xmrig | 705e7bf7c644a26ce487b851e93e10eb497e12fd2a7a8ed23c4aad33c7746c7e

Analysis

max time kernel
149s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
24-12-2024 23:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

705e7bf7c644a26ce487b851e93e10eb497e12fd2a7a8ed23c4aad33c7746c7e.exe
Size

1.6MB
MD5

61e3738642ab0c40d5825d8d74f80c88
SHA1

f8ccb42b075513e3f194939c5bc64dd9162a8412
SHA256

705e7bf7c644a26ce487b851e93e10eb497e12fd2a7a8ed23c4aad33c7746c7e
SHA512

c80aa05a4bb90c53e5660f7a7f007daf54a9ab655d717d38259d62887e0659dbe2afa80477223aaabae6f36575094c3fe9418fcd5462966894cf172b6151fdda
SSDEEP

49152:GezaTF8FcNkNdfE0pZ9ozttwIRRegkvbAOq:GemTLkNdfE0pZyx

Score

10^/10

xmrig discovery miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 33 IoCs

miner

resource	yara_rule
behavioral2/files/0x000c000000023b14-4.dat	xmrig
behavioral2/files/0x000a000000023b71-8.dat	xmrig
behavioral2/files/0x000d000000023b6d-10.dat	xmrig
behavioral2/files/0x000a000000023b72-21.dat	xmrig
behavioral2/files/0x000a000000023b79-54.dat	xmrig
behavioral2/files/0x000a000000023b7b-67.dat	xmrig
behavioral2/files/0x000a000000023b7e-82.dat	xmrig
behavioral2/files/0x000a000000023b8f-162.dat	xmrig
behavioral2/files/0x000a000000023b8d-158.dat	xmrig
behavioral2/files/0x000a000000023b8e-157.dat	xmrig
behavioral2/files/0x000a000000023b8c-153.dat	xmrig
behavioral2/files/0x000a000000023b8b-148.dat	xmrig
behavioral2/files/0x000a000000023b8a-142.dat	xmrig
behavioral2/files/0x000a000000023b89-138.dat	xmrig
behavioral2/files/0x000a000000023b88-133.dat	xmrig
behavioral2/files/0x000a000000023b87-128.dat	xmrig
behavioral2/files/0x0031000000023b86-123.dat	xmrig
behavioral2/files/0x0031000000023b85-118.dat	xmrig
behavioral2/files/0x0031000000023b84-112.dat	xmrig
behavioral2/files/0x000a000000023b83-108.dat	xmrig
behavioral2/files/0x000a000000023b82-102.dat	xmrig
behavioral2/files/0x000a000000023b81-98.dat	xmrig
behavioral2/files/0x000a000000023b80-92.dat	xmrig
behavioral2/files/0x000a000000023b7f-88.dat	xmrig
behavioral2/files/0x000a000000023b7d-78.dat	xmrig
behavioral2/files/0x000a000000023b7c-73.dat	xmrig
behavioral2/files/0x000a000000023b7a-63.dat	xmrig
behavioral2/files/0x000a000000023b78-52.dat	xmrig
behavioral2/files/0x000a000000023b77-48.dat	xmrig
behavioral2/files/0x000a000000023b76-43.dat	xmrig
behavioral2/files/0x000a000000023b75-38.dat	xmrig
behavioral2/files/0x000a000000023b74-32.dat	xmrig
behavioral2/files/0x000a000000023b73-28.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
956	VdsYBlP.exe
4560	CaLTwtT.exe
4812	vvYtfIf.exe
3652	uwrLAbz.exe
3692	fZhupdh.exe
1472	gLERZIT.exe
2360	QVTNpoD.exe
4144	fsrgBMz.exe
908	yQsBIjW.exe
220	rXgqrpZ.exe
3080	TuVJmrv.exe
2652	rAjCDVk.exe
2192	rFjCngG.exe
2316	TYivkmx.exe
1744	dcMwPGq.exe
4248	WZPQXus.exe
3556	MWKFsvv.exe
4524	fRCPJld.exe
2996	KuJWJHD.exe
3944	AkhfUPa.exe
5108	cNwXoxi.exe
1084	IUGXGTO.exe
4820	OQumEJB.exe
2628	OMLsQTw.exe
1836	HsVlnGA.exe
2284	nDRJfcD.exe
3596	OvmWOAQ.exe
548	ilJFAHf.exe
1348	fcMoiXA.exe
4104	nMQTTzK.exe
1220	AjnGllj.exe
1792	lCeRIjT.exe
4024	myeJVGm.exe
4072	glSFrEp.exe
3088	pRvfTdR.exe
4868	EpqCwQO.exe
4600	LnnMZGZ.exe
900	pqvgmmP.exe
1876	uatQvnt.exe
2716	xjoDBvc.exe
1504	fPTirZv.exe
1464	RsBbxfL.exe
3092	oOnRQwj.exe
4804	ozgTmfS.exe
540	mnEBcvR.exe
2020	hHTkbBQ.exe
4448	sUAcDdD.exe
3800	kqATpGN.exe
1708	KaciNSu.exe
3700	RjPSSZv.exe
208	xfsCXWi.exe
1948	LdCMRbx.exe
4452	mxCBXft.exe
3820	ZVSukzx.exe
3476	LovdJvg.exe
3760	UBaUlUu.exe
3172	oEdsopQ.exe
3236	yMltiRS.exe
4784	gTvCJxp.exe
1604	IyPZEGo.exe
4932	DQDLVDI.exe
4904	cPbkcoL.exe
3448	QiIOqmv.exe
3180	qRXAJsu.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\lubLqZC.exe	705e7bf7c644a26ce487b851e93e10eb497e12fd2a7a8ed23c4aad33c7746c7e.exe
File created	C:\Windows\System\cRidCPZ.exe	705e7bf7c644a26ce487b851e93e10eb497e12fd2a7a8ed23c4aad33c7746c7e.exe
File created	C:\Windows\System\kMwmbgt.exe	705e7bf7c644a26ce487b851e93e10eb497e12fd2a7a8ed23c4aad33c7746c7e.exe
File created	C:\Windows\System\MKGgFLC.exe	705e7bf7c644a26ce487b851e93e10eb497e12fd2a7a8ed23c4aad33c7746c7e.exe
File created	C:\Windows\System\UQzVtta.exe	705e7bf7c644a26ce487b851e93e10eb497e12fd2a7a8ed23c4aad33c7746c7e.exe
File created	C:\Windows\System\UHwRWJD.exe	705e7bf7c644a26ce487b851e93e10eb497e12fd2a7a8ed23c4aad33c7746c7e.exe
File created	C:\Windows\System\AkhfUPa.exe	705e7bf7c644a26ce487b851e93e10eb497e12fd2a7a8ed23c4aad33c7746c7e.exe
File created	C:\Windows\System\ArcZvyh.exe	705e7bf7c644a26ce487b851e93e10eb497e12fd2a7a8ed23c4aad33c7746c7e.exe
File created	C:\Windows\System\hxXTuZw.exe	705e7bf7c644a26ce487b851e93e10eb497e12fd2a7a8ed23c4aad33c7746c7e.exe
File created	C:\Windows\System\TquByKK.exe	705e7bf7c644a26ce487b851e93e10eb497e12fd2a7a8ed23c4aad33c7746c7e.exe
File created	C:\Windows\System\irPkqQW.exe	705e7bf7c644a26ce487b851e93e10eb497e12fd2a7a8ed23c4aad33c7746c7e.exe
File created	C:\Windows\System\covZogh.exe	705e7bf7c644a26ce487b851e93e10eb497e12fd2a7a8ed23c4aad33c7746c7e.exe
File created	C:\Windows\System\ZNUtHiI.exe	705e7bf7c644a26ce487b851e93e10eb497e12fd2a7a8ed23c4aad33c7746c7e.exe
File created	C:\Windows\System\lOurnMo.exe	705e7bf7c644a26ce487b851e93e10eb497e12fd2a7a8ed23c4aad33c7746c7e.exe
File created	C:\Windows\System\fcMoiXA.exe	705e7bf7c644a26ce487b851e93e10eb497e12fd2a7a8ed23c4aad33c7746c7e.exe
File created	C:\Windows\System\sUhORnF.exe	705e7bf7c644a26ce487b851e93e10eb497e12fd2a7a8ed23c4aad33c7746c7e.exe
File created	C:\Windows\System\qiAlFgK.exe	705e7bf7c644a26ce487b851e93e10eb497e12fd2a7a8ed23c4aad33c7746c7e.exe
File created	C:\Windows\System\raLXpAX.exe	705e7bf7c644a26ce487b851e93e10eb497e12fd2a7a8ed23c4aad33c7746c7e.exe
File created	C:\Windows\System\AjnGllj.exe	705e7bf7c644a26ce487b851e93e10eb497e12fd2a7a8ed23c4aad33c7746c7e.exe
File created	C:\Windows\System\qvQNEMK.exe	705e7bf7c644a26ce487b851e93e10eb497e12fd2a7a8ed23c4aad33c7746c7e.exe
File created	C:\Windows\System\wONxnsl.exe	705e7bf7c644a26ce487b851e93e10eb497e12fd2a7a8ed23c4aad33c7746c7e.exe
File created	C:\Windows\System\kqATpGN.exe	705e7bf7c644a26ce487b851e93e10eb497e12fd2a7a8ed23c4aad33c7746c7e.exe
File created	C:\Windows\System\OErILcC.exe	705e7bf7c644a26ce487b851e93e10eb497e12fd2a7a8ed23c4aad33c7746c7e.exe
File created	C:\Windows\System\qwSpgkf.exe	705e7bf7c644a26ce487b851e93e10eb497e12fd2a7a8ed23c4aad33c7746c7e.exe
File created	C:\Windows\System\DfVbDwA.exe	705e7bf7c644a26ce487b851e93e10eb497e12fd2a7a8ed23c4aad33c7746c7e.exe
File created	C:\Windows\System\PiifSHm.exe	705e7bf7c644a26ce487b851e93e10eb497e12fd2a7a8ed23c4aad33c7746c7e.exe
File created	C:\Windows\System\jeBHtzu.exe	705e7bf7c644a26ce487b851e93e10eb497e12fd2a7a8ed23c4aad33c7746c7e.exe
File created	C:\Windows\System\voteCDR.exe	705e7bf7c644a26ce487b851e93e10eb497e12fd2a7a8ed23c4aad33c7746c7e.exe
File created	C:\Windows\System\gGaRWfA.exe	705e7bf7c644a26ce487b851e93e10eb497e12fd2a7a8ed23c4aad33c7746c7e.exe
File created	C:\Windows\System\srHtXhF.exe	705e7bf7c644a26ce487b851e93e10eb497e12fd2a7a8ed23c4aad33c7746c7e.exe
File created	C:\Windows\System\rdxeDmu.exe	705e7bf7c644a26ce487b851e93e10eb497e12fd2a7a8ed23c4aad33c7746c7e.exe
File created	C:\Windows\System\mlQGKae.exe	705e7bf7c644a26ce487b851e93e10eb497e12fd2a7a8ed23c4aad33c7746c7e.exe
File created	C:\Windows\System\qxQxbfQ.exe	705e7bf7c644a26ce487b851e93e10eb497e12fd2a7a8ed23c4aad33c7746c7e.exe
File created	C:\Windows\System\AJClwFM.exe	705e7bf7c644a26ce487b851e93e10eb497e12fd2a7a8ed23c4aad33c7746c7e.exe
File created	C:\Windows\System\hfPCrVJ.exe	705e7bf7c644a26ce487b851e93e10eb497e12fd2a7a8ed23c4aad33c7746c7e.exe
File created	C:\Windows\System\MRZxQQt.exe	705e7bf7c644a26ce487b851e93e10eb497e12fd2a7a8ed23c4aad33c7746c7e.exe
File created	C:\Windows\System\JFkwvNG.exe	705e7bf7c644a26ce487b851e93e10eb497e12fd2a7a8ed23c4aad33c7746c7e.exe
File created	C:\Windows\System\ViUobyK.exe	705e7bf7c644a26ce487b851e93e10eb497e12fd2a7a8ed23c4aad33c7746c7e.exe
File created	C:\Windows\System\rolkXYd.exe	705e7bf7c644a26ce487b851e93e10eb497e12fd2a7a8ed23c4aad33c7746c7e.exe
File created	C:\Windows\System\lXbEgII.exe	705e7bf7c644a26ce487b851e93e10eb497e12fd2a7a8ed23c4aad33c7746c7e.exe
File created	C:\Windows\System\VaePJMP.exe	705e7bf7c644a26ce487b851e93e10eb497e12fd2a7a8ed23c4aad33c7746c7e.exe
File created	C:\Windows\System\RZLNZEx.exe	705e7bf7c644a26ce487b851e93e10eb497e12fd2a7a8ed23c4aad33c7746c7e.exe
File created	C:\Windows\System\mmHNdCZ.exe	705e7bf7c644a26ce487b851e93e10eb497e12fd2a7a8ed23c4aad33c7746c7e.exe
File created	C:\Windows\System\vjflBur.exe	705e7bf7c644a26ce487b851e93e10eb497e12fd2a7a8ed23c4aad33c7746c7e.exe
File created	C:\Windows\System\fzvyvqP.exe	705e7bf7c644a26ce487b851e93e10eb497e12fd2a7a8ed23c4aad33c7746c7e.exe
File created	C:\Windows\System\GwoUlWO.exe	705e7bf7c644a26ce487b851e93e10eb497e12fd2a7a8ed23c4aad33c7746c7e.exe
File created	C:\Windows\System\yEBjmVt.exe	705e7bf7c644a26ce487b851e93e10eb497e12fd2a7a8ed23c4aad33c7746c7e.exe
File created	C:\Windows\System\MvmwFdF.exe	705e7bf7c644a26ce487b851e93e10eb497e12fd2a7a8ed23c4aad33c7746c7e.exe
File created	C:\Windows\System\whSYeeW.exe	705e7bf7c644a26ce487b851e93e10eb497e12fd2a7a8ed23c4aad33c7746c7e.exe
File created	C:\Windows\System\nMQTTzK.exe	705e7bf7c644a26ce487b851e93e10eb497e12fd2a7a8ed23c4aad33c7746c7e.exe
File created	C:\Windows\System\HcrmVDt.exe	705e7bf7c644a26ce487b851e93e10eb497e12fd2a7a8ed23c4aad33c7746c7e.exe
File created	C:\Windows\System\xGavDdu.exe	705e7bf7c644a26ce487b851e93e10eb497e12fd2a7a8ed23c4aad33c7746c7e.exe
File created	C:\Windows\System\wpgAJvT.exe	705e7bf7c644a26ce487b851e93e10eb497e12fd2a7a8ed23c4aad33c7746c7e.exe
File created	C:\Windows\System\TYivkmx.exe	705e7bf7c644a26ce487b851e93e10eb497e12fd2a7a8ed23c4aad33c7746c7e.exe
File created	C:\Windows\System\glSFrEp.exe	705e7bf7c644a26ce487b851e93e10eb497e12fd2a7a8ed23c4aad33c7746c7e.exe
File created	C:\Windows\System\oEdsopQ.exe	705e7bf7c644a26ce487b851e93e10eb497e12fd2a7a8ed23c4aad33c7746c7e.exe
File created	C:\Windows\System\VCWlkAB.exe	705e7bf7c644a26ce487b851e93e10eb497e12fd2a7a8ed23c4aad33c7746c7e.exe
File created	C:\Windows\System\AniLSfN.exe	705e7bf7c644a26ce487b851e93e10eb497e12fd2a7a8ed23c4aad33c7746c7e.exe
File created	C:\Windows\System\rtpXxYL.exe	705e7bf7c644a26ce487b851e93e10eb497e12fd2a7a8ed23c4aad33c7746c7e.exe
File created	C:\Windows\System\sHxmwZO.exe	705e7bf7c644a26ce487b851e93e10eb497e12fd2a7a8ed23c4aad33c7746c7e.exe
File created	C:\Windows\System\qJCmnCK.exe	705e7bf7c644a26ce487b851e93e10eb497e12fd2a7a8ed23c4aad33c7746c7e.exe
File created	C:\Windows\System\nPruavp.exe	705e7bf7c644a26ce487b851e93e10eb497e12fd2a7a8ed23c4aad33c7746c7e.exe
File created	C:\Windows\System\DQDLVDI.exe	705e7bf7c644a26ce487b851e93e10eb497e12fd2a7a8ed23c4aad33c7746c7e.exe
File created	C:\Windows\System\ktnguhU.exe	705e7bf7c644a26ce487b851e93e10eb497e12fd2a7a8ed23c4aad33c7746c7e.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
14640	UPPiNGk.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	16360	dwm.exe
Token: SeChangeNotifyPrivilege	16360	dwm.exe
Token: 33	16360	dwm.exe
Token: SeIncBasePriorityPrivilege	16360	dwm.exe
Token: SeShutdownPrivilege	16360	dwm.exe
Token: SeCreatePagefilePrivilege	16360	dwm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2856 wrote to memory of 956	2856	705e7bf7c644a26ce487b851e93e10eb497e12fd2a7a8ed23c4aad33c7746c7e.exe	84
PID 2856 wrote to memory of 956	2856	705e7bf7c644a26ce487b851e93e10eb497e12fd2a7a8ed23c4aad33c7746c7e.exe	84
PID 2856 wrote to memory of 4560	2856	705e7bf7c644a26ce487b851e93e10eb497e12fd2a7a8ed23c4aad33c7746c7e.exe	85
PID 2856 wrote to memory of 4560	2856	705e7bf7c644a26ce487b851e93e10eb497e12fd2a7a8ed23c4aad33c7746c7e.exe	85
PID 2856 wrote to memory of 4812	2856	705e7bf7c644a26ce487b851e93e10eb497e12fd2a7a8ed23c4aad33c7746c7e.exe	86
PID 2856 wrote to memory of 4812	2856	705e7bf7c644a26ce487b851e93e10eb497e12fd2a7a8ed23c4aad33c7746c7e.exe	86
PID 2856 wrote to memory of 3652	2856	705e7bf7c644a26ce487b851e93e10eb497e12fd2a7a8ed23c4aad33c7746c7e.exe	87
PID 2856 wrote to memory of 3652	2856	705e7bf7c644a26ce487b851e93e10eb497e12fd2a7a8ed23c4aad33c7746c7e.exe	87
PID 2856 wrote to memory of 3692	2856	705e7bf7c644a26ce487b851e93e10eb497e12fd2a7a8ed23c4aad33c7746c7e.exe	88
PID 2856 wrote to memory of 3692	2856	705e7bf7c644a26ce487b851e93e10eb497e12fd2a7a8ed23c4aad33c7746c7e.exe	88
PID 2856 wrote to memory of 1472	2856	705e7bf7c644a26ce487b851e93e10eb497e12fd2a7a8ed23c4aad33c7746c7e.exe	89
PID 2856 wrote to memory of 1472	2856	705e7bf7c644a26ce487b851e93e10eb497e12fd2a7a8ed23c4aad33c7746c7e.exe	89
PID 2856 wrote to memory of 2360	2856	705e7bf7c644a26ce487b851e93e10eb497e12fd2a7a8ed23c4aad33c7746c7e.exe	90
PID 2856 wrote to memory of 2360	2856	705e7bf7c644a26ce487b851e93e10eb497e12fd2a7a8ed23c4aad33c7746c7e.exe	90
PID 2856 wrote to memory of 4144	2856	705e7bf7c644a26ce487b851e93e10eb497e12fd2a7a8ed23c4aad33c7746c7e.exe	91
PID 2856 wrote to memory of 4144	2856	705e7bf7c644a26ce487b851e93e10eb497e12fd2a7a8ed23c4aad33c7746c7e.exe	91
PID 2856 wrote to memory of 908	2856	705e7bf7c644a26ce487b851e93e10eb497e12fd2a7a8ed23c4aad33c7746c7e.exe	92
PID 2856 wrote to memory of 908	2856	705e7bf7c644a26ce487b851e93e10eb497e12fd2a7a8ed23c4aad33c7746c7e.exe	92
PID 2856 wrote to memory of 220	2856	705e7bf7c644a26ce487b851e93e10eb497e12fd2a7a8ed23c4aad33c7746c7e.exe	93
PID 2856 wrote to memory of 220	2856	705e7bf7c644a26ce487b851e93e10eb497e12fd2a7a8ed23c4aad33c7746c7e.exe	93
PID 2856 wrote to memory of 3080	2856	705e7bf7c644a26ce487b851e93e10eb497e12fd2a7a8ed23c4aad33c7746c7e.exe	94
PID 2856 wrote to memory of 3080	2856	705e7bf7c644a26ce487b851e93e10eb497e12fd2a7a8ed23c4aad33c7746c7e.exe	94
PID 2856 wrote to memory of 2652	2856	705e7bf7c644a26ce487b851e93e10eb497e12fd2a7a8ed23c4aad33c7746c7e.exe	95
PID 2856 wrote to memory of 2652	2856	705e7bf7c644a26ce487b851e93e10eb497e12fd2a7a8ed23c4aad33c7746c7e.exe	95
PID 2856 wrote to memory of 2192	2856	705e7bf7c644a26ce487b851e93e10eb497e12fd2a7a8ed23c4aad33c7746c7e.exe	96
PID 2856 wrote to memory of 2192	2856	705e7bf7c644a26ce487b851e93e10eb497e12fd2a7a8ed23c4aad33c7746c7e.exe	96
PID 2856 wrote to memory of 2316	2856	705e7bf7c644a26ce487b851e93e10eb497e12fd2a7a8ed23c4aad33c7746c7e.exe	97
PID 2856 wrote to memory of 2316	2856	705e7bf7c644a26ce487b851e93e10eb497e12fd2a7a8ed23c4aad33c7746c7e.exe	97
PID 2856 wrote to memory of 1744	2856	705e7bf7c644a26ce487b851e93e10eb497e12fd2a7a8ed23c4aad33c7746c7e.exe	98
PID 2856 wrote to memory of 1744	2856	705e7bf7c644a26ce487b851e93e10eb497e12fd2a7a8ed23c4aad33c7746c7e.exe	98
PID 2856 wrote to memory of 4248	2856	705e7bf7c644a26ce487b851e93e10eb497e12fd2a7a8ed23c4aad33c7746c7e.exe	99
PID 2856 wrote to memory of 4248	2856	705e7bf7c644a26ce487b851e93e10eb497e12fd2a7a8ed23c4aad33c7746c7e.exe	99
PID 2856 wrote to memory of 3556	2856	705e7bf7c644a26ce487b851e93e10eb497e12fd2a7a8ed23c4aad33c7746c7e.exe	100
PID 2856 wrote to memory of 3556	2856	705e7bf7c644a26ce487b851e93e10eb497e12fd2a7a8ed23c4aad33c7746c7e.exe	100
PID 2856 wrote to memory of 4524	2856	705e7bf7c644a26ce487b851e93e10eb497e12fd2a7a8ed23c4aad33c7746c7e.exe	101
PID 2856 wrote to memory of 4524	2856	705e7bf7c644a26ce487b851e93e10eb497e12fd2a7a8ed23c4aad33c7746c7e.exe	101
PID 2856 wrote to memory of 2996	2856	705e7bf7c644a26ce487b851e93e10eb497e12fd2a7a8ed23c4aad33c7746c7e.exe	102
PID 2856 wrote to memory of 2996	2856	705e7bf7c644a26ce487b851e93e10eb497e12fd2a7a8ed23c4aad33c7746c7e.exe	102
PID 2856 wrote to memory of 3944	2856	705e7bf7c644a26ce487b851e93e10eb497e12fd2a7a8ed23c4aad33c7746c7e.exe	103
PID 2856 wrote to memory of 3944	2856	705e7bf7c644a26ce487b851e93e10eb497e12fd2a7a8ed23c4aad33c7746c7e.exe	103
PID 2856 wrote to memory of 5108	2856	705e7bf7c644a26ce487b851e93e10eb497e12fd2a7a8ed23c4aad33c7746c7e.exe	104
PID 2856 wrote to memory of 5108	2856	705e7bf7c644a26ce487b851e93e10eb497e12fd2a7a8ed23c4aad33c7746c7e.exe	104
PID 2856 wrote to memory of 1084	2856	705e7bf7c644a26ce487b851e93e10eb497e12fd2a7a8ed23c4aad33c7746c7e.exe	105
PID 2856 wrote to memory of 1084	2856	705e7bf7c644a26ce487b851e93e10eb497e12fd2a7a8ed23c4aad33c7746c7e.exe	105
PID 2856 wrote to memory of 4820	2856	705e7bf7c644a26ce487b851e93e10eb497e12fd2a7a8ed23c4aad33c7746c7e.exe	106
PID 2856 wrote to memory of 4820	2856	705e7bf7c644a26ce487b851e93e10eb497e12fd2a7a8ed23c4aad33c7746c7e.exe	106
PID 2856 wrote to memory of 2628	2856	705e7bf7c644a26ce487b851e93e10eb497e12fd2a7a8ed23c4aad33c7746c7e.exe	107
PID 2856 wrote to memory of 2628	2856	705e7bf7c644a26ce487b851e93e10eb497e12fd2a7a8ed23c4aad33c7746c7e.exe	107
PID 2856 wrote to memory of 1836	2856	705e7bf7c644a26ce487b851e93e10eb497e12fd2a7a8ed23c4aad33c7746c7e.exe	108
PID 2856 wrote to memory of 1836	2856	705e7bf7c644a26ce487b851e93e10eb497e12fd2a7a8ed23c4aad33c7746c7e.exe	108
PID 2856 wrote to memory of 2284	2856	705e7bf7c644a26ce487b851e93e10eb497e12fd2a7a8ed23c4aad33c7746c7e.exe	109
PID 2856 wrote to memory of 2284	2856	705e7bf7c644a26ce487b851e93e10eb497e12fd2a7a8ed23c4aad33c7746c7e.exe	109
PID 2856 wrote to memory of 3596	2856	705e7bf7c644a26ce487b851e93e10eb497e12fd2a7a8ed23c4aad33c7746c7e.exe	110
PID 2856 wrote to memory of 3596	2856	705e7bf7c644a26ce487b851e93e10eb497e12fd2a7a8ed23c4aad33c7746c7e.exe	110
PID 2856 wrote to memory of 548	2856	705e7bf7c644a26ce487b851e93e10eb497e12fd2a7a8ed23c4aad33c7746c7e.exe	111
PID 2856 wrote to memory of 548	2856	705e7bf7c644a26ce487b851e93e10eb497e12fd2a7a8ed23c4aad33c7746c7e.exe	111
PID 2856 wrote to memory of 1348	2856	705e7bf7c644a26ce487b851e93e10eb497e12fd2a7a8ed23c4aad33c7746c7e.exe	112
PID 2856 wrote to memory of 1348	2856	705e7bf7c644a26ce487b851e93e10eb497e12fd2a7a8ed23c4aad33c7746c7e.exe	112
PID 2856 wrote to memory of 4104	2856	705e7bf7c644a26ce487b851e93e10eb497e12fd2a7a8ed23c4aad33c7746c7e.exe	113
PID 2856 wrote to memory of 4104	2856	705e7bf7c644a26ce487b851e93e10eb497e12fd2a7a8ed23c4aad33c7746c7e.exe	113
PID 2856 wrote to memory of 1220	2856	705e7bf7c644a26ce487b851e93e10eb497e12fd2a7a8ed23c4aad33c7746c7e.exe	114
PID 2856 wrote to memory of 1220	2856	705e7bf7c644a26ce487b851e93e10eb497e12fd2a7a8ed23c4aad33c7746c7e.exe	114
PID 2856 wrote to memory of 1792	2856	705e7bf7c644a26ce487b851e93e10eb497e12fd2a7a8ed23c4aad33c7746c7e.exe	115
PID 2856 wrote to memory of 1792	2856	705e7bf7c644a26ce487b851e93e10eb497e12fd2a7a8ed23c4aad33c7746c7e.exe	115

C:\Users\Admin\AppData\Local\Temp\705e7bf7c644a26ce487b851e93e10eb497e12fd2a7a8ed23c4aad33c7746c7e.exe
"C:\Users\Admin\AppData\Local\Temp\705e7bf7c644a26ce487b851e93e10eb497e12fd2a7a8ed23c4aad33c7746c7e.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2856
- C:\Windows\System\VdsYBlP.exe
  C:\Windows\System\VdsYBlP.exe
  2⤵
  - Executes dropped EXE
  PID:956
- C:\Windows\System\CaLTwtT.exe
  C:\Windows\System\CaLTwtT.exe
  2⤵
  - Executes dropped EXE
  PID:4560
- C:\Windows\System\vvYtfIf.exe
  C:\Windows\System\vvYtfIf.exe
  2⤵
  - Executes dropped EXE
  PID:4812
- C:\Windows\System\uwrLAbz.exe
  C:\Windows\System\uwrLAbz.exe
  2⤵
  - Executes dropped EXE
  PID:3652
- C:\Windows\System\fZhupdh.exe
  C:\Windows\System\fZhupdh.exe
  2⤵
  - Executes dropped EXE
  PID:3692
- C:\Windows\System\gLERZIT.exe
  C:\Windows\System\gLERZIT.exe
  2⤵
  - Executes dropped EXE
  PID:1472
- C:\Windows\System\QVTNpoD.exe
  C:\Windows\System\QVTNpoD.exe
  2⤵
  - Executes dropped EXE
  PID:2360
- C:\Windows\System\fsrgBMz.exe
  C:\Windows\System\fsrgBMz.exe
  2⤵
  - Executes dropped EXE
  PID:4144
- C:\Windows\System\yQsBIjW.exe
  C:\Windows\System\yQsBIjW.exe
  2⤵
  - Executes dropped EXE
  PID:908
- C:\Windows\System\rXgqrpZ.exe
  C:\Windows\System\rXgqrpZ.exe
  2⤵
  - Executes dropped EXE
  PID:220
- C:\Windows\System\TuVJmrv.exe
  C:\Windows\System\TuVJmrv.exe
  2⤵
  - Executes dropped EXE
  PID:3080
- C:\Windows\System\rAjCDVk.exe
  C:\Windows\System\rAjCDVk.exe
  2⤵
  - Executes dropped EXE
  PID:2652
- C:\Windows\System\rFjCngG.exe
  C:\Windows\System\rFjCngG.exe
  2⤵
  - Executes dropped EXE
  PID:2192
- C:\Windows\System\TYivkmx.exe
  C:\Windows\System\TYivkmx.exe
  2⤵
  - Executes dropped EXE
  PID:2316
- C:\Windows\System\dcMwPGq.exe
  C:\Windows\System\dcMwPGq.exe
  2⤵
  - Executes dropped EXE
  PID:1744
- C:\Windows\System\WZPQXus.exe
  C:\Windows\System\WZPQXus.exe
  2⤵
  - Executes dropped EXE
  PID:4248
- C:\Windows\System\MWKFsvv.exe
  C:\Windows\System\MWKFsvv.exe
  2⤵
  - Executes dropped EXE
  PID:3556
- C:\Windows\System\fRCPJld.exe
  C:\Windows\System\fRCPJld.exe
  2⤵
  - Executes dropped EXE
  PID:4524
- C:\Windows\System\KuJWJHD.exe
  C:\Windows\System\KuJWJHD.exe
  2⤵
  - Executes dropped EXE
  PID:2996
- C:\Windows\System\AkhfUPa.exe
  C:\Windows\System\AkhfUPa.exe
  2⤵
  - Executes dropped EXE
  PID:3944
- C:\Windows\System\cNwXoxi.exe
  C:\Windows\System\cNwXoxi.exe
  2⤵
  - Executes dropped EXE
  PID:5108
- C:\Windows\System\IUGXGTO.exe
  C:\Windows\System\IUGXGTO.exe
  2⤵
  - Executes dropped EXE
  PID:1084
- C:\Windows\System\OQumEJB.exe
  C:\Windows\System\OQumEJB.exe
  2⤵
  - Executes dropped EXE
  PID:4820
- C:\Windows\System\OMLsQTw.exe
  C:\Windows\System\OMLsQTw.exe
  2⤵
  - Executes dropped EXE
  PID:2628
- C:\Windows\System\HsVlnGA.exe
  C:\Windows\System\HsVlnGA.exe
  2⤵
  - Executes dropped EXE
  PID:1836
- C:\Windows\System\nDRJfcD.exe
  C:\Windows\System\nDRJfcD.exe
  2⤵
  - Executes dropped EXE
  PID:2284
- C:\Windows\System\OvmWOAQ.exe
  C:\Windows\System\OvmWOAQ.exe
  2⤵
  - Executes dropped EXE
  PID:3596
- C:\Windows\System\ilJFAHf.exe
  C:\Windows\System\ilJFAHf.exe
  2⤵
  - Executes dropped EXE
  PID:548
- C:\Windows\System\fcMoiXA.exe
  C:\Windows\System\fcMoiXA.exe
  2⤵
  - Executes dropped EXE
  PID:1348
- C:\Windows\System\nMQTTzK.exe
  C:\Windows\System\nMQTTzK.exe
  2⤵
  - Executes dropped EXE
  PID:4104
- C:\Windows\System\AjnGllj.exe
  C:\Windows\System\AjnGllj.exe
  2⤵
  - Executes dropped EXE
  PID:1220
- C:\Windows\System\lCeRIjT.exe
  C:\Windows\System\lCeRIjT.exe
  2⤵
  - Executes dropped EXE
  PID:1792
- C:\Windows\System\myeJVGm.exe
  C:\Windows\System\myeJVGm.exe
  2⤵
  - Executes dropped EXE
  PID:4024
- C:\Windows\System\glSFrEp.exe
  C:\Windows\System\glSFrEp.exe
  2⤵
  - Executes dropped EXE
  PID:4072
- C:\Windows\System\pRvfTdR.exe
  C:\Windows\System\pRvfTdR.exe
  2⤵
  - Executes dropped EXE
  PID:3088
- C:\Windows\System\EpqCwQO.exe
  C:\Windows\System\EpqCwQO.exe
  2⤵
  - Executes dropped EXE
  PID:4868
- C:\Windows\System\LnnMZGZ.exe
  C:\Windows\System\LnnMZGZ.exe
  2⤵
  - Executes dropped EXE
  PID:4600
- C:\Windows\System\pqvgmmP.exe
  C:\Windows\System\pqvgmmP.exe
  2⤵
  - Executes dropped EXE
  PID:900
- C:\Windows\System\uatQvnt.exe
  C:\Windows\System\uatQvnt.exe
  2⤵
  - Executes dropped EXE
  PID:1876
- C:\Windows\System\xjoDBvc.exe
  C:\Windows\System\xjoDBvc.exe
  2⤵
  - Executes dropped EXE
  PID:2716
- C:\Windows\System\fPTirZv.exe
  C:\Windows\System\fPTirZv.exe
  2⤵
  - Executes dropped EXE
  PID:1504
- C:\Windows\System\RsBbxfL.exe
  C:\Windows\System\RsBbxfL.exe
  2⤵
  - Executes dropped EXE
  PID:1464
- C:\Windows\System\oOnRQwj.exe
  C:\Windows\System\oOnRQwj.exe
  2⤵
  - Executes dropped EXE
  PID:3092
- C:\Windows\System\ozgTmfS.exe
  C:\Windows\System\ozgTmfS.exe
  2⤵
  - Executes dropped EXE
  PID:4804
- C:\Windows\System\mnEBcvR.exe
  C:\Windows\System\mnEBcvR.exe
  2⤵
  - Executes dropped EXE
  PID:540
- C:\Windows\System\hHTkbBQ.exe
  C:\Windows\System\hHTkbBQ.exe
  2⤵
  - Executes dropped EXE
  PID:2020
- C:\Windows\System\sUAcDdD.exe
  C:\Windows\System\sUAcDdD.exe
  2⤵
  - Executes dropped EXE
  PID:4448
- C:\Windows\System\kqATpGN.exe
  C:\Windows\System\kqATpGN.exe
  2⤵
  - Executes dropped EXE
  PID:3800
- C:\Windows\System\KaciNSu.exe
  C:\Windows\System\KaciNSu.exe
  2⤵
  - Executes dropped EXE
  PID:1708
- C:\Windows\System\RjPSSZv.exe
  C:\Windows\System\RjPSSZv.exe
  2⤵
  - Executes dropped EXE
  PID:3700
- C:\Windows\System\xfsCXWi.exe
  C:\Windows\System\xfsCXWi.exe
  2⤵
  - Executes dropped EXE
  PID:208
- C:\Windows\System\LdCMRbx.exe
  C:\Windows\System\LdCMRbx.exe
  2⤵
  - Executes dropped EXE
  PID:1948
- C:\Windows\System\mxCBXft.exe
  C:\Windows\System\mxCBXft.exe
  2⤵
  - Executes dropped EXE
  PID:4452
- C:\Windows\System\ZVSukzx.exe
  C:\Windows\System\ZVSukzx.exe
  2⤵
  - Executes dropped EXE
  PID:3820
- C:\Windows\System\LovdJvg.exe
  C:\Windows\System\LovdJvg.exe
  2⤵
  - Executes dropped EXE
  PID:3476
- C:\Windows\System\UBaUlUu.exe
  C:\Windows\System\UBaUlUu.exe
  2⤵
  - Executes dropped EXE
  PID:3760
- C:\Windows\System\oEdsopQ.exe
  C:\Windows\System\oEdsopQ.exe
  2⤵
  - Executes dropped EXE
  PID:3172
- C:\Windows\System\yMltiRS.exe
  C:\Windows\System\yMltiRS.exe
  2⤵
  - Executes dropped EXE
  PID:3236
- C:\Windows\System\gTvCJxp.exe
  C:\Windows\System\gTvCJxp.exe
  2⤵
  - Executes dropped EXE
  PID:4784
- C:\Windows\System\IyPZEGo.exe
  C:\Windows\System\IyPZEGo.exe
  2⤵
  - Executes dropped EXE
  PID:1604
- C:\Windows\System\DQDLVDI.exe
  C:\Windows\System\DQDLVDI.exe
  2⤵
  - Executes dropped EXE
  PID:4932
- C:\Windows\System\cPbkcoL.exe
  C:\Windows\System\cPbkcoL.exe
  2⤵
  - Executes dropped EXE
  PID:4904
- C:\Windows\System\QiIOqmv.exe
  C:\Windows\System\QiIOqmv.exe
  2⤵
  - Executes dropped EXE
  PID:3448
- C:\Windows\System\qRXAJsu.exe
  C:\Windows\System\qRXAJsu.exe
  2⤵
  - Executes dropped EXE
  PID:3180
- C:\Windows\System\BGKcXkU.exe
  C:\Windows\System\BGKcXkU.exe
  2⤵
  PID:4996
- C:\Windows\System\gCrmCzp.exe
  C:\Windows\System\gCrmCzp.exe
  2⤵
  PID:868
- C:\Windows\System\ArcZvyh.exe
  C:\Windows\System\ArcZvyh.exe
  2⤵
  PID:376
- C:\Windows\System\QOTaOBL.exe
  C:\Windows\System\QOTaOBL.exe
  2⤵
  PID:1560
- C:\Windows\System\rBFMyxb.exe
  C:\Windows\System\rBFMyxb.exe
  2⤵
  PID:4816
- C:\Windows\System\EzzbSlp.exe
  C:\Windows\System\EzzbSlp.exe
  2⤵
  PID:1168
- C:\Windows\System\ZkPWWXM.exe
  C:\Windows\System\ZkPWWXM.exe
  2⤵
  PID:5100
- C:\Windows\System\rUkoOoa.exe
  C:\Windows\System\rUkoOoa.exe
  2⤵
  PID:3792
- C:\Windows\System\yQAsONb.exe
  C:\Windows\System\yQAsONb.exe
  2⤵
  PID:5148
- C:\Windows\System\uyxACNk.exe
  C:\Windows\System\uyxACNk.exe
  2⤵
  PID:5176
- C:\Windows\System\CdnwsGk.exe
  C:\Windows\System\CdnwsGk.exe
  2⤵
  PID:5204
- C:\Windows\System\CxaMzpV.exe
  C:\Windows\System\CxaMzpV.exe
  2⤵
  PID:5228
- C:\Windows\System\IKvSVZn.exe
  C:\Windows\System\IKvSVZn.exe
  2⤵
  PID:5260
- C:\Windows\System\KdmiAte.exe
  C:\Windows\System\KdmiAte.exe
  2⤵
  PID:5288
- C:\Windows\System\TlfyvCt.exe
  C:\Windows\System\TlfyvCt.exe
  2⤵
  PID:5312
- C:\Windows\System\mNoSQut.exe
  C:\Windows\System\mNoSQut.exe
  2⤵
  PID:5344
- C:\Windows\System\raLXpAX.exe
  C:\Windows\System\raLXpAX.exe
  2⤵
  PID:5368
- C:\Windows\System\IbBOvLd.exe
  C:\Windows\System\IbBOvLd.exe
  2⤵
  PID:5396
- C:\Windows\System\MCWLDLi.exe
  C:\Windows\System\MCWLDLi.exe
  2⤵
  PID:5428
- C:\Windows\System\WbxTTRL.exe
  C:\Windows\System\WbxTTRL.exe
  2⤵
  PID:5452
- C:\Windows\System\zWiXlkn.exe
  C:\Windows\System\zWiXlkn.exe
  2⤵
  PID:5480
- C:\Windows\System\jyQGuOP.exe
  C:\Windows\System\jyQGuOP.exe
  2⤵
  PID:5508
- C:\Windows\System\voteCDR.exe
  C:\Windows\System\voteCDR.exe
  2⤵
  PID:5536
- C:\Windows\System\hKOYhIy.exe
  C:\Windows\System\hKOYhIy.exe
  2⤵
  PID:5564
- C:\Windows\System\jpRParh.exe
  C:\Windows\System\jpRParh.exe
  2⤵
  PID:5596
- C:\Windows\System\itVATBr.exe
  C:\Windows\System\itVATBr.exe
  2⤵
  PID:5624
- C:\Windows\System\GtjeRZm.exe
  C:\Windows\System\GtjeRZm.exe
  2⤵
  PID:5648
- C:\Windows\System\BqDtQGs.exe
  C:\Windows\System\BqDtQGs.exe
  2⤵
  PID:5676
- C:\Windows\System\IGzMNko.exe
  C:\Windows\System\IGzMNko.exe
  2⤵
  PID:5708
- C:\Windows\System\CqvtzRD.exe
  C:\Windows\System\CqvtzRD.exe
  2⤵
  PID:5728
- C:\Windows\System\NbxuRfw.exe
  C:\Windows\System\NbxuRfw.exe
  2⤵
  PID:5764
- C:\Windows\System\LzRtADi.exe
  C:\Windows\System\LzRtADi.exe
  2⤵
  PID:5792
- C:\Windows\System\GwrjHKb.exe
  C:\Windows\System\GwrjHKb.exe
  2⤵
  PID:5820
- C:\Windows\System\bTGajIW.exe
  C:\Windows\System\bTGajIW.exe
  2⤵
  PID:5844
- C:\Windows\System\vjflBur.exe
  C:\Windows\System\vjflBur.exe
  2⤵
  PID:5872
- C:\Windows\System\tEYvzvB.exe
  C:\Windows\System\tEYvzvB.exe
  2⤵
  PID:5900
- C:\Windows\System\qucOanV.exe
  C:\Windows\System\qucOanV.exe
  2⤵
  PID:5932
- C:\Windows\System\dikjsFN.exe
  C:\Windows\System\dikjsFN.exe
  2⤵
  PID:5960
- C:\Windows\System\UsdgfOr.exe
  C:\Windows\System\UsdgfOr.exe
  2⤵
  PID:5984
- C:\Windows\System\ZpwWDDj.exe
  C:\Windows\System\ZpwWDDj.exe
  2⤵
  PID:6012
- C:\Windows\System\pCcosGG.exe
  C:\Windows\System\pCcosGG.exe
  2⤵
  PID:6044
- C:\Windows\System\aOLRrjB.exe
  C:\Windows\System\aOLRrjB.exe
  2⤵
  PID:6104
- C:\Windows\System\mUrURrj.exe
  C:\Windows\System\mUrURrj.exe
  2⤵
  PID:6120
- C:\Windows\System\OfQUtrh.exe
  C:\Windows\System\OfQUtrh.exe
  2⤵
  PID:6136
- C:\Windows\System\gqffpeb.exe
  C:\Windows\System\gqffpeb.exe
  2⤵
  PID:3260
- C:\Windows\System\afnSWzv.exe
  C:\Windows\System\afnSWzv.exe
  2⤵
  PID:4240
- C:\Windows\System\qOFzIaK.exe
  C:\Windows\System\qOFzIaK.exe
  2⤵
  PID:5080
- C:\Windows\System\LWOoqnA.exe
  C:\Windows\System\LWOoqnA.exe
  2⤵
  PID:1840
- C:\Windows\System\UPwlLYd.exe
  C:\Windows\System\UPwlLYd.exe
  2⤵
  PID:3052
- C:\Windows\System\gzuydBj.exe
  C:\Windows\System\gzuydBj.exe
  2⤵
  PID:1032
- C:\Windows\System\wlYCLdB.exe
  C:\Windows\System\wlYCLdB.exe
  2⤵
  PID:5136
- C:\Windows\System\GNcwhaA.exe
  C:\Windows\System\GNcwhaA.exe
  2⤵
  PID:5212
- C:\Windows\System\gEMqrCH.exe
  C:\Windows\System\gEMqrCH.exe
  2⤵
  PID:5276
- C:\Windows\System\sUhORnF.exe
  C:\Windows\System\sUhORnF.exe
  2⤵
  PID:5332
- C:\Windows\System\NvWQuZK.exe
  C:\Windows\System\NvWQuZK.exe
  2⤵
  PID:5408
- C:\Windows\System\MghrILZ.exe
  C:\Windows\System\MghrILZ.exe
  2⤵
  PID:5468
- C:\Windows\System\ezJJFRT.exe
  C:\Windows\System\ezJJFRT.exe
  2⤵
  PID:5528
- C:\Windows\System\gGaRWfA.exe
  C:\Windows\System\gGaRWfA.exe
  2⤵
  PID:5580
- C:\Windows\System\jAyiYxt.exe
  C:\Windows\System\jAyiYxt.exe
  2⤵
  PID:5640
- C:\Windows\System\BaFIXUe.exe
  C:\Windows\System\BaFIXUe.exe
  2⤵
  PID:5696
- C:\Windows\System\JEiZqis.exe
  C:\Windows\System\JEiZqis.exe
  2⤵
  PID:5772
- C:\Windows\System\xjLBQNh.exe
  C:\Windows\System\xjLBQNh.exe
  2⤵
  PID:5836
- C:\Windows\System\dLMzCdU.exe
  C:\Windows\System\dLMzCdU.exe
  2⤵
  PID:5892
- C:\Windows\System\vpLpVkT.exe
  C:\Windows\System\vpLpVkT.exe
  2⤵
  PID:5976
- C:\Windows\System\QMSemmP.exe
  C:\Windows\System\QMSemmP.exe
  2⤵
  PID:6028
- C:\Windows\System\IdOkMFG.exe
  C:\Windows\System\IdOkMFG.exe
  2⤵
  PID:6064
- C:\Windows\System\nLvIGBb.exe
  C:\Windows\System\nLvIGBb.exe
  2⤵
  PID:384
- C:\Windows\System\JVzIGah.exe
  C:\Windows\System\JVzIGah.exe
  2⤵
  PID:2696
- C:\Windows\System\VfjCPSN.exe
  C:\Windows\System\VfjCPSN.exe
  2⤵
  PID:1640
- C:\Windows\System\cHLzoly.exe
  C:\Windows\System\cHLzoly.exe
  2⤵
  PID:5240
- C:\Windows\System\FljmyJX.exe
  C:\Windows\System\FljmyJX.exe
  2⤵
  PID:5380
- C:\Windows\System\IQooCqV.exe
  C:\Windows\System\IQooCqV.exe
  2⤵
  PID:5520
- C:\Windows\System\qWCxSuf.exe
  C:\Windows\System\qWCxSuf.exe
  2⤵
  PID:5664
- C:\Windows\System\qgYfFZA.exe
  C:\Windows\System\qgYfFZA.exe
  2⤵
  PID:6164
- C:\Windows\System\bvrPxDC.exe
  C:\Windows\System\bvrPxDC.exe
  2⤵
  PID:6192
- C:\Windows\System\yqisIhd.exe
  C:\Windows\System\yqisIhd.exe
  2⤵
  PID:6220
- C:\Windows\System\bOCyXbN.exe
  C:\Windows\System\bOCyXbN.exe
  2⤵
  PID:6248
- C:\Windows\System\tMHjybi.exe
  C:\Windows\System\tMHjybi.exe
  2⤵
  PID:6276
- C:\Windows\System\ZjfyhBW.exe
  C:\Windows\System\ZjfyhBW.exe
  2⤵
  PID:6304
- C:\Windows\System\PwfPMoa.exe
  C:\Windows\System\PwfPMoa.exe
  2⤵
  PID:6332
- C:\Windows\System\tckSkQK.exe
  C:\Windows\System\tckSkQK.exe
  2⤵
  PID:6360
- C:\Windows\System\wVqUhRa.exe
  C:\Windows\System\wVqUhRa.exe
  2⤵
  PID:6388
- C:\Windows\System\VCWlkAB.exe
  C:\Windows\System\VCWlkAB.exe
  2⤵
  PID:6420
- C:\Windows\System\tPOIImd.exe
  C:\Windows\System\tPOIImd.exe
  2⤵
  PID:6456
- C:\Windows\System\TBBQZpH.exe
  C:\Windows\System\TBBQZpH.exe
  2⤵
  PID:6484
- C:\Windows\System\FCmIkwT.exe
  C:\Windows\System\FCmIkwT.exe
  2⤵
  PID:6500
- C:\Windows\System\ehZsOAM.exe
  C:\Windows\System\ehZsOAM.exe
  2⤵
  PID:6528
- C:\Windows\System\CTJUWax.exe
  C:\Windows\System\CTJUWax.exe
  2⤵
  PID:6556
- C:\Windows\System\qTJOOmd.exe
  C:\Windows\System\qTJOOmd.exe
  2⤵
  PID:6584
- C:\Windows\System\TegLKbv.exe
  C:\Windows\System\TegLKbv.exe
  2⤵
  PID:6612
- C:\Windows\System\zpvKzKo.exe
  C:\Windows\System\zpvKzKo.exe
  2⤵
  PID:6640
- C:\Windows\System\gUWwucT.exe
  C:\Windows\System\gUWwucT.exe
  2⤵
  PID:6668
- C:\Windows\System\mUQsjeU.exe
  C:\Windows\System\mUQsjeU.exe
  2⤵
  PID:6696
- C:\Windows\System\wxHUiur.exe
  C:\Windows\System\wxHUiur.exe
  2⤵
  PID:6724
- C:\Windows\System\mIDgGwZ.exe
  C:\Windows\System\mIDgGwZ.exe
  2⤵
  PID:6752
- C:\Windows\System\TfCesjd.exe
  C:\Windows\System\TfCesjd.exe
  2⤵
  PID:6780
- C:\Windows\System\JfhCoey.exe
  C:\Windows\System\JfhCoey.exe
  2⤵
  PID:6808
- C:\Windows\System\kAwenWZ.exe
  C:\Windows\System\kAwenWZ.exe
  2⤵
  PID:6832
- C:\Windows\System\GgVzOzZ.exe
  C:\Windows\System\GgVzOzZ.exe
  2⤵
  PID:6864
- C:\Windows\System\fzvyvqP.exe
  C:\Windows\System\fzvyvqP.exe
  2⤵
  PID:6892
- C:\Windows\System\OErILcC.exe
  C:\Windows\System\OErILcC.exe
  2⤵
  PID:6920
- C:\Windows\System\FjXTnep.exe
  C:\Windows\System\FjXTnep.exe
  2⤵
  PID:6948
- C:\Windows\System\qrKnWss.exe
  C:\Windows\System\qrKnWss.exe
  2⤵
  PID:6976
- C:\Windows\System\gRjMmTT.exe
  C:\Windows\System\gRjMmTT.exe
  2⤵
  PID:7004
- C:\Windows\System\GqtETzn.exe
  C:\Windows\System\GqtETzn.exe
  2⤵
  PID:7032
- C:\Windows\System\hAXweAP.exe
  C:\Windows\System\hAXweAP.exe
  2⤵
  PID:7060
- C:\Windows\System\dugnLIj.exe
  C:\Windows\System\dugnLIj.exe
  2⤵
  PID:7088
- C:\Windows\System\LvsXlmG.exe
  C:\Windows\System\LvsXlmG.exe
  2⤵
  PID:7116
- C:\Windows\System\cvGBBSd.exe
  C:\Windows\System\cvGBBSd.exe
  2⤵
  PID:7144
- C:\Windows\System\ftAmGUE.exe
  C:\Windows\System\ftAmGUE.exe
  2⤵
  PID:5724
- C:\Windows\System\MQYgubj.exe
  C:\Windows\System\MQYgubj.exe
  2⤵
  PID:5868
- C:\Windows\System\bNDCzNA.exe
  C:\Windows\System\bNDCzNA.exe
  2⤵
  PID:6024
- C:\Windows\System\mlQGKae.exe
  C:\Windows\System\mlQGKae.exe
  2⤵
  PID:2920
- C:\Windows\System\Uhfvtvt.exe
  C:\Windows\System\Uhfvtvt.exe
  2⤵
  PID:5128
- C:\Windows\System\xGLZqxh.exe
  C:\Windows\System\xGLZqxh.exe
  2⤵
  PID:5444
- C:\Windows\System\UivXjBu.exe
  C:\Windows\System\UivXjBu.exe
  2⤵
  PID:6152
- C:\Windows\System\foxjnAv.exe
  C:\Windows\System\foxjnAv.exe
  2⤵
  PID:6208
- C:\Windows\System\ClqwHDw.exe
  C:\Windows\System\ClqwHDw.exe
  2⤵
  PID:6264
- C:\Windows\System\riaNZme.exe
  C:\Windows\System\riaNZme.exe
  2⤵
  PID:6324
- C:\Windows\System\eTWFywI.exe
  C:\Windows\System\eTWFywI.exe
  2⤵
  PID:6400
- C:\Windows\System\TgpPogP.exe
  C:\Windows\System\TgpPogP.exe
  2⤵
  PID:6468
- C:\Windows\System\QOashFL.exe
  C:\Windows\System\QOashFL.exe
  2⤵
  PID:6520
- C:\Windows\System\XUcuefJ.exe
  C:\Windows\System\XUcuefJ.exe
  2⤵
  PID:6576
- C:\Windows\System\GmdKomn.exe
  C:\Windows\System\GmdKomn.exe
  2⤵
  PID:6628
- C:\Windows\System\AniLSfN.exe
  C:\Windows\System\AniLSfN.exe
  2⤵
  PID:6688
- C:\Windows\System\ZJLYJSC.exe
  C:\Windows\System\ZJLYJSC.exe
  2⤵
  PID:6744
- C:\Windows\System\CYkFEff.exe
  C:\Windows\System\CYkFEff.exe
  2⤵
  PID:6820
- C:\Windows\System\JRlZshl.exe
  C:\Windows\System\JRlZshl.exe
  2⤵
  PID:6880
- C:\Windows\System\LAmTnfK.exe
  C:\Windows\System\LAmTnfK.exe
  2⤵
  PID:6932
- C:\Windows\System\KgYDNxh.exe
  C:\Windows\System\KgYDNxh.exe
  2⤵
  PID:6992
- C:\Windows\System\kSBcppm.exe
  C:\Windows\System\kSBcppm.exe
  2⤵
  PID:2792
- C:\Windows\System\upIBrui.exe
  C:\Windows\System\upIBrui.exe
  2⤵
  PID:6548
- C:\Windows\System\lxoIcZB.exe
  C:\Windows\System\lxoIcZB.exe
  2⤵
  PID:912
- C:\Windows\System\PZgIsQl.exe
  C:\Windows\System\PZgIsQl.exe
  2⤵
  PID:3196
- C:\Windows\System\EngEXPO.exe
  C:\Windows\System\EngEXPO.exe
  2⤵
  PID:2808
- C:\Windows\System\PCKtaOp.exe
  C:\Windows\System\PCKtaOp.exe
  2⤵
  PID:2940
- C:\Windows\System\ppXgrmB.exe
  C:\Windows\System\ppXgrmB.exe
  2⤵
  PID:2364
- C:\Windows\System\cRidCPZ.exe
  C:\Windows\System\cRidCPZ.exe
  2⤵
  PID:5012
- C:\Windows\System\NkKquMF.exe
  C:\Windows\System\NkKquMF.exe
  2⤵
  PID:2744
- C:\Windows\System\lVmSHXv.exe
  C:\Windows\System\lVmSHXv.exe
  2⤵
  PID:1028
- C:\Windows\System\PtbmRRP.exe
  C:\Windows\System\PtbmRRP.exe
  2⤵
  PID:2324
- C:\Windows\System\UgIDioN.exe
  C:\Windows\System\UgIDioN.exe
  2⤵
  PID:808
- C:\Windows\System\naIJUPH.exe
  C:\Windows\System\naIJUPH.exe
  2⤵
  PID:1408
- C:\Windows\System\OnFJlyU.exe
  C:\Windows\System\OnFJlyU.exe
  2⤵
  PID:1204
- C:\Windows\System\HDWEpfz.exe
  C:\Windows\System\HDWEpfz.exe
  2⤵
  PID:5036
- C:\Windows\System\hxXTuZw.exe
  C:\Windows\System\hxXTuZw.exe
  2⤵
  PID:6964
- C:\Windows\System\LVorZmt.exe
  C:\Windows\System\LVorZmt.exe
  2⤵
  PID:1516
- C:\Windows\System\PcnUTan.exe
  C:\Windows\System\PcnUTan.exe
  2⤵
  PID:2016
- C:\Windows\System\xAgpEjl.exe
  C:\Windows\System\xAgpEjl.exe
  2⤵
  PID:6380
- C:\Windows\System\QfZXTtx.exe
  C:\Windows\System\QfZXTtx.exe
  2⤵
  PID:3828
- C:\Windows\System\iDRULZy.exe
  C:\Windows\System\iDRULZy.exe
  2⤵
  PID:6240
- C:\Windows\System\EACZuRI.exe
  C:\Windows\System\EACZuRI.exe
  2⤵
  PID:5812
- C:\Windows\System\FmisIJL.exe
  C:\Windows\System\FmisIJL.exe
  2⤵
  PID:5304
- C:\Windows\System\aCNbVVY.exe
  C:\Windows\System\aCNbVVY.exe
  2⤵
  PID:6132
- C:\Windows\System\SNaaZpq.exe
  C:\Windows\System\SNaaZpq.exe
  2⤵
  PID:2576
- C:\Windows\System\XECBJxZ.exe
  C:\Windows\System\XECBJxZ.exe
  2⤵
  PID:7136
- C:\Windows\System\apswlRa.exe
  C:\Windows\System\apswlRa.exe
  2⤵
  PID:7080
- C:\Windows\System\HSsiiNh.exe
  C:\Windows\System\HSsiiNh.exe
  2⤵
  PID:4708
- C:\Windows\System\TTOUpsU.exe
  C:\Windows\System\TTOUpsU.exe
  2⤵
  PID:528
- C:\Windows\System\lLJbbht.exe
  C:\Windows\System\lLJbbht.exe
  2⤵
  PID:2644
- C:\Windows\System\EDXghxH.exe
  C:\Windows\System\EDXghxH.exe
  2⤵
  PID:4984
- C:\Windows\System\TdxDWQX.exe
  C:\Windows\System\TdxDWQX.exe
  2⤵
  PID:1756
- C:\Windows\System\whuFPFQ.exe
  C:\Windows\System\whuFPFQ.exe
  2⤵
  PID:2692
- C:\Windows\System\EsCHlkj.exe
  C:\Windows\System\EsCHlkj.exe
  2⤵
  PID:7104
- C:\Windows\System\hWmKXrg.exe
  C:\Windows\System\hWmKXrg.exe
  2⤵
  PID:6352
- C:\Windows\System\khauIfM.exe
  C:\Windows\System\khauIfM.exe
  2⤵
  PID:1076
- C:\Windows\System\LAHcllI.exe
  C:\Windows\System\LAHcllI.exe
  2⤵
  PID:6440
- C:\Windows\System\TNxfYJM.exe
  C:\Windows\System\TNxfYJM.exe
  2⤵
  PID:4196
- C:\Windows\System\PcgiXSa.exe
  C:\Windows\System\PcgiXSa.exe
  2⤵
  PID:4124
- C:\Windows\System\qJCmnCK.exe
  C:\Windows\System\qJCmnCK.exe
  2⤵
  PID:6968
- C:\Windows\System\LPVzYSo.exe
  C:\Windows\System\LPVzYSo.exe
  2⤵
  PID:5996
- C:\Windows\System\fJxpXQd.exe
  C:\Windows\System\fJxpXQd.exe
  2⤵
  PID:2728
- C:\Windows\System\xcyztcT.exe
  C:\Windows\System\xcyztcT.exe
  2⤵
  PID:7100
- C:\Windows\System\rzCVVZQ.exe
  C:\Windows\System\rzCVVZQ.exe
  2⤵
  PID:7184
- C:\Windows\System\aobEfeG.exe
  C:\Windows\System\aobEfeG.exe
  2⤵
  PID:7224
- C:\Windows\System\FvKorkQ.exe
  C:\Windows\System\FvKorkQ.exe
  2⤵
  PID:7240
- C:\Windows\System\gZgRQrD.exe
  C:\Windows\System\gZgRQrD.exe
  2⤵
  PID:7260
- C:\Windows\System\GLSoUxr.exe
  C:\Windows\System\GLSoUxr.exe
  2⤵
  PID:7280
- C:\Windows\System\wSoVMdJ.exe
  C:\Windows\System\wSoVMdJ.exe
  2⤵
  PID:7336
- C:\Windows\System\qXvbmGH.exe
  C:\Windows\System\qXvbmGH.exe
  2⤵
  PID:7352
- C:\Windows\System\vGdAGaC.exe
  C:\Windows\System\vGdAGaC.exe
  2⤵
  PID:7380
- C:\Windows\System\wyPYoaa.exe
  C:\Windows\System\wyPYoaa.exe
  2⤵
  PID:7420
- C:\Windows\System\YnuBVVN.exe
  C:\Windows\System\YnuBVVN.exe
  2⤵
  PID:7436
- C:\Windows\System\VNrYcqL.exe
  C:\Windows\System\VNrYcqL.exe
  2⤵
  PID:7456
- C:\Windows\System\ESbsFaT.exe
  C:\Windows\System\ESbsFaT.exe
  2⤵
  PID:7484
- C:\Windows\System\xCtozoa.exe
  C:\Windows\System\xCtozoa.exe
  2⤵
  PID:7508
- C:\Windows\System\UcMrAbe.exe
  C:\Windows\System\UcMrAbe.exe
  2⤵
  PID:7544
- C:\Windows\System\zoJxiie.exe
  C:\Windows\System\zoJxiie.exe
  2⤵
  PID:7588
- C:\Windows\System\VFKexQr.exe
  C:\Windows\System\VFKexQr.exe
  2⤵
  PID:7616
- C:\Windows\System\FAIpghF.exe
  C:\Windows\System\FAIpghF.exe
  2⤵
  PID:7644
- C:\Windows\System\yEdCsNG.exe
  C:\Windows\System\yEdCsNG.exe
  2⤵
  PID:7672
- C:\Windows\System\xoyqzbH.exe
  C:\Windows\System\xoyqzbH.exe
  2⤵
  PID:7688
- C:\Windows\System\ugGNmwT.exe
  C:\Windows\System\ugGNmwT.exe
  2⤵
  PID:7716
- C:\Windows\System\tGYWqWc.exe
  C:\Windows\System\tGYWqWc.exe
  2⤵
  PID:7756
- C:\Windows\System\aMBsbGF.exe
  C:\Windows\System\aMBsbGF.exe
  2⤵
  PID:7772
- C:\Windows\System\vuOrNGp.exe
  C:\Windows\System\vuOrNGp.exe
  2⤵
  PID:7800
- C:\Windows\System\mSQOpEh.exe
  C:\Windows\System\mSQOpEh.exe
  2⤵
  PID:7828
- C:\Windows\System\ywxwmzr.exe
  C:\Windows\System\ywxwmzr.exe
  2⤵
  PID:7868
- C:\Windows\System\nmyoaPm.exe
  C:\Windows\System\nmyoaPm.exe
  2⤵
  PID:7884
- C:\Windows\System\UzjFWyy.exe
  C:\Windows\System\UzjFWyy.exe
  2⤵
  PID:7912
- C:\Windows\System\ANeVnNC.exe
  C:\Windows\System\ANeVnNC.exe
  2⤵
  PID:7932
- C:\Windows\System\Emysgpi.exe
  C:\Windows\System\Emysgpi.exe
  2⤵
  PID:7964
- C:\Windows\System\ZNUtHiI.exe
  C:\Windows\System\ZNUtHiI.exe
  2⤵
  PID:7984
- C:\Windows\System\XCbvUUE.exe
  C:\Windows\System\XCbvUUE.exe
  2⤵
  PID:8008
- C:\Windows\System\RnjjjxZ.exe
  C:\Windows\System\RnjjjxZ.exe
  2⤵
  PID:8064
- C:\Windows\System\mmCEzsK.exe
  C:\Windows\System\mmCEzsK.exe
  2⤵
  PID:8092
- C:\Windows\System\cXNlxMJ.exe
  C:\Windows\System\cXNlxMJ.exe
  2⤵
  PID:8108
- C:\Windows\System\XAajhmT.exe
  C:\Windows\System\XAajhmT.exe
  2⤵
  PID:8148
- C:\Windows\System\hnFRjJe.exe
  C:\Windows\System\hnFRjJe.exe
  2⤵
  PID:8176
- C:\Windows\System\rdtKzei.exe
  C:\Windows\System\rdtKzei.exe
  2⤵
  PID:7016
- C:\Windows\System\yjZpBSJ.exe
  C:\Windows\System\yjZpBSJ.exe
  2⤵
  PID:7172
- C:\Windows\System\VHBmrZL.exe
  C:\Windows\System\VHBmrZL.exe
  2⤵
  PID:7316
- C:\Windows\System\FupSUBP.exe
  C:\Windows\System\FupSUBP.exe
  2⤵
  PID:7328
- C:\Windows\System\FVUsIRe.exe
  C:\Windows\System\FVUsIRe.exe
  2⤵
  PID:7364
- C:\Windows\System\tyFPKMD.exe
  C:\Windows\System\tyFPKMD.exe
  2⤵
  PID:3224
- C:\Windows\System\ITNyFyg.exe
  C:\Windows\System\ITNyFyg.exe
  2⤵
  PID:7480
- C:\Windows\System\ImEDTLI.exe
  C:\Windows\System\ImEDTLI.exe
  2⤵
  PID:7528
- C:\Windows\System\eZBTEJp.exe
  C:\Windows\System\eZBTEJp.exe
  2⤵
  PID:7608
- C:\Windows\System\GQUfSly.exe
  C:\Windows\System\GQUfSly.exe
  2⤵
  PID:7660
- C:\Windows\System\VQSceVi.exe
  C:\Windows\System\VQSceVi.exe
  2⤵
  PID:7740
- C:\Windows\System\ktnguhU.exe
  C:\Windows\System\ktnguhU.exe
  2⤵
  PID:7816
- C:\Windows\System\pfNCXce.exe
  C:\Windows\System\pfNCXce.exe
  2⤵
  PID:7860
- C:\Windows\System\bDiOazp.exe
  C:\Windows\System\bDiOazp.exe
  2⤵
  PID:7948
- C:\Windows\System\kZQAuMO.exe
  C:\Windows\System\kZQAuMO.exe
  2⤵
  PID:7996
- C:\Windows\System\WUaXlbo.exe
  C:\Windows\System\WUaXlbo.exe
  2⤵
  PID:8084
- C:\Windows\System\voJwtLP.exe
  C:\Windows\System\voJwtLP.exe
  2⤵
  PID:8120
- C:\Windows\System\rNNTHtg.exe
  C:\Windows\System\rNNTHtg.exe
  2⤵
  PID:1384
- C:\Windows\System\kqGnwlh.exe
  C:\Windows\System\kqGnwlh.exe
  2⤵
  PID:7252
- C:\Windows\System\leiQkAW.exe
  C:\Windows\System\leiQkAW.exe
  2⤵
  PID:7444
- C:\Windows\System\iNtfXrp.exe
  C:\Windows\System\iNtfXrp.exe
  2⤵
  PID:7568
- C:\Windows\System\QBtvPxm.exe
  C:\Windows\System\QBtvPxm.exe
  2⤵
  PID:7744
- C:\Windows\System\RkBtBkd.exe
  C:\Windows\System\RkBtBkd.exe
  2⤵
  PID:7896
- C:\Windows\System\EyGSJFp.exe
  C:\Windows\System\EyGSJFp.exe
  2⤵
  PID:8024
- C:\Windows\System\RdQtppC.exe
  C:\Windows\System\RdQtppC.exe
  2⤵
  PID:8172
- C:\Windows\System\RScuwFB.exe
  C:\Windows\System\RScuwFB.exe
  2⤵
  PID:7376
- C:\Windows\System\IwOkeFM.exe
  C:\Windows\System\IwOkeFM.exe
  2⤵
  PID:7636
- C:\Windows\System\oYyZMSm.exe
  C:\Windows\System\oYyZMSm.exe
  2⤵
  PID:7864
- C:\Windows\System\HTEVJxz.exe
  C:\Windows\System\HTEVJxz.exe
  2⤵
  PID:7768
- C:\Windows\System\zRbRYps.exe
  C:\Windows\System\zRbRYps.exe
  2⤵
  PID:8224
- C:\Windows\System\kMwmbgt.exe
  C:\Windows\System\kMwmbgt.exe
  2⤵
  PID:8252
- C:\Windows\System\xFlWaHy.exe
  C:\Windows\System\xFlWaHy.exe
  2⤵
  PID:8280
- C:\Windows\System\doMhulV.exe
  C:\Windows\System\doMhulV.exe
  2⤵
  PID:8300
- C:\Windows\System\VKEFOzK.exe
  C:\Windows\System\VKEFOzK.exe
  2⤵
  PID:8336
- C:\Windows\System\bjPOTfW.exe
  C:\Windows\System\bjPOTfW.exe
  2⤵
  PID:8364
- C:\Windows\System\GTIhZdv.exe
  C:\Windows\System\GTIhZdv.exe
  2⤵
  PID:8392
- C:\Windows\System\KxYfZra.exe
  C:\Windows\System\KxYfZra.exe
  2⤵
  PID:8420
- C:\Windows\System\VBvGPIX.exe
  C:\Windows\System\VBvGPIX.exe
  2⤵
  PID:8448
- C:\Windows\System\aeyuFdD.exe
  C:\Windows\System\aeyuFdD.exe
  2⤵
  PID:8476
- C:\Windows\System\JplSPcp.exe
  C:\Windows\System\JplSPcp.exe
  2⤵
  PID:8504
- C:\Windows\System\stWMyxq.exe
  C:\Windows\System\stWMyxq.exe
  2⤵
  PID:8532
- C:\Windows\System\wWGzxjM.exe
  C:\Windows\System\wWGzxjM.exe
  2⤵
  PID:8572
- C:\Windows\System\bPxHeGs.exe
  C:\Windows\System\bPxHeGs.exe
  2⤵
  PID:8600
- C:\Windows\System\THscgLd.exe
  C:\Windows\System\THscgLd.exe
  2⤵
  PID:8624
- C:\Windows\System\tcekwTo.exe
  C:\Windows\System\tcekwTo.exe
  2⤵
  PID:8644
- C:\Windows\System\OUPFxZS.exe
  C:\Windows\System\OUPFxZS.exe
  2⤵
  PID:8672
- C:\Windows\System\bCaXKjy.exe
  C:\Windows\System\bCaXKjy.exe
  2⤵
  PID:8700
- C:\Windows\System\ICoCqse.exe
  C:\Windows\System\ICoCqse.exe
  2⤵
  PID:8724
- C:\Windows\System\mbbtaso.exe
  C:\Windows\System\mbbtaso.exe
  2⤵
  PID:8748
- C:\Windows\System\OOMQJUF.exe
  C:\Windows\System\OOMQJUF.exe
  2⤵
  PID:8796
- C:\Windows\System\LkkPawn.exe
  C:\Windows\System\LkkPawn.exe
  2⤵
  PID:8824
- C:\Windows\System\hKOocBR.exe
  C:\Windows\System\hKOocBR.exe
  2⤵
  PID:8840
- C:\Windows\System\dIvaBQA.exe
  C:\Windows\System\dIvaBQA.exe
  2⤵
  PID:8864
- C:\Windows\System\OWYiSfy.exe
  C:\Windows\System\OWYiSfy.exe
  2⤵
  PID:8896
- C:\Windows\System\CgHetrw.exe
  C:\Windows\System\CgHetrw.exe
  2⤵
  PID:8924
- C:\Windows\System\SqBQPzy.exe
  C:\Windows\System\SqBQPzy.exe
  2⤵
  PID:8952
- C:\Windows\System\lplKltY.exe
  C:\Windows\System\lplKltY.exe
  2⤵
  PID:8988
- C:\Windows\System\TogFbeE.exe
  C:\Windows\System\TogFbeE.exe
  2⤵
  PID:9012
- C:\Windows\System\NHxpKdg.exe
  C:\Windows\System\NHxpKdg.exe
  2⤵
  PID:9036
- C:\Windows\System\hZuHcqB.exe
  C:\Windows\System\hZuHcqB.exe
  2⤵
  PID:9052
- C:\Windows\System\nQxYenW.exe
  C:\Windows\System\nQxYenW.exe
  2⤵
  PID:9084
- C:\Windows\System\VQjYEBL.exe
  C:\Windows\System\VQjYEBL.exe
  2⤵
  PID:9112
- C:\Windows\System\dhlZMSq.exe
  C:\Windows\System\dhlZMSq.exe
  2⤵
  PID:9144
- C:\Windows\System\CsMrvjh.exe
  C:\Windows\System\CsMrvjh.exe
  2⤵
  PID:9188
- C:\Windows\System\srHtXhF.exe
  C:\Windows\System\srHtXhF.exe
  2⤵
  PID:9204
- C:\Windows\System\fYAHVyL.exe
  C:\Windows\System\fYAHVyL.exe
  2⤵
  PID:8196
- C:\Windows\System\qvQNEMK.exe
  C:\Windows\System\qvQNEMK.exe
  2⤵
  PID:8308
- C:\Windows\System\iHtgGBi.exe
  C:\Windows\System\iHtgGBi.exe
  2⤵
  PID:8320
- C:\Windows\System\DcMUnQd.exe
  C:\Windows\System\DcMUnQd.exe
  2⤵
  PID:8380
- C:\Windows\System\EXPPjKe.exe
  C:\Windows\System\EXPPjKe.exe
  2⤵
  PID:8464
- C:\Windows\System\GVoipIN.exe
  C:\Windows\System\GVoipIN.exe
  2⤵
  PID:8516
- C:\Windows\System\qwSpgkf.exe
  C:\Windows\System\qwSpgkf.exe
  2⤵
  PID:8596
- C:\Windows\System\LAvKazM.exe
  C:\Windows\System\LAvKazM.exe
  2⤵
  PID:8684
- C:\Windows\System\teIXcpq.exe
  C:\Windows\System\teIXcpq.exe
  2⤵
  PID:8736
- C:\Windows\System\HGvwJth.exe
  C:\Windows\System\HGvwJth.exe
  2⤵
  PID:8812
- C:\Windows\System\TgENfeW.exe
  C:\Windows\System\TgENfeW.exe
  2⤵
  PID:8856
- C:\Windows\System\WSvIKqq.exe
  C:\Windows\System\WSvIKqq.exe
  2⤵
  PID:8944
- C:\Windows\System\rXKGgdp.exe
  C:\Windows\System\rXKGgdp.exe
  2⤵
  PID:9028
- C:\Windows\System\oXgpMEA.exe
  C:\Windows\System\oXgpMEA.exe
  2⤵
  PID:9076
- C:\Windows\System\kauNOtj.exe
  C:\Windows\System\kauNOtj.exe
  2⤵
  PID:9176
- C:\Windows\System\MyXRrUv.exe
  C:\Windows\System\MyXRrUv.exe
  2⤵
  PID:8208
- C:\Windows\System\HLflrGU.exe
  C:\Windows\System\HLflrGU.exe
  2⤵
  PID:8264
- C:\Windows\System\EJzABFP.exe
  C:\Windows\System\EJzABFP.exe
  2⤵
  PID:8356
- C:\Windows\System\ySaybBR.exe
  C:\Windows\System\ySaybBR.exe
  2⤵
  PID:8496
- C:\Windows\System\BlpWzGJ.exe
  C:\Windows\System\BlpWzGJ.exe
  2⤵
  PID:8664
- C:\Windows\System\JcXQmUj.exe
  C:\Windows\System\JcXQmUj.exe
  2⤵
  PID:8808
- C:\Windows\System\sHocyUe.exe
  C:\Windows\System\sHocyUe.exe
  2⤵
  PID:8972
- C:\Windows\System\MKGgFLC.exe
  C:\Windows\System\MKGgFLC.exe
  2⤵
  PID:9128
- C:\Windows\System\VMkUiay.exe
  C:\Windows\System\VMkUiay.exe
  2⤵
  PID:8328
- C:\Windows\System\WVWFsJL.exe
  C:\Windows\System\WVWFsJL.exe
  2⤵
  PID:8564
- C:\Windows\System\nbYNoZR.exe
  C:\Windows\System\nbYNoZR.exe
  2⤵
  PID:8716
- C:\Windows\System\ViUobyK.exe
  C:\Windows\System\ViUobyK.exe
  2⤵
  PID:8432
- C:\Windows\System\zADMCXM.exe
  C:\Windows\System\zADMCXM.exe
  2⤵
  PID:9236
- C:\Windows\System\MrvFkvJ.exe
  C:\Windows\System\MrvFkvJ.exe
  2⤵
  PID:9264
- C:\Windows\System\dcUUSxi.exe
  C:\Windows\System\dcUUSxi.exe
  2⤵
  PID:9292
- C:\Windows\System\mrPuTiP.exe
  C:\Windows\System\mrPuTiP.exe
  2⤵
  PID:9308
- C:\Windows\System\mhBCFGs.exe
  C:\Windows\System\mhBCFGs.exe
  2⤵
  PID:9340
- C:\Windows\System\ywTSoyT.exe
  C:\Windows\System\ywTSoyT.exe
  2⤵
  PID:9364
- C:\Windows\System\wbIPqvw.exe
  C:\Windows\System\wbIPqvw.exe
  2⤵
  PID:9396
- C:\Windows\System\KMdqMiI.exe
  C:\Windows\System\KMdqMiI.exe
  2⤵
  PID:9416
- C:\Windows\System\bsrkpss.exe
  C:\Windows\System\bsrkpss.exe
  2⤵
  PID:9436
- C:\Windows\System\twRGGaP.exe
  C:\Windows\System\twRGGaP.exe
  2⤵
  PID:9476
- C:\Windows\System\YCLRrZY.exe
  C:\Windows\System\YCLRrZY.exe
  2⤵
  PID:9508
- C:\Windows\System\JdTPPEG.exe
  C:\Windows\System\JdTPPEG.exe
  2⤵
  PID:9540
- C:\Windows\System\gqmXwPS.exe
  C:\Windows\System\gqmXwPS.exe
  2⤵
  PID:9572
- C:\Windows\System\ZIkLegq.exe
  C:\Windows\System\ZIkLegq.exe
  2⤵
  PID:9596
- C:\Windows\System\vTSbLJh.exe
  C:\Windows\System\vTSbLJh.exe
  2⤵
  PID:9628
- C:\Windows\System\TPoPvnU.exe
  C:\Windows\System\TPoPvnU.exe
  2⤵
  PID:9652
- C:\Windows\System\NpYdWxE.exe
  C:\Windows\System\NpYdWxE.exe
  2⤵
  PID:9668
- C:\Windows\System\ehGzQZC.exe
  C:\Windows\System\ehGzQZC.exe
  2⤵
  PID:9712
- C:\Windows\System\brMoIYS.exe
  C:\Windows\System\brMoIYS.exe
  2⤵
  PID:9752
- C:\Windows\System\GJKxQyF.exe
  C:\Windows\System\GJKxQyF.exe
  2⤵
  PID:9780
- C:\Windows\System\hbMEmvU.exe
  C:\Windows\System\hbMEmvU.exe
  2⤵
  PID:9796
- C:\Windows\System\rChpvLO.exe
  C:\Windows\System\rChpvLO.exe
  2⤵
  PID:9812
- C:\Windows\System\vMHCIik.exe
  C:\Windows\System\vMHCIik.exe
  2⤵
  PID:9864
- C:\Windows\System\JaSKcXW.exe
  C:\Windows\System\JaSKcXW.exe
  2⤵
  PID:9880
- C:\Windows\System\DlpbutU.exe
  C:\Windows\System\DlpbutU.exe
  2⤵
  PID:9908
- C:\Windows\System\FbziYuk.exe
  C:\Windows\System\FbziYuk.exe
  2⤵
  PID:9936
- C:\Windows\System\SIBLUOe.exe
  C:\Windows\System\SIBLUOe.exe
  2⤵
  PID:9964
- C:\Windows\System\ABlmONw.exe
  C:\Windows\System\ABlmONw.exe
  2⤵
  PID:9992
- C:\Windows\System\YgCZCOH.exe
  C:\Windows\System\YgCZCOH.exe
  2⤵
  PID:10020
- C:\Windows\System\qbHoDvk.exe
  C:\Windows\System\qbHoDvk.exe
  2⤵
  PID:10036
- C:\Windows\System\vdblGpC.exe
  C:\Windows\System\vdblGpC.exe
  2⤵
  PID:10052
- C:\Windows\System\qRDspYd.exe
  C:\Windows\System\qRDspYd.exe
  2⤵
  PID:10068
- C:\Windows\System\BPgNKRY.exe
  C:\Windows\System\BPgNKRY.exe
  2⤵
  PID:10100
- C:\Windows\System\WPqZUoH.exe
  C:\Windows\System\WPqZUoH.exe
  2⤵
  PID:10132
- C:\Windows\System\JhmrLwS.exe
  C:\Windows\System\JhmrLwS.exe
  2⤵
  PID:10152
- C:\Windows\System\zmIzALR.exe
  C:\Windows\System\zmIzALR.exe
  2⤵
  PID:10176
- C:\Windows\System\KxvIXIg.exe
  C:\Windows\System\KxvIXIg.exe
  2⤵
  PID:10208
- C:\Windows\System\OgCtpIY.exe
  C:\Windows\System\OgCtpIY.exe
  2⤵
  PID:9008
- C:\Windows\System\rDzjEVn.exe
  C:\Windows\System\rDzjEVn.exe
  2⤵
  PID:9252
- C:\Windows\System\pHrlVCV.exe
  C:\Windows\System\pHrlVCV.exe
  2⤵
  PID:9280
- C:\Windows\System\sVtaDHz.exe
  C:\Windows\System\sVtaDHz.exe
  2⤵
  PID:9300
- C:\Windows\System\mINGpww.exe
  C:\Windows\System\mINGpww.exe
  2⤵
  PID:9456
- C:\Windows\System\pHlbLui.exe
  C:\Windows\System\pHlbLui.exe
  2⤵
  PID:9584
- C:\Windows\System\wONxnsl.exe
  C:\Windows\System\wONxnsl.exe
  2⤵
  PID:9620
- C:\Windows\System\TVRGIle.exe
  C:\Windows\System\TVRGIle.exe
  2⤵
  PID:9724
- C:\Windows\System\ogeEkrO.exe
  C:\Windows\System\ogeEkrO.exe
  2⤵
  PID:9788
- C:\Windows\System\pwMIVbr.exe
  C:\Windows\System\pwMIVbr.exe
  2⤵
  PID:9848
- C:\Windows\System\MWgaQle.exe
  C:\Windows\System\MWgaQle.exe
  2⤵
  PID:9920
- C:\Windows\System\ohdtDDE.exe
  C:\Windows\System\ohdtDDE.exe
  2⤵
  PID:9984
- C:\Windows\System\LVjgzqw.exe
  C:\Windows\System\LVjgzqw.exe
  2⤵
  PID:10048
- C:\Windows\System\vPwSKJZ.exe
  C:\Windows\System\vPwSKJZ.exe
  2⤵
  PID:10112
- C:\Windows\System\eueFtBQ.exe
  C:\Windows\System\eueFtBQ.exe
  2⤵
  PID:10192
- C:\Windows\System\oMYCZxT.exe
  C:\Windows\System\oMYCZxT.exe
  2⤵
  PID:10220
- C:\Windows\System\FBAvOUZ.exe
  C:\Windows\System\FBAvOUZ.exe
  2⤵
  PID:9304
- C:\Windows\System\MpQggkH.exe
  C:\Windows\System\MpQggkH.exe
  2⤵
  PID:9428
- C:\Windows\System\KNQIvjd.exe
  C:\Windows\System\KNQIvjd.exe
  2⤵
  PID:9688
- C:\Windows\System\DLqkAxg.exe
  C:\Windows\System\DLqkAxg.exe
  2⤵
  PID:9808
- C:\Windows\System\BsCYrvi.exe
  C:\Windows\System\BsCYrvi.exe
  2⤵
  PID:10008
- C:\Windows\System\NUGrrBN.exe
  C:\Windows\System\NUGrrBN.exe
  2⤵
  PID:10096
- C:\Windows\System\QbmRukl.exe
  C:\Windows\System\QbmRukl.exe
  2⤵
  PID:9260
- C:\Windows\System\DmTrmvr.exe
  C:\Windows\System\DmTrmvr.exe
  2⤵
  PID:9524
- C:\Windows\System\APyFwSO.exe
  C:\Windows\System\APyFwSO.exe
  2⤵
  PID:10032
- C:\Windows\System\forZWAs.exe
  C:\Windows\System\forZWAs.exe
  2⤵
  PID:10092
- C:\Windows\System\jMYTOGO.exe
  C:\Windows\System\jMYTOGO.exe
  2⤵
  PID:9560
- C:\Windows\System\OCTdhRY.exe
  C:\Windows\System\OCTdhRY.exe
  2⤵
  PID:10264
- C:\Windows\System\QeQzZgx.exe
  C:\Windows\System\QeQzZgx.exe
  2⤵
  PID:10288
- C:\Windows\System\EMnCNEw.exe
  C:\Windows\System\EMnCNEw.exe
  2⤵
  PID:10332
- C:\Windows\System\rtpXxYL.exe
  C:\Windows\System\rtpXxYL.exe
  2⤵
  PID:10348
- C:\Windows\System\VgZjmQk.exe
  C:\Windows\System\VgZjmQk.exe
  2⤵
  PID:10372
- C:\Windows\System\CWdSKqx.exe
  C:\Windows\System\CWdSKqx.exe
  2⤵
  PID:10396
- C:\Windows\System\xkJaiiN.exe
  C:\Windows\System\xkJaiiN.exe
  2⤵
  PID:10432
- C:\Windows\System\nfgwqnu.exe
  C:\Windows\System\nfgwqnu.exe
  2⤵
  PID:10460
- C:\Windows\System\QVGSiUG.exe
  C:\Windows\System\QVGSiUG.exe
  2⤵
  PID:10488
- C:\Windows\System\xMzYMsC.exe
  C:\Windows\System\xMzYMsC.exe
  2⤵
  PID:10516
- C:\Windows\System\cxbQjze.exe
  C:\Windows\System\cxbQjze.exe
  2⤵
  PID:10544
- C:\Windows\System\hWqmdUp.exe
  C:\Windows\System\hWqmdUp.exe
  2⤵
  PID:10572
- C:\Windows\System\HrYTZdL.exe
  C:\Windows\System\HrYTZdL.exe
  2⤵
  PID:10600
- C:\Windows\System\HBkIHrJ.exe
  C:\Windows\System\HBkIHrJ.exe
  2⤵
  PID:10628
- C:\Windows\System\qxQxbfQ.exe
  C:\Windows\System\qxQxbfQ.exe
  2⤵
  PID:10668
- C:\Windows\System\RPEpOsL.exe
  C:\Windows\System\RPEpOsL.exe
  2⤵
  PID:10684
- C:\Windows\System\kLCIyac.exe
  C:\Windows\System\kLCIyac.exe
  2⤵
  PID:10708
- C:\Windows\System\pARuFcQ.exe
  C:\Windows\System\pARuFcQ.exe
  2⤵
  PID:10740
- C:\Windows\System\QfJRWRK.exe
  C:\Windows\System\QfJRWRK.exe
  2⤵
  PID:10768
- C:\Windows\System\ERMOYQV.exe
  C:\Windows\System\ERMOYQV.exe
  2⤵
  PID:10796
- C:\Windows\System\hCMvqjB.exe
  C:\Windows\System\hCMvqjB.exe
  2⤵
  PID:10824
- C:\Windows\System\idNlMvv.exe
  C:\Windows\System\idNlMvv.exe
  2⤵
  PID:10852
- C:\Windows\System\DYvGnDb.exe
  C:\Windows\System\DYvGnDb.exe
  2⤵
  PID:10868
- C:\Windows\System\HYShvCE.exe
  C:\Windows\System\HYShvCE.exe
  2⤵
  PID:10896
- C:\Windows\System\hDIphBS.exe
  C:\Windows\System\hDIphBS.exe
  2⤵
  PID:10940
- C:\Windows\System\veiUXYB.exe
  C:\Windows\System\veiUXYB.exe
  2⤵
  PID:10964
- C:\Windows\System\UXKYrtc.exe
  C:\Windows\System\UXKYrtc.exe
  2⤵
  PID:11004
- C:\Windows\System\KUJRqdd.exe
  C:\Windows\System\KUJRqdd.exe
  2⤵
  PID:11032
- C:\Windows\System\ZyGMDYe.exe
  C:\Windows\System\ZyGMDYe.exe
  2⤵
  PID:11060
- C:\Windows\System\rolkXYd.exe
  C:\Windows\System\rolkXYd.exe
  2⤵
  PID:11088
- C:\Windows\System\MhWAwIb.exe
  C:\Windows\System\MhWAwIb.exe
  2⤵
  PID:11104
- C:\Windows\System\xlLIxMC.exe
  C:\Windows\System\xlLIxMC.exe
  2⤵
  PID:11132
- C:\Windows\System\CEEFIDx.exe
  C:\Windows\System\CEEFIDx.exe
  2⤵
  PID:11160
- C:\Windows\System\GiVbKHy.exe
  C:\Windows\System\GiVbKHy.exe
  2⤵
  PID:11200
- C:\Windows\System\qwXNeXO.exe
  C:\Windows\System\qwXNeXO.exe
  2⤵
  PID:11216
- C:\Windows\System\LZJeXrd.exe
  C:\Windows\System\LZJeXrd.exe
  2⤵
  PID:11256
- C:\Windows\System\lOurnMo.exe
  C:\Windows\System\lOurnMo.exe
  2⤵
  PID:10280
- C:\Windows\System\nbfIUiT.exe
  C:\Windows\System\nbfIUiT.exe
  2⤵
  PID:10276
- C:\Windows\System\jRvgxdf.exe
  C:\Windows\System\jRvgxdf.exe
  2⤵
  PID:10384
- C:\Windows\System\FCwGHxx.exe
  C:\Windows\System\FCwGHxx.exe
  2⤵
  PID:10424
- C:\Windows\System\lyuqRVs.exe
  C:\Windows\System\lyuqRVs.exe
  2⤵
  PID:10472
- C:\Windows\System\szHPdNs.exe
  C:\Windows\System\szHPdNs.exe
  2⤵
  PID:10560
- C:\Windows\System\aHwEeys.exe
  C:\Windows\System\aHwEeys.exe
  2⤵
  PID:10676
- C:\Windows\System\yCYLkwh.exe
  C:\Windows\System\yCYLkwh.exe
  2⤵
  PID:10704
- C:\Windows\System\gWwiBYm.exe
  C:\Windows\System\gWwiBYm.exe
  2⤵
  PID:10736
- C:\Windows\System\ygAEZfH.exe
  C:\Windows\System\ygAEZfH.exe
  2⤵
  PID:10820
- C:\Windows\System\eYKZrlf.exe
  C:\Windows\System\eYKZrlf.exe
  2⤵
  PID:10880
- C:\Windows\System\GzTSQgF.exe
  C:\Windows\System\GzTSQgF.exe
  2⤵
  PID:10956
- C:\Windows\System\ZuwbtQV.exe
  C:\Windows\System\ZuwbtQV.exe
  2⤵
  PID:11028
- C:\Windows\System\GwoUlWO.exe
  C:\Windows\System\GwoUlWO.exe
  2⤵
  PID:11176
- C:\Windows\System\OLmrIQg.exe
  C:\Windows\System\OLmrIQg.exe
  2⤵
  PID:11208
- C:\Windows\System\PWXbNMQ.exe
  C:\Windows\System\PWXbNMQ.exe
  2⤵
  PID:9896
- C:\Windows\System\pZDIeoR.exe
  C:\Windows\System\pZDIeoR.exe
  2⤵
  PID:10320
- C:\Windows\System\BSDaJXf.exe
  C:\Windows\System\BSDaJXf.exe
  2⤵
  PID:10480
- C:\Windows\System\cauixmt.exe
  C:\Windows\System\cauixmt.exe
  2⤵
  PID:10612
- C:\Windows\System\evsTSqd.exe
  C:\Windows\System\evsTSqd.exe
  2⤵
  PID:10652
- C:\Windows\System\QRHDgCZ.exe
  C:\Windows\System\QRHDgCZ.exe
  2⤵
  PID:10756
- C:\Windows\System\pJedJEg.exe
  C:\Windows\System\pJedJEg.exe
  2⤵
  PID:10848
- C:\Windows\System\HoaCgfs.exe
  C:\Windows\System\HoaCgfs.exe
  2⤵
  PID:11148
- C:\Windows\System\jdWXJEY.exe
  C:\Windows\System\jdWXJEY.exe
  2⤵
  PID:11248
- C:\Windows\System\KfBavCh.exe
  C:\Windows\System\KfBavCh.exe
  2⤵
  PID:10536
- C:\Windows\System\UhFNvJh.exe
  C:\Windows\System\UhFNvJh.exe
  2⤵
  PID:10860
- C:\Windows\System\aumrrvy.exe
  C:\Windows\System\aumrrvy.exe
  2⤵
  PID:11244
- C:\Windows\System\fdXhgcX.exe
  C:\Windows\System\fdXhgcX.exe
  2⤵
  PID:10864
- C:\Windows\System\JxzgOaS.exe
  C:\Windows\System\JxzgOaS.exe
  2⤵
  PID:11292
- C:\Windows\System\YTBPMgX.exe
  C:\Windows\System\YTBPMgX.exe
  2⤵
  PID:11312
- C:\Windows\System\MmNIYXX.exe
  C:\Windows\System\MmNIYXX.exe
  2⤵
  PID:11332
- C:\Windows\System\HZAzdhq.exe
  C:\Windows\System\HZAzdhq.exe
  2⤵
  PID:11384
- C:\Windows\System\xjLlwzA.exe
  C:\Windows\System\xjLlwzA.exe
  2⤵
  PID:11408
- C:\Windows\System\DfVbDwA.exe
  C:\Windows\System\DfVbDwA.exe
  2⤵
  PID:11460
- C:\Windows\System\lXbEgII.exe
  C:\Windows\System\lXbEgII.exe
  2⤵
  PID:11492
- C:\Windows\System\XKHtcCc.exe
  C:\Windows\System\XKHtcCc.exe
  2⤵
  PID:11508
- C:\Windows\System\xfhXVAe.exe
  C:\Windows\System\xfhXVAe.exe
  2⤵
  PID:11536
- C:\Windows\System\ltiQWQc.exe
  C:\Windows\System\ltiQWQc.exe
  2⤵
  PID:11588
- C:\Windows\System\WbSnYJM.exe
  C:\Windows\System\WbSnYJM.exe
  2⤵
  PID:11616
- C:\Windows\System\ksazQrz.exe
  C:\Windows\System\ksazQrz.exe
  2⤵
  PID:11632
- C:\Windows\System\yEBjmVt.exe
  C:\Windows\System\yEBjmVt.exe
  2⤵
  PID:11648
- C:\Windows\System\DJWFXnt.exe
  C:\Windows\System\DJWFXnt.exe
  2⤵
  PID:11696
- C:\Windows\System\RLmmDRm.exe
  C:\Windows\System\RLmmDRm.exe
  2⤵
  PID:11716
- C:\Windows\System\IeqoQin.exe
  C:\Windows\System\IeqoQin.exe
  2⤵
  PID:11732
- C:\Windows\System\yPSRbJa.exe
  C:\Windows\System\yPSRbJa.exe
  2⤵
  PID:11752
- C:\Windows\System\UfIXnCV.exe
  C:\Windows\System\UfIXnCV.exe
  2⤵
  PID:11796
- C:\Windows\System\HDADgMP.exe
  C:\Windows\System\HDADgMP.exe
  2⤵
  PID:11828
- C:\Windows\System\BeLFdtN.exe
  C:\Windows\System\BeLFdtN.exe
  2⤵
  PID:11844
- C:\Windows\System\XsXbqge.exe
  C:\Windows\System\XsXbqge.exe
  2⤵
  PID:11872
- C:\Windows\System\XMoeRdN.exe
  C:\Windows\System\XMoeRdN.exe
  2⤵
  PID:11912
- C:\Windows\System\SWXJkOB.exe
  C:\Windows\System\SWXJkOB.exe
  2⤵
  PID:11952
- C:\Windows\System\DqkXWyT.exe
  C:\Windows\System\DqkXWyT.exe
  2⤵
  PID:11968
- C:\Windows\System\qiAlFgK.exe
  C:\Windows\System\qiAlFgK.exe
  2⤵
  PID:11992
- C:\Windows\System\AJClwFM.exe
  C:\Windows\System\AJClwFM.exe
  2⤵
  PID:12024
- C:\Windows\System\zldxRur.exe
  C:\Windows\System\zldxRur.exe
  2⤵
  PID:12048
- C:\Windows\System\zYqLPpF.exe
  C:\Windows\System\zYqLPpF.exe
  2⤵
  PID:12068
- C:\Windows\System\PjpfPHO.exe
  C:\Windows\System\PjpfPHO.exe
  2⤵
  PID:12096
- C:\Windows\System\KNdUqzT.exe
  C:\Windows\System\KNdUqzT.exe
  2⤵
  PID:12132
- C:\Windows\System\hJatDCK.exe
  C:\Windows\System\hJatDCK.exe
  2⤵
  PID:12160
- C:\Windows\System\GXCBZYf.exe
  C:\Windows\System\GXCBZYf.exe
  2⤵
  PID:12196
- C:\Windows\System\KhwrwzN.exe
  C:\Windows\System\KhwrwzN.exe
  2⤵
  PID:12244
- C:\Windows\System\OjlQyIn.exe
  C:\Windows\System\OjlQyIn.exe
  2⤵
  PID:12272
- C:\Windows\System\pKerpsr.exe
  C:\Windows\System\pKerpsr.exe
  2⤵
  PID:10808
- C:\Windows\System\zSaiLqz.exe
  C:\Windows\System\zSaiLqz.exe
  2⤵
  PID:11320
- C:\Windows\System\qenfSuR.exe
  C:\Windows\System\qenfSuR.exe
  2⤵
  PID:11404
- C:\Windows\System\tpiuvyq.exe
  C:\Windows\System\tpiuvyq.exe
  2⤵
  PID:11456
- C:\Windows\System\XoDWLhB.exe
  C:\Windows\System\XoDWLhB.exe
  2⤵
  PID:11500
- C:\Windows\System\jMoARwi.exe
  C:\Windows\System\jMoARwi.exe
  2⤵
  PID:11584
- C:\Windows\System\BNcshJL.exe
  C:\Windows\System\BNcshJL.exe
  2⤵
  PID:11644
- C:\Windows\System\FLCWrRX.exe
  C:\Windows\System\FLCWrRX.exe
  2⤵
  PID:11744
- C:\Windows\System\JXCFonm.exe
  C:\Windows\System\JXCFonm.exe
  2⤵
  PID:11768
- C:\Windows\System\TncDeGB.exe
  C:\Windows\System\TncDeGB.exe
  2⤵
  PID:11860
- C:\Windows\System\epHbuNa.exe
  C:\Windows\System\epHbuNa.exe
  2⤵
  PID:11904
- C:\Windows\System\RMrFxnt.exe
  C:\Windows\System\RMrFxnt.exe
  2⤵
  PID:12012
- C:\Windows\System\HtNsjaW.exe
  C:\Windows\System\HtNsjaW.exe
  2⤵
  PID:12080
- C:\Windows\System\iUkbUlm.exe
  C:\Windows\System\iUkbUlm.exe
  2⤵
  PID:12144
- C:\Windows\System\hMInqjE.exe
  C:\Windows\System\hMInqjE.exe
  2⤵
  PID:12216
- C:\Windows\System\JgGvIeS.exe
  C:\Windows\System\JgGvIeS.exe
  2⤵
  PID:11100
- C:\Windows\System\wGfcarv.exe
  C:\Windows\System\wGfcarv.exe
  2⤵
  PID:12264
- C:\Windows\System\QgEzDPv.exe
  C:\Windows\System\QgEzDPv.exe
  2⤵
  PID:11284
- C:\Windows\System\rshJUEK.exe
  C:\Windows\System\rshJUEK.exe
  2⤵
  PID:11484
- C:\Windows\System\bOlIQPd.exe
  C:\Windows\System\bOlIQPd.exe
  2⤵
  PID:11684
- C:\Windows\System\fIJhvYj.exe
  C:\Windows\System\fIJhvYj.exe
  2⤵
  PID:11804
- C:\Windows\System\dUImUTa.exe
  C:\Windows\System\dUImUTa.exe
  2⤵
  PID:11452
- C:\Windows\System\idJYlSt.exe
  C:\Windows\System\idJYlSt.exe
  2⤵
  PID:12060
- C:\Windows\System\MvmwFdF.exe
  C:\Windows\System\MvmwFdF.exe
  2⤵
  PID:12188
- C:\Windows\System\HAxpoCv.exe
  C:\Windows\System\HAxpoCv.exe
  2⤵
  PID:4764
- C:\Windows\System\ioQcNDh.exe
  C:\Windows\System\ioQcNDh.exe
  2⤵
  PID:11440
- C:\Windows\System\TYplvVv.exe
  C:\Windows\System\TYplvVv.exe
  2⤵
  PID:11964
- C:\Windows\System\xJuhSsx.exe
  C:\Windows\System\xJuhSsx.exe
  2⤵
  PID:12172
- C:\Windows\System\VaePJMP.exe
  C:\Windows\System\VaePJMP.exe
  2⤵
  PID:11688
- C:\Windows\System\gWJsCHd.exe
  C:\Windows\System\gWJsCHd.exe
  2⤵
  PID:12092
- C:\Windows\System\PpIBdmz.exe
  C:\Windows\System\PpIBdmz.exe
  2⤵
  PID:12312
- C:\Windows\System\gEjlITD.exe
  C:\Windows\System\gEjlITD.exe
  2⤵
  PID:12364
- C:\Windows\System\SAZnSQb.exe
  C:\Windows\System\SAZnSQb.exe
  2⤵
  PID:12380
- C:\Windows\System\zWsdmVA.exe
  C:\Windows\System\zWsdmVA.exe
  2⤵
  PID:12408
- C:\Windows\System\HcrmVDt.exe
  C:\Windows\System\HcrmVDt.exe
  2⤵
  PID:12432
- C:\Windows\System\ODjjrSD.exe
  C:\Windows\System\ODjjrSD.exe
  2⤵
  PID:12456
- C:\Windows\System\xGavDdu.exe
  C:\Windows\System\xGavDdu.exe
  2⤵
  PID:12484
- C:\Windows\System\YgcDRSj.exe
  C:\Windows\System\YgcDRSj.exe
  2⤵
  PID:12504
- C:\Windows\System\ZuRSlyw.exe
  C:\Windows\System\ZuRSlyw.exe
  2⤵
  PID:12532
- C:\Windows\System\pblCnTk.exe
  C:\Windows\System\pblCnTk.exe
  2⤵
  PID:12576
- C:\Windows\System\yoMuEBD.exe
  C:\Windows\System\yoMuEBD.exe
  2⤵
  PID:12592
- C:\Windows\System\bzTGxJf.exe
  C:\Windows\System\bzTGxJf.exe
  2⤵
  PID:12640
- C:\Windows\System\cLxUjiU.exe
  C:\Windows\System\cLxUjiU.exe
  2⤵
  PID:12660
- C:\Windows\System\tcTOXfV.exe
  C:\Windows\System\tcTOXfV.exe
  2⤵
  PID:12688
- C:\Windows\System\oqSMehC.exe
  C:\Windows\System\oqSMehC.exe
  2⤵
  PID:12704
- C:\Windows\System\lMyvGxU.exe
  C:\Windows\System\lMyvGxU.exe
  2⤵
  PID:12744
- C:\Windows\System\NDGZqYj.exe
  C:\Windows\System\NDGZqYj.exe
  2⤵
  PID:12760
- C:\Windows\System\rMhbfvQ.exe
  C:\Windows\System\rMhbfvQ.exe
  2⤵
  PID:12788
- C:\Windows\System\HZqYJQp.exe
  C:\Windows\System\HZqYJQp.exe
  2⤵
  PID:12812
- C:\Windows\System\uwvWEhv.exe
  C:\Windows\System\uwvWEhv.exe
  2⤵
  PID:12856
- C:\Windows\System\yatiBfV.exe
  C:\Windows\System\yatiBfV.exe
  2⤵
  PID:12884
- C:\Windows\System\ZyBWGMP.exe
  C:\Windows\System\ZyBWGMP.exe
  2⤵
  PID:12924
- C:\Windows\System\ZZAyfpe.exe
  C:\Windows\System\ZZAyfpe.exe
  2⤵
  PID:12948
- C:\Windows\System\YWEWBHu.exe
  C:\Windows\System\YWEWBHu.exe
  2⤵
  PID:12972
- C:\Windows\System\XfkwHyC.exe
  C:\Windows\System\XfkwHyC.exe
  2⤵
  PID:13008
- C:\Windows\System\yiXkDdW.exe
  C:\Windows\System\yiXkDdW.exe
  2⤵
  PID:13036
- C:\Windows\System\AavWbor.exe
  C:\Windows\System\AavWbor.exe
  2⤵
  PID:13052
- C:\Windows\System\UawvbIn.exe
  C:\Windows\System\UawvbIn.exe
  2⤵
  PID:13080
- C:\Windows\System\vXvTucP.exe
  C:\Windows\System\vXvTucP.exe
  2⤵
  PID:13108
- C:\Windows\System\etQUxLZ.exe
  C:\Windows\System\etQUxLZ.exe
  2⤵
  PID:13148
- C:\Windows\System\uviQETA.exe
  C:\Windows\System\uviQETA.exe
  2⤵
  PID:13172
- C:\Windows\System\AxfytCF.exe
  C:\Windows\System\AxfytCF.exe
  2⤵
  PID:13192
- C:\Windows\System\DsujxLr.exe
  C:\Windows\System\DsujxLr.exe
  2⤵
  PID:13208
- C:\Windows\System\qNtLjND.exe
  C:\Windows\System\qNtLjND.exe
  2⤵
  PID:13260
- C:\Windows\System\WnYqXZx.exe
  C:\Windows\System\WnYqXZx.exe
  2⤵
  PID:13288
- C:\Windows\System\TvElukM.exe
  C:\Windows\System\TvElukM.exe
  2⤵
  PID:12304
- C:\Windows\System\RJvyBFa.exe
  C:\Windows\System\RJvyBFa.exe
  2⤵
  PID:12356
- C:\Windows\System\MvYBNXJ.exe
  C:\Windows\System\MvYBNXJ.exe
  2⤵
  PID:12424
- C:\Windows\System\fYEWkQL.exe
  C:\Windows\System\fYEWkQL.exe
  2⤵
  PID:12492
- C:\Windows\System\fVSCqkz.exe
  C:\Windows\System\fVSCqkz.exe
  2⤵
  PID:12496
- C:\Windows\System\tsGcmth.exe
  C:\Windows\System\tsGcmth.exe
  2⤵
  PID:12624
- C:\Windows\System\bYGbmoI.exe
  C:\Windows\System\bYGbmoI.exe
  2⤵
  PID:12604
- C:\Windows\System\tSjiumN.exe
  C:\Windows\System\tSjiumN.exe
  2⤵
  PID:12672
- C:\Windows\System\cpxBFUC.exe
  C:\Windows\System\cpxBFUC.exe
  2⤵
  PID:12716
- C:\Windows\System\XkIrzWW.exe
  C:\Windows\System\XkIrzWW.exe
  2⤵
  PID:12772
- C:\Windows\System\FWeidUo.exe
  C:\Windows\System\FWeidUo.exe
  2⤵
  PID:12904
- C:\Windows\System\gjIFMSI.exe
  C:\Windows\System\gjIFMSI.exe
  2⤵
  PID:12944
- C:\Windows\System\gHkkwXT.exe
  C:\Windows\System\gHkkwXT.exe
  2⤵
  PID:13004
- C:\Windows\System\pjguLVy.exe
  C:\Windows\System\pjguLVy.exe
  2⤵
  PID:13044
- C:\Windows\System\rONkcsg.exe
  C:\Windows\System\rONkcsg.exe
  2⤵
  PID:13136
- C:\Windows\System\bcGavUz.exe
  C:\Windows\System\bcGavUz.exe
  2⤵
  PID:13200
- C:\Windows\System\hfPCrVJ.exe
  C:\Windows\System\hfPCrVJ.exe
  2⤵
  PID:12308
- C:\Windows\System\DvWroJp.exe
  C:\Windows\System\DvWroJp.exe
  2⤵
  PID:12404
- C:\Windows\System\mOeLDYf.exe
  C:\Windows\System\mOeLDYf.exe
  2⤵
  PID:12560
- C:\Windows\System\lQULyMG.exe
  C:\Windows\System\lQULyMG.exe
  2⤵
  PID:12696
- C:\Windows\System\NIWwbdX.exe
  C:\Windows\System\NIWwbdX.exe
  2⤵
  PID:12872
- C:\Windows\System\mOcUDms.exe
  C:\Windows\System\mOcUDms.exe
  2⤵
  PID:13104
- C:\Windows\System\YePuvdc.exe
  C:\Windows\System\YePuvdc.exe
  2⤵
  PID:13252
- C:\Windows\System\pDSkvnb.exe
  C:\Windows\System\pDSkvnb.exe
  2⤵
  PID:12444
- C:\Windows\System\VIenbKE.exe
  C:\Windows\System\VIenbKE.exe
  2⤵
  PID:13048
- C:\Windows\System\aXTEmiS.exe
  C:\Windows\System\aXTEmiS.exe
  2⤵
  PID:13276
- C:\Windows\System\UQzVtta.exe
  C:\Windows\System\UQzVtta.exe
  2⤵
  PID:13092
- C:\Windows\System\naCZoFn.exe
  C:\Windows\System\naCZoFn.exe
  2⤵
  PID:12836
- C:\Windows\System\jJqvXPP.exe
  C:\Windows\System\jJqvXPP.exe
  2⤵
  PID:13336
- C:\Windows\System\hrJgZev.exe
  C:\Windows\System\hrJgZev.exe
  2⤵
  PID:13364
- C:\Windows\System\bHytiKz.exe
  C:\Windows\System\bHytiKz.exe
  2⤵
  PID:13392
- C:\Windows\System\CJIxEqj.exe
  C:\Windows\System\CJIxEqj.exe
  2⤵
  PID:13408
- C:\Windows\System\uosUlNg.exe
  C:\Windows\System\uosUlNg.exe
  2⤵
  PID:13448
- C:\Windows\System\TxbkGsT.exe
  C:\Windows\System\TxbkGsT.exe
  2⤵
  PID:13464
- C:\Windows\System\basQYef.exe
  C:\Windows\System\basQYef.exe
  2⤵
  PID:13488
- C:\Windows\System\dbdsgJH.exe
  C:\Windows\System\dbdsgJH.exe
  2⤵
  PID:13544
- C:\Windows\System\KNTNfji.exe
  C:\Windows\System\KNTNfji.exe
  2⤵
  PID:13572
- C:\Windows\System\JnesXDC.exe
  C:\Windows\System\JnesXDC.exe
  2⤵
  PID:13588
- C:\Windows\System\EvhOliD.exe
  C:\Windows\System\EvhOliD.exe
  2⤵
  PID:13612
- C:\Windows\System\fpMSvSS.exe
  C:\Windows\System\fpMSvSS.exe
  2⤵
  PID:13656
- C:\Windows\System\KIEsfiu.exe
  C:\Windows\System\KIEsfiu.exe
  2⤵
  PID:13672
- C:\Windows\System\HJHoUNu.exe
  C:\Windows\System\HJHoUNu.exe
  2⤵
  PID:13700
- C:\Windows\System\lubLqZC.exe
  C:\Windows\System\lubLqZC.exe
  2⤵
  PID:13728
- C:\Windows\System\ybxEGIt.exe
  C:\Windows\System\ybxEGIt.exe
  2⤵
  PID:13756
- C:\Windows\System\rdxeDmu.exe
  C:\Windows\System\rdxeDmu.exe
  2⤵
  PID:13784
- C:\Windows\System\jxSjieW.exe
  C:\Windows\System\jxSjieW.exe
  2⤵
  PID:13804
- C:\Windows\System\VyiZgzy.exe
  C:\Windows\System\VyiZgzy.exe
  2⤵
  PID:13828
- C:\Windows\System\RznKSRn.exe
  C:\Windows\System\RznKSRn.exe
  2⤵
  PID:13868
- C:\Windows\System\WATCMRI.exe
  C:\Windows\System\WATCMRI.exe
  2⤵
  PID:13892
- C:\Windows\System\naMOLiv.exe
  C:\Windows\System\naMOLiv.exe
  2⤵
  PID:13920
- C:\Windows\System\RfVbmwO.exe
  C:\Windows\System\RfVbmwO.exe
  2⤵
  PID:13948
- C:\Windows\System\MRZxQQt.exe
  C:\Windows\System\MRZxQQt.exe
  2⤵
  PID:13992
- C:\Windows\System\ruQhvlp.exe
  C:\Windows\System\ruQhvlp.exe
  2⤵
  PID:14020
- C:\Windows\System\EMxlmrj.exe
  C:\Windows\System\EMxlmrj.exe
  2⤵
  PID:14048
- C:\Windows\System\eEwEPMO.exe
  C:\Windows\System\eEwEPMO.exe
  2⤵
  PID:14076
- C:\Windows\System\KuowRPs.exe
  C:\Windows\System\KuowRPs.exe
  2⤵
  PID:14104
- C:\Windows\System\VdyJfRc.exe
  C:\Windows\System\VdyJfRc.exe
  2⤵
  PID:14132
- C:\Windows\System\cuzWGxw.exe
  C:\Windows\System\cuzWGxw.exe
  2⤵
  PID:14160
- C:\Windows\System\QMekzZQ.exe
  C:\Windows\System\QMekzZQ.exe
  2⤵
  PID:14180
- C:\Windows\System\GirduLR.exe
  C:\Windows\System\GirduLR.exe
  2⤵
  PID:14208
- C:\Windows\System\guDfIIX.exe
  C:\Windows\System\guDfIIX.exe
  2⤵
  PID:14232
- C:\Windows\System\TQLOEWg.exe
  C:\Windows\System\TQLOEWg.exe
  2⤵
  PID:14256
- C:\Windows\System\hMOliNi.exe
  C:\Windows\System\hMOliNi.exe
  2⤵
  PID:14288
- C:\Windows\System\gQwphPv.exe
  C:\Windows\System\gQwphPv.exe
  2⤵
  PID:14312
- C:\Windows\System\yOfaBZn.exe
  C:\Windows\System\yOfaBZn.exe
  2⤵
  PID:13380
- C:\Windows\System\tXWGfpE.exe
  C:\Windows\System\tXWGfpE.exe
  2⤵
  PID:13376
- C:\Windows\System\NEtwHRF.exe
  C:\Windows\System\NEtwHRF.exe
  2⤵
  PID:13480
- C:\Windows\System\TquByKK.exe
  C:\Windows\System\TquByKK.exe
  2⤵
  PID:13528
- C:\Windows\System\tqDLLCh.exe
  C:\Windows\System\tqDLLCh.exe
  2⤵
  PID:13580
- C:\Windows\System\QlBiNQC.exe
  C:\Windows\System\QlBiNQC.exe
  2⤵
  PID:13648
- C:\Windows\System\fqyGjaF.exe
  C:\Windows\System\fqyGjaF.exe
  2⤵
  PID:13716
- C:\Windows\System\PMScfVN.exe
  C:\Windows\System\PMScfVN.exe
  2⤵
  PID:13736
- C:\Windows\System\dEGWTYr.exe
  C:\Windows\System\dEGWTYr.exe
  2⤵
  PID:13824
- C:\Windows\System\wqMLnpE.exe
  C:\Windows\System\wqMLnpE.exe
  2⤵
  PID:13944
- C:\Windows\System\PIDHcPP.exe
  C:\Windows\System\PIDHcPP.exe
  2⤵
  PID:14012
- C:\Windows\System\Uestjdt.exe
  C:\Windows\System\Uestjdt.exe
  2⤵
  PID:14060
- C:\Windows\System\nKKFXCZ.exe
  C:\Windows\System\nKKFXCZ.exe
  2⤵
  PID:14096
- C:\Windows\System\trpPyfL.exe
  C:\Windows\System\trpPyfL.exe
  2⤵
  PID:14176
- C:\Windows\System\NwYizCa.exe
  C:\Windows\System\NwYizCa.exe
  2⤵
  PID:14240
- C:\Windows\System\sVITrBs.exe
  C:\Windows\System\sVITrBs.exe
  2⤵
  PID:14308
- C:\Windows\System\RzVygtV.exe
  C:\Windows\System\RzVygtV.exe
  2⤵
  PID:13420
- C:\Windows\System\NlxcBLM.exe
  C:\Windows\System\NlxcBLM.exe
  2⤵
  PID:13476
- C:\Windows\System\OQxGtuX.exe
  C:\Windows\System\OQxGtuX.exe
  2⤵
  PID:13564
- C:\Windows\System\QgEncsJ.exe
  C:\Windows\System\QgEncsJ.exe
  2⤵
  PID:13636
- C:\Windows\System\zPWztIR.exe
  C:\Windows\System\zPWztIR.exe
  2⤵
  PID:13852
- C:\Windows\System\zsnaYlJ.exe
  C:\Windows\System\zsnaYlJ.exe
  2⤵
  PID:13988
- C:\Windows\System\eiFSeoS.exe
  C:\Windows\System\eiFSeoS.exe
  2⤵
  PID:14124
- C:\Windows\System\QISoXgs.exe
  C:\Windows\System\QISoXgs.exe
  2⤵
  PID:13684
- C:\Windows\System\ABoInbS.exe
  C:\Windows\System\ABoInbS.exe
  2⤵
  PID:13984
- C:\Windows\System\qGRklEZ.exe
  C:\Windows\System\qGRklEZ.exe
  2⤵
  PID:13456
- C:\Windows\System\FfxdrTf.exe
  C:\Windows\System\FfxdrTf.exe
  2⤵
  PID:14072
- C:\Windows\System\VbXZJNl.exe
  C:\Windows\System\VbXZJNl.exe
  2⤵
  PID:14356
- C:\Windows\System\sHxmwZO.exe
  C:\Windows\System\sHxmwZO.exe
  2⤵
  PID:14380
- C:\Windows\System\blbxKst.exe
  C:\Windows\System\blbxKst.exe
  2⤵
  PID:14412
- C:\Windows\System\GiiTSHV.exe
  C:\Windows\System\GiiTSHV.exe
  2⤵
  PID:14440
- C:\Windows\System\TBGYxBj.exe
  C:\Windows\System\TBGYxBj.exe
  2⤵
  PID:14468
- C:\Windows\System\NAlWqDK.exe
  C:\Windows\System\NAlWqDK.exe
  2⤵
  PID:14484
- C:\Windows\System\gNdxSCF.exe
  C:\Windows\System\gNdxSCF.exe
  2⤵
  PID:14512
- C:\Windows\System\tActUGA.exe
  C:\Windows\System\tActUGA.exe
  2⤵
  PID:14544
- C:\Windows\System\kBNUHtu.exe
  C:\Windows\System\kBNUHtu.exe
  2⤵
  PID:14568
- C:\Windows\System\iVtSbFz.exe
  C:\Windows\System\iVtSbFz.exe
  2⤵
  PID:14596
- C:\Windows\System\okXDXEN.exe
  C:\Windows\System\okXDXEN.exe
  2⤵
  PID:14648
- C:\Windows\System\KPqIIbV.exe
  C:\Windows\System\KPqIIbV.exe
  2⤵
  PID:14664
- C:\Windows\System\xciJivG.exe
  C:\Windows\System\xciJivG.exe
  2⤵
  PID:14692
- C:\Windows\System\QZJvzuU.exe
  C:\Windows\System\QZJvzuU.exe
  2⤵
  PID:14720
- C:\Windows\System\HzAhUoK.exe
  C:\Windows\System\HzAhUoK.exe
  2⤵
  PID:14740
- C:\Windows\System\CMCgKcH.exe
  C:\Windows\System\CMCgKcH.exe
  2⤵
  PID:14756
- C:\Windows\System\AptDXTz.exe
  C:\Windows\System\AptDXTz.exe
  2⤵
  PID:14788
- C:\Windows\System\rhjRAPU.exe
  C:\Windows\System\rhjRAPU.exe
  2⤵
  PID:14836
- C:\Windows\System\UvMmYoQ.exe
  C:\Windows\System\UvMmYoQ.exe
  2⤵
  PID:14860
- C:\Windows\System\XtDorWT.exe
  C:\Windows\System\XtDorWT.exe
  2⤵
  PID:14896
- C:\Windows\System\gkaHSHy.exe
  C:\Windows\System\gkaHSHy.exe
  2⤵
  PID:14916
- C:\Windows\System\iwsnifv.exe
  C:\Windows\System\iwsnifv.exe
  2⤵
  PID:14956
- C:\Windows\System\GKXuOfX.exe
  C:\Windows\System\GKXuOfX.exe
  2⤵
  PID:14972
- C:\Windows\System\irPkqQW.exe
  C:\Windows\System\irPkqQW.exe
  2⤵
  PID:15000
- C:\Windows\System\eaEeSFL.exe
  C:\Windows\System\eaEeSFL.exe
  2⤵
  PID:15040
- C:\Windows\System\QppkooS.exe
  C:\Windows\System\QppkooS.exe
  2⤵
  PID:15064
- C:\Windows\System\EHjPXXw.exe
  C:\Windows\System\EHjPXXw.exe
  2⤵
  PID:15084
- C:\Windows\System\PiifSHm.exe
  C:\Windows\System\PiifSHm.exe
  2⤵
  PID:15112
- C:\Windows\System\CFrtyvJ.exe
  C:\Windows\System\CFrtyvJ.exe
  2⤵
  PID:15128
- C:\Windows\System\htlNWeX.exe
  C:\Windows\System\htlNWeX.exe
  2⤵
  PID:15152
- C:\Windows\System\DItuFUZ.exe
  C:\Windows\System\DItuFUZ.exe
  2⤵
  PID:15188
- C:\Windows\System\DKyodPw.exe
  C:\Windows\System\DKyodPw.exe
  2⤵
  PID:15212
- C:\Windows\System\mqUQyTN.exe
  C:\Windows\System\mqUQyTN.exe
  2⤵
  PID:15228
- C:\Windows\System\eCNIncG.exe
  C:\Windows\System\eCNIncG.exe
  2⤵
  PID:15252
- C:\Windows\System\axSeYYw.exe
  C:\Windows\System\axSeYYw.exe
  2⤵
  PID:15268
- C:\Windows\System\TZgwnQD.exe
  C:\Windows\System\TZgwnQD.exe
  2⤵
  PID:15308
- C:\Windows\System\gHnzCjO.exe
  C:\Windows\System\gHnzCjO.exe
  2⤵
  PID:15344
- C:\Windows\System\ZuKJrlx.exe
  C:\Windows\System\ZuKJrlx.exe
  2⤵
  PID:14344
- C:\Windows\System\XhjaWGz.exe
  C:\Windows\System\XhjaWGz.exe
  2⤵
  PID:14404
- C:\Windows\System\cTMnBFi.exe
  C:\Windows\System\cTMnBFi.exe
  2⤵
  PID:14504
- C:\Windows\System\OMsSdTN.exe
  C:\Windows\System\OMsSdTN.exe
  2⤵
  PID:14608
- C:\Windows\System\PqjVIYr.exe
  C:\Windows\System\PqjVIYr.exe
  2⤵
  PID:14644
- C:\Windows\System\IDNmFap.exe
  C:\Windows\System\IDNmFap.exe
  2⤵
  PID:14768
- C:\Windows\System\wpgAJvT.exe
  C:\Windows\System\wpgAJvT.exe
  2⤵
  PID:14776
- C:\Windows\System\GdQZopN.exe
  C:\Windows\System\GdQZopN.exe
  2⤵
  PID:14852
- C:\Windows\System\lksQxIS.exe
  C:\Windows\System\lksQxIS.exe
  2⤵
  PID:14876
- C:\Windows\System\oDWgfpq.exe
  C:\Windows\System\oDWgfpq.exe
  2⤵
  PID:14952
- C:\Windows\System\XZXcnOW.exe
  C:\Windows\System\XZXcnOW.exe
  2⤵
  PID:15012
- C:\Windows\System\bHtrDXg.exe
  C:\Windows\System\bHtrDXg.exe
  2⤵
  PID:15076
- C:\Windows\System\wgvOySv.exe
  C:\Windows\System\wgvOySv.exe
  2⤵
  PID:15124
- C:\Windows\System\wpOmXgK.exe
  C:\Windows\System\wpOmXgK.exe
  2⤵
  PID:15236
- C:\Windows\System\XYsHLTF.exe
  C:\Windows\System\XYsHLTF.exe
  2⤵
  PID:15352
- C:\Windows\System\aGNZnMt.exe
  C:\Windows\System\aGNZnMt.exe
  2⤵
  PID:14348
- C:\Windows\System\BgBBDhX.exe
  C:\Windows\System\BgBBDhX.exe
  2⤵
  PID:14560
- C:\Windows\System\UPPiNGk.exe
  C:\Windows\System\UPPiNGk.exe
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:14640
- C:\Windows\System\lSXpymP.exe
  C:\Windows\System\lSXpymP.exe
  2⤵
  PID:13820
- C:\Windows\System\OKEmqTC.exe
  C:\Windows\System\OKEmqTC.exe
  2⤵
  PID:14968
- C:\Windows\System\KiReiEA.exe
  C:\Windows\System\KiReiEA.exe
  2⤵
  PID:15204
- C:\Windows\System\nPruavp.exe
  C:\Windows\System\nPruavp.exe
  2⤵
  PID:15220
- C:\Windows\System\dYHMXCi.exe
  C:\Windows\System\dYHMXCi.exe
  2⤵
  PID:14480
- C:\Windows\System\BRFPenu.exe
  C:\Windows\System\BRFPenu.exe
  2⤵
  PID:14752
- C:\Windows\System\KMDXUYT.exe
  C:\Windows\System\KMDXUYT.exe
  2⤵
  PID:15304
- C:\Windows\System\EEJTcEd.exe
  C:\Windows\System\EEJTcEd.exe
  2⤵
  PID:14780
- C:\Windows\System\fJHtVWV.exe
  C:\Windows\System\fJHtVWV.exe
  2⤵
  PID:15384
- C:\Windows\System\XCNvogB.exe
  C:\Windows\System\XCNvogB.exe
  2⤵
  PID:15400
- C:\Windows\System\ylDOtDZ.exe
  C:\Windows\System\ylDOtDZ.exe
  2⤵
  PID:15424
- C:\Windows\System\whSYeeW.exe
  C:\Windows\System\whSYeeW.exe
  2⤵
  PID:15468
- C:\Windows\System\tbqvXgJ.exe
  C:\Windows\System\tbqvXgJ.exe
  2⤵
  PID:15496
- C:\Windows\System\mMqHext.exe
  C:\Windows\System\mMqHext.exe
  2⤵
  PID:15516
- C:\Windows\System\UAuusRc.exe
  C:\Windows\System\UAuusRc.exe
  2⤵
  PID:15540
- C:\Windows\System\PwFDuus.exe
  C:\Windows\System\PwFDuus.exe
  2⤵
  PID:15568
- C:\Windows\System\AJveLEd.exe
  C:\Windows\System\AJveLEd.exe
  2⤵
  PID:15588
- C:\Windows\System\TEiSPgf.exe
  C:\Windows\System\TEiSPgf.exe
  2⤵
  PID:15616
- C:\Windows\System\AQSkYwf.exe
  C:\Windows\System\AQSkYwf.exe
  2⤵
  PID:15636
- C:\Windows\System\TqCcwTY.exe
  C:\Windows\System\TqCcwTY.exe
  2⤵
  PID:15668
- C:\Windows\System\RZLNZEx.exe
  C:\Windows\System\RZLNZEx.exe
  2⤵
  PID:15700
- C:\Windows\System\FbclheO.exe
  C:\Windows\System\FbclheO.exe
  2⤵
  PID:15736
- C:\Windows\System\CssBJaN.exe
  C:\Windows\System\CssBJaN.exe
  2⤵
  PID:15752
- C:\Windows\System\mfQBoMW.exe
  C:\Windows\System\mfQBoMW.exe
  2⤵
  PID:15772
- C:\Windows\System\covZogh.exe
  C:\Windows\System\covZogh.exe
  2⤵
  PID:15808
- C:\Windows\System\SUmQPNv.exe
  C:\Windows\System\SUmQPNv.exe
  2⤵
  PID:15848
- C:\Windows\System\ZRXVxSG.exe
  C:\Windows\System\ZRXVxSG.exe
  2⤵
  PID:15864
- C:\Windows\System\WzlMgAM.exe
  C:\Windows\System\WzlMgAM.exe
  2⤵
  PID:15880
- C:\Windows\System\oFRmEVq.exe
  C:\Windows\System\oFRmEVq.exe
  2⤵
  PID:15944
- C:\Windows\System\qjYNKLl.exe
  C:\Windows\System\qjYNKLl.exe
  2⤵
  PID:15984
- C:\Windows\System\ieSTqIl.exe
  C:\Windows\System\ieSTqIl.exe
  2⤵
  PID:16000
- C:\Windows\System\ekoKnFP.exe
  C:\Windows\System\ekoKnFP.exe
  2⤵
  PID:16028
- C:\Windows\System\teFxCTO.exe
  C:\Windows\System\teFxCTO.exe
  2⤵
  PID:16056
- C:\Windows\System\TEWtJlv.exe
  C:\Windows\System\TEWtJlv.exe
  2⤵
  PID:16072
- C:\Windows\System\qbeTylP.exe
  C:\Windows\System\qbeTylP.exe
  2⤵
  PID:16092
- C:\Windows\System\kWlYqvn.exe
  C:\Windows\System\kWlYqvn.exe
  2⤵
  PID:16128
- C:\Windows\System\nGMwZEX.exe
  C:\Windows\System\nGMwZEX.exe
  2⤵
  PID:16156
- C:\Windows\System\woVPWEL.exe
  C:\Windows\System\woVPWEL.exe
  2⤵
  PID:16196
- C:\Windows\System\dSUnerF.exe
  C:\Windows\System\dSUnerF.exe
  2⤵
  PID:16220
- C:\Windows\System\UqrlfEY.exe
  C:\Windows\System\UqrlfEY.exe
  2⤵
  PID:16240
- C:\Windows\System\sjoMbec.exe
  C:\Windows\System\sjoMbec.exe
  2⤵
  PID:16280
- C:\Windows\System\hvCRIVD.exe
  C:\Windows\System\hvCRIVD.exe
  2⤵
  PID:16308
- C:\Windows\System\ZFGGaxy.exe
  C:\Windows\System\ZFGGaxy.exe
  2⤵
  PID:16328
- C:\Windows\System\NzdAzpS.exe
  C:\Windows\System\NzdAzpS.exe
  2⤵
  PID:16352
- C:\Windows\System\aWyFpun.exe
  C:\Windows\System\aWyFpun.exe
  2⤵
  PID:16368
- C:\Windows\System\GSUuTDy.exe
  C:\Windows\System\GSUuTDy.exe
  2⤵
  PID:15056
- C:\Windows\System\zaKiiwC.exe
  C:\Windows\System\zaKiiwC.exe
  2⤵
  PID:15416
- C:\Windows\System\TlnCzMi.exe
  C:\Windows\System\TlnCzMi.exe
  2⤵
  PID:15480
- C:\Windows\System\JqaKGNQ.exe
  C:\Windows\System\JqaKGNQ.exe
  2⤵
  PID:15576
- C:\Windows\System\QsbIenm.exe
  C:\Windows\System\QsbIenm.exe
  2⤵
  PID:15656
- C:\Windows\System\cIJHAgS.exe
  C:\Windows\System\cIJHAgS.exe
  2⤵
  PID:15696
- C:\Windows\System\OmltgDT.exe
  C:\Windows\System\OmltgDT.exe
  2⤵
  PID:15784
- C:\Windows\System\AxZPpbh.exe
  C:\Windows\System\AxZPpbh.exe
  2⤵
  PID:15832
- C:\Windows\System\jeBHtzu.exe
  C:\Windows\System\jeBHtzu.exe
  2⤵
  PID:15900
- C:\Windows\System\kdjtOLo.exe
  C:\Windows\System\kdjtOLo.exe
  2⤵
  PID:15956
- C:\Windows\System\VvTMiis.exe
  C:\Windows\System\VvTMiis.exe
  2⤵
  PID:16044
- C:\Windows\System\NNVaGnL.exe
  C:\Windows\System\NNVaGnL.exe
  2⤵
  PID:16136
- C:\Windows\System\vsCPBIx.exe
  C:\Windows\System\vsCPBIx.exe
  2⤵
  PID:16188
- C:\Windows\System\yBnQoXe.exe
  C:\Windows\System\yBnQoXe.exe
  2⤵
  PID:16252
- C:\Windows\System\vnVTugE.exe
  C:\Windows\System\vnVTugE.exe
  2⤵
  PID:16300
- C:\Windows\System\kkkGIjs.exe
  C:\Windows\System\kkkGIjs.exe
  2⤵
  PID:16344
- C:\Windows\System\uFIDfwz.exe
  C:\Windows\System\uFIDfwz.exe
  2⤵
  PID:15380
- C:\Windows\System\kiEBzAx.exe
  C:\Windows\System\kiEBzAx.exe
  2⤵
  PID:15708
- C:\Windows\System\WPLUlrg.exe
  C:\Windows\System\WPLUlrg.exe
  2⤵
  PID:15732
- C:\Windows\System\ZGMYUiD.exe
  C:\Windows\System\ZGMYUiD.exe
  2⤵
  PID:15940
- C:\Windows\System\vVlKHde.exe
  C:\Windows\System\vVlKHde.exe
  2⤵
  PID:16144
- C:\Windows\System\HHbNzxz.exe
  C:\Windows\System\HHbNzxz.exe
  2⤵
  PID:16272
- C:\Windows\System\PoIQhYr.exe
  C:\Windows\System\PoIQhYr.exe
  2⤵
  PID:16292
- C:\Windows\System\buyUJbl.exe
  C:\Windows\System\buyUJbl.exe
  2⤵
  PID:15364
- C:\Windows\System\LhqPgfU.exe
  C:\Windows\System\LhqPgfU.exe
  2⤵
  PID:15876
- C:\Windows\System\znvkHDW.exe
  C:\Windows\System\znvkHDW.exe
  2⤵
  PID:16232
- C:\Windows\System\LpHjbsq.exe
  C:\Windows\System\LpHjbsq.exe
  2⤵
  PID:16068
- C:\Windows\System\jBzNiqo.exe
  C:\Windows\System\jBzNiqo.exe
  2⤵
  PID:16400
- C:\Windows\System\gSbrlqd.exe
  C:\Windows\System\gSbrlqd.exe
  2⤵
  PID:16440
- C:\Windows\System\mmHNdCZ.exe
  C:\Windows\System\mmHNdCZ.exe
  2⤵
  PID:16464
- C:\Windows\System\VBxKXal.exe
  C:\Windows\System\VBxKXal.exe
  2⤵
  PID:16496
- C:\Windows\System\LZuWeQM.exe
  C:\Windows\System\LZuWeQM.exe
  2⤵
  PID:16524
- C:\Windows\System\yeNqLKm.exe
  C:\Windows\System\yeNqLKm.exe
  2⤵
  PID:16540
- C:\Windows\System\HxsxEao.exe
  C:\Windows\System\HxsxEao.exe
  2⤵
  PID:16580
- C:\Windows\System\MGABmrU.exe
  C:\Windows\System\MGABmrU.exe
  2⤵
  PID:16596
- C:\Windows\System\mCUbHDL.exe
  C:\Windows\System\mCUbHDL.exe
  2⤵
  PID:16620
- C:\Windows\System\hgvmdxE.exe
  C:\Windows\System\hgvmdxE.exe
  2⤵
  PID:16652
- C:\Windows\System\zqiLkph.exe
  C:\Windows\System\zqiLkph.exe
  2⤵
  PID:16696
- C:\Windows\System\eOEwniV.exe
  C:\Windows\System\eOEwniV.exe
  2⤵
  PID:16720
- C:\Windows\System\KMxXEgI.exe
  C:\Windows\System\KMxXEgI.exe
  2⤵
  PID:16760
- C:\Windows\System\XdwcIiQ.exe
  C:\Windows\System\XdwcIiQ.exe
  2⤵
  PID:16776
- C:\Windows\System\oMbhoMg.exe
  C:\Windows\System\oMbhoMg.exe
  2⤵
  PID:16816
- C:\Windows\System\izyavmv.exe
  C:\Windows\System\izyavmv.exe
  2⤵
  PID:16832
- C:\Windows\System\dQrmLSg.exe
  C:\Windows\System\dQrmLSg.exe
  2⤵
  PID:16860
- C:\Windows\System\zIgnIGS.exe
  C:\Windows\System\zIgnIGS.exe
  2⤵
  PID:16888
- C:\Windows\System\kbiAZSJ.exe
  C:\Windows\System\kbiAZSJ.exe
  2⤵
  PID:16904
- C:\Windows\System\OgsMZHg.exe
  C:\Windows\System\OgsMZHg.exe
  2⤵
  PID:16928
- C:\Windows\System\eiImKyQ.exe
  C:\Windows\System\eiImKyQ.exe
  2⤵
  PID:16952
- C:\Windows\System\UqozmDd.exe
  C:\Windows\System\UqozmDd.exe
  2⤵
  PID:16976
- C:\Windows\System\JFkwvNG.exe
  C:\Windows\System\JFkwvNG.exe
  2⤵
  PID:17028
- C:\Windows\System\QWEKVkP.exe
  C:\Windows\System\QWEKVkP.exe
  2⤵
  PID:17052
- - C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -u -p 17052 -s 252
    3⤵
    PID:17364
- C:\Windows\System\qIAuBKf.exe
  C:\Windows\System\qIAuBKf.exe
  2⤵
  PID:17072
- C:\Windows\System\VYSPPJu.exe
  C:\Windows\System\VYSPPJu.exe
  2⤵
  PID:17092

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:16360

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\AjnGllj.exe

Filesize
1.6MB

MD5
4b7020374dfa0f17f7ef7c596c0342c5

SHA1
ce5449930e2ce2b402522fb853badd14f68529a0

SHA256
4929d6adbf409eced403da5b518ad2772bc6165e810e98b62ccb6e8e5419f67a

SHA512
a2ab5586dee6bcf4cd5809eed7b5f902eb448961f6e1d66ae7ec7ea29759e192d51780fd095a3982db1a113eb7e30463696d3d525e2bbea71aa51346db74d7a6

Download Submit
C:\Windows\System\AkhfUPa.exe

Filesize
1.6MB

MD5
2eab03bcb823fb1ae1e66e144a172968

SHA1
3f0b6fa14588887f4b17f21b82011958e4992010

SHA256
1f00271ed4e9fff28535d7166e9df705bc826dada9c26654b4a782b42fbc42d5

SHA512
62c315d5c3bddce1cb8a8ffa898d309555d6a958ede34d033fbe83294a9d1a54c4cc04f8b31646c9ea73759e3ef02f1ef33f3dc10e9cb13d560886ec5d7ae057

Download Submit
C:\Windows\System\CaLTwtT.exe

Filesize
1.6MB

MD5
187bbff3168ee70c069a598d10fe1989

SHA1
513c932b47ffed7ed0dbbe6d711785ea50e0da6a

SHA256
28f21ecce31cd77a928affc7f6a0b14ed4101f6af680862ae8bd12007353c242

SHA512
39e2e3fa537c8715f5052d3a0957cce1856029f22d234bdf3781c9877103857807d54b4afc4c999e0fc209412f3989ee4158d716f5cb237fe38e7afabf98d68c

Download Submit
C:\Windows\System\HsVlnGA.exe

Filesize
1.6MB

MD5
2c3e6e2f766a5b06b396936850dca83f

SHA1
089a2aff7aaeef7ca2cf7794790e49db61b2da61

SHA256
e792e4384aab73dde0541e8fb030ff88fb0c88c5a741de7898f22ba0390f210a

SHA512
2a44df00ad5dfcfe038b233281f6c6a28888acfaccf397216b13aae4682bf19adf2f3d670eba149244257fd9b9442b31b2bc52647ccc507d25fa93790f26660b

Download Submit
C:\Windows\System\IUGXGTO.exe

Filesize
1.6MB

MD5
3f97f75e5ac46edf09a535608259a50d

SHA1
e57061ef29a95be5b8b85645a83956ed522999f6

SHA256
ab148b9a9462dd1ce2cf92a27b95cffdc0a8c4eff10151d14a27b0cd25a1454e

SHA512
48b5ed7c77b0b882395b143f5ae6228b8824004cda2ee559e170b554ea95d65077119602a7691445fb36d0db09b15cef309070f1e950e367cc3122af7dcaa111

Download Submit
C:\Windows\System\KuJWJHD.exe

Filesize
1.6MB

MD5
a65a219f1a17dce7a13f31d1f1d9604c

SHA1
06ba76f901810bbed1a5f72776a6aebde0245113

SHA256
7600430385d05005d96ae08f1d5c993328869c464cb8e14fb013f139ff26e0cc

SHA512
86d5b1746eb90b233357aad41eeb59dace352c7249f4b49d2e3e675fc0d9dd39f8f0194ceb03676753fffa174b0bdaec245c5eded560788c559db621ebd22f51

Download Submit
C:\Windows\System\MWKFsvv.exe

Filesize
1.6MB

MD5
6222ff3c1c58a5a25af2c47ff80c5223

SHA1
bbcf9346b7ef52e3c2a6266efdcc10a30b46403f

SHA256
78ba8eea971726656fbf4f7576166c189831c449d64e935be89989b26f8615cb

SHA512
9875b6861d4aff3c4f9144a5c26fa2d2a9a8de64541996c1777c43db927ef9cab7eb3ea59af5169081b38a83802c212995b4e0fae8c8e89a641919b1cb00e4b3

Download Submit
C:\Windows\System\OMLsQTw.exe

Filesize
1.6MB

MD5
ee12866314264fd3453da0ee928f39dd

SHA1
940e72edee533f5c9cb6a0cf0e40253662d48557

SHA256
87d9250c134c7092be83e47be215984e11c84ec3c30f4f57537e36a18bdc6817

SHA512
17bc4351876e3c05c6d329db204087d6b082b0c3a26dac47077d704e66dded68aff9665f7037405f06580b891baa9117add4dbc3c709bbad5ccc9a0fabf0436b

Download Submit
C:\Windows\System\OQumEJB.exe

Filesize
1.6MB

MD5
fa6ac78fc6d1c2d051cbaf4714ebd64f

SHA1
6329dc5886e62a55dc2a179602ed3caad5e0a25f

SHA256
d42a04cd56e60e1b52e5132be3416f604a20ae07fe5dd5a9264d442f694740c8

SHA512
439ab58d9982a9c1bcd2674a49d8170229fc6b990020a66de7f85de7d9ef322d1fda2555c917c51145ebcd262680bbad82ed54881dbe61cd7ed800aa2c13f73e

Download Submit
C:\Windows\System\OvmWOAQ.exe

Filesize
1.6MB

MD5
ae2a8302afaf2f0e4c884d97c17ec365

SHA1
41bcbd45ed5718c3b2bcf57909712d2b937b6956

SHA256
65466c66533eca0a541fa1e6afd8f8826a4d637ce389004b92ebd4b5255bc0e5

SHA512
7ea960411c4dc29cc3bb7dc9f5ee25dcced150ab10936ae6e090793e580d739737d6790ed7913a116152dddd79a61cf6abcec5eebb48eb7656f17905faf0ad37

Download Submit
C:\Windows\System\QVTNpoD.exe

Filesize
1.6MB

MD5
d5fe05ed92fa7585ae5c0d98d3c42cdb

SHA1
8b4e239dbaa4a6a23a40de85b3e7991671e14c0f

SHA256
f2f0c0238033b685d831cbf5b9b97d40116633ea637bf0e4a2a91418162dcda4

SHA512
8eb34ed4f8b41384c2c439745568652628f7c737d0f85b5bc0259799ccf059d41e419002ed23026ee70f4de81c4469e7dd03abe66139c653fa8a6fd852290cbf

Download Submit
C:\Windows\System\TYivkmx.exe

Filesize
1.6MB

MD5
e5b9e366c004cb71d3ea977aedbb7ab5

SHA1
5b6e168126b6643edf0aa3443ff48ec1aa979666

SHA256
7773274075b2011f6d7a1c5c39816bf4722a266bf1669a1dab10380151d37258

SHA512
18f57d20d335f37dcedce90a8a03e940c3cde7f1c0b3ecd6adb911a4d624e7f3b8219ab39ac99634893d988419a00000d6fdb55edfecdd5bbceb4544f009f72c

Download Submit
C:\Windows\System\TuVJmrv.exe

Filesize
1.6MB

MD5
86968a8a2a4d9a43645e3d189a872175

SHA1
b3ec694c626106f56104bfc4957ef6139a447891

SHA256
51ba205d491c766f357a2b0fff9737ea289b5756ec9e4821a5eec19fd2caf4f9

SHA512
fc28225c44e1e322393cc4b60d7ceea44468ab3387213941960795b1a1aa04f362cc826c348d948b48a219a20e5a085ec45dc53fe5e2ee9d825fe5b4e2610a3d

Download Submit
C:\Windows\System\VdsYBlP.exe

Filesize
1.6MB

MD5
c2f0e42271548b7304d69ec83a5bf3fa

SHA1
330cc0461cef936e2b846b12c01cb188d273241f

SHA256
806a71785c245b479d066d6e7ba6830c1b9b563da17a85711fee20bde5ef339a

SHA512
c90cb5940f5497a1d1857cb8a20cc20e4e398d83c7059efb0eabcd3d350f94d491de3d0440343dd6dca5a26574b252f284cefd10330a96af517121921d44eef1

Download Submit
C:\Windows\System\WZPQXus.exe

Filesize
1.6MB

MD5
301c7f8f8cbd161ab32ad196707d5b1f

SHA1
9e02b884265e27ef4f87b675c59ba2a7448faa96

SHA256
d89e9c0527d2ad56980c38a3535dfff59fe881ac948d0aea45b98848e03eecce

SHA512
68fced4d7377720c501922c5020ba1d4ae9d777b87922721526f18251f01a6dc1425be54258c27c6a863936d23746f8b3f585fb729eb428ee3ca42a8326f08fe

Download Submit
C:\Windows\System\cNwXoxi.exe

Filesize
1.6MB

MD5
87d53ad5f2374c724a86678f6cbdeffa

SHA1
b9b3d28ac6c332abe56e8c9219e99d3681a51327

SHA256
629b27bb9dc3299839d56a6546b9842785c8055db0e25567607a47afad237ec5

SHA512
340545758f71f858758bfbb0b2357d064f50c9f97f1bda1d35a1862af2c715e32bc297f5c31130cd7a69adef7163c283e4e9afedfefbbf91930f78de1878965e

Download Submit
C:\Windows\System\dcMwPGq.exe

Filesize
1.6MB

MD5
1f47a9927dda3f952765d63411faf702

SHA1
93cd2004ffbe86eefd103037e5d1ff76d353ebd8

SHA256
4abbaa5a5c569e32c5d8197e78b95a1cdb4e4dba28734f16b3f1f2de1b59c7d1

SHA512
7067341602dfa450c8dcde6564466a2a907ebc21977e322bea4d1ebe56ee508417f2d760dcd60e2d4c680d0a6ee136ab3657e476718c1e809f64fb5143bf4ade

Download Submit
C:\Windows\System\fRCPJld.exe

Filesize
1.6MB

MD5
98f41a852e508d9e0ea92c50b1260510

SHA1
34ebcf9d70bfd52a8cbce58543e4dde6db8ff295

SHA256
4e8c2735222af67b9d6ff31ed6a877e9cd554d83b0ac11da940d4c7a669a0564

SHA512
b5ad2f9ae9c5031673756c5423b44d388023acaa5cfe442a5e4016134319178a655c6a8bf8324b0d9b34887a25773882fc36ad2612b0edb51ee4b7b2983694ac

Download Submit
C:\Windows\System\fZhupdh.exe

Filesize
1.6MB

MD5
66dbac5fb744186de9bbef5641009de6

SHA1
76146bcdafa5b8ee537e4a4139a71dd1d66b6b62

SHA256
ae90d9aea50139921772ca0338549ca898d10a9f549bca115ed0e05ea29e433e

SHA512
ab380481ae27af5f696b80b49b72ec92343433dffac54891a778cc707021e71021d3271a57841f6a8ec53aedbe59ed3b13f966bdf97b88f20df9fd5d4e4a8bd4

Download Submit
C:\Windows\System\fcMoiXA.exe

Filesize
1.6MB

MD5
3c367a33a1ee8df5cfa4001467dc36c4

SHA1
2e6fc3ad2efab0f8c594a53c34f5c9b33bae9127

SHA256
386dd5890b818de4d94c8a5346c3f40c9acca5f8c7bbd81e50d4134ae840b0d8

SHA512
c9ee152a6342b4f22c50edc17e72cd196fdabd49c592651ff8f15cd140caaa5d8bf4ac19a2809c6528b685ab3a7abfb1abee5b8b4a119f51ba95ad7f2f631e5a

Download Submit
C:\Windows\System\fsrgBMz.exe

Filesize
1.6MB

MD5
c0bafe491aa3cf683c2b5be24427cf1e

SHA1
120b155119095c789efdd2dcd94dba22ffdbbdf3

SHA256
ae438560b4eadbcb559c0f9ae5e50eac3063c9749f3f88d92fa5dd61a68cff13

SHA512
5a4a5302c4d72247c395d467f28721f732150579ce642b0d83e125198f3321cc7ebc3288a8dc133e92a82117927f9c4f5b130b32f92222d2f918d0d4c1ea212e

Download Submit
C:\Windows\System\gLERZIT.exe

Filesize
1.6MB

MD5
12d9a4eb5032e625badf7337103a71c7

SHA1
810de84d3e7bd9981e5864055dd4dd3ffd09513c

SHA256
fd30d2efed75a28514687bed8049f2468b74239322e94f8f704f6e4b033370ef

SHA512
52e13b6299421e6db746ce68c86774a943980b5679fda5ef853d508089be3f74d0f7ea9159ba445c386810f241ced3b34bbf2fc941c55c2ed28891da1608e386

Download Submit
C:\Windows\System\ilJFAHf.exe

Filesize
1.6MB

MD5
9bbfd5a2f404f00870886bdb4e4f34f9

SHA1
7e08cb689fc70ba945ceb4014e46332d93360393

SHA256
bb49cce331a473ebd4013c1e496bf6cd4b654822964bb0bab79f146f7cb379e5

SHA512
c0e5c4beec1433c2be499f536812d01237e7c08fea25982ec1cbbd2b6b61a545ce0c574f32ee49dafa54825d1eaf5bc110316a2dc164ab49aca2493e8b861843

Download Submit
C:\Windows\System\lCeRIjT.exe

Filesize
1.6MB

MD5
b70ee674baf32b7f7521e3e72c446fd3

SHA1
71e842ebed400d0cd1d6498bf85887be5b889e9f

SHA256
e9522375fa08d18f7f501bfda15eedc42b9e1fa480b8fdf22e5437ca2f112e24

SHA512
739b4ca9bbd7ab0b8e8a081c27f318fa458545ce7cde12640f41159d7b31a61f5b57b7eda11969c56b100102730c47355a18282f1d82a0ac7f2946df5af33716

Download Submit
C:\Windows\System\myeJVGm.exe

Filesize
1.6MB

MD5
da0f1e602b79f96ab65ca382c1cd55d1

SHA1
75a7d2260702cfe8e0de541e363ff5e16dc8a9f7

SHA256
a1568032c645421bfe040e592da4724e74d2ee099d5c80945d29b5612b8ca464

SHA512
9864ec09e4830f44fb3f36fac2ee9eec354bd9b9378fe99d97c80b7dd0c1a83a4330459122c9696018d316d747ab493fdb9ddcd44dded8153ce5182c5715cc70

Download Submit
C:\Windows\System\nDRJfcD.exe

Filesize
1.6MB

MD5
fbd38c8c799d84872a226e4849885e62

SHA1
746c0ce51521c7891c18365a7ae174c9495118be

SHA256
7ec2636191b507bd7f902408d62aa9c788e6d8b98084185ecc08af9c9ba63b67

SHA512
6d762427bb08637a837f071ba88a41b30bbf3f53588ae2b983445d1edfd39dc7e23bd955398fb54c639223c98ac8e6776953b18d3b6dcc327e76afd3fede15cd

Download Submit
C:\Windows\System\nMQTTzK.exe

Filesize
1.6MB

MD5
86c5ad70e06283948aa1196c7b07a212

SHA1
8106b043d6e533a63e90ff1122d81f028a387af6

SHA256
e77e4f85113ad482772753985ab9b5c812d3d5c5d39039df4a308a1f51bd898b

SHA512
5aef6eb18e2bc229b25290bcbcb408f50fc42f032c397d2394de09056baac814a2f61b663e492d8788d5752942474a93b681182b0bec809b3ef92d937ea84c97

Download Submit
C:\Windows\System\rAjCDVk.exe

Filesize
1.6MB

MD5
0d50ced0a969ec59f98b21fa025c7928

SHA1
2ea7591f7bee77fb64ebdf55a0c007cc96b6f1c6

SHA256
47935b0948a3e3d610b3566b98e377e74627f64012e0980e134719a873e22f47

SHA512
de85222b70688b87822d56017e651fb1152925c9f489b571a05207a27d1f74c810e2d6ba43f3289d91889190d9de7f51095c75ad1db8737ff6d7a9c9ba16b8a9

Download Submit
C:\Windows\System\rFjCngG.exe

Filesize
1.6MB

MD5
5c1529d33bc77bd9a3abca645577c6a1

SHA1
031e57e66e6c433b3e89ab119c5410308dad3265

SHA256
146421f1fa53d5f444617bad2fc3e0a3c34ed8181425aba7a70727821d110f66

SHA512
21aded5969a613a82c803cd229105bc3a5c45ab656e9475c2c04da60fc5131353c4b4dd89ef7f003c22e14e19aea8845cae542bef7148146b0730dafb2a895c5

Download Submit
C:\Windows\System\rXgqrpZ.exe

Filesize
1.6MB

MD5
a3ef1a984683506ab37040ec3f5445a5

SHA1
63d93af829200c4407ec4d7b118c1b8b6b246cb6

SHA256
03c5a584d43fe12d21a053b25e8836c46b502f89e622141e78dce0dead87479a

SHA512
b675c9b908fe39c0ba08ec3c02e0f0e86a46dd0881f4b768fd1d4644200c2e9eea913ec1552f90335843440606109003f0fd97df0d9c3d3d009e7cacb154bf37

Download Submit
C:\Windows\System\uwrLAbz.exe

Filesize
1.6MB

MD5
f9906d11d5e998e0f1bb133654fb5b69

SHA1
64cec96dd208b23c4c52ed96ac3ed0c369f3453e

SHA256
56f96685a0523182b030e758f41532c9a9b53c6739875f6227953dc4e6639c52

SHA512
1c60ce6efb14b2e161b11f7663e7e283b0527927974c8cc954ad26c0b8d48366c2608e5a7404fdeefb9015b72b987564737637d001ac574705409e5019113ddb

Download Submit
C:\Windows\System\vvYtfIf.exe

Filesize
1.6MB

MD5
f44e9282fdfb9e8b881ee2a3b6ed9e54

SHA1
9ba22af129a24313e247460e1921d8b1dced42bd

SHA256
5b7acb882e1c792e0b8b476d116f12957f11e9e87e8a67e92a8c30857ab4b8bf

SHA512
c6a8c20b6cd6e1ec92ec66c7691887d1b3a4cef86bc21941ed5b650826fdfbf1e969cd6b43484281558aa28fda8d312116ded27ad31c94ca7f880b1d0f5aff7b

Download Submit
C:\Windows\System\yQsBIjW.exe

Filesize
1.6MB

MD5
53cef40f6e6ce9304eb9dda0241d8c6e

SHA1
690faa0db654e6130cc43fd6d3433614a4401a6e

SHA256
5c3124befc5dd0ab6e8f34f33b509ee5068914fad50a1168df09cc69e8a39724

SHA512
d0e8cd8bb99d0233493a3c42ccb21238322c009b02bdedfe333eafe24bef22a2613206481ee5d6a956470c9da60728f25de999472e60e5c44082c586947b7806

Download Submit
memory/2856-0-0x000001F43D940000-0x000001F43D950000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads