windows\System\IPxvREt.exe
  C:\Windows\System\IPxvREt.exe
  2⤵
  PID:5520
- C:\Windows\System\DRlxzEy.exe
  C:\Windows\System\DRlxzEy.exe
  2⤵
  PID:5544
- C:\Windows\System\tHhfwpZ.exe
  C:\Windows\System\tHhfwpZ.exe
  2⤵
  PID:5572
- C:\Windows\System\IPtHBkP.exe
  C:\Windows\System\IPtHBkP.exe
  2⤵
  PID:5604
- C:\Windows\System\mgjUylQ.exe
  C:\Windows\System\mgjUylQ.exe
  2⤵
  PID:5628
- C:\Windows\System\NpELbhc.exe
  C:\Windows\System\NpELbhc.exe
  2⤵
  PID:5656
- C:\Windows\System\pfKdZsA.exe
  C:\Windows\System\pfKdZsA.exe
  2⤵
  PID:5680
- C:\Windows\System\NuUpwne.exe
  C:\Windows\System\NuUpwne.exe
  2⤵
  PID:5708
- C:\Windows\System\BopcvXG.exe
  C:\Windows\System\BopcvXG.exe
  2⤵
  PID:5736
- C:\Windows\System\VGAOaVe.exe
  C:\Windows\System\VGAOaVe.exe
  2⤵
  PID:5768
- C:\Windows\System\QYqEXmR.exe
  C:\Windows\System\QYqEXmR.exe
  2⤵
  PID:5796
- C:\Windows\System\MnXTURF.exe
  C:\Windows\System\MnXTURF.exe
  2⤵
  PID:5824
- C:\Windows\System\yPhsvAG.exe
  C:\Windows\System\yPhsvAG.exe
  2⤵
  PID:5856
- C:\Windows\System\pXgTswD.exe
  C:\Windows\System\pXgTswD.exe
  2⤵
  PID:5888
- C:\Windows\System\YHYdjQf.exe
  C:\Windows\System\YHYdjQf.exe
  2⤵
  PID:5912
- C:\Windows\System\ddpOOwK.exe
  C:\Windows\System\ddpOOwK.exe
  2⤵
  PID:5932
- C:\Windows\System\mOTGGbS.exe
  C:\Windows\System\mOTGGbS.exe
  2⤵
  PID:5960
- C:\Windows\System\CATlWYZ.exe
  C:\Windows\System\CATlWYZ.exe
  2⤵
  PID:5992
- C:\Windows\System\KZBSioz.exe
  C:\Windows\System\KZBSioz.exe
  2⤵
  PID:6012
- C:\Windows\System\JbcRyqC.exe
  C:\Windows\System\JbcRyqC.exe
  2⤵
  PID:6048
- C:\Windows\System\uVztXPp.exe
  C:\Windows\System\uVztXPp.exe
  2⤵
  PID:6076
- C:\Windows\System\ccaNAtW.exe
  C:\Windows\System\ccaNAtW.exe
  2⤵
  PID:6112
- C:\Windows\System\vmfUEBc.exe
  C:\Windows\System\vmfUEBc.exe
  2⤵
  PID:6136
- C:\Windows\System\TJiypTI.exe
  C:\Windows\System\TJiypTI.exe
  2⤵
  PID:4716
- C:\Windows\System\mpKTIex.exe
  C:\Windows\System\mpKTIex.exe
  2⤵
  PID:4880
- C:\Windows\System\MZnSWAv.exe
  C:\Windows\System\MZnSWAv.exe
  2⤵
  PID:4272
- C:\Windows\System\OWHHVrl.exe
  C:\Windows\System\OWHHVrl.exe
  2⤵
  PID:5160
- C:\Windows\System\lbQeEhq.exe
  C:\Windows\System\lbQeEhq.exe
  2⤵
  PID:5224
- C:\Windows\System\iDVpiZF.exe
  C:\Windows\System\iDVpiZF.exe
  2⤵
  PID:5396
- C:\Windows\System\faJapxP.exe
  C:\Windows\System\faJapxP.exe
  2⤵
  PID:5348
- C:\Windows\System\qfAMsCP.exe
  C:\Windows\System\qfAMsCP.exe
  2⤵
  PID:5312
- C:\Windows\System\hXDwTqs.exe
  C:\Windows\System\hXDwTqs.exe
  2⤵
  PID:5388
- C:\Windows\System\mIsMGlm.exe
  C:\Windows\System\mIsMGlm.exe
  2⤵
  PID:5644
- C:\Windows\System\tmecbvD.exe
  C:\Windows\System\tmecbvD.exe
  2⤵
  PID:5504
- C:\Windows\System\IsgucmN.exe
  C:\Windows\System\IsgucmN.exe
  2⤵
  PID:5612
- C:\Windows\System\tBZJYTg.exe
  C:\Windows\System\tBZJYTg.exe
  2⤵
  PID:5532
- C:\Windows\System\uFMwICa.exe
  C:\Windows\System\uFMwICa.exe
  2⤵
  PID:5876
- C:\Windows\System\RMVleLu.exe
  C:\Windows\System\RMVleLu.exe
  2⤵
  PID:6008
- C:\Windows\System\aATzqof.exe
  C:\Windows\System\aATzqof.exe
  2⤵
  PID:6072
- C:\Windows\System\EKWgGjq.exe
  C:\Windows\System\EKWgGjq.exe
  2⤵
  PID:5944
- C:\Windows\System\YiFcCtc.exe
  C:\Windows\System\YiFcCtc.exe
  2⤵
  PID:5920
- C:\Windows\System\JGzwPUv.exe
  C:\Windows\System\JGzwPUv.exe
  2⤵
  PID:5972
- C:\Windows\System\sakzPeQ.exe
  C:\Windows\System\sakzPeQ.exe
  2⤵
  PID:6032
- C:\Windows\System\dUswdjK.exe
  C:\Windows\System\dUswdjK.exe
  2⤵
  PID:5148
- C:\Windows\System\XEvhutF.exe
  C:\Windows\System\XEvhutF.exe
  2⤵
  PID:5300
- C:\Windows\System\KUPEqyh.exe
  C:\Windows\System\KUPEqyh.exe
  2⤵
  PID:6064
- C:\Windows\System\DfVyMpd.exe
  C:\Windows\System\DfVyMpd.exe
  2⤵
  PID:4448
- C:\Windows\System\ymXefHz.exe
  C:\Windows\System\ymXefHz.exe
  2⤵
  PID:6004
- C:\Windows\System\NTSSrnR.exe
  C:\Windows\System\NTSSrnR.exe
  2⤵
  PID:5196
- C:\Windows\System\mBsFEOL.exe
  C:\Windows\System\mBsFEOL.exe
  2⤵
  PID:6152
- C:\Windows\System\BNVFeju.exe
  C:\Windows\System\BNVFeju.exe
  2⤵
  PID:6180
- C:\Windows\System\AQGqAOb.exe
  C:\Windows\System\AQGqAOb.exe
  2⤵
  PID:6232
- C:\Windows\System\NMbhXkM.exe
  C:\Windows\System\NMbhXkM.exe
  2⤵
  PID:6256
- C:\Windows\System\GoUvMqK.exe
  C:\Windows\System\GoUvMqK.exe
  2⤵
  PID:6288
- C:\Windows\System\kJiGzRu.exe
  C:\Windows\System\kJiGzRu.exe
  2⤵
  PID:6316
- C:\Windows\System\ysShHqD.exe
  C:\Windows\System\ysShHqD.exe
  2⤵
  PID:6344
- C:\Windows\System\ranIwYV.exe
  C:\Windows\System\ranIwYV.exe
  2⤵
  PID:6376
- C:\Windows\System\Gkfvutp.exe
  C:\Windows\System\Gkfvutp.exe
  2⤵
  PID:6408
- C:\Windows\System\alNQoXj.exe
  C:\Windows\System\alNQoXj.exe
  2⤵
  PID:6428
- C:\Windows\System\YSCHGSS.exe
  C:\Windows\System\YSCHGSS.exe
  2⤵
  PID:6460
- C:\Windows\System\oPJjXXg.exe
  C:\Windows\System\oPJjXXg.exe
  2⤵
  PID:6480
- C:\Windows\System\BQzbvOF.exe
  C:\Windows\System\BQzbvOF.exe
  2⤵
  PID:6504
- C:\Windows\System\HYdVdXK.exe
  C:\Windows\System\HYdVdXK.exe
  2⤵
  PID:6528
- C:\Windows\System\cfsgYiZ.exe
  C:\Windows\System\cfsgYiZ.exe
  2⤵
  PID:6556
- C:\Windows\System\cSoLFEM.exe
  C:\Windows\System\cSoLFEM.exe
  2⤵
  PID:6576
- C:\Windows\System\tgPOHtf.exe
  C:\Windows\System\tgPOHtf.exe
  2⤵
  PID:6604
- C:\Windows\System\eOhrSaB.exe
  C:\Windows\System\eOhrSaB.exe
  2⤵
  PID:6628
- C:\Windows\System\jNYLjMz.exe
  C:\Windows\System\jNYLjMz.exe
  2⤵
  PID:6648
- C:\Windows\System\pThMJlM.exe
  C:\Windows\System\pThMJlM.exe
  2⤵
  PID:6676
- C:\Windows\System\KaavtFN.exe
  C:\Windows\System\KaavtFN.exe
  2⤵
  PID:6700
- C:\Windows\System\FMnlnSM.exe
  C:\Windows\System\FMnlnSM.exe
  2⤵
  PID:6724
- C:\Windows\System\SrabTru.exe
  C:\Windows\System\SrabTru.exe
  2⤵
  PID:6748
- C:\Windows\System\cRtAEtr.exe
  C:\Windows\System\cRtAEtr.exe
  2⤵
  PID:6780
- C:\Windows\System\LopRerY.exe
  C:\Windows\System\LopRerY.exe
  2⤵
  PID:6808
- C:\Windows\System\SSVxEQe.exe
  C:\Windows\System\SSVxEQe.exe
  2⤵
  PID:6836
- C:\Windows\System\ZryHcqn.exe
  C:\Windows\System\ZryHcqn.exe
  2⤵
  PID:6856
- C:\Windows\System\lTGLkuN.exe
  C:\Windows\System\lTGLkuN.exe
  2⤵
  PID:6880
- C:\Windows\System\yEqSYYu.exe
  C:\Windows\System\yEqSYYu.exe
  2⤵
  PID:6908
- C:\Windows\System\rkVlvYM.exe
  C:\Windows\System\rkVlvYM.exe
  2⤵
  PID:6932
- C:\Windows\System\VUCAUoC.exe
  C:\Windows\System\VUCAUoC.exe
  2⤵
  PID:6956
- C:\Windows\System\arVplGm.exe
  C:\Windows\System\arVplGm.exe
  2⤵
  PID:6988
- C:\Windows\System\DhmqoUi.exe
  C:\Windows\System\DhmqoUi.exe
  2⤵
  PID:7004
- C:\Windows\System\xdJAlOn.exe
  C:\Windows\System\xdJAlOn.exe
  2⤵
  PID:7028
- C:\Windows\System\ftRECrP.exe
  C:\Windows\System\ftRECrP.exe
  2⤵
  PID:7060
- C:\Windows\System\JsLGgCt.exe
  C:\Windows\System\JsLGgCt.exe
  2⤵
  PID:7084
- C:\Windows\System\IlFmfZj.exe
  C:\Windows\System\IlFmfZj.exe
  2⤵
  PID:7116
- C:\Windows\System\RcXKstd.exe
  C:\Windows\System\RcXKstd.exe
  2⤵
  PID:7140
- C:\Windows\System\nAKWhZr.exe
  C:\Windows\System\nAKWhZr.exe
  2⤵
  PID:7164
- C:\Windows\System\KeVeKXI.exe
  C:\Windows\System\KeVeKXI.exe
  2⤵
  PID:5948
- C:\Windows\System\GbHlVqx.exe
  C:\Windows\System\GbHlVqx.exe
  2⤵
  PID:5252
- C:\Windows\System\xUWKSOd.exe
  C:\Windows\System\xUWKSOd.exe
  2⤵
  PID:6148
- C:\Windows\System\qnJXpCf.exe
  C:\Windows\System\qnJXpCf.exe
  2⤵
  PID:5788
- C:\Windows\System\FLVikDm.exe
  C:\Windows\System\FLVikDm.exe
  2⤵
  PID:6244
- C:\Windows\System\ATNgkqa.exe
  C:\Windows\System\ATNgkqa.exe
  2⤵
  PID:6196
- C:\Windows\System\dNfeuXR.exe
  C:\Windows\System\dNfeuXR.exe
  2⤵
  PID:6308
- C:\Windows\System\XWkgtHS.exe
  C:\Windows\System\XWkgtHS.exe
  2⤵
  PID:6372
- C:\Windows\System\uYrgWkW.exe
  C:\Windows\System\uYrgWkW.exe
  2⤵
  PID:6448
- C:\Windows\System\MQMKRLO.exe
  C:\Windows\System\MQMKRLO.exe
  2⤵
  PID:6492
- C:\Windows\System\MTropIW.exe
  C:\Windows\System\MTropIW.exe
  2⤵
  PID:6536
- C:\Windows\System\eOuMIjs.exe
  C:\Windows\System\eOuMIjs.exe
  2⤵
  PID:6544
- C:\Windows\System\vktommd.exe
  C:\Windows\System\vktommd.exe
  2⤵
  PID:6800
- C:\Windows\System\VnmpUxj.exe
  C:\Windows\System\VnmpUxj.exe
  2⤵
  PID:6708
- C:\Windows\System\OjIHkDk.exe
  C:\Windows\System\OjIHkDk.exe
  2⤵
  PID:6888
- C:\Windows\System\kbQoRVJ.exe
  C:\Windows\System\kbQoRVJ.exe
  2⤵
  PID:6712
- C:\Windows\System\NXzWSvz.exe
  C:\Windows\System\NXzWSvz.exe
  2⤵
  PID:6744
- C:\Windows\System\OQHhGkF.exe
  C:\Windows\System\OQHhGkF.exe
  2⤵
  PID:6944
- C:\Windows\System\mXoRikE.exe
  C:\Windows\System\mXoRikE.exe
  2⤵
  PID:5484
- C:\Windows\System\GaTzuOV.exe
  C:\Windows\System\GaTzuOV.exe
  2⤵
  PID:7020
- C:\Windows\System\eeZSxqz.exe
  C:\Windows\System\eeZSxqz.exe
  2⤵
  PID:6168
- C:\Windows\System\ckLWkba.exe
  C:\Windows\System\ckLWkba.exe
  2⤵
  PID:6356
- C:\Windows\System\krosytA.exe
  C:\Windows\System\krosytA.exe
  2⤵
  PID:6304
- C:\Windows\System\ngxMGLg.exe
  C:\Windows\System\ngxMGLg.exe
  2⤵
  PID:6644
- C:\Windows\System\ddoBvAm.exe
  C:\Windows\System\ddoBvAm.exe
  2⤵
  PID:7188
- C:\Windows\System\IxUXnlm.exe
  C:\Windows\System\IxUXnlm.exe
  2⤵
  PID:7212
- C:\Windows\System\XWoxovK.exe
  C:\Windows\System\XWoxovK.exe
  2⤵
  PID:7236
- C:\Windows\System\ASRauTv.exe
  C:\Windows\System\ASRauTv.exe
  2⤵
  PID:7256
- C:\Windows\System\KDTtkcQ.exe
  C:\Windows\System\KDTtkcQ.exe
  2⤵
  PID:7276
- C:\Windows\System\eDzoAEw.exe
  C:\Windows\System\eDzoAEw.exe
  2⤵
  PID:7296
- C:\Windows\System\BlKocXU.exe
  C:\Windows\System\BlKocXU.exe
  2⤵
  PID:7324
- C:\Windows\System\potwvFZ.exe
  C:\Windows\System\potwvFZ.exe
  2⤵
  PID:7348
- C:\Windows\System\NxtGxxP.exe
  C:\Windows\System\NxtGxxP.exe
  2⤵
  PID:7364
- C:\Windows\System\YhatgAk.exe
  C:\Windows\System\YhatgAk.exe
  2⤵
  PID:7392
- C:\Windows\System\xShrHhs.exe
  C:\Windows\System\xShrHhs.exe
  2⤵
  PID:7416
- C:\Windows\System\FTjTsNw.exe
  C:\Windows\System\FTjTsNw.exe
  2⤵
  PID:7444
- C:\Windows\System\klKJyJf.exe
  C:\Windows\System\klKJyJf.exe
  2⤵
  PID:7468
- C:\Windows\System\fMpfEgr.exe
  C:\Windows\System\fMpfEgr.exe
  2⤵
  PID:7492
- C:\Windows\System\XxKZlAr.exe
  C:\Windows\System\XxKZlAr.exe
  2⤵
  PID:7520
- C:\Windows\System\ixqUcmg.exe
  C:\Windows\System\ixqUcmg.exe
  2⤵
  PID:7544
- C:\Windows\System\DnMvlRh.exe
  C:\Windows\System\DnMvlRh.exe
  2⤵
  PID:7564
- C:\Windows\System\ccakDww.exe
  C:\Windows\System\ccakDww.exe
  2⤵
  PID:7588
- C:\Windows\System\pqjkzOW.exe
  C:\Windows\System\pqjkzOW.exe
  2⤵
  PID:7608
- C:\Windows\System\lhvzOsd.exe
  C:\Windows\System\lhvzOsd.exe
  2⤵
  PID:7640
- C:\Windows\System\QYxPiuT.exe
  C:\Windows\System\QYxPiuT.exe
  2⤵
  PID:7664
- C:\Windows\System\avTTIFc.exe
  C:\Windows\System\avTTIFc.exe
  2⤵
  PID:7692
- C:\Windows\System\tIUgpky.exe
  C:\Windows\System\tIUgpky.exe
  2⤵
  PID:7720
- C:\Windows\System\tGriNZJ.exe
  C:\Windows\System\tGriNZJ.exe
  2⤵
  PID:7744
- C:\Windows\System\GGYXfTV.exe
  C:\Windows\System\GGYXfTV.exe
  2⤵
  PID:7768
- C:\Windows\System\HfIdJPm.exe
  C:\Windows\System\HfIdJPm.exe
  2⤵
  PID:7792
- C:\Windows\System\MAvANdE.exe
  C:\Windows\System\MAvANdE.exe
  2⤵
  PID:7820
- C:\Windows\System\ihWWerf.exe
  C:\Windows\System\ihWWerf.exe
  2⤵
  PID:7840
- C:\Windows\System\kYitdix.exe
  C:\Windows\System\kYitdix.exe
  2⤵
  PID:7856
- C:\Windows\System\VHEWOxy.exe
  C:\Windows\System\VHEWOxy.exe
  2⤵
  PID:7872
- C:\Windows\System\KAyhYtz.exe
  C:\Windows\System\KAyhYtz.exe
  2⤵
  PID:7900
- C:\Windows\System\PARPBnJ.exe
  C:\Windows\System\PARPBnJ.exe
  2⤵
  PID:7920
- C:\Windows\System\GuogRRZ.exe
  C:\Windows\System\GuogRRZ.exe
  2⤵
  PID:7944
- C:\Windows\System\WDjkBiX.exe
  C:\Windows\System\WDjkBiX.exe
  2⤵
  PID:7968
- C:\Windows\System\imfYzgT.exe
  C:\Windows\System\imfYzgT.exe
  2⤵
  PID:7992
- C:\Windows\System\RCSCgoa.exe
  C:\Windows\System\RCSCgoa.exe
  2⤵
  PID:8016
- C:\Windows\System\NDaBoPt.exe
  C:\Windows\System\NDaBoPt.exe
  2⤵
  PID:8040
- C:\Windows\System\bOMnotJ.exe
  C:\Windows\System\bOMnotJ.exe
  2⤵
  PID:8064
- C:\Windows\System\ZyHUnpk.exe
  C:\Windows\System\ZyHUnpk.exe
  2⤵
  PID:8092
- C:\Windows\System\sDPrghd.exe
  C:\Windows\System\sDPrghd.exe
  2⤵
  PID:8120
- C:\Windows\System\mwdSRYd.exe
  C:\Windows\System\mwdSRYd.exe
  2⤵
  PID:8140
- C:\Windows\System\SUsCbSk.exe
  C:\Windows\System\SUsCbSk.exe
  2⤵
  PID:8160
- C:\Windows\System\tybqeQp.exe
  C:\Windows\System\tybqeQp.exe
  2⤵
  PID:8188
- C:\Windows\System\hFljYUL.exe
  C:\Windows\System\hFljYUL.exe
  2⤵
  PID:5724
- C:\Windows\System\SEMtskk.exe
  C:\Windows\System\SEMtskk.exe
  2⤵
  PID:6964
- C:\Windows\System\fTJBnID.exe
  C:\Windows\System\fTJBnID.exe
  2⤵
  PID:6756
- C:\Windows\System\TNuwBdA.exe
  C:\Windows\System\TNuwBdA.exe
  2⤵
  PID:7208
- C:\Windows\System\CfDpxOr.exe
  C:\Windows\System\CfDpxOr.exe
  2⤵
  PID:6612
- C:\Windows\System\YXDkrjc.exe
  C:\Windows\System\YXDkrjc.exe
  2⤵
  PID:6664
- C:\Windows\System\feVdFOd.exe
  C:\Windows\System\feVdFOd.exe
  2⤵
  PID:7308
- C:\Windows\System\prMQaqP.exe
  C:\Windows\System\prMQaqP.exe
  2⤵
  PID:6916
- C:\Windows\System\ttzeCTN.exe
  C:\Windows\System\ttzeCTN.exe
  2⤵
  PID:7228
- C:\Windows\System\VJQJoxp.exe
  C:\Windows\System\VJQJoxp.exe
  2⤵
  PID:7292
- C:\Windows\System\lNIZcIw.exe
  C:\Windows\System\lNIZcIw.exe
  2⤵
  PID:7688
- C:\Windows\System\xIdyLkj.exe
  C:\Windows\System\xIdyLkj.exe
  2⤵
  PID:7264
- C:\Windows\System\JyIqrVd.exe
  C:\Windows\System\JyIqrVd.exe
  2⤵
  PID:7536
- C:\Windows\System\AOJXwJp.exe
  C:\Windows\System\AOJXwJp.exe
  2⤵
  PID:7816
- C:\Windows\System\obWUVhD.exe
  C:\Windows\System\obWUVhD.exe
  2⤵
  PID:7892
- C:\Windows\System\RrexEgg.exe
  C:\Windows\System\RrexEgg.exe
  2⤵
  PID:7916
- C:\Windows\System\Temiomp.exe
  C:\Windows\System\Temiomp.exe
  2⤵
  PID:7740
- C:\Windows\System\OddYIKk.exe
  C:\Windows\System\OddYIKk.exe
  2⤵
  PID:7808
- C:\Windows\System\NuvTNky.exe
  C:\Windows\System\NuvTNky.exe
  2⤵
  PID:7836
- C:\Windows\System\oSbeBiO.exe
  C:\Windows\System\oSbeBiO.exe
  2⤵
  PID:7848
- C:\Windows\System\qSStpRt.exe
  C:\Windows\System\qSStpRt.exe
  2⤵
  PID:7132
- C:\Windows\System\smXcbpO.exe
  C:\Windows\System\smXcbpO.exe
  2⤵
  PID:7940
- C:\Windows\System\fFuaGGF.exe
  C:\Windows\System\fFuaGGF.exe
  2⤵
  PID:7732
- C:\Windows\System\CTesJKe.exe
  C:\Windows\System\CTesJKe.exe
  2⤵
  PID:8208
- C:\Windows\System\sGsWGxU.exe
  C:\Windows\System\sGsWGxU.exe
  2⤵
  PID:8228
- C:\Windows\System\JjwuUvp.exe
  C:\Windows\System\JjwuUvp.exe
  2⤵
  PID:8248
- C:\Windows\System\dRuZpPL.exe
  C:\Windows\System\dRuZpPL.exe
  2⤵
  PID:8276
- C:\Windows\System\FwCinxt.exe
  C:\Windows\System\FwCinxt.exe
  2⤵
  PID:8304
- C:\Windows\System\ATREtiM.exe
  C:\Windows\System\ATREtiM.exe
  2⤵
  PID:8336
- C:\Windows\System\WHSHafz.exe
  C:\Windows\System\WHSHafz.exe
  2⤵
  PID:8360
- C:\Windows\System\SAaUdpf.exe
  C:\Windows\System\SAaUdpf.exe
  2⤵
  PID:8388
- C:\Windows\System\qWXoIue.exe
  C:\Windows\System\qWXoIue.exe
  2⤵
  PID:8412
- C:\Windows\System\YebXEFM.exe
  C:\Windows\System\YebXEFM.exe
  2⤵
  PID:8436
- C:\Windows\System\lsSYQZb.exe
  C:\Windows\System\lsSYQZb.exe
  2⤵
  PID:8464
- C:\Windows\System\gLzyCjg.exe
  C:\Windows\System\gLzyCjg.exe
  2⤵
  PID:8488
- C:\Windows\System\uprwPGJ.exe
  C:\Windows\System\uprwPGJ.exe
  2⤵
  PID:8516
- C:\Windows\System\yrKaONz.exe
  C:\Windows\System\yrKaONz.exe
  2⤵
  PID:8540
- C:\Windows\System\VYHLznA.exe
  C:\Windows\System\VYHLznA.exe
  2⤵
  PID:8564
- C:\Windows\System\pZENlGe.exe
  C:\Windows\System\pZENlGe.exe
  2⤵
  PID:8588
- C:\Windows\System\YiGvboz.exe
  C:\Windows\System\YiGvboz.exe
  2⤵
  PID:8608
- C:\Windows\System\SISfGVq.exe
  C:\Windows\System\SISfGVq.exe
  2⤵
  PID:8636
- C:\Windows\System\RocbPXq.exe
  C:\Windows\System\RocbPXq.exe
  2⤵
  PID:8656
- C:\Windows\System\ayJTQVZ.exe
  C:\Windows\System\ayJTQVZ.exe
  2⤵
  PID:8672
- C:\Windows\System\DOebFDm.exe
  C:\Windows\System\DOebFDm.exe
  2⤵
  PID:8708
- C:\Windows\System\IVeeibt.exe
  C:\Windows\System\IVeeibt.exe
  2⤵
  PID:8732
- C:\Windows\System\bgEafha.exe
  C:\Windows\System\bgEafha.exe
  2⤵
  PID:8756
- C:\Windows\System\wyFTLGo.exe
  C:\Windows\System\wyFTLGo.exe
  2⤵
  PID:8780
- C:\Windows\System\MDWQcFe.exe
  C:\Windows\System\MDWQcFe.exe
  2⤵
  PID:8808
- C:\Windows\System\KzBpQRF.exe
  C:\Windows\System\KzBpQRF.exe
  2⤵
  PID:8832
- C:\Windows\System\ElvUdhU.exe
  C:\Windows\System\ElvUdhU.exe
  2⤵
  PID:8856
- C:\Windows\System\cdHZNXZ.exe
  C:\Windows\System\cdHZNXZ.exe
  2⤵
  PID:8888
- C:\Windows\System\nunpRCc.exe
  C:\Windows\System\nunpRCc.exe
  2⤵
  PID:8912
- C:\Windows\System\GBjRNsp.exe
  C:\Windows\System\GBjRNsp.exe
  2⤵
  PID:8928
- C:\Windows\System\JwmHdxa.exe
  C:\Windows\System\JwmHdxa.exe
  2⤵
  PID:8956
- C:\Windows\System\paLoluN.exe
  C:\Windows\System\paLoluN.exe
  2⤵
  PID:8976
- C:\Windows\System\cAQRDMj.exe
  C:\Windows\System\cAQRDMj.exe
  2⤵
  PID:8996
- C:\Windows\System\pZPgeSf.exe
  C:\Windows\System\pZPgeSf.exe
  2⤵
  PID:9024
- C:\Windows\System\azqBIjK.exe
  C:\Windows\System\azqBIjK.exe
  2⤵
  PID:9056
- C:\Windows\System\KsDEZSm.exe
  C:\Windows\System\KsDEZSm.exe
  2⤵
  PID:9072
- C:\Windows\System\EWvqKWy.exe
  C:\Windows\System\EWvqKWy.exe
  2⤵
  PID:9108
- C:\Windows\System\pjiWKwI.exe
  C:\Windows\System\pjiWKwI.exe
  2⤵
  PID:9124
- C:\Windows\System\VqxUVWI.exe
  C:\Windows\System\VqxUVWI.exe
  2⤵
  PID:9152
- C:\Windows\System\XbQAspI.exe
  C:\Windows\System\XbQAspI.exe
  2⤵
  PID:9168
- C:\Windows\System\iWmbCcB.exe
  C:\Windows\System\iWmbCcB.exe
  2⤵
  PID:9188
- C:\Windows\System\UytLImA.exe
  C:\Windows\System\UytLImA.exe
  2⤵
  PID:9212
- C:\Windows\System\HdgdkgB.exe
  C:\Windows\System\HdgdkgB.exe
  2⤵
  PID:7760
- C:\Windows\System\BdxiMvO.exe
  C:\Windows\System\BdxiMvO.exe
  2⤵
  PID:6868
- C:\Windows\System\ooFthnB.exe
  C:\Windows\System\ooFthnB.exe
  2⤵
  PID:8000
- C:\Windows\System\eDDvJcF.exe
  C:\Windows\System\eDDvJcF.exe
  2⤵
  PID:7884
- C:\Windows\System\ahmctAh.exe
  C:\Windows\System\ahmctAh.exe
  2⤵
  PID:8004
- C:\Windows\System\YdobRgV.exe
  C:\Windows\System\YdobRgV.exe
  2⤵
  PID:8088
- C:\Windows\System\rjDOFFM.exe
  C:\Windows\System\rjDOFFM.exe
  2⤵
  PID:8172
- C:\Windows\System\rTYfVpY.exe
  C:\Windows\System\rTYfVpY.exe
  2⤵
  PID:7812
- C:\Windows\System\weBIYXU.exe
  C:\Windows\System\weBIYXU.exe
  2⤵
  PID:7388
- C:\Windows\System\wSuJdnG.exe
  C:\Windows\System\wSuJdnG.exe
  2⤵
  PID:8480
- C:\Windows\System\vwqIExw.exe
  C:\Windows\System\vwqIExw.exe
  2⤵
  PID:7932
- C:\Windows\System\TJmyobh.exe
  C:\Windows\System\TJmyobh.exe
  2⤵
  PID:6892
- C:\Windows\System\LkbHSIF.exe
  C:\Windows\System\LkbHSIF.exe
  2⤵
  PID:8652
- C:\Windows\System\vTaxHmx.exe
  C:\Windows\System\vTaxHmx.exe
  2⤵
  PID:8288
- C:\Windows\System\ppDuZvT.exe
  C:\Windows\System\ppDuZvT.exe
  2⤵
  PID:7252
- C:\Windows\System\uAqhPqg.exe
  C:\Windows\System\uAqhPqg.exe
  2⤵
  PID:7556
- C:\Windows\System\XozwdoW.exe
  C:\Windows\System\XozwdoW.exe
  2⤵
  PID:8456
- C:\Windows\System\BnbDyCT.exe
  C:\Windows\System\BnbDyCT.exe
  2⤵
  PID:7776
- C:\Windows\System\PsGjdwi.exe
  C:\Windows\System\PsGjdwi.exe
  2⤵
  PID:8104
- C:\Windows\System\xpwTqhn.exe
  C:\Windows\System\xpwTqhn.exe
  2⤵
  PID:8536
- C:\Windows\System\DNqucIg.exe
  C:\Windows\System\DNqucIg.exe
  2⤵
  PID:6596
- C:\Windows\System\jKGSAiF.exe
  C:\Windows\System\jKGSAiF.exe
  2⤵
  PID:9088
- C:\Windows\System\vgBISXG.exe
  C:\Windows\System\vgBISXG.exe
  2⤵
  PID:8220
- C:\Windows\System\SRPmDYo.exe
  C:\Windows\System\SRPmDYo.exe
  2⤵
  PID:9160
- C:\Windows\System\ErYBToF.exe
  C:\Windows\System\ErYBToF.exe
  2⤵
  PID:8332
- C:\Windows\System\ORpNvut.exe
  C:\Windows\System\ORpNvut.exe
  2⤵
  PID:8776
- C:\Windows\System\YtaMrhv.exe
  C:\Windows\System\YtaMrhv.exe
  2⤵
  PID:8108
- C:\Windows\System\YQzWnar.exe
  C:\Windows\System\YQzWnar.exe
  2⤵
  PID:7980
- C:\Windows\System\rsYDpxR.exe
  C:\Windows\System\rsYDpxR.exe
  2⤵
  PID:7320
- C:\Windows\System\STtxadW.exe
  C:\Windows\System\STtxadW.exe
  2⤵
  PID:9236
- C:\Windows\System\PMPTFKU.exe
  C:\Windows\System\PMPTFKU.exe
  2⤵
  PID:9264
- C:\Windows\System\CJcXUpP.exe
  C:\Windows\System\CJcXUpP.exe
  2⤵
  PID:9288
- C:\Windows\System\UIcBRYr.exe
  C:\Windows\System\UIcBRYr.exe
  2⤵
  PID:9312
- C:\Windows\System\gZCMuqG.exe
  C:\Windows\System\gZCMuqG.exe
  2⤵
  PID:9340
- C:\Windows\System\ZHAMZVC.exe
  C:\Windows\System\ZHAMZVC.exe
  2⤵
  PID:9364
- C:\Windows\System\bDMtjiX.exe
  C:\Windows\System\bDMtjiX.exe
  2⤵
  PID:9392
- C:\Windows\System\Cevqqpy.exe
  C:\Windows\System\Cevqqpy.exe
  2⤵
  PID:9416
- C:\Windows\System\WugffLj.exe
  C:\Windows\System\WugffLj.exe
  2⤵
  PID:9444
- C:\Windows\System\ZTosipk.exe
  C:\Windows\System\ZTosipk.exe
  2⤵
  PID:9472
- C:\Windows\System\CBtKzzs.exe
  C:\Windows\System\CBtKzzs.exe
  2⤵
  PID:9492
- C:\Windows\System\CCgATCy.exe
  C:\Windows\System\CCgATCy.exe
  2⤵
  PID:9524
- C:\Windows\System\MMbDhHR.exe
  C:\Windows\System\MMbDhHR.exe
  2⤵
  PID:9552
- C:\Windows\System\RsvOqOU.exe
  C:\Windows\System\RsvOqOU.exe
  2⤵
  PID:9584
- C:\Windows\System\hULtjPp.exe
  C:\Windows\System\hULtjPp.exe
  2⤵
  PID:9600
- C:\Windows\System\XWAMANd.exe
  C:\Windows\System\XWAMANd.exe
  2⤵
  PID:9628
- C:\Windows\System\qKAWcMC.exe
  C:\Windows\System\qKAWcMC.exe
  2⤵
  PID:9648
- C:\Windows\System\lDsqnPU.exe
  C:\Windows\System\lDsqnPU.exe
  2⤵
  PID:9680
- C:\Windows\System\SPZnUAN.exe
  C:\Windows\System\SPZnUAN.exe
  2⤵
  PID:9704
- C:\Windows\System\ePqIwfA.exe
  C:\Windows\System\ePqIwfA.exe
  2⤵
  PID:9732
- C:\Windows\System\phxDIxu.exe
  C:\Windows\System\phxDIxu.exe
  2⤵
  PID:9764
- C:\Windows\System\PEUcUcX.exe
  C:\Windows\System\PEUcUcX.exe
  2⤵
  PID:9788
- C:\Windows\System\yiqXgMc.exe
  C:\Windows\System\yiqXgMc.exe
  2⤵
  PID:10080
- C:\Windows\System\nxBhrRc.exe
  C:\Windows\System\nxBhrRc.exe
  2⤵
  PID:10112
- C:\Windows\System\KOsdJOS.exe
  C:\Windows\System\KOsdJOS.exe
  2⤵
  PID:10132
- C:\Windows\System\PWSMnrj.exe
  C:\Windows\System\PWSMnrj.exe
  2⤵
  PID:10184
- C:\Windows\System\tgcBiZi.exe
  C:\Windows\System\tgcBiZi.exe
  2⤵
  PID:10204
- C:\Windows\System\sUxjiOm.exe
  C:\Windows\System\sUxjiOm.exe
  2⤵
  PID:10224
- C:\Windows\System\nKiUsTF.exe
  C:\Windows\System\nKiUsTF.exe
  2⤵
  PID:8688
- C:\Windows\System\jxoTKMx.exe
  C:\Windows\System\jxoTKMx.exe
  2⤵
  PID:8948
- C:\Windows\System\YQwbnVX.exe
  C:\Windows\System\YQwbnVX.exe
  2⤵
  PID:8052
- C:\Windows\System\vytrKIy.exe
  C:\Windows\System\vytrKIy.exe
  2⤵
  PID:8824
- C:\Windows\System\NSWIMmH.exe
  C:\Windows\System\NSWIMmH.exe
  2⤵
  PID:9036
- C:\Windows\System\gBfnMLg.exe
  C:\Windows\System\gBfnMLg.exe
  2⤵
  PID:9244
- C:\Windows\System\yeePtcg.exe
  C:\Windows\System\yeePtcg.exe
  2⤵
  PID:9148
- C:\Windows\System\WLrznCf.exe
  C:\Windows\System\WLrznCf.exe
  2⤵
  PID:7580
- C:\Windows\System\DCpaeLn.exe
  C:\Windows\System\DCpaeLn.exe
  2⤵
  PID:5280
- C:\Windows\System\FyYXiWF.exe
  C:\Windows\System\FyYXiWF.exe
  2⤵
  PID:6600
- C:\Windows\System\DlzvUti.exe
  C:\Windows\System\DlzvUti.exe
  2⤵
  PID:9352
- C:\Windows\System\DpeHQoT.exe
  C:\Windows\System\DpeHQoT.exe
  2⤵
  PID:8300
- C:\Windows\System\CBJdpwY.exe
  C:\Windows\System\CBJdpwY.exe
  2⤵
  PID:9440
- C:\Windows\System\SswpUAd.exe
  C:\Windows\System\SswpUAd.exe
  2⤵
  PID:8484
- C:\Windows\System\tcmlZvq.exe
  C:\Windows\System\tcmlZvq.exe
  2⤵
  PID:9968
- C:\Windows\System\AogQnfk.exe
  C:\Windows\System\AogQnfk.exe
  2⤵
  PID:9668
- C:\Windows\System\yxwQTai.exe
  C:\Windows\System\yxwQTai.exe
  2⤵
  PID:10052
- C:\Windows\System\xyEvlbn.exe
  C:\Windows\System\xyEvlbn.exe
  2⤵
  PID:9136
- C:\Windows\System\KJmzkdB.exe
  C:\Windows\System\KJmzkdB.exe
  2⤵
  PID:8356
- C:\Windows\System\hhxsuza.exe
  C:\Windows\System\hhxsuza.exe
  2⤵
  PID:7912
- C:\Windows\System\vjwfTpr.exe
  C:\Windows\System\vjwfTpr.exe
  2⤵
  PID:9220
- C:\Windows\System\DHpEGZb.exe
  C:\Windows\System\DHpEGZb.exe
  2⤵
  PID:8668
- C:\Windows\System\VCiwnnq.exe
  C:\Windows\System\VCiwnnq.exe
  2⤵
  PID:9324
- C:\Windows\System\BMYBORU.exe
  C:\Windows\System\BMYBORU.exe
  2⤵
  PID:10256
- C:\Windows\System\MfEogFf.exe
  C:\Windows\System\MfEogFf.exe
  2⤵
  PID:10276
- C:\Windows\System\ptxcbiV.exe
  C:\Windows\System\ptxcbiV.exe
  2⤵
  PID:10312
- C:\Windows\System\aFNuXRl.exe
  C:\Windows\System\aFNuXRl.exe
  2⤵
  PID:10336
- C:\Windows\System\IvUcnmo.exe
  C:\Windows\System\IvUcnmo.exe
  2⤵
  PID:10368
- C:\Windows\System\hIVcllk.exe
  C:\Windows\System\hIVcllk.exe
  2⤵
  PID:10388
- C:\Windows\System\QbTOdjz.exe
  C:\Windows\System\QbTOdjz.exe
  2⤵
  PID:10408
- C:\Windows\System\nKHtlfz.exe
  C:\Windows\System\nKHtlfz.exe
  2⤵
  PID:10424
- C:\Windows\System\IoOKpYu.exe
  C:\Windows\System\IoOKpYu.exe
  2⤵
  PID:10444
- C:\Windows\System\DkcxSCN.exe
  C:\Windows\System\DkcxSCN.exe
  2⤵
  PID:10468
- C:\Windows\System\CZrVMhA.exe
  C:\Windows\System\CZrVMhA.exe
  2⤵
  PID:10496
- C:\Windows\System\mBsWkdW.exe
  C:\Windows\System\mBsWkdW.exe
  2⤵
  PID:10524
- C:\Windows\System\bMfTlnC.exe
  C:\Windows\System\bMfTlnC.exe
  2⤵
  PID:10544
- C:\Windows\System\mmCABsR.exe
  C:\Windows\System\mmCABsR.exe
  2⤵
  PID:10564
- C:\Windows\System\OiZHqQq.exe
  C:\Windows\System\OiZHqQq.exe
  2⤵
  PID:10592
- C:\Windows\System\MGZuSKD.exe
  C:\Windows\System\MGZuSKD.exe
  2⤵
  PID:10612
- C:\Windows\System\jUfQNqC.exe
  C:\Windows\System\jUfQNqC.exe
  2⤵
  PID:10636
- C:\Windows\System\bNsbeeC.exe
  C:\Windows\System\bNsbeeC.exe
  2⤵
  PID:10656
- C:\Windows\System\fRNOpAQ.exe
  C:\Windows\System\fRNOpAQ.exe
  2⤵
  PID:10680
- C:\Windows\System\FGEiQSv.exe
  C:\Windows\System\FGEiQSv.exe
  2⤵
  PID:10704
- C:\Windows\System\rkvlRIV.exe
  C:\Windows\System\rkvlRIV.exe
  2⤵
  PID:10728
- C:\Windows\System\hAGeXep.exe
  C:\Windows\System\hAGeXep.exe
  2⤵
  PID:10768
- C:\Windows\System\WkxmUtS.exe
  C:\Windows\System\WkxmUtS.exe
  2⤵
  PID:10800
- C:\Windows\System\BlZelJR.exe
  C:\Windows\System\BlZelJR.exe
  2⤵
  PID:10828
- C:\Windows\System\BwyrmXt.exe
  C:\Windows\System\BwyrmXt.exe
  2⤵
  PID:10856
- C:\Windows\System\qViCAtK.exe
  C:\Windows\System\qViCAtK.exe
  2⤵
  PID:10876
- C:\Windows\System\ODYoIbM.exe
  C:\Windows\System\ODYoIbM.exe
  2⤵
  PID:10916
- C:\Windows\System\bUiRvZB.exe
  C:\Windows\System\bUiRvZB.exe
  2⤵
  PID:10932
- C:\Windows\System\DycujQm.exe
  C:\Windows\System\DycujQm.exe
  2⤵
  PID:10948
- C:\Windows\System\hvGrIwk.exe
  C:\Windows\System\hvGrIwk.exe
  2⤵
  PID:10968
- C:\Windows\System\jHLdNsS.exe
  C:\Windows\System\jHLdNsS.exe
  2⤵
  PID:10984
- C:\Windows\System\UpsaZLv.exe
  C:\Windows\System\UpsaZLv.exe
  2⤵
  PID:11000
- C:\Windows\System\JFEOenc.exe
  C:\Windows\System\JFEOenc.exe
  2⤵
  PID:11020
- C:\Windows\System\mAHhxEV.exe
  C:\Windows\System\mAHhxEV.exe
  2⤵
  PID:11168
- C:\Windows\System\HLFbMWI.exe
  C:\Windows\System\HLFbMWI.exe
  2⤵
  PID:11212
- C:\Windows\System\nQYwKTg.exe
  C:\Windows\System\nQYwKTg.exe
  2⤵
  PID:11248
- C:\Windows\System\YYonWvV.exe
  C:\Windows\System\YYonWvV.exe
  2⤵
  PID:9456
- C:\Windows\System\oWsIbUQ.exe
  C:\Windows\System\oWsIbUQ.exe
  2⤵
  PID:9484
- C:\Windows\System\DsLBOcI.exe
  C:\Windows\System\DsLBOcI.exe
  2⤵
  PID:9572
- C:\Windows\System\kIiGOhf.exe
  C:\Windows\System\kIiGOhf.exe
  2⤵
  PID:9596
- C:\Windows\System\vFWDEvf.exe
  C:\Windows\System\vFWDEvf.exe
  2⤵
  PID:9672
- C:\Windows\System\TyxIYyy.exe
  C:\Windows\System\TyxIYyy.exe
  2⤵
  PID:9772
- C:\Windows\System\lScZrif.exe
  C:\Windows\System\lScZrif.exe
  2⤵
  PID:9360
- C:\Windows\System\MdYqgOS.exe
  C:\Windows\System\MdYqgOS.exe
  2⤵
  PID:8552
- C:\Windows\System\BVhBNLZ.exe
  C:\Windows\System\BVhBNLZ.exe
  2⤵
  PID:9828
- C:\Windows\System\FGSVjuy.exe
  C:\Windows\System\FGSVjuy.exe
  2⤵
  PID:9944
- C:\Windows\System\suusCEl.exe
  C:\Windows\System\suusCEl.exe
  2⤵
  PID:8180
- C:\Windows\System\DUfuLLW.exe
  C:\Windows\System\DUfuLLW.exe
  2⤵
  PID:8176
- C:\Windows\System\quYLdbR.exe
  C:\Windows\System\quYLdbR.exe
  2⤵
  PID:9896
- C:\Windows\System\vmSKhTf.exe
  C:\Windows\System\vmSKhTf.exe
  2⤵
  PID:10076
- C:\Windows\System\gzrvVqr.exe
  C:\Windows\System\gzrvVqr.exe
  2⤵
  PID:10148
- C:\Windows\System\KPUBGQA.exe
  C:\Windows\System\KPUBGQA.exe
  2⤵
  PID:10128
- C:\Windows\System\HMqidmo.exe
  C:\Windows\System\HMqidmo.exe
  2⤵
  PID:8504
- C:\Windows\System\lpEeLeA.exe
  C:\Windows\System\lpEeLeA.exe
  2⤵
  PID:10268
- C:\Windows\System\GabCupG.exe
  C:\Windows\System\GabCupG.exe
  2⤵
  PID:9140
- C:\Windows\System\ubHtmxe.exe
  C:\Windows\System\ubHtmxe.exe
  2⤵
  PID:9512
- C:\Windows\System\tmGOGyn.exe
  C:\Windows\System\tmGOGyn.exe
  2⤵
  PID:10912
- C:\Windows\System\QbfzmDd.exe
  C:\Windows\System\QbfzmDd.exe
  2⤵
  PID:10352
- C:\Windows\System\BHZtQdg.exe
  C:\Windows\System\BHZtQdg.exe
  2⤵
  PID:10380
- C:\Windows\System\DdEuXEx.exe
  C:\Windows\System\DdEuXEx.exe
  2⤵
  PID:10560
- C:\Windows\System\GdjIzoK.exe
  C:\Windows\System\GdjIzoK.exe
  2⤵
  PID:10584
- C:\Windows\System\hotTLzi.exe
  C:\Windows\System\hotTLzi.exe
  2⤵
  PID:10620
- C:\Windows\System\ChaZJlP.exe
  C:\Windows\System\ChaZJlP.exe
  2⤵
  PID:10696
- C:\Windows\System\jhZixoF.exe
  C:\Windows\System\jhZixoF.exe
  2⤵
  PID:11196
- C:\Windows\System\hZqgREm.exe
  C:\Windows\System\hZqgREm.exe
  2⤵
  PID:10816
- C:\Windows\System\LtQQjEZ.exe
  C:\Windows\System\LtQQjEZ.exe
  2⤵
  PID:10892
- C:\Windows\System\uEwlhQB.exe
  C:\Windows\System\uEwlhQB.exe
  2⤵
  PID:11076
- C:\Windows\System\rJHAvXm.exe
  C:\Windows\System\rJHAvXm.exe
  2⤵
  PID:11284
- C:\Windows\System\RkLGOKG.exe
  C:\Windows\System\RkLGOKG.exe
  2⤵
  PID:11312
- C:\Windows\System\rCNsteg.exe
  C:\Windows\System\rCNsteg.exe
  2⤵
  PID:11340
- C:\Windows\System\POnNAar.exe
  C:\Windows\System\POnNAar.exe
  2⤵
  PID:11360
- C:\Windows\System\gSaMBWn.exe
  C:\Windows\System\gSaMBWn.exe
  2⤵
  PID:11380
- C:\Windows\System\uKWgDny.exe
  C:\Windows\System\uKWgDny.exe
  2⤵
  PID:11396
- C:\Windows\System\fBfpTCn.exe
  C:\Windows\System\fBfpTCn.exe
  2⤵
  PID:11416
- C:\Windows\System\PALSqNL.exe
  C:\Windows\System\PALSqNL.exe
  2⤵
  PID:11440
- C:\Windows\System\oerzEXN.exe
  C:\Windows\System\oerzEXN.exe
  2⤵
  PID:11464
- C:\Windows\System\hGpjevE.exe
  C:\Windows\System\hGpjevE.exe
  2⤵
  PID:11488
- C:\Windows\System\smBksZl.exe
  C:\Windows\System\smBksZl.exe
  2⤵
  PID:11516
- C:\Windows\System\CFdZNFg.exe
  C:\Windows\System\CFdZNFg.exe
  2⤵
  PID:11552
- C:\Windows\System\QRxxoke.exe
  C:\Windows\System\QRxxoke.exe
  2⤵
  PID:11576
- C:\Windows\System\IRqkhSi.exe
  C:\Windows\System\IRqkhSi.exe
  2⤵
  PID:11608
- C:\Windows\System\xAzFkCt.exe
  C:\Windows\System\xAzFkCt.exe
  2⤵
  PID:11640
- C:\Windows\System\cQfNCMt.exe
  C:\Windows\System\cQfNCMt.exe
  2⤵
  PID:11656
- C:\Windows\System\gnKVjVb.exe
  C:\Windows\System\gnKVjVb.exe
  2⤵
  PID:11676
- C:\Windows\System\ecTMawj.exe
  C:\Windows\System\ecTMawj.exe
  2⤵
  PID:11712
- C:\Windows\System\sPGobca.exe
  C:\Windows\System\sPGobca.exe
  2⤵
  PID:11732
- C:\Windows\System\FCHpJfr.exe
  C:\Windows\System\FCHpJfr.exe
  2⤵
  PID:11764
- C:\Windows\System\HMpoFAM.exe
  C:\Windows\System\HMpoFAM.exe
  2⤵
  PID:11788
- C:\Windows\System\ZmjkoQh.exe
  C:\Windows\System\ZmjkoQh.exe
  2⤵
  PID:11816
- C:\Windows\System\TIwAYMG.exe
  C:\Windows\System\TIwAYMG.exe
  2⤵
  PID:11844
- C:\Windows\System\WWamEPD.exe
  C:\Windows\System\WWamEPD.exe
  2⤵
  PID:11888
- C:\Windows\System\uJUOxyd.exe
  C:\Windows\System\uJUOxyd.exe
  2⤵
  PID:11912
- C:\Windows\System\CNdQCJJ.exe
  C:\Windows\System\CNdQCJJ.exe
  2⤵
  PID:11940
- C:\Windows\System\NUVycrr.exe
  C:\Windows\System\NUVycrr.exe
  2⤵
  PID:11960
- C:\Windows\System\OklTmzU.exe
  C:\Windows\System\OklTmzU.exe
  2⤵
  PID:11976
- C:\Windows\System\FeUgDuv.exe
  C:\Windows\System\FeUgDuv.exe
  2⤵
  PID:11992
- C:\Windows\System\FMzKPak.exe
  C:\Windows\System\FMzKPak.exe
  2⤵
  PID:12012
- C:\Windows\System\mGifXAW.exe
  C:\Windows\System\mGifXAW.exe
  2⤵
  PID:12036
- C:\Windows\System\iempaxH.exe
  C:\Windows\System\iempaxH.exe
  2⤵
  PID:12060
- C:\Windows\System\yjECwQw.exe
  C:\Windows\System\yjECwQw.exe
  2⤵
  PID:12076
- C:\Windows\System\EGLMfEV.exe
  C:\Windows\System\EGLMfEV.exe
  2⤵
  PID:12092
- C:\Windows\System\PaJZtwh.exe
  C:\Windows\System\PaJZtwh.exe
  2⤵
  PID:12116
- C:\Windows\System\InKHJoU.exe
  C:\Windows\System\InKHJoU.exe
  2⤵
  PID:12144
- C:\Windows\System\iXsKAZm.exe
  C:\Windows\System\iXsKAZm.exe
  2⤵
  PID:12160
- C:\Windows\System\nbtgBPw.exe
  C:\Windows\System\nbtgBPw.exe
  2⤵
  PID:12188
- C:\Windows\System\fdggIUB.exe
  C:\Windows\System\fdggIUB.exe
  2⤵
  PID:12208
- C:\Windows\System\SiBleBP.exe
  C:\Windows\System\SiBleBP.exe
  2⤵
  PID:12236
- C:\Windows\System\GzWSkQN.exe
  C:\Windows\System\GzWSkQN.exe
  2⤵
  PID:12260
- C:\Windows\System\NSFytTX.exe
  C:\Windows\System\NSFytTX.exe
  2⤵
  PID:11136
- C:\Windows\System\VzoQpJO.exe
  C:\Windows\System\VzoQpJO.exe
  2⤵
  PID:11156
- C:\Windows\System\srnCvxt.exe
  C:\Windows\System\srnCvxt.exe
  2⤵
  PID:11184
- C:\Windows\System\nxcImrl.exe
  C:\Windows\System\nxcImrl.exe
  2⤵
  PID:10140
- C:\Windows\System\DlfUaSD.exe
  C:\Windows\System\DlfUaSD.exe
  2⤵
  PID:9564
- C:\Windows\System\zkWOqrQ.exe
  C:\Windows\System\zkWOqrQ.exe
  2⤵
  PID:9504
- C:\Windows\System\XiTscyr.exe
  C:\Windows\System\XiTscyr.exe
  2⤵
  PID:10580
- C:\Windows\System\yebNveS.exe
  C:\Windows\System\yebNveS.exe
  2⤵
  PID:10996
- C:\Windows\System\SZSkuYu.exe
  C:\Windows\System\SZSkuYu.exe
  2⤵
  PID:9468
- C:\Windows\System\JahEIHQ.exe
  C:\Windows\System\JahEIHQ.exe
  2⤵
  PID:8796
- C:\Windows\System\MVUQPNI.exe
  C:\Windows\System\MVUQPNI.exe
  2⤵
  PID:9200
- C:\Windows\System\GBxOUcw.exe
  C:\Windows\System\GBxOUcw.exe
  2⤵
  PID:9776
- C:\Windows\System\wpOufsX.exe
  C:\Windows\System\wpOufsX.exe
  2⤵
  PID:10532
- C:\Windows\System\EbZJSAN.exe
  C:\Windows\System\EbZJSAN.exe
  2⤵
  PID:10644
- C:\Windows\System\VPbuMYY.exe
  C:\Windows\System\VPbuMYY.exe
  2⤵
  PID:11752
- C:\Windows\System\sGBKmbt.exe
  C:\Windows\System\sGBKmbt.exe
  2⤵
  PID:11272
- C:\Windows\System\mrhzdER.exe
  C:\Windows\System\mrhzdER.exe
  2⤵
  PID:11308
- C:\Windows\System\cCgsKrM.exe
  C:\Windows\System\cCgsKrM.exe
  2⤵
  PID:10460
- C:\Windows\System\NAFbsEY.exe
  C:\Windows\System\NAFbsEY.exe
  2⤵
  PID:10516
- C:\Windows\System\EclfrKW.exe
  C:\Windows\System\EclfrKW.exe
  2⤵
  PID:11388
- C:\Windows\System\lGzhMDU.exe
  C:\Windows\System\lGzhMDU.exe
  2⤵
  PID:9892
- C:\Windows\System\oCZXcMx.exe
  C:\Windows\System\oCZXcMx.exe
  2⤵
  PID:11956
- C:\Windows\System\KtMxxoD.exe
  C:\Windows\System\KtMxxoD.exe
  2⤵
  PID:11504
- C:\Windows\System\yikCyvA.exe
  C:\Windows\System\yikCyvA.exe
  2⤵
  PID:11584
- C:\Windows\System\dzjjPiK.exe
  C:\Windows\System\dzjjPiK.exe
  2⤵
  PID:12068
- C:\Windows\System\PZoiUCg.exe
  C:\Windows\System\PZoiUCg.exe
  2⤵
  PID:11704
- C:\Windows\System\eBkKdfn.exe
  C:\Windows\System\eBkKdfn.exe
  2⤵
  PID:10884
- C:\Windows\System\rhuuxXt.exe
  C:\Windows\System\rhuuxXt.exe
  2⤵
  PID:12196
- C:\Windows\System\BEoAHkP.exe
  C:\Windows\System\BEoAHkP.exe
  2⤵
  PID:12220
- C:\Windows\System\WhfQcoT.exe
  C:\Windows\System\WhfQcoT.exe
  2⤵
  PID:12308
- C:\Windows\System\ElMqFyU.exe
  C:\Windows\System\ElMqFyU.exe
  2⤵
  PID:12336
- C:\Windows\System\AcYSfjI.exe
  C:\Windows\System\AcYSfjI.exe
  2⤵
  PID:12356
- C:\Windows\System\PWrDsLl.exe
  C:\Windows\System\PWrDsLl.exe
  2⤵
  PID:12380
- C:\Windows\System\PvCSKlY.exe
  C:\Windows\System\PvCSKlY.exe
  2⤵
  PID:12416
- C:\Windows\System\vAYgnQi.exe
  C:\Windows\System\vAYgnQi.exe
  2⤵
  PID:12436
- C:\Windows\System\kPmowCT.exe
  C:\Windows\System\kPmowCT.exe
  2⤵
  PID:12460
- C:\Windows\System\RiSObVX.exe
  C:\Windows\System\RiSObVX.exe
  2⤵
  PID:12480
- C:\Windows\System\WypCPfB.exe
  C:\Windows\System\WypCPfB.exe
  2⤵
  PID:12504
- C:\Windows\System\gzQDwwU.exe
  C:\Windows\System\gzQDwwU.exe
  2⤵
  PID:12552
- C:\Windows\System\coXlaav.exe
  C:\Windows\System\coXlaav.exe
  2⤵
  PID:12580
- C:\Windows\System\BfLGQsS.exe
  C:\Windows\System\BfLGQsS.exe
  2⤵
  PID:12600
- C:\Windows\System\RaciSYI.exe
  C:\Windows\System\RaciSYI.exe
  2⤵
  PID:12616
- C:\Windows\System\tlXHGUl.exe
  C:\Windows\System\tlXHGUl.exe
  2⤵
  PID:12640
- C:\Windows\System\Rhoaabl.exe
  C:\Windows\System\Rhoaabl.exe
  2⤵
  PID:12664
- C:\Windows\System\aGuXZqJ.exe
  C:\Windows\System\aGuXZqJ.exe
  2⤵
  PID:12684
- C:\Windows\System\PlCXgjb.exe
  C:\Windows\System\PlCXgjb.exe
  2⤵
  PID:12716
- C:\Windows\System\BqAvUZv.exe
  C:\Windows\System\BqAvUZv.exe
  2⤵
  PID:12744
- C:\Windows\System\qizZXaB.exe
  C:\Windows\System\qizZXaB.exe
  2⤵
  PID:12776
- C:\Windows\System\TaJpyuC.exe
  C:\Windows\System\TaJpyuC.exe
  2⤵
  PID:12792
- C:\Windows\System\OWfuHpR.exe
  C:\Windows\System\OWfuHpR.exe
  2⤵
  PID:12816
- C:\Windows\System\PmJpKdG.exe
  C:\Windows\System\PmJpKdG.exe
  2⤵
  PID:12836
- C:\Windows\System\aGIBKvy.exe
  C:\Windows\System\aGIBKvy.exe
  2⤵
  PID:12868
- C:\Windows\System\KTNfsrg.exe
  C:\Windows\System\KTNfsrg.exe
  2⤵
  PID:12896
- C:\Windows\System\dOdFusR.exe
  C:\Windows\System\dOdFusR.exe
  2⤵
  PID:12916
- C:\Windows\System\fjAccJh.exe
  C:\Windows\System\fjAccJh.exe
  2⤵
  PID:12940
- C:\Windows\System\ZCKRsYY.exe
  C:\Windows\System\ZCKRsYY.exe
  2⤵
  PID:12968
- C:\Windows\System\fCShIfG.exe
  C:\Windows\System\fCShIfG.exe
  2⤵
  PID:12992
- C:\Windows\System\rflfOLb.exe
  C:\Windows\System\rflfOLb.exe
  2⤵
  PID:13012
- C:\Windows\System\arLeWTV.exe
  C:\Windows\System\arLeWTV.exe
  2⤵
  PID:13028
- C:\Windows\System\fJJfzNs.exe
  C:\Windows\System\fJJfzNs.exe
  2⤵
  PID:13044
- C:\Windows\System\kFjLNuF.exe
  C:\Windows\System\kFjLNuF.exe
  2⤵
  PID:13068
- C:\Windows\System\SakDikO.exe
  C:\Windows\System\SakDikO.exe
  2⤵
  PID:13092
- C:\Windows\System\GVxReJV.exe
  C:\Windows\System\GVxReJV.exe
  2⤵
  PID:13116
- C:\Windows\System\IGKnOSh.exe
  C:\Windows\System\IGKnOSh.exe
  2⤵
  PID:13152
- C:\Windows\System\EWOsFfa.exe
  C:\Windows\System\EWOsFfa.exe
  2⤵
  PID:13184
- C:\Windows\System\OsopLiV.exe
  C:\Windows\System\OsopLiV.exe
  2⤵
  PID:13200
- C:\Windows\System\KhDWHvh.exe
  C:\Windows\System\KhDWHvh.exe
  2⤵
  PID:13220
- C:\Windows\System\XYtPKIf.exe
  C:\Windows\System\XYtPKIf.exe
  2⤵
  PID:13248
- C:\Windows\System\ahdDiBN.exe
  C:\Windows\System\ahdDiBN.exe
  2⤵
  PID:13276
- C:\Windows\System\WVnJjRg.exe
  C:\Windows\System\WVnJjRg.exe
  2⤵
  PID:13304
- C:\Windows\System\YrqctzJ.exe
  C:\Windows\System\YrqctzJ.exe
  2⤵
  PID:11904
- C:\Windows\System\exVGIas.exe
  C:\Windows\System\exVGIas.exe
  2⤵
  PID:11564
- C:\Windows\System\kheutGX.exe
  C:\Windows\System\kheutGX.exe
  2⤵
  PID:11648
- C:\Windows\System\nbcXJLU.exe
  C:\Windows\System\nbcXJLU.exe
  2⤵
  PID:12140
- C:\Windows\System\CUAgXDF.exe
  C:\Windows\System\CUAgXDF.exe
  2⤵
  PID:12228
- C:\Windows\System\ByTqHks.exe
  C:\Windows\System\ByTqHks.exe
  2⤵
  PID:12280
- C:\Windows\System\wtnLcMb.exe
  C:\Windows\System\wtnLcMb.exe
  2⤵
  PID:9580
- C:\Windows\System\DOjrHpc.exe
  C:\Windows\System\DOjrHpc.exe
  2⤵
  PID:8532
- C:\Windows\System\AxVLNwZ.exe
  C:\Windows\System\AxVLNwZ.exe
  2⤵
  PID:11896
- C:\Windows\System\rEHkvcB.exe
  C:\Windows\System\rEHkvcB.exe
  2⤵
  PID:11948
- C:\Windows\System\tjEugGl.exe
  C:\Windows\System\tjEugGl.exe
  2⤵
  PID:10164
- C:\Windows\System\DoMfRSz.exe
  C:\Windows\System\DoMfRSz.exe
  2⤵
  PID:12656
- C:\Windows\System\WkCGypQ.exe
  C:\Windows\System\WkCGypQ.exe
  2⤵
  PID:8348
- C:\Windows\System\wpxBDBW.exe
  C:\Windows\System\wpxBDBW.exe
  2⤵
  PID:11456
- C:\Windows\System\uwFbmvC.exe
  C:\Windows\System\uwFbmvC.exe
  2⤵
  PID:12008
- C:\Windows\System\ROxvWYo.exe
  C:\Windows\System\ROxvWYo.exe
  2⤵
  PID:10400
- C:\Windows\System\qSrhqIA.exe
  C:\Windows\System\qSrhqIA.exe
  2⤵
  PID:12184
- C:\Windows\System\GLnLcWS.exe
  C:\Windows\System\GLnLcWS.exe
  2⤵
  PID:13336
- C:\Windows\System\stWERrU.exe
  C:\Windows\System\stWERrU.exe
  2⤵
  PID:13356
- C:\Windows\System\HVNliNs.exe
  C:\Windows\System\HVNliNs.exe
  2⤵
  PID:13384
- C:\Windows\System\zlYISnM.exe
  C:\Windows\System\zlYISnM.exe
  2⤵
  PID:13408
- C:\Windows\System\qOOkyQa.exe
  C:\Windows\System\qOOkyQa.exe
  2⤵
  PID:13440
- C:\Windows\System\RnMKPkE.exe
  C:\Windows\System\RnMKPkE.exe
  2⤵
  PID:13464
- C:\Windows\System\tAuHLBd.exe
  C:\Windows\System\tAuHLBd.exe
  2⤵
  PID:13484
- C:\Windows\System\HlBqVYv.exe
  C:\Windows\System\HlBqVYv.exe
  2⤵
  PID:13508
- C:\Windows\System\hXbihqD.exe
  C:\Windows\System\hXbihqD.exe
  2⤵
  PID:13532
- C:\Windows\System\QiqCkPo.exe
  C:\Windows\System\QiqCkPo.exe
  2⤵
  PID:13556
- C:\Windows\System\fkmhLcw.exe
  C:\Windows\System\fkmhLcw.exe
  2⤵
  PID:13576
- C:\Windows\System\xQgZVKh.exe
  C:\Windows\System\xQgZVKh.exe
  2⤵
  PID:13596
- C:\Windows\System\DsHqpVG.exe
  C:\Windows\System\DsHqpVG.exe
  2⤵
  PID:13620
- C:\Windows\System\owACReb.exe
  C:\Windows\System\owACReb.exe
  2⤵
  PID:13648
- C:\Windows\System\KeQDjso.exe
  C:\Windows\System\KeQDjso.exe
  2⤵
  PID:13680
- C:\Windows\System\TsKNnFJ.exe
  C:\Windows\System\TsKNnFJ.exe
  2⤵
  PID:13700
- C:\Windows\System\ZxdDkyn.exe
  C:\Windows\System\ZxdDkyn.exe
  2⤵
  PID:13724
- C:\Windows\System\ykbYMho.exe
  C:\Windows\System\ykbYMho.exe
  2⤵
  PID:13740
- C:\Windows\System\XhVjEcO.exe
  C:\Windows\System\XhVjEcO.exe
  2⤵
  PID:13756
- C:\Windows\System\GESSVca.exe
  C:\Windows\System\GESSVca.exe
  2⤵
  PID:13928
- C:\Windows\System\dtgQjrg.exe
  C:\Windows\System\dtgQjrg.exe
  2⤵
  PID:13948
- C:\Windows\System\IyqjxcN.exe
  C:\Windows\System\IyqjxcN.exe
  2⤵
  PID:13980
- C:\Windows\System\aaRkKbb.exe
  C:\Windows\System\aaRkKbb.exe
  2⤵
  PID:14016
- C:\Windows\System\UCGkyXS.exe
  C:\Windows\System\UCGkyXS.exe
  2⤵
  PID:14040
- C:\Windows\System\DMZesky.exe
  C:\Windows\System\DMZesky.exe
  2⤵
  PID:14056
- C:\Windows\System\QiGioMR.exe
  C:\Windows\System\QiGioMR.exe
  2⤵
  PID:14092
- C:\Windows\System\QVfUIdU.exe
  C:\Windows\System\QVfUIdU.exe
  2⤵
  PID:14112
- C:\Windows\System\gQzSySF.exe
  C:\Windows\System\gQzSySF.exe
  2⤵
  PID:14128
- C:\Windows\System\SpwySEm.exe
  C:\Windows\System\SpwySEm.exe
  2⤵
  PID:14160
- C:\Windows\System\kMBmjnd.exe
  C:\Windows\System\kMBmjnd.exe
  2⤵
  PID:14176
- C:\Windows\System\vRjSvQW.exe
  C:\Windows\System\vRjSvQW.exe
  2⤵
  PID:14192
- C:\Windows\System\YmRpXls.exe
  C:\Windows\System\YmRpXls.exe
  2⤵
  PID:14212
- C:\Windows\System\iuGvYaI.exe
  C:\Windows\System\iuGvYaI.exe
  2⤵
  PID:14240
- C:\Windows\System\qxViLql.exe
  C:\Windows\System\qxViLql.exe
  2⤵
  PID:14256
- C:\Windows\System\wVTPGpF.exe
  C:\Windows\System\wVTPGpF.exe
  2⤵
  PID:14280
- C:\Windows\System\JcSEaUx.exe
  C:\Windows\System\JcSEaUx.exe
  2⤵
  PID:14296
- C:\Windows\System\wOniXXb.exe
  C:\Windows\System\wOniXXb.exe
  2⤵
  PID:14324
- C:\Windows\System\TYGvEHy.exe
  C:\Windows\System\TYGvEHy.exe
  2⤵
  PID:11776
- C:\Windows\System\ouHeWUR.exe
  C:\Windows\System\ouHeWUR.exe
  2⤵
  PID:13020
- C:\Windows\System\hOehKVN.exe
  C:\Windows\System\hOehKVN.exe
  2⤵
  PID:13084
- C:\Windows\System\DpgusGs.exe
  C:\Windows\System\DpgusGs.exe
  2⤵
  PID:10356
- C:\Windows\System\npyUfow.exe
  C:\Windows\System\npyUfow.exe
  2⤵
  PID:13132
- C:\Windows\System\FlbnPyR.exe
  C:\Windows\System\FlbnPyR.exe
  2⤵
  PID:13168
- C:\Windows\System\BrcMGFW.exe
  C:\Windows\System\BrcMGFW.exe
  2⤵
  PID:12456
- C:\Windows\System\deCZAlT.exe
  C:\Windows\System\deCZAlT.exe
  2⤵
  PID:13240
- C:\Windows\System\VVEHxNY.exe
  C:\Windows\System\VVEHxNY.exe
  2⤵
  PID:9308
- C:\Windows\System\UhgQOyi.exe
  C:\Windows\System\UhgQOyi.exe
  2⤵
  PID:12572
- C:\Windows\System\lMqTyYV.exe
  C:\Windows\System\lMqTyYV.exe
  2⤵
  PID:10632
- C:\Windows\System\gxMUvVm.exe
  C:\Windows\System\gxMUvVm.exe
  2⤵
  PID:11808
- C:\Windows\System\RAGnZda.exe
  C:\Windows\System\RAGnZda.exe
  2⤵
  PID:12760
- C:\Windows\System\tJmxlqg.exe
  C:\Windows\System\tJmxlqg.exe
  2⤵
  PID:12800
- C:\Windows\System\WLhaqQH.exe
  C:\Windows\System\WLhaqQH.exe
  2⤵
  PID:12864
- C:\Windows\System\rZRWvpK.exe
  C:\Windows\System\rZRWvpK.exe
  2⤵
  PID:10672
- C:\Windows\System\EJvmUDz.exe
  C:\Windows\System\EJvmUDz.exe
  2⤵
  PID:12960
- C:\Windows\System\SwexKfR.exe
  C:\Windows\System\SwexKfR.exe
  2⤵
  PID:13108
- C:\Windows\System\qqDsjYV.exe
  C:\Windows\System\qqDsjYV.exe
  2⤵
  PID:12592
- C:\Windows\System\WGUkMAO.exe
  C:\Windows\System\WGUkMAO.exe
  2⤵
  PID:11376
- C:\Windows\System\QXONMET.exe
  C:\Windows\System\QXONMET.exe
  2⤵
  PID:12724
- C:\Windows\System\IvjwCnq.exe
  C:\Windows\System\IvjwCnq.exe
  2⤵
  PID:10980
- C:\Windows\System\AFRYWJF.exe
  C:\Windows\System\AFRYWJF.exe
  2⤵
  PID:12028
- C:\Windows\System\XdOOYQb.exe
  C:\Windows\System\XdOOYQb.exe
  2⤵
  PID:13320
- C:\Windows\System\RraHPPg.exe
  C:\Windows\System\RraHPPg.exe
  2⤵
  PID:13024
- C:\Windows\System\ZcWOZlA.exe
  C:\Windows\System\ZcWOZlA.exe
  2⤵
  PID:13060
- C:\Windows\System\EtTcsAG.exe
  C:\Windows\System\EtTcsAG.exe
  2⤵
  PID:13100
- C:\Windows\System\zdFJNsh.exe
  C:\Windows\System\zdFJNsh.exe
  2⤵
  PID:13528
- C:\Windows\System\mRtsAYp.exe
  C:\Windows\System\mRtsAYp.exe
  2⤵
  PID:13172
- C:\Windows\System\BNchUys.exe
  C:\Windows\System\BNchUys.exe
  2⤵
  PID:13212
- C:\Windows\System\JaKxCCx.exe
  C:\Windows\System\JaKxCCx.exe
  2⤵
  PID:13960
- C:\Windows\System\ACiqxdM.exe
  C:\Windows\System\ACiqxdM.exe
  2⤵
  PID:12088
- C:\Windows\System\qGbpBmx.exe
  C:\Windows\System\qGbpBmx.exe
  2⤵
  PID:12284
- C:\Windows\System\uxmGXsG.exe
  C:\Windows\System\uxmGXsG.exe
  2⤵
  PID:14152
- C:\Windows\System\WPCyCDU.exe
  C:\Windows\System\WPCyCDU.exe
  2⤵
  PID:14348
- C:\Windows\System\LnUQfHr.exe
  C:\Windows\System\LnUQfHr.exe
  2⤵
  PID:14388
- C:\Windows\System\YQYIMQJ.exe
  C:\Windows\System\YQYIMQJ.exe
  2⤵
  PID:14408
- C:\Windows\System\IaLfbVo.exe
  C:\Windows\System\IaLfbVo.exe
  2⤵
  PID:14436
- C:\Windows\System\UZXINTX.exe
  C:\Windows\System\UZXINTX.exe
  2⤵
  PID:14456
- C:\Windows\System\hUZgHIL.exe
  C:\Windows\System\hUZgHIL.exe
  2⤵
  PID:14488
- C:\Windows\System\cnQzqyH.exe
  C:\Windows\System\cnQzqyH.exe
  2⤵
  PID:14512
- C:\Windows\System\mRHwcDJ.exe
  C:\Windows\System\mRHwcDJ.exe
  2⤵
  PID:14532
- C:\Windows\System\NnXmrfs.exe
  C:\Windows\System\NnXmrfs.exe
  2⤵
  PID:14548
- C:\Windows\System\nEyqhUT.exe
  C:\Windows\System\nEyqhUT.exe
  2⤵
  PID:14568
- C:\Windows\System\bYMhwjE.exe
  C:\Windows\System\bYMhwjE.exe
  2⤵
  PID:14592
- C:\Windows\System\miblupo.exe
  C:\Windows\System\miblupo.exe
  2⤵
  PID:14612
- C:\Windows\System\sASigyk.exe
  C:\Windows\System\sASigyk.exe
  2⤵
  PID:14628
- C:\Windows\System\JfIiegF.exe
  C:\Windows\System\JfIiegF.exe
  2⤵
  PID:14648
- C:\Windows\System\MiRktYR.exe
  C:\Windows\System\MiRktYR.exe
  2⤵
  PID:14672
- C:\Windows\System\QVTylDR.exe
  C:\Windows\System\QVTylDR.exe
  2⤵
  PID:14704
- C:\Windows\System\ZMQdUlC.exe
  C:\Windows\System\ZMQdUlC.exe
  2⤵
  PID:14724
- C:\Windows\System\VfYdRhy.exe
  C:\Windows\System\VfYdRhy.exe
  2⤵
  PID:14744
- C:\Windows\System\klKrrKf.exe
  C:\Windows\System\klKrrKf.exe
  2⤵
  PID:14764
- C:\Windows\System\YwBcJUL.exe
  C:\Windows\System\YwBcJUL.exe
  2⤵
  PID:14784
- C:\Windows\System\rzPQEtr.exe
  C:\Windows\System\rzPQEtr.exe
  2⤵
  PID:14804
- C:\Windows\System\IyhHPtZ.exe
  C:\Windows\System\IyhHPtZ.exe
  2⤵
  PID:14824
- C:\Windows\System\rNTDWCp.exe
  C:\Windows\System\rNTDWCp.exe
  2⤵
  PID:14844
- C:\Windows\System\JXuKgmJ.exe
  C:\Windows\System\JXuKgmJ.exe
  2⤵
  PID:14860
- C:\Windows\System\olTPsia.exe
  C:\Windows\System\olTPsia.exe
  2⤵
  PID:14884
- C:\Windows\System\nOESjfk.exe
  C:\Windows\System\nOESjfk.exe
  2⤵
  PID:14912
- C:\Windows\System\cfhGWSb.exe
  C:\Windows\System\cfhGWSb.exe
  2⤵
  PID:14936
- C:\Windows\System\OMfQVyf.exe
  C:\Windows\System\OMfQVyf.exe
  2⤵
  PID:14960
- C:\Windows\System\uFXXukq.exe
  C:\Windows\System\uFXXukq.exe
  2⤵
  PID:14992
- C:\Windows\System\HBZSMBh.exe
  C:\Windows\System\HBZSMBh.exe
  2⤵
  PID:15028
- C:\Windows\System\KUHJqOX.exe
  C:\Windows\System\KUHJqOX.exe
  2⤵
  PID:15048
- C:\Windows\System\cxDImRH.exe
  C:\Windows\System\cxDImRH.exe
  2⤵
  PID:15076
- C:\Windows\System\LqXlwWH.exe
  C:\Windows\System\LqXlwWH.exe
  2⤵
  PID:15096
- C:\Windows\System\wZozltE.exe
  C:\Windows\System\wZozltE.exe
  2⤵
  PID:15116
- C:\Windows\System\VyvVyZE.exe
  C:\Windows\System\VyvVyZE.exe
  2⤵
  PID:15144
- C:\Windows\System\dMrzfJZ.exe
  C:\Windows\System\dMrzfJZ.exe
  2⤵
  PID:15160
- C:\Windows\System\oKsEERa.exe
  C:\Windows\System\oKsEERa.exe
  2⤵
  PID:15184
- C:\Windows\System\jPTrGna.exe
  C:\Windows\System\jPTrGna.exe
  2⤵
  PID:15212
- C:\Windows\System\GORNfRy.exe
  C:\Windows\System\GORNfRy.exe
  2⤵
  PID:15228
- C:\Windows\System\hrRjxZK.exe
  C:\Windows\System\hrRjxZK.exe
  2⤵
  PID:15244
- C:\Windows\System\dTuKdaL.exe
  C:\Windows\System\dTuKdaL.exe
  2⤵
  PID:15260
- C:\Windows\System\XmuleDs.exe
  C:\Windows\System\XmuleDs.exe
  2⤵
  PID:15280
- C:\Windows\System\xNnBhdH.exe
  C:\Windows\System\xNnBhdH.exe
  2⤵
  PID:15312
- C:\Windows\System\hAJoLDQ.exe
  C:\Windows\System\hAJoLDQ.exe
  2⤵
  PID:15336
- C:\Windows\System\aPdyYLR.exe
  C:\Windows\System\aPdyYLR.exe
  2⤵
  PID:15352
- C:\Windows\System\cnfRlWi.exe
  C:\Windows\System\cnfRlWi.exe
  2⤵
  PID:11928
- C:\Windows\System\CGFOPcH.exe
  C:\Windows\System\CGFOPcH.exe
  2⤵
  PID:13000
- C:\Windows\System\gotyBmQ.exe
  C:\Windows\System\gotyBmQ.exe
  2⤵
  PID:13372
- C:\Windows\System\bNhVCZL.exe
  C:\Windows\System\bNhVCZL.exe
  2⤵
  PID:13236
- C:\Windows\System\XpStDKa.exe
  C:\Windows\System\XpStDKa.exe
  2⤵
  PID:13548
- C:\Windows\System\FxRLxmA.exe
  C:\Windows\System\FxRLxmA.exe
  2⤵
  PID:12784
- C:\Windows\System\KfoSiws.exe
  C:\Windows\System\KfoSiws.exe
  2⤵
  PID:13628
- C:\Windows\System\XaKyKIt.exe
  C:\Windows\System\XaKyKIt.exe
  2⤵
  PID:13264
- C:\Windows\System\izOKRcD.exe
  C:\Windows\System\izOKRcD.exe
  2⤵
  PID:13920
- C:\Windows\System\JSJsbFb.exe
  C:\Windows\System\JSJsbFb.exe
  2⤵
  PID:12564
- C:\Windows\System\TtLgdni.exe
  C:\Windows\System\TtLgdni.exe
  2⤵
  PID:12884
- C:\Windows\System\CafgDKb.exe
  C:\Windows\System\CafgDKb.exe
  2⤵
  PID:13996
- C:\Windows\System\qkMJeYL.exe
  C:\Windows\System\qkMJeYL.exe
  2⤵
  PID:13352
- C:\Windows\System\LwFQUCf.exe
  C:\Windows\System\LwFQUCf.exe
  2⤵
  PID:13076
- C:\Windows\System\IidEktk.exe
  C:\Windows\System\IidEktk.exe
  2⤵
  PID:13816
- C:\Windows\System\kknGRnG.exe
  C:\Windows\System\kknGRnG.exe
  2⤵
  PID:13688
- C:\Windows\System\pwerJcN.exe
  C:\Windows\System\pwerJcN.exe
  2⤵
  PID:10512
- C:\Windows\System\EOLOfHH.exe
  C:\Windows\System\EOLOfHH.exe
  2⤵
  PID:14372
- C:\Windows\System\vxGMHfo.exe
  C:\Windows\System\vxGMHfo.exe
  2⤵
  PID:14420
- C:\Windows\System\YpLiNGP.exe
  C:\Windows\System\YpLiNGP.exe
  2⤵
  PID:14308
- C:\Windows\System\qvbMjzC.exe
  C:\Windows\System\qvbMjzC.exe
  2⤵
  PID:10992
- C:\Windows\System\QoPnKGY.exe
  C:\Windows\System\QoPnKGY.exe
  2⤵
  PID:14584
- C:\Windows\System\yZvBmRo.exe
  C:\Windows\System\yZvBmRo.exe
  2⤵
  PID:14640
- C:\Windows\System\xOPMtCG.exe
  C:\Windows\System\xOPMtCG.exe
  2⤵
  PID:15368
- C:\Windows\System\ySuFiUL.exe
  C:\Windows\System\ySuFiUL.exe
  2⤵
  PID:15384
- C:\Windows\System\tOXuuxk.exe
  C:\Windows\System\tOXuuxk.exe
  2⤵
  PID:15400
- C:\Windows\System\tjCZypM.exe
  C:\Windows\System\tjCZypM.exe
  2⤵
  PID:15428
- C:\Windows\System\fNZvUqa.exe
  C:\Windows\System\fNZvUqa.exe
  2⤵
  PID:15452
- C:\Windows\System\jLpLVNP.exe
  C:\Windows\System\jLpLVNP.exe
  2⤵
  PID:15472
- C:\Windows\System\bjwatVO.exe
  C:\Windows\System\bjwatVO.exe
  2⤵
  PID:15500
- C:\Windows\System\SDkRSGy.exe
  C:\Windows\System\SDkRSGy.exe
  2⤵
  PID:15520
- C:\Windows\System\cldUmjW.exe
  C:\Windows\System\cldUmjW.exe
  2⤵
  PID:15552
- C:\Windows\System\AcEzaWU.exe
  C:\Windows\System\AcEzaWU.exe
  2⤵
  PID:15576
- C:\Windows\System\YDKEPDR.exe
  C:\Windows\System\YDKEPDR.exe
  2⤵
  PID:15600
- C:\Windows\System\diOXZgh.exe
  C:\Windows\System\diOXZgh.exe
  2⤵
  PID:15624
- C:\Windows\System\WBadAUJ.exe
  C:\Windows\System\WBadAUJ.exe
  2⤵
  PID:15644
- C:\Windows\System\hKipAJP.exe
  C:\Windows\System\hKipAJP.exe
  2⤵
  PID:15672
- C:\Windows\System\XKrjHRi.exe
  C:\Windows\System\XKrjHRi.exe
  2⤵
  PID:15688
- C:\Windows\System\ckdxBuC.exe
  C:\Windows\System\ckdxBuC.exe
  2⤵
  PID:15708
- C:\Windows\System\WaVPhfa.exe
  C:\Windows\System\WaVPhfa.exe
  2⤵
  PID:15740
- C:\Windows\System\mxtbKge.exe
  C:\Windows\System\mxtbKge.exe
  2⤵
  PID:15756
- C:\Windows\System\jufVTnF.exe
  C:\Windows\System\jufVTnF.exe
  2⤵
  PID:15784
- C:\Windows\System\FfhnWQb.exe
  C:\Windows\System\FfhnWQb.exe
  2⤵
  PID:15812
- C:\Windows\System\gqRoNXm.exe
  C:\Windows\System\gqRoNXm.exe
  2⤵
  PID:15836
- C:\Windows\System\GXwShLl.exe
  C:\Windows\System\GXwShLl.exe
  2⤵
  PID:15864
- C:\Windows\System\UXUinCS.exe
  C:\Windows\System\UXUinCS.exe
  2⤵
  PID:15892
- C:\Windows\System\KXVPXZi.exe
  C:\Windows\System\KXVPXZi.exe
  2⤵
  PID:15916
- C:\Windows\System\fjCLwDj.exe
  C:\Windows\System\fjCLwDj.exe
  2⤵
  PID:15936
- C:\Windows\System\SPzZfLp.exe
  C:\Windows\System\SPzZfLp.exe
  2⤵
  PID:15956
- C:\Windows\System\LMDRglM.exe
  C:\Windows\System\LMDRglM.exe
  2⤵
  PID:15976
- C:\Windows\System\hWLerCu.exe
  C:\Windows\System\hWLerCu.exe
  2⤵
  PID:15996
- C:\Windows\System\UMsUDvA.exe
  C:\Windows\System\UMsUDvA.exe
  2⤵
  PID:16016
- C:\Windows\System\ixSqtOT.exe
  C:\Windows\System\ixSqtOT.exe
  2⤵
  PID:16040
- C:\Windows\System\OeYVSLC.exe
  C:\Windows\System\OeYVSLC.exe
  2⤵
  PID:16072
- C:\Windows\System\yLqFOed.exe
  C:\Windows\System\yLqFOed.exe
  2⤵
  PID:16092
- C:\Windows\System\VFatlDv.exe
  C:\Windows\System\VFatlDv.exe
  2⤵
  PID:16108
- C:\Windows\System\vrlAyBO.exe
  C:\Windows\System\vrlAyBO.exe
  2⤵
  PID:16128
- C:\Windows\System\fUxFFvB.exe
  C:\Windows\System\fUxFFvB.exe
  2⤵
  PID:16148
- C:\Windows\System\FIOhakA.exe
  C:\Windows\System\FIOhakA.exe
  2⤵
  PID:16176
- C:\Windows\System\EgeFtNo.exe
  C:\Windows\System\EgeFtNo.exe
  2⤵
  PID:16204
- C:\Windows\System\PXGeobr.exe
  C:\Windows\System\PXGeobr.exe
  2⤵
  PID:16228
- C:\Windows\System\lhTZTWe.exe
  C:\Windows\System\lhTZTWe.exe
  2⤵
  PID:16256
- C:\Windows\System\GzvARLg.exe
  C:\Windows\System\GzvARLg.exe
  2⤵
  PID:16276
- C:\Windows\System\oMjbaNf.exe
  C:\Windows\System\oMjbaNf.exe
  2⤵
  PID:16312
- C:\Windows\System\UTxczoE.exe
  C:\Windows\System\UTxczoE.exe
  2⤵
  PID:16336
- C:\Windows\System\djhUlEk.exe
  C:\Windows\System\djhUlEk.exe
  2⤵
  PID:16360
- C:\Windows\System\FbkfCKJ.exe
  C:\Windows\System\FbkfCKJ.exe
  2⤵
  PID:16380
- C:\Windows\System\DjHlGvC.exe
  C:\Windows\System\DjHlGvC.exe
  2⤵
  PID:12824
- C:\Windows\System\htjsSDn.exe
  C:\Windows\System\htjsSDn.exe
  2⤵
  PID:14908
- C:\Windows\System\uNUdbWG.exe
  C:\Windows\System\uNUdbWG.exe
  2⤵
  PID:12936
- C:\Windows\System\tfLeemb.exe
  C:\Windows\System\tfLeemb.exe
  2⤵
  PID:15072
- C:\Windows\System\kAFzZly.exe
  C:\Windows\System\kAFzZly.exe
  2⤵
  PID:15156
- C:\Windows\System\fseqEcR.exe
  C:\Windows\System\fseqEcR.exe
  2⤵
  PID:14052
- C:\Windows\System\eJPzeNJ.exe
  C:\Windows\System\eJPzeNJ.exe
  2⤵
  PID:14124
- C:\Windows\System\FwommJf.exe
  C:\Windows\System\FwommJf.exe
  2⤵
  PID:13608
- C:\Windows\System\aumGPUW.exe
  C:\Windows\System\aumGPUW.exe
  2⤵
  PID:14188
- C:\Windows\System\ZDpqNnF.exe
  C:\Windows\System\ZDpqNnF.exe
  2⤵
  PID:12448
- C:\Windows\System\TuQUiFo.exe
  C:\Windows\System\TuQUiFo.exe
  2⤵
  PID:14444
- C:\Windows\System\gfEnwYk.exe
  C:\Windows\System\gfEnwYk.exe
  2⤵
  PID:14468
- C:\Windows\System\kGJSjPT.exe
  C:\Windows\System\kGJSjPT.exe
  2⤵
  PID:13988
- C:\Windows\System\RhKUKLk.exe
  C:\Windows\System\RhKUKLk.exe
  2⤵
  PID:13112
- C:\Windows\System\HmmBELw.exe
  C:\Windows\System\HmmBELw.exe
  2⤵
  PID:14344
- C:\Windows\System\akKChqN.exe
  C:\Windows\System\akKChqN.exe
  2⤵
  PID:14288
- C:\Windows\System\pYgYwhV.exe
  C:\Windows\System\pYgYwhV.exe
  2⤵
  PID:12492
- C:\Windows\System\TjBtjNO.exe
  C:\Windows\System\TjBtjNO.exe
  2⤵
  PID:14624
- C:\Windows\System\OUmNsZd.exe
  C:\Windows\System\OUmNsZd.exe
  2⤵
  PID:14796
- C:\Windows\System\Kkcaxgk.exe
  C:\Windows\System\Kkcaxgk.exe
  2⤵
  PID:15412
- C:\Windows\System\mcSaUMR.exe
  C:\Windows\System\mcSaUMR.exe
  2⤵
  PID:15448
- C:\Windows\System\ymbWGVA.exe
  C:\Windows\System\ymbWGVA.exe
  2⤵
  PID:16404
- C:\Windows\System\regaRKw.exe
  C:\Windows\System\regaRKw.exe
  2⤵
  PID:16424
- C:\Windows\System\ivFBVdx.exe
  C:\Windows\System\ivFBVdx.exe
  2⤵
  PID:16456
- C:\Windows\System\DeHMblh.exe
  C:\Windows\System\DeHMblh.exe
  2⤵
  PID:16476
- C:\Windows\System\UKWehNk.exe
  C:\Windows\System\UKWehNk.exe
  2⤵
  PID:16504
- C:\Windows\System\mINbQAK.exe
  C:\Windows\System\mINbQAK.exe
  2⤵
  PID:16528
- C:\Windows\System\nQSOtNd.exe
  C:\Windows\System\nQSOtNd.exe
  2⤵
  PID:16544
- C:\Windows\System\omeQDfw.exe
  C:\Windows\System\omeQDfw.exe
  2⤵
  PID:16568
- C:\Windows\System\SYNUkIa.exe
  C:\Windows\System\SYNUkIa.exe
  2⤵
  PID:16584
- C:\Windows\System\iJGlRoG.exe
  C:\Windows\System\iJGlRoG.exe
  2⤵
  PID:16616
- C:\Windows\System\CKFIjmf.exe
  C:\Windows\System\CKFIjmf.exe
  2⤵
  PID:16636
- C:\Windows\System\pcEJZkS.exe
  C:\Windows\System\pcEJZkS.exe
  2⤵
  PID:16652
- C:\Windows\System\BKSeurL.exe
  C:\Windows\System\BKSeurL.exe
  2⤵
  PID:17344
- C:\Windows\System\NuknEdE.exe
  C:\Windows\System\NuknEdE.exe
  2⤵
  PID:17368
- C:\Windows\System\GcPLIOl.exe
  C:\Windows\System\GcPLIOl.exe
  2⤵
  PID:17400
- C:\Windows\System\neWJCoV.exe
  C:\Windows\System\neWJCoV.exe
  2⤵
  PID:15460
- C:\Windows\System\PgGfhGV.exe
  C:\Windows\System\PgGfhGV.exe
  2⤵
  PID:15508
- C:\Windows\System\RURBkHi.exe
  C:\Windows\System\RURBkHi.exe
  2⤵
  PID:13064
- C:\Windows\System\lRdTOCb.exe
  C:\Windows\System\lRdTOCb.exe
  2⤵
  PID:15560
- C:\Windows\System\OhfwEWA.exe
  C:\Windows\System\OhfwEWA.exe
  2⤵
  PID:15004
- C:\Windows\System\uNvQGxd.exe
  C:\Windows\System\uNvQGxd.exe
  2⤵
  PID:15036
- C:\Windows\System\gmYCVXM.exe
  C:\Windows\System\gmYCVXM.exe
  2⤵
  PID:15664
- C:\Windows\System\GbtUAjM.exe
  C:\Windows\System\GbtUAjM.exe
  2⤵
  PID:15684
- C:\Windows\System\SZwOCAw.exe
  C:\Windows\System\SZwOCAw.exe
  2⤵
  PID:15720
- C:\Windows\System\nHKECij.exe
  C:\Windows\System\nHKECij.exe
  2⤵
  PID:13520
- C:\Windows\System\dthWoGy.exe
  C:\Windows\System\dthWoGy.exe
  2⤵
  PID:15276

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:15848

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
1⤵
PID:14648

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
1⤵
PID:13236

C:\Windows\servicing\TrustedInstaller.exe
C:\Windows\servicing\TrustedInstaller.exe
1⤵
PID:16040

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\BBdNZLH.exe

Filesize
1.0MB

MD5
397e00ee833e8f62d4f09ff9423a31fb

SHA1
f9267af7363c9789e12bf1b6d5f4f9ae40d7cd18

SHA256
03c37e3b1da0f4a9cee6659031eb816dba67d7f43a351f08c26fa86dd3af0985

SHA512
8ca04867b5ad75fddfb8e102aae3bcc3100c849d97b138e5e81e1fa57f9eb86e70f3c2edd12dc539d71062ded648313084f82c1a784aa9e05cffa7829306b86d

Download Submit
C:\Windows\System\BPJDOlV.exe

Filesize
1.0MB

MD5
7f6da3442befa66298834ef562c51694

SHA1
cb8353a87a88b68c8e23474b7ebeb432e63ef19a

SHA256
603b96b791ef8a19b7c8d3bfbb6bffb2cdc6f4c273b543db3508ee7560c3dd7d

SHA512
b1aa3277ca51ba5a2feb454194d6a1e3b0b232a0ed2ec01ffbf9f6b7c36cdcb50dc6b5501005fe89099222f8225c1c69b6df5dacc8fd8819f0d90f848b77cd73

Download Submit
C:\Windows\System\BbWjFer.exe

Filesize
1.0MB

MD5
f7fa971f01e1b70b8d26c35d715ecd71

SHA1
fa8de79bf4f712e467d88e60d6c3719a96cf9180

SHA256
c162b61657f7819a73797c7023d317fb29958b722cad8630f4095871d3a94e09

SHA512
98e6dc7d167d8dfd21d48963e7e6bee283e1764cca06a33fc0d8b3b75e9fc0b9437dd4610b669f54666ef9c4b2688691b99c33727005a568a47bbadf28139a6b

Download Submit
C:\Windows\System\CEdfLTc.exe

Filesize
1.0MB

MD5
8399a2deb523eac4992786e3c934c39c

SHA1
73cadbb9b422b052fcfb2779d871f0b4a96c419e

SHA256
89ed8d028276adeb405d1efc0a3d1f9da763c0c868347bc2a84f5842b99b79af

SHA512
a258244d88f5b5b666ef9efc7ad89002f685dd6cfffa04d502797308e32892251dbe73f00d0a27f3985c56ce634de01b9f67d2bd693fbbcd29f4aa0c4c1f12ac

Download Submit
C:\Windows\System\CZiEhwe.exe

Filesize
1.0MB

MD5
732b511386597ef968feddd37e7f6129

SHA1
ca84a21e2aa68274502e2901c9208ce9eba825b7

SHA256
2b3fab6c06aec500951e2446ebdcffda40c979036466050407ef6f3a476057e4

SHA512
8d4e1c57b5319d1894e8344ca8d280afaa89f5abed2bbf02a9f2a0dddac9b9e89dffe50602bbef583104d8d6cba019d2b9173bd471f152646268e01d8538dd43

Download Submit
C:\Windows\System\EjAKMFG.exe

Filesize
1.0MB

MD5
2398cbf6d03408b94addb674ec4807b8

SHA1
644e1fa1884c4c70f32f2c12b442a73f9fe73c00

SHA256
8d78b3faecaf156b76e85c1ed7174622e502f097d4d4d821a545bed98f957b22

SHA512
82e4e0873c2ff3202fe08dfdd600f82274de6a2b266fb3142694df3c43a20f662db579e569b58ca454c3df2688a3c4e58a74eb96d83c04de0a5fddaee43e369c

Download Submit
C:\Windows\System\FmGZpNr.exe

Filesize
1.0MB

MD5
e7f80abddc9e612dc5c82a90c50f9ec2

SHA1
82dd3979a5af35c9c4becde1aa84feae42c34116

SHA256
ca6d3d58acff8a544a336b6cb45241bf65cf5778e2cd02017eb9bc534843640e

SHA512
1a1da199c66b75786c4bf12f6f48fcb99b097c86bc533c4977e3e9b08a4a57204f757718dd23badd64e8d50f533d6dc2ced92829192ec4610e868e5c38e76a7b

Download Submit
C:\Windows\System\GIqBeFh.exe

Filesize
1.0MB

MD5
9fce33cd9335c22a16cf1cac93f43461

SHA1
cdaf04d0e429aa97b30dbf21a7b794a0db88cefe

SHA256
45da9c5734518fadb9b519c4a1ad85d58754d4ff6316160185009954a3fe9359

SHA512
9aa743f74697a1970a798047de8f2341982c366c756a5cba6eaa8a14ddfc68db93bc5e37bf95da6d588a09c33ae80669554f775e7daef6054eba5c3e14723dc7

Download Submit
C:\Windows\System\MaybNdO.exe

Filesize
1.0MB

MD5
f3c3e8ad9f9b6c133f03558ae965b3e1

SHA1
4629060ccbc45430dee51816c70fc34305297e2d

SHA256
4240e0a2d7cbdbc374d4787b336120b8bd7b6decd3cb1fc6ffb8138ea5de3f04

SHA512
4d17ba726d6bed086f75d1c4d0bbf4d731ab0ad6133e7841d36c95b8749978cefca3098e49a759e360610dff15f598e245085450400b763bac89bddf0581fdca

Download Submit
C:\Windows\System\OffOkuv.exe

Filesize
1.0MB

MD5
e968ca61bea05096b60149a35d2f8d2f

SHA1
1bc3f82ad7bffe33fc2cf7cf84850132a75bc1cc

SHA256
e76bddc498e0bb8cd6d3e89e3cf8b9c8a5c48abbae3e0d65db16db48481ddbef

SHA512
3dc890a3958143c8ca6170e6146a0647ad0160aca129d62cfd5825d1ca1f2c4cbc5ce0a2547c3462f0cd63e7296c66ef8b78e1dff0439ec456e5a71a30df6df0

Download Submit
C:\Windows\System\PBLRdjV.exe

Filesize
1.0MB

MD5
ff8ba082ec0dda5da4d36fe3d1b1df65

SHA1
f8f034dfc89b00b4350bee14221722ccd08637bb

SHA256
3a54a1776806d68e9fa44f15b5ee037b8e08de7a791f87b39595aa464d47850e

SHA512
fd6256039e96f9cf75c9bf134fa47955efd0049cb794baa860309679d44aa8a9b30e3a51e11957a7c7f194088aa004cb713a0ae32c5636f00de56788bf9c4aed

Download Submit
C:\Windows\System\QzFuPlE.exe

Filesize
1.0MB

MD5
a8afa9962604a1f58c6c22827041bc2f

SHA1
8f70fda47f4a7e67681c851ce90a88ab1ef6eb02

SHA256
299e2384a75036a989a840f91dc645ed9322f5e1264bb84d2f22f5d9f0664cfe

SHA512
e12876f4e99ab7ab0bd8720d839afa7fab008e5cc60d7c8a83bda6e5108683e15f55ef6a60d659d80bc7ef1fb12a2c7d8d1268e01bb82b3d606203aa339c0621

Download Submit
C:\Windows\System\TYRLAUo.exe

Filesize
1.0MB

MD5
a55e06917ddc41acff5b778c2da3652c

SHA1
650250f71963d640f117e124c5d6afe16b81ec34

SHA256
08a2fb830180a31a84b701bace98f472c9fc0ac918c6636f40dfd68b6a862275

SHA512
8de0c6e751bd65bfadc2fc1016136b02faf3a4384b1fb616b428372efcfb5c0609f6c50f76c7a7bd46dc955e801b8748eb8a27578422a3facd86a56a9cba9709

Download Submit
C:\Windows\System\VOcsehV.exe

Filesize
1.0MB

MD5
a4781d7af5b892e9afdd150dac1b2acd

SHA1
f91c3acb254bdf32fb36929f855ac5ac56b27d4d

SHA256
c112b1ffa4e7087746f0e27c7dcffc3912b934c51fab366c9e5c05742bbc6b68

SHA512
d481e2febe7a06810984470a41741fa8cec301f7689faba895a6c8ec4720ccd69609ca19a37e27b28e37a4a9afb8794e223295a892cc1712f63449ecf6da349e

Download Submit
C:\Windows\System\ZapWTGo.exe

Filesize
1.0MB

MD5
4c8c3daee5f0cc125f4524a9f71f19f8

SHA1
5d69cde6ce160d8d8e5a9b42c5d4cbb80b1c95ba

SHA256
4bcf6c633b4a54ea65689d498d2aa60566da0d44080527e85ae9b42eb3b823a0

SHA512
bcde3e22663fecefc0b21d80bc21c8d4e4398a8bb854c17a8b84909867a8bc9e900e239fb301afc0e171bbbfe2c8db4238e5d9cf00eac7ecbb8d8454117d4baa

Download Submit
C:\Windows\System\ZrwswCe.exe

Filesize
1.0MB

MD5
4e3e1465dbedce384f6446c3479da441

SHA1
cf53a885f2286e8c6075470e009b1bbbfcc663a6

SHA256
31ff79ed3742aedb0538264ec0a40ef29729ed7d5591696190c16e6fa54b5d32

SHA512
e11ae0866cfe7cab18be19d6f2f9f2b88543c38e0efcc16a788d96ebe0de5e4100e54867a02fd738afd9d2a441f8d130d7f0938655e929ed431daa6efd0f4100

Download Submit
C:\Windows\System\coovslj.exe

Filesize
1.0MB

MD5
ec742d3a24a8b875b5f2a9da82191f90

SHA1
164e53907956b2610a976681a6f3beb5d10441ef

SHA256
52b84f6dead3e413a5170a6ffc403029880e32be0c7cfe6d0adae2cf176b1697

SHA512
68e6be785832a1d7d6c08e29158cae72a33000f405a10580a0f08545d8ee9b8ae289837c9f84902456a4aab2d51e827ddcb70ab31d3f562f28cda3891c23a161

Download Submit
C:\Windows\System\dPtqzQL.exe

Filesize
1.0MB

MD5
67422600fb589be4394d1c3daab943a0

SHA1
79e0ed99b63a65925164ddda6817f0503411170f

SHA256
fcd6387ffed39d9167ea917acf4d8c84a34bbb3ff9193d65c78f713e63797756

SHA512
b5417a48dd58ec395b0e04dcbea052a9853e459b18610254b18783c162a39ccc66f4141c8a3eb41d0479c95c4b9d551cbcdbfa316854ac1d3e4d1408de43ecf4

Download Submit
C:\Windows\System\fEXDUmc.exe

Filesize
1.0MB

MD5
969985e226697dc173bb609c7a4b16f4

SHA1
72900f7493dcebfc094d6ec000f0b964230224ed

SHA256
81c6f5e215548475defdaf8032cb3220940bf0909a88c0e6e09e704375d1cc9d

SHA512
9bd544043261a6bb0b602e16411fa871aed8a90a230345fc1913f9b20c7be5debde274e0deaf0a44781afd2a8d54020424eff60d8765970799cc706b70ef047e

Download Submit
C:\Windows\System\gGSPqAc.exe

Filesize
1.0MB

MD5
a86f0c8f827c14575988419f8daf7520

SHA1
bb2b74ed4be974613f97a62da2fa71f39f9f4495

SHA256
d686d63fdcb180b1a338009604416ecbf340a99edc46aa4593a54e279ee7f187

SHA512
d4fa424ec7aade59c6d01ea6bfaf1ff4787c24ab78c5536287f2a43d8a1c7356729bd015c298ee2e7585f1b9f20cf20da5c09067e1ceaee27a8ec00a9c612799

Download Submit
C:\Windows\System\hPqrLTH.exe

Filesize
1.0MB

MD5
765ce6fd63b8036da12ba0d1fb63bca0

SHA1
c2dc2945cc468059f08914064ae5145ab4a70edd

SHA256
0b016aac1eaac09a8ae9cf5f216deae66d437a86e84050473d2aecb54e926756

SHA512
5b1ef9aed3a8c4b123df9a4a8a8c246043325967bf12d235bb0a832cc7ec0176c453962b65cc6fcd7c2e80f322643b09dcf087d0471395729776d1542975d5ea

Download Submit
C:\Windows\System\ibrkGkI.exe

Filesize
1.0MB

MD5
5be230c995cb816868d3cea19d763d1c

SHA1
c4b4ea42e6add03ca35a005e1d49f068605d244e

SHA256
e0a9d5f40733bcf2032f1ed741f179bf2ae6971baf02f7590ba66228298cc1ad

SHA512
a4f3511a83ef0f6dff1f2a465d441a03f86cc40172d9ab511d0760461b7abcea03c395bf54c3b478dcb478936b6b59076d19ac316d8bea39515cb75bdae0a3b5

Download Submit
C:\Windows\System\kJVVGQV.exe

Filesize
1.0MB

MD5
451d0b6352a4c70adee0f9bd8fff39cd

SHA1
e4c073dc5e551d6b8ddc70569f770b7a42262169

SHA256
ea29ef774ee198e4618424280f6b2130ede50b4a4c91d242804a4c06d3f266e9

SHA512
4b030dfa38be160dc764476ad8553ce2d5d700c682efec99141d28602ed8c182d19481c0eaa17f3e7508097a256b9cfd69a275559445076b323931f847e9f7ad

Download Submit
C:\Windows\System\mVCCQbX.exe

Filesize
1.0MB

MD5
5462b1b82e6c2c60c811eb890df94179

SHA1
8d6da9ec5900ed1e59d8f45ffb87ea73151df5f5

SHA256
a3f70ac683bac4838fda3a824d335e794e942a1ff026bf737401776d965840a0

SHA512
7961b7d318c08d8d008d0b166a70f6310b0331c9d12fa95a6edc79fbe20a04d57b9be40a77da0c6d1ec23a49309dc35edfd882aee675de8eae891d55357d2fcd

Download Submit
C:\Windows\System\mqpWrZt.exe

Filesize
1.0MB

MD5
9c38df2a2c67f57c478f739897112275

SHA1
93edc1b66fa051f3b0b29400c9b6c34d34a70184

SHA256
7d729f37e149217114d44fc09d9b205f826721ccb91114464ac994aa68a8341a

SHA512
298092b10a7b6ed1e1c1a688ca83d3a413a1e247466efacae084adbd6c1959b10762ba5feab3212e56cc5cf1fbf11695c0fd1d369fc06c9b50f83266113e07a6

Download Submit
C:\Windows\System\qnTXbCM.exe

Filesize
1.0MB

MD5
dcf10dce7199dfdacf72233f4e6bbb6d

SHA1
7a326481ed636bd1f7738034089469a0423b4ea5

SHA256
3cddb72a8e93e57972da602a1a60c8197704951a21e70d9bed887f40a4e6f17c

SHA512
f5911e11c62b0044fbfe77e942f88db38d28cf611e865e55ed2468987f3b896dc58c5f9ee9f07115bf514a8525d6b7572341dc798fa865307942e0caf88a00a3

Download Submit
C:\Windows\System\rXEhrNb.exe

Filesize
1.0MB

MD5
bb5436fd1a8860408062756a7734f255

SHA1
ecab27ffa88230c4d135f60be75276db60fd351d

SHA256
235720cae02765cdf955cd69429866cb92c9c71a60649f44929f5cd1f981ee14

SHA512
9ffa25fad88f411bdffbe2d672ef24c15dc65b5f59be08f954b5eebb5758fe875b96f84cce7e981c83c791138ca9595e4bed884256b639268fbf7ed0ece9541e

Download Submit
C:\Windows\System\sQykzXY.exe

Filesize
1.0MB

MD5
e211143ac7bf0d644145d656af5297c4

SHA1
f362680f6db86855a38a32dfc727ad47e1435d0a

SHA256
65df1a6bd1a7dba1348868655cff303dd9240b73cfa45ee06b7ad6f3f70d9a4c

SHA512
64f90cd4f7733245e10135c5d2f485321213c2cff86403913153b519a0c2e8dabbdcfac1a9faf9c1fe110d2b4f696eab276b9ad7eea88bf7342ad4a01476dfe2

Download Submit
C:\Windows\System\tlvXDbR.exe

Filesize
1.0MB

MD5
751feb5e2b3d5ed9d3725405f0fb17d3

SHA1
c92ea1a520589999f2373c77dc53326bdfeeb970

SHA256
8c7d31d3cd0766e78a60bfd7cf08b57848cfcdc722631e5d72b976960366953d

SHA512
f0eb37978a90c7617683bbb207411ef97d8201e55771f17332d8c21702ad64202f15b4d4eb664a27a84dff80b973f7586a6265ed4942ba28fe1d0a8c58519625

Download Submit
C:\Windows\System\waIPNYm.exe

Filesize
1.0MB

MD5
f2a9d5cc0b63e8a43d417fbdecc89df6

SHA1
b6c1f0c4acc5ee3d8de5e5e8609b4bfd5a6d5722

SHA256
2a7a7307352d5da4e548616320f3ba51169a6e3b5398faa6c0dac1fb79c6bcf5

SHA512
54054f2f8bf00992c297a6fccc0a60accb2d0f7938a62ae41511ffb1238df37a82302dac9c53b2326234d67114ba040fb3aa6aa0f6273ac1fba904850e4ebcad

Download Submit
C:\Windows\System\yMfVtsg.exe

Filesize
1.0MB

MD5
ce6241b3ba66fa3fe86a1ac3b38f23cd

SHA1
a66c200bc449a7420797f17ca5dd251beec1c40d

SHA256
de57ad9dac5661d213db45d241e76eb7c33394caab633d69706cb9f3f5261f3e

SHA512
e788e6105953c8e61549593cee1e329585861b4c35df64ae0541cbc4e5a21a5a56e1910a18db3176719d29d56adcf992f90f7570fae8e30363dcf9a093b3b9a5

Download Submit
C:\Windows\System\ygZtJLI.exe

Filesize
1.0MB

MD5
6efd49cdcb6dd5056ccd5555c73fe076

SHA1
cd116debfc0a6b43698575a88b82f338b88797ba

SHA256
9ca2af16e915ae2adc1ce394e0d075cad869700bed1b6beb3b09cdbbdb24df8d

SHA512
4170f612c8e696b89a4ace55556b908e304760560b0fb44cd93a2f48649e97d7e16c2daa1b4926db3768a47bf23dbd8edb41e38f97e0343e43a793bd417008db

Download Submit
memory/2436-0-0x000001F0BAEC0000-0x000001F0BAED0000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads