xmrig | 571acb1e63cffa883e09070bd9f1b9f7f1a3787e72d099b4f2dc2a192b8e831c

Analysis

max time kernel
92s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
22-12-2024 22:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

571acb1e63cffa883e09070bd9f1b9f7f1a3787e72d099b4f2dc2a192b8e831c.exe
Size

1.3MB
MD5

785b3ccda9367d76483bf0c909dbee8d
SHA1

0ea4e932a978d4e9aaee031dea77966e660075d6
SHA256

571acb1e63cffa883e09070bd9f1b9f7f1a3787e72d099b4f2dc2a192b8e831c
SHA512

1a022e6ca59abf1cfd4a103d4cbd61f05e826e5c9cc83767eff71fb7d5e614d9b58b44d1fe7f0bbd6712754c39123fbe24713813cf01902be3aeab30b2636711
SSDEEP

24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbpwlKenszQEMrYn6MYj4LaEbseEY:GezaTF8FcNkNdfE0pZ9ozttwIRQxMYeH

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 33 IoCs

miner

resource	yara_rule
behavioral2/files/0x0032000000023b77-3.dat	xmrig
behavioral2/files/0x000a000000023b7b-8.dat	xmrig
behavioral2/files/0x000a000000023b7c-9.dat	xmrig
behavioral2/files/0x000a000000023b80-32.dat	xmrig
behavioral2/files/0x000a000000023b82-48.dat	xmrig
behavioral2/files/0x000a000000023b84-54.dat	xmrig
behavioral2/files/0x000a000000023b8a-82.dat	xmrig
behavioral2/files/0x000a000000023b8c-97.dat	xmrig
behavioral2/files/0x000a000000023b93-129.dat	xmrig
behavioral2/files/0x000a000000023b97-149.dat	xmrig
behavioral2/files/0x000a000000023b9a-162.dat	xmrig
behavioral2/files/0x000a000000023b99-159.dat	xmrig
behavioral2/files/0x000a000000023b98-157.dat	xmrig
behavioral2/files/0x000a000000023b96-147.dat	xmrig
behavioral2/files/0x000a000000023b95-143.dat	xmrig
behavioral2/files/0x000a000000023b94-137.dat	xmrig
behavioral2/files/0x000a000000023b92-127.dat	xmrig
behavioral2/files/0x000a000000023b91-123.dat	xmrig
behavioral2/files/0x000a000000023b90-117.dat	xmrig
behavioral2/files/0x000a000000023b8f-113.dat	xmrig
behavioral2/files/0x000a000000023b8e-107.dat	xmrig
behavioral2/files/0x000a000000023b8d-103.dat	xmrig
behavioral2/files/0x000a000000023b8b-93.dat	xmrig
behavioral2/files/0x000a000000023b89-83.dat	xmrig
behavioral2/files/0x000a000000023b88-80.dat	xmrig
behavioral2/files/0x000a000000023b87-72.dat	xmrig
behavioral2/files/0x000a000000023b86-68.dat	xmrig
behavioral2/files/0x000a000000023b85-62.dat	xmrig
behavioral2/files/0x000a000000023b83-52.dat	xmrig
behavioral2/files/0x000a000000023b81-40.dat	xmrig
behavioral2/files/0x000a000000023b7f-33.dat	xmrig
behavioral2/files/0x000a000000023b7e-27.dat	xmrig
behavioral2/files/0x000a000000023b7d-21.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
3404	jLFrNTE.exe
2604	svXruql.exe
3848	WxogzpS.exe
4612	kxflpCQ.exe
1076	xuiCbAk.exe
2472	DJkxQrZ.exe
4632	AYhXIkk.exe
2968	UvvMBfY.exe
4904	fhhCFvX.exe
716	FsMHztg.exe
4540	kXIAkSr.exe
396	NqUgcPZ.exe
4236	sIvPMEP.exe
4592	SYJCccV.exe
3656	csEGuCp.exe
3076	VYGTxaj.exe
1832	TmqIfKS.exe
960	kSNDUPf.exe
4348	GsISSwm.exe
3428	BNvVHRD.exe
4712	lvelxXM.exe
2124	rHzaLqS.exe
2388	VvEwtgw.exe
4020	VMqWXeV.exe
3092	MVWISse.exe
2004	FZOJLTA.exe
2808	ZgztmAn.exe
1596	DwEeXMj.exe
2348	ppGCGXX.exe
956	vCSThFv.exe
4124	AEThNgT.exe
2648	jXAbpHI.exe
4628	fJJQsFK.exe
4108	PSgTRTA.exe
3916	MbJIohG.exe
3664	ahlLXlz.exe
1276	GslaWEi.exe
1196	ilgcnSn.exe
3364	gUOdjYX.exe
724	GldxagI.exe
4576	WlZerSm.exe
5020	sMKBkbk.exe
2032	YuOMGgJ.exe
5096	ZvKXJui.exe
1444	evpvzxl.exe
436	MssZCSf.exe
1904	slqJOJD.exe
3600	OMOUstR.exe
3200	HGtubrx.exe
3852	poLulon.exe
1324	ePHyPZt.exe
2868	RBplgtZ.exe
2700	viKavIv.exe
4876	qemNQdp.exe
2460	GxYpWuK.exe
1396	YmdWivq.exe
4072	GdnJAzE.exe
3968	AqkzZFT.exe
1844	FydwVhI.exe
3344	mifWcrt.exe
2268	dsuRLIu.exe
2440	lzDxGoT.exe
3960	dEkdezL.exe
784	RgBlOTu.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\dCQSTpy.exe	571acb1e63cffa883e09070bd9f1b9f7f1a3787e72d099b4f2dc2a192b8e831c.exe
File created	C:\Windows\System\igmjtNt.exe	571acb1e63cffa883e09070bd9f1b9f7f1a3787e72d099b4f2dc2a192b8e831c.exe
File created	C:\Windows\System\Nkswuok.exe	571acb1e63cffa883e09070bd9f1b9f7f1a3787e72d099b4f2dc2a192b8e831c.exe
File created	C:\Windows\System\XHetBMZ.exe	571acb1e63cffa883e09070bd9f1b9f7f1a3787e72d099b4f2dc2a192b8e831c.exe
File created	C:\Windows\System\dJQoDEJ.exe	571acb1e63cffa883e09070bd9f1b9f7f1a3787e72d099b4f2dc2a192b8e831c.exe
File created	C:\Windows\System\gEWYggy.exe	571acb1e63cffa883e09070bd9f1b9f7f1a3787e72d099b4f2dc2a192b8e831c.exe
File created	C:\Windows\System\BrDcjgB.exe	571acb1e63cffa883e09070bd9f1b9f7f1a3787e72d099b4f2dc2a192b8e831c.exe
File created	C:\Windows\System\fxCgvVU.exe	571acb1e63cffa883e09070bd9f1b9f7f1a3787e72d099b4f2dc2a192b8e831c.exe
File created	C:\Windows\System\yuoCeBQ.exe	571acb1e63cffa883e09070bd9f1b9f7f1a3787e72d099b4f2dc2a192b8e831c.exe
File created	C:\Windows\System\GSjrgSj.exe	571acb1e63cffa883e09070bd9f1b9f7f1a3787e72d099b4f2dc2a192b8e831c.exe
File created	C:\Windows\System\DSWZFdG.exe	571acb1e63cffa883e09070bd9f1b9f7f1a3787e72d099b4f2dc2a192b8e831c.exe
File created	C:\Windows\System\pmKaGxF.exe	571acb1e63cffa883e09070bd9f1b9f7f1a3787e72d099b4f2dc2a192b8e831c.exe
File created	C:\Windows\System\OeLDwFT.exe	571acb1e63cffa883e09070bd9f1b9f7f1a3787e72d099b4f2dc2a192b8e831c.exe
File created	C:\Windows\System\AVQRIUA.exe	571acb1e63cffa883e09070bd9f1b9f7f1a3787e72d099b4f2dc2a192b8e831c.exe
File created	C:\Windows\System\CvCIVVt.exe	571acb1e63cffa883e09070bd9f1b9f7f1a3787e72d099b4f2dc2a192b8e831c.exe
File created	C:\Windows\System\NoVaDUN.exe	571acb1e63cffa883e09070bd9f1b9f7f1a3787e72d099b4f2dc2a192b8e831c.exe
File created	C:\Windows\System\NUURPmt.exe	571acb1e63cffa883e09070bd9f1b9f7f1a3787e72d099b4f2dc2a192b8e831c.exe
File created	C:\Windows\System\pBsjTTQ.exe	571acb1e63cffa883e09070bd9f1b9f7f1a3787e72d099b4f2dc2a192b8e831c.exe
File created	C:\Windows\System\tzwANrn.exe	571acb1e63cffa883e09070bd9f1b9f7f1a3787e72d099b4f2dc2a192b8e831c.exe
File created	C:\Windows\System\QvXWbUl.exe	571acb1e63cffa883e09070bd9f1b9f7f1a3787e72d099b4f2dc2a192b8e831c.exe
File created	C:\Windows\System\KLCqvQl.exe	571acb1e63cffa883e09070bd9f1b9f7f1a3787e72d099b4f2dc2a192b8e831c.exe
File created	C:\Windows\System\pBsufox.exe	571acb1e63cffa883e09070bd9f1b9f7f1a3787e72d099b4f2dc2a192b8e831c.exe
File created	C:\Windows\System\LMFUsBH.exe	571acb1e63cffa883e09070bd9f1b9f7f1a3787e72d099b4f2dc2a192b8e831c.exe
File created	C:\Windows\System\CQcDzxp.exe	571acb1e63cffa883e09070bd9f1b9f7f1a3787e72d099b4f2dc2a192b8e831c.exe
File created	C:\Windows\System\EkOVKiM.exe	571acb1e63cffa883e09070bd9f1b9f7f1a3787e72d099b4f2dc2a192b8e831c.exe
File created	C:\Windows\System\eguUfHa.exe	571acb1e63cffa883e09070bd9f1b9f7f1a3787e72d099b4f2dc2a192b8e831c.exe
File created	C:\Windows\System\dWKOAnF.exe	571acb1e63cffa883e09070bd9f1b9f7f1a3787e72d099b4f2dc2a192b8e831c.exe
File created	C:\Windows\System\TgIjIUw.exe	571acb1e63cffa883e09070bd9f1b9f7f1a3787e72d099b4f2dc2a192b8e831c.exe
File created	C:\Windows\System\evpvzxl.exe	571acb1e63cffa883e09070bd9f1b9f7f1a3787e72d099b4f2dc2a192b8e831c.exe
File created	C:\Windows\System\bfPNuCp.exe	571acb1e63cffa883e09070bd9f1b9f7f1a3787e72d099b4f2dc2a192b8e831c.exe
File created	C:\Windows\System\tFseOwk.exe	571acb1e63cffa883e09070bd9f1b9f7f1a3787e72d099b4f2dc2a192b8e831c.exe
File created	C:\Windows\System\xzlolNy.exe	571acb1e63cffa883e09070bd9f1b9f7f1a3787e72d099b4f2dc2a192b8e831c.exe
File created	C:\Windows\System\yFVcAHX.exe	571acb1e63cffa883e09070bd9f1b9f7f1a3787e72d099b4f2dc2a192b8e831c.exe
File created	C:\Windows\System\VKvVecZ.exe	571acb1e63cffa883e09070bd9f1b9f7f1a3787e72d099b4f2dc2a192b8e831c.exe
File created	C:\Windows\System\RYfitKt.exe	571acb1e63cffa883e09070bd9f1b9f7f1a3787e72d099b4f2dc2a192b8e831c.exe
File created	C:\Windows\System\GUXHwBN.exe	571acb1e63cffa883e09070bd9f1b9f7f1a3787e72d099b4f2dc2a192b8e831c.exe
File created	C:\Windows\System\jQYlMHK.exe	571acb1e63cffa883e09070bd9f1b9f7f1a3787e72d099b4f2dc2a192b8e831c.exe
File created	C:\Windows\System\jkOVtwt.exe	571acb1e63cffa883e09070bd9f1b9f7f1a3787e72d099b4f2dc2a192b8e831c.exe
File created	C:\Windows\System\rVMGgxH.exe	571acb1e63cffa883e09070bd9f1b9f7f1a3787e72d099b4f2dc2a192b8e831c.exe
File created	C:\Windows\System\SHIkObT.exe	571acb1e63cffa883e09070bd9f1b9f7f1a3787e72d099b4f2dc2a192b8e831c.exe
File created	C:\Windows\System\KclTeBT.exe	571acb1e63cffa883e09070bd9f1b9f7f1a3787e72d099b4f2dc2a192b8e831c.exe
File created	C:\Windows\System\LWUnUgd.exe	571acb1e63cffa883e09070bd9f1b9f7f1a3787e72d099b4f2dc2a192b8e831c.exe
File created	C:\Windows\System\QplyVBw.exe	571acb1e63cffa883e09070bd9f1b9f7f1a3787e72d099b4f2dc2a192b8e831c.exe
File created	C:\Windows\System\vhlNLpn.exe	571acb1e63cffa883e09070bd9f1b9f7f1a3787e72d099b4f2dc2a192b8e831c.exe
File created	C:\Windows\System\AycxVik.exe	571acb1e63cffa883e09070bd9f1b9f7f1a3787e72d099b4f2dc2a192b8e831c.exe
File created	C:\Windows\System\CAQoYZF.exe	571acb1e63cffa883e09070bd9f1b9f7f1a3787e72d099b4f2dc2a192b8e831c.exe
File created	C:\Windows\System\XHLlMVQ.exe	571acb1e63cffa883e09070bd9f1b9f7f1a3787e72d099b4f2dc2a192b8e831c.exe
File created	C:\Windows\System\IZNxCDW.exe	571acb1e63cffa883e09070bd9f1b9f7f1a3787e72d099b4f2dc2a192b8e831c.exe
File created	C:\Windows\System\xxDbcRg.exe	571acb1e63cffa883e09070bd9f1b9f7f1a3787e72d099b4f2dc2a192b8e831c.exe
File created	C:\Windows\System\RkZrnpn.exe	571acb1e63cffa883e09070bd9f1b9f7f1a3787e72d099b4f2dc2a192b8e831c.exe
File created	C:\Windows\System\abVofpT.exe	571acb1e63cffa883e09070bd9f1b9f7f1a3787e72d099b4f2dc2a192b8e831c.exe
File created	C:\Windows\System\KczPNMr.exe	571acb1e63cffa883e09070bd9f1b9f7f1a3787e72d099b4f2dc2a192b8e831c.exe
File created	C:\Windows\System\fWCSBvh.exe	571acb1e63cffa883e09070bd9f1b9f7f1a3787e72d099b4f2dc2a192b8e831c.exe
File created	C:\Windows\System\WyYmNKk.exe	571acb1e63cffa883e09070bd9f1b9f7f1a3787e72d099b4f2dc2a192b8e831c.exe
File created	C:\Windows\System\tovHoWR.exe	571acb1e63cffa883e09070bd9f1b9f7f1a3787e72d099b4f2dc2a192b8e831c.exe
File created	C:\Windows\System\jPYolyS.exe	571acb1e63cffa883e09070bd9f1b9f7f1a3787e72d099b4f2dc2a192b8e831c.exe
File created	C:\Windows\System\QXOLofe.exe	571acb1e63cffa883e09070bd9f1b9f7f1a3787e72d099b4f2dc2a192b8e831c.exe
File created	C:\Windows\System\FJrsOov.exe	571acb1e63cffa883e09070bd9f1b9f7f1a3787e72d099b4f2dc2a192b8e831c.exe
File created	C:\Windows\System\pDzvNUQ.exe	571acb1e63cffa883e09070bd9f1b9f7f1a3787e72d099b4f2dc2a192b8e831c.exe
File created	C:\Windows\System\NOthtqq.exe	571acb1e63cffa883e09070bd9f1b9f7f1a3787e72d099b4f2dc2a192b8e831c.exe
File created	C:\Windows\System\FbmfpfD.exe	571acb1e63cffa883e09070bd9f1b9f7f1a3787e72d099b4f2dc2a192b8e831c.exe
File created	C:\Windows\System\jXAbpHI.exe	571acb1e63cffa883e09070bd9f1b9f7f1a3787e72d099b4f2dc2a192b8e831c.exe
File created	C:\Windows\System\HGtubrx.exe	571acb1e63cffa883e09070bd9f1b9f7f1a3787e72d099b4f2dc2a192b8e831c.exe
File created	C:\Windows\System\KLWuMcp.exe	571acb1e63cffa883e09070bd9f1b9f7f1a3787e72d099b4f2dc2a192b8e831c.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	17388	dwm.exe
Token: SeChangeNotifyPrivilege	17388	dwm.exe
Token: 33	17388	dwm.exe
Token: SeIncBasePriorityPrivilege	17388	dwm.exe
Token: SeShutdownPrivilege	17388	dwm.exe
Token: SeCreatePagefilePrivilege	17388	dwm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 384 wrote to memory of 3404	384	571acb1e63cffa883e09070bd9f1b9f7f1a3787e72d099b4f2dc2a192b8e831c.exe	84
PID 384 wrote to memory of 3404	384	571acb1e63cffa883e09070bd9f1b9f7f1a3787e72d099b4f2dc2a192b8e831c.exe	84
PID 384 wrote to memory of 2604	384	571acb1e63cffa883e09070bd9f1b9f7f1a3787e72d099b4f2dc2a192b8e831c.exe	85
PID 384 wrote to memory of 2604	384	571acb1e63cffa883e09070bd9f1b9f7f1a3787e72d099b4f2dc2a192b8e831c.exe	85
PID 384 wrote to memory of 3848	384	571acb1e63cffa883e09070bd9f1b9f7f1a3787e72d099b4f2dc2a192b8e831c.exe	86
PID 384 wrote to memory of 3848	384	571acb1e63cffa883e09070bd9f1b9f7f1a3787e72d099b4f2dc2a192b8e831c.exe	86
PID 384 wrote to memory of 4612	384	571acb1e63cffa883e09070bd9f1b9f7f1a3787e72d099b4f2dc2a192b8e831c.exe	87
PID 384 wrote to memory of 4612	384	571acb1e63cffa883e09070bd9f1b9f7f1a3787e72d099b4f2dc2a192b8e831c.exe	87
PID 384 wrote to memory of 1076	384	571acb1e63cffa883e09070bd9f1b9f7f1a3787e72d099b4f2dc2a192b8e831c.exe	88
PID 384 wrote to memory of 1076	384	571acb1e63cffa883e09070bd9f1b9f7f1a3787e72d099b4f2dc2a192b8e831c.exe	88
PID 384 wrote to memory of 2472	384	571acb1e63cffa883e09070bd9f1b9f7f1a3787e72d099b4f2dc2a192b8e831c.exe	89
PID 384 wrote to memory of 2472	384	571acb1e63cffa883e09070bd9f1b9f7f1a3787e72d099b4f2dc2a192b8e831c.exe	89
PID 384 wrote to memory of 4632	384	571acb1e63cffa883e09070bd9f1b9f7f1a3787e72d099b4f2dc2a192b8e831c.exe	90
PID 384 wrote to memory of 4632	384	571acb1e63cffa883e09070bd9f1b9f7f1a3787e72d099b4f2dc2a192b8e831c.exe	90
PID 384 wrote to memory of 2968	384	571acb1e63cffa883e09070bd9f1b9f7f1a3787e72d099b4f2dc2a192b8e831c.exe	91
PID 384 wrote to memory of 2968	384	571acb1e63cffa883e09070bd9f1b9f7f1a3787e72d099b4f2dc2a192b8e831c.exe	91
PID 384 wrote to memory of 4904	384	571acb1e63cffa883e09070bd9f1b9f7f1a3787e72d099b4f2dc2a192b8e831c.exe	92
PID 384 wrote to memory of 4904	384	571acb1e63cffa883e09070bd9f1b9f7f1a3787e72d099b4f2dc2a192b8e831c.exe	92
PID 384 wrote to memory of 716	384	571acb1e63cffa883e09070bd9f1b9f7f1a3787e72d099b4f2dc2a192b8e831c.exe	93
PID 384 wrote to memory of 716	384	571acb1e63cffa883e09070bd9f1b9f7f1a3787e72d099b4f2dc2a192b8e831c.exe	93
PID 384 wrote to memory of 4540	384	571acb1e63cffa883e09070bd9f1b9f7f1a3787e72d099b4f2dc2a192b8e831c.exe	94
PID 384 wrote to memory of 4540	384	571acb1e63cffa883e09070bd9f1b9f7f1a3787e72d099b4f2dc2a192b8e831c.exe	94
PID 384 wrote to memory of 396	384	571acb1e63cffa883e09070bd9f1b9f7f1a3787e72d099b4f2dc2a192b8e831c.exe	95
PID 384 wrote to memory of 396	384	571acb1e63cffa883e09070bd9f1b9f7f1a3787e72d099b4f2dc2a192b8e831c.exe	95
PID 384 wrote to memory of 4236	384	571acb1e63cffa883e09070bd9f1b9f7f1a3787e72d099b4f2dc2a192b8e831c.exe	96
PID 384 wrote to memory of 4236	384	571acb1e63cffa883e09070bd9f1b9f7f1a3787e72d099b4f2dc2a192b8e831c.exe	96
PID 384 wrote to memory of 4592	384	571acb1e63cffa883e09070bd9f1b9f7f1a3787e72d099b4f2dc2a192b8e831c.exe	97
PID 384 wrote to memory of 4592	384	571acb1e63cffa883e09070bd9f1b9f7f1a3787e72d099b4f2dc2a192b8e831c.exe	97
PID 384 wrote to memory of 3656	384	571acb1e63cffa883e09070bd9f1b9f7f1a3787e72d099b4f2dc2a192b8e831c.exe	98
PID 384 wrote to memory of 3656	384	571acb1e63cffa883e09070bd9f1b9f7f1a3787e72d099b4f2dc2a192b8e831c.exe	98
PID 384 wrote to memory of 3076	384	571acb1e63cffa883e09070bd9f1b9f7f1a3787e72d099b4f2dc2a192b8e831c.exe	99
PID 384 wrote to memory of 3076	384	571acb1e63cffa883e09070bd9f1b9f7f1a3787e72d099b4f2dc2a192b8e831c.exe	99
PID 384 wrote to memory of 1832	384	571acb1e63cffa883e09070bd9f1b9f7f1a3787e72d099b4f2dc2a192b8e831c.exe	100
PID 384 wrote to memory of 1832	384	571acb1e63cffa883e09070bd9f1b9f7f1a3787e72d099b4f2dc2a192b8e831c.exe	100
PID 384 wrote to memory of 960	384	571acb1e63cffa883e09070bd9f1b9f7f1a3787e72d099b4f2dc2a192b8e831c.exe	101
PID 384 wrote to memory of 960	384	571acb1e63cffa883e09070bd9f1b9f7f1a3787e72d099b4f2dc2a192b8e831c.exe	101
PID 384 wrote to memory of 4348	384	571acb1e63cffa883e09070bd9f1b9f7f1a3787e72d099b4f2dc2a192b8e831c.exe	102
PID 384 wrote to memory of 4348	384	571acb1e63cffa883e09070bd9f1b9f7f1a3787e72d099b4f2dc2a192b8e831c.exe	102
PID 384 wrote to memory of 3428	384	571acb1e63cffa883e09070bd9f1b9f7f1a3787e72d099b4f2dc2a192b8e831c.exe	103
PID 384 wrote to memory of 3428	384	571acb1e63cffa883e09070bd9f1b9f7f1a3787e72d099b4f2dc2a192b8e831c.exe	103
PID 384 wrote to memory of 4712	384	571acb1e63cffa883e09070bd9f1b9f7f1a3787e72d099b4f2dc2a192b8e831c.exe	104
PID 384 wrote to memory of 4712	384	571acb1e63cffa883e09070bd9f1b9f7f1a3787e72d099b4f2dc2a192b8e831c.exe	104
PID 384 wrote to memory of 2124	384	571acb1e63cffa883e09070bd9f1b9f7f1a3787e72d099b4f2dc2a192b8e831c.exe	105
PID 384 wrote to memory of 2124	384	571acb1e63cffa883e09070bd9f1b9f7f1a3787e72d099b4f2dc2a192b8e831c.exe	105
PID 384 wrote to memory of 2388	384	571acb1e63cffa883e09070bd9f1b9f7f1a3787e72d099b4f2dc2a192b8e831c.exe	106
PID 384 wrote to memory of 2388	384	571acb1e63cffa883e09070bd9f1b9f7f1a3787e72d099b4f2dc2a192b8e831c.exe	106
PID 384 wrote to memory of 4020	384	571acb1e63cffa883e09070bd9f1b9f7f1a3787e72d099b4f2dc2a192b8e831c.exe	107
PID 384 wrote to memory of 4020	384	571acb1e63cffa883e09070bd9f1b9f7f1a3787e72d099b4f2dc2a192b8e831c.exe	107
PID 384 wrote to memory of 3092	384	571acb1e63cffa883e09070bd9f1b9f7f1a3787e72d099b4f2dc2a192b8e831c.exe	108
PID 384 wrote to memory of 3092	384	571acb1e63cffa883e09070bd9f1b9f7f1a3787e72d099b4f2dc2a192b8e831c.exe	108
PID 384 wrote to memory of 2004	384	571acb1e63cffa883e09070bd9f1b9f7f1a3787e72d099b4f2dc2a192b8e831c.exe	109
PID 384 wrote to memory of 2004	384	571acb1e63cffa883e09070bd9f1b9f7f1a3787e72d099b4f2dc2a192b8e831c.exe	109
PID 384 wrote to memory of 2808	384	571acb1e63cffa883e09070bd9f1b9f7f1a3787e72d099b4f2dc2a192b8e831c.exe	110
PID 384 wrote to memory of 2808	384	571acb1e63cffa883e09070bd9f1b9f7f1a3787e72d099b4f2dc2a192b8e831c.exe	110
PID 384 wrote to memory of 1596	384	571acb1e63cffa883e09070bd9f1b9f7f1a3787e72d099b4f2dc2a192b8e831c.exe	111
PID 384 wrote to memory of 1596	384	571acb1e63cffa883e09070bd9f1b9f7f1a3787e72d099b4f2dc2a192b8e831c.exe	111
PID 384 wrote to memory of 2348	384	571acb1e63cffa883e09070bd9f1b9f7f1a3787e72d099b4f2dc2a192b8e831c.exe	112
PID 384 wrote to memory of 2348	384	571acb1e63cffa883e09070bd9f1b9f7f1a3787e72d099b4f2dc2a192b8e831c.exe	112
PID 384 wrote to memory of 956	384	571acb1e63cffa883e09070bd9f1b9f7f1a3787e72d099b4f2dc2a192b8e831c.exe	113
PID 384 wrote to memory of 956	384	571acb1e63cffa883e09070bd9f1b9f7f1a3787e72d099b4f2dc2a192b8e831c.exe	113
PID 384 wrote to memory of 4124	384	571acb1e63cffa883e09070bd9f1b9f7f1a3787e72d099b4f2dc2a192b8e831c.exe	114
PID 384 wrote to memory of 4124	384	571acb1e63cffa883e09070bd9f1b9f7f1a3787e72d099b4f2dc2a192b8e831c.exe	114
PID 384 wrote to memory of 2648	384	571acb1e63cffa883e09070bd9f1b9f7f1a3787e72d099b4f2dc2a192b8e831c.exe	115
PID 384 wrote to memory of 2648	384	571acb1e63cffa883e09070bd9f1b9f7f1a3787e72d099b4f2dc2a192b8e831c.exe	115

C:\Users\Admin\AppData\Local\Temp\571acb1e63cffa883e09070bd9f1b9f7f1a3787e72d099b4f2dc2a192b8e831c.exe
"C:\Users\Admin\AppData\Local\Temp\571acb1e63cffa883e09070bd9f1b9f7f1a3787e72d099b4f2dc2a192b8e831c.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:384
- C:\Windows\System\jLFrNTE.exe
  C:\Windows\System\jLFrNTE.exe
  2⤵
  - Executes dropped EXE
  PID:3404
- C:\Windows\System\svXruql.exe
  C:\Windows\System\svXruql.exe
  2⤵
  - Executes dropped EXE
  PID:2604
- C:\Windows\System\WxogzpS.exe
  C:\Windows\System\WxogzpS.exe
  2⤵
  - Executes dropped EXE
  PID:3848
- C:\Windows\System\kxflpCQ.exe
  C:\Windows\System\kxflpCQ.exe
  2⤵
  - Executes dropped EXE
  PID:4612
- C:\Windows\System\xuiCbAk.exe
  C:\Windows\System\xuiCbAk.exe
  2⤵
  - Executes dropped EXE
  PID:1076
- C:\Windows\System\DJkxQrZ.exe
  C:\Windows\System\DJkxQrZ.exe
  2⤵
  - Executes dropped EXE
  PID:2472
- C:\Windows\System\AYhXIkk.exe
  C:\Windows\System\AYhXIkk.exe
  2⤵
  - Executes dropped EXE
  PID:4632
- C:\Windows\System\UvvMBfY.exe
  C:\Windows\System\UvvMBfY.exe
  2⤵
  - Executes dropped EXE
  PID:2968
- C:\Windows\System\fhhCFvX.exe
  C:\Windows\System\fhhCFvX.exe
  2⤵
  - Executes dropped EXE
  PID:4904
- C:\Windows\System\FsMHztg.exe
  C:\Windows\System\FsMHztg.exe
  2⤵
  - Executes dropped EXE
  PID:716
- C:\Windows\System\kXIAkSr.exe
  C:\Windows\System\kXIAkSr.exe
  2⤵
  - Executes dropped EXE
  PID:4540
- C:\Windows\System\NqUgcPZ.exe
  C:\Windows\System\NqUgcPZ.exe
  2⤵
  - Executes dropped EXE
  PID:396
- C:\Windows\System\sIvPMEP.exe
  C:\Windows\System\sIvPMEP.exe
  2⤵
  - Executes dropped EXE
  PID:4236
- C:\Windows\System\SYJCccV.exe
  C:\Windows\System\SYJCccV.exe
  2⤵
  - Executes dropped EXE
  PID:4592
- C:\Windows\System\csEGuCp.exe
  C:\Windows\System\csEGuCp.exe
  2⤵
  - Executes dropped EXE
  PID:3656
- C:\Windows\System\VYGTxaj.exe
  C:\Windows\System\VYGTxaj.exe
  2⤵
  - Executes dropped EXE
  PID:3076
- C:\Windows\System\TmqIfKS.exe
  C:\Windows\System\TmqIfKS.exe
  2⤵
  - Executes dropped EXE
  PID:1832
- C:\Windows\System\kSNDUPf.exe
  C:\Windows\System\kSNDUPf.exe
  2⤵
  - Executes dropped EXE
  PID:960
- C:\Windows\System\GsISSwm.exe
  C:\Windows\System\GsISSwm.exe
  2⤵
  - Executes dropped EXE
  PID:4348
- C:\Windows\System\BNvVHRD.exe
  C:\Windows\System\BNvVHRD.exe
  2⤵
  - Executes dropped EXE
  PID:3428
- C:\Windows\System\lvelxXM.exe
  C:\Windows\System\lvelxXM.exe
  2⤵
  - Executes dropped EXE
  PID:4712
- C:\Windows\System\rHzaLqS.exe
  C:\Windows\System\rHzaLqS.exe
  2⤵
  - Executes dropped EXE
  PID:2124
- C:\Windows\System\VvEwtgw.exe
  C:\Windows\System\VvEwtgw.exe
  2⤵
  - Executes dropped EXE
  PID:2388
- C:\Windows\System\VMqWXeV.exe
  C:\Windows\System\VMqWXeV.exe
  2⤵
  - Executes dropped EXE
  PID:4020
- C:\Windows\System\MVWISse.exe
  C:\Windows\System\MVWISse.exe
  2⤵
  - Executes dropped EXE
  PID:3092
- C:\Windows\System\FZOJLTA.exe
  C:\Windows\System\FZOJLTA.exe
  2⤵
  - Executes dropped EXE
  PID:2004
- C:\Windows\System\ZgztmAn.exe
  C:\Windows\System\ZgztmAn.exe
  2⤵
  - Executes dropped EXE
  PID:2808
- C:\Windows\System\DwEeXMj.exe
  C:\Windows\System\DwEeXMj.exe
  2⤵
  - Executes dropped EXE
  PID:1596
- C:\Windows\System\ppGCGXX.exe
  C:\Windows\System\ppGCGXX.exe
  2⤵
  - Executes dropped EXE
  PID:2348
- C:\Windows\System\vCSThFv.exe
  C:\Windows\System\vCSThFv.exe
  2⤵
  - Executes dropped EXE
  PID:956
- C:\Windows\System\AEThNgT.exe
  C:\Windows\System\AEThNgT.exe
  2⤵
  - Executes dropped EXE
  PID:4124
- C:\Windows\System\jXAbpHI.exe
  C:\Windows\System\jXAbpHI.exe
  2⤵
  - Executes dropped EXE
  PID:2648
- C:\Windows\System\fJJQsFK.exe
  C:\Windows\System\fJJQsFK.exe
  2⤵
  - Executes dropped EXE
  PID:4628
- C:\Windows\System\PSgTRTA.exe
  C:\Windows\System\PSgTRTA.exe
  2⤵
  - Executes dropped EXE
  PID:4108
- C:\Windows\System\MbJIohG.exe
  C:\Windows\System\MbJIohG.exe
  2⤵
  - Executes dropped EXE
  PID:3916
- C:\Windows\System\ahlLXlz.exe
  C:\Windows\System\ahlLXlz.exe
  2⤵
  - Executes dropped EXE
  PID:3664
- C:\Windows\System\GslaWEi.exe
  C:\Windows\System\GslaWEi.exe
  2⤵
  - Executes dropped EXE
  PID:1276
- C:\Windows\System\ilgcnSn.exe
  C:\Windows\System\ilgcnSn.exe
  2⤵
  - Executes dropped EXE
  PID:1196
- C:\Windows\System\gUOdjYX.exe
  C:\Windows\System\gUOdjYX.exe
  2⤵
  - Executes dropped EXE
  PID:3364
- C:\Windows\System\GldxagI.exe
  C:\Windows\System\GldxagI.exe
  2⤵
  - Executes dropped EXE
  PID:724
- C:\Windows\System\WlZerSm.exe
  C:\Windows\System\WlZerSm.exe
  2⤵
  - Executes dropped EXE
  PID:4576
- C:\Windows\System\sMKBkbk.exe
  C:\Windows\System\sMKBkbk.exe
  2⤵
  - Executes dropped EXE
  PID:5020
- C:\Windows\System\YuOMGgJ.exe
  C:\Windows\System\YuOMGgJ.exe
  2⤵
  - Executes dropped EXE
  PID:2032
- C:\Windows\System\ZvKXJui.exe
  C:\Windows\System\ZvKXJui.exe
  2⤵
  - Executes dropped EXE
  PID:5096
- C:\Windows\System\evpvzxl.exe
  C:\Windows\System\evpvzxl.exe
  2⤵
  - Executes dropped EXE
  PID:1444
- C:\Windows\System\MssZCSf.exe
  C:\Windows\System\MssZCSf.exe
  2⤵
  - Executes dropped EXE
  PID:436
- C:\Windows\System\slqJOJD.exe
  C:\Windows\System\slqJOJD.exe
  2⤵
  - Executes dropped EXE
  PID:1904
- C:\Windows\System\OMOUstR.exe
  C:\Windows\System\OMOUstR.exe
  2⤵
  - Executes dropped EXE
  PID:3600
- C:\Windows\System\HGtubrx.exe
  C:\Windows\System\HGtubrx.exe
  2⤵
  - Executes dropped EXE
  PID:3200
- C:\Windows\System\poLulon.exe
  C:\Windows\System\poLulon.exe
  2⤵
  - Executes dropped EXE
  PID:3852
- C:\Windows\System\ePHyPZt.exe
  C:\Windows\System\ePHyPZt.exe
  2⤵
  - Executes dropped EXE
  PID:1324
- C:\Windows\System\RBplgtZ.exe
  C:\Windows\System\RBplgtZ.exe
  2⤵
  - Executes dropped EXE
  PID:2868
- C:\Windows\System\viKavIv.exe
  C:\Windows\System\viKavIv.exe
  2⤵
  - Executes dropped EXE
  PID:2700
- C:\Windows\System\qemNQdp.exe
  C:\Windows\System\qemNQdp.exe
  2⤵
  - Executes dropped EXE
  PID:4876
- C:\Windows\System\GxYpWuK.exe
  C:\Windows\System\GxYpWuK.exe
  2⤵
  - Executes dropped EXE
  PID:2460
- C:\Windows\System\YmdWivq.exe
  C:\Windows\System\YmdWivq.exe
  2⤵
  - Executes dropped EXE
  PID:1396
- C:\Windows\System\GdnJAzE.exe
  C:\Windows\System\GdnJAzE.exe
  2⤵
  - Executes dropped EXE
  PID:4072
- C:\Windows\System\AqkzZFT.exe
  C:\Windows\System\AqkzZFT.exe
  2⤵
  - Executes dropped EXE
  PID:3968
- C:\Windows\System\FydwVhI.exe
  C:\Windows\System\FydwVhI.exe
  2⤵
  - Executes dropped EXE
  PID:1844
- C:\Windows\System\mifWcrt.exe
  C:\Windows\System\mifWcrt.exe
  2⤵
  - Executes dropped EXE
  PID:3344
- C:\Windows\System\dsuRLIu.exe
  C:\Windows\System\dsuRLIu.exe
  2⤵
  - Executes dropped EXE
  PID:2268
- C:\Windows\System\lzDxGoT.exe
  C:\Windows\System\lzDxGoT.exe
  2⤵
  - Executes dropped EXE
  PID:2440
- C:\Windows\System\dEkdezL.exe
  C:\Windows\System\dEkdezL.exe
  2⤵
  - Executes dropped EXE
  PID:3960
- C:\Windows\System\RgBlOTu.exe
  C:\Windows\System\RgBlOTu.exe
  2⤵
  - Executes dropped EXE
  PID:784
- C:\Windows\System\UtIIKTY.exe
  C:\Windows\System\UtIIKTY.exe
  2⤵
  PID:764
- C:\Windows\System\TRJvGAW.exe
  C:\Windows\System\TRJvGAW.exe
  2⤵
  PID:4692
- C:\Windows\System\NdGrXqy.exe
  C:\Windows\System\NdGrXqy.exe
  2⤵
  PID:3540
- C:\Windows\System\izVACrj.exe
  C:\Windows\System\izVACrj.exe
  2⤵
  PID:2804
- C:\Windows\System\mRjgXLO.exe
  C:\Windows\System\mRjgXLO.exe
  2⤵
  PID:3220
- C:\Windows\System\KLCqvQl.exe
  C:\Windows\System\KLCqvQl.exe
  2⤵
  PID:3680
- C:\Windows\System\IncBMKe.exe
  C:\Windows\System\IncBMKe.exe
  2⤵
  PID:4624
- C:\Windows\System\pBsufox.exe
  C:\Windows\System\pBsufox.exe
  2⤵
  PID:4112
- C:\Windows\System\wSgGeOa.exe
  C:\Windows\System\wSgGeOa.exe
  2⤵
  PID:4264
- C:\Windows\System\wBVYMfT.exe
  C:\Windows\System\wBVYMfT.exe
  2⤵
  PID:3280
- C:\Windows\System\grvBydY.exe
  C:\Windows\System\grvBydY.exe
  2⤵
  PID:1588
- C:\Windows\System\Cksztde.exe
  C:\Windows\System\Cksztde.exe
  2⤵
  PID:4132
- C:\Windows\System\ECIyQTt.exe
  C:\Windows\System\ECIyQTt.exe
  2⤵
  PID:3032
- C:\Windows\System\kgpUOMK.exe
  C:\Windows\System\kgpUOMK.exe
  2⤵
  PID:3864
- C:\Windows\System\gAQEkRA.exe
  C:\Windows\System\gAQEkRA.exe
  2⤵
  PID:2356
- C:\Windows\System\gZTGOOv.exe
  C:\Windows\System\gZTGOOv.exe
  2⤵
  PID:4900
- C:\Windows\System\jMQdZXD.exe
  C:\Windows\System\jMQdZXD.exe
  2⤵
  PID:4056
- C:\Windows\System\IpEffDb.exe
  C:\Windows\System\IpEffDb.exe
  2⤵
  PID:4824
- C:\Windows\System\xncjMZk.exe
  C:\Windows\System\xncjMZk.exe
  2⤵
  PID:1732
- C:\Windows\System\UaOGHuB.exe
  C:\Windows\System\UaOGHuB.exe
  2⤵
  PID:3632
- C:\Windows\System\mOLGwSx.exe
  C:\Windows\System\mOLGwSx.exe
  2⤵
  PID:5088
- C:\Windows\System\dCQSTpy.exe
  C:\Windows\System\dCQSTpy.exe
  2⤵
  PID:4488
- C:\Windows\System\drfqrgZ.exe
  C:\Windows\System\drfqrgZ.exe
  2⤵
  PID:5124
- C:\Windows\System\fPsNAZe.exe
  C:\Windows\System\fPsNAZe.exe
  2⤵
  PID:5148
- C:\Windows\System\MTgIJZq.exe
  C:\Windows\System\MTgIJZq.exe
  2⤵
  PID:5180
- C:\Windows\System\iodHxXA.exe
  C:\Windows\System\iodHxXA.exe
  2⤵
  PID:5208
- C:\Windows\System\LWUnUgd.exe
  C:\Windows\System\LWUnUgd.exe
  2⤵
  PID:5232
- C:\Windows\System\koVWOcP.exe
  C:\Windows\System\koVWOcP.exe
  2⤵
  PID:5264
- C:\Windows\System\yElJlDJ.exe
  C:\Windows\System\yElJlDJ.exe
  2⤵
  PID:5292
- C:\Windows\System\EjxtBSm.exe
  C:\Windows\System\EjxtBSm.exe
  2⤵
  PID:5320
- C:\Windows\System\ogCjsVf.exe
  C:\Windows\System\ogCjsVf.exe
  2⤵
  PID:5348
- C:\Windows\System\mQpxBDz.exe
  C:\Windows\System\mQpxBDz.exe
  2⤵
  PID:5372
- C:\Windows\System\ztsPVRf.exe
  C:\Windows\System\ztsPVRf.exe
  2⤵
  PID:5404
- C:\Windows\System\GbDeKWT.exe
  C:\Windows\System\GbDeKWT.exe
  2⤵
  PID:5432
- C:\Windows\System\TWHptDs.exe
  C:\Windows\System\TWHptDs.exe
  2⤵
  PID:5456
- C:\Windows\System\stTshqj.exe
  C:\Windows\System\stTshqj.exe
  2⤵
  PID:5488
- C:\Windows\System\dQgYdRL.exe
  C:\Windows\System\dQgYdRL.exe
  2⤵
  PID:5516
- C:\Windows\System\tNGmKXH.exe
  C:\Windows\System\tNGmKXH.exe
  2⤵
  PID:5540
- C:\Windows\System\lEmmdbw.exe
  C:\Windows\System\lEmmdbw.exe
  2⤵
  PID:5572
- C:\Windows\System\vHGlkuL.exe
  C:\Windows\System\vHGlkuL.exe
  2⤵
  PID:5604
- C:\Windows\System\InxGqbf.exe
  C:\Windows\System\InxGqbf.exe
  2⤵
  PID:5640
- C:\Windows\System\tPpqcAG.exe
  C:\Windows\System\tPpqcAG.exe
  2⤵
  PID:5664
- C:\Windows\System\KEUlPtp.exe
  C:\Windows\System\KEUlPtp.exe
  2⤵
  PID:5684
- C:\Windows\System\XvEpEaS.exe
  C:\Windows\System\XvEpEaS.exe
  2⤵
  PID:5712
- C:\Windows\System\SxrccwE.exe
  C:\Windows\System\SxrccwE.exe
  2⤵
  PID:5740
- C:\Windows\System\fhZamvy.exe
  C:\Windows\System\fhZamvy.exe
  2⤵
  PID:5764
- C:\Windows\System\gMOkYYr.exe
  C:\Windows\System\gMOkYYr.exe
  2⤵
  PID:5792
- C:\Windows\System\znNjkgV.exe
  C:\Windows\System\znNjkgV.exe
  2⤵
  PID:5824
- C:\Windows\System\WbqAhMX.exe
  C:\Windows\System\WbqAhMX.exe
  2⤵
  PID:5848
- C:\Windows\System\tbbNCEV.exe
  C:\Windows\System\tbbNCEV.exe
  2⤵
  PID:5880
- C:\Windows\System\ZNcFGvY.exe
  C:\Windows\System\ZNcFGvY.exe
  2⤵
  PID:5912
- C:\Windows\System\nUzPFZg.exe
  C:\Windows\System\nUzPFZg.exe
  2⤵
  PID:5940
- C:\Windows\System\muNSRxr.exe
  C:\Windows\System\muNSRxr.exe
  2⤵
  PID:5972
- C:\Windows\System\QXOLofe.exe
  C:\Windows\System\QXOLofe.exe
  2⤵
  PID:6004
- C:\Windows\System\uqwXiTR.exe
  C:\Windows\System\uqwXiTR.exe
  2⤵
  PID:6028
- C:\Windows\System\KpsqliY.exe
  C:\Windows\System\KpsqliY.exe
  2⤵
  PID:6048
- C:\Windows\System\DEmZaGf.exe
  C:\Windows\System\DEmZaGf.exe
  2⤵
  PID:6076
- C:\Windows\System\HGhJCkq.exe
  C:\Windows\System\HGhJCkq.exe
  2⤵
  PID:6100
- C:\Windows\System\RXxCSxB.exe
  C:\Windows\System\RXxCSxB.exe
  2⤵
  PID:6132
- C:\Windows\System\oWRyZxP.exe
  C:\Windows\System\oWRyZxP.exe
  2⤵
  PID:4292
- C:\Windows\System\KLWuMcp.exe
  C:\Windows\System\KLWuMcp.exe
  2⤵
  PID:3244
- C:\Windows\System\ABkrATd.exe
  C:\Windows\System\ABkrATd.exe
  2⤵
  PID:2600
- C:\Windows\System\PMfoaiQ.exe
  C:\Windows\System\PMfoaiQ.exe
  2⤵
  PID:2240
- C:\Windows\System\eCdHImV.exe
  C:\Windows\System\eCdHImV.exe
  2⤵
  PID:2652
- C:\Windows\System\EBOwHjB.exe
  C:\Windows\System\EBOwHjB.exe
  2⤵
  PID:544
- C:\Windows\System\tSYjsQO.exe
  C:\Windows\System\tSYjsQO.exe
  2⤵
  PID:3760
- C:\Windows\System\pUciaRh.exe
  C:\Windows\System\pUciaRh.exe
  2⤵
  PID:5132
- C:\Windows\System\bXyWTcM.exe
  C:\Windows\System\bXyWTcM.exe
  2⤵
  PID:5196
- C:\Windows\System\wDoONnj.exe
  C:\Windows\System\wDoONnj.exe
  2⤵
  PID:5248
- C:\Windows\System\MLHMqFW.exe
  C:\Windows\System\MLHMqFW.exe
  2⤵
  PID:5328
- C:\Windows\System\OACdowe.exe
  C:\Windows\System\OACdowe.exe
  2⤵
  PID:5388
- C:\Windows\System\bfPNuCp.exe
  C:\Windows\System\bfPNuCp.exe
  2⤵
  PID:5448
- C:\Windows\System\aYNVzRB.exe
  C:\Windows\System\aYNVzRB.exe
  2⤵
  PID:5524
- C:\Windows\System\juidsSF.exe
  C:\Windows\System\juidsSF.exe
  2⤵
  PID:5588
- C:\Windows\System\jrrftZQ.exe
  C:\Windows\System\jrrftZQ.exe
  2⤵
  PID:5628
- C:\Windows\System\JMcZGTV.exe
  C:\Windows\System\JMcZGTV.exe
  2⤵
  PID:5720
- C:\Windows\System\oQWRPie.exe
  C:\Windows\System\oQWRPie.exe
  2⤵
  PID:5760
- C:\Windows\System\UFIskHQ.exe
  C:\Windows\System\UFIskHQ.exe
  2⤵
  PID:5816
- C:\Windows\System\XCHtbwU.exe
  C:\Windows\System\XCHtbwU.exe
  2⤵
  PID:5888
- C:\Windows\System\rOpAlTj.exe
  C:\Windows\System\rOpAlTj.exe
  2⤵
  PID:5936
- C:\Windows\System\Vctxfct.exe
  C:\Windows\System\Vctxfct.exe
  2⤵
  PID:6020
- C:\Windows\System\YrUsRUf.exe
  C:\Windows\System\YrUsRUf.exe
  2⤵
  PID:6084
- C:\Windows\System\rZidsTd.exe
  C:\Windows\System\rZidsTd.exe
  2⤵
  PID:1540
- C:\Windows\System\yXgesep.exe
  C:\Windows\System\yXgesep.exe
  2⤵
  PID:3732
- C:\Windows\System\MUoHVKB.exe
  C:\Windows\System\MUoHVKB.exe
  2⤵
  PID:1916
- C:\Windows\System\uuQMHHQ.exe
  C:\Windows\System\uuQMHHQ.exe
  2⤵
  PID:1528
- C:\Windows\System\OBkvSwv.exe
  C:\Windows\System\OBkvSwv.exe
  2⤵
  PID:5168
- C:\Windows\System\ZWYXXMW.exe
  C:\Windows\System\ZWYXXMW.exe
  2⤵
  PID:5496
- C:\Windows\System\STlDxew.exe
  C:\Windows\System\STlDxew.exe
  2⤵
  PID:2092
- C:\Windows\System\jvMtxsy.exe
  C:\Windows\System\jvMtxsy.exe
  2⤵
  PID:3416
- C:\Windows\System\gEnCovm.exe
  C:\Windows\System\gEnCovm.exe
  2⤵
  PID:5780
- C:\Windows\System\qVIxWAb.exe
  C:\Windows\System\qVIxWAb.exe
  2⤵
  PID:5900
- C:\Windows\System\ETANvoS.exe
  C:\Windows\System\ETANvoS.exe
  2⤵
  PID:6036
- C:\Windows\System\QasyNXz.exe
  C:\Windows\System\QasyNXz.exe
  2⤵
  PID:6096
- C:\Windows\System\lqgLEQo.exe
  C:\Windows\System\lqgLEQo.exe
  2⤵
  PID:820
- C:\Windows\System\loHPOpl.exe
  C:\Windows\System\loHPOpl.exe
  2⤵
  PID:5144
- C:\Windows\System\KgigORI.exe
  C:\Windows\System\KgigORI.exe
  2⤵
  PID:5412
- C:\Windows\System\xZCodHZ.exe
  C:\Windows\System\xZCodHZ.exe
  2⤵
  PID:6164
- C:\Windows\System\rSinBTZ.exe
  C:\Windows\System\rSinBTZ.exe
  2⤵
  PID:6192
- C:\Windows\System\vMXniHc.exe
  C:\Windows\System\vMXniHc.exe
  2⤵
  PID:6220
- C:\Windows\System\tFseOwk.exe
  C:\Windows\System\tFseOwk.exe
  2⤵
  PID:6248
- C:\Windows\System\aEKaBDs.exe
  C:\Windows\System\aEKaBDs.exe
  2⤵
  PID:6276
- C:\Windows\System\IyyZzjq.exe
  C:\Windows\System\IyyZzjq.exe
  2⤵
  PID:6304
- C:\Windows\System\QplyVBw.exe
  C:\Windows\System\QplyVBw.exe
  2⤵
  PID:6328
- C:\Windows\System\ACQPGAB.exe
  C:\Windows\System\ACQPGAB.exe
  2⤵
  PID:6356
- C:\Windows\System\SBtYvyD.exe
  C:\Windows\System\SBtYvyD.exe
  2⤵
  PID:6384
- C:\Windows\System\vqPHlgJ.exe
  C:\Windows\System\vqPHlgJ.exe
  2⤵
  PID:6432
- C:\Windows\System\bXxbHuP.exe
  C:\Windows\System\bXxbHuP.exe
  2⤵
  PID:6476
- C:\Windows\System\CDeOHlb.exe
  C:\Windows\System\CDeOHlb.exe
  2⤵
  PID:6516
- C:\Windows\System\kjWivsP.exe
  C:\Windows\System\kjWivsP.exe
  2⤵
  PID:6548
- C:\Windows\System\aVgCXSH.exe
  C:\Windows\System\aVgCXSH.exe
  2⤵
  PID:6580
- C:\Windows\System\kFGGdAQ.exe
  C:\Windows\System\kFGGdAQ.exe
  2⤵
  PID:6596
- C:\Windows\System\ECvtPVq.exe
  C:\Windows\System\ECvtPVq.exe
  2⤵
  PID:6644
- C:\Windows\System\dZcAseX.exe
  C:\Windows\System\dZcAseX.exe
  2⤵
  PID:6688
- C:\Windows\System\AvSBDWn.exe
  C:\Windows\System\AvSBDWn.exe
  2⤵
  PID:6708
- C:\Windows\System\cIUQNVA.exe
  C:\Windows\System\cIUQNVA.exe
  2⤵
  PID:6724
- C:\Windows\System\uetwUwK.exe
  C:\Windows\System\uetwUwK.exe
  2⤵
  PID:6744
- C:\Windows\System\HKpiIAV.exe
  C:\Windows\System\HKpiIAV.exe
  2⤵
  PID:6768
- C:\Windows\System\EZsratS.exe
  C:\Windows\System\EZsratS.exe
  2⤵
  PID:6792
- C:\Windows\System\FnEvRHK.exe
  C:\Windows\System\FnEvRHK.exe
  2⤵
  PID:6816
- C:\Windows\System\SopzLZo.exe
  C:\Windows\System\SopzLZo.exe
  2⤵
  PID:6832
- C:\Windows\System\Ovboloo.exe
  C:\Windows\System\Ovboloo.exe
  2⤵
  PID:6868
- C:\Windows\System\MOKZhmS.exe
  C:\Windows\System\MOKZhmS.exe
  2⤵
  PID:6904
- C:\Windows\System\owmEnnq.exe
  C:\Windows\System\owmEnnq.exe
  2⤵
  PID:6924
- C:\Windows\System\bRqovuz.exe
  C:\Windows\System\bRqovuz.exe
  2⤵
  PID:6960
- C:\Windows\System\IFBvqiY.exe
  C:\Windows\System\IFBvqiY.exe
  2⤵
  PID:6984
- C:\Windows\System\kNAFuKm.exe
  C:\Windows\System\kNAFuKm.exe
  2⤵
  PID:7016
- C:\Windows\System\XkWRBXG.exe
  C:\Windows\System\XkWRBXG.exe
  2⤵
  PID:7044
- C:\Windows\System\GSjrgSj.exe
  C:\Windows\System\GSjrgSj.exe
  2⤵
  PID:7060
- C:\Windows\System\MbwJQVK.exe
  C:\Windows\System\MbwJQVK.exe
  2⤵
  PID:7076
- C:\Windows\System\FbYOOmX.exe
  C:\Windows\System\FbYOOmX.exe
  2⤵
  PID:7092
- C:\Windows\System\igmjtNt.exe
  C:\Windows\System\igmjtNt.exe
  2⤵
  PID:7108
- C:\Windows\System\ddnltYf.exe
  C:\Windows\System\ddnltYf.exe
  2⤵
  PID:7124
- C:\Windows\System\BgDaxWk.exe
  C:\Windows\System\BgDaxWk.exe
  2⤵
  PID:7156
- C:\Windows\System\GOjTZZm.exe
  C:\Windows\System\GOjTZZm.exe
  2⤵
  PID:5556
- C:\Windows\System\EEuAEmM.exe
  C:\Windows\System\EEuAEmM.exe
  2⤵
  PID:1108
- C:\Windows\System\zsNulIF.exe
  C:\Windows\System\zsNulIF.exe
  2⤵
  PID:5992
- C:\Windows\System\eqVrhXJ.exe
  C:\Windows\System\eqVrhXJ.exe
  2⤵
  PID:1096
- C:\Windows\System\rvBFfbk.exe
  C:\Windows\System\rvBFfbk.exe
  2⤵
  PID:6184
- C:\Windows\System\SZHOowM.exe
  C:\Windows\System\SZHOowM.exe
  2⤵
  PID:6288
- C:\Windows\System\BiiVzES.exe
  C:\Windows\System\BiiVzES.exe
  2⤵
  PID:1756
- C:\Windows\System\GFTPWqj.exe
  C:\Windows\System\GFTPWqj.exe
  2⤵
  PID:6316
- C:\Windows\System\gFxoFnd.exe
  C:\Windows\System\gFxoFnd.exe
  2⤵
  PID:1012
- C:\Windows\System\WqAcCiJ.exe
  C:\Windows\System\WqAcCiJ.exe
  2⤵
  PID:6380
- C:\Windows\System\KxhnVMJ.exe
  C:\Windows\System\KxhnVMJ.exe
  2⤵
  PID:6428
- C:\Windows\System\fBBBcLK.exe
  C:\Windows\System\fBBBcLK.exe
  2⤵
  PID:6496
- C:\Windows\System\indPOsZ.exe
  C:\Windows\System\indPOsZ.exe
  2⤵
  PID:6536
- C:\Windows\System\xzlolNy.exe
  C:\Windows\System\xzlolNy.exe
  2⤵
  PID:6592
- C:\Windows\System\FCvNYkb.exe
  C:\Windows\System\FCvNYkb.exe
  2⤵
  PID:6680
- C:\Windows\System\AHKFLIr.exe
  C:\Windows\System\AHKFLIr.exe
  2⤵
  PID:6752
- C:\Windows\System\itOaYXm.exe
  C:\Windows\System\itOaYXm.exe
  2⤵
  PID:6788
- C:\Windows\System\sYVfVOx.exe
  C:\Windows\System\sYVfVOx.exe
  2⤵
  PID:6912
- C:\Windows\System\jMChgXr.exe
  C:\Windows\System\jMChgXr.exe
  2⤵
  PID:6892
- C:\Windows\System\QtVwTok.exe
  C:\Windows\System\QtVwTok.exe
  2⤵
  PID:7032
- C:\Windows\System\mSjpSvC.exe
  C:\Windows\System\mSjpSvC.exe
  2⤵
  PID:5672
- C:\Windows\System\vYvSRLx.exe
  C:\Windows\System\vYvSRLx.exe
  2⤵
  PID:7088
- C:\Windows\System\VehtHni.exe
  C:\Windows\System\VehtHni.exe
  2⤵
  PID:7132
- C:\Windows\System\lGCqaEs.exe
  C:\Windows\System\lGCqaEs.exe
  2⤵
  PID:5932
- C:\Windows\System\BqSevsD.exe
  C:\Windows\System\BqSevsD.exe
  2⤵
  PID:752
- C:\Windows\System\IkLadci.exe
  C:\Windows\System\IkLadci.exe
  2⤵
  PID:3524
- C:\Windows\System\zfzEXgj.exe
  C:\Windows\System\zfzEXgj.exe
  2⤵
  PID:2616
- C:\Windows\System\XSHsSdN.exe
  C:\Windows\System\XSHsSdN.exe
  2⤵
  PID:6352
- C:\Windows\System\voulqBR.exe
  C:\Windows\System\voulqBR.exe
  2⤵
  PID:6492
- C:\Windows\System\RrjlMbS.exe
  C:\Windows\System\RrjlMbS.exe
  2⤵
  PID:6612
- C:\Windows\System\AshJaAr.exe
  C:\Windows\System\AshJaAr.exe
  2⤵
  PID:6716
- C:\Windows\System\xkCVUIP.exe
  C:\Windows\System\xkCVUIP.exe
  2⤵
  PID:6932
- C:\Windows\System\ZZhjKKW.exe
  C:\Windows\System\ZZhjKKW.exe
  2⤵
  PID:7084
- C:\Windows\System\WqNvkeZ.exe
  C:\Windows\System\WqNvkeZ.exe
  2⤵
  PID:2928
- C:\Windows\System\BDugpds.exe
  C:\Windows\System\BDugpds.exe
  2⤵
  PID:6324
- C:\Windows\System\zvSyzBA.exe
  C:\Windows\System\zvSyzBA.exe
  2⤵
  PID:3856
- C:\Windows\System\JnXaGNE.exe
  C:\Windows\System\JnXaGNE.exe
  2⤵
  PID:6568
- C:\Windows\System\eWCDLFF.exe
  C:\Windows\System\eWCDLFF.exe
  2⤵
  PID:7100
- C:\Windows\System\nFiMdXM.exe
  C:\Windows\System\nFiMdXM.exe
  2⤵
  PID:1256
- C:\Windows\System\zPKQHhl.exe
  C:\Windows\System\zPKQHhl.exe
  2⤵
  PID:6260
- C:\Windows\System\ifSzmxp.exe
  C:\Windows\System\ifSzmxp.exe
  2⤵
  PID:4336
- C:\Windows\System\uboyNCi.exe
  C:\Windows\System\uboyNCi.exe
  2⤵
  PID:7192
- C:\Windows\System\DSWZFdG.exe
  C:\Windows\System\DSWZFdG.exe
  2⤵
  PID:7224
- C:\Windows\System\EblDhWD.exe
  C:\Windows\System\EblDhWD.exe
  2⤵
  PID:7248
- C:\Windows\System\jNuCajV.exe
  C:\Windows\System\jNuCajV.exe
  2⤵
  PID:7276
- C:\Windows\System\eLdsaci.exe
  C:\Windows\System\eLdsaci.exe
  2⤵
  PID:7300
- C:\Windows\System\JGPOmFY.exe
  C:\Windows\System\JGPOmFY.exe
  2⤵
  PID:7328
- C:\Windows\System\FSndgek.exe
  C:\Windows\System\FSndgek.exe
  2⤵
  PID:7352
- C:\Windows\System\VaSRnSb.exe
  C:\Windows\System\VaSRnSb.exe
  2⤵
  PID:7376
- C:\Windows\System\vhlNLpn.exe
  C:\Windows\System\vhlNLpn.exe
  2⤵
  PID:7408
- C:\Windows\System\sWLgUDF.exe
  C:\Windows\System\sWLgUDF.exe
  2⤵
  PID:7432
- C:\Windows\System\lLzvmSp.exe
  C:\Windows\System\lLzvmSp.exe
  2⤵
  PID:7460
- C:\Windows\System\kSQFSVy.exe
  C:\Windows\System\kSQFSVy.exe
  2⤵
  PID:7488
- C:\Windows\System\xsbRAMS.exe
  C:\Windows\System\xsbRAMS.exe
  2⤵
  PID:7540
- C:\Windows\System\tovHoWR.exe
  C:\Windows\System\tovHoWR.exe
  2⤵
  PID:7568
- C:\Windows\System\biQmcxc.exe
  C:\Windows\System\biQmcxc.exe
  2⤵
  PID:7584
- C:\Windows\System\nTluJtU.exe
  C:\Windows\System\nTluJtU.exe
  2⤵
  PID:7612
- C:\Windows\System\wqcIzBD.exe
  C:\Windows\System\wqcIzBD.exe
  2⤵
  PID:7640
- C:\Windows\System\ywkUVuD.exe
  C:\Windows\System\ywkUVuD.exe
  2⤵
  PID:7680
- C:\Windows\System\LgmeOpw.exe
  C:\Windows\System\LgmeOpw.exe
  2⤵
  PID:7704
- C:\Windows\System\VigTdsd.exe
  C:\Windows\System\VigTdsd.exe
  2⤵
  PID:7736
- C:\Windows\System\DKqmTVU.exe
  C:\Windows\System\DKqmTVU.exe
  2⤵
  PID:7764
- C:\Windows\System\vfHkkPa.exe
  C:\Windows\System\vfHkkPa.exe
  2⤵
  PID:7780
- C:\Windows\System\nXKWoKm.exe
  C:\Windows\System\nXKWoKm.exe
  2⤵
  PID:7820
- C:\Windows\System\YKzNdyo.exe
  C:\Windows\System\YKzNdyo.exe
  2⤵
  PID:7848
- C:\Windows\System\NpzgkQn.exe
  C:\Windows\System\NpzgkQn.exe
  2⤵
  PID:7864
- C:\Windows\System\CupJSKv.exe
  C:\Windows\System\CupJSKv.exe
  2⤵
  PID:7880
- C:\Windows\System\pGkSFZK.exe
  C:\Windows\System\pGkSFZK.exe
  2⤵
  PID:7896
- C:\Windows\System\mOfYmiy.exe
  C:\Windows\System\mOfYmiy.exe
  2⤵
  PID:7912
- C:\Windows\System\CwNllBZ.exe
  C:\Windows\System\CwNllBZ.exe
  2⤵
  PID:7928
- C:\Windows\System\VnHmFHl.exe
  C:\Windows\System\VnHmFHl.exe
  2⤵
  PID:7960
- C:\Windows\System\fVURpwc.exe
  C:\Windows\System\fVURpwc.exe
  2⤵
  PID:7996
- C:\Windows\System\zSHuElv.exe
  C:\Windows\System\zSHuElv.exe
  2⤵
  PID:8040
- C:\Windows\System\yFVcAHX.exe
  C:\Windows\System\yFVcAHX.exe
  2⤵
  PID:8072
- C:\Windows\System\UkIvPsJ.exe
  C:\Windows\System\UkIvPsJ.exe
  2⤵
  PID:8116
- C:\Windows\System\LboDaLF.exe
  C:\Windows\System\LboDaLF.exe
  2⤵
  PID:8152
- C:\Windows\System\JBBSmBB.exe
  C:\Windows\System\JBBSmBB.exe
  2⤵
  PID:8172
- C:\Windows\System\iABdNQc.exe
  C:\Windows\System\iABdNQc.exe
  2⤵
  PID:7176
- C:\Windows\System\nrHQdjJ.exe
  C:\Windows\System\nrHQdjJ.exe
  2⤵
  PID:7244
- C:\Windows\System\lGcZzRY.exe
  C:\Windows\System\lGcZzRY.exe
  2⤵
  PID:7316
- C:\Windows\System\jfeAjqa.exe
  C:\Windows\System\jfeAjqa.exe
  2⤵
  PID:7336
- C:\Windows\System\OeLDwFT.exe
  C:\Windows\System\OeLDwFT.exe
  2⤵
  PID:7428
- C:\Windows\System\ZLBpzDr.exe
  C:\Windows\System\ZLBpzDr.exe
  2⤵
  PID:7452
- C:\Windows\System\BrDcjgB.exe
  C:\Windows\System\BrDcjgB.exe
  2⤵
  PID:7516
- C:\Windows\System\bPbFeRx.exe
  C:\Windows\System\bPbFeRx.exe
  2⤵
  PID:7636
- C:\Windows\System\KMJCNSc.exe
  C:\Windows\System\KMJCNSc.exe
  2⤵
  PID:2644
- C:\Windows\System\OUzeJXd.exe
  C:\Windows\System\OUzeJXd.exe
  2⤵
  PID:7756
- C:\Windows\System\FJrsOov.exe
  C:\Windows\System\FJrsOov.exe
  2⤵
  PID:7812
- C:\Windows\System\eguUfHa.exe
  C:\Windows\System\eguUfHa.exe
  2⤵
  PID:7876
- C:\Windows\System\HbEZDCS.exe
  C:\Windows\System\HbEZDCS.exe
  2⤵
  PID:7940
- C:\Windows\System\ShjesPv.exe
  C:\Windows\System\ShjesPv.exe
  2⤵
  PID:7956
- C:\Windows\System\uSNQFNl.exe
  C:\Windows\System\uSNQFNl.exe
  2⤵
  PID:8056
- C:\Windows\System\TvLcKcU.exe
  C:\Windows\System\TvLcKcU.exe
  2⤵
  PID:8064
- C:\Windows\System\pFWqiDm.exe
  C:\Windows\System\pFWqiDm.exe
  2⤵
  PID:7220
- C:\Windows\System\IQHxfKy.exe
  C:\Windows\System\IQHxfKy.exe
  2⤵
  PID:7272
- C:\Windows\System\OBEmvga.exe
  C:\Windows\System\OBEmvga.exe
  2⤵
  PID:7424
- C:\Windows\System\wmXgwZi.exe
  C:\Windows\System\wmXgwZi.exe
  2⤵
  PID:7552
- C:\Windows\System\XHetBMZ.exe
  C:\Windows\System\XHetBMZ.exe
  2⤵
  PID:7676
- C:\Windows\System\xxDbcRg.exe
  C:\Windows\System\xxDbcRg.exe
  2⤵
  PID:7796
- C:\Windows\System\EFIhKXv.exe
  C:\Windows\System\EFIhKXv.exe
  2⤵
  PID:7888
- C:\Windows\System\blINBTy.exe
  C:\Windows\System\blINBTy.exe
  2⤵
  PID:8024
- C:\Windows\System\yeFqmYc.exe
  C:\Windows\System\yeFqmYc.exe
  2⤵
  PID:7320
- C:\Windows\System\nKnTMvN.exe
  C:\Windows\System\nKnTMvN.exe
  2⤵
  PID:7860
- C:\Windows\System\ZQpRPls.exe
  C:\Windows\System\ZQpRPls.exe
  2⤵
  PID:7724
- C:\Windows\System\wnLCUHY.exe
  C:\Windows\System\wnLCUHY.exe
  2⤵
  PID:8164
- C:\Windows\System\jMLbTlr.exe
  C:\Windows\System\jMLbTlr.exe
  2⤵
  PID:8224
- C:\Windows\System\RkZrnpn.exe
  C:\Windows\System\RkZrnpn.exe
  2⤵
  PID:8248
- C:\Windows\System\QkZkgrn.exe
  C:\Windows\System\QkZkgrn.exe
  2⤵
  PID:8264
- C:\Windows\System\CCCHbSx.exe
  C:\Windows\System\CCCHbSx.exe
  2⤵
  PID:8304
- C:\Windows\System\ePBybfk.exe
  C:\Windows\System\ePBybfk.exe
  2⤵
  PID:8344
- C:\Windows\System\xpBByXu.exe
  C:\Windows\System\xpBByXu.exe
  2⤵
  PID:8360
- C:\Windows\System\hshKQPl.exe
  C:\Windows\System\hshKQPl.exe
  2⤵
  PID:8400
- C:\Windows\System\YwwvbKy.exe
  C:\Windows\System\YwwvbKy.exe
  2⤵
  PID:8428
- C:\Windows\System\ynkfEdS.exe
  C:\Windows\System\ynkfEdS.exe
  2⤵
  PID:8456
- C:\Windows\System\XmYgClH.exe
  C:\Windows\System\XmYgClH.exe
  2⤵
  PID:8472
- C:\Windows\System\MCzviaa.exe
  C:\Windows\System\MCzviaa.exe
  2⤵
  PID:8488
- C:\Windows\System\IlcJpWF.exe
  C:\Windows\System\IlcJpWF.exe
  2⤵
  PID:8504
- C:\Windows\System\exuMCdb.exe
  C:\Windows\System\exuMCdb.exe
  2⤵
  PID:8540
- C:\Windows\System\uKaSLrt.exe
  C:\Windows\System\uKaSLrt.exe
  2⤵
  PID:8568
- C:\Windows\System\MZDYPjN.exe
  C:\Windows\System\MZDYPjN.exe
  2⤵
  PID:8600
- C:\Windows\System\DrZgdQN.exe
  C:\Windows\System\DrZgdQN.exe
  2⤵
  PID:8624
- C:\Windows\System\SgfAUJr.exe
  C:\Windows\System\SgfAUJr.exe
  2⤵
  PID:8656
- C:\Windows\System\sNLwnon.exe
  C:\Windows\System\sNLwnon.exe
  2⤵
  PID:8708
- C:\Windows\System\eIMZXZa.exe
  C:\Windows\System\eIMZXZa.exe
  2⤵
  PID:8728
- C:\Windows\System\lMCgWYh.exe
  C:\Windows\System\lMCgWYh.exe
  2⤵
  PID:8756
- C:\Windows\System\qXQEZlE.exe
  C:\Windows\System\qXQEZlE.exe
  2⤵
  PID:8796
- C:\Windows\System\Bcrswko.exe
  C:\Windows\System\Bcrswko.exe
  2⤵
  PID:8812
- C:\Windows\System\LjEhzKz.exe
  C:\Windows\System\LjEhzKz.exe
  2⤵
  PID:8840
- C:\Windows\System\sUHRSqb.exe
  C:\Windows\System\sUHRSqb.exe
  2⤵
  PID:8856
- C:\Windows\System\XqwMmrc.exe
  C:\Windows\System\XqwMmrc.exe
  2⤵
  PID:8884
- C:\Windows\System\HRUMYYC.exe
  C:\Windows\System\HRUMYYC.exe
  2⤵
  PID:8908
- C:\Windows\System\ZBlZrhV.exe
  C:\Windows\System\ZBlZrhV.exe
  2⤵
  PID:8952
- C:\Windows\System\OxXgMHU.exe
  C:\Windows\System\OxXgMHU.exe
  2⤵
  PID:8968
- C:\Windows\System\nFqvrqy.exe
  C:\Windows\System\nFqvrqy.exe
  2⤵
  PID:8996
- C:\Windows\System\VMwDeUg.exe
  C:\Windows\System\VMwDeUg.exe
  2⤵
  PID:9020
- C:\Windows\System\NUURPmt.exe
  C:\Windows\System\NUURPmt.exe
  2⤵
  PID:9044
- C:\Windows\System\FpkTzWy.exe
  C:\Windows\System\FpkTzWy.exe
  2⤵
  PID:9072
- C:\Windows\System\JxGxGFT.exe
  C:\Windows\System\JxGxGFT.exe
  2⤵
  PID:9100
- C:\Windows\System\ZlyjOMz.exe
  C:\Windows\System\ZlyjOMz.exe
  2⤵
  PID:9164
- C:\Windows\System\LsEKytu.exe
  C:\Windows\System\LsEKytu.exe
  2⤵
  PID:9180
- C:\Windows\System\QiuVpBT.exe
  C:\Windows\System\QiuVpBT.exe
  2⤵
  PID:9208
- C:\Windows\System\SHIkObT.exe
  C:\Windows\System\SHIkObT.exe
  2⤵
  PID:8236
- C:\Windows\System\pQgTQwW.exe
  C:\Windows\System\pQgTQwW.exe
  2⤵
  PID:8324
- C:\Windows\System\kjBrnyV.exe
  C:\Windows\System\kjBrnyV.exe
  2⤵
  PID:8376
- C:\Windows\System\LONNhwL.exe
  C:\Windows\System\LONNhwL.exe
  2⤵
  PID:8412
- C:\Windows\System\NLZHauk.exe
  C:\Windows\System\NLZHauk.exe
  2⤵
  PID:8464
- C:\Windows\System\uwjMfbU.exe
  C:\Windows\System\uwjMfbU.exe
  2⤵
  PID:8576
- C:\Windows\System\uhughzR.exe
  C:\Windows\System\uhughzR.exe
  2⤵
  PID:8620
- C:\Windows\System\ZcVKswY.exe
  C:\Windows\System\ZcVKswY.exe
  2⤵
  PID:8700
- C:\Windows\System\jHSJYwk.exe
  C:\Windows\System\jHSJYwk.exe
  2⤵
  PID:8740
- C:\Windows\System\cqavJxX.exe
  C:\Windows\System\cqavJxX.exe
  2⤵
  PID:8808
- C:\Windows\System\DEzNTwr.exe
  C:\Windows\System\DEzNTwr.exe
  2⤵
  PID:8932
- C:\Windows\System\abVofpT.exe
  C:\Windows\System\abVofpT.exe
  2⤵
  PID:8964
- C:\Windows\System\nfuFuMq.exe
  C:\Windows\System\nfuFuMq.exe
  2⤵
  PID:9052
- C:\Windows\System\nsObZyz.exe
  C:\Windows\System\nsObZyz.exe
  2⤵
  PID:9088
- C:\Windows\System\WKMVaWl.exe
  C:\Windows\System\WKMVaWl.exe
  2⤵
  PID:9136
- C:\Windows\System\rhNnMpK.exe
  C:\Windows\System\rhNnMpK.exe
  2⤵
  PID:9204
- C:\Windows\System\XoMtsLG.exe
  C:\Windows\System\XoMtsLG.exe
  2⤵
  PID:8484
- C:\Windows\System\ADXxLts.exe
  C:\Windows\System\ADXxLts.exe
  2⤵
  PID:8556
- C:\Windows\System\yIOeLDT.exe
  C:\Windows\System\yIOeLDT.exe
  2⤵
  PID:8752
- C:\Windows\System\pBsjTTQ.exe
  C:\Windows\System\pBsjTTQ.exe
  2⤵
  PID:8868
- C:\Windows\System\JrRsQIg.exe
  C:\Windows\System\JrRsQIg.exe
  2⤵
  PID:8980
- C:\Windows\System\ANjEgIV.exe
  C:\Windows\System\ANjEgIV.exe
  2⤵
  PID:8196
- C:\Windows\System\qLHZbhm.exe
  C:\Windows\System\qLHZbhm.exe
  2⤵
  PID:8396
- C:\Windows\System\NJaFliM.exe
  C:\Windows\System\NJaFliM.exe
  2⤵
  PID:8500
- C:\Windows\System\NLMHGqM.exe
  C:\Windows\System\NLMHGqM.exe
  2⤵
  PID:8928
- C:\Windows\System\krCWStx.exe
  C:\Windows\System\krCWStx.exe
  2⤵
  PID:9096
- C:\Windows\System\cnbpgVg.exe
  C:\Windows\System\cnbpgVg.exe
  2⤵
  PID:9268
- C:\Windows\System\FoYsvck.exe
  C:\Windows\System\FoYsvck.exe
  2⤵
  PID:9284
- C:\Windows\System\EGvgTiP.exe
  C:\Windows\System\EGvgTiP.exe
  2⤵
  PID:9316
- C:\Windows\System\sULMucZ.exe
  C:\Windows\System\sULMucZ.exe
  2⤵
  PID:9368
- C:\Windows\System\NOthtqq.exe
  C:\Windows\System\NOthtqq.exe
  2⤵
  PID:9384
- C:\Windows\System\NPggPut.exe
  C:\Windows\System\NPggPut.exe
  2⤵
  PID:9412
- C:\Windows\System\JUIbUyI.exe
  C:\Windows\System\JUIbUyI.exe
  2⤵
  PID:9440
- C:\Windows\System\tEBkdvO.exe
  C:\Windows\System\tEBkdvO.exe
  2⤵
  PID:9460
- C:\Windows\System\PghSYfb.exe
  C:\Windows\System\PghSYfb.exe
  2⤵
  PID:9492
- C:\Windows\System\tAJvUHu.exe
  C:\Windows\System\tAJvUHu.exe
  2⤵
  PID:9520
- C:\Windows\System\sszymbh.exe
  C:\Windows\System\sszymbh.exe
  2⤵
  PID:9552
- C:\Windows\System\lwMiTDH.exe
  C:\Windows\System\lwMiTDH.exe
  2⤵
  PID:9576
- C:\Windows\System\wapYfTt.exe
  C:\Windows\System\wapYfTt.exe
  2⤵
  PID:9600
- C:\Windows\System\MwgWzsv.exe
  C:\Windows\System\MwgWzsv.exe
  2⤵
  PID:9628
- C:\Windows\System\kcMOUpy.exe
  C:\Windows\System\kcMOUpy.exe
  2⤵
  PID:9664
- C:\Windows\System\EnNagOR.exe
  C:\Windows\System\EnNagOR.exe
  2⤵
  PID:9684
- C:\Windows\System\TmQIhIj.exe
  C:\Windows\System\TmQIhIj.exe
  2⤵
  PID:9708
- C:\Windows\System\ONcSFaq.exe
  C:\Windows\System\ONcSFaq.exe
  2⤵
  PID:9736
- C:\Windows\System\rFfYuDy.exe
  C:\Windows\System\rFfYuDy.exe
  2⤵
  PID:9756
- C:\Windows\System\YHeCEXE.exe
  C:\Windows\System\YHeCEXE.exe
  2⤵
  PID:9804
- C:\Windows\System\VYbUxHy.exe
  C:\Windows\System\VYbUxHy.exe
  2⤵
  PID:9836
- C:\Windows\System\JyNWVGx.exe
  C:\Windows\System\JyNWVGx.exe
  2⤵
  PID:9864
- C:\Windows\System\fxCgvVU.exe
  C:\Windows\System\fxCgvVU.exe
  2⤵
  PID:9880
- C:\Windows\System\aZpdLKl.exe
  C:\Windows\System\aZpdLKl.exe
  2⤵
  PID:9904
- C:\Windows\System\GhKyiJU.exe
  C:\Windows\System\GhKyiJU.exe
  2⤵
  PID:9932
- C:\Windows\System\bfeDbqX.exe
  C:\Windows\System\bfeDbqX.exe
  2⤵
  PID:9960
- C:\Windows\System\VKvVecZ.exe
  C:\Windows\System\VKvVecZ.exe
  2⤵
  PID:9996
- C:\Windows\System\SSeFBKq.exe
  C:\Windows\System\SSeFBKq.exe
  2⤵
  PID:10032
- C:\Windows\System\UtHtCTr.exe
  C:\Windows\System\UtHtCTr.exe
  2⤵
  PID:10052
- C:\Windows\System\CAQoYZF.exe
  C:\Windows\System\CAQoYZF.exe
  2⤵
  PID:10092
- C:\Windows\System\jMncQiV.exe
  C:\Windows\System\jMncQiV.exe
  2⤵
  PID:10116
- C:\Windows\System\idDtFON.exe
  C:\Windows\System\idDtFON.exe
  2⤵
  PID:10160
- C:\Windows\System\Nkswuok.exe
  C:\Windows\System\Nkswuok.exe
  2⤵
  PID:10188
- C:\Windows\System\UVDGusv.exe
  C:\Windows\System\UVDGusv.exe
  2⤵
  PID:10212
- C:\Windows\System\ZEdSxJz.exe
  C:\Windows\System\ZEdSxJz.exe
  2⤵
  PID:8632
- C:\Windows\System\jQYlMHK.exe
  C:\Windows\System\jQYlMHK.exe
  2⤵
  PID:9252
- C:\Windows\System\AlYtodO.exe
  C:\Windows\System\AlYtodO.exe
  2⤵
  PID:9312
- C:\Windows\System\AycxVik.exe
  C:\Windows\System\AycxVik.exe
  2⤵
  PID:9400
- C:\Windows\System\ITfyrmf.exe
  C:\Windows\System\ITfyrmf.exe
  2⤵
  PID:9456
- C:\Windows\System\PlXuBLy.exe
  C:\Windows\System\PlXuBLy.exe
  2⤵
  PID:9568
- C:\Windows\System\hqFdjKD.exe
  C:\Windows\System\hqFdjKD.exe
  2⤵
  PID:8904
- C:\Windows\System\JzLIgyS.exe
  C:\Windows\System\JzLIgyS.exe
  2⤵
  PID:9592
- C:\Windows\System\UJidmoV.exe
  C:\Windows\System\UJidmoV.exe
  2⤵
  PID:9648
- C:\Windows\System\JSBqveq.exe
  C:\Windows\System\JSBqveq.exe
  2⤵
  PID:9680
- C:\Windows\System\sOGFSPM.exe
  C:\Windows\System\sOGFSPM.exe
  2⤵
  PID:9896
- C:\Windows\System\rQwbdVa.exe
  C:\Windows\System\rQwbdVa.exe
  2⤵
  PID:9928
- C:\Windows\System\nCaCEeN.exe
  C:\Windows\System\nCaCEeN.exe
  2⤵
  PID:9988
- C:\Windows\System\KrGJXJY.exe
  C:\Windows\System\KrGJXJY.exe
  2⤵
  PID:10040
- C:\Windows\System\fCnJDov.exe
  C:\Windows\System\fCnJDov.exe
  2⤵
  PID:10136
- C:\Windows\System\gDMDDsJ.exe
  C:\Windows\System\gDMDDsJ.exe
  2⤵
  PID:10180
- C:\Windows\System\KWVmwRE.exe
  C:\Windows\System\KWVmwRE.exe
  2⤵
  PID:10204
- C:\Windows\System\nxInrge.exe
  C:\Windows\System\nxInrge.exe
  2⤵
  PID:9228
- C:\Windows\System\hyEimZX.exe
  C:\Windows\System\hyEimZX.exe
  2⤵
  PID:9380
- C:\Windows\System\zHZwoHD.exe
  C:\Windows\System\zHZwoHD.exe
  2⤵
  PID:9480
- C:\Windows\System\kJavyyz.exe
  C:\Windows\System\kJavyyz.exe
  2⤵
  PID:9620
- C:\Windows\System\cmLSdPB.exe
  C:\Windows\System\cmLSdPB.exe
  2⤵
  PID:9956
- C:\Windows\System\bBzNGXJ.exe
  C:\Windows\System\bBzNGXJ.exe
  2⤵
  PID:10084
- C:\Windows\System\FxItuVK.exe
  C:\Windows\System\FxItuVK.exe
  2⤵
  PID:10200
- C:\Windows\System\jPYolyS.exe
  C:\Windows\System\jPYolyS.exe
  2⤵
  PID:9428
- C:\Windows\System\kfHtMcn.exe
  C:\Windows\System\kfHtMcn.exe
  2⤵
  PID:9564
- C:\Windows\System\DgcZOeM.exe
  C:\Windows\System\DgcZOeM.exe
  2⤵
  PID:9172
- C:\Windows\System\ziNltQE.exe
  C:\Windows\System\ziNltQE.exe
  2⤵
  PID:9640
- C:\Windows\System\SauDiMp.exe
  C:\Windows\System\SauDiMp.exe
  2⤵
  PID:456
- C:\Windows\System\BvJzSsI.exe
  C:\Windows\System\BvJzSsI.exe
  2⤵
  PID:10252
- C:\Windows\System\yYIbdIV.exe
  C:\Windows\System\yYIbdIV.exe
  2⤵
  PID:10284
- C:\Windows\System\nfXoHpx.exe
  C:\Windows\System\nfXoHpx.exe
  2⤵
  PID:10304
- C:\Windows\System\yGkhmxP.exe
  C:\Windows\System\yGkhmxP.exe
  2⤵
  PID:10332
- C:\Windows\System\GVEvAbM.exe
  C:\Windows\System\GVEvAbM.exe
  2⤵
  PID:10360
- C:\Windows\System\ZGaiMGQ.exe
  C:\Windows\System\ZGaiMGQ.exe
  2⤵
  PID:10388
- C:\Windows\System\oYeLwUQ.exe
  C:\Windows\System\oYeLwUQ.exe
  2⤵
  PID:10420
- C:\Windows\System\CLaaxct.exe
  C:\Windows\System\CLaaxct.exe
  2⤵
  PID:10448
- C:\Windows\System\pfytpVm.exe
  C:\Windows\System\pfytpVm.exe
  2⤵
  PID:10492
- C:\Windows\System\PlBslTO.exe
  C:\Windows\System\PlBslTO.exe
  2⤵
  PID:10520
- C:\Windows\System\IRZhxir.exe
  C:\Windows\System\IRZhxir.exe
  2⤵
  PID:10536
- C:\Windows\System\nlUCXab.exe
  C:\Windows\System\nlUCXab.exe
  2⤵
  PID:10556
- C:\Windows\System\pDzvNUQ.exe
  C:\Windows\System\pDzvNUQ.exe
  2⤵
  PID:10584
- C:\Windows\System\rFHlmuQ.exe
  C:\Windows\System\rFHlmuQ.exe
  2⤵
  PID:10608
- C:\Windows\System\Quesqjc.exe
  C:\Windows\System\Quesqjc.exe
  2⤵
  PID:10632
- C:\Windows\System\UJqmpNF.exe
  C:\Windows\System\UJqmpNF.exe
  2⤵
  PID:10676
- C:\Windows\System\pxymDDY.exe
  C:\Windows\System\pxymDDY.exe
  2⤵
  PID:10700
- C:\Windows\System\UkJzYuT.exe
  C:\Windows\System\UkJzYuT.exe
  2⤵
  PID:10728
- C:\Windows\System\vdeWVhg.exe
  C:\Windows\System\vdeWVhg.exe
  2⤵
  PID:10748
- C:\Windows\System\NdVdjOw.exe
  C:\Windows\System\NdVdjOw.exe
  2⤵
  PID:10776
- C:\Windows\System\CqEjJZj.exe
  C:\Windows\System\CqEjJZj.exe
  2⤵
  PID:10792
- C:\Windows\System\MgobpbW.exe
  C:\Windows\System\MgobpbW.exe
  2⤵
  PID:10824
- C:\Windows\System\OzBQKVY.exe
  C:\Windows\System\OzBQKVY.exe
  2⤵
  PID:10884
- C:\Windows\System\KczPNMr.exe
  C:\Windows\System\KczPNMr.exe
  2⤵
  PID:10912
- C:\Windows\System\IlouYKe.exe
  C:\Windows\System\IlouYKe.exe
  2⤵
  PID:10940
- C:\Windows\System\OtimOgW.exe
  C:\Windows\System\OtimOgW.exe
  2⤵
  PID:10968
- C:\Windows\System\vIvIYOB.exe
  C:\Windows\System\vIvIYOB.exe
  2⤵
  PID:10992
- C:\Windows\System\vqzDhHh.exe
  C:\Windows\System\vqzDhHh.exe
  2⤵
  PID:11016
- C:\Windows\System\sQvYPrL.exe
  C:\Windows\System\sQvYPrL.exe
  2⤵
  PID:11056
- C:\Windows\System\QLKlJKk.exe
  C:\Windows\System\QLKlJKk.exe
  2⤵
  PID:11072
- C:\Windows\System\iWqVOyp.exe
  C:\Windows\System\iWqVOyp.exe
  2⤵
  PID:11092
- C:\Windows\System\BgaDWit.exe
  C:\Windows\System\BgaDWit.exe
  2⤵
  PID:11128
- C:\Windows\System\PpHcmyW.exe
  C:\Windows\System\PpHcmyW.exe
  2⤵
  PID:11156
- C:\Windows\System\stiKdxf.exe
  C:\Windows\System\stiKdxf.exe
  2⤵
  PID:11176
- C:\Windows\System\CvCIVVt.exe
  C:\Windows\System\CvCIVVt.exe
  2⤵
  PID:11200
- C:\Windows\System\Yudgaee.exe
  C:\Windows\System\Yudgaee.exe
  2⤵
  PID:11244
- C:\Windows\System\QsISLCu.exe
  C:\Windows\System\QsISLCu.exe
  2⤵
  PID:10272
- C:\Windows\System\EaaJgmC.exe
  C:\Windows\System\EaaJgmC.exe
  2⤵
  PID:10320
- C:\Windows\System\LnfSUcl.exe
  C:\Windows\System\LnfSUcl.exe
  2⤵
  PID:10380
- C:\Windows\System\kpQfMQw.exe
  C:\Windows\System\kpQfMQw.exe
  2⤵
  PID:10436
- C:\Windows\System\lRevAgG.exe
  C:\Windows\System\lRevAgG.exe
  2⤵
  PID:10480
- C:\Windows\System\AKFoACP.exe
  C:\Windows\System\AKFoACP.exe
  2⤵
  PID:10516
- C:\Windows\System\thBmLcp.exe
  C:\Windows\System\thBmLcp.exe
  2⤵
  PID:10568
- C:\Windows\System\jhzjDsY.exe
  C:\Windows\System\jhzjDsY.exe
  2⤵
  PID:10624
- C:\Windows\System\pmKaGxF.exe
  C:\Windows\System\pmKaGxF.exe
  2⤵
  PID:10724
- C:\Windows\System\dHwvYxK.exe
  C:\Windows\System\dHwvYxK.exe
  2⤵
  PID:10784
- C:\Windows\System\ZYZBUDi.exe
  C:\Windows\System\ZYZBUDi.exe
  2⤵
  PID:10808
- C:\Windows\System\wYtGogP.exe
  C:\Windows\System\wYtGogP.exe
  2⤵
  PID:10904
- C:\Windows\System\vUsUAyt.exe
  C:\Windows\System\vUsUAyt.exe
  2⤵
  PID:10980
- C:\Windows\System\xJhXMTp.exe
  C:\Windows\System\xJhXMTp.exe
  2⤵
  PID:11048
- C:\Windows\System\YFOEDFo.exe
  C:\Windows\System\YFOEDFo.exe
  2⤵
  PID:11140
- C:\Windows\System\GwZzACC.exe
  C:\Windows\System\GwZzACC.exe
  2⤵
  PID:11188
- C:\Windows\System\ojmVkRp.exe
  C:\Windows\System\ojmVkRp.exe
  2⤵
  PID:9344
- C:\Windows\System\ACVIMuw.exe
  C:\Windows\System\ACVIMuw.exe
  2⤵
  PID:10428
- C:\Windows\System\UAVEiXf.exe
  C:\Windows\System\UAVEiXf.exe
  2⤵
  PID:10664
- C:\Windows\System\qzODwdS.exe
  C:\Windows\System\qzODwdS.exe
  2⤵
  PID:10720
- C:\Windows\System\IUNINNN.exe
  C:\Windows\System\IUNINNN.exe
  2⤵
  PID:10924
- C:\Windows\System\DMvSmuU.exe
  C:\Windows\System\DMvSmuU.exe
  2⤵
  PID:9832
- C:\Windows\System\CifNdiK.exe
  C:\Windows\System\CifNdiK.exe
  2⤵
  PID:11148
- C:\Windows\System\lTIMBNM.exe
  C:\Windows\System\lTIMBNM.exe
  2⤵
  PID:10296
- C:\Windows\System\iWxjQDn.exe
  C:\Windows\System\iWxjQDn.exe
  2⤵
  PID:10652
- C:\Windows\System\NoVaDUN.exe
  C:\Windows\System\NoVaDUN.exe
  2⤵
  PID:11144
- C:\Windows\System\RKeGKbk.exe
  C:\Windows\System\RKeGKbk.exe
  2⤵
  PID:11272
- C:\Windows\System\xLjteaU.exe
  C:\Windows\System\xLjteaU.exe
  2⤵
  PID:11288
- C:\Windows\System\lbSkEdi.exe
  C:\Windows\System\lbSkEdi.exe
  2⤵
  PID:11340
- C:\Windows\System\tzwANrn.exe
  C:\Windows\System\tzwANrn.exe
  2⤵
  PID:11356
- C:\Windows\System\YsJHOaj.exe
  C:\Windows\System\YsJHOaj.exe
  2⤵
  PID:11372
- C:\Windows\System\YDnwWhx.exe
  C:\Windows\System\YDnwWhx.exe
  2⤵
  PID:11396
- C:\Windows\System\yAchPip.exe
  C:\Windows\System\yAchPip.exe
  2⤵
  PID:11416
- C:\Windows\System\hbFUtpR.exe
  C:\Windows\System\hbFUtpR.exe
  2⤵
  PID:11440
- C:\Windows\System\UUauwPj.exe
  C:\Windows\System\UUauwPj.exe
  2⤵
  PID:11468
- C:\Windows\System\JczdiKb.exe
  C:\Windows\System\JczdiKb.exe
  2⤵
  PID:11516
- C:\Windows\System\NdIxrQx.exe
  C:\Windows\System\NdIxrQx.exe
  2⤵
  PID:11544
- C:\Windows\System\xggRBvi.exe
  C:\Windows\System\xggRBvi.exe
  2⤵
  PID:11572
- C:\Windows\System\VBUaiKp.exe
  C:\Windows\System\VBUaiKp.exe
  2⤵
  PID:11604
- C:\Windows\System\GCeemDY.exe
  C:\Windows\System\GCeemDY.exe
  2⤵
  PID:11624
- C:\Windows\System\TsNjXVl.exe
  C:\Windows\System\TsNjXVl.exe
  2⤵
  PID:11644
- C:\Windows\System\HfLbAXm.exe
  C:\Windows\System\HfLbAXm.exe
  2⤵
  PID:11684
- C:\Windows\System\YsxyEBw.exe
  C:\Windows\System\YsxyEBw.exe
  2⤵
  PID:11708
- C:\Windows\System\GvbeTEG.exe
  C:\Windows\System\GvbeTEG.exe
  2⤵
  PID:11748
- C:\Windows\System\LSsnhNq.exe
  C:\Windows\System\LSsnhNq.exe
  2⤵
  PID:11776
- C:\Windows\System\XchtPbz.exe
  C:\Windows\System\XchtPbz.exe
  2⤵
  PID:11804
- C:\Windows\System\SaflaSA.exe
  C:\Windows\System\SaflaSA.exe
  2⤵
  PID:11832
- C:\Windows\System\GakzyfO.exe
  C:\Windows\System\GakzyfO.exe
  2⤵
  PID:11852
- C:\Windows\System\XvBDbmT.exe
  C:\Windows\System\XvBDbmT.exe
  2⤵
  PID:11884
- C:\Windows\System\MDasopt.exe
  C:\Windows\System\MDasopt.exe
  2⤵
  PID:11932
- C:\Windows\System\msqbFmS.exe
  C:\Windows\System\msqbFmS.exe
  2⤵
  PID:11956
- C:\Windows\System\IZPxfva.exe
  C:\Windows\System\IZPxfva.exe
  2⤵
  PID:11972
- C:\Windows\System\XNlgPsR.exe
  C:\Windows\System\XNlgPsR.exe
  2⤵
  PID:12012
- C:\Windows\System\JKmZhzl.exe
  C:\Windows\System\JKmZhzl.exe
  2⤵
  PID:12028
- C:\Windows\System\KDcEhaf.exe
  C:\Windows\System\KDcEhaf.exe
  2⤵
  PID:12048
- C:\Windows\System\lhsJVnA.exe
  C:\Windows\System\lhsJVnA.exe
  2⤵
  PID:12084
- C:\Windows\System\zZnaNUd.exe
  C:\Windows\System\zZnaNUd.exe
  2⤵
  PID:12112
- C:\Windows\System\fWCSBvh.exe
  C:\Windows\System\fWCSBvh.exe
  2⤵
  PID:12136
- C:\Windows\System\CchGrnk.exe
  C:\Windows\System\CchGrnk.exe
  2⤵
  PID:12168
- C:\Windows\System\FFtZEpC.exe
  C:\Windows\System\FFtZEpC.exe
  2⤵
  PID:12200
- C:\Windows\System\gZsHVsC.exe
  C:\Windows\System\gZsHVsC.exe
  2⤵
  PID:12224
- C:\Windows\System\FhMGPaU.exe
  C:\Windows\System\FhMGPaU.exe
  2⤵
  PID:12252
- C:\Windows\System\VqUwUVf.exe
  C:\Windows\System\VqUwUVf.exe
  2⤵
  PID:12280
- C:\Windows\System\wMCPGuI.exe
  C:\Windows\System\wMCPGuI.exe
  2⤵
  PID:11280
- C:\Windows\System\PNIdpob.exe
  C:\Windows\System\PNIdpob.exe
  2⤵
  PID:11328
- C:\Windows\System\gmJVqhx.exe
  C:\Windows\System\gmJVqhx.exe
  2⤵
  PID:11348
- C:\Windows\System\qPMnJVp.exe
  C:\Windows\System\qPMnJVp.exe
  2⤵
  PID:11384
- C:\Windows\System\GBZXWJD.exe
  C:\Windows\System\GBZXWJD.exe
  2⤵
  PID:11464
- C:\Windows\System\jRPoWiE.exe
  C:\Windows\System\jRPoWiE.exe
  2⤵
  PID:11524
- C:\Windows\System\FjDeZSk.exe
  C:\Windows\System\FjDeZSk.exe
  2⤵
  PID:11596
- C:\Windows\System\zlSmOxa.exe
  C:\Windows\System\zlSmOxa.exe
  2⤵
  PID:11640
- C:\Windows\System\OadpjCL.exe
  C:\Windows\System\OadpjCL.exe
  2⤵
  PID:11736
- C:\Windows\System\wsuFmAd.exe
  C:\Windows\System\wsuFmAd.exe
  2⤵
  PID:11796
- C:\Windows\System\DTOZtwP.exe
  C:\Windows\System\DTOZtwP.exe
  2⤵
  PID:11880
- C:\Windows\System\gEWYggy.exe
  C:\Windows\System\gEWYggy.exe
  2⤵
  PID:11924
- C:\Windows\System\PvThgmL.exe
  C:\Windows\System\PvThgmL.exe
  2⤵
  PID:12008
- C:\Windows\System\VVmDGRY.exe
  C:\Windows\System\VVmDGRY.exe
  2⤵
  PID:12080
- C:\Windows\System\lpSMZyU.exe
  C:\Windows\System\lpSMZyU.exe
  2⤵
  PID:12132
- C:\Windows\System\iJmIUno.exe
  C:\Windows\System\iJmIUno.exe
  2⤵
  PID:12188
- C:\Windows\System\WOmJaSX.exe
  C:\Windows\System\WOmJaSX.exe
  2⤵
  PID:10956
- C:\Windows\System\nTuqWnp.exe
  C:\Windows\System\nTuqWnp.exe
  2⤵
  PID:10840
- C:\Windows\System\wJjrnQR.exe
  C:\Windows\System\wJjrnQR.exe
  2⤵
  PID:11504
- C:\Windows\System\QxjiThn.exe
  C:\Windows\System\QxjiThn.exe
  2⤵
  PID:11676
- C:\Windows\System\fHxGWYa.exe
  C:\Windows\System\fHxGWYa.exe
  2⤵
  PID:11900
- C:\Windows\System\cOUWnqw.exe
  C:\Windows\System\cOUWnqw.exe
  2⤵
  PID:12020
- C:\Windows\System\BkCCZsw.exe
  C:\Windows\System\BkCCZsw.exe
  2⤵
  PID:12068
- C:\Windows\System\GiWtckX.exe
  C:\Windows\System\GiWtckX.exe
  2⤵
  PID:12272
- C:\Windows\System\fKqMKOU.exe
  C:\Windows\System\fKqMKOU.exe
  2⤵
  PID:11568
- C:\Windows\System\XHLlMVQ.exe
  C:\Windows\System\XHLlMVQ.exe
  2⤵
  PID:12128
- C:\Windows\System\fNgvqsR.exe
  C:\Windows\System\fNgvqsR.exe
  2⤵
  PID:11592
- C:\Windows\System\rNzkFXC.exe
  C:\Windows\System\rNzkFXC.exe
  2⤵
  PID:11724
- C:\Windows\System\KGLCmPX.exe
  C:\Windows\System\KGLCmPX.exe
  2⤵
  PID:12300
- C:\Windows\System\ObfJkzI.exe
  C:\Windows\System\ObfJkzI.exe
  2⤵
  PID:12328
- C:\Windows\System\rjDvyez.exe
  C:\Windows\System\rjDvyez.exe
  2⤵
  PID:12356
- C:\Windows\System\fOzJhqi.exe
  C:\Windows\System\fOzJhqi.exe
  2⤵
  PID:12372
- C:\Windows\System\FbmfpfD.exe
  C:\Windows\System\FbmfpfD.exe
  2⤵
  PID:12408
- C:\Windows\System\kggVqce.exe
  C:\Windows\System\kggVqce.exe
  2⤵
  PID:12452
- C:\Windows\System\WfkXEEl.exe
  C:\Windows\System\WfkXEEl.exe
  2⤵
  PID:12476
- C:\Windows\System\PEzBacs.exe
  C:\Windows\System\PEzBacs.exe
  2⤵
  PID:12496
- C:\Windows\System\GzjNDfi.exe
  C:\Windows\System\GzjNDfi.exe
  2⤵
  PID:12532
- C:\Windows\System\hjrrsZr.exe
  C:\Windows\System\hjrrsZr.exe
  2⤵
  PID:12552
- C:\Windows\System\FMmRymX.exe
  C:\Windows\System\FMmRymX.exe
  2⤵
  PID:12572
- C:\Windows\System\EhuaDpE.exe
  C:\Windows\System\EhuaDpE.exe
  2⤵
  PID:12592
- C:\Windows\System\piRnbxN.exe
  C:\Windows\System\piRnbxN.exe
  2⤵
  PID:12628
- C:\Windows\System\PivdZCQ.exe
  C:\Windows\System\PivdZCQ.exe
  2⤵
  PID:12652
- C:\Windows\System\rVMGgxH.exe
  C:\Windows\System\rVMGgxH.exe
  2⤵
  PID:12676
- C:\Windows\System\AVQRIUA.exe
  C:\Windows\System\AVQRIUA.exe
  2⤵
  PID:12712
- C:\Windows\System\HDPzeMY.exe
  C:\Windows\System\HDPzeMY.exe
  2⤵
  PID:12736
- C:\Windows\System\daTZUhj.exe
  C:\Windows\System\daTZUhj.exe
  2⤵
  PID:12764
- C:\Windows\System\oFcZWLl.exe
  C:\Windows\System\oFcZWLl.exe
  2⤵
  PID:12788
- C:\Windows\System\ocEGuAU.exe
  C:\Windows\System\ocEGuAU.exe
  2⤵
  PID:12836
- C:\Windows\System\gyrJnNy.exe
  C:\Windows\System\gyrJnNy.exe
  2⤵
  PID:12860
- C:\Windows\System\xWdJlfg.exe
  C:\Windows\System\xWdJlfg.exe
  2⤵
  PID:12888
- C:\Windows\System\bexVxcj.exe
  C:\Windows\System\bexVxcj.exe
  2⤵
  PID:12904
- C:\Windows\System\PVIHeUb.exe
  C:\Windows\System\PVIHeUb.exe
  2⤵
  PID:12944
- C:\Windows\System\vcGGVpe.exe
  C:\Windows\System\vcGGVpe.exe
  2⤵
  PID:12964
- C:\Windows\System\xBuOQPo.exe
  C:\Windows\System\xBuOQPo.exe
  2⤵
  PID:12992
- C:\Windows\System\yJRaJVa.exe
  C:\Windows\System\yJRaJVa.exe
  2⤵
  PID:13028
- C:\Windows\System\XvsTCpW.exe
  C:\Windows\System\XvsTCpW.exe
  2⤵
  PID:13048
- C:\Windows\System\HBegslC.exe
  C:\Windows\System\HBegslC.exe
  2⤵
  PID:13068
- C:\Windows\System\JiKTrMk.exe
  C:\Windows\System\JiKTrMk.exe
  2⤵
  PID:13112
- C:\Windows\System\Pojkveh.exe
  C:\Windows\System\Pojkveh.exe
  2⤵
  PID:13128
- C:\Windows\System\nZBcdjy.exe
  C:\Windows\System\nZBcdjy.exe
  2⤵
  PID:13148
- C:\Windows\System\TwqBqwk.exe
  C:\Windows\System\TwqBqwk.exe
  2⤵
  PID:13176
- C:\Windows\System\hYqHCrN.exe
  C:\Windows\System\hYqHCrN.exe
  2⤵
  PID:13212
- C:\Windows\System\IZNxCDW.exe
  C:\Windows\System\IZNxCDW.exe
  2⤵
  PID:13240
- C:\Windows\System\XryHESb.exe
  C:\Windows\System\XryHESb.exe
  2⤵
  PID:13260
- C:\Windows\System\oysivet.exe
  C:\Windows\System\oysivet.exe
  2⤵
  PID:13288
- C:\Windows\System\YATXket.exe
  C:\Windows\System\YATXket.exe
  2⤵
  PID:12344
- C:\Windows\System\xJhCyGb.exe
  C:\Windows\System\xJhCyGb.exe
  2⤵
  PID:12368
- C:\Windows\System\GTpdArU.exe
  C:\Windows\System\GTpdArU.exe
  2⤵
  PID:12440
- C:\Windows\System\mKNJTbS.exe
  C:\Windows\System\mKNJTbS.exe
  2⤵
  PID:12488
- C:\Windows\System\hhwxFZu.exe
  C:\Windows\System\hhwxFZu.exe
  2⤵
  PID:12564
- C:\Windows\System\RrVHFpu.exe
  C:\Windows\System\RrVHFpu.exe
  2⤵
  PID:12584
- C:\Windows\System\wORVtKQ.exe
  C:\Windows\System\wORVtKQ.exe
  2⤵
  PID:12668
- C:\Windows\System\JedMltJ.exe
  C:\Windows\System\JedMltJ.exe
  2⤵
  PID:12804
- C:\Windows\System\uzhaqav.exe
  C:\Windows\System\uzhaqav.exe
  2⤵
  PID:12876
- C:\Windows\System\pnGoAZo.exe
  C:\Windows\System\pnGoAZo.exe
  2⤵
  PID:12896
- C:\Windows\System\uHMzvuZ.exe
  C:\Windows\System\uHMzvuZ.exe
  2⤵
  PID:12960
- C:\Windows\System\NYxGIjD.exe
  C:\Windows\System\NYxGIjD.exe
  2⤵
  PID:13020
- C:\Windows\System\LVRrTmL.exe
  C:\Windows\System\LVRrTmL.exe
  2⤵
  PID:13092
- C:\Windows\System\EgTfOAN.exe
  C:\Windows\System\EgTfOAN.exe
  2⤵
  PID:13144
- C:\Windows\System\jzCbQQh.exe
  C:\Windows\System\jzCbQQh.exe
  2⤵
  PID:13232
- C:\Windows\System\eYcrGvz.exe
  C:\Windows\System\eYcrGvz.exe
  2⤵
  PID:13248
- C:\Windows\System\JlCKMsm.exe
  C:\Windows\System\JlCKMsm.exe
  2⤵
  PID:12384
- C:\Windows\System\nvfmlwc.exe
  C:\Windows\System\nvfmlwc.exe
  2⤵
  PID:12460
- C:\Windows\System\xlusZUm.exe
  C:\Windows\System\xlusZUm.exe
  2⤵
  PID:12620
- C:\Windows\System\tpQQVqX.exe
  C:\Windows\System\tpQQVqX.exe
  2⤵
  PID:12700
- C:\Windows\System\EjwZjkS.exe
  C:\Windows\System\EjwZjkS.exe
  2⤵
  PID:12696
- C:\Windows\System\Nutpdit.exe
  C:\Windows\System\Nutpdit.exe
  2⤵
  PID:12952
- C:\Windows\System\QvXWbUl.exe
  C:\Windows\System\QvXWbUl.exe
  2⤵
  PID:13064
- C:\Windows\System\xdlCeBE.exe
  C:\Windows\System\xdlCeBE.exe
  2⤵
  PID:13280
- C:\Windows\System\RiQVIUK.exe
  C:\Windows\System\RiQVIUK.exe
  2⤵
  PID:12728
- C:\Windows\System\NskNDxw.exe
  C:\Windows\System\NskNDxw.exe
  2⤵
  PID:12640
- C:\Windows\System\CpOzWCE.exe
  C:\Windows\System\CpOzWCE.exe
  2⤵
  PID:13256
- C:\Windows\System\xuiqCAs.exe
  C:\Windows\System\xuiqCAs.exe
  2⤵
  PID:13320
- C:\Windows\System\buyPufM.exe
  C:\Windows\System\buyPufM.exe
  2⤵
  PID:13348
- C:\Windows\System\XEemXET.exe
  C:\Windows\System\XEemXET.exe
  2⤵
  PID:13376
- C:\Windows\System\XCYdVCX.exe
  C:\Windows\System\XCYdVCX.exe
  2⤵
  PID:13396
- C:\Windows\System\PurCpjw.exe
  C:\Windows\System\PurCpjw.exe
  2⤵
  PID:13440
- C:\Windows\System\keGxsCN.exe
  C:\Windows\System\keGxsCN.exe
  2⤵
  PID:13480
- C:\Windows\System\uexOpmJ.exe
  C:\Windows\System\uexOpmJ.exe
  2⤵
  PID:13504
- C:\Windows\System\DDRZuHs.exe
  C:\Windows\System\DDRZuHs.exe
  2⤵
  PID:13528
- C:\Windows\System\lvjBhcq.exe
  C:\Windows\System\lvjBhcq.exe
  2⤵
  PID:13560
- C:\Windows\System\SgXAjvo.exe
  C:\Windows\System\SgXAjvo.exe
  2⤵
  PID:13604
- C:\Windows\System\subPzdW.exe
  C:\Windows\System\subPzdW.exe
  2⤵
  PID:13620
- C:\Windows\System\BsQtwcY.exe
  C:\Windows\System\BsQtwcY.exe
  2⤵
  PID:13644
- C:\Windows\System\petUKhs.exe
  C:\Windows\System\petUKhs.exe
  2⤵
  PID:13668
- C:\Windows\System\xefyHmB.exe
  C:\Windows\System\xefyHmB.exe
  2⤵
  PID:13692
- C:\Windows\System\SzOJqhL.exe
  C:\Windows\System\SzOJqhL.exe
  2⤵
  PID:13716
- C:\Windows\System\xiJRCle.exe
  C:\Windows\System\xiJRCle.exe
  2⤵
  PID:13744
- C:\Windows\System\WQCkQmz.exe
  C:\Windows\System\WQCkQmz.exe
  2⤵
  PID:13788
- C:\Windows\System\byfTyKP.exe
  C:\Windows\System\byfTyKP.exe
  2⤵
  PID:13808
- C:\Windows\System\IMjgJsI.exe
  C:\Windows\System\IMjgJsI.exe
  2⤵
  PID:13828
- C:\Windows\System\PBXSTou.exe
  C:\Windows\System\PBXSTou.exe
  2⤵
  PID:13856
- C:\Windows\System\qRkYWpV.exe
  C:\Windows\System\qRkYWpV.exe
  2⤵
  PID:13884
- C:\Windows\System\efkmfcx.exe
  C:\Windows\System\efkmfcx.exe
  2⤵
  PID:13916
- C:\Windows\System\DJNGkpo.exe
  C:\Windows\System\DJNGkpo.exe
  2⤵
  PID:13944
- C:\Windows\System\HuALehX.exe
  C:\Windows\System\HuALehX.exe
  2⤵
  PID:13964
- C:\Windows\System\llYVgjf.exe
  C:\Windows\System\llYVgjf.exe
  2⤵
  PID:14024
- C:\Windows\System\zgwFzgu.exe
  C:\Windows\System\zgwFzgu.exe
  2⤵
  PID:14040
- C:\Windows\System\JKOmJTA.exe
  C:\Windows\System\JKOmJTA.exe
  2⤵
  PID:14068
- C:\Windows\System\ONrADzb.exe
  C:\Windows\System\ONrADzb.exe
  2⤵
  PID:14096
- C:\Windows\System\pjuIIoX.exe
  C:\Windows\System\pjuIIoX.exe
  2⤵
  PID:14132
- C:\Windows\System\huYrlQY.exe
  C:\Windows\System\huYrlQY.exe
  2⤵
  PID:14152
- C:\Windows\System\TGSuPSE.exe
  C:\Windows\System\TGSuPSE.exe
  2⤵
  PID:14172
- C:\Windows\System\fPWHFwo.exe
  C:\Windows\System\fPWHFwo.exe
  2⤵
  PID:14200
- C:\Windows\System\HlzghrD.exe
  C:\Windows\System\HlzghrD.exe
  2⤵
  PID:14224
- C:\Windows\System\KveLdgO.exe
  C:\Windows\System\KveLdgO.exe
  2⤵
  PID:14248
- C:\Windows\System\VcdSxjF.exe
  C:\Windows\System\VcdSxjF.exe
  2⤵
  PID:14292
- C:\Windows\System\XSWVDJs.exe
  C:\Windows\System\XSWVDJs.exe
  2⤵
  PID:14312
- C:\Windows\System\IkfCnRG.exe
  C:\Windows\System\IkfCnRG.exe
  2⤵
  PID:12296
- C:\Windows\System\fpBDToM.exe
  C:\Windows\System\fpBDToM.exe
  2⤵
  PID:13332
- C:\Windows\System\GdzcJMH.exe
  C:\Windows\System\GdzcJMH.exe
  2⤵
  PID:13408
- C:\Windows\System\CiUPVCK.exe
  C:\Windows\System\CiUPVCK.exe
  2⤵
  PID:13476
- C:\Windows\System\UdYdBsT.exe
  C:\Windows\System\UdYdBsT.exe
  2⤵
  PID:13544
- C:\Windows\System\nQXgLXm.exe
  C:\Windows\System\nQXgLXm.exe
  2⤵
  PID:13580
- C:\Windows\System\WspDWMo.exe
  C:\Windows\System\WspDWMo.exe
  2⤵
  PID:13636
- C:\Windows\System\ySYbFeu.exe
  C:\Windows\System\ySYbFeu.exe
  2⤵
  PID:4912
- C:\Windows\System\cJdEaaq.exe
  C:\Windows\System\cJdEaaq.exe
  2⤵
  PID:13676
- C:\Windows\System\RcPHLgx.exe
  C:\Windows\System\RcPHLgx.exe
  2⤵
  PID:13776
- C:\Windows\System\LGCwZQX.exe
  C:\Windows\System\LGCwZQX.exe
  2⤵
  PID:13848
- C:\Windows\System\pGoDIVH.exe
  C:\Windows\System\pGoDIVH.exe
  2⤵
  PID:13900
- C:\Windows\System\dWKOAnF.exe
  C:\Windows\System\dWKOAnF.exe
  2⤵
  PID:13972
- C:\Windows\System\uxWklgo.exe
  C:\Windows\System\uxWklgo.exe
  2⤵
  PID:14032
- C:\Windows\System\UQPufmu.exe
  C:\Windows\System\UQPufmu.exe
  2⤵
  PID:14092
- C:\Windows\System\leJYxhn.exe
  C:\Windows\System\leJYxhn.exe
  2⤵
  PID:14192
- C:\Windows\System\CxUeMeO.exe
  C:\Windows\System\CxUeMeO.exe
  2⤵
  PID:14240
- C:\Windows\System\pgpYeBR.exe
  C:\Windows\System\pgpYeBR.exe
  2⤵
  PID:14328
- C:\Windows\System\TODiZiL.exe
  C:\Windows\System\TODiZiL.exe
  2⤵
  PID:13364
- C:\Windows\System\SemOVRb.exe
  C:\Windows\System\SemOVRb.exe
  2⤵
  PID:13556
- C:\Windows\System\ewGILsA.exe
  C:\Windows\System\ewGILsA.exe
  2⤵
  PID:4528
- C:\Windows\System\BQNYRsv.exe
  C:\Windows\System\BQNYRsv.exe
  2⤵
  PID:13924
- C:\Windows\System\zxGOBYL.exe
  C:\Windows\System\zxGOBYL.exe
  2⤵
  PID:14012
- C:\Windows\System\AVkjWto.exe
  C:\Windows\System\AVkjWto.exe
  2⤵
  PID:14272
- C:\Windows\System\LMFUsBH.exe
  C:\Windows\System\LMFUsBH.exe
  2⤵
  PID:13344
- C:\Windows\System\eWIkYdQ.exe
  C:\Windows\System\eWIkYdQ.exe
  2⤵
  PID:13584
- C:\Windows\System\bslMjIT.exe
  C:\Windows\System\bslMjIT.exe
  2⤵
  PID:13988
- C:\Windows\System\wfeCCxV.exe
  C:\Windows\System\wfeCCxV.exe
  2⤵
  PID:13424
- C:\Windows\System\CvRcSVm.exe
  C:\Windows\System\CvRcSVm.exe
  2⤵
  PID:13820
- C:\Windows\System\JpSmaZY.exe
  C:\Windows\System\JpSmaZY.exe
  2⤵
  PID:14348
- C:\Windows\System\RYfitKt.exe
  C:\Windows\System\RYfitKt.exe
  2⤵
  PID:14368
- C:\Windows\System\KgkkoKk.exe
  C:\Windows\System\KgkkoKk.exe
  2⤵
  PID:14408
- C:\Windows\System\tuwvIQs.exe
  C:\Windows\System\tuwvIQs.exe
  2⤵
  PID:14432
- C:\Windows\System\OGMrLMx.exe
  C:\Windows\System\OGMrLMx.exe
  2⤵
  PID:14452
- C:\Windows\System\bhruFBX.exe
  C:\Windows\System\bhruFBX.exe
  2⤵
  PID:14472
- C:\Windows\System\jaxigrU.exe
  C:\Windows\System\jaxigrU.exe
  2⤵
  PID:14512
- C:\Windows\System\KclTeBT.exe
  C:\Windows\System\KclTeBT.exe
  2⤵
  PID:14528
- C:\Windows\System\mtwPHLM.exe
  C:\Windows\System\mtwPHLM.exe
  2⤵
  PID:14552
- C:\Windows\System\gCLYUMp.exe
  C:\Windows\System\gCLYUMp.exe
  2⤵
  PID:14600
- C:\Windows\System\ZoMOuaC.exe
  C:\Windows\System\ZoMOuaC.exe
  2⤵
  PID:14620
- C:\Windows\System\EViXkTv.exe
  C:\Windows\System\EViXkTv.exe
  2⤵
  PID:14648
- C:\Windows\System\BgnVhSe.exe
  C:\Windows\System\BgnVhSe.exe
  2⤵
  PID:14676
- C:\Windows\System\qlZNeGu.exe
  C:\Windows\System\qlZNeGu.exe
  2⤵
  PID:14704
- C:\Windows\System\tvERubE.exe
  C:\Windows\System\tvERubE.exe
  2⤵
  PID:14744
- C:\Windows\System\CwUbmRr.exe
  C:\Windows\System\CwUbmRr.exe
  2⤵
  PID:14764
- C:\Windows\System\KekOGhH.exe
  C:\Windows\System\KekOGhH.exe
  2⤵
  PID:14808
- C:\Windows\System\lpYZEwM.exe
  C:\Windows\System\lpYZEwM.exe
  2⤵
  PID:14844
- C:\Windows\System\tTOBvdd.exe
  C:\Windows\System\tTOBvdd.exe
  2⤵
  PID:14872
- C:\Windows\System\cIKbMaI.exe
  C:\Windows\System\cIKbMaI.exe
  2⤵
  PID:14900
- C:\Windows\System\ZJzZptV.exe
  C:\Windows\System\ZJzZptV.exe
  2⤵
  PID:14928
- C:\Windows\System\nXWgtzQ.exe
  C:\Windows\System\nXWgtzQ.exe
  2⤵
  PID:14944
- C:\Windows\System\gGgcXOO.exe
  C:\Windows\System\gGgcXOO.exe
  2⤵
  PID:14968
- C:\Windows\System\tLlWKdu.exe
  C:\Windows\System\tLlWKdu.exe
  2⤵
  PID:15012
- C:\Windows\System\mvslZfH.exe
  C:\Windows\System\mvslZfH.exe
  2⤵
  PID:15040
- C:\Windows\System\moXJxlK.exe
  C:\Windows\System\moXJxlK.exe
  2⤵
  PID:15056
- C:\Windows\System\rUiDJOB.exe
  C:\Windows\System\rUiDJOB.exe
  2⤵
  PID:15084
- C:\Windows\System\ruCUPJb.exe
  C:\Windows\System\ruCUPJb.exe
  2⤵
  PID:15112
- C:\Windows\System\uvSFbYO.exe
  C:\Windows\System\uvSFbYO.exe
  2⤵
  PID:15132
- C:\Windows\System\PvRdOYt.exe
  C:\Windows\System\PvRdOYt.exe
  2⤵
  PID:15160
- C:\Windows\System\wftuAzA.exe
  C:\Windows\System\wftuAzA.exe
  2⤵
  PID:15196
- C:\Windows\System\lYTGvxE.exe
  C:\Windows\System\lYTGvxE.exe
  2⤵
  PID:15224
- C:\Windows\System\PWGQWaA.exe
  C:\Windows\System\PWGQWaA.exe
  2⤵
  PID:15244
- C:\Windows\System\wIoGJzt.exe
  C:\Windows\System\wIoGJzt.exe
  2⤵
  PID:15268
- C:\Windows\System\pXxxLFm.exe
  C:\Windows\System\pXxxLFm.exe
  2⤵
  PID:15304
- C:\Windows\System\sJrbZdB.exe
  C:\Windows\System\sJrbZdB.exe
  2⤵
  PID:15328
- C:\Windows\System\VUmGKSo.exe
  C:\Windows\System\VUmGKSo.exe
  2⤵
  PID:15348
- C:\Windows\System\vQpCxsQ.exe
  C:\Windows\System\vQpCxsQ.exe
  2⤵
  PID:14344
- C:\Windows\System\ahAScTX.exe
  C:\Windows\System\ahAScTX.exe
  2⤵
  PID:14424
- C:\Windows\System\MtqFCwR.exe
  C:\Windows\System\MtqFCwR.exe
  2⤵
  PID:14444
- C:\Windows\System\afLHXGS.exe
  C:\Windows\System\afLHXGS.exe
  2⤵
  PID:14460
- C:\Windows\System\uOVJDKp.exe
  C:\Windows\System\uOVJDKp.exe
  2⤵
  PID:14548
- C:\Windows\System\ziqIYje.exe
  C:\Windows\System\ziqIYje.exe
  2⤵
  PID:14612
- C:\Windows\System\oNfMcwu.exe
  C:\Windows\System\oNfMcwu.exe
  2⤵
  PID:14660
- C:\Windows\System\eGEZjmN.exe
  C:\Windows\System\eGEZjmN.exe
  2⤵
  PID:14720
- C:\Windows\System\lOEMUYS.exe
  C:\Windows\System\lOEMUYS.exe
  2⤵
  PID:14888
- C:\Windows\System\LlVrnmx.exe
  C:\Windows\System\LlVrnmx.exe
  2⤵
  PID:14956
- C:\Windows\System\PytMVrv.exe
  C:\Windows\System\PytMVrv.exe
  2⤵
  PID:15008
- C:\Windows\System\QRcJmUp.exe
  C:\Windows\System\QRcJmUp.exe
  2⤵
  PID:15048
- C:\Windows\System\PlCqUYY.exe
  C:\Windows\System\PlCqUYY.exe
  2⤵
  PID:15104
- C:\Windows\System\uTgEaxK.exe
  C:\Windows\System\uTgEaxK.exe
  2⤵
  PID:15192
- C:\Windows\System\WyYmNKk.exe
  C:\Windows\System\WyYmNKk.exe
  2⤵
  PID:15220
- C:\Windows\System\fluZUJV.exe
  C:\Windows\System\fluZUJV.exe
  2⤵
  PID:15264
- C:\Windows\System\LglKTpR.exe
  C:\Windows\System\LglKTpR.exe
  2⤵
  PID:13520
- C:\Windows\System\nxHCcsA.exe
  C:\Windows\System\nxHCcsA.exe
  2⤵
  PID:14588
- C:\Windows\System\NZHTKhE.exe
  C:\Windows\System\NZHTKhE.exe
  2⤵
  PID:14756
- C:\Windows\System\VFjYCZY.exe
  C:\Windows\System\VFjYCZY.exe
  2⤵
  PID:14796
- C:\Windows\System\jSDqhFi.exe
  C:\Windows\System\jSDqhFi.exe
  2⤵
  PID:14976
- C:\Windows\System\yuoCeBQ.exe
  C:\Windows\System\yuoCeBQ.exe
  2⤵
  PID:15152
- C:\Windows\System\WeiGHvY.exe
  C:\Windows\System\WeiGHvY.exe
  2⤵
  PID:15292
- C:\Windows\System\JIjFArI.exe
  C:\Windows\System\JIjFArI.exe
  2⤵
  PID:14380
- C:\Windows\System\JDbvhts.exe
  C:\Windows\System\JDbvhts.exe
  2⤵
  PID:14996
- C:\Windows\System\zinNUzB.exe
  C:\Windows\System\zinNUzB.exe
  2⤵
  PID:15216
- C:\Windows\System\lrCyXZx.exe
  C:\Windows\System\lrCyXZx.exe
  2⤵
  PID:14856
- C:\Windows\System\KHPFxcy.exe
  C:\Windows\System\KHPFxcy.exe
  2⤵
  PID:15364
- C:\Windows\System\tlwCWYb.exe
  C:\Windows\System\tlwCWYb.exe
  2⤵
  PID:15392
- C:\Windows\System\oHDqUdX.exe
  C:\Windows\System\oHDqUdX.exe
  2⤵
  PID:15424
- C:\Windows\System\wQLHlXr.exe
  C:\Windows\System\wQLHlXr.exe
  2⤵
  PID:15440
- C:\Windows\System\TrYjvtG.exe
  C:\Windows\System\TrYjvtG.exe
  2⤵
  PID:15492
- C:\Windows\System\QkWfrRt.exe
  C:\Windows\System\QkWfrRt.exe
  2⤵
  PID:15508
- C:\Windows\System\PRloIZT.exe
  C:\Windows\System\PRloIZT.exe
  2⤵
  PID:15536
- C:\Windows\System\GUXHwBN.exe
  C:\Windows\System\GUXHwBN.exe
  2⤵
  PID:15564
- C:\Windows\System\vKPiGRX.exe
  C:\Windows\System\vKPiGRX.exe
  2⤵
  PID:15596
- C:\Windows\System\nsDzlyO.exe
  C:\Windows\System\nsDzlyO.exe
  2⤵
  PID:15620
- C:\Windows\System\nBwZfYQ.exe
  C:\Windows\System\nBwZfYQ.exe
  2⤵
  PID:15648
- C:\Windows\System\DEoRfaE.exe
  C:\Windows\System\DEoRfaE.exe
  2⤵
  PID:15668
- C:\Windows\System\YPmfYpQ.exe
  C:\Windows\System\YPmfYpQ.exe
  2⤵
  PID:15704
- C:\Windows\System\PeWVMZY.exe
  C:\Windows\System\PeWVMZY.exe
  2⤵
  PID:15720
- C:\Windows\System\uMnWsHF.exe
  C:\Windows\System\uMnWsHF.exe
  2⤵
  PID:15744
- C:\Windows\System\tQpxpbd.exe
  C:\Windows\System\tQpxpbd.exe
  2⤵
  PID:15772
- C:\Windows\System\EheNYOF.exe
  C:\Windows\System\EheNYOF.exe
  2⤵
  PID:15816
- C:\Windows\System\tHJtgHJ.exe
  C:\Windows\System\tHJtgHJ.exe
  2⤵
  PID:15848
- C:\Windows\System\UefiElF.exe
  C:\Windows\System\UefiElF.exe
  2⤵
  PID:15868
- C:\Windows\System\nnmHLmW.exe
  C:\Windows\System\nnmHLmW.exe
  2⤵
  PID:15916
- C:\Windows\System\CQcDzxp.exe
  C:\Windows\System\CQcDzxp.exe
  2⤵
  PID:15944
- C:\Windows\System\HMUjojA.exe
  C:\Windows\System\HMUjojA.exe
  2⤵
  PID:15960
- C:\Windows\System\BlCCDWN.exe
  C:\Windows\System\BlCCDWN.exe
  2⤵
  PID:15976
- C:\Windows\System\eHuPNqi.exe
  C:\Windows\System\eHuPNqi.exe
  2⤵
  PID:15992
- C:\Windows\System\QONxEvD.exe
  C:\Windows\System\QONxEvD.exe
  2⤵
  PID:16048
- C:\Windows\System\xsQClWW.exe
  C:\Windows\System\xsQClWW.exe
  2⤵
  PID:16072
- C:\Windows\System\StLmiHT.exe
  C:\Windows\System\StLmiHT.exe
  2⤵
  PID:16112
- C:\Windows\System\eIglAYz.exe
  C:\Windows\System\eIglAYz.exe
  2⤵
  PID:16128
- C:\Windows\System\WRulyLE.exe
  C:\Windows\System\WRulyLE.exe
  2⤵
  PID:16144
- C:\Windows\System\zcqtLwD.exe
  C:\Windows\System\zcqtLwD.exe
  2⤵
  PID:16196
- C:\Windows\System\RgcGpvQ.exe
  C:\Windows\System\RgcGpvQ.exe
  2⤵
  PID:16212
- C:\Windows\System\qUqTizh.exe
  C:\Windows\System\qUqTizh.exe
  2⤵
  PID:16236
- C:\Windows\System\ZosKOaA.exe
  C:\Windows\System\ZosKOaA.exe
  2⤵
  PID:16264
- C:\Windows\System\BOixoWn.exe
  C:\Windows\System\BOixoWn.exe
  2⤵
  PID:16296
- C:\Windows\System\dJQoDEJ.exe
  C:\Windows\System\dJQoDEJ.exe
  2⤵
  PID:16316
- C:\Windows\System\sZBQhCs.exe
  C:\Windows\System\sZBQhCs.exe
  2⤵
  PID:16364
- C:\Windows\System\YcOQZjq.exe
  C:\Windows\System\YcOQZjq.exe
  2⤵
  PID:14580
- C:\Windows\System\HjFlkdH.exe
  C:\Windows\System\HjFlkdH.exe
  2⤵
  PID:15376
- C:\Windows\System\SzRyNCv.exe
  C:\Windows\System\SzRyNCv.exe
  2⤵
  PID:15452
- C:\Windows\System\rPrywEY.exe
  C:\Windows\System\rPrywEY.exe
  2⤵
  PID:15528
- C:\Windows\System\dqkWRmh.exe
  C:\Windows\System\dqkWRmh.exe
  2⤵
  PID:15556
- C:\Windows\System\EKkGYou.exe
  C:\Windows\System\EKkGYou.exe
  2⤵
  PID:15640
- C:\Windows\System\ZNYnsWP.exe
  C:\Windows\System\ZNYnsWP.exe
  2⤵
  PID:15688
- C:\Windows\System\jkOVtwt.exe
  C:\Windows\System\jkOVtwt.exe
  2⤵
  PID:15756
- C:\Windows\System\uSMvLfS.exe
  C:\Windows\System\uSMvLfS.exe
  2⤵
  PID:15768
- C:\Windows\System\btPJFSU.exe
  C:\Windows\System\btPJFSU.exe
  2⤵
  PID:15904
- C:\Windows\System\WLegVFF.exe
  C:\Windows\System\WLegVFF.exe
  2⤵
  PID:15952
- C:\Windows\System\DrQZxzP.exe
  C:\Windows\System\DrQZxzP.exe
  2⤵
  PID:16016
- C:\Windows\System\CIzDpWp.exe
  C:\Windows\System\CIzDpWp.exe
  2⤵
  PID:16068
- C:\Windows\System\wUAeGpY.exe
  C:\Windows\System\wUAeGpY.exe
  2⤵
  PID:16208
- C:\Windows\System\YNpLqxH.exe
  C:\Windows\System\YNpLqxH.exe
  2⤵
  PID:16256
- C:\Windows\System\mXGGvkV.exe
  C:\Windows\System\mXGGvkV.exe
  2⤵
  PID:16288
- C:\Windows\System\LbPMiJh.exe
  C:\Windows\System\LbPMiJh.exe
  2⤵
  PID:16376
- C:\Windows\System\nxUzbOG.exe
  C:\Windows\System\nxUzbOG.exe
  2⤵
  PID:15404
- C:\Windows\System\kxVmlMo.exe
  C:\Windows\System\kxVmlMo.exe
  2⤵
  PID:15560
- C:\Windows\System\avHNtuA.exe
  C:\Windows\System\avHNtuA.exe
  2⤵
  PID:15736
- C:\Windows\System\KyOFoQM.exe
  C:\Windows\System\KyOFoQM.exe
  2⤵
  PID:15936
- C:\Windows\System\ZNSwVWz.exe
  C:\Windows\System\ZNSwVWz.exe
  2⤵
  PID:15988
- C:\Windows\System\SHPvpZC.exe
  C:\Windows\System\SHPvpZC.exe
  2⤵
  PID:16172
- C:\Windows\System\sXghJXF.exe
  C:\Windows\System\sXghJXF.exe
  2⤵
  PID:15400
- C:\Windows\System\KnZBBMS.exe
  C:\Windows\System\KnZBBMS.exe
  2⤵
  PID:15552
- C:\Windows\System\zOGbkrR.exe
  C:\Windows\System\zOGbkrR.exe
  2⤵
  PID:16096
- C:\Windows\System\yYVtTqA.exe
  C:\Windows\System\yYVtTqA.exe
  2⤵
  PID:13940
- C:\Windows\System\zgHRbZB.exe
  C:\Windows\System\zgHRbZB.exe
  2⤵
  PID:16140
- C:\Windows\System\HJddBhI.exe
  C:\Windows\System\HJddBhI.exe
  2⤵
  PID:16392
- C:\Windows\System\ILQgLVD.exe
  C:\Windows\System\ILQgLVD.exe
  2⤵
  PID:16420
- C:\Windows\System\DoNGUkz.exe
  C:\Windows\System\DoNGUkz.exe
  2⤵
  PID:16440
- C:\Windows\System\irPZIHJ.exe
  C:\Windows\System\irPZIHJ.exe
  2⤵
  PID:16476
- C:\Windows\System\pCkWKqo.exe
  C:\Windows\System\pCkWKqo.exe
  2⤵
  PID:16516
- C:\Windows\System\RPaMicy.exe
  C:\Windows\System\RPaMicy.exe
  2⤵
  PID:16544
- C:\Windows\System\rbyuqVE.exe
  C:\Windows\System\rbyuqVE.exe
  2⤵
  PID:16560
- C:\Windows\System\bMXquJB.exe
  C:\Windows\System\bMXquJB.exe
  2⤵
  PID:16584
- C:\Windows\System\gSWazZu.exe
  C:\Windows\System\gSWazZu.exe
  2⤵
  PID:16616
- C:\Windows\System\IXdxuIs.exe
  C:\Windows\System\IXdxuIs.exe
  2⤵
  PID:16652
- C:\Windows\System\GpmLBKQ.exe
  C:\Windows\System\GpmLBKQ.exe
  2⤵
  PID:16672
- C:\Windows\System\Xzbhtvl.exe
  C:\Windows\System\Xzbhtvl.exe
  2⤵
  PID:16696
- C:\Windows\System\wcoAisz.exe
  C:\Windows\System\wcoAisz.exe
  2⤵
  PID:16728
- C:\Windows\System\nazmMui.exe
  C:\Windows\System\nazmMui.exe
  2⤵
  PID:16784
- C:\Windows\System\TQbjRox.exe
  C:\Windows\System\TQbjRox.exe
  2⤵
  PID:16800
- C:\Windows\System\iLelzxH.exe
  C:\Windows\System\iLelzxH.exe
  2⤵
  PID:16820
- C:\Windows\System\HEGxYAv.exe
  C:\Windows\System\HEGxYAv.exe
  2⤵
  PID:16844
- C:\Windows\System\THgkTCr.exe
  C:\Windows\System\THgkTCr.exe
  2⤵
  PID:16864
- C:\Windows\System\mrgmpZi.exe
  C:\Windows\System\mrgmpZi.exe
  2⤵
  PID:16892
- C:\Windows\System\xVKopvn.exe
  C:\Windows\System\xVKopvn.exe
  2⤵
  PID:16916
- C:\Windows\System\dWhkRdS.exe
  C:\Windows\System\dWhkRdS.exe
  2⤵
  PID:16932
- C:\Windows\System\vmfXlBm.exe
  C:\Windows\System\vmfXlBm.exe
  2⤵
  PID:17000

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:17388

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\AEThNgT.exe

Filesize
1.3MB

MD5
2cb545b6ab582c9b9c4cabbe5ecc7bdf

SHA1
c7705393c44c9983a1fb99947b07e3b0f6b4f1ba

SHA256
bbf33592771454c0ba977f3fbd345befd5f8affbe2c12c592fd6e6514d0d9c54

SHA512
35a5b4e7116290a041f49e403f343413088c27c36100407e1dba5db88421e006d808f7e0dff6eda96bbb5b80277a75719d890973d31fcbe5da8af6fc6ee36e84

Download Submit
C:\Windows\System\AYhXIkk.exe

Filesize
1.3MB

MD5
42020cba1bad5fca7c2050025def6b28

SHA1
3493e194b62379b712ab369fa74bb407f0722fd2

SHA256
038509601dc3baedfce87c4378d1b3bb90a88ff7665bbd3b246811aee42caf61

SHA512
8e39bde1336b1a35debedefdd83885f04e8c13c02123c824d00f330eed14afb745add49f0de37f5e675a36e9fef983855569ed641152e6e0fa2764fa698f4316

Download Submit
C:\Windows\System\BNvVHRD.exe

Filesize
1.3MB

MD5
98892d4f278f6330e2c67a6d3140d0d9

SHA1
1808d989534d3655ef310427dc7b74d8ffa46d3c

SHA256
d4947f1acc754cc1aa5c426df88724f0ab57e92270bf0cbf67339d3d6da601aa

SHA512
6f1d638898bd38c28a43910ea481c8dbf5ffd855f18565ec3df7f338cff500f3eaba1c84952529a7d9a8632bb6b0b04ea6d1de63e6b50c625e78c37f0a80412e

Download Submit
C:\Windows\System\DJkxQrZ.exe

Filesize
1.3MB

MD5
d00c16f3e1ef7b959a70d4204f8b4b67

SHA1
8cf6c364d04f29cc41d9a482da4f7ebf89b9f7a2

SHA256
bf3a3df210f9a14c4bf1b3e896cc73d2a781909dffefabbf2869cad382999a91

SHA512
6b4aa22e46d385b8bae5344917ad886da1799cd568770cfbb69f9fc26939f268291a4fc1e6455db0f68756020a7806192fab67046d8a5ce985e70b379e99b443

Download Submit
C:\Windows\System\DwEeXMj.exe

Filesize
1.3MB

MD5
f3c0c1a16e1f96ee3cc2fb04e768beb1

SHA1
739422bfeb3fbad7e5f669a1392c544ac705eb58

SHA256
0fdd717a730bb6d9dfd0567fd0dbc79d46e135aca033d490c4017c40fbcbd62b

SHA512
9c3db93bc5ef463dcecaf5c8cb7e9677f5de4310633fe11ce2cfcf489e2a25eb116c1a373deb1ac9303fd2eaf71e8cbb301a324d8835eecd02abf6ebd60c0b26

Download Submit
C:\Windows\System\FZOJLTA.exe

Filesize
1.3MB

MD5
ce27b7bcee95cbbe88ac12ccf51f8810

SHA1
93300c5b0e59fe36e9121b66b85d553f7215afee

SHA256
cd8ae310a52bf2f82b1599f21f61e4293d742d8ed8cd0be38c30813b2b54f319

SHA512
48be10e3bbcb22af089303bc7190ccdc9c5fa5e720e3479defa126b713305b99278f49324fffe4c2c90e7d8d4ce88705ec3e76572c01c8d25828a0bb85ac2014

Download Submit
C:\Windows\System\FsMHztg.exe

Filesize
1.3MB

MD5
a2b421978d98ff6085f73d025f758721

SHA1
55688b8c01203dff8243eae4637568d7fb8bc4a5

SHA256
a66e0d3af9914f75fc8e5f9f009fce2fecc53c18d5fc7a2e75961e3c34cff12a

SHA512
8c05a807c97edd6957e8391d6ada41f5f34814784878c68fa8ec84c54e5b1e494c99e417ad040c1000837121b9ef1ff315417dd55606fc6aa1dc87abe5a9a1c3

Download Submit
C:\Windows\System\GsISSwm.exe

Filesize
1.3MB

MD5
1df75e51f3199e9f4bf327875a78488d

SHA1
c3937b9bdb91018021a251ca49b6547abd74034a

SHA256
f9b16ff3732c28513b108919c7ab075d189fceaa7ef488bfe48ff76957f6cf62

SHA512
fbc8fe350fd01cfdda365428e0925673c387c19a1bd8007f8300557cee18b820a0702b7a52fb5794b9adc131499d3984984d2cec64faa8dfe5f0434f1139a383

Download Submit
C:\Windows\System\MVWISse.exe

Filesize
1.3MB

MD5
4b6d12c1e39b338786f025ec59a2534f

SHA1
4bb60863fc64b3dae8e4eb0eebb1d8b698ac706e

SHA256
f07c1fa6064e3b1fa4215aa8262a3b3042a04fc9450f17266b2c6c95fb947490

SHA512
8d81a4e0f7d63b092d35ef183cd53ae28946c6f8be54e7103885d0c61f66f1ba6aa99017c09b952a8cb68d2c2b663c54e06966a58715b50894179c349d235cc6

Download Submit
C:\Windows\System\NqUgcPZ.exe

Filesize
1.3MB

MD5
25fcbd1a040f6aa22437bb23b1824032

SHA1
ffade898d722475603928bd6ddca6f688ee50306

SHA256
d5d7456af8b8a88e301028e2907be6d980d127fb24e65aedebb06ae5d6ab658f

SHA512
4bc79c5b5e35d388362f42a0a166eaf7576d01bca676e679e90ddb7501ab609a6ce7dc699f76c1388b5bc9d2811037cd3cdceddc7ed0baf4c33dc62d1e5443e4

Download Submit
C:\Windows\System\SYJCccV.exe

Filesize
1.3MB

MD5
c4f0a7f9568e6c6831b63f128e15d0c8

SHA1
239b3c0cf51587c06be042066181f23c85c1530e

SHA256
2dacf389e1f2e6dd40d79cb11fdf9c109fb5f538d1feab0ad35766c1f6a191bb

SHA512
80f74d9de189d502eec226bbb82fc4db80a816cfaf6b278a3ef4015983bed8e6df4aac209a1cade862f32d7f11aab6d6e546e5a77da463ced54335bba49305cc

Download Submit
C:\Windows\System\TmqIfKS.exe

Filesize
1.3MB

MD5
55e203a675b1596d03bac7ed16e314a8

SHA1
64b9a0eec776be6a67a3436fa103dcec799305bf

SHA256
3f61af47fd8532e99216e2690242815fdac0130ad9587197c63ae9ffc93da3c1

SHA512
6d95f516ac0016021f11529a51fa9a234c9a3da216524afad665c5cdbeecf5c9b401c6c4cec3242f066a48d5b46690c55657f73195b2e1924c9e5a354f522fe3

Download Submit
C:\Windows\System\UvvMBfY.exe

Filesize
1.3MB

MD5
eea21133d22a6f6a45b33a7c7539c3f5

SHA1
dd13c65cec2e6a5ef848edaa0caba156864dbd13

SHA256
16279269435c1e73b1718ee17e4e414070b87579e8c13510e134d3d09cc0aab5

SHA512
5925bf5ba5209d4b9b69829cfde8598d0f328bba3efce7d50b1a39b198159e91542d2d3b0be0024a5f859dcd3841d6b81a45201e154fa0f8c42ed8c958d66461

Download Submit
C:\Windows\System\VMqWXeV.exe

Filesize
1.3MB

MD5
f0ced239f55003a6eaa1e0915910a4e9

SHA1
b26dee0d570fa0b15734f4e9ace6f61b448b83d1

SHA256
19613b24c4765c17fe07f92dce0b17c966799cefe2a009498cb86d33b644cc1e

SHA512
0a2ee0421c27f1a1ccaab5a7619475d1d0ecaba20057915e70af6877cd087b55e3d8502d364220ca09c5a345b553e5eb7f1561160d0a61c9a5fac3c8ccd50db5

Download Submit
C:\Windows\System\VYGTxaj.exe

Filesize
1.3MB

MD5
9ce55c3b4e48a30dae7176dc7d4d3239

SHA1
d49d96959e92cd0defff97e85a5e51bad3ba22ee

SHA256
f5a7facfbde217ff55a7e15dbd2820025e1575b06d4aea3068a6670a58b98ae9

SHA512
5191ab06ebde3df954a40daf3e8a10ba4f37c8bc193322b1d151f680d559569b1ad738c43afdb8151e882b188c1205ea7fa05b4d880e50c59348f2a594f1f17b

Download Submit
C:\Windows\System\VvEwtgw.exe

Filesize
1.3MB

MD5
666843fc804f99baf7cf4393524c43ee

SHA1
7f1d83022844b603ec0c1673731f73cfe35a4310

SHA256
7f037cf6af02e60b3b578107f9bd3e9436327affaa3c6bd2399e87466eb3ba8a

SHA512
2b738045ab59f2f8551ac8f6bde107a25d782f59954a925baa763b796ecb4eb3833195684d9195a6e3836b14ec6dde2daee4751d1a8371ce64b0e4214199372a

Download Submit
C:\Windows\System\WxogzpS.exe

Filesize
1.3MB

MD5
0223f6f7a189046924603978cb5a1a9a

SHA1
9f3a6e635d5786e2794d839d110f450e7df0a45b

SHA256
919ea346dc04a43d5206af1ed1fbd92a0a866a374dfe5e0dd3296058ef0d94f2

SHA512
4c18e67a6eaa0c1239964334d1672c896c86837149a7fe537124cce66782807eec750c16735a0aefc7d6aa0312df3f8406867787236928b4e71e9aa5879747a2

Download Submit
C:\Windows\System\ZgztmAn.exe

Filesize
1.3MB

MD5
6e2d52036570f7c7b41a9f4171a7b6c0

SHA1
a7ea3a5e5c14068410826709b60af2b8b0f9827a

SHA256
e83c564d0726ea88ccb1130eb3cbf1d39ad42b3cd7c811122aebc08bc73f234f

SHA512
da946f1eb06a68722b07e5e70a2de2448c75ee115d218e7fa4b4702f1814bde058c1083a748f55ad3173a1e1bd1b6c5cfbd23d644e68c98a752e4afce8e49a0e

Download Submit
C:\Windows\System\csEGuCp.exe

Filesize
1.3MB

MD5
7fe3d4d52efc5e58a9706035cde1a09b

SHA1
9eab60edbb844234335788c21c8828f4d3b2ad1c

SHA256
60ade4aecfb68b3df438f0982aef4c2fa9d7f4eb9d0d4664c4777411a35f866a

SHA512
756faec1c84eed42317fd1cb9e8f7ad1851f375842d25ab6b844e7e7204111260ae22ce9964ca500a024a918fd3002096798596611bec1a14164ae06310037ce

Download Submit
C:\Windows\System\fJJQsFK.exe

Filesize
1.3MB

MD5
3d074820082d5fa347b4e34a550f0fc5

SHA1
5aa367c2858cc29cc6ec8717f9143a2809641f62

SHA256
694c6945c637e95760f538d165f53b159b46a822168deaa82cf2436b9e8df3da

SHA512
0f3e50ba7cceaf1a43bb7204e3446107a31d529fa351d929a16ccb74456822bf6acaecc8d1d09f2ebb4f2245700d701880c70d1432fabb67730e597bd4f68731

Download Submit
C:\Windows\System\fhhCFvX.exe

Filesize
1.3MB

MD5
17dbef3d98fcf96a94dc77e5f3d9c0f9

SHA1
4e68784f5a34e085fdc15325922a1efe4ea7c711

SHA256
f322709c3e08e186610256090389112be93f3ed92809798f0d16c2e688aee8e4

SHA512
cde27fb3804df9e8631efd4f2adb6af65747ae4ce3d48cd3af871757194aaaeeaa84656b11c79f035a1b5b5ff679ec30e4d9861c42d9910eb3c8382d2e5fb89f

Download Submit
C:\Windows\System\jLFrNTE.exe

Filesize
1.3MB

MD5
33ff57ee4408b78c15bb7c2c0257fcfc

SHA1
d3806470715d1534c2857a29a24d9fd97ed36e44

SHA256
98a9c2d7dd1659a214a3f9f5b3e828182d91754b859e4e85a56ab9d0b3d12afb

SHA512
6b63db61119a626ff5b413e1e1481083665fc4b2891c43f2d49ee6c4e6a2b7301e99451664ad66d29a57b1fa7248ae10c43ea994fc984b3a4757a3edeb6d8ec1

Download Submit
C:\Windows\System\jXAbpHI.exe

Filesize
1.3MB

MD5
b1a5bca86ce9471f658725955e96a169

SHA1
7cb10ee5041eac0162325ef32f88aef7545a78cb

SHA256
249896971e3d7720d4ccb7587062251a7a1bb00d2680b1160675a15b091b9d47

SHA512
a3f3d114959f429636156f731779c7a6e33ff993d53535a8915a6b16b359f472f92baf72c819d3cba66173a547cc0524cb3d28c4e8bd68492b2ce0d81ec02dff

Download Submit
C:\Windows\System\kSNDUPf.exe

Filesize
1.3MB

MD5
3755ca6ce9c1da18a13346394e9f971e

SHA1
1bc9eb1488bff8103c39ed328aaf9f0e5579e40c

SHA256
a0864e99572d1be614ab08602939165147ce3e94e3b06dfdddd39e91264e6515

SHA512
3cde8a3165ffdafdc8f06515041ff2b9f8d3820f73bd6e1cacc7b74ed5e3c398cab10ee1a176ba4489864c27deeeeb31e01cc576b21ec95d8039a3fcf9ba21cb

Download Submit
C:\Windows\System\kXIAkSr.exe

Filesize
1.3MB

MD5
9d56c49ec6c9b8470434210a4315ebe5

SHA1
df5455868e25b61da72124dab1f2c4b7d93ba694

SHA256
62c7a5b0ca979fac78b5b69f41e1ecc80bb3e9cded115c106f1a25a092981e01

SHA512
f3a256ac8bb9a9914e07fd97e8036953f4f11410a69b1f79ab8e8983ce4615735a043c57b1199f1a53d271459e494a222ba17f87f30e6788e4bacc990fc70c6f

Download Submit
C:\Windows\System\kxflpCQ.exe

Filesize
1.3MB

MD5
830e5ac11af6a9458ca1fff73d9348af

SHA1
80e6fc4472e1b41f7d882165c2a12c2ec506d580

SHA256
5f660c7075fe8ae8ba6f63af62eb2506b6afa1650d41823074dd274e5b565f42

SHA512
6d2ee7b9da1f0c137ca018f2de4f22c71c001fd33b5512964c990eb7470f6249d0e56234055bd2c231b05b4b4a6619d7304cf598f57cd55ce310562940d307c7

Download Submit
C:\Windows\System\lvelxXM.exe

Filesize
1.3MB

MD5
2519ab0a5eb0771c4236114ac1d5114d

SHA1
57515f904bc92f837e4e6f2fc9366036b3b187b4

SHA256
7d40e08265f4a572ff0307f42253563318f3ce21d19df6aaa36a98d708052cb7

SHA512
187292a033e9ac3b6b9a65e7b85b0fdcfeb748027afafc6873b729bcfbcdeb7706037b1b36df2b47b4769832eb5cd7aa402e548b484211e9426cc0ff2671591e

Download Submit
C:\Windows\System\ppGCGXX.exe

Filesize
1.3MB

MD5
d68d23ac06b01f4f736c81efd95cc350

SHA1
a298f6cbd528e0773eabb62606ccabcce1d7300a

SHA256
bf88f6470aa2718f84d9576a1852fb2d4d0bae7822b19dcd2c0a86783d240bf2

SHA512
03948547c8fa1b73577e52a43cad98d661dbb2863efb5cf8de12a4f1b3fe6253970156305d46cf1289b4c705d96fd19bf9758bc1bc777d7752d2066ebfd7200d

Download Submit
C:\Windows\System\rHzaLqS.exe

Filesize
1.3MB

MD5
2d1bc3b17b638c7bd41eef99ab4fc75f

SHA1
38a945e2bf95a074ceb05d2c3858c606af64bb20

SHA256
10c6bfd01be794b04241e36e34c0b9b26ac99b4ab428f45886128cc2d88310c8

SHA512
ffe22f5699a5db150525001c34ce7b96ac497fa72fe11e82eaf9af6c182734137348077c4b1dfaa1af8fe3a6bf4591c88b183bfd8d302bab28e794fe9bf350d3

Download Submit
C:\Windows\System\sIvPMEP.exe

Filesize
1.3MB

MD5
871dde9d478b1b8fa4257333f6ba9408

SHA1
713b0ac1bed41c991df778f4f255c20026465f3b

SHA256
0fe0eeaa2887f0b9f295beae05c8e85e6b3ecc5f5141ea6c18cd55c23ad4a0d0

SHA512
c1d4055b98c8343afeb89d5ed726532002e592f6457b75aaea8fbefdeacdb2ab55db6c6a7d866e2df7d5590449ec6564d0e2dd9172328788888927c412de9fdf

Download Submit
C:\Windows\System\svXruql.exe

Filesize
1.3MB

MD5
8e640e124c63dfb3efbb42d1bc30de71

SHA1
48b2bf21ec5a8eb9a902d6c58b146fec47b8fdd6

SHA256
8af04040122e86321f0b501b1071a24f231e88ada37c335edd4d5fbb6e775213

SHA512
457b63ba184d6ef08e28bbf9964eb26be764962c6e788995f19d60e919e67df6b101afd55e9f0ca50396124e98b659e371db832aa8ce73070b7405c9b7bd6306

Download Submit
C:\Windows\System\vCSThFv.exe

Filesize
1.3MB

MD5
c7daca990afff2d2e5cfa4deb030a15f

SHA1
232398cc38d0613dc3d21062f80fb03485e98e79

SHA256
b2b82753c25b660d6df4f5d33c10eec44c7f738de0a68db1d4790ef99e23df3f

SHA512
743e329c77cb1701ef659650e548a402e87457325cd51ba778bb110439a7736fcf530e369de902c5d274239cf1fed81d4774335f24c47da47feace7233ede64a

Download Submit
C:\Windows\System\xuiCbAk.exe

Filesize
1.3MB

MD5
91adb21d81db5db0eb05b23aa5f7fbd9

SHA1
5bb0fd8c12081ee3bc3a050ccd9feeec967c6e0b

SHA256
2e09722ac30fe1ca717ef7a05d823854be238bb5c5def191c12fcd4ac6613720

SHA512
49e9383a81924b71f010a35a378630a39577637c00f29828c5b8a3d58a04552b3b0220ad9ac0afff851f56ee9b0de7afc8086563ab5988196ba7bffe952c3054

Download Submit
memory/384-0-0x000002A49E570000-0x000002A49E580000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads