xmrig | ada4df573c45bf79c8ae5f1a254112c05808c4604847f257ee65b42936874334

Analysis

max time kernel
100s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
24/12/2024, 00:29 UTC

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ada4df573c45bf79c8ae5f1a254112c05808c4604847f257ee65b42936874334.exe
Size

1.1MB
MD5

97f4f8cdb5c05b8b65739848e09ba22e
SHA1

1c5001758a1f210610b495afe6260e13c965bcba
SHA256

ada4df573c45bf79c8ae5f1a254112c05808c4604847f257ee65b42936874334
SHA512

7a39c82cb845b208a8da8a5366d2a9871b005883b39921bea4b39babc8f027480b6153bbcef6712f8528089c26f94c353f8ab61b44f2c8b2ba00b1508f98c029
SSDEEP

24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbpwlKenszQEMrJkZlFG:GezaTF8FcNkNdfE0pZ9ozttwIRQ3

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 33 IoCs

miner

resource	yara_rule
behavioral2/files/0x000a000000023c0e-4.dat	xmrig
behavioral2/files/0x0007000000023cb4-9.dat	xmrig
behavioral2/files/0x0007000000023cb5-13.dat	xmrig
behavioral2/files/0x0007000000023cb6-20.dat	xmrig
behavioral2/files/0x0007000000023cb7-27.dat	xmrig
behavioral2/files/0x0007000000023cb9-33.dat	xmrig
behavioral2/files/0x0007000000023cbe-62.dat	xmrig
behavioral2/files/0x0007000000023cc1-76.dat	xmrig
behavioral2/files/0x0007000000023cc3-89.dat	xmrig
behavioral2/files/0x0007000000023cce-136.dat	xmrig
behavioral2/files/0x0007000000023cd3-161.dat	xmrig
behavioral2/files/0x0007000000023cd1-159.dat	xmrig
behavioral2/files/0x0007000000023cd2-156.dat	xmrig
behavioral2/files/0x0007000000023cd0-154.dat	xmrig
behavioral2/files/0x0007000000023ccf-149.dat	xmrig
behavioral2/files/0x0007000000023ccd-139.dat	xmrig
behavioral2/files/0x0007000000023ccc-134.dat	xmrig
behavioral2/files/0x0007000000023ccb-129.dat	xmrig
behavioral2/files/0x0007000000023cca-124.dat	xmrig
behavioral2/files/0x0007000000023cc9-119.dat	xmrig
behavioral2/files/0x0007000000023cc8-114.dat	xmrig
behavioral2/files/0x0007000000023cc7-109.dat	xmrig
behavioral2/files/0x0007000000023cc6-104.dat	xmrig
behavioral2/files/0x0007000000023cc5-99.dat	xmrig
behavioral2/files/0x0007000000023cc4-94.dat	xmrig
behavioral2/files/0x0007000000023cc2-84.dat	xmrig
behavioral2/files/0x0007000000023cc0-72.dat	xmrig
behavioral2/files/0x0007000000023cbf-64.dat	xmrig
behavioral2/files/0x0007000000023cbd-59.dat	xmrig
behavioral2/files/0x0007000000023cbc-54.dat	xmrig
behavioral2/files/0x0007000000023cbb-49.dat	xmrig
behavioral2/files/0x0007000000023cba-41.dat	xmrig
behavioral2/files/0x0007000000023cb8-31.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
856	QymvCjg.exe
3084	riKEHUa.exe
3692	ujnRWSA.exe
1300	RiDeVjZ.exe
1524	jrdgdGF.exe
3308	CWXGBOj.exe
3168	pWcCYRx.exe
1592	SZeQpWd.exe
2364	iWOtEdC.exe
5112	YwfUjzq.exe
4456	JisSPzB.exe
1560	gRbBKSZ.exe
4836	BQPkPiD.exe
3732	fWYzpbn.exe
4984	aKBwJTV.exe
4464	KpgEEmj.exe
2512	CjbdWhf.exe
2872	JoDsmKn.exe
4992	cMkwrgl.exe
4804	DVvoMnh.exe
1216	tnRWQUv.exe
3244	mofvCdX.exe
3428	HNRSiBe.exe
3848	sYZfkqX.exe
1948	poGQoTZ.exe
4752	SNlgeSx.exe
2416	FChLpMu.exe
1864	HLxnMeF.exe
4336	ymwGvNq.exe
5092	tPLfgyT.exe
756	ubZljFu.exe
4220	XUEmzRu.exe
4112	lErNret.exe
2044	ciEbZsx.exe
2516	lrzfSpz.exe
4396	Vbmrcbv.exe
1336	dokfrXC.exe
4820	vLdsMXW.exe
4436	HhUXEvx.exe
1776	BnWyHBu.exe
1016	OSXWVal.exe
1580	QhIRgmE.exe
4560	EZWqEzB.exe
2800	muZpxlB.exe
1308	GxqLPQt.exe
4476	VCGarfQ.exe
4348	ohTOmEe.exe
3456	fgfGabz.exe
1860	TSPmySH.exe
4140	NyFRvTz.exe
3080	vLZeXFC.exe
2480	LcyyLPk.exe
3892	CIIqMYt.exe
3060	vJEYNpS.exe
2412	WvIERcT.exe
4424	DMiYgiq.exe
1448	LlhVCfb.exe
1696	YxMdQSL.exe
3756	uIWcflD.exe
208	UNYDNcs.exe
1408	quAYlYm.exe
4956	cnMHFEF.exe
2124	YPKlwxT.exe
1660	eHaocnP.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\lDPsrQP.exe	ada4df573c45bf79c8ae5f1a254112c05808c4604847f257ee65b42936874334.exe
File created	C:\Windows\System\JuhEJat.exe	ada4df573c45bf79c8ae5f1a254112c05808c4604847f257ee65b42936874334.exe
File created	C:\Windows\System\kwCXeai.exe	ada4df573c45bf79c8ae5f1a254112c05808c4604847f257ee65b42936874334.exe
File created	C:\Windows\System\gXSputO.exe	ada4df573c45bf79c8ae5f1a254112c05808c4604847f257ee65b42936874334.exe
File created	C:\Windows\System\AtUmICm.exe	ada4df573c45bf79c8ae5f1a254112c05808c4604847f257ee65b42936874334.exe
File created	C:\Windows\System\HzIJGRI.exe	ada4df573c45bf79c8ae5f1a254112c05808c4604847f257ee65b42936874334.exe
File created	C:\Windows\System\feCQjaw.exe	ada4df573c45bf79c8ae5f1a254112c05808c4604847f257ee65b42936874334.exe
File created	C:\Windows\System\tqshzkF.exe	ada4df573c45bf79c8ae5f1a254112c05808c4604847f257ee65b42936874334.exe
File created	C:\Windows\System\gxziUqR.exe	ada4df573c45bf79c8ae5f1a254112c05808c4604847f257ee65b42936874334.exe
File created	C:\Windows\System\lCPgFrZ.exe	ada4df573c45bf79c8ae5f1a254112c05808c4604847f257ee65b42936874334.exe
File created	C:\Windows\System\KzftZSO.exe	ada4df573c45bf79c8ae5f1a254112c05808c4604847f257ee65b42936874334.exe
File created	C:\Windows\System\HFxBVWt.exe	ada4df573c45bf79c8ae5f1a254112c05808c4604847f257ee65b42936874334.exe
File created	C:\Windows\System\XXkUnEI.exe	ada4df573c45bf79c8ae5f1a254112c05808c4604847f257ee65b42936874334.exe
File created	C:\Windows\System\dBtllWz.exe	ada4df573c45bf79c8ae5f1a254112c05808c4604847f257ee65b42936874334.exe
File created	C:\Windows\System\YoccFad.exe	ada4df573c45bf79c8ae5f1a254112c05808c4604847f257ee65b42936874334.exe
File created	C:\Windows\System\hJtGONG.exe	ada4df573c45bf79c8ae5f1a254112c05808c4604847f257ee65b42936874334.exe
File created	C:\Windows\System\jQGBtnJ.exe	ada4df573c45bf79c8ae5f1a254112c05808c4604847f257ee65b42936874334.exe
File created	C:\Windows\System\TLYVtUr.exe	ada4df573c45bf79c8ae5f1a254112c05808c4604847f257ee65b42936874334.exe
File created	C:\Windows\System\LviGNiI.exe	ada4df573c45bf79c8ae5f1a254112c05808c4604847f257ee65b42936874334.exe
File created	C:\Windows\System\TfsPmjG.exe	ada4df573c45bf79c8ae5f1a254112c05808c4604847f257ee65b42936874334.exe
File created	C:\Windows\System\hmRuQKe.exe	ada4df573c45bf79c8ae5f1a254112c05808c4604847f257ee65b42936874334.exe
File created	C:\Windows\System\OBnMlZT.exe	ada4df573c45bf79c8ae5f1a254112c05808c4604847f257ee65b42936874334.exe
File created	C:\Windows\System\LBdmWAK.exe	ada4df573c45bf79c8ae5f1a254112c05808c4604847f257ee65b42936874334.exe
File created	C:\Windows\System\nstzdxl.exe	ada4df573c45bf79c8ae5f1a254112c05808c4604847f257ee65b42936874334.exe
File created	C:\Windows\System\AWLTXCY.exe	ada4df573c45bf79c8ae5f1a254112c05808c4604847f257ee65b42936874334.exe
File created	C:\Windows\System\uUgRTsA.exe	ada4df573c45bf79c8ae5f1a254112c05808c4604847f257ee65b42936874334.exe
File created	C:\Windows\System\FWFWDfl.exe	ada4df573c45bf79c8ae5f1a254112c05808c4604847f257ee65b42936874334.exe
File created	C:\Windows\System\mbyIvlw.exe	ada4df573c45bf79c8ae5f1a254112c05808c4604847f257ee65b42936874334.exe
File created	C:\Windows\System\xUqyXUk.exe	ada4df573c45bf79c8ae5f1a254112c05808c4604847f257ee65b42936874334.exe
File created	C:\Windows\System\XNlOHkO.exe	ada4df573c45bf79c8ae5f1a254112c05808c4604847f257ee65b42936874334.exe
File created	C:\Windows\System\ZrgYvfh.exe	ada4df573c45bf79c8ae5f1a254112c05808c4604847f257ee65b42936874334.exe
File created	C:\Windows\System\XYklbuc.exe	ada4df573c45bf79c8ae5f1a254112c05808c4604847f257ee65b42936874334.exe
File created	C:\Windows\System\OPeacTK.exe	ada4df573c45bf79c8ae5f1a254112c05808c4604847f257ee65b42936874334.exe
File created	C:\Windows\System\YVSDaYx.exe	ada4df573c45bf79c8ae5f1a254112c05808c4604847f257ee65b42936874334.exe
File created	C:\Windows\System\XgKpGVA.exe	ada4df573c45bf79c8ae5f1a254112c05808c4604847f257ee65b42936874334.exe
File created	C:\Windows\System\eblFiBR.exe	ada4df573c45bf79c8ae5f1a254112c05808c4604847f257ee65b42936874334.exe
File created	C:\Windows\System\lrzfSpz.exe	ada4df573c45bf79c8ae5f1a254112c05808c4604847f257ee65b42936874334.exe
File created	C:\Windows\System\ZaOnfAy.exe	ada4df573c45bf79c8ae5f1a254112c05808c4604847f257ee65b42936874334.exe
File created	C:\Windows\System\AIbHfqp.exe	ada4df573c45bf79c8ae5f1a254112c05808c4604847f257ee65b42936874334.exe
File created	C:\Windows\System\SgAYhwY.exe	ada4df573c45bf79c8ae5f1a254112c05808c4604847f257ee65b42936874334.exe
File created	C:\Windows\System\jfgpkTf.exe	ada4df573c45bf79c8ae5f1a254112c05808c4604847f257ee65b42936874334.exe
File created	C:\Windows\System\GhVokyN.exe	ada4df573c45bf79c8ae5f1a254112c05808c4604847f257ee65b42936874334.exe
File created	C:\Windows\System\idaubEN.exe	ada4df573c45bf79c8ae5f1a254112c05808c4604847f257ee65b42936874334.exe
File created	C:\Windows\System\pJzuegt.exe	ada4df573c45bf79c8ae5f1a254112c05808c4604847f257ee65b42936874334.exe
File created	C:\Windows\System\ZdlLqXI.exe	ada4df573c45bf79c8ae5f1a254112c05808c4604847f257ee65b42936874334.exe
File created	C:\Windows\System\LKLNFBE.exe	ada4df573c45bf79c8ae5f1a254112c05808c4604847f257ee65b42936874334.exe
File created	C:\Windows\System\nCXmfqO.exe	ada4df573c45bf79c8ae5f1a254112c05808c4604847f257ee65b42936874334.exe
File created	C:\Windows\System\CkRwYxW.exe	ada4df573c45bf79c8ae5f1a254112c05808c4604847f257ee65b42936874334.exe
File created	C:\Windows\System\zdnBojv.exe	ada4df573c45bf79c8ae5f1a254112c05808c4604847f257ee65b42936874334.exe
File created	C:\Windows\System\yEgJQRr.exe	ada4df573c45bf79c8ae5f1a254112c05808c4604847f257ee65b42936874334.exe
File created	C:\Windows\System\dVXPtUx.exe	ada4df573c45bf79c8ae5f1a254112c05808c4604847f257ee65b42936874334.exe
File created	C:\Windows\System\YQyhuvR.exe	ada4df573c45bf79c8ae5f1a254112c05808c4604847f257ee65b42936874334.exe
File created	C:\Windows\System\SZioGEz.exe	ada4df573c45bf79c8ae5f1a254112c05808c4604847f257ee65b42936874334.exe
File created	C:\Windows\System\fKSvoGH.exe	ada4df573c45bf79c8ae5f1a254112c05808c4604847f257ee65b42936874334.exe
File created	C:\Windows\System\eiOMYTq.exe	ada4df573c45bf79c8ae5f1a254112c05808c4604847f257ee65b42936874334.exe
File created	C:\Windows\System\uLFpSvq.exe	ada4df573c45bf79c8ae5f1a254112c05808c4604847f257ee65b42936874334.exe
File created	C:\Windows\System\UNYDNcs.exe	ada4df573c45bf79c8ae5f1a254112c05808c4604847f257ee65b42936874334.exe
File created	C:\Windows\System\qFeYmZP.exe	ada4df573c45bf79c8ae5f1a254112c05808c4604847f257ee65b42936874334.exe
File created	C:\Windows\System\JLvlzub.exe	ada4df573c45bf79c8ae5f1a254112c05808c4604847f257ee65b42936874334.exe
File created	C:\Windows\System\PkftyRJ.exe	ada4df573c45bf79c8ae5f1a254112c05808c4604847f257ee65b42936874334.exe
File created	C:\Windows\System\KjxniEi.exe	ada4df573c45bf79c8ae5f1a254112c05808c4604847f257ee65b42936874334.exe
File created	C:\Windows\System\KUbBguT.exe	ada4df573c45bf79c8ae5f1a254112c05808c4604847f257ee65b42936874334.exe
File created	C:\Windows\System\knSsgNh.exe	ada4df573c45bf79c8ae5f1a254112c05808c4604847f257ee65b42936874334.exe
File created	C:\Windows\System\szEufNM.exe	ada4df573c45bf79c8ae5f1a254112c05808c4604847f257ee65b42936874334.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	17104	dwm.exe
Token: SeChangeNotifyPrivilege	17104	dwm.exe
Token: 33	17104	dwm.exe
Token: SeIncBasePriorityPrivilege	17104	dwm.exe
Token: SeShutdownPrivilege	17104	dwm.exe
Token: SeCreatePagefilePrivilege	17104	dwm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1060 wrote to memory of 856	1060	ada4df573c45bf79c8ae5f1a254112c05808c4604847f257ee65b42936874334.exe	84
PID 1060 wrote to memory of 856	1060	ada4df573c45bf79c8ae5f1a254112c05808c4604847f257ee65b42936874334.exe	84
PID 1060 wrote to memory of 3084	1060	ada4df573c45bf79c8ae5f1a254112c05808c4604847f257ee65b42936874334.exe	85
PID 1060 wrote to memory of 3084	1060	ada4df573c45bf79c8ae5f1a254112c05808c4604847f257ee65b42936874334.exe	85
PID 1060 wrote to memory of 3692	1060	ada4df573c45bf79c8ae5f1a254112c05808c4604847f257ee65b42936874334.exe	86
PID 1060 wrote to memory of 3692	1060	ada4df573c45bf79c8ae5f1a254112c05808c4604847f257ee65b42936874334.exe	86
PID 1060 wrote to memory of 1300	1060	ada4df573c45bf79c8ae5f1a254112c05808c4604847f257ee65b42936874334.exe	87
PID 1060 wrote to memory of 1300	1060	ada4df573c45bf79c8ae5f1a254112c05808c4604847f257ee65b42936874334.exe	87
PID 1060 wrote to memory of 1524	1060	ada4df573c45bf79c8ae5f1a254112c05808c4604847f257ee65b42936874334.exe	88
PID 1060 wrote to memory of 1524	1060	ada4df573c45bf79c8ae5f1a254112c05808c4604847f257ee65b42936874334.exe	88
PID 1060 wrote to memory of 3308	1060	ada4df573c45bf79c8ae5f1a254112c05808c4604847f257ee65b42936874334.exe	89
PID 1060 wrote to memory of 3308	1060	ada4df573c45bf79c8ae5f1a254112c05808c4604847f257ee65b42936874334.exe	89
PID 1060 wrote to memory of 3168	1060	ada4df573c45bf79c8ae5f1a254112c05808c4604847f257ee65b42936874334.exe	90
PID 1060 wrote to memory of 3168	1060	ada4df573c45bf79c8ae5f1a254112c05808c4604847f257ee65b42936874334.exe	90
PID 1060 wrote to memory of 1592	1060	ada4df573c45bf79c8ae5f1a254112c05808c4604847f257ee65b42936874334.exe	91
PID 1060 wrote to memory of 1592	1060	ada4df573c45bf79c8ae5f1a254112c05808c4604847f257ee65b42936874334.exe	91
PID 1060 wrote to memory of 2364	1060	ada4df573c45bf79c8ae5f1a254112c05808c4604847f257ee65b42936874334.exe	92
PID 1060 wrote to memory of 2364	1060	ada4df573c45bf79c8ae5f1a254112c05808c4604847f257ee65b42936874334.exe	92
PID 1060 wrote to memory of 5112	1060	ada4df573c45bf79c8ae5f1a254112c05808c4604847f257ee65b42936874334.exe	93
PID 1060 wrote to memory of 5112	1060	ada4df573c45bf79c8ae5f1a254112c05808c4604847f257ee65b42936874334.exe	93
PID 1060 wrote to memory of 4456	1060	ada4df573c45bf79c8ae5f1a254112c05808c4604847f257ee65b42936874334.exe	94
PID 1060 wrote to memory of 4456	1060	ada4df573c45bf79c8ae5f1a254112c05808c4604847f257ee65b42936874334.exe	94
PID 1060 wrote to memory of 1560	1060	ada4df573c45bf79c8ae5f1a254112c05808c4604847f257ee65b42936874334.exe	95
PID 1060 wrote to memory of 1560	1060	ada4df573c45bf79c8ae5f1a254112c05808c4604847f257ee65b42936874334.exe	95
PID 1060 wrote to memory of 4836	1060	ada4df573c45bf79c8ae5f1a254112c05808c4604847f257ee65b42936874334.exe	96
PID 1060 wrote to memory of 4836	1060	ada4df573c45bf79c8ae5f1a254112c05808c4604847f257ee65b42936874334.exe	96
PID 1060 wrote to memory of 3732	1060	ada4df573c45bf79c8ae5f1a254112c05808c4604847f257ee65b42936874334.exe	97
PID 1060 wrote to memory of 3732	1060	ada4df573c45bf79c8ae5f1a254112c05808c4604847f257ee65b42936874334.exe	97
PID 1060 wrote to memory of 4984	1060	ada4df573c45bf79c8ae5f1a254112c05808c4604847f257ee65b42936874334.exe	98
PID 1060 wrote to memory of 4984	1060	ada4df573c45bf79c8ae5f1a254112c05808c4604847f257ee65b42936874334.exe	98
PID 1060 wrote to memory of 4464	1060	ada4df573c45bf79c8ae5f1a254112c05808c4604847f257ee65b42936874334.exe	99
PID 1060 wrote to memory of 4464	1060	ada4df573c45bf79c8ae5f1a254112c05808c4604847f257ee65b42936874334.exe	99
PID 1060 wrote to memory of 2512	1060	ada4df573c45bf79c8ae5f1a254112c05808c4604847f257ee65b42936874334.exe	100
PID 1060 wrote to memory of 2512	1060	ada4df573c45bf79c8ae5f1a254112c05808c4604847f257ee65b42936874334.exe	100
PID 1060 wrote to memory of 2872	1060	ada4df573c45bf79c8ae5f1a254112c05808c4604847f257ee65b42936874334.exe	101
PID 1060 wrote to memory of 2872	1060	ada4df573c45bf79c8ae5f1a254112c05808c4604847f257ee65b42936874334.exe	101
PID 1060 wrote to memory of 4992	1060	ada4df573c45bf79c8ae5f1a254112c05808c4604847f257ee65b42936874334.exe	102
PID 1060 wrote to memory of 4992	1060	ada4df573c45bf79c8ae5f1a254112c05808c4604847f257ee65b42936874334.exe	102
PID 1060 wrote to memory of 4804	1060	ada4df573c45bf79c8ae5f1a254112c05808c4604847f257ee65b42936874334.exe	103
PID 1060 wrote to memory of 4804	1060	ada4df573c45bf79c8ae5f1a254112c05808c4604847f257ee65b42936874334.exe	103
PID 1060 wrote to memory of 1216	1060	ada4df573c45bf79c8ae5f1a254112c05808c4604847f257ee65b42936874334.exe	104
PID 1060 wrote to memory of 1216	1060	ada4df573c45bf79c8ae5f1a254112c05808c4604847f257ee65b42936874334.exe	104
PID 1060 wrote to memory of 3244	1060	ada4df573c45bf79c8ae5f1a254112c05808c4604847f257ee65b42936874334.exe	105
PID 1060 wrote to memory of 3244	1060	ada4df573c45bf79c8ae5f1a254112c05808c4604847f257ee65b42936874334.exe	105
PID 1060 wrote to memory of 3428	1060	ada4df573c45bf79c8ae5f1a254112c05808c4604847f257ee65b42936874334.exe	106
PID 1060 wrote to memory of 3428	1060	ada4df573c45bf79c8ae5f1a254112c05808c4604847f257ee65b42936874334.exe	106
PID 1060 wrote to memory of 3848	1060	ada4df573c45bf79c8ae5f1a254112c05808c4604847f257ee65b42936874334.exe	107
PID 1060 wrote to memory of 3848	1060	ada4df573c45bf79c8ae5f1a254112c05808c4604847f257ee65b42936874334.exe	107
PID 1060 wrote to memory of 1948	1060	ada4df573c45bf79c8ae5f1a254112c05808c4604847f257ee65b42936874334.exe	108
PID 1060 wrote to memory of 1948	1060	ada4df573c45bf79c8ae5f1a254112c05808c4604847f257ee65b42936874334.exe	108
PID 1060 wrote to memory of 4752	1060	ada4df573c45bf79c8ae5f1a254112c05808c4604847f257ee65b42936874334.exe	109
PID 1060 wrote to memory of 4752	1060	ada4df573c45bf79c8ae5f1a254112c05808c4604847f257ee65b42936874334.exe	109
PID 1060 wrote to memory of 2416	1060	ada4df573c45bf79c8ae5f1a254112c05808c4604847f257ee65b42936874334.exe	110
PID 1060 wrote to memory of 2416	1060	ada4df573c45bf79c8ae5f1a254112c05808c4604847f257ee65b42936874334.exe	110
PID 1060 wrote to memory of 1864	1060	ada4df573c45bf79c8ae5f1a254112c05808c4604847f257ee65b42936874334.exe	111
PID 1060 wrote to memory of 1864	1060	ada4df573c45bf79c8ae5f1a254112c05808c4604847f257ee65b42936874334.exe	111
PID 1060 wrote to memory of 4336	1060	ada4df573c45bf79c8ae5f1a254112c05808c4604847f257ee65b42936874334.exe	112
PID 1060 wrote to memory of 4336	1060	ada4df573c45bf79c8ae5f1a254112c05808c4604847f257ee65b42936874334.exe	112
PID 1060 wrote to memory of 5092	1060	ada4df573c45bf79c8ae5f1a254112c05808c4604847f257ee65b42936874334.exe	113
PID 1060 wrote to memory of 5092	1060	ada4df573c45bf79c8ae5f1a254112c05808c4604847f257ee65b42936874334.exe	113
PID 1060 wrote to memory of 756	1060	ada4df573c45bf79c8ae5f1a254112c05808c4604847f257ee65b42936874334.exe	114
PID 1060 wrote to memory of 756	1060	ada4df573c45bf79c8ae5f1a254112c05808c4604847f257ee65b42936874334.exe	114
PID 1060 wrote to memory of 4220	1060	ada4df573c45bf79c8ae5f1a254112c05808c4604847f257ee65b42936874334.exe	115
PID 1060 wrote to memory of 4220	1060	ada4df573c45bf79c8ae5f1a254112c05808c4604847f257ee65b42936874334.exe	115

C:\Users\Admin\AppData\Local\Temp\ada4df573c45bf79c8ae5f1a254112c05808c4604847f257ee65b42936874334.exe
"C:\Users\Admin\AppData\Local\Temp\ada4df573c45bf79c8ae5f1a254112c05808c4604847f257ee65b42936874334.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1060
- C:\Windows\System\QymvCjg.exe
  C:\Windows\System\QymvCjg.exe
  2⤵
  - Executes dropped EXE
  PID:856
- C:\Windows\System\riKEHUa.exe
  C:\Windows\System\riKEHUa.exe
  2⤵
  - Executes dropped EXE
  PID:3084
- C:\Windows\System\ujnRWSA.exe
  C:\Windows\System\ujnRWSA.exe
  2⤵
  - Executes dropped EXE
  PID:3692
- C:\Windows\System\RiDeVjZ.exe
  C:\Windows\System\RiDeVjZ.exe
  2⤵
  - Executes dropped EXE
  PID:1300
- C:\Windows\System\jrdgdGF.exe
  C:\Windows\System\jrdgdGF.exe
  2⤵
  - Executes dropped EXE
  PID:1524
- C:\Windows\System\CWXGBOj.exe
  C:\Windows\System\CWXGBOj.exe
  2⤵
  - Executes dropped EXE
  PID:3308
- C:\Windows\System\pWcCYRx.exe
  C:\Windows\System\pWcCYRx.exe
  2⤵
  - Executes dropped EXE
  PID:3168
- C:\Windows\System\SZeQpWd.exe
  C:\Windows\System\SZeQpWd.exe
  2⤵
  - Executes dropped EXE
  PID:1592
- C:\Windows\System\iWOtEdC.exe
  C:\Windows\System\iWOtEdC.exe
  2⤵
  - Executes dropped EXE
  PID:2364
- C:\Windows\System\YwfUjzq.exe
  C:\Windows\System\YwfUjzq.exe
  2⤵
  - Executes dropped EXE
  PID:5112
- C:\Windows\System\JisSPzB.exe
  C:\Windows\System\JisSPzB.exe
  2⤵
  - Executes dropped EXE
  PID:4456
- C:\Windows\System\gRbBKSZ.exe
  C:\Windows\System\gRbBKSZ.exe
  2⤵
  - Executes dropped EXE
  PID:1560
- C:\Windows\System\BQPkPiD.exe
  C:\Windows\System\BQPkPiD.exe
  2⤵
  - Executes dropped EXE
  PID:4836
- C:\Windows\System\fWYzpbn.exe
  C:\Windows\System\fWYzpbn.exe
  2⤵
  - Executes dropped EXE
  PID:3732
- C:\Windows\System\aKBwJTV.exe
  C:\Windows\System\aKBwJTV.exe
  2⤵
  - Executes dropped EXE
  PID:4984
- C:\Windows\System\KpgEEmj.exe
  C:\Windows\System\KpgEEmj.exe
  2⤵
  - Executes dropped EXE
  PID:4464
- C:\Windows\System\CjbdWhf.exe
  C:\Windows\System\CjbdWhf.exe
  2⤵
  - Executes dropped EXE
  PID:2512
- C:\Windows\System\JoDsmKn.exe
  C:\Windows\System\JoDsmKn.exe
  2⤵
  - Executes dropped EXE
  PID:2872
- C:\Windows\System\cMkwrgl.exe
  C:\Windows\System\cMkwrgl.exe
  2⤵
  - Executes dropped EXE
  PID:4992
- C:\Windows\System\DVvoMnh.exe
  C:\Windows\System\DVvoMnh.exe
  2⤵
  - Executes dropped EXE
  PID:4804
- C:\Windows\System\tnRWQUv.exe
  C:\Windows\System\tnRWQUv.exe
  2⤵
  - Executes dropped EXE
  PID:1216
- C:\Windows\System\mofvCdX.exe
  C:\Windows\System\mofvCdX.exe
  2⤵
  - Executes dropped EXE
  PID:3244
- C:\Windows\System\HNRSiBe.exe
  C:\Windows\System\HNRSiBe.exe
  2⤵
  - Executes dropped EXE
  PID:3428
- C:\Windows\System\sYZfkqX.exe
  C:\Windows\System\sYZfkqX.exe
  2⤵
  - Executes dropped EXE
  PID:3848
- C:\Windows\System\poGQoTZ.exe
  C:\Windows\System\poGQoTZ.exe
  2⤵
  - Executes dropped EXE
  PID:1948
- C:\Windows\System\SNlgeSx.exe
  C:\Windows\System\SNlgeSx.exe
  2⤵
  - Executes dropped EXE
  PID:4752
- C:\Windows\System\FChLpMu.exe
  C:\Windows\System\FChLpMu.exe
  2⤵
  - Executes dropped EXE
  PID:2416
- C:\Windows\System\HLxnMeF.exe
  C:\Windows\System\HLxnMeF.exe
  2⤵
  - Executes dropped EXE
  PID:1864
- C:\Windows\System\ymwGvNq.exe
  C:\Windows\System\ymwGvNq.exe
  2⤵
  - Executes dropped EXE
  PID:4336
- C:\Windows\System\tPLfgyT.exe
  C:\Windows\System\tPLfgyT.exe
  2⤵
  - Executes dropped EXE
  PID:5092
- C:\Windows\System\ubZljFu.exe
  C:\Windows\System\ubZljFu.exe
  2⤵
  - Executes dropped EXE
  PID:756
- C:\Windows\System\XUEmzRu.exe
  C:\Windows\System\XUEmzRu.exe
  2⤵
  - Executes dropped EXE
  PID:4220
- C:\Windows\System\lErNret.exe
  C:\Windows\System\lErNret.exe
  2⤵
  - Executes dropped EXE
  PID:4112
- C:\Windows\System\ciEbZsx.exe
  C:\Windows\System\ciEbZsx.exe
  2⤵
  - Executes dropped EXE
  PID:2044
- C:\Windows\System\lrzfSpz.exe
  C:\Windows\System\lrzfSpz.exe
  2⤵
  - Executes dropped EXE
  PID:2516
- C:\Windows\System\Vbmrcbv.exe
  C:\Windows\System\Vbmrcbv.exe
  2⤵
  - Executes dropped EXE
  PID:4396
- C:\Windows\System\dokfrXC.exe
  C:\Windows\System\dokfrXC.exe
  2⤵
  - Executes dropped EXE
  PID:1336
- C:\Windows\System\vLdsMXW.exe
  C:\Windows\System\vLdsMXW.exe
  2⤵
  - Executes dropped EXE
  PID:4820
- C:\Windows\System\HhUXEvx.exe
  C:\Windows\System\HhUXEvx.exe
  2⤵
  - Executes dropped EXE
  PID:4436
- C:\Windows\System\BnWyHBu.exe
  C:\Windows\System\BnWyHBu.exe
  2⤵
  - Executes dropped EXE
  PID:1776
- C:\Windows\System\OSXWVal.exe
  C:\Windows\System\OSXWVal.exe
  2⤵
  - Executes dropped EXE
  PID:1016
- C:\Windows\System\QhIRgmE.exe
  C:\Windows\System\QhIRgmE.exe
  2⤵
  - Executes dropped EXE
  PID:1580
- C:\Windows\System\EZWqEzB.exe
  C:\Windows\System\EZWqEzB.exe
  2⤵
  - Executes dropped EXE
  PID:4560
- C:\Windows\System\muZpxlB.exe
  C:\Windows\System\muZpxlB.exe
  2⤵
  - Executes dropped EXE
  PID:2800
- C:\Windows\System\GxqLPQt.exe
  C:\Windows\System\GxqLPQt.exe
  2⤵
  - Executes dropped EXE
  PID:1308
- C:\Windows\System\VCGarfQ.exe
  C:\Windows\System\VCGarfQ.exe
  2⤵
  - Executes dropped EXE
  PID:4476
- C:\Windows\System\ohTOmEe.exe
  C:\Windows\System\ohTOmEe.exe
  2⤵
  - Executes dropped EXE
  PID:4348
- C:\Windows\System\fgfGabz.exe
  C:\Windows\System\fgfGabz.exe
  2⤵
  - Executes dropped EXE
  PID:3456
- C:\Windows\System\TSPmySH.exe
  C:\Windows\System\TSPmySH.exe
  2⤵
  - Executes dropped EXE
  PID:1860
- C:\Windows\System\NyFRvTz.exe
  C:\Windows\System\NyFRvTz.exe
  2⤵
  - Executes dropped EXE
  PID:4140
- C:\Windows\System\vLZeXFC.exe
  C:\Windows\System\vLZeXFC.exe
  2⤵
  - Executes dropped EXE
  PID:3080
- C:\Windows\System\LcyyLPk.exe
  C:\Windows\System\LcyyLPk.exe
  2⤵
  - Executes dropped EXE
  PID:2480
- C:\Windows\System\CIIqMYt.exe
  C:\Windows\System\CIIqMYt.exe
  2⤵
  - Executes dropped EXE
  PID:3892
- C:\Windows\System\vJEYNpS.exe
  C:\Windows\System\vJEYNpS.exe
  2⤵
  - Executes dropped EXE
  PID:3060
- C:\Windows\System\WvIERcT.exe
  C:\Windows\System\WvIERcT.exe
  2⤵
  - Executes dropped EXE
  PID:2412
- C:\Windows\System\DMiYgiq.exe
  C:\Windows\System\DMiYgiq.exe
  2⤵
  - Executes dropped EXE
  PID:4424
- C:\Windows\System\LlhVCfb.exe
  C:\Windows\System\LlhVCfb.exe
  2⤵
  - Executes dropped EXE
  PID:1448
- C:\Windows\System\YxMdQSL.exe
  C:\Windows\System\YxMdQSL.exe
  2⤵
  - Executes dropped EXE
  PID:1696
- C:\Windows\System\uIWcflD.exe
  C:\Windows\System\uIWcflD.exe
  2⤵
  - Executes dropped EXE
  PID:3756
- C:\Windows\System\UNYDNcs.exe
  C:\Windows\System\UNYDNcs.exe
  2⤵
  - Executes dropped EXE
  PID:208
- C:\Windows\System\quAYlYm.exe
  C:\Windows\System\quAYlYm.exe
  2⤵
  - Executes dropped EXE
  PID:1408
- C:\Windows\System\cnMHFEF.exe
  C:\Windows\System\cnMHFEF.exe
  2⤵
  - Executes dropped EXE
  PID:4956
- C:\Windows\System\YPKlwxT.exe
  C:\Windows\System\YPKlwxT.exe
  2⤵
  - Executes dropped EXE
  PID:2124
- C:\Windows\System\eHaocnP.exe
  C:\Windows\System\eHaocnP.exe
  2⤵
  - Executes dropped EXE
  PID:1660
- C:\Windows\System\ojnKwwr.exe
  C:\Windows\System\ojnKwwr.exe
  2⤵
  PID:3624
- C:\Windows\System\kzXZFDM.exe
  C:\Windows\System\kzXZFDM.exe
  2⤵
  PID:4260
- C:\Windows\System\UZlsRbZ.exe
  C:\Windows\System\UZlsRbZ.exe
  2⤵
  PID:2876
- C:\Windows\System\uVMwqZv.exe
  C:\Windows\System\uVMwqZv.exe
  2⤵
  PID:3640
- C:\Windows\System\VLYdNbX.exe
  C:\Windows\System\VLYdNbX.exe
  2⤵
  PID:4504
- C:\Windows\System\YljyKTi.exe
  C:\Windows\System\YljyKTi.exe
  2⤵
  PID:996
- C:\Windows\System\ZUZOLBm.exe
  C:\Windows\System\ZUZOLBm.exe
  2⤵
  PID:952
- C:\Windows\System\GVeuVUJ.exe
  C:\Windows\System\GVeuVUJ.exe
  2⤵
  PID:3420
- C:\Windows\System\XhJzyqT.exe
  C:\Windows\System\XhJzyqT.exe
  2⤵
  PID:900
- C:\Windows\System\ZRXLAZb.exe
  C:\Windows\System\ZRXLAZb.exe
  2⤵
  PID:4936
- C:\Windows\System\NiNhphJ.exe
  C:\Windows\System\NiNhphJ.exe
  2⤵
  PID:3232
- C:\Windows\System\IQuHiGd.exe
  C:\Windows\System\IQuHiGd.exe
  2⤵
  PID:4492
- C:\Windows\System\uArtplI.exe
  C:\Windows\System\uArtplI.exe
  2⤵
  PID:3656
- C:\Windows\System\pKQERfA.exe
  C:\Windows\System\pKQERfA.exe
  2⤵
  PID:2652
- C:\Windows\System\kQGIBOC.exe
  C:\Windows\System\kQGIBOC.exe
  2⤵
  PID:3360
- C:\Windows\System\MRMUwPx.exe
  C:\Windows\System\MRMUwPx.exe
  2⤵
  PID:4532
- C:\Windows\System\MnoQgIQ.exe
  C:\Windows\System\MnoQgIQ.exe
  2⤵
  PID:3332
- C:\Windows\System\qobQLNd.exe
  C:\Windows\System\qobQLNd.exe
  2⤵
  PID:2456
- C:\Windows\System\rPLWLzc.exe
  C:\Windows\System\rPLWLzc.exe
  2⤵
  PID:1472
- C:\Windows\System\LmWQjav.exe
  C:\Windows\System\LmWQjav.exe
  2⤵
  PID:2912
- C:\Windows\System\jQOaaox.exe
  C:\Windows\System\jQOaaox.exe
  2⤵
  PID:3276
- C:\Windows\System\ylrGICB.exe
  C:\Windows\System\ylrGICB.exe
  2⤵
  PID:384
- C:\Windows\System\SETqBSr.exe
  C:\Windows\System\SETqBSr.exe
  2⤵
  PID:2856
- C:\Windows\System\ZzcVeMY.exe
  C:\Windows\System\ZzcVeMY.exe
  2⤵
  PID:5124
- C:\Windows\System\ZaOnfAy.exe
  C:\Windows\System\ZaOnfAy.exe
  2⤵
  PID:5148
- C:\Windows\System\EeFRrsp.exe
  C:\Windows\System\EeFRrsp.exe
  2⤵
  PID:5176
- C:\Windows\System\feCQjaw.exe
  C:\Windows\System\feCQjaw.exe
  2⤵
  PID:5200
- C:\Windows\System\HyEfGKt.exe
  C:\Windows\System\HyEfGKt.exe
  2⤵
  PID:5236
- C:\Windows\System\sJLoIEE.exe
  C:\Windows\System\sJLoIEE.exe
  2⤵
  PID:5260
- C:\Windows\System\inURZrU.exe
  C:\Windows\System\inURZrU.exe
  2⤵
  PID:5288
- C:\Windows\System\etqdvDe.exe
  C:\Windows\System\etqdvDe.exe
  2⤵
  PID:5316
- C:\Windows\System\gaGNdEA.exe
  C:\Windows\System\gaGNdEA.exe
  2⤵
  PID:5344
- C:\Windows\System\fUmeITP.exe
  C:\Windows\System\fUmeITP.exe
  2⤵
  PID:5372
- C:\Windows\System\EbAimRz.exe
  C:\Windows\System\EbAimRz.exe
  2⤵
  PID:5400
- C:\Windows\System\Rihddcr.exe
  C:\Windows\System\Rihddcr.exe
  2⤵
  PID:5424
- C:\Windows\System\DKBnfJg.exe
  C:\Windows\System\DKBnfJg.exe
  2⤵
  PID:5456
- C:\Windows\System\omAKJbW.exe
  C:\Windows\System\omAKJbW.exe
  2⤵
  PID:5484
- C:\Windows\System\rZfOEBM.exe
  C:\Windows\System\rZfOEBM.exe
  2⤵
  PID:5516
- C:\Windows\System\XBZSXVj.exe
  C:\Windows\System\XBZSXVj.exe
  2⤵
  PID:5540
- C:\Windows\System\tfpeyRa.exe
  C:\Windows\System\tfpeyRa.exe
  2⤵
  PID:5568
- C:\Windows\System\mbyIvlw.exe
  C:\Windows\System\mbyIvlw.exe
  2⤵
  PID:5596
- C:\Windows\System\ysRJDbo.exe
  C:\Windows\System\ysRJDbo.exe
  2⤵
  PID:5620
- C:\Windows\System\BjULDIQ.exe
  C:\Windows\System\BjULDIQ.exe
  2⤵
  PID:5652
- C:\Windows\System\TfsPmjG.exe
  C:\Windows\System\TfsPmjG.exe
  2⤵
  PID:5680
- C:\Windows\System\FZauVle.exe
  C:\Windows\System\FZauVle.exe
  2⤵
  PID:5708
- C:\Windows\System\OPeacTK.exe
  C:\Windows\System\OPeacTK.exe
  2⤵
  PID:5736
- C:\Windows\System\IbOoVTD.exe
  C:\Windows\System\IbOoVTD.exe
  2⤵
  PID:5764
- C:\Windows\System\hagbsSj.exe
  C:\Windows\System\hagbsSj.exe
  2⤵
  PID:5792
- C:\Windows\System\XlivHqE.exe
  C:\Windows\System\XlivHqE.exe
  2⤵
  PID:5824
- C:\Windows\System\tqshzkF.exe
  C:\Windows\System\tqshzkF.exe
  2⤵
  PID:5852
- C:\Windows\System\VPrmXmR.exe
  C:\Windows\System\VPrmXmR.exe
  2⤵
  PID:5876
- C:\Windows\System\VjzPRiF.exe
  C:\Windows\System\VjzPRiF.exe
  2⤵
  PID:5904
- C:\Windows\System\oIGTQLS.exe
  C:\Windows\System\oIGTQLS.exe
  2⤵
  PID:5928
- C:\Windows\System\ktuZVOr.exe
  C:\Windows\System\ktuZVOr.exe
  2⤵
  PID:5960
- C:\Windows\System\gnnFted.exe
  C:\Windows\System\gnnFted.exe
  2⤵
  PID:5988
- C:\Windows\System\SsYxyJf.exe
  C:\Windows\System\SsYxyJf.exe
  2⤵
  PID:6016
- C:\Windows\System\ftJEiah.exe
  C:\Windows\System\ftJEiah.exe
  2⤵
  PID:6044
- C:\Windows\System\ztaffkF.exe
  C:\Windows\System\ztaffkF.exe
  2⤵
  PID:6072
- C:\Windows\System\QDcuSHb.exe
  C:\Windows\System\QDcuSHb.exe
  2⤵
  PID:6104
- C:\Windows\System\TlomDvQ.exe
  C:\Windows\System\TlomDvQ.exe
  2⤵
  PID:6132
- C:\Windows\System\KRmwudE.exe
  C:\Windows\System\KRmwudE.exe
  2⤵
  PID:1104
- C:\Windows\System\MkWlHzD.exe
  C:\Windows\System\MkWlHzD.exe
  2⤵
  PID:1916
- C:\Windows\System\OMJvyOi.exe
  C:\Windows\System\OMJvyOi.exe
  2⤵
  PID:4472
- C:\Windows\System\gTaoLGz.exe
  C:\Windows\System\gTaoLGz.exe
  2⤵
  PID:3588
- C:\Windows\System\UDsJbNY.exe
  C:\Windows\System\UDsJbNY.exe
  2⤵
  PID:3104
- C:\Windows\System\jwHzetC.exe
  C:\Windows\System\jwHzetC.exe
  2⤵
  PID:4316
- C:\Windows\System\iIqdjfm.exe
  C:\Windows\System\iIqdjfm.exe
  2⤵
  PID:2752
- C:\Windows\System\pIRyozq.exe
  C:\Windows\System\pIRyozq.exe
  2⤵
  PID:3896
- C:\Windows\System\JuhEJat.exe
  C:\Windows\System\JuhEJat.exe
  2⤵
  PID:5160
- C:\Windows\System\OKCldNz.exe
  C:\Windows\System\OKCldNz.exe
  2⤵
  PID:5220
- C:\Windows\System\ERmReSV.exe
  C:\Windows\System\ERmReSV.exe
  2⤵
  PID:5280
- C:\Windows\System\AJwkouV.exe
  C:\Windows\System\AJwkouV.exe
  2⤵
  PID:5336
- C:\Windows\System\TLYVtUr.exe
  C:\Windows\System\TLYVtUr.exe
  2⤵
  PID:5416
- C:\Windows\System\knSsgNh.exe
  C:\Windows\System\knSsgNh.exe
  2⤵
  PID:5476
- C:\Windows\System\PqUfexC.exe
  C:\Windows\System\PqUfexC.exe
  2⤵
  PID:5536
- C:\Windows\System\MmIBMyn.exe
  C:\Windows\System\MmIBMyn.exe
  2⤵
  PID:5612
- C:\Windows\System\YVSDaYx.exe
  C:\Windows\System\YVSDaYx.exe
  2⤵
  PID:5672
- C:\Windows\System\OkQhnRX.exe
  C:\Windows\System\OkQhnRX.exe
  2⤵
  PID:5748
- C:\Windows\System\SefMaIi.exe
  C:\Windows\System\SefMaIi.exe
  2⤵
  PID:5804
- C:\Windows\System\nNbivuH.exe
  C:\Windows\System\nNbivuH.exe
  2⤵
  PID:5860
- C:\Windows\System\BOpDsxr.exe
  C:\Windows\System\BOpDsxr.exe
  2⤵
  PID:6004
- C:\Windows\System\VclbfnU.exe
  C:\Windows\System\VclbfnU.exe
  2⤵
  PID:6036
- C:\Windows\System\MnslCVY.exe
  C:\Windows\System\MnslCVY.exe
  2⤵
  PID:6068
- C:\Windows\System\LsNAIuf.exe
  C:\Windows\System\LsNAIuf.exe
  2⤵
  PID:6124
- C:\Windows\System\lmUxAWv.exe
  C:\Windows\System\lmUxAWv.exe
  2⤵
  PID:2756
- C:\Windows\System\FVWNPPc.exe
  C:\Windows\System\FVWNPPc.exe
  2⤵
  PID:4284
- C:\Windows\System\IoGqimZ.exe
  C:\Windows\System\IoGqimZ.exe
  2⤵
  PID:1184
- C:\Windows\System\jPNEEdW.exe
  C:\Windows\System\jPNEEdW.exe
  2⤵
  PID:3604
- C:\Windows\System\YsyGztJ.exe
  C:\Windows\System\YsyGztJ.exe
  2⤵
  PID:5196
- C:\Windows\System\AIbHfqp.exe
  C:\Windows\System\AIbHfqp.exe
  2⤵
  PID:3676
- C:\Windows\System\mjwnLXP.exe
  C:\Windows\System\mjwnLXP.exe
  2⤵
  PID:2272
- C:\Windows\System\FDcdtnr.exe
  C:\Windows\System\FDcdtnr.exe
  2⤵
  PID:5584
- C:\Windows\System\ixJqASX.exe
  C:\Windows\System\ixJqASX.exe
  2⤵
  PID:5720
- C:\Windows\System\CdtzEkS.exe
  C:\Windows\System\CdtzEkS.exe
  2⤵
  PID:5840
- C:\Windows\System\SkzRVJo.exe
  C:\Windows\System\SkzRVJo.exe
  2⤵
  PID:5952
- C:\Windows\System\eFCKWOe.exe
  C:\Windows\System\eFCKWOe.exe
  2⤵
  PID:6056
- C:\Windows\System\NTCfRty.exe
  C:\Windows\System\NTCfRty.exe
  2⤵
  PID:2380
- C:\Windows\System\dgnjjYV.exe
  C:\Windows\System\dgnjjYV.exe
  2⤵
  PID:3324
- C:\Windows\System\vpUYrFE.exe
  C:\Windows\System\vpUYrFE.exe
  2⤵
  PID:3572
- C:\Windows\System\JzMfkgS.exe
  C:\Windows\System\JzMfkgS.exe
  2⤵
  PID:5028
- C:\Windows\System\MMSpGyT.exe
  C:\Windows\System\MMSpGyT.exe
  2⤵
  PID:4776
- C:\Windows\System\lKISZQg.exe
  C:\Windows\System\lKISZQg.exe
  2⤵
  PID:5892
- C:\Windows\System\NvCtfIj.exe
  C:\Windows\System\NvCtfIj.exe
  2⤵
  PID:2632
- C:\Windows\System\hQbsBju.exe
  C:\Windows\System\hQbsBju.exe
  2⤵
  PID:1076
- C:\Windows\System\qeZGCJx.exe
  C:\Windows\System\qeZGCJx.exe
  2⤵
  PID:1544
- C:\Windows\System\eUdvhXc.exe
  C:\Windows\System\eUdvhXc.exe
  2⤵
  PID:3076
- C:\Windows\System\UekRyPG.exe
  C:\Windows\System\UekRyPG.exe
  2⤵
  PID:2536
- C:\Windows\System\OmaBAyF.exe
  C:\Windows\System\OmaBAyF.exe
  2⤵
  PID:4800
- C:\Windows\System\uCQPJZY.exe
  C:\Windows\System\uCQPJZY.exe
  2⤵
  PID:5588
- C:\Windows\System\bfXnOma.exe
  C:\Windows\System\bfXnOma.exe
  2⤵
  PID:5532
- C:\Windows\System\vAtVVyu.exe
  C:\Windows\System\vAtVVyu.exe
  2⤵
  PID:1568
- C:\Windows\System\dAUxdBH.exe
  C:\Windows\System\dAUxdBH.exe
  2⤵
  PID:6148
- C:\Windows\System\uiNIBPm.exe
  C:\Windows\System\uiNIBPm.exe
  2⤵
  PID:6164
- C:\Windows\System\Lvayrfs.exe
  C:\Windows\System\Lvayrfs.exe
  2⤵
  PID:6192
- C:\Windows\System\JbcghNd.exe
  C:\Windows\System\JbcghNd.exe
  2⤵
  PID:6216
- C:\Windows\System\LxtpsmM.exe
  C:\Windows\System\LxtpsmM.exe
  2⤵
  PID:6240
- C:\Windows\System\zAFfHYm.exe
  C:\Windows\System\zAFfHYm.exe
  2⤵
  PID:6264
- C:\Windows\System\pJzuegt.exe
  C:\Windows\System\pJzuegt.exe
  2⤵
  PID:6280
- C:\Windows\System\KNpczRI.exe
  C:\Windows\System\KNpczRI.exe
  2⤵
  PID:6316
- C:\Windows\System\rEzbfzg.exe
  C:\Windows\System\rEzbfzg.exe
  2⤵
  PID:6340
- C:\Windows\System\NQFKXuC.exe
  C:\Windows\System\NQFKXuC.exe
  2⤵
  PID:6368
- C:\Windows\System\EZhikFb.exe
  C:\Windows\System\EZhikFb.exe
  2⤵
  PID:6392
- C:\Windows\System\YuDhAXA.exe
  C:\Windows\System\YuDhAXA.exe
  2⤵
  PID:6452
- C:\Windows\System\isIpGWn.exe
  C:\Windows\System\isIpGWn.exe
  2⤵
  PID:6472
- C:\Windows\System\ndOuaYP.exe
  C:\Windows\System\ndOuaYP.exe
  2⤵
  PID:6492
- C:\Windows\System\nzDGTnq.exe
  C:\Windows\System\nzDGTnq.exe
  2⤵
  PID:6516
- C:\Windows\System\rDcJnxE.exe
  C:\Windows\System\rDcJnxE.exe
  2⤵
  PID:6532
- C:\Windows\System\roLOKzk.exe
  C:\Windows\System\roLOKzk.exe
  2⤵
  PID:6572
- C:\Windows\System\aNqUPnm.exe
  C:\Windows\System\aNqUPnm.exe
  2⤵
  PID:6592
- C:\Windows\System\TeBHGeD.exe
  C:\Windows\System\TeBHGeD.exe
  2⤵
  PID:6636
- C:\Windows\System\WfJToiq.exe
  C:\Windows\System\WfJToiq.exe
  2⤵
  PID:6660
- C:\Windows\System\cESjkKQ.exe
  C:\Windows\System\cESjkKQ.exe
  2⤵
  PID:6696
- C:\Windows\System\izkJkgY.exe
  C:\Windows\System\izkJkgY.exe
  2⤵
  PID:6712
- C:\Windows\System\OaufkgS.exe
  C:\Windows\System\OaufkgS.exe
  2⤵
  PID:6740
- C:\Windows\System\aJUHWDm.exe
  C:\Windows\System\aJUHWDm.exe
  2⤵
  PID:6780
- C:\Windows\System\bWIFudR.exe
  C:\Windows\System\bWIFudR.exe
  2⤵
  PID:6820
- C:\Windows\System\jELedqB.exe
  C:\Windows\System\jELedqB.exe
  2⤵
  PID:6848
- C:\Windows\System\QNvnotj.exe
  C:\Windows\System\QNvnotj.exe
  2⤵
  PID:6876
- C:\Windows\System\rftBqni.exe
  C:\Windows\System\rftBqni.exe
  2⤵
  PID:6896
- C:\Windows\System\nafnrPw.exe
  C:\Windows\System\nafnrPw.exe
  2⤵
  PID:6920
- C:\Windows\System\bqDHbBS.exe
  C:\Windows\System\bqDHbBS.exe
  2⤵
  PID:6952
- C:\Windows\System\ORppVbE.exe
  C:\Windows\System\ORppVbE.exe
  2⤵
  PID:6980
- C:\Windows\System\HxMrggA.exe
  C:\Windows\System\HxMrggA.exe
  2⤵
  PID:7004
- C:\Windows\System\bWgIKAJ.exe
  C:\Windows\System\bWgIKAJ.exe
  2⤵
  PID:7036
- C:\Windows\System\aTDWEeo.exe
  C:\Windows\System\aTDWEeo.exe
  2⤵
  PID:7056
- C:\Windows\System\yxCHOHL.exe
  C:\Windows\System\yxCHOHL.exe
  2⤵
  PID:7092
- C:\Windows\System\avPOMtg.exe
  C:\Windows\System\avPOMtg.exe
  2⤵
  PID:7112
- C:\Windows\System\NytHSyF.exe
  C:\Windows\System\NytHSyF.exe
  2⤵
  PID:7144
- C:\Windows\System\ZFFZweC.exe
  C:\Windows\System\ZFFZweC.exe
  2⤵
  PID:7164
- C:\Windows\System\nEerjhO.exe
  C:\Windows\System\nEerjhO.exe
  2⤵
  PID:5392
- C:\Windows\System\ZkEigQa.exe
  C:\Windows\System\ZkEigQa.exe
  2⤵
  PID:6184
- C:\Windows\System\ODTllEv.exe
  C:\Windows\System\ODTllEv.exe
  2⤵
  PID:6276
- C:\Windows\System\SMqQZob.exe
  C:\Windows\System\SMqQZob.exe
  2⤵
  PID:6304
- C:\Windows\System\FGUzaRF.exe
  C:\Windows\System\FGUzaRF.exe
  2⤵
  PID:6388
- C:\Windows\System\jkRzXKp.exe
  C:\Windows\System\jkRzXKp.exe
  2⤵
  PID:6480
- C:\Windows\System\bzbohcm.exe
  C:\Windows\System\bzbohcm.exe
  2⤵
  PID:6524
- C:\Windows\System\BdgHbPB.exe
  C:\Windows\System\BdgHbPB.exe
  2⤵
  PID:6584
- C:\Windows\System\ZGfoATP.exe
  C:\Windows\System\ZGfoATP.exe
  2⤵
  PID:6680
- C:\Windows\System\ZrgYvfh.exe
  C:\Windows\System\ZrgYvfh.exe
  2⤵
  PID:6748
- C:\Windows\System\KIgwTCI.exe
  C:\Windows\System\KIgwTCI.exe
  2⤵
  PID:6768
- C:\Windows\System\hhhEszs.exe
  C:\Windows\System\hhhEszs.exe
  2⤵
  PID:6832
- C:\Windows\System\gmcaryO.exe
  C:\Windows\System\gmcaryO.exe
  2⤵
  PID:6912
- C:\Windows\System\BkuhYJB.exe
  C:\Windows\System\BkuhYJB.exe
  2⤵
  PID:7024
- C:\Windows\System\pjkWKPn.exe
  C:\Windows\System\pjkWKPn.exe
  2⤵
  PID:7084
- C:\Windows\System\FPjvnPk.exe
  C:\Windows\System\FPjvnPk.exe
  2⤵
  PID:7100
- C:\Windows\System\kNSDDrW.exe
  C:\Windows\System\kNSDDrW.exe
  2⤵
  PID:7160
- C:\Windows\System\bwbQYLR.exe
  C:\Windows\System\bwbQYLR.exe
  2⤵
  PID:4008
- C:\Windows\System\ylmXuUH.exe
  C:\Windows\System\ylmXuUH.exe
  2⤵
  PID:6348
- C:\Windows\System\lYoPbyA.exe
  C:\Windows\System\lYoPbyA.exe
  2⤵
  PID:6556
- C:\Windows\System\aVbnCmE.exe
  C:\Windows\System\aVbnCmE.exe
  2⤵
  PID:6724
- C:\Windows\System\UdCwzFJ.exe
  C:\Windows\System\UdCwzFJ.exe
  2⤵
  PID:6892
- C:\Windows\System\lDNCQhH.exe
  C:\Windows\System\lDNCQhH.exe
  2⤵
  PID:6964
- C:\Windows\System\QYsKRLN.exe
  C:\Windows\System\QYsKRLN.exe
  2⤵
  PID:460
- C:\Windows\System\LKzfpvs.exe
  C:\Windows\System\LKzfpvs.exe
  2⤵
  PID:6776
- C:\Windows\System\iLUKdOT.exe
  C:\Windows\System\iLUKdOT.exe
  2⤵
  PID:6812
- C:\Windows\System\VvSBZGb.exe
  C:\Windows\System\VvSBZGb.exe
  2⤵
  PID:7108
- C:\Windows\System\IXBlQVy.exe
  C:\Windows\System\IXBlQVy.exe
  2⤵
  PID:7172
- C:\Windows\System\KgtdJgf.exe
  C:\Windows\System\KgtdJgf.exe
  2⤵
  PID:7196
- C:\Windows\System\doeEDOF.exe
  C:\Windows\System\doeEDOF.exe
  2⤵
  PID:7216
- C:\Windows\System\nCyKRPC.exe
  C:\Windows\System\nCyKRPC.exe
  2⤵
  PID:7244
- C:\Windows\System\YFvbRkD.exe
  C:\Windows\System\YFvbRkD.exe
  2⤵
  PID:7280
- C:\Windows\System\hmRuQKe.exe
  C:\Windows\System\hmRuQKe.exe
  2⤵
  PID:7308
- C:\Windows\System\CxbkpBe.exe
  C:\Windows\System\CxbkpBe.exe
  2⤵
  PID:7332
- C:\Windows\System\VYNLkYa.exe
  C:\Windows\System\VYNLkYa.exe
  2⤵
  PID:7352
- C:\Windows\System\ThNMtXk.exe
  C:\Windows\System\ThNMtXk.exe
  2⤵
  PID:7388
- C:\Windows\System\dVXPtUx.exe
  C:\Windows\System\dVXPtUx.exe
  2⤵
  PID:7408
- C:\Windows\System\JxhuZJo.exe
  C:\Windows\System\JxhuZJo.exe
  2⤵
  PID:7448
- C:\Windows\System\bFnHLFE.exe
  C:\Windows\System\bFnHLFE.exe
  2⤵
  PID:7480
- C:\Windows\System\FaxFMKR.exe
  C:\Windows\System\FaxFMKR.exe
  2⤵
  PID:7508
- C:\Windows\System\exoTPgs.exe
  C:\Windows\System\exoTPgs.exe
  2⤵
  PID:7524
- C:\Windows\System\zdjGIYQ.exe
  C:\Windows\System\zdjGIYQ.exe
  2⤵
  PID:7552
- C:\Windows\System\DpehgTk.exe
  C:\Windows\System\DpehgTk.exe
  2⤵
  PID:7576
- C:\Windows\System\kWrTMhH.exe
  C:\Windows\System\kWrTMhH.exe
  2⤵
  PID:7604
- C:\Windows\System\QlZwyZh.exe
  C:\Windows\System\QlZwyZh.exe
  2⤵
  PID:7640
- C:\Windows\System\vzlnRfH.exe
  C:\Windows\System\vzlnRfH.exe
  2⤵
  PID:7672
- C:\Windows\System\yEMwQCU.exe
  C:\Windows\System\yEMwQCU.exe
  2⤵
  PID:7704
- C:\Windows\System\PEWfWxO.exe
  C:\Windows\System\PEWfWxO.exe
  2⤵
  PID:7756
- C:\Windows\System\iBtdtsA.exe
  C:\Windows\System\iBtdtsA.exe
  2⤵
  PID:7776
- C:\Windows\System\QwdWwFJ.exe
  C:\Windows\System\QwdWwFJ.exe
  2⤵
  PID:7800
- C:\Windows\System\bcLPzES.exe
  C:\Windows\System\bcLPzES.exe
  2⤵
  PID:7832
- C:\Windows\System\NneTSdh.exe
  C:\Windows\System\NneTSdh.exe
  2⤵
  PID:7848
- C:\Windows\System\kwCXeai.exe
  C:\Windows\System\kwCXeai.exe
  2⤵
  PID:7872
- C:\Windows\System\TRoutJn.exe
  C:\Windows\System\TRoutJn.exe
  2⤵
  PID:7896
- C:\Windows\System\idyoDFS.exe
  C:\Windows\System\idyoDFS.exe
  2⤵
  PID:7924
- C:\Windows\System\XgKpGVA.exe
  C:\Windows\System\XgKpGVA.exe
  2⤵
  PID:7948
- C:\Windows\System\dBtllWz.exe
  C:\Windows\System\dBtllWz.exe
  2⤵
  PID:7964
- C:\Windows\System\XEJyscx.exe
  C:\Windows\System\XEJyscx.exe
  2⤵
  PID:7992
- C:\Windows\System\EMHtAMn.exe
  C:\Windows\System\EMHtAMn.exe
  2⤵
  PID:8032
- C:\Windows\System\JvgUCrU.exe
  C:\Windows\System\JvgUCrU.exe
  2⤵
  PID:8048
- C:\Windows\System\PLYZkKi.exe
  C:\Windows\System\PLYZkKi.exe
  2⤵
  PID:8088
- C:\Windows\System\SgAYhwY.exe
  C:\Windows\System\SgAYhwY.exe
  2⤵
  PID:8152
- C:\Windows\System\HGEGprm.exe
  C:\Windows\System\HGEGprm.exe
  2⤵
  PID:8168
- C:\Windows\System\LcAKYWN.exe
  C:\Windows\System\LcAKYWN.exe
  2⤵
  PID:7016
- C:\Windows\System\RliWsQq.exe
  C:\Windows\System\RliWsQq.exe
  2⤵
  PID:7124
- C:\Windows\System\xmmhGBI.exe
  C:\Windows\System\xmmhGBI.exe
  2⤵
  PID:7208
- C:\Windows\System\WcIEVql.exe
  C:\Windows\System\WcIEVql.exe
  2⤵
  PID:7300
- C:\Windows\System\XfmafDO.exe
  C:\Windows\System\XfmafDO.exe
  2⤵
  PID:7320
- C:\Windows\System\YRiJBQJ.exe
  C:\Windows\System\YRiJBQJ.exe
  2⤵
  PID:7400
- C:\Windows\System\weUduYo.exe
  C:\Windows\System\weUduYo.exe
  2⤵
  PID:7472
- C:\Windows\System\saXGyqc.exe
  C:\Windows\System\saXGyqc.exe
  2⤵
  PID:7520
- C:\Windows\System\qqZdlKP.exe
  C:\Windows\System\qqZdlKP.exe
  2⤵
  PID:7632
- C:\Windows\System\nFspsiG.exe
  C:\Windows\System\nFspsiG.exe
  2⤵
  PID:7740
- C:\Windows\System\vQVXbyU.exe
  C:\Windows\System\vQVXbyU.exe
  2⤵
  PID:7732
- C:\Windows\System\PPhkeFy.exe
  C:\Windows\System\PPhkeFy.exe
  2⤵
  PID:7860
- C:\Windows\System\UlkscOQ.exe
  C:\Windows\System\UlkscOQ.exe
  2⤵
  PID:7892
- C:\Windows\System\rpXyGKY.exe
  C:\Windows\System\rpXyGKY.exe
  2⤵
  PID:8016
- C:\Windows\System\UAuwcfW.exe
  C:\Windows\System\UAuwcfW.exe
  2⤵
  PID:8044
- C:\Windows\System\tKfdJsi.exe
  C:\Windows\System\tKfdJsi.exe
  2⤵
  PID:8128
- C:\Windows\System\QOFGezc.exe
  C:\Windows\System\QOFGezc.exe
  2⤵
  PID:8160
- C:\Windows\System\xbgXSLX.exe
  C:\Windows\System\xbgXSLX.exe
  2⤵
  PID:8184
- C:\Windows\System\wQxqeHt.exe
  C:\Windows\System\wQxqeHt.exe
  2⤵
  PID:7380
- C:\Windows\System\lDPsrQP.exe
  C:\Windows\System\lDPsrQP.exe
  2⤵
  PID:7488
- C:\Windows\System\LsLMlXF.exe
  C:\Windows\System\LsLMlXF.exe
  2⤵
  PID:7600
- C:\Windows\System\LmTwKvk.exe
  C:\Windows\System\LmTwKvk.exe
  2⤵
  PID:7840
- C:\Windows\System\EBnGAyA.exe
  C:\Windows\System\EBnGAyA.exe
  2⤵
  PID:7960
- C:\Windows\System\eAMLYRG.exe
  C:\Windows\System\eAMLYRG.exe
  2⤵
  PID:7212
- C:\Windows\System\eyWjRse.exe
  C:\Windows\System\eyWjRse.exe
  2⤵
  PID:7652
- C:\Windows\System\NCgrtcV.exe
  C:\Windows\System\NCgrtcV.exe
  2⤵
  PID:7788
- C:\Windows\System\XVfzrWS.exe
  C:\Windows\System\XVfzrWS.exe
  2⤵
  PID:8028
- C:\Windows\System\LviGNiI.exe
  C:\Windows\System\LviGNiI.exe
  2⤵
  PID:7572
- C:\Windows\System\NOohcLB.exe
  C:\Windows\System\NOohcLB.exe
  2⤵
  PID:8024
- C:\Windows\System\NSrOTsC.exe
  C:\Windows\System\NSrOTsC.exe
  2⤵
  PID:8204
- C:\Windows\System\DBmtceR.exe
  C:\Windows\System\DBmtceR.exe
  2⤵
  PID:8236
- C:\Windows\System\CpAjWIJ.exe
  C:\Windows\System\CpAjWIJ.exe
  2⤵
  PID:8260
- C:\Windows\System\uiXOKLY.exe
  C:\Windows\System\uiXOKLY.exe
  2⤵
  PID:8280
- C:\Windows\System\MbnCIpN.exe
  C:\Windows\System\MbnCIpN.exe
  2⤵
  PID:8344
- C:\Windows\System\OhynoFm.exe
  C:\Windows\System\OhynoFm.exe
  2⤵
  PID:8360
- C:\Windows\System\fpNAfDz.exe
  C:\Windows\System\fpNAfDz.exe
  2⤵
  PID:8388
- C:\Windows\System\MxWCUEF.exe
  C:\Windows\System\MxWCUEF.exe
  2⤵
  PID:8404
- C:\Windows\System\UDGqBdI.exe
  C:\Windows\System\UDGqBdI.exe
  2⤵
  PID:8444
- C:\Windows\System\rVxpqjJ.exe
  C:\Windows\System\rVxpqjJ.exe
  2⤵
  PID:8472
- C:\Windows\System\fNzNppr.exe
  C:\Windows\System\fNzNppr.exe
  2⤵
  PID:8496
- C:\Windows\System\QvJGGrc.exe
  C:\Windows\System\QvJGGrc.exe
  2⤵
  PID:8528
- C:\Windows\System\fyWYEls.exe
  C:\Windows\System\fyWYEls.exe
  2⤵
  PID:8544
- C:\Windows\System\ndunGzV.exe
  C:\Windows\System\ndunGzV.exe
  2⤵
  PID:8592
- C:\Windows\System\wHUeFZQ.exe
  C:\Windows\System\wHUeFZQ.exe
  2⤵
  PID:8612
- C:\Windows\System\lmtdbYm.exe
  C:\Windows\System\lmtdbYm.exe
  2⤵
  PID:8640
- C:\Windows\System\WMLfcLb.exe
  C:\Windows\System\WMLfcLb.exe
  2⤵
  PID:8660
- C:\Windows\System\toMRUvV.exe
  C:\Windows\System\toMRUvV.exe
  2⤵
  PID:8708
- C:\Windows\System\MGShCPO.exe
  C:\Windows\System\MGShCPO.exe
  2⤵
  PID:8728
- C:\Windows\System\aJxPPoV.exe
  C:\Windows\System\aJxPPoV.exe
  2⤵
  PID:8764
- C:\Windows\System\BKxbPQj.exe
  C:\Windows\System\BKxbPQj.exe
  2⤵
  PID:8792
- C:\Windows\System\AIrErnm.exe
  C:\Windows\System\AIrErnm.exe
  2⤵
  PID:8820
- C:\Windows\System\MmjjnJL.exe
  C:\Windows\System\MmjjnJL.exe
  2⤵
  PID:8836
- C:\Windows\System\fgZAAwH.exe
  C:\Windows\System\fgZAAwH.exe
  2⤵
  PID:8876
- C:\Windows\System\CbHpYnc.exe
  C:\Windows\System\CbHpYnc.exe
  2⤵
  PID:8892
- C:\Windows\System\MPikbsA.exe
  C:\Windows\System\MPikbsA.exe
  2⤵
  PID:8924
- C:\Windows\System\jfgpkTf.exe
  C:\Windows\System\jfgpkTf.exe
  2⤵
  PID:8948
- C:\Windows\System\lCPgFrZ.exe
  C:\Windows\System\lCPgFrZ.exe
  2⤵
  PID:8988
- C:\Windows\System\jPqNxVF.exe
  C:\Windows\System\jPqNxVF.exe
  2⤵
  PID:9016
- C:\Windows\System\mZiZERr.exe
  C:\Windows\System\mZiZERr.exe
  2⤵
  PID:9032
- C:\Windows\System\DGEPoHh.exe
  C:\Windows\System\DGEPoHh.exe
  2⤵
  PID:9056
- C:\Windows\System\AhyaMqV.exe
  C:\Windows\System\AhyaMqV.exe
  2⤵
  PID:9084
- C:\Windows\System\BdJwmvZ.exe
  C:\Windows\System\BdJwmvZ.exe
  2⤵
  PID:9120
- C:\Windows\System\WeQgidw.exe
  C:\Windows\System\WeQgidw.exe
  2⤵
  PID:9144
- C:\Windows\System\wUEkBRs.exe
  C:\Windows\System\wUEkBRs.exe
  2⤵
  PID:9172
- C:\Windows\System\BwBaHfn.exe
  C:\Windows\System\BwBaHfn.exe
  2⤵
  PID:9196
- C:\Windows\System\ZdlLqXI.exe
  C:\Windows\System\ZdlLqXI.exe
  2⤵
  PID:7348
- C:\Windows\System\EKNwCcJ.exe
  C:\Windows\System\EKNwCcJ.exe
  2⤵
  PID:8320
- C:\Windows\System\UtMskrG.exe
  C:\Windows\System\UtMskrG.exe
  2⤵
  PID:8312
- C:\Windows\System\EATEDOc.exe
  C:\Windows\System\EATEDOc.exe
  2⤵
  PID:8400
- C:\Windows\System\zhzQKNp.exe
  C:\Windows\System\zhzQKNp.exe
  2⤵
  PID:8460
- C:\Windows\System\PsdFINb.exe
  C:\Windows\System\PsdFINb.exe
  2⤵
  PID:8488
- C:\Windows\System\MbLoUYk.exe
  C:\Windows\System\MbLoUYk.exe
  2⤵
  PID:8628
- C:\Windows\System\XIRdvUG.exe
  C:\Windows\System\XIRdvUG.exe
  2⤵
  PID:8656
- C:\Windows\System\gXSputO.exe
  C:\Windows\System\gXSputO.exe
  2⤵
  PID:8736
- C:\Windows\System\zguNgOg.exe
  C:\Windows\System\zguNgOg.exe
  2⤵
  PID:8780
- C:\Windows\System\cQzadLN.exe
  C:\Windows\System\cQzadLN.exe
  2⤵
  PID:8832
- C:\Windows\System\TQAItVW.exe
  C:\Windows\System\TQAItVW.exe
  2⤵
  PID:8908
- C:\Windows\System\wchUsdq.exe
  C:\Windows\System\wchUsdq.exe
  2⤵
  PID:8944
- C:\Windows\System\VdYhzMD.exe
  C:\Windows\System\VdYhzMD.exe
  2⤵
  PID:9100
- C:\Windows\System\XvzbWYD.exe
  C:\Windows\System\XvzbWYD.exe
  2⤵
  PID:9136
- C:\Windows\System\TSyiVKp.exe
  C:\Windows\System\TSyiVKp.exe
  2⤵
  PID:9184
- C:\Windows\System\RvizfLF.exe
  C:\Windows\System\RvizfLF.exe
  2⤵
  PID:8356
- C:\Windows\System\QSibhUw.exe
  C:\Windows\System\QSibhUw.exe
  2⤵
  PID:8420
- C:\Windows\System\AWLTXCY.exe
  C:\Windows\System\AWLTXCY.exe
  2⤵
  PID:8632
- C:\Windows\System\wfHkIRA.exe
  C:\Windows\System\wfHkIRA.exe
  2⤵
  PID:8856
- C:\Windows\System\uLeTVCd.exe
  C:\Windows\System\uLeTVCd.exe
  2⤵
  PID:8816
- C:\Windows\System\quVBrxn.exe
  C:\Windows\System\quVBrxn.exe
  2⤵
  PID:9080
- C:\Windows\System\bSTEueE.exe
  C:\Windows\System\bSTEueE.exe
  2⤵
  PID:9208
- C:\Windows\System\WBCNboE.exe
  C:\Windows\System\WBCNboE.exe
  2⤵
  PID:8432
- C:\Windows\System\jekSmaT.exe
  C:\Windows\System\jekSmaT.exe
  2⤵
  PID:8756
- C:\Windows\System\kNrQHLf.exe
  C:\Windows\System\kNrQHLf.exe
  2⤵
  PID:9188
- C:\Windows\System\uUgRTsA.exe
  C:\Windows\System\uUgRTsA.exe
  2⤵
  PID:9108
- C:\Windows\System\SAIwWFW.exe
  C:\Windows\System\SAIwWFW.exe
  2⤵
  PID:9240
- C:\Windows\System\iQjsozZ.exe
  C:\Windows\System\iQjsozZ.exe
  2⤵
  PID:9256
- C:\Windows\System\GzRkIFd.exe
  C:\Windows\System\GzRkIFd.exe
  2⤵
  PID:9296
- C:\Windows\System\xjtfcmP.exe
  C:\Windows\System\xjtfcmP.exe
  2⤵
  PID:9316
- C:\Windows\System\csaajMY.exe
  C:\Windows\System\csaajMY.exe
  2⤵
  PID:9380
- C:\Windows\System\qmNmdhW.exe
  C:\Windows\System\qmNmdhW.exe
  2⤵
  PID:9400
- C:\Windows\System\drwpBqD.exe
  C:\Windows\System\drwpBqD.exe
  2⤵
  PID:9432
- C:\Windows\System\bvrrKRN.exe
  C:\Windows\System\bvrrKRN.exe
  2⤵
  PID:9468
- C:\Windows\System\QoOsgOv.exe
  C:\Windows\System\QoOsgOv.exe
  2⤵
  PID:9492
- C:\Windows\System\AtUmICm.exe
  C:\Windows\System\AtUmICm.exe
  2⤵
  PID:9524
- C:\Windows\System\vWTFJWq.exe
  C:\Windows\System\vWTFJWq.exe
  2⤵
  PID:9556
- C:\Windows\System\njjygOo.exe
  C:\Windows\System\njjygOo.exe
  2⤵
  PID:9576
- C:\Windows\System\EhARTGe.exe
  C:\Windows\System\EhARTGe.exe
  2⤵
  PID:9596
- C:\Windows\System\EJUUDjC.exe
  C:\Windows\System\EJUUDjC.exe
  2⤵
  PID:9628
- C:\Windows\System\dkRbRwl.exe
  C:\Windows\System\dkRbRwl.exe
  2⤵
  PID:9668
- C:\Windows\System\HtEEhyd.exe
  C:\Windows\System\HtEEhyd.exe
  2⤵
  PID:9684
- C:\Windows\System\xUqyXUk.exe
  C:\Windows\System\xUqyXUk.exe
  2⤵
  PID:9700
- C:\Windows\System\ZfDYCnO.exe
  C:\Windows\System\ZfDYCnO.exe
  2⤵
  PID:9720
- C:\Windows\System\sFFEfRC.exe
  C:\Windows\System\sFFEfRC.exe
  2⤵
  PID:9736
- C:\Windows\System\AyXFZYa.exe
  C:\Windows\System\AyXFZYa.exe
  2⤵
  PID:9760
- C:\Windows\System\eMXYnyg.exe
  C:\Windows\System\eMXYnyg.exe
  2⤵
  PID:9780
- C:\Windows\System\OylNqoU.exe
  C:\Windows\System\OylNqoU.exe
  2⤵
  PID:9812
- C:\Windows\System\wwMBCia.exe
  C:\Windows\System\wwMBCia.exe
  2⤵
  PID:9836
- C:\Windows\System\SZioGEz.exe
  C:\Windows\System\SZioGEz.exe
  2⤵
  PID:9856
- C:\Windows\System\ftgpkBf.exe
  C:\Windows\System\ftgpkBf.exe
  2⤵
  PID:9876
- C:\Windows\System\KzftZSO.exe
  C:\Windows\System\KzftZSO.exe
  2⤵
  PID:9924
- C:\Windows\System\XaREVvJ.exe
  C:\Windows\System\XaREVvJ.exe
  2⤵
  PID:9948
- C:\Windows\System\nXnBKmF.exe
  C:\Windows\System\nXnBKmF.exe
  2⤵
  PID:9972
- C:\Windows\System\TNONPgH.exe
  C:\Windows\System\TNONPgH.exe
  2⤵
  PID:10024
- C:\Windows\System\ZgTMnVU.exe
  C:\Windows\System\ZgTMnVU.exe
  2⤵
  PID:10060
- C:\Windows\System\YZYneWP.exe
  C:\Windows\System\YZYneWP.exe
  2⤵
  PID:10084
- C:\Windows\System\ixnjIZM.exe
  C:\Windows\System\ixnjIZM.exe
  2⤵
  PID:10108
- C:\Windows\System\KizkMJx.exe
  C:\Windows\System\KizkMJx.exe
  2⤵
  PID:10124
- C:\Windows\System\pMoxewM.exe
  C:\Windows\System\pMoxewM.exe
  2⤵
  PID:10152
- C:\Windows\System\TYVaRJM.exe
  C:\Windows\System\TYVaRJM.exe
  2⤵
  PID:10196
- C:\Windows\System\UaECWzJ.exe
  C:\Windows\System\UaECWzJ.exe
  2⤵
  PID:10220
- C:\Windows\System\kQEiNMK.exe
  C:\Windows\System\kQEiNMK.exe
  2⤵
  PID:9236
- C:\Windows\System\VPFhBbk.exe
  C:\Windows\System\VPFhBbk.exe
  2⤵
  PID:8296
- C:\Windows\System\fmkTcjY.exe
  C:\Windows\System\fmkTcjY.exe
  2⤵
  PID:9328
- C:\Windows\System\OvZuCeo.exe
  C:\Windows\System\OvZuCeo.exe
  2⤵
  PID:9288
- C:\Windows\System\TQXxDfQ.exe
  C:\Windows\System\TQXxDfQ.exe
  2⤵
  PID:9452
- C:\Windows\System\jByNrsK.exe
  C:\Windows\System\jByNrsK.exe
  2⤵
  PID:9532
- C:\Windows\System\TXgqNMG.exe
  C:\Windows\System\TXgqNMG.exe
  2⤵
  PID:9676
- C:\Windows\System\IfDFYTz.exe
  C:\Windows\System\IfDFYTz.exe
  2⤵
  PID:9728
- C:\Windows\System\iyvKwFR.exe
  C:\Windows\System\iyvKwFR.exe
  2⤵
  PID:9772
- C:\Windows\System\wcQliVx.exe
  C:\Windows\System\wcQliVx.exe
  2⤵
  PID:9848
- C:\Windows\System\HqcEuHb.exe
  C:\Windows\System\HqcEuHb.exe
  2⤵
  PID:9808
- C:\Windows\System\jtIharf.exe
  C:\Windows\System\jtIharf.exe
  2⤵
  PID:9916
- C:\Windows\System\cecnblP.exe
  C:\Windows\System\cecnblP.exe
  2⤵
  PID:10048
- C:\Windows\System\yhEPVPp.exe
  C:\Windows\System\yhEPVPp.exe
  2⤵
  PID:10104
- C:\Windows\System\bzYzxYQ.exe
  C:\Windows\System\bzYzxYQ.exe
  2⤵
  PID:10184
- C:\Windows\System\JLvlzub.exe
  C:\Windows\System\JLvlzub.exe
  2⤵
  PID:10236
- C:\Windows\System\MrdFnHO.exe
  C:\Windows\System\MrdFnHO.exe
  2⤵
  PID:9272
- C:\Windows\System\BqUmEQy.exe
  C:\Windows\System\BqUmEQy.exe
  2⤵
  PID:9364
- C:\Windows\System\HzIJGRI.exe
  C:\Windows\System\HzIJGRI.exe
  2⤵
  PID:9616
- C:\Windows\System\NhBvhTV.exe
  C:\Windows\System\NhBvhTV.exe
  2⤵
  PID:9640
- C:\Windows\System\gtCJEfV.exe
  C:\Windows\System\gtCJEfV.exe
  2⤵
  PID:9912
- C:\Windows\System\ueCPDNd.exe
  C:\Windows\System\ueCPDNd.exe
  2⤵
  PID:10100
- C:\Windows\System\NLGdOXu.exe
  C:\Windows\System\NLGdOXu.exe
  2⤵
  PID:10228
- C:\Windows\System\HAKcEDg.exe
  C:\Windows\System\HAKcEDg.exe
  2⤵
  PID:9280
- C:\Windows\System\PwkwEau.exe
  C:\Windows\System\PwkwEau.exe
  2⤵
  PID:9712
- C:\Windows\System\QIVFEIc.exe
  C:\Windows\System\QIVFEIc.exe
  2⤵
  PID:10180
- C:\Windows\System\wsOkrhf.exe
  C:\Windows\System\wsOkrhf.exe
  2⤵
  PID:9408
- C:\Windows\System\GxNqRRF.exe
  C:\Windows\System\GxNqRRF.exe
  2⤵
  PID:10264
- C:\Windows\System\VwcIQoM.exe
  C:\Windows\System\VwcIQoM.exe
  2⤵
  PID:10280
- C:\Windows\System\hgQIYxN.exe
  C:\Windows\System\hgQIYxN.exe
  2⤵
  PID:10300
- C:\Windows\System\yCttbGF.exe
  C:\Windows\System\yCttbGF.exe
  2⤵
  PID:10348
- C:\Windows\System\ygPLohv.exe
  C:\Windows\System\ygPLohv.exe
  2⤵
  PID:10372
- C:\Windows\System\ArijGUF.exe
  C:\Windows\System\ArijGUF.exe
  2⤵
  PID:10392
- C:\Windows\System\PkftyRJ.exe
  C:\Windows\System\PkftyRJ.exe
  2⤵
  PID:10420
- C:\Windows\System\fbToeIz.exe
  C:\Windows\System\fbToeIz.exe
  2⤵
  PID:10448
- C:\Windows\System\MRkobyv.exe
  C:\Windows\System\MRkobyv.exe
  2⤵
  PID:10468
- C:\Windows\System\XpONtVg.exe
  C:\Windows\System\XpONtVg.exe
  2⤵
  PID:10492
- C:\Windows\System\xnEEqRd.exe
  C:\Windows\System\xnEEqRd.exe
  2⤵
  PID:10544
- C:\Windows\System\bALTkJv.exe
  C:\Windows\System\bALTkJv.exe
  2⤵
  PID:10572
- C:\Windows\System\WMvkAAQ.exe
  C:\Windows\System\WMvkAAQ.exe
  2⤵
  PID:10588
- C:\Windows\System\pENlsEh.exe
  C:\Windows\System\pENlsEh.exe
  2⤵
  PID:10628
- C:\Windows\System\kjWkyhK.exe
  C:\Windows\System\kjWkyhK.exe
  2⤵
  PID:10656
- C:\Windows\System\TiVHyUn.exe
  C:\Windows\System\TiVHyUn.exe
  2⤵
  PID:10676
- C:\Windows\System\GhVokyN.exe
  C:\Windows\System\GhVokyN.exe
  2⤵
  PID:10696
- C:\Windows\System\AZIzbdv.exe
  C:\Windows\System\AZIzbdv.exe
  2⤵
  PID:10720
- C:\Windows\System\ugayTeE.exe
  C:\Windows\System\ugayTeE.exe
  2⤵
  PID:10744
- C:\Windows\System\UPJxZSL.exe
  C:\Windows\System\UPJxZSL.exe
  2⤵
  PID:10772
- C:\Windows\System\HFxBVWt.exe
  C:\Windows\System\HFxBVWt.exe
  2⤵
  PID:10804
- C:\Windows\System\YHLjXWb.exe
  C:\Windows\System\YHLjXWb.exe
  2⤵
  PID:10828
- C:\Windows\System\jYBSWyc.exe
  C:\Windows\System\jYBSWyc.exe
  2⤵
  PID:10852
- C:\Windows\System\TSOKzyn.exe
  C:\Windows\System\TSOKzyn.exe
  2⤵
  PID:10872
- C:\Windows\System\hRfvhSg.exe
  C:\Windows\System\hRfvhSg.exe
  2⤵
  PID:10892
- C:\Windows\System\fEwkstR.exe
  C:\Windows\System\fEwkstR.exe
  2⤵
  PID:10956
- C:\Windows\System\Kwcaxbp.exe
  C:\Windows\System\Kwcaxbp.exe
  2⤵
  PID:10976
- C:\Windows\System\iyjdlUe.exe
  C:\Windows\System\iyjdlUe.exe
  2⤵
  PID:11024
- C:\Windows\System\TWfxlGq.exe
  C:\Windows\System\TWfxlGq.exe
  2⤵
  PID:11040
- C:\Windows\System\npEnQgV.exe
  C:\Windows\System\npEnQgV.exe
  2⤵
  PID:11056
- C:\Windows\System\OLcjeqO.exe
  C:\Windows\System\OLcjeqO.exe
  2⤵
  PID:11072
- C:\Windows\System\ePtRdMi.exe
  C:\Windows\System\ePtRdMi.exe
  2⤵
  PID:11116
- C:\Windows\System\DUIZPtH.exe
  C:\Windows\System\DUIZPtH.exe
  2⤵
  PID:11140
- C:\Windows\System\TJdxdwH.exe
  C:\Windows\System\TJdxdwH.exe
  2⤵
  PID:11156
- C:\Windows\System\yHJQuuX.exe
  C:\Windows\System\yHJQuuX.exe
  2⤵
  PID:11184
- C:\Windows\System\azVFkYF.exe
  C:\Windows\System\azVFkYF.exe
  2⤵
  PID:11228
- C:\Windows\System\PNMAEeo.exe
  C:\Windows\System\PNMAEeo.exe
  2⤵
  PID:11252
- C:\Windows\System\VJadKnJ.exe
  C:\Windows\System\VJadKnJ.exe
  2⤵
  PID:10272
- C:\Windows\System\MAKmFjK.exe
  C:\Windows\System\MAKmFjK.exe
  2⤵
  PID:10328
- C:\Windows\System\YQyhuvR.exe
  C:\Windows\System\YQyhuvR.exe
  2⤵
  PID:10380
- C:\Windows\System\umUJzMi.exe
  C:\Windows\System\umUJzMi.exe
  2⤵
  PID:10480
- C:\Windows\System\KbsWdIZ.exe
  C:\Windows\System\KbsWdIZ.exe
  2⤵
  PID:10520
- C:\Windows\System\FujgTbu.exe
  C:\Windows\System\FujgTbu.exe
  2⤵
  PID:10560
- C:\Windows\System\cPFtlqp.exe
  C:\Windows\System\cPFtlqp.exe
  2⤵
  PID:10608
- C:\Windows\System\OlXSUjb.exe
  C:\Windows\System\OlXSUjb.exe
  2⤵
  PID:10672
- C:\Windows\System\WZHVvEn.exe
  C:\Windows\System\WZHVvEn.exe
  2⤵
  PID:10708
- C:\Windows\System\MHuRGeT.exe
  C:\Windows\System\MHuRGeT.exe
  2⤵
  PID:10812
- C:\Windows\System\TvRthEQ.exe
  C:\Windows\System\TvRthEQ.exe
  2⤵
  PID:10816
- C:\Windows\System\nCXmfqO.exe
  C:\Windows\System\nCXmfqO.exe
  2⤵
  PID:11020
- C:\Windows\System\xqnqTiZ.exe
  C:\Windows\System\xqnqTiZ.exe
  2⤵
  PID:11068
- C:\Windows\System\VZVICQP.exe
  C:\Windows\System\VZVICQP.exe
  2⤵
  PID:11064
- C:\Windows\System\txWOyjC.exe
  C:\Windows\System\txWOyjC.exe
  2⤵
  PID:11204
- C:\Windows\System\qVLPREA.exe
  C:\Windows\System\qVLPREA.exe
  2⤵
  PID:10260
- C:\Windows\System\ewlEDvb.exe
  C:\Windows\System\ewlEDvb.exe
  2⤵
  PID:10320
- C:\Windows\System\XAeBzWE.exe
  C:\Windows\System\XAeBzWE.exe
  2⤵
  PID:10624
- C:\Windows\System\uSmuPPr.exe
  C:\Windows\System\uSmuPPr.exe
  2⤵
  PID:10564
- C:\Windows\System\nFVBnqm.exe
  C:\Windows\System\nFVBnqm.exe
  2⤵
  PID:10768
- C:\Windows\System\YVysdmw.exe
  C:\Windows\System\YVysdmw.exe
  2⤵
  PID:10864
- C:\Windows\System\GZtJVWy.exe
  C:\Windows\System\GZtJVWy.exe
  2⤵
  PID:11196
- C:\Windows\System\axNvgbh.exe
  C:\Windows\System\axNvgbh.exe
  2⤵
  PID:10324
- C:\Windows\System\CkRwYxW.exe
  C:\Windows\System\CkRwYxW.exe
  2⤵
  PID:10704
- C:\Windows\System\BoduVbQ.exe
  C:\Windows\System\BoduVbQ.exe
  2⤵
  PID:10800
- C:\Windows\System\htmkELC.exe
  C:\Windows\System\htmkELC.exe
  2⤵
  PID:11176
- C:\Windows\System\PuujgfI.exe
  C:\Windows\System\PuujgfI.exe
  2⤵
  PID:10464
- C:\Windows\System\kebkZNN.exe
  C:\Windows\System\kebkZNN.exe
  2⤵
  PID:11276
- C:\Windows\System\QTTLYUt.exe
  C:\Windows\System\QTTLYUt.exe
  2⤵
  PID:11344
- C:\Windows\System\YPAhnxE.exe
  C:\Windows\System\YPAhnxE.exe
  2⤵
  PID:11368
- C:\Windows\System\TBoDZHu.exe
  C:\Windows\System\TBoDZHu.exe
  2⤵
  PID:11388
- C:\Windows\System\HbtaZAR.exe
  C:\Windows\System\HbtaZAR.exe
  2⤵
  PID:11416
- C:\Windows\System\lbkzhyu.exe
  C:\Windows\System\lbkzhyu.exe
  2⤵
  PID:11432
- C:\Windows\System\TgxkRqy.exe
  C:\Windows\System\TgxkRqy.exe
  2⤵
  PID:11476
- C:\Windows\System\kHmOJSu.exe
  C:\Windows\System\kHmOJSu.exe
  2⤵
  PID:11500
- C:\Windows\System\SACuQFx.exe
  C:\Windows\System\SACuQFx.exe
  2⤵
  PID:11524
- C:\Windows\System\hZjxAsf.exe
  C:\Windows\System\hZjxAsf.exe
  2⤵
  PID:11552
- C:\Windows\System\fKSvoGH.exe
  C:\Windows\System\fKSvoGH.exe
  2⤵
  PID:11580
- C:\Windows\System\wyybKWA.exe
  C:\Windows\System\wyybKWA.exe
  2⤵
  PID:11600
- C:\Windows\System\YoccFad.exe
  C:\Windows\System\YoccFad.exe
  2⤵
  PID:11616
- C:\Windows\System\szEufNM.exe
  C:\Windows\System\szEufNM.exe
  2⤵
  PID:11676
- C:\Windows\System\XXkUnEI.exe
  C:\Windows\System\XXkUnEI.exe
  2⤵
  PID:11700
- C:\Windows\System\DmknIKv.exe
  C:\Windows\System\DmknIKv.exe
  2⤵
  PID:11720
- C:\Windows\System\XNlOHkO.exe
  C:\Windows\System\XNlOHkO.exe
  2⤵
  PID:11740
- C:\Windows\System\rlycpmM.exe
  C:\Windows\System\rlycpmM.exe
  2⤵
  PID:11760
- C:\Windows\System\PlGOWUG.exe
  C:\Windows\System\PlGOWUG.exe
  2⤵
  PID:11792
- C:\Windows\System\OteHWWJ.exe
  C:\Windows\System\OteHWWJ.exe
  2⤵
  PID:11816
- C:\Windows\System\KDzoeIt.exe
  C:\Windows\System\KDzoeIt.exe
  2⤵
  PID:11868
- C:\Windows\System\WmFMRhm.exe
  C:\Windows\System\WmFMRhm.exe
  2⤵
  PID:11884
- C:\Windows\System\EqqPvAm.exe
  C:\Windows\System\EqqPvAm.exe
  2⤵
  PID:11936
- C:\Windows\System\UHYTZGj.exe
  C:\Windows\System\UHYTZGj.exe
  2⤵
  PID:11952
- C:\Windows\System\iZycuzV.exe
  C:\Windows\System\iZycuzV.exe
  2⤵
  PID:11976
- C:\Windows\System\KtwQaTO.exe
  C:\Windows\System\KtwQaTO.exe
  2⤵
  PID:11996
- C:\Windows\System\TxYhcMQ.exe
  C:\Windows\System\TxYhcMQ.exe
  2⤵
  PID:12012
- C:\Windows\System\LSfYtUX.exe
  C:\Windows\System\LSfYtUX.exe
  2⤵
  PID:12072
- C:\Windows\System\yHGlmuB.exe
  C:\Windows\System\yHGlmuB.exe
  2⤵
  PID:12092
- C:\Windows\System\nuXjASX.exe
  C:\Windows\System\nuXjASX.exe
  2⤵
  PID:12120
- C:\Windows\System\hGtxqLa.exe
  C:\Windows\System\hGtxqLa.exe
  2⤵
  PID:12136
- C:\Windows\System\OMXnRnz.exe
  C:\Windows\System\OMXnRnz.exe
  2⤵
  PID:12160
- C:\Windows\System\ZwAsqAF.exe
  C:\Windows\System\ZwAsqAF.exe
  2⤵
  PID:12192
- C:\Windows\System\XEfGHMD.exe
  C:\Windows\System\XEfGHMD.exe
  2⤵
  PID:12208
- C:\Windows\System\fMgYoIH.exe
  C:\Windows\System\fMgYoIH.exe
  2⤵
  PID:12248
- C:\Windows\System\JbPaNaR.exe
  C:\Windows\System\JbPaNaR.exe
  2⤵
  PID:11272
- C:\Windows\System\OAoSLmZ.exe
  C:\Windows\System\OAoSLmZ.exe
  2⤵
  PID:11300
- C:\Windows\System\eblFiBR.exe
  C:\Windows\System\eblFiBR.exe
  2⤵
  PID:11332
- C:\Windows\System\uMCPXMa.exe
  C:\Windows\System\uMCPXMa.exe
  2⤵
  PID:11408
- C:\Windows\System\JMFmBfg.exe
  C:\Windows\System\JMFmBfg.exe
  2⤵
  PID:11460
- C:\Windows\System\CxWabsw.exe
  C:\Windows\System\CxWabsw.exe
  2⤵
  PID:11564
- C:\Windows\System\UEYLEtx.exe
  C:\Windows\System\UEYLEtx.exe
  2⤵
  PID:11612
- C:\Windows\System\AoagKoL.exe
  C:\Windows\System\AoagKoL.exe
  2⤵
  PID:11664
- C:\Windows\System\KHdJZiU.exe
  C:\Windows\System\KHdJZiU.exe
  2⤵
  PID:11732
- C:\Windows\System\nKgTWbq.exe
  C:\Windows\System\nKgTWbq.exe
  2⤵
  PID:11788
- C:\Windows\System\HBFtWSO.exe
  C:\Windows\System\HBFtWSO.exe
  2⤵
  PID:11860
- C:\Windows\System\ihwFfYG.exe
  C:\Windows\System\ihwFfYG.exe
  2⤵
  PID:11908
- C:\Windows\System\NjrTRWE.exe
  C:\Windows\System\NjrTRWE.exe
  2⤵
  PID:11968
- C:\Windows\System\gYYlfwt.exe
  C:\Windows\System\gYYlfwt.exe
  2⤵
  PID:12004
- C:\Windows\System\NpLdDHN.exe
  C:\Windows\System\NpLdDHN.exe
  2⤵
  PID:12152
- C:\Windows\System\VWVLtrG.exe
  C:\Windows\System\VWVLtrG.exe
  2⤵
  PID:12180
- C:\Windows\System\tXHYrML.exe
  C:\Windows\System\tXHYrML.exe
  2⤵
  PID:12260
- C:\Windows\System\qrbEFKg.exe
  C:\Windows\System\qrbEFKg.exe
  2⤵
  PID:11108
- C:\Windows\System\dOYyXZM.exe
  C:\Windows\System\dOYyXZM.exe
  2⤵
  PID:11428
- C:\Windows\System\dlwQDMN.exe
  C:\Windows\System\dlwQDMN.exe
  2⤵
  PID:11588
- C:\Windows\System\fNoCWSc.exe
  C:\Windows\System\fNoCWSc.exe
  2⤵
  PID:11772
- C:\Windows\System\OBnMlZT.exe
  C:\Windows\System\OBnMlZT.exe
  2⤵
  PID:11880
- C:\Windows\System\CAiAzqG.exe
  C:\Windows\System\CAiAzqG.exe
  2⤵
  PID:12008
- C:\Windows\System\oQtNtZX.exe
  C:\Windows\System\oQtNtZX.exe
  2⤵
  PID:11944
- C:\Windows\System\rkSbmqw.exe
  C:\Windows\System\rkSbmqw.exe
  2⤵
  PID:12240
- C:\Windows\System\dDJgxky.exe
  C:\Windows\System\dDJgxky.exe
  2⤵
  PID:11688
- C:\Windows\System\xZHtJri.exe
  C:\Windows\System\xZHtJri.exe
  2⤵
  PID:11928
- C:\Windows\System\cNnmtmX.exe
  C:\Windows\System\cNnmtmX.exe
  2⤵
  PID:12296
- C:\Windows\System\VqpTbac.exe
  C:\Windows\System\VqpTbac.exe
  2⤵
  PID:12340
- C:\Windows\System\GtPgtzK.exe
  C:\Windows\System\GtPgtzK.exe
  2⤵
  PID:12364
- C:\Windows\System\dUnVEVo.exe
  C:\Windows\System\dUnVEVo.exe
  2⤵
  PID:12384
- C:\Windows\System\ssHkJnb.exe
  C:\Windows\System\ssHkJnb.exe
  2⤵
  PID:12404
- C:\Windows\System\hJtGONG.exe
  C:\Windows\System\hJtGONG.exe
  2⤵
  PID:12444
- C:\Windows\System\jFzKXwp.exe
  C:\Windows\System\jFzKXwp.exe
  2⤵
  PID:12464
- C:\Windows\System\fThIPbU.exe
  C:\Windows\System\fThIPbU.exe
  2⤵
  PID:12488
- C:\Windows\System\DrQyBLh.exe
  C:\Windows\System\DrQyBLh.exe
  2⤵
  PID:12512
- C:\Windows\System\YolDFwK.exe
  C:\Windows\System\YolDFwK.exe
  2⤵
  PID:12532
- C:\Windows\System\GwfSIvT.exe
  C:\Windows\System\GwfSIvT.exe
  2⤵
  PID:12588
- C:\Windows\System\mQoiPos.exe
  C:\Windows\System\mQoiPos.exe
  2⤵
  PID:12612
- C:\Windows\System\eiOMYTq.exe
  C:\Windows\System\eiOMYTq.exe
  2⤵
  PID:12632
- C:\Windows\System\DASwbWq.exe
  C:\Windows\System\DASwbWq.exe
  2⤵
  PID:12668
- C:\Windows\System\dvIBLQF.exe
  C:\Windows\System\dvIBLQF.exe
  2⤵
  PID:12688
- C:\Windows\System\zTBSJUD.exe
  C:\Windows\System\zTBSJUD.exe
  2⤵
  PID:12720
- C:\Windows\System\pWmjFcQ.exe
  C:\Windows\System\pWmjFcQ.exe
  2⤵
  PID:12752
- C:\Windows\System\bRMuqIa.exe
  C:\Windows\System\bRMuqIa.exe
  2⤵
  PID:12776
- C:\Windows\System\MxHpEFP.exe
  C:\Windows\System\MxHpEFP.exe
  2⤵
  PID:12800
- C:\Windows\System\IDEZozQ.exe
  C:\Windows\System\IDEZozQ.exe
  2⤵
  PID:12824
- C:\Windows\System\uuJrGQd.exe
  C:\Windows\System\uuJrGQd.exe
  2⤵
  PID:12880
- C:\Windows\System\QAxYKkG.exe
  C:\Windows\System\QAxYKkG.exe
  2⤵
  PID:12908
- C:\Windows\System\cUxrQPI.exe
  C:\Windows\System\cUxrQPI.exe
  2⤵
  PID:12936
- C:\Windows\System\FWFWDfl.exe
  C:\Windows\System\FWFWDfl.exe
  2⤵
  PID:12964
- C:\Windows\System\PhqLBWO.exe
  C:\Windows\System\PhqLBWO.exe
  2⤵
  PID:12980
- C:\Windows\System\xXKIlrZ.exe
  C:\Windows\System\xXKIlrZ.exe
  2⤵
  PID:13020
- C:\Windows\System\zmLeHHy.exe
  C:\Windows\System\zmLeHHy.exe
  2⤵
  PID:13036
- C:\Windows\System\canvhZd.exe
  C:\Windows\System\canvhZd.exe
  2⤵
  PID:13064
- C:\Windows\System\uLFpSvq.exe
  C:\Windows\System\uLFpSvq.exe
  2⤵
  PID:13104
- C:\Windows\System\VbtBzaQ.exe
  C:\Windows\System\VbtBzaQ.exe
  2⤵
  PID:13120
- C:\Windows\System\sjNULna.exe
  C:\Windows\System\sjNULna.exe
  2⤵
  PID:13136
- C:\Windows\System\FzRlbPF.exe
  C:\Windows\System\FzRlbPF.exe
  2⤵
  PID:13152
- C:\Windows\System\ciOXzdU.exe
  C:\Windows\System\ciOXzdU.exe
  2⤵
  PID:13172
- C:\Windows\System\GTFwCSZ.exe
  C:\Windows\System\GTFwCSZ.exe
  2⤵
  PID:13192
- C:\Windows\System\olGkLxE.exe
  C:\Windows\System\olGkLxE.exe
  2⤵
  PID:13224
- C:\Windows\System\CQpyLBd.exe
  C:\Windows\System\CQpyLBd.exe
  2⤵
  PID:13256
- C:\Windows\System\KUFuacu.exe
  C:\Windows\System\KUFuacu.exe
  2⤵
  PID:13288
- C:\Windows\System\SHLEGhe.exe
  C:\Windows\System\SHLEGhe.exe
  2⤵
  PID:11404
- C:\Windows\System\fZMboiw.exe
  C:\Windows\System\fZMboiw.exe
  2⤵
  PID:12132
- C:\Windows\System\xVLLuNE.exe
  C:\Windows\System\xVLLuNE.exe
  2⤵
  PID:12348
- C:\Windows\System\XPOLFCY.exe
  C:\Windows\System\XPOLFCY.exe
  2⤵
  PID:12380
- C:\Windows\System\hTYMSFW.exe
  C:\Windows\System\hTYMSFW.exe
  2⤵
  PID:12472
- C:\Windows\System\kVthvEu.exe
  C:\Windows\System\kVthvEu.exe
  2⤵
  PID:12644
- C:\Windows\System\xgBLUjH.exe
  C:\Windows\System\xgBLUjH.exe
  2⤵
  PID:12660
- C:\Windows\System\bCnCMjI.exe
  C:\Windows\System\bCnCMjI.exe
  2⤵
  PID:12712
- C:\Windows\System\hYqnjto.exe
  C:\Windows\System\hYqnjto.exe
  2⤵
  PID:12796
- C:\Windows\System\QakzhAq.exe
  C:\Windows\System\QakzhAq.exe
  2⤵
  PID:12904
- C:\Windows\System\pNNXYfx.exe
  C:\Windows\System\pNNXYfx.exe
  2⤵
  PID:12952
- C:\Windows\System\IJqYeCD.exe
  C:\Windows\System\IJqYeCD.exe
  2⤵
  PID:12976
- C:\Windows\System\exhUncp.exe
  C:\Windows\System\exhUncp.exe
  2⤵
  PID:13028
- C:\Windows\System\uPLFaos.exe
  C:\Windows\System\uPLFaos.exe
  2⤵
  PID:13092
- C:\Windows\System\AvTwQVg.exe
  C:\Windows\System\AvTwQVg.exe
  2⤵
  PID:13144
- C:\Windows\System\CofXgQM.exe
  C:\Windows\System\CofXgQM.exe
  2⤵
  PID:13164
- C:\Windows\System\OTBTzTZ.exe
  C:\Windows\System\OTBTzTZ.exe
  2⤵
  PID:13232
- C:\Windows\System\iKjRmKB.exe
  C:\Windows\System\iKjRmKB.exe
  2⤵
  PID:12400
- C:\Windows\System\dsqRTWa.exe
  C:\Windows\System\dsqRTWa.exe
  2⤵
  PID:11448
- C:\Windows\System\WMjCLbs.exe
  C:\Windows\System\WMjCLbs.exe
  2⤵
  PID:12696
- C:\Windows\System\kZuTehO.exe
  C:\Windows\System\kZuTehO.exe
  2⤵
  PID:12872
- C:\Windows\System\yOPdJFY.exe
  C:\Windows\System\yOPdJFY.exe
  2⤵
  PID:12920
- C:\Windows\System\cSVDzmO.exe
  C:\Windows\System\cSVDzmO.exe
  2⤵
  PID:12996
- C:\Windows\System\LZoSBvj.exe
  C:\Windows\System\LZoSBvj.exe
  2⤵
  PID:13088
- C:\Windows\System\xLlFiUg.exe
  C:\Windows\System\xLlFiUg.exe
  2⤵
  PID:13268
- C:\Windows\System\yYQrfLg.exe
  C:\Windows\System\yYQrfLg.exe
  2⤵
  PID:12576
- C:\Windows\System\NCQxfpg.exe
  C:\Windows\System\NCQxfpg.exe
  2⤵
  PID:13212
- C:\Windows\System\ynocKPa.exe
  C:\Windows\System\ynocKPa.exe
  2⤵
  PID:13320
- C:\Windows\System\uJtOWqu.exe
  C:\Windows\System\uJtOWqu.exe
  2⤵
  PID:13344
- C:\Windows\System\uMyZsYX.exe
  C:\Windows\System\uMyZsYX.exe
  2⤵
  PID:13364
- C:\Windows\System\uMzQGuR.exe
  C:\Windows\System\uMzQGuR.exe
  2⤵
  PID:13388
- C:\Windows\System\uRbhHJz.exe
  C:\Windows\System\uRbhHJz.exe
  2⤵
  PID:13412
- C:\Windows\System\YdggaqL.exe
  C:\Windows\System\YdggaqL.exe
  2⤵
  PID:13468
- C:\Windows\System\yByZugP.exe
  C:\Windows\System\yByZugP.exe
  2⤵
  PID:13484
- C:\Windows\System\jbvmkjp.exe
  C:\Windows\System\jbvmkjp.exe
  2⤵
  PID:13512
- C:\Windows\System\qFeYmZP.exe
  C:\Windows\System\qFeYmZP.exe
  2⤵
  PID:13540
- C:\Windows\System\HNcoaAY.exe
  C:\Windows\System\HNcoaAY.exe
  2⤵
  PID:13556
- C:\Windows\System\iwVznvR.exe
  C:\Windows\System\iwVznvR.exe
  2⤵
  PID:13576
- C:\Windows\System\PJhqYQf.exe
  C:\Windows\System\PJhqYQf.exe
  2⤵
  PID:13608
- C:\Windows\System\XWYrQWB.exe
  C:\Windows\System\XWYrQWB.exe
  2⤵
  PID:13624
- C:\Windows\System\DshnPcn.exe
  C:\Windows\System\DshnPcn.exe
  2⤵
  PID:13656
- C:\Windows\System\lUQBLPu.exe
  C:\Windows\System\lUQBLPu.exe
  2⤵
  PID:13684
- C:\Windows\System\gnoXLia.exe
  C:\Windows\System\gnoXLia.exe
  2⤵
  PID:13708
- C:\Windows\System\KIQykgX.exe
  C:\Windows\System\KIQykgX.exe
  2⤵
  PID:13732
- C:\Windows\System\emkVmDS.exe
  C:\Windows\System\emkVmDS.exe
  2⤵
  PID:13752
- C:\Windows\System\fKACxIk.exe
  C:\Windows\System\fKACxIk.exe
  2⤵
  PID:13812
- C:\Windows\System\RAOZABa.exe
  C:\Windows\System\RAOZABa.exe
  2⤵
  PID:13852
- C:\Windows\System\qhKKEDP.exe
  C:\Windows\System\qhKKEDP.exe
  2⤵
  PID:13876
- C:\Windows\System\EMvFZJg.exe
  C:\Windows\System\EMvFZJg.exe
  2⤵
  PID:13904
- C:\Windows\System\kDkmDXw.exe
  C:\Windows\System\kDkmDXw.exe
  2⤵
  PID:13936
- C:\Windows\System\KHnCXbx.exe
  C:\Windows\System\KHnCXbx.exe
  2⤵
  PID:13960
- C:\Windows\System\xwnnJVc.exe
  C:\Windows\System\xwnnJVc.exe
  2⤵
  PID:13980
- C:\Windows\System\uRoIFcp.exe
  C:\Windows\System\uRoIFcp.exe
  2⤵
  PID:14044
- C:\Windows\System\CniGjtw.exe
  C:\Windows\System\CniGjtw.exe
  2⤵
  PID:14060
- C:\Windows\System\phHqFbh.exe
  C:\Windows\System\phHqFbh.exe
  2⤵
  PID:14076
- C:\Windows\System\xSdfzYJ.exe
  C:\Windows\System\xSdfzYJ.exe
  2⤵
  PID:14100
- C:\Windows\System\oslLprC.exe
  C:\Windows\System\oslLprC.exe
  2⤵
  PID:14120
- C:\Windows\System\AetvKcG.exe
  C:\Windows\System\AetvKcG.exe
  2⤵
  PID:14148
- C:\Windows\System\kgQRdej.exe
  C:\Windows\System\kgQRdej.exe
  2⤵
  PID:14204
- C:\Windows\System\SmvlOHY.exe
  C:\Windows\System\SmvlOHY.exe
  2⤵
  PID:14228
- C:\Windows\System\VWHMQeC.exe
  C:\Windows\System\VWHMQeC.exe
  2⤵
  PID:14252
- C:\Windows\System\sGJPPKL.exe
  C:\Windows\System\sGJPPKL.exe
  2⤵
  PID:14284
- C:\Windows\System\hcfyjLV.exe
  C:\Windows\System\hcfyjLV.exe
  2⤵
  PID:14300
- C:\Windows\System\eyQWreS.exe
  C:\Windows\System\eyQWreS.exe
  2⤵
  PID:14316
- C:\Windows\System\QURhWsX.exe
  C:\Windows\System\QURhWsX.exe
  2⤵
  PID:13032
- C:\Windows\System\YpkLZfh.exe
  C:\Windows\System\YpkLZfh.exe
  2⤵
  PID:13380
- C:\Windows\System\pQHOkon.exe
  C:\Windows\System\pQHOkon.exe
  2⤵
  PID:13480
- C:\Windows\System\fzXPVMl.exe
  C:\Windows\System\fzXPVMl.exe
  2⤵
  PID:13508
- C:\Windows\System\EBIRTeJ.exe
  C:\Windows\System\EBIRTeJ.exe
  2⤵
  PID:13648
- C:\Windows\System\LKLNFBE.exe
  C:\Windows\System\LKLNFBE.exe
  2⤵
  PID:13704
- C:\Windows\System\FTynGOg.exe
  C:\Windows\System\FTynGOg.exe
  2⤵
  PID:13760
- C:\Windows\System\UEOqpRZ.exe
  C:\Windows\System\UEOqpRZ.exe
  2⤵
  PID:13800
- C:\Windows\System\lKibBrb.exe
  C:\Windows\System\lKibBrb.exe
  2⤵
  PID:13796
- C:\Windows\System\gkpPFul.exe
  C:\Windows\System\gkpPFul.exe
  2⤵
  PID:13920
- C:\Windows\System\YeLfNeh.exe
  C:\Windows\System\YeLfNeh.exe
  2⤵
  PID:13952
- C:\Windows\System\RAAmFEv.exe
  C:\Windows\System\RAAmFEv.exe
  2⤵
  PID:14000
- C:\Windows\System\HSDQVXA.exe
  C:\Windows\System\HSDQVXA.exe
  2⤵
  PID:14016
- C:\Windows\System\GesWETz.exe
  C:\Windows\System\GesWETz.exe
  2⤵
  PID:14116
- C:\Windows\System\ebXBbQp.exe
  C:\Windows\System\ebXBbQp.exe
  2⤵
  PID:14224
- C:\Windows\System\ojbpasL.exe
  C:\Windows\System\ojbpasL.exe
  2⤵
  PID:4556
- C:\Windows\System\xLCvxJf.exe
  C:\Windows\System\xLCvxJf.exe
  2⤵
  PID:14240
- C:\Windows\System\gxziUqR.exe
  C:\Windows\System\gxziUqR.exe
  2⤵
  PID:14292
- C:\Windows\System\uLFOdar.exe
  C:\Windows\System\uLFOdar.exe
  2⤵
  PID:13572
- C:\Windows\System\mhVERyV.exe
  C:\Windows\System\mhVERyV.exe
  2⤵
  PID:13620
- C:\Windows\System\HdcLfpP.exe
  C:\Windows\System\HdcLfpP.exe
  2⤵
  PID:13864
- C:\Windows\System\fcVYwVZ.exe
  C:\Windows\System\fcVYwVZ.exe
  2⤵
  PID:13948
- C:\Windows\System\pqlVfTf.exe
  C:\Windows\System\pqlVfTf.exe
  2⤵
  PID:14040
- C:\Windows\System\cKBlMQA.exe
  C:\Windows\System\cKBlMQA.exe
  2⤵
  PID:2276
- C:\Windows\System\VzyUdkb.exe
  C:\Windows\System\VzyUdkb.exe
  2⤵
  PID:14272
- C:\Windows\System\XYklbuc.exe
  C:\Windows\System\XYklbuc.exe
  2⤵
  PID:13332
- C:\Windows\System\PAOTNuS.exe
  C:\Windows\System\PAOTNuS.exe
  2⤵
  PID:13744
- C:\Windows\System\onyOZXT.exe
  C:\Windows\System\onyOZXT.exe
  2⤵
  PID:1160
- C:\Windows\System\GOBArCS.exe
  C:\Windows\System\GOBArCS.exe
  2⤵
  PID:14180
- C:\Windows\System\CHTlGrc.exe
  C:\Windows\System\CHTlGrc.exe
  2⤵
  PID:13408
- C:\Windows\System\afAyZwd.exe
  C:\Windows\System\afAyZwd.exe
  2⤵
  PID:14356
- C:\Windows\System\IDZjnwX.exe
  C:\Windows\System\IDZjnwX.exe
  2⤵
  PID:14388
- C:\Windows\System\pWhTCiQ.exe
  C:\Windows\System\pWhTCiQ.exe
  2⤵
  PID:14408
- C:\Windows\System\UosjOxv.exe
  C:\Windows\System\UosjOxv.exe
  2⤵
  PID:14432
- C:\Windows\System\zEkyEBT.exe
  C:\Windows\System\zEkyEBT.exe
  2⤵
  PID:14448
- C:\Windows\System\DVFyRgS.exe
  C:\Windows\System\DVFyRgS.exe
  2⤵
  PID:14472
- C:\Windows\System\qcrdQox.exe
  C:\Windows\System\qcrdQox.exe
  2⤵
  PID:14496
- C:\Windows\System\EhuWdec.exe
  C:\Windows\System\EhuWdec.exe
  2⤵
  PID:14520
- C:\Windows\System\qZOVSFl.exe
  C:\Windows\System\qZOVSFl.exe
  2⤵
  PID:14544
- C:\Windows\System\kjpLKLc.exe
  C:\Windows\System\kjpLKLc.exe
  2⤵
  PID:14576
- C:\Windows\System\IkJbGtJ.exe
  C:\Windows\System\IkJbGtJ.exe
  2⤵
  PID:14620
- C:\Windows\System\YXRZvvm.exe
  C:\Windows\System\YXRZvvm.exe
  2⤵
  PID:14668
- C:\Windows\System\SotdUmx.exe
  C:\Windows\System\SotdUmx.exe
  2⤵
  PID:14684
- C:\Windows\System\LVmgAdT.exe
  C:\Windows\System\LVmgAdT.exe
  2⤵
  PID:14724
- C:\Windows\System\Uncbnes.exe
  C:\Windows\System\Uncbnes.exe
  2⤵
  PID:14760
- C:\Windows\System\jQGBtnJ.exe
  C:\Windows\System\jQGBtnJ.exe
  2⤵
  PID:14804
- C:\Windows\System\wPcRlUd.exe
  C:\Windows\System\wPcRlUd.exe
  2⤵
  PID:14832
- C:\Windows\System\OntrpJW.exe
  C:\Windows\System\OntrpJW.exe
  2⤵
  PID:14848
- C:\Windows\System\ZMrNjAq.exe
  C:\Windows\System\ZMrNjAq.exe
  2⤵
  PID:14872
- C:\Windows\System\gUGIHPT.exe
  C:\Windows\System\gUGIHPT.exe
  2⤵
  PID:14896
- C:\Windows\System\gsnQjmU.exe
  C:\Windows\System\gsnQjmU.exe
  2⤵
  PID:14948
- C:\Windows\System\rtHvllg.exe
  C:\Windows\System\rtHvllg.exe
  2⤵
  PID:14980
- C:\Windows\System\JGCbebf.exe
  C:\Windows\System\JGCbebf.exe
  2⤵
  PID:14996
- C:\Windows\System\qxQsupd.exe
  C:\Windows\System\qxQsupd.exe
  2⤵
  PID:15012
- C:\Windows\System\GyDVeOc.exe
  C:\Windows\System\GyDVeOc.exe
  2⤵
  PID:15052
- C:\Windows\System\uJbHIMA.exe
  C:\Windows\System\uJbHIMA.exe
  2⤵
  PID:15072
- C:\Windows\System\wuzHijf.exe
  C:\Windows\System\wuzHijf.exe
  2⤵
  PID:15092
- C:\Windows\System\xTUyaCf.exe
  C:\Windows\System\xTUyaCf.exe
  2⤵
  PID:15116
- C:\Windows\System\ESmqrYl.exe
  C:\Windows\System\ESmqrYl.exe
  2⤵
  PID:15168
- C:\Windows\System\owQyhDi.exe
  C:\Windows\System\owQyhDi.exe
  2⤵
  PID:15184
- C:\Windows\System\PGFhUiZ.exe
  C:\Windows\System\PGFhUiZ.exe
  2⤵
  PID:15208
- C:\Windows\System\VEXrHkG.exe
  C:\Windows\System\VEXrHkG.exe
  2⤵
  PID:15232
- C:\Windows\System\iSdiYRI.exe
  C:\Windows\System\iSdiYRI.exe
  2⤵
  PID:15256
- C:\Windows\System\jkCrvzm.exe
  C:\Windows\System\jkCrvzm.exe
  2⤵
  PID:15276
- C:\Windows\System\fBdSBJH.exe
  C:\Windows\System\fBdSBJH.exe
  2⤵
  PID:15308
- C:\Windows\System\QPdcAUx.exe
  C:\Windows\System\QPdcAUx.exe
  2⤵
  PID:14340
- C:\Windows\System\qcYzeuT.exe
  C:\Windows\System\qcYzeuT.exe
  2⤵
  PID:14416
- C:\Windows\System\CTnySDc.exe
  C:\Windows\System\CTnySDc.exe
  2⤵
  PID:14440
- C:\Windows\System\uNPlGFv.exe
  C:\Windows\System\uNPlGFv.exe
  2⤵
  PID:14512
- C:\Windows\System\DLPfvOT.exe
  C:\Windows\System\DLPfvOT.exe
  2⤵
  PID:14644
- C:\Windows\System\ksjiQZq.exe
  C:\Windows\System\ksjiQZq.exe
  2⤵
  PID:14720
- C:\Windows\System\assLdqW.exe
  C:\Windows\System\assLdqW.exe
  2⤵
  PID:14752
- C:\Windows\System\aQbIWfP.exe
  C:\Windows\System\aQbIWfP.exe
  2⤵
  PID:14820
- C:\Windows\System\LBdmWAK.exe
  C:\Windows\System\LBdmWAK.exe
  2⤵
  PID:14864
- C:\Windows\System\tXXpaXU.exe
  C:\Windows\System\tXXpaXU.exe
  2⤵
  PID:14884
- C:\Windows\System\dGTMugN.exe
  C:\Windows\System\dGTMugN.exe
  2⤵
  PID:14932
- C:\Windows\System\nNZttTi.exe
  C:\Windows\System\nNZttTi.exe
  2⤵
  PID:15032
- C:\Windows\System\myMKugO.exe
  C:\Windows\System\myMKugO.exe
  2⤵
  PID:15084
- C:\Windows\System\bpgXvjQ.exe
  C:\Windows\System\bpgXvjQ.exe
  2⤵
  PID:15180
- C:\Windows\System\wqRNynS.exe
  C:\Windows\System\wqRNynS.exe
  2⤵
  PID:15316
- C:\Windows\System\cbBqrOh.exe
  C:\Windows\System\cbBqrOh.exe
  2⤵
  PID:15348
- C:\Windows\System\lOsubuv.exe
  C:\Windows\System\lOsubuv.exe
  2⤵
  PID:14460
- C:\Windows\System\YPuAuQR.exe
  C:\Windows\System\YPuAuQR.exe
  2⤵
  PID:14516
- C:\Windows\System\hyQtpCM.exe
  C:\Windows\System\hyQtpCM.exe
  2⤵
  PID:14736
- C:\Windows\System\GzOyZpb.exe
  C:\Windows\System\GzOyZpb.exe
  2⤵
  PID:15004
- C:\Windows\System\mCusjfn.exe
  C:\Windows\System\mCusjfn.exe
  2⤵
  PID:15064
- C:\Windows\System\FtFYRVP.exe
  C:\Windows\System\FtFYRVP.exe
  2⤵
  PID:15112
- C:\Windows\System\BbUBqQR.exe
  C:\Windows\System\BbUBqQR.exe
  2⤵
  PID:15300
- C:\Windows\System\SPdggTP.exe
  C:\Windows\System\SPdggTP.exe
  2⤵
  PID:14700
- C:\Windows\System\qvfIPHy.exe
  C:\Windows\System\qvfIPHy.exe
  2⤵
  PID:15044
- C:\Windows\System\pHnzudc.exe
  C:\Windows\System\pHnzudc.exe
  2⤵
  PID:14368
- C:\Windows\System\hXjTxpC.exe
  C:\Windows\System\hXjTxpC.exe
  2⤵
  PID:15376
- C:\Windows\System\qSVqFTQ.exe
  C:\Windows\System\qSVqFTQ.exe
  2⤵
  PID:15392
- C:\Windows\System\wzmxXZe.exe
  C:\Windows\System\wzmxXZe.exe
  2⤵
  PID:15408
- C:\Windows\System\FYgzFKq.exe
  C:\Windows\System\FYgzFKq.exe
  2⤵
  PID:15448
- C:\Windows\System\MhqzvjT.exe
  C:\Windows\System\MhqzvjT.exe
  2⤵
  PID:15500
- C:\Windows\System\nstzdxl.exe
  C:\Windows\System\nstzdxl.exe
  2⤵
  PID:15552
- C:\Windows\System\uyGRbnh.exe
  C:\Windows\System\uyGRbnh.exe
  2⤵
  PID:15572
- C:\Windows\System\VyzAfyQ.exe
  C:\Windows\System\VyzAfyQ.exe
  2⤵
  PID:15600
- C:\Windows\System\EUznUDA.exe
  C:\Windows\System\EUznUDA.exe
  2⤵
  PID:15640
- C:\Windows\System\XGXtgsT.exe
  C:\Windows\System\XGXtgsT.exe
  2⤵
  PID:15668
- C:\Windows\System\KjxniEi.exe
  C:\Windows\System\KjxniEi.exe
  2⤵
  PID:15692
- C:\Windows\System\BvXQhTw.exe
  C:\Windows\System\BvXQhTw.exe
  2⤵
  PID:15720
- C:\Windows\System\zdnBojv.exe
  C:\Windows\System\zdnBojv.exe
  2⤵
  PID:15740
- C:\Windows\System\eEQNURW.exe
  C:\Windows\System\eEQNURW.exe
  2⤵
  PID:15760
- C:\Windows\System\DZmURog.exe
  C:\Windows\System\DZmURog.exe
  2⤵
  PID:15788
- C:\Windows\System\VuddrNZ.exe
  C:\Windows\System\VuddrNZ.exe
  2⤵
  PID:15836
- C:\Windows\System\CUleSTy.exe
  C:\Windows\System\CUleSTy.exe
  2⤵
  PID:15860
- C:\Windows\System\uZUxWCZ.exe
  C:\Windows\System\uZUxWCZ.exe
  2⤵
  PID:15888
- C:\Windows\System\ESitoPq.exe
  C:\Windows\System\ESitoPq.exe
  2⤵
  PID:15904
- C:\Windows\System\PtLQQcf.exe
  C:\Windows\System\PtLQQcf.exe
  2⤵
  PID:15920
- C:\Windows\System\EPaylJJ.exe
  C:\Windows\System\EPaylJJ.exe
  2⤵
  PID:15956
- C:\Windows\System\SdMydDA.exe
  C:\Windows\System\SdMydDA.exe
  2⤵
  PID:15980
- C:\Windows\System\bJEWdMc.exe
  C:\Windows\System\bJEWdMc.exe
  2⤵
  PID:16012
- C:\Windows\System\nyinOcU.exe
  C:\Windows\System\nyinOcU.exe
  2⤵
  PID:16032
- C:\Windows\System\HEYaHai.exe
  C:\Windows\System\HEYaHai.exe
  2⤵
  PID:16060
- C:\Windows\System\HdVfNBP.exe
  C:\Windows\System\HdVfNBP.exe
  2⤵
  PID:16088
- C:\Windows\System\jwPvYpm.exe
  C:\Windows\System\jwPvYpm.exe
  2⤵
  PID:16136
- C:\Windows\System\JyXXoyV.exe
  C:\Windows\System\JyXXoyV.exe
  2⤵
  PID:16156
- C:\Windows\System\AtrAvjU.exe
  C:\Windows\System\AtrAvjU.exe
  2⤵
  PID:16176
- C:\Windows\System\RtkYCZx.exe
  C:\Windows\System\RtkYCZx.exe
  2⤵
  PID:16224
- C:\Windows\System\QTcMrtK.exe
  C:\Windows\System\QTcMrtK.exe
  2⤵
  PID:16252
- C:\Windows\System\mRuUrtD.exe
  C:\Windows\System\mRuUrtD.exe
  2⤵
  PID:16268
- C:\Windows\System\wEWHCGG.exe
  C:\Windows\System\wEWHCGG.exe
  2⤵
  PID:16292
- C:\Windows\System\sSLlgrm.exe
  C:\Windows\System\sSLlgrm.exe
  2⤵
  PID:16324
- C:\Windows\System\LmfYSeG.exe
  C:\Windows\System\LmfYSeG.exe
  2⤵
  PID:16352
- C:\Windows\System\PHsVLDc.exe
  C:\Windows\System\PHsVLDc.exe
  2⤵
  PID:13928
- C:\Windows\System\WutZOPe.exe
  C:\Windows\System\WutZOPe.exe
  2⤵
  PID:14892
- C:\Windows\System\XHYmkVE.exe
  C:\Windows\System\XHYmkVE.exe
  2⤵
  PID:15404
- C:\Windows\System\GAVvMiS.exe
  C:\Windows\System\GAVvMiS.exe
  2⤵
  PID:15492
- C:\Windows\System\sIUiDqC.exe
  C:\Windows\System\sIUiDqC.exe
  2⤵
  PID:15568
- C:\Windows\System\NZkucrY.exe
  C:\Windows\System\NZkucrY.exe
  2⤵
  PID:15628
- C:\Windows\System\DUORmbi.exe
  C:\Windows\System\DUORmbi.exe
  2⤵
  PID:15676
- C:\Windows\System\pZNPINV.exe
  C:\Windows\System\pZNPINV.exe
  2⤵
  PID:15748
- C:\Windows\System\yEgJQRr.exe
  C:\Windows\System\yEgJQRr.exe
  2⤵
  PID:15780
- C:\Windows\System\KUbBguT.exe
  C:\Windows\System\KUbBguT.exe
  2⤵
  PID:15844
- C:\Windows\System\hXjzJyX.exe
  C:\Windows\System\hXjzJyX.exe
  2⤵
  PID:15992
- C:\Windows\System\hZqlcLd.exe
  C:\Windows\System\hZqlcLd.exe
  2⤵
  PID:16024
- C:\Windows\System\mdOUFEX.exe
  C:\Windows\System\mdOUFEX.exe
  2⤵
  PID:16072
- C:\Windows\System\kWNqYvU.exe
  C:\Windows\System\kWNqYvU.exe
  2⤵
  PID:16112
- C:\Windows\System\FHjNGzC.exe
  C:\Windows\System\FHjNGzC.exe
  2⤵
  PID:16168
- C:\Windows\System\QfRbKYR.exe
  C:\Windows\System\QfRbKYR.exe
  2⤵
  PID:16264
- C:\Windows\System\wDwMkzF.exe
  C:\Windows\System\wDwMkzF.exe
  2⤵
  PID:16308
- C:\Windows\System\kaJWuZd.exe
  C:\Windows\System\kaJWuZd.exe
  2⤵
  PID:16380
- C:\Windows\System\AkSRwmX.exe
  C:\Windows\System\AkSRwmX.exe
  2⤵
  PID:15456
- C:\Windows\System\yRUWzzT.exe
  C:\Windows\System\yRUWzzT.exe
  2⤵
  PID:15656
- C:\Windows\System\PLuUXNm.exe
  C:\Windows\System\PLuUXNm.exe
  2⤵
  PID:15808
- C:\Windows\System\XMXGJzZ.exe
  C:\Windows\System\XMXGJzZ.exe
  2⤵
  PID:15816
- C:\Windows\System\wEtlsOw.exe
  C:\Windows\System\wEtlsOw.exe
  2⤵
  PID:16052
- C:\Windows\System\FpwqkXM.exe
  C:\Windows\System\FpwqkXM.exe
  2⤵
  PID:16344
- C:\Windows\System\IqaigXF.exe
  C:\Windows\System\IqaigXF.exe
  2⤵
  PID:15752
- C:\Windows\System\LVpvvCf.exe
  C:\Windows\System\LVpvvCf.exe
  2⤵
  PID:15660
- C:\Windows\System\wgDyttb.exe
  C:\Windows\System\wgDyttb.exe
  2⤵
  PID:16004
- C:\Windows\System\NMrKtEv.exe
  C:\Windows\System\NMrKtEv.exe
  2⤵
  PID:15388
- C:\Windows\System\FuyFCvf.exe
  C:\Windows\System\FuyFCvf.exe
  2⤵
  PID:16392
- C:\Windows\System\BtNkmfI.exe
  C:\Windows\System\BtNkmfI.exe
  2⤵
  PID:16408
- C:\Windows\System\gdCQwAE.exe
  C:\Windows\System\gdCQwAE.exe
  2⤵
  PID:16432
- C:\Windows\System\fkfUraD.exe
  C:\Windows\System\fkfUraD.exe
  2⤵
  PID:16456
- C:\Windows\System\fYooety.exe
  C:\Windows\System\fYooety.exe
  2⤵
  PID:16492
- C:\Windows\System\hMUZqcb.exe
  C:\Windows\System\hMUZqcb.exe
  2⤵
  PID:16512
- C:\Windows\System\ReqiaKu.exe
  C:\Windows\System\ReqiaKu.exe
  2⤵
  PID:16540
- C:\Windows\System\iaNzyhy.exe
  C:\Windows\System\iaNzyhy.exe
  2⤵
  PID:16588
- C:\Windows\System\LtgHJeW.exe
  C:\Windows\System\LtgHJeW.exe
  2⤵
  PID:16604
- C:\Windows\System\MeKYlbY.exe
  C:\Windows\System\MeKYlbY.exe
  2⤵
  PID:16656
- C:\Windows\System\MqWlEqg.exe
  C:\Windows\System\MqWlEqg.exe
  2⤵
  PID:16672
- C:\Windows\System\idaubEN.exe
  C:\Windows\System\idaubEN.exe
  2⤵
  PID:16700
- C:\Windows\System\rhArlZG.exe
  C:\Windows\System\rhArlZG.exe
  2⤵
  PID:16728
- C:\Windows\System\Pnkglmq.exe
  C:\Windows\System\Pnkglmq.exe
  2⤵
  PID:16768

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:17104

Network

DNS

228.249.119.40.in-addr.arpa

Remote address:

8.8.8.8:53

Request

228.249.119.40.in-addr.arpa

IN PTR

Response
DNS

81.144.22.2.in-addr.arpa

Remote address:

8.8.8.8:53

Request

81.144.22.2.in-addr.arpa

IN PTR

Response

81.144.22.2.in-addr.arpa

IN PTR

a2-22-144-81deploystaticakamaitechnologiescom
DNS

140.32.126.40.in-addr.arpa

Remote address:

8.8.8.8:53

Request

140.32.126.40.in-addr.arpa

IN PTR

Response
DNS

95.221.229.192.in-addr.arpa

Remote address:

8.8.8.8:53

Request

95.221.229.192.in-addr.arpa

IN PTR

Response
DNS

196.249.167.52.in-addr.arpa

Remote address:

8.8.8.8:53

Request

196.249.167.52.in-addr.arpa

IN PTR

Response
DNS

73.144.22.2.in-addr.arpa

Remote address:

8.8.8.8:53

Request

73.144.22.2.in-addr.arpa

IN PTR

Response

73.144.22.2.in-addr.arpa

IN PTR

a2-22-144-73deploystaticakamaitechnologiescom
DNS

43.229.111.52.in-addr.arpa

Remote address:

8.8.8.8:53

Request

43.229.111.52.in-addr.arpa

IN PTR

Response

No results found

8.8.8.8:53

228.249.119.40.in-addr.arpa

dns

73 B
159 B
1
1

DNS Request

228.249.119.40.in-addr.arpa
8.8.8.8:53

81.144.22.2.in-addr.arpa

dns

70 B
133 B
1
1

DNS Request

81.144.22.2.in-addr.arpa
8.8.8.8:53

140.32.126.40.in-addr.arpa

dns

72 B
158 B
1
1

DNS Request

140.32.126.40.in-addr.arpa
8.8.8.8:53

95.221.229.192.in-addr.arpa

dns

73 B
144 B
1
1

DNS Request

95.221.229.192.in-addr.arpa
8.8.8.8:53

196.249.167.52.in-addr.arpa

dns

73 B
147 B
1
1

DNS Request

196.249.167.52.in-addr.arpa
8.8.8.8:53

73.144.22.2.in-addr.arpa

dns

70 B
133 B
1
1

DNS Request

73.144.22.2.in-addr.arpa
8.8.8.8:53

43.229.111.52.in-addr.arpa

dns

72 B
158 B
1
1

DNS Request

43.229.111.52.in-addr.arpa

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\BQPkPiD.exe

Filesize
1.1MB

MD5
98e87a223098b92303095658f7c71f76

SHA1
b9d888f5b5024758292bc1bc7ef0a45f1620b82f

SHA256
67ab24e2f1c8ac34f67c0284cca46dbd69e4dce96a8fa740a71f01908fe28557

SHA512
54221da9e715f31ebd0fc745d7423f3af5227bbde3af920ad47b58f41a9d83d9dde13cdff70c3681e0eb20339256204fd55bc276a3eef75e8d993cbffb8312c4

Download Submit
C:\Windows\System\CWXGBOj.exe

Filesize
1.1MB

MD5
6898eb1f5a3a049f18458313467d7840

SHA1
419c74cc38482a39de2dad2a3063e4d550c65c76

SHA256
e962eae3efdbd56b938c4850026b6ea45156cfb9d3dfe1122e369980279476e0

SHA512
324f625a357d2c10f2e14390dfa77d057955e3eae7cae152e064eb2a3aed7a440be71fb909aa445ec81903089b8826888009975bdad541569c098fb2b25d6e1c

Download Submit
C:\Windows\System\CjbdWhf.exe

Filesize
1.1MB

MD5
5ab929209dc87081cb504365efbc339d

SHA1
950fdeee0d23a9a06c6c3ba166ca403f313dc91f

SHA256
8c97f002a54a7f3e3eca0a0a53bbd75d843058dd20fdbf4d948b5ce0eb2f17c4

SHA512
ff6ce0dd7ee89b649f4f1a091a858a67c89307b4bd59c1498955a452b84ee3214e4ec127ae461504e0d94fab5dbacee9df41795a22c7d7745eb1a2c1a37c8d7d

Download Submit
C:\Windows\System\DVvoMnh.exe

Filesize
1.1MB

MD5
eca763a8045234a1c48727327b618e1a

SHA1
005693d37e107191046f9417f16dbdf26ab713a8

SHA256
06463b1085b7ee5f097c450e0da15ca43c602bf0ec00d9933743dbcf4eb20f1e

SHA512
89f0ed1732309a772acb22f1d8a924080999d677dcf95b99b7fc9bdf7ae71de5893882c3ae9807d087243908221ebd46642a40b382ed47847a2cfb44e8fc68af

Download Submit
C:\Windows\System\FChLpMu.exe

Filesize
1.1MB

MD5
8b8ac435d11845014a86b0b4bff63222

SHA1
ec967d579fc6efb6a0b158477ccf5b2f57deef00

SHA256
b3954a47994ea4116e07b18386978e764d97dd9346c7d1835374038709df484d

SHA512
c79a769c0d290c06362a12290ba38fb9cfa57f25c72a1557039a0f3d7a1e60219566315ac6d0de834f55195a9502e75bbf831b7e16e155afb9b27510d6ff0cbe

Download Submit
C:\Windows\System\HLxnMeF.exe

Filesize
1.1MB

MD5
37eb975895d2e1047001dd05e41f5ec1

SHA1
5a3609828abbfae1d2dc13f359467b25332de0cb

SHA256
911c89ba9e1d60b04076ac5bd905548e47cab13e64ef29044b46985631f5dbf9

SHA512
1057d2b5770dfd7457fb3b50509c4484bf05101e2a3e3b9ef3a00e70251933d0f8200f9533dac71a7c148bf8e12e45ef6b7a23b24f61b613bc0dd2e599918693

Download Submit
C:\Windows\System\HNRSiBe.exe

Filesize
1.1MB

MD5
09cffa4f405591e7571fe80deccd788a

SHA1
d49e3d1f1af7523fcfde70228b487925f4162c26

SHA256
0cac7602c1f5945df3711bb9b89b5783f59bfc35bd5271c41abaa026df47005c

SHA512
d97c0732753c1726ae01e7018e4a33c46f9946e46ee44d926fa4c946b663a1ff64af4140312b73c6ae02ed6a00f4cbc681013ff2efe40b8933085707faede1e6

Download Submit
C:\Windows\System\JisSPzB.exe

Filesize
1.1MB

MD5
dc9b90fde4355282b861b845b9eabc2f

SHA1
e2f4554dbbe632bbb9d6171a89b02792421403c0

SHA256
0f179519780bd57f5a2c13f3c48b1119934223f24552c1e3981a16b75e957c4a

SHA512
1de4d6722f50c019e008e6017978cbfeb60eb991884759db60146582e32a6a16341e4de17fed181cb11d653b3d615770c66708ab42198c2050b417793724ea3b

Download Submit
C:\Windows\System\JoDsmKn.exe

Filesize
1.1MB

MD5
73aa178167cd9aca39b08f3c83e6a477

SHA1
9c646d53b0a5c7ce4bf48f32b361f87fa8ccb3e3

SHA256
b5ca6241057d3db3667d6aadb472816fb1e0d183672b5a1e6258f220103a1878

SHA512
549966fc157eeaee9b3f3f81fffa2cbf332e7557021c31aa6d2aca0957d8a9c721d9b7d33bd5bf2288113f7c9967f6fca99d52f9ba7ef3f2ddbf8cf04a68e06b

Download Submit
C:\Windows\System\KpgEEmj.exe

Filesize
1.1MB

MD5
61194456204aae51c9eb15ced32ed66a

SHA1
7416537b68e84c9fa221e1bfdf8b7a20d2dc431e

SHA256
9be2172697e9045783e973c27379193395d1bf10a8c5ce9d4c4048c705d4ed43

SHA512
fa7da3d36f8e87a6e959af7157a091fb6468243d7ea6f636f782a39d0f38ba1bc261218ac5fd07f76f50580360b6121f5c02a9d8670ff692c814d8f1e5d818c6

Download Submit
C:\Windows\System\QymvCjg.exe

Filesize
1.1MB

MD5
ff3298b6a40db02b9be27b6b6fea9e82

SHA1
96294b27fc7ddf13d18c85529c933d2ee1a3e6f6

SHA256
b67ef8dabf84bc87ab9a7742c50f721b5c2ef165dbddbdf601cbc5d445d73be9

SHA512
b82b8dd1aa597910a05988629865979ea57dff69f216614f319de74766cad4380ee40e5b4b6cde18f0172961f82e7eff6a4c3d8761da297ae92112b603b36253

Download Submit
C:\Windows\System\RiDeVjZ.exe

Filesize
1.1MB

MD5
d7c102061a5b0089dcd1d9ba7e4a102d

SHA1
7bdd5985b0b5e679e75033f5a72a4cf60019650d

SHA256
815cb17fd952fadfe095c2861b5a9c6271b501099a677e16dab39bcf914d7af9

SHA512
dff5a86f08ae6925a1a76dac4f8b36ade81694543d0c01ddf7e87a659bda606db4af3973878c2523475ca65ede7fbd2a47d7478da9fcfb2f48b6a35d2bee424d

Download Submit
C:\Windows\System\SNlgeSx.exe

Filesize
1.1MB

MD5
4aebedc942bbd58192f7c59d4a8c357e

SHA1
6e339ab4a161cf8b7566bd4ba2ed44facfb0cc26

SHA256
5879bb89d960aa07d8cbcda4a1b173fb22e05a60afeec3161dc2832eecaceaf9

SHA512
0d3e1908b83e3951b4dd3981227844ba561f34692ef58c259048817fdbf65a27abe50e2dd10e3aa244bfe6206e26d15319fe26526fa2c731e03dc11a79898c91

Download Submit
C:\Windows\System\SZeQpWd.exe

Filesize
1.1MB

MD5
0250b18409fcd7a40b272b626bfb9aae

SHA1
bddb297af63ed29ad4fd43edadafb579e456f3aa

SHA256
807b18f6869ba02730fb0e938600294ad776332df8450f4ff3ac9a8582ca4a95

SHA512
9790bdea04267882c6ccf2eb4c74a3fe311ea7d4a11fd0f19b0cbe43427c7d933fd6abd25a333ce120f3c5dfbb6b0845d532ee6149a257917c49e7551014a4ab

Download Submit
C:\Windows\System\XUEmzRu.exe

Filesize
1.1MB

MD5
b74a4a00c326c50671c397ca06650657

SHA1
41200a763d9fdaa23b5a985fac1e07fda7a7b694

SHA256
268bdada55d1ffd2b9597c5130cb4ea270b4cd7a31bce8589cf051c6e3680c08

SHA512
4de4168a77c1ba526500a6e53e7074d7d5bd13f9ec1ced879d0d911bb3d07898e0b8fd2fd058d350f375bc0b23d2da9c61dc02ce727e381222d7af5f5b20f289

Download Submit
C:\Windows\System\YwfUjzq.exe

Filesize
1.1MB

MD5
fb3cb809dd95cee941fb53b9ae1298eb

SHA1
30a0c1880d8fe6dc53d6c736d5b992aa3433e414

SHA256
8c8eb46cc0f327ca3afe88b034f312c6ac68c8588c3fe6d8e3561f6f83f20ff8

SHA512
0b58f67ec8d5297480139a9e38a75c65fda247c178565a6ed3046c600494f83ea6e3ad21bf3db5f2002514cbe8be374ee77ea1c43b4468c19ec4c5f22c2f19e4

Download Submit
C:\Windows\System\aKBwJTV.exe

Filesize
1.1MB

MD5
277c5fb3218e7a2c1ee6fb7cc2fdc6fd

SHA1
e765f138700a30f5f582b340bdca7c3553ae9bdf

SHA256
0eb3ee79c4bc99584bd5951bb48ab28e656d89b5d7f4c71aa2bf7b8b5e46b3cc

SHA512
c2cd3c610db048abdc08710fc49c523cd2250402cdb41ae3c22544db55c0090f0fe9dc3ba9f86c2d05cbb4a552810663cdc1a12be8e9673193e2f653a3a6ac01

Download Submit
C:\Windows\System\cMkwrgl.exe

Filesize
1.1MB

MD5
09b2d200cd0a12932de79e89ce11acc5

SHA1
52a3d3bab09c4ef51f39df79005b6cadba19fdc2

SHA256
66493ebe5bd6985eee16dd003db0d06cd9f8761fff250359c2ed6cfa2b3c0ca1

SHA512
28a0ad5cb60615b5ed5cdca1699ee27ee9bbbfcd63ef45860a4cbeebd23b8df0e3341a1597257492ec66740bff812a3a4610139f23c4835bd9f8adfeb49bda54

Download Submit
C:\Windows\System\fWYzpbn.exe

Filesize
1.1MB

MD5
ba9c867cde8c2b8ddbfe11398bc60655

SHA1
09ee23a823d8b04633d9b17885f255601f2c69d2

SHA256
332348d31fdcd3d4f030b03b21d1fb0663c3c5fde12b00a301196a08e180469a

SHA512
486cbb08e2105d69a5a854890cf156322023a21273a5f1a23e10af91a9546e143deb522bcaaa6b305b1080c31cd79f4292d2a391e445e88f2d3fc9dda93fca58

Download Submit
C:\Windows\System\gRbBKSZ.exe

Filesize
1.1MB

MD5
c50b8074fee5ecec62fbad826cccc46c

SHA1
93b825284bef9d4829aacb8f9a00078657b0869f

SHA256
5f2d359a0460db163d2e1487d85b1f61b84a95f25896c01d87024e5f8b9d8b54

SHA512
852d6cf00ad5093cadac010dd0916e230f636f3e0dd6d89d14682311fd97010a59a5d54ab59f50198466fca626608ea8ee9498a209944a12e2f703455cabbbeb

Download Submit
C:\Windows\System\iWOtEdC.exe

Filesize
1.1MB

MD5
95c5f9400985bd1b38189f55b3d5d09a

SHA1
23cdc03f02c5c906cc134fac0342bc77fc94d1b6

SHA256
136a6e39aae6695670fa5a9c0c3100893a15158b13c9bf3ddc0bf0d06932aea9

SHA512
d060fcb698bf532bd5a4e1d00cc250b941a971f7576b30f79562d14fc1c1c53a82a98a7206ff2e6c6f05368c79c62bed69e65276dc117d143c1b9e57920a0a2c

Download Submit
C:\Windows\System\jrdgdGF.exe

Filesize
1.1MB

MD5
be76f6f4eebaaca6cf71ba69ff822950

SHA1
db2323ade12db03caf477fec347aff2dec95311c

SHA256
aefb0bcfec23c3570507cfe074855a79e6c3e4f0364493e1364682265a94e9f5

SHA512
02fde231658b75796bcb9002c752e904b0de50707c8293207edd71be4110cc74ee2c673ba0c9020c65aeb3484f29640810ab3dbc0693f08ba4e27f64ef33f2c4

Download Submit
C:\Windows\System\lErNret.exe

Filesize
1.1MB

MD5
4c7e3c26d36a750d877c8197a02e45c4

SHA1
f428dc35df1bfdbbeee2442e8d5cbc79ce0455f1

SHA256
16aebdcb7dec418db86b7b09d36095828f0fdf690ba880e80d785515a76fd538

SHA512
f961d461066b9c1aa74559c3a62108a024bfae09094bdb1f3c06c3ff40d48ee20afb2cfeb0064c3a3aaa51f763e2e3a7156c7387309ce7ad14a970ff956b4d8d

Download Submit
C:\Windows\System\mofvCdX.exe

Filesize
1.1MB

MD5
4d8d9fb5d7c76dd3463f1854bcef8ed8

SHA1
b0799a812da3e5d6ecd43b57f10950144e6a919e

SHA256
04082b94294accbd6f5fd0a5025bc6bd0eb4abd7b2d68aabf848a570aad0dc66

SHA512
465ae19db282000dca8e0d7383625e2ef93df4c6953b3e95fa55133322924da831516e4c2c901aef686713a8c4ae53ad2a9fc82a8452da3fb5628b525ce52e39

Download Submit
C:\Windows\System\pWcCYRx.exe

Filesize
1.1MB

MD5
ab5f66a1d69ef87119714f00a5d5132d

SHA1
80ced4179610e426ea8d6d093f9e304695e97c6b

SHA256
daffbca15e8c25dd90339127060cc8442594c6e938d6921dad1237761187c259

SHA512
7f7dcebc048fa76fb10d1aeb6744d7f5c5e212ec9e3bd1f5902ac9fe6b55ebb40a815c66c2e7546072999f041bf367efde146fe0e39d0d40a9983556d2662b9e

Download Submit
C:\Windows\System\poGQoTZ.exe

Filesize
1.1MB

MD5
c9b0a1575a966a02e78c2c1adef6178c

SHA1
809c40403cd63e74232277e4672e5eb476c88fc2

SHA256
26269678fe2d38835a0e4d8b4bc7e0027ab2856e6e02fdd96c2d5de4dd1bdd8d

SHA512
c814e8dc9096120239326e75831cc6dae8862d599e55d91cd5de8e0107e670b0750f1122737f79b481c279df942bc91eaf8e0a1e992690b9d015146118fd27da

Download Submit
C:\Windows\System\riKEHUa.exe

Filesize
1.1MB

MD5
a3c004a7dd3254ce33f3df23a25f6f5f

SHA1
8be36b2ef918d81078dcc0d8566115905e03a4f0

SHA256
1cac97d5206a54ff8e5b2dd183fae5ce13812a32ed04917e95ecc29b38dbe93f

SHA512
b7c3c9730bc1b29ed729ea5967a7b3245ccfaf17193b2662ec8c18afc6bb906113e6c214d263680c79b6bb83f18dbfbdc90a859afbaa6458db059bcda71732ab

Download Submit
C:\Windows\System\sYZfkqX.exe

Filesize
1.1MB

MD5
2a97c7c4f910efa1af4d597a2707ca38

SHA1
e53e92d440405cfaeab5dafb7c8c6ec4cd5884d6

SHA256
12eaa2a1687f436aa61e9f9206c31211f14893d398d3345d961111e47b1928e4

SHA512
045b21fb778a7e04fec834d8e0d82950c48ca225dedfd295c867cd4d88fa765661daac052436e774e6d7b8677c918d388a770d15891d3c17c1f77b91404b7d6e

Download Submit
C:\Windows\System\tPLfgyT.exe

Filesize
1.1MB

MD5
acc0d68d0077ba6be77de9c89f83c881

SHA1
f83d0d9c50a459ac9d495dcad6fb7e72d8c79316

SHA256
aadb944c60b8fb49d37eb3e6bade2bfe4f349c2d963a1fdb371a920568a4df10

SHA512
f89c5739ccc30a9984bff2ceb9d1df6994f99751fd7b66b13a43fc903faf5ce5188342aa928d920fb67444debe3532d6265c6298b5f946fa3e852c8cb6ef4836

Download Submit
C:\Windows\System\tnRWQUv.exe

Filesize
1.1MB

MD5
5124ec9539cc3d66e7bc1398c2ab7386

SHA1
4b371cd008e4e5a6936d15c89cf08b4b844485ab

SHA256
1819b1aae1ed729c210f3695099737fd7672dc0234165e49ee58545e661c4634

SHA512
f58560fb53a08501dc73a8aa6187c5f787dfed4a7082821e89b1eef2ff8712372515b681734af622bc9cb6ed53e99af5eaf08ee5a7cba71a281d4b8cb0aa1ebb

Download Submit
C:\Windows\System\ubZljFu.exe

Filesize
1.1MB

MD5
24f577d8c50a4d8ff9bf1ac8fb4ff09e

SHA1
26fe81f49fb66bba051b356bb966acb0c193a60e

SHA256
5725fcff8f4952493d2038a37ab24c2ee0227ca9656a80a835f30e412e50dccf

SHA512
d1403fdd25cd730624ba8ad451fcc839642b1807af1a3172ea4f803c53d5ad6e97698c5622352d4ecb7dc0c5870dcfaffa1a7127db6579fe560818577b0d3118

Download Submit
C:\Windows\System\ujnRWSA.exe

Filesize
1.1MB

MD5
12126a6f8ddb0993569d2808865067ee

SHA1
c2f5e5a60955ea9109761609d1dd1c88a2f5d843

SHA256
c5e6d4d30af8b32bfce10e3e7b58063fdc697df04befba90f4e56f41a6204a80

SHA512
8c831851590e863674599dd4dba0e8ac0ddaf6ebbd0950bfbe033f22b4c50135472cbf0363e0550dc489414af99952f90ad07aa0ae0a971bd7f7220ec03899c3

Download Submit
C:\Windows\System\ymwGvNq.exe

Filesize
1.1MB

MD5
51c90bbf156e8f72c783d8221778b975

SHA1
021544b187b56e76a291ccbc39b45ddec10e4699

SHA256
a42e0e8d8f9cf58a2c0db2358a70ac3f5c78ee92d6e90c7e949cd2d3981c76b5

SHA512
ca4f876fbb1f6ab8ffc6736a164724764bd4f5405991d5ccb9efb16b844b593f0128ff0aade2d1a42a99c85eabd20ccc566df5caec0fb7655394d6c706ed5216

Download Submit
memory/1060-0-0x000001EFA7720000-0x000001EFA7730000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

We care about your privacy.