xmrig | 14540c9dcd27406924bf0191ebbb1a5356064fc0aee6a8afd8d0fd330f814bae

Analysis

max time kernel
147s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
22-12-2024 19:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

14540c9dcd27406924bf0191ebbb1a5356064fc0aee6a8afd8d0fd330f814bae.exe
Size

1.6MB
MD5

5d365881dc1fe13d51531862bf2dc69f
SHA1

47c02224125db5c944435072c7997535545d8c01
SHA256

14540c9dcd27406924bf0191ebbb1a5356064fc0aee6a8afd8d0fd330f814bae
SHA512

7047e0753f44c46ba834c016a9829d0642f29693e11dbc5a3d4df2678a7529b41319ba4052674f6105f930e8288dfd6fac0561ef766c2acfa1642008ce6141f4
SSDEEP

49152:GezaTF8FcNkNdfE0pZ9ozttwIRxj4c5yOBZCQ7Gj:GemTLkNdfE0pZyU

Score

10^/10

xmrig miner persistence privilege_escalation

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 33 IoCs

miner

resource	yara_rule
behavioral2/files/0x000a000000023c9a-3.dat	xmrig
behavioral2/files/0x0008000000023c9e-8.dat	xmrig
behavioral2/files/0x0007000000023ca2-15.dat	xmrig
behavioral2/files/0x0007000000023ca6-38.dat	xmrig
behavioral2/files/0x0007000000023ca9-52.dat	xmrig
behavioral2/files/0x0007000000023cac-64.dat	xmrig
behavioral2/files/0x0007000000023cb4-102.dat	xmrig
behavioral2/files/0x0007000000023cc0-162.dat	xmrig
behavioral2/files/0x0007000000023cbe-160.dat	xmrig
behavioral2/files/0x0007000000023cbf-157.dat	xmrig
behavioral2/files/0x0007000000023cbd-155.dat	xmrig
behavioral2/files/0x0007000000023cbc-150.dat	xmrig
behavioral2/files/0x0007000000023cbb-145.dat	xmrig
behavioral2/files/0x0007000000023cba-140.dat	xmrig
behavioral2/files/0x0007000000023cb9-135.dat	xmrig
behavioral2/files/0x0007000000023cb8-130.dat	xmrig
behavioral2/files/0x0007000000023cb7-125.dat	xmrig
behavioral2/files/0x0007000000023cb6-120.dat	xmrig
behavioral2/files/0x0007000000023cb5-115.dat	xmrig
behavioral2/files/0x0007000000023cb3-105.dat	xmrig
behavioral2/files/0x0007000000023cb2-100.dat	xmrig
behavioral2/files/0x0007000000023cb1-95.dat	xmrig
behavioral2/files/0x0007000000023cb0-90.dat	xmrig
behavioral2/files/0x0007000000023caf-85.dat	xmrig
behavioral2/files/0x0007000000023cae-80.dat	xmrig
behavioral2/files/0x0007000000023cad-72.dat	xmrig
behavioral2/files/0x0007000000023cab-62.dat	xmrig
behavioral2/files/0x0007000000023caa-58.dat	xmrig
behavioral2/files/0x0007000000023ca8-48.dat	xmrig
behavioral2/files/0x0007000000023ca7-42.dat	xmrig
behavioral2/files/0x0007000000023ca5-32.dat	xmrig
behavioral2/files/0x0007000000023ca4-24.dat	xmrig
behavioral2/files/0x0007000000023ca3-20.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
1752	tUgoETV.exe
868	JJlqSXM.exe
3604	mtLGVJI.exe
4484	tMmIaze.exe
3372	VBxHdtB.exe
816	bUWDOHM.exe
1956	yBsRWxq.exe
2596	rzoqnKI.exe
2636	CIZiwIM.exe
3368	bOpKGYm.exe
3536	bgGPgrd.exe
4168	AcrhjFP.exe
2828	IuceWYj.exe
4252	oRvjMBK.exe
1372	CxZyvqC.exe
4204	lErLMiI.exe
4216	wEuoORC.exe
1988	zOYWOKx.exe
3436	TJUIJft.exe
2944	HwdoQJa.exe
2004	wRvhzYr.exe
4932	xmBioTT.exe
3544	lWnXniS.exe
4392	irFSmBZ.exe
4592	FQPtUMr.exe
4004	PtxVjvU.exe
4588	zTAyoWz.exe
2236	tTeOciD.exe
3500	VCEUGXy.exe
2172	ZzePWjb.exe
1568	srlsmCJ.exe
4688	TTIXMwH.exe
5044	vNAOFfJ.exe
2256	XnpuUaF.exe
2676	hgMDhww.exe
1028	zISBqKD.exe
4436	uiiOrAr.exe
4544	xDTmKdL.exe
3192	NyGUgmU.exe
1680	aAEkHEe.exe
1832	clCCyfm.exe
2456	qTuJjsw.exe
3148	OnzBmIc.exe
4568	SNSqfcA.exe
3216	JWxZuzB.exe
736	UrTOGdY.exe
2624	rnWELZQ.exe
640	QKgqIjG.exe
2120	QEPnFUs.exe
5100	QKLUurc.exe
4080	IkeZrOj.exe
432	INMrrtc.exe
1708	dNxyMFc.exe
3976	VkgutnN.exe
4744	EgoLJDe.exe
2020	OSwyRJt.exe
4032	lnNMcFg.exe
388	Vjbcvkp.exe
1360	ILMMEfs.exe
4140	ZxSuerk.exe
1248	NgtFBBZ.exe
4572	MSyQQnL.exe
676	PubwDvz.exe
5024	NTVorHk.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\tTeOciD.exe	14540c9dcd27406924bf0191ebbb1a5356064fc0aee6a8afd8d0fd330f814bae.exe
File created	C:\Windows\System\MvkEPGk.exe	14540c9dcd27406924bf0191ebbb1a5356064fc0aee6a8afd8d0fd330f814bae.exe
File created	C:\Windows\System\BmQmGWW.exe	14540c9dcd27406924bf0191ebbb1a5356064fc0aee6a8afd8d0fd330f814bae.exe
File created	C:\Windows\System\nrMFvIf.exe	14540c9dcd27406924bf0191ebbb1a5356064fc0aee6a8afd8d0fd330f814bae.exe
File created	C:\Windows\System\fTDTZru.exe	14540c9dcd27406924bf0191ebbb1a5356064fc0aee6a8afd8d0fd330f814bae.exe
File created	C:\Windows\System\ADTMamN.exe	14540c9dcd27406924bf0191ebbb1a5356064fc0aee6a8afd8d0fd330f814bae.exe
File created	C:\Windows\System\SdeshIr.exe	14540c9dcd27406924bf0191ebbb1a5356064fc0aee6a8afd8d0fd330f814bae.exe
File created	C:\Windows\System\EVrIsFB.exe	14540c9dcd27406924bf0191ebbb1a5356064fc0aee6a8afd8d0fd330f814bae.exe
File created	C:\Windows\System\StYiXmb.exe	14540c9dcd27406924bf0191ebbb1a5356064fc0aee6a8afd8d0fd330f814bae.exe
File created	C:\Windows\System\pUSQVMK.exe	14540c9dcd27406924bf0191ebbb1a5356064fc0aee6a8afd8d0fd330f814bae.exe
File created	C:\Windows\System\oAaShAS.exe	14540c9dcd27406924bf0191ebbb1a5356064fc0aee6a8afd8d0fd330f814bae.exe
File created	C:\Windows\System\gVeHPew.exe	14540c9dcd27406924bf0191ebbb1a5356064fc0aee6a8afd8d0fd330f814bae.exe
File created	C:\Windows\System\iMDyGiC.exe	14540c9dcd27406924bf0191ebbb1a5356064fc0aee6a8afd8d0fd330f814bae.exe
File created	C:\Windows\System\LlgzMzf.exe	14540c9dcd27406924bf0191ebbb1a5356064fc0aee6a8afd8d0fd330f814bae.exe
File created	C:\Windows\System\uJFxJVD.exe	14540c9dcd27406924bf0191ebbb1a5356064fc0aee6a8afd8d0fd330f814bae.exe
File created	C:\Windows\System\tVOepPO.exe	14540c9dcd27406924bf0191ebbb1a5356064fc0aee6a8afd8d0fd330f814bae.exe
File created	C:\Windows\System\IbdZebZ.exe	14540c9dcd27406924bf0191ebbb1a5356064fc0aee6a8afd8d0fd330f814bae.exe
File created	C:\Windows\System\iLMpoyp.exe	14540c9dcd27406924bf0191ebbb1a5356064fc0aee6a8afd8d0fd330f814bae.exe
File created	C:\Windows\System\WTNlCFt.exe	14540c9dcd27406924bf0191ebbb1a5356064fc0aee6a8afd8d0fd330f814bae.exe
File created	C:\Windows\System\WmjvNty.exe	14540c9dcd27406924bf0191ebbb1a5356064fc0aee6a8afd8d0fd330f814bae.exe
File created	C:\Windows\System\Ekflmdv.exe	14540c9dcd27406924bf0191ebbb1a5356064fc0aee6a8afd8d0fd330f814bae.exe
File created	C:\Windows\System\wRvhzYr.exe	14540c9dcd27406924bf0191ebbb1a5356064fc0aee6a8afd8d0fd330f814bae.exe
File created	C:\Windows\System\UBqaJpt.exe	14540c9dcd27406924bf0191ebbb1a5356064fc0aee6a8afd8d0fd330f814bae.exe
File created	C:\Windows\System\sCtAVSR.exe	14540c9dcd27406924bf0191ebbb1a5356064fc0aee6a8afd8d0fd330f814bae.exe
File created	C:\Windows\System\tNdVCOM.exe	14540c9dcd27406924bf0191ebbb1a5356064fc0aee6a8afd8d0fd330f814bae.exe
File created	C:\Windows\System\PHOhBng.exe	14540c9dcd27406924bf0191ebbb1a5356064fc0aee6a8afd8d0fd330f814bae.exe
File created	C:\Windows\System\UrTOGdY.exe	14540c9dcd27406924bf0191ebbb1a5356064fc0aee6a8afd8d0fd330f814bae.exe
File created	C:\Windows\System\EgoLJDe.exe	14540c9dcd27406924bf0191ebbb1a5356064fc0aee6a8afd8d0fd330f814bae.exe
File created	C:\Windows\System\YElFHuk.exe	14540c9dcd27406924bf0191ebbb1a5356064fc0aee6a8afd8d0fd330f814bae.exe
File created	C:\Windows\System\jUIJDAo.exe	14540c9dcd27406924bf0191ebbb1a5356064fc0aee6a8afd8d0fd330f814bae.exe
File created	C:\Windows\System\LVhtVzq.exe	14540c9dcd27406924bf0191ebbb1a5356064fc0aee6a8afd8d0fd330f814bae.exe
File created	C:\Windows\System\NTVorHk.exe	14540c9dcd27406924bf0191ebbb1a5356064fc0aee6a8afd8d0fd330f814bae.exe
File created	C:\Windows\System\qyrsfyP.exe	14540c9dcd27406924bf0191ebbb1a5356064fc0aee6a8afd8d0fd330f814bae.exe
File created	C:\Windows\System\kCobBOF.exe	14540c9dcd27406924bf0191ebbb1a5356064fc0aee6a8afd8d0fd330f814bae.exe
File created	C:\Windows\System\lIXOrZe.exe	14540c9dcd27406924bf0191ebbb1a5356064fc0aee6a8afd8d0fd330f814bae.exe
File created	C:\Windows\System\zOYWOKx.exe	14540c9dcd27406924bf0191ebbb1a5356064fc0aee6a8afd8d0fd330f814bae.exe
File created	C:\Windows\System\AiypXTr.exe	14540c9dcd27406924bf0191ebbb1a5356064fc0aee6a8afd8d0fd330f814bae.exe
File created	C:\Windows\System\dTcQAst.exe	14540c9dcd27406924bf0191ebbb1a5356064fc0aee6a8afd8d0fd330f814bae.exe
File created	C:\Windows\System\tUKQQpU.exe	14540c9dcd27406924bf0191ebbb1a5356064fc0aee6a8afd8d0fd330f814bae.exe
File created	C:\Windows\System\DOyVKib.exe	14540c9dcd27406924bf0191ebbb1a5356064fc0aee6a8afd8d0fd330f814bae.exe
File created	C:\Windows\System\ihgodZM.exe	14540c9dcd27406924bf0191ebbb1a5356064fc0aee6a8afd8d0fd330f814bae.exe
File created	C:\Windows\System\srlsmCJ.exe	14540c9dcd27406924bf0191ebbb1a5356064fc0aee6a8afd8d0fd330f814bae.exe
File created	C:\Windows\System\bVkBvQb.exe	14540c9dcd27406924bf0191ebbb1a5356064fc0aee6a8afd8d0fd330f814bae.exe
File created	C:\Windows\System\HnHTDVA.exe	14540c9dcd27406924bf0191ebbb1a5356064fc0aee6a8afd8d0fd330f814bae.exe
File created	C:\Windows\System\FgauREs.exe	14540c9dcd27406924bf0191ebbb1a5356064fc0aee6a8afd8d0fd330f814bae.exe
File created	C:\Windows\System\EePqkib.exe	14540c9dcd27406924bf0191ebbb1a5356064fc0aee6a8afd8d0fd330f814bae.exe
File created	C:\Windows\System\AtTPzrv.exe	14540c9dcd27406924bf0191ebbb1a5356064fc0aee6a8afd8d0fd330f814bae.exe
File created	C:\Windows\System\rpVtlYB.exe	14540c9dcd27406924bf0191ebbb1a5356064fc0aee6a8afd8d0fd330f814bae.exe
File created	C:\Windows\System\zDwBlKK.exe	14540c9dcd27406924bf0191ebbb1a5356064fc0aee6a8afd8d0fd330f814bae.exe
File created	C:\Windows\System\TDKDrdl.exe	14540c9dcd27406924bf0191ebbb1a5356064fc0aee6a8afd8d0fd330f814bae.exe
File created	C:\Windows\System\dEEPKdu.exe	14540c9dcd27406924bf0191ebbb1a5356064fc0aee6a8afd8d0fd330f814bae.exe
File created	C:\Windows\System\irFSmBZ.exe	14540c9dcd27406924bf0191ebbb1a5356064fc0aee6a8afd8d0fd330f814bae.exe
File created	C:\Windows\System\HjYMeJp.exe	14540c9dcd27406924bf0191ebbb1a5356064fc0aee6a8afd8d0fd330f814bae.exe
File created	C:\Windows\System\WSjmgYe.exe	14540c9dcd27406924bf0191ebbb1a5356064fc0aee6a8afd8d0fd330f814bae.exe
File created	C:\Windows\System\uuPgobQ.exe	14540c9dcd27406924bf0191ebbb1a5356064fc0aee6a8afd8d0fd330f814bae.exe
File created	C:\Windows\System\yatMiGN.exe	14540c9dcd27406924bf0191ebbb1a5356064fc0aee6a8afd8d0fd330f814bae.exe
File created	C:\Windows\System\UOnGEvm.exe	14540c9dcd27406924bf0191ebbb1a5356064fc0aee6a8afd8d0fd330f814bae.exe
File created	C:\Windows\System\dMYBMdB.exe	14540c9dcd27406924bf0191ebbb1a5356064fc0aee6a8afd8d0fd330f814bae.exe
File created	C:\Windows\System\pzdDgzI.exe	14540c9dcd27406924bf0191ebbb1a5356064fc0aee6a8afd8d0fd330f814bae.exe
File created	C:\Windows\System\MqRMSuz.exe	14540c9dcd27406924bf0191ebbb1a5356064fc0aee6a8afd8d0fd330f814bae.exe
File created	C:\Windows\System\xosxCfx.exe	14540c9dcd27406924bf0191ebbb1a5356064fc0aee6a8afd8d0fd330f814bae.exe
File created	C:\Windows\System\szpOsqi.exe	14540c9dcd27406924bf0191ebbb1a5356064fc0aee6a8afd8d0fd330f814bae.exe
File created	C:\Windows\System\ijGLcFN.exe	14540c9dcd27406924bf0191ebbb1a5356064fc0aee6a8afd8d0fd330f814bae.exe
File created	C:\Windows\System\JmJzWGK.exe	14540c9dcd27406924bf0191ebbb1a5356064fc0aee6a8afd8d0fd330f814bae.exe

Event Triggered Execution: Accessibility Features 1 TTPs
Windows contains accessibility features that may be used by adversaries to establish persistence and/or elevate privileges.
persistence privilege_escalation

Accessibility Features
T1546.008

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	16476	dwm.exe
Token: SeChangeNotifyPrivilege	16476	dwm.exe
Token: 33	16476	dwm.exe
Token: SeIncBasePriorityPrivilege	16476	dwm.exe
Token: SeShutdownPrivilege	16476	dwm.exe
Token: SeCreatePagefilePrivilege	16476	dwm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1292 wrote to memory of 1752	1292	14540c9dcd27406924bf0191ebbb1a5356064fc0aee6a8afd8d0fd330f814bae.exe	84
PID 1292 wrote to memory of 1752	1292	14540c9dcd27406924bf0191ebbb1a5356064fc0aee6a8afd8d0fd330f814bae.exe	84
PID 1292 wrote to memory of 868	1292	14540c9dcd27406924bf0191ebbb1a5356064fc0aee6a8afd8d0fd330f814bae.exe	85
PID 1292 wrote to memory of 868	1292	14540c9dcd27406924bf0191ebbb1a5356064fc0aee6a8afd8d0fd330f814bae.exe	85
PID 1292 wrote to memory of 3604	1292	14540c9dcd27406924bf0191ebbb1a5356064fc0aee6a8afd8d0fd330f814bae.exe	86
PID 1292 wrote to memory of 3604	1292	14540c9dcd27406924bf0191ebbb1a5356064fc0aee6a8afd8d0fd330f814bae.exe	86
PID 1292 wrote to memory of 4484	1292	14540c9dcd27406924bf0191ebbb1a5356064fc0aee6a8afd8d0fd330f814bae.exe	87
PID 1292 wrote to memory of 4484	1292	14540c9dcd27406924bf0191ebbb1a5356064fc0aee6a8afd8d0fd330f814bae.exe	87
PID 1292 wrote to memory of 3372	1292	14540c9dcd27406924bf0191ebbb1a5356064fc0aee6a8afd8d0fd330f814bae.exe	88
PID 1292 wrote to memory of 3372	1292	14540c9dcd27406924bf0191ebbb1a5356064fc0aee6a8afd8d0fd330f814bae.exe	88
PID 1292 wrote to memory of 816	1292	14540c9dcd27406924bf0191ebbb1a5356064fc0aee6a8afd8d0fd330f814bae.exe	89
PID 1292 wrote to memory of 816	1292	14540c9dcd27406924bf0191ebbb1a5356064fc0aee6a8afd8d0fd330f814bae.exe	89
PID 1292 wrote to memory of 1956	1292	14540c9dcd27406924bf0191ebbb1a5356064fc0aee6a8afd8d0fd330f814bae.exe	90
PID 1292 wrote to memory of 1956	1292	14540c9dcd27406924bf0191ebbb1a5356064fc0aee6a8afd8d0fd330f814bae.exe	90
PID 1292 wrote to memory of 2596	1292	14540c9dcd27406924bf0191ebbb1a5356064fc0aee6a8afd8d0fd330f814bae.exe	91
PID 1292 wrote to memory of 2596	1292	14540c9dcd27406924bf0191ebbb1a5356064fc0aee6a8afd8d0fd330f814bae.exe	91
PID 1292 wrote to memory of 2636	1292	14540c9dcd27406924bf0191ebbb1a5356064fc0aee6a8afd8d0fd330f814bae.exe	92
PID 1292 wrote to memory of 2636	1292	14540c9dcd27406924bf0191ebbb1a5356064fc0aee6a8afd8d0fd330f814bae.exe	92
PID 1292 wrote to memory of 3368	1292	14540c9dcd27406924bf0191ebbb1a5356064fc0aee6a8afd8d0fd330f814bae.exe	93
PID 1292 wrote to memory of 3368	1292	14540c9dcd27406924bf0191ebbb1a5356064fc0aee6a8afd8d0fd330f814bae.exe	93
PID 1292 wrote to memory of 3536	1292	14540c9dcd27406924bf0191ebbb1a5356064fc0aee6a8afd8d0fd330f814bae.exe	94
PID 1292 wrote to memory of 3536	1292	14540c9dcd27406924bf0191ebbb1a5356064fc0aee6a8afd8d0fd330f814bae.exe	94
PID 1292 wrote to memory of 4168	1292	14540c9dcd27406924bf0191ebbb1a5356064fc0aee6a8afd8d0fd330f814bae.exe	95
PID 1292 wrote to memory of 4168	1292	14540c9dcd27406924bf0191ebbb1a5356064fc0aee6a8afd8d0fd330f814bae.exe	95
PID 1292 wrote to memory of 2828	1292	14540c9dcd27406924bf0191ebbb1a5356064fc0aee6a8afd8d0fd330f814bae.exe	96
PID 1292 wrote to memory of 2828	1292	14540c9dcd27406924bf0191ebbb1a5356064fc0aee6a8afd8d0fd330f814bae.exe	96
PID 1292 wrote to memory of 4252	1292	14540c9dcd27406924bf0191ebbb1a5356064fc0aee6a8afd8d0fd330f814bae.exe	97
PID 1292 wrote to memory of 4252	1292	14540c9dcd27406924bf0191ebbb1a5356064fc0aee6a8afd8d0fd330f814bae.exe	97
PID 1292 wrote to memory of 1372	1292	14540c9dcd27406924bf0191ebbb1a5356064fc0aee6a8afd8d0fd330f814bae.exe	98
PID 1292 wrote to memory of 1372	1292	14540c9dcd27406924bf0191ebbb1a5356064fc0aee6a8afd8d0fd330f814bae.exe	98
PID 1292 wrote to memory of 4204	1292	14540c9dcd27406924bf0191ebbb1a5356064fc0aee6a8afd8d0fd330f814bae.exe	99
PID 1292 wrote to memory of 4204	1292	14540c9dcd27406924bf0191ebbb1a5356064fc0aee6a8afd8d0fd330f814bae.exe	99
PID 1292 wrote to memory of 4216	1292	14540c9dcd27406924bf0191ebbb1a5356064fc0aee6a8afd8d0fd330f814bae.exe	100
PID 1292 wrote to memory of 4216	1292	14540c9dcd27406924bf0191ebbb1a5356064fc0aee6a8afd8d0fd330f814bae.exe	100
PID 1292 wrote to memory of 1988	1292	14540c9dcd27406924bf0191ebbb1a5356064fc0aee6a8afd8d0fd330f814bae.exe	101
PID 1292 wrote to memory of 1988	1292	14540c9dcd27406924bf0191ebbb1a5356064fc0aee6a8afd8d0fd330f814bae.exe	101
PID 1292 wrote to memory of 3436	1292	14540c9dcd27406924bf0191ebbb1a5356064fc0aee6a8afd8d0fd330f814bae.exe	102
PID 1292 wrote to memory of 3436	1292	14540c9dcd27406924bf0191ebbb1a5356064fc0aee6a8afd8d0fd330f814bae.exe	102
PID 1292 wrote to memory of 2944	1292	14540c9dcd27406924bf0191ebbb1a5356064fc0aee6a8afd8d0fd330f814bae.exe	103
PID 1292 wrote to memory of 2944	1292	14540c9dcd27406924bf0191ebbb1a5356064fc0aee6a8afd8d0fd330f814bae.exe	103
PID 1292 wrote to memory of 2004	1292	14540c9dcd27406924bf0191ebbb1a5356064fc0aee6a8afd8d0fd330f814bae.exe	104
PID 1292 wrote to memory of 2004	1292	14540c9dcd27406924bf0191ebbb1a5356064fc0aee6a8afd8d0fd330f814bae.exe	104
PID 1292 wrote to memory of 4932	1292	14540c9dcd27406924bf0191ebbb1a5356064fc0aee6a8afd8d0fd330f814bae.exe	105
PID 1292 wrote to memory of 4932	1292	14540c9dcd27406924bf0191ebbb1a5356064fc0aee6a8afd8d0fd330f814bae.exe	105
PID 1292 wrote to memory of 3544	1292	14540c9dcd27406924bf0191ebbb1a5356064fc0aee6a8afd8d0fd330f814bae.exe	106
PID 1292 wrote to memory of 3544	1292	14540c9dcd27406924bf0191ebbb1a5356064fc0aee6a8afd8d0fd330f814bae.exe	106
PID 1292 wrote to memory of 4392	1292	14540c9dcd27406924bf0191ebbb1a5356064fc0aee6a8afd8d0fd330f814bae.exe	107
PID 1292 wrote to memory of 4392	1292	14540c9dcd27406924bf0191ebbb1a5356064fc0aee6a8afd8d0fd330f814bae.exe	107
PID 1292 wrote to memory of 4592	1292	14540c9dcd27406924bf0191ebbb1a5356064fc0aee6a8afd8d0fd330f814bae.exe	108
PID 1292 wrote to memory of 4592	1292	14540c9dcd27406924bf0191ebbb1a5356064fc0aee6a8afd8d0fd330f814bae.exe	108
PID 1292 wrote to memory of 4004	1292	14540c9dcd27406924bf0191ebbb1a5356064fc0aee6a8afd8d0fd330f814bae.exe	109
PID 1292 wrote to memory of 4004	1292	14540c9dcd27406924bf0191ebbb1a5356064fc0aee6a8afd8d0fd330f814bae.exe	109
PID 1292 wrote to memory of 4588	1292	14540c9dcd27406924bf0191ebbb1a5356064fc0aee6a8afd8d0fd330f814bae.exe	110
PID 1292 wrote to memory of 4588	1292	14540c9dcd27406924bf0191ebbb1a5356064fc0aee6a8afd8d0fd330f814bae.exe	110
PID 1292 wrote to memory of 2236	1292	14540c9dcd27406924bf0191ebbb1a5356064fc0aee6a8afd8d0fd330f814bae.exe	111
PID 1292 wrote to memory of 2236	1292	14540c9dcd27406924bf0191ebbb1a5356064fc0aee6a8afd8d0fd330f814bae.exe	111
PID 1292 wrote to memory of 3500	1292	14540c9dcd27406924bf0191ebbb1a5356064fc0aee6a8afd8d0fd330f814bae.exe	112
PID 1292 wrote to memory of 3500	1292	14540c9dcd27406924bf0191ebbb1a5356064fc0aee6a8afd8d0fd330f814bae.exe	112
PID 1292 wrote to memory of 2172	1292	14540c9dcd27406924bf0191ebbb1a5356064fc0aee6a8afd8d0fd330f814bae.exe	113
PID 1292 wrote to memory of 2172	1292	14540c9dcd27406924bf0191ebbb1a5356064fc0aee6a8afd8d0fd330f814bae.exe	113
PID 1292 wrote to memory of 1568	1292	14540c9dcd27406924bf0191ebbb1a5356064fc0aee6a8afd8d0fd330f814bae.exe	114
PID 1292 wrote to memory of 1568	1292	14540c9dcd27406924bf0191ebbb1a5356064fc0aee6a8afd8d0fd330f814bae.exe	114
PID 1292 wrote to memory of 4688	1292	14540c9dcd27406924bf0191ebbb1a5356064fc0aee6a8afd8d0fd330f814bae.exe	115
PID 1292 wrote to memory of 4688	1292	14540c9dcd27406924bf0191ebbb1a5356064fc0aee6a8afd8d0fd330f814bae.exe	115

C:\Users\Admin\AppData\Local\Temp\14540c9dcd27406924bf0191ebbb1a5356064fc0aee6a8afd8d0fd330f814bae.exe
"C:\Users\Admin\AppData\Local\Temp\14540c9dcd27406924bf0191ebbb1a5356064fc0aee6a8afd8d0fd330f814bae.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1292
- C:\Windows\System\tUgoETV.exe
  C:\Windows\System\tUgoETV.exe
  2⤵
  - Executes dropped EXE
  PID:1752
- C:\Windows\System\JJlqSXM.exe
  C:\Windows\System\JJlqSXM.exe
  2⤵
  - Executes dropped EXE
  PID:868
- C:\Windows\System\mtLGVJI.exe
  C:\Windows\System\mtLGVJI.exe
  2⤵
  - Executes dropped EXE
  PID:3604
- C:\Windows\System\tMmIaze.exe
  C:\Windows\System\tMmIaze.exe
  2⤵
  - Executes dropped EXE
  PID:4484
- C:\Windows\System\VBxHdtB.exe
  C:\Windows\System\VBxHdtB.exe
  2⤵
  - Executes dropped EXE
  PID:3372
- C:\Windows\System\bUWDOHM.exe
  C:\Windows\System\bUWDOHM.exe
  2⤵
  - Executes dropped EXE
  PID:816
- C:\Windows\System\yBsRWxq.exe
  C:\Windows\System\yBsRWxq.exe
  2⤵
  - Executes dropped EXE
  PID:1956
- C:\Windows\System\rzoqnKI.exe
  C:\Windows\System\rzoqnKI.exe
  2⤵
  - Executes dropped EXE
  PID:2596
- C:\Windows\System\CIZiwIM.exe
  C:\Windows\System\CIZiwIM.exe
  2⤵
  - Executes dropped EXE
  PID:2636
- C:\Windows\System\bOpKGYm.exe
  C:\Windows\System\bOpKGYm.exe
  2⤵
  - Executes dropped EXE
  PID:3368
- C:\Windows\System\bgGPgrd.exe
  C:\Windows\System\bgGPgrd.exe
  2⤵
  - Executes dropped EXE
  PID:3536
- C:\Windows\System\AcrhjFP.exe
  C:\Windows\System\AcrhjFP.exe
  2⤵
  - Executes dropped EXE
  PID:4168
- C:\Windows\System\IuceWYj.exe
  C:\Windows\System\IuceWYj.exe
  2⤵
  - Executes dropped EXE
  PID:2828
- C:\Windows\System\oRvjMBK.exe
  C:\Windows\System\oRvjMBK.exe
  2⤵
  - Executes dropped EXE
  PID:4252
- C:\Windows\System\CxZyvqC.exe
  C:\Windows\System\CxZyvqC.exe
  2⤵
  - Executes dropped EXE
  PID:1372
- C:\Windows\System\lErLMiI.exe
  C:\Windows\System\lErLMiI.exe
  2⤵
  - Executes dropped EXE
  PID:4204
- C:\Windows\System\wEuoORC.exe
  C:\Windows\System\wEuoORC.exe
  2⤵
  - Executes dropped EXE
  PID:4216
- C:\Windows\System\zOYWOKx.exe
  C:\Windows\System\zOYWOKx.exe
  2⤵
  - Executes dropped EXE
  PID:1988
- C:\Windows\System\TJUIJft.exe
  C:\Windows\System\TJUIJft.exe
  2⤵
  - Executes dropped EXE
  PID:3436
- C:\Windows\System\HwdoQJa.exe
  C:\Windows\System\HwdoQJa.exe
  2⤵
  - Executes dropped EXE
  PID:2944
- C:\Windows\System\wRvhzYr.exe
  C:\Windows\System\wRvhzYr.exe
  2⤵
  - Executes dropped EXE
  PID:2004
- C:\Windows\System\xmBioTT.exe
  C:\Windows\System\xmBioTT.exe
  2⤵
  - Executes dropped EXE
  PID:4932
- C:\Windows\System\lWnXniS.exe
  C:\Windows\System\lWnXniS.exe
  2⤵
  - Executes dropped EXE
  PID:3544
- C:\Windows\System\irFSmBZ.exe
  C:\Windows\System\irFSmBZ.exe
  2⤵
  - Executes dropped EXE
  PID:4392
- C:\Windows\System\FQPtUMr.exe
  C:\Windows\System\FQPtUMr.exe
  2⤵
  - Executes dropped EXE
  PID:4592
- C:\Windows\System\PtxVjvU.exe
  C:\Windows\System\PtxVjvU.exe
  2⤵
  - Executes dropped EXE
  PID:4004
- C:\Windows\System\zTAyoWz.exe
  C:\Windows\System\zTAyoWz.exe
  2⤵
  - Executes dropped EXE
  PID:4588
- C:\Windows\System\tTeOciD.exe
  C:\Windows\System\tTeOciD.exe
  2⤵
  - Executes dropped EXE
  PID:2236
- C:\Windows\System\VCEUGXy.exe
  C:\Windows\System\VCEUGXy.exe
  2⤵
  - Executes dropped EXE
  PID:3500
- C:\Windows\System\ZzePWjb.exe
  C:\Windows\System\ZzePWjb.exe
  2⤵
  - Executes dropped EXE
  PID:2172
- C:\Windows\System\srlsmCJ.exe
  C:\Windows\System\srlsmCJ.exe
  2⤵
  - Executes dropped EXE
  PID:1568
- C:\Windows\System\TTIXMwH.exe
  C:\Windows\System\TTIXMwH.exe
  2⤵
  - Executes dropped EXE
  PID:4688
- C:\Windows\System\vNAOFfJ.exe
  C:\Windows\System\vNAOFfJ.exe
  2⤵
  - Executes dropped EXE
  PID:5044
- C:\Windows\System\XnpuUaF.exe
  C:\Windows\System\XnpuUaF.exe
  2⤵
  - Executes dropped EXE
  PID:2256
- C:\Windows\System\hgMDhww.exe
  C:\Windows\System\hgMDhww.exe
  2⤵
  - Executes dropped EXE
  PID:2676
- C:\Windows\System\zISBqKD.exe
  C:\Windows\System\zISBqKD.exe
  2⤵
  - Executes dropped EXE
  PID:1028
- C:\Windows\System\uiiOrAr.exe
  C:\Windows\System\uiiOrAr.exe
  2⤵
  - Executes dropped EXE
  PID:4436
- C:\Windows\System\xDTmKdL.exe
  C:\Windows\System\xDTmKdL.exe
  2⤵
  - Executes dropped EXE
  PID:4544
- C:\Windows\System\NyGUgmU.exe
  C:\Windows\System\NyGUgmU.exe
  2⤵
  - Executes dropped EXE
  PID:3192
- C:\Windows\System\aAEkHEe.exe
  C:\Windows\System\aAEkHEe.exe
  2⤵
  - Executes dropped EXE
  PID:1680
- C:\Windows\System\clCCyfm.exe
  C:\Windows\System\clCCyfm.exe
  2⤵
  - Executes dropped EXE
  PID:1832
- C:\Windows\System\qTuJjsw.exe
  C:\Windows\System\qTuJjsw.exe
  2⤵
  - Executes dropped EXE
  PID:2456
- C:\Windows\System\OnzBmIc.exe
  C:\Windows\System\OnzBmIc.exe
  2⤵
  - Executes dropped EXE
  PID:3148
- C:\Windows\System\SNSqfcA.exe
  C:\Windows\System\SNSqfcA.exe
  2⤵
  - Executes dropped EXE
  PID:4568
- C:\Windows\System\JWxZuzB.exe
  C:\Windows\System\JWxZuzB.exe
  2⤵
  - Executes dropped EXE
  PID:3216
- C:\Windows\System\UrTOGdY.exe
  C:\Windows\System\UrTOGdY.exe
  2⤵
  - Executes dropped EXE
  PID:736
- C:\Windows\System\rnWELZQ.exe
  C:\Windows\System\rnWELZQ.exe
  2⤵
  - Executes dropped EXE
  PID:2624
- C:\Windows\System\QKgqIjG.exe
  C:\Windows\System\QKgqIjG.exe
  2⤵
  - Executes dropped EXE
  PID:640
- C:\Windows\System\QEPnFUs.exe
  C:\Windows\System\QEPnFUs.exe
  2⤵
  - Executes dropped EXE
  PID:2120
- C:\Windows\System\QKLUurc.exe
  C:\Windows\System\QKLUurc.exe
  2⤵
  - Executes dropped EXE
  PID:5100
- C:\Windows\System\IkeZrOj.exe
  C:\Windows\System\IkeZrOj.exe
  2⤵
  - Executes dropped EXE
  PID:4080
- C:\Windows\System\INMrrtc.exe
  C:\Windows\System\INMrrtc.exe
  2⤵
  - Executes dropped EXE
  PID:432
- C:\Windows\System\dNxyMFc.exe
  C:\Windows\System\dNxyMFc.exe
  2⤵
  - Executes dropped EXE
  PID:1708
- C:\Windows\System\VkgutnN.exe
  C:\Windows\System\VkgutnN.exe
  2⤵
  - Executes dropped EXE
  PID:3976
- C:\Windows\System\EgoLJDe.exe
  C:\Windows\System\EgoLJDe.exe
  2⤵
  - Executes dropped EXE
  PID:4744
- C:\Windows\System\OSwyRJt.exe
  C:\Windows\System\OSwyRJt.exe
  2⤵
  - Executes dropped EXE
  PID:2020
- C:\Windows\System\lnNMcFg.exe
  C:\Windows\System\lnNMcFg.exe
  2⤵
  - Executes dropped EXE
  PID:4032
- C:\Windows\System\Vjbcvkp.exe
  C:\Windows\System\Vjbcvkp.exe
  2⤵
  - Executes dropped EXE
  PID:388
- C:\Windows\System\ILMMEfs.exe
  C:\Windows\System\ILMMEfs.exe
  2⤵
  - Executes dropped EXE
  PID:1360
- C:\Windows\System\ZxSuerk.exe
  C:\Windows\System\ZxSuerk.exe
  2⤵
  - Executes dropped EXE
  PID:4140
- C:\Windows\System\NgtFBBZ.exe
  C:\Windows\System\NgtFBBZ.exe
  2⤵
  - Executes dropped EXE
  PID:1248
- C:\Windows\System\MSyQQnL.exe
  C:\Windows\System\MSyQQnL.exe
  2⤵
  - Executes dropped EXE
  PID:4572
- C:\Windows\System\PubwDvz.exe
  C:\Windows\System\PubwDvz.exe
  2⤵
  - Executes dropped EXE
  PID:676
- C:\Windows\System\NTVorHk.exe
  C:\Windows\System\NTVorHk.exe
  2⤵
  - Executes dropped EXE
  PID:5024
- C:\Windows\System\qyrsfyP.exe
  C:\Windows\System\qyrsfyP.exe
  2⤵
  PID:668
- C:\Windows\System\zCIInPb.exe
  C:\Windows\System\zCIInPb.exe
  2⤵
  PID:3896
- C:\Windows\System\PpUpKMr.exe
  C:\Windows\System\PpUpKMr.exe
  2⤵
  PID:2300
- C:\Windows\System\GZeFDhZ.exe
  C:\Windows\System\GZeFDhZ.exe
  2⤵
  PID:4772
- C:\Windows\System\GsNiBbE.exe
  C:\Windows\System\GsNiBbE.exe
  2⤵
  PID:2404
- C:\Windows\System\HjYMeJp.exe
  C:\Windows\System\HjYMeJp.exe
  2⤵
  PID:2196
- C:\Windows\System\fCmxVxd.exe
  C:\Windows\System\fCmxVxd.exe
  2⤵
  PID:4120
- C:\Windows\System\HFOxLhG.exe
  C:\Windows\System\HFOxLhG.exe
  2⤵
  PID:1676
- C:\Windows\System\wfLeBDj.exe
  C:\Windows\System\wfLeBDj.exe
  2⤵
  PID:776
- C:\Windows\System\mnNOtPs.exe
  C:\Windows\System\mnNOtPs.exe
  2⤵
  PID:1000
- C:\Windows\System\wHajAFB.exe
  C:\Windows\System\wHajAFB.exe
  2⤵
  PID:1368
- C:\Windows\System\nQHkuiA.exe
  C:\Windows\System\nQHkuiA.exe
  2⤵
  PID:3688
- C:\Windows\System\LARxjIz.exe
  C:\Windows\System\LARxjIz.exe
  2⤵
  PID:532
- C:\Windows\System\diztVBn.exe
  C:\Windows\System\diztVBn.exe
  2⤵
  PID:2500
- C:\Windows\System\KhUHVEk.exe
  C:\Windows\System\KhUHVEk.exe
  2⤵
  PID:1008
- C:\Windows\System\JzZwpKJ.exe
  C:\Windows\System\JzZwpKJ.exe
  2⤵
  PID:4500
- C:\Windows\System\GHNzKsA.exe
  C:\Windows\System\GHNzKsA.exe
  2⤵
  PID:1088
- C:\Windows\System\XPESFjV.exe
  C:\Windows\System\XPESFjV.exe
  2⤵
  PID:4388
- C:\Windows\System\YDZYJHP.exe
  C:\Windows\System\YDZYJHP.exe
  2⤵
  PID:5048
- C:\Windows\System\jIvactf.exe
  C:\Windows\System\jIvactf.exe
  2⤵
  PID:728
- C:\Windows\System\jsPOEIn.exe
  C:\Windows\System\jsPOEIn.exe
  2⤵
  PID:3024
- C:\Windows\System\edUuGkF.exe
  C:\Windows\System\edUuGkF.exe
  2⤵
  PID:1668
- C:\Windows\System\nSmPknv.exe
  C:\Windows\System\nSmPknv.exe
  2⤵
  PID:1464
- C:\Windows\System\zIznkPJ.exe
  C:\Windows\System\zIznkPJ.exe
  2⤵
  PID:4152
- C:\Windows\System\tltcHYj.exe
  C:\Windows\System\tltcHYj.exe
  2⤵
  PID:4844
- C:\Windows\System\tHvXJtJ.exe
  C:\Windows\System\tHvXJtJ.exe
  2⤵
  PID:5148
- C:\Windows\System\KLiISbC.exe
  C:\Windows\System\KLiISbC.exe
  2⤵
  PID:5176
- C:\Windows\System\qprihQu.exe
  C:\Windows\System\qprihQu.exe
  2⤵
  PID:5204
- C:\Windows\System\urPRSmu.exe
  C:\Windows\System\urPRSmu.exe
  2⤵
  PID:5228
- C:\Windows\System\XbUChAd.exe
  C:\Windows\System\XbUChAd.exe
  2⤵
  PID:5260
- C:\Windows\System\phMtVjM.exe
  C:\Windows\System\phMtVjM.exe
  2⤵
  PID:5288
- C:\Windows\System\TIipuFN.exe
  C:\Windows\System\TIipuFN.exe
  2⤵
  PID:5316
- C:\Windows\System\oMNbZfy.exe
  C:\Windows\System\oMNbZfy.exe
  2⤵
  PID:5340
- C:\Windows\System\mBPfXAt.exe
  C:\Windows\System\mBPfXAt.exe
  2⤵
  PID:5368
- C:\Windows\System\jipUbqr.exe
  C:\Windows\System\jipUbqr.exe
  2⤵
  PID:5396
- C:\Windows\System\YGsHEeq.exe
  C:\Windows\System\YGsHEeq.exe
  2⤵
  PID:5424
- C:\Windows\System\udDmWXU.exe
  C:\Windows\System\udDmWXU.exe
  2⤵
  PID:5452
- C:\Windows\System\OCkcrwT.exe
  C:\Windows\System\OCkcrwT.exe
  2⤵
  PID:5480
- C:\Windows\System\kCobBOF.exe
  C:\Windows\System\kCobBOF.exe
  2⤵
  PID:5508
- C:\Windows\System\ibtyJWp.exe
  C:\Windows\System\ibtyJWp.exe
  2⤵
  PID:5536
- C:\Windows\System\YewxFeG.exe
  C:\Windows\System\YewxFeG.exe
  2⤵
  PID:5564
- C:\Windows\System\grUBmXd.exe
  C:\Windows\System\grUBmXd.exe
  2⤵
  PID:5592
- C:\Windows\System\paAdtrm.exe
  C:\Windows\System\paAdtrm.exe
  2⤵
  PID:5620
- C:\Windows\System\LEaoJNj.exe
  C:\Windows\System\LEaoJNj.exe
  2⤵
  PID:5648
- C:\Windows\System\GZmyRFk.exe
  C:\Windows\System\GZmyRFk.exe
  2⤵
  PID:5668
- C:\Windows\System\vPgIusa.exe
  C:\Windows\System\vPgIusa.exe
  2⤵
  PID:5704
- C:\Windows\System\HUfbKoC.exe
  C:\Windows\System\HUfbKoC.exe
  2⤵
  PID:5724
- C:\Windows\System\TszMVje.exe
  C:\Windows\System\TszMVje.exe
  2⤵
  PID:5752
- C:\Windows\System\ypEUqoq.exe
  C:\Windows\System\ypEUqoq.exe
  2⤵
  PID:5780
- C:\Windows\System\kZGrbLh.exe
  C:\Windows\System\kZGrbLh.exe
  2⤵
  PID:5812
- C:\Windows\System\SkVChsO.exe
  C:\Windows\System\SkVChsO.exe
  2⤵
  PID:5836
- C:\Windows\System\oNUWvbd.exe
  C:\Windows\System\oNUWvbd.exe
  2⤵
  PID:5864
- C:\Windows\System\uCezNBC.exe
  C:\Windows\System\uCezNBC.exe
  2⤵
  PID:5892
- C:\Windows\System\aUZzISG.exe
  C:\Windows\System\aUZzISG.exe
  2⤵
  PID:5920
- C:\Windows\System\MSbLtHI.exe
  C:\Windows\System\MSbLtHI.exe
  2⤵
  PID:5948
- C:\Windows\System\UBqaJpt.exe
  C:\Windows\System\UBqaJpt.exe
  2⤵
  PID:5976
- C:\Windows\System\vHgXSMh.exe
  C:\Windows\System\vHgXSMh.exe
  2⤵
  PID:6004
- C:\Windows\System\CkaDsGM.exe
  C:\Windows\System\CkaDsGM.exe
  2⤵
  PID:6032
- C:\Windows\System\uDoTKhE.exe
  C:\Windows\System\uDoTKhE.exe
  2⤵
  PID:6060
- C:\Windows\System\Ingtmtl.exe
  C:\Windows\System\Ingtmtl.exe
  2⤵
  PID:6088
- C:\Windows\System\bvzIiVm.exe
  C:\Windows\System\bvzIiVm.exe
  2⤵
  PID:6116
- C:\Windows\System\RAQaCcn.exe
  C:\Windows\System\RAQaCcn.exe
  2⤵
  PID:4632
- C:\Windows\System\koAScqJ.exe
  C:\Windows\System\koAScqJ.exe
  2⤵
  PID:1960
- C:\Windows\System\lncGNEw.exe
  C:\Windows\System\lncGNEw.exe
  2⤵
  PID:1884
- C:\Windows\System\yuilcUk.exe
  C:\Windows\System\yuilcUk.exe
  2⤵
  PID:2240
- C:\Windows\System\fmOrQzD.exe
  C:\Windows\System\fmOrQzD.exe
  2⤵
  PID:3120
- C:\Windows\System\uJFxJVD.exe
  C:\Windows\System\uJFxJVD.exe
  2⤵
  PID:4660
- C:\Windows\System\mXebNKy.exe
  C:\Windows\System\mXebNKy.exe
  2⤵
  PID:4384
- C:\Windows\System\SHESTfo.exe
  C:\Windows\System\SHESTfo.exe
  2⤵
  PID:5160
- C:\Windows\System\nWjilxt.exe
  C:\Windows\System\nWjilxt.exe
  2⤵
  PID:5220
- C:\Windows\System\kxQjBIb.exe
  C:\Windows\System\kxQjBIb.exe
  2⤵
  PID:5280
- C:\Windows\System\AdSZWqm.exe
  C:\Windows\System\AdSZWqm.exe
  2⤵
  PID:5356
- C:\Windows\System\xLpTzoJ.exe
  C:\Windows\System\xLpTzoJ.exe
  2⤵
  PID:5416
- C:\Windows\System\EePqkib.exe
  C:\Windows\System\EePqkib.exe
  2⤵
  PID:5476
- C:\Windows\System\CixOvhC.exe
  C:\Windows\System\CixOvhC.exe
  2⤵
  PID:5552
- C:\Windows\System\TqgineN.exe
  C:\Windows\System\TqgineN.exe
  2⤵
  PID:5612
- C:\Windows\System\FIWQUQC.exe
  C:\Windows\System\FIWQUQC.exe
  2⤵
  PID:5680
- C:\Windows\System\NJUmwkT.exe
  C:\Windows\System\NJUmwkT.exe
  2⤵
  PID:5740
- C:\Windows\System\SmPDxcp.exe
  C:\Windows\System\SmPDxcp.exe
  2⤵
  PID:5804
- C:\Windows\System\fUmCCzw.exe
  C:\Windows\System\fUmCCzw.exe
  2⤵
  PID:5856
- C:\Windows\System\LIZJEOp.exe
  C:\Windows\System\LIZJEOp.exe
  2⤵
  PID:5932
- C:\Windows\System\MvenIqm.exe
  C:\Windows\System\MvenIqm.exe
  2⤵
  PID:5992
- C:\Windows\System\GNIDxQG.exe
  C:\Windows\System\GNIDxQG.exe
  2⤵
  PID:6052
- C:\Windows\System\mxSuVQg.exe
  C:\Windows\System\mxSuVQg.exe
  2⤵
  PID:6108
- C:\Windows\System\ildWfhz.exe
  C:\Windows\System\ildWfhz.exe
  2⤵
  PID:3936
- C:\Windows\System\fCjoVJB.exe
  C:\Windows\System\fCjoVJB.exe
  2⤵
  PID:212
- C:\Windows\System\mjdyPrG.exe
  C:\Windows\System\mjdyPrG.exe
  2⤵
  PID:1964
- C:\Windows\System\lhQJSmu.exe
  C:\Windows\System\lhQJSmu.exe
  2⤵
  PID:5196
- C:\Windows\System\szpOsqi.exe
  C:\Windows\System\szpOsqi.exe
  2⤵
  PID:5332
- C:\Windows\System\lHLmnMy.exe
  C:\Windows\System\lHLmnMy.exe
  2⤵
  PID:5504
- C:\Windows\System\ijGLcFN.exe
  C:\Windows\System\ijGLcFN.exe
  2⤵
  PID:5644
- C:\Windows\System\nFFAZlE.exe
  C:\Windows\System\nFFAZlE.exe
  2⤵
  PID:5792
- C:\Windows\System\lsQmBhb.exe
  C:\Windows\System\lsQmBhb.exe
  2⤵
  PID:5908
- C:\Windows\System\tBWoCQX.exe
  C:\Windows\System\tBWoCQX.exe
  2⤵
  PID:6044
- C:\Windows\System\WTHcfMC.exe
  C:\Windows\System\WTHcfMC.exe
  2⤵
  PID:6148
- C:\Windows\System\KEGcUMv.exe
  C:\Windows\System\KEGcUMv.exe
  2⤵
  PID:6172
- C:\Windows\System\cAbafvh.exe
  C:\Windows\System\cAbafvh.exe
  2⤵
  PID:6200
- C:\Windows\System\XScYKkF.exe
  C:\Windows\System\XScYKkF.exe
  2⤵
  PID:6232
- C:\Windows\System\nvIaNBc.exe
  C:\Windows\System\nvIaNBc.exe
  2⤵
  PID:6260
- C:\Windows\System\lIXOrZe.exe
  C:\Windows\System\lIXOrZe.exe
  2⤵
  PID:6288
- C:\Windows\System\oLfGdzL.exe
  C:\Windows\System\oLfGdzL.exe
  2⤵
  PID:6320
- C:\Windows\System\JmJzWGK.exe
  C:\Windows\System\JmJzWGK.exe
  2⤵
  PID:6344
- C:\Windows\System\GPWYNoE.exe
  C:\Windows\System\GPWYNoE.exe
  2⤵
  PID:6372
- C:\Windows\System\klYvipt.exe
  C:\Windows\System\klYvipt.exe
  2⤵
  PID:6396
- C:\Windows\System\PlWZSXM.exe
  C:\Windows\System\PlWZSXM.exe
  2⤵
  PID:6428
- C:\Windows\System\QCUQoTH.exe
  C:\Windows\System\QCUQoTH.exe
  2⤵
  PID:6452
- C:\Windows\System\iMxYAfd.exe
  C:\Windows\System\iMxYAfd.exe
  2⤵
  PID:6480
- C:\Windows\System\JQzxNlJ.exe
  C:\Windows\System\JQzxNlJ.exe
  2⤵
  PID:6512
- C:\Windows\System\EbqvQVc.exe
  C:\Windows\System\EbqvQVc.exe
  2⤵
  PID:6540
- C:\Windows\System\pdxEXrn.exe
  C:\Windows\System\pdxEXrn.exe
  2⤵
  PID:6568
- C:\Windows\System\TuEHTyi.exe
  C:\Windows\System\TuEHTyi.exe
  2⤵
  PID:6596
- C:\Windows\System\ANhudFq.exe
  C:\Windows\System\ANhudFq.exe
  2⤵
  PID:6624
- C:\Windows\System\bayaxMq.exe
  C:\Windows\System\bayaxMq.exe
  2⤵
  PID:6652
- C:\Windows\System\WSjmgYe.exe
  C:\Windows\System\WSjmgYe.exe
  2⤵
  PID:6680
- C:\Windows\System\xygcHUB.exe
  C:\Windows\System\xygcHUB.exe
  2⤵
  PID:6708
- C:\Windows\System\HTpTSnI.exe
  C:\Windows\System\HTpTSnI.exe
  2⤵
  PID:6736
- C:\Windows\System\cTWMMDk.exe
  C:\Windows\System\cTWMMDk.exe
  2⤵
  PID:6768
- C:\Windows\System\qOaOdsR.exe
  C:\Windows\System\qOaOdsR.exe
  2⤵
  PID:6796
- C:\Windows\System\NKHciKp.exe
  C:\Windows\System\NKHciKp.exe
  2⤵
  PID:6824
- C:\Windows\System\zDCJIPC.exe
  C:\Windows\System\zDCJIPC.exe
  2⤵
  PID:6852
- C:\Windows\System\UkwsRme.exe
  C:\Windows\System\UkwsRme.exe
  2⤵
  PID:6880
- C:\Windows\System\oADtyxQ.exe
  C:\Windows\System\oADtyxQ.exe
  2⤵
  PID:7140
- C:\Windows\System\VSxuckq.exe
  C:\Windows\System\VSxuckq.exe
  2⤵
  PID:7164
- C:\Windows\System\DZeiRSo.exe
  C:\Windows\System\DZeiRSo.exe
  2⤵
  PID:5272
- C:\Windows\System\uNPHXjf.exe
  C:\Windows\System\uNPHXjf.exe
  2⤵
  PID:5580
- C:\Windows\System\BwCLmLN.exe
  C:\Windows\System\BwCLmLN.exe
  2⤵
  PID:5768
- C:\Windows\System\wbVaKIO.exe
  C:\Windows\System\wbVaKIO.exe
  2⤵
  PID:6020
- C:\Windows\System\qbCxqfJ.exe
  C:\Windows\System\qbCxqfJ.exe
  2⤵
  PID:6188
- C:\Windows\System\uryJSBP.exe
  C:\Windows\System\uryJSBP.exe
  2⤵
  PID:6248
- C:\Windows\System\sdiyVtf.exe
  C:\Windows\System\sdiyVtf.exe
  2⤵
  PID:6300
- C:\Windows\System\HbUgpTY.exe
  C:\Windows\System\HbUgpTY.exe
  2⤵
  PID:1724
- C:\Windows\System\jZHgpbW.exe
  C:\Windows\System\jZHgpbW.exe
  2⤵
  PID:6356
- C:\Windows\System\HBlOObQ.exe
  C:\Windows\System\HBlOObQ.exe
  2⤵
  PID:5116
- C:\Windows\System\zDjbNFL.exe
  C:\Windows\System\zDjbNFL.exe
  2⤵
  PID:2044
- C:\Windows\System\whjPoGk.exe
  C:\Windows\System\whjPoGk.exe
  2⤵
  PID:6528
- C:\Windows\System\KRQAqkC.exe
  C:\Windows\System\KRQAqkC.exe
  2⤵
  PID:6556
- C:\Windows\System\aIcnbpx.exe
  C:\Windows\System\aIcnbpx.exe
  2⤵
  PID:6612
- C:\Windows\System\zttBSjH.exe
  C:\Windows\System\zttBSjH.exe
  2⤵
  PID:6672
- C:\Windows\System\FEjepBQ.exe
  C:\Windows\System\FEjepBQ.exe
  2⤵
  PID:6732
- C:\Windows\System\BpFZWmz.exe
  C:\Windows\System\BpFZWmz.exe
  2⤵
  PID:6760
- C:\Windows\System\wwFjpzz.exe
  C:\Windows\System\wwFjpzz.exe
  2⤵
  PID:6784
- C:\Windows\System\pFWRwaN.exe
  C:\Windows\System\pFWRwaN.exe
  2⤵
  PID:6840
- C:\Windows\System\RsaVvIJ.exe
  C:\Windows\System\RsaVvIJ.exe
  2⤵
  PID:6920
- C:\Windows\System\HdhrmRC.exe
  C:\Windows\System\HdhrmRC.exe
  2⤵
  PID:6940
- C:\Windows\System\QmtEgzN.exe
  C:\Windows\System\QmtEgzN.exe
  2⤵
  PID:3968
- C:\Windows\System\XuTAPKs.exe
  C:\Windows\System\XuTAPKs.exe
  2⤵
  PID:4524
- C:\Windows\System\OpZnsfa.exe
  C:\Windows\System\OpZnsfa.exe
  2⤵
  PID:6964
- C:\Windows\System\JTZQNfe.exe
  C:\Windows\System\JTZQNfe.exe
  2⤵
  PID:7096
- C:\Windows\System\AtTPzrv.exe
  C:\Windows\System\AtTPzrv.exe
  2⤵
  PID:6960
- C:\Windows\System\UMvQDQk.exe
  C:\Windows\System\UMvQDQk.exe
  2⤵
  PID:7060
- C:\Windows\System\ISRqTxM.exe
  C:\Windows\System\ISRqTxM.exe
  2⤵
  PID:1404
- C:\Windows\System\tMbiTSv.exe
  C:\Windows\System\tMbiTSv.exe
  2⤵
  PID:6980
- C:\Windows\System\HPROGkk.exe
  C:\Windows\System\HPROGkk.exe
  2⤵
  PID:6984
- C:\Windows\System\zCSlMDU.exe
  C:\Windows\System\zCSlMDU.exe
  2⤵
  PID:6244
- C:\Windows\System\sVtyCFc.exe
  C:\Windows\System\sVtyCFc.exe
  2⤵
  PID:1344
- C:\Windows\System\AKLIyWY.exe
  C:\Windows\System\AKLIyWY.exe
  2⤵
  PID:7024
- C:\Windows\System\lnYUkZQ.exe
  C:\Windows\System\lnYUkZQ.exe
  2⤵
  PID:6444
- C:\Windows\System\jzsvtoG.exe
  C:\Windows\System\jzsvtoG.exe
  2⤵
  PID:7016
- C:\Windows\System\qjjmOTm.exe
  C:\Windows\System\qjjmOTm.exe
  2⤵
  PID:6476
- C:\Windows\System\qINCtni.exe
  C:\Windows\System\qINCtni.exe
  2⤵
  PID:6588
- C:\Windows\System\wehbGGI.exe
  C:\Windows\System\wehbGGI.exe
  2⤵
  PID:1720
- C:\Windows\System\xvwtQEe.exe
  C:\Windows\System\xvwtQEe.exe
  2⤵
  PID:6812
- C:\Windows\System\ADTMamN.exe
  C:\Windows\System\ADTMamN.exe
  2⤵
  PID:6952
- C:\Windows\System\FTyIvHK.exe
  C:\Windows\System\FTyIvHK.exe
  2⤵
  PID:7064
- C:\Windows\System\MkWmfEx.exe
  C:\Windows\System\MkWmfEx.exe
  2⤵
  PID:4756
- C:\Windows\System\RUzRLbD.exe
  C:\Windows\System\RUzRLbD.exe
  2⤵
  PID:6976
- C:\Windows\System\QmpXequ.exe
  C:\Windows\System\QmpXequ.exe
  2⤵
  PID:6312
- C:\Windows\System\PeOYQyV.exe
  C:\Windows\System\PeOYQyV.exe
  2⤵
  PID:6468
- C:\Windows\System\ylGURbi.exe
  C:\Windows\System\ylGURbi.exe
  2⤵
  PID:1288
- C:\Windows\System\akqgygd.exe
  C:\Windows\System\akqgygd.exe
  2⤵
  PID:6924
- C:\Windows\System\MRbcrox.exe
  C:\Windows\System\MRbcrox.exe
  2⤵
  PID:7108
- C:\Windows\System\pRtvepx.exe
  C:\Windows\System\pRtvepx.exe
  2⤵
  PID:5968
- C:\Windows\System\gcUYTdx.exe
  C:\Windows\System\gcUYTdx.exe
  2⤵
  PID:3932
- C:\Windows\System\KTjuqhj.exe
  C:\Windows\System\KTjuqhj.exe
  2⤵
  PID:5716
- C:\Windows\System\KleSdvJ.exe
  C:\Windows\System\KleSdvJ.exe
  2⤵
  PID:6968
- C:\Windows\System\blRPKMQ.exe
  C:\Windows\System\blRPKMQ.exe
  2⤵
  PID:6640
- C:\Windows\System\bBVPmmJ.exe
  C:\Windows\System\bBVPmmJ.exe
  2⤵
  PID:7196
- C:\Windows\System\iOkdgbY.exe
  C:\Windows\System\iOkdgbY.exe
  2⤵
  PID:7220
- C:\Windows\System\yQtFApF.exe
  C:\Windows\System\yQtFApF.exe
  2⤵
  PID:7252
- C:\Windows\System\eaiWOfa.exe
  C:\Windows\System\eaiWOfa.exe
  2⤵
  PID:7292
- C:\Windows\System\gjwpkdb.exe
  C:\Windows\System\gjwpkdb.exe
  2⤵
  PID:7320
- C:\Windows\System\vMwnLJn.exe
  C:\Windows\System\vMwnLJn.exe
  2⤵
  PID:7356
- C:\Windows\System\kHrUGQp.exe
  C:\Windows\System\kHrUGQp.exe
  2⤵
  PID:7380
- C:\Windows\System\YElFHuk.exe
  C:\Windows\System\YElFHuk.exe
  2⤵
  PID:7400
- C:\Windows\System\hKMrmPh.exe
  C:\Windows\System\hKMrmPh.exe
  2⤵
  PID:7432
- C:\Windows\System\MvkEPGk.exe
  C:\Windows\System\MvkEPGk.exe
  2⤵
  PID:7456
- C:\Windows\System\GUOpCkk.exe
  C:\Windows\System\GUOpCkk.exe
  2⤵
  PID:7484
- C:\Windows\System\SBReAiB.exe
  C:\Windows\System\SBReAiB.exe
  2⤵
  PID:7512
- C:\Windows\System\bqCjLiM.exe
  C:\Windows\System\bqCjLiM.exe
  2⤵
  PID:7552
- C:\Windows\System\ItJRYOO.exe
  C:\Windows\System\ItJRYOO.exe
  2⤵
  PID:7568
- C:\Windows\System\EPLoOtu.exe
  C:\Windows\System\EPLoOtu.exe
  2⤵
  PID:7584
- C:\Windows\System\tCOUQEu.exe
  C:\Windows\System\tCOUQEu.exe
  2⤵
  PID:7600
- C:\Windows\System\BxDgWVg.exe
  C:\Windows\System\BxDgWVg.exe
  2⤵
  PID:7616
- C:\Windows\System\jUpRBwZ.exe
  C:\Windows\System\jUpRBwZ.exe
  2⤵
  PID:7640
- C:\Windows\System\tFJEYSN.exe
  C:\Windows\System\tFJEYSN.exe
  2⤵
  PID:7664
- C:\Windows\System\CJpGKuR.exe
  C:\Windows\System\CJpGKuR.exe
  2⤵
  PID:7684
- C:\Windows\System\ZFmiYFR.exe
  C:\Windows\System\ZFmiYFR.exe
  2⤵
  PID:7704
- C:\Windows\System\qpPliEU.exe
  C:\Windows\System\qpPliEU.exe
  2⤵
  PID:7720
- C:\Windows\System\AiypXTr.exe
  C:\Windows\System\AiypXTr.exe
  2⤵
  PID:7748
- C:\Windows\System\PsuQQXi.exe
  C:\Windows\System\PsuQQXi.exe
  2⤵
  PID:7772
- C:\Windows\System\LGokJhQ.exe
  C:\Windows\System\LGokJhQ.exe
  2⤵
  PID:7796
- C:\Windows\System\jDdhwIk.exe
  C:\Windows\System\jDdhwIk.exe
  2⤵
  PID:7828
- C:\Windows\System\yAnaEXa.exe
  C:\Windows\System\yAnaEXa.exe
  2⤵
  PID:7912
- C:\Windows\System\wlDHOxl.exe
  C:\Windows\System\wlDHOxl.exe
  2⤵
  PID:7948
- C:\Windows\System\YzbSeSc.exe
  C:\Windows\System\YzbSeSc.exe
  2⤵
  PID:7968
- C:\Windows\System\pGInqUy.exe
  C:\Windows\System\pGInqUy.exe
  2⤵
  PID:7992
- C:\Windows\System\sMHUurP.exe
  C:\Windows\System\sMHUurP.exe
  2⤵
  PID:8020
- C:\Windows\System\cJzxrsi.exe
  C:\Windows\System\cJzxrsi.exe
  2⤵
  PID:8076
- C:\Windows\System\sCSWWTn.exe
  C:\Windows\System\sCSWWTn.exe
  2⤵
  PID:8100
- C:\Windows\System\LUypFLy.exe
  C:\Windows\System\LUypFLy.exe
  2⤵
  PID:8116
- C:\Windows\System\osGDnyu.exe
  C:\Windows\System\osGDnyu.exe
  2⤵
  PID:8144
- C:\Windows\System\wKkglog.exe
  C:\Windows\System\wKkglog.exe
  2⤵
  PID:8160
- C:\Windows\System\nRalSWk.exe
  C:\Windows\System\nRalSWk.exe
  2⤵
  PID:8184
- C:\Windows\System\wDrKdrN.exe
  C:\Windows\System\wDrKdrN.exe
  2⤵
  PID:7236
- C:\Windows\System\edmhSLN.exe
  C:\Windows\System\edmhSLN.exe
  2⤵
  PID:7352
- C:\Windows\System\nftYUnM.exe
  C:\Windows\System\nftYUnM.exe
  2⤵
  PID:7396
- C:\Windows\System\eHOdGpI.exe
  C:\Windows\System\eHOdGpI.exe
  2⤵
  PID:7416
- C:\Windows\System\NpooNkT.exe
  C:\Windows\System\NpooNkT.exe
  2⤵
  PID:7476
- C:\Windows\System\orbBPGc.exe
  C:\Windows\System\orbBPGc.exe
  2⤵
  PID:7504
- C:\Windows\System\VMifUZv.exe
  C:\Windows\System\VMifUZv.exe
  2⤵
  PID:7612
- C:\Windows\System\PamdijX.exe
  C:\Windows\System\PamdijX.exe
  2⤵
  PID:7712
- C:\Windows\System\QqYtait.exe
  C:\Windows\System\QqYtait.exe
  2⤵
  PID:7804
- C:\Windows\System\KAXpeVt.exe
  C:\Windows\System\KAXpeVt.exe
  2⤵
  PID:7884
- C:\Windows\System\jXqtCsW.exe
  C:\Windows\System\jXqtCsW.exe
  2⤵
  PID:7940
- C:\Windows\System\XYUKXLN.exe
  C:\Windows\System\XYUKXLN.exe
  2⤵
  PID:7932
- C:\Windows\System\NDyqWRn.exe
  C:\Windows\System\NDyqWRn.exe
  2⤵
  PID:7956
- C:\Windows\System\bWLSTEW.exe
  C:\Windows\System\bWLSTEW.exe
  2⤵
  PID:8108
- C:\Windows\System\kYGEFQI.exe
  C:\Windows\System\kYGEFQI.exe
  2⤵
  PID:6752
- C:\Windows\System\FYgOBeB.exe
  C:\Windows\System\FYgOBeB.exe
  2⤵
  PID:7348
- C:\Windows\System\cSKYtQk.exe
  C:\Windows\System\cSKYtQk.exe
  2⤵
  PID:7532
- C:\Windows\System\epJNAKb.exe
  C:\Windows\System\epJNAKb.exe
  2⤵
  PID:7424
- C:\Windows\System\UOnGEvm.exe
  C:\Windows\System\UOnGEvm.exe
  2⤵
  PID:7676
- C:\Windows\System\FJiUCbi.exe
  C:\Windows\System\FJiUCbi.exe
  2⤵
  PID:7848
- C:\Windows\System\uuPgobQ.exe
  C:\Windows\System\uuPgobQ.exe
  2⤵
  PID:8084
- C:\Windows\System\sCtAVSR.exe
  C:\Windows\System\sCtAVSR.exe
  2⤵
  PID:2072
- C:\Windows\System\OsroRHf.exe
  C:\Windows\System\OsroRHf.exe
  2⤵
  PID:7560
- C:\Windows\System\dtFyBDu.exe
  C:\Windows\System\dtFyBDu.exe
  2⤵
  PID:7756
- C:\Windows\System\sLhXbah.exe
  C:\Windows\System\sLhXbah.exe
  2⤵
  PID:8132
- C:\Windows\System\RVcnaDb.exe
  C:\Windows\System\RVcnaDb.exe
  2⤵
  PID:7608
- C:\Windows\System\rpVtlYB.exe
  C:\Windows\System\rpVtlYB.exe
  2⤵
  PID:8200
- C:\Windows\System\cZYyYEP.exe
  C:\Windows\System\cZYyYEP.exe
  2⤵
  PID:8224
- C:\Windows\System\nyWMgrT.exe
  C:\Windows\System\nyWMgrT.exe
  2⤵
  PID:8252
- C:\Windows\System\wtQLtri.exe
  C:\Windows\System\wtQLtri.exe
  2⤵
  PID:8284
- C:\Windows\System\wVcHDuv.exe
  C:\Windows\System\wVcHDuv.exe
  2⤵
  PID:8320
- C:\Windows\System\aaZmPtf.exe
  C:\Windows\System\aaZmPtf.exe
  2⤵
  PID:8336
- C:\Windows\System\XUDafNA.exe
  C:\Windows\System\XUDafNA.exe
  2⤵
  PID:8364
- C:\Windows\System\EEoynur.exe
  C:\Windows\System\EEoynur.exe
  2⤵
  PID:8392
- C:\Windows\System\SIqQJuS.exe
  C:\Windows\System\SIqQJuS.exe
  2⤵
  PID:8432
- C:\Windows\System\SdeshIr.exe
  C:\Windows\System\SdeshIr.exe
  2⤵
  PID:8460
- C:\Windows\System\idiDrfx.exe
  C:\Windows\System\idiDrfx.exe
  2⤵
  PID:8476
- C:\Windows\System\ABJAraG.exe
  C:\Windows\System\ABJAraG.exe
  2⤵
  PID:8516
- C:\Windows\System\cdcTmBi.exe
  C:\Windows\System\cdcTmBi.exe
  2⤵
  PID:8544
- C:\Windows\System\qysKnOT.exe
  C:\Windows\System\qysKnOT.exe
  2⤵
  PID:8572
- C:\Windows\System\XfEKXsO.exe
  C:\Windows\System\XfEKXsO.exe
  2⤵
  PID:8592
- C:\Windows\System\MAOcbhk.exe
  C:\Windows\System\MAOcbhk.exe
  2⤵
  PID:8628
- C:\Windows\System\RpdvEhY.exe
  C:\Windows\System\RpdvEhY.exe
  2⤵
  PID:8656
- C:\Windows\System\VwMQchB.exe
  C:\Windows\System\VwMQchB.exe
  2⤵
  PID:8672
- C:\Windows\System\YdysFUO.exe
  C:\Windows\System\YdysFUO.exe
  2⤵
  PID:8712
- C:\Windows\System\dKNkHSn.exe
  C:\Windows\System\dKNkHSn.exe
  2⤵
  PID:8744
- C:\Windows\System\WmjvNty.exe
  C:\Windows\System\WmjvNty.exe
  2⤵
  PID:8772
- C:\Windows\System\VFIGSgr.exe
  C:\Windows\System\VFIGSgr.exe
  2⤵
  PID:8796
- C:\Windows\System\NXsCxWj.exe
  C:\Windows\System\NXsCxWj.exe
  2⤵
  PID:8816
- C:\Windows\System\zUqONDZ.exe
  C:\Windows\System\zUqONDZ.exe
  2⤵
  PID:8844
- C:\Windows\System\ptOHHff.exe
  C:\Windows\System\ptOHHff.exe
  2⤵
  PID:8884
- C:\Windows\System\TisYcgV.exe
  C:\Windows\System\TisYcgV.exe
  2⤵
  PID:8908
- C:\Windows\System\JkPRerd.exe
  C:\Windows\System\JkPRerd.exe
  2⤵
  PID:8928
- C:\Windows\System\VkyXuNQ.exe
  C:\Windows\System\VkyXuNQ.exe
  2⤵
  PID:8956
- C:\Windows\System\KuWPEvQ.exe
  C:\Windows\System\KuWPEvQ.exe
  2⤵
  PID:8984
- C:\Windows\System\iVvKeel.exe
  C:\Windows\System\iVvKeel.exe
  2⤵
  PID:9028
- C:\Windows\System\ANWqeNN.exe
  C:\Windows\System\ANWqeNN.exe
  2⤵
  PID:9056
- C:\Windows\System\PwzKHUc.exe
  C:\Windows\System\PwzKHUc.exe
  2⤵
  PID:9076
- C:\Windows\System\vsXTadS.exe
  C:\Windows\System\vsXTadS.exe
  2⤵
  PID:9100
- C:\Windows\System\BSsqpiw.exe
  C:\Windows\System\BSsqpiw.exe
  2⤵
  PID:9116
- C:\Windows\System\KFYXXNt.exe
  C:\Windows\System\KFYXXNt.exe
  2⤵
  PID:9148
- C:\Windows\System\bPwTerf.exe
  C:\Windows\System\bPwTerf.exe
  2⤵
  PID:9172
- C:\Windows\System\XLtDEZM.exe
  C:\Windows\System\XLtDEZM.exe
  2⤵
  PID:9200
- C:\Windows\System\vQliBKS.exe
  C:\Windows\System\vQliBKS.exe
  2⤵
  PID:8292
- C:\Windows\System\YnISKJx.exe
  C:\Windows\System\YnISKJx.exe
  2⤵
  PID:8312
- C:\Windows\System\TZLelYF.exe
  C:\Windows\System\TZLelYF.exe
  2⤵
  PID:8352
- C:\Windows\System\WceqIZP.exe
  C:\Windows\System\WceqIZP.exe
  2⤵
  PID:8428
- C:\Windows\System\cVbtkYL.exe
  C:\Windows\System\cVbtkYL.exe
  2⤵
  PID:8532
- C:\Windows\System\ePgPuGC.exe
  C:\Windows\System\ePgPuGC.exe
  2⤵
  PID:8600
- C:\Windows\System\dTcQAst.exe
  C:\Windows\System\dTcQAst.exe
  2⤵
  PID:8664
- C:\Windows\System\RsirJIJ.exe
  C:\Windows\System\RsirJIJ.exe
  2⤵
  PID:8736
- C:\Windows\System\noLLURN.exe
  C:\Windows\System\noLLURN.exe
  2⤵
  PID:8840
- C:\Windows\System\tzflAgS.exe
  C:\Windows\System\tzflAgS.exe
  2⤵
  PID:8860
- C:\Windows\System\iNMaNrO.exe
  C:\Windows\System\iNMaNrO.exe
  2⤵
  PID:8944
- C:\Windows\System\OwHwjqS.exe
  C:\Windows\System\OwHwjqS.exe
  2⤵
  PID:9052
- C:\Windows\System\CsEkJkQ.exe
  C:\Windows\System\CsEkJkQ.exe
  2⤵
  PID:9092
- C:\Windows\System\XCCHogx.exe
  C:\Windows\System\XCCHogx.exe
  2⤵
  PID:9188
- C:\Windows\System\YQfXUqs.exe
  C:\Windows\System\YQfXUqs.exe
  2⤵
  PID:8208
- C:\Windows\System\UhDFJwB.exe
  C:\Windows\System\UhDFJwB.exe
  2⤵
  PID:8388
- C:\Windows\System\sYEnHiB.exe
  C:\Windows\System\sYEnHiB.exe
  2⤵
  PID:8512
- C:\Windows\System\zFhmRnO.exe
  C:\Windows\System\zFhmRnO.exe
  2⤵
  PID:8640
- C:\Windows\System\beFAVOK.exe
  C:\Windows\System\beFAVOK.exe
  2⤵
  PID:8876
- C:\Windows\System\fKWYQej.exe
  C:\Windows\System\fKWYQej.exe
  2⤵
  PID:9040
- C:\Windows\System\TDKDrdl.exe
  C:\Windows\System\TDKDrdl.exe
  2⤵
  PID:9184
- C:\Windows\System\DCfgtqr.exe
  C:\Windows\System\DCfgtqr.exe
  2⤵
  PID:8828
- C:\Windows\System\mZtFzVK.exe
  C:\Windows\System\mZtFzVK.exe
  2⤵
  PID:8996
- C:\Windows\System\WLuzCoM.exe
  C:\Windows\System\WLuzCoM.exe
  2⤵
  PID:8612
- C:\Windows\System\EcFDvOU.exe
  C:\Windows\System\EcFDvOU.exe
  2⤵
  PID:9072
- C:\Windows\System\FosJNba.exe
  C:\Windows\System\FosJNba.exe
  2⤵
  PID:9236
- C:\Windows\System\PSEiPLb.exe
  C:\Windows\System\PSEiPLb.exe
  2⤵
  PID:9264
- C:\Windows\System\YPbTZFo.exe
  C:\Windows\System\YPbTZFo.exe
  2⤵
  PID:9292
- C:\Windows\System\rJMiQFT.exe
  C:\Windows\System\rJMiQFT.exe
  2⤵
  PID:9320
- C:\Windows\System\KFwAonm.exe
  C:\Windows\System\KFwAonm.exe
  2⤵
  PID:9348
- C:\Windows\System\JtapySH.exe
  C:\Windows\System\JtapySH.exe
  2⤵
  PID:9372
- C:\Windows\System\PuHrSYG.exe
  C:\Windows\System\PuHrSYG.exe
  2⤵
  PID:9416
- C:\Windows\System\CBZrNuT.exe
  C:\Windows\System\CBZrNuT.exe
  2⤵
  PID:9436
- C:\Windows\System\qdzPshv.exe
  C:\Windows\System\qdzPshv.exe
  2⤵
  PID:9464
- C:\Windows\System\rjuaxCE.exe
  C:\Windows\System\rjuaxCE.exe
  2⤵
  PID:9492
- C:\Windows\System\iPSEwuE.exe
  C:\Windows\System\iPSEwuE.exe
  2⤵
  PID:9508
- C:\Windows\System\mNTHKjH.exe
  C:\Windows\System\mNTHKjH.exe
  2⤵
  PID:9548
- C:\Windows\System\RCASUyW.exe
  C:\Windows\System\RCASUyW.exe
  2⤵
  PID:9564
- C:\Windows\System\shHXjgx.exe
  C:\Windows\System\shHXjgx.exe
  2⤵
  PID:9592
- C:\Windows\System\eTcupjV.exe
  C:\Windows\System\eTcupjV.exe
  2⤵
  PID:9620
- C:\Windows\System\qeUKbDS.exe
  C:\Windows\System\qeUKbDS.exe
  2⤵
  PID:9652
- C:\Windows\System\WSFZoJp.exe
  C:\Windows\System\WSFZoJp.exe
  2⤵
  PID:9688
- C:\Windows\System\XvBzesJ.exe
  C:\Windows\System\XvBzesJ.exe
  2⤵
  PID:9728
- C:\Windows\System\HODaBDH.exe
  C:\Windows\System\HODaBDH.exe
  2⤵
  PID:9756
- C:\Windows\System\jgeqzDn.exe
  C:\Windows\System\jgeqzDn.exe
  2⤵
  PID:9784
- C:\Windows\System\qeSEYdJ.exe
  C:\Windows\System\qeSEYdJ.exe
  2⤵
  PID:9812
- C:\Windows\System\facoFku.exe
  C:\Windows\System\facoFku.exe
  2⤵
  PID:9844
- C:\Windows\System\tVOepPO.exe
  C:\Windows\System\tVOepPO.exe
  2⤵
  PID:9860
- C:\Windows\System\TYanoAK.exe
  C:\Windows\System\TYanoAK.exe
  2⤵
  PID:9900
- C:\Windows\System\IbdZebZ.exe
  C:\Windows\System\IbdZebZ.exe
  2⤵
  PID:9932
- C:\Windows\System\WHDgAzV.exe
  C:\Windows\System\WHDgAzV.exe
  2⤵
  PID:9956
- C:\Windows\System\kOwrtQx.exe
  C:\Windows\System\kOwrtQx.exe
  2⤵
  PID:9988
- C:\Windows\System\TetuhOt.exe
  C:\Windows\System\TetuhOt.exe
  2⤵
  PID:10004
- C:\Windows\System\VAclbPH.exe
  C:\Windows\System\VAclbPH.exe
  2⤵
  PID:10044
- C:\Windows\System\GbLvPVI.exe
  C:\Windows\System\GbLvPVI.exe
  2⤵
  PID:10072
- C:\Windows\System\EoxVHAL.exe
  C:\Windows\System\EoxVHAL.exe
  2⤵
  PID:10100
- C:\Windows\System\uuCJVHv.exe
  C:\Windows\System\uuCJVHv.exe
  2⤵
  PID:10116
- C:\Windows\System\CgSDXhj.exe
  C:\Windows\System\CgSDXhj.exe
  2⤵
  PID:10156
- C:\Windows\System\JqdaydL.exe
  C:\Windows\System\JqdaydL.exe
  2⤵
  PID:10184
- C:\Windows\System\vOeNpLr.exe
  C:\Windows\System\vOeNpLr.exe
  2⤵
  PID:10212
- C:\Windows\System\sHCgeEM.exe
  C:\Windows\System\sHCgeEM.exe
  2⤵
  PID:10232
- C:\Windows\System\JpNEwRR.exe
  C:\Windows\System\JpNEwRR.exe
  2⤵
  PID:9284
- C:\Windows\System\ERmHIgZ.exe
  C:\Windows\System\ERmHIgZ.exe
  2⤵
  PID:9344
- C:\Windows\System\dIqPgQe.exe
  C:\Windows\System\dIqPgQe.exe
  2⤵
  PID:9404
- C:\Windows\System\ZBWrDAF.exe
  C:\Windows\System\ZBWrDAF.exe
  2⤵
  PID:9480
- C:\Windows\System\jYaxsqw.exe
  C:\Windows\System\jYaxsqw.exe
  2⤵
  PID:9528
- C:\Windows\System\wzRRnkX.exe
  C:\Windows\System\wzRRnkX.exe
  2⤵
  PID:9580
- C:\Windows\System\jdxXwJa.exe
  C:\Windows\System\jdxXwJa.exe
  2⤵
  PID:9632
- C:\Windows\System\GQZvPzJ.exe
  C:\Windows\System\GQZvPzJ.exe
  2⤵
  PID:9712
- C:\Windows\System\kMnOWWC.exe
  C:\Windows\System\kMnOWWC.exe
  2⤵
  PID:9796
- C:\Windows\System\oDDEAbr.exe
  C:\Windows\System\oDDEAbr.exe
  2⤵
  PID:9856
- C:\Windows\System\FIySbiB.exe
  C:\Windows\System\FIySbiB.exe
  2⤵
  PID:9920
- C:\Windows\System\UtTQNdd.exe
  C:\Windows\System\UtTQNdd.exe
  2⤵
  PID:9996
- C:\Windows\System\ahMnPka.exe
  C:\Windows\System\ahMnPka.exe
  2⤵
  PID:10068
- C:\Windows\System\xsCChsD.exe
  C:\Windows\System\xsCChsD.exe
  2⤵
  PID:10136
- C:\Windows\System\rNtPbBX.exe
  C:\Windows\System\rNtPbBX.exe
  2⤵
  PID:10168
- C:\Windows\System\dEEPKdu.exe
  C:\Windows\System\dEEPKdu.exe
  2⤵
  PID:10220
- C:\Windows\System\SAyphHQ.exe
  C:\Windows\System\SAyphHQ.exe
  2⤵
  PID:9392
- C:\Windows\System\WGtisWz.exe
  C:\Windows\System\WGtisWz.exe
  2⤵
  PID:9536
- C:\Windows\System\GAkWaQo.exe
  C:\Windows\System\GAkWaQo.exe
  2⤵
  PID:9708
- C:\Windows\System\FqyjsjN.exe
  C:\Windows\System\FqyjsjN.exe
  2⤵
  PID:9836
- C:\Windows\System\RqNijiU.exe
  C:\Windows\System\RqNijiU.exe
  2⤵
  PID:9952
- C:\Windows\System\IImyehw.exe
  C:\Windows\System\IImyehw.exe
  2⤵
  PID:10152
- C:\Windows\System\HwsqwSt.exe
  C:\Windows\System\HwsqwSt.exe
  2⤵
  PID:9452
- C:\Windows\System\tiTkTDm.exe
  C:\Windows\System\tiTkTDm.exe
  2⤵
  PID:9832
- C:\Windows\System\NCKouOX.exe
  C:\Windows\System\NCKouOX.exe
  2⤵
  PID:10056
- C:\Windows\System\tcIpQdA.exe
  C:\Windows\System\tcIpQdA.exe
  2⤵
  PID:10092
- C:\Windows\System\tUKQQpU.exe
  C:\Windows\System\tUKQQpU.exe
  2⤵
  PID:9840
- C:\Windows\System\pDfhIab.exe
  C:\Windows\System\pDfhIab.exe
  2⤵
  PID:10256
- C:\Windows\System\pGsdVSR.exe
  C:\Windows\System\pGsdVSR.exe
  2⤵
  PID:10304
- C:\Windows\System\JcfHLNy.exe
  C:\Windows\System\JcfHLNy.exe
  2⤵
  PID:10336
- C:\Windows\System\rZXJcTX.exe
  C:\Windows\System\rZXJcTX.exe
  2⤵
  PID:10364
- C:\Windows\System\fHdBSxO.exe
  C:\Windows\System\fHdBSxO.exe
  2⤵
  PID:10392
- C:\Windows\System\DqYjzti.exe
  C:\Windows\System\DqYjzti.exe
  2⤵
  PID:10420
- C:\Windows\System\WNHEWeN.exe
  C:\Windows\System\WNHEWeN.exe
  2⤵
  PID:10440
- C:\Windows\System\EkusPlM.exe
  C:\Windows\System\EkusPlM.exe
  2⤵
  PID:10464
- C:\Windows\System\reLlnEs.exe
  C:\Windows\System\reLlnEs.exe
  2⤵
  PID:10504
- C:\Windows\System\WerzzPh.exe
  C:\Windows\System\WerzzPh.exe
  2⤵
  PID:10528
- C:\Windows\System\GgQAyyn.exe
  C:\Windows\System\GgQAyyn.exe
  2⤵
  PID:10548
- C:\Windows\System\klMItNE.exe
  C:\Windows\System\klMItNE.exe
  2⤵
  PID:10588
- C:\Windows\System\FmytwGC.exe
  C:\Windows\System\FmytwGC.exe
  2⤵
  PID:10604
- C:\Windows\System\SHkNgGl.exe
  C:\Windows\System\SHkNgGl.exe
  2⤵
  PID:10632
- C:\Windows\System\itziIQV.exe
  C:\Windows\System\itziIQV.exe
  2⤵
  PID:10660
- C:\Windows\System\gyZMuUS.exe
  C:\Windows\System\gyZMuUS.exe
  2⤵
  PID:10676
- C:\Windows\System\MkviniS.exe
  C:\Windows\System\MkviniS.exe
  2⤵
  PID:10692
- C:\Windows\System\gyyGaRq.exe
  C:\Windows\System\gyyGaRq.exe
  2⤵
  PID:10716
- C:\Windows\System\SStDLGA.exe
  C:\Windows\System\SStDLGA.exe
  2⤵
  PID:10744
- C:\Windows\System\bizRxSC.exe
  C:\Windows\System\bizRxSC.exe
  2⤵
  PID:10796
- C:\Windows\System\idJrghF.exe
  C:\Windows\System\idJrghF.exe
  2⤵
  PID:10840
- C:\Windows\System\ydxbvfQ.exe
  C:\Windows\System\ydxbvfQ.exe
  2⤵
  PID:10860
- C:\Windows\System\ONKYPGx.exe
  C:\Windows\System\ONKYPGx.exe
  2⤵
  PID:10884
- C:\Windows\System\cURbkkZ.exe
  C:\Windows\System\cURbkkZ.exe
  2⤵
  PID:10928
- C:\Windows\System\PmWrdhJ.exe
  C:\Windows\System\PmWrdhJ.exe
  2⤵
  PID:10956
- C:\Windows\System\iQDGUMG.exe
  C:\Windows\System\iQDGUMG.exe
  2⤵
  PID:10972
- C:\Windows\System\dMYBMdB.exe
  C:\Windows\System\dMYBMdB.exe
  2⤵
  PID:11000
- C:\Windows\System\hjlrXrQ.exe
  C:\Windows\System\hjlrXrQ.exe
  2⤵
  PID:11040
- C:\Windows\System\zIauzQv.exe
  C:\Windows\System\zIauzQv.exe
  2⤵
  PID:11056
- C:\Windows\System\TfgNgAh.exe
  C:\Windows\System\TfgNgAh.exe
  2⤵
  PID:11088
- C:\Windows\System\UqzDBKU.exe
  C:\Windows\System\UqzDBKU.exe
  2⤵
  PID:11112
- C:\Windows\System\BbRRlEw.exe
  C:\Windows\System\BbRRlEw.exe
  2⤵
  PID:11132
- C:\Windows\System\zDwBlKK.exe
  C:\Windows\System\zDwBlKK.exe
  2⤵
  PID:11180
- C:\Windows\System\NROfqLc.exe
  C:\Windows\System\NROfqLc.exe
  2⤵
  PID:11208
- C:\Windows\System\nBrsGiW.exe
  C:\Windows\System\nBrsGiW.exe
  2⤵
  PID:11236
- C:\Windows\System\FvsYsRQ.exe
  C:\Windows\System\FvsYsRQ.exe
  2⤵
  PID:9672
- C:\Windows\System\AGpQcme.exe
  C:\Windows\System\AGpQcme.exe
  2⤵
  PID:10276
- C:\Windows\System\bxMxhdF.exe
  C:\Windows\System\bxMxhdF.exe
  2⤵
  PID:10348
- C:\Windows\System\vVqjOTb.exe
  C:\Windows\System\vVqjOTb.exe
  2⤵
  PID:10376
- C:\Windows\System\KbzyJDs.exe
  C:\Windows\System\KbzyJDs.exe
  2⤵
  PID:10456
- C:\Windows\System\peqhVyU.exe
  C:\Windows\System\peqhVyU.exe
  2⤵
  PID:10512
- C:\Windows\System\iLMpoyp.exe
  C:\Windows\System\iLMpoyp.exe
  2⤵
  PID:10564
- C:\Windows\System\Rqbqico.exe
  C:\Windows\System\Rqbqico.exe
  2⤵
  PID:10652
- C:\Windows\System\SJjJMBt.exe
  C:\Windows\System\SJjJMBt.exe
  2⤵
  PID:10688
- C:\Windows\System\QcQQkVZ.exe
  C:\Windows\System\QcQQkVZ.exe
  2⤵
  PID:10712
- C:\Windows\System\sIItNSi.exe
  C:\Windows\System\sIItNSi.exe
  2⤵
  PID:10812
- C:\Windows\System\dyUrtnd.exe
  C:\Windows\System\dyUrtnd.exe
  2⤵
  PID:10880
- C:\Windows\System\ASXKmnk.exe
  C:\Windows\System\ASXKmnk.exe
  2⤵
  PID:2888
- C:\Windows\System\XJRKLah.exe
  C:\Windows\System\XJRKLah.exe
  2⤵
  PID:10964
- C:\Windows\System\izdrIgs.exe
  C:\Windows\System\izdrIgs.exe
  2⤵
  PID:11048
- C:\Windows\System\sYonmsJ.exe
  C:\Windows\System\sYonmsJ.exe
  2⤵
  PID:11120
- C:\Windows\System\mNzDrxY.exe
  C:\Windows\System\mNzDrxY.exe
  2⤵
  PID:11176
- C:\Windows\System\bmhtzwP.exe
  C:\Windows\System\bmhtzwP.exe
  2⤵
  PID:11248
- C:\Windows\System\DZEaGUH.exe
  C:\Windows\System\DZEaGUH.exe
  2⤵
  PID:10320
- C:\Windows\System\OuugQLH.exe
  C:\Windows\System\OuugQLH.exe
  2⤵
  PID:10488
- C:\Windows\System\tYqwhSC.exe
  C:\Windows\System\tYqwhSC.exe
  2⤵
  PID:10600
- C:\Windows\System\nQcolwr.exe
  C:\Windows\System\nQcolwr.exe
  2⤵
  PID:10704
- C:\Windows\System\XLVYGEX.exe
  C:\Windows\System\XLVYGEX.exe
  2⤵
  PID:10904
- C:\Windows\System\hLAtGbg.exe
  C:\Windows\System\hLAtGbg.exe
  2⤵
  PID:11016
- C:\Windows\System\tOJgAHo.exe
  C:\Windows\System\tOJgAHo.exe
  2⤵
  PID:11096
- C:\Windows\System\SPpjwkq.exe
  C:\Windows\System\SPpjwkq.exe
  2⤵
  PID:10248
- C:\Windows\System\pxLJvwY.exe
  C:\Windows\System\pxLJvwY.exe
  2⤵
  PID:10536
- C:\Windows\System\SVZOZjC.exe
  C:\Windows\System\SVZOZjC.exe
  2⤵
  PID:10948
- C:\Windows\System\EmSvgkv.exe
  C:\Windows\System\EmSvgkv.exe
  2⤵
  PID:11228
- C:\Windows\System\nZcTCHe.exe
  C:\Windows\System\nZcTCHe.exe
  2⤵
  PID:10728
- C:\Windows\System\tdoATJz.exe
  C:\Windows\System\tdoATJz.exe
  2⤵
  PID:10200
- C:\Windows\System\bHwWwnL.exe
  C:\Windows\System\bHwWwnL.exe
  2⤵
  PID:11272
- C:\Windows\System\ECqEPGe.exe
  C:\Windows\System\ECqEPGe.exe
  2⤵
  PID:11308
- C:\Windows\System\CTeDZgH.exe
  C:\Windows\System\CTeDZgH.exe
  2⤵
  PID:11336
- C:\Windows\System\JXuHGQe.exe
  C:\Windows\System\JXuHGQe.exe
  2⤵
  PID:11352
- C:\Windows\System\uHfehfs.exe
  C:\Windows\System\uHfehfs.exe
  2⤵
  PID:11408
- C:\Windows\System\KAGcWRx.exe
  C:\Windows\System\KAGcWRx.exe
  2⤵
  PID:11436
- C:\Windows\System\JKcqNDV.exe
  C:\Windows\System\JKcqNDV.exe
  2⤵
  PID:11464
- C:\Windows\System\YpLxAFu.exe
  C:\Windows\System\YpLxAFu.exe
  2⤵
  PID:11480
- C:\Windows\System\EVrIsFB.exe
  C:\Windows\System\EVrIsFB.exe
  2⤵
  PID:11504
- C:\Windows\System\MPpQnUz.exe
  C:\Windows\System\MPpQnUz.exe
  2⤵
  PID:11536
- C:\Windows\System\pRdxvbP.exe
  C:\Windows\System\pRdxvbP.exe
  2⤵
  PID:11552
- C:\Windows\System\lqfNPTr.exe
  C:\Windows\System\lqfNPTr.exe
  2⤵
  PID:11584
- C:\Windows\System\tTKSsUW.exe
  C:\Windows\System\tTKSsUW.exe
  2⤵
  PID:11616
- C:\Windows\System\RGOwwNC.exe
  C:\Windows\System\RGOwwNC.exe
  2⤵
  PID:11652
- C:\Windows\System\MCJJGNS.exe
  C:\Windows\System\MCJJGNS.exe
  2⤵
  PID:11676
- C:\Windows\System\HYjVGsV.exe
  C:\Windows\System\HYjVGsV.exe
  2⤵
  PID:11704
- C:\Windows\System\lTGumwS.exe
  C:\Windows\System\lTGumwS.exe
  2⤵
  PID:11744
- C:\Windows\System\ACGwIXK.exe
  C:\Windows\System\ACGwIXK.exe
  2⤵
  PID:11772
- C:\Windows\System\IHAlTWx.exe
  C:\Windows\System\IHAlTWx.exe
  2⤵
  PID:11796
- C:\Windows\System\Mgujqur.exe
  C:\Windows\System\Mgujqur.exe
  2⤵
  PID:11828
- C:\Windows\System\jDyUVWM.exe
  C:\Windows\System\jDyUVWM.exe
  2⤵
  PID:11856
- C:\Windows\System\GQFLTgG.exe
  C:\Windows\System\GQFLTgG.exe
  2⤵
  PID:11884
- C:\Windows\System\UEIASYw.exe
  C:\Windows\System\UEIASYw.exe
  2⤵
  PID:11912
- C:\Windows\System\IvytMHh.exe
  C:\Windows\System\IvytMHh.exe
  2⤵
  PID:11940
- C:\Windows\System\PdWsjLW.exe
  C:\Windows\System\PdWsjLW.exe
  2⤵
  PID:11968
- C:\Windows\System\UmBHMyz.exe
  C:\Windows\System\UmBHMyz.exe
  2⤵
  PID:11996
- C:\Windows\System\anwITMx.exe
  C:\Windows\System\anwITMx.exe
  2⤵
  PID:12012
- C:\Windows\System\qSyKYaQ.exe
  C:\Windows\System\qSyKYaQ.exe
  2⤵
  PID:12040
- C:\Windows\System\obCMFIE.exe
  C:\Windows\System\obCMFIE.exe
  2⤵
  PID:12068
- C:\Windows\System\CzdDjDY.exe
  C:\Windows\System\CzdDjDY.exe
  2⤵
  PID:12096
- C:\Windows\System\OWMVkCW.exe
  C:\Windows\System\OWMVkCW.exe
  2⤵
  PID:12120
- C:\Windows\System\DOyVKib.exe
  C:\Windows\System\DOyVKib.exe
  2⤵
  PID:12152
- C:\Windows\System\NAGVEVO.exe
  C:\Windows\System\NAGVEVO.exe
  2⤵
  PID:12180
- C:\Windows\System\pAVyzVO.exe
  C:\Windows\System\pAVyzVO.exe
  2⤵
  PID:12208
- C:\Windows\System\eWUyIKT.exe
  C:\Windows\System\eWUyIKT.exe
  2⤵
  PID:12236
- C:\Windows\System\uDazKva.exe
  C:\Windows\System\uDazKva.exe
  2⤵
  PID:12264
- C:\Windows\System\TVhfIne.exe
  C:\Windows\System\TVhfIne.exe
  2⤵
  PID:11280
- C:\Windows\System\PnSvsJg.exe
  C:\Windows\System\PnSvsJg.exe
  2⤵
  PID:11348
- C:\Windows\System\nKcunaU.exe
  C:\Windows\System\nKcunaU.exe
  2⤵
  PID:11384
- C:\Windows\System\hWjsdBd.exe
  C:\Windows\System\hWjsdBd.exe
  2⤵
  PID:11456
- C:\Windows\System\ZtuJbev.exe
  C:\Windows\System\ZtuJbev.exe
  2⤵
  PID:11524
- C:\Windows\System\GcsvDLq.exe
  C:\Windows\System\GcsvDLq.exe
  2⤵
  PID:11592
- C:\Windows\System\pRjPOjM.exe
  C:\Windows\System\pRjPOjM.exe
  2⤵
  PID:11608
- C:\Windows\System\prcANfo.exe
  C:\Windows\System\prcANfo.exe
  2⤵
  PID:11716
- C:\Windows\System\zsNnMcb.exe
  C:\Windows\System\zsNnMcb.exe
  2⤵
  PID:11756
- C:\Windows\System\HUxVbDt.exe
  C:\Windows\System\HUxVbDt.exe
  2⤵
  PID:11792
- C:\Windows\System\rAKsEgl.exe
  C:\Windows\System\rAKsEgl.exe
  2⤵
  PID:11896
- C:\Windows\System\qrDtbnB.exe
  C:\Windows\System\qrDtbnB.exe
  2⤵
  PID:12004
- C:\Windows\System\GOzfhTP.exe
  C:\Windows\System\GOzfhTP.exe
  2⤵
  PID:12112
- C:\Windows\System\iMDyGiC.exe
  C:\Windows\System\iMDyGiC.exe
  2⤵
  PID:12144
- C:\Windows\System\tJvlDar.exe
  C:\Windows\System\tJvlDar.exe
  2⤵
  PID:12168
- C:\Windows\System\pdIkTaP.exe
  C:\Windows\System\pdIkTaP.exe
  2⤵
  PID:12228
- C:\Windows\System\gadKvyn.exe
  C:\Windows\System\gadKvyn.exe
  2⤵
  PID:12252
- C:\Windows\System\vxwYmMW.exe
  C:\Windows\System\vxwYmMW.exe
  2⤵
  PID:11380
- C:\Windows\System\ThscyTx.exe
  C:\Windows\System\ThscyTx.exe
  2⤵
  PID:11632
- C:\Windows\System\seuQHlS.exe
  C:\Windows\System\seuQHlS.exe
  2⤵
  PID:11732
- C:\Windows\System\FvCvbQr.exe
  C:\Windows\System\FvCvbQr.exe
  2⤵
  PID:11956
- C:\Windows\System\ZTsuDJU.exe
  C:\Windows\System\ZTsuDJU.exe
  2⤵
  PID:12056
- C:\Windows\System\jUIJDAo.exe
  C:\Windows\System\jUIJDAo.exe
  2⤵
  PID:12192
- C:\Windows\System\vbGJTrB.exe
  C:\Windows\System\vbGJTrB.exe
  2⤵
  PID:11688
- C:\Windows\System\BWJGGxR.exe
  C:\Windows\System\BWJGGxR.exe
  2⤵
  PID:11852
- C:\Windows\System\fImdSvE.exe
  C:\Windows\System\fImdSvE.exe
  2⤵
  PID:11344
- C:\Windows\System\LiDwmtl.exe
  C:\Windows\System\LiDwmtl.exe
  2⤵
  PID:12104
- C:\Windows\System\tNdVCOM.exe
  C:\Windows\System\tNdVCOM.exe
  2⤵
  PID:12300
- C:\Windows\System\MEJbykD.exe
  C:\Windows\System\MEJbykD.exe
  2⤵
  PID:12324
- C:\Windows\System\ruIqVem.exe
  C:\Windows\System\ruIqVem.exe
  2⤵
  PID:12344
- C:\Windows\System\xrfKmqg.exe
  C:\Windows\System\xrfKmqg.exe
  2⤵
  PID:12376
- C:\Windows\System\hLMywwz.exe
  C:\Windows\System\hLMywwz.exe
  2⤵
  PID:12416
- C:\Windows\System\HMFgJGv.exe
  C:\Windows\System\HMFgJGv.exe
  2⤵
  PID:12444
- C:\Windows\System\rUCiidw.exe
  C:\Windows\System\rUCiidw.exe
  2⤵
  PID:12460
- C:\Windows\System\SikgLbb.exe
  C:\Windows\System\SikgLbb.exe
  2⤵
  PID:12488
- C:\Windows\System\vFIweyh.exe
  C:\Windows\System\vFIweyh.exe
  2⤵
  PID:12516
- C:\Windows\System\eLqCjji.exe
  C:\Windows\System\eLqCjji.exe
  2⤵
  PID:12556
- C:\Windows\System\JYBAkIw.exe
  C:\Windows\System\JYBAkIw.exe
  2⤵
  PID:12584
- C:\Windows\System\cIUKYkQ.exe
  C:\Windows\System\cIUKYkQ.exe
  2⤵
  PID:12600
- C:\Windows\System\JhMwiNn.exe
  C:\Windows\System\JhMwiNn.exe
  2⤵
  PID:12640
- C:\Windows\System\StYiXmb.exe
  C:\Windows\System\StYiXmb.exe
  2⤵
  PID:12660
- C:\Windows\System\ivsWUkB.exe
  C:\Windows\System\ivsWUkB.exe
  2⤵
  PID:12696
- C:\Windows\System\NTBZYKf.exe
  C:\Windows\System\NTBZYKf.exe
  2⤵
  PID:12724
- C:\Windows\System\YGtacDg.exe
  C:\Windows\System\YGtacDg.exe
  2⤵
  PID:12752
- C:\Windows\System\HNrDdAP.exe
  C:\Windows\System\HNrDdAP.exe
  2⤵
  PID:12780
- C:\Windows\System\vVfQolS.exe
  C:\Windows\System\vVfQolS.exe
  2⤵
  PID:12796
- C:\Windows\System\JfwCbtI.exe
  C:\Windows\System\JfwCbtI.exe
  2⤵
  PID:12816
- C:\Windows\System\biuigvo.exe
  C:\Windows\System\biuigvo.exe
  2⤵
  PID:12860
- C:\Windows\System\xosxCfx.exe
  C:\Windows\System\xosxCfx.exe
  2⤵
  PID:12880
- C:\Windows\System\kOOARXS.exe
  C:\Windows\System\kOOARXS.exe
  2⤵
  PID:12912
- C:\Windows\System\KkSlCrA.exe
  C:\Windows\System\KkSlCrA.exe
  2⤵
  PID:12936
- C:\Windows\System\Jieeymn.exe
  C:\Windows\System\Jieeymn.exe
  2⤵
  PID:12972
- C:\Windows\System\lUVAjnv.exe
  C:\Windows\System\lUVAjnv.exe
  2⤵
  PID:13004
- C:\Windows\System\swYLpjT.exe
  C:\Windows\System\swYLpjT.exe
  2⤵
  PID:13024
- C:\Windows\System\hfnQFXY.exe
  C:\Windows\System\hfnQFXY.exe
  2⤵
  PID:13048
- C:\Windows\System\yXnuwmL.exe
  C:\Windows\System\yXnuwmL.exe
  2⤵
  PID:13072
- C:\Windows\System\dnjJGLJ.exe
  C:\Windows\System\dnjJGLJ.exe
  2⤵
  PID:13104
- C:\Windows\System\jRiIcZW.exe
  C:\Windows\System\jRiIcZW.exe
  2⤵
  PID:13132
- C:\Windows\System\DZflmTW.exe
  C:\Windows\System\DZflmTW.exe
  2⤵
  PID:13148
- C:\Windows\System\QBAIUDR.exe
  C:\Windows\System\QBAIUDR.exe
  2⤵
  PID:13180
- C:\Windows\System\mtpHHnm.exe
  C:\Windows\System\mtpHHnm.exe
  2⤵
  PID:13212
- C:\Windows\System\mbgQNqA.exe
  C:\Windows\System\mbgQNqA.exe
  2⤵
  PID:13256
- C:\Windows\System\BmQmGWW.exe
  C:\Windows\System\BmQmGWW.exe
  2⤵
  PID:13284
- C:\Windows\System\eVbBaFH.exe
  C:\Windows\System\eVbBaFH.exe
  2⤵
  PID:13300
- C:\Windows\System\pUSQVMK.exe
  C:\Windows\System\pUSQVMK.exe
  2⤵
  PID:12308
- C:\Windows\System\UzwWVqG.exe
  C:\Windows\System\UzwWVqG.exe
  2⤵
  PID:12372
- C:\Windows\System\mSVsECY.exe
  C:\Windows\System\mSVsECY.exe
  2⤵
  PID:12428
- C:\Windows\System\jLDdJjr.exe
  C:\Windows\System\jLDdJjr.exe
  2⤵
  PID:12480
- C:\Windows\System\RWeXNLB.exe
  C:\Windows\System\RWeXNLB.exe
  2⤵
  PID:12576
- C:\Windows\System\YmDGWyL.exe
  C:\Windows\System\YmDGWyL.exe
  2⤵
  PID:12636
- C:\Windows\System\ZfjXGjy.exe
  C:\Windows\System\ZfjXGjy.exe
  2⤵
  PID:12712
- C:\Windows\System\hNnYYmZ.exe
  C:\Windows\System\hNnYYmZ.exe
  2⤵
  PID:12764
- C:\Windows\System\LlgzMzf.exe
  C:\Windows\System\LlgzMzf.exe
  2⤵
  PID:12804
- C:\Windows\System\FQvKyiW.exe
  C:\Windows\System\FQvKyiW.exe
  2⤵
  PID:12892
- C:\Windows\System\NOdeIvu.exe
  C:\Windows\System\NOdeIvu.exe
  2⤵
  PID:12928
- C:\Windows\System\pIhRslN.exe
  C:\Windows\System\pIhRslN.exe
  2⤵
  PID:13064
- C:\Windows\System\Ekflmdv.exe
  C:\Windows\System\Ekflmdv.exe
  2⤵
  PID:13116
- C:\Windows\System\EvaZdQt.exe
  C:\Windows\System\EvaZdQt.exe
  2⤵
  PID:13196
- C:\Windows\System\uptCcAV.exe
  C:\Windows\System\uptCcAV.exe
  2⤵
  PID:13228
- C:\Windows\System\RtsKzlg.exe
  C:\Windows\System\RtsKzlg.exe
  2⤵
  PID:13296
- C:\Windows\System\rpfluVz.exe
  C:\Windows\System\rpfluVz.exe
  2⤵
  PID:12440
- C:\Windows\System\xLniEVK.exe
  C:\Windows\System\xLniEVK.exe
  2⤵
  PID:12508
- C:\Windows\System\hNCFCzX.exe
  C:\Windows\System\hNCFCzX.exe
  2⤵
  PID:12688
- C:\Windows\System\GWELqNT.exe
  C:\Windows\System\GWELqNT.exe
  2⤵
  PID:12856
- C:\Windows\System\VUZnSkR.exe
  C:\Windows\System\VUZnSkR.exe
  2⤵
  PID:13044
- C:\Windows\System\eOpoGoQ.exe
  C:\Windows\System\eOpoGoQ.exe
  2⤵
  PID:13168
- C:\Windows\System\wrrMULZ.exe
  C:\Windows\System\wrrMULZ.exe
  2⤵
  PID:13272
- C:\Windows\System\foFKLnr.exe
  C:\Windows\System\foFKLnr.exe
  2⤵
  PID:12532
- C:\Windows\System\ZecPyJB.exe
  C:\Windows\System\ZecPyJB.exe
  2⤵
  PID:13040
- C:\Windows\System\ihgodZM.exe
  C:\Windows\System\ihgodZM.exe
  2⤵
  PID:13200
- C:\Windows\System\saemrxu.exe
  C:\Windows\System\saemrxu.exe
  2⤵
  PID:12624
- C:\Windows\System\syDErfn.exe
  C:\Windows\System\syDErfn.exe
  2⤵
  PID:13332
- C:\Windows\System\VNHHODm.exe
  C:\Windows\System\VNHHODm.exe
  2⤵
  PID:13364
- C:\Windows\System\bVkBvQb.exe
  C:\Windows\System\bVkBvQb.exe
  2⤵
  PID:13396
- C:\Windows\System\PMWzYbW.exe
  C:\Windows\System\PMWzYbW.exe
  2⤵
  PID:13420
- C:\Windows\System\yvIyyGB.exe
  C:\Windows\System\yvIyyGB.exe
  2⤵
  PID:13476
- C:\Windows\System\JJBLMpr.exe
  C:\Windows\System\JJBLMpr.exe
  2⤵
  PID:13496
- C:\Windows\System\YtEKHni.exe
  C:\Windows\System\YtEKHni.exe
  2⤵
  PID:13532
- C:\Windows\System\kxGeAUS.exe
  C:\Windows\System\kxGeAUS.exe
  2⤵
  PID:13552
- C:\Windows\System\pfOGeqz.exe
  C:\Windows\System\pfOGeqz.exe
  2⤵
  PID:13576
- C:\Windows\System\YbKzMEp.exe
  C:\Windows\System\YbKzMEp.exe
  2⤵
  PID:13592
- C:\Windows\System\LLsAJBZ.exe
  C:\Windows\System\LLsAJBZ.exe
  2⤵
  PID:13624
- C:\Windows\System\WVQmXUO.exe
  C:\Windows\System\WVQmXUO.exe
  2⤵
  PID:13660
- C:\Windows\System\fTYsBAb.exe
  C:\Windows\System\fTYsBAb.exe
  2⤵
  PID:13676
- C:\Windows\System\NxoJGNQ.exe
  C:\Windows\System\NxoJGNQ.exe
  2⤵
  PID:13728
- C:\Windows\System\KGCGGbf.exe
  C:\Windows\System\KGCGGbf.exe
  2⤵
  PID:13756
- C:\Windows\System\EDsdzjc.exe
  C:\Windows\System\EDsdzjc.exe
  2⤵
  PID:13772
- C:\Windows\System\duEKDEQ.exe
  C:\Windows\System\duEKDEQ.exe
  2⤵
  PID:13788
- C:\Windows\System\FfRWDoy.exe
  C:\Windows\System\FfRWDoy.exe
  2⤵
  PID:13832
- C:\Windows\System\MbrHroP.exe
  C:\Windows\System\MbrHroP.exe
  2⤵
  PID:13856
- C:\Windows\System\bQVlxEd.exe
  C:\Windows\System\bQVlxEd.exe
  2⤵
  PID:13872
- C:\Windows\System\Arpmuoo.exe
  C:\Windows\System\Arpmuoo.exe
  2⤵
  PID:13900
- C:\Windows\System\BgKRDkK.exe
  C:\Windows\System\BgKRDkK.exe
  2⤵
  PID:13932
- C:\Windows\System\mljnwFR.exe
  C:\Windows\System\mljnwFR.exe
  2⤵
  PID:13956
- C:\Windows\System\nghNeEJ.exe
  C:\Windows\System\nghNeEJ.exe
  2⤵
  PID:13972
- C:\Windows\System\OPiyNvb.exe
  C:\Windows\System\OPiyNvb.exe
  2⤵
  PID:14000
- C:\Windows\System\fEYbonW.exe
  C:\Windows\System\fEYbonW.exe
  2⤵
  PID:14028
- C:\Windows\System\uitgWgD.exe
  C:\Windows\System\uitgWgD.exe
  2⤵
  PID:14052
- C:\Windows\System\HYevcKH.exe
  C:\Windows\System\HYevcKH.exe
  2⤵
  PID:14072
- C:\Windows\System\ZkHDgGQ.exe
  C:\Windows\System\ZkHDgGQ.exe
  2⤵
  PID:14120
- C:\Windows\System\szDFirv.exe
  C:\Windows\System\szDFirv.exe
  2⤵
  PID:14176
- C:\Windows\System\bDUWqHY.exe
  C:\Windows\System\bDUWqHY.exe
  2⤵
  PID:14192
- C:\Windows\System\VOIZsQq.exe
  C:\Windows\System\VOIZsQq.exe
  2⤵
  PID:14232
- C:\Windows\System\RliyorS.exe
  C:\Windows\System\RliyorS.exe
  2⤵
  PID:14252
- C:\Windows\System\zcJXYFQ.exe
  C:\Windows\System\zcJXYFQ.exe
  2⤵
  PID:14280
- C:\Windows\System\tCVLnsf.exe
  C:\Windows\System\tCVLnsf.exe
  2⤵
  PID:14316
- C:\Windows\System\DopdhBg.exe
  C:\Windows\System\DopdhBg.exe
  2⤵
  PID:14332
- C:\Windows\System\dVSvelB.exe
  C:\Windows\System\dVSvelB.exe
  2⤵
  PID:13188
- C:\Windows\System\MGWYWyu.exe
  C:\Windows\System\MGWYWyu.exe
  2⤵
  PID:13416
- C:\Windows\System\tVYDkGv.exe
  C:\Windows\System\tVYDkGv.exe
  2⤵
  PID:13492
- C:\Windows\System\zEkeVUF.exe
  C:\Windows\System\zEkeVUF.exe
  2⤵
  PID:13560
- C:\Windows\System\dxToBFA.exe
  C:\Windows\System\dxToBFA.exe
  2⤵
  PID:13604
- C:\Windows\System\oAaShAS.exe
  C:\Windows\System\oAaShAS.exe
  2⤵
  PID:13700
- C:\Windows\System\rLAMUGM.exe
  C:\Windows\System\rLAMUGM.exe
  2⤵
  PID:13752
- C:\Windows\System\efoucKK.exe
  C:\Windows\System\efoucKK.exe
  2⤵
  PID:13784
- C:\Windows\System\ZHIwOSk.exe
  C:\Windows\System\ZHIwOSk.exe
  2⤵
  PID:13868
- C:\Windows\System\sGRWjyn.exe
  C:\Windows\System\sGRWjyn.exe
  2⤵
  PID:13952
- C:\Windows\System\UpyNjkw.exe
  C:\Windows\System\UpyNjkw.exe
  2⤵
  PID:14036
- C:\Windows\System\tQnogzQ.exe
  C:\Windows\System\tQnogzQ.exe
  2⤵
  PID:14020
- C:\Windows\System\pyYMeqz.exe
  C:\Windows\System\pyYMeqz.exe
  2⤵
  PID:14112
- C:\Windows\System\SbrpMKi.exe
  C:\Windows\System\SbrpMKi.exe
  2⤵
  PID:14160
- C:\Windows\System\XMrVQrI.exe
  C:\Windows\System\XMrVQrI.exe
  2⤵
  PID:14260
- C:\Windows\System\PiIKyEF.exe
  C:\Windows\System\PiIKyEF.exe
  2⤵
  PID:14324
- C:\Windows\System\Lvuszxp.exe
  C:\Windows\System\Lvuszxp.exe
  2⤵
  PID:13320
- C:\Windows\System\UbovNll.exe
  C:\Windows\System\UbovNll.exe
  2⤵
  PID:13516
- C:\Windows\System\SnfLglr.exe
  C:\Windows\System\SnfLglr.exe
  2⤵
  PID:13720
- C:\Windows\System\ssjqykC.exe
  C:\Windows\System\ssjqykC.exe
  2⤵
  PID:13820
- C:\Windows\System\mfODWAf.exe
  C:\Windows\System\mfODWAf.exe
  2⤵
  PID:13984
- C:\Windows\System\MmJRisR.exe
  C:\Windows\System\MmJRisR.exe
  2⤵
  PID:14108
- C:\Windows\System\pWqGIAY.exe
  C:\Windows\System\pWqGIAY.exe
  2⤵
  PID:13392
- C:\Windows\System\ImqlalV.exe
  C:\Windows\System\ImqlalV.exe
  2⤵
  PID:13740
- C:\Windows\System\goySfsu.exe
  C:\Windows\System\goySfsu.exe
  2⤵
  PID:13824
- C:\Windows\System\PFtASSp.exe
  C:\Windows\System\PFtASSp.exe
  2⤵
  PID:13588
- C:\Windows\System\ceqSWSe.exe
  C:\Windows\System\ceqSWSe.exe
  2⤵
  PID:14240
- C:\Windows\System\rdyBftz.exe
  C:\Windows\System\rdyBftz.exe
  2⤵
  PID:14352
- C:\Windows\System\fhJtaTB.exe
  C:\Windows\System\fhJtaTB.exe
  2⤵
  PID:14368
- C:\Windows\System\iMRAMjT.exe
  C:\Windows\System\iMRAMjT.exe
  2⤵
  PID:14408
- C:\Windows\System\VTDPFDx.exe
  C:\Windows\System\VTDPFDx.exe
  2⤵
  PID:14436
- C:\Windows\System\pzdDgzI.exe
  C:\Windows\System\pzdDgzI.exe
  2⤵
  PID:14464
- C:\Windows\System\xhKKsYH.exe
  C:\Windows\System\xhKKsYH.exe
  2⤵
  PID:14480
- C:\Windows\System\SdRVSWH.exe
  C:\Windows\System\SdRVSWH.exe
  2⤵
  PID:14496
- C:\Windows\System\MglEeBe.exe
  C:\Windows\System\MglEeBe.exe
  2⤵
  PID:14544
- C:\Windows\System\njrkACN.exe
  C:\Windows\System\njrkACN.exe
  2⤵
  PID:14560
- C:\Windows\System\DhxmTlD.exe
  C:\Windows\System\DhxmTlD.exe
  2⤵
  PID:14588
- C:\Windows\System\VLDpXAn.exe
  C:\Windows\System\VLDpXAn.exe
  2⤵
  PID:14612
- C:\Windows\System\vmBZFUT.exe
  C:\Windows\System\vmBZFUT.exe
  2⤵
  PID:14652
- C:\Windows\System\IDRoobk.exe
  C:\Windows\System\IDRoobk.exe
  2⤵
  PID:14684
- C:\Windows\System\fIjTvow.exe
  C:\Windows\System\fIjTvow.exe
  2⤵
  PID:14704
- C:\Windows\System\xhbBFVu.exe
  C:\Windows\System\xhbBFVu.exe
  2⤵
  PID:14736
- C:\Windows\System\iZdQRJT.exe
  C:\Windows\System\iZdQRJT.exe
  2⤵
  PID:14756
- C:\Windows\System\oedOVmK.exe
  C:\Windows\System\oedOVmK.exe
  2⤵
  PID:14804
- C:\Windows\System\KqDTQtM.exe
  C:\Windows\System\KqDTQtM.exe
  2⤵
  PID:14832
- C:\Windows\System\vbDLCDY.exe
  C:\Windows\System\vbDLCDY.exe
  2⤵
  PID:14860
- C:\Windows\System\CMdblAt.exe
  C:\Windows\System\CMdblAt.exe
  2⤵
  PID:14888
- C:\Windows\System\QJCWsLp.exe
  C:\Windows\System\QJCWsLp.exe
  2⤵
  PID:14916
- C:\Windows\System\OTyyYDW.exe
  C:\Windows\System\OTyyYDW.exe
  2⤵
  PID:14944
- C:\Windows\System\fMGegjH.exe
  C:\Windows\System\fMGegjH.exe
  2⤵
  PID:14972
- C:\Windows\System\LVhtVzq.exe
  C:\Windows\System\LVhtVzq.exe
  2⤵
  PID:14996
- C:\Windows\System\Zmgiplv.exe
  C:\Windows\System\Zmgiplv.exe
  2⤵
  PID:15016
- C:\Windows\System\rwunici.exe
  C:\Windows\System\rwunici.exe
  2⤵
  PID:15040
- C:\Windows\System\UxEFvyv.exe
  C:\Windows\System\UxEFvyv.exe
  2⤵
  PID:15072
- C:\Windows\System\SupgeXM.exe
  C:\Windows\System\SupgeXM.exe
  2⤵
  PID:15088
- C:\Windows\System\ZeiLxsM.exe
  C:\Windows\System\ZeiLxsM.exe
  2⤵
  PID:15108
- C:\Windows\System\kwpAncJ.exe
  C:\Windows\System\kwpAncJ.exe
  2⤵
  PID:15148
- C:\Windows\System\hRheGkC.exe
  C:\Windows\System\hRheGkC.exe
  2⤵
  PID:15172
- C:\Windows\System\fLqPdDn.exe
  C:\Windows\System\fLqPdDn.exe
  2⤵
  PID:15212
- C:\Windows\System\VzgpCQM.exe
  C:\Windows\System\VzgpCQM.exe
  2⤵
  PID:15232
- C:\Windows\System\qKsGpuV.exe
  C:\Windows\System\qKsGpuV.exe
  2⤵
  PID:15280
- C:\Windows\System\vrKqDNx.exe
  C:\Windows\System\vrKqDNx.exe
  2⤵
  PID:15304
- C:\Windows\System\WEqKQXj.exe
  C:\Windows\System\WEqKQXj.exe
  2⤵
  PID:15328
- C:\Windows\System\tvCNCfl.exe
  C:\Windows\System\tvCNCfl.exe
  2⤵
  PID:14340
- C:\Windows\System\EhQFhWY.exe
  C:\Windows\System\EhQFhWY.exe
  2⤵
  PID:14400
- C:\Windows\System\lodpCpT.exe
  C:\Windows\System\lodpCpT.exe
  2⤵
  PID:14456
- C:\Windows\System\ZJgqwNj.exe
  C:\Windows\System\ZJgqwNj.exe
  2⤵
  PID:14516
- C:\Windows\System\ptzQqjf.exe
  C:\Windows\System\ptzQqjf.exe
  2⤵
  PID:14580
- C:\Windows\System\CIkVwts.exe
  C:\Windows\System\CIkVwts.exe
  2⤵
  PID:14636
- C:\Windows\System\XwjUXwJ.exe
  C:\Windows\System\XwjUXwJ.exe
  2⤵
  PID:14732
- C:\Windows\System\QYxWuXG.exe
  C:\Windows\System\QYxWuXG.exe
  2⤵
  PID:14796
- C:\Windows\System\CLhfjtU.exe
  C:\Windows\System\CLhfjtU.exe
  2⤵
  PID:14872
- C:\Windows\System\gDInhXL.exe
  C:\Windows\System\gDInhXL.exe
  2⤵
  PID:14928
- C:\Windows\System\vpxKtbj.exe
  C:\Windows\System\vpxKtbj.exe
  2⤵
  PID:14968
- C:\Windows\System\BTRKRpC.exe
  C:\Windows\System\BTRKRpC.exe
  2⤵
  PID:15032
- C:\Windows\System\ykIWcwj.exe
  C:\Windows\System\ykIWcwj.exe
  2⤵
  PID:15056
- C:\Windows\System\fOggKGY.exe
  C:\Windows\System\fOggKGY.exe
  2⤵
  PID:15096
- C:\Windows\System\DAzvNvD.exe
  C:\Windows\System\DAzvNvD.exe
  2⤵
  PID:15144
- C:\Windows\System\kZTJGEU.exe
  C:\Windows\System\kZTJGEU.exe
  2⤵
  PID:15296
- C:\Windows\System\sdrMPIh.exe
  C:\Windows\System\sdrMPIh.exe
  2⤵
  PID:14380
- C:\Windows\System\WxuOiKj.exe
  C:\Windows\System\WxuOiKj.exe
  2⤵
  PID:14452
- C:\Windows\System\SIHenHu.exe
  C:\Windows\System\SIHenHu.exe
  2⤵
  PID:4872
- C:\Windows\System\PPfWNYM.exe
  C:\Windows\System\PPfWNYM.exe
  2⤵
  PID:14608
- C:\Windows\System\hmrnhuq.exe
  C:\Windows\System\hmrnhuq.exe
  2⤵
  PID:14908
- C:\Windows\System\jVdafXR.exe
  C:\Windows\System\jVdafXR.exe
  2⤵
  PID:15024
- C:\Windows\System\HmdhkSY.exe
  C:\Windows\System\HmdhkSY.exe
  2⤵
  PID:15196
- C:\Windows\System\RsBpGKe.exe
  C:\Windows\System\RsBpGKe.exe
  2⤵
  PID:15324
- C:\Windows\System\EHnVxPI.exe
  C:\Windows\System\EHnVxPI.exe
  2⤵
  PID:14508
- C:\Windows\System\rPlHWSB.exe
  C:\Windows\System\rPlHWSB.exe
  2⤵
  PID:14844
- C:\Windows\System\CnRNlsZ.exe
  C:\Windows\System\CnRNlsZ.exe
  2⤵
  PID:15084
- C:\Windows\System\GoYZoWb.exe
  C:\Windows\System\GoYZoWb.exe
  2⤵
  PID:14552
- C:\Windows\System\ggerSfs.exe
  C:\Windows\System\ggerSfs.exe
  2⤵
  PID:15240
- C:\Windows\System\KwXcyqV.exe
  C:\Windows\System\KwXcyqV.exe
  2⤵
  PID:15388
- C:\Windows\System\CccgoND.exe
  C:\Windows\System\CccgoND.exe
  2⤵
  PID:15420
- C:\Windows\System\QApqCLL.exe
  C:\Windows\System\QApqCLL.exe
  2⤵
  PID:15440
- C:\Windows\System\DmMYKvI.exe
  C:\Windows\System\DmMYKvI.exe
  2⤵
  PID:15460
- C:\Windows\System\yGvKhrK.exe
  C:\Windows\System\yGvKhrK.exe
  2⤵
  PID:15504
- C:\Windows\System\zwDQJQM.exe
  C:\Windows\System\zwDQJQM.exe
  2⤵
  PID:15520
- C:\Windows\System\cgIsDOx.exe
  C:\Windows\System\cgIsDOx.exe
  2⤵
  PID:15568
- C:\Windows\System\sUDGFyt.exe
  C:\Windows\System\sUDGFyt.exe
  2⤵
  PID:15592
- C:\Windows\System\IMYAajj.exe
  C:\Windows\System\IMYAajj.exe
  2⤵
  PID:15616
- C:\Windows\System\GdsWffU.exe
  C:\Windows\System\GdsWffU.exe
  2⤵
  PID:15636
- C:\Windows\System\tcMldcp.exe
  C:\Windows\System\tcMldcp.exe
  2⤵
  PID:15672
- C:\Windows\System\OyDECdc.exe
  C:\Windows\System\OyDECdc.exe
  2⤵
  PID:15700
- C:\Windows\System\ckMbuVd.exe
  C:\Windows\System\ckMbuVd.exe
  2⤵
  PID:15720
- C:\Windows\System\fYcNTCt.exe
  C:\Windows\System\fYcNTCt.exe
  2⤵
  PID:15768
- C:\Windows\System\yatMiGN.exe
  C:\Windows\System\yatMiGN.exe
  2⤵
  PID:15796
- C:\Windows\System\LYBGqGx.exe
  C:\Windows\System\LYBGqGx.exe
  2⤵
  PID:15816
- C:\Windows\System\XYDXfRq.exe
  C:\Windows\System\XYDXfRq.exe
  2⤵
  PID:15848
- C:\Windows\System\kNLSrlR.exe
  C:\Windows\System\kNLSrlR.exe
  2⤵
  PID:15872
- C:\Windows\System\OAHPXdH.exe
  C:\Windows\System\OAHPXdH.exe
  2⤵
  PID:15896
- C:\Windows\System\UQUZtsQ.exe
  C:\Windows\System\UQUZtsQ.exe
  2⤵
  PID:15912
- C:\Windows\System\SSyCdbU.exe
  C:\Windows\System\SSyCdbU.exe
  2⤵
  PID:15932
- C:\Windows\System\WfYrMTK.exe
  C:\Windows\System\WfYrMTK.exe
  2⤵
  PID:15956
- C:\Windows\System\EawtvrB.exe
  C:\Windows\System\EawtvrB.exe
  2⤵
  PID:15984
- C:\Windows\System\IolDdYd.exe
  C:\Windows\System\IolDdYd.exe
  2⤵
  PID:16008
- C:\Windows\System\nvwHVAY.exe
  C:\Windows\System\nvwHVAY.exe
  2⤵
  PID:16064
- C:\Windows\System\BzswYsL.exe
  C:\Windows\System\BzswYsL.exe
  2⤵
  PID:16104
- C:\Windows\System\buzZurl.exe
  C:\Windows\System\buzZurl.exe
  2⤵
  PID:16132
- C:\Windows\System\blraPBk.exe
  C:\Windows\System\blraPBk.exe
  2⤵
  PID:16148
- C:\Windows\System\qimQime.exe
  C:\Windows\System\qimQime.exe
  2⤵
  PID:16176
- C:\Windows\System\rvOPpvJ.exe
  C:\Windows\System\rvOPpvJ.exe
  2⤵
  PID:16216
- C:\Windows\System\fAJFHLu.exe
  C:\Windows\System\fAJFHLu.exe
  2⤵
  PID:16232
- C:\Windows\System\DrDuMQC.exe
  C:\Windows\System\DrDuMQC.exe
  2⤵
  PID:16272
- C:\Windows\System\vUDZcVP.exe
  C:\Windows\System\vUDZcVP.exe
  2⤵
  PID:16300
- C:\Windows\System\HnHTDVA.exe
  C:\Windows\System\HnHTDVA.exe
  2⤵
  PID:16320
- C:\Windows\System\EcgQhgk.exe
  C:\Windows\System\EcgQhgk.exe
  2⤵
  PID:16356
- C:\Windows\System\yrwoYQY.exe
  C:\Windows\System\yrwoYQY.exe
  2⤵
  PID:16372
- C:\Windows\System\ygsLEcX.exe
  C:\Windows\System\ygsLEcX.exe
  2⤵
  PID:15012
- C:\Windows\System\AUumaRk.exe
  C:\Windows\System\AUumaRk.exe
  2⤵
  PID:15384
- C:\Windows\System\NFlDtEd.exe
  C:\Windows\System\NFlDtEd.exe
  2⤵
  PID:15536
- C:\Windows\System\JaHyujZ.exe
  C:\Windows\System\JaHyujZ.exe
  2⤵
  PID:15576
- C:\Windows\System\oslUrpP.exe
  C:\Windows\System\oslUrpP.exe
  2⤵
  PID:15612
- C:\Windows\System\qQlcGHX.exe
  C:\Windows\System\qQlcGHX.exe
  2⤵
  PID:15712
- C:\Windows\System\XfgBQpx.exe
  C:\Windows\System\XfgBQpx.exe
  2⤵
  PID:15792
- C:\Windows\System\pFrbQHu.exe
  C:\Windows\System\pFrbQHu.exe
  2⤵
  PID:15832
- C:\Windows\System\sTGfulW.exe
  C:\Windows\System\sTGfulW.exe
  2⤵
  PID:15908
- C:\Windows\System\swAikIF.exe
  C:\Windows\System\swAikIF.exe
  2⤵
  PID:15940
- C:\Windows\System\zmVlQGq.exe
  C:\Windows\System\zmVlQGq.exe
  2⤵
  PID:15996
- C:\Windows\System\RIUNzbK.exe
  C:\Windows\System\RIUNzbK.exe
  2⤵
  PID:16128
- C:\Windows\System\GyoPrtT.exe
  C:\Windows\System\GyoPrtT.exe
  2⤵
  PID:16156
- C:\Windows\System\MqRMSuz.exe
  C:\Windows\System\MqRMSuz.exe
  2⤵
  PID:16256
- C:\Windows\System\LwFpMil.exe
  C:\Windows\System\LwFpMil.exe
  2⤵
  PID:16308
- C:\Windows\System\AkPtYfz.exe
  C:\Windows\System\AkPtYfz.exe
  2⤵
  PID:16364
- C:\Windows\System\LmBMtAZ.exe
  C:\Windows\System\LmBMtAZ.exe
  2⤵
  PID:15564
- C:\Windows\System\uchNNNN.exe
  C:\Windows\System\uchNNNN.exe
  2⤵
  PID:15588
- C:\Windows\System\wBIqBar.exe
  C:\Windows\System\wBIqBar.exe
  2⤵
  PID:15752
- C:\Windows\System\fAikQSv.exe
  C:\Windows\System\fAikQSv.exe
  2⤵
  PID:15964
- C:\Windows\System\HZxTjoa.exe
  C:\Windows\System\HZxTjoa.exe
  2⤵
  PID:16196
- C:\Windows\System\iLKckQx.exe
  C:\Windows\System\iLKckQx.exe
  2⤵
  PID:16284
- C:\Windows\System\fpyQwwj.exe
  C:\Windows\System\fpyQwwj.exe
  2⤵
  PID:15376
- C:\Windows\System\LVMzjHx.exe
  C:\Windows\System\LVMzjHx.exe
  2⤵
  PID:15708
- C:\Windows\System\ziDAFRg.exe
  C:\Windows\System\ziDAFRg.exe
  2⤵
  PID:16096
- C:\Windows\System\zVnuFfr.exe
  C:\Windows\System\zVnuFfr.exe
  2⤵
  PID:15480
- C:\Windows\System\XrMjkaf.exe
  C:\Windows\System\XrMjkaf.exe
  2⤵
  PID:15868
- C:\Windows\System\GBEdCan.exe
  C:\Windows\System\GBEdCan.exe
  2⤵
  PID:16404
- C:\Windows\System\MdbtAEx.exe
  C:\Windows\System\MdbtAEx.exe
  2⤵
  PID:16428
- C:\Windows\System\CpHipSq.exe
  C:\Windows\System\CpHipSq.exe
  2⤵
  PID:16460
- C:\Windows\System\phVJrTO.exe
  C:\Windows\System\phVJrTO.exe
  2⤵
  PID:16480
- C:\Windows\System\UnhctRe.exe
  C:\Windows\System\UnhctRe.exe
  2⤵
  PID:16500
- C:\Windows\System\YzjyigS.exe
  C:\Windows\System\YzjyigS.exe
  2⤵
  PID:16548
- C:\Windows\System\nKzPCrK.exe
  C:\Windows\System\nKzPCrK.exe
  2⤵
  PID:16588
- C:\Windows\System\rczGuWr.exe
  C:\Windows\System\rczGuWr.exe
  2⤵
  PID:16616
- C:\Windows\System\fclcVTq.exe
  C:\Windows\System\fclcVTq.exe
  2⤵
  PID:16644
- C:\Windows\System\BdUxLkQ.exe
  C:\Windows\System\BdUxLkQ.exe
  2⤵
  PID:16660
- C:\Windows\System\zEqhaSH.exe
  C:\Windows\System\zEqhaSH.exe
  2⤵
  PID:16676
- C:\Windows\System\NpDCcdV.exe
  C:\Windows\System\NpDCcdV.exe
  2⤵
  PID:16716
- C:\Windows\System\UiVvGyf.exe
  C:\Windows\System\UiVvGyf.exe
  2⤵
  PID:16744
- C:\Windows\System\vfMnPID.exe
  C:\Windows\System\vfMnPID.exe
  2⤵
  PID:16772
- C:\Windows\System\WTNlCFt.exe
  C:\Windows\System\WTNlCFt.exe
  2⤵
  PID:16788
- C:\Windows\System\BgWmgSb.exe
  C:\Windows\System\BgWmgSb.exe
  2⤵
  PID:16820
- C:\Windows\System\CdwqfrV.exe
  C:\Windows\System\CdwqfrV.exe
  2⤵
  PID:16844
- C:\Windows\System\nrMFvIf.exe
  C:\Windows\System\nrMFvIf.exe
  2⤵
  PID:16884
- C:\Windows\System\gnKjySY.exe
  C:\Windows\System\gnKjySY.exe
  2⤵
  PID:16912
- C:\Windows\System\fTDTZru.exe
  C:\Windows\System\fTDTZru.exe
  2⤵
  PID:16936
- C:\Windows\System\sYiPcQh.exe
  C:\Windows\System\sYiPcQh.exe
  2⤵
  PID:16956
- C:\Windows\System\FgauREs.exe
  C:\Windows\System\FgauREs.exe
  2⤵
  PID:17044

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:16476

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Accessibility Features

T1546.008

Privilege Escalation

Event Triggered Execution

T1546

Accessibility Features

T1546.008

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\AcrhjFP.exe

Filesize
1.7MB

MD5
1f49b16a26fed6edd246e8fa848e4d09

SHA1
e123f027a0e7b47fe2f04d87fbb8420e4cfce907

SHA256
d55ffcebe4c61d6638693759b707cf61001315344e24f87d59a5e92c706370f1

SHA512
ddf5ef8cb5933485cc9053f2cbad9e3e1fc37972725591eee64d0fc0e2f7f7e2adebeaf33fa8d74a090acf3ceaf49f9bed25a347d0c8d0777e11e5b05efdf3df

Download Submit
C:\Windows\System\CIZiwIM.exe

Filesize
1.7MB

MD5
08272dd7962766264acfef0d6914b01b

SHA1
e26662fa06781f71a395cb4db6d89cef725f2d91

SHA256
a5577b24213f895025824e49bc13b97c7f009d79cf3469c87d3b2964048749f4

SHA512
aeff44e837fa33d2eb9f2b076f31de6dae15fc781c90f8548fdf9424621eb286fbd7c1c381ab602e1d582ab08fc7828590cb507b77a463f723f508def3444026

Download Submit
C:\Windows\System\CxZyvqC.exe

Filesize
1.7MB

MD5
c08d3ebced76089dad08f5af0b97e5b9

SHA1
e1eb5d255c963011578db603b3b18229fde0314e

SHA256
d71832c9317e4ff031a9e4404c085f37becda4471aa95f22e00986802a44a60f

SHA512
480136e8b09bd6989ad1207fc65ca149fd7ea3f044005809edb3b71a6e60636509747fe64906dbfb5154647e8cc04231cb385d409fde2fac88106ab30218b82e

Download Submit
C:\Windows\System\FQPtUMr.exe

Filesize
1.7MB

MD5
cb32f9b9eb1a3ce680bc4112f63741fd

SHA1
c1125b829403a95127b6b7c15b52b42ca80efa2b

SHA256
18d8059e6db19a1280f6e10eb83d83ecf0e494faf5e9dfaebf37cd06772d7fdf

SHA512
ce812e0d3541b6c52902c1105ffd5be7e94109c18ed210a9b348d8a0949b52354a0df99d2944629c7146ab543cbcff01422f8be54d19d0735ab39781c7a21cce

Download Submit
C:\Windows\System\HwdoQJa.exe

Filesize
1.7MB

MD5
32b91fefa8e6f26cbe0354a8e3865c5a

SHA1
9fcefc94f663bf2dccd47887e1d96f88b6856af3

SHA256
aa6306506edcaa86791efbc65b108ff1d109ccaa474065abeae991acedd7c9da

SHA512
00e5a07c9b67dc4335b59e9c8e5ebe3a7234fd1a72b82ef2790d02c11aa2931d054b266fffa855206ab867a3f83797da60af2935647f21cf864a52bbe303a2b1

Download Submit
C:\Windows\System\IuceWYj.exe

Filesize
1.7MB

MD5
9c8c6d54c521b410ae8dd16d5764af08

SHA1
57cbb2b86d30babb38929c05cd64b5322d3179d9

SHA256
c9d39706352ffa41ede253ea587c4ca28f661793ac4606799df2807eb5f39122

SHA512
f15760e110edf558ca4c22a55c88cf7234b0ca82f9159c9008d7c5fec3bc819d54afdd5cc1cb20e5ee2c5573cce751cc957c0cea4b69d89d84c20fdfbeaf8b49

Download Submit
C:\Windows\System\JJlqSXM.exe

Filesize
1.6MB

MD5
b8e911cac9e730a07d62bde0d51be80d

SHA1
2ce2ac64219d67fb5b34341fdfeed87efb5a46a6

SHA256
15a971cf2054b5fa99b678790f78bf22b4c2a4fd85b31640f8fcbbded9b98eea

SHA512
c0d293a0b6a5301858dea604c0171dd33f4a778a2a78fa5a30b07294524212ce12e8bfe521fa4ff71045c6e6ed311ca41d895fe11126b5ddce93e653ec00a12b

Download Submit
C:\Windows\System\PtxVjvU.exe

Filesize
1.7MB

MD5
f5648eb57a5eb7c7c9a032bf8c2a4a09

SHA1
b4979e5c4515ee702c5e2570d4215fc4f810087e

SHA256
1f8298d4b829ab2cd18785e22f1954c218e20373e68148395457c6449f18adff

SHA512
3e9af88e6cd00dda0cd9339977a71df3de96f49ccc8f1518ed58f3cca4445333d0642e4e82af2159f9fbf56612f031a87af818fe890777d04851fa119e95a220

Download Submit
C:\Windows\System\TJUIJft.exe

Filesize
1.7MB

MD5
90ed23d5c312fed288b8a86855e259db

SHA1
ed9aa40de406fc8c7d8e9150eab927c7bdc6c509

SHA256
7fde960b4db666f8efd8bfda79546dd8b047e20ec660b913ef654f73fc990f49

SHA512
35821ed60f6b47e8f9dd64b58052353c0d15a5e46b4dbedf63c9aab15cc560cd2fefb1599273127dd19367ee552e4e516658484f8eac349354a597a76c3722b6

Download Submit
C:\Windows\System\TTIXMwH.exe

Filesize
1.7MB

MD5
2be51460dad5d6e4973ce5286ebfaf10

SHA1
80cbd79a72a7e86edde5ce02ff690a72faaa7938

SHA256
198104cfed779c0094a18166e106ec0949ea2dbf37ebb0ee833a10dbd4cf190a

SHA512
4db8c967db3b2d19d9e75c4bc56ddee6b91966883af37318e5a2488b14152dc4b18680f7bb9d4eedb53e0d524423a4e96879d49a009322abbd910a0ce5afa5d7

Download Submit
C:\Windows\System\VBxHdtB.exe

Filesize
1.6MB

MD5
680afda4112c5ab828b86c716f23c47f

SHA1
8a7f60b2058ac78351aa5ef36735398e504ce5d3

SHA256
cf145891af9ce5d5ea01e637768b20f4681964caee03bb9e97ac661b7944a2eb

SHA512
1b487a21ec65a88ae6296550d76203730aea5017c8f9feb1c0776a91fbff72152e85718913848df59b3322382ff82f9e8d9843285ed22a72841e9c08e1d9ef85

Download Submit
C:\Windows\System\VCEUGXy.exe

Filesize
1.7MB

MD5
88b31a64c538d41ac08f4e6288f5d8e0

SHA1
6f7772333c9f69d4f2bb7426d004d553402d9631

SHA256
4f466c405072e2b9233f69e9b61e7ee0b799dd1c5cac30d3557cdeadb525cd5c

SHA512
b6c6c2ad2a818c5df484c00d91909b1f13762543bd0dd9616a6570239c811b8c77d4b1cdff6af5ff63d4b247dfa78bb5d393738c26689f4d6f0d2e113e5abdf1

Download Submit
C:\Windows\System\ZzePWjb.exe

Filesize
1.7MB

MD5
18cf48df3f09c396906b1ee92548b9af

SHA1
ce4ca50f2d86544bfa7aeb281dcb4697d71758a6

SHA256
514c6f916b0c87fac71ce92d825b7132eb4dc6d35731dbef26cb235127600358

SHA512
069f1fda53a0abf470edcb7c44c3cd5447221a3e2b5accabfdbf463f3f6e397a26365eefcab3ec33a41de4c27e01606cdbc2a2269c448c25a9a1cd0911cc6d30

Download Submit
C:\Windows\System\bOpKGYm.exe

Filesize
1.7MB

MD5
18d7358e4cd32894bbae074958492f49

SHA1
fc07aef8435c26c68910a7db687cb3bda18726d0

SHA256
b6cd23283560c2f165b8fa6c41e5c9d4dd2da3368ff0624866f53ac9e2cd2191

SHA512
47e8a6480765d063f5f71c1574f42815c2db338cc7712c41e3111796cf6a45881eca472f6d8f05e5ef87db10898f23495f800c4690c06100c6e22a1600c9f9bb

Download Submit
C:\Windows\System\bUWDOHM.exe

Filesize
1.6MB

MD5
a2f060cd0668f65f0209d782e826f1e1

SHA1
2b08b393fdc958f6a3eecb59203ff9fd526b7efa

SHA256
9b6753e0fa7ef1df50a979ab9d016cbd29f0840c261c9c6e2ae1fc3813a5e820

SHA512
c56d55dc7a5925adbcd2f6aea45b59d664f4853c118aecc4d493af35a232ceba6ffcc717ca9cfeec953502ecb580c3f8aaf065a7cfee73c1db382eb3157f129e

Download Submit
C:\Windows\System\bgGPgrd.exe

Filesize
1.7MB

MD5
33f0ba1688a88ece1c553418222d83ac

SHA1
f668084e7f9fd3ec33341892beb4ce08ef99fda5

SHA256
2a629f48deaf883a3613ad991e4f537097bffc07944da73a4906993f782f6bfc

SHA512
5c7894de579dc569a626a015b5c5ce96e1b82a02c258327cd84aeadafd9ecea53098b601f4f2f2b96405221a05f3960578b6182a0e0f3611cc9f144978c8482e

Download Submit
C:\Windows\System\irFSmBZ.exe

Filesize
1.7MB

MD5
d33f07dba6d4269dabd55b743706603f

SHA1
fc6dd31463a64bea38dc158ef878cb627943a05e

SHA256
82434ef7d22e7f80b50efdbec5c7586796f874bb1ddfbeeeb0ec05d1a7eed832

SHA512
64447b153974146251c7b7953d1cdaddf1c5923ce35b382be4b73631b48c918089313964391e33f7d4fa86d4499cfd711df59ba827f147f9c4f9c64dd992d32f

Download Submit
C:\Windows\System\lErLMiI.exe

Filesize
1.7MB

MD5
c6d801671929c69efab5fa0f3f8b0e7f

SHA1
e633ba218fc01c308c2740e839a31a907d978c11

SHA256
669bbcd6586c5c5ccd75c744dcf2d7a0d5257cfd410f54597ea372d7f93f1721

SHA512
cdb2e2228c2be884057704c13e6bb0e41702220684755cc4532ffdb9ee5f80a557014e2cc51242b0694559b7b18a16e48d0b12ecb7abb5fafd6433c674ffc1b0

Download Submit
C:\Windows\System\lWnXniS.exe

Filesize
1.7MB

MD5
af342f5f98efa299036b62db2d086b03

SHA1
0d7e5b39bd936d528011262c309685d1d31e4dfe

SHA256
0ff1d71c144e3c94edd1648ef019b5b1e1e3233ca69dc0a1a9067156fdef9cd3

SHA512
5891e55b006a6b2232171362a8fbb99bc041a512321de19822a516f08bed97cd1518783f9ba56c617ee5e6c59675668010c1f96345bbb40605861a10318bfa10

Download Submit
C:\Windows\System\mtLGVJI.exe

Filesize
1.6MB

MD5
2145c1ab908c7852498348676d161069

SHA1
7e5bfac04f9dd04459a8732c084ff397c0c1bfa5

SHA256
3f3fed40d5d090f81bd122bcc5d33f049ecefb44370ebee61a936d0a5b321a92

SHA512
5aa5f79e369e3174f8064f3f9acd967c2726260810e1224c23d1c7487d91f49b2466d893e756b1e9039e6c694b3ee873e1978c8a03ea6b530d6a1ae9bdba13b2

Download Submit
C:\Windows\System\oRvjMBK.exe

Filesize
1.7MB

MD5
485b9d5bd50f1355a00fd308ea853c8c

SHA1
ce98960540b37aedd8c56c76904790558a5d2959

SHA256
bfb33a3ca768425389695d7527fc67888f1d8e43b34a01242142e4b4663e139d

SHA512
795bbe90e91d42cb62b0aac3802aa2ceb1ebd6d8465d16870b291cbfea5308f04990c63d580e9611e880718c796f49beb07596aced776e98ac6dd4c1511b2771

Download Submit
C:\Windows\System\rzoqnKI.exe

Filesize
1.7MB

MD5
8dc730006a0a35084bc26426055bee36

SHA1
c84f04dc8c449660af959adbee62b3b2c75aa5fd

SHA256
2051c5caea6f317cd2d69b9ce7885c43039f5f9a5db8e9ba7612df158618dd1a

SHA512
6178d4fba5fe5681bfc5537f4217db3ed36d9d882ecc8daa984a2d9debc5d9ad90cceb34b3d3f59b56a0a0f8657dda101e999db8fb03a8a47780c98c512254ca

Download Submit
C:\Windows\System\srlsmCJ.exe

Filesize
1.7MB

MD5
91e9e0238dee4bb9a636850996cbb9a7

SHA1
2bcc2b506a4cdca587e9c1d16391ad0504d1193c

SHA256
697a26b0a2b1d9561feedf1aece04261d65531bc3a563506cc7498ac7ac572dc

SHA512
7ae778c25c48553205b131b8ac0fa2fa581495eca1cd8dd1bc7c28cc721fd259bce667e0e2cf5fcce27dd34153841391b1e3ca0680c8107b49867c157021fff9

Download Submit
C:\Windows\System\tMmIaze.exe

Filesize
1.6MB

MD5
51671bc73f14b871dd95fda5ffd3e1d9

SHA1
97ed6066afe2624f1e534becf0cec0ea67a959e5

SHA256
d81b66b4527eebb1afd9d4a0b77c2a70b34784d5492ad03c2bb5a454b7390cd9

SHA512
5fd68f19db60bb4f0f3c0c9cc351517f1ac9c923e40b8adbf31137502b2307cca4e101d897ae6172a06d033794e953dbc021b2645af3131f4003c7b98ec6a168

Download Submit
C:\Windows\System\tTeOciD.exe

Filesize
1.7MB

MD5
49a0112e12512e9b14fc2bb27f5a6be3

SHA1
a4ae83dd8c189867d33d1f6059347f0944ab5c44

SHA256
d3612845a416e769475586f84b1e3f2e52a5757efb3389c7635a08de2f4cac40

SHA512
75558c04c5ba9a41b8497db8b74e70f50be6c2378e714685435bb71eb7b27c0038bf691e1a24b9cef06966691c5733edd29463c66cc6e25bd042aa82c3a19b88

Download Submit
C:\Windows\System\tUgoETV.exe

Filesize
1.6MB

MD5
0fafa8d54f740188c56a7e8ba8ef216f

SHA1
b7df81da3e748d2f7c21dc1b543a1ede1fe15166

SHA256
f3bf666fdc2968f3da36db4ff52099c3f411fc6ec462a50302cd20073d1cf636

SHA512
b0aa3da9062633c3eadfa5fdae57e1d2f9b435e2fa497c791022ca8762b2322103b7d7f68bae6ee5c7c477c14e6c04a6e2f06ac51f52b1632cb9299c843eac71

Download Submit
C:\Windows\System\vNAOFfJ.exe

Filesize
1.7MB

MD5
c0d99aa11d1cfb8adc4e882ee7e21919

SHA1
d795a58284827cb94d386558ab0adf2535b2fe14

SHA256
b6c9bf1edea11fdb24b0d8b3911c6c8267fc093d826dd71e5bbe23f13a39594b

SHA512
4a4e8ca1732ff6f7b3d37e86eac7421ce626e3c173935119407d1ea2037f95a4530b9ad90ef3e53bc9f4e701007bb62c120a4dd88c59114ef6421dd9764ed5df

Download Submit
C:\Windows\System\wEuoORC.exe

Filesize
1.7MB

MD5
9718bc3610c463520e85ae854a4522d0

SHA1
68014701f4db3742dca6ec149888481e2b8c1707

SHA256
9d6c55ab7a05b2898857f699d4b59f50f52385d45edf87235273c760cf0755d2

SHA512
26ebc779e765b11aac30ba250ded5e3396125c5887246d2352d014865bb8f2d5790405c319593105befb9aeb8f55af8ee48f737f9e82c62f6462ee71ba335f57

Download Submit
C:\Windows\System\wRvhzYr.exe

Filesize
1.7MB

MD5
024f619e9d3a482c7e31afefb409be52

SHA1
d213b90e7722eff9de78d7ce346a940f7f38036b

SHA256
c8c816d77f9a3f56385426fa00ba60a30c6ce3f77ab2704bbffae02941d9457f

SHA512
e3c1a11ed4908617e697f605550b988c2b69d76a86664d09fa71d41c346f3941d32dd113bdb171d07366de12a7a5e2fe206ce66a324b021d17480a0768ea40be

Download Submit
C:\Windows\System\xmBioTT.exe

Filesize
1.7MB

MD5
1042484ec2125909cdd7eee5c4c37c39

SHA1
74908ee75da9a0467484bdb3143fe65588468119

SHA256
a7951845699a7bd24decddeb2ccf89960f998c213e4cda2adb48bf3a8f52f60b

SHA512
f7f9b61cc5174a66033ec6523f5f8f8f609e6028303050ecc1931dfe646e610f5ac6b397168e1a33aab3f41a073f8de0e56a471b069cf252d482de9ff88d7af3

Download Submit
C:\Windows\System\yBsRWxq.exe

Filesize
1.7MB

MD5
25d0587502d25f9c7e03ae3a8f6d5a6a

SHA1
11a2109ef47632bcfdb58f510bd8df675ae0b139

SHA256
6e90b68520066962cb89be971aab3517417bd9602c30d64a697158027bd5729c

SHA512
889976bf180d6d3c7b0a1972f3997997f4483e8f99f850e9c14514814b6e47cd5924ab62fbbe17c8468f442070571aab33c79778df120f3a81e6ee2cb1b6dc79

Download Submit
C:\Windows\System\zOYWOKx.exe

Filesize
1.7MB

MD5
7210d68ae1ea2e490b35537ec4adf8ab

SHA1
23aef4f06513f368741b8df4fb72fcd5ad55f27a

SHA256
fc42cd846da46806ed7e2063bf026ee7abd6a7b58b4ac305ce9b893eb9b5146e

SHA512
40cdc8e3c74e95a6ed8f717ff9195dec733b01be66bfbc37b51a87a603714616abc0a25d12a98bacb46c6c43af4a4992e0d3fe65b44fb7a3b7f01802be8f9650

Download Submit
C:\Windows\System\zTAyoWz.exe

Filesize
1.7MB

MD5
cf7f8a4ae70f89de40ebecea7645acc8

SHA1
0ce40e94f522c0e7ec3514dbefc1c76fb19187ee

SHA256
70382e4c5b7ab7b2b7c527a85b5ea4f9a9fd4e1336cb263248cc097fcb043233

SHA512
51b81fdb583195a970897156516c3a93b28ba02ae4ab65a4e41c0b73b4797a3f0fa03e05b3869bfa442899ec278a835483678d2256035e021d174bb983126e68

Download Submit
memory/1292-0-0x00000160EF340000-0x00000160EF350000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads