xmrig | 1b8709794511e170ae18d46693e326312ac2ce49d32adb450cf70a1754fb0e57

Analysis

max time kernel
149s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
23-12-2024 19:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1b8709794511e170ae18d46693e326312ac2ce49d32adb450cf70a1754fb0e57.exe
Size

1.6MB
MD5

f8f3555fd7b257397fb643f2744eb039
SHA1

764226525ede85ed7ab900610980d535a485fb66
SHA256

1b8709794511e170ae18d46693e326312ac2ce49d32adb450cf70a1754fb0e57
SHA512

3e1e6fd9392b8e4afad5f941b09b0dff5883a1d9119cec1348ef9ff1367bfe36ecb23d71d07ea83fa498e4b7fc93bd2e494c6557cd2f1e1c3c5521fb8234efda
SSDEEP

49152:GezaTF8FcNkNdfE0pZ9ozttwIRxjaXdbxR9EX:GemTLkNdfE0pZyZ

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 35 IoCs

miner

resource	yara_rule
behavioral2/files/0x000c000000023b93-4.dat	xmrig
behavioral2/files/0x0007000000023c86-6.dat	xmrig
behavioral2/files/0x0007000000023c87-15.dat	xmrig
behavioral2/files/0x0007000000023c8d-41.dat	xmrig
behavioral2/files/0x0007000000023c8a-65.dat	xmrig
behavioral2/files/0x0007000000023c94-64.dat	xmrig
behavioral2/files/0x0007000000023c93-83.dat	xmrig
behavioral2/files/0x0007000000023c96-96.dat	xmrig
behavioral2/files/0x0007000000023c98-98.dat	xmrig
behavioral2/files/0x0007000000023c9b-115.dat	xmrig
behavioral2/files/0x0007000000023c9a-114.dat	xmrig
behavioral2/files/0x0007000000023c99-113.dat	xmrig
behavioral2/files/0x0007000000023c97-109.dat	xmrig
behavioral2/files/0x0007000000023c95-103.dat	xmrig
behavioral2/files/0x0007000000023c92-81.dat	xmrig
behavioral2/files/0x0007000000023c91-79.dat	xmrig
behavioral2/files/0x0007000000023c90-77.dat	xmrig
behavioral2/files/0x0007000000023c8f-75.dat	xmrig
behavioral2/files/0x0007000000023c8e-73.dat	xmrig
behavioral2/files/0x0007000000023c8c-69.dat	xmrig
behavioral2/files/0x0007000000023c8b-67.dat	xmrig
behavioral2/files/0x0007000000023c89-62.dat	xmrig
behavioral2/files/0x0007000000023c88-26.dat	xmrig
behavioral2/files/0x0008000000023c82-16.dat	xmrig
behavioral2/files/0x0008000000023c83-128.dat	xmrig
behavioral2/files/0x0007000000023ca2-146.dat	xmrig
behavioral2/files/0x0007000000023c9f-144.dat	xmrig
behavioral2/files/0x0007000000023ca5-163.dat	xmrig
behavioral2/files/0x0007000000023ca0-164.dat	xmrig
behavioral2/files/0x0007000000023ca4-162.dat	xmrig
behavioral2/files/0x0007000000023ca1-158.dat	xmrig
behavioral2/files/0x0007000000023c9e-154.dat	xmrig
behavioral2/files/0x0007000000023ca6-172.dat	xmrig
behavioral2/files/0x0007000000023ca3-153.dat	xmrig
behavioral2/files/0x0007000000023c9c-134.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2148	MkzFeiv.exe
1408	FmeKzzu.exe
432	diDYFep.exe
3532	gcPttTN.exe
4232	sDobjxS.exe
1892	cXIbOre.exe
400	AfgROiJ.exe
916	wfBgXvC.exe
4060	nqsetYv.exe
3236	EPXCtfo.exe
2208	XYSFWoF.exe
4984	tDmcXmY.exe
3492	xfrIqlO.exe
3964	pbaxnlh.exe
2176	WrCKxOG.exe
3852	IWewSMU.exe
1676	AuxohdB.exe
4044	AcQbiXt.exe
4872	YHrtUvy.exe
3232	sirQFXC.exe
4888	twcfJFX.exe
3512	ZnMpyPr.exe
4304	tlZAZQu.exe
3900	uoUQHAd.exe
2692	BZkPgnQ.exe
3416	LIosjhX.exe
1972	TXjZPzd.exe
3544	TwQmuiM.exe
4456	WhQuwJc.exe
1012	OKfaDGh.exe
3472	GroBdkM.exe
4680	zMlvDHD.exe
880	miYvLeg.exe
4876	iDABcIO.exe
2328	yYRZBEk.exe
64	aZwKuWf.exe
2280	qtkLLYl.exe
884	jFyNxYV.exe
1008	YxCxvyO.exe
1264	iiFDHiw.exe
1516	RfDYaxv.exe
640	dQHSfYR.exe
4180	ZJdukfz.exe
2884	LlDccDo.exe
4500	mYDVjWw.exe
1744	kilgZFm.exe
4612	keUGFFH.exe
1804	TsQhxhr.exe
1652	fWjRSyy.exe
3352	oNJhevZ.exe
3968	OSuVIkm.exe
4312	ohexqfs.exe
3528	aUbsIjy.exe
4532	xDIyJph.exe
3384	uoVNrWO.exe
4484	cEfdFtE.exe
1832	uCKbKRf.exe
4824	yovjngq.exe
4404	TwYyedm.exe
1628	wlDSSNF.exe
4772	kaEEXsC.exe
224	hAtaLMl.exe
3432	tEohxfQ.exe
4472	CxCMwEK.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\pAUHFHQ.exe	1b8709794511e170ae18d46693e326312ac2ce49d32adb450cf70a1754fb0e57.exe
File created	C:\Windows\System\mRxRGTW.exe	1b8709794511e170ae18d46693e326312ac2ce49d32adb450cf70a1754fb0e57.exe
File created	C:\Windows\System\BYEpQdr.exe	1b8709794511e170ae18d46693e326312ac2ce49d32adb450cf70a1754fb0e57.exe
File created	C:\Windows\System\miYvLeg.exe	1b8709794511e170ae18d46693e326312ac2ce49d32adb450cf70a1754fb0e57.exe
File created	C:\Windows\System\zCwERNj.exe	1b8709794511e170ae18d46693e326312ac2ce49d32adb450cf70a1754fb0e57.exe
File created	C:\Windows\System\KcQzROw.exe	1b8709794511e170ae18d46693e326312ac2ce49d32adb450cf70a1754fb0e57.exe
File created	C:\Windows\System\siGAsIi.exe	1b8709794511e170ae18d46693e326312ac2ce49d32adb450cf70a1754fb0e57.exe
File created	C:\Windows\System\nVohgAX.exe	1b8709794511e170ae18d46693e326312ac2ce49d32adb450cf70a1754fb0e57.exe
File created	C:\Windows\System\twgSGvI.exe	1b8709794511e170ae18d46693e326312ac2ce49d32adb450cf70a1754fb0e57.exe
File created	C:\Windows\System\cwPbdlK.exe	1b8709794511e170ae18d46693e326312ac2ce49d32adb450cf70a1754fb0e57.exe
File created	C:\Windows\System\qUOCqQL.exe	1b8709794511e170ae18d46693e326312ac2ce49d32adb450cf70a1754fb0e57.exe
File created	C:\Windows\System\BReAcWl.exe	1b8709794511e170ae18d46693e326312ac2ce49d32adb450cf70a1754fb0e57.exe
File created	C:\Windows\System\ZOHFiyu.exe	1b8709794511e170ae18d46693e326312ac2ce49d32adb450cf70a1754fb0e57.exe
File created	C:\Windows\System\xZZCVil.exe	1b8709794511e170ae18d46693e326312ac2ce49d32adb450cf70a1754fb0e57.exe
File created	C:\Windows\System\OvlAOcV.exe	1b8709794511e170ae18d46693e326312ac2ce49d32adb450cf70a1754fb0e57.exe
File created	C:\Windows\System\qFecetY.exe	1b8709794511e170ae18d46693e326312ac2ce49d32adb450cf70a1754fb0e57.exe
File created	C:\Windows\System\mjTpqYj.exe	1b8709794511e170ae18d46693e326312ac2ce49d32adb450cf70a1754fb0e57.exe
File created	C:\Windows\System\oBJAGMD.exe	1b8709794511e170ae18d46693e326312ac2ce49d32adb450cf70a1754fb0e57.exe
File created	C:\Windows\System\xnOGoId.exe	1b8709794511e170ae18d46693e326312ac2ce49d32adb450cf70a1754fb0e57.exe
File created	C:\Windows\System\tNxlCft.exe	1b8709794511e170ae18d46693e326312ac2ce49d32adb450cf70a1754fb0e57.exe
File created	C:\Windows\System\ttfNhUE.exe	1b8709794511e170ae18d46693e326312ac2ce49d32adb450cf70a1754fb0e57.exe
File created	C:\Windows\System\wsfNVKh.exe	1b8709794511e170ae18d46693e326312ac2ce49d32adb450cf70a1754fb0e57.exe
File created	C:\Windows\System\nhVJxcR.exe	1b8709794511e170ae18d46693e326312ac2ce49d32adb450cf70a1754fb0e57.exe
File created	C:\Windows\System\aZwKuWf.exe	1b8709794511e170ae18d46693e326312ac2ce49d32adb450cf70a1754fb0e57.exe
File created	C:\Windows\System\ARMREVL.exe	1b8709794511e170ae18d46693e326312ac2ce49d32adb450cf70a1754fb0e57.exe
File created	C:\Windows\System\ZapyKmI.exe	1b8709794511e170ae18d46693e326312ac2ce49d32adb450cf70a1754fb0e57.exe
File created	C:\Windows\System\rsJpEJy.exe	1b8709794511e170ae18d46693e326312ac2ce49d32adb450cf70a1754fb0e57.exe
File created	C:\Windows\System\gHnBCdL.exe	1b8709794511e170ae18d46693e326312ac2ce49d32adb450cf70a1754fb0e57.exe
File created	C:\Windows\System\MzsyAJF.exe	1b8709794511e170ae18d46693e326312ac2ce49d32adb450cf70a1754fb0e57.exe
File created	C:\Windows\System\AaStPrB.exe	1b8709794511e170ae18d46693e326312ac2ce49d32adb450cf70a1754fb0e57.exe
File created	C:\Windows\System\vldeVHV.exe	1b8709794511e170ae18d46693e326312ac2ce49d32adb450cf70a1754fb0e57.exe
File created	C:\Windows\System\amgsAop.exe	1b8709794511e170ae18d46693e326312ac2ce49d32adb450cf70a1754fb0e57.exe
File created	C:\Windows\System\mAlVBmS.exe	1b8709794511e170ae18d46693e326312ac2ce49d32adb450cf70a1754fb0e57.exe
File created	C:\Windows\System\KvQtAcW.exe	1b8709794511e170ae18d46693e326312ac2ce49d32adb450cf70a1754fb0e57.exe
File created	C:\Windows\System\MnUCuku.exe	1b8709794511e170ae18d46693e326312ac2ce49d32adb450cf70a1754fb0e57.exe
File created	C:\Windows\System\kaEEXsC.exe	1b8709794511e170ae18d46693e326312ac2ce49d32adb450cf70a1754fb0e57.exe
File created	C:\Windows\System\ePZThkf.exe	1b8709794511e170ae18d46693e326312ac2ce49d32adb450cf70a1754fb0e57.exe
File created	C:\Windows\System\qWtEAnY.exe	1b8709794511e170ae18d46693e326312ac2ce49d32adb450cf70a1754fb0e57.exe
File created	C:\Windows\System\xjNgUdU.exe	1b8709794511e170ae18d46693e326312ac2ce49d32adb450cf70a1754fb0e57.exe
File created	C:\Windows\System\UafJgwm.exe	1b8709794511e170ae18d46693e326312ac2ce49d32adb450cf70a1754fb0e57.exe
File created	C:\Windows\System\VvOZOok.exe	1b8709794511e170ae18d46693e326312ac2ce49d32adb450cf70a1754fb0e57.exe
File created	C:\Windows\System\iQagrqw.exe	1b8709794511e170ae18d46693e326312ac2ce49d32adb450cf70a1754fb0e57.exe
File created	C:\Windows\System\ZaZmFAc.exe	1b8709794511e170ae18d46693e326312ac2ce49d32adb450cf70a1754fb0e57.exe
File created	C:\Windows\System\PvhzPuk.exe	1b8709794511e170ae18d46693e326312ac2ce49d32adb450cf70a1754fb0e57.exe
File created	C:\Windows\System\jGSxwXH.exe	1b8709794511e170ae18d46693e326312ac2ce49d32adb450cf70a1754fb0e57.exe
File created	C:\Windows\System\qYMqvjC.exe	1b8709794511e170ae18d46693e326312ac2ce49d32adb450cf70a1754fb0e57.exe
File created	C:\Windows\System\xujbzFT.exe	1b8709794511e170ae18d46693e326312ac2ce49d32adb450cf70a1754fb0e57.exe
File created	C:\Windows\System\uYQvuDw.exe	1b8709794511e170ae18d46693e326312ac2ce49d32adb450cf70a1754fb0e57.exe
File created	C:\Windows\System\tAOxGrc.exe	1b8709794511e170ae18d46693e326312ac2ce49d32adb450cf70a1754fb0e57.exe
File created	C:\Windows\System\xppUKOq.exe	1b8709794511e170ae18d46693e326312ac2ce49d32adb450cf70a1754fb0e57.exe
File created	C:\Windows\System\tWCRIOF.exe	1b8709794511e170ae18d46693e326312ac2ce49d32adb450cf70a1754fb0e57.exe
File created	C:\Windows\System\nZROaSb.exe	1b8709794511e170ae18d46693e326312ac2ce49d32adb450cf70a1754fb0e57.exe
File created	C:\Windows\System\YAcjmyT.exe	1b8709794511e170ae18d46693e326312ac2ce49d32adb450cf70a1754fb0e57.exe
File created	C:\Windows\System\TtPnxCt.exe	1b8709794511e170ae18d46693e326312ac2ce49d32adb450cf70a1754fb0e57.exe
File created	C:\Windows\System\lmCJIUV.exe	1b8709794511e170ae18d46693e326312ac2ce49d32adb450cf70a1754fb0e57.exe
File created	C:\Windows\System\HYBCbzZ.exe	1b8709794511e170ae18d46693e326312ac2ce49d32adb450cf70a1754fb0e57.exe
File created	C:\Windows\System\PKVPACy.exe	1b8709794511e170ae18d46693e326312ac2ce49d32adb450cf70a1754fb0e57.exe
File created	C:\Windows\System\rTqUFaF.exe	1b8709794511e170ae18d46693e326312ac2ce49d32adb450cf70a1754fb0e57.exe
File created	C:\Windows\System\idSAIIf.exe	1b8709794511e170ae18d46693e326312ac2ce49d32adb450cf70a1754fb0e57.exe
File created	C:\Windows\System\pzFRlLe.exe	1b8709794511e170ae18d46693e326312ac2ce49d32adb450cf70a1754fb0e57.exe
File created	C:\Windows\System\rmbPNuH.exe	1b8709794511e170ae18d46693e326312ac2ce49d32adb450cf70a1754fb0e57.exe
File created	C:\Windows\System\axTcsdW.exe	1b8709794511e170ae18d46693e326312ac2ce49d32adb450cf70a1754fb0e57.exe
File created	C:\Windows\System\YcIYayD.exe	1b8709794511e170ae18d46693e326312ac2ce49d32adb450cf70a1754fb0e57.exe
File created	C:\Windows\System\CRziVch.exe	1b8709794511e170ae18d46693e326312ac2ce49d32adb450cf70a1754fb0e57.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	16908	dwm.exe
Token: SeChangeNotifyPrivilege	16908	dwm.exe
Token: 33	16908	dwm.exe
Token: SeIncBasePriorityPrivilege	16908	dwm.exe
Token: SeShutdownPrivilege	16908	dwm.exe
Token: SeCreatePagefilePrivilege	16908	dwm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4688 wrote to memory of 2148	4688	1b8709794511e170ae18d46693e326312ac2ce49d32adb450cf70a1754fb0e57.exe	84
PID 4688 wrote to memory of 2148	4688	1b8709794511e170ae18d46693e326312ac2ce49d32adb450cf70a1754fb0e57.exe	84
PID 4688 wrote to memory of 1408	4688	1b8709794511e170ae18d46693e326312ac2ce49d32adb450cf70a1754fb0e57.exe	85
PID 4688 wrote to memory of 1408	4688	1b8709794511e170ae18d46693e326312ac2ce49d32adb450cf70a1754fb0e57.exe	85
PID 4688 wrote to memory of 432	4688	1b8709794511e170ae18d46693e326312ac2ce49d32adb450cf70a1754fb0e57.exe	86
PID 4688 wrote to memory of 432	4688	1b8709794511e170ae18d46693e326312ac2ce49d32adb450cf70a1754fb0e57.exe	86
PID 4688 wrote to memory of 3532	4688	1b8709794511e170ae18d46693e326312ac2ce49d32adb450cf70a1754fb0e57.exe	87
PID 4688 wrote to memory of 3532	4688	1b8709794511e170ae18d46693e326312ac2ce49d32adb450cf70a1754fb0e57.exe	87
PID 4688 wrote to memory of 4232	4688	1b8709794511e170ae18d46693e326312ac2ce49d32adb450cf70a1754fb0e57.exe	88
PID 4688 wrote to memory of 4232	4688	1b8709794511e170ae18d46693e326312ac2ce49d32adb450cf70a1754fb0e57.exe	88
PID 4688 wrote to memory of 1892	4688	1b8709794511e170ae18d46693e326312ac2ce49d32adb450cf70a1754fb0e57.exe	89
PID 4688 wrote to memory of 1892	4688	1b8709794511e170ae18d46693e326312ac2ce49d32adb450cf70a1754fb0e57.exe	89
PID 4688 wrote to memory of 400	4688	1b8709794511e170ae18d46693e326312ac2ce49d32adb450cf70a1754fb0e57.exe	90
PID 4688 wrote to memory of 400	4688	1b8709794511e170ae18d46693e326312ac2ce49d32adb450cf70a1754fb0e57.exe	90
PID 4688 wrote to memory of 916	4688	1b8709794511e170ae18d46693e326312ac2ce49d32adb450cf70a1754fb0e57.exe	91
PID 4688 wrote to memory of 916	4688	1b8709794511e170ae18d46693e326312ac2ce49d32adb450cf70a1754fb0e57.exe	91
PID 4688 wrote to memory of 4060	4688	1b8709794511e170ae18d46693e326312ac2ce49d32adb450cf70a1754fb0e57.exe	92
PID 4688 wrote to memory of 4060	4688	1b8709794511e170ae18d46693e326312ac2ce49d32adb450cf70a1754fb0e57.exe	92
PID 4688 wrote to memory of 3236	4688	1b8709794511e170ae18d46693e326312ac2ce49d32adb450cf70a1754fb0e57.exe	93
PID 4688 wrote to memory of 3236	4688	1b8709794511e170ae18d46693e326312ac2ce49d32adb450cf70a1754fb0e57.exe	93
PID 4688 wrote to memory of 2208	4688	1b8709794511e170ae18d46693e326312ac2ce49d32adb450cf70a1754fb0e57.exe	94
PID 4688 wrote to memory of 2208	4688	1b8709794511e170ae18d46693e326312ac2ce49d32adb450cf70a1754fb0e57.exe	94
PID 4688 wrote to memory of 4984	4688	1b8709794511e170ae18d46693e326312ac2ce49d32adb450cf70a1754fb0e57.exe	95
PID 4688 wrote to memory of 4984	4688	1b8709794511e170ae18d46693e326312ac2ce49d32adb450cf70a1754fb0e57.exe	95
PID 4688 wrote to memory of 3492	4688	1b8709794511e170ae18d46693e326312ac2ce49d32adb450cf70a1754fb0e57.exe	96
PID 4688 wrote to memory of 3492	4688	1b8709794511e170ae18d46693e326312ac2ce49d32adb450cf70a1754fb0e57.exe	96
PID 4688 wrote to memory of 3964	4688	1b8709794511e170ae18d46693e326312ac2ce49d32adb450cf70a1754fb0e57.exe	97
PID 4688 wrote to memory of 3964	4688	1b8709794511e170ae18d46693e326312ac2ce49d32adb450cf70a1754fb0e57.exe	97
PID 4688 wrote to memory of 2176	4688	1b8709794511e170ae18d46693e326312ac2ce49d32adb450cf70a1754fb0e57.exe	98
PID 4688 wrote to memory of 2176	4688	1b8709794511e170ae18d46693e326312ac2ce49d32adb450cf70a1754fb0e57.exe	98
PID 4688 wrote to memory of 3852	4688	1b8709794511e170ae18d46693e326312ac2ce49d32adb450cf70a1754fb0e57.exe	99
PID 4688 wrote to memory of 3852	4688	1b8709794511e170ae18d46693e326312ac2ce49d32adb450cf70a1754fb0e57.exe	99
PID 4688 wrote to memory of 1676	4688	1b8709794511e170ae18d46693e326312ac2ce49d32adb450cf70a1754fb0e57.exe	100
PID 4688 wrote to memory of 1676	4688	1b8709794511e170ae18d46693e326312ac2ce49d32adb450cf70a1754fb0e57.exe	100
PID 4688 wrote to memory of 4044	4688	1b8709794511e170ae18d46693e326312ac2ce49d32adb450cf70a1754fb0e57.exe	101
PID 4688 wrote to memory of 4044	4688	1b8709794511e170ae18d46693e326312ac2ce49d32adb450cf70a1754fb0e57.exe	101
PID 4688 wrote to memory of 4872	4688	1b8709794511e170ae18d46693e326312ac2ce49d32adb450cf70a1754fb0e57.exe	102
PID 4688 wrote to memory of 4872	4688	1b8709794511e170ae18d46693e326312ac2ce49d32adb450cf70a1754fb0e57.exe	102
PID 4688 wrote to memory of 3232	4688	1b8709794511e170ae18d46693e326312ac2ce49d32adb450cf70a1754fb0e57.exe	103
PID 4688 wrote to memory of 3232	4688	1b8709794511e170ae18d46693e326312ac2ce49d32adb450cf70a1754fb0e57.exe	103
PID 4688 wrote to memory of 4888	4688	1b8709794511e170ae18d46693e326312ac2ce49d32adb450cf70a1754fb0e57.exe	104
PID 4688 wrote to memory of 4888	4688	1b8709794511e170ae18d46693e326312ac2ce49d32adb450cf70a1754fb0e57.exe	104
PID 4688 wrote to memory of 3512	4688	1b8709794511e170ae18d46693e326312ac2ce49d32adb450cf70a1754fb0e57.exe	105
PID 4688 wrote to memory of 3512	4688	1b8709794511e170ae18d46693e326312ac2ce49d32adb450cf70a1754fb0e57.exe	105
PID 4688 wrote to memory of 4304	4688	1b8709794511e170ae18d46693e326312ac2ce49d32adb450cf70a1754fb0e57.exe	106
PID 4688 wrote to memory of 4304	4688	1b8709794511e170ae18d46693e326312ac2ce49d32adb450cf70a1754fb0e57.exe	106
PID 4688 wrote to memory of 3900	4688	1b8709794511e170ae18d46693e326312ac2ce49d32adb450cf70a1754fb0e57.exe	107
PID 4688 wrote to memory of 3900	4688	1b8709794511e170ae18d46693e326312ac2ce49d32adb450cf70a1754fb0e57.exe	107
PID 4688 wrote to memory of 2692	4688	1b8709794511e170ae18d46693e326312ac2ce49d32adb450cf70a1754fb0e57.exe	108
PID 4688 wrote to memory of 2692	4688	1b8709794511e170ae18d46693e326312ac2ce49d32adb450cf70a1754fb0e57.exe	108
PID 4688 wrote to memory of 3416	4688	1b8709794511e170ae18d46693e326312ac2ce49d32adb450cf70a1754fb0e57.exe	109
PID 4688 wrote to memory of 3416	4688	1b8709794511e170ae18d46693e326312ac2ce49d32adb450cf70a1754fb0e57.exe	109
PID 4688 wrote to memory of 1972	4688	1b8709794511e170ae18d46693e326312ac2ce49d32adb450cf70a1754fb0e57.exe	110
PID 4688 wrote to memory of 1972	4688	1b8709794511e170ae18d46693e326312ac2ce49d32adb450cf70a1754fb0e57.exe	110
PID 4688 wrote to memory of 1012	4688	1b8709794511e170ae18d46693e326312ac2ce49d32adb450cf70a1754fb0e57.exe	111
PID 4688 wrote to memory of 1012	4688	1b8709794511e170ae18d46693e326312ac2ce49d32adb450cf70a1754fb0e57.exe	111
PID 4688 wrote to memory of 3544	4688	1b8709794511e170ae18d46693e326312ac2ce49d32adb450cf70a1754fb0e57.exe	112
PID 4688 wrote to memory of 3544	4688	1b8709794511e170ae18d46693e326312ac2ce49d32adb450cf70a1754fb0e57.exe	112
PID 4688 wrote to memory of 4456	4688	1b8709794511e170ae18d46693e326312ac2ce49d32adb450cf70a1754fb0e57.exe	113
PID 4688 wrote to memory of 4456	4688	1b8709794511e170ae18d46693e326312ac2ce49d32adb450cf70a1754fb0e57.exe	113
PID 4688 wrote to memory of 3472	4688	1b8709794511e170ae18d46693e326312ac2ce49d32adb450cf70a1754fb0e57.exe	114
PID 4688 wrote to memory of 3472	4688	1b8709794511e170ae18d46693e326312ac2ce49d32adb450cf70a1754fb0e57.exe	114
PID 4688 wrote to memory of 4680	4688	1b8709794511e170ae18d46693e326312ac2ce49d32adb450cf70a1754fb0e57.exe	115
PID 4688 wrote to memory of 4680	4688	1b8709794511e170ae18d46693e326312ac2ce49d32adb450cf70a1754fb0e57.exe	115

C:\Users\Admin\AppData\Local\Temp\1b8709794511e170ae18d46693e326312ac2ce49d32adb450cf70a1754fb0e57.exe
"C:\Users\Admin\AppData\Local\Temp\1b8709794511e170ae18d46693e326312ac2ce49d32adb450cf70a1754fb0e57.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4688
- C:\Windows\System\MkzFeiv.exe
  C:\Windows\System\MkzFeiv.exe
  2⤵
  - Executes dropped EXE
  PID:2148
- C:\Windows\System\FmeKzzu.exe
  C:\Windows\System\FmeKzzu.exe
  2⤵
  - Executes dropped EXE
  PID:1408
- C:\Windows\System\diDYFep.exe
  C:\Windows\System\diDYFep.exe
  2⤵
  - Executes dropped EXE
  PID:432
- C:\Windows\System\gcPttTN.exe
  C:\Windows\System\gcPttTN.exe
  2⤵
  - Executes dropped EXE
  PID:3532
- C:\Windows\System\sDobjxS.exe
  C:\Windows\System\sDobjxS.exe
  2⤵
  - Executes dropped EXE
  PID:4232
- C:\Windows\System\cXIbOre.exe
  C:\Windows\System\cXIbOre.exe
  2⤵
  - Executes dropped EXE
  PID:1892
- C:\Windows\System\AfgROiJ.exe
  C:\Windows\System\AfgROiJ.exe
  2⤵
  - Executes dropped EXE
  PID:400
- C:\Windows\System\wfBgXvC.exe
  C:\Windows\System\wfBgXvC.exe
  2⤵
  - Executes dropped EXE
  PID:916
- C:\Windows\System\nqsetYv.exe
  C:\Windows\System\nqsetYv.exe
  2⤵
  - Executes dropped EXE
  PID:4060
- C:\Windows\System\EPXCtfo.exe
  C:\Windows\System\EPXCtfo.exe
  2⤵
  - Executes dropped EXE
  PID:3236
- C:\Windows\System\XYSFWoF.exe
  C:\Windows\System\XYSFWoF.exe
  2⤵
  - Executes dropped EXE
  PID:2208
- C:\Windows\System\tDmcXmY.exe
  C:\Windows\System\tDmcXmY.exe
  2⤵
  - Executes dropped EXE
  PID:4984
- C:\Windows\System\xfrIqlO.exe
  C:\Windows\System\xfrIqlO.exe
  2⤵
  - Executes dropped EXE
  PID:3492
- C:\Windows\System\pbaxnlh.exe
  C:\Windows\System\pbaxnlh.exe
  2⤵
  - Executes dropped EXE
  PID:3964
- C:\Windows\System\WrCKxOG.exe
  C:\Windows\System\WrCKxOG.exe
  2⤵
  - Executes dropped EXE
  PID:2176
- C:\Windows\System\IWewSMU.exe
  C:\Windows\System\IWewSMU.exe
  2⤵
  - Executes dropped EXE
  PID:3852
- C:\Windows\System\AuxohdB.exe
  C:\Windows\System\AuxohdB.exe
  2⤵
  - Executes dropped EXE
  PID:1676
- C:\Windows\System\AcQbiXt.exe
  C:\Windows\System\AcQbiXt.exe
  2⤵
  - Executes dropped EXE
  PID:4044
- C:\Windows\System\YHrtUvy.exe
  C:\Windows\System\YHrtUvy.exe
  2⤵
  - Executes dropped EXE
  PID:4872
- C:\Windows\System\sirQFXC.exe
  C:\Windows\System\sirQFXC.exe
  2⤵
  - Executes dropped EXE
  PID:3232
- C:\Windows\System\twcfJFX.exe
  C:\Windows\System\twcfJFX.exe
  2⤵
  - Executes dropped EXE
  PID:4888
- C:\Windows\System\ZnMpyPr.exe
  C:\Windows\System\ZnMpyPr.exe
  2⤵
  - Executes dropped EXE
  PID:3512
- C:\Windows\System\tlZAZQu.exe
  C:\Windows\System\tlZAZQu.exe
  2⤵
  - Executes dropped EXE
  PID:4304
- C:\Windows\System\uoUQHAd.exe
  C:\Windows\System\uoUQHAd.exe
  2⤵
  - Executes dropped EXE
  PID:3900
- C:\Windows\System\BZkPgnQ.exe
  C:\Windows\System\BZkPgnQ.exe
  2⤵
  - Executes dropped EXE
  PID:2692
- C:\Windows\System\LIosjhX.exe
  C:\Windows\System\LIosjhX.exe
  2⤵
  - Executes dropped EXE
  PID:3416
- C:\Windows\System\TXjZPzd.exe
  C:\Windows\System\TXjZPzd.exe
  2⤵
  - Executes dropped EXE
  PID:1972
- C:\Windows\System\OKfaDGh.exe
  C:\Windows\System\OKfaDGh.exe
  2⤵
  - Executes dropped EXE
  PID:1012
- C:\Windows\System\TwQmuiM.exe
  C:\Windows\System\TwQmuiM.exe
  2⤵
  - Executes dropped EXE
  PID:3544
- C:\Windows\System\WhQuwJc.exe
  C:\Windows\System\WhQuwJc.exe
  2⤵
  - Executes dropped EXE
  PID:4456
- C:\Windows\System\GroBdkM.exe
  C:\Windows\System\GroBdkM.exe
  2⤵
  - Executes dropped EXE
  PID:3472
- C:\Windows\System\zMlvDHD.exe
  C:\Windows\System\zMlvDHD.exe
  2⤵
  - Executes dropped EXE
  PID:4680
- C:\Windows\System\miYvLeg.exe
  C:\Windows\System\miYvLeg.exe
  2⤵
  - Executes dropped EXE
  PID:880
- C:\Windows\System\iDABcIO.exe
  C:\Windows\System\iDABcIO.exe
  2⤵
  - Executes dropped EXE
  PID:4876
- C:\Windows\System\yYRZBEk.exe
  C:\Windows\System\yYRZBEk.exe
  2⤵
  - Executes dropped EXE
  PID:2328
- C:\Windows\System\aZwKuWf.exe
  C:\Windows\System\aZwKuWf.exe
  2⤵
  - Executes dropped EXE
  PID:64
- C:\Windows\System\qtkLLYl.exe
  C:\Windows\System\qtkLLYl.exe
  2⤵
  - Executes dropped EXE
  PID:2280
- C:\Windows\System\jFyNxYV.exe
  C:\Windows\System\jFyNxYV.exe
  2⤵
  - Executes dropped EXE
  PID:884
- C:\Windows\System\YxCxvyO.exe
  C:\Windows\System\YxCxvyO.exe
  2⤵
  - Executes dropped EXE
  PID:1008
- C:\Windows\System\iiFDHiw.exe
  C:\Windows\System\iiFDHiw.exe
  2⤵
  - Executes dropped EXE
  PID:1264
- C:\Windows\System\RfDYaxv.exe
  C:\Windows\System\RfDYaxv.exe
  2⤵
  - Executes dropped EXE
  PID:1516
- C:\Windows\System\dQHSfYR.exe
  C:\Windows\System\dQHSfYR.exe
  2⤵
  - Executes dropped EXE
  PID:640
- C:\Windows\System\ZJdukfz.exe
  C:\Windows\System\ZJdukfz.exe
  2⤵
  - Executes dropped EXE
  PID:4180
- C:\Windows\System\LlDccDo.exe
  C:\Windows\System\LlDccDo.exe
  2⤵
  - Executes dropped EXE
  PID:2884
- C:\Windows\System\mYDVjWw.exe
  C:\Windows\System\mYDVjWw.exe
  2⤵
  - Executes dropped EXE
  PID:4500
- C:\Windows\System\kilgZFm.exe
  C:\Windows\System\kilgZFm.exe
  2⤵
  - Executes dropped EXE
  PID:1744
- C:\Windows\System\keUGFFH.exe
  C:\Windows\System\keUGFFH.exe
  2⤵
  - Executes dropped EXE
  PID:4612
- C:\Windows\System\TsQhxhr.exe
  C:\Windows\System\TsQhxhr.exe
  2⤵
  - Executes dropped EXE
  PID:1804
- C:\Windows\System\fWjRSyy.exe
  C:\Windows\System\fWjRSyy.exe
  2⤵
  - Executes dropped EXE
  PID:1652
- C:\Windows\System\oNJhevZ.exe
  C:\Windows\System\oNJhevZ.exe
  2⤵
  - Executes dropped EXE
  PID:3352
- C:\Windows\System\OSuVIkm.exe
  C:\Windows\System\OSuVIkm.exe
  2⤵
  - Executes dropped EXE
  PID:3968
- C:\Windows\System\ohexqfs.exe
  C:\Windows\System\ohexqfs.exe
  2⤵
  - Executes dropped EXE
  PID:4312
- C:\Windows\System\aUbsIjy.exe
  C:\Windows\System\aUbsIjy.exe
  2⤵
  - Executes dropped EXE
  PID:3528
- C:\Windows\System\xDIyJph.exe
  C:\Windows\System\xDIyJph.exe
  2⤵
  - Executes dropped EXE
  PID:4532
- C:\Windows\System\uoVNrWO.exe
  C:\Windows\System\uoVNrWO.exe
  2⤵
  - Executes dropped EXE
  PID:3384
- C:\Windows\System\cEfdFtE.exe
  C:\Windows\System\cEfdFtE.exe
  2⤵
  - Executes dropped EXE
  PID:4484
- C:\Windows\System\yovjngq.exe
  C:\Windows\System\yovjngq.exe
  2⤵
  - Executes dropped EXE
  PID:4824
- C:\Windows\System\uCKbKRf.exe
  C:\Windows\System\uCKbKRf.exe
  2⤵
  - Executes dropped EXE
  PID:1832
- C:\Windows\System\TwYyedm.exe
  C:\Windows\System\TwYyedm.exe
  2⤵
  - Executes dropped EXE
  PID:4404
- C:\Windows\System\kaEEXsC.exe
  C:\Windows\System\kaEEXsC.exe
  2⤵
  - Executes dropped EXE
  PID:4772
- C:\Windows\System\wlDSSNF.exe
  C:\Windows\System\wlDSSNF.exe
  2⤵
  - Executes dropped EXE
  PID:1628
- C:\Windows\System\hAtaLMl.exe
  C:\Windows\System\hAtaLMl.exe
  2⤵
  - Executes dropped EXE
  PID:224
- C:\Windows\System\tEohxfQ.exe
  C:\Windows\System\tEohxfQ.exe
  2⤵
  - Executes dropped EXE
  PID:3432
- C:\Windows\System\CxCMwEK.exe
  C:\Windows\System\CxCMwEK.exe
  2⤵
  - Executes dropped EXE
  PID:4472
- C:\Windows\System\eJuYNcd.exe
  C:\Windows\System\eJuYNcd.exe
  2⤵
  PID:4712
- C:\Windows\System\PNRnEcL.exe
  C:\Windows\System\PNRnEcL.exe
  2⤵
  PID:540
- C:\Windows\System\cACUwcc.exe
  C:\Windows\System\cACUwcc.exe
  2⤵
  PID:1968
- C:\Windows\System\FylScGd.exe
  C:\Windows\System\FylScGd.exe
  2⤵
  PID:5004
- C:\Windows\System\sPvdGfc.exe
  C:\Windows\System\sPvdGfc.exe
  2⤵
  PID:556
- C:\Windows\System\FolGYbP.exe
  C:\Windows\System\FolGYbP.exe
  2⤵
  PID:1448
- C:\Windows\System\pAUHFHQ.exe
  C:\Windows\System\pAUHFHQ.exe
  2⤵
  PID:1236
- C:\Windows\System\iViSEsa.exe
  C:\Windows\System\iViSEsa.exe
  2⤵
  PID:2496
- C:\Windows\System\yXvMEsw.exe
  C:\Windows\System\yXvMEsw.exe
  2⤵
  PID:4588
- C:\Windows\System\fUziRod.exe
  C:\Windows\System\fUziRod.exe
  2⤵
  PID:440
- C:\Windows\System\aauxpzC.exe
  C:\Windows\System\aauxpzC.exe
  2⤵
  PID:1096
- C:\Windows\System\PvjBigh.exe
  C:\Windows\System\PvjBigh.exe
  2⤵
  PID:4488
- C:\Windows\System\oeylzEC.exe
  C:\Windows\System\oeylzEC.exe
  2⤵
  PID:3488
- C:\Windows\System\qrSxRjP.exe
  C:\Windows\System\qrSxRjP.exe
  2⤵
  PID:1308
- C:\Windows\System\WtlUDbV.exe
  C:\Windows\System\WtlUDbV.exe
  2⤵
  PID:4928
- C:\Windows\System\URWhPEd.exe
  C:\Windows\System\URWhPEd.exe
  2⤵
  PID:2412
- C:\Windows\System\xhlvBmv.exe
  C:\Windows\System\xhlvBmv.exe
  2⤵
  PID:1884
- C:\Windows\System\sZTkiLx.exe
  C:\Windows\System\sZTkiLx.exe
  2⤵
  PID:4508
- C:\Windows\System\HFZnpOy.exe
  C:\Windows\System\HFZnpOy.exe
  2⤵
  PID:1092
- C:\Windows\System\nwEmbqc.exe
  C:\Windows\System\nwEmbqc.exe
  2⤵
  PID:4668
- C:\Windows\System\dnSUPVD.exe
  C:\Windows\System\dnSUPVD.exe
  2⤵
  PID:1140
- C:\Windows\System\pqbzCLk.exe
  C:\Windows\System\pqbzCLk.exe
  2⤵
  PID:4684
- C:\Windows\System\uwkufoy.exe
  C:\Windows\System\uwkufoy.exe
  2⤵
  PID:3200
- C:\Windows\System\vZlqnMQ.exe
  C:\Windows\System\vZlqnMQ.exe
  2⤵
  PID:2596
- C:\Windows\System\pspJOCh.exe
  C:\Windows\System\pspJOCh.exe
  2⤵
  PID:2232
- C:\Windows\System\UwtIkPn.exe
  C:\Windows\System\UwtIkPn.exe
  2⤵
  PID:3984
- C:\Windows\System\hcVLKvW.exe
  C:\Windows\System\hcVLKvW.exe
  2⤵
  PID:3332
- C:\Windows\System\YEXuMcb.exe
  C:\Windows\System\YEXuMcb.exe
  2⤵
  PID:3548
- C:\Windows\System\YSTXkAC.exe
  C:\Windows\System\YSTXkAC.exe
  2⤵
  PID:2640
- C:\Windows\System\jcHXKLD.exe
  C:\Windows\System\jcHXKLD.exe
  2⤵
  PID:5064
- C:\Windows\System\ePZThkf.exe
  C:\Windows\System\ePZThkf.exe
  2⤵
  PID:1856
- C:\Windows\System\QCALsKe.exe
  C:\Windows\System\QCALsKe.exe
  2⤵
  PID:804
- C:\Windows\System\xVMbILV.exe
  C:\Windows\System\xVMbILV.exe
  2⤵
  PID:4620
- C:\Windows\System\ehxsPSy.exe
  C:\Windows\System\ehxsPSy.exe
  2⤵
  PID:1908
- C:\Windows\System\DxijCuq.exe
  C:\Windows\System\DxijCuq.exe
  2⤵
  PID:3004
- C:\Windows\System\cFHjekV.exe
  C:\Windows\System\cFHjekV.exe
  2⤵
  PID:264
- C:\Windows\System\xurdHEc.exe
  C:\Windows\System\xurdHEc.exe
  2⤵
  PID:2960
- C:\Windows\System\EYsRBYw.exe
  C:\Windows\System\EYsRBYw.exe
  2⤵
  PID:2888
- C:\Windows\System\XeiKqAB.exe
  C:\Windows\System\XeiKqAB.exe
  2⤵
  PID:3608
- C:\Windows\System\uYQvuDw.exe
  C:\Windows\System\uYQvuDw.exe
  2⤵
  PID:4736
- C:\Windows\System\rwBAxGE.exe
  C:\Windows\System\rwBAxGE.exe
  2⤵
  PID:2644
- C:\Windows\System\bagWsTP.exe
  C:\Windows\System\bagWsTP.exe
  2⤵
  PID:4716
- C:\Windows\System\jfGvzNJ.exe
  C:\Windows\System\jfGvzNJ.exe
  2⤵
  PID:4696
- C:\Windows\System\QQHPqmF.exe
  C:\Windows\System\QQHPqmF.exe
  2⤵
  PID:5020
- C:\Windows\System\SaYkjxj.exe
  C:\Windows\System\SaYkjxj.exe
  2⤵
  PID:760
- C:\Windows\System\DmtjjQQ.exe
  C:\Windows\System\DmtjjQQ.exe
  2⤵
  PID:4436
- C:\Windows\System\pCApARo.exe
  C:\Windows\System\pCApARo.exe
  2⤵
  PID:4596
- C:\Windows\System\fdptrAJ.exe
  C:\Windows\System\fdptrAJ.exe
  2⤵
  PID:5136
- C:\Windows\System\onUVgaq.exe
  C:\Windows\System\onUVgaq.exe
  2⤵
  PID:5152
- C:\Windows\System\SeOYpnM.exe
  C:\Windows\System\SeOYpnM.exe
  2⤵
  PID:5168
- C:\Windows\System\HYBCbzZ.exe
  C:\Windows\System\HYBCbzZ.exe
  2⤵
  PID:5192
- C:\Windows\System\zmhXiNM.exe
  C:\Windows\System\zmhXiNM.exe
  2⤵
  PID:5220
- C:\Windows\System\ioRsvKr.exe
  C:\Windows\System\ioRsvKr.exe
  2⤵
  PID:5236
- C:\Windows\System\ZBsNnAM.exe
  C:\Windows\System\ZBsNnAM.exe
  2⤵
  PID:5252
- C:\Windows\System\NffGFMv.exe
  C:\Windows\System\NffGFMv.exe
  2⤵
  PID:5280
- C:\Windows\System\mceFgBG.exe
  C:\Windows\System\mceFgBG.exe
  2⤵
  PID:5300
- C:\Windows\System\hoPUtdH.exe
  C:\Windows\System\hoPUtdH.exe
  2⤵
  PID:5324
- C:\Windows\System\vcrkcFo.exe
  C:\Windows\System\vcrkcFo.exe
  2⤵
  PID:5340
- C:\Windows\System\pSBTiQA.exe
  C:\Windows\System\pSBTiQA.exe
  2⤵
  PID:5356
- C:\Windows\System\gtMcsLJ.exe
  C:\Windows\System\gtMcsLJ.exe
  2⤵
  PID:5376
- C:\Windows\System\WCgNKnP.exe
  C:\Windows\System\WCgNKnP.exe
  2⤵
  PID:5416
- C:\Windows\System\BTLxIjQ.exe
  C:\Windows\System\BTLxIjQ.exe
  2⤵
  PID:5440
- C:\Windows\System\hDmHuKu.exe
  C:\Windows\System\hDmHuKu.exe
  2⤵
  PID:5476
- C:\Windows\System\GbVAGtW.exe
  C:\Windows\System\GbVAGtW.exe
  2⤵
  PID:5500
- C:\Windows\System\hCaJHYM.exe
  C:\Windows\System\hCaJHYM.exe
  2⤵
  PID:5532
- C:\Windows\System\tCMIpxr.exe
  C:\Windows\System\tCMIpxr.exe
  2⤵
  PID:5560
- C:\Windows\System\mYBVAzJ.exe
  C:\Windows\System\mYBVAzJ.exe
  2⤵
  PID:5596
- C:\Windows\System\EhpMtzp.exe
  C:\Windows\System\EhpMtzp.exe
  2⤵
  PID:5628
- C:\Windows\System\eWmfmul.exe
  C:\Windows\System\eWmfmul.exe
  2⤵
  PID:5652
- C:\Windows\System\ClUaGnU.exe
  C:\Windows\System\ClUaGnU.exe
  2⤵
  PID:5684
- C:\Windows\System\XoumMOk.exe
  C:\Windows\System\XoumMOk.exe
  2⤵
  PID:5712
- C:\Windows\System\YyXpBGx.exe
  C:\Windows\System\YyXpBGx.exe
  2⤵
  PID:5736
- C:\Windows\System\LEEvffo.exe
  C:\Windows\System\LEEvffo.exe
  2⤵
  PID:5772
- C:\Windows\System\NjMxWGf.exe
  C:\Windows\System\NjMxWGf.exe
  2⤵
  PID:5812
- C:\Windows\System\oCHSocd.exe
  C:\Windows\System\oCHSocd.exe
  2⤵
  PID:5836
- C:\Windows\System\CCPvvpS.exe
  C:\Windows\System\CCPvvpS.exe
  2⤵
  PID:5860
- C:\Windows\System\ZoFSRMx.exe
  C:\Windows\System\ZoFSRMx.exe
  2⤵
  PID:5900
- C:\Windows\System\fHZDzbt.exe
  C:\Windows\System\fHZDzbt.exe
  2⤵
  PID:5928
- C:\Windows\System\nbOrsiN.exe
  C:\Windows\System\nbOrsiN.exe
  2⤵
  PID:5960
- C:\Windows\System\QETRWyk.exe
  C:\Windows\System\QETRWyk.exe
  2⤵
  PID:5996
- C:\Windows\System\cwPbdlK.exe
  C:\Windows\System\cwPbdlK.exe
  2⤵
  PID:6028
- C:\Windows\System\jGSxwXH.exe
  C:\Windows\System\jGSxwXH.exe
  2⤵
  PID:6060
- C:\Windows\System\VSeZHhP.exe
  C:\Windows\System\VSeZHhP.exe
  2⤵
  PID:6088
- C:\Windows\System\LjXhAka.exe
  C:\Windows\System\LjXhAka.exe
  2⤵
  PID:6124
- C:\Windows\System\IngFvad.exe
  C:\Windows\System\IngFvad.exe
  2⤵
  PID:5164
- C:\Windows\System\hKjjChJ.exe
  C:\Windows\System\hKjjChJ.exe
  2⤵
  PID:5232
- C:\Windows\System\gApWkOn.exe
  C:\Windows\System\gApWkOn.exe
  2⤵
  PID:5288
- C:\Windows\System\ORaUJRi.exe
  C:\Windows\System\ORaUJRi.exe
  2⤵
  PID:5204
- C:\Windows\System\OVxdLlf.exe
  C:\Windows\System\OVxdLlf.exe
  2⤵
  PID:5332
- C:\Windows\System\tIbBvUx.exe
  C:\Windows\System\tIbBvUx.exe
  2⤵
  PID:5316
- C:\Windows\System\ujyYvHJ.exe
  C:\Windows\System\ujyYvHJ.exe
  2⤵
  PID:5520
- C:\Windows\System\wLaRxhC.exe
  C:\Windows\System\wLaRxhC.exe
  2⤵
  PID:5556
- C:\Windows\System\bSOLefT.exe
  C:\Windows\System\bSOLefT.exe
  2⤵
  PID:5548
- C:\Windows\System\NrIJqnC.exe
  C:\Windows\System\NrIJqnC.exe
  2⤵
  PID:5648
- C:\Windows\System\WvbaoRr.exe
  C:\Windows\System\WvbaoRr.exe
  2⤵
  PID:5728
- C:\Windows\System\JKECSdX.exe
  C:\Windows\System\JKECSdX.exe
  2⤵
  PID:5724
- C:\Windows\System\ghiVrfd.exe
  C:\Windows\System\ghiVrfd.exe
  2⤵
  PID:5848
- C:\Windows\System\QmqufXV.exe
  C:\Windows\System\QmqufXV.exe
  2⤵
  PID:5916
- C:\Windows\System\KVMdVJe.exe
  C:\Windows\System\KVMdVJe.exe
  2⤵
  PID:5988
- C:\Windows\System\yaIqZwf.exe
  C:\Windows\System\yaIqZwf.exe
  2⤵
  PID:6024
- C:\Windows\System\fbmqfhe.exe
  C:\Windows\System\fbmqfhe.exe
  2⤵
  PID:6108
- C:\Windows\System\ukcypXb.exe
  C:\Windows\System\ukcypXb.exe
  2⤵
  PID:5144
- C:\Windows\System\vLXYIAB.exe
  C:\Windows\System\vLXYIAB.exe
  2⤵
  PID:5400
- C:\Windows\System\FsEvZlm.exe
  C:\Windows\System\FsEvZlm.exe
  2⤵
  PID:5372
- C:\Windows\System\qGxWbSw.exe
  C:\Windows\System\qGxWbSw.exe
  2⤵
  PID:5508
- C:\Windows\System\pzFRlLe.exe
  C:\Windows\System\pzFRlLe.exe
  2⤵
  PID:5692
- C:\Windows\System\FJXPPgC.exe
  C:\Windows\System\FJXPPgC.exe
  2⤵
  PID:5912
- C:\Windows\System\hNKosEO.exe
  C:\Windows\System\hNKosEO.exe
  2⤵
  PID:5732
- C:\Windows\System\NbhOvpg.exe
  C:\Windows\System\NbhOvpg.exe
  2⤵
  PID:5464
- C:\Windows\System\fvqgAGa.exe
  C:\Windows\System\fvqgAGa.exe
  2⤵
  PID:5880
- C:\Windows\System\rHeeLby.exe
  C:\Windows\System\rHeeLby.exe
  2⤵
  PID:6156
- C:\Windows\System\mRxRGTW.exe
  C:\Windows\System\mRxRGTW.exe
  2⤵
  PID:6184
- C:\Windows\System\TJLOBAv.exe
  C:\Windows\System\TJLOBAv.exe
  2⤵
  PID:6220
- C:\Windows\System\CRziVch.exe
  C:\Windows\System\CRziVch.exe
  2⤵
  PID:6248
- C:\Windows\System\eMdaoXV.exe
  C:\Windows\System\eMdaoXV.exe
  2⤵
  PID:6276
- C:\Windows\System\vXJAFmc.exe
  C:\Windows\System\vXJAFmc.exe
  2⤵
  PID:6308
- C:\Windows\System\BqzlTNm.exe
  C:\Windows\System\BqzlTNm.exe
  2⤵
  PID:6328
- C:\Windows\System\ijZlUqj.exe
  C:\Windows\System\ijZlUqj.exe
  2⤵
  PID:6360
- C:\Windows\System\mjTpqYj.exe
  C:\Windows\System\mjTpqYj.exe
  2⤵
  PID:6384
- C:\Windows\System\LPJBwar.exe
  C:\Windows\System\LPJBwar.exe
  2⤵
  PID:6412
- C:\Windows\System\ENuTCBQ.exe
  C:\Windows\System\ENuTCBQ.exe
  2⤵
  PID:6432
- C:\Windows\System\PYZYzxD.exe
  C:\Windows\System\PYZYzxD.exe
  2⤵
  PID:6460
- C:\Windows\System\VbrckWM.exe
  C:\Windows\System\VbrckWM.exe
  2⤵
  PID:6496
- C:\Windows\System\KcJNrdH.exe
  C:\Windows\System\KcJNrdH.exe
  2⤵
  PID:6524
- C:\Windows\System\PKVPACy.exe
  C:\Windows\System\PKVPACy.exe
  2⤵
  PID:6564
- C:\Windows\System\NrMnAUj.exe
  C:\Windows\System\NrMnAUj.exe
  2⤵
  PID:6604
- C:\Windows\System\aSRzfPb.exe
  C:\Windows\System\aSRzfPb.exe
  2⤵
  PID:6636
- C:\Windows\System\vpArwfc.exe
  C:\Windows\System\vpArwfc.exe
  2⤵
  PID:6656
- C:\Windows\System\lMBEMYG.exe
  C:\Windows\System\lMBEMYG.exe
  2⤵
  PID:6676
- C:\Windows\System\lbzQLDw.exe
  C:\Windows\System\lbzQLDw.exe
  2⤵
  PID:6704
- C:\Windows\System\rbFAluU.exe
  C:\Windows\System\rbFAluU.exe
  2⤵
  PID:6736
- C:\Windows\System\nAPrOXR.exe
  C:\Windows\System\nAPrOXR.exe
  2⤵
  PID:6772
- C:\Windows\System\YENQTJD.exe
  C:\Windows\System\YENQTJD.exe
  2⤵
  PID:6804
- C:\Windows\System\obNlsdh.exe
  C:\Windows\System\obNlsdh.exe
  2⤵
  PID:6832
- C:\Windows\System\yqvHNbo.exe
  C:\Windows\System\yqvHNbo.exe
  2⤵
  PID:6868
- C:\Windows\System\ZJRGDsG.exe
  C:\Windows\System\ZJRGDsG.exe
  2⤵
  PID:6900
- C:\Windows\System\stEkpwI.exe
  C:\Windows\System\stEkpwI.exe
  2⤵
  PID:6932
- C:\Windows\System\iNlsRII.exe
  C:\Windows\System\iNlsRII.exe
  2⤵
  PID:6956
- C:\Windows\System\iIUqoVb.exe
  C:\Windows\System\iIUqoVb.exe
  2⤵
  PID:6980
- C:\Windows\System\CjdOUUs.exe
  C:\Windows\System\CjdOUUs.exe
  2⤵
  PID:7008
- C:\Windows\System\qAdexEF.exe
  C:\Windows\System\qAdexEF.exe
  2⤵
  PID:7032
- C:\Windows\System\SAWfEff.exe
  C:\Windows\System\SAWfEff.exe
  2⤵
  PID:7060
- C:\Windows\System\SahFNEg.exe
  C:\Windows\System\SahFNEg.exe
  2⤵
  PID:7088
- C:\Windows\System\HVDFCEy.exe
  C:\Windows\System\HVDFCEy.exe
  2⤵
  PID:7116
- C:\Windows\System\rJHBEbh.exe
  C:\Windows\System\rJHBEbh.exe
  2⤵
  PID:7144
- C:\Windows\System\tsBpvIP.exe
  C:\Windows\System\tsBpvIP.exe
  2⤵
  PID:5180
- C:\Windows\System\SKcPnOv.exe
  C:\Windows\System\SKcPnOv.exe
  2⤵
  PID:5800
- C:\Windows\System\jCFSIME.exe
  C:\Windows\System\jCFSIME.exe
  2⤵
  PID:6176
- C:\Windows\System\vfOhvfx.exe
  C:\Windows\System\vfOhvfx.exe
  2⤵
  PID:6204
- C:\Windows\System\jKqYhWC.exe
  C:\Windows\System\jKqYhWC.exe
  2⤵
  PID:6168
- C:\Windows\System\LpYrxUA.exe
  C:\Windows\System\LpYrxUA.exe
  2⤵
  PID:6316
- C:\Windows\System\EDHtPSR.exe
  C:\Windows\System\EDHtPSR.exe
  2⤵
  PID:6420
- C:\Windows\System\AWbWEqM.exe
  C:\Windows\System\AWbWEqM.exe
  2⤵
  PID:6484
- C:\Windows\System\tNxlCft.exe
  C:\Windows\System\tNxlCft.exe
  2⤵
  PID:6504
- C:\Windows\System\mRERNgu.exe
  C:\Windows\System\mRERNgu.exe
  2⤵
  PID:6624
- C:\Windows\System\AvGhgko.exe
  C:\Windows\System\AvGhgko.exe
  2⤵
  PID:6684
- C:\Windows\System\hayUGGB.exe
  C:\Windows\System\hayUGGB.exe
  2⤵
  PID:6716
- C:\Windows\System\ADbxeSt.exe
  C:\Windows\System\ADbxeSt.exe
  2⤵
  PID:6864
- C:\Windows\System\IhsTiiC.exe
  C:\Windows\System\IhsTiiC.exe
  2⤵
  PID:6888
- C:\Windows\System\cwblhiq.exe
  C:\Windows\System\cwblhiq.exe
  2⤵
  PID:6920
- C:\Windows\System\xppUKOq.exe
  C:\Windows\System\xppUKOq.exe
  2⤵
  PID:7020
- C:\Windows\System\axTcsdW.exe
  C:\Windows\System\axTcsdW.exe
  2⤵
  PID:7068
- C:\Windows\System\RLpHowA.exe
  C:\Windows\System\RLpHowA.exe
  2⤵
  PID:7048
- C:\Windows\System\KfrPDYR.exe
  C:\Windows\System\KfrPDYR.exe
  2⤵
  PID:6084
- C:\Windows\System\QKaTxnt.exe
  C:\Windows\System\QKaTxnt.exe
  2⤵
  PID:6140
- C:\Windows\System\RMSpPpm.exe
  C:\Windows\System\RMSpPpm.exe
  2⤵
  PID:6264
- C:\Windows\System\NQHImHw.exe
  C:\Windows\System\NQHImHw.exe
  2⤵
  PID:6300
- C:\Windows\System\LbXeOjW.exe
  C:\Windows\System\LbXeOjW.exe
  2⤵
  PID:6752
- C:\Windows\System\eUAOgBk.exe
  C:\Windows\System\eUAOgBk.exe
  2⤵
  PID:6792
- C:\Windows\System\VTFcMQs.exe
  C:\Windows\System\VTFcMQs.exe
  2⤵
  PID:6976
- C:\Windows\System\uErPcPF.exe
  C:\Windows\System\uErPcPF.exe
  2⤵
  PID:7104
- C:\Windows\System\EJTywtn.exe
  C:\Windows\System\EJTywtn.exe
  2⤵
  PID:7124
- C:\Windows\System\gHnBCdL.exe
  C:\Windows\System\gHnBCdL.exe
  2⤵
  PID:6720
- C:\Windows\System\VIemtKE.exe
  C:\Windows\System\VIemtKE.exe
  2⤵
  PID:6876
- C:\Windows\System\eFWclUX.exe
  C:\Windows\System\eFWclUX.exe
  2⤵
  PID:7192
- C:\Windows\System\VvOZOok.exe
  C:\Windows\System\VvOZOok.exe
  2⤵
  PID:7220
- C:\Windows\System\zTBkiKX.exe
  C:\Windows\System\zTBkiKX.exe
  2⤵
  PID:7240
- C:\Windows\System\yfQFaVc.exe
  C:\Windows\System\yfQFaVc.exe
  2⤵
  PID:7260
- C:\Windows\System\EnMhiYE.exe
  C:\Windows\System\EnMhiYE.exe
  2⤵
  PID:7284
- C:\Windows\System\QpPCyyc.exe
  C:\Windows\System\QpPCyyc.exe
  2⤵
  PID:7312
- C:\Windows\System\vzJBERD.exe
  C:\Windows\System\vzJBERD.exe
  2⤵
  PID:7344
- C:\Windows\System\UdBElqT.exe
  C:\Windows\System\UdBElqT.exe
  2⤵
  PID:7376
- C:\Windows\System\UsBRWSE.exe
  C:\Windows\System\UsBRWSE.exe
  2⤵
  PID:7404
- C:\Windows\System\jsFJiUl.exe
  C:\Windows\System\jsFJiUl.exe
  2⤵
  PID:7440
- C:\Windows\System\YebDKDi.exe
  C:\Windows\System\YebDKDi.exe
  2⤵
  PID:7464
- C:\Windows\System\DXjIsek.exe
  C:\Windows\System\DXjIsek.exe
  2⤵
  PID:7500
- C:\Windows\System\JLlpuOC.exe
  C:\Windows\System\JLlpuOC.exe
  2⤵
  PID:7528
- C:\Windows\System\mopselx.exe
  C:\Windows\System\mopselx.exe
  2⤵
  PID:7552
- C:\Windows\System\fYDFiiU.exe
  C:\Windows\System\fYDFiiU.exe
  2⤵
  PID:7576
- C:\Windows\System\vvaNTgC.exe
  C:\Windows\System\vvaNTgC.exe
  2⤵
  PID:7592
- C:\Windows\System\wFrNGSI.exe
  C:\Windows\System\wFrNGSI.exe
  2⤵
  PID:7620
- C:\Windows\System\CZcxoxA.exe
  C:\Windows\System\CZcxoxA.exe
  2⤵
  PID:7648
- C:\Windows\System\PjKkwWN.exe
  C:\Windows\System\PjKkwWN.exe
  2⤵
  PID:7676
- C:\Windows\System\BteUbGU.exe
  C:\Windows\System\BteUbGU.exe
  2⤵
  PID:7712
- C:\Windows\System\AIdcjNR.exe
  C:\Windows\System\AIdcjNR.exe
  2⤵
  PID:7740
- C:\Windows\System\wsfNVKh.exe
  C:\Windows\System\wsfNVKh.exe
  2⤵
  PID:7768
- C:\Windows\System\cFYBNlk.exe
  C:\Windows\System\cFYBNlk.exe
  2⤵
  PID:7796
- C:\Windows\System\MCIEEqK.exe
  C:\Windows\System\MCIEEqK.exe
  2⤵
  PID:7824
- C:\Windows\System\qUOCqQL.exe
  C:\Windows\System\qUOCqQL.exe
  2⤵
  PID:7856
- C:\Windows\System\NjCoDHJ.exe
  C:\Windows\System\NjCoDHJ.exe
  2⤵
  PID:7884
- C:\Windows\System\zQZXSkl.exe
  C:\Windows\System\zQZXSkl.exe
  2⤵
  PID:7920
- C:\Windows\System\aWGjcne.exe
  C:\Windows\System\aWGjcne.exe
  2⤵
  PID:7952
- C:\Windows\System\KNxxeWj.exe
  C:\Windows\System\KNxxeWj.exe
  2⤵
  PID:7988
- C:\Windows\System\sEhnsKx.exe
  C:\Windows\System\sEhnsKx.exe
  2⤵
  PID:8004
- C:\Windows\System\qrQehpT.exe
  C:\Windows\System\qrQehpT.exe
  2⤵
  PID:8028
- C:\Windows\System\amgsAop.exe
  C:\Windows\System\amgsAop.exe
  2⤵
  PID:8052
- C:\Windows\System\NeqAYwT.exe
  C:\Windows\System\NeqAYwT.exe
  2⤵
  PID:8080
- C:\Windows\System\lgwhbLt.exe
  C:\Windows\System\lgwhbLt.exe
  2⤵
  PID:8112
- C:\Windows\System\oBJAGMD.exe
  C:\Windows\System\oBJAGMD.exe
  2⤵
  PID:8140
- C:\Windows\System\mKotfSB.exe
  C:\Windows\System\mKotfSB.exe
  2⤵
  PID:8164
- C:\Windows\System\iQagrqw.exe
  C:\Windows\System\iQagrqw.exe
  2⤵
  PID:6116
- C:\Windows\System\xSZlwfi.exe
  C:\Windows\System\xSZlwfi.exe
  2⤵
  PID:7212
- C:\Windows\System\gBNcshP.exe
  C:\Windows\System\gBNcshP.exe
  2⤵
  PID:7280
- C:\Windows\System\iDTXbBY.exe
  C:\Windows\System\iDTXbBY.exe
  2⤵
  PID:7308
- C:\Windows\System\QOhKork.exe
  C:\Windows\System\QOhKork.exe
  2⤵
  PID:7336
- C:\Windows\System\SzJHHoj.exe
  C:\Windows\System\SzJHHoj.exe
  2⤵
  PID:7332
- C:\Windows\System\uTGlwuW.exe
  C:\Windows\System\uTGlwuW.exe
  2⤵
  PID:7388
- C:\Windows\System\IWTgjiP.exe
  C:\Windows\System\IWTgjiP.exe
  2⤵
  PID:7524
- C:\Windows\System\tWCRIOF.exe
  C:\Windows\System\tWCRIOF.exe
  2⤵
  PID:7608
- C:\Windows\System\ivRSrtq.exe
  C:\Windows\System\ivRSrtq.exe
  2⤵
  PID:5452
- C:\Windows\System\DHVkXOC.exe
  C:\Windows\System\DHVkXOC.exe
  2⤵
  PID:7688
- C:\Windows\System\kEgPkXQ.exe
  C:\Windows\System\kEgPkXQ.exe
  2⤵
  PID:7812
- C:\Windows\System\THCVndS.exe
  C:\Windows\System\THCVndS.exe
  2⤵
  PID:7868
- C:\Windows\System\rmbPNuH.exe
  C:\Windows\System\rmbPNuH.exe
  2⤵
  PID:8024
- C:\Windows\System\TeHdHvn.exe
  C:\Windows\System\TeHdHvn.exe
  2⤵
  PID:7980
- C:\Windows\System\IfkWGcc.exe
  C:\Windows\System\IfkWGcc.exe
  2⤵
  PID:8076
- C:\Windows\System\vQPQBBU.exe
  C:\Windows\System\vQPQBBU.exe
  2⤵
  PID:8120
- C:\Windows\System\ARMREVL.exe
  C:\Windows\System\ARMREVL.exe
  2⤵
  PID:7180
- C:\Windows\System\woJYApD.exe
  C:\Windows\System\woJYApD.exe
  2⤵
  PID:7364
- C:\Windows\System\FhzetpS.exe
  C:\Windows\System\FhzetpS.exe
  2⤵
  PID:7584
- C:\Windows\System\AjYNetY.exe
  C:\Windows\System\AjYNetY.exe
  2⤵
  PID:7604
- C:\Windows\System\pUuaJCs.exe
  C:\Windows\System\pUuaJCs.exe
  2⤵
  PID:8000
- C:\Windows\System\POwPhOd.exe
  C:\Windows\System\POwPhOd.exe
  2⤵
  PID:8132
- C:\Windows\System\BVyCYNc.exe
  C:\Windows\System\BVyCYNc.exe
  2⤵
  PID:7256
- C:\Windows\System\mPFeKLt.exe
  C:\Windows\System\mPFeKLt.exe
  2⤵
  PID:7416
- C:\Windows\System\EjfyTcF.exe
  C:\Windows\System\EjfyTcF.exe
  2⤵
  PID:7356
- C:\Windows\System\xZZCVil.exe
  C:\Windows\System\xZZCVil.exe
  2⤵
  PID:8012
- C:\Windows\System\XWUmEZK.exe
  C:\Windows\System\XWUmEZK.exe
  2⤵
  PID:6452
- C:\Windows\System\OvlAOcV.exe
  C:\Windows\System\OvlAOcV.exe
  2⤵
  PID:8220
- C:\Windows\System\yQKEIdl.exe
  C:\Windows\System\yQKEIdl.exe
  2⤵
  PID:8248
- C:\Windows\System\VCEZFuo.exe
  C:\Windows\System\VCEZFuo.exe
  2⤵
  PID:8280
- C:\Windows\System\NgdGtLm.exe
  C:\Windows\System\NgdGtLm.exe
  2⤵
  PID:8300
- C:\Windows\System\SpIwhdZ.exe
  C:\Windows\System\SpIwhdZ.exe
  2⤵
  PID:8332
- C:\Windows\System\ijIxsph.exe
  C:\Windows\System\ijIxsph.exe
  2⤵
  PID:8352
- C:\Windows\System\keEMmpK.exe
  C:\Windows\System\keEMmpK.exe
  2⤵
  PID:8384
- C:\Windows\System\ogPAgwu.exe
  C:\Windows\System\ogPAgwu.exe
  2⤵
  PID:8416
- C:\Windows\System\TCGzdDh.exe
  C:\Windows\System\TCGzdDh.exe
  2⤵
  PID:8436
- C:\Windows\System\OQMAAqa.exe
  C:\Windows\System\OQMAAqa.exe
  2⤵
  PID:8464
- C:\Windows\System\yYyIFUT.exe
  C:\Windows\System\yYyIFUT.exe
  2⤵
  PID:8492
- C:\Windows\System\NZpLZLT.exe
  C:\Windows\System\NZpLZLT.exe
  2⤵
  PID:8520
- C:\Windows\System\ktztCKD.exe
  C:\Windows\System\ktztCKD.exe
  2⤵
  PID:8544
- C:\Windows\System\KVSYFIU.exe
  C:\Windows\System\KVSYFIU.exe
  2⤵
  PID:8576
- C:\Windows\System\ittPdqA.exe
  C:\Windows\System\ittPdqA.exe
  2⤵
  PID:8604
- C:\Windows\System\qdSCxLd.exe
  C:\Windows\System\qdSCxLd.exe
  2⤵
  PID:8636
- C:\Windows\System\AlCwBhi.exe
  C:\Windows\System\AlCwBhi.exe
  2⤵
  PID:8652
- C:\Windows\System\InEjhRy.exe
  C:\Windows\System\InEjhRy.exe
  2⤵
  PID:8672
- C:\Windows\System\RmtpTOc.exe
  C:\Windows\System\RmtpTOc.exe
  2⤵
  PID:8700
- C:\Windows\System\XThHwZK.exe
  C:\Windows\System\XThHwZK.exe
  2⤵
  PID:8740
- C:\Windows\System\bNUbvyh.exe
  C:\Windows\System\bNUbvyh.exe
  2⤵
  PID:8772
- C:\Windows\System\pURjsXh.exe
  C:\Windows\System\pURjsXh.exe
  2⤵
  PID:8792
- C:\Windows\System\MIopFaL.exe
  C:\Windows\System\MIopFaL.exe
  2⤵
  PID:8824
- C:\Windows\System\VRiiDNo.exe
  C:\Windows\System\VRiiDNo.exe
  2⤵
  PID:8852
- C:\Windows\System\nKiqevP.exe
  C:\Windows\System\nKiqevP.exe
  2⤵
  PID:8888
- C:\Windows\System\nAUcIem.exe
  C:\Windows\System\nAUcIem.exe
  2⤵
  PID:8916
- C:\Windows\System\rHkzRLp.exe
  C:\Windows\System\rHkzRLp.exe
  2⤵
  PID:8948
- C:\Windows\System\uGLZlzX.exe
  C:\Windows\System\uGLZlzX.exe
  2⤵
  PID:8984
- C:\Windows\System\eNutZJp.exe
  C:\Windows\System\eNutZJp.exe
  2⤵
  PID:9004
- C:\Windows\System\KSLKXzn.exe
  C:\Windows\System\KSLKXzn.exe
  2⤵
  PID:9028
- C:\Windows\System\RtUibWQ.exe
  C:\Windows\System\RtUibWQ.exe
  2⤵
  PID:9044
- C:\Windows\System\zsFbvdX.exe
  C:\Windows\System\zsFbvdX.exe
  2⤵
  PID:9068
- C:\Windows\System\uGZpKzP.exe
  C:\Windows\System\uGZpKzP.exe
  2⤵
  PID:9100
- C:\Windows\System\yzRwdaX.exe
  C:\Windows\System\yzRwdaX.exe
  2⤵
  PID:9132
- C:\Windows\System\iTWijnO.exe
  C:\Windows\System\iTWijnO.exe
  2⤵
  PID:9168
- C:\Windows\System\Xyssclq.exe
  C:\Windows\System\Xyssclq.exe
  2⤵
  PID:9200
- C:\Windows\System\ttfNhUE.exe
  C:\Windows\System\ttfNhUE.exe
  2⤵
  PID:7940
- C:\Windows\System\IbWxOVg.exe
  C:\Windows\System\IbWxOVg.exe
  2⤵
  PID:8208
- C:\Windows\System\xWXcbwI.exe
  C:\Windows\System\xWXcbwI.exe
  2⤵
  PID:8204
- C:\Windows\System\GxKwAPZ.exe
  C:\Windows\System\GxKwAPZ.exe
  2⤵
  PID:8320
- C:\Windows\System\qIgfHKN.exe
  C:\Windows\System\qIgfHKN.exe
  2⤵
  PID:8432
- C:\Windows\System\rranImP.exe
  C:\Windows\System\rranImP.exe
  2⤵
  PID:8476
- C:\Windows\System\LBklagf.exe
  C:\Windows\System\LBklagf.exe
  2⤵
  PID:8584
- C:\Windows\System\mZxMJeA.exe
  C:\Windows\System\mZxMJeA.exe
  2⤵
  PID:8628
- C:\Windows\System\cGIxMlH.exe
  C:\Windows\System\cGIxMlH.exe
  2⤵
  PID:8728
- C:\Windows\System\NsZyciJ.exe
  C:\Windows\System\NsZyciJ.exe
  2⤵
  PID:8812
- C:\Windows\System\cfVnhip.exe
  C:\Windows\System\cfVnhip.exe
  2⤵
  PID:8840
- C:\Windows\System\NNUmuHs.exe
  C:\Windows\System\NNUmuHs.exe
  2⤵
  PID:8872
- C:\Windows\System\PJzFAeh.exe
  C:\Windows\System\PJzFAeh.exe
  2⤵
  PID:8904
- C:\Windows\System\BmjVzQe.exe
  C:\Windows\System\BmjVzQe.exe
  2⤵
  PID:8944
- C:\Windows\System\CLvUArg.exe
  C:\Windows\System\CLvUArg.exe
  2⤵
  PID:9128
- C:\Windows\System\QcRoVQN.exe
  C:\Windows\System\QcRoVQN.exe
  2⤵
  PID:9036
- C:\Windows\System\gfNhXVb.exe
  C:\Windows\System\gfNhXVb.exe
  2⤵
  PID:9192
- C:\Windows\System\OwLVlmq.exe
  C:\Windows\System\OwLVlmq.exe
  2⤵
  PID:8372
- C:\Windows\System\UIEMgIT.exe
  C:\Windows\System\UIEMgIT.exe
  2⤵
  PID:8396
- C:\Windows\System\CTpwazh.exe
  C:\Windows\System\CTpwazh.exe
  2⤵
  PID:8460
- C:\Windows\System\QOYIFRM.exe
  C:\Windows\System\QOYIFRM.exe
  2⤵
  PID:8556
- C:\Windows\System\dEaYAGE.exe
  C:\Windows\System\dEaYAGE.exe
  2⤵
  PID:8820
- C:\Windows\System\qyuqgOG.exe
  C:\Windows\System\qyuqgOG.exe
  2⤵
  PID:9024
- C:\Windows\System\IeAAubd.exe
  C:\Windows\System\IeAAubd.exe
  2⤵
  PID:9188
- C:\Windows\System\tAOxGrc.exe
  C:\Windows\System\tAOxGrc.exe
  2⤵
  PID:8448
- C:\Windows\System\alkcqae.exe
  C:\Windows\System\alkcqae.exe
  2⤵
  PID:8896
- C:\Windows\System\VyqAJYU.exe
  C:\Windows\System\VyqAJYU.exe
  2⤵
  PID:8696
- C:\Windows\System\XcAozLV.exe
  C:\Windows\System\XcAozLV.exe
  2⤵
  PID:9232
- C:\Windows\System\nZROaSb.exe
  C:\Windows\System\nZROaSb.exe
  2⤵
  PID:9264
- C:\Windows\System\fYDbnaA.exe
  C:\Windows\System\fYDbnaA.exe
  2⤵
  PID:9292
- C:\Windows\System\LaqHsUx.exe
  C:\Windows\System\LaqHsUx.exe
  2⤵
  PID:9324
- C:\Windows\System\XfTYoSF.exe
  C:\Windows\System\XfTYoSF.exe
  2⤵
  PID:9344
- C:\Windows\System\XVsLyrw.exe
  C:\Windows\System\XVsLyrw.exe
  2⤵
  PID:9376
- C:\Windows\System\OmragmN.exe
  C:\Windows\System\OmragmN.exe
  2⤵
  PID:9404
- C:\Windows\System\kAuPtWU.exe
  C:\Windows\System\kAuPtWU.exe
  2⤵
  PID:9424
- C:\Windows\System\YEHBTKW.exe
  C:\Windows\System\YEHBTKW.exe
  2⤵
  PID:9452
- C:\Windows\System\bgciHTu.exe
  C:\Windows\System\bgciHTu.exe
  2⤵
  PID:9472
- C:\Windows\System\MzsyAJF.exe
  C:\Windows\System\MzsyAJF.exe
  2⤵
  PID:9496
- C:\Windows\System\VLvwbsp.exe
  C:\Windows\System\VLvwbsp.exe
  2⤵
  PID:9524
- C:\Windows\System\jWHirVN.exe
  C:\Windows\System\jWHirVN.exe
  2⤵
  PID:9548
- C:\Windows\System\pFVFGvp.exe
  C:\Windows\System\pFVFGvp.exe
  2⤵
  PID:9572
- C:\Windows\System\fWeamqy.exe
  C:\Windows\System\fWeamqy.exe
  2⤵
  PID:9600
- C:\Windows\System\MROwijW.exe
  C:\Windows\System\MROwijW.exe
  2⤵
  PID:9632
- C:\Windows\System\qyRgXgU.exe
  C:\Windows\System\qyRgXgU.exe
  2⤵
  PID:9660
- C:\Windows\System\wSkxHWk.exe
  C:\Windows\System\wSkxHWk.exe
  2⤵
  PID:9688
- C:\Windows\System\xQABvIm.exe
  C:\Windows\System\xQABvIm.exe
  2⤵
  PID:9708
- C:\Windows\System\JOaViNr.exe
  C:\Windows\System\JOaViNr.exe
  2⤵
  PID:9724
- C:\Windows\System\xLpHqFq.exe
  C:\Windows\System\xLpHqFq.exe
  2⤵
  PID:9740
- C:\Windows\System\qYMqvjC.exe
  C:\Windows\System\qYMqvjC.exe
  2⤵
  PID:9764
- C:\Windows\System\ARdIySh.exe
  C:\Windows\System\ARdIySh.exe
  2⤵
  PID:9796
- C:\Windows\System\rlPNhjU.exe
  C:\Windows\System\rlPNhjU.exe
  2⤵
  PID:9820
- C:\Windows\System\WpZpSnF.exe
  C:\Windows\System\WpZpSnF.exe
  2⤵
  PID:9836
- C:\Windows\System\KllQhcP.exe
  C:\Windows\System\KllQhcP.exe
  2⤵
  PID:9860
- C:\Windows\System\qTxhluG.exe
  C:\Windows\System\qTxhluG.exe
  2⤵
  PID:9888
- C:\Windows\System\IXSNBwm.exe
  C:\Windows\System\IXSNBwm.exe
  2⤵
  PID:9904
- C:\Windows\System\UgQPHTS.exe
  C:\Windows\System\UgQPHTS.exe
  2⤵
  PID:9928
- C:\Windows\System\YEXAdPV.exe
  C:\Windows\System\YEXAdPV.exe
  2⤵
  PID:9956
- C:\Windows\System\KcQzROw.exe
  C:\Windows\System\KcQzROw.exe
  2⤵
  PID:9984
- C:\Windows\System\rNIVyEm.exe
  C:\Windows\System\rNIVyEm.exe
  2⤵
  PID:10016
- C:\Windows\System\JTMfFci.exe
  C:\Windows\System\JTMfFci.exe
  2⤵
  PID:10048
- C:\Windows\System\UfXrYVj.exe
  C:\Windows\System\UfXrYVj.exe
  2⤵
  PID:10072
- C:\Windows\System\WrSPEST.exe
  C:\Windows\System\WrSPEST.exe
  2⤵
  PID:10092
- C:\Windows\System\UpgYzhh.exe
  C:\Windows\System\UpgYzhh.exe
  2⤵
  PID:10124
- C:\Windows\System\ShTMSwk.exe
  C:\Windows\System\ShTMSwk.exe
  2⤵
  PID:10156
- C:\Windows\System\ndhKISO.exe
  C:\Windows\System\ndhKISO.exe
  2⤵
  PID:10200
- C:\Windows\System\ooGjkuL.exe
  C:\Windows\System\ooGjkuL.exe
  2⤵
  PID:10224
- C:\Windows\System\cJJnHrm.exe
  C:\Windows\System\cJJnHrm.exe
  2⤵
  PID:8324
- C:\Windows\System\fXTjNcv.exe
  C:\Windows\System\fXTjNcv.exe
  2⤵
  PID:9312
- C:\Windows\System\wyFxxnm.exe
  C:\Windows\System\wyFxxnm.exe
  2⤵
  PID:9288
- C:\Windows\System\DRUcKKI.exe
  C:\Windows\System\DRUcKKI.exe
  2⤵
  PID:9384
- C:\Windows\System\cEVYQJZ.exe
  C:\Windows\System\cEVYQJZ.exe
  2⤵
  PID:9448
- C:\Windows\System\rXzWAqS.exe
  C:\Windows\System\rXzWAqS.exe
  2⤵
  PID:9520
- C:\Windows\System\JATdJUG.exe
  C:\Windows\System\JATdJUG.exe
  2⤵
  PID:9492
- C:\Windows\System\NWQvZNE.exe
  C:\Windows\System\NWQvZNE.exe
  2⤵
  PID:9532
- C:\Windows\System\YKxOcXy.exe
  C:\Windows\System\YKxOcXy.exe
  2⤵
  PID:9580
- C:\Windows\System\MPFbzuj.exe
  C:\Windows\System\MPFbzuj.exe
  2⤵
  PID:9736
- C:\Windows\System\YYunXiF.exe
  C:\Windows\System\YYunXiF.exe
  2⤵
  PID:9784
- C:\Windows\System\CszvZGH.exe
  C:\Windows\System\CszvZGH.exe
  2⤵
  PID:9876
- C:\Windows\System\qtFcUht.exe
  C:\Windows\System\qtFcUht.exe
  2⤵
  PID:9732
- C:\Windows\System\vDXVewQ.exe
  C:\Windows\System\vDXVewQ.exe
  2⤵
  PID:10060
- C:\Windows\System\clbBajP.exe
  C:\Windows\System\clbBajP.exe
  2⤵
  PID:9940
- C:\Windows\System\pLUaMhk.exe
  C:\Windows\System\pLUaMhk.exe
  2⤵
  PID:10176
- C:\Windows\System\irAkRHF.exe
  C:\Windows\System\irAkRHF.exe
  2⤵
  PID:10220
- C:\Windows\System\RJyQqMR.exe
  C:\Windows\System\RJyQqMR.exe
  2⤵
  PID:9276
- C:\Windows\System\ZJiNIAk.exe
  C:\Windows\System\ZJiNIAk.exe
  2⤵
  PID:9364
- C:\Windows\System\hWePsPL.exe
  C:\Windows\System\hWePsPL.exe
  2⤵
  PID:9400
- C:\Windows\System\xujbzFT.exe
  C:\Windows\System\xujbzFT.exe
  2⤵
  PID:9808
- C:\Windows\System\SJNygyZ.exe
  C:\Windows\System\SJNygyZ.exe
  2⤵
  PID:9656
- C:\Windows\System\PsvEaxd.exe
  C:\Windows\System\PsvEaxd.exe
  2⤵
  PID:9648
- C:\Windows\System\AoHTDXY.exe
  C:\Windows\System\AoHTDXY.exe
  2⤵
  PID:9700
- C:\Windows\System\FSYpuOC.exe
  C:\Windows\System\FSYpuOC.exe
  2⤵
  PID:10068
- C:\Windows\System\QIejsjX.exe
  C:\Windows\System\QIejsjX.exe
  2⤵
  PID:9900
- C:\Windows\System\BtvhhPs.exe
  C:\Windows\System\BtvhhPs.exe
  2⤵
  PID:10248
- C:\Windows\System\TGACmgV.exe
  C:\Windows\System\TGACmgV.exe
  2⤵
  PID:10284
- C:\Windows\System\CShCSRy.exe
  C:\Windows\System\CShCSRy.exe
  2⤵
  PID:10312
- C:\Windows\System\oZgIZhv.exe
  C:\Windows\System\oZgIZhv.exe
  2⤵
  PID:10336
- C:\Windows\System\jUQRrZB.exe
  C:\Windows\System\jUQRrZB.exe
  2⤵
  PID:10368
- C:\Windows\System\HhQBzVR.exe
  C:\Windows\System\HhQBzVR.exe
  2⤵
  PID:10400
- C:\Windows\System\rBZmBks.exe
  C:\Windows\System\rBZmBks.exe
  2⤵
  PID:10424
- C:\Windows\System\CdBcpSJ.exe
  C:\Windows\System\CdBcpSJ.exe
  2⤵
  PID:10444
- C:\Windows\System\RSwHcOz.exe
  C:\Windows\System\RSwHcOz.exe
  2⤵
  PID:10464
- C:\Windows\System\mUsBsku.exe
  C:\Windows\System\mUsBsku.exe
  2⤵
  PID:10488
- C:\Windows\System\oGyhFmb.exe
  C:\Windows\System\oGyhFmb.exe
  2⤵
  PID:10520
- C:\Windows\System\YFJxDEg.exe
  C:\Windows\System\YFJxDEg.exe
  2⤵
  PID:10552
- C:\Windows\System\mxExAwi.exe
  C:\Windows\System\mxExAwi.exe
  2⤵
  PID:10580
- C:\Windows\System\qgEuaut.exe
  C:\Windows\System\qgEuaut.exe
  2⤵
  PID:10604
- C:\Windows\System\KvQtAcW.exe
  C:\Windows\System\KvQtAcW.exe
  2⤵
  PID:10628
- C:\Windows\System\rgRLzco.exe
  C:\Windows\System\rgRLzco.exe
  2⤵
  PID:10660
- C:\Windows\System\OEcrwpm.exe
  C:\Windows\System\OEcrwpm.exe
  2⤵
  PID:10688
- C:\Windows\System\WEUvehB.exe
  C:\Windows\System\WEUvehB.exe
  2⤵
  PID:10720
- C:\Windows\System\hehSfTC.exe
  C:\Windows\System\hehSfTC.exe
  2⤵
  PID:10748
- C:\Windows\System\qJEFJRQ.exe
  C:\Windows\System\qJEFJRQ.exe
  2⤵
  PID:10776
- C:\Windows\System\fpIoZwq.exe
  C:\Windows\System\fpIoZwq.exe
  2⤵
  PID:10812
- C:\Windows\System\QTYSrNW.exe
  C:\Windows\System\QTYSrNW.exe
  2⤵
  PID:10832
- C:\Windows\System\lOHNfJz.exe
  C:\Windows\System\lOHNfJz.exe
  2⤵
  PID:10860
- C:\Windows\System\ZSztPwb.exe
  C:\Windows\System\ZSztPwb.exe
  2⤵
  PID:10888
- C:\Windows\System\hBCfPEL.exe
  C:\Windows\System\hBCfPEL.exe
  2⤵
  PID:10916
- C:\Windows\System\LNTpMXP.exe
  C:\Windows\System\LNTpMXP.exe
  2⤵
  PID:10944
- C:\Windows\System\uLaUPof.exe
  C:\Windows\System\uLaUPof.exe
  2⤵
  PID:10968
- C:\Windows\System\CNilisP.exe
  C:\Windows\System\CNilisP.exe
  2⤵
  PID:10992
- C:\Windows\System\GZJyCLD.exe
  C:\Windows\System\GZJyCLD.exe
  2⤵
  PID:11020
- C:\Windows\System\fbydqEO.exe
  C:\Windows\System\fbydqEO.exe
  2⤵
  PID:11052
- C:\Windows\System\sUfMCuv.exe
  C:\Windows\System\sUfMCuv.exe
  2⤵
  PID:11080
- C:\Windows\System\ZapyKmI.exe
  C:\Windows\System\ZapyKmI.exe
  2⤵
  PID:11108
- C:\Windows\System\vFGTlxT.exe
  C:\Windows\System\vFGTlxT.exe
  2⤵
  PID:11136
- C:\Windows\System\lLTppit.exe
  C:\Windows\System\lLTppit.exe
  2⤵
  PID:11164
- C:\Windows\System\IvhNflw.exe
  C:\Windows\System\IvhNflw.exe
  2⤵
  PID:11192
- C:\Windows\System\pmLuRbV.exe
  C:\Windows\System\pmLuRbV.exe
  2⤵
  PID:11228
- C:\Windows\System\JvkSLhy.exe
  C:\Windows\System\JvkSLhy.exe
  2⤵
  PID:9772
- C:\Windows\System\paMnZdh.exe
  C:\Windows\System\paMnZdh.exe
  2⤵
  PID:10216
- C:\Windows\System\vnMxQfz.exe
  C:\Windows\System\vnMxQfz.exe
  2⤵
  PID:9720
- C:\Windows\System\NuSrgrJ.exe
  C:\Windows\System\NuSrgrJ.exe
  2⤵
  PID:10308
- C:\Windows\System\cNJJKnP.exe
  C:\Windows\System\cNJJKnP.exe
  2⤵
  PID:10376
- C:\Windows\System\qFecetY.exe
  C:\Windows\System\qFecetY.exe
  2⤵
  PID:10360
- C:\Windows\System\yvHspAT.exe
  C:\Windows\System\yvHspAT.exe
  2⤵
  PID:10412
- C:\Windows\System\MzyVQbv.exe
  C:\Windows\System\MzyVQbv.exe
  2⤵
  PID:10352
- C:\Windows\System\iVBZLnA.exe
  C:\Windows\System\iVBZLnA.exe
  2⤵
  PID:10652
- C:\Windows\System\mAlVBmS.exe
  C:\Windows\System\mAlVBmS.exe
  2⤵
  PID:10732
- C:\Windows\System\rsJpEJy.exe
  C:\Windows\System\rsJpEJy.exe
  2⤵
  PID:10700
- C:\Windows\System\HGJtXXv.exe
  C:\Windows\System\HGJtXXv.exe
  2⤵
  PID:10856
- C:\Windows\System\WQLSaBN.exe
  C:\Windows\System\WQLSaBN.exe
  2⤵
  PID:10976
- C:\Windows\System\eBfgFxz.exe
  C:\Windows\System\eBfgFxz.exe
  2⤵
  PID:11016
- C:\Windows\System\jAhWnOe.exe
  C:\Windows\System\jAhWnOe.exe
  2⤵
  PID:10928
- C:\Windows\System\itJdThp.exe
  C:\Windows\System\itJdThp.exe
  2⤵
  PID:10900
- C:\Windows\System\zOFtWJO.exe
  C:\Windows\System\zOFtWJO.exe
  2⤵
  PID:11044
- C:\Windows\System\SbYlraz.exe
  C:\Windows\System\SbYlraz.exe
  2⤵
  PID:11216
- C:\Windows\System\Upcnzfu.exe
  C:\Windows\System\Upcnzfu.exe
  2⤵
  PID:8624
- C:\Windows\System\kUoJBoJ.exe
  C:\Windows\System\kUoJBoJ.exe
  2⤵
  PID:9468
- C:\Windows\System\PpynuFN.exe
  C:\Windows\System\PpynuFN.exe
  2⤵
  PID:10328
- C:\Windows\System\XcWVGof.exe
  C:\Windows\System\XcWVGof.exe
  2⤵
  PID:10496
- C:\Windows\System\eaqRRin.exe
  C:\Windows\System\eaqRRin.exe
  2⤵
  PID:10800
- C:\Windows\System\vbqvnBk.exe
  C:\Windows\System\vbqvnBk.exe
  2⤵
  PID:10500
- C:\Windows\System\BekWsqB.exe
  C:\Windows\System\BekWsqB.exe
  2⤵
  PID:11064
- C:\Windows\System\fnpAQSu.exe
  C:\Windows\System\fnpAQSu.exe
  2⤵
  PID:10904
- C:\Windows\System\sgqpNFx.exe
  C:\Windows\System\sgqpNFx.exe
  2⤵
  PID:11240
- C:\Windows\System\RfaIpOy.exe
  C:\Windows\System\RfaIpOy.exe
  2⤵
  PID:10960
- C:\Windows\System\VZgNTWe.exe
  C:\Windows\System\VZgNTWe.exe
  2⤵
  PID:11272
- C:\Windows\System\OPtoHnI.exe
  C:\Windows\System\OPtoHnI.exe
  2⤵
  PID:11304
- C:\Windows\System\DTjkCxn.exe
  C:\Windows\System\DTjkCxn.exe
  2⤵
  PID:11332
- C:\Windows\System\VCCpvha.exe
  C:\Windows\System\VCCpvha.exe
  2⤵
  PID:11352
- C:\Windows\System\CBkzdRA.exe
  C:\Windows\System\CBkzdRA.exe
  2⤵
  PID:11388
- C:\Windows\System\kFTJBIC.exe
  C:\Windows\System\kFTJBIC.exe
  2⤵
  PID:11404
- C:\Windows\System\FwDEHGR.exe
  C:\Windows\System\FwDEHGR.exe
  2⤵
  PID:11428
- C:\Windows\System\xGVFuMV.exe
  C:\Windows\System\xGVFuMV.exe
  2⤵
  PID:11460
- C:\Windows\System\rizahTE.exe
  C:\Windows\System\rizahTE.exe
  2⤵
  PID:11484
- C:\Windows\System\qYPiOVx.exe
  C:\Windows\System\qYPiOVx.exe
  2⤵
  PID:11512
- C:\Windows\System\hFLIxzd.exe
  C:\Windows\System\hFLIxzd.exe
  2⤵
  PID:11548
- C:\Windows\System\sKkfAXe.exe
  C:\Windows\System\sKkfAXe.exe
  2⤵
  PID:11576
- C:\Windows\System\zzSUHag.exe
  C:\Windows\System\zzSUHag.exe
  2⤵
  PID:11600
- C:\Windows\System\aeoXapo.exe
  C:\Windows\System\aeoXapo.exe
  2⤵
  PID:11628
- C:\Windows\System\GIyquKJ.exe
  C:\Windows\System\GIyquKJ.exe
  2⤵
  PID:11656
- C:\Windows\System\ZncxDXP.exe
  C:\Windows\System\ZncxDXP.exe
  2⤵
  PID:11688
- C:\Windows\System\JmKcAfU.exe
  C:\Windows\System\JmKcAfU.exe
  2⤵
  PID:11712
- C:\Windows\System\qTQEOGF.exe
  C:\Windows\System\qTQEOGF.exe
  2⤵
  PID:11728
- C:\Windows\System\fzmEIXd.exe
  C:\Windows\System\fzmEIXd.exe
  2⤵
  PID:11752
- C:\Windows\System\mDMQtzo.exe
  C:\Windows\System\mDMQtzo.exe
  2⤵
  PID:11792
- C:\Windows\System\EZVGnPo.exe
  C:\Windows\System\EZVGnPo.exe
  2⤵
  PID:11844
- C:\Windows\System\RFwKbCj.exe
  C:\Windows\System\RFwKbCj.exe
  2⤵
  PID:11868
- C:\Windows\System\CJyQdfZ.exe
  C:\Windows\System\CJyQdfZ.exe
  2⤵
  PID:11888
- C:\Windows\System\hLaIczl.exe
  C:\Windows\System\hLaIczl.exe
  2⤵
  PID:11916
- C:\Windows\System\qWtEAnY.exe
  C:\Windows\System\qWtEAnY.exe
  2⤵
  PID:11948
- C:\Windows\System\vahxoAP.exe
  C:\Windows\System\vahxoAP.exe
  2⤵
  PID:11988
- C:\Windows\System\hAHNMGk.exe
  C:\Windows\System\hAHNMGk.exe
  2⤵
  PID:12016
- C:\Windows\System\uAfWChi.exe
  C:\Windows\System\uAfWChi.exe
  2⤵
  PID:12040
- C:\Windows\System\zESEwPn.exe
  C:\Windows\System\zESEwPn.exe
  2⤵
  PID:12068
- C:\Windows\System\BHTFeNI.exe
  C:\Windows\System\BHTFeNI.exe
  2⤵
  PID:12096
- C:\Windows\System\kBHarWS.exe
  C:\Windows\System\kBHarWS.exe
  2⤵
  PID:12132
- C:\Windows\System\BOxNeej.exe
  C:\Windows\System\BOxNeej.exe
  2⤵
  PID:12156
- C:\Windows\System\vvoYlAz.exe
  C:\Windows\System\vvoYlAz.exe
  2⤵
  PID:12184
- C:\Windows\System\UpALOXZ.exe
  C:\Windows\System\UpALOXZ.exe
  2⤵
  PID:12208
- C:\Windows\System\NyoXlQE.exe
  C:\Windows\System\NyoXlQE.exe
  2⤵
  PID:12232
- C:\Windows\System\LOOZKnX.exe
  C:\Windows\System\LOOZKnX.exe
  2⤵
  PID:12260
- C:\Windows\System\xnOGoId.exe
  C:\Windows\System\xnOGoId.exe
  2⤵
  PID:10872
- C:\Windows\System\UsochGk.exe
  C:\Windows\System\UsochGk.exe
  2⤵
  PID:10680
- C:\Windows\System\dzfvyUy.exe
  C:\Windows\System\dzfvyUy.exe
  2⤵
  PID:11348
- C:\Windows\System\VdHkDhb.exe
  C:\Windows\System\VdHkDhb.exe
  2⤵
  PID:11440
- C:\Windows\System\ZVHmWZZ.exe
  C:\Windows\System\ZVHmWZZ.exe
  2⤵
  PID:11124
- C:\Windows\System\YcIYayD.exe
  C:\Windows\System\YcIYayD.exe
  2⤵
  PID:11296
- C:\Windows\System\yknhdCh.exe
  C:\Windows\System\yknhdCh.exe
  2⤵
  PID:11496
- C:\Windows\System\LyEvSli.exe
  C:\Windows\System\LyEvSli.exe
  2⤵
  PID:11676
- C:\Windows\System\ZIbwzzs.exe
  C:\Windows\System\ZIbwzzs.exe
  2⤵
  PID:11700
- C:\Windows\System\IDcVkOZ.exe
  C:\Windows\System\IDcVkOZ.exe
  2⤵
  PID:11608
- C:\Windows\System\tYFXyoH.exe
  C:\Windows\System\tYFXyoH.exe
  2⤵
  PID:11776
- C:\Windows\System\IVjCmjq.exe
  C:\Windows\System\IVjCmjq.exe
  2⤵
  PID:11864
- C:\Windows\System\hFODHHB.exe
  C:\Windows\System\hFODHHB.exe
  2⤵
  PID:11924
- C:\Windows\System\VFLdJww.exe
  C:\Windows\System\VFLdJww.exe
  2⤵
  PID:11996
- C:\Windows\System\SLMhGyf.exe
  C:\Windows\System\SLMhGyf.exe
  2⤵
  PID:12088
- C:\Windows\System\TyOOWKw.exe
  C:\Windows\System\TyOOWKw.exe
  2⤵
  PID:12204
- C:\Windows\System\ymnRQPP.exe
  C:\Windows\System\ymnRQPP.exe
  2⤵
  PID:12280
- C:\Windows\System\LAmxhbN.exe
  C:\Windows\System\LAmxhbN.exe
  2⤵
  PID:12172
- C:\Windows\System\NNjTigQ.exe
  C:\Windows\System\NNjTigQ.exe
  2⤵
  PID:11376
- C:\Windows\System\FwJcMPo.exe
  C:\Windows\System\FwJcMPo.exe
  2⤵
  PID:11312
- C:\Windows\System\yusDnVx.exe
  C:\Windows\System\yusDnVx.exe
  2⤵
  PID:11704
- C:\Windows\System\FIhCclC.exe
  C:\Windows\System\FIhCclC.exe
  2⤵
  PID:11680
- C:\Windows\System\UTDldaB.exe
  C:\Windows\System\UTDldaB.exe
  2⤵
  PID:11928
- C:\Windows\System\rgcUEdg.exe
  C:\Windows\System\rgcUEdg.exe
  2⤵
  PID:12060
- C:\Windows\System\FzqMyhq.exe
  C:\Windows\System\FzqMyhq.exe
  2⤵
  PID:12080
- C:\Windows\System\kvwDUMg.exe
  C:\Windows\System\kvwDUMg.exe
  2⤵
  PID:11724
- C:\Windows\System\eZceRJP.exe
  C:\Windows\System\eZceRJP.exe
  2⤵
  PID:11744
- C:\Windows\System\MUdmBIQ.exe
  C:\Windows\System\MUdmBIQ.exe
  2⤵
  PID:12324
- C:\Windows\System\xtbQdwk.exe
  C:\Windows\System\xtbQdwk.exe
  2⤵
  PID:12344
- C:\Windows\System\USiCtjh.exe
  C:\Windows\System\USiCtjh.exe
  2⤵
  PID:12380
- C:\Windows\System\kxnuGPJ.exe
  C:\Windows\System\kxnuGPJ.exe
  2⤵
  PID:12396
- C:\Windows\System\IJQFSOU.exe
  C:\Windows\System\IJQFSOU.exe
  2⤵
  PID:12428
- C:\Windows\System\gpYttUx.exe
  C:\Windows\System\gpYttUx.exe
  2⤵
  PID:12444
- C:\Windows\System\jycvbQX.exe
  C:\Windows\System\jycvbQX.exe
  2⤵
  PID:12472
- C:\Windows\System\PGKilxF.exe
  C:\Windows\System\PGKilxF.exe
  2⤵
  PID:12508
- C:\Windows\System\pDrgORx.exe
  C:\Windows\System\pDrgORx.exe
  2⤵
  PID:12540
- C:\Windows\System\yqouUKN.exe
  C:\Windows\System\yqouUKN.exe
  2⤵
  PID:12568
- C:\Windows\System\KzrgBNC.exe
  C:\Windows\System\KzrgBNC.exe
  2⤵
  PID:12584
- C:\Windows\System\jWHslar.exe
  C:\Windows\System\jWHslar.exe
  2⤵
  PID:12612
- C:\Windows\System\nfupWXu.exe
  C:\Windows\System\nfupWXu.exe
  2⤵
  PID:12640
- C:\Windows\System\iwxvHsB.exe
  C:\Windows\System\iwxvHsB.exe
  2⤵
  PID:12672
- C:\Windows\System\CtyKVbb.exe
  C:\Windows\System\CtyKVbb.exe
  2⤵
  PID:12696
- C:\Windows\System\eoMCeVx.exe
  C:\Windows\System\eoMCeVx.exe
  2⤵
  PID:12724
- C:\Windows\System\JbhAmcr.exe
  C:\Windows\System\JbhAmcr.exe
  2⤵
  PID:12752
- C:\Windows\System\FFDxXgC.exe
  C:\Windows\System\FFDxXgC.exe
  2⤵
  PID:12768
- C:\Windows\System\cscNzLU.exe
  C:\Windows\System\cscNzLU.exe
  2⤵
  PID:12804
- C:\Windows\System\eVuNkOt.exe
  C:\Windows\System\eVuNkOt.exe
  2⤵
  PID:12828
- C:\Windows\System\xvwKyom.exe
  C:\Windows\System\xvwKyom.exe
  2⤵
  PID:12852
- C:\Windows\System\gEhvXyf.exe
  C:\Windows\System\gEhvXyf.exe
  2⤵
  PID:12880
- C:\Windows\System\UAHHHZP.exe
  C:\Windows\System\UAHHHZP.exe
  2⤵
  PID:12904
- C:\Windows\System\nauvhiI.exe
  C:\Windows\System\nauvhiI.exe
  2⤵
  PID:12924
- C:\Windows\System\zBQrcVn.exe
  C:\Windows\System\zBQrcVn.exe
  2⤵
  PID:12960
- C:\Windows\System\YrPbNEQ.exe
  C:\Windows\System\YrPbNEQ.exe
  2⤵
  PID:12980
- C:\Windows\System\OZTQKeE.exe
  C:\Windows\System\OZTQKeE.exe
  2⤵
  PID:13008
- C:\Windows\System\BVTwRjp.exe
  C:\Windows\System\BVTwRjp.exe
  2⤵
  PID:13036
- C:\Windows\System\eSJDfbc.exe
  C:\Windows\System\eSJDfbc.exe
  2⤵
  PID:13064
- C:\Windows\System\nbAynYx.exe
  C:\Windows\System\nbAynYx.exe
  2⤵
  PID:13092
- C:\Windows\System\wjWyacC.exe
  C:\Windows\System\wjWyacC.exe
  2⤵
  PID:13128
- C:\Windows\System\wZAEpWz.exe
  C:\Windows\System\wZAEpWz.exe
  2⤵
  PID:13156
- C:\Windows\System\HPCnaxu.exe
  C:\Windows\System\HPCnaxu.exe
  2⤵
  PID:13188
- C:\Windows\System\YywDcRX.exe
  C:\Windows\System\YywDcRX.exe
  2⤵
  PID:13212
- C:\Windows\System\diJNFdP.exe
  C:\Windows\System\diJNFdP.exe
  2⤵
  PID:13248
- C:\Windows\System\AStWXuT.exe
  C:\Windows\System\AStWXuT.exe
  2⤵
  PID:13280
- C:\Windows\System\swafTAQ.exe
  C:\Windows\System\swafTAQ.exe
  2⤵
  PID:13308
- C:\Windows\System\lDwNPkl.exe
  C:\Windows\System\lDwNPkl.exe
  2⤵
  PID:11620
- C:\Windows\System\brybAmf.exe
  C:\Windows\System\brybAmf.exe
  2⤵
  PID:11856
- C:\Windows\System\aPuBdBP.exe
  C:\Windows\System\aPuBdBP.exe
  2⤵
  PID:11480
- C:\Windows\System\pJGYMlt.exe
  C:\Windows\System\pJGYMlt.exe
  2⤵
  PID:12372
- C:\Windows\System\LZyVNuK.exe
  C:\Windows\System\LZyVNuK.exe
  2⤵
  PID:12308
- C:\Windows\System\JCePPbD.exe
  C:\Windows\System\JCePPbD.exe
  2⤵
  PID:12536
- C:\Windows\System\GsCkhjX.exe
  C:\Windows\System\GsCkhjX.exe
  2⤵
  PID:12560
- C:\Windows\System\CofpkDu.exe
  C:\Windows\System\CofpkDu.exe
  2⤵
  PID:12680
- C:\Windows\System\AeCmPcR.exe
  C:\Windows\System\AeCmPcR.exe
  2⤵
  PID:12564
- C:\Windows\System\ImOLndY.exe
  C:\Windows\System\ImOLndY.exe
  2⤵
  PID:12608
- C:\Windows\System\evVtobn.exe
  C:\Windows\System\evVtobn.exe
  2⤵
  PID:12816
- C:\Windows\System\uhvvFiG.exe
  C:\Windows\System\uhvvFiG.exe
  2⤵
  PID:12848
- C:\Windows\System\eGAukLd.exe
  C:\Windows\System\eGAukLd.exe
  2⤵
  PID:12792
- C:\Windows\System\wXzavYU.exe
  C:\Windows\System\wXzavYU.exe
  2⤵
  PID:12976
- C:\Windows\System\RXounUJ.exe
  C:\Windows\System\RXounUJ.exe
  2⤵
  PID:12956
- C:\Windows\System\clAxWEe.exe
  C:\Windows\System\clAxWEe.exe
  2⤵
  PID:12996
- C:\Windows\System\bcGwGea.exe
  C:\Windows\System\bcGwGea.exe
  2⤵
  PID:13136
- C:\Windows\System\mBdEaiQ.exe
  C:\Windows\System\mBdEaiQ.exe
  2⤵
  PID:13168
- C:\Windows\System\lcvlCpV.exe
  C:\Windows\System\lcvlCpV.exe
  2⤵
  PID:13220
- C:\Windows\System\DQwdNcl.exe
  C:\Windows\System\DQwdNcl.exe
  2⤵
  PID:13272
- C:\Windows\System\urlxqsx.exe
  C:\Windows\System\urlxqsx.exe
  2⤵
  PID:12516
- C:\Windows\System\eyyoUzP.exe
  C:\Windows\System\eyyoUzP.exe
  2⤵
  PID:12580
- C:\Windows\System\eliaZYO.exe
  C:\Windows\System\eliaZYO.exe
  2⤵
  PID:12788
- C:\Windows\System\jnFxmNe.exe
  C:\Windows\System\jnFxmNe.exe
  2⤵
  PID:13004
- C:\Windows\System\BTHqGcp.exe
  C:\Windows\System\BTHqGcp.exe
  2⤵
  PID:12336
- C:\Windows\System\xfyjzIi.exe
  C:\Windows\System\xfyjzIi.exe
  2⤵
  PID:12684
- C:\Windows\System\rkmOxFb.exe
  C:\Windows\System\rkmOxFb.exe
  2⤵
  PID:13316
- C:\Windows\System\NttqUMf.exe
  C:\Windows\System\NttqUMf.exe
  2⤵
  PID:13336
- C:\Windows\System\niUYhtH.exe
  C:\Windows\System\niUYhtH.exe
  2⤵
  PID:13356
- C:\Windows\System\VwMfEbw.exe
  C:\Windows\System\VwMfEbw.exe
  2⤵
  PID:13380
- C:\Windows\System\jnFLWca.exe
  C:\Windows\System\jnFLWca.exe
  2⤵
  PID:13396
- C:\Windows\System\HTWZSLc.exe
  C:\Windows\System\HTWZSLc.exe
  2⤵
  PID:13420
- C:\Windows\System\tQBKiZt.exe
  C:\Windows\System\tQBKiZt.exe
  2⤵
  PID:13444
- C:\Windows\System\vAXjUAM.exe
  C:\Windows\System\vAXjUAM.exe
  2⤵
  PID:13468
- C:\Windows\System\EixwdQf.exe
  C:\Windows\System\EixwdQf.exe
  2⤵
  PID:13488
- C:\Windows\System\aSMQlRZ.exe
  C:\Windows\System\aSMQlRZ.exe
  2⤵
  PID:13512
- C:\Windows\System\nunMfVP.exe
  C:\Windows\System\nunMfVP.exe
  2⤵
  PID:13540
- C:\Windows\System\pQDtxLx.exe
  C:\Windows\System\pQDtxLx.exe
  2⤵
  PID:13576
- C:\Windows\System\PnoSUtd.exe
  C:\Windows\System\PnoSUtd.exe
  2⤵
  PID:13600
- C:\Windows\System\ZaZmFAc.exe
  C:\Windows\System\ZaZmFAc.exe
  2⤵
  PID:13628
- C:\Windows\System\svHBcMY.exe
  C:\Windows\System\svHBcMY.exe
  2⤵
  PID:13656
- C:\Windows\System\IBnnOTS.exe
  C:\Windows\System\IBnnOTS.exe
  2⤵
  PID:13680
- C:\Windows\System\BSqSDIw.exe
  C:\Windows\System\BSqSDIw.exe
  2⤵
  PID:13708
- C:\Windows\System\lrkAvQv.exe
  C:\Windows\System\lrkAvQv.exe
  2⤵
  PID:13736
- C:\Windows\System\ikRJqbg.exe
  C:\Windows\System\ikRJqbg.exe
  2⤵
  PID:13764
- C:\Windows\System\OgsxSFt.exe
  C:\Windows\System\OgsxSFt.exe
  2⤵
  PID:13804
- C:\Windows\System\WLTSHoI.exe
  C:\Windows\System\WLTSHoI.exe
  2⤵
  PID:13836
- C:\Windows\System\wtgspTT.exe
  C:\Windows\System\wtgspTT.exe
  2⤵
  PID:13860
- C:\Windows\System\PxJkQJx.exe
  C:\Windows\System\PxJkQJx.exe
  2⤵
  PID:13892
- C:\Windows\System\nYceVXk.exe
  C:\Windows\System\nYceVXk.exe
  2⤵
  PID:13912
- C:\Windows\System\qOGZOmK.exe
  C:\Windows\System\qOGZOmK.exe
  2⤵
  PID:13936
- C:\Windows\System\JkUBDNF.exe
  C:\Windows\System\JkUBDNF.exe
  2⤵
  PID:13972
- C:\Windows\System\vEmHEAF.exe
  C:\Windows\System\vEmHEAF.exe
  2⤵
  PID:14000
- C:\Windows\System\xjNgUdU.exe
  C:\Windows\System\xjNgUdU.exe
  2⤵
  PID:14028
- C:\Windows\System\TDBkYXu.exe
  C:\Windows\System\TDBkYXu.exe
  2⤵
  PID:14048
- C:\Windows\System\VrSHROX.exe
  C:\Windows\System\VrSHROX.exe
  2⤵
  PID:14076
- C:\Windows\System\iMJPnNW.exe
  C:\Windows\System\iMJPnNW.exe
  2⤵
  PID:14104
- C:\Windows\System\wEixUeQ.exe
  C:\Windows\System\wEixUeQ.exe
  2⤵
  PID:14124
- C:\Windows\System\SQcWRSS.exe
  C:\Windows\System\SQcWRSS.exe
  2⤵
  PID:14152
- C:\Windows\System\mVKypyN.exe
  C:\Windows\System\mVKypyN.exe
  2⤵
  PID:14176
- C:\Windows\System\GGewmZP.exe
  C:\Windows\System\GGewmZP.exe
  2⤵
  PID:14192
- C:\Windows\System\iVrmUvk.exe
  C:\Windows\System\iVrmUvk.exe
  2⤵
  PID:14220
- C:\Windows\System\LvwYjSD.exe
  C:\Windows\System\LvwYjSD.exe
  2⤵
  PID:14252
- C:\Windows\System\gGGUiaX.exe
  C:\Windows\System\gGGUiaX.exe
  2⤵
  PID:14280
- C:\Windows\System\oZPAWJI.exe
  C:\Windows\System\oZPAWJI.exe
  2⤵
  PID:14308
- C:\Windows\System\oLrHWJq.exe
  C:\Windows\System\oLrHWJq.exe
  2⤵
  PID:14332
- C:\Windows\System\zwxrlXC.exe
  C:\Windows\System\zwxrlXC.exe
  2⤵
  PID:13088
- C:\Windows\System\zCwERNj.exe
  C:\Windows\System\zCwERNj.exe
  2⤵
  PID:12496
- C:\Windows\System\auoiPqw.exe
  C:\Windows\System\auoiPqw.exe
  2⤵
  PID:12892
- C:\Windows\System\JDgCKht.exe
  C:\Windows\System\JDgCKht.exe
  2⤵
  PID:13328
- C:\Windows\System\wJSNHXl.exe
  C:\Windows\System\wJSNHXl.exe
  2⤵
  PID:13256
- C:\Windows\System\gwZikWd.exe
  C:\Windows\System\gwZikWd.exe
  2⤵
  PID:13344
- C:\Windows\System\aSBtlOB.exe
  C:\Windows\System\aSBtlOB.exe
  2⤵
  PID:13636
- C:\Windows\System\sGNKUbY.exe
  C:\Windows\System\sGNKUbY.exe
  2⤵
  PID:13696
- C:\Windows\System\usxbwys.exe
  C:\Windows\System\usxbwys.exe
  2⤵
  PID:13500
- C:\Windows\System\xJdPunu.exe
  C:\Windows\System\xJdPunu.exe
  2⤵
  PID:13372
- C:\Windows\System\QXXSYee.exe
  C:\Windows\System\QXXSYee.exe
  2⤵
  PID:13900
- C:\Windows\System\dAQSSQS.exe
  C:\Windows\System\dAQSSQS.exe
  2⤵
  PID:13756
- C:\Windows\System\acjtctq.exe
  C:\Windows\System\acjtctq.exe
  2⤵
  PID:14012
- C:\Windows\System\QreRXTB.exe
  C:\Windows\System\QreRXTB.exe
  2⤵
  PID:13828
- C:\Windows\System\YAcjmyT.exe
  C:\Windows\System\YAcjmyT.exe
  2⤵
  PID:10576
- C:\Windows\System\STPfGzP.exe
  C:\Windows\System\STPfGzP.exe
  2⤵
  PID:14144
- C:\Windows\System\sxDswHf.exe
  C:\Windows\System\sxDswHf.exe
  2⤵
  PID:14060
- C:\Windows\System\OZJLWUB.exe
  C:\Windows\System\OZJLWUB.exe
  2⤵
  PID:13888
- C:\Windows\System\wxnQSdy.exe
  C:\Windows\System\wxnQSdy.exe
  2⤵
  PID:14188
- C:\Windows\System\rTqUFaF.exe
  C:\Windows\System\rTqUFaF.exe
  2⤵
  PID:12300
- C:\Windows\System\vkniltv.exe
  C:\Windows\System\vkniltv.exe
  2⤵
  PID:11652
- C:\Windows\System\tZHhFGT.exe
  C:\Windows\System\tZHhFGT.exe
  2⤵
  PID:14140
- C:\Windows\System\oJRTLTz.exe
  C:\Windows\System\oJRTLTz.exe
  2⤵
  PID:14184
- C:\Windows\System\YluNpEo.exe
  C:\Windows\System\YluNpEo.exe
  2⤵
  PID:14240
- C:\Windows\System\behRflR.exe
  C:\Windows\System\behRflR.exe
  2⤵
  PID:13612
- C:\Windows\System\SKAofTO.exe
  C:\Windows\System\SKAofTO.exe
  2⤵
  PID:14348
- C:\Windows\System\SEaVNpR.exe
  C:\Windows\System\SEaVNpR.exe
  2⤵
  PID:14376
- C:\Windows\System\pRNUNzO.exe
  C:\Windows\System\pRNUNzO.exe
  2⤵
  PID:14400
- C:\Windows\System\XGFNMcY.exe
  C:\Windows\System\XGFNMcY.exe
  2⤵
  PID:14428
- C:\Windows\System\wMQMzFC.exe
  C:\Windows\System\wMQMzFC.exe
  2⤵
  PID:14460
- C:\Windows\System\ydVrjCu.exe
  C:\Windows\System\ydVrjCu.exe
  2⤵
  PID:14480
- C:\Windows\System\NyhATCR.exe
  C:\Windows\System\NyhATCR.exe
  2⤵
  PID:14504
- C:\Windows\System\vtEZuMn.exe
  C:\Windows\System\vtEZuMn.exe
  2⤵
  PID:14520
- C:\Windows\System\ghCGYMF.exe
  C:\Windows\System\ghCGYMF.exe
  2⤵
  PID:14540
- C:\Windows\System\tDokBCR.exe
  C:\Windows\System\tDokBCR.exe
  2⤵
  PID:14564
- C:\Windows\System\HzgKSlX.exe
  C:\Windows\System\HzgKSlX.exe
  2⤵
  PID:14588
- C:\Windows\System\rEIZGlc.exe
  C:\Windows\System\rEIZGlc.exe
  2⤵
  PID:14620
- C:\Windows\System\OPYnVdM.exe
  C:\Windows\System\OPYnVdM.exe
  2⤵
  PID:14640
- C:\Windows\System\ipewObR.exe
  C:\Windows\System\ipewObR.exe
  2⤵
  PID:14668
- C:\Windows\System\DBxVLFN.exe
  C:\Windows\System\DBxVLFN.exe
  2⤵
  PID:14704
- C:\Windows\System\jCdhGsw.exe
  C:\Windows\System\jCdhGsw.exe
  2⤵
  PID:14728
- C:\Windows\System\zcJCYjH.exe
  C:\Windows\System\zcJCYjH.exe
  2⤵
  PID:14744
- C:\Windows\System\MQSqnFX.exe
  C:\Windows\System\MQSqnFX.exe
  2⤵
  PID:14772
- C:\Windows\System\zOtZlQo.exe
  C:\Windows\System\zOtZlQo.exe
  2⤵
  PID:14800
- C:\Windows\System\LGzaVAw.exe
  C:\Windows\System\LGzaVAw.exe
  2⤵
  PID:14828
- C:\Windows\System\RewVQSF.exe
  C:\Windows\System\RewVQSF.exe
  2⤵
  PID:14864
- C:\Windows\System\NJSxiJV.exe
  C:\Windows\System\NJSxiJV.exe
  2⤵
  PID:14888
- C:\Windows\System\nczDHYJ.exe
  C:\Windows\System\nczDHYJ.exe
  2⤵
  PID:14916
- C:\Windows\System\BReAcWl.exe
  C:\Windows\System\BReAcWl.exe
  2⤵
  PID:14956
- C:\Windows\System\MbeYZsX.exe
  C:\Windows\System\MbeYZsX.exe
  2⤵
  PID:14976
- C:\Windows\System\THotTnt.exe
  C:\Windows\System\THotTnt.exe
  2⤵
  PID:15000
- C:\Windows\System\zTfGDke.exe
  C:\Windows\System\zTfGDke.exe
  2⤵
  PID:15036
- C:\Windows\System\xCueHuY.exe
  C:\Windows\System\xCueHuY.exe
  2⤵
  PID:15060
- C:\Windows\System\XWgjIpl.exe
  C:\Windows\System\XWgjIpl.exe
  2⤵
  PID:15084
- C:\Windows\System\RTzkNHc.exe
  C:\Windows\System\RTzkNHc.exe
  2⤵
  PID:15112
- C:\Windows\System\JetCqCq.exe
  C:\Windows\System\JetCqCq.exe
  2⤵
  PID:15136
- C:\Windows\System\MWsrVvD.exe
  C:\Windows\System\MWsrVvD.exe
  2⤵
  PID:15160
- C:\Windows\System\tKTOmCo.exe
  C:\Windows\System\tKTOmCo.exe
  2⤵
  PID:15192
- C:\Windows\System\WyerPQg.exe
  C:\Windows\System\WyerPQg.exe
  2⤵
  PID:15212
- C:\Windows\System\ifMzliO.exe
  C:\Windows\System\ifMzliO.exe
  2⤵
  PID:15236
- C:\Windows\System\vERjbVq.exe
  C:\Windows\System\vERjbVq.exe
  2⤵
  PID:15260
- C:\Windows\System\jRyhWAo.exe
  C:\Windows\System\jRyhWAo.exe
  2⤵
  PID:15284
- C:\Windows\System\qpZjOmg.exe
  C:\Windows\System\qpZjOmg.exe
  2⤵
  PID:15316
- C:\Windows\System\qLFZXLN.exe
  C:\Windows\System\qLFZXLN.exe
  2⤵
  PID:15344
- C:\Windows\System\yNwQWVT.exe
  C:\Windows\System\yNwQWVT.exe
  2⤵
  PID:14168
- C:\Windows\System\CrcPpyR.exe
  C:\Windows\System\CrcPpyR.exe
  2⤵
  PID:11568
- C:\Windows\System\nLIgYAJ.exe
  C:\Windows\System\nLIgYAJ.exe
  2⤵
  PID:13376
- C:\Windows\System\hOWhuHS.exe
  C:\Windows\System\hOWhuHS.exe
  2⤵
  PID:13728
- C:\Windows\System\TnRDMRY.exe
  C:\Windows\System\TnRDMRY.exe
  2⤵
  PID:14452
- C:\Windows\System\NboLcZe.exe
  C:\Windows\System\NboLcZe.exe
  2⤵
  PID:13436
- C:\Windows\System\TSwGkAc.exe
  C:\Windows\System\TSwGkAc.exe
  2⤵
  PID:13592
- C:\Windows\System\uPHnknH.exe
  C:\Windows\System\uPHnknH.exe
  2⤵
  PID:14340
- C:\Windows\System\SwOEdKM.exe
  C:\Windows\System\SwOEdKM.exe
  2⤵
  PID:2376
- C:\Windows\System\lbtwzfW.exe
  C:\Windows\System\lbtwzfW.exe
  2⤵
  PID:2372
- C:\Windows\System\KyhYrry.exe
  C:\Windows\System\KyhYrry.exe
  2⤵
  PID:14736
- C:\Windows\System\mwkSapu.exe
  C:\Windows\System\mwkSapu.exe
  2⤵
  PID:14796
- C:\Windows\System\nJUBPdI.exe
  C:\Windows\System\nJUBPdI.exe
  2⤵
  PID:14932
- C:\Windows\System\bbAAxCv.exe
  C:\Windows\System\bbAAxCv.exe
  2⤵
  PID:14784
- C:\Windows\System\fAviCbG.exe
  C:\Windows\System\fAviCbG.exe
  2⤵
  PID:14808
- C:\Windows\System\DCrRJHy.exe
  C:\Windows\System\DCrRJHy.exe
  2⤵
  PID:14552
- C:\Windows\System\OlQurCo.exe
  C:\Windows\System\OlQurCo.exe
  2⤵
  PID:14632
- C:\Windows\System\CyATtGR.exe
  C:\Windows\System\CyATtGR.exe
  2⤵
  PID:15008
- C:\Windows\System\bYQEshD.exe
  C:\Windows\System\bYQEshD.exe
  2⤵
  PID:15076
- C:\Windows\System\iPuVnCG.exe
  C:\Windows\System\iPuVnCG.exe
  2⤵
  PID:14928
- C:\Windows\System\MXumjRF.exe
  C:\Windows\System\MXumjRF.exe
  2⤵
  PID:15332
- C:\Windows\System\nhVJxcR.exe
  C:\Windows\System\nhVJxcR.exe
  2⤵
  PID:14636
- C:\Windows\System\dWnoNYi.exe
  C:\Windows\System\dWnoNYi.exe
  2⤵
  PID:12220
- C:\Windows\System\grwcShS.exe
  C:\Windows\System\grwcShS.exe
  2⤵
  PID:15144
- C:\Windows\System\mrPkyfu.exe
  C:\Windows\System\mrPkyfu.exe
  2⤵
  PID:14468
- C:\Windows\System\AJsrMRB.exe
  C:\Windows\System\AJsrMRB.exe
  2⤵
  PID:15372
- C:\Windows\System\mPIJgfQ.exe
  C:\Windows\System\mPIJgfQ.exe
  2⤵
  PID:15400
- C:\Windows\System\EEzxSJN.exe
  C:\Windows\System\EEzxSJN.exe
  2⤵
  PID:15444
- C:\Windows\System\UJjBFCa.exe
  C:\Windows\System\UJjBFCa.exe
  2⤵
  PID:15464
- C:\Windows\System\VvefWPq.exe
  C:\Windows\System\VvefWPq.exe
  2⤵
  PID:15480
- C:\Windows\System\xlaMabi.exe
  C:\Windows\System\xlaMabi.exe
  2⤵
  PID:15504
- C:\Windows\System\LwEXOfy.exe
  C:\Windows\System\LwEXOfy.exe
  2⤵
  PID:15528
- C:\Windows\System\aXAuzxu.exe
  C:\Windows\System\aXAuzxu.exe
  2⤵
  PID:15552
- C:\Windows\System\jAzhtlq.exe
  C:\Windows\System\jAzhtlq.exe
  2⤵
  PID:15576
- C:\Windows\System\oFLVmVe.exe
  C:\Windows\System\oFLVmVe.exe
  2⤵
  PID:15596
- C:\Windows\System\kSoCoXq.exe
  C:\Windows\System\kSoCoXq.exe
  2⤵
  PID:15624
- C:\Windows\System\cvKindy.exe
  C:\Windows\System\cvKindy.exe
  2⤵
  PID:15640
- C:\Windows\System\TLzYmnW.exe
  C:\Windows\System\TLzYmnW.exe
  2⤵
  PID:15660
- C:\Windows\System\DxBxpUs.exe
  C:\Windows\System\DxBxpUs.exe
  2⤵
  PID:15680
- C:\Windows\System\AaStPrB.exe
  C:\Windows\System\AaStPrB.exe
  2⤵
  PID:15696
- C:\Windows\System\sOjYdxH.exe
  C:\Windows\System\sOjYdxH.exe
  2⤵
  PID:15724
- C:\Windows\System\VVgmVgr.exe
  C:\Windows\System\VVgmVgr.exe
  2⤵
  PID:15740
- C:\Windows\System\DJoYYWR.exe
  C:\Windows\System\DJoYYWR.exe
  2⤵
  PID:15764
- C:\Windows\System\QbCRWoh.exe
  C:\Windows\System\QbCRWoh.exe
  2⤵
  PID:15800
- C:\Windows\System\iOtHOjL.exe
  C:\Windows\System\iOtHOjL.exe
  2⤵
  PID:15820
- C:\Windows\System\eSoqhRW.exe
  C:\Windows\System\eSoqhRW.exe
  2⤵
  PID:15852
- C:\Windows\System\KsDSKmU.exe
  C:\Windows\System\KsDSKmU.exe
  2⤵
  PID:15880
- C:\Windows\System\VVolnAO.exe
  C:\Windows\System\VVolnAO.exe
  2⤵
  PID:15916
- C:\Windows\System\CmLpXvn.exe
  C:\Windows\System\CmLpXvn.exe
  2⤵
  PID:15936
- C:\Windows\System\ZOHFiyu.exe
  C:\Windows\System\ZOHFiyu.exe
  2⤵
  PID:15968
- C:\Windows\System\UafJgwm.exe
  C:\Windows\System\UafJgwm.exe
  2⤵
  PID:15984
- C:\Windows\System\siGAsIi.exe
  C:\Windows\System\siGAsIi.exe
  2⤵
  PID:16000
- C:\Windows\System\FuYqpnJ.exe
  C:\Windows\System\FuYqpnJ.exe
  2⤵
  PID:16044
- C:\Windows\System\gsKDlNY.exe
  C:\Windows\System\gsKDlNY.exe
  2⤵
  PID:16064
- C:\Windows\System\eFxdoSl.exe
  C:\Windows\System\eFxdoSl.exe
  2⤵
  PID:16088
- C:\Windows\System\sMWwzJx.exe
  C:\Windows\System\sMWwzJx.exe
  2⤵
  PID:16112
- C:\Windows\System\NOBUzBC.exe
  C:\Windows\System\NOBUzBC.exe
  2⤵
  PID:16144
- C:\Windows\System\GNXgHZP.exe
  C:\Windows\System\GNXgHZP.exe
  2⤵
  PID:16168
- C:\Windows\System\bbITcRI.exe
  C:\Windows\System\bbITcRI.exe
  2⤵
  PID:16192
- C:\Windows\System\RguXviP.exe
  C:\Windows\System\RguXviP.exe
  2⤵
  PID:16228
- C:\Windows\System\xaMDmXW.exe
  C:\Windows\System\xaMDmXW.exe
  2⤵
  PID:16256
- C:\Windows\System\esLunfj.exe
  C:\Windows\System\esLunfj.exe
  2⤵
  PID:16284
- C:\Windows\System\nVohgAX.exe
  C:\Windows\System\nVohgAX.exe
  2⤵
  PID:16300
- C:\Windows\System\IEahwLE.exe
  C:\Windows\System\IEahwLE.exe
  2⤵
  PID:16324
- C:\Windows\System\UgbMZYD.exe
  C:\Windows\System\UgbMZYD.exe
  2⤵
  PID:16352
- C:\Windows\System\NVZDMPD.exe
  C:\Windows\System\NVZDMPD.exe
  2⤵
  PID:14756
- C:\Windows\System\QlHgZJT.exe
  C:\Windows\System\QlHgZJT.exe
  2⤵
  PID:14768
- C:\Windows\System\PvhzPuk.exe
  C:\Windows\System\PvhzPuk.exe
  2⤵
  PID:14852
- C:\Windows\System\nWKHhxW.exe
  C:\Windows\System\nWKHhxW.exe
  2⤵
  PID:15512
- C:\Windows\System\hoDXKpi.exe
  C:\Windows\System\hoDXKpi.exe
  2⤵
  PID:15548
- C:\Windows\System\UDzITfQ.exe
  C:\Windows\System\UDzITfQ.exe
  2⤵
  PID:15584
- C:\Windows\System\NoquYaa.exe
  C:\Windows\System\NoquYaa.exe
  2⤵
  PID:15572
- C:\Windows\System\kPupKbq.exe
  C:\Windows\System\kPupKbq.exe
  2⤵
  PID:15632
- C:\Windows\System\ukHWidm.exe
  C:\Windows\System\ukHWidm.exe
  2⤵
  PID:15692
- C:\Windows\System\qdEftHT.exe
  C:\Windows\System\qdEftHT.exe
  2⤵
  PID:15908
- C:\Windows\System\VetZIXc.exe
  C:\Windows\System\VetZIXc.exe
  2⤵
  PID:15732
- C:\Windows\System\qbGjubu.exe
  C:\Windows\System\qbGjubu.exe
  2⤵
  PID:15776
- C:\Windows\System\pKWLwur.exe
  C:\Windows\System\pKWLwur.exe
  2⤵
  PID:15980
- C:\Windows\System\SiCkcAj.exe
  C:\Windows\System\SiCkcAj.exe
  2⤵
  PID:16072
- C:\Windows\System\ttJMTqJ.exe
  C:\Windows\System\ttJMTqJ.exe
  2⤵
  PID:16024
- C:\Windows\System\ngYHKFv.exe
  C:\Windows\System\ngYHKFv.exe
  2⤵
  PID:16104
- C:\Windows\System\jwalsPZ.exe
  C:\Windows\System\jwalsPZ.exe
  2⤵
  PID:15992
- C:\Windows\System\GTKnhwr.exe
  C:\Windows\System\GTKnhwr.exe
  2⤵
  PID:16344
- C:\Windows\System\cVDNSGi.exe
  C:\Windows\System\cVDNSGi.exe
  2⤵
  PID:16268
- C:\Windows\System\qWnpkfu.exe
  C:\Windows\System\qWnpkfu.exe
  2⤵
  PID:15368
- C:\Windows\System\cxzIOuC.exe
  C:\Windows\System\cxzIOuC.exe
  2⤵
  PID:16212
- C:\Windows\System\CVVwQBg.exe
  C:\Windows\System\CVVwQBg.exe
  2⤵
  PID:15676
- C:\Windows\System\hdwtvWB.exe
  C:\Windows\System\hdwtvWB.exe
  2⤵
  PID:15932
- C:\Windows\System\FaqPaRk.exe
  C:\Windows\System\FaqPaRk.exe
  2⤵
  PID:16404
- C:\Windows\System\AwDwMhE.exe
  C:\Windows\System\AwDwMhE.exe
  2⤵
  PID:16424
- C:\Windows\System\DSDpGzG.exe
  C:\Windows\System\DSDpGzG.exe
  2⤵
  PID:16452
- C:\Windows\System\vqFylbz.exe
  C:\Windows\System\vqFylbz.exe
  2⤵
  PID:16500
- C:\Windows\System\itMumzj.exe
  C:\Windows\System\itMumzj.exe
  2⤵
  PID:16524
- C:\Windows\System\psgeZOc.exe
  C:\Windows\System\psgeZOc.exe
  2⤵
  PID:16548
- C:\Windows\System\ogfMbWo.exe
  C:\Windows\System\ogfMbWo.exe
  2⤵
  PID:16576
- C:\Windows\System\KwSAUOn.exe
  C:\Windows\System\KwSAUOn.exe
  2⤵
  PID:16612
- C:\Windows\System\APHizeW.exe
  C:\Windows\System\APHizeW.exe
  2⤵
  PID:16648
- C:\Windows\System\stOiOYm.exe
  C:\Windows\System\stOiOYm.exe
  2⤵
  PID:16672
- C:\Windows\System\EsckmgA.exe
  C:\Windows\System\EsckmgA.exe
  2⤵
  PID:16704
- C:\Windows\System\kTlGczs.exe
  C:\Windows\System\kTlGczs.exe
  2⤵
  PID:16720
- C:\Windows\System\bhlhHrJ.exe
  C:\Windows\System\bhlhHrJ.exe
  2⤵
  PID:16744
- C:\Windows\System\uSyscBe.exe
  C:\Windows\System\uSyscBe.exe
  2⤵
  PID:16776
- C:\Windows\System\WMsHqtC.exe
  C:\Windows\System\WMsHqtC.exe
  2⤵
  PID:16808
- C:\Windows\System\twgSGvI.exe
  C:\Windows\System\twgSGvI.exe
  2⤵
  PID:16844
- C:\Windows\System\YwuTJmE.exe
  C:\Windows\System\YwuTJmE.exe
  2⤵
  PID:16876
- C:\Windows\System\xHWcIwL.exe
  C:\Windows\System\xHWcIwL.exe
  2⤵
  PID:16892
- C:\Windows\System\PmJhjFU.exe
  C:\Windows\System\PmJhjFU.exe
  2⤵
  PID:16928
- C:\Windows\System\DeicAgk.exe
  C:\Windows\System\DeicAgk.exe
  2⤵
  PID:16948
- C:\Windows\System\hqZqjxn.exe
  C:\Windows\System\hqZqjxn.exe
  2⤵
  PID:16964
- C:\Windows\System\FYcnSJd.exe
  C:\Windows\System\FYcnSJd.exe
  2⤵
  PID:16988
- C:\Windows\System\jEmZJme.exe
  C:\Windows\System\jEmZJme.exe
  2⤵
  PID:17224
- C:\Windows\System\WKyfzDk.exe
  C:\Windows\System\WKyfzDk.exe
  2⤵
  PID:17364
- C:\Windows\System\yWSpsaE.exe
  C:\Windows\System\yWSpsaE.exe
  2⤵
  PID:17392
- C:\Windows\System\EqMENEs.exe
  C:\Windows\System\EqMENEs.exe
  2⤵
  PID:15560

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:16908

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\AcQbiXt.exe

Filesize
1.6MB

MD5
98b602e8b013b1cb3c72cb477ac487cf

SHA1
d87629a2f2bca7783413b01bfac8b6fe17e189f2

SHA256
cb21b32e77a31148138eff02feb21a2878d4755c6f21bcc0c0a6b8bcd786f995

SHA512
5552a690c73729975c5219e3e13795161ca7227dc507cbbe16777422623c3ff7610c20afbf07e3ffb6ab9bee583706a0d0a0b54ee403fc99af85798f1022c639

Download Submit
C:\Windows\System\AfgROiJ.exe

Filesize
1.6MB

MD5
cb0859ca325ef28f6286a9dc7e5c4813

SHA1
abd00e8cbd01d9f9f4df774e204bfd0a00fb7394

SHA256
4e4171a819f464f951edbe503506652645d2af920db43c953855421ed20669f4

SHA512
b66795103948890e2beb7a1f44a096ae18c8a614aaed04b365f5d4ab5f1572fa32e412b35aa19aa540f5b8056b6e11a5e33ad5da9385249903dd744ae7301d80

Download Submit
C:\Windows\System\AuxohdB.exe

Filesize
1.6MB

MD5
0e072945829d73c8b4ac42a3a0d85f6d

SHA1
e59e399be9c753432d3a8069f9b9b420ef064f34

SHA256
9b46d2acd080411834f4a8e6d76138a689d00de7b55dddbf378af37f34fd46b8

SHA512
b3edaf8ca6305783e188dc4a89e7f396340b7fcaa5cd463f48d53b278c8b2335fab7bd5f55545a4c2a06c697d118a18a81a0b3069acee9b382e8ff8fee7d2e05

Download Submit
C:\Windows\System\BZkPgnQ.exe

Filesize
1.6MB

MD5
46497155aa96c41442576e1911eaa6a5

SHA1
3184d9ef906a4e89e01bc50bd0513b1df4afa3b6

SHA256
57f6661de504f2b0c10ed1d49633ce3def4ead1b4af7b1f8ca98a1a39ce746ba

SHA512
cdfd47d65b4d53024efab12138c476e35bca31cef29fd27624e3aa2825ab40a2d72a92783cecf4c5789ed49f35ba632d13b694c48b50fc2dcc5b37aaf15c52de

Download Submit
C:\Windows\System\EPXCtfo.exe

Filesize
1.6MB

MD5
5758ca830d0f65edb9da87b6ae6a8d35

SHA1
46bc460791cb54f54dcd65f786c4a0acc472c307

SHA256
67b09461e2761e08425d3b49163cc90efc179fae986f9f4f2d26aa206e495485

SHA512
299f7aee09ea8b6494799f7ff8f022e4cc36e2dba74fc8fc6ae80684aa1a8d7e1bf43748cdaeaa0c117d10ad89b7d5d1c751210d008543aad0671df843aa0a31

Download Submit
C:\Windows\System\FmeKzzu.exe

Filesize
1.6MB

MD5
f41ea0ed7a5c82d012cf3e0ffb2bf085

SHA1
0c8bfd4c30fec01fd3afbbd287af10f47e433a62

SHA256
ca49eb99ee97e3b81992c2233cff53e7bc6e3c646522c286ac78135a78b4b567

SHA512
ae4b8702082c4b1c54f03862e43a4a9415778947e52906aa23cc178f2e6afdefbc92afef45bf2a5931101cf953e862a9f112a3ed5435c42a41ad26ad3c0b7c5c

Download Submit
C:\Windows\System\GroBdkM.exe

Filesize
1.6MB

MD5
2638792a0328d2bce85301c7b711d25f

SHA1
9995f56aff915cb16df463dce0befe4eae84314d

SHA256
6e402e2a9a8e51d23e6e8891e840d951d04e2a3951ce034358c713ab517e52a1

SHA512
5e8ed3b4d91b382f0a1ad358f6f1a61714e3e6c55548e003714b7632a6e68dd634e0df62d0e13f11b8b223ab71d69c37ef64b8b853cf0e0e20ba91523637736e

Download Submit
C:\Windows\System\IWewSMU.exe

Filesize
1.6MB

MD5
555ae35bd6ddc2203c4f9c93b4137cf9

SHA1
0fad56947a781a66fcaea824db4f3dd17a021a8f

SHA256
d5d121ee3ed01fcfc2a603327997178bbcb59bdbec9bf2c3163b929d2c38337d

SHA512
bc9cd7117ed06d403f27880319878102e742b615db2c01588a5a253468fc22e265ab663c4073f40211800cbdde55206ea7fa0a8d8bd1246a345107de569c6e32

Download Submit
C:\Windows\System\LIosjhX.exe

Filesize
1.6MB

MD5
6532bb3b1b4756b857391405556f5b25

SHA1
df88a9eedbabac4a59e845c0993ebfdc999d4a4a

SHA256
e88033596c09de0ce6e5d02d81c7a411a22911236cd116792e87fcd3abf2357c

SHA512
60e7129a91b00571eba4a35686a9576ef3290ac4c8c88a878d9f5d04f2e7d46a426b7dc3c862d46f939a29e4700cad527491adb7b0bd7657abd4b3451eddb7f8

Download Submit
C:\Windows\System\MkzFeiv.exe

Filesize
1.6MB

MD5
fa29bc7fa2caf442859a54b7ce6b660d

SHA1
735bc6d96d92facc7ed8b10bcc43bb8f19dbf2a2

SHA256
172b31c47c3bb176e8975afb9cdc0175a697b997f5ed894a81cd266e8908b87f

SHA512
aae12b6e10994d5fe1c6c1afb0bbe563f15e12e7a3b0f8fee798c591760528052c41e7a06efd66f2a0cd133a2a22ed8d4c88f0a43d0a270c1b85079824782582

Download Submit
C:\Windows\System\OKfaDGh.exe

Filesize
1.6MB

MD5
fe5eb5ff5b5cec5629b5c38f29c819f0

SHA1
13df7fa6a17d092706cf70312699b0da180e1412

SHA256
8bcf09e3d3939ff31e736f75b20060ff55f91813b5e654007f3f76221cc1e9fd

SHA512
cfa5d2acd289223e8c34cc8afe723cddce3ee4fff58d5cc83028b8495f40ed165247bebd34ac3d660488dd93dce5c9df91dd9cdd4d4ea411c6e17d84d79c4025

Download Submit
C:\Windows\System\TXjZPzd.exe

Filesize
1.6MB

MD5
b89f6f98765c796003015888bd606c0a

SHA1
49072191b5efc3657ebbf02fc60b0e1f68785908

SHA256
2c07519f45476d136d8f8b12235f206161b9f66e9f0ba19ea20e5f12c82cb4b9

SHA512
bf1eb113ae1f8ab98c604184c163e88c1d85648ab6db86a34787c981be6b875a2c64106e64984d658e266c755293361131b81a258c695756d741a1d8dd68c9e8

Download Submit
C:\Windows\System\TwQmuiM.exe

Filesize
1.6MB

MD5
2737b339f63e1e2172192cbda2d684be

SHA1
e07875f3f5a87f23df5fb0cc818860a4484c1b38

SHA256
272aae655b24c95625e5708d61f0b485e04f93f5729b6d0077c3861dc425f849

SHA512
217e026efbcee4669e448517d135b6e7efd99906c68a5ebed0a61489b38a33b01d382b74bbb91e2810181b97aec84876a186c810138e4d947555dd5f124f36d6

Download Submit
C:\Windows\System\WhQuwJc.exe

Filesize
1.6MB

MD5
c1efdabdae79962e1b553853864e9cac

SHA1
c8c4932d43705f5a24510a559603fad403f383e2

SHA256
16b457ca1ecd055da871743884c917c0c110754ee201bef23aef8474c6d37b14

SHA512
04e8c155b8f0386fb05b42ab7b7f0ed723848268f948a54a25e19008edb40653d6ecb2678c22302d41a2b729f3ec38fb1b27646b74e1970aaa3fafd027cac765

Download Submit
C:\Windows\System\WrCKxOG.exe

Filesize
1.6MB

MD5
0a28386dc734fdbd97df2a54ca354a60

SHA1
30fe4ae24dcb06e584a9dcb73a96ee7314e03cc9

SHA256
95e07aa1b76b183c1c2a7cdb53a95f22373e5ed391f293c9a6fa468df93784b3

SHA512
a99ca2a1038b04d54809539a435bf12c91c2477a2e1e51222a50cff3cc7d52f81e43e8e2dedf29c1b96028ac5f68b4db3990e8e93a1b797c9f6d0d30aa02c763

Download Submit
C:\Windows\System\XYSFWoF.exe

Filesize
1.6MB

MD5
0d565cc36c8a933743262ecb8f0fd851

SHA1
4b7e2c1c7908e9aa12f544b32c96725179299c36

SHA256
005527cf9906acc92707b60d91eedad8443d183ad1d51f23a35a0c0fd27a570d

SHA512
4e388a3d97502ebb5f3e7a68e45bc60cbf463c9090c770991803907c766fe421cf1e89bb715f76c0df21adc8b0b206705c687d56813c02536ee4bad32101062f

Download Submit
C:\Windows\System\YHrtUvy.exe

Filesize
1.6MB

MD5
849897cebab56b7f88b56ae9cc07c80d

SHA1
5e86c576dc6adff10dc5371511b5d440802d15f0

SHA256
a5bd432371ed2482ae41caf39263a842e7b47fe37222771eb88a6aa88f699ac8

SHA512
be27966143e84512411de2fe8f3e3fd89935f5cd588f1e3c423bdcfdbff388163155070892c7496ef1eb8749b421e9fd688fd97e219fcd5c76a2a00da2babf3a

Download Submit
C:\Windows\System\ZnMpyPr.exe

Filesize
1.6MB

MD5
24c7eeaa3d5e0c2107744bdb5f41b7eb

SHA1
2dba7aeaab520b6fb5265589a3fd5fd014edb6cf

SHA256
f85f178e661171508f6c5f6d8f81062bc1288b09057cf14338ba441323933304

SHA512
a5897ab4dbf49ec685bacd5d511d987fdb9c720ffdcd87c2fe222c1837053aedc0a4ba9b360735d393f507d841d97f02ef21016a9b10a303402b2f609633d224

Download Submit
C:\Windows\System\cXIbOre.exe

Filesize
1.6MB

MD5
b313766879a69053e0fbbe9af4f76e68

SHA1
d710700767b1ce6d5c49472e883308aec246df4d

SHA256
f99e91a7fe9f212ddfc442ba8446643e2f97c85ce8c6cf87279183a938d978aa

SHA512
a7ede188f00174b49c893362bddde8f1dd95e6200743d3b0c909c90f5f677f2746b199f93a747321656c7f30e528ef20fd93602ee3db3f015c01d801ef72a1fa

Download Submit
C:\Windows\System\diDYFep.exe

Filesize
1.6MB

MD5
744f8f6513fdad548ab1466c6d661c1e

SHA1
65a2fc0c69bbcf9116e2138adfffe59d32e2fed5

SHA256
eceaf9b32190ef34b5d1c052785b149fc64c5b813174428ab1cfe2307cb1fe7d

SHA512
d81ff72a73ec973290ca7d2d7aee07e7c40e39d6d87700a471613106d33dcc42273c69c60c9771133f5a6d622a9f35a60035cd2c55d8eaa8cf02df819c789821

Download Submit
C:\Windows\System\gcPttTN.exe

Filesize
1.6MB

MD5
2fa433890937d4c750c1b9d14b6183e7

SHA1
b042fc62b8d19c406b6f6fe08f0c0175b0fd9cfc

SHA256
ce6444cad844c2f5cefcf5f076a9c26e8c5c0ae6b3b00fa03d34b5782f1add8b

SHA512
9f653e5966f678ba5a1cb5ab2d416d73a87c9b8e956e9fc832ac869191b9772aa9395f86caa575fff317fa5a782ae5c99614cef777f4bea6b53e521951e690ce

Download Submit
C:\Windows\System\iDABcIO.exe

Filesize
1.6MB

MD5
2ca8f510efffef94a6cfa6e5553eb9d3

SHA1
da462c84ddebba8ce06e7f5aa50403bfbecaef9b

SHA256
4d8712efbe2db39e2e6fa0e4d87451220c816f3787b1b50f257177c0dd4e100f

SHA512
d3de4538db9eb6b4da53fc75809722e0d889461ecefd584da5b946090ddf5b6247d52cd1ac3da0500c67b5da7e3ea1e05606f11c3a1d1a0c2bc6baaddeccef3d

Download Submit
C:\Windows\System\miYvLeg.exe

Filesize
1.6MB

MD5
b811ad1f97ce7c77dd98ea7656b2212a

SHA1
f6b9b5f5c5ec74b9a72a767cfbf6a0691231353c

SHA256
daa4bf915471d570daea1e98da24b813a54dd3c0e43d2d9459a2b04d111f70f8

SHA512
d7dc985c2259cbdddb44802823eb085af30f43927daa941208363982ccac1cb4dda0330ed4f8cf9756180f852dcf72111e48580cc8724e4d4dfa5ec599d4cdfb

Download Submit
C:\Windows\System\nqsetYv.exe

Filesize
1.6MB

MD5
26fea2484a71be54d61c7069a6151af5

SHA1
1214a997cd820f87a08538731c600436cb4e8411

SHA256
2720d2f1bb7e8ac9089cc6656cf3965847e4f038687c5894a02764e0acd0aebc

SHA512
508a8bb9154aee32801c07c7002a2a25a9d1d11ed2b539a39df4e48ef3fce9338625884f371c2f59dd998121f2ccb17a60c33b02752bc20e733dd3e849dcf145

Download Submit
C:\Windows\System\pbaxnlh.exe

Filesize
1.6MB

MD5
e67a0f306624148610a2227413a359a0

SHA1
2322e94cf42900c14747eec9cb744d3f63a686ce

SHA256
e279bad52a9e5ff1ea470fadafb5bc205aca7df2cce88aa732a761b1d9f4373c

SHA512
12d4358f41f233dbf2407c0d3f03475c168c78f3ce7bcda0bc58269bbcb744242c2b1bbf0b2d8cc2345b7f56d5ab94714000e800e0615f5088436c1507e966d5

Download Submit
C:\Windows\System\sDobjxS.exe

Filesize
1.6MB

MD5
9aee8e239fc38f11d5b4ca91a38033d8

SHA1
9181f7e019763ac98112e1da68081c8d0e79aa8f

SHA256
3f9ff0f5e0f6c4bd60b73fb783ae8e18e985e279156c0f1cdffe95cd9922a07c

SHA512
ea9ca03f96bb4313bd8f6ef16ff9eb5f0dc88482eda0b73906316788f49fcf0a4815d96828514d8de16eeb02f4e958633bb3ffc968053ad077a1284651dcd231

Download Submit
C:\Windows\System\sirQFXC.exe

Filesize
1.6MB

MD5
51023449a8043d23d534f0639643a0be

SHA1
0556bcc7be230fdd1e90668466127331a9d57ff0

SHA256
a5521e4f25fbbd73ecd547d71b2f3592e5b304eb3d69ee2375b91be599a5a788

SHA512
a7c0b20e664397ff80e4452d276785395246dee7c1c2099d77a06869416dcda21a54b98dcd46637375dd26cb1c15bbf7bf56bec6701aaa714207e2a3ec8ee1d6

Download Submit
C:\Windows\System\tDmcXmY.exe

Filesize
1.6MB

MD5
7c1ae596a485e79791bb351184fc3f82

SHA1
c6c6a55dcf9e2c4cfa8b70afbb88372838ad31e9

SHA256
3b25060c139d7b15fc4184cafc6c6b524d5dc4431ec15e49b5ecb8d8a0b7ebdc

SHA512
9b54a038f355ca34ab1bbfeab0791137a11e8adcdc2a2ef5c48cba27dbaf6bbb3eb6d52423933a38099b7f98a611833177fb43c921985de9c184b7ef09ab6b02

Download Submit
C:\Windows\System\tlZAZQu.exe

Filesize
1.6MB

MD5
5f84a5e91bdb93eb7ec941fef7239a58

SHA1
3e50c82c2fbe1c091b83cb875e3d7612c05a7eeb

SHA256
bfdc44cad0a060c6662b4a6d1e1d460604982fcdf3e9adcc6e720ca2b96f5099

SHA512
381fe02a35c7dba73f7e69400535b13fbff4e0a0e80f2e275cc9fa9e7ef29a130e89c8a3e2bff735fb1f45099d667cdee6c7ef252db9ca5c14ede74fdd7c9bfa

Download Submit
C:\Windows\System\twcfJFX.exe

Filesize
1.6MB

MD5
50d1e4ce89df29ccc46ca7929506d1da

SHA1
c2257c9e18599c7213ab5ffa4344962d6479dced

SHA256
1f8776921388bc8bcb9d8c6c81d78cf2fe5f48df84d72c1413d1d65471f797ae

SHA512
3ee49f4b1d98fe103ae4c3aeff8c30476cd9496b7b814b242edfdddae26b720d2257852938c60d160e20f115389144ce6f94f05843a55bb7c640d684e3a05da3

Download Submit
C:\Windows\System\uoUQHAd.exe

Filesize
1.6MB

MD5
37575445d9ff5d8c081f672fec8e568a

SHA1
50adc55295138b6b5d4a9d9d06a7cdfb1796da97

SHA256
bb2da7d243572cd38521dd10adc8efde14708204162d98473d090cca61c513c1

SHA512
2f36744685c140abef64826ee30d44ff611641ee70925fb23c0652d6e8590e0e278c41dd6f7d950b3b8810c68fb25ab00c1b6b6c5766fe9add7809e29720b42e

Download Submit
C:\Windows\System\wfBgXvC.exe

Filesize
1.6MB

MD5
c86af7266f875d62929ab95ed51a5d83

SHA1
7496d3ac2daa7256dc24a1099e7709185bcf76ed

SHA256
190dcbb8b83332fdb96b12ae72adcdf6c79f05985f3f36be4106e89ca4ea63fa

SHA512
ebede239477d187682aceaf2517b584e1ef46c0be3249d37bf0d44b77ad68c2c10238a0191732a3eb8c42528245b0e1b83b10862d0aa068cc13377683ad0b861

Download Submit
C:\Windows\System\xfrIqlO.exe

Filesize
1.6MB

MD5
b753f3ab39f2ea19b91c90589cff2769

SHA1
73d79768f642d1ba405cc85ce6538100abb48522

SHA256
e8912c84f025b6d79fa36fe89984260816ea80a24870f2e3cb412382159a6323

SHA512
3ac7721ebc40d429878b976f866f553135cae5225c05705de3a27a456a87f0d3cd083c0fd52c89fd5e4a633f4f9402d080f5234f1dd6cd7270b601d873f80c39

Download Submit
C:\Windows\System\yYRZBEk.exe

Filesize
1.6MB

MD5
88d70099f8981e14ac8cbb8d305017fd

SHA1
0a6d1706f2ca40547e03dff7b56152f7e9d13c2e

SHA256
b5f7a1621e671f0cb24db8bbd5b467dbde64212e278135bb6982352e85b67ee7

SHA512
7bc26f099443c53ae793869aa6e3f964cffe2493d1fa4687353366c76819eae32d79d6b92115dc8601c7fe4883c2e294d5438cc715fc0465bc209dbdee6089d9

Download Submit
C:\Windows\System\zMlvDHD.exe

Filesize
1.6MB

MD5
3359123401f8924dc63fc57bef170593

SHA1
f3f010cd703c478449d51decad53bdc4edb04cbe

SHA256
f9630af5e2c2b24f52878655b365f326d25a0b8daa02061bdede3c2b8a557359

SHA512
44dea70327dbf5e52bf36e9ec4f51c77d666d67c8c2de98905415e962cef91f9864ed553d84f924fa0ca0b6f388ab0da8af7a5577e7c17ae71482ba76e37a4e7

Download Submit
memory/4688-0-0x00000167F0D40000-0x00000167F0D50000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads