xmrig | 14cd8e3a6e204ddac0e12aa617e0cd2d7698408aa10394c6d16cc9e5f8d8b41c

Analysis

max time kernel
123s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
23-12-2024 19:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

14cd8e3a6e204ddac0e12aa617e0cd2d7698408aa10394c6d16cc9e5f8d8b41c.exe
Size

1.5MB
MD5

3b16290384d76445b7bf06f3720a7613
SHA1

4bac19405636ad0a47c3e22895d6b8ae3627e7a9
SHA256

14cd8e3a6e204ddac0e12aa617e0cd2d7698408aa10394c6d16cc9e5f8d8b41c
SHA512

a6afba0f4bfcd89f6ed60ab8d42fc6de931430fae4d2848df3df61e3014d6ad83620dd184f4775ca20c209e40e06971c5ced536b9d20e7e78ce9a3ec633f8320
SSDEEP

24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbpwlKensziXoSPqZ650tTovQ8EXe:GezaTF8FcNkNdfE0pZ9ozttwIRRegkvJ

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 33 IoCs

miner

resource	yara_rule
behavioral2/files/0x000c000000023bbe-4.dat	xmrig
behavioral2/files/0x0007000000023c9e-9.dat	xmrig
behavioral2/files/0x0007000000023c9f-8.dat	xmrig
behavioral2/files/0x0007000000023cbd-162.dat	xmrig
behavioral2/files/0x0007000000023cbb-160.dat	xmrig
behavioral2/files/0x0007000000023cbc-157.dat	xmrig
behavioral2/files/0x0007000000023cba-155.dat	xmrig
behavioral2/files/0x0007000000023cb9-150.dat	xmrig
behavioral2/files/0x0007000000023cb8-145.dat	xmrig
behavioral2/files/0x0007000000023cb7-140.dat	xmrig
behavioral2/files/0x0007000000023cb6-135.dat	xmrig
behavioral2/files/0x0007000000023cb5-130.dat	xmrig
behavioral2/files/0x0007000000023cb4-125.dat	xmrig
behavioral2/files/0x0007000000023cb3-120.dat	xmrig
behavioral2/files/0x0007000000023cb2-115.dat	xmrig
behavioral2/files/0x0007000000023cb1-110.dat	xmrig
behavioral2/files/0x0007000000023cb0-105.dat	xmrig
behavioral2/files/0x0007000000023caf-97.dat	xmrig
behavioral2/files/0x0007000000023cae-93.dat	xmrig
behavioral2/files/0x0007000000023cad-87.dat	xmrig
behavioral2/files/0x0007000000023cac-83.dat	xmrig
behavioral2/files/0x0007000000023cab-77.dat	xmrig
behavioral2/files/0x0007000000023caa-73.dat	xmrig
behavioral2/files/0x0007000000023ca9-67.dat	xmrig
behavioral2/files/0x0007000000023ca8-63.dat	xmrig
behavioral2/files/0x0007000000023ca7-57.dat	xmrig
behavioral2/files/0x0007000000023ca6-53.dat	xmrig
behavioral2/files/0x0007000000023ca5-47.dat	xmrig
behavioral2/files/0x0007000000023ca4-43.dat	xmrig
behavioral2/files/0x0007000000023ca3-35.dat	xmrig
behavioral2/files/0x0007000000023ca2-30.dat	xmrig
behavioral2/files/0x0007000000023ca1-24.dat	xmrig
behavioral2/files/0x0007000000023ca0-20.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
1932	DCZemgG.exe
1100	IwOsGxf.exe
1076	coyRYju.exe
4968	NuVavvY.exe
2472	DkfNneO.exe
4900	RCOLzJT.exe
3960	KklKQOu.exe
2976	QoVQSQM.exe
836	iTzBvJx.exe
2268	TVKKcph.exe
2428	gIwaKdo.exe
2424	eGIuBeY.exe
2760	dLQdIfA.exe
1936	vgsyUDd.exe
5076	rvlejyN.exe
3816	hflOEHE.exe
4868	kDZazCe.exe
3164	qxWzubu.exe
4052	tqoFKDH.exe
4436	UVZEAbS.exe
5108	qkmOzXh.exe
3684	VQwXyTf.exe
2524	eGTSfCb.exe
4936	EIUvXGm.exe
1592	QkFtfyj.exe
4732	XHkpbjt.exe
3280	FsdpBNi.exe
2556	udazXwO.exe
3524	aDdJhcH.exe
760	LUxFJRi.exe
2872	DzHRplk.exe
4300	dTrXedr.exe
4312	GprkUoo.exe
1060	bRsOLnX.exe
1492	BiTiXtR.exe
384	pWyGBRM.exe
1516	MFDMcYo.exe
2232	zLPMhnO.exe
1756	SeImwRJ.exe
4452	jmbGAWO.exe
3972	AjIkfir.exe
1276	VdBeekZ.exe
4796	LCHRVmY.exe
1976	YQuXiAH.exe
756	drDHupw.exe
4716	REOgbxe.exe
1044	rEdawCa.exe
4124	fDGVnAJ.exe
1160	JKptzvt.exe
2464	clkMCsB.exe
1568	RgXHENB.exe
4460	sHhzGtk.exe
4368	bInrdsf.exe
3140	etXCzly.exe
916	vOKQIEQ.exe
4576	OTKgwIU.exe
3900	krVAKVi.exe
4100	JOjLMVk.exe
4740	vtdhkzF.exe
2364	DpTYHQt.exe
3724	RPQSFJt.exe
1528	yhMBxHi.exe
808	aMpOAFO.exe
4012	kmdiapQ.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\HFENsIS.exe	14cd8e3a6e204ddac0e12aa617e0cd2d7698408aa10394c6d16cc9e5f8d8b41c.exe
File created	C:\Windows\System\QiUpDWR.exe	14cd8e3a6e204ddac0e12aa617e0cd2d7698408aa10394c6d16cc9e5f8d8b41c.exe
File created	C:\Windows\System\VImKhox.exe	14cd8e3a6e204ddac0e12aa617e0cd2d7698408aa10394c6d16cc9e5f8d8b41c.exe
File created	C:\Windows\System\fDGVnAJ.exe	14cd8e3a6e204ddac0e12aa617e0cd2d7698408aa10394c6d16cc9e5f8d8b41c.exe
File created	C:\Windows\System\PTeqTuX.exe	14cd8e3a6e204ddac0e12aa617e0cd2d7698408aa10394c6d16cc9e5f8d8b41c.exe
File created	C:\Windows\System\qlrmclU.exe	14cd8e3a6e204ddac0e12aa617e0cd2d7698408aa10394c6d16cc9e5f8d8b41c.exe
File created	C:\Windows\System\LsUKrFD.exe	14cd8e3a6e204ddac0e12aa617e0cd2d7698408aa10394c6d16cc9e5f8d8b41c.exe
File created	C:\Windows\System\QEdlzpt.exe	14cd8e3a6e204ddac0e12aa617e0cd2d7698408aa10394c6d16cc9e5f8d8b41c.exe
File created	C:\Windows\System\rWnbCBi.exe	14cd8e3a6e204ddac0e12aa617e0cd2d7698408aa10394c6d16cc9e5f8d8b41c.exe
File created	C:\Windows\System\MifJKbQ.exe	14cd8e3a6e204ddac0e12aa617e0cd2d7698408aa10394c6d16cc9e5f8d8b41c.exe
File created	C:\Windows\System\TFENhxD.exe	14cd8e3a6e204ddac0e12aa617e0cd2d7698408aa10394c6d16cc9e5f8d8b41c.exe
File created	C:\Windows\System\BbBQhxW.exe	14cd8e3a6e204ddac0e12aa617e0cd2d7698408aa10394c6d16cc9e5f8d8b41c.exe
File created	C:\Windows\System\SQHcNOk.exe	14cd8e3a6e204ddac0e12aa617e0cd2d7698408aa10394c6d16cc9e5f8d8b41c.exe
File created	C:\Windows\System\JnkaapM.exe	14cd8e3a6e204ddac0e12aa617e0cd2d7698408aa10394c6d16cc9e5f8d8b41c.exe
File created	C:\Windows\System\keuDGhJ.exe	14cd8e3a6e204ddac0e12aa617e0cd2d7698408aa10394c6d16cc9e5f8d8b41c.exe
File created	C:\Windows\System\TUvHTEn.exe	14cd8e3a6e204ddac0e12aa617e0cd2d7698408aa10394c6d16cc9e5f8d8b41c.exe
File created	C:\Windows\System\vjJrhab.exe	14cd8e3a6e204ddac0e12aa617e0cd2d7698408aa10394c6d16cc9e5f8d8b41c.exe
File created	C:\Windows\System\KxsyrBj.exe	14cd8e3a6e204ddac0e12aa617e0cd2d7698408aa10394c6d16cc9e5f8d8b41c.exe
File created	C:\Windows\System\vlSryua.exe	14cd8e3a6e204ddac0e12aa617e0cd2d7698408aa10394c6d16cc9e5f8d8b41c.exe
File created	C:\Windows\System\JTvUSts.exe	14cd8e3a6e204ddac0e12aa617e0cd2d7698408aa10394c6d16cc9e5f8d8b41c.exe
File created	C:\Windows\System\PVMrvKP.exe	14cd8e3a6e204ddac0e12aa617e0cd2d7698408aa10394c6d16cc9e5f8d8b41c.exe
File created	C:\Windows\System\RSGFARx.exe	14cd8e3a6e204ddac0e12aa617e0cd2d7698408aa10394c6d16cc9e5f8d8b41c.exe
File created	C:\Windows\System\qxWzubu.exe	14cd8e3a6e204ddac0e12aa617e0cd2d7698408aa10394c6d16cc9e5f8d8b41c.exe
File created	C:\Windows\System\AjIkfir.exe	14cd8e3a6e204ddac0e12aa617e0cd2d7698408aa10394c6d16cc9e5f8d8b41c.exe
File created	C:\Windows\System\WhGZOtt.exe	14cd8e3a6e204ddac0e12aa617e0cd2d7698408aa10394c6d16cc9e5f8d8b41c.exe
File created	C:\Windows\System\OVxovLc.exe	14cd8e3a6e204ddac0e12aa617e0cd2d7698408aa10394c6d16cc9e5f8d8b41c.exe
File created	C:\Windows\System\uWLCIQE.exe	14cd8e3a6e204ddac0e12aa617e0cd2d7698408aa10394c6d16cc9e5f8d8b41c.exe
File created	C:\Windows\System\KYpObJU.exe	14cd8e3a6e204ddac0e12aa617e0cd2d7698408aa10394c6d16cc9e5f8d8b41c.exe
File created	C:\Windows\System\MIpQvyS.exe	14cd8e3a6e204ddac0e12aa617e0cd2d7698408aa10394c6d16cc9e5f8d8b41c.exe
File created	C:\Windows\System\CMoRnPF.exe	14cd8e3a6e204ddac0e12aa617e0cd2d7698408aa10394c6d16cc9e5f8d8b41c.exe
File created	C:\Windows\System\BhCgCIZ.exe	14cd8e3a6e204ddac0e12aa617e0cd2d7698408aa10394c6d16cc9e5f8d8b41c.exe
File created	C:\Windows\System\HrJrWWB.exe	14cd8e3a6e204ddac0e12aa617e0cd2d7698408aa10394c6d16cc9e5f8d8b41c.exe
File created	C:\Windows\System\PPIvfxw.exe	14cd8e3a6e204ddac0e12aa617e0cd2d7698408aa10394c6d16cc9e5f8d8b41c.exe
File created	C:\Windows\System\swIqWDB.exe	14cd8e3a6e204ddac0e12aa617e0cd2d7698408aa10394c6d16cc9e5f8d8b41c.exe
File created	C:\Windows\System\kbtCSDX.exe	14cd8e3a6e204ddac0e12aa617e0cd2d7698408aa10394c6d16cc9e5f8d8b41c.exe
File created	C:\Windows\System\KsQpVMM.exe	14cd8e3a6e204ddac0e12aa617e0cd2d7698408aa10394c6d16cc9e5f8d8b41c.exe
File created	C:\Windows\System\vOZjprF.exe	14cd8e3a6e204ddac0e12aa617e0cd2d7698408aa10394c6d16cc9e5f8d8b41c.exe
File created	C:\Windows\System\PWJwAvi.exe	14cd8e3a6e204ddac0e12aa617e0cd2d7698408aa10394c6d16cc9e5f8d8b41c.exe
File created	C:\Windows\System\nnmmEGW.exe	14cd8e3a6e204ddac0e12aa617e0cd2d7698408aa10394c6d16cc9e5f8d8b41c.exe
File created	C:\Windows\System\daRbhmS.exe	14cd8e3a6e204ddac0e12aa617e0cd2d7698408aa10394c6d16cc9e5f8d8b41c.exe
File created	C:\Windows\System\VsMecvC.exe	14cd8e3a6e204ddac0e12aa617e0cd2d7698408aa10394c6d16cc9e5f8d8b41c.exe
File created	C:\Windows\System\wzxHAEp.exe	14cd8e3a6e204ddac0e12aa617e0cd2d7698408aa10394c6d16cc9e5f8d8b41c.exe
File created	C:\Windows\System\XcjGOQy.exe	14cd8e3a6e204ddac0e12aa617e0cd2d7698408aa10394c6d16cc9e5f8d8b41c.exe
File created	C:\Windows\System\XSzxXbC.exe	14cd8e3a6e204ddac0e12aa617e0cd2d7698408aa10394c6d16cc9e5f8d8b41c.exe
File created	C:\Windows\System\fbBjsXV.exe	14cd8e3a6e204ddac0e12aa617e0cd2d7698408aa10394c6d16cc9e5f8d8b41c.exe
File created	C:\Windows\System\qzYZpZv.exe	14cd8e3a6e204ddac0e12aa617e0cd2d7698408aa10394c6d16cc9e5f8d8b41c.exe
File created	C:\Windows\System\cGxNWxm.exe	14cd8e3a6e204ddac0e12aa617e0cd2d7698408aa10394c6d16cc9e5f8d8b41c.exe
File created	C:\Windows\System\krtEDHj.exe	14cd8e3a6e204ddac0e12aa617e0cd2d7698408aa10394c6d16cc9e5f8d8b41c.exe
File created	C:\Windows\System\SwhvrgH.exe	14cd8e3a6e204ddac0e12aa617e0cd2d7698408aa10394c6d16cc9e5f8d8b41c.exe
File created	C:\Windows\System\YyfHVpL.exe	14cd8e3a6e204ddac0e12aa617e0cd2d7698408aa10394c6d16cc9e5f8d8b41c.exe
File created	C:\Windows\System\OLQKWGG.exe	14cd8e3a6e204ddac0e12aa617e0cd2d7698408aa10394c6d16cc9e5f8d8b41c.exe
File created	C:\Windows\System\LYWIcUc.exe	14cd8e3a6e204ddac0e12aa617e0cd2d7698408aa10394c6d16cc9e5f8d8b41c.exe
File created	C:\Windows\System\azsLKTZ.exe	14cd8e3a6e204ddac0e12aa617e0cd2d7698408aa10394c6d16cc9e5f8d8b41c.exe
File created	C:\Windows\System\EvLGTtR.exe	14cd8e3a6e204ddac0e12aa617e0cd2d7698408aa10394c6d16cc9e5f8d8b41c.exe
File created	C:\Windows\System\ZIhJfOv.exe	14cd8e3a6e204ddac0e12aa617e0cd2d7698408aa10394c6d16cc9e5f8d8b41c.exe
File created	C:\Windows\System\XFqHRaD.exe	14cd8e3a6e204ddac0e12aa617e0cd2d7698408aa10394c6d16cc9e5f8d8b41c.exe
File created	C:\Windows\System\LCbsEiu.exe	14cd8e3a6e204ddac0e12aa617e0cd2d7698408aa10394c6d16cc9e5f8d8b41c.exe
File created	C:\Windows\System\vHVqDAw.exe	14cd8e3a6e204ddac0e12aa617e0cd2d7698408aa10394c6d16cc9e5f8d8b41c.exe
File created	C:\Windows\System\AKtHUvI.exe	14cd8e3a6e204ddac0e12aa617e0cd2d7698408aa10394c6d16cc9e5f8d8b41c.exe
File created	C:\Windows\System\ItQPoKX.exe	14cd8e3a6e204ddac0e12aa617e0cd2d7698408aa10394c6d16cc9e5f8d8b41c.exe
File created	C:\Windows\System\tQJsnEL.exe	14cd8e3a6e204ddac0e12aa617e0cd2d7698408aa10394c6d16cc9e5f8d8b41c.exe
File created	C:\Windows\System\SThabem.exe	14cd8e3a6e204ddac0e12aa617e0cd2d7698408aa10394c6d16cc9e5f8d8b41c.exe
File created	C:\Windows\System\kYgBxQn.exe	14cd8e3a6e204ddac0e12aa617e0cd2d7698408aa10394c6d16cc9e5f8d8b41c.exe
File created	C:\Windows\System\WGgMIrE.exe	14cd8e3a6e204ddac0e12aa617e0cd2d7698408aa10394c6d16cc9e5f8d8b41c.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	17160	dwm.exe
Token: SeChangeNotifyPrivilege	17160	dwm.exe
Token: 33	17160	dwm.exe
Token: SeIncBasePriorityPrivilege	17160	dwm.exe
Token: SeShutdownPrivilege	17160	dwm.exe
Token: SeCreatePagefilePrivilege	17160	dwm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4048 wrote to memory of 1932	4048	14cd8e3a6e204ddac0e12aa617e0cd2d7698408aa10394c6d16cc9e5f8d8b41c.exe	84
PID 4048 wrote to memory of 1932	4048	14cd8e3a6e204ddac0e12aa617e0cd2d7698408aa10394c6d16cc9e5f8d8b41c.exe	84
PID 4048 wrote to memory of 1100	4048	14cd8e3a6e204ddac0e12aa617e0cd2d7698408aa10394c6d16cc9e5f8d8b41c.exe	85
PID 4048 wrote to memory of 1100	4048	14cd8e3a6e204ddac0e12aa617e0cd2d7698408aa10394c6d16cc9e5f8d8b41c.exe	85
PID 4048 wrote to memory of 1076	4048	14cd8e3a6e204ddac0e12aa617e0cd2d7698408aa10394c6d16cc9e5f8d8b41c.exe	86
PID 4048 wrote to memory of 1076	4048	14cd8e3a6e204ddac0e12aa617e0cd2d7698408aa10394c6d16cc9e5f8d8b41c.exe	86
PID 4048 wrote to memory of 4968	4048	14cd8e3a6e204ddac0e12aa617e0cd2d7698408aa10394c6d16cc9e5f8d8b41c.exe	87
PID 4048 wrote to memory of 4968	4048	14cd8e3a6e204ddac0e12aa617e0cd2d7698408aa10394c6d16cc9e5f8d8b41c.exe	87
PID 4048 wrote to memory of 2472	4048	14cd8e3a6e204ddac0e12aa617e0cd2d7698408aa10394c6d16cc9e5f8d8b41c.exe	88
PID 4048 wrote to memory of 2472	4048	14cd8e3a6e204ddac0e12aa617e0cd2d7698408aa10394c6d16cc9e5f8d8b41c.exe	88
PID 4048 wrote to memory of 4900	4048	14cd8e3a6e204ddac0e12aa617e0cd2d7698408aa10394c6d16cc9e5f8d8b41c.exe	89
PID 4048 wrote to memory of 4900	4048	14cd8e3a6e204ddac0e12aa617e0cd2d7698408aa10394c6d16cc9e5f8d8b41c.exe	89
PID 4048 wrote to memory of 3960	4048	14cd8e3a6e204ddac0e12aa617e0cd2d7698408aa10394c6d16cc9e5f8d8b41c.exe	90
PID 4048 wrote to memory of 3960	4048	14cd8e3a6e204ddac0e12aa617e0cd2d7698408aa10394c6d16cc9e5f8d8b41c.exe	90
PID 4048 wrote to memory of 2976	4048	14cd8e3a6e204ddac0e12aa617e0cd2d7698408aa10394c6d16cc9e5f8d8b41c.exe	91
PID 4048 wrote to memory of 2976	4048	14cd8e3a6e204ddac0e12aa617e0cd2d7698408aa10394c6d16cc9e5f8d8b41c.exe	91
PID 4048 wrote to memory of 836	4048	14cd8e3a6e204ddac0e12aa617e0cd2d7698408aa10394c6d16cc9e5f8d8b41c.exe	92
PID 4048 wrote to memory of 836	4048	14cd8e3a6e204ddac0e12aa617e0cd2d7698408aa10394c6d16cc9e5f8d8b41c.exe	92
PID 4048 wrote to memory of 2268	4048	14cd8e3a6e204ddac0e12aa617e0cd2d7698408aa10394c6d16cc9e5f8d8b41c.exe	93
PID 4048 wrote to memory of 2268	4048	14cd8e3a6e204ddac0e12aa617e0cd2d7698408aa10394c6d16cc9e5f8d8b41c.exe	93
PID 4048 wrote to memory of 2428	4048	14cd8e3a6e204ddac0e12aa617e0cd2d7698408aa10394c6d16cc9e5f8d8b41c.exe	94
PID 4048 wrote to memory of 2428	4048	14cd8e3a6e204ddac0e12aa617e0cd2d7698408aa10394c6d16cc9e5f8d8b41c.exe	94
PID 4048 wrote to memory of 2424	4048	14cd8e3a6e204ddac0e12aa617e0cd2d7698408aa10394c6d16cc9e5f8d8b41c.exe	95
PID 4048 wrote to memory of 2424	4048	14cd8e3a6e204ddac0e12aa617e0cd2d7698408aa10394c6d16cc9e5f8d8b41c.exe	95
PID 4048 wrote to memory of 2760	4048	14cd8e3a6e204ddac0e12aa617e0cd2d7698408aa10394c6d16cc9e5f8d8b41c.exe	96
PID 4048 wrote to memory of 2760	4048	14cd8e3a6e204ddac0e12aa617e0cd2d7698408aa10394c6d16cc9e5f8d8b41c.exe	96
PID 4048 wrote to memory of 1936	4048	14cd8e3a6e204ddac0e12aa617e0cd2d7698408aa10394c6d16cc9e5f8d8b41c.exe	97
PID 4048 wrote to memory of 1936	4048	14cd8e3a6e204ddac0e12aa617e0cd2d7698408aa10394c6d16cc9e5f8d8b41c.exe	97
PID 4048 wrote to memory of 5076	4048	14cd8e3a6e204ddac0e12aa617e0cd2d7698408aa10394c6d16cc9e5f8d8b41c.exe	98
PID 4048 wrote to memory of 5076	4048	14cd8e3a6e204ddac0e12aa617e0cd2d7698408aa10394c6d16cc9e5f8d8b41c.exe	98
PID 4048 wrote to memory of 3816	4048	14cd8e3a6e204ddac0e12aa617e0cd2d7698408aa10394c6d16cc9e5f8d8b41c.exe	99
PID 4048 wrote to memory of 3816	4048	14cd8e3a6e204ddac0e12aa617e0cd2d7698408aa10394c6d16cc9e5f8d8b41c.exe	99
PID 4048 wrote to memory of 4868	4048	14cd8e3a6e204ddac0e12aa617e0cd2d7698408aa10394c6d16cc9e5f8d8b41c.exe	100
PID 4048 wrote to memory of 4868	4048	14cd8e3a6e204ddac0e12aa617e0cd2d7698408aa10394c6d16cc9e5f8d8b41c.exe	100
PID 4048 wrote to memory of 3164	4048	14cd8e3a6e204ddac0e12aa617e0cd2d7698408aa10394c6d16cc9e5f8d8b41c.exe	101
PID 4048 wrote to memory of 3164	4048	14cd8e3a6e204ddac0e12aa617e0cd2d7698408aa10394c6d16cc9e5f8d8b41c.exe	101
PID 4048 wrote to memory of 4052	4048	14cd8e3a6e204ddac0e12aa617e0cd2d7698408aa10394c6d16cc9e5f8d8b41c.exe	102
PID 4048 wrote to memory of 4052	4048	14cd8e3a6e204ddac0e12aa617e0cd2d7698408aa10394c6d16cc9e5f8d8b41c.exe	102
PID 4048 wrote to memory of 4436	4048	14cd8e3a6e204ddac0e12aa617e0cd2d7698408aa10394c6d16cc9e5f8d8b41c.exe	103
PID 4048 wrote to memory of 4436	4048	14cd8e3a6e204ddac0e12aa617e0cd2d7698408aa10394c6d16cc9e5f8d8b41c.exe	103
PID 4048 wrote to memory of 5108	4048	14cd8e3a6e204ddac0e12aa617e0cd2d7698408aa10394c6d16cc9e5f8d8b41c.exe	104
PID 4048 wrote to memory of 5108	4048	14cd8e3a6e204ddac0e12aa617e0cd2d7698408aa10394c6d16cc9e5f8d8b41c.exe	104
PID 4048 wrote to memory of 3684	4048	14cd8e3a6e204ddac0e12aa617e0cd2d7698408aa10394c6d16cc9e5f8d8b41c.exe	105
PID 4048 wrote to memory of 3684	4048	14cd8e3a6e204ddac0e12aa617e0cd2d7698408aa10394c6d16cc9e5f8d8b41c.exe	105
PID 4048 wrote to memory of 2524	4048	14cd8e3a6e204ddac0e12aa617e0cd2d7698408aa10394c6d16cc9e5f8d8b41c.exe	106
PID 4048 wrote to memory of 2524	4048	14cd8e3a6e204ddac0e12aa617e0cd2d7698408aa10394c6d16cc9e5f8d8b41c.exe	106
PID 4048 wrote to memory of 4936	4048	14cd8e3a6e204ddac0e12aa617e0cd2d7698408aa10394c6d16cc9e5f8d8b41c.exe	107
PID 4048 wrote to memory of 4936	4048	14cd8e3a6e204ddac0e12aa617e0cd2d7698408aa10394c6d16cc9e5f8d8b41c.exe	107
PID 4048 wrote to memory of 1592	4048	14cd8e3a6e204ddac0e12aa617e0cd2d7698408aa10394c6d16cc9e5f8d8b41c.exe	108
PID 4048 wrote to memory of 1592	4048	14cd8e3a6e204ddac0e12aa617e0cd2d7698408aa10394c6d16cc9e5f8d8b41c.exe	108
PID 4048 wrote to memory of 4732	4048	14cd8e3a6e204ddac0e12aa617e0cd2d7698408aa10394c6d16cc9e5f8d8b41c.exe	109
PID 4048 wrote to memory of 4732	4048	14cd8e3a6e204ddac0e12aa617e0cd2d7698408aa10394c6d16cc9e5f8d8b41c.exe	109
PID 4048 wrote to memory of 3280	4048	14cd8e3a6e204ddac0e12aa617e0cd2d7698408aa10394c6d16cc9e5f8d8b41c.exe	110
PID 4048 wrote to memory of 3280	4048	14cd8e3a6e204ddac0e12aa617e0cd2d7698408aa10394c6d16cc9e5f8d8b41c.exe	110
PID 4048 wrote to memory of 2556	4048	14cd8e3a6e204ddac0e12aa617e0cd2d7698408aa10394c6d16cc9e5f8d8b41c.exe	111
PID 4048 wrote to memory of 2556	4048	14cd8e3a6e204ddac0e12aa617e0cd2d7698408aa10394c6d16cc9e5f8d8b41c.exe	111
PID 4048 wrote to memory of 3524	4048	14cd8e3a6e204ddac0e12aa617e0cd2d7698408aa10394c6d16cc9e5f8d8b41c.exe	112
PID 4048 wrote to memory of 3524	4048	14cd8e3a6e204ddac0e12aa617e0cd2d7698408aa10394c6d16cc9e5f8d8b41c.exe	112
PID 4048 wrote to memory of 760	4048	14cd8e3a6e204ddac0e12aa617e0cd2d7698408aa10394c6d16cc9e5f8d8b41c.exe	113
PID 4048 wrote to memory of 760	4048	14cd8e3a6e204ddac0e12aa617e0cd2d7698408aa10394c6d16cc9e5f8d8b41c.exe	113
PID 4048 wrote to memory of 2872	4048	14cd8e3a6e204ddac0e12aa617e0cd2d7698408aa10394c6d16cc9e5f8d8b41c.exe	114
PID 4048 wrote to memory of 2872	4048	14cd8e3a6e204ddac0e12aa617e0cd2d7698408aa10394c6d16cc9e5f8d8b41c.exe	114
PID 4048 wrote to memory of 4300	4048	14cd8e3a6e204ddac0e12aa617e0cd2d7698408aa10394c6d16cc9e5f8d8b41c.exe	115
PID 4048 wrote to memory of 4300	4048	14cd8e3a6e204ddac0e12aa617e0cd2d7698408aa10394c6d16cc9e5f8d8b41c.exe	115

C:\Users\Admin\AppData\Local\Temp\14cd8e3a6e204ddac0e12aa617e0cd2d7698408aa10394c6d16cc9e5f8d8b41c.exe
"C:\Users\Admin\AppData\Local\Temp\14cd8e3a6e204ddac0e12aa617e0cd2d7698408aa10394c6d16cc9e5f8d8b41c.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4048
- C:\Windows\System\DCZemgG.exe
  C:\Windows\System\DCZemgG.exe
  2⤵
  - Executes dropped EXE
  PID:1932
- C:\Windows\System\IwOsGxf.exe
  C:\Windows\System\IwOsGxf.exe
  2⤵
  - Executes dropped EXE
  PID:1100
- C:\Windows\System\coyRYju.exe
  C:\Windows\System\coyRYju.exe
  2⤵
  - Executes dropped EXE
  PID:1076
- C:\Windows\System\NuVavvY.exe
  C:\Windows\System\NuVavvY.exe
  2⤵
  - Executes dropped EXE
  PID:4968
- C:\Windows\System\DkfNneO.exe
  C:\Windows\System\DkfNneO.exe
  2⤵
  - Executes dropped EXE
  PID:2472
- C:\Windows\System\RCOLzJT.exe
  C:\Windows\System\RCOLzJT.exe
  2⤵
  - Executes dropped EXE
  PID:4900
- C:\Windows\System\KklKQOu.exe
  C:\Windows\System\KklKQOu.exe
  2⤵
  - Executes dropped EXE
  PID:3960
- C:\Windows\System\QoVQSQM.exe
  C:\Windows\System\QoVQSQM.exe
  2⤵
  - Executes dropped EXE
  PID:2976
- C:\Windows\System\iTzBvJx.exe
  C:\Windows\System\iTzBvJx.exe
  2⤵
  - Executes dropped EXE
  PID:836
- C:\Windows\System\TVKKcph.exe
  C:\Windows\System\TVKKcph.exe
  2⤵
  - Executes dropped EXE
  PID:2268
- C:\Windows\System\gIwaKdo.exe
  C:\Windows\System\gIwaKdo.exe
  2⤵
  - Executes dropped EXE
  PID:2428
- C:\Windows\System\eGIuBeY.exe
  C:\Windows\System\eGIuBeY.exe
  2⤵
  - Executes dropped EXE
  PID:2424
- C:\Windows\System\dLQdIfA.exe
  C:\Windows\System\dLQdIfA.exe
  2⤵
  - Executes dropped EXE
  PID:2760
- C:\Windows\System\vgsyUDd.exe
  C:\Windows\System\vgsyUDd.exe
  2⤵
  - Executes dropped EXE
  PID:1936
- C:\Windows\System\rvlejyN.exe
  C:\Windows\System\rvlejyN.exe
  2⤵
  - Executes dropped EXE
  PID:5076
- C:\Windows\System\hflOEHE.exe
  C:\Windows\System\hflOEHE.exe
  2⤵
  - Executes dropped EXE
  PID:3816
- C:\Windows\System\kDZazCe.exe
  C:\Windows\System\kDZazCe.exe
  2⤵
  - Executes dropped EXE
  PID:4868
- C:\Windows\System\qxWzubu.exe
  C:\Windows\System\qxWzubu.exe
  2⤵
  - Executes dropped EXE
  PID:3164
- C:\Windows\System\tqoFKDH.exe
  C:\Windows\System\tqoFKDH.exe
  2⤵
  - Executes dropped EXE
  PID:4052
- C:\Windows\System\UVZEAbS.exe
  C:\Windows\System\UVZEAbS.exe
  2⤵
  - Executes dropped EXE
  PID:4436
- C:\Windows\System\qkmOzXh.exe
  C:\Windows\System\qkmOzXh.exe
  2⤵
  - Executes dropped EXE
  PID:5108
- C:\Windows\System\VQwXyTf.exe
  C:\Windows\System\VQwXyTf.exe
  2⤵
  - Executes dropped EXE
  PID:3684
- C:\Windows\System\eGTSfCb.exe
  C:\Windows\System\eGTSfCb.exe
  2⤵
  - Executes dropped EXE
  PID:2524
- C:\Windows\System\EIUvXGm.exe
  C:\Windows\System\EIUvXGm.exe
  2⤵
  - Executes dropped EXE
  PID:4936
- C:\Windows\System\QkFtfyj.exe
  C:\Windows\System\QkFtfyj.exe
  2⤵
  - Executes dropped EXE
  PID:1592
- C:\Windows\System\XHkpbjt.exe
  C:\Windows\System\XHkpbjt.exe
  2⤵
  - Executes dropped EXE
  PID:4732
- C:\Windows\System\FsdpBNi.exe
  C:\Windows\System\FsdpBNi.exe
  2⤵
  - Executes dropped EXE
  PID:3280
- C:\Windows\System\udazXwO.exe
  C:\Windows\System\udazXwO.exe
  2⤵
  - Executes dropped EXE
  PID:2556
- C:\Windows\System\aDdJhcH.exe
  C:\Windows\System\aDdJhcH.exe
  2⤵
  - Executes dropped EXE
  PID:3524
- C:\Windows\System\LUxFJRi.exe
  C:\Windows\System\LUxFJRi.exe
  2⤵
  - Executes dropped EXE
  PID:760
- C:\Windows\System\DzHRplk.exe
  C:\Windows\System\DzHRplk.exe
  2⤵
  - Executes dropped EXE
  PID:2872
- C:\Windows\System\dTrXedr.exe
  C:\Windows\System\dTrXedr.exe
  2⤵
  - Executes dropped EXE
  PID:4300
- C:\Windows\System\GprkUoo.exe
  C:\Windows\System\GprkUoo.exe
  2⤵
  - Executes dropped EXE
  PID:4312
- C:\Windows\System\bRsOLnX.exe
  C:\Windows\System\bRsOLnX.exe
  2⤵
  - Executes dropped EXE
  PID:1060
- C:\Windows\System\BiTiXtR.exe
  C:\Windows\System\BiTiXtR.exe
  2⤵
  - Executes dropped EXE
  PID:1492
- C:\Windows\System\pWyGBRM.exe
  C:\Windows\System\pWyGBRM.exe
  2⤵
  - Executes dropped EXE
  PID:384
- C:\Windows\System\MFDMcYo.exe
  C:\Windows\System\MFDMcYo.exe
  2⤵
  - Executes dropped EXE
  PID:1516
- C:\Windows\System\zLPMhnO.exe
  C:\Windows\System\zLPMhnO.exe
  2⤵
  - Executes dropped EXE
  PID:2232
- C:\Windows\System\SeImwRJ.exe
  C:\Windows\System\SeImwRJ.exe
  2⤵
  - Executes dropped EXE
  PID:1756
- C:\Windows\System\jmbGAWO.exe
  C:\Windows\System\jmbGAWO.exe
  2⤵
  - Executes dropped EXE
  PID:4452
- C:\Windows\System\AjIkfir.exe
  C:\Windows\System\AjIkfir.exe
  2⤵
  - Executes dropped EXE
  PID:3972
- C:\Windows\System\VdBeekZ.exe
  C:\Windows\System\VdBeekZ.exe
  2⤵
  - Executes dropped EXE
  PID:1276
- C:\Windows\System\LCHRVmY.exe
  C:\Windows\System\LCHRVmY.exe
  2⤵
  - Executes dropped EXE
  PID:4796
- C:\Windows\System\YQuXiAH.exe
  C:\Windows\System\YQuXiAH.exe
  2⤵
  - Executes dropped EXE
  PID:1976
- C:\Windows\System\drDHupw.exe
  C:\Windows\System\drDHupw.exe
  2⤵
  - Executes dropped EXE
  PID:756
- C:\Windows\System\REOgbxe.exe
  C:\Windows\System\REOgbxe.exe
  2⤵
  - Executes dropped EXE
  PID:4716
- C:\Windows\System\rEdawCa.exe
  C:\Windows\System\rEdawCa.exe
  2⤵
  - Executes dropped EXE
  PID:1044
- C:\Windows\System\fDGVnAJ.exe
  C:\Windows\System\fDGVnAJ.exe
  2⤵
  - Executes dropped EXE
  PID:4124
- C:\Windows\System\JKptzvt.exe
  C:\Windows\System\JKptzvt.exe
  2⤵
  - Executes dropped EXE
  PID:1160
- C:\Windows\System\clkMCsB.exe
  C:\Windows\System\clkMCsB.exe
  2⤵
  - Executes dropped EXE
  PID:2464
- C:\Windows\System\RgXHENB.exe
  C:\Windows\System\RgXHENB.exe
  2⤵
  - Executes dropped EXE
  PID:1568
- C:\Windows\System\sHhzGtk.exe
  C:\Windows\System\sHhzGtk.exe
  2⤵
  - Executes dropped EXE
  PID:4460
- C:\Windows\System\bInrdsf.exe
  C:\Windows\System\bInrdsf.exe
  2⤵
  - Executes dropped EXE
  PID:4368
- C:\Windows\System\etXCzly.exe
  C:\Windows\System\etXCzly.exe
  2⤵
  - Executes dropped EXE
  PID:3140
- C:\Windows\System\vOKQIEQ.exe
  C:\Windows\System\vOKQIEQ.exe
  2⤵
  - Executes dropped EXE
  PID:916
- C:\Windows\System\OTKgwIU.exe
  C:\Windows\System\OTKgwIU.exe
  2⤵
  - Executes dropped EXE
  PID:4576
- C:\Windows\System\krVAKVi.exe
  C:\Windows\System\krVAKVi.exe
  2⤵
  - Executes dropped EXE
  PID:3900
- C:\Windows\System\JOjLMVk.exe
  C:\Windows\System\JOjLMVk.exe
  2⤵
  - Executes dropped EXE
  PID:4100
- C:\Windows\System\vtdhkzF.exe
  C:\Windows\System\vtdhkzF.exe
  2⤵
  - Executes dropped EXE
  PID:4740
- C:\Windows\System\DpTYHQt.exe
  C:\Windows\System\DpTYHQt.exe
  2⤵
  - Executes dropped EXE
  PID:2364
- C:\Windows\System\RPQSFJt.exe
  C:\Windows\System\RPQSFJt.exe
  2⤵
  - Executes dropped EXE
  PID:3724
- C:\Windows\System\yhMBxHi.exe
  C:\Windows\System\yhMBxHi.exe
  2⤵
  - Executes dropped EXE
  PID:1528
- C:\Windows\System\aMpOAFO.exe
  C:\Windows\System\aMpOAFO.exe
  2⤵
  - Executes dropped EXE
  PID:808
- C:\Windows\System\kmdiapQ.exe
  C:\Windows\System\kmdiapQ.exe
  2⤵
  - Executes dropped EXE
  PID:4012
- C:\Windows\System\PTeqTuX.exe
  C:\Windows\System\PTeqTuX.exe
  2⤵
  PID:4828
- C:\Windows\System\lCjkjVe.exe
  C:\Windows\System\lCjkjVe.exe
  2⤵
  PID:4104
- C:\Windows\System\TcdHYby.exe
  C:\Windows\System\TcdHYby.exe
  2⤵
  PID:3256
- C:\Windows\System\eoLXNzK.exe
  C:\Windows\System\eoLXNzK.exe
  2⤵
  PID:512
- C:\Windows\System\zWHUbcP.exe
  C:\Windows\System\zWHUbcP.exe
  2⤵
  PID:832
- C:\Windows\System\yiVmmXi.exe
  C:\Windows\System\yiVmmXi.exe
  2⤵
  PID:216
- C:\Windows\System\DiDhOrg.exe
  C:\Windows\System\DiDhOrg.exe
  2⤵
  PID:1312
- C:\Windows\System\zAIALhB.exe
  C:\Windows\System\zAIALhB.exe
  2⤵
  PID:4324
- C:\Windows\System\QGLBWHR.exe
  C:\Windows\System\QGLBWHR.exe
  2⤵
  PID:4488
- C:\Windows\System\mXyPIkh.exe
  C:\Windows\System\mXyPIkh.exe
  2⤵
  PID:2028
- C:\Windows\System\XcjGOQy.exe
  C:\Windows\System\XcjGOQy.exe
  2⤵
  PID:2204
- C:\Windows\System\fyjvMpq.exe
  C:\Windows\System\fyjvMpq.exe
  2⤵
  PID:3548
- C:\Windows\System\ronNLzj.exe
  C:\Windows\System\ronNLzj.exe
  2⤵
  PID:4648
- C:\Windows\System\OcSTRlW.exe
  C:\Windows\System\OcSTRlW.exe
  2⤵
  PID:4476
- C:\Windows\System\kUosdFX.exe
  C:\Windows\System\kUosdFX.exe
  2⤵
  PID:428
- C:\Windows\System\FdJxuNt.exe
  C:\Windows\System\FdJxuNt.exe
  2⤵
  PID:4912
- C:\Windows\System\vWUmbSL.exe
  C:\Windows\System\vWUmbSL.exe
  2⤵
  PID:1052
- C:\Windows\System\SgezoDA.exe
  C:\Windows\System\SgezoDA.exe
  2⤵
  PID:4620
- C:\Windows\System\NZMNkBU.exe
  C:\Windows\System\NZMNkBU.exe
  2⤵
  PID:804
- C:\Windows\System\DVLEkyJ.exe
  C:\Windows\System\DVLEkyJ.exe
  2⤵
  PID:5124
- C:\Windows\System\kbYBKEF.exe
  C:\Windows\System\kbYBKEF.exe
  2⤵
  PID:5148
- C:\Windows\System\mfeHlHI.exe
  C:\Windows\System\mfeHlHI.exe
  2⤵
  PID:5180
- C:\Windows\System\LkknNlR.exe
  C:\Windows\System\LkknNlR.exe
  2⤵
  PID:5204
- C:\Windows\System\aKtsMMP.exe
  C:\Windows\System\aKtsMMP.exe
  2⤵
  PID:5228
- C:\Windows\System\STcPjbS.exe
  C:\Windows\System\STcPjbS.exe
  2⤵
  PID:5260
- C:\Windows\System\LgXgggd.exe
  C:\Windows\System\LgXgggd.exe
  2⤵
  PID:5292
- C:\Windows\System\UTUpKRY.exe
  C:\Windows\System\UTUpKRY.exe
  2⤵
  PID:5316
- C:\Windows\System\zdFrqyw.exe
  C:\Windows\System\zdFrqyw.exe
  2⤵
  PID:5336
- C:\Windows\System\MyGxfkE.exe
  C:\Windows\System\MyGxfkE.exe
  2⤵
  PID:5364
- C:\Windows\System\CYSRuBi.exe
  C:\Windows\System\CYSRuBi.exe
  2⤵
  PID:5388
- C:\Windows\System\zLhsSFx.exe
  C:\Windows\System\zLhsSFx.exe
  2⤵
  PID:5420
- C:\Windows\System\QhsWsTi.exe
  C:\Windows\System\QhsWsTi.exe
  2⤵
  PID:5448
- C:\Windows\System\aSaIFIl.exe
  C:\Windows\System\aSaIFIl.exe
  2⤵
  PID:5476
- C:\Windows\System\xMEBuSz.exe
  C:\Windows\System\xMEBuSz.exe
  2⤵
  PID:5500
- C:\Windows\System\MvNShTd.exe
  C:\Windows\System\MvNShTd.exe
  2⤵
  PID:5532
- C:\Windows\System\iFadgmW.exe
  C:\Windows\System\iFadgmW.exe
  2⤵
  PID:5560
- C:\Windows\System\POsTbaQ.exe
  C:\Windows\System\POsTbaQ.exe
  2⤵
  PID:5588
- C:\Windows\System\gnVPhnY.exe
  C:\Windows\System\gnVPhnY.exe
  2⤵
  PID:5616
- C:\Windows\System\temcBgM.exe
  C:\Windows\System\temcBgM.exe
  2⤵
  PID:5644
- C:\Windows\System\ToBEmeg.exe
  C:\Windows\System\ToBEmeg.exe
  2⤵
  PID:5672
- C:\Windows\System\QbkDpjN.exe
  C:\Windows\System\QbkDpjN.exe
  2⤵
  PID:5700
- C:\Windows\System\SnFEOMj.exe
  C:\Windows\System\SnFEOMj.exe
  2⤵
  PID:5728
- C:\Windows\System\wpfIVFg.exe
  C:\Windows\System\wpfIVFg.exe
  2⤵
  PID:5756
- C:\Windows\System\rRljDbf.exe
  C:\Windows\System\rRljDbf.exe
  2⤵
  PID:5780
- C:\Windows\System\wahBrUH.exe
  C:\Windows\System\wahBrUH.exe
  2⤵
  PID:5808
- C:\Windows\System\iLAgWvo.exe
  C:\Windows\System\iLAgWvo.exe
  2⤵
  PID:5840
- C:\Windows\System\cxXxfvv.exe
  C:\Windows\System\cxXxfvv.exe
  2⤵
  PID:5868
- C:\Windows\System\DkPBuDo.exe
  C:\Windows\System\DkPBuDo.exe
  2⤵
  PID:5896
- C:\Windows\System\EviDgoo.exe
  C:\Windows\System\EviDgoo.exe
  2⤵
  PID:5920
- C:\Windows\System\ZmcWleU.exe
  C:\Windows\System\ZmcWleU.exe
  2⤵
  PID:5952
- C:\Windows\System\OJytUyW.exe
  C:\Windows\System\OJytUyW.exe
  2⤵
  PID:5984
- C:\Windows\System\yXhAzar.exe
  C:\Windows\System\yXhAzar.exe
  2⤵
  PID:6012
- C:\Windows\System\EvLGTtR.exe
  C:\Windows\System\EvLGTtR.exe
  2⤵
  PID:6044
- C:\Windows\System\eRfWTHz.exe
  C:\Windows\System\eRfWTHz.exe
  2⤵
  PID:6076
- C:\Windows\System\eGsEZbo.exe
  C:\Windows\System\eGsEZbo.exe
  2⤵
  PID:6100
- C:\Windows\System\NGWuqwA.exe
  C:\Windows\System\NGWuqwA.exe
  2⤵
  PID:6124
- C:\Windows\System\QAMlxdT.exe
  C:\Windows\System\QAMlxdT.exe
  2⤵
  PID:4808
- C:\Windows\System\bCTWlOG.exe
  C:\Windows\System\bCTWlOG.exe
  2⤵
  PID:3852
- C:\Windows\System\hPtCdQF.exe
  C:\Windows\System\hPtCdQF.exe
  2⤵
  PID:2208
- C:\Windows\System\uXOzFKp.exe
  C:\Windows\System\uXOzFKp.exe
  2⤵
  PID:3872
- C:\Windows\System\YzgUGAz.exe
  C:\Windows\System\YzgUGAz.exe
  2⤵
  PID:2180
- C:\Windows\System\CoJUJPv.exe
  C:\Windows\System\CoJUJPv.exe
  2⤵
  PID:1196
- C:\Windows\System\ywqDmPa.exe
  C:\Windows\System\ywqDmPa.exe
  2⤵
  PID:3504
- C:\Windows\System\SIEwMji.exe
  C:\Windows\System\SIEwMji.exe
  2⤵
  PID:3308
- C:\Windows\System\HMrfSmk.exe
  C:\Windows\System\HMrfSmk.exe
  2⤵
  PID:5164
- C:\Windows\System\LCbsEiu.exe
  C:\Windows\System\LCbsEiu.exe
  2⤵
  PID:5224
- C:\Windows\System\kLfhMXy.exe
  C:\Windows\System\kLfhMXy.exe
  2⤵
  PID:5300
- C:\Windows\System\IkuKRqo.exe
  C:\Windows\System\IkuKRqo.exe
  2⤵
  PID:5372
- C:\Windows\System\srusaLe.exe
  C:\Windows\System\srusaLe.exe
  2⤵
  PID:5436
- C:\Windows\System\vHVqDAw.exe
  C:\Windows\System\vHVqDAw.exe
  2⤵
  PID:5492
- C:\Windows\System\MAletuJ.exe
  C:\Windows\System\MAletuJ.exe
  2⤵
  PID:5548
- C:\Windows\System\bmxxLcv.exe
  C:\Windows\System\bmxxLcv.exe
  2⤵
  PID:5608
- C:\Windows\System\KxsyrBj.exe
  C:\Windows\System\KxsyrBj.exe
  2⤵
  PID:5660
- C:\Windows\System\zEcFkRc.exe
  C:\Windows\System\zEcFkRc.exe
  2⤵
  PID:5720
- C:\Windows\System\rLUZOlU.exe
  C:\Windows\System\rLUZOlU.exe
  2⤵
  PID:5776
- C:\Windows\System\oaXicIv.exe
  C:\Windows\System\oaXicIv.exe
  2⤵
  PID:5832
- C:\Windows\System\fAxhtwG.exe
  C:\Windows\System\fAxhtwG.exe
  2⤵
  PID:5912
- C:\Windows\System\sFBHPGs.exe
  C:\Windows\System\sFBHPGs.exe
  2⤵
  PID:5972
- C:\Windows\System\xSRYNfo.exe
  C:\Windows\System\xSRYNfo.exe
  2⤵
  PID:6032
- C:\Windows\System\UOcRtFD.exe
  C:\Windows\System\UOcRtFD.exe
  2⤵
  PID:6096
- C:\Windows\System\pkvJBUi.exe
  C:\Windows\System\pkvJBUi.exe
  2⤵
  PID:3552
- C:\Windows\System\gCtPsvL.exe
  C:\Windows\System\gCtPsvL.exe
  2⤵
  PID:3536
- C:\Windows\System\HMjaucp.exe
  C:\Windows\System\HMjaucp.exe
  2⤵
  PID:4448
- C:\Windows\System\pWCHuhT.exe
  C:\Windows\System\pWCHuhT.exe
  2⤵
  PID:5140
- C:\Windows\System\zpwQoKB.exe
  C:\Windows\System\zpwQoKB.exe
  2⤵
  PID:5252
- C:\Windows\System\qnAgxGx.exe
  C:\Windows\System\qnAgxGx.exe
  2⤵
  PID:5404
- C:\Windows\System\fbBjsXV.exe
  C:\Windows\System\fbBjsXV.exe
  2⤵
  PID:5540
- C:\Windows\System\eDVQALw.exe
  C:\Windows\System\eDVQALw.exe
  2⤵
  PID:3644
- C:\Windows\System\AKtHUvI.exe
  C:\Windows\System\AKtHUvI.exe
  2⤵
  PID:5800
- C:\Windows\System\gUkLwKF.exe
  C:\Windows\System\gUkLwKF.exe
  2⤵
  PID:6148
- C:\Windows\System\xtNSXrK.exe
  C:\Windows\System\xtNSXrK.exe
  2⤵
  PID:6176
- C:\Windows\System\YVsMPkk.exe
  C:\Windows\System\YVsMPkk.exe
  2⤵
  PID:6200
- C:\Windows\System\PwuVmqT.exe
  C:\Windows\System\PwuVmqT.exe
  2⤵
  PID:6232
- C:\Windows\System\ctkHFpM.exe
  C:\Windows\System\ctkHFpM.exe
  2⤵
  PID:6260
- C:\Windows\System\jsvlJhk.exe
  C:\Windows\System\jsvlJhk.exe
  2⤵
  PID:6288
- C:\Windows\System\lvFZdGy.exe
  C:\Windows\System\lvFZdGy.exe
  2⤵
  PID:6316
- C:\Windows\System\iddeBOB.exe
  C:\Windows\System\iddeBOB.exe
  2⤵
  PID:6344
- C:\Windows\System\YyfHVpL.exe
  C:\Windows\System\YyfHVpL.exe
  2⤵
  PID:6372
- C:\Windows\System\OHriCfF.exe
  C:\Windows\System\OHriCfF.exe
  2⤵
  PID:6400
- C:\Windows\System\blzJdGH.exe
  C:\Windows\System\blzJdGH.exe
  2⤵
  PID:6428
- C:\Windows\System\HrJrWWB.exe
  C:\Windows\System\HrJrWWB.exe
  2⤵
  PID:6456
- C:\Windows\System\JYvxPmd.exe
  C:\Windows\System\JYvxPmd.exe
  2⤵
  PID:6484
- C:\Windows\System\oYwACPH.exe
  C:\Windows\System\oYwACPH.exe
  2⤵
  PID:6512
- C:\Windows\System\YwpSgTC.exe
  C:\Windows\System\YwpSgTC.exe
  2⤵
  PID:6540
- C:\Windows\System\XVxkJgo.exe
  C:\Windows\System\XVxkJgo.exe
  2⤵
  PID:6568
- C:\Windows\System\eHcCpFB.exe
  C:\Windows\System\eHcCpFB.exe
  2⤵
  PID:6596
- C:\Windows\System\kUKElmh.exe
  C:\Windows\System\kUKElmh.exe
  2⤵
  PID:6624
- C:\Windows\System\iUiReNl.exe
  C:\Windows\System\iUiReNl.exe
  2⤵
  PID:6656
- C:\Windows\System\lkKbDUz.exe
  C:\Windows\System\lkKbDUz.exe
  2⤵
  PID:6688
- C:\Windows\System\iifHfzs.exe
  C:\Windows\System\iifHfzs.exe
  2⤵
  PID:6716
- C:\Windows\System\ZIhJfOv.exe
  C:\Windows\System\ZIhJfOv.exe
  2⤵
  PID:6744
- C:\Windows\System\AlfZwYQ.exe
  C:\Windows\System\AlfZwYQ.exe
  2⤵
  PID:6772
- C:\Windows\System\KVHKjsf.exe
  C:\Windows\System\KVHKjsf.exe
  2⤵
  PID:6800
- C:\Windows\System\HGNwMGv.exe
  C:\Windows\System\HGNwMGv.exe
  2⤵
  PID:6828
- C:\Windows\System\xJUHorc.exe
  C:\Windows\System\xJUHorc.exe
  2⤵
  PID:6856
- C:\Windows\System\AZPcdWA.exe
  C:\Windows\System\AZPcdWA.exe
  2⤵
  PID:6884
- C:\Windows\System\KsQpVMM.exe
  C:\Windows\System\KsQpVMM.exe
  2⤵
  PID:6912
- C:\Windows\System\VZTBMvK.exe
  C:\Windows\System\VZTBMvK.exe
  2⤵
  PID:6940
- C:\Windows\System\UrFffAN.exe
  C:\Windows\System\UrFffAN.exe
  2⤵
  PID:6960
- C:\Windows\System\VAdVkpB.exe
  C:\Windows\System\VAdVkpB.exe
  2⤵
  PID:6988
- C:\Windows\System\cmdhlpq.exe
  C:\Windows\System\cmdhlpq.exe
  2⤵
  PID:7016
- C:\Windows\System\TaCheAY.exe
  C:\Windows\System\TaCheAY.exe
  2⤵
  PID:7044
- C:\Windows\System\dIgeqWi.exe
  C:\Windows\System\dIgeqWi.exe
  2⤵
  PID:7072
- C:\Windows\System\RnZLUMT.exe
  C:\Windows\System\RnZLUMT.exe
  2⤵
  PID:7100
- C:\Windows\System\AfsyqEW.exe
  C:\Windows\System\AfsyqEW.exe
  2⤵
  PID:7128
- C:\Windows\System\ubLGKaH.exe
  C:\Windows\System\ubLGKaH.exe
  2⤵
  PID:7156
- C:\Windows\System\uGGBSsx.exe
  C:\Windows\System\uGGBSsx.exe
  2⤵
  PID:6008
- C:\Windows\System\ZVaXZzY.exe
  C:\Windows\System\ZVaXZzY.exe
  2⤵
  PID:712
- C:\Windows\System\mvESuyT.exe
  C:\Windows\System\mvESuyT.exe
  2⤵
  PID:5636
- C:\Windows\System\fapwRLy.exe
  C:\Windows\System\fapwRLy.exe
  2⤵
  PID:5884
- C:\Windows\System\KhAfsxj.exe
  C:\Windows\System\KhAfsxj.exe
  2⤵
  PID:6188
- C:\Windows\System\hFyQDQI.exe
  C:\Windows\System\hFyQDQI.exe
  2⤵
  PID:6248
- C:\Windows\System\brcAhrV.exe
  C:\Windows\System\brcAhrV.exe
  2⤵
  PID:6332
- C:\Windows\System\gYNYtcI.exe
  C:\Windows\System\gYNYtcI.exe
  2⤵
  PID:2704
- C:\Windows\System\QsguuIV.exe
  C:\Windows\System\QsguuIV.exe
  2⤵
  PID:6392
- C:\Windows\System\ZcpNLjh.exe
  C:\Windows\System\ZcpNLjh.exe
  2⤵
  PID:6448
- C:\Windows\System\MtxyGFI.exe
  C:\Windows\System\MtxyGFI.exe
  2⤵
  PID:6524
- C:\Windows\System\NAELvmZ.exe
  C:\Windows\System\NAELvmZ.exe
  2⤵
  PID:1396
- C:\Windows\System\CpFdqub.exe
  C:\Windows\System\CpFdqub.exe
  2⤵
  PID:2408
- C:\Windows\System\hMsnGCj.exe
  C:\Windows\System\hMsnGCj.exe
  2⤵
  PID:6684
- C:\Windows\System\VshxoWC.exe
  C:\Windows\System\VshxoWC.exe
  2⤵
  PID:6736
- C:\Windows\System\qbgdjOy.exe
  C:\Windows\System\qbgdjOy.exe
  2⤵
  PID:6764
- C:\Windows\System\FZNpKIb.exe
  C:\Windows\System\FZNpKIb.exe
  2⤵
  PID:4664
- C:\Windows\System\fmhJHKx.exe
  C:\Windows\System\fmhJHKx.exe
  2⤵
  PID:4680
- C:\Windows\System\baLuhqX.exe
  C:\Windows\System\baLuhqX.exe
  2⤵
  PID:6876
- C:\Windows\System\XMafxaf.exe
  C:\Windows\System\XMafxaf.exe
  2⤵
  PID:6932
- C:\Windows\System\jWRWDkb.exe
  C:\Windows\System\jWRWDkb.exe
  2⤵
  PID:1032
- C:\Windows\System\rQuzpSs.exe
  C:\Windows\System\rQuzpSs.exe
  2⤵
  PID:7008
- C:\Windows\System\xarOuhv.exe
  C:\Windows\System\xarOuhv.exe
  2⤵
  PID:7036
- C:\Windows\System\ZoWgbgA.exe
  C:\Windows\System\ZoWgbgA.exe
  2⤵
  PID:2316
- C:\Windows\System\wbkldQM.exe
  C:\Windows\System\wbkldQM.exe
  2⤵
  PID:7140
- C:\Windows\System\vuzhsnx.exe
  C:\Windows\System\vuzhsnx.exe
  2⤵
  PID:7084
- C:\Windows\System\tLFujyV.exe
  C:\Windows\System\tLFujyV.exe
  2⤵
  PID:5960
- C:\Windows\System\jPdmJpB.exe
  C:\Windows\System\jPdmJpB.exe
  2⤵
  PID:5200
- C:\Windows\System\kBBDIZd.exe
  C:\Windows\System\kBBDIZd.exe
  2⤵
  PID:3700
- C:\Windows\System\gPAsNJU.exe
  C:\Windows\System\gPAsNJU.exe
  2⤵
  PID:732
- C:\Windows\System\hFhNwIm.exe
  C:\Windows\System\hFhNwIm.exe
  2⤵
  PID:6224
- C:\Windows\System\RjWYNYm.exe
  C:\Windows\System\RjWYNYm.exe
  2⤵
  PID:6504
- C:\Windows\System\CHypqcK.exe
  C:\Windows\System\CHypqcK.exe
  2⤵
  PID:6440
- C:\Windows\System\PksHyrL.exe
  C:\Windows\System\PksHyrL.exe
  2⤵
  PID:6580
- C:\Windows\System\JwJPezz.exe
  C:\Windows\System\JwJPezz.exe
  2⤵
  PID:6732
- C:\Windows\System\NvhJDlf.exe
  C:\Windows\System\NvhJDlf.exe
  2⤵
  PID:6848
- C:\Windows\System\pDLfofC.exe
  C:\Windows\System\pDLfofC.exe
  2⤵
  PID:2620
- C:\Windows\System\sGNDoCe.exe
  C:\Windows\System\sGNDoCe.exe
  2⤵
  PID:4872
- C:\Windows\System\wDcfVWW.exe
  C:\Windows\System\wDcfVWW.exe
  2⤵
  PID:7056
- C:\Windows\System\djhcWsB.exe
  C:\Windows\System\djhcWsB.exe
  2⤵
  PID:6120
- C:\Windows\System\GKIWqlv.exe
  C:\Windows\System\GKIWqlv.exe
  2⤵
  PID:3648
- C:\Windows\System\fDgxqlB.exe
  C:\Windows\System\fDgxqlB.exe
  2⤵
  PID:7148
- C:\Windows\System\TUvHTEn.exe
  C:\Windows\System\TUvHTEn.exe
  2⤵
  PID:1948
- C:\Windows\System\HDCMBwM.exe
  C:\Windows\System\HDCMBwM.exe
  2⤵
  PID:6788
- C:\Windows\System\BBoXZgK.exe
  C:\Windows\System\BBoXZgK.exe
  2⤵
  PID:872
- C:\Windows\System\tBzRjvu.exe
  C:\Windows\System\tBzRjvu.exe
  2⤵
  PID:3668
- C:\Windows\System\rpVtbAz.exe
  C:\Windows\System\rpVtbAz.exe
  2⤵
  PID:4604
- C:\Windows\System\VDHwybO.exe
  C:\Windows\System\VDHwybO.exe
  2⤵
  PID:6652
- C:\Windows\System\BbBQhxW.exe
  C:\Windows\System\BbBQhxW.exe
  2⤵
  PID:6972
- C:\Windows\System\WhGZOtt.exe
  C:\Windows\System\WhGZOtt.exe
  2⤵
  PID:1576
- C:\Windows\System\AbtofHg.exe
  C:\Windows\System\AbtofHg.exe
  2⤵
  PID:7180
- C:\Windows\System\vlSryua.exe
  C:\Windows\System\vlSryua.exe
  2⤵
  PID:7196
- C:\Windows\System\lltiPWq.exe
  C:\Windows\System\lltiPWq.exe
  2⤵
  PID:7216
- C:\Windows\System\iDZmxVM.exe
  C:\Windows\System\iDZmxVM.exe
  2⤵
  PID:7240
- C:\Windows\System\OVxovLc.exe
  C:\Windows\System\OVxovLc.exe
  2⤵
  PID:7268
- C:\Windows\System\xTUiSDd.exe
  C:\Windows\System\xTUiSDd.exe
  2⤵
  PID:7304
- C:\Windows\System\WuowTpG.exe
  C:\Windows\System\WuowTpG.exe
  2⤵
  PID:7332
- C:\Windows\System\fZLYSYz.exe
  C:\Windows\System\fZLYSYz.exe
  2⤵
  PID:7356
- C:\Windows\System\LxqSnUI.exe
  C:\Windows\System\LxqSnUI.exe
  2⤵
  PID:7400
- C:\Windows\System\INEIWAD.exe
  C:\Windows\System\INEIWAD.exe
  2⤵
  PID:7436
- C:\Windows\System\eoRbapj.exe
  C:\Windows\System\eoRbapj.exe
  2⤵
  PID:7456
- C:\Windows\System\TvhGNgT.exe
  C:\Windows\System\TvhGNgT.exe
  2⤵
  PID:7476
- C:\Windows\System\yWahOFh.exe
  C:\Windows\System\yWahOFh.exe
  2⤵
  PID:7496
- C:\Windows\System\mEGBZZB.exe
  C:\Windows\System\mEGBZZB.exe
  2⤵
  PID:7516
- C:\Windows\System\ZBIRPEi.exe
  C:\Windows\System\ZBIRPEi.exe
  2⤵
  PID:7544
- C:\Windows\System\qWqaeAj.exe
  C:\Windows\System\qWqaeAj.exe
  2⤵
  PID:7588
- C:\Windows\System\xvTgQRl.exe
  C:\Windows\System\xvTgQRl.exe
  2⤵
  PID:7624
- C:\Windows\System\NxGtZaP.exe
  C:\Windows\System\NxGtZaP.exe
  2⤵
  PID:7660
- C:\Windows\System\yqzqTcQ.exe
  C:\Windows\System\yqzqTcQ.exe
  2⤵
  PID:7680
- C:\Windows\System\dqGDLoj.exe
  C:\Windows\System\dqGDLoj.exe
  2⤵
  PID:7696
- C:\Windows\System\HHAgPUM.exe
  C:\Windows\System\HHAgPUM.exe
  2⤵
  PID:7724
- C:\Windows\System\szKphYX.exe
  C:\Windows\System\szKphYX.exe
  2⤵
  PID:7752
- C:\Windows\System\ItQPoKX.exe
  C:\Windows\System\ItQPoKX.exe
  2⤵
  PID:7804
- C:\Windows\System\Advqykc.exe
  C:\Windows\System\Advqykc.exe
  2⤵
  PID:7820
- C:\Windows\System\JTvUSts.exe
  C:\Windows\System\JTvUSts.exe
  2⤵
  PID:7848
- C:\Windows\System\xsreeVe.exe
  C:\Windows\System\xsreeVe.exe
  2⤵
  PID:7864
- C:\Windows\System\BGEsNce.exe
  C:\Windows\System\BGEsNce.exe
  2⤵
  PID:7880
- C:\Windows\System\hPGWKHx.exe
  C:\Windows\System\hPGWKHx.exe
  2⤵
  PID:7900
- C:\Windows\System\UGXxxeS.exe
  C:\Windows\System\UGXxxeS.exe
  2⤵
  PID:7924
- C:\Windows\System\XSUZUpC.exe
  C:\Windows\System\XSUZUpC.exe
  2⤵
  PID:8000
- C:\Windows\System\dGHNJMx.exe
  C:\Windows\System\dGHNJMx.exe
  2⤵
  PID:8020
- C:\Windows\System\NBlhRVM.exe
  C:\Windows\System\NBlhRVM.exe
  2⤵
  PID:8048
- C:\Windows\System\RBLBSjQ.exe
  C:\Windows\System\RBLBSjQ.exe
  2⤵
  PID:8088
- C:\Windows\System\YstElJn.exe
  C:\Windows\System\YstElJn.exe
  2⤵
  PID:8116
- C:\Windows\System\oGVGYVC.exe
  C:\Windows\System\oGVGYVC.exe
  2⤵
  PID:8156
- C:\Windows\System\IHOKaTs.exe
  C:\Windows\System\IHOKaTs.exe
  2⤵
  PID:8172
- C:\Windows\System\TeBizJs.exe
  C:\Windows\System\TeBizJs.exe
  2⤵
  PID:3024
- C:\Windows\System\EKRiydd.exe
  C:\Windows\System\EKRiydd.exe
  2⤵
  PID:7256
- C:\Windows\System\XcDlkki.exe
  C:\Windows\System\XcDlkki.exe
  2⤵
  PID:7324
- C:\Windows\System\mRkNbwg.exe
  C:\Windows\System\mRkNbwg.exe
  2⤵
  PID:7384
- C:\Windows\System\qlrmclU.exe
  C:\Windows\System\qlrmclU.exe
  2⤵
  PID:7448
- C:\Windows\System\HSLxYJn.exe
  C:\Windows\System\HSLxYJn.exe
  2⤵
  PID:7528
- C:\Windows\System\AREHMJc.exe
  C:\Windows\System\AREHMJc.exe
  2⤵
  PID:7576
- C:\Windows\System\ZKFetRS.exe
  C:\Windows\System\ZKFetRS.exe
  2⤵
  PID:7672
- C:\Windows\System\Hhiltsh.exe
  C:\Windows\System\Hhiltsh.exe
  2⤵
  PID:7712
- C:\Windows\System\HfhCHKZ.exe
  C:\Windows\System\HfhCHKZ.exe
  2⤵
  PID:7784
- C:\Windows\System\leWewCH.exe
  C:\Windows\System\leWewCH.exe
  2⤵
  PID:7836
- C:\Windows\System\DAhyLMo.exe
  C:\Windows\System\DAhyLMo.exe
  2⤵
  PID:7912
- C:\Windows\System\TVSZxAc.exe
  C:\Windows\System\TVSZxAc.exe
  2⤵
  PID:7960
- C:\Windows\System\LAdgVrQ.exe
  C:\Windows\System\LAdgVrQ.exe
  2⤵
  PID:8040
- C:\Windows\System\pSWzZVI.exe
  C:\Windows\System\pSWzZVI.exe
  2⤵
  PID:8108
- C:\Windows\System\oZPDEAA.exe
  C:\Windows\System\oZPDEAA.exe
  2⤵
  PID:8188
- C:\Windows\System\ruVbvPI.exe
  C:\Windows\System\ruVbvPI.exe
  2⤵
  PID:7376
- C:\Windows\System\xyxKnRT.exe
  C:\Windows\System\xyxKnRT.exe
  2⤵
  PID:7464
- C:\Windows\System\PVMrvKP.exe
  C:\Windows\System\PVMrvKP.exe
  2⤵
  PID:7620
- C:\Windows\System\HqZcvxU.exe
  C:\Windows\System\HqZcvxU.exe
  2⤵
  PID:7676
- C:\Windows\System\RkaECbc.exe
  C:\Windows\System\RkaECbc.exe
  2⤵
  PID:7892
- C:\Windows\System\GeXvTzk.exe
  C:\Windows\System\GeXvTzk.exe
  2⤵
  PID:8012
- C:\Windows\System\biozgPH.exe
  C:\Windows\System\biozgPH.exe
  2⤵
  PID:8168
- C:\Windows\System\vOZjprF.exe
  C:\Windows\System\vOZjprF.exe
  2⤵
  PID:7564
- C:\Windows\System\bNTAPmo.exe
  C:\Windows\System\bNTAPmo.exe
  2⤵
  PID:8100
- C:\Windows\System\ItfPudE.exe
  C:\Windows\System\ItfPudE.exe
  2⤵
  PID:8136
- C:\Windows\System\VcoVxfA.exe
  C:\Windows\System\VcoVxfA.exe
  2⤵
  PID:7908
- C:\Windows\System\HvDxooe.exe
  C:\Windows\System\HvDxooe.exe
  2⤵
  PID:8196
- C:\Windows\System\qzYZpZv.exe
  C:\Windows\System\qzYZpZv.exe
  2⤵
  PID:8220
- C:\Windows\System\xvxRwgr.exe
  C:\Windows\System\xvxRwgr.exe
  2⤵
  PID:8236
- C:\Windows\System\TbMsKGd.exe
  C:\Windows\System\TbMsKGd.exe
  2⤵
  PID:8276
- C:\Windows\System\jXDFffP.exe
  C:\Windows\System\jXDFffP.exe
  2⤵
  PID:8308
- C:\Windows\System\Itsrcwc.exe
  C:\Windows\System\Itsrcwc.exe
  2⤵
  PID:8356
- C:\Windows\System\IpaFqWS.exe
  C:\Windows\System\IpaFqWS.exe
  2⤵
  PID:8372
- C:\Windows\System\EujjxdV.exe
  C:\Windows\System\EujjxdV.exe
  2⤵
  PID:8388
- C:\Windows\System\HGDSzEW.exe
  C:\Windows\System\HGDSzEW.exe
  2⤵
  PID:8440
- C:\Windows\System\StnmqBJ.exe
  C:\Windows\System\StnmqBJ.exe
  2⤵
  PID:8456
- C:\Windows\System\AmcYNUb.exe
  C:\Windows\System\AmcYNUb.exe
  2⤵
  PID:8488
- C:\Windows\System\JctwyFp.exe
  C:\Windows\System\JctwyFp.exe
  2⤵
  PID:8524
- C:\Windows\System\BtaDEzT.exe
  C:\Windows\System\BtaDEzT.exe
  2⤵
  PID:8548
- C:\Windows\System\hcTnZrx.exe
  C:\Windows\System\hcTnZrx.exe
  2⤵
  PID:8568
- C:\Windows\System\ZbdTqya.exe
  C:\Windows\System\ZbdTqya.exe
  2⤵
  PID:8588
- C:\Windows\System\MySoCYO.exe
  C:\Windows\System\MySoCYO.exe
  2⤵
  PID:8612
- C:\Windows\System\ZdFdWyW.exe
  C:\Windows\System\ZdFdWyW.exe
  2⤵
  PID:8640
- C:\Windows\System\TJqHXXB.exe
  C:\Windows\System\TJqHXXB.exe
  2⤵
  PID:8664
- C:\Windows\System\ojaJVGQ.exe
  C:\Windows\System\ojaJVGQ.exe
  2⤵
  PID:8688
- C:\Windows\System\TaZQOYa.exe
  C:\Windows\System\TaZQOYa.exe
  2⤵
  PID:8748
- C:\Windows\System\dBqIYBw.exe
  C:\Windows\System\dBqIYBw.exe
  2⤵
  PID:8768
- C:\Windows\System\RJfYJiJ.exe
  C:\Windows\System\RJfYJiJ.exe
  2⤵
  PID:8792
- C:\Windows\System\wPwvPDh.exe
  C:\Windows\System\wPwvPDh.exe
  2⤵
  PID:8832
- C:\Windows\System\wfMeYWj.exe
  C:\Windows\System\wfMeYWj.exe
  2⤵
  PID:8860
- C:\Windows\System\GmMHyGI.exe
  C:\Windows\System\GmMHyGI.exe
  2⤵
  PID:8888
- C:\Windows\System\JVetIgq.exe
  C:\Windows\System\JVetIgq.exe
  2⤵
  PID:8920
- C:\Windows\System\nmpctJY.exe
  C:\Windows\System\nmpctJY.exe
  2⤵
  PID:8936
- C:\Windows\System\feRUEEK.exe
  C:\Windows\System\feRUEEK.exe
  2⤵
  PID:8964
- C:\Windows\System\paMQzTu.exe
  C:\Windows\System\paMQzTu.exe
  2⤵
  PID:8992
- C:\Windows\System\BgxdbCr.exe
  C:\Windows\System\BgxdbCr.exe
  2⤵
  PID:9020
- C:\Windows\System\oPojTnI.exe
  C:\Windows\System\oPojTnI.exe
  2⤵
  PID:9060
- C:\Windows\System\VbVPhQu.exe
  C:\Windows\System\VbVPhQu.exe
  2⤵
  PID:9076
- C:\Windows\System\orLRagH.exe
  C:\Windows\System\orLRagH.exe
  2⤵
  PID:9116
- C:\Windows\System\yicaNWL.exe
  C:\Windows\System\yicaNWL.exe
  2⤵
  PID:9144
- C:\Windows\System\bkEQZFn.exe
  C:\Windows\System\bkEQZFn.exe
  2⤵
  PID:9164
- C:\Windows\System\XyTjxEx.exe
  C:\Windows\System\XyTjxEx.exe
  2⤵
  PID:9192
- C:\Windows\System\JnnjtLK.exe
  C:\Windows\System\JnnjtLK.exe
  2⤵
  PID:8212
- C:\Windows\System\ItqNsTj.exe
  C:\Windows\System\ItqNsTj.exe
  2⤵
  PID:8268
- C:\Windows\System\PhZjzCe.exe
  C:\Windows\System\PhZjzCe.exe
  2⤵
  PID:8340
- C:\Windows\System\DPWLMYy.exe
  C:\Windows\System\DPWLMYy.exe
  2⤵
  PID:8412
- C:\Windows\System\OLQKWGG.exe
  C:\Windows\System\OLQKWGG.exe
  2⤵
  PID:8484
- C:\Windows\System\CkABKqu.exe
  C:\Windows\System\CkABKqu.exe
  2⤵
  PID:8532
- C:\Windows\System\lHpYMqh.exe
  C:\Windows\System\lHpYMqh.exe
  2⤵
  PID:8608
- C:\Windows\System\qwFAEes.exe
  C:\Windows\System\qwFAEes.exe
  2⤵
  PID:8660
- C:\Windows\System\UGGmrwG.exe
  C:\Windows\System\UGGmrwG.exe
  2⤵
  PID:8708
- C:\Windows\System\UVSafAy.exe
  C:\Windows\System\UVSafAy.exe
  2⤵
  PID:8724
- C:\Windows\System\UfZXLns.exe
  C:\Windows\System\UfZXLns.exe
  2⤵
  PID:8784
- C:\Windows\System\YbOCorW.exe
  C:\Windows\System\YbOCorW.exe
  2⤵
  PID:8932
- C:\Windows\System\QvVBzDd.exe
  C:\Windows\System\QvVBzDd.exe
  2⤵
  PID:8976
- C:\Windows\System\xbjiprn.exe
  C:\Windows\System\xbjiprn.exe
  2⤵
  PID:9032
- C:\Windows\System\TjQufZq.exe
  C:\Windows\System\TjQufZq.exe
  2⤵
  PID:9096
- C:\Windows\System\cXHQFHT.exe
  C:\Windows\System\cXHQFHT.exe
  2⤵
  PID:9172
- C:\Windows\System\cgWyKeV.exe
  C:\Windows\System\cgWyKeV.exe
  2⤵
  PID:7748
- C:\Windows\System\gQNHBOL.exe
  C:\Windows\System\gQNHBOL.exe
  2⤵
  PID:8364
- C:\Windows\System\xGJdxNg.exe
  C:\Windows\System\xGJdxNg.exe
  2⤵
  PID:8448
- C:\Windows\System\FSEGyCQ.exe
  C:\Windows\System\FSEGyCQ.exe
  2⤵
  PID:8576
- C:\Windows\System\RkyrIxc.exe
  C:\Windows\System\RkyrIxc.exe
  2⤵
  PID:8780
- C:\Windows\System\oFhXeqU.exe
  C:\Windows\System\oFhXeqU.exe
  2⤵
  PID:8876
- C:\Windows\System\HoyVezo.exe
  C:\Windows\System\HoyVezo.exe
  2⤵
  PID:8960
- C:\Windows\System\YyDrjTK.exe
  C:\Windows\System\YyDrjTK.exe
  2⤵
  PID:9056
- C:\Windows\System\QwDIZPU.exe
  C:\Windows\System\QwDIZPU.exe
  2⤵
  PID:9204
- C:\Windows\System\ZAUiCxR.exe
  C:\Windows\System\ZAUiCxR.exe
  2⤵
  PID:8516
- C:\Windows\System\rQgMIvM.exe
  C:\Windows\System\rQgMIvM.exe
  2⤵
  PID:9228
- C:\Windows\System\kqpoSLw.exe
  C:\Windows\System\kqpoSLw.exe
  2⤵
  PID:9256
- C:\Windows\System\lhWddkg.exe
  C:\Windows\System\lhWddkg.exe
  2⤵
  PID:9284
- C:\Windows\System\rQQXlHu.exe
  C:\Windows\System\rQQXlHu.exe
  2⤵
  PID:9336
- C:\Windows\System\YAKIKbw.exe
  C:\Windows\System\YAKIKbw.exe
  2⤵
  PID:9376
- C:\Windows\System\roaDNbN.exe
  C:\Windows\System\roaDNbN.exe
  2⤵
  PID:9392
- C:\Windows\System\MIuUaho.exe
  C:\Windows\System\MIuUaho.exe
  2⤵
  PID:9432
- C:\Windows\System\PQqeRSN.exe
  C:\Windows\System\PQqeRSN.exe
  2⤵
  PID:9472
- C:\Windows\System\KdAOgIh.exe
  C:\Windows\System\KdAOgIh.exe
  2⤵
  PID:9488
- C:\Windows\System\xDXIgIy.exe
  C:\Windows\System\xDXIgIy.exe
  2⤵
  PID:9516
- C:\Windows\System\YtaNYsh.exe
  C:\Windows\System\YtaNYsh.exe
  2⤵
  PID:9544
- C:\Windows\System\sXaMEPg.exe
  C:\Windows\System\sXaMEPg.exe
  2⤵
  PID:9568
- C:\Windows\System\BrKvsKz.exe
  C:\Windows\System\BrKvsKz.exe
  2⤵
  PID:9604
- C:\Windows\System\WTYhGXn.exe
  C:\Windows\System\WTYhGXn.exe
  2⤵
  PID:9628
- C:\Windows\System\LbIqIGA.exe
  C:\Windows\System\LbIqIGA.exe
  2⤵
  PID:9648
- C:\Windows\System\qhudZbm.exe
  C:\Windows\System\qhudZbm.exe
  2⤵
  PID:9684
- C:\Windows\System\MutWQXO.exe
  C:\Windows\System\MutWQXO.exe
  2⤵
  PID:9716
- C:\Windows\System\uvgEDDt.exe
  C:\Windows\System\uvgEDDt.exe
  2⤵
  PID:9740
- C:\Windows\System\pQyweBe.exe
  C:\Windows\System\pQyweBe.exe
  2⤵
  PID:9768
- C:\Windows\System\hvZpNEY.exe
  C:\Windows\System\hvZpNEY.exe
  2⤵
  PID:9784
- C:\Windows\System\VsMecvC.exe
  C:\Windows\System\VsMecvC.exe
  2⤵
  PID:9812
- C:\Windows\System\CROrguB.exe
  C:\Windows\System\CROrguB.exe
  2⤵
  PID:9844
- C:\Windows\System\hVcgvAk.exe
  C:\Windows\System\hVcgvAk.exe
  2⤵
  PID:9892
- C:\Windows\System\lbYAXZy.exe
  C:\Windows\System\lbYAXZy.exe
  2⤵
  PID:9908
- C:\Windows\System\IoKsGYJ.exe
  C:\Windows\System\IoKsGYJ.exe
  2⤵
  PID:9936
- C:\Windows\System\nSxYNSW.exe
  C:\Windows\System\nSxYNSW.exe
  2⤵
  PID:9964
- C:\Windows\System\cJnwsNM.exe
  C:\Windows\System\cJnwsNM.exe
  2⤵
  PID:9992
- C:\Windows\System\RlOfUZf.exe
  C:\Windows\System\RlOfUZf.exe
  2⤵
  PID:10012
- C:\Windows\System\eEBijOO.exe
  C:\Windows\System\eEBijOO.exe
  2⤵
  PID:10052
- C:\Windows\System\mqlYLgq.exe
  C:\Windows\System\mqlYLgq.exe
  2⤵
  PID:10068
- C:\Windows\System\ZDagZXa.exe
  C:\Windows\System\ZDagZXa.exe
  2⤵
  PID:10108
- C:\Windows\System\wtJegot.exe
  C:\Windows\System\wtJegot.exe
  2⤵
  PID:10132
- C:\Windows\System\hgBnsVK.exe
  C:\Windows\System\hgBnsVK.exe
  2⤵
  PID:10160
- C:\Windows\System\kigwveV.exe
  C:\Windows\System\kigwveV.exe
  2⤵
  PID:10188
- C:\Windows\System\dxIVvAH.exe
  C:\Windows\System\dxIVvAH.exe
  2⤵
  PID:10228
- C:\Windows\System\vvuKqdo.exe
  C:\Windows\System\vvuKqdo.exe
  2⤵
  PID:8952
- C:\Windows\System\LTJxoGM.exe
  C:\Windows\System\LTJxoGM.exe
  2⤵
  PID:9152
- C:\Windows\System\HRQwdTF.exe
  C:\Windows\System\HRQwdTF.exe
  2⤵
  PID:9236
- C:\Windows\System\yFpqlOu.exe
  C:\Windows\System\yFpqlOu.exe
  2⤵
  PID:9276
- C:\Windows\System\CshglhW.exe
  C:\Windows\System\CshglhW.exe
  2⤵
  PID:9352
- C:\Windows\System\FethGdM.exe
  C:\Windows\System\FethGdM.exe
  2⤵
  PID:9388
- C:\Windows\System\mCmjCud.exe
  C:\Windows\System\mCmjCud.exe
  2⤵
  PID:9464
- C:\Windows\System\cYinlGS.exe
  C:\Windows\System\cYinlGS.exe
  2⤵
  PID:9512
- C:\Windows\System\bsriezz.exe
  C:\Windows\System\bsriezz.exe
  2⤵
  PID:9560
- C:\Windows\System\tQJsnEL.exe
  C:\Windows\System\tQJsnEL.exe
  2⤵
  PID:9616
- C:\Windows\System\hjRhIQl.exe
  C:\Windows\System\hjRhIQl.exe
  2⤵
  PID:9696
- C:\Windows\System\AEcMKel.exe
  C:\Windows\System\AEcMKel.exe
  2⤵
  PID:9756
- C:\Windows\System\SThabem.exe
  C:\Windows\System\SThabem.exe
  2⤵
  PID:9832
- C:\Windows\System\gttConB.exe
  C:\Windows\System\gttConB.exe
  2⤵
  PID:9904
- C:\Windows\System\mVrXtLg.exe
  C:\Windows\System\mVrXtLg.exe
  2⤵
  PID:9956
- C:\Windows\System\rNItvuE.exe
  C:\Windows\System\rNItvuE.exe
  2⤵
  PID:10008
- C:\Windows\System\ruNdnCa.exe
  C:\Windows\System\ruNdnCa.exe
  2⤵
  PID:10096
- C:\Windows\System\RSGFARx.exe
  C:\Windows\System\RSGFARx.exe
  2⤵
  PID:10128
- C:\Windows\System\jkLZCfG.exe
  C:\Windows\System\jkLZCfG.exe
  2⤵
  PID:10224
- C:\Windows\System\wVeeuyo.exe
  C:\Windows\System\wVeeuyo.exe
  2⤵
  PID:9244
- C:\Windows\System\TNIIjaG.exe
  C:\Windows\System\TNIIjaG.exe
  2⤵
  PID:9480
- C:\Windows\System\kUJbVII.exe
  C:\Windows\System\kUJbVII.exe
  2⤵
  PID:9668
- C:\Windows\System\WUmCWKN.exe
  C:\Windows\System\WUmCWKN.exe
  2⤵
  PID:9780
- C:\Windows\System\IJpKpPx.exe
  C:\Windows\System\IJpKpPx.exe
  2⤵
  PID:9980
- C:\Windows\System\CkkMpTy.exe
  C:\Windows\System\CkkMpTy.exe
  2⤵
  PID:10092
- C:\Windows\System\dyzgodk.exe
  C:\Windows\System\dyzgodk.exe
  2⤵
  PID:10220
- C:\Windows\System\FZYXNIk.exe
  C:\Windows\System\FZYXNIk.exe
  2⤵
  PID:9364
- C:\Windows\System\CwOXjKZ.exe
  C:\Windows\System\CwOXjKZ.exe
  2⤵
  PID:9728
- C:\Windows\System\VSPhopb.exe
  C:\Windows\System\VSPhopb.exe
  2⤵
  PID:10180
- C:\Windows\System\KolUkce.exe
  C:\Windows\System\KolUkce.exe
  2⤵
  PID:9884
- C:\Windows\System\sWqhhjm.exe
  C:\Windows\System\sWqhhjm.exe
  2⤵
  PID:10264
- C:\Windows\System\cGxNWxm.exe
  C:\Windows\System\cGxNWxm.exe
  2⤵
  PID:10284
- C:\Windows\System\IKwLyfv.exe
  C:\Windows\System\IKwLyfv.exe
  2⤵
  PID:10312
- C:\Windows\System\RJPHXnF.exe
  C:\Windows\System\RJPHXnF.exe
  2⤵
  PID:10340
- C:\Windows\System\ctDCjZl.exe
  C:\Windows\System\ctDCjZl.exe
  2⤵
  PID:10380
- C:\Windows\System\AOWgnpE.exe
  C:\Windows\System\AOWgnpE.exe
  2⤵
  PID:10408
- C:\Windows\System\QuiiVdC.exe
  C:\Windows\System\QuiiVdC.exe
  2⤵
  PID:10436
- C:\Windows\System\QOOmkJz.exe
  C:\Windows\System\QOOmkJz.exe
  2⤵
  PID:10452
- C:\Windows\System\GxnXxKe.exe
  C:\Windows\System\GxnXxKe.exe
  2⤵
  PID:10488
- C:\Windows\System\jAPAhqp.exe
  C:\Windows\System\jAPAhqp.exe
  2⤵
  PID:10520
- C:\Windows\System\KdcjurK.exe
  C:\Windows\System\KdcjurK.exe
  2⤵
  PID:10540
- C:\Windows\System\PPIvfxw.exe
  C:\Windows\System\PPIvfxw.exe
  2⤵
  PID:10560
- C:\Windows\System\AUZihVm.exe
  C:\Windows\System\AUZihVm.exe
  2⤵
  PID:10588
- C:\Windows\System\EzGnSfp.exe
  C:\Windows\System\EzGnSfp.exe
  2⤵
  PID:10604
- C:\Windows\System\VpYQzfn.exe
  C:\Windows\System\VpYQzfn.exe
  2⤵
  PID:10856
- C:\Windows\System\emVUgPE.exe
  C:\Windows\System\emVUgPE.exe
  2⤵
  PID:10896
- C:\Windows\System\gZIzhEe.exe
  C:\Windows\System\gZIzhEe.exe
  2⤵
  PID:10920
- C:\Windows\System\zKWXWOC.exe
  C:\Windows\System\zKWXWOC.exe
  2⤵
  PID:10940
- C:\Windows\System\HCZlfdx.exe
  C:\Windows\System\HCZlfdx.exe
  2⤵
  PID:10980
- C:\Windows\System\XkJDnGZ.exe
  C:\Windows\System\XkJDnGZ.exe
  2⤵
  PID:10996
- C:\Windows\System\TAxaewR.exe
  C:\Windows\System\TAxaewR.exe
  2⤵
  PID:11012
- C:\Windows\System\JbCqPKa.exe
  C:\Windows\System\JbCqPKa.exe
  2⤵
  PID:11040
- C:\Windows\System\iQcBVZv.exe
  C:\Windows\System\iQcBVZv.exe
  2⤵
  PID:11068
- C:\Windows\System\rilrnho.exe
  C:\Windows\System\rilrnho.exe
  2⤵
  PID:11088
- C:\Windows\System\JnXIZJY.exe
  C:\Windows\System\JnXIZJY.exe
  2⤵
  PID:11112
- C:\Windows\System\djJlvRF.exe
  C:\Windows\System\djJlvRF.exe
  2⤵
  PID:11152
- C:\Windows\System\VWWvdST.exe
  C:\Windows\System\VWWvdST.exe
  2⤵
  PID:11180
- C:\Windows\System\HFENsIS.exe
  C:\Windows\System\HFENsIS.exe
  2⤵
  PID:11212
- C:\Windows\System\mEMcxKw.exe
  C:\Windows\System\mEMcxKw.exe
  2⤵
  PID:11248
- C:\Windows\System\QhWRexA.exe
  C:\Windows\System\QhWRexA.exe
  2⤵
  PID:10244
- C:\Windows\System\QhnnMOz.exe
  C:\Windows\System\QhnnMOz.exe
  2⤵
  PID:10336
- C:\Windows\System\tPHGOVC.exe
  C:\Windows\System\tPHGOVC.exe
  2⤵
  PID:10376
- C:\Windows\System\LmnKzPL.exe
  C:\Windows\System\LmnKzPL.exe
  2⤵
  PID:10420
- C:\Windows\System\rmotcCw.exe
  C:\Windows\System\rmotcCw.exe
  2⤵
  PID:10516
- C:\Windows\System\USwjsko.exe
  C:\Windows\System\USwjsko.exe
  2⤵
  PID:10648
- C:\Windows\System\pNMSvZa.exe
  C:\Windows\System\pNMSvZa.exe
  2⤵
  PID:10688
- C:\Windows\System\tYktBoi.exe
  C:\Windows\System\tYktBoi.exe
  2⤵
  PID:10676
- C:\Windows\System\ibrozgV.exe
  C:\Windows\System\ibrozgV.exe
  2⤵
  PID:10724
- C:\Windows\System\hBuPFNh.exe
  C:\Windows\System\hBuPFNh.exe
  2⤵
  PID:10764
- C:\Windows\System\vLWNuAu.exe
  C:\Windows\System\vLWNuAu.exe
  2⤵
  PID:10792
- C:\Windows\System\IfHFyYu.exe
  C:\Windows\System\IfHFyYu.exe
  2⤵
  PID:10624
- C:\Windows\System\UQHgLWO.exe
  C:\Windows\System\UQHgLWO.exe
  2⤵
  PID:10836
- C:\Windows\System\SJKhsea.exe
  C:\Windows\System\SJKhsea.exe
  2⤵
  PID:10912
- C:\Windows\System\ybzfqEP.exe
  C:\Windows\System\ybzfqEP.exe
  2⤵
  PID:10968
- C:\Windows\System\aIHSjrq.exe
  C:\Windows\System\aIHSjrq.exe
  2⤵
  PID:10992
- C:\Windows\System\XuqwmnX.exe
  C:\Windows\System\XuqwmnX.exe
  2⤵
  PID:10468
- C:\Windows\System\JFyzIVY.exe
  C:\Windows\System\JFyzIVY.exe
  2⤵
  PID:11060
- C:\Windows\System\lYaXyuA.exe
  C:\Windows\System\lYaXyuA.exe
  2⤵
  PID:11192
- C:\Windows\System\AAxLIiJ.exe
  C:\Windows\System\AAxLIiJ.exe
  2⤵
  PID:11240
- C:\Windows\System\krtEDHj.exe
  C:\Windows\System\krtEDHj.exe
  2⤵
  PID:11260
- C:\Windows\System\hmXKyAX.exe
  C:\Windows\System\hmXKyAX.exe
  2⤵
  PID:10672
- C:\Windows\System\wLuYRSA.exe
  C:\Windows\System\wLuYRSA.exe
  2⤵
  PID:10732
- C:\Windows\System\ZQRWBcB.exe
  C:\Windows\System\ZQRWBcB.exe
  2⤵
  PID:10788
- C:\Windows\System\LLiVnOm.exe
  C:\Windows\System\LLiVnOm.exe
  2⤵
  PID:10892
- C:\Windows\System\PWJwAvi.exe
  C:\Windows\System\PWJwAvi.exe
  2⤵
  PID:11164
- C:\Windows\System\TfSzbLq.exe
  C:\Windows\System\TfSzbLq.exe
  2⤵
  PID:11236
- C:\Windows\System\KLwZQck.exe
  C:\Windows\System\KLwZQck.exe
  2⤵
  PID:10576
- C:\Windows\System\pRORZte.exe
  C:\Windows\System\pRORZte.exe
  2⤵
  PID:10708
- C:\Windows\System\YDdERwX.exe
  C:\Windows\System\YDdERwX.exe
  2⤵
  PID:10844
- C:\Windows\System\MawqRQe.exe
  C:\Windows\System\MawqRQe.exe
  2⤵
  PID:11224
- C:\Windows\System\VrcfDCE.exe
  C:\Windows\System\VrcfDCE.exe
  2⤵
  PID:11272
- C:\Windows\System\rIFHiwQ.exe
  C:\Windows\System\rIFHiwQ.exe
  2⤵
  PID:11300
- C:\Windows\System\uEJLbTy.exe
  C:\Windows\System\uEJLbTy.exe
  2⤵
  PID:11328
- C:\Windows\System\AxrZxAI.exe
  C:\Windows\System\AxrZxAI.exe
  2⤵
  PID:11360
- C:\Windows\System\mmkNRuf.exe
  C:\Windows\System\mmkNRuf.exe
  2⤵
  PID:11388
- C:\Windows\System\ZOiNyfl.exe
  C:\Windows\System\ZOiNyfl.exe
  2⤵
  PID:11404
- C:\Windows\System\omIqxXO.exe
  C:\Windows\System\omIqxXO.exe
  2⤵
  PID:11432
- C:\Windows\System\golCggA.exe
  C:\Windows\System\golCggA.exe
  2⤵
  PID:11460
- C:\Windows\System\fdmQgcG.exe
  C:\Windows\System\fdmQgcG.exe
  2⤵
  PID:11492
- C:\Windows\System\wtWaGxu.exe
  C:\Windows\System\wtWaGxu.exe
  2⤵
  PID:11548
- C:\Windows\System\GjRZlFc.exe
  C:\Windows\System\GjRZlFc.exe
  2⤵
  PID:11564
- C:\Windows\System\aQqzBVQ.exe
  C:\Windows\System\aQqzBVQ.exe
  2⤵
  PID:11632
- C:\Windows\System\CMoRnPF.exe
  C:\Windows\System\CMoRnPF.exe
  2⤵
  PID:11664
- C:\Windows\System\AiPnxtF.exe
  C:\Windows\System\AiPnxtF.exe
  2⤵
  PID:11684
- C:\Windows\System\wtoNLCH.exe
  C:\Windows\System\wtoNLCH.exe
  2⤵
  PID:11708
- C:\Windows\System\jnAGGxK.exe
  C:\Windows\System\jnAGGxK.exe
  2⤵
  PID:11728
- C:\Windows\System\sJBPQtS.exe
  C:\Windows\System\sJBPQtS.exe
  2⤵
  PID:11764
- C:\Windows\System\pkNDuEA.exe
  C:\Windows\System\pkNDuEA.exe
  2⤵
  PID:11780
- C:\Windows\System\qUJvyhZ.exe
  C:\Windows\System\qUJvyhZ.exe
  2⤵
  PID:11808
- C:\Windows\System\YDbQemJ.exe
  C:\Windows\System\YDbQemJ.exe
  2⤵
  PID:11848
- C:\Windows\System\CxrIpNC.exe
  C:\Windows\System\CxrIpNC.exe
  2⤵
  PID:11864
- C:\Windows\System\GLlXFTA.exe
  C:\Windows\System\GLlXFTA.exe
  2⤵
  PID:11888
- C:\Windows\System\ETafEAl.exe
  C:\Windows\System\ETafEAl.exe
  2⤵
  PID:11924
- C:\Windows\System\zzJUKZg.exe
  C:\Windows\System\zzJUKZg.exe
  2⤵
  PID:11972
- C:\Windows\System\hdzREcJ.exe
  C:\Windows\System\hdzREcJ.exe
  2⤵
  PID:12000
- C:\Windows\System\EJsdhfE.exe
  C:\Windows\System\EJsdhfE.exe
  2⤵
  PID:12020
- C:\Windows\System\tgPhGDV.exe
  C:\Windows\System\tgPhGDV.exe
  2⤵
  PID:12044
- C:\Windows\System\pqhQRxB.exe
  C:\Windows\System\pqhQRxB.exe
  2⤵
  PID:12068
- C:\Windows\System\EkNOVzx.exe
  C:\Windows\System\EkNOVzx.exe
  2⤵
  PID:12100
- C:\Windows\System\TpOmFbf.exe
  C:\Windows\System\TpOmFbf.exe
  2⤵
  PID:12136
- C:\Windows\System\lEGmQSF.exe
  C:\Windows\System\lEGmQSF.exe
  2⤵
  PID:12160
- C:\Windows\System\BhCgCIZ.exe
  C:\Windows\System\BhCgCIZ.exe
  2⤵
  PID:12200
- C:\Windows\System\ZaOsDBq.exe
  C:\Windows\System\ZaOsDBq.exe
  2⤵
  PID:12228
- C:\Windows\System\exJdIHR.exe
  C:\Windows\System\exJdIHR.exe
  2⤵
  PID:12256
- C:\Windows\System\mIVTkCa.exe
  C:\Windows\System\mIVTkCa.exe
  2⤵
  PID:12284
- C:\Windows\System\JuJGWFM.exe
  C:\Windows\System\JuJGWFM.exe
  2⤵
  PID:10744
- C:\Windows\System\uWLCIQE.exe
  C:\Windows\System\uWLCIQE.exe
  2⤵
  PID:11376
- C:\Windows\System\fpqlMdt.exe
  C:\Windows\System\fpqlMdt.exe
  2⤵
  PID:11348
- C:\Windows\System\QKrjfpP.exe
  C:\Windows\System\QKrjfpP.exe
  2⤵
  PID:11416
- C:\Windows\System\keuDGhJ.exe
  C:\Windows\System\keuDGhJ.exe
  2⤵
  PID:11488
- C:\Windows\System\xxPxFOf.exe
  C:\Windows\System\xxPxFOf.exe
  2⤵
  PID:11524
- C:\Windows\System\GrpDqRj.exe
  C:\Windows\System\GrpDqRj.exe
  2⤵
  PID:11588
- C:\Windows\System\TuTbtiC.exe
  C:\Windows\System\TuTbtiC.exe
  2⤵
  PID:11652
- C:\Windows\System\VqsQMqe.exe
  C:\Windows\System\VqsQMqe.exe
  2⤵
  PID:11700
- C:\Windows\System\LsUKrFD.exe
  C:\Windows\System\LsUKrFD.exe
  2⤵
  PID:11772
- C:\Windows\System\WUShdUr.exe
  C:\Windows\System\WUShdUr.exe
  2⤵
  PID:11836
- C:\Windows\System\iTKubBA.exe
  C:\Windows\System\iTKubBA.exe
  2⤵
  PID:11988
- C:\Windows\System\ZmJvMwu.exe
  C:\Windows\System\ZmJvMwu.exe
  2⤵
  PID:12036
- C:\Windows\System\xthXpTM.exe
  C:\Windows\System\xthXpTM.exe
  2⤵
  PID:12084
- C:\Windows\System\NFRXBLM.exe
  C:\Windows\System\NFRXBLM.exe
  2⤵
  PID:12144
- C:\Windows\System\amukkFG.exe
  C:\Windows\System\amukkFG.exe
  2⤵
  PID:12196
- C:\Windows\System\QQHazde.exe
  C:\Windows\System\QQHazde.exe
  2⤵
  PID:12276
- C:\Windows\System\VUXVlxY.exe
  C:\Windows\System\VUXVlxY.exe
  2⤵
  PID:11444
- C:\Windows\System\OXRvSxm.exe
  C:\Windows\System\OXRvSxm.exe
  2⤵
  PID:11600
- C:\Windows\System\mjqZPpC.exe
  C:\Windows\System\mjqZPpC.exe
  2⤵
  PID:11680
- C:\Windows\System\hoNjawj.exe
  C:\Windows\System\hoNjawj.exe
  2⤵
  PID:11860
- C:\Windows\System\YLvjRie.exe
  C:\Windows\System\YLvjRie.exe
  2⤵
  PID:11952
- C:\Windows\System\imTyKVL.exe
  C:\Windows\System\imTyKVL.exe
  2⤵
  PID:10664
- C:\Windows\System\UNZtdhy.exe
  C:\Windows\System\UNZtdhy.exe
  2⤵
  PID:11336
- C:\Windows\System\yfUxSkj.exe
  C:\Windows\System\yfUxSkj.exe
  2⤵
  PID:11628
- C:\Windows\System\mruiwyC.exe
  C:\Windows\System\mruiwyC.exe
  2⤵
  PID:11832
- C:\Windows\System\AYiQdNs.exe
  C:\Windows\System\AYiQdNs.exe
  2⤵
  PID:12252
- C:\Windows\System\lzKSuXW.exe
  C:\Windows\System\lzKSuXW.exe
  2⤵
  PID:11744
- C:\Windows\System\OSzhOgQ.exe
  C:\Windows\System\OSzhOgQ.exe
  2⤵
  PID:12328
- C:\Windows\System\SQHcNOk.exe
  C:\Windows\System\SQHcNOk.exe
  2⤵
  PID:12344
- C:\Windows\System\LGWiHFO.exe
  C:\Windows\System\LGWiHFO.exe
  2⤵
  PID:12384
- C:\Windows\System\UJiKRRp.exe
  C:\Windows\System\UJiKRRp.exe
  2⤵
  PID:12412
- C:\Windows\System\uHCVjnz.exe
  C:\Windows\System\uHCVjnz.exe
  2⤵
  PID:12436
- C:\Windows\System\JnuuLhX.exe
  C:\Windows\System\JnuuLhX.exe
  2⤵
  PID:12456
- C:\Windows\System\UymKmiV.exe
  C:\Windows\System\UymKmiV.exe
  2⤵
  PID:12472
- C:\Windows\System\cOaGWeY.exe
  C:\Windows\System\cOaGWeY.exe
  2⤵
  PID:12488
- C:\Windows\System\snTZEum.exe
  C:\Windows\System\snTZEum.exe
  2⤵
  PID:12552
- C:\Windows\System\sAwQSJH.exe
  C:\Windows\System\sAwQSJH.exe
  2⤵
  PID:12568
- C:\Windows\System\QBrieUE.exe
  C:\Windows\System\QBrieUE.exe
  2⤵
  PID:12596
- C:\Windows\System\OLXNRmn.exe
  C:\Windows\System\OLXNRmn.exe
  2⤵
  PID:12628
- C:\Windows\System\ALaLwdQ.exe
  C:\Windows\System\ALaLwdQ.exe
  2⤵
  PID:12652
- C:\Windows\System\iMuEfkz.exe
  C:\Windows\System\iMuEfkz.exe
  2⤵
  PID:12672
- C:\Windows\System\OXKDBdK.exe
  C:\Windows\System\OXKDBdK.exe
  2⤵
  PID:12696
- C:\Windows\System\NyQKRQC.exe
  C:\Windows\System\NyQKRQC.exe
  2⤵
  PID:12720
- C:\Windows\System\ptKCgSo.exe
  C:\Windows\System\ptKCgSo.exe
  2⤵
  PID:12752
- C:\Windows\System\hxPYrJm.exe
  C:\Windows\System\hxPYrJm.exe
  2⤵
  PID:12772
- C:\Windows\System\FWIwDku.exe
  C:\Windows\System\FWIwDku.exe
  2⤵
  PID:12796
- C:\Windows\System\ILQWXXH.exe
  C:\Windows\System\ILQWXXH.exe
  2⤵
  PID:12828
- C:\Windows\System\aCUGZws.exe
  C:\Windows\System\aCUGZws.exe
  2⤵
  PID:12852
- C:\Windows\System\HhcvTlU.exe
  C:\Windows\System\HhcvTlU.exe
  2⤵
  PID:12912
- C:\Windows\System\nnmmEGW.exe
  C:\Windows\System\nnmmEGW.exe
  2⤵
  PID:12936
- C:\Windows\System\xhEXKnA.exe
  C:\Windows\System\xhEXKnA.exe
  2⤵
  PID:12960
- C:\Windows\System\tunRUJQ.exe
  C:\Windows\System\tunRUJQ.exe
  2⤵
  PID:12988
- C:\Windows\System\FiIUxQd.exe
  C:\Windows\System\FiIUxQd.exe
  2⤵
  PID:13016
- C:\Windows\System\igjjJMb.exe
  C:\Windows\System\igjjJMb.exe
  2⤵
  PID:13032
- C:\Windows\System\JnkaapM.exe
  C:\Windows\System\JnkaapM.exe
  2⤵
  PID:13064
- C:\Windows\System\EahXBgC.exe
  C:\Windows\System\EahXBgC.exe
  2⤵
  PID:13084
- C:\Windows\System\qXwqEgg.exe
  C:\Windows\System\qXwqEgg.exe
  2⤵
  PID:13120
- C:\Windows\System\qOKTDlh.exe
  C:\Windows\System\qOKTDlh.exe
  2⤵
  PID:13172
- C:\Windows\System\gDnTYCe.exe
  C:\Windows\System\gDnTYCe.exe
  2⤵
  PID:13200
- C:\Windows\System\hkyanYm.exe
  C:\Windows\System\hkyanYm.exe
  2⤵
  PID:13228
- C:\Windows\System\NHahVlg.exe
  C:\Windows\System\NHahVlg.exe
  2⤵
  PID:13244
- C:\Windows\System\dRCHjnA.exe
  C:\Windows\System\dRCHjnA.exe
  2⤵
  PID:13272
- C:\Windows\System\BmRwEXW.exe
  C:\Windows\System\BmRwEXW.exe
  2⤵
  PID:13308
- C:\Windows\System\FHsNgwd.exe
  C:\Windows\System\FHsNgwd.exe
  2⤵
  PID:12320
- C:\Windows\System\QwkJPwT.exe
  C:\Windows\System\QwkJPwT.exe
  2⤵
  PID:12376
- C:\Windows\System\AcPiokP.exe
  C:\Windows\System\AcPiokP.exe
  2⤵
  PID:12428
- C:\Windows\System\IbDptBR.exe
  C:\Windows\System\IbDptBR.exe
  2⤵
  PID:12468
- C:\Windows\System\JqnMMdU.exe
  C:\Windows\System\JqnMMdU.exe
  2⤵
  PID:12536
- C:\Windows\System\nZMHINg.exe
  C:\Windows\System\nZMHINg.exe
  2⤵
  PID:12616
- C:\Windows\System\GLxcvZw.exe
  C:\Windows\System\GLxcvZw.exe
  2⤵
  PID:12680
- C:\Windows\System\diSjZoL.exe
  C:\Windows\System\diSjZoL.exe
  2⤵
  PID:12740
- C:\Windows\System\yReEUWZ.exe
  C:\Windows\System\yReEUWZ.exe
  2⤵
  PID:12804
- C:\Windows\System\FTSkCQB.exe
  C:\Windows\System\FTSkCQB.exe
  2⤵
  PID:12108
- C:\Windows\System\dCgjruQ.exe
  C:\Windows\System\dCgjruQ.exe
  2⤵
  PID:12972
- C:\Windows\System\Zquxcbx.exe
  C:\Windows\System\Zquxcbx.exe
  2⤵
  PID:13000
- C:\Windows\System\SkAvGaz.exe
  C:\Windows\System\SkAvGaz.exe
  2⤵
  PID:13092
- C:\Windows\System\xYkRYIT.exe
  C:\Windows\System\xYkRYIT.exe
  2⤵
  PID:13104
- C:\Windows\System\EGRXVzz.exe
  C:\Windows\System\EGRXVzz.exe
  2⤵
  PID:13192
- C:\Windows\System\duhlkbx.exe
  C:\Windows\System\duhlkbx.exe
  2⤵
  PID:13240
- C:\Windows\System\sxSfpCf.exe
  C:\Windows\System\sxSfpCf.exe
  2⤵
  PID:11484
- C:\Windows\System\ydCZfOq.exe
  C:\Windows\System\ydCZfOq.exe
  2⤵
  PID:12408
- C:\Windows\System\OXIHZse.exe
  C:\Windows\System\OXIHZse.exe
  2⤵
  PID:12516
- C:\Windows\System\TJaGihw.exe
  C:\Windows\System\TJaGihw.exe
  2⤵
  PID:12624
- C:\Windows\System\rkquSrc.exe
  C:\Windows\System\rkquSrc.exe
  2⤵
  PID:12792
- C:\Windows\System\FmOUMRn.exe
  C:\Windows\System\FmOUMRn.exe
  2⤵
  PID:12924
- C:\Windows\System\RKldOfW.exe
  C:\Windows\System\RKldOfW.exe
  2⤵
  PID:13028
- C:\Windows\System\kYgBxQn.exe
  C:\Windows\System\kYgBxQn.exe
  2⤵
  PID:13268
- C:\Windows\System\QsDNHVG.exe
  C:\Windows\System\QsDNHVG.exe
  2⤵
  PID:12480
- C:\Windows\System\qAVJVOW.exe
  C:\Windows\System\qAVJVOW.exe
  2⤵
  PID:12760
- C:\Windows\System\daRbhmS.exe
  C:\Windows\System\daRbhmS.exe
  2⤵
  PID:12336
- C:\Windows\System\KpThyid.exe
  C:\Windows\System\KpThyid.exe
  2⤵
  PID:11480
- C:\Windows\System\pEwIjtq.exe
  C:\Windows\System\pEwIjtq.exe
  2⤵
  PID:13336
- C:\Windows\System\tZhwCih.exe
  C:\Windows\System\tZhwCih.exe
  2⤵
  PID:13364
- C:\Windows\System\XFqHRaD.exe
  C:\Windows\System\XFqHRaD.exe
  2⤵
  PID:13392
- C:\Windows\System\QEdlzpt.exe
  C:\Windows\System\QEdlzpt.exe
  2⤵
  PID:13424
- C:\Windows\System\PHhuUWG.exe
  C:\Windows\System\PHhuUWG.exe
  2⤵
  PID:13444
- C:\Windows\System\fSpGLWW.exe
  C:\Windows\System\fSpGLWW.exe
  2⤵
  PID:13480
- C:\Windows\System\swIqWDB.exe
  C:\Windows\System\swIqWDB.exe
  2⤵
  PID:13508
- C:\Windows\System\EEcRALx.exe
  C:\Windows\System\EEcRALx.exe
  2⤵
  PID:13552
- C:\Windows\System\qxDkQai.exe
  C:\Windows\System\qxDkQai.exe
  2⤵
  PID:13572
- C:\Windows\System\CmsHjiq.exe
  C:\Windows\System\CmsHjiq.exe
  2⤵
  PID:13596
- C:\Windows\System\AaRxciL.exe
  C:\Windows\System\AaRxciL.exe
  2⤵
  PID:13616
- C:\Windows\System\QPHMoJC.exe
  C:\Windows\System\QPHMoJC.exe
  2⤵
  PID:13652
- C:\Windows\System\JIStUPG.exe
  C:\Windows\System\JIStUPG.exe
  2⤵
  PID:13668
- C:\Windows\System\GWUyJnv.exe
  C:\Windows\System\GWUyJnv.exe
  2⤵
  PID:13720
- C:\Windows\System\aDYWwrE.exe
  C:\Windows\System\aDYWwrE.exe
  2⤵
  PID:13744
- C:\Windows\System\yQFogew.exe
  C:\Windows\System\yQFogew.exe
  2⤵
  PID:13764
- C:\Windows\System\QuTOWcT.exe
  C:\Windows\System\QuTOWcT.exe
  2⤵
  PID:13792
- C:\Windows\System\stMWZrD.exe
  C:\Windows\System\stMWZrD.exe
  2⤵
  PID:13808
- C:\Windows\System\pZAUCnS.exe
  C:\Windows\System\pZAUCnS.exe
  2⤵
  PID:13844
- C:\Windows\System\PgmZJHy.exe
  C:\Windows\System\PgmZJHy.exe
  2⤵
  PID:13884
- C:\Windows\System\rWnbCBi.exe
  C:\Windows\System\rWnbCBi.exe
  2⤵
  PID:13904
- C:\Windows\System\MXlUaoO.exe
  C:\Windows\System\MXlUaoO.exe
  2⤵
  PID:13944
- C:\Windows\System\CaSmHRU.exe
  C:\Windows\System\CaSmHRU.exe
  2⤵
  PID:13968
- C:\Windows\System\WXyaVgy.exe
  C:\Windows\System\WXyaVgy.exe
  2⤵
  PID:13988
- C:\Windows\System\IogOSXN.exe
  C:\Windows\System\IogOSXN.exe
  2⤵
  PID:14028
- C:\Windows\System\nGXXyGy.exe
  C:\Windows\System\nGXXyGy.exe
  2⤵
  PID:14044
- C:\Windows\System\JNjHioK.exe
  C:\Windows\System\JNjHioK.exe
  2⤵
  PID:14064
- C:\Windows\System\vRIPPhr.exe
  C:\Windows\System\vRIPPhr.exe
  2⤵
  PID:14088
- C:\Windows\System\aMuQrrE.exe
  C:\Windows\System\aMuQrrE.exe
  2⤵
  PID:14112
- C:\Windows\System\DyjIYMu.exe
  C:\Windows\System\DyjIYMu.exe
  2⤵
  PID:14148
- C:\Windows\System\LhoUExc.exe
  C:\Windows\System\LhoUExc.exe
  2⤵
  PID:14176
- C:\Windows\System\DDtVuMu.exe
  C:\Windows\System\DDtVuMu.exe
  2⤵
  PID:14204
- C:\Windows\System\PKpJgtu.exe
  C:\Windows\System\PKpJgtu.exe
  2⤵
  PID:14244
- C:\Windows\System\OHQleOb.exe
  C:\Windows\System\OHQleOb.exe
  2⤵
  PID:14272
- C:\Windows\System\XSjrtXC.exe
  C:\Windows\System\XSjrtXC.exe
  2⤵
  PID:14300
- C:\Windows\System\iXHdghG.exe
  C:\Windows\System\iXHdghG.exe
  2⤵
  PID:14320
- C:\Windows\System\AlwSfaF.exe
  C:\Windows\System\AlwSfaF.exe
  2⤵
  PID:12588
- C:\Windows\System\GLNFLXV.exe
  C:\Windows\System\GLNFLXV.exe
  2⤵
  PID:13352
- C:\Windows\System\synbwBa.exe
  C:\Windows\System\synbwBa.exe
  2⤵
  PID:13440
- C:\Windows\System\XdTwYdd.exe
  C:\Windows\System\XdTwYdd.exe
  2⤵
  PID:13500
- C:\Windows\System\MifJKbQ.exe
  C:\Windows\System\MifJKbQ.exe
  2⤵
  PID:13564
- C:\Windows\System\WZsYjhX.exe
  C:\Windows\System\WZsYjhX.exe
  2⤵
  PID:13604
- C:\Windows\System\VRxQatb.exe
  C:\Windows\System\VRxQatb.exe
  2⤵
  PID:13712
- C:\Windows\System\ORjqUeA.exe
  C:\Windows\System\ORjqUeA.exe
  2⤵
  PID:13776
- C:\Windows\System\ryJXNGa.exe
  C:\Windows\System\ryJXNGa.exe
  2⤵
  PID:13872
- C:\Windows\System\azZpHbX.exe
  C:\Windows\System\azZpHbX.exe
  2⤵
  PID:13932
- C:\Windows\System\JQRMEWW.exe
  C:\Windows\System\JQRMEWW.exe
  2⤵
  PID:13984
- C:\Windows\System\AnXWKIo.exe
  C:\Windows\System\AnXWKIo.exe
  2⤵
  PID:14052
- C:\Windows\System\sNzjrtQ.exe
  C:\Windows\System\sNzjrtQ.exe
  2⤵
  PID:14084
- C:\Windows\System\fnPCiTy.exe
  C:\Windows\System\fnPCiTy.exe
  2⤵
  PID:14164
- C:\Windows\System\KYpObJU.exe
  C:\Windows\System\KYpObJU.exe
  2⤵
  PID:14256
- C:\Windows\System\WlSqzpc.exe
  C:\Windows\System\WlSqzpc.exe
  2⤵
  PID:14264
- C:\Windows\System\rDUaUjj.exe
  C:\Windows\System\rDUaUjj.exe
  2⤵
  PID:12956
- C:\Windows\System\zEVHfTH.exe
  C:\Windows\System\zEVHfTH.exe
  2⤵
  PID:13324
- C:\Windows\System\IRtTXlv.exe
  C:\Windows\System\IRtTXlv.exe
  2⤵
  PID:13580
- C:\Windows\System\PAPWLYJ.exe
  C:\Windows\System\PAPWLYJ.exe
  2⤵
  PID:13760
- C:\Windows\System\kDKdaDd.exe
  C:\Windows\System\kDKdaDd.exe
  2⤵
  PID:13880
- C:\Windows\System\DTllrKA.exe
  C:\Windows\System\DTllrKA.exe
  2⤵
  PID:14056
- C:\Windows\System\TzbWQRM.exe
  C:\Windows\System\TzbWQRM.exe
  2⤵
  PID:14184
- C:\Windows\System\wKpqxop.exe
  C:\Windows\System\wKpqxop.exe
  2⤵
  PID:14260
- C:\Windows\System\yGKkhVM.exe
  C:\Windows\System\yGKkhVM.exe
  2⤵
  PID:13840
- C:\Windows\System\madCYiF.exe
  C:\Windows\System\madCYiF.exe
  2⤵
  PID:13648
- C:\Windows\System\HQOnQcW.exe
  C:\Windows\System\HQOnQcW.exe
  2⤵
  PID:14156
- C:\Windows\System\KEmDzwJ.exe
  C:\Windows\System\KEmDzwJ.exe
  2⤵
  PID:13900
- C:\Windows\System\NGcnUDm.exe
  C:\Windows\System\NGcnUDm.exe
  2⤵
  PID:14360
- C:\Windows\System\ZEVgnUq.exe
  C:\Windows\System\ZEVgnUq.exe
  2⤵
  PID:14384
- C:\Windows\System\zlcHdti.exe
  C:\Windows\System\zlcHdti.exe
  2⤵
  PID:14412
- C:\Windows\System\CrzwAVF.exe
  C:\Windows\System\CrzwAVF.exe
  2⤵
  PID:14428
- C:\Windows\System\kbtCSDX.exe
  C:\Windows\System\kbtCSDX.exe
  2⤵
  PID:14480
- C:\Windows\System\gVlIMiP.exe
  C:\Windows\System\gVlIMiP.exe
  2⤵
  PID:14504
- C:\Windows\System\autDBgK.exe
  C:\Windows\System\autDBgK.exe
  2⤵
  PID:14524
- C:\Windows\System\zmSuMQM.exe
  C:\Windows\System\zmSuMQM.exe
  2⤵
  PID:14548
- C:\Windows\System\uBuLsOm.exe
  C:\Windows\System\uBuLsOm.exe
  2⤵
  PID:14580
- C:\Windows\System\urvOcNY.exe
  C:\Windows\System\urvOcNY.exe
  2⤵
  PID:14596
- C:\Windows\System\vFfaonG.exe
  C:\Windows\System\vFfaonG.exe
  2⤵
  PID:14648
- C:\Windows\System\jdaYvUK.exe
  C:\Windows\System\jdaYvUK.exe
  2⤵
  PID:14672
- C:\Windows\System\NVXAOxW.exe
  C:\Windows\System\NVXAOxW.exe
  2⤵
  PID:14692
- C:\Windows\System\BILKsat.exe
  C:\Windows\System\BILKsat.exe
  2⤵
  PID:14720
- C:\Windows\System\HWcdTBe.exe
  C:\Windows\System\HWcdTBe.exe
  2⤵
  PID:14740
- C:\Windows\System\eLmoSLt.exe
  C:\Windows\System\eLmoSLt.exe
  2⤵
  PID:14760
- C:\Windows\System\tPzeXYq.exe
  C:\Windows\System\tPzeXYq.exe
  2⤵
  PID:14792
- C:\Windows\System\BfgbjqB.exe
  C:\Windows\System\BfgbjqB.exe
  2⤵
  PID:14820
- C:\Windows\System\dKRRCVV.exe
  C:\Windows\System\dKRRCVV.exe
  2⤵
  PID:14844
- C:\Windows\System\ApakGcO.exe
  C:\Windows\System\ApakGcO.exe
  2⤵
  PID:14900
- C:\Windows\System\wPiJEhP.exe
  C:\Windows\System\wPiJEhP.exe
  2⤵
  PID:14916
- C:\Windows\System\sKvHnKB.exe
  C:\Windows\System\sKvHnKB.exe
  2⤵
  PID:14944
- C:\Windows\System\PUNWRSL.exe
  C:\Windows\System\PUNWRSL.exe
  2⤵
  PID:14968
- C:\Windows\System\uHYmupm.exe
  C:\Windows\System\uHYmupm.exe
  2⤵
  PID:15012
- C:\Windows\System\NcXfISq.exe
  C:\Windows\System\NcXfISq.exe
  2⤵
  PID:15028
- C:\Windows\System\SRASaZU.exe
  C:\Windows\System\SRASaZU.exe
  2⤵
  PID:15056
- C:\Windows\System\rPAeNCH.exe
  C:\Windows\System\rPAeNCH.exe
  2⤵
  PID:15080
- C:\Windows\System\zKPPeCn.exe
  C:\Windows\System\zKPPeCn.exe
  2⤵
  PID:15112
- C:\Windows\System\nKPsekG.exe
  C:\Windows\System\nKPsekG.exe
  2⤵
  PID:15128
- C:\Windows\System\xzLoWQi.exe
  C:\Windows\System\xzLoWQi.exe
  2⤵
  PID:15152
- C:\Windows\System\CEoKdxP.exe
  C:\Windows\System\CEoKdxP.exe
  2⤵
  PID:15184
- C:\Windows\System\BIgeCRc.exe
  C:\Windows\System\BIgeCRc.exe
  2⤵
  PID:15208
- C:\Windows\System\LYWIcUc.exe
  C:\Windows\System\LYWIcUc.exe
  2⤵
  PID:15236
- C:\Windows\System\dKyWOwT.exe
  C:\Windows\System\dKyWOwT.exe
  2⤵
  PID:15264
- C:\Windows\System\FVVRnqn.exe
  C:\Windows\System\FVVRnqn.exe
  2⤵
  PID:15320
- C:\Windows\System\FQkezsL.exe
  C:\Windows\System\FQkezsL.exe
  2⤵
  PID:15336
- C:\Windows\System\HgEhMTY.exe
  C:\Windows\System\HgEhMTY.exe
  2⤵
  PID:14340
- C:\Windows\System\nUfgaxl.exe
  C:\Windows\System\nUfgaxl.exe
  2⤵
  PID:14396
- C:\Windows\System\sPpzvkd.exe
  C:\Windows\System\sPpzvkd.exe
  2⤵
  PID:14476
- C:\Windows\System\PEQmpDY.exe
  C:\Windows\System\PEQmpDY.exe
  2⤵
  PID:14520
- C:\Windows\System\oYlazGw.exe
  C:\Windows\System\oYlazGw.exe
  2⤵
  PID:14576
- C:\Windows\System\ScOhBee.exe
  C:\Windows\System\ScOhBee.exe
  2⤵
  PID:14612
- C:\Windows\System\UopKCvZ.exe
  C:\Windows\System\UopKCvZ.exe
  2⤵
  PID:14680
- C:\Windows\System\wzHurDO.exe
  C:\Windows\System\wzHurDO.exe
  2⤵
  PID:14712
- C:\Windows\System\MIpQvyS.exe
  C:\Windows\System\MIpQvyS.exe
  2⤵
  PID:14800
- C:\Windows\System\jkIsRCX.exe
  C:\Windows\System\jkIsRCX.exe
  2⤵
  PID:14880
- C:\Windows\System\sNUmRnd.exe
  C:\Windows\System\sNUmRnd.exe
  2⤵
  PID:14988
- C:\Windows\System\usBmKBu.exe
  C:\Windows\System\usBmKBu.exe
  2⤵
  PID:15020
- C:\Windows\System\wZUHBRa.exe
  C:\Windows\System\wZUHBRa.exe
  2⤵
  PID:15064
- C:\Windows\System\nZQYIqG.exe
  C:\Windows\System\nZQYIqG.exe
  2⤵
  PID:15124
- C:\Windows\System\PTuWKzR.exe
  C:\Windows\System\PTuWKzR.exe
  2⤵
  PID:15260
- C:\Windows\System\wrCPmZE.exe
  C:\Windows\System\wrCPmZE.exe
  2⤵
  PID:15304
- C:\Windows\System\azsLKTZ.exe
  C:\Windows\System\azsLKTZ.exe
  2⤵
  PID:15348
- C:\Windows\System\QbpYJTm.exe
  C:\Windows\System\QbpYJTm.exe
  2⤵
  PID:14372
- C:\Windows\System\LXtCdWE.exe
  C:\Windows\System\LXtCdWE.exe
  2⤵
  PID:14556
- C:\Windows\System\DRgDhLQ.exe
  C:\Windows\System\DRgDhLQ.exe
  2⤵
  PID:14632
- C:\Windows\System\dilZRQq.exe
  C:\Windows\System\dilZRQq.exe
  2⤵
  PID:14828
- C:\Windows\System\jvWOFvL.exe
  C:\Windows\System\jvWOFvL.exe
  2⤵
  PID:14936
- C:\Windows\System\YJuWQRY.exe
  C:\Windows\System\YJuWQRY.exe
  2⤵
  PID:15044
- C:\Windows\System\vjJrhab.exe
  C:\Windows\System\vjJrhab.exe
  2⤵
  PID:15328
- C:\Windows\System\vhNAyMF.exe
  C:\Windows\System\vhNAyMF.exe
  2⤵
  PID:14960
- C:\Windows\System\hdpyxlD.exe
  C:\Windows\System\hdpyxlD.exe
  2⤵
  PID:15280
- C:\Windows\System\GoSuHIV.exe
  C:\Windows\System\GoSuHIV.exe
  2⤵
  PID:14864
- C:\Windows\System\vkovJxJ.exe
  C:\Windows\System\vkovJxJ.exe
  2⤵
  PID:15368
- C:\Windows\System\TjvyAai.exe
  C:\Windows\System\TjvyAai.exe
  2⤵
  PID:15384
- C:\Windows\System\zXbxQDI.exe
  C:\Windows\System\zXbxQDI.exe
  2⤵
  PID:15404
- C:\Windows\System\zOiYbjc.exe
  C:\Windows\System\zOiYbjc.exe
  2⤵
  PID:15428
- C:\Windows\System\OVrsNbr.exe
  C:\Windows\System\OVrsNbr.exe
  2⤵
  PID:15468
- C:\Windows\System\FtdUeMr.exe
  C:\Windows\System\FtdUeMr.exe
  2⤵
  PID:15508
- C:\Windows\System\eetXfqv.exe
  C:\Windows\System\eetXfqv.exe
  2⤵
  PID:15524
- C:\Windows\System\WGgMIrE.exe
  C:\Windows\System\WGgMIrE.exe
  2⤵
  PID:15544
- C:\Windows\System\yaRpJhe.exe
  C:\Windows\System\yaRpJhe.exe
  2⤵
  PID:15564
- C:\Windows\System\bqbvjYz.exe
  C:\Windows\System\bqbvjYz.exe
  2⤵
  PID:15588
- C:\Windows\System\zfBJgss.exe
  C:\Windows\System\zfBJgss.exe
  2⤵
  PID:15604
- C:\Windows\System\hUGkFTj.exe
  C:\Windows\System\hUGkFTj.exe
  2⤵
  PID:15648
- C:\Windows\System\cTQwmFa.exe
  C:\Windows\System\cTQwmFa.exe
  2⤵
  PID:15716
- C:\Windows\System\KgRWdxO.exe
  C:\Windows\System\KgRWdxO.exe
  2⤵
  PID:15732
- C:\Windows\System\UUTndLP.exe
  C:\Windows\System\UUTndLP.exe
  2⤵
  PID:15760
- C:\Windows\System\GoqtChJ.exe
  C:\Windows\System\GoqtChJ.exe
  2⤵
  PID:15784
- C:\Windows\System\arwThyE.exe
  C:\Windows\System\arwThyE.exe
  2⤵
  PID:15804
- C:\Windows\System\cLCSswi.exe
  C:\Windows\System\cLCSswi.exe
  2⤵
  PID:15824
- C:\Windows\System\YUCxkiv.exe
  C:\Windows\System\YUCxkiv.exe
  2⤵
  PID:15856
- C:\Windows\System\wjKZlbD.exe
  C:\Windows\System\wjKZlbD.exe
  2⤵
  PID:15900
- C:\Windows\System\LFNrDme.exe
  C:\Windows\System\LFNrDme.exe
  2⤵
  PID:15920
- C:\Windows\System\EsydQsz.exe
  C:\Windows\System\EsydQsz.exe
  2⤵
  PID:15944
- C:\Windows\System\RqdxhUQ.exe
  C:\Windows\System\RqdxhUQ.exe
  2⤵
  PID:15984
- C:\Windows\System\NGKBTcv.exe
  C:\Windows\System\NGKBTcv.exe
  2⤵
  PID:16012
- C:\Windows\System\iAkFBFw.exe
  C:\Windows\System\iAkFBFw.exe
  2⤵
  PID:16028
- C:\Windows\System\EcJhxCc.exe
  C:\Windows\System\EcJhxCc.exe
  2⤵
  PID:16056
- C:\Windows\System\vnBiDBj.exe
  C:\Windows\System\vnBiDBj.exe
  2⤵
  PID:16080
- C:\Windows\System\whtSKof.exe
  C:\Windows\System\whtSKof.exe
  2⤵
  PID:16104
- C:\Windows\System\YHEUWow.exe
  C:\Windows\System\YHEUWow.exe
  2⤵
  PID:16128
- C:\Windows\System\VaBBPJO.exe
  C:\Windows\System\VaBBPJO.exe
  2⤵
  PID:16156
- C:\Windows\System\hNAHheB.exe
  C:\Windows\System\hNAHheB.exe
  2⤵
  PID:16192
- C:\Windows\System\LqsUtzr.exe
  C:\Windows\System\LqsUtzr.exe
  2⤵
  PID:16216
- C:\Windows\System\LnfZTmV.exe
  C:\Windows\System\LnfZTmV.exe
  2⤵
  PID:16264
- C:\Windows\System\cISgAcK.exe
  C:\Windows\System\cISgAcK.exe
  2⤵
  PID:16280
- C:\Windows\System\SwhvrgH.exe
  C:\Windows\System\SwhvrgH.exe
  2⤵
  PID:16296
- C:\Windows\System\SdbyAYe.exe
  C:\Windows\System\SdbyAYe.exe
  2⤵
  PID:16348
- C:\Windows\System\dMcsCxk.exe
  C:\Windows\System\dMcsCxk.exe
  2⤵
  PID:16368
- C:\Windows\System\lZZmyvl.exe
  C:\Windows\System\lZZmyvl.exe
  2⤵
  PID:14780
- C:\Windows\System\URatxiY.exe
  C:\Windows\System\URatxiY.exe
  2⤵
  PID:15412
- C:\Windows\System\XLmQWnN.exe
  C:\Windows\System\XLmQWnN.exe
  2⤵
  PID:15440
- C:\Windows\System\xsOyfVh.exe
  C:\Windows\System\xsOyfVh.exe
  2⤵
  PID:15520
- C:\Windows\System\ieVYEaF.exe
  C:\Windows\System\ieVYEaF.exe
  2⤵
  PID:15612
- C:\Windows\System\UibbLQe.exe
  C:\Windows\System\UibbLQe.exe
  2⤵
  PID:15712
- C:\Windows\System\fAGyEVN.exe
  C:\Windows\System\fAGyEVN.exe
  2⤵
  PID:15748
- C:\Windows\System\IYKqJsp.exe
  C:\Windows\System\IYKqJsp.exe
  2⤵
  PID:15776
- C:\Windows\System\wzxHAEp.exe
  C:\Windows\System\wzxHAEp.exe
  2⤵
  PID:15812
- C:\Windows\System\cPAxkPZ.exe
  C:\Windows\System\cPAxkPZ.exe
  2⤵
  PID:15940
- C:\Windows\System\jsyTNdA.exe
  C:\Windows\System\jsyTNdA.exe
  2⤵
  PID:16008
- C:\Windows\System\wvvPgAS.exe
  C:\Windows\System\wvvPgAS.exe
  2⤵
  PID:16040
- C:\Windows\System\FAMztCA.exe
  C:\Windows\System\FAMztCA.exe
  2⤵
  PID:16124
- C:\Windows\System\sKDeZXn.exe
  C:\Windows\System\sKDeZXn.exe
  2⤵
  PID:16152
- C:\Windows\System\QvEFHMw.exe
  C:\Windows\System\QvEFHMw.exe
  2⤵
  PID:16248
- C:\Windows\System\Lxooddp.exe
  C:\Windows\System\Lxooddp.exe
  2⤵
  PID:16244
- C:\Windows\System\oXkPAKJ.exe
  C:\Windows\System\oXkPAKJ.exe
  2⤵
  PID:15392
- C:\Windows\System\XkuCEWL.exe
  C:\Windows\System\XkuCEWL.exe
  2⤵
  PID:15484
- C:\Windows\System\ksYqfAW.exe
  C:\Windows\System\ksYqfAW.exe
  2⤵
  PID:15596
- C:\Windows\System\DeBDQYC.exe
  C:\Windows\System\DeBDQYC.exe
  2⤵
  PID:15896
- C:\Windows\System\ZzrsYTA.exe
  C:\Windows\System\ZzrsYTA.exe
  2⤵
  PID:15956
- C:\Windows\System\BzJIzSR.exe
  C:\Windows\System\BzJIzSR.exe
  2⤵
  PID:16024
- C:\Windows\System\ekdnZNf.exe
  C:\Windows\System\ekdnZNf.exe
  2⤵
  PID:16076
- C:\Windows\System\zLXIlAi.exe
  C:\Windows\System\zLXIlAi.exe
  2⤵
  PID:16344
- C:\Windows\System\UyifjmY.exe
  C:\Windows\System\UyifjmY.exe
  2⤵
  PID:15684
- C:\Windows\System\ruuTbrv.exe
  C:\Windows\System\ruuTbrv.exe
  2⤵
  PID:15844
- C:\Windows\System\AYhuhQG.exe
  C:\Windows\System\AYhuhQG.exe
  2⤵
  PID:16236
- C:\Windows\System\TFENhxD.exe
  C:\Windows\System\TFENhxD.exe
  2⤵
  PID:15792
- C:\Windows\System\nLYNUyK.exe
  C:\Windows\System\nLYNUyK.exe
  2⤵
  PID:16404
- C:\Windows\System\mFUiUPX.exe
  C:\Windows\System\mFUiUPX.exe
  2⤵
  PID:16428
- C:\Windows\System\aYtvmNp.exe
  C:\Windows\System\aYtvmNp.exe
  2⤵
  PID:16448
- C:\Windows\System\XTGfBik.exe
  C:\Windows\System\XTGfBik.exe
  2⤵
  PID:16480
- C:\Windows\System\psyYTYl.exe
  C:\Windows\System\psyYTYl.exe
  2⤵
  PID:16500
- C:\Windows\System\eUWtMJd.exe
  C:\Windows\System\eUWtMJd.exe
  2⤵
  PID:16520
- C:\Windows\System\XSzxXbC.exe
  C:\Windows\System\XSzxXbC.exe
  2⤵
  PID:16560
- C:\Windows\System\ErZSJoH.exe
  C:\Windows\System\ErZSJoH.exe
  2⤵
  PID:16620
- C:\Windows\System\ylDKCGM.exe
  C:\Windows\System\ylDKCGM.exe
  2⤵
  PID:16648
- C:\Windows\System\ufNNUxA.exe
  C:\Windows\System\ufNNUxA.exe
  2⤵
  PID:16668
- C:\Windows\System\EdKdUmf.exe
  C:\Windows\System\EdKdUmf.exe
  2⤵
  PID:16692
- C:\Windows\System\HEsIQPT.exe
  C:\Windows\System\HEsIQPT.exe
  2⤵
  PID:16724
- C:\Windows\System\KHoOrVs.exe
  C:\Windows\System\KHoOrVs.exe
  2⤵
  PID:16744
- C:\Windows\System\TFXTjUz.exe
  C:\Windows\System\TFXTjUz.exe
  2⤵
  PID:16776
- C:\Windows\System\bWLdMtB.exe
  C:\Windows\System\bWLdMtB.exe
  2⤵
  PID:16800
- C:\Windows\System\SQLARZN.exe
  C:\Windows\System\SQLARZN.exe
  2⤵
  PID:16824
- C:\Windows\System\gljWNiP.exe
  C:\Windows\System\gljWNiP.exe
  2⤵
  PID:16848
- C:\Windows\System\MlHrRAy.exe
  C:\Windows\System\MlHrRAy.exe
  2⤵
  PID:16880

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:17160

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\DCZemgG.exe

Filesize
1.5MB

MD5
188bc1407c0aa9dca830a4c98c87594e

SHA1
a689283320f940198f0375c9b92194b800704fab

SHA256
0a175d6031a6dc114ddae2f608898de8657eea0df2e5f549683dcffc47ebbe0c

SHA512
75e41ef417bb3ba6c082eab1b4f0c8c49cecf93e644cc253d6e0e188b1c7b1831e3506c6798cffe61910c141083f7ced3cc6c933ba26b8b9eb73279dec168f68

Download Submit
C:\Windows\System\DkfNneO.exe

Filesize
1.5MB

MD5
225196a1a6f7120451c97e014b2a161a

SHA1
b28e8365192017d4d866f7c6e51b6e7bf36754c1

SHA256
d30f2debe6c3867d4f51237327be006e1817e4968396724a856c6dd7c1380f6c

SHA512
c245f41e92a8c1fda8b6d457612b81b41d5942d2c4a257c5d5c98e468a44bb4cd9c6e12b16f2aec3960d6cf79157f3dc0b42e363a8b4d72ca2cecc4b38a04e40

Download Submit
C:\Windows\System\DzHRplk.exe

Filesize
1.5MB

MD5
197ce45722dbd03a92f82d0cd79f4de0

SHA1
cf6dba6973dc6e9e466dd5c8d34dc6d7ac25ab03

SHA256
cf868f12379db6f3782e08de6ee5dae08ca6240644b6f627abdb38eb15672b93

SHA512
5700ff2b78f8f083dd4db2d44ce6da68ff05ff6a0569e28ab7e1e9980045db5c5c5edc3a9f8b6756e823b6306bf2facbcc05df6464117aeaa6d0e4e2c429e102

Download Submit
C:\Windows\System\EIUvXGm.exe

Filesize
1.5MB

MD5
f1ea8c0a66bbec73e5f5b1cd26655d20

SHA1
1eed35da3e2e07908842b797c96a6ad8b4446c59

SHA256
3c487aab20b0d944022c11baea657ea8d2103c3d428598093bdbc09368c342cc

SHA512
8c0e8a1c79a103a323dbbaad4fab4b2fda8f7ac2a65736245b58614dd5c39803fb9738c572f59b6b2eece989fd47353115934bca6b14d4593f692ddf90d01c8b

Download Submit
C:\Windows\System\FsdpBNi.exe

Filesize
1.5MB

MD5
a0ec708b582c9c13fe904915dde5e229

SHA1
00f79137b2695154cd755ad6d48ebd3af85874e1

SHA256
deb40a10f8160b3beb4797cc36c721d4615828a3a5f3c71a76fb7c363a38ff0f

SHA512
d916d4a924d4ddb25be60fdc21ee3c80bb20731b9c8cf8ddc9444492bfcd5fe82b2492099896ff536c5c6a9f90624209c40358278aebda09d5bb99ad502350fa

Download Submit
C:\Windows\System\GprkUoo.exe

Filesize
1.5MB

MD5
648e0f277c4b745fa6746e0a32e096de

SHA1
8c951e3887a6d664191720ab5b281edcc57425f2

SHA256
3ad52f2c730854173e228e4f5ebb8522abc6b380dbf490de2059541ee4d3578c

SHA512
43aff412012158d2f2bfed89bbdfc8157f09f72af10df58e2d186e32e9f16d87a548a4fbdd4664a9c39a0d809ec4f6c48e01aabb49700b5c7280b10385539ca6

Download Submit
C:\Windows\System\IwOsGxf.exe

Filesize
1.5MB

MD5
32c556d0912b967be59b8f6b1165d547

SHA1
73b64915b75d63934e98bde639dcf2d42c84ef91

SHA256
33d6056bfd70a864f5297744b2ae03fb384d20d9a672735212525c01bef21e31

SHA512
dc85a7ae2faea03456a94f37238002f2e16a9864c178501132a3577899dc83ba709380c9be30927b6256031141ea19ce75b029a43ebe16eb9a388625e4a5c41b

Download Submit
C:\Windows\System\KklKQOu.exe

Filesize
1.5MB

MD5
709d5b3f12adee5d924561104e2c8a67

SHA1
a8f0d4926a737363e6fe7a80401d91d4dc3cd9c7

SHA256
c9af552b51b68d428ce83bbe15de2d804cc6d9a645eed23bfb36820f9bdd4296

SHA512
22bcd6e0501d847a5f62c01fe3363122131c1c9f3ef5c103bf31fd214bc8da7d57bbd071e509b7ed7bd3bb741451680c6d28a78ccbd4c60e0ebfa78db3d7ab0e

Download Submit
C:\Windows\System\LUxFJRi.exe

Filesize
1.5MB

MD5
078cf8f175066a4ad864ed7004128163

SHA1
df107a56eb4f77b4fb69cc3ed5d527646375795a

SHA256
f02b4313759dcc44699a2181a67d1bd2a028e1fff043986c9fe5fe1ba19e34ee

SHA512
bf6775b89b455e18180c54430233fce53c7d59e1ae7de0504d14755bd501415e1f58e2efde0edb97e6d731473eea7531bfd26cf253d755be6b40b32eeb350484

Download Submit
C:\Windows\System\NuVavvY.exe

Filesize
1.5MB

MD5
fff835b0c83db87fb4e3c2a4d2e414ee

SHA1
7bd15200e74e26679050aa17d94194eb95e09773

SHA256
c418523fa9d9232082812477c90f3d97539b76a85a267eb0ab342e2aa166886a

SHA512
58f9e8214685985f977f5e8d808e6dc04833403af8d454299fbf273ca221b45d89310f580c1e516c7aa4d67fb6133a6cc18063499a4d6c183d573ac914c13814

Download Submit
C:\Windows\System\QkFtfyj.exe

Filesize
1.5MB

MD5
a8baa2e132b296d7880b198f283481b5

SHA1
8ec971d4162bdcb52598a4b14823ed014800966f

SHA256
c8642bc65e7e90ca3a11ddbc310969d6ae8f7929ac4bd7be2786f53ad3f973e6

SHA512
856cb3a66da6f02150cb6a0723bec508c658bb5b663eb0fbf8c32909cc51f2eab90a0b0afe462d0cd1b308698ba6df1c44357b36e086855b964abcef432c9f0d

Download Submit
C:\Windows\System\QoVQSQM.exe

Filesize
1.5MB

MD5
63cc8623512f3d7be16d760e2c82833e

SHA1
97310ade6289476a3a9639ab584df9481fb0b8ae

SHA256
f78b8faf2c8b7d230f781f3484173f608cc5ce1e23d6dcab735dc5bf02b63fa9

SHA512
5844f44c982e609b3fa7f356888a01f5ea1c90c4ce23786dccabfc5860a1f35675d885a99919da1f4b013ae878e7860765c3464085884dde8b12bbfa73e24825

Download Submit
C:\Windows\System\RCOLzJT.exe

Filesize
1.5MB

MD5
1e3d43af96aa9251d12082ba146d0ded

SHA1
6f3f4927c6328ffa65ebde378def9cc99181ca98

SHA256
52fc4adff78975a1e6e6d7d9b0a360772d2b400ea555161d3173ab7e6d582040

SHA512
135cf299fd37a168949dfc4d0ad23334696c77e46beba4b88c463101b4bd989167bd761ad821ab165c86eeef630839c36841436d99366aaee56cd119f8eb92a6

Download Submit
C:\Windows\System\TVKKcph.exe

Filesize
1.5MB

MD5
be4dcc755f1fca6dede1376dae36925f

SHA1
0f4d4d15e581c8f61826bc7c697e5ce895bef711

SHA256
f855879487cca04300c6d7d74d10bfe9b711cd93df1dec602220b009f0c91d83

SHA512
b7cdbc78bbcfc3a8d9584a8411ec6047ec549ef757a903de0d17b296368682dc7d2d0208ab5fade1cbc47fffab6761da94f89ec71ecadf753326913c8a3064b3

Download Submit
C:\Windows\System\UVZEAbS.exe

Filesize
1.5MB

MD5
0d1114224f2681e50746c907fbbeed59

SHA1
4932cb95fe17fd2ae82fefef130f8d31f78162e1

SHA256
015e7137fcf57ba04cbd09313adff73bfdb5c8b3236da1a031526db01bb88cac

SHA512
9b27c2794096ad95e218a860ffc90ad44a56f687609c66e437b29fe0286ec764cced0429536de5aed68f05ef91579cc69be2f7eeb3cb75d91963879d0edaeed8

Download Submit
C:\Windows\System\VQwXyTf.exe

Filesize
1.5MB

MD5
17261618bbcadcd6ceaa6c2286b27eef

SHA1
ae049dc3ebc73c6da13a31da1a4a7ca9b99a0a06

SHA256
6f5c45bd1b508c0fe655dcfc337bc9e0bc043ee2d698a947be889a19e59b5380

SHA512
2cdf18de16641b5696eecb1c2994b7e385b8e96f64723076e7b1bc9774fe560f938e8a7489ae297b57a0955def8beb859153d6e848d0a7c49a843059834482f3

Download Submit
C:\Windows\System\XHkpbjt.exe

Filesize
1.5MB

MD5
fc19e4a4b7adae5d0d76bdd82c3cb23c

SHA1
3b638385c1aff37a1bf9eb4ae40b307398a4915a

SHA256
302794b1065987a15a34a7af0fd2acef87cf96d907f3977aec9f75524482eaa6

SHA512
242aa82488c9494f7c73885fa095e39852a348c17211fc3e139aec0e30a1d4f39313e9e6d190ad1f517e75275dc1dd932298570b8325dfd3bfb795039af139de

Download Submit
C:\Windows\System\aDdJhcH.exe

Filesize
1.5MB

MD5
0c5a37b5d19de1daf1b7d259fcf0591d

SHA1
41c381b764cc560438415db1bb9d1f8ca8f2eaac

SHA256
d03d23e507f0d73cf663deaf45dc50cf50ed9552dc48b4f9ef16e9f673976238

SHA512
94b663a402226a78e667e6784a95dc7ce780e8ba2b20be2689a638eb69495bfed48ce341e88e846665c34dbaa45454442f48a0c6eb8adff3a98c7b060979f60d

Download Submit
C:\Windows\System\coyRYju.exe

Filesize
1.5MB

MD5
8dbaed098d577116500efe0920d2011f

SHA1
b241b4e5a139bdd4d6c41a82ed748132e7325d6b

SHA256
2be4639656907d6fb1e6908f4594c0b65c649c15eddb2b1e6321793076e039bd

SHA512
01bb7e616355446874bbbf3db2a16caee292068fa32277ca9c169eee141abc6fbb7486219ca8587b5b955e7f10355c3db32a7c4612b245096e7ccb99de374204

Download Submit
C:\Windows\System\dLQdIfA.exe

Filesize
1.5MB

MD5
388957af3632c454a6aa5616fcc76b3f

SHA1
b03f7ccda2a72a8a348ce5a4b0378f7775f71265

SHA256
2272eb13253aad9b1e99b0059ac5d2073d9c67837df91045742f39fa01877f1f

SHA512
1729112cba9ee97dfba4e86f94b6205d6bff1e6d088955d31cb84d3dd637a10f02d7af1eabcb797ba2bddeebc173cc964bdda964ea41ccadf31d9d9aa73dfeb2

Download Submit
C:\Windows\System\dTrXedr.exe

Filesize
1.5MB

MD5
f4433b6388e14b38783a5ff56d0a88d9

SHA1
fafedf01ba5512fb5f2ee1ea4d6f79c4eb2cb4e5

SHA256
f34a4a2deec105a14f6a13f8cb5c10b8e0b891e2ab9288aab6a4aa72ba3c4e4d

SHA512
6ffc6e87c1fe5bd44af82a382f06e37fa3c289fa907f2e668997e441f5d5f26b8ea0cad6a6d83e469483b7144db3eaa9f759299b963e82b67fd05149490ab3e9

Download Submit
C:\Windows\System\eGIuBeY.exe

Filesize
1.5MB

MD5
6af1dce24d31c65e3a2b6ddb47adb517

SHA1
0fa3758ee523410923b0b0baff14ffbce61d45e5

SHA256
72289cbe16337731fbacc5747447362948d985f3265d12e4542901fa803b55f0

SHA512
1d37fc6a42f80c86aac72823f17c80fb2aa6af894a3925b23d950c8405fb2afeed1f3a7d00420f757ad7ae4b243a0ecf9f3d9f178bb593eb02274a042c07198d

Download Submit
C:\Windows\System\eGTSfCb.exe

Filesize
1.5MB

MD5
7c0668d58930612814b6a3187925bb6e

SHA1
da53686cc23ac224cf5736bfbe857f9a2c3d756c

SHA256
d17e37d8b442c84b7dc6e4eb711bc7b719bf01b709b5fd0eff1893b5cfa801e7

SHA512
b419a04428a25313a2edc59411fc8e441445922aa38f0554edbb9906136e39e7e11cce05510da286ce7780c00c24b9f0fdf9b383be741744d20c6217d80cd28e

Download Submit
C:\Windows\System\gIwaKdo.exe

Filesize
1.5MB

MD5
ca26a5421a5ecc2eabb3f61237f68bb0

SHA1
eea421a7605d93d6094092a8d84417b944c11acd

SHA256
d63477583756e25666dc72d2a5704dac7cc076a25dbcd76b5095ec91a823d8ee

SHA512
74a5eda447aafb22d593acd84d3cf8b94d78668699d828968c754ecc72f4ac6f83995a8b7f1132e15067de8a9d7af7cb9d08f6101dbe92d30eb1d2f677b83a07

Download Submit
C:\Windows\System\hflOEHE.exe

Filesize
1.5MB

MD5
01edaaa25d189b741e2a289f5479645a

SHA1
854ff06f71bffd1cf275fd738018f429b363ad85

SHA256
ed263fefa7f860afd42fcb41c4f7195922e5b4f23dff0adc028395eeb4b8d655

SHA512
d2c88aaff3beebad46fe0269e042747539ac19cb3f7a5cd018ca2e62ea0109b7fa027ac2a7793b12e8446949682dde5ca5916957bb79142a2d3967f406e43d10

Download Submit
C:\Windows\System\iTzBvJx.exe

Filesize
1.5MB

MD5
5c0461b1f35dc30b9a17afe48158dfe6

SHA1
49e28c70d9416eb22c58f7ed2aa59813595cb0e0

SHA256
ceffb05f85f86ed0f80aede524ada99198d223db7f0cb04862f57bb8fa24be13

SHA512
96965e14f5ae45a9998f3e56e43b20e511d6a340ab131ab908f76fbde01037a5343a68557a0ddf5703ac2c230c727e479f5638afa31c5a4459a294875504a8fe

Download Submit
C:\Windows\System\kDZazCe.exe

Filesize
1.5MB

MD5
f71c1f5b3bc10b1be182c0d0d6199660

SHA1
438ed35c4702be2600888410eeae5c3eca376645

SHA256
46ec5c1d3f09ea794f4e1fbc1c24272413bcef8a19a0ff67952121fa98025539

SHA512
06dd98f61478001087ea5d1d1716ea9f5296b722576947e16250e70a688697c329686fd7ecc5ec93d6384ee22eae27415a99efdeba0afda627d3deada046dacd

Download Submit
C:\Windows\System\qkmOzXh.exe

Filesize
1.5MB

MD5
8c0ca139f163935b0f3122588c47ba71

SHA1
8cab6e9f962edcecfe2683947595d2e4258da49f

SHA256
78c7e73df0397ffab3c7625bd071b6f58bfb588e027fef2b39d385bdf9eb2192

SHA512
062995ce1885c40cb2c0c776e267bb6363f3c4c8d5b75bdea099d2241683f782cd5c95074dde927c91e64692ff47c5f64e909bca21bde38cf18ea58a87d84eb2

Download Submit
C:\Windows\System\qxWzubu.exe

Filesize
1.5MB

MD5
77c5dbf95993ea744bed0d4e35919d54

SHA1
82446b156f9116402209a884191edcb83ee6c5b1

SHA256
e0a864456cc24d7dc827c334cf1a8ec500b414ffc3b7cfdd93e3748f6090e9b8

SHA512
361688dfb9776becefcc0e2b24f587f5cabbcd8b9b1a40d62c2f5139e9e587c1f5deb052d4cba38ab001007087ba291195fb8028a3db41e767ee99a7dc1f9aac

Download Submit
C:\Windows\System\rvlejyN.exe

Filesize
1.5MB

MD5
809fd510e638794572949d0d0d37ef2a

SHA1
73f767dfd006a34932eda3da306c969e464728fd

SHA256
f4e18bcaa3c4c28553ef704c740c560fc3f223fd4aca758dba61bd2239db50bd

SHA512
8779f347bbea76134fe7d971ade9c999cd70ef82d4eb77e224129531be36a7dd50c0854af1a090c54483bf7d3d31927382a34c3b5f411a8f8463cafefc596f9a

Download Submit
C:\Windows\System\tqoFKDH.exe

Filesize
1.5MB

MD5
e1c975d2183c851338455c918d9edbb3

SHA1
b2e3e7da87224922e33a03d490461809be07f4c7

SHA256
4524b5c70daf943d347ff1070b9e0f780bf42aa9c23529fc30efa81af100ad8f

SHA512
bbcfb29c52bc5d0f11791ccfc8f464dc81c7362cb5bdab90cbfd6384827b50d028385dc27fa80c552dba81f10613a831ae0cd7a189f1f731f95190df98568aee

Download Submit
C:\Windows\System\udazXwO.exe

Filesize
1.5MB

MD5
8160b8c0268fe8c3ba7acc731fd7b1a7

SHA1
5d2c7611b5f5ced6d5156484817693ad4b274164

SHA256
6f855c1da6196b7e1acb0bf79c0750e23201d891ffe320ae2c2dff370ce14d19

SHA512
ececc2ae21149d1f88edd49f2ea61ae53c03043f1ecc86bec1dc58315c9b51a1ff922145d6fd5782195df44721654a6cb96d42c9d72bc3a07eb59e5f367ad220

Download Submit
C:\Windows\System\vgsyUDd.exe

Filesize
1.5MB

MD5
a03a91d705bcd05e91a43044892b6dcf

SHA1
2b061eeed0765e54581117e58c208e13bf551219

SHA256
9ae3fa43e9a9ef45968c6416762e464f89193dc2151a089b19d66a9ec444a454

SHA512
5ca44f74a56db969fa099bfe25c5c449c1381080864f93605432fb4820f65a148ec2ad78ce82ee96f6729ba792ee2c922d9ab6075d42b9fac1216f01f64a3a8b

Download Submit
memory/4048-0-0x0000025F83140000-0x0000025F83150000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads