xmrig | b356978369e75682097aa7a6f158be2e440ffb9b77c253f51a89e6d440b9031f

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
24-12-2024 00:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b356978369e75682097aa7a6f158be2e440ffb9b77c253f51a89e6d440b9031f.exe
Size

1.9MB
MD5

17151990822fff6b5cdc010736bfe1d2
SHA1

ba7807876f728dd38d1624d1e833ec31d8bd46cf
SHA256

b356978369e75682097aa7a6f158be2e440ffb9b77c253f51a89e6d440b9031f
SHA512

d4653828b88619ad52547542e1bd90c22e04a91fee1f907bc2b4e89b8b282cf5e214e63854db27ece8954078884a5994c711c6b2bebf15d184dae69da1225ac1
SSDEEP

49152:GezaTF8FcNkNdfE0pZ9ozttwIRxj4c5yOBZnmxZ8zouZxlvy:GemTLkNdfE0pZyO

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 33 IoCs

miner

resource	yara_rule
behavioral2/files/0x000b000000023bc0-3.dat	xmrig
behavioral2/files/0x0007000000023c9b-11.dat	xmrig
behavioral2/files/0x000c000000023c92-12.dat	xmrig
behavioral2/files/0x0007000000023c9c-19.dat	xmrig
behavioral2/files/0x0007000000023c9d-24.dat	xmrig
behavioral2/files/0x0007000000023c9f-33.dat	xmrig
behavioral2/files/0x0007000000023ca0-37.dat	xmrig
behavioral2/files/0x0007000000023cad-99.dat	xmrig
behavioral2/files/0x0007000000023caf-113.dat	xmrig
behavioral2/files/0x0007000000023cb7-152.dat	xmrig
behavioral2/files/0x0007000000023cba-162.dat	xmrig
behavioral2/files/0x0007000000023cb8-160.dat	xmrig
behavioral2/files/0x0007000000023cb9-157.dat	xmrig
behavioral2/files/0x0007000000023cb6-148.dat	xmrig
behavioral2/files/0x0007000000023cb5-143.dat	xmrig
behavioral2/files/0x0007000000023cb4-138.dat	xmrig
behavioral2/files/0x0007000000023cb3-133.dat	xmrig
behavioral2/files/0x0007000000023cb2-127.dat	xmrig
behavioral2/files/0x0007000000023cb1-123.dat	xmrig
behavioral2/files/0x0007000000023cb0-117.dat	xmrig
behavioral2/files/0x0007000000023cae-105.dat	xmrig
behavioral2/files/0x0007000000023cac-95.dat	xmrig
behavioral2/files/0x0007000000023cab-90.dat	xmrig
behavioral2/files/0x0007000000023caa-85.dat	xmrig
behavioral2/files/0x0007000000023ca9-80.dat	xmrig
behavioral2/files/0x0007000000023ca8-75.dat	xmrig
behavioral2/files/0x0007000000023ca7-70.dat	xmrig
behavioral2/files/0x0007000000023ca6-65.dat	xmrig
behavioral2/files/0x0007000000023ca5-60.dat	xmrig
behavioral2/files/0x0007000000023ca4-55.dat	xmrig
behavioral2/files/0x0007000000023ca3-50.dat	xmrig
behavioral2/files/0x0007000000023ca2-45.dat	xmrig
behavioral2/files/0x0007000000023ca1-43.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
1236	AaNkDZC.exe
912	eCfkZas.exe
4244	RmmoJqC.exe
4252	QbIvWtq.exe
736	YTmGGzZ.exe
3720	oValgEd.exe
3012	THJdSYA.exe
5072	rMEhmER.exe
4980	NZyDbSG.exe
3960	soHBDvZ.exe
2128	lWFoYSB.exe
1400	qQsCumW.exe
3760	fDMarys.exe
4500	DWzRpfA.exe
3408	yGtdIgt.exe
4696	YSERkIx.exe
3988	aOGqggR.exe
3640	pnoDYnr.exe
2236	RYqpTlb.exe
2072	fzVBdZF.exe
3664	qkfOYwV.exe
624	erhAkba.exe
2508	ouZgvKd.exe
3472	eMffPYW.exe
4012	LYjvQKG.exe
2640	AffiUne.exe
3840	aeNGYpZ.exe
836	Qifebke.exe
3512	evwflDw.exe
3364	cHGkoRZ.exe
3320	sSWrXSc.exe
2080	gUxoLMq.exe
1772	rCdLGtL.exe
5028	ozzHSlC.exe
4772	qebOAKG.exe
2340	EmIzCeS.exe
2652	lWvQrGX.exe
2224	lkeoUKW.exe
1728	YWDJzfd.exe
2116	eLaxgoX.exe
1636	VrYMQNn.exe
1564	ZkYAGbd.exe
4304	MXVPuaQ.exe
972	sHmphMi.exe
2968	IudjIHe.exe
2868	azvzAmu.exe
2240	nVXKUlw.exe
2344	qXwTFxk.exe
1148	uFXZCIj.exe
5020	DkbdfzU.exe
1744	NoAkgPz.exe
3684	RlDKFbT.exe
3020	gmbTgXC.exe
3628	rAbUGAg.exe
4316	gwuRdhC.exe
804	jXHMGhl.exe
3064	ELvuUzS.exe
4996	NtafUDQ.exe
3860	Bxaenty.exe
2576	nizEytY.exe
2388	CyncPVY.exe
4348	xhdKcVr.exe
404	FztMVGo.exe
2928	bsTmzVc.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\ELgJolU.exe	b356978369e75682097aa7a6f158be2e440ffb9b77c253f51a89e6d440b9031f.exe
File created	C:\Windows\System\LwGmKRS.exe	b356978369e75682097aa7a6f158be2e440ffb9b77c253f51a89e6d440b9031f.exe
File created	C:\Windows\System\qgFvkmi.exe	b356978369e75682097aa7a6f158be2e440ffb9b77c253f51a89e6d440b9031f.exe
File created	C:\Windows\System\pXajUYy.exe	b356978369e75682097aa7a6f158be2e440ffb9b77c253f51a89e6d440b9031f.exe
File created	C:\Windows\System\oZZkuAX.exe	b356978369e75682097aa7a6f158be2e440ffb9b77c253f51a89e6d440b9031f.exe
File created	C:\Windows\System\RSNCaSc.exe	b356978369e75682097aa7a6f158be2e440ffb9b77c253f51a89e6d440b9031f.exe
File created	C:\Windows\System\AyJyoDe.exe	b356978369e75682097aa7a6f158be2e440ffb9b77c253f51a89e6d440b9031f.exe
File created	C:\Windows\System\qYulZZz.exe	b356978369e75682097aa7a6f158be2e440ffb9b77c253f51a89e6d440b9031f.exe
File created	C:\Windows\System\vIfieiI.exe	b356978369e75682097aa7a6f158be2e440ffb9b77c253f51a89e6d440b9031f.exe
File created	C:\Windows\System\UgUJiuj.exe	b356978369e75682097aa7a6f158be2e440ffb9b77c253f51a89e6d440b9031f.exe
File created	C:\Windows\System\JkSlHuT.exe	b356978369e75682097aa7a6f158be2e440ffb9b77c253f51a89e6d440b9031f.exe
File created	C:\Windows\System\HgFsFmE.exe	b356978369e75682097aa7a6f158be2e440ffb9b77c253f51a89e6d440b9031f.exe
File created	C:\Windows\System\kbgRiAg.exe	b356978369e75682097aa7a6f158be2e440ffb9b77c253f51a89e6d440b9031f.exe
File created	C:\Windows\System\jGdNHsI.exe	b356978369e75682097aa7a6f158be2e440ffb9b77c253f51a89e6d440b9031f.exe
File created	C:\Windows\System\sEiOCkh.exe	b356978369e75682097aa7a6f158be2e440ffb9b77c253f51a89e6d440b9031f.exe
File created	C:\Windows\System\cpffMxo.exe	b356978369e75682097aa7a6f158be2e440ffb9b77c253f51a89e6d440b9031f.exe
File created	C:\Windows\System\GeAdYjJ.exe	b356978369e75682097aa7a6f158be2e440ffb9b77c253f51a89e6d440b9031f.exe
File created	C:\Windows\System\CrfqCLQ.exe	b356978369e75682097aa7a6f158be2e440ffb9b77c253f51a89e6d440b9031f.exe
File created	C:\Windows\System\NyaKpPv.exe	b356978369e75682097aa7a6f158be2e440ffb9b77c253f51a89e6d440b9031f.exe
File created	C:\Windows\System\rZwfSsq.exe	b356978369e75682097aa7a6f158be2e440ffb9b77c253f51a89e6d440b9031f.exe
File created	C:\Windows\System\AymzdSR.exe	b356978369e75682097aa7a6f158be2e440ffb9b77c253f51a89e6d440b9031f.exe
File created	C:\Windows\System\EGIxIVg.exe	b356978369e75682097aa7a6f158be2e440ffb9b77c253f51a89e6d440b9031f.exe
File created	C:\Windows\System\thxIeaR.exe	b356978369e75682097aa7a6f158be2e440ffb9b77c253f51a89e6d440b9031f.exe
File created	C:\Windows\System\nMMBLty.exe	b356978369e75682097aa7a6f158be2e440ffb9b77c253f51a89e6d440b9031f.exe
File created	C:\Windows\System\tZiOWuo.exe	b356978369e75682097aa7a6f158be2e440ffb9b77c253f51a89e6d440b9031f.exe
File created	C:\Windows\System\sazwtFS.exe	b356978369e75682097aa7a6f158be2e440ffb9b77c253f51a89e6d440b9031f.exe
File created	C:\Windows\System\ZXtMKCw.exe	b356978369e75682097aa7a6f158be2e440ffb9b77c253f51a89e6d440b9031f.exe
File created	C:\Windows\System\gwuRdhC.exe	b356978369e75682097aa7a6f158be2e440ffb9b77c253f51a89e6d440b9031f.exe
File created	C:\Windows\System\UDVagtL.exe	b356978369e75682097aa7a6f158be2e440ffb9b77c253f51a89e6d440b9031f.exe
File created	C:\Windows\System\XEJIXuE.exe	b356978369e75682097aa7a6f158be2e440ffb9b77c253f51a89e6d440b9031f.exe
File created	C:\Windows\System\armOIXM.exe	b356978369e75682097aa7a6f158be2e440ffb9b77c253f51a89e6d440b9031f.exe
File created	C:\Windows\System\rGUbYJX.exe	b356978369e75682097aa7a6f158be2e440ffb9b77c253f51a89e6d440b9031f.exe
File created	C:\Windows\System\rnPDmCA.exe	b356978369e75682097aa7a6f158be2e440ffb9b77c253f51a89e6d440b9031f.exe
File created	C:\Windows\System\bdewOkL.exe	b356978369e75682097aa7a6f158be2e440ffb9b77c253f51a89e6d440b9031f.exe
File created	C:\Windows\System\CmXPSDW.exe	b356978369e75682097aa7a6f158be2e440ffb9b77c253f51a89e6d440b9031f.exe
File created	C:\Windows\System\hnqVtVu.exe	b356978369e75682097aa7a6f158be2e440ffb9b77c253f51a89e6d440b9031f.exe
File created	C:\Windows\System\ATIlwYp.exe	b356978369e75682097aa7a6f158be2e440ffb9b77c253f51a89e6d440b9031f.exe
File created	C:\Windows\System\VKFbrib.exe	b356978369e75682097aa7a6f158be2e440ffb9b77c253f51a89e6d440b9031f.exe
File created	C:\Windows\System\hZbILlF.exe	b356978369e75682097aa7a6f158be2e440ffb9b77c253f51a89e6d440b9031f.exe
File created	C:\Windows\System\tgjtlmK.exe	b356978369e75682097aa7a6f158be2e440ffb9b77c253f51a89e6d440b9031f.exe
File created	C:\Windows\System\cYcfKnP.exe	b356978369e75682097aa7a6f158be2e440ffb9b77c253f51a89e6d440b9031f.exe
File created	C:\Windows\System\eCfkZas.exe	b356978369e75682097aa7a6f158be2e440ffb9b77c253f51a89e6d440b9031f.exe
File created	C:\Windows\System\XUORsrs.exe	b356978369e75682097aa7a6f158be2e440ffb9b77c253f51a89e6d440b9031f.exe
File created	C:\Windows\System\uvPdWmQ.exe	b356978369e75682097aa7a6f158be2e440ffb9b77c253f51a89e6d440b9031f.exe
File created	C:\Windows\System\xhDSksx.exe	b356978369e75682097aa7a6f158be2e440ffb9b77c253f51a89e6d440b9031f.exe
File created	C:\Windows\System\ZqOcUtl.exe	b356978369e75682097aa7a6f158be2e440ffb9b77c253f51a89e6d440b9031f.exe
File created	C:\Windows\System\oSKHBvv.exe	b356978369e75682097aa7a6f158be2e440ffb9b77c253f51a89e6d440b9031f.exe
File created	C:\Windows\System\SJWwwYz.exe	b356978369e75682097aa7a6f158be2e440ffb9b77c253f51a89e6d440b9031f.exe
File created	C:\Windows\System\nIawPmC.exe	b356978369e75682097aa7a6f158be2e440ffb9b77c253f51a89e6d440b9031f.exe
File created	C:\Windows\System\ngHOLhw.exe	b356978369e75682097aa7a6f158be2e440ffb9b77c253f51a89e6d440b9031f.exe
File created	C:\Windows\System\aVVOpCm.exe	b356978369e75682097aa7a6f158be2e440ffb9b77c253f51a89e6d440b9031f.exe
File created	C:\Windows\System\CgtBzdw.exe	b356978369e75682097aa7a6f158be2e440ffb9b77c253f51a89e6d440b9031f.exe
File created	C:\Windows\System\wHENUTT.exe	b356978369e75682097aa7a6f158be2e440ffb9b77c253f51a89e6d440b9031f.exe
File created	C:\Windows\System\eDntqPT.exe	b356978369e75682097aa7a6f158be2e440ffb9b77c253f51a89e6d440b9031f.exe
File created	C:\Windows\System\OnnpwXj.exe	b356978369e75682097aa7a6f158be2e440ffb9b77c253f51a89e6d440b9031f.exe
File created	C:\Windows\System\WHUOIAA.exe	b356978369e75682097aa7a6f158be2e440ffb9b77c253f51a89e6d440b9031f.exe
File created	C:\Windows\System\XBsNDjc.exe	b356978369e75682097aa7a6f158be2e440ffb9b77c253f51a89e6d440b9031f.exe
File created	C:\Windows\System\pXwnbEy.exe	b356978369e75682097aa7a6f158be2e440ffb9b77c253f51a89e6d440b9031f.exe
File created	C:\Windows\System\FtUOMiS.exe	b356978369e75682097aa7a6f158be2e440ffb9b77c253f51a89e6d440b9031f.exe
File created	C:\Windows\System\XNtKCWj.exe	b356978369e75682097aa7a6f158be2e440ffb9b77c253f51a89e6d440b9031f.exe
File created	C:\Windows\System\UaUREDx.exe	b356978369e75682097aa7a6f158be2e440ffb9b77c253f51a89e6d440b9031f.exe
File created	C:\Windows\System\FMbXsaP.exe	b356978369e75682097aa7a6f158be2e440ffb9b77c253f51a89e6d440b9031f.exe
File created	C:\Windows\System\BeCTJpH.exe	b356978369e75682097aa7a6f158be2e440ffb9b77c253f51a89e6d440b9031f.exe
File created	C:\Windows\System\VMltOFK.exe	b356978369e75682097aa7a6f158be2e440ffb9b77c253f51a89e6d440b9031f.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	16508	dwm.exe
Token: SeChangeNotifyPrivilege	16508	dwm.exe
Token: 33	16508	dwm.exe
Token: SeIncBasePriorityPrivilege	16508	dwm.exe
Token: SeShutdownPrivilege	16508	dwm.exe
Token: SeCreatePagefilePrivilege	16508	dwm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4684 wrote to memory of 1236	4684	b356978369e75682097aa7a6f158be2e440ffb9b77c253f51a89e6d440b9031f.exe	84
PID 4684 wrote to memory of 1236	4684	b356978369e75682097aa7a6f158be2e440ffb9b77c253f51a89e6d440b9031f.exe	84
PID 4684 wrote to memory of 4244	4684	b356978369e75682097aa7a6f158be2e440ffb9b77c253f51a89e6d440b9031f.exe	85
PID 4684 wrote to memory of 4244	4684	b356978369e75682097aa7a6f158be2e440ffb9b77c253f51a89e6d440b9031f.exe	85
PID 4684 wrote to memory of 912	4684	b356978369e75682097aa7a6f158be2e440ffb9b77c253f51a89e6d440b9031f.exe	86
PID 4684 wrote to memory of 912	4684	b356978369e75682097aa7a6f158be2e440ffb9b77c253f51a89e6d440b9031f.exe	86
PID 4684 wrote to memory of 4252	4684	b356978369e75682097aa7a6f158be2e440ffb9b77c253f51a89e6d440b9031f.exe	87
PID 4684 wrote to memory of 4252	4684	b356978369e75682097aa7a6f158be2e440ffb9b77c253f51a89e6d440b9031f.exe	87
PID 4684 wrote to memory of 736	4684	b356978369e75682097aa7a6f158be2e440ffb9b77c253f51a89e6d440b9031f.exe	88
PID 4684 wrote to memory of 736	4684	b356978369e75682097aa7a6f158be2e440ffb9b77c253f51a89e6d440b9031f.exe	88
PID 4684 wrote to memory of 3720	4684	b356978369e75682097aa7a6f158be2e440ffb9b77c253f51a89e6d440b9031f.exe	89
PID 4684 wrote to memory of 3720	4684	b356978369e75682097aa7a6f158be2e440ffb9b77c253f51a89e6d440b9031f.exe	89
PID 4684 wrote to memory of 3012	4684	b356978369e75682097aa7a6f158be2e440ffb9b77c253f51a89e6d440b9031f.exe	90
PID 4684 wrote to memory of 3012	4684	b356978369e75682097aa7a6f158be2e440ffb9b77c253f51a89e6d440b9031f.exe	90
PID 4684 wrote to memory of 5072	4684	b356978369e75682097aa7a6f158be2e440ffb9b77c253f51a89e6d440b9031f.exe	91
PID 4684 wrote to memory of 5072	4684	b356978369e75682097aa7a6f158be2e440ffb9b77c253f51a89e6d440b9031f.exe	91
PID 4684 wrote to memory of 4980	4684	b356978369e75682097aa7a6f158be2e440ffb9b77c253f51a89e6d440b9031f.exe	92
PID 4684 wrote to memory of 4980	4684	b356978369e75682097aa7a6f158be2e440ffb9b77c253f51a89e6d440b9031f.exe	92
PID 4684 wrote to memory of 3960	4684	b356978369e75682097aa7a6f158be2e440ffb9b77c253f51a89e6d440b9031f.exe	93
PID 4684 wrote to memory of 3960	4684	b356978369e75682097aa7a6f158be2e440ffb9b77c253f51a89e6d440b9031f.exe	93
PID 4684 wrote to memory of 2128	4684	b356978369e75682097aa7a6f158be2e440ffb9b77c253f51a89e6d440b9031f.exe	94
PID 4684 wrote to memory of 2128	4684	b356978369e75682097aa7a6f158be2e440ffb9b77c253f51a89e6d440b9031f.exe	94
PID 4684 wrote to memory of 1400	4684	b356978369e75682097aa7a6f158be2e440ffb9b77c253f51a89e6d440b9031f.exe	95
PID 4684 wrote to memory of 1400	4684	b356978369e75682097aa7a6f158be2e440ffb9b77c253f51a89e6d440b9031f.exe	95
PID 4684 wrote to memory of 3760	4684	b356978369e75682097aa7a6f158be2e440ffb9b77c253f51a89e6d440b9031f.exe	96
PID 4684 wrote to memory of 3760	4684	b356978369e75682097aa7a6f158be2e440ffb9b77c253f51a89e6d440b9031f.exe	96
PID 4684 wrote to memory of 4500	4684	b356978369e75682097aa7a6f158be2e440ffb9b77c253f51a89e6d440b9031f.exe	97
PID 4684 wrote to memory of 4500	4684	b356978369e75682097aa7a6f158be2e440ffb9b77c253f51a89e6d440b9031f.exe	97
PID 4684 wrote to memory of 3408	4684	b356978369e75682097aa7a6f158be2e440ffb9b77c253f51a89e6d440b9031f.exe	98
PID 4684 wrote to memory of 3408	4684	b356978369e75682097aa7a6f158be2e440ffb9b77c253f51a89e6d440b9031f.exe	98
PID 4684 wrote to memory of 4696	4684	b356978369e75682097aa7a6f158be2e440ffb9b77c253f51a89e6d440b9031f.exe	99
PID 4684 wrote to memory of 4696	4684	b356978369e75682097aa7a6f158be2e440ffb9b77c253f51a89e6d440b9031f.exe	99
PID 4684 wrote to memory of 3988	4684	b356978369e75682097aa7a6f158be2e440ffb9b77c253f51a89e6d440b9031f.exe	100
PID 4684 wrote to memory of 3988	4684	b356978369e75682097aa7a6f158be2e440ffb9b77c253f51a89e6d440b9031f.exe	100
PID 4684 wrote to memory of 3640	4684	b356978369e75682097aa7a6f158be2e440ffb9b77c253f51a89e6d440b9031f.exe	101
PID 4684 wrote to memory of 3640	4684	b356978369e75682097aa7a6f158be2e440ffb9b77c253f51a89e6d440b9031f.exe	101
PID 4684 wrote to memory of 2236	4684	b356978369e75682097aa7a6f158be2e440ffb9b77c253f51a89e6d440b9031f.exe	102
PID 4684 wrote to memory of 2236	4684	b356978369e75682097aa7a6f158be2e440ffb9b77c253f51a89e6d440b9031f.exe	102
PID 4684 wrote to memory of 2072	4684	b356978369e75682097aa7a6f158be2e440ffb9b77c253f51a89e6d440b9031f.exe	103
PID 4684 wrote to memory of 2072	4684	b356978369e75682097aa7a6f158be2e440ffb9b77c253f51a89e6d440b9031f.exe	103
PID 4684 wrote to memory of 3664	4684	b356978369e75682097aa7a6f158be2e440ffb9b77c253f51a89e6d440b9031f.exe	104
PID 4684 wrote to memory of 3664	4684	b356978369e75682097aa7a6f158be2e440ffb9b77c253f51a89e6d440b9031f.exe	104
PID 4684 wrote to memory of 624	4684	b356978369e75682097aa7a6f158be2e440ffb9b77c253f51a89e6d440b9031f.exe	105
PID 4684 wrote to memory of 624	4684	b356978369e75682097aa7a6f158be2e440ffb9b77c253f51a89e6d440b9031f.exe	105
PID 4684 wrote to memory of 2508	4684	b356978369e75682097aa7a6f158be2e440ffb9b77c253f51a89e6d440b9031f.exe	106
PID 4684 wrote to memory of 2508	4684	b356978369e75682097aa7a6f158be2e440ffb9b77c253f51a89e6d440b9031f.exe	106
PID 4684 wrote to memory of 3472	4684	b356978369e75682097aa7a6f158be2e440ffb9b77c253f51a89e6d440b9031f.exe	107
PID 4684 wrote to memory of 3472	4684	b356978369e75682097aa7a6f158be2e440ffb9b77c253f51a89e6d440b9031f.exe	107
PID 4684 wrote to memory of 4012	4684	b356978369e75682097aa7a6f158be2e440ffb9b77c253f51a89e6d440b9031f.exe	108
PID 4684 wrote to memory of 4012	4684	b356978369e75682097aa7a6f158be2e440ffb9b77c253f51a89e6d440b9031f.exe	108
PID 4684 wrote to memory of 2640	4684	b356978369e75682097aa7a6f158be2e440ffb9b77c253f51a89e6d440b9031f.exe	109
PID 4684 wrote to memory of 2640	4684	b356978369e75682097aa7a6f158be2e440ffb9b77c253f51a89e6d440b9031f.exe	109
PID 4684 wrote to memory of 3840	4684	b356978369e75682097aa7a6f158be2e440ffb9b77c253f51a89e6d440b9031f.exe	110
PID 4684 wrote to memory of 3840	4684	b356978369e75682097aa7a6f158be2e440ffb9b77c253f51a89e6d440b9031f.exe	110
PID 4684 wrote to memory of 836	4684	b356978369e75682097aa7a6f158be2e440ffb9b77c253f51a89e6d440b9031f.exe	111
PID 4684 wrote to memory of 836	4684	b356978369e75682097aa7a6f158be2e440ffb9b77c253f51a89e6d440b9031f.exe	111
PID 4684 wrote to memory of 3512	4684	b356978369e75682097aa7a6f158be2e440ffb9b77c253f51a89e6d440b9031f.exe	112
PID 4684 wrote to memory of 3512	4684	b356978369e75682097aa7a6f158be2e440ffb9b77c253f51a89e6d440b9031f.exe	112
PID 4684 wrote to memory of 3364	4684	b356978369e75682097aa7a6f158be2e440ffb9b77c253f51a89e6d440b9031f.exe	113
PID 4684 wrote to memory of 3364	4684	b356978369e75682097aa7a6f158be2e440ffb9b77c253f51a89e6d440b9031f.exe	113
PID 4684 wrote to memory of 3320	4684	b356978369e75682097aa7a6f158be2e440ffb9b77c253f51a89e6d440b9031f.exe	114
PID 4684 wrote to memory of 3320	4684	b356978369e75682097aa7a6f158be2e440ffb9b77c253f51a89e6d440b9031f.exe	114
PID 4684 wrote to memory of 2080	4684	b356978369e75682097aa7a6f158be2e440ffb9b77c253f51a89e6d440b9031f.exe	115
PID 4684 wrote to memory of 2080	4684	b356978369e75682097aa7a6f158be2e440ffb9b77c253f51a89e6d440b9031f.exe	115

C:\Users\Admin\AppData\Local\Temp\b356978369e75682097aa7a6f158be2e440ffb9b77c253f51a89e6d440b9031f.exe
"C:\Users\Admin\AppData\Local\Temp\b356978369e75682097aa7a6f158be2e440ffb9b77c253f51a89e6d440b9031f.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4684
- C:\Windows\System\AaNkDZC.exe
  C:\Windows\System\AaNkDZC.exe
  2⤵
  - Executes dropped EXE
  PID:1236
- C:\Windows\System\RmmoJqC.exe
  C:\Windows\System\RmmoJqC.exe
  2⤵
  - Executes dropped EXE
  PID:4244
- C:\Windows\System\eCfkZas.exe
  C:\Windows\System\eCfkZas.exe
  2⤵
  - Executes dropped EXE
  PID:912
- C:\Windows\System\QbIvWtq.exe
  C:\Windows\System\QbIvWtq.exe
  2⤵
  - Executes dropped EXE
  PID:4252
- C:\Windows\System\YTmGGzZ.exe
  C:\Windows\System\YTmGGzZ.exe
  2⤵
  - Executes dropped EXE
  PID:736
- C:\Windows\System\oValgEd.exe
  C:\Windows\System\oValgEd.exe
  2⤵
  - Executes dropped EXE
  PID:3720
- C:\Windows\System\THJdSYA.exe
  C:\Windows\System\THJdSYA.exe
  2⤵
  - Executes dropped EXE
  PID:3012
- C:\Windows\System\rMEhmER.exe
  C:\Windows\System\rMEhmER.exe
  2⤵
  - Executes dropped EXE
  PID:5072
- C:\Windows\System\NZyDbSG.exe
  C:\Windows\System\NZyDbSG.exe
  2⤵
  - Executes dropped EXE
  PID:4980
- C:\Windows\System\soHBDvZ.exe
  C:\Windows\System\soHBDvZ.exe
  2⤵
  - Executes dropped EXE
  PID:3960
- C:\Windows\System\lWFoYSB.exe
  C:\Windows\System\lWFoYSB.exe
  2⤵
  - Executes dropped EXE
  PID:2128
- C:\Windows\System\qQsCumW.exe
  C:\Windows\System\qQsCumW.exe
  2⤵
  - Executes dropped EXE
  PID:1400
- C:\Windows\System\fDMarys.exe
  C:\Windows\System\fDMarys.exe
  2⤵
  - Executes dropped EXE
  PID:3760
- C:\Windows\System\DWzRpfA.exe
  C:\Windows\System\DWzRpfA.exe
  2⤵
  - Executes dropped EXE
  PID:4500
- C:\Windows\System\yGtdIgt.exe
  C:\Windows\System\yGtdIgt.exe
  2⤵
  - Executes dropped EXE
  PID:3408
- C:\Windows\System\YSERkIx.exe
  C:\Windows\System\YSERkIx.exe
  2⤵
  - Executes dropped EXE
  PID:4696
- C:\Windows\System\aOGqggR.exe
  C:\Windows\System\aOGqggR.exe
  2⤵
  - Executes dropped EXE
  PID:3988
- C:\Windows\System\pnoDYnr.exe
  C:\Windows\System\pnoDYnr.exe
  2⤵
  - Executes dropped EXE
  PID:3640
- C:\Windows\System\RYqpTlb.exe
  C:\Windows\System\RYqpTlb.exe
  2⤵
  - Executes dropped EXE
  PID:2236
- C:\Windows\System\fzVBdZF.exe
  C:\Windows\System\fzVBdZF.exe
  2⤵
  - Executes dropped EXE
  PID:2072
- C:\Windows\System\qkfOYwV.exe
  C:\Windows\System\qkfOYwV.exe
  2⤵
  - Executes dropped EXE
  PID:3664
- C:\Windows\System\erhAkba.exe
  C:\Windows\System\erhAkba.exe
  2⤵
  - Executes dropped EXE
  PID:624
- C:\Windows\System\ouZgvKd.exe
  C:\Windows\System\ouZgvKd.exe
  2⤵
  - Executes dropped EXE
  PID:2508
- C:\Windows\System\eMffPYW.exe
  C:\Windows\System\eMffPYW.exe
  2⤵
  - Executes dropped EXE
  PID:3472
- C:\Windows\System\LYjvQKG.exe
  C:\Windows\System\LYjvQKG.exe
  2⤵
  - Executes dropped EXE
  PID:4012
- C:\Windows\System\AffiUne.exe
  C:\Windows\System\AffiUne.exe
  2⤵
  - Executes dropped EXE
  PID:2640
- C:\Windows\System\aeNGYpZ.exe
  C:\Windows\System\aeNGYpZ.exe
  2⤵
  - Executes dropped EXE
  PID:3840
- C:\Windows\System\Qifebke.exe
  C:\Windows\System\Qifebke.exe
  2⤵
  - Executes dropped EXE
  PID:836
- C:\Windows\System\evwflDw.exe
  C:\Windows\System\evwflDw.exe
  2⤵
  - Executes dropped EXE
  PID:3512
- C:\Windows\System\cHGkoRZ.exe
  C:\Windows\System\cHGkoRZ.exe
  2⤵
  - Executes dropped EXE
  PID:3364
- C:\Windows\System\sSWrXSc.exe
  C:\Windows\System\sSWrXSc.exe
  2⤵
  - Executes dropped EXE
  PID:3320
- C:\Windows\System\gUxoLMq.exe
  C:\Windows\System\gUxoLMq.exe
  2⤵
  - Executes dropped EXE
  PID:2080
- C:\Windows\System\rCdLGtL.exe
  C:\Windows\System\rCdLGtL.exe
  2⤵
  - Executes dropped EXE
  PID:1772
- C:\Windows\System\ozzHSlC.exe
  C:\Windows\System\ozzHSlC.exe
  2⤵
  - Executes dropped EXE
  PID:5028
- C:\Windows\System\qebOAKG.exe
  C:\Windows\System\qebOAKG.exe
  2⤵
  - Executes dropped EXE
  PID:4772
- C:\Windows\System\EmIzCeS.exe
  C:\Windows\System\EmIzCeS.exe
  2⤵
  - Executes dropped EXE
  PID:2340
- C:\Windows\System\lWvQrGX.exe
  C:\Windows\System\lWvQrGX.exe
  2⤵
  - Executes dropped EXE
  PID:2652
- C:\Windows\System\lkeoUKW.exe
  C:\Windows\System\lkeoUKW.exe
  2⤵
  - Executes dropped EXE
  PID:2224
- C:\Windows\System\YWDJzfd.exe
  C:\Windows\System\YWDJzfd.exe
  2⤵
  - Executes dropped EXE
  PID:1728
- C:\Windows\System\eLaxgoX.exe
  C:\Windows\System\eLaxgoX.exe
  2⤵
  - Executes dropped EXE
  PID:2116
- C:\Windows\System\VrYMQNn.exe
  C:\Windows\System\VrYMQNn.exe
  2⤵
  - Executes dropped EXE
  PID:1636
- C:\Windows\System\ZkYAGbd.exe
  C:\Windows\System\ZkYAGbd.exe
  2⤵
  - Executes dropped EXE
  PID:1564
- C:\Windows\System\MXVPuaQ.exe
  C:\Windows\System\MXVPuaQ.exe
  2⤵
  - Executes dropped EXE
  PID:4304
- C:\Windows\System\sHmphMi.exe
  C:\Windows\System\sHmphMi.exe
  2⤵
  - Executes dropped EXE
  PID:972
- C:\Windows\System\IudjIHe.exe
  C:\Windows\System\IudjIHe.exe
  2⤵
  - Executes dropped EXE
  PID:2968
- C:\Windows\System\azvzAmu.exe
  C:\Windows\System\azvzAmu.exe
  2⤵
  - Executes dropped EXE
  PID:2868
- C:\Windows\System\nVXKUlw.exe
  C:\Windows\System\nVXKUlw.exe
  2⤵
  - Executes dropped EXE
  PID:2240
- C:\Windows\System\qXwTFxk.exe
  C:\Windows\System\qXwTFxk.exe
  2⤵
  - Executes dropped EXE
  PID:2344
- C:\Windows\System\uFXZCIj.exe
  C:\Windows\System\uFXZCIj.exe
  2⤵
  - Executes dropped EXE
  PID:1148
- C:\Windows\System\DkbdfzU.exe
  C:\Windows\System\DkbdfzU.exe
  2⤵
  - Executes dropped EXE
  PID:5020
- C:\Windows\System\NoAkgPz.exe
  C:\Windows\System\NoAkgPz.exe
  2⤵
  - Executes dropped EXE
  PID:1744
- C:\Windows\System\RlDKFbT.exe
  C:\Windows\System\RlDKFbT.exe
  2⤵
  - Executes dropped EXE
  PID:3684
- C:\Windows\System\gmbTgXC.exe
  C:\Windows\System\gmbTgXC.exe
  2⤵
  - Executes dropped EXE
  PID:3020
- C:\Windows\System\rAbUGAg.exe
  C:\Windows\System\rAbUGAg.exe
  2⤵
  - Executes dropped EXE
  PID:3628
- C:\Windows\System\gwuRdhC.exe
  C:\Windows\System\gwuRdhC.exe
  2⤵
  - Executes dropped EXE
  PID:4316
- C:\Windows\System\jXHMGhl.exe
  C:\Windows\System\jXHMGhl.exe
  2⤵
  - Executes dropped EXE
  PID:804
- C:\Windows\System\ELvuUzS.exe
  C:\Windows\System\ELvuUzS.exe
  2⤵
  - Executes dropped EXE
  PID:3064
- C:\Windows\System\NtafUDQ.exe
  C:\Windows\System\NtafUDQ.exe
  2⤵
  - Executes dropped EXE
  PID:4996
- C:\Windows\System\Bxaenty.exe
  C:\Windows\System\Bxaenty.exe
  2⤵
  - Executes dropped EXE
  PID:3860
- C:\Windows\System\nizEytY.exe
  C:\Windows\System\nizEytY.exe
  2⤵
  - Executes dropped EXE
  PID:2576
- C:\Windows\System\CyncPVY.exe
  C:\Windows\System\CyncPVY.exe
  2⤵
  - Executes dropped EXE
  PID:2388
- C:\Windows\System\xhdKcVr.exe
  C:\Windows\System\xhdKcVr.exe
  2⤵
  - Executes dropped EXE
  PID:4348
- C:\Windows\System\FztMVGo.exe
  C:\Windows\System\FztMVGo.exe
  2⤵
  - Executes dropped EXE
  PID:404
- C:\Windows\System\bsTmzVc.exe
  C:\Windows\System\bsTmzVc.exe
  2⤵
  - Executes dropped EXE
  PID:2928
- C:\Windows\System\tAJPVRM.exe
  C:\Windows\System\tAJPVRM.exe
  2⤵
  PID:4508
- C:\Windows\System\qIzWDnV.exe
  C:\Windows\System\qIzWDnV.exe
  2⤵
  PID:3504
- C:\Windows\System\hyfxRxk.exe
  C:\Windows\System\hyfxRxk.exe
  2⤵
  PID:3556
- C:\Windows\System\qZvNtbG.exe
  C:\Windows\System\qZvNtbG.exe
  2⤵
  PID:4168
- C:\Windows\System\UTzZjKA.exe
  C:\Windows\System\UTzZjKA.exe
  2⤵
  PID:3440
- C:\Windows\System\LouKePS.exe
  C:\Windows\System\LouKePS.exe
  2⤵
  PID:4100
- C:\Windows\System\TVbKwmo.exe
  C:\Windows\System\TVbKwmo.exe
  2⤵
  PID:888
- C:\Windows\System\IYaFHJn.exe
  C:\Windows\System\IYaFHJn.exe
  2⤵
  PID:4372
- C:\Windows\System\NgTDxdZ.exe
  C:\Windows\System\NgTDxdZ.exe
  2⤵
  PID:1932
- C:\Windows\System\WFiEkni.exe
  C:\Windows\System\WFiEkni.exe
  2⤵
  PID:2272
- C:\Windows\System\KjXgVwd.exe
  C:\Windows\System\KjXgVwd.exe
  2⤵
  PID:4504
- C:\Windows\System\cjmljRx.exe
  C:\Windows\System\cjmljRx.exe
  2⤵
  PID:3536
- C:\Windows\System\sdCUrHx.exe
  C:\Windows\System\sdCUrHx.exe
  2⤵
  PID:2624
- C:\Windows\System\HFMDajt.exe
  C:\Windows\System\HFMDajt.exe
  2⤵
  PID:640
- C:\Windows\System\jLiehPY.exe
  C:\Windows\System\jLiehPY.exe
  2⤵
  PID:628
- C:\Windows\System\ttQvvGc.exe
  C:\Windows\System\ttQvvGc.exe
  2⤵
  PID:4360
- C:\Windows\System\mDeUppo.exe
  C:\Windows\System\mDeUppo.exe
  2⤵
  PID:428
- C:\Windows\System\CrfqCLQ.exe
  C:\Windows\System\CrfqCLQ.exe
  2⤵
  PID:440
- C:\Windows\System\SjRZKmL.exe
  C:\Windows\System\SjRZKmL.exe
  2⤵
  PID:1296
- C:\Windows\System\CWeoSqH.exe
  C:\Windows\System\CWeoSqH.exe
  2⤵
  PID:3816
- C:\Windows\System\FlLdEBx.exe
  C:\Windows\System\FlLdEBx.exe
  2⤵
  PID:2280
- C:\Windows\System\wdWAtHA.exe
  C:\Windows\System\wdWAtHA.exe
  2⤵
  PID:1968
- C:\Windows\System\UgUJiuj.exe
  C:\Windows\System\UgUJiuj.exe
  2⤵
  PID:5140
- C:\Windows\System\CBXJkld.exe
  C:\Windows\System\CBXJkld.exe
  2⤵
  PID:5168
- C:\Windows\System\qWqrCbH.exe
  C:\Windows\System\qWqrCbH.exe
  2⤵
  PID:5196
- C:\Windows\System\rOMnSwt.exe
  C:\Windows\System\rOMnSwt.exe
  2⤵
  PID:5224
- C:\Windows\System\oZZkuAX.exe
  C:\Windows\System\oZZkuAX.exe
  2⤵
  PID:5252
- C:\Windows\System\SNGsduL.exe
  C:\Windows\System\SNGsduL.exe
  2⤵
  PID:5280
- C:\Windows\System\CmXPSDW.exe
  C:\Windows\System\CmXPSDW.exe
  2⤵
  PID:5308
- C:\Windows\System\ghkpKjE.exe
  C:\Windows\System\ghkpKjE.exe
  2⤵
  PID:5360
- C:\Windows\System\IqTKTlw.exe
  C:\Windows\System\IqTKTlw.exe
  2⤵
  PID:5376
- C:\Windows\System\wYUfRoO.exe
  C:\Windows\System\wYUfRoO.exe
  2⤵
  PID:5392
- C:\Windows\System\ArRBBJB.exe
  C:\Windows\System\ArRBBJB.exe
  2⤵
  PID:5416
- C:\Windows\System\zFAaLvd.exe
  C:\Windows\System\zFAaLvd.exe
  2⤵
  PID:5448
- C:\Windows\System\CSvDqOH.exe
  C:\Windows\System\CSvDqOH.exe
  2⤵
  PID:5472
- C:\Windows\System\aDuhSQN.exe
  C:\Windows\System\aDuhSQN.exe
  2⤵
  PID:5500
- C:\Windows\System\UMpasfd.exe
  C:\Windows\System\UMpasfd.exe
  2⤵
  PID:5528
- C:\Windows\System\EqWhfFf.exe
  C:\Windows\System\EqWhfFf.exe
  2⤵
  PID:5556
- C:\Windows\System\XxiYczD.exe
  C:\Windows\System\XxiYczD.exe
  2⤵
  PID:5584
- C:\Windows\System\QboKHyK.exe
  C:\Windows\System\QboKHyK.exe
  2⤵
  PID:5612
- C:\Windows\System\jbaNuZE.exe
  C:\Windows\System\jbaNuZE.exe
  2⤵
  PID:5640
- C:\Windows\System\HHcmzWk.exe
  C:\Windows\System\HHcmzWk.exe
  2⤵
  PID:5660
- C:\Windows\System\JTJGvrq.exe
  C:\Windows\System\JTJGvrq.exe
  2⤵
  PID:5688
- C:\Windows\System\cDcdCqq.exe
  C:\Windows\System\cDcdCqq.exe
  2⤵
  PID:5716
- C:\Windows\System\azDiqJA.exe
  C:\Windows\System\azDiqJA.exe
  2⤵
  PID:5744
- C:\Windows\System\AHVucgV.exe
  C:\Windows\System\AHVucgV.exe
  2⤵
  PID:5772
- C:\Windows\System\IWTGKXP.exe
  C:\Windows\System\IWTGKXP.exe
  2⤵
  PID:5796
- C:\Windows\System\fBwcxaG.exe
  C:\Windows\System\fBwcxaG.exe
  2⤵
  PID:5828
- C:\Windows\System\SovLURe.exe
  C:\Windows\System\SovLURe.exe
  2⤵
  PID:5856
- C:\Windows\System\qslSHkF.exe
  C:\Windows\System\qslSHkF.exe
  2⤵
  PID:5884
- C:\Windows\System\bLXgBFA.exe
  C:\Windows\System\bLXgBFA.exe
  2⤵
  PID:5912
- C:\Windows\System\QHDtAgd.exe
  C:\Windows\System\QHDtAgd.exe
  2⤵
  PID:5940
- C:\Windows\System\yJZBEPY.exe
  C:\Windows\System\yJZBEPY.exe
  2⤵
  PID:5968
- C:\Windows\System\FxjsgsO.exe
  C:\Windows\System\FxjsgsO.exe
  2⤵
  PID:5996
- C:\Windows\System\fjTgLMG.exe
  C:\Windows\System\fjTgLMG.exe
  2⤵
  PID:6024
- C:\Windows\System\tfCGaTJ.exe
  C:\Windows\System\tfCGaTJ.exe
  2⤵
  PID:6052
- C:\Windows\System\OabIyxU.exe
  C:\Windows\System\OabIyxU.exe
  2⤵
  PID:6080
- C:\Windows\System\LWBHuTN.exe
  C:\Windows\System\LWBHuTN.exe
  2⤵
  PID:6108
- C:\Windows\System\yzBUpiW.exe
  C:\Windows\System\yzBUpiW.exe
  2⤵
  PID:6136
- C:\Windows\System\YZKAzcq.exe
  C:\Windows\System\YZKAzcq.exe
  2⤵
  PID:2360
- C:\Windows\System\AQCspiP.exe
  C:\Windows\System\AQCspiP.exe
  2⤵
  PID:2724
- C:\Windows\System\UhkhChc.exe
  C:\Windows\System\UhkhChc.exe
  2⤵
  PID:2308
- C:\Windows\System\yDBjHdc.exe
  C:\Windows\System\yDBjHdc.exe
  2⤵
  PID:3796
- C:\Windows\System\SCczBRj.exe
  C:\Windows\System\SCczBRj.exe
  2⤵
  PID:4532
- C:\Windows\System\uUEBtJp.exe
  C:\Windows\System\uUEBtJp.exe
  2⤵
  PID:1724
- C:\Windows\System\SHJuWGu.exe
  C:\Windows\System\SHJuWGu.exe
  2⤵
  PID:5000
- C:\Windows\System\uayCHWD.exe
  C:\Windows\System\uayCHWD.exe
  2⤵
  PID:5180
- C:\Windows\System\JiMqjxx.exe
  C:\Windows\System\JiMqjxx.exe
  2⤵
  PID:5240
- C:\Windows\System\OoDVsuY.exe
  C:\Windows\System\OoDVsuY.exe
  2⤵
  PID:5300
- C:\Windows\System\XNtKCWj.exe
  C:\Windows\System\XNtKCWj.exe
  2⤵
  PID:5372
- C:\Windows\System\AmTnxYI.exe
  C:\Windows\System\AmTnxYI.exe
  2⤵
  PID:5436
- C:\Windows\System\kQQaEgz.exe
  C:\Windows\System\kQQaEgz.exe
  2⤵
  PID:5496
- C:\Windows\System\YJaeObo.exe
  C:\Windows\System\YJaeObo.exe
  2⤵
  PID:5572
- C:\Windows\System\LGAUulY.exe
  C:\Windows\System\LGAUulY.exe
  2⤵
  PID:5632
- C:\Windows\System\BhqOOoe.exe
  C:\Windows\System\BhqOOoe.exe
  2⤵
  PID:5700
- C:\Windows\System\qMtPzpX.exe
  C:\Windows\System\qMtPzpX.exe
  2⤵
  PID:5756
- C:\Windows\System\rGUbYJX.exe
  C:\Windows\System\rGUbYJX.exe
  2⤵
  PID:5812
- C:\Windows\System\wSeXaja.exe
  C:\Windows\System\wSeXaja.exe
  2⤵
  PID:2712
- C:\Windows\System\JfRigZf.exe
  C:\Windows\System\JfRigZf.exe
  2⤵
  PID:5928
- C:\Windows\System\hVSqfSt.exe
  C:\Windows\System\hVSqfSt.exe
  2⤵
  PID:6008
- C:\Windows\System\WBRBgXm.exe
  C:\Windows\System\WBRBgXm.exe
  2⤵
  PID:6064
- C:\Windows\System\uDNPJyS.exe
  C:\Windows\System\uDNPJyS.exe
  2⤵
  PID:6124
- C:\Windows\System\VlzKNlA.exe
  C:\Windows\System\VlzKNlA.exe
  2⤵
  PID:1644
- C:\Windows\System\SPlWmDF.exe
  C:\Windows\System\SPlWmDF.exe
  2⤵
  PID:2520
- C:\Windows\System\CSLKFwu.exe
  C:\Windows\System\CSLKFwu.exe
  2⤵
  PID:4948
- C:\Windows\System\ecRTdDy.exe
  C:\Windows\System\ecRTdDy.exe
  2⤵
  PID:5212
- C:\Windows\System\aMmGDGB.exe
  C:\Windows\System\aMmGDGB.exe
  2⤵
  PID:5404
- C:\Windows\System\yeecuXi.exe
  C:\Windows\System\yeecuXi.exe
  2⤵
  PID:5548
- C:\Windows\System\armOIXM.exe
  C:\Windows\System\armOIXM.exe
  2⤵
  PID:5672
- C:\Windows\System\BtUOtnN.exe
  C:\Windows\System\BtUOtnN.exe
  2⤵
  PID:5792
- C:\Windows\System\cNtsEVL.exe
  C:\Windows\System\cNtsEVL.exe
  2⤵
  PID:5924
- C:\Windows\System\AtfmugC.exe
  C:\Windows\System\AtfmugC.exe
  2⤵
  PID:6040
- C:\Windows\System\CkSXGZK.exe
  C:\Windows\System\CkSXGZK.exe
  2⤵
  PID:4268
- C:\Windows\System\xifhTxj.exe
  C:\Windows\System\xifhTxj.exe
  2⤵
  PID:6168
- C:\Windows\System\BtDJyZA.exe
  C:\Windows\System\BtDJyZA.exe
  2⤵
  PID:6200
- C:\Windows\System\WHHKArf.exe
  C:\Windows\System\WHHKArf.exe
  2⤵
  PID:6224
- C:\Windows\System\KWCvbuG.exe
  C:\Windows\System\KWCvbuG.exe
  2⤵
  PID:6256
- C:\Windows\System\ZItycnb.exe
  C:\Windows\System\ZItycnb.exe
  2⤵
  PID:6284
- C:\Windows\System\ldyKWhH.exe
  C:\Windows\System\ldyKWhH.exe
  2⤵
  PID:6312
- C:\Windows\System\RSNCaSc.exe
  C:\Windows\System\RSNCaSc.exe
  2⤵
  PID:6336
- C:\Windows\System\WXfMmrc.exe
  C:\Windows\System\WXfMmrc.exe
  2⤵
  PID:6368
- C:\Windows\System\QWbZQkf.exe
  C:\Windows\System\QWbZQkf.exe
  2⤵
  PID:6392
- C:\Windows\System\PHiGMsI.exe
  C:\Windows\System\PHiGMsI.exe
  2⤵
  PID:6424
- C:\Windows\System\lzuMmiS.exe
  C:\Windows\System\lzuMmiS.exe
  2⤵
  PID:6448
- C:\Windows\System\tZiOWuo.exe
  C:\Windows\System\tZiOWuo.exe
  2⤵
  PID:6480
- C:\Windows\System\XGJIpoZ.exe
  C:\Windows\System\XGJIpoZ.exe
  2⤵
  PID:6508
- C:\Windows\System\AyJyoDe.exe
  C:\Windows\System\AyJyoDe.exe
  2⤵
  PID:6536
- C:\Windows\System\tFtRFYa.exe
  C:\Windows\System\tFtRFYa.exe
  2⤵
  PID:6564
- C:\Windows\System\bNhFtlv.exe
  C:\Windows\System\bNhFtlv.exe
  2⤵
  PID:6592
- C:\Windows\System\XJMcgrs.exe
  C:\Windows\System\XJMcgrs.exe
  2⤵
  PID:6616
- C:\Windows\System\qUJxbyu.exe
  C:\Windows\System\qUJxbyu.exe
  2⤵
  PID:6648
- C:\Windows\System\iuhyNVJ.exe
  C:\Windows\System\iuhyNVJ.exe
  2⤵
  PID:6676
- C:\Windows\System\XykfJLc.exe
  C:\Windows\System\XykfJLc.exe
  2⤵
  PID:6704
- C:\Windows\System\rQzDZEg.exe
  C:\Windows\System\rQzDZEg.exe
  2⤵
  PID:6732
- C:\Windows\System\sGFOaRX.exe
  C:\Windows\System\sGFOaRX.exe
  2⤵
  PID:6760
- C:\Windows\System\UDVagtL.exe
  C:\Windows\System\UDVagtL.exe
  2⤵
  PID:6788
- C:\Windows\System\CoWMJhw.exe
  C:\Windows\System\CoWMJhw.exe
  2⤵
  PID:6816
- C:\Windows\System\gXgXFAw.exe
  C:\Windows\System\gXgXFAw.exe
  2⤵
  PID:6840
- C:\Windows\System\XUZejqF.exe
  C:\Windows\System\XUZejqF.exe
  2⤵
  PID:6872
- C:\Windows\System\yUFhJjH.exe
  C:\Windows\System\yUFhJjH.exe
  2⤵
  PID:6900
- C:\Windows\System\EUoYzcr.exe
  C:\Windows\System\EUoYzcr.exe
  2⤵
  PID:6924
- C:\Windows\System\gfTsuJt.exe
  C:\Windows\System\gfTsuJt.exe
  2⤵
  PID:6952
- C:\Windows\System\ukTOEjR.exe
  C:\Windows\System\ukTOEjR.exe
  2⤵
  PID:6984
- C:\Windows\System\krwrnQM.exe
  C:\Windows\System\krwrnQM.exe
  2⤵
  PID:7012
- C:\Windows\System\ELgJolU.exe
  C:\Windows\System\ELgJolU.exe
  2⤵
  PID:7040
- C:\Windows\System\HXJuFZp.exe
  C:\Windows\System\HXJuFZp.exe
  2⤵
  PID:7064
- C:\Windows\System\bgUlrVg.exe
  C:\Windows\System\bgUlrVg.exe
  2⤵
  PID:7096
- C:\Windows\System\YjkZQPH.exe
  C:\Windows\System\YjkZQPH.exe
  2⤵
  PID:7124
- C:\Windows\System\ESHOLuv.exe
  C:\Windows\System\ESHOLuv.exe
  2⤵
  PID:7148
- C:\Windows\System\pqSLBPc.exe
  C:\Windows\System\pqSLBPc.exe
  2⤵
  PID:5156
- C:\Windows\System\SVONYqf.exe
  C:\Windows\System\SVONYqf.exe
  2⤵
  PID:5468
- C:\Windows\System\YMCLHnA.exe
  C:\Windows\System\YMCLHnA.exe
  2⤵
  PID:2180
- C:\Windows\System\PlmvKdD.exe
  C:\Windows\System\PlmvKdD.exe
  2⤵
  PID:5988
- C:\Windows\System\XMJuVpn.exe
  C:\Windows\System\XMJuVpn.exe
  2⤵
  PID:6096
- C:\Windows\System\GpYSNqg.exe
  C:\Windows\System\GpYSNqg.exe
  2⤵
  PID:6184
- C:\Windows\System\jYaRSJk.exe
  C:\Windows\System\jYaRSJk.exe
  2⤵
  PID:6268
- C:\Windows\System\tMfZlye.exe
  C:\Windows\System\tMfZlye.exe
  2⤵
  PID:6332
- C:\Windows\System\qjyZMGz.exe
  C:\Windows\System\qjyZMGz.exe
  2⤵
  PID:2560
- C:\Windows\System\UaUREDx.exe
  C:\Windows\System\UaUREDx.exe
  2⤵
  PID:4056
- C:\Windows\System\xrGUlFF.exe
  C:\Windows\System\xrGUlFF.exe
  2⤵
  PID:400
- C:\Windows\System\SghMJuv.exe
  C:\Windows\System\SghMJuv.exe
  2⤵
  PID:6604
- C:\Windows\System\meKzhPm.exe
  C:\Windows\System\meKzhPm.exe
  2⤵
  PID:6660
- C:\Windows\System\zpChGMa.exe
  C:\Windows\System\zpChGMa.exe
  2⤵
  PID:3740
- C:\Windows\System\TNpevEz.exe
  C:\Windows\System\TNpevEz.exe
  2⤵
  PID:2656
- C:\Windows\System\QGtlPAc.exe
  C:\Windows\System\QGtlPAc.exe
  2⤵
  PID:6804
- C:\Windows\System\BLrJhux.exe
  C:\Windows\System\BLrJhux.exe
  2⤵
  PID:6860
- C:\Windows\System\HgFsFmE.exe
  C:\Windows\System\HgFsFmE.exe
  2⤵
  PID:2784
- C:\Windows\System\uiefQkn.exe
  C:\Windows\System\uiefQkn.exe
  2⤵
  PID:4092
- C:\Windows\System\unTAehc.exe
  C:\Windows\System\unTAehc.exe
  2⤵
  PID:2832
- C:\Windows\System\KWhWrjz.exe
  C:\Windows\System\KWhWrjz.exe
  2⤵
  PID:4008
- C:\Windows\System\IfVJHnK.exe
  C:\Windows\System\IfVJHnK.exe
  2⤵
  PID:2524
- C:\Windows\System\onkLUMZ.exe
  C:\Windows\System\onkLUMZ.exe
  2⤵
  PID:7084
- C:\Windows\System\PiVInAE.exe
  C:\Windows\System\PiVInAE.exe
  2⤵
  PID:908
- C:\Windows\System\hAJlUkH.exe
  C:\Windows\System\hAJlUkH.exe
  2⤵
  PID:7164
- C:\Windows\System\XkhmMso.exe
  C:\Windows\System\XkhmMso.exe
  2⤵
  PID:4032
- C:\Windows\System\brdXJSa.exe
  C:\Windows\System\brdXJSa.exe
  2⤵
  PID:5152
- C:\Windows\System\EbApkmj.exe
  C:\Windows\System\EbApkmj.exe
  2⤵
  PID:6016
- C:\Windows\System\nwFRWUF.exe
  C:\Windows\System\nwFRWUF.exe
  2⤵
  PID:6240
- C:\Windows\System\ONQeExo.exe
  C:\Windows\System\ONQeExo.exe
  2⤵
  PID:6304
- C:\Windows\System\YnBrPgm.exe
  C:\Windows\System\YnBrPgm.exe
  2⤵
  PID:6468
- C:\Windows\System\svoAnGX.exe
  C:\Windows\System\svoAnGX.exe
  2⤵
  PID:6632
- C:\Windows\System\JbGTGZK.exe
  C:\Windows\System\JbGTGZK.exe
  2⤵
  PID:6692
- C:\Windows\System\XpVZetH.exe
  C:\Windows\System\XpVZetH.exe
  2⤵
  PID:6748
- C:\Windows\System\ovCmrwT.exe
  C:\Windows\System\ovCmrwT.exe
  2⤵
  PID:6836
- C:\Windows\System\CGIJwVR.exe
  C:\Windows\System\CGIJwVR.exe
  2⤵
  PID:6944
- C:\Windows\System\MQWcULb.exe
  C:\Windows\System\MQWcULb.exe
  2⤵
  PID:6976
- C:\Windows\System\fftfHYe.exe
  C:\Windows\System\fftfHYe.exe
  2⤵
  PID:7108
- C:\Windows\System\pPAnLVJ.exe
  C:\Windows\System\pPAnLVJ.exe
  2⤵
  PID:944
- C:\Windows\System\AOwWYrl.exe
  C:\Windows\System\AOwWYrl.exe
  2⤵
  PID:3524
- C:\Windows\System\CZJcUEn.exe
  C:\Windows\System\CZJcUEn.exe
  2⤵
  PID:6160
- C:\Windows\System\RaJXPdE.exe
  C:\Windows\System\RaJXPdE.exe
  2⤵
  PID:2764
- C:\Windows\System\uFyHrWe.exe
  C:\Windows\System\uFyHrWe.exe
  2⤵
  PID:6832
- C:\Windows\System\PTWKRmg.exe
  C:\Windows\System\PTWKRmg.exe
  2⤵
  PID:4632
- C:\Windows\System\HhdBNJG.exe
  C:\Windows\System\HhdBNJG.exe
  2⤵
  PID:3372
- C:\Windows\System\geggisQ.exe
  C:\Windows\System\geggisQ.exe
  2⤵
  PID:3248
- C:\Windows\System\QQxppLe.exe
  C:\Windows\System\QQxppLe.exe
  2⤵
  PID:7176
- C:\Windows\System\RiXnZkS.exe
  C:\Windows\System\RiXnZkS.exe
  2⤵
  PID:7208
- C:\Windows\System\vYlKLtZ.exe
  C:\Windows\System\vYlKLtZ.exe
  2⤵
  PID:7232
- C:\Windows\System\vknRAvb.exe
  C:\Windows\System\vknRAvb.exe
  2⤵
  PID:7252
- C:\Windows\System\UFNjkCt.exe
  C:\Windows\System\UFNjkCt.exe
  2⤵
  PID:7304
- C:\Windows\System\pfUYeBW.exe
  C:\Windows\System\pfUYeBW.exe
  2⤵
  PID:7328
- C:\Windows\System\bsEspQB.exe
  C:\Windows\System\bsEspQB.exe
  2⤵
  PID:7356
- C:\Windows\System\bchPTEV.exe
  C:\Windows\System\bchPTEV.exe
  2⤵
  PID:7388
- C:\Windows\System\tRzmyJv.exe
  C:\Windows\System\tRzmyJv.exe
  2⤵
  PID:7412
- C:\Windows\System\vcTYWXJ.exe
  C:\Windows\System\vcTYWXJ.exe
  2⤵
  PID:7436
- C:\Windows\System\bslitBh.exe
  C:\Windows\System\bslitBh.exe
  2⤵
  PID:7468
- C:\Windows\System\MyQGLVZ.exe
  C:\Windows\System\MyQGLVZ.exe
  2⤵
  PID:7496
- C:\Windows\System\qOfhGIp.exe
  C:\Windows\System\qOfhGIp.exe
  2⤵
  PID:7536
- C:\Windows\System\fuafkbG.exe
  C:\Windows\System\fuafkbG.exe
  2⤵
  PID:7552
- C:\Windows\System\fmvLItp.exe
  C:\Windows\System\fmvLItp.exe
  2⤵
  PID:7572
- C:\Windows\System\kATuqsz.exe
  C:\Windows\System\kATuqsz.exe
  2⤵
  PID:7612
- C:\Windows\System\tthwsLA.exe
  C:\Windows\System\tthwsLA.exe
  2⤵
  PID:7636
- C:\Windows\System\LKlrdSL.exe
  C:\Windows\System\LKlrdSL.exe
  2⤵
  PID:7668
- C:\Windows\System\zxakGiE.exe
  C:\Windows\System\zxakGiE.exe
  2⤵
  PID:7692
- C:\Windows\System\NxEJGcw.exe
  C:\Windows\System\NxEJGcw.exe
  2⤵
  PID:7720
- C:\Windows\System\LwGmKRS.exe
  C:\Windows\System\LwGmKRS.exe
  2⤵
  PID:7748
- C:\Windows\System\jqxCNqj.exe
  C:\Windows\System\jqxCNqj.exe
  2⤵
  PID:7776
- C:\Windows\System\gJGBioH.exe
  C:\Windows\System\gJGBioH.exe
  2⤵
  PID:7804
- C:\Windows\System\pqYZnxD.exe
  C:\Windows\System\pqYZnxD.exe
  2⤵
  PID:7844
- C:\Windows\System\AETgdJT.exe
  C:\Windows\System\AETgdJT.exe
  2⤵
  PID:7872
- C:\Windows\System\qaFCHpY.exe
  C:\Windows\System\qaFCHpY.exe
  2⤵
  PID:7900
- C:\Windows\System\JwMnDVl.exe
  C:\Windows\System\JwMnDVl.exe
  2⤵
  PID:7920
- C:\Windows\System\lURxjwm.exe
  C:\Windows\System\lURxjwm.exe
  2⤵
  PID:7944
- C:\Windows\System\cgdoCBG.exe
  C:\Windows\System\cgdoCBG.exe
  2⤵
  PID:7984
- C:\Windows\System\KKOBjRB.exe
  C:\Windows\System\KKOBjRB.exe
  2⤵
  PID:8000
- C:\Windows\System\gTcuiUP.exe
  C:\Windows\System\gTcuiUP.exe
  2⤵
  PID:8016
- C:\Windows\System\eNoHDXY.exe
  C:\Windows\System\eNoHDXY.exe
  2⤵
  PID:8032
- C:\Windows\System\FMXMcBv.exe
  C:\Windows\System\FMXMcBv.exe
  2⤵
  PID:8052
- C:\Windows\System\StrQoKe.exe
  C:\Windows\System\StrQoKe.exe
  2⤵
  PID:8072
- C:\Windows\System\WncsVhK.exe
  C:\Windows\System\WncsVhK.exe
  2⤵
  PID:8092
- C:\Windows\System\PbvDJVJ.exe
  C:\Windows\System\PbvDJVJ.exe
  2⤵
  PID:8108
- C:\Windows\System\zblnAGp.exe
  C:\Windows\System\zblnAGp.exe
  2⤵
  PID:8128
- C:\Windows\System\wkueLJw.exe
  C:\Windows\System\wkueLJw.exe
  2⤵
  PID:8156
- C:\Windows\System\FCrDUPA.exe
  C:\Windows\System\FCrDUPA.exe
  2⤵
  PID:8184
- C:\Windows\System\uYZQizj.exe
  C:\Windows\System\uYZQizj.exe
  2⤵
  PID:6464
- C:\Windows\System\dobcznd.exe
  C:\Windows\System\dobcznd.exe
  2⤵
  PID:7292
- C:\Windows\System\YLUxCFo.exe
  C:\Windows\System\YLUxCFo.exe
  2⤵
  PID:7400
- C:\Windows\System\wHENUTT.exe
  C:\Windows\System\wHENUTT.exe
  2⤵
  PID:7456
- C:\Windows\System\NcFczpf.exe
  C:\Windows\System\NcFczpf.exe
  2⤵
  PID:7544
- C:\Windows\System\fwxTDkh.exe
  C:\Windows\System\fwxTDkh.exe
  2⤵
  PID:7656
- C:\Windows\System\MOGEKwT.exe
  C:\Windows\System\MOGEKwT.exe
  2⤵
  PID:7684
- C:\Windows\System\dNgbXmT.exe
  C:\Windows\System\dNgbXmT.exe
  2⤵
  PID:7788
- C:\Windows\System\UsOvYMj.exe
  C:\Windows\System\UsOvYMj.exe
  2⤵
  PID:7832
- C:\Windows\System\EHDRTfC.exe
  C:\Windows\System\EHDRTfC.exe
  2⤵
  PID:7884
- C:\Windows\System\fPMAtXQ.exe
  C:\Windows\System\fPMAtXQ.exe
  2⤵
  PID:7908
- C:\Windows\System\cCKqsaa.exe
  C:\Windows\System\cCKqsaa.exe
  2⤵
  PID:7996
- C:\Windows\System\rpgKeQa.exe
  C:\Windows\System\rpgKeQa.exe
  2⤵
  PID:8044
- C:\Windows\System\UHdxcDm.exe
  C:\Windows\System\UHdxcDm.exe
  2⤵
  PID:8124
- C:\Windows\System\RphKHhc.exe
  C:\Windows\System\RphKHhc.exe
  2⤵
  PID:8144
- C:\Windows\System\ZYarPqf.exe
  C:\Windows\System\ZYarPqf.exe
  2⤵
  PID:7372
- C:\Windows\System\oKVMkdj.exe
  C:\Windows\System\oKVMkdj.exe
  2⤵
  PID:7512
- C:\Windows\System\wXdbcdl.exe
  C:\Windows\System\wXdbcdl.exe
  2⤵
  PID:7588
- C:\Windows\System\zsblJgc.exe
  C:\Windows\System\zsblJgc.exe
  2⤵
  PID:7888
- C:\Windows\System\TtwwrBr.exe
  C:\Windows\System\TtwwrBr.exe
  2⤵
  PID:7960
- C:\Windows\System\CZcOKsj.exe
  C:\Windows\System\CZcOKsj.exe
  2⤵
  PID:8064
- C:\Windows\System\YjBZwIF.exe
  C:\Windows\System\YjBZwIF.exe
  2⤵
  PID:7480
- C:\Windows\System\dhndtqL.exe
  C:\Windows\System\dhndtqL.exe
  2⤵
  PID:7868
- C:\Windows\System\wnjWGfs.exe
  C:\Windows\System\wnjWGfs.exe
  2⤵
  PID:8040
- C:\Windows\System\fFhpIrS.exe
  C:\Windows\System\fFhpIrS.exe
  2⤵
  PID:8200
- C:\Windows\System\NKpJvOJ.exe
  C:\Windows\System\NKpJvOJ.exe
  2⤵
  PID:8228
- C:\Windows\System\HEoWbqH.exe
  C:\Windows\System\HEoWbqH.exe
  2⤵
  PID:8256
- C:\Windows\System\qYulZZz.exe
  C:\Windows\System\qYulZZz.exe
  2⤵
  PID:8284
- C:\Windows\System\VTFAPEt.exe
  C:\Windows\System\VTFAPEt.exe
  2⤵
  PID:8312
- C:\Windows\System\ShOXKAG.exe
  C:\Windows\System\ShOXKAG.exe
  2⤵
  PID:8340
- C:\Windows\System\bKZiogl.exe
  C:\Windows\System\bKZiogl.exe
  2⤵
  PID:8356
- C:\Windows\System\QjMFIsJ.exe
  C:\Windows\System\QjMFIsJ.exe
  2⤵
  PID:8384
- C:\Windows\System\symbdjb.exe
  C:\Windows\System\symbdjb.exe
  2⤵
  PID:8432
- C:\Windows\System\nzlTfRE.exe
  C:\Windows\System\nzlTfRE.exe
  2⤵
  PID:8448
- C:\Windows\System\eCcXEyD.exe
  C:\Windows\System\eCcXEyD.exe
  2⤵
  PID:8464
- C:\Windows\System\BVOlGvE.exe
  C:\Windows\System\BVOlGvE.exe
  2⤵
  PID:8488
- C:\Windows\System\xnezPFH.exe
  C:\Windows\System\xnezPFH.exe
  2⤵
  PID:8548
- C:\Windows\System\kUfjzcO.exe
  C:\Windows\System\kUfjzcO.exe
  2⤵
  PID:8576
- C:\Windows\System\FtUOMiS.exe
  C:\Windows\System\FtUOMiS.exe
  2⤵
  PID:8592
- C:\Windows\System\wobYpet.exe
  C:\Windows\System\wobYpet.exe
  2⤵
  PID:8632
- C:\Windows\System\qBNWQky.exe
  C:\Windows\System\qBNWQky.exe
  2⤵
  PID:8648
- C:\Windows\System\IjkRVtz.exe
  C:\Windows\System\IjkRVtz.exe
  2⤵
  PID:8676
- C:\Windows\System\mZQmMHA.exe
  C:\Windows\System\mZQmMHA.exe
  2⤵
  PID:8708
- C:\Windows\System\fgWLywx.exe
  C:\Windows\System\fgWLywx.exe
  2⤵
  PID:8736
- C:\Windows\System\XpjjNjn.exe
  C:\Windows\System\XpjjNjn.exe
  2⤵
  PID:8764
- C:\Windows\System\ATIlwYp.exe
  C:\Windows\System\ATIlwYp.exe
  2⤵
  PID:8792
- C:\Windows\System\uwMZYxc.exe
  C:\Windows\System\uwMZYxc.exe
  2⤵
  PID:8820
- C:\Windows\System\xxSimgX.exe
  C:\Windows\System\xxSimgX.exe
  2⤵
  PID:8856
- C:\Windows\System\kVhnjoh.exe
  C:\Windows\System\kVhnjoh.exe
  2⤵
  PID:8880
- C:\Windows\System\cscdkKg.exe
  C:\Windows\System\cscdkKg.exe
  2⤵
  PID:8916
- C:\Windows\System\IdRPsca.exe
  C:\Windows\System\IdRPsca.exe
  2⤵
  PID:8940
- C:\Windows\System\VKFbrib.exe
  C:\Windows\System\VKFbrib.exe
  2⤵
  PID:8960
- C:\Windows\System\IGOSuWY.exe
  C:\Windows\System\IGOSuWY.exe
  2⤵
  PID:9016
- C:\Windows\System\cjhLiVf.exe
  C:\Windows\System\cjhLiVf.exe
  2⤵
  PID:9036
- C:\Windows\System\GknMCqh.exe
  C:\Windows\System\GknMCqh.exe
  2⤵
  PID:9052
- C:\Windows\System\mWncdMG.exe
  C:\Windows\System\mWncdMG.exe
  2⤵
  PID:9084
- C:\Windows\System\RIEgWmO.exe
  C:\Windows\System\RIEgWmO.exe
  2⤵
  PID:9112
- C:\Windows\System\JcojOUZ.exe
  C:\Windows\System\JcojOUZ.exe
  2⤵
  PID:9136
- C:\Windows\System\QSSbjIv.exe
  C:\Windows\System\QSSbjIv.exe
  2⤵
  PID:9176
- C:\Windows\System\ivuhyCx.exe
  C:\Windows\System\ivuhyCx.exe
  2⤵
  PID:9192
- C:\Windows\System\LCcEmfH.exe
  C:\Windows\System\LCcEmfH.exe
  2⤵
  PID:9212
- C:\Windows\System\oqhuEXu.exe
  C:\Windows\System\oqhuEXu.exe
  2⤵
  PID:8248
- C:\Windows\System\RtJbmCy.exe
  C:\Windows\System\RtJbmCy.exe
  2⤵
  PID:8328
- C:\Windows\System\qYLEIfR.exe
  C:\Windows\System\qYLEIfR.exe
  2⤵
  PID:8408
- C:\Windows\System\SOwtnQw.exe
  C:\Windows\System\SOwtnQw.exe
  2⤵
  PID:8480
- C:\Windows\System\klYmqMf.exe
  C:\Windows\System\klYmqMf.exe
  2⤵
  PID:8512
- C:\Windows\System\GCmGveo.exe
  C:\Windows\System\GCmGveo.exe
  2⤵
  PID:8608
- C:\Windows\System\hbMDRlc.exe
  C:\Windows\System\hbMDRlc.exe
  2⤵
  PID:8692
- C:\Windows\System\dMALMAM.exe
  C:\Windows\System\dMALMAM.exe
  2⤵
  PID:8780
- C:\Windows\System\TPCeHyg.exe
  C:\Windows\System\TPCeHyg.exe
  2⤵
  PID:8832
- C:\Windows\System\bZAsARf.exe
  C:\Windows\System\bZAsARf.exe
  2⤵
  PID:8900
- C:\Windows\System\YIoNQRt.exe
  C:\Windows\System\YIoNQRt.exe
  2⤵
  PID:8932
- C:\Windows\System\vRTDjoW.exe
  C:\Windows\System\vRTDjoW.exe
  2⤵
  PID:8968
- C:\Windows\System\CHlIMAU.exe
  C:\Windows\System\CHlIMAU.exe
  2⤵
  PID:9080
- C:\Windows\System\bYyDack.exe
  C:\Windows\System\bYyDack.exe
  2⤵
  PID:9132
- C:\Windows\System\RBCdbMh.exe
  C:\Windows\System\RBCdbMh.exe
  2⤵
  PID:8196
- C:\Windows\System\JJywgJy.exe
  C:\Windows\System\JJywgJy.exe
  2⤵
  PID:8324
- C:\Windows\System\RBKDvpA.exe
  C:\Windows\System\RBKDvpA.exe
  2⤵
  PID:8564
- C:\Windows\System\fViwvrU.exe
  C:\Windows\System\fViwvrU.exe
  2⤵
  PID:8644
- C:\Windows\System\XnAQcJv.exe
  C:\Windows\System\XnAQcJv.exe
  2⤵
  PID:8724
- C:\Windows\System\xyDLkdH.exe
  C:\Windows\System\xyDLkdH.exe
  2⤵
  PID:8876
- C:\Windows\System\BzRFVsO.exe
  C:\Windows\System\BzRFVsO.exe
  2⤵
  PID:9064
- C:\Windows\System\XhUzdRo.exe
  C:\Windows\System\XhUzdRo.exe
  2⤵
  PID:9188
- C:\Windows\System\vkHajhd.exe
  C:\Windows\System\vkHajhd.exe
  2⤵
  PID:8392
- C:\Windows\System\NhXSNqc.exe
  C:\Windows\System\NhXSNqc.exe
  2⤵
  PID:8700
- C:\Windows\System\ubqObes.exe
  C:\Windows\System\ubqObes.exe
  2⤵
  PID:9124
- C:\Windows\System\iXTAGgv.exe
  C:\Windows\System\iXTAGgv.exe
  2⤵
  PID:9004
- C:\Windows\System\VYnVxui.exe
  C:\Windows\System\VYnVxui.exe
  2⤵
  PID:9224
- C:\Windows\System\TysSRGI.exe
  C:\Windows\System\TysSRGI.exe
  2⤵
  PID:9252
- C:\Windows\System\cYsyxsN.exe
  C:\Windows\System\cYsyxsN.exe
  2⤵
  PID:9292
- C:\Windows\System\acSbIQh.exe
  C:\Windows\System\acSbIQh.exe
  2⤵
  PID:9308
- C:\Windows\System\zgPmYPS.exe
  C:\Windows\System\zgPmYPS.exe
  2⤵
  PID:9336
- C:\Windows\System\lreifSU.exe
  C:\Windows\System\lreifSU.exe
  2⤵
  PID:9364
- C:\Windows\System\rPVKWRz.exe
  C:\Windows\System\rPVKWRz.exe
  2⤵
  PID:9392
- C:\Windows\System\nRhpvEV.exe
  C:\Windows\System\nRhpvEV.exe
  2⤵
  PID:9420
- C:\Windows\System\EkjKVNC.exe
  C:\Windows\System\EkjKVNC.exe
  2⤵
  PID:9448
- C:\Windows\System\aVVOpCm.exe
  C:\Windows\System\aVVOpCm.exe
  2⤵
  PID:9476
- C:\Windows\System\QEnuxXX.exe
  C:\Windows\System\QEnuxXX.exe
  2⤵
  PID:9504
- C:\Windows\System\quutcZg.exe
  C:\Windows\System\quutcZg.exe
  2⤵
  PID:9532
- C:\Windows\System\CLUlPAM.exe
  C:\Windows\System\CLUlPAM.exe
  2⤵
  PID:9572
- C:\Windows\System\RleRwDG.exe
  C:\Windows\System\RleRwDG.exe
  2⤵
  PID:9592
- C:\Windows\System\eYuzrdL.exe
  C:\Windows\System\eYuzrdL.exe
  2⤵
  PID:9616
- C:\Windows\System\aUdPpgj.exe
  C:\Windows\System\aUdPpgj.exe
  2⤵
  PID:9644
- C:\Windows\System\RkovUHw.exe
  C:\Windows\System\RkovUHw.exe
  2⤵
  PID:9664
- C:\Windows\System\phYiIgV.exe
  C:\Windows\System\phYiIgV.exe
  2⤵
  PID:9696
- C:\Windows\System\GlQueJo.exe
  C:\Windows\System\GlQueJo.exe
  2⤵
  PID:9736
- C:\Windows\System\CZIZPkU.exe
  C:\Windows\System\CZIZPkU.exe
  2⤵
  PID:9772
- C:\Windows\System\uTazkLs.exe
  C:\Windows\System\uTazkLs.exe
  2⤵
  PID:9800
- C:\Windows\System\zhZpJRM.exe
  C:\Windows\System\zhZpJRM.exe
  2⤵
  PID:9828
- C:\Windows\System\FMbXsaP.exe
  C:\Windows\System\FMbXsaP.exe
  2⤵
  PID:9856
- C:\Windows\System\vZHCkyv.exe
  C:\Windows\System\vZHCkyv.exe
  2⤵
  PID:9872
- C:\Windows\System\TmjvpXC.exe
  C:\Windows\System\TmjvpXC.exe
  2⤵
  PID:9912
- C:\Windows\System\gXPcyuk.exe
  C:\Windows\System\gXPcyuk.exe
  2⤵
  PID:9928
- C:\Windows\System\qgFvkmi.exe
  C:\Windows\System\qgFvkmi.exe
  2⤵
  PID:9968
- C:\Windows\System\CHbvzrH.exe
  C:\Windows\System\CHbvzrH.exe
  2⤵
  PID:9996
- C:\Windows\System\JbGvjNY.exe
  C:\Windows\System\JbGvjNY.exe
  2⤵
  PID:10024
- C:\Windows\System\WkLYOTD.exe
  C:\Windows\System\WkLYOTD.exe
  2⤵
  PID:10044
- C:\Windows\System\JQKCRmj.exe
  C:\Windows\System\JQKCRmj.exe
  2⤵
  PID:10080
- C:\Windows\System\sazwtFS.exe
  C:\Windows\System\sazwtFS.exe
  2⤵
  PID:10112
- C:\Windows\System\uYshsRa.exe
  C:\Windows\System\uYshsRa.exe
  2⤵
  PID:10140
- C:\Windows\System\NshYsxE.exe
  C:\Windows\System\NshYsxE.exe
  2⤵
  PID:10168
- C:\Windows\System\bcOuMMY.exe
  C:\Windows\System\bcOuMMY.exe
  2⤵
  PID:10196
- C:\Windows\System\jpbQqNk.exe
  C:\Windows\System\jpbQqNk.exe
  2⤵
  PID:10224
- C:\Windows\System\EbaqIZq.exe
  C:\Windows\System\EbaqIZq.exe
  2⤵
  PID:8584
- C:\Windows\System\QNxVcqf.exe
  C:\Windows\System\QNxVcqf.exe
  2⤵
  PID:9276
- C:\Windows\System\CTiJCxr.exe
  C:\Windows\System\CTiJCxr.exe
  2⤵
  PID:9320
- C:\Windows\System\ReDMlye.exe
  C:\Windows\System\ReDMlye.exe
  2⤵
  PID:9388
- C:\Windows\System\DYwHSAV.exe
  C:\Windows\System\DYwHSAV.exe
  2⤵
  PID:9444
- C:\Windows\System\lnPunlM.exe
  C:\Windows\System\lnPunlM.exe
  2⤵
  PID:9548
- C:\Windows\System\KHCxeMv.exe
  C:\Windows\System\KHCxeMv.exe
  2⤵
  PID:9568
- C:\Windows\System\YHRpHTn.exe
  C:\Windows\System\YHRpHTn.exe
  2⤵
  PID:9636
- C:\Windows\System\laqKCUT.exe
  C:\Windows\System\laqKCUT.exe
  2⤵
  PID:9716
- C:\Windows\System\scioZCG.exe
  C:\Windows\System\scioZCG.exe
  2⤵
  PID:1200
- C:\Windows\System\Ajesaor.exe
  C:\Windows\System\Ajesaor.exe
  2⤵
  PID:9848
- C:\Windows\System\pMNNwnq.exe
  C:\Windows\System\pMNNwnq.exe
  2⤵
  PID:9864
- C:\Windows\System\rtaqvcH.exe
  C:\Windows\System\rtaqvcH.exe
  2⤵
  PID:9948
- C:\Windows\System\WHUOIAA.exe
  C:\Windows\System\WHUOIAA.exe
  2⤵
  PID:10016
- C:\Windows\System\bfmQqHY.exe
  C:\Windows\System\bfmQqHY.exe
  2⤵
  PID:10096
- C:\Windows\System\HAmdeoU.exe
  C:\Windows\System\HAmdeoU.exe
  2⤵
  PID:10124
- C:\Windows\System\tNqiXdZ.exe
  C:\Windows\System\tNqiXdZ.exe
  2⤵
  PID:10184
- C:\Windows\System\HuUTNkb.exe
  C:\Windows\System\HuUTNkb.exe
  2⤵
  PID:9280
- C:\Windows\System\egIAkkh.exe
  C:\Windows\System\egIAkkh.exe
  2⤵
  PID:9360
- C:\Windows\System\cAPYrzu.exe
  C:\Windows\System\cAPYrzu.exe
  2⤵
  PID:9684
- C:\Windows\System\VvAgQNC.exe
  C:\Windows\System\VvAgQNC.exe
  2⤵
  PID:9756
- C:\Windows\System\LkiqPGn.exe
  C:\Windows\System\LkiqPGn.exe
  2⤵
  PID:8996
- C:\Windows\System\womfgRt.exe
  C:\Windows\System\womfgRt.exe
  2⤵
  PID:9944
- C:\Windows\System\wPSFcqj.exe
  C:\Windows\System\wPSFcqj.exe
  2⤵
  PID:10188
- C:\Windows\System\GEepzjE.exe
  C:\Windows\System\GEepzjE.exe
  2⤵
  PID:10216
- C:\Windows\System\qdGWFuu.exe
  C:\Windows\System\qdGWFuu.exe
  2⤵
  PID:9600
- C:\Windows\System\ZNFicsa.exe
  C:\Windows\System\ZNFicsa.exe
  2⤵
  PID:9924
- C:\Windows\System\hZbILlF.exe
  C:\Windows\System\hZbILlF.exe
  2⤵
  PID:10160
- C:\Windows\System\afpAKdH.exe
  C:\Windows\System\afpAKdH.exe
  2⤵
  PID:10252
- C:\Windows\System\XFAWEJZ.exe
  C:\Windows\System\XFAWEJZ.exe
  2⤵
  PID:10268
- C:\Windows\System\amAIHAf.exe
  C:\Windows\System\amAIHAf.exe
  2⤵
  PID:10288
- C:\Windows\System\ZqOcUtl.exe
  C:\Windows\System\ZqOcUtl.exe
  2⤵
  PID:10328
- C:\Windows\System\mkoAQPo.exe
  C:\Windows\System\mkoAQPo.exe
  2⤵
  PID:10356
- C:\Windows\System\wSewLnN.exe
  C:\Windows\System\wSewLnN.exe
  2⤵
  PID:10376
- C:\Windows\System\qHxAafI.exe
  C:\Windows\System\qHxAafI.exe
  2⤵
  PID:10412
- C:\Windows\System\WNioarE.exe
  C:\Windows\System\WNioarE.exe
  2⤵
  PID:10452
- C:\Windows\System\KTHtMJm.exe
  C:\Windows\System\KTHtMJm.exe
  2⤵
  PID:10480
- C:\Windows\System\IbeFxcU.exe
  C:\Windows\System\IbeFxcU.exe
  2⤵
  PID:10512
- C:\Windows\System\XBsNDjc.exe
  C:\Windows\System\XBsNDjc.exe
  2⤵
  PID:10536
- C:\Windows\System\TcOKLId.exe
  C:\Windows\System\TcOKLId.exe
  2⤵
  PID:10552
- C:\Windows\System\JEweACO.exe
  C:\Windows\System\JEweACO.exe
  2⤵
  PID:10584
- C:\Windows\System\rnnsVgL.exe
  C:\Windows\System\rnnsVgL.exe
  2⤵
  PID:10620
- C:\Windows\System\BeCTJpH.exe
  C:\Windows\System\BeCTJpH.exe
  2⤵
  PID:10656
- C:\Windows\System\xTGRbAf.exe
  C:\Windows\System\xTGRbAf.exe
  2⤵
  PID:10692
- C:\Windows\System\zbHBPnI.exe
  C:\Windows\System\zbHBPnI.exe
  2⤵
  PID:10720
- C:\Windows\System\RfYsPYz.exe
  C:\Windows\System\RfYsPYz.exe
  2⤵
  PID:10748
- C:\Windows\System\OnnpwXj.exe
  C:\Windows\System\OnnpwXj.exe
  2⤵
  PID:10776
- C:\Windows\System\zYezklT.exe
  C:\Windows\System\zYezklT.exe
  2⤵
  PID:10804
- C:\Windows\System\bCSROJx.exe
  C:\Windows\System\bCSROJx.exe
  2⤵
  PID:10832
- C:\Windows\System\WqPQJBn.exe
  C:\Windows\System\WqPQJBn.exe
  2⤵
  PID:10848
- C:\Windows\System\yzAnzZw.exe
  C:\Windows\System\yzAnzZw.exe
  2⤵
  PID:10888
- C:\Windows\System\yKxMQto.exe
  C:\Windows\System\yKxMQto.exe
  2⤵
  PID:10904
- C:\Windows\System\eKVnWHV.exe
  C:\Windows\System\eKVnWHV.exe
  2⤵
  PID:10948
- C:\Windows\System\EGfMkRa.exe
  C:\Windows\System\EGfMkRa.exe
  2⤵
  PID:10972
- C:\Windows\System\fhViZgm.exe
  C:\Windows\System\fhViZgm.exe
  2⤵
  PID:11008
- C:\Windows\System\pSWeguU.exe
  C:\Windows\System\pSWeguU.exe
  2⤵
  PID:11032
- C:\Windows\System\nJPJomO.exe
  C:\Windows\System\nJPJomO.exe
  2⤵
  PID:11056
- C:\Windows\System\bmXgTWx.exe
  C:\Windows\System\bmXgTWx.exe
  2⤵
  PID:11092
- C:\Windows\System\GHSrqaD.exe
  C:\Windows\System\GHSrqaD.exe
  2⤵
  PID:11120
- C:\Windows\System\NYbNsbw.exe
  C:\Windows\System\NYbNsbw.exe
  2⤵
  PID:11148
- C:\Windows\System\uoyRAKx.exe
  C:\Windows\System\uoyRAKx.exe
  2⤵
  PID:11164
- C:\Windows\System\eOIntIZ.exe
  C:\Windows\System\eOIntIZ.exe
  2⤵
  PID:11192
- C:\Windows\System\AVOrPjZ.exe
  C:\Windows\System\AVOrPjZ.exe
  2⤵
  PID:11220
- C:\Windows\System\rbeFijZ.exe
  C:\Windows\System\rbeFijZ.exe
  2⤵
  PID:11252
- C:\Windows\System\FHPgGWI.exe
  C:\Windows\System\FHPgGWI.exe
  2⤵
  PID:10248
- C:\Windows\System\hdyMuMx.exe
  C:\Windows\System\hdyMuMx.exe
  2⤵
  PID:10284
- C:\Windows\System\tjOnKPf.exe
  C:\Windows\System\tjOnKPf.exe
  2⤵
  PID:10364
- C:\Windows\System\bktGQgX.exe
  C:\Windows\System\bktGQgX.exe
  2⤵
  PID:10392
- C:\Windows\System\BuHyvEc.exe
  C:\Windows\System\BuHyvEc.exe
  2⤵
  PID:10440
- C:\Windows\System\aGVKiNo.exe
  C:\Windows\System\aGVKiNo.exe
  2⤵
  PID:10520
- C:\Windows\System\ngHOLhw.exe
  C:\Windows\System\ngHOLhw.exe
  2⤵
  PID:10596
- C:\Windows\System\DuxQVsy.exe
  C:\Windows\System\DuxQVsy.exe
  2⤵
  PID:10648
- C:\Windows\System\wyZesOg.exe
  C:\Windows\System\wyZesOg.exe
  2⤵
  PID:10708
- C:\Windows\System\VMltOFK.exe
  C:\Windows\System\VMltOFK.exe
  2⤵
  PID:10824
- C:\Windows\System\WaWVcrR.exe
  C:\Windows\System\WaWVcrR.exe
  2⤵
  PID:10884
- C:\Windows\System\pXajUYy.exe
  C:\Windows\System\pXajUYy.exe
  2⤵
  PID:10956
- C:\Windows\System\HsqywGk.exe
  C:\Windows\System\HsqywGk.exe
  2⤵
  PID:11028
- C:\Windows\System\CoowIEW.exe
  C:\Windows\System\CoowIEW.exe
  2⤵
  PID:11076
- C:\Windows\System\vDSxkhB.exe
  C:\Windows\System\vDSxkhB.exe
  2⤵
  PID:11136
- C:\Windows\System\AijKhlP.exe
  C:\Windows\System\AijKhlP.exe
  2⤵
  PID:11208
- C:\Windows\System\YYVALju.exe
  C:\Windows\System\YYVALju.exe
  2⤵
  PID:10236
- C:\Windows\System\bWdLMlq.exe
  C:\Windows\System\bWdLMlq.exe
  2⤵
  PID:10324
- C:\Windows\System\wynBJij.exe
  C:\Windows\System\wynBJij.exe
  2⤵
  PID:10408
- C:\Windows\System\vcfofFB.exe
  C:\Windows\System\vcfofFB.exe
  2⤵
  PID:10632
- C:\Windows\System\gWlkrYw.exe
  C:\Windows\System\gWlkrYw.exe
  2⤵
  PID:10840
- C:\Windows\System\uNTswfD.exe
  C:\Windows\System\uNTswfD.exe
  2⤵
  PID:11004
- C:\Windows\System\bIGPfEG.exe
  C:\Windows\System\bIGPfEG.exe
  2⤵
  PID:11044
- C:\Windows\System\FwylBrp.exe
  C:\Windows\System\FwylBrp.exe
  2⤵
  PID:11188
- C:\Windows\System\HTFtkEx.exe
  C:\Windows\System\HTFtkEx.exe
  2⤵
  PID:10816
- C:\Windows\System\elkECkX.exe
  C:\Windows\System\elkECkX.exe
  2⤵
  PID:11160
- C:\Windows\System\JylFxDg.exe
  C:\Windows\System\JylFxDg.exe
  2⤵
  PID:11280
- C:\Windows\System\fXXelPw.exe
  C:\Windows\System\fXXelPw.exe
  2⤵
  PID:11316
- C:\Windows\System\kbgRiAg.exe
  C:\Windows\System\kbgRiAg.exe
  2⤵
  PID:11360
- C:\Windows\System\gHWpmAK.exe
  C:\Windows\System\gHWpmAK.exe
  2⤵
  PID:11380
- C:\Windows\System\GYaQiqz.exe
  C:\Windows\System\GYaQiqz.exe
  2⤵
  PID:11412
- C:\Windows\System\ZnHFqHu.exe
  C:\Windows\System\ZnHFqHu.exe
  2⤵
  PID:11432
- C:\Windows\System\lpwjdpH.exe
  C:\Windows\System\lpwjdpH.exe
  2⤵
  PID:11460
- C:\Windows\System\OdfDndU.exe
  C:\Windows\System\OdfDndU.exe
  2⤵
  PID:11488
- C:\Windows\System\hKXhYEM.exe
  C:\Windows\System\hKXhYEM.exe
  2⤵
  PID:11516
- C:\Windows\System\AkKJaUL.exe
  C:\Windows\System\AkKJaUL.exe
  2⤵
  PID:11544
- C:\Windows\System\ANlLvul.exe
  C:\Windows\System\ANlLvul.exe
  2⤵
  PID:11572
- C:\Windows\System\fHcmKHd.exe
  C:\Windows\System\fHcmKHd.exe
  2⤵
  PID:11616
- C:\Windows\System\ZfNquKu.exe
  C:\Windows\System\ZfNquKu.exe
  2⤵
  PID:11632
- C:\Windows\System\kdvGxvZ.exe
  C:\Windows\System\kdvGxvZ.exe
  2⤵
  PID:11660
- C:\Windows\System\TCxhjrF.exe
  C:\Windows\System\TCxhjrF.exe
  2⤵
  PID:11688
- C:\Windows\System\opLobiG.exe
  C:\Windows\System\opLobiG.exe
  2⤵
  PID:11716
- C:\Windows\System\BCfmeKj.exe
  C:\Windows\System\BCfmeKj.exe
  2⤵
  PID:11756
- C:\Windows\System\PujHdFI.exe
  C:\Windows\System\PujHdFI.exe
  2⤵
  PID:11780
- C:\Windows\System\pXwnbEy.exe
  C:\Windows\System\pXwnbEy.exe
  2⤵
  PID:11800
- C:\Windows\System\RXnqUdd.exe
  C:\Windows\System\RXnqUdd.exe
  2⤵
  PID:11828
- C:\Windows\System\lOBwyYP.exe
  C:\Windows\System\lOBwyYP.exe
  2⤵
  PID:11844
- C:\Windows\System\EVeUECL.exe
  C:\Windows\System\EVeUECL.exe
  2⤵
  PID:11872
- C:\Windows\System\fiZLYkg.exe
  C:\Windows\System\fiZLYkg.exe
  2⤵
  PID:11892
- C:\Windows\System\bCUFGff.exe
  C:\Windows\System\bCUFGff.exe
  2⤵
  PID:11928
- C:\Windows\System\csWjhYZ.exe
  C:\Windows\System\csWjhYZ.exe
  2⤵
  PID:11952
- C:\Windows\System\JEHbFrO.exe
  C:\Windows\System\JEHbFrO.exe
  2⤵
  PID:11996
- C:\Windows\System\JQVKKmQ.exe
  C:\Windows\System\JQVKKmQ.exe
  2⤵
  PID:12028
- C:\Windows\System\dEdsJYL.exe
  C:\Windows\System\dEdsJYL.exe
  2⤵
  PID:12052
- C:\Windows\System\LVJOmQk.exe
  C:\Windows\System\LVJOmQk.exe
  2⤵
  PID:12092
- C:\Windows\System\gwLAJJY.exe
  C:\Windows\System\gwLAJJY.exe
  2⤵
  PID:12120
- C:\Windows\System\zjzvFVi.exe
  C:\Windows\System\zjzvFVi.exe
  2⤵
  PID:12140
- C:\Windows\System\HsrAcQM.exe
  C:\Windows\System\HsrAcQM.exe
  2⤵
  PID:12164
- C:\Windows\System\cJrgJDj.exe
  C:\Windows\System\cJrgJDj.exe
  2⤵
  PID:12200
- C:\Windows\System\AymzdSR.exe
  C:\Windows\System\AymzdSR.exe
  2⤵
  PID:12220
- C:\Windows\System\ShiVUfk.exe
  C:\Windows\System\ShiVUfk.exe
  2⤵
  PID:12248
- C:\Windows\System\HnlqEHa.exe
  C:\Windows\System\HnlqEHa.exe
  2⤵
  PID:12264
- C:\Windows\System\QJLtSgv.exe
  C:\Windows\System\QJLtSgv.exe
  2⤵
  PID:11292
- C:\Windows\System\XCaUiKZ.exe
  C:\Windows\System\XCaUiKZ.exe
  2⤵
  PID:11336
- C:\Windows\System\FUfklJo.exe
  C:\Windows\System\FUfklJo.exe
  2⤵
  PID:11424
- C:\Windows\System\YgScdXh.exe
  C:\Windows\System\YgScdXh.exe
  2⤵
  PID:11472
- C:\Windows\System\ocSXmcn.exe
  C:\Windows\System\ocSXmcn.exe
  2⤵
  PID:11556
- C:\Windows\System\MtLBMMG.exe
  C:\Windows\System\MtLBMMG.exe
  2⤵
  PID:11612
- C:\Windows\System\fOksvdw.exe
  C:\Windows\System\fOksvdw.exe
  2⤵
  PID:11652
- C:\Windows\System\vrkVXuc.exe
  C:\Windows\System\vrkVXuc.exe
  2⤵
  PID:11736
- C:\Windows\System\eOYbsdf.exe
  C:\Windows\System\eOYbsdf.exe
  2⤵
  PID:11776
- C:\Windows\System\vIfieiI.exe
  C:\Windows\System\vIfieiI.exe
  2⤵
  PID:11856
- C:\Windows\System\tKfvnKS.exe
  C:\Windows\System\tKfvnKS.exe
  2⤵
  PID:11944
- C:\Windows\System\VAqItbv.exe
  C:\Windows\System\VAqItbv.exe
  2⤵
  PID:12036
- C:\Windows\System\sbFewme.exe
  C:\Windows\System\sbFewme.exe
  2⤵
  PID:12080
- C:\Windows\System\BLGWgrM.exe
  C:\Windows\System\BLGWgrM.exe
  2⤵
  PID:12128
- C:\Windows\System\EGIxIVg.exe
  C:\Windows\System\EGIxIVg.exe
  2⤵
  PID:12212
- C:\Windows\System\CgtBzdw.exe
  C:\Windows\System\CgtBzdw.exe
  2⤵
  PID:12236
- C:\Windows\System\FDznmos.exe
  C:\Windows\System\FDznmos.exe
  2⤵
  PID:11272
- C:\Windows\System\OqRTaHy.exe
  C:\Windows\System\OqRTaHy.exe
  2⤵
  PID:11456
- C:\Windows\System\dUkaAUZ.exe
  C:\Windows\System\dUkaAUZ.exe
  2⤵
  PID:11560
- C:\Windows\System\ayiojUb.exe
  C:\Windows\System\ayiojUb.exe
  2⤵
  PID:11764
- C:\Windows\System\nidcUFf.exe
  C:\Windows\System\nidcUFf.exe
  2⤵
  PID:11900
- C:\Windows\System\YveaxCy.exe
  C:\Windows\System\YveaxCy.exe
  2⤵
  PID:12072
- C:\Windows\System\UrwDMsL.exe
  C:\Windows\System\UrwDMsL.exe
  2⤵
  PID:12260
- C:\Windows\System\VzJRoMq.exe
  C:\Windows\System\VzJRoMq.exe
  2⤵
  PID:11596
- C:\Windows\System\UVZXuJE.exe
  C:\Windows\System\UVZXuJE.exe
  2⤵
  PID:12048
- C:\Windows\System\HvANcNE.exe
  C:\Windows\System\HvANcNE.exe
  2⤵
  PID:12232
- C:\Windows\System\rnPDmCA.exe
  C:\Windows\System\rnPDmCA.exe
  2⤵
  PID:11444
- C:\Windows\System\NByjcIM.exe
  C:\Windows\System\NByjcIM.exe
  2⤵
  PID:11884
- C:\Windows\System\JMnnEei.exe
  C:\Windows\System\JMnnEei.exe
  2⤵
  PID:12308
- C:\Windows\System\keOckfl.exe
  C:\Windows\System\keOckfl.exe
  2⤵
  PID:12328
- C:\Windows\System\DCxaBjM.exe
  C:\Windows\System\DCxaBjM.exe
  2⤵
  PID:12356
- C:\Windows\System\yDWbCAn.exe
  C:\Windows\System\yDWbCAn.exe
  2⤵
  PID:12408
- C:\Windows\System\ZXtMKCw.exe
  C:\Windows\System\ZXtMKCw.exe
  2⤵
  PID:12436
- C:\Windows\System\SFigLSi.exe
  C:\Windows\System\SFigLSi.exe
  2⤵
  PID:12460
- C:\Windows\System\mdXzSmX.exe
  C:\Windows\System\mdXzSmX.exe
  2⤵
  PID:12476
- C:\Windows\System\iVbbsmg.exe
  C:\Windows\System\iVbbsmg.exe
  2⤵
  PID:12524
- C:\Windows\System\AaHtACc.exe
  C:\Windows\System\AaHtACc.exe
  2⤵
  PID:12544
- C:\Windows\System\QYxfvHt.exe
  C:\Windows\System\QYxfvHt.exe
  2⤵
  PID:12560
- C:\Windows\System\HcYZEOk.exe
  C:\Windows\System\HcYZEOk.exe
  2⤵
  PID:12596
- C:\Windows\System\aSojPWD.exe
  C:\Windows\System\aSojPWD.exe
  2⤵
  PID:12620
- C:\Windows\System\OkSoGGp.exe
  C:\Windows\System\OkSoGGp.exe
  2⤵
  PID:12648
- C:\Windows\System\SbeGVnC.exe
  C:\Windows\System\SbeGVnC.exe
  2⤵
  PID:12676
- C:\Windows\System\wUBcuCm.exe
  C:\Windows\System\wUBcuCm.exe
  2⤵
  PID:12704
- C:\Windows\System\zsblOHe.exe
  C:\Windows\System\zsblOHe.exe
  2⤵
  PID:12744
- C:\Windows\System\uoisuer.exe
  C:\Windows\System\uoisuer.exe
  2⤵
  PID:12768
- C:\Windows\System\fmDHIFC.exe
  C:\Windows\System\fmDHIFC.exe
  2⤵
  PID:12808
- C:\Windows\System\YFGgHFd.exe
  C:\Windows\System\YFGgHFd.exe
  2⤵
  PID:12824
- C:\Windows\System\SlnXMRq.exe
  C:\Windows\System\SlnXMRq.exe
  2⤵
  PID:12852
- C:\Windows\System\TsDJBSk.exe
  C:\Windows\System\TsDJBSk.exe
  2⤵
  PID:12880
- C:\Windows\System\GMUIaLS.exe
  C:\Windows\System\GMUIaLS.exe
  2⤵
  PID:12900
- C:\Windows\System\KxvuPKk.exe
  C:\Windows\System\KxvuPKk.exe
  2⤵
  PID:12920
- C:\Windows\System\bXljrkc.exe
  C:\Windows\System\bXljrkc.exe
  2⤵
  PID:12944
- C:\Windows\System\DzLvVnG.exe
  C:\Windows\System\DzLvVnG.exe
  2⤵
  PID:12988
- C:\Windows\System\SigIDSK.exe
  C:\Windows\System\SigIDSK.exe
  2⤵
  PID:13008
- C:\Windows\System\tgjtlmK.exe
  C:\Windows\System\tgjtlmK.exe
  2⤵
  PID:13028
- C:\Windows\System\WYAaYvc.exe
  C:\Windows\System\WYAaYvc.exe
  2⤵
  PID:13056
- C:\Windows\System\JKcXHSr.exe
  C:\Windows\System\JKcXHSr.exe
  2⤵
  PID:13092
- C:\Windows\System\gcVlshs.exe
  C:\Windows\System\gcVlshs.exe
  2⤵
  PID:13124
- C:\Windows\System\uBDPTmT.exe
  C:\Windows\System\uBDPTmT.exe
  2⤵
  PID:13144
- C:\Windows\System\xeTmCXg.exe
  C:\Windows\System\xeTmCXg.exe
  2⤵
  PID:13172
- C:\Windows\System\vAZrInz.exe
  C:\Windows\System\vAZrInz.exe
  2⤵
  PID:13220
- C:\Windows\System\CNyGGoS.exe
  C:\Windows\System\CNyGGoS.exe
  2⤵
  PID:13248
- C:\Windows\System\rZwfSsq.exe
  C:\Windows\System\rZwfSsq.exe
  2⤵
  PID:13276
- C:\Windows\System\lirXduG.exe
  C:\Windows\System\lirXduG.exe
  2⤵
  PID:13300
- C:\Windows\System\CVfouzH.exe
  C:\Windows\System\CVfouzH.exe
  2⤵
  PID:12344
- C:\Windows\System\McsPEwB.exe
  C:\Windows\System\McsPEwB.exe
  2⤵
  PID:12352
- C:\Windows\System\zlGJQjl.exe
  C:\Windows\System\zlGJQjl.exe
  2⤵
  PID:12448
- C:\Windows\System\hnqVtVu.exe
  C:\Windows\System\hnqVtVu.exe
  2⤵
  PID:12488
- C:\Windows\System\gItrTGT.exe
  C:\Windows\System\gItrTGT.exe
  2⤵
  PID:12536
- C:\Windows\System\kHIKNKC.exe
  C:\Windows\System\kHIKNKC.exe
  2⤵
  PID:12556
- C:\Windows\System\aNWVhGb.exe
  C:\Windows\System\aNWVhGb.exe
  2⤵
  PID:12656
- C:\Windows\System\pvZYrYT.exe
  C:\Windows\System\pvZYrYT.exe
  2⤵
  PID:12732
- C:\Windows\System\srUaSCA.exe
  C:\Windows\System\srUaSCA.exe
  2⤵
  PID:12816
- C:\Windows\System\XzjrqzC.exe
  C:\Windows\System\XzjrqzC.exe
  2⤵
  PID:12888
- C:\Windows\System\tpRtOEK.exe
  C:\Windows\System\tpRtOEK.exe
  2⤵
  PID:12964
- C:\Windows\System\scoEYPC.exe
  C:\Windows\System\scoEYPC.exe
  2⤵
  PID:13048
- C:\Windows\System\jGdNHsI.exe
  C:\Windows\System\jGdNHsI.exe
  2⤵
  PID:13116
- C:\Windows\System\GOyPtgL.exe
  C:\Windows\System\GOyPtgL.exe
  2⤵
  PID:13188
- C:\Windows\System\ZtjPjEA.exe
  C:\Windows\System\ZtjPjEA.exe
  2⤵
  PID:13260
- C:\Windows\System\TlwuURR.exe
  C:\Windows\System\TlwuURR.exe
  2⤵
  PID:11836
- C:\Windows\System\GAXvKCA.exe
  C:\Windows\System\GAXvKCA.exe
  2⤵
  PID:12392
- C:\Windows\System\sEiOCkh.exe
  C:\Windows\System\sEiOCkh.exe
  2⤵
  PID:12584
- C:\Windows\System\BbPmGLi.exe
  C:\Windows\System\BbPmGLi.exe
  2⤵
  PID:12756
- C:\Windows\System\vTLKXKG.exe
  C:\Windows\System\vTLKXKG.exe
  2⤵
  PID:12872
- C:\Windows\System\GVwjhgE.exe
  C:\Windows\System\GVwjhgE.exe
  2⤵
  PID:13040
- C:\Windows\System\oXFpfYp.exe
  C:\Windows\System\oXFpfYp.exe
  2⤵
  PID:13160
- C:\Windows\System\YSNxYQR.exe
  C:\Windows\System\YSNxYQR.exe
  2⤵
  PID:13288
- C:\Windows\System\xkFtqJx.exe
  C:\Windows\System\xkFtqJx.exe
  2⤵
  PID:12540
- C:\Windows\System\ruRBecI.exe
  C:\Windows\System\ruRBecI.exe
  2⤵
  PID:12820
- C:\Windows\System\RQnEraq.exe
  C:\Windows\System\RQnEraq.exe
  2⤵
  PID:13292
- C:\Windows\System\ZDMJBGQ.exe
  C:\Windows\System\ZDMJBGQ.exe
  2⤵
  PID:13200
- C:\Windows\System\SCvrerA.exe
  C:\Windows\System\SCvrerA.exe
  2⤵
  PID:13324
- C:\Windows\System\KtygpYn.exe
  C:\Windows\System\KtygpYn.exe
  2⤵
  PID:13352
- C:\Windows\System\XEJIXuE.exe
  C:\Windows\System\XEJIXuE.exe
  2⤵
  PID:13380
- C:\Windows\System\XHfOLeB.exe
  C:\Windows\System\XHfOLeB.exe
  2⤵
  PID:13408
- C:\Windows\System\wwHAlfr.exe
  C:\Windows\System\wwHAlfr.exe
  2⤵
  PID:13424
- C:\Windows\System\LhOKrYP.exe
  C:\Windows\System\LhOKrYP.exe
  2⤵
  PID:13464
- C:\Windows\System\vWTGywF.exe
  C:\Windows\System\vWTGywF.exe
  2⤵
  PID:13496
- C:\Windows\System\xebsDsR.exe
  C:\Windows\System\xebsDsR.exe
  2⤵
  PID:13524
- C:\Windows\System\JMjRaJm.exe
  C:\Windows\System\JMjRaJm.exe
  2⤵
  PID:13552
- C:\Windows\System\pFQhzon.exe
  C:\Windows\System\pFQhzon.exe
  2⤵
  PID:13580
- C:\Windows\System\XIEeUIY.exe
  C:\Windows\System\XIEeUIY.exe
  2⤵
  PID:13596
- C:\Windows\System\SdtpTLz.exe
  C:\Windows\System\SdtpTLz.exe
  2⤵
  PID:13624
- C:\Windows\System\SeuzGyw.exe
  C:\Windows\System\SeuzGyw.exe
  2⤵
  PID:13656
- C:\Windows\System\tGWXOBf.exe
  C:\Windows\System\tGWXOBf.exe
  2⤵
  PID:13680
- C:\Windows\System\tsXkMOd.exe
  C:\Windows\System\tsXkMOd.exe
  2⤵
  PID:13708
- C:\Windows\System\PCkNVDp.exe
  C:\Windows\System\PCkNVDp.exe
  2⤵
  PID:13724
- C:\Windows\System\xmKkpek.exe
  C:\Windows\System\xmKkpek.exe
  2⤵
  PID:13768
- C:\Windows\System\bYrBsLq.exe
  C:\Windows\System\bYrBsLq.exe
  2⤵
  PID:13800
- C:\Windows\System\KpHEwsq.exe
  C:\Windows\System\KpHEwsq.exe
  2⤵
  PID:13820
- C:\Windows\System\oSKHBvv.exe
  C:\Windows\System\oSKHBvv.exe
  2⤵
  PID:13860
- C:\Windows\System\juYfLRs.exe
  C:\Windows\System\juYfLRs.exe
  2⤵
  PID:13880
- C:\Windows\System\nbxHMPQ.exe
  C:\Windows\System\nbxHMPQ.exe
  2⤵
  PID:13904
- C:\Windows\System\cpffMxo.exe
  C:\Windows\System\cpffMxo.exe
  2⤵
  PID:13944
- C:\Windows\System\jtuzvKV.exe
  C:\Windows\System\jtuzvKV.exe
  2⤵
  PID:13960
- C:\Windows\System\SThqJmo.exe
  C:\Windows\System\SThqJmo.exe
  2⤵
  PID:13980
- C:\Windows\System\LgMFUqC.exe
  C:\Windows\System\LgMFUqC.exe
  2⤵
  PID:14008
- C:\Windows\System\tfhNdYY.exe
  C:\Windows\System\tfhNdYY.exe
  2⤵
  PID:14032
- C:\Windows\System\xmmaKGr.exe
  C:\Windows\System\xmmaKGr.exe
  2⤵
  PID:14048
- C:\Windows\System\thxIeaR.exe
  C:\Windows\System\thxIeaR.exe
  2⤵
  PID:14076
- C:\Windows\System\WLHhCuY.exe
  C:\Windows\System\WLHhCuY.exe
  2⤵
  PID:14116
- C:\Windows\System\ZfpxFMc.exe
  C:\Windows\System\ZfpxFMc.exe
  2⤵
  PID:14144
- C:\Windows\System\gjXkWSi.exe
  C:\Windows\System\gjXkWSi.exe
  2⤵
  PID:14168
- C:\Windows\System\SJWwwYz.exe
  C:\Windows\System\SJWwwYz.exe
  2⤵
  PID:14212
- C:\Windows\System\qSdKkQa.exe
  C:\Windows\System\qSdKkQa.exe
  2⤵
  PID:14236
- C:\Windows\System\bbYGznm.exe
  C:\Windows\System\bbYGznm.exe
  2⤵
  PID:14256
- C:\Windows\System\hDzJnhc.exe
  C:\Windows\System\hDzJnhc.exe
  2⤵
  PID:14300
- C:\Windows\System\ADfYqqS.exe
  C:\Windows\System\ADfYqqS.exe
  2⤵
  PID:14324
- C:\Windows\System\raDpnVZ.exe
  C:\Windows\System\raDpnVZ.exe
  2⤵
  PID:13372
- C:\Windows\System\ancRFaw.exe
  C:\Windows\System\ancRFaw.exe
  2⤵
  PID:13444
- C:\Windows\System\sRpeoGQ.exe
  C:\Windows\System\sRpeoGQ.exe
  2⤵
  PID:13512
- C:\Windows\System\CPZfpRs.exe
  C:\Windows\System\CPZfpRs.exe
  2⤵
  PID:13568
- C:\Windows\System\luFmUwm.exe
  C:\Windows\System\luFmUwm.exe
  2⤵
  PID:13644
- C:\Windows\System\qdxYrWk.exe
  C:\Windows\System\qdxYrWk.exe
  2⤵
  PID:13676
- C:\Windows\System\axtdKDS.exe
  C:\Windows\System\axtdKDS.exe
  2⤵
  PID:13744
- C:\Windows\System\LUvlpZF.exe
  C:\Windows\System\LUvlpZF.exe
  2⤵
  PID:13812
- C:\Windows\System\dpMtpey.exe
  C:\Windows\System\dpMtpey.exe
  2⤵
  PID:13888
- C:\Windows\System\YxpbsBI.exe
  C:\Windows\System\YxpbsBI.exe
  2⤵
  PID:13936
- C:\Windows\System\bdewOkL.exe
  C:\Windows\System\bdewOkL.exe
  2⤵
  PID:13968
- C:\Windows\System\lBpJPJf.exe
  C:\Windows\System\lBpJPJf.exe
  2⤵
  PID:14072
- C:\Windows\System\CQmogbF.exe
  C:\Windows\System\CQmogbF.exe
  2⤵
  PID:14140
- C:\Windows\System\SGuUXLA.exe
  C:\Windows\System\SGuUXLA.exe
  2⤵
  PID:14188
- C:\Windows\System\fvckFEE.exe
  C:\Windows\System\fvckFEE.exe
  2⤵
  PID:14232
- C:\Windows\System\tEIVkWm.exe
  C:\Windows\System\tEIVkWm.exe
  2⤵
  PID:12420
- C:\Windows\System\qxTXaeC.exe
  C:\Windows\System\qxTXaeC.exe
  2⤵
  PID:13420
- C:\Windows\System\LUoBAlL.exe
  C:\Windows\System\LUoBAlL.exe
  2⤵
  PID:13588
- C:\Windows\System\kLtUcIB.exe
  C:\Windows\System\kLtUcIB.exe
  2⤵
  PID:13696
- C:\Windows\System\nMMBLty.exe
  C:\Windows\System\nMMBLty.exe
  2⤵
  PID:13900
- C:\Windows\System\JZAlFHE.exe
  C:\Windows\System\JZAlFHE.exe
  2⤵
  PID:14124
- C:\Windows\System\LnoxVFV.exe
  C:\Windows\System\LnoxVFV.exe
  2⤵
  PID:14220
- C:\Windows\System\lXnqLYe.exe
  C:\Windows\System\lXnqLYe.exe
  2⤵
  PID:14284
- C:\Windows\System\pTbEvPE.exe
  C:\Windows\System\pTbEvPE.exe
  2⤵
  PID:13636
- C:\Windows\System\diMsHpC.exe
  C:\Windows\System\diMsHpC.exe
  2⤵
  PID:14068
- C:\Windows\System\gLodIAj.exe
  C:\Windows\System\gLodIAj.exe
  2⤵
  PID:13396
- C:\Windows\System\bveJAZu.exe
  C:\Windows\System\bveJAZu.exe
  2⤵
  PID:13956
- C:\Windows\System\GeAdYjJ.exe
  C:\Windows\System\GeAdYjJ.exe
  2⤵
  PID:14352
- C:\Windows\System\EIblFzQ.exe
  C:\Windows\System\EIblFzQ.exe
  2⤵
  PID:14380
- C:\Windows\System\pDotTvM.exe
  C:\Windows\System\pDotTvM.exe
  2⤵
  PID:14408
- C:\Windows\System\nSrKfNM.exe
  C:\Windows\System\nSrKfNM.exe
  2⤵
  PID:14424
- C:\Windows\System\fclEbHP.exe
  C:\Windows\System\fclEbHP.exe
  2⤵
  PID:14452
- C:\Windows\System\HcAlQlU.exe
  C:\Windows\System\HcAlQlU.exe
  2⤵
  PID:14492
- C:\Windows\System\xQVEYGt.exe
  C:\Windows\System\xQVEYGt.exe
  2⤵
  PID:14520
- C:\Windows\System\UPiPWth.exe
  C:\Windows\System\UPiPWth.exe
  2⤵
  PID:14548
- C:\Windows\System\fgikJOF.exe
  C:\Windows\System\fgikJOF.exe
  2⤵
  PID:14568
- C:\Windows\System\VWzTlDi.exe
  C:\Windows\System\VWzTlDi.exe
  2⤵
  PID:14608
- C:\Windows\System\tLLfCjh.exe
  C:\Windows\System\tLLfCjh.exe
  2⤵
  PID:14636
- C:\Windows\System\GBjBZEW.exe
  C:\Windows\System\GBjBZEW.exe
  2⤵
  PID:14660
- C:\Windows\System\bIlKMxg.exe
  C:\Windows\System\bIlKMxg.exe
  2⤵
  PID:14680
- C:\Windows\System\nIawPmC.exe
  C:\Windows\System\nIawPmC.exe
  2⤵
  PID:14708
- C:\Windows\System\wTlmKaB.exe
  C:\Windows\System\wTlmKaB.exe
  2⤵
  PID:14724
- C:\Windows\System\pMnaBSx.exe
  C:\Windows\System\pMnaBSx.exe
  2⤵
  PID:14760
- C:\Windows\System\CpZvVHD.exe
  C:\Windows\System\CpZvVHD.exe
  2⤵
  PID:14800
- C:\Windows\System\kuylpgc.exe
  C:\Windows\System\kuylpgc.exe
  2⤵
  PID:14828
- C:\Windows\System\wVuCsgg.exe
  C:\Windows\System\wVuCsgg.exe
  2⤵
  PID:14848
- C:\Windows\System\EkASuUB.exe
  C:\Windows\System\EkASuUB.exe
  2⤵
  PID:14868
- C:\Windows\System\twvqoKQ.exe
  C:\Windows\System\twvqoKQ.exe
  2⤵
  PID:14904
- C:\Windows\System\OlLalWp.exe
  C:\Windows\System\OlLalWp.exe
  2⤵
  PID:14932
- C:\Windows\System\fswtnOe.exe
  C:\Windows\System\fswtnOe.exe
  2⤵
  PID:14964
- C:\Windows\System\bhUZQsY.exe
  C:\Windows\System\bhUZQsY.exe
  2⤵
  PID:14988
- C:\Windows\System\XUORsrs.exe
  C:\Windows\System\XUORsrs.exe
  2⤵
  PID:15004
- C:\Windows\System\rXkqFpa.exe
  C:\Windows\System\rXkqFpa.exe
  2⤵
  PID:15044
- C:\Windows\System\rRuEUUP.exe
  C:\Windows\System\rRuEUUP.exe
  2⤵
  PID:15064
- C:\Windows\System\qyPbOqF.exe
  C:\Windows\System\qyPbOqF.exe
  2⤵
  PID:15112
- C:\Windows\System\vVolWGW.exe
  C:\Windows\System\vVolWGW.exe
  2⤵
  PID:15132
- C:\Windows\System\GcuxtRq.exe
  C:\Windows\System\GcuxtRq.exe
  2⤵
  PID:15156
- C:\Windows\System\TvrpyED.exe
  C:\Windows\System\TvrpyED.exe
  2⤵
  PID:15172
- C:\Windows\System\tNimxnr.exe
  C:\Windows\System\tNimxnr.exe
  2⤵
  PID:15196
- C:\Windows\System\dnRgXQb.exe
  C:\Windows\System\dnRgXQb.exe
  2⤵
  PID:15228
- C:\Windows\System\iSzsQFY.exe
  C:\Windows\System\iSzsQFY.exe
  2⤵
  PID:15280
- C:\Windows\System\OuDsOJv.exe
  C:\Windows\System\OuDsOJv.exe
  2⤵
  PID:15308
- C:\Windows\System\Ickpquq.exe
  C:\Windows\System\Ickpquq.exe
  2⤵
  PID:15336
- C:\Windows\System\fGxotZC.exe
  C:\Windows\System\fGxotZC.exe
  2⤵
  PID:14340
- C:\Windows\System\DTmSsQw.exe
  C:\Windows\System\DTmSsQw.exe
  2⤵
  PID:14372
- C:\Windows\System\QltOoZP.exe
  C:\Windows\System\QltOoZP.exe
  2⤵
  PID:14440
- C:\Windows\System\YaYlZUh.exe
  C:\Windows\System\YaYlZUh.exe
  2⤵
  PID:14560
- C:\Windows\System\JPEyqvZ.exe
  C:\Windows\System\JPEyqvZ.exe
  2⤵
  PID:14604
- C:\Windows\System\aBPcPDN.exe
  C:\Windows\System\aBPcPDN.exe
  2⤵
  PID:14652
- C:\Windows\System\nzOfRIz.exe
  C:\Windows\System\nzOfRIz.exe
  2⤵
  PID:14736
- C:\Windows\System\yovldkw.exe
  C:\Windows\System\yovldkw.exe
  2⤵
  PID:14784
- C:\Windows\System\uvPdWmQ.exe
  C:\Windows\System\uvPdWmQ.exe
  2⤵
  PID:14844
- C:\Windows\System\onXGYEi.exe
  C:\Windows\System\onXGYEi.exe
  2⤵
  PID:14892
- C:\Windows\System\upEWRGx.exe
  C:\Windows\System\upEWRGx.exe
  2⤵
  PID:14956
- C:\Windows\System\kKbcWWO.exe
  C:\Windows\System\kKbcWWO.exe
  2⤵
  PID:15032
- C:\Windows\System\BBSTPdJ.exe
  C:\Windows\System\BBSTPdJ.exe
  2⤵
  PID:15096
- C:\Windows\System\yfWdJyt.exe
  C:\Windows\System\yfWdJyt.exe
  2⤵
  PID:15164
- C:\Windows\System\BaRLtNy.exe
  C:\Windows\System\BaRLtNy.exe
  2⤵
  PID:15224
- C:\Windows\System\evWhZjg.exe
  C:\Windows\System\evWhZjg.exe
  2⤵
  PID:15272
- C:\Windows\System\XmKMbai.exe
  C:\Windows\System\XmKMbai.exe
  2⤵
  PID:14476
- C:\Windows\System\EFKVyEO.exe
  C:\Windows\System\EFKVyEO.exe
  2⤵
  PID:14628
- C:\Windows\System\CCbrJfd.exe
  C:\Windows\System\CCbrJfd.exe
  2⤵
  PID:14716
- C:\Windows\System\lvuuHLp.exe
  C:\Windows\System\lvuuHLp.exe
  2⤵
  PID:14856
- C:\Windows\System\dooCczE.exe
  C:\Windows\System\dooCczE.exe
  2⤵
  PID:15108
- C:\Windows\System\ynrFEHY.exe
  C:\Windows\System\ynrFEHY.exe
  2⤵
  PID:15148
- C:\Windows\System\FXTaNYj.exe
  C:\Windows\System\FXTaNYj.exe
  2⤵
  PID:15320
- C:\Windows\System\uqfyUQP.exe
  C:\Windows\System\uqfyUQP.exe
  2⤵
  PID:14512
- C:\Windows\System\jcPaLgG.exe
  C:\Windows\System\jcPaLgG.exe
  2⤵
  PID:14972
- C:\Windows\System\ibOcMll.exe
  C:\Windows\System\ibOcMll.exe
  2⤵
  PID:15264
- C:\Windows\System\MNyqzJo.exe
  C:\Windows\System\MNyqzJo.exe
  2⤵
  PID:15120
- C:\Windows\System\uTLpXWS.exe
  C:\Windows\System\uTLpXWS.exe
  2⤵
  PID:15368
- C:\Windows\System\xjxDweI.exe
  C:\Windows\System\xjxDweI.exe
  2⤵
  PID:15396
- C:\Windows\System\WliAoeE.exe
  C:\Windows\System\WliAoeE.exe
  2⤵
  PID:15424
- C:\Windows\System\SmGPrem.exe
  C:\Windows\System\SmGPrem.exe
  2⤵
  PID:15448
- C:\Windows\System\soRUZIY.exe
  C:\Windows\System\soRUZIY.exe
  2⤵
  PID:15468
- C:\Windows\System\ruKnriG.exe
  C:\Windows\System\ruKnriG.exe
  2⤵
  PID:15496
- C:\Windows\System\azllBLS.exe
  C:\Windows\System\azllBLS.exe
  2⤵
  PID:15516
- C:\Windows\System\TtNIlpn.exe
  C:\Windows\System\TtNIlpn.exe
  2⤵
  PID:15548
- C:\Windows\System\kItyhfb.exe
  C:\Windows\System\kItyhfb.exe
  2⤵
  PID:15580
- C:\Windows\System\TkZLkBK.exe
  C:\Windows\System\TkZLkBK.exe
  2⤵
  PID:15604
- C:\Windows\System\zRMVxBt.exe
  C:\Windows\System\zRMVxBt.exe
  2⤵
  PID:15628
- C:\Windows\System\dzFcAZn.exe
  C:\Windows\System\dzFcAZn.exe
  2⤵
  PID:15676
- C:\Windows\System\DHMgehU.exe
  C:\Windows\System\DHMgehU.exe
  2⤵
  PID:15696
- C:\Windows\System\IBWAEkw.exe
  C:\Windows\System\IBWAEkw.exe
  2⤵
  PID:15732
- C:\Windows\System\gWJJAxa.exe
  C:\Windows\System\gWJJAxa.exe
  2⤵
  PID:15748
- C:\Windows\System\sXJnSmI.exe
  C:\Windows\System\sXJnSmI.exe
  2⤵
  PID:15776
- C:\Windows\System\dSeBKLb.exe
  C:\Windows\System\dSeBKLb.exe
  2⤵
  PID:15808
- C:\Windows\System\VnwIiqg.exe
  C:\Windows\System\VnwIiqg.exe
  2⤵
  PID:15836
- C:\Windows\System\HnONENL.exe
  C:\Windows\System\HnONENL.exe
  2⤵
  PID:15872
- C:\Windows\System\sRxSYyL.exe
  C:\Windows\System\sRxSYyL.exe
  2⤵
  PID:15900
- C:\Windows\System\BhTshdu.exe
  C:\Windows\System\BhTshdu.exe
  2⤵
  PID:15928
- C:\Windows\System\wNEcATR.exe
  C:\Windows\System\wNEcATR.exe
  2⤵
  PID:15956
- C:\Windows\System\cYcfKnP.exe
  C:\Windows\System\cYcfKnP.exe
  2⤵
  PID:15984
- C:\Windows\System\jiujeEs.exe
  C:\Windows\System\jiujeEs.exe
  2⤵
  PID:16012
- C:\Windows\System\pFRnJZZ.exe
  C:\Windows\System\pFRnJZZ.exe
  2⤵
  PID:16032
- C:\Windows\System\fFpHTRj.exe
  C:\Windows\System\fFpHTRj.exe
  2⤵
  PID:16056
- C:\Windows\System\blxfFsK.exe
  C:\Windows\System\blxfFsK.exe
  2⤵
  PID:16076
- C:\Windows\System\UDSXzik.exe
  C:\Windows\System\UDSXzik.exe
  2⤵
  PID:16108
- C:\Windows\System\gcuOcmW.exe
  C:\Windows\System\gcuOcmW.exe
  2⤵
  PID:16144
- C:\Windows\System\fvIkdJK.exe
  C:\Windows\System\fvIkdJK.exe
  2⤵
  PID:16160
- C:\Windows\System\MFsqtZy.exe
  C:\Windows\System\MFsqtZy.exe
  2⤵
  PID:16212
- C:\Windows\System\VFCXRkC.exe
  C:\Windows\System\VFCXRkC.exe
  2⤵
  PID:16240
- C:\Windows\System\AHZtJTN.exe
  C:\Windows\System\AHZtJTN.exe
  2⤵
  PID:16260
- C:\Windows\System\HqkdKKw.exe
  C:\Windows\System\HqkdKKw.exe
  2⤵
  PID:16296
- C:\Windows\System\zcnRWiT.exe
  C:\Windows\System\zcnRWiT.exe
  2⤵
  PID:16312
- C:\Windows\System\ENFOkBS.exe
  C:\Windows\System\ENFOkBS.exe
  2⤵
  PID:16340
- C:\Windows\System\bWzhUML.exe
  C:\Windows\System\bWzhUML.exe
  2⤵
  PID:16368
- C:\Windows\System\DrofWFd.exe
  C:\Windows\System\DrofWFd.exe
  2⤵
  PID:15380
- C:\Windows\System\hMtcyKd.exe
  C:\Windows\System\hMtcyKd.exe
  2⤵
  PID:15416
- C:\Windows\System\PJkSKXe.exe
  C:\Windows\System\PJkSKXe.exe
  2⤵
  PID:15480
- C:\Windows\System\eDntqPT.exe
  C:\Windows\System\eDntqPT.exe
  2⤵
  PID:15524
- C:\Windows\System\urfvfPn.exe
  C:\Windows\System\urfvfPn.exe
  2⤵
  PID:15572
- C:\Windows\System\MUSqxNH.exe
  C:\Windows\System\MUSqxNH.exe
  2⤵
  PID:15728
- C:\Windows\System\LZWOzJZ.exe
  C:\Windows\System\LZWOzJZ.exe
  2⤵
  PID:15796
- C:\Windows\System\LpebbVy.exe
  C:\Windows\System\LpebbVy.exe
  2⤵
  PID:15824
- C:\Windows\System\WhhJmMa.exe
  C:\Windows\System\WhhJmMa.exe
  2⤵
  PID:15924
- C:\Windows\System\yBroUAD.exe
  C:\Windows\System\yBroUAD.exe
  2⤵
  PID:15972
- C:\Windows\System\UvFMpAu.exe
  C:\Windows\System\UvFMpAu.exe
  2⤵
  PID:16048
- C:\Windows\System\sCwyAyf.exe
  C:\Windows\System\sCwyAyf.exe
  2⤵
  PID:16128
- C:\Windows\System\IaiOMbZ.exe
  C:\Windows\System\IaiOMbZ.exe
  2⤵
  PID:16156
- C:\Windows\System\LtOqPJR.exe
  C:\Windows\System\LtOqPJR.exe
  2⤵
  PID:16224
- C:\Windows\System\HmMXUYr.exe
  C:\Windows\System\HmMXUYr.exe
  2⤵
  PID:16308
- C:\Windows\System\JkSlHuT.exe
  C:\Windows\System\JkSlHuT.exe
  2⤵
  PID:16360
- C:\Windows\System\idNKcTL.exe
  C:\Windows\System\idNKcTL.exe
  2⤵
  PID:15408
- C:\Windows\System\NWtcjsb.exe
  C:\Windows\System\NWtcjsb.exe
  2⤵
  PID:15536
- C:\Windows\System\mHsYpYv.exe
  C:\Windows\System\mHsYpYv.exe
  2⤵
  PID:15740
- C:\Windows\System\hbYVmQy.exe
  C:\Windows\System\hbYVmQy.exe
  2⤵
  PID:15896
- C:\Windows\System\vVzTquj.exe
  C:\Windows\System\vVzTquj.exe
  2⤵
  PID:15952
- C:\Windows\System\DEeaxar.exe
  C:\Windows\System\DEeaxar.exe
  2⤵
  PID:16152
- C:\Windows\System\VbFEcpX.exe
  C:\Windows\System\VbFEcpX.exe
  2⤵
  PID:16256
- C:\Windows\System\kkMJUEg.exe
  C:\Windows\System\kkMJUEg.exe
  2⤵
  PID:15556
- C:\Windows\System\AzwbhpU.exe
  C:\Windows\System\AzwbhpU.exe
  2⤵
  PID:16000
- C:\Windows\System\WdAxOey.exe
  C:\Windows\System\WdAxOey.exe
  2⤵
  PID:16332
- C:\Windows\System\kYjvWPV.exe
  C:\Windows\System\kYjvWPV.exe
  2⤵
  PID:15844
- C:\Windows\System\BsPfbsb.exe
  C:\Windows\System\BsPfbsb.exe
  2⤵
  PID:4236
- C:\Windows\System\CwJHwHU.exe
  C:\Windows\System\CwJHwHU.exe
  2⤵
  PID:16408
- C:\Windows\System\tUGvWZU.exe
  C:\Windows\System\tUGvWZU.exe
  2⤵
  PID:16436
- C:\Windows\System\ZkXWJbO.exe
  C:\Windows\System\ZkXWJbO.exe
  2⤵
  PID:16452
- C:\Windows\System\BTJlXYT.exe
  C:\Windows\System\BTJlXYT.exe
  2⤵
  PID:16472
- C:\Windows\System\jTUiOWl.exe
  C:\Windows\System\jTUiOWl.exe
  2⤵
  PID:16496
- C:\Windows\System\MGumcQW.exe
  C:\Windows\System\MGumcQW.exe
  2⤵
  PID:16516
- C:\Windows\System\PUHcQAu.exe
  C:\Windows\System\PUHcQAu.exe
  2⤵
  PID:16544
- C:\Windows\System\gNDrEEi.exe
  C:\Windows\System\gNDrEEi.exe
  2⤵
  PID:16576
- C:\Windows\System\GonwEmd.exe
  C:\Windows\System\GonwEmd.exe
  2⤵
  PID:16612
- C:\Windows\System\NyaKpPv.exe
  C:\Windows\System\NyaKpPv.exe
  2⤵
  PID:16644
- C:\Windows\System\goPuHgD.exe
  C:\Windows\System\goPuHgD.exe
  2⤵
  PID:16676
- C:\Windows\System\QjNqKDm.exe
  C:\Windows\System\QjNqKDm.exe
  2⤵
  PID:16700
- C:\Windows\System\SEslTEQ.exe
  C:\Windows\System\SEslTEQ.exe
  2⤵
  PID:16720
- C:\Windows\System\zEsrHud.exe
  C:\Windows\System\zEsrHud.exe
  2⤵
  PID:16760
- C:\Windows\System\lGHPVST.exe
  C:\Windows\System\lGHPVST.exe
  2⤵
  PID:16776
- C:\Windows\System\oVRBLeL.exe
  C:\Windows\System\oVRBLeL.exe
  2⤵
  PID:16812
- C:\Windows\System\fmOWjUb.exe
  C:\Windows\System\fmOWjUb.exe
  2⤵
  PID:16844
- C:\Windows\System\iRTvOyJ.exe
  C:\Windows\System\iRTvOyJ.exe
  2⤵
  PID:16868
- C:\Windows\System\nccKWfc.exe
  C:\Windows\System\nccKWfc.exe
  2⤵
  PID:16900
- C:\Windows\System\zgrWbrv.exe
  C:\Windows\System\zgrWbrv.exe
  2⤵
  PID:16928
- C:\Windows\System\DYqVDbp.exe
  C:\Windows\System\DYqVDbp.exe
  2⤵
  PID:16964
- C:\Windows\System\cXVgjyP.exe
  C:\Windows\System\cXVgjyP.exe
  2⤵
  PID:16980

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:16508

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\AaNkDZC.exe

Filesize
1.9MB

MD5
c1b0765e7192e3846cc08849884c5a99

SHA1
1d30d031f37ec6570f7ba309ff5a272425be36f5

SHA256
86b3590231f1e6426ab19759fd6c6dd43bd30c6a3c034d2c4e56ecf49a44a94e

SHA512
80919b56cf72274d7ad5d5ecf11a61cc40d89418feb43fc84257f760de71929574d84ecaae2d3c30d91a94eb1a0210dd9e76f35c1b3f822e855906c8409ca9a1

Download Submit
C:\Windows\System\AffiUne.exe

Filesize
1.9MB

MD5
a9331b612870a9ea6ac6065ae23d30dc

SHA1
e3fbe98f3c70d84e16968d906f0e409badc116ac

SHA256
1ea15b511f0468dab8544a544ed1b232869ea6cf2e59cf5aabf3204a0c8b35ba

SHA512
f5cb6dedaa70409f0c226255088cdc1dfe66007c7876042e34ae6c4258c5d204cdbbb771e26245ddd2c06b8387e9ff343d8717f9ab9fa6fee970829db9cf0121

Download Submit
C:\Windows\System\DWzRpfA.exe

Filesize
1.9MB

MD5
49711adcfe0027151a6130fe235a5a93

SHA1
7ea6784f4a3c9ef0af2e2e7926ba6b1d65ba1776

SHA256
1abf095e5c6bb0b6d318d0ce5a52a6c513f304c92a7db4da2b0b8714922e763f

SHA512
323b3e66c647cd9aac0eef4ca61e517d218aa247e553fee5c98bb8d5c86691b0d39ba33285751bb35c22858ba397fc5db4f6a91c9f77aad75379c8bd856f951b

Download Submit
C:\Windows\System\LYjvQKG.exe

Filesize
1.9MB

MD5
9ffa04bdf9ca6ec34a2966b93d758df1

SHA1
70f7a15e812e5509a4943dc2ca9150af98491b7e

SHA256
e16887d4c42de7ca1d5ae8b0d1d2e672d221798f737ac04871fe61655bce3bf2

SHA512
446836e3a28822e9bd8d2ecbd25e3446fed85103ff525522bcd3edba292f3c5dbad81c24daac456a3b44040e5fb996f77844f3e57380df7089347ae51729137b

Download Submit
C:\Windows\System\NZyDbSG.exe

Filesize
1.9MB

MD5
a1344789a126975ecd976b3b91f8b66a

SHA1
dc22efc03d5c50b8b137b23a1b7c0828b5c5dec5

SHA256
872e6789870956339db740f7f0d5d888f08a9e563c24da4521aa6cbffeab2fc5

SHA512
77d384ee16e61ac57dece02c1b23ce25fc0a468b5e9a7bb81d18f374e9fb3d243189a0ac13bb822b831d51b7b4e0dc3512d7723175db9882ed6a9f7dfc31b366

Download Submit
C:\Windows\System\QbIvWtq.exe

Filesize
1.9MB

MD5
7c3262236831f2d4f15d862084f7e9d9

SHA1
0bb333dfd2be93d3cc1b2566255144b10ca9a6e6

SHA256
3246c7405cb52bda9061832776b26dc73ce60bc64b5dbf7243f2a5595a2f4edb

SHA512
4f6f5b6f87ac74028acf176417913827b409650fcf4be5bcaccf511c1b081746f199b618261f160b34af4eb7f87b24e3210fa79377b6eda452b41fdf5be567a5

Download Submit
C:\Windows\System\Qifebke.exe

Filesize
1.9MB

MD5
c4698172e019149f6dc2a66fd0a316ef

SHA1
dc55d664c392cff9fa449aecb9882cc3d8e12f2f

SHA256
f1f6159065dff265efccf6a2dc3156be7f54c42e6b0573064cbe83b7c36f5c5b

SHA512
bd0cb83f22c9407d3a084c5e9d4d5170f853bdb0475ab63e641a0e9d97a8037ebb78d5f7f9ea974a8a958a1b65fcf2e5a92d9e52c63126bdabe135e1d4f08697

Download Submit
C:\Windows\System\RYqpTlb.exe

Filesize
1.9MB

MD5
3b373192dfd3adc776da0e1ea418cba1

SHA1
240dd5459ce606df23079244894f9bc5f90c38d7

SHA256
777abc9e929b092baa5f7716b5cca458d207943568d3811ea06fb048da0cda95

SHA512
a38501b2c9d82aa523cc14a607203161033b9ba3cd235139f7de80a08e37fc19bd38f9edf1eb1207cadcb220fe3c550ac7f3e14efd3dfa37536ff5b5573348e2

Download Submit
C:\Windows\System\RmmoJqC.exe

Filesize
1.9MB

MD5
4565ca8f0eb4c462e8aa38989a5d6f27

SHA1
d6024558994aa1e70ca8c17bedb238fad75c18a3

SHA256
ec75c006444147e3a8595f2b30be6a4bf8a56c859aaeb6aaf0c1a66c6a1959e6

SHA512
36bd1b8c317a58ef2a3f93a9357e69859c1b0fc0e1fd2a80d90db6262f4794e7a00626a1b17844999c6df16f6397c4e2781144fae66a17c4dfb7dfd658c20a87

Download Submit
C:\Windows\System\THJdSYA.exe

Filesize
1.9MB

MD5
5dd48ec08f68bec156094a8eb09ff646

SHA1
d6a5f7d03d5235ee17d09401b3223a1eef865321

SHA256
fe56c86ca74a11749c5ad534723878389f40202fefcbaf3ae47cc7847e4ab7ae

SHA512
255e56cdc48719cee3647c4e0d109a134551d4db3e2fa01954dc2b322a330762fa6344373792d3652682f1a797692885904c79bcde782e97ca4c3ee1f79f794f

Download Submit
C:\Windows\System\YSERkIx.exe

Filesize
1.9MB

MD5
d1b49ea9dc6fe3eea0d63630dd60a6cc

SHA1
b1647f1699745fb6e70200830060ee34da3a270f

SHA256
fb475e7f17e1657bf21d5050bfffd30a69cdf2fbf6c39e35f6d1f8a7940d857f

SHA512
5005f1d76e1a2f2406d4dfcb316ac9093ba8bcd33f2fdcdf9dc164eab136388c49b7acd58bcb9207ddc38cbc3d9ed0cb6a1955627d58c710a1e1795719ff5f13

Download Submit
C:\Windows\System\YTmGGzZ.exe

Filesize
1.9MB

MD5
39cf1bdd431e4259a23fa073e46bcb67

SHA1
462632c4f1a1fa08860bc2b6d807517965bb2199

SHA256
26e0a7778575ca9aebf03af3b58a43106f66b7090127a5aa8e7d9d38b5bfe6b5

SHA512
5efff07ef5017e08c171443c23f7e9414c29e3e8b7aa6fac1a32c5419f6a45678483baf15629e194f5f51e3225a63fc2b9d0ea782a8ba0e0aadac78b9d14d44f

Download Submit
C:\Windows\System\aOGqggR.exe

Filesize
1.9MB

MD5
13319dc28b4ba4a489a8417ea3cc4c9a

SHA1
a026517399262ea085d045f6f5ab5468a7408427

SHA256
331bf0602affdfd9d852ad26a384bddffd894bd4d849fe4c18b699209ce0dac4

SHA512
3830357c2498942147426ead9e95051937712a9ccb64c5bbf0638acab0ddb46b994f461fbf078fee8a2f7d9d59bb5307c3a0e660dac4cbabe5c10d2c32ddf50d

Download Submit
C:\Windows\System\aeNGYpZ.exe

Filesize
1.9MB

MD5
1c479c56dd8a1fc8f5246457b27ffd64

SHA1
00838eaf52a7dfd9485e5324ead294e8bf427d11

SHA256
83ac5961616295fff1b4f4015f690f7406960671e6a47914695707c2a6a96025

SHA512
cb877e18624a7f595382a0ff67624b1a30d6cbc59386dfce7db1a253a6e986a45adb0f78afe75b6231966afd48c039ab9e9ac47f864026ea918d585b2f126e66

Download Submit
C:\Windows\System\cHGkoRZ.exe

Filesize
1.9MB

MD5
e152f6a4a0fbefab7fa1a30c8c118674

SHA1
d696dc46197ab48bbdc4a1bf46ed8f40902c3922

SHA256
c56b720778791c182ed03408ddfe084d2071fd3c59fab15d59cdf5a8327d3fa9

SHA512
4da4beb1b827c5722ec4578dc61957c13dfbe11a6f3dd18e49491b6834300a6d924ca330f384c0dd8abf8e955ae71f65b17ff48da8d91924f0c190a3ce03abe8

Download Submit
C:\Windows\System\eCfkZas.exe

Filesize
1.9MB

MD5
86516881addd496da67be41988b0be66

SHA1
c25e5f6a2e744f50c9093ffbf8b04fafd7933ebf

SHA256
6ea87f004e25b8dc80650b35b2f45c3400eb2a11c1b7f7a9025f9541bc96c33e

SHA512
8359965d11f25e790220d82faf8dd885feaf39279edfb75f2f3f1c61b6b1f9dd03e34f16dd03d8acee36f5c24739f32fd413343a8fcd5c2ef27f54c030649a82

Download Submit
C:\Windows\System\eMffPYW.exe

Filesize
1.9MB

MD5
9bafc5807ffe5eca7df2e167f282ce38

SHA1
430a6aa5d26fc6739030078ced8239326ea099f7

SHA256
bc3850bb714336819ad761b2747a4cde1f1addb38bd1eff76dc9ebedd4cabef4

SHA512
416c7a137d981b2dd89d67ffa49f1be09250c6cddf210f09acab3684a04174ad8ac8740de94b1d844aac5137d5c5e851ac536a64faacfc59e9abd3f9f8ef11df

Download Submit
C:\Windows\System\erhAkba.exe

Filesize
1.9MB

MD5
cd3ad128e2940cadd8a5b8d6f8f998ae

SHA1
b09b9da6cbac723ed138b09b1c047e61ddd3f789

SHA256
f3ed3e74744c901c6e727344ed9dc003a29b3761a36d3c207d6ac4f7686260ad

SHA512
a5a238c43f227e8cdfa4a13c46b6290e7bf4827bf5debd03e4a2fe74edcdc41ea5e70ef8a9ef3288b295e6c38357c0b49df5d0f557e8e9b21f546eed0d034a43

Download Submit
C:\Windows\System\evwflDw.exe

Filesize
1.9MB

MD5
929be04b9a11aafca830b6e2ee0837c6

SHA1
e12c038631e8e5091985154acc39c13d89563c09

SHA256
eee40a909b116773829d2602a9e0f576a3f9256bf4d51506c0c82966567c7b05

SHA512
14fb5c12b2b65dca5cb81d6e37e1db4919e98a29e3f99e3646b04191df94f80387bcecf972c3993a629cdee7fd34e3776341d660f77d702139e0f7dd4a5860d1

Download Submit
C:\Windows\System\fDMarys.exe

Filesize
1.9MB

MD5
94239657ae41171af6d40f9d1c0b641f

SHA1
f2f53b3790407d11f0dc73eb5a690ad646a67058

SHA256
4e5157db1b0b22e9424bf5d0a34be46e93a1cd32888678054c5cdda0ef5c0878

SHA512
0f914f27b2428050b3c18dc3b8222f3407dc0a79136c6c512973e228f1d23252b82ebebec05a30c85182be35c449033df6d59dd6a43968ba4c4467d3b52df1a8

Download Submit
C:\Windows\System\fzVBdZF.exe

Filesize
1.9MB

MD5
fdae04a1ec162a43198fd95f402c4a98

SHA1
4ab97f8553c0ba03f69b07d5efa2f3f80f3e651b

SHA256
70ca36cee45e66978ee3f1f27defcad4c9fe8b1a9bf1e5baed8d124ae2979aae

SHA512
5523e288bbde5c44a4b5e0332ab19d1c1a1858b40cd65baa72ec7adba1cf9ef9a052d1c8cc7038d4f39bb8b2acb6c903032b5cc687520f4e938103889144d9c4

Download Submit
C:\Windows\System\gUxoLMq.exe

Filesize
1.9MB

MD5
f50b343888e4702bc6846a8f5d34fdc6

SHA1
2cf1d2849a25ffdf07679d6d1e5deaf372af0a1f

SHA256
a6a21965af621cb35b47553abf8d60898f40d5ea1363d3fc9b524a004dfd5324

SHA512
1ef0d9c93efd3f282c151c55f8ac81f5f13b6f6ba20285ecea7557b6241e20a6e2ca568b79669f974a5c1f2b8c36ca8124654572c68ee94d65ff500c608499dd

Download Submit
C:\Windows\System\lWFoYSB.exe

Filesize
1.9MB

MD5
03fcddbeee9df3413fcf5cd2a3a17b65

SHA1
272864e3e69abb1ffa94974007d419764af1d9c3

SHA256
38e6e5c3bd840704febab7eaae9594eec521a8e505434a0138570b134fc2f6b7

SHA512
3e3c0aa275871d61f78480652a44b01370a16aac1a624f91aaf144dc8c6ecf82f2a396f460736dede0245c3174f84dbf4cfe5a0a186e274bd55e8893ebe3b6ee

Download Submit
C:\Windows\System\oValgEd.exe

Filesize
1.9MB

MD5
d0fd74ea21dca610725028c97e64667f

SHA1
d17fdd6c2b31b14cfea76b1e10eca698f099ae99

SHA256
1e824ae193063d72508e297d784931405fc9ef0b65827fb5c67d314e11c9066d

SHA512
b0e00401351855a1b070afc0c5dfd0936ccdf30149ae51aedcf135ffbead0d70be4b3e7f564cdfe134019e36925a0d58f7d7dda907a6d9011f53e57965952bb8

Download Submit
C:\Windows\System\ouZgvKd.exe

Filesize
1.9MB

MD5
100712f251f9b1d23143bf8657111ecb

SHA1
981c4989c032c04acb7177b612b7b2feb43f838e

SHA256
98e1df11fdf1a3b7990de44522d9c78907fe52bfd224d77389154fa347385e7f

SHA512
2aac61a639c4ba5e0776363ca99ddbe89c80df83096ee78c290de318a417124a8674381eeca6faae37dff1ba179bd1123db0baca0a23ddb8f9b51e26de03f03c

Download Submit
C:\Windows\System\pnoDYnr.exe

Filesize
1.9MB

MD5
8bd6b71b45ef87d0f428fb52358828bf

SHA1
05dd3e81af94832dfc690e1f2c83df5058a1acbf

SHA256
40af5e117089cc1c2a4d479fb2e5c1c5c9c37921256bfe67d60c3d9a3d9ad167

SHA512
e13a2f54c098bf1d62d760d47cef1fba0163d1310969042bf35d85f346c4b076d0d2ddb8c118a25a610038b5960d51343f16359f50ce918c19fd132db4ce5b0a

Download Submit
C:\Windows\System\qQsCumW.exe

Filesize
1.9MB

MD5
2b226ff5d8ef6c50703c34cfc57ff067

SHA1
66f6cce7174979bdf55e1d181dc24e4937eebce3

SHA256
96b2eb36729987ea9c6092fe800848e51c4610b0a225172a3bc0a498fdc59742

SHA512
0a4caab0fc2e6d474d5fed32576f6bf0fa5804075735a509a992b06ffef75bdae1fec65105839c90f9ee43769eb3e5452cb82fb313f2224dccccbc3cef2a34aa

Download Submit
C:\Windows\System\qkfOYwV.exe

Filesize
1.9MB

MD5
578f08bc05feffadcf3dcd293f4f4443

SHA1
33f67984e2e0f2cd4797b9528bd9c3e470285876

SHA256
416f37b094860c78fb98d7e313b17267c717ad6f0ce43111e240b8f1ccc972c2

SHA512
2754bec07808c077e95f897392a1e44dfec2554784c55f58c10d8b25169f0287445fa67caade7652f6f4488981d4194ec5456cebeec017143d958252cf4a5ce4

Download Submit
C:\Windows\System\rCdLGtL.exe

Filesize
1.9MB

MD5
974182fd62f2dda377ba6e1992a992a6

SHA1
21d2707db6b556efa8fd7e2b99b5da79c7f7cf22

SHA256
36e05262532218e57b490cc8420dab9a7f68b2a44420826cf4a6383b6e31ac2a

SHA512
0edefee79665483a837d5c2fd2df475a2c4889f724d2d014a264436567f807085bf89096e069355abd20c9de159917b136d36a0b6a483360faa8c150d5888c32

Download Submit
C:\Windows\System\rMEhmER.exe

Filesize
1.9MB

MD5
544b92c4a681c129ea823e2f42e0aa35

SHA1
136d90e913eefcbf9bdc82f6752dcada8416bbad

SHA256
177312f64e7772fabd635de764122f6a08222dd8f5482e3cf51aaf0c431cce08

SHA512
4dea0f0b3398f480d89cddd729e750de8941dd642c76338aec75003e57ce786517b0b1861a14d696cff0ca0ecfae44102aebff3d8f49b28a4ee31e892b165798

Download Submit
C:\Windows\System\sSWrXSc.exe

Filesize
1.9MB

MD5
47fd88a68bbf01fc0e1b15655a9ef5f1

SHA1
4554947c9673393b9b4d50a02ea35dcc8b510b9d

SHA256
ec201d5be0173d53cb2ae7f80ebb54c4aa992763e65bbf4d24890cdc1f5c3624

SHA512
6295e63ae8ca4e6b3e12edfb14b3adcd09484558b71cf3f226a6c9480b74ce355a9919b6ef24dae1c294f04fba2211d26941917bfd60b1ae2c94ab69580b7294

Download Submit
C:\Windows\System\soHBDvZ.exe

Filesize
1.9MB

MD5
9da1363aabd9649ab98263b9871f6e66

SHA1
bbcae7c78fb4c450e782ba2150a07bff470cce80

SHA256
741da24504c3f8450c23d75951d24bbcfc06b87b39d29c7d74c8d6191e9748e5

SHA512
ecd1d42e9a07938a6260c6da32a5365f01991c32434bbac6033bdbc02a31fb3329851b7ebed9432faed73297adf3c7f390b06fe4daa811fb9ad7689c3d8c9cf9

Download Submit
C:\Windows\System\yGtdIgt.exe

Filesize
1.9MB

MD5
a970bae3800014f6f221baff8d927155

SHA1
ebd5ff25d3f2a769fc2ca4fc26b84e56c3afa70f

SHA256
faf68df1cf207ff3a0cdd234ccd18309af43f6f226ac1f947bba8a55c2eb2348

SHA512
7c53b35abe08f395a34ed1ef097111cf3e15eae16c6d4ac31509dc935ed3845b0d2f72b2127e202169cdb998eb1e6e71b8ec2043ff33f99f6820580001f27510

Download Submit
memory/4684-0-0x00000238B14D0000-0x00000238B14E0000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads