xmrig | 9caccaf937b46f4df77dc5a65774a1b4847dc223e476c2aae9a04a1149458e76

Analysis

max time kernel
116s
max time network
117s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
23/12/2024, 23:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9caccaf937b46f4df77dc5a65774a1b4847dc223e476c2aae9a04a1149458e76.exe
Size

1.4MB
MD5

80a08da5e5664a2dd6fc987b20858b23
SHA1

fa876b94c26d1a24ac0f282af6b453106445a202
SHA256

9caccaf937b46f4df77dc5a65774a1b4847dc223e476c2aae9a04a1149458e76
SHA512

304c0086d3577c62133f53f7d31a1ed70a7cc43cbf7ed83524ac3b62468b6637e45cecd1250bbc6f38dcb67d118e9786775516a57de5eb5940ea6062ea521649
SSDEEP

24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbpwlKenszaDw4BcYC8qKswr+WvUA:GezaTF8FcNkNdfE0pZ9ozttwIRakG37/

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 33 IoCs

miner

resource	yara_rule
behavioral2/files/0x000b000000023b8e-3.dat	xmrig
behavioral2/files/0x000a000000023b93-8.dat	xmrig
behavioral2/files/0x000a000000023b92-9.dat	xmrig
behavioral2/files/0x000a000000023b9a-53.dat	xmrig
behavioral2/files/0x000a000000023b9d-67.dat	xmrig
behavioral2/files/0x000a000000023ba4-105.dat	xmrig
behavioral2/files/0x000a000000023bb8-162.dat	xmrig
behavioral2/files/0x000b000000023baf-160.dat	xmrig
behavioral2/files/0x000b000000023bb0-157.dat	xmrig
behavioral2/files/0x000b000000023bae-155.dat	xmrig
behavioral2/files/0x000a000000023bad-150.dat	xmrig
behavioral2/files/0x000a000000023bac-145.dat	xmrig
behavioral2/files/0x000a000000023bab-140.dat	xmrig
behavioral2/files/0x000a000000023baa-135.dat	xmrig
behavioral2/files/0x000a000000023ba9-130.dat	xmrig
behavioral2/files/0x000a000000023ba8-125.dat	xmrig
behavioral2/files/0x000a000000023ba7-120.dat	xmrig
behavioral2/files/0x000a000000023ba6-115.dat	xmrig
behavioral2/files/0x000a000000023ba5-110.dat	xmrig
behavioral2/files/0x000a000000023ba3-97.dat	xmrig
behavioral2/files/0x000a000000023ba2-93.dat	xmrig
behavioral2/files/0x000a000000023ba1-85.dat	xmrig
behavioral2/files/0x000a000000023ba0-80.dat	xmrig
behavioral2/files/0x000a000000023b9f-75.dat	xmrig
behavioral2/files/0x000a000000023b9e-73.dat	xmrig
behavioral2/files/0x000a000000023b9c-63.dat	xmrig
behavioral2/files/0x000a000000023b9b-57.dat	xmrig
behavioral2/files/0x000a000000023b99-47.dat	xmrig
behavioral2/files/0x000a000000023b98-43.dat	xmrig
behavioral2/files/0x000a000000023b97-37.dat	xmrig
behavioral2/files/0x000a000000023b96-33.dat	xmrig
behavioral2/files/0x000a000000023b95-27.dat	xmrig
behavioral2/files/0x000a000000023b94-22.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
4560	CjVpxHt.exe
4084	RQyQXQG.exe
1068	GCvLGTr.exe
4844	hHUvXAC.exe
228	ZUuErsl.exe
3808	hLPXMMm.exe
380	CsCHgBM.exe
4864	ZGOOEIi.exe
3316	BctfBHd.exe
460	zSVqJlS.exe
2440	rfMRzOa.exe
2724	XUrPghy.exe
620	UtfhRBK.exe
3868	hcXAgyT.exe
3212	KdOshwX.exe
1080	GePiiBQ.exe
2924	eLcHQIQ.exe
1212	XbrFfmD.exe
1848	vhwrZaV.exe
3300	tJbkudQ.exe
3456	vXjTEoB.exe
2936	PYrfECq.exe
5000	xrkZasH.exe
4760	aeHHoxB.exe
2036	kldwUsD.exe
5020	PqNVlam.exe
736	kxeYOyg.exe
664	VlmCYhK.exe
4164	KqytKxW.exe
2092	ktlDDTn.exe
2064	jdyTAMK.exe
3328	PVxpxYz.exe
2904	KfPlOpG.exe
4884	SnDntZt.exe
4840	RTGDGGP.exe
4316	PqYhyRt.exe
4040	hyUGhqm.exe
396	CxujdMB.exe
4272	ZQftmOe.exe
532	GutZUgT.exe
448	vDjEAGA.exe
4828	uqYIILj.exe
4348	PgyHHOc.exe
4240	dyzcZTr.exe
1512	nIStJhP.exe
2868	XGmqUAL.exe
3280	aONVjVI.exe
4344	tEouuEk.exe
4772	kumfAlY.exe
1732	fFbCKeZ.exe
3732	DyLjrxs.exe
5112	lzXcSCc.exe
1748	ZtvKWbL.exe
1916	OdPjpRM.exe
1620	HoairXp.exe
4948	mCAjUxF.exe
2004	nANCkHb.exe
1436	AxGDrcv.exe
4508	mGtYhSG.exe
4676	vdgDavt.exe
2132	VoQBqsp.exe
2760	hApvimH.exe
2276	kxgUpHq.exe
3696	QEZhVvF.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\yWucUTx.exe	9caccaf937b46f4df77dc5a65774a1b4847dc223e476c2aae9a04a1149458e76.exe
File created	C:\Windows\System\zoesusL.exe	9caccaf937b46f4df77dc5a65774a1b4847dc223e476c2aae9a04a1149458e76.exe
File created	C:\Windows\System\aJXLefs.exe	9caccaf937b46f4df77dc5a65774a1b4847dc223e476c2aae9a04a1149458e76.exe
File created	C:\Windows\System\MTtGjFM.exe	9caccaf937b46f4df77dc5a65774a1b4847dc223e476c2aae9a04a1149458e76.exe
File created	C:\Windows\System\eofBLRs.exe	9caccaf937b46f4df77dc5a65774a1b4847dc223e476c2aae9a04a1149458e76.exe
File created	C:\Windows\System\hsTKCdr.exe	9caccaf937b46f4df77dc5a65774a1b4847dc223e476c2aae9a04a1149458e76.exe
File created	C:\Windows\System\HGqkdJe.exe	9caccaf937b46f4df77dc5a65774a1b4847dc223e476c2aae9a04a1149458e76.exe
File created	C:\Windows\System\WVGzKAl.exe	9caccaf937b46f4df77dc5a65774a1b4847dc223e476c2aae9a04a1149458e76.exe
File created	C:\Windows\System\xKXYHrP.exe	9caccaf937b46f4df77dc5a65774a1b4847dc223e476c2aae9a04a1149458e76.exe
File created	C:\Windows\System\kLMMyFE.exe	9caccaf937b46f4df77dc5a65774a1b4847dc223e476c2aae9a04a1149458e76.exe
File created	C:\Windows\System\rsEwQwh.exe	9caccaf937b46f4df77dc5a65774a1b4847dc223e476c2aae9a04a1149458e76.exe
File created	C:\Windows\System\AdtDOTH.exe	9caccaf937b46f4df77dc5a65774a1b4847dc223e476c2aae9a04a1149458e76.exe
File created	C:\Windows\System\wWXuJhD.exe	9caccaf937b46f4df77dc5a65774a1b4847dc223e476c2aae9a04a1149458e76.exe
File created	C:\Windows\System\BQEviLs.exe	9caccaf937b46f4df77dc5a65774a1b4847dc223e476c2aae9a04a1149458e76.exe
File created	C:\Windows\System\Giwmuqi.exe	9caccaf937b46f4df77dc5a65774a1b4847dc223e476c2aae9a04a1149458e76.exe
File created	C:\Windows\System\gSbYSOG.exe	9caccaf937b46f4df77dc5a65774a1b4847dc223e476c2aae9a04a1149458e76.exe
File created	C:\Windows\System\bquqcvf.exe	9caccaf937b46f4df77dc5a65774a1b4847dc223e476c2aae9a04a1149458e76.exe
File created	C:\Windows\System\BHUSyKr.exe	9caccaf937b46f4df77dc5a65774a1b4847dc223e476c2aae9a04a1149458e76.exe
File created	C:\Windows\System\HwkdNyR.exe	9caccaf937b46f4df77dc5a65774a1b4847dc223e476c2aae9a04a1149458e76.exe
File created	C:\Windows\System\avmCwqx.exe	9caccaf937b46f4df77dc5a65774a1b4847dc223e476c2aae9a04a1149458e76.exe
File created	C:\Windows\System\bbJXwQl.exe	9caccaf937b46f4df77dc5a65774a1b4847dc223e476c2aae9a04a1149458e76.exe
File created	C:\Windows\System\kZXEpWQ.exe	9caccaf937b46f4df77dc5a65774a1b4847dc223e476c2aae9a04a1149458e76.exe
File created	C:\Windows\System\ktlDDTn.exe	9caccaf937b46f4df77dc5a65774a1b4847dc223e476c2aae9a04a1149458e76.exe
File created	C:\Windows\System\iELVbOv.exe	9caccaf937b46f4df77dc5a65774a1b4847dc223e476c2aae9a04a1149458e76.exe
File created	C:\Windows\System\zCXYeWH.exe	9caccaf937b46f4df77dc5a65774a1b4847dc223e476c2aae9a04a1149458e76.exe
File created	C:\Windows\System\eoNGrqQ.exe	9caccaf937b46f4df77dc5a65774a1b4847dc223e476c2aae9a04a1149458e76.exe
File created	C:\Windows\System\wOcosMq.exe	9caccaf937b46f4df77dc5a65774a1b4847dc223e476c2aae9a04a1149458e76.exe
File created	C:\Windows\System\uGTtYWN.exe	9caccaf937b46f4df77dc5a65774a1b4847dc223e476c2aae9a04a1149458e76.exe
File created	C:\Windows\System\RCzZNbr.exe	9caccaf937b46f4df77dc5a65774a1b4847dc223e476c2aae9a04a1149458e76.exe
File created	C:\Windows\System\MPoJkJl.exe	9caccaf937b46f4df77dc5a65774a1b4847dc223e476c2aae9a04a1149458e76.exe
File created	C:\Windows\System\qrMjEYy.exe	9caccaf937b46f4df77dc5a65774a1b4847dc223e476c2aae9a04a1149458e76.exe
File created	C:\Windows\System\OBsvRPN.exe	9caccaf937b46f4df77dc5a65774a1b4847dc223e476c2aae9a04a1149458e76.exe
File created	C:\Windows\System\ldvyOrF.exe	9caccaf937b46f4df77dc5a65774a1b4847dc223e476c2aae9a04a1149458e76.exe
File created	C:\Windows\System\zVPlMeY.exe	9caccaf937b46f4df77dc5a65774a1b4847dc223e476c2aae9a04a1149458e76.exe
File created	C:\Windows\System\rAxNqwy.exe	9caccaf937b46f4df77dc5a65774a1b4847dc223e476c2aae9a04a1149458e76.exe
File created	C:\Windows\System\PYrfECq.exe	9caccaf937b46f4df77dc5a65774a1b4847dc223e476c2aae9a04a1149458e76.exe
File created	C:\Windows\System\hApvimH.exe	9caccaf937b46f4df77dc5a65774a1b4847dc223e476c2aae9a04a1149458e76.exe
File created	C:\Windows\System\yimoavq.exe	9caccaf937b46f4df77dc5a65774a1b4847dc223e476c2aae9a04a1149458e76.exe
File created	C:\Windows\System\emYLzvE.exe	9caccaf937b46f4df77dc5a65774a1b4847dc223e476c2aae9a04a1149458e76.exe
File created	C:\Windows\System\UuYmnQd.exe	9caccaf937b46f4df77dc5a65774a1b4847dc223e476c2aae9a04a1149458e76.exe
File created	C:\Windows\System\TyDijMT.exe	9caccaf937b46f4df77dc5a65774a1b4847dc223e476c2aae9a04a1149458e76.exe
File created	C:\Windows\System\CPNHRSV.exe	9caccaf937b46f4df77dc5a65774a1b4847dc223e476c2aae9a04a1149458e76.exe
File created	C:\Windows\System\hDIQTnK.exe	9caccaf937b46f4df77dc5a65774a1b4847dc223e476c2aae9a04a1149458e76.exe
File created	C:\Windows\System\KYQVmYg.exe	9caccaf937b46f4df77dc5a65774a1b4847dc223e476c2aae9a04a1149458e76.exe
File created	C:\Windows\System\kHbmRMp.exe	9caccaf937b46f4df77dc5a65774a1b4847dc223e476c2aae9a04a1149458e76.exe
File created	C:\Windows\System\bheHQNn.exe	9caccaf937b46f4df77dc5a65774a1b4847dc223e476c2aae9a04a1149458e76.exe
File created	C:\Windows\System\IgneNgl.exe	9caccaf937b46f4df77dc5a65774a1b4847dc223e476c2aae9a04a1149458e76.exe
File created	C:\Windows\System\sLFdCFH.exe	9caccaf937b46f4df77dc5a65774a1b4847dc223e476c2aae9a04a1149458e76.exe
File created	C:\Windows\System\MWyNbbj.exe	9caccaf937b46f4df77dc5a65774a1b4847dc223e476c2aae9a04a1149458e76.exe
File created	C:\Windows\System\AaBYgdE.exe	9caccaf937b46f4df77dc5a65774a1b4847dc223e476c2aae9a04a1149458e76.exe
File created	C:\Windows\System\yQYlAjc.exe	9caccaf937b46f4df77dc5a65774a1b4847dc223e476c2aae9a04a1149458e76.exe
File created	C:\Windows\System\upjcLhh.exe	9caccaf937b46f4df77dc5a65774a1b4847dc223e476c2aae9a04a1149458e76.exe
File created	C:\Windows\System\LDxpTbY.exe	9caccaf937b46f4df77dc5a65774a1b4847dc223e476c2aae9a04a1149458e76.exe
File created	C:\Windows\System\UwinPVJ.exe	9caccaf937b46f4df77dc5a65774a1b4847dc223e476c2aae9a04a1149458e76.exe
File created	C:\Windows\System\knYCFCS.exe	9caccaf937b46f4df77dc5a65774a1b4847dc223e476c2aae9a04a1149458e76.exe
File created	C:\Windows\System\klGOwzw.exe	9caccaf937b46f4df77dc5a65774a1b4847dc223e476c2aae9a04a1149458e76.exe
File created	C:\Windows\System\HqposuB.exe	9caccaf937b46f4df77dc5a65774a1b4847dc223e476c2aae9a04a1149458e76.exe
File created	C:\Windows\System\sbJJZRZ.exe	9caccaf937b46f4df77dc5a65774a1b4847dc223e476c2aae9a04a1149458e76.exe
File created	C:\Windows\System\dAXHCwc.exe	9caccaf937b46f4df77dc5a65774a1b4847dc223e476c2aae9a04a1149458e76.exe
File created	C:\Windows\System\ScwjzLx.exe	9caccaf937b46f4df77dc5a65774a1b4847dc223e476c2aae9a04a1149458e76.exe
File created	C:\Windows\System\QLBlUGz.exe	9caccaf937b46f4df77dc5a65774a1b4847dc223e476c2aae9a04a1149458e76.exe
File created	C:\Windows\System\MTnOlPF.exe	9caccaf937b46f4df77dc5a65774a1b4847dc223e476c2aae9a04a1149458e76.exe
File created	C:\Windows\System\jLoUHpk.exe	9caccaf937b46f4df77dc5a65774a1b4847dc223e476c2aae9a04a1149458e76.exe
File created	C:\Windows\System\NpgAbTF.exe	9caccaf937b46f4df77dc5a65774a1b4847dc223e476c2aae9a04a1149458e76.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	16396	dwm.exe
Token: SeChangeNotifyPrivilege	16396	dwm.exe
Token: 33	16396	dwm.exe
Token: SeIncBasePriorityPrivilege	16396	dwm.exe
Token: SeShutdownPrivilege	16396	dwm.exe
Token: SeCreatePagefilePrivilege	16396	dwm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2008 wrote to memory of 4560	2008	9caccaf937b46f4df77dc5a65774a1b4847dc223e476c2aae9a04a1149458e76.exe	84
PID 2008 wrote to memory of 4560	2008	9caccaf937b46f4df77dc5a65774a1b4847dc223e476c2aae9a04a1149458e76.exe	84
PID 2008 wrote to memory of 4084	2008	9caccaf937b46f4df77dc5a65774a1b4847dc223e476c2aae9a04a1149458e76.exe	85
PID 2008 wrote to memory of 4084	2008	9caccaf937b46f4df77dc5a65774a1b4847dc223e476c2aae9a04a1149458e76.exe	85
PID 2008 wrote to memory of 1068	2008	9caccaf937b46f4df77dc5a65774a1b4847dc223e476c2aae9a04a1149458e76.exe	86
PID 2008 wrote to memory of 1068	2008	9caccaf937b46f4df77dc5a65774a1b4847dc223e476c2aae9a04a1149458e76.exe	86
PID 2008 wrote to memory of 4844	2008	9caccaf937b46f4df77dc5a65774a1b4847dc223e476c2aae9a04a1149458e76.exe	87
PID 2008 wrote to memory of 4844	2008	9caccaf937b46f4df77dc5a65774a1b4847dc223e476c2aae9a04a1149458e76.exe	87
PID 2008 wrote to memory of 228	2008	9caccaf937b46f4df77dc5a65774a1b4847dc223e476c2aae9a04a1149458e76.exe	88
PID 2008 wrote to memory of 228	2008	9caccaf937b46f4df77dc5a65774a1b4847dc223e476c2aae9a04a1149458e76.exe	88
PID 2008 wrote to memory of 3808	2008	9caccaf937b46f4df77dc5a65774a1b4847dc223e476c2aae9a04a1149458e76.exe	89
PID 2008 wrote to memory of 3808	2008	9caccaf937b46f4df77dc5a65774a1b4847dc223e476c2aae9a04a1149458e76.exe	89
PID 2008 wrote to memory of 380	2008	9caccaf937b46f4df77dc5a65774a1b4847dc223e476c2aae9a04a1149458e76.exe	90
PID 2008 wrote to memory of 380	2008	9caccaf937b46f4df77dc5a65774a1b4847dc223e476c2aae9a04a1149458e76.exe	90
PID 2008 wrote to memory of 4864	2008	9caccaf937b46f4df77dc5a65774a1b4847dc223e476c2aae9a04a1149458e76.exe	91
PID 2008 wrote to memory of 4864	2008	9caccaf937b46f4df77dc5a65774a1b4847dc223e476c2aae9a04a1149458e76.exe	91
PID 2008 wrote to memory of 3316	2008	9caccaf937b46f4df77dc5a65774a1b4847dc223e476c2aae9a04a1149458e76.exe	92
PID 2008 wrote to memory of 3316	2008	9caccaf937b46f4df77dc5a65774a1b4847dc223e476c2aae9a04a1149458e76.exe	92
PID 2008 wrote to memory of 460	2008	9caccaf937b46f4df77dc5a65774a1b4847dc223e476c2aae9a04a1149458e76.exe	93
PID 2008 wrote to memory of 460	2008	9caccaf937b46f4df77dc5a65774a1b4847dc223e476c2aae9a04a1149458e76.exe	93
PID 2008 wrote to memory of 2440	2008	9caccaf937b46f4df77dc5a65774a1b4847dc223e476c2aae9a04a1149458e76.exe	94
PID 2008 wrote to memory of 2440	2008	9caccaf937b46f4df77dc5a65774a1b4847dc223e476c2aae9a04a1149458e76.exe	94
PID 2008 wrote to memory of 2724	2008	9caccaf937b46f4df77dc5a65774a1b4847dc223e476c2aae9a04a1149458e76.exe	95
PID 2008 wrote to memory of 2724	2008	9caccaf937b46f4df77dc5a65774a1b4847dc223e476c2aae9a04a1149458e76.exe	95
PID 2008 wrote to memory of 620	2008	9caccaf937b46f4df77dc5a65774a1b4847dc223e476c2aae9a04a1149458e76.exe	96
PID 2008 wrote to memory of 620	2008	9caccaf937b46f4df77dc5a65774a1b4847dc223e476c2aae9a04a1149458e76.exe	96
PID 2008 wrote to memory of 3868	2008	9caccaf937b46f4df77dc5a65774a1b4847dc223e476c2aae9a04a1149458e76.exe	97
PID 2008 wrote to memory of 3868	2008	9caccaf937b46f4df77dc5a65774a1b4847dc223e476c2aae9a04a1149458e76.exe	97
PID 2008 wrote to memory of 3212	2008	9caccaf937b46f4df77dc5a65774a1b4847dc223e476c2aae9a04a1149458e76.exe	98
PID 2008 wrote to memory of 3212	2008	9caccaf937b46f4df77dc5a65774a1b4847dc223e476c2aae9a04a1149458e76.exe	98
PID 2008 wrote to memory of 1080	2008	9caccaf937b46f4df77dc5a65774a1b4847dc223e476c2aae9a04a1149458e76.exe	99
PID 2008 wrote to memory of 1080	2008	9caccaf937b46f4df77dc5a65774a1b4847dc223e476c2aae9a04a1149458e76.exe	99
PID 2008 wrote to memory of 2924	2008	9caccaf937b46f4df77dc5a65774a1b4847dc223e476c2aae9a04a1149458e76.exe	100
PID 2008 wrote to memory of 2924	2008	9caccaf937b46f4df77dc5a65774a1b4847dc223e476c2aae9a04a1149458e76.exe	100
PID 2008 wrote to memory of 1212	2008	9caccaf937b46f4df77dc5a65774a1b4847dc223e476c2aae9a04a1149458e76.exe	101
PID 2008 wrote to memory of 1212	2008	9caccaf937b46f4df77dc5a65774a1b4847dc223e476c2aae9a04a1149458e76.exe	101
PID 2008 wrote to memory of 1848	2008	9caccaf937b46f4df77dc5a65774a1b4847dc223e476c2aae9a04a1149458e76.exe	102
PID 2008 wrote to memory of 1848	2008	9caccaf937b46f4df77dc5a65774a1b4847dc223e476c2aae9a04a1149458e76.exe	102
PID 2008 wrote to memory of 3300	2008	9caccaf937b46f4df77dc5a65774a1b4847dc223e476c2aae9a04a1149458e76.exe	103
PID 2008 wrote to memory of 3300	2008	9caccaf937b46f4df77dc5a65774a1b4847dc223e476c2aae9a04a1149458e76.exe	103
PID 2008 wrote to memory of 3456	2008	9caccaf937b46f4df77dc5a65774a1b4847dc223e476c2aae9a04a1149458e76.exe	104
PID 2008 wrote to memory of 3456	2008	9caccaf937b46f4df77dc5a65774a1b4847dc223e476c2aae9a04a1149458e76.exe	104
PID 2008 wrote to memory of 2936	2008	9caccaf937b46f4df77dc5a65774a1b4847dc223e476c2aae9a04a1149458e76.exe	105
PID 2008 wrote to memory of 2936	2008	9caccaf937b46f4df77dc5a65774a1b4847dc223e476c2aae9a04a1149458e76.exe	105
PID 2008 wrote to memory of 5000	2008	9caccaf937b46f4df77dc5a65774a1b4847dc223e476c2aae9a04a1149458e76.exe	106
PID 2008 wrote to memory of 5000	2008	9caccaf937b46f4df77dc5a65774a1b4847dc223e476c2aae9a04a1149458e76.exe	106
PID 2008 wrote to memory of 4760	2008	9caccaf937b46f4df77dc5a65774a1b4847dc223e476c2aae9a04a1149458e76.exe	107
PID 2008 wrote to memory of 4760	2008	9caccaf937b46f4df77dc5a65774a1b4847dc223e476c2aae9a04a1149458e76.exe	107
PID 2008 wrote to memory of 2036	2008	9caccaf937b46f4df77dc5a65774a1b4847dc223e476c2aae9a04a1149458e76.exe	108
PID 2008 wrote to memory of 2036	2008	9caccaf937b46f4df77dc5a65774a1b4847dc223e476c2aae9a04a1149458e76.exe	108
PID 2008 wrote to memory of 5020	2008	9caccaf937b46f4df77dc5a65774a1b4847dc223e476c2aae9a04a1149458e76.exe	109
PID 2008 wrote to memory of 5020	2008	9caccaf937b46f4df77dc5a65774a1b4847dc223e476c2aae9a04a1149458e76.exe	109
PID 2008 wrote to memory of 736	2008	9caccaf937b46f4df77dc5a65774a1b4847dc223e476c2aae9a04a1149458e76.exe	110
PID 2008 wrote to memory of 736	2008	9caccaf937b46f4df77dc5a65774a1b4847dc223e476c2aae9a04a1149458e76.exe	110
PID 2008 wrote to memory of 664	2008	9caccaf937b46f4df77dc5a65774a1b4847dc223e476c2aae9a04a1149458e76.exe	111
PID 2008 wrote to memory of 664	2008	9caccaf937b46f4df77dc5a65774a1b4847dc223e476c2aae9a04a1149458e76.exe	111
PID 2008 wrote to memory of 4164	2008	9caccaf937b46f4df77dc5a65774a1b4847dc223e476c2aae9a04a1149458e76.exe	112
PID 2008 wrote to memory of 4164	2008	9caccaf937b46f4df77dc5a65774a1b4847dc223e476c2aae9a04a1149458e76.exe	112
PID 2008 wrote to memory of 2092	2008	9caccaf937b46f4df77dc5a65774a1b4847dc223e476c2aae9a04a1149458e76.exe	113
PID 2008 wrote to memory of 2092	2008	9caccaf937b46f4df77dc5a65774a1b4847dc223e476c2aae9a04a1149458e76.exe	113
PID 2008 wrote to memory of 2064	2008	9caccaf937b46f4df77dc5a65774a1b4847dc223e476c2aae9a04a1149458e76.exe	114
PID 2008 wrote to memory of 2064	2008	9caccaf937b46f4df77dc5a65774a1b4847dc223e476c2aae9a04a1149458e76.exe	114
PID 2008 wrote to memory of 3328	2008	9caccaf937b46f4df77dc5a65774a1b4847dc223e476c2aae9a04a1149458e76.exe	115
PID 2008 wrote to memory of 3328	2008	9caccaf937b46f4df77dc5a65774a1b4847dc223e476c2aae9a04a1149458e76.exe	115

C:\Users\Admin\AppData\Local\Temp\9caccaf937b46f4df77dc5a65774a1b4847dc223e476c2aae9a04a1149458e76.exe
"C:\Users\Admin\AppData\Local\Temp\9caccaf937b46f4df77dc5a65774a1b4847dc223e476c2aae9a04a1149458e76.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2008
- C:\Windows\System\CjVpxHt.exe
  C:\Windows\System\CjVpxHt.exe
  2⤵
  - Executes dropped EXE
  PID:4560
- C:\Windows\System\RQyQXQG.exe
  C:\Windows\System\RQyQXQG.exe
  2⤵
  - Executes dropped EXE
  PID:4084
- C:\Windows\System\GCvLGTr.exe
  C:\Windows\System\GCvLGTr.exe
  2⤵
  - Executes dropped EXE
  PID:1068
- C:\Windows\System\hHUvXAC.exe
  C:\Windows\System\hHUvXAC.exe
  2⤵
  - Executes dropped EXE
  PID:4844
- C:\Windows\System\ZUuErsl.exe
  C:\Windows\System\ZUuErsl.exe
  2⤵
  - Executes dropped EXE
  PID:228
- C:\Windows\System\hLPXMMm.exe
  C:\Windows\System\hLPXMMm.exe
  2⤵
  - Executes dropped EXE
  PID:3808
- C:\Windows\System\CsCHgBM.exe
  C:\Windows\System\CsCHgBM.exe
  2⤵
  - Executes dropped EXE
  PID:380
- C:\Windows\System\ZGOOEIi.exe
  C:\Windows\System\ZGOOEIi.exe
  2⤵
  - Executes dropped EXE
  PID:4864
- C:\Windows\System\BctfBHd.exe
  C:\Windows\System\BctfBHd.exe
  2⤵
  - Executes dropped EXE
  PID:3316
- C:\Windows\System\zSVqJlS.exe
  C:\Windows\System\zSVqJlS.exe
  2⤵
  - Executes dropped EXE
  PID:460
- C:\Windows\System\rfMRzOa.exe
  C:\Windows\System\rfMRzOa.exe
  2⤵
  - Executes dropped EXE
  PID:2440
- C:\Windows\System\XUrPghy.exe
  C:\Windows\System\XUrPghy.exe
  2⤵
  - Executes dropped EXE
  PID:2724
- C:\Windows\System\UtfhRBK.exe
  C:\Windows\System\UtfhRBK.exe
  2⤵
  - Executes dropped EXE
  PID:620
- C:\Windows\System\hcXAgyT.exe
  C:\Windows\System\hcXAgyT.exe
  2⤵
  - Executes dropped EXE
  PID:3868
- C:\Windows\System\KdOshwX.exe
  C:\Windows\System\KdOshwX.exe
  2⤵
  - Executes dropped EXE
  PID:3212
- C:\Windows\System\GePiiBQ.exe
  C:\Windows\System\GePiiBQ.exe
  2⤵
  - Executes dropped EXE
  PID:1080
- C:\Windows\System\eLcHQIQ.exe
  C:\Windows\System\eLcHQIQ.exe
  2⤵
  - Executes dropped EXE
  PID:2924
- C:\Windows\System\XbrFfmD.exe
  C:\Windows\System\XbrFfmD.exe
  2⤵
  - Executes dropped EXE
  PID:1212
- C:\Windows\System\vhwrZaV.exe
  C:\Windows\System\vhwrZaV.exe
  2⤵
  - Executes dropped EXE
  PID:1848
- C:\Windows\System\tJbkudQ.exe
  C:\Windows\System\tJbkudQ.exe
  2⤵
  - Executes dropped EXE
  PID:3300
- C:\Windows\System\vXjTEoB.exe
  C:\Windows\System\vXjTEoB.exe
  2⤵
  - Executes dropped EXE
  PID:3456
- C:\Windows\System\PYrfECq.exe
  C:\Windows\System\PYrfECq.exe
  2⤵
  - Executes dropped EXE
  PID:2936
- C:\Windows\System\xrkZasH.exe
  C:\Windows\System\xrkZasH.exe
  2⤵
  - Executes dropped EXE
  PID:5000
- C:\Windows\System\aeHHoxB.exe
  C:\Windows\System\aeHHoxB.exe
  2⤵
  - Executes dropped EXE
  PID:4760
- C:\Windows\System\kldwUsD.exe
  C:\Windows\System\kldwUsD.exe
  2⤵
  - Executes dropped EXE
  PID:2036
- C:\Windows\System\PqNVlam.exe
  C:\Windows\System\PqNVlam.exe
  2⤵
  - Executes dropped EXE
  PID:5020
- C:\Windows\System\kxeYOyg.exe
  C:\Windows\System\kxeYOyg.exe
  2⤵
  - Executes dropped EXE
  PID:736
- C:\Windows\System\VlmCYhK.exe
  C:\Windows\System\VlmCYhK.exe
  2⤵
  - Executes dropped EXE
  PID:664
- C:\Windows\System\KqytKxW.exe
  C:\Windows\System\KqytKxW.exe
  2⤵
  - Executes dropped EXE
  PID:4164
- C:\Windows\System\ktlDDTn.exe
  C:\Windows\System\ktlDDTn.exe
  2⤵
  - Executes dropped EXE
  PID:2092
- C:\Windows\System\jdyTAMK.exe
  C:\Windows\System\jdyTAMK.exe
  2⤵
  - Executes dropped EXE
  PID:2064
- C:\Windows\System\PVxpxYz.exe
  C:\Windows\System\PVxpxYz.exe
  2⤵
  - Executes dropped EXE
  PID:3328
- C:\Windows\System\KfPlOpG.exe
  C:\Windows\System\KfPlOpG.exe
  2⤵
  - Executes dropped EXE
  PID:2904
- C:\Windows\System\SnDntZt.exe
  C:\Windows\System\SnDntZt.exe
  2⤵
  - Executes dropped EXE
  PID:4884
- C:\Windows\System\RTGDGGP.exe
  C:\Windows\System\RTGDGGP.exe
  2⤵
  - Executes dropped EXE
  PID:4840
- C:\Windows\System\PqYhyRt.exe
  C:\Windows\System\PqYhyRt.exe
  2⤵
  - Executes dropped EXE
  PID:4316
- C:\Windows\System\hyUGhqm.exe
  C:\Windows\System\hyUGhqm.exe
  2⤵
  - Executes dropped EXE
  PID:4040
- C:\Windows\System\CxujdMB.exe
  C:\Windows\System\CxujdMB.exe
  2⤵
  - Executes dropped EXE
  PID:396
- C:\Windows\System\ZQftmOe.exe
  C:\Windows\System\ZQftmOe.exe
  2⤵
  - Executes dropped EXE
  PID:4272
- C:\Windows\System\GutZUgT.exe
  C:\Windows\System\GutZUgT.exe
  2⤵
  - Executes dropped EXE
  PID:532
- C:\Windows\System\vDjEAGA.exe
  C:\Windows\System\vDjEAGA.exe
  2⤵
  - Executes dropped EXE
  PID:448
- C:\Windows\System\uqYIILj.exe
  C:\Windows\System\uqYIILj.exe
  2⤵
  - Executes dropped EXE
  PID:4828
- C:\Windows\System\PgyHHOc.exe
  C:\Windows\System\PgyHHOc.exe
  2⤵
  - Executes dropped EXE
  PID:4348
- C:\Windows\System\dyzcZTr.exe
  C:\Windows\System\dyzcZTr.exe
  2⤵
  - Executes dropped EXE
  PID:4240
- C:\Windows\System\nIStJhP.exe
  C:\Windows\System\nIStJhP.exe
  2⤵
  - Executes dropped EXE
  PID:1512
- C:\Windows\System\XGmqUAL.exe
  C:\Windows\System\XGmqUAL.exe
  2⤵
  - Executes dropped EXE
  PID:2868
- C:\Windows\System\aONVjVI.exe
  C:\Windows\System\aONVjVI.exe
  2⤵
  - Executes dropped EXE
  PID:3280
- C:\Windows\System\tEouuEk.exe
  C:\Windows\System\tEouuEk.exe
  2⤵
  - Executes dropped EXE
  PID:4344
- C:\Windows\System\kumfAlY.exe
  C:\Windows\System\kumfAlY.exe
  2⤵
  - Executes dropped EXE
  PID:4772
- C:\Windows\System\fFbCKeZ.exe
  C:\Windows\System\fFbCKeZ.exe
  2⤵
  - Executes dropped EXE
  PID:1732
- C:\Windows\System\DyLjrxs.exe
  C:\Windows\System\DyLjrxs.exe
  2⤵
  - Executes dropped EXE
  PID:3732
- C:\Windows\System\lzXcSCc.exe
  C:\Windows\System\lzXcSCc.exe
  2⤵
  - Executes dropped EXE
  PID:5112
- C:\Windows\System\ZtvKWbL.exe
  C:\Windows\System\ZtvKWbL.exe
  2⤵
  - Executes dropped EXE
  PID:1748
- C:\Windows\System\OdPjpRM.exe
  C:\Windows\System\OdPjpRM.exe
  2⤵
  - Executes dropped EXE
  PID:1916
- C:\Windows\System\HoairXp.exe
  C:\Windows\System\HoairXp.exe
  2⤵
  - Executes dropped EXE
  PID:1620
- C:\Windows\System\mCAjUxF.exe
  C:\Windows\System\mCAjUxF.exe
  2⤵
  - Executes dropped EXE
  PID:4948
- C:\Windows\System\nANCkHb.exe
  C:\Windows\System\nANCkHb.exe
  2⤵
  - Executes dropped EXE
  PID:2004
- C:\Windows\System\AxGDrcv.exe
  C:\Windows\System\AxGDrcv.exe
  2⤵
  - Executes dropped EXE
  PID:1436
- C:\Windows\System\mGtYhSG.exe
  C:\Windows\System\mGtYhSG.exe
  2⤵
  - Executes dropped EXE
  PID:4508
- C:\Windows\System\vdgDavt.exe
  C:\Windows\System\vdgDavt.exe
  2⤵
  - Executes dropped EXE
  PID:4676
- C:\Windows\System\VoQBqsp.exe
  C:\Windows\System\VoQBqsp.exe
  2⤵
  - Executes dropped EXE
  PID:2132
- C:\Windows\System\hApvimH.exe
  C:\Windows\System\hApvimH.exe
  2⤵
  - Executes dropped EXE
  PID:2760
- C:\Windows\System\kxgUpHq.exe
  C:\Windows\System\kxgUpHq.exe
  2⤵
  - Executes dropped EXE
  PID:2276
- C:\Windows\System\QEZhVvF.exe
  C:\Windows\System\QEZhVvF.exe
  2⤵
  - Executes dropped EXE
  PID:3696
- C:\Windows\System\yimoavq.exe
  C:\Windows\System\yimoavq.exe
  2⤵
  PID:3164
- C:\Windows\System\uMLtBVG.exe
  C:\Windows\System\uMLtBVG.exe
  2⤵
  PID:2432
- C:\Windows\System\MTtGjFM.exe
  C:\Windows\System\MTtGjFM.exe
  2⤵
  PID:1900
- C:\Windows\System\FPENESY.exe
  C:\Windows\System\FPENESY.exe
  2⤵
  PID:4500
- C:\Windows\System\DmYGkHz.exe
  C:\Windows\System\DmYGkHz.exe
  2⤵
  PID:3556
- C:\Windows\System\clXwWej.exe
  C:\Windows\System\clXwWej.exe
  2⤵
  PID:2356
- C:\Windows\System\gSbYSOG.exe
  C:\Windows\System\gSbYSOG.exe
  2⤵
  PID:2524
- C:\Windows\System\nMoDPHR.exe
  C:\Windows\System\nMoDPHR.exe
  2⤵
  PID:5128
- C:\Windows\System\HuPogFy.exe
  C:\Windows\System\HuPogFy.exe
  2⤵
  PID:5156
- C:\Windows\System\ltzOmNK.exe
  C:\Windows\System\ltzOmNK.exe
  2⤵
  PID:5184
- C:\Windows\System\aEROjJK.exe
  C:\Windows\System\aEROjJK.exe
  2⤵
  PID:5208
- C:\Windows\System\iELVbOv.exe
  C:\Windows\System\iELVbOv.exe
  2⤵
  PID:5240
- C:\Windows\System\muDEjwC.exe
  C:\Windows\System\muDEjwC.exe
  2⤵
  PID:5272
- C:\Windows\System\jMXmjOP.exe
  C:\Windows\System\jMXmjOP.exe
  2⤵
  PID:5300
- C:\Windows\System\oQCROuG.exe
  C:\Windows\System\oQCROuG.exe
  2⤵
  PID:5324
- C:\Windows\System\bquqcvf.exe
  C:\Windows\System\bquqcvf.exe
  2⤵
  PID:5352
- C:\Windows\System\JabIpgJ.exe
  C:\Windows\System\JabIpgJ.exe
  2⤵
  PID:5380
- C:\Windows\System\DnpUIbS.exe
  C:\Windows\System\DnpUIbS.exe
  2⤵
  PID:5408
- C:\Windows\System\nAXWjfP.exe
  C:\Windows\System\nAXWjfP.exe
  2⤵
  PID:5432
- C:\Windows\System\MiyDWpB.exe
  C:\Windows\System\MiyDWpB.exe
  2⤵
  PID:5464
- C:\Windows\System\HUUECTo.exe
  C:\Windows\System\HUUECTo.exe
  2⤵
  PID:5496
- C:\Windows\System\DiZWrME.exe
  C:\Windows\System\DiZWrME.exe
  2⤵
  PID:5520
- C:\Windows\System\HxZpZCX.exe
  C:\Windows\System\HxZpZCX.exe
  2⤵
  PID:5548
- C:\Windows\System\cclOhcP.exe
  C:\Windows\System\cclOhcP.exe
  2⤵
  PID:5580
- C:\Windows\System\IcdtPEV.exe
  C:\Windows\System\IcdtPEV.exe
  2⤵
  PID:5604
- C:\Windows\System\uOwOagJ.exe
  C:\Windows\System\uOwOagJ.exe
  2⤵
  PID:5632
- C:\Windows\System\MXwYOnP.exe
  C:\Windows\System\MXwYOnP.exe
  2⤵
  PID:5660
- C:\Windows\System\aZZHvcl.exe
  C:\Windows\System\aZZHvcl.exe
  2⤵
  PID:5688
- C:\Windows\System\wLScbFg.exe
  C:\Windows\System\wLScbFg.exe
  2⤵
  PID:5716
- C:\Windows\System\NpgAbTF.exe
  C:\Windows\System\NpgAbTF.exe
  2⤵
  PID:5744
- C:\Windows\System\STwftVm.exe
  C:\Windows\System\STwftVm.exe
  2⤵
  PID:5776
- C:\Windows\System\EgvzZtM.exe
  C:\Windows\System\EgvzZtM.exe
  2⤵
  PID:5800
- C:\Windows\System\IsGrgXt.exe
  C:\Windows\System\IsGrgXt.exe
  2⤵
  PID:5828
- C:\Windows\System\MFvAnJN.exe
  C:\Windows\System\MFvAnJN.exe
  2⤵
  PID:5856
- C:\Windows\System\JimOKLz.exe
  C:\Windows\System\JimOKLz.exe
  2⤵
  PID:5888
- C:\Windows\System\DiFORJq.exe
  C:\Windows\System\DiFORJq.exe
  2⤵
  PID:5916
- C:\Windows\System\CYWbTDh.exe
  C:\Windows\System\CYWbTDh.exe
  2⤵
  PID:5940
- C:\Windows\System\ecMOCIR.exe
  C:\Windows\System\ecMOCIR.exe
  2⤵
  PID:5968
- C:\Windows\System\XpQPgzM.exe
  C:\Windows\System\XpQPgzM.exe
  2⤵
  PID:5992
- C:\Windows\System\CupNNiK.exe
  C:\Windows\System\CupNNiK.exe
  2⤵
  PID:6028
- C:\Windows\System\wopqXMp.exe
  C:\Windows\System\wopqXMp.exe
  2⤵
  PID:6052
- C:\Windows\System\UVazjPT.exe
  C:\Windows\System\UVazjPT.exe
  2⤵
  PID:6080
- C:\Windows\System\WlniQqN.exe
  C:\Windows\System\WlniQqN.exe
  2⤵
  PID:6108
- C:\Windows\System\bMavHIC.exe
  C:\Windows\System\bMavHIC.exe
  2⤵
  PID:6136
- C:\Windows\System\vfMNznS.exe
  C:\Windows\System\vfMNznS.exe
  2⤵
  PID:2676
- C:\Windows\System\oZicDkA.exe
  C:\Windows\System\oZicDkA.exe
  2⤵
  PID:1700
- C:\Windows\System\IubZzQa.exe
  C:\Windows\System\IubZzQa.exe
  2⤵
  PID:376
- C:\Windows\System\egYJWSR.exe
  C:\Windows\System\egYJWSR.exe
  2⤵
  PID:3992
- C:\Windows\System\IyvwDjz.exe
  C:\Windows\System\IyvwDjz.exe
  2⤵
  PID:2028
- C:\Windows\System\BHUSyKr.exe
  C:\Windows\System\BHUSyKr.exe
  2⤵
  PID:4616
- C:\Windows\System\BLVqHVZ.exe
  C:\Windows\System\BLVqHVZ.exe
  2⤵
  PID:5148
- C:\Windows\System\hNgWbsz.exe
  C:\Windows\System\hNgWbsz.exe
  2⤵
  PID:5224
- C:\Windows\System\ebFdVbY.exe
  C:\Windows\System\ebFdVbY.exe
  2⤵
  PID:5288
- C:\Windows\System\nLXVWhl.exe
  C:\Windows\System\nLXVWhl.exe
  2⤵
  PID:5340
- C:\Windows\System\zamwCAp.exe
  C:\Windows\System\zamwCAp.exe
  2⤵
  PID:5420
- C:\Windows\System\qlxLkPr.exe
  C:\Windows\System\qlxLkPr.exe
  2⤵
  PID:5480
- C:\Windows\System\yppMMqu.exe
  C:\Windows\System\yppMMqu.exe
  2⤵
  PID:5540
- C:\Windows\System\fdtSKGs.exe
  C:\Windows\System\fdtSKGs.exe
  2⤵
  PID:5616
- C:\Windows\System\HMUnhHz.exe
  C:\Windows\System\HMUnhHz.exe
  2⤵
  PID:5676
- C:\Windows\System\IsLCtdp.exe
  C:\Windows\System\IsLCtdp.exe
  2⤵
  PID:5736
- C:\Windows\System\lzuLSPG.exe
  C:\Windows\System\lzuLSPG.exe
  2⤵
  PID:5796
- C:\Windows\System\ULbqmzN.exe
  C:\Windows\System\ULbqmzN.exe
  2⤵
  PID:5868
- C:\Windows\System\wkgDJml.exe
  C:\Windows\System\wkgDJml.exe
  2⤵
  PID:5932
- C:\Windows\System\JvAWeps.exe
  C:\Windows\System\JvAWeps.exe
  2⤵
  PID:5988
- C:\Windows\System\ScnpHWQ.exe
  C:\Windows\System\ScnpHWQ.exe
  2⤵
  PID:6048
- C:\Windows\System\GAiFyAS.exe
  C:\Windows\System\GAiFyAS.exe
  2⤵
  PID:6096
- C:\Windows\System\eofBLRs.exe
  C:\Windows\System\eofBLRs.exe
  2⤵
  PID:1092
- C:\Windows\System\mknuujT.exe
  C:\Windows\System\mknuujT.exe
  2⤵
  PID:3804
- C:\Windows\System\sQeVDoz.exe
  C:\Windows\System\sQeVDoz.exe
  2⤵
  PID:668
- C:\Windows\System\ApvHZcu.exe
  C:\Windows\System\ApvHZcu.exe
  2⤵
  PID:5196
- C:\Windows\System\ZCNzsqJ.exe
  C:\Windows\System\ZCNzsqJ.exe
  2⤵
  PID:5568
- C:\Windows\System\ytbcDXj.exe
  C:\Windows\System\ytbcDXj.exe
  2⤵
  PID:5644
- C:\Windows\System\emYLzvE.exe
  C:\Windows\System\emYLzvE.exe
  2⤵
  PID:5708
- C:\Windows\System\LkWbqGQ.exe
  C:\Windows\System\LkWbqGQ.exe
  2⤵
  PID:4876
- C:\Windows\System\NhDXBRd.exe
  C:\Windows\System\NhDXBRd.exe
  2⤵
  PID:6152
- C:\Windows\System\LOGJZgi.exe
  C:\Windows\System\LOGJZgi.exe
  2⤵
  PID:6180
- C:\Windows\System\bDQEYJo.exe
  C:\Windows\System\bDQEYJo.exe
  2⤵
  PID:6204
- C:\Windows\System\ThyWntE.exe
  C:\Windows\System\ThyWntE.exe
  2⤵
  PID:6228
- C:\Windows\System\zkadEvA.exe
  C:\Windows\System\zkadEvA.exe
  2⤵
  PID:6256
- C:\Windows\System\JtGTNSu.exe
  C:\Windows\System\JtGTNSu.exe
  2⤵
  PID:6288
- C:\Windows\System\pbqcOnT.exe
  C:\Windows\System\pbqcOnT.exe
  2⤵
  PID:6312
- C:\Windows\System\cowUYus.exe
  C:\Windows\System\cowUYus.exe
  2⤵
  PID:6340
- C:\Windows\System\fywDfRc.exe
  C:\Windows\System\fywDfRc.exe
  2⤵
  PID:6368
- C:\Windows\System\dpdkVAj.exe
  C:\Windows\System\dpdkVAj.exe
  2⤵
  PID:6396
- C:\Windows\System\otytrQG.exe
  C:\Windows\System\otytrQG.exe
  2⤵
  PID:6424
- C:\Windows\System\lhPkJyL.exe
  C:\Windows\System\lhPkJyL.exe
  2⤵
  PID:6452
- C:\Windows\System\aNhBATH.exe
  C:\Windows\System\aNhBATH.exe
  2⤵
  PID:6480
- C:\Windows\System\PtYqQFU.exe
  C:\Windows\System\PtYqQFU.exe
  2⤵
  PID:6508
- C:\Windows\System\OAdnfXw.exe
  C:\Windows\System\OAdnfXw.exe
  2⤵
  PID:6536
- C:\Windows\System\amkfivw.exe
  C:\Windows\System\amkfivw.exe
  2⤵
  PID:6564
- C:\Windows\System\phMJrxO.exe
  C:\Windows\System\phMJrxO.exe
  2⤵
  PID:6592
- C:\Windows\System\yrXLHat.exe
  C:\Windows\System\yrXLHat.exe
  2⤵
  PID:6628
- C:\Windows\System\KQAfuqp.exe
  C:\Windows\System\KQAfuqp.exe
  2⤵
  PID:6648
- C:\Windows\System\nvmEnYI.exe
  C:\Windows\System\nvmEnYI.exe
  2⤵
  PID:6676
- C:\Windows\System\nrVprqn.exe
  C:\Windows\System\nrVprqn.exe
  2⤵
  PID:6704
- C:\Windows\System\FzTicTB.exe
  C:\Windows\System\FzTicTB.exe
  2⤵
  PID:6732
- C:\Windows\System\wOcosMq.exe
  C:\Windows\System\wOcosMq.exe
  2⤵
  PID:6756
- C:\Windows\System\LDxpTbY.exe
  C:\Windows\System\LDxpTbY.exe
  2⤵
  PID:6788
- C:\Windows\System\dsHlNST.exe
  C:\Windows\System\dsHlNST.exe
  2⤵
  PID:6816
- C:\Windows\System\xxaWlIk.exe
  C:\Windows\System\xxaWlIk.exe
  2⤵
  PID:6844
- C:\Windows\System\AShtYdv.exe
  C:\Windows\System\AShtYdv.exe
  2⤵
  PID:6872
- C:\Windows\System\XVdBzXa.exe
  C:\Windows\System\XVdBzXa.exe
  2⤵
  PID:6900
- C:\Windows\System\TIRICvA.exe
  C:\Windows\System\TIRICvA.exe
  2⤵
  PID:6928
- C:\Windows\System\bheHQNn.exe
  C:\Windows\System\bheHQNn.exe
  2⤵
  PID:6956
- C:\Windows\System\uvVXeKL.exe
  C:\Windows\System\uvVXeKL.exe
  2⤵
  PID:6980
- C:\Windows\System\ubaHkCT.exe
  C:\Windows\System\ubaHkCT.exe
  2⤵
  PID:7012
- C:\Windows\System\qqRdnnV.exe
  C:\Windows\System\qqRdnnV.exe
  2⤵
  PID:7040
- C:\Windows\System\DVZcymF.exe
  C:\Windows\System\DVZcymF.exe
  2⤵
  PID:7068
- C:\Windows\System\LinZuuA.exe
  C:\Windows\System\LinZuuA.exe
  2⤵
  PID:7096
- C:\Windows\System\vNMuanS.exe
  C:\Windows\System\vNMuanS.exe
  2⤵
  PID:7124
- C:\Windows\System\hDIQTnK.exe
  C:\Windows\System\hDIQTnK.exe
  2⤵
  PID:7152
- C:\Windows\System\MPYgEGx.exe
  C:\Windows\System\MPYgEGx.exe
  2⤵
  PID:3292
- C:\Windows\System\dAXHCwc.exe
  C:\Windows\System\dAXHCwc.exe
  2⤵
  PID:6128
- C:\Windows\System\EBhnFMV.exe
  C:\Windows\System\EBhnFMV.exe
  2⤵
  PID:2364
- C:\Windows\System\zzUTWLi.exe
  C:\Windows\System\zzUTWLi.exe
  2⤵
  PID:5396
- C:\Windows\System\jxlicFX.exe
  C:\Windows\System\jxlicFX.exe
  2⤵
  PID:5784
- C:\Windows\System\azPsPRU.exe
  C:\Windows\System\azPsPRU.exe
  2⤵
  PID:6168
- C:\Windows\System\OQheqEO.exe
  C:\Windows\System\OQheqEO.exe
  2⤵
  PID:6224
- C:\Windows\System\qRBkZSy.exe
  C:\Windows\System\qRBkZSy.exe
  2⤵
  PID:6276
- C:\Windows\System\rIPkGTr.exe
  C:\Windows\System\rIPkGTr.exe
  2⤵
  PID:6384
- C:\Windows\System\DERQINZ.exe
  C:\Windows\System\DERQINZ.exe
  2⤵
  PID:6464
- C:\Windows\System\mYWZuKc.exe
  C:\Windows\System\mYWZuKc.exe
  2⤵
  PID:6496
- C:\Windows\System\buoCcSD.exe
  C:\Windows\System\buoCcSD.exe
  2⤵
  PID:6528
- C:\Windows\System\OBsvRPN.exe
  C:\Windows\System\OBsvRPN.exe
  2⤵
  PID:6640
- C:\Windows\System\AuaHRir.exe
  C:\Windows\System\AuaHRir.exe
  2⤵
  PID:6720
- C:\Windows\System\ScwjzLx.exe
  C:\Windows\System\ScwjzLx.exe
  2⤵
  PID:6828
- C:\Windows\System\WUvZwlt.exe
  C:\Windows\System\WUvZwlt.exe
  2⤵
  PID:6860
- C:\Windows\System\yBswuUu.exe
  C:\Windows\System\yBswuUu.exe
  2⤵
  PID:6944
- C:\Windows\System\jfeQUJX.exe
  C:\Windows\System\jfeQUJX.exe
  2⤵
  PID:4976
- C:\Windows\System\XAKXhxw.exe
  C:\Windows\System\XAKXhxw.exe
  2⤵
  PID:6996
- C:\Windows\System\UwTEUjk.exe
  C:\Windows\System\UwTEUjk.exe
  2⤵
  PID:5004
- C:\Windows\System\JTNdTkk.exe
  C:\Windows\System\JTNdTkk.exe
  2⤵
  PID:1612
- C:\Windows\System\uGmhATn.exe
  C:\Windows\System\uGmhATn.exe
  2⤵
  PID:7088
- C:\Windows\System\rPpArpu.exe
  C:\Windows\System\rPpArpu.exe
  2⤵
  PID:3264
- C:\Windows\System\cPZBWey.exe
  C:\Windows\System\cPZBWey.exe
  2⤵
  PID:6044
- C:\Windows\System\ByfeJpU.exe
  C:\Windows\System\ByfeJpU.exe
  2⤵
  PID:4664
- C:\Windows\System\wHoJxRP.exe
  C:\Windows\System\wHoJxRP.exe
  2⤵
  PID:3540
- C:\Windows\System\mLmpAWy.exe
  C:\Windows\System\mLmpAWy.exe
  2⤵
  PID:4672
- C:\Windows\System\chSkZPP.exe
  C:\Windows\System\chSkZPP.exe
  2⤵
  PID:3760
- C:\Windows\System\zBYwgxa.exe
  C:\Windows\System\zBYwgxa.exe
  2⤵
  PID:1268
- C:\Windows\System\xMGVjnF.exe
  C:\Windows\System\xMGVjnF.exe
  2⤵
  PID:1980
- C:\Windows\System\xEwMucv.exe
  C:\Windows\System\xEwMucv.exe
  2⤵
  PID:860
- C:\Windows\System\FGdfakm.exe
  C:\Windows\System\FGdfakm.exe
  2⤵
  PID:1572
- C:\Windows\System\fBHcoKA.exe
  C:\Windows\System\fBHcoKA.exe
  2⤵
  PID:1132
- C:\Windows\System\QpDmsGC.exe
  C:\Windows\System\QpDmsGC.exe
  2⤵
  PID:4116
- C:\Windows\System\gDkFZHx.exe
  C:\Windows\System\gDkFZHx.exe
  2⤵
  PID:2900
- C:\Windows\System\HoaDplQ.exe
  C:\Windows\System\HoaDplQ.exe
  2⤵
  PID:864
- C:\Windows\System\ACLgtnZ.exe
  C:\Windows\System\ACLgtnZ.exe
  2⤵
  PID:3108
- C:\Windows\System\JOsHOic.exe
  C:\Windows\System\JOsHOic.exe
  2⤵
  PID:2596
- C:\Windows\System\RCnwYbv.exe
  C:\Windows\System\RCnwYbv.exe
  2⤵
  PID:1552
- C:\Windows\System\XrQqzsd.exe
  C:\Windows\System\XrQqzsd.exe
  2⤵
  PID:3472
- C:\Windows\System\OGgrVwk.exe
  C:\Windows\System\OGgrVwk.exe
  2⤵
  PID:4924
- C:\Windows\System\fqglDBF.exe
  C:\Windows\System\fqglDBF.exe
  2⤵
  PID:6212
- C:\Windows\System\JRutHER.exe
  C:\Windows\System\JRutHER.exe
  2⤵
  PID:4692
- C:\Windows\System\BGYjTkv.exe
  C:\Windows\System\BGYjTkv.exe
  2⤵
  PID:6440
- C:\Windows\System\AmYFXgu.exe
  C:\Windows\System\AmYFXgu.exe
  2⤵
  PID:6472
- C:\Windows\System\wdGnPdZ.exe
  C:\Windows\System\wdGnPdZ.exe
  2⤵
  PID:6696
- C:\Windows\System\MKrqgAA.exe
  C:\Windows\System\MKrqgAA.exe
  2⤵
  PID:1696
- C:\Windows\System\qkWqtfG.exe
  C:\Windows\System\qkWqtfG.exe
  2⤵
  PID:6912
- C:\Windows\System\GpLmkfY.exe
  C:\Windows\System\GpLmkfY.exe
  2⤵
  PID:3916
- C:\Windows\System\CeRTPlb.exe
  C:\Windows\System\CeRTPlb.exe
  2⤵
  PID:7112
- C:\Windows\System\JtLTlmq.exe
  C:\Windows\System\JtLTlmq.exe
  2⤵
  PID:3880
- C:\Windows\System\NqKNFbO.exe
  C:\Windows\System\NqKNFbO.exe
  2⤵
  PID:5140
- C:\Windows\System\yRNpgnH.exe
  C:\Windows\System\yRNpgnH.exe
  2⤵
  PID:1048
- C:\Windows\System\OrhXOwM.exe
  C:\Windows\System\OrhXOwM.exe
  2⤵
  PID:4232
- C:\Windows\System\rPeVniM.exe
  C:\Windows\System\rPeVniM.exe
  2⤵
  PID:4780
- C:\Windows\System\hMUXJfR.exe
  C:\Windows\System\hMUXJfR.exe
  2⤵
  PID:1516
- C:\Windows\System\IkVpGac.exe
  C:\Windows\System\IkVpGac.exe
  2⤵
  PID:628
- C:\Windows\System\HrxipYX.exe
  C:\Windows\System\HrxipYX.exe
  2⤵
  PID:4000
- C:\Windows\System\xOOvTyj.exe
  C:\Windows\System\xOOvTyj.exe
  2⤵
  PID:6356
- C:\Windows\System\tihocGR.exe
  C:\Windows\System\tihocGR.exe
  2⤵
  PID:3288
- C:\Windows\System\SPTpdbN.exe
  C:\Windows\System\SPTpdbN.exe
  2⤵
  PID:7120
- C:\Windows\System\bBcKAPN.exe
  C:\Windows\System\bBcKAPN.exe
  2⤵
  PID:5596
- C:\Windows\System\JneiKtZ.exe
  C:\Windows\System\JneiKtZ.exe
  2⤵
  PID:1632
- C:\Windows\System\beQevyL.exe
  C:\Windows\System\beQevyL.exe
  2⤵
  PID:1576
- C:\Windows\System\yWucUTx.exe
  C:\Windows\System\yWucUTx.exe
  2⤵
  PID:6612
- C:\Windows\System\hLGpSJO.exe
  C:\Windows\System\hLGpSJO.exe
  2⤵
  PID:6836
- C:\Windows\System\ODUTVDG.exe
  C:\Windows\System\ODUTVDG.exe
  2⤵
  PID:772
- C:\Windows\System\tHFkEVJ.exe
  C:\Windows\System\tHFkEVJ.exe
  2⤵
  PID:7004
- C:\Windows\System\TaEiuOB.exe
  C:\Windows\System\TaEiuOB.exe
  2⤵
  PID:7180
- C:\Windows\System\HwuVXYz.exe
  C:\Windows\System\HwuVXYz.exe
  2⤵
  PID:7208
- C:\Windows\System\Phbhvrp.exe
  C:\Windows\System\Phbhvrp.exe
  2⤵
  PID:7236
- C:\Windows\System\fpcDRaI.exe
  C:\Windows\System\fpcDRaI.exe
  2⤵
  PID:7276
- C:\Windows\System\QDRJukG.exe
  C:\Windows\System\QDRJukG.exe
  2⤵
  PID:7308
- C:\Windows\System\CBfbwUW.exe
  C:\Windows\System\CBfbwUW.exe
  2⤵
  PID:7336
- C:\Windows\System\icESRgH.exe
  C:\Windows\System\icESRgH.exe
  2⤵
  PID:7356
- C:\Windows\System\LTkKpfi.exe
  C:\Windows\System\LTkKpfi.exe
  2⤵
  PID:7380
- C:\Windows\System\IbdbltX.exe
  C:\Windows\System\IbdbltX.exe
  2⤵
  PID:7420
- C:\Windows\System\wNvfZUX.exe
  C:\Windows\System\wNvfZUX.exe
  2⤵
  PID:7436
- C:\Windows\System\WqxWnKt.exe
  C:\Windows\System\WqxWnKt.exe
  2⤵
  PID:7452
- C:\Windows\System\yWdFsvu.exe
  C:\Windows\System\yWdFsvu.exe
  2⤵
  PID:7484
- C:\Windows\System\vHNyDhv.exe
  C:\Windows\System\vHNyDhv.exe
  2⤵
  PID:7512
- C:\Windows\System\SLhzFAr.exe
  C:\Windows\System\SLhzFAr.exe
  2⤵
  PID:7532
- C:\Windows\System\rwrVnGu.exe
  C:\Windows\System\rwrVnGu.exe
  2⤵
  PID:7560
- C:\Windows\System\qQwRkiy.exe
  C:\Windows\System\qQwRkiy.exe
  2⤵
  PID:7580
- C:\Windows\System\rAGblZm.exe
  C:\Windows\System\rAGblZm.exe
  2⤵
  PID:7620
- C:\Windows\System\rPjtgAK.exe
  C:\Windows\System\rPjtgAK.exe
  2⤵
  PID:7648
- C:\Windows\System\QCDkyem.exe
  C:\Windows\System\QCDkyem.exe
  2⤵
  PID:7668
- C:\Windows\System\hOYGFaH.exe
  C:\Windows\System\hOYGFaH.exe
  2⤵
  PID:7704
- C:\Windows\System\kLMMyFE.exe
  C:\Windows\System\kLMMyFE.exe
  2⤵
  PID:7748
- C:\Windows\System\wOgqIrT.exe
  C:\Windows\System\wOgqIrT.exe
  2⤵
  PID:7792
- C:\Windows\System\cdXwBju.exe
  C:\Windows\System\cdXwBju.exe
  2⤵
  PID:7820
- C:\Windows\System\kdOuUTY.exe
  C:\Windows\System\kdOuUTY.exe
  2⤵
  PID:7848
- C:\Windows\System\UyVOvOv.exe
  C:\Windows\System\UyVOvOv.exe
  2⤵
  PID:7876
- C:\Windows\System\rFZCzPS.exe
  C:\Windows\System\rFZCzPS.exe
  2⤵
  PID:7904
- C:\Windows\System\tlSWevv.exe
  C:\Windows\System\tlSWevv.exe
  2⤵
  PID:7920
- C:\Windows\System\wefwEYR.exe
  C:\Windows\System\wefwEYR.exe
  2⤵
  PID:7960
- C:\Windows\System\KouPFwk.exe
  C:\Windows\System\KouPFwk.exe
  2⤵
  PID:7988
- C:\Windows\System\xpHTRJb.exe
  C:\Windows\System\xpHTRJb.exe
  2⤵
  PID:8016
- C:\Windows\System\VPNKdJm.exe
  C:\Windows\System\VPNKdJm.exe
  2⤵
  PID:8032
- C:\Windows\System\UmlJqLH.exe
  C:\Windows\System\UmlJqLH.exe
  2⤵
  PID:8072
- C:\Windows\System\JMEPsxV.exe
  C:\Windows\System\JMEPsxV.exe
  2⤵
  PID:8100
- C:\Windows\System\hyEinGo.exe
  C:\Windows\System\hyEinGo.exe
  2⤵
  PID:8116
- C:\Windows\System\LxfnzoQ.exe
  C:\Windows\System\LxfnzoQ.exe
  2⤵
  PID:8148
- C:\Windows\System\DDyHWBo.exe
  C:\Windows\System\DDyHWBo.exe
  2⤵
  PID:8168
- C:\Windows\System\lXmFUQT.exe
  C:\Windows\System\lXmFUQT.exe
  2⤵
  PID:8188
- C:\Windows\System\VJKxbYu.exe
  C:\Windows\System\VJKxbYu.exe
  2⤵
  PID:7232
- C:\Windows\System\goYkPOB.exe
  C:\Windows\System\goYkPOB.exe
  2⤵
  PID:7324
- C:\Windows\System\yfVdVGA.exe
  C:\Windows\System\yfVdVGA.exe
  2⤵
  PID:7368
- C:\Windows\System\wXczLuJ.exe
  C:\Windows\System\wXczLuJ.exe
  2⤵
  PID:7448
- C:\Windows\System\WVtbehA.exe
  C:\Windows\System\WVtbehA.exe
  2⤵
  PID:7504
- C:\Windows\System\DDHTcjl.exe
  C:\Windows\System\DDHTcjl.exe
  2⤵
  PID:7556
- C:\Windows\System\HnOeTPe.exe
  C:\Windows\System\HnOeTPe.exe
  2⤵
  PID:7628
- C:\Windows\System\PbBqHZr.exe
  C:\Windows\System\PbBqHZr.exe
  2⤵
  PID:7676
- C:\Windows\System\qrGJmuy.exe
  C:\Windows\System\qrGJmuy.exe
  2⤵
  PID:7712
- C:\Windows\System\EqzNRzL.exe
  C:\Windows\System\EqzNRzL.exe
  2⤵
  PID:7768
- C:\Windows\System\KgVmEpI.exe
  C:\Windows\System\KgVmEpI.exe
  2⤵
  PID:7832
- C:\Windows\System\JCsyAZn.exe
  C:\Windows\System\JCsyAZn.exe
  2⤵
  PID:7888
- C:\Windows\System\nQqFWeh.exe
  C:\Windows\System\nQqFWeh.exe
  2⤵
  PID:7976
- C:\Windows\System\VzxxQRo.exe
  C:\Windows\System\VzxxQRo.exe
  2⤵
  PID:8028
- C:\Windows\System\JefFLCX.exe
  C:\Windows\System\JefFLCX.exe
  2⤵
  PID:8164
- C:\Windows\System\tnQrKFQ.exe
  C:\Windows\System\tnQrKFQ.exe
  2⤵
  PID:7176
- C:\Windows\System\WhoYwJf.exe
  C:\Windows\System\WhoYwJf.exe
  2⤵
  PID:7348
- C:\Windows\System\rsEwQwh.exe
  C:\Windows\System\rsEwQwh.exe
  2⤵
  PID:7428
- C:\Windows\System\MWyNbbj.exe
  C:\Windows\System\MWyNbbj.exe
  2⤵
  PID:7664
- C:\Windows\System\PynjoDf.exe
  C:\Windows\System\PynjoDf.exe
  2⤵
  PID:7736
- C:\Windows\System\rzGwoqR.exe
  C:\Windows\System\rzGwoqR.exe
  2⤵
  PID:7872
- C:\Windows\System\gijQegh.exe
  C:\Windows\System\gijQegh.exe
  2⤵
  PID:8004
- C:\Windows\System\UuYmnQd.exe
  C:\Windows\System\UuYmnQd.exe
  2⤵
  PID:8180
- C:\Windows\System\dFxIaCf.exe
  C:\Windows\System\dFxIaCf.exe
  2⤵
  PID:7576
- C:\Windows\System\HwkdNyR.exe
  C:\Windows\System\HwkdNyR.exe
  2⤵
  PID:8096
- C:\Windows\System\FQUpkZu.exe
  C:\Windows\System\FQUpkZu.exe
  2⤵
  PID:7916
- C:\Windows\System\nPiCLaQ.exe
  C:\Windows\System\nPiCLaQ.exe
  2⤵
  PID:8144
- C:\Windows\System\lBXfMCv.exe
  C:\Windows\System\lBXfMCv.exe
  2⤵
  PID:8208
- C:\Windows\System\IgneNgl.exe
  C:\Windows\System\IgneNgl.exe
  2⤵
  PID:8236
- C:\Windows\System\GpBkoms.exe
  C:\Windows\System\GpBkoms.exe
  2⤵
  PID:8268
- C:\Windows\System\tslRczT.exe
  C:\Windows\System\tslRczT.exe
  2⤵
  PID:8300
- C:\Windows\System\RmZrcrJ.exe
  C:\Windows\System\RmZrcrJ.exe
  2⤵
  PID:8344
- C:\Windows\System\TflcYaw.exe
  C:\Windows\System\TflcYaw.exe
  2⤵
  PID:8372
- C:\Windows\System\RiKzSXd.exe
  C:\Windows\System\RiKzSXd.exe
  2⤵
  PID:8400
- C:\Windows\System\UwinPVJ.exe
  C:\Windows\System\UwinPVJ.exe
  2⤵
  PID:8428
- C:\Windows\System\LrIhZHi.exe
  C:\Windows\System\LrIhZHi.exe
  2⤵
  PID:8456
- C:\Windows\System\wjhkXPl.exe
  C:\Windows\System\wjhkXPl.exe
  2⤵
  PID:8476
- C:\Windows\System\fWpxMWy.exe
  C:\Windows\System\fWpxMWy.exe
  2⤵
  PID:8512
- C:\Windows\System\kiHIxuM.exe
  C:\Windows\System\kiHIxuM.exe
  2⤵
  PID:8528
- C:\Windows\System\dNboHnD.exe
  C:\Windows\System\dNboHnD.exe
  2⤵
  PID:8568
- C:\Windows\System\fCvsSqE.exe
  C:\Windows\System\fCvsSqE.exe
  2⤵
  PID:8592
- C:\Windows\System\wrWMWGq.exe
  C:\Windows\System\wrWMWGq.exe
  2⤵
  PID:8612
- C:\Windows\System\sHFVODz.exe
  C:\Windows\System\sHFVODz.exe
  2⤵
  PID:8648
- C:\Windows\System\PTnYOZM.exe
  C:\Windows\System\PTnYOZM.exe
  2⤵
  PID:8668
- C:\Windows\System\twUWZSI.exe
  C:\Windows\System\twUWZSI.exe
  2⤵
  PID:8696
- C:\Windows\System\jfYzNfo.exe
  C:\Windows\System\jfYzNfo.exe
  2⤵
  PID:8712
- C:\Windows\System\RLGdnJm.exe
  C:\Windows\System\RLGdnJm.exe
  2⤵
  PID:8740
- C:\Windows\System\vICztqz.exe
  C:\Windows\System\vICztqz.exe
  2⤵
  PID:8792
- C:\Windows\System\ybKxkwk.exe
  C:\Windows\System\ybKxkwk.exe
  2⤵
  PID:8808
- C:\Windows\System\rrZHbhO.exe
  C:\Windows\System\rrZHbhO.exe
  2⤵
  PID:8836
- C:\Windows\System\nxrloxc.exe
  C:\Windows\System\nxrloxc.exe
  2⤵
  PID:8864
- C:\Windows\System\kEWOeyl.exe
  C:\Windows\System\kEWOeyl.exe
  2⤵
  PID:8892
- C:\Windows\System\RNZcOVR.exe
  C:\Windows\System\RNZcOVR.exe
  2⤵
  PID:8920
- C:\Windows\System\QTCpiNk.exe
  C:\Windows\System\QTCpiNk.exe
  2⤵
  PID:8948
- C:\Windows\System\CHQHWYq.exe
  C:\Windows\System\CHQHWYq.exe
  2⤵
  PID:8988
- C:\Windows\System\QXhNFYc.exe
  C:\Windows\System\QXhNFYc.exe
  2⤵
  PID:9016
- C:\Windows\System\krnjKfE.exe
  C:\Windows\System\krnjKfE.exe
  2⤵
  PID:9044
- C:\Windows\System\WGAkXth.exe
  C:\Windows\System\WGAkXth.exe
  2⤵
  PID:9068
- C:\Windows\System\ggRXozx.exe
  C:\Windows\System\ggRXozx.exe
  2⤵
  PID:9088
- C:\Windows\System\ggwAMLa.exe
  C:\Windows\System\ggwAMLa.exe
  2⤵
  PID:9128
- C:\Windows\System\WiGdars.exe
  C:\Windows\System\WiGdars.exe
  2⤵
  PID:9144
- C:\Windows\System\MhxAyUu.exe
  C:\Windows\System\MhxAyUu.exe
  2⤵
  PID:9168
- C:\Windows\System\hsTKCdr.exe
  C:\Windows\System\hsTKCdr.exe
  2⤵
  PID:9212
- C:\Windows\System\sQkPlaZ.exe
  C:\Windows\System\sQkPlaZ.exe
  2⤵
  PID:8232
- C:\Windows\System\xWUQfCQ.exe
  C:\Windows\System\xWUQfCQ.exe
  2⤵
  PID:8256
- C:\Windows\System\kLbTRKl.exe
  C:\Windows\System\kLbTRKl.exe
  2⤵
  PID:8364
- C:\Windows\System\KskgFAA.exe
  C:\Windows\System\KskgFAA.exe
  2⤵
  PID:8440
- C:\Windows\System\rmbmPHY.exe
  C:\Windows\System\rmbmPHY.exe
  2⤵
  PID:8504
- C:\Windows\System\AxikQHO.exe
  C:\Windows\System\AxikQHO.exe
  2⤵
  PID:8552
- C:\Windows\System\QuSHtCz.exe
  C:\Windows\System\QuSHtCz.exe
  2⤵
  PID:8608
- C:\Windows\System\eIkwNvC.exe
  C:\Windows\System\eIkwNvC.exe
  2⤵
  PID:8660
- C:\Windows\System\wdsnIcg.exe
  C:\Windows\System\wdsnIcg.exe
  2⤵
  PID:8756
- C:\Windows\System\JaZZdme.exe
  C:\Windows\System\JaZZdme.exe
  2⤵
  PID:8776
- C:\Windows\System\nXUcsZn.exe
  C:\Windows\System\nXUcsZn.exe
  2⤵
  PID:8820
- C:\Windows\System\upVHpJh.exe
  C:\Windows\System\upVHpJh.exe
  2⤵
  PID:8944
- C:\Windows\System\VlmmUvB.exe
  C:\Windows\System\VlmmUvB.exe
  2⤵
  PID:9004
- C:\Windows\System\NxZpBBQ.exe
  C:\Windows\System\NxZpBBQ.exe
  2⤵
  PID:9080
- C:\Windows\System\dFzjpjc.exe
  C:\Windows\System\dFzjpjc.exe
  2⤵
  PID:9124
- C:\Windows\System\IuZqNie.exe
  C:\Windows\System\IuZqNie.exe
  2⤵
  PID:8200
- C:\Windows\System\OhJenJn.exe
  C:\Windows\System\OhJenJn.exe
  2⤵
  PID:8360
- C:\Windows\System\DgqAveV.exe
  C:\Windows\System\DgqAveV.exe
  2⤵
  PID:8424
- C:\Windows\System\uBKZgPu.exe
  C:\Windows\System\uBKZgPu.exe
  2⤵
  PID:8664
- C:\Windows\System\AePOtpd.exe
  C:\Windows\System\AePOtpd.exe
  2⤵
  PID:8704
- C:\Windows\System\lTkRXQK.exe
  C:\Windows\System\lTkRXQK.exe
  2⤵
  PID:8800
- C:\Windows\System\ztguOHw.exe
  C:\Windows\System\ztguOHw.exe
  2⤵
  PID:8876
- C:\Windows\System\JPjdBaq.exe
  C:\Windows\System\JPjdBaq.exe
  2⤵
  PID:8932
- C:\Windows\System\nQSYXuk.exe
  C:\Windows\System\nQSYXuk.exe
  2⤵
  PID:9104
- C:\Windows\System\rUFNqDl.exe
  C:\Windows\System\rUFNqDl.exe
  2⤵
  PID:8412
- C:\Windows\System\HqposuB.exe
  C:\Windows\System\HqposuB.exe
  2⤵
  PID:8724
- C:\Windows\System\QZhzdTl.exe
  C:\Windows\System\QZhzdTl.exe
  2⤵
  PID:9084
- C:\Windows\System\Sqposka.exe
  C:\Windows\System\Sqposka.exe
  2⤵
  PID:9240
- C:\Windows\System\qeIseKn.exe
  C:\Windows\System\qeIseKn.exe
  2⤵
  PID:9256
- C:\Windows\System\VHEfFHi.exe
  C:\Windows\System\VHEfFHi.exe
  2⤵
  PID:9280
- C:\Windows\System\IWhUVYx.exe
  C:\Windows\System\IWhUVYx.exe
  2⤵
  PID:9300
- C:\Windows\System\uUiFTLE.exe
  C:\Windows\System\uUiFTLE.exe
  2⤵
  PID:9364
- C:\Windows\System\GomJIEi.exe
  C:\Windows\System\GomJIEi.exe
  2⤵
  PID:9396
- C:\Windows\System\nfyEEYf.exe
  C:\Windows\System\nfyEEYf.exe
  2⤵
  PID:9416
- C:\Windows\System\hVeEoMe.exe
  C:\Windows\System\hVeEoMe.exe
  2⤵
  PID:9444
- C:\Windows\System\hMGkQoi.exe
  C:\Windows\System\hMGkQoi.exe
  2⤵
  PID:9468
- C:\Windows\System\IBbuZQm.exe
  C:\Windows\System\IBbuZQm.exe
  2⤵
  PID:9492
- C:\Windows\System\BVYlAcT.exe
  C:\Windows\System\BVYlAcT.exe
  2⤵
  PID:9544
- C:\Windows\System\foYqdJl.exe
  C:\Windows\System\foYqdJl.exe
  2⤵
  PID:9568
- C:\Windows\System\RAfFlfQ.exe
  C:\Windows\System\RAfFlfQ.exe
  2⤵
  PID:9592
- C:\Windows\System\GTDHVQC.exe
  C:\Windows\System\GTDHVQC.exe
  2⤵
  PID:9616
- C:\Windows\System\TJoAAUr.exe
  C:\Windows\System\TJoAAUr.exe
  2⤵
  PID:9640
- C:\Windows\System\ZylzHTa.exe
  C:\Windows\System\ZylzHTa.exe
  2⤵
  PID:9664
- C:\Windows\System\PegDKyE.exe
  C:\Windows\System\PegDKyE.exe
  2⤵
  PID:9692
- C:\Windows\System\ZXiLwlc.exe
  C:\Windows\System\ZXiLwlc.exe
  2⤵
  PID:9720
- C:\Windows\System\TobAdqx.exe
  C:\Windows\System\TobAdqx.exe
  2⤵
  PID:9740
- C:\Windows\System\shkVYvH.exe
  C:\Windows\System\shkVYvH.exe
  2⤵
  PID:9776
- C:\Windows\System\apIXuwR.exe
  C:\Windows\System\apIXuwR.exe
  2⤵
  PID:9816
- C:\Windows\System\GMdyBZe.exe
  C:\Windows\System\GMdyBZe.exe
  2⤵
  PID:9852
- C:\Windows\System\aFwaPlv.exe
  C:\Windows\System\aFwaPlv.exe
  2⤵
  PID:9880
- C:\Windows\System\RsAqrlR.exe
  C:\Windows\System\RsAqrlR.exe
  2⤵
  PID:9904
- C:\Windows\System\zoesusL.exe
  C:\Windows\System\zoesusL.exe
  2⤵
  PID:9936
- C:\Windows\System\KQZJBjF.exe
  C:\Windows\System\KQZJBjF.exe
  2⤵
  PID:9960
- C:\Windows\System\sZjaDYE.exe
  C:\Windows\System\sZjaDYE.exe
  2⤵
  PID:9992
- C:\Windows\System\gDKgZDC.exe
  C:\Windows\System\gDKgZDC.exe
  2⤵
  PID:10020
- C:\Windows\System\SScdBoL.exe
  C:\Windows\System\SScdBoL.exe
  2⤵
  PID:10048
- C:\Windows\System\KBCRyuP.exe
  C:\Windows\System\KBCRyuP.exe
  2⤵
  PID:10076
- C:\Windows\System\ROGtANX.exe
  C:\Windows\System\ROGtANX.exe
  2⤵
  PID:10116
- C:\Windows\System\TskHDrc.exe
  C:\Windows\System\TskHDrc.exe
  2⤵
  PID:10132
- C:\Windows\System\gdqFIIC.exe
  C:\Windows\System\gdqFIIC.exe
  2⤵
  PID:10160
- C:\Windows\System\ypDQoxd.exe
  C:\Windows\System\ypDQoxd.exe
  2⤵
  PID:10176
- C:\Windows\System\rhYknzj.exe
  C:\Windows\System\rhYknzj.exe
  2⤵
  PID:10196
- C:\Windows\System\WvXsRUV.exe
  C:\Windows\System\WvXsRUV.exe
  2⤵
  PID:9204
- C:\Windows\System\tPfXNBY.exe
  C:\Windows\System\tPfXNBY.exe
  2⤵
  PID:9252
- C:\Windows\System\nYwiVlK.exe
  C:\Windows\System\nYwiVlK.exe
  2⤵
  PID:9340
- C:\Windows\System\MNoxjrM.exe
  C:\Windows\System\MNoxjrM.exe
  2⤵
  PID:9384
- C:\Windows\System\klsLJsw.exe
  C:\Windows\System\klsLJsw.exe
  2⤵
  PID:9436
- C:\Windows\System\bwIPfJP.exe
  C:\Windows\System\bwIPfJP.exe
  2⤵
  PID:9524
- C:\Windows\System\jnxBvQB.exe
  C:\Windows\System\jnxBvQB.exe
  2⤵
  PID:9560
- C:\Windows\System\GdzWHPg.exe
  C:\Windows\System\GdzWHPg.exe
  2⤵
  PID:9628
- C:\Windows\System\zSRNOZy.exe
  C:\Windows\System\zSRNOZy.exe
  2⤵
  PID:9704
- C:\Windows\System\MKyYcjg.exe
  C:\Windows\System\MKyYcjg.exe
  2⤵
  PID:9772
- C:\Windows\System\SOEFnZp.exe
  C:\Windows\System\SOEFnZp.exe
  2⤵
  PID:9812
- C:\Windows\System\WPvopaj.exe
  C:\Windows\System\WPvopaj.exe
  2⤵
  PID:9868
- C:\Windows\System\CnqYkFP.exe
  C:\Windows\System\CnqYkFP.exe
  2⤵
  PID:9976
- C:\Windows\System\uGTtYWN.exe
  C:\Windows\System\uGTtYWN.exe
  2⤵
  PID:10032
- C:\Windows\System\IKLRUZL.exe
  C:\Windows\System\IKLRUZL.exe
  2⤵
  PID:10072
- C:\Windows\System\TtsxRVP.exe
  C:\Windows\System\TtsxRVP.exe
  2⤵
  PID:10124
- C:\Windows\System\fEZonpu.exe
  C:\Windows\System\fEZonpu.exe
  2⤵
  PID:10216
- C:\Windows\System\wTWJYoP.exe
  C:\Windows\System\wTWJYoP.exe
  2⤵
  PID:8296
- C:\Windows\System\zrvmDDp.exe
  C:\Windows\System\zrvmDDp.exe
  2⤵
  PID:9336
- C:\Windows\System\aJXLefs.exe
  C:\Windows\System\aJXLefs.exe
  2⤵
  PID:9512
- C:\Windows\System\Jvqnhwv.exe
  C:\Windows\System\Jvqnhwv.exe
  2⤵
  PID:9584
- C:\Windows\System\kxmgAVe.exe
  C:\Windows\System\kxmgAVe.exe
  2⤵
  PID:9808
- C:\Windows\System\WCPVGjy.exe
  C:\Windows\System\WCPVGjy.exe
  2⤵
  PID:10000
- C:\Windows\System\jnYlaBq.exe
  C:\Windows\System\jnYlaBq.exe
  2⤵
  PID:10092
- C:\Windows\System\dKClZgB.exe
  C:\Windows\System\dKClZgB.exe
  2⤵
  PID:10168
- C:\Windows\System\wQUyLvk.exe
  C:\Windows\System\wQUyLvk.exe
  2⤵
  PID:9484
- C:\Windows\System\OyvHAZV.exe
  C:\Windows\System\OyvHAZV.exe
  2⤵
  PID:9768
- C:\Windows\System\FOlSAxu.exe
  C:\Windows\System\FOlSAxu.exe
  2⤵
  PID:9980
- C:\Windows\System\zpzSkMH.exe
  C:\Windows\System\zpzSkMH.exe
  2⤵
  PID:9440
- C:\Windows\System\QJVrwkD.exe
  C:\Windows\System\QJVrwkD.exe
  2⤵
  PID:10260
- C:\Windows\System\YgRLXZQ.exe
  C:\Windows\System\YgRLXZQ.exe
  2⤵
  PID:10324
- C:\Windows\System\WvnZvfX.exe
  C:\Windows\System\WvnZvfX.exe
  2⤵
  PID:10340
- C:\Windows\System\XFwAKmH.exe
  C:\Windows\System\XFwAKmH.exe
  2⤵
  PID:10360
- C:\Windows\System\pZCcHqB.exe
  C:\Windows\System\pZCcHqB.exe
  2⤵
  PID:10408
- C:\Windows\System\fGQAPuv.exe
  C:\Windows\System\fGQAPuv.exe
  2⤵
  PID:10448
- C:\Windows\System\xpGnlJL.exe
  C:\Windows\System\xpGnlJL.exe
  2⤵
  PID:10464
- C:\Windows\System\JTseVmK.exe
  C:\Windows\System\JTseVmK.exe
  2⤵
  PID:10488
- C:\Windows\System\BUGGTWP.exe
  C:\Windows\System\BUGGTWP.exe
  2⤵
  PID:10516
- C:\Windows\System\PsBSBRj.exe
  C:\Windows\System\PsBSBRj.exe
  2⤵
  PID:10532
- C:\Windows\System\hyYjnXs.exe
  C:\Windows\System\hyYjnXs.exe
  2⤵
  PID:10560
- C:\Windows\System\JLGlyfh.exe
  C:\Windows\System\JLGlyfh.exe
  2⤵
  PID:10584
- C:\Windows\System\fzPlFRI.exe
  C:\Windows\System\fzPlFRI.exe
  2⤵
  PID:10628
- C:\Windows\System\jTTvdNd.exe
  C:\Windows\System\jTTvdNd.exe
  2⤵
  PID:10660
- C:\Windows\System\JToeZOS.exe
  C:\Windows\System\JToeZOS.exe
  2⤵
  PID:10684
- C:\Windows\System\WUCvjWh.exe
  C:\Windows\System\WUCvjWh.exe
  2⤵
  PID:10704
- C:\Windows\System\BtFFciQ.exe
  C:\Windows\System\BtFFciQ.exe
  2⤵
  PID:10740
- C:\Windows\System\tMxNeMx.exe
  C:\Windows\System\tMxNeMx.exe
  2⤵
  PID:10760
- C:\Windows\System\ldvyOrF.exe
  C:\Windows\System\ldvyOrF.exe
  2⤵
  PID:10800
- C:\Windows\System\zVPlMeY.exe
  C:\Windows\System\zVPlMeY.exe
  2⤵
  PID:10828
- C:\Windows\System\aVcwgCC.exe
  C:\Windows\System\aVcwgCC.exe
  2⤵
  PID:10852
- C:\Windows\System\hDiPoin.exe
  C:\Windows\System\hDiPoin.exe
  2⤵
  PID:10884
- C:\Windows\System\gJcHuZm.exe
  C:\Windows\System\gJcHuZm.exe
  2⤵
  PID:10908
- C:\Windows\System\AdtDOTH.exe
  C:\Windows\System\AdtDOTH.exe
  2⤵
  PID:10936
- C:\Windows\System\vzFkXJd.exe
  C:\Windows\System\vzFkXJd.exe
  2⤵
  PID:10980
- C:\Windows\System\GewGJSl.exe
  C:\Windows\System\GewGJSl.exe
  2⤵
  PID:10996
- C:\Windows\System\SspNvBy.exe
  C:\Windows\System\SspNvBy.exe
  2⤵
  PID:11012
- C:\Windows\System\XZtdVYR.exe
  C:\Windows\System\XZtdVYR.exe
  2⤵
  PID:11036
- C:\Windows\System\IOvijPS.exe
  C:\Windows\System\IOvijPS.exe
  2⤵
  PID:11076
- C:\Windows\System\xfoFdlC.exe
  C:\Windows\System\xfoFdlC.exe
  2⤵
  PID:11104
- C:\Windows\System\cDwOZPf.exe
  C:\Windows\System\cDwOZPf.exe
  2⤵
  PID:11124
- C:\Windows\System\knYCFCS.exe
  C:\Windows\System\knYCFCS.exe
  2⤵
  PID:11156
- C:\Windows\System\RRlNveH.exe
  C:\Windows\System\RRlNveH.exe
  2⤵
  PID:11184
- C:\Windows\System\VgROATQ.exe
  C:\Windows\System\VgROATQ.exe
  2⤵
  PID:11212
- C:\Windows\System\YUXBmgp.exe
  C:\Windows\System\YUXBmgp.exe
  2⤵
  PID:11228
- C:\Windows\System\XnsjFIW.exe
  C:\Windows\System\XnsjFIW.exe
  2⤵
  PID:9716
- C:\Windows\System\rzbQlYi.exe
  C:\Windows\System\rzbQlYi.exe
  2⤵
  PID:10292
- C:\Windows\System\SzAxmiG.exe
  C:\Windows\System\SzAxmiG.exe
  2⤵
  PID:10332
- C:\Windows\System\RtkZcpJ.exe
  C:\Windows\System\RtkZcpJ.exe
  2⤵
  PID:10396
- C:\Windows\System\MPGTjXG.exe
  C:\Windows\System\MPGTjXG.exe
  2⤵
  PID:10508
- C:\Windows\System\QIsErPx.exe
  C:\Windows\System\QIsErPx.exe
  2⤵
  PID:10552
- C:\Windows\System\NtTSvtW.exe
  C:\Windows\System\NtTSvtW.exe
  2⤵
  PID:10568
- C:\Windows\System\ZoyEZwx.exe
  C:\Windows\System\ZoyEZwx.exe
  2⤵
  PID:10652
- C:\Windows\System\oUSqbvy.exe
  C:\Windows\System\oUSqbvy.exe
  2⤵
  PID:10752
- C:\Windows\System\zCXYeWH.exe
  C:\Windows\System\zCXYeWH.exe
  2⤵
  PID:10788
- C:\Windows\System\bbJXwQl.exe
  C:\Windows\System\bbJXwQl.exe
  2⤵
  PID:10820
- C:\Windows\System\YltOxpt.exe
  C:\Windows\System\YltOxpt.exe
  2⤵
  PID:10864
- C:\Windows\System\VrhwHnR.exe
  C:\Windows\System\VrhwHnR.exe
  2⤵
  PID:10988
- C:\Windows\System\rzpfZGE.exe
  C:\Windows\System\rzpfZGE.exe
  2⤵
  PID:11068
- C:\Windows\System\FdPGECb.exe
  C:\Windows\System\FdPGECb.exe
  2⤵
  PID:11096
- C:\Windows\System\WdxVQwh.exe
  C:\Windows\System\WdxVQwh.exe
  2⤵
  PID:11172
- C:\Windows\System\TNKPUDl.exe
  C:\Windows\System\TNKPUDl.exe
  2⤵
  PID:11248
- C:\Windows\System\XWCnLzs.exe
  C:\Windows\System\XWCnLzs.exe
  2⤵
  PID:10300
- C:\Windows\System\YFKDBiq.exe
  C:\Windows\System\YFKDBiq.exe
  2⤵
  PID:10372
- C:\Windows\System\XUgRWDg.exe
  C:\Windows\System\XUgRWDg.exe
  2⤵
  PID:10548
- C:\Windows\System\wDHuxnu.exe
  C:\Windows\System\wDHuxnu.exe
  2⤵
  PID:10572
- C:\Windows\System\IAmWufN.exe
  C:\Windows\System\IAmWufN.exe
  2⤵
  PID:10920
- C:\Windows\System\paloxvj.exe
  C:\Windows\System\paloxvj.exe
  2⤵
  PID:11052
- C:\Windows\System\YIRwVEr.exe
  C:\Windows\System\YIRwVEr.exe
  2⤵
  PID:9844
- C:\Windows\System\XTtsOJl.exe
  C:\Windows\System\XTtsOJl.exe
  2⤵
  PID:10700
- C:\Windows\System\DlxWMAh.exe
  C:\Windows\System\DlxWMAh.exe
  2⤵
  PID:10748
- C:\Windows\System\sbJJZRZ.exe
  C:\Windows\System\sbJJZRZ.exe
  2⤵
  PID:9928
- C:\Windows\System\GopKgdx.exe
  C:\Windows\System\GopKgdx.exe
  2⤵
  PID:10616
- C:\Windows\System\ShvWRyo.exe
  C:\Windows\System\ShvWRyo.exe
  2⤵
  PID:11008
- C:\Windows\System\zXiXSeL.exe
  C:\Windows\System\zXiXSeL.exe
  2⤵
  PID:11288
- C:\Windows\System\ZUJhmZa.exe
  C:\Windows\System\ZUJhmZa.exe
  2⤵
  PID:11316
- C:\Windows\System\Xdjwvpy.exe
  C:\Windows\System\Xdjwvpy.exe
  2⤵
  PID:11348
- C:\Windows\System\BlLuEDy.exe
  C:\Windows\System\BlLuEDy.exe
  2⤵
  PID:11372
- C:\Windows\System\eoNGrqQ.exe
  C:\Windows\System\eoNGrqQ.exe
  2⤵
  PID:11432
- C:\Windows\System\sHwwjSX.exe
  C:\Windows\System\sHwwjSX.exe
  2⤵
  PID:11460
- C:\Windows\System\AAhAJGl.exe
  C:\Windows\System\AAhAJGl.exe
  2⤵
  PID:11476
- C:\Windows\System\lFSdliq.exe
  C:\Windows\System\lFSdliq.exe
  2⤵
  PID:11496
- C:\Windows\System\GwvcZJm.exe
  C:\Windows\System\GwvcZJm.exe
  2⤵
  PID:11520
- C:\Windows\System\BpSsSJK.exe
  C:\Windows\System\BpSsSJK.exe
  2⤵
  PID:11548
- C:\Windows\System\qLxprDd.exe
  C:\Windows\System\qLxprDd.exe
  2⤵
  PID:11572
- C:\Windows\System\irDzvBO.exe
  C:\Windows\System\irDzvBO.exe
  2⤵
  PID:11596
- C:\Windows\System\AjpIGWG.exe
  C:\Windows\System\AjpIGWG.exe
  2⤵
  PID:11636
- C:\Windows\System\JMlYvxy.exe
  C:\Windows\System\JMlYvxy.exe
  2⤵
  PID:11672
- C:\Windows\System\ISzXrzz.exe
  C:\Windows\System\ISzXrzz.exe
  2⤵
  PID:11712
- C:\Windows\System\XKDwcXP.exe
  C:\Windows\System\XKDwcXP.exe
  2⤵
  PID:11740
- C:\Windows\System\QkqgQMe.exe
  C:\Windows\System\QkqgQMe.exe
  2⤵
  PID:11756
- C:\Windows\System\TUiJErY.exe
  C:\Windows\System\TUiJErY.exe
  2⤵
  PID:11776
- C:\Windows\System\gwlZOuN.exe
  C:\Windows\System\gwlZOuN.exe
  2⤵
  PID:11800
- C:\Windows\System\oPlPDmp.exe
  C:\Windows\System\oPlPDmp.exe
  2⤵
  PID:11840
- C:\Windows\System\jzonvJo.exe
  C:\Windows\System\jzonvJo.exe
  2⤵
  PID:11860
- C:\Windows\System\EPrbFQc.exe
  C:\Windows\System\EPrbFQc.exe
  2⤵
  PID:11908
- C:\Windows\System\QfAKqNr.exe
  C:\Windows\System\QfAKqNr.exe
  2⤵
  PID:11936
- C:\Windows\System\Tiiwnrs.exe
  C:\Windows\System\Tiiwnrs.exe
  2⤵
  PID:11964
- C:\Windows\System\jmuZefL.exe
  C:\Windows\System\jmuZefL.exe
  2⤵
  PID:11988
- C:\Windows\System\QleqceX.exe
  C:\Windows\System\QleqceX.exe
  2⤵
  PID:12008
- C:\Windows\System\FnFJADr.exe
  C:\Windows\System\FnFJADr.exe
  2⤵
  PID:12036
- C:\Windows\System\wQrNehV.exe
  C:\Windows\System\wQrNehV.exe
  2⤵
  PID:12076
- C:\Windows\System\IACNKGm.exe
  C:\Windows\System\IACNKGm.exe
  2⤵
  PID:12104
- C:\Windows\System\XEftHqD.exe
  C:\Windows\System\XEftHqD.exe
  2⤵
  PID:12120
- C:\Windows\System\FaNmfQU.exe
  C:\Windows\System\FaNmfQU.exe
  2⤵
  PID:12148
- C:\Windows\System\tEuqNjq.exe
  C:\Windows\System\tEuqNjq.exe
  2⤵
  PID:12188
- C:\Windows\System\WaEhEHG.exe
  C:\Windows\System\WaEhEHG.exe
  2⤵
  PID:12216
- C:\Windows\System\PZLDkwM.exe
  C:\Windows\System\PZLDkwM.exe
  2⤵
  PID:12232
- C:\Windows\System\arQiLiy.exe
  C:\Windows\System\arQiLiy.exe
  2⤵
  PID:12248
- C:\Windows\System\GocgoDQ.exe
  C:\Windows\System\GocgoDQ.exe
  2⤵
  PID:11004
- C:\Windows\System\rlxnpXm.exe
  C:\Windows\System\rlxnpXm.exe
  2⤵
  PID:11276
- C:\Windows\System\emKBeZO.exe
  C:\Windows\System\emKBeZO.exe
  2⤵
  PID:11368
- C:\Windows\System\oDekECz.exe
  C:\Windows\System\oDekECz.exe
  2⤵
  PID:11428
- C:\Windows\System\UBssrAX.exe
  C:\Windows\System\UBssrAX.exe
  2⤵
  PID:11504
- C:\Windows\System\xweMBHO.exe
  C:\Windows\System\xweMBHO.exe
  2⤵
  PID:11584
- C:\Windows\System\OIHewZh.exe
  C:\Windows\System\OIHewZh.exe
  2⤵
  PID:11616
- C:\Windows\System\TvGvlDo.exe
  C:\Windows\System\TvGvlDo.exe
  2⤵
  PID:11684
- C:\Windows\System\fMLhwdo.exe
  C:\Windows\System\fMLhwdo.exe
  2⤵
  PID:11752
- C:\Windows\System\dzIahEf.exe
  C:\Windows\System\dzIahEf.exe
  2⤵
  PID:11868
- C:\Windows\System\RfTibgI.exe
  C:\Windows\System\RfTibgI.exe
  2⤵
  PID:11924
- C:\Windows\System\BFaClQI.exe
  C:\Windows\System\BFaClQI.exe
  2⤵
  PID:11952
- C:\Windows\System\QLBlUGz.exe
  C:\Windows\System\QLBlUGz.exe
  2⤵
  PID:12000
- C:\Windows\System\krZfcqe.exe
  C:\Windows\System\krZfcqe.exe
  2⤵
  PID:12112
- C:\Windows\System\klGOwzw.exe
  C:\Windows\System\klGOwzw.exe
  2⤵
  PID:12132
- C:\Windows\System\kNjWNYt.exe
  C:\Windows\System\kNjWNYt.exe
  2⤵
  PID:12184
- C:\Windows\System\VoiFtEF.exe
  C:\Windows\System\VoiFtEF.exe
  2⤵
  PID:10384
- C:\Windows\System\HGqkdJe.exe
  C:\Windows\System\HGqkdJe.exe
  2⤵
  PID:11416
- C:\Windows\System\maSIlMe.exe
  C:\Windows\System\maSIlMe.exe
  2⤵
  PID:11580
- C:\Windows\System\jtDdGbF.exe
  C:\Windows\System\jtDdGbF.exe
  2⤵
  PID:11660
- C:\Windows\System\bQxtrPp.exe
  C:\Windows\System\bQxtrPp.exe
  2⤵
  PID:11828
- C:\Windows\System\cyYJeqB.exe
  C:\Windows\System\cyYJeqB.exe
  2⤵
  PID:11880
- C:\Windows\System\OdqtdCF.exe
  C:\Windows\System\OdqtdCF.exe
  2⤵
  PID:11920
- C:\Windows\System\kZXEpWQ.exe
  C:\Windows\System\kZXEpWQ.exe
  2⤵
  PID:11356
- C:\Windows\System\mBSNCOp.exe
  C:\Windows\System\mBSNCOp.exe
  2⤵
  PID:11620
- C:\Windows\System\UsJAINM.exe
  C:\Windows\System\UsJAINM.exe
  2⤵
  PID:11724
- C:\Windows\System\PdJQgfg.exe
  C:\Windows\System\PdJQgfg.exe
  2⤵
  PID:11304
- C:\Windows\System\IPPlcYs.exe
  C:\Windows\System\IPPlcYs.exe
  2⤵
  PID:11856
- C:\Windows\System\VxjWpeF.exe
  C:\Windows\System\VxjWpeF.exe
  2⤵
  PID:12300
- C:\Windows\System\ypUThJe.exe
  C:\Windows\System\ypUThJe.exe
  2⤵
  PID:12336
- C:\Windows\System\rGgBQTh.exe
  C:\Windows\System\rGgBQTh.exe
  2⤵
  PID:12364
- C:\Windows\System\AQMzCMN.exe
  C:\Windows\System\AQMzCMN.exe
  2⤵
  PID:12404
- C:\Windows\System\drgrBsG.exe
  C:\Windows\System\drgrBsG.exe
  2⤵
  PID:12428
- C:\Windows\System\JtfSjhY.exe
  C:\Windows\System\JtfSjhY.exe
  2⤵
  PID:12460
- C:\Windows\System\ScYYOTG.exe
  C:\Windows\System\ScYYOTG.exe
  2⤵
  PID:12476
- C:\Windows\System\WQjMOHT.exe
  C:\Windows\System\WQjMOHT.exe
  2⤵
  PID:12492
- C:\Windows\System\huJEuQA.exe
  C:\Windows\System\huJEuQA.exe
  2⤵
  PID:12512
- C:\Windows\System\nXiDoFN.exe
  C:\Windows\System\nXiDoFN.exe
  2⤵
  PID:12544
- C:\Windows\System\RLuGmFx.exe
  C:\Windows\System\RLuGmFx.exe
  2⤵
  PID:12596
- C:\Windows\System\KYQVmYg.exe
  C:\Windows\System\KYQVmYg.exe
  2⤵
  PID:12616
- C:\Windows\System\kuLQcXY.exe
  C:\Windows\System\kuLQcXY.exe
  2⤵
  PID:12644
- C:\Windows\System\DBTtWOA.exe
  C:\Windows\System\DBTtWOA.exe
  2⤵
  PID:12660
- C:\Windows\System\bQodzxz.exe
  C:\Windows\System\bQodzxz.exe
  2⤵
  PID:12684
- C:\Windows\System\mXpKBAl.exe
  C:\Windows\System\mXpKBAl.exe
  2⤵
  PID:12708
- C:\Windows\System\VrChAhw.exe
  C:\Windows\System\VrChAhw.exe
  2⤵
  PID:12760
- C:\Windows\System\zGQPCco.exe
  C:\Windows\System\zGQPCco.exe
  2⤵
  PID:12792
- C:\Windows\System\rRnMLav.exe
  C:\Windows\System\rRnMLav.exe
  2⤵
  PID:12808
- C:\Windows\System\GEflsnH.exe
  C:\Windows\System\GEflsnH.exe
  2⤵
  PID:12828
- C:\Windows\System\rLXZvFb.exe
  C:\Windows\System\rLXZvFb.exe
  2⤵
  PID:12876
- C:\Windows\System\zuPxiyT.exe
  C:\Windows\System\zuPxiyT.exe
  2⤵
  PID:12896
- C:\Windows\System\geqBloI.exe
  C:\Windows\System\geqBloI.exe
  2⤵
  PID:12924
- C:\Windows\System\zOLThEo.exe
  C:\Windows\System\zOLThEo.exe
  2⤵
  PID:12944
- C:\Windows\System\GWBJhMB.exe
  C:\Windows\System\GWBJhMB.exe
  2⤵
  PID:12968
- C:\Windows\System\foYOeDz.exe
  C:\Windows\System\foYOeDz.exe
  2⤵
  PID:12988
- C:\Windows\System\kOPJPEp.exe
  C:\Windows\System\kOPJPEp.exe
  2⤵
  PID:13024
- C:\Windows\System\XKJRfwD.exe
  C:\Windows\System\XKJRfwD.exe
  2⤵
  PID:13064
- C:\Windows\System\fFoTSmO.exe
  C:\Windows\System\fFoTSmO.exe
  2⤵
  PID:13088
- C:\Windows\System\OgHrIkL.exe
  C:\Windows\System\OgHrIkL.exe
  2⤵
  PID:13112
- C:\Windows\System\aBvLngf.exe
  C:\Windows\System\aBvLngf.exe
  2⤵
  PID:13148
- C:\Windows\System\NGRApVC.exe
  C:\Windows\System\NGRApVC.exe
  2⤵
  PID:13172
- C:\Windows\System\zitijOa.exe
  C:\Windows\System\zitijOa.exe
  2⤵
  PID:13192
- C:\Windows\System\XiVRbYh.exe
  C:\Windows\System\XiVRbYh.exe
  2⤵
  PID:13244
- C:\Windows\System\qrMjEYy.exe
  C:\Windows\System\qrMjEYy.exe
  2⤵
  PID:13268
- C:\Windows\System\bRJgPiW.exe
  C:\Windows\System\bRJgPiW.exe
  2⤵
  PID:13292
- C:\Windows\System\zzLoIqC.exe
  C:\Windows\System\zzLoIqC.exe
  2⤵
  PID:12372
- C:\Windows\System\tFDsVmW.exe
  C:\Windows\System\tFDsVmW.exe
  2⤵
  PID:12412
- C:\Windows\System\tNhVvhE.exe
  C:\Windows\System\tNhVvhE.exe
  2⤵
  PID:12420
- C:\Windows\System\ZTgxpyu.exe
  C:\Windows\System\ZTgxpyu.exe
  2⤵
  PID:12524
- C:\Windows\System\cWkaxOX.exe
  C:\Windows\System\cWkaxOX.exe
  2⤵
  PID:12500
- C:\Windows\System\evBqdwH.exe
  C:\Windows\System\evBqdwH.exe
  2⤵
  PID:12608
- C:\Windows\System\ZhjsgVF.exe
  C:\Windows\System\ZhjsgVF.exe
  2⤵
  PID:12676
- C:\Windows\System\iOLmvzD.exe
  C:\Windows\System\iOLmvzD.exe
  2⤵
  PID:12784
- C:\Windows\System\xpzTSbm.exe
  C:\Windows\System\xpzTSbm.exe
  2⤵
  PID:12824
- C:\Windows\System\ZeLqjLQ.exe
  C:\Windows\System\ZeLqjLQ.exe
  2⤵
  PID:12892
- C:\Windows\System\nzHVMSL.exe
  C:\Windows\System\nzHVMSL.exe
  2⤵
  PID:12976
- C:\Windows\System\sfypAfl.exe
  C:\Windows\System\sfypAfl.exe
  2⤵
  PID:13084
- C:\Windows\System\AHqvWzD.exe
  C:\Windows\System\AHqvWzD.exe
  2⤵
  PID:13100
- C:\Windows\System\tvmSyxQ.exe
  C:\Windows\System\tvmSyxQ.exe
  2⤵
  PID:13188
- C:\Windows\System\SjdwswV.exe
  C:\Windows\System\SjdwswV.exe
  2⤵
  PID:13276
- C:\Windows\System\aQuYQxx.exe
  C:\Windows\System\aQuYQxx.exe
  2⤵
  PID:13284
- C:\Windows\System\KodGvpm.exe
  C:\Windows\System\KodGvpm.exe
  2⤵
  PID:12532
- C:\Windows\System\mkQbkWO.exe
  C:\Windows\System\mkQbkWO.exe
  2⤵
  PID:12736
- C:\Windows\System\LmDmwGB.exe
  C:\Windows\System\LmDmwGB.exe
  2⤵
  PID:12800
- C:\Windows\System\UHVExCk.exe
  C:\Windows\System\UHVExCk.exe
  2⤵
  PID:13020
- C:\Windows\System\WoEVfJD.exe
  C:\Windows\System\WoEVfJD.exe
  2⤵
  PID:13136
- C:\Windows\System\YAykwHP.exe
  C:\Windows\System\YAykwHP.exe
  2⤵
  PID:13264
- C:\Windows\System\OIPRwlc.exe
  C:\Windows\System\OIPRwlc.exe
  2⤵
  PID:12740
- C:\Windows\System\ptbhHlo.exe
  C:\Windows\System\ptbhHlo.exe
  2⤵
  PID:12652
- C:\Windows\System\QsDteqj.exe
  C:\Windows\System\QsDteqj.exe
  2⤵
  PID:13208
- C:\Windows\System\bUUiNNX.exe
  C:\Windows\System\bUUiNNX.exe
  2⤵
  PID:13320
- C:\Windows\System\WidsYuW.exe
  C:\Windows\System\WidsYuW.exe
  2⤵
  PID:13340
- C:\Windows\System\IEVnUqB.exe
  C:\Windows\System\IEVnUqB.exe
  2⤵
  PID:13364
- C:\Windows\System\JoJeKzQ.exe
  C:\Windows\System\JoJeKzQ.exe
  2⤵
  PID:13404
- C:\Windows\System\RPrMTqY.exe
  C:\Windows\System\RPrMTqY.exe
  2⤵
  PID:13468
- C:\Windows\System\kFehKiR.exe
  C:\Windows\System\kFehKiR.exe
  2⤵
  PID:13492
- C:\Windows\System\CeKHmhL.exe
  C:\Windows\System\CeKHmhL.exe
  2⤵
  PID:13512
- C:\Windows\System\zTFSvRw.exe
  C:\Windows\System\zTFSvRw.exe
  2⤵
  PID:13540
- C:\Windows\System\LUcBXzh.exe
  C:\Windows\System\LUcBXzh.exe
  2⤵
  PID:13564
- C:\Windows\System\shalrzI.exe
  C:\Windows\System\shalrzI.exe
  2⤵
  PID:13592
- C:\Windows\System\GTcjaXj.exe
  C:\Windows\System\GTcjaXj.exe
  2⤵
  PID:13612
- C:\Windows\System\JzqwpvG.exe
  C:\Windows\System\JzqwpvG.exe
  2⤵
  PID:13632
- C:\Windows\System\waBDRwr.exe
  C:\Windows\System\waBDRwr.exe
  2⤵
  PID:13668
- C:\Windows\System\ODedHRS.exe
  C:\Windows\System\ODedHRS.exe
  2⤵
  PID:13692
- C:\Windows\System\jYLoPcO.exe
  C:\Windows\System\jYLoPcO.exe
  2⤵
  PID:13712
- C:\Windows\System\VGyTFlj.exe
  C:\Windows\System\VGyTFlj.exe
  2⤵
  PID:13776
- C:\Windows\System\kpMBzGg.exe
  C:\Windows\System\kpMBzGg.exe
  2⤵
  PID:13796
- C:\Windows\System\hgATZcT.exe
  C:\Windows\System\hgATZcT.exe
  2⤵
  PID:13832
- C:\Windows\System\uRzpnZk.exe
  C:\Windows\System\uRzpnZk.exe
  2⤵
  PID:13860
- C:\Windows\System\WVGzKAl.exe
  C:\Windows\System\WVGzKAl.exe
  2⤵
  PID:13888
- C:\Windows\System\KjcDbpd.exe
  C:\Windows\System\KjcDbpd.exe
  2⤵
  PID:13916
- C:\Windows\System\BnPyRgf.exe
  C:\Windows\System\BnPyRgf.exe
  2⤵
  PID:13932
- C:\Windows\System\ZfetQFN.exe
  C:\Windows\System\ZfetQFN.exe
  2⤵
  PID:13956
- C:\Windows\System\xbTRSgT.exe
  C:\Windows\System\xbTRSgT.exe
  2⤵
  PID:13980
- C:\Windows\System\BvZGdoz.exe
  C:\Windows\System\BvZGdoz.exe
  2⤵
  PID:14008
- C:\Windows\System\MgiHWqz.exe
  C:\Windows\System\MgiHWqz.exe
  2⤵
  PID:14036
- C:\Windows\System\HjpsVgn.exe
  C:\Windows\System\HjpsVgn.exe
  2⤵
  PID:14060
- C:\Windows\System\lWgniqc.exe
  C:\Windows\System\lWgniqc.exe
  2⤵
  PID:14104
- C:\Windows\System\fivYVxz.exe
  C:\Windows\System\fivYVxz.exe
  2⤵
  PID:14132
- C:\Windows\System\zAnyrDR.exe
  C:\Windows\System\zAnyrDR.exe
  2⤵
  PID:14152
- C:\Windows\System\qYHCxRC.exe
  C:\Windows\System\qYHCxRC.exe
  2⤵
  PID:14176
- C:\Windows\System\UDcESON.exe
  C:\Windows\System\UDcESON.exe
  2⤵
  PID:14216
- C:\Windows\System\rtooPzx.exe
  C:\Windows\System\rtooPzx.exe
  2⤵
  PID:14240
- C:\Windows\System\BWAIpoj.exe
  C:\Windows\System\BWAIpoj.exe
  2⤵
  PID:14284
- C:\Windows\System\XzEtrhN.exe
  C:\Windows\System\XzEtrhN.exe
  2⤵
  PID:14300
- C:\Windows\System\UnerIyp.exe
  C:\Windows\System\UnerIyp.exe
  2⤵
  PID:14328
- C:\Windows\System\kBLyEQb.exe
  C:\Windows\System\kBLyEQb.exe
  2⤵
  PID:13156
- C:\Windows\System\kHbmRMp.exe
  C:\Windows\System\kHbmRMp.exe
  2⤵
  PID:13332
- C:\Windows\System\NXsqMgi.exe
  C:\Windows\System\NXsqMgi.exe
  2⤵
  PID:13452
- C:\Windows\System\STmzrJG.exe
  C:\Windows\System\STmzrJG.exe
  2⤵
  PID:13428
- C:\Windows\System\CWwYJcs.exe
  C:\Windows\System\CWwYJcs.exe
  2⤵
  PID:13560
- C:\Windows\System\BIlvPvO.exe
  C:\Windows\System\BIlvPvO.exe
  2⤵
  PID:13676
- C:\Windows\System\IYFpeaW.exe
  C:\Windows\System\IYFpeaW.exe
  2⤵
  PID:13700
- C:\Windows\System\UXpsqGm.exe
  C:\Windows\System\UXpsqGm.exe
  2⤵
  PID:13744
- C:\Windows\System\jKlEYrW.exe
  C:\Windows\System\jKlEYrW.exe
  2⤵
  PID:13820
- C:\Windows\System\yIKZhFG.exe
  C:\Windows\System\yIKZhFG.exe
  2⤵
  PID:13884
- C:\Windows\System\lohfHqR.exe
  C:\Windows\System\lohfHqR.exe
  2⤵
  PID:13968
- C:\Windows\System\IAuAbMO.exe
  C:\Windows\System\IAuAbMO.exe
  2⤵
  PID:14000
- C:\Windows\System\brNeedT.exe
  C:\Windows\System\brNeedT.exe
  2⤵
  PID:14096
- C:\Windows\System\JnDZflQ.exe
  C:\Windows\System\JnDZflQ.exe
  2⤵
  PID:14116
- C:\Windows\System\RWFqtNS.exe
  C:\Windows\System\RWFqtNS.exe
  2⤵
  PID:14204
- C:\Windows\System\zqFhPVX.exe
  C:\Windows\System\zqFhPVX.exe
  2⤵
  PID:14280
- C:\Windows\System\WTEjRpZ.exe
  C:\Windows\System\WTEjRpZ.exe
  2⤵
  PID:14316
- C:\Windows\System\JqWtBIs.exe
  C:\Windows\System\JqWtBIs.exe
  2⤵
  PID:13620
- C:\Windows\System\tXKbpEF.exe
  C:\Windows\System\tXKbpEF.exe
  2⤵
  PID:13628
- C:\Windows\System\cODlspg.exe
  C:\Windows\System\cODlspg.exe
  2⤵
  PID:13784
- C:\Windows\System\roOFfrP.exe
  C:\Windows\System\roOFfrP.exe
  2⤵
  PID:14080
- C:\Windows\System\pjicUTg.exe
  C:\Windows\System\pjicUTg.exe
  2⤵
  PID:14200
- C:\Windows\System\wWXuJhD.exe
  C:\Windows\System\wWXuJhD.exe
  2⤵
  PID:14228
- C:\Windows\System\hMNZJwM.exe
  C:\Windows\System\hMNZJwM.exe
  2⤵
  PID:12444
- C:\Windows\System\AaBYgdE.exe
  C:\Windows\System\AaBYgdE.exe
  2⤵
  PID:13300
- C:\Windows\System\vlqUAfo.exe
  C:\Windows\System\vlqUAfo.exe
  2⤵
  PID:14032
- C:\Windows\System\ypPmYpS.exe
  C:\Windows\System\ypPmYpS.exe
  2⤵
  PID:13444
- C:\Windows\System\AFHbieu.exe
  C:\Windows\System\AFHbieu.exe
  2⤵
  PID:14352
- C:\Windows\System\pKKCyZg.exe
  C:\Windows\System\pKKCyZg.exe
  2⤵
  PID:14380
- C:\Windows\System\xKXYHrP.exe
  C:\Windows\System\xKXYHrP.exe
  2⤵
  PID:14408
- C:\Windows\System\zvqPcJz.exe
  C:\Windows\System\zvqPcJz.exe
  2⤵
  PID:14424
- C:\Windows\System\MnAIZej.exe
  C:\Windows\System\MnAIZej.exe
  2⤵
  PID:14452
- C:\Windows\System\QgQpzQO.exe
  C:\Windows\System\QgQpzQO.exe
  2⤵
  PID:14480
- C:\Windows\System\fJreBQe.exe
  C:\Windows\System\fJreBQe.exe
  2⤵
  PID:14496
- C:\Windows\System\nYyMxzk.exe
  C:\Windows\System\nYyMxzk.exe
  2⤵
  PID:14520
- C:\Windows\System\fMBoZlq.exe
  C:\Windows\System\fMBoZlq.exe
  2⤵
  PID:14576
- C:\Windows\System\SYJCHJz.exe
  C:\Windows\System\SYJCHJz.exe
  2⤵
  PID:14604
- C:\Windows\System\xlgHGzd.exe
  C:\Windows\System\xlgHGzd.exe
  2⤵
  PID:14632
- C:\Windows\System\VHNQbjv.exe
  C:\Windows\System\VHNQbjv.exe
  2⤵
  PID:14648
- C:\Windows\System\pUvlHob.exe
  C:\Windows\System\pUvlHob.exe
  2⤵
  PID:14676
- C:\Windows\System\OVyHxjg.exe
  C:\Windows\System\OVyHxjg.exe
  2⤵
  PID:14716
- C:\Windows\System\uhorjkv.exe
  C:\Windows\System\uhorjkv.exe
  2⤵
  PID:14732
- C:\Windows\System\EIwBiFU.exe
  C:\Windows\System\EIwBiFU.exe
  2⤵
  PID:14756
- C:\Windows\System\vIBlbaj.exe
  C:\Windows\System\vIBlbaj.exe
  2⤵
  PID:14776
- C:\Windows\System\jnUoEmt.exe
  C:\Windows\System\jnUoEmt.exe
  2⤵
  PID:14828
- C:\Windows\System\rAxNqwy.exe
  C:\Windows\System\rAxNqwy.exe
  2⤵
  PID:14856
- C:\Windows\System\lxndJZo.exe
  C:\Windows\System\lxndJZo.exe
  2⤵
  PID:14884
- C:\Windows\System\YJXNeas.exe
  C:\Windows\System\YJXNeas.exe
  2⤵
  PID:14900
- C:\Windows\System\NBgIRMm.exe
  C:\Windows\System\NBgIRMm.exe
  2⤵
  PID:14916
- C:\Windows\System\avmCwqx.exe
  C:\Windows\System\avmCwqx.exe
  2⤵
  PID:14968
- C:\Windows\System\nlDWiJR.exe
  C:\Windows\System\nlDWiJR.exe
  2⤵
  PID:14984
- C:\Windows\System\Yunzyeg.exe
  C:\Windows\System\Yunzyeg.exe
  2⤵
  PID:15004
- C:\Windows\System\RyuhQNh.exe
  C:\Windows\System\RyuhQNh.exe
  2⤵
  PID:15028
- C:\Windows\System\DOvSxZp.exe
  C:\Windows\System\DOvSxZp.exe
  2⤵
  PID:15064
- C:\Windows\System\WhDvlbL.exe
  C:\Windows\System\WhDvlbL.exe
  2⤵
  PID:15084
- C:\Windows\System\hFdWpHn.exe
  C:\Windows\System\hFdWpHn.exe
  2⤵
  PID:15104
- C:\Windows\System\fATqHsG.exe
  C:\Windows\System\fATqHsG.exe
  2⤵
  PID:15148
- C:\Windows\System\vwaOPBW.exe
  C:\Windows\System\vwaOPBW.exe
  2⤵
  PID:15172
- C:\Windows\System\NKOApVk.exe
  C:\Windows\System\NKOApVk.exe
  2⤵
  PID:15208
- C:\Windows\System\XfXEfGU.exe
  C:\Windows\System\XfXEfGU.exe
  2⤵
  PID:15232
- C:\Windows\System\pUnTqEU.exe
  C:\Windows\System\pUnTqEU.exe
  2⤵
  PID:15256
- C:\Windows\System\QWGvIKK.exe
  C:\Windows\System\QWGvIKK.exe
  2⤵
  PID:15292
- C:\Windows\System\mXWAtBe.exe
  C:\Windows\System\mXWAtBe.exe
  2⤵
  PID:15316
- C:\Windows\System\iszFWAg.exe
  C:\Windows\System\iszFWAg.exe
  2⤵
  PID:15336
- C:\Windows\System\hNusDls.exe
  C:\Windows\System\hNusDls.exe
  2⤵
  PID:14348
- C:\Windows\System\sYiGpst.exe
  C:\Windows\System\sYiGpst.exe
  2⤵
  PID:14420
- C:\Windows\System\yQYlAjc.exe
  C:\Windows\System\yQYlAjc.exe
  2⤵
  PID:14476
- C:\Windows\System\bhjADbP.exe
  C:\Windows\System\bhjADbP.exe
  2⤵
  PID:14488
- C:\Windows\System\wJQTZia.exe
  C:\Windows\System\wJQTZia.exe
  2⤵
  PID:14592
- C:\Windows\System\RCzZNbr.exe
  C:\Windows\System\RCzZNbr.exe
  2⤵
  PID:14668
- C:\Windows\System\pjtUPGj.exe
  C:\Windows\System\pjtUPGj.exe
  2⤵
  PID:14704
- C:\Windows\System\UHcvYAY.exe
  C:\Windows\System\UHcvYAY.exe
  2⤵
  PID:14772
- C:\Windows\System\sgPeAUp.exe
  C:\Windows\System\sgPeAUp.exe
  2⤵
  PID:14868
- C:\Windows\System\ZZgUCUI.exe
  C:\Windows\System\ZZgUCUI.exe
  2⤵
  PID:14952
- C:\Windows\System\UicLZdm.exe
  C:\Windows\System\UicLZdm.exe
  2⤵
  PID:15036
- C:\Windows\System\qhErNpL.exe
  C:\Windows\System\qhErNpL.exe
  2⤵
  PID:15000
- C:\Windows\System\jVTbFTa.exe
  C:\Windows\System\jVTbFTa.exe
  2⤵
  PID:15132
- C:\Windows\System\XOZuBWU.exe
  C:\Windows\System\XOZuBWU.exe
  2⤵
  PID:15192
- C:\Windows\System\MTnOlPF.exe
  C:\Windows\System\MTnOlPF.exe
  2⤵
  PID:15240
- C:\Windows\System\zsYkfKK.exe
  C:\Windows\System\zsYkfKK.exe
  2⤵
  PID:15312
- C:\Windows\System\DOnwfWs.exe
  C:\Windows\System\DOnwfWs.exe
  2⤵
  PID:15332
- C:\Windows\System\PnPBJop.exe
  C:\Windows\System\PnPBJop.exe
  2⤵
  PID:14376
- C:\Windows\System\oxXykdv.exe
  C:\Windows\System\oxXykdv.exe
  2⤵
  PID:14560
- C:\Windows\System\RxgbutD.exe
  C:\Windows\System\RxgbutD.exe
  2⤵
  PID:14660
- C:\Windows\System\SFCRDIJ.exe
  C:\Windows\System\SFCRDIJ.exe
  2⤵
  PID:14764
- C:\Windows\System\XfBbeFV.exe
  C:\Windows\System\XfBbeFV.exe
  2⤵
  PID:15080
- C:\Windows\System\SLYmpIA.exe
  C:\Windows\System\SLYmpIA.exe
  2⤵
  PID:15160
- C:\Windows\System\wbuapmU.exe
  C:\Windows\System\wbuapmU.exe
  2⤵
  PID:13924
- C:\Windows\System\NPatWBo.exe
  C:\Windows\System\NPatWBo.exe
  2⤵
  PID:14396
- C:\Windows\System\PIxVAFi.exe
  C:\Windows\System\PIxVAFi.exe
  2⤵
  PID:14788
- C:\Windows\System\HJJYXzQ.exe
  C:\Windows\System\HJJYXzQ.exe
  2⤵
  PID:14980
- C:\Windows\System\fABsrKW.exe
  C:\Windows\System\fABsrKW.exe
  2⤵
  PID:15180
- C:\Windows\System\UqkMHVa.exe
  C:\Windows\System\UqkMHVa.exe
  2⤵
  PID:15388
- C:\Windows\System\UPKFcpT.exe
  C:\Windows\System\UPKFcpT.exe
  2⤵
  PID:15428
- C:\Windows\System\MnaGYWy.exe
  C:\Windows\System\MnaGYWy.exe
  2⤵
  PID:15448
- C:\Windows\System\kFnuvHY.exe
  C:\Windows\System\kFnuvHY.exe
  2⤵
  PID:15464
- C:\Windows\System\veZbqsC.exe
  C:\Windows\System\veZbqsC.exe
  2⤵
  PID:15480
- C:\Windows\System\sQAeHek.exe
  C:\Windows\System\sQAeHek.exe
  2⤵
  PID:15504
- C:\Windows\System\FtiJGnA.exe
  C:\Windows\System\FtiJGnA.exe
  2⤵
  PID:15560
- C:\Windows\System\VLwICFm.exe
  C:\Windows\System\VLwICFm.exe
  2⤵
  PID:15576
- C:\Windows\System\IdUCHfG.exe
  C:\Windows\System\IdUCHfG.exe
  2⤵
  PID:15608
- C:\Windows\System\rtMdfuy.exe
  C:\Windows\System\rtMdfuy.exe
  2⤵
  PID:15644
- C:\Windows\System\tJoQUjF.exe
  C:\Windows\System\tJoQUjF.exe
  2⤵
  PID:15660
- C:\Windows\System\ZAmCTqz.exe
  C:\Windows\System\ZAmCTqz.exe
  2⤵
  PID:15688
- C:\Windows\System\jLoUHpk.exe
  C:\Windows\System\jLoUHpk.exe
  2⤵
  PID:15716
- C:\Windows\System\ogVIAvm.exe
  C:\Windows\System\ogVIAvm.exe
  2⤵
  PID:15756
- C:\Windows\System\pwqCsft.exe
  C:\Windows\System\pwqCsft.exe
  2⤵
  PID:15776
- C:\Windows\System\UDLCoad.exe
  C:\Windows\System\UDLCoad.exe
  2⤵
  PID:15812
- C:\Windows\System\cazhVCH.exe
  C:\Windows\System\cazhVCH.exe
  2⤵
  PID:15828
- C:\Windows\System\dLLQYGM.exe
  C:\Windows\System\dLLQYGM.exe
  2⤵
  PID:15856
- C:\Windows\System\BvnxLFp.exe
  C:\Windows\System\BvnxLFp.exe
  2⤵
  PID:15892
- C:\Windows\System\Nqxwwxr.exe
  C:\Windows\System\Nqxwwxr.exe
  2⤵
  PID:15920
- C:\Windows\System\EaeReoN.exe
  C:\Windows\System\EaeReoN.exe
  2⤵
  PID:15952
- C:\Windows\System\sFkpSUf.exe
  C:\Windows\System\sFkpSUf.exe
  2⤵
  PID:15980
- C:\Windows\System\eUlbvXV.exe
  C:\Windows\System\eUlbvXV.exe
  2⤵
  PID:16016
- C:\Windows\System\iCWVOod.exe
  C:\Windows\System\iCWVOod.exe
  2⤵
  PID:16060
- C:\Windows\System\HqCyTOT.exe
  C:\Windows\System\HqCyTOT.exe
  2⤵
  PID:16080
- C:\Windows\System\rIJFjaO.exe
  C:\Windows\System\rIJFjaO.exe
  2⤵
  PID:16096
- C:\Windows\System\rdfYNRI.exe
  C:\Windows\System\rdfYNRI.exe
  2⤵
  PID:16128
- C:\Windows\System\gVXSbFY.exe
  C:\Windows\System\gVXSbFY.exe
  2⤵
  PID:16152
- C:\Windows\System\QJcFOBM.exe
  C:\Windows\System\QJcFOBM.exe
  2⤵
  PID:16180
- C:\Windows\System\umEEnvI.exe
  C:\Windows\System\umEEnvI.exe
  2⤵
  PID:16204
- C:\Windows\System\kHKGDim.exe
  C:\Windows\System\kHKGDim.exe
  2⤵
  PID:16240
- C:\Windows\System\YpqKnyh.exe
  C:\Windows\System\YpqKnyh.exe
  2⤵
  PID:16268
- C:\Windows\System\GoWlJao.exe
  C:\Windows\System\GoWlJao.exe
  2⤵
  PID:16288
- C:\Windows\System\zrWOjVk.exe
  C:\Windows\System\zrWOjVk.exe
  2⤵
  PID:16328
- C:\Windows\System\QQAGkVv.exe
  C:\Windows\System\QQAGkVv.exe
  2⤵
  PID:16352
- C:\Windows\System\LgtjvLZ.exe
  C:\Windows\System\LgtjvLZ.exe
  2⤵
  PID:16368
- C:\Windows\System\aDunMUE.exe
  C:\Windows\System\aDunMUE.exe
  2⤵
  PID:15376
- C:\Windows\System\OwIOKQR.exe
  C:\Windows\System\OwIOKQR.exe
  2⤵
  PID:15456
- C:\Windows\System\MWRIuge.exe
  C:\Windows\System\MWRIuge.exe
  2⤵
  PID:15500
- C:\Windows\System\upjcLhh.exe
  C:\Windows\System\upjcLhh.exe
  2⤵
  PID:15568
- C:\Windows\System\VZnMdcG.exe
  C:\Windows\System\VZnMdcG.exe
  2⤵
  PID:15676
- C:\Windows\System\FzZrZAH.exe
  C:\Windows\System\FzZrZAH.exe
  2⤵
  PID:15736
- C:\Windows\System\MPoJkJl.exe
  C:\Windows\System\MPoJkJl.exe
  2⤵
  PID:15788
- C:\Windows\System\tPjvZXa.exe
  C:\Windows\System\tPjvZXa.exe
  2⤵
  PID:15840
- C:\Windows\System\KilajWu.exe
  C:\Windows\System\KilajWu.exe
  2⤵
  PID:15948
- C:\Windows\System\yLtzPic.exe
  C:\Windows\System\yLtzPic.exe
  2⤵
  PID:15968
- C:\Windows\System\LfZNejz.exe
  C:\Windows\System\LfZNejz.exe
  2⤵
  PID:3260
- C:\Windows\System\CzdNKaB.exe
  C:\Windows\System\CzdNKaB.exe
  2⤵
  PID:16044
- C:\Windows\System\RtoksMX.exe
  C:\Windows\System\RtoksMX.exe
  2⤵
  PID:16116
- C:\Windows\System\pNIHAZY.exe
  C:\Windows\System\pNIHAZY.exe
  2⤵
  PID:16224
- C:\Windows\System\aVwNNFR.exe
  C:\Windows\System\aVwNNFR.exe
  2⤵
  PID:16256
- C:\Windows\System\PrhTMDQ.exe
  C:\Windows\System\PrhTMDQ.exe
  2⤵
  PID:16344
- C:\Windows\System\oQolzBz.exe
  C:\Windows\System\oQolzBz.exe
  2⤵
  PID:16340
- C:\Windows\System\ixrvCru.exe
  C:\Windows\System\ixrvCru.exe
  2⤵
  PID:15496
- C:\Windows\System\CIhOCrg.exe
  C:\Windows\System\CIhOCrg.exe
  2⤵
  PID:15524
- C:\Windows\System\siIoIBj.exe
  C:\Windows\System\siIoIBj.exe
  2⤵
  PID:15708
- C:\Windows\System\jgyUiBw.exe
  C:\Windows\System\jgyUiBw.exe
  2⤵
  PID:15820
- C:\Windows\System\tyaTzUO.exe
  C:\Windows\System\tyaTzUO.exe
  2⤵
  PID:15972
- C:\Windows\System\qaodBKl.exe
  C:\Windows\System\qaodBKl.exe
  2⤵
  PID:16088
- C:\Windows\System\kGZszwr.exe
  C:\Windows\System\kGZszwr.exe
  2⤵
  PID:16276
- C:\Windows\System\BQEviLs.exe
  C:\Windows\System\BQEviLs.exe
  2⤵
  PID:15380
- C:\Windows\System\MhDNkjp.exe
  C:\Windows\System\MhDNkjp.exe
  2⤵
  PID:15800
- C:\Windows\System\UEXuwvZ.exe
  C:\Windows\System\UEXuwvZ.exe
  2⤵
  PID:16092
- C:\Windows\System\bZbjQOg.exe
  C:\Windows\System\bZbjQOg.exe
  2⤵
  PID:16260
- C:\Windows\System\WvchIIQ.exe
  C:\Windows\System\WvchIIQ.exe
  2⤵
  PID:15744
- C:\Windows\System\HmeKfRL.exe
  C:\Windows\System\HmeKfRL.exe
  2⤵
  PID:16408
- C:\Windows\System\PBJHUoK.exe
  C:\Windows\System\PBJHUoK.exe
  2⤵
  PID:16444
- C:\Windows\System\gsAcrJN.exe
  C:\Windows\System\gsAcrJN.exe
  2⤵
  PID:16460
- C:\Windows\System\Giwmuqi.exe
  C:\Windows\System\Giwmuqi.exe
  2⤵
  PID:16476
- C:\Windows\System\jMbdSLs.exe
  C:\Windows\System\jMbdSLs.exe
  2⤵
  PID:16500
- C:\Windows\System\jacndtz.exe
  C:\Windows\System\jacndtz.exe
  2⤵
  PID:16544
- C:\Windows\System\SDikQFC.exe
  C:\Windows\System\SDikQFC.exe
  2⤵
  PID:16580
- C:\Windows\System\wlLhTEG.exe
  C:\Windows\System\wlLhTEG.exe
  2⤵
  PID:16620
- C:\Windows\System\xJRLeOJ.exe
  C:\Windows\System\xJRLeOJ.exe
  2⤵
  PID:16640
- C:\Windows\System\LwrGdyc.exe
  C:\Windows\System\LwrGdyc.exe
  2⤵
  PID:16656
- C:\Windows\System\CkmUwCq.exe
  C:\Windows\System\CkmUwCq.exe
  2⤵
  PID:16680
- C:\Windows\System\dFXeucj.exe
  C:\Windows\System\dFXeucj.exe
  2⤵
  PID:16700
- C:\Windows\System\hFOgpCK.exe
  C:\Windows\System\hFOgpCK.exe
  2⤵
  PID:16748
- C:\Windows\System\KfpkTkU.exe
  C:\Windows\System\KfpkTkU.exe
  2⤵
  PID:16776
- C:\Windows\System\nArVOPj.exe
  C:\Windows\System\nArVOPj.exe
  2⤵
  PID:16796
- C:\Windows\System\jjZFKxy.exe
  C:\Windows\System\jjZFKxy.exe
  2⤵
  PID:16816
- C:\Windows\System\fKuctOd.exe
  C:\Windows\System\fKuctOd.exe
  2⤵
  PID:16876
- C:\Windows\System\fmevuQH.exe
  C:\Windows\System\fmevuQH.exe
  2⤵
  PID:16892
- C:\Windows\System\TOUQJpw.exe
  C:\Windows\System\TOUQJpw.exe
  2⤵
  PID:16912
- C:\Windows\System\DeJrpyH.exe
  C:\Windows\System\DeJrpyH.exe
  2⤵
  PID:16948
- C:\Windows\System\ZQizhlH.exe
  C:\Windows\System\ZQizhlH.exe
  2⤵
  PID:16964

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:16396

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\BctfBHd.exe

Filesize
1.4MB

MD5
40023bb1f85fc942464a13d11759d98a

SHA1
84146db2c40d5f2c6707702014635fcc158b6421

SHA256
c492c1b51abea1c3d7179e57bfef1519f6c93937a3eceef1e98acdb928e9384b

SHA512
b0caff21a28e2f333b38910eb5b10866cbdbff98c7481da2e53de39a90cab81deb12cbcb43d723042d12c9c82501adfefe799ae38a486aee957924cb2f40bf52

Download Submit
C:\Windows\System\CjVpxHt.exe

Filesize
1.4MB

MD5
0aab81be6a2aa9b00a37faef514b94cb

SHA1
a381130931183cd9f032aca5db1a5ec0a5a263dd

SHA256
73e3ed9ffe4482dd9c5902ee29b9522135233094e5eef34ecd3f0400fbf2e097

SHA512
2910547a1d723e4c7ea6caf7018f93c3e225a2faf4d1640cbf554c638cbe9ba039826ff8db18b79a0e5a84ce2655a8833de39d033d300693da584fa28e593cf1

Download Submit
C:\Windows\System\CsCHgBM.exe

Filesize
1.4MB

MD5
228a917aadb76fa0e09f2067268aa5ce

SHA1
5940ff43901582040a15b370dbbbc303ce0dffd1

SHA256
da6799820007e0a4d2ab6d3a74efa08e6fe96c1541eb5ce1430b812a924bc59a

SHA512
3d61f87f726b5bdda72cb45cf2914a0a07431b8500e7d8d273880fc2006409d410108b587d5634cc562e702512a4a4b4defd86538c27e3a68160ed4d1fb8a6dd

Download Submit
C:\Windows\System\GCvLGTr.exe

Filesize
1.4MB

MD5
007a35c752c1e3ae05d1a45e6f7621f1

SHA1
7db67d51132a7730517912ec5eadcae86f0431d6

SHA256
c60418317580d9424adb7e44d1743d7a7aa8426b13987c995850122113bbf8bf

SHA512
074ddfef5934aabcd9def808a0433210bd468f6f36b92de16e3e672b86b710d733dff2a049de4f17a41a68209b752d6b36b5da56ea4219002dae728d3c0718c2

Download Submit
C:\Windows\System\GePiiBQ.exe

Filesize
1.4MB

MD5
8cc87a74a5228c851f229fcd574e1727

SHA1
4658871e9361d17c380c14aab47f360daedf7fd4

SHA256
76c55ef39ac3a99128f2568e51ac7f9237ad8dfcb351fdd9535a68ab51406c62

SHA512
1af64076a281327956f5d063d85236eb6b6e46a5996611ee8af4af460a5398d5f7bc566a49c81c5cc8427e055e271e85b5fdd5c9ef903009ff14836a03e8f526

Download Submit
C:\Windows\System\KdOshwX.exe

Filesize
1.4MB

MD5
b02cfd50a1329b6fade1450913f15d31

SHA1
7634d65a4a967c7792337268149bfa22dd09bd20

SHA256
a93539f59a255c05285be732996bcef954b71efba0fa584e131f08f8985eea17

SHA512
a33b3d20c604f415960e9964dc81a6d22422844e1f3ea69e8464204b887cbb2ef89c252509a4c365fa3228aa4e2496aa35469f2eb1d7cb60513cb8ce5a25f8a2

Download Submit
C:\Windows\System\KfPlOpG.exe

Filesize
1.4MB

MD5
bf36c3c850873c6ceaea9a073d83f502

SHA1
30188840313fe8612fee1aafdbe2cb656cff384c

SHA256
7687ac24903ebd0da664aa3da3077f8aa37aaed92edc6512294bec91cfb6c9cd

SHA512
eab673741c58899b443007d34c2d504a4c2bb19196cd5effdc28b65db587d9aaf2063648937bc40884fa6a54a4622907db8120afa6d541375ab63ce347ed2895

Download Submit
C:\Windows\System\KqytKxW.exe

Filesize
1.4MB

MD5
33ebaa517b3cf88b58608f328f81810e

SHA1
a2bbb364901da749a4a3a37c35cb83cc0b9dd1bc

SHA256
7919c245a942ea56ec37faab80a57bf0c45987098e84425f48ee06c13ec43dc4

SHA512
10dedf27561b8741c7c0b85b65a3ff7853c76fb1faef9278e95fc9f05c900a63d3b4b1071b7630277ade5ae9c8e6e540cf0eb9d3bfe9521171b34b9c9b8c74ad

Download Submit
C:\Windows\System\PVxpxYz.exe

Filesize
1.4MB

MD5
77bc0eed5533cd5575b8d9e874e08dda

SHA1
94d328e415fe90b5beccf2e97759657463c8a424

SHA256
91a1f3d65ff12835903e491f8057adc4989088b6324f9493cab5229dd69d766e

SHA512
a1a653b5fa867814d62ba6afd3df4fd94b3daeba6c6de5145a4d4625767e63b40614ea673220a61aee7f569a2cfbaf19096c8a4bb8231e92f92dd26bdb75159c

Download Submit
C:\Windows\System\PYrfECq.exe

Filesize
1.4MB

MD5
385297896d8998c4824dcc8083635d0c

SHA1
cadd50eb5f276838867ce486296453536dd67fff

SHA256
043dbee61864a94e7967daa67d4fecda0fcd5728dc42aa78d69cbba9ecebda7a

SHA512
f45bf1d48a5c5539777149a427f77a1e04df3f31ef7c53e7a1c363e578d999df1ac0d6b04254a34bba672959eb1daccc06c5d85f86a718f55a5dba74678a49f5

Download Submit
C:\Windows\System\PqNVlam.exe

Filesize
1.4MB

MD5
5e5ad305df3a3ce70d7993c80f6b0b1e

SHA1
112965e50ee4b72bc97018d52e32d39e54b5997f

SHA256
3454a7787b2049cf36dd46c9bc1d60c4f43eeb7d0a6525b1abeb5c884a6a32ab

SHA512
b71aa2c46338264e5bd847af2029d081e75786a139112a3877833381ae5e3c593776fbd7d66c98f56ce89a83d8b632842e1ad10947d9da222d4e52b22d553e99

Download Submit
C:\Windows\System\RQyQXQG.exe

Filesize
1.4MB

MD5
a890df699ea17688ffa64d40e4934121

SHA1
2279189c67ec3329ce46d400d6e532bb041c1ea1

SHA256
c9b96a7d36d779c99ed40c0aeff12c64d496cef98972852e91ada61c44660a0f

SHA512
87b532b81ecbfc6aa3d3f98305cf990a1eff4c4f31e7d100ff0214a18b45d2d39ea5fcef9f59fe19bd7507d3188fdc4cbd9021d58366d5e34c5ebf6cadebefdd

Download Submit
C:\Windows\System\UtfhRBK.exe

Filesize
1.4MB

MD5
8f23568992565725a92817e9cef48235

SHA1
dc5c73f7fd7b81c9b1e6452b8f3f3000190e9fac

SHA256
b21087d72a92e34b84575cfb33eedebb98632d01b584a5d6a57635c7e299040c

SHA512
c481b5738f3138e570cc6b5629a124d311de150587693f58249d5f705a472624f0619eb09e7879224b9ef664e5c7810f7e322bc37c5256aa7a31fd29addfae4e

Download Submit
C:\Windows\System\VlmCYhK.exe

Filesize
1.4MB

MD5
e2c0cdff1fc0d5a91f56ba7f83bc3783

SHA1
8c3b0c50089a9855f5454e58148d8f87760b5fab

SHA256
db7ce47ce9eda21e515e98337766c27fd78f991782506ead9de18e107851c926

SHA512
bd505d9f31977534207593437934f2f2298f9c79b9593174a900593b0fc36843c59e826d2cb46250a655c8c024ed2bc88cefe037fc75868dce2d63b489107b92

Download Submit
C:\Windows\System\XUrPghy.exe

Filesize
1.4MB

MD5
b269cb4980c0e2b78d187268441bf34f

SHA1
7d6f826e0c43d6ab82a28d82131a51360c506a47

SHA256
b054474f32cd717be1cabf1284575106b1925b69252cbe83ea6934bcc2d83677

SHA512
7d9dbb4e2656bf33c9a62a77a182851b8cdc8c95dd9c5213f589c2d948547367b49e3b6b1215d03eedc0c5e63aa3f1354dfb92a848f340686315cfa775f889e2

Download Submit
C:\Windows\System\XbrFfmD.exe

Filesize
1.4MB

MD5
81a9c5668160fae0e3b8ec218c8c8932

SHA1
322c5bcdef1a9b6c7fafa95bda833f310ebef4d5

SHA256
fbbcaf0be3f5aca0040181c8224b004ac88ca5814bf64b2369360eedf987f1c7

SHA512
8bf1aec723797346fe1c8165f65dd8a5fade9b5dfa210d5d6ed7bfe79ad26a25908b534a8d6e8b1201863cd1f655fab06cee708536bc614dbc6a73148bf4f374

Download Submit
C:\Windows\System\ZGOOEIi.exe

Filesize
1.4MB

MD5
d91475fda4e74ca3697aff7c5afa5fad

SHA1
1704f3fb23bb09b8a726ebc33da92199118ae0f7

SHA256
27b379fa618f715b9ffc027c8645e0da95de5db95516d3fa39c8abc848bce0f9

SHA512
8e4b6ed1c5432af0412e5df33752ea4a5dd7ebb96b1766521ee05d9ec05f533c6da29b01c2409d27a3e229131b26e4bb8e293e723ddd3dd380a643ccf684c355

Download Submit
C:\Windows\System\ZUuErsl.exe

Filesize
1.4MB

MD5
cd8afcb9d5f46d15683f909067fe9212

SHA1
5fe9a1d345d3049045831441cca3276a66ad6e95

SHA256
f23dbb1934de05905f9dc161fb9da9ffcb12f06c808024834d9474851a5c7a5a

SHA512
182d3870d96d3075df5df82053427d3d95ac7cb52aad4f8f5ac5d55b952006687cf4594b579806a1b7ee3f69b8a333311637512efcd75a6b25bb8ed2de331f44

Download Submit
C:\Windows\System\aeHHoxB.exe

Filesize
1.4MB

MD5
3f0bc09b71fe33ef87a9a2128ecb1764

SHA1
fa4e897352adc8ae9eafd4040192cc3e2068bd2a

SHA256
505dd0c7727a475c32b97d481f78b47279a5f3e73b243b12b424b8e963aa27f5

SHA512
3269ace5f66784c900a3be57d85da4a5c8ba9064de7b689c3d21344bdd1edcd45bc919406b94f6f287bcc699f19dadab5497464ee20bfedef6e005c66b613b1f

Download Submit
C:\Windows\System\eLcHQIQ.exe

Filesize
1.4MB

MD5
1dd2643f6d78775953315443230128c2

SHA1
468d9022d1d30f1aec5d12191cc2ddc08a2db033

SHA256
9b0503d8072d28259bf35f18b9c1f8427c83c31d857fe71680562cf931c41dd1

SHA512
9a312b14418febef0b10013229da314a472cc59ac992ffcecf57f929d67b8498a98b45912991c82c893fe48d5cf6c4e5e4f957726aacdfe3f9194da587329e20

Download Submit
C:\Windows\System\hHUvXAC.exe

Filesize
1.4MB

MD5
6dc37d94e9dace59436014165fde4717

SHA1
58c9c382c05b8d74f5b5f56acaa75c350bdb8008

SHA256
fa7dd527b0752433344a3fa7264d6fcfe1d430ed74e7c429128ce0e7ec214d33

SHA512
da1d3cbc1878cc1d6f21662b3784958dee9049134495f423d59dcbe81435308d15fb76e49915357aa8a37b218ce015a2f38aa94af50ee65fdd97ebce8b85610c

Download Submit
C:\Windows\System\hLPXMMm.exe

Filesize
1.4MB

MD5
8f006146e58e3a0c22633c83f8278c47

SHA1
913bad9843d6b7f2e6fac7ddeaabe461cbc55480

SHA256
07f1d48ca23e81924cf49e1e8e40e94a1ddac173d758d57b995540e2a526b53b

SHA512
95e9710a5191e0f2bdc45da5f85f33999b9f031b183dcde33ec03541ac191047dd75d9d06f4beee3bbd9d044b6c640230bb21ad4322c9f0899d20aa7864b2924

Download Submit
C:\Windows\System\hcXAgyT.exe

Filesize
1.4MB

MD5
bc097a471eb4ce61687614f46ae21a77

SHA1
3946c14081a63a222bf94d25e13a46891deef411

SHA256
b3f76451e26a42afcb2a21b476a1adbcbfd09eaf81112d3294435419eafa969c

SHA512
8c81a6de7ab05b2571cba11030db2a64f35028b00647d5891a2961fe095365413203441205aff474c4e875b864f96e1cb152c7c52355d693244c41da13c39e29

Download Submit
C:\Windows\System\jdyTAMK.exe

Filesize
1.4MB

MD5
3217bdd1d2745635f01cbf9e0b5242c4

SHA1
90dbf6bb60554081ab5b684eb88f5ac8fba25aef

SHA256
780986de60ca2e87b736f392f253d6fbbe72beefd8951099033c666ae0c27d91

SHA512
347724eb708ad83a9df11cc30bd7cc23fd70fcd63a2e92e63aee69c59e71824cce88ac23474a3b99fee49fb91cc4d3f4f145cba95178a55074de821d3d7b6cde

Download Submit
C:\Windows\System\kldwUsD.exe

Filesize
1.4MB

MD5
e61f4e7b91ea811ab7965e777ad65ac3

SHA1
d43329a4dc5ec47839b34408337a11825896f8af

SHA256
bb3a196c38ea6836fd9385700bb0475821c5bc1bd670f996fa5d0d6bd4afdccf

SHA512
5caa8128c0a8ba0286ecc82640bc63a901b909e705ca0e6a984a7cc1f1c56bb50e5f758afa6db2f945556a4f8aafeba37365d77e3b97ced52177007d86075389

Download Submit
C:\Windows\System\ktlDDTn.exe

Filesize
1.4MB

MD5
b372cd4e60059ca6fb2ccd17a118f951

SHA1
217cab365329786cc72cab90b5ace244061432c2

SHA256
aa22ec2a2661889a5430a2ee68a96717ece4c570780e2a7f283c0d83592469cb

SHA512
bf8961b265edfd2a22af7323c6eac70f4bee27883b4a56139d39bbffc5f4102b6f1a3e0440ed8167e9504cc57ef36114ca887fdeb5386af73271acc549d9f5c5

Download Submit
C:\Windows\System\kxeYOyg.exe

Filesize
1.4MB

MD5
3054a63ef5336e8fc8fb23d4550c9a07

SHA1
5864e725051d3af506763c0cec128d770b2da8d1

SHA256
70437b980b7739094d4bcb2216e16f8a84f1b7a0686bf3e781adbb68f8a59b18

SHA512
f3cb83a8f0d5832dc33696336a719257088a155dd30bc1ba2317629538a39821467d61870d6dc6298cff8b06c6f4c3069f7bbe27f2106b2eb45d49bf90b4b6e9

Download Submit
C:\Windows\System\rfMRzOa.exe

Filesize
1.4MB

MD5
ee65feba222eaffb864bf9da4f6d9566

SHA1
2ca65c58160d4d32fb56e3be513d6c2c980a0bf4

SHA256
0359f60955cfcdc77677d23dcae37984dd51f196d62cac9ab31f4b057de89b4b

SHA512
95b5d849b5accb1f2c11e3f6e252c7d317f28956127e6c5d691065a10dd93eee1d492a2265aaf01ab70c6ffc0175ea0acb25367387727c7a5299b0633181d3a7

Download Submit
C:\Windows\System\tJbkudQ.exe

Filesize
1.4MB

MD5
f6cb1528e3a7c26937f5b21f13e4b765

SHA1
2c72d2c3971f1be7ca990cfb2c785486fc8642b0

SHA256
17f8d5595d5f0691bd57c4cd711876192cb2bd6e753c9ed14a59491e060d8af5

SHA512
b7ec8379a926f6858dba4d00e9306b23b683600a1c79a58f3225af7796bf3b8707a7150a878fd69f8ea07b2f5e66049b662add22fe5896176e238f01e7034fba

Download Submit
C:\Windows\System\vXjTEoB.exe

Filesize
1.4MB

MD5
ba82d97d82c2502fd2e6db21a6fc0078

SHA1
1f7b8216bb0d2b87ecbb753be464f9e17f3c7a2f

SHA256
3e173fb18f193f3c6b66d0d6bac955de6ab21b60451520d46011904789658c35

SHA512
6da0631708362d66e63d70f4bde6293a6c30c1d15640b82533bcc8428ba1120e73f9507dd2749ba9a5fecfb41efb81772f22074ff78736dacd570fd169d7f992

Download Submit
C:\Windows\System\vhwrZaV.exe

Filesize
1.4MB

MD5
e799680c563396522471bc02fc2228b8

SHA1
0e11257fcf5863db76d9730db45fdee1e42583b1

SHA256
4e9d035bfd05738b6f5d71764dd831448f88058dc8671cc479e94972c73416a2

SHA512
c11eebe59bb45c6dc2767f9a649489d8bee843d80720d40b7ec5875ccb06355406fb1d8390ea98076d22645de92ab42ba4ebf26221c2b2b33cfb088c093f5a54

Download Submit
C:\Windows\System\xrkZasH.exe

Filesize
1.4MB

MD5
715ddef9665616c9ff26b3bf381a0d0f

SHA1
296a0b03297944ef49a1ec57899ddd2d305ba66d

SHA256
b7a39c6a1345ead5a2d070c1ced3a9c2d1adcdefbf0dd80869a96ac68754c773

SHA512
598623b58dd2e48151307cc4a6ef5df8517c6b8644edc75861fd79f407b7d0242ee8c44bb2b19951d0a2b9dffe466d26611433fab735eb1eccc7f5498d6d7ef8

Download Submit
C:\Windows\System\zSVqJlS.exe

Filesize
1.4MB

MD5
64900b8e02309eeda60780fd0be25804

SHA1
61113aa5a99405bddbc10436edd0861d5c170931

SHA256
a165cefb9ac78f1b162dcad90ff882d80025572f131e52df1cbbf968f6a19239

SHA512
608d4aa52d1c42e2de8a3fbc88617026a593639fdd1740259a64cac30da0fbd341e1cd8820f99cdd81f2c93b87c8ab4f612bbbfb81fa4f5daf01c57b0377b621

Download Submit
memory/2008-0-0x00000161E7F20000-0x00000161E7F30000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads