xmrig | 2ca66adceff529a3f1d59b410ca5830b8022a66272180da6670a22cda1257a3a

Analysis

max time kernel
120s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
23-12-2024 20:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2ca66adceff529a3f1d59b410ca5830b8022a66272180da6670a22cda1257a3a.exe
Size

1.8MB
MD5

17b897aa20fbc08bf905207e3926b679
SHA1

b24882d294ada328a491e011312be2cd4d514ae0
SHA256

2ca66adceff529a3f1d59b410ca5830b8022a66272180da6670a22cda1257a3a
SHA512

6009d2532b223c8afd784d732d04df40b9ed02ca4819bd2f6180f34fe03e84024ce0a258297216067586e47f91c64360dcbf33b2d074fd507456f0596a5f0e31
SSDEEP

49152:GezaTF8FcNkNdfE0pZ9ozttwIRxj4c5yOBZnmxZ7eqa:GemTLkNdfE0pZyb

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 33 IoCs

miner

resource	yara_rule
behavioral2/files/0x0009000000023c6a-4.dat	xmrig
behavioral2/files/0x0008000000023cba-9.dat	xmrig
behavioral2/files/0x0007000000023cbe-14.dat	xmrig
behavioral2/files/0x0007000000023cc0-21.dat	xmrig
behavioral2/files/0x0007000000023cc1-33.dat	xmrig
behavioral2/files/0x0007000000023cc6-58.dat	xmrig
behavioral2/files/0x0007000000023cce-98.dat	xmrig
behavioral2/files/0x0007000000023cd3-117.dat	xmrig
behavioral2/files/0x0007000000023cd6-140.dat	xmrig
behavioral2/files/0x0007000000023cdc-162.dat	xmrig
behavioral2/files/0x0007000000023cda-160.dat	xmrig
behavioral2/files/0x0007000000023cdb-157.dat	xmrig
behavioral2/files/0x0007000000023cd9-155.dat	xmrig
behavioral2/files/0x0007000000023cd8-150.dat	xmrig
behavioral2/files/0x0007000000023cd7-145.dat	xmrig
behavioral2/files/0x0007000000023cd5-135.dat	xmrig
behavioral2/files/0x0007000000023cd4-130.dat	xmrig
behavioral2/files/0x0007000000023cd2-120.dat	xmrig
behavioral2/files/0x0007000000023cd1-115.dat	xmrig
behavioral2/files/0x0007000000023cd0-110.dat	xmrig
behavioral2/files/0x0007000000023ccf-103.dat	xmrig
behavioral2/files/0x0007000000023ccd-93.dat	xmrig
behavioral2/files/0x0007000000023ccc-88.dat	xmrig
behavioral2/files/0x0007000000023ccb-83.dat	xmrig
behavioral2/files/0x0007000000023cca-78.dat	xmrig
behavioral2/files/0x0007000000023cc9-73.dat	xmrig
behavioral2/files/0x0007000000023cc8-68.dat	xmrig
behavioral2/files/0x0007000000023cc7-63.dat	xmrig
behavioral2/files/0x0007000000023cc5-53.dat	xmrig
behavioral2/files/0x0007000000023cc4-47.dat	xmrig
behavioral2/files/0x0007000000023cc3-43.dat	xmrig
behavioral2/files/0x0007000000023cc2-37.dat	xmrig
behavioral2/files/0x0007000000023cbf-23.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
4700	zDpppcB.exe
448	aBqYIJb.exe
2264	xDawisz.exe
3968	BSbQpHY.exe
4364	cLYLpau.exe
920	MQSYsyW.exe
3020	NqWLQrN.exe
3840	OZpBnBG.exe
2612	LhkRyMn.exe
848	sJIinun.exe
1544	hjxfmOJ.exe
4344	jkWYVJr.exe
1316	IPEJHpP.exe
2088	ijYakPm.exe
5040	hvFBhdW.exe
1004	hSsxqGM.exe
5108	RYvFGND.exe
1124	IDCWtwK.exe
1632	dPmNJvv.exe
4668	FyxghBG.exe
3920	EKUnpwI.exe
2716	AXdPIZr.exe
2248	DxigmIa.exe
2980	qODJMWy.exe
4724	fThdhQI.exe
2204	LrJIlZB.exe
3488	ZkJUGYs.exe
984	mjMQZnK.exe
5004	kAkQhYa.exe
2996	OOlWHxw.exe
4452	XcLuqBy.exe
4832	urihFuJ.exe
4712	rkCcseP.exe
1804	yawOvXX.exe
3668	HXAtAYz.exe
3332	ZRITcHr.exe
432	QGoHsoy.exe
4392	OYFDfbW.exe
4040	achiUHr.exe
3508	QrQxMeJ.exe
1176	vysrDge.exe
380	VUEQDWN.exe
1060	KQzvSoJ.exe
2216	rMNWLdD.exe
4680	RXrNGdX.exe
2824	oYqBovs.exe
3656	NSxaOSY.exe
4536	DBJhXBR.exe
2396	GbLsSuK.exe
3676	ILRlDnI.exe
4980	lFLyPuS.exe
4620	LTIcRlY.exe
4568	veJBXSm.exe
2844	nwtFvRN.exe
2840	ezFmHjm.exe
4420	EvEMNgE.exe
4428	jmbnVgT.exe
2712	PasXvgE.exe
1932	ZEnosMa.exe
5072	SpuqVvd.exe
1516	RAYpEyw.exe
2864	xzUgYsn.exe
736	MoaaeZh.exe
1080	XzHDcAE.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\Yttmpte.exe	2ca66adceff529a3f1d59b410ca5830b8022a66272180da6670a22cda1257a3a.exe
File created	C:\Windows\System\fQMANfB.exe	2ca66adceff529a3f1d59b410ca5830b8022a66272180da6670a22cda1257a3a.exe
File created	C:\Windows\System\MfMWvpW.exe	2ca66adceff529a3f1d59b410ca5830b8022a66272180da6670a22cda1257a3a.exe
File created	C:\Windows\System\FWbkgQP.exe	2ca66adceff529a3f1d59b410ca5830b8022a66272180da6670a22cda1257a3a.exe
File created	C:\Windows\System\hsuAfSc.exe	2ca66adceff529a3f1d59b410ca5830b8022a66272180da6670a22cda1257a3a.exe
File created	C:\Windows\System\FlCvLuL.exe	2ca66adceff529a3f1d59b410ca5830b8022a66272180da6670a22cda1257a3a.exe
File created	C:\Windows\System\fNiNvPZ.exe	2ca66adceff529a3f1d59b410ca5830b8022a66272180da6670a22cda1257a3a.exe
File created	C:\Windows\System\Vmouhsk.exe	2ca66adceff529a3f1d59b410ca5830b8022a66272180da6670a22cda1257a3a.exe
File created	C:\Windows\System\iLjnkRg.exe	2ca66adceff529a3f1d59b410ca5830b8022a66272180da6670a22cda1257a3a.exe
File created	C:\Windows\System\mjMQZnK.exe	2ca66adceff529a3f1d59b410ca5830b8022a66272180da6670a22cda1257a3a.exe
File created	C:\Windows\System\sKtOBtb.exe	2ca66adceff529a3f1d59b410ca5830b8022a66272180da6670a22cda1257a3a.exe
File created	C:\Windows\System\jZFUqxF.exe	2ca66adceff529a3f1d59b410ca5830b8022a66272180da6670a22cda1257a3a.exe
File created	C:\Windows\System\VmQFkAU.exe	2ca66adceff529a3f1d59b410ca5830b8022a66272180da6670a22cda1257a3a.exe
File created	C:\Windows\System\utJatsP.exe	2ca66adceff529a3f1d59b410ca5830b8022a66272180da6670a22cda1257a3a.exe
File created	C:\Windows\System\vNdBPNu.exe	2ca66adceff529a3f1d59b410ca5830b8022a66272180da6670a22cda1257a3a.exe
File created	C:\Windows\System\GAowLmm.exe	2ca66adceff529a3f1d59b410ca5830b8022a66272180da6670a22cda1257a3a.exe
File created	C:\Windows\System\GCmBiaR.exe	2ca66adceff529a3f1d59b410ca5830b8022a66272180da6670a22cda1257a3a.exe
File created	C:\Windows\System\Qnwcfec.exe	2ca66adceff529a3f1d59b410ca5830b8022a66272180da6670a22cda1257a3a.exe
File created	C:\Windows\System\kPlpjpY.exe	2ca66adceff529a3f1d59b410ca5830b8022a66272180da6670a22cda1257a3a.exe
File created	C:\Windows\System\fDQjXQk.exe	2ca66adceff529a3f1d59b410ca5830b8022a66272180da6670a22cda1257a3a.exe
File created	C:\Windows\System\DIeJbzN.exe	2ca66adceff529a3f1d59b410ca5830b8022a66272180da6670a22cda1257a3a.exe
File created	C:\Windows\System\JWIZnKj.exe	2ca66adceff529a3f1d59b410ca5830b8022a66272180da6670a22cda1257a3a.exe
File created	C:\Windows\System\NSxaOSY.exe	2ca66adceff529a3f1d59b410ca5830b8022a66272180da6670a22cda1257a3a.exe
File created	C:\Windows\System\BSBBmnb.exe	2ca66adceff529a3f1d59b410ca5830b8022a66272180da6670a22cda1257a3a.exe
File created	C:\Windows\System\qjurCjG.exe	2ca66adceff529a3f1d59b410ca5830b8022a66272180da6670a22cda1257a3a.exe
File created	C:\Windows\System\xevikDZ.exe	2ca66adceff529a3f1d59b410ca5830b8022a66272180da6670a22cda1257a3a.exe
File created	C:\Windows\System\MRsMFPW.exe	2ca66adceff529a3f1d59b410ca5830b8022a66272180da6670a22cda1257a3a.exe
File created	C:\Windows\System\UFWzzjr.exe	2ca66adceff529a3f1d59b410ca5830b8022a66272180da6670a22cda1257a3a.exe
File created	C:\Windows\System\icqAphg.exe	2ca66adceff529a3f1d59b410ca5830b8022a66272180da6670a22cda1257a3a.exe
File created	C:\Windows\System\GbUQydW.exe	2ca66adceff529a3f1d59b410ca5830b8022a66272180da6670a22cda1257a3a.exe
File created	C:\Windows\System\nkDGZBj.exe	2ca66adceff529a3f1d59b410ca5830b8022a66272180da6670a22cda1257a3a.exe
File created	C:\Windows\System\twxxSmq.exe	2ca66adceff529a3f1d59b410ca5830b8022a66272180da6670a22cda1257a3a.exe
File created	C:\Windows\System\PxzDIjN.exe	2ca66adceff529a3f1d59b410ca5830b8022a66272180da6670a22cda1257a3a.exe
File created	C:\Windows\System\leKhiZO.exe	2ca66adceff529a3f1d59b410ca5830b8022a66272180da6670a22cda1257a3a.exe
File created	C:\Windows\System\hjxfmOJ.exe	2ca66adceff529a3f1d59b410ca5830b8022a66272180da6670a22cda1257a3a.exe
File created	C:\Windows\System\laAItyf.exe	2ca66adceff529a3f1d59b410ca5830b8022a66272180da6670a22cda1257a3a.exe
File created	C:\Windows\System\jHDioAZ.exe	2ca66adceff529a3f1d59b410ca5830b8022a66272180da6670a22cda1257a3a.exe
File created	C:\Windows\System\LhkRyMn.exe	2ca66adceff529a3f1d59b410ca5830b8022a66272180da6670a22cda1257a3a.exe
File created	C:\Windows\System\qIyyXdP.exe	2ca66adceff529a3f1d59b410ca5830b8022a66272180da6670a22cda1257a3a.exe
File created	C:\Windows\System\CUpYfUP.exe	2ca66adceff529a3f1d59b410ca5830b8022a66272180da6670a22cda1257a3a.exe
File created	C:\Windows\System\vdJmMwi.exe	2ca66adceff529a3f1d59b410ca5830b8022a66272180da6670a22cda1257a3a.exe
File created	C:\Windows\System\Czrpyhz.exe	2ca66adceff529a3f1d59b410ca5830b8022a66272180da6670a22cda1257a3a.exe
File created	C:\Windows\System\IlBRmaH.exe	2ca66adceff529a3f1d59b410ca5830b8022a66272180da6670a22cda1257a3a.exe
File created	C:\Windows\System\PDXxBKc.exe	2ca66adceff529a3f1d59b410ca5830b8022a66272180da6670a22cda1257a3a.exe
File created	C:\Windows\System\ZcNYMcu.exe	2ca66adceff529a3f1d59b410ca5830b8022a66272180da6670a22cda1257a3a.exe
File created	C:\Windows\System\QGoHsoy.exe	2ca66adceff529a3f1d59b410ca5830b8022a66272180da6670a22cda1257a3a.exe
File created	C:\Windows\System\EWyTkBi.exe	2ca66adceff529a3f1d59b410ca5830b8022a66272180da6670a22cda1257a3a.exe
File created	C:\Windows\System\ioXIpst.exe	2ca66adceff529a3f1d59b410ca5830b8022a66272180da6670a22cda1257a3a.exe
File created	C:\Windows\System\ZRsIUAq.exe	2ca66adceff529a3f1d59b410ca5830b8022a66272180da6670a22cda1257a3a.exe
File created	C:\Windows\System\bveKkBD.exe	2ca66adceff529a3f1d59b410ca5830b8022a66272180da6670a22cda1257a3a.exe
File created	C:\Windows\System\NFrJRPY.exe	2ca66adceff529a3f1d59b410ca5830b8022a66272180da6670a22cda1257a3a.exe
File created	C:\Windows\System\AHRqlHJ.exe	2ca66adceff529a3f1d59b410ca5830b8022a66272180da6670a22cda1257a3a.exe
File created	C:\Windows\System\zOVXjuj.exe	2ca66adceff529a3f1d59b410ca5830b8022a66272180da6670a22cda1257a3a.exe
File created	C:\Windows\System\HGRTZjc.exe	2ca66adceff529a3f1d59b410ca5830b8022a66272180da6670a22cda1257a3a.exe
File created	C:\Windows\System\LYyTrvj.exe	2ca66adceff529a3f1d59b410ca5830b8022a66272180da6670a22cda1257a3a.exe
File created	C:\Windows\System\WFbaZKN.exe	2ca66adceff529a3f1d59b410ca5830b8022a66272180da6670a22cda1257a3a.exe
File created	C:\Windows\System\ldDJivc.exe	2ca66adceff529a3f1d59b410ca5830b8022a66272180da6670a22cda1257a3a.exe
File created	C:\Windows\System\utXioAY.exe	2ca66adceff529a3f1d59b410ca5830b8022a66272180da6670a22cda1257a3a.exe
File created	C:\Windows\System\pMuCcqG.exe	2ca66adceff529a3f1d59b410ca5830b8022a66272180da6670a22cda1257a3a.exe
File created	C:\Windows\System\yzDBxXQ.exe	2ca66adceff529a3f1d59b410ca5830b8022a66272180da6670a22cda1257a3a.exe
File created	C:\Windows\System\auDUHok.exe	2ca66adceff529a3f1d59b410ca5830b8022a66272180da6670a22cda1257a3a.exe
File created	C:\Windows\System\NlMGgvi.exe	2ca66adceff529a3f1d59b410ca5830b8022a66272180da6670a22cda1257a3a.exe
File created	C:\Windows\System\lFLyPuS.exe	2ca66adceff529a3f1d59b410ca5830b8022a66272180da6670a22cda1257a3a.exe
File created	C:\Windows\System\nwUrMQm.exe	2ca66adceff529a3f1d59b410ca5830b8022a66272180da6670a22cda1257a3a.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	16756	dwm.exe
Token: SeChangeNotifyPrivilege	16756	dwm.exe
Token: 33	16756	dwm.exe
Token: SeIncBasePriorityPrivilege	16756	dwm.exe
Token: SeShutdownPrivilege	16756	dwm.exe
Token: SeCreatePagefilePrivilege	16756	dwm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 536 wrote to memory of 4700	536	2ca66adceff529a3f1d59b410ca5830b8022a66272180da6670a22cda1257a3a.exe	85
PID 536 wrote to memory of 4700	536	2ca66adceff529a3f1d59b410ca5830b8022a66272180da6670a22cda1257a3a.exe	85
PID 536 wrote to memory of 448	536	2ca66adceff529a3f1d59b410ca5830b8022a66272180da6670a22cda1257a3a.exe	86
PID 536 wrote to memory of 448	536	2ca66adceff529a3f1d59b410ca5830b8022a66272180da6670a22cda1257a3a.exe	86
PID 536 wrote to memory of 2264	536	2ca66adceff529a3f1d59b410ca5830b8022a66272180da6670a22cda1257a3a.exe	87
PID 536 wrote to memory of 2264	536	2ca66adceff529a3f1d59b410ca5830b8022a66272180da6670a22cda1257a3a.exe	87
PID 536 wrote to memory of 3968	536	2ca66adceff529a3f1d59b410ca5830b8022a66272180da6670a22cda1257a3a.exe	88
PID 536 wrote to memory of 3968	536	2ca66adceff529a3f1d59b410ca5830b8022a66272180da6670a22cda1257a3a.exe	88
PID 536 wrote to memory of 4364	536	2ca66adceff529a3f1d59b410ca5830b8022a66272180da6670a22cda1257a3a.exe	89
PID 536 wrote to memory of 4364	536	2ca66adceff529a3f1d59b410ca5830b8022a66272180da6670a22cda1257a3a.exe	89
PID 536 wrote to memory of 920	536	2ca66adceff529a3f1d59b410ca5830b8022a66272180da6670a22cda1257a3a.exe	90
PID 536 wrote to memory of 920	536	2ca66adceff529a3f1d59b410ca5830b8022a66272180da6670a22cda1257a3a.exe	90
PID 536 wrote to memory of 3020	536	2ca66adceff529a3f1d59b410ca5830b8022a66272180da6670a22cda1257a3a.exe	91
PID 536 wrote to memory of 3020	536	2ca66adceff529a3f1d59b410ca5830b8022a66272180da6670a22cda1257a3a.exe	91
PID 536 wrote to memory of 3840	536	2ca66adceff529a3f1d59b410ca5830b8022a66272180da6670a22cda1257a3a.exe	92
PID 536 wrote to memory of 3840	536	2ca66adceff529a3f1d59b410ca5830b8022a66272180da6670a22cda1257a3a.exe	92
PID 536 wrote to memory of 2612	536	2ca66adceff529a3f1d59b410ca5830b8022a66272180da6670a22cda1257a3a.exe	93
PID 536 wrote to memory of 2612	536	2ca66adceff529a3f1d59b410ca5830b8022a66272180da6670a22cda1257a3a.exe	93
PID 536 wrote to memory of 848	536	2ca66adceff529a3f1d59b410ca5830b8022a66272180da6670a22cda1257a3a.exe	94
PID 536 wrote to memory of 848	536	2ca66adceff529a3f1d59b410ca5830b8022a66272180da6670a22cda1257a3a.exe	94
PID 536 wrote to memory of 1544	536	2ca66adceff529a3f1d59b410ca5830b8022a66272180da6670a22cda1257a3a.exe	95
PID 536 wrote to memory of 1544	536	2ca66adceff529a3f1d59b410ca5830b8022a66272180da6670a22cda1257a3a.exe	95
PID 536 wrote to memory of 4344	536	2ca66adceff529a3f1d59b410ca5830b8022a66272180da6670a22cda1257a3a.exe	96
PID 536 wrote to memory of 4344	536	2ca66adceff529a3f1d59b410ca5830b8022a66272180da6670a22cda1257a3a.exe	96
PID 536 wrote to memory of 1316	536	2ca66adceff529a3f1d59b410ca5830b8022a66272180da6670a22cda1257a3a.exe	97
PID 536 wrote to memory of 1316	536	2ca66adceff529a3f1d59b410ca5830b8022a66272180da6670a22cda1257a3a.exe	97
PID 536 wrote to memory of 2088	536	2ca66adceff529a3f1d59b410ca5830b8022a66272180da6670a22cda1257a3a.exe	98
PID 536 wrote to memory of 2088	536	2ca66adceff529a3f1d59b410ca5830b8022a66272180da6670a22cda1257a3a.exe	98
PID 536 wrote to memory of 5040	536	2ca66adceff529a3f1d59b410ca5830b8022a66272180da6670a22cda1257a3a.exe	99
PID 536 wrote to memory of 5040	536	2ca66adceff529a3f1d59b410ca5830b8022a66272180da6670a22cda1257a3a.exe	99
PID 536 wrote to memory of 1004	536	2ca66adceff529a3f1d59b410ca5830b8022a66272180da6670a22cda1257a3a.exe	100
PID 536 wrote to memory of 1004	536	2ca66adceff529a3f1d59b410ca5830b8022a66272180da6670a22cda1257a3a.exe	100
PID 536 wrote to memory of 5108	536	2ca66adceff529a3f1d59b410ca5830b8022a66272180da6670a22cda1257a3a.exe	101
PID 536 wrote to memory of 5108	536	2ca66adceff529a3f1d59b410ca5830b8022a66272180da6670a22cda1257a3a.exe	101
PID 536 wrote to memory of 1124	536	2ca66adceff529a3f1d59b410ca5830b8022a66272180da6670a22cda1257a3a.exe	102
PID 536 wrote to memory of 1124	536	2ca66adceff529a3f1d59b410ca5830b8022a66272180da6670a22cda1257a3a.exe	102
PID 536 wrote to memory of 1632	536	2ca66adceff529a3f1d59b410ca5830b8022a66272180da6670a22cda1257a3a.exe	103
PID 536 wrote to memory of 1632	536	2ca66adceff529a3f1d59b410ca5830b8022a66272180da6670a22cda1257a3a.exe	103
PID 536 wrote to memory of 4668	536	2ca66adceff529a3f1d59b410ca5830b8022a66272180da6670a22cda1257a3a.exe	104
PID 536 wrote to memory of 4668	536	2ca66adceff529a3f1d59b410ca5830b8022a66272180da6670a22cda1257a3a.exe	104
PID 536 wrote to memory of 3920	536	2ca66adceff529a3f1d59b410ca5830b8022a66272180da6670a22cda1257a3a.exe	105
PID 536 wrote to memory of 3920	536	2ca66adceff529a3f1d59b410ca5830b8022a66272180da6670a22cda1257a3a.exe	105
PID 536 wrote to memory of 2716	536	2ca66adceff529a3f1d59b410ca5830b8022a66272180da6670a22cda1257a3a.exe	106
PID 536 wrote to memory of 2716	536	2ca66adceff529a3f1d59b410ca5830b8022a66272180da6670a22cda1257a3a.exe	106
PID 536 wrote to memory of 2248	536	2ca66adceff529a3f1d59b410ca5830b8022a66272180da6670a22cda1257a3a.exe	107
PID 536 wrote to memory of 2248	536	2ca66adceff529a3f1d59b410ca5830b8022a66272180da6670a22cda1257a3a.exe	107
PID 536 wrote to memory of 2980	536	2ca66adceff529a3f1d59b410ca5830b8022a66272180da6670a22cda1257a3a.exe	108
PID 536 wrote to memory of 2980	536	2ca66adceff529a3f1d59b410ca5830b8022a66272180da6670a22cda1257a3a.exe	108
PID 536 wrote to memory of 4724	536	2ca66adceff529a3f1d59b410ca5830b8022a66272180da6670a22cda1257a3a.exe	109
PID 536 wrote to memory of 4724	536	2ca66adceff529a3f1d59b410ca5830b8022a66272180da6670a22cda1257a3a.exe	109
PID 536 wrote to memory of 2204	536	2ca66adceff529a3f1d59b410ca5830b8022a66272180da6670a22cda1257a3a.exe	110
PID 536 wrote to memory of 2204	536	2ca66adceff529a3f1d59b410ca5830b8022a66272180da6670a22cda1257a3a.exe	110
PID 536 wrote to memory of 3488	536	2ca66adceff529a3f1d59b410ca5830b8022a66272180da6670a22cda1257a3a.exe	111
PID 536 wrote to memory of 3488	536	2ca66adceff529a3f1d59b410ca5830b8022a66272180da6670a22cda1257a3a.exe	111
PID 536 wrote to memory of 984	536	2ca66adceff529a3f1d59b410ca5830b8022a66272180da6670a22cda1257a3a.exe	112
PID 536 wrote to memory of 984	536	2ca66adceff529a3f1d59b410ca5830b8022a66272180da6670a22cda1257a3a.exe	112
PID 536 wrote to memory of 5004	536	2ca66adceff529a3f1d59b410ca5830b8022a66272180da6670a22cda1257a3a.exe	113
PID 536 wrote to memory of 5004	536	2ca66adceff529a3f1d59b410ca5830b8022a66272180da6670a22cda1257a3a.exe	113
PID 536 wrote to memory of 2996	536	2ca66adceff529a3f1d59b410ca5830b8022a66272180da6670a22cda1257a3a.exe	114
PID 536 wrote to memory of 2996	536	2ca66adceff529a3f1d59b410ca5830b8022a66272180da6670a22cda1257a3a.exe	114
PID 536 wrote to memory of 4452	536	2ca66adceff529a3f1d59b410ca5830b8022a66272180da6670a22cda1257a3a.exe	115
PID 536 wrote to memory of 4452	536	2ca66adceff529a3f1d59b410ca5830b8022a66272180da6670a22cda1257a3a.exe	115
PID 536 wrote to memory of 4832	536	2ca66adceff529a3f1d59b410ca5830b8022a66272180da6670a22cda1257a3a.exe	116
PID 536 wrote to memory of 4832	536	2ca66adceff529a3f1d59b410ca5830b8022a66272180da6670a22cda1257a3a.exe	116

C:\Users\Admin\AppData\Local\Temp\2ca66adceff529a3f1d59b410ca5830b8022a66272180da6670a22cda1257a3a.exe
"C:\Users\Admin\AppData\Local\Temp\2ca66adceff529a3f1d59b410ca5830b8022a66272180da6670a22cda1257a3a.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:536
- C:\Windows\System\zDpppcB.exe
  C:\Windows\System\zDpppcB.exe
  2⤵
  - Executes dropped EXE
  PID:4700
- C:\Windows\System\aBqYIJb.exe
  C:\Windows\System\aBqYIJb.exe
  2⤵
  - Executes dropped EXE
  PID:448
- C:\Windows\System\xDawisz.exe
  C:\Windows\System\xDawisz.exe
  2⤵
  - Executes dropped EXE
  PID:2264
- C:\Windows\System\BSbQpHY.exe
  C:\Windows\System\BSbQpHY.exe
  2⤵
  - Executes dropped EXE
  PID:3968
- C:\Windows\System\cLYLpau.exe
  C:\Windows\System\cLYLpau.exe
  2⤵
  - Executes dropped EXE
  PID:4364
- C:\Windows\System\MQSYsyW.exe
  C:\Windows\System\MQSYsyW.exe
  2⤵
  - Executes dropped EXE
  PID:920
- C:\Windows\System\NqWLQrN.exe
  C:\Windows\System\NqWLQrN.exe
  2⤵
  - Executes dropped EXE
  PID:3020
- C:\Windows\System\OZpBnBG.exe
  C:\Windows\System\OZpBnBG.exe
  2⤵
  - Executes dropped EXE
  PID:3840
- C:\Windows\System\LhkRyMn.exe
  C:\Windows\System\LhkRyMn.exe
  2⤵
  - Executes dropped EXE
  PID:2612
- C:\Windows\System\sJIinun.exe
  C:\Windows\System\sJIinun.exe
  2⤵
  - Executes dropped EXE
  PID:848
- C:\Windows\System\hjxfmOJ.exe
  C:\Windows\System\hjxfmOJ.exe
  2⤵
  - Executes dropped EXE
  PID:1544
- C:\Windows\System\jkWYVJr.exe
  C:\Windows\System\jkWYVJr.exe
  2⤵
  - Executes dropped EXE
  PID:4344
- C:\Windows\System\IPEJHpP.exe
  C:\Windows\System\IPEJHpP.exe
  2⤵
  - Executes dropped EXE
  PID:1316
- C:\Windows\System\ijYakPm.exe
  C:\Windows\System\ijYakPm.exe
  2⤵
  - Executes dropped EXE
  PID:2088
- C:\Windows\System\hvFBhdW.exe
  C:\Windows\System\hvFBhdW.exe
  2⤵
  - Executes dropped EXE
  PID:5040
- C:\Windows\System\hSsxqGM.exe
  C:\Windows\System\hSsxqGM.exe
  2⤵
  - Executes dropped EXE
  PID:1004
- C:\Windows\System\RYvFGND.exe
  C:\Windows\System\RYvFGND.exe
  2⤵
  - Executes dropped EXE
  PID:5108
- C:\Windows\System\IDCWtwK.exe
  C:\Windows\System\IDCWtwK.exe
  2⤵
  - Executes dropped EXE
  PID:1124
- C:\Windows\System\dPmNJvv.exe
  C:\Windows\System\dPmNJvv.exe
  2⤵
  - Executes dropped EXE
  PID:1632
- C:\Windows\System\FyxghBG.exe
  C:\Windows\System\FyxghBG.exe
  2⤵
  - Executes dropped EXE
  PID:4668
- C:\Windows\System\EKUnpwI.exe
  C:\Windows\System\EKUnpwI.exe
  2⤵
  - Executes dropped EXE
  PID:3920
- C:\Windows\System\AXdPIZr.exe
  C:\Windows\System\AXdPIZr.exe
  2⤵
  - Executes dropped EXE
  PID:2716
- C:\Windows\System\DxigmIa.exe
  C:\Windows\System\DxigmIa.exe
  2⤵
  - Executes dropped EXE
  PID:2248
- C:\Windows\System\qODJMWy.exe
  C:\Windows\System\qODJMWy.exe
  2⤵
  - Executes dropped EXE
  PID:2980
- C:\Windows\System\fThdhQI.exe
  C:\Windows\System\fThdhQI.exe
  2⤵
  - Executes dropped EXE
  PID:4724
- C:\Windows\System\LrJIlZB.exe
  C:\Windows\System\LrJIlZB.exe
  2⤵
  - Executes dropped EXE
  PID:2204
- C:\Windows\System\ZkJUGYs.exe
  C:\Windows\System\ZkJUGYs.exe
  2⤵
  - Executes dropped EXE
  PID:3488
- C:\Windows\System\mjMQZnK.exe
  C:\Windows\System\mjMQZnK.exe
  2⤵
  - Executes dropped EXE
  PID:984
- C:\Windows\System\kAkQhYa.exe
  C:\Windows\System\kAkQhYa.exe
  2⤵
  - Executes dropped EXE
  PID:5004
- C:\Windows\System\OOlWHxw.exe
  C:\Windows\System\OOlWHxw.exe
  2⤵
  - Executes dropped EXE
  PID:2996
- C:\Windows\System\XcLuqBy.exe
  C:\Windows\System\XcLuqBy.exe
  2⤵
  - Executes dropped EXE
  PID:4452
- C:\Windows\System\urihFuJ.exe
  C:\Windows\System\urihFuJ.exe
  2⤵
  - Executes dropped EXE
  PID:4832
- C:\Windows\System\rkCcseP.exe
  C:\Windows\System\rkCcseP.exe
  2⤵
  - Executes dropped EXE
  PID:4712
- C:\Windows\System\yawOvXX.exe
  C:\Windows\System\yawOvXX.exe
  2⤵
  - Executes dropped EXE
  PID:1804
- C:\Windows\System\HXAtAYz.exe
  C:\Windows\System\HXAtAYz.exe
  2⤵
  - Executes dropped EXE
  PID:3668
- C:\Windows\System\ZRITcHr.exe
  C:\Windows\System\ZRITcHr.exe
  2⤵
  - Executes dropped EXE
  PID:3332
- C:\Windows\System\QGoHsoy.exe
  C:\Windows\System\QGoHsoy.exe
  2⤵
  - Executes dropped EXE
  PID:432
- C:\Windows\System\OYFDfbW.exe
  C:\Windows\System\OYFDfbW.exe
  2⤵
  - Executes dropped EXE
  PID:4392
- C:\Windows\System\achiUHr.exe
  C:\Windows\System\achiUHr.exe
  2⤵
  - Executes dropped EXE
  PID:4040
- C:\Windows\System\QrQxMeJ.exe
  C:\Windows\System\QrQxMeJ.exe
  2⤵
  - Executes dropped EXE
  PID:3508
- C:\Windows\System\vysrDge.exe
  C:\Windows\System\vysrDge.exe
  2⤵
  - Executes dropped EXE
  PID:1176
- C:\Windows\System\VUEQDWN.exe
  C:\Windows\System\VUEQDWN.exe
  2⤵
  - Executes dropped EXE
  PID:380
- C:\Windows\System\KQzvSoJ.exe
  C:\Windows\System\KQzvSoJ.exe
  2⤵
  - Executes dropped EXE
  PID:1060
- C:\Windows\System\rMNWLdD.exe
  C:\Windows\System\rMNWLdD.exe
  2⤵
  - Executes dropped EXE
  PID:2216
- C:\Windows\System\RXrNGdX.exe
  C:\Windows\System\RXrNGdX.exe
  2⤵
  - Executes dropped EXE
  PID:4680
- C:\Windows\System\oYqBovs.exe
  C:\Windows\System\oYqBovs.exe
  2⤵
  - Executes dropped EXE
  PID:2824
- C:\Windows\System\NSxaOSY.exe
  C:\Windows\System\NSxaOSY.exe
  2⤵
  - Executes dropped EXE
  PID:3656
- C:\Windows\System\DBJhXBR.exe
  C:\Windows\System\DBJhXBR.exe
  2⤵
  - Executes dropped EXE
  PID:4536
- C:\Windows\System\GbLsSuK.exe
  C:\Windows\System\GbLsSuK.exe
  2⤵
  - Executes dropped EXE
  PID:2396
- C:\Windows\System\ILRlDnI.exe
  C:\Windows\System\ILRlDnI.exe
  2⤵
  - Executes dropped EXE
  PID:3676
- C:\Windows\System\lFLyPuS.exe
  C:\Windows\System\lFLyPuS.exe
  2⤵
  - Executes dropped EXE
  PID:4980
- C:\Windows\System\LTIcRlY.exe
  C:\Windows\System\LTIcRlY.exe
  2⤵
  - Executes dropped EXE
  PID:4620
- C:\Windows\System\veJBXSm.exe
  C:\Windows\System\veJBXSm.exe
  2⤵
  - Executes dropped EXE
  PID:4568
- C:\Windows\System\nwtFvRN.exe
  C:\Windows\System\nwtFvRN.exe
  2⤵
  - Executes dropped EXE
  PID:2844
- C:\Windows\System\ezFmHjm.exe
  C:\Windows\System\ezFmHjm.exe
  2⤵
  - Executes dropped EXE
  PID:2840
- C:\Windows\System\EvEMNgE.exe
  C:\Windows\System\EvEMNgE.exe
  2⤵
  - Executes dropped EXE
  PID:4420
- C:\Windows\System\jmbnVgT.exe
  C:\Windows\System\jmbnVgT.exe
  2⤵
  - Executes dropped EXE
  PID:4428
- C:\Windows\System\PasXvgE.exe
  C:\Windows\System\PasXvgE.exe
  2⤵
  - Executes dropped EXE
  PID:2712
- C:\Windows\System\ZEnosMa.exe
  C:\Windows\System\ZEnosMa.exe
  2⤵
  - Executes dropped EXE
  PID:1932
- C:\Windows\System\SpuqVvd.exe
  C:\Windows\System\SpuqVvd.exe
  2⤵
  - Executes dropped EXE
  PID:5072
- C:\Windows\System\RAYpEyw.exe
  C:\Windows\System\RAYpEyw.exe
  2⤵
  - Executes dropped EXE
  PID:1516
- C:\Windows\System\xzUgYsn.exe
  C:\Windows\System\xzUgYsn.exe
  2⤵
  - Executes dropped EXE
  PID:2864
- C:\Windows\System\MoaaeZh.exe
  C:\Windows\System\MoaaeZh.exe
  2⤵
  - Executes dropped EXE
  PID:736
- C:\Windows\System\XzHDcAE.exe
  C:\Windows\System\XzHDcAE.exe
  2⤵
  - Executes dropped EXE
  PID:1080
- C:\Windows\System\CSIMMzM.exe
  C:\Windows\System\CSIMMzM.exe
  2⤵
  PID:3148
- C:\Windows\System\eXqquto.exe
  C:\Windows\System\eXqquto.exe
  2⤵
  PID:3524
- C:\Windows\System\YwiaJNg.exe
  C:\Windows\System\YwiaJNg.exe
  2⤵
  PID:3892
- C:\Windows\System\TXjHYXt.exe
  C:\Windows\System\TXjHYXt.exe
  2⤵
  PID:2856
- C:\Windows\System\ENzMNOz.exe
  C:\Windows\System\ENzMNOz.exe
  2⤵
  PID:1500
- C:\Windows\System\LMmmDkr.exe
  C:\Windows\System\LMmmDkr.exe
  2⤵
  PID:2416
- C:\Windows\System\NFrJRPY.exe
  C:\Windows\System\NFrJRPY.exe
  2⤵
  PID:4572
- C:\Windows\System\pzCQrNF.exe
  C:\Windows\System\pzCQrNF.exe
  2⤵
  PID:3596
- C:\Windows\System\kgKjzsV.exe
  C:\Windows\System\kgKjzsV.exe
  2⤵
  PID:3580
- C:\Windows\System\dQMMFpu.exe
  C:\Windows\System\dQMMFpu.exe
  2⤵
  PID:2320
- C:\Windows\System\srYbJda.exe
  C:\Windows\System\srYbJda.exe
  2⤵
  PID:3708
- C:\Windows\System\ZqYENLk.exe
  C:\Windows\System\ZqYENLk.exe
  2⤵
  PID:4564
- C:\Windows\System\QPKzOlY.exe
  C:\Windows\System\QPKzOlY.exe
  2⤵
  PID:3680
- C:\Windows\System\qJNeLlj.exe
  C:\Windows\System\qJNeLlj.exe
  2⤵
  PID:3672
- C:\Windows\System\ReMaBVQ.exe
  C:\Windows\System\ReMaBVQ.exe
  2⤵
  PID:1492
- C:\Windows\System\nlanoGe.exe
  C:\Windows\System\nlanoGe.exe
  2⤵
  PID:4812
- C:\Windows\System\MAjmsde.exe
  C:\Windows\System\MAjmsde.exe
  2⤵
  PID:3800
- C:\Windows\System\zmWfcJj.exe
  C:\Windows\System\zmWfcJj.exe
  2⤵
  PID:1788
- C:\Windows\System\YoFfKrN.exe
  C:\Windows\System\YoFfKrN.exe
  2⤵
  PID:2308
- C:\Windows\System\VGRjlQG.exe
  C:\Windows\System\VGRjlQG.exe
  2⤵
  PID:4896
- C:\Windows\System\hkSFqRn.exe
  C:\Windows\System\hkSFqRn.exe
  2⤵
  PID:1648
- C:\Windows\System\jPjumwV.exe
  C:\Windows\System\jPjumwV.exe
  2⤵
  PID:5128
- C:\Windows\System\oVKluTj.exe
  C:\Windows\System\oVKluTj.exe
  2⤵
  PID:5156
- C:\Windows\System\UdgqlsU.exe
  C:\Windows\System\UdgqlsU.exe
  2⤵
  PID:5184
- C:\Windows\System\RnlSdbw.exe
  C:\Windows\System\RnlSdbw.exe
  2⤵
  PID:5212
- C:\Windows\System\fwiqsDD.exe
  C:\Windows\System\fwiqsDD.exe
  2⤵
  PID:5240
- C:\Windows\System\seezHxW.exe
  C:\Windows\System\seezHxW.exe
  2⤵
  PID:5268
- C:\Windows\System\lzBXwQt.exe
  C:\Windows\System\lzBXwQt.exe
  2⤵
  PID:5296
- C:\Windows\System\ituECGi.exe
  C:\Windows\System\ituECGi.exe
  2⤵
  PID:5324
- C:\Windows\System\GCmBiaR.exe
  C:\Windows\System\GCmBiaR.exe
  2⤵
  PID:5352
- C:\Windows\System\PcnEcxs.exe
  C:\Windows\System\PcnEcxs.exe
  2⤵
  PID:5380
- C:\Windows\System\BCglLWU.exe
  C:\Windows\System\BCglLWU.exe
  2⤵
  PID:5408
- C:\Windows\System\MzjlGNl.exe
  C:\Windows\System\MzjlGNl.exe
  2⤵
  PID:5472
- C:\Windows\System\MjrzljI.exe
  C:\Windows\System\MjrzljI.exe
  2⤵
  PID:5488
- C:\Windows\System\ldDJivc.exe
  C:\Windows\System\ldDJivc.exe
  2⤵
  PID:5504
- C:\Windows\System\opajWCP.exe
  C:\Windows\System\opajWCP.exe
  2⤵
  PID:5528
- C:\Windows\System\VCNBmvp.exe
  C:\Windows\System\VCNBmvp.exe
  2⤵
  PID:5556
- C:\Windows\System\XrsONyH.exe
  C:\Windows\System\XrsONyH.exe
  2⤵
  PID:5576
- C:\Windows\System\mkmlZWg.exe
  C:\Windows\System\mkmlZWg.exe
  2⤵
  PID:5604
- C:\Windows\System\CpsaYTM.exe
  C:\Windows\System\CpsaYTM.exe
  2⤵
  PID:5628
- C:\Windows\System\QutuMql.exe
  C:\Windows\System\QutuMql.exe
  2⤵
  PID:5656
- C:\Windows\System\jdBqjdt.exe
  C:\Windows\System\jdBqjdt.exe
  2⤵
  PID:5684
- C:\Windows\System\qeUjiBV.exe
  C:\Windows\System\qeUjiBV.exe
  2⤵
  PID:5716
- C:\Windows\System\NbbOXlZ.exe
  C:\Windows\System\NbbOXlZ.exe
  2⤵
  PID:5740
- C:\Windows\System\rXcmtKP.exe
  C:\Windows\System\rXcmtKP.exe
  2⤵
  PID:5768
- C:\Windows\System\oznppgh.exe
  C:\Windows\System\oznppgh.exe
  2⤵
  PID:5804
- C:\Windows\System\SgFooyR.exe
  C:\Windows\System\SgFooyR.exe
  2⤵
  PID:5828
- C:\Windows\System\ymZvusR.exe
  C:\Windows\System\ymZvusR.exe
  2⤵
  PID:5852
- C:\Windows\System\jeCDaiM.exe
  C:\Windows\System\jeCDaiM.exe
  2⤵
  PID:5884
- C:\Windows\System\FqlQquJ.exe
  C:\Windows\System\FqlQquJ.exe
  2⤵
  PID:5912
- C:\Windows\System\GJBTsMw.exe
  C:\Windows\System\GJBTsMw.exe
  2⤵
  PID:5940
- C:\Windows\System\PHZRTcH.exe
  C:\Windows\System\PHZRTcH.exe
  2⤵
  PID:5968
- C:\Windows\System\laAItyf.exe
  C:\Windows\System\laAItyf.exe
  2⤵
  PID:5996
- C:\Windows\System\nwNGwZa.exe
  C:\Windows\System\nwNGwZa.exe
  2⤵
  PID:6024
- C:\Windows\System\yUZHgQk.exe
  C:\Windows\System\yUZHgQk.exe
  2⤵
  PID:6056
- C:\Windows\System\NTQsBgq.exe
  C:\Windows\System\NTQsBgq.exe
  2⤵
  PID:6080
- C:\Windows\System\lLvFpdA.exe
  C:\Windows\System\lLvFpdA.exe
  2⤵
  PID:6108
- C:\Windows\System\wJKxBBo.exe
  C:\Windows\System\wJKxBBo.exe
  2⤵
  PID:6132
- C:\Windows\System\otuwGcB.exe
  C:\Windows\System\otuwGcB.exe
  2⤵
  PID:4368
- C:\Windows\System\hevddVl.exe
  C:\Windows\System\hevddVl.exe
  2⤵
  PID:1712
- C:\Windows\System\OBVYgBn.exe
  C:\Windows\System\OBVYgBn.exe
  2⤵
  PID:2304
- C:\Windows\System\ZoQPDbO.exe
  C:\Windows\System\ZoQPDbO.exe
  2⤵
  PID:956
- C:\Windows\System\ZzoajSX.exe
  C:\Windows\System\ZzoajSX.exe
  2⤵
  PID:636
- C:\Windows\System\PxzDIjN.exe
  C:\Windows\System\PxzDIjN.exe
  2⤵
  PID:2276
- C:\Windows\System\tgqLZPd.exe
  C:\Windows\System\tgqLZPd.exe
  2⤵
  PID:4176
- C:\Windows\System\wMQlnLm.exe
  C:\Windows\System\wMQlnLm.exe
  2⤵
  PID:5144
- C:\Windows\System\MqYqLhx.exe
  C:\Windows\System\MqYqLhx.exe
  2⤵
  PID:5200
- C:\Windows\System\rvGBFPp.exe
  C:\Windows\System\rvGBFPp.exe
  2⤵
  PID:5260
- C:\Windows\System\ejMPZtQ.exe
  C:\Windows\System\ejMPZtQ.exe
  2⤵
  PID:5340
- C:\Windows\System\qSieEfa.exe
  C:\Windows\System\qSieEfa.exe
  2⤵
  PID:5400
- C:\Windows\System\UiBYjki.exe
  C:\Windows\System\UiBYjki.exe
  2⤵
  PID:5484
- C:\Windows\System\uiBIzgr.exe
  C:\Windows\System\uiBIzgr.exe
  2⤵
  PID:5548
- C:\Windows\System\YZHqIWu.exe
  C:\Windows\System\YZHqIWu.exe
  2⤵
  PID:5596
- C:\Windows\System\DjSPqWo.exe
  C:\Windows\System\DjSPqWo.exe
  2⤵
  PID:5672
- C:\Windows\System\lYGfCaY.exe
  C:\Windows\System\lYGfCaY.exe
  2⤵
  PID:5736
- C:\Windows\System\DHCUqqc.exe
  C:\Windows\System\DHCUqqc.exe
  2⤵
  PID:664
- C:\Windows\System\AHRqlHJ.exe
  C:\Windows\System\AHRqlHJ.exe
  2⤵
  PID:5848
- C:\Windows\System\xZPSIUp.exe
  C:\Windows\System\xZPSIUp.exe
  2⤵
  PID:5932
- C:\Windows\System\EcmSixP.exe
  C:\Windows\System\EcmSixP.exe
  2⤵
  PID:6012
- C:\Windows\System\bdfqxMn.exe
  C:\Windows\System\bdfqxMn.exe
  2⤵
  PID:6076
- C:\Windows\System\XiUroyL.exe
  C:\Windows\System\XiUroyL.exe
  2⤵
  PID:6124
- C:\Windows\System\yRVYSBf.exe
  C:\Windows\System\yRVYSBf.exe
  2⤵
  PID:888
- C:\Windows\System\UFWzzjr.exe
  C:\Windows\System\UFWzzjr.exe
  2⤵
  PID:816
- C:\Windows\System\zZlhZTR.exe
  C:\Windows\System\zZlhZTR.exe
  2⤵
  PID:212
- C:\Windows\System\oOzGdwy.exe
  C:\Windows\System\oOzGdwy.exe
  2⤵
  PID:5196
- C:\Windows\System\lmWotMl.exe
  C:\Windows\System\lmWotMl.exe
  2⤵
  PID:5316
- C:\Windows\System\QcyWfWC.exe
  C:\Windows\System\QcyWfWC.exe
  2⤵
  PID:5516
- C:\Windows\System\DBoQZYa.exe
  C:\Windows\System\DBoQZYa.exe
  2⤵
  PID:6164
- C:\Windows\System\jaOjuST.exe
  C:\Windows\System\jaOjuST.exe
  2⤵
  PID:6192
- C:\Windows\System\tBikwTa.exe
  C:\Windows\System\tBikwTa.exe
  2⤵
  PID:6216
- C:\Windows\System\rFavKoY.exe
  C:\Windows\System\rFavKoY.exe
  2⤵
  PID:6248
- C:\Windows\System\sNGdwUV.exe
  C:\Windows\System\sNGdwUV.exe
  2⤵
  PID:6276
- C:\Windows\System\NnCyxOt.exe
  C:\Windows\System\NnCyxOt.exe
  2⤵
  PID:6300
- C:\Windows\System\CYHMSHF.exe
  C:\Windows\System\CYHMSHF.exe
  2⤵
  PID:6332
- C:\Windows\System\RzDOPPF.exe
  C:\Windows\System\RzDOPPF.exe
  2⤵
  PID:6364
- C:\Windows\System\yuIRQJs.exe
  C:\Windows\System\yuIRQJs.exe
  2⤵
  PID:6388
- C:\Windows\System\JUfBmxA.exe
  C:\Windows\System\JUfBmxA.exe
  2⤵
  PID:6416
- C:\Windows\System\sWcxWDl.exe
  C:\Windows\System\sWcxWDl.exe
  2⤵
  PID:6440
- C:\Windows\System\IYlosId.exe
  C:\Windows\System\IYlosId.exe
  2⤵
  PID:6468
- C:\Windows\System\iZAPZnK.exe
  C:\Windows\System\iZAPZnK.exe
  2⤵
  PID:6500
- C:\Windows\System\rPvpAFo.exe
  C:\Windows\System\rPvpAFo.exe
  2⤵
  PID:6528
- C:\Windows\System\HBCoRNN.exe
  C:\Windows\System\HBCoRNN.exe
  2⤵
  PID:6552
- C:\Windows\System\oqYXURi.exe
  C:\Windows\System\oqYXURi.exe
  2⤵
  PID:6580
- C:\Windows\System\WYrpboz.exe
  C:\Windows\System\WYrpboz.exe
  2⤵
  PID:6612
- C:\Windows\System\YUTIPWb.exe
  C:\Windows\System\YUTIPWb.exe
  2⤵
  PID:6644
- C:\Windows\System\eSYjilS.exe
  C:\Windows\System\eSYjilS.exe
  2⤵
  PID:6672
- C:\Windows\System\clrZeSw.exe
  C:\Windows\System\clrZeSw.exe
  2⤵
  PID:6696
- C:\Windows\System\nxVyZqF.exe
  C:\Windows\System\nxVyZqF.exe
  2⤵
  PID:6724
- C:\Windows\System\jTrcQmQ.exe
  C:\Windows\System\jTrcQmQ.exe
  2⤵
  PID:6752
- C:\Windows\System\CteZGNl.exe
  C:\Windows\System\CteZGNl.exe
  2⤵
  PID:6780
- C:\Windows\System\KCRufTI.exe
  C:\Windows\System\KCRufTI.exe
  2⤵
  PID:6812
- C:\Windows\System\icqAphg.exe
  C:\Windows\System\icqAphg.exe
  2⤵
  PID:6836
- C:\Windows\System\HgZBcoY.exe
  C:\Windows\System\HgZBcoY.exe
  2⤵
  PID:6864
- C:\Windows\System\fNiNvPZ.exe
  C:\Windows\System\fNiNvPZ.exe
  2⤵
  PID:6900
- C:\Windows\System\VPRWpZa.exe
  C:\Windows\System\VPRWpZa.exe
  2⤵
  PID:6924
- C:\Windows\System\TkPhDYY.exe
  C:\Windows\System\TkPhDYY.exe
  2⤵
  PID:6952
- C:\Windows\System\NTqVSMo.exe
  C:\Windows\System\NTqVSMo.exe
  2⤵
  PID:6976
- C:\Windows\System\vGFWqhh.exe
  C:\Windows\System\vGFWqhh.exe
  2⤵
  PID:7008
- C:\Windows\System\yAioBVk.exe
  C:\Windows\System\yAioBVk.exe
  2⤵
  PID:7036
- C:\Windows\System\PDXxBKc.exe
  C:\Windows\System\PDXxBKc.exe
  2⤵
  PID:7052
- C:\Windows\System\GzMODjc.exe
  C:\Windows\System\GzMODjc.exe
  2⤵
  PID:7080
- C:\Windows\System\ioXIpst.exe
  C:\Windows\System\ioXIpst.exe
  2⤵
  PID:7112
- C:\Windows\System\teiBjHh.exe
  C:\Windows\System\teiBjHh.exe
  2⤵
  PID:7144
- C:\Windows\System\jBQrmpm.exe
  C:\Windows\System\jBQrmpm.exe
  2⤵
  PID:5592
- C:\Windows\System\ASRkLmb.exe
  C:\Windows\System\ASRkLmb.exe
  2⤵
  PID:5764
- C:\Windows\System\FnytsvD.exe
  C:\Windows\System\FnytsvD.exe
  2⤵
  PID:5928
- C:\Windows\System\ZabeAQO.exe
  C:\Windows\System\ZabeAQO.exe
  2⤵
  PID:6044
- C:\Windows\System\sbkgShX.exe
  C:\Windows\System\sbkgShX.exe
  2⤵
  PID:1852
- C:\Windows\System\XEFRXgM.exe
  C:\Windows\System\XEFRXgM.exe
  2⤵
  PID:2500
- C:\Windows\System\CvMeEbL.exe
  C:\Windows\System\CvMeEbL.exe
  2⤵
  PID:5420
- C:\Windows\System\BFxXtTK.exe
  C:\Windows\System\BFxXtTK.exe
  2⤵
  PID:6180
- C:\Windows\System\rmCrqPX.exe
  C:\Windows\System\rmCrqPX.exe
  2⤵
  PID:6240
- C:\Windows\System\kaErIWJ.exe
  C:\Windows\System\kaErIWJ.exe
  2⤵
  PID:6296
- C:\Windows\System\zLjHyWb.exe
  C:\Windows\System\zLjHyWb.exe
  2⤵
  PID:6372
- C:\Windows\System\ClWRqhW.exe
  C:\Windows\System\ClWRqhW.exe
  2⤵
  PID:6432
- C:\Windows\System\kpaFFay.exe
  C:\Windows\System\kpaFFay.exe
  2⤵
  PID:6492
- C:\Windows\System\YYVUHwV.exe
  C:\Windows\System\YYVUHwV.exe
  2⤵
  PID:6568
- C:\Windows\System\urvkqGv.exe
  C:\Windows\System\urvkqGv.exe
  2⤵
  PID:6632
- C:\Windows\System\CWWSzha.exe
  C:\Windows\System\CWWSzha.exe
  2⤵
  PID:6692
- C:\Windows\System\wWwTkJx.exe
  C:\Windows\System\wWwTkJx.exe
  2⤵
  PID:6768
- C:\Windows\System\WALfCVZ.exe
  C:\Windows\System\WALfCVZ.exe
  2⤵
  PID:6828
- C:\Windows\System\vZqtOAF.exe
  C:\Windows\System\vZqtOAF.exe
  2⤵
  PID:6860
- C:\Windows\System\yVslMyp.exe
  C:\Windows\System\yVslMyp.exe
  2⤵
  PID:6936
- C:\Windows\System\bhCLhox.exe
  C:\Windows\System\bhCLhox.exe
  2⤵
  PID:6996
- C:\Windows\System\VAZPYAf.exe
  C:\Windows\System\VAZPYAf.exe
  2⤵
  PID:7048
- C:\Windows\System\vgJMXXY.exe
  C:\Windows\System\vgJMXXY.exe
  2⤵
  PID:7104
- C:\Windows\System\KTBUotx.exe
  C:\Windows\System\KTBUotx.exe
  2⤵
  PID:5704
- C:\Windows\System\YilDvvN.exe
  C:\Windows\System\YilDvvN.exe
  2⤵
  PID:5988
- C:\Windows\System\MhmUMWd.exe
  C:\Windows\System\MhmUMWd.exe
  2⤵
  PID:4424
- C:\Windows\System\KMgTFhD.exe
  C:\Windows\System\KMgTFhD.exe
  2⤵
  PID:548
- C:\Windows\System\fhvHOlb.exe
  C:\Windows\System\fhvHOlb.exe
  2⤵
  PID:2752
- C:\Windows\System\AhWklnY.exe
  C:\Windows\System\AhWklnY.exe
  2⤵
  PID:6404
- C:\Windows\System\DTikISf.exe
  C:\Windows\System\DTikISf.exe
  2⤵
  PID:6544
- C:\Windows\System\TvPRKeN.exe
  C:\Windows\System\TvPRKeN.exe
  2⤵
  PID:6628
- C:\Windows\System\oJrVJru.exe
  C:\Windows\System\oJrVJru.exe
  2⤵
  PID:6748
- C:\Windows\System\uabbiKE.exe
  C:\Windows\System\uabbiKE.exe
  2⤵
  PID:6856
- C:\Windows\System\pJlNjBx.exe
  C:\Windows\System\pJlNjBx.exe
  2⤵
  PID:6968
- C:\Windows\System\BZYKnJL.exe
  C:\Windows\System\BZYKnJL.exe
  2⤵
  PID:4168
- C:\Windows\System\fcLnbVz.exe
  C:\Windows\System\fcLnbVz.exe
  2⤵
  PID:2848
- C:\Windows\System\nqigMij.exe
  C:\Windows\System\nqigMij.exe
  2⤵
  PID:5896
- C:\Windows\System\kcwVuyy.exe
  C:\Windows\System\kcwVuyy.exe
  2⤵
  PID:6212
- C:\Windows\System\pIzlJZL.exe
  C:\Windows\System\pIzlJZL.exe
  2⤵
  PID:5064
- C:\Windows\System\QCcnpsa.exe
  C:\Windows\System\QCcnpsa.exe
  2⤵
  PID:3460
- C:\Windows\System\XOOrlQz.exe
  C:\Windows\System\XOOrlQz.exe
  2⤵
  PID:6920
- C:\Windows\System\uRfOkif.exe
  C:\Windows\System\uRfOkif.exe
  2⤵
  PID:7044
- C:\Windows\System\WtQLtcl.exe
  C:\Windows\System\WtQLtcl.exe
  2⤵
  PID:5440
- C:\Windows\System\KbpMnpD.exe
  C:\Windows\System\KbpMnpD.exe
  2⤵
  PID:2336
- C:\Windows\System\yYfVhKC.exe
  C:\Windows\System\yYfVhKC.exe
  2⤵
  PID:6464
- C:\Windows\System\IlBRmaH.exe
  C:\Windows\System\IlBRmaH.exe
  2⤵
  PID:4192
- C:\Windows\System\RMBswhX.exe
  C:\Windows\System\RMBswhX.exe
  2⤵
  PID:4524
- C:\Windows\System\KRUEIwU.exe
  C:\Windows\System\KRUEIwU.exe
  2⤵
  PID:6348
- C:\Windows\System\TyvkHAH.exe
  C:\Windows\System\TyvkHAH.exe
  2⤵
  PID:552
- C:\Windows\System\DNYERMV.exe
  C:\Windows\System\DNYERMV.exe
  2⤵
  PID:232
- C:\Windows\System\MRsMFPW.exe
  C:\Windows\System\MRsMFPW.exe
  2⤵
  PID:7184
- C:\Windows\System\GiaHEsk.exe
  C:\Windows\System\GiaHEsk.exe
  2⤵
  PID:7204
- C:\Windows\System\vHGijxA.exe
  C:\Windows\System\vHGijxA.exe
  2⤵
  PID:7240
- C:\Windows\System\XFQXLKf.exe
  C:\Windows\System\XFQXLKf.exe
  2⤵
  PID:7272
- C:\Windows\System\KRuLEui.exe
  C:\Windows\System\KRuLEui.exe
  2⤵
  PID:7308
- C:\Windows\System\utXioAY.exe
  C:\Windows\System\utXioAY.exe
  2⤵
  PID:7332
- C:\Windows\System\iNFoHQb.exe
  C:\Windows\System\iNFoHQb.exe
  2⤵
  PID:7352
- C:\Windows\System\lFuUPVZ.exe
  C:\Windows\System\lFuUPVZ.exe
  2⤵
  PID:7376
- C:\Windows\System\aHemFWG.exe
  C:\Windows\System\aHemFWG.exe
  2⤵
  PID:7416
- C:\Windows\System\MzSwQjr.exe
  C:\Windows\System\MzSwQjr.exe
  2⤵
  PID:7472
- C:\Windows\System\ecsoQuO.exe
  C:\Windows\System\ecsoQuO.exe
  2⤵
  PID:7492
- C:\Windows\System\KGMqyFV.exe
  C:\Windows\System\KGMqyFV.exe
  2⤵
  PID:7516
- C:\Windows\System\JVGKpPe.exe
  C:\Windows\System\JVGKpPe.exe
  2⤵
  PID:7540
- C:\Windows\System\mEFoQkF.exe
  C:\Windows\System\mEFoQkF.exe
  2⤵
  PID:7568
- C:\Windows\System\onhJkVa.exe
  C:\Windows\System\onhJkVa.exe
  2⤵
  PID:7596
- C:\Windows\System\SNyKhPr.exe
  C:\Windows\System\SNyKhPr.exe
  2⤵
  PID:7616
- C:\Windows\System\XVTPmnm.exe
  C:\Windows\System\XVTPmnm.exe
  2⤵
  PID:7632
- C:\Windows\System\oGtZDGX.exe
  C:\Windows\System\oGtZDGX.exe
  2⤵
  PID:7648
- C:\Windows\System\jNrQkid.exe
  C:\Windows\System\jNrQkid.exe
  2⤵
  PID:7696
- C:\Windows\System\MQcridk.exe
  C:\Windows\System\MQcridk.exe
  2⤵
  PID:7744
- C:\Windows\System\WeSZHbt.exe
  C:\Windows\System\WeSZHbt.exe
  2⤵
  PID:7780
- C:\Windows\System\XkzNBso.exe
  C:\Windows\System\XkzNBso.exe
  2⤵
  PID:7796
- C:\Windows\System\mDKopAG.exe
  C:\Windows\System\mDKopAG.exe
  2⤵
  PID:7824
- C:\Windows\System\kOZtLNK.exe
  C:\Windows\System\kOZtLNK.exe
  2⤵
  PID:7844
- C:\Windows\System\cHzzOKj.exe
  C:\Windows\System\cHzzOKj.exe
  2⤵
  PID:7880
- C:\Windows\System\MQwPqME.exe
  C:\Windows\System\MQwPqME.exe
  2⤵
  PID:7920
- C:\Windows\System\jVqgfGV.exe
  C:\Windows\System\jVqgfGV.exe
  2⤵
  PID:7948
- C:\Windows\System\PfCpbGe.exe
  C:\Windows\System\PfCpbGe.exe
  2⤵
  PID:7976
- C:\Windows\System\zrtvGVm.exe
  C:\Windows\System\zrtvGVm.exe
  2⤵
  PID:7992
- C:\Windows\System\VkkebvM.exe
  C:\Windows\System\VkkebvM.exe
  2⤵
  PID:8032
- C:\Windows\System\sIiyrdw.exe
  C:\Windows\System\sIiyrdw.exe
  2⤵
  PID:8056
- C:\Windows\System\RObqrBa.exe
  C:\Windows\System\RObqrBa.exe
  2⤵
  PID:8076
- C:\Windows\System\ZewEhQY.exe
  C:\Windows\System\ZewEhQY.exe
  2⤵
  PID:8116
- C:\Windows\System\TISYnYN.exe
  C:\Windows\System\TISYnYN.exe
  2⤵
  PID:8144
- C:\Windows\System\lODuZAG.exe
  C:\Windows\System\lODuZAG.exe
  2⤵
  PID:8160
- C:\Windows\System\FLKmdOM.exe
  C:\Windows\System\FLKmdOM.exe
  2⤵
  PID:740
- C:\Windows\System\cdYhDQc.exe
  C:\Windows\System\cdYhDQc.exe
  2⤵
  PID:2468
- C:\Windows\System\FlCvLuL.exe
  C:\Windows\System\FlCvLuL.exe
  2⤵
  PID:7232
- C:\Windows\System\BSBBmnb.exe
  C:\Windows\System\BSBBmnb.exe
  2⤵
  PID:7316
- C:\Windows\System\dtvHmuk.exe
  C:\Windows\System\dtvHmuk.exe
  2⤵
  PID:7368
- C:\Windows\System\rUvBPyn.exe
  C:\Windows\System\rUvBPyn.exe
  2⤵
  PID:7364
- C:\Windows\System\RpYbJGr.exe
  C:\Windows\System\RpYbJGr.exe
  2⤵
  PID:7512
- C:\Windows\System\FbuGLlm.exe
  C:\Windows\System\FbuGLlm.exe
  2⤵
  PID:7556
- C:\Windows\System\bnLwvvK.exe
  C:\Windows\System\bnLwvvK.exe
  2⤵
  PID:7576
- C:\Windows\System\burvrrA.exe
  C:\Windows\System\burvrrA.exe
  2⤵
  PID:7704
- C:\Windows\System\SBjhvfE.exe
  C:\Windows\System\SBjhvfE.exe
  2⤵
  PID:7720
- C:\Windows\System\WtBBgQR.exe
  C:\Windows\System\WtBBgQR.exe
  2⤵
  PID:7792
- C:\Windows\System\TvlKRjZ.exe
  C:\Windows\System\TvlKRjZ.exe
  2⤵
  PID:7840
- C:\Windows\System\noRoJIL.exe
  C:\Windows\System\noRoJIL.exe
  2⤵
  PID:7944
- C:\Windows\System\cskIkAb.exe
  C:\Windows\System\cskIkAb.exe
  2⤵
  PID:8008
- C:\Windows\System\WPzUbaf.exe
  C:\Windows\System\WPzUbaf.exe
  2⤵
  PID:8072
- C:\Windows\System\LDRJUwW.exe
  C:\Windows\System\LDRJUwW.exe
  2⤵
  PID:8132
- C:\Windows\System\PEdOAlR.exe
  C:\Windows\System\PEdOAlR.exe
  2⤵
  PID:8180
- C:\Windows\System\xeaNFWz.exe
  C:\Windows\System\xeaNFWz.exe
  2⤵
  PID:4152
- C:\Windows\System\PnczXNi.exe
  C:\Windows\System\PnczXNi.exe
  2⤵
  PID:7488
- C:\Windows\System\yfSdIpS.exe
  C:\Windows\System\yfSdIpS.exe
  2⤵
  PID:7608
- C:\Windows\System\IQTgfNA.exe
  C:\Windows\System\IQTgfNA.exe
  2⤵
  PID:7808
- C:\Windows\System\XLXhwRu.exe
  C:\Windows\System\XLXhwRu.exe
  2⤵
  PID:7968
- C:\Windows\System\ksuDzUR.exe
  C:\Windows\System\ksuDzUR.exe
  2⤵
  PID:8092
- C:\Windows\System\GByvrnZ.exe
  C:\Windows\System\GByvrnZ.exe
  2⤵
  PID:7288
- C:\Windows\System\Wbhglzo.exe
  C:\Windows\System\Wbhglzo.exe
  2⤵
  PID:7624
- C:\Windows\System\daXZmeU.exe
  C:\Windows\System\daXZmeU.exe
  2⤵
  PID:7852
- C:\Windows\System\CZNPPCw.exe
  C:\Windows\System\CZNPPCw.exe
  2⤵
  PID:7716
- C:\Windows\System\ZyLZhBq.exe
  C:\Windows\System\ZyLZhBq.exe
  2⤵
  PID:8200
- C:\Windows\System\pMuCcqG.exe
  C:\Windows\System\pMuCcqG.exe
  2⤵
  PID:8228
- C:\Windows\System\lpqEBiP.exe
  C:\Windows\System\lpqEBiP.exe
  2⤵
  PID:8256
- C:\Windows\System\VmQFkAU.exe
  C:\Windows\System\VmQFkAU.exe
  2⤵
  PID:8272
- C:\Windows\System\pwDlHUr.exe
  C:\Windows\System\pwDlHUr.exe
  2⤵
  PID:8288
- C:\Windows\System\GqMTEhD.exe
  C:\Windows\System\GqMTEhD.exe
  2⤵
  PID:8316
- C:\Windows\System\TUrcXKz.exe
  C:\Windows\System\TUrcXKz.exe
  2⤵
  PID:8368
- C:\Windows\System\EcvgVEJ.exe
  C:\Windows\System\EcvgVEJ.exe
  2⤵
  PID:8388
- C:\Windows\System\GbUQydW.exe
  C:\Windows\System\GbUQydW.exe
  2⤵
  PID:8412
- C:\Windows\System\YTCOFMR.exe
  C:\Windows\System\YTCOFMR.exe
  2⤵
  PID:8428
- C:\Windows\System\SoPwcWj.exe
  C:\Windows\System\SoPwcWj.exe
  2⤵
  PID:8452
- C:\Windows\System\elTleBQ.exe
  C:\Windows\System\elTleBQ.exe
  2⤵
  PID:8468
- C:\Windows\System\FzRGhwJ.exe
  C:\Windows\System\FzRGhwJ.exe
  2⤵
  PID:8488
- C:\Windows\System\FWbkgQP.exe
  C:\Windows\System\FWbkgQP.exe
  2⤵
  PID:8536
- C:\Windows\System\xbhYPgF.exe
  C:\Windows\System\xbhYPgF.exe
  2⤵
  PID:8572
- C:\Windows\System\cwCyDxo.exe
  C:\Windows\System\cwCyDxo.exe
  2⤵
  PID:8608
- C:\Windows\System\qIyyXdP.exe
  C:\Windows\System\qIyyXdP.exe
  2⤵
  PID:8636
- C:\Windows\System\BqAoFUf.exe
  C:\Windows\System\BqAoFUf.exe
  2⤵
  PID:8664
- C:\Windows\System\CGwUXJb.exe
  C:\Windows\System\CGwUXJb.exe
  2⤵
  PID:8692
- C:\Windows\System\KFpxxJS.exe
  C:\Windows\System\KFpxxJS.exe
  2⤵
  PID:8708
- C:\Windows\System\wFXwnLw.exe
  C:\Windows\System\wFXwnLw.exe
  2⤵
  PID:8732
- C:\Windows\System\ueThRtP.exe
  C:\Windows\System\ueThRtP.exe
  2⤵
  PID:8764
- C:\Windows\System\vcsuBoh.exe
  C:\Windows\System\vcsuBoh.exe
  2⤵
  PID:8788
- C:\Windows\System\QreSZqw.exe
  C:\Windows\System\QreSZqw.exe
  2⤵
  PID:8812
- C:\Windows\System\NeBhIQr.exe
  C:\Windows\System\NeBhIQr.exe
  2⤵
  PID:8836
- C:\Windows\System\URoLibE.exe
  C:\Windows\System\URoLibE.exe
  2⤵
  PID:8872
- C:\Windows\System\MImgnmk.exe
  C:\Windows\System\MImgnmk.exe
  2⤵
  PID:8904
- C:\Windows\System\kertEFw.exe
  C:\Windows\System\kertEFw.exe
  2⤵
  PID:8932
- C:\Windows\System\lUwaYph.exe
  C:\Windows\System\lUwaYph.exe
  2⤵
  PID:8964
- C:\Windows\System\QMNXFzp.exe
  C:\Windows\System\QMNXFzp.exe
  2⤵
  PID:8988
- C:\Windows\System\NHlQfUm.exe
  C:\Windows\System\NHlQfUm.exe
  2⤵
  PID:9020
- C:\Windows\System\vcsYzGq.exe
  C:\Windows\System\vcsYzGq.exe
  2⤵
  PID:9048
- C:\Windows\System\NkxqLLH.exe
  C:\Windows\System\NkxqLLH.exe
  2⤵
  PID:9072
- C:\Windows\System\dLSupJE.exe
  C:\Windows\System\dLSupJE.exe
  2⤵
  PID:9096
- C:\Windows\System\zOVXjuj.exe
  C:\Windows\System\zOVXjuj.exe
  2⤵
  PID:9132
- C:\Windows\System\TXeCXZs.exe
  C:\Windows\System\TXeCXZs.exe
  2⤵
  PID:9156
- C:\Windows\System\liTCcxI.exe
  C:\Windows\System\liTCcxI.exe
  2⤵
  PID:9176
- C:\Windows\System\fVdcyYZ.exe
  C:\Windows\System\fVdcyYZ.exe
  2⤵
  PID:9204
- C:\Windows\System\UgNMZtm.exe
  C:\Windows\System\UgNMZtm.exe
  2⤵
  PID:8220
- C:\Windows\System\ZcNOXMU.exe
  C:\Windows\System\ZcNOXMU.exe
  2⤵
  PID:8360
- C:\Windows\System\DuiYnyr.exe
  C:\Windows\System\DuiYnyr.exe
  2⤵
  PID:8408
- C:\Windows\System\mTlzBQt.exe
  C:\Windows\System\mTlzBQt.exe
  2⤵
  PID:8464
- C:\Windows\System\jYBTarI.exe
  C:\Windows\System\jYBTarI.exe
  2⤵
  PID:8520
- C:\Windows\System\MEwBlWY.exe
  C:\Windows\System\MEwBlWY.exe
  2⤵
  PID:8564
- C:\Windows\System\ZRsIUAq.exe
  C:\Windows\System\ZRsIUAq.exe
  2⤵
  PID:8684
- C:\Windows\System\ENJvwXH.exe
  C:\Windows\System\ENJvwXH.exe
  2⤵
  PID:8720
- C:\Windows\System\iGAisTm.exe
  C:\Windows\System\iGAisTm.exe
  2⤵
  PID:8776
- C:\Windows\System\qXWasbc.exe
  C:\Windows\System\qXWasbc.exe
  2⤵
  PID:8856
- C:\Windows\System\xHgtKTh.exe
  C:\Windows\System\xHgtKTh.exe
  2⤵
  PID:8880
- C:\Windows\System\syvpFjJ.exe
  C:\Windows\System\syvpFjJ.exe
  2⤵
  PID:8948
- C:\Windows\System\MHgxvPG.exe
  C:\Windows\System\MHgxvPG.exe
  2⤵
  PID:9056
- C:\Windows\System\utJatsP.exe
  C:\Windows\System\utJatsP.exe
  2⤵
  PID:9084
- C:\Windows\System\hsuAfSc.exe
  C:\Windows\System\hsuAfSc.exe
  2⤵
  PID:9188
- C:\Windows\System\qQoVyVu.exe
  C:\Windows\System\qQoVyVu.exe
  2⤵
  PID:8284
- C:\Windows\System\rqycgDF.exe
  C:\Windows\System\rqycgDF.exe
  2⤵
  PID:8440
- C:\Windows\System\LuOOhPT.exe
  C:\Windows\System\LuOOhPT.exe
  2⤵
  PID:8560
- C:\Windows\System\LJaGXfV.exe
  C:\Windows\System\LJaGXfV.exe
  2⤵
  PID:8676
- C:\Windows\System\iCNaSKY.exe
  C:\Windows\System\iCNaSKY.exe
  2⤵
  PID:8852
- C:\Windows\System\rZRmuuz.exe
  C:\Windows\System\rZRmuuz.exe
  2⤵
  PID:9028
- C:\Windows\System\rdSzPcY.exe
  C:\Windows\System\rdSzPcY.exe
  2⤵
  PID:8944
- C:\Windows\System\rXgQEYF.exe
  C:\Windows\System\rXgQEYF.exe
  2⤵
  PID:8660
- C:\Windows\System\saixtQB.exe
  C:\Windows\System\saixtQB.exe
  2⤵
  PID:8820
- C:\Windows\System\OrlfjSh.exe
  C:\Windows\System\OrlfjSh.exe
  2⤵
  PID:8604
- C:\Windows\System\BuYtYlK.exe
  C:\Windows\System\BuYtYlK.exe
  2⤵
  PID:9228
- C:\Windows\System\HBUMRpP.exe
  C:\Windows\System\HBUMRpP.exe
  2⤵
  PID:9268
- C:\Windows\System\hSEZVxP.exe
  C:\Windows\System\hSEZVxP.exe
  2⤵
  PID:9296
- C:\Windows\System\miDtUwh.exe
  C:\Windows\System\miDtUwh.exe
  2⤵
  PID:9324
- C:\Windows\System\gSQKUxk.exe
  C:\Windows\System\gSQKUxk.exe
  2⤵
  PID:9340
- C:\Windows\System\HKSygIm.exe
  C:\Windows\System\HKSygIm.exe
  2⤵
  PID:9380
- C:\Windows\System\kPswjFj.exe
  C:\Windows\System\kPswjFj.exe
  2⤵
  PID:9408
- C:\Windows\System\NPVPNXB.exe
  C:\Windows\System\NPVPNXB.exe
  2⤵
  PID:9436
- C:\Windows\System\uShLYGA.exe
  C:\Windows\System\uShLYGA.exe
  2⤵
  PID:9464
- C:\Windows\System\Vmouhsk.exe
  C:\Windows\System\Vmouhsk.exe
  2⤵
  PID:9488
- C:\Windows\System\BFnGeai.exe
  C:\Windows\System\BFnGeai.exe
  2⤵
  PID:9516
- C:\Windows\System\fEsoNBO.exe
  C:\Windows\System\fEsoNBO.exe
  2⤵
  PID:9544
- C:\Windows\System\jYMPfvq.exe
  C:\Windows\System\jYMPfvq.exe
  2⤵
  PID:9572
- C:\Windows\System\jfGieMe.exe
  C:\Windows\System\jfGieMe.exe
  2⤵
  PID:9588
- C:\Windows\System\nLiZyLI.exe
  C:\Windows\System\nLiZyLI.exe
  2⤵
  PID:9616
- C:\Windows\System\NWMyKXa.exe
  C:\Windows\System\NWMyKXa.exe
  2⤵
  PID:9652
- C:\Windows\System\Qnwcfec.exe
  C:\Windows\System\Qnwcfec.exe
  2⤵
  PID:9676
- C:\Windows\System\vnwnLLD.exe
  C:\Windows\System\vnwnLLD.exe
  2⤵
  PID:9696
- C:\Windows\System\NFdihNK.exe
  C:\Windows\System\NFdihNK.exe
  2⤵
  PID:9724
- C:\Windows\System\IAGfkxd.exe
  C:\Windows\System\IAGfkxd.exe
  2⤵
  PID:9784
- C:\Windows\System\jJobRDg.exe
  C:\Windows\System\jJobRDg.exe
  2⤵
  PID:9812
- C:\Windows\System\sqKFoxl.exe
  C:\Windows\System\sqKFoxl.exe
  2⤵
  PID:9840
- C:\Windows\System\smNbPVM.exe
  C:\Windows\System\smNbPVM.exe
  2⤵
  PID:9868
- C:\Windows\System\gdDkbCG.exe
  C:\Windows\System\gdDkbCG.exe
  2⤵
  PID:9896
- C:\Windows\System\pNjietl.exe
  C:\Windows\System\pNjietl.exe
  2⤵
  PID:9916
- C:\Windows\System\qXbvZJx.exe
  C:\Windows\System\qXbvZJx.exe
  2⤵
  PID:9940
- C:\Windows\System\eqAGPws.exe
  C:\Windows\System\eqAGPws.exe
  2⤵
  PID:9972
- C:\Windows\System\AQYRROS.exe
  C:\Windows\System\AQYRROS.exe
  2⤵
  PID:9992
- C:\Windows\System\BvfwwyA.exe
  C:\Windows\System\BvfwwyA.exe
  2⤵
  PID:10016
- C:\Windows\System\KniTXRu.exe
  C:\Windows\System\KniTXRu.exe
  2⤵
  PID:10048
- C:\Windows\System\nGcpaTQ.exe
  C:\Windows\System\nGcpaTQ.exe
  2⤵
  PID:10076
- C:\Windows\System\CWDnhAk.exe
  C:\Windows\System\CWDnhAk.exe
  2⤵
  PID:10112
- C:\Windows\System\BPDmprO.exe
  C:\Windows\System\BPDmprO.exe
  2⤵
  PID:10132
- C:\Windows\System\HeuImIR.exe
  C:\Windows\System\HeuImIR.exe
  2⤵
  PID:10160
- C:\Windows\System\FiZEPDz.exe
  C:\Windows\System\FiZEPDz.exe
  2⤵
  PID:10208
- C:\Windows\System\GXMaoFX.exe
  C:\Windows\System\GXMaoFX.exe
  2⤵
  PID:10236
- C:\Windows\System\PxDcBeq.exe
  C:\Windows\System\PxDcBeq.exe
  2⤵
  PID:9224
- C:\Windows\System\pXMNjNm.exe
  C:\Windows\System\pXMNjNm.exe
  2⤵
  PID:9292
- C:\Windows\System\HHoUROq.exe
  C:\Windows\System\HHoUROq.exe
  2⤵
  PID:9356
- C:\Windows\System\NknGvPk.exe
  C:\Windows\System\NknGvPk.exe
  2⤵
  PID:9376
- C:\Windows\System\zFhSYqz.exe
  C:\Windows\System\zFhSYqz.exe
  2⤵
  PID:9420
- C:\Windows\System\OTPbEfH.exe
  C:\Windows\System\OTPbEfH.exe
  2⤵
  PID:9568
- C:\Windows\System\NFgIFCJ.exe
  C:\Windows\System\NFgIFCJ.exe
  2⤵
  PID:9648
- C:\Windows\System\nVaLzMI.exe
  C:\Windows\System\nVaLzMI.exe
  2⤵
  PID:9704
- C:\Windows\System\zTkimpa.exe
  C:\Windows\System\zTkimpa.exe
  2⤵
  PID:9748
- C:\Windows\System\jHdsxGV.exe
  C:\Windows\System\jHdsxGV.exe
  2⤵
  PID:9832
- C:\Windows\System\mBRMLOq.exe
  C:\Windows\System\mBRMLOq.exe
  2⤵
  PID:9888
- C:\Windows\System\GUcZghk.exe
  C:\Windows\System\GUcZghk.exe
  2⤵
  PID:9952
- C:\Windows\System\RIcPkKl.exe
  C:\Windows\System\RIcPkKl.exe
  2⤵
  PID:10008
- C:\Windows\System\IKpFCSt.exe
  C:\Windows\System\IKpFCSt.exe
  2⤵
  PID:10096
- C:\Windows\System\NnUGdjF.exe
  C:\Windows\System\NnUGdjF.exe
  2⤵
  PID:10128
- C:\Windows\System\nkxxizT.exe
  C:\Windows\System\nkxxizT.exe
  2⤵
  PID:10204
- C:\Windows\System\jHaVLNf.exe
  C:\Windows\System\jHaVLNf.exe
  2⤵
  PID:9248
- C:\Windows\System\eozzzZt.exe
  C:\Windows\System\eozzzZt.exe
  2⤵
  PID:9504
- C:\Windows\System\jsyGMOE.exe
  C:\Windows\System\jsyGMOE.exe
  2⤵
  PID:9752
- C:\Windows\System\KjYVWDS.exe
  C:\Windows\System\KjYVWDS.exe
  2⤵
  PID:9808
- C:\Windows\System\JAUQZmi.exe
  C:\Windows\System\JAUQZmi.exe
  2⤵
  PID:9964
- C:\Windows\System\mApoNTB.exe
  C:\Windows\System\mApoNTB.exe
  2⤵
  PID:10152
- C:\Windows\System\CKYXenb.exe
  C:\Windows\System\CKYXenb.exe
  2⤵
  PID:10228
- C:\Windows\System\WWnXtkv.exe
  C:\Windows\System\WWnXtkv.exe
  2⤵
  PID:9764
- C:\Windows\System\DDxgXPn.exe
  C:\Windows\System\DDxgXPn.exe
  2⤵
  PID:9904
- C:\Windows\System\wgGMXzo.exe
  C:\Windows\System\wgGMXzo.exe
  2⤵
  PID:9540
- C:\Windows\System\sKqYwHe.exe
  C:\Windows\System\sKqYwHe.exe
  2⤵
  PID:10244
- C:\Windows\System\zEIsatZ.exe
  C:\Windows\System\zEIsatZ.exe
  2⤵
  PID:10272
- C:\Windows\System\nDOzKlr.exe
  C:\Windows\System\nDOzKlr.exe
  2⤵
  PID:10300
- C:\Windows\System\nMfFoog.exe
  C:\Windows\System\nMfFoog.exe
  2⤵
  PID:10324
- C:\Windows\System\YivKfZT.exe
  C:\Windows\System\YivKfZT.exe
  2⤵
  PID:10352
- C:\Windows\System\vyUtono.exe
  C:\Windows\System\vyUtono.exe
  2⤵
  PID:10372
- C:\Windows\System\EGnhXhE.exe
  C:\Windows\System\EGnhXhE.exe
  2⤵
  PID:10396
- C:\Windows\System\LWNbqkn.exe
  C:\Windows\System\LWNbqkn.exe
  2⤵
  PID:10432
- C:\Windows\System\CFandxI.exe
  C:\Windows\System\CFandxI.exe
  2⤵
  PID:10460
- C:\Windows\System\JfWFeqM.exe
  C:\Windows\System\JfWFeqM.exe
  2⤵
  PID:10480
- C:\Windows\System\iCARYIm.exe
  C:\Windows\System\iCARYIm.exe
  2⤵
  PID:10512
- C:\Windows\System\VZnGnxR.exe
  C:\Windows\System\VZnGnxR.exe
  2⤵
  PID:10556
- C:\Windows\System\tmkRIYV.exe
  C:\Windows\System\tmkRIYV.exe
  2⤵
  PID:10580
- C:\Windows\System\PSpofpz.exe
  C:\Windows\System\PSpofpz.exe
  2⤵
  PID:10596
- C:\Windows\System\tmrywfg.exe
  C:\Windows\System\tmrywfg.exe
  2⤵
  PID:10628
- C:\Windows\System\NxzWpce.exe
  C:\Windows\System\NxzWpce.exe
  2⤵
  PID:10660
- C:\Windows\System\xlnDblJ.exe
  C:\Windows\System\xlnDblJ.exe
  2⤵
  PID:10684
- C:\Windows\System\aSFevUe.exe
  C:\Windows\System\aSFevUe.exe
  2⤵
  PID:10712
- C:\Windows\System\SZFkwgP.exe
  C:\Windows\System\SZFkwgP.exe
  2⤵
  PID:10760
- C:\Windows\System\hYzSSLY.exe
  C:\Windows\System\hYzSSLY.exe
  2⤵
  PID:10788
- C:\Windows\System\VLHqaLn.exe
  C:\Windows\System\VLHqaLn.exe
  2⤵
  PID:10812
- C:\Windows\System\lkhVKRs.exe
  C:\Windows\System\lkhVKRs.exe
  2⤵
  PID:10832
- C:\Windows\System\EJujQLz.exe
  C:\Windows\System\EJujQLz.exe
  2⤵
  PID:10860
- C:\Windows\System\atiuaYs.exe
  C:\Windows\System\atiuaYs.exe
  2⤵
  PID:10880
- C:\Windows\System\DTCTQUe.exe
  C:\Windows\System\DTCTQUe.exe
  2⤵
  PID:10916
- C:\Windows\System\taQHRvs.exe
  C:\Windows\System\taQHRvs.exe
  2⤵
  PID:10940
- C:\Windows\System\xeHHEgT.exe
  C:\Windows\System\xeHHEgT.exe
  2⤵
  PID:10972
- C:\Windows\System\xlKaUBy.exe
  C:\Windows\System\xlKaUBy.exe
  2⤵
  PID:10988
- C:\Windows\System\IaxZimC.exe
  C:\Windows\System\IaxZimC.exe
  2⤵
  PID:11044
- C:\Windows\System\fKGdlqC.exe
  C:\Windows\System\fKGdlqC.exe
  2⤵
  PID:11072
- C:\Windows\System\EFdAXyv.exe
  C:\Windows\System\EFdAXyv.exe
  2⤵
  PID:11088
- C:\Windows\System\KRonWNF.exe
  C:\Windows\System\KRonWNF.exe
  2⤵
  PID:11104
- C:\Windows\System\LUoJrqP.exe
  C:\Windows\System\LUoJrqP.exe
  2⤵
  PID:11156
- C:\Windows\System\syHMbKj.exe
  C:\Windows\System\syHMbKj.exe
  2⤵
  PID:11172
- C:\Windows\System\qFNAjJP.exe
  C:\Windows\System\qFNAjJP.exe
  2⤵
  PID:11212
- C:\Windows\System\JSkzFsi.exe
  C:\Windows\System\JSkzFsi.exe
  2⤵
  PID:11240
- C:\Windows\System\nHXGdRY.exe
  C:\Windows\System\nHXGdRY.exe
  2⤵
  PID:11256
- C:\Windows\System\VqnIOMS.exe
  C:\Windows\System\VqnIOMS.exe
  2⤵
  PID:10120
- C:\Windows\System\gUOsehc.exe
  C:\Windows\System\gUOsehc.exe
  2⤵
  PID:10292
- C:\Windows\System\XTRzYVp.exe
  C:\Windows\System\XTRzYVp.exe
  2⤵
  PID:10336
- C:\Windows\System\ottuiXn.exe
  C:\Windows\System\ottuiXn.exe
  2⤵
  PID:10404
- C:\Windows\System\npCOTIz.exe
  C:\Windows\System\npCOTIz.exe
  2⤵
  PID:10420
- C:\Windows\System\FpZjOcL.exe
  C:\Windows\System\FpZjOcL.exe
  2⤵
  PID:10492
- C:\Windows\System\akbHLEm.exe
  C:\Windows\System\akbHLEm.exe
  2⤵
  PID:10636
- C:\Windows\System\GpbpONz.exe
  C:\Windows\System\GpbpONz.exe
  2⤵
  PID:10700
- C:\Windows\System\LZbimXq.exe
  C:\Windows\System\LZbimXq.exe
  2⤵
  PID:10724
- C:\Windows\System\MWaMGrl.exe
  C:\Windows\System\MWaMGrl.exe
  2⤵
  PID:10804
- C:\Windows\System\EWyTkBi.exe
  C:\Windows\System\EWyTkBi.exe
  2⤵
  PID:10852
- C:\Windows\System\tJznmQh.exe
  C:\Windows\System\tJznmQh.exe
  2⤵
  PID:10924
- C:\Windows\System\XGmlfin.exe
  C:\Windows\System\XGmlfin.exe
  2⤵
  PID:10980
- C:\Windows\System\HbVwmDF.exe
  C:\Windows\System\HbVwmDF.exe
  2⤵
  PID:11000
- C:\Windows\System\BLgDlDK.exe
  C:\Windows\System\BLgDlDK.exe
  2⤵
  PID:11184
- C:\Windows\System\IWuzrXs.exe
  C:\Windows\System\IWuzrXs.exe
  2⤵
  PID:11224
- C:\Windows\System\hgehjbO.exe
  C:\Windows\System\hgehjbO.exe
  2⤵
  PID:10312
- C:\Windows\System\NuBuLRn.exe
  C:\Windows\System\NuBuLRn.exe
  2⤵
  PID:10468
- C:\Windows\System\yKVeYYj.exe
  C:\Windows\System\yKVeYYj.exe
  2⤵
  PID:10648
- C:\Windows\System\weNBEjq.exe
  C:\Windows\System\weNBEjq.exe
  2⤵
  PID:10692
- C:\Windows\System\eZIbYVg.exe
  C:\Windows\System\eZIbYVg.exe
  2⤵
  PID:10872
- C:\Windows\System\nkDGZBj.exe
  C:\Windows\System\nkDGZBj.exe
  2⤵
  PID:11020
- C:\Windows\System\ZUeEaiw.exe
  C:\Windows\System\ZUeEaiw.exe
  2⤵
  PID:11252
- C:\Windows\System\WZrwDZY.exe
  C:\Windows\System\WZrwDZY.exe
  2⤵
  PID:10392
- C:\Windows\System\ZBNjxTU.exe
  C:\Windows\System\ZBNjxTU.exe
  2⤵
  PID:10912
- C:\Windows\System\QlCPRIj.exe
  C:\Windows\System\QlCPRIj.exe
  2⤵
  PID:11136
- C:\Windows\System\bXUYHBs.exe
  C:\Windows\System\bXUYHBs.exe
  2⤵
  PID:10844
- C:\Windows\System\AnEAzmf.exe
  C:\Windows\System\AnEAzmf.exe
  2⤵
  PID:11268
- C:\Windows\System\ynexNCx.exe
  C:\Windows\System\ynexNCx.exe
  2⤵
  PID:11292
- C:\Windows\System\syVNBdu.exe
  C:\Windows\System\syVNBdu.exe
  2⤵
  PID:11324
- C:\Windows\System\kABHmFO.exe
  C:\Windows\System\kABHmFO.exe
  2⤵
  PID:11352
- C:\Windows\System\yhqwSeh.exe
  C:\Windows\System\yhqwSeh.exe
  2⤵
  PID:11368
- C:\Windows\System\fgRhBzB.exe
  C:\Windows\System\fgRhBzB.exe
  2⤵
  PID:11388
- C:\Windows\System\yzDBxXQ.exe
  C:\Windows\System\yzDBxXQ.exe
  2⤵
  PID:11412
- C:\Windows\System\zhUXJMW.exe
  C:\Windows\System\zhUXJMW.exe
  2⤵
  PID:11432
- C:\Windows\System\ObGEqXq.exe
  C:\Windows\System\ObGEqXq.exe
  2⤵
  PID:11476
- C:\Windows\System\pokriMa.exe
  C:\Windows\System\pokriMa.exe
  2⤵
  PID:11500
- C:\Windows\System\ahurkeq.exe
  C:\Windows\System\ahurkeq.exe
  2⤵
  PID:11528
- C:\Windows\System\mxXHwoX.exe
  C:\Windows\System\mxXHwoX.exe
  2⤵
  PID:11552
- C:\Windows\System\sOtkLAP.exe
  C:\Windows\System\sOtkLAP.exe
  2⤵
  PID:11584
- C:\Windows\System\arynfpO.exe
  C:\Windows\System\arynfpO.exe
  2⤵
  PID:11636
- C:\Windows\System\MKFEruf.exe
  C:\Windows\System\MKFEruf.exe
  2⤵
  PID:11664
- C:\Windows\System\JiMpUBg.exe
  C:\Windows\System\JiMpUBg.exe
  2⤵
  PID:11692
- C:\Windows\System\hsunnqG.exe
  C:\Windows\System\hsunnqG.exe
  2⤵
  PID:11708
- C:\Windows\System\cjoTgUy.exe
  C:\Windows\System\cjoTgUy.exe
  2⤵
  PID:11728
- C:\Windows\System\sqjlLyT.exe
  C:\Windows\System\sqjlLyT.exe
  2⤵
  PID:11756
- C:\Windows\System\McZztqg.exe
  C:\Windows\System\McZztqg.exe
  2⤵
  PID:11784
- C:\Windows\System\cAJnQmP.exe
  C:\Windows\System\cAJnQmP.exe
  2⤵
  PID:11812
- C:\Windows\System\YfkbxiG.exe
  C:\Windows\System\YfkbxiG.exe
  2⤵
  PID:11844
- C:\Windows\System\jCSZqXl.exe
  C:\Windows\System\jCSZqXl.exe
  2⤵
  PID:11872
- C:\Windows\System\YjtSegK.exe
  C:\Windows\System\YjtSegK.exe
  2⤵
  PID:11904
- C:\Windows\System\bsRYoaJ.exe
  C:\Windows\System\bsRYoaJ.exe
  2⤵
  PID:11932
- C:\Windows\System\ksvYmXu.exe
  C:\Windows\System\ksvYmXu.exe
  2⤵
  PID:11960
- C:\Windows\System\MiPbsjX.exe
  C:\Windows\System\MiPbsjX.exe
  2⤵
  PID:11988
- C:\Windows\System\NrgGLvg.exe
  C:\Windows\System\NrgGLvg.exe
  2⤵
  PID:12008
- C:\Windows\System\yMuYhRa.exe
  C:\Windows\System\yMuYhRa.exe
  2⤵
  PID:12036
- C:\Windows\System\NjMBJHQ.exe
  C:\Windows\System\NjMBJHQ.exe
  2⤵
  PID:12060
- C:\Windows\System\Pjsilty.exe
  C:\Windows\System\Pjsilty.exe
  2⤵
  PID:12084
- C:\Windows\System\tKuPOmP.exe
  C:\Windows\System\tKuPOmP.exe
  2⤵
  PID:12112
- C:\Windows\System\zPDmPbv.exe
  C:\Windows\System\zPDmPbv.exe
  2⤵
  PID:12152
- C:\Windows\System\oXqbHex.exe
  C:\Windows\System\oXqbHex.exe
  2⤵
  PID:12180
- C:\Windows\System\vVklzMP.exe
  C:\Windows\System\vVklzMP.exe
  2⤵
  PID:12212
- C:\Windows\System\ACZYaKn.exe
  C:\Windows\System\ACZYaKn.exe
  2⤵
  PID:12228
- C:\Windows\System\lkOfNIP.exe
  C:\Windows\System\lkOfNIP.exe
  2⤵
  PID:12260
- C:\Windows\System\WEFpmsK.exe
  C:\Windows\System\WEFpmsK.exe
  2⤵
  PID:12284
- C:\Windows\System\iXkFmff.exe
  C:\Windows\System\iXkFmff.exe
  2⤵
  PID:11380
- C:\Windows\System\EhXWmGX.exe
  C:\Windows\System\EhXWmGX.exe
  2⤵
  PID:11424
- C:\Windows\System\TwNSvKQ.exe
  C:\Windows\System\TwNSvKQ.exe
  2⤵
  PID:11452
- C:\Windows\System\jBAsrPm.exe
  C:\Windows\System\jBAsrPm.exe
  2⤵
  PID:11536
- C:\Windows\System\qjurCjG.exe
  C:\Windows\System\qjurCjG.exe
  2⤵
  PID:11564
- C:\Windows\System\brQxiGS.exe
  C:\Windows\System\brQxiGS.exe
  2⤵
  PID:11604
- C:\Windows\System\XUuZcJc.exe
  C:\Windows\System\XUuZcJc.exe
  2⤵
  PID:11660
- C:\Windows\System\NfYhWha.exe
  C:\Windows\System\NfYhWha.exe
  2⤵
  PID:11700
- C:\Windows\System\yCbQhnD.exe
  C:\Windows\System\yCbQhnD.exe
  2⤵
  PID:11820
- C:\Windows\System\UJnqUoR.exe
  C:\Windows\System\UJnqUoR.exe
  2⤵
  PID:11832
- C:\Windows\System\NegjIEV.exe
  C:\Windows\System\NegjIEV.exe
  2⤵
  PID:11944
- C:\Windows\System\CpjLmRR.exe
  C:\Windows\System\CpjLmRR.exe
  2⤵
  PID:11980
- C:\Windows\System\UVrIJDK.exe
  C:\Windows\System\UVrIJDK.exe
  2⤵
  PID:12004
- C:\Windows\System\rQJCjbu.exe
  C:\Windows\System\rQJCjbu.exe
  2⤵
  PID:12048
- C:\Windows\System\yUULewY.exe
  C:\Windows\System\yUULewY.exe
  2⤵
  PID:12164
- C:\Windows\System\KuTdNhT.exe
  C:\Windows\System\KuTdNhT.exe
  2⤵
  PID:12224
- C:\Windows\System\RSiBbUP.exe
  C:\Windows\System\RSiBbUP.exe
  2⤵
  PID:11320
- C:\Windows\System\VfKYaYw.exe
  C:\Windows\System\VfKYaYw.exe
  2⤵
  PID:11472
- C:\Windows\System\bIfpPCl.exe
  C:\Windows\System\bIfpPCl.exe
  2⤵
  PID:11600
- C:\Windows\System\YHajcyC.exe
  C:\Windows\System\YHajcyC.exe
  2⤵
  PID:11676
- C:\Windows\System\wDtMTVr.exe
  C:\Windows\System\wDtMTVr.exe
  2⤵
  PID:11772
- C:\Windows\System\GtNBujU.exe
  C:\Windows\System\GtNBujU.exe
  2⤵
  PID:11864
- C:\Windows\System\AKmMlIP.exe
  C:\Windows\System\AKmMlIP.exe
  2⤵
  PID:12128
- C:\Windows\System\ibLbiyw.exe
  C:\Windows\System\ibLbiyw.exe
  2⤵
  PID:12248
- C:\Windows\System\OgloTkS.exe
  C:\Windows\System\OgloTkS.exe
  2⤵
  PID:1436
- C:\Windows\System\GZOYEJr.exe
  C:\Windows\System\GZOYEJr.exe
  2⤵
  PID:11896
- C:\Windows\System\ZsLCJOl.exe
  C:\Windows\System\ZsLCJOl.exe
  2⤵
  PID:12136
- C:\Windows\System\iGlBESa.exe
  C:\Windows\System\iGlBESa.exe
  2⤵
  PID:11448
- C:\Windows\System\EDYOJWf.exe
  C:\Windows\System\EDYOJWf.exe
  2⤵
  PID:11408
- C:\Windows\System\SwoDOwz.exe
  C:\Windows\System\SwoDOwz.exe
  2⤵
  PID:12308
- C:\Windows\System\PrIBijF.exe
  C:\Windows\System\PrIBijF.exe
  2⤵
  PID:12332
- C:\Windows\System\GaqtbLF.exe
  C:\Windows\System\GaqtbLF.exe
  2⤵
  PID:12372
- C:\Windows\System\Zdtrnsc.exe
  C:\Windows\System\Zdtrnsc.exe
  2⤵
  PID:12400
- C:\Windows\System\ezkTmpL.exe
  C:\Windows\System\ezkTmpL.exe
  2⤵
  PID:12420
- C:\Windows\System\rCNnKEH.exe
  C:\Windows\System\rCNnKEH.exe
  2⤵
  PID:12444
- C:\Windows\System\jZFUqxF.exe
  C:\Windows\System\jZFUqxF.exe
  2⤵
  PID:12472
- C:\Windows\System\kPlpjpY.exe
  C:\Windows\System\kPlpjpY.exe
  2⤵
  PID:12488
- C:\Windows\System\oSWmIqp.exe
  C:\Windows\System\oSWmIqp.exe
  2⤵
  PID:12520
- C:\Windows\System\PgSGgIi.exe
  C:\Windows\System\PgSGgIi.exe
  2⤵
  PID:12548
- C:\Windows\System\gjnNHDX.exe
  C:\Windows\System\gjnNHDX.exe
  2⤵
  PID:12588
- C:\Windows\System\pOUbewV.exe
  C:\Windows\System\pOUbewV.exe
  2⤵
  PID:12608
- C:\Windows\System\ZqiUMig.exe
  C:\Windows\System\ZqiUMig.exe
  2⤵
  PID:12628
- C:\Windows\System\FTfEztM.exe
  C:\Windows\System\FTfEztM.exe
  2⤵
  PID:12668
- C:\Windows\System\HENaIbf.exe
  C:\Windows\System\HENaIbf.exe
  2⤵
  PID:12692
- C:\Windows\System\ZlZBuBG.exe
  C:\Windows\System\ZlZBuBG.exe
  2⤵
  PID:12712
- C:\Windows\System\tSlJHnV.exe
  C:\Windows\System\tSlJHnV.exe
  2⤵
  PID:12764
- C:\Windows\System\iLjnkRg.exe
  C:\Windows\System\iLjnkRg.exe
  2⤵
  PID:12784
- C:\Windows\System\bJvEVrW.exe
  C:\Windows\System\bJvEVrW.exe
  2⤵
  PID:12812
- C:\Windows\System\HMoJHcH.exe
  C:\Windows\System\HMoJHcH.exe
  2⤵
  PID:12836
- C:\Windows\System\dHkOXQJ.exe
  C:\Windows\System\dHkOXQJ.exe
  2⤵
  PID:12868
- C:\Windows\System\gDRvnqr.exe
  C:\Windows\System\gDRvnqr.exe
  2⤵
  PID:12896
- C:\Windows\System\ICYjeVo.exe
  C:\Windows\System\ICYjeVo.exe
  2⤵
  PID:12920
- C:\Windows\System\nwUrMQm.exe
  C:\Windows\System\nwUrMQm.exe
  2⤵
  PID:12948
- C:\Windows\System\jWBUBwm.exe
  C:\Windows\System\jWBUBwm.exe
  2⤵
  PID:12968
- C:\Windows\System\ehzaisw.exe
  C:\Windows\System\ehzaisw.exe
  2⤵
  PID:12988
- C:\Windows\System\GuWdToF.exe
  C:\Windows\System\GuWdToF.exe
  2⤵
  PID:13020
- C:\Windows\System\YPbBvaa.exe
  C:\Windows\System\YPbBvaa.exe
  2⤵
  PID:13060
- C:\Windows\System\bBNzIET.exe
  C:\Windows\System\bBNzIET.exe
  2⤵
  PID:13100
- C:\Windows\System\xOUdPvm.exe
  C:\Windows\System\xOUdPvm.exe
  2⤵
  PID:13116
- C:\Windows\System\EEvXHyQ.exe
  C:\Windows\System\EEvXHyQ.exe
  2⤵
  PID:13148
- C:\Windows\System\ekTCATN.exe
  C:\Windows\System\ekTCATN.exe
  2⤵
  PID:13164
- C:\Windows\System\dqfbjzx.exe
  C:\Windows\System\dqfbjzx.exe
  2⤵
  PID:13188
- C:\Windows\System\OKJsFnU.exe
  C:\Windows\System\OKJsFnU.exe
  2⤵
  PID:13236
- C:\Windows\System\nFtzHxd.exe
  C:\Windows\System\nFtzHxd.exe
  2⤵
  PID:13256
- C:\Windows\System\NjfUlfB.exe
  C:\Windows\System\NjfUlfB.exe
  2⤵
  PID:13272
- C:\Windows\System\NaEnhbU.exe
  C:\Windows\System\NaEnhbU.exe
  2⤵
  PID:12328
- C:\Windows\System\OfOrDop.exe
  C:\Windows\System\OfOrDop.exe
  2⤵
  PID:12344
- C:\Windows\System\zXnTOlV.exe
  C:\Windows\System\zXnTOlV.exe
  2⤵
  PID:12384
- C:\Windows\System\bsyinKX.exe
  C:\Windows\System\bsyinKX.exe
  2⤵
  PID:12500
- C:\Windows\System\aeMBfwq.exe
  C:\Windows\System\aeMBfwq.exe
  2⤵
  PID:12512
- C:\Windows\System\vNdBPNu.exe
  C:\Windows\System\vNdBPNu.exe
  2⤵
  PID:12576
- C:\Windows\System\PQlwnRI.exe
  C:\Windows\System\PQlwnRI.exe
  2⤵
  PID:12644
- C:\Windows\System\BKVKHay.exe
  C:\Windows\System\BKVKHay.exe
  2⤵
  PID:12780
- C:\Windows\System\PWkpxoy.exe
  C:\Windows\System\PWkpxoy.exe
  2⤵
  PID:12848
- C:\Windows\System\CEGdxGQ.exe
  C:\Windows\System\CEGdxGQ.exe
  2⤵
  PID:12904
- C:\Windows\System\asFfffA.exe
  C:\Windows\System\asFfffA.exe
  2⤵
  PID:12932
- C:\Windows\System\xOtQVkO.exe
  C:\Windows\System\xOtQVkO.exe
  2⤵
  PID:13052
- C:\Windows\System\GKksoGb.exe
  C:\Windows\System\GKksoGb.exe
  2⤵
  PID:13112
- C:\Windows\System\kZWviyH.exe
  C:\Windows\System\kZWviyH.exe
  2⤵
  PID:13136
- C:\Windows\System\fXsAbeW.exe
  C:\Windows\System\fXsAbeW.exe
  2⤵
  PID:11652
- C:\Windows\System\JuZZiFY.exe
  C:\Windows\System\JuZZiFY.exe
  2⤵
  PID:13300
- C:\Windows\System\LfsBdNm.exe
  C:\Windows\System\LfsBdNm.exe
  2⤵
  PID:12388
- C:\Windows\System\eGLuqUf.exe
  C:\Windows\System\eGLuqUf.exe
  2⤵
  PID:12432
- C:\Windows\System\SqWNMlU.exe
  C:\Windows\System\SqWNMlU.exe
  2⤵
  PID:12736
- C:\Windows\System\whkWqyw.exe
  C:\Windows\System\whkWqyw.exe
  2⤵
  PID:12808
- C:\Windows\System\gKuMuoA.exe
  C:\Windows\System\gKuMuoA.exe
  2⤵
  PID:13004
- C:\Windows\System\SHZkNYw.exe
  C:\Windows\System\SHZkNYw.exe
  2⤵
  PID:13172
- C:\Windows\System\HgyWApt.exe
  C:\Windows\System\HgyWApt.exe
  2⤵
  PID:13208
- C:\Windows\System\VDuOAbq.exe
  C:\Windows\System\VDuOAbq.exe
  2⤵
  PID:12464
- C:\Windows\System\cWlECgf.exe
  C:\Windows\System\cWlECgf.exe
  2⤵
  PID:12940
- C:\Windows\System\sKtOBtb.exe
  C:\Windows\System\sKtOBtb.exe
  2⤵
  PID:13092
- C:\Windows\System\DZjiBFv.exe
  C:\Windows\System\DZjiBFv.exe
  2⤵
  PID:1404
- C:\Windows\System\fHyOuvm.exe
  C:\Windows\System\fHyOuvm.exe
  2⤵
  PID:12760
- C:\Windows\System\htCkvTx.exe
  C:\Windows\System\htCkvTx.exe
  2⤵
  PID:13348
- C:\Windows\System\wbvmjhr.exe
  C:\Windows\System\wbvmjhr.exe
  2⤵
  PID:13372
- C:\Windows\System\xJrgmIS.exe
  C:\Windows\System\xJrgmIS.exe
  2⤵
  PID:13392
- C:\Windows\System\gjSHfkN.exe
  C:\Windows\System\gjSHfkN.exe
  2⤵
  PID:13436
- C:\Windows\System\wLIXHrK.exe
  C:\Windows\System\wLIXHrK.exe
  2⤵
  PID:13456
- C:\Windows\System\tadDdrU.exe
  C:\Windows\System\tadDdrU.exe
  2⤵
  PID:13480
- C:\Windows\System\WnEikMs.exe
  C:\Windows\System\WnEikMs.exe
  2⤵
  PID:13528
- C:\Windows\System\uPvzupI.exe
  C:\Windows\System\uPvzupI.exe
  2⤵
  PID:13548
- C:\Windows\System\HfaGLny.exe
  C:\Windows\System\HfaGLny.exe
  2⤵
  PID:13572
- C:\Windows\System\FhPMJgk.exe
  C:\Windows\System\FhPMJgk.exe
  2⤵
  PID:13588
- C:\Windows\System\uONIBYm.exe
  C:\Windows\System\uONIBYm.exe
  2⤵
  PID:13612
- C:\Windows\System\zaSjgMg.exe
  C:\Windows\System\zaSjgMg.exe
  2⤵
  PID:13664
- C:\Windows\System\bobKCMe.exe
  C:\Windows\System\bobKCMe.exe
  2⤵
  PID:13684
- C:\Windows\System\LDnvlfm.exe
  C:\Windows\System\LDnvlfm.exe
  2⤵
  PID:13712
- C:\Windows\System\fZtCXsk.exe
  C:\Windows\System\fZtCXsk.exe
  2⤵
  PID:13752
- C:\Windows\System\cjzozJu.exe
  C:\Windows\System\cjzozJu.exe
  2⤵
  PID:13780
- C:\Windows\System\GwUFsvh.exe
  C:\Windows\System\GwUFsvh.exe
  2⤵
  PID:13800
- C:\Windows\System\wVtGsRs.exe
  C:\Windows\System\wVtGsRs.exe
  2⤵
  PID:13828
- C:\Windows\System\lqWpLlV.exe
  C:\Windows\System\lqWpLlV.exe
  2⤵
  PID:13852
- C:\Windows\System\MfMWvpW.exe
  C:\Windows\System\MfMWvpW.exe
  2⤵
  PID:13880
- C:\Windows\System\AWoSdJT.exe
  C:\Windows\System\AWoSdJT.exe
  2⤵
  PID:13908
- C:\Windows\System\GaITdeZ.exe
  C:\Windows\System\GaITdeZ.exe
  2⤵
  PID:13924
- C:\Windows\System\lVEkxWC.exe
  C:\Windows\System\lVEkxWC.exe
  2⤵
  PID:13940
- C:\Windows\System\Yttmpte.exe
  C:\Windows\System\Yttmpte.exe
  2⤵
  PID:13972
- C:\Windows\System\RBXgqnI.exe
  C:\Windows\System\RBXgqnI.exe
  2⤵
  PID:14008
- C:\Windows\System\hcQYMMM.exe
  C:\Windows\System\hcQYMMM.exe
  2⤵
  PID:14048
- C:\Windows\System\SEtkiik.exe
  C:\Windows\System\SEtkiik.exe
  2⤵
  PID:14072
- C:\Windows\System\mmLOfGS.exe
  C:\Windows\System\mmLOfGS.exe
  2⤵
  PID:14100
- C:\Windows\System\BjrSfCA.exe
  C:\Windows\System\BjrSfCA.exe
  2⤵
  PID:14128
- C:\Windows\System\BHXRpeC.exe
  C:\Windows\System\BHXRpeC.exe
  2⤵
  PID:14148
- C:\Windows\System\KyuhSXb.exe
  C:\Windows\System\KyuhSXb.exe
  2⤵
  PID:14164
- C:\Windows\System\JJSvtHG.exe
  C:\Windows\System\JJSvtHG.exe
  2⤵
  PID:14192
- C:\Windows\System\HckvSvb.exe
  C:\Windows\System\HckvSvb.exe
  2⤵
  PID:14216
- C:\Windows\System\CkgJbHP.exe
  C:\Windows\System\CkgJbHP.exe
  2⤵
  PID:14240
- C:\Windows\System\vwwoomS.exe
  C:\Windows\System\vwwoomS.exe
  2⤵
  PID:14268
- C:\Windows\System\uUZEbSE.exe
  C:\Windows\System\uUZEbSE.exe
  2⤵
  PID:14288
- C:\Windows\System\QGmhlxK.exe
  C:\Windows\System\QGmhlxK.exe
  2⤵
  PID:14312
- C:\Windows\System\HfGiGVH.exe
  C:\Windows\System\HfGiGVH.exe
  2⤵
  PID:13132
- C:\Windows\System\ElxsMFw.exe
  C:\Windows\System\ElxsMFw.exe
  2⤵
  PID:13344
- C:\Windows\System\eIbeUyv.exe
  C:\Windows\System\eIbeUyv.exe
  2⤵
  PID:13360
- C:\Windows\System\KZyOUkq.exe
  C:\Windows\System\KZyOUkq.exe
  2⤵
  PID:13404
- C:\Windows\System\adgBHmD.exe
  C:\Windows\System\adgBHmD.exe
  2⤵
  PID:13468
- C:\Windows\System\IMfGtto.exe
  C:\Windows\System\IMfGtto.exe
  2⤵
  PID:13524
- C:\Windows\System\NPSSMLE.exe
  C:\Windows\System\NPSSMLE.exe
  2⤵
  PID:13584
- C:\Windows\System\JmurPAt.exe
  C:\Windows\System\JmurPAt.exe
  2⤵
  PID:13672
- C:\Windows\System\gSPtVIw.exe
  C:\Windows\System\gSPtVIw.exe
  2⤵
  PID:13700
- C:\Windows\System\aIlEgLz.exe
  C:\Windows\System\aIlEgLz.exe
  2⤵
  PID:13744
- C:\Windows\System\YVbDKeb.exe
  C:\Windows\System\YVbDKeb.exe
  2⤵
  PID:13812
- C:\Windows\System\KwxiRfM.exe
  C:\Windows\System\KwxiRfM.exe
  2⤵
  PID:13892
- C:\Windows\System\hwEOjQr.exe
  C:\Windows\System\hwEOjQr.exe
  2⤵
  PID:13920
- C:\Windows\System\nrhLopX.exe
  C:\Windows\System\nrhLopX.exe
  2⤵
  PID:13996
- C:\Windows\System\nrqzoMI.exe
  C:\Windows\System\nrqzoMI.exe
  2⤵
  PID:14032
- C:\Windows\System\txdnxmD.exe
  C:\Windows\System\txdnxmD.exe
  2⤵
  PID:14124
- C:\Windows\System\bJhlgAB.exe
  C:\Windows\System\bJhlgAB.exe
  2⤵
  PID:14144
- C:\Windows\System\qpBsHDe.exe
  C:\Windows\System\qpBsHDe.exe
  2⤵
  PID:14224
- C:\Windows\System\PFHzSTo.exe
  C:\Windows\System\PFHzSTo.exe
  2⤵
  PID:14228
- C:\Windows\System\HAehAnU.exe
  C:\Windows\System\HAehAnU.exe
  2⤵
  PID:14308
- C:\Windows\System\flVAJsH.exe
  C:\Windows\System\flVAJsH.exe
  2⤵
  PID:13328
- C:\Windows\System\DvIBQhJ.exe
  C:\Windows\System\DvIBQhJ.exe
  2⤵
  PID:13516
- C:\Windows\System\OnRKgYS.exe
  C:\Windows\System\OnRKgYS.exe
  2⤵
  PID:13388
- C:\Windows\System\xVLDidi.exe
  C:\Windows\System\xVLDidi.exe
  2⤵
  PID:13452
- C:\Windows\System\jQOjpPU.exe
  C:\Windows\System\jQOjpPU.exe
  2⤵
  PID:13864
- C:\Windows\System\VtPpleU.exe
  C:\Windows\System\VtPpleU.exe
  2⤵
  PID:13736
- C:\Windows\System\tWGbFpT.exe
  C:\Windows\System\tWGbFpT.exe
  2⤵
  PID:13916
- C:\Windows\System\yLiLise.exe
  C:\Windows\System\yLiLise.exe
  2⤵
  PID:13968
- C:\Windows\System\nySOlff.exe
  C:\Windows\System\nySOlff.exe
  2⤵
  PID:14356
- C:\Windows\System\iwEGqWy.exe
  C:\Windows\System\iwEGqWy.exe
  2⤵
  PID:14380
- C:\Windows\System\RepovSF.exe
  C:\Windows\System\RepovSF.exe
  2⤵
  PID:14396
- C:\Windows\System\tWjuOhT.exe
  C:\Windows\System\tWjuOhT.exe
  2⤵
  PID:14420
- C:\Windows\System\gmMsIle.exe
  C:\Windows\System\gmMsIle.exe
  2⤵
  PID:14444
- C:\Windows\System\KOdBeKn.exe
  C:\Windows\System\KOdBeKn.exe
  2⤵
  PID:14464
- C:\Windows\System\TeCcitq.exe
  C:\Windows\System\TeCcitq.exe
  2⤵
  PID:14484
- C:\Windows\System\vlFcqrw.exe
  C:\Windows\System\vlFcqrw.exe
  2⤵
  PID:14508
- C:\Windows\System\BEkZcSk.exe
  C:\Windows\System\BEkZcSk.exe
  2⤵
  PID:14528
- C:\Windows\System\eHOywXL.exe
  C:\Windows\System\eHOywXL.exe
  2⤵
  PID:14552
- C:\Windows\System\hQuFtff.exe
  C:\Windows\System\hQuFtff.exe
  2⤵
  PID:14580
- C:\Windows\System\tFYwgzX.exe
  C:\Windows\System\tFYwgzX.exe
  2⤵
  PID:14604
- C:\Windows\System\CUpYfUP.exe
  C:\Windows\System\CUpYfUP.exe
  2⤵
  PID:14628
- C:\Windows\System\YIKkxAN.exe
  C:\Windows\System\YIKkxAN.exe
  2⤵
  PID:14652
- C:\Windows\System\PftMgVl.exe
  C:\Windows\System\PftMgVl.exe
  2⤵
  PID:14684
- C:\Windows\System\JDgDMxK.exe
  C:\Windows\System\JDgDMxK.exe
  2⤵
  PID:14704
- C:\Windows\System\ouTCiie.exe
  C:\Windows\System\ouTCiie.exe
  2⤵
  PID:14728
- C:\Windows\System\mhpSdEt.exe
  C:\Windows\System\mhpSdEt.exe
  2⤵
  PID:14744
- C:\Windows\System\auDUHok.exe
  C:\Windows\System\auDUHok.exe
  2⤵
  PID:14768
- C:\Windows\System\LbwxEPv.exe
  C:\Windows\System\LbwxEPv.exe
  2⤵
  PID:14792
- C:\Windows\System\Zlqhmjw.exe
  C:\Windows\System\Zlqhmjw.exe
  2⤵
  PID:14824
- C:\Windows\System\cVNSQWA.exe
  C:\Windows\System\cVNSQWA.exe
  2⤵
  PID:14856
- C:\Windows\System\tdatEaR.exe
  C:\Windows\System\tdatEaR.exe
  2⤵
  PID:14880
- C:\Windows\System\ZdrKSNO.exe
  C:\Windows\System\ZdrKSNO.exe
  2⤵
  PID:14904
- C:\Windows\System\UGqZbge.exe
  C:\Windows\System\UGqZbge.exe
  2⤵
  PID:14920
- C:\Windows\System\dlvHWsh.exe
  C:\Windows\System\dlvHWsh.exe
  2⤵
  PID:14940
- C:\Windows\System\BnpJrZi.exe
  C:\Windows\System\BnpJrZi.exe
  2⤵
  PID:14956
- C:\Windows\System\RgCBXlc.exe
  C:\Windows\System\RgCBXlc.exe
  2⤵
  PID:14972
- C:\Windows\System\pPszinC.exe
  C:\Windows\System\pPszinC.exe
  2⤵
  PID:14988
- C:\Windows\System\IQjxIMp.exe
  C:\Windows\System\IQjxIMp.exe
  2⤵
  PID:15004
- C:\Windows\System\HGRTZjc.exe
  C:\Windows\System\HGRTZjc.exe
  2⤵
  PID:15020
- C:\Windows\System\iGzZFRo.exe
  C:\Windows\System\iGzZFRo.exe
  2⤵
  PID:15060
- C:\Windows\System\FYnVKMk.exe
  C:\Windows\System\FYnVKMk.exe
  2⤵
  PID:15096
- C:\Windows\System\uVfUPwk.exe
  C:\Windows\System\uVfUPwk.exe
  2⤵
  PID:15120
- C:\Windows\System\vdJmMwi.exe
  C:\Windows\System\vdJmMwi.exe
  2⤵
  PID:15140
- C:\Windows\System\bYoKGQW.exe
  C:\Windows\System\bYoKGQW.exe
  2⤵
  PID:15176
- C:\Windows\System\wEvussw.exe
  C:\Windows\System\wEvussw.exe
  2⤵
  PID:15196
- C:\Windows\System\fkhaRtj.exe
  C:\Windows\System\fkhaRtj.exe
  2⤵
  PID:15212
- C:\Windows\System\UeURrfE.exe
  C:\Windows\System\UeURrfE.exe
  2⤵
  PID:15240
- C:\Windows\System\WZudETC.exe
  C:\Windows\System\WZudETC.exe
  2⤵
  PID:15256
- C:\Windows\System\FUcpUnu.exe
  C:\Windows\System\FUcpUnu.exe
  2⤵
  PID:15272
- C:\Windows\System\IewccWn.exe
  C:\Windows\System\IewccWn.exe
  2⤵
  PID:15288
- C:\Windows\System\nEBTRYj.exe
  C:\Windows\System\nEBTRYj.exe
  2⤵
  PID:15304
- C:\Windows\System\XwvJepP.exe
  C:\Windows\System\XwvJepP.exe
  2⤵
  PID:15344
- C:\Windows\System\gpFPELU.exe
  C:\Windows\System\gpFPELU.exe
  2⤵
  PID:14256
- C:\Windows\System\gBUzIHW.exe
  C:\Windows\System\gBUzIHW.exe
  2⤵
  PID:14084
- C:\Windows\System\rCBapFv.exe
  C:\Windows\System\rCBapFv.exe
  2⤵
  PID:14160
- C:\Windows\System\PjsLczU.exe
  C:\Windows\System\PjsLczU.exe
  2⤵
  PID:13652
- C:\Windows\System\lmiVVbi.exe
  C:\Windows\System\lmiVVbi.exe
  2⤵
  PID:13696
- C:\Windows\System\dyvBJUO.exe
  C:\Windows\System\dyvBJUO.exe
  2⤵
  PID:14140
- C:\Windows\System\SAdiVPh.exe
  C:\Windows\System\SAdiVPh.exe
  2⤵
  PID:12352
- C:\Windows\System\hCTYrQW.exe
  C:\Windows\System\hCTYrQW.exe
  2⤵
  PID:1044
- C:\Windows\System\VddOpnA.exe
  C:\Windows\System\VddOpnA.exe
  2⤵
  PID:14616
- C:\Windows\System\XNpldss.exe
  C:\Windows\System\XNpldss.exe
  2⤵
  PID:14660
- C:\Windows\System\NglQvpS.exe
  C:\Windows\System\NglQvpS.exe
  2⤵
  PID:14452
- C:\Windows\System\biLXOkA.exe
  C:\Windows\System\biLXOkA.exe
  2⤵
  PID:14352
- C:\Windows\System\DXcXzcp.exe
  C:\Windows\System\DXcXzcp.exe
  2⤵
  PID:14624
- C:\Windows\System\ZNLoQiX.exe
  C:\Windows\System\ZNLoQiX.exe
  2⤵
  PID:14764
- C:\Windows\System\IwqjTEa.exe
  C:\Windows\System\IwqjTEa.exe
  2⤵
  PID:15012
- C:\Windows\System\BnORiOv.exe
  C:\Windows\System\BnORiOv.exe
  2⤵
  PID:15088
- C:\Windows\System\IvEiogm.exe
  C:\Windows\System\IvEiogm.exe
  2⤵
  PID:14848
- C:\Windows\System\YeNVByY.exe
  C:\Windows\System\YeNVByY.exe
  2⤵
  PID:14900
- C:\Windows\System\moNPkQH.exe
  C:\Windows\System\moNPkQH.exe
  2⤵
  PID:15248
- C:\Windows\System\vtPUkbo.exe
  C:\Windows\System\vtPUkbo.exe
  2⤵
  PID:15300
- C:\Windows\System\SXBetyW.exe
  C:\Windows\System\SXBetyW.exe
  2⤵
  PID:15076
- C:\Windows\System\qJpRkEM.exe
  C:\Windows\System\qJpRkEM.exe
  2⤵
  PID:13960
- C:\Windows\System\PCCPOfW.exe
  C:\Windows\System\PCCPOfW.exe
  2⤵
  PID:14412
- C:\Windows\System\Czrpyhz.exe
  C:\Windows\System\Czrpyhz.exe
  2⤵
  PID:15224
- C:\Windows\System\Avsgtur.exe
  C:\Windows\System\Avsgtur.exe
  2⤵
  PID:15380
- C:\Windows\System\blgPmyO.exe
  C:\Windows\System\blgPmyO.exe
  2⤵
  PID:15404
- C:\Windows\System\fcxkcjf.exe
  C:\Windows\System\fcxkcjf.exe
  2⤵
  PID:15440
- C:\Windows\System\cbWALZz.exe
  C:\Windows\System\cbWALZz.exe
  2⤵
  PID:15464
- C:\Windows\System\xiyLYju.exe
  C:\Windows\System\xiyLYju.exe
  2⤵
  PID:15480
- C:\Windows\System\KScvTCn.exe
  C:\Windows\System\KScvTCn.exe
  2⤵
  PID:15500
- C:\Windows\System\VxfxJJm.exe
  C:\Windows\System\VxfxJJm.exe
  2⤵
  PID:15532
- C:\Windows\System\mFaJMHl.exe
  C:\Windows\System\mFaJMHl.exe
  2⤵
  PID:15556
- C:\Windows\System\KxQeEXN.exe
  C:\Windows\System\KxQeEXN.exe
  2⤵
  PID:15572
- C:\Windows\System\jzacTXO.exe
  C:\Windows\System\jzacTXO.exe
  2⤵
  PID:15604
- C:\Windows\System\mefybKa.exe
  C:\Windows\System\mefybKa.exe
  2⤵
  PID:15776
- C:\Windows\System\QmGqjbf.exe
  C:\Windows\System\QmGqjbf.exe
  2⤵
  PID:15812
- C:\Windows\System\zJBRxnS.exe
  C:\Windows\System\zJBRxnS.exe
  2⤵
  PID:15852
- C:\Windows\System\DehylYD.exe
  C:\Windows\System\DehylYD.exe
  2⤵
  PID:15868
- C:\Windows\System\ltzVNhr.exe
  C:\Windows\System\ltzVNhr.exe
  2⤵
  PID:15888
- C:\Windows\System\OwIcIhB.exe
  C:\Windows\System\OwIcIhB.exe
  2⤵
  PID:15904
- C:\Windows\System\GpFdTLa.exe
  C:\Windows\System\GpFdTLa.exe
  2⤵
  PID:15920
- C:\Windows\System\jlVdZcO.exe
  C:\Windows\System\jlVdZcO.exe
  2⤵
  PID:15936
- C:\Windows\System\ULOsQMC.exe
  C:\Windows\System\ULOsQMC.exe
  2⤵
  PID:15960
- C:\Windows\System\pSGRZCo.exe
  C:\Windows\System\pSGRZCo.exe
  2⤵
  PID:15976
- C:\Windows\System\RnPWjZj.exe
  C:\Windows\System\RnPWjZj.exe
  2⤵
  PID:15992
- C:\Windows\System\kkixjAH.exe
  C:\Windows\System\kkixjAH.exe
  2⤵
  PID:16008
- C:\Windows\System\twxxSmq.exe
  C:\Windows\System\twxxSmq.exe
  2⤵
  PID:16024
- C:\Windows\System\RXcYopa.exe
  C:\Windows\System\RXcYopa.exe
  2⤵
  PID:16064
- C:\Windows\System\OVULzDW.exe
  C:\Windows\System\OVULzDW.exe
  2⤵
  PID:16080
- C:\Windows\System\YvaaBXI.exe
  C:\Windows\System\YvaaBXI.exe
  2⤵
  PID:16108
- C:\Windows\System\QYwHhQY.exe
  C:\Windows\System\QYwHhQY.exe
  2⤵
  PID:16124
- C:\Windows\System\GAowLmm.exe
  C:\Windows\System\GAowLmm.exe
  2⤵
  PID:16148
- C:\Windows\System\HbilOlE.exe
  C:\Windows\System\HbilOlE.exe
  2⤵
  PID:16168
- C:\Windows\System\QaXovWR.exe
  C:\Windows\System\QaXovWR.exe
  2⤵
  PID:16188
- C:\Windows\System\afjalYl.exe
  C:\Windows\System\afjalYl.exe
  2⤵
  PID:16212
- C:\Windows\System\FRKzFrd.exe
  C:\Windows\System\FRKzFrd.exe
  2⤵
  PID:16232
- C:\Windows\System\DdfMlKC.exe
  C:\Windows\System\DdfMlKC.exe
  2⤵
  PID:16248
- C:\Windows\System\zoMStaC.exe
  C:\Windows\System\zoMStaC.exe
  2⤵
  PID:15112
- C:\Windows\System\CfBvvAT.exe
  C:\Windows\System\CfBvvAT.exe
  2⤵
  PID:15840
- C:\Windows\System\suUtbEm.exe
  C:\Windows\System\suUtbEm.exe
  2⤵
  PID:3544
- C:\Windows\System\mCPwXWP.exe
  C:\Windows\System\mCPwXWP.exe
  2⤵
  PID:15968
- C:\Windows\System\frGhtDz.exe
  C:\Windows\System\frGhtDz.exe
  2⤵
  PID:15784
- C:\Windows\System\pfqhsGy.exe
  C:\Windows\System\pfqhsGy.exe
  2⤵
  PID:16104
- C:\Windows\System\PRdGmfK.exe
  C:\Windows\System\PRdGmfK.exe
  2⤵
  PID:15988
- C:\Windows\System\hpyOCms.exe
  C:\Windows\System\hpyOCms.exe
  2⤵
  PID:16076
- C:\Windows\System\XOUbbgZ.exe
  C:\Windows\System\XOUbbgZ.exe
  2⤵
  PID:16116
- C:\Windows\System\UXDxoYZ.exe
  C:\Windows\System\UXDxoYZ.exe
  2⤵
  PID:16164
- C:\Windows\System\dfCQfFd.exe
  C:\Windows\System\dfCQfFd.exe
  2⤵
  PID:16020
- C:\Windows\System\kSkMESD.exe
  C:\Windows\System\kSkMESD.exe
  2⤵
  PID:16364
- C:\Windows\System\fDQjXQk.exe
  C:\Windows\System\fDQjXQk.exe
  2⤵
  PID:16228
- C:\Windows\System\laDXVDi.exe
  C:\Windows\System\laDXVDi.exe
  2⤵
  PID:14700
- C:\Windows\System\dltkSyX.exe
  C:\Windows\System\dltkSyX.exe
  2⤵
  PID:16320
- C:\Windows\System\MRoxFRP.exe
  C:\Windows\System\MRoxFRP.exe
  2⤵
  PID:14784
- C:\Windows\System\FJozCQC.exe
  C:\Windows\System\FJozCQC.exe
  2⤵
  PID:15516
- C:\Windows\System\vhhQCsG.exe
  C:\Windows\System\vhhQCsG.exe
  2⤵
  PID:15696
- C:\Windows\System\oVfDDEQ.exe
  C:\Windows\System\oVfDDEQ.exe
  2⤵
  PID:14392
- C:\Windows\System\aPseFuM.exe
  C:\Windows\System\aPseFuM.exe
  2⤵
  PID:15616
- C:\Windows\System\TyVqyYD.exe
  C:\Windows\System\TyVqyYD.exe
  2⤵
  PID:15912
- C:\Windows\System\yuquayG.exe
  C:\Windows\System\yuquayG.exe
  2⤵
  PID:16140
- C:\Windows\System\ZcNYMcu.exe
  C:\Windows\System\ZcNYMcu.exe
  2⤵
  PID:16036
- C:\Windows\System\yLQSqPc.exe
  C:\Windows\System\yLQSqPc.exe
  2⤵
  PID:16040
- C:\Windows\System\EIRfQMu.exe
  C:\Windows\System\EIRfQMu.exe
  2⤵
  PID:15016
- C:\Windows\System\TsUOhzw.exe
  C:\Windows\System\TsUOhzw.exe
  2⤵
  PID:16340
- C:\Windows\System\mkkOphq.exe
  C:\Windows\System\mkkOphq.exe
  2⤵
  PID:16144
- C:\Windows\System\EnJeKCi.exe
  C:\Windows\System\EnJeKCi.exe
  2⤵
  PID:16400
- C:\Windows\System\qIzPunE.exe
  C:\Windows\System\qIzPunE.exe
  2⤵
  PID:16428
- C:\Windows\System\WCFAoPv.exe
  C:\Windows\System\WCFAoPv.exe
  2⤵
  PID:16456
- C:\Windows\System\FgbzXsc.exe
  C:\Windows\System\FgbzXsc.exe
  2⤵
  PID:16472
- C:\Windows\System\tdDdetp.exe
  C:\Windows\System\tdDdetp.exe
  2⤵
  PID:16492
- C:\Windows\System\BYpaKJK.exe
  C:\Windows\System\BYpaKJK.exe
  2⤵
  PID:16508
- C:\Windows\System\WsAVSEF.exe
  C:\Windows\System\WsAVSEF.exe
  2⤵
  PID:16524
- C:\Windows\System\jiJhAeV.exe
  C:\Windows\System\jiJhAeV.exe
  2⤵
  PID:16540
- C:\Windows\System\UrTrBOm.exe
  C:\Windows\System\UrTrBOm.exe
  2⤵
  PID:16560
- C:\Windows\System\RYycsZI.exe
  C:\Windows\System\RYycsZI.exe
  2⤵
  PID:16584
- C:\Windows\System\aIHTYpV.exe
  C:\Windows\System\aIHTYpV.exe
  2⤵
  PID:16616
- C:\Windows\System\KvwPdiC.exe
  C:\Windows\System\KvwPdiC.exe
  2⤵
  PID:16644
- C:\Windows\System\bveKkBD.exe
  C:\Windows\System\bveKkBD.exe
  2⤵
  PID:16660
- C:\Windows\System\qmIpvwT.exe
  C:\Windows\System\qmIpvwT.exe
  2⤵
  PID:16676
- C:\Windows\System\DIeJbzN.exe
  C:\Windows\System\DIeJbzN.exe
  2⤵
  PID:16700
- C:\Windows\System\FiXfpuM.exe
  C:\Windows\System\FiXfpuM.exe
  2⤵
  PID:16740
- C:\Windows\System\yeTHANk.exe
  C:\Windows\System\yeTHANk.exe
  2⤵
  PID:16780
- C:\Windows\System\GrUaiIY.exe
  C:\Windows\System\GrUaiIY.exe
  2⤵
  PID:16808
- C:\Windows\System\GORazha.exe
  C:\Windows\System\GORazha.exe
  2⤵
  PID:16828
- C:\Windows\System\EvsZicK.exe
  C:\Windows\System\EvsZicK.exe
  2⤵
  PID:17188
- C:\Windows\System\JWIZnKj.exe
  C:\Windows\System\JWIZnKj.exe
  2⤵
  PID:17248
- C:\Windows\System\uwJIbEe.exe
  C:\Windows\System\uwJIbEe.exe
  2⤵
  PID:17268
- C:\Windows\System\fOYMiay.exe
  C:\Windows\System\fOYMiay.exe
  2⤵
  PID:17404

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:16756

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\AXdPIZr.exe

Filesize
1.8MB

MD5
c8a55be8e27c6c9cc8e62e69542c3762

SHA1
e05f4001aa6b51878e2eba1665abfac0cd41fcc4

SHA256
ddf0ff56da2dfebf742d310186f006582307bf3010e68b3331c53cad165119be

SHA512
fa05243397b03f2fe0fd46b8d07261cf543e912f3a91654eaea33002f8843c8f63b003a222d555ece7e8c99337d2b7282f61fa83dbc99466ddbd55b4f4c7373e

Download Submit
C:\Windows\System\BSbQpHY.exe

Filesize
1.8MB

MD5
24caba7791c5f3b419dc512f4a9be25d

SHA1
24dcebd692de64ff4cfd24153b977464f48c9b4a

SHA256
808a11bfac26d7dbe5a9e31a4fbf2e7fd893ecd6777a70524980be8b54248b90

SHA512
2dc2255d17f8949186c519613a78c80115454a52e75491940c4ae01d42a7d2fb0f2c963dcf10b3211ef7e0e403662a6febbb289965082fe477ddc7e71705317e

Download Submit
C:\Windows\System\DxigmIa.exe

Filesize
1.8MB

MD5
8cd1c450ffdbeb3a941be6882b170f0f

SHA1
66f907ca8191caac1e2d29343f8019bde4956da4

SHA256
48c85683849f23d92e943fb2316d3c3b73ad228b57a6f80123c1a28239653a09

SHA512
87e9ec9cb7d603e9cec826007c8f5011fff4d26331a484a4400b08a6a9b385a8cac7f0ab4a48aae4014ee2a4802b24e5dec0cbe5c7aed0fa9a39482926904780

Download Submit
C:\Windows\System\EKUnpwI.exe

Filesize
1.8MB

MD5
90ba70d2995eb5fc9b75f8fc503cd84e

SHA1
bfa8f48686e76eef9f4f2f3d62be4be280db9e59

SHA256
1f5db6b67f1743aa89b7d940813ddfae7499d3b0a4461c34a7d3477c7e98c9c8

SHA512
266ae4771cd404db3590d62e3d25c9594b6271a78f7f542c58d0b2fae7148b2ef6d27f90e42695c5ec8d599cfbce8acaeb6ecf2b443618a23fb8362cc68223ee

Download Submit
C:\Windows\System\FyxghBG.exe

Filesize
1.8MB

MD5
902a135581ef6ca0e8aa28dce17c6a4f

SHA1
568fcd4ab5370e36eebd2ddffe78aa200b74f782

SHA256
d6db1e5f47038e4d0181415a0e72ad9c34707bf790edd0226d56f462c811eb56

SHA512
ccdea26c8f84cd6bd98196f13c948c80693135331fc8e822553684884cf0e49da25a5b2c769abcd60975bb43f34850bd90237c3cd1280b28afb3256c8e2a80ab

Download Submit
C:\Windows\System\IDCWtwK.exe

Filesize
1.8MB

MD5
d6ff6162711bacad2001d8998935d0ff

SHA1
4fbc62c5cf2d9f9b8009dfdf7d62a829ce91560b

SHA256
7e19ed08de723bb834e08d8c83febdb97be5a2b62fc1517895dd1bca469449c5

SHA512
44550e1080e51079283bafacfc484a107e3abe0a6ab8a2a8a9d0e3739acafa1efb338ce565c5c5369941eff9b3a23f86283eb9a32ad3dd387b571d1cbcb3fbb3

Download Submit
C:\Windows\System\IPEJHpP.exe

Filesize
1.8MB

MD5
6889956b3d44b6bf7a0339da1aacde73

SHA1
aae661ac1a7d2299366a7a838144f4be520762e9

SHA256
8b93429c4661d3142252fd690af23a900b16a930b100f3e3202b92fedfd620a6

SHA512
e879c8c39752c8c477e0ca4d1749ab3c66b1b946159f6d2dca02d2648dc5c2909df54bdb72dbb46896bd7268545d984fa8e59dc4ab42e20b14ec4aa0d289f3a6

Download Submit
C:\Windows\System\LhkRyMn.exe

Filesize
1.8MB

MD5
ac3c58b316438d7ee3e043b5aadff680

SHA1
217f596264f87d55161d53e42155d6e2ff1759d9

SHA256
3743ef74ee2932d954647d03bc0f2ff266a7de5bb839cfe6147a577b75771d9f

SHA512
d09f594e4c8336b466ddd2d5964ac83ef48cd65e894400533227b0fd8004375f129f6532968e52ae9c585c0c6da8087ef4c71886a4c6987c20b559087dbd6ce0

Download Submit
C:\Windows\System\LrJIlZB.exe

Filesize
1.8MB

MD5
91df6818aa4ea39dca4b334aeacaec53

SHA1
585542fa40cc2d95b9958d2ec4dd686d3973b132

SHA256
9feac3d81682d1e6483883da1fd84bd60f22adde98ebb1157e1cbbc5a4acf09e

SHA512
5e9eacc6e8041804f3c1b051ec5ccff8828cb83f5936efb4f4d69018de96b5c5bc2474c1ddd89dcfcdfe84128077133f965c15df2b7edc6c7171e7e21a24266d

Download Submit
C:\Windows\System\MQSYsyW.exe

Filesize
1.8MB

MD5
24785bccfe15150b97ab6be9b21744bb

SHA1
26e6f2bae13ba6f7b76f87b2e1dcd4f62d7c3f8a

SHA256
48a6fb918e4f98ae55f055da9f4f89fbc7e5eb80365da82ba6916d3d266ca24e

SHA512
8807d649ad15a964a28f6eac97f09833aafda08351909d32da998c7af6d9afb95758d406632acaaa4597ef2aaaff71903f59551677f2d998cf27717d65113582

Download Submit
C:\Windows\System\NqWLQrN.exe

Filesize
1.8MB

MD5
d9647ee5788a7fddcc92039bd3afa76d

SHA1
9b4e401f1fc65f4e7c0d6e3eabbf952e1b2b0910

SHA256
028ca6f55423c01a4000daac720ffd0ffd7d91a8b02a160d2fe5e388a549ef0d

SHA512
4170049ec714783d26f24b7b49184a83dd5dc464df267bf8c513fbb9a8554ab58508f9470c4bbef32cf5ae5e5162d211208d8b2702ca19d8f6ea7ca006168135

Download Submit
C:\Windows\System\OOlWHxw.exe

Filesize
1.8MB

MD5
b4fd4b4ed7b664558cbacf671e9d20a3

SHA1
5846075e13f5b6ff990d2c34464defc3adf3b275

SHA256
facd7760945a384301150470779414b4ba8c7989243ee0ee109b07c63deb4047

SHA512
182b378ff2705723556a51fd027e396084214b16ed45215adbcd8467c191e95b5146100cca1262daa50da8ffed756e1fb3b3f895539cd50017b184737dcca470

Download Submit
C:\Windows\System\OZpBnBG.exe

Filesize
1.8MB

MD5
1871c064fcba5df3dfc5e878d01db2a8

SHA1
163ca2dd74b9ce97d65e3067cd531d4eab6d0f52

SHA256
091ac64b6d1890f1930f1c67fd198d0a65b8a088daa90d33d0ccd24de57df3e3

SHA512
1ac8dc6f4087e288128c800d0e6f3d869973f744b75d65cf1a2f8675ab0f07679ea2d0e0b5e12931c67b6c24eb4e7d6bc0b272738302c01e804191fc2de9bf1e

Download Submit
C:\Windows\System\RYvFGND.exe

Filesize
1.8MB

MD5
a0e398e46204b39c981780ae43c7b22e

SHA1
771417867dac5aac7f678569073c48b079a068e5

SHA256
85ba171fdc33ac84a4d27de558ea40245abc49a4340e5d1825231ac884b54f9b

SHA512
2cf774ada33cef45f75673c652f695713c5c3b77ba610cbe5d89b2f73bdaa2db19c2e3c18ac84ef7f1fa993c6a276eec35037caa50b18625636f31d2e46ddca9

Download Submit
C:\Windows\System\XcLuqBy.exe

Filesize
1.8MB

MD5
19db4b0cbca03149c9a59e41b1686e05

SHA1
135d5599a9ac1f761313cd366cdce3f27e0b1705

SHA256
b40c69ebc0bf4def7896a0ab012ac52fba1cefd7c9ac2906257ebaf5d8564bac

SHA512
3bddb42e2bfee9728949c97c022da9209ecb7bdae843e0ce675587dcfecda6b662b5b15ed19d3ed5a2ca737bf09e7c55284d30faa86dcba60e79503f98ec707f

Download Submit
C:\Windows\System\ZkJUGYs.exe

Filesize
1.8MB

MD5
b82d4210c03cb20a4fb2e115f8df27c2

SHA1
34f10b8269f5aec97af27dd9392c7e5236798caf

SHA256
aa10e6d050991a5e5ca604c044e10341cd31892e0e6d33d927039ce00608a983

SHA512
d34aa577874205162bdb722d44f0ca1c297d35c77ccaa33e3db61ef8ba31424324d53bc25e028b2b0e88dc8236a9b56b8bb5bc442033a0d3916edb2237a090e1

Download Submit
C:\Windows\System\aBqYIJb.exe

Filesize
1.8MB

MD5
f4f66cdf2767bce398fa5bcbdf5693e7

SHA1
0e4a83e841084ee6bbfb5e3595f631258c0ebb50

SHA256
9d265f7642892fb7b2062e22a8e9bcc6d1802bab73a0ee989f233bacab4f1ef6

SHA512
566cbcdba298ff928fa91d5a11342cd8219efab2a6bb1a5749e1da7a05967a71e5441d6ff83d381cfc35df0123d6f898b858ef5edab05a08f5fc1c9bc1b5e340

Download Submit
C:\Windows\System\cLYLpau.exe

Filesize
1.8MB

MD5
c30aa2df93023fc0b119eff587a3782b

SHA1
ea8c7ebb0af1dba6ebc92f002f6ae80d6460c09d

SHA256
2d005230fc66bfef89fc0192ef43ca68af98cee731997de7da5164e11ded27a8

SHA512
91739a294d4b2145df1cafa43619788bb084900190a434e4ab3963d6fee206ceb790c58320edaaf4850fa02a21362eeaa8391b7f378791027c17607b0ef58a02

Download Submit
C:\Windows\System\dPmNJvv.exe

Filesize
1.8MB

MD5
c61dcdabb5622aaad11fc255a0a40f7e

SHA1
317e8497bb02855c155591a3d9a472aaff6424c9

SHA256
83af330013db8f2eb84eece485c5b0ac68706c68fe7b7edf84e123a415f4f068

SHA512
996e8a73ab99ae64b57659c44da86274aab0e2f841320afe70581aaf5fde750e21ea0ed62bd354041e7a8c37e7a0e1a49a3eabd093399bcd9d1134ccd5fb2fee

Download Submit
C:\Windows\System\fThdhQI.exe

Filesize
1.8MB

MD5
a63ac9cc56d2c7d589b8b137a49210c4

SHA1
c88304309fdfac931ef3b9e47fae7e6887abc8d1

SHA256
03399bed709e77befa748218c3cf8e53720314d4ccec1710e059463fb527df2a

SHA512
f1d8453f099fc65d060da974cd751d2942a92552bc72d1d642538188798d308291a0a18c9dedefd19584018d7f5a712b3d957d7682ef2c367e7790cec2f88d91

Download Submit
C:\Windows\System\hSsxqGM.exe

Filesize
1.8MB

MD5
393b36a57b3847ba6bf5cacb8d1d6c70

SHA1
4d37e322ab7a237aa137331703986df89a58256a

SHA256
e7b50a5e82548c029915163701ff7ee3b58601f3ec3c656461c3b765cdd6cf2e

SHA512
3e87e9c406989dcec7998137a7152dd37c5cbed5fcd4660523c19e8d464761c10b073fbc10ea500eb4afbae09b6709fd19abce7e73057b4844db039a93d2a228

Download Submit
C:\Windows\System\hjxfmOJ.exe

Filesize
1.8MB

MD5
03582b6adcdf07cefb53af5e3d78bb03

SHA1
27b7278924f150f4ec00b417c1f5cb8f2bfde8ba

SHA256
2718dde90311de7375708895b95d5bf550907232fa8860e95c42df7652b7034e

SHA512
9170bd45f2ad766478be4dd36233e8f334f01e7123ac8481f18aa129eb65c72f01d9d69f5a53dc2226e8ec3bb049bedd9159733b710f416165fb9b2f94b108ec

Download Submit
C:\Windows\System\hvFBhdW.exe

Filesize
1.8MB

MD5
ef03184db09f13eca7b9286535ac6cde

SHA1
75a70e4076fd4568ce44ec8aaf3e1c163969168a

SHA256
c0ab3e3d6f285637aaca8eb0c21265a8cbb0d2a2c09bb777e31b6cda23556963

SHA512
b5d92614403d10cfa76ad5e25300d1fc3b2b52177d237e50ed60c26d5beb4cf935121d4c437329b7190cf01bf6d5f8bf8baa31c92820096067b232f5198c1fde

Download Submit
C:\Windows\System\ijYakPm.exe

Filesize
1.8MB

MD5
da6d3ceb614254088f7c0430ad577269

SHA1
289e804721d25c38c667ef89c6d180f5937a8ba3

SHA256
010d2cab527828650833fd4d9d8eede107732ab055493572372268f436a4f90f

SHA512
848e02c4a342d66042a35358f516e2a12fc2a92546cbb44af46374ea5f3cdd74c85f06467ab16e4d4c7e58ab0342fbb062ef220a0bdd574518241bf853ac5867

Download Submit
C:\Windows\System\jkWYVJr.exe

Filesize
1.8MB

MD5
8a9882a626f1b3ae51f4052c61e9c34e

SHA1
ce93b537dcca128329764856c1a1c80a1ec8774c

SHA256
a606b024d7e763d8351b4d4c0ea194d2149ae0758486edcb0e563a2878b36f23

SHA512
9000bc76938fcaf3d78fd6965db54ca24916042e3a97353242676109d2743628ae00593603c00a81875c9b769b5ae64c63b986cc910069731874c8b6dd864ac8

Download Submit
C:\Windows\System\kAkQhYa.exe

Filesize
1.8MB

MD5
a64ea72ee61e0d0d9883437582aeaece

SHA1
0c0a67b34636e24b7f90c226f334b740fca5df3a

SHA256
00b81fdb6eb7f8a487daff8494850dce9232469c0b7cc87ef10d8c364c0cc9a2

SHA512
e336a7a809f3c89d526b3f9e461c51f5feef04664f2bb5c9e354f6150f58996952f687bdfda11921b27cb952fbf6c3af626f3d2dc836132b33cf3d54f0675f35

Download Submit
C:\Windows\System\mjMQZnK.exe

Filesize
1.8MB

MD5
5795902346b9b355f6289070390b9129

SHA1
79216202b55fe8c677ed37bdb4c8b6919e0ba21b

SHA256
5fa1eebc1263a35d5ca6d5c7da05c3d3b7dc32364de0ec6a00cacaa83356b836

SHA512
e3141177800ea7ab96f8569ebda0126e811dd90fe758b24011c3d19c84c384d29ac7ab5dcfeaa33d37929ac816557d3d55e3ebacab054016860e0345732b695f

Download Submit
C:\Windows\System\qODJMWy.exe

Filesize
1.8MB

MD5
75ae42caa38351ab5adfb89bf9e3713b

SHA1
0599c3064be04e7b2bef127e7232099fcc46f53e

SHA256
2ba6618c0b2cfa84dedf2edffbb05976a7431b77ee1cfd8cfe19c4b30323a90c

SHA512
eb0f61d267036ba6762997704136b97d20d4f66b76214455fb7a044332a161a03db457b21cfa4e6bf2b0edd67e7e1c9ed263d6bdaf191cd4bd34348e84ed9990

Download Submit
C:\Windows\System\rkCcseP.exe

Filesize
1.8MB

MD5
c3879609fbd8a66935da47d0c37408e5

SHA1
05bfee1b493119222952b8b9e626e172796b869c

SHA256
2fd627a063fb64bab7a65e826b50a6e0512390ab767bb30c6666f6c0387b8236

SHA512
bc30a387725b3f1464a15dd9fcc58815871b820cfd486e9b203536cb6280aaece8d75ba4f5c275fb8cb3f02a29858ec77fa97188d05cb3c578ef617d48716c08

Download Submit
C:\Windows\System\sJIinun.exe

Filesize
1.8MB

MD5
6812bb508f04e76e29267d3aa059ea52

SHA1
5847fc75dc68735a4b07029d9d775e0ca84d6487

SHA256
03bac95a61f91c203aada4923c7ab9cb622f54000af4f24fcfe9c4835c4ac081

SHA512
b9a20c1203b2c2e02953692f190c75b3c907c7983c2e2269cb19141e26dfdd9b3a2bd2b70eb357efc4c158215d9d4f09448666341b3df522d288a150d94a69a3

Download Submit
C:\Windows\System\urihFuJ.exe

Filesize
1.8MB

MD5
385f42c1df6bc806e6581c6ea84bec8a

SHA1
25fbcfb7df45991a1bca1a3317cb55c9e199ea9b

SHA256
54cd364e7454a0eb1fbdfe88a32679fe442d4c036d10ae1c0346dde8dfaa6657

SHA512
c96f8dec4a1822ca86834ca5ba38a635d8123244364580553145f7ec6cdb8d3dca0c65b59090f4a5071c324fcdc8e4f426014214397f631e06913308d7de35a2

Download Submit
C:\Windows\System\xDawisz.exe

Filesize
1.8MB

MD5
a37ed39b66d1bdb8674a8c2819ef4ddf

SHA1
d9a38ac6f8092002f009a6f787922be8f2cb30a6

SHA256
7cdc9116fdc60ea034364a4673c2eb63b287c7dd456b9c6f74bf1d2bf0a76628

SHA512
a7bdd50412841e863588effb33669ddec73cd4329719635c45c35ca95b91f4c4e5d08bc64abb00e72545b7b6f76cbf4604a333cb0a575c1dcd7d016e9f9e749a

Download Submit
C:\Windows\System\zDpppcB.exe

Filesize
1.8MB

MD5
803458e4740badc3f78423809b42f0ab

SHA1
993fc0d311d93b10be8cc69bb22010f139c118fa

SHA256
ccb9011f42c6575f0225563532b48d848c27b4fd6eb4d0b9f6fa218e3151f251

SHA512
c055dd0ed3a2743688f192ed93892fc07017356902bf24a1f179e3847d369a5db1dc1d74e8efeb470e844fdaf546c07b7350b6a734ba954875b716bca229b8bb

Download Submit
memory/536-0-0x0000019E62B90000-0x0000019E62BA0000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads