xmrig | e865367bde901a815de02578253a2b89d5d1ba3d42f2ce208f476c8672c1f441

Analysis

max time kernel
141s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
23-12-2024 04:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e865367bde901a815de02578253a2b89d5d1ba3d42f2ce208f476c8672c1f441.exe
Size

1002KB
MD5

47254fa8390ca259b616149f71811cc2
SHA1

e5a7db5a2d8feff790c1f84f7122f129022600a5
SHA256

e865367bde901a815de02578253a2b89d5d1ba3d42f2ce208f476c8672c1f441
SHA512

4c4cd5caf4b207d9b339eb754aae918e2d4124968ca919e7d2a238ec3e3500a890952a7e34bae538bcefbe7b57d05c4e65e3209ca4c4e0287f30fc6dde923800
SSDEEP

24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbpwlKenszbWKDNEm/5QbR:GezaTF8FcNkNdfE0pZ9ozttwIRx2N

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 33 IoCs

miner

resource	yara_rule
behavioral2/files/0x000b000000023bb1-4.dat	xmrig
behavioral2/files/0x0008000000023c8e-9.dat	xmrig
behavioral2/files/0x0007000000023c92-14.dat	xmrig
behavioral2/files/0x0007000000023c94-22.dat	xmrig
behavioral2/files/0x0007000000023c9c-63.dat	xmrig
behavioral2/files/0x0007000000023c9d-74.dat	xmrig
behavioral2/files/0x0007000000023cac-141.dat	xmrig
behavioral2/files/0x0007000000023cb0-161.dat	xmrig
behavioral2/files/0x0007000000023cae-159.dat	xmrig
behavioral2/files/0x0007000000023caf-156.dat	xmrig
behavioral2/files/0x0007000000023cad-154.dat	xmrig
behavioral2/files/0x0007000000023cab-144.dat	xmrig
behavioral2/files/0x0007000000023caa-139.dat	xmrig
behavioral2/files/0x0007000000023ca9-134.dat	xmrig
behavioral2/files/0x0007000000023ca8-129.dat	xmrig
behavioral2/files/0x0007000000023ca7-124.dat	xmrig
behavioral2/files/0x0007000000023ca6-119.dat	xmrig
behavioral2/files/0x0007000000023ca5-114.dat	xmrig
behavioral2/files/0x0007000000023ca4-109.dat	xmrig
behavioral2/files/0x0007000000023ca3-104.dat	xmrig
behavioral2/files/0x0007000000023ca2-99.dat	xmrig
behavioral2/files/0x0007000000023ca1-94.dat	xmrig
behavioral2/files/0x0007000000023ca0-89.dat	xmrig
behavioral2/files/0x0007000000023c9f-84.dat	xmrig
behavioral2/files/0x0007000000023c9e-79.dat	xmrig
behavioral2/files/0x0007000000023c9b-61.dat	xmrig
behavioral2/files/0x0007000000023c9a-57.dat	xmrig
behavioral2/files/0x0007000000023c99-51.dat	xmrig
behavioral2/files/0x0007000000023c98-47.dat	xmrig
behavioral2/files/0x0007000000023c97-41.dat	xmrig
behavioral2/files/0x0007000000023c96-37.dat	xmrig
behavioral2/files/0x0007000000023c95-31.dat	xmrig
behavioral2/files/0x0007000000023c93-19.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
3512	NDbIrBw.exe
3480	SjVVNME.exe
5032	srEohEu.exe
3356	HWdcjTf.exe
4924	LaLCfNR.exe
3868	zCuMlHS.exe
3092	rJnyLaT.exe
4648	xmRtPnI.exe
412	bGxpplf.exe
4020	cUAciaV.exe
3936	hlhLQWD.exe
2924	kCMTAYU.exe
528	VSfxYqe.exe
1608	XDvNqEX.exe
2596	wsCmdEK.exe
4548	piBahvJ.exe
396	hJbQbJn.exe
856	qCiRPGK.exe
4144	ILkOrnN.exe
3676	eksHgzi.exe
1852	NIFvelk.exe
2552	SJyGzFy.exe
4960	ulKHhTH.exe
3424	yBpntQg.exe
2328	zFyMKcM.exe
5072	ejzPMGu.exe
4488	TGtrocG.exe
868	JRtvfBO.exe
3432	GwQunwg.exe
4576	WzkxGRA.exe
2196	YKZeNCb.exe
3448	LGHxGiI.exe
1000	JasNhxu.exe
4952	ZjnSXZB.exe
5112	ArIsGAl.exe
4580	ErsJpHv.exe
2688	ywoRsCW.exe
4304	ICaglnI.exe
4184	WfcPxOB.exe
4912	icVYyuh.exe
5024	SBFgeei.exe
2616	mujXUPe.exe
4084	AksABox.exe
4024	ZVDjxPD.exe
4928	KDCpIRH.exe
1340	uwDGPWJ.exe
3460	rUNwTDj.exe
4440	GrRrKIe.exe
1216	iUyhSml.exe
3636	zUpOdSZ.exe
4684	Gmtockz.exe
4056	ZtsgfKn.exe
1748	NQJrDDB.exe
5064	VsZavaj.exe
644	nVSVYDW.exe
3292	MgFuJuS.exe
4608	SMcEfXS.exe
3532	YiBaRjb.exe
3032	JvjdoXo.exe
408	izhrGyc.exe
2600	EWXmbfb.exe
1344	wabclDe.exe
4632	Mmffsvg.exe
4932	hGPQmxx.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\XDvNqEX.exe	e865367bde901a815de02578253a2b89d5d1ba3d42f2ce208f476c8672c1f441.exe
File created	C:\Windows\System\ICaglnI.exe	e865367bde901a815de02578253a2b89d5d1ba3d42f2ce208f476c8672c1f441.exe
File created	C:\Windows\System\UYmRDmh.exe	e865367bde901a815de02578253a2b89d5d1ba3d42f2ce208f476c8672c1f441.exe
File created	C:\Windows\System\OxzJQPi.exe	e865367bde901a815de02578253a2b89d5d1ba3d42f2ce208f476c8672c1f441.exe
File created	C:\Windows\System\jiWaodf.exe	e865367bde901a815de02578253a2b89d5d1ba3d42f2ce208f476c8672c1f441.exe
File created	C:\Windows\System\RsVlHux.exe	e865367bde901a815de02578253a2b89d5d1ba3d42f2ce208f476c8672c1f441.exe
File created	C:\Windows\System\QXXvqwl.exe	e865367bde901a815de02578253a2b89d5d1ba3d42f2ce208f476c8672c1f441.exe
File created	C:\Windows\System\ekRgdzT.exe	e865367bde901a815de02578253a2b89d5d1ba3d42f2ce208f476c8672c1f441.exe
File created	C:\Windows\System\LhVYQQT.exe	e865367bde901a815de02578253a2b89d5d1ba3d42f2ce208f476c8672c1f441.exe
File created	C:\Windows\System\MzPUbTQ.exe	e865367bde901a815de02578253a2b89d5d1ba3d42f2ce208f476c8672c1f441.exe
File created	C:\Windows\System\XLrFAHJ.exe	e865367bde901a815de02578253a2b89d5d1ba3d42f2ce208f476c8672c1f441.exe
File created	C:\Windows\System\VeKBorY.exe	e865367bde901a815de02578253a2b89d5d1ba3d42f2ce208f476c8672c1f441.exe
File created	C:\Windows\System\gWwKSWD.exe	e865367bde901a815de02578253a2b89d5d1ba3d42f2ce208f476c8672c1f441.exe
File created	C:\Windows\System\vjhrbtH.exe	e865367bde901a815de02578253a2b89d5d1ba3d42f2ce208f476c8672c1f441.exe
File created	C:\Windows\System\JgJbdVf.exe	e865367bde901a815de02578253a2b89d5d1ba3d42f2ce208f476c8672c1f441.exe
File created	C:\Windows\System\SjgzBSq.exe	e865367bde901a815de02578253a2b89d5d1ba3d42f2ce208f476c8672c1f441.exe
File created	C:\Windows\System\hlhLQWD.exe	e865367bde901a815de02578253a2b89d5d1ba3d42f2ce208f476c8672c1f441.exe
File created	C:\Windows\System\uJODTYv.exe	e865367bde901a815de02578253a2b89d5d1ba3d42f2ce208f476c8672c1f441.exe
File created	C:\Windows\System\tOxgBMa.exe	e865367bde901a815de02578253a2b89d5d1ba3d42f2ce208f476c8672c1f441.exe
File created	C:\Windows\System\vpEUcix.exe	e865367bde901a815de02578253a2b89d5d1ba3d42f2ce208f476c8672c1f441.exe
File created	C:\Windows\System\rtWvAcR.exe	e865367bde901a815de02578253a2b89d5d1ba3d42f2ce208f476c8672c1f441.exe
File created	C:\Windows\System\nMkcKEH.exe	e865367bde901a815de02578253a2b89d5d1ba3d42f2ce208f476c8672c1f441.exe
File created	C:\Windows\System\UBpUXna.exe	e865367bde901a815de02578253a2b89d5d1ba3d42f2ce208f476c8672c1f441.exe
File created	C:\Windows\System\gfXGYNi.exe	e865367bde901a815de02578253a2b89d5d1ba3d42f2ce208f476c8672c1f441.exe
File created	C:\Windows\System\btstyHP.exe	e865367bde901a815de02578253a2b89d5d1ba3d42f2ce208f476c8672c1f441.exe
File created	C:\Windows\System\mGgyRpd.exe	e865367bde901a815de02578253a2b89d5d1ba3d42f2ce208f476c8672c1f441.exe
File created	C:\Windows\System\vzanlxe.exe	e865367bde901a815de02578253a2b89d5d1ba3d42f2ce208f476c8672c1f441.exe
File created	C:\Windows\System\FJIOcTA.exe	e865367bde901a815de02578253a2b89d5d1ba3d42f2ce208f476c8672c1f441.exe
File created	C:\Windows\System\akdOidj.exe	e865367bde901a815de02578253a2b89d5d1ba3d42f2ce208f476c8672c1f441.exe
File created	C:\Windows\System\lKsWbpO.exe	e865367bde901a815de02578253a2b89d5d1ba3d42f2ce208f476c8672c1f441.exe
File created	C:\Windows\System\FolZNzf.exe	e865367bde901a815de02578253a2b89d5d1ba3d42f2ce208f476c8672c1f441.exe
File created	C:\Windows\System\HqSwmbh.exe	e865367bde901a815de02578253a2b89d5d1ba3d42f2ce208f476c8672c1f441.exe
File created	C:\Windows\System\CRuQVKZ.exe	e865367bde901a815de02578253a2b89d5d1ba3d42f2ce208f476c8672c1f441.exe
File created	C:\Windows\System\jocFmzD.exe	e865367bde901a815de02578253a2b89d5d1ba3d42f2ce208f476c8672c1f441.exe
File created	C:\Windows\System\ywoRsCW.exe	e865367bde901a815de02578253a2b89d5d1ba3d42f2ce208f476c8672c1f441.exe
File created	C:\Windows\System\VVRTIPL.exe	e865367bde901a815de02578253a2b89d5d1ba3d42f2ce208f476c8672c1f441.exe
File created	C:\Windows\System\hSChPsB.exe	e865367bde901a815de02578253a2b89d5d1ba3d42f2ce208f476c8672c1f441.exe
File created	C:\Windows\System\CRbPoIS.exe	e865367bde901a815de02578253a2b89d5d1ba3d42f2ce208f476c8672c1f441.exe
File created	C:\Windows\System\YbPmDpZ.exe	e865367bde901a815de02578253a2b89d5d1ba3d42f2ce208f476c8672c1f441.exe
File created	C:\Windows\System\jUYKZDU.exe	e865367bde901a815de02578253a2b89d5d1ba3d42f2ce208f476c8672c1f441.exe
File created	C:\Windows\System\pnaHZIg.exe	e865367bde901a815de02578253a2b89d5d1ba3d42f2ce208f476c8672c1f441.exe
File created	C:\Windows\System\oRmzUOR.exe	e865367bde901a815de02578253a2b89d5d1ba3d42f2ce208f476c8672c1f441.exe
File created	C:\Windows\System\zZhcfrI.exe	e865367bde901a815de02578253a2b89d5d1ba3d42f2ce208f476c8672c1f441.exe
File created	C:\Windows\System\bcYOowI.exe	e865367bde901a815de02578253a2b89d5d1ba3d42f2ce208f476c8672c1f441.exe
File created	C:\Windows\System\aLWvcRD.exe	e865367bde901a815de02578253a2b89d5d1ba3d42f2ce208f476c8672c1f441.exe
File created	C:\Windows\System\piBahvJ.exe	e865367bde901a815de02578253a2b89d5d1ba3d42f2ce208f476c8672c1f441.exe
File created	C:\Windows\System\gJjIFdk.exe	e865367bde901a815de02578253a2b89d5d1ba3d42f2ce208f476c8672c1f441.exe
File created	C:\Windows\System\UGrhoJt.exe	e865367bde901a815de02578253a2b89d5d1ba3d42f2ce208f476c8672c1f441.exe
File created	C:\Windows\System\cmyRZvn.exe	e865367bde901a815de02578253a2b89d5d1ba3d42f2ce208f476c8672c1f441.exe
File created	C:\Windows\System\VSfxYqe.exe	e865367bde901a815de02578253a2b89d5d1ba3d42f2ce208f476c8672c1f441.exe
File created	C:\Windows\System\mNTVSCr.exe	e865367bde901a815de02578253a2b89d5d1ba3d42f2ce208f476c8672c1f441.exe
File created	C:\Windows\System\CzffaxJ.exe	e865367bde901a815de02578253a2b89d5d1ba3d42f2ce208f476c8672c1f441.exe
File created	C:\Windows\System\VkYlHON.exe	e865367bde901a815de02578253a2b89d5d1ba3d42f2ce208f476c8672c1f441.exe
File created	C:\Windows\System\qjtgwhu.exe	e865367bde901a815de02578253a2b89d5d1ba3d42f2ce208f476c8672c1f441.exe
File created	C:\Windows\System\mdEUULF.exe	e865367bde901a815de02578253a2b89d5d1ba3d42f2ce208f476c8672c1f441.exe
File created	C:\Windows\System\daOuZfU.exe	e865367bde901a815de02578253a2b89d5d1ba3d42f2ce208f476c8672c1f441.exe
File created	C:\Windows\System\UDDwfOH.exe	e865367bde901a815de02578253a2b89d5d1ba3d42f2ce208f476c8672c1f441.exe
File created	C:\Windows\System\UoMeFhj.exe	e865367bde901a815de02578253a2b89d5d1ba3d42f2ce208f476c8672c1f441.exe
File created	C:\Windows\System\MKJQBMR.exe	e865367bde901a815de02578253a2b89d5d1ba3d42f2ce208f476c8672c1f441.exe
File created	C:\Windows\System\OEYnHlS.exe	e865367bde901a815de02578253a2b89d5d1ba3d42f2ce208f476c8672c1f441.exe
File created	C:\Windows\System\btKlWsK.exe	e865367bde901a815de02578253a2b89d5d1ba3d42f2ce208f476c8672c1f441.exe
File created	C:\Windows\System\lEEIqVd.exe	e865367bde901a815de02578253a2b89d5d1ba3d42f2ce208f476c8672c1f441.exe
File created	C:\Windows\System\OjtVURS.exe	e865367bde901a815de02578253a2b89d5d1ba3d42f2ce208f476c8672c1f441.exe
File created	C:\Windows\System\hhvNFkN.exe	e865367bde901a815de02578253a2b89d5d1ba3d42f2ce208f476c8672c1f441.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	17208	dwm.exe
Token: SeChangeNotifyPrivilege	17208	dwm.exe
Token: 33	17208	dwm.exe
Token: SeIncBasePriorityPrivilege	17208	dwm.exe
Token: SeShutdownPrivilege	17208	dwm.exe
Token: SeCreatePagefilePrivilege	17208	dwm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3672 wrote to memory of 3512	3672	e865367bde901a815de02578253a2b89d5d1ba3d42f2ce208f476c8672c1f441.exe	84
PID 3672 wrote to memory of 3512	3672	e865367bde901a815de02578253a2b89d5d1ba3d42f2ce208f476c8672c1f441.exe	84
PID 3672 wrote to memory of 3480	3672	e865367bde901a815de02578253a2b89d5d1ba3d42f2ce208f476c8672c1f441.exe	85
PID 3672 wrote to memory of 3480	3672	e865367bde901a815de02578253a2b89d5d1ba3d42f2ce208f476c8672c1f441.exe	85
PID 3672 wrote to memory of 5032	3672	e865367bde901a815de02578253a2b89d5d1ba3d42f2ce208f476c8672c1f441.exe	86
PID 3672 wrote to memory of 5032	3672	e865367bde901a815de02578253a2b89d5d1ba3d42f2ce208f476c8672c1f441.exe	86
PID 3672 wrote to memory of 3356	3672	e865367bde901a815de02578253a2b89d5d1ba3d42f2ce208f476c8672c1f441.exe	87
PID 3672 wrote to memory of 3356	3672	e865367bde901a815de02578253a2b89d5d1ba3d42f2ce208f476c8672c1f441.exe	87
PID 3672 wrote to memory of 4924	3672	e865367bde901a815de02578253a2b89d5d1ba3d42f2ce208f476c8672c1f441.exe	88
PID 3672 wrote to memory of 4924	3672	e865367bde901a815de02578253a2b89d5d1ba3d42f2ce208f476c8672c1f441.exe	88
PID 3672 wrote to memory of 3868	3672	e865367bde901a815de02578253a2b89d5d1ba3d42f2ce208f476c8672c1f441.exe	89
PID 3672 wrote to memory of 3868	3672	e865367bde901a815de02578253a2b89d5d1ba3d42f2ce208f476c8672c1f441.exe	89
PID 3672 wrote to memory of 3092	3672	e865367bde901a815de02578253a2b89d5d1ba3d42f2ce208f476c8672c1f441.exe	90
PID 3672 wrote to memory of 3092	3672	e865367bde901a815de02578253a2b89d5d1ba3d42f2ce208f476c8672c1f441.exe	90
PID 3672 wrote to memory of 4648	3672	e865367bde901a815de02578253a2b89d5d1ba3d42f2ce208f476c8672c1f441.exe	91
PID 3672 wrote to memory of 4648	3672	e865367bde901a815de02578253a2b89d5d1ba3d42f2ce208f476c8672c1f441.exe	91
PID 3672 wrote to memory of 412	3672	e865367bde901a815de02578253a2b89d5d1ba3d42f2ce208f476c8672c1f441.exe	92
PID 3672 wrote to memory of 412	3672	e865367bde901a815de02578253a2b89d5d1ba3d42f2ce208f476c8672c1f441.exe	92
PID 3672 wrote to memory of 4020	3672	e865367bde901a815de02578253a2b89d5d1ba3d42f2ce208f476c8672c1f441.exe	93
PID 3672 wrote to memory of 4020	3672	e865367bde901a815de02578253a2b89d5d1ba3d42f2ce208f476c8672c1f441.exe	93
PID 3672 wrote to memory of 3936	3672	e865367bde901a815de02578253a2b89d5d1ba3d42f2ce208f476c8672c1f441.exe	94
PID 3672 wrote to memory of 3936	3672	e865367bde901a815de02578253a2b89d5d1ba3d42f2ce208f476c8672c1f441.exe	94
PID 3672 wrote to memory of 2924	3672	e865367bde901a815de02578253a2b89d5d1ba3d42f2ce208f476c8672c1f441.exe	95
PID 3672 wrote to memory of 2924	3672	e865367bde901a815de02578253a2b89d5d1ba3d42f2ce208f476c8672c1f441.exe	95
PID 3672 wrote to memory of 528	3672	e865367bde901a815de02578253a2b89d5d1ba3d42f2ce208f476c8672c1f441.exe	96
PID 3672 wrote to memory of 528	3672	e865367bde901a815de02578253a2b89d5d1ba3d42f2ce208f476c8672c1f441.exe	96
PID 3672 wrote to memory of 1608	3672	e865367bde901a815de02578253a2b89d5d1ba3d42f2ce208f476c8672c1f441.exe	97
PID 3672 wrote to memory of 1608	3672	e865367bde901a815de02578253a2b89d5d1ba3d42f2ce208f476c8672c1f441.exe	97
PID 3672 wrote to memory of 2596	3672	e865367bde901a815de02578253a2b89d5d1ba3d42f2ce208f476c8672c1f441.exe	98
PID 3672 wrote to memory of 2596	3672	e865367bde901a815de02578253a2b89d5d1ba3d42f2ce208f476c8672c1f441.exe	98
PID 3672 wrote to memory of 4548	3672	e865367bde901a815de02578253a2b89d5d1ba3d42f2ce208f476c8672c1f441.exe	99
PID 3672 wrote to memory of 4548	3672	e865367bde901a815de02578253a2b89d5d1ba3d42f2ce208f476c8672c1f441.exe	99
PID 3672 wrote to memory of 396	3672	e865367bde901a815de02578253a2b89d5d1ba3d42f2ce208f476c8672c1f441.exe	100
PID 3672 wrote to memory of 396	3672	e865367bde901a815de02578253a2b89d5d1ba3d42f2ce208f476c8672c1f441.exe	100
PID 3672 wrote to memory of 856	3672	e865367bde901a815de02578253a2b89d5d1ba3d42f2ce208f476c8672c1f441.exe	101
PID 3672 wrote to memory of 856	3672	e865367bde901a815de02578253a2b89d5d1ba3d42f2ce208f476c8672c1f441.exe	101
PID 3672 wrote to memory of 4144	3672	e865367bde901a815de02578253a2b89d5d1ba3d42f2ce208f476c8672c1f441.exe	102
PID 3672 wrote to memory of 4144	3672	e865367bde901a815de02578253a2b89d5d1ba3d42f2ce208f476c8672c1f441.exe	102
PID 3672 wrote to memory of 3676	3672	e865367bde901a815de02578253a2b89d5d1ba3d42f2ce208f476c8672c1f441.exe	103
PID 3672 wrote to memory of 3676	3672	e865367bde901a815de02578253a2b89d5d1ba3d42f2ce208f476c8672c1f441.exe	103
PID 3672 wrote to memory of 1852	3672	e865367bde901a815de02578253a2b89d5d1ba3d42f2ce208f476c8672c1f441.exe	104
PID 3672 wrote to memory of 1852	3672	e865367bde901a815de02578253a2b89d5d1ba3d42f2ce208f476c8672c1f441.exe	104
PID 3672 wrote to memory of 2552	3672	e865367bde901a815de02578253a2b89d5d1ba3d42f2ce208f476c8672c1f441.exe	105
PID 3672 wrote to memory of 2552	3672	e865367bde901a815de02578253a2b89d5d1ba3d42f2ce208f476c8672c1f441.exe	105
PID 3672 wrote to memory of 4960	3672	e865367bde901a815de02578253a2b89d5d1ba3d42f2ce208f476c8672c1f441.exe	106
PID 3672 wrote to memory of 4960	3672	e865367bde901a815de02578253a2b89d5d1ba3d42f2ce208f476c8672c1f441.exe	106
PID 3672 wrote to memory of 3424	3672	e865367bde901a815de02578253a2b89d5d1ba3d42f2ce208f476c8672c1f441.exe	107
PID 3672 wrote to memory of 3424	3672	e865367bde901a815de02578253a2b89d5d1ba3d42f2ce208f476c8672c1f441.exe	107
PID 3672 wrote to memory of 2328	3672	e865367bde901a815de02578253a2b89d5d1ba3d42f2ce208f476c8672c1f441.exe	108
PID 3672 wrote to memory of 2328	3672	e865367bde901a815de02578253a2b89d5d1ba3d42f2ce208f476c8672c1f441.exe	108
PID 3672 wrote to memory of 5072	3672	e865367bde901a815de02578253a2b89d5d1ba3d42f2ce208f476c8672c1f441.exe	109
PID 3672 wrote to memory of 5072	3672	e865367bde901a815de02578253a2b89d5d1ba3d42f2ce208f476c8672c1f441.exe	109
PID 3672 wrote to memory of 4488	3672	e865367bde901a815de02578253a2b89d5d1ba3d42f2ce208f476c8672c1f441.exe	110
PID 3672 wrote to memory of 4488	3672	e865367bde901a815de02578253a2b89d5d1ba3d42f2ce208f476c8672c1f441.exe	110
PID 3672 wrote to memory of 868	3672	e865367bde901a815de02578253a2b89d5d1ba3d42f2ce208f476c8672c1f441.exe	111
PID 3672 wrote to memory of 868	3672	e865367bde901a815de02578253a2b89d5d1ba3d42f2ce208f476c8672c1f441.exe	111
PID 3672 wrote to memory of 3432	3672	e865367bde901a815de02578253a2b89d5d1ba3d42f2ce208f476c8672c1f441.exe	112
PID 3672 wrote to memory of 3432	3672	e865367bde901a815de02578253a2b89d5d1ba3d42f2ce208f476c8672c1f441.exe	112
PID 3672 wrote to memory of 4576	3672	e865367bde901a815de02578253a2b89d5d1ba3d42f2ce208f476c8672c1f441.exe	113
PID 3672 wrote to memory of 4576	3672	e865367bde901a815de02578253a2b89d5d1ba3d42f2ce208f476c8672c1f441.exe	113
PID 3672 wrote to memory of 2196	3672	e865367bde901a815de02578253a2b89d5d1ba3d42f2ce208f476c8672c1f441.exe	114
PID 3672 wrote to memory of 2196	3672	e865367bde901a815de02578253a2b89d5d1ba3d42f2ce208f476c8672c1f441.exe	114
PID 3672 wrote to memory of 3448	3672	e865367bde901a815de02578253a2b89d5d1ba3d42f2ce208f476c8672c1f441.exe	115
PID 3672 wrote to memory of 3448	3672	e865367bde901a815de02578253a2b89d5d1ba3d42f2ce208f476c8672c1f441.exe	115

C:\Users\Admin\AppData\Local\Temp\e865367bde901a815de02578253a2b89d5d1ba3d42f2ce208f476c8672c1f441.exe
"C:\Users\Admin\AppData\Local\Temp\e865367bde901a815de02578253a2b89d5d1ba3d42f2ce208f476c8672c1f441.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3672
- C:\Windows\System\NDbIrBw.exe
  C:\Windows\System\NDbIrBw.exe
  2⤵
  - Executes dropped EXE
  PID:3512
- C:\Windows\System\SjVVNME.exe
  C:\Windows\System\SjVVNME.exe
  2⤵
  - Executes dropped EXE
  PID:3480
- C:\Windows\System\srEohEu.exe
  C:\Windows\System\srEohEu.exe
  2⤵
  - Executes dropped EXE
  PID:5032
- C:\Windows\System\HWdcjTf.exe
  C:\Windows\System\HWdcjTf.exe
  2⤵
  - Executes dropped EXE
  PID:3356
- C:\Windows\System\LaLCfNR.exe
  C:\Windows\System\LaLCfNR.exe
  2⤵
  - Executes dropped EXE
  PID:4924
- C:\Windows\System\zCuMlHS.exe
  C:\Windows\System\zCuMlHS.exe
  2⤵
  - Executes dropped EXE
  PID:3868
- C:\Windows\System\rJnyLaT.exe
  C:\Windows\System\rJnyLaT.exe
  2⤵
  - Executes dropped EXE
  PID:3092
- C:\Windows\System\xmRtPnI.exe
  C:\Windows\System\xmRtPnI.exe
  2⤵
  - Executes dropped EXE
  PID:4648
- C:\Windows\System\bGxpplf.exe
  C:\Windows\System\bGxpplf.exe
  2⤵
  - Executes dropped EXE
  PID:412
- C:\Windows\System\cUAciaV.exe
  C:\Windows\System\cUAciaV.exe
  2⤵
  - Executes dropped EXE
  PID:4020
- C:\Windows\System\hlhLQWD.exe
  C:\Windows\System\hlhLQWD.exe
  2⤵
  - Executes dropped EXE
  PID:3936
- C:\Windows\System\kCMTAYU.exe
  C:\Windows\System\kCMTAYU.exe
  2⤵
  - Executes dropped EXE
  PID:2924
- C:\Windows\System\VSfxYqe.exe
  C:\Windows\System\VSfxYqe.exe
  2⤵
  - Executes dropped EXE
  PID:528
- C:\Windows\System\XDvNqEX.exe
  C:\Windows\System\XDvNqEX.exe
  2⤵
  - Executes dropped EXE
  PID:1608
- C:\Windows\System\wsCmdEK.exe
  C:\Windows\System\wsCmdEK.exe
  2⤵
  - Executes dropped EXE
  PID:2596
- C:\Windows\System\piBahvJ.exe
  C:\Windows\System\piBahvJ.exe
  2⤵
  - Executes dropped EXE
  PID:4548
- C:\Windows\System\hJbQbJn.exe
  C:\Windows\System\hJbQbJn.exe
  2⤵
  - Executes dropped EXE
  PID:396
- C:\Windows\System\qCiRPGK.exe
  C:\Windows\System\qCiRPGK.exe
  2⤵
  - Executes dropped EXE
  PID:856
- C:\Windows\System\ILkOrnN.exe
  C:\Windows\System\ILkOrnN.exe
  2⤵
  - Executes dropped EXE
  PID:4144
- C:\Windows\System\eksHgzi.exe
  C:\Windows\System\eksHgzi.exe
  2⤵
  - Executes dropped EXE
  PID:3676
- C:\Windows\System\NIFvelk.exe
  C:\Windows\System\NIFvelk.exe
  2⤵
  - Executes dropped EXE
  PID:1852
- C:\Windows\System\SJyGzFy.exe
  C:\Windows\System\SJyGzFy.exe
  2⤵
  - Executes dropped EXE
  PID:2552
- C:\Windows\System\ulKHhTH.exe
  C:\Windows\System\ulKHhTH.exe
  2⤵
  - Executes dropped EXE
  PID:4960
- C:\Windows\System\yBpntQg.exe
  C:\Windows\System\yBpntQg.exe
  2⤵
  - Executes dropped EXE
  PID:3424
- C:\Windows\System\zFyMKcM.exe
  C:\Windows\System\zFyMKcM.exe
  2⤵
  - Executes dropped EXE
  PID:2328
- C:\Windows\System\ejzPMGu.exe
  C:\Windows\System\ejzPMGu.exe
  2⤵
  - Executes dropped EXE
  PID:5072
- C:\Windows\System\TGtrocG.exe
  C:\Windows\System\TGtrocG.exe
  2⤵
  - Executes dropped EXE
  PID:4488
- C:\Windows\System\JRtvfBO.exe
  C:\Windows\System\JRtvfBO.exe
  2⤵
  - Executes dropped EXE
  PID:868
- C:\Windows\System\GwQunwg.exe
  C:\Windows\System\GwQunwg.exe
  2⤵
  - Executes dropped EXE
  PID:3432
- C:\Windows\System\WzkxGRA.exe
  C:\Windows\System\WzkxGRA.exe
  2⤵
  - Executes dropped EXE
  PID:4576
- C:\Windows\System\YKZeNCb.exe
  C:\Windows\System\YKZeNCb.exe
  2⤵
  - Executes dropped EXE
  PID:2196
- C:\Windows\System\LGHxGiI.exe
  C:\Windows\System\LGHxGiI.exe
  2⤵
  - Executes dropped EXE
  PID:3448
- C:\Windows\System\JasNhxu.exe
  C:\Windows\System\JasNhxu.exe
  2⤵
  - Executes dropped EXE
  PID:1000
- C:\Windows\System\ZjnSXZB.exe
  C:\Windows\System\ZjnSXZB.exe
  2⤵
  - Executes dropped EXE
  PID:4952
- C:\Windows\System\ArIsGAl.exe
  C:\Windows\System\ArIsGAl.exe
  2⤵
  - Executes dropped EXE
  PID:5112
- C:\Windows\System\ErsJpHv.exe
  C:\Windows\System\ErsJpHv.exe
  2⤵
  - Executes dropped EXE
  PID:4580
- C:\Windows\System\ywoRsCW.exe
  C:\Windows\System\ywoRsCW.exe
  2⤵
  - Executes dropped EXE
  PID:2688
- C:\Windows\System\ICaglnI.exe
  C:\Windows\System\ICaglnI.exe
  2⤵
  - Executes dropped EXE
  PID:4304
- C:\Windows\System\WfcPxOB.exe
  C:\Windows\System\WfcPxOB.exe
  2⤵
  - Executes dropped EXE
  PID:4184
- C:\Windows\System\icVYyuh.exe
  C:\Windows\System\icVYyuh.exe
  2⤵
  - Executes dropped EXE
  PID:4912
- C:\Windows\System\SBFgeei.exe
  C:\Windows\System\SBFgeei.exe
  2⤵
  - Executes dropped EXE
  PID:5024
- C:\Windows\System\mujXUPe.exe
  C:\Windows\System\mujXUPe.exe
  2⤵
  - Executes dropped EXE
  PID:2616
- C:\Windows\System\AksABox.exe
  C:\Windows\System\AksABox.exe
  2⤵
  - Executes dropped EXE
  PID:4084
- C:\Windows\System\ZVDjxPD.exe
  C:\Windows\System\ZVDjxPD.exe
  2⤵
  - Executes dropped EXE
  PID:4024
- C:\Windows\System\KDCpIRH.exe
  C:\Windows\System\KDCpIRH.exe
  2⤵
  - Executes dropped EXE
  PID:4928
- C:\Windows\System\uwDGPWJ.exe
  C:\Windows\System\uwDGPWJ.exe
  2⤵
  - Executes dropped EXE
  PID:1340
- C:\Windows\System\rUNwTDj.exe
  C:\Windows\System\rUNwTDj.exe
  2⤵
  - Executes dropped EXE
  PID:3460
- C:\Windows\System\GrRrKIe.exe
  C:\Windows\System\GrRrKIe.exe
  2⤵
  - Executes dropped EXE
  PID:4440
- C:\Windows\System\iUyhSml.exe
  C:\Windows\System\iUyhSml.exe
  2⤵
  - Executes dropped EXE
  PID:1216
- C:\Windows\System\zUpOdSZ.exe
  C:\Windows\System\zUpOdSZ.exe
  2⤵
  - Executes dropped EXE
  PID:3636
- C:\Windows\System\Gmtockz.exe
  C:\Windows\System\Gmtockz.exe
  2⤵
  - Executes dropped EXE
  PID:4684
- C:\Windows\System\ZtsgfKn.exe
  C:\Windows\System\ZtsgfKn.exe
  2⤵
  - Executes dropped EXE
  PID:4056
- C:\Windows\System\NQJrDDB.exe
  C:\Windows\System\NQJrDDB.exe
  2⤵
  - Executes dropped EXE
  PID:1748
- C:\Windows\System\VsZavaj.exe
  C:\Windows\System\VsZavaj.exe
  2⤵
  - Executes dropped EXE
  PID:5064
- C:\Windows\System\nVSVYDW.exe
  C:\Windows\System\nVSVYDW.exe
  2⤵
  - Executes dropped EXE
  PID:644
- C:\Windows\System\MgFuJuS.exe
  C:\Windows\System\MgFuJuS.exe
  2⤵
  - Executes dropped EXE
  PID:3292
- C:\Windows\System\SMcEfXS.exe
  C:\Windows\System\SMcEfXS.exe
  2⤵
  - Executes dropped EXE
  PID:4608
- C:\Windows\System\YiBaRjb.exe
  C:\Windows\System\YiBaRjb.exe
  2⤵
  - Executes dropped EXE
  PID:3532
- C:\Windows\System\JvjdoXo.exe
  C:\Windows\System\JvjdoXo.exe
  2⤵
  - Executes dropped EXE
  PID:3032
- C:\Windows\System\izhrGyc.exe
  C:\Windows\System\izhrGyc.exe
  2⤵
  - Executes dropped EXE
  PID:408
- C:\Windows\System\EWXmbfb.exe
  C:\Windows\System\EWXmbfb.exe
  2⤵
  - Executes dropped EXE
  PID:2600
- C:\Windows\System\wabclDe.exe
  C:\Windows\System\wabclDe.exe
  2⤵
  - Executes dropped EXE
  PID:1344
- C:\Windows\System\Mmffsvg.exe
  C:\Windows\System\Mmffsvg.exe
  2⤵
  - Executes dropped EXE
  PID:4632
- C:\Windows\System\hGPQmxx.exe
  C:\Windows\System\hGPQmxx.exe
  2⤵
  - Executes dropped EXE
  PID:4932
- C:\Windows\System\hRWKqRJ.exe
  C:\Windows\System\hRWKqRJ.exe
  2⤵
  PID:5052
- C:\Windows\System\bffoWeC.exe
  C:\Windows\System\bffoWeC.exe
  2⤵
  PID:912
- C:\Windows\System\gjcSjdw.exe
  C:\Windows\System\gjcSjdw.exe
  2⤵
  PID:2240
- C:\Windows\System\enmytIQ.exe
  C:\Windows\System\enmytIQ.exe
  2⤵
  PID:4724
- C:\Windows\System\rcNrZNF.exe
  C:\Windows\System\rcNrZNF.exe
  2⤵
  PID:4596
- C:\Windows\System\GBsNEub.exe
  C:\Windows\System\GBsNEub.exe
  2⤵
  PID:3340
- C:\Windows\System\nYmqAxU.exe
  C:\Windows\System\nYmqAxU.exe
  2⤵
  PID:3452
- C:\Windows\System\swcitzI.exe
  C:\Windows\System\swcitzI.exe
  2⤵
  PID:3476
- C:\Windows\System\addmeIH.exe
  C:\Windows\System\addmeIH.exe
  2⤵
  PID:232
- C:\Windows\System\YwAHUJH.exe
  C:\Windows\System\YwAHUJH.exe
  2⤵
  PID:5124
- C:\Windows\System\yqISmdd.exe
  C:\Windows\System\yqISmdd.exe
  2⤵
  PID:5148
- C:\Windows\System\dynOPVT.exe
  C:\Windows\System\dynOPVT.exe
  2⤵
  PID:5180
- C:\Windows\System\FgGyBkE.exe
  C:\Windows\System\FgGyBkE.exe
  2⤵
  PID:5204
- C:\Windows\System\eyGVlNt.exe
  C:\Windows\System\eyGVlNt.exe
  2⤵
  PID:5236
- C:\Windows\System\YuNjpYc.exe
  C:\Windows\System\YuNjpYc.exe
  2⤵
  PID:5260
- C:\Windows\System\aKwyhLn.exe
  C:\Windows\System\aKwyhLn.exe
  2⤵
  PID:5292
- C:\Windows\System\Wftbehy.exe
  C:\Windows\System\Wftbehy.exe
  2⤵
  PID:5316
- C:\Windows\System\AHWLrFt.exe
  C:\Windows\System\AHWLrFt.exe
  2⤵
  PID:5348
- C:\Windows\System\BCZQxDi.exe
  C:\Windows\System\BCZQxDi.exe
  2⤵
  PID:5372
- C:\Windows\System\UDDwfOH.exe
  C:\Windows\System\UDDwfOH.exe
  2⤵
  PID:5404
- C:\Windows\System\klIFiqr.exe
  C:\Windows\System\klIFiqr.exe
  2⤵
  PID:5428
- C:\Windows\System\CMsRpoQ.exe
  C:\Windows\System\CMsRpoQ.exe
  2⤵
  PID:5460
- C:\Windows\System\pVapPAY.exe
  C:\Windows\System\pVapPAY.exe
  2⤵
  PID:5484
- C:\Windows\System\EzOFhhY.exe
  C:\Windows\System\EzOFhhY.exe
  2⤵
  PID:5516
- C:\Windows\System\UVzMRRn.exe
  C:\Windows\System\UVzMRRn.exe
  2⤵
  PID:5540
- C:\Windows\System\LIPxSbm.exe
  C:\Windows\System\LIPxSbm.exe
  2⤵
  PID:5572
- C:\Windows\System\stDZyuV.exe
  C:\Windows\System\stDZyuV.exe
  2⤵
  PID:5596
- C:\Windows\System\cdIsGkk.exe
  C:\Windows\System\cdIsGkk.exe
  2⤵
  PID:5628
- C:\Windows\System\uylhCLD.exe
  C:\Windows\System\uylhCLD.exe
  2⤵
  PID:5656
- C:\Windows\System\Irffyrd.exe
  C:\Windows\System\Irffyrd.exe
  2⤵
  PID:5684
- C:\Windows\System\ZYzsJDr.exe
  C:\Windows\System\ZYzsJDr.exe
  2⤵
  PID:5712
- C:\Windows\System\kpMGfnt.exe
  C:\Windows\System\kpMGfnt.exe
  2⤵
  PID:5740
- C:\Windows\System\aqUjuUl.exe
  C:\Windows\System\aqUjuUl.exe
  2⤵
  PID:5764
- C:\Windows\System\kXIzvLq.exe
  C:\Windows\System\kXIzvLq.exe
  2⤵
  PID:5796
- C:\Windows\System\ZjCgaVK.exe
  C:\Windows\System\ZjCgaVK.exe
  2⤵
  PID:5820
- C:\Windows\System\rWCMUku.exe
  C:\Windows\System\rWCMUku.exe
  2⤵
  PID:5852
- C:\Windows\System\KYeBzEn.exe
  C:\Windows\System\KYeBzEn.exe
  2⤵
  PID:5876
- C:\Windows\System\vzanlxe.exe
  C:\Windows\System\vzanlxe.exe
  2⤵
  PID:5908
- C:\Windows\System\sviRtnv.exe
  C:\Windows\System\sviRtnv.exe
  2⤵
  PID:5932
- C:\Windows\System\SJGjbaV.exe
  C:\Windows\System\SJGjbaV.exe
  2⤵
  PID:5964
- C:\Windows\System\TABIOfi.exe
  C:\Windows\System\TABIOfi.exe
  2⤵
  PID:5988
- C:\Windows\System\JnQybwl.exe
  C:\Windows\System\JnQybwl.exe
  2⤵
  PID:6020
- C:\Windows\System\YWPkPew.exe
  C:\Windows\System\YWPkPew.exe
  2⤵
  PID:6044
- C:\Windows\System\ksAFbWK.exe
  C:\Windows\System\ksAFbWK.exe
  2⤵
  PID:6072
- C:\Windows\System\gIXHIkN.exe
  C:\Windows\System\gIXHIkN.exe
  2⤵
  PID:6104
- C:\Windows\System\ozllOQn.exe
  C:\Windows\System\ozllOQn.exe
  2⤵
  PID:6132
- C:\Windows\System\cgVmlLz.exe
  C:\Windows\System\cgVmlLz.exe
  2⤵
  PID:1328
- C:\Windows\System\ftULvzN.exe
  C:\Windows\System\ftULvzN.exe
  2⤵
  PID:4776
- C:\Windows\System\VgKsjOv.exe
  C:\Windows\System\VgKsjOv.exe
  2⤵
  PID:1584
- C:\Windows\System\WMreXJG.exe
  C:\Windows\System\WMreXJG.exe
  2⤵
  PID:3344
- C:\Windows\System\tgHwFMb.exe
  C:\Windows\System\tgHwFMb.exe
  2⤵
  PID:1612
- C:\Windows\System\IGzCcJK.exe
  C:\Windows\System\IGzCcJK.exe
  2⤵
  PID:4696
- C:\Windows\System\PzENfty.exe
  C:\Windows\System\PzENfty.exe
  2⤵
  PID:5140
- C:\Windows\System\ZeMyLEk.exe
  C:\Windows\System\ZeMyLEk.exe
  2⤵
  PID:5188
- C:\Windows\System\whVeNeP.exe
  C:\Windows\System\whVeNeP.exe
  2⤵
  PID:5256
- C:\Windows\System\ACICrLe.exe
  C:\Windows\System\ACICrLe.exe
  2⤵
  PID:5308
- C:\Windows\System\VQsOQFt.exe
  C:\Windows\System\VQsOQFt.exe
  2⤵
  PID:5384
- C:\Windows\System\zZhcfrI.exe
  C:\Windows\System\zZhcfrI.exe
  2⤵
  PID:5444
- C:\Windows\System\yjUTOPc.exe
  C:\Windows\System\yjUTOPc.exe
  2⤵
  PID:5500
- C:\Windows\System\gQeDhHi.exe
  C:\Windows\System\gQeDhHi.exe
  2⤵
  PID:5556
- C:\Windows\System\twryBWp.exe
  C:\Windows\System\twryBWp.exe
  2⤵
  PID:5636
- C:\Windows\System\UipmgSr.exe
  C:\Windows\System\UipmgSr.exe
  2⤵
  PID:5672
- C:\Windows\System\GeXCukG.exe
  C:\Windows\System\GeXCukG.exe
  2⤵
  PID:5732
- C:\Windows\System\FfEwIIs.exe
  C:\Windows\System\FfEwIIs.exe
  2⤵
  PID:5784
- C:\Windows\System\XXrddnf.exe
  C:\Windows\System\XXrddnf.exe
  2⤵
  PID:5860
- C:\Windows\System\AuhPtNm.exe
  C:\Windows\System\AuhPtNm.exe
  2⤵
  PID:5924
- C:\Windows\System\iOAcmuY.exe
  C:\Windows\System\iOAcmuY.exe
  2⤵
  PID:3168
- C:\Windows\System\alZCOLd.exe
  C:\Windows\System\alZCOLd.exe
  2⤵
  PID:4828
- C:\Windows\System\qVPnIyT.exe
  C:\Windows\System\qVPnIyT.exe
  2⤵
  PID:6084
- C:\Windows\System\FolZNzf.exe
  C:\Windows\System\FolZNzf.exe
  2⤵
  PID:6140
- C:\Windows\System\MPcQEEB.exe
  C:\Windows\System\MPcQEEB.exe
  2⤵
  PID:4516
- C:\Windows\System\iUTaAHT.exe
  C:\Windows\System\iUTaAHT.exe
  2⤵
  PID:4432
- C:\Windows\System\SQEYuaP.exe
  C:\Windows\System\SQEYuaP.exe
  2⤵
  PID:1704
- C:\Windows\System\aypWjtz.exe
  C:\Windows\System\aypWjtz.exe
  2⤵
  PID:3740
- C:\Windows\System\JNmVhSF.exe
  C:\Windows\System\JNmVhSF.exe
  2⤵
  PID:5392
- C:\Windows\System\npvDhpe.exe
  C:\Windows\System\npvDhpe.exe
  2⤵
  PID:5496
- C:\Windows\System\tkiSkHd.exe
  C:\Windows\System\tkiSkHd.exe
  2⤵
  PID:5592
- C:\Windows\System\nlPLXkH.exe
  C:\Windows\System\nlPLXkH.exe
  2⤵
  PID:5700
- C:\Windows\System\OYiStAG.exe
  C:\Windows\System\OYiStAG.exe
  2⤵
  PID:5888
- C:\Windows\System\HUDhiIz.exe
  C:\Windows\System\HUDhiIz.exe
  2⤵
  PID:5948
- C:\Windows\System\RayYJAm.exe
  C:\Windows\System\RayYJAm.exe
  2⤵
  PID:6040
- C:\Windows\System\EXjEHcR.exe
  C:\Windows\System\EXjEHcR.exe
  2⤵
  PID:3108
- C:\Windows\System\NHNaooR.exe
  C:\Windows\System\NHNaooR.exe
  2⤵
  PID:2136
- C:\Windows\System\bbcfBxk.exe
  C:\Windows\System\bbcfBxk.exe
  2⤵
  PID:5168
- C:\Windows\System\WSDGiLB.exe
  C:\Windows\System\WSDGiLB.exe
  2⤵
  PID:5336
- C:\Windows\System\KAQCuWe.exe
  C:\Windows\System\KAQCuWe.exe
  2⤵
  PID:4464
- C:\Windows\System\AhUZIUg.exe
  C:\Windows\System\AhUZIUg.exe
  2⤵
  PID:2372
- C:\Windows\System\WoDbnmj.exe
  C:\Windows\System\WoDbnmj.exe
  2⤵
  PID:3944
- C:\Windows\System\mSuleIH.exe
  C:\Windows\System\mSuleIH.exe
  2⤵
  PID:4232
- C:\Windows\System\aIvjUlw.exe
  C:\Windows\System\aIvjUlw.exe
  2⤵
  PID:1008
- C:\Windows\System\dqsfhhv.exe
  C:\Windows\System\dqsfhhv.exe
  2⤵
  PID:1368
- C:\Windows\System\ROJHpuK.exe
  C:\Windows\System\ROJHpuK.exe
  2⤵
  PID:4312
- C:\Windows\System\JrbLPTE.exe
  C:\Windows\System\JrbLPTE.exe
  2⤵
  PID:4836
- C:\Windows\System\HEBkQgq.exe
  C:\Windows\System\HEBkQgq.exe
  2⤵
  PID:4448
- C:\Windows\System\grAtNQP.exe
  C:\Windows\System\grAtNQP.exe
  2⤵
  PID:1512
- C:\Windows\System\MkwaeUx.exe
  C:\Windows\System\MkwaeUx.exe
  2⤵
  PID:4972
- C:\Windows\System\QTmjySZ.exe
  C:\Windows\System\QTmjySZ.exe
  2⤵
  PID:4908
- C:\Windows\System\vpEUcix.exe
  C:\Windows\System\vpEUcix.exe
  2⤵
  PID:2996
- C:\Windows\System\mdEUULF.exe
  C:\Windows\System\mdEUULF.exe
  2⤵
  PID:1360
- C:\Windows\System\kurkSyN.exe
  C:\Windows\System\kurkSyN.exe
  2⤵
  PID:3428
- C:\Windows\System\JKYtavW.exe
  C:\Windows\System\JKYtavW.exe
  2⤵
  PID:2276
- C:\Windows\System\zhnncVN.exe
  C:\Windows\System\zhnncVN.exe
  2⤵
  PID:5004
- C:\Windows\System\AaDeVXA.exe
  C:\Windows\System\AaDeVXA.exe
  2⤵
  PID:4936
- C:\Windows\System\OxzJQPi.exe
  C:\Windows\System\OxzJQPi.exe
  2⤵
  PID:2204
- C:\Windows\System\eQKCOVf.exe
  C:\Windows\System\eQKCOVf.exe
  2⤵
  PID:5108
- C:\Windows\System\jyZEabe.exe
  C:\Windows\System\jyZEabe.exe
  2⤵
  PID:4712
- C:\Windows\System\AHROTBV.exe
  C:\Windows\System\AHROTBV.exe
  2⤵
  PID:4660
- C:\Windows\System\NIHwIjh.exe
  C:\Windows\System\NIHwIjh.exe
  2⤵
  PID:5896
- C:\Windows\System\RwVexrN.exe
  C:\Windows\System\RwVexrN.exe
  2⤵
  PID:5080
- C:\Windows\System\nLpKoQC.exe
  C:\Windows\System\nLpKoQC.exe
  2⤵
  PID:2352
- C:\Windows\System\mNTVSCr.exe
  C:\Windows\System\mNTVSCr.exe
  2⤵
  PID:2232
- C:\Windows\System\zRcCVvy.exe
  C:\Windows\System\zRcCVvy.exe
  2⤵
  PID:3088
- C:\Windows\System\ElTKzgI.exe
  C:\Windows\System\ElTKzgI.exe
  2⤵
  PID:3204
- C:\Windows\System\MclYyhK.exe
  C:\Windows\System\MclYyhK.exe
  2⤵
  PID:2000
- C:\Windows\System\TMiLnhV.exe
  C:\Windows\System\TMiLnhV.exe
  2⤵
  PID:6180
- C:\Windows\System\EgdGImJ.exe
  C:\Windows\System\EgdGImJ.exe
  2⤵
  PID:6212
- C:\Windows\System\thzmgpY.exe
  C:\Windows\System\thzmgpY.exe
  2⤵
  PID:6244
- C:\Windows\System\akVoqNc.exe
  C:\Windows\System\akVoqNc.exe
  2⤵
  PID:6268
- C:\Windows\System\NWTZOjH.exe
  C:\Windows\System\NWTZOjH.exe
  2⤵
  PID:6288
- C:\Windows\System\bqfGTFE.exe
  C:\Windows\System\bqfGTFE.exe
  2⤵
  PID:6316
- C:\Windows\System\ydiaxhk.exe
  C:\Windows\System\ydiaxhk.exe
  2⤵
  PID:6340
- C:\Windows\System\OGNlafy.exe
  C:\Windows\System\OGNlafy.exe
  2⤵
  PID:6368
- C:\Windows\System\yFqpFfa.exe
  C:\Windows\System\yFqpFfa.exe
  2⤵
  PID:6384
- C:\Windows\System\TliIXmo.exe
  C:\Windows\System\TliIXmo.exe
  2⤵
  PID:6412
- C:\Windows\System\SQObtmt.exe
  C:\Windows\System\SQObtmt.exe
  2⤵
  PID:6436
- C:\Windows\System\efCdPpR.exe
  C:\Windows\System\efCdPpR.exe
  2⤵
  PID:6460
- C:\Windows\System\aPscbLN.exe
  C:\Windows\System\aPscbLN.exe
  2⤵
  PID:6488
- C:\Windows\System\oLUEgwA.exe
  C:\Windows\System\oLUEgwA.exe
  2⤵
  PID:6524
- C:\Windows\System\tOPejkk.exe
  C:\Windows\System\tOPejkk.exe
  2⤵
  PID:6568
- C:\Windows\System\QYDaEIM.exe
  C:\Windows\System\QYDaEIM.exe
  2⤵
  PID:6596
- C:\Windows\System\gbtdyAi.exe
  C:\Windows\System\gbtdyAi.exe
  2⤵
  PID:6620
- C:\Windows\System\DbXnhFC.exe
  C:\Windows\System\DbXnhFC.exe
  2⤵
  PID:6660
- C:\Windows\System\RhmbFAn.exe
  C:\Windows\System\RhmbFAn.exe
  2⤵
  PID:6676
- C:\Windows\System\hhwmCfD.exe
  C:\Windows\System\hhwmCfD.exe
  2⤵
  PID:6692
- C:\Windows\System\KUgjTRP.exe
  C:\Windows\System\KUgjTRP.exe
  2⤵
  PID:6752
- C:\Windows\System\XLfuwof.exe
  C:\Windows\System\XLfuwof.exe
  2⤵
  PID:6772
- C:\Windows\System\PkNROeU.exe
  C:\Windows\System\PkNROeU.exe
  2⤵
  PID:6788
- C:\Windows\System\sfisAtx.exe
  C:\Windows\System\sfisAtx.exe
  2⤵
  PID:6808
- C:\Windows\System\szxUeXn.exe
  C:\Windows\System\szxUeXn.exe
  2⤵
  PID:6824
- C:\Windows\System\yORVywp.exe
  C:\Windows\System\yORVywp.exe
  2⤵
  PID:6852
- C:\Windows\System\DXZOwuI.exe
  C:\Windows\System\DXZOwuI.exe
  2⤵
  PID:6876
- C:\Windows\System\RBjCYly.exe
  C:\Windows\System\RBjCYly.exe
  2⤵
  PID:6900
- C:\Windows\System\gjxfMGs.exe
  C:\Windows\System\gjxfMGs.exe
  2⤵
  PID:6952
- C:\Windows\System\fynoVCZ.exe
  C:\Windows\System\fynoVCZ.exe
  2⤵
  PID:6984
- C:\Windows\System\BhhyCqq.exe
  C:\Windows\System\BhhyCqq.exe
  2⤵
  PID:7008
- C:\Windows\System\wazMxkg.exe
  C:\Windows\System\wazMxkg.exe
  2⤵
  PID:7032
- C:\Windows\System\dHtnVtq.exe
  C:\Windows\System\dHtnVtq.exe
  2⤵
  PID:7056
- C:\Windows\System\zbPAnNZ.exe
  C:\Windows\System\zbPAnNZ.exe
  2⤵
  PID:7084
- C:\Windows\System\rtWvAcR.exe
  C:\Windows\System\rtWvAcR.exe
  2⤵
  PID:7108
- C:\Windows\System\YUHAyip.exe
  C:\Windows\System\YUHAyip.exe
  2⤵
  PID:7136
- C:\Windows\System\grhaAbo.exe
  C:\Windows\System\grhaAbo.exe
  2⤵
  PID:6152
- C:\Windows\System\jfEplsc.exe
  C:\Windows\System\jfEplsc.exe
  2⤵
  PID:6240
- C:\Windows\System\FbHnmNK.exe
  C:\Windows\System\FbHnmNK.exe
  2⤵
  PID:6260
- C:\Windows\System\sPbYUok.exe
  C:\Windows\System\sPbYUok.exe
  2⤵
  PID:6328
- C:\Windows\System\wNSdQMu.exe
  C:\Windows\System\wNSdQMu.exe
  2⤵
  PID:464
- C:\Windows\System\uYkLCXQ.exe
  C:\Windows\System\uYkLCXQ.exe
  2⤵
  PID:6448
- C:\Windows\System\zDwtxTr.exe
  C:\Windows\System\zDwtxTr.exe
  2⤵
  PID:6584
- C:\Windows\System\vpFZbEn.exe
  C:\Windows\System\vpFZbEn.exe
  2⤵
  PID:6628
- C:\Windows\System\ceTTzOT.exe
  C:\Windows\System\ceTTzOT.exe
  2⤵
  PID:6716
- C:\Windows\System\HFheiuG.exe
  C:\Windows\System\HFheiuG.exe
  2⤵
  PID:6724
- C:\Windows\System\zhONeel.exe
  C:\Windows\System\zhONeel.exe
  2⤵
  PID:6800
- C:\Windows\System\oWAdyur.exe
  C:\Windows\System\oWAdyur.exe
  2⤵
  PID:6840
- C:\Windows\System\dJSrqBn.exe
  C:\Windows\System\dJSrqBn.exe
  2⤵
  PID:6928
- C:\Windows\System\qOJWjYk.exe
  C:\Windows\System\qOJWjYk.exe
  2⤵
  PID:7016
- C:\Windows\System\WSnxTnv.exe
  C:\Windows\System\WSnxTnv.exe
  2⤵
  PID:7048
- C:\Windows\System\gLrVCYT.exe
  C:\Windows\System\gLrVCYT.exe
  2⤵
  PID:7100
- C:\Windows\System\kfyvEJJ.exe
  C:\Windows\System\kfyvEJJ.exe
  2⤵
  PID:4700
- C:\Windows\System\ErZOPwR.exe
  C:\Windows\System\ErZOPwR.exe
  2⤵
  PID:6296
- C:\Windows\System\NQetxvX.exe
  C:\Windows\System\NQetxvX.exe
  2⤵
  PID:6380
- C:\Windows\System\AwiyDxV.exe
  C:\Windows\System\AwiyDxV.exe
  2⤵
  PID:6552
- C:\Windows\System\CekhZsP.exe
  C:\Windows\System\CekhZsP.exe
  2⤵
  PID:6652
- C:\Windows\System\edtpRvF.exe
  C:\Windows\System\edtpRvF.exe
  2⤵
  PID:6884
- C:\Windows\System\tiikcKK.exe
  C:\Windows\System\tiikcKK.exe
  2⤵
  PID:7096
- C:\Windows\System\IXgocrU.exe
  C:\Windows\System\IXgocrU.exe
  2⤵
  PID:6232
- C:\Windows\System\tXwnqYo.exe
  C:\Windows\System\tXwnqYo.exe
  2⤵
  PID:6556
- C:\Windows\System\XLrFAHJ.exe
  C:\Windows\System\XLrFAHJ.exe
  2⤵
  PID:6784
- C:\Windows\System\UfnROlC.exe
  C:\Windows\System\UfnROlC.exe
  2⤵
  PID:6360
- C:\Windows\System\NlYXPGU.exe
  C:\Windows\System\NlYXPGU.exe
  2⤵
  PID:7184
- C:\Windows\System\IgImaLZ.exe
  C:\Windows\System\IgImaLZ.exe
  2⤵
  PID:7208
- C:\Windows\System\FPFMDug.exe
  C:\Windows\System\FPFMDug.exe
  2⤵
  PID:7232
- C:\Windows\System\lGGXydZ.exe
  C:\Windows\System\lGGXydZ.exe
  2⤵
  PID:7260
- C:\Windows\System\MiRXYNt.exe
  C:\Windows\System\MiRXYNt.exe
  2⤵
  PID:7288
- C:\Windows\System\gwuVFPs.exe
  C:\Windows\System\gwuVFPs.exe
  2⤵
  PID:7304
- C:\Windows\System\hhSJkYE.exe
  C:\Windows\System\hhSJkYE.exe
  2⤵
  PID:7332
- C:\Windows\System\XqmQdwM.exe
  C:\Windows\System\XqmQdwM.exe
  2⤵
  PID:7356
- C:\Windows\System\ACJWuAH.exe
  C:\Windows\System\ACJWuAH.exe
  2⤵
  PID:7400
- C:\Windows\System\WiIuqxL.exe
  C:\Windows\System\WiIuqxL.exe
  2⤵
  PID:7440
- C:\Windows\System\KXgUtIq.exe
  C:\Windows\System\KXgUtIq.exe
  2⤵
  PID:7460
- C:\Windows\System\ivdnBDz.exe
  C:\Windows\System\ivdnBDz.exe
  2⤵
  PID:7488
- C:\Windows\System\UtRZAFm.exe
  C:\Windows\System\UtRZAFm.exe
  2⤵
  PID:7512
- C:\Windows\System\aUEWrJb.exe
  C:\Windows\System\aUEWrJb.exe
  2⤵
  PID:7532
- C:\Windows\System\LhVYQQT.exe
  C:\Windows\System\LhVYQQT.exe
  2⤵
  PID:7556
- C:\Windows\System\JekxwQK.exe
  C:\Windows\System\JekxwQK.exe
  2⤵
  PID:7572
- C:\Windows\System\bwCcRDd.exe
  C:\Windows\System\bwCcRDd.exe
  2⤵
  PID:7600
- C:\Windows\System\BDFWcbb.exe
  C:\Windows\System\BDFWcbb.exe
  2⤵
  PID:7640
- C:\Windows\System\dlOmoaL.exe
  C:\Windows\System\dlOmoaL.exe
  2⤵
  PID:7672
- C:\Windows\System\eHEfaKW.exe
  C:\Windows\System\eHEfaKW.exe
  2⤵
  PID:7700
- C:\Windows\System\HRVcKRI.exe
  C:\Windows\System\HRVcKRI.exe
  2⤵
  PID:7724
- C:\Windows\System\WhqkWdk.exe
  C:\Windows\System\WhqkWdk.exe
  2⤵
  PID:7760
- C:\Windows\System\DIiVFWS.exe
  C:\Windows\System\DIiVFWS.exe
  2⤵
  PID:7784
- C:\Windows\System\NgfjxUw.exe
  C:\Windows\System\NgfjxUw.exe
  2⤵
  PID:7824
- C:\Windows\System\IucyVmC.exe
  C:\Windows\System\IucyVmC.exe
  2⤵
  PID:7848
- C:\Windows\System\SEISIML.exe
  C:\Windows\System\SEISIML.exe
  2⤵
  PID:7872
- C:\Windows\System\OTedexo.exe
  C:\Windows\System\OTedexo.exe
  2⤵
  PID:7904
- C:\Windows\System\txNqFaJ.exe
  C:\Windows\System\txNqFaJ.exe
  2⤵
  PID:7936
- C:\Windows\System\IKYjAOM.exe
  C:\Windows\System\IKYjAOM.exe
  2⤵
  PID:7956
- C:\Windows\System\YTnxiDu.exe
  C:\Windows\System\YTnxiDu.exe
  2⤵
  PID:7988
- C:\Windows\System\HeqLptl.exe
  C:\Windows\System\HeqLptl.exe
  2⤵
  PID:8008
- C:\Windows\System\CFGGrKt.exe
  C:\Windows\System\CFGGrKt.exe
  2⤵
  PID:8024
- C:\Windows\System\DPXgQxl.exe
  C:\Windows\System\DPXgQxl.exe
  2⤵
  PID:8052
- C:\Windows\System\HqSwmbh.exe
  C:\Windows\System\HqSwmbh.exe
  2⤵
  PID:8088
- C:\Windows\System\RYMqQRu.exe
  C:\Windows\System\RYMqQRu.exe
  2⤵
  PID:8104
- C:\Windows\System\vbNkjKj.exe
  C:\Windows\System\vbNkjKj.exe
  2⤵
  PID:8132
- C:\Windows\System\TdjACBY.exe
  C:\Windows\System\TdjACBY.exe
  2⤵
  PID:8188
- C:\Windows\System\edzKDIp.exe
  C:\Windows\System\edzKDIp.exe
  2⤵
  PID:6672
- C:\Windows\System\epdOBnD.exe
  C:\Windows\System\epdOBnD.exe
  2⤵
  PID:7228
- C:\Windows\System\VArsdSW.exe
  C:\Windows\System\VArsdSW.exe
  2⤵
  PID:7268
- C:\Windows\System\mIfxJXN.exe
  C:\Windows\System\mIfxJXN.exe
  2⤵
  PID:7380
- C:\Windows\System\zMvSdHY.exe
  C:\Windows\System\zMvSdHY.exe
  2⤵
  PID:7436
- C:\Windows\System\YOpGvma.exe
  C:\Windows\System\YOpGvma.exe
  2⤵
  PID:7508
- C:\Windows\System\dlmrcYR.exe
  C:\Windows\System\dlmrcYR.exe
  2⤵
  PID:7540
- C:\Windows\System\ozzxIaR.exe
  C:\Windows\System\ozzxIaR.exe
  2⤵
  PID:7596
- C:\Windows\System\kSAylkE.exe
  C:\Windows\System\kSAylkE.exe
  2⤵
  PID:7660
- C:\Windows\System\BkNGDxi.exe
  C:\Windows\System\BkNGDxi.exe
  2⤵
  PID:7776
- C:\Windows\System\fvIwMRc.exe
  C:\Windows\System\fvIwMRc.exe
  2⤵
  PID:7840
- C:\Windows\System\xKJNlSG.exe
  C:\Windows\System\xKJNlSG.exe
  2⤵
  PID:7928
- C:\Windows\System\bFxeWQW.exe
  C:\Windows\System\bFxeWQW.exe
  2⤵
  PID:7976
- C:\Windows\System\ZXSugcX.exe
  C:\Windows\System\ZXSugcX.exe
  2⤵
  PID:8040
- C:\Windows\System\PedpVTL.exe
  C:\Windows\System\PedpVTL.exe
  2⤵
  PID:8076
- C:\Windows\System\qDxAcay.exe
  C:\Windows\System\qDxAcay.exe
  2⤵
  PID:8124
- C:\Windows\System\GUjXOCL.exe
  C:\Windows\System\GUjXOCL.exe
  2⤵
  PID:8152
- C:\Windows\System\yDCvHaj.exe
  C:\Windows\System\yDCvHaj.exe
  2⤵
  PID:4600
- C:\Windows\System\FJIOcTA.exe
  C:\Windows\System\FJIOcTA.exe
  2⤵
  PID:7280
- C:\Windows\System\odvUFJX.exe
  C:\Windows\System\odvUFJX.exe
  2⤵
  PID:7484
- C:\Windows\System\QcDDDMN.exe
  C:\Windows\System\QcDDDMN.exe
  2⤵
  PID:7496
- C:\Windows\System\ByIUoCA.exe
  C:\Windows\System\ByIUoCA.exe
  2⤵
  PID:7688
- C:\Windows\System\ITUWzSa.exe
  C:\Windows\System\ITUWzSa.exe
  2⤵
  PID:7900
- C:\Windows\System\RYkEkhG.exe
  C:\Windows\System\RYkEkhG.exe
  2⤵
  PID:3628
- C:\Windows\System\BNaSWIc.exe
  C:\Windows\System\BNaSWIc.exe
  2⤵
  PID:7480
- C:\Windows\System\CRbPoIS.exe
  C:\Windows\System\CRbPoIS.exe
  2⤵
  PID:7768
- C:\Windows\System\tJpuxoc.exe
  C:\Windows\System\tJpuxoc.exe
  2⤵
  PID:7924
- C:\Windows\System\VeKBorY.exe
  C:\Windows\System\VeKBorY.exe
  2⤵
  PID:8212
- C:\Windows\System\AyDxmpf.exe
  C:\Windows\System\AyDxmpf.exe
  2⤵
  PID:8236
- C:\Windows\System\vaffthn.exe
  C:\Windows\System\vaffthn.exe
  2⤵
  PID:8264
- C:\Windows\System\dtebxpw.exe
  C:\Windows\System\dtebxpw.exe
  2⤵
  PID:8300
- C:\Windows\System\TKKctvh.exe
  C:\Windows\System\TKKctvh.exe
  2⤵
  PID:8324
- C:\Windows\System\QCTjQuM.exe
  C:\Windows\System\QCTjQuM.exe
  2⤵
  PID:8356
- C:\Windows\System\OWaoifS.exe
  C:\Windows\System\OWaoifS.exe
  2⤵
  PID:8388
- C:\Windows\System\eFpngqX.exe
  C:\Windows\System\eFpngqX.exe
  2⤵
  PID:8428
- C:\Windows\System\lABzIdO.exe
  C:\Windows\System\lABzIdO.exe
  2⤵
  PID:8464
- C:\Windows\System\EaZLPTh.exe
  C:\Windows\System\EaZLPTh.exe
  2⤵
  PID:8480
- C:\Windows\System\ftJhtsh.exe
  C:\Windows\System\ftJhtsh.exe
  2⤵
  PID:8500
- C:\Windows\System\hdpKfQM.exe
  C:\Windows\System\hdpKfQM.exe
  2⤵
  PID:8520
- C:\Windows\System\wvOAdJj.exe
  C:\Windows\System\wvOAdJj.exe
  2⤵
  PID:8572
- C:\Windows\System\XLCnmCV.exe
  C:\Windows\System\XLCnmCV.exe
  2⤵
  PID:8592
- C:\Windows\System\cWyLyhz.exe
  C:\Windows\System\cWyLyhz.exe
  2⤵
  PID:8636
- C:\Windows\System\dGftouI.exe
  C:\Windows\System\dGftouI.exe
  2⤵
  PID:8664
- C:\Windows\System\NDcqugT.exe
  C:\Windows\System\NDcqugT.exe
  2⤵
  PID:8680
- C:\Windows\System\FaKDSex.exe
  C:\Windows\System\FaKDSex.exe
  2⤵
  PID:8708
- C:\Windows\System\AJguWeQ.exe
  C:\Windows\System\AJguWeQ.exe
  2⤵
  PID:8736
- C:\Windows\System\PEOGBoq.exe
  C:\Windows\System\PEOGBoq.exe
  2⤵
  PID:8764
- C:\Windows\System\uXUYcux.exe
  C:\Windows\System\uXUYcux.exe
  2⤵
  PID:8788
- C:\Windows\System\eWuGLvu.exe
  C:\Windows\System\eWuGLvu.exe
  2⤵
  PID:8808
- C:\Windows\System\OwtsYkO.exe
  C:\Windows\System\OwtsYkO.exe
  2⤵
  PID:8832
- C:\Windows\System\IKYmqeN.exe
  C:\Windows\System\IKYmqeN.exe
  2⤵
  PID:8864
- C:\Windows\System\copUkYI.exe
  C:\Windows\System\copUkYI.exe
  2⤵
  PID:8888
- C:\Windows\System\rraYqyh.exe
  C:\Windows\System\rraYqyh.exe
  2⤵
  PID:8944
- C:\Windows\System\DsNqFZk.exe
  C:\Windows\System\DsNqFZk.exe
  2⤵
  PID:8972
- C:\Windows\System\ixMSTjf.exe
  C:\Windows\System\ixMSTjf.exe
  2⤵
  PID:8988
- C:\Windows\System\kPAKIRr.exe
  C:\Windows\System\kPAKIRr.exe
  2⤵
  PID:9012
- C:\Windows\System\trCFjyp.exe
  C:\Windows\System\trCFjyp.exe
  2⤵
  PID:9032
- C:\Windows\System\ZcWFRsH.exe
  C:\Windows\System\ZcWFRsH.exe
  2⤵
  PID:9060
- C:\Windows\System\wOxUHpN.exe
  C:\Windows\System\wOxUHpN.exe
  2⤵
  PID:9092
- C:\Windows\System\NCYUMbU.exe
  C:\Windows\System\NCYUMbU.exe
  2⤵
  PID:9116
- C:\Windows\System\hfGhhlW.exe
  C:\Windows\System\hfGhhlW.exe
  2⤵
  PID:9140
- C:\Windows\System\EdDqLjn.exe
  C:\Windows\System\EdDqLjn.exe
  2⤵
  PID:9168
- C:\Windows\System\DvtQedb.exe
  C:\Windows\System\DvtQedb.exe
  2⤵
  PID:9212
- C:\Windows\System\ffaSlzC.exe
  C:\Windows\System\ffaSlzC.exe
  2⤵
  PID:8044
- C:\Windows\System\cMYidku.exe
  C:\Windows\System\cMYidku.exe
  2⤵
  PID:8224
- C:\Windows\System\NCHTBHN.exe
  C:\Windows\System\NCHTBHN.exe
  2⤵
  PID:8252
- C:\Windows\System\fDEastZ.exe
  C:\Windows\System\fDEastZ.exe
  2⤵
  PID:8352
- C:\Windows\System\yDDprja.exe
  C:\Windows\System\yDDprja.exe
  2⤵
  PID:8472
- C:\Windows\System\xIxbjjb.exe
  C:\Windows\System\xIxbjjb.exe
  2⤵
  PID:8488
- C:\Windows\System\QRwKLbB.exe
  C:\Windows\System\QRwKLbB.exe
  2⤵
  PID:8564
- C:\Windows\System\lOjxtOs.exe
  C:\Windows\System\lOjxtOs.exe
  2⤵
  PID:8616
- C:\Windows\System\vdnCIyW.exe
  C:\Windows\System\vdnCIyW.exe
  2⤵
  PID:8676
- C:\Windows\System\CGTYegw.exe
  C:\Windows\System\CGTYegw.exe
  2⤵
  PID:8748
- C:\Windows\System\WemZVoP.exe
  C:\Windows\System\WemZVoP.exe
  2⤵
  PID:8804
- C:\Windows\System\EVZhaHc.exe
  C:\Windows\System\EVZhaHc.exe
  2⤵
  PID:8904
- C:\Windows\System\UgFtJyQ.exe
  C:\Windows\System\UgFtJyQ.exe
  2⤵
  PID:8936
- C:\Windows\System\drUtvkw.exe
  C:\Windows\System\drUtvkw.exe
  2⤵
  PID:9004
- C:\Windows\System\VVRTIPL.exe
  C:\Windows\System\VVRTIPL.exe
  2⤵
  PID:9088
- C:\Windows\System\QkDoNYw.exe
  C:\Windows\System\QkDoNYw.exe
  2⤵
  PID:9200
- C:\Windows\System\tSdRoal.exe
  C:\Windows\System\tSdRoal.exe
  2⤵
  PID:9208
- C:\Windows\System\JKCYPCt.exe
  C:\Windows\System\JKCYPCt.exe
  2⤵
  PID:7216
- C:\Windows\System\zzsQQRf.exe
  C:\Windows\System\zzsQQRf.exe
  2⤵
  PID:8020
- C:\Windows\System\HKkoFtM.exe
  C:\Windows\System\HKkoFtM.exe
  2⤵
  PID:8460
- C:\Windows\System\cohSVpi.exe
  C:\Windows\System\cohSVpi.exe
  2⤵
  PID:8540
- C:\Windows\System\sgmNyQg.exe
  C:\Windows\System\sgmNyQg.exe
  2⤵
  PID:8848
- C:\Windows\System\VUyErbw.exe
  C:\Windows\System\VUyErbw.exe
  2⤵
  PID:9052
- C:\Windows\System\ePePcTE.exe
  C:\Windows\System\ePePcTE.exe
  2⤵
  PID:7588
- C:\Windows\System\cyPJDxN.exe
  C:\Windows\System\cyPJDxN.exe
  2⤵
  PID:8204
- C:\Windows\System\OzPqZmZ.exe
  C:\Windows\System\OzPqZmZ.exe
  2⤵
  PID:8420
- C:\Windows\System\oELttxp.exe
  C:\Windows\System\oELttxp.exe
  2⤵
  PID:8924
- C:\Windows\System\wQBAijm.exe
  C:\Windows\System\wQBAijm.exe
  2⤵
  PID:8348
- C:\Windows\System\Zddirlm.exe
  C:\Windows\System\Zddirlm.exe
  2⤵
  PID:9232
- C:\Windows\System\DGtnvML.exe
  C:\Windows\System\DGtnvML.exe
  2⤵
  PID:9256
- C:\Windows\System\uiYrCfS.exe
  C:\Windows\System\uiYrCfS.exe
  2⤵
  PID:9276
- C:\Windows\System\IidLGCV.exe
  C:\Windows\System\IidLGCV.exe
  2⤵
  PID:9304
- C:\Windows\System\oWGeVIe.exe
  C:\Windows\System\oWGeVIe.exe
  2⤵
  PID:9368
- C:\Windows\System\OZPPWTh.exe
  C:\Windows\System\OZPPWTh.exe
  2⤵
  PID:9396
- C:\Windows\System\XiZPCCG.exe
  C:\Windows\System\XiZPCCG.exe
  2⤵
  PID:9424
- C:\Windows\System\SzNQmeP.exe
  C:\Windows\System\SzNQmeP.exe
  2⤵
  PID:9440
- C:\Windows\System\dJlHCIP.exe
  C:\Windows\System\dJlHCIP.exe
  2⤵
  PID:9464
- C:\Windows\System\pgzMuNy.exe
  C:\Windows\System\pgzMuNy.exe
  2⤵
  PID:9508
- C:\Windows\System\OcLgJzz.exe
  C:\Windows\System\OcLgJzz.exe
  2⤵
  PID:9524
- C:\Windows\System\PRVuWyq.exe
  C:\Windows\System\PRVuWyq.exe
  2⤵
  PID:9552
- C:\Windows\System\BOlcBPZ.exe
  C:\Windows\System\BOlcBPZ.exe
  2⤵
  PID:9584
- C:\Windows\System\WxmlwJE.exe
  C:\Windows\System\WxmlwJE.exe
  2⤵
  PID:9608
- C:\Windows\System\BKKiYea.exe
  C:\Windows\System\BKKiYea.exe
  2⤵
  PID:9636
- C:\Windows\System\jrhyjLy.exe
  C:\Windows\System\jrhyjLy.exe
  2⤵
  PID:9652
- C:\Windows\System\SJbQhdA.exe
  C:\Windows\System\SJbQhdA.exe
  2⤵
  PID:9680
- C:\Windows\System\QHfXBqm.exe
  C:\Windows\System\QHfXBqm.exe
  2⤵
  PID:9704
- C:\Windows\System\NAcwnES.exe
  C:\Windows\System\NAcwnES.exe
  2⤵
  PID:9732
- C:\Windows\System\KXNZNUx.exe
  C:\Windows\System\KXNZNUx.exe
  2⤵
  PID:9760
- C:\Windows\System\JlBuaBm.exe
  C:\Windows\System\JlBuaBm.exe
  2⤵
  PID:9784
- C:\Windows\System\bcYOowI.exe
  C:\Windows\System\bcYOowI.exe
  2⤵
  PID:9820
- C:\Windows\System\Yndfzfd.exe
  C:\Windows\System\Yndfzfd.exe
  2⤵
  PID:9844
- C:\Windows\System\wLwjPJe.exe
  C:\Windows\System\wLwjPJe.exe
  2⤵
  PID:9876
- C:\Windows\System\PJiJAmV.exe
  C:\Windows\System\PJiJAmV.exe
  2⤵
  PID:9896
- C:\Windows\System\XBRRGtZ.exe
  C:\Windows\System\XBRRGtZ.exe
  2⤵
  PID:9932
- C:\Windows\System\GSlRrgX.exe
  C:\Windows\System\GSlRrgX.exe
  2⤵
  PID:9960
- C:\Windows\System\OQIVqsh.exe
  C:\Windows\System\OQIVqsh.exe
  2⤵
  PID:9984
- C:\Windows\System\VRxKnrd.exe
  C:\Windows\System\VRxKnrd.exe
  2⤵
  PID:10020
- C:\Windows\System\SocerwX.exe
  C:\Windows\System\SocerwX.exe
  2⤵
  PID:10068
- C:\Windows\System\uJODTYv.exe
  C:\Windows\System\uJODTYv.exe
  2⤵
  PID:10084
- C:\Windows\System\TjKfOKp.exe
  C:\Windows\System\TjKfOKp.exe
  2⤵
  PID:10100
- C:\Windows\System\iZdAdRd.exe
  C:\Windows\System\iZdAdRd.exe
  2⤵
  PID:10116
- C:\Windows\System\ezPVhAZ.exe
  C:\Windows\System\ezPVhAZ.exe
  2⤵
  PID:10140
- C:\Windows\System\ojNHCkI.exe
  C:\Windows\System\ojNHCkI.exe
  2⤵
  PID:10164
- C:\Windows\System\xKMgnxp.exe
  C:\Windows\System\xKMgnxp.exe
  2⤵
  PID:10192
- C:\Windows\System\ARuZuvB.exe
  C:\Windows\System\ARuZuvB.exe
  2⤵
  PID:10212
- C:\Windows\System\MzGFavK.exe
  C:\Windows\System\MzGFavK.exe
  2⤵
  PID:8620
- C:\Windows\System\PddMDrw.exe
  C:\Windows\System\PddMDrw.exe
  2⤵
  PID:9224
- C:\Windows\System\dSsNlyt.exe
  C:\Windows\System\dSsNlyt.exe
  2⤵
  PID:9264
- C:\Windows\System\qSAaqvU.exe
  C:\Windows\System\qSAaqvU.exe
  2⤵
  PID:9340
- C:\Windows\System\ewXnjAh.exe
  C:\Windows\System\ewXnjAh.exe
  2⤵
  PID:9520
- C:\Windows\System\RktTiAs.exe
  C:\Windows\System\RktTiAs.exe
  2⤵
  PID:9604
- C:\Windows\System\xeNiqwO.exe
  C:\Windows\System\xeNiqwO.exe
  2⤵
  PID:9624
- C:\Windows\System\CUBFvao.exe
  C:\Windows\System\CUBFvao.exe
  2⤵
  PID:9720
- C:\Windows\System\SrYGKed.exe
  C:\Windows\System\SrYGKed.exe
  2⤵
  PID:9744
- C:\Windows\System\GDrDoUj.exe
  C:\Windows\System\GDrDoUj.exe
  2⤵
  PID:9832
- C:\Windows\System\bdMUvHl.exe
  C:\Windows\System\bdMUvHl.exe
  2⤵
  PID:9860
- C:\Windows\System\zpSAjvb.exe
  C:\Windows\System\zpSAjvb.exe
  2⤵
  PID:9908
- C:\Windows\System\pnaHZIg.exe
  C:\Windows\System\pnaHZIg.exe
  2⤵
  PID:9956
- C:\Windows\System\mXtWScO.exe
  C:\Windows\System\mXtWScO.exe
  2⤵
  PID:10008
- C:\Windows\System\fEGbVWo.exe
  C:\Windows\System\fEGbVWo.exe
  2⤵
  PID:10096
- C:\Windows\System\WHccclk.exe
  C:\Windows\System\WHccclk.exe
  2⤵
  PID:10128
- C:\Windows\System\hoHnXor.exe
  C:\Windows\System\hoHnXor.exe
  2⤵
  PID:1428
- C:\Windows\System\OlJlKwt.exe
  C:\Windows\System\OlJlKwt.exe
  2⤵
  PID:10236
- C:\Windows\System\CRuQVKZ.exe
  C:\Windows\System\CRuQVKZ.exe
  2⤵
  PID:9292
- C:\Windows\System\aKaXRNM.exe
  C:\Windows\System\aKaXRNM.exe
  2⤵
  PID:9672
- C:\Windows\System\QQJCXdx.exe
  C:\Windows\System\QQJCXdx.exe
  2⤵
  PID:9772
- C:\Windows\System\CjySZvH.exe
  C:\Windows\System\CjySZvH.exe
  2⤵
  PID:9804
- C:\Windows\System\gJjIFdk.exe
  C:\Windows\System\gJjIFdk.exe
  2⤵
  PID:9996
- C:\Windows\System\nMkcKEH.exe
  C:\Windows\System\nMkcKEH.exe
  2⤵
  PID:10172
- C:\Windows\System\ZWBRuoN.exe
  C:\Windows\System\ZWBRuoN.exe
  2⤵
  PID:9416
- C:\Windows\System\FLzbEni.exe
  C:\Windows\System\FLzbEni.exe
  2⤵
  PID:9484
- C:\Windows\System\MzPUbTQ.exe
  C:\Windows\System\MzPUbTQ.exe
  2⤵
  PID:9392
- C:\Windows\System\zyPYWrm.exe
  C:\Windows\System\zyPYWrm.exe
  2⤵
  PID:10076
- C:\Windows\System\CCgSaLN.exe
  C:\Windows\System\CCgSaLN.exe
  2⤵
  PID:10268
- C:\Windows\System\PuqqDba.exe
  C:\Windows\System\PuqqDba.exe
  2⤵
  PID:10292
- C:\Windows\System\mvtffkN.exe
  C:\Windows\System\mvtffkN.exe
  2⤵
  PID:10320
- C:\Windows\System\muMiMrP.exe
  C:\Windows\System\muMiMrP.exe
  2⤵
  PID:10352
- C:\Windows\System\UBpUXna.exe
  C:\Windows\System\UBpUXna.exe
  2⤵
  PID:10376
- C:\Windows\System\vINBiDt.exe
  C:\Windows\System\vINBiDt.exe
  2⤵
  PID:10424
- C:\Windows\System\PWcyTBn.exe
  C:\Windows\System\PWcyTBn.exe
  2⤵
  PID:10440
- C:\Windows\System\ktaDuWf.exe
  C:\Windows\System\ktaDuWf.exe
  2⤵
  PID:10464
- C:\Windows\System\yJZgGlF.exe
  C:\Windows\System\yJZgGlF.exe
  2⤵
  PID:10492
- C:\Windows\System\ZEHIfZW.exe
  C:\Windows\System\ZEHIfZW.exe
  2⤵
  PID:10512
- C:\Windows\System\sktUWlL.exe
  C:\Windows\System\sktUWlL.exe
  2⤵
  PID:10568
- C:\Windows\System\LxDxEHr.exe
  C:\Windows\System\LxDxEHr.exe
  2⤵
  PID:10588
- C:\Windows\System\ixtkGXD.exe
  C:\Windows\System\ixtkGXD.exe
  2⤵
  PID:10612
- C:\Windows\System\ZEjlUVj.exe
  C:\Windows\System\ZEjlUVj.exe
  2⤵
  PID:10640
- C:\Windows\System\mVBypaU.exe
  C:\Windows\System\mVBypaU.exe
  2⤵
  PID:10660
- C:\Windows\System\vlephCb.exe
  C:\Windows\System\vlephCb.exe
  2⤵
  PID:10704
- C:\Windows\System\qXjDeTV.exe
  C:\Windows\System\qXjDeTV.exe
  2⤵
  PID:10732
- C:\Windows\System\PliwUEj.exe
  C:\Windows\System\PliwUEj.exe
  2⤵
  PID:10756
- C:\Windows\System\RBDwhHp.exe
  C:\Windows\System\RBDwhHp.exe
  2⤵
  PID:10776
- C:\Windows\System\yclCjsD.exe
  C:\Windows\System\yclCjsD.exe
  2⤵
  PID:10808
- C:\Windows\System\GLUwrfm.exe
  C:\Windows\System\GLUwrfm.exe
  2⤵
  PID:10832
- C:\Windows\System\GclZgbm.exe
  C:\Windows\System\GclZgbm.exe
  2⤵
  PID:10856
- C:\Windows\System\JWNCHYD.exe
  C:\Windows\System\JWNCHYD.exe
  2⤵
  PID:10884
- C:\Windows\System\FkQqkxs.exe
  C:\Windows\System\FkQqkxs.exe
  2⤵
  PID:10920
- C:\Windows\System\zxVjrIb.exe
  C:\Windows\System\zxVjrIb.exe
  2⤵
  PID:10940
- C:\Windows\System\ZNQKFlv.exe
  C:\Windows\System\ZNQKFlv.exe
  2⤵
  PID:10956
- C:\Windows\System\ZOYsWKw.exe
  C:\Windows\System\ZOYsWKw.exe
  2⤵
  PID:10972
- C:\Windows\System\TcdQwHU.exe
  C:\Windows\System\TcdQwHU.exe
  2⤵
  PID:10996
- C:\Windows\System\haIhGpK.exe
  C:\Windows\System\haIhGpK.exe
  2⤵
  PID:11020
- C:\Windows\System\btKlWsK.exe
  C:\Windows\System\btKlWsK.exe
  2⤵
  PID:11048
- C:\Windows\System\XpFIUya.exe
  C:\Windows\System\XpFIUya.exe
  2⤵
  PID:11080
- C:\Windows\System\GhBHLIZ.exe
  C:\Windows\System\GhBHLIZ.exe
  2⤵
  PID:11104
- C:\Windows\System\SOglSUv.exe
  C:\Windows\System\SOglSUv.exe
  2⤵
  PID:11164
- C:\Windows\System\YqYSAja.exe
  C:\Windows\System\YqYSAja.exe
  2⤵
  PID:11216
- C:\Windows\System\rYEDiJp.exe
  C:\Windows\System\rYEDiJp.exe
  2⤵
  PID:11244
- C:\Windows\System\KMterio.exe
  C:\Windows\System\KMterio.exe
  2⤵
  PID:10280
- C:\Windows\System\NvvZvsn.exe
  C:\Windows\System\NvvZvsn.exe
  2⤵
  PID:10308
- C:\Windows\System\pbWsuHp.exe
  C:\Windows\System\pbWsuHp.exe
  2⤵
  PID:10340
- C:\Windows\System\ptxXqup.exe
  C:\Windows\System\ptxXqup.exe
  2⤵
  PID:10408
- C:\Windows\System\tzwdyoc.exe
  C:\Windows\System\tzwdyoc.exe
  2⤵
  PID:10452
- C:\Windows\System\mSCHDGp.exe
  C:\Windows\System\mSCHDGp.exe
  2⤵
  PID:10580
- C:\Windows\System\OgxaEaC.exe
  C:\Windows\System\OgxaEaC.exe
  2⤵
  PID:10652
- C:\Windows\System\EkDOBjW.exe
  C:\Windows\System\EkDOBjW.exe
  2⤵
  PID:10684
- C:\Windows\System\PMqNyzm.exe
  C:\Windows\System\PMqNyzm.exe
  2⤵
  PID:10820
- C:\Windows\System\OlcHxUN.exe
  C:\Windows\System\OlcHxUN.exe
  2⤵
  PID:10872
- C:\Windows\System\RzQCAEV.exe
  C:\Windows\System\RzQCAEV.exe
  2⤵
  PID:10948
- C:\Windows\System\atIsTSF.exe
  C:\Windows\System\atIsTSF.exe
  2⤵
  PID:11016
- C:\Windows\System\ZNbLJpB.exe
  C:\Windows\System\ZNbLJpB.exe
  2⤵
  PID:11088
- C:\Windows\System\xHhIEBC.exe
  C:\Windows\System\xHhIEBC.exe
  2⤵
  PID:11060
- C:\Windows\System\IScrYoR.exe
  C:\Windows\System\IScrYoR.exe
  2⤵
  PID:11092
- C:\Windows\System\FkdJSAm.exe
  C:\Windows\System\FkdJSAm.exe
  2⤵
  PID:11256
- C:\Windows\System\bYUoSqD.exe
  C:\Windows\System\bYUoSqD.exe
  2⤵
  PID:10384
- C:\Windows\System\CzffaxJ.exe
  C:\Windows\System\CzffaxJ.exe
  2⤵
  PID:10404
- C:\Windows\System\hhvNFkN.exe
  C:\Windows\System\hhvNFkN.exe
  2⤵
  PID:10628
- C:\Windows\System\afLSdCe.exe
  C:\Windows\System\afLSdCe.exe
  2⤵
  PID:10848
- C:\Windows\System\AfsTWSw.exe
  C:\Windows\System\AfsTWSw.exe
  2⤵
  PID:11012
- C:\Windows\System\blYjUjE.exe
  C:\Windows\System\blYjUjE.exe
  2⤵
  PID:11208
- C:\Windows\System\gWwKSWD.exe
  C:\Windows\System\gWwKSWD.exe
  2⤵
  PID:10316
- C:\Windows\System\omNAwfX.exe
  C:\Windows\System\omNAwfX.exe
  2⤵
  PID:10800
- C:\Windows\System\AznxjGO.exe
  C:\Windows\System\AznxjGO.exe
  2⤵
  PID:10896
- C:\Windows\System\oWiRvUi.exe
  C:\Windows\System\oWiRvUi.exe
  2⤵
  PID:11268
- C:\Windows\System\toHULCy.exe
  C:\Windows\System\toHULCy.exe
  2⤵
  PID:11296
- C:\Windows\System\dLrymLK.exe
  C:\Windows\System\dLrymLK.exe
  2⤵
  PID:11316
- C:\Windows\System\hyqVXyt.exe
  C:\Windows\System\hyqVXyt.exe
  2⤵
  PID:11340
- C:\Windows\System\jLnXdXq.exe
  C:\Windows\System\jLnXdXq.exe
  2⤵
  PID:11368
- C:\Windows\System\YbPmDpZ.exe
  C:\Windows\System\YbPmDpZ.exe
  2⤵
  PID:11400
- C:\Windows\System\fpVKiKC.exe
  C:\Windows\System\fpVKiKC.exe
  2⤵
  PID:11428
- C:\Windows\System\kXEIzWw.exe
  C:\Windows\System\kXEIzWw.exe
  2⤵
  PID:11452
- C:\Windows\System\LJNjjqT.exe
  C:\Windows\System\LJNjjqT.exe
  2⤵
  PID:11504
- C:\Windows\System\BCxfjEZ.exe
  C:\Windows\System\BCxfjEZ.exe
  2⤵
  PID:11544
- C:\Windows\System\NaxyjSP.exe
  C:\Windows\System\NaxyjSP.exe
  2⤵
  PID:11564
- C:\Windows\System\TvTbuik.exe
  C:\Windows\System\TvTbuik.exe
  2⤵
  PID:11592
- C:\Windows\System\SkwkvoG.exe
  C:\Windows\System\SkwkvoG.exe
  2⤵
  PID:11628
- C:\Windows\System\pgOeldF.exe
  C:\Windows\System\pgOeldF.exe
  2⤵
  PID:11648
- C:\Windows\System\QZpTHYi.exe
  C:\Windows\System\QZpTHYi.exe
  2⤵
  PID:11676
- C:\Windows\System\GRucWCo.exe
  C:\Windows\System\GRucWCo.exe
  2⤵
  PID:11700
- C:\Windows\System\yNJGDMF.exe
  C:\Windows\System\yNJGDMF.exe
  2⤵
  PID:11732
- C:\Windows\System\rhFXJTq.exe
  C:\Windows\System\rhFXJTq.exe
  2⤵
  PID:11756
- C:\Windows\System\CjDTfIy.exe
  C:\Windows\System\CjDTfIy.exe
  2⤵
  PID:11796
- C:\Windows\System\akdOidj.exe
  C:\Windows\System\akdOidj.exe
  2⤵
  PID:11840
- C:\Windows\System\bWsXMMi.exe
  C:\Windows\System\bWsXMMi.exe
  2⤵
  PID:11856
- C:\Windows\System\hSChPsB.exe
  C:\Windows\System\hSChPsB.exe
  2⤵
  PID:11872
- C:\Windows\System\jFayrYM.exe
  C:\Windows\System\jFayrYM.exe
  2⤵
  PID:11912
- C:\Windows\System\gTaPMEI.exe
  C:\Windows\System\gTaPMEI.exe
  2⤵
  PID:11936
- C:\Windows\System\WuvLSBk.exe
  C:\Windows\System\WuvLSBk.exe
  2⤵
  PID:11972
- C:\Windows\System\usRTuTh.exe
  C:\Windows\System\usRTuTh.exe
  2⤵
  PID:12004
- C:\Windows\System\cVMTyFY.exe
  C:\Windows\System\cVMTyFY.exe
  2⤵
  PID:12024
- C:\Windows\System\SqBDuhh.exe
  C:\Windows\System\SqBDuhh.exe
  2⤵
  PID:12040
- C:\Windows\System\RwEvlYs.exe
  C:\Windows\System\RwEvlYs.exe
  2⤵
  PID:12072
- C:\Windows\System\yNxAdZb.exe
  C:\Windows\System\yNxAdZb.exe
  2⤵
  PID:12100
- C:\Windows\System\PmkGPER.exe
  C:\Windows\System\PmkGPER.exe
  2⤵
  PID:12124
- C:\Windows\System\zfHPJKn.exe
  C:\Windows\System\zfHPJKn.exe
  2⤵
  PID:12140
- C:\Windows\System\KMCStQt.exe
  C:\Windows\System\KMCStQt.exe
  2⤵
  PID:12156
- C:\Windows\System\PUeejFq.exe
  C:\Windows\System\PUeejFq.exe
  2⤵
  PID:12212
- C:\Windows\System\MnWahRm.exe
  C:\Windows\System\MnWahRm.exe
  2⤵
  PID:12244
- C:\Windows\System\NpKdjvy.exe
  C:\Windows\System\NpKdjvy.exe
  2⤵
  PID:12280
- C:\Windows\System\lXxowMC.exe
  C:\Windows\System\lXxowMC.exe
  2⤵
  PID:10420
- C:\Windows\System\ftCTSxk.exe
  C:\Windows\System\ftCTSxk.exe
  2⤵
  PID:11304
- C:\Windows\System\UoMeFhj.exe
  C:\Windows\System\UoMeFhj.exe
  2⤵
  PID:11364
- C:\Windows\System\xAixTfL.exe
  C:\Windows\System\xAixTfL.exe
  2⤵
  PID:11448
- C:\Windows\System\LHqSaIo.exe
  C:\Windows\System\LHqSaIo.exe
  2⤵
  PID:11464
- C:\Windows\System\lEEIqVd.exe
  C:\Windows\System\lEEIqVd.exe
  2⤵
  PID:11580
- C:\Windows\System\tGBBOlV.exe
  C:\Windows\System\tGBBOlV.exe
  2⤵
  PID:11684
- C:\Windows\System\zOtJbWu.exe
  C:\Windows\System\zOtJbWu.exe
  2⤵
  PID:11720
- C:\Windows\System\FHITQAP.exe
  C:\Windows\System\FHITQAP.exe
  2⤵
  PID:11792
- C:\Windows\System\FpmPCQZ.exe
  C:\Windows\System\FpmPCQZ.exe
  2⤵
  PID:11852
- C:\Windows\System\eVVDMPs.exe
  C:\Windows\System\eVVDMPs.exe
  2⤵
  PID:11896
- C:\Windows\System\BQQbgQv.exe
  C:\Windows\System\BQQbgQv.exe
  2⤵
  PID:11948
- C:\Windows\System\bcJpTUe.exe
  C:\Windows\System\bcJpTUe.exe
  2⤵
  PID:12016
- C:\Windows\System\cVhkaix.exe
  C:\Windows\System\cVhkaix.exe
  2⤵
  PID:12112
- C:\Windows\System\jZrGGjd.exe
  C:\Windows\System\jZrGGjd.exe
  2⤵
  PID:12148
- C:\Windows\System\CDwSxoJ.exe
  C:\Windows\System\CDwSxoJ.exe
  2⤵
  PID:12224
- C:\Windows\System\oAcWVHu.exe
  C:\Windows\System\oAcWVHu.exe
  2⤵
  PID:11356
- C:\Windows\System\DRGBBPt.exe
  C:\Windows\System\DRGBBPt.exe
  2⤵
  PID:11352
- C:\Windows\System\HSMrZTp.exe
  C:\Windows\System\HSMrZTp.exe
  2⤵
  PID:11496
- C:\Windows\System\etXSoei.exe
  C:\Windows\System\etXSoei.exe
  2⤵
  PID:11620
- C:\Windows\System\wXMKcsb.exe
  C:\Windows\System\wXMKcsb.exe
  2⤵
  PID:11748
- C:\Windows\System\wMJFWwL.exe
  C:\Windows\System\wMJFWwL.exe
  2⤵
  PID:12000
- C:\Windows\System\DfJdANb.exe
  C:\Windows\System\DfJdANb.exe
  2⤵
  PID:12136
- C:\Windows\System\tOxgBMa.exe
  C:\Windows\System\tOxgBMa.exe
  2⤵
  PID:12116
- C:\Windows\System\lazQjpi.exe
  C:\Windows\System\lazQjpi.exe
  2⤵
  PID:11420
- C:\Windows\System\zOUzyTj.exe
  C:\Windows\System\zOUzyTj.exe
  2⤵
  PID:11688
- C:\Windows\System\MqXpQlf.exe
  C:\Windows\System\MqXpQlf.exe
  2⤵
  PID:12272
- C:\Windows\System\CSkjHKx.exe
  C:\Windows\System\CSkjHKx.exe
  2⤵
  PID:11392
- C:\Windows\System\ZnByDyP.exe
  C:\Windows\System\ZnByDyP.exe
  2⤵
  PID:10544
- C:\Windows\System\ccXpENs.exe
  C:\Windows\System\ccXpENs.exe
  2⤵
  PID:12316
- C:\Windows\System\WESBVFx.exe
  C:\Windows\System\WESBVFx.exe
  2⤵
  PID:12340
- C:\Windows\System\mtplFmx.exe
  C:\Windows\System\mtplFmx.exe
  2⤵
  PID:12360
- C:\Windows\System\YgCoSYM.exe
  C:\Windows\System\YgCoSYM.exe
  2⤵
  PID:12400
- C:\Windows\System\TRlLRyd.exe
  C:\Windows\System\TRlLRyd.exe
  2⤵
  PID:12420
- C:\Windows\System\ArpJOdx.exe
  C:\Windows\System\ArpJOdx.exe
  2⤵
  PID:12468
- C:\Windows\System\oRmzUOR.exe
  C:\Windows\System\oRmzUOR.exe
  2⤵
  PID:12484
- C:\Windows\System\gWPrKTA.exe
  C:\Windows\System\gWPrKTA.exe
  2⤵
  PID:12512
- C:\Windows\System\fmRhqpY.exe
  C:\Windows\System\fmRhqpY.exe
  2⤵
  PID:12532
- C:\Windows\System\ZvUoHqv.exe
  C:\Windows\System\ZvUoHqv.exe
  2⤵
  PID:12560
- C:\Windows\System\QgHKQKn.exe
  C:\Windows\System\QgHKQKn.exe
  2⤵
  PID:12584
- C:\Windows\System\EKublNV.exe
  C:\Windows\System\EKublNV.exe
  2⤵
  PID:12608
- C:\Windows\System\DFyZCgk.exe
  C:\Windows\System\DFyZCgk.exe
  2⤵
  PID:12624
- C:\Windows\System\oFRBBsX.exe
  C:\Windows\System\oFRBBsX.exe
  2⤵
  PID:12644
- C:\Windows\System\KOEJbEi.exe
  C:\Windows\System\KOEJbEi.exe
  2⤵
  PID:12660
- C:\Windows\System\EdQlCTc.exe
  C:\Windows\System\EdQlCTc.exe
  2⤵
  PID:12684
- C:\Windows\System\qYqVLbb.exe
  C:\Windows\System\qYqVLbb.exe
  2⤵
  PID:12712
- C:\Windows\System\UGrhoJt.exe
  C:\Windows\System\UGrhoJt.exe
  2⤵
  PID:12748
- C:\Windows\System\ROASdDK.exe
  C:\Windows\System\ROASdDK.exe
  2⤵
  PID:12768
- C:\Windows\System\ULxKndh.exe
  C:\Windows\System\ULxKndh.exe
  2⤵
  PID:12796
- C:\Windows\System\tQcwiCH.exe
  C:\Windows\System\tQcwiCH.exe
  2⤵
  PID:12824
- C:\Windows\System\EtBojpx.exe
  C:\Windows\System\EtBojpx.exe
  2⤵
  PID:12904
- C:\Windows\System\TXeVTkR.exe
  C:\Windows\System\TXeVTkR.exe
  2⤵
  PID:12928
- C:\Windows\System\DSnYkCK.exe
  C:\Windows\System\DSnYkCK.exe
  2⤵
  PID:12952
- C:\Windows\System\abVBtQi.exe
  C:\Windows\System\abVBtQi.exe
  2⤵
  PID:12992
- C:\Windows\System\PhuhdFh.exe
  C:\Windows\System\PhuhdFh.exe
  2⤵
  PID:13032
- C:\Windows\System\bzfvmBo.exe
  C:\Windows\System\bzfvmBo.exe
  2⤵
  PID:13048
- C:\Windows\System\TyfoJtH.exe
  C:\Windows\System\TyfoJtH.exe
  2⤵
  PID:13072
- C:\Windows\System\IRgEdUz.exe
  C:\Windows\System\IRgEdUz.exe
  2⤵
  PID:13096
- C:\Windows\System\IlsIqPN.exe
  C:\Windows\System\IlsIqPN.exe
  2⤵
  PID:13120
- C:\Windows\System\vOrRNDK.exe
  C:\Windows\System\vOrRNDK.exe
  2⤵
  PID:13156
- C:\Windows\System\XHuwGKE.exe
  C:\Windows\System\XHuwGKE.exe
  2⤵
  PID:13188
- C:\Windows\System\RtGCIHx.exe
  C:\Windows\System\RtGCIHx.exe
  2⤵
  PID:13216
- C:\Windows\System\zqOqKeS.exe
  C:\Windows\System\zqOqKeS.exe
  2⤵
  PID:13240
- C:\Windows\System\cHHUfLu.exe
  C:\Windows\System\cHHUfLu.exe
  2⤵
  PID:13268
- C:\Windows\System\bbGnDxg.exe
  C:\Windows\System\bbGnDxg.exe
  2⤵
  PID:13296
- C:\Windows\System\uRtaGWF.exe
  C:\Windows\System\uRtaGWF.exe
  2⤵
  PID:12328
- C:\Windows\System\vPMVdro.exe
  C:\Windows\System\vPMVdro.exe
  2⤵
  PID:12300
- C:\Windows\System\aEtVSXb.exe
  C:\Windows\System\aEtVSXb.exe
  2⤵
  PID:12464
- C:\Windows\System\CQTmNmu.exe
  C:\Windows\System\CQTmNmu.exe
  2⤵
  PID:12504
- C:\Windows\System\APqDXPf.exe
  C:\Windows\System\APqDXPf.exe
  2⤵
  PID:12556
- C:\Windows\System\HqnWVHh.exe
  C:\Windows\System\HqnWVHh.exe
  2⤵
  PID:12576
- C:\Windows\System\sFyUyQj.exe
  C:\Windows\System\sFyUyQj.exe
  2⤵
  PID:12656
- C:\Windows\System\IOKCXTf.exe
  C:\Windows\System\IOKCXTf.exe
  2⤵
  PID:12736
- C:\Windows\System\VSGRuEw.exe
  C:\Windows\System\VSGRuEw.exe
  2⤵
  PID:12840
- C:\Windows\System\jUYKZDU.exe
  C:\Windows\System\jUYKZDU.exe
  2⤵
  PID:12820
- C:\Windows\System\TVReAvZ.exe
  C:\Windows\System\TVReAvZ.exe
  2⤵
  PID:12972
- C:\Windows\System\WSNxACH.exe
  C:\Windows\System\WSNxACH.exe
  2⤵
  PID:13040
- C:\Windows\System\hyOigzf.exe
  C:\Windows\System\hyOigzf.exe
  2⤵
  PID:13080
- C:\Windows\System\ZCsREDu.exe
  C:\Windows\System\ZCsREDu.exe
  2⤵
  PID:13112
- C:\Windows\System\bIhwerT.exe
  C:\Windows\System\bIhwerT.exe
  2⤵
  PID:13260
- C:\Windows\System\uRITqho.exe
  C:\Windows\System\uRITqho.exe
  2⤵
  PID:12336
- C:\Windows\System\QyFchAp.exe
  C:\Windows\System\QyFchAp.exe
  2⤵
  PID:12380
- C:\Windows\System\IeblpnT.exe
  C:\Windows\System\IeblpnT.exe
  2⤵
  PID:12600
- C:\Windows\System\VIzxNld.exe
  C:\Windows\System\VIzxNld.exe
  2⤵
  PID:12640
- C:\Windows\System\orQpWut.exe
  C:\Windows\System\orQpWut.exe
  2⤵
  PID:12968
- C:\Windows\System\dibszZT.exe
  C:\Windows\System\dibszZT.exe
  2⤵
  PID:13024
- C:\Windows\System\xHyChyt.exe
  C:\Windows\System\xHyChyt.exe
  2⤵
  PID:13236
- C:\Windows\System\QsncFDa.exe
  C:\Windows\System\QsncFDa.exe
  2⤵
  PID:12428
- C:\Windows\System\aRPcrYO.exe
  C:\Windows\System\aRPcrYO.exe
  2⤵
  PID:12704
- C:\Windows\System\cmyRZvn.exe
  C:\Windows\System\cmyRZvn.exe
  2⤵
  PID:13012
- C:\Windows\System\nsiEZVy.exe
  C:\Windows\System\nsiEZVy.exe
  2⤵
  PID:12924
- C:\Windows\System\pPHLbpM.exe
  C:\Windows\System\pPHLbpM.exe
  2⤵
  PID:12888
- C:\Windows\System\ToSFSTk.exe
  C:\Windows\System\ToSFSTk.exe
  2⤵
  PID:13320
- C:\Windows\System\aCMqCRr.exe
  C:\Windows\System\aCMqCRr.exe
  2⤵
  PID:13344
- C:\Windows\System\aRuOXyH.exe
  C:\Windows\System\aRuOXyH.exe
  2⤵
  PID:13364
- C:\Windows\System\OTMFcuI.exe
  C:\Windows\System\OTMFcuI.exe
  2⤵
  PID:13428
- C:\Windows\System\wHdxkhl.exe
  C:\Windows\System\wHdxkhl.exe
  2⤵
  PID:13456
- C:\Windows\System\DTCOfKV.exe
  C:\Windows\System\DTCOfKV.exe
  2⤵
  PID:13480
- C:\Windows\System\vjhrbtH.exe
  C:\Windows\System\vjhrbtH.exe
  2⤵
  PID:13500
- C:\Windows\System\RMaMlCP.exe
  C:\Windows\System\RMaMlCP.exe
  2⤵
  PID:13536
- C:\Windows\System\urDtoml.exe
  C:\Windows\System\urDtoml.exe
  2⤵
  PID:13556
- C:\Windows\System\sUVaKgF.exe
  C:\Windows\System\sUVaKgF.exe
  2⤵
  PID:13580
- C:\Windows\System\JgJbdVf.exe
  C:\Windows\System\JgJbdVf.exe
  2⤵
  PID:13600
- C:\Windows\System\VkYlHON.exe
  C:\Windows\System\VkYlHON.exe
  2⤵
  PID:13632
- C:\Windows\System\WvwPUmq.exe
  C:\Windows\System\WvwPUmq.exe
  2⤵
  PID:13664
- C:\Windows\System\pDVOqpL.exe
  C:\Windows\System\pDVOqpL.exe
  2⤵
  PID:13684
- C:\Windows\System\uAhvgcC.exe
  C:\Windows\System\uAhvgcC.exe
  2⤵
  PID:13736
- C:\Windows\System\cbITrdA.exe
  C:\Windows\System\cbITrdA.exe
  2⤵
  PID:13760
- C:\Windows\System\frgtRhn.exe
  C:\Windows\System\frgtRhn.exe
  2⤵
  PID:13780
- C:\Windows\System\ruLWqDy.exe
  C:\Windows\System\ruLWqDy.exe
  2⤵
  PID:13808
- C:\Windows\System\KKRyXkP.exe
  C:\Windows\System\KKRyXkP.exe
  2⤵
  PID:13848
- C:\Windows\System\fWvekvw.exe
  C:\Windows\System\fWvekvw.exe
  2⤵
  PID:13868
- C:\Windows\System\LiPdHwq.exe
  C:\Windows\System\LiPdHwq.exe
  2⤵
  PID:13892
- C:\Windows\System\aGERXqk.exe
  C:\Windows\System\aGERXqk.exe
  2⤵
  PID:13912
- C:\Windows\System\lKMpnfg.exe
  C:\Windows\System\lKMpnfg.exe
  2⤵
  PID:13948
- C:\Windows\System\UgvSSiW.exe
  C:\Windows\System\UgvSSiW.exe
  2⤵
  PID:13964
- C:\Windows\System\UDaqleE.exe
  C:\Windows\System\UDaqleE.exe
  2⤵
  PID:13988
- C:\Windows\System\ZARCZlJ.exe
  C:\Windows\System\ZARCZlJ.exe
  2⤵
  PID:14012
- C:\Windows\System\wRptaDa.exe
  C:\Windows\System\wRptaDa.exe
  2⤵
  PID:14036
- C:\Windows\System\WipHmKl.exe
  C:\Windows\System\WipHmKl.exe
  2⤵
  PID:14060
- C:\Windows\System\PSzMVyL.exe
  C:\Windows\System\PSzMVyL.exe
  2⤵
  PID:14128
- C:\Windows\System\jiWaodf.exe
  C:\Windows\System\jiWaodf.exe
  2⤵
  PID:14144
- C:\Windows\System\oeYCuHS.exe
  C:\Windows\System\oeYCuHS.exe
  2⤵
  PID:14184
- C:\Windows\System\ZzebULp.exe
  C:\Windows\System\ZzebULp.exe
  2⤵
  PID:14200
- C:\Windows\System\ZGgQrun.exe
  C:\Windows\System\ZGgQrun.exe
  2⤵
  PID:14224
- C:\Windows\System\XsDXuxy.exe
  C:\Windows\System\XsDXuxy.exe
  2⤵
  PID:14248
- C:\Windows\System\WCvYtuX.exe
  C:\Windows\System\WCvYtuX.exe
  2⤵
  PID:14268
- C:\Windows\System\hQEKVkz.exe
  C:\Windows\System\hQEKVkz.exe
  2⤵
  PID:14300
- C:\Windows\System\JZfmTvn.exe
  C:\Windows\System\JZfmTvn.exe
  2⤵
  PID:13336
- C:\Windows\System\WufeNRT.exe
  C:\Windows\System\WufeNRT.exe
  2⤵
  PID:13416
- C:\Windows\System\OEYnHlS.exe
  C:\Windows\System\OEYnHlS.exe
  2⤵
  PID:13444
- C:\Windows\System\LtrqFya.exe
  C:\Windows\System\LtrqFya.exe
  2⤵
  PID:13532
- C:\Windows\System\GOCrTnv.exe
  C:\Windows\System\GOCrTnv.exe
  2⤵
  PID:13588
- C:\Windows\System\bxwGaVG.exe
  C:\Windows\System\bxwGaVG.exe
  2⤵
  PID:13572
- C:\Windows\System\CUXEvHi.exe
  C:\Windows\System\CUXEvHi.exe
  2⤵
  PID:13724
- C:\Windows\System\wFzSNfW.exe
  C:\Windows\System\wFzSNfW.exe
  2⤵
  PID:13772
- C:\Windows\System\RsVlHux.exe
  C:\Windows\System\RsVlHux.exe
  2⤵
  PID:13888
- C:\Windows\System\jocFmzD.exe
  C:\Windows\System\jocFmzD.exe
  2⤵
  PID:13880
- C:\Windows\System\juSebcG.exe
  C:\Windows\System\juSebcG.exe
  2⤵
  PID:13976
- C:\Windows\System\TnAQMhs.exe
  C:\Windows\System\TnAQMhs.exe
  2⤵
  PID:14024
- C:\Windows\System\daOuZfU.exe
  C:\Windows\System\daOuZfU.exe
  2⤵
  PID:14100
- C:\Windows\System\qZkHQik.exe
  C:\Windows\System\qZkHQik.exe
  2⤵
  PID:14192
- C:\Windows\System\cQvKJKm.exe
  C:\Windows\System\cQvKJKm.exe
  2⤵
  PID:14244
- C:\Windows\System\yXuqDzn.exe
  C:\Windows\System\yXuqDzn.exe
  2⤵
  PID:14324
- C:\Windows\System\jIzzNDQ.exe
  C:\Windows\System\jIzzNDQ.exe
  2⤵
  PID:13384
- C:\Windows\System\xuaaUIV.exe
  C:\Windows\System\xuaaUIV.exe
  2⤵
  PID:13492
- C:\Windows\System\PJGahvI.exe
  C:\Windows\System\PJGahvI.exe
  2⤵
  PID:13676
- C:\Windows\System\CzGfxiU.exe
  C:\Windows\System\CzGfxiU.exe
  2⤵
  PID:13796
- C:\Windows\System\sgeWibX.exe
  C:\Windows\System\sgeWibX.exe
  2⤵
  PID:14044
- C:\Windows\System\Vfxfmfl.exe
  C:\Windows\System\Vfxfmfl.exe
  2⤵
  PID:14088
- C:\Windows\System\cbociym.exe
  C:\Windows\System\cbociym.exe
  2⤵
  PID:14212
- C:\Windows\System\HZZXBGg.exe
  C:\Windows\System\HZZXBGg.exe
  2⤵
  PID:13496
- C:\Windows\System\DSiUgUI.exe
  C:\Windows\System\DSiUgUI.exe
  2⤵
  PID:13908
- C:\Windows\System\pDfWgpX.exe
  C:\Windows\System\pDfWgpX.exe
  2⤵
  PID:14260
- C:\Windows\System\hAkYXRq.exe
  C:\Windows\System\hAkYXRq.exe
  2⤵
  PID:14372
- C:\Windows\System\iLolKCD.exe
  C:\Windows\System\iLolKCD.exe
  2⤵
  PID:14388
- C:\Windows\System\iGemEzF.exe
  C:\Windows\System\iGemEzF.exe
  2⤵
  PID:14404
- C:\Windows\System\wboSdSh.exe
  C:\Windows\System\wboSdSh.exe
  2⤵
  PID:14452
- C:\Windows\System\qjtgwhu.exe
  C:\Windows\System\qjtgwhu.exe
  2⤵
  PID:14480
- C:\Windows\System\pfgRxvc.exe
  C:\Windows\System\pfgRxvc.exe
  2⤵
  PID:14500
- C:\Windows\System\HttSWvU.exe
  C:\Windows\System\HttSWvU.exe
  2⤵
  PID:14516
- C:\Windows\System\YCZPsxx.exe
  C:\Windows\System\YCZPsxx.exe
  2⤵
  PID:14560
- C:\Windows\System\WmFpxtf.exe
  C:\Windows\System\WmFpxtf.exe
  2⤵
  PID:14600
- C:\Windows\System\DDMbZgE.exe
  C:\Windows\System\DDMbZgE.exe
  2⤵
  PID:14620
- C:\Windows\System\YlFtFpT.exe
  C:\Windows\System\YlFtFpT.exe
  2⤵
  PID:14644
- C:\Windows\System\EFRvvzk.exe
  C:\Windows\System\EFRvvzk.exe
  2⤵
  PID:14660
- C:\Windows\System\vywYrPM.exe
  C:\Windows\System\vywYrPM.exe
  2⤵
  PID:14684
- C:\Windows\System\RiNgDsF.exe
  C:\Windows\System\RiNgDsF.exe
  2⤵
  PID:14716
- C:\Windows\System\XSflIAh.exe
  C:\Windows\System\XSflIAh.exe
  2⤵
  PID:14744
- C:\Windows\System\VBalVVm.exe
  C:\Windows\System\VBalVVm.exe
  2⤵
  PID:14772
- C:\Windows\System\YKusFFD.exe
  C:\Windows\System\YKusFFD.exe
  2⤵
  PID:14824
- C:\Windows\System\aFBPXMT.exe
  C:\Windows\System\aFBPXMT.exe
  2⤵
  PID:14840
- C:\Windows\System\YdLLPli.exe
  C:\Windows\System\YdLLPli.exe
  2⤵
  PID:14856
- C:\Windows\System\fflzKgY.exe
  C:\Windows\System\fflzKgY.exe
  2⤵
  PID:14880
- C:\Windows\System\pGZkSaW.exe
  C:\Windows\System\pGZkSaW.exe
  2⤵
  PID:14936
- C:\Windows\System\wtKeknr.exe
  C:\Windows\System\wtKeknr.exe
  2⤵
  PID:14964
- C:\Windows\System\ehQroHG.exe
  C:\Windows\System\ehQroHG.exe
  2⤵
  PID:14980
- C:\Windows\System\wFbPkhS.exe
  C:\Windows\System\wFbPkhS.exe
  2⤵
  PID:15008
- C:\Windows\System\gfXGYNi.exe
  C:\Windows\System\gfXGYNi.exe
  2⤵
  PID:15036
- C:\Windows\System\FNXsrDc.exe
  C:\Windows\System\FNXsrDc.exe
  2⤵
  PID:15056
- C:\Windows\System\IYzyNIz.exe
  C:\Windows\System\IYzyNIz.exe
  2⤵
  PID:15092
- C:\Windows\System\SfFrabP.exe
  C:\Windows\System\SfFrabP.exe
  2⤵
  PID:15112
- C:\Windows\System\WCrOygQ.exe
  C:\Windows\System\WCrOygQ.exe
  2⤵
  PID:15136
- C:\Windows\System\JsPezTc.exe
  C:\Windows\System\JsPezTc.exe
  2⤵
  PID:15152
- C:\Windows\System\vxajvUW.exe
  C:\Windows\System\vxajvUW.exe
  2⤵
  PID:15176
- C:\Windows\System\rHtJBMn.exe
  C:\Windows\System\rHtJBMn.exe
  2⤵
  PID:15204
- C:\Windows\System\QOxHmzu.exe
  C:\Windows\System\QOxHmzu.exe
  2⤵
  PID:15240
- C:\Windows\System\AQOUXuI.exe
  C:\Windows\System\AQOUXuI.exe
  2⤵
  PID:15300
- C:\Windows\System\lKsWbpO.exe
  C:\Windows\System\lKsWbpO.exe
  2⤵
  PID:15316
- C:\Windows\System\QXXvqwl.exe
  C:\Windows\System\QXXvqwl.exe
  2⤵
  PID:15340
- C:\Windows\System\bGfDUJk.exe
  C:\Windows\System\bGfDUJk.exe
  2⤵
  PID:13940
- C:\Windows\System\aLWvcRD.exe
  C:\Windows\System\aLWvcRD.exe
  2⤵
  PID:14328
- C:\Windows\System\VCtdZRx.exe
  C:\Windows\System\VCtdZRx.exe
  2⤵
  PID:14384
- C:\Windows\System\zDrbUDV.exe
  C:\Windows\System\zDrbUDV.exe
  2⤵
  PID:14416
- C:\Windows\System\hcgxNjz.exe
  C:\Windows\System\hcgxNjz.exe
  2⤵
  PID:14468
- C:\Windows\System\OSmCizx.exe
  C:\Windows\System\OSmCizx.exe
  2⤵
  PID:14536
- C:\Windows\System\QgYRkzU.exe
  C:\Windows\System\QgYRkzU.exe
  2⤵
  PID:4824
- C:\Windows\System\ttXJlMc.exe
  C:\Windows\System\ttXJlMc.exe
  2⤵
  PID:14616
- C:\Windows\System\eKaIpJu.exe
  C:\Windows\System\eKaIpJu.exe
  2⤵
  PID:14656
- C:\Windows\System\btstyHP.exe
  C:\Windows\System\btstyHP.exe
  2⤵
  PID:14832
- C:\Windows\System\CVnsIGe.exe
  C:\Windows\System\CVnsIGe.exe
  2⤵
  PID:14852
- C:\Windows\System\RykHEYL.exe
  C:\Windows\System\RykHEYL.exe
  2⤵
  PID:14904
- C:\Windows\System\qrEBSRe.exe
  C:\Windows\System\qrEBSRe.exe
  2⤵
  PID:14932
- C:\Windows\System\gRlKTZu.exe
  C:\Windows\System\gRlKTZu.exe
  2⤵
  PID:15028
- C:\Windows\System\CKuBELC.exe
  C:\Windows\System\CKuBELC.exe
  2⤵
  PID:15084
- C:\Windows\System\yLlcxRK.exe
  C:\Windows\System\yLlcxRK.exe
  2⤵
  PID:15128
- C:\Windows\System\AatFCfn.exe
  C:\Windows\System\AatFCfn.exe
  2⤵
  PID:15148
- C:\Windows\System\ctTvrLq.exe
  C:\Windows\System\ctTvrLq.exe
  2⤵
  PID:15236
- C:\Windows\System\cGmokHX.exe
  C:\Windows\System\cGmokHX.exe
  2⤵
  PID:15352
- C:\Windows\System\UYmRDmh.exe
  C:\Windows\System\UYmRDmh.exe
  2⤵
  PID:14368
- C:\Windows\System\mfxLnPa.exe
  C:\Windows\System\mfxLnPa.exe
  2⤵
  PID:14584
- C:\Windows\System\ESnFoik.exe
  C:\Windows\System\ESnFoik.exe
  2⤵
  PID:14608
- C:\Windows\System\OCtFCbK.exe
  C:\Windows\System\OCtFCbK.exe
  2⤵
  PID:14924
- C:\Windows\System\ZactZBm.exe
  C:\Windows\System\ZactZBm.exe
  2⤵
  PID:15216
- C:\Windows\System\pdppaIv.exe
  C:\Windows\System\pdppaIv.exe
  2⤵
  PID:15200
- C:\Windows\System\CIrOXGl.exe
  C:\Windows\System\CIrOXGl.exe
  2⤵
  PID:14492
- C:\Windows\System\efOHCEj.exe
  C:\Windows\System\efOHCEj.exe
  2⤵
  PID:1364
- C:\Windows\System\INtYtGL.exe
  C:\Windows\System\INtYtGL.exe
  2⤵
  PID:14976
- C:\Windows\System\aArfHBZ.exe
  C:\Windows\System\aArfHBZ.exe
  2⤵
  PID:15260
- C:\Windows\System\zpHAHWf.exe
  C:\Windows\System\zpHAHWf.exe
  2⤵
  PID:14680
- C:\Windows\System\usTcCJy.exe
  C:\Windows\System\usTcCJy.exe
  2⤵
  PID:15392
- C:\Windows\System\BvFGtPx.exe
  C:\Windows\System\BvFGtPx.exe
  2⤵
  PID:15416
- C:\Windows\System\HqmkIzg.exe
  C:\Windows\System\HqmkIzg.exe
  2⤵
  PID:15448
- C:\Windows\System\ENjwapn.exe
  C:\Windows\System\ENjwapn.exe
  2⤵
  PID:15464
- C:\Windows\System\lFoeapB.exe
  C:\Windows\System\lFoeapB.exe
  2⤵
  PID:15484
- C:\Windows\System\CRiCwil.exe
  C:\Windows\System\CRiCwil.exe
  2⤵
  PID:15520
- C:\Windows\System\TPpPQeQ.exe
  C:\Windows\System\TPpPQeQ.exe
  2⤵
  PID:15544
- C:\Windows\System\PKtnkQe.exe
  C:\Windows\System\PKtnkQe.exe
  2⤵
  PID:15584
- C:\Windows\System\gISbCSc.exe
  C:\Windows\System\gISbCSc.exe
  2⤵
  PID:15604
- C:\Windows\System\MpFkFmd.exe
  C:\Windows\System\MpFkFmd.exe
  2⤵
  PID:15644
- C:\Windows\System\dshTwDg.exe
  C:\Windows\System\dshTwDg.exe
  2⤵
  PID:15672
- C:\Windows\System\cbWCIxL.exe
  C:\Windows\System\cbWCIxL.exe
  2⤵
  PID:15688
- C:\Windows\System\QEuAJSL.exe
  C:\Windows\System\QEuAJSL.exe
  2⤵
  PID:15716
- C:\Windows\System\WsNOvwF.exe
  C:\Windows\System\WsNOvwF.exe
  2⤵
  PID:15736
- C:\Windows\System\tKmRaji.exe
  C:\Windows\System\tKmRaji.exe
  2⤵
  PID:15768
- C:\Windows\System\GPdBlyl.exe
  C:\Windows\System\GPdBlyl.exe
  2⤵
  PID:15788
- C:\Windows\System\VTcToMu.exe
  C:\Windows\System\VTcToMu.exe
  2⤵
  PID:15840
- C:\Windows\System\OSKcMJj.exe
  C:\Windows\System\OSKcMJj.exe
  2⤵
  PID:15868
- C:\Windows\System\SOzXITR.exe
  C:\Windows\System\SOzXITR.exe
  2⤵
  PID:15884
- C:\Windows\System\gWRVegA.exe
  C:\Windows\System\gWRVegA.exe
  2⤵
  PID:15924
- C:\Windows\System\Mqyxenn.exe
  C:\Windows\System\Mqyxenn.exe
  2⤵
  PID:15940
- C:\Windows\System\EVPHofY.exe
  C:\Windows\System\EVPHofY.exe
  2⤵
  PID:15960
- C:\Windows\System\qCHbPcV.exe
  C:\Windows\System\qCHbPcV.exe
  2⤵
  PID:15984
- C:\Windows\System\AnhjsmN.exe
  C:\Windows\System\AnhjsmN.exe
  2⤵
  PID:16004
- C:\Windows\System\geaEFUZ.exe
  C:\Windows\System\geaEFUZ.exe
  2⤵
  PID:16028
- C:\Windows\System\TmpnAKS.exe
  C:\Windows\System\TmpnAKS.exe
  2⤵
  PID:16072
- C:\Windows\System\xXHRWAh.exe
  C:\Windows\System\xXHRWAh.exe
  2⤵
  PID:16108
- C:\Windows\System\qspdqJa.exe
  C:\Windows\System\qspdqJa.exe
  2⤵
  PID:16128
- C:\Windows\System\KPqHZXb.exe
  C:\Windows\System\KPqHZXb.exe
  2⤵
  PID:16152
- C:\Windows\System\EBnOfTY.exe
  C:\Windows\System\EBnOfTY.exe
  2⤵
  PID:16184
- C:\Windows\System\OxhQsoE.exe
  C:\Windows\System\OxhQsoE.exe
  2⤵
  PID:16224
- C:\Windows\System\cioeEDz.exe
  C:\Windows\System\cioeEDz.exe
  2⤵
  PID:16240
- C:\Windows\System\pHHlSLB.exe
  C:\Windows\System\pHHlSLB.exe
  2⤵
  PID:16280
- C:\Windows\System\VoUKXzm.exe
  C:\Windows\System\VoUKXzm.exe
  2⤵
  PID:16320
- C:\Windows\System\tDBoOSA.exe
  C:\Windows\System\tDBoOSA.exe
  2⤵
  PID:16348
- C:\Windows\System\uhPkrvB.exe
  C:\Windows\System\uhPkrvB.exe
  2⤵
  PID:16364
- C:\Windows\System\VCOznAx.exe
  C:\Windows\System\VCOznAx.exe
  2⤵
  PID:15124
- C:\Windows\System\CtVrdnb.exe
  C:\Windows\System\CtVrdnb.exe
  2⤵
  PID:15424
- C:\Windows\System\SjgzBSq.exe
  C:\Windows\System\SjgzBSq.exe
  2⤵
  PID:15508
- C:\Windows\System\qoUXrzR.exe
  C:\Windows\System\qoUXrzR.exe
  2⤵
  PID:15532
- C:\Windows\System\uvrZMFy.exe
  C:\Windows\System\uvrZMFy.exe
  2⤵
  PID:15620
- C:\Windows\System\dQJDSIw.exe
  C:\Windows\System\dQJDSIw.exe
  2⤵
  PID:15636
- C:\Windows\System\oFKJlLT.exe
  C:\Windows\System\oFKJlLT.exe
  2⤵
  PID:15684
- C:\Windows\System\uLFnbnV.exe
  C:\Windows\System\uLFnbnV.exe
  2⤵
  PID:15724
- C:\Windows\System\RIWiZfQ.exe
  C:\Windows\System\RIWiZfQ.exe
  2⤵
  PID:15824
- C:\Windows\System\cCeamgu.exe
  C:\Windows\System\cCeamgu.exe
  2⤵
  PID:15880
- C:\Windows\System\oKTQODA.exe
  C:\Windows\System\oKTQODA.exe
  2⤵
  PID:15916
- C:\Windows\System\LUUzxAg.exe
  C:\Windows\System\LUUzxAg.exe
  2⤵
  PID:16016
- C:\Windows\System\wPMSLhz.exe
  C:\Windows\System\wPMSLhz.exe
  2⤵
  PID:16148
- C:\Windows\System\pwjsHYH.exe
  C:\Windows\System\pwjsHYH.exe
  2⤵
  PID:16200
- C:\Windows\System\tJMJVfI.exe
  C:\Windows\System\tJMJVfI.exe
  2⤵
  PID:16232
- C:\Windows\System\WuVofMO.exe
  C:\Windows\System\WuVofMO.exe
  2⤵
  PID:16276
- C:\Windows\System\nieUdbr.exe
  C:\Windows\System\nieUdbr.exe
  2⤵
  PID:16332
- C:\Windows\System\sevmMYZ.exe
  C:\Windows\System\sevmMYZ.exe
  2⤵
  PID:15384
- C:\Windows\System\ITkHuZq.exe
  C:\Windows\System\ITkHuZq.exe
  2⤵
  PID:15580
- C:\Windows\System\XyKmORA.exe
  C:\Windows\System\XyKmORA.exe
  2⤵
  PID:15732
- C:\Windows\System\xMvSlJo.exe
  C:\Windows\System\xMvSlJo.exe
  2⤵
  PID:15908
- C:\Windows\System\XrGMCgU.exe
  C:\Windows\System\XrGMCgU.exe
  2⤵
  PID:16088
- C:\Windows\System\mGgyRpd.exe
  C:\Windows\System\mGgyRpd.exe
  2⤵
  PID:16172
- C:\Windows\System\TBxBSKb.exe
  C:\Windows\System\TBxBSKb.exe
  2⤵
  PID:16336
- C:\Windows\System\sWSippu.exe
  C:\Windows\System\sWSippu.exe
  2⤵
  PID:15536
- C:\Windows\System\znWbyWw.exe
  C:\Windows\System\znWbyWw.exe
  2⤵
  PID:16124
- C:\Windows\System\KeNSLqO.exe
  C:\Windows\System\KeNSLqO.exe
  2⤵
  PID:16236
- C:\Windows\System\OjtVURS.exe
  C:\Windows\System\OjtVURS.exe
  2⤵
  PID:16104
- C:\Windows\System\LXnMWuI.exe
  C:\Windows\System\LXnMWuI.exe
  2⤵
  PID:16260
- C:\Windows\System\gBRFOtH.exe
  C:\Windows\System\gBRFOtH.exe
  2⤵
  PID:16400
- C:\Windows\System\ptJKwHP.exe
  C:\Windows\System\ptJKwHP.exe
  2⤵
  PID:16416
- C:\Windows\System\FnqTcHQ.exe
  C:\Windows\System\FnqTcHQ.exe
  2⤵
  PID:16440
- C:\Windows\System\KogeMxc.exe
  C:\Windows\System\KogeMxc.exe
  2⤵
  PID:16460
- C:\Windows\System\dVpiTeh.exe
  C:\Windows\System\dVpiTeh.exe
  2⤵
  PID:16496
- C:\Windows\System\MbltAcs.exe
  C:\Windows\System\MbltAcs.exe
  2⤵
  PID:16520
- C:\Windows\System\HXrNqMj.exe
  C:\Windows\System\HXrNqMj.exe
  2⤵
  PID:16560
- C:\Windows\System\dzElBxK.exe
  C:\Windows\System\dzElBxK.exe
  2⤵
  PID:16584
- C:\Windows\System\WHeQkWc.exe
  C:\Windows\System\WHeQkWc.exe
  2⤵
  PID:16648
- C:\Windows\System\FTpLcpt.exe
  C:\Windows\System\FTpLcpt.exe
  2⤵
  PID:16664
- C:\Windows\System\iSsLvUX.exe
  C:\Windows\System\iSsLvUX.exe
  2⤵
  PID:16680
- C:\Windows\System\jBVmgNu.exe
  C:\Windows\System\jBVmgNu.exe
  2⤵
  PID:16708
- C:\Windows\System\oPWgNdN.exe
  C:\Windows\System\oPWgNdN.exe
  2⤵
  PID:16728
- C:\Windows\System\dgDiBVs.exe
  C:\Windows\System\dgDiBVs.exe
  2⤵
  PID:16756
- C:\Windows\System\LzfEbaT.exe
  C:\Windows\System\LzfEbaT.exe
  2⤵
  PID:16792
- C:\Windows\System\PiXNpex.exe
  C:\Windows\System\PiXNpex.exe
  2⤵
  PID:16816
- C:\Windows\System\NgoQiHx.exe
  C:\Windows\System\NgoQiHx.exe
  2⤵
  PID:16844

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:17208

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\GwQunwg.exe

Filesize
1009KB

MD5
2755ce8222a73eeee352b5017f4fb228

SHA1
65fccc9ff72d3bca669098dc813618539cfe6757

SHA256
12242cca93b81c29090c3da82b24890ac2fdba38c96cde90b3dd9ae349cc049f

SHA512
26f7787a737603eb87433768c4c52c53a94743ac3e20e3996e8647bb3ad88f9f8b1c2d4977ca718a183aeac154655a87e52807367dca3993f2f5721352597f1e

Download Submit
C:\Windows\System\HWdcjTf.exe

Filesize
1003KB

MD5
ea2d5afb703b6855021c58d9d15da7bf

SHA1
7d8ccf379b868a36644f9247567d710b3906e26f

SHA256
d05997a4860b977665c3a6607c7fb571aa5eca1a93cf6692fe028a0807346df8

SHA512
2265558b152b41309eccacd02f2f457f9c474ac2b1f0884215897a3be657139f620998a9b32fe5c0387c4c7cb5ec4b3b8cf31b950705666d66a58ccf68efb972

Download Submit
C:\Windows\System\ILkOrnN.exe

Filesize
1006KB

MD5
97f297b78492c32c9e160cf0709b68e2

SHA1
493afe2761329087312c702acd1ae5188b8d0c8b

SHA256
57d6a8fea53f9ecae23a11be502976f3189bd780c5aaae08d26bccce295804e1

SHA512
5f02bfad2a31f945c45f9c9449043cd7eb3e65c912d04ae7c725bdb4cefd578c7c1341d0c220d698d49606be26404ba00b64fa7cb8af5b1036f338713f68c474

Download Submit
C:\Windows\System\JRtvfBO.exe

Filesize
1008KB

MD5
3d0f5c532927cb9c085074bed905ff52

SHA1
d77972bd977b9282535ee5ed1fbed7aa2fd37e56

SHA256
e5230e796ae2b688beb204b40b60acbade3ddcaeaf518b3ec04a329b9614b704

SHA512
d17b1589628c8723bd5e88a1b8e03fcd4ab1a58185cc2ae3dd1560193f3348a75542855133da60111e24820722456d103137579e2ec02d4b0d1110e1fd026796

Download Submit
C:\Windows\System\JasNhxu.exe

Filesize
1010KB

MD5
c132207cc7ea48c918e11c0676a4196a

SHA1
12719a108ec553814b5193cb51d238148a8fdb6f

SHA256
63a96736db581cd89a613217ed0c6dd1e84872e6cf22f27b9a53809fc9d2b084

SHA512
d259cecd509d8e0efc4b42277ad3b9fa3543ba00d1fae70e808483239756f29415f514c7b72913a2ba69d2f2e345cd5f79fb916547b28f9aea4ec7b0a49a7701

Download Submit
C:\Windows\System\LGHxGiI.exe

Filesize
1009KB

MD5
d21d598fd653f4bf59c7ddb85ad21746

SHA1
d7f180e68ea07dbcfb9a63d5cd3ab0a4a27e72db

SHA256
62ca82734e5328f25fa7c83b05760eb1e96463e9bca85132c5570850710976bd

SHA512
dd0c1458b21f5487ec4960dff5f7b463d43bc2519389716f4763409e93f17b8f2161d0b3d055ee133934328a4939a1a004abab7302f993a8318de44d37dc5596

Download Submit
C:\Windows\System\LaLCfNR.exe

Filesize
1003KB

MD5
c3c22f1e2823d4774ff0616bbbd67c1b

SHA1
79a13f71a9ec6f3e476996c5bcebaef401573d51

SHA256
e0ff1ff679e4964e369d026b6190664bb973cf0cd3becde6f65f84daff922a0a

SHA512
03ba8a3eaccb2ffde87bac227252b241b4a2e2603f7cf06c6dc41a6c23582fe65c528af5861022fdf9f3dc36ab043bf5225b34289c568d3cfbd830d1987499e1

Download Submit
C:\Windows\System\NDbIrBw.exe

Filesize
1002KB

MD5
ecdc79b027634a0a06fd15f9200b8aa2

SHA1
4999c5948274a337bd07432fbdf3b8af74c91806

SHA256
429c2c879e83082627245aa6d522471008f7fe1c4819389eb9d7e43ea6f79f01

SHA512
07fe65cb592f1f47b1a01f95d25470f38de689f636448c8925b935cd6de6b15d11207a3bb6ed6bb72c2d35440dfd97d46133a426fd4c2e35b7424a13e0e5afdc

Download Submit
C:\Windows\System\NIFvelk.exe

Filesize
1007KB

MD5
b65850298baa8f3b60464d06d246c57a

SHA1
a4d5306875670dacf7dbad8000a93b56dfcc077e

SHA256
ea89d1557bc197d9846df56db362f09e12fcc73e57aa08f4bf4b4bc553e5c6b0

SHA512
ddb0648cce2174dd05af22e34be0b6bd086d249a8dc9ba52547e15350dc0bb0ea99c762d5ed5a49916dab9e5addbeb83f48d54408bb26914476bc14d7d4183cc

Download Submit
C:\Windows\System\SJyGzFy.exe

Filesize
1007KB

MD5
aafbf0af5bce0d26c40e8412da2a327d

SHA1
4827fe0623880207d51f85af4c908f6fef434a1e

SHA256
083400a4242976cfe6cbbc05758c361a525f2f0c9211c3cc2d3bbf0d0d9784c4

SHA512
faaa27461807e231a4eb8b9275f4384fa41296234a9c5dce0a88b8233da149073be6b3d97c4131c6cfc6ca951baef78e3aae2a5da605622fddf1140655fcd1d7

Download Submit
C:\Windows\System\SjVVNME.exe

Filesize
1002KB

MD5
e6cb9e83244dd8891940cb8ddab30672

SHA1
6f1e9922888bc8530baed0768a37c2ff8ca5269a

SHA256
7a5abf4d4069419d048361513f2f46a7bb18faff3bee05958c7be6f5b07813d5

SHA512
d06411defd240a4e6b83a259594a6587ae2c726c051b5ea3eb92719ef2265e82d3dc92a38dd9434ba8a6ff92512f9e86b4a2c0f2c139d021ce0520c9a64fb06f

Download Submit
C:\Windows\System\TGtrocG.exe

Filesize
1008KB

MD5
8347784723f7cf249929d709b999055a

SHA1
9edc311060c5ae5cd2ad6b8bb98486790e80d562

SHA256
0276d90cdfa1b3afe9f5ed3e741080b9ed4918888eb115af851b11c37ec6b76c

SHA512
f4df775bbf29e5951f1266ccc6f3a7b506b5b05ec498db5b2a32a0e731e5b89e4b86b28878f2d5ec4a189fd5e641cab717ca7254ea45dd8ef6bd188ee61b7af3

Download Submit
C:\Windows\System\VSfxYqe.exe

Filesize
1005KB

MD5
ba284a745ce04fb464f598b5c60637d5

SHA1
8b0fac60be266f3df1364eabf9cdda997d5bc291

SHA256
5ce86e6ed3dcd97fa62e8b1e0deb4a80b0ded948b20b735b220717752600a75e

SHA512
c95804256aaf1bab98888f462c3e0321de02a0d7babae0c12bdc3d5da8f3abb0492bd07d6006a66a9c46c328fd623a8c76e8c62fc8df671a5341c1fba5d8988b

Download Submit
C:\Windows\System\WzkxGRA.exe

Filesize
1009KB

MD5
ee95e3298921dcfe3a581caff60ed7f9

SHA1
a9ba9f0317cab5e6ad56c5f061d3369cb2ce824c

SHA256
0e297d931a31f98ed81ae5e812b636a72b8c3aa791992105f0aa0dfb15998c8b

SHA512
b0254b7cb41dc775c583f41b00c5cf850d908681400cff239851b9d80e44c5d2a72c21fe2d49b1e2f174169edf6d6ecd7ffc5587dab10f14e01d2c3ce672948d

Download Submit
C:\Windows\System\XDvNqEX.exe

Filesize
1005KB

MD5
8b4742972dfc5d04d1340f7dbc86d181

SHA1
5122089d2c905750b6fad80e935960d1bf38a159

SHA256
78855b9eb6165290553586cf1ced9dc43529f1fd5d3b9129082bf2375c749891

SHA512
65b2728eca04bf277c2faa8d66dfbac8f77a562e8dbae3a269fb413deb180d15bef4472fa7ab7871bf43d9d11e93c9452acef9bf99afc61eb576b7af1964d424

Download Submit
C:\Windows\System\YKZeNCb.exe

Filesize
1009KB

MD5
a0ea48d03a7cd46006bce9016f92d8d5

SHA1
4d9ba3308d64c32abb79867227f5b17d51d002be

SHA256
7a94da7a202dee0826c61cf255edd2263b29c345ab19a77a852802dc1b9c2984

SHA512
f793a8cd9e600623e9da578c5e0ae3badda33448c39e40ff08186f45c2586aca05503905a20685205a882fb2867a9a4255714e4bc8e8c1aa473cf6d32cf63107

Download Submit
C:\Windows\System\bGxpplf.exe

Filesize
1004KB

MD5
4098dc3773b4f1aa9b1319c8d499785d

SHA1
78c4b52b1b7f504e6f498ca1548611ed5866d1b6

SHA256
1d109f318da907504214726ac943514d9fece53b4e84c1dcb46b58b8cd969a73

SHA512
bb3e98ecddfdb4eaf054462e0deecd2e92f7b5179b00c728eacc826ddd188d85878367d84bcca4f0f3f60e54752c6c09ea40ae0574ce4c25bcceb7b1735049be

Download Submit
C:\Windows\System\cUAciaV.exe

Filesize
1004KB

MD5
fc8916b1890656988ce5eb85849df653

SHA1
6408909abb1c6ab8975109f1993b2c1bea663503

SHA256
dada7540131961c5e53408826aec76388f2d14d2f1e4f285cecebea203ab2f40

SHA512
1327487e3692b72e4ca6dff3643f370c5608f32e48f01940e3f5c5724bbdf9e55d38cbf90ee2b7aa9a49be650bff7fa72dd64c36e3cfbe55f956e8266e20cd8f

Download Submit
C:\Windows\System\ejzPMGu.exe

Filesize
1008KB

MD5
c9495aa05190bfd5eab9fc61922fa49e

SHA1
613b61343052243f3f6916049905320f6fa88e7d

SHA256
a16a611c8be5caf49da88f1edb5760e1a4c7ffa092320eeebd7278c6014a0518

SHA512
1a9ba4cfdd7ba4de7d8bd599c0227e02a2d95db8fe7662c2531ad73fb2474fffbf60a60d936878aaf5991239583f9bc8836706b56967f93fe95a6e6fd79379b1

Download Submit
C:\Windows\System\eksHgzi.exe

Filesize
1006KB

MD5
8a799a3b0456caa5f4f6838ababc1e10

SHA1
c61efb4d3528f29bfee8e61cc0922337a10b0efc

SHA256
3e928eed52810169a8e779f17ebecdb76357d13550c01b49f7558c8f954ae06d

SHA512
7a914f4aae4362fdcebd1a182cfb6c4c1ae1348b6ff1822725ac8cd802fe6c4985c344c6e1c00fec4ace11b632f359e4251fda0164b34010f0b394e39613fbd8

Download Submit
C:\Windows\System\hJbQbJn.exe

Filesize
1006KB

MD5
b7883faf5d178abaaccf9666851a35d2

SHA1
ec3d06951aee3c10ab508d752440f5b843abb5d8

SHA256
a5a7cd6afc4f78a9645d8aaceab94d35ebd8d10a92d56a6417c145df2567a585

SHA512
132a8875149e3b267fc266c36f342262fbba657d649681319c2c127481c8eef5e82de61280b48a723d76af9632dcc4cbb1e20d6e36d80e1da2dc050ce239ddbb

Download Submit
C:\Windows\System\hlhLQWD.exe

Filesize
1004KB

MD5
a1a3c92e0a48a2267a8e3db15dbf0021

SHA1
4af28de78d17a8b8ec75b56a4f1ef41e4e2e2131

SHA256
dbb7314c240ec0609b764ccc1133d9179f00553dd4ad5fc195bc050983601927

SHA512
a861b897d64a0ba1e84ddb5225adb3b0d832e5484564f4b9a5e7a142aae28558bb18341ac2a0983e509b79d925653ed3be50cd9b9e339e2a81418b88bc167b8c

Download Submit
C:\Windows\System\kCMTAYU.exe

Filesize
1005KB

MD5
68733b6ebdf70ae8516d651dcfc8fea0

SHA1
d441bbd993d248a13dac9e9e4624213e3b109e77

SHA256
8d51371167a232c9395709fb475eec5aa90e18e6073872b4835a86e8f0fe2877

SHA512
7951563db38520fc1cfabf49d70e2dc06cfdd67da1158fdbfde2e17af959317da640ba82efb1b97de9b1485acd83e44547357e6be83b79890a61f27e4e006dd9

Download Submit
C:\Windows\System\piBahvJ.exe

Filesize
1005KB

MD5
3cc18380ac397f55f1c949a61a12a32d

SHA1
ca8a2846916b47cb83c3225d6b16d02a02b0d4b2

SHA256
54e044ac942dc200df17793d0f118bf53abc69b5ddd7a154d4e660fbcb49cb25

SHA512
25e72f2b2af0e78c0be1b5a29b8cab40dc0f82b0bda56022adb938fb8cefedc46d9807caa07b5897485a9d8c175dc697c2872ab0decb7d0431a9e3233c06f2df

Download Submit
C:\Windows\System\qCiRPGK.exe

Filesize
1006KB

MD5
3d09acb4419f36b7d61de568d33f43d3

SHA1
0adfc28a10051cac7d7c03e733538d810d9f2838

SHA256
7ad27a247d5bea134c4d6dcb4f17bc9aa295df053d00abdf0d01b41cbc855d90

SHA512
643cdc24e788ca666757aba817cb36724afda3e98d2b7f456b198eae848427a25648334373ef851121466639d2f09d40e2dc8a272391309e1676c3f3593dc0c0

Download Submit
C:\Windows\System\rJnyLaT.exe

Filesize
1003KB

MD5
a2918e0545a9bb19d1b5d5b062430985

SHA1
e31efd202913645e01dd6aa39c71c0998ae25ac1

SHA256
caf7270fe66529d4bcc0978229cd5fdfdf23181589aefe4b8d54f9eef6ba9fb5

SHA512
5fab7dfa8838858c84362c66fdf41da8a592fe3305ac296c30a7f5644a67fddf0f80b16320a5e771b206dfff2ee7f7b760c271efe3d114967959d039daa60534

Download Submit
C:\Windows\System\srEohEu.exe

Filesize
1002KB

MD5
5276fb2b148ebfed4bc14aef23b4ede8

SHA1
8c363adf631405fdb1c3e5a0d40dff6b2f72eb21

SHA256
c8ddb7f2ca6936c4212c5e3984d7a88dad70d21a440f72f1d7a1e31b37b54bbd

SHA512
c65d6c6dfe30669405a2d7607620c26c5aef45d202fb245001e4fccc98d12d5d61af543254860297e671c4a71ee4016e56dbd24f17f33e8ae32cb1c4ab35d8a7

Download Submit
C:\Windows\System\ulKHhTH.exe

Filesize
1007KB

MD5
7092592c6a35238f5b0be745c6673c20

SHA1
eae7857c823e19b882ceeced2d2969f8ea78b2bd

SHA256
dcc1cf5667d46dc7480dd091cb74fe0293473374f359e28b5af67696f8427e1b

SHA512
2aedaf9e8eb78f0e25c76e3e92241448d71905761ed53d9764a9a83195771b9e39c26fa8f72bb134e6a26f8ded79384fc766f5149b2a04938614427d1a90bb58

Download Submit
C:\Windows\System\wsCmdEK.exe

Filesize
1005KB

MD5
e9eeab21579ed52c9ea5e0fe0af32bfe

SHA1
b18c8a2d0e4ff64a0f8f992f4a7417aa7d843e84

SHA256
ef10c8e5eac116ae64037fe4d9ae67bab730e847f55257b18c605ce53ba4abea

SHA512
0ac75b81d36ba6ceaa42d83fb07e76622a5c8e15e7ab3dad31bcaeb20dd81eb086197f6a7a23a0ef1500e1bb525929aa20f32a20d93853e0b74be82da592f39b

Download Submit
C:\Windows\System\xmRtPnI.exe

Filesize
1004KB

MD5
7d3ae1c025088e764e6ad296b2e0b2c4

SHA1
7e0363713ae0ec351e8b62dd7430ce7831fa02e0

SHA256
20e355fa3e6408ed55220e664b9e04afdb8a79a4e993d3c15c3d4a8240008894

SHA512
77f285ebd3039376469ada89417e4c66b0b4c492ec86bc12c3b6dc7950c9c259ef8bf7c1c4b74ebf752d622995d8d03e4a5848b0a0d83dc409b877e141e52709

Download Submit
C:\Windows\System\yBpntQg.exe

Filesize
1007KB

MD5
37a0c7cf0d247925b7889189cea38c9c

SHA1
481040336872835bbfe1351d1c92b584fadb9230

SHA256
80534976bbac840aadde704906e293886c9c8cf52535781302253ce0303d696d

SHA512
ceb859a2e68d0456610db3301383c9dbcfa6d7192b56e36e33992f4fd39488922844a41838621f6584b872b77c6c13aed83ee50ba5b7fab3c88ef5c4778023c7

Download Submit
C:\Windows\System\zCuMlHS.exe

Filesize
1003KB

MD5
1111be6631cf6406d5563067d9e9cd19

SHA1
706bf6c5e47ec09ec2db82dc24fea52f30dc67bc

SHA256
1243942ecdbd61c8a2b5bcf0a7c92aa1329155eb13a3f2dc648978ced9720503

SHA512
ce2b862d2435b22cf9d9020ccab6862655fd9074841a8fe37917d0ef91b3da56856073eb73466da9dd8b4e1c4e4f9250f65b382d426cf59d73cc083d0311d09a

Download Submit
C:\Windows\System\zFyMKcM.exe

Filesize
1008KB

MD5
1d4ab97d78e9e60a699a6389b078b9ec

SHA1
92df7709bcb89f78c5f3a73f0bd693e51492c5f3

SHA256
4f61747577a32b4aee5e0d4b9ff48d76fb89ee604d3647e37c41aea1bcaa0c40

SHA512
32f0a0df58d41d1f1f2b7b00830e8d3bc4e83aa3ca2e185aeb13b087de37a9ff3a28818c71629280ab6cff3f7e5ef790fd89f9bc28d3710e9450104360af733e

Download Submit
memory/3672-0-0x000001FDA7AE0000-0x000001FDA7AF0000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads