xmrig | 146c70b3373da41d14c6e640f31d1d1d403eecdef66a21bd4de64ad78a033cd5

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
23-12-2024 19:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

146c70b3373da41d14c6e640f31d1d1d403eecdef66a21bd4de64ad78a033cd5.exe
Size

1.5MB
MD5

9d70002ab79b1c6c3166ccb38c4f9ad9
SHA1

212181f25f6fcb20c8823f2a9545d09b0583e77b
SHA256

146c70b3373da41d14c6e640f31d1d1d403eecdef66a21bd4de64ad78a033cd5
SHA512

e5c686d2dc0958d551d656a16a89be64aa6a4a478d3104f212fbddd05f8937e5b4de1ef8fda5ea36dff5bdb66d1eecfba37731dcfbb972fd868a71f37ee0f97c
SSDEEP

24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbpwlKenszbWKDNEm/5pbkTPLwann:GezaTF8FcNkNdfE0pZ9ozttwIRxeEah1

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 36 IoCs

miner

resource	yara_rule
behavioral2/files/0x000c000000023b17-4.dat	xmrig
behavioral2/files/0x000a000000023b7a-7.dat	xmrig
behavioral2/files/0x000b000000023b76-9.dat	xmrig
behavioral2/files/0x000a000000023b7b-19.dat	xmrig
behavioral2/files/0x000a000000023b7c-24.dat	xmrig
behavioral2/files/0x000a000000023b7e-32.dat	xmrig
behavioral2/files/0x000a000000023b7d-33.dat	xmrig
behavioral2/files/0x000a000000023b81-43.dat	xmrig
behavioral2/files/0x000a000000023b7f-59.dat	xmrig
behavioral2/files/0x000a000000023b87-71.dat	xmrig
behavioral2/files/0x000a000000023b84-79.dat	xmrig
behavioral2/files/0x000a000000023b88-95.dat	xmrig
behavioral2/files/0x000a000000023b8a-109.dat	xmrig
behavioral2/files/0x000b000000023b92-128.dat	xmrig
behavioral2/files/0x000a000000023b9c-148.dat	xmrig
behavioral2/files/0x000b000000023b93-166.dat	xmrig
behavioral2/files/0x0008000000023bb9-165.dat	xmrig
behavioral2/files/0x000e000000023bb7-164.dat	xmrig
behavioral2/files/0x0009000000023bb3-161.dat	xmrig
behavioral2/files/0x0009000000023bb2-160.dat	xmrig
behavioral2/files/0x0009000000023bb1-159.dat	xmrig
behavioral2/files/0x0008000000023bac-158.dat	xmrig
behavioral2/files/0x000e000000023ba3-151.dat	xmrig
behavioral2/files/0x000a000000023b90-139.dat	xmrig
behavioral2/files/0x000b000000023b94-136.dat	xmrig
behavioral2/files/0x000a000000023b8f-119.dat	xmrig
behavioral2/files/0x000a000000023b8e-117.dat	xmrig
behavioral2/files/0x000a000000023b8d-115.dat	xmrig
behavioral2/files/0x000a000000023b8c-113.dat	xmrig
behavioral2/files/0x000a000000023b8b-111.dat	xmrig
behavioral2/files/0x000a000000023b89-107.dat	xmrig
behavioral2/files/0x000a000000023b86-90.dat	xmrig
behavioral2/files/0x000a000000023b85-80.dat	xmrig
behavioral2/files/0x000a000000023b82-73.dat	xmrig
behavioral2/files/0x000a000000023b83-75.dat	xmrig
behavioral2/files/0x000a000000023b80-50.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2976	GXtPNUc.exe
2796	EFFdzOM.exe
64	XAHIJFF.exe
2264	msOjfyD.exe
744	WKcPEbg.exe
3216	sAqEQkt.exe
2984	ujJQFKJ.exe
4296	SAUgcAB.exe
1820	NRPfMkr.exe
3608	kjTOJZF.exe
1880	MpiCEIa.exe
4044	tuJsbfL.exe
5060	sVlIAjG.exe
2256	XQFSGzJ.exe
3940	abHgZqL.exe
4616	kyYQnuC.exe
3532	NdivCWF.exe
752	pWYHYvf.exe
1584	XbBxrNZ.exe
436	qxnNAPQ.exe
3752	FKeOZDN.exe
4320	lvVnmkV.exe
3416	DcxdtSX.exe
4348	UIAAVlf.exe
1776	nqJLsPG.exe
1524	JHPNjle.exe
1548	KXQcNkR.exe
2960	SkznoUI.exe
3892	RQciVLf.exe
3248	FGuxvSD.exe
3388	wQQCwGT.exe
2996	QHWWGaA.exe
4900	whDvDRk.exe
760	qxDXkFj.exe
2400	idOTMLB.exe
2988	KevbjJE.exe
4324	KEUouQp.exe
4088	eGXeKEE.exe
2496	jxSgbuU.exe
2908	IPnirNT.exe
1252	FGKMVMG.exe
3632	bXSfcqs.exe
4276	bIsmtQo.exe
944	QcWBGYf.exe
2536	yFzKDrn.exe
4048	dRyyUvZ.exe
4444	qbpRFNu.exe
3848	AAkhMRs.exe
2012	lUtenRU.exe
3104	qohmhEt.exe
1068	bGxKgOt.exe
4652	xNJQARi.exe
2576	ozuqQEI.exe
3324	xDfEzNk.exe
940	ElbajiP.exe
3220	LREBQzM.exe
4716	SyPeARS.exe
2168	WLxmitY.exe
3828	fcwlJed.exe
3092	iAvneMK.exe
4400	GpVxgMn.exe
2216	pCctNJT.exe
4952	iBrqvbq.exe
4416	blxuzBE.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\JHPNjle.exe	146c70b3373da41d14c6e640f31d1d1d403eecdef66a21bd4de64ad78a033cd5.exe
File created	C:\Windows\System\CPbiTKy.exe	146c70b3373da41d14c6e640f31d1d1d403eecdef66a21bd4de64ad78a033cd5.exe
File created	C:\Windows\System\OwjaolP.exe	146c70b3373da41d14c6e640f31d1d1d403eecdef66a21bd4de64ad78a033cd5.exe
File created	C:\Windows\System\QNzrjAL.exe	146c70b3373da41d14c6e640f31d1d1d403eecdef66a21bd4de64ad78a033cd5.exe
File created	C:\Windows\System\BmAsDSD.exe	146c70b3373da41d14c6e640f31d1d1d403eecdef66a21bd4de64ad78a033cd5.exe
File created	C:\Windows\System\CFmxGHf.exe	146c70b3373da41d14c6e640f31d1d1d403eecdef66a21bd4de64ad78a033cd5.exe
File created	C:\Windows\System\pWYHYvf.exe	146c70b3373da41d14c6e640f31d1d1d403eecdef66a21bd4de64ad78a033cd5.exe
File created	C:\Windows\System\ommnULG.exe	146c70b3373da41d14c6e640f31d1d1d403eecdef66a21bd4de64ad78a033cd5.exe
File created	C:\Windows\System\cavrQzP.exe	146c70b3373da41d14c6e640f31d1d1d403eecdef66a21bd4de64ad78a033cd5.exe
File created	C:\Windows\System\ELUftYF.exe	146c70b3373da41d14c6e640f31d1d1d403eecdef66a21bd4de64ad78a033cd5.exe
File created	C:\Windows\System\HyDtoWz.exe	146c70b3373da41d14c6e640f31d1d1d403eecdef66a21bd4de64ad78a033cd5.exe
File created	C:\Windows\System\JOCOotM.exe	146c70b3373da41d14c6e640f31d1d1d403eecdef66a21bd4de64ad78a033cd5.exe
File created	C:\Windows\System\cfwfdrN.exe	146c70b3373da41d14c6e640f31d1d1d403eecdef66a21bd4de64ad78a033cd5.exe
File created	C:\Windows\System\CxsSSTr.exe	146c70b3373da41d14c6e640f31d1d1d403eecdef66a21bd4de64ad78a033cd5.exe
File created	C:\Windows\System\Eiwagvh.exe	146c70b3373da41d14c6e640f31d1d1d403eecdef66a21bd4de64ad78a033cd5.exe
File created	C:\Windows\System\wDnnwQl.exe	146c70b3373da41d14c6e640f31d1d1d403eecdef66a21bd4de64ad78a033cd5.exe
File created	C:\Windows\System\tuJsbfL.exe	146c70b3373da41d14c6e640f31d1d1d403eecdef66a21bd4de64ad78a033cd5.exe
File created	C:\Windows\System\aoooHpo.exe	146c70b3373da41d14c6e640f31d1d1d403eecdef66a21bd4de64ad78a033cd5.exe
File created	C:\Windows\System\sVlIAjG.exe	146c70b3373da41d14c6e640f31d1d1d403eecdef66a21bd4de64ad78a033cd5.exe
File created	C:\Windows\System\qICOWdQ.exe	146c70b3373da41d14c6e640f31d1d1d403eecdef66a21bd4de64ad78a033cd5.exe
File created	C:\Windows\System\OwfbaDg.exe	146c70b3373da41d14c6e640f31d1d1d403eecdef66a21bd4de64ad78a033cd5.exe
File created	C:\Windows\System\AZflPUB.exe	146c70b3373da41d14c6e640f31d1d1d403eecdef66a21bd4de64ad78a033cd5.exe
File created	C:\Windows\System\btVwgVU.exe	146c70b3373da41d14c6e640f31d1d1d403eecdef66a21bd4de64ad78a033cd5.exe
File created	C:\Windows\System\uGvFkSQ.exe	146c70b3373da41d14c6e640f31d1d1d403eecdef66a21bd4de64ad78a033cd5.exe
File created	C:\Windows\System\QhXgjpv.exe	146c70b3373da41d14c6e640f31d1d1d403eecdef66a21bd4de64ad78a033cd5.exe
File created	C:\Windows\System\OvQfCOM.exe	146c70b3373da41d14c6e640f31d1d1d403eecdef66a21bd4de64ad78a033cd5.exe
File created	C:\Windows\System\VNvTEks.exe	146c70b3373da41d14c6e640f31d1d1d403eecdef66a21bd4de64ad78a033cd5.exe
File created	C:\Windows\System\MlvBxLO.exe	146c70b3373da41d14c6e640f31d1d1d403eecdef66a21bd4de64ad78a033cd5.exe
File created	C:\Windows\System\RpFKhnC.exe	146c70b3373da41d14c6e640f31d1d1d403eecdef66a21bd4de64ad78a033cd5.exe
File created	C:\Windows\System\oGsqXsm.exe	146c70b3373da41d14c6e640f31d1d1d403eecdef66a21bd4de64ad78a033cd5.exe
File created	C:\Windows\System\ERERnml.exe	146c70b3373da41d14c6e640f31d1d1d403eecdef66a21bd4de64ad78a033cd5.exe
File created	C:\Windows\System\bLywAmf.exe	146c70b3373da41d14c6e640f31d1d1d403eecdef66a21bd4de64ad78a033cd5.exe
File created	C:\Windows\System\wXCgHZb.exe	146c70b3373da41d14c6e640f31d1d1d403eecdef66a21bd4de64ad78a033cd5.exe
File created	C:\Windows\System\BObPhvT.exe	146c70b3373da41d14c6e640f31d1d1d403eecdef66a21bd4de64ad78a033cd5.exe
File created	C:\Windows\System\OOclqnk.exe	146c70b3373da41d14c6e640f31d1d1d403eecdef66a21bd4de64ad78a033cd5.exe
File created	C:\Windows\System\XvmVoop.exe	146c70b3373da41d14c6e640f31d1d1d403eecdef66a21bd4de64ad78a033cd5.exe
File created	C:\Windows\System\NDKvVnH.exe	146c70b3373da41d14c6e640f31d1d1d403eecdef66a21bd4de64ad78a033cd5.exe
File created	C:\Windows\System\TmcGRCd.exe	146c70b3373da41d14c6e640f31d1d1d403eecdef66a21bd4de64ad78a033cd5.exe
File created	C:\Windows\System\whDvDRk.exe	146c70b3373da41d14c6e640f31d1d1d403eecdef66a21bd4de64ad78a033cd5.exe
File created	C:\Windows\System\XbBxrNZ.exe	146c70b3373da41d14c6e640f31d1d1d403eecdef66a21bd4de64ad78a033cd5.exe
File created	C:\Windows\System\qyrPvlF.exe	146c70b3373da41d14c6e640f31d1d1d403eecdef66a21bd4de64ad78a033cd5.exe
File created	C:\Windows\System\aAvUxJh.exe	146c70b3373da41d14c6e640f31d1d1d403eecdef66a21bd4de64ad78a033cd5.exe
File created	C:\Windows\System\pBHjmSZ.exe	146c70b3373da41d14c6e640f31d1d1d403eecdef66a21bd4de64ad78a033cd5.exe
File created	C:\Windows\System\XOZBYlg.exe	146c70b3373da41d14c6e640f31d1d1d403eecdef66a21bd4de64ad78a033cd5.exe
File created	C:\Windows\System\lsvajrK.exe	146c70b3373da41d14c6e640f31d1d1d403eecdef66a21bd4de64ad78a033cd5.exe
File created	C:\Windows\System\ihLgZrs.exe	146c70b3373da41d14c6e640f31d1d1d403eecdef66a21bd4de64ad78a033cd5.exe
File created	C:\Windows\System\PFFHfxy.exe	146c70b3373da41d14c6e640f31d1d1d403eecdef66a21bd4de64ad78a033cd5.exe
File created	C:\Windows\System\fgvflsQ.exe	146c70b3373da41d14c6e640f31d1d1d403eecdef66a21bd4de64ad78a033cd5.exe
File created	C:\Windows\System\mMcgARz.exe	146c70b3373da41d14c6e640f31d1d1d403eecdef66a21bd4de64ad78a033cd5.exe
File created	C:\Windows\System\ylELDVO.exe	146c70b3373da41d14c6e640f31d1d1d403eecdef66a21bd4de64ad78a033cd5.exe
File created	C:\Windows\System\oJsCZIm.exe	146c70b3373da41d14c6e640f31d1d1d403eecdef66a21bd4de64ad78a033cd5.exe
File created	C:\Windows\System\NpfvRCs.exe	146c70b3373da41d14c6e640f31d1d1d403eecdef66a21bd4de64ad78a033cd5.exe
File created	C:\Windows\System\AnoWwJd.exe	146c70b3373da41d14c6e640f31d1d1d403eecdef66a21bd4de64ad78a033cd5.exe
File created	C:\Windows\System\DVdFsMD.exe	146c70b3373da41d14c6e640f31d1d1d403eecdef66a21bd4de64ad78a033cd5.exe
File created	C:\Windows\System\AAkhMRs.exe	146c70b3373da41d14c6e640f31d1d1d403eecdef66a21bd4de64ad78a033cd5.exe
File created	C:\Windows\System\xQcaFqM.exe	146c70b3373da41d14c6e640f31d1d1d403eecdef66a21bd4de64ad78a033cd5.exe
File created	C:\Windows\System\FseqazM.exe	146c70b3373da41d14c6e640f31d1d1d403eecdef66a21bd4de64ad78a033cd5.exe
File created	C:\Windows\System\EDwTRYM.exe	146c70b3373da41d14c6e640f31d1d1d403eecdef66a21bd4de64ad78a033cd5.exe
File created	C:\Windows\System\ijRNykC.exe	146c70b3373da41d14c6e640f31d1d1d403eecdef66a21bd4de64ad78a033cd5.exe
File created	C:\Windows\System\xROQUCV.exe	146c70b3373da41d14c6e640f31d1d1d403eecdef66a21bd4de64ad78a033cd5.exe
File created	C:\Windows\System\JGbqcau.exe	146c70b3373da41d14c6e640f31d1d1d403eecdef66a21bd4de64ad78a033cd5.exe
File created	C:\Windows\System\kjTOJZF.exe	146c70b3373da41d14c6e640f31d1d1d403eecdef66a21bd4de64ad78a033cd5.exe
File created	C:\Windows\System\RSTVLAT.exe	146c70b3373da41d14c6e640f31d1d1d403eecdef66a21bd4de64ad78a033cd5.exe
File created	C:\Windows\System\IORJGqx.exe	146c70b3373da41d14c6e640f31d1d1d403eecdef66a21bd4de64ad78a033cd5.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	15700	dwm.exe
Token: SeChangeNotifyPrivilege	15700	dwm.exe
Token: 33	15700	dwm.exe
Token: SeIncBasePriorityPrivilege	15700	dwm.exe
Token: SeShutdownPrivilege	15700	dwm.exe
Token: SeCreatePagefilePrivilege	15700	dwm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1408 wrote to memory of 2976	1408	146c70b3373da41d14c6e640f31d1d1d403eecdef66a21bd4de64ad78a033cd5.exe	86
PID 1408 wrote to memory of 2976	1408	146c70b3373da41d14c6e640f31d1d1d403eecdef66a21bd4de64ad78a033cd5.exe	86
PID 1408 wrote to memory of 2796	1408	146c70b3373da41d14c6e640f31d1d1d403eecdef66a21bd4de64ad78a033cd5.exe	87
PID 1408 wrote to memory of 2796	1408	146c70b3373da41d14c6e640f31d1d1d403eecdef66a21bd4de64ad78a033cd5.exe	87
PID 1408 wrote to memory of 64	1408	146c70b3373da41d14c6e640f31d1d1d403eecdef66a21bd4de64ad78a033cd5.exe	88
PID 1408 wrote to memory of 64	1408	146c70b3373da41d14c6e640f31d1d1d403eecdef66a21bd4de64ad78a033cd5.exe	88
PID 1408 wrote to memory of 2264	1408	146c70b3373da41d14c6e640f31d1d1d403eecdef66a21bd4de64ad78a033cd5.exe	89
PID 1408 wrote to memory of 2264	1408	146c70b3373da41d14c6e640f31d1d1d403eecdef66a21bd4de64ad78a033cd5.exe	89
PID 1408 wrote to memory of 744	1408	146c70b3373da41d14c6e640f31d1d1d403eecdef66a21bd4de64ad78a033cd5.exe	90
PID 1408 wrote to memory of 744	1408	146c70b3373da41d14c6e640f31d1d1d403eecdef66a21bd4de64ad78a033cd5.exe	90
PID 1408 wrote to memory of 3216	1408	146c70b3373da41d14c6e640f31d1d1d403eecdef66a21bd4de64ad78a033cd5.exe	91
PID 1408 wrote to memory of 3216	1408	146c70b3373da41d14c6e640f31d1d1d403eecdef66a21bd4de64ad78a033cd5.exe	91
PID 1408 wrote to memory of 2984	1408	146c70b3373da41d14c6e640f31d1d1d403eecdef66a21bd4de64ad78a033cd5.exe	92
PID 1408 wrote to memory of 2984	1408	146c70b3373da41d14c6e640f31d1d1d403eecdef66a21bd4de64ad78a033cd5.exe	92
PID 1408 wrote to memory of 3608	1408	146c70b3373da41d14c6e640f31d1d1d403eecdef66a21bd4de64ad78a033cd5.exe	93
PID 1408 wrote to memory of 3608	1408	146c70b3373da41d14c6e640f31d1d1d403eecdef66a21bd4de64ad78a033cd5.exe	93
PID 1408 wrote to memory of 4296	1408	146c70b3373da41d14c6e640f31d1d1d403eecdef66a21bd4de64ad78a033cd5.exe	94
PID 1408 wrote to memory of 4296	1408	146c70b3373da41d14c6e640f31d1d1d403eecdef66a21bd4de64ad78a033cd5.exe	94
PID 1408 wrote to memory of 1820	1408	146c70b3373da41d14c6e640f31d1d1d403eecdef66a21bd4de64ad78a033cd5.exe	95
PID 1408 wrote to memory of 1820	1408	146c70b3373da41d14c6e640f31d1d1d403eecdef66a21bd4de64ad78a033cd5.exe	95
PID 1408 wrote to memory of 1880	1408	146c70b3373da41d14c6e640f31d1d1d403eecdef66a21bd4de64ad78a033cd5.exe	96
PID 1408 wrote to memory of 1880	1408	146c70b3373da41d14c6e640f31d1d1d403eecdef66a21bd4de64ad78a033cd5.exe	96
PID 1408 wrote to memory of 4044	1408	146c70b3373da41d14c6e640f31d1d1d403eecdef66a21bd4de64ad78a033cd5.exe	97
PID 1408 wrote to memory of 4044	1408	146c70b3373da41d14c6e640f31d1d1d403eecdef66a21bd4de64ad78a033cd5.exe	97
PID 1408 wrote to memory of 5060	1408	146c70b3373da41d14c6e640f31d1d1d403eecdef66a21bd4de64ad78a033cd5.exe	98
PID 1408 wrote to memory of 5060	1408	146c70b3373da41d14c6e640f31d1d1d403eecdef66a21bd4de64ad78a033cd5.exe	98
PID 1408 wrote to memory of 2256	1408	146c70b3373da41d14c6e640f31d1d1d403eecdef66a21bd4de64ad78a033cd5.exe	99
PID 1408 wrote to memory of 2256	1408	146c70b3373da41d14c6e640f31d1d1d403eecdef66a21bd4de64ad78a033cd5.exe	99
PID 1408 wrote to memory of 3940	1408	146c70b3373da41d14c6e640f31d1d1d403eecdef66a21bd4de64ad78a033cd5.exe	100
PID 1408 wrote to memory of 3940	1408	146c70b3373da41d14c6e640f31d1d1d403eecdef66a21bd4de64ad78a033cd5.exe	100
PID 1408 wrote to memory of 4616	1408	146c70b3373da41d14c6e640f31d1d1d403eecdef66a21bd4de64ad78a033cd5.exe	101
PID 1408 wrote to memory of 4616	1408	146c70b3373da41d14c6e640f31d1d1d403eecdef66a21bd4de64ad78a033cd5.exe	101
PID 1408 wrote to memory of 3532	1408	146c70b3373da41d14c6e640f31d1d1d403eecdef66a21bd4de64ad78a033cd5.exe	102
PID 1408 wrote to memory of 3532	1408	146c70b3373da41d14c6e640f31d1d1d403eecdef66a21bd4de64ad78a033cd5.exe	102
PID 1408 wrote to memory of 752	1408	146c70b3373da41d14c6e640f31d1d1d403eecdef66a21bd4de64ad78a033cd5.exe	103
PID 1408 wrote to memory of 752	1408	146c70b3373da41d14c6e640f31d1d1d403eecdef66a21bd4de64ad78a033cd5.exe	103
PID 1408 wrote to memory of 1584	1408	146c70b3373da41d14c6e640f31d1d1d403eecdef66a21bd4de64ad78a033cd5.exe	104
PID 1408 wrote to memory of 1584	1408	146c70b3373da41d14c6e640f31d1d1d403eecdef66a21bd4de64ad78a033cd5.exe	104
PID 1408 wrote to memory of 436	1408	146c70b3373da41d14c6e640f31d1d1d403eecdef66a21bd4de64ad78a033cd5.exe	105
PID 1408 wrote to memory of 436	1408	146c70b3373da41d14c6e640f31d1d1d403eecdef66a21bd4de64ad78a033cd5.exe	105
PID 1408 wrote to memory of 3752	1408	146c70b3373da41d14c6e640f31d1d1d403eecdef66a21bd4de64ad78a033cd5.exe	106
PID 1408 wrote to memory of 3752	1408	146c70b3373da41d14c6e640f31d1d1d403eecdef66a21bd4de64ad78a033cd5.exe	106
PID 1408 wrote to memory of 4320	1408	146c70b3373da41d14c6e640f31d1d1d403eecdef66a21bd4de64ad78a033cd5.exe	107
PID 1408 wrote to memory of 4320	1408	146c70b3373da41d14c6e640f31d1d1d403eecdef66a21bd4de64ad78a033cd5.exe	107
PID 1408 wrote to memory of 3416	1408	146c70b3373da41d14c6e640f31d1d1d403eecdef66a21bd4de64ad78a033cd5.exe	108
PID 1408 wrote to memory of 3416	1408	146c70b3373da41d14c6e640f31d1d1d403eecdef66a21bd4de64ad78a033cd5.exe	108
PID 1408 wrote to memory of 4348	1408	146c70b3373da41d14c6e640f31d1d1d403eecdef66a21bd4de64ad78a033cd5.exe	109
PID 1408 wrote to memory of 4348	1408	146c70b3373da41d14c6e640f31d1d1d403eecdef66a21bd4de64ad78a033cd5.exe	109
PID 1408 wrote to memory of 1776	1408	146c70b3373da41d14c6e640f31d1d1d403eecdef66a21bd4de64ad78a033cd5.exe	110
PID 1408 wrote to memory of 1776	1408	146c70b3373da41d14c6e640f31d1d1d403eecdef66a21bd4de64ad78a033cd5.exe	110
PID 1408 wrote to memory of 1524	1408	146c70b3373da41d14c6e640f31d1d1d403eecdef66a21bd4de64ad78a033cd5.exe	111
PID 1408 wrote to memory of 1524	1408	146c70b3373da41d14c6e640f31d1d1d403eecdef66a21bd4de64ad78a033cd5.exe	111
PID 1408 wrote to memory of 1548	1408	146c70b3373da41d14c6e640f31d1d1d403eecdef66a21bd4de64ad78a033cd5.exe	112
PID 1408 wrote to memory of 1548	1408	146c70b3373da41d14c6e640f31d1d1d403eecdef66a21bd4de64ad78a033cd5.exe	112
PID 1408 wrote to memory of 2960	1408	146c70b3373da41d14c6e640f31d1d1d403eecdef66a21bd4de64ad78a033cd5.exe	113
PID 1408 wrote to memory of 2960	1408	146c70b3373da41d14c6e640f31d1d1d403eecdef66a21bd4de64ad78a033cd5.exe	113
PID 1408 wrote to memory of 3892	1408	146c70b3373da41d14c6e640f31d1d1d403eecdef66a21bd4de64ad78a033cd5.exe	114
PID 1408 wrote to memory of 3892	1408	146c70b3373da41d14c6e640f31d1d1d403eecdef66a21bd4de64ad78a033cd5.exe	114
PID 1408 wrote to memory of 3248	1408	146c70b3373da41d14c6e640f31d1d1d403eecdef66a21bd4de64ad78a033cd5.exe	115
PID 1408 wrote to memory of 3248	1408	146c70b3373da41d14c6e640f31d1d1d403eecdef66a21bd4de64ad78a033cd5.exe	115
PID 1408 wrote to memory of 3388	1408	146c70b3373da41d14c6e640f31d1d1d403eecdef66a21bd4de64ad78a033cd5.exe	116
PID 1408 wrote to memory of 3388	1408	146c70b3373da41d14c6e640f31d1d1d403eecdef66a21bd4de64ad78a033cd5.exe	116
PID 1408 wrote to memory of 2996	1408	146c70b3373da41d14c6e640f31d1d1d403eecdef66a21bd4de64ad78a033cd5.exe	117
PID 1408 wrote to memory of 2996	1408	146c70b3373da41d14c6e640f31d1d1d403eecdef66a21bd4de64ad78a033cd5.exe	117

C:\Users\Admin\AppData\Local\Temp\146c70b3373da41d14c6e640f31d1d1d403eecdef66a21bd4de64ad78a033cd5.exe
"C:\Users\Admin\AppData\Local\Temp\146c70b3373da41d14c6e640f31d1d1d403eecdef66a21bd4de64ad78a033cd5.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1408
- C:\Windows\System\GXtPNUc.exe
  C:\Windows\System\GXtPNUc.exe
  2⤵
  - Executes dropped EXE
  PID:2976
- C:\Windows\System\EFFdzOM.exe
  C:\Windows\System\EFFdzOM.exe
  2⤵
  - Executes dropped EXE
  PID:2796
- C:\Windows\System\XAHIJFF.exe
  C:\Windows\System\XAHIJFF.exe
  2⤵
  - Executes dropped EXE
  PID:64
- C:\Windows\System\msOjfyD.exe
  C:\Windows\System\msOjfyD.exe
  2⤵
  - Executes dropped EXE
  PID:2264
- C:\Windows\System\WKcPEbg.exe
  C:\Windows\System\WKcPEbg.exe
  2⤵
  - Executes dropped EXE
  PID:744
- C:\Windows\System\sAqEQkt.exe
  C:\Windows\System\sAqEQkt.exe
  2⤵
  - Executes dropped EXE
  PID:3216
- C:\Windows\System\ujJQFKJ.exe
  C:\Windows\System\ujJQFKJ.exe
  2⤵
  - Executes dropped EXE
  PID:2984
- C:\Windows\System\kjTOJZF.exe
  C:\Windows\System\kjTOJZF.exe
  2⤵
  - Executes dropped EXE
  PID:3608
- C:\Windows\System\SAUgcAB.exe
  C:\Windows\System\SAUgcAB.exe
  2⤵
  - Executes dropped EXE
  PID:4296
- C:\Windows\System\NRPfMkr.exe
  C:\Windows\System\NRPfMkr.exe
  2⤵
  - Executes dropped EXE
  PID:1820
- C:\Windows\System\MpiCEIa.exe
  C:\Windows\System\MpiCEIa.exe
  2⤵
  - Executes dropped EXE
  PID:1880
- C:\Windows\System\tuJsbfL.exe
  C:\Windows\System\tuJsbfL.exe
  2⤵
  - Executes dropped EXE
  PID:4044
- C:\Windows\System\sVlIAjG.exe
  C:\Windows\System\sVlIAjG.exe
  2⤵
  - Executes dropped EXE
  PID:5060
- C:\Windows\System\XQFSGzJ.exe
  C:\Windows\System\XQFSGzJ.exe
  2⤵
  - Executes dropped EXE
  PID:2256
- C:\Windows\System\abHgZqL.exe
  C:\Windows\System\abHgZqL.exe
  2⤵
  - Executes dropped EXE
  PID:3940
- C:\Windows\System\kyYQnuC.exe
  C:\Windows\System\kyYQnuC.exe
  2⤵
  - Executes dropped EXE
  PID:4616
- C:\Windows\System\NdivCWF.exe
  C:\Windows\System\NdivCWF.exe
  2⤵
  - Executes dropped EXE
  PID:3532
- C:\Windows\System\pWYHYvf.exe
  C:\Windows\System\pWYHYvf.exe
  2⤵
  - Executes dropped EXE
  PID:752
- C:\Windows\System\XbBxrNZ.exe
  C:\Windows\System\XbBxrNZ.exe
  2⤵
  - Executes dropped EXE
  PID:1584
- C:\Windows\System\qxnNAPQ.exe
  C:\Windows\System\qxnNAPQ.exe
  2⤵
  - Executes dropped EXE
  PID:436
- C:\Windows\System\FKeOZDN.exe
  C:\Windows\System\FKeOZDN.exe
  2⤵
  - Executes dropped EXE
  PID:3752
- C:\Windows\System\lvVnmkV.exe
  C:\Windows\System\lvVnmkV.exe
  2⤵
  - Executes dropped EXE
  PID:4320
- C:\Windows\System\DcxdtSX.exe
  C:\Windows\System\DcxdtSX.exe
  2⤵
  - Executes dropped EXE
  PID:3416
- C:\Windows\System\UIAAVlf.exe
  C:\Windows\System\UIAAVlf.exe
  2⤵
  - Executes dropped EXE
  PID:4348
- C:\Windows\System\nqJLsPG.exe
  C:\Windows\System\nqJLsPG.exe
  2⤵
  - Executes dropped EXE
  PID:1776
- C:\Windows\System\JHPNjle.exe
  C:\Windows\System\JHPNjle.exe
  2⤵
  - Executes dropped EXE
  PID:1524
- C:\Windows\System\KXQcNkR.exe
  C:\Windows\System\KXQcNkR.exe
  2⤵
  - Executes dropped EXE
  PID:1548
- C:\Windows\System\SkznoUI.exe
  C:\Windows\System\SkznoUI.exe
  2⤵
  - Executes dropped EXE
  PID:2960
- C:\Windows\System\RQciVLf.exe
  C:\Windows\System\RQciVLf.exe
  2⤵
  - Executes dropped EXE
  PID:3892
- C:\Windows\System\FGuxvSD.exe
  C:\Windows\System\FGuxvSD.exe
  2⤵
  - Executes dropped EXE
  PID:3248
- C:\Windows\System\wQQCwGT.exe
  C:\Windows\System\wQQCwGT.exe
  2⤵
  - Executes dropped EXE
  PID:3388
- C:\Windows\System\QHWWGaA.exe
  C:\Windows\System\QHWWGaA.exe
  2⤵
  - Executes dropped EXE
  PID:2996
- C:\Windows\System\whDvDRk.exe
  C:\Windows\System\whDvDRk.exe
  2⤵
  - Executes dropped EXE
  PID:4900
- C:\Windows\System\qxDXkFj.exe
  C:\Windows\System\qxDXkFj.exe
  2⤵
  - Executes dropped EXE
  PID:760
- C:\Windows\System\idOTMLB.exe
  C:\Windows\System\idOTMLB.exe
  2⤵
  - Executes dropped EXE
  PID:2400
- C:\Windows\System\KevbjJE.exe
  C:\Windows\System\KevbjJE.exe
  2⤵
  - Executes dropped EXE
  PID:2988
- C:\Windows\System\KEUouQp.exe
  C:\Windows\System\KEUouQp.exe
  2⤵
  - Executes dropped EXE
  PID:4324
- C:\Windows\System\eGXeKEE.exe
  C:\Windows\System\eGXeKEE.exe
  2⤵
  - Executes dropped EXE
  PID:4088
- C:\Windows\System\jxSgbuU.exe
  C:\Windows\System\jxSgbuU.exe
  2⤵
  - Executes dropped EXE
  PID:2496
- C:\Windows\System\IPnirNT.exe
  C:\Windows\System\IPnirNT.exe
  2⤵
  - Executes dropped EXE
  PID:2908
- C:\Windows\System\FGKMVMG.exe
  C:\Windows\System\FGKMVMG.exe
  2⤵
  - Executes dropped EXE
  PID:1252
- C:\Windows\System\bXSfcqs.exe
  C:\Windows\System\bXSfcqs.exe
  2⤵
  - Executes dropped EXE
  PID:3632
- C:\Windows\System\bIsmtQo.exe
  C:\Windows\System\bIsmtQo.exe
  2⤵
  - Executes dropped EXE
  PID:4276
- C:\Windows\System\QcWBGYf.exe
  C:\Windows\System\QcWBGYf.exe
  2⤵
  - Executes dropped EXE
  PID:944
- C:\Windows\System\yFzKDrn.exe
  C:\Windows\System\yFzKDrn.exe
  2⤵
  - Executes dropped EXE
  PID:2536
- C:\Windows\System\dRyyUvZ.exe
  C:\Windows\System\dRyyUvZ.exe
  2⤵
  - Executes dropped EXE
  PID:4048
- C:\Windows\System\qbpRFNu.exe
  C:\Windows\System\qbpRFNu.exe
  2⤵
  - Executes dropped EXE
  PID:4444
- C:\Windows\System\AAkhMRs.exe
  C:\Windows\System\AAkhMRs.exe
  2⤵
  - Executes dropped EXE
  PID:3848
- C:\Windows\System\lUtenRU.exe
  C:\Windows\System\lUtenRU.exe
  2⤵
  - Executes dropped EXE
  PID:2012
- C:\Windows\System\qohmhEt.exe
  C:\Windows\System\qohmhEt.exe
  2⤵
  - Executes dropped EXE
  PID:3104
- C:\Windows\System\bGxKgOt.exe
  C:\Windows\System\bGxKgOt.exe
  2⤵
  - Executes dropped EXE
  PID:1068
- C:\Windows\System\xNJQARi.exe
  C:\Windows\System\xNJQARi.exe
  2⤵
  - Executes dropped EXE
  PID:4652
- C:\Windows\System\ozuqQEI.exe
  C:\Windows\System\ozuqQEI.exe
  2⤵
  - Executes dropped EXE
  PID:2576
- C:\Windows\System\xDfEzNk.exe
  C:\Windows\System\xDfEzNk.exe
  2⤵
  - Executes dropped EXE
  PID:3324
- C:\Windows\System\ElbajiP.exe
  C:\Windows\System\ElbajiP.exe
  2⤵
  - Executes dropped EXE
  PID:940
- C:\Windows\System\LREBQzM.exe
  C:\Windows\System\LREBQzM.exe
  2⤵
  - Executes dropped EXE
  PID:3220
- C:\Windows\System\SyPeARS.exe
  C:\Windows\System\SyPeARS.exe
  2⤵
  - Executes dropped EXE
  PID:4716
- C:\Windows\System\WLxmitY.exe
  C:\Windows\System\WLxmitY.exe
  2⤵
  - Executes dropped EXE
  PID:2168
- C:\Windows\System\fcwlJed.exe
  C:\Windows\System\fcwlJed.exe
  2⤵
  - Executes dropped EXE
  PID:3828
- C:\Windows\System\iAvneMK.exe
  C:\Windows\System\iAvneMK.exe
  2⤵
  - Executes dropped EXE
  PID:3092
- C:\Windows\System\GpVxgMn.exe
  C:\Windows\System\GpVxgMn.exe
  2⤵
  - Executes dropped EXE
  PID:4400
- C:\Windows\System\pCctNJT.exe
  C:\Windows\System\pCctNJT.exe
  2⤵
  - Executes dropped EXE
  PID:2216
- C:\Windows\System\iBrqvbq.exe
  C:\Windows\System\iBrqvbq.exe
  2⤵
  - Executes dropped EXE
  PID:4952
- C:\Windows\System\blxuzBE.exe
  C:\Windows\System\blxuzBE.exe
  2⤵
  - Executes dropped EXE
  PID:4416
- C:\Windows\System\Eiwagvh.exe
  C:\Windows\System\Eiwagvh.exe
  2⤵
  PID:1664
- C:\Windows\System\PFFHfxy.exe
  C:\Windows\System\PFFHfxy.exe
  2⤵
  PID:732
- C:\Windows\System\CmutKCs.exe
  C:\Windows\System\CmutKCs.exe
  2⤵
  PID:3836
- C:\Windows\System\PkZJPYq.exe
  C:\Windows\System\PkZJPYq.exe
  2⤵
  PID:4868
- C:\Windows\System\FYAgSMv.exe
  C:\Windows\System\FYAgSMv.exe
  2⤵
  PID:60
- C:\Windows\System\JNXHIQn.exe
  C:\Windows\System\JNXHIQn.exe
  2⤵
  PID:1256
- C:\Windows\System\OtPtjpj.exe
  C:\Windows\System\OtPtjpj.exe
  2⤵
  PID:4632
- C:\Windows\System\ScCDaAn.exe
  C:\Windows\System\ScCDaAn.exe
  2⤵
  PID:1520
- C:\Windows\System\GcHUkcV.exe
  C:\Windows\System\GcHUkcV.exe
  2⤵
  PID:1540
- C:\Windows\System\qyrPvlF.exe
  C:\Windows\System\qyrPvlF.exe
  2⤵
  PID:4160
- C:\Windows\System\lqdfwwk.exe
  C:\Windows\System\lqdfwwk.exe
  2⤵
  PID:4608
- C:\Windows\System\rZVHEYG.exe
  C:\Windows\System\rZVHEYG.exe
  2⤵
  PID:4360
- C:\Windows\System\EExwUfr.exe
  C:\Windows\System\EExwUfr.exe
  2⤵
  PID:1780
- C:\Windows\System\FFihfvq.exe
  C:\Windows\System\FFihfvq.exe
  2⤵
  PID:4072
- C:\Windows\System\VYknbnL.exe
  C:\Windows\System\VYknbnL.exe
  2⤵
  PID:2956
- C:\Windows\System\dgRTtKx.exe
  C:\Windows\System\dgRTtKx.exe
  2⤵
  PID:4684
- C:\Windows\System\WVoKKlC.exe
  C:\Windows\System\WVoKKlC.exe
  2⤵
  PID:3084
- C:\Windows\System\BjVxPsZ.exe
  C:\Windows\System\BjVxPsZ.exe
  2⤵
  PID:2336
- C:\Windows\System\BXfERVi.exe
  C:\Windows\System\BXfERVi.exe
  2⤵
  PID:3196
- C:\Windows\System\gsjgfBb.exe
  C:\Windows\System\gsjgfBb.exe
  2⤵
  PID:4924
- C:\Windows\System\cszaHCD.exe
  C:\Windows\System\cszaHCD.exe
  2⤵
  PID:2928
- C:\Windows\System\lcxyaII.exe
  C:\Windows\System\lcxyaII.exe
  2⤵
  PID:4292
- C:\Windows\System\DzLDZez.exe
  C:\Windows\System\DzLDZez.exe
  2⤵
  PID:916
- C:\Windows\System\uTEFNOQ.exe
  C:\Windows\System\uTEFNOQ.exe
  2⤵
  PID:4456
- C:\Windows\System\dAJzztl.exe
  C:\Windows\System\dAJzztl.exe
  2⤵
  PID:2492
- C:\Windows\System\RqKiHEg.exe
  C:\Windows\System\RqKiHEg.exe
  2⤵
  PID:2320
- C:\Windows\System\FidqxOM.exe
  C:\Windows\System\FidqxOM.exe
  2⤵
  PID:2636
- C:\Windows\System\cAKfQkO.exe
  C:\Windows\System\cAKfQkO.exe
  2⤵
  PID:2120
- C:\Windows\System\lEBSRUs.exe
  C:\Windows\System\lEBSRUs.exe
  2⤵
  PID:4736
- C:\Windows\System\yUzcecn.exe
  C:\Windows\System\yUzcecn.exe
  2⤵
  PID:3960
- C:\Windows\System\hRUFmAd.exe
  C:\Windows\System\hRUFmAd.exe
  2⤵
  PID:3444
- C:\Windows\System\qFXwave.exe
  C:\Windows\System\qFXwave.exe
  2⤵
  PID:4656
- C:\Windows\System\qfBUVgJ.exe
  C:\Windows\System\qfBUVgJ.exe
  2⤵
  PID:2952
- C:\Windows\System\pNTiEBD.exe
  C:\Windows\System\pNTiEBD.exe
  2⤵
  PID:3912
- C:\Windows\System\lzKeacC.exe
  C:\Windows\System\lzKeacC.exe
  2⤵
  PID:116
- C:\Windows\System\qFNNDEY.exe
  C:\Windows\System\qFNNDEY.exe
  2⤵
  PID:3604
- C:\Windows\System\PLUtwYX.exe
  C:\Windows\System\PLUtwYX.exe
  2⤵
  PID:2584
- C:\Windows\System\XSMyGjy.exe
  C:\Windows\System\XSMyGjy.exe
  2⤵
  PID:5144
- C:\Windows\System\wQlcOOd.exe
  C:\Windows\System\wQlcOOd.exe
  2⤵
  PID:5176
- C:\Windows\System\NESalRX.exe
  C:\Windows\System\NESalRX.exe
  2⤵
  PID:5208
- C:\Windows\System\hrXjMqJ.exe
  C:\Windows\System\hrXjMqJ.exe
  2⤵
  PID:5232
- C:\Windows\System\mppvmZW.exe
  C:\Windows\System\mppvmZW.exe
  2⤵
  PID:5252
- C:\Windows\System\iilnInN.exe
  C:\Windows\System\iilnInN.exe
  2⤵
  PID:5268
- C:\Windows\System\fgvflsQ.exe
  C:\Windows\System\fgvflsQ.exe
  2⤵
  PID:5296
- C:\Windows\System\eEDYNvF.exe
  C:\Windows\System\eEDYNvF.exe
  2⤵
  PID:5336
- C:\Windows\System\zyNbLQE.exe
  C:\Windows\System\zyNbLQE.exe
  2⤵
  PID:5368
- C:\Windows\System\EHiarSL.exe
  C:\Windows\System\EHiarSL.exe
  2⤵
  PID:5400
- C:\Windows\System\jMPpREm.exe
  C:\Windows\System\jMPpREm.exe
  2⤵
  PID:5420
- C:\Windows\System\pXiavIi.exe
  C:\Windows\System\pXiavIi.exe
  2⤵
  PID:5460
- C:\Windows\System\jsrtZKB.exe
  C:\Windows\System\jsrtZKB.exe
  2⤵
  PID:5484
- C:\Windows\System\VHUATKf.exe
  C:\Windows\System\VHUATKf.exe
  2⤵
  PID:5504
- C:\Windows\System\yfExvrx.exe
  C:\Windows\System\yfExvrx.exe
  2⤵
  PID:5536
- C:\Windows\System\tadylBC.exe
  C:\Windows\System\tadylBC.exe
  2⤵
  PID:5556
- C:\Windows\System\MfygElD.exe
  C:\Windows\System\MfygElD.exe
  2⤵
  PID:5580
- C:\Windows\System\ommnULG.exe
  C:\Windows\System\ommnULG.exe
  2⤵
  PID:5640
- C:\Windows\System\VopgNFX.exe
  C:\Windows\System\VopgNFX.exe
  2⤵
  PID:5656
- C:\Windows\System\mYTqJND.exe
  C:\Windows\System\mYTqJND.exe
  2⤵
  PID:5672
- C:\Windows\System\vHmEVDu.exe
  C:\Windows\System\vHmEVDu.exe
  2⤵
  PID:5704
- C:\Windows\System\sMskRDL.exe
  C:\Windows\System\sMskRDL.exe
  2⤵
  PID:5724
- C:\Windows\System\kNwanlK.exe
  C:\Windows\System\kNwanlK.exe
  2⤵
  PID:5744
- C:\Windows\System\vcHgmWC.exe
  C:\Windows\System\vcHgmWC.exe
  2⤵
  PID:5776
- C:\Windows\System\bFCMaRB.exe
  C:\Windows\System\bFCMaRB.exe
  2⤵
  PID:5816
- C:\Windows\System\qRGXmhs.exe
  C:\Windows\System\qRGXmhs.exe
  2⤵
  PID:5852
- C:\Windows\System\PBgAnYt.exe
  C:\Windows\System\PBgAnYt.exe
  2⤵
  PID:5872
- C:\Windows\System\lLNcvBS.exe
  C:\Windows\System\lLNcvBS.exe
  2⤵
  PID:5912
- C:\Windows\System\nQWtUhX.exe
  C:\Windows\System\nQWtUhX.exe
  2⤵
  PID:5944
- C:\Windows\System\REGPoAC.exe
  C:\Windows\System\REGPoAC.exe
  2⤵
  PID:5964
- C:\Windows\System\DOzhXji.exe
  C:\Windows\System\DOzhXji.exe
  2⤵
  PID:5988
- C:\Windows\System\VlSRDQN.exe
  C:\Windows\System\VlSRDQN.exe
  2⤵
  PID:6016
- C:\Windows\System\JjDgHDW.exe
  C:\Windows\System\JjDgHDW.exe
  2⤵
  PID:6036
- C:\Windows\System\shUpEiC.exe
  C:\Windows\System\shUpEiC.exe
  2⤵
  PID:6072
- C:\Windows\System\zRpNQBr.exe
  C:\Windows\System\zRpNQBr.exe
  2⤵
  PID:6108
- C:\Windows\System\bCuChIb.exe
  C:\Windows\System\bCuChIb.exe
  2⤵
  PID:6128
- C:\Windows\System\EeZcMnm.exe
  C:\Windows\System\EeZcMnm.exe
  2⤵
  PID:5128
- C:\Windows\System\OqlSyVZ.exe
  C:\Windows\System\OqlSyVZ.exe
  2⤵
  PID:5196
- C:\Windows\System\fVXdBKu.exe
  C:\Windows\System\fVXdBKu.exe
  2⤵
  PID:5244
- C:\Windows\System\AHOsvcD.exe
  C:\Windows\System\AHOsvcD.exe
  2⤵
  PID:5280
- C:\Windows\System\scyiQKU.exe
  C:\Windows\System\scyiQKU.exe
  2⤵
  PID:5360
- C:\Windows\System\aTkmRIN.exe
  C:\Windows\System\aTkmRIN.exe
  2⤵
  PID:5416
- C:\Windows\System\qGnLtoH.exe
  C:\Windows\System\qGnLtoH.exe
  2⤵
  PID:5524
- C:\Windows\System\RCoLKxp.exe
  C:\Windows\System\RCoLKxp.exe
  2⤵
  PID:5632
- C:\Windows\System\KLAbYGG.exe
  C:\Windows\System\KLAbYGG.exe
  2⤵
  PID:5664
- C:\Windows\System\voHZtSm.exe
  C:\Windows\System\voHZtSm.exe
  2⤵
  PID:5696
- C:\Windows\System\wABOZqW.exe
  C:\Windows\System\wABOZqW.exe
  2⤵
  PID:5760
- C:\Windows\System\EgRueWg.exe
  C:\Windows\System\EgRueWg.exe
  2⤵
  PID:5808
- C:\Windows\System\PTHXvAw.exe
  C:\Windows\System\PTHXvAw.exe
  2⤵
  PID:5924
- C:\Windows\System\EVATACx.exe
  C:\Windows\System\EVATACx.exe
  2⤵
  PID:5960
- C:\Windows\System\ldmLggl.exe
  C:\Windows\System\ldmLggl.exe
  2⤵
  PID:6004
- C:\Windows\System\mHvOOfB.exe
  C:\Windows\System\mHvOOfB.exe
  2⤵
  PID:6068
- C:\Windows\System\NEGoQQe.exe
  C:\Windows\System\NEGoQQe.exe
  2⤵
  PID:5124
- C:\Windows\System\sYEqoGu.exe
  C:\Windows\System\sYEqoGu.exe
  2⤵
  PID:5240
- C:\Windows\System\UOQRLHw.exe
  C:\Windows\System\UOQRLHw.exe
  2⤵
  PID:5380
- C:\Windows\System\CfTTwjI.exe
  C:\Windows\System\CfTTwjI.exe
  2⤵
  PID:5548
- C:\Windows\System\BUzxhBz.exe
  C:\Windows\System\BUzxhBz.exe
  2⤵
  PID:5668
- C:\Windows\System\pUznhmU.exe
  C:\Windows\System\pUznhmU.exe
  2⤵
  PID:5880
- C:\Windows\System\LvZnNFq.exe
  C:\Windows\System\LvZnNFq.exe
  2⤵
  PID:5832
- C:\Windows\System\ZTWfYWj.exe
  C:\Windows\System\ZTWfYWj.exe
  2⤵
  PID:5260
- C:\Windows\System\oAVbryK.exe
  C:\Windows\System\oAVbryK.exe
  2⤵
  PID:6120
- C:\Windows\System\gsjLSLh.exe
  C:\Windows\System\gsjLSLh.exe
  2⤵
  PID:6056
- C:\Windows\System\JGSGbCU.exe
  C:\Windows\System\JGSGbCU.exe
  2⤵
  PID:5164
- C:\Windows\System\JRUroPt.exe
  C:\Windows\System\JRUroPt.exe
  2⤵
  PID:6148
- C:\Windows\System\BjXRViW.exe
  C:\Windows\System\BjXRViW.exe
  2⤵
  PID:6176
- C:\Windows\System\AoLHuBv.exe
  C:\Windows\System\AoLHuBv.exe
  2⤵
  PID:6196
- C:\Windows\System\XlXtxPB.exe
  C:\Windows\System\XlXtxPB.exe
  2⤵
  PID:6216
- C:\Windows\System\oKjVXvZ.exe
  C:\Windows\System\oKjVXvZ.exe
  2⤵
  PID:6240
- C:\Windows\System\ukBoGSS.exe
  C:\Windows\System\ukBoGSS.exe
  2⤵
  PID:6264
- C:\Windows\System\hEsGJTW.exe
  C:\Windows\System\hEsGJTW.exe
  2⤵
  PID:6284
- C:\Windows\System\wFTxVXb.exe
  C:\Windows\System\wFTxVXb.exe
  2⤵
  PID:6308
- C:\Windows\System\OSMDhKX.exe
  C:\Windows\System\OSMDhKX.exe
  2⤵
  PID:6324
- C:\Windows\System\keiPOZF.exe
  C:\Windows\System\keiPOZF.exe
  2⤵
  PID:6356
- C:\Windows\System\EBJGNDl.exe
  C:\Windows\System\EBJGNDl.exe
  2⤵
  PID:6384
- C:\Windows\System\mMMZUxQ.exe
  C:\Windows\System\mMMZUxQ.exe
  2⤵
  PID:6420
- C:\Windows\System\HTCpSfd.exe
  C:\Windows\System\HTCpSfd.exe
  2⤵
  PID:6444
- C:\Windows\System\bwGKPBc.exe
  C:\Windows\System\bwGKPBc.exe
  2⤵
  PID:6472
- C:\Windows\System\rHUGEhh.exe
  C:\Windows\System\rHUGEhh.exe
  2⤵
  PID:6500
- C:\Windows\System\aGOUygd.exe
  C:\Windows\System\aGOUygd.exe
  2⤵
  PID:6528
- C:\Windows\System\nAWngMi.exe
  C:\Windows\System\nAWngMi.exe
  2⤵
  PID:6560
- C:\Windows\System\mddyEJU.exe
  C:\Windows\System\mddyEJU.exe
  2⤵
  PID:6592
- C:\Windows\System\XkIfKhS.exe
  C:\Windows\System\XkIfKhS.exe
  2⤵
  PID:6624
- C:\Windows\System\gqvUhgl.exe
  C:\Windows\System\gqvUhgl.exe
  2⤵
  PID:6664
- C:\Windows\System\MMzguwW.exe
  C:\Windows\System\MMzguwW.exe
  2⤵
  PID:6692
- C:\Windows\System\xQcaFqM.exe
  C:\Windows\System\xQcaFqM.exe
  2⤵
  PID:6720
- C:\Windows\System\UMZUipd.exe
  C:\Windows\System\UMZUipd.exe
  2⤵
  PID:6740
- C:\Windows\System\hboQhuv.exe
  C:\Windows\System\hboQhuv.exe
  2⤵
  PID:6768
- C:\Windows\System\IcNXayL.exe
  C:\Windows\System\IcNXayL.exe
  2⤵
  PID:6796
- C:\Windows\System\vFkZGbd.exe
  C:\Windows\System\vFkZGbd.exe
  2⤵
  PID:6844
- C:\Windows\System\RfpeZzQ.exe
  C:\Windows\System\RfpeZzQ.exe
  2⤵
  PID:6860
- C:\Windows\System\agRwoGC.exe
  C:\Windows\System\agRwoGC.exe
  2⤵
  PID:6896
- C:\Windows\System\HimgVbE.exe
  C:\Windows\System\HimgVbE.exe
  2⤵
  PID:6912
- C:\Windows\System\SPgPwYU.exe
  C:\Windows\System\SPgPwYU.exe
  2⤵
  PID:6936
- C:\Windows\System\YFPtJLr.exe
  C:\Windows\System\YFPtJLr.exe
  2⤵
  PID:6960
- C:\Windows\System\ZJwDapf.exe
  C:\Windows\System\ZJwDapf.exe
  2⤵
  PID:6984
- C:\Windows\System\MlBDPRD.exe
  C:\Windows\System\MlBDPRD.exe
  2⤵
  PID:7020
- C:\Windows\System\DbGUvhi.exe
  C:\Windows\System\DbGUvhi.exe
  2⤵
  PID:7044
- C:\Windows\System\IGIfCQr.exe
  C:\Windows\System\IGIfCQr.exe
  2⤵
  PID:7080
- C:\Windows\System\BObPhvT.exe
  C:\Windows\System\BObPhvT.exe
  2⤵
  PID:7100
- C:\Windows\System\jCUfafu.exe
  C:\Windows\System\jCUfafu.exe
  2⤵
  PID:7136
- C:\Windows\System\RWblzbC.exe
  C:\Windows\System\RWblzbC.exe
  2⤵
  PID:7160
- C:\Windows\System\jWGZuIF.exe
  C:\Windows\System\jWGZuIF.exe
  2⤵
  PID:6008
- C:\Windows\System\GDhCfOX.exe
  C:\Windows\System\GDhCfOX.exe
  2⤵
  PID:6188
- C:\Windows\System\MlvBxLO.exe
  C:\Windows\System\MlvBxLO.exe
  2⤵
  PID:6272
- C:\Windows\System\WUNttBk.exe
  C:\Windows\System\WUNttBk.exe
  2⤵
  PID:6344
- C:\Windows\System\mgTKHgw.exe
  C:\Windows\System\mgTKHgw.exe
  2⤵
  PID:6396
- C:\Windows\System\zribzTA.exe
  C:\Windows\System\zribzTA.exe
  2⤵
  PID:6548
- C:\Windows\System\SRrHNcI.exe
  C:\Windows\System\SRrHNcI.exe
  2⤵
  PID:6620
- C:\Windows\System\CPbiTKy.exe
  C:\Windows\System\CPbiTKy.exe
  2⤵
  PID:6636
- C:\Windows\System\SAwdgZE.exe
  C:\Windows\System\SAwdgZE.exe
  2⤵
  PID:6600
- C:\Windows\System\bOrScjW.exe
  C:\Windows\System\bOrScjW.exe
  2⤵
  PID:6712
- C:\Windows\System\XZorQjU.exe
  C:\Windows\System\XZorQjU.exe
  2⤵
  PID:6852
- C:\Windows\System\cIFOgnm.exe
  C:\Windows\System\cIFOgnm.exe
  2⤵
  PID:992
- C:\Windows\System\cvICkJA.exe
  C:\Windows\System\cvICkJA.exe
  2⤵
  PID:2540
- C:\Windows\System\DyAdccx.exe
  C:\Windows\System\DyAdccx.exe
  2⤵
  PID:7068
- C:\Windows\System\GoxkJgW.exe
  C:\Windows\System\GoxkJgW.exe
  2⤵
  PID:7036
- C:\Windows\System\cavrQzP.exe
  C:\Windows\System\cavrQzP.exe
  2⤵
  PID:6184
- C:\Windows\System\KGTKcPf.exe
  C:\Windows\System\KGTKcPf.exe
  2⤵
  PID:6376
- C:\Windows\System\mNObLaL.exe
  C:\Windows\System\mNObLaL.exe
  2⤵
  PID:6520
- C:\Windows\System\YumwQHL.exe
  C:\Windows\System\YumwQHL.exe
  2⤵
  PID:6588
- C:\Windows\System\aZWpDFB.exe
  C:\Windows\System\aZWpDFB.exe
  2⤵
  PID:3924
- C:\Windows\System\jtpDozg.exe
  C:\Windows\System\jtpDozg.exe
  2⤵
  PID:6756
- C:\Windows\System\EEsTZta.exe
  C:\Windows\System\EEsTZta.exe
  2⤵
  PID:6872
- C:\Windows\System\jsDtjgW.exe
  C:\Windows\System\jsDtjgW.exe
  2⤵
  PID:7008
- C:\Windows\System\oDYLoBo.exe
  C:\Windows\System\oDYLoBo.exe
  2⤵
  PID:6232
- C:\Windows\System\wlwTfsc.exe
  C:\Windows\System\wlwTfsc.exe
  2⤵
  PID:6392
- C:\Windows\System\qMzSiMC.exe
  C:\Windows\System\qMzSiMC.exe
  2⤵
  PID:6704
- C:\Windows\System\ywZBibO.exe
  C:\Windows\System\ywZBibO.exe
  2⤵
  PID:4508
- C:\Windows\System\mGySRsK.exe
  C:\Windows\System\mGySRsK.exe
  2⤵
  PID:7128
- C:\Windows\System\tbtJuNK.exe
  C:\Windows\System\tbtJuNK.exe
  2⤵
  PID:6508
- C:\Windows\System\dCdOnmz.exe
  C:\Windows\System\dCdOnmz.exe
  2⤵
  PID:6972
- C:\Windows\System\RSTVLAT.exe
  C:\Windows\System\RSTVLAT.exe
  2⤵
  PID:7176
- C:\Windows\System\OCvKktu.exe
  C:\Windows\System\OCvKktu.exe
  2⤵
  PID:7208
- C:\Windows\System\MeEdcYG.exe
  C:\Windows\System\MeEdcYG.exe
  2⤵
  PID:7232
- C:\Windows\System\kjHpEhb.exe
  C:\Windows\System\kjHpEhb.exe
  2⤵
  PID:7248
- C:\Windows\System\ScjXTdI.exe
  C:\Windows\System\ScjXTdI.exe
  2⤵
  PID:7276
- C:\Windows\System\PKvGdpr.exe
  C:\Windows\System\PKvGdpr.exe
  2⤵
  PID:7312
- C:\Windows\System\XoQITsp.exe
  C:\Windows\System\XoQITsp.exe
  2⤵
  PID:7344
- C:\Windows\System\qPlKRzZ.exe
  C:\Windows\System\qPlKRzZ.exe
  2⤵
  PID:7360
- C:\Windows\System\MllPquO.exe
  C:\Windows\System\MllPquO.exe
  2⤵
  PID:7376
- C:\Windows\System\cMfXXdm.exe
  C:\Windows\System\cMfXXdm.exe
  2⤵
  PID:7404
- C:\Windows\System\WelRMht.exe
  C:\Windows\System\WelRMht.exe
  2⤵
  PID:7428
- C:\Windows\System\jrbJhpC.exe
  C:\Windows\System\jrbJhpC.exe
  2⤵
  PID:7452
- C:\Windows\System\MacIgQm.exe
  C:\Windows\System\MacIgQm.exe
  2⤵
  PID:7472
- C:\Windows\System\JwurJIG.exe
  C:\Windows\System\JwurJIG.exe
  2⤵
  PID:7500
- C:\Windows\System\ELWVIqf.exe
  C:\Windows\System\ELWVIqf.exe
  2⤵
  PID:7520
- C:\Windows\System\fbmFGNH.exe
  C:\Windows\System\fbmFGNH.exe
  2⤵
  PID:7540
- C:\Windows\System\gOTxPTt.exe
  C:\Windows\System\gOTxPTt.exe
  2⤵
  PID:7564
- C:\Windows\System\fYwBoHw.exe
  C:\Windows\System\fYwBoHw.exe
  2⤵
  PID:7592
- C:\Windows\System\aAvUxJh.exe
  C:\Windows\System\aAvUxJh.exe
  2⤵
  PID:7624
- C:\Windows\System\ojTBWSp.exe
  C:\Windows\System\ojTBWSp.exe
  2⤵
  PID:7680
- C:\Windows\System\tDpKzrs.exe
  C:\Windows\System\tDpKzrs.exe
  2⤵
  PID:7704
- C:\Windows\System\GQYgAKx.exe
  C:\Windows\System\GQYgAKx.exe
  2⤵
  PID:7736
- C:\Windows\System\mXuwMMM.exe
  C:\Windows\System\mXuwMMM.exe
  2⤵
  PID:7764
- C:\Windows\System\hzHAkUV.exe
  C:\Windows\System\hzHAkUV.exe
  2⤵
  PID:7788
- C:\Windows\System\gmdYkNU.exe
  C:\Windows\System\gmdYkNU.exe
  2⤵
  PID:7812
- C:\Windows\System\aSQzusX.exe
  C:\Windows\System\aSQzusX.exe
  2⤵
  PID:7836
- C:\Windows\System\LpeZctf.exe
  C:\Windows\System\LpeZctf.exe
  2⤵
  PID:7864
- C:\Windows\System\xfIgWfi.exe
  C:\Windows\System\xfIgWfi.exe
  2⤵
  PID:7888
- C:\Windows\System\bJlZocX.exe
  C:\Windows\System\bJlZocX.exe
  2⤵
  PID:7916
- C:\Windows\System\DlIvXnL.exe
  C:\Windows\System\DlIvXnL.exe
  2⤵
  PID:7936
- C:\Windows\System\jZPIwdt.exe
  C:\Windows\System\jZPIwdt.exe
  2⤵
  PID:7964
- C:\Windows\System\GDhKhTr.exe
  C:\Windows\System\GDhKhTr.exe
  2⤵
  PID:7996
- C:\Windows\System\BnFvsKV.exe
  C:\Windows\System\BnFvsKV.exe
  2⤵
  PID:8016
- C:\Windows\System\LSbXNoB.exe
  C:\Windows\System\LSbXNoB.exe
  2⤵
  PID:8036
- C:\Windows\System\UJIUUYZ.exe
  C:\Windows\System\UJIUUYZ.exe
  2⤵
  PID:8064
- C:\Windows\System\DmNpNrt.exe
  C:\Windows\System\DmNpNrt.exe
  2⤵
  PID:8080
- C:\Windows\System\EXmXkoJ.exe
  C:\Windows\System\EXmXkoJ.exe
  2⤵
  PID:8112
- C:\Windows\System\CdwbGjE.exe
  C:\Windows\System\CdwbGjE.exe
  2⤵
  PID:8144
- C:\Windows\System\budSdBE.exe
  C:\Windows\System\budSdBE.exe
  2⤵
  PID:8176
- C:\Windows\System\pIecrUB.exe
  C:\Windows\System\pIecrUB.exe
  2⤵
  PID:1784
- C:\Windows\System\paemVyR.exe
  C:\Windows\System\paemVyR.exe
  2⤵
  PID:1732
- C:\Windows\System\HvsFUne.exe
  C:\Windows\System\HvsFUne.exe
  2⤵
  PID:7228
- C:\Windows\System\ADprAGi.exe
  C:\Windows\System\ADprAGi.exe
  2⤵
  PID:7284
- C:\Windows\System\wJwtjQw.exe
  C:\Windows\System\wJwtjQw.exe
  2⤵
  PID:7324
- C:\Windows\System\eNcpwuv.exe
  C:\Windows\System\eNcpwuv.exe
  2⤵
  PID:2144
- C:\Windows\System\uGvFkSQ.exe
  C:\Windows\System\uGvFkSQ.exe
  2⤵
  PID:7416
- C:\Windows\System\uIPcIAk.exe
  C:\Windows\System\uIPcIAk.exe
  2⤵
  PID:7436
- C:\Windows\System\mkoQHic.exe
  C:\Windows\System\mkoQHic.exe
  2⤵
  PID:7620
- C:\Windows\System\DzJsUhQ.exe
  C:\Windows\System\DzJsUhQ.exe
  2⤵
  PID:7580
- C:\Windows\System\YUheCTD.exe
  C:\Windows\System\YUheCTD.exe
  2⤵
  PID:7748
- C:\Windows\System\CzUKHyv.exe
  C:\Windows\System\CzUKHyv.exe
  2⤵
  PID:7804
- C:\Windows\System\KeqznMM.exe
  C:\Windows\System\KeqznMM.exe
  2⤵
  PID:7780
- C:\Windows\System\pVKartC.exe
  C:\Windows\System\pVKartC.exe
  2⤵
  PID:7908
- C:\Windows\System\aoooHpo.exe
  C:\Windows\System\aoooHpo.exe
  2⤵
  PID:7956
- C:\Windows\System\jQiSjRJ.exe
  C:\Windows\System\jQiSjRJ.exe
  2⤵
  PID:8076
- C:\Windows\System\yJNfsrJ.exe
  C:\Windows\System\yJNfsrJ.exe
  2⤵
  PID:8060
- C:\Windows\System\zrupKpy.exe
  C:\Windows\System\zrupKpy.exe
  2⤵
  PID:8184
- C:\Windows\System\ERERnml.exe
  C:\Windows\System\ERERnml.exe
  2⤵
  PID:7244
- C:\Windows\System\fKnFYGG.exe
  C:\Windows\System\fKnFYGG.exe
  2⤵
  PID:1600
- C:\Windows\System\qADRCtN.exe
  C:\Windows\System\qADRCtN.exe
  2⤵
  PID:7372
- C:\Windows\System\EecfTAu.exe
  C:\Windows\System\EecfTAu.exe
  2⤵
  PID:7460
- C:\Windows\System\RTUepyc.exe
  C:\Windows\System\RTUepyc.exe
  2⤵
  PID:7776
- C:\Windows\System\xjaRJra.exe
  C:\Windows\System\xjaRJra.exe
  2⤵
  PID:7972
- C:\Windows\System\iubTnnT.exe
  C:\Windows\System\iubTnnT.exe
  2⤵
  PID:7992
- C:\Windows\System\DYFIqNx.exe
  C:\Windows\System\DYFIqNx.exe
  2⤵
  PID:1484
- C:\Windows\System\iMFspFZ.exe
  C:\Windows\System\iMFspFZ.exe
  2⤵
  PID:7944
- C:\Windows\System\TDgNZbB.exe
  C:\Windows\System\TDgNZbB.exe
  2⤵
  PID:7368
- C:\Windows\System\KoRbgvH.exe
  C:\Windows\System\KoRbgvH.exe
  2⤵
  PID:7828
- C:\Windows\System\OWuffPw.exe
  C:\Windows\System\OWuffPw.exe
  2⤵
  PID:7400
- C:\Windows\System\YRTgoSW.exe
  C:\Windows\System\YRTgoSW.exe
  2⤵
  PID:8212
- C:\Windows\System\HtidNjO.exe
  C:\Windows\System\HtidNjO.exe
  2⤵
  PID:8244
- C:\Windows\System\RCwXEfp.exe
  C:\Windows\System\RCwXEfp.exe
  2⤵
  PID:8276
- C:\Windows\System\CEvjewX.exe
  C:\Windows\System\CEvjewX.exe
  2⤵
  PID:8308
- C:\Windows\System\Ikcdanq.exe
  C:\Windows\System\Ikcdanq.exe
  2⤵
  PID:8344
- C:\Windows\System\EWAFVCx.exe
  C:\Windows\System\EWAFVCx.exe
  2⤵
  PID:8376
- C:\Windows\System\fZgdAJo.exe
  C:\Windows\System\fZgdAJo.exe
  2⤵
  PID:8404
- C:\Windows\System\CMGWDCZ.exe
  C:\Windows\System\CMGWDCZ.exe
  2⤵
  PID:8436
- C:\Windows\System\XVvPCfB.exe
  C:\Windows\System\XVvPCfB.exe
  2⤵
  PID:8464
- C:\Windows\System\fhymerO.exe
  C:\Windows\System\fhymerO.exe
  2⤵
  PID:8496
- C:\Windows\System\NgamCHL.exe
  C:\Windows\System\NgamCHL.exe
  2⤵
  PID:8528
- C:\Windows\System\GdVdJxe.exe
  C:\Windows\System\GdVdJxe.exe
  2⤵
  PID:8552
- C:\Windows\System\FPRZtiE.exe
  C:\Windows\System\FPRZtiE.exe
  2⤵
  PID:8584
- C:\Windows\System\jXutfHh.exe
  C:\Windows\System\jXutfHh.exe
  2⤵
  PID:8624
- C:\Windows\System\CpJYQyk.exe
  C:\Windows\System\CpJYQyk.exe
  2⤵
  PID:8644
- C:\Windows\System\udBuPis.exe
  C:\Windows\System\udBuPis.exe
  2⤵
  PID:8668
- C:\Windows\System\qwkmlUi.exe
  C:\Windows\System\qwkmlUi.exe
  2⤵
  PID:8700
- C:\Windows\System\VATErxm.exe
  C:\Windows\System\VATErxm.exe
  2⤵
  PID:8728
- C:\Windows\System\JmukpVE.exe
  C:\Windows\System\JmukpVE.exe
  2⤵
  PID:8752
- C:\Windows\System\roQlnKg.exe
  C:\Windows\System\roQlnKg.exe
  2⤵
  PID:8780
- C:\Windows\System\dswqulG.exe
  C:\Windows\System\dswqulG.exe
  2⤵
  PID:8816
- C:\Windows\System\jGJoJIP.exe
  C:\Windows\System\jGJoJIP.exe
  2⤵
  PID:8840
- C:\Windows\System\olbESEh.exe
  C:\Windows\System\olbESEh.exe
  2⤵
  PID:8868
- C:\Windows\System\nFeUXoq.exe
  C:\Windows\System\nFeUXoq.exe
  2⤵
  PID:8896
- C:\Windows\System\ZAOAfxR.exe
  C:\Windows\System\ZAOAfxR.exe
  2⤵
  PID:8928
- C:\Windows\System\jWNraVH.exe
  C:\Windows\System\jWNraVH.exe
  2⤵
  PID:8952
- C:\Windows\System\UHAZOtV.exe
  C:\Windows\System\UHAZOtV.exe
  2⤵
  PID:8980
- C:\Windows\System\pihBhhq.exe
  C:\Windows\System\pihBhhq.exe
  2⤵
  PID:9008
- C:\Windows\System\pecyUDw.exe
  C:\Windows\System\pecyUDw.exe
  2⤵
  PID:9028
- C:\Windows\System\pcEYgev.exe
  C:\Windows\System\pcEYgev.exe
  2⤵
  PID:9060
- C:\Windows\System\JgRTCHN.exe
  C:\Windows\System\JgRTCHN.exe
  2⤵
  PID:9092
- C:\Windows\System\AcixVqv.exe
  C:\Windows\System\AcixVqv.exe
  2⤵
  PID:9112
- C:\Windows\System\IlxEPhq.exe
  C:\Windows\System\IlxEPhq.exe
  2⤵
  PID:9132
- C:\Windows\System\HFnkXYd.exe
  C:\Windows\System\HFnkXYd.exe
  2⤵
  PID:9152
- C:\Windows\System\WpHeRbE.exe
  C:\Windows\System\WpHeRbE.exe
  2⤵
  PID:9172
- C:\Windows\System\mAPEdQr.exe
  C:\Windows\System\mAPEdQr.exe
  2⤵
  PID:9200
- C:\Windows\System\sGupUqI.exe
  C:\Windows\System\sGupUqI.exe
  2⤵
  PID:7264
- C:\Windows\System\KaskHhg.exe
  C:\Windows\System\KaskHhg.exe
  2⤵
  PID:8224
- C:\Windows\System\WSIueQP.exe
  C:\Windows\System\WSIueQP.exe
  2⤵
  PID:8296
- C:\Windows\System\OpafWza.exe
  C:\Windows\System\OpafWza.exe
  2⤵
  PID:8292
- C:\Windows\System\nBLGRBY.exe
  C:\Windows\System\nBLGRBY.exe
  2⤵
  PID:8392
- C:\Windows\System\qmREcSh.exe
  C:\Windows\System\qmREcSh.exe
  2⤵
  PID:8492
- C:\Windows\System\RtwQIhi.exe
  C:\Windows\System\RtwQIhi.exe
  2⤵
  PID:8580
- C:\Windows\System\GLVIMVf.exe
  C:\Windows\System\GLVIMVf.exe
  2⤵
  PID:8600
- C:\Windows\System\kyYySsC.exe
  C:\Windows\System\kyYySsC.exe
  2⤵
  PID:8656
- C:\Windows\System\tkVwrCv.exe
  C:\Windows\System\tkVwrCv.exe
  2⤵
  PID:8744
- C:\Windows\System\sFetSuB.exe
  C:\Windows\System\sFetSuB.exe
  2⤵
  PID:8772
- C:\Windows\System\ennMglr.exe
  C:\Windows\System\ennMglr.exe
  2⤵
  PID:8860
- C:\Windows\System\PhZSWdw.exe
  C:\Windows\System\PhZSWdw.exe
  2⤵
  PID:8920
- C:\Windows\System\tgucHVo.exe
  C:\Windows\System\tgucHVo.exe
  2⤵
  PID:8964
- C:\Windows\System\DmiAhCI.exe
  C:\Windows\System\DmiAhCI.exe
  2⤵
  PID:9016
- C:\Windows\System\hIdoRWT.exe
  C:\Windows\System\hIdoRWT.exe
  2⤵
  PID:3424
- C:\Windows\System\fTRnclZ.exe
  C:\Windows\System\fTRnclZ.exe
  2⤵
  PID:2388
- C:\Windows\System\qSAvSar.exe
  C:\Windows\System\qSAvSar.exe
  2⤵
  PID:9160
- C:\Windows\System\jiRuOnd.exe
  C:\Windows\System\jiRuOnd.exe
  2⤵
  PID:9196
- C:\Windows\System\ZTQPhPh.exe
  C:\Windows\System\ZTQPhPh.exe
  2⤵
  PID:8340
- C:\Windows\System\qdJkxUr.exe
  C:\Windows\System\qdJkxUr.exe
  2⤵
  PID:8428
- C:\Windows\System\qomMNmM.exe
  C:\Windows\System\qomMNmM.exe
  2⤵
  PID:8540
- C:\Windows\System\IeXNJWD.exe
  C:\Windows\System\IeXNJWD.exe
  2⤵
  PID:8696
- C:\Windows\System\cYLWFlV.exe
  C:\Windows\System\cYLWFlV.exe
  2⤵
  PID:8892
- C:\Windows\System\WlwvrvH.exe
  C:\Windows\System\WlwvrvH.exe
  2⤵
  PID:4120
- C:\Windows\System\OMGJEcv.exe
  C:\Windows\System\OMGJEcv.exe
  2⤵
  PID:9048
- C:\Windows\System\iyyIgVF.exe
  C:\Windows\System\iyyIgVF.exe
  2⤵
  PID:8988
- C:\Windows\System\STDviKk.exe
  C:\Windows\System\STDviKk.exe
  2⤵
  PID:8284
- C:\Windows\System\HtSgrRa.exe
  C:\Windows\System\HtSgrRa.exe
  2⤵
  PID:9120
- C:\Windows\System\OXvArXz.exe
  C:\Windows\System\OXvArXz.exe
  2⤵
  PID:9220
- C:\Windows\System\hVwRNgz.exe
  C:\Windows\System\hVwRNgz.exe
  2⤵
  PID:9248
- C:\Windows\System\uyAFLeF.exe
  C:\Windows\System\uyAFLeF.exe
  2⤵
  PID:9272
- C:\Windows\System\JbyHmXn.exe
  C:\Windows\System\JbyHmXn.exe
  2⤵
  PID:9296
- C:\Windows\System\LxTVtSz.exe
  C:\Windows\System\LxTVtSz.exe
  2⤵
  PID:9320
- C:\Windows\System\xdgkTps.exe
  C:\Windows\System\xdgkTps.exe
  2⤵
  PID:9348
- C:\Windows\System\ryyswNX.exe
  C:\Windows\System\ryyswNX.exe
  2⤵
  PID:9376
- C:\Windows\System\CrvdnNB.exe
  C:\Windows\System\CrvdnNB.exe
  2⤵
  PID:9412
- C:\Windows\System\wUKaAfV.exe
  C:\Windows\System\wUKaAfV.exe
  2⤵
  PID:9440
- C:\Windows\System\MxbcMnn.exe
  C:\Windows\System\MxbcMnn.exe
  2⤵
  PID:9456
- C:\Windows\System\LuuISAk.exe
  C:\Windows\System\LuuISAk.exe
  2⤵
  PID:9488
- C:\Windows\System\XXulISm.exe
  C:\Windows\System\XXulISm.exe
  2⤵
  PID:9512
- C:\Windows\System\wmGzzmc.exe
  C:\Windows\System\wmGzzmc.exe
  2⤵
  PID:9548
- C:\Windows\System\FZGGuWI.exe
  C:\Windows\System\FZGGuWI.exe
  2⤵
  PID:9576
- C:\Windows\System\wkTbhCf.exe
  C:\Windows\System\wkTbhCf.exe
  2⤵
  PID:9596
- C:\Windows\System\pBHjmSZ.exe
  C:\Windows\System\pBHjmSZ.exe
  2⤵
  PID:9628
- C:\Windows\System\rPnnqZZ.exe
  C:\Windows\System\rPnnqZZ.exe
  2⤵
  PID:9652
- C:\Windows\System\VFCtViB.exe
  C:\Windows\System\VFCtViB.exe
  2⤵
  PID:9680
- C:\Windows\System\kPKCbHC.exe
  C:\Windows\System\kPKCbHC.exe
  2⤵
  PID:9708
- C:\Windows\System\dqCTUMk.exe
  C:\Windows\System\dqCTUMk.exe
  2⤵
  PID:9736
- C:\Windows\System\ueuxthJ.exe
  C:\Windows\System\ueuxthJ.exe
  2⤵
  PID:9772
- C:\Windows\System\kimbvhy.exe
  C:\Windows\System\kimbvhy.exe
  2⤵
  PID:9800
- C:\Windows\System\jZtcFuB.exe
  C:\Windows\System\jZtcFuB.exe
  2⤵
  PID:9832
- C:\Windows\System\BBekzeB.exe
  C:\Windows\System\BBekzeB.exe
  2⤵
  PID:9856
- C:\Windows\System\OwjaolP.exe
  C:\Windows\System\OwjaolP.exe
  2⤵
  PID:9888
- C:\Windows\System\KqphVcu.exe
  C:\Windows\System\KqphVcu.exe
  2⤵
  PID:9916
- C:\Windows\System\reQeqbl.exe
  C:\Windows\System\reQeqbl.exe
  2⤵
  PID:9948
- C:\Windows\System\PxKdWAR.exe
  C:\Windows\System\PxKdWAR.exe
  2⤵
  PID:9972
- C:\Windows\System\efApaqp.exe
  C:\Windows\System\efApaqp.exe
  2⤵
  PID:9996
- C:\Windows\System\KusnQvR.exe
  C:\Windows\System\KusnQvR.exe
  2⤵
  PID:10028
- C:\Windows\System\BWMYBOr.exe
  C:\Windows\System\BWMYBOr.exe
  2⤵
  PID:10060
- C:\Windows\System\YWiXIfk.exe
  C:\Windows\System\YWiXIfk.exe
  2⤵
  PID:10092
- C:\Windows\System\hjTVRsc.exe
  C:\Windows\System\hjTVRsc.exe
  2⤵
  PID:10120
- C:\Windows\System\IBmYFXj.exe
  C:\Windows\System\IBmYFXj.exe
  2⤵
  PID:10152
- C:\Windows\System\KsQcOaa.exe
  C:\Windows\System\KsQcOaa.exe
  2⤵
  PID:10188
- C:\Windows\System\RpFKhnC.exe
  C:\Windows\System\RpFKhnC.exe
  2⤵
  PID:10204
- C:\Windows\System\VxATMBg.exe
  C:\Windows\System\VxATMBg.exe
  2⤵
  PID:10228
- C:\Windows\System\XFDbtQf.exe
  C:\Windows\System\XFDbtQf.exe
  2⤵
  PID:8972
- C:\Windows\System\qckiGpb.exe
  C:\Windows\System\qckiGpb.exe
  2⤵
  PID:1044
- C:\Windows\System\ZTCRTbU.exe
  C:\Windows\System\ZTCRTbU.exe
  2⤵
  PID:9304
- C:\Windows\System\laiHMwX.exe
  C:\Windows\System\laiHMwX.exe
  2⤵
  PID:9280
- C:\Windows\System\gJCYbmL.exe
  C:\Windows\System\gJCYbmL.exe
  2⤵
  PID:9452
- C:\Windows\System\MBcFndc.exe
  C:\Windows\System\MBcFndc.exe
  2⤵
  PID:9528
- C:\Windows\System\UTUWEfE.exe
  C:\Windows\System\UTUWEfE.exe
  2⤵
  PID:9544
- C:\Windows\System\swAmWcB.exe
  C:\Windows\System\swAmWcB.exe
  2⤵
  PID:9588
- C:\Windows\System\RltiKrE.exe
  C:\Windows\System\RltiKrE.exe
  2⤵
  PID:9720
- C:\Windows\System\AlaTjSY.exe
  C:\Windows\System\AlaTjSY.exe
  2⤵
  PID:9780
- C:\Windows\System\XHKmpNZ.exe
  C:\Windows\System\XHKmpNZ.exe
  2⤵
  PID:9768
- C:\Windows\System\VSGpOaD.exe
  C:\Windows\System\VSGpOaD.exe
  2⤵
  PID:9876
- C:\Windows\System\haRlrTp.exe
  C:\Windows\System\haRlrTp.exe
  2⤵
  PID:9844
- C:\Windows\System\xCCSYvC.exe
  C:\Windows\System\xCCSYvC.exe
  2⤵
  PID:10004
- C:\Windows\System\XpTenJp.exe
  C:\Windows\System\XpTenJp.exe
  2⤵
  PID:10044
- C:\Windows\System\ChZyKMb.exe
  C:\Windows\System\ChZyKMb.exe
  2⤵
  PID:10144
- C:\Windows\System\CZXKXHi.exe
  C:\Windows\System\CZXKXHi.exe
  2⤵
  PID:10196
- C:\Windows\System\XtRXycv.exe
  C:\Windows\System\XtRXycv.exe
  2⤵
  PID:10220
- C:\Windows\System\dxViRZD.exe
  C:\Windows\System\dxViRZD.exe
  2⤵
  PID:9268
- C:\Windows\System\ijRNykC.exe
  C:\Windows\System\ijRNykC.exe
  2⤵
  PID:9052
- C:\Windows\System\GlILimG.exe
  C:\Windows\System\GlILimG.exe
  2⤵
  PID:9332
- C:\Windows\System\LxIeVBm.exe
  C:\Windows\System\LxIeVBm.exe
  2⤵
  PID:9620
- C:\Windows\System\yutnESE.exe
  C:\Windows\System\yutnESE.exe
  2⤵
  PID:9988
- C:\Windows\System\FseqazM.exe
  C:\Windows\System\FseqazM.exe
  2⤵
  PID:10104
- C:\Windows\System\vNLkgjc.exe
  C:\Windows\System\vNLkgjc.exe
  2⤵
  PID:9908
- C:\Windows\System\nwVBSPO.exe
  C:\Windows\System\nwVBSPO.exe
  2⤵
  PID:10184
- C:\Windows\System\wPJfTdI.exe
  C:\Windows\System\wPJfTdI.exe
  2⤵
  PID:1736
- C:\Windows\System\XTnWyOe.exe
  C:\Windows\System\XTnWyOe.exe
  2⤵
  PID:9968
- C:\Windows\System\tvVghUh.exe
  C:\Windows\System\tvVghUh.exe
  2⤵
  PID:9384
- C:\Windows\System\ZkELjcZ.exe
  C:\Windows\System\ZkELjcZ.exe
  2⤵
  PID:10260
- C:\Windows\System\GtyqZFS.exe
  C:\Windows\System\GtyqZFS.exe
  2⤵
  PID:10296
- C:\Windows\System\ZowmHSF.exe
  C:\Windows\System\ZowmHSF.exe
  2⤵
  PID:10324
- C:\Windows\System\ZDiuiNQ.exe
  C:\Windows\System\ZDiuiNQ.exe
  2⤵
  PID:10356
- C:\Windows\System\BbQnbSk.exe
  C:\Windows\System\BbQnbSk.exe
  2⤵
  PID:10376
- C:\Windows\System\oENmgTi.exe
  C:\Windows\System\oENmgTi.exe
  2⤵
  PID:10408
- C:\Windows\System\ogJMinS.exe
  C:\Windows\System\ogJMinS.exe
  2⤵
  PID:10428
- C:\Windows\System\HpBPMlx.exe
  C:\Windows\System\HpBPMlx.exe
  2⤵
  PID:10456
- C:\Windows\System\GlnNgpD.exe
  C:\Windows\System\GlnNgpD.exe
  2⤵
  PID:10492
- C:\Windows\System\hWJGdkw.exe
  C:\Windows\System\hWJGdkw.exe
  2⤵
  PID:10516
- C:\Windows\System\dgItxXG.exe
  C:\Windows\System\dgItxXG.exe
  2⤵
  PID:10552
- C:\Windows\System\veKmIKJ.exe
  C:\Windows\System\veKmIKJ.exe
  2⤵
  PID:10584
- C:\Windows\System\ZpWBFUl.exe
  C:\Windows\System\ZpWBFUl.exe
  2⤵
  PID:10612
- C:\Windows\System\astSnzg.exe
  C:\Windows\System\astSnzg.exe
  2⤵
  PID:10648
- C:\Windows\System\OnuFOOi.exe
  C:\Windows\System\OnuFOOi.exe
  2⤵
  PID:10680
- C:\Windows\System\YfXDjmm.exe
  C:\Windows\System\YfXDjmm.exe
  2⤵
  PID:10712
- C:\Windows\System\vVItyLV.exe
  C:\Windows\System\vVItyLV.exe
  2⤵
  PID:10748
- C:\Windows\System\pQlMYBV.exe
  C:\Windows\System\pQlMYBV.exe
  2⤵
  PID:10788
- C:\Windows\System\CxsSSTr.exe
  C:\Windows\System\CxsSSTr.exe
  2⤵
  PID:10820
- C:\Windows\System\uMzQvKf.exe
  C:\Windows\System\uMzQvKf.exe
  2⤵
  PID:10836
- C:\Windows\System\mMcgARz.exe
  C:\Windows\System\mMcgARz.exe
  2⤵
  PID:10872
- C:\Windows\System\DcOanDN.exe
  C:\Windows\System\DcOanDN.exe
  2⤵
  PID:10908
- C:\Windows\System\bcfCOJc.exe
  C:\Windows\System\bcfCOJc.exe
  2⤵
  PID:10940
- C:\Windows\System\QCSGfhD.exe
  C:\Windows\System\QCSGfhD.exe
  2⤵
  PID:10960
- C:\Windows\System\LwOOUgI.exe
  C:\Windows\System\LwOOUgI.exe
  2⤵
  PID:10988
- C:\Windows\System\eEBJZiW.exe
  C:\Windows\System\eEBJZiW.exe
  2⤵
  PID:11016
- C:\Windows\System\gZaOrDK.exe
  C:\Windows\System\gZaOrDK.exe
  2⤵
  PID:11044
- C:\Windows\System\NTqXqaf.exe
  C:\Windows\System\NTqXqaf.exe
  2⤵
  PID:11076
- C:\Windows\System\VCuQWUH.exe
  C:\Windows\System\VCuQWUH.exe
  2⤵
  PID:11112
- C:\Windows\System\DIqhmkU.exe
  C:\Windows\System\DIqhmkU.exe
  2⤵
  PID:11144
- C:\Windows\System\YRLcAHf.exe
  C:\Windows\System\YRLcAHf.exe
  2⤵
  PID:11164
- C:\Windows\System\SZZHwhU.exe
  C:\Windows\System\SZZHwhU.exe
  2⤵
  PID:11192
- C:\Windows\System\MOYzWcu.exe
  C:\Windows\System\MOYzWcu.exe
  2⤵
  PID:11216
- C:\Windows\System\KbhfxlD.exe
  C:\Windows\System\KbhfxlD.exe
  2⤵
  PID:11244
- C:\Windows\System\cYpyrSn.exe
  C:\Windows\System\cYpyrSn.exe
  2⤵
  PID:9392
- C:\Windows\System\GqJNxsw.exe
  C:\Windows\System\GqJNxsw.exe
  2⤵
  PID:10112
- C:\Windows\System\qHAVsBA.exe
  C:\Windows\System\qHAVsBA.exe
  2⤵
  PID:9820
- C:\Windows\System\WmlrshG.exe
  C:\Windows\System\WmlrshG.exe
  2⤵
  PID:10368
- C:\Windows\System\JvqgsWK.exe
  C:\Windows\System\JvqgsWK.exe
  2⤵
  PID:10448
- C:\Windows\System\DVdFsMD.exe
  C:\Windows\System\DVdFsMD.exe
  2⤵
  PID:10336
- C:\Windows\System\EYSlHhB.exe
  C:\Windows\System\EYSlHhB.exe
  2⤵
  PID:10444
- C:\Windows\System\dTavUki.exe
  C:\Windows\System\dTavUki.exe
  2⤵
  PID:10420
- C:\Windows\System\glMUHEH.exe
  C:\Windows\System\glMUHEH.exe
  2⤵
  PID:10528
- C:\Windows\System\bDHWbNQ.exe
  C:\Windows\System\bDHWbNQ.exe
  2⤵
  PID:10704
- C:\Windows\System\FHxbkdz.exe
  C:\Windows\System\FHxbkdz.exe
  2⤵
  PID:10692
- C:\Windows\System\tDVExsn.exe
  C:\Windows\System\tDVExsn.exe
  2⤵
  PID:10744
- C:\Windows\System\IFcsqFM.exe
  C:\Windows\System\IFcsqFM.exe
  2⤵
  PID:10828
- C:\Windows\System\vqNLhhN.exe
  C:\Windows\System\vqNLhhN.exe
  2⤵
  PID:10932
- C:\Windows\System\zybKMYt.exe
  C:\Windows\System\zybKMYt.exe
  2⤵
  PID:10984
- C:\Windows\System\HyDtoWz.exe
  C:\Windows\System\HyDtoWz.exe
  2⤵
  PID:11004
- C:\Windows\System\StjRFfu.exe
  C:\Windows\System\StjRFfu.exe
  2⤵
  PID:11092
- C:\Windows\System\AakIjQN.exe
  C:\Windows\System\AakIjQN.exe
  2⤵
  PID:11180
- C:\Windows\System\RtLTxas.exe
  C:\Windows\System\RtLTxas.exe
  2⤵
  PID:10248
- C:\Windows\System\jSYFtac.exe
  C:\Windows\System\jSYFtac.exe
  2⤵
  PID:11240
- C:\Windows\System\AEjdKJG.exe
  C:\Windows\System\AEjdKJG.exe
  2⤵
  PID:10364
- C:\Windows\System\YcXyoso.exe
  C:\Windows\System\YcXyoso.exe
  2⤵
  PID:10440
- C:\Windows\System\ZwvtEZo.exe
  C:\Windows\System\ZwvtEZo.exe
  2⤵
  PID:10484
- C:\Windows\System\GfPvvHM.exe
  C:\Windows\System\GfPvvHM.exe
  2⤵
  PID:10724
- C:\Windows\System\lgSstTd.exe
  C:\Windows\System\lgSstTd.exe
  2⤵
  PID:10920
- C:\Windows\System\wDnnwQl.exe
  C:\Windows\System\wDnnwQl.exe
  2⤵
  PID:11136
- C:\Windows\System\QMnvdJs.exe
  C:\Windows\System\QMnvdJs.exe
  2⤵
  PID:10568
- C:\Windows\System\smCEeEC.exe
  C:\Windows\System\smCEeEC.exe
  2⤵
  PID:10860
- C:\Windows\System\yxTLQli.exe
  C:\Windows\System\yxTLQli.exe
  2⤵
  PID:10340
- C:\Windows\System\QNzrjAL.exe
  C:\Windows\System\QNzrjAL.exe
  2⤵
  PID:4272
- C:\Windows\System\ylELDVO.exe
  C:\Windows\System\ylELDVO.exe
  2⤵
  PID:11296
- C:\Windows\System\LIqdiMY.exe
  C:\Windows\System\LIqdiMY.exe
  2⤵
  PID:11328
- C:\Windows\System\wuNEnNC.exe
  C:\Windows\System\wuNEnNC.exe
  2⤵
  PID:11352
- C:\Windows\System\vuUulIO.exe
  C:\Windows\System\vuUulIO.exe
  2⤵
  PID:11372
- C:\Windows\System\zoOTkhY.exe
  C:\Windows\System\zoOTkhY.exe
  2⤵
  PID:11396
- C:\Windows\System\oJblRVE.exe
  C:\Windows\System\oJblRVE.exe
  2⤵
  PID:11436
- C:\Windows\System\hbLcIuw.exe
  C:\Windows\System\hbLcIuw.exe
  2⤵
  PID:11464
- C:\Windows\System\exlOmcf.exe
  C:\Windows\System\exlOmcf.exe
  2⤵
  PID:11484
- C:\Windows\System\itOIRfb.exe
  C:\Windows\System\itOIRfb.exe
  2⤵
  PID:11520
- C:\Windows\System\PkpTpLJ.exe
  C:\Windows\System\PkpTpLJ.exe
  2⤵
  PID:11536
- C:\Windows\System\byWMpRP.exe
  C:\Windows\System\byWMpRP.exe
  2⤵
  PID:11556
- C:\Windows\System\qICOWdQ.exe
  C:\Windows\System\qICOWdQ.exe
  2⤵
  PID:11576
- C:\Windows\System\PXPjIMO.exe
  C:\Windows\System\PXPjIMO.exe
  2⤵
  PID:11612
- C:\Windows\System\htOIlMZ.exe
  C:\Windows\System\htOIlMZ.exe
  2⤵
  PID:11648
- C:\Windows\System\rqMRRZb.exe
  C:\Windows\System\rqMRRZb.exe
  2⤵
  PID:11676
- C:\Windows\System\UxVuHvu.exe
  C:\Windows\System\UxVuHvu.exe
  2⤵
  PID:11708
- C:\Windows\System\ELUftYF.exe
  C:\Windows\System\ELUftYF.exe
  2⤵
  PID:11740
- C:\Windows\System\JBNSjwR.exe
  C:\Windows\System\JBNSjwR.exe
  2⤵
  PID:11764
- C:\Windows\System\OwfbaDg.exe
  C:\Windows\System\OwfbaDg.exe
  2⤵
  PID:11792
- C:\Windows\System\zPAPzCi.exe
  C:\Windows\System\zPAPzCi.exe
  2⤵
  PID:11832
- C:\Windows\System\OOclqnk.exe
  C:\Windows\System\OOclqnk.exe
  2⤵
  PID:11860
- C:\Windows\System\wsxXngT.exe
  C:\Windows\System\wsxXngT.exe
  2⤵
  PID:11880
- C:\Windows\System\WqXKpRq.exe
  C:\Windows\System\WqXKpRq.exe
  2⤵
  PID:11908
- C:\Windows\System\qJtzacK.exe
  C:\Windows\System\qJtzacK.exe
  2⤵
  PID:11932
- C:\Windows\System\hQkgyaw.exe
  C:\Windows\System\hQkgyaw.exe
  2⤵
  PID:11956
- C:\Windows\System\oiWFLSW.exe
  C:\Windows\System\oiWFLSW.exe
  2⤵
  PID:11980
- C:\Windows\System\JHxAxKN.exe
  C:\Windows\System\JHxAxKN.exe
  2⤵
  PID:12008
- C:\Windows\System\uBEsdFq.exe
  C:\Windows\System\uBEsdFq.exe
  2⤵
  PID:12040
- C:\Windows\System\uPRQWzu.exe
  C:\Windows\System\uPRQWzu.exe
  2⤵
  PID:12060
- C:\Windows\System\jMRmThJ.exe
  C:\Windows\System\jMRmThJ.exe
  2⤵
  PID:12080
- C:\Windows\System\KKyGXts.exe
  C:\Windows\System\KKyGXts.exe
  2⤵
  PID:12108
- C:\Windows\System\oxiTxtF.exe
  C:\Windows\System\oxiTxtF.exe
  2⤵
  PID:12132
- C:\Windows\System\TBvUPFM.exe
  C:\Windows\System\TBvUPFM.exe
  2⤵
  PID:12156
- C:\Windows\System\vCOhDZW.exe
  C:\Windows\System\vCOhDZW.exe
  2⤵
  PID:12176
- C:\Windows\System\qaviwaS.exe
  C:\Windows\System\qaviwaS.exe
  2⤵
  PID:12196
- C:\Windows\System\bUnrErC.exe
  C:\Windows\System\bUnrErC.exe
  2⤵
  PID:12220
- C:\Windows\System\WxlJgPr.exe
  C:\Windows\System\WxlJgPr.exe
  2⤵
  PID:12248
- C:\Windows\System\lnqQFzZ.exe
  C:\Windows\System\lnqQFzZ.exe
  2⤵
  PID:12280
- C:\Windows\System\EqqUlbH.exe
  C:\Windows\System\EqqUlbH.exe
  2⤵
  PID:10604
- C:\Windows\System\GZtSfQO.exe
  C:\Windows\System\GZtSfQO.exe
  2⤵
  PID:11348
- C:\Windows\System\xRPQfkk.exe
  C:\Windows\System\xRPQfkk.exe
  2⤵
  PID:11344
- C:\Windows\System\FsMdLyK.exe
  C:\Windows\System\FsMdLyK.exe
  2⤵
  PID:11392
- C:\Windows\System\LcdjCJP.exe
  C:\Windows\System\LcdjCJP.exe
  2⤵
  PID:11512
- C:\Windows\System\YOkdXGt.exe
  C:\Windows\System\YOkdXGt.exe
  2⤵
  PID:11500
- C:\Windows\System\XUuskiy.exe
  C:\Windows\System\XUuskiy.exe
  2⤵
  PID:11572
- C:\Windows\System\JRsiQvi.exe
  C:\Windows\System\JRsiQvi.exe
  2⤵
  PID:11684
- C:\Windows\System\AqeNhBK.exe
  C:\Windows\System\AqeNhBK.exe
  2⤵
  PID:11780
- C:\Windows\System\puSesJZ.exe
  C:\Windows\System\puSesJZ.exe
  2⤵
  PID:11788
- C:\Windows\System\nUzhbLi.exe
  C:\Windows\System\nUzhbLi.exe
  2⤵
  PID:11952
- C:\Windows\System\bTPVQmV.exe
  C:\Windows\System\bTPVQmV.exe
  2⤵
  PID:11900
- C:\Windows\System\GIntBjM.exe
  C:\Windows\System\GIntBjM.exe
  2⤵
  PID:12076
- C:\Windows\System\IwdVMQc.exe
  C:\Windows\System\IwdVMQc.exe
  2⤵
  PID:12144
- C:\Windows\System\jeKFtyB.exe
  C:\Windows\System\jeKFtyB.exe
  2⤵
  PID:12120
- C:\Windows\System\yBLclau.exe
  C:\Windows\System\yBLclau.exe
  2⤵
  PID:3340
- C:\Windows\System\gSIcezu.exe
  C:\Windows\System\gSIcezu.exe
  2⤵
  PID:12244
- C:\Windows\System\zfquBvp.exe
  C:\Windows\System\zfquBvp.exe
  2⤵
  PID:11452
- C:\Windows\System\YoifYQT.exe
  C:\Windows\System\YoifYQT.exe
  2⤵
  PID:11548
- C:\Windows\System\bLywAmf.exe
  C:\Windows\System\bLywAmf.exe
  2⤵
  PID:11600
- C:\Windows\System\kcDybso.exe
  C:\Windows\System\kcDybso.exe
  2⤵
  PID:11824
- C:\Windows\System\aONEwhO.exe
  C:\Windows\System\aONEwhO.exe
  2⤵
  PID:12068
- C:\Windows\System\AZvxyZU.exe
  C:\Windows\System\AZvxyZU.exe
  2⤵
  PID:12024
- C:\Windows\System\xjmMCiu.exe
  C:\Windows\System\xjmMCiu.exe
  2⤵
  PID:11592
- C:\Windows\System\DcRiTQf.exe
  C:\Windows\System\DcRiTQf.exe
  2⤵
  PID:11368
- C:\Windows\System\sWiLivn.exe
  C:\Windows\System\sWiLivn.exe
  2⤵
  PID:12300
- C:\Windows\System\lzuCMis.exe
  C:\Windows\System\lzuCMis.exe
  2⤵
  PID:12340
- C:\Windows\System\oJsCZIm.exe
  C:\Windows\System\oJsCZIm.exe
  2⤵
  PID:12360
- C:\Windows\System\zocGRdq.exe
  C:\Windows\System\zocGRdq.exe
  2⤵
  PID:12400
- C:\Windows\System\bzxgRLg.exe
  C:\Windows\System\bzxgRLg.exe
  2⤵
  PID:12428
- C:\Windows\System\FIxPQeL.exe
  C:\Windows\System\FIxPQeL.exe
  2⤵
  PID:12448
- C:\Windows\System\etlHPyI.exe
  C:\Windows\System\etlHPyI.exe
  2⤵
  PID:12484
- C:\Windows\System\BmAsDSD.exe
  C:\Windows\System\BmAsDSD.exe
  2⤵
  PID:12512
- C:\Windows\System\eRZuOZY.exe
  C:\Windows\System\eRZuOZY.exe
  2⤵
  PID:12536
- C:\Windows\System\FXVSzQo.exe
  C:\Windows\System\FXVSzQo.exe
  2⤵
  PID:12568
- C:\Windows\System\KSLliMd.exe
  C:\Windows\System\KSLliMd.exe
  2⤵
  PID:12600
- C:\Windows\System\kcODHeX.exe
  C:\Windows\System\kcODHeX.exe
  2⤵
  PID:12624
- C:\Windows\System\Qtgbcvv.exe
  C:\Windows\System\Qtgbcvv.exe
  2⤵
  PID:12640
- C:\Windows\System\VowakVf.exe
  C:\Windows\System\VowakVf.exe
  2⤵
  PID:12668
- C:\Windows\System\OHLlTUL.exe
  C:\Windows\System\OHLlTUL.exe
  2⤵
  PID:12704
- C:\Windows\System\PlFolNt.exe
  C:\Windows\System\PlFolNt.exe
  2⤵
  PID:12720
- C:\Windows\System\IORJGqx.exe
  C:\Windows\System\IORJGqx.exe
  2⤵
  PID:12748
- C:\Windows\System\YgbPxfW.exe
  C:\Windows\System\YgbPxfW.exe
  2⤵
  PID:12776
- C:\Windows\System\aCaYjUg.exe
  C:\Windows\System\aCaYjUg.exe
  2⤵
  PID:12808
- C:\Windows\System\ubvCrsc.exe
  C:\Windows\System\ubvCrsc.exe
  2⤵
  PID:12832
- C:\Windows\System\yZzicWi.exe
  C:\Windows\System\yZzicWi.exe
  2⤵
  PID:12860
- C:\Windows\System\WAueqJg.exe
  C:\Windows\System\WAueqJg.exe
  2⤵
  PID:12880
- C:\Windows\System\eWjXoIV.exe
  C:\Windows\System\eWjXoIV.exe
  2⤵
  PID:12900
- C:\Windows\System\bFCkPcG.exe
  C:\Windows\System\bFCkPcG.exe
  2⤵
  PID:12928
- C:\Windows\System\RnVRUgN.exe
  C:\Windows\System\RnVRUgN.exe
  2⤵
  PID:12952
- C:\Windows\System\ldUxULq.exe
  C:\Windows\System\ldUxULq.exe
  2⤵
  PID:13044
- C:\Windows\System\LAjjbHN.exe
  C:\Windows\System\LAjjbHN.exe
  2⤵
  PID:13080
- C:\Windows\System\DkRXeGB.exe
  C:\Windows\System\DkRXeGB.exe
  2⤵
  PID:13112
- C:\Windows\System\OVANHjN.exe
  C:\Windows\System\OVANHjN.exe
  2⤵
  PID:13140
- C:\Windows\System\XvmVoop.exe
  C:\Windows\System\XvmVoop.exe
  2⤵
  PID:13168
- C:\Windows\System\KqfFtxH.exe
  C:\Windows\System\KqfFtxH.exe
  2⤵
  PID:13196
- C:\Windows\System\uAIDBYh.exe
  C:\Windows\System\uAIDBYh.exe
  2⤵
  PID:13216
- C:\Windows\System\awUzfKl.exe
  C:\Windows\System\awUzfKl.exe
  2⤵
  PID:13236
- C:\Windows\System\VGJcPFC.exe
  C:\Windows\System\VGJcPFC.exe
  2⤵
  PID:13252
- C:\Windows\System\AnEXjmp.exe
  C:\Windows\System\AnEXjmp.exe
  2⤵
  PID:13292
- C:\Windows\System\pAzyPLw.exe
  C:\Windows\System\pAzyPLw.exe
  2⤵
  PID:12228
- C:\Windows\System\jHPrUlt.exe
  C:\Windows\System\jHPrUlt.exe
  2⤵
  PID:12020
- C:\Windows\System\qEjKPCK.exe
  C:\Windows\System\qEjKPCK.exe
  2⤵
  PID:11628
- C:\Windows\System\GdfjGIp.exe
  C:\Windows\System\GdfjGIp.exe
  2⤵
  PID:12472
- C:\Windows\System\EDwTRYM.exe
  C:\Windows\System\EDwTRYM.exe
  2⤵
  PID:12416
- C:\Windows\System\xROQUCV.exe
  C:\Windows\System\xROQUCV.exe
  2⤵
  PID:12476
- C:\Windows\System\VQkaaLQ.exe
  C:\Windows\System\VQkaaLQ.exe
  2⤵
  PID:12592
- C:\Windows\System\GkYrXSO.exe
  C:\Windows\System\GkYrXSO.exe
  2⤵
  PID:12548
- C:\Windows\System\nQcjXgH.exe
  C:\Windows\System\nQcjXgH.exe
  2⤵
  PID:12772
- C:\Windows\System\TXcevab.exe
  C:\Windows\System\TXcevab.exe
  2⤵
  PID:12680
- C:\Windows\System\dxktJIA.exe
  C:\Windows\System\dxktJIA.exe
  2⤵
  PID:12632
- C:\Windows\System\DUKWENz.exe
  C:\Windows\System\DUKWENz.exe
  2⤵
  PID:12960
- C:\Windows\System\XUCZFYd.exe
  C:\Windows\System\XUCZFYd.exe
  2⤵
  PID:12948
- C:\Windows\System\DFQeJmf.exe
  C:\Windows\System\DFQeJmf.exe
  2⤵
  PID:12968
- C:\Windows\System\KTqPjDH.exe
  C:\Windows\System\KTqPjDH.exe
  2⤵
  PID:13000
- C:\Windows\System\wwdiJKK.exe
  C:\Windows\System\wwdiJKK.exe
  2⤵
  PID:13104
- C:\Windows\System\JGbqcau.exe
  C:\Windows\System\JGbqcau.exe
  2⤵
  PID:13204
- C:\Windows\System\VMIhoIh.exe
  C:\Windows\System\VMIhoIh.exe
  2⤵
  PID:13228
- C:\Windows\System\VemqwIN.exe
  C:\Windows\System\VemqwIN.exe
  2⤵
  PID:11724
- C:\Windows\System\QSwZueB.exe
  C:\Windows\System\QSwZueB.exe
  2⤵
  PID:12564
- C:\Windows\System\qnFBzMY.exe
  C:\Windows\System\qnFBzMY.exe
  2⤵
  PID:12532
- C:\Windows\System\dduesId.exe
  C:\Windows\System\dduesId.exe
  2⤵
  PID:12700
- C:\Windows\System\VOEnQXv.exe
  C:\Windows\System\VOEnQXv.exe
  2⤵
  PID:12964
- C:\Windows\System\nfKBbye.exe
  C:\Windows\System\nfKBbye.exe
  2⤵
  PID:13028
- C:\Windows\System\sXuJbsT.exe
  C:\Windows\System\sXuJbsT.exe
  2⤵
  PID:13192
- C:\Windows\System\GmPLpJY.exe
  C:\Windows\System\GmPLpJY.exe
  2⤵
  PID:13284
- C:\Windows\System\dUsEFno.exe
  C:\Windows\System\dUsEFno.exe
  2⤵
  PID:11460
- C:\Windows\System\BGOWthi.exe
  C:\Windows\System\BGOWthi.exe
  2⤵
  PID:12324
- C:\Windows\System\SReAeex.exe
  C:\Windows\System\SReAeex.exe
  2⤵
  PID:12272
- C:\Windows\System\JLWUozW.exe
  C:\Windows\System\JLWUozW.exe
  2⤵
  PID:12888
- C:\Windows\System\eaYrFjP.exe
  C:\Windows\System\eaYrFjP.exe
  2⤵
  PID:13328
- C:\Windows\System\yDzSaPW.exe
  C:\Windows\System\yDzSaPW.exe
  2⤵
  PID:13356
- C:\Windows\System\eFAARXy.exe
  C:\Windows\System\eFAARXy.exe
  2⤵
  PID:13380
- C:\Windows\System\uBpiRKs.exe
  C:\Windows\System\uBpiRKs.exe
  2⤵
  PID:13412
- C:\Windows\System\PAasBEZ.exe
  C:\Windows\System\PAasBEZ.exe
  2⤵
  PID:13448
- C:\Windows\System\OKpwwjo.exe
  C:\Windows\System\OKpwwjo.exe
  2⤵
  PID:13488
- C:\Windows\System\uIYOlkb.exe
  C:\Windows\System\uIYOlkb.exe
  2⤵
  PID:13520
- C:\Windows\System\VYLuErA.exe
  C:\Windows\System\VYLuErA.exe
  2⤵
  PID:13544
- C:\Windows\System\yLHnppb.exe
  C:\Windows\System\yLHnppb.exe
  2⤵
  PID:13576
- C:\Windows\System\ssxkaHU.exe
  C:\Windows\System\ssxkaHU.exe
  2⤵
  PID:13600
- C:\Windows\System\qdDvDDH.exe
  C:\Windows\System\qdDvDDH.exe
  2⤵
  PID:13620
- C:\Windows\System\wryEbSM.exe
  C:\Windows\System\wryEbSM.exe
  2⤵
  PID:13648
- C:\Windows\System\LxWNLMe.exe
  C:\Windows\System\LxWNLMe.exe
  2⤵
  PID:13668
- C:\Windows\System\BHyUEUy.exe
  C:\Windows\System\BHyUEUy.exe
  2⤵
  PID:13692
- C:\Windows\System\xvlKZQx.exe
  C:\Windows\System\xvlKZQx.exe
  2⤵
  PID:13716
- C:\Windows\System\ZbKhyuX.exe
  C:\Windows\System\ZbKhyuX.exe
  2⤵
  PID:13756
- C:\Windows\System\ZiSyhHh.exe
  C:\Windows\System\ZiSyhHh.exe
  2⤵
  PID:13788
- C:\Windows\System\WecTiGq.exe
  C:\Windows\System\WecTiGq.exe
  2⤵
  PID:13816
- C:\Windows\System\yOExbfX.exe
  C:\Windows\System\yOExbfX.exe
  2⤵
  PID:13840
- C:\Windows\System\PECrJdb.exe
  C:\Windows\System\PECrJdb.exe
  2⤵
  PID:13872
- C:\Windows\System\LGBFASH.exe
  C:\Windows\System\LGBFASH.exe
  2⤵
  PID:13900
- C:\Windows\System\HVshUoZ.exe
  C:\Windows\System\HVshUoZ.exe
  2⤵
  PID:13936
- C:\Windows\System\uqcoiKe.exe
  C:\Windows\System\uqcoiKe.exe
  2⤵
  PID:13960
- C:\Windows\System\fpyQwCv.exe
  C:\Windows\System\fpyQwCv.exe
  2⤵
  PID:13992
- C:\Windows\System\QMMdyTV.exe
  C:\Windows\System\QMMdyTV.exe
  2⤵
  PID:14020
- C:\Windows\System\FqyQpDv.exe
  C:\Windows\System\FqyQpDv.exe
  2⤵
  PID:14040
- C:\Windows\System\RZiaBUL.exe
  C:\Windows\System\RZiaBUL.exe
  2⤵
  PID:14060
- C:\Windows\System\POPIFhO.exe
  C:\Windows\System\POPIFhO.exe
  2⤵
  PID:14084
- C:\Windows\System\gqHTESu.exe
  C:\Windows\System\gqHTESu.exe
  2⤵
  PID:14108
- C:\Windows\System\yCYjTZr.exe
  C:\Windows\System\yCYjTZr.exe
  2⤵
  PID:14132
- C:\Windows\System\JMpusek.exe
  C:\Windows\System\JMpusek.exe
  2⤵
  PID:14160
- C:\Windows\System\IreEEJY.exe
  C:\Windows\System\IreEEJY.exe
  2⤵
  PID:14176
- C:\Windows\System\lEPKkmO.exe
  C:\Windows\System\lEPKkmO.exe
  2⤵
  PID:14204
- C:\Windows\System\txgvRVI.exe
  C:\Windows\System\txgvRVI.exe
  2⤵
  PID:14220
- C:\Windows\System\YxzwUJA.exe
  C:\Windows\System\YxzwUJA.exe
  2⤵
  PID:14248
- C:\Windows\System\AZflPUB.exe
  C:\Windows\System\AZflPUB.exe
  2⤵
  PID:14268
- C:\Windows\System\OhKTLTc.exe
  C:\Windows\System\OhKTLTc.exe
  2⤵
  PID:14288
- C:\Windows\System\lZXRsZG.exe
  C:\Windows\System\lZXRsZG.exe
  2⤵
  PID:14312
- C:\Windows\System\rZGMaZj.exe
  C:\Windows\System\rZGMaZj.exe
  2⤵
  PID:14332
- C:\Windows\System\lwAXTRu.exe
  C:\Windows\System\lwAXTRu.exe
  2⤵
  PID:12716
- C:\Windows\System\nYHiytJ.exe
  C:\Windows\System\nYHiytJ.exe
  2⤵
  PID:13408
- C:\Windows\System\GPdmiMp.exe
  C:\Windows\System\GPdmiMp.exe
  2⤵
  PID:13480
- C:\Windows\System\DDbbLYa.exe
  C:\Windows\System\DDbbLYa.exe
  2⤵
  PID:13376
- C:\Windows\System\fSjZgKO.exe
  C:\Windows\System\fSjZgKO.exe
  2⤵
  PID:13588
- C:\Windows\System\LGzSlYh.exe
  C:\Windows\System\LGzSlYh.exe
  2⤵
  PID:13584
- C:\Windows\System\nBDAwPc.exe
  C:\Windows\System\nBDAwPc.exe
  2⤵
  PID:13772
- C:\Windows\System\QRyUtLt.exe
  C:\Windows\System\QRyUtLt.exe
  2⤵
  PID:13708
- C:\Windows\System\hInSQGF.exe
  C:\Windows\System\hInSQGF.exe
  2⤵
  PID:13864
- C:\Windows\System\qsITXKG.exe
  C:\Windows\System\qsITXKG.exe
  2⤵
  PID:13928
- C:\Windows\System\EwjTlZW.exe
  C:\Windows\System\EwjTlZW.exe
  2⤵
  PID:13884
- C:\Windows\System\WppTdyK.exe
  C:\Windows\System\WppTdyK.exe
  2⤵
  PID:14096
- C:\Windows\System\pWaTNru.exe
  C:\Windows\System\pWaTNru.exe
  2⤵
  PID:14004
- C:\Windows\System\fifJVvf.exe
  C:\Windows\System\fifJVvf.exe
  2⤵
  PID:14012
- C:\Windows\System\gMFMyai.exe
  C:\Windows\System\gMFMyai.exe
  2⤵
  PID:14240
- C:\Windows\System\yggxoMD.exe
  C:\Windows\System\yggxoMD.exe
  2⤵
  PID:14200
- C:\Windows\System\cfwfdrN.exe
  C:\Windows\System\cfwfdrN.exe
  2⤵
  PID:13232
- C:\Windows\System\JOCOotM.exe
  C:\Windows\System\JOCOotM.exe
  2⤵
  PID:14212
- C:\Windows\System\oajIEID.exe
  C:\Windows\System\oajIEID.exe
  2⤵
  PID:14296
- C:\Windows\System\kCRBMJI.exe
  C:\Windows\System\kCRBMJI.exe
  2⤵
  PID:13736
- C:\Windows\System\RQUeVlc.exe
  C:\Windows\System\RQUeVlc.exe
  2⤵
  PID:13892
- C:\Windows\System\aUDYiKb.exe
  C:\Windows\System\aUDYiKb.exe
  2⤵
  PID:13808
- C:\Windows\System\uKRcFeQ.exe
  C:\Windows\System\uKRcFeQ.exe
  2⤵
  PID:14120
- C:\Windows\System\HcLcRDd.exe
  C:\Windows\System\HcLcRDd.exe
  2⤵
  PID:13556
- C:\Windows\System\FMAZQwJ.exe
  C:\Windows\System\FMAZQwJ.exe
  2⤵
  PID:14364
- C:\Windows\System\pTNXRbr.exe
  C:\Windows\System\pTNXRbr.exe
  2⤵
  PID:14396
- C:\Windows\System\jQHMlnO.exe
  C:\Windows\System\jQHMlnO.exe
  2⤵
  PID:14428
- C:\Windows\System\xKlIkqE.exe
  C:\Windows\System\xKlIkqE.exe
  2⤵
  PID:14464
- C:\Windows\System\GNgpAAl.exe
  C:\Windows\System\GNgpAAl.exe
  2⤵
  PID:14488
- C:\Windows\System\ikjOdbH.exe
  C:\Windows\System\ikjOdbH.exe
  2⤵
  PID:14508
- C:\Windows\System\sNcTycu.exe
  C:\Windows\System\sNcTycu.exe
  2⤵
  PID:14532
- C:\Windows\System\GfTuwHk.exe
  C:\Windows\System\GfTuwHk.exe
  2⤵
  PID:14556
- C:\Windows\System\NDKvVnH.exe
  C:\Windows\System\NDKvVnH.exe
  2⤵
  PID:14588
- C:\Windows\System\JswfDtG.exe
  C:\Windows\System\JswfDtG.exe
  2⤵
  PID:14608
- C:\Windows\System\rxwDonL.exe
  C:\Windows\System\rxwDonL.exe
  2⤵
  PID:14636
- C:\Windows\System\kidQGjp.exe
  C:\Windows\System\kidQGjp.exe
  2⤵
  PID:14668
- C:\Windows\System\qWDTtzi.exe
  C:\Windows\System\qWDTtzi.exe
  2⤵
  PID:14692
- C:\Windows\System\plalPZN.exe
  C:\Windows\System\plalPZN.exe
  2⤵
  PID:14708
- C:\Windows\System\eJBiWca.exe
  C:\Windows\System\eJBiWca.exe
  2⤵
  PID:14740
- C:\Windows\System\AuZepmF.exe
  C:\Windows\System\AuZepmF.exe
  2⤵
  PID:14776
- C:\Windows\System\JPLtcsN.exe
  C:\Windows\System\JPLtcsN.exe
  2⤵
  PID:14800
- C:\Windows\System\NpfvRCs.exe
  C:\Windows\System\NpfvRCs.exe
  2⤵
  PID:14828
- C:\Windows\System\ierLKNA.exe
  C:\Windows\System\ierLKNA.exe
  2⤵
  PID:14868
- C:\Windows\System\mAiYZQl.exe
  C:\Windows\System\mAiYZQl.exe
  2⤵
  PID:14892
- C:\Windows\System\SwMmpgh.exe
  C:\Windows\System\SwMmpgh.exe
  2⤵
  PID:14912
- C:\Windows\System\nwhXcwB.exe
  C:\Windows\System\nwhXcwB.exe
  2⤵
  PID:14944
- C:\Windows\System\SzAaBEG.exe
  C:\Windows\System\SzAaBEG.exe
  2⤵
  PID:14976
- C:\Windows\System\btVwgVU.exe
  C:\Windows\System\btVwgVU.exe
  2⤵
  PID:15004
- C:\Windows\System\OvQfCOM.exe
  C:\Windows\System\OvQfCOM.exe
  2⤵
  PID:15020
- C:\Windows\System\VNvTEks.exe
  C:\Windows\System\VNvTEks.exe
  2⤵
  PID:15044
- C:\Windows\System\UvhnmrE.exe
  C:\Windows\System\UvhnmrE.exe
  2⤵
  PID:15072
- C:\Windows\System\SaIaeYY.exe
  C:\Windows\System\SaIaeYY.exe
  2⤵
  PID:15108
- C:\Windows\System\zxSVEPB.exe
  C:\Windows\System\zxSVEPB.exe
  2⤵
  PID:15136
- C:\Windows\System\FNmtSaW.exe
  C:\Windows\System\FNmtSaW.exe
  2⤵
  PID:15176
- C:\Windows\System\hnEsVRv.exe
  C:\Windows\System\hnEsVRv.exe
  2⤵
  PID:15208
- C:\Windows\System\lZhMDXI.exe
  C:\Windows\System\lZhMDXI.exe
  2⤵
  PID:15240
- C:\Windows\System\TGqeThG.exe
  C:\Windows\System\TGqeThG.exe
  2⤵
  PID:15272
- C:\Windows\System\wcfohiy.exe
  C:\Windows\System\wcfohiy.exe
  2⤵
  PID:15308
- C:\Windows\System\TmcGRCd.exe
  C:\Windows\System\TmcGRCd.exe
  2⤵
  PID:15340
- C:\Windows\System\XOZBYlg.exe
  C:\Windows\System\XOZBYlg.exe
  2⤵
  PID:13676
- C:\Windows\System\cguWPuz.exe
  C:\Windows\System\cguWPuz.exe
  2⤵
  PID:14284
- C:\Windows\System\azilOxl.exe
  C:\Windows\System\azilOxl.exe
  2⤵
  PID:14412
- C:\Windows\System\LSSuKNc.exe
  C:\Windows\System\LSSuKNc.exe
  2⤵
  PID:14304
- C:\Windows\System\QhXgjpv.exe
  C:\Windows\System\QhXgjpv.exe
  2⤵
  PID:14344
- C:\Windows\System\MzEuduP.exe
  C:\Windows\System\MzEuduP.exe
  2⤵
  PID:14520
- C:\Windows\System\wmatbMD.exe
  C:\Windows\System\wmatbMD.exe
  2⤵
  PID:14476
- C:\Windows\System\rGHejbT.exe
  C:\Windows\System\rGHejbT.exe
  2⤵
  PID:14660
- C:\Windows\System\HhsAwCo.exe
  C:\Windows\System\HhsAwCo.exe
  2⤵
  PID:14704
- C:\Windows\System\zzGwYCP.exe
  C:\Windows\System\zzGwYCP.exe
  2⤵
  PID:14616
- C:\Windows\System\hyjhaNR.exe
  C:\Windows\System\hyjhaNR.exe
  2⤵
  PID:14764
- C:\Windows\System\mcLNgdD.exe
  C:\Windows\System\mcLNgdD.exe
  2⤵
  PID:14812
- C:\Windows\System\bCFqBJq.exe
  C:\Windows\System\bCFqBJq.exe
  2⤵
  PID:14628
- C:\Windows\System\ISDWiHq.exe
  C:\Windows\System\ISDWiHq.exe
  2⤵
  PID:14968
- C:\Windows\System\dqFyqxC.exe
  C:\Windows\System\dqFyqxC.exe
  2⤵
  PID:14788
- C:\Windows\System\pQvtrdl.exe
  C:\Windows\System\pQvtrdl.exe
  2⤵
  PID:14836
- C:\Windows\System\WXsZUfG.exe
  C:\Windows\System\WXsZUfG.exe
  2⤵
  PID:14908
- C:\Windows\System\TtwoSyN.exe
  C:\Windows\System\TtwoSyN.exe
  2⤵
  PID:15216
- C:\Windows\System\KZOIRMx.exe
  C:\Windows\System\KZOIRMx.exe
  2⤵
  PID:15132
- C:\Windows\System\KwhvnJP.exe
  C:\Windows\System\KwhvnJP.exe
  2⤵
  PID:15188
- C:\Windows\System\RvbQMID.exe
  C:\Windows\System\RvbQMID.exe
  2⤵
  PID:15264
- C:\Windows\System\iZCgAPD.exe
  C:\Windows\System\iZCgAPD.exe
  2⤵
  PID:14528
- C:\Windows\System\rPKvYHO.exe
  C:\Windows\System\rPKvYHO.exe
  2⤵
  PID:13440
- C:\Windows\System\FhRinUU.exe
  C:\Windows\System\FhRinUU.exe
  2⤵
  PID:14448
- C:\Windows\System\odKdMDF.exe
  C:\Windows\System\odKdMDF.exe
  2⤵
  PID:14484
- C:\Windows\System\VgxPisk.exe
  C:\Windows\System\VgxPisk.exe
  2⤵
  PID:14992
- C:\Windows\System\cjCZlHZ.exe
  C:\Windows\System\cjCZlHZ.exe
  2⤵
  PID:14824
- C:\Windows\System\yoTXxAf.exe
  C:\Windows\System\yoTXxAf.exe
  2⤵
  PID:15368
- C:\Windows\System\zkDUkll.exe
  C:\Windows\System\zkDUkll.exe
  2⤵
  PID:15396
- C:\Windows\System\BASfGEH.exe
  C:\Windows\System\BASfGEH.exe
  2⤵
  PID:15416
- C:\Windows\System\CulZWbU.exe
  C:\Windows\System\CulZWbU.exe
  2⤵
  PID:15440
- C:\Windows\System\ttQyOQJ.exe
  C:\Windows\System\ttQyOQJ.exe
  2⤵
  PID:15464
- C:\Windows\System\YXbMgjh.exe
  C:\Windows\System\YXbMgjh.exe
  2⤵
  PID:15484
- C:\Windows\System\RfnMoKb.exe
  C:\Windows\System\RfnMoKb.exe
  2⤵
  PID:15516
- C:\Windows\System\wXCgHZb.exe
  C:\Windows\System\wXCgHZb.exe
  2⤵
  PID:15544
- C:\Windows\System\RFLNgAt.exe
  C:\Windows\System\RFLNgAt.exe
  2⤵
  PID:15568
- C:\Windows\System\AgOCTZX.exe
  C:\Windows\System\AgOCTZX.exe
  2⤵
  PID:15588
- C:\Windows\System\wWGRYBm.exe
  C:\Windows\System\wWGRYBm.exe
  2⤵
  PID:15604
- C:\Windows\System\GvgdlJr.exe
  C:\Windows\System\GvgdlJr.exe
  2⤵
  PID:15636
- C:\Windows\System\GaZvjJE.exe
  C:\Windows\System\GaZvjJE.exe
  2⤵
  PID:15656
- C:\Windows\System\SCwhqsX.exe
  C:\Windows\System\SCwhqsX.exe
  2⤵
  PID:15684
- C:\Windows\System\CHnsgVN.exe
  C:\Windows\System\CHnsgVN.exe
  2⤵
  PID:15708
- C:\Windows\System\DJmtyLb.exe
  C:\Windows\System\DJmtyLb.exe
  2⤵
  PID:15728
- C:\Windows\System\KsOWkQn.exe
  C:\Windows\System\KsOWkQn.exe
  2⤵
  PID:15748
- C:\Windows\System\WCDlhJb.exe
  C:\Windows\System\WCDlhJb.exe
  2⤵
  PID:15768
- C:\Windows\System\pIOKxEl.exe
  C:\Windows\System\pIOKxEl.exe
  2⤵
  PID:15800
- C:\Windows\System\vvggQUl.exe
  C:\Windows\System\vvggQUl.exe
  2⤵
  PID:15828
- C:\Windows\System\byUfNKZ.exe
  C:\Windows\System\byUfNKZ.exe
  2⤵
  PID:15856
- C:\Windows\System\uFmkRTi.exe
  C:\Windows\System\uFmkRTi.exe
  2⤵
  PID:15880
- C:\Windows\System\XyRweXp.exe
  C:\Windows\System\XyRweXp.exe
  2⤵
  PID:15904
- C:\Windows\System\ntKfPUT.exe
  C:\Windows\System\ntKfPUT.exe
  2⤵
  PID:15936
- C:\Windows\System\TxXuCzY.exe
  C:\Windows\System\TxXuCzY.exe
  2⤵
  PID:15968
- C:\Windows\System\PZlJbLW.exe
  C:\Windows\System\PZlJbLW.exe
  2⤵
  PID:15996
- C:\Windows\System\pdHHqLQ.exe
  C:\Windows\System\pdHHqLQ.exe
  2⤵
  PID:16024
- C:\Windows\System\bXMgKcp.exe
  C:\Windows\System\bXMgKcp.exe
  2⤵
  PID:16052
- C:\Windows\System\vsKOYSc.exe
  C:\Windows\System\vsKOYSc.exe
  2⤵
  PID:16080
- C:\Windows\System\IvIuRtg.exe
  C:\Windows\System\IvIuRtg.exe
  2⤵
  PID:16104
- C:\Windows\System\EqUCPpY.exe
  C:\Windows\System\EqUCPpY.exe
  2⤵
  PID:16136
- C:\Windows\System\GMWALYS.exe
  C:\Windows\System\GMWALYS.exe
  2⤵
  PID:16152
- C:\Windows\System\KpEvvAV.exe
  C:\Windows\System\KpEvvAV.exe
  2⤵
  PID:16180
- C:\Windows\System\oMQgKAZ.exe
  C:\Windows\System\oMQgKAZ.exe
  2⤵
  PID:16208
- C:\Windows\System\twAQYnn.exe
  C:\Windows\System\twAQYnn.exe
  2⤵
  PID:16240
- C:\Windows\System\MyjoCxM.exe
  C:\Windows\System\MyjoCxM.exe
  2⤵
  PID:16272
- C:\Windows\System\oaarIxx.exe
  C:\Windows\System\oaarIxx.exe
  2⤵
  PID:16300
- C:\Windows\System\LiMkJTD.exe
  C:\Windows\System\LiMkJTD.exe
  2⤵
  PID:16316
- C:\Windows\System\lsvajrK.exe
  C:\Windows\System\lsvajrK.exe
  2⤵
  PID:16356
- C:\Windows\System\LcDobZB.exe
  C:\Windows\System\LcDobZB.exe
  2⤵
  PID:16376
- C:\Windows\System\yJIlApg.exe
  C:\Windows\System\yJIlApg.exe
  2⤵
  PID:15100
- C:\Windows\System\DCXncZs.exe
  C:\Windows\System\DCXncZs.exe
  2⤵
  PID:15320
- C:\Windows\System\kxMmNUn.exe
  C:\Windows\System\kxMmNUn.exe
  2⤵
  PID:15116
- C:\Windows\System\CqDWXVq.exe
  C:\Windows\System\CqDWXVq.exe
  2⤵
  PID:15460
- C:\Windows\System\cVSKaYU.exe
  C:\Windows\System\cVSKaYU.exe
  2⤵
  PID:15388
- C:\Windows\System\XcZWseV.exe
  C:\Windows\System\XcZWseV.exe
  2⤵
  PID:15432
- C:\Windows\System\IlLhlNk.exe
  C:\Windows\System\IlLhlNk.exe
  2⤵
  PID:14552
- C:\Windows\System\fmUDyAJ.exe
  C:\Windows\System\fmUDyAJ.exe
  2⤵
  PID:15580
- C:\Windows\System\yMmpQyj.exe
  C:\Windows\System\yMmpQyj.exe
  2⤵
  PID:15628
- C:\Windows\System\AuTOBrc.exe
  C:\Windows\System\AuTOBrc.exe
  2⤵
  PID:15788
- C:\Windows\System\uIsguZS.exe
  C:\Windows\System\uIsguZS.exe
  2⤵
  PID:15560
- C:\Windows\System\iyZEWIL.exe
  C:\Windows\System\iyZEWIL.exe
  2⤵
  PID:15888
- C:\Windows\System\dosYXDT.exe
  C:\Windows\System\dosYXDT.exe
  2⤵
  PID:15980
- C:\Windows\System\ygMLNDp.exe
  C:\Windows\System\ygMLNDp.exe
  2⤵
  PID:16048
- C:\Windows\System\kSoHbQh.exe
  C:\Windows\System\kSoHbQh.exe
  2⤵
  PID:15944
- C:\Windows\System\oYJIKfC.exe
  C:\Windows\System\oYJIKfC.exe
  2⤵
  PID:16196
- C:\Windows\System\eSnnwEG.exe
  C:\Windows\System\eSnnwEG.exe
  2⤵
  PID:15916
- C:\Windows\System\tsldtAp.exe
  C:\Windows\System\tsldtAp.exe
  2⤵
  PID:16332
- C:\Windows\System\FyiyhdB.exe
  C:\Windows\System\FyiyhdB.exe
  2⤵
  PID:16164
- C:\Windows\System\nPGbVRm.exe
  C:\Windows\System\nPGbVRm.exe
  2⤵
  PID:15204
- C:\Windows\System\eYZSYpo.exe
  C:\Windows\System\eYZSYpo.exe
  2⤵
  PID:13688
- C:\Windows\System\EzgajTp.exe
  C:\Windows\System\EzgajTp.exe
  2⤵
  PID:15456
- C:\Windows\System\oGsqXsm.exe
  C:\Windows\System\oGsqXsm.exe
  2⤵
  PID:15648
- C:\Windows\System\tOHSjlm.exe
  C:\Windows\System\tOHSjlm.exe
  2⤵
  PID:15500
- C:\Windows\System\IbIKBtn.exe
  C:\Windows\System\IbIKBtn.exe
  2⤵
  PID:14356
- C:\Windows\System\gKyJruL.exe
  C:\Windows\System\gKyJruL.exe
  2⤵
  PID:14748
- C:\Windows\System\qwuhCdn.exe
  C:\Windows\System\qwuhCdn.exe
  2⤵
  PID:15556
- C:\Windows\System\FLYuvam.exe
  C:\Windows\System\FLYuvam.exe
  2⤵
  PID:16340
- C:\Windows\System\CFmxGHf.exe
  C:\Windows\System\CFmxGHf.exe
  2⤵
  PID:16404
- C:\Windows\System\HAygHyu.exe
  C:\Windows\System\HAygHyu.exe
  2⤵
  PID:16432
- C:\Windows\System\ZukdwHu.exe
  C:\Windows\System\ZukdwHu.exe
  2⤵
  PID:16452
- C:\Windows\System\uGSDHwb.exe
  C:\Windows\System\uGSDHwb.exe
  2⤵
  PID:16476
- C:\Windows\System\XjsOqMN.exe
  C:\Windows\System\XjsOqMN.exe
  2⤵
  PID:16496
- C:\Windows\System\IWjPWum.exe
  C:\Windows\System\IWjPWum.exe
  2⤵
  PID:16536
- C:\Windows\System\QAPDAkL.exe
  C:\Windows\System\QAPDAkL.exe
  2⤵
  PID:16556
- C:\Windows\System\OjbifJB.exe
  C:\Windows\System\OjbifJB.exe
  2⤵
  PID:16588
- C:\Windows\System\JXOPZVZ.exe
  C:\Windows\System\JXOPZVZ.exe
  2⤵
  PID:16620
- C:\Windows\System\cmsPRWY.exe
  C:\Windows\System\cmsPRWY.exe
  2⤵
  PID:16640
- C:\Windows\System\YWeoryh.exe
  C:\Windows\System\YWeoryh.exe
  2⤵
  PID:17016
- C:\Windows\System\xsIjjzo.exe
  C:\Windows\System\xsIjjzo.exe
  2⤵
  PID:17032
- C:\Windows\System\XJHuujN.exe
  C:\Windows\System\XJHuujN.exe
  2⤵
  PID:17060
- C:\Windows\System\axZGFCS.exe
  C:\Windows\System\axZGFCS.exe
  2⤵
  PID:17080
- C:\Windows\System\evOHsll.exe
  C:\Windows\System\evOHsll.exe
  2⤵
  PID:17104
- C:\Windows\System\TBsylja.exe
  C:\Windows\System\TBsylja.exe
  2⤵
  PID:17120
- C:\Windows\System\YRVsKoo.exe
  C:\Windows\System\YRVsKoo.exe
  2⤵
  PID:17156
- C:\Windows\System\ePmVXXG.exe
  C:\Windows\System\ePmVXXG.exe
  2⤵
  PID:17176
- C:\Windows\System\yiNpnpl.exe
  C:\Windows\System\yiNpnpl.exe
  2⤵
  PID:17192

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:15700

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\DcxdtSX.exe

Filesize
1.5MB

MD5
99ca868765ec51aba1f7c5a39324c10b

SHA1
e1c5af81f86ce6248dae61bda718fc89ce63535f

SHA256
fdc7d78ce148a213af20dac782289b2419d1cff5e5fa6bd8462d3b666ad83121

SHA512
7ef567d29dc66a4773c267f1dc977540923a0f335871e7f5782d732c56c41149fb1605ed1d8d6e9fd66f3e643bb4a78330829a8cbd93e683f3ecc4029fdf77fa

Download Submit
C:\Windows\System\EFFdzOM.exe

Filesize
1.5MB

MD5
d0d5008a406ffb1aa343e01a5191a66b

SHA1
4df013ed2bc5c29fb0f3d05c5cd1e91db4285f6c

SHA256
73d9834c3a9b4a41afcc1f0238cfdaed7e1908c7949fe24d95b1f5d33364bd98

SHA512
20c7439c0685ade474c81eed56158ca65f996d61677642ddf79d0503eb90d351569beaceb3d03c84c0d38f18643f6d1b8a1a6365e02a2df7d3b6508013894d9b

Download Submit
C:\Windows\System\FGuxvSD.exe

Filesize
1.5MB

MD5
9bc9fc36220412a84c1c8e8db96a129d

SHA1
aee1ba0b7f644ca1c14c2bd524ccfe8f513d72a7

SHA256
482e0dbcd88825611a9c9751377311084468485900540222ba00ad84b95c7652

SHA512
f9e8999176fcc206dbcccad759b4a93d3cbe20f7590141fb404b3608786e8984e698038e8e26544e19778627ddd878a80c0e7c235235861d87979570f09b1ae8

Download Submit
C:\Windows\System\FKeOZDN.exe

Filesize
1.5MB

MD5
dbcdf5d96a00a08bfb0a8cf2208cbc2c

SHA1
0316edf6cd69ad61ec52fbb3402f893a25ec84bd

SHA256
dbf3ea1cce7199e4ad6211505874fef80567fb6a0829795718db534050c6c094

SHA512
130ea99f05cb0d52bb70e4a86948d7dc614f09a4f9a9bd10dbf13d484f236cbf27c2ab7cfc71787049aa985cc60ad8d5c9544dcfeedd884dbe9d8bce38709701

Download Submit
C:\Windows\System\GXtPNUc.exe

Filesize
1.5MB

MD5
768222725754c964612b3b32d3f5c98a

SHA1
afc897c8fe01948501fbf3002403882d498c9697

SHA256
1fb0f4f1d68d6b371ef84f691fd0817b26e033142040ce35b53884013fd6a003

SHA512
353ef8f8ea7093e4891c473c556c5e8b5077011531c5c96eb6b9406d2c78001165fda40d6422d426c5f689b951860d4176767886b0d917857a7366f267511c1c

Download Submit
C:\Windows\System\JHPNjle.exe

Filesize
1.5MB

MD5
a01ffd786bb64ae91bb7bc5bea4bf020

SHA1
7deb575e016e8394b6d7520ba3ccad4b93b347dd

SHA256
691f531a6870ae37d42c9f86bf7be87398f0052efe5c953c8e90f753877f53bf

SHA512
44d08f9cab37816b58f8242cc1da559822fe3e9fb70702fc53e8f78e9e8304d3af0a6c91697ee4e79f204f16c4e844ccf45ee8f20737242399dea6617608454b

Download Submit
C:\Windows\System\KXQcNkR.exe

Filesize
1.5MB

MD5
f9611d4fe11176f8471ec3b791a9cef0

SHA1
a765e57dfd28ce98b29f7613b5955afd37b60729

SHA256
1a2c8be35fbc45bb2dcfdd0d2a8059c6d407001cef82b47cbbb40c7dfc57868a

SHA512
563150f72466ee597ba885262488dde110e91d1a57beaabee5f1832986629e69b5f648ae228915fc793cc1f21e5bc96b02fa4a03a112267820f28a0b8ea4ad6b

Download Submit
C:\Windows\System\KevbjJE.exe

Filesize
1.5MB

MD5
8e2ca4d28d5824dd53030cb7f36e241e

SHA1
9d41d73f1ebbce0c1e21852b42fa8d79d8c78ccb

SHA256
ea8c74fbdaab7de186273ccd6aabfd6262cf3ed6987908b04f9be6c15b0be41b

SHA512
8dbfbb8b6d2b25bffadc6e5f71e595fce004389dd039a83a6c923128062e7955f1b3a06c288dcd70d8d72293eca28d73e7c323bf95138251b46c51dad127be27

Download Submit
C:\Windows\System\MpiCEIa.exe

Filesize
1.5MB

MD5
99d3b193a45585f8876d3696686d158c

SHA1
617d63721d688dc32b41ad3132cb1464f172a04a

SHA256
480b1fa2aa3127ff470fba8b067573dd55a65109f7d15a10c6ea2c076d1d6dad

SHA512
bf32fd4cd72af9ffd70ed0061f5aa8786955507f066238862c1bb8b739228848c1044f5d1132ed3db0f5e81f2e0c65cbe7824c04f26bb0327e7d8aa3c3c18f87

Download Submit
C:\Windows\System\NRPfMkr.exe

Filesize
1.5MB

MD5
11d0b1fc2ac9800017353ec11613abd2

SHA1
6b5ebd91eea09a7e5dec941304085dfc494edd1e

SHA256
ea1810689872f352d7ae91938cafb5921060356aed26362aa2b25252b767b7f9

SHA512
c4cf7cdb0235c8c71152cc552764ef7cffec109a9403dfeaeceed6f8a758dde496f7226869d11d46a6c0dee8f26365084f7dc63491d2594b0b74e4f170ed8231

Download Submit
C:\Windows\System\NdivCWF.exe

Filesize
1.5MB

MD5
c6c7c34e88b5a539181b7ce1be5afcda

SHA1
707b8ab3a11398720c935dd5f4ffbb6149533988

SHA256
560580fa2e12594478cf7be4ca9676a63571a40cef5eb6d192d9048d3d1e3af1

SHA512
df9bd65904bb214cd03e1ac3b479b7da2b8868f8b3cdfddc549171f6697094010e5fae0b879f62fea44c6859ac8b2142b01a93ca7b0eca221032515166961ff4

Download Submit
C:\Windows\System\QHWWGaA.exe

Filesize
1.5MB

MD5
3be051a720b6968b295e1864561339d9

SHA1
e5ca9b79b7358b41a1cf84ad38274ccdf3c097fc

SHA256
587888e6929734d02fc19b217892fd8de1834c4cb0075dc2700af5d507167a4e

SHA512
dfe4f4fefad225099221a20684126e937f2627fd8a29fcb8946fe00be021b18573d53de3edf475bc3d21ad8604a8b5334357e0d5a6b8479b2640dd7be16373e9

Download Submit
C:\Windows\System\RQciVLf.exe

Filesize
1.5MB

MD5
46ec00efe66eba02eb471a4b04c9c141

SHA1
8020044cfcd24a5d20581066817620c7bc6ccc36

SHA256
ca6398ea0c2759271272a711a515f7df144e1629a1e86e9dd18dd38007dafff2

SHA512
8e91dbffd576a9ff24c9721cc5d2e30fb49afbe505ea68b212bd32a36da12b5cb44e589d0a116d780c400aee4f24606ea5da472092fb834400d22fc9183a2ba6

Download Submit
C:\Windows\System\SAUgcAB.exe

Filesize
1.5MB

MD5
e7deaf38ae90ab02b07dcab8c483497e

SHA1
1ced2d4fedebf6a1736a9805f3b15b1dfcc0e389

SHA256
d234d6ff1eef55f394478afbdaf794afc960e47784d32d5c2991717e7121f42a

SHA512
4d7ac42271ef04d9f3792a6b6c1da7e558b3c4df2659b9ad87eeb48b7f845d58ccada710bfd6cd45e7596c8f205de1ffa07c51abeb9d0cce645b75fc20cb4485

Download Submit
C:\Windows\System\SkznoUI.exe

Filesize
1.5MB

MD5
a6ca7398d45315485664cc5d3f469370

SHA1
a9e99567bccd8b5749022a6d85b20089fe31159a

SHA256
688e08f4ecbccec57724b0c97b0372263b31b966af75ca6b7710f52e121dc06c

SHA512
02e0397043444ffde8034ca83534d44d6b6ad34c489c9374f2bff143bca67c2138486dae0b5b8c4317e353e76d8f830cbbb1b96a0288ff6a41d2638fa42ed26b

Download Submit
C:\Windows\System\UIAAVlf.exe

Filesize
1.5MB

MD5
7309ea0b51f15756ecd76a92a8db567c

SHA1
eb5bff61355546d69a1ad931b64e8da9e3ba3d94

SHA256
f791d8446ce609dcee31a87cdfa4e9f88ad4f3ead948d749e1a54b57e7349a99

SHA512
d25972540c52f5aeb0ab7f65e7a1c2490eb775466df0f57e42ef383b6df20cbb3f7c603190661f894f55e23ad148f8d1dcaa1877b063e2c241d6eb1a5ade3f0a

Download Submit
C:\Windows\System\WKcPEbg.exe

Filesize
1.5MB

MD5
452eda892a08dd6ab124615c633839d6

SHA1
a61a3e25d92e368d2fcbb030d5b54eeab121e3dd

SHA256
3eecaa3312af20b744a7093f89486aee76df7580813d1718b14741af3bf0b7dd

SHA512
d9ff0be45f4ec0630395340cd6551275b365812f0cbfe9a8f5ce12e7d53d0a775fa2139df3c3cb97b6762c01c5bbbbaa858d2618fd58719bb5ca3663a1c82278

Download Submit
C:\Windows\System\XAHIJFF.exe

Filesize
1.5MB

MD5
7d4e03497c795237d3b303ba9be909ff

SHA1
d6e707fd3f0c2dac5d099d1c3687050c55773dc7

SHA256
c2742988a971a2cbd7b47d087e8de087b9266bba711a1fcd320e20a5234883d2

SHA512
79a3381aff57f31433481ecb2a287c3573247d6c09967e21a8085cf4662e31931ffbf828d0f4e3e7576e340c09f128f72d5de260e52a483dbae0e21aa0aa9cb1

Download Submit
C:\Windows\System\XQFSGzJ.exe

Filesize
1.5MB

MD5
7b83284687944927a22d1cc930ea7721

SHA1
1aa68b34eb6d79c64f0932c6e65cddaabdfeb1ce

SHA256
fbaf3ab77f69c9e454c388f11f89af62f20fb9c94618142726fdd2376cd147c2

SHA512
44fb89c8e7dea5639af915ad5f6c515728741c4de598c50e94de8168b0a64d47f6ac4e2b9fb87ec4024eeaf6ee9855477a1c068c47c971eccf6f97025caabbd0

Download Submit
C:\Windows\System\XbBxrNZ.exe

Filesize
1.5MB

MD5
46fdd6de686629af2d8f35d3e7c8458f

SHA1
3e9f7d57579acdfbcc857d2f23b952e08d2bf6f6

SHA256
f6569b6c2ecf65a1a145a20fbb9c629e2906c1564ec70401885b642eb32edb37

SHA512
0a3b2b69a2e1767eb598c4c7c9ff701aa98da16814e857d5aa94a1a7171bd8bcb20bbf4ae69b0b6620b295bebdac4f9642b589a197e1ce64ad1ce8363f134fdd

Download Submit
C:\Windows\System\abHgZqL.exe

Filesize
1.5MB

MD5
e7240e419128e878cdc7b4d2c5a477da

SHA1
6d0547f0bcedfaa93dbe48c61aaab30c55e6de16

SHA256
a4ece772acd70f681b658e6cc21c0850750dbea4048726d3282a3e6cc259d326

SHA512
a92f6ab58cadcc7d3b26290e80666845d700af145015fa20d863fbd4ab5b24264e6d05e57f7dcba6b706424a91423d994688fcce6cc8f7bcf3861727c50489ca

Download Submit
C:\Windows\System\idOTMLB.exe

Filesize
1.5MB

MD5
560d755da99bb1a434b05777f927159d

SHA1
0b0c09aba4b5f55d63bea401782ca8f38c7a3838

SHA256
3b8f43b0f4fad2f7689b348a4ad37e94443847641a36207712961a35893850ae

SHA512
3c55611ad0e405766c270017e42f5ce0e8812afa6ff603c461c83541c00db1e6ecafe91b23c04584c6d4b2c5f0b35d19c7a6cff0be989c9e42e1c81d65bfcbd2

Download Submit
C:\Windows\System\kjTOJZF.exe

Filesize
1.5MB

MD5
1cdbc7525d2aeb6be4f7973ed816bef6

SHA1
111d7a15a175a67bd2463406339a48a522801643

SHA256
7b792fc0161c565a9bd95b7f62017f47d08baa59ddce175c14f34768d399a7a8

SHA512
e23c630488b398da39af41e581b216006d8b64ae235c1eb078c79817e6c56de0ad348d1a80cf92e6958aa1d58d16e258d08e3232ac0e081d09cd595d97427bc2

Download Submit
C:\Windows\System\kyYQnuC.exe

Filesize
1.5MB

MD5
f8924e2490edf4671c52c70dd6518a41

SHA1
1f347e0dacca31c4cd8b375ae72b702336300692

SHA256
d61388264ac3b3ff7db290ef0e667d721c4dc815d74f91d6e2e7d4210e5e1d0a

SHA512
5cd1afc3484e11e65427acbf89483b5ae5b4e63bc30f03a8accc26df43e24d4eee9f029bad740d5f347d649fa632b6ac290c168bc5197e8769779e96b02a8fb8

Download Submit
C:\Windows\System\lvVnmkV.exe

Filesize
1.5MB

MD5
00212c1b00536485ea02a47139ecea2d

SHA1
eb4d1b5c2766425065e77bba5b9c23ab5aa41ee5

SHA256
63db1e280fe3d537137872964a35614a9a46559a29f3b3a8c8f106de83974c28

SHA512
28639ff6558ed9c55d2c1315ab6e74e1d5318a7b594eb8831b1615db4dba85ec15c4311f01cb1a24ab739b72a3903fecca9f5a9be53952ffadbc32a8042db522

Download Submit
C:\Windows\System\msOjfyD.exe

Filesize
1.5MB

MD5
798ab71dba0983d793caff2617dc276b

SHA1
15c594725e489340ecd0c764eb3693c93a5d5a01

SHA256
d23369b606f90e321d5ec629306ecdadeb10649ab2f5c5673b550700252658ac

SHA512
5680754848f9b6ca0559877434f26be7e4edc6f1b2a90ae0821520aa0e35a4220a66fa6a3725dfb13de880bd6fb61eba04dae50d31264bf5e7ff7af6ec27d769

Download Submit
C:\Windows\System\nqJLsPG.exe

Filesize
1.5MB

MD5
3784ab5b849a02ca9db071984426a19a

SHA1
bbd62eb91f0c805f2b80fd7f2bacd5b1e96fbc40

SHA256
78e9ac1f729d0897f6353589d59eb159243e29509a90f380c9c7f46617197c90

SHA512
3eb2ab8e262e1e475eef5ee90601c8db35d5e1d377a578479f3e3ba7af74f8a6421480c49ab74b0eaf09ff532c2ba1cb96e1e5c06c341e70873d653678d81ddb

Download Submit
C:\Windows\System\pWYHYvf.exe

Filesize
1.5MB

MD5
ca4a34c5faa1af9d381fd647fb3053d3

SHA1
c7a5f98714cec5452fc91d53535e55b4a1c349fd

SHA256
7fa015eb21579f99dd1bfd1f4df57a6c2d52a243c5353f1e4547853ab629a72c

SHA512
3ef1877b877ce8f275fdb7c22d56920cd4df4982e8b64de0c5cc6cfcfdb962dd4273fc4ad123650d2e60cf585773175b717478d73e61c339061d5caa299583f4

Download Submit
C:\Windows\System\qxDXkFj.exe

Filesize
1.5MB

MD5
07d1b0c7da32befefa56c46a7a2b2c73

SHA1
44e8f2a51da99ac2daa16b9012b89557f12422f7

SHA256
2c50ae53ba91597d903c88a283dbe45fac2cc09eadb5cde87397386dec448f31

SHA512
51c3519c5e1cdd66dadb2d117f319b9beb95727def984fc1262e6815ba8a86d1885f168c962bf93cc9e521b2fd3d31cbce43bad14fff2a9a7f366bf50c1d093b

Download Submit
C:\Windows\System\qxnNAPQ.exe

Filesize
1.5MB

MD5
7e2a8a0cf48c17bf6c3d3af2ff9361c6

SHA1
31e87cec44d77b216441ea90d7428b3af9297d77

SHA256
8500290e7c0246354f19f80e10f89c7cf8e7477b50bd286ea8c9f0b641335d85

SHA512
623e147a825b8f323ff6ba8a51b01cfcd7f97cdb33e89f69cabf5e348d4f1bce4748de625cc2772b16ffc4232d9eecc71a55c0d5ca3a75390c42d12797db1c73

Download Submit
C:\Windows\System\sAqEQkt.exe

Filesize
1.5MB

MD5
40c69e94825c0c79b3b6491b1bbabe2c

SHA1
39ae7e3d930621a2b8bcafdec61b10ed7799a969

SHA256
aa7118f489675c29a017d5b84e500fb69b067995493e23993380759059955980

SHA512
65a7c864d77de6a5ec417d1c468aafcced0abb32362b0a394bed19bf3bbe5359f0d6476f7b842a01c8981bf65a634a978857c30c2b549a932c5222897aed771e

Download Submit
C:\Windows\System\sVlIAjG.exe

Filesize
1.5MB

MD5
1e0346831b319219bed6d26477e4ce17

SHA1
2292ce7ea8d923a7dbf373c8a1b1e209cc14bf56

SHA256
c4fc5709f27bcfc8799575e6ca44b0df2d781e8ed26f2c3c811e60c7431bfcc7

SHA512
67794dc36b1d74afeb984ec277da8e18659d9adb3d500297b266ee948a2d46aaf059ef8e11b70701448886949d3731db11fa0af5b9f282694916a36df212df4d

Download Submit
C:\Windows\System\tuJsbfL.exe

Filesize
1.5MB

MD5
a3c18d111caa3d9db529a2f98a8164e4

SHA1
358231949cd43beee0e87c088b95c1a43cd1c33f

SHA256
4fea6addd44763cb4fb3461490ab195ef0ed276c076f410a1a505743d18350a6

SHA512
b2ccb6e7e20ed623f976389d5d4b6f8a535e4fadb0482abd0a09193fadda162eb14b5b01605776bd894562bbf081bf5d1efd7699d895549f759ec1999cf5d43a

Download Submit
C:\Windows\System\ujJQFKJ.exe

Filesize
1.5MB

MD5
54a258a28944bc824007538898dbc906

SHA1
c52cd4a475d09c2f222d277cb31ba286bc4ee03b

SHA256
5655721dce0066adcb5c2bad486f9480051a77fe47112bbf4871d985424ed259

SHA512
5b98e3ed62415acc6c97d88e57d94d2691519eff9e4b0e5acb6c369c40ee86f110a7406404a8e83356910d697aeda39376a5c52ffd33e39aa5bacce44629c091

Download Submit
C:\Windows\System\wQQCwGT.exe

Filesize
1.5MB

MD5
862453d9172632e2388cafc754f06077

SHA1
a49d0cb7e282fee59a274ec181ceeae9ef3196d8

SHA256
89174d1b2fe6c49e66c2c291fa2ababaa1417ee92ebbd6d7767989f6a12fe8a5

SHA512
89f52e3b5da2530ce14b7a7fdbcad8f74d209e72205b43d01e5bbe7c430755e0428df81f8b882c4d9364126f7649fba8c64651faf33f9ca9c43d78d73d74edce

Download Submit
C:\Windows\System\whDvDRk.exe

Filesize
1.5MB

MD5
07d52d310c2fa7b517606d2589501289

SHA1
5f3187f9126c943acb45ac7f4044b21301d7feb2

SHA256
ecb5102486abbca333514fef188e27570064b4bea8e509119fd321988ef5232f

SHA512
a8db24a5ecd9569bc21310b2e944d85c2d85fa0034b1ce93e5572efc9dc2e0d43dab7cc41c73d152c9d5a40318a47e6966f57662ab754ad589acec19b011fb69

Download Submit
memory/1408-0-0x0000023FECA00000-0x0000023FECA10000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads