xmrig | 13cef6a7357b996e980cff274286eee65ed1b97cbdf07eeea2d9ac8bd22c2d26

Analysis

max time kernel
129s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
22-12-2024 19:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

13cef6a7357b996e980cff274286eee65ed1b97cbdf07eeea2d9ac8bd22c2d26.exe
Size

1.7MB
MD5

71ed8490fb864ca3a42c6533a4a4cba3
SHA1

8557ec4834f7298b4aa1c81f3f5d377f236f8aa5
SHA256

13cef6a7357b996e980cff274286eee65ed1b97cbdf07eeea2d9ac8bd22c2d26
SHA512

264b8691e68443962b0049aca6cfc2b0da01c812031d9a899872bd7e24a743e850460dee8d7b9bd7d071ea5f343676cdf3df93fd42d349e21321a998cd600d84
SSDEEP

49152:GezaTF8FcNkNdfE0pZ9ozttwIRRegkvbAKFi:GemTLkNdfE0pZyL

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 37 IoCs

miner

resource	yara_rule
behavioral2/files/0x0009000000023ca4-3.dat	xmrig
behavioral2/files/0x0007000000023cad-15.dat	xmrig
behavioral2/files/0x0007000000023cab-17.dat	xmrig
behavioral2/files/0x0007000000023cae-24.dat	xmrig
behavioral2/files/0x0007000000023cac-20.dat	xmrig
behavioral2/files/0x0007000000023caf-33.dat	xmrig
behavioral2/files/0x0007000000023cb7-62.dat	xmrig
behavioral2/files/0x0007000000023cb6-57.dat	xmrig
behavioral2/files/0x0007000000023cb5-54.dat	xmrig
behavioral2/files/0x0007000000023cb4-53.dat	xmrig
behavioral2/files/0x0007000000023cb3-50.dat	xmrig
behavioral2/files/0x0007000000023cb2-44.dat	xmrig
behavioral2/files/0x0007000000023cb1-35.dat	xmrig
behavioral2/files/0x0007000000023cbb-75.dat	xmrig
behavioral2/files/0x0007000000023cba-89.dat	xmrig
behavioral2/files/0x0007000000023cc4-128.dat	xmrig
behavioral2/files/0x0007000000023ccd-152.dat	xmrig
behavioral2/files/0x0007000000023cc3-171.dat	xmrig
behavioral2/files/0x0007000000023cbd-169.dat	xmrig
behavioral2/files/0x0007000000023cc1-164.dat	xmrig
behavioral2/files/0x0007000000023cc0-163.dat	xmrig
behavioral2/files/0x0007000000023ccf-162.dat	xmrig
behavioral2/files/0x0007000000023cbf-155.dat	xmrig
behavioral2/files/0x0007000000023cbe-153.dat	xmrig
behavioral2/files/0x0007000000023ccc-151.dat	xmrig
behavioral2/files/0x0009000000023ca5-149.dat	xmrig
behavioral2/files/0x0007000000023ccb-148.dat	xmrig
behavioral2/files/0x0007000000023cc2-146.dat	xmrig
behavioral2/files/0x0007000000023cca-145.dat	xmrig
behavioral2/files/0x0007000000023cc9-142.dat	xmrig
behavioral2/files/0x0007000000023cc8-141.dat	xmrig
behavioral2/files/0x0007000000023cc7-138.dat	xmrig
behavioral2/files/0x0007000000023cc6-135.dat	xmrig
behavioral2/files/0x0007000000023cbc-134.dat	xmrig
behavioral2/files/0x0007000000023cc5-133.dat	xmrig
behavioral2/files/0x0007000000023cb9-117.dat	xmrig
behavioral2/files/0x0007000000023cb8-114.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
5080	lNUamwi.exe
2376	SfsRFfV.exe
3192	BikkCaD.exe
512	sWNkCxW.exe
3532	QHeRHKk.exe
3244	CGdQxuU.exe
3136	rPBlbHm.exe
2260	PymcorF.exe
3260	NSfNRjE.exe
3640	JxwxYrI.exe
4744	WVGDShx.exe
3460	LgkQVBm.exe
4132	mcTNWBM.exe
3732	XWyaCiZ.exe
3164	nRpdzpc.exe
3716	hLptKeV.exe
4500	WSfDqSM.exe
5044	mXdEmJO.exe
1004	gEwreqB.exe
1352	Wbntpxb.exe
3768	TYcbQPR.exe
4224	ucdKNAP.exe
4416	dZyQgbO.exe
2988	hvXGlRC.exe
2976	KjHREdt.exe
1632	YzFyxOo.exe
796	pBfxsFE.exe
2820	NPufQxM.exe
1724	qoRqymq.exe
3228	RImcBpW.exe
4036	phUcyIi.exe
4760	WGjQlmv.exe
1644	SgJJxCB.exe
536	cxUbbdg.exe
2412	TUOOwPl.exe
4108	vRNKrSk.exe
2504	gyERNzi.exe
324	sPnnFHq.exe
2872	wLywEEr.exe
4356	xXVhnjr.exe
440	jOeiPZj.exe
996	XPzZfqV.exe
2124	eKuQbtA.exe
4632	AafyJCH.exe
60	BiJqNsJ.exe
4716	yvxxvPT.exe
3828	zlEMEkZ.exe
2952	mYRwuar.exe
3928	HzNCYLQ.exe
3580	bqvZtIk.exe
4064	fpdXiKd.exe
1220	AMdsHbI.exe
3584	fGbmruA.exe
4216	hdyODHa.exe
400	rmByRjM.exe
2364	FNBdpLI.exe
4344	aAzHqwI.exe
3088	ZioSOLW.exe
1972	ZPwmMMP.exe
2452	UpRWHvO.exe
2648	TRvMCxq.exe
1784	AmUtHKW.exe
4792	qjeRiVO.exe
2656	TJopUyV.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\TkkTVcT.exe	13cef6a7357b996e980cff274286eee65ed1b97cbdf07eeea2d9ac8bd22c2d26.exe
File created	C:\Windows\System\hgidRCQ.exe	13cef6a7357b996e980cff274286eee65ed1b97cbdf07eeea2d9ac8bd22c2d26.exe
File created	C:\Windows\System\qYiGfLr.exe	13cef6a7357b996e980cff274286eee65ed1b97cbdf07eeea2d9ac8bd22c2d26.exe
File created	C:\Windows\System\jRrrzQf.exe	13cef6a7357b996e980cff274286eee65ed1b97cbdf07eeea2d9ac8bd22c2d26.exe
File created	C:\Windows\System\DsHUFni.exe	13cef6a7357b996e980cff274286eee65ed1b97cbdf07eeea2d9ac8bd22c2d26.exe
File created	C:\Windows\System\bpbKUvS.exe	13cef6a7357b996e980cff274286eee65ed1b97cbdf07eeea2d9ac8bd22c2d26.exe
File created	C:\Windows\System\qTpQuFX.exe	13cef6a7357b996e980cff274286eee65ed1b97cbdf07eeea2d9ac8bd22c2d26.exe
File created	C:\Windows\System\LYHoGdf.exe	13cef6a7357b996e980cff274286eee65ed1b97cbdf07eeea2d9ac8bd22c2d26.exe
File created	C:\Windows\System\tgAwXHQ.exe	13cef6a7357b996e980cff274286eee65ed1b97cbdf07eeea2d9ac8bd22c2d26.exe
File created	C:\Windows\System\uAtcVfo.exe	13cef6a7357b996e980cff274286eee65ed1b97cbdf07eeea2d9ac8bd22c2d26.exe
File created	C:\Windows\System\ubvCOAB.exe	13cef6a7357b996e980cff274286eee65ed1b97cbdf07eeea2d9ac8bd22c2d26.exe
File created	C:\Windows\System\BLQsjSo.exe	13cef6a7357b996e980cff274286eee65ed1b97cbdf07eeea2d9ac8bd22c2d26.exe
File created	C:\Windows\System\yzebpZa.exe	13cef6a7357b996e980cff274286eee65ed1b97cbdf07eeea2d9ac8bd22c2d26.exe
File created	C:\Windows\System\vLLBIas.exe	13cef6a7357b996e980cff274286eee65ed1b97cbdf07eeea2d9ac8bd22c2d26.exe
File created	C:\Windows\System\zczEmmw.exe	13cef6a7357b996e980cff274286eee65ed1b97cbdf07eeea2d9ac8bd22c2d26.exe
File created	C:\Windows\System\OdiSNrI.exe	13cef6a7357b996e980cff274286eee65ed1b97cbdf07eeea2d9ac8bd22c2d26.exe
File created	C:\Windows\System\NrnIxXG.exe	13cef6a7357b996e980cff274286eee65ed1b97cbdf07eeea2d9ac8bd22c2d26.exe
File created	C:\Windows\System\ykrQWvj.exe	13cef6a7357b996e980cff274286eee65ed1b97cbdf07eeea2d9ac8bd22c2d26.exe
File created	C:\Windows\System\oObMWQM.exe	13cef6a7357b996e980cff274286eee65ed1b97cbdf07eeea2d9ac8bd22c2d26.exe
File created	C:\Windows\System\RmXdwQS.exe	13cef6a7357b996e980cff274286eee65ed1b97cbdf07eeea2d9ac8bd22c2d26.exe
File created	C:\Windows\System\cjUbOLv.exe	13cef6a7357b996e980cff274286eee65ed1b97cbdf07eeea2d9ac8bd22c2d26.exe
File created	C:\Windows\System\BikkCaD.exe	13cef6a7357b996e980cff274286eee65ed1b97cbdf07eeea2d9ac8bd22c2d26.exe
File created	C:\Windows\System\LpLjzfi.exe	13cef6a7357b996e980cff274286eee65ed1b97cbdf07eeea2d9ac8bd22c2d26.exe
File created	C:\Windows\System\ZWUPtVE.exe	13cef6a7357b996e980cff274286eee65ed1b97cbdf07eeea2d9ac8bd22c2d26.exe
File created	C:\Windows\System\tpSBwbn.exe	13cef6a7357b996e980cff274286eee65ed1b97cbdf07eeea2d9ac8bd22c2d26.exe
File created	C:\Windows\System\JtkPAsj.exe	13cef6a7357b996e980cff274286eee65ed1b97cbdf07eeea2d9ac8bd22c2d26.exe
File created	C:\Windows\System\ucdKNAP.exe	13cef6a7357b996e980cff274286eee65ed1b97cbdf07eeea2d9ac8bd22c2d26.exe
File created	C:\Windows\System\Hcawefn.exe	13cef6a7357b996e980cff274286eee65ed1b97cbdf07eeea2d9ac8bd22c2d26.exe
File created	C:\Windows\System\ICmQoRs.exe	13cef6a7357b996e980cff274286eee65ed1b97cbdf07eeea2d9ac8bd22c2d26.exe
File created	C:\Windows\System\ijSvQBZ.exe	13cef6a7357b996e980cff274286eee65ed1b97cbdf07eeea2d9ac8bd22c2d26.exe
File created	C:\Windows\System\kfLaJxc.exe	13cef6a7357b996e980cff274286eee65ed1b97cbdf07eeea2d9ac8bd22c2d26.exe
File created	C:\Windows\System\iZTtSet.exe	13cef6a7357b996e980cff274286eee65ed1b97cbdf07eeea2d9ac8bd22c2d26.exe
File created	C:\Windows\System\gDhQYrN.exe	13cef6a7357b996e980cff274286eee65ed1b97cbdf07eeea2d9ac8bd22c2d26.exe
File created	C:\Windows\System\fztwyqV.exe	13cef6a7357b996e980cff274286eee65ed1b97cbdf07eeea2d9ac8bd22c2d26.exe
File created	C:\Windows\System\QJEvvzs.exe	13cef6a7357b996e980cff274286eee65ed1b97cbdf07eeea2d9ac8bd22c2d26.exe
File created	C:\Windows\System\raYnORq.exe	13cef6a7357b996e980cff274286eee65ed1b97cbdf07eeea2d9ac8bd22c2d26.exe
File created	C:\Windows\System\koKSNND.exe	13cef6a7357b996e980cff274286eee65ed1b97cbdf07eeea2d9ac8bd22c2d26.exe
File created	C:\Windows\System\FCzuTNE.exe	13cef6a7357b996e980cff274286eee65ed1b97cbdf07eeea2d9ac8bd22c2d26.exe
File created	C:\Windows\System\HPAZCCv.exe	13cef6a7357b996e980cff274286eee65ed1b97cbdf07eeea2d9ac8bd22c2d26.exe
File created	C:\Windows\System\ZWCmYzm.exe	13cef6a7357b996e980cff274286eee65ed1b97cbdf07eeea2d9ac8bd22c2d26.exe
File created	C:\Windows\System\gyNWFtV.exe	13cef6a7357b996e980cff274286eee65ed1b97cbdf07eeea2d9ac8bd22c2d26.exe
File created	C:\Windows\System\JxwxYrI.exe	13cef6a7357b996e980cff274286eee65ed1b97cbdf07eeea2d9ac8bd22c2d26.exe
File created	C:\Windows\System\KEKcvfy.exe	13cef6a7357b996e980cff274286eee65ed1b97cbdf07eeea2d9ac8bd22c2d26.exe
File created	C:\Windows\System\SeDdKZb.exe	13cef6a7357b996e980cff274286eee65ed1b97cbdf07eeea2d9ac8bd22c2d26.exe
File created	C:\Windows\System\oUlAbQN.exe	13cef6a7357b996e980cff274286eee65ed1b97cbdf07eeea2d9ac8bd22c2d26.exe
File created	C:\Windows\System\UQWrvHB.exe	13cef6a7357b996e980cff274286eee65ed1b97cbdf07eeea2d9ac8bd22c2d26.exe
File created	C:\Windows\System\keFYkHm.exe	13cef6a7357b996e980cff274286eee65ed1b97cbdf07eeea2d9ac8bd22c2d26.exe
File created	C:\Windows\System\RMswXuJ.exe	13cef6a7357b996e980cff274286eee65ed1b97cbdf07eeea2d9ac8bd22c2d26.exe
File created	C:\Windows\System\YuBHzLV.exe	13cef6a7357b996e980cff274286eee65ed1b97cbdf07eeea2d9ac8bd22c2d26.exe
File created	C:\Windows\System\YQLLZqf.exe	13cef6a7357b996e980cff274286eee65ed1b97cbdf07eeea2d9ac8bd22c2d26.exe
File created	C:\Windows\System\iFuInuN.exe	13cef6a7357b996e980cff274286eee65ed1b97cbdf07eeea2d9ac8bd22c2d26.exe
File created	C:\Windows\System\moPoche.exe	13cef6a7357b996e980cff274286eee65ed1b97cbdf07eeea2d9ac8bd22c2d26.exe
File created	C:\Windows\System\yAENMri.exe	13cef6a7357b996e980cff274286eee65ed1b97cbdf07eeea2d9ac8bd22c2d26.exe
File created	C:\Windows\System\GHonruc.exe	13cef6a7357b996e980cff274286eee65ed1b97cbdf07eeea2d9ac8bd22c2d26.exe
File created	C:\Windows\System\fEhRoXL.exe	13cef6a7357b996e980cff274286eee65ed1b97cbdf07eeea2d9ac8bd22c2d26.exe
File created	C:\Windows\System\jsuBPCz.exe	13cef6a7357b996e980cff274286eee65ed1b97cbdf07eeea2d9ac8bd22c2d26.exe
File created	C:\Windows\System\drZbcpz.exe	13cef6a7357b996e980cff274286eee65ed1b97cbdf07eeea2d9ac8bd22c2d26.exe
File created	C:\Windows\System\gZrqObF.exe	13cef6a7357b996e980cff274286eee65ed1b97cbdf07eeea2d9ac8bd22c2d26.exe
File created	C:\Windows\System\dNKnXRn.exe	13cef6a7357b996e980cff274286eee65ed1b97cbdf07eeea2d9ac8bd22c2d26.exe
File created	C:\Windows\System\WGjQlmv.exe	13cef6a7357b996e980cff274286eee65ed1b97cbdf07eeea2d9ac8bd22c2d26.exe
File created	C:\Windows\System\AMdsHbI.exe	13cef6a7357b996e980cff274286eee65ed1b97cbdf07eeea2d9ac8bd22c2d26.exe
File created	C:\Windows\System\HnNVHok.exe	13cef6a7357b996e980cff274286eee65ed1b97cbdf07eeea2d9ac8bd22c2d26.exe
File created	C:\Windows\System\WdvWOrX.exe	13cef6a7357b996e980cff274286eee65ed1b97cbdf07eeea2d9ac8bd22c2d26.exe
File created	C:\Windows\System\hqpzbor.exe	13cef6a7357b996e980cff274286eee65ed1b97cbdf07eeea2d9ac8bd22c2d26.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	17224	dwm.exe
Token: SeChangeNotifyPrivilege	17224	dwm.exe
Token: 33	17224	dwm.exe
Token: SeIncBasePriorityPrivilege	17224	dwm.exe
Token: SeShutdownPrivilege	17224	dwm.exe
Token: SeCreatePagefilePrivilege	17224	dwm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 904 wrote to memory of 5080	904	13cef6a7357b996e980cff274286eee65ed1b97cbdf07eeea2d9ac8bd22c2d26.exe	84
PID 904 wrote to memory of 5080	904	13cef6a7357b996e980cff274286eee65ed1b97cbdf07eeea2d9ac8bd22c2d26.exe	84
PID 904 wrote to memory of 2376	904	13cef6a7357b996e980cff274286eee65ed1b97cbdf07eeea2d9ac8bd22c2d26.exe	85
PID 904 wrote to memory of 2376	904	13cef6a7357b996e980cff274286eee65ed1b97cbdf07eeea2d9ac8bd22c2d26.exe	85
PID 904 wrote to memory of 3192	904	13cef6a7357b996e980cff274286eee65ed1b97cbdf07eeea2d9ac8bd22c2d26.exe	86
PID 904 wrote to memory of 3192	904	13cef6a7357b996e980cff274286eee65ed1b97cbdf07eeea2d9ac8bd22c2d26.exe	86
PID 904 wrote to memory of 512	904	13cef6a7357b996e980cff274286eee65ed1b97cbdf07eeea2d9ac8bd22c2d26.exe	87
PID 904 wrote to memory of 512	904	13cef6a7357b996e980cff274286eee65ed1b97cbdf07eeea2d9ac8bd22c2d26.exe	87
PID 904 wrote to memory of 3532	904	13cef6a7357b996e980cff274286eee65ed1b97cbdf07eeea2d9ac8bd22c2d26.exe	88
PID 904 wrote to memory of 3532	904	13cef6a7357b996e980cff274286eee65ed1b97cbdf07eeea2d9ac8bd22c2d26.exe	88
PID 904 wrote to memory of 3244	904	13cef6a7357b996e980cff274286eee65ed1b97cbdf07eeea2d9ac8bd22c2d26.exe	89
PID 904 wrote to memory of 3244	904	13cef6a7357b996e980cff274286eee65ed1b97cbdf07eeea2d9ac8bd22c2d26.exe	89
PID 904 wrote to memory of 3136	904	13cef6a7357b996e980cff274286eee65ed1b97cbdf07eeea2d9ac8bd22c2d26.exe	90
PID 904 wrote to memory of 3136	904	13cef6a7357b996e980cff274286eee65ed1b97cbdf07eeea2d9ac8bd22c2d26.exe	90
PID 904 wrote to memory of 2260	904	13cef6a7357b996e980cff274286eee65ed1b97cbdf07eeea2d9ac8bd22c2d26.exe	91
PID 904 wrote to memory of 2260	904	13cef6a7357b996e980cff274286eee65ed1b97cbdf07eeea2d9ac8bd22c2d26.exe	91
PID 904 wrote to memory of 3260	904	13cef6a7357b996e980cff274286eee65ed1b97cbdf07eeea2d9ac8bd22c2d26.exe	92
PID 904 wrote to memory of 3260	904	13cef6a7357b996e980cff274286eee65ed1b97cbdf07eeea2d9ac8bd22c2d26.exe	92
PID 904 wrote to memory of 3640	904	13cef6a7357b996e980cff274286eee65ed1b97cbdf07eeea2d9ac8bd22c2d26.exe	93
PID 904 wrote to memory of 3640	904	13cef6a7357b996e980cff274286eee65ed1b97cbdf07eeea2d9ac8bd22c2d26.exe	93
PID 904 wrote to memory of 4744	904	13cef6a7357b996e980cff274286eee65ed1b97cbdf07eeea2d9ac8bd22c2d26.exe	94
PID 904 wrote to memory of 4744	904	13cef6a7357b996e980cff274286eee65ed1b97cbdf07eeea2d9ac8bd22c2d26.exe	94
PID 904 wrote to memory of 3460	904	13cef6a7357b996e980cff274286eee65ed1b97cbdf07eeea2d9ac8bd22c2d26.exe	95
PID 904 wrote to memory of 3460	904	13cef6a7357b996e980cff274286eee65ed1b97cbdf07eeea2d9ac8bd22c2d26.exe	95
PID 904 wrote to memory of 4132	904	13cef6a7357b996e980cff274286eee65ed1b97cbdf07eeea2d9ac8bd22c2d26.exe	96
PID 904 wrote to memory of 4132	904	13cef6a7357b996e980cff274286eee65ed1b97cbdf07eeea2d9ac8bd22c2d26.exe	96
PID 904 wrote to memory of 3732	904	13cef6a7357b996e980cff274286eee65ed1b97cbdf07eeea2d9ac8bd22c2d26.exe	97
PID 904 wrote to memory of 3732	904	13cef6a7357b996e980cff274286eee65ed1b97cbdf07eeea2d9ac8bd22c2d26.exe	97
PID 904 wrote to memory of 3164	904	13cef6a7357b996e980cff274286eee65ed1b97cbdf07eeea2d9ac8bd22c2d26.exe	98
PID 904 wrote to memory of 3164	904	13cef6a7357b996e980cff274286eee65ed1b97cbdf07eeea2d9ac8bd22c2d26.exe	98
PID 904 wrote to memory of 5044	904	13cef6a7357b996e980cff274286eee65ed1b97cbdf07eeea2d9ac8bd22c2d26.exe	99
PID 904 wrote to memory of 5044	904	13cef6a7357b996e980cff274286eee65ed1b97cbdf07eeea2d9ac8bd22c2d26.exe	99
PID 904 wrote to memory of 3716	904	13cef6a7357b996e980cff274286eee65ed1b97cbdf07eeea2d9ac8bd22c2d26.exe	100
PID 904 wrote to memory of 3716	904	13cef6a7357b996e980cff274286eee65ed1b97cbdf07eeea2d9ac8bd22c2d26.exe	100
PID 904 wrote to memory of 4500	904	13cef6a7357b996e980cff274286eee65ed1b97cbdf07eeea2d9ac8bd22c2d26.exe	101
PID 904 wrote to memory of 4500	904	13cef6a7357b996e980cff274286eee65ed1b97cbdf07eeea2d9ac8bd22c2d26.exe	101
PID 904 wrote to memory of 2988	904	13cef6a7357b996e980cff274286eee65ed1b97cbdf07eeea2d9ac8bd22c2d26.exe	102
PID 904 wrote to memory of 2988	904	13cef6a7357b996e980cff274286eee65ed1b97cbdf07eeea2d9ac8bd22c2d26.exe	102
PID 904 wrote to memory of 1004	904	13cef6a7357b996e980cff274286eee65ed1b97cbdf07eeea2d9ac8bd22c2d26.exe	103
PID 904 wrote to memory of 1004	904	13cef6a7357b996e980cff274286eee65ed1b97cbdf07eeea2d9ac8bd22c2d26.exe	103
PID 904 wrote to memory of 1352	904	13cef6a7357b996e980cff274286eee65ed1b97cbdf07eeea2d9ac8bd22c2d26.exe	104
PID 904 wrote to memory of 1352	904	13cef6a7357b996e980cff274286eee65ed1b97cbdf07eeea2d9ac8bd22c2d26.exe	104
PID 904 wrote to memory of 3768	904	13cef6a7357b996e980cff274286eee65ed1b97cbdf07eeea2d9ac8bd22c2d26.exe	105
PID 904 wrote to memory of 3768	904	13cef6a7357b996e980cff274286eee65ed1b97cbdf07eeea2d9ac8bd22c2d26.exe	105
PID 904 wrote to memory of 4224	904	13cef6a7357b996e980cff274286eee65ed1b97cbdf07eeea2d9ac8bd22c2d26.exe	106
PID 904 wrote to memory of 4224	904	13cef6a7357b996e980cff274286eee65ed1b97cbdf07eeea2d9ac8bd22c2d26.exe	106
PID 904 wrote to memory of 4416	904	13cef6a7357b996e980cff274286eee65ed1b97cbdf07eeea2d9ac8bd22c2d26.exe	107
PID 904 wrote to memory of 4416	904	13cef6a7357b996e980cff274286eee65ed1b97cbdf07eeea2d9ac8bd22c2d26.exe	107
PID 904 wrote to memory of 2976	904	13cef6a7357b996e980cff274286eee65ed1b97cbdf07eeea2d9ac8bd22c2d26.exe	108
PID 904 wrote to memory of 2976	904	13cef6a7357b996e980cff274286eee65ed1b97cbdf07eeea2d9ac8bd22c2d26.exe	108
PID 904 wrote to memory of 1632	904	13cef6a7357b996e980cff274286eee65ed1b97cbdf07eeea2d9ac8bd22c2d26.exe	109
PID 904 wrote to memory of 1632	904	13cef6a7357b996e980cff274286eee65ed1b97cbdf07eeea2d9ac8bd22c2d26.exe	109
PID 904 wrote to memory of 796	904	13cef6a7357b996e980cff274286eee65ed1b97cbdf07eeea2d9ac8bd22c2d26.exe	110
PID 904 wrote to memory of 796	904	13cef6a7357b996e980cff274286eee65ed1b97cbdf07eeea2d9ac8bd22c2d26.exe	110
PID 904 wrote to memory of 2820	904	13cef6a7357b996e980cff274286eee65ed1b97cbdf07eeea2d9ac8bd22c2d26.exe	111
PID 904 wrote to memory of 2820	904	13cef6a7357b996e980cff274286eee65ed1b97cbdf07eeea2d9ac8bd22c2d26.exe	111
PID 904 wrote to memory of 1724	904	13cef6a7357b996e980cff274286eee65ed1b97cbdf07eeea2d9ac8bd22c2d26.exe	112
PID 904 wrote to memory of 1724	904	13cef6a7357b996e980cff274286eee65ed1b97cbdf07eeea2d9ac8bd22c2d26.exe	112
PID 904 wrote to memory of 3228	904	13cef6a7357b996e980cff274286eee65ed1b97cbdf07eeea2d9ac8bd22c2d26.exe	113
PID 904 wrote to memory of 3228	904	13cef6a7357b996e980cff274286eee65ed1b97cbdf07eeea2d9ac8bd22c2d26.exe	113
PID 904 wrote to memory of 4036	904	13cef6a7357b996e980cff274286eee65ed1b97cbdf07eeea2d9ac8bd22c2d26.exe	114
PID 904 wrote to memory of 4036	904	13cef6a7357b996e980cff274286eee65ed1b97cbdf07eeea2d9ac8bd22c2d26.exe	114
PID 904 wrote to memory of 4760	904	13cef6a7357b996e980cff274286eee65ed1b97cbdf07eeea2d9ac8bd22c2d26.exe	115
PID 904 wrote to memory of 4760	904	13cef6a7357b996e980cff274286eee65ed1b97cbdf07eeea2d9ac8bd22c2d26.exe	115

C:\Users\Admin\AppData\Local\Temp\13cef6a7357b996e980cff274286eee65ed1b97cbdf07eeea2d9ac8bd22c2d26.exe
"C:\Users\Admin\AppData\Local\Temp\13cef6a7357b996e980cff274286eee65ed1b97cbdf07eeea2d9ac8bd22c2d26.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:904
- C:\Windows\System\lNUamwi.exe
  C:\Windows\System\lNUamwi.exe
  2⤵
  - Executes dropped EXE
  PID:5080
- C:\Windows\System\SfsRFfV.exe
  C:\Windows\System\SfsRFfV.exe
  2⤵
  - Executes dropped EXE
  PID:2376
- C:\Windows\System\BikkCaD.exe
  C:\Windows\System\BikkCaD.exe
  2⤵
  - Executes dropped EXE
  PID:3192
- C:\Windows\System\sWNkCxW.exe
  C:\Windows\System\sWNkCxW.exe
  2⤵
  - Executes dropped EXE
  PID:512
- C:\Windows\System\QHeRHKk.exe
  C:\Windows\System\QHeRHKk.exe
  2⤵
  - Executes dropped EXE
  PID:3532
- C:\Windows\System\CGdQxuU.exe
  C:\Windows\System\CGdQxuU.exe
  2⤵
  - Executes dropped EXE
  PID:3244
- C:\Windows\System\rPBlbHm.exe
  C:\Windows\System\rPBlbHm.exe
  2⤵
  - Executes dropped EXE
  PID:3136
- C:\Windows\System\PymcorF.exe
  C:\Windows\System\PymcorF.exe
  2⤵
  - Executes dropped EXE
  PID:2260
- C:\Windows\System\NSfNRjE.exe
  C:\Windows\System\NSfNRjE.exe
  2⤵
  - Executes dropped EXE
  PID:3260
- C:\Windows\System\JxwxYrI.exe
  C:\Windows\System\JxwxYrI.exe
  2⤵
  - Executes dropped EXE
  PID:3640
- C:\Windows\System\WVGDShx.exe
  C:\Windows\System\WVGDShx.exe
  2⤵
  - Executes dropped EXE
  PID:4744
- C:\Windows\System\LgkQVBm.exe
  C:\Windows\System\LgkQVBm.exe
  2⤵
  - Executes dropped EXE
  PID:3460
- C:\Windows\System\mcTNWBM.exe
  C:\Windows\System\mcTNWBM.exe
  2⤵
  - Executes dropped EXE
  PID:4132
- C:\Windows\System\XWyaCiZ.exe
  C:\Windows\System\XWyaCiZ.exe
  2⤵
  - Executes dropped EXE
  PID:3732
- C:\Windows\System\nRpdzpc.exe
  C:\Windows\System\nRpdzpc.exe
  2⤵
  - Executes dropped EXE
  PID:3164
- C:\Windows\System\mXdEmJO.exe
  C:\Windows\System\mXdEmJO.exe
  2⤵
  - Executes dropped EXE
  PID:5044
- C:\Windows\System\hLptKeV.exe
  C:\Windows\System\hLptKeV.exe
  2⤵
  - Executes dropped EXE
  PID:3716
- C:\Windows\System\WSfDqSM.exe
  C:\Windows\System\WSfDqSM.exe
  2⤵
  - Executes dropped EXE
  PID:4500
- C:\Windows\System\hvXGlRC.exe
  C:\Windows\System\hvXGlRC.exe
  2⤵
  - Executes dropped EXE
  PID:2988
- C:\Windows\System\gEwreqB.exe
  C:\Windows\System\gEwreqB.exe
  2⤵
  - Executes dropped EXE
  PID:1004
- C:\Windows\System\Wbntpxb.exe
  C:\Windows\System\Wbntpxb.exe
  2⤵
  - Executes dropped EXE
  PID:1352
- C:\Windows\System\TYcbQPR.exe
  C:\Windows\System\TYcbQPR.exe
  2⤵
  - Executes dropped EXE
  PID:3768
- C:\Windows\System\ucdKNAP.exe
  C:\Windows\System\ucdKNAP.exe
  2⤵
  - Executes dropped EXE
  PID:4224
- C:\Windows\System\dZyQgbO.exe
  C:\Windows\System\dZyQgbO.exe
  2⤵
  - Executes dropped EXE
  PID:4416
- C:\Windows\System\KjHREdt.exe
  C:\Windows\System\KjHREdt.exe
  2⤵
  - Executes dropped EXE
  PID:2976
- C:\Windows\System\YzFyxOo.exe
  C:\Windows\System\YzFyxOo.exe
  2⤵
  - Executes dropped EXE
  PID:1632
- C:\Windows\System\pBfxsFE.exe
  C:\Windows\System\pBfxsFE.exe
  2⤵
  - Executes dropped EXE
  PID:796
- C:\Windows\System\NPufQxM.exe
  C:\Windows\System\NPufQxM.exe
  2⤵
  - Executes dropped EXE
  PID:2820
- C:\Windows\System\qoRqymq.exe
  C:\Windows\System\qoRqymq.exe
  2⤵
  - Executes dropped EXE
  PID:1724
- C:\Windows\System\RImcBpW.exe
  C:\Windows\System\RImcBpW.exe
  2⤵
  - Executes dropped EXE
  PID:3228
- C:\Windows\System\phUcyIi.exe
  C:\Windows\System\phUcyIi.exe
  2⤵
  - Executes dropped EXE
  PID:4036
- C:\Windows\System\WGjQlmv.exe
  C:\Windows\System\WGjQlmv.exe
  2⤵
  - Executes dropped EXE
  PID:4760
- C:\Windows\System\SgJJxCB.exe
  C:\Windows\System\SgJJxCB.exe
  2⤵
  - Executes dropped EXE
  PID:1644
- C:\Windows\System\cxUbbdg.exe
  C:\Windows\System\cxUbbdg.exe
  2⤵
  - Executes dropped EXE
  PID:536
- C:\Windows\System\TUOOwPl.exe
  C:\Windows\System\TUOOwPl.exe
  2⤵
  - Executes dropped EXE
  PID:2412
- C:\Windows\System\vRNKrSk.exe
  C:\Windows\System\vRNKrSk.exe
  2⤵
  - Executes dropped EXE
  PID:4108
- C:\Windows\System\xXVhnjr.exe
  C:\Windows\System\xXVhnjr.exe
  2⤵
  - Executes dropped EXE
  PID:4356
- C:\Windows\System\gyERNzi.exe
  C:\Windows\System\gyERNzi.exe
  2⤵
  - Executes dropped EXE
  PID:2504
- C:\Windows\System\sPnnFHq.exe
  C:\Windows\System\sPnnFHq.exe
  2⤵
  - Executes dropped EXE
  PID:324
- C:\Windows\System\wLywEEr.exe
  C:\Windows\System\wLywEEr.exe
  2⤵
  - Executes dropped EXE
  PID:2872
- C:\Windows\System\jOeiPZj.exe
  C:\Windows\System\jOeiPZj.exe
  2⤵
  - Executes dropped EXE
  PID:440
- C:\Windows\System\XPzZfqV.exe
  C:\Windows\System\XPzZfqV.exe
  2⤵
  - Executes dropped EXE
  PID:996
- C:\Windows\System\eKuQbtA.exe
  C:\Windows\System\eKuQbtA.exe
  2⤵
  - Executes dropped EXE
  PID:2124
- C:\Windows\System\AafyJCH.exe
  C:\Windows\System\AafyJCH.exe
  2⤵
  - Executes dropped EXE
  PID:4632
- C:\Windows\System\BiJqNsJ.exe
  C:\Windows\System\BiJqNsJ.exe
  2⤵
  - Executes dropped EXE
  PID:60
- C:\Windows\System\yvxxvPT.exe
  C:\Windows\System\yvxxvPT.exe
  2⤵
  - Executes dropped EXE
  PID:4716
- C:\Windows\System\zlEMEkZ.exe
  C:\Windows\System\zlEMEkZ.exe
  2⤵
  - Executes dropped EXE
  PID:3828
- C:\Windows\System\mYRwuar.exe
  C:\Windows\System\mYRwuar.exe
  2⤵
  - Executes dropped EXE
  PID:2952
- C:\Windows\System\HzNCYLQ.exe
  C:\Windows\System\HzNCYLQ.exe
  2⤵
  - Executes dropped EXE
  PID:3928
- C:\Windows\System\bqvZtIk.exe
  C:\Windows\System\bqvZtIk.exe
  2⤵
  - Executes dropped EXE
  PID:3580
- C:\Windows\System\fpdXiKd.exe
  C:\Windows\System\fpdXiKd.exe
  2⤵
  - Executes dropped EXE
  PID:4064
- C:\Windows\System\AMdsHbI.exe
  C:\Windows\System\AMdsHbI.exe
  2⤵
  - Executes dropped EXE
  PID:1220
- C:\Windows\System\fGbmruA.exe
  C:\Windows\System\fGbmruA.exe
  2⤵
  - Executes dropped EXE
  PID:3584
- C:\Windows\System\hdyODHa.exe
  C:\Windows\System\hdyODHa.exe
  2⤵
  - Executes dropped EXE
  PID:4216
- C:\Windows\System\rmByRjM.exe
  C:\Windows\System\rmByRjM.exe
  2⤵
  - Executes dropped EXE
  PID:400
- C:\Windows\System\FNBdpLI.exe
  C:\Windows\System\FNBdpLI.exe
  2⤵
  - Executes dropped EXE
  PID:2364
- C:\Windows\System\aAzHqwI.exe
  C:\Windows\System\aAzHqwI.exe
  2⤵
  - Executes dropped EXE
  PID:4344
- C:\Windows\System\ZioSOLW.exe
  C:\Windows\System\ZioSOLW.exe
  2⤵
  - Executes dropped EXE
  PID:3088
- C:\Windows\System\ZPwmMMP.exe
  C:\Windows\System\ZPwmMMP.exe
  2⤵
  - Executes dropped EXE
  PID:1972
- C:\Windows\System\UpRWHvO.exe
  C:\Windows\System\UpRWHvO.exe
  2⤵
  - Executes dropped EXE
  PID:2452
- C:\Windows\System\TRvMCxq.exe
  C:\Windows\System\TRvMCxq.exe
  2⤵
  - Executes dropped EXE
  PID:2648
- C:\Windows\System\AmUtHKW.exe
  C:\Windows\System\AmUtHKW.exe
  2⤵
  - Executes dropped EXE
  PID:1784
- C:\Windows\System\qjeRiVO.exe
  C:\Windows\System\qjeRiVO.exe
  2⤵
  - Executes dropped EXE
  PID:4792
- C:\Windows\System\TJopUyV.exe
  C:\Windows\System\TJopUyV.exe
  2⤵
  - Executes dropped EXE
  PID:2656
- C:\Windows\System\GHJILiY.exe
  C:\Windows\System\GHJILiY.exe
  2⤵
  PID:4868
- C:\Windows\System\dxELNHh.exe
  C:\Windows\System\dxELNHh.exe
  2⤵
  PID:3168
- C:\Windows\System\EUbHrcc.exe
  C:\Windows\System\EUbHrcc.exe
  2⤵
  PID:3112
- C:\Windows\System\kXKJoGz.exe
  C:\Windows\System\kXKJoGz.exe
  2⤵
  PID:4260
- C:\Windows\System\rmDqAgy.exe
  C:\Windows\System\rmDqAgy.exe
  2⤵
  PID:2884
- C:\Windows\System\YZzLvHP.exe
  C:\Windows\System\YZzLvHP.exe
  2⤵
  PID:1440
- C:\Windows\System\zrnUyBJ.exe
  C:\Windows\System\zrnUyBJ.exe
  2⤵
  PID:3320
- C:\Windows\System\joEZiTx.exe
  C:\Windows\System\joEZiTx.exe
  2⤵
  PID:4340
- C:\Windows\System\JMLRKva.exe
  C:\Windows\System\JMLRKva.exe
  2⤵
  PID:3576
- C:\Windows\System\JggBzqU.exe
  C:\Windows\System\JggBzqU.exe
  2⤵
  PID:2992
- C:\Windows\System\YAmfDNP.exe
  C:\Windows\System\YAmfDNP.exe
  2⤵
  PID:2964
- C:\Windows\System\fUdnmAk.exe
  C:\Windows\System\fUdnmAk.exe
  2⤵
  PID:1628
- C:\Windows\System\GvQLXoi.exe
  C:\Windows\System\GvQLXoi.exe
  2⤵
  PID:3772
- C:\Windows\System\KIWKwDa.exe
  C:\Windows\System\KIWKwDa.exe
  2⤵
  PID:2536
- C:\Windows\System\DrEROqJ.exe
  C:\Windows\System\DrEROqJ.exe
  2⤵
  PID:4984
- C:\Windows\System\eNaEfJN.exe
  C:\Windows\System\eNaEfJN.exe
  2⤵
  PID:1708
- C:\Windows\System\NOTwbwd.exe
  C:\Windows\System\NOTwbwd.exe
  2⤵
  PID:4676
- C:\Windows\System\ZLBduMf.exe
  C:\Windows\System\ZLBduMf.exe
  2⤵
  PID:4088
- C:\Windows\System\Pbyfozb.exe
  C:\Windows\System\Pbyfozb.exe
  2⤵
  PID:2896
- C:\Windows\System\dnsfSxG.exe
  C:\Windows\System\dnsfSxG.exe
  2⤵
  PID:932
- C:\Windows\System\dlkCCoS.exe
  C:\Windows\System\dlkCCoS.exe
  2⤵
  PID:4672
- C:\Windows\System\sIyDTzt.exe
  C:\Windows\System\sIyDTzt.exe
  2⤵
  PID:3984
- C:\Windows\System\zGdoFqg.exe
  C:\Windows\System\zGdoFqg.exe
  2⤵
  PID:860
- C:\Windows\System\VvRdrgA.exe
  C:\Windows\System\VvRdrgA.exe
  2⤵
  PID:4480
- C:\Windows\System\fztwyqV.exe
  C:\Windows\System\fztwyqV.exe
  2⤵
  PID:3596
- C:\Windows\System\BGLbesb.exe
  C:\Windows\System\BGLbesb.exe
  2⤵
  PID:2424
- C:\Windows\System\MhJSrFZ.exe
  C:\Windows\System\MhJSrFZ.exe
  2⤵
  PID:1416
- C:\Windows\System\uhdFGsV.exe
  C:\Windows\System\uhdFGsV.exe
  2⤵
  PID:1812
- C:\Windows\System\uzHcrLt.exe
  C:\Windows\System\uzHcrLt.exe
  2⤵
  PID:708
- C:\Windows\System\hMoaUTZ.exe
  C:\Windows\System\hMoaUTZ.exe
  2⤵
  PID:872
- C:\Windows\System\qRgCtNr.exe
  C:\Windows\System\qRgCtNr.exe
  2⤵
  PID:5128
- C:\Windows\System\OehnGbr.exe
  C:\Windows\System\OehnGbr.exe
  2⤵
  PID:5144
- C:\Windows\System\ICZzwtc.exe
  C:\Windows\System\ICZzwtc.exe
  2⤵
  PID:5160
- C:\Windows\System\dotWKDH.exe
  C:\Windows\System\dotWKDH.exe
  2⤵
  PID:5176
- C:\Windows\System\hzljsnU.exe
  C:\Windows\System\hzljsnU.exe
  2⤵
  PID:5192
- C:\Windows\System\oVqYgNS.exe
  C:\Windows\System\oVqYgNS.exe
  2⤵
  PID:5208
- C:\Windows\System\EqAGVNk.exe
  C:\Windows\System\EqAGVNk.exe
  2⤵
  PID:5224
- C:\Windows\System\XYhkZhp.exe
  C:\Windows\System\XYhkZhp.exe
  2⤵
  PID:5240
- C:\Windows\System\PySddcr.exe
  C:\Windows\System\PySddcr.exe
  2⤵
  PID:5256
- C:\Windows\System\zOxfilN.exe
  C:\Windows\System\zOxfilN.exe
  2⤵
  PID:5488
- C:\Windows\System\OKgxtsH.exe
  C:\Windows\System\OKgxtsH.exe
  2⤵
  PID:5508
- C:\Windows\System\EJqAbdl.exe
  C:\Windows\System\EJqAbdl.exe
  2⤵
  PID:5524
- C:\Windows\System\owREyZK.exe
  C:\Windows\System\owREyZK.exe
  2⤵
  PID:5548
- C:\Windows\System\TMenlTc.exe
  C:\Windows\System\TMenlTc.exe
  2⤵
  PID:5568
- C:\Windows\System\TWXqINI.exe
  C:\Windows\System\TWXqINI.exe
  2⤵
  PID:5596
- C:\Windows\System\dvzUGzX.exe
  C:\Windows\System\dvzUGzX.exe
  2⤵
  PID:5616
- C:\Windows\System\hEGsxpO.exe
  C:\Windows\System\hEGsxpO.exe
  2⤵
  PID:5636
- C:\Windows\System\LRlghil.exe
  C:\Windows\System\LRlghil.exe
  2⤵
  PID:5656
- C:\Windows\System\sKfNnGV.exe
  C:\Windows\System\sKfNnGV.exe
  2⤵
  PID:5680
- C:\Windows\System\okSdNIE.exe
  C:\Windows\System\okSdNIE.exe
  2⤵
  PID:5708
- C:\Windows\System\DmstFWc.exe
  C:\Windows\System\DmstFWc.exe
  2⤵
  PID:5748
- C:\Windows\System\jYZpuLC.exe
  C:\Windows\System\jYZpuLC.exe
  2⤵
  PID:5780
- C:\Windows\System\qzLShoy.exe
  C:\Windows\System\qzLShoy.exe
  2⤵
  PID:5816
- C:\Windows\System\cloiLYj.exe
  C:\Windows\System\cloiLYj.exe
  2⤵
  PID:5840
- C:\Windows\System\XbaDiIY.exe
  C:\Windows\System\XbaDiIY.exe
  2⤵
  PID:5872
- C:\Windows\System\IUSAous.exe
  C:\Windows\System\IUSAous.exe
  2⤵
  PID:5892
- C:\Windows\System\dCSQFgv.exe
  C:\Windows\System\dCSQFgv.exe
  2⤵
  PID:5924
- C:\Windows\System\rcuqMNx.exe
  C:\Windows\System\rcuqMNx.exe
  2⤵
  PID:5948
- C:\Windows\System\oOBHUrY.exe
  C:\Windows\System\oOBHUrY.exe
  2⤵
  PID:5988
- C:\Windows\System\MOuVFdF.exe
  C:\Windows\System\MOuVFdF.exe
  2⤵
  PID:6020
- C:\Windows\System\qxmQSEX.exe
  C:\Windows\System\qxmQSEX.exe
  2⤵
  PID:6056
- C:\Windows\System\nIvOvfY.exe
  C:\Windows\System\nIvOvfY.exe
  2⤵
  PID:6084
- C:\Windows\System\UmmfbGl.exe
  C:\Windows\System\UmmfbGl.exe
  2⤵
  PID:6112
- C:\Windows\System\vAlbznV.exe
  C:\Windows\System\vAlbznV.exe
  2⤵
  PID:3268
- C:\Windows\System\xhNzszY.exe
  C:\Windows\System\xhNzszY.exe
  2⤵
  PID:1844
- C:\Windows\System\RdOcjMF.exe
  C:\Windows\System\RdOcjMF.exe
  2⤵
  PID:4796
- C:\Windows\System\sVEROOl.exe
  C:\Windows\System\sVEROOl.exe
  2⤵
  PID:5116
- C:\Windows\System\XLGfWGK.exe
  C:\Windows\System\XLGfWGK.exe
  2⤵
  PID:1596
- C:\Windows\System\vHhbQCv.exe
  C:\Windows\System\vHhbQCv.exe
  2⤵
  PID:1932
- C:\Windows\System\IccCmGk.exe
  C:\Windows\System\IccCmGk.exe
  2⤵
  PID:5124
- C:\Windows\System\lvghzUJ.exe
  C:\Windows\System\lvghzUJ.exe
  2⤵
  PID:5184
- C:\Windows\System\EJoxsaA.exe
  C:\Windows\System\EJoxsaA.exe
  2⤵
  PID:5236
- C:\Windows\System\HiCeoJm.exe
  C:\Windows\System\HiCeoJm.exe
  2⤵
  PID:5308
- C:\Windows\System\iVVLktU.exe
  C:\Windows\System\iVVLktU.exe
  2⤵
  PID:5372
- C:\Windows\System\SKHuvyF.exe
  C:\Windows\System\SKHuvyF.exe
  2⤵
  PID:3188
- C:\Windows\System\NIKbHQQ.exe
  C:\Windows\System\NIKbHQQ.exe
  2⤵
  PID:2684
- C:\Windows\System\Hcawefn.exe
  C:\Windows\System\Hcawefn.exe
  2⤵
  PID:3548
- C:\Windows\System\YuBHzLV.exe
  C:\Windows\System\YuBHzLV.exe
  2⤵
  PID:1580
- C:\Windows\System\vGWCdpi.exe
  C:\Windows\System\vGWCdpi.exe
  2⤵
  PID:1712
- C:\Windows\System\wwFfXQI.exe
  C:\Windows\System\wwFfXQI.exe
  2⤵
  PID:224
- C:\Windows\System\EJEtlli.exe
  C:\Windows\System\EJEtlli.exe
  2⤵
  PID:1692
- C:\Windows\System\RCJeJnN.exe
  C:\Windows\System\RCJeJnN.exe
  2⤵
  PID:2160
- C:\Windows\System\ttOgaRs.exe
  C:\Windows\System\ttOgaRs.exe
  2⤵
  PID:5500
- C:\Windows\System\hijJPWk.exe
  C:\Windows\System\hijJPWk.exe
  2⤵
  PID:5564
- C:\Windows\System\UBLdFzA.exe
  C:\Windows\System\UBLdFzA.exe
  2⤵
  PID:5648
- C:\Windows\System\sEQMuSb.exe
  C:\Windows\System\sEQMuSb.exe
  2⤵
  PID:5696
- C:\Windows\System\msAfTaO.exe
  C:\Windows\System\msAfTaO.exe
  2⤵
  PID:5824
- C:\Windows\System\GHuVtip.exe
  C:\Windows\System\GHuVtip.exe
  2⤵
  PID:5860
- C:\Windows\System\BErwFUb.exe
  C:\Windows\System\BErwFUb.exe
  2⤵
  PID:5912
- C:\Windows\System\rUnKpKi.exe
  C:\Windows\System\rUnKpKi.exe
  2⤵
  PID:5960
- C:\Windows\System\wPqTNci.exe
  C:\Windows\System\wPqTNci.exe
  2⤵
  PID:6044
- C:\Windows\System\JPEjYJP.exe
  C:\Windows\System\JPEjYJP.exe
  2⤵
  PID:6124
- C:\Windows\System\jrLIrsM.exe
  C:\Windows\System\jrLIrsM.exe
  2⤵
  PID:5104
- C:\Windows\System\fEhRoXL.exe
  C:\Windows\System\fEhRoXL.exe
  2⤵
  PID:2204
- C:\Windows\System\NQDwILe.exe
  C:\Windows\System\NQDwILe.exe
  2⤵
  PID:5172
- C:\Windows\System\XIkxCXC.exe
  C:\Windows\System\XIkxCXC.exe
  2⤵
  PID:5216
- C:\Windows\System\xEJTvTx.exe
  C:\Windows\System\xEJTvTx.exe
  2⤵
  PID:5364
- C:\Windows\System\LlQNsOx.exe
  C:\Windows\System\LlQNsOx.exe
  2⤵
  PID:4524
- C:\Windows\System\LpLjzfi.exe
  C:\Windows\System\LpLjzfi.exe
  2⤵
  PID:4060
- C:\Windows\System\oZurwZG.exe
  C:\Windows\System\oZurwZG.exe
  2⤵
  PID:856
- C:\Windows\System\cOWbSat.exe
  C:\Windows\System\cOWbSat.exe
  2⤵
  PID:5540
- C:\Windows\System\ErOwilf.exe
  C:\Windows\System\ErOwilf.exe
  2⤵
  PID:5676
- C:\Windows\System\FIlguWb.exe
  C:\Windows\System\FIlguWb.exe
  2⤵
  PID:5884
- C:\Windows\System\yoRgnCi.exe
  C:\Windows\System\yoRgnCi.exe
  2⤵
  PID:5936
- C:\Windows\System\HnOBXGO.exe
  C:\Windows\System\HnOBXGO.exe
  2⤵
  PID:6136
- C:\Windows\System\tJGCWYB.exe
  C:\Windows\System\tJGCWYB.exe
  2⤵
  PID:3592
- C:\Windows\System\eZNHbOs.exe
  C:\Windows\System\eZNHbOs.exe
  2⤵
  PID:5300
- C:\Windows\System\RbxWqPj.exe
  C:\Windows\System\RbxWqPj.exe
  2⤵
  PID:3704
- C:\Windows\System\nNWMTKz.exe
  C:\Windows\System\nNWMTKz.exe
  2⤵
  PID:4936
- C:\Windows\System\anAfFax.exe
  C:\Windows\System\anAfFax.exe
  2⤵
  PID:5848
- C:\Windows\System\xSACClZ.exe
  C:\Windows\System\xSACClZ.exe
  2⤵
  PID:5800
- C:\Windows\System\gUKKiBI.exe
  C:\Windows\System\gUKKiBI.exe
  2⤵
  PID:6096
- C:\Windows\System\ZFgqnAX.exe
  C:\Windows\System\ZFgqnAX.exe
  2⤵
  PID:6152
- C:\Windows\System\HVmDThc.exe
  C:\Windows\System\HVmDThc.exe
  2⤵
  PID:6188
- C:\Windows\System\oxxvSqu.exe
  C:\Windows\System\oxxvSqu.exe
  2⤵
  PID:6212
- C:\Windows\System\cbAzZFV.exe
  C:\Windows\System\cbAzZFV.exe
  2⤵
  PID:6244
- C:\Windows\System\hedtiTg.exe
  C:\Windows\System\hedtiTg.exe
  2⤵
  PID:6268
- C:\Windows\System\xJanBEG.exe
  C:\Windows\System\xJanBEG.exe
  2⤵
  PID:6304
- C:\Windows\System\NvfIETW.exe
  C:\Windows\System\NvfIETW.exe
  2⤵
  PID:6328
- C:\Windows\System\cdspKGz.exe
  C:\Windows\System\cdspKGz.exe
  2⤵
  PID:6348
- C:\Windows\System\fkqLoeL.exe
  C:\Windows\System\fkqLoeL.exe
  2⤵
  PID:6380
- C:\Windows\System\RNkFdTb.exe
  C:\Windows\System\RNkFdTb.exe
  2⤵
  PID:6408
- C:\Windows\System\fvUzPbd.exe
  C:\Windows\System\fvUzPbd.exe
  2⤵
  PID:6440
- C:\Windows\System\CKDWfNm.exe
  C:\Windows\System\CKDWfNm.exe
  2⤵
  PID:6468
- C:\Windows\System\SDDWaTg.exe
  C:\Windows\System\SDDWaTg.exe
  2⤵
  PID:6504
- C:\Windows\System\hCbYbeB.exe
  C:\Windows\System\hCbYbeB.exe
  2⤵
  PID:6524
- C:\Windows\System\AKxSoKV.exe
  C:\Windows\System\AKxSoKV.exe
  2⤵
  PID:6552
- C:\Windows\System\wVXdMQk.exe
  C:\Windows\System\wVXdMQk.exe
  2⤵
  PID:6576
- C:\Windows\System\zrNzeGu.exe
  C:\Windows\System\zrNzeGu.exe
  2⤵
  PID:6592
- C:\Windows\System\tvaMEgF.exe
  C:\Windows\System\tvaMEgF.exe
  2⤵
  PID:6624
- C:\Windows\System\hYejMId.exe
  C:\Windows\System\hYejMId.exe
  2⤵
  PID:6656
- C:\Windows\System\UImSKoq.exe
  C:\Windows\System\UImSKoq.exe
  2⤵
  PID:6676
- C:\Windows\System\XHBbiDg.exe
  C:\Windows\System\XHBbiDg.exe
  2⤵
  PID:6700
- C:\Windows\System\nnBXCLa.exe
  C:\Windows\System\nnBXCLa.exe
  2⤵
  PID:6732
- C:\Windows\System\bcJPQqf.exe
  C:\Windows\System\bcJPQqf.exe
  2⤵
  PID:6760
- C:\Windows\System\SYdEYyr.exe
  C:\Windows\System\SYdEYyr.exe
  2⤵
  PID:6792
- C:\Windows\System\jsuBPCz.exe
  C:\Windows\System\jsuBPCz.exe
  2⤵
  PID:6816
- C:\Windows\System\TBQpEdk.exe
  C:\Windows\System\TBQpEdk.exe
  2⤵
  PID:6848
- C:\Windows\System\xmvdmSu.exe
  C:\Windows\System\xmvdmSu.exe
  2⤵
  PID:6880
- C:\Windows\System\GkHMEjK.exe
  C:\Windows\System\GkHMEjK.exe
  2⤵
  PID:6900
- C:\Windows\System\ZMOIgCw.exe
  C:\Windows\System\ZMOIgCw.exe
  2⤵
  PID:6928
- C:\Windows\System\YwIpydK.exe
  C:\Windows\System\YwIpydK.exe
  2⤵
  PID:6968
- C:\Windows\System\tlcUBKq.exe
  C:\Windows\System\tlcUBKq.exe
  2⤵
  PID:7000
- C:\Windows\System\xmJRScy.exe
  C:\Windows\System\xmJRScy.exe
  2⤵
  PID:7032
- C:\Windows\System\qwNWnjR.exe
  C:\Windows\System\qwNWnjR.exe
  2⤵
  PID:7060
- C:\Windows\System\msiCPNP.exe
  C:\Windows\System\msiCPNP.exe
  2⤵
  PID:7092
- C:\Windows\System\QJEvvzs.exe
  C:\Windows\System\QJEvvzs.exe
  2⤵
  PID:7124
- C:\Windows\System\ICmQoRs.exe
  C:\Windows\System\ICmQoRs.exe
  2⤵
  PID:7148
- C:\Windows\System\DncgDqa.exe
  C:\Windows\System\DncgDqa.exe
  2⤵
  PID:6100
- C:\Windows\System\rgeCJCH.exe
  C:\Windows\System\rgeCJCH.exe
  2⤵
  PID:6180
- C:\Windows\System\EXXLZMz.exe
  C:\Windows\System\EXXLZMz.exe
  2⤵
  PID:6224
- C:\Windows\System\cBZgenS.exe
  C:\Windows\System\cBZgenS.exe
  2⤵
  PID:6280
- C:\Windows\System\jIIJBVb.exe
  C:\Windows\System\jIIJBVb.exe
  2⤵
  PID:6404
- C:\Windows\System\SQZJXMx.exe
  C:\Windows\System\SQZJXMx.exe
  2⤵
  PID:6424
- C:\Windows\System\kfHiafC.exe
  C:\Windows\System\kfHiafC.exe
  2⤵
  PID:6512
- C:\Windows\System\jRrrzQf.exe
  C:\Windows\System\jRrrzQf.exe
  2⤵
  PID:6568
- C:\Windows\System\RqxYuST.exe
  C:\Windows\System\RqxYuST.exe
  2⤵
  PID:6640
- C:\Windows\System\oEWZIlG.exe
  C:\Windows\System\oEWZIlG.exe
  2⤵
  PID:6672
- C:\Windows\System\eEagwsf.exe
  C:\Windows\System\eEagwsf.exe
  2⤵
  PID:6668
- C:\Windows\System\goVacAV.exe
  C:\Windows\System\goVacAV.exe
  2⤵
  PID:6836
- C:\Windows\System\sXhoQzQ.exe
  C:\Windows\System\sXhoQzQ.exe
  2⤵
  PID:6912
- C:\Windows\System\eEZXMkr.exe
  C:\Windows\System\eEZXMkr.exe
  2⤵
  PID:6916
- C:\Windows\System\OdiSNrI.exe
  C:\Windows\System\OdiSNrI.exe
  2⤵
  PID:6940
- C:\Windows\System\WWqjyYH.exe
  C:\Windows\System\WWqjyYH.exe
  2⤵
  PID:7056
- C:\Windows\System\JhZWtki.exe
  C:\Windows\System\JhZWtki.exe
  2⤵
  PID:3948
- C:\Windows\System\gGXSwAm.exe
  C:\Windows\System\gGXSwAm.exe
  2⤵
  PID:7136
- C:\Windows\System\WvIdXHb.exe
  C:\Windows\System\WvIdXHb.exe
  2⤵
  PID:6164
- C:\Windows\System\WEzpeQX.exe
  C:\Windows\System\WEzpeQX.exe
  2⤵
  PID:6496
- C:\Windows\System\zrrGaFB.exe
  C:\Windows\System\zrrGaFB.exe
  2⤵
  PID:6688
- C:\Windows\System\awogXTc.exe
  C:\Windows\System\awogXTc.exe
  2⤵
  PID:6788
- C:\Windows\System\ZkrBvyV.exe
  C:\Windows\System\ZkrBvyV.exe
  2⤵
  PID:6960
- C:\Windows\System\VRoSQxD.exe
  C:\Windows\System\VRoSQxD.exe
  2⤵
  PID:3456
- C:\Windows\System\bpbKUvS.exe
  C:\Windows\System\bpbKUvS.exe
  2⤵
  PID:6324
- C:\Windows\System\OHJAEDl.exe
  C:\Windows\System\OHJAEDl.exe
  2⤵
  PID:6316
- C:\Windows\System\RtOhhQx.exe
  C:\Windows\System\RtOhhQx.exe
  2⤵
  PID:6860
- C:\Windows\System\bcxwCFy.exe
  C:\Windows\System\bcxwCFy.exe
  2⤵
  PID:6872
- C:\Windows\System\wAVQXXf.exe
  C:\Windows\System\wAVQXXf.exe
  2⤵
  PID:7200
- C:\Windows\System\SvEpwZw.exe
  C:\Windows\System\SvEpwZw.exe
  2⤵
  PID:7228
- C:\Windows\System\pGwsSLg.exe
  C:\Windows\System\pGwsSLg.exe
  2⤵
  PID:7248
- C:\Windows\System\sHvCpRC.exe
  C:\Windows\System\sHvCpRC.exe
  2⤵
  PID:7284
- C:\Windows\System\lDEXpyt.exe
  C:\Windows\System\lDEXpyt.exe
  2⤵
  PID:7312
- C:\Windows\System\ppIeHtX.exe
  C:\Windows\System\ppIeHtX.exe
  2⤵
  PID:7340
- C:\Windows\System\nIYjaMR.exe
  C:\Windows\System\nIYjaMR.exe
  2⤵
  PID:7368
- C:\Windows\System\MEnJplW.exe
  C:\Windows\System\MEnJplW.exe
  2⤵
  PID:7388
- C:\Windows\System\MndmYiu.exe
  C:\Windows\System\MndmYiu.exe
  2⤵
  PID:7412
- C:\Windows\System\kMxbEqS.exe
  C:\Windows\System\kMxbEqS.exe
  2⤵
  PID:7452
- C:\Windows\System\QDsNBWF.exe
  C:\Windows\System\QDsNBWF.exe
  2⤵
  PID:7484
- C:\Windows\System\juftqjh.exe
  C:\Windows\System\juftqjh.exe
  2⤵
  PID:7504
- C:\Windows\System\SDpQzTZ.exe
  C:\Windows\System\SDpQzTZ.exe
  2⤵
  PID:7524
- C:\Windows\System\dhZPgXP.exe
  C:\Windows\System\dhZPgXP.exe
  2⤵
  PID:7556
- C:\Windows\System\nyQqDEG.exe
  C:\Windows\System\nyQqDEG.exe
  2⤵
  PID:7580
- C:\Windows\System\CAqBvdD.exe
  C:\Windows\System\CAqBvdD.exe
  2⤵
  PID:7612
- C:\Windows\System\gCBZoXh.exe
  C:\Windows\System\gCBZoXh.exe
  2⤵
  PID:7636
- C:\Windows\System\GngQIxB.exe
  C:\Windows\System\GngQIxB.exe
  2⤵
  PID:7668
- C:\Windows\System\ehaDFyJ.exe
  C:\Windows\System\ehaDFyJ.exe
  2⤵
  PID:7704
- C:\Windows\System\zsijajk.exe
  C:\Windows\System\zsijajk.exe
  2⤵
  PID:7732
- C:\Windows\System\EYLHDtQ.exe
  C:\Windows\System\EYLHDtQ.exe
  2⤵
  PID:7760
- C:\Windows\System\ZytBqmK.exe
  C:\Windows\System\ZytBqmK.exe
  2⤵
  PID:7776
- C:\Windows\System\nUqKptX.exe
  C:\Windows\System\nUqKptX.exe
  2⤵
  PID:7804
- C:\Windows\System\koUrLNq.exe
  C:\Windows\System\koUrLNq.exe
  2⤵
  PID:7828
- C:\Windows\System\jrVxeEm.exe
  C:\Windows\System\jrVxeEm.exe
  2⤵
  PID:7856
- C:\Windows\System\NGZSzUn.exe
  C:\Windows\System\NGZSzUn.exe
  2⤵
  PID:7884
- C:\Windows\System\gsnfbmT.exe
  C:\Windows\System\gsnfbmT.exe
  2⤵
  PID:7904
- C:\Windows\System\CdvDzkZ.exe
  C:\Windows\System\CdvDzkZ.exe
  2⤵
  PID:7932
- C:\Windows\System\DBkzkiR.exe
  C:\Windows\System\DBkzkiR.exe
  2⤵
  PID:7976
- C:\Windows\System\LrfoGUs.exe
  C:\Windows\System\LrfoGUs.exe
  2⤵
  PID:8000
- C:\Windows\System\pkiEFlT.exe
  C:\Windows\System\pkiEFlT.exe
  2⤵
  PID:8024
- C:\Windows\System\kuTvPEo.exe
  C:\Windows\System\kuTvPEo.exe
  2⤵
  PID:8056
- C:\Windows\System\LHCFZAm.exe
  C:\Windows\System\LHCFZAm.exe
  2⤵
  PID:8084
- C:\Windows\System\HnNVHok.exe
  C:\Windows\System\HnNVHok.exe
  2⤵
  PID:8112
- C:\Windows\System\TYzhTtX.exe
  C:\Windows\System\TYzhTtX.exe
  2⤵
  PID:8148
- C:\Windows\System\BCtfGau.exe
  C:\Windows\System\BCtfGau.exe
  2⤵
  PID:8180
- C:\Windows\System\rvSWEhH.exe
  C:\Windows\System\rvSWEhH.exe
  2⤵
  PID:6492
- C:\Windows\System\ccwpJtM.exe
  C:\Windows\System\ccwpJtM.exe
  2⤵
  PID:7176
- C:\Windows\System\diFEsco.exe
  C:\Windows\System\diFEsco.exe
  2⤵
  PID:7256
- C:\Windows\System\TaGuZpy.exe
  C:\Windows\System\TaGuZpy.exe
  2⤵
  PID:7328
- C:\Windows\System\HlxHuRo.exe
  C:\Windows\System\HlxHuRo.exe
  2⤵
  PID:7396
- C:\Windows\System\RuAyvTT.exe
  C:\Windows\System\RuAyvTT.exe
  2⤵
  PID:7468
- C:\Windows\System\wGTBxXK.exe
  C:\Windows\System\wGTBxXK.exe
  2⤵
  PID:7548
- C:\Windows\System\jYFkCmM.exe
  C:\Windows\System\jYFkCmM.exe
  2⤵
  PID:7568
- C:\Windows\System\MwIorjW.exe
  C:\Windows\System\MwIorjW.exe
  2⤵
  PID:7588
- C:\Windows\System\YQLLZqf.exe
  C:\Windows\System\YQLLZqf.exe
  2⤵
  PID:7744
- C:\Windows\System\KQJAAGm.exe
  C:\Windows\System\KQJAAGm.exe
  2⤵
  PID:7756
- C:\Windows\System\KmvWVBY.exe
  C:\Windows\System\KmvWVBY.exe
  2⤵
  PID:7880
- C:\Windows\System\SVRSgxE.exe
  C:\Windows\System\SVRSgxE.exe
  2⤵
  PID:7928
- C:\Windows\System\upnArjY.exe
  C:\Windows\System\upnArjY.exe
  2⤵
  PID:7944
- C:\Windows\System\NrnIxXG.exe
  C:\Windows\System\NrnIxXG.exe
  2⤵
  PID:8040
- C:\Windows\System\XrNwYBW.exe
  C:\Windows\System\XrNwYBW.exe
  2⤵
  PID:8100
- C:\Windows\System\uhZVTvS.exe
  C:\Windows\System\uhZVTvS.exe
  2⤵
  PID:8168
- C:\Windows\System\npgAqwu.exe
  C:\Windows\System\npgAqwu.exe
  2⤵
  PID:7236
- C:\Windows\System\BVquNCm.exe
  C:\Windows\System\BVquNCm.exe
  2⤵
  PID:7464
- C:\Windows\System\XWLJIKX.exe
  C:\Windows\System\XWLJIKX.exe
  2⤵
  PID:7476
- C:\Windows\System\ykrQWvj.exe
  C:\Windows\System\ykrQWvj.exe
  2⤵
  PID:7628
- C:\Windows\System\tgAwXHQ.exe
  C:\Windows\System\tgAwXHQ.exe
  2⤵
  PID:7748
- C:\Windows\System\NlzayLW.exe
  C:\Windows\System\NlzayLW.exe
  2⤵
  PID:7992
- C:\Windows\System\IvOnjVZ.exe
  C:\Windows\System\IvOnjVZ.exe
  2⤵
  PID:8052
- C:\Windows\System\HUJDIhV.exe
  C:\Windows\System\HUJDIhV.exe
  2⤵
  PID:7272
- C:\Windows\System\cXSuhdC.exe
  C:\Windows\System\cXSuhdC.exe
  2⤵
  PID:7600
- C:\Windows\System\uAYZzMT.exe
  C:\Windows\System\uAYZzMT.exe
  2⤵
  PID:7964
- C:\Windows\System\qDexZlk.exe
  C:\Windows\System\qDexZlk.exe
  2⤵
  PID:7356
- C:\Windows\System\CIdMAls.exe
  C:\Windows\System\CIdMAls.exe
  2⤵
  PID:8208
- C:\Windows\System\tAABoib.exe
  C:\Windows\System\tAABoib.exe
  2⤵
  PID:8252
- C:\Windows\System\eOwTVnO.exe
  C:\Windows\System\eOwTVnO.exe
  2⤵
  PID:8272
- C:\Windows\System\XepfpQE.exe
  C:\Windows\System\XepfpQE.exe
  2⤵
  PID:8296
- C:\Windows\System\BmRdvtO.exe
  C:\Windows\System\BmRdvtO.exe
  2⤵
  PID:8336
- C:\Windows\System\PNdeRRd.exe
  C:\Windows\System\PNdeRRd.exe
  2⤵
  PID:8356
- C:\Windows\System\jdUrpDV.exe
  C:\Windows\System\jdUrpDV.exe
  2⤵
  PID:8384
- C:\Windows\System\RGJBoBo.exe
  C:\Windows\System\RGJBoBo.exe
  2⤵
  PID:8408
- C:\Windows\System\DlzHNQB.exe
  C:\Windows\System\DlzHNQB.exe
  2⤵
  PID:8440
- C:\Windows\System\nmLcBMo.exe
  C:\Windows\System\nmLcBMo.exe
  2⤵
  PID:8476
- C:\Windows\System\pQakxmB.exe
  C:\Windows\System\pQakxmB.exe
  2⤵
  PID:8504
- C:\Windows\System\PvzwuER.exe
  C:\Windows\System\PvzwuER.exe
  2⤵
  PID:8536
- C:\Windows\System\vtBMgKq.exe
  C:\Windows\System\vtBMgKq.exe
  2⤵
  PID:8560
- C:\Windows\System\MrcndmG.exe
  C:\Windows\System\MrcndmG.exe
  2⤵
  PID:8588
- C:\Windows\System\QieTtXR.exe
  C:\Windows\System\QieTtXR.exe
  2⤵
  PID:8604
- C:\Windows\System\oWQJhel.exe
  C:\Windows\System\oWQJhel.exe
  2⤵
  PID:8636
- C:\Windows\System\bsFfPem.exe
  C:\Windows\System\bsFfPem.exe
  2⤵
  PID:8672
- C:\Windows\System\QBjOemA.exe
  C:\Windows\System\QBjOemA.exe
  2⤵
  PID:8688
- C:\Windows\System\soMbkVc.exe
  C:\Windows\System\soMbkVc.exe
  2⤵
  PID:8716
- C:\Windows\System\BVZZOVU.exe
  C:\Windows\System\BVZZOVU.exe
  2⤵
  PID:8732
- C:\Windows\System\aYTxWgU.exe
  C:\Windows\System\aYTxWgU.exe
  2⤵
  PID:8764
- C:\Windows\System\hVGkyUb.exe
  C:\Windows\System\hVGkyUb.exe
  2⤵
  PID:8788
- C:\Windows\System\BVWyEnM.exe
  C:\Windows\System\BVWyEnM.exe
  2⤵
  PID:8820
- C:\Windows\System\nfxcshw.exe
  C:\Windows\System\nfxcshw.exe
  2⤵
  PID:8840
- C:\Windows\System\VazuGlG.exe
  C:\Windows\System\VazuGlG.exe
  2⤵
  PID:8868
- C:\Windows\System\ouYCUsy.exe
  C:\Windows\System\ouYCUsy.exe
  2⤵
  PID:8900
- C:\Windows\System\EoGcbTo.exe
  C:\Windows\System\EoGcbTo.exe
  2⤵
  PID:8944
- C:\Windows\System\cBzGRvt.exe
  C:\Windows\System\cBzGRvt.exe
  2⤵
  PID:8980
- C:\Windows\System\KBzWTRp.exe
  C:\Windows\System\KBzWTRp.exe
  2⤵
  PID:8996
- C:\Windows\System\hhWoXyU.exe
  C:\Windows\System\hhWoXyU.exe
  2⤵
  PID:9032
- C:\Windows\System\QDIEifp.exe
  C:\Windows\System\QDIEifp.exe
  2⤵
  PID:9056
- C:\Windows\System\rQfjPAZ.exe
  C:\Windows\System\rQfjPAZ.exe
  2⤵
  PID:9092
- C:\Windows\System\uSSpMWU.exe
  C:\Windows\System\uSSpMWU.exe
  2⤵
  PID:9108
- C:\Windows\System\JVVbCnd.exe
  C:\Windows\System\JVVbCnd.exe
  2⤵
  PID:9136
- C:\Windows\System\TkkTVcT.exe
  C:\Windows\System\TkkTVcT.exe
  2⤵
  PID:9176
- C:\Windows\System\tdPsZeh.exe
  C:\Windows\System\tdPsZeh.exe
  2⤵
  PID:9204
- C:\Windows\System\QhSXrUc.exe
  C:\Windows\System\QhSXrUc.exe
  2⤵
  PID:7796
- C:\Windows\System\QslFCqT.exe
  C:\Windows\System\QslFCqT.exe
  2⤵
  PID:8240
- C:\Windows\System\whDiDaw.exe
  C:\Windows\System\whDiDaw.exe
  2⤵
  PID:8308
- C:\Windows\System\iocTLmP.exe
  C:\Windows\System\iocTLmP.exe
  2⤵
  PID:8372
- C:\Windows\System\RhFSruv.exe
  C:\Windows\System\RhFSruv.exe
  2⤵
  PID:8424
- C:\Windows\System\cOFbWNV.exe
  C:\Windows\System\cOFbWNV.exe
  2⤵
  PID:8516
- C:\Windows\System\KCsCaix.exe
  C:\Windows\System\KCsCaix.exe
  2⤵
  PID:8576
- C:\Windows\System\SeDdKZb.exe
  C:\Windows\System\SeDdKZb.exe
  2⤵
  PID:8660
- C:\Windows\System\rjhiKcY.exe
  C:\Windows\System\rjhiKcY.exe
  2⤵
  PID:8684
- C:\Windows\System\CFnevIB.exe
  C:\Windows\System\CFnevIB.exe
  2⤵
  PID:8784
- C:\Windows\System\lEbySfZ.exe
  C:\Windows\System\lEbySfZ.exe
  2⤵
  PID:8780
- C:\Windows\System\QzjKgSb.exe
  C:\Windows\System\QzjKgSb.exe
  2⤵
  PID:8864
- C:\Windows\System\TTcpmGN.exe
  C:\Windows\System\TTcpmGN.exe
  2⤵
  PID:8968
- C:\Windows\System\uEPsNSh.exe
  C:\Windows\System\uEPsNSh.exe
  2⤵
  PID:9020
- C:\Windows\System\JXVprLP.exe
  C:\Windows\System\JXVprLP.exe
  2⤵
  PID:9044
- C:\Windows\System\rjJqbML.exe
  C:\Windows\System\rjJqbML.exe
  2⤵
  PID:9144
- C:\Windows\System\YYnnMZm.exe
  C:\Windows\System\YYnnMZm.exe
  2⤵
  PID:8196
- C:\Windows\System\VAwIJeZ.exe
  C:\Windows\System\VAwIJeZ.exe
  2⤵
  PID:8316
- C:\Windows\System\nQAJcex.exe
  C:\Windows\System\nQAJcex.exe
  2⤵
  PID:8472
- C:\Windows\System\QuhoJfk.exe
  C:\Windows\System\QuhoJfk.exe
  2⤵
  PID:8620
- C:\Windows\System\bpcUWDq.exe
  C:\Windows\System\bpcUWDq.exe
  2⤵
  PID:8700
- C:\Windows\System\PbZwWKC.exe
  C:\Windows\System\PbZwWKC.exe
  2⤵
  PID:8960
- C:\Windows\System\CYAXTLS.exe
  C:\Windows\System\CYAXTLS.exe
  2⤵
  PID:9080
- C:\Windows\System\mGgtajN.exe
  C:\Windows\System\mGgtajN.exe
  2⤵
  PID:9192
- C:\Windows\System\xtufyuX.exe
  C:\Windows\System\xtufyuX.exe
  2⤵
  PID:7604
- C:\Windows\System\hgidRCQ.exe
  C:\Windows\System\hgidRCQ.exe
  2⤵
  PID:8644
- C:\Windows\System\XrZCDOG.exe
  C:\Windows\System\XrZCDOG.exe
  2⤵
  PID:9040
- C:\Windows\System\psRtatx.exe
  C:\Windows\System\psRtatx.exe
  2⤵
  PID:8812
- C:\Windows\System\qTpQuFX.exe
  C:\Windows\System\qTpQuFX.exe
  2⤵
  PID:9232
- C:\Windows\System\KPlJGjm.exe
  C:\Windows\System\KPlJGjm.exe
  2⤵
  PID:9260
- C:\Windows\System\pbCDGTj.exe
  C:\Windows\System\pbCDGTj.exe
  2⤵
  PID:9292
- C:\Windows\System\oObMWQM.exe
  C:\Windows\System\oObMWQM.exe
  2⤵
  PID:9316
- C:\Windows\System\zPgmDFj.exe
  C:\Windows\System\zPgmDFj.exe
  2⤵
  PID:9340
- C:\Windows\System\EBWikXY.exe
  C:\Windows\System\EBWikXY.exe
  2⤵
  PID:9372
- C:\Windows\System\ZWUPtVE.exe
  C:\Windows\System\ZWUPtVE.exe
  2⤵
  PID:9400
- C:\Windows\System\ehDURVa.exe
  C:\Windows\System\ehDURVa.exe
  2⤵
  PID:9424
- C:\Windows\System\RUGAjFD.exe
  C:\Windows\System\RUGAjFD.exe
  2⤵
  PID:9456
- C:\Windows\System\wFvkpjh.exe
  C:\Windows\System\wFvkpjh.exe
  2⤵
  PID:9484
- C:\Windows\System\DQeRIJk.exe
  C:\Windows\System\DQeRIJk.exe
  2⤵
  PID:9516
- C:\Windows\System\hDfkmiv.exe
  C:\Windows\System\hDfkmiv.exe
  2⤵
  PID:9532
- C:\Windows\System\YxfoLWh.exe
  C:\Windows\System\YxfoLWh.exe
  2⤵
  PID:9556
- C:\Windows\System\OZagrMX.exe
  C:\Windows\System\OZagrMX.exe
  2⤵
  PID:9588
- C:\Windows\System\hqcBddi.exe
  C:\Windows\System\hqcBddi.exe
  2⤵
  PID:9616
- C:\Windows\System\aNSIGHo.exe
  C:\Windows\System\aNSIGHo.exe
  2⤵
  PID:9648
- C:\Windows\System\lPoLPMt.exe
  C:\Windows\System\lPoLPMt.exe
  2⤵
  PID:9680
- C:\Windows\System\LFTovbH.exe
  C:\Windows\System\LFTovbH.exe
  2⤵
  PID:9704
- C:\Windows\System\WdvWOrX.exe
  C:\Windows\System\WdvWOrX.exe
  2⤵
  PID:9732
- C:\Windows\System\CqwrfNy.exe
  C:\Windows\System\CqwrfNy.exe
  2⤵
  PID:9760
- C:\Windows\System\oecrsOA.exe
  C:\Windows\System\oecrsOA.exe
  2⤵
  PID:9780
- C:\Windows\System\XkJQoja.exe
  C:\Windows\System\XkJQoja.exe
  2⤵
  PID:9808
- C:\Windows\System\OuNTirr.exe
  C:\Windows\System\OuNTirr.exe
  2⤵
  PID:9832
- C:\Windows\System\SonBcRi.exe
  C:\Windows\System\SonBcRi.exe
  2⤵
  PID:9856
- C:\Windows\System\xUlALwc.exe
  C:\Windows\System\xUlALwc.exe
  2⤵
  PID:9888
- C:\Windows\System\TEMFITw.exe
  C:\Windows\System\TEMFITw.exe
  2⤵
  PID:9912
- C:\Windows\System\liWQmgo.exe
  C:\Windows\System\liWQmgo.exe
  2⤵
  PID:9944
- C:\Windows\System\xiLflYA.exe
  C:\Windows\System\xiLflYA.exe
  2⤵
  PID:9972
- C:\Windows\System\mzsjtZV.exe
  C:\Windows\System\mzsjtZV.exe
  2⤵
  PID:10000
- C:\Windows\System\tsMKQuS.exe
  C:\Windows\System\tsMKQuS.exe
  2⤵
  PID:10040
- C:\Windows\System\qiMuAGd.exe
  C:\Windows\System\qiMuAGd.exe
  2⤵
  PID:10064
- C:\Windows\System\XwEHNwi.exe
  C:\Windows\System\XwEHNwi.exe
  2⤵
  PID:10088
- C:\Windows\System\DKiaorM.exe
  C:\Windows\System\DKiaorM.exe
  2⤵
  PID:10116
- C:\Windows\System\AtngXqe.exe
  C:\Windows\System\AtngXqe.exe
  2⤵
  PID:10144
- C:\Windows\System\EbTjlyu.exe
  C:\Windows\System\EbTjlyu.exe
  2⤵
  PID:10172
- C:\Windows\System\TZZSwTR.exe
  C:\Windows\System\TZZSwTR.exe
  2⤵
  PID:10196
- C:\Windows\System\ZpPQEHo.exe
  C:\Windows\System\ZpPQEHo.exe
  2⤵
  PID:10228
- C:\Windows\System\eEquUdw.exe
  C:\Windows\System\eEquUdw.exe
  2⤵
  PID:9220
- C:\Windows\System\WMVmLHR.exe
  C:\Windows\System\WMVmLHR.exe
  2⤵
  PID:9308
- C:\Windows\System\dxcfnIK.exe
  C:\Windows\System\dxcfnIK.exe
  2⤵
  PID:9328
- C:\Windows\System\iyhihNT.exe
  C:\Windows\System\iyhihNT.exe
  2⤵
  PID:9468
- C:\Windows\System\JVorcUm.exe
  C:\Windows\System\JVorcUm.exe
  2⤵
  PID:9496
- C:\Windows\System\sdmHOKd.exe
  C:\Windows\System\sdmHOKd.exe
  2⤵
  PID:9540
- C:\Windows\System\oxwIPvQ.exe
  C:\Windows\System\oxwIPvQ.exe
  2⤵
  PID:9612
- C:\Windows\System\XMrrpim.exe
  C:\Windows\System\XMrrpim.exe
  2⤵
  PID:9724
- C:\Windows\System\TNzVJJp.exe
  C:\Windows\System\TNzVJJp.exe
  2⤵
  PID:9752
- C:\Windows\System\vkZhgKP.exe
  C:\Windows\System\vkZhgKP.exe
  2⤵
  PID:9848
- C:\Windows\System\HiZYfzR.exe
  C:\Windows\System\HiZYfzR.exe
  2⤵
  PID:9868
- C:\Windows\System\GaLNEcp.exe
  C:\Windows\System\GaLNEcp.exe
  2⤵
  PID:9928
- C:\Windows\System\bpQXxxu.exe
  C:\Windows\System\bpQXxxu.exe
  2⤵
  PID:9992
- C:\Windows\System\uVJiNwg.exe
  C:\Windows\System\uVJiNwg.exe
  2⤵
  PID:10080
- C:\Windows\System\BQrxTpp.exe
  C:\Windows\System\BQrxTpp.exe
  2⤵
  PID:10192
- C:\Windows\System\WtbkXDu.exe
  C:\Windows\System\WtbkXDu.exe
  2⤵
  PID:9272
- C:\Windows\System\FkbQVDB.exe
  C:\Windows\System\FkbQVDB.exe
  2⤵
  PID:9388
- C:\Windows\System\TfeNPNX.exe
  C:\Windows\System\TfeNPNX.exe
  2⤵
  PID:9444
- C:\Windows\System\WkIqUFn.exe
  C:\Windows\System\WkIqUFn.exe
  2⤵
  PID:9628
- C:\Windows\System\vJUELRf.exe
  C:\Windows\System\vJUELRf.exe
  2⤵
  PID:9804
- C:\Windows\System\TYkfDKZ.exe
  C:\Windows\System\TYkfDKZ.exe
  2⤵
  PID:9844
- C:\Windows\System\XlTiTsO.exe
  C:\Windows\System\XlTiTsO.exe
  2⤵
  PID:10084
- C:\Windows\System\WdZYuTm.exe
  C:\Windows\System\WdZYuTm.exe
  2⤵
  PID:10100
- C:\Windows\System\OgLSTYU.exe
  C:\Windows\System\OgLSTYU.exe
  2⤵
  PID:9360
- C:\Windows\System\pYaxvtl.exe
  C:\Windows\System\pYaxvtl.exe
  2⤵
  PID:9576
- C:\Windows\System\Gjeorfn.exe
  C:\Windows\System\Gjeorfn.exe
  2⤵
  PID:10032
- C:\Windows\System\ZrdluFa.exe
  C:\Windows\System\ZrdluFa.exe
  2⤵
  PID:10256
- C:\Windows\System\dvZlQjs.exe
  C:\Windows\System\dvZlQjs.exe
  2⤵
  PID:10284
- C:\Windows\System\XzsIbsB.exe
  C:\Windows\System\XzsIbsB.exe
  2⤵
  PID:10312
- C:\Windows\System\srxBqkE.exe
  C:\Windows\System\srxBqkE.exe
  2⤵
  PID:10332
- C:\Windows\System\IqRPgHx.exe
  C:\Windows\System\IqRPgHx.exe
  2⤵
  PID:10356
- C:\Windows\System\IfceSYM.exe
  C:\Windows\System\IfceSYM.exe
  2⤵
  PID:10380
- C:\Windows\System\MdXEkXi.exe
  C:\Windows\System\MdXEkXi.exe
  2⤵
  PID:10408
- C:\Windows\System\izfONIE.exe
  C:\Windows\System\izfONIE.exe
  2⤵
  PID:10428
- C:\Windows\System\szIqddA.exe
  C:\Windows\System\szIqddA.exe
  2⤵
  PID:10452
- C:\Windows\System\ezEHlfu.exe
  C:\Windows\System\ezEHlfu.exe
  2⤵
  PID:10492
- C:\Windows\System\USYwoOL.exe
  C:\Windows\System\USYwoOL.exe
  2⤵
  PID:10512
- C:\Windows\System\dFARdRn.exe
  C:\Windows\System\dFARdRn.exe
  2⤵
  PID:10536
- C:\Windows\System\qYiGfLr.exe
  C:\Windows\System\qYiGfLr.exe
  2⤵
  PID:10560
- C:\Windows\System\mUCngVV.exe
  C:\Windows\System\mUCngVV.exe
  2⤵
  PID:10584
- C:\Windows\System\KAMqiTa.exe
  C:\Windows\System\KAMqiTa.exe
  2⤵
  PID:10620
- C:\Windows\System\DjiFttc.exe
  C:\Windows\System\DjiFttc.exe
  2⤵
  PID:10652
- C:\Windows\System\ubvCOAB.exe
  C:\Windows\System\ubvCOAB.exe
  2⤵
  PID:10672
- C:\Windows\System\ipaHUjp.exe
  C:\Windows\System\ipaHUjp.exe
  2⤵
  PID:10696
- C:\Windows\System\eACULQN.exe
  C:\Windows\System\eACULQN.exe
  2⤵
  PID:10736
- C:\Windows\System\ZYYALmW.exe
  C:\Windows\System\ZYYALmW.exe
  2⤵
  PID:10760
- C:\Windows\System\eHnbBYN.exe
  C:\Windows\System\eHnbBYN.exe
  2⤵
  PID:10792
- C:\Windows\System\jWaTBsX.exe
  C:\Windows\System\jWaTBsX.exe
  2⤵
  PID:10812
- C:\Windows\System\hrFVypn.exe
  C:\Windows\System\hrFVypn.exe
  2⤵
  PID:10836
- C:\Windows\System\qbNquJX.exe
  C:\Windows\System\qbNquJX.exe
  2⤵
  PID:10860
- C:\Windows\System\LYHoGdf.exe
  C:\Windows\System\LYHoGdf.exe
  2⤵
  PID:10896
- C:\Windows\System\MXPrwxP.exe
  C:\Windows\System\MXPrwxP.exe
  2⤵
  PID:10920
- C:\Windows\System\TguYrDX.exe
  C:\Windows\System\TguYrDX.exe
  2⤵
  PID:10944
- C:\Windows\System\niEvLJA.exe
  C:\Windows\System\niEvLJA.exe
  2⤵
  PID:10964
- C:\Windows\System\teORdDY.exe
  C:\Windows\System\teORdDY.exe
  2⤵
  PID:10988
- C:\Windows\System\eTHgJAp.exe
  C:\Windows\System\eTHgJAp.exe
  2⤵
  PID:11012
- C:\Windows\System\cGxAWYd.exe
  C:\Windows\System\cGxAWYd.exe
  2⤵
  PID:11028
- C:\Windows\System\eNtdiQz.exe
  C:\Windows\System\eNtdiQz.exe
  2⤵
  PID:11056
- C:\Windows\System\ziLKioP.exe
  C:\Windows\System\ziLKioP.exe
  2⤵
  PID:11076
- C:\Windows\System\QCFsZiW.exe
  C:\Windows\System\QCFsZiW.exe
  2⤵
  PID:11108
- C:\Windows\System\DbPRsJS.exe
  C:\Windows\System\DbPRsJS.exe
  2⤵
  PID:11140
- C:\Windows\System\pkLDNBk.exe
  C:\Windows\System\pkLDNBk.exe
  2⤵
  PID:11168
- C:\Windows\System\NVOGULg.exe
  C:\Windows\System\NVOGULg.exe
  2⤵
  PID:11204
- C:\Windows\System\vEazZrN.exe
  C:\Windows\System\vEazZrN.exe
  2⤵
  PID:11228
- C:\Windows\System\bsmBuCG.exe
  C:\Windows\System\bsmBuCG.exe
  2⤵
  PID:11260
- C:\Windows\System\abCrQVM.exe
  C:\Windows\System\abCrQVM.exe
  2⤵
  PID:10276
- C:\Windows\System\yvRnjmq.exe
  C:\Windows\System\yvRnjmq.exe
  2⤵
  PID:10328
- C:\Windows\System\yfFvLTV.exe
  C:\Windows\System\yfFvLTV.exe
  2⤵
  PID:10344
- C:\Windows\System\iJweQDj.exe
  C:\Windows\System\iJweQDj.exe
  2⤵
  PID:10416
- C:\Windows\System\GyqTJej.exe
  C:\Windows\System\GyqTJej.exe
  2⤵
  PID:10532
- C:\Windows\System\IARgwfi.exe
  C:\Windows\System\IARgwfi.exe
  2⤵
  PID:10552
- C:\Windows\System\XAHEuUf.exe
  C:\Windows\System\XAHEuUf.exe
  2⤵
  PID:10608
- C:\Windows\System\TuTusDq.exe
  C:\Windows\System\TuTusDq.exe
  2⤵
  PID:10720
- C:\Windows\System\DRLhWvS.exe
  C:\Windows\System\DRLhWvS.exe
  2⤵
  PID:10852
- C:\Windows\System\eCUeLhi.exe
  C:\Windows\System\eCUeLhi.exe
  2⤵
  PID:10884
- C:\Windows\System\QBVOWFe.exe
  C:\Windows\System\QBVOWFe.exe
  2⤵
  PID:10872
- C:\Windows\System\UhrFwMS.exe
  C:\Windows\System\UhrFwMS.exe
  2⤵
  PID:11020
- C:\Windows\System\MJTJRpV.exe
  C:\Windows\System\MJTJRpV.exe
  2⤵
  PID:10984
- C:\Windows\System\GFOWjgJ.exe
  C:\Windows\System\GFOWjgJ.exe
  2⤵
  PID:11176
- C:\Windows\System\akBMlmZ.exe
  C:\Windows\System\akBMlmZ.exe
  2⤵
  PID:11064
- C:\Windows\System\zvWiJhO.exe
  C:\Windows\System\zvWiJhO.exe
  2⤵
  PID:11216
- C:\Windows\System\PaTuPXm.exe
  C:\Windows\System\PaTuPXm.exe
  2⤵
  PID:10340
- C:\Windows\System\IQRHGff.exe
  C:\Windows\System\IQRHGff.exe
  2⤵
  PID:9960
- C:\Windows\System\KuvCxNV.exe
  C:\Windows\System\KuvCxNV.exe
  2⤵
  PID:10476
- C:\Windows\System\HfJYDST.exe
  C:\Windows\System\HfJYDST.exe
  2⤵
  PID:10572
- C:\Windows\System\ZIwpaha.exe
  C:\Windows\System\ZIwpaha.exe
  2⤵
  PID:10784
- C:\Windows\System\BDyYSRJ.exe
  C:\Windows\System\BDyYSRJ.exe
  2⤵
  PID:10976
- C:\Windows\System\phXRXWS.exe
  C:\Windows\System\phXRXWS.exe
  2⤵
  PID:11156
- C:\Windows\System\XllGhrX.exe
  C:\Windows\System\XllGhrX.exe
  2⤵
  PID:10628
- C:\Windows\System\cuinLlS.exe
  C:\Windows\System\cuinLlS.exe
  2⤵
  PID:10956
- C:\Windows\System\ipyvYOG.exe
  C:\Windows\System\ipyvYOG.exe
  2⤵
  PID:11196
- C:\Windows\System\DPEoTnC.exe
  C:\Windows\System\DPEoTnC.exe
  2⤵
  PID:11284
- C:\Windows\System\wqhGCBz.exe
  C:\Windows\System\wqhGCBz.exe
  2⤵
  PID:11316
- C:\Windows\System\DFPepVI.exe
  C:\Windows\System\DFPepVI.exe
  2⤵
  PID:11340
- C:\Windows\System\iqqnewt.exe
  C:\Windows\System\iqqnewt.exe
  2⤵
  PID:11372
- C:\Windows\System\fgmIgjk.exe
  C:\Windows\System\fgmIgjk.exe
  2⤵
  PID:11400
- C:\Windows\System\LGrbNhU.exe
  C:\Windows\System\LGrbNhU.exe
  2⤵
  PID:11428
- C:\Windows\System\SkeBmyJ.exe
  C:\Windows\System\SkeBmyJ.exe
  2⤵
  PID:11460
- C:\Windows\System\ijSvQBZ.exe
  C:\Windows\System\ijSvQBZ.exe
  2⤵
  PID:11488
- C:\Windows\System\hqpzbor.exe
  C:\Windows\System\hqpzbor.exe
  2⤵
  PID:11508
- C:\Windows\System\eqHTuoz.exe
  C:\Windows\System\eqHTuoz.exe
  2⤵
  PID:11540
- C:\Windows\System\gVHkyde.exe
  C:\Windows\System\gVHkyde.exe
  2⤵
  PID:11568
- C:\Windows\System\txRotyw.exe
  C:\Windows\System\txRotyw.exe
  2⤵
  PID:11604
- C:\Windows\System\pgHNZto.exe
  C:\Windows\System\pgHNZto.exe
  2⤵
  PID:11636
- C:\Windows\System\hXNdJda.exe
  C:\Windows\System\hXNdJda.exe
  2⤵
  PID:11668
- C:\Windows\System\VrTROUt.exe
  C:\Windows\System\VrTROUt.exe
  2⤵
  PID:11692
- C:\Windows\System\drZbcpz.exe
  C:\Windows\System\drZbcpz.exe
  2⤵
  PID:11720
- C:\Windows\System\VwcFZJz.exe
  C:\Windows\System\VwcFZJz.exe
  2⤵
  PID:11756
- C:\Windows\System\lkRctVH.exe
  C:\Windows\System\lkRctVH.exe
  2⤵
  PID:11776
- C:\Windows\System\dNDVeNU.exe
  C:\Windows\System\dNDVeNU.exe
  2⤵
  PID:11800
- C:\Windows\System\oUlAbQN.exe
  C:\Windows\System\oUlAbQN.exe
  2⤵
  PID:11828
- C:\Windows\System\KkyXgDa.exe
  C:\Windows\System\KkyXgDa.exe
  2⤵
  PID:11844
- C:\Windows\System\VLsPoBV.exe
  C:\Windows\System\VLsPoBV.exe
  2⤵
  PID:11868
- C:\Windows\System\VUIZGph.exe
  C:\Windows\System\VUIZGph.exe
  2⤵
  PID:11900
- C:\Windows\System\fRlHTNt.exe
  C:\Windows\System\fRlHTNt.exe
  2⤵
  PID:11932
- C:\Windows\System\iCUnigt.exe
  C:\Windows\System\iCUnigt.exe
  2⤵
  PID:11952
- C:\Windows\System\DudFEzo.exe
  C:\Windows\System\DudFEzo.exe
  2⤵
  PID:11984
- C:\Windows\System\NMDBbKA.exe
  C:\Windows\System\NMDBbKA.exe
  2⤵
  PID:12004
- C:\Windows\System\LDhIiUh.exe
  C:\Windows\System\LDhIiUh.exe
  2⤵
  PID:12032
- C:\Windows\System\bxfsQsg.exe
  C:\Windows\System\bxfsQsg.exe
  2⤵
  PID:12056
- C:\Windows\System\ClmksNW.exe
  C:\Windows\System\ClmksNW.exe
  2⤵
  PID:12076
- C:\Windows\System\tRFIpbT.exe
  C:\Windows\System\tRFIpbT.exe
  2⤵
  PID:12112
- C:\Windows\System\IHHISBj.exe
  C:\Windows\System\IHHISBj.exe
  2⤵
  PID:12128
- C:\Windows\System\WBhrePh.exe
  C:\Windows\System\WBhrePh.exe
  2⤵
  PID:12164
- C:\Windows\System\DLYQCMe.exe
  C:\Windows\System\DLYQCMe.exe
  2⤵
  PID:12188
- C:\Windows\System\rmdKLgr.exe
  C:\Windows\System\rmdKLgr.exe
  2⤵
  PID:12212
- C:\Windows\System\YtDedRQ.exe
  C:\Windows\System\YtDedRQ.exe
  2⤵
  PID:12248
- C:\Windows\System\KITWsCo.exe
  C:\Windows\System\KITWsCo.exe
  2⤵
  PID:12284
- C:\Windows\System\XhmARVK.exe
  C:\Windows\System\XhmARVK.exe
  2⤵
  PID:11048
- C:\Windows\System\VqnYdOM.exe
  C:\Windows\System\VqnYdOM.exe
  2⤵
  PID:11300
- C:\Windows\System\eYgdAlx.exe
  C:\Windows\System\eYgdAlx.exe
  2⤵
  PID:11380
- C:\Windows\System\FMEaGeN.exe
  C:\Windows\System\FMEaGeN.exe
  2⤵
  PID:11456
- C:\Windows\System\HIxBrCQ.exe
  C:\Windows\System\HIxBrCQ.exe
  2⤵
  PID:11500
- C:\Windows\System\FsEKzSO.exe
  C:\Windows\System\FsEKzSO.exe
  2⤵
  PID:11556
- C:\Windows\System\nXmimkC.exe
  C:\Windows\System\nXmimkC.exe
  2⤵
  PID:11708
- C:\Windows\System\gZpntxU.exe
  C:\Windows\System\gZpntxU.exe
  2⤵
  PID:11740
- C:\Windows\System\BXaYcsK.exe
  C:\Windows\System\BXaYcsK.exe
  2⤵
  PID:11772
- C:\Windows\System\FlQWRmv.exe
  C:\Windows\System\FlQWRmv.exe
  2⤵
  PID:11920
- C:\Windows\System\fRNmbiv.exe
  C:\Windows\System\fRNmbiv.exe
  2⤵
  PID:11940
- C:\Windows\System\FnHluTQ.exe
  C:\Windows\System\FnHluTQ.exe
  2⤵
  PID:12084
- C:\Windows\System\yCwmhLW.exe
  C:\Windows\System\yCwmhLW.exe
  2⤵
  PID:12040
- C:\Windows\System\CsacDZd.exe
  C:\Windows\System\CsacDZd.exe
  2⤵
  PID:12140
- C:\Windows\System\JaUbnye.exe
  C:\Windows\System\JaUbnye.exe
  2⤵
  PID:12064
- C:\Windows\System\xVoXWET.exe
  C:\Windows\System\xVoXWET.exe
  2⤵
  PID:10668
- C:\Windows\System\pSZZWCp.exe
  C:\Windows\System\pSZZWCp.exe
  2⤵
  PID:10644
- C:\Windows\System\wFUcDCL.exe
  C:\Windows\System\wFUcDCL.exe
  2⤵
  PID:11332
- C:\Windows\System\jyjUStW.exe
  C:\Windows\System\jyjUStW.exe
  2⤵
  PID:11732
- C:\Windows\System\LHbtLPt.exe
  C:\Windows\System\LHbtLPt.exe
  2⤵
  PID:11676
- C:\Windows\System\AcTJpSE.exe
  C:\Windows\System\AcTJpSE.exe
  2⤵
  PID:11592
- C:\Windows\System\XaOPrSp.exe
  C:\Windows\System\XaOPrSp.exe
  2⤵
  PID:11504
- C:\Windows\System\mybiXBd.exe
  C:\Windows\System\mybiXBd.exe
  2⤵
  PID:12204
- C:\Windows\System\oAUCZcz.exe
  C:\Windows\System\oAUCZcz.exe
  2⤵
  PID:11476
- C:\Windows\System\UykowKC.exe
  C:\Windows\System\UykowKC.exe
  2⤵
  PID:12324
- C:\Windows\System\cuicpuG.exe
  C:\Windows\System\cuicpuG.exe
  2⤵
  PID:12344
- C:\Windows\System\vIuAFua.exe
  C:\Windows\System\vIuAFua.exe
  2⤵
  PID:12368
- C:\Windows\System\LWnYmxO.exe
  C:\Windows\System\LWnYmxO.exe
  2⤵
  PID:12392
- C:\Windows\System\agDvwOF.exe
  C:\Windows\System\agDvwOF.exe
  2⤵
  PID:12420
- C:\Windows\System\XBdiuKc.exe
  C:\Windows\System\XBdiuKc.exe
  2⤵
  PID:12464
- C:\Windows\System\jnrEJWZ.exe
  C:\Windows\System\jnrEJWZ.exe
  2⤵
  PID:12496
- C:\Windows\System\FglzUnH.exe
  C:\Windows\System\FglzUnH.exe
  2⤵
  PID:12524
- C:\Windows\System\oeHriad.exe
  C:\Windows\System\oeHriad.exe
  2⤵
  PID:12572
- C:\Windows\System\tJRpUSZ.exe
  C:\Windows\System\tJRpUSZ.exe
  2⤵
  PID:12600
- C:\Windows\System\iVGTVJG.exe
  C:\Windows\System\iVGTVJG.exe
  2⤵
  PID:12636
- C:\Windows\System\iFuInuN.exe
  C:\Windows\System\iFuInuN.exe
  2⤵
  PID:12668
- C:\Windows\System\kDDsKfw.exe
  C:\Windows\System\kDDsKfw.exe
  2⤵
  PID:12696
- C:\Windows\System\DDHLElI.exe
  C:\Windows\System\DDHLElI.exe
  2⤵
  PID:12720
- C:\Windows\System\sWoobTO.exe
  C:\Windows\System\sWoobTO.exe
  2⤵
  PID:12748
- C:\Windows\System\UzJWDlD.exe
  C:\Windows\System\UzJWDlD.exe
  2⤵
  PID:12772
- C:\Windows\System\bpqWRJE.exe
  C:\Windows\System\bpqWRJE.exe
  2⤵
  PID:12808
- C:\Windows\System\tzIbbQC.exe
  C:\Windows\System\tzIbbQC.exe
  2⤵
  PID:12836
- C:\Windows\System\GtxTwHw.exe
  C:\Windows\System\GtxTwHw.exe
  2⤵
  PID:12860
- C:\Windows\System\vPigqsy.exe
  C:\Windows\System\vPigqsy.exe
  2⤵
  PID:12888
- C:\Windows\System\ernHquh.exe
  C:\Windows\System\ernHquh.exe
  2⤵
  PID:12916
- C:\Windows\System\JlHJgXe.exe
  C:\Windows\System\JlHJgXe.exe
  2⤵
  PID:12944
- C:\Windows\System\pBSKemf.exe
  C:\Windows\System\pBSKemf.exe
  2⤵
  PID:12968
- C:\Windows\System\XsoCOVx.exe
  C:\Windows\System\XsoCOVx.exe
  2⤵
  PID:12992
- C:\Windows\System\XezfbWJ.exe
  C:\Windows\System\XezfbWJ.exe
  2⤵
  PID:13008
- C:\Windows\System\KqmebUQ.exe
  C:\Windows\System\KqmebUQ.exe
  2⤵
  PID:13032
- C:\Windows\System\twMJvBx.exe
  C:\Windows\System\twMJvBx.exe
  2⤵
  PID:13060
- C:\Windows\System\TaqgEBX.exe
  C:\Windows\System\TaqgEBX.exe
  2⤵
  PID:13084
- C:\Windows\System\ZWCmYzm.exe
  C:\Windows\System\ZWCmYzm.exe
  2⤵
  PID:13120
- C:\Windows\System\HZYedPT.exe
  C:\Windows\System\HZYedPT.exe
  2⤵
  PID:13148
- C:\Windows\System\UoXgncg.exe
  C:\Windows\System\UoXgncg.exe
  2⤵
  PID:13180
- C:\Windows\System\MtlLJgW.exe
  C:\Windows\System\MtlLJgW.exe
  2⤵
  PID:13216
- C:\Windows\System\OwTBHrQ.exe
  C:\Windows\System\OwTBHrQ.exe
  2⤵
  PID:13252
- C:\Windows\System\rcVVhNc.exe
  C:\Windows\System\rcVVhNc.exe
  2⤵
  PID:13272
- C:\Windows\System\KxKpUxH.exe
  C:\Windows\System\KxKpUxH.exe
  2⤵
  PID:13292
- C:\Windows\System\wNPfELq.exe
  C:\Windows\System\wNPfELq.exe
  2⤵
  PID:11816
- C:\Windows\System\PxHPczW.exe
  C:\Windows\System\PxHPczW.exe
  2⤵
  PID:11892
- C:\Windows\System\BLQsjSo.exe
  C:\Windows\System\BLQsjSo.exe
  2⤵
  PID:11860
- C:\Windows\System\raYnORq.exe
  C:\Windows\System\raYnORq.exe
  2⤵
  PID:12200
- C:\Windows\System\hnxzxWc.exe
  C:\Windows\System\hnxzxWc.exe
  2⤵
  PID:12356
- C:\Windows\System\tpSBwbn.exe
  C:\Windows\System\tpSBwbn.exe
  2⤵
  PID:12408
- C:\Windows\System\PpIrbJG.exe
  C:\Windows\System\PpIrbJG.exe
  2⤵
  PID:12456
- C:\Windows\System\MLcTpfo.exe
  C:\Windows\System\MLcTpfo.exe
  2⤵
  PID:12460
- C:\Windows\System\iRniJku.exe
  C:\Windows\System\iRniJku.exe
  2⤵
  PID:12596
- C:\Windows\System\iIpGsBw.exe
  C:\Windows\System\iIpGsBw.exe
  2⤵
  PID:12660
- C:\Windows\System\laQYPiA.exe
  C:\Windows\System\laQYPiA.exe
  2⤵
  PID:12616
- C:\Windows\System\kyDwhsQ.exe
  C:\Windows\System\kyDwhsQ.exe
  2⤵
  PID:12764
- C:\Windows\System\NFoSjnF.exe
  C:\Windows\System\NFoSjnF.exe
  2⤵
  PID:12820
- C:\Windows\System\Gnlvoba.exe
  C:\Windows\System\Gnlvoba.exe
  2⤵
  PID:12872
- C:\Windows\System\nqFcZYC.exe
  C:\Windows\System\nqFcZYC.exe
  2⤵
  PID:13048
- C:\Windows\System\HSwWBfw.exe
  C:\Windows\System\HSwWBfw.exe
  2⤵
  PID:13028
- C:\Windows\System\YiFwqoc.exe
  C:\Windows\System\YiFwqoc.exe
  2⤵
  PID:13024
- C:\Windows\System\tqGHxeN.exe
  C:\Windows\System\tqGHxeN.exe
  2⤵
  PID:13108
- C:\Windows\System\sYnqpKE.exe
  C:\Windows\System\sYnqpKE.exe
  2⤵
  PID:13080
- C:\Windows\System\vgpuNdp.exe
  C:\Windows\System\vgpuNdp.exe
  2⤵
  PID:12020
- C:\Windows\System\qkwCtnm.exe
  C:\Windows\System\qkwCtnm.exe
  2⤵
  PID:13264
- C:\Windows\System\RmUlkBS.exe
  C:\Windows\System\RmUlkBS.exe
  2⤵
  PID:11624
- C:\Windows\System\lNsXUbp.exe
  C:\Windows\System\lNsXUbp.exe
  2⤵
  PID:12360
- C:\Windows\System\rzbTtso.exe
  C:\Windows\System\rzbTtso.exe
  2⤵
  PID:12224
- C:\Windows\System\qZhlxrH.exe
  C:\Windows\System\qZhlxrH.exe
  2⤵
  PID:12804
- C:\Windows\System\tLjCimF.exe
  C:\Windows\System\tLjCimF.exe
  2⤵
  PID:13160
- C:\Windows\System\utqkfXI.exe
  C:\Windows\System\utqkfXI.exe
  2⤵
  PID:13176
- C:\Windows\System\HxrhhAv.exe
  C:\Windows\System\HxrhhAv.exe
  2⤵
  PID:12960
- C:\Windows\System\oVmbaVP.exe
  C:\Windows\System\oVmbaVP.exe
  2⤵
  PID:13332
- C:\Windows\System\njrnfbo.exe
  C:\Windows\System\njrnfbo.exe
  2⤵
  PID:13352
- C:\Windows\System\XxaFyFI.exe
  C:\Windows\System\XxaFyFI.exe
  2⤵
  PID:13388
- C:\Windows\System\xefRVLS.exe
  C:\Windows\System\xefRVLS.exe
  2⤵
  PID:13416
- C:\Windows\System\meewmFQ.exe
  C:\Windows\System\meewmFQ.exe
  2⤵
  PID:13452
- C:\Windows\System\BjSPFTq.exe
  C:\Windows\System\BjSPFTq.exe
  2⤵
  PID:13472
- C:\Windows\System\QPWSOKw.exe
  C:\Windows\System\QPWSOKw.exe
  2⤵
  PID:13492
- C:\Windows\System\nLnqULo.exe
  C:\Windows\System\nLnqULo.exe
  2⤵
  PID:13524
- C:\Windows\System\JGuoXvj.exe
  C:\Windows\System\JGuoXvj.exe
  2⤵
  PID:13552
- C:\Windows\System\vXeZTwP.exe
  C:\Windows\System\vXeZTwP.exe
  2⤵
  PID:13576
- C:\Windows\System\mSLaqUN.exe
  C:\Windows\System\mSLaqUN.exe
  2⤵
  PID:13592
- C:\Windows\System\FBrSYNu.exe
  C:\Windows\System\FBrSYNu.exe
  2⤵
  PID:13624
- C:\Windows\System\nkDyWDW.exe
  C:\Windows\System\nkDyWDW.exe
  2⤵
  PID:13648
- C:\Windows\System\avKZZrU.exe
  C:\Windows\System\avKZZrU.exe
  2⤵
  PID:13672
- C:\Windows\System\nTFhWFm.exe
  C:\Windows\System\nTFhWFm.exe
  2⤵
  PID:13700
- C:\Windows\System\kPmVuSb.exe
  C:\Windows\System\kPmVuSb.exe
  2⤵
  PID:13724
- C:\Windows\System\MwVDxZm.exe
  C:\Windows\System\MwVDxZm.exe
  2⤵
  PID:13756
- C:\Windows\System\PoXcxTQ.exe
  C:\Windows\System\PoXcxTQ.exe
  2⤵
  PID:13792
- C:\Windows\System\nkJKJeF.exe
  C:\Windows\System\nkJKJeF.exe
  2⤵
  PID:13808
- C:\Windows\System\zpGHcQp.exe
  C:\Windows\System\zpGHcQp.exe
  2⤵
  PID:13828
- C:\Windows\System\sqIMEar.exe
  C:\Windows\System\sqIMEar.exe
  2⤵
  PID:13852
- C:\Windows\System\PQKZNbS.exe
  C:\Windows\System\PQKZNbS.exe
  2⤵
  PID:13880
- C:\Windows\System\CicVFeQ.exe
  C:\Windows\System\CicVFeQ.exe
  2⤵
  PID:13912
- C:\Windows\System\smEGqfv.exe
  C:\Windows\System\smEGqfv.exe
  2⤵
  PID:13940
- C:\Windows\System\HeEcPgf.exe
  C:\Windows\System\HeEcPgf.exe
  2⤵
  PID:13964
- C:\Windows\System\NqRLPqT.exe
  C:\Windows\System\NqRLPqT.exe
  2⤵
  PID:13996
- C:\Windows\System\pvZbsku.exe
  C:\Windows\System\pvZbsku.exe
  2⤵
  PID:14020
- C:\Windows\System\bGFuNxe.exe
  C:\Windows\System\bGFuNxe.exe
  2⤵
  PID:14048
- C:\Windows\System\SJqTLtI.exe
  C:\Windows\System\SJqTLtI.exe
  2⤵
  PID:14068
- C:\Windows\System\mctFCDP.exe
  C:\Windows\System\mctFCDP.exe
  2⤵
  PID:14096
- C:\Windows\System\bvHvWUK.exe
  C:\Windows\System\bvHvWUK.exe
  2⤵
  PID:14116
- C:\Windows\System\DiVVVhl.exe
  C:\Windows\System\DiVVVhl.exe
  2⤵
  PID:14144
- C:\Windows\System\ygsJGwV.exe
  C:\Windows\System\ygsJGwV.exe
  2⤵
  PID:14176
- C:\Windows\System\JDALnjg.exe
  C:\Windows\System\JDALnjg.exe
  2⤵
  PID:14196
- C:\Windows\System\TItPBhq.exe
  C:\Windows\System\TItPBhq.exe
  2⤵
  PID:14220
- C:\Windows\System\cWNxNKD.exe
  C:\Windows\System\cWNxNKD.exe
  2⤵
  PID:14256
- C:\Windows\System\MtqsOgU.exe
  C:\Windows\System\MtqsOgU.exe
  2⤵
  PID:14288
- C:\Windows\System\YRgdsfN.exe
  C:\Windows\System\YRgdsfN.exe
  2⤵
  PID:14324
- C:\Windows\System\cHRhexG.exe
  C:\Windows\System\cHRhexG.exe
  2⤵
  PID:12504
- C:\Windows\System\wiYasrl.exe
  C:\Windows\System\wiYasrl.exe
  2⤵
  PID:13280
- C:\Windows\System\pwdQeeH.exe
  C:\Windows\System\pwdQeeH.exe
  2⤵
  PID:13396
- C:\Windows\System\GWZjIOK.exe
  C:\Windows\System\GWZjIOK.exe
  2⤵
  PID:12904
- C:\Windows\System\otkDOyS.exe
  C:\Windows\System\otkDOyS.exe
  2⤵
  PID:13304
- C:\Windows\System\moPoche.exe
  C:\Windows\System\moPoche.exe
  2⤵
  PID:13488
- C:\Windows\System\efGueEJ.exe
  C:\Windows\System\efGueEJ.exe
  2⤵
  PID:13468
- C:\Windows\System\JLauQUg.exe
  C:\Windows\System\JLauQUg.exe
  2⤵
  PID:13572
- C:\Windows\System\uVBNeHK.exe
  C:\Windows\System\uVBNeHK.exe
  2⤵
  PID:13620
- C:\Windows\System\QxbjQej.exe
  C:\Windows\System\QxbjQej.exe
  2⤵
  PID:13664
- C:\Windows\System\EDVEgth.exe
  C:\Windows\System\EDVEgth.exe
  2⤵
  PID:13956
- C:\Windows\System\BMHftAt.exe
  C:\Windows\System\BMHftAt.exe
  2⤵
  PID:13800
- C:\Windows\System\vWVUNTa.exe
  C:\Windows\System\vWVUNTa.exe
  2⤵
  PID:14036
- C:\Windows\System\RVkNhdl.exe
  C:\Windows\System\RVkNhdl.exe
  2⤵
  PID:13948
- C:\Windows\System\aNmZKvm.exe
  C:\Windows\System\aNmZKvm.exe
  2⤵
  PID:13988
- C:\Windows\System\EACOsio.exe
  C:\Windows\System\EACOsio.exe
  2⤵
  PID:14232
- C:\Windows\System\wnKuALY.exe
  C:\Windows\System\wnKuALY.exe
  2⤵
  PID:14252
- C:\Windows\System\IVKynjq.exe
  C:\Windows\System\IVKynjq.exe
  2⤵
  PID:14304
- C:\Windows\System\nervDCI.exe
  C:\Windows\System\nervDCI.exe
  2⤵
  PID:13328
- C:\Windows\System\ziyOeKk.exe
  C:\Windows\System\ziyOeKk.exe
  2⤵
  PID:13436
- C:\Windows\System\oggHiPl.exe
  C:\Windows\System\oggHiPl.exe
  2⤵
  PID:13104
- C:\Windows\System\rxJePGy.exe
  C:\Windows\System\rxJePGy.exe
  2⤵
  PID:12508
- C:\Windows\System\hiIudmm.exe
  C:\Windows\System\hiIudmm.exe
  2⤵
  PID:13640
- C:\Windows\System\blEdCqa.exe
  C:\Windows\System\blEdCqa.exe
  2⤵
  PID:13692
- C:\Windows\System\yvAEdBL.exe
  C:\Windows\System\yvAEdBL.exe
  2⤵
  PID:11912
- C:\Windows\System\BBPsTcH.exe
  C:\Windows\System\BBPsTcH.exe
  2⤵
  PID:13784
- C:\Windows\System\kpHaVkX.exe
  C:\Windows\System\kpHaVkX.exe
  2⤵
  PID:14184
- C:\Windows\System\KEKcvfy.exe
  C:\Windows\System\KEKcvfy.exe
  2⤵
  PID:14356
- C:\Windows\System\ppRQZKL.exe
  C:\Windows\System\ppRQZKL.exe
  2⤵
  PID:14380
- C:\Windows\System\IRJVrfq.exe
  C:\Windows\System\IRJVrfq.exe
  2⤵
  PID:14404
- C:\Windows\System\XaQmbzH.exe
  C:\Windows\System\XaQmbzH.exe
  2⤵
  PID:14432
- C:\Windows\System\YwEnQlH.exe
  C:\Windows\System\YwEnQlH.exe
  2⤵
  PID:14456
- C:\Windows\System\SLDRgwv.exe
  C:\Windows\System\SLDRgwv.exe
  2⤵
  PID:14480
- C:\Windows\System\BDbFsvI.exe
  C:\Windows\System\BDbFsvI.exe
  2⤵
  PID:14504
- C:\Windows\System\NadkxrN.exe
  C:\Windows\System\NadkxrN.exe
  2⤵
  PID:14528
- C:\Windows\System\VEFDetH.exe
  C:\Windows\System\VEFDetH.exe
  2⤵
  PID:14552
- C:\Windows\System\dYptxsQ.exe
  C:\Windows\System\dYptxsQ.exe
  2⤵
  PID:14588
- C:\Windows\System\WvCNHae.exe
  C:\Windows\System\WvCNHae.exe
  2⤵
  PID:14604
- C:\Windows\System\asrmrGX.exe
  C:\Windows\System\asrmrGX.exe
  2⤵
  PID:14632
- C:\Windows\System\xBRVaeA.exe
  C:\Windows\System\xBRVaeA.exe
  2⤵
  PID:14656
- C:\Windows\System\kyRqWiH.exe
  C:\Windows\System\kyRqWiH.exe
  2⤵
  PID:14684
- C:\Windows\System\wAAHdDZ.exe
  C:\Windows\System\wAAHdDZ.exe
  2⤵
  PID:14708
- C:\Windows\System\kfLaJxc.exe
  C:\Windows\System\kfLaJxc.exe
  2⤵
  PID:14732
- C:\Windows\System\uHLSqzh.exe
  C:\Windows\System\uHLSqzh.exe
  2⤵
  PID:14768
- C:\Windows\System\JVNCQve.exe
  C:\Windows\System\JVNCQve.exe
  2⤵
  PID:14796
- C:\Windows\System\ZXpVySx.exe
  C:\Windows\System\ZXpVySx.exe
  2⤵
  PID:14812
- C:\Windows\System\DxVKXOu.exe
  C:\Windows\System\DxVKXOu.exe
  2⤵
  PID:14844
- C:\Windows\System\ATzejBb.exe
  C:\Windows\System\ATzejBb.exe
  2⤵
  PID:14864
- C:\Windows\System\kioboBh.exe
  C:\Windows\System\kioboBh.exe
  2⤵
  PID:14884
- C:\Windows\System\mAZaOpl.exe
  C:\Windows\System\mAZaOpl.exe
  2⤵
  PID:14920
- C:\Windows\System\ZnZNCvB.exe
  C:\Windows\System\ZnZNCvB.exe
  2⤵
  PID:14940
- C:\Windows\System\RmXdwQS.exe
  C:\Windows\System\RmXdwQS.exe
  2⤵
  PID:14964
- C:\Windows\System\gZrqObF.exe
  C:\Windows\System\gZrqObF.exe
  2⤵
  PID:15000
- C:\Windows\System\ROHaqaC.exe
  C:\Windows\System\ROHaqaC.exe
  2⤵
  PID:15032
- C:\Windows\System\UEzKjWq.exe
  C:\Windows\System\UEzKjWq.exe
  2⤵
  PID:15052
- C:\Windows\System\VdpULjv.exe
  C:\Windows\System\VdpULjv.exe
  2⤵
  PID:15076
- C:\Windows\System\zEriKdo.exe
  C:\Windows\System\zEriKdo.exe
  2⤵
  PID:15096
- C:\Windows\System\VbHvIBw.exe
  C:\Windows\System\VbHvIBw.exe
  2⤵
  PID:15120
- C:\Windows\System\ZQVyMcH.exe
  C:\Windows\System\ZQVyMcH.exe
  2⤵
  PID:15152
- C:\Windows\System\SCoabSO.exe
  C:\Windows\System\SCoabSO.exe
  2⤵
  PID:15180
- C:\Windows\System\SYoHuDf.exe
  C:\Windows\System\SYoHuDf.exe
  2⤵
  PID:15220
- C:\Windows\System\DsHUFni.exe
  C:\Windows\System\DsHUFni.exe
  2⤵
  PID:15244
- C:\Windows\System\fikfpbE.exe
  C:\Windows\System\fikfpbE.exe
  2⤵
  PID:15280
- C:\Windows\System\OIGWyiU.exe
  C:\Windows\System\OIGWyiU.exe
  2⤵
  PID:15308
- C:\Windows\System\UEcFcpL.exe
  C:\Windows\System\UEcFcpL.exe
  2⤵
  PID:15328
- C:\Windows\System\PLgaCPK.exe
  C:\Windows\System\PLgaCPK.exe
  2⤵
  PID:15356
- C:\Windows\System\WDDociS.exe
  C:\Windows\System\WDDociS.exe
  2⤵
  PID:14284
- C:\Windows\System\djUuNQr.exe
  C:\Windows\System\djUuNQr.exe
  2⤵
  PID:14364
- C:\Windows\System\rQAMJtT.exe
  C:\Windows\System\rQAMJtT.exe
  2⤵
  PID:13644
- C:\Windows\System\BgnQZgI.exe
  C:\Windows\System\BgnQZgI.exe
  2⤵
  PID:15112
- C:\Windows\System\oQgQmCJ.exe
  C:\Windows\System\oQgQmCJ.exe
  2⤵
  PID:15140
- C:\Windows\System\cwUWrHL.exe
  C:\Windows\System\cwUWrHL.exe
  2⤵
  PID:15204
- C:\Windows\System\LGjKHbT.exe
  C:\Windows\System\LGjKHbT.exe
  2⤵
  PID:15296
- C:\Windows\System\TMOoXTo.exe
  C:\Windows\System\TMOoXTo.exe
  2⤵
  PID:15068
- C:\Windows\System\ifPpcEx.exe
  C:\Windows\System\ifPpcEx.exe
  2⤵
  PID:14960
- C:\Windows\System\USNxmnl.exe
  C:\Windows\System\USNxmnl.exe
  2⤵
  PID:15252
- C:\Windows\System\prdMiRL.exe
  C:\Windows\System\prdMiRL.exe
  2⤵
  PID:13000
- C:\Windows\System\DuKTlDl.exe
  C:\Windows\System\DuKTlDl.exe
  2⤵
  PID:15228
- C:\Windows\System\ORjXDIK.exe
  C:\Windows\System\ORjXDIK.exe
  2⤵
  PID:14188
- C:\Windows\System\EIcltRz.exe
  C:\Windows\System\EIcltRz.exe
  2⤵
  PID:14652
- C:\Windows\System\vkqinZj.exe
  C:\Windows\System\vkqinZj.exe
  2⤵
  PID:14780
- C:\Windows\System\TrHvhXA.exe
  C:\Windows\System\TrHvhXA.exe
  2⤵
  PID:14860
- C:\Windows\System\NlTYwVB.exe
  C:\Windows\System\NlTYwVB.exe
  2⤵
  PID:14928
- C:\Windows\System\YWQAZFg.exe
  C:\Windows\System\YWQAZFg.exe
  2⤵
  PID:15060
- C:\Windows\System\tAwhAcn.exe
  C:\Windows\System\tAwhAcn.exe
  2⤵
  PID:15264
- C:\Windows\System\IKkTPJI.exe
  C:\Windows\System\IKkTPJI.exe
  2⤵
  PID:15240
- C:\Windows\System\WTecVKn.exe
  C:\Windows\System\WTecVKn.exe
  2⤵
  PID:14560
- C:\Windows\System\CsbzBbX.exe
  C:\Windows\System\CsbzBbX.exe
  2⤵
  PID:14952
- C:\Windows\System\Sbvnyep.exe
  C:\Windows\System\Sbvnyep.exe
  2⤵
  PID:14340
- C:\Windows\System\fUChWnk.exe
  C:\Windows\System\fUChWnk.exe
  2⤵
  PID:15376
- C:\Windows\System\taJBrqL.exe
  C:\Windows\System\taJBrqL.exe
  2⤵
  PID:15400
- C:\Windows\System\adHtstn.exe
  C:\Windows\System\adHtstn.exe
  2⤵
  PID:15436
- C:\Windows\System\lpEoQNE.exe
  C:\Windows\System\lpEoQNE.exe
  2⤵
  PID:15452
- C:\Windows\System\HnCwoIh.exe
  C:\Windows\System\HnCwoIh.exe
  2⤵
  PID:15484
- C:\Windows\System\bPOBIAI.exe
  C:\Windows\System\bPOBIAI.exe
  2⤵
  PID:15504
- C:\Windows\System\MIPFaXU.exe
  C:\Windows\System\MIPFaXU.exe
  2⤵
  PID:15520
- C:\Windows\System\cVrOhNm.exe
  C:\Windows\System\cVrOhNm.exe
  2⤵
  PID:15540
- C:\Windows\System\GwzZRsK.exe
  C:\Windows\System\GwzZRsK.exe
  2⤵
  PID:15564
- C:\Windows\System\uAtcVfo.exe
  C:\Windows\System\uAtcVfo.exe
  2⤵
  PID:15588
- C:\Windows\System\GlgzlXw.exe
  C:\Windows\System\GlgzlXw.exe
  2⤵
  PID:15624
- C:\Windows\System\YhXtxWo.exe
  C:\Windows\System\YhXtxWo.exe
  2⤵
  PID:15652
- C:\Windows\System\jPnuorG.exe
  C:\Windows\System\jPnuorG.exe
  2⤵
  PID:15684
- C:\Windows\System\YDjOojC.exe
  C:\Windows\System\YDjOojC.exe
  2⤵
  PID:15712
- C:\Windows\System\xxPomtz.exe
  C:\Windows\System\xxPomtz.exe
  2⤵
  PID:15748
- C:\Windows\System\VmnhdyQ.exe
  C:\Windows\System\VmnhdyQ.exe
  2⤵
  PID:15764
- C:\Windows\System\eFNWaed.exe
  C:\Windows\System\eFNWaed.exe
  2⤵
  PID:15784
- C:\Windows\System\WselMBJ.exe
  C:\Windows\System\WselMBJ.exe
  2⤵
  PID:15804
- C:\Windows\System\zTLigNk.exe
  C:\Windows\System\zTLigNk.exe
  2⤵
  PID:15820
- C:\Windows\System\wGlTzxR.exe
  C:\Windows\System\wGlTzxR.exe
  2⤵
  PID:15844
- C:\Windows\System\rbmXKkx.exe
  C:\Windows\System\rbmXKkx.exe
  2⤵
  PID:15876
- C:\Windows\System\AYhcDgq.exe
  C:\Windows\System\AYhcDgq.exe
  2⤵
  PID:15904
- C:\Windows\System\ustTATY.exe
  C:\Windows\System\ustTATY.exe
  2⤵
  PID:15928
- C:\Windows\System\CAJNdxu.exe
  C:\Windows\System\CAJNdxu.exe
  2⤵
  PID:15964
- C:\Windows\System\PSOMTmM.exe
  C:\Windows\System\PSOMTmM.exe
  2⤵
  PID:15992
- C:\Windows\System\rBMFYii.exe
  C:\Windows\System\rBMFYii.exe
  2⤵
  PID:16024
- C:\Windows\System\PysIRZH.exe
  C:\Windows\System\PysIRZH.exe
  2⤵
  PID:16056
- C:\Windows\System\VOEiVDt.exe
  C:\Windows\System\VOEiVDt.exe
  2⤵
  PID:16076
- C:\Windows\System\YXDluzx.exe
  C:\Windows\System\YXDluzx.exe
  2⤵
  PID:16108
- C:\Windows\System\UQSTLeO.exe
  C:\Windows\System\UQSTLeO.exe
  2⤵
  PID:16132
- C:\Windows\System\YbLenoI.exe
  C:\Windows\System\YbLenoI.exe
  2⤵
  PID:16148
- C:\Windows\System\HHNxYjC.exe
  C:\Windows\System\HHNxYjC.exe
  2⤵
  PID:16172
- C:\Windows\System\usxLPjI.exe
  C:\Windows\System\usxLPjI.exe
  2⤵
  PID:16196
- C:\Windows\System\gzUDigU.exe
  C:\Windows\System\gzUDigU.exe
  2⤵
  PID:16220
- C:\Windows\System\ehsCYvZ.exe
  C:\Windows\System\ehsCYvZ.exe
  2⤵
  PID:16256
- C:\Windows\System\UQWrvHB.exe
  C:\Windows\System\UQWrvHB.exe
  2⤵
  PID:16288
- C:\Windows\System\HVSjPwh.exe
  C:\Windows\System\HVSjPwh.exe
  2⤵
  PID:16304
- C:\Windows\System\MOlaltG.exe
  C:\Windows\System\MOlaltG.exe
  2⤵
  PID:16332
- C:\Windows\System\MwyOgGe.exe
  C:\Windows\System\MwyOgGe.exe
  2⤵
  PID:16372
- C:\Windows\System\wbIZYAY.exe
  C:\Windows\System\wbIZYAY.exe
  2⤵
  PID:15260
- C:\Windows\System\abcWxJg.exe
  C:\Windows\System\abcWxJg.exe
  2⤵
  PID:14464
- C:\Windows\System\zUKbOGk.exe
  C:\Windows\System\zUKbOGk.exe
  2⤵
  PID:15396
- C:\Windows\System\MciCCIV.exe
  C:\Windows\System\MciCCIV.exe
  2⤵
  PID:15388
- C:\Windows\System\UIDWkKa.exe
  C:\Windows\System\UIDWkKa.exe
  2⤵
  PID:15492
- C:\Windows\System\klAnyet.exe
  C:\Windows\System\klAnyet.exe
  2⤵
  PID:15572
- C:\Windows\System\FeCrgqL.exe
  C:\Windows\System\FeCrgqL.exe
  2⤵
  PID:15672
- C:\Windows\System\YTtBsvb.exe
  C:\Windows\System\YTtBsvb.exe
  2⤵
  PID:15648
- C:\Windows\System\YFsFXLk.exe
  C:\Windows\System\YFsFXLk.exe
  2⤵
  PID:15708
- C:\Windows\System\oYlyUdn.exe
  C:\Windows\System\oYlyUdn.exe
  2⤵
  PID:15736
- C:\Windows\System\iZTtSet.exe
  C:\Windows\System\iZTtSet.exe
  2⤵
  PID:15892
- C:\Windows\System\ULnLkoT.exe
  C:\Windows\System\ULnLkoT.exe
  2⤵
  PID:15832
- C:\Windows\System\CwVygVr.exe
  C:\Windows\System\CwVygVr.exe
  2⤵
  PID:15920
- C:\Windows\System\aahkmtB.exe
  C:\Windows\System\aahkmtB.exe
  2⤵
  PID:16000
- C:\Windows\System\REYtRbX.exe
  C:\Windows\System\REYtRbX.exe
  2⤵
  PID:16188
- C:\Windows\System\kGnDtda.exe
  C:\Windows\System\kGnDtda.exe
  2⤵
  PID:16144
- C:\Windows\System\onUyUuu.exe
  C:\Windows\System\onUyUuu.exe
  2⤵
  PID:16268
- C:\Windows\System\RkElpwI.exe
  C:\Windows\System\RkElpwI.exe
  2⤵
  PID:16140
- C:\Windows\System\XrgQLAP.exe
  C:\Windows\System\XrgQLAP.exe
  2⤵
  PID:16320
- C:\Windows\System\keFYkHm.exe
  C:\Windows\System\keFYkHm.exe
  2⤵
  PID:15412
- C:\Windows\System\Scrvzgq.exe
  C:\Windows\System\Scrvzgq.exe
  2⤵
  PID:16300
- C:\Windows\System\qBJwGXO.exe
  C:\Windows\System\qBJwGXO.exe
  2⤵
  PID:15868
- C:\Windows\System\NxMbZNK.exe
  C:\Windows\System\NxMbZNK.exe
  2⤵
  PID:15796
- C:\Windows\System\tiIRSfz.exe
  C:\Windows\System\tiIRSfz.exe
  2⤵
  PID:15584
- C:\Windows\System\PxjdGsD.exe
  C:\Windows\System\PxjdGsD.exe
  2⤵
  PID:15816
- C:\Windows\System\vLePagf.exe
  C:\Windows\System\vLePagf.exe
  2⤵
  PID:16392
- C:\Windows\System\zKwjgEj.exe
  C:\Windows\System\zKwjgEj.exe
  2⤵
  PID:16412
- C:\Windows\System\CGRcBAt.exe
  C:\Windows\System\CGRcBAt.exe
  2⤵
  PID:16440
- C:\Windows\System\gVnlAmb.exe
  C:\Windows\System\gVnlAmb.exe
  2⤵
  PID:16456
- C:\Windows\System\nrbOPxf.exe
  C:\Windows\System\nrbOPxf.exe
  2⤵
  PID:16476
- C:\Windows\System\eLjCmXO.exe
  C:\Windows\System\eLjCmXO.exe
  2⤵
  PID:16512
- C:\Windows\System\BBTXHUM.exe
  C:\Windows\System\BBTXHUM.exe
  2⤵
  PID:16532
- C:\Windows\System\WqYrJOd.exe
  C:\Windows\System\WqYrJOd.exe
  2⤵
  PID:16564
- C:\Windows\System\iZjiDTV.exe
  C:\Windows\System\iZjiDTV.exe
  2⤵
  PID:16596
- C:\Windows\System\AknqEXy.exe
  C:\Windows\System\AknqEXy.exe
  2⤵
  PID:16620
- C:\Windows\System\KiKfQEM.exe
  C:\Windows\System\KiKfQEM.exe
  2⤵
  PID:16640
- C:\Windows\System\cPUydaq.exe
  C:\Windows\System\cPUydaq.exe
  2⤵
  PID:16664
- C:\Windows\System\tdNjXzC.exe
  C:\Windows\System\tdNjXzC.exe
  2⤵
  PID:16688
- C:\Windows\System\YHfoWWf.exe
  C:\Windows\System\YHfoWWf.exe
  2⤵
  PID:16724
- C:\Windows\System\yzebpZa.exe
  C:\Windows\System\yzebpZa.exe
  2⤵
  PID:16744
- C:\Windows\System\XUuFqvx.exe
  C:\Windows\System\XUuFqvx.exe
  2⤵
  PID:16768
- C:\Windows\System\vvuOSQS.exe
  C:\Windows\System\vvuOSQS.exe
  2⤵
  PID:16788
- C:\Windows\System\Tzbnhiv.exe
  C:\Windows\System\Tzbnhiv.exe
  2⤵
  PID:16824
- C:\Windows\System\jyabjZx.exe
  C:\Windows\System\jyabjZx.exe
  2⤵
  PID:16848
- C:\Windows\System\HLEhzSJ.exe
  C:\Windows\System\HLEhzSJ.exe
  2⤵
  PID:16884
- C:\Windows\System\yWIUhCp.exe
  C:\Windows\System\yWIUhCp.exe
  2⤵
  PID:16904
- C:\Windows\System\RcujrUI.exe
  C:\Windows\System\RcujrUI.exe
  2⤵
  PID:16936
- C:\Windows\System\FfBOrcc.exe
  C:\Windows\System\FfBOrcc.exe
  2⤵
  PID:16956
- C:\Windows\System\RILpqoq.exe
  C:\Windows\System\RILpqoq.exe
  2⤵
  PID:16984
- C:\Windows\System\KnyWFBx.exe
  C:\Windows\System\KnyWFBx.exe
  2⤵
  PID:17008
- C:\Windows\System\FyUwsxz.exe
  C:\Windows\System\FyUwsxz.exe
  2⤵
  PID:17040
- C:\Windows\System\EqiYTvy.exe
  C:\Windows\System\EqiYTvy.exe
  2⤵
  PID:17068
- C:\Windows\System\UQVXwuz.exe
  C:\Windows\System\UQVXwuz.exe
  2⤵
  PID:17096
- C:\Windows\System\gDhQYrN.exe
  C:\Windows\System\gDhQYrN.exe
  2⤵
  PID:17120
- C:\Windows\System\hvKKlBt.exe
  C:\Windows\System\hvKKlBt.exe
  2⤵
  PID:17340
- C:\Windows\System\wBwJdyM.exe
  C:\Windows\System\wBwJdyM.exe
  2⤵
  PID:17376
- C:\Windows\System\iTuLrXd.exe
  C:\Windows\System\iTuLrXd.exe
  2⤵
  PID:15856
- C:\Windows\System\hzRzLsv.exe
  C:\Windows\System\hzRzLsv.exe
  2⤵
  PID:15368
- C:\Windows\System\PeJiwnR.exe
  C:\Windows\System\PeJiwnR.exe
  2⤵
  PID:16296

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:17224

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\BikkCaD.exe

Filesize
1.7MB

MD5
c918cb6826d782122cf092421807724b

SHA1
994be0f7343cc38f7a8a9d964ef5ade79d90a5ca

SHA256
7e7635db4d253ed904f1aea28a5bf002b9e41f67ecea5d9601b94bb2355ff438

SHA512
9d5fe55cca3db32350f54d6e014687fa22e7f0a92aa55f8e6f47851de4d25bef1b97b6991084c4a3e0377afb399ff5275b0bf72a01522fbc82a59d1fb917202d

Download Submit
C:\Windows\System\CGdQxuU.exe

Filesize
1.7MB

MD5
f075a46a716163328e10cc41cda1b371

SHA1
303ca7d14a9145700509eaf8cd6ebffbc4ca65a0

SHA256
c5b2ed781f9369a340fbb124bc99a3ae78e7fcb5b168e461ff3a2e379c9f7201

SHA512
490e46781401074401f8bad590aa5ff8920260f0d90fde09f2d5703f7e9ae6a2220b1d5be3714fe738f3053466770d1f8e7535a4cb453bd1d100300e21b006f2

Download Submit
C:\Windows\System\JxwxYrI.exe

Filesize
1.7MB

MD5
a0fcfa469d393f51a49dcffcf5719965

SHA1
f71516463a6d0cfef66385707f7c70ad2dd3ee57

SHA256
71c72e1af78fe0fa6d5d2d5a15330a36229db2ed5d9e110d7e44553c51c83f84

SHA512
8d41b891a6e0b3433a6c340ea89530c2a5d94a56ef8afe4da4f9594a53fa2a2db6ec1ceaa8e56c80e56442bfba4d13594ecec91f5a49b1479c00082a5695bacd

Download Submit
C:\Windows\System\KjHREdt.exe

Filesize
1.7MB

MD5
59c80908afa3bac4218e909412088716

SHA1
52dea7eb393a1679ae1551fe7446192252ea61e9

SHA256
473a08c3075ced4fddb67a3cfdbd2bf4738b1874ae3488ca7364b5a256526257

SHA512
747655874e8c7547b5b0ebdb06637367003eccbe6a7073508b0108633c22d69e71ca7941406b8db587ba2c4a0ad67a46502fc3fdf4dda1a2329f51270cb5febb

Download Submit
C:\Windows\System\LgkQVBm.exe

Filesize
1.7MB

MD5
b94f17e8a553c9c57811539d49ec77c0

SHA1
200a2d64a95690fc0498b6f6582310141e1db010

SHA256
ab7fdf9b7205193f9e9c2401d28c44b3dee4cf2dc195ba2dd885655affa521f8

SHA512
d820e7e16e707247181cc705ae9ab593f3fe7571e300f98a08404af8de02aa2df1aeec92e66a39b9ad8858abf0dfedce0c7d13b135241355b1dbd3b5306e5062

Download Submit
C:\Windows\System\NPufQxM.exe

Filesize
1.7MB

MD5
d2e892cc70b66c390d698ead6cbfb9f1

SHA1
03efc0f2c3c723f18ab068364bf4c50ae885dd1d

SHA256
1f091acb5560bde7aceb25de07a4cfe11335c9106500ca7d7edb5b59fb5cb09f

SHA512
0db9dc81b7729eecc8e8949d67d83a6cac2506efa2ef8816dd52ca2ca6561e81a21f5aeb6330d84b8339ea8f95ce816755b9e75a3edcb320f1d4e09d8e588426

Download Submit
C:\Windows\System\NSfNRjE.exe

Filesize
1.7MB

MD5
a088f69c49f613789dbc6654ce5acc25

SHA1
c30dbc8780d8bd80aeaf8417ff57fbe0900b2012

SHA256
37e71b95e383fb1614442f2b8420e30a1a72d57857b6a0b9143dbcd7c390cfdb

SHA512
7b6f5745e0f56cc86ba08c010419377b342d34f68625a94966bc2a953b9dbe70e0a5a6a827827d728f920fc456c4085f68d7467053946b86945aae756c3eb381

Download Submit
C:\Windows\System\PymcorF.exe

Filesize
1.7MB

MD5
1448abf18bc5dd58593fed0cf7727900

SHA1
1733ce3b3a7111d860da292e6e5ed4e03767e5ba

SHA256
a9b4a44f5a6691c47a478ccb50da78f59e2b1fe75ec652c9d22578565d080787

SHA512
929d8d6f44b4ac5d2f367a4c6cba768ddf2668e6870b8048e7c2e8afdc73a8ac901a1264c60497bbfa3784ec6c164c382a6fcb5a5f6003bf30a72dc6e97c8cc8

Download Submit
C:\Windows\System\QHeRHKk.exe

Filesize
1.7MB

MD5
ebdf63d96474811f3f360d6697117fb9

SHA1
f3e0ba19bbe254735eacf4d8009b6cb36f85d997

SHA256
b629425cd61b0fdceb6b365bbec12a37c433051f4b0a9e1739160b6a35acbd18

SHA512
2644ae53868a4d277bd91539c6161a39717b9d61a8b1c6bb4f510e2030e5ab8d7d35618d06ad365a06ecd3bef387a32b394fab121c75cfbc358ba40901f362d7

Download Submit
C:\Windows\System\RImcBpW.exe

Filesize
1.7MB

MD5
23375c776b10e21e9979161dba6042fb

SHA1
ef145cfd4d4885d206386dc57cdcff5a1dae04c9

SHA256
db261405ee6e74f53eab584af8eccfa9c06d6dd5e72ac406c18404a941233a64

SHA512
132295a4457684ba206db4448cf35ad682faaef3eb4474a01e0e073f800f02720cde80a9238ffc707a726fec7a11b93bdd79339234059142429996d5dcc8985f

Download Submit
C:\Windows\System\SfsRFfV.exe

Filesize
1.7MB

MD5
bd58553c9970a028c84205601d051c35

SHA1
eaeba4c2955586d6660da80d408a35a0b62a020a

SHA256
bcadf0eea3fdea8a4894d04754574559ef9be3ce804ed69143e3b9fabb21d486

SHA512
d66571dce52ab01390a3946a7db8f48230c2b6b8f53f079eb50dfbcf59774e29c4c6205482c7c00cbf2585371732d6b4323b323ea879a1fd107b629629160ede

Download Submit
C:\Windows\System\SgJJxCB.exe

Filesize
1.7MB

MD5
4fbb10d9d0e85e27b30f684d2c29e775

SHA1
d9c66e5af5e524fce4f01d2f799ff21657f9019a

SHA256
e5ee49365b4d56e2ed3d9ba09513eec5ee8b11f77b96d71e0ad926175c8e6927

SHA512
d8f8a4db49c96dcbc3f053fc126c4b200bf663d9ecf0e5874e9eef7caeabdc7835fe5cc969113254c6745dcd2dbf8adcda72c10a0a669a04b2ebd1bfebf7fdfc

Download Submit
C:\Windows\System\TUOOwPl.exe

Filesize
1.7MB

MD5
3678c7b5ccf0ba8ddf6a653999ddbde5

SHA1
c84038c27ce402a5651ec960e060573d296823c8

SHA256
94a5a64aa7d440f7df892d9f0da07267494b678fa86a35c1b8270f28fc8d449e

SHA512
f156a8556712a54e990e763749b6c0087970e0231c3121039a9b0acc933212bc7e180f7612e20733a31e199afd43883e321793d41556605647074d8c3aab510a

Download Submit
C:\Windows\System\TYcbQPR.exe

Filesize
1.7MB

MD5
5f601a2165dceddd91efb32962bf21c1

SHA1
60974a6e222276daf510baddf5fdeee93155f959

SHA256
a254d4853b7d47e8f0e82acd9ec4489e1be796c027f786b1ac768a0710a64275

SHA512
6d185a319fc86a6aa2ebb103ea94e46a5fbd5a6262ab6384080c52d1e24b6472b02383ad87cda99886e56561fa2534492edfde22db9b88ef7d141e60c44694ff

Download Submit
C:\Windows\System\WGjQlmv.exe

Filesize
1.7MB

MD5
55df6dea698ae8876a0ed0eccd79700c

SHA1
b0bd392f91d6aabb3c401b729920cf3e609a17ac

SHA256
f9eb72ce5959eeaafce08f5a5b7c7e414f9ec656a08cd98d744ab77a60fc526c

SHA512
63906feb6e655a0b1c6f000aea42d6bee041f70a0d5b375066c904269066083a7a9b9894032f8be365f977a90e195a91fefd574641b58f8077a9856c33602baf

Download Submit
C:\Windows\System\WSfDqSM.exe

Filesize
1.7MB

MD5
89e01d944800dd41558be969d4393c47

SHA1
c2c29387971d7b8747104e4a839d8bb96c0bebec

SHA256
9c539d5a9aa42300fe07b497a778cde02593a4372768f7662bf5dadb87f1dc8f

SHA512
840b9808cd9c3de3930b2130801c8767909c963007657eed19cc20021e8af0284eea6a8c481ca969d1e25e85f5bea2d60f8613a63266c558dc91135593bd2693

Download Submit
C:\Windows\System\WVGDShx.exe

Filesize
1.7MB

MD5
df673dc144a97b42f957659c12c3f83d

SHA1
d9a074b592b6943969f7e556a8babd7d5e835334

SHA256
82424cf3e259224ca52cee3b197ad9baefb6ad1864d880dd9b584e239ec970fb

SHA512
035b9c734b07a04635649267153ffbdb648369d79c38e3df0da7e62326ba4c46e492a1616af6dc74eba3dfc7dbe73d55454317402a2a3b664a8fe690b9f556eb

Download Submit
C:\Windows\System\Wbntpxb.exe

Filesize
1.7MB

MD5
88395c5b0e7989b8f785a95c26f29ec0

SHA1
47528dd2e859e72fdceba7a06e553765c6ad1238

SHA256
74d4b99235f4f00c62d63c2dd4b152b6ae9529c0f258617314c2a004a56c0d24

SHA512
4c4631e70a3c2aee8a22f3d954478d24d1debcb3e185a4b8e4a8b010ef9422b98abdd48909c81fd65f80630e405f1fbea22da034436902619c5e0af0b59ed891

Download Submit
C:\Windows\System\XWyaCiZ.exe

Filesize
1.7MB

MD5
00a2c5c9d061ef817a474b061c8fb4b4

SHA1
7a069b7432bec3f2ac2001e8c3458384a31a73b1

SHA256
18f1093c30170fd082a95fe79be5fd379132ee64e194bdf0823bbd320989d432

SHA512
5b8a2fa7fe0ef0eb50c474c3ebcaac794c4402d5341c6792e8a6815b6f5d8970b5e974f422948086bd9e2ff410fb1d464a230e9f6be5b96cbfb1d298dea1fec4

Download Submit
C:\Windows\System\YzFyxOo.exe

Filesize
1.7MB

MD5
f6767bae23a8b4c6ef39b27f2cffa18a

SHA1
b78e5d548554a231bf6b6ac3ef29c0eecfae4e6b

SHA256
a9973a426549034bc06afc38214413acd189705595731eae1a79a7a9d691aa35

SHA512
8be61d03d8eac71bd13414ca0367b016976f360ec26f944883f40a0da73509e40c2779521ae86496a485caf07656f786a5cf3f846158a777d9169f76e97510e9

Download Submit
C:\Windows\System\cxUbbdg.exe

Filesize
1.7MB

MD5
dfc58a1e822006771ba46acdfe5f3c40

SHA1
578c8bfec85f0d962bed7c3ad8b8b504ee42ada2

SHA256
bd94897f10b70309da2311f28c0fc65f000692035826f1d1abe7158247d02dad

SHA512
60fa780d1051e45c4f4fa10926b7e55c155e3449c0f52cf488d94db4ad7db74aadb73b3e73ef241833b29044e59f0b9c2e12fdc613c90f15e8bdf2bd0a4a1e50

Download Submit
C:\Windows\System\dZyQgbO.exe

Filesize
1.7MB

MD5
353c6c1ea8f365426d71105a6c56cf94

SHA1
59944ad60401bf4942130292b000dff97a5c4b06

SHA256
9894e0d3ebbcabd0e1ff3f8e1ab0d86008d1cb1c92e0ad930b17377c3f5c838e

SHA512
ba2608f56776b5e6103d6b92caa6bf610cf915ac7b847941e5138694b99c9215bc05cddb371e08376bda3fc876e9cbdd935a78e8904a48235aec8a1303617b7f

Download Submit
C:\Windows\System\gEwreqB.exe

Filesize
1.7MB

MD5
514381c64f90d9995bfab97a7235c681

SHA1
618cc0d54072c090e50b86306f4864e074e28da8

SHA256
638a629fbb8b3b3497fd8a768d4f9cca8884713a91fa23f57384913456e3e612

SHA512
fbca16dbdb034122a1f3e49d32ac50e46670c5f6c7bf6c5e666fb6127a33f66f3dfadb206028754929f9b609384808620d1b921cde0c295c0873cd9727984f5c

Download Submit
C:\Windows\System\gyERNzi.exe

Filesize
1.7MB

MD5
56f3ff7d912c043c9af1c72fadc9d2bd

SHA1
b4499799c89ed26d07bfc3096f06c98a60fb955c

SHA256
b86d32600c0389df09cb624219597eaa1c39ec5912b6602e617fe2699ae34fb4

SHA512
ca161d733a881318c26ec35251b93252294f022a56a318a3bd3f53c842020c5861f9aa1344727a5e014a109a6afd273c677dbad8a07b2bbe5ad31a210d8b94dd

Download Submit
C:\Windows\System\hLptKeV.exe

Filesize
1.7MB

MD5
473915d62f1dd693eb2cde3fde51a384

SHA1
4d32ea844c6e0ee5a1e56d87cf57546db4aa4dcd

SHA256
531436199018642ee19ca7ca507e00bd4ff32b906a709ba06711f5a1c249f978

SHA512
c0ca0c6f210679f700f661997810edae2302a510f63ea1fe04adb77c7839d4cb12513f79b528a1d60914f6028a6b08864b1da9f7c8326609f0da2bb69350c7fd

Download Submit
C:\Windows\System\hvXGlRC.exe

Filesize
1.7MB

MD5
056117515bef6edc24209a055999d890

SHA1
69cc4adb464c73a6b094aae38d4525731dac06bc

SHA256
9951dcf348d6a32af5f902c9cdba5b0ac875078081ec36b7bc2c889b5c1ff854

SHA512
f85ef4d67364f8fa19d8199aff2aa1526934f0a043dab9a9c702576571d0136bcfd7f26fcdbf136b54c2a79600e7e06ab8a98187d18b97a939385ab4c84dff2e

Download Submit
C:\Windows\System\lNUamwi.exe

Filesize
1.7MB

MD5
6db4de348857a15d9272347b8f4ac3a0

SHA1
810097704e15d2d77ac5a782820ff9a9ae2eae0c

SHA256
2967087d3e2ab5104dd17bad43a63a70a0b0c1bd5f0ee4a8ab7d197ee19caf53

SHA512
433f1935681b371a311d048a9b061d02ddf5905df15aaa6372ec304a8933d4d02e8c50ee90749458acc5d544242f37bc2f6378c33c3e06580c32de9c1f675aa0

Download Submit
C:\Windows\System\mXdEmJO.exe

Filesize
1.7MB

MD5
d5e585dd700451bb0e38613cbea657a7

SHA1
00f5eaebdf8e02c0a86d2b5f32e1e5cdf4c02118

SHA256
3dcd4a25b05e3fa4028afcbcbdab00850dbd2fce56ed454bc0bde12a9a39a496

SHA512
629742c98294d85681360fb6f7025ae255b223b6a9ca7690e49956af38b13420aff0afca4d369fab6c283edad0e6a25cece467a8f6eba43d487badf92e772632

Download Submit
C:\Windows\System\mcTNWBM.exe

Filesize
1.7MB

MD5
b5ece1b47704f30a4ef417f9963f972c

SHA1
9e41d78c87a8c286fb7180cdfb7a34840f042f78

SHA256
86d1c2080d288efe7e57bd63747e0a80dd6d049f630e9437ccfcf6df698f34ed

SHA512
a70a3f8a32f29422bceb4a293180bc40a76de17094a22fcb606c8ce99e107e31e01402c6b55095dfff4b3b141c1dbbb46eb060f1dd47da259f53ff9269f39f46

Download Submit
C:\Windows\System\nRpdzpc.exe

Filesize
1.7MB

MD5
ea4f25c293ddb392e14dc2c52f897899

SHA1
279713e52b60d241c59deb4effe7cf6078107664

SHA256
2e530951b888670771bb6d4ef66afc45cd67fd54d6fd6b11f09740621a988b15

SHA512
1212a52091845ccc8d6739de861a598dae6a709ab95537839d8598942d9d107fc337229e19b92a27caed96c172a373923192dd4f396e3105e60c5f2ab285e0c3

Download Submit
C:\Windows\System\pBfxsFE.exe

Filesize
1.7MB

MD5
bddc83459a3097f4ab1b22cab8151929

SHA1
f20d2770c9baf094bc407080c75c253638727a46

SHA256
bbde692c5e33e1548d51bd2c78f089646a92ff87587c9f92d6dff60268ba25c5

SHA512
579d3b63fc44e1348b188088b58cb10df0dadbb5374afc418c5f88cb7d7b101ccd7120dc053da81f1ab6ee3ebf3433d55c9d6b82b3bef4b8e3a2857b89cf94d8

Download Submit
C:\Windows\System\phUcyIi.exe

Filesize
1.7MB

MD5
ff1c7b3da05c3e6c11fc8c0f846f2d8e

SHA1
7983bfaec408b144b63091eb7e8c37c7b7cb0582

SHA256
4af6a3449d90ae9469ea120ed40a8096c33175a86aa66e8514b19118b639e411

SHA512
d28a4a53c69481499b281cd1b77f4633db379abc03c2bfd5f68103e963967a69fffa05d5ed218b2bc6a410e4de96d135573c99a8267d139530cd4a87fe071826

Download Submit
C:\Windows\System\qoRqymq.exe

Filesize
1.7MB

MD5
0b01c90b5a6cdddfacc26ee03166eb09

SHA1
572fac8c80917b4c1dde78fd9bc5177f66cef5a6

SHA256
dc4c11c3ed0a87347d00c7b88ef394518dd9690a67207613d3b1af2c1ca7b845

SHA512
9121424fc44375093369f3500e64719e4c76eabcff95cdf656299b68e44f6df794e013ad1a5d96ff25f9016bb107f3e81ca4da4c5546631849527dc3e865a5ef

Download Submit
C:\Windows\System\rPBlbHm.exe

Filesize
1.7MB

MD5
e72b38f9bf92a14bcd1df66b0b2f202e

SHA1
92a35f592fb5630b5ffb8c2b92a6b90f66ddefb7

SHA256
e3c0ea8f43ac455c5d546a4e9826fdfdc0be9e7dfa576e71755c23a65181aede

SHA512
e379fa6fec68bebbf18598aba781b5d5cb96099be7cbbc08856798476a88726d3e91134dda1c770a7327b57660adcb5588f539292aebcab76fa8693531694c72

Download Submit
C:\Windows\System\sWNkCxW.exe

Filesize
1.7MB

MD5
64915f7a67714b5feadc87b9b4c1c69c

SHA1
efceda00492c2299ae2588eb79a2a465734b5f14

SHA256
5ae10cef05ad5041f29a6e1fecb6c50cb26a0cfb612643e30ebb881ba4014f8b

SHA512
00a453caf6eea26c199419ac8da960c32e6da73d04a275d1d9bf5133f4c3f9132cb55a71b992aa7b189f59389fe3b6025fb4df005f056b644be71677cca2679e

Download Submit
C:\Windows\System\ucdKNAP.exe

Filesize
1.7MB

MD5
70684e26e9853ca7791e0e4d26b4edc7

SHA1
2beac7f6a388e321fc4656e5c7a9d540ec9604b9

SHA256
5c1d9514114d2a37cab4f6c3ef4c2dfa35692cc4e01792f228efe6f7e7f0a0e8

SHA512
56ea0f61832702bf8b842d69a6249dbfb86d336c67c933ef7f97729d6fbf89bc293cabbb0f72a7121989a9e91dfdf3e49cf4bcddd6c3ca3d6e324767e399e402

Download Submit
C:\Windows\System\vRNKrSk.exe

Filesize
1.7MB

MD5
8726506c2c4f5569e87d97c946d6342f

SHA1
5078e804a12a3c19f4ec2b6a4fb2bd46c706478c

SHA256
a554dbbc7751533b59b090a26b548fa5b08aad1ad0af7fad6b6f2046419a4eac

SHA512
a9a9760b7f66d7fb593813f81986e5968e8f883d7829daa057bc77e819f485af4b3f1e1c0fdde2cb2a5e87c371cdbabaa4cda838c71a2a96fc93dc0d1fbc3845

Download Submit
memory/904-0-0x000002B36EE10000-0x000002B36EE20000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads