xmrig | 6c247d1995ef61452e73c18f6cf90c8df5b65982adf6787521c48a7c4308f5a4

Analysis

max time kernel
108s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
24-12-2024 23:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6c247d1995ef61452e73c18f6cf90c8df5b65982adf6787521c48a7c4308f5a4.exe
Size

1.8MB
MD5

6ef45438e5aa7e37a5abab80ade0d948
SHA1

6453458c8cfaa96290005d860b75a2f3fe9f5bf4
SHA256

6c247d1995ef61452e73c18f6cf90c8df5b65982adf6787521c48a7c4308f5a4
SHA512

fbd00343bbb471b19d64b97eaa7092d99a76a51e64c298a12d0fad7683f07698b703f528ec6ccdf4cf60dbb1b7a9c1030f7354a96d591118c5f081e788a87107
SSDEEP

49152:GezaTF8FcNkNdfE0pZ9ozttwIRxj4c5y2PF6fRXzsFI:GemTLkNdfE0pZyW

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 33 IoCs

miner

resource	yara_rule
behavioral2/files/0x000a000000023b92-6.dat	xmrig
behavioral2/files/0x000c000000023b35-10.dat	xmrig
behavioral2/files/0x000a000000023b94-21.dat	xmrig
behavioral2/files/0x000a000000023b95-28.dat	xmrig
behavioral2/files/0x000a000000023b96-36.dat	xmrig
behavioral2/files/0x000a000000023b98-44.dat	xmrig
behavioral2/files/0x000a000000023b9b-62.dat	xmrig
behavioral2/files/0x000a000000023bac-141.dat	xmrig
behavioral2/files/0x000b000000023bb0-161.dat	xmrig
behavioral2/files/0x000b000000023bae-159.dat	xmrig
behavioral2/files/0x000b000000023baf-156.dat	xmrig
behavioral2/files/0x000a000000023bad-154.dat	xmrig
behavioral2/files/0x000a000000023bab-144.dat	xmrig
behavioral2/files/0x000a000000023baa-139.dat	xmrig
behavioral2/files/0x000a000000023ba9-134.dat	xmrig
behavioral2/files/0x000a000000023ba8-129.dat	xmrig
behavioral2/files/0x000a000000023ba7-124.dat	xmrig
behavioral2/files/0x000a000000023ba6-119.dat	xmrig
behavioral2/files/0x000a000000023ba5-114.dat	xmrig
behavioral2/files/0x000a000000023ba4-109.dat	xmrig
behavioral2/files/0x000a000000023ba3-104.dat	xmrig
behavioral2/files/0x000a000000023ba2-99.dat	xmrig
behavioral2/files/0x000a000000023ba1-94.dat	xmrig
behavioral2/files/0x000a000000023ba0-89.dat	xmrig
behavioral2/files/0x000a000000023b9f-84.dat	xmrig
behavioral2/files/0x000a000000023b9e-76.dat	xmrig
behavioral2/files/0x000a000000023b9d-72.dat	xmrig
behavioral2/files/0x000a000000023b9c-66.dat	xmrig
behavioral2/files/0x000a000000023b9a-57.dat	xmrig
behavioral2/files/0x000a000000023b99-51.dat	xmrig
behavioral2/files/0x000a000000023b97-42.dat	xmrig
behavioral2/files/0x000a000000023b93-20.dat	xmrig
behavioral2/files/0x000b000000023b8e-13.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
3260	JxzyBug.exe
1968	TISUxms.exe
4088	zpWLXWb.exe
3296	RkYMtPv.exe
1604	BQAGPkh.exe
4132	VeRuzQt.exe
3096	YVGDaoF.exe
4832	GtFDpei.exe
1744	QkqscQl.exe
1232	YFtVYgp.exe
2736	LmVlUDM.exe
2184	lIHWJNf.exe
1748	sidGucO.exe
1388	DsUTYja.exe
2052	reDpkRh.exe
5004	VoXEdtL.exe
1080	selsPNd.exe
3264	fWDiqzo.exe
1736	QfUtbbX.exe
4644	GQGOdMM.exe
4696	NtDsmhb.exe
2508	tiwdyOe.exe
4576	roDOkLm.exe
1716	jwsWJqw.exe
1788	UIawwtV.exe
5008	ZRtoRyY.exe
2768	rFXDbKf.exe
664	hAIzgOE.exe
464	LtNLBtP.exe
2876	VjxymAo.exe
4692	rTouxBL.exe
2480	MjZgYuh.exe
2904	UuQrECb.exe
4884	WfFhaPV.exe
804	MfOfcij.exe
3408	zjmYOcJ.exe
1036	AqqwtPs.exe
396	mcJhGqL.exe
4272	oXExmed.exe
1924	UscjBEO.exe
3080	MVNiaSX.exe
4828	JKmdpaK.exe
4952	UMyQTKn.exe
4240	XaGezRm.exe
4396	awjDIqb.exe
4516	DvWoelV.exe
4564	sUIiJYl.exe
668	wQELsjQ.exe
3008	PHjvkkj.exe
4844	gtvRVlU.exe
3240	eVrAvaH.exe
1696	IKeUuaF.exe
1892	CbzSWLk.exe
1612	msZDnwS.exe
3624	PyyUjwg.exe
5076	nOFYqFI.exe
4664	pWApPKr.exe
1092	wmJrAGj.exe
1400	RWQMDnw.exe
3160	BcFZefQ.exe
1180	QuZSJdv.exe
5052	MmIwLLq.exe
2348	oNWogbt.exe
2448	isEusrR.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\eWFGPgj.exe	6c247d1995ef61452e73c18f6cf90c8df5b65982adf6787521c48a7c4308f5a4.exe
File created	C:\Windows\System\JBOlQvd.exe	6c247d1995ef61452e73c18f6cf90c8df5b65982adf6787521c48a7c4308f5a4.exe
File created	C:\Windows\System\wMCOdbr.exe	6c247d1995ef61452e73c18f6cf90c8df5b65982adf6787521c48a7c4308f5a4.exe
File created	C:\Windows\System\WQQQPDy.exe	6c247d1995ef61452e73c18f6cf90c8df5b65982adf6787521c48a7c4308f5a4.exe
File created	C:\Windows\System\UshewLX.exe	6c247d1995ef61452e73c18f6cf90c8df5b65982adf6787521c48a7c4308f5a4.exe
File created	C:\Windows\System\Mqxktlg.exe	6c247d1995ef61452e73c18f6cf90c8df5b65982adf6787521c48a7c4308f5a4.exe
File created	C:\Windows\System\pRekakD.exe	6c247d1995ef61452e73c18f6cf90c8df5b65982adf6787521c48a7c4308f5a4.exe
File created	C:\Windows\System\EiwTmGh.exe	6c247d1995ef61452e73c18f6cf90c8df5b65982adf6787521c48a7c4308f5a4.exe
File created	C:\Windows\System\NreWBuW.exe	6c247d1995ef61452e73c18f6cf90c8df5b65982adf6787521c48a7c4308f5a4.exe
File created	C:\Windows\System\HtocONE.exe	6c247d1995ef61452e73c18f6cf90c8df5b65982adf6787521c48a7c4308f5a4.exe
File created	C:\Windows\System\HOVzQBz.exe	6c247d1995ef61452e73c18f6cf90c8df5b65982adf6787521c48a7c4308f5a4.exe
File created	C:\Windows\System\xqIWpBF.exe	6c247d1995ef61452e73c18f6cf90c8df5b65982adf6787521c48a7c4308f5a4.exe
File created	C:\Windows\System\yxywGSx.exe	6c247d1995ef61452e73c18f6cf90c8df5b65982adf6787521c48a7c4308f5a4.exe
File created	C:\Windows\System\HoRzDDb.exe	6c247d1995ef61452e73c18f6cf90c8df5b65982adf6787521c48a7c4308f5a4.exe
File created	C:\Windows\System\EjnWKHU.exe	6c247d1995ef61452e73c18f6cf90c8df5b65982adf6787521c48a7c4308f5a4.exe
File created	C:\Windows\System\DFEfmIt.exe	6c247d1995ef61452e73c18f6cf90c8df5b65982adf6787521c48a7c4308f5a4.exe
File created	C:\Windows\System\YVGDaoF.exe	6c247d1995ef61452e73c18f6cf90c8df5b65982adf6787521c48a7c4308f5a4.exe
File created	C:\Windows\System\NfmJsFt.exe	6c247d1995ef61452e73c18f6cf90c8df5b65982adf6787521c48a7c4308f5a4.exe
File created	C:\Windows\System\mQfMuQb.exe	6c247d1995ef61452e73c18f6cf90c8df5b65982adf6787521c48a7c4308f5a4.exe
File created	C:\Windows\System\CKqmMXy.exe	6c247d1995ef61452e73c18f6cf90c8df5b65982adf6787521c48a7c4308f5a4.exe
File created	C:\Windows\System\aniDiXo.exe	6c247d1995ef61452e73c18f6cf90c8df5b65982adf6787521c48a7c4308f5a4.exe
File created	C:\Windows\System\FHlIPgR.exe	6c247d1995ef61452e73c18f6cf90c8df5b65982adf6787521c48a7c4308f5a4.exe
File created	C:\Windows\System\YwKKqVL.exe	6c247d1995ef61452e73c18f6cf90c8df5b65982adf6787521c48a7c4308f5a4.exe
File created	C:\Windows\System\jTrWadD.exe	6c247d1995ef61452e73c18f6cf90c8df5b65982adf6787521c48a7c4308f5a4.exe
File created	C:\Windows\System\CvkbAcE.exe	6c247d1995ef61452e73c18f6cf90c8df5b65982adf6787521c48a7c4308f5a4.exe
File created	C:\Windows\System\hXBlgVN.exe	6c247d1995ef61452e73c18f6cf90c8df5b65982adf6787521c48a7c4308f5a4.exe
File created	C:\Windows\System\neIYQEp.exe	6c247d1995ef61452e73c18f6cf90c8df5b65982adf6787521c48a7c4308f5a4.exe
File created	C:\Windows\System\dfauokb.exe	6c247d1995ef61452e73c18f6cf90c8df5b65982adf6787521c48a7c4308f5a4.exe
File created	C:\Windows\System\dyIZKLh.exe	6c247d1995ef61452e73c18f6cf90c8df5b65982adf6787521c48a7c4308f5a4.exe
File created	C:\Windows\System\CcgzJHM.exe	6c247d1995ef61452e73c18f6cf90c8df5b65982adf6787521c48a7c4308f5a4.exe
File created	C:\Windows\System\MLvkLqI.exe	6c247d1995ef61452e73c18f6cf90c8df5b65982adf6787521c48a7c4308f5a4.exe
File created	C:\Windows\System\gdbCrwf.exe	6c247d1995ef61452e73c18f6cf90c8df5b65982adf6787521c48a7c4308f5a4.exe
File created	C:\Windows\System\GvSFhmf.exe	6c247d1995ef61452e73c18f6cf90c8df5b65982adf6787521c48a7c4308f5a4.exe
File created	C:\Windows\System\PFUzQbx.exe	6c247d1995ef61452e73c18f6cf90c8df5b65982adf6787521c48a7c4308f5a4.exe
File created	C:\Windows\System\XLQuIse.exe	6c247d1995ef61452e73c18f6cf90c8df5b65982adf6787521c48a7c4308f5a4.exe
File created	C:\Windows\System\cguTyyp.exe	6c247d1995ef61452e73c18f6cf90c8df5b65982adf6787521c48a7c4308f5a4.exe
File created	C:\Windows\System\mcJhGqL.exe	6c247d1995ef61452e73c18f6cf90c8df5b65982adf6787521c48a7c4308f5a4.exe
File created	C:\Windows\System\USzMgqc.exe	6c247d1995ef61452e73c18f6cf90c8df5b65982adf6787521c48a7c4308f5a4.exe
File created	C:\Windows\System\dlSOWDG.exe	6c247d1995ef61452e73c18f6cf90c8df5b65982adf6787521c48a7c4308f5a4.exe
File created	C:\Windows\System\fLIgbNT.exe	6c247d1995ef61452e73c18f6cf90c8df5b65982adf6787521c48a7c4308f5a4.exe
File created	C:\Windows\System\oNWogbt.exe	6c247d1995ef61452e73c18f6cf90c8df5b65982adf6787521c48a7c4308f5a4.exe
File created	C:\Windows\System\RCRmfhd.exe	6c247d1995ef61452e73c18f6cf90c8df5b65982adf6787521c48a7c4308f5a4.exe
File created	C:\Windows\System\vWNmtEo.exe	6c247d1995ef61452e73c18f6cf90c8df5b65982adf6787521c48a7c4308f5a4.exe
File created	C:\Windows\System\HhjSRaJ.exe	6c247d1995ef61452e73c18f6cf90c8df5b65982adf6787521c48a7c4308f5a4.exe
File created	C:\Windows\System\IAxWsKQ.exe	6c247d1995ef61452e73c18f6cf90c8df5b65982adf6787521c48a7c4308f5a4.exe
File created	C:\Windows\System\oDjVqbG.exe	6c247d1995ef61452e73c18f6cf90c8df5b65982adf6787521c48a7c4308f5a4.exe
File created	C:\Windows\System\aNMsJdw.exe	6c247d1995ef61452e73c18f6cf90c8df5b65982adf6787521c48a7c4308f5a4.exe
File created	C:\Windows\System\FieHgAz.exe	6c247d1995ef61452e73c18f6cf90c8df5b65982adf6787521c48a7c4308f5a4.exe
File created	C:\Windows\System\fOOsyvq.exe	6c247d1995ef61452e73c18f6cf90c8df5b65982adf6787521c48a7c4308f5a4.exe
File created	C:\Windows\System\wMqlFGz.exe	6c247d1995ef61452e73c18f6cf90c8df5b65982adf6787521c48a7c4308f5a4.exe
File created	C:\Windows\System\oKlcLoc.exe	6c247d1995ef61452e73c18f6cf90c8df5b65982adf6787521c48a7c4308f5a4.exe
File created	C:\Windows\System\pauDKkk.exe	6c247d1995ef61452e73c18f6cf90c8df5b65982adf6787521c48a7c4308f5a4.exe
File created	C:\Windows\System\FvTXlLo.exe	6c247d1995ef61452e73c18f6cf90c8df5b65982adf6787521c48a7c4308f5a4.exe
File created	C:\Windows\System\fEmPaEm.exe	6c247d1995ef61452e73c18f6cf90c8df5b65982adf6787521c48a7c4308f5a4.exe
File created	C:\Windows\System\GQGOdMM.exe	6c247d1995ef61452e73c18f6cf90c8df5b65982adf6787521c48a7c4308f5a4.exe
File created	C:\Windows\System\nzdirYv.exe	6c247d1995ef61452e73c18f6cf90c8df5b65982adf6787521c48a7c4308f5a4.exe
File created	C:\Windows\System\hajzBbj.exe	6c247d1995ef61452e73c18f6cf90c8df5b65982adf6787521c48a7c4308f5a4.exe
File created	C:\Windows\System\HfZRnEC.exe	6c247d1995ef61452e73c18f6cf90c8df5b65982adf6787521c48a7c4308f5a4.exe
File created	C:\Windows\System\EDokNYQ.exe	6c247d1995ef61452e73c18f6cf90c8df5b65982adf6787521c48a7c4308f5a4.exe
File created	C:\Windows\System\roDOkLm.exe	6c247d1995ef61452e73c18f6cf90c8df5b65982adf6787521c48a7c4308f5a4.exe
File created	C:\Windows\System\ngYKLph.exe	6c247d1995ef61452e73c18f6cf90c8df5b65982adf6787521c48a7c4308f5a4.exe
File created	C:\Windows\System\CEcmSsW.exe	6c247d1995ef61452e73c18f6cf90c8df5b65982adf6787521c48a7c4308f5a4.exe
File created	C:\Windows\System\wVpyUOD.exe	6c247d1995ef61452e73c18f6cf90c8df5b65982adf6787521c48a7c4308f5a4.exe
File created	C:\Windows\System\ahJfthC.exe	6c247d1995ef61452e73c18f6cf90c8df5b65982adf6787521c48a7c4308f5a4.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	15592	dwm.exe
Token: SeChangeNotifyPrivilege	15592	dwm.exe
Token: 33	15592	dwm.exe
Token: SeIncBasePriorityPrivilege	15592	dwm.exe
Token: SeShutdownPrivilege	15592	dwm.exe
Token: SeCreatePagefilePrivilege	15592	dwm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1764 wrote to memory of 3260	1764	6c247d1995ef61452e73c18f6cf90c8df5b65982adf6787521c48a7c4308f5a4.exe	84
PID 1764 wrote to memory of 3260	1764	6c247d1995ef61452e73c18f6cf90c8df5b65982adf6787521c48a7c4308f5a4.exe	84
PID 1764 wrote to memory of 1968	1764	6c247d1995ef61452e73c18f6cf90c8df5b65982adf6787521c48a7c4308f5a4.exe	85
PID 1764 wrote to memory of 1968	1764	6c247d1995ef61452e73c18f6cf90c8df5b65982adf6787521c48a7c4308f5a4.exe	85
PID 1764 wrote to memory of 4088	1764	6c247d1995ef61452e73c18f6cf90c8df5b65982adf6787521c48a7c4308f5a4.exe	86
PID 1764 wrote to memory of 4088	1764	6c247d1995ef61452e73c18f6cf90c8df5b65982adf6787521c48a7c4308f5a4.exe	86
PID 1764 wrote to memory of 3296	1764	6c247d1995ef61452e73c18f6cf90c8df5b65982adf6787521c48a7c4308f5a4.exe	87
PID 1764 wrote to memory of 3296	1764	6c247d1995ef61452e73c18f6cf90c8df5b65982adf6787521c48a7c4308f5a4.exe	87
PID 1764 wrote to memory of 1604	1764	6c247d1995ef61452e73c18f6cf90c8df5b65982adf6787521c48a7c4308f5a4.exe	88
PID 1764 wrote to memory of 1604	1764	6c247d1995ef61452e73c18f6cf90c8df5b65982adf6787521c48a7c4308f5a4.exe	88
PID 1764 wrote to memory of 4132	1764	6c247d1995ef61452e73c18f6cf90c8df5b65982adf6787521c48a7c4308f5a4.exe	89
PID 1764 wrote to memory of 4132	1764	6c247d1995ef61452e73c18f6cf90c8df5b65982adf6787521c48a7c4308f5a4.exe	89
PID 1764 wrote to memory of 3096	1764	6c247d1995ef61452e73c18f6cf90c8df5b65982adf6787521c48a7c4308f5a4.exe	90
PID 1764 wrote to memory of 3096	1764	6c247d1995ef61452e73c18f6cf90c8df5b65982adf6787521c48a7c4308f5a4.exe	90
PID 1764 wrote to memory of 4832	1764	6c247d1995ef61452e73c18f6cf90c8df5b65982adf6787521c48a7c4308f5a4.exe	91
PID 1764 wrote to memory of 4832	1764	6c247d1995ef61452e73c18f6cf90c8df5b65982adf6787521c48a7c4308f5a4.exe	91
PID 1764 wrote to memory of 1744	1764	6c247d1995ef61452e73c18f6cf90c8df5b65982adf6787521c48a7c4308f5a4.exe	92
PID 1764 wrote to memory of 1744	1764	6c247d1995ef61452e73c18f6cf90c8df5b65982adf6787521c48a7c4308f5a4.exe	92
PID 1764 wrote to memory of 1232	1764	6c247d1995ef61452e73c18f6cf90c8df5b65982adf6787521c48a7c4308f5a4.exe	93
PID 1764 wrote to memory of 1232	1764	6c247d1995ef61452e73c18f6cf90c8df5b65982adf6787521c48a7c4308f5a4.exe	93
PID 1764 wrote to memory of 2736	1764	6c247d1995ef61452e73c18f6cf90c8df5b65982adf6787521c48a7c4308f5a4.exe	94
PID 1764 wrote to memory of 2736	1764	6c247d1995ef61452e73c18f6cf90c8df5b65982adf6787521c48a7c4308f5a4.exe	94
PID 1764 wrote to memory of 2184	1764	6c247d1995ef61452e73c18f6cf90c8df5b65982adf6787521c48a7c4308f5a4.exe	95
PID 1764 wrote to memory of 2184	1764	6c247d1995ef61452e73c18f6cf90c8df5b65982adf6787521c48a7c4308f5a4.exe	95
PID 1764 wrote to memory of 1748	1764	6c247d1995ef61452e73c18f6cf90c8df5b65982adf6787521c48a7c4308f5a4.exe	96
PID 1764 wrote to memory of 1748	1764	6c247d1995ef61452e73c18f6cf90c8df5b65982adf6787521c48a7c4308f5a4.exe	96
PID 1764 wrote to memory of 1388	1764	6c247d1995ef61452e73c18f6cf90c8df5b65982adf6787521c48a7c4308f5a4.exe	97
PID 1764 wrote to memory of 1388	1764	6c247d1995ef61452e73c18f6cf90c8df5b65982adf6787521c48a7c4308f5a4.exe	97
PID 1764 wrote to memory of 2052	1764	6c247d1995ef61452e73c18f6cf90c8df5b65982adf6787521c48a7c4308f5a4.exe	98
PID 1764 wrote to memory of 2052	1764	6c247d1995ef61452e73c18f6cf90c8df5b65982adf6787521c48a7c4308f5a4.exe	98
PID 1764 wrote to memory of 5004	1764	6c247d1995ef61452e73c18f6cf90c8df5b65982adf6787521c48a7c4308f5a4.exe	99
PID 1764 wrote to memory of 5004	1764	6c247d1995ef61452e73c18f6cf90c8df5b65982adf6787521c48a7c4308f5a4.exe	99
PID 1764 wrote to memory of 1080	1764	6c247d1995ef61452e73c18f6cf90c8df5b65982adf6787521c48a7c4308f5a4.exe	100
PID 1764 wrote to memory of 1080	1764	6c247d1995ef61452e73c18f6cf90c8df5b65982adf6787521c48a7c4308f5a4.exe	100
PID 1764 wrote to memory of 3264	1764	6c247d1995ef61452e73c18f6cf90c8df5b65982adf6787521c48a7c4308f5a4.exe	101
PID 1764 wrote to memory of 3264	1764	6c247d1995ef61452e73c18f6cf90c8df5b65982adf6787521c48a7c4308f5a4.exe	101
PID 1764 wrote to memory of 1736	1764	6c247d1995ef61452e73c18f6cf90c8df5b65982adf6787521c48a7c4308f5a4.exe	102
PID 1764 wrote to memory of 1736	1764	6c247d1995ef61452e73c18f6cf90c8df5b65982adf6787521c48a7c4308f5a4.exe	102
PID 1764 wrote to memory of 4644	1764	6c247d1995ef61452e73c18f6cf90c8df5b65982adf6787521c48a7c4308f5a4.exe	103
PID 1764 wrote to memory of 4644	1764	6c247d1995ef61452e73c18f6cf90c8df5b65982adf6787521c48a7c4308f5a4.exe	103
PID 1764 wrote to memory of 4696	1764	6c247d1995ef61452e73c18f6cf90c8df5b65982adf6787521c48a7c4308f5a4.exe	104
PID 1764 wrote to memory of 4696	1764	6c247d1995ef61452e73c18f6cf90c8df5b65982adf6787521c48a7c4308f5a4.exe	104
PID 1764 wrote to memory of 2508	1764	6c247d1995ef61452e73c18f6cf90c8df5b65982adf6787521c48a7c4308f5a4.exe	105
PID 1764 wrote to memory of 2508	1764	6c247d1995ef61452e73c18f6cf90c8df5b65982adf6787521c48a7c4308f5a4.exe	105
PID 1764 wrote to memory of 4576	1764	6c247d1995ef61452e73c18f6cf90c8df5b65982adf6787521c48a7c4308f5a4.exe	106
PID 1764 wrote to memory of 4576	1764	6c247d1995ef61452e73c18f6cf90c8df5b65982adf6787521c48a7c4308f5a4.exe	106
PID 1764 wrote to memory of 1716	1764	6c247d1995ef61452e73c18f6cf90c8df5b65982adf6787521c48a7c4308f5a4.exe	107
PID 1764 wrote to memory of 1716	1764	6c247d1995ef61452e73c18f6cf90c8df5b65982adf6787521c48a7c4308f5a4.exe	107
PID 1764 wrote to memory of 1788	1764	6c247d1995ef61452e73c18f6cf90c8df5b65982adf6787521c48a7c4308f5a4.exe	108
PID 1764 wrote to memory of 1788	1764	6c247d1995ef61452e73c18f6cf90c8df5b65982adf6787521c48a7c4308f5a4.exe	108
PID 1764 wrote to memory of 5008	1764	6c247d1995ef61452e73c18f6cf90c8df5b65982adf6787521c48a7c4308f5a4.exe	109
PID 1764 wrote to memory of 5008	1764	6c247d1995ef61452e73c18f6cf90c8df5b65982adf6787521c48a7c4308f5a4.exe	109
PID 1764 wrote to memory of 2768	1764	6c247d1995ef61452e73c18f6cf90c8df5b65982adf6787521c48a7c4308f5a4.exe	110
PID 1764 wrote to memory of 2768	1764	6c247d1995ef61452e73c18f6cf90c8df5b65982adf6787521c48a7c4308f5a4.exe	110
PID 1764 wrote to memory of 664	1764	6c247d1995ef61452e73c18f6cf90c8df5b65982adf6787521c48a7c4308f5a4.exe	111
PID 1764 wrote to memory of 664	1764	6c247d1995ef61452e73c18f6cf90c8df5b65982adf6787521c48a7c4308f5a4.exe	111
PID 1764 wrote to memory of 464	1764	6c247d1995ef61452e73c18f6cf90c8df5b65982adf6787521c48a7c4308f5a4.exe	112
PID 1764 wrote to memory of 464	1764	6c247d1995ef61452e73c18f6cf90c8df5b65982adf6787521c48a7c4308f5a4.exe	112
PID 1764 wrote to memory of 2876	1764	6c247d1995ef61452e73c18f6cf90c8df5b65982adf6787521c48a7c4308f5a4.exe	113
PID 1764 wrote to memory of 2876	1764	6c247d1995ef61452e73c18f6cf90c8df5b65982adf6787521c48a7c4308f5a4.exe	113
PID 1764 wrote to memory of 4692	1764	6c247d1995ef61452e73c18f6cf90c8df5b65982adf6787521c48a7c4308f5a4.exe	114
PID 1764 wrote to memory of 4692	1764	6c247d1995ef61452e73c18f6cf90c8df5b65982adf6787521c48a7c4308f5a4.exe	114
PID 1764 wrote to memory of 2480	1764	6c247d1995ef61452e73c18f6cf90c8df5b65982adf6787521c48a7c4308f5a4.exe	115
PID 1764 wrote to memory of 2480	1764	6c247d1995ef61452e73c18f6cf90c8df5b65982adf6787521c48a7c4308f5a4.exe	115

C:\Users\Admin\AppData\Local\Temp\6c247d1995ef61452e73c18f6cf90c8df5b65982adf6787521c48a7c4308f5a4.exe
"C:\Users\Admin\AppData\Local\Temp\6c247d1995ef61452e73c18f6cf90c8df5b65982adf6787521c48a7c4308f5a4.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1764
- C:\Windows\System\JxzyBug.exe
  C:\Windows\System\JxzyBug.exe
  2⤵
  - Executes dropped EXE
  PID:3260
- C:\Windows\System\TISUxms.exe
  C:\Windows\System\TISUxms.exe
  2⤵
  - Executes dropped EXE
  PID:1968
- C:\Windows\System\zpWLXWb.exe
  C:\Windows\System\zpWLXWb.exe
  2⤵
  - Executes dropped EXE
  PID:4088
- C:\Windows\System\RkYMtPv.exe
  C:\Windows\System\RkYMtPv.exe
  2⤵
  - Executes dropped EXE
  PID:3296
- C:\Windows\System\BQAGPkh.exe
  C:\Windows\System\BQAGPkh.exe
  2⤵
  - Executes dropped EXE
  PID:1604
- C:\Windows\System\VeRuzQt.exe
  C:\Windows\System\VeRuzQt.exe
  2⤵
  - Executes dropped EXE
  PID:4132
- C:\Windows\System\YVGDaoF.exe
  C:\Windows\System\YVGDaoF.exe
  2⤵
  - Executes dropped EXE
  PID:3096
- C:\Windows\System\GtFDpei.exe
  C:\Windows\System\GtFDpei.exe
  2⤵
  - Executes dropped EXE
  PID:4832
- C:\Windows\System\QkqscQl.exe
  C:\Windows\System\QkqscQl.exe
  2⤵
  - Executes dropped EXE
  PID:1744
- C:\Windows\System\YFtVYgp.exe
  C:\Windows\System\YFtVYgp.exe
  2⤵
  - Executes dropped EXE
  PID:1232
- C:\Windows\System\LmVlUDM.exe
  C:\Windows\System\LmVlUDM.exe
  2⤵
  - Executes dropped EXE
  PID:2736
- C:\Windows\System\lIHWJNf.exe
  C:\Windows\System\lIHWJNf.exe
  2⤵
  - Executes dropped EXE
  PID:2184
- C:\Windows\System\sidGucO.exe
  C:\Windows\System\sidGucO.exe
  2⤵
  - Executes dropped EXE
  PID:1748
- C:\Windows\System\DsUTYja.exe
  C:\Windows\System\DsUTYja.exe
  2⤵
  - Executes dropped EXE
  PID:1388
- C:\Windows\System\reDpkRh.exe
  C:\Windows\System\reDpkRh.exe
  2⤵
  - Executes dropped EXE
  PID:2052
- C:\Windows\System\VoXEdtL.exe
  C:\Windows\System\VoXEdtL.exe
  2⤵
  - Executes dropped EXE
  PID:5004
- C:\Windows\System\selsPNd.exe
  C:\Windows\System\selsPNd.exe
  2⤵
  - Executes dropped EXE
  PID:1080
- C:\Windows\System\fWDiqzo.exe
  C:\Windows\System\fWDiqzo.exe
  2⤵
  - Executes dropped EXE
  PID:3264
- C:\Windows\System\QfUtbbX.exe
  C:\Windows\System\QfUtbbX.exe
  2⤵
  - Executes dropped EXE
  PID:1736
- C:\Windows\System\GQGOdMM.exe
  C:\Windows\System\GQGOdMM.exe
  2⤵
  - Executes dropped EXE
  PID:4644
- C:\Windows\System\NtDsmhb.exe
  C:\Windows\System\NtDsmhb.exe
  2⤵
  - Executes dropped EXE
  PID:4696
- C:\Windows\System\tiwdyOe.exe
  C:\Windows\System\tiwdyOe.exe
  2⤵
  - Executes dropped EXE
  PID:2508
- C:\Windows\System\roDOkLm.exe
  C:\Windows\System\roDOkLm.exe
  2⤵
  - Executes dropped EXE
  PID:4576
- C:\Windows\System\jwsWJqw.exe
  C:\Windows\System\jwsWJqw.exe
  2⤵
  - Executes dropped EXE
  PID:1716
- C:\Windows\System\UIawwtV.exe
  C:\Windows\System\UIawwtV.exe
  2⤵
  - Executes dropped EXE
  PID:1788
- C:\Windows\System\ZRtoRyY.exe
  C:\Windows\System\ZRtoRyY.exe
  2⤵
  - Executes dropped EXE
  PID:5008
- C:\Windows\System\rFXDbKf.exe
  C:\Windows\System\rFXDbKf.exe
  2⤵
  - Executes dropped EXE
  PID:2768
- C:\Windows\System\hAIzgOE.exe
  C:\Windows\System\hAIzgOE.exe
  2⤵
  - Executes dropped EXE
  PID:664
- C:\Windows\System\LtNLBtP.exe
  C:\Windows\System\LtNLBtP.exe
  2⤵
  - Executes dropped EXE
  PID:464
- C:\Windows\System\VjxymAo.exe
  C:\Windows\System\VjxymAo.exe
  2⤵
  - Executes dropped EXE
  PID:2876
- C:\Windows\System\rTouxBL.exe
  C:\Windows\System\rTouxBL.exe
  2⤵
  - Executes dropped EXE
  PID:4692
- C:\Windows\System\MjZgYuh.exe
  C:\Windows\System\MjZgYuh.exe
  2⤵
  - Executes dropped EXE
  PID:2480
- C:\Windows\System\UuQrECb.exe
  C:\Windows\System\UuQrECb.exe
  2⤵
  - Executes dropped EXE
  PID:2904
- C:\Windows\System\WfFhaPV.exe
  C:\Windows\System\WfFhaPV.exe
  2⤵
  - Executes dropped EXE
  PID:4884
- C:\Windows\System\MfOfcij.exe
  C:\Windows\System\MfOfcij.exe
  2⤵
  - Executes dropped EXE
  PID:804
- C:\Windows\System\zjmYOcJ.exe
  C:\Windows\System\zjmYOcJ.exe
  2⤵
  - Executes dropped EXE
  PID:3408
- C:\Windows\System\AqqwtPs.exe
  C:\Windows\System\AqqwtPs.exe
  2⤵
  - Executes dropped EXE
  PID:1036
- C:\Windows\System\mcJhGqL.exe
  C:\Windows\System\mcJhGqL.exe
  2⤵
  - Executes dropped EXE
  PID:396
- C:\Windows\System\oXExmed.exe
  C:\Windows\System\oXExmed.exe
  2⤵
  - Executes dropped EXE
  PID:4272
- C:\Windows\System\UscjBEO.exe
  C:\Windows\System\UscjBEO.exe
  2⤵
  - Executes dropped EXE
  PID:1924
- C:\Windows\System\MVNiaSX.exe
  C:\Windows\System\MVNiaSX.exe
  2⤵
  - Executes dropped EXE
  PID:3080
- C:\Windows\System\JKmdpaK.exe
  C:\Windows\System\JKmdpaK.exe
  2⤵
  - Executes dropped EXE
  PID:4828
- C:\Windows\System\UMyQTKn.exe
  C:\Windows\System\UMyQTKn.exe
  2⤵
  - Executes dropped EXE
  PID:4952
- C:\Windows\System\XaGezRm.exe
  C:\Windows\System\XaGezRm.exe
  2⤵
  - Executes dropped EXE
  PID:4240
- C:\Windows\System\awjDIqb.exe
  C:\Windows\System\awjDIqb.exe
  2⤵
  - Executes dropped EXE
  PID:4396
- C:\Windows\System\DvWoelV.exe
  C:\Windows\System\DvWoelV.exe
  2⤵
  - Executes dropped EXE
  PID:4516
- C:\Windows\System\sUIiJYl.exe
  C:\Windows\System\sUIiJYl.exe
  2⤵
  - Executes dropped EXE
  PID:4564
- C:\Windows\System\wQELsjQ.exe
  C:\Windows\System\wQELsjQ.exe
  2⤵
  - Executes dropped EXE
  PID:668
- C:\Windows\System\PHjvkkj.exe
  C:\Windows\System\PHjvkkj.exe
  2⤵
  - Executes dropped EXE
  PID:3008
- C:\Windows\System\gtvRVlU.exe
  C:\Windows\System\gtvRVlU.exe
  2⤵
  - Executes dropped EXE
  PID:4844
- C:\Windows\System\eVrAvaH.exe
  C:\Windows\System\eVrAvaH.exe
  2⤵
  - Executes dropped EXE
  PID:3240
- C:\Windows\System\IKeUuaF.exe
  C:\Windows\System\IKeUuaF.exe
  2⤵
  - Executes dropped EXE
  PID:1696
- C:\Windows\System\CbzSWLk.exe
  C:\Windows\System\CbzSWLk.exe
  2⤵
  - Executes dropped EXE
  PID:1892
- C:\Windows\System\msZDnwS.exe
  C:\Windows\System\msZDnwS.exe
  2⤵
  - Executes dropped EXE
  PID:1612
- C:\Windows\System\PyyUjwg.exe
  C:\Windows\System\PyyUjwg.exe
  2⤵
  - Executes dropped EXE
  PID:3624
- C:\Windows\System\nOFYqFI.exe
  C:\Windows\System\nOFYqFI.exe
  2⤵
  - Executes dropped EXE
  PID:5076
- C:\Windows\System\pWApPKr.exe
  C:\Windows\System\pWApPKr.exe
  2⤵
  - Executes dropped EXE
  PID:4664
- C:\Windows\System\wmJrAGj.exe
  C:\Windows\System\wmJrAGj.exe
  2⤵
  - Executes dropped EXE
  PID:1092
- C:\Windows\System\RWQMDnw.exe
  C:\Windows\System\RWQMDnw.exe
  2⤵
  - Executes dropped EXE
  PID:1400
- C:\Windows\System\BcFZefQ.exe
  C:\Windows\System\BcFZefQ.exe
  2⤵
  - Executes dropped EXE
  PID:3160
- C:\Windows\System\QuZSJdv.exe
  C:\Windows\System\QuZSJdv.exe
  2⤵
  - Executes dropped EXE
  PID:1180
- C:\Windows\System\MmIwLLq.exe
  C:\Windows\System\MmIwLLq.exe
  2⤵
  - Executes dropped EXE
  PID:5052
- C:\Windows\System\oNWogbt.exe
  C:\Windows\System\oNWogbt.exe
  2⤵
  - Executes dropped EXE
  PID:2348
- C:\Windows\System\isEusrR.exe
  C:\Windows\System\isEusrR.exe
  2⤵
  - Executes dropped EXE
  PID:2448
- C:\Windows\System\EVUyxhY.exe
  C:\Windows\System\EVUyxhY.exe
  2⤵
  PID:852
- C:\Windows\System\neIYQEp.exe
  C:\Windows\System\neIYQEp.exe
  2⤵
  PID:4436
- C:\Windows\System\UsHxrjm.exe
  C:\Windows\System\UsHxrjm.exe
  2⤵
  PID:3896
- C:\Windows\System\dSjYSAF.exe
  C:\Windows\System\dSjYSAF.exe
  2⤵
  PID:3492
- C:\Windows\System\RCRmfhd.exe
  C:\Windows\System\RCRmfhd.exe
  2⤵
  PID:3824
- C:\Windows\System\PIERcAJ.exe
  C:\Windows\System\PIERcAJ.exe
  2⤵
  PID:3316
- C:\Windows\System\zUPrvoV.exe
  C:\Windows\System\zUPrvoV.exe
  2⤵
  PID:3612
- C:\Windows\System\OtbGYAE.exe
  C:\Windows\System\OtbGYAE.exe
  2⤵
  PID:2464
- C:\Windows\System\EKXGsUy.exe
  C:\Windows\System\EKXGsUy.exe
  2⤵
  PID:5148
- C:\Windows\System\nMgPNFT.exe
  C:\Windows\System\nMgPNFT.exe
  2⤵
  PID:5180
- C:\Windows\System\jgqCrMx.exe
  C:\Windows\System\jgqCrMx.exe
  2⤵
  PID:5204
- C:\Windows\System\JzmRyhx.exe
  C:\Windows\System\JzmRyhx.exe
  2⤵
  PID:5232
- C:\Windows\System\DJxJTkT.exe
  C:\Windows\System\DJxJTkT.exe
  2⤵
  PID:5260
- C:\Windows\System\YjyrDbV.exe
  C:\Windows\System\YjyrDbV.exe
  2⤵
  PID:5288
- C:\Windows\System\YKZBmxs.exe
  C:\Windows\System\YKZBmxs.exe
  2⤵
  PID:5320
- C:\Windows\System\HxngYud.exe
  C:\Windows\System\HxngYud.exe
  2⤵
  PID:5344
- C:\Windows\System\IGZtzUc.exe
  C:\Windows\System\IGZtzUc.exe
  2⤵
  PID:5372
- C:\Windows\System\HRrkbyl.exe
  C:\Windows\System\HRrkbyl.exe
  2⤵
  PID:5400
- C:\Windows\System\rFVWUCh.exe
  C:\Windows\System\rFVWUCh.exe
  2⤵
  PID:5428
- C:\Windows\System\khbtMdq.exe
  C:\Windows\System\khbtMdq.exe
  2⤵
  PID:5456
- C:\Windows\System\syldrtq.exe
  C:\Windows\System\syldrtq.exe
  2⤵
  PID:5488
- C:\Windows\System\QbvmmLc.exe
  C:\Windows\System\QbvmmLc.exe
  2⤵
  PID:5512
- C:\Windows\System\MAcMydk.exe
  C:\Windows\System\MAcMydk.exe
  2⤵
  PID:5540
- C:\Windows\System\bxkzxkP.exe
  C:\Windows\System\bxkzxkP.exe
  2⤵
  PID:5568
- C:\Windows\System\yrrwYCZ.exe
  C:\Windows\System\yrrwYCZ.exe
  2⤵
  PID:5600
- C:\Windows\System\JKyNKqI.exe
  C:\Windows\System\JKyNKqI.exe
  2⤵
  PID:5628
- C:\Windows\System\wPfrOJx.exe
  C:\Windows\System\wPfrOJx.exe
  2⤵
  PID:5656
- C:\Windows\System\ygbUply.exe
  C:\Windows\System\ygbUply.exe
  2⤵
  PID:5680
- C:\Windows\System\tBjkAmY.exe
  C:\Windows\System\tBjkAmY.exe
  2⤵
  PID:5708
- C:\Windows\System\QzQJCSD.exe
  C:\Windows\System\QzQJCSD.exe
  2⤵
  PID:5740
- C:\Windows\System\xymbrxX.exe
  C:\Windows\System\xymbrxX.exe
  2⤵
  PID:5768
- C:\Windows\System\BUDFBzn.exe
  C:\Windows\System\BUDFBzn.exe
  2⤵
  PID:5792
- C:\Windows\System\YEqoJsm.exe
  C:\Windows\System\YEqoJsm.exe
  2⤵
  PID:5820
- C:\Windows\System\rEEszdd.exe
  C:\Windows\System\rEEszdd.exe
  2⤵
  PID:5884
- C:\Windows\System\PFUzQbx.exe
  C:\Windows\System\PFUzQbx.exe
  2⤵
  PID:5900
- C:\Windows\System\nhyUBJl.exe
  C:\Windows\System\nhyUBJl.exe
  2⤵
  PID:5916
- C:\Windows\System\QsLMteF.exe
  C:\Windows\System\QsLMteF.exe
  2⤵
  PID:5940
- C:\Windows\System\IHdecBR.exe
  C:\Windows\System\IHdecBR.exe
  2⤵
  PID:5968
- C:\Windows\System\RuEcasl.exe
  C:\Windows\System\RuEcasl.exe
  2⤵
  PID:6000
- C:\Windows\System\SgdUqqv.exe
  C:\Windows\System\SgdUqqv.exe
  2⤵
  PID:6028
- C:\Windows\System\CcgzJHM.exe
  C:\Windows\System\CcgzJHM.exe
  2⤵
  PID:6056
- C:\Windows\System\oHgHjem.exe
  C:\Windows\System\oHgHjem.exe
  2⤵
  PID:6080
- C:\Windows\System\EKeIDup.exe
  C:\Windows\System\EKeIDup.exe
  2⤵
  PID:6108
- C:\Windows\System\xBvDnrQ.exe
  C:\Windows\System\xBvDnrQ.exe
  2⤵
  PID:6136
- C:\Windows\System\Kaxjffi.exe
  C:\Windows\System\Kaxjffi.exe
  2⤵
  PID:2676
- C:\Windows\System\uTGrFqE.exe
  C:\Windows\System\uTGrFqE.exe
  2⤵
  PID:1012
- C:\Windows\System\idTKQDJ.exe
  C:\Windows\System\idTKQDJ.exe
  2⤵
  PID:2248
- C:\Windows\System\lzgrbKr.exe
  C:\Windows\System\lzgrbKr.exe
  2⤵
  PID:544
- C:\Windows\System\UaIaeaz.exe
  C:\Windows\System\UaIaeaz.exe
  2⤵
  PID:5048
- C:\Windows\System\ePlBIJI.exe
  C:\Windows\System\ePlBIJI.exe
  2⤵
  PID:3052
- C:\Windows\System\aCaLHJE.exe
  C:\Windows\System\aCaLHJE.exe
  2⤵
  PID:2260
- C:\Windows\System\rdQgiWV.exe
  C:\Windows\System\rdQgiWV.exe
  2⤵
  PID:5168
- C:\Windows\System\NhVLvFA.exe
  C:\Windows\System\NhVLvFA.exe
  2⤵
  PID:5244
- C:\Windows\System\Vctktoy.exe
  C:\Windows\System\Vctktoy.exe
  2⤵
  PID:5304
- C:\Windows\System\zeSxUDD.exe
  C:\Windows\System\zeSxUDD.exe
  2⤵
  PID:5364
- C:\Windows\System\hTrXiki.exe
  C:\Windows\System\hTrXiki.exe
  2⤵
  PID:5440
- C:\Windows\System\SDHMfdf.exe
  C:\Windows\System\SDHMfdf.exe
  2⤵
  PID:5504
- C:\Windows\System\UwjTBME.exe
  C:\Windows\System\UwjTBME.exe
  2⤵
  PID:5560
- C:\Windows\System\uWwvuIr.exe
  C:\Windows\System\uWwvuIr.exe
  2⤵
  PID:5636
- C:\Windows\System\RYzofzR.exe
  C:\Windows\System\RYzofzR.exe
  2⤵
  PID:5692
- C:\Windows\System\kVRALqL.exe
  C:\Windows\System\kVRALqL.exe
  2⤵
  PID:5756
- C:\Windows\System\OfNtqSY.exe
  C:\Windows\System\OfNtqSY.exe
  2⤵
  PID:5812
- C:\Windows\System\rfpSYiH.exe
  C:\Windows\System\rfpSYiH.exe
  2⤵
  PID:5892
- C:\Windows\System\xWizxeb.exe
  C:\Windows\System\xWizxeb.exe
  2⤵
  PID:5960
- C:\Windows\System\pybgAOE.exe
  C:\Windows\System\pybgAOE.exe
  2⤵
  PID:6020
- C:\Windows\System\GmusbjM.exe
  C:\Windows\System\GmusbjM.exe
  2⤵
  PID:6096
- C:\Windows\System\dZvtRIk.exe
  C:\Windows\System\dZvtRIk.exe
  2⤵
  PID:1808
- C:\Windows\System\FiYNvVv.exe
  C:\Windows\System\FiYNvVv.exe
  2⤵
  PID:3620
- C:\Windows\System\txBevab.exe
  C:\Windows\System\txBevab.exe
  2⤵
  PID:436
- C:\Windows\System\NKJrAOp.exe
  C:\Windows\System\NKJrAOp.exe
  2⤵
  PID:5140
- C:\Windows\System\XrOMPjk.exe
  C:\Windows\System\XrOMPjk.exe
  2⤵
  PID:5280
- C:\Windows\System\KYtBvyI.exe
  C:\Windows\System\KYtBvyI.exe
  2⤵
  PID:5468
- C:\Windows\System\JWdlyzf.exe
  C:\Windows\System\JWdlyzf.exe
  2⤵
  PID:5608
- C:\Windows\System\yezxXTA.exe
  C:\Windows\System\yezxXTA.exe
  2⤵
  PID:5748
- C:\Windows\System\vMbazOE.exe
  C:\Windows\System\vMbazOE.exe
  2⤵
  PID:5932
- C:\Windows\System\VemltwA.exe
  C:\Windows\System\VemltwA.exe
  2⤵
  PID:6068
- C:\Windows\System\gDqTJJV.exe
  C:\Windows\System\gDqTJJV.exe
  2⤵
  PID:1172
- C:\Windows\System\CjScSKx.exe
  C:\Windows\System\CjScSKx.exe
  2⤵
  PID:6148
- C:\Windows\System\CKqmMXy.exe
  C:\Windows\System\CKqmMXy.exe
  2⤵
  PID:6176
- C:\Windows\System\LJYUQrx.exe
  C:\Windows\System\LJYUQrx.exe
  2⤵
  PID:6204
- C:\Windows\System\yCvJxiG.exe
  C:\Windows\System\yCvJxiG.exe
  2⤵
  PID:6232
- C:\Windows\System\hyvuFWo.exe
  C:\Windows\System\hyvuFWo.exe
  2⤵
  PID:6260
- C:\Windows\System\CQVrGnV.exe
  C:\Windows\System\CQVrGnV.exe
  2⤵
  PID:6288
- C:\Windows\System\UXmVuwk.exe
  C:\Windows\System\UXmVuwk.exe
  2⤵
  PID:6312
- C:\Windows\System\adDyxrT.exe
  C:\Windows\System\adDyxrT.exe
  2⤵
  PID:6340
- C:\Windows\System\EuUBBiK.exe
  C:\Windows\System\EuUBBiK.exe
  2⤵
  PID:6372
- C:\Windows\System\uMIYDSz.exe
  C:\Windows\System\uMIYDSz.exe
  2⤵
  PID:6400
- C:\Windows\System\ygAEDYA.exe
  C:\Windows\System\ygAEDYA.exe
  2⤵
  PID:6428
- C:\Windows\System\homWomZ.exe
  C:\Windows\System\homWomZ.exe
  2⤵
  PID:6452
- C:\Windows\System\dNUWwyj.exe
  C:\Windows\System\dNUWwyj.exe
  2⤵
  PID:6480
- C:\Windows\System\Ypfmlly.exe
  C:\Windows\System\Ypfmlly.exe
  2⤵
  PID:6512
- C:\Windows\System\RpQOdFD.exe
  C:\Windows\System\RpQOdFD.exe
  2⤵
  PID:6540
- C:\Windows\System\HzNMcMP.exe
  C:\Windows\System\HzNMcMP.exe
  2⤵
  PID:6556
- C:\Windows\System\MYINNKm.exe
  C:\Windows\System\MYINNKm.exe
  2⤵
  PID:6584
- C:\Windows\System\pWOtwcc.exe
  C:\Windows\System\pWOtwcc.exe
  2⤵
  PID:6620
- C:\Windows\System\knEKywK.exe
  C:\Windows\System\knEKywK.exe
  2⤵
  PID:6652
- C:\Windows\System\pnGjmog.exe
  C:\Windows\System\pnGjmog.exe
  2⤵
  PID:6676
- C:\Windows\System\gUstpRy.exe
  C:\Windows\System\gUstpRy.exe
  2⤵
  PID:6704
- C:\Windows\System\JZvBMIe.exe
  C:\Windows\System\JZvBMIe.exe
  2⤵
  PID:6736
- C:\Windows\System\EOZCfxN.exe
  C:\Windows\System\EOZCfxN.exe
  2⤵
  PID:6764
- C:\Windows\System\HtocONE.exe
  C:\Windows\System\HtocONE.exe
  2⤵
  PID:6792
- C:\Windows\System\vMccGPL.exe
  C:\Windows\System\vMccGPL.exe
  2⤵
  PID:6820
- C:\Windows\System\HWOwBEU.exe
  C:\Windows\System\HWOwBEU.exe
  2⤵
  PID:6848
- C:\Windows\System\LapYUBD.exe
  C:\Windows\System\LapYUBD.exe
  2⤵
  PID:6876
- C:\Windows\System\GIytvHN.exe
  C:\Windows\System\GIytvHN.exe
  2⤵
  PID:6904
- C:\Windows\System\rJXNWGY.exe
  C:\Windows\System\rJXNWGY.exe
  2⤵
  PID:6932
- C:\Windows\System\bgjYQip.exe
  C:\Windows\System\bgjYQip.exe
  2⤵
  PID:6960
- C:\Windows\System\ghPCCkz.exe
  C:\Windows\System\ghPCCkz.exe
  2⤵
  PID:6988
- C:\Windows\System\RXPjMcg.exe
  C:\Windows\System\RXPjMcg.exe
  2⤵
  PID:7016
- C:\Windows\System\jfRXyuA.exe
  C:\Windows\System\jfRXyuA.exe
  2⤵
  PID:7044
- C:\Windows\System\tQpwgUm.exe
  C:\Windows\System\tQpwgUm.exe
  2⤵
  PID:7072
- C:\Windows\System\NUdfItE.exe
  C:\Windows\System\NUdfItE.exe
  2⤵
  PID:7100
- C:\Windows\System\LJHieME.exe
  C:\Windows\System\LJHieME.exe
  2⤵
  PID:7128
- C:\Windows\System\SrjNBVi.exe
  C:\Windows\System\SrjNBVi.exe
  2⤵
  PID:7156
- C:\Windows\System\yBoSEqj.exe
  C:\Windows\System\yBoSEqj.exe
  2⤵
  PID:5412
- C:\Windows\System\AdUROwK.exe
  C:\Windows\System\AdUROwK.exe
  2⤵
  PID:5728
- C:\Windows\System\rebPtlj.exe
  C:\Windows\System\rebPtlj.exe
  2⤵
  PID:6128
- C:\Windows\System\pYPoOqu.exe
  C:\Windows\System\pYPoOqu.exe
  2⤵
  PID:6164
- C:\Windows\System\fndUptt.exe
  C:\Windows\System\fndUptt.exe
  2⤵
  PID:6224
- C:\Windows\System\KuKVKYa.exe
  C:\Windows\System\KuKVKYa.exe
  2⤵
  PID:6300
- C:\Windows\System\QLtUCaP.exe
  C:\Windows\System\QLtUCaP.exe
  2⤵
  PID:6332
- C:\Windows\System\ndtkDPc.exe
  C:\Windows\System\ndtkDPc.exe
  2⤵
  PID:4236
- C:\Windows\System\edEKOXt.exe
  C:\Windows\System\edEKOXt.exe
  2⤵
  PID:6444
- C:\Windows\System\npzOnBH.exe
  C:\Windows\System\npzOnBH.exe
  2⤵
  PID:6504
- C:\Windows\System\bPxmBYR.exe
  C:\Windows\System\bPxmBYR.exe
  2⤵
  PID:6572
- C:\Windows\System\hYNYVIr.exe
  C:\Windows\System\hYNYVIr.exe
  2⤵
  PID:6640
- C:\Windows\System\LJiZvoJ.exe
  C:\Windows\System\LJiZvoJ.exe
  2⤵
  PID:6696
- C:\Windows\System\MLvkLqI.exe
  C:\Windows\System\MLvkLqI.exe
  2⤵
  PID:6756
- C:\Windows\System\zPITWCh.exe
  C:\Windows\System\zPITWCh.exe
  2⤵
  PID:6812
- C:\Windows\System\EVsgEyB.exe
  C:\Windows\System\EVsgEyB.exe
  2⤵
  PID:6868
- C:\Windows\System\AxAWoxg.exe
  C:\Windows\System\AxAWoxg.exe
  2⤵
  PID:6924
- C:\Windows\System\TikviAF.exe
  C:\Windows\System\TikviAF.exe
  2⤵
  PID:7000
- C:\Windows\System\wMCOdbr.exe
  C:\Windows\System\wMCOdbr.exe
  2⤵
  PID:7056
- C:\Windows\System\dhZyGvl.exe
  C:\Windows\System\dhZyGvl.exe
  2⤵
  PID:7116
- C:\Windows\System\ozTQKRI.exe
  C:\Windows\System\ozTQKRI.exe
  2⤵
  PID:5276
- C:\Windows\System\wGEHAVr.exe
  C:\Windows\System\wGEHAVr.exe
  2⤵
  PID:5840
- C:\Windows\System\XiWyoot.exe
  C:\Windows\System\XiWyoot.exe
  2⤵
  PID:6328
- C:\Windows\System\fmJqbGn.exe
  C:\Windows\System\fmJqbGn.exe
  2⤵
  PID:3256
- C:\Windows\System\xqIWpBF.exe
  C:\Windows\System\xqIWpBF.exe
  2⤵
  PID:6532
- C:\Windows\System\vPBeoOW.exe
  C:\Windows\System\vPBeoOW.exe
  2⤵
  PID:6608
- C:\Windows\System\FnWVoiu.exe
  C:\Windows\System\FnWVoiu.exe
  2⤵
  PID:1300
- C:\Windows\System\BzEUffZ.exe
  C:\Windows\System\BzEUffZ.exe
  2⤵
  PID:1620
- C:\Windows\System\JCUsMDg.exe
  C:\Windows\System\JCUsMDg.exe
  2⤵
  PID:4916
- C:\Windows\System\vrQsylX.exe
  C:\Windows\System\vrQsylX.exe
  2⤵
  PID:4836
- C:\Windows\System\lUENXPA.exe
  C:\Windows\System\lUENXPA.exe
  2⤵
  PID:2396
- C:\Windows\System\fKbDAnu.exe
  C:\Windows\System\fKbDAnu.exe
  2⤵
  PID:2936
- C:\Windows\System\rDKPBDj.exe
  C:\Windows\System\rDKPBDj.exe
  2⤵
  PID:3820
- C:\Windows\System\ORbLnOe.exe
  C:\Windows\System\ORbLnOe.exe
  2⤵
  PID:2584
- C:\Windows\System\QQNnYkr.exe
  C:\Windows\System\QQNnYkr.exe
  2⤵
  PID:3412
- C:\Windows\System\FMjxEsU.exe
  C:\Windows\System\FMjxEsU.exe
  2⤵
  PID:1996
- C:\Windows\System\CxWGuZm.exe
  C:\Windows\System\CxWGuZm.exe
  2⤵
  PID:1364
- C:\Windows\System\kHJkTcb.exe
  C:\Windows\System\kHJkTcb.exe
  2⤵
  PID:2896
- C:\Windows\System\ONXRiBB.exe
  C:\Windows\System\ONXRiBB.exe
  2⤵
  PID:864
- C:\Windows\System\XrlqnLr.exe
  C:\Windows\System\XrlqnLr.exe
  2⤵
  PID:1356
- C:\Windows\System\IZfYWmA.exe
  C:\Windows\System\IZfYWmA.exe
  2⤵
  PID:2596
- C:\Windows\System\RyTeQJI.exe
  C:\Windows\System\RyTeQJI.exe
  2⤵
  PID:4092
- C:\Windows\System\rUgrGzo.exe
  C:\Windows\System\rUgrGzo.exe
  2⤵
  PID:1876
- C:\Windows\System\dGrXTdZ.exe
  C:\Windows\System\dGrXTdZ.exe
  2⤵
  PID:3692
- C:\Windows\System\hHUFpVk.exe
  C:\Windows\System\hHUFpVk.exe
  2⤵
  PID:7148
- C:\Windows\System\PROeFOM.exe
  C:\Windows\System\PROeFOM.exe
  2⤵
  PID:4768
- C:\Windows\System\UeMTSYb.exe
  C:\Windows\System\UeMTSYb.exe
  2⤵
  PID:2132
- C:\Windows\System\wDwPIAG.exe
  C:\Windows\System\wDwPIAG.exe
  2⤵
  PID:4584
- C:\Windows\System\yxywGSx.exe
  C:\Windows\System\yxywGSx.exe
  2⤵
  PID:2440
- C:\Windows\System\TsaFMnt.exe
  C:\Windows\System\TsaFMnt.exe
  2⤵
  PID:392
- C:\Windows\System\edZTIJx.exe
  C:\Windows\System\edZTIJx.exe
  2⤵
  PID:6976
- C:\Windows\System\vxQMSbR.exe
  C:\Windows\System\vxQMSbR.exe
  2⤵
  PID:7028
- C:\Windows\System\DWCyAbg.exe
  C:\Windows\System\DWCyAbg.exe
  2⤵
  PID:3812
- C:\Windows\System\rfKorgx.exe
  C:\Windows\System\rfKorgx.exe
  2⤵
  PID:760
- C:\Windows\System\CoNNNRO.exe
  C:\Windows\System\CoNNNRO.exe
  2⤵
  PID:4116
- C:\Windows\System\IHOuKnc.exe
  C:\Windows\System\IHOuKnc.exe
  2⤵
  PID:1552
- C:\Windows\System\FLQDeHX.exe
  C:\Windows\System\FLQDeHX.exe
  2⤵
  PID:960
- C:\Windows\System\Zetykbp.exe
  C:\Windows\System\Zetykbp.exe
  2⤵
  PID:432
- C:\Windows\System\gGBvlln.exe
  C:\Windows\System\gGBvlln.exe
  2⤵
  PID:6276
- C:\Windows\System\AMKabNU.exe
  C:\Windows\System\AMKabNU.exe
  2⤵
  PID:4792
- C:\Windows\System\EegzKoK.exe
  C:\Windows\System\EegzKoK.exe
  2⤵
  PID:1196
- C:\Windows\System\lfWauSr.exe
  C:\Windows\System\lfWauSr.exe
  2⤵
  PID:3304
- C:\Windows\System\KohXJgw.exe
  C:\Windows\System\KohXJgw.exe
  2⤵
  PID:3768
- C:\Windows\System\ViFYWSH.exe
  C:\Windows\System\ViFYWSH.exe
  2⤵
  PID:3844
- C:\Windows\System\tbroFbk.exe
  C:\Windows\System\tbroFbk.exe
  2⤵
  PID:7172
- C:\Windows\System\uWXstJW.exe
  C:\Windows\System\uWXstJW.exe
  2⤵
  PID:7196
- C:\Windows\System\Mqxktlg.exe
  C:\Windows\System\Mqxktlg.exe
  2⤵
  PID:7236
- C:\Windows\System\rSnNnTu.exe
  C:\Windows\System\rSnNnTu.exe
  2⤵
  PID:7264
- C:\Windows\System\hsWFEiU.exe
  C:\Windows\System\hsWFEiU.exe
  2⤵
  PID:7280
- C:\Windows\System\CvkbAcE.exe
  C:\Windows\System\CvkbAcE.exe
  2⤵
  PID:7308
- C:\Windows\System\PRmqQWo.exe
  C:\Windows\System\PRmqQWo.exe
  2⤵
  PID:7336
- C:\Windows\System\pwakuGh.exe
  C:\Windows\System\pwakuGh.exe
  2⤵
  PID:7364
- C:\Windows\System\tWwIAGx.exe
  C:\Windows\System\tWwIAGx.exe
  2⤵
  PID:7404
- C:\Windows\System\hveYetk.exe
  C:\Windows\System\hveYetk.exe
  2⤵
  PID:7432
- C:\Windows\System\xnZkprZ.exe
  C:\Windows\System\xnZkprZ.exe
  2⤵
  PID:7460
- C:\Windows\System\FqKxzIO.exe
  C:\Windows\System\FqKxzIO.exe
  2⤵
  PID:7488
- C:\Windows\System\UgtGBRk.exe
  C:\Windows\System\UgtGBRk.exe
  2⤵
  PID:7520
- C:\Windows\System\LGBwuqf.exe
  C:\Windows\System\LGBwuqf.exe
  2⤵
  PID:7540
- C:\Windows\System\xljYEpV.exe
  C:\Windows\System\xljYEpV.exe
  2⤵
  PID:7560
- C:\Windows\System\aniDiXo.exe
  C:\Windows\System\aniDiXo.exe
  2⤵
  PID:7580
- C:\Windows\System\zARuEjB.exe
  C:\Windows\System\zARuEjB.exe
  2⤵
  PID:7604
- C:\Windows\System\mKWchGb.exe
  C:\Windows\System\mKWchGb.exe
  2⤵
  PID:7636
- C:\Windows\System\pdnBgZR.exe
  C:\Windows\System\pdnBgZR.exe
  2⤵
  PID:7664
- C:\Windows\System\esDCcXS.exe
  C:\Windows\System\esDCcXS.exe
  2⤵
  PID:7700
- C:\Windows\System\KjmIQZY.exe
  C:\Windows\System\KjmIQZY.exe
  2⤵
  PID:7732
- C:\Windows\System\aamRKFM.exe
  C:\Windows\System\aamRKFM.exe
  2⤵
  PID:7760
- C:\Windows\System\vSYpdfK.exe
  C:\Windows\System\vSYpdfK.exe
  2⤵
  PID:7776
- C:\Windows\System\kxoHoCU.exe
  C:\Windows\System\kxoHoCU.exe
  2⤵
  PID:7804
- C:\Windows\System\HHhJvIw.exe
  C:\Windows\System\HHhJvIw.exe
  2⤵
  PID:7840
- C:\Windows\System\eLaSaWV.exe
  C:\Windows\System\eLaSaWV.exe
  2⤵
  PID:7868
- C:\Windows\System\JNGqwYg.exe
  C:\Windows\System\JNGqwYg.exe
  2⤵
  PID:7888
- C:\Windows\System\FAwtYXR.exe
  C:\Windows\System\FAwtYXR.exe
  2⤵
  PID:7916
- C:\Windows\System\yUZZkfn.exe
  C:\Windows\System\yUZZkfn.exe
  2⤵
  PID:7944
- C:\Windows\System\mMZTYXs.exe
  C:\Windows\System\mMZTYXs.exe
  2⤵
  PID:7968
- C:\Windows\System\uKjwAWT.exe
  C:\Windows\System\uKjwAWT.exe
  2⤵
  PID:7984
- C:\Windows\System\gETJgsp.exe
  C:\Windows\System\gETJgsp.exe
  2⤵
  PID:8040
- C:\Windows\System\bMPjxJj.exe
  C:\Windows\System\bMPjxJj.exe
  2⤵
  PID:8056
- C:\Windows\System\EkTznyh.exe
  C:\Windows\System\EkTznyh.exe
  2⤵
  PID:8076
- C:\Windows\System\UIHDwyZ.exe
  C:\Windows\System\UIHDwyZ.exe
  2⤵
  PID:8092
- C:\Windows\System\HsADuwL.exe
  C:\Windows\System\HsADuwL.exe
  2⤵
  PID:8164
- C:\Windows\System\mPNNlHN.exe
  C:\Windows\System\mPNNlHN.exe
  2⤵
  PID:1472
- C:\Windows\System\iINIXpJ.exe
  C:\Windows\System\iINIXpJ.exe
  2⤵
  PID:6672
- C:\Windows\System\bniqUeS.exe
  C:\Windows\System\bniqUeS.exe
  2⤵
  PID:7188
- C:\Windows\System\FETKqJq.exe
  C:\Windows\System\FETKqJq.exe
  2⤵
  PID:7260
- C:\Windows\System\KcDacrV.exe
  C:\Windows\System\KcDacrV.exe
  2⤵
  PID:7352
- C:\Windows\System\WQQQPDy.exe
  C:\Windows\System\WQQQPDy.exe
  2⤵
  PID:7392
- C:\Windows\System\XvSrEiD.exe
  C:\Windows\System\XvSrEiD.exe
  2⤵
  PID:7416
- C:\Windows\System\rkrGkaE.exe
  C:\Windows\System\rkrGkaE.exe
  2⤵
  PID:7552
- C:\Windows\System\zEJDsZx.exe
  C:\Windows\System\zEJDsZx.exe
  2⤵
  PID:7624
- C:\Windows\System\AukOEFE.exe
  C:\Windows\System\AukOEFE.exe
  2⤵
  PID:7688
- C:\Windows\System\vSwxQyZ.exe
  C:\Windows\System\vSwxQyZ.exe
  2⤵
  PID:7788
- C:\Windows\System\OgAclVJ.exe
  C:\Windows\System\OgAclVJ.exe
  2⤵
  PID:7772
- C:\Windows\System\WGtGQJm.exe
  C:\Windows\System\WGtGQJm.exe
  2⤵
  PID:7928
- C:\Windows\System\ybYrksu.exe
  C:\Windows\System\ybYrksu.exe
  2⤵
  PID:7896
- C:\Windows\System\LYaugtc.exe
  C:\Windows\System\LYaugtc.exe
  2⤵
  PID:7980
- C:\Windows\System\IarlFnr.exe
  C:\Windows\System\IarlFnr.exe
  2⤵
  PID:8068
- C:\Windows\System\rTAyyhw.exe
  C:\Windows\System\rTAyyhw.exe
  2⤵
  PID:8160
- C:\Windows\System\qTaIIEE.exe
  C:\Windows\System\qTaIIEE.exe
  2⤵
  PID:6972
- C:\Windows\System\gFHGheA.exe
  C:\Windows\System\gFHGheA.exe
  2⤵
  PID:7180
- C:\Windows\System\svxizFq.exe
  C:\Windows\System\svxizFq.exe
  2⤵
  PID:7388
- C:\Windows\System\vWNmtEo.exe
  C:\Windows\System\vWNmtEo.exe
  2⤵
  PID:7676
- C:\Windows\System\mbAAlog.exe
  C:\Windows\System\mbAAlog.exe
  2⤵
  PID:7724
- C:\Windows\System\ZAImcgl.exe
  C:\Windows\System\ZAImcgl.exe
  2⤵
  PID:7960
- C:\Windows\System\bpqhsGM.exe
  C:\Windows\System\bpqhsGM.exe
  2⤵
  PID:8048
- C:\Windows\System\dWiEDHb.exe
  C:\Windows\System\dWiEDHb.exe
  2⤵
  PID:7220
- C:\Windows\System\XifdVGl.exe
  C:\Windows\System\XifdVGl.exe
  2⤵
  PID:7384
- C:\Windows\System\rMBrkmZ.exe
  C:\Windows\System\rMBrkmZ.exe
  2⤵
  PID:8052
- C:\Windows\System\oUDXJEa.exe
  C:\Windows\System\oUDXJEa.exe
  2⤵
  PID:3144
- C:\Windows\System\DDGOkpc.exe
  C:\Windows\System\DDGOkpc.exe
  2⤵
  PID:7252
- C:\Windows\System\EjzUHpu.exe
  C:\Windows\System\EjzUHpu.exe
  2⤵
  PID:8216
- C:\Windows\System\ssDQRRG.exe
  C:\Windows\System\ssDQRRG.exe
  2⤵
  PID:8256
- C:\Windows\System\dPioSna.exe
  C:\Windows\System\dPioSna.exe
  2⤵
  PID:8284
- C:\Windows\System\cKpnqFP.exe
  C:\Windows\System\cKpnqFP.exe
  2⤵
  PID:8300
- C:\Windows\System\NgHVLhh.exe
  C:\Windows\System\NgHVLhh.exe
  2⤵
  PID:8328
- C:\Windows\System\DTAWptw.exe
  C:\Windows\System\DTAWptw.exe
  2⤵
  PID:8356
- C:\Windows\System\DCAUjOF.exe
  C:\Windows\System\DCAUjOF.exe
  2⤵
  PID:8392
- C:\Windows\System\niEqKtz.exe
  C:\Windows\System\niEqKtz.exe
  2⤵
  PID:8424
- C:\Windows\System\taShQlW.exe
  C:\Windows\System\taShQlW.exe
  2⤵
  PID:8440
- C:\Windows\System\CNuBOeX.exe
  C:\Windows\System\CNuBOeX.exe
  2⤵
  PID:8464
- C:\Windows\System\OsGbAjV.exe
  C:\Windows\System\OsGbAjV.exe
  2⤵
  PID:8496
- C:\Windows\System\ygTAaQX.exe
  C:\Windows\System\ygTAaQX.exe
  2⤵
  PID:8524
- C:\Windows\System\QoPwGHw.exe
  C:\Windows\System\QoPwGHw.exe
  2⤵
  PID:8552
- C:\Windows\System\VbczsaO.exe
  C:\Windows\System\VbczsaO.exe
  2⤵
  PID:8568
- C:\Windows\System\OMMqprx.exe
  C:\Windows\System\OMMqprx.exe
  2⤵
  PID:8608
- C:\Windows\System\pVmalGx.exe
  C:\Windows\System\pVmalGx.exe
  2⤵
  PID:8636
- C:\Windows\System\eQKCaCZ.exe
  C:\Windows\System\eQKCaCZ.exe
  2⤵
  PID:8664
- C:\Windows\System\atpowUS.exe
  C:\Windows\System\atpowUS.exe
  2⤵
  PID:8692
- C:\Windows\System\PQqchSG.exe
  C:\Windows\System\PQqchSG.exe
  2⤵
  PID:8720
- C:\Windows\System\lAgrhAc.exe
  C:\Windows\System\lAgrhAc.exe
  2⤵
  PID:8748
- C:\Windows\System\rtZmltb.exe
  C:\Windows\System\rtZmltb.exe
  2⤵
  PID:8776
- C:\Windows\System\LghFJib.exe
  C:\Windows\System\LghFJib.exe
  2⤵
  PID:8804
- C:\Windows\System\MivwlaQ.exe
  C:\Windows\System\MivwlaQ.exe
  2⤵
  PID:8844
- C:\Windows\System\AXKoLLG.exe
  C:\Windows\System\AXKoLLG.exe
  2⤵
  PID:8876
- C:\Windows\System\WRBnuBP.exe
  C:\Windows\System\WRBnuBP.exe
  2⤵
  PID:8904
- C:\Windows\System\orffFvR.exe
  C:\Windows\System\orffFvR.exe
  2⤵
  PID:8924
- C:\Windows\System\OWvrPZp.exe
  C:\Windows\System\OWvrPZp.exe
  2⤵
  PID:8956
- C:\Windows\System\naMSHVm.exe
  C:\Windows\System\naMSHVm.exe
  2⤵
  PID:8996
- C:\Windows\System\YkGBrSe.exe
  C:\Windows\System\YkGBrSe.exe
  2⤵
  PID:9012
- C:\Windows\System\nUzYtMm.exe
  C:\Windows\System\nUzYtMm.exe
  2⤵
  PID:9040
- C:\Windows\System\wJXdBin.exe
  C:\Windows\System\wJXdBin.exe
  2⤵
  PID:9084
- C:\Windows\System\zwMDXTa.exe
  C:\Windows\System\zwMDXTa.exe
  2⤵
  PID:9112
- C:\Windows\System\fLIgbNT.exe
  C:\Windows\System\fLIgbNT.exe
  2⤵
  PID:9128
- C:\Windows\System\UUlTFRE.exe
  C:\Windows\System\UUlTFRE.exe
  2⤵
  PID:9152
- C:\Windows\System\uEgPvXN.exe
  C:\Windows\System\uEgPvXN.exe
  2⤵
  PID:9196
- C:\Windows\System\HdbeTMg.exe
  C:\Windows\System\HdbeTMg.exe
  2⤵
  PID:9212
- C:\Windows\System\aXibAeM.exe
  C:\Windows\System\aXibAeM.exe
  2⤵
  PID:8200
- C:\Windows\System\GhXVZOC.exe
  C:\Windows\System\GhXVZOC.exe
  2⤵
  PID:8340
- C:\Windows\System\OXdpQXu.exe
  C:\Windows\System\OXdpQXu.exe
  2⤵
  PID:8344
- C:\Windows\System\MdvMvZQ.exe
  C:\Windows\System\MdvMvZQ.exe
  2⤵
  PID:8460
- C:\Windows\System\FvTXlLo.exe
  C:\Windows\System\FvTXlLo.exe
  2⤵
  PID:8536
- C:\Windows\System\yhFiYFl.exe
  C:\Windows\System\yhFiYFl.exe
  2⤵
  PID:8596
- C:\Windows\System\bvGbtuz.exe
  C:\Windows\System\bvGbtuz.exe
  2⤵
  PID:8648
- C:\Windows\System\mbbenLy.exe
  C:\Windows\System\mbbenLy.exe
  2⤵
  PID:8760
- C:\Windows\System\dteldUy.exe
  C:\Windows\System\dteldUy.exe
  2⤵
  PID:8824
- C:\Windows\System\UTTJyak.exe
  C:\Windows\System\UTTJyak.exe
  2⤵
  PID:8896
- C:\Windows\System\YzVBGaZ.exe
  C:\Windows\System\YzVBGaZ.exe
  2⤵
  PID:8952
- C:\Windows\System\mncXEwx.exe
  C:\Windows\System\mncXEwx.exe
  2⤵
  PID:9036
- C:\Windows\System\HfZRnEC.exe
  C:\Windows\System\HfZRnEC.exe
  2⤵
  PID:9124
- C:\Windows\System\sJblUyB.exe
  C:\Windows\System\sJblUyB.exe
  2⤵
  PID:9184
- C:\Windows\System\bgUMssq.exe
  C:\Windows\System\bgUMssq.exe
  2⤵
  PID:8204
- C:\Windows\System\NoRfaRo.exe
  C:\Windows\System\NoRfaRo.exe
  2⤵
  PID:8416
- C:\Windows\System\VhLDOgW.exe
  C:\Windows\System\VhLDOgW.exe
  2⤵
  PID:8580
- C:\Windows\System\fWrlhad.exe
  C:\Windows\System\fWrlhad.exe
  2⤵
  PID:8728
- C:\Windows\System\MyoHuYK.exe
  C:\Windows\System\MyoHuYK.exe
  2⤵
  PID:8864
- C:\Windows\System\TjLBFqK.exe
  C:\Windows\System\TjLBFqK.exe
  2⤵
  PID:8936
- C:\Windows\System\pRekakD.exe
  C:\Windows\System\pRekakD.exe
  2⤵
  PID:8452
- C:\Windows\System\CNihMmV.exe
  C:\Windows\System\CNihMmV.exe
  2⤵
  PID:8840
- C:\Windows\System\nfLfHiV.exe
  C:\Windows\System\nfLfHiV.exe
  2⤵
  PID:8656
- C:\Windows\System\saCLPQQ.exe
  C:\Windows\System\saCLPQQ.exe
  2⤵
  PID:8768
- C:\Windows\System\ZSActgQ.exe
  C:\Windows\System\ZSActgQ.exe
  2⤵
  PID:9104
- C:\Windows\System\NpPQWzW.exe
  C:\Windows\System\NpPQWzW.exe
  2⤵
  PID:9232
- C:\Windows\System\iAqioSW.exe
  C:\Windows\System\iAqioSW.exe
  2⤵
  PID:9264
- C:\Windows\System\MjVnsfl.exe
  C:\Windows\System\MjVnsfl.exe
  2⤵
  PID:9304
- C:\Windows\System\UshewLX.exe
  C:\Windows\System\UshewLX.exe
  2⤵
  PID:9332
- C:\Windows\System\HoRzDDb.exe
  C:\Windows\System\HoRzDDb.exe
  2⤵
  PID:9360
- C:\Windows\System\tWOQYxH.exe
  C:\Windows\System\tWOQYxH.exe
  2⤵
  PID:9380
- C:\Windows\System\McNmkTi.exe
  C:\Windows\System\McNmkTi.exe
  2⤵
  PID:9416
- C:\Windows\System\zrmOfTT.exe
  C:\Windows\System\zrmOfTT.exe
  2⤵
  PID:9444
- C:\Windows\System\EiwTmGh.exe
  C:\Windows\System\EiwTmGh.exe
  2⤵
  PID:9472
- C:\Windows\System\LKKjpzX.exe
  C:\Windows\System\LKKjpzX.exe
  2⤵
  PID:9500
- C:\Windows\System\IVgEVNj.exe
  C:\Windows\System\IVgEVNj.exe
  2⤵
  PID:9520
- C:\Windows\System\SdYnBGs.exe
  C:\Windows\System\SdYnBGs.exe
  2⤵
  PID:9536
- C:\Windows\System\yjOqszA.exe
  C:\Windows\System\yjOqszA.exe
  2⤵
  PID:9556
- C:\Windows\System\koAHUMN.exe
  C:\Windows\System\koAHUMN.exe
  2⤵
  PID:9592
- C:\Windows\System\KoWMuKm.exe
  C:\Windows\System\KoWMuKm.exe
  2⤵
  PID:9620
- C:\Windows\System\oItTskK.exe
  C:\Windows\System\oItTskK.exe
  2⤵
  PID:9648
- C:\Windows\System\DysLAyj.exe
  C:\Windows\System\DysLAyj.exe
  2⤵
  PID:9676
- C:\Windows\System\RHOAhBo.exe
  C:\Windows\System\RHOAhBo.exe
  2⤵
  PID:9692
- C:\Windows\System\FFDVUCT.exe
  C:\Windows\System\FFDVUCT.exe
  2⤵
  PID:9728
- C:\Windows\System\HdoNHlc.exe
  C:\Windows\System\HdoNHlc.exe
  2⤵
  PID:9756
- C:\Windows\System\SnualXc.exe
  C:\Windows\System\SnualXc.exe
  2⤵
  PID:9800
- C:\Windows\System\ecQQhrT.exe
  C:\Windows\System\ecQQhrT.exe
  2⤵
  PID:9836
- C:\Windows\System\JinHpJs.exe
  C:\Windows\System\JinHpJs.exe
  2⤵
  PID:9864
- C:\Windows\System\vbwHtyA.exe
  C:\Windows\System\vbwHtyA.exe
  2⤵
  PID:9892
- C:\Windows\System\hpwvIrl.exe
  C:\Windows\System\hpwvIrl.exe
  2⤵
  PID:9920
- C:\Windows\System\PSmcAKZ.exe
  C:\Windows\System\PSmcAKZ.exe
  2⤵
  PID:9952
- C:\Windows\System\oKbfXgB.exe
  C:\Windows\System\oKbfXgB.exe
  2⤵
  PID:9980
- C:\Windows\System\LbuFKXW.exe
  C:\Windows\System\LbuFKXW.exe
  2⤵
  PID:10004
- C:\Windows\System\mLrwgKA.exe
  C:\Windows\System\mLrwgKA.exe
  2⤵
  PID:10032
- C:\Windows\System\BRjkSOG.exe
  C:\Windows\System\BRjkSOG.exe
  2⤵
  PID:10072
- C:\Windows\System\OkhGdpx.exe
  C:\Windows\System\OkhGdpx.exe
  2⤵
  PID:10104
- C:\Windows\System\pOTsceP.exe
  C:\Windows\System\pOTsceP.exe
  2⤵
  PID:10120
- C:\Windows\System\RjuewJN.exe
  C:\Windows\System\RjuewJN.exe
  2⤵
  PID:10148
- C:\Windows\System\gdbCrwf.exe
  C:\Windows\System\gdbCrwf.exe
  2⤵
  PID:10164
- C:\Windows\System\GXBGphO.exe
  C:\Windows\System\GXBGphO.exe
  2⤵
  PID:10204
- C:\Windows\System\gDfnxPi.exe
  C:\Windows\System\gDfnxPi.exe
  2⤵
  PID:10232
- C:\Windows\System\PukOsJq.exe
  C:\Windows\System\PukOsJq.exe
  2⤵
  PID:9272
- C:\Windows\System\ulhAXFM.exe
  C:\Windows\System\ulhAXFM.exe
  2⤵
  PID:9324
- C:\Windows\System\WQDQsPn.exe
  C:\Windows\System\WQDQsPn.exe
  2⤵
  PID:9376
- C:\Windows\System\eZzmbUm.exe
  C:\Windows\System\eZzmbUm.exe
  2⤵
  PID:9468
- C:\Windows\System\mITtJVD.exe
  C:\Windows\System\mITtJVD.exe
  2⤵
  PID:9552
- C:\Windows\System\ihYoOKB.exe
  C:\Windows\System\ihYoOKB.exe
  2⤵
  PID:9640
- C:\Windows\System\FuTyvHh.exe
  C:\Windows\System\FuTyvHh.exe
  2⤵
  PID:9660
- C:\Windows\System\giBohex.exe
  C:\Windows\System\giBohex.exe
  2⤵
  PID:9688
- C:\Windows\System\USzMgqc.exe
  C:\Windows\System\USzMgqc.exe
  2⤵
  PID:9712
- C:\Windows\System\oTzWERm.exe
  C:\Windows\System\oTzWERm.exe
  2⤵
  PID:9880
- C:\Windows\System\WVgTdVr.exe
  C:\Windows\System\WVgTdVr.exe
  2⤵
  PID:9936
- C:\Windows\System\tqIBvIi.exe
  C:\Windows\System\tqIBvIi.exe
  2⤵
  PID:9968
- C:\Windows\System\SIzuPqn.exe
  C:\Windows\System\SIzuPqn.exe
  2⤵
  PID:10028
- C:\Windows\System\FedJpoz.exe
  C:\Windows\System\FedJpoz.exe
  2⤵
  PID:10088
- C:\Windows\System\MivMtMC.exe
  C:\Windows\System\MivMtMC.exe
  2⤵
  PID:10192
- C:\Windows\System\FTkaKOL.exe
  C:\Windows\System\FTkaKOL.exe
  2⤵
  PID:9224
- C:\Windows\System\fkNneYF.exe
  C:\Windows\System\fkNneYF.exe
  2⤵
  PID:9428
- C:\Windows\System\OLbISlI.exe
  C:\Windows\System\OLbISlI.exe
  2⤵
  PID:9544
- C:\Windows\System\caLmOoI.exe
  C:\Windows\System\caLmOoI.exe
  2⤵
  PID:9716
- C:\Windows\System\magWciS.exe
  C:\Windows\System\magWciS.exe
  2⤵
  PID:9904
- C:\Windows\System\PxNywAr.exe
  C:\Windows\System\PxNywAr.exe
  2⤵
  PID:9932
- C:\Windows\System\PwDvZXY.exe
  C:\Windows\System\PwDvZXY.exe
  2⤵
  PID:10132
- C:\Windows\System\TvscCxr.exe
  C:\Windows\System\TvscCxr.exe
  2⤵
  PID:9296
- C:\Windows\System\sIypdrp.exe
  C:\Windows\System\sIypdrp.exe
  2⤵
  PID:9816
- C:\Windows\System\tMVvFKf.exe
  C:\Windows\System\tMVvFKf.exe
  2⤵
  PID:10048
- C:\Windows\System\oCfeFgp.exe
  C:\Windows\System\oCfeFgp.exe
  2⤵
  PID:9412
- C:\Windows\System\vjAnrwV.exe
  C:\Windows\System\vjAnrwV.exe
  2⤵
  PID:9844
- C:\Windows\System\titSaGy.exe
  C:\Windows\System\titSaGy.exe
  2⤵
  PID:8744
- C:\Windows\System\YXDODLb.exe
  C:\Windows\System\YXDODLb.exe
  2⤵
  PID:10260
- C:\Windows\System\bjIAZxh.exe
  C:\Windows\System\bjIAZxh.exe
  2⤵
  PID:10292
- C:\Windows\System\scEsyGV.exe
  C:\Windows\System\scEsyGV.exe
  2⤵
  PID:10332
- C:\Windows\System\dfauokb.exe
  C:\Windows\System\dfauokb.exe
  2⤵
  PID:10360
- C:\Windows\System\CEcmSsW.exe
  C:\Windows\System\CEcmSsW.exe
  2⤵
  PID:10400
- C:\Windows\System\WdpCGGD.exe
  C:\Windows\System\WdpCGGD.exe
  2⤵
  PID:10428
- C:\Windows\System\NEJQJrq.exe
  C:\Windows\System\NEJQJrq.exe
  2⤵
  PID:10444
- C:\Windows\System\IYVLQRM.exe
  C:\Windows\System\IYVLQRM.exe
  2⤵
  PID:10472
- C:\Windows\System\HhjSRaJ.exe
  C:\Windows\System\HhjSRaJ.exe
  2⤵
  PID:10512
- C:\Windows\System\eWFGPgj.exe
  C:\Windows\System\eWFGPgj.exe
  2⤵
  PID:10536
- C:\Windows\System\BrNZWiJ.exe
  C:\Windows\System\BrNZWiJ.exe
  2⤵
  PID:10576
- C:\Windows\System\gclbhbJ.exe
  C:\Windows\System\gclbhbJ.exe
  2⤵
  PID:10604
- C:\Windows\System\qTzyQPu.exe
  C:\Windows\System\qTzyQPu.exe
  2⤵
  PID:10632
- C:\Windows\System\vQgkTAA.exe
  C:\Windows\System\vQgkTAA.exe
  2⤵
  PID:10664
- C:\Windows\System\eREGaTd.exe
  C:\Windows\System\eREGaTd.exe
  2⤵
  PID:10688
- C:\Windows\System\EjnWKHU.exe
  C:\Windows\System\EjnWKHU.exe
  2⤵
  PID:10716
- C:\Windows\System\dGtlmxs.exe
  C:\Windows\System\dGtlmxs.exe
  2⤵
  PID:10744
- C:\Windows\System\cYJyafi.exe
  C:\Windows\System\cYJyafi.exe
  2⤵
  PID:10772
- C:\Windows\System\JToUXmL.exe
  C:\Windows\System\JToUXmL.exe
  2⤵
  PID:10800
- C:\Windows\System\agcCDTr.exe
  C:\Windows\System\agcCDTr.exe
  2⤵
  PID:10828
- C:\Windows\System\uorUTXo.exe
  C:\Windows\System\uorUTXo.exe
  2⤵
  PID:10856
- C:\Windows\System\TdMhlKH.exe
  C:\Windows\System\TdMhlKH.exe
  2⤵
  PID:10896
- C:\Windows\System\CMRpdlE.exe
  C:\Windows\System\CMRpdlE.exe
  2⤵
  PID:10924
- C:\Windows\System\KfLQvzj.exe
  C:\Windows\System\KfLQvzj.exe
  2⤵
  PID:10940
- C:\Windows\System\zYNubKj.exe
  C:\Windows\System\zYNubKj.exe
  2⤵
  PID:10968
- C:\Windows\System\SptkEME.exe
  C:\Windows\System\SptkEME.exe
  2⤵
  PID:11008
- C:\Windows\System\vPpRhlr.exe
  C:\Windows\System\vPpRhlr.exe
  2⤵
  PID:11036
- C:\Windows\System\haxpGLd.exe
  C:\Windows\System\haxpGLd.exe
  2⤵
  PID:11052
- C:\Windows\System\kdksfWt.exe
  C:\Windows\System\kdksfWt.exe
  2⤵
  PID:11080
- C:\Windows\System\oEuxgOu.exe
  C:\Windows\System\oEuxgOu.exe
  2⤵
  PID:11108
- C:\Windows\System\irwbGsA.exe
  C:\Windows\System\irwbGsA.exe
  2⤵
  PID:11136
- C:\Windows\System\BfEiOKN.exe
  C:\Windows\System\BfEiOKN.exe
  2⤵
  PID:11176
- C:\Windows\System\xnbBeQA.exe
  C:\Windows\System\xnbBeQA.exe
  2⤵
  PID:11204
- C:\Windows\System\yXUqnQZ.exe
  C:\Windows\System\yXUqnQZ.exe
  2⤵
  PID:11220
- C:\Windows\System\jcWhZtR.exe
  C:\Windows\System\jcWhZtR.exe
  2⤵
  PID:11240
- C:\Windows\System\lchMTTc.exe
  C:\Windows\System\lchMTTc.exe
  2⤵
  PID:10156
- C:\Windows\System\lqmBPFy.exe
  C:\Windows\System\lqmBPFy.exe
  2⤵
  PID:2408
- C:\Windows\System\fGhzuxi.exe
  C:\Windows\System\fGhzuxi.exe
  2⤵
  PID:10324
- C:\Windows\System\uzhchNi.exe
  C:\Windows\System\uzhchNi.exe
  2⤵
  PID:10384
- C:\Windows\System\dyIZKLh.exe
  C:\Windows\System\dyIZKLh.exe
  2⤵
  PID:10460
- C:\Windows\System\XIArkec.exe
  C:\Windows\System\XIArkec.exe
  2⤵
  PID:10548
- C:\Windows\System\xpKbJte.exe
  C:\Windows\System\xpKbJte.exe
  2⤵
  PID:10564
- C:\Windows\System\JQIvsGZ.exe
  C:\Windows\System\JQIvsGZ.exe
  2⤵
  PID:10648
- C:\Windows\System\BeZfBcr.exe
  C:\Windows\System\BeZfBcr.exe
  2⤵
  PID:10712
- C:\Windows\System\dlSOWDG.exe
  C:\Windows\System\dlSOWDG.exe
  2⤵
  PID:10752
- C:\Windows\System\hXOenqW.exe
  C:\Windows\System\hXOenqW.exe
  2⤵
  PID:10820
- C:\Windows\System\ncqiZsA.exe
  C:\Windows\System\ncqiZsA.exe
  2⤵
  PID:10888
- C:\Windows\System\YrCMeQE.exe
  C:\Windows\System\YrCMeQE.exe
  2⤵
  PID:10956
- C:\Windows\System\QqShQzq.exe
  C:\Windows\System\QqShQzq.exe
  2⤵
  PID:11020
- C:\Windows\System\dPepQKc.exe
  C:\Windows\System\dPepQKc.exe
  2⤵
  PID:11068
- C:\Windows\System\mEqBbcx.exe
  C:\Windows\System\mEqBbcx.exe
  2⤵
  PID:11156
- C:\Windows\System\fMCkPDQ.exe
  C:\Windows\System\fMCkPDQ.exe
  2⤵
  PID:11228
- C:\Windows\System\GvSFhmf.exe
  C:\Windows\System\GvSFhmf.exe
  2⤵
  PID:944
- C:\Windows\System\brYHrnv.exe
  C:\Windows\System\brYHrnv.exe
  2⤵
  PID:10412
- C:\Windows\System\cxYuJdp.exe
  C:\Windows\System\cxYuJdp.exe
  2⤵
  PID:10484
- C:\Windows\System\TmBBoHZ.exe
  C:\Windows\System\TmBBoHZ.exe
  2⤵
  PID:10508
- C:\Windows\System\JzJsJJp.exe
  C:\Windows\System\JzJsJJp.exe
  2⤵
  PID:10728
- C:\Windows\System\EwmSqCJ.exe
  C:\Windows\System\EwmSqCJ.exe
  2⤵
  PID:10936
- C:\Windows\System\plRaVYl.exe
  C:\Windows\System\plRaVYl.exe
  2⤵
  PID:11096
- C:\Windows\System\BvtYYlI.exe
  C:\Windows\System\BvtYYlI.exe
  2⤵
  PID:9220
- C:\Windows\System\oeEqDmX.exe
  C:\Windows\System\oeEqDmX.exe
  2⤵
  PID:9608
- C:\Windows\System\CNYGvJl.exe
  C:\Windows\System\CNYGvJl.exe
  2⤵
  PID:10852
- C:\Windows\System\vIgVCiu.exe
  C:\Windows\System\vIgVCiu.exe
  2⤵
  PID:10600
- C:\Windows\System\ZsqLQgx.exe
  C:\Windows\System\ZsqLQgx.exe
  2⤵
  PID:8740
- C:\Windows\System\gBZivWA.exe
  C:\Windows\System\gBZivWA.exe
  2⤵
  PID:11284
- C:\Windows\System\adzKfYW.exe
  C:\Windows\System\adzKfYW.exe
  2⤵
  PID:11312
- C:\Windows\System\TdrZguD.exe
  C:\Windows\System\TdrZguD.exe
  2⤵
  PID:11328
- C:\Windows\System\oKlcLoc.exe
  C:\Windows\System\oKlcLoc.exe
  2⤵
  PID:11356
- C:\Windows\System\reOlGHb.exe
  C:\Windows\System\reOlGHb.exe
  2⤵
  PID:11380
- C:\Windows\System\AwVyOqg.exe
  C:\Windows\System\AwVyOqg.exe
  2⤵
  PID:11412
- C:\Windows\System\HTSakSl.exe
  C:\Windows\System\HTSakSl.exe
  2⤵
  PID:11436
- C:\Windows\System\pAgDqMO.exe
  C:\Windows\System\pAgDqMO.exe
  2⤵
  PID:11468
- C:\Windows\System\KVPHcxW.exe
  C:\Windows\System\KVPHcxW.exe
  2⤵
  PID:11484
- C:\Windows\System\ZLHQTeN.exe
  C:\Windows\System\ZLHQTeN.exe
  2⤵
  PID:11500
- C:\Windows\System\ADRikzh.exe
  C:\Windows\System\ADRikzh.exe
  2⤵
  PID:11524
- C:\Windows\System\fEoIFGr.exe
  C:\Windows\System\fEoIFGr.exe
  2⤵
  PID:11564
- C:\Windows\System\FhQSscP.exe
  C:\Windows\System\FhQSscP.exe
  2⤵
  PID:11584
- C:\Windows\System\vgeHpDf.exe
  C:\Windows\System\vgeHpDf.exe
  2⤵
  PID:11612
- C:\Windows\System\AnTFwGk.exe
  C:\Windows\System\AnTFwGk.exe
  2⤵
  PID:11632
- C:\Windows\System\GxpVixD.exe
  C:\Windows\System\GxpVixD.exe
  2⤵
  PID:11648
- C:\Windows\System\IiVdsiF.exe
  C:\Windows\System\IiVdsiF.exe
  2⤵
  PID:11696
- C:\Windows\System\OFTcYNd.exe
  C:\Windows\System\OFTcYNd.exe
  2⤵
  PID:11748
- C:\Windows\System\hkZPcbO.exe
  C:\Windows\System\hkZPcbO.exe
  2⤵
  PID:11764
- C:\Windows\System\NjGtqjl.exe
  C:\Windows\System\NjGtqjl.exe
  2⤵
  PID:11808
- C:\Windows\System\MQFeikX.exe
  C:\Windows\System\MQFeikX.exe
  2⤵
  PID:11832
- C:\Windows\System\cnCMzcc.exe
  C:\Windows\System\cnCMzcc.exe
  2⤵
  PID:11864
- C:\Windows\System\FHlIPgR.exe
  C:\Windows\System\FHlIPgR.exe
  2⤵
  PID:11904
- C:\Windows\System\cKagZFU.exe
  C:\Windows\System\cKagZFU.exe
  2⤵
  PID:11920
- C:\Windows\System\LnQbYAF.exe
  C:\Windows\System\LnQbYAF.exe
  2⤵
  PID:11956
- C:\Windows\System\LzdPaqW.exe
  C:\Windows\System\LzdPaqW.exe
  2⤵
  PID:11988
- C:\Windows\System\FKGngez.exe
  C:\Windows\System\FKGngez.exe
  2⤵
  PID:12016
- C:\Windows\System\BFKnAik.exe
  C:\Windows\System\BFKnAik.exe
  2⤵
  PID:12032
- C:\Windows\System\QPlQcWo.exe
  C:\Windows\System\QPlQcWo.exe
  2⤵
  PID:12052
- C:\Windows\System\FfqlNtP.exe
  C:\Windows\System\FfqlNtP.exe
  2⤵
  PID:12076
- C:\Windows\System\TTNCmef.exe
  C:\Windows\System\TTNCmef.exe
  2⤵
  PID:12128
- C:\Windows\System\dqOLhjq.exe
  C:\Windows\System\dqOLhjq.exe
  2⤵
  PID:12156
- C:\Windows\System\OEHWYKj.exe
  C:\Windows\System\OEHWYKj.exe
  2⤵
  PID:12184
- C:\Windows\System\kYERrLl.exe
  C:\Windows\System\kYERrLl.exe
  2⤵
  PID:12200
- C:\Windows\System\UTvIWBy.exe
  C:\Windows\System\UTvIWBy.exe
  2⤵
  PID:12228
- C:\Windows\System\wVpyUOD.exe
  C:\Windows\System\wVpyUOD.exe
  2⤵
  PID:12256
- C:\Windows\System\uWFQsyd.exe
  C:\Windows\System\uWFQsyd.exe
  2⤵
  PID:11272
- C:\Windows\System\SgyPQkt.exe
  C:\Windows\System\SgyPQkt.exe
  2⤵
  PID:11324
- C:\Windows\System\ejmigRu.exe
  C:\Windows\System\ejmigRu.exe
  2⤵
  PID:11376
- C:\Windows\System\fGxnTWr.exe
  C:\Windows\System\fGxnTWr.exe
  2⤵
  PID:11424
- C:\Windows\System\pooiqmN.exe
  C:\Windows\System\pooiqmN.exe
  2⤵
  PID:11556
- C:\Windows\System\ngctKhO.exe
  C:\Windows\System\ngctKhO.exe
  2⤵
  PID:11544
- C:\Windows\System\wCEwuea.exe
  C:\Windows\System\wCEwuea.exe
  2⤵
  PID:11644
- C:\Windows\System\WTunYZh.exe
  C:\Windows\System\WTunYZh.exe
  2⤵
  PID:11728
- C:\Windows\System\ZPRAhMp.exe
  C:\Windows\System\ZPRAhMp.exe
  2⤵
  PID:11756
- C:\Windows\System\UXvwdih.exe
  C:\Windows\System\UXvwdih.exe
  2⤵
  PID:11876
- C:\Windows\System\tgDONbB.exe
  C:\Windows\System\tgDONbB.exe
  2⤵
  PID:11932
- C:\Windows\System\GKRuaRA.exe
  C:\Windows\System\GKRuaRA.exe
  2⤵
  PID:12004
- C:\Windows\System\kZutzUR.exe
  C:\Windows\System\kZutzUR.exe
  2⤵
  PID:12108
- C:\Windows\System\xCqIlxO.exe
  C:\Windows\System\xCqIlxO.exe
  2⤵
  PID:12124
- C:\Windows\System\ikxGeJu.exe
  C:\Windows\System\ikxGeJu.exe
  2⤵
  PID:12176
- C:\Windows\System\nVRLkDk.exe
  C:\Windows\System\nVRLkDk.exe
  2⤵
  PID:12244
- C:\Windows\System\UEEfQtm.exe
  C:\Windows\System\UEEfQtm.exe
  2⤵
  PID:11308
- C:\Windows\System\JDbDbdm.exe
  C:\Windows\System\JDbDbdm.exe
  2⤵
  PID:11512
- C:\Windows\System\xobpnlN.exe
  C:\Windows\System\xobpnlN.exe
  2⤵
  PID:11572
- C:\Windows\System\rAejRyl.exe
  C:\Windows\System\rAejRyl.exe
  2⤵
  PID:11776
- C:\Windows\System\TbLwytb.exe
  C:\Windows\System\TbLwytb.exe
  2⤵
  PID:11972
- C:\Windows\System\NeCqwfs.exe
  C:\Windows\System\NeCqwfs.exe
  2⤵
  PID:12180
- C:\Windows\System\PWXDcke.exe
  C:\Windows\System\PWXDcke.exe
  2⤵
  PID:12144
- C:\Windows\System\TiRVOxc.exe
  C:\Windows\System\TiRVOxc.exe
  2⤵
  PID:11492
- C:\Windows\System\mfDbWDt.exe
  C:\Windows\System\mfDbWDt.exe
  2⤵
  PID:11912
- C:\Windows\System\VJoJrxK.exe
  C:\Windows\System\VJoJrxK.exe
  2⤵
  PID:12240
- C:\Windows\System\prDVvAj.exe
  C:\Windows\System\prDVvAj.exe
  2⤵
  PID:11672
- C:\Windows\System\EpvtMbn.exe
  C:\Windows\System\EpvtMbn.exe
  2⤵
  PID:11276
- C:\Windows\System\NABQqTZ.exe
  C:\Windows\System\NABQqTZ.exe
  2⤵
  PID:12324
- C:\Windows\System\CJtAzFW.exe
  C:\Windows\System\CJtAzFW.exe
  2⤵
  PID:12348
- C:\Windows\System\SgjZzuP.exe
  C:\Windows\System\SgjZzuP.exe
  2⤵
  PID:12372
- C:\Windows\System\XtaXiWx.exe
  C:\Windows\System\XtaXiWx.exe
  2⤵
  PID:12416
- C:\Windows\System\YaBsDKP.exe
  C:\Windows\System\YaBsDKP.exe
  2⤵
  PID:12432
- C:\Windows\System\DFEfmIt.exe
  C:\Windows\System\DFEfmIt.exe
  2⤵
  PID:12460
- C:\Windows\System\LQdPbAI.exe
  C:\Windows\System\LQdPbAI.exe
  2⤵
  PID:12480
- C:\Windows\System\QHPrFAP.exe
  C:\Windows\System\QHPrFAP.exe
  2⤵
  PID:12516
- C:\Windows\System\nSiZWaT.exe
  C:\Windows\System\nSiZWaT.exe
  2⤵
  PID:12540
- C:\Windows\System\XgNqsoF.exe
  C:\Windows\System\XgNqsoF.exe
  2⤵
  PID:12584
- C:\Windows\System\rxazfqj.exe
  C:\Windows\System\rxazfqj.exe
  2⤵
  PID:12600
- C:\Windows\System\DVxzHgW.exe
  C:\Windows\System\DVxzHgW.exe
  2⤵
  PID:12628
- C:\Windows\System\eqFaqqq.exe
  C:\Windows\System\eqFaqqq.exe
  2⤵
  PID:12644
- C:\Windows\System\RRWwbMD.exe
  C:\Windows\System\RRWwbMD.exe
  2⤵
  PID:12676
- C:\Windows\System\vxxqykn.exe
  C:\Windows\System\vxxqykn.exe
  2⤵
  PID:12708
- C:\Windows\System\oNkDvNA.exe
  C:\Windows\System\oNkDvNA.exe
  2⤵
  PID:12736
- C:\Windows\System\NnXCFha.exe
  C:\Windows\System\NnXCFha.exe
  2⤵
  PID:12768
- C:\Windows\System\PASBYJr.exe
  C:\Windows\System\PASBYJr.exe
  2⤵
  PID:12792
- C:\Windows\System\HUPtSkC.exe
  C:\Windows\System\HUPtSkC.exe
  2⤵
  PID:12824
- C:\Windows\System\ifeKgaM.exe
  C:\Windows\System\ifeKgaM.exe
  2⤵
  PID:12856
- C:\Windows\System\piHzHVM.exe
  C:\Windows\System\piHzHVM.exe
  2⤵
  PID:12880
- C:\Windows\System\SqvFVll.exe
  C:\Windows\System\SqvFVll.exe
  2⤵
  PID:12908
- C:\Windows\System\lzqFVNR.exe
  C:\Windows\System\lzqFVNR.exe
  2⤵
  PID:12924
- C:\Windows\System\WvNotkj.exe
  C:\Windows\System\WvNotkj.exe
  2⤵
  PID:12940
- C:\Windows\System\kHlGVFf.exe
  C:\Windows\System\kHlGVFf.exe
  2⤵
  PID:13004
- C:\Windows\System\XLQuIse.exe
  C:\Windows\System\XLQuIse.exe
  2⤵
  PID:13032
- C:\Windows\System\fMYkQYN.exe
  C:\Windows\System\fMYkQYN.exe
  2⤵
  PID:13060
- C:\Windows\System\RZRGxvn.exe
  C:\Windows\System\RZRGxvn.exe
  2⤵
  PID:13088
- C:\Windows\System\fOOsyvq.exe
  C:\Windows\System\fOOsyvq.exe
  2⤵
  PID:13104
- C:\Windows\System\KHRSlBj.exe
  C:\Windows\System\KHRSlBj.exe
  2⤵
  PID:13144
- C:\Windows\System\RjpiKDG.exe
  C:\Windows\System\RjpiKDG.exe
  2⤵
  PID:13160
- C:\Windows\System\TQfQtJx.exe
  C:\Windows\System\TQfQtJx.exe
  2⤵
  PID:13188
- C:\Windows\System\HNkRRKS.exe
  C:\Windows\System\HNkRRKS.exe
  2⤵
  PID:13216
- C:\Windows\System\scZldAD.exe
  C:\Windows\System\scZldAD.exe
  2⤵
  PID:13256
- C:\Windows\System\YWlqsZN.exe
  C:\Windows\System\YWlqsZN.exe
  2⤵
  PID:13284
- C:\Windows\System\AvTuQwy.exe
  C:\Windows\System\AvTuQwy.exe
  2⤵
  PID:12068
- C:\Windows\System\WwPqxHd.exe
  C:\Windows\System\WwPqxHd.exe
  2⤵
  PID:12344
- C:\Windows\System\KOqVtGI.exe
  C:\Windows\System\KOqVtGI.exe
  2⤵
  PID:12408
- C:\Windows\System\ocsNnIJ.exe
  C:\Windows\System\ocsNnIJ.exe
  2⤵
  PID:12476
- C:\Windows\System\wMqlFGz.exe
  C:\Windows\System\wMqlFGz.exe
  2⤵
  PID:12500
- C:\Windows\System\khGXXVC.exe
  C:\Windows\System\khGXXVC.exe
  2⤵
  PID:12548
- C:\Windows\System\EqXvTKv.exe
  C:\Windows\System\EqXvTKv.exe
  2⤵
  PID:12700
- C:\Windows\System\athENaV.exe
  C:\Windows\System\athENaV.exe
  2⤵
  PID:12788
- C:\Windows\System\lYCZuUM.exe
  C:\Windows\System\lYCZuUM.exe
  2⤵
  PID:12812
- C:\Windows\System\MboCpXz.exe
  C:\Windows\System\MboCpXz.exe
  2⤵
  PID:12836
- C:\Windows\System\UZbDyNF.exe
  C:\Windows\System\UZbDyNF.exe
  2⤵
  PID:12900
- C:\Windows\System\wNiQJoO.exe
  C:\Windows\System\wNiQJoO.exe
  2⤵
  PID:12968
- C:\Windows\System\DwXAzvv.exe
  C:\Windows\System\DwXAzvv.exe
  2⤵
  PID:13072
- C:\Windows\System\eQtvmnk.exe
  C:\Windows\System\eQtvmnk.exe
  2⤵
  PID:13116
- C:\Windows\System\rprvTdT.exe
  C:\Windows\System\rprvTdT.exe
  2⤵
  PID:13176
- C:\Windows\System\WXhWKHO.exe
  C:\Windows\System\WXhWKHO.exe
  2⤵
  PID:13240
- C:\Windows\System\RfKwchJ.exe
  C:\Windows\System\RfKwchJ.exe
  2⤵
  PID:13304
- C:\Windows\System\tzyEpsM.exe
  C:\Windows\System\tzyEpsM.exe
  2⤵
  PID:12396
- C:\Windows\System\oQNsedN.exe
  C:\Windows\System\oQNsedN.exe
  2⤵
  PID:12504
- C:\Windows\System\TEgotct.exe
  C:\Windows\System\TEgotct.exe
  2⤵
  PID:12748
- C:\Windows\System\SAfNcRr.exe
  C:\Windows\System\SAfNcRr.exe
  2⤵
  PID:12904
- C:\Windows\System\LLHNTvJ.exe
  C:\Windows\System\LLHNTvJ.exe
  2⤵
  PID:13048
- C:\Windows\System\pohBeng.exe
  C:\Windows\System\pohBeng.exe
  2⤵
  PID:13180
- C:\Windows\System\kiFhFgV.exe
  C:\Windows\System\kiFhFgV.exe
  2⤵
  PID:12308
- C:\Windows\System\ijnbKsL.exe
  C:\Windows\System\ijnbKsL.exe
  2⤵
  PID:12612
- C:\Windows\System\bqupHMl.exe
  C:\Windows\System\bqupHMl.exe
  2⤵
  PID:12980
- C:\Windows\System\xiqFbXH.exe
  C:\Windows\System\xiqFbXH.exe
  2⤵
  PID:13236
- C:\Windows\System\fdrGgHg.exe
  C:\Windows\System\fdrGgHg.exe
  2⤵
  PID:13200
- C:\Windows\System\SUhWwPv.exe
  C:\Windows\System\SUhWwPv.exe
  2⤵
  PID:13340
- C:\Windows\System\cPLgIrC.exe
  C:\Windows\System\cPLgIrC.exe
  2⤵
  PID:13364
- C:\Windows\System\kkYFzdr.exe
  C:\Windows\System\kkYFzdr.exe
  2⤵
  PID:13388
- C:\Windows\System\kNuxYjZ.exe
  C:\Windows\System\kNuxYjZ.exe
  2⤵
  PID:13440
- C:\Windows\System\DtkvPry.exe
  C:\Windows\System\DtkvPry.exe
  2⤵
  PID:13456
- C:\Windows\System\YSwSiSM.exe
  C:\Windows\System\YSwSiSM.exe
  2⤵
  PID:13484
- C:\Windows\System\rppqdNm.exe
  C:\Windows\System\rppqdNm.exe
  2⤵
  PID:13512
- C:\Windows\System\nJHltYE.exe
  C:\Windows\System\nJHltYE.exe
  2⤵
  PID:13540
- C:\Windows\System\fEmPaEm.exe
  C:\Windows\System\fEmPaEm.exe
  2⤵
  PID:13580
- C:\Windows\System\oHTpnCU.exe
  C:\Windows\System\oHTpnCU.exe
  2⤵
  PID:13600
- C:\Windows\System\wHcwaHP.exe
  C:\Windows\System\wHcwaHP.exe
  2⤵
  PID:13624
- C:\Windows\System\pauDKkk.exe
  C:\Windows\System\pauDKkk.exe
  2⤵
  PID:13640
- C:\Windows\System\EDokNYQ.exe
  C:\Windows\System\EDokNYQ.exe
  2⤵
  PID:13668
- C:\Windows\System\ryStMdn.exe
  C:\Windows\System\ryStMdn.exe
  2⤵
  PID:13684
- C:\Windows\System\nzdirYv.exe
  C:\Windows\System\nzdirYv.exe
  2⤵
  PID:13728
- C:\Windows\System\nEhFyMW.exe
  C:\Windows\System\nEhFyMW.exe
  2⤵
  PID:13776
- C:\Windows\System\NkyhUhk.exe
  C:\Windows\System\NkyhUhk.exe
  2⤵
  PID:13792
- C:\Windows\System\CkmBFEw.exe
  C:\Windows\System\CkmBFEw.exe
  2⤵
  PID:13816
- C:\Windows\System\fltqItv.exe
  C:\Windows\System\fltqItv.exe
  2⤵
  PID:13836
- C:\Windows\System\EmsjMOF.exe
  C:\Windows\System\EmsjMOF.exe
  2⤵
  PID:13868
- C:\Windows\System\IDFcuPH.exe
  C:\Windows\System\IDFcuPH.exe
  2⤵
  PID:13900
- C:\Windows\System\OzxAEjT.exe
  C:\Windows\System\OzxAEjT.exe
  2⤵
  PID:13924
- C:\Windows\System\ahJfthC.exe
  C:\Windows\System\ahJfthC.exe
  2⤵
  PID:13968
- C:\Windows\System\VryjKZi.exe
  C:\Windows\System\VryjKZi.exe
  2⤵
  PID:13988
- C:\Windows\System\uvAEWjV.exe
  C:\Windows\System\uvAEWjV.exe
  2⤵
  PID:14024
- C:\Windows\System\abtSsxV.exe
  C:\Windows\System\abtSsxV.exe
  2⤵
  PID:14048
- C:\Windows\System\bhkFjYw.exe
  C:\Windows\System\bhkFjYw.exe
  2⤵
  PID:14072
- C:\Windows\System\zluZKHt.exe
  C:\Windows\System\zluZKHt.exe
  2⤵
  PID:14100
- C:\Windows\System\HWDnuDG.exe
  C:\Windows\System\HWDnuDG.exe
  2⤵
  PID:14128
- C:\Windows\System\OlDXBxR.exe
  C:\Windows\System\OlDXBxR.exe
  2⤵
  PID:14156
- C:\Windows\System\NIKZVtI.exe
  C:\Windows\System\NIKZVtI.exe
  2⤵
  PID:14184
- C:\Windows\System\wEmsAqZ.exe
  C:\Windows\System\wEmsAqZ.exe
  2⤵
  PID:14224
- C:\Windows\System\tBhJGDi.exe
  C:\Windows\System\tBhJGDi.exe
  2⤵
  PID:14240
- C:\Windows\System\OLPFohd.exe
  C:\Windows\System\OLPFohd.exe
  2⤵
  PID:14268
- C:\Windows\System\wWWwENE.exe
  C:\Windows\System\wWWwENE.exe
  2⤵
  PID:14296
- C:\Windows\System\kjiIXGm.exe
  C:\Windows\System\kjiIXGm.exe
  2⤵
  PID:14312
- C:\Windows\System\plvjPAp.exe
  C:\Windows\System\plvjPAp.exe
  2⤵
  PID:14328
- C:\Windows\System\dQeIUVj.exe
  C:\Windows\System\dQeIUVj.exe
  2⤵
  PID:13332
- C:\Windows\System\aWAVWmf.exe
  C:\Windows\System\aWAVWmf.exe
  2⤵
  PID:13448
- C:\Windows\System\HhNOAql.exe
  C:\Windows\System\HhNOAql.exe
  2⤵
  PID:13524
- C:\Windows\System\cRLGMyh.exe
  C:\Windows\System\cRLGMyh.exe
  2⤵
  PID:13616
- C:\Windows\System\UryiUWj.exe
  C:\Windows\System\UryiUWj.exe
  2⤵
  PID:13636
- C:\Windows\System\ZmNBqjq.exe
  C:\Windows\System\ZmNBqjq.exe
  2⤵
  PID:13720
- C:\Windows\System\Pkewenb.exe
  C:\Windows\System\Pkewenb.exe
  2⤵
  PID:13772
- C:\Windows\System\dawwguS.exe
  C:\Windows\System\dawwguS.exe
  2⤵
  PID:13812
- C:\Windows\System\rejTrhv.exe
  C:\Windows\System\rejTrhv.exe
  2⤵
  PID:13848
- C:\Windows\System\qbwROmt.exe
  C:\Windows\System\qbwROmt.exe
  2⤵
  PID:13980
- C:\Windows\System\JqzrbUD.exe
  C:\Windows\System\JqzrbUD.exe
  2⤵
  PID:14044
- C:\Windows\System\YwKKqVL.exe
  C:\Windows\System\YwKKqVL.exe
  2⤵
  PID:14084
- C:\Windows\System\Qwezbhc.exe
  C:\Windows\System\Qwezbhc.exe
  2⤵
  PID:14112
- C:\Windows\System\pqwCCJu.exe
  C:\Windows\System\pqwCCJu.exe
  2⤵
  PID:14216
- C:\Windows\System\FdgxsVD.exe
  C:\Windows\System\FdgxsVD.exe
  2⤵
  PID:14260
- C:\Windows\System\fGSTzCq.exe
  C:\Windows\System\fGSTzCq.exe
  2⤵
  PID:14320
- C:\Windows\System\FtEJrNI.exe
  C:\Windows\System\FtEJrNI.exe
  2⤵
  PID:13472
- C:\Windows\System\QtArAAw.exe
  C:\Windows\System\QtArAAw.exe
  2⤵
  PID:13748
- C:\Windows\System\fUjyZlC.exe
  C:\Windows\System\fUjyZlC.exe
  2⤵
  PID:13828
- C:\Windows\System\gEYuXcY.exe
  C:\Windows\System\gEYuXcY.exe
  2⤵
  PID:14004
- C:\Windows\System\bMqAmfj.exe
  C:\Windows\System\bMqAmfj.exe
  2⤵
  PID:14088
- C:\Windows\System\FYdPqdz.exe
  C:\Windows\System\FYdPqdz.exe
  2⤵
  PID:14280
- C:\Windows\System\MUbCLFa.exe
  C:\Windows\System\MUbCLFa.exe
  2⤵
  PID:13576
- C:\Windows\System\iwwHSZO.exe
  C:\Windows\System\iwwHSZO.exe
  2⤵
  PID:13804
- C:\Windows\System\IAxWsKQ.exe
  C:\Windows\System\IAxWsKQ.exe
  2⤵
  PID:13376
- C:\Windows\System\nnOiaQI.exe
  C:\Windows\System\nnOiaQI.exe
  2⤵
  PID:14212
- C:\Windows\System\fFuZoWy.exe
  C:\Windows\System\fFuZoWy.exe
  2⤵
  PID:13596
- C:\Windows\System\nWXKSwt.exe
  C:\Windows\System\nWXKSwt.exe
  2⤵
  PID:14360
- C:\Windows\System\rzUhqJs.exe
  C:\Windows\System\rzUhqJs.exe
  2⤵
  PID:14376
- C:\Windows\System\pSzxEnu.exe
  C:\Windows\System\pSzxEnu.exe
  2⤵
  PID:14428
- C:\Windows\System\ceOdyot.exe
  C:\Windows\System\ceOdyot.exe
  2⤵
  PID:14456
- C:\Windows\System\RCyaMeX.exe
  C:\Windows\System\RCyaMeX.exe
  2⤵
  PID:14484
- C:\Windows\System\vDHQlyT.exe
  C:\Windows\System\vDHQlyT.exe
  2⤵
  PID:14500
- C:\Windows\System\kPEGrED.exe
  C:\Windows\System\kPEGrED.exe
  2⤵
  PID:14516
- C:\Windows\System\tiKNXjI.exe
  C:\Windows\System\tiKNXjI.exe
  2⤵
  PID:14544
- C:\Windows\System\FQVKTZT.exe
  C:\Windows\System\FQVKTZT.exe
  2⤵
  PID:14576
- C:\Windows\System\HFOPPMh.exe
  C:\Windows\System\HFOPPMh.exe
  2⤵
  PID:14604
- C:\Windows\System\LQrmqXc.exe
  C:\Windows\System\LQrmqXc.exe
  2⤵
  PID:14628
- C:\Windows\System\SGnrIfD.exe
  C:\Windows\System\SGnrIfD.exe
  2⤵
  PID:14680
- C:\Windows\System\XBliuzy.exe
  C:\Windows\System\XBliuzy.exe
  2⤵
  PID:14704
- C:\Windows\System\PBvMQEy.exe
  C:\Windows\System\PBvMQEy.exe
  2⤵
  PID:14724
- C:\Windows\System\fJNqjXD.exe
  C:\Windows\System\fJNqjXD.exe
  2⤵
  PID:14752
- C:\Windows\System\oDjVqbG.exe
  C:\Windows\System\oDjVqbG.exe
  2⤵
  PID:14792
- C:\Windows\System\xaRijxd.exe
  C:\Windows\System\xaRijxd.exe
  2⤵
  PID:14808
- C:\Windows\System\hXBlgVN.exe
  C:\Windows\System\hXBlgVN.exe
  2⤵
  PID:14836
- C:\Windows\System\mxIDWRl.exe
  C:\Windows\System\mxIDWRl.exe
  2⤵
  PID:14856
- C:\Windows\System\NfmJsFt.exe
  C:\Windows\System\NfmJsFt.exe
  2⤵
  PID:14880
- C:\Windows\System\SUlrSjP.exe
  C:\Windows\System\SUlrSjP.exe
  2⤵
  PID:14944
- C:\Windows\System\tbzBnpM.exe
  C:\Windows\System\tbzBnpM.exe
  2⤵
  PID:14960
- C:\Windows\System\OwqXpzX.exe
  C:\Windows\System\OwqXpzX.exe
  2⤵
  PID:14988
- C:\Windows\System\LAUHiUr.exe
  C:\Windows\System\LAUHiUr.exe
  2⤵
  PID:15016
- C:\Windows\System\OWwjvvE.exe
  C:\Windows\System\OWwjvvE.exe
  2⤵
  PID:15044
- C:\Windows\System\dAKIvjH.exe
  C:\Windows\System\dAKIvjH.exe
  2⤵
  PID:15072
- C:\Windows\System\WzAPYLs.exe
  C:\Windows\System\WzAPYLs.exe
  2⤵
  PID:15100
- C:\Windows\System\PxwqgjT.exe
  C:\Windows\System\PxwqgjT.exe
  2⤵
  PID:15128
- C:\Windows\System\NreWBuW.exe
  C:\Windows\System\NreWBuW.exe
  2⤵
  PID:15156
- C:\Windows\System\AGAONbO.exe
  C:\Windows\System\AGAONbO.exe
  2⤵
  PID:15172
- C:\Windows\System\NmlRLTl.exe
  C:\Windows\System\NmlRLTl.exe
  2⤵
  PID:15200
- C:\Windows\System\camoCfV.exe
  C:\Windows\System\camoCfV.exe
  2⤵
  PID:15216
- C:\Windows\System\mEmaYqp.exe
  C:\Windows\System\mEmaYqp.exe
  2⤵
  PID:15256
- C:\Windows\System\KRhDfzx.exe
  C:\Windows\System\KRhDfzx.exe
  2⤵
  PID:15272
- C:\Windows\System\nfTugjy.exe
  C:\Windows\System\nfTugjy.exe
  2⤵
  PID:15300
- C:\Windows\System\uOYRLQx.exe
  C:\Windows\System\uOYRLQx.exe
  2⤵
  PID:15340
- C:\Windows\System\PUlmRCA.exe
  C:\Windows\System\PUlmRCA.exe
  2⤵
  PID:14092
- C:\Windows\System\QXBpYow.exe
  C:\Windows\System\QXBpYow.exe
  2⤵
  PID:14388
- C:\Windows\System\spoOdsO.exe
  C:\Windows\System\spoOdsO.exe
  2⤵
  PID:14452
- C:\Windows\System\rjLRxeR.exe
  C:\Windows\System\rjLRxeR.exe
  2⤵
  PID:14512
- C:\Windows\System\cgZvksZ.exe
  C:\Windows\System\cgZvksZ.exe
  2⤵
  PID:14600
- C:\Windows\System\iNoOLqc.exe
  C:\Windows\System\iNoOLqc.exe
  2⤵
  PID:14648
- C:\Windows\System\sFAOSpw.exe
  C:\Windows\System\sFAOSpw.exe
  2⤵
  PID:14696
- C:\Windows\System\MBzUIRf.exe
  C:\Windows\System\MBzUIRf.exe
  2⤵
  PID:14776
- C:\Windows\System\akJNMeA.exe
  C:\Windows\System\akJNMeA.exe
  2⤵
  PID:14844
- C:\Windows\System\IsWExtR.exe
  C:\Windows\System\IsWExtR.exe
  2⤵
  PID:14936
- C:\Windows\System\EpUHdid.exe
  C:\Windows\System\EpUHdid.exe
  2⤵
  PID:15004
- C:\Windows\System\awOEUed.exe
  C:\Windows\System\awOEUed.exe
  2⤵
  PID:15088
- C:\Windows\System\jjknpIO.exe
  C:\Windows\System\jjknpIO.exe
  2⤵
  PID:15164
- C:\Windows\System\rMFIYVD.exe
  C:\Windows\System\rMFIYVD.exe
  2⤵
  PID:15208
- C:\Windows\System\BtNBnCn.exe
  C:\Windows\System\BtNBnCn.exe
  2⤵
  PID:15288
- C:\Windows\System\rxspWIf.exe
  C:\Windows\System\rxspWIf.exe
  2⤵
  PID:15356
- C:\Windows\System\aNMsJdw.exe
  C:\Windows\System\aNMsJdw.exe
  2⤵
  PID:14368
- C:\Windows\System\MqiZzFu.exe
  C:\Windows\System\MqiZzFu.exe
  2⤵
  PID:14568
- C:\Windows\System\FzWglBH.exe
  C:\Windows\System\FzWglBH.exe
  2⤵
  PID:14720
- C:\Windows\System\jRIlNdz.exe
  C:\Windows\System\jRIlNdz.exe
  2⤵
  PID:14824
- C:\Windows\System\NaaTTZn.exe
  C:\Windows\System\NaaTTZn.exe
  2⤵
  PID:15036
- C:\Windows\System\JBOlQvd.exe
  C:\Windows\System\JBOlQvd.exe
  2⤵
  PID:15140
- C:\Windows\System\nqNNQjs.exe
  C:\Windows\System\nqNNQjs.exe
  2⤵
  PID:15268
- C:\Windows\System\jpVCGzi.exe
  C:\Windows\System\jpVCGzi.exe
  2⤵
  PID:15352
- C:\Windows\System\AdDwaNe.exe
  C:\Windows\System\AdDwaNe.exe
  2⤵
  PID:14656
- C:\Windows\System\ngYKLph.exe
  C:\Windows\System\ngYKLph.exe
  2⤵
  PID:14564
- C:\Windows\System\tlMhIvU.exe
  C:\Windows\System\tlMhIvU.exe
  2⤵
  PID:15364
- C:\Windows\System\gtatQvf.exe
  C:\Windows\System\gtatQvf.exe
  2⤵
  PID:15384
- C:\Windows\System\cfwPdxB.exe
  C:\Windows\System\cfwPdxB.exe
  2⤵
  PID:15412
- C:\Windows\System\cguTyyp.exe
  C:\Windows\System\cguTyyp.exe
  2⤵
  PID:15432
- C:\Windows\System\uqGiPpY.exe
  C:\Windows\System\uqGiPpY.exe
  2⤵
  PID:15480
- C:\Windows\System\gJtgoWf.exe
  C:\Windows\System\gJtgoWf.exe
  2⤵
  PID:15496
- C:\Windows\System\UUFVcgg.exe
  C:\Windows\System\UUFVcgg.exe
  2⤵
  PID:15516
- C:\Windows\System\BEqBdrF.exe
  C:\Windows\System\BEqBdrF.exe
  2⤵
  PID:15544
- C:\Windows\System\rRlEMeU.exe
  C:\Windows\System\rRlEMeU.exe
  2⤵
  PID:15576
- C:\Windows\System\fpUijBf.exe
  C:\Windows\System\fpUijBf.exe
  2⤵
  PID:15608
- C:\Windows\System\KzhhCGa.exe
  C:\Windows\System\KzhhCGa.exe
  2⤵
  PID:15628
- C:\Windows\System\jTrWadD.exe
  C:\Windows\System\jTrWadD.exe
  2⤵
  PID:15660
- C:\Windows\System\vMpTmXa.exe
  C:\Windows\System\vMpTmXa.exe
  2⤵
  PID:15688
- C:\Windows\System\upIWyPP.exe
  C:\Windows\System\upIWyPP.exe
  2⤵
  PID:15708
- C:\Windows\System\OYcSiVZ.exe
  C:\Windows\System\OYcSiVZ.exe
  2⤵
  PID:15748
- C:\Windows\System\KGQapQn.exe
  C:\Windows\System\KGQapQn.exe
  2⤵
  PID:15788
- C:\Windows\System\EIkcGoj.exe
  C:\Windows\System\EIkcGoj.exe
  2⤵
  PID:15804
- C:\Windows\System\KfsfRVV.exe
  C:\Windows\System\KfsfRVV.exe
  2⤵
  PID:15832
- C:\Windows\System\YiAADfp.exe
  C:\Windows\System\YiAADfp.exe
  2⤵
  PID:15852
- C:\Windows\System\xtVnqND.exe
  C:\Windows\System\xtVnqND.exe
  2⤵
  PID:15884
- C:\Windows\System\YMDrtyx.exe
  C:\Windows\System\YMDrtyx.exe
  2⤵
  PID:15912
- C:\Windows\System\YHUeZQs.exe
  C:\Windows\System\YHUeZQs.exe
  2⤵
  PID:15948
- C:\Windows\System\eaIdOCO.exe
  C:\Windows\System\eaIdOCO.exe
  2⤵
  PID:15972
- C:\Windows\System\QtxJPRn.exe
  C:\Windows\System\QtxJPRn.exe
  2⤵
  PID:16004
- C:\Windows\System\sZwtIMU.exe
  C:\Windows\System\sZwtIMU.exe
  2⤵
  PID:16028
- C:\Windows\System\ONZllpP.exe
  C:\Windows\System\ONZllpP.exe
  2⤵
  PID:16044
- C:\Windows\System\oTbauMG.exe
  C:\Windows\System\oTbauMG.exe
  2⤵
  PID:16096
- C:\Windows\System\aWqjRcl.exe
  C:\Windows\System\aWqjRcl.exe
  2⤵
  PID:16124
- C:\Windows\System\cKjpuwi.exe
  C:\Windows\System\cKjpuwi.exe
  2⤵
  PID:16140
- C:\Windows\System\eneqzTn.exe
  C:\Windows\System\eneqzTn.exe
  2⤵
  PID:16168
- C:\Windows\System\FxouILJ.exe
  C:\Windows\System\FxouILJ.exe
  2⤵
  PID:16192
- C:\Windows\System\JWRwaim.exe
  C:\Windows\System\JWRwaim.exe
  2⤵
  PID:16224
- C:\Windows\System\qIubRQu.exe
  C:\Windows\System\qIubRQu.exe
  2⤵
  PID:16252
- C:\Windows\System\SEnxGAV.exe
  C:\Windows\System\SEnxGAV.exe
  2⤵
  PID:16292
- C:\Windows\System\tuQODdK.exe
  C:\Windows\System\tuQODdK.exe
  2⤵
  PID:16320
- C:\Windows\System\QYhKpHs.exe
  C:\Windows\System\QYhKpHs.exe
  2⤵
  PID:16348
- C:\Windows\System\VaoQhlv.exe
  C:\Windows\System\VaoQhlv.exe
  2⤵
  PID:16376
- C:\Windows\System\fxeOhGK.exe
  C:\Windows\System\fxeOhGK.exe
  2⤵
  PID:15376
- C:\Windows\System\acljPUI.exe
  C:\Windows\System\acljPUI.exe
  2⤵
  PID:15404
- C:\Windows\System\tNkqhvb.exe
  C:\Windows\System\tNkqhvb.exe
  2⤵
  PID:15464
- C:\Windows\System\LWehMmK.exe
  C:\Windows\System\LWehMmK.exe
  2⤵
  PID:15512
- C:\Windows\System\ReoBJVo.exe
  C:\Windows\System\ReoBJVo.exe
  2⤵
  PID:15616
- C:\Windows\System\WeuoJRf.exe
  C:\Windows\System\WeuoJRf.exe
  2⤵
  PID:15680
- C:\Windows\System\MDIMeAF.exe
  C:\Windows\System\MDIMeAF.exe
  2⤵
  PID:15732
- C:\Windows\System\brjvbEP.exe
  C:\Windows\System\brjvbEP.exe
  2⤵
  PID:15800
- C:\Windows\System\PVMjKfd.exe
  C:\Windows\System\PVMjKfd.exe
  2⤵
  PID:15872
- C:\Windows\System\MXXcvlj.exe
  C:\Windows\System\MXXcvlj.exe
  2⤵
  PID:15956
- C:\Windows\System\xNCcgla.exe
  C:\Windows\System\xNCcgla.exe
  2⤵
  PID:15992
- C:\Windows\System\jBJsMkR.exe
  C:\Windows\System\jBJsMkR.exe
  2⤵
  PID:16040
- C:\Windows\System\hajzBbj.exe
  C:\Windows\System\hajzBbj.exe
  2⤵
  PID:16152
- C:\Windows\System\mQfMuQb.exe
  C:\Windows\System\mQfMuQb.exe
  2⤵
  PID:16240
- C:\Windows\System\whPfMwP.exe
  C:\Windows\System\whPfMwP.exe
  2⤵
  PID:16280
- C:\Windows\System\BHuLIrq.exe
  C:\Windows\System\BHuLIrq.exe
  2⤵
  PID:16312
- C:\Windows\System\gcsgCwh.exe
  C:\Windows\System\gcsgCwh.exe
  2⤵
  PID:16340
- C:\Windows\System\DNvqqLd.exe
  C:\Windows\System\DNvqqLd.exe
  2⤵
  PID:15472
- C:\Windows\System\iOYNznK.exe
  C:\Windows\System\iOYNznK.exe
  2⤵
  PID:15568
- C:\Windows\System\fhBSady.exe
  C:\Windows\System\fhBSady.exe
  2⤵
  PID:15720
- C:\Windows\System\JPfFLQk.exe
  C:\Windows\System\JPfFLQk.exe
  2⤵
  PID:15904
- C:\Windows\System\piEopaP.exe
  C:\Windows\System\piEopaP.exe
  2⤵
  PID:16092
- C:\Windows\System\sLxPmtf.exe
  C:\Windows\System\sLxPmtf.exe
  2⤵
  PID:16304
- C:\Windows\System\oLIvaqP.exe
  C:\Windows\System\oLIvaqP.exe
  2⤵
  PID:15408
- C:\Windows\System\CsDauiD.exe
  C:\Windows\System\CsDauiD.exe
  2⤵
  PID:15776
- C:\Windows\System\GEnAUsB.exe
  C:\Windows\System\GEnAUsB.exe
  2⤵
  PID:16208
- C:\Windows\System\KDMvvUj.exe
  C:\Windows\System\KDMvvUj.exe
  2⤵
  PID:15372
- C:\Windows\System\ZPIyRVq.exe
  C:\Windows\System\ZPIyRVq.exe
  2⤵
  PID:15684
- C:\Windows\System\yNdveeV.exe
  C:\Windows\System\yNdveeV.exe
  2⤵
  PID:16396
- C:\Windows\System\HGGeQHU.exe
  C:\Windows\System\HGGeQHU.exe
  2⤵
  PID:16416
- C:\Windows\System\CRvUCav.exe
  C:\Windows\System\CRvUCav.exe
  2⤵
  PID:16464
- C:\Windows\System\dZlqyjb.exe
  C:\Windows\System\dZlqyjb.exe
  2⤵
  PID:16492
- C:\Windows\System\HOVzQBz.exe
  C:\Windows\System\HOVzQBz.exe
  2⤵
  PID:16520
- C:\Windows\System\DSerHhC.exe
  C:\Windows\System\DSerHhC.exe
  2⤵
  PID:16548
- C:\Windows\System\erpaXEN.exe
  C:\Windows\System\erpaXEN.exe
  2⤵
  PID:16572
- C:\Windows\System\CsAoEPa.exe
  C:\Windows\System\CsAoEPa.exe
  2⤵
  PID:16592
- C:\Windows\System\bwgduxT.exe
  C:\Windows\System\bwgduxT.exe
  2⤵
  PID:16620
- C:\Windows\System\CIVYewQ.exe
  C:\Windows\System\CIVYewQ.exe
  2⤵
  PID:16648
- C:\Windows\System\MKOCkpY.exe
  C:\Windows\System\MKOCkpY.exe
  2⤵
  PID:16668
- C:\Windows\System\BPwvEgr.exe
  C:\Windows\System\BPwvEgr.exe
  2⤵
  PID:16716
- C:\Windows\System\JWGplUC.exe
  C:\Windows\System\JWGplUC.exe
  2⤵
  PID:16744
- C:\Windows\System\bHdfdpz.exe
  C:\Windows\System\bHdfdpz.exe
  2⤵
  PID:16760
- C:\Windows\System\lhGFjQq.exe
  C:\Windows\System\lhGFjQq.exe
  2⤵
  PID:16800
- C:\Windows\System\SMxPjAX.exe
  C:\Windows\System\SMxPjAX.exe
  2⤵
  PID:16816
- C:\Windows\System\tYObHZB.exe
  C:\Windows\System\tYObHZB.exe
  2⤵
  PID:16832
- C:\Windows\System\atLERtj.exe
  C:\Windows\System\atLERtj.exe
  2⤵
  PID:16860
- C:\Windows\System\mtnjIrM.exe
  C:\Windows\System\mtnjIrM.exe
  2⤵
  PID:16896
- C:\Windows\System\FieHgAz.exe
  C:\Windows\System\FieHgAz.exe
  2⤵
  PID:16940
- C:\Windows\System\HtVCUQh.exe
  C:\Windows\System\HtVCUQh.exe
  2⤵
  PID:16980
- C:\Windows\System\QIZMVfx.exe
  C:\Windows\System\QIZMVfx.exe
  2⤵
  PID:17016
- C:\Windows\System\CBzhoIA.exe
  C:\Windows\System\CBzhoIA.exe
  2⤵
  PID:17032

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:15592

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\BQAGPkh.exe

Filesize
1.8MB

MD5
6190dc42d12646d11b97e3bff814342d

SHA1
a06820f2947d68b9e4bd4b270b6eee49d252e6d8

SHA256
11bb59e7ae3af7df5f860c871c7a90018920ea9ea3af924541d27732acc2af98

SHA512
6834ee8c52f848a0cfd80cdd20a990a93cef4cd358f618f88ea72dd558041153bcbab36c9ed3e407139c24a0bfaf7eeaecb708da13a7affae6b50da380d1b9bd

Download Submit
C:\Windows\System\DsUTYja.exe

Filesize
1.8MB

MD5
f20ab28e349c6eefc7e6fe6fc4d81a4f

SHA1
c8b7453bf2ca94724b0336e21a366d4d10c00cd0

SHA256
8dd7d36c22667c12d9d872ba1adb8ce7d9ecb03e3a74709bb56ce06eea1bb5ea

SHA512
28b6a29093d13d1bf1aad4c644711208d2b08f6060df5b72dda351ac84271f90873659877bc1fd18a28aca20f38da979f8a5ea5ea5c479c264c25c532a779b53

Download Submit
C:\Windows\System\GQGOdMM.exe

Filesize
1.8MB

MD5
edc25d712e059427ca737ffd54f6efca

SHA1
1db7b96960042048eaec5f18c554f653c85b9d6f

SHA256
8320016d20e9ca5ba2ab5ec79037d6991292d62404905ff21f81bb9af0acb861

SHA512
9b10cfb5bb4efb4e86dc24c5a264d6fb81ace08218e79e3598ebdfc625b9cde8fba30a107b62b10d1f6f3263b69120f3a950c0c8587018dad57e6a2db3a25a3b

Download Submit
C:\Windows\System\GtFDpei.exe

Filesize
1.8MB

MD5
aacaefbee34f8f7c95f2744bf1d60bef

SHA1
a198c6b90047be09cac360a9ab551e0965b384c3

SHA256
f13276f89afc13965d942c6ff803823ba49242b79ee2bf7c12dfc788892e0b79

SHA512
7a7ebb7964d8b170633f3096388d9461a582ee2f086421150865db85e14bb3563f6c83fccdf579755cca2f151291daae80119ebe7f28ace61cb83af008c4c792

Download Submit
C:\Windows\System\JxzyBug.exe

Filesize
1.8MB

MD5
7b2e6f0b973f76a1e0f4ac9b263227c6

SHA1
915a31bbed6f8d532c4a5220e4c62ed4854bf39f

SHA256
e03e672fc00f86ed8ced804976f54d801a7357d24f9368fa955d391e8a887283

SHA512
87fe0b9e0b08a2aa56b2430bd5ab15798a91762dc62ba99a8cfe2662ca7895bb8d5da8fe328b46b0b8960cdd2a74cec583b613888fde06de4d8214c6b276f9d3

Download Submit
C:\Windows\System\LmVlUDM.exe

Filesize
1.8MB

MD5
61b9a3920ea49f1127b17bb0f0bd0979

SHA1
8f011a1bbd04c1e2089f4ea5aad7630041e9bb58

SHA256
1796bcfaef28d3ebd61ea24b0536f5364854db7fc72cb0951d817a41f8ffa037

SHA512
47d651be6621874678c5fa913f5b8afbe8edce9a0e106d83251f3a3820535d6c0ce50f675f485a9f8a64bf0622161e2654c6c93eec742907cbdacebdbbcab45f

Download Submit
C:\Windows\System\LtNLBtP.exe

Filesize
1.8MB

MD5
cde004f32d3a9275f03e0a8ff4195ec7

SHA1
940f9d0c9456418fb0f46a972c19977b98b44b5e

SHA256
b0d20ef3ab9278c8965b2572e4d564d02e0721f54cf0c7cd1c1803558af74e2a

SHA512
3636a910cb2fb8bdf3e6c7e1a554c15e5533f727eac4b2fc8e6e9baf90c12c856cca41afecaf64d5f47b44925124eacd07adb6f60b7d728f0cc830396148cd94

Download Submit
C:\Windows\System\MjZgYuh.exe

Filesize
1.8MB

MD5
566e12dc62f5e4cb1f60196162765b03

SHA1
9d30f1216c3e978155752224f14649c0c31476a5

SHA256
51b4db09c9221ad793ee2977129bec22525209d8e75aff36d35d8f8c386b9b34

SHA512
8a4e6dd1d2a4c26adaa850c40f2d5cd506193bcee00025e1062fcc94054eed6b312b8cc411aa1c351716d41ab971624978f74f9b74102523abad17403a638661

Download Submit
C:\Windows\System\NtDsmhb.exe

Filesize
1.8MB

MD5
c3265d63676db975d81ac0a2a30323ee

SHA1
9525287015888f0bf202e5d2c96e7d8973f910c2

SHA256
fce4ecc6d3db01af3da4dfdd024f30ceb26a78ad00c43937640bb373fbcb5f4b

SHA512
e5fcc5f36897301f52564e45d1f83632de6905036c7e7796252d01c9f42e9197b39ce22a0ec6e1edb8852ebe6a95a60a98787e9e235ec0f5c38e7f3a7142f139

Download Submit
C:\Windows\System\QfUtbbX.exe

Filesize
1.8MB

MD5
5d86639df9ce8e3aefb2e04a9ee2e76b

SHA1
4d65c666c98475c4ad8b47d18d1cc0c612e3473f

SHA256
0558bc158f1a1326bc57c2ef1f9cc3eb44a2d77417d9ed065189dbb4b10773f8

SHA512
12f60d68c0337a68c6a24f4903f949b7e4fe3b0d7e6430da3a4e6fd1347094529d510703876d5831cce9c8636b35bdbf23a2cb12c66ff3ffda1bee6bc76f13de

Download Submit
C:\Windows\System\QkqscQl.exe

Filesize
1.8MB

MD5
7e00b73af7e7444a6df24c1265cf9965

SHA1
9b751144203a31ec5eab9cb0673fef649e8949cd

SHA256
bf2ac31d711b3ece8a021ba1598af58d73e7eb7b2fe558e5a8d4382040ac8477

SHA512
158b55ebb2400557a206919657d524870448842616bb47688998999f8f0f6c28b13404732c3c92b7a8aacbe92ccbfbbab70391a81b5b8dd4e1cefe96eab909b2

Download Submit
C:\Windows\System\RkYMtPv.exe

Filesize
1.8MB

MD5
08066901918877365865d4f2bc359894

SHA1
2eebaa600a71bec5f52adb70714c19dea7962e69

SHA256
22764ec46cfc0d81d99882103991deec1a349be8673dbe44ba1878144b8a83f9

SHA512
1fae7024b543b26d5c81fac3d38afc3c24b3b29c9823197ec7cb821ddcabb357350e75f1bb08cd2a076a35cd8d516b19b9b69a4e93aa3b5f5f3cf32af9dd129d

Download Submit
C:\Windows\System\TISUxms.exe

Filesize
1.8MB

MD5
3ec403794dafdca397dc05664fdfee40

SHA1
9a2369e768ce11b0fb589b71cadbef8f82e4283c

SHA256
427c364ee93d38f27d3e1a874b1ebc9041995872924420d95623086a4f38b949

SHA512
c9eba4713d5536ae7330aefc473c946dbea2d2bc2c1edcbf3fefd18154c614f9ec54f6fc8fa92b8cc41d71e916c81611f487b8c528b4e6314cf41eef0c04a267

Download Submit
C:\Windows\System\UIawwtV.exe

Filesize
1.8MB

MD5
4e38fde7ba5560f796967e7cd2426d3d

SHA1
2a395b50897a43a8b22a3e45f4c8d7943796d0a1

SHA256
5d9bdfee3720d721f2ff4aacc13595b8f32447dd67472f6d3ba21252dbe1d304

SHA512
683c23d834870312cc76005a4ce82b89bc20159651774e5079a98ed5a921a2423b8fda3a5ea8a930e9e876b8a37781624ae22fd2904568885d36a1b31de30dff

Download Submit
C:\Windows\System\UuQrECb.exe

Filesize
1.8MB

MD5
5b85929f76fd1d17491f90c996d0105d

SHA1
8020f42bce4d223fa58c0521daa1027c56324961

SHA256
8d137d9fc342d17623c9b1cd67209758f6f8baccb3e4eb8394753e1bf2ed5cee

SHA512
5394e743aedd9ac68e6fec6e2736261fed015550606a93856897b07ccad2ca7062832580278217ccb92a391a93c9aebfd8c35f246ce88d978d3a624033bf8ca7

Download Submit
C:\Windows\System\VeRuzQt.exe

Filesize
1.8MB

MD5
a09a530a98f598e97a5034849389d4f2

SHA1
c9a6fe01aeb467d2fb74f9cd30ab5841c81cd5ee

SHA256
e1e676decd8952da56f1dd0271bcf53e24438d8fa72f606b0758b3f50b657a9d

SHA512
0d627d093f55bfe71ce31384eeba9555a46c370aba9e876429d2fd6baf51590dbfb189b8923298906d7ff73ed0b4055e524d423350defdfab4e5117838ed82a3

Download Submit
C:\Windows\System\VjxymAo.exe

Filesize
1.8MB

MD5
cae784e73ffe2baebedfdcf9b38779f5

SHA1
a76b239f99759c7095d052ff87ba6a1be7515497

SHA256
df7a0292b853a011c96eb786846e2fcb269dd0ac96011a3eb952d8111fa3fb06

SHA512
63b67ab7ce9b08ac9a4a1b89d6e75df642987b0702a391a1d4a8cc1bbe6bf394ed265a7c473759a5776d971982ec73caba1b78820ef27d760c8f5ca49ec8bc9f

Download Submit
C:\Windows\System\VoXEdtL.exe

Filesize
1.8MB

MD5
c092569dcc05fdab97c0e7ee5597ea3b

SHA1
e72dd9ff336c74063e19d090318fe66a7eef0f92

SHA256
6d7b8320f19a964e9986045758f5a82dd291b1bbecb9e625683ac604344840ac

SHA512
6cbcc9f57652b7a93f21e0c1c17161f13f7a383ee7a73c3eb42ebd1d6b873729b1dc8fb402418edb54dbb05c83e549a6f769e4f559f6c4d735a63670e8c4e271

Download Submit
C:\Windows\System\YFtVYgp.exe

Filesize
1.8MB

MD5
d260d9b0a61edd7a38ac75aaf858af3d

SHA1
979820273666bd160a1c4d887e13d0d21389ce94

SHA256
ff6452d63e2323bc09ef536f1ebea8268a5e7ea6d3275fc670b6089acc0b6198

SHA512
db00cfae08aff9d51b33af76cf2a710fdb61393fdd82fb468ead76cfbb7d98c0d4daf1c0c76a94ab7d7a04f08ba7d9a2e2ad2b97eb31d930411094446fdeac5f

Download Submit
C:\Windows\System\YVGDaoF.exe

Filesize
1.8MB

MD5
5c5b59c5e5e18ae541ecf249d37e1af3

SHA1
72ebea3d1fb182b0b32457de72093c4a43764a5e

SHA256
d16a49afa84da04689a094136d60efb0f22f469779e3a45e6f51a3c8d3479d7b

SHA512
1766db8a68715c4d8c3a2f99317f58fdab5f6367c31d6651d6ebdec736f2210f4a32af963f47e97c93c6a203973ddd70e5211cb8e9574b1d60a7ed8d43465ecb

Download Submit
C:\Windows\System\ZRtoRyY.exe

Filesize
1.8MB

MD5
eb19450371c28604c1abc8d8d4ff4aad

SHA1
aaf89cd580b15e8b9079a603c176cd2af34fa45a

SHA256
4f2c0c103563ec0460f2bcbe9e41fd2cf40ba026ac9be80e3f0eadfaf306bfc7

SHA512
227bf3fe44e9a1f68ead0042f1259cd19d35e80c86d313ad7ae7d91e15f84409b8b81dcadae2f15fe2d43eea756213176fa67b1223895ccbdc07ba15bb8ae129

Download Submit
C:\Windows\System\fWDiqzo.exe

Filesize
1.8MB

MD5
97fce599e41dc9d6ac0ade9f13ec3802

SHA1
bdbc56c8bffef70a822a5ecb519c4f5bc4e2f8a7

SHA256
7faea17c3d2c313e90e23ec30fdf53ddeb3c795a0f9d219b3cc540d03285a50d

SHA512
d128ba73eee1e7d80228e7955b44348c0fffcebbe4362f818d14be9c35f8597bba3c7f72a43a5310e6a9fb395eda83646121159a86f1df6b8bf586c694db95d0

Download Submit
C:\Windows\System\hAIzgOE.exe

Filesize
1.8MB

MD5
724c9a5c697f785f9979c0fe2c509df0

SHA1
9498df869e9c804625a94c980e388b61bf06c06e

SHA256
04f77196394366c2fcfd6508e82f564e79824a3d3788afde711d4be359a22d94

SHA512
54fa5ad6e7eb0d510e92e00873db3119a0ddde3033ed080e87ced4d4b3d2eafb620f766242c8a5947434c76d91cc5e16a1a2dc62a8beb465845d1b1531d35b2a

Download Submit
C:\Windows\System\jwsWJqw.exe

Filesize
1.8MB

MD5
4c44b9e08978c768a065595636225789

SHA1
ab60f08db28ac55eaa23b284853f602abc70fb94

SHA256
293887672a0c6c069d74beff2722aad6989df95a77655c81ba132ba30709c42c

SHA512
17e48a313c266dd7dc614773334967194cffc1dc14d5cff1d91ab37c3aa701c35073b6b481af1d87a3be2d98765f51636b1279bcc1cac74c350a6fb7cdffe2b2

Download Submit
C:\Windows\System\lIHWJNf.exe

Filesize
1.8MB

MD5
4b205a7bf202ce24237a58b34c2075ec

SHA1
870cc10242601e53ea22646208cd79bc44492399

SHA256
eae52c3b5a64006c405f8910bf3efa1e41f1a45f85794ff3a013f1ae841a5228

SHA512
b7628315ae46e6aaa719d220ed255cbe6835087c0f1f7d115c50d4be34528979834e720fc26622ddf2b58b2df757064d057892754563dec729ec9a38533513b9

Download Submit
C:\Windows\System\rFXDbKf.exe

Filesize
1.8MB

MD5
6efc631e13d6126a58a41f4c6bed392d

SHA1
ba2ba04bbbb3906909d0f23c043f20c10fa8f213

SHA256
978f4e68758d1c4b238310413c5a7a180c3350f5fbc41b022e6f8d4f18f3f9a1

SHA512
fda1517601c33a52620b7e7875fedadf25e10e1aac7c0e1079380698315b408362d5b15804af4d49055c6d64cb57b833d02f4cf72edaf1d63ab7de095f99b82f

Download Submit
C:\Windows\System\rTouxBL.exe

Filesize
1.8MB

MD5
9e3243bc16dcac57c3b9036af73012c3

SHA1
11c4f85821621561c95f925aef8a2a59cd9cf5bf

SHA256
13e6f99160c157c72688c5bb7d54326245c294420a3654c3c51dcce7ae60323d

SHA512
973be9ec68554071a6ed5b79bb8265fa01a1f137958af58dcec8654e7c1a33468b8df70186fdfe847616bf923ae679f8852e32e2ff152c610a46a337f20a2ef3

Download Submit
C:\Windows\System\reDpkRh.exe

Filesize
1.8MB

MD5
dbae33596aa8f0156ed34139094d1796

SHA1
d0f9f284380258454c76b822acfc6f258ee60af6

SHA256
6cbae8493be245be23b3bf5baef4706055e2163fefb6ec7d1a184362d13879c4

SHA512
02535b74b20909b77a49330a464c0d846a1372bab2f3a98515252125d834ff26479022b96a4e0210f8548cf42e2f084fac76b2ac1933c7c367a7f07e622a8331

Download Submit
C:\Windows\System\roDOkLm.exe

Filesize
1.8MB

MD5
89bf447f11366e383df27ee9b3141753

SHA1
6111a1bc9bdf171dd2f9046c2bf89d58fb2f0b56

SHA256
c975bd4563edf54f30cc914acb162685030836145e15d1b664d2cd3395812f33

SHA512
14bc6000484a68acaec316b12913131cafd966698b85463a1f1e32521c397061c1402cc711323c6a38e4f94d6129b104be8c49ed68d767a50ca42e5859bf0ef5

Download Submit
C:\Windows\System\selsPNd.exe

Filesize
1.8MB

MD5
4516a8e25a1f23f6319b11185a77f0cc

SHA1
c3169d2c835e9c3a83abed2abdc47c77ce398e83

SHA256
c8900f07b31f092ca7ade36d33a3c207a8b566e0feb256f252de6022ff994e6f

SHA512
469f5c07542499d3624a4fe2229190657d1b89ad76c81717cee56b6e7480a158cc561f744024a0eacdcc032fe73558484d143917e491b9e3999893a5196ed505

Download Submit
C:\Windows\System\sidGucO.exe

Filesize
1.8MB

MD5
3567b4e70e87df17143f2261a53b34bf

SHA1
ff0cba7482b1ec95ce92cf95bae77053d27fdbec

SHA256
ebc0a17a9abed0bf2bdc993da575b5fbbaa81039ee3b2943a014b2922e0c69ec

SHA512
e536ef53e475830bafa1f2efc5fcb1ed2c816bc605ab184a2239b744356615cd50f61ec53be46c7f59dfa662b0d68a28545d18fe7f27897ffe628aae4a5876a7

Download Submit
C:\Windows\System\tiwdyOe.exe

Filesize
1.8MB

MD5
dd16e455787c00a39f3bcdeedc5b6881

SHA1
055f597fa546023fe27bcf58f2f99813f6379235

SHA256
95aad0068babc761cb4c7da35b10a4ca63926ff46849367adfb345038edd3765

SHA512
5ed5f886e66fe6c75b5d85e613a7653c58ce444b7deff5da1f53a3b5fee21e4ed416c02665f3279dd6b25d324071620db6d47822f760d3ecd3157ac191132848

Download Submit
C:\Windows\System\zpWLXWb.exe

Filesize
1.8MB

MD5
b75aeb89380a2a826b319ae6740070d5

SHA1
b7dfbf558fa2b639778b03bdf89732e4145197ac

SHA256
0c9ab434e4153b007e634d6f290a852a9c4cc8556781196267b345ceeabad668

SHA512
44aaca3639787824b62b48bc964b63db09025318eb3e5a4e8398d41df6442be90dd06f7331e0e6ab7a765ea54a0ff03d3f3fa47db1aa22579312622e5df3cf0a

Download Submit
memory/1764-0-0x00000210D0B50000-0x00000210D0B60000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads