xmrig | 16c56fc77afa20be0876582725d3748ba06d2ac11f1d93eda1aa3e61e2d0b8ec

Analysis

max time kernel
134s
max time network
99s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
23-12-2024 19:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

16c56fc77afa20be0876582725d3748ba06d2ac11f1d93eda1aa3e61e2d0b8ec.exe
Size

1.7MB
MD5

06fb18de44aeb3731a93532b3995a426
SHA1

60092c1f5482c15d2dc874b2ea12b0e57cc6e9bd
SHA256

16c56fc77afa20be0876582725d3748ba06d2ac11f1d93eda1aa3e61e2d0b8ec
SHA512

22bfe528ba46a8839138670e02133afa5358fe5757d409eeb1822bbf8c17a7ce74609f1d781a55c0ac57b02aea84a23ef5d74b91fd763d95231f1cf01dbced36
SSDEEP

49152:GezaTF8FcNkNdfE0pZ9ozttwIRakGNrNHGfX:GemTLkNdfE0pZyr

Score

10^/10

xmrig discovery miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 33 IoCs

miner

resource	yara_rule
behavioral2/files/0x000b000000023b97-4.dat	xmrig
behavioral2/files/0x000a000000023b9b-9.dat	xmrig
behavioral2/files/0x000a000000023b9c-16.dat	xmrig
behavioral2/files/0x000a000000023b9f-27.dat	xmrig
behavioral2/files/0x0031000000023ba4-55.dat	xmrig
behavioral2/files/0x000a000000023ba7-65.dat	xmrig
behavioral2/files/0x000a000000023baa-74.dat	xmrig
behavioral2/files/0x000a000000023bae-105.dat	xmrig
behavioral2/files/0x000a000000023bad-103.dat	xmrig
behavioral2/files/0x000a000000023bac-99.dat	xmrig
behavioral2/files/0x000a000000023bab-97.dat	xmrig
behavioral2/files/0x000a000000023ba9-95.dat	xmrig
behavioral2/files/0x000a000000023ba8-92.dat	xmrig
behavioral2/files/0x0058000000023ba6-85.dat	xmrig
behavioral2/files/0x000a000000023ba5-80.dat	xmrig
behavioral2/files/0x000a000000023ba1-64.dat	xmrig
behavioral2/files/0x000a000000023ba3-62.dat	xmrig
behavioral2/files/0x000a000000023ba2-52.dat	xmrig
behavioral2/files/0x000a000000023ba0-41.dat	xmrig
behavioral2/files/0x000a000000023b9d-38.dat	xmrig
behavioral2/files/0x000a000000023b9e-31.dat	xmrig
behavioral2/files/0x000a000000023bb0-112.dat	xmrig
behavioral2/files/0x000a000000023baf-111.dat	xmrig
behavioral2/files/0x000b000000023b98-119.dat	xmrig
behavioral2/files/0x000a000000023bb2-127.dat	xmrig
behavioral2/files/0x000a000000023bb1-125.dat	xmrig
behavioral2/files/0x000a000000023bb3-135.dat	xmrig
behavioral2/files/0x000a000000023bb6-145.dat	xmrig
behavioral2/files/0x000a000000023bb5-148.dat	xmrig
behavioral2/files/0x000a000000023bb4-146.dat	xmrig
behavioral2/files/0x000a000000023bb7-154.dat	xmrig
behavioral2/files/0x000a000000023bba-160.dat	xmrig
behavioral2/files/0x000a000000023bb9-159.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2228	YkuOKoh.exe
3672	YlHePsD.exe
2680	UGDnPbk.exe
1292	APvdKad.exe
1208	ZviKwof.exe
232	TdXubSR.exe
4420	zefgcEx.exe
2308	rgIYwKh.exe
1844	EfWmiMU.exe
1912	UywPTnR.exe
4432	sdoiChj.exe
692	CEYZyUi.exe
4560	TeZYzoW.exe
2892	xKCqgHW.exe
4188	xprttYk.exe
2260	EQVyXCr.exe
2124	RGyyulc.exe
1276	LesESqA.exe
4140	FYXZedA.exe
3716	HvniqQn.exe
3804	TvjrbzY.exe
2040	gnWPmmc.exe
3744	DjOkngM.exe
3388	eZJhdDI.exe
1792	evfPOhr.exe
372	zfRJjcR.exe
2328	lBdFTpk.exe
3604	nQNQmfJ.exe
4528	xtwZkIS.exe
4860	hkTcWJj.exe
2476	EvlkTcA.exe
1592	eGrRShc.exe
2036	AcCphFC.exe
4956	wVUGHtY.exe
5028	nraMxYq.exe
1904	CckqvXj.exe
3936	qowkiPF.exe
1284	djEaqbi.exe
3820	OCePKMi.exe
2292	UnzEkdI.exe
3260	aPWBeFd.exe
3280	pmYVNTH.exe
704	gyKuVDe.exe
4880	mZihfRB.exe
5064	njSWoWJ.exe
4964	JpiEICK.exe
884	AmgbSrb.exe
2844	mEZmEYY.exe
2992	ojZtmYs.exe
3332	Mkcwoln.exe
1436	KYSFsYN.exe
4404	OqZWtrW.exe
4388	tzMZPZc.exe
2952	GiOguNh.exe
4896	xjxrHlo.exe
760	EVbwnUi.exe
3464	qVpoehN.exe
1620	XeyzVuY.exe
4572	sERlzug.exe
4884	NLdGKSJ.exe
2900	ugzmErO.exe
3536	KfgaoRa.exe
4584	ZZOWFGv.exe
3112	qaFXpZd.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\IMZgeNY.exe	16c56fc77afa20be0876582725d3748ba06d2ac11f1d93eda1aa3e61e2d0b8ec.exe
File created	C:\Windows\System\jodPSTb.exe	16c56fc77afa20be0876582725d3748ba06d2ac11f1d93eda1aa3e61e2d0b8ec.exe
File created	C:\Windows\System\frPnPPR.exe	16c56fc77afa20be0876582725d3748ba06d2ac11f1d93eda1aa3e61e2d0b8ec.exe
File created	C:\Windows\System\nZPzlAV.exe	16c56fc77afa20be0876582725d3748ba06d2ac11f1d93eda1aa3e61e2d0b8ec.exe
File created	C:\Windows\System\JoLCWnk.exe	16c56fc77afa20be0876582725d3748ba06d2ac11f1d93eda1aa3e61e2d0b8ec.exe
File created	C:\Windows\System\otJwuHX.exe	16c56fc77afa20be0876582725d3748ba06d2ac11f1d93eda1aa3e61e2d0b8ec.exe
File created	C:\Windows\System\JqFnIsC.exe	16c56fc77afa20be0876582725d3748ba06d2ac11f1d93eda1aa3e61e2d0b8ec.exe
File created	C:\Windows\System\SSAOKJw.exe	16c56fc77afa20be0876582725d3748ba06d2ac11f1d93eda1aa3e61e2d0b8ec.exe
File created	C:\Windows\System\jddCUHd.exe	16c56fc77afa20be0876582725d3748ba06d2ac11f1d93eda1aa3e61e2d0b8ec.exe
File created	C:\Windows\System\mzZrdQW.exe	16c56fc77afa20be0876582725d3748ba06d2ac11f1d93eda1aa3e61e2d0b8ec.exe
File created	C:\Windows\System\blQQdbO.exe	16c56fc77afa20be0876582725d3748ba06d2ac11f1d93eda1aa3e61e2d0b8ec.exe
File created	C:\Windows\System\QrfpFns.exe	16c56fc77afa20be0876582725d3748ba06d2ac11f1d93eda1aa3e61e2d0b8ec.exe
File created	C:\Windows\System\zkVwthw.exe	16c56fc77afa20be0876582725d3748ba06d2ac11f1d93eda1aa3e61e2d0b8ec.exe
File created	C:\Windows\System\iuXkdia.exe	16c56fc77afa20be0876582725d3748ba06d2ac11f1d93eda1aa3e61e2d0b8ec.exe
File created	C:\Windows\System\vChjiXJ.exe	16c56fc77afa20be0876582725d3748ba06d2ac11f1d93eda1aa3e61e2d0b8ec.exe
File created	C:\Windows\System\yJGtQXf.exe	16c56fc77afa20be0876582725d3748ba06d2ac11f1d93eda1aa3e61e2d0b8ec.exe
File created	C:\Windows\System\qfLFOyr.exe	16c56fc77afa20be0876582725d3748ba06d2ac11f1d93eda1aa3e61e2d0b8ec.exe
File created	C:\Windows\System\nHJDznJ.exe	16c56fc77afa20be0876582725d3748ba06d2ac11f1d93eda1aa3e61e2d0b8ec.exe
File created	C:\Windows\System\UnzEkdI.exe	16c56fc77afa20be0876582725d3748ba06d2ac11f1d93eda1aa3e61e2d0b8ec.exe
File created	C:\Windows\System\gGrWvGq.exe	16c56fc77afa20be0876582725d3748ba06d2ac11f1d93eda1aa3e61e2d0b8ec.exe
File created	C:\Windows\System\SpesPhb.exe	16c56fc77afa20be0876582725d3748ba06d2ac11f1d93eda1aa3e61e2d0b8ec.exe
File created	C:\Windows\System\kowcgGy.exe	16c56fc77afa20be0876582725d3748ba06d2ac11f1d93eda1aa3e61e2d0b8ec.exe
File created	C:\Windows\System\yBXxefI.exe	16c56fc77afa20be0876582725d3748ba06d2ac11f1d93eda1aa3e61e2d0b8ec.exe
File created	C:\Windows\System\CNVRDcc.exe	16c56fc77afa20be0876582725d3748ba06d2ac11f1d93eda1aa3e61e2d0b8ec.exe
File created	C:\Windows\System\sDPhHhJ.exe	16c56fc77afa20be0876582725d3748ba06d2ac11f1d93eda1aa3e61e2d0b8ec.exe
File created	C:\Windows\System\AxYFkDZ.exe	16c56fc77afa20be0876582725d3748ba06d2ac11f1d93eda1aa3e61e2d0b8ec.exe
File created	C:\Windows\System\QHDCTUu.exe	16c56fc77afa20be0876582725d3748ba06d2ac11f1d93eda1aa3e61e2d0b8ec.exe
File created	C:\Windows\System\cyylICW.exe	16c56fc77afa20be0876582725d3748ba06d2ac11f1d93eda1aa3e61e2d0b8ec.exe
File created	C:\Windows\System\nxSkhsg.exe	16c56fc77afa20be0876582725d3748ba06d2ac11f1d93eda1aa3e61e2d0b8ec.exe
File created	C:\Windows\System\LYNaCNb.exe	16c56fc77afa20be0876582725d3748ba06d2ac11f1d93eda1aa3e61e2d0b8ec.exe
File created	C:\Windows\System\mrrAWfL.exe	16c56fc77afa20be0876582725d3748ba06d2ac11f1d93eda1aa3e61e2d0b8ec.exe
File created	C:\Windows\System\vzvyQwK.exe	16c56fc77afa20be0876582725d3748ba06d2ac11f1d93eda1aa3e61e2d0b8ec.exe
File created	C:\Windows\System\SzgPTlj.exe	16c56fc77afa20be0876582725d3748ba06d2ac11f1d93eda1aa3e61e2d0b8ec.exe
File created	C:\Windows\System\tNUKgAA.exe	16c56fc77afa20be0876582725d3748ba06d2ac11f1d93eda1aa3e61e2d0b8ec.exe
File created	C:\Windows\System\wNSTSlb.exe	16c56fc77afa20be0876582725d3748ba06d2ac11f1d93eda1aa3e61e2d0b8ec.exe
File created	C:\Windows\System\dIfqDRT.exe	16c56fc77afa20be0876582725d3748ba06d2ac11f1d93eda1aa3e61e2d0b8ec.exe
File created	C:\Windows\System\UZrcCMi.exe	16c56fc77afa20be0876582725d3748ba06d2ac11f1d93eda1aa3e61e2d0b8ec.exe
File created	C:\Windows\System\SOwMqSL.exe	16c56fc77afa20be0876582725d3748ba06d2ac11f1d93eda1aa3e61e2d0b8ec.exe
File created	C:\Windows\System\vZTBJAe.exe	16c56fc77afa20be0876582725d3748ba06d2ac11f1d93eda1aa3e61e2d0b8ec.exe
File created	C:\Windows\System\dkqHIwE.exe	16c56fc77afa20be0876582725d3748ba06d2ac11f1d93eda1aa3e61e2d0b8ec.exe
File created	C:\Windows\System\GwAYGGr.exe	16c56fc77afa20be0876582725d3748ba06d2ac11f1d93eda1aa3e61e2d0b8ec.exe
File created	C:\Windows\System\gsRRPVm.exe	16c56fc77afa20be0876582725d3748ba06d2ac11f1d93eda1aa3e61e2d0b8ec.exe
File created	C:\Windows\System\WPQDCkq.exe	16c56fc77afa20be0876582725d3748ba06d2ac11f1d93eda1aa3e61e2d0b8ec.exe
File created	C:\Windows\System\EElfTwu.exe	16c56fc77afa20be0876582725d3748ba06d2ac11f1d93eda1aa3e61e2d0b8ec.exe
File created	C:\Windows\System\COydavp.exe	16c56fc77afa20be0876582725d3748ba06d2ac11f1d93eda1aa3e61e2d0b8ec.exe
File created	C:\Windows\System\wBwLvJe.exe	16c56fc77afa20be0876582725d3748ba06d2ac11f1d93eda1aa3e61e2d0b8ec.exe
File created	C:\Windows\System\sYUIsSq.exe	16c56fc77afa20be0876582725d3748ba06d2ac11f1d93eda1aa3e61e2d0b8ec.exe
File created	C:\Windows\System\ETTeKUz.exe	16c56fc77afa20be0876582725d3748ba06d2ac11f1d93eda1aa3e61e2d0b8ec.exe
File created	C:\Windows\System\TryrVGe.exe	16c56fc77afa20be0876582725d3748ba06d2ac11f1d93eda1aa3e61e2d0b8ec.exe
File created	C:\Windows\System\vVoxgmF.exe	16c56fc77afa20be0876582725d3748ba06d2ac11f1d93eda1aa3e61e2d0b8ec.exe
File created	C:\Windows\System\XZWXRSX.exe	16c56fc77afa20be0876582725d3748ba06d2ac11f1d93eda1aa3e61e2d0b8ec.exe
File created	C:\Windows\System\pWnwsmi.exe	16c56fc77afa20be0876582725d3748ba06d2ac11f1d93eda1aa3e61e2d0b8ec.exe
File created	C:\Windows\System\sudogcD.exe	16c56fc77afa20be0876582725d3748ba06d2ac11f1d93eda1aa3e61e2d0b8ec.exe
File created	C:\Windows\System\GxXJDFI.exe	16c56fc77afa20be0876582725d3748ba06d2ac11f1d93eda1aa3e61e2d0b8ec.exe
File created	C:\Windows\System\phkolUk.exe	16c56fc77afa20be0876582725d3748ba06d2ac11f1d93eda1aa3e61e2d0b8ec.exe
File created	C:\Windows\System\nffFXyA.exe	16c56fc77afa20be0876582725d3748ba06d2ac11f1d93eda1aa3e61e2d0b8ec.exe
File created	C:\Windows\System\BKNjphr.exe	16c56fc77afa20be0876582725d3748ba06d2ac11f1d93eda1aa3e61e2d0b8ec.exe
File created	C:\Windows\System\uusFOKg.exe	16c56fc77afa20be0876582725d3748ba06d2ac11f1d93eda1aa3e61e2d0b8ec.exe
File created	C:\Windows\System\aTcUAjx.exe	16c56fc77afa20be0876582725d3748ba06d2ac11f1d93eda1aa3e61e2d0b8ec.exe
File created	C:\Windows\System\zefgcEx.exe	16c56fc77afa20be0876582725d3748ba06d2ac11f1d93eda1aa3e61e2d0b8ec.exe
File created	C:\Windows\System\uUgAPfd.exe	16c56fc77afa20be0876582725d3748ba06d2ac11f1d93eda1aa3e61e2d0b8ec.exe
File created	C:\Windows\System\BofBjLk.exe	16c56fc77afa20be0876582725d3748ba06d2ac11f1d93eda1aa3e61e2d0b8ec.exe
File created	C:\Windows\System\zyWOotw.exe	16c56fc77afa20be0876582725d3748ba06d2ac11f1d93eda1aa3e61e2d0b8ec.exe
File created	C:\Windows\System\qzwejmJ.exe	16c56fc77afa20be0876582725d3748ba06d2ac11f1d93eda1aa3e61e2d0b8ec.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4520	yPInGIh.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	17384	dwm.exe
Token: SeChangeNotifyPrivilege	17384	dwm.exe
Token: 33	17384	dwm.exe
Token: SeIncBasePriorityPrivilege	17384	dwm.exe
Token: SeShutdownPrivilege	17384	dwm.exe
Token: SeCreatePagefilePrivilege	17384	dwm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1272 wrote to memory of 2228	1272	16c56fc77afa20be0876582725d3748ba06d2ac11f1d93eda1aa3e61e2d0b8ec.exe	84
PID 1272 wrote to memory of 2228	1272	16c56fc77afa20be0876582725d3748ba06d2ac11f1d93eda1aa3e61e2d0b8ec.exe	84
PID 1272 wrote to memory of 3672	1272	16c56fc77afa20be0876582725d3748ba06d2ac11f1d93eda1aa3e61e2d0b8ec.exe	85
PID 1272 wrote to memory of 3672	1272	16c56fc77afa20be0876582725d3748ba06d2ac11f1d93eda1aa3e61e2d0b8ec.exe	85
PID 1272 wrote to memory of 2680	1272	16c56fc77afa20be0876582725d3748ba06d2ac11f1d93eda1aa3e61e2d0b8ec.exe	86
PID 1272 wrote to memory of 2680	1272	16c56fc77afa20be0876582725d3748ba06d2ac11f1d93eda1aa3e61e2d0b8ec.exe	86
PID 1272 wrote to memory of 1292	1272	16c56fc77afa20be0876582725d3748ba06d2ac11f1d93eda1aa3e61e2d0b8ec.exe	87
PID 1272 wrote to memory of 1292	1272	16c56fc77afa20be0876582725d3748ba06d2ac11f1d93eda1aa3e61e2d0b8ec.exe	87
PID 1272 wrote to memory of 1208	1272	16c56fc77afa20be0876582725d3748ba06d2ac11f1d93eda1aa3e61e2d0b8ec.exe	88
PID 1272 wrote to memory of 1208	1272	16c56fc77afa20be0876582725d3748ba06d2ac11f1d93eda1aa3e61e2d0b8ec.exe	88
PID 1272 wrote to memory of 232	1272	16c56fc77afa20be0876582725d3748ba06d2ac11f1d93eda1aa3e61e2d0b8ec.exe	89
PID 1272 wrote to memory of 232	1272	16c56fc77afa20be0876582725d3748ba06d2ac11f1d93eda1aa3e61e2d0b8ec.exe	89
PID 1272 wrote to memory of 4420	1272	16c56fc77afa20be0876582725d3748ba06d2ac11f1d93eda1aa3e61e2d0b8ec.exe	90
PID 1272 wrote to memory of 4420	1272	16c56fc77afa20be0876582725d3748ba06d2ac11f1d93eda1aa3e61e2d0b8ec.exe	90
PID 1272 wrote to memory of 2308	1272	16c56fc77afa20be0876582725d3748ba06d2ac11f1d93eda1aa3e61e2d0b8ec.exe	91
PID 1272 wrote to memory of 2308	1272	16c56fc77afa20be0876582725d3748ba06d2ac11f1d93eda1aa3e61e2d0b8ec.exe	91
PID 1272 wrote to memory of 1844	1272	16c56fc77afa20be0876582725d3748ba06d2ac11f1d93eda1aa3e61e2d0b8ec.exe	92
PID 1272 wrote to memory of 1844	1272	16c56fc77afa20be0876582725d3748ba06d2ac11f1d93eda1aa3e61e2d0b8ec.exe	92
PID 1272 wrote to memory of 1912	1272	16c56fc77afa20be0876582725d3748ba06d2ac11f1d93eda1aa3e61e2d0b8ec.exe	93
PID 1272 wrote to memory of 1912	1272	16c56fc77afa20be0876582725d3748ba06d2ac11f1d93eda1aa3e61e2d0b8ec.exe	93
PID 1272 wrote to memory of 4432	1272	16c56fc77afa20be0876582725d3748ba06d2ac11f1d93eda1aa3e61e2d0b8ec.exe	94
PID 1272 wrote to memory of 4432	1272	16c56fc77afa20be0876582725d3748ba06d2ac11f1d93eda1aa3e61e2d0b8ec.exe	94
PID 1272 wrote to memory of 692	1272	16c56fc77afa20be0876582725d3748ba06d2ac11f1d93eda1aa3e61e2d0b8ec.exe	95
PID 1272 wrote to memory of 692	1272	16c56fc77afa20be0876582725d3748ba06d2ac11f1d93eda1aa3e61e2d0b8ec.exe	95
PID 1272 wrote to memory of 4560	1272	16c56fc77afa20be0876582725d3748ba06d2ac11f1d93eda1aa3e61e2d0b8ec.exe	96
PID 1272 wrote to memory of 4560	1272	16c56fc77afa20be0876582725d3748ba06d2ac11f1d93eda1aa3e61e2d0b8ec.exe	96
PID 1272 wrote to memory of 2892	1272	16c56fc77afa20be0876582725d3748ba06d2ac11f1d93eda1aa3e61e2d0b8ec.exe	97
PID 1272 wrote to memory of 2892	1272	16c56fc77afa20be0876582725d3748ba06d2ac11f1d93eda1aa3e61e2d0b8ec.exe	97
PID 1272 wrote to memory of 4188	1272	16c56fc77afa20be0876582725d3748ba06d2ac11f1d93eda1aa3e61e2d0b8ec.exe	98
PID 1272 wrote to memory of 4188	1272	16c56fc77afa20be0876582725d3748ba06d2ac11f1d93eda1aa3e61e2d0b8ec.exe	98
PID 1272 wrote to memory of 2260	1272	16c56fc77afa20be0876582725d3748ba06d2ac11f1d93eda1aa3e61e2d0b8ec.exe	99
PID 1272 wrote to memory of 2260	1272	16c56fc77afa20be0876582725d3748ba06d2ac11f1d93eda1aa3e61e2d0b8ec.exe	99
PID 1272 wrote to memory of 2124	1272	16c56fc77afa20be0876582725d3748ba06d2ac11f1d93eda1aa3e61e2d0b8ec.exe	100
PID 1272 wrote to memory of 2124	1272	16c56fc77afa20be0876582725d3748ba06d2ac11f1d93eda1aa3e61e2d0b8ec.exe	100
PID 1272 wrote to memory of 1276	1272	16c56fc77afa20be0876582725d3748ba06d2ac11f1d93eda1aa3e61e2d0b8ec.exe	101
PID 1272 wrote to memory of 1276	1272	16c56fc77afa20be0876582725d3748ba06d2ac11f1d93eda1aa3e61e2d0b8ec.exe	101
PID 1272 wrote to memory of 4140	1272	16c56fc77afa20be0876582725d3748ba06d2ac11f1d93eda1aa3e61e2d0b8ec.exe	102
PID 1272 wrote to memory of 4140	1272	16c56fc77afa20be0876582725d3748ba06d2ac11f1d93eda1aa3e61e2d0b8ec.exe	102
PID 1272 wrote to memory of 3716	1272	16c56fc77afa20be0876582725d3748ba06d2ac11f1d93eda1aa3e61e2d0b8ec.exe	103
PID 1272 wrote to memory of 3716	1272	16c56fc77afa20be0876582725d3748ba06d2ac11f1d93eda1aa3e61e2d0b8ec.exe	103
PID 1272 wrote to memory of 3804	1272	16c56fc77afa20be0876582725d3748ba06d2ac11f1d93eda1aa3e61e2d0b8ec.exe	104
PID 1272 wrote to memory of 3804	1272	16c56fc77afa20be0876582725d3748ba06d2ac11f1d93eda1aa3e61e2d0b8ec.exe	104
PID 1272 wrote to memory of 2040	1272	16c56fc77afa20be0876582725d3748ba06d2ac11f1d93eda1aa3e61e2d0b8ec.exe	105
PID 1272 wrote to memory of 2040	1272	16c56fc77afa20be0876582725d3748ba06d2ac11f1d93eda1aa3e61e2d0b8ec.exe	105
PID 1272 wrote to memory of 3744	1272	16c56fc77afa20be0876582725d3748ba06d2ac11f1d93eda1aa3e61e2d0b8ec.exe	106
PID 1272 wrote to memory of 3744	1272	16c56fc77afa20be0876582725d3748ba06d2ac11f1d93eda1aa3e61e2d0b8ec.exe	106
PID 1272 wrote to memory of 3388	1272	16c56fc77afa20be0876582725d3748ba06d2ac11f1d93eda1aa3e61e2d0b8ec.exe	107
PID 1272 wrote to memory of 3388	1272	16c56fc77afa20be0876582725d3748ba06d2ac11f1d93eda1aa3e61e2d0b8ec.exe	107
PID 1272 wrote to memory of 1792	1272	16c56fc77afa20be0876582725d3748ba06d2ac11f1d93eda1aa3e61e2d0b8ec.exe	108
PID 1272 wrote to memory of 1792	1272	16c56fc77afa20be0876582725d3748ba06d2ac11f1d93eda1aa3e61e2d0b8ec.exe	108
PID 1272 wrote to memory of 372	1272	16c56fc77afa20be0876582725d3748ba06d2ac11f1d93eda1aa3e61e2d0b8ec.exe	109
PID 1272 wrote to memory of 372	1272	16c56fc77afa20be0876582725d3748ba06d2ac11f1d93eda1aa3e61e2d0b8ec.exe	109
PID 1272 wrote to memory of 2328	1272	16c56fc77afa20be0876582725d3748ba06d2ac11f1d93eda1aa3e61e2d0b8ec.exe	110
PID 1272 wrote to memory of 2328	1272	16c56fc77afa20be0876582725d3748ba06d2ac11f1d93eda1aa3e61e2d0b8ec.exe	110
PID 1272 wrote to memory of 3604	1272	16c56fc77afa20be0876582725d3748ba06d2ac11f1d93eda1aa3e61e2d0b8ec.exe	111
PID 1272 wrote to memory of 3604	1272	16c56fc77afa20be0876582725d3748ba06d2ac11f1d93eda1aa3e61e2d0b8ec.exe	111
PID 1272 wrote to memory of 4528	1272	16c56fc77afa20be0876582725d3748ba06d2ac11f1d93eda1aa3e61e2d0b8ec.exe	112
PID 1272 wrote to memory of 4528	1272	16c56fc77afa20be0876582725d3748ba06d2ac11f1d93eda1aa3e61e2d0b8ec.exe	112
PID 1272 wrote to memory of 4860	1272	16c56fc77afa20be0876582725d3748ba06d2ac11f1d93eda1aa3e61e2d0b8ec.exe	113
PID 1272 wrote to memory of 4860	1272	16c56fc77afa20be0876582725d3748ba06d2ac11f1d93eda1aa3e61e2d0b8ec.exe	113
PID 1272 wrote to memory of 2476	1272	16c56fc77afa20be0876582725d3748ba06d2ac11f1d93eda1aa3e61e2d0b8ec.exe	114
PID 1272 wrote to memory of 2476	1272	16c56fc77afa20be0876582725d3748ba06d2ac11f1d93eda1aa3e61e2d0b8ec.exe	114
PID 1272 wrote to memory of 1592	1272	16c56fc77afa20be0876582725d3748ba06d2ac11f1d93eda1aa3e61e2d0b8ec.exe	115
PID 1272 wrote to memory of 1592	1272	16c56fc77afa20be0876582725d3748ba06d2ac11f1d93eda1aa3e61e2d0b8ec.exe	115

C:\Users\Admin\AppData\Local\Temp\16c56fc77afa20be0876582725d3748ba06d2ac11f1d93eda1aa3e61e2d0b8ec.exe
"C:\Users\Admin\AppData\Local\Temp\16c56fc77afa20be0876582725d3748ba06d2ac11f1d93eda1aa3e61e2d0b8ec.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1272
- C:\Windows\System\YkuOKoh.exe
  C:\Windows\System\YkuOKoh.exe
  2⤵
  - Executes dropped EXE
  PID:2228
- C:\Windows\System\YlHePsD.exe
  C:\Windows\System\YlHePsD.exe
  2⤵
  - Executes dropped EXE
  PID:3672
- C:\Windows\System\UGDnPbk.exe
  C:\Windows\System\UGDnPbk.exe
  2⤵
  - Executes dropped EXE
  PID:2680
- C:\Windows\System\APvdKad.exe
  C:\Windows\System\APvdKad.exe
  2⤵
  - Executes dropped EXE
  PID:1292
- C:\Windows\System\ZviKwof.exe
  C:\Windows\System\ZviKwof.exe
  2⤵
  - Executes dropped EXE
  PID:1208
- C:\Windows\System\TdXubSR.exe
  C:\Windows\System\TdXubSR.exe
  2⤵
  - Executes dropped EXE
  PID:232
- C:\Windows\System\zefgcEx.exe
  C:\Windows\System\zefgcEx.exe
  2⤵
  - Executes dropped EXE
  PID:4420
- C:\Windows\System\rgIYwKh.exe
  C:\Windows\System\rgIYwKh.exe
  2⤵
  - Executes dropped EXE
  PID:2308
- C:\Windows\System\EfWmiMU.exe
  C:\Windows\System\EfWmiMU.exe
  2⤵
  - Executes dropped EXE
  PID:1844
- C:\Windows\System\UywPTnR.exe
  C:\Windows\System\UywPTnR.exe
  2⤵
  - Executes dropped EXE
  PID:1912
- C:\Windows\System\sdoiChj.exe
  C:\Windows\System\sdoiChj.exe
  2⤵
  - Executes dropped EXE
  PID:4432
- C:\Windows\System\CEYZyUi.exe
  C:\Windows\System\CEYZyUi.exe
  2⤵
  - Executes dropped EXE
  PID:692
- C:\Windows\System\TeZYzoW.exe
  C:\Windows\System\TeZYzoW.exe
  2⤵
  - Executes dropped EXE
  PID:4560
- C:\Windows\System\xKCqgHW.exe
  C:\Windows\System\xKCqgHW.exe
  2⤵
  - Executes dropped EXE
  PID:2892
- C:\Windows\System\xprttYk.exe
  C:\Windows\System\xprttYk.exe
  2⤵
  - Executes dropped EXE
  PID:4188
- C:\Windows\System\EQVyXCr.exe
  C:\Windows\System\EQVyXCr.exe
  2⤵
  - Executes dropped EXE
  PID:2260
- C:\Windows\System\RGyyulc.exe
  C:\Windows\System\RGyyulc.exe
  2⤵
  - Executes dropped EXE
  PID:2124
- C:\Windows\System\LesESqA.exe
  C:\Windows\System\LesESqA.exe
  2⤵
  - Executes dropped EXE
  PID:1276
- C:\Windows\System\FYXZedA.exe
  C:\Windows\System\FYXZedA.exe
  2⤵
  - Executes dropped EXE
  PID:4140
- C:\Windows\System\HvniqQn.exe
  C:\Windows\System\HvniqQn.exe
  2⤵
  - Executes dropped EXE
  PID:3716
- C:\Windows\System\TvjrbzY.exe
  C:\Windows\System\TvjrbzY.exe
  2⤵
  - Executes dropped EXE
  PID:3804
- C:\Windows\System\gnWPmmc.exe
  C:\Windows\System\gnWPmmc.exe
  2⤵
  - Executes dropped EXE
  PID:2040
- C:\Windows\System\DjOkngM.exe
  C:\Windows\System\DjOkngM.exe
  2⤵
  - Executes dropped EXE
  PID:3744
- C:\Windows\System\eZJhdDI.exe
  C:\Windows\System\eZJhdDI.exe
  2⤵
  - Executes dropped EXE
  PID:3388
- C:\Windows\System\evfPOhr.exe
  C:\Windows\System\evfPOhr.exe
  2⤵
  - Executes dropped EXE
  PID:1792
- C:\Windows\System\zfRJjcR.exe
  C:\Windows\System\zfRJjcR.exe
  2⤵
  - Executes dropped EXE
  PID:372
- C:\Windows\System\lBdFTpk.exe
  C:\Windows\System\lBdFTpk.exe
  2⤵
  - Executes dropped EXE
  PID:2328
- C:\Windows\System\nQNQmfJ.exe
  C:\Windows\System\nQNQmfJ.exe
  2⤵
  - Executes dropped EXE
  PID:3604
- C:\Windows\System\xtwZkIS.exe
  C:\Windows\System\xtwZkIS.exe
  2⤵
  - Executes dropped EXE
  PID:4528
- C:\Windows\System\hkTcWJj.exe
  C:\Windows\System\hkTcWJj.exe
  2⤵
  - Executes dropped EXE
  PID:4860
- C:\Windows\System\EvlkTcA.exe
  C:\Windows\System\EvlkTcA.exe
  2⤵
  - Executes dropped EXE
  PID:2476
- C:\Windows\System\eGrRShc.exe
  C:\Windows\System\eGrRShc.exe
  2⤵
  - Executes dropped EXE
  PID:1592
- C:\Windows\System\AcCphFC.exe
  C:\Windows\System\AcCphFC.exe
  2⤵
  - Executes dropped EXE
  PID:2036
- C:\Windows\System\wVUGHtY.exe
  C:\Windows\System\wVUGHtY.exe
  2⤵
  - Executes dropped EXE
  PID:4956
- C:\Windows\System\nraMxYq.exe
  C:\Windows\System\nraMxYq.exe
  2⤵
  - Executes dropped EXE
  PID:5028
- C:\Windows\System\CckqvXj.exe
  C:\Windows\System\CckqvXj.exe
  2⤵
  - Executes dropped EXE
  PID:1904
- C:\Windows\System\qowkiPF.exe
  C:\Windows\System\qowkiPF.exe
  2⤵
  - Executes dropped EXE
  PID:3936
- C:\Windows\System\djEaqbi.exe
  C:\Windows\System\djEaqbi.exe
  2⤵
  - Executes dropped EXE
  PID:1284
- C:\Windows\System\OCePKMi.exe
  C:\Windows\System\OCePKMi.exe
  2⤵
  - Executes dropped EXE
  PID:3820
- C:\Windows\System\UnzEkdI.exe
  C:\Windows\System\UnzEkdI.exe
  2⤵
  - Executes dropped EXE
  PID:2292
- C:\Windows\System\aPWBeFd.exe
  C:\Windows\System\aPWBeFd.exe
  2⤵
  - Executes dropped EXE
  PID:3260
- C:\Windows\System\pmYVNTH.exe
  C:\Windows\System\pmYVNTH.exe
  2⤵
  - Executes dropped EXE
  PID:3280
- C:\Windows\System\gyKuVDe.exe
  C:\Windows\System\gyKuVDe.exe
  2⤵
  - Executes dropped EXE
  PID:704
- C:\Windows\System\mZihfRB.exe
  C:\Windows\System\mZihfRB.exe
  2⤵
  - Executes dropped EXE
  PID:4880
- C:\Windows\System\njSWoWJ.exe
  C:\Windows\System\njSWoWJ.exe
  2⤵
  - Executes dropped EXE
  PID:5064
- C:\Windows\System\JpiEICK.exe
  C:\Windows\System\JpiEICK.exe
  2⤵
  - Executes dropped EXE
  PID:4964
- C:\Windows\System\AmgbSrb.exe
  C:\Windows\System\AmgbSrb.exe
  2⤵
  - Executes dropped EXE
  PID:884
- C:\Windows\System\mEZmEYY.exe
  C:\Windows\System\mEZmEYY.exe
  2⤵
  - Executes dropped EXE
  PID:2844
- C:\Windows\System\ojZtmYs.exe
  C:\Windows\System\ojZtmYs.exe
  2⤵
  - Executes dropped EXE
  PID:2992
- C:\Windows\System\Mkcwoln.exe
  C:\Windows\System\Mkcwoln.exe
  2⤵
  - Executes dropped EXE
  PID:3332
- C:\Windows\System\KYSFsYN.exe
  C:\Windows\System\KYSFsYN.exe
  2⤵
  - Executes dropped EXE
  PID:1436
- C:\Windows\System\OqZWtrW.exe
  C:\Windows\System\OqZWtrW.exe
  2⤵
  - Executes dropped EXE
  PID:4404
- C:\Windows\System\tzMZPZc.exe
  C:\Windows\System\tzMZPZc.exe
  2⤵
  - Executes dropped EXE
  PID:4388
- C:\Windows\System\GiOguNh.exe
  C:\Windows\System\GiOguNh.exe
  2⤵
  - Executes dropped EXE
  PID:2952
- C:\Windows\System\xjxrHlo.exe
  C:\Windows\System\xjxrHlo.exe
  2⤵
  - Executes dropped EXE
  PID:4896
- C:\Windows\System\EVbwnUi.exe
  C:\Windows\System\EVbwnUi.exe
  2⤵
  - Executes dropped EXE
  PID:760
- C:\Windows\System\qVpoehN.exe
  C:\Windows\System\qVpoehN.exe
  2⤵
  - Executes dropped EXE
  PID:3464
- C:\Windows\System\XeyzVuY.exe
  C:\Windows\System\XeyzVuY.exe
  2⤵
  - Executes dropped EXE
  PID:1620
- C:\Windows\System\sERlzug.exe
  C:\Windows\System\sERlzug.exe
  2⤵
  - Executes dropped EXE
  PID:4572
- C:\Windows\System\NLdGKSJ.exe
  C:\Windows\System\NLdGKSJ.exe
  2⤵
  - Executes dropped EXE
  PID:4884
- C:\Windows\System\ugzmErO.exe
  C:\Windows\System\ugzmErO.exe
  2⤵
  - Executes dropped EXE
  PID:2900
- C:\Windows\System\KfgaoRa.exe
  C:\Windows\System\KfgaoRa.exe
  2⤵
  - Executes dropped EXE
  PID:3536
- C:\Windows\System\qaFXpZd.exe
  C:\Windows\System\qaFXpZd.exe
  2⤵
  - Executes dropped EXE
  PID:3112
- C:\Windows\System\ZZOWFGv.exe
  C:\Windows\System\ZZOWFGv.exe
  2⤵
  - Executes dropped EXE
  PID:4584
- C:\Windows\System\LXzCyOe.exe
  C:\Windows\System\LXzCyOe.exe
  2⤵
  PID:5012
- C:\Windows\System\LKQBHIW.exe
  C:\Windows\System\LKQBHIW.exe
  2⤵
  PID:5052
- C:\Windows\System\ZtAsdBg.exe
  C:\Windows\System\ZtAsdBg.exe
  2⤵
  PID:3252
- C:\Windows\System\EdxTqwJ.exe
  C:\Windows\System\EdxTqwJ.exe
  2⤵
  PID:2944
- C:\Windows\System\psgYwek.exe
  C:\Windows\System\psgYwek.exe
  2⤵
  PID:1728
- C:\Windows\System\oRVCdNK.exe
  C:\Windows\System\oRVCdNK.exe
  2⤵
  PID:3652
- C:\Windows\System\HIMlKMR.exe
  C:\Windows\System\HIMlKMR.exe
  2⤵
  PID:5072
- C:\Windows\System\GMTkDHy.exe
  C:\Windows\System\GMTkDHy.exe
  2⤵
  PID:4088
- C:\Windows\System\VkXdtsB.exe
  C:\Windows\System\VkXdtsB.exe
  2⤵
  PID:2728
- C:\Windows\System\ywkzgsj.exe
  C:\Windows\System\ywkzgsj.exe
  2⤵
  PID:2652
- C:\Windows\System\RPDtYmy.exe
  C:\Windows\System\RPDtYmy.exe
  2⤵
  PID:764
- C:\Windows\System\YpWPZUx.exe
  C:\Windows\System\YpWPZUx.exe
  2⤵
  PID:316
- C:\Windows\System\lBZfidB.exe
  C:\Windows\System\lBZfidB.exe
  2⤵
  PID:3096
- C:\Windows\System\XxvXILW.exe
  C:\Windows\System\XxvXILW.exe
  2⤵
  PID:2232
- C:\Windows\System\FmjPZEy.exe
  C:\Windows\System\FmjPZEy.exe
  2⤵
  PID:1524
- C:\Windows\System\AxVPYcc.exe
  C:\Windows\System\AxVPYcc.exe
  2⤵
  PID:112
- C:\Windows\System\cjAGKtp.exe
  C:\Windows\System\cjAGKtp.exe
  2⤵
  PID:2532
- C:\Windows\System\lQFBpwW.exe
  C:\Windows\System\lQFBpwW.exe
  2⤵
  PID:1084
- C:\Windows\System\jeKYkjg.exe
  C:\Windows\System\jeKYkjg.exe
  2⤵
  PID:2536
- C:\Windows\System\OHFrwdl.exe
  C:\Windows\System\OHFrwdl.exe
  2⤵
  PID:3628
- C:\Windows\System\mcswUKC.exe
  C:\Windows\System\mcswUKC.exe
  2⤵
  PID:1984
- C:\Windows\System\mnRrrXt.exe
  C:\Windows\System\mnRrrXt.exe
  2⤵
  PID:4048
- C:\Windows\System\pTqyCjI.exe
  C:\Windows\System\pTqyCjI.exe
  2⤵
  PID:2708
- C:\Windows\System\YuEqmuU.exe
  C:\Windows\System\YuEqmuU.exe
  2⤵
  PID:4548
- C:\Windows\System\YWfTikx.exe
  C:\Windows\System\YWfTikx.exe
  2⤵
  PID:544
- C:\Windows\System\OwGgzUK.exe
  C:\Windows\System\OwGgzUK.exe
  2⤵
  PID:2296
- C:\Windows\System\WZpqAlW.exe
  C:\Windows\System\WZpqAlW.exe
  2⤵
  PID:1772
- C:\Windows\System\XjGINKx.exe
  C:\Windows\System\XjGINKx.exe
  2⤵
  PID:4464
- C:\Windows\System\bCHBeyq.exe
  C:\Windows\System\bCHBeyq.exe
  2⤵
  PID:212
- C:\Windows\System\iBbfnwT.exe
  C:\Windows\System\iBbfnwT.exe
  2⤵
  PID:2724
- C:\Windows\System\JNuOuhx.exe
  C:\Windows\System\JNuOuhx.exe
  2⤵
  PID:1924
- C:\Windows\System\JbGdkML.exe
  C:\Windows\System\JbGdkML.exe
  2⤵
  PID:2224
- C:\Windows\System\yPInGIh.exe
  C:\Windows\System\yPInGIh.exe
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:4520
- C:\Windows\System\AzHBJXq.exe
  C:\Windows\System\AzHBJXq.exe
  2⤵
  PID:2412
- C:\Windows\System\lbYoRTo.exe
  C:\Windows\System\lbYoRTo.exe
  2⤵
  PID:4684
- C:\Windows\System\iGjHspt.exe
  C:\Windows\System\iGjHspt.exe
  2⤵
  PID:588
- C:\Windows\System\KYGvmpL.exe
  C:\Windows\System\KYGvmpL.exe
  2⤵
  PID:4124
- C:\Windows\System\eSnUVgR.exe
  C:\Windows\System\eSnUVgR.exe
  2⤵
  PID:1992
- C:\Windows\System\kOWUnLd.exe
  C:\Windows\System\kOWUnLd.exe
  2⤵
  PID:3440
- C:\Windows\System\oUsfxMw.exe
  C:\Windows\System\oUsfxMw.exe
  2⤵
  PID:3432
- C:\Windows\System\FaxkBMd.exe
  C:\Windows\System\FaxkBMd.exe
  2⤵
  PID:1036
- C:\Windows\System\zDkDiYq.exe
  C:\Windows\System\zDkDiYq.exe
  2⤵
  PID:4016
- C:\Windows\System\PzSHXkZ.exe
  C:\Windows\System\PzSHXkZ.exe
  2⤵
  PID:3148
- C:\Windows\System\efOQBcX.exe
  C:\Windows\System\efOQBcX.exe
  2⤵
  PID:4544
- C:\Windows\System\CLPcFoK.exe
  C:\Windows\System\CLPcFoK.exe
  2⤵
  PID:2072
- C:\Windows\System\lKOeYJF.exe
  C:\Windows\System\lKOeYJF.exe
  2⤵
  PID:4220
- C:\Windows\System\EElfTwu.exe
  C:\Windows\System\EElfTwu.exe
  2⤵
  PID:4592
- C:\Windows\System\pnlkSKL.exe
  C:\Windows\System\pnlkSKL.exe
  2⤵
  PID:1664
- C:\Windows\System\rIgMmZD.exe
  C:\Windows\System\rIgMmZD.exe
  2⤵
  PID:844
- C:\Windows\System\PbKrZZb.exe
  C:\Windows\System\PbKrZZb.exe
  2⤵
  PID:3288
- C:\Windows\System\mnGgvIP.exe
  C:\Windows\System\mnGgvIP.exe
  2⤵
  PID:3524
- C:\Windows\System\JaHxvxR.exe
  C:\Windows\System\JaHxvxR.exe
  2⤵
  PID:4488
- C:\Windows\System\jvEkANz.exe
  C:\Windows\System\jvEkANz.exe
  2⤵
  PID:2488
- C:\Windows\System\QWWyxrD.exe
  C:\Windows\System\QWWyxrD.exe
  2⤵
  PID:5156
- C:\Windows\System\xYIZcCF.exe
  C:\Windows\System\xYIZcCF.exe
  2⤵
  PID:5184
- C:\Windows\System\TwcAaMY.exe
  C:\Windows\System\TwcAaMY.exe
  2⤵
  PID:5212
- C:\Windows\System\iuXkdia.exe
  C:\Windows\System\iuXkdia.exe
  2⤵
  PID:5232
- C:\Windows\System\htvnVDF.exe
  C:\Windows\System\htvnVDF.exe
  2⤵
  PID:5256
- C:\Windows\System\sXFQIxm.exe
  C:\Windows\System\sXFQIxm.exe
  2⤵
  PID:5292
- C:\Windows\System\TXYegbk.exe
  C:\Windows\System\TXYegbk.exe
  2⤵
  PID:5312
- C:\Windows\System\lxIFHIB.exe
  C:\Windows\System\lxIFHIB.exe
  2⤵
  PID:5340
- C:\Windows\System\cyylICW.exe
  C:\Windows\System\cyylICW.exe
  2⤵
  PID:5380
- C:\Windows\System\ooPbVOA.exe
  C:\Windows\System\ooPbVOA.exe
  2⤵
  PID:5396
- C:\Windows\System\vlMcbFa.exe
  C:\Windows\System\vlMcbFa.exe
  2⤵
  PID:5424
- C:\Windows\System\hbJjQSa.exe
  C:\Windows\System\hbJjQSa.exe
  2⤵
  PID:5448
- C:\Windows\System\sYQkcgz.exe
  C:\Windows\System\sYQkcgz.exe
  2⤵
  PID:5476
- C:\Windows\System\wZjHimF.exe
  C:\Windows\System\wZjHimF.exe
  2⤵
  PID:5508
- C:\Windows\System\QWYWlqs.exe
  C:\Windows\System\QWYWlqs.exe
  2⤵
  PID:5536
- C:\Windows\System\ALxwING.exe
  C:\Windows\System\ALxwING.exe
  2⤵
  PID:5572
- C:\Windows\System\xjhxJSb.exe
  C:\Windows\System\xjhxJSb.exe
  2⤵
  PID:5592
- C:\Windows\System\LKXeOGs.exe
  C:\Windows\System\LKXeOGs.exe
  2⤵
  PID:5620
- C:\Windows\System\vChjiXJ.exe
  C:\Windows\System\vChjiXJ.exe
  2⤵
  PID:5656
- C:\Windows\System\FtJUHtx.exe
  C:\Windows\System\FtJUHtx.exe
  2⤵
  PID:5672
- C:\Windows\System\vAXnyKa.exe
  C:\Windows\System\vAXnyKa.exe
  2⤵
  PID:5692
- C:\Windows\System\PyWzKON.exe
  C:\Windows\System\PyWzKON.exe
  2⤵
  PID:5720
- C:\Windows\System\aRibLGL.exe
  C:\Windows\System\aRibLGL.exe
  2⤵
  PID:5748
- C:\Windows\System\GlYlBVk.exe
  C:\Windows\System\GlYlBVk.exe
  2⤵
  PID:5772
- C:\Windows\System\RgWRPcp.exe
  C:\Windows\System\RgWRPcp.exe
  2⤵
  PID:5800
- C:\Windows\System\ZfoxSda.exe
  C:\Windows\System\ZfoxSda.exe
  2⤵
  PID:5832
- C:\Windows\System\OoNKRpr.exe
  C:\Windows\System\OoNKRpr.exe
  2⤵
  PID:5864
- C:\Windows\System\wjnHnnp.exe
  C:\Windows\System\wjnHnnp.exe
  2⤵
  PID:5892
- C:\Windows\System\yQoIfto.exe
  C:\Windows\System\yQoIfto.exe
  2⤵
  PID:5928
- C:\Windows\System\USbyigi.exe
  C:\Windows\System\USbyigi.exe
  2⤵
  PID:5956
- C:\Windows\System\JLTMXjm.exe
  C:\Windows\System\JLTMXjm.exe
  2⤵
  PID:5984
- C:\Windows\System\HTnQhZO.exe
  C:\Windows\System\HTnQhZO.exe
  2⤵
  PID:6016
- C:\Windows\System\sHVfbaq.exe
  C:\Windows\System\sHVfbaq.exe
  2⤵
  PID:6052
- C:\Windows\System\rPbganw.exe
  C:\Windows\System\rPbganw.exe
  2⤵
  PID:6068
- C:\Windows\System\thStvIJ.exe
  C:\Windows\System\thStvIJ.exe
  2⤵
  PID:6092
- C:\Windows\System\fBjcFQR.exe
  C:\Windows\System\fBjcFQR.exe
  2⤵
  PID:6116
- C:\Windows\System\fGyhrxp.exe
  C:\Windows\System\fGyhrxp.exe
  2⤵
  PID:5136
- C:\Windows\System\dStOtkt.exe
  C:\Windows\System\dStOtkt.exe
  2⤵
  PID:5200
- C:\Windows\System\HVjQTGk.exe
  C:\Windows\System\HVjQTGk.exe
  2⤵
  PID:5268
- C:\Windows\System\cAGLbNI.exe
  C:\Windows\System\cAGLbNI.exe
  2⤵
  PID:5324
- C:\Windows\System\SakpDQb.exe
  C:\Windows\System\SakpDQb.exe
  2⤵
  PID:5416
- C:\Windows\System\STFQjMi.exe
  C:\Windows\System\STFQjMi.exe
  2⤵
  PID:5492
- C:\Windows\System\SOwMqSL.exe
  C:\Windows\System\SOwMqSL.exe
  2⤵
  PID:5564
- C:\Windows\System\AXSaZRL.exe
  C:\Windows\System\AXSaZRL.exe
  2⤵
  PID:5616
- C:\Windows\System\uSgmIFR.exe
  C:\Windows\System\uSgmIFR.exe
  2⤵
  PID:5668
- C:\Windows\System\OUVPZek.exe
  C:\Windows\System\OUVPZek.exe
  2⤵
  PID:5784
- C:\Windows\System\XzPNMMa.exe
  C:\Windows\System\XzPNMMa.exe
  2⤵
  PID:5792
- C:\Windows\System\UpKgSHl.exe
  C:\Windows\System\UpKgSHl.exe
  2⤵
  PID:5876
- C:\Windows\System\zxHeDVv.exe
  C:\Windows\System\zxHeDVv.exe
  2⤵
  PID:5948
- C:\Windows\System\SNYSDkc.exe
  C:\Windows\System\SNYSDkc.exe
  2⤵
  PID:5980
- C:\Windows\System\yGAlXeJ.exe
  C:\Windows\System\yGAlXeJ.exe
  2⤵
  PID:6060
- C:\Windows\System\nxSkhsg.exe
  C:\Windows\System\nxSkhsg.exe
  2⤵
  PID:6104
- C:\Windows\System\qSjDzxx.exe
  C:\Windows\System\qSjDzxx.exe
  2⤵
  PID:5308
- C:\Windows\System\VlUOVsB.exe
  C:\Windows\System\VlUOVsB.exe
  2⤵
  PID:5280
- C:\Windows\System\xVQsdwB.exe
  C:\Windows\System\xVQsdwB.exe
  2⤵
  PID:5488
- C:\Windows\System\AwcZHjj.exe
  C:\Windows\System\AwcZHjj.exe
  2⤵
  PID:5632
- C:\Windows\System\JjjYOlY.exe
  C:\Windows\System\JjjYOlY.exe
  2⤵
  PID:5736
- C:\Windows\System\hkrkeCU.exe
  C:\Windows\System\hkrkeCU.exe
  2⤵
  PID:5972
- C:\Windows\System\XlIVfTy.exe
  C:\Windows\System\XlIVfTy.exe
  2⤵
  PID:5180
- C:\Windows\System\HgEvFDk.exe
  C:\Windows\System\HgEvFDk.exe
  2⤵
  PID:5440
- C:\Windows\System\BkjeFtd.exe
  C:\Windows\System\BkjeFtd.exe
  2⤵
  PID:5172
- C:\Windows\System\ksNmDSD.exe
  C:\Windows\System\ksNmDSD.exe
  2⤵
  PID:5820
- C:\Windows\System\oueZAMn.exe
  C:\Windows\System\oueZAMn.exe
  2⤵
  PID:6160
- C:\Windows\System\vZTBJAe.exe
  C:\Windows\System\vZTBJAe.exe
  2⤵
  PID:6176
- C:\Windows\System\aFTQqyN.exe
  C:\Windows\System\aFTQqyN.exe
  2⤵
  PID:6192
- C:\Windows\System\mCcsgJs.exe
  C:\Windows\System\mCcsgJs.exe
  2⤵
  PID:6216
- C:\Windows\System\dYviJhr.exe
  C:\Windows\System\dYviJhr.exe
  2⤵
  PID:6236
- C:\Windows\System\vvudyBy.exe
  C:\Windows\System\vvudyBy.exe
  2⤵
  PID:6260
- C:\Windows\System\VXqtmbA.exe
  C:\Windows\System\VXqtmbA.exe
  2⤵
  PID:6284
- C:\Windows\System\GjkpVAe.exe
  C:\Windows\System\GjkpVAe.exe
  2⤵
  PID:6324
- C:\Windows\System\hnwbpCT.exe
  C:\Windows\System\hnwbpCT.exe
  2⤵
  PID:6352
- C:\Windows\System\awIDGQt.exe
  C:\Windows\System\awIDGQt.exe
  2⤵
  PID:6384
- C:\Windows\System\yBRQWdO.exe
  C:\Windows\System\yBRQWdO.exe
  2⤵
  PID:6404
- C:\Windows\System\pWnwsmi.exe
  C:\Windows\System\pWnwsmi.exe
  2⤵
  PID:6432
- C:\Windows\System\XvOYVTj.exe
  C:\Windows\System\XvOYVTj.exe
  2⤵
  PID:6464
- C:\Windows\System\fKcxoEu.exe
  C:\Windows\System\fKcxoEu.exe
  2⤵
  PID:6492
- C:\Windows\System\HYjNBbM.exe
  C:\Windows\System\HYjNBbM.exe
  2⤵
  PID:6532
- C:\Windows\System\WrWagzo.exe
  C:\Windows\System\WrWagzo.exe
  2⤵
  PID:6564
- C:\Windows\System\hfNCpPi.exe
  C:\Windows\System\hfNCpPi.exe
  2⤵
  PID:6596
- C:\Windows\System\NPdroOV.exe
  C:\Windows\System\NPdroOV.exe
  2⤵
  PID:6636
- C:\Windows\System\mupSPRi.exe
  C:\Windows\System\mupSPRi.exe
  2⤵
  PID:6660
- C:\Windows\System\kowcgGy.exe
  C:\Windows\System\kowcgGy.exe
  2⤵
  PID:6700
- C:\Windows\System\yBXxefI.exe
  C:\Windows\System\yBXxefI.exe
  2⤵
  PID:6724
- C:\Windows\System\CNVRDcc.exe
  C:\Windows\System\CNVRDcc.exe
  2⤵
  PID:6756
- C:\Windows\System\JWKVzrb.exe
  C:\Windows\System\JWKVzrb.exe
  2⤵
  PID:6780
- C:\Windows\System\wfUAgyW.exe
  C:\Windows\System\wfUAgyW.exe
  2⤵
  PID:6804
- C:\Windows\System\AIqvKqV.exe
  C:\Windows\System\AIqvKqV.exe
  2⤵
  PID:6836
- C:\Windows\System\ZoWpZJA.exe
  C:\Windows\System\ZoWpZJA.exe
  2⤵
  PID:6856
- C:\Windows\System\fverQDn.exe
  C:\Windows\System\fverQDn.exe
  2⤵
  PID:6892
- C:\Windows\System\GAjgGwC.exe
  C:\Windows\System\GAjgGwC.exe
  2⤵
  PID:6920
- C:\Windows\System\PIfsHqn.exe
  C:\Windows\System\PIfsHqn.exe
  2⤵
  PID:6960
- C:\Windows\System\nffFXyA.exe
  C:\Windows\System\nffFXyA.exe
  2⤵
  PID:6980
- C:\Windows\System\NWnxeXQ.exe
  C:\Windows\System\NWnxeXQ.exe
  2⤵
  PID:7004
- C:\Windows\System\PvYjYsQ.exe
  C:\Windows\System\PvYjYsQ.exe
  2⤵
  PID:7040
- C:\Windows\System\AnPmBDG.exe
  C:\Windows\System\AnPmBDG.exe
  2⤵
  PID:7060
- C:\Windows\System\XMmiKYi.exe
  C:\Windows\System\XMmiKYi.exe
  2⤵
  PID:7088
- C:\Windows\System\KqDjtCh.exe
  C:\Windows\System\KqDjtCh.exe
  2⤵
  PID:7116
- C:\Windows\System\BKNjphr.exe
  C:\Windows\System\BKNjphr.exe
  2⤵
  PID:7148
- C:\Windows\System\YqnLliX.exe
  C:\Windows\System\YqnLliX.exe
  2⤵
  PID:6152
- C:\Windows\System\yThBdJp.exe
  C:\Windows\System\yThBdJp.exe
  2⤵
  PID:6212
- C:\Windows\System\GOxoExU.exe
  C:\Windows\System\GOxoExU.exe
  2⤵
  PID:6244
- C:\Windows\System\iaLBfDt.exe
  C:\Windows\System\iaLBfDt.exe
  2⤵
  PID:6280
- C:\Windows\System\XuiCzoe.exe
  C:\Windows\System\XuiCzoe.exe
  2⤵
  PID:6396
- C:\Windows\System\iLYQNnS.exe
  C:\Windows\System\iLYQNnS.exe
  2⤵
  PID:6508
- C:\Windows\System\qqSFcpu.exe
  C:\Windows\System\qqSFcpu.exe
  2⤵
  PID:6448
- C:\Windows\System\oNlPjUS.exe
  C:\Windows\System\oNlPjUS.exe
  2⤵
  PID:6584
- C:\Windows\System\RXCaZwU.exe
  C:\Windows\System\RXCaZwU.exe
  2⤵
  PID:6608
- C:\Windows\System\PmmqyTA.exe
  C:\Windows\System\PmmqyTA.exe
  2⤵
  PID:6716
- C:\Windows\System\qzwejmJ.exe
  C:\Windows\System\qzwejmJ.exe
  2⤵
  PID:6788
- C:\Windows\System\cGpkJsF.exe
  C:\Windows\System\cGpkJsF.exe
  2⤵
  PID:6852
- C:\Windows\System\XYcnROV.exe
  C:\Windows\System\XYcnROV.exe
  2⤵
  PID:6900
- C:\Windows\System\IMZgeNY.exe
  C:\Windows\System\IMZgeNY.exe
  2⤵
  PID:6908
- C:\Windows\System\AbMJSdA.exe
  C:\Windows\System\AbMJSdA.exe
  2⤵
  PID:6996
- C:\Windows\System\cdvhUmS.exe
  C:\Windows\System\cdvhUmS.exe
  2⤵
  PID:7112
- C:\Windows\System\LmvuIEv.exe
  C:\Windows\System\LmvuIEv.exe
  2⤵
  PID:5468
- C:\Windows\System\WfYJMaj.exe
  C:\Windows\System\WfYJMaj.exe
  2⤵
  PID:7160
- C:\Windows\System\kfJXVeq.exe
  C:\Windows\System\kfJXVeq.exe
  2⤵
  PID:6376
- C:\Windows\System\khOYzQW.exe
  C:\Windows\System\khOYzQW.exe
  2⤵
  PID:6500
- C:\Windows\System\dnTkgKa.exe
  C:\Windows\System\dnTkgKa.exe
  2⤵
  PID:6592
- C:\Windows\System\gHjVUVW.exe
  C:\Windows\System\gHjVUVW.exe
  2⤵
  PID:6820
- C:\Windows\System\WAVOpHq.exe
  C:\Windows\System\WAVOpHq.exe
  2⤵
  PID:7000
- C:\Windows\System\FNixPVF.exe
  C:\Windows\System\FNixPVF.exe
  2⤵
  PID:6184
- C:\Windows\System\CYaUZwP.exe
  C:\Windows\System\CYaUZwP.exe
  2⤵
  PID:6084
- C:\Windows\System\uAVXCTt.exe
  C:\Windows\System\uAVXCTt.exe
  2⤵
  PID:6440
- C:\Windows\System\RmbLKMz.exe
  C:\Windows\System\RmbLKMz.exe
  2⤵
  PID:6944
- C:\Windows\System\QOPKTdA.exe
  C:\Windows\System\QOPKTdA.exe
  2⤵
  PID:6976
- C:\Windows\System\HKrRTgh.exe
  C:\Windows\System\HKrRTgh.exe
  2⤵
  PID:7188
- C:\Windows\System\ecplGmr.exe
  C:\Windows\System\ecplGmr.exe
  2⤵
  PID:7216
- C:\Windows\System\UQFrFLK.exe
  C:\Windows\System\UQFrFLK.exe
  2⤵
  PID:7252
- C:\Windows\System\qvhTyCD.exe
  C:\Windows\System\qvhTyCD.exe
  2⤵
  PID:7288
- C:\Windows\System\xRmgxgD.exe
  C:\Windows\System\xRmgxgD.exe
  2⤵
  PID:7312
- C:\Windows\System\wjzrVtO.exe
  C:\Windows\System\wjzrVtO.exe
  2⤵
  PID:7332
- C:\Windows\System\YpFmaGR.exe
  C:\Windows\System\YpFmaGR.exe
  2⤵
  PID:7360
- C:\Windows\System\KhiBqvy.exe
  C:\Windows\System\KhiBqvy.exe
  2⤵
  PID:7396
- C:\Windows\System\XSNcMjR.exe
  C:\Windows\System\XSNcMjR.exe
  2⤵
  PID:7424
- C:\Windows\System\CFcnmMe.exe
  C:\Windows\System\CFcnmMe.exe
  2⤵
  PID:7452
- C:\Windows\System\trGsXRw.exe
  C:\Windows\System\trGsXRw.exe
  2⤵
  PID:7480
- C:\Windows\System\HYrZkzU.exe
  C:\Windows\System\HYrZkzU.exe
  2⤵
  PID:7508
- C:\Windows\System\RHrrAhl.exe
  C:\Windows\System\RHrrAhl.exe
  2⤵
  PID:7536
- C:\Windows\System\uBsvzDA.exe
  C:\Windows\System\uBsvzDA.exe
  2⤵
  PID:7564
- C:\Windows\System\omJwxqz.exe
  C:\Windows\System\omJwxqz.exe
  2⤵
  PID:7592
- C:\Windows\System\VicumzX.exe
  C:\Windows\System\VicumzX.exe
  2⤵
  PID:7624
- C:\Windows\System\dIfqDRT.exe
  C:\Windows\System\dIfqDRT.exe
  2⤵
  PID:7652
- C:\Windows\System\QtIogsV.exe
  C:\Windows\System\QtIogsV.exe
  2⤵
  PID:7684
- C:\Windows\System\HQrzvVh.exe
  C:\Windows\System\HQrzvVh.exe
  2⤵
  PID:7708
- C:\Windows\System\cBNbtPz.exe
  C:\Windows\System\cBNbtPz.exe
  2⤵
  PID:7728
- C:\Windows\System\oajFRbB.exe
  C:\Windows\System\oajFRbB.exe
  2⤵
  PID:7756
- C:\Windows\System\ztBtdJm.exe
  C:\Windows\System\ztBtdJm.exe
  2⤵
  PID:7784
- C:\Windows\System\mRHhtMo.exe
  C:\Windows\System\mRHhtMo.exe
  2⤵
  PID:7816
- C:\Windows\System\KGRvnqj.exe
  C:\Windows\System\KGRvnqj.exe
  2⤵
  PID:7848
- C:\Windows\System\uUgAPfd.exe
  C:\Windows\System\uUgAPfd.exe
  2⤵
  PID:7868
- C:\Windows\System\erXYwhp.exe
  C:\Windows\System\erXYwhp.exe
  2⤵
  PID:7900
- C:\Windows\System\qhGyDUQ.exe
  C:\Windows\System\qhGyDUQ.exe
  2⤵
  PID:7932
- C:\Windows\System\ncLXwRl.exe
  C:\Windows\System\ncLXwRl.exe
  2⤵
  PID:7956
- C:\Windows\System\ladhMXI.exe
  C:\Windows\System\ladhMXI.exe
  2⤵
  PID:7992
- C:\Windows\System\vjxzBDu.exe
  C:\Windows\System\vjxzBDu.exe
  2⤵
  PID:8016
- C:\Windows\System\plFlJYp.exe
  C:\Windows\System\plFlJYp.exe
  2⤵
  PID:8056
- C:\Windows\System\JCbfWJk.exe
  C:\Windows\System\JCbfWJk.exe
  2⤵
  PID:8084
- C:\Windows\System\YDsxVQd.exe
  C:\Windows\System\YDsxVQd.exe
  2⤵
  PID:8108
- C:\Windows\System\geUnIKX.exe
  C:\Windows\System\geUnIKX.exe
  2⤵
  PID:8140
- C:\Windows\System\EVeoZbX.exe
  C:\Windows\System\EVeoZbX.exe
  2⤵
  PID:8172
- C:\Windows\System\QNhfmot.exe
  C:\Windows\System\QNhfmot.exe
  2⤵
  PID:7180
- C:\Windows\System\xpQYWDu.exe
  C:\Windows\System\xpQYWDu.exe
  2⤵
  PID:7236
- C:\Windows\System\hdUbzUg.exe
  C:\Windows\System\hdUbzUg.exe
  2⤵
  PID:7304
- C:\Windows\System\XELXloN.exe
  C:\Windows\System\XELXloN.exe
  2⤵
  PID:7320
- C:\Windows\System\hbJmAhy.exe
  C:\Windows\System\hbJmAhy.exe
  2⤵
  PID:7408
- C:\Windows\System\HwmbRrv.exe
  C:\Windows\System\HwmbRrv.exe
  2⤵
  PID:7492
- C:\Windows\System\mIBMOkO.exe
  C:\Windows\System\mIBMOkO.exe
  2⤵
  PID:7556
- C:\Windows\System\zrFJjcA.exe
  C:\Windows\System\zrFJjcA.exe
  2⤵
  PID:7636
- C:\Windows\System\uKWPICw.exe
  C:\Windows\System\uKWPICw.exe
  2⤵
  PID:7664
- C:\Windows\System\uNmajmS.exe
  C:\Windows\System\uNmajmS.exe
  2⤵
  PID:7772
- C:\Windows\System\JoLCWnk.exe
  C:\Windows\System\JoLCWnk.exe
  2⤵
  PID:7792
- C:\Windows\System\ZycRRXC.exe
  C:\Windows\System\ZycRRXC.exe
  2⤵
  PID:7860
- C:\Windows\System\RfJoxDv.exe
  C:\Windows\System\RfJoxDv.exe
  2⤵
  PID:7952
- C:\Windows\System\jUKdcIY.exe
  C:\Windows\System\jUKdcIY.exe
  2⤵
  PID:7972
- C:\Windows\System\idMLTCp.exe
  C:\Windows\System\idMLTCp.exe
  2⤵
  PID:8072
- C:\Windows\System\iRyQHSc.exe
  C:\Windows\System\iRyQHSc.exe
  2⤵
  PID:8124
- C:\Windows\System\bkywHev.exe
  C:\Windows\System\bkywHev.exe
  2⤵
  PID:8180
- C:\Windows\System\RoNRhxu.exe
  C:\Windows\System\RoNRhxu.exe
  2⤵
  PID:7268
- C:\Windows\System\lJzuZFx.exe
  C:\Windows\System\lJzuZFx.exe
  2⤵
  PID:7520
- C:\Windows\System\QVKtqLQ.exe
  C:\Windows\System\QVKtqLQ.exe
  2⤵
  PID:7700
- C:\Windows\System\COydavp.exe
  C:\Windows\System\COydavp.exe
  2⤵
  PID:7796
- C:\Windows\System\WcwRgWi.exe
  C:\Windows\System\WcwRgWi.exe
  2⤵
  PID:7924
- C:\Windows\System\WYOPimq.exe
  C:\Windows\System\WYOPimq.exe
  2⤵
  PID:8120
- C:\Windows\System\awRhTSP.exe
  C:\Windows\System\awRhTSP.exe
  2⤵
  PID:7228
- C:\Windows\System\aRSvKzW.exe
  C:\Windows\System\aRSvKzW.exe
  2⤵
  PID:7720
- C:\Windows\System\IBnSGEQ.exe
  C:\Windows\System\IBnSGEQ.exe
  2⤵
  PID:7280
- C:\Windows\System\qYzAtwF.exe
  C:\Windows\System\qYzAtwF.exe
  2⤵
  PID:7912
- C:\Windows\System\eyrWnuK.exe
  C:\Windows\System\eyrWnuK.exe
  2⤵
  PID:8196
- C:\Windows\System\aRQNTPj.exe
  C:\Windows\System\aRQNTPj.exe
  2⤵
  PID:8252
- C:\Windows\System\rBcGwXB.exe
  C:\Windows\System\rBcGwXB.exe
  2⤵
  PID:8272
- C:\Windows\System\atjjbgF.exe
  C:\Windows\System\atjjbgF.exe
  2⤵
  PID:8296
- C:\Windows\System\CjpvGyu.exe
  C:\Windows\System\CjpvGyu.exe
  2⤵
  PID:8324
- C:\Windows\System\zorHSoY.exe
  C:\Windows\System\zorHSoY.exe
  2⤵
  PID:8352
- C:\Windows\System\HAQUEoV.exe
  C:\Windows\System\HAQUEoV.exe
  2⤵
  PID:8368
- C:\Windows\System\RGUVHLc.exe
  C:\Windows\System\RGUVHLc.exe
  2⤵
  PID:8388
- C:\Windows\System\gGrWvGq.exe
  C:\Windows\System\gGrWvGq.exe
  2⤵
  PID:8420
- C:\Windows\System\YlwLUtA.exe
  C:\Windows\System\YlwLUtA.exe
  2⤵
  PID:8448
- C:\Windows\System\VlwyZxu.exe
  C:\Windows\System\VlwyZxu.exe
  2⤵
  PID:8472
- C:\Windows\System\LXOmaPt.exe
  C:\Windows\System\LXOmaPt.exe
  2⤵
  PID:8496
- C:\Windows\System\blQQdbO.exe
  C:\Windows\System\blQQdbO.exe
  2⤵
  PID:8536
- C:\Windows\System\VBNrHug.exe
  C:\Windows\System\VBNrHug.exe
  2⤵
  PID:8564
- C:\Windows\System\BofBjLk.exe
  C:\Windows\System\BofBjLk.exe
  2⤵
  PID:8592
- C:\Windows\System\JTJFHAK.exe
  C:\Windows\System\JTJFHAK.exe
  2⤵
  PID:8620
- C:\Windows\System\gCOOaZK.exe
  C:\Windows\System\gCOOaZK.exe
  2⤵
  PID:8660
- C:\Windows\System\zMNKZLs.exe
  C:\Windows\System\zMNKZLs.exe
  2⤵
  PID:8688
- C:\Windows\System\dkqHIwE.exe
  C:\Windows\System\dkqHIwE.exe
  2⤵
  PID:8716
- C:\Windows\System\JIaolxK.exe
  C:\Windows\System\JIaolxK.exe
  2⤵
  PID:8736
- C:\Windows\System\otJwuHX.exe
  C:\Windows\System\otJwuHX.exe
  2⤵
  PID:8760
- C:\Windows\System\lVDSodY.exe
  C:\Windows\System\lVDSodY.exe
  2⤵
  PID:8788
- C:\Windows\System\oFTPgOb.exe
  C:\Windows\System\oFTPgOb.exe
  2⤵
  PID:8824
- C:\Windows\System\gpjDxHX.exe
  C:\Windows\System\gpjDxHX.exe
  2⤵
  PID:8848
- C:\Windows\System\RGMRqYn.exe
  C:\Windows\System\RGMRqYn.exe
  2⤵
  PID:8876
- C:\Windows\System\LKJllRK.exe
  C:\Windows\System\LKJllRK.exe
  2⤵
  PID:8892
- C:\Windows\System\sDPhHhJ.exe
  C:\Windows\System\sDPhHhJ.exe
  2⤵
  PID:8924
- C:\Windows\System\tNUKgAA.exe
  C:\Windows\System\tNUKgAA.exe
  2⤵
  PID:8956
- C:\Windows\System\kbAhgOR.exe
  C:\Windows\System\kbAhgOR.exe
  2⤵
  PID:8980
- C:\Windows\System\IAzTAXz.exe
  C:\Windows\System\IAzTAXz.exe
  2⤵
  PID:9004
- C:\Windows\System\aViYCIz.exe
  C:\Windows\System\aViYCIz.exe
  2⤵
  PID:9032
- C:\Windows\System\jGPqBdY.exe
  C:\Windows\System\jGPqBdY.exe
  2⤵
  PID:9064
- C:\Windows\System\sudogcD.exe
  C:\Windows\System\sudogcD.exe
  2⤵
  PID:9088
- C:\Windows\System\UfaVIkx.exe
  C:\Windows\System\UfaVIkx.exe
  2⤵
  PID:9116
- C:\Windows\System\TSuIofD.exe
  C:\Windows\System\TSuIofD.exe
  2⤵
  PID:9140
- C:\Windows\System\cCBLVMC.exe
  C:\Windows\System\cCBLVMC.exe
  2⤵
  PID:9172
- C:\Windows\System\abWiLXR.exe
  C:\Windows\System\abWiLXR.exe
  2⤵
  PID:9200
- C:\Windows\System\fUWUVZz.exe
  C:\Windows\System\fUWUVZz.exe
  2⤵
  PID:8204
- C:\Windows\System\kVXfnNy.exe
  C:\Windows\System\kVXfnNy.exe
  2⤵
  PID:8268
- C:\Windows\System\YDcCMVW.exe
  C:\Windows\System\YDcCMVW.exe
  2⤵
  PID:8336
- C:\Windows\System\qXJUZvX.exe
  C:\Windows\System\qXJUZvX.exe
  2⤵
  PID:8376
- C:\Windows\System\HpWZpnM.exe
  C:\Windows\System\HpWZpnM.exe
  2⤵
  PID:8460
- C:\Windows\System\TozyBgA.exe
  C:\Windows\System\TozyBgA.exe
  2⤵
  PID:8480
- C:\Windows\System\RLVGQhP.exe
  C:\Windows\System\RLVGQhP.exe
  2⤵
  PID:8548
- C:\Windows\System\rKKhZtd.exe
  C:\Windows\System\rKKhZtd.exe
  2⤵
  PID:8608
- C:\Windows\System\gDwfIyO.exe
  C:\Windows\System\gDwfIyO.exe
  2⤵
  PID:7812
- C:\Windows\System\pdpRmXi.exe
  C:\Windows\System\pdpRmXi.exe
  2⤵
  PID:8748
- C:\Windows\System\kOMvntT.exe
  C:\Windows\System\kOMvntT.exe
  2⤵
  PID:8772
- C:\Windows\System\lOerczc.exe
  C:\Windows\System\lOerczc.exe
  2⤵
  PID:8836
- C:\Windows\System\kloXhhy.exe
  C:\Windows\System\kloXhhy.exe
  2⤵
  PID:8940
- C:\Windows\System\MQVpSJa.exe
  C:\Windows\System\MQVpSJa.exe
  2⤵
  PID:8912
- C:\Windows\System\KXmMXDL.exe
  C:\Windows\System\KXmMXDL.exe
  2⤵
  PID:8968
- C:\Windows\System\fOFgjxw.exe
  C:\Windows\System\fOFgjxw.exe
  2⤵
  PID:9108
- C:\Windows\System\SurTlsP.exe
  C:\Windows\System\SurTlsP.exe
  2⤵
  PID:9164
- C:\Windows\System\eUSzXWP.exe
  C:\Windows\System\eUSzXWP.exe
  2⤵
  PID:9184
- C:\Windows\System\cGnMAHC.exe
  C:\Windows\System\cGnMAHC.exe
  2⤵
  PID:6460
- C:\Windows\System\yJGtQXf.exe
  C:\Windows\System\yJGtQXf.exe
  2⤵
  PID:8492
- C:\Windows\System\OpeUEGw.exe
  C:\Windows\System\OpeUEGw.exe
  2⤵
  PID:8672
- C:\Windows\System\mUNjbEF.exe
  C:\Windows\System\mUNjbEF.exe
  2⤵
  PID:8776
- C:\Windows\System\OegoIDP.exe
  C:\Windows\System\OegoIDP.exe
  2⤵
  PID:8712
- C:\Windows\System\DvVxksv.exe
  C:\Windows\System\DvVxksv.exe
  2⤵
  PID:9056
- C:\Windows\System\nVjtTSK.exe
  C:\Windows\System\nVjtTSK.exe
  2⤵
  PID:9208
- C:\Windows\System\sTAfkNf.exe
  C:\Windows\System\sTAfkNf.exe
  2⤵
  PID:8316
- C:\Windows\System\qbCdasg.exe
  C:\Windows\System\qbCdasg.exe
  2⤵
  PID:8732
- C:\Windows\System\SgdIMhr.exe
  C:\Windows\System\SgdIMhr.exe
  2⤵
  PID:9048
- C:\Windows\System\GHpSwBq.exe
  C:\Windows\System\GHpSwBq.exe
  2⤵
  PID:9240
- C:\Windows\System\ecfXDjV.exe
  C:\Windows\System\ecfXDjV.exe
  2⤵
  PID:9272
- C:\Windows\System\VUToVOc.exe
  C:\Windows\System\VUToVOc.exe
  2⤵
  PID:9304
- C:\Windows\System\NiJjlGp.exe
  C:\Windows\System\NiJjlGp.exe
  2⤵
  PID:9336
- C:\Windows\System\TkGIgsl.exe
  C:\Windows\System\TkGIgsl.exe
  2⤵
  PID:9360
- C:\Windows\System\XldXYKA.exe
  C:\Windows\System\XldXYKA.exe
  2⤵
  PID:9392
- C:\Windows\System\SOjUWPW.exe
  C:\Windows\System\SOjUWPW.exe
  2⤵
  PID:9420
- C:\Windows\System\KoQQsBM.exe
  C:\Windows\System\KoQQsBM.exe
  2⤵
  PID:9448
- C:\Windows\System\MeYgpnG.exe
  C:\Windows\System\MeYgpnG.exe
  2⤵
  PID:9484
- C:\Windows\System\nkTtpVB.exe
  C:\Windows\System\nkTtpVB.exe
  2⤵
  PID:9508
- C:\Windows\System\bGYopaY.exe
  C:\Windows\System\bGYopaY.exe
  2⤵
  PID:9536
- C:\Windows\System\qfLFOyr.exe
  C:\Windows\System\qfLFOyr.exe
  2⤵
  PID:9568
- C:\Windows\System\fxPacGH.exe
  C:\Windows\System\fxPacGH.exe
  2⤵
  PID:9596
- C:\Windows\System\XzmxRso.exe
  C:\Windows\System\XzmxRso.exe
  2⤵
  PID:9628
- C:\Windows\System\vdIdmPn.exe
  C:\Windows\System\vdIdmPn.exe
  2⤵
  PID:9660
- C:\Windows\System\ZvSTzXn.exe
  C:\Windows\System\ZvSTzXn.exe
  2⤵
  PID:9676
- C:\Windows\System\LOZwvXl.exe
  C:\Windows\System\LOZwvXl.exe
  2⤵
  PID:9704
- C:\Windows\System\KUKFvKL.exe
  C:\Windows\System\KUKFvKL.exe
  2⤵
  PID:9740
- C:\Windows\System\IlzTlio.exe
  C:\Windows\System\IlzTlio.exe
  2⤵
  PID:9760
- C:\Windows\System\GbVzHXk.exe
  C:\Windows\System\GbVzHXk.exe
  2⤵
  PID:9788
- C:\Windows\System\yePqkuf.exe
  C:\Windows\System\yePqkuf.exe
  2⤵
  PID:9808
- C:\Windows\System\FtWFAle.exe
  C:\Windows\System\FtWFAle.exe
  2⤵
  PID:9836
- C:\Windows\System\NQGJHrQ.exe
  C:\Windows\System\NQGJHrQ.exe
  2⤵
  PID:9860
- C:\Windows\System\SRgywkW.exe
  C:\Windows\System\SRgywkW.exe
  2⤵
  PID:9888
- C:\Windows\System\CfoOXUO.exe
  C:\Windows\System\CfoOXUO.exe
  2⤵
  PID:9912
- C:\Windows\System\SZKrVls.exe
  C:\Windows\System\SZKrVls.exe
  2⤵
  PID:9960
- C:\Windows\System\GAzqQTo.exe
  C:\Windows\System\GAzqQTo.exe
  2⤵
  PID:9984
- C:\Windows\System\XwgtXKU.exe
  C:\Windows\System\XwgtXKU.exe
  2⤵
  PID:10012
- C:\Windows\System\JbpEHzp.exe
  C:\Windows\System\JbpEHzp.exe
  2⤵
  PID:10040
- C:\Windows\System\JDaqgku.exe
  C:\Windows\System\JDaqgku.exe
  2⤵
  PID:10064
- C:\Windows\System\GxXJDFI.exe
  C:\Windows\System\GxXJDFI.exe
  2⤵
  PID:10088
- C:\Windows\System\NltWXMq.exe
  C:\Windows\System\NltWXMq.exe
  2⤵
  PID:10116
- C:\Windows\System\xBMFuEv.exe
  C:\Windows\System\xBMFuEv.exe
  2⤵
  PID:10136
- C:\Windows\System\zVGgsII.exe
  C:\Windows\System\zVGgsII.exe
  2⤵
  PID:10184
- C:\Windows\System\dcFlXGJ.exe
  C:\Windows\System\dcFlXGJ.exe
  2⤵
  PID:10212
- C:\Windows\System\lSTtXYG.exe
  C:\Windows\System\lSTtXYG.exe
  2⤵
  PID:10236
- C:\Windows\System\VWkJPML.exe
  C:\Windows\System\VWkJPML.exe
  2⤵
  PID:9072
- C:\Windows\System\xamltJT.exe
  C:\Windows\System\xamltJT.exe
  2⤵
  PID:9288
- C:\Windows\System\vklJDUD.exe
  C:\Windows\System\vklJDUD.exe
  2⤵
  PID:9252
- C:\Windows\System\YMKzCey.exe
  C:\Windows\System\YMKzCey.exe
  2⤵
  PID:9320
- C:\Windows\System\SpesPhb.exe
  C:\Windows\System\SpesPhb.exe
  2⤵
  PID:9460
- C:\Windows\System\oBxJfHj.exe
  C:\Windows\System\oBxJfHj.exe
  2⤵
  PID:9376
- C:\Windows\System\GoIbWmd.exe
  C:\Windows\System\GoIbWmd.exe
  2⤵
  PID:9528
- C:\Windows\System\wSrLZXe.exe
  C:\Windows\System\wSrLZXe.exe
  2⤵
  PID:9584
- C:\Windows\System\mrrAWfL.exe
  C:\Windows\System\mrrAWfL.exe
  2⤵
  PID:9620
- C:\Windows\System\qLEnhwu.exe
  C:\Windows\System\qLEnhwu.exe
  2⤵
  PID:9724
- C:\Windows\System\vIvlbpF.exe
  C:\Windows\System\vIvlbpF.exe
  2⤵
  PID:9748
- C:\Windows\System\ssQbsPz.exe
  C:\Windows\System\ssQbsPz.exe
  2⤵
  PID:9880
- C:\Windows\System\tgtIWOq.exe
  C:\Windows\System\tgtIWOq.exe
  2⤵
  PID:9936
- C:\Windows\System\gkKNSvL.exe
  C:\Windows\System\gkKNSvL.exe
  2⤵
  PID:10004
- C:\Windows\System\wHfogQK.exe
  C:\Windows\System\wHfogQK.exe
  2⤵
  PID:10060
- C:\Windows\System\EHRNlZy.exe
  C:\Windows\System\EHRNlZy.exe
  2⤵
  PID:10168
- C:\Windows\System\IkqDNXa.exe
  C:\Windows\System\IkqDNXa.exe
  2⤵
  PID:10220
- C:\Windows\System\BdWAwTU.exe
  C:\Windows\System\BdWAwTU.exe
  2⤵
  PID:9160
- C:\Windows\System\fvBeBOm.exe
  C:\Windows\System\fvBeBOm.exe
  2⤵
  PID:9296
- C:\Windows\System\GaCIWrM.exe
  C:\Windows\System\GaCIWrM.exe
  2⤵
  PID:8988
- C:\Windows\System\kNRijZl.exe
  C:\Windows\System\kNRijZl.exe
  2⤵
  PID:9648
- C:\Windows\System\iZjFYHY.exe
  C:\Windows\System\iZjFYHY.exe
  2⤵
  PID:9492
- C:\Windows\System\UmpPSoF.exe
  C:\Windows\System\UmpPSoF.exe
  2⤵
  PID:10104
- C:\Windows\System\gXPaOCW.exe
  C:\Windows\System\gXPaOCW.exe
  2⤵
  PID:10228
- C:\Windows\System\YoWMOGM.exe
  C:\Windows\System\YoWMOGM.exe
  2⤵
  PID:8808
- C:\Windows\System\RfTOCdH.exe
  C:\Windows\System\RfTOCdH.exe
  2⤵
  PID:9824
- C:\Windows\System\dVaLxMK.exe
  C:\Windows\System\dVaLxMK.exe
  2⤵
  PID:10248
- C:\Windows\System\QrfpFns.exe
  C:\Windows\System\QrfpFns.exe
  2⤵
  PID:10280
- C:\Windows\System\tqcyQiC.exe
  C:\Windows\System\tqcyQiC.exe
  2⤵
  PID:10308
- C:\Windows\System\qXbdxMU.exe
  C:\Windows\System\qXbdxMU.exe
  2⤵
  PID:10340
- C:\Windows\System\qIDjHoE.exe
  C:\Windows\System\qIDjHoE.exe
  2⤵
  PID:10364
- C:\Windows\System\jkLLaEj.exe
  C:\Windows\System\jkLLaEj.exe
  2⤵
  PID:10388
- C:\Windows\System\kEySBlR.exe
  C:\Windows\System\kEySBlR.exe
  2⤵
  PID:10428
- C:\Windows\System\KUpoDFY.exe
  C:\Windows\System\KUpoDFY.exe
  2⤵
  PID:10460
- C:\Windows\System\HpSgckv.exe
  C:\Windows\System\HpSgckv.exe
  2⤵
  PID:10480
- C:\Windows\System\rwFJNgY.exe
  C:\Windows\System\rwFJNgY.exe
  2⤵
  PID:10512
- C:\Windows\System\jJIortS.exe
  C:\Windows\System\jJIortS.exe
  2⤵
  PID:10544
- C:\Windows\System\xqoxqiF.exe
  C:\Windows\System\xqoxqiF.exe
  2⤵
  PID:10568
- C:\Windows\System\NLxItlx.exe
  C:\Windows\System\NLxItlx.exe
  2⤵
  PID:10596
- C:\Windows\System\pofvlAD.exe
  C:\Windows\System\pofvlAD.exe
  2⤵
  PID:10620
- C:\Windows\System\FNXxqMS.exe
  C:\Windows\System\FNXxqMS.exe
  2⤵
  PID:10648
- C:\Windows\System\LfYEMYd.exe
  C:\Windows\System\LfYEMYd.exe
  2⤵
  PID:10676
- C:\Windows\System\iHLdjjj.exe
  C:\Windows\System\iHLdjjj.exe
  2⤵
  PID:10700
- C:\Windows\System\RRZOJFd.exe
  C:\Windows\System\RRZOJFd.exe
  2⤵
  PID:10732
- C:\Windows\System\ZnMxViM.exe
  C:\Windows\System\ZnMxViM.exe
  2⤵
  PID:10756
- C:\Windows\System\PIfjgde.exe
  C:\Windows\System\PIfjgde.exe
  2⤵
  PID:10788
- C:\Windows\System\VEEQSuo.exe
  C:\Windows\System\VEEQSuo.exe
  2⤵
  PID:10804
- C:\Windows\System\HHmCpUI.exe
  C:\Windows\System\HHmCpUI.exe
  2⤵
  PID:10828
- C:\Windows\System\GagfDjW.exe
  C:\Windows\System\GagfDjW.exe
  2⤵
  PID:10860
- C:\Windows\System\NTTVkca.exe
  C:\Windows\System\NTTVkca.exe
  2⤵
  PID:10900
- C:\Windows\System\WXRsrdL.exe
  C:\Windows\System\WXRsrdL.exe
  2⤵
  PID:10932
- C:\Windows\System\hJjrKrv.exe
  C:\Windows\System\hJjrKrv.exe
  2⤵
  PID:10960
- C:\Windows\System\vnjFeuj.exe
  C:\Windows\System\vnjFeuj.exe
  2⤵
  PID:10980
- C:\Windows\System\FLXJdfB.exe
  C:\Windows\System\FLXJdfB.exe
  2⤵
  PID:11012
- C:\Windows\System\pQGNgel.exe
  C:\Windows\System\pQGNgel.exe
  2⤵
  PID:11040
- C:\Windows\System\WewOcgX.exe
  C:\Windows\System\WewOcgX.exe
  2⤵
  PID:11072
- C:\Windows\System\CfcKfYZ.exe
  C:\Windows\System\CfcKfYZ.exe
  2⤵
  PID:11108
- C:\Windows\System\aJZTmHa.exe
  C:\Windows\System\aJZTmHa.exe
  2⤵
  PID:11132
- C:\Windows\System\WAotMas.exe
  C:\Windows\System\WAotMas.exe
  2⤵
  PID:11160
- C:\Windows\System\QldaSIa.exe
  C:\Windows\System\QldaSIa.exe
  2⤵
  PID:11176
- C:\Windows\System\tBVptzS.exe
  C:\Windows\System\tBVptzS.exe
  2⤵
  PID:11212
- C:\Windows\System\PTukSCd.exe
  C:\Windows\System\PTukSCd.exe
  2⤵
  PID:11244
- C:\Windows\System\VnQSJHW.exe
  C:\Windows\System\VnQSJHW.exe
  2⤵
  PID:10056
- C:\Windows\System\HPZspCi.exe
  C:\Windows\System\HPZspCi.exe
  2⤵
  PID:9524
- C:\Windows\System\IcGaaQr.exe
  C:\Windows\System\IcGaaQr.exe
  2⤵
  PID:10264
- C:\Windows\System\pCnufiF.exe
  C:\Windows\System\pCnufiF.exe
  2⤵
  PID:10336
- C:\Windows\System\ydDlHcA.exe
  C:\Windows\System\ydDlHcA.exe
  2⤵
  PID:10448
- C:\Windows\System\UfVBvxS.exe
  C:\Windows\System\UfVBvxS.exe
  2⤵
  PID:10536
- C:\Windows\System\AnNlFWk.exe
  C:\Windows\System\AnNlFWk.exe
  2⤵
  PID:10496
- C:\Windows\System\IlcFEvG.exe
  C:\Windows\System\IlcFEvG.exe
  2⤵
  PID:10532
- C:\Windows\System\IiWaAHA.exe
  C:\Windows\System\IiWaAHA.exe
  2⤵
  PID:10636
- C:\Windows\System\JpJRyPZ.exe
  C:\Windows\System\JpJRyPZ.exe
  2⤵
  PID:10612
- C:\Windows\System\cTfZmuD.exe
  C:\Windows\System\cTfZmuD.exe
  2⤵
  PID:10784
- C:\Windows\System\GqKvURI.exe
  C:\Windows\System\GqKvURI.exe
  2⤵
  PID:10800
- C:\Windows\System\aKTnRqr.exe
  C:\Windows\System\aKTnRqr.exe
  2⤵
  PID:10944
- C:\Windows\System\oTJODrM.exe
  C:\Windows\System\oTJODrM.exe
  2⤵
  PID:10976
- C:\Windows\System\kiaUmHb.exe
  C:\Windows\System\kiaUmHb.exe
  2⤵
  PID:11060
- C:\Windows\System\ZbcpszI.exe
  C:\Windows\System\ZbcpszI.exe
  2⤵
  PID:11116
- C:\Windows\System\sFzPREq.exe
  C:\Windows\System\sFzPREq.exe
  2⤵
  PID:11208
- C:\Windows\System\WsLiNrk.exe
  C:\Windows\System\WsLiNrk.exe
  2⤵
  PID:11200
- C:\Windows\System\ruJQfAM.exe
  C:\Windows\System\ruJQfAM.exe
  2⤵
  PID:10412
- C:\Windows\System\CvivavD.exe
  C:\Windows\System\CvivavD.exe
  2⤵
  PID:9368
- C:\Windows\System\GwHxBmh.exe
  C:\Windows\System\GwHxBmh.exe
  2⤵
  PID:10552
- C:\Windows\System\kZwqASF.exe
  C:\Windows\System\kZwqASF.exe
  2⤵
  PID:10660
- C:\Windows\System\wcvDiPm.exe
  C:\Windows\System\wcvDiPm.exe
  2⤵
  PID:10840
- C:\Windows\System\ztTQbbt.exe
  C:\Windows\System\ztTQbbt.exe
  2⤵
  PID:10896
- C:\Windows\System\JvxtQsl.exe
  C:\Windows\System\JvxtQsl.exe
  2⤵
  PID:10928
- C:\Windows\System\dFCTWPo.exe
  C:\Windows\System\dFCTWPo.exe
  2⤵
  PID:10352
- C:\Windows\System\hnpkowK.exe
  C:\Windows\System\hnpkowK.exe
  2⤵
  PID:10588
- C:\Windows\System\dZqoQIA.exe
  C:\Windows\System\dZqoQIA.exe
  2⤵
  PID:11056
- C:\Windows\System\dIflrrL.exe
  C:\Windows\System\dIflrrL.exe
  2⤵
  PID:11028
- C:\Windows\System\FcrMXsH.exe
  C:\Windows\System\FcrMXsH.exe
  2⤵
  PID:11296
- C:\Windows\System\SWjtJjo.exe
  C:\Windows\System\SWjtJjo.exe
  2⤵
  PID:11324
- C:\Windows\System\FRsQgfm.exe
  C:\Windows\System\FRsQgfm.exe
  2⤵
  PID:11364
- C:\Windows\System\EChCdRm.exe
  C:\Windows\System\EChCdRm.exe
  2⤵
  PID:11396
- C:\Windows\System\mpFNFPp.exe
  C:\Windows\System\mpFNFPp.exe
  2⤵
  PID:11416
- C:\Windows\System\tAIczNs.exe
  C:\Windows\System\tAIczNs.exe
  2⤵
  PID:11440
- C:\Windows\System\KIowXTo.exe
  C:\Windows\System\KIowXTo.exe
  2⤵
  PID:11460
- C:\Windows\System\oXjEIXH.exe
  C:\Windows\System\oXjEIXH.exe
  2⤵
  PID:11476
- C:\Windows\System\WRUoiek.exe
  C:\Windows\System\WRUoiek.exe
  2⤵
  PID:11492
- C:\Windows\System\kKvWxKn.exe
  C:\Windows\System\kKvWxKn.exe
  2⤵
  PID:11524
- C:\Windows\System\oUGlJtf.exe
  C:\Windows\System\oUGlJtf.exe
  2⤵
  PID:11556
- C:\Windows\System\tShXxje.exe
  C:\Windows\System\tShXxje.exe
  2⤵
  PID:11584
- C:\Windows\System\EcUpOye.exe
  C:\Windows\System\EcUpOye.exe
  2⤵
  PID:11608
- C:\Windows\System\rhYVrwY.exe
  C:\Windows\System\rhYVrwY.exe
  2⤵
  PID:11644
- C:\Windows\System\ilFFzhE.exe
  C:\Windows\System\ilFFzhE.exe
  2⤵
  PID:11672
- C:\Windows\System\eoslxBq.exe
  C:\Windows\System\eoslxBq.exe
  2⤵
  PID:11700
- C:\Windows\System\uusFOKg.exe
  C:\Windows\System\uusFOKg.exe
  2⤵
  PID:11732
- C:\Windows\System\FFDQcpw.exe
  C:\Windows\System\FFDQcpw.exe
  2⤵
  PID:11752
- C:\Windows\System\LDJKrlY.exe
  C:\Windows\System\LDJKrlY.exe
  2⤵
  PID:11780
- C:\Windows\System\hkzgHCk.exe
  C:\Windows\System\hkzgHCk.exe
  2⤵
  PID:11808
- C:\Windows\System\hUYVmvb.exe
  C:\Windows\System\hUYVmvb.exe
  2⤵
  PID:11836
- C:\Windows\System\fBlQAvM.exe
  C:\Windows\System\fBlQAvM.exe
  2⤵
  PID:11868
- C:\Windows\System\LGsbvKL.exe
  C:\Windows\System\LGsbvKL.exe
  2⤵
  PID:11892
- C:\Windows\System\YNyXyIa.exe
  C:\Windows\System\YNyXyIa.exe
  2⤵
  PID:11932
- C:\Windows\System\CCZWYfF.exe
  C:\Windows\System\CCZWYfF.exe
  2⤵
  PID:11952
- C:\Windows\System\yEgnxkS.exe
  C:\Windows\System\yEgnxkS.exe
  2⤵
  PID:11976
- C:\Windows\System\DJOQzzK.exe
  C:\Windows\System\DJOQzzK.exe
  2⤵
  PID:12000
- C:\Windows\System\vzvyQwK.exe
  C:\Windows\System\vzvyQwK.exe
  2⤵
  PID:12036
- C:\Windows\System\kapTAbd.exe
  C:\Windows\System\kapTAbd.exe
  2⤵
  PID:12056
- C:\Windows\System\DRpMpXh.exe
  C:\Windows\System\DRpMpXh.exe
  2⤵
  PID:12088
- C:\Windows\System\dSvKQvU.exe
  C:\Windows\System\dSvKQvU.exe
  2⤵
  PID:12104
- C:\Windows\System\jKCWyKb.exe
  C:\Windows\System\jKCWyKb.exe
  2⤵
  PID:12132
- C:\Windows\System\SSLJiLf.exe
  C:\Windows\System\SSLJiLf.exe
  2⤵
  PID:12160
- C:\Windows\System\nmxzDuC.exe
  C:\Windows\System\nmxzDuC.exe
  2⤵
  PID:12180
- C:\Windows\System\CxnNDOg.exe
  C:\Windows\System\CxnNDOg.exe
  2⤵
  PID:12208
- C:\Windows\System\XbOmuww.exe
  C:\Windows\System\XbOmuww.exe
  2⤵
  PID:12232
- C:\Windows\System\iVYrOmd.exe
  C:\Windows\System\iVYrOmd.exe
  2⤵
  PID:12264
- C:\Windows\System\XBfdQex.exe
  C:\Windows\System\XBfdQex.exe
  2⤵
  PID:10256
- C:\Windows\System\WeoFYOl.exe
  C:\Windows\System\WeoFYOl.exe
  2⤵
  PID:11284
- C:\Windows\System\pVutaZL.exe
  C:\Windows\System\pVutaZL.exe
  2⤵
  PID:11036
- C:\Windows\System\lTcOgvj.exe
  C:\Windows\System\lTcOgvj.exe
  2⤵
  PID:11380
- C:\Windows\System\visAODR.exe
  C:\Windows\System\visAODR.exe
  2⤵
  PID:11516
- C:\Windows\System\BBtZadr.exe
  C:\Windows\System\BBtZadr.exe
  2⤵
  PID:11468
- C:\Windows\System\BRgMGfY.exe
  C:\Windows\System\BRgMGfY.exe
  2⤵
  PID:11572
- C:\Windows\System\mfVLWFE.exe
  C:\Windows\System\mfVLWFE.exe
  2⤵
  PID:11664
- C:\Windows\System\WLhkoyv.exe
  C:\Windows\System\WLhkoyv.exe
  2⤵
  PID:11656
- C:\Windows\System\XPjujVn.exe
  C:\Windows\System\XPjujVn.exe
  2⤵
  PID:11804
- C:\Windows\System\NDFGdoX.exe
  C:\Windows\System\NDFGdoX.exe
  2⤵
  PID:11864
- C:\Windows\System\XhRviKB.exe
  C:\Windows\System\XhRviKB.exe
  2⤵
  PID:11924
- C:\Windows\System\RgmfjgF.exe
  C:\Windows\System\RgmfjgF.exe
  2⤵
  PID:12044
- C:\Windows\System\iKWCYYb.exe
  C:\Windows\System\iKWCYYb.exe
  2⤵
  PID:12100
- C:\Windows\System\jYSoJsD.exe
  C:\Windows\System\jYSoJsD.exe
  2⤵
  PID:12148
- C:\Windows\System\YsBcbzc.exe
  C:\Windows\System\YsBcbzc.exe
  2⤵
  PID:12220
- C:\Windows\System\yjJCrGO.exe
  C:\Windows\System\yjJCrGO.exe
  2⤵
  PID:12192
- C:\Windows\System\dcwpEbf.exe
  C:\Windows\System\dcwpEbf.exe
  2⤵
  PID:12280
- C:\Windows\System\iMbRuAL.exe
  C:\Windows\System\iMbRuAL.exe
  2⤵
  PID:11344
- C:\Windows\System\wNSTSlb.exe
  C:\Windows\System\wNSTSlb.exe
  2⤵
  PID:11504
- C:\Windows\System\CTIGUxh.exe
  C:\Windows\System\CTIGUxh.exe
  2⤵
  PID:11824
- C:\Windows\System\TIHHMuy.exe
  C:\Windows\System\TIHHMuy.exe
  2⤵
  PID:11684
- C:\Windows\System\rmIWKgl.exe
  C:\Windows\System\rmIWKgl.exe
  2⤵
  PID:11712
- C:\Windows\System\awCkJth.exe
  C:\Windows\System\awCkJth.exe
  2⤵
  PID:11996
- C:\Windows\System\baiYDMr.exe
  C:\Windows\System\baiYDMr.exe
  2⤵
  PID:12272
- C:\Windows\System\XcrcKzC.exe
  C:\Windows\System\XcrcKzC.exe
  2⤵
  PID:12260
- C:\Windows\System\KeygqjA.exe
  C:\Windows\System\KeygqjA.exe
  2⤵
  PID:11828
- C:\Windows\System\PfnOgpH.exe
  C:\Windows\System\PfnOgpH.exe
  2⤵
  PID:12316
- C:\Windows\System\IdoCdkT.exe
  C:\Windows\System\IdoCdkT.exe
  2⤵
  PID:12352
- C:\Windows\System\VTqbWof.exe
  C:\Windows\System\VTqbWof.exe
  2⤵
  PID:12376
- C:\Windows\System\puXHuqM.exe
  C:\Windows\System\puXHuqM.exe
  2⤵
  PID:12416
- C:\Windows\System\AGlbDAp.exe
  C:\Windows\System\AGlbDAp.exe
  2⤵
  PID:12444
- C:\Windows\System\KTmSsVO.exe
  C:\Windows\System\KTmSsVO.exe
  2⤵
  PID:12472
- C:\Windows\System\pmLqfFX.exe
  C:\Windows\System\pmLqfFX.exe
  2⤵
  PID:12492
- C:\Windows\System\ydBxavq.exe
  C:\Windows\System\ydBxavq.exe
  2⤵
  PID:12532
- C:\Windows\System\TAaCDUe.exe
  C:\Windows\System\TAaCDUe.exe
  2⤵
  PID:12560
- C:\Windows\System\SEsbaDF.exe
  C:\Windows\System\SEsbaDF.exe
  2⤵
  PID:12588
- C:\Windows\System\jWdZXOU.exe
  C:\Windows\System\jWdZXOU.exe
  2⤵
  PID:12612
- C:\Windows\System\TTEkyJh.exe
  C:\Windows\System\TTEkyJh.exe
  2⤵
  PID:12640
- C:\Windows\System\jFqYlnQ.exe
  C:\Windows\System\jFqYlnQ.exe
  2⤵
  PID:12668
- C:\Windows\System\hZutWNo.exe
  C:\Windows\System\hZutWNo.exe
  2⤵
  PID:12692
- C:\Windows\System\KxWFbtn.exe
  C:\Windows\System\KxWFbtn.exe
  2⤵
  PID:12724
- C:\Windows\System\lZaGass.exe
  C:\Windows\System\lZaGass.exe
  2⤵
  PID:12748
- C:\Windows\System\WcVVsHw.exe
  C:\Windows\System\WcVVsHw.exe
  2⤵
  PID:12772
- C:\Windows\System\EEAeeTl.exe
  C:\Windows\System\EEAeeTl.exe
  2⤵
  PID:12800
- C:\Windows\System\AxYFkDZ.exe
  C:\Windows\System\AxYFkDZ.exe
  2⤵
  PID:12824
- C:\Windows\System\qKCGQyK.exe
  C:\Windows\System\qKCGQyK.exe
  2⤵
  PID:12860
- C:\Windows\System\DcnBtvB.exe
  C:\Windows\System\DcnBtvB.exe
  2⤵
  PID:12884
- C:\Windows\System\AYoKbkR.exe
  C:\Windows\System\AYoKbkR.exe
  2⤵
  PID:12912
- C:\Windows\System\rfVsvPe.exe
  C:\Windows\System\rfVsvPe.exe
  2⤵
  PID:12940
- C:\Windows\System\NkJTCtg.exe
  C:\Windows\System\NkJTCtg.exe
  2⤵
  PID:12976
- C:\Windows\System\SeKsLlc.exe
  C:\Windows\System\SeKsLlc.exe
  2⤵
  PID:13004
- C:\Windows\System\UqxgweF.exe
  C:\Windows\System\UqxgweF.exe
  2⤵
  PID:13028
- C:\Windows\System\yiNozMS.exe
  C:\Windows\System\yiNozMS.exe
  2⤵
  PID:13052
- C:\Windows\System\mjEqsmC.exe
  C:\Windows\System\mjEqsmC.exe
  2⤵
  PID:13076
- C:\Windows\System\gzspdUO.exe
  C:\Windows\System\gzspdUO.exe
  2⤵
  PID:13116
- C:\Windows\System\kgaaaIT.exe
  C:\Windows\System\kgaaaIT.exe
  2⤵
  PID:13140
- C:\Windows\System\GwAYGGr.exe
  C:\Windows\System\GwAYGGr.exe
  2⤵
  PID:13172
- C:\Windows\System\jABDLDl.exe
  C:\Windows\System\jABDLDl.exe
  2⤵
  PID:13200
- C:\Windows\System\NCAyFuS.exe
  C:\Windows\System\NCAyFuS.exe
  2⤵
  PID:13220
- C:\Windows\System\alBDaQT.exe
  C:\Windows\System\alBDaQT.exe
  2⤵
  PID:13240
- C:\Windows\System\qvyXRcf.exe
  C:\Windows\System\qvyXRcf.exe
  2⤵
  PID:13280
- C:\Windows\System\nuMcwVD.exe
  C:\Windows\System\nuMcwVD.exe
  2⤵
  PID:12096
- C:\Windows\System\pqBIUUX.exe
  C:\Windows\System\pqBIUUX.exe
  2⤵
  PID:11692
- C:\Windows\System\emUUPCf.exe
  C:\Windows\System\emUUPCf.exe
  2⤵
  PID:11940
- C:\Windows\System\alwnKlK.exe
  C:\Windows\System\alwnKlK.exe
  2⤵
  PID:12324
- C:\Windows\System\xxjDzNO.exe
  C:\Windows\System\xxjDzNO.exe
  2⤵
  PID:12428
- C:\Windows\System\FdqZKZW.exe
  C:\Windows\System\FdqZKZW.exe
  2⤵
  PID:12484
- C:\Windows\System\dfVywcM.exe
  C:\Windows\System\dfVywcM.exe
  2⤵
  PID:12628
- C:\Windows\System\lgquvNk.exe
  C:\Windows\System\lgquvNk.exe
  2⤵
  PID:12600
- C:\Windows\System\gHsVkKV.exe
  C:\Windows\System\gHsVkKV.exe
  2⤵
  PID:12736
- C:\Windows\System\XJGCMcl.exe
  C:\Windows\System\XJGCMcl.exe
  2⤵
  PID:12768
- C:\Windows\System\BmHGoIh.exe
  C:\Windows\System\BmHGoIh.exe
  2⤵
  PID:12836
- C:\Windows\System\zezfSxf.exe
  C:\Windows\System\zezfSxf.exe
  2⤵
  PID:12848
- C:\Windows\System\kITmjYn.exe
  C:\Windows\System\kITmjYn.exe
  2⤵
  PID:12932
- C:\Windows\System\cHQXOds.exe
  C:\Windows\System\cHQXOds.exe
  2⤵
  PID:12992
- C:\Windows\System\FBJEHsV.exe
  C:\Windows\System\FBJEHsV.exe
  2⤵
  PID:12960
- C:\Windows\System\XZWgCXm.exe
  C:\Windows\System\XZWgCXm.exe
  2⤵
  PID:11544
- C:\Windows\System\LAcISrB.exe
  C:\Windows\System\LAcISrB.exe
  2⤵
  PID:12400
- C:\Windows\System\OoNCXYg.exe
  C:\Windows\System\OoNCXYg.exe
  2⤵
  PID:12372
- C:\Windows\System\SsTwlGK.exe
  C:\Windows\System\SsTwlGK.exe
  2⤵
  PID:12460
- C:\Windows\System\aqWquPM.exe
  C:\Windows\System\aqWquPM.exe
  2⤵
  PID:12892
- C:\Windows\System\hsMpyEo.exe
  C:\Windows\System\hsMpyEo.exe
  2⤵
  PID:12852
- C:\Windows\System\aobmxoT.exe
  C:\Windows\System\aobmxoT.exe
  2⤵
  PID:12964
- C:\Windows\System\epkwDfp.exe
  C:\Windows\System\epkwDfp.exe
  2⤵
  PID:13128
- C:\Windows\System\okBTbSV.exe
  C:\Windows\System\okBTbSV.exe
  2⤵
  PID:12452
- C:\Windows\System\gjHmosP.exe
  C:\Windows\System\gjHmosP.exe
  2⤵
  PID:12704
- C:\Windows\System\PCjHlgm.exe
  C:\Windows\System\PCjHlgm.exe
  2⤵
  PID:12968
- C:\Windows\System\ssANhCc.exe
  C:\Windows\System\ssANhCc.exe
  2⤵
  PID:12436
- C:\Windows\System\gZMEMqK.exe
  C:\Windows\System\gZMEMqK.exe
  2⤵
  PID:13316
- C:\Windows\System\uvaocNn.exe
  C:\Windows\System\uvaocNn.exe
  2⤵
  PID:13340
- C:\Windows\System\zDubiCI.exe
  C:\Windows\System\zDubiCI.exe
  2⤵
  PID:13368
- C:\Windows\System\VFtymsG.exe
  C:\Windows\System\VFtymsG.exe
  2⤵
  PID:13392
- C:\Windows\System\JUhbFyQ.exe
  C:\Windows\System\JUhbFyQ.exe
  2⤵
  PID:13416
- C:\Windows\System\BPwSdSH.exe
  C:\Windows\System\BPwSdSH.exe
  2⤵
  PID:13440
- C:\Windows\System\TjStnrd.exe
  C:\Windows\System\TjStnrd.exe
  2⤵
  PID:13464
- C:\Windows\System\byGZqME.exe
  C:\Windows\System\byGZqME.exe
  2⤵
  PID:13496
- C:\Windows\System\alcPfqG.exe
  C:\Windows\System\alcPfqG.exe
  2⤵
  PID:13516
- C:\Windows\System\nrQGOlE.exe
  C:\Windows\System\nrQGOlE.exe
  2⤵
  PID:13532
- C:\Windows\System\alQXQNN.exe
  C:\Windows\System\alQXQNN.exe
  2⤵
  PID:13560
- C:\Windows\System\LUBGMjc.exe
  C:\Windows\System\LUBGMjc.exe
  2⤵
  PID:13580
- C:\Windows\System\FfhfDoA.exe
  C:\Windows\System\FfhfDoA.exe
  2⤵
  PID:13608
- C:\Windows\System\DhCMyfN.exe
  C:\Windows\System\DhCMyfN.exe
  2⤵
  PID:13628
- C:\Windows\System\qVBTKtp.exe
  C:\Windows\System\qVBTKtp.exe
  2⤵
  PID:13660
- C:\Windows\System\UYNmUgY.exe
  C:\Windows\System\UYNmUgY.exe
  2⤵
  PID:13684
- C:\Windows\System\ByOUOhI.exe
  C:\Windows\System\ByOUOhI.exe
  2⤵
  PID:13704
- C:\Windows\System\MmRICxh.exe
  C:\Windows\System\MmRICxh.exe
  2⤵
  PID:13732
- C:\Windows\System\oLOJlUd.exe
  C:\Windows\System\oLOJlUd.exe
  2⤵
  PID:13756
- C:\Windows\System\QuNyBKn.exe
  C:\Windows\System\QuNyBKn.exe
  2⤵
  PID:13784
- C:\Windows\System\VUZSPLZ.exe
  C:\Windows\System\VUZSPLZ.exe
  2⤵
  PID:13816
- C:\Windows\System\SiIYVxh.exe
  C:\Windows\System\SiIYVxh.exe
  2⤵
  PID:13840
- C:\Windows\System\dUTmrlG.exe
  C:\Windows\System\dUTmrlG.exe
  2⤵
  PID:13860
- C:\Windows\System\aTcUAjx.exe
  C:\Windows\System\aTcUAjx.exe
  2⤵
  PID:13896
- C:\Windows\System\yOIgfFR.exe
  C:\Windows\System\yOIgfFR.exe
  2⤵
  PID:13920
- C:\Windows\System\zVwIdQt.exe
  C:\Windows\System\zVwIdQt.exe
  2⤵
  PID:13944
- C:\Windows\System\HXbQRgw.exe
  C:\Windows\System\HXbQRgw.exe
  2⤵
  PID:13972
- C:\Windows\System\nHJDznJ.exe
  C:\Windows\System\nHJDznJ.exe
  2⤵
  PID:13992
- C:\Windows\System\RkZFhzi.exe
  C:\Windows\System\RkZFhzi.exe
  2⤵
  PID:14008
- C:\Windows\System\QUoBlvW.exe
  C:\Windows\System\QUoBlvW.exe
  2⤵
  PID:14032
- C:\Windows\System\bDzgNCu.exe
  C:\Windows\System\bDzgNCu.exe
  2⤵
  PID:14052
- C:\Windows\System\umsNJyB.exe
  C:\Windows\System\umsNJyB.exe
  2⤵
  PID:14072
- C:\Windows\System\pEwQgov.exe
  C:\Windows\System\pEwQgov.exe
  2⤵
  PID:14104
- C:\Windows\System\LNZFxFG.exe
  C:\Windows\System\LNZFxFG.exe
  2⤵
  PID:14120
- C:\Windows\System\OnJmZxx.exe
  C:\Windows\System\OnJmZxx.exe
  2⤵
  PID:14144
- C:\Windows\System\UyHHFel.exe
  C:\Windows\System\UyHHFel.exe
  2⤵
  PID:14172
- C:\Windows\System\SUelifl.exe
  C:\Windows\System\SUelifl.exe
  2⤵
  PID:14200
- C:\Windows\System\leYRnpj.exe
  C:\Windows\System\leYRnpj.exe
  2⤵
  PID:14228
- C:\Windows\System\IKutpcc.exe
  C:\Windows\System\IKutpcc.exe
  2⤵
  PID:14252
- C:\Windows\System\iLGrhTM.exe
  C:\Windows\System\iLGrhTM.exe
  2⤵
  PID:14276
- C:\Windows\System\EpPoJVP.exe
  C:\Windows\System\EpPoJVP.exe
  2⤵
  PID:14308
- C:\Windows\System\clEMXSQ.exe
  C:\Windows\System\clEMXSQ.exe
  2⤵
  PID:12712
- C:\Windows\System\XUjALWF.exe
  C:\Windows\System\XUjALWF.exe
  2⤵
  PID:13352
- C:\Windows\System\VWeDKof.exe
  C:\Windows\System\VWeDKof.exe
  2⤵
  PID:13452
- C:\Windows\System\enRrKSM.exe
  C:\Windows\System\enRrKSM.exe
  2⤵
  PID:13428
- C:\Windows\System\CWwxbak.exe
  C:\Windows\System\CWwxbak.exe
  2⤵
  PID:13456
- C:\Windows\System\EHEmJtq.exe
  C:\Windows\System\EHEmJtq.exe
  2⤵
  PID:13572
- C:\Windows\System\nhHWagj.exe
  C:\Windows\System\nhHWagj.exe
  2⤵
  PID:13644
- C:\Windows\System\taSLiQs.exe
  C:\Windows\System\taSLiQs.exe
  2⤵
  PID:13668
- C:\Windows\System\QwSOfiK.exe
  C:\Windows\System\QwSOfiK.exe
  2⤵
  PID:13604
- C:\Windows\System\nMnOFcc.exe
  C:\Windows\System\nMnOFcc.exe
  2⤵
  PID:13812
- C:\Windows\System\KDrkQoK.exe
  C:\Windows\System\KDrkQoK.exe
  2⤵
  PID:13792
- C:\Windows\System\ETTeKUz.exe
  C:\Windows\System\ETTeKUz.exe
  2⤵
  PID:13824
- C:\Windows\System\KPtKQOU.exe
  C:\Windows\System\KPtKQOU.exe
  2⤵
  PID:13884
- C:\Windows\System\YoqlJHz.exe
  C:\Windows\System\YoqlJHz.exe
  2⤵
  PID:14024
- C:\Windows\System\ZJNfxIG.exe
  C:\Windows\System\ZJNfxIG.exe
  2⤵
  PID:14152
- C:\Windows\System\ZNnhsOG.exe
  C:\Windows\System\ZNnhsOG.exe
  2⤵
  PID:14080
- C:\Windows\System\ZoKyABZ.exe
  C:\Windows\System\ZoKyABZ.exe
  2⤵
  PID:14248
- C:\Windows\System\fIXzzeU.exe
  C:\Windows\System\fIXzzeU.exe
  2⤵
  PID:14272
- C:\Windows\System\NErArAW.exe
  C:\Windows\System\NErArAW.exe
  2⤵
  PID:13088
- C:\Windows\System\VicYoHk.exe
  C:\Windows\System\VicYoHk.exe
  2⤵
  PID:13124
- C:\Windows\System\OyYQKfS.exe
  C:\Windows\System\OyYQKfS.exe
  2⤵
  PID:13616
- C:\Windows\System\YYVqAmB.exe
  C:\Windows\System\YYVqAmB.exe
  2⤵
  PID:13360
- C:\Windows\System\iiPrhpj.exe
  C:\Windows\System\iiPrhpj.exe
  2⤵
  PID:13436
- C:\Windows\System\iYclHQG.exe
  C:\Windows\System\iYclHQG.exe
  2⤵
  PID:14048
- C:\Windows\System\uZiYLMi.exe
  C:\Windows\System\uZiYLMi.exe
  2⤵
  PID:13964
- C:\Windows\System\mJYubPC.exe
  C:\Windows\System\mJYubPC.exe
  2⤵
  PID:14348
- C:\Windows\System\gWJhbgv.exe
  C:\Windows\System\gWJhbgv.exe
  2⤵
  PID:14388
- C:\Windows\System\KRVETqr.exe
  C:\Windows\System\KRVETqr.exe
  2⤵
  PID:14408
- C:\Windows\System\quwwnOM.exe
  C:\Windows\System\quwwnOM.exe
  2⤵
  PID:14436
- C:\Windows\System\aYIhQDc.exe
  C:\Windows\System\aYIhQDc.exe
  2⤵
  PID:14464
- C:\Windows\System\pdPFjcs.exe
  C:\Windows\System\pdPFjcs.exe
  2⤵
  PID:14500
- C:\Windows\System\QKZDHMy.exe
  C:\Windows\System\QKZDHMy.exe
  2⤵
  PID:14516
- C:\Windows\System\tJgkwBR.exe
  C:\Windows\System\tJgkwBR.exe
  2⤵
  PID:14544
- C:\Windows\System\zHtXSSx.exe
  C:\Windows\System\zHtXSSx.exe
  2⤵
  PID:14564
- C:\Windows\System\GOSljbJ.exe
  C:\Windows\System\GOSljbJ.exe
  2⤵
  PID:14592
- C:\Windows\System\EcKEEcA.exe
  C:\Windows\System\EcKEEcA.exe
  2⤵
  PID:14608
- C:\Windows\System\ppfneYa.exe
  C:\Windows\System\ppfneYa.exe
  2⤵
  PID:14640
- C:\Windows\System\NhCTNdl.exe
  C:\Windows\System\NhCTNdl.exe
  2⤵
  PID:14660
- C:\Windows\System\ijlczEH.exe
  C:\Windows\System\ijlczEH.exe
  2⤵
  PID:14688
- C:\Windows\System\GRcFtUl.exe
  C:\Windows\System\GRcFtUl.exe
  2⤵
  PID:14712
- C:\Windows\System\DWJaPYm.exe
  C:\Windows\System\DWJaPYm.exe
  2⤵
  PID:14744
- C:\Windows\System\opeqDss.exe
  C:\Windows\System\opeqDss.exe
  2⤵
  PID:14768
- C:\Windows\System\nFZOYXC.exe
  C:\Windows\System\nFZOYXC.exe
  2⤵
  PID:14788
- C:\Windows\System\zyWOotw.exe
  C:\Windows\System\zyWOotw.exe
  2⤵
  PID:14812
- C:\Windows\System\MPRvSgQ.exe
  C:\Windows\System\MPRvSgQ.exe
  2⤵
  PID:14840
- C:\Windows\System\LLUIOFz.exe
  C:\Windows\System\LLUIOFz.exe
  2⤵
  PID:14868
- C:\Windows\System\PepPorY.exe
  C:\Windows\System\PepPorY.exe
  2⤵
  PID:14892
- C:\Windows\System\ODaPoyC.exe
  C:\Windows\System\ODaPoyC.exe
  2⤵
  PID:14924
- C:\Windows\System\crEVuQV.exe
  C:\Windows\System\crEVuQV.exe
  2⤵
  PID:14944
- C:\Windows\System\jqSXvCC.exe
  C:\Windows\System\jqSXvCC.exe
  2⤵
  PID:14976
- C:\Windows\System\BFEJWAj.exe
  C:\Windows\System\BFEJWAj.exe
  2⤵
  PID:15008
- C:\Windows\System\cAfOxLw.exe
  C:\Windows\System\cAfOxLw.exe
  2⤵
  PID:15036
- C:\Windows\System\gPDKBkj.exe
  C:\Windows\System\gPDKBkj.exe
  2⤵
  PID:15068
- C:\Windows\System\iaYPPKV.exe
  C:\Windows\System\iaYPPKV.exe
  2⤵
  PID:15092
- C:\Windows\System\jDghaia.exe
  C:\Windows\System\jDghaia.exe
  2⤵
  PID:15128
- C:\Windows\System\KxYjXqw.exe
  C:\Windows\System\KxYjXqw.exe
  2⤵
  PID:15148
- C:\Windows\System\sumsylW.exe
  C:\Windows\System\sumsylW.exe
  2⤵
  PID:15172
- C:\Windows\System\OdgARbW.exe
  C:\Windows\System\OdgARbW.exe
  2⤵
  PID:15196
- C:\Windows\System\MUUFYgd.exe
  C:\Windows\System\MUUFYgd.exe
  2⤵
  PID:15232
- C:\Windows\System\LVbIxwC.exe
  C:\Windows\System\LVbIxwC.exe
  2⤵
  PID:15248
- C:\Windows\System\ObEUJpI.exe
  C:\Windows\System\ObEUJpI.exe
  2⤵
  PID:15272
- C:\Windows\System\nnVqwtM.exe
  C:\Windows\System\nnVqwtM.exe
  2⤵
  PID:15300
- C:\Windows\System\dXtIleM.exe
  C:\Windows\System\dXtIleM.exe
  2⤵
  PID:15332
- C:\Windows\System\orlXnXC.exe
  C:\Windows\System\orlXnXC.exe
  2⤵
  PID:15348
- C:\Windows\System\sYHnwUc.exe
  C:\Windows\System\sYHnwUc.exe
  2⤵
  PID:14320
- C:\Windows\System\zBAMQPq.exe
  C:\Windows\System\zBAMQPq.exe
  2⤵
  PID:14372
- C:\Windows\System\ruBDxAA.exe
  C:\Windows\System\ruBDxAA.exe
  2⤵
  PID:14432
- C:\Windows\System\rllavxs.exe
  C:\Windows\System\rllavxs.exe
  2⤵
  PID:14128
- C:\Windows\System\JOzfRRf.exe
  C:\Windows\System\JOzfRRf.exe
  2⤵
  PID:13592
- C:\Windows\System\xlzeToS.exe
  C:\Windows\System\xlzeToS.exe
  2⤵
  PID:14584
- C:\Windows\System\CsoqqZz.exe
  C:\Windows\System\CsoqqZz.exe
  2⤵
  PID:13700
- C:\Windows\System\xoEWNTP.exe
  C:\Windows\System\xoEWNTP.exe
  2⤵
  PID:14484
- C:\Windows\System\XcDuhCU.exe
  C:\Windows\System\XcDuhCU.exe
  2⤵
  PID:13504
- C:\Windows\System\cOoDdqJ.exe
  C:\Windows\System\cOoDdqJ.exe
  2⤵
  PID:14068
- C:\Windows\System\eLFftMv.exe
  C:\Windows\System\eLFftMv.exe
  2⤵
  PID:14808
- C:\Windows\System\lcihJiM.exe
  C:\Windows\System\lcihJiM.exe
  2⤵
  PID:14636
- C:\Windows\System\rTmvtBp.exe
  C:\Windows\System\rTmvtBp.exe
  2⤵
  PID:14952
- C:\Windows\System\CXwdxDZ.exe
  C:\Windows\System\CXwdxDZ.exe
  2⤵
  PID:14832
- C:\Windows\System\YNBuEjk.exe
  C:\Windows\System\YNBuEjk.exe
  2⤵
  PID:14968
- C:\Windows\System\PSXimIZ.exe
  C:\Windows\System\PSXimIZ.exe
  2⤵
  PID:14780
- C:\Windows\System\pnZcrgY.exe
  C:\Windows\System\pnZcrgY.exe
  2⤵
  PID:14856
- C:\Windows\System\aBGEusK.exe
  C:\Windows\System\aBGEusK.exe
  2⤵
  PID:15116
- C:\Windows\System\SxWQeBs.exe
  C:\Windows\System\SxWQeBs.exe
  2⤵
  PID:15188
- C:\Windows\System\mtcygCS.exe
  C:\Windows\System\mtcygCS.exe
  2⤵
  PID:14084
- C:\Windows\System\nxtkhGO.exe
  C:\Windows\System\nxtkhGO.exe
  2⤵
  PID:14620
- C:\Windows\System\ZtUBlBQ.exe
  C:\Windows\System\ZtUBlBQ.exe
  2⤵
  PID:15340
- C:\Windows\System\HnXdHJN.exe
  C:\Windows\System\HnXdHJN.exe
  2⤵
  PID:14724
- C:\Windows\System\SMDOFKI.exe
  C:\Windows\System\SMDOFKI.exe
  2⤵
  PID:15164
- C:\Windows\System\DGEJRBP.exe
  C:\Windows\System\DGEJRBP.exe
  2⤵
  PID:15216
- C:\Windows\System\LcFkBbd.exe
  C:\Windows\System\LcFkBbd.exe
  2⤵
  PID:14708
- C:\Windows\System\hBQuErx.exe
  C:\Windows\System\hBQuErx.exe
  2⤵
  PID:15380
- C:\Windows\System\WSLVHQS.exe
  C:\Windows\System\WSLVHQS.exe
  2⤵
  PID:15400
- C:\Windows\System\FmwtNZe.exe
  C:\Windows\System\FmwtNZe.exe
  2⤵
  PID:15428
- C:\Windows\System\tsLRwRR.exe
  C:\Windows\System\tsLRwRR.exe
  2⤵
  PID:15456
- C:\Windows\System\mnVeeds.exe
  C:\Windows\System\mnVeeds.exe
  2⤵
  PID:15480
- C:\Windows\System\hwQKPob.exe
  C:\Windows\System\hwQKPob.exe
  2⤵
  PID:15496
- C:\Windows\System\XudLJKN.exe
  C:\Windows\System\XudLJKN.exe
  2⤵
  PID:15536
- C:\Windows\System\OXxYDvW.exe
  C:\Windows\System\OXxYDvW.exe
  2⤵
  PID:15572
- C:\Windows\System\bxVtdTu.exe
  C:\Windows\System\bxVtdTu.exe
  2⤵
  PID:15592
- C:\Windows\System\DUpTAGn.exe
  C:\Windows\System\DUpTAGn.exe
  2⤵
  PID:15616
- C:\Windows\System\NGUgfFM.exe
  C:\Windows\System\NGUgfFM.exe
  2⤵
  PID:15648
- C:\Windows\System\AYXYqaN.exe
  C:\Windows\System\AYXYqaN.exe
  2⤵
  PID:15680
- C:\Windows\System\xZXKEeC.exe
  C:\Windows\System\xZXKEeC.exe
  2⤵
  PID:15700
- C:\Windows\System\ZSaJhDk.exe
  C:\Windows\System\ZSaJhDk.exe
  2⤵
  PID:15728
- C:\Windows\System\vaShaoR.exe
  C:\Windows\System\vaShaoR.exe
  2⤵
  PID:15760
- C:\Windows\System\CHZrpkf.exe
  C:\Windows\System\CHZrpkf.exe
  2⤵
  PID:15788
- C:\Windows\System\ndnbXha.exe
  C:\Windows\System\ndnbXha.exe
  2⤵
  PID:15816
- C:\Windows\System\gHBgEkb.exe
  C:\Windows\System\gHBgEkb.exe
  2⤵
  PID:15848
- C:\Windows\System\TqJSMmR.exe
  C:\Windows\System\TqJSMmR.exe
  2⤵
  PID:15864
- C:\Windows\System\huTyfSj.exe
  C:\Windows\System\huTyfSj.exe
  2⤵
  PID:15884
- C:\Windows\System\ZYwnpRX.exe
  C:\Windows\System\ZYwnpRX.exe
  2⤵
  PID:15904
- C:\Windows\System\QJgUImH.exe
  C:\Windows\System\QJgUImH.exe
  2⤵
  PID:15940
- C:\Windows\System\asiXJOE.exe
  C:\Windows\System\asiXJOE.exe
  2⤵
  PID:15968
- C:\Windows\System\ouRRawk.exe
  C:\Windows\System\ouRRawk.exe
  2⤵
  PID:16004
- C:\Windows\System\kcOJRVO.exe
  C:\Windows\System\kcOJRVO.exe
  2⤵
  PID:16028
- C:\Windows\System\PVBfsRK.exe
  C:\Windows\System\PVBfsRK.exe
  2⤵
  PID:16052
- C:\Windows\System\JIxKypl.exe
  C:\Windows\System\JIxKypl.exe
  2⤵
  PID:16076
- C:\Windows\System\ZNynXAv.exe
  C:\Windows\System\ZNynXAv.exe
  2⤵
  PID:16100
- C:\Windows\System\FhceVXm.exe
  C:\Windows\System\FhceVXm.exe
  2⤵
  PID:16132
- C:\Windows\System\qQWJlAi.exe
  C:\Windows\System\qQWJlAi.exe
  2⤵
  PID:16152
- C:\Windows\System\AbdvFHm.exe
  C:\Windows\System\AbdvFHm.exe
  2⤵
  PID:16176
- C:\Windows\System\EijKQNo.exe
  C:\Windows\System\EijKQNo.exe
  2⤵
  PID:16212
- C:\Windows\System\nsNtzll.exe
  C:\Windows\System\nsNtzll.exe
  2⤵
  PID:16240
- C:\Windows\System\TdBziLa.exe
  C:\Windows\System\TdBziLa.exe
  2⤵
  PID:16268
- C:\Windows\System\QHDCTUu.exe
  C:\Windows\System\QHDCTUu.exe
  2⤵
  PID:16300
- C:\Windows\System\OjhwBXk.exe
  C:\Windows\System\OjhwBXk.exe
  2⤵
  PID:16324
- C:\Windows\System\ZjKkXub.exe
  C:\Windows\System\ZjKkXub.exe
  2⤵
  PID:16356
- C:\Windows\System\ueyIBSK.exe
  C:\Windows\System\ueyIBSK.exe
  2⤵
  PID:16380
- C:\Windows\System\cDbSfsk.exe
  C:\Windows\System\cDbSfsk.exe
  2⤵
  PID:14060
- C:\Windows\System\WMzjmjz.exe
  C:\Windows\System\WMzjmjz.exe
  2⤵
  PID:12816
- C:\Windows\System\DksVfIW.exe
  C:\Windows\System\DksVfIW.exe
  2⤵
  PID:14552
- C:\Windows\System\gceYqBm.exe
  C:\Windows\System\gceYqBm.exe
  2⤵
  PID:15224
- C:\Windows\System\icZvozk.exe
  C:\Windows\System\icZvozk.exe
  2⤵
  PID:15284
- C:\Windows\System\DiLDbIh.exe
  C:\Windows\System\DiLDbIh.exe
  2⤵
  PID:14496
- C:\Windows\System\xmaWFgv.exe
  C:\Windows\System\xmaWFgv.exe
  2⤵
  PID:15420
- C:\Windows\System\TryrVGe.exe
  C:\Windows\System\TryrVGe.exe
  2⤵
  PID:15696
- C:\Windows\System\XTJoWrh.exe
  C:\Windows\System\XTJoWrh.exe
  2⤵
  PID:15756
- C:\Windows\System\LVFDZsD.exe
  C:\Windows\System\LVFDZsD.exe
  2⤵
  PID:15544
- C:\Windows\System\DMdgOHO.exe
  C:\Windows\System\DMdgOHO.exe
  2⤵
  PID:15880
- C:\Windows\System\XqhhVaU.exe
  C:\Windows\System\XqhhVaU.exe
  2⤵
  PID:15920
- C:\Windows\System\idNbuLu.exe
  C:\Windows\System\idNbuLu.exe
  2⤵
  PID:15664
- C:\Windows\System\EiPhAxr.exe
  C:\Windows\System\EiPhAxr.exe
  2⤵
  PID:16016
- C:\Windows\System\wlOGUcy.exe
  C:\Windows\System\wlOGUcy.exe
  2⤵
  PID:16024
- C:\Windows\System\SNOvBHB.exe
  C:\Windows\System\SNOvBHB.exe
  2⤵
  PID:15776
- C:\Windows\System\ZWVKFtf.exe
  C:\Windows\System\ZWVKFtf.exe
  2⤵
  PID:15860
- C:\Windows\System\zwYnIhZ.exe
  C:\Windows\System\zwYnIhZ.exe
  2⤵
  PID:16168
- C:\Windows\System\ITTlFdE.exe
  C:\Windows\System\ITTlFdE.exe
  2⤵
  PID:15628
- C:\Windows\System\PfNLNvT.exe
  C:\Windows\System\PfNLNvT.exe
  2⤵
  PID:16260
- C:\Windows\System\qjxcMVr.exe
  C:\Windows\System\qjxcMVr.exe
  2⤵
  PID:16320
- C:\Windows\System\jOdZktS.exe
  C:\Windows\System\jOdZktS.exe
  2⤵
  PID:16044
- C:\Windows\System\VkUEDMn.exe
  C:\Windows\System\VkUEDMn.exe
  2⤵
  PID:14704
- C:\Windows\System\lWBBcoq.exe
  C:\Windows\System\lWBBcoq.exe
  2⤵
  PID:16164
- C:\Windows\System\QKvypLA.exe
  C:\Windows\System\QKvypLA.exe
  2⤵
  PID:15392
- C:\Windows\System\ldiNnOC.exe
  C:\Windows\System\ldiNnOC.exe
  2⤵
  PID:15724
- C:\Windows\System\pWXmtqt.exe
  C:\Windows\System\pWXmtqt.exe
  2⤵
  PID:15912
- C:\Windows\System\iOpvhrj.exe
  C:\Windows\System\iOpvhrj.exe
  2⤵
  PID:16392
- C:\Windows\System\rcWIPVp.exe
  C:\Windows\System\rcWIPVp.exe
  2⤵
  PID:16420
- C:\Windows\System\pbwxiwK.exe
  C:\Windows\System\pbwxiwK.exe
  2⤵
  PID:16440
- C:\Windows\System\wBwLvJe.exe
  C:\Windows\System\wBwLvJe.exe
  2⤵
  PID:16464
- C:\Windows\System\AxPjQxi.exe
  C:\Windows\System\AxPjQxi.exe
  2⤵
  PID:16492
- C:\Windows\System\IzMSHRN.exe
  C:\Windows\System\IzMSHRN.exe
  2⤵
  PID:16512
- C:\Windows\System\HJMdtoB.exe
  C:\Windows\System\HJMdtoB.exe
  2⤵
  PID:16532
- C:\Windows\System\vdvFLSt.exe
  C:\Windows\System\vdvFLSt.exe
  2⤵
  PID:16556
- C:\Windows\System\fcwqfVR.exe
  C:\Windows\System\fcwqfVR.exe
  2⤵
  PID:16588
- C:\Windows\System\IlPAYZL.exe
  C:\Windows\System\IlPAYZL.exe
  2⤵
  PID:16616
- C:\Windows\System\YnCBKZs.exe
  C:\Windows\System\YnCBKZs.exe
  2⤵
  PID:16648
- C:\Windows\System\wrRVYCb.exe
  C:\Windows\System\wrRVYCb.exe
  2⤵
  PID:16680
- C:\Windows\System\yYDUktE.exe
  C:\Windows\System\yYDUktE.exe
  2⤵
  PID:16704
- C:\Windows\System\TpUtQyA.exe
  C:\Windows\System\TpUtQyA.exe
  2⤵
  PID:16728
- C:\Windows\System\TcLajAE.exe
  C:\Windows\System\TcLajAE.exe
  2⤵
  PID:16756
- C:\Windows\System\aXNcaqY.exe
  C:\Windows\System\aXNcaqY.exe
  2⤵
  PID:16780
- C:\Windows\System\lQZatQE.exe
  C:\Windows\System\lQZatQE.exe
  2⤵
  PID:16808
- C:\Windows\System\ZSUjxsc.exe
  C:\Windows\System\ZSUjxsc.exe
  2⤵
  PID:16836
- C:\Windows\System\rlzgHpF.exe
  C:\Windows\System\rlzgHpF.exe
  2⤵
  PID:16852
- C:\Windows\System\CmnrpJI.exe
  C:\Windows\System\CmnrpJI.exe
  2⤵
  PID:16884
- C:\Windows\System\hYEHMmK.exe
  C:\Windows\System\hYEHMmK.exe
  2⤵
  PID:16920
- C:\Windows\System\RhhUYZp.exe
  C:\Windows\System\RhhUYZp.exe
  2⤵
  PID:16252
- C:\Windows\System\SwxYNIw.exe
  C:\Windows\System\SwxYNIw.exe
  2⤵
  PID:16188
- C:\Windows\System\PBegtAM.exe
  C:\Windows\System\PBegtAM.exe
  2⤵
  PID:16292
- C:\Windows\System\XZWXRSX.exe
  C:\Windows\System\XZWXRSX.exe
  2⤵
  PID:15108
- C:\Windows\System\wRTGYUO.exe
  C:\Windows\System\wRTGYUO.exe
  2⤵
  PID:16140
- C:\Windows\System\zyjFhqM.exe
  C:\Windows\System\zyjFhqM.exe
  2⤵
  PID:16688
- C:\Windows\System\aAxqktn.exe
  C:\Windows\System\aAxqktn.exe
  2⤵
  PID:15692
- C:\Windows\System\IzmIsaV.exe
  C:\Windows\System\IzmIsaV.exe
  2⤵
  PID:15812
- C:\Windows\System\DVNaopM.exe
  C:\Windows\System\DVNaopM.exe
  2⤵
  PID:16896
- C:\Windows\System\kjmKVMH.exe
  C:\Windows\System\kjmKVMH.exe
  2⤵
  PID:16744
- C:\Windows\System\WnpxllY.exe
  C:\Windows\System\WnpxllY.exe
  2⤵
  PID:17152

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:17384

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\APvdKad.exe

Filesize
1.7MB

MD5
60136ce80ce9a7ce4cf3ee22dafc627b

SHA1
ffe7da58e4425205f3452ffe8d439c9274af35a2

SHA256
5474ffabc78429f39e4ed0466249de7881c676a621551b6a0a00344aa41d13ed

SHA512
700a751831bc8862f01410523fcf1da5c0769e3fe8f5f8f25405935415521feea6bb2c681c856ce42e4c0533fe0df8490b8b073292430d1e09acd1aeebe6e2fe

Download Submit
C:\Windows\System\AcCphFC.exe

Filesize
1.7MB

MD5
a28b5347a350c26891613973d68dbce7

SHA1
603dabd824383ff7f2d5d768e06475eee81e273c

SHA256
b822f8054981095b0f82a56b88f26a043c8d0b4ca137fdcc36c362e9f30891fb

SHA512
9c49d607d6cb5b7d8c790aa042acda246a665de599de55798cb81bda06e097d67363db41cb6db89b41a95a4318692623912fb95ffae42917ddd4daf18b5a25f0

Download Submit
C:\Windows\System\CEYZyUi.exe

Filesize
1.7MB

MD5
63d849724a3b1d6f6f4c6f58cbf112ea

SHA1
84ba3fc7a39707d7d1563407eb13184e51a70bbf

SHA256
fc1117582b5c2af87f70609e9a369ccebe8f2fceb04f8d387c518bc6057e27bf

SHA512
92b65cd28d3e1176ed9490fd4246f2797df0764f845a742fa3f4ca560c6cca944260cba0b272fc4dae80357ea3ffe7d0c1c775c25cb01425be80de25783bbf47

Download Submit
C:\Windows\System\DjOkngM.exe

Filesize
1.7MB

MD5
42ba0d74978c48e2c2e9e4f0682b4b77

SHA1
0b96bda943659126acf3de8469bac6766ecd7098

SHA256
dd584deab5e1f0b3e0af3e5ce3f1a4e4852bce19919af614b9bc9bd442803234

SHA512
7d5b84e198f262235d376740d568d794254e31ed8712988a80613987c4376f34822708b33c781de797d9aef391a06ef56c95b7ea0fc04a53003ba4fc977ba22c

Download Submit
C:\Windows\System\EQVyXCr.exe

Filesize
1.7MB

MD5
042ce79b44932701e9fd2e64538485eb

SHA1
7410ffc29b9aed24bb266bac1fbbe7088491ebe7

SHA256
afd4059e7e947e1f43d3d9dbc5c999f535973d9771747615086180e699955c59

SHA512
3ecd119485243c1e3088a63830a344950a5cbdf917581674aff61590d94504271a2c68feeabdfd52765c3466989992e3f74d649d8719821f0b0e5ebe7ffad91f

Download Submit
C:\Windows\System\EfWmiMU.exe

Filesize
1.7MB

MD5
8eb62bfa6cae90c4e26e39abdc2e0f3e

SHA1
b1410f0fd276e31316153008730d0c82486c5dda

SHA256
ac84c00f3a24cb8d74a4780c66a6225a878c6dc3edb0f7bc2f94908e164e751d

SHA512
e19657ad29d7950e2685bc5ee8d4f96b7a612e9576d9c399915788214113dfc1143d4525bb152ab07484067eee2b2065044da9346cf50aee79026dd0bd2877bc

Download Submit
C:\Windows\System\EvlkTcA.exe

Filesize
1.7MB

MD5
a6e5c8ca11f8dc604de965367eb6eccf

SHA1
80c0a296592e740a50b1dd06c7618f70fc9e5231

SHA256
ba38339e21a26f58543303c3f1b6da95aba9da4199824c9b03d3ad5e3a19fcef

SHA512
1c2af195190ad18d961cdc5318ff3fb650d615c73f3bb90ec9b1113ae39dbdcd4f07adcf34e8a4079f192c37e83880adb0fecd2715d902e6738753f2e5063e92

Download Submit
C:\Windows\System\FYXZedA.exe

Filesize
1.7MB

MD5
6c8fd0cea2203ab59529caf20bdbb789

SHA1
82060b6e419778b54aff0a519a82800c29d24c7a

SHA256
3ea1022e7a352afac787f15112854ebe4ee20b9b0e2585566065dbafa3db9c07

SHA512
5e13aacf93f284ef1cc81470b50d2be387a24aae6d2bb3db81518bb8887e9afa909a80dd574b6c145d6103d7323ff881997962666667ea8cf26038159ed8acc1

Download Submit
C:\Windows\System\HvniqQn.exe

Filesize
1.7MB

MD5
bf2e2f816dfbdf8b5e7e0c7203f2d670

SHA1
08ff6c4de213e8e96ab4416f821ac44305eed21e

SHA256
f48a273badcec334b09bd5517dd9c16e7112a1252786893ae6f230b88004d62a

SHA512
939fea05ee01ada7243d94737a5c447e7ea3142b1175676df5393f4522819779408820ba5f968bd7f68e6ed99e573e37b1e88cce72e023db7dd094e3b52f006a

Download Submit
C:\Windows\System\LesESqA.exe

Filesize
1.7MB

MD5
dff367241302774ac778431851c2f88a

SHA1
1e07e73d715c36c842fec39bee94edc57ad7b8dc

SHA256
6a6b97da8e8657aad5ab51a6685b097a6623e7ab27cc86bcd50cb6b5c5956a33

SHA512
c8b977835a85e5280dc808ec0f664ea7bd4445b2a95504b74c305c767460d293122274d087ebbc6ee469602478f21af35eed350a3007c91e1c0cfc67be9f31ed

Download Submit
C:\Windows\System\RGyyulc.exe

Filesize
1.7MB

MD5
03911a37eabcdf71010a27cc5f50f301

SHA1
e6a9e58a5d37bdc2dacd4faf5c68f52e6b2ce508

SHA256
487b3e34d195ec118b508da8c9f395ed47aa1cbbe147606ea386bf56ba20dd54

SHA512
28f253fbe87994b03796122971b347b4842eb5b6ed653bfeb008cac332c576833bb26253d6099b8e57d6dfe0f0ac4a8116884511b986a7ee75867748521e95d0

Download Submit
C:\Windows\System\TdXubSR.exe

Filesize
1.7MB

MD5
84ba661b848472f9e96f9fd8a3fbe62b

SHA1
276bcfe7e3fe120920462b77ba43a7e86aac818a

SHA256
32606f57b782d32019309046c8e910865f44bd474914cedd29db287f9eee4448

SHA512
ee6300c229c39c90af3939d7d84e180a790d225f43d0c4367df8b1b36b72fda8573fb75fff6d68768ef6bc7b49f200a7f48cd50adec0b9b0fa0b0729d4ce8515

Download Submit
C:\Windows\System\TeZYzoW.exe

Filesize
1.7MB

MD5
118cd5fb678da833115828180f0b2b91

SHA1
adab2cb93727d7db8cda80912797c310e9149570

SHA256
87fbb0e85a33d6ac50cec78d53a5b2002326c92471b42d8cb54ad654f679386c

SHA512
e06b3cb5fd3f76c2c3cc8e6e0b4ffc8e5f75afced669e7e3f0c0ffa0ec1780d8fef7230693e63a82a81d6ed3f9865dba241074657b3bee89cbd13465ea634eb2

Download Submit
C:\Windows\System\TvjrbzY.exe

Filesize
1.7MB

MD5
91eb9ef5d30af5525755444f633781ed

SHA1
a163cb8f974fa80f9ddf3744992b2b5371e8c294

SHA256
ab198a4b6cf4c432b4d442c6483394073702ce9567424d5a1fe397b65348a79f

SHA512
f871c63c5f091a1d734edb325f642be6d423c7ad2fd93a4a1f4325518d9b39afc3949702e433db85cbdd5dab53f0ce81c7ecbe10770eea8d9631053612cfcc9a

Download Submit
C:\Windows\System\UGDnPbk.exe

Filesize
1.7MB

MD5
f49b739c89060def4bd6f021e7dce96e

SHA1
2ed7442a354a0da9ee2ba0f2e635a0316d44f65e

SHA256
bd43b58d3d73db51a0234718b370cf8ee7d1738c8962ac77f3ac47ca2d5c3ef5

SHA512
5368344dfbfd3aced7f0f1ea647c8acdaead740fcd342e20fdb8ffcfb93f98cb553d982568f0837d6797b0537b0052d2cdc869ec3e08471df6b7b7c74f3afeee

Download Submit
C:\Windows\System\UywPTnR.exe

Filesize
1.7MB

MD5
ff8aa05d872a0ce1828668d80d4adfda

SHA1
5358653eb57a9306feb746ffc7ec5eea5c735dea

SHA256
aed50fb8479bcc44f9b326c8a85507e53da2d8852cdae95c17a0a63e7999a55e

SHA512
0b4c82b5089afd6358af2662e350337d71a97fd07c53cfd5d5ee7320ee2bab8b6d765a0a0c96c103fedb2a164d7376766c2b59f641e685a11da907cea9352801

Download Submit
C:\Windows\System\YkuOKoh.exe

Filesize
1.7MB

MD5
eacbbafd016722b2d5161219908dcc3f

SHA1
4a31eecd1ded1b8b54a9f8f9c7f0e8ec47543a6d

SHA256
906409d89983dac0aa4f943fd0129e79cee9ddcdf5bcc106378b6984c338ccd3

SHA512
8861667f159bb98662019f053ecfd13cc703d186ec25f1a301fef76e16dc93587518b94ddfd3fdbedfbd3f9502973667f2ddc93c37c43a11aa5053c34422f7f5

Download Submit
C:\Windows\System\YlHePsD.exe

Filesize
1.7MB

MD5
f6d98bf5fbda920137361f20f38b2c39

SHA1
681af7c62cc3eb73de730fc75b3f1eba62c3549d

SHA256
a922ceacee812288dcc720021b9c89d704e95917642ecfce411be5450d5c06e5

SHA512
5d0c42a9c16fc34392b761242bea984488ae6f5463b40b24e093519c9b752af11a932c1945242fc8ecab6d5c8fd0d1a20b0b7df6e29b6ac81420eaa0e2582953

Download Submit
C:\Windows\System\ZviKwof.exe

Filesize
1.7MB

MD5
d34c6bbd9ffd37bd507d9155230029db

SHA1
289aacd838c2af640b360f7fdc2cc47a274937c2

SHA256
8f1873b943bd7ddc3f1379f985e23d745de397493ea4db7d24a3656468d694e2

SHA512
b2d7a354fc8e63fcd21107c712ed3d43944c4ded3cb34f92f19541d969ad74694871e91427f3f7cfbdf41530554618df9c8e66dc0d6dd6ef074ffadfab357c43

Download Submit
C:\Windows\System\eGrRShc.exe

Filesize
1.7MB

MD5
9e5995a93f2a28e1dff4289dd907f304

SHA1
03392a2c86d280f24e081420478005dc69e1320b

SHA256
5ed1349e99b0be8f5195b5bb9a26b034e93f970d58f13bbae67e92f1d2fe2a95

SHA512
7d3aa826ac7ebb2e48dc881b6cab900ab729b148640a00b3d44b1eb0ccc448e8d21cb052b4132cdeef03562230a556ef8d60a9ba243e30e48ce8df8db662623b

Download Submit
C:\Windows\System\eZJhdDI.exe

Filesize
1.7MB

MD5
fbe56687c674d82632dd4a1242f3b200

SHA1
189910b6507203c3fee5905c488362d036498645

SHA256
d372923d98f4c6e88c265dd7745832ce5145ef031e0cf20dc90596a307210922

SHA512
2f461a2f7e52d6e4c7e762c0ec10390ce3001009114e5498d1795799cb77ce20b60d9dd40a4c8f6d2993ba6966a82a894a102f4fb0dfa6f906e6d9c8dc6fe57e

Download Submit
C:\Windows\System\evfPOhr.exe

Filesize
1.7MB

MD5
e498e0233fe2983c566808fee743aa3e

SHA1
d6ef634795ab568275ecb2d2d6f4d6ec0ac11d6c

SHA256
8c1f20dcf1eac1a722bc655c8db51add66ee8f8654df53991946b405576526af

SHA512
9033e7873220676372e9884ce676b5ed7f60e89f76d86b70901ea07fe0df16768179dc3e4cc24283b540806cbcbd543e910a26c7248dc4f700f867a273f72649

Download Submit
C:\Windows\System\gnWPmmc.exe

Filesize
1.7MB

MD5
72fc69893acbfca4c0687f0cd11293c1

SHA1
98f7256de874781504ee631b4a980d8cf136a981

SHA256
4334f5fd2d52dba325c55dc20c948e2eaf69c98f3c566fc6f003b011c79997df

SHA512
9956ec4f8bd587a7e2ffd4b39b5096718519f7428ac3318296de5ad133f3a0fc7c5823839b4a7795b7710f32dedd619311ea24c22922c476b243032b4a74593a

Download Submit
C:\Windows\System\hkTcWJj.exe

Filesize
1.7MB

MD5
5337f630de3166b3f20e4d45b65e20ea

SHA1
c2ce02be3f35781e8f3ebd526ee5dedfa582ecd9

SHA256
f1776063cd3cfd627c217988cf87b94a20b4b8a346972f0c71fb47dad7a5014e

SHA512
2935d1f467594865d52eba991c2cc2b6e8f0bbbd7866c724d48fb3ed6a3b07a39752753c7c9ebf7b6b096fbd1018828bb67c723cfaa139ec8c16e4ee0390ab4d

Download Submit
C:\Windows\System\lBdFTpk.exe

Filesize
1.7MB

MD5
cafee908952a16ad3f687b3186bb5a99

SHA1
3abfd3ba92c1ca88939455801f31d17817615a08

SHA256
5690da0421e3a553e0c999a3be0a09612dbc67715ea38febc42156e5f306f9c6

SHA512
f6c34db30087c3f261dd65a49082724905c2942d959ffb1593b6e2e166874a9ea4f9e16a7476e943cbd94d1794e45751487356bdee09a31efea8274204bfda0f

Download Submit
C:\Windows\System\nQNQmfJ.exe

Filesize
1.7MB

MD5
ae266d993211f2b159f9a2d12db5f702

SHA1
0a6c7abc805217119c6d580653eb163a3517cbd1

SHA256
fd6082dbcde668ecdb189f0e05fb2481d7e64daf63e8d0548515967fa054a5d3

SHA512
17f80e478b245ab2edd5012a433e92c4378c54a041899902c1eba75ad3375a0bc1d5489922b7bd0ad345eec58d421e9a07226d9e8938aee144844f0613e36dfa

Download Submit
C:\Windows\System\rgIYwKh.exe

Filesize
1.7MB

MD5
1b0047de34ff833a51d85d45fb646eab

SHA1
6a8d6e2d3237f0b8cabd48fbb35ad0a0f670559e

SHA256
fae65e2007daa3b70c7ac5f340b32e6aaaa98388d50a138bb5fbb22273265f95

SHA512
ff1ff667e7f24d21132b35a8112c20fdd946cde550dbd6045a1d0afe1e0f3ad4f866e8e7a9b96c98f75005153cb6f9885f7747f5a508455c6db49e80ae4f78b4

Download Submit
C:\Windows\System\sdoiChj.exe

Filesize
1.7MB

MD5
d1b09fe09d4fb45780d57362e7339273

SHA1
96cc63dbbff8c6a3c978276a61d32c02cb128e83

SHA256
b73b8d9f230b5b20c5cc560dc06fc0d139248e0193ccc7f42199f7f9003f59ff

SHA512
84fd8204c36ae2005863004c5222c7df544fbc22b8fba3ef095e665b5813b783671606b9aa7e754a14ae4a6c311037f6dac0516836f6ba7053c9c0c4fc42343f

Download Submit
C:\Windows\System\xKCqgHW.exe

Filesize
1.7MB

MD5
f510a5dfb8b5554e1b76853d7b62e51a

SHA1
de89ec4227e4af56c8f8357a0e50cf0270e81067

SHA256
c96c34882f7cc5b46708d1c6173b7c6477663b0b756344b849e78302f4350c58

SHA512
f2993a2e49e090609c6a7ec937cc8fc851fe92e7d0ef8ba3fdfdcfdfd087c0a66a9c6804d5092ef0d5e93a8a15db1e6b127205c3fe1aa5559532d452de895ef5

Download Submit
C:\Windows\System\xprttYk.exe

Filesize
1.7MB

MD5
c9347dcdb00c30e483be9eb02e8228a3

SHA1
af6f7254abd63a4404c31a6483e0ca4fce5bf41d

SHA256
035aac0e8c0c5e294bb78063ead9bc0993adc20209c2febc215afcaf3a165ad9

SHA512
2c132eb907e09c09c5db25f7824190f6639f4fad01f9afd86b3e7e7249509ebdcd66df7cf1241147d1fb33c557cf38e1213b1899b69e864263515c6e23cb739e

Download Submit
C:\Windows\System\xtwZkIS.exe

Filesize
1.7MB

MD5
a0840161d038d8215060c362fb09f1d8

SHA1
e921aa72edc6304d1bab633726249c1f7b950db5

SHA256
d71768ea189241d7e90889bebf76398085aa82383e8b28a35739d21938ef3744

SHA512
3214e619d05c3b114ce428c68cede0e98fb7756138f26003203ee51c8b5aba7b5bee5751f4fea66ca4162701b3e75dbb6d5469928b3fbc96792a4610183bea5d

Download Submit
C:\Windows\System\zefgcEx.exe

Filesize
1.7MB

MD5
1b9c83b3146f4330f75e64ca281eb8f9

SHA1
9ea5f5b6e1bf522ca780472ff9fe0becb6a86068

SHA256
a7e3b88e8a5375bbe3f705382587ff22831784f24a7a2014d2d16cee208e4f1c

SHA512
ac1bef763579e03a65eae808e350d3b9647ef4e0b9807e8812b6323e58990b45f634d425d989ddbe7006b184fbb5aca8a7a6656fe50618d81e26883aec8e67b0

Download Submit
C:\Windows\System\zfRJjcR.exe

Filesize
1.7MB

MD5
6075d49b720d37fac8a7fabbe21b0605

SHA1
10a0687114a94a2eb6f1265f5f31a3abeb800ece

SHA256
21cb95860c0b2a9862e84eb0f15cb9d1f738ba39deaee3a244937823d4b8da43

SHA512
8250e12025ee26af3502da2c4355368ac95010d6a95edd5a2b4a2287af43ccb5efb8abee5ddb9ac35a65f15dfdec3cd90efe26fa524f4bdad115747017249265

Download Submit
memory/1272-0-0x000001EEB07D0000-0x000001EEB07E0000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads