xmrig | 8c40065d095f86dafd6fb6180c0892ceeccd1474c0698d675461a06769f7d913

Analysis

max time kernel
128s
max time network
135s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
23/12/2024, 23:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8c40065d095f86dafd6fb6180c0892ceeccd1474c0698d675461a06769f7d913.exe
Size

1.4MB
MD5

0a82d4e8117b9bca40039aa7bb988f49
SHA1

10a94481b6add45e65b7d24e0b1cca044d2e78ca
SHA256

8c40065d095f86dafd6fb6180c0892ceeccd1474c0698d675461a06769f7d913
SHA512

569156167b39a4ff7db921d1706778d3d7bbc8797dd01c891f6501272476788018a0241c0cf5db05bfaa21e22c617eac80546dc391e2ccab86545dcf1acab2fb
SSDEEP

24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbpwlKenszbWKDNEm/51m6Pb8eRKj:GezaTF8FcNkNdfE0pZ9ozttwIRx3rEug

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 34 IoCs

miner

resource	yara_rule
behavioral2/files/0x000c000000023b84-4.dat	xmrig
behavioral2/files/0x0009000000023c73-9.dat	xmrig
behavioral2/files/0x0007000000023c77-8.dat	xmrig
behavioral2/files/0x0007000000023c78-17.dat	xmrig
behavioral2/files/0x0007000000023c79-23.dat	xmrig
behavioral2/files/0x0007000000023c7b-27.dat	xmrig
behavioral2/files/0x0007000000023c7c-34.dat	xmrig
behavioral2/files/0x0007000000023c7e-43.dat	xmrig
behavioral2/files/0x0007000000023c80-55.dat	xmrig
behavioral2/files/0x0007000000023c81-66.dat	xmrig
behavioral2/files/0x0007000000023c84-76.dat	xmrig
behavioral2/files/0x0007000000023c89-100.dat	xmrig
behavioral2/files/0x0007000000023c88-98.dat	xmrig
behavioral2/files/0x0007000000023c87-96.dat	xmrig
behavioral2/files/0x0007000000023c86-94.dat	xmrig
behavioral2/files/0x0007000000023c85-90.dat	xmrig
behavioral2/files/0x0007000000023c83-70.dat	xmrig
behavioral2/files/0x0007000000023c82-62.dat	xmrig
behavioral2/files/0x0007000000023c7f-58.dat	xmrig
behavioral2/files/0x0007000000023c8a-105.dat	xmrig
behavioral2/files/0x0008000000023c74-110.dat	xmrig
behavioral2/files/0x0007000000023c8b-114.dat	xmrig
behavioral2/files/0x0007000000023c8e-129.dat	xmrig
behavioral2/files/0x0007000000023c90-136.dat	xmrig
behavioral2/files/0x0007000000023c96-159.dat	xmrig
behavioral2/files/0x0007000000023c95-158.dat	xmrig
behavioral2/files/0x0007000000023c93-157.dat	xmrig
behavioral2/files/0x0007000000023c94-155.dat	xmrig
behavioral2/files/0x0007000000023c91-152.dat	xmrig
behavioral2/files/0x0007000000023c8f-137.dat	xmrig
behavioral2/files/0x0007000000023c97-161.dat	xmrig
behavioral2/files/0x0007000000023c8d-128.dat	xmrig
behavioral2/files/0x0007000000023c8c-123.dat	xmrig
behavioral2/files/0x0007000000023c7d-42.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
4484	hXDWDOO.exe
4708	iJRNNXN.exe
4956	VwbEEuI.exe
4296	SKoPRbT.exe
3784	mLvkify.exe
4276	diQLpPM.exe
3272	awmjdNi.exe
4596	IVrimgk.exe
3172	zetlYJQ.exe
2068	MmNtOle.exe
4148	SZZUDrZ.exe
3276	hTYUSxJ.exe
3468	LuKdcKF.exe
3392	Rjtgqqh.exe
448	DoceDQO.exe
1576	cXsuyVm.exe
512	bUjoeAr.exe
5032	ROgURJa.exe
4972	dGnSlSE.exe
1608	jQGQiNV.exe
1516	DXJDLpL.exe
3052	VDOZIDB.exe
1740	qRGzJqg.exe
1440	czHBqXW.exe
1704	xRalsFS.exe
1128	QRCRYqc.exe
1616	WjDnUnk.exe
2848	LHUdCzF.exe
4468	CyhGrhT.exe
2108	bHIYnpA.exe
1512	mvPXPUP.exe
4644	EVJymcv.exe
2164	CjmXurI.exe
2792	BZfHERX.exe
5084	lHjoRzw.exe
3016	PbiJyGP.exe
1772	ktjryrO.exe
3516	ZRbjiCl.exe
4808	EsWnRCQ.exe
4512	pDiRRgb.exe
1960	QowwQlI.exe
1632	BlRcKRA.exe
2004	IopDRzG.exe
3804	pazPsod.exe
4832	zBaymkS.exe
4268	afhCSUX.exe
2832	jnqZmIL.exe
1064	THwEjkM.exe
4316	ZrPwNLp.exe
3952	BhaVxkL.exe
3416	iEoGUhb.exe
2712	Razifzu.exe
2248	PqHahTb.exe
2244	NNHDZcu.exe
4500	TLbIcwg.exe
5004	YVhiFfV.exe
1748	eYahJBj.exe
5016	CWnySTp.exe
1932	YfoMcEM.exe
4736	vAaZJDy.exe
1820	zBKXNRH.exe
3616	uqMIqGA.exe
928	WRfUHiN.exe
368	RzmaClr.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\BrZQzwE.exe	8c40065d095f86dafd6fb6180c0892ceeccd1474c0698d675461a06769f7d913.exe
File created	C:\Windows\System\LCYhkBh.exe	8c40065d095f86dafd6fb6180c0892ceeccd1474c0698d675461a06769f7d913.exe
File created	C:\Windows\System\ApvlbzR.exe	8c40065d095f86dafd6fb6180c0892ceeccd1474c0698d675461a06769f7d913.exe
File created	C:\Windows\System\VWuPwvD.exe	8c40065d095f86dafd6fb6180c0892ceeccd1474c0698d675461a06769f7d913.exe
File created	C:\Windows\System\xisTpQs.exe	8c40065d095f86dafd6fb6180c0892ceeccd1474c0698d675461a06769f7d913.exe
File created	C:\Windows\System\lBqAnAc.exe	8c40065d095f86dafd6fb6180c0892ceeccd1474c0698d675461a06769f7d913.exe
File created	C:\Windows\System\yoPchHV.exe	8c40065d095f86dafd6fb6180c0892ceeccd1474c0698d675461a06769f7d913.exe
File created	C:\Windows\System\mdYCPno.exe	8c40065d095f86dafd6fb6180c0892ceeccd1474c0698d675461a06769f7d913.exe
File created	C:\Windows\System\AhvLOIF.exe	8c40065d095f86dafd6fb6180c0892ceeccd1474c0698d675461a06769f7d913.exe
File created	C:\Windows\System\gaLWKVm.exe	8c40065d095f86dafd6fb6180c0892ceeccd1474c0698d675461a06769f7d913.exe
File created	C:\Windows\System\jAzVcxz.exe	8c40065d095f86dafd6fb6180c0892ceeccd1474c0698d675461a06769f7d913.exe
File created	C:\Windows\System\zlTbMuH.exe	8c40065d095f86dafd6fb6180c0892ceeccd1474c0698d675461a06769f7d913.exe
File created	C:\Windows\System\PqXPVDc.exe	8c40065d095f86dafd6fb6180c0892ceeccd1474c0698d675461a06769f7d913.exe
File created	C:\Windows\System\sDhxIoM.exe	8c40065d095f86dafd6fb6180c0892ceeccd1474c0698d675461a06769f7d913.exe
File created	C:\Windows\System\SUJMDHq.exe	8c40065d095f86dafd6fb6180c0892ceeccd1474c0698d675461a06769f7d913.exe
File created	C:\Windows\System\QbWftnR.exe	8c40065d095f86dafd6fb6180c0892ceeccd1474c0698d675461a06769f7d913.exe
File created	C:\Windows\System\RIpcphO.exe	8c40065d095f86dafd6fb6180c0892ceeccd1474c0698d675461a06769f7d913.exe
File created	C:\Windows\System\NxmYMMU.exe	8c40065d095f86dafd6fb6180c0892ceeccd1474c0698d675461a06769f7d913.exe
File created	C:\Windows\System\jgCSEBL.exe	8c40065d095f86dafd6fb6180c0892ceeccd1474c0698d675461a06769f7d913.exe
File created	C:\Windows\System\CmhesuA.exe	8c40065d095f86dafd6fb6180c0892ceeccd1474c0698d675461a06769f7d913.exe
File created	C:\Windows\System\jbTPkkT.exe	8c40065d095f86dafd6fb6180c0892ceeccd1474c0698d675461a06769f7d913.exe
File created	C:\Windows\System\aQTmHvr.exe	8c40065d095f86dafd6fb6180c0892ceeccd1474c0698d675461a06769f7d913.exe
File created	C:\Windows\System\xkLhglt.exe	8c40065d095f86dafd6fb6180c0892ceeccd1474c0698d675461a06769f7d913.exe
File created	C:\Windows\System\rExXMHr.exe	8c40065d095f86dafd6fb6180c0892ceeccd1474c0698d675461a06769f7d913.exe
File created	C:\Windows\System\uSNSVKC.exe	8c40065d095f86dafd6fb6180c0892ceeccd1474c0698d675461a06769f7d913.exe
File created	C:\Windows\System\lEXMLHT.exe	8c40065d095f86dafd6fb6180c0892ceeccd1474c0698d675461a06769f7d913.exe
File created	C:\Windows\System\eTWJKxw.exe	8c40065d095f86dafd6fb6180c0892ceeccd1474c0698d675461a06769f7d913.exe
File created	C:\Windows\System\rJBmOqW.exe	8c40065d095f86dafd6fb6180c0892ceeccd1474c0698d675461a06769f7d913.exe
File created	C:\Windows\System\ukDgast.exe	8c40065d095f86dafd6fb6180c0892ceeccd1474c0698d675461a06769f7d913.exe
File created	C:\Windows\System\PiHCRCx.exe	8c40065d095f86dafd6fb6180c0892ceeccd1474c0698d675461a06769f7d913.exe
File created	C:\Windows\System\OYOnEuC.exe	8c40065d095f86dafd6fb6180c0892ceeccd1474c0698d675461a06769f7d913.exe
File created	C:\Windows\System\HvRlePe.exe	8c40065d095f86dafd6fb6180c0892ceeccd1474c0698d675461a06769f7d913.exe
File created	C:\Windows\System\XEGMGKK.exe	8c40065d095f86dafd6fb6180c0892ceeccd1474c0698d675461a06769f7d913.exe
File created	C:\Windows\System\wgxGzxF.exe	8c40065d095f86dafd6fb6180c0892ceeccd1474c0698d675461a06769f7d913.exe
File created	C:\Windows\System\RuzMEvA.exe	8c40065d095f86dafd6fb6180c0892ceeccd1474c0698d675461a06769f7d913.exe
File created	C:\Windows\System\IVrimgk.exe	8c40065d095f86dafd6fb6180c0892ceeccd1474c0698d675461a06769f7d913.exe
File created	C:\Windows\System\mHLPSoY.exe	8c40065d095f86dafd6fb6180c0892ceeccd1474c0698d675461a06769f7d913.exe
File created	C:\Windows\System\uEtaTFI.exe	8c40065d095f86dafd6fb6180c0892ceeccd1474c0698d675461a06769f7d913.exe
File created	C:\Windows\System\PhQEeOb.exe	8c40065d095f86dafd6fb6180c0892ceeccd1474c0698d675461a06769f7d913.exe
File created	C:\Windows\System\xRalsFS.exe	8c40065d095f86dafd6fb6180c0892ceeccd1474c0698d675461a06769f7d913.exe
File created	C:\Windows\System\FZkNSvG.exe	8c40065d095f86dafd6fb6180c0892ceeccd1474c0698d675461a06769f7d913.exe
File created	C:\Windows\System\zRpyQyl.exe	8c40065d095f86dafd6fb6180c0892ceeccd1474c0698d675461a06769f7d913.exe
File created	C:\Windows\System\XcafCuA.exe	8c40065d095f86dafd6fb6180c0892ceeccd1474c0698d675461a06769f7d913.exe
File created	C:\Windows\System\YisFmAZ.exe	8c40065d095f86dafd6fb6180c0892ceeccd1474c0698d675461a06769f7d913.exe
File created	C:\Windows\System\XnoODvW.exe	8c40065d095f86dafd6fb6180c0892ceeccd1474c0698d675461a06769f7d913.exe
File created	C:\Windows\System\QowwQlI.exe	8c40065d095f86dafd6fb6180c0892ceeccd1474c0698d675461a06769f7d913.exe
File created	C:\Windows\System\BlRcKRA.exe	8c40065d095f86dafd6fb6180c0892ceeccd1474c0698d675461a06769f7d913.exe
File created	C:\Windows\System\BHABWWv.exe	8c40065d095f86dafd6fb6180c0892ceeccd1474c0698d675461a06769f7d913.exe
File created	C:\Windows\System\mOTipjU.exe	8c40065d095f86dafd6fb6180c0892ceeccd1474c0698d675461a06769f7d913.exe
File created	C:\Windows\System\oxfVhAS.exe	8c40065d095f86dafd6fb6180c0892ceeccd1474c0698d675461a06769f7d913.exe
File created	C:\Windows\System\vbnCQfk.exe	8c40065d095f86dafd6fb6180c0892ceeccd1474c0698d675461a06769f7d913.exe
File created	C:\Windows\System\oVaDITv.exe	8c40065d095f86dafd6fb6180c0892ceeccd1474c0698d675461a06769f7d913.exe
File created	C:\Windows\System\Qudgopo.exe	8c40065d095f86dafd6fb6180c0892ceeccd1474c0698d675461a06769f7d913.exe
File created	C:\Windows\System\FWjUhbs.exe	8c40065d095f86dafd6fb6180c0892ceeccd1474c0698d675461a06769f7d913.exe
File created	C:\Windows\System\WBEKFyv.exe	8c40065d095f86dafd6fb6180c0892ceeccd1474c0698d675461a06769f7d913.exe
File created	C:\Windows\System\jyDmToI.exe	8c40065d095f86dafd6fb6180c0892ceeccd1474c0698d675461a06769f7d913.exe
File created	C:\Windows\System\xleEQxU.exe	8c40065d095f86dafd6fb6180c0892ceeccd1474c0698d675461a06769f7d913.exe
File created	C:\Windows\System\VDOZIDB.exe	8c40065d095f86dafd6fb6180c0892ceeccd1474c0698d675461a06769f7d913.exe
File created	C:\Windows\System\eYahJBj.exe	8c40065d095f86dafd6fb6180c0892ceeccd1474c0698d675461a06769f7d913.exe
File created	C:\Windows\System\GVgrlkc.exe	8c40065d095f86dafd6fb6180c0892ceeccd1474c0698d675461a06769f7d913.exe
File created	C:\Windows\System\QlMWlcm.exe	8c40065d095f86dafd6fb6180c0892ceeccd1474c0698d675461a06769f7d913.exe
File created	C:\Windows\System\BvCTXtg.exe	8c40065d095f86dafd6fb6180c0892ceeccd1474c0698d675461a06769f7d913.exe
File created	C:\Windows\System\BnddPmg.exe	8c40065d095f86dafd6fb6180c0892ceeccd1474c0698d675461a06769f7d913.exe
File created	C:\Windows\System\sWriOtT.exe	8c40065d095f86dafd6fb6180c0892ceeccd1474c0698d675461a06769f7d913.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	16984	dwm.exe
Token: SeChangeNotifyPrivilege	16984	dwm.exe
Token: 33	16984	dwm.exe
Token: SeIncBasePriorityPrivilege	16984	dwm.exe
Token: SeShutdownPrivilege	16984	dwm.exe
Token: SeCreatePagefilePrivilege	16984	dwm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2748 wrote to memory of 4484	2748	8c40065d095f86dafd6fb6180c0892ceeccd1474c0698d675461a06769f7d913.exe	84
PID 2748 wrote to memory of 4484	2748	8c40065d095f86dafd6fb6180c0892ceeccd1474c0698d675461a06769f7d913.exe	84
PID 2748 wrote to memory of 4708	2748	8c40065d095f86dafd6fb6180c0892ceeccd1474c0698d675461a06769f7d913.exe	85
PID 2748 wrote to memory of 4708	2748	8c40065d095f86dafd6fb6180c0892ceeccd1474c0698d675461a06769f7d913.exe	85
PID 2748 wrote to memory of 4956	2748	8c40065d095f86dafd6fb6180c0892ceeccd1474c0698d675461a06769f7d913.exe	86
PID 2748 wrote to memory of 4956	2748	8c40065d095f86dafd6fb6180c0892ceeccd1474c0698d675461a06769f7d913.exe	86
PID 2748 wrote to memory of 4296	2748	8c40065d095f86dafd6fb6180c0892ceeccd1474c0698d675461a06769f7d913.exe	87
PID 2748 wrote to memory of 4296	2748	8c40065d095f86dafd6fb6180c0892ceeccd1474c0698d675461a06769f7d913.exe	87
PID 2748 wrote to memory of 3784	2748	8c40065d095f86dafd6fb6180c0892ceeccd1474c0698d675461a06769f7d913.exe	88
PID 2748 wrote to memory of 3784	2748	8c40065d095f86dafd6fb6180c0892ceeccd1474c0698d675461a06769f7d913.exe	88
PID 2748 wrote to memory of 4276	2748	8c40065d095f86dafd6fb6180c0892ceeccd1474c0698d675461a06769f7d913.exe	89
PID 2748 wrote to memory of 4276	2748	8c40065d095f86dafd6fb6180c0892ceeccd1474c0698d675461a06769f7d913.exe	89
PID 2748 wrote to memory of 3272	2748	8c40065d095f86dafd6fb6180c0892ceeccd1474c0698d675461a06769f7d913.exe	90
PID 2748 wrote to memory of 3272	2748	8c40065d095f86dafd6fb6180c0892ceeccd1474c0698d675461a06769f7d913.exe	90
PID 2748 wrote to memory of 4596	2748	8c40065d095f86dafd6fb6180c0892ceeccd1474c0698d675461a06769f7d913.exe	91
PID 2748 wrote to memory of 4596	2748	8c40065d095f86dafd6fb6180c0892ceeccd1474c0698d675461a06769f7d913.exe	91
PID 2748 wrote to memory of 3172	2748	8c40065d095f86dafd6fb6180c0892ceeccd1474c0698d675461a06769f7d913.exe	92
PID 2748 wrote to memory of 3172	2748	8c40065d095f86dafd6fb6180c0892ceeccd1474c0698d675461a06769f7d913.exe	92
PID 2748 wrote to memory of 2068	2748	8c40065d095f86dafd6fb6180c0892ceeccd1474c0698d675461a06769f7d913.exe	93
PID 2748 wrote to memory of 2068	2748	8c40065d095f86dafd6fb6180c0892ceeccd1474c0698d675461a06769f7d913.exe	93
PID 2748 wrote to memory of 4148	2748	8c40065d095f86dafd6fb6180c0892ceeccd1474c0698d675461a06769f7d913.exe	94
PID 2748 wrote to memory of 4148	2748	8c40065d095f86dafd6fb6180c0892ceeccd1474c0698d675461a06769f7d913.exe	94
PID 2748 wrote to memory of 3276	2748	8c40065d095f86dafd6fb6180c0892ceeccd1474c0698d675461a06769f7d913.exe	95
PID 2748 wrote to memory of 3276	2748	8c40065d095f86dafd6fb6180c0892ceeccd1474c0698d675461a06769f7d913.exe	95
PID 2748 wrote to memory of 3468	2748	8c40065d095f86dafd6fb6180c0892ceeccd1474c0698d675461a06769f7d913.exe	96
PID 2748 wrote to memory of 3468	2748	8c40065d095f86dafd6fb6180c0892ceeccd1474c0698d675461a06769f7d913.exe	96
PID 2748 wrote to memory of 3392	2748	8c40065d095f86dafd6fb6180c0892ceeccd1474c0698d675461a06769f7d913.exe	97
PID 2748 wrote to memory of 3392	2748	8c40065d095f86dafd6fb6180c0892ceeccd1474c0698d675461a06769f7d913.exe	97
PID 2748 wrote to memory of 448	2748	8c40065d095f86dafd6fb6180c0892ceeccd1474c0698d675461a06769f7d913.exe	98
PID 2748 wrote to memory of 448	2748	8c40065d095f86dafd6fb6180c0892ceeccd1474c0698d675461a06769f7d913.exe	98
PID 2748 wrote to memory of 1576	2748	8c40065d095f86dafd6fb6180c0892ceeccd1474c0698d675461a06769f7d913.exe	99
PID 2748 wrote to memory of 1576	2748	8c40065d095f86dafd6fb6180c0892ceeccd1474c0698d675461a06769f7d913.exe	99
PID 2748 wrote to memory of 512	2748	8c40065d095f86dafd6fb6180c0892ceeccd1474c0698d675461a06769f7d913.exe	100
PID 2748 wrote to memory of 512	2748	8c40065d095f86dafd6fb6180c0892ceeccd1474c0698d675461a06769f7d913.exe	100
PID 2748 wrote to memory of 5032	2748	8c40065d095f86dafd6fb6180c0892ceeccd1474c0698d675461a06769f7d913.exe	101
PID 2748 wrote to memory of 5032	2748	8c40065d095f86dafd6fb6180c0892ceeccd1474c0698d675461a06769f7d913.exe	101
PID 2748 wrote to memory of 4972	2748	8c40065d095f86dafd6fb6180c0892ceeccd1474c0698d675461a06769f7d913.exe	102
PID 2748 wrote to memory of 4972	2748	8c40065d095f86dafd6fb6180c0892ceeccd1474c0698d675461a06769f7d913.exe	102
PID 2748 wrote to memory of 1608	2748	8c40065d095f86dafd6fb6180c0892ceeccd1474c0698d675461a06769f7d913.exe	103
PID 2748 wrote to memory of 1608	2748	8c40065d095f86dafd6fb6180c0892ceeccd1474c0698d675461a06769f7d913.exe	103
PID 2748 wrote to memory of 1516	2748	8c40065d095f86dafd6fb6180c0892ceeccd1474c0698d675461a06769f7d913.exe	104
PID 2748 wrote to memory of 1516	2748	8c40065d095f86dafd6fb6180c0892ceeccd1474c0698d675461a06769f7d913.exe	104
PID 2748 wrote to memory of 3052	2748	8c40065d095f86dafd6fb6180c0892ceeccd1474c0698d675461a06769f7d913.exe	105
PID 2748 wrote to memory of 3052	2748	8c40065d095f86dafd6fb6180c0892ceeccd1474c0698d675461a06769f7d913.exe	105
PID 2748 wrote to memory of 1740	2748	8c40065d095f86dafd6fb6180c0892ceeccd1474c0698d675461a06769f7d913.exe	106
PID 2748 wrote to memory of 1740	2748	8c40065d095f86dafd6fb6180c0892ceeccd1474c0698d675461a06769f7d913.exe	106
PID 2748 wrote to memory of 1440	2748	8c40065d095f86dafd6fb6180c0892ceeccd1474c0698d675461a06769f7d913.exe	107
PID 2748 wrote to memory of 1440	2748	8c40065d095f86dafd6fb6180c0892ceeccd1474c0698d675461a06769f7d913.exe	107
PID 2748 wrote to memory of 1704	2748	8c40065d095f86dafd6fb6180c0892ceeccd1474c0698d675461a06769f7d913.exe	108
PID 2748 wrote to memory of 1704	2748	8c40065d095f86dafd6fb6180c0892ceeccd1474c0698d675461a06769f7d913.exe	108
PID 2748 wrote to memory of 1128	2748	8c40065d095f86dafd6fb6180c0892ceeccd1474c0698d675461a06769f7d913.exe	109
PID 2748 wrote to memory of 1128	2748	8c40065d095f86dafd6fb6180c0892ceeccd1474c0698d675461a06769f7d913.exe	109
PID 2748 wrote to memory of 1616	2748	8c40065d095f86dafd6fb6180c0892ceeccd1474c0698d675461a06769f7d913.exe	110
PID 2748 wrote to memory of 1616	2748	8c40065d095f86dafd6fb6180c0892ceeccd1474c0698d675461a06769f7d913.exe	110
PID 2748 wrote to memory of 2848	2748	8c40065d095f86dafd6fb6180c0892ceeccd1474c0698d675461a06769f7d913.exe	111
PID 2748 wrote to memory of 2848	2748	8c40065d095f86dafd6fb6180c0892ceeccd1474c0698d675461a06769f7d913.exe	111
PID 2748 wrote to memory of 4468	2748	8c40065d095f86dafd6fb6180c0892ceeccd1474c0698d675461a06769f7d913.exe	112
PID 2748 wrote to memory of 4468	2748	8c40065d095f86dafd6fb6180c0892ceeccd1474c0698d675461a06769f7d913.exe	112
PID 2748 wrote to memory of 2108	2748	8c40065d095f86dafd6fb6180c0892ceeccd1474c0698d675461a06769f7d913.exe	113
PID 2748 wrote to memory of 2108	2748	8c40065d095f86dafd6fb6180c0892ceeccd1474c0698d675461a06769f7d913.exe	113
PID 2748 wrote to memory of 1512	2748	8c40065d095f86dafd6fb6180c0892ceeccd1474c0698d675461a06769f7d913.exe	114
PID 2748 wrote to memory of 1512	2748	8c40065d095f86dafd6fb6180c0892ceeccd1474c0698d675461a06769f7d913.exe	114
PID 2748 wrote to memory of 4644	2748	8c40065d095f86dafd6fb6180c0892ceeccd1474c0698d675461a06769f7d913.exe	115
PID 2748 wrote to memory of 4644	2748	8c40065d095f86dafd6fb6180c0892ceeccd1474c0698d675461a06769f7d913.exe	115

C:\Users\Admin\AppData\Local\Temp\8c40065d095f86dafd6fb6180c0892ceeccd1474c0698d675461a06769f7d913.exe
"C:\Users\Admin\AppData\Local\Temp\8c40065d095f86dafd6fb6180c0892ceeccd1474c0698d675461a06769f7d913.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2748
- C:\Windows\System\hXDWDOO.exe
  C:\Windows\System\hXDWDOO.exe
  2⤵
  - Executes dropped EXE
  PID:4484
- C:\Windows\System\iJRNNXN.exe
  C:\Windows\System\iJRNNXN.exe
  2⤵
  - Executes dropped EXE
  PID:4708
- C:\Windows\System\VwbEEuI.exe
  C:\Windows\System\VwbEEuI.exe
  2⤵
  - Executes dropped EXE
  PID:4956
- C:\Windows\System\SKoPRbT.exe
  C:\Windows\System\SKoPRbT.exe
  2⤵
  - Executes dropped EXE
  PID:4296
- C:\Windows\System\mLvkify.exe
  C:\Windows\System\mLvkify.exe
  2⤵
  - Executes dropped EXE
  PID:3784
- C:\Windows\System\diQLpPM.exe
  C:\Windows\System\diQLpPM.exe
  2⤵
  - Executes dropped EXE
  PID:4276
- C:\Windows\System\awmjdNi.exe
  C:\Windows\System\awmjdNi.exe
  2⤵
  - Executes dropped EXE
  PID:3272
- C:\Windows\System\IVrimgk.exe
  C:\Windows\System\IVrimgk.exe
  2⤵
  - Executes dropped EXE
  PID:4596
- C:\Windows\System\zetlYJQ.exe
  C:\Windows\System\zetlYJQ.exe
  2⤵
  - Executes dropped EXE
  PID:3172
- C:\Windows\System\MmNtOle.exe
  C:\Windows\System\MmNtOle.exe
  2⤵
  - Executes dropped EXE
  PID:2068
- C:\Windows\System\SZZUDrZ.exe
  C:\Windows\System\SZZUDrZ.exe
  2⤵
  - Executes dropped EXE
  PID:4148
- C:\Windows\System\hTYUSxJ.exe
  C:\Windows\System\hTYUSxJ.exe
  2⤵
  - Executes dropped EXE
  PID:3276
- C:\Windows\System\LuKdcKF.exe
  C:\Windows\System\LuKdcKF.exe
  2⤵
  - Executes dropped EXE
  PID:3468
- C:\Windows\System\Rjtgqqh.exe
  C:\Windows\System\Rjtgqqh.exe
  2⤵
  - Executes dropped EXE
  PID:3392
- C:\Windows\System\DoceDQO.exe
  C:\Windows\System\DoceDQO.exe
  2⤵
  - Executes dropped EXE
  PID:448
- C:\Windows\System\cXsuyVm.exe
  C:\Windows\System\cXsuyVm.exe
  2⤵
  - Executes dropped EXE
  PID:1576
- C:\Windows\System\bUjoeAr.exe
  C:\Windows\System\bUjoeAr.exe
  2⤵
  - Executes dropped EXE
  PID:512
- C:\Windows\System\ROgURJa.exe
  C:\Windows\System\ROgURJa.exe
  2⤵
  - Executes dropped EXE
  PID:5032
- C:\Windows\System\dGnSlSE.exe
  C:\Windows\System\dGnSlSE.exe
  2⤵
  - Executes dropped EXE
  PID:4972
- C:\Windows\System\jQGQiNV.exe
  C:\Windows\System\jQGQiNV.exe
  2⤵
  - Executes dropped EXE
  PID:1608
- C:\Windows\System\DXJDLpL.exe
  C:\Windows\System\DXJDLpL.exe
  2⤵
  - Executes dropped EXE
  PID:1516
- C:\Windows\System\VDOZIDB.exe
  C:\Windows\System\VDOZIDB.exe
  2⤵
  - Executes dropped EXE
  PID:3052
- C:\Windows\System\qRGzJqg.exe
  C:\Windows\System\qRGzJqg.exe
  2⤵
  - Executes dropped EXE
  PID:1740
- C:\Windows\System\czHBqXW.exe
  C:\Windows\System\czHBqXW.exe
  2⤵
  - Executes dropped EXE
  PID:1440
- C:\Windows\System\xRalsFS.exe
  C:\Windows\System\xRalsFS.exe
  2⤵
  - Executes dropped EXE
  PID:1704
- C:\Windows\System\QRCRYqc.exe
  C:\Windows\System\QRCRYqc.exe
  2⤵
  - Executes dropped EXE
  PID:1128
- C:\Windows\System\WjDnUnk.exe
  C:\Windows\System\WjDnUnk.exe
  2⤵
  - Executes dropped EXE
  PID:1616
- C:\Windows\System\LHUdCzF.exe
  C:\Windows\System\LHUdCzF.exe
  2⤵
  - Executes dropped EXE
  PID:2848
- C:\Windows\System\CyhGrhT.exe
  C:\Windows\System\CyhGrhT.exe
  2⤵
  - Executes dropped EXE
  PID:4468
- C:\Windows\System\bHIYnpA.exe
  C:\Windows\System\bHIYnpA.exe
  2⤵
  - Executes dropped EXE
  PID:2108
- C:\Windows\System\mvPXPUP.exe
  C:\Windows\System\mvPXPUP.exe
  2⤵
  - Executes dropped EXE
  PID:1512
- C:\Windows\System\EVJymcv.exe
  C:\Windows\System\EVJymcv.exe
  2⤵
  - Executes dropped EXE
  PID:4644
- C:\Windows\System\CjmXurI.exe
  C:\Windows\System\CjmXurI.exe
  2⤵
  - Executes dropped EXE
  PID:2164
- C:\Windows\System\BZfHERX.exe
  C:\Windows\System\BZfHERX.exe
  2⤵
  - Executes dropped EXE
  PID:2792
- C:\Windows\System\lHjoRzw.exe
  C:\Windows\System\lHjoRzw.exe
  2⤵
  - Executes dropped EXE
  PID:5084
- C:\Windows\System\PbiJyGP.exe
  C:\Windows\System\PbiJyGP.exe
  2⤵
  - Executes dropped EXE
  PID:3016
- C:\Windows\System\ktjryrO.exe
  C:\Windows\System\ktjryrO.exe
  2⤵
  - Executes dropped EXE
  PID:1772
- C:\Windows\System\ZRbjiCl.exe
  C:\Windows\System\ZRbjiCl.exe
  2⤵
  - Executes dropped EXE
  PID:3516
- C:\Windows\System\pDiRRgb.exe
  C:\Windows\System\pDiRRgb.exe
  2⤵
  - Executes dropped EXE
  PID:4512
- C:\Windows\System\EsWnRCQ.exe
  C:\Windows\System\EsWnRCQ.exe
  2⤵
  - Executes dropped EXE
  PID:4808
- C:\Windows\System\QowwQlI.exe
  C:\Windows\System\QowwQlI.exe
  2⤵
  - Executes dropped EXE
  PID:1960
- C:\Windows\System\BlRcKRA.exe
  C:\Windows\System\BlRcKRA.exe
  2⤵
  - Executes dropped EXE
  PID:1632
- C:\Windows\System\IopDRzG.exe
  C:\Windows\System\IopDRzG.exe
  2⤵
  - Executes dropped EXE
  PID:2004
- C:\Windows\System\pazPsod.exe
  C:\Windows\System\pazPsod.exe
  2⤵
  - Executes dropped EXE
  PID:3804
- C:\Windows\System\zBaymkS.exe
  C:\Windows\System\zBaymkS.exe
  2⤵
  - Executes dropped EXE
  PID:4832
- C:\Windows\System\afhCSUX.exe
  C:\Windows\System\afhCSUX.exe
  2⤵
  - Executes dropped EXE
  PID:4268
- C:\Windows\System\jnqZmIL.exe
  C:\Windows\System\jnqZmIL.exe
  2⤵
  - Executes dropped EXE
  PID:2832
- C:\Windows\System\THwEjkM.exe
  C:\Windows\System\THwEjkM.exe
  2⤵
  - Executes dropped EXE
  PID:1064
- C:\Windows\System\ZrPwNLp.exe
  C:\Windows\System\ZrPwNLp.exe
  2⤵
  - Executes dropped EXE
  PID:4316
- C:\Windows\System\BhaVxkL.exe
  C:\Windows\System\BhaVxkL.exe
  2⤵
  - Executes dropped EXE
  PID:3952
- C:\Windows\System\iEoGUhb.exe
  C:\Windows\System\iEoGUhb.exe
  2⤵
  - Executes dropped EXE
  PID:3416
- C:\Windows\System\Razifzu.exe
  C:\Windows\System\Razifzu.exe
  2⤵
  - Executes dropped EXE
  PID:2712
- C:\Windows\System\PqHahTb.exe
  C:\Windows\System\PqHahTb.exe
  2⤵
  - Executes dropped EXE
  PID:2248
- C:\Windows\System\NNHDZcu.exe
  C:\Windows\System\NNHDZcu.exe
  2⤵
  - Executes dropped EXE
  PID:2244
- C:\Windows\System\TLbIcwg.exe
  C:\Windows\System\TLbIcwg.exe
  2⤵
  - Executes dropped EXE
  PID:4500
- C:\Windows\System\YVhiFfV.exe
  C:\Windows\System\YVhiFfV.exe
  2⤵
  - Executes dropped EXE
  PID:5004
- C:\Windows\System\eYahJBj.exe
  C:\Windows\System\eYahJBj.exe
  2⤵
  - Executes dropped EXE
  PID:1748
- C:\Windows\System\CWnySTp.exe
  C:\Windows\System\CWnySTp.exe
  2⤵
  - Executes dropped EXE
  PID:5016
- C:\Windows\System\YfoMcEM.exe
  C:\Windows\System\YfoMcEM.exe
  2⤵
  - Executes dropped EXE
  PID:1932
- C:\Windows\System\vAaZJDy.exe
  C:\Windows\System\vAaZJDy.exe
  2⤵
  - Executes dropped EXE
  PID:4736
- C:\Windows\System\zBKXNRH.exe
  C:\Windows\System\zBKXNRH.exe
  2⤵
  - Executes dropped EXE
  PID:1820
- C:\Windows\System\uqMIqGA.exe
  C:\Windows\System\uqMIqGA.exe
  2⤵
  - Executes dropped EXE
  PID:3616
- C:\Windows\System\WRfUHiN.exe
  C:\Windows\System\WRfUHiN.exe
  2⤵
  - Executes dropped EXE
  PID:928
- C:\Windows\System\UAHnhly.exe
  C:\Windows\System\UAHnhly.exe
  2⤵
  PID:3576
- C:\Windows\System\RzmaClr.exe
  C:\Windows\System\RzmaClr.exe
  2⤵
  - Executes dropped EXE
  PID:368
- C:\Windows\System\isSqNzM.exe
  C:\Windows\System\isSqNzM.exe
  2⤵
  PID:1164
- C:\Windows\System\iZYAMAV.exe
  C:\Windows\System\iZYAMAV.exe
  2⤵
  PID:1004
- C:\Windows\System\qsiREXI.exe
  C:\Windows\System\qsiREXI.exe
  2⤵
  PID:1836
- C:\Windows\System\HzyGYzq.exe
  C:\Windows\System\HzyGYzq.exe
  2⤵
  PID:2436
- C:\Windows\System\KLmJhUo.exe
  C:\Windows\System\KLmJhUo.exe
  2⤵
  PID:748
- C:\Windows\System\LEXJyrh.exe
  C:\Windows\System\LEXJyrh.exe
  2⤵
  PID:5100
- C:\Windows\System\QsMrcEJ.exe
  C:\Windows\System\QsMrcEJ.exe
  2⤵
  PID:3776
- C:\Windows\System\rmEawnf.exe
  C:\Windows\System\rmEawnf.exe
  2⤵
  PID:60
- C:\Windows\System\psYoyfx.exe
  C:\Windows\System\psYoyfx.exe
  2⤵
  PID:5060
- C:\Windows\System\WYyCtzk.exe
  C:\Windows\System\WYyCtzk.exe
  2⤵
  PID:848
- C:\Windows\System\iULjqUq.exe
  C:\Windows\System\iULjqUq.exe
  2⤵
  PID:760
- C:\Windows\System\lTkUaGR.exe
  C:\Windows\System\lTkUaGR.exe
  2⤵
  PID:2852
- C:\Windows\System\pzqiNdC.exe
  C:\Windows\System\pzqiNdC.exe
  2⤵
  PID:4900
- C:\Windows\System\mHLPSoY.exe
  C:\Windows\System\mHLPSoY.exe
  2⤵
  PID:1860
- C:\Windows\System\gSWHUti.exe
  C:\Windows\System\gSWHUti.exe
  2⤵
  PID:3644
- C:\Windows\System\axHHQWq.exe
  C:\Windows\System\axHHQWq.exe
  2⤵
  PID:4700
- C:\Windows\System\UhTmQqg.exe
  C:\Windows\System\UhTmQqg.exe
  2⤵
  PID:2724
- C:\Windows\System\HvRlePe.exe
  C:\Windows\System\HvRlePe.exe
  2⤵
  PID:3508
- C:\Windows\System\zQDLRqv.exe
  C:\Windows\System\zQDLRqv.exe
  2⤵
  PID:3636
- C:\Windows\System\CRKdHSZ.exe
  C:\Windows\System\CRKdHSZ.exe
  2⤵
  PID:4120
- C:\Windows\System\gdWSyWz.exe
  C:\Windows\System\gdWSyWz.exe
  2⤵
  PID:4504
- C:\Windows\System\SjppaFW.exe
  C:\Windows\System\SjppaFW.exe
  2⤵
  PID:4384
- C:\Windows\System\nRSgEdm.exe
  C:\Windows\System\nRSgEdm.exe
  2⤵
  PID:4456
- C:\Windows\System\YebeTDF.exe
  C:\Windows\System\YebeTDF.exe
  2⤵
  PID:3828
- C:\Windows\System\FooPZrn.exe
  C:\Windows\System\FooPZrn.exe
  2⤵
  PID:4248
- C:\Windows\System\hWbbimL.exe
  C:\Windows\System\hWbbimL.exe
  2⤵
  PID:3872
- C:\Windows\System\DdWIGiJ.exe
  C:\Windows\System\DdWIGiJ.exe
  2⤵
  PID:4180
- C:\Windows\System\PTlCNHC.exe
  C:\Windows\System\PTlCNHC.exe
  2⤵
  PID:1768
- C:\Windows\System\KNrKmMA.exe
  C:\Windows\System\KNrKmMA.exe
  2⤵
  PID:2020
- C:\Windows\System\PqXPVDc.exe
  C:\Windows\System\PqXPVDc.exe
  2⤵
  PID:4916
- C:\Windows\System\VUlICOh.exe
  C:\Windows\System\VUlICOh.exe
  2⤵
  PID:2820
- C:\Windows\System\ZqCDhmH.exe
  C:\Windows\System\ZqCDhmH.exe
  2⤵
  PID:1428
- C:\Windows\System\hRWVdea.exe
  C:\Windows\System\hRWVdea.exe
  2⤵
  PID:2616
- C:\Windows\System\CobBpyh.exe
  C:\Windows\System\CobBpyh.exe
  2⤵
  PID:2408
- C:\Windows\System\qMuoEvr.exe
  C:\Windows\System\qMuoEvr.exe
  2⤵
  PID:1208
- C:\Windows\System\sTjwfqT.exe
  C:\Windows\System\sTjwfqT.exe
  2⤵
  PID:4508
- C:\Windows\System\oiCpmjs.exe
  C:\Windows\System\oiCpmjs.exe
  2⤵
  PID:4200
- C:\Windows\System\rpzFExe.exe
  C:\Windows\System\rpzFExe.exe
  2⤵
  PID:2512
- C:\Windows\System\sDhxIoM.exe
  C:\Windows\System\sDhxIoM.exe
  2⤵
  PID:2524
- C:\Windows\System\htCvquz.exe
  C:\Windows\System\htCvquz.exe
  2⤵
  PID:4992
- C:\Windows\System\zOVqKbI.exe
  C:\Windows\System\zOVqKbI.exe
  2⤵
  PID:3924
- C:\Windows\System\ZFHECbS.exe
  C:\Windows\System\ZFHECbS.exe
  2⤵
  PID:2948
- C:\Windows\System\XEGMGKK.exe
  C:\Windows\System\XEGMGKK.exe
  2⤵
  PID:5108
- C:\Windows\System\NDDSJSS.exe
  C:\Windows\System\NDDSJSS.exe
  2⤵
  PID:1056
- C:\Windows\System\PBUufNo.exe
  C:\Windows\System\PBUufNo.exe
  2⤵
  PID:2600
- C:\Windows\System\hRWClEh.exe
  C:\Windows\System\hRWClEh.exe
  2⤵
  PID:3456
- C:\Windows\System\MhKQEQy.exe
  C:\Windows\System\MhKQEQy.exe
  2⤵
  PID:1412
- C:\Windows\System\yMpbPCO.exe
  C:\Windows\System\yMpbPCO.exe
  2⤵
  PID:4860
- C:\Windows\System\QEDoVnE.exe
  C:\Windows\System\QEDoVnE.exe
  2⤵
  PID:3548
- C:\Windows\System\sTkOiMN.exe
  C:\Windows\System\sTkOiMN.exe
  2⤵
  PID:5132
- C:\Windows\System\kdqxHRq.exe
  C:\Windows\System\kdqxHRq.exe
  2⤵
  PID:5156
- C:\Windows\System\MTgbkil.exe
  C:\Windows\System\MTgbkil.exe
  2⤵
  PID:5200
- C:\Windows\System\PjfQAVv.exe
  C:\Windows\System\PjfQAVv.exe
  2⤵
  PID:5232
- C:\Windows\System\kPSIfBO.exe
  C:\Windows\System\kPSIfBO.exe
  2⤵
  PID:5264
- C:\Windows\System\fQnOAjo.exe
  C:\Windows\System\fQnOAjo.exe
  2⤵
  PID:5284
- C:\Windows\System\jXPUGfe.exe
  C:\Windows\System\jXPUGfe.exe
  2⤵
  PID:5312
- C:\Windows\System\gfZTKrZ.exe
  C:\Windows\System\gfZTKrZ.exe
  2⤵
  PID:5348
- C:\Windows\System\dlZbVqQ.exe
  C:\Windows\System\dlZbVqQ.exe
  2⤵
  PID:5368
- C:\Windows\System\FUHmzdK.exe
  C:\Windows\System\FUHmzdK.exe
  2⤵
  PID:5400
- C:\Windows\System\IyYsUJN.exe
  C:\Windows\System\IyYsUJN.exe
  2⤵
  PID:5432
- C:\Windows\System\mGaFDcd.exe
  C:\Windows\System\mGaFDcd.exe
  2⤵
  PID:5460
- C:\Windows\System\qMAktKR.exe
  C:\Windows\System\qMAktKR.exe
  2⤵
  PID:5480
- C:\Windows\System\wYKYNaB.exe
  C:\Windows\System\wYKYNaB.exe
  2⤵
  PID:5508
- C:\Windows\System\PiHCRCx.exe
  C:\Windows\System\PiHCRCx.exe
  2⤵
  PID:5540
- C:\Windows\System\OsclHtN.exe
  C:\Windows\System\OsclHtN.exe
  2⤵
  PID:5564
- C:\Windows\System\jSDStJO.exe
  C:\Windows\System\jSDStJO.exe
  2⤵
  PID:5592
- C:\Windows\System\jQKEGkn.exe
  C:\Windows\System\jQKEGkn.exe
  2⤵
  PID:5632
- C:\Windows\System\BwzlPJZ.exe
  C:\Windows\System\BwzlPJZ.exe
  2⤵
  PID:5648
- C:\Windows\System\MYHzUls.exe
  C:\Windows\System\MYHzUls.exe
  2⤵
  PID:5676
- C:\Windows\System\acararY.exe
  C:\Windows\System\acararY.exe
  2⤵
  PID:5704
- C:\Windows\System\Qgymsfw.exe
  C:\Windows\System\Qgymsfw.exe
  2⤵
  PID:5736
- C:\Windows\System\hZVzXLe.exe
  C:\Windows\System\hZVzXLe.exe
  2⤵
  PID:5764
- C:\Windows\System\lnnhEYz.exe
  C:\Windows\System\lnnhEYz.exe
  2⤵
  PID:5792
- C:\Windows\System\QwflIea.exe
  C:\Windows\System\QwflIea.exe
  2⤵
  PID:5820
- C:\Windows\System\loouSYH.exe
  C:\Windows\System\loouSYH.exe
  2⤵
  PID:5848
- C:\Windows\System\fGjsKGg.exe
  C:\Windows\System\fGjsKGg.exe
  2⤵
  PID:5876
- C:\Windows\System\CvhJDNL.exe
  C:\Windows\System\CvhJDNL.exe
  2⤵
  PID:5904
- C:\Windows\System\bhIlYxE.exe
  C:\Windows\System\bhIlYxE.exe
  2⤵
  PID:5932
- C:\Windows\System\jnNGcNp.exe
  C:\Windows\System\jnNGcNp.exe
  2⤵
  PID:5960
- C:\Windows\System\eouKiaq.exe
  C:\Windows\System\eouKiaq.exe
  2⤵
  PID:5988
- C:\Windows\System\HwHSFmU.exe
  C:\Windows\System\HwHSFmU.exe
  2⤵
  PID:6008
- C:\Windows\System\liPqlYr.exe
  C:\Windows\System\liPqlYr.exe
  2⤵
  PID:6036
- C:\Windows\System\IErXsQZ.exe
  C:\Windows\System\IErXsQZ.exe
  2⤵
  PID:6076
- C:\Windows\System\lUIqIhR.exe
  C:\Windows\System\lUIqIhR.exe
  2⤵
  PID:6100
- C:\Windows\System\taYPZLS.exe
  C:\Windows\System\taYPZLS.exe
  2⤵
  PID:6128
- C:\Windows\System\ZUoXKVF.exe
  C:\Windows\System\ZUoXKVF.exe
  2⤵
  PID:5148
- C:\Windows\System\KMJgjyo.exe
  C:\Windows\System\KMJgjyo.exe
  2⤵
  PID:5224
- C:\Windows\System\pHKnKXP.exe
  C:\Windows\System\pHKnKXP.exe
  2⤵
  PID:5296
- C:\Windows\System\UjuSIfM.exe
  C:\Windows\System\UjuSIfM.exe
  2⤵
  PID:5360
- C:\Windows\System\QPgtKPQ.exe
  C:\Windows\System\QPgtKPQ.exe
  2⤵
  PID:5420
- C:\Windows\System\pXKbSTe.exe
  C:\Windows\System\pXKbSTe.exe
  2⤵
  PID:5492
- C:\Windows\System\kpydQJY.exe
  C:\Windows\System\kpydQJY.exe
  2⤵
  PID:5560
- C:\Windows\System\vaVIwwx.exe
  C:\Windows\System\vaVIwwx.exe
  2⤵
  PID:5616
- C:\Windows\System\DNaEWLe.exe
  C:\Windows\System\DNaEWLe.exe
  2⤵
  PID:5696
- C:\Windows\System\fHVQZyx.exe
  C:\Windows\System\fHVQZyx.exe
  2⤵
  PID:5760
- C:\Windows\System\mVlTvHz.exe
  C:\Windows\System\mVlTvHz.exe
  2⤵
  PID:5844
- C:\Windows\System\dFilXaL.exe
  C:\Windows\System\dFilXaL.exe
  2⤵
  PID:5892
- C:\Windows\System\junPrsA.exe
  C:\Windows\System\junPrsA.exe
  2⤵
  PID:5944
- C:\Windows\System\NMDSeMv.exe
  C:\Windows\System\NMDSeMv.exe
  2⤵
  PID:6044
- C:\Windows\System\LqriFAz.exe
  C:\Windows\System\LqriFAz.exe
  2⤵
  PID:6096
- C:\Windows\System\eOAnhWO.exe
  C:\Windows\System\eOAnhWO.exe
  2⤵
  PID:5176
- C:\Windows\System\OyZWiDi.exe
  C:\Windows\System\OyZWiDi.exe
  2⤵
  PID:5336
- C:\Windows\System\kIBmxNT.exe
  C:\Windows\System\kIBmxNT.exe
  2⤵
  PID:5476
- C:\Windows\System\XuyGmAL.exe
  C:\Windows\System\XuyGmAL.exe
  2⤵
  PID:5660
- C:\Windows\System\xAguXIv.exe
  C:\Windows\System\xAguXIv.exe
  2⤵
  PID:5832
- C:\Windows\System\VggfUBq.exe
  C:\Windows\System\VggfUBq.exe
  2⤵
  PID:5972
- C:\Windows\System\Wqyxzkk.exe
  C:\Windows\System\Wqyxzkk.exe
  2⤵
  PID:6124
- C:\Windows\System\DyojSbo.exe
  C:\Windows\System\DyojSbo.exe
  2⤵
  PID:5412
- C:\Windows\System\VaLmvUl.exe
  C:\Windows\System\VaLmvUl.exe
  2⤵
  PID:5748
- C:\Windows\System\hSobLCC.exe
  C:\Windows\System\hSobLCC.exe
  2⤵
  PID:6092
- C:\Windows\System\SBJinve.exe
  C:\Windows\System\SBJinve.exe
  2⤵
  PID:5548
- C:\Windows\System\xzGqsSM.exe
  C:\Windows\System\xzGqsSM.exe
  2⤵
  PID:6164
- C:\Windows\System\uEtaTFI.exe
  C:\Windows\System\uEtaTFI.exe
  2⤵
  PID:6192
- C:\Windows\System\WKdFtSl.exe
  C:\Windows\System\WKdFtSl.exe
  2⤵
  PID:6220
- C:\Windows\System\kILthcn.exe
  C:\Windows\System\kILthcn.exe
  2⤵
  PID:6248
- C:\Windows\System\VsSykBb.exe
  C:\Windows\System\VsSykBb.exe
  2⤵
  PID:6276
- C:\Windows\System\HsjReCU.exe
  C:\Windows\System\HsjReCU.exe
  2⤵
  PID:6304
- C:\Windows\System\zyroRPN.exe
  C:\Windows\System\zyroRPN.exe
  2⤵
  PID:6332
- C:\Windows\System\CsFzcml.exe
  C:\Windows\System\CsFzcml.exe
  2⤵
  PID:6360
- C:\Windows\System\RCajrNN.exe
  C:\Windows\System\RCajrNN.exe
  2⤵
  PID:6388
- C:\Windows\System\mdYCPno.exe
  C:\Windows\System\mdYCPno.exe
  2⤵
  PID:6420
- C:\Windows\System\ukWBrPj.exe
  C:\Windows\System\ukWBrPj.exe
  2⤵
  PID:6448
- C:\Windows\System\jbTPkkT.exe
  C:\Windows\System\jbTPkkT.exe
  2⤵
  PID:6476
- C:\Windows\System\FYDIRAO.exe
  C:\Windows\System\FYDIRAO.exe
  2⤵
  PID:6504
- C:\Windows\System\ApvlbzR.exe
  C:\Windows\System\ApvlbzR.exe
  2⤵
  PID:6532
- C:\Windows\System\kSAtCfY.exe
  C:\Windows\System\kSAtCfY.exe
  2⤵
  PID:6560
- C:\Windows\System\HWzXiWH.exe
  C:\Windows\System\HWzXiWH.exe
  2⤵
  PID:6588
- C:\Windows\System\aQTmHvr.exe
  C:\Windows\System\aQTmHvr.exe
  2⤵
  PID:6616
- C:\Windows\System\ptOVmXC.exe
  C:\Windows\System\ptOVmXC.exe
  2⤵
  PID:6644
- C:\Windows\System\wBlWENs.exe
  C:\Windows\System\wBlWENs.exe
  2⤵
  PID:6672
- C:\Windows\System\ynlCoHV.exe
  C:\Windows\System\ynlCoHV.exe
  2⤵
  PID:6700
- C:\Windows\System\ieEXQLG.exe
  C:\Windows\System\ieEXQLG.exe
  2⤵
  PID:6728
- C:\Windows\System\UXaFrEq.exe
  C:\Windows\System\UXaFrEq.exe
  2⤵
  PID:6756
- C:\Windows\System\jzMdKop.exe
  C:\Windows\System\jzMdKop.exe
  2⤵
  PID:6784
- C:\Windows\System\clULuCa.exe
  C:\Windows\System\clULuCa.exe
  2⤵
  PID:6812
- C:\Windows\System\gbRYhIW.exe
  C:\Windows\System\gbRYhIW.exe
  2⤵
  PID:6840
- C:\Windows\System\xsrdslX.exe
  C:\Windows\System\xsrdslX.exe
  2⤵
  PID:6868
- C:\Windows\System\zySzFoy.exe
  C:\Windows\System\zySzFoy.exe
  2⤵
  PID:6896
- C:\Windows\System\JnQVyJR.exe
  C:\Windows\System\JnQVyJR.exe
  2⤵
  PID:6924
- C:\Windows\System\RtOzYZC.exe
  C:\Windows\System\RtOzYZC.exe
  2⤵
  PID:6952
- C:\Windows\System\BZLjtCx.exe
  C:\Windows\System\BZLjtCx.exe
  2⤵
  PID:6972
- C:\Windows\System\tSoiyXs.exe
  C:\Windows\System\tSoiyXs.exe
  2⤵
  PID:7004
- C:\Windows\System\fhkTVXi.exe
  C:\Windows\System\fhkTVXi.exe
  2⤵
  PID:7032
- C:\Windows\System\EjoFjuC.exe
  C:\Windows\System\EjoFjuC.exe
  2⤵
  PID:7056
- C:\Windows\System\VobUgmf.exe
  C:\Windows\System\VobUgmf.exe
  2⤵
  PID:7092
- C:\Windows\System\aaeCRvj.exe
  C:\Windows\System\aaeCRvj.exe
  2⤵
  PID:7120
- C:\Windows\System\fWmXDIs.exe
  C:\Windows\System\fWmXDIs.exe
  2⤵
  PID:7148
- C:\Windows\System\UUyMkEw.exe
  C:\Windows\System\UUyMkEw.exe
  2⤵
  PID:5612
- C:\Windows\System\XXxEWRp.exe
  C:\Windows\System\XXxEWRp.exe
  2⤵
  PID:6204
- C:\Windows\System\hxgVOmo.exe
  C:\Windows\System\hxgVOmo.exe
  2⤵
  PID:6268
- C:\Windows\System\QFhbwWM.exe
  C:\Windows\System\QFhbwWM.exe
  2⤵
  PID:6328
- C:\Windows\System\IXplYsH.exe
  C:\Windows\System\IXplYsH.exe
  2⤵
  PID:6404
- C:\Windows\System\IkWYkmg.exe
  C:\Windows\System\IkWYkmg.exe
  2⤵
  PID:6468
- C:\Windows\System\akGCrcQ.exe
  C:\Windows\System\akGCrcQ.exe
  2⤵
  PID:6556
- C:\Windows\System\YoRTxwH.exe
  C:\Windows\System\YoRTxwH.exe
  2⤵
  PID:6600
- C:\Windows\System\dwklxyI.exe
  C:\Windows\System\dwklxyI.exe
  2⤵
  PID:6664
- C:\Windows\System\RGVzqam.exe
  C:\Windows\System\RGVzqam.exe
  2⤵
  PID:6720
- C:\Windows\System\PXTMsdE.exe
  C:\Windows\System\PXTMsdE.exe
  2⤵
  PID:6796
- C:\Windows\System\wrtRVpd.exe
  C:\Windows\System\wrtRVpd.exe
  2⤵
  PID:6860
- C:\Windows\System\ouuLJVY.exe
  C:\Windows\System\ouuLJVY.exe
  2⤵
  PID:6916
- C:\Windows\System\EPTyPhC.exe
  C:\Windows\System\EPTyPhC.exe
  2⤵
  PID:6960
- C:\Windows\System\jVBEfia.exe
  C:\Windows\System\jVBEfia.exe
  2⤵
  PID:7040
- C:\Windows\System\bPvRsPk.exe
  C:\Windows\System\bPvRsPk.exe
  2⤵
  PID:7076
- C:\Windows\System\Zmkjpip.exe
  C:\Windows\System\Zmkjpip.exe
  2⤵
  PID:7132
- C:\Windows\System\ExkpIpm.exe
  C:\Windows\System\ExkpIpm.exe
  2⤵
  PID:6188
- C:\Windows\System\suviISb.exe
  C:\Windows\System\suviISb.exe
  2⤵
  PID:6356
- C:\Windows\System\zqhczFQ.exe
  C:\Windows\System\zqhczFQ.exe
  2⤵
  PID:6496
- C:\Windows\System\YaZtXXc.exe
  C:\Windows\System\YaZtXXc.exe
  2⤵
  PID:6628
- C:\Windows\System\LrhhFcR.exe
  C:\Windows\System\LrhhFcR.exe
  2⤵
  PID:6768
- C:\Windows\System\lEXMLHT.exe
  C:\Windows\System\lEXMLHT.exe
  2⤵
  PID:6892
- C:\Windows\System\fnCLRwG.exe
  C:\Windows\System\fnCLRwG.exe
  2⤵
  PID:7088
- C:\Windows\System\JnRvRIh.exe
  C:\Windows\System\JnRvRIh.exe
  2⤵
  PID:6324
- C:\Windows\System\gGsTjQU.exe
  C:\Windows\System\gGsTjQU.exe
  2⤵
  PID:6516
- C:\Windows\System\CrBNhhR.exe
  C:\Windows\System\CrBNhhR.exe
  2⤵
  PID:6888
- C:\Windows\System\ftBabxh.exe
  C:\Windows\System\ftBabxh.exe
  2⤵
  PID:7188
- C:\Windows\System\WhZNpHj.exe
  C:\Windows\System\WhZNpHj.exe
  2⤵
  PID:7220
- C:\Windows\System\MBclOmO.exe
  C:\Windows\System\MBclOmO.exe
  2⤵
  PID:7248
- C:\Windows\System\LSGRSns.exe
  C:\Windows\System\LSGRSns.exe
  2⤵
  PID:7272
- C:\Windows\System\eCDQYck.exe
  C:\Windows\System\eCDQYck.exe
  2⤵
  PID:7308
- C:\Windows\System\KjQsrLD.exe
  C:\Windows\System\KjQsrLD.exe
  2⤵
  PID:7332
- C:\Windows\System\IjZzblF.exe
  C:\Windows\System\IjZzblF.exe
  2⤵
  PID:7356
- C:\Windows\System\UAzRaHB.exe
  C:\Windows\System\UAzRaHB.exe
  2⤵
  PID:7380
- C:\Windows\System\AhvLOIF.exe
  C:\Windows\System\AhvLOIF.exe
  2⤵
  PID:7400
- C:\Windows\System\cTEzzNN.exe
  C:\Windows\System\cTEzzNN.exe
  2⤵
  PID:7428
- C:\Windows\System\rwzGKJF.exe
  C:\Windows\System\rwzGKJF.exe
  2⤵
  PID:7456
- C:\Windows\System\msXYrjw.exe
  C:\Windows\System\msXYrjw.exe
  2⤵
  PID:7480
- C:\Windows\System\kWFFFcl.exe
  C:\Windows\System\kWFFFcl.exe
  2⤵
  PID:7508
- C:\Windows\System\NwzBLKm.exe
  C:\Windows\System\NwzBLKm.exe
  2⤵
  PID:7532
- C:\Windows\System\DLrCfPX.exe
  C:\Windows\System\DLrCfPX.exe
  2⤵
  PID:7564
- C:\Windows\System\gzPVXBF.exe
  C:\Windows\System\gzPVXBF.exe
  2⤵
  PID:7592
- C:\Windows\System\OZkwFBz.exe
  C:\Windows\System\OZkwFBz.exe
  2⤵
  PID:7628
- C:\Windows\System\khSuVBW.exe
  C:\Windows\System\khSuVBW.exe
  2⤵
  PID:7660
- C:\Windows\System\BrZQzwE.exe
  C:\Windows\System\BrZQzwE.exe
  2⤵
  PID:7680
- C:\Windows\System\wQNIwgm.exe
  C:\Windows\System\wQNIwgm.exe
  2⤵
  PID:7712
- C:\Windows\System\CuzpRWp.exe
  C:\Windows\System\CuzpRWp.exe
  2⤵
  PID:7736
- C:\Windows\System\ihNfqIG.exe
  C:\Windows\System\ihNfqIG.exe
  2⤵
  PID:7760
- C:\Windows\System\OKXTuYr.exe
  C:\Windows\System\OKXTuYr.exe
  2⤵
  PID:7784
- C:\Windows\System\VllXCOh.exe
  C:\Windows\System\VllXCOh.exe
  2⤵
  PID:7812
- C:\Windows\System\jLebRXG.exe
  C:\Windows\System\jLebRXG.exe
  2⤵
  PID:7844
- C:\Windows\System\VdnKLuv.exe
  C:\Windows\System\VdnKLuv.exe
  2⤵
  PID:7880
- C:\Windows\System\QlMWlcm.exe
  C:\Windows\System\QlMWlcm.exe
  2⤵
  PID:7912
- C:\Windows\System\FsobHVJ.exe
  C:\Windows\System\FsobHVJ.exe
  2⤵
  PID:7948
- C:\Windows\System\OdXllcM.exe
  C:\Windows\System\OdXllcM.exe
  2⤵
  PID:7968
- C:\Windows\System\qKmoQXL.exe
  C:\Windows\System\qKmoQXL.exe
  2⤵
  PID:8000
- C:\Windows\System\irriztE.exe
  C:\Windows\System\irriztE.exe
  2⤵
  PID:8032
- C:\Windows\System\yaaogKJ.exe
  C:\Windows\System\yaaogKJ.exe
  2⤵
  PID:8056
- C:\Windows\System\pwkPBJL.exe
  C:\Windows\System\pwkPBJL.exe
  2⤵
  PID:8096
- C:\Windows\System\HxVoIwr.exe
  C:\Windows\System\HxVoIwr.exe
  2⤵
  PID:8116
- C:\Windows\System\zCkYAJc.exe
  C:\Windows\System\zCkYAJc.exe
  2⤵
  PID:8140
- C:\Windows\System\kXynrmh.exe
  C:\Windows\System\kXynrmh.exe
  2⤵
  PID:8168
- C:\Windows\System\MDjClcf.exe
  C:\Windows\System\MDjClcf.exe
  2⤵
  PID:6584
- C:\Windows\System\qRcddhF.exe
  C:\Windows\System\qRcddhF.exe
  2⤵
  PID:6988
- C:\Windows\System\LCYhkBh.exe
  C:\Windows\System\LCYhkBh.exe
  2⤵
  PID:7200
- C:\Windows\System\GVgrlkc.exe
  C:\Windows\System\GVgrlkc.exe
  2⤵
  PID:7208
- C:\Windows\System\aSaEXaw.exe
  C:\Windows\System\aSaEXaw.exe
  2⤵
  PID:7328
- C:\Windows\System\tiaOGeb.exe
  C:\Windows\System\tiaOGeb.exe
  2⤵
  PID:7420
- C:\Windows\System\TGdsWoS.exe
  C:\Windows\System\TGdsWoS.exe
  2⤵
  PID:7452
- C:\Windows\System\MjokmEr.exe
  C:\Windows\System\MjokmEr.exe
  2⤵
  PID:7552
- C:\Windows\System\RwKykbR.exe
  C:\Windows\System\RwKykbR.exe
  2⤵
  PID:7616
- C:\Windows\System\JseIcBH.exe
  C:\Windows\System\JseIcBH.exe
  2⤵
  PID:7600
- C:\Windows\System\lGYakUY.exe
  C:\Windows\System\lGYakUY.exe
  2⤵
  PID:7772
- C:\Windows\System\KYDxErb.exe
  C:\Windows\System\KYDxErb.exe
  2⤵
  PID:7856
- C:\Windows\System\doaBKcz.exe
  C:\Windows\System\doaBKcz.exe
  2⤵
  PID:7800
- C:\Windows\System\cDvkjEF.exe
  C:\Windows\System\cDvkjEF.exe
  2⤵
  PID:7904
- C:\Windows\System\nVYWFUw.exe
  C:\Windows\System\nVYWFUw.exe
  2⤵
  PID:8024
- C:\Windows\System\nxWnAGv.exe
  C:\Windows\System\nxWnAGv.exe
  2⤵
  PID:8076
- C:\Windows\System\aJGARfG.exe
  C:\Windows\System\aJGARfG.exe
  2⤵
  PID:8164
- C:\Windows\System\MgWWWCf.exe
  C:\Windows\System\MgWWWCf.exe
  2⤵
  PID:7236
- C:\Windows\System\VXLTCRy.exe
  C:\Windows\System\VXLTCRy.exe
  2⤵
  PID:7176
- C:\Windows\System\bCryZvQ.exe
  C:\Windows\System\bCryZvQ.exe
  2⤵
  PID:7444
- C:\Windows\System\eYGcLkw.exe
  C:\Windows\System\eYGcLkw.exe
  2⤵
  PID:7488
- C:\Windows\System\ZVThHop.exe
  C:\Windows\System\ZVThHop.exe
  2⤵
  PID:7676
- C:\Windows\System\ATCZhjR.exe
  C:\Windows\System\ATCZhjR.exe
  2⤵
  PID:7808
- C:\Windows\System\pRGnNfA.exe
  C:\Windows\System\pRGnNfA.exe
  2⤵
  PID:7900
- C:\Windows\System\qyEsmFB.exe
  C:\Windows\System\qyEsmFB.exe
  2⤵
  PID:7988
- C:\Windows\System\aQjFhnt.exe
  C:\Windows\System\aQjFhnt.exe
  2⤵
  PID:7348
- C:\Windows\System\CNfoGBL.exe
  C:\Windows\System\CNfoGBL.exe
  2⤵
  PID:7528
- C:\Windows\System\xKpunwU.exe
  C:\Windows\System\xKpunwU.exe
  2⤵
  PID:7548
- C:\Windows\System\bfVxlLf.exe
  C:\Windows\System\bfVxlLf.exe
  2⤵
  PID:7408
- C:\Windows\System\wvfkieX.exe
  C:\Windows\System\wvfkieX.exe
  2⤵
  PID:8216
- C:\Windows\System\WDLirKb.exe
  C:\Windows\System\WDLirKb.exe
  2⤵
  PID:8244
- C:\Windows\System\kYQsZEW.exe
  C:\Windows\System\kYQsZEW.exe
  2⤵
  PID:8268
- C:\Windows\System\hrKYGBy.exe
  C:\Windows\System\hrKYGBy.exe
  2⤵
  PID:8296
- C:\Windows\System\WHvPuxm.exe
  C:\Windows\System\WHvPuxm.exe
  2⤵
  PID:8324
- C:\Windows\System\zqqYAZM.exe
  C:\Windows\System\zqqYAZM.exe
  2⤵
  PID:8352
- C:\Windows\System\TSehMwV.exe
  C:\Windows\System\TSehMwV.exe
  2⤵
  PID:8380
- C:\Windows\System\eTWJKxw.exe
  C:\Windows\System\eTWJKxw.exe
  2⤵
  PID:8408
- C:\Windows\System\egkKbFl.exe
  C:\Windows\System\egkKbFl.exe
  2⤵
  PID:8440
- C:\Windows\System\gdAxbfx.exe
  C:\Windows\System\gdAxbfx.exe
  2⤵
  PID:8468
- C:\Windows\System\xWOqZDF.exe
  C:\Windows\System\xWOqZDF.exe
  2⤵
  PID:8500
- C:\Windows\System\aXlGyBf.exe
  C:\Windows\System\aXlGyBf.exe
  2⤵
  PID:8520
- C:\Windows\System\xRnZiLA.exe
  C:\Windows\System\xRnZiLA.exe
  2⤵
  PID:8556
- C:\Windows\System\YUVmigl.exe
  C:\Windows\System\YUVmigl.exe
  2⤵
  PID:8584
- C:\Windows\System\ZgYiTEC.exe
  C:\Windows\System\ZgYiTEC.exe
  2⤵
  PID:8608
- C:\Windows\System\slZLdnS.exe
  C:\Windows\System\slZLdnS.exe
  2⤵
  PID:8648
- C:\Windows\System\eBonPxu.exe
  C:\Windows\System\eBonPxu.exe
  2⤵
  PID:8672
- C:\Windows\System\DKEhdMq.exe
  C:\Windows\System\DKEhdMq.exe
  2⤵
  PID:8700
- C:\Windows\System\kZZoLCm.exe
  C:\Windows\System\kZZoLCm.exe
  2⤵
  PID:8728
- C:\Windows\System\sMvcCWx.exe
  C:\Windows\System\sMvcCWx.exe
  2⤵
  PID:8760
- C:\Windows\System\yJnpXko.exe
  C:\Windows\System\yJnpXko.exe
  2⤵
  PID:8788
- C:\Windows\System\VjkuIVy.exe
  C:\Windows\System\VjkuIVy.exe
  2⤵
  PID:8828
- C:\Windows\System\liwSthb.exe
  C:\Windows\System\liwSthb.exe
  2⤵
  PID:8856
- C:\Windows\System\dGmIScO.exe
  C:\Windows\System\dGmIScO.exe
  2⤵
  PID:8880
- C:\Windows\System\YxwfdtF.exe
  C:\Windows\System\YxwfdtF.exe
  2⤵
  PID:8916
- C:\Windows\System\XAROoPP.exe
  C:\Windows\System\XAROoPP.exe
  2⤵
  PID:8940
- C:\Windows\System\egsRHVf.exe
  C:\Windows\System\egsRHVf.exe
  2⤵
  PID:8964
- C:\Windows\System\KGEcrTv.exe
  C:\Windows\System\KGEcrTv.exe
  2⤵
  PID:9004
- C:\Windows\System\zUyDpAG.exe
  C:\Windows\System\zUyDpAG.exe
  2⤵
  PID:9036
- C:\Windows\System\sQCpAov.exe
  C:\Windows\System\sQCpAov.exe
  2⤵
  PID:9068
- C:\Windows\System\nZXphPK.exe
  C:\Windows\System\nZXphPK.exe
  2⤵
  PID:9096
- C:\Windows\System\wxVwiul.exe
  C:\Windows\System\wxVwiul.exe
  2⤵
  PID:9120
- C:\Windows\System\lKEcMXB.exe
  C:\Windows\System\lKEcMXB.exe
  2⤵
  PID:9148
- C:\Windows\System\NoGjSet.exe
  C:\Windows\System\NoGjSet.exe
  2⤵
  PID:9168
- C:\Windows\System\INSbHoe.exe
  C:\Windows\System\INSbHoe.exe
  2⤵
  PID:9196
- C:\Windows\System\usnuHmw.exe
  C:\Windows\System\usnuHmw.exe
  2⤵
  PID:8176
- C:\Windows\System\NkEnLeZ.exe
  C:\Windows\System\NkEnLeZ.exe
  2⤵
  PID:8232
- C:\Windows\System\RhOjlpN.exe
  C:\Windows\System\RhOjlpN.exe
  2⤵
  PID:8276
- C:\Windows\System\NjuGFXN.exe
  C:\Windows\System\NjuGFXN.exe
  2⤵
  PID:8400
- C:\Windows\System\QFsPfwW.exe
  C:\Windows\System\QFsPfwW.exe
  2⤵
  PID:8388
- C:\Windows\System\DpZwoyr.exe
  C:\Windows\System\DpZwoyr.exe
  2⤵
  PID:8480
- C:\Windows\System\yRCSxOg.exe
  C:\Windows\System\yRCSxOg.exe
  2⤵
  PID:8508
- C:\Windows\System\dzKRfnB.exe
  C:\Windows\System\dzKRfnB.exe
  2⤵
  PID:8572
- C:\Windows\System\MXKefqn.exe
  C:\Windows\System\MXKefqn.exe
  2⤵
  PID:8604
- C:\Windows\System\ZykwpYd.exe
  C:\Windows\System\ZykwpYd.exe
  2⤵
  PID:8660
- C:\Windows\System\XQewtIe.exe
  C:\Windows\System\XQewtIe.exe
  2⤵
  PID:8720
- C:\Windows\System\CAiyYrf.exe
  C:\Windows\System\CAiyYrf.exe
  2⤵
  PID:8772
- C:\Windows\System\VzkAKKj.exe
  C:\Windows\System\VzkAKKj.exe
  2⤵
  PID:8840
- C:\Windows\System\qLZQZcn.exe
  C:\Windows\System\qLZQZcn.exe
  2⤵
  PID:8872
- C:\Windows\System\BluoUJt.exe
  C:\Windows\System\BluoUJt.exe
  2⤵
  PID:8960
- C:\Windows\System\jjRVDuH.exe
  C:\Windows\System\jjRVDuH.exe
  2⤵
  PID:9024
- C:\Windows\System\jKsuSsU.exe
  C:\Windows\System\jKsuSsU.exe
  2⤵
  PID:9084
- C:\Windows\System\ujBMhey.exe
  C:\Windows\System\ujBMhey.exe
  2⤵
  PID:9112
- C:\Windows\System\PQlKELb.exe
  C:\Windows\System\PQlKELb.exe
  2⤵
  PID:7820
- C:\Windows\System\zIZDWca.exe
  C:\Windows\System\zIZDWca.exe
  2⤵
  PID:8204
- C:\Windows\System\hcYLtTX.exe
  C:\Windows\System\hcYLtTX.exe
  2⤵
  PID:8348
- C:\Windows\System\JHPMuJH.exe
  C:\Windows\System\JHPMuJH.exe
  2⤵
  PID:8544
- C:\Windows\System\ZQHUvRU.exe
  C:\Windows\System\ZQHUvRU.exe
  2⤵
  PID:8712
- C:\Windows\System\YESkIzH.exe
  C:\Windows\System\YESkIzH.exe
  2⤵
  PID:8820
- C:\Windows\System\GVYKyjN.exe
  C:\Windows\System\GVYKyjN.exe
  2⤵
  PID:9180
- C:\Windows\System\OjWmHiU.exe
  C:\Windows\System\OjWmHiU.exe
  2⤵
  PID:8404
- C:\Windows\System\VgGoprq.exe
  C:\Windows\System\VgGoprq.exe
  2⤵
  PID:9156
- C:\Windows\System\dFnMQZv.exe
  C:\Windows\System\dFnMQZv.exe
  2⤵
  PID:9220
- C:\Windows\System\PiORxzX.exe
  C:\Windows\System\PiORxzX.exe
  2⤵
  PID:9240
- C:\Windows\System\UIzPCZz.exe
  C:\Windows\System\UIzPCZz.exe
  2⤵
  PID:9268
- C:\Windows\System\gaLWKVm.exe
  C:\Windows\System\gaLWKVm.exe
  2⤵
  PID:9300
- C:\Windows\System\VCnhxzu.exe
  C:\Windows\System\VCnhxzu.exe
  2⤵
  PID:9324
- C:\Windows\System\nHncsgQ.exe
  C:\Windows\System\nHncsgQ.exe
  2⤵
  PID:9360
- C:\Windows\System\eImBkRA.exe
  C:\Windows\System\eImBkRA.exe
  2⤵
  PID:9392
- C:\Windows\System\rEZeJZK.exe
  C:\Windows\System\rEZeJZK.exe
  2⤵
  PID:9428
- C:\Windows\System\vSzqEae.exe
  C:\Windows\System\vSzqEae.exe
  2⤵
  PID:9456
- C:\Windows\System\viiVnBF.exe
  C:\Windows\System\viiVnBF.exe
  2⤵
  PID:9480
- C:\Windows\System\AobSevq.exe
  C:\Windows\System\AobSevq.exe
  2⤵
  PID:9508
- C:\Windows\System\NagnZAX.exe
  C:\Windows\System\NagnZAX.exe
  2⤵
  PID:9532
- C:\Windows\System\lYNeQBf.exe
  C:\Windows\System\lYNeQBf.exe
  2⤵
  PID:9564
- C:\Windows\System\JIwsifK.exe
  C:\Windows\System\JIwsifK.exe
  2⤵
  PID:9592
- C:\Windows\System\MvISgId.exe
  C:\Windows\System\MvISgId.exe
  2⤵
  PID:9616
- C:\Windows\System\Ggmnxyw.exe
  C:\Windows\System\Ggmnxyw.exe
  2⤵
  PID:9640
- C:\Windows\System\UzoXPsU.exe
  C:\Windows\System\UzoXPsU.exe
  2⤵
  PID:9660
- C:\Windows\System\DOTMTkk.exe
  C:\Windows\System\DOTMTkk.exe
  2⤵
  PID:9684
- C:\Windows\System\TtgXQem.exe
  C:\Windows\System\TtgXQem.exe
  2⤵
  PID:9716
- C:\Windows\System\WrkEGru.exe
  C:\Windows\System\WrkEGru.exe
  2⤵
  PID:9740
- C:\Windows\System\QHmiqrV.exe
  C:\Windows\System\QHmiqrV.exe
  2⤵
  PID:9776
- C:\Windows\System\LZCrzcx.exe
  C:\Windows\System\LZCrzcx.exe
  2⤵
  PID:9804
- C:\Windows\System\OKCKMfV.exe
  C:\Windows\System\OKCKMfV.exe
  2⤵
  PID:9840
- C:\Windows\System\ycrEOjN.exe
  C:\Windows\System\ycrEOjN.exe
  2⤵
  PID:9860
- C:\Windows\System\yeqgMph.exe
  C:\Windows\System\yeqgMph.exe
  2⤵
  PID:9876
- C:\Windows\System\kTSEUMw.exe
  C:\Windows\System\kTSEUMw.exe
  2⤵
  PID:9908
- C:\Windows\System\IdUpPFb.exe
  C:\Windows\System\IdUpPFb.exe
  2⤵
  PID:9932
- C:\Windows\System\lojnBpv.exe
  C:\Windows\System\lojnBpv.exe
  2⤵
  PID:9960
- C:\Windows\System\ARsudNz.exe
  C:\Windows\System\ARsudNz.exe
  2⤵
  PID:9984
- C:\Windows\System\nTgwCMz.exe
  C:\Windows\System\nTgwCMz.exe
  2⤵
  PID:10008
- C:\Windows\System\jAzVcxz.exe
  C:\Windows\System\jAzVcxz.exe
  2⤵
  PID:10032
- C:\Windows\System\MMzXpZH.exe
  C:\Windows\System\MMzXpZH.exe
  2⤵
  PID:10068
- C:\Windows\System\fXuHacI.exe
  C:\Windows\System\fXuHacI.exe
  2⤵
  PID:10096
- C:\Windows\System\CGiMUGD.exe
  C:\Windows\System\CGiMUGD.exe
  2⤵
  PID:10124
- C:\Windows\System\LvBHIPU.exe
  C:\Windows\System\LvBHIPU.exe
  2⤵
  PID:10160
- C:\Windows\System\qoEcSXr.exe
  C:\Windows\System\qoEcSXr.exe
  2⤵
  PID:10188
- C:\Windows\System\xkLhglt.exe
  C:\Windows\System\xkLhglt.exe
  2⤵
  PID:10216
- C:\Windows\System\WISasps.exe
  C:\Windows\System\WISasps.exe
  2⤵
  PID:8476
- C:\Windows\System\KPgkYes.exe
  C:\Windows\System\KPgkYes.exe
  2⤵
  PID:8264
- C:\Windows\System\QijcSaz.exe
  C:\Windows\System\QijcSaz.exe
  2⤵
  PID:8976
- C:\Windows\System\CpaBLby.exe
  C:\Windows\System\CpaBLby.exe
  2⤵
  PID:9312
- C:\Windows\System\tJKQpyG.exe
  C:\Windows\System\tJKQpyG.exe
  2⤵
  PID:9292
- C:\Windows\System\zqgtOOQ.exe
  C:\Windows\System\zqgtOOQ.exe
  2⤵
  PID:9420
- C:\Windows\System\hVDqOqb.exe
  C:\Windows\System\hVDqOqb.exe
  2⤵
  PID:9584
- C:\Windows\System\TUtcdxB.exe
  C:\Windows\System\TUtcdxB.exe
  2⤵
  PID:9552
- C:\Windows\System\tmZiJLi.exe
  C:\Windows\System\tmZiJLi.exe
  2⤵
  PID:9680
- C:\Windows\System\UsbTziR.exe
  C:\Windows\System\UsbTziR.exe
  2⤵
  PID:9760
- C:\Windows\System\mamvaRR.exe
  C:\Windows\System\mamvaRR.exe
  2⤵
  PID:9800
- C:\Windows\System\kTrKggP.exe
  C:\Windows\System\kTrKggP.exe
  2⤵
  PID:9900
- C:\Windows\System\lnukjCq.exe
  C:\Windows\System\lnukjCq.exe
  2⤵
  PID:9888
- C:\Windows\System\NivkmCm.exe
  C:\Windows\System\NivkmCm.exe
  2⤵
  PID:9948
- C:\Windows\System\siEttCQ.exe
  C:\Windows\System\siEttCQ.exe
  2⤵
  PID:9980
- C:\Windows\System\yhksMpR.exe
  C:\Windows\System\yhksMpR.exe
  2⤵
  PID:10108
- C:\Windows\System\BHABWWv.exe
  C:\Windows\System\BHABWWv.exe
  2⤵
  PID:10088
- C:\Windows\System\vTkTpMh.exe
  C:\Windows\System\vTkTpMh.exe
  2⤵
  PID:10148
- C:\Windows\System\bExReCs.exe
  C:\Windows\System\bExReCs.exe
  2⤵
  PID:9588
- C:\Windows\System\qiLHWXg.exe
  C:\Windows\System\qiLHWXg.exe
  2⤵
  PID:9712
- C:\Windows\System\vSukoIQ.exe
  C:\Windows\System\vSukoIQ.exe
  2⤵
  PID:9636
- C:\Windows\System\iEGICoR.exe
  C:\Windows\System\iEGICoR.exe
  2⤵
  PID:10136
- C:\Windows\System\VDOMSGW.exe
  C:\Windows\System\VDOMSGW.exe
  2⤵
  PID:9992
- C:\Windows\System\zLSfIit.exe
  C:\Windows\System\zLSfIit.exe
  2⤵
  PID:9404
- C:\Windows\System\srXgmWx.exe
  C:\Windows\System\srXgmWx.exe
  2⤵
  PID:8756
- C:\Windows\System\bfNUzUB.exe
  C:\Windows\System\bfNUzUB.exe
  2⤵
  PID:9796
- C:\Windows\System\KRDJYaa.exe
  C:\Windows\System\KRDJYaa.exe
  2⤵
  PID:10144
- C:\Windows\System\svUKVHU.exe
  C:\Windows\System\svUKVHU.exe
  2⤵
  PID:9856
- C:\Windows\System\vOwQODd.exe
  C:\Windows\System\vOwQODd.exe
  2⤵
  PID:10064
- C:\Windows\System\yYGXGWM.exe
  C:\Windows\System\yYGXGWM.exe
  2⤵
  PID:10248
- C:\Windows\System\lOsUeck.exe
  C:\Windows\System\lOsUeck.exe
  2⤵
  PID:10284
- C:\Windows\System\ZSuzHul.exe
  C:\Windows\System\ZSuzHul.exe
  2⤵
  PID:10300
- C:\Windows\System\FWjUhbs.exe
  C:\Windows\System\FWjUhbs.exe
  2⤵
  PID:10328
- C:\Windows\System\VuzlrpA.exe
  C:\Windows\System\VuzlrpA.exe
  2⤵
  PID:10364
- C:\Windows\System\RCHPCXu.exe
  C:\Windows\System\RCHPCXu.exe
  2⤵
  PID:10388
- C:\Windows\System\QKzOlBE.exe
  C:\Windows\System\QKzOlBE.exe
  2⤵
  PID:10416
- C:\Windows\System\ICXkWUx.exe
  C:\Windows\System\ICXkWUx.exe
  2⤵
  PID:10448
- C:\Windows\System\BrACmuX.exe
  C:\Windows\System\BrACmuX.exe
  2⤵
  PID:10476
- C:\Windows\System\hNCWdoo.exe
  C:\Windows\System\hNCWdoo.exe
  2⤵
  PID:10504
- C:\Windows\System\UAwfNnR.exe
  C:\Windows\System\UAwfNnR.exe
  2⤵
  PID:10544
- C:\Windows\System\mgCGXLh.exe
  C:\Windows\System\mgCGXLh.exe
  2⤵
  PID:10576
- C:\Windows\System\UiKuPAF.exe
  C:\Windows\System\UiKuPAF.exe
  2⤵
  PID:10592
- C:\Windows\System\WjaUUdX.exe
  C:\Windows\System\WjaUUdX.exe
  2⤵
  PID:10616
- C:\Windows\System\VaSQLtq.exe
  C:\Windows\System\VaSQLtq.exe
  2⤵
  PID:10652
- C:\Windows\System\IxeHzsl.exe
  C:\Windows\System\IxeHzsl.exe
  2⤵
  PID:10680
- C:\Windows\System\dLKEVgn.exe
  C:\Windows\System\dLKEVgn.exe
  2⤵
  PID:10704
- C:\Windows\System\wgxGzxF.exe
  C:\Windows\System\wgxGzxF.exe
  2⤵
  PID:10724
- C:\Windows\System\DOzyMTy.exe
  C:\Windows\System\DOzyMTy.exe
  2⤵
  PID:10756
- C:\Windows\System\AtLOPPb.exe
  C:\Windows\System\AtLOPPb.exe
  2⤵
  PID:10784
- C:\Windows\System\FAFwwFV.exe
  C:\Windows\System\FAFwwFV.exe
  2⤵
  PID:10804
- C:\Windows\System\ZcErbed.exe
  C:\Windows\System\ZcErbed.exe
  2⤵
  PID:10828
- C:\Windows\System\tBDTqOs.exe
  C:\Windows\System\tBDTqOs.exe
  2⤵
  PID:10852
- C:\Windows\System\yQSiNvQ.exe
  C:\Windows\System\yQSiNvQ.exe
  2⤵
  PID:10880
- C:\Windows\System\OYOnEuC.exe
  C:\Windows\System\OYOnEuC.exe
  2⤵
  PID:10908
- C:\Windows\System\YNSLjGK.exe
  C:\Windows\System\YNSLjGK.exe
  2⤵
  PID:10940
- C:\Windows\System\wfFUxvG.exe
  C:\Windows\System\wfFUxvG.exe
  2⤵
  PID:10972
- C:\Windows\System\tDnwshA.exe
  C:\Windows\System\tDnwshA.exe
  2⤵
  PID:11000
- C:\Windows\System\osJYMMg.exe
  C:\Windows\System\osJYMMg.exe
  2⤵
  PID:11016
- C:\Windows\System\VfnWSaE.exe
  C:\Windows\System\VfnWSaE.exe
  2⤵
  PID:11048
- C:\Windows\System\QlZBzrv.exe
  C:\Windows\System\QlZBzrv.exe
  2⤵
  PID:11084
- C:\Windows\System\cJUWYJz.exe
  C:\Windows\System\cJUWYJz.exe
  2⤵
  PID:11132
- C:\Windows\System\ACiPsAz.exe
  C:\Windows\System\ACiPsAz.exe
  2⤵
  PID:11152
- C:\Windows\System\DtfeffZ.exe
  C:\Windows\System\DtfeffZ.exe
  2⤵
  PID:11176
- C:\Windows\System\ZQBdfJE.exe
  C:\Windows\System\ZQBdfJE.exe
  2⤵
  PID:11200
- C:\Windows\System\YSfuGhi.exe
  C:\Windows\System\YSfuGhi.exe
  2⤵
  PID:11224
- C:\Windows\System\LIEnRdm.exe
  C:\Windows\System\LIEnRdm.exe
  2⤵
  PID:11240
- C:\Windows\System\JLmCehc.exe
  C:\Windows\System\JLmCehc.exe
  2⤵
  PID:9108
- C:\Windows\System\heajiBU.exe
  C:\Windows\System\heajiBU.exe
  2⤵
  PID:10324
- C:\Windows\System\aiFQtvV.exe
  C:\Windows\System\aiFQtvV.exe
  2⤵
  PID:10348
- C:\Windows\System\cXpXPUG.exe
  C:\Windows\System\cXpXPUG.exe
  2⤵
  PID:10404
- C:\Windows\System\jStttOO.exe
  C:\Windows\System\jStttOO.exe
  2⤵
  PID:10440
- C:\Windows\System\TfNFcHr.exe
  C:\Windows\System\TfNFcHr.exe
  2⤵
  PID:10560
- C:\Windows\System\HzKFLdW.exe
  C:\Windows\System\HzKFLdW.exe
  2⤵
  PID:10644
- C:\Windows\System\nwvEXEE.exe
  C:\Windows\System\nwvEXEE.exe
  2⤵
  PID:10712
- C:\Windows\System\bXhWnvl.exe
  C:\Windows\System\bXhWnvl.exe
  2⤵
  PID:10688
- C:\Windows\System\zlTbMuH.exe
  C:\Windows\System\zlTbMuH.exe
  2⤵
  PID:10768
- C:\Windows\System\AYymdGo.exe
  C:\Windows\System\AYymdGo.exe
  2⤵
  PID:10824
- C:\Windows\System\OkbNGwh.exe
  C:\Windows\System\OkbNGwh.exe
  2⤵
  PID:10984
- C:\Windows\System\RxrHYCX.exe
  C:\Windows\System\RxrHYCX.exe
  2⤵
  PID:11028
- C:\Windows\System\FZkNSvG.exe
  C:\Windows\System\FZkNSvG.exe
  2⤵
  PID:11112
- C:\Windows\System\pGTZaub.exe
  C:\Windows\System\pGTZaub.exe
  2⤵
  PID:11080
- C:\Windows\System\MnLAgGS.exe
  C:\Windows\System\MnLAgGS.exe
  2⤵
  PID:11216
- C:\Windows\System\sowjzlC.exe
  C:\Windows\System\sowjzlC.exe
  2⤵
  PID:10272
- C:\Windows\System\avLkHDP.exe
  C:\Windows\System\avLkHDP.exe
  2⤵
  PID:11232
- C:\Windows\System\IwtjZFc.exe
  C:\Windows\System\IwtjZFc.exe
  2⤵
  PID:10612
- C:\Windows\System\hYrENQQ.exe
  C:\Windows\System\hYrENQQ.exe
  2⤵
  PID:11164
- C:\Windows\System\hCdnTnu.exe
  C:\Windows\System\hCdnTnu.exe
  2⤵
  PID:10524
- C:\Windows\System\KnjZyoJ.exe
  C:\Windows\System\KnjZyoJ.exe
  2⤵
  PID:11252
- C:\Windows\System\rJBmOqW.exe
  C:\Windows\System\rJBmOqW.exe
  2⤵
  PID:10676
- C:\Windows\System\KfVkoxY.exe
  C:\Windows\System\KfVkoxY.exe
  2⤵
  PID:11188
- C:\Windows\System\ImuWTyn.exe
  C:\Windows\System\ImuWTyn.exe
  2⤵
  PID:11144
- C:\Windows\System\bAUARvR.exe
  C:\Windows\System\bAUARvR.exe
  2⤵
  PID:10892
- C:\Windows\System\zPCFNFn.exe
  C:\Windows\System\zPCFNFn.exe
  2⤵
  PID:11288
- C:\Windows\System\RKYXGDN.exe
  C:\Windows\System\RKYXGDN.exe
  2⤵
  PID:11324
- C:\Windows\System\VQxsQVx.exe
  C:\Windows\System\VQxsQVx.exe
  2⤵
  PID:11352
- C:\Windows\System\JzSkfvS.exe
  C:\Windows\System\JzSkfvS.exe
  2⤵
  PID:11380
- C:\Windows\System\KABgacD.exe
  C:\Windows\System\KABgacD.exe
  2⤵
  PID:11412
- C:\Windows\System\kFIDrnO.exe
  C:\Windows\System\kFIDrnO.exe
  2⤵
  PID:11436
- C:\Windows\System\FqPBOHm.exe
  C:\Windows\System\FqPBOHm.exe
  2⤵
  PID:11468
- C:\Windows\System\QkyvVNm.exe
  C:\Windows\System\QkyvVNm.exe
  2⤵
  PID:11500
- C:\Windows\System\hkcEOaX.exe
  C:\Windows\System\hkcEOaX.exe
  2⤵
  PID:11524
- C:\Windows\System\zRpyQyl.exe
  C:\Windows\System\zRpyQyl.exe
  2⤵
  PID:11548
- C:\Windows\System\FFcjacg.exe
  C:\Windows\System\FFcjacg.exe
  2⤵
  PID:11564
- C:\Windows\System\GdcnjQV.exe
  C:\Windows\System\GdcnjQV.exe
  2⤵
  PID:11592
- C:\Windows\System\BLTUCrV.exe
  C:\Windows\System\BLTUCrV.exe
  2⤵
  PID:11616
- C:\Windows\System\SScgbir.exe
  C:\Windows\System\SScgbir.exe
  2⤵
  PID:11644
- C:\Windows\System\IagZuaD.exe
  C:\Windows\System\IagZuaD.exe
  2⤵
  PID:11668
- C:\Windows\System\HsXdWsq.exe
  C:\Windows\System\HsXdWsq.exe
  2⤵
  PID:11700
- C:\Windows\System\icVUgQQ.exe
  C:\Windows\System\icVUgQQ.exe
  2⤵
  PID:11724
- C:\Windows\System\MZIgCjc.exe
  C:\Windows\System\MZIgCjc.exe
  2⤵
  PID:11752
- C:\Windows\System\BTPJjrq.exe
  C:\Windows\System\BTPJjrq.exe
  2⤵
  PID:11768
- C:\Windows\System\lWNtTfG.exe
  C:\Windows\System\lWNtTfG.exe
  2⤵
  PID:11788
- C:\Windows\System\zoXVTvw.exe
  C:\Windows\System\zoXVTvw.exe
  2⤵
  PID:11824
- C:\Windows\System\ggRAJrb.exe
  C:\Windows\System\ggRAJrb.exe
  2⤵
  PID:11856
- C:\Windows\System\ZvpKMjh.exe
  C:\Windows\System\ZvpKMjh.exe
  2⤵
  PID:11884
- C:\Windows\System\ysGeAgD.exe
  C:\Windows\System\ysGeAgD.exe
  2⤵
  PID:11916
- C:\Windows\System\XfTayJv.exe
  C:\Windows\System\XfTayJv.exe
  2⤵
  PID:11940
- C:\Windows\System\GunVgxp.exe
  C:\Windows\System\GunVgxp.exe
  2⤵
  PID:11968
- C:\Windows\System\BnddPmg.exe
  C:\Windows\System\BnddPmg.exe
  2⤵
  PID:12004
- C:\Windows\System\ZOuhFRI.exe
  C:\Windows\System\ZOuhFRI.exe
  2⤵
  PID:12032
- C:\Windows\System\KpgwRIh.exe
  C:\Windows\System\KpgwRIh.exe
  2⤵
  PID:12060
- C:\Windows\System\TJfRmLH.exe
  C:\Windows\System\TJfRmLH.exe
  2⤵
  PID:12084
- C:\Windows\System\lBSlyZp.exe
  C:\Windows\System\lBSlyZp.exe
  2⤵
  PID:12116
- C:\Windows\System\WBRDjXS.exe
  C:\Windows\System\WBRDjXS.exe
  2⤵
  PID:12140
- C:\Windows\System\NsvGWPG.exe
  C:\Windows\System\NsvGWPG.exe
  2⤵
  PID:12160
- C:\Windows\System\yhpfQHK.exe
  C:\Windows\System\yhpfQHK.exe
  2⤵
  PID:12192
- C:\Windows\System\AfaHqeF.exe
  C:\Windows\System\AfaHqeF.exe
  2⤵
  PID:12216
- C:\Windows\System\ZiLTPoU.exe
  C:\Windows\System\ZiLTPoU.exe
  2⤵
  PID:12248
- C:\Windows\System\XcafCuA.exe
  C:\Windows\System\XcafCuA.exe
  2⤵
  PID:12280
- C:\Windows\System\oqpoFvS.exe
  C:\Windows\System\oqpoFvS.exe
  2⤵
  PID:11284
- C:\Windows\System\IjQQypH.exe
  C:\Windows\System\IjQQypH.exe
  2⤵
  PID:11340
- C:\Windows\System\tTfifwy.exe
  C:\Windows\System\tTfifwy.exe
  2⤵
  PID:11376
- C:\Windows\System\yEQFOHf.exe
  C:\Windows\System\yEQFOHf.exe
  2⤵
  PID:11420
- C:\Windows\System\vaglHOV.exe
  C:\Windows\System\vaglHOV.exe
  2⤵
  PID:11452
- C:\Windows\System\oBLFdBj.exe
  C:\Windows\System\oBLFdBj.exe
  2⤵
  PID:11556
- C:\Windows\System\AGSUmXR.exe
  C:\Windows\System\AGSUmXR.exe
  2⤵
  PID:11580
- C:\Windows\System\SQGpAED.exe
  C:\Windows\System\SQGpAED.exe
  2⤵
  PID:11664
- C:\Windows\System\GQEbMMy.exe
  C:\Windows\System\GQEbMMy.exe
  2⤵
  PID:11636
- C:\Windows\System\mTGtHKh.exe
  C:\Windows\System\mTGtHKh.exe
  2⤵
  PID:11744
- C:\Windows\System\gGpJfpJ.exe
  C:\Windows\System\gGpJfpJ.exe
  2⤵
  PID:11784
- C:\Windows\System\AVxGxVI.exe
  C:\Windows\System\AVxGxVI.exe
  2⤵
  PID:11872
- C:\Windows\System\YCRefsd.exe
  C:\Windows\System\YCRefsd.exe
  2⤵
  PID:11896
- C:\Windows\System\fgPTIFD.exe
  C:\Windows\System\fgPTIFD.exe
  2⤵
  PID:11992
- C:\Windows\System\YisFmAZ.exe
  C:\Windows\System\YisFmAZ.exe
  2⤵
  PID:12132
- C:\Windows\System\PhQEeOb.exe
  C:\Windows\System\PhQEeOb.exe
  2⤵
  PID:12128
- C:\Windows\System\NmYAMvC.exe
  C:\Windows\System\NmYAMvC.exe
  2⤵
  PID:12172
- C:\Windows\System\nzOqYid.exe
  C:\Windows\System\nzOqYid.exe
  2⤵
  PID:12264
- C:\Windows\System\PDhdzQv.exe
  C:\Windows\System\PDhdzQv.exe
  2⤵
  PID:11312
- C:\Windows\System\yHtYoMa.exe
  C:\Windows\System\yHtYoMa.exe
  2⤵
  PID:11708
- C:\Windows\System\JcEIfBo.exe
  C:\Windows\System\JcEIfBo.exe
  2⤵
  PID:11932
- C:\Windows\System\pfAwGew.exe
  C:\Windows\System\pfAwGew.exe
  2⤵
  PID:11812
- C:\Windows\System\AVNwSZk.exe
  C:\Windows\System\AVNwSZk.exe
  2⤵
  PID:11040
- C:\Windows\System\IlaQBzE.exe
  C:\Windows\System\IlaQBzE.exe
  2⤵
  PID:12244
- C:\Windows\System\qBSzXdK.exe
  C:\Windows\System\qBSzXdK.exe
  2⤵
  PID:11712
- C:\Windows\System\YuQMNnN.exe
  C:\Windows\System\YuQMNnN.exe
  2⤵
  PID:11536
- C:\Windows\System\NUeSlTC.exe
  C:\Windows\System\NUeSlTC.exe
  2⤵
  PID:12316
- C:\Windows\System\mxlIWvz.exe
  C:\Windows\System\mxlIWvz.exe
  2⤵
  PID:12344
- C:\Windows\System\WBEKFyv.exe
  C:\Windows\System\WBEKFyv.exe
  2⤵
  PID:12380
- C:\Windows\System\KebqQqE.exe
  C:\Windows\System\KebqQqE.exe
  2⤵
  PID:12408
- C:\Windows\System\YpPjwcq.exe
  C:\Windows\System\YpPjwcq.exe
  2⤵
  PID:12436
- C:\Windows\System\ACKxbVs.exe
  C:\Windows\System\ACKxbVs.exe
  2⤵
  PID:12460
- C:\Windows\System\zatPOtg.exe
  C:\Windows\System\zatPOtg.exe
  2⤵
  PID:12492
- C:\Windows\System\eBPTmHH.exe
  C:\Windows\System\eBPTmHH.exe
  2⤵
  PID:12524
- C:\Windows\System\liDopGx.exe
  C:\Windows\System\liDopGx.exe
  2⤵
  PID:12560
- C:\Windows\System\VyVbAUk.exe
  C:\Windows\System\VyVbAUk.exe
  2⤵
  PID:12592
- C:\Windows\System\jyDmToI.exe
  C:\Windows\System\jyDmToI.exe
  2⤵
  PID:12624
- C:\Windows\System\NGzjZOO.exe
  C:\Windows\System\NGzjZOO.exe
  2⤵
  PID:12656
- C:\Windows\System\ALRqEgb.exe
  C:\Windows\System\ALRqEgb.exe
  2⤵
  PID:12688
- C:\Windows\System\qtqCJFu.exe
  C:\Windows\System\qtqCJFu.exe
  2⤵
  PID:12708
- C:\Windows\System\JjzwSIk.exe
  C:\Windows\System\JjzwSIk.exe
  2⤵
  PID:12736
- C:\Windows\System\TnoqUHI.exe
  C:\Windows\System\TnoqUHI.exe
  2⤵
  PID:12764
- C:\Windows\System\TlDahnJ.exe
  C:\Windows\System\TlDahnJ.exe
  2⤵
  PID:12792
- C:\Windows\System\DsBIjDN.exe
  C:\Windows\System\DsBIjDN.exe
  2⤵
  PID:12824
- C:\Windows\System\lWjlezT.exe
  C:\Windows\System\lWjlezT.exe
  2⤵
  PID:12856
- C:\Windows\System\yfJCMfi.exe
  C:\Windows\System\yfJCMfi.exe
  2⤵
  PID:12880
- C:\Windows\System\ADMGLph.exe
  C:\Windows\System\ADMGLph.exe
  2⤵
  PID:12912
- C:\Windows\System\YWSdOob.exe
  C:\Windows\System\YWSdOob.exe
  2⤵
  PID:12932
- C:\Windows\System\PAKfYzw.exe
  C:\Windows\System\PAKfYzw.exe
  2⤵
  PID:12964
- C:\Windows\System\iSzFtAu.exe
  C:\Windows\System\iSzFtAu.exe
  2⤵
  PID:12980
- C:\Windows\System\IJkpKAH.exe
  C:\Windows\System\IJkpKAH.exe
  2⤵
  PID:13000
- C:\Windows\System\knpkGOB.exe
  C:\Windows\System\knpkGOB.exe
  2⤵
  PID:13028
- C:\Windows\System\TDmXdEV.exe
  C:\Windows\System\TDmXdEV.exe
  2⤵
  PID:13052
- C:\Windows\System\fqNlohQ.exe
  C:\Windows\System\fqNlohQ.exe
  2⤵
  PID:13072
- C:\Windows\System\FWUfoOU.exe
  C:\Windows\System\FWUfoOU.exe
  2⤵
  PID:13104
- C:\Windows\System\ULksiAL.exe
  C:\Windows\System\ULksiAL.exe
  2⤵
  PID:13136
- C:\Windows\System\XAOluko.exe
  C:\Windows\System\XAOluko.exe
  2⤵
  PID:13164
- C:\Windows\System\lnsdCtX.exe
  C:\Windows\System\lnsdCtX.exe
  2⤵
  PID:13196
- C:\Windows\System\jRFxDQK.exe
  C:\Windows\System\jRFxDQK.exe
  2⤵
  PID:13224
- C:\Windows\System\aNKEFRH.exe
  C:\Windows\System\aNKEFRH.exe
  2⤵
  PID:13252
- C:\Windows\System\BqWeLSn.exe
  C:\Windows\System\BqWeLSn.exe
  2⤵
  PID:13284
- C:\Windows\System\sWriOtT.exe
  C:\Windows\System\sWriOtT.exe
  2⤵
  PID:11980
- C:\Windows\System\UAFPBvw.exe
  C:\Windows\System\UAFPBvw.exe
  2⤵
  PID:11900
- C:\Windows\System\oFBXrRC.exe
  C:\Windows\System\oFBXrRC.exe
  2⤵
  PID:12300
- C:\Windows\System\hNHzuMI.exe
  C:\Windows\System\hNHzuMI.exe
  2⤵
  PID:12404
- C:\Windows\System\weYeZta.exe
  C:\Windows\System\weYeZta.exe
  2⤵
  PID:12508
- C:\Windows\System\XCcthTW.exe
  C:\Windows\System\XCcthTW.exe
  2⤵
  PID:12612
- C:\Windows\System\KTkdhaj.exe
  C:\Windows\System\KTkdhaj.exe
  2⤵
  PID:12636
- C:\Windows\System\PVqbHiE.exe
  C:\Windows\System\PVqbHiE.exe
  2⤵
  PID:12664
- C:\Windows\System\WQaETzf.exe
  C:\Windows\System\WQaETzf.exe
  2⤵
  PID:12780
- C:\Windows\System\kOPNBXQ.exe
  C:\Windows\System\kOPNBXQ.exe
  2⤵
  PID:12808
- C:\Windows\System\EfIayAc.exe
  C:\Windows\System\EfIayAc.exe
  2⤵
  PID:12928
- C:\Windows\System\EOhsXPu.exe
  C:\Windows\System\EOhsXPu.exe
  2⤵
  PID:13048
- C:\Windows\System\GGmBjyy.exe
  C:\Windows\System\GGmBjyy.exe
  2⤵
  PID:13144
- C:\Windows\System\PbeueRP.exe
  C:\Windows\System\PbeueRP.exe
  2⤵
  PID:13024
- C:\Windows\System\GtqBjPP.exe
  C:\Windows\System\GtqBjPP.exe
  2⤵
  PID:13188
- C:\Windows\System\syifXAd.exe
  C:\Windows\System\syifXAd.exe
  2⤵
  PID:13240
- C:\Windows\System\IgvaWDS.exe
  C:\Windows\System\IgvaWDS.exe
  2⤵
  PID:13304
- C:\Windows\System\CDJPvwf.exe
  C:\Windows\System\CDJPvwf.exe
  2⤵
  PID:13272
- C:\Windows\System\qTknZAk.exe
  C:\Windows\System\qTknZAk.exe
  2⤵
  PID:11316
- C:\Windows\System\qRpSxTM.exe
  C:\Windows\System\qRpSxTM.exe
  2⤵
  PID:12048
- C:\Windows\System\jQiFIMI.exe
  C:\Windows\System\jQiFIMI.exe
  2⤵
  PID:12676
- C:\Windows\System\eOGGyeP.exe
  C:\Windows\System\eOGGyeP.exe
  2⤵
  PID:12952
- C:\Windows\System\rExXMHr.exe
  C:\Windows\System\rExXMHr.exe
  2⤵
  PID:12800
- C:\Windows\System\PKuYVTE.exe
  C:\Windows\System\PKuYVTE.exe
  2⤵
  PID:13016
- C:\Windows\System\cponyFK.exe
  C:\Windows\System\cponyFK.exe
  2⤵
  PID:13124
- C:\Windows\System\yMXerud.exe
  C:\Windows\System\yMXerud.exe
  2⤵
  PID:12704
- C:\Windows\System\PEhaAWq.exe
  C:\Windows\System\PEhaAWq.exe
  2⤵
  PID:13280
- C:\Windows\System\VcDMbMT.exe
  C:\Windows\System\VcDMbMT.exe
  2⤵
  PID:13040
- C:\Windows\System\NtRhmmf.exe
  C:\Windows\System\NtRhmmf.exe
  2⤵
  PID:13328
- C:\Windows\System\oTTVtgg.exe
  C:\Windows\System\oTTVtgg.exe
  2⤵
  PID:13356
- C:\Windows\System\VEcNEsx.exe
  C:\Windows\System\VEcNEsx.exe
  2⤵
  PID:13388
- C:\Windows\System\kOLeUSl.exe
  C:\Windows\System\kOLeUSl.exe
  2⤵
  PID:13420
- C:\Windows\System\uSNSVKC.exe
  C:\Windows\System\uSNSVKC.exe
  2⤵
  PID:13436
- C:\Windows\System\HAshzkN.exe
  C:\Windows\System\HAshzkN.exe
  2⤵
  PID:13464
- C:\Windows\System\vauxroZ.exe
  C:\Windows\System\vauxroZ.exe
  2⤵
  PID:13492
- C:\Windows\System\GbnxGWI.exe
  C:\Windows\System\GbnxGWI.exe
  2⤵
  PID:13520
- C:\Windows\System\FYhhxAM.exe
  C:\Windows\System\FYhhxAM.exe
  2⤵
  PID:13548
- C:\Windows\System\bHThssU.exe
  C:\Windows\System\bHThssU.exe
  2⤵
  PID:13580
- C:\Windows\System\tuwfYII.exe
  C:\Windows\System\tuwfYII.exe
  2⤵
  PID:13604
- C:\Windows\System\MHNmBSY.exe
  C:\Windows\System\MHNmBSY.exe
  2⤵
  PID:13636
- C:\Windows\System\EEScWbH.exe
  C:\Windows\System\EEScWbH.exe
  2⤵
  PID:13664
- C:\Windows\System\mOTipjU.exe
  C:\Windows\System\mOTipjU.exe
  2⤵
  PID:13692
- C:\Windows\System\caoMEPP.exe
  C:\Windows\System\caoMEPP.exe
  2⤵
  PID:13720
- C:\Windows\System\HFqCJpU.exe
  C:\Windows\System\HFqCJpU.exe
  2⤵
  PID:13748
- C:\Windows\System\cAYsial.exe
  C:\Windows\System\cAYsial.exe
  2⤵
  PID:13768
- C:\Windows\System\ltGTAUO.exe
  C:\Windows\System\ltGTAUO.exe
  2⤵
  PID:13800
- C:\Windows\System\XWiekcO.exe
  C:\Windows\System\XWiekcO.exe
  2⤵
  PID:13824
- C:\Windows\System\sqCudQt.exe
  C:\Windows\System\sqCudQt.exe
  2⤵
  PID:13848
- C:\Windows\System\LAnGqPt.exe
  C:\Windows\System\LAnGqPt.exe
  2⤵
  PID:13876
- C:\Windows\System\aSXwWbm.exe
  C:\Windows\System\aSXwWbm.exe
  2⤵
  PID:13900
- C:\Windows\System\GnrwKiK.exe
  C:\Windows\System\GnrwKiK.exe
  2⤵
  PID:13928
- C:\Windows\System\RuzMEvA.exe
  C:\Windows\System\RuzMEvA.exe
  2⤵
  PID:13964
- C:\Windows\System\GjlUFfD.exe
  C:\Windows\System\GjlUFfD.exe
  2⤵
  PID:13992
- C:\Windows\System\sawwPlc.exe
  C:\Windows\System\sawwPlc.exe
  2⤵
  PID:14020
- C:\Windows\System\VEAkrTt.exe
  C:\Windows\System\VEAkrTt.exe
  2⤵
  PID:14048
- C:\Windows\System\GnQZtJp.exe
  C:\Windows\System\GnQZtJp.exe
  2⤵
  PID:14080
- C:\Windows\System\obBLjDe.exe
  C:\Windows\System\obBLjDe.exe
  2⤵
  PID:14108
- C:\Windows\System\BHfIYeH.exe
  C:\Windows\System\BHfIYeH.exe
  2⤵
  PID:14132
- C:\Windows\System\jYmwTNt.exe
  C:\Windows\System\jYmwTNt.exe
  2⤵
  PID:14156
- C:\Windows\System\BvCTXtg.exe
  C:\Windows\System\BvCTXtg.exe
  2⤵
  PID:14176
- C:\Windows\System\YPgAWmF.exe
  C:\Windows\System\YPgAWmF.exe
  2⤵
  PID:14204
- C:\Windows\System\lIPEPaK.exe
  C:\Windows\System\lIPEPaK.exe
  2⤵
  PID:14228
- C:\Windows\System\mrJgGZX.exe
  C:\Windows\System\mrJgGZX.exe
  2⤵
  PID:14248
- C:\Windows\System\LXSWRfv.exe
  C:\Windows\System\LXSWRfv.exe
  2⤵
  PID:14276
- C:\Windows\System\niLwUeI.exe
  C:\Windows\System\niLwUeI.exe
  2⤵
  PID:14300
- C:\Windows\System\ncltlYd.exe
  C:\Windows\System\ncltlYd.exe
  2⤵
  PID:13100
- C:\Windows\System\apubLMG.exe
  C:\Windows\System\apubLMG.exe
  2⤵
  PID:12484
- C:\Windows\System\VdBglxC.exe
  C:\Windows\System\VdBglxC.exe
  2⤵
  PID:13432
- C:\Windows\System\eMnwVfS.exe
  C:\Windows\System\eMnwVfS.exe
  2⤵
  PID:13404
- C:\Windows\System\ukDgast.exe
  C:\Windows\System\ukDgast.exe
  2⤵
  PID:13576
- C:\Windows\System\CDoKlwm.exe
  C:\Windows\System\CDoKlwm.exe
  2⤵
  PID:13512
- C:\Windows\System\qbvFjDE.exe
  C:\Windows\System\qbvFjDE.exe
  2⤵
  PID:13592
- C:\Windows\System\TtKAyAd.exe
  C:\Windows\System\TtKAyAd.exe
  2⤵
  PID:13680
- C:\Windows\System\rUFcxlL.exe
  C:\Windows\System\rUFcxlL.exe
  2⤵
  PID:13740
- C:\Windows\System\ayBKOWZ.exe
  C:\Windows\System\ayBKOWZ.exe
  2⤵
  PID:13788
- C:\Windows\System\GxXDoSp.exe
  C:\Windows\System\GxXDoSp.exe
  2⤵
  PID:13940
- C:\Windows\System\XVBsCQQ.exe
  C:\Windows\System\XVBsCQQ.exe
  2⤵
  PID:13776
- C:\Windows\System\beyrsWJ.exe
  C:\Windows\System\beyrsWJ.exe
  2⤵
  PID:13808
- C:\Windows\System\BZKmWFl.exe
  C:\Windows\System\BZKmWFl.exe
  2⤵
  PID:13840
- C:\Windows\System\yCyYiua.exe
  C:\Windows\System\yCyYiua.exe
  2⤵
  PID:14124
- C:\Windows\System\xisTpQs.exe
  C:\Windows\System\xisTpQs.exe
  2⤵
  PID:14308
- C:\Windows\System\EyCKuDg.exe
  C:\Windows\System\EyCKuDg.exe
  2⤵
  PID:13276
- C:\Windows\System\fgbLQix.exe
  C:\Windows\System\fgbLQix.exe
  2⤵
  PID:14236
- C:\Windows\System\mFydcCR.exe
  C:\Windows\System\mFydcCR.exe
  2⤵
  PID:14328
- C:\Windows\System\qJVQEgs.exe
  C:\Windows\System\qJVQEgs.exe
  2⤵
  PID:13128
- C:\Windows\System\PgqrVVs.exe
  C:\Windows\System\PgqrVVs.exe
  2⤵
  PID:13532
- C:\Windows\System\vNCYyVb.exe
  C:\Windows\System\vNCYyVb.exe
  2⤵
  PID:13560
- C:\Windows\System\zUUQbGl.exe
  C:\Windows\System\zUUQbGl.exe
  2⤵
  PID:13732
- C:\Windows\System\LUNIgPS.exe
  C:\Windows\System\LUNIgPS.exe
  2⤵
  PID:13816
- C:\Windows\System\scCqmlq.exe
  C:\Windows\System\scCqmlq.exe
  2⤵
  PID:14168
- C:\Windows\System\LfLMfFh.exe
  C:\Windows\System\LfLMfFh.exe
  2⤵
  PID:14324
- C:\Windows\System\wBpulej.exe
  C:\Windows\System\wBpulej.exe
  2⤵
  PID:14352
- C:\Windows\System\ATQOgBJ.exe
  C:\Windows\System\ATQOgBJ.exe
  2⤵
  PID:14368
- C:\Windows\System\VWuPwvD.exe
  C:\Windows\System\VWuPwvD.exe
  2⤵
  PID:14396
- C:\Windows\System\jJNssUX.exe
  C:\Windows\System\jJNssUX.exe
  2⤵
  PID:14424
- C:\Windows\System\sOsiLXZ.exe
  C:\Windows\System\sOsiLXZ.exe
  2⤵
  PID:14452
- C:\Windows\System\pjsEUVn.exe
  C:\Windows\System\pjsEUVn.exe
  2⤵
  PID:14480
- C:\Windows\System\SUJMDHq.exe
  C:\Windows\System\SUJMDHq.exe
  2⤵
  PID:14508
- C:\Windows\System\dWcunwW.exe
  C:\Windows\System\dWcunwW.exe
  2⤵
  PID:14536
- C:\Windows\System\LuCFrKW.exe
  C:\Windows\System\LuCFrKW.exe
  2⤵
  PID:14560
- C:\Windows\System\yiZLQPG.exe
  C:\Windows\System\yiZLQPG.exe
  2⤵
  PID:14600
- C:\Windows\System\rDBSnYt.exe
  C:\Windows\System\rDBSnYt.exe
  2⤵
  PID:14628
- C:\Windows\System\lbHyZcq.exe
  C:\Windows\System\lbHyZcq.exe
  2⤵
  PID:14656
- C:\Windows\System\TaZOuuE.exe
  C:\Windows\System\TaZOuuE.exe
  2⤵
  PID:14680
- C:\Windows\System\KHSUAEn.exe
  C:\Windows\System\KHSUAEn.exe
  2⤵
  PID:14712
- C:\Windows\System\MWNctBc.exe
  C:\Windows\System\MWNctBc.exe
  2⤵
  PID:14748
- C:\Windows\System\DvgCbHZ.exe
  C:\Windows\System\DvgCbHZ.exe
  2⤵
  PID:14776
- C:\Windows\System\QRevzVO.exe
  C:\Windows\System\QRevzVO.exe
  2⤵
  PID:14792
- C:\Windows\System\XkulHCz.exe
  C:\Windows\System\XkulHCz.exe
  2⤵
  PID:14820
- C:\Windows\System\QgHxuaH.exe
  C:\Windows\System\QgHxuaH.exe
  2⤵
  PID:14844
- C:\Windows\System\slDhyhc.exe
  C:\Windows\System\slDhyhc.exe
  2⤵
  PID:14872
- C:\Windows\System\VdLvtOp.exe
  C:\Windows\System\VdLvtOp.exe
  2⤵
  PID:14896
- C:\Windows\System\kmSMbqu.exe
  C:\Windows\System\kmSMbqu.exe
  2⤵
  PID:14928
- C:\Windows\System\oxfVhAS.exe
  C:\Windows\System\oxfVhAS.exe
  2⤵
  PID:14956
- C:\Windows\System\tcPkwhC.exe
  C:\Windows\System\tcPkwhC.exe
  2⤵
  PID:14992
- C:\Windows\System\bNxnOSq.exe
  C:\Windows\System\bNxnOSq.exe
  2⤵
  PID:15028
- C:\Windows\System\DbBPxnO.exe
  C:\Windows\System\DbBPxnO.exe
  2⤵
  PID:15060
- C:\Windows\System\yuUXkqx.exe
  C:\Windows\System\yuUXkqx.exe
  2⤵
  PID:15092
- C:\Windows\System\KiPOOiE.exe
  C:\Windows\System\KiPOOiE.exe
  2⤵
  PID:15120
- C:\Windows\System\iuBDMWT.exe
  C:\Windows\System\iuBDMWT.exe
  2⤵
  PID:15148
- C:\Windows\System\sQzDQgY.exe
  C:\Windows\System\sQzDQgY.exe
  2⤵
  PID:15172
- C:\Windows\System\oGSfWhN.exe
  C:\Windows\System\oGSfWhN.exe
  2⤵
  PID:15204
- C:\Windows\System\ksHZcHs.exe
  C:\Windows\System\ksHZcHs.exe
  2⤵
  PID:15244
- C:\Windows\System\UgqbSFr.exe
  C:\Windows\System\UgqbSFr.exe
  2⤵
  PID:15272
- C:\Windows\System\wDWvZQY.exe
  C:\Windows\System\wDWvZQY.exe
  2⤵
  PID:15296
- C:\Windows\System\oaUuadn.exe
  C:\Windows\System\oaUuadn.exe
  2⤵
  PID:15328
- C:\Windows\System\CqiaFRR.exe
  C:\Windows\System\CqiaFRR.exe
  2⤵
  PID:15344
- C:\Windows\System\tvRiAMB.exe
  C:\Windows\System\tvRiAMB.exe
  2⤵
  PID:14172
- C:\Windows\System\LkFXQPI.exe
  C:\Windows\System\LkFXQPI.exe
  2⤵
  PID:13836
- C:\Windows\System\dZBNKxe.exe
  C:\Windows\System\dZBNKxe.exe
  2⤵
  PID:13180
- C:\Windows\System\OlhkyVy.exe
  C:\Windows\System\OlhkyVy.exe
  2⤵
  PID:14440
- C:\Windows\System\puooJIR.exe
  C:\Windows\System\puooJIR.exe
  2⤵
  PID:14528
- C:\Windows\System\ZxxSTiO.exe
  C:\Windows\System\ZxxSTiO.exe
  2⤵
  PID:14576
- C:\Windows\System\nuVffOm.exe
  C:\Windows\System\nuVffOm.exe
  2⤵
  PID:14616
- C:\Windows\System\BJamTNc.exe
  C:\Windows\System\BJamTNc.exe
  2⤵
  PID:14476
- C:\Windows\System\VUCkjRg.exe
  C:\Windows\System\VUCkjRg.exe
  2⤵
  PID:14696
- C:\Windows\System\DDKDTgG.exe
  C:\Windows\System\DDKDTgG.exe
  2⤵
  PID:14648
- C:\Windows\System\vbnCQfk.exe
  C:\Windows\System\vbnCQfk.exe
  2⤵
  PID:14756
- C:\Windows\System\zsNCHcz.exe
  C:\Windows\System\zsNCHcz.exe
  2⤵
  PID:14784
- C:\Windows\System\PxtZSMj.exe
  C:\Windows\System\PxtZSMj.exe
  2⤵
  PID:14852
- C:\Windows\System\LqCDZmK.exe
  C:\Windows\System\LqCDZmK.exe
  2⤵
  PID:15008
- C:\Windows\System\dRMVyIx.exe
  C:\Windows\System\dRMVyIx.exe
  2⤵
  PID:14940
- C:\Windows\System\vakpblJ.exe
  C:\Windows\System\vakpblJ.exe
  2⤵
  PID:15212
- C:\Windows\System\dwRFBVk.exe
  C:\Windows\System\dwRFBVk.exe
  2⤵
  PID:15268
- C:\Windows\System\ZwGRuoN.exe
  C:\Windows\System\ZwGRuoN.exe
  2⤵
  PID:15004
- C:\Windows\System\VTBMnCT.exe
  C:\Windows\System\VTBMnCT.exe
  2⤵
  PID:12872
- C:\Windows\System\NEMmDab.exe
  C:\Windows\System\NEMmDab.exe
  2⤵
  PID:15340
- C:\Windows\System\hqQbVVo.exe
  C:\Windows\System\hqQbVVo.exe
  2⤵
  PID:14140
- C:\Windows\System\NxmYMMU.exe
  C:\Windows\System\NxmYMMU.exe
  2⤵
  PID:14420
- C:\Windows\System\RCBsIpW.exe
  C:\Windows\System\RCBsIpW.exe
  2⤵
  PID:14360
- C:\Windows\System\kYPvZuN.exe
  C:\Windows\System\kYPvZuN.exe
  2⤵
  PID:14344
- C:\Windows\System\ItcZAmy.exe
  C:\Windows\System\ItcZAmy.exe
  2⤵
  PID:14884
- C:\Windows\System\BcOEQck.exe
  C:\Windows\System\BcOEQck.exe
  2⤵
  PID:15224
- C:\Windows\System\lBqAnAc.exe
  C:\Windows\System\lBqAnAc.exe
  2⤵
  PID:15040
- C:\Windows\System\BVvSFKU.exe
  C:\Windows\System\BVvSFKU.exe
  2⤵
  PID:14408
- C:\Windows\System\SyQjtYB.exe
  C:\Windows\System\SyQjtYB.exe
  2⤵
  PID:14952
- C:\Windows\System\dUGkJOJ.exe
  C:\Windows\System\dUGkJOJ.exe
  2⤵
  PID:15164
- C:\Windows\System\XnoODvW.exe
  C:\Windows\System\XnoODvW.exe
  2⤵
  PID:15380
- C:\Windows\System\tKBGZff.exe
  C:\Windows\System\tKBGZff.exe
  2⤵
  PID:15408
- C:\Windows\System\yysqxZZ.exe
  C:\Windows\System\yysqxZZ.exe
  2⤵
  PID:15428
- C:\Windows\System\IVksoTq.exe
  C:\Windows\System\IVksoTq.exe
  2⤵
  PID:15452
- C:\Windows\System\VqIpVtC.exe
  C:\Windows\System\VqIpVtC.exe
  2⤵
  PID:15472
- C:\Windows\System\whhCCJo.exe
  C:\Windows\System\whhCCJo.exe
  2⤵
  PID:15504
- C:\Windows\System\xtxsCdb.exe
  C:\Windows\System\xtxsCdb.exe
  2⤵
  PID:15524
- C:\Windows\System\QygBLyF.exe
  C:\Windows\System\QygBLyF.exe
  2⤵
  PID:15560
- C:\Windows\System\ReqYawJ.exe
  C:\Windows\System\ReqYawJ.exe
  2⤵
  PID:15584
- C:\Windows\System\oVaDITv.exe
  C:\Windows\System\oVaDITv.exe
  2⤵
  PID:15612
- C:\Windows\System\stweEOg.exe
  C:\Windows\System\stweEOg.exe
  2⤵
  PID:15644
- C:\Windows\System\Bkiykwp.exe
  C:\Windows\System\Bkiykwp.exe
  2⤵
  PID:15664
- C:\Windows\System\JfDBaXb.exe
  C:\Windows\System\JfDBaXb.exe
  2⤵
  PID:15680
- C:\Windows\System\RibhRwY.exe
  C:\Windows\System\RibhRwY.exe
  2⤵
  PID:15708
- C:\Windows\System\iZbViJP.exe
  C:\Windows\System\iZbViJP.exe
  2⤵
  PID:15736
- C:\Windows\System\TPjLQDp.exe
  C:\Windows\System\TPjLQDp.exe
  2⤵
  PID:15764
- C:\Windows\System\oaCaAZE.exe
  C:\Windows\System\oaCaAZE.exe
  2⤵
  PID:15796
- C:\Windows\System\bxFDyZe.exe
  C:\Windows\System\bxFDyZe.exe
  2⤵
  PID:15824
- C:\Windows\System\HPTAoaV.exe
  C:\Windows\System\HPTAoaV.exe
  2⤵
  PID:15844
- C:\Windows\System\cFiMAgS.exe
  C:\Windows\System\cFiMAgS.exe
  2⤵
  PID:15876
- C:\Windows\System\FivkbUN.exe
  C:\Windows\System\FivkbUN.exe
  2⤵
  PID:15900
- C:\Windows\System\LsOnfhm.exe
  C:\Windows\System\LsOnfhm.exe
  2⤵
  PID:15936
- C:\Windows\System\BBIkVPj.exe
  C:\Windows\System\BBIkVPj.exe
  2⤵
  PID:15964
- C:\Windows\System\mbYmVow.exe
  C:\Windows\System\mbYmVow.exe
  2⤵
  PID:15996
- C:\Windows\System\dVlDJVb.exe
  C:\Windows\System\dVlDJVb.exe
  2⤵
  PID:16020
- C:\Windows\System\aaanKBG.exe
  C:\Windows\System\aaanKBG.exe
  2⤵
  PID:16060
- C:\Windows\System\sEkZXlw.exe
  C:\Windows\System\sEkZXlw.exe
  2⤵
  PID:16084
- C:\Windows\System\RDUOCZE.exe
  C:\Windows\System\RDUOCZE.exe
  2⤵
  PID:16112
- C:\Windows\System\nBakKLl.exe
  C:\Windows\System\nBakKLl.exe
  2⤵
  PID:16136
- C:\Windows\System\XkPtYWU.exe
  C:\Windows\System\XkPtYWU.exe
  2⤵
  PID:16160
- C:\Windows\System\amvFqUF.exe
  C:\Windows\System\amvFqUF.exe
  2⤵
  PID:16184
- C:\Windows\System\FaszvfQ.exe
  C:\Windows\System\FaszvfQ.exe
  2⤵
  PID:16220
- C:\Windows\System\NTnVBRJ.exe
  C:\Windows\System\NTnVBRJ.exe
  2⤵
  PID:16248
- C:\Windows\System\aCPnxoy.exe
  C:\Windows\System\aCPnxoy.exe
  2⤵
  PID:16272
- C:\Windows\System\qCmPuLz.exe
  C:\Windows\System\qCmPuLz.exe
  2⤵
  PID:16296
- C:\Windows\System\KWHgFev.exe
  C:\Windows\System\KWHgFev.exe
  2⤵
  PID:16332
- C:\Windows\System\wfuwNJN.exe
  C:\Windows\System\wfuwNJN.exe
  2⤵
  PID:16368
- C:\Windows\System\YPAVyqy.exe
  C:\Windows\System\YPAVyqy.exe
  2⤵
  PID:15188
- C:\Windows\System\QcwhLHc.exe
  C:\Windows\System\QcwhLHc.exe
  2⤵
  PID:14348
- C:\Windows\System\ehOdSLj.exe
  C:\Windows\System\ehOdSLj.exe
  2⤵
  PID:15424
- C:\Windows\System\dXtfkBr.exe
  C:\Windows\System\dXtfkBr.exe
  2⤵
  PID:15368
- C:\Windows\System\gTsUzOw.exe
  C:\Windows\System\gTsUzOw.exe
  2⤵
  PID:15288
- C:\Windows\System\zEkKGct.exe
  C:\Windows\System\zEkKGct.exe
  2⤵
  PID:15488
- C:\Windows\System\XWrcivp.exe
  C:\Windows\System\XWrcivp.exe
  2⤵
  PID:15520
- C:\Windows\System\aniJYgI.exe
  C:\Windows\System\aniJYgI.exe
  2⤵
  PID:15732
- C:\Windows\System\ZBPnDIW.exe
  C:\Windows\System\ZBPnDIW.exe
  2⤵
  PID:15820
- C:\Windows\System\IOkoSAD.exe
  C:\Windows\System\IOkoSAD.exe
  2⤵
  PID:15660
- C:\Windows\System\syaXcGN.exe
  C:\Windows\System\syaXcGN.exe
  2⤵
  PID:15960
- C:\Windows\System\hvRSoEp.exe
  C:\Windows\System\hvRSoEp.exe
  2⤵
  PID:15784
- C:\Windows\System\tQuKuBA.exe
  C:\Windows\System\tQuKuBA.exe
  2⤵
  PID:16076
- C:\Windows\System\iKGaYlO.exe
  C:\Windows\System\iKGaYlO.exe
  2⤵
  PID:16176
- C:\Windows\System\FckKpgE.exe
  C:\Windows\System\FckKpgE.exe
  2⤵
  PID:16096
- C:\Windows\System\yoPchHV.exe
  C:\Windows\System\yoPchHV.exe
  2⤵
  PID:16168
- C:\Windows\System\xXoCtze.exe
  C:\Windows\System\xXoCtze.exe
  2⤵
  PID:16352
- C:\Windows\System\RBDXvym.exe
  C:\Windows\System\RBDXvym.exe
  2⤵
  PID:15376
- C:\Windows\System\DgGvHti.exe
  C:\Windows\System\DgGvHti.exe
  2⤵
  PID:15336
- C:\Windows\System\hCeWKLo.exe
  C:\Windows\System\hCeWKLo.exe
  2⤵
  PID:15748
- C:\Windows\System\wEFJjea.exe
  C:\Windows\System\wEFJjea.exe
  2⤵
  PID:15624
- C:\Windows\System\HVCxhcx.exe
  C:\Windows\System\HVCxhcx.exe
  2⤵
  PID:15932
- C:\Windows\System\PpcBdYG.exe
  C:\Windows\System\PpcBdYG.exe
  2⤵
  PID:16268
- C:\Windows\System\KnaIlxa.exe
  C:\Windows\System\KnaIlxa.exe
  2⤵
  PID:15772
- C:\Windows\System\haORzMc.exe
  C:\Windows\System\haORzMc.exe
  2⤵
  PID:16132
- C:\Windows\System\UwfXmRW.exe
  C:\Windows\System\UwfXmRW.exe
  2⤵
  PID:16412
- C:\Windows\System\oEzNtUx.exe
  C:\Windows\System\oEzNtUx.exe
  2⤵
  PID:16436
- C:\Windows\System\LgBEWof.exe
  C:\Windows\System\LgBEWof.exe
  2⤵
  PID:16472
- C:\Windows\System\WRjhMqF.exe
  C:\Windows\System\WRjhMqF.exe
  2⤵
  PID:16496
- C:\Windows\System\hgrreVx.exe
  C:\Windows\System\hgrreVx.exe
  2⤵
  PID:16512
- C:\Windows\System\HMQTKsU.exe
  C:\Windows\System\HMQTKsU.exe
  2⤵
  PID:16532
- C:\Windows\System\rofxRXo.exe
  C:\Windows\System\rofxRXo.exe
  2⤵
  PID:16548
- C:\Windows\System\cjFbhAv.exe
  C:\Windows\System\cjFbhAv.exe
  2⤵
  PID:16580
- C:\Windows\System\KehMHXf.exe
  C:\Windows\System\KehMHXf.exe
  2⤵
  PID:16608
- C:\Windows\System\IWCctTo.exe
  C:\Windows\System\IWCctTo.exe
  2⤵
  PID:16644
- C:\Windows\System\UceVoer.exe
  C:\Windows\System\UceVoer.exe
  2⤵
  PID:16664
- C:\Windows\System\jgCSEBL.exe
  C:\Windows\System\jgCSEBL.exe
  2⤵
  PID:16696
- C:\Windows\System\ynJbFcu.exe
  C:\Windows\System\ynJbFcu.exe
  2⤵
  PID:16728
- C:\Windows\System\zhjGJva.exe
  C:\Windows\System\zhjGJva.exe
  2⤵
  PID:16756
- C:\Windows\System\tdXDdTc.exe
  C:\Windows\System\tdXDdTc.exe
  2⤵
  PID:16780
- C:\Windows\System\wdxvDKz.exe
  C:\Windows\System\wdxvDKz.exe
  2⤵
  PID:16808
- C:\Windows\System\HjwavnO.exe
  C:\Windows\System\HjwavnO.exe
  2⤵
  PID:16844
- C:\Windows\System\xleEQxU.exe
  C:\Windows\System\xleEQxU.exe
  2⤵
  PID:16872
- C:\Windows\System\zwFQuBK.exe
  C:\Windows\System\zwFQuBK.exe
  2⤵
  PID:16904
- C:\Windows\System\HWYbgoa.exe
  C:\Windows\System\HWYbgoa.exe
  2⤵
  PID:16928
- C:\Windows\System\mRFiKXZ.exe
  C:\Windows\System\mRFiKXZ.exe
  2⤵
  PID:16956
- C:\Windows\System\cZjewdk.exe
  C:\Windows\System\cZjewdk.exe
  2⤵
  PID:16972
- C:\Windows\System\uopxWjK.exe
  C:\Windows\System\uopxWjK.exe
  2⤵
  PID:17004
- C:\Windows\System\WchJlFr.exe
  C:\Windows\System\WchJlFr.exe
  2⤵
  PID:17256
- C:\Windows\System\DOsDiuk.exe
  C:\Windows\System\DOsDiuk.exe
  2⤵
  PID:17284
- C:\Windows\System\wvijtcq.exe
  C:\Windows\System\wvijtcq.exe
  2⤵
  PID:17304

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:16984

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\BZfHERX.exe

Filesize
1.4MB

MD5
bd822c9b1cf3db81a8866e598a6b8cc1

SHA1
94c2601da69b766d57e6de70db29cc3f12106e05

SHA256
367a54c20864e5b0be05e517b0c10d8a57ad9ece64a4bc6d82a0de741dd750d7

SHA512
3d90c5104e95e1e3f63611881ae53b856f2d12fc77b0cc353351e4636698d86f107b44ae4a784bf5cf3b7a4b8abd9d721d3dbc7bd4a6824f859c331e0f244c64

Download Submit
C:\Windows\System\CjmXurI.exe

Filesize
1.4MB

MD5
91d6d50b6923f11bf3e97134b79d9988

SHA1
c1541bde5d4b30288fc2d138ccb2ba7f7ecab3db

SHA256
c8d1320c61fc62e20a0953176b7777a3dfa2a79f414471028486988d71517944

SHA512
07cc4691433a8c619fe5404dc28151295af7edfba61521df58f07b88c376313000d8f63e7fe6c22b753f8c89bc3e4069a88e6b1e1c6dc7ed1eee5b44aee11b49

Download Submit
C:\Windows\System\CyhGrhT.exe

Filesize
1.4MB

MD5
97606c06c596dd36794dd01d2816e870

SHA1
b353fa5ea3b70112a5b5bf80d3b6eda16687fb47

SHA256
eb7fc443ad703fee65583a8f9c3bdb7df69c8b8a2bdaa331b3cbd1f16f0a4f1d

SHA512
32f1c0b8d1e5b90af18274eba05717b1a4ed4097d7592acf783194ae1cf7570098e5eed3df9ed12e2692a2d3433800c0956908d16812c2cb0b2a44f0ca262f28

Download Submit
C:\Windows\System\DXJDLpL.exe

Filesize
1.4MB

MD5
6777cac2b99a15299c5289507678fc27

SHA1
c5c99e7a37fd18aa68d7f552fefddc3db1902c85

SHA256
d5a898607bc67bcb9ab480e2670e9ef414abe3bd5e735027b1383cdcfe8b4a73

SHA512
65a9b785eaa66cd85eff301c14fa7e929797b5771b8796220dd163a51bdb8eab9147e8d5fdb7462123e25630e803d41b0e304da3f9f26d8e2b2e4540c7ab2c63

Download Submit
C:\Windows\System\DoceDQO.exe

Filesize
1.4MB

MD5
98fbbbb86023d15b8039c76798bee5ce

SHA1
31a91188609a528c4bf563a55f97da5dbacbe221

SHA256
72529a1b14723d76f92ee877f759995ba7345f45a7f9e1fa5944b3c90f54cc18

SHA512
7863058a25176a6910e7ec926ebc215edd86dda201ed9965698fdeb50f9f375612de8bc53b9506fcd9abcbaa084ea738ca315796613ceae9050516199958a0aa

Download Submit
C:\Windows\System\EVJymcv.exe

Filesize
1.4MB

MD5
8ede677fb071341a375ed22e47429a97

SHA1
e5718bff521851d6ac1beb4cb55dccd36518b82c

SHA256
0b1f9c7c594f6a7ddac4d42dbfb8e5a096801d9782ce5c7c1298c9ffb2a1d863

SHA512
e39b13af1a837cf5174663e59d57055fc22ec8608cfac85885c4144f24b3b6f04a71fe282e41c8b8711734325ba392444dd8833f181db4d9e00069e10b43baca

Download Submit
C:\Windows\System\IVrimgk.exe

Filesize
1.4MB

MD5
462b2ef2483ccf755771a75926c3b8d6

SHA1
1ae92b67e28efcf61900a13b7a8837dee778de74

SHA256
48362a4330162e3fb85aee853ad7fe455d52839cd66d33d07b130063689d8879

SHA512
78afa579de512cafc95b8d8323c4bf5514b90ffa8a04e89be46323e2a9f19a7cff1521182f8a30268fdb8f1ff1885965740db0df4ccce1338ad474939f72fca5

Download Submit
C:\Windows\System\LHUdCzF.exe

Filesize
1.4MB

MD5
9189487f7d63a60b33bcbbb8ed14f323

SHA1
7dfa031428babe8b7c220aff884b3d6d3a91a842

SHA256
b05c8667b45a5d629c70361c9eb3234fa22c782264299083d1dfd864877d7c46

SHA512
2e11366f51a9878095b22dee3fcfca8e2364fff5ad515f5ee5131a593bfb415c586fc3c7f5914fddb3323fe61aa75ba1c0f2f494e35f3f035abce50a9ee431f0

Download Submit
C:\Windows\System\LuKdcKF.exe

Filesize
1.4MB

MD5
24e7ca4f1e431534643c44d3207b9dc2

SHA1
9f4bd98f41598d7af856229e010808270749c15a

SHA256
a9e4bc23dae705ad4d81439cab4efab256d4d30bd26081dea3df1d04d7e40551

SHA512
9f668c875142a76bf67d602a6f2387de223f6544805479cee4e3b599bdd87e3245fc267995e26cf1763b4a5e4ad321c0984ea0689e965262ac659b35d25f7398

Download Submit
C:\Windows\System\MmNtOle.exe

Filesize
1.4MB

MD5
368a1a8ed14ab174bf99214d537a3c44

SHA1
040a82a1ee0b471da57ac5d2d7a2aa169bef3f93

SHA256
f118c7476d97cbf96320a0ec9d3c7216fe03bc31b20da3b494fc94392427b6db

SHA512
e5c3667752f77487372090e4f1fdc63396af10c8e4cc0b789710826b28aad3f187370f04385e8c5a6a3c20cb5e08b108fa4f9b97e87c2be2ba2847c97ff8aa76

Download Submit
C:\Windows\System\QRCRYqc.exe

Filesize
1.4MB

MD5
0c6f518bfb8cca4de4af8211855a728d

SHA1
b5f647ec5a9245cbcfa0b8d433a6f4e04cc75ef6

SHA256
433d56fdf60d9f37ace1bf4482d64ba439d2796298de0d01ce2dd38f9cfb18e3

SHA512
eda94a4061608c0079fea0ca77e662c32ebd51c95f42def7c4759b0cfd185d7744ce9d27699698b550af053601f02e33b20e17994a4ba6424467a7aca22e383d

Download Submit
C:\Windows\System\ROgURJa.exe

Filesize
1.4MB

MD5
4f24a9177c28f2f2c6e3433ddefcd050

SHA1
882da46f277ad606b0ddeda54fac8fb8df81d7aa

SHA256
f94643c2928ea06b27ef37756d7f7e39ca377b68206d7ffa83536ae72c23ecc8

SHA512
2a41d44ceb46d23ce3a970bd82dc1d59321309818a470ad30d58d7598dcb068d51637ffdf89771cef61be748356966f8b9feefcdffab27d3c8f135597cb6f35d

Download Submit
C:\Windows\System\Rjtgqqh.exe

Filesize
1.4MB

MD5
c77da8318896c6c2fd73a6682ac3a7c8

SHA1
47c265c58b09cf0c51adacb06c9486c37c9da283

SHA256
ec347a14acc7184b9a9bfb8e64091846b0e08934fba68f00ec5f01c365b75066

SHA512
6089087085814333a74f4c892e6f55edc1d0e4576b52764356949b8e1a9fbb1fb028af00230f540310df1a13bef737873e6e268f5538900b766a8fc7bf688c35

Download Submit
C:\Windows\System\SKoPRbT.exe

Filesize
1.4MB

MD5
92fd375280f71ea6d29c75b846c7cf55

SHA1
42411238ff91f0115e7113e34643ea50aee05488

SHA256
bd704858655d1cfa10986351eb7ba2a38547776928d6b3de471b28c98d5f4a43

SHA512
84407572de37263b37164c04ea714f2bbdb31a5e810ff08b027a530d359e32587120e30bb94716da345b57518416244e1424cfcfb8e679048ed91c9414f0435c

Download Submit
C:\Windows\System\SZZUDrZ.exe

Filesize
1.4MB

MD5
2d14a1b4cfba7c902d7d1321fdf27f25

SHA1
86ba942df2f7413fc0cd13ed5516d8964447de7e

SHA256
798fd5e639086b1bc23e46709e6a03334eb53b18a3f7cfea6e7af03381d484be

SHA512
768feba3530f2cf25a46bc3275ecac7e6c441cc4249c85637a476ee2780087e34c50318aba73c181656a4264f630052378f16288810bc7f8ce30fca5986f145a

Download Submit
C:\Windows\System\VDOZIDB.exe

Filesize
1.4MB

MD5
dfc32251bb674893a4e4ad0a0278e246

SHA1
8542918bc47a3cfaa01a7fc7c573a50a6ea42527

SHA256
6f80dc908a92c792a15085470fac0d1edcfddb141ebe7fde9fb599eb5daaea08

SHA512
14153302b5cf7a9464f0575824e0a8d754a07d765c26df146eb3cea033c6f23cb850804b136ccceffc94ce4964f3de39c4bfde38a88714676fe11ef1d6577a73

Download Submit
C:\Windows\System\VwbEEuI.exe

Filesize
1.4MB

MD5
8b784d7ee1d4eba45483a79599d425c3

SHA1
0a54f44ac39e0744dfedc77c515b63ff460bf2d3

SHA256
53849b32fbb58c5637e5b660ec0c0f2e5aa1a8b07e22d31c6d5112f711e17fdc

SHA512
d62e43ea02a834c2e0755d59fcddf1590b9adbcb9a18b0bf06d2fd997113d390ac268e5839e590d4e062ab70c4a07e1c3faeeae7576d069dda9a400e9055c881

Download Submit
C:\Windows\System\WjDnUnk.exe

Filesize
1.4MB

MD5
2aeb7d78efb5ec720a3215cf14d93297

SHA1
8c488e4321b6f4807128b8f638f242bcd381a697

SHA256
315922740038eaa13fffce5edf6d90fed7edb9682002a677a985fe8124261257

SHA512
2ca5fb9f5bad9faf45938026b094d091d49d91a5759d9ed0519eae21f8fb980f02b91aadef9ef29cddcbe5fab6737617e5edadebe2f8020b519814191e797dc2

Download Submit
C:\Windows\System\awmjdNi.exe

Filesize
1.4MB

MD5
95e834c33b17e676afbc24a5f01e3fcd

SHA1
3031dd04510104063afd8c274f6a2f9f854bca7d

SHA256
0c8f70e93b1c4227538b49fb57ccda237b37d40a3922834f81df33fd612b946c

SHA512
c020a222b083b8d83652d079ba000a1d2fb1ab5af75b417f72864e0a1d4c7b6ad9b823fb34971471318282d94beccc7e987aac6c27eab91d74e70d6813f72ac0

Download Submit
C:\Windows\System\bHIYnpA.exe

Filesize
1.4MB

MD5
e52058d6135e77b07f537475e2840b1b

SHA1
83d910fbe675b51b83cb32b7a234e4225a54b984

SHA256
499af05dc61d4e0b9bf79e929fa0bc6f1f78ddae63c324d7661b698627958bc7

SHA512
72ebd9e4c34241b6a1920c9b64d9c50df9fa1e4e22e9ce2523dd0e72862bdecfe3003449cef7e3498f03df28bde6348192975db615da54fbae23d6ff225710ce

Download Submit
C:\Windows\System\bUjoeAr.exe

Filesize
1.4MB

MD5
ed3067d3e5982792ca2c4d5e8d2adafa

SHA1
0b4de122685d542f6d1e35679da43e4fb17ec942

SHA256
4d87744f6f5201652b11d7163587557f0ba78c1e1524f05cb959dae311ad3f3c

SHA512
61a9b82d1e5da8fd7d45a1fe8dbcf3137a8a274b45dcc93442755936375d9d2ad432057434137c36ddf4884527fe47e3f79f59ec8105a7858154ba5150291e37

Download Submit
C:\Windows\System\cXsuyVm.exe

Filesize
1.4MB

MD5
c7b974e00e6c8fcc4977c8c1070a1a7f

SHA1
db712f7ee2d51efdfe5487ee60ffb772af851ff4

SHA256
d91e5c23c63f61ef3420da98dff956b39425526cfae65f7b92b50b947384cc6f

SHA512
dd1ddd47a9676399ddde34c612f56a6a0cc67881b08ead8767ac7f116d6ddfee203534a271b4dd54503ede5c4cba2cdfebc7c2f557d783a572f1760e9243279e

Download Submit
C:\Windows\System\czHBqXW.exe

Filesize
1.4MB

MD5
4c41980ab6fd65c246fa13f467df0e81

SHA1
0f63e39688e2ce55d8d9b896f031728746610f34

SHA256
90bdd280d628219ec7d8bfa5ccf93d48812ae862b335688c73634d3f58f9557b

SHA512
d60c483db725a867124cc4006fa51a44a1ecc5c24d2418e63a0e218e82f068cdcdec9ea45b4bb3e851d70297934c499c9602fe8b9fb59c6229cbde60b782bec9

Download Submit
C:\Windows\System\dGnSlSE.exe

Filesize
1.4MB

MD5
d6c21dee0ecb15ec962dcd1c925a8969

SHA1
26a9afc0a0a0fdf93a34ff4c9d0d82f949ee901d

SHA256
08230a1f63ae82cacfced65627ac5c2d27fe2cd584851a13b2821e45235e4425

SHA512
7855182b8f1dbe7f4aece63b614a395869e0c7b4e02cf7f686382c15272e8ae7297e998105e9d3ed7ff9e232fc324a5bb5a3105532aa820b156b271256c424e3

Download Submit
C:\Windows\System\diQLpPM.exe

Filesize
1.4MB

MD5
df9e44f096478ca421cb810292c3b373

SHA1
5dccb658839e41a3aefa9b63e0d5916795bbb28a

SHA256
ba074d0393cd3081527929b8ea52fe74c89102598795c972b020c3d0700e3e90

SHA512
84c062ed26b38f0be274464cccf693490d5f956b80e1d3bb4e677bfa497a173fa1ba204ff1d3bb80c3b253998cc8e92259130fb19c70b639cc7f1f471078f82f

Download Submit
C:\Windows\System\hTYUSxJ.exe

Filesize
1.4MB

MD5
6d01054a77e11bd20d97625130b9fbe7

SHA1
cb7433ea8786c895a77921362419cece8d9115c0

SHA256
c487be3fc52d63924c11b59deacc746c84a90353b96a5c0b8f6ecbbaedaaafb2

SHA512
66204b92799e01368814e16eafd498af1e695ebc5d4d4a0163c7cebeca36eba15213b0251b8912faed2089d726d6aad63c337f6172cfaf75319eea60d8c0f5c1

Download Submit
C:\Windows\System\hXDWDOO.exe

Filesize
1.4MB

MD5
1ca4dde43df2f6ee91e97dc6f6ce95f5

SHA1
3aad438ef571a66308fee0219e465e867b3a3a98

SHA256
5647f062b9603adc2d58a89e303a82d1f3093885856db671340da5c9e1ae840d

SHA512
e1037d768b24db698346e7fb266bcc0aa027bead3c7f05799110380e5c56e090d2590f14cd274e6588904c676560e7947c7fbaf715231acdb19b18906b0704f3

Download Submit
C:\Windows\System\iJRNNXN.exe

Filesize
1.4MB

MD5
315374de6bdf1708d63effbcc94dfcae

SHA1
922e13a7f32713473a6aeb4149487b0ff396a92e

SHA256
ee4c7ada2fcbe85b19bf1c35d504046ae0ef5fbc8a981b67bee1daa9d9239ff0

SHA512
95bd3433e7eb97b4cd360b5ee9de916a68964879534762f1501ad710332693c506065245195188985cede16bbde9601aedda88366b98bc96cfccecaae81d2fbd

Download Submit
C:\Windows\System\jQGQiNV.exe

Filesize
1.4MB

MD5
4668d5267896c96810a00f3eaa02d82c

SHA1
7fbf73800b83fdc07e4e08639a0406e3cb9b9337

SHA256
90b71bc77a1a5e8058f6d838468966a96b2c4fce0360250d15a757e08836783f

SHA512
be3659c241332da2c148b4b66c1edc511e2249c684fd1964932538d4446a2cc0b3725d5c968789811aadc114ed63584f8644e0f61c0e8180e27acae4b1cd1ef1

Download Submit
C:\Windows\System\mLvkify.exe

Filesize
1.4MB

MD5
ec4e271b1b22b3563ca9c8808b2b9691

SHA1
824d51606034e19f8e7a169970383c8b73d70146

SHA256
dc2ca9350b7a48796c48321d018e76bf4b096c457cea55ed7a1712a82e654277

SHA512
c14f11e3e74b277dad00b03f1dc8dcc37fb67eb0bcbae0f8ce40dc7e52b6ef7a92e1cb10e32070a6fb1fed3b6110e56c3e8d33da94654944f10a35d9d492413b

Download Submit
C:\Windows\System\mvPXPUP.exe

Filesize
1.4MB

MD5
22aaca939e76fc6d5dc6557c9c523737

SHA1
b325f6d1cbf877599829cdc8c1f30bcf64c2ada2

SHA256
2bd7b8c9d666882461d5811a01a5f4a40cbe51edf21bc71337ae67bb45a61ddf

SHA512
27ccb4f97707eda47d3c52828d4e97ee0906e353c6686c7afd84866d087496edcaa3d5b75d88fa7590f389d7c60e781c36b3f9f660110e3edb782ecf7c2dd5b5

Download Submit
C:\Windows\System\qRGzJqg.exe

Filesize
1.4MB

MD5
425f48139117d8cf58a7fc47698c1df0

SHA1
5c011fa6e17da46168f133a5c8ee986e18174f87

SHA256
5ba9626557d83047e24e2a49c7417bab6aec6daa86166207500ac759c66bd312

SHA512
b51f6ac88e7df3743b6e1eaf2d8cf271c9b4eb550c66de325bfd5a9dbac15ab89feb1567f812a42db849fc97588c7b88802e98504d248f9f07644e6493b6ab04

Download Submit
C:\Windows\System\xRalsFS.exe

Filesize
1.4MB

MD5
21fe38e7412f21ba4847f8ca82390b17

SHA1
30d322b42ea7d88c20b5779e381b32bfa6b83aeb

SHA256
9158997e5222fb33b98de3710b8f93d7232ff8c67eb7ef652a052b2b775f1240

SHA512
f10978108a1bfae4e29d389d8e9daceacffe587dcc7e1169b84318e531fdfe0f1a4c3eea5e91b0bfd9c30adbd52540b62535afe9dd2b5c376c68bcbbc216a114

Download Submit
C:\Windows\System\zetlYJQ.exe

Filesize
1.4MB

MD5
63ed9577f787ad3b358dcf4a533de2fb

SHA1
ee8160f52b5d92c5a5ef72607811a68d60ad8067

SHA256
27ac4d6bea7259206418d53042bc0b9691507f3303371548f5dc02a4ac798e8f

SHA512
dcd6f26cafd5a9b7aa43f1ab04af9122bbdeb71d49fc590d1d98db98abd587f59e778678b13cad757bce8178cd1ef9466eec783347e37b30008281163edb1ae7

Download Submit
memory/2748-0-0x00000182B1F20000-0x00000182B1F30000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads