xmrig | c2fe81bf445f007af6766ecaadb27c2a8b173a03def015cfc0ce93381796c607

Analysis

max time kernel
139s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
24-12-2024 01:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c2fe81bf445f007af6766ecaadb27c2a8b173a03def015cfc0ce93381796c607.exe
Size

1.6MB
MD5

21ee98d9e347d5bf42556968568e58fc
SHA1

c65d38ce9c308b45304559e9db9d05232255d66b
SHA256

c2fe81bf445f007af6766ecaadb27c2a8b173a03def015cfc0ce93381796c607
SHA512

367767dfaaf42652605a72ef12d292a38432fa3b3e7870f50a2bc87cfafc6b58c3289f98ff4d2f1fa0408774a36e71557642d0c5b89ded33eaec5018f53d37b5
SSDEEP

49152:GezaTF8FcNkNdfE0pZ9ozttwIRx3Qi+PWiJpY:GemTLkNdfE0pZyj

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 37 IoCs

miner

resource	yara_rule
behavioral2/files/0x000d000000023b84-4.dat	xmrig
behavioral2/files/0x000a000000023b91-16.dat	xmrig
behavioral2/files/0x000a000000023b92-17.dat	xmrig
behavioral2/files/0x000a000000023b94-30.dat	xmrig
behavioral2/files/0x000a000000023b93-28.dat	xmrig
behavioral2/files/0x000b000000023b8d-9.dat	xmrig
behavioral2/files/0x000a000000023b95-34.dat	xmrig
behavioral2/files/0x000a000000023b98-43.dat	xmrig
behavioral2/files/0x000a000000023b9b-54.dat	xmrig
behavioral2/files/0x000a000000023b9c-61.dat	xmrig
behavioral2/files/0x000a000000023b9e-73.dat	xmrig
behavioral2/files/0x000a000000023b9d-75.dat	xmrig
behavioral2/files/0x000b000000023ba1-92.dat	xmrig
behavioral2/files/0x0009000000023bbe-105.dat	xmrig
behavioral2/files/0x0008000000023bcc-151.dat	xmrig
behavioral2/files/0x0008000000023c05-170.dat	xmrig
behavioral2/files/0x0008000000023bc9-175.dat	xmrig
behavioral2/files/0x0008000000023c00-167.dat	xmrig
behavioral2/files/0x0008000000023bff-166.dat	xmrig
behavioral2/files/0x0008000000023bfe-163.dat	xmrig
behavioral2/files/0x0008000000023bfd-162.dat	xmrig
behavioral2/files/0x0008000000023bfc-157.dat	xmrig
behavioral2/files/0x0008000000023bfb-155.dat	xmrig
behavioral2/files/0x0008000000023bcb-148.dat	xmrig
behavioral2/files/0x0008000000023bca-145.dat	xmrig
behavioral2/files/0x0008000000023bc6-122.dat	xmrig
behavioral2/files/0x000e000000023bc4-121.dat	xmrig
behavioral2/files/0x0009000000023bc0-120.dat	xmrig
behavioral2/files/0x0009000000023bbf-119.dat	xmrig
behavioral2/files/0x0008000000023bb9-117.dat	xmrig
behavioral2/files/0x000e000000023bb0-116.dat	xmrig
behavioral2/files/0x000a000000023ba9-113.dat	xmrig
behavioral2/files/0x000b000000023ba0-88.dat	xmrig
behavioral2/files/0x000b000000023b9f-83.dat	xmrig
behavioral2/files/0x000a000000023b9a-58.dat	xmrig
behavioral2/files/0x000a000000023b99-55.dat	xmrig
behavioral2/files/0x000b000000023b8e-51.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
4352	JbXWTJI.exe
4188	NFRijCd.exe
4536	fPQJVnV.exe
3608	xSxcIim.exe
1808	uPONTzB.exe
5008	XtLIrNf.exe
3812	JCuJGbQ.exe
4784	WtwpvgK.exe
4008	OrUekIn.exe
4772	IuIpbNU.exe
3044	nscNxcG.exe
1836	bwHuzUf.exe
2312	dKkgQta.exe
2704	HPwiNlm.exe
3956	DcgMaLM.exe
4932	YGaxNVI.exe
3448	RnHRQxz.exe
4664	bwxNHMP.exe
3096	QqXRCsu.exe
520	HgYJRYD.exe
1944	RhnofEk.exe
1508	TrbsDfq.exe
4532	SrQjPdj.exe
2848	nQKWxWC.exe
4988	zYHrOHd.exe
1252	OrERCqe.exe
2016	PQalowQ.exe
2512	TrHDXbb.exe
4396	GmKXMdh.exe
2084	ekXiBxJ.exe
4400	hqnleHg.exe
4244	UIcVUPy.exe
4580	NLXABXI.exe
444	MFsPgAW.exe
1124	QkbekUn.exe
2316	MoQmecF.exe
2240	MSsMBNP.exe
1040	OUnQbnp.exe
872	JgwljKA.exe
1824	DdmuIwz.exe
2612	QDBjTIc.exe
2808	VLHXZHC.exe
1640	QSxahDi.exe
3932	UHQtZYQ.exe
1492	wKguHri.exe
320	myqiIZr.exe
2928	IMEOFgz.exe
336	zCrPMUc.exe
2032	QPLSEyi.exe
2376	xfEjfkJ.exe
5048	APSAlcO.exe
3600	GTNTrGx.exe
1752	fehkurZ.exe
4684	kdfHGMG.exe
3852	nKVGGgP.exe
1352	rsDEJdH.exe
2684	pmUFUkN.exe
1336	SamqYGR.exe
4316	sZCVHse.exe
4956	EIRnBhW.exe
4848	cBBCHmj.exe
3460	uKEDVnC.exe
3324	ASXMpRY.exe
2960	rjdwQcI.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\dUnuFeU.exe	c2fe81bf445f007af6766ecaadb27c2a8b173a03def015cfc0ce93381796c607.exe
File created	C:\Windows\System\ikozubD.exe	c2fe81bf445f007af6766ecaadb27c2a8b173a03def015cfc0ce93381796c607.exe
File created	C:\Windows\System\IEyeXqb.exe	c2fe81bf445f007af6766ecaadb27c2a8b173a03def015cfc0ce93381796c607.exe
File created	C:\Windows\System\JbXWTJI.exe	c2fe81bf445f007af6766ecaadb27c2a8b173a03def015cfc0ce93381796c607.exe
File created	C:\Windows\System\RyCNClT.exe	c2fe81bf445f007af6766ecaadb27c2a8b173a03def015cfc0ce93381796c607.exe
File created	C:\Windows\System\DSVFxHz.exe	c2fe81bf445f007af6766ecaadb27c2a8b173a03def015cfc0ce93381796c607.exe
File created	C:\Windows\System\lVsYeoH.exe	c2fe81bf445f007af6766ecaadb27c2a8b173a03def015cfc0ce93381796c607.exe
File created	C:\Windows\System\EpZQWYz.exe	c2fe81bf445f007af6766ecaadb27c2a8b173a03def015cfc0ce93381796c607.exe
File created	C:\Windows\System\DtpfUCq.exe	c2fe81bf445f007af6766ecaadb27c2a8b173a03def015cfc0ce93381796c607.exe
File created	C:\Windows\System\LBTcjtV.exe	c2fe81bf445f007af6766ecaadb27c2a8b173a03def015cfc0ce93381796c607.exe
File created	C:\Windows\System\oyoJAjz.exe	c2fe81bf445f007af6766ecaadb27c2a8b173a03def015cfc0ce93381796c607.exe
File created	C:\Windows\System\TRlatFM.exe	c2fe81bf445f007af6766ecaadb27c2a8b173a03def015cfc0ce93381796c607.exe
File created	C:\Windows\System\hzoiOiS.exe	c2fe81bf445f007af6766ecaadb27c2a8b173a03def015cfc0ce93381796c607.exe
File created	C:\Windows\System\hGsfzYo.exe	c2fe81bf445f007af6766ecaadb27c2a8b173a03def015cfc0ce93381796c607.exe
File created	C:\Windows\System\mCrHuQw.exe	c2fe81bf445f007af6766ecaadb27c2a8b173a03def015cfc0ce93381796c607.exe
File created	C:\Windows\System\wCyneCE.exe	c2fe81bf445f007af6766ecaadb27c2a8b173a03def015cfc0ce93381796c607.exe
File created	C:\Windows\System\jLpJCQl.exe	c2fe81bf445f007af6766ecaadb27c2a8b173a03def015cfc0ce93381796c607.exe
File created	C:\Windows\System\wSuzmPB.exe	c2fe81bf445f007af6766ecaadb27c2a8b173a03def015cfc0ce93381796c607.exe
File created	C:\Windows\System\yBydnWP.exe	c2fe81bf445f007af6766ecaadb27c2a8b173a03def015cfc0ce93381796c607.exe
File created	C:\Windows\System\mzdiWxc.exe	c2fe81bf445f007af6766ecaadb27c2a8b173a03def015cfc0ce93381796c607.exe
File created	C:\Windows\System\FfFZXHQ.exe	c2fe81bf445f007af6766ecaadb27c2a8b173a03def015cfc0ce93381796c607.exe
File created	C:\Windows\System\tjRNwuz.exe	c2fe81bf445f007af6766ecaadb27c2a8b173a03def015cfc0ce93381796c607.exe
File created	C:\Windows\System\YCSCHaa.exe	c2fe81bf445f007af6766ecaadb27c2a8b173a03def015cfc0ce93381796c607.exe
File created	C:\Windows\System\qPUrWlR.exe	c2fe81bf445f007af6766ecaadb27c2a8b173a03def015cfc0ce93381796c607.exe
File created	C:\Windows\System\hpaIdVY.exe	c2fe81bf445f007af6766ecaadb27c2a8b173a03def015cfc0ce93381796c607.exe
File created	C:\Windows\System\cpHDQLi.exe	c2fe81bf445f007af6766ecaadb27c2a8b173a03def015cfc0ce93381796c607.exe
File created	C:\Windows\System\RDhZkoU.exe	c2fe81bf445f007af6766ecaadb27c2a8b173a03def015cfc0ce93381796c607.exe
File created	C:\Windows\System\rsFKhGJ.exe	c2fe81bf445f007af6766ecaadb27c2a8b173a03def015cfc0ce93381796c607.exe
File created	C:\Windows\System\lVRWhtf.exe	c2fe81bf445f007af6766ecaadb27c2a8b173a03def015cfc0ce93381796c607.exe
File created	C:\Windows\System\acuYdff.exe	c2fe81bf445f007af6766ecaadb27c2a8b173a03def015cfc0ce93381796c607.exe
File created	C:\Windows\System\nBewPfB.exe	c2fe81bf445f007af6766ecaadb27c2a8b173a03def015cfc0ce93381796c607.exe
File created	C:\Windows\System\iJKUDep.exe	c2fe81bf445f007af6766ecaadb27c2a8b173a03def015cfc0ce93381796c607.exe
File created	C:\Windows\System\pKnjMGo.exe	c2fe81bf445f007af6766ecaadb27c2a8b173a03def015cfc0ce93381796c607.exe
File created	C:\Windows\System\wKguHri.exe	c2fe81bf445f007af6766ecaadb27c2a8b173a03def015cfc0ce93381796c607.exe
File created	C:\Windows\System\plBOyCx.exe	c2fe81bf445f007af6766ecaadb27c2a8b173a03def015cfc0ce93381796c607.exe
File created	C:\Windows\System\FjPxWsi.exe	c2fe81bf445f007af6766ecaadb27c2a8b173a03def015cfc0ce93381796c607.exe
File created	C:\Windows\System\QDBjTIc.exe	c2fe81bf445f007af6766ecaadb27c2a8b173a03def015cfc0ce93381796c607.exe
File created	C:\Windows\System\vFRjxAT.exe	c2fe81bf445f007af6766ecaadb27c2a8b173a03def015cfc0ce93381796c607.exe
File created	C:\Windows\System\FmvCfEp.exe	c2fe81bf445f007af6766ecaadb27c2a8b173a03def015cfc0ce93381796c607.exe
File created	C:\Windows\System\EobmHOg.exe	c2fe81bf445f007af6766ecaadb27c2a8b173a03def015cfc0ce93381796c607.exe
File created	C:\Windows\System\AogWNkF.exe	c2fe81bf445f007af6766ecaadb27c2a8b173a03def015cfc0ce93381796c607.exe
File created	C:\Windows\System\hdygoFR.exe	c2fe81bf445f007af6766ecaadb27c2a8b173a03def015cfc0ce93381796c607.exe
File created	C:\Windows\System\wRTEbgZ.exe	c2fe81bf445f007af6766ecaadb27c2a8b173a03def015cfc0ce93381796c607.exe
File created	C:\Windows\System\jpntnGO.exe	c2fe81bf445f007af6766ecaadb27c2a8b173a03def015cfc0ce93381796c607.exe
File created	C:\Windows\System\FCYIdfc.exe	c2fe81bf445f007af6766ecaadb27c2a8b173a03def015cfc0ce93381796c607.exe
File created	C:\Windows\System\pdXkXSz.exe	c2fe81bf445f007af6766ecaadb27c2a8b173a03def015cfc0ce93381796c607.exe
File created	C:\Windows\System\BPfjrQx.exe	c2fe81bf445f007af6766ecaadb27c2a8b173a03def015cfc0ce93381796c607.exe
File created	C:\Windows\System\oQWzojx.exe	c2fe81bf445f007af6766ecaadb27c2a8b173a03def015cfc0ce93381796c607.exe
File created	C:\Windows\System\YGaxNVI.exe	c2fe81bf445f007af6766ecaadb27c2a8b173a03def015cfc0ce93381796c607.exe
File created	C:\Windows\System\DSHQEqh.exe	c2fe81bf445f007af6766ecaadb27c2a8b173a03def015cfc0ce93381796c607.exe
File created	C:\Windows\System\OIxbpfZ.exe	c2fe81bf445f007af6766ecaadb27c2a8b173a03def015cfc0ce93381796c607.exe
File created	C:\Windows\System\fJNxTKT.exe	c2fe81bf445f007af6766ecaadb27c2a8b173a03def015cfc0ce93381796c607.exe
File created	C:\Windows\System\fehkurZ.exe	c2fe81bf445f007af6766ecaadb27c2a8b173a03def015cfc0ce93381796c607.exe
File created	C:\Windows\System\hjHkfys.exe	c2fe81bf445f007af6766ecaadb27c2a8b173a03def015cfc0ce93381796c607.exe
File created	C:\Windows\System\gNuGKDj.exe	c2fe81bf445f007af6766ecaadb27c2a8b173a03def015cfc0ce93381796c607.exe
File created	C:\Windows\System\KhivhaR.exe	c2fe81bf445f007af6766ecaadb27c2a8b173a03def015cfc0ce93381796c607.exe
File created	C:\Windows\System\wGJmkSp.exe	c2fe81bf445f007af6766ecaadb27c2a8b173a03def015cfc0ce93381796c607.exe
File created	C:\Windows\System\slqjSFC.exe	c2fe81bf445f007af6766ecaadb27c2a8b173a03def015cfc0ce93381796c607.exe
File created	C:\Windows\System\yvOhpfR.exe	c2fe81bf445f007af6766ecaadb27c2a8b173a03def015cfc0ce93381796c607.exe
File created	C:\Windows\System\FmcfZxC.exe	c2fe81bf445f007af6766ecaadb27c2a8b173a03def015cfc0ce93381796c607.exe
File created	C:\Windows\System\AokZFHk.exe	c2fe81bf445f007af6766ecaadb27c2a8b173a03def015cfc0ce93381796c607.exe
File created	C:\Windows\System\UIcVUPy.exe	c2fe81bf445f007af6766ecaadb27c2a8b173a03def015cfc0ce93381796c607.exe
File created	C:\Windows\System\mHEDapJ.exe	c2fe81bf445f007af6766ecaadb27c2a8b173a03def015cfc0ce93381796c607.exe
File created	C:\Windows\System\EOFPVrD.exe	c2fe81bf445f007af6766ecaadb27c2a8b173a03def015cfc0ce93381796c607.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 26 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentEcs\Overrides	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentEcs\all\Overrides	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\FirstSession\officeclicktorun	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentEcs\officeclicktorun\Overrides	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\ExternalFeatureOverrides\officeclicktorun	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun\ConfigContextData	OfficeClickToRun.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	16936	dwm.exe
Token: SeChangeNotifyPrivilege	16936	dwm.exe
Token: 33	16936	dwm.exe
Token: SeIncBasePriorityPrivilege	16936	dwm.exe
Token: SeShutdownPrivilege	16936	dwm.exe
Token: SeCreatePagefilePrivilege	16936	dwm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1576 wrote to memory of 4352	1576	c2fe81bf445f007af6766ecaadb27c2a8b173a03def015cfc0ce93381796c607.exe	84
PID 1576 wrote to memory of 4352	1576	c2fe81bf445f007af6766ecaadb27c2a8b173a03def015cfc0ce93381796c607.exe	84
PID 1576 wrote to memory of 4188	1576	c2fe81bf445f007af6766ecaadb27c2a8b173a03def015cfc0ce93381796c607.exe	85
PID 1576 wrote to memory of 4188	1576	c2fe81bf445f007af6766ecaadb27c2a8b173a03def015cfc0ce93381796c607.exe	85
PID 1576 wrote to memory of 4536	1576	c2fe81bf445f007af6766ecaadb27c2a8b173a03def015cfc0ce93381796c607.exe	86
PID 1576 wrote to memory of 4536	1576	c2fe81bf445f007af6766ecaadb27c2a8b173a03def015cfc0ce93381796c607.exe	86
PID 1576 wrote to memory of 3608	1576	c2fe81bf445f007af6766ecaadb27c2a8b173a03def015cfc0ce93381796c607.exe	87
PID 1576 wrote to memory of 3608	1576	c2fe81bf445f007af6766ecaadb27c2a8b173a03def015cfc0ce93381796c607.exe	87
PID 1576 wrote to memory of 1808	1576	c2fe81bf445f007af6766ecaadb27c2a8b173a03def015cfc0ce93381796c607.exe	88
PID 1576 wrote to memory of 1808	1576	c2fe81bf445f007af6766ecaadb27c2a8b173a03def015cfc0ce93381796c607.exe	88
PID 1576 wrote to memory of 5008	1576	c2fe81bf445f007af6766ecaadb27c2a8b173a03def015cfc0ce93381796c607.exe	89
PID 1576 wrote to memory of 5008	1576	c2fe81bf445f007af6766ecaadb27c2a8b173a03def015cfc0ce93381796c607.exe	89
PID 1576 wrote to memory of 3812	1576	c2fe81bf445f007af6766ecaadb27c2a8b173a03def015cfc0ce93381796c607.exe	90
PID 1576 wrote to memory of 3812	1576	c2fe81bf445f007af6766ecaadb27c2a8b173a03def015cfc0ce93381796c607.exe	90
PID 1576 wrote to memory of 4784	1576	c2fe81bf445f007af6766ecaadb27c2a8b173a03def015cfc0ce93381796c607.exe	91
PID 1576 wrote to memory of 4784	1576	c2fe81bf445f007af6766ecaadb27c2a8b173a03def015cfc0ce93381796c607.exe	91
PID 1576 wrote to memory of 4008	1576	c2fe81bf445f007af6766ecaadb27c2a8b173a03def015cfc0ce93381796c607.exe	92
PID 1576 wrote to memory of 4008	1576	c2fe81bf445f007af6766ecaadb27c2a8b173a03def015cfc0ce93381796c607.exe	92
PID 1576 wrote to memory of 4772	1576	c2fe81bf445f007af6766ecaadb27c2a8b173a03def015cfc0ce93381796c607.exe	93
PID 1576 wrote to memory of 4772	1576	c2fe81bf445f007af6766ecaadb27c2a8b173a03def015cfc0ce93381796c607.exe	93
PID 1576 wrote to memory of 3044	1576	c2fe81bf445f007af6766ecaadb27c2a8b173a03def015cfc0ce93381796c607.exe	94
PID 1576 wrote to memory of 3044	1576	c2fe81bf445f007af6766ecaadb27c2a8b173a03def015cfc0ce93381796c607.exe	94
PID 1576 wrote to memory of 1836	1576	c2fe81bf445f007af6766ecaadb27c2a8b173a03def015cfc0ce93381796c607.exe	95
PID 1576 wrote to memory of 1836	1576	c2fe81bf445f007af6766ecaadb27c2a8b173a03def015cfc0ce93381796c607.exe	95
PID 1576 wrote to memory of 2312	1576	c2fe81bf445f007af6766ecaadb27c2a8b173a03def015cfc0ce93381796c607.exe	96
PID 1576 wrote to memory of 2312	1576	c2fe81bf445f007af6766ecaadb27c2a8b173a03def015cfc0ce93381796c607.exe	96
PID 1576 wrote to memory of 3956	1576	c2fe81bf445f007af6766ecaadb27c2a8b173a03def015cfc0ce93381796c607.exe	97
PID 1576 wrote to memory of 3956	1576	c2fe81bf445f007af6766ecaadb27c2a8b173a03def015cfc0ce93381796c607.exe	97
PID 1576 wrote to memory of 2704	1576	c2fe81bf445f007af6766ecaadb27c2a8b173a03def015cfc0ce93381796c607.exe	98
PID 1576 wrote to memory of 2704	1576	c2fe81bf445f007af6766ecaadb27c2a8b173a03def015cfc0ce93381796c607.exe	98
PID 1576 wrote to memory of 4932	1576	c2fe81bf445f007af6766ecaadb27c2a8b173a03def015cfc0ce93381796c607.exe	99
PID 1576 wrote to memory of 4932	1576	c2fe81bf445f007af6766ecaadb27c2a8b173a03def015cfc0ce93381796c607.exe	99
PID 1576 wrote to memory of 3448	1576	c2fe81bf445f007af6766ecaadb27c2a8b173a03def015cfc0ce93381796c607.exe	100
PID 1576 wrote to memory of 3448	1576	c2fe81bf445f007af6766ecaadb27c2a8b173a03def015cfc0ce93381796c607.exe	100
PID 1576 wrote to memory of 4664	1576	c2fe81bf445f007af6766ecaadb27c2a8b173a03def015cfc0ce93381796c607.exe	101
PID 1576 wrote to memory of 4664	1576	c2fe81bf445f007af6766ecaadb27c2a8b173a03def015cfc0ce93381796c607.exe	101
PID 1576 wrote to memory of 3096	1576	c2fe81bf445f007af6766ecaadb27c2a8b173a03def015cfc0ce93381796c607.exe	102
PID 1576 wrote to memory of 3096	1576	c2fe81bf445f007af6766ecaadb27c2a8b173a03def015cfc0ce93381796c607.exe	102
PID 1576 wrote to memory of 520	1576	c2fe81bf445f007af6766ecaadb27c2a8b173a03def015cfc0ce93381796c607.exe	103
PID 1576 wrote to memory of 520	1576	c2fe81bf445f007af6766ecaadb27c2a8b173a03def015cfc0ce93381796c607.exe	103
PID 1576 wrote to memory of 1944	1576	c2fe81bf445f007af6766ecaadb27c2a8b173a03def015cfc0ce93381796c607.exe	104
PID 1576 wrote to memory of 1944	1576	c2fe81bf445f007af6766ecaadb27c2a8b173a03def015cfc0ce93381796c607.exe	104
PID 1576 wrote to memory of 1508	1576	c2fe81bf445f007af6766ecaadb27c2a8b173a03def015cfc0ce93381796c607.exe	105
PID 1576 wrote to memory of 1508	1576	c2fe81bf445f007af6766ecaadb27c2a8b173a03def015cfc0ce93381796c607.exe	105
PID 1576 wrote to memory of 4532	1576	c2fe81bf445f007af6766ecaadb27c2a8b173a03def015cfc0ce93381796c607.exe	106
PID 1576 wrote to memory of 4532	1576	c2fe81bf445f007af6766ecaadb27c2a8b173a03def015cfc0ce93381796c607.exe	106
PID 1576 wrote to memory of 2848	1576	c2fe81bf445f007af6766ecaadb27c2a8b173a03def015cfc0ce93381796c607.exe	107
PID 1576 wrote to memory of 2848	1576	c2fe81bf445f007af6766ecaadb27c2a8b173a03def015cfc0ce93381796c607.exe	107
PID 1576 wrote to memory of 4988	1576	c2fe81bf445f007af6766ecaadb27c2a8b173a03def015cfc0ce93381796c607.exe	108
PID 1576 wrote to memory of 4988	1576	c2fe81bf445f007af6766ecaadb27c2a8b173a03def015cfc0ce93381796c607.exe	108
PID 1576 wrote to memory of 1252	1576	c2fe81bf445f007af6766ecaadb27c2a8b173a03def015cfc0ce93381796c607.exe	109
PID 1576 wrote to memory of 1252	1576	c2fe81bf445f007af6766ecaadb27c2a8b173a03def015cfc0ce93381796c607.exe	109
PID 1576 wrote to memory of 2016	1576	c2fe81bf445f007af6766ecaadb27c2a8b173a03def015cfc0ce93381796c607.exe	110
PID 1576 wrote to memory of 2016	1576	c2fe81bf445f007af6766ecaadb27c2a8b173a03def015cfc0ce93381796c607.exe	110
PID 1576 wrote to memory of 2512	1576	c2fe81bf445f007af6766ecaadb27c2a8b173a03def015cfc0ce93381796c607.exe	111
PID 1576 wrote to memory of 2512	1576	c2fe81bf445f007af6766ecaadb27c2a8b173a03def015cfc0ce93381796c607.exe	111
PID 1576 wrote to memory of 4396	1576	c2fe81bf445f007af6766ecaadb27c2a8b173a03def015cfc0ce93381796c607.exe	112
PID 1576 wrote to memory of 4396	1576	c2fe81bf445f007af6766ecaadb27c2a8b173a03def015cfc0ce93381796c607.exe	112
PID 1576 wrote to memory of 2084	1576	c2fe81bf445f007af6766ecaadb27c2a8b173a03def015cfc0ce93381796c607.exe	113
PID 1576 wrote to memory of 2084	1576	c2fe81bf445f007af6766ecaadb27c2a8b173a03def015cfc0ce93381796c607.exe	113
PID 1576 wrote to memory of 4400	1576	c2fe81bf445f007af6766ecaadb27c2a8b173a03def015cfc0ce93381796c607.exe	114
PID 1576 wrote to memory of 4400	1576	c2fe81bf445f007af6766ecaadb27c2a8b173a03def015cfc0ce93381796c607.exe	114
PID 1576 wrote to memory of 4244	1576	c2fe81bf445f007af6766ecaadb27c2a8b173a03def015cfc0ce93381796c607.exe	115
PID 1576 wrote to memory of 4244	1576	c2fe81bf445f007af6766ecaadb27c2a8b173a03def015cfc0ce93381796c607.exe	115

C:\Users\Admin\AppData\Local\Temp\c2fe81bf445f007af6766ecaadb27c2a8b173a03def015cfc0ce93381796c607.exe
"C:\Users\Admin\AppData\Local\Temp\c2fe81bf445f007af6766ecaadb27c2a8b173a03def015cfc0ce93381796c607.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1576
- C:\Windows\System\JbXWTJI.exe
  C:\Windows\System\JbXWTJI.exe
  2⤵
  - Executes dropped EXE
  PID:4352
- C:\Windows\System\NFRijCd.exe
  C:\Windows\System\NFRijCd.exe
  2⤵
  - Executes dropped EXE
  PID:4188
- C:\Windows\System\fPQJVnV.exe
  C:\Windows\System\fPQJVnV.exe
  2⤵
  - Executes dropped EXE
  PID:4536
- C:\Windows\System\xSxcIim.exe
  C:\Windows\System\xSxcIim.exe
  2⤵
  - Executes dropped EXE
  PID:3608
- C:\Windows\System\uPONTzB.exe
  C:\Windows\System\uPONTzB.exe
  2⤵
  - Executes dropped EXE
  PID:1808
- C:\Windows\System\XtLIrNf.exe
  C:\Windows\System\XtLIrNf.exe
  2⤵
  - Executes dropped EXE
  PID:5008
- C:\Windows\System\JCuJGbQ.exe
  C:\Windows\System\JCuJGbQ.exe
  2⤵
  - Executes dropped EXE
  PID:3812
- C:\Windows\System\WtwpvgK.exe
  C:\Windows\System\WtwpvgK.exe
  2⤵
  - Executes dropped EXE
  PID:4784
- C:\Windows\System\OrUekIn.exe
  C:\Windows\System\OrUekIn.exe
  2⤵
  - Executes dropped EXE
  PID:4008
- C:\Windows\System\IuIpbNU.exe
  C:\Windows\System\IuIpbNU.exe
  2⤵
  - Executes dropped EXE
  PID:4772
- C:\Windows\System\nscNxcG.exe
  C:\Windows\System\nscNxcG.exe
  2⤵
  - Executes dropped EXE
  PID:3044
- C:\Windows\System\bwHuzUf.exe
  C:\Windows\System\bwHuzUf.exe
  2⤵
  - Executes dropped EXE
  PID:1836
- C:\Windows\System\dKkgQta.exe
  C:\Windows\System\dKkgQta.exe
  2⤵
  - Executes dropped EXE
  PID:2312
- C:\Windows\System\DcgMaLM.exe
  C:\Windows\System\DcgMaLM.exe
  2⤵
  - Executes dropped EXE
  PID:3956
- C:\Windows\System\HPwiNlm.exe
  C:\Windows\System\HPwiNlm.exe
  2⤵
  - Executes dropped EXE
  PID:2704
- C:\Windows\System\YGaxNVI.exe
  C:\Windows\System\YGaxNVI.exe
  2⤵
  - Executes dropped EXE
  PID:4932
- C:\Windows\System\RnHRQxz.exe
  C:\Windows\System\RnHRQxz.exe
  2⤵
  - Executes dropped EXE
  PID:3448
- C:\Windows\System\bwxNHMP.exe
  C:\Windows\System\bwxNHMP.exe
  2⤵
  - Executes dropped EXE
  PID:4664
- C:\Windows\System\QqXRCsu.exe
  C:\Windows\System\QqXRCsu.exe
  2⤵
  - Executes dropped EXE
  PID:3096
- C:\Windows\System\HgYJRYD.exe
  C:\Windows\System\HgYJRYD.exe
  2⤵
  - Executes dropped EXE
  PID:520
- C:\Windows\System\RhnofEk.exe
  C:\Windows\System\RhnofEk.exe
  2⤵
  - Executes dropped EXE
  PID:1944
- C:\Windows\System\TrbsDfq.exe
  C:\Windows\System\TrbsDfq.exe
  2⤵
  - Executes dropped EXE
  PID:1508
- C:\Windows\System\SrQjPdj.exe
  C:\Windows\System\SrQjPdj.exe
  2⤵
  - Executes dropped EXE
  PID:4532
- C:\Windows\System\nQKWxWC.exe
  C:\Windows\System\nQKWxWC.exe
  2⤵
  - Executes dropped EXE
  PID:2848
- C:\Windows\System\zYHrOHd.exe
  C:\Windows\System\zYHrOHd.exe
  2⤵
  - Executes dropped EXE
  PID:4988
- C:\Windows\System\OrERCqe.exe
  C:\Windows\System\OrERCqe.exe
  2⤵
  - Executes dropped EXE
  PID:1252
- C:\Windows\System\PQalowQ.exe
  C:\Windows\System\PQalowQ.exe
  2⤵
  - Executes dropped EXE
  PID:2016
- C:\Windows\System\TrHDXbb.exe
  C:\Windows\System\TrHDXbb.exe
  2⤵
  - Executes dropped EXE
  PID:2512
- C:\Windows\System\GmKXMdh.exe
  C:\Windows\System\GmKXMdh.exe
  2⤵
  - Executes dropped EXE
  PID:4396
- C:\Windows\System\ekXiBxJ.exe
  C:\Windows\System\ekXiBxJ.exe
  2⤵
  - Executes dropped EXE
  PID:2084
- C:\Windows\System\hqnleHg.exe
  C:\Windows\System\hqnleHg.exe
  2⤵
  - Executes dropped EXE
  PID:4400
- C:\Windows\System\UIcVUPy.exe
  C:\Windows\System\UIcVUPy.exe
  2⤵
  - Executes dropped EXE
  PID:4244
- C:\Windows\System\NLXABXI.exe
  C:\Windows\System\NLXABXI.exe
  2⤵
  - Executes dropped EXE
  PID:4580
- C:\Windows\System\MFsPgAW.exe
  C:\Windows\System\MFsPgAW.exe
  2⤵
  - Executes dropped EXE
  PID:444
- C:\Windows\System\QkbekUn.exe
  C:\Windows\System\QkbekUn.exe
  2⤵
  - Executes dropped EXE
  PID:1124
- C:\Windows\System\MoQmecF.exe
  C:\Windows\System\MoQmecF.exe
  2⤵
  - Executes dropped EXE
  PID:2316
- C:\Windows\System\MSsMBNP.exe
  C:\Windows\System\MSsMBNP.exe
  2⤵
  - Executes dropped EXE
  PID:2240
- C:\Windows\System\OUnQbnp.exe
  C:\Windows\System\OUnQbnp.exe
  2⤵
  - Executes dropped EXE
  PID:1040
- C:\Windows\System\JgwljKA.exe
  C:\Windows\System\JgwljKA.exe
  2⤵
  - Executes dropped EXE
  PID:872
- C:\Windows\System\DdmuIwz.exe
  C:\Windows\System\DdmuIwz.exe
  2⤵
  - Executes dropped EXE
  PID:1824
- C:\Windows\System\QDBjTIc.exe
  C:\Windows\System\QDBjTIc.exe
  2⤵
  - Executes dropped EXE
  PID:2612
- C:\Windows\System\VLHXZHC.exe
  C:\Windows\System\VLHXZHC.exe
  2⤵
  - Executes dropped EXE
  PID:2808
- C:\Windows\System\QSxahDi.exe
  C:\Windows\System\QSxahDi.exe
  2⤵
  - Executes dropped EXE
  PID:1640
- C:\Windows\System\UHQtZYQ.exe
  C:\Windows\System\UHQtZYQ.exe
  2⤵
  - Executes dropped EXE
  PID:3932
- C:\Windows\System\wKguHri.exe
  C:\Windows\System\wKguHri.exe
  2⤵
  - Executes dropped EXE
  PID:1492
- C:\Windows\System\myqiIZr.exe
  C:\Windows\System\myqiIZr.exe
  2⤵
  - Executes dropped EXE
  PID:320
- C:\Windows\System\IMEOFgz.exe
  C:\Windows\System\IMEOFgz.exe
  2⤵
  - Executes dropped EXE
  PID:2928
- C:\Windows\System\zCrPMUc.exe
  C:\Windows\System\zCrPMUc.exe
  2⤵
  - Executes dropped EXE
  PID:336
- C:\Windows\System\QPLSEyi.exe
  C:\Windows\System\QPLSEyi.exe
  2⤵
  - Executes dropped EXE
  PID:2032
- C:\Windows\System\xfEjfkJ.exe
  C:\Windows\System\xfEjfkJ.exe
  2⤵
  - Executes dropped EXE
  PID:2376
- C:\Windows\System\APSAlcO.exe
  C:\Windows\System\APSAlcO.exe
  2⤵
  - Executes dropped EXE
  PID:5048
- C:\Windows\System\GTNTrGx.exe
  C:\Windows\System\GTNTrGx.exe
  2⤵
  - Executes dropped EXE
  PID:3600
- C:\Windows\System\fehkurZ.exe
  C:\Windows\System\fehkurZ.exe
  2⤵
  - Executes dropped EXE
  PID:1752
- C:\Windows\System\kdfHGMG.exe
  C:\Windows\System\kdfHGMG.exe
  2⤵
  - Executes dropped EXE
  PID:4684
- C:\Windows\System\nKVGGgP.exe
  C:\Windows\System\nKVGGgP.exe
  2⤵
  - Executes dropped EXE
  PID:3852
- C:\Windows\System\rsDEJdH.exe
  C:\Windows\System\rsDEJdH.exe
  2⤵
  - Executes dropped EXE
  PID:1352
- C:\Windows\System\pmUFUkN.exe
  C:\Windows\System\pmUFUkN.exe
  2⤵
  - Executes dropped EXE
  PID:2684
- C:\Windows\System\SamqYGR.exe
  C:\Windows\System\SamqYGR.exe
  2⤵
  - Executes dropped EXE
  PID:1336
- C:\Windows\System\sZCVHse.exe
  C:\Windows\System\sZCVHse.exe
  2⤵
  - Executes dropped EXE
  PID:4316
- C:\Windows\System\EIRnBhW.exe
  C:\Windows\System\EIRnBhW.exe
  2⤵
  - Executes dropped EXE
  PID:4956
- C:\Windows\System\cBBCHmj.exe
  C:\Windows\System\cBBCHmj.exe
  2⤵
  - Executes dropped EXE
  PID:4848
- C:\Windows\System\uKEDVnC.exe
  C:\Windows\System\uKEDVnC.exe
  2⤵
  - Executes dropped EXE
  PID:3460
- C:\Windows\System\ASXMpRY.exe
  C:\Windows\System\ASXMpRY.exe
  2⤵
  - Executes dropped EXE
  PID:3324
- C:\Windows\System\rjdwQcI.exe
  C:\Windows\System\rjdwQcI.exe
  2⤵
  - Executes dropped EXE
  PID:2960
- C:\Windows\System\vDBqedn.exe
  C:\Windows\System\vDBqedn.exe
  2⤵
  PID:1736
- C:\Windows\System\DAWZJzf.exe
  C:\Windows\System\DAWZJzf.exe
  2⤵
  PID:548
- C:\Windows\System\bEVhXzL.exe
  C:\Windows\System\bEVhXzL.exe
  2⤵
  PID:1688
- C:\Windows\System\mHEDapJ.exe
  C:\Windows\System\mHEDapJ.exe
  2⤵
  PID:2360
- C:\Windows\System\rPHZSUG.exe
  C:\Windows\System\rPHZSUG.exe
  2⤵
  PID:4148
- C:\Windows\System\KfcnagG.exe
  C:\Windows\System\KfcnagG.exe
  2⤵
  PID:3992
- C:\Windows\System\uvmyOQA.exe
  C:\Windows\System\uvmyOQA.exe
  2⤵
  PID:5060
- C:\Windows\System\NPlEzPI.exe
  C:\Windows\System\NPlEzPI.exe
  2⤵
  PID:4868
- C:\Windows\System\nsAoecz.exe
  C:\Windows\System\nsAoecz.exe
  2⤵
  PID:3272
- C:\Windows\System\hdygoFR.exe
  C:\Windows\System\hdygoFR.exe
  2⤵
  PID:2708
- C:\Windows\System\XvLwveI.exe
  C:\Windows\System\XvLwveI.exe
  2⤵
  PID:4884
- C:\Windows\System\jdlOJOF.exe
  C:\Windows\System\jdlOJOF.exe
  2⤵
  PID:1852
- C:\Windows\System\KFGJKba.exe
  C:\Windows\System\KFGJKba.exe
  2⤵
  PID:4860
- C:\Windows\System\wRTEbgZ.exe
  C:\Windows\System\wRTEbgZ.exe
  2⤵
  PID:3368
- C:\Windows\System\VbcjJUz.exe
  C:\Windows\System\VbcjJUz.exe
  2⤵
  PID:2552
- C:\Windows\System\hjHkfys.exe
  C:\Windows\System\hjHkfys.exe
  2⤵
  PID:3136
- C:\Windows\System\HFXsOhR.exe
  C:\Windows\System\HFXsOhR.exe
  2⤵
  PID:2796
- C:\Windows\System\kvOcZkV.exe
  C:\Windows\System\kvOcZkV.exe
  2⤵
  PID:4508
- C:\Windows\System\yFRmaYG.exe
  C:\Windows\System\yFRmaYG.exe
  2⤵
  PID:852
- C:\Windows\System\RBEROFr.exe
  C:\Windows\System\RBEROFr.exe
  2⤵
  PID:1192
- C:\Windows\System\dUnuFeU.exe
  C:\Windows\System\dUnuFeU.exe
  2⤵
  PID:1360
- C:\Windows\System\aGrrWWL.exe
  C:\Windows\System\aGrrWWL.exe
  2⤵
  PID:1172
- C:\Windows\System\zLQpAvm.exe
  C:\Windows\System\zLQpAvm.exe
  2⤵
  PID:1964
- C:\Windows\System\mfLcRZI.exe
  C:\Windows\System\mfLcRZI.exe
  2⤵
  PID:5052
- C:\Windows\System\MQqesgB.exe
  C:\Windows\System\MQqesgB.exe
  2⤵
  PID:4080
- C:\Windows\System\XvJztWz.exe
  C:\Windows\System\XvJztWz.exe
  2⤵
  PID:2100
- C:\Windows\System\MVxvDuD.exe
  C:\Windows\System\MVxvDuD.exe
  2⤵
  PID:2348
- C:\Windows\System\caakzvV.exe
  C:\Windows\System\caakzvV.exe
  2⤵
  PID:1628
- C:\Windows\System\ylMbXmV.exe
  C:\Windows\System\ylMbXmV.exe
  2⤵
  PID:3112
- C:\Windows\System\MHOTvvH.exe
  C:\Windows\System\MHOTvvH.exe
  2⤵
  PID:400
- C:\Windows\System\yvJWKOl.exe
  C:\Windows\System\yvJWKOl.exe
  2⤵
  PID:3372
- C:\Windows\System\AzHbyuk.exe
  C:\Windows\System\AzHbyuk.exe
  2⤵
  PID:440
- C:\Windows\System\opcmFSQ.exe
  C:\Windows\System\opcmFSQ.exe
  2⤵
  PID:2884
- C:\Windows\System\gXueZsy.exe
  C:\Windows\System\gXueZsy.exe
  2⤵
  PID:2404
- C:\Windows\System\WnFGxcD.exe
  C:\Windows\System\WnFGxcD.exe
  2⤵
  PID:4464
- C:\Windows\System\KzSWayY.exe
  C:\Windows\System\KzSWayY.exe
  2⤵
  PID:3392
- C:\Windows\System\NDERYrj.exe
  C:\Windows\System\NDERYrj.exe
  2⤵
  PID:3152
- C:\Windows\System\efsSkEY.exe
  C:\Windows\System\efsSkEY.exe
  2⤵
  PID:2772
- C:\Windows\System\FtxiPot.exe
  C:\Windows\System\FtxiPot.exe
  2⤵
  PID:3332
- C:\Windows\System\IaItfrK.exe
  C:\Windows\System\IaItfrK.exe
  2⤵
  PID:4060
- C:\Windows\System\EgyMhwZ.exe
  C:\Windows\System\EgyMhwZ.exe
  2⤵
  PID:2876
- C:\Windows\System\RKnjPtu.exe
  C:\Windows\System\RKnjPtu.exe
  2⤵
  PID:1376
- C:\Windows\System\YXGusfM.exe
  C:\Windows\System\YXGusfM.exe
  2⤵
  PID:908
- C:\Windows\System\cvUJkLD.exe
  C:\Windows\System\cvUJkLD.exe
  2⤵
  PID:4572
- C:\Windows\System\KzyOwZU.exe
  C:\Windows\System\KzyOwZU.exe
  2⤵
  PID:1620
- C:\Windows\System\CSSiFnn.exe
  C:\Windows\System\CSSiFnn.exe
  2⤵
  PID:4040
- C:\Windows\System\LBTcjtV.exe
  C:\Windows\System\LBTcjtV.exe
  2⤵
  PID:4444
- C:\Windows\System\sTvYzOM.exe
  C:\Windows\System\sTvYzOM.exe
  2⤵
  PID:2644
- C:\Windows\System\niyIJZN.exe
  C:\Windows\System\niyIJZN.exe
  2⤵
  PID:4488
- C:\Windows\System\cgEEIcg.exe
  C:\Windows\System\cgEEIcg.exe
  2⤵
  PID:5144
- C:\Windows\System\IMhYoED.exe
  C:\Windows\System\IMhYoED.exe
  2⤵
  PID:5172
- C:\Windows\System\NZUBpSC.exe
  C:\Windows\System\NZUBpSC.exe
  2⤵
  PID:5196
- C:\Windows\System\Difmprk.exe
  C:\Windows\System\Difmprk.exe
  2⤵
  PID:5236
- C:\Windows\System\MOvpPRE.exe
  C:\Windows\System\MOvpPRE.exe
  2⤵
  PID:5256
- C:\Windows\System\fBOAebp.exe
  C:\Windows\System\fBOAebp.exe
  2⤵
  PID:5280
- C:\Windows\System\oyoJAjz.exe
  C:\Windows\System\oyoJAjz.exe
  2⤵
  PID:5312
- C:\Windows\System\VNlYOqi.exe
  C:\Windows\System\VNlYOqi.exe
  2⤵
  PID:5340
- C:\Windows\System\bzKxMjK.exe
  C:\Windows\System\bzKxMjK.exe
  2⤵
  PID:5368
- C:\Windows\System\ZeMMXzh.exe
  C:\Windows\System\ZeMMXzh.exe
  2⤵
  PID:5400
- C:\Windows\System\ULZAlFS.exe
  C:\Windows\System\ULZAlFS.exe
  2⤵
  PID:5424
- C:\Windows\System\uXLZwWw.exe
  C:\Windows\System\uXLZwWw.exe
  2⤵
  PID:5448
- C:\Windows\System\KpEVSqK.exe
  C:\Windows\System\KpEVSqK.exe
  2⤵
  PID:5492
- C:\Windows\System\uxpnDPR.exe
  C:\Windows\System\uxpnDPR.exe
  2⤵
  PID:5508
- C:\Windows\System\rXWqmIa.exe
  C:\Windows\System\rXWqmIa.exe
  2⤵
  PID:5536
- C:\Windows\System\cPpOEyz.exe
  C:\Windows\System\cPpOEyz.exe
  2⤵
  PID:5552
- C:\Windows\System\EMYbpXj.exe
  C:\Windows\System\EMYbpXj.exe
  2⤵
  PID:5580
- C:\Windows\System\vpvoeux.exe
  C:\Windows\System\vpvoeux.exe
  2⤵
  PID:5596
- C:\Windows\System\gniNxui.exe
  C:\Windows\System\gniNxui.exe
  2⤵
  PID:5636
- C:\Windows\System\pdJXqbK.exe
  C:\Windows\System\pdJXqbK.exe
  2⤵
  PID:5660
- C:\Windows\System\TfgfBbE.exe
  C:\Windows\System\TfgfBbE.exe
  2⤵
  PID:5692
- C:\Windows\System\BTJXiqQ.exe
  C:\Windows\System\BTJXiqQ.exe
  2⤵
  PID:5728
- C:\Windows\System\gTbthCV.exe
  C:\Windows\System\gTbthCV.exe
  2⤵
  PID:5748
- C:\Windows\System\aEStrVr.exe
  C:\Windows\System\aEStrVr.exe
  2⤵
  PID:5780
- C:\Windows\System\NkMxeAc.exe
  C:\Windows\System\NkMxeAc.exe
  2⤵
  PID:5808
- C:\Windows\System\zIDhHQO.exe
  C:\Windows\System\zIDhHQO.exe
  2⤵
  PID:5836
- C:\Windows\System\uFrxsib.exe
  C:\Windows\System\uFrxsib.exe
  2⤵
  PID:5868
- C:\Windows\System\SpRBmct.exe
  C:\Windows\System\SpRBmct.exe
  2⤵
  PID:5892
- C:\Windows\System\HFkprzQ.exe
  C:\Windows\System\HFkprzQ.exe
  2⤵
  PID:5920
- C:\Windows\System\EZqfaYi.exe
  C:\Windows\System\EZqfaYi.exe
  2⤵
  PID:5952
- C:\Windows\System\aQBmXdj.exe
  C:\Windows\System\aQBmXdj.exe
  2⤵
  PID:5988
- C:\Windows\System\XiKBNmE.exe
  C:\Windows\System\XiKBNmE.exe
  2⤵
  PID:6004
- C:\Windows\System\hzfQFfZ.exe
  C:\Windows\System\hzfQFfZ.exe
  2⤵
  PID:6028
- C:\Windows\System\bdlpIAZ.exe
  C:\Windows\System\bdlpIAZ.exe
  2⤵
  PID:6060
- C:\Windows\System\VgDWSoF.exe
  C:\Windows\System\VgDWSoF.exe
  2⤵
  PID:6100
- C:\Windows\System\RhbNlvz.exe
  C:\Windows\System\RhbNlvz.exe
  2⤵
  PID:6124
- C:\Windows\System\KhivhaR.exe
  C:\Windows\System\KhivhaR.exe
  2⤵
  PID:5128
- C:\Windows\System\HWqfsPu.exe
  C:\Windows\System\HWqfsPu.exe
  2⤵
  PID:5184
- C:\Windows\System\QMIPzjg.exe
  C:\Windows\System\QMIPzjg.exe
  2⤵
  PID:5248
- C:\Windows\System\kiIgKOt.exe
  C:\Windows\System\kiIgKOt.exe
  2⤵
  PID:5332
- C:\Windows\System\MocEtZb.exe
  C:\Windows\System\MocEtZb.exe
  2⤵
  PID:5412
- C:\Windows\System\VMxHkEJ.exe
  C:\Windows\System\VMxHkEJ.exe
  2⤵
  PID:5460
- C:\Windows\System\flWUXcL.exe
  C:\Windows\System\flWUXcL.exe
  2⤵
  PID:5528
- C:\Windows\System\yBydnWP.exe
  C:\Windows\System\yBydnWP.exe
  2⤵
  PID:5572
- C:\Windows\System\vKmFYPZ.exe
  C:\Windows\System\vKmFYPZ.exe
  2⤵
  PID:5616
- C:\Windows\System\FcfvOCf.exe
  C:\Windows\System\FcfvOCf.exe
  2⤵
  PID:5736
- C:\Windows\System\UIrSZHC.exe
  C:\Windows\System\UIrSZHC.exe
  2⤵
  PID:5792
- C:\Windows\System\aqvkClo.exe
  C:\Windows\System\aqvkClo.exe
  2⤵
  PID:5832
- C:\Windows\System\jpknYQP.exe
  C:\Windows\System\jpknYQP.exe
  2⤵
  PID:5908
- C:\Windows\System\jnPPjyh.exe
  C:\Windows\System\jnPPjyh.exe
  2⤵
  PID:5960
- C:\Windows\System\dovTqZl.exe
  C:\Windows\System\dovTqZl.exe
  2⤵
  PID:6040
- C:\Windows\System\WpARKwO.exe
  C:\Windows\System\WpARKwO.exe
  2⤵
  PID:6132
- C:\Windows\System\IxLTgez.exe
  C:\Windows\System\IxLTgez.exe
  2⤵
  PID:5224
- C:\Windows\System\XwNLuXr.exe
  C:\Windows\System\XwNLuXr.exe
  2⤵
  PID:5364
- C:\Windows\System\YdOxrJo.exe
  C:\Windows\System\YdOxrJo.exe
  2⤵
  PID:5500
- C:\Windows\System\mzdiWxc.exe
  C:\Windows\System\mzdiWxc.exe
  2⤵
  PID:5644
- C:\Windows\System\gnUdyiN.exe
  C:\Windows\System\gnUdyiN.exe
  2⤵
  PID:5768
- C:\Windows\System\cAgoYex.exe
  C:\Windows\System\cAgoYex.exe
  2⤵
  PID:5972
- C:\Windows\System\xrWkWLE.exe
  C:\Windows\System\xrWkWLE.exe
  2⤵
  PID:6140
- C:\Windows\System\QmepDtQ.exe
  C:\Windows\System\QmepDtQ.exe
  2⤵
  PID:5288
- C:\Windows\System\LuEPFaT.exe
  C:\Windows\System\LuEPFaT.exe
  2⤵
  PID:5712
- C:\Windows\System\vFRjxAT.exe
  C:\Windows\System\vFRjxAT.exe
  2⤵
  PID:6024
- C:\Windows\System\cpHDQLi.exe
  C:\Windows\System\cpHDQLi.exe
  2⤵
  PID:5476
- C:\Windows\System\TRlatFM.exe
  C:\Windows\System\TRlatFM.exe
  2⤵
  PID:6164
- C:\Windows\System\HragbqO.exe
  C:\Windows\System\HragbqO.exe
  2⤵
  PID:6192
- C:\Windows\System\QTgickn.exe
  C:\Windows\System\QTgickn.exe
  2⤵
  PID:6220
- C:\Windows\System\CWFzjzY.exe
  C:\Windows\System\CWFzjzY.exe
  2⤵
  PID:6260
- C:\Windows\System\LUajVeJ.exe
  C:\Windows\System\LUajVeJ.exe
  2⤵
  PID:6288
- C:\Windows\System\NGtjwoq.exe
  C:\Windows\System\NGtjwoq.exe
  2⤵
  PID:6316
- C:\Windows\System\JENGqTL.exe
  C:\Windows\System\JENGqTL.exe
  2⤵
  PID:6348
- C:\Windows\System\cpqEBck.exe
  C:\Windows\System\cpqEBck.exe
  2⤵
  PID:6372
- C:\Windows\System\vPYPkkx.exe
  C:\Windows\System\vPYPkkx.exe
  2⤵
  PID:6404
- C:\Windows\System\owfzZIB.exe
  C:\Windows\System\owfzZIB.exe
  2⤵
  PID:6428
- C:\Windows\System\hRGONWC.exe
  C:\Windows\System\hRGONWC.exe
  2⤵
  PID:6448
- C:\Windows\System\CxHRQvb.exe
  C:\Windows\System\CxHRQvb.exe
  2⤵
  PID:6472
- C:\Windows\System\UxdqLmA.exe
  C:\Windows\System\UxdqLmA.exe
  2⤵
  PID:6508
- C:\Windows\System\QQeOLye.exe
  C:\Windows\System\QQeOLye.exe
  2⤵
  PID:6528
- C:\Windows\System\erKSpyj.exe
  C:\Windows\System\erKSpyj.exe
  2⤵
  PID:6544
- C:\Windows\System\vMxKvLT.exe
  C:\Windows\System\vMxKvLT.exe
  2⤵
  PID:6572
- C:\Windows\System\SBMeuIL.exe
  C:\Windows\System\SBMeuIL.exe
  2⤵
  PID:6612
- C:\Windows\System\VtGzKvK.exe
  C:\Windows\System\VtGzKvK.exe
  2⤵
  PID:6628
- C:\Windows\System\OsqkPYJ.exe
  C:\Windows\System\OsqkPYJ.exe
  2⤵
  PID:6644
- C:\Windows\System\FKWjXTr.exe
  C:\Windows\System\FKWjXTr.exe
  2⤵
  PID:6668
- C:\Windows\System\lbwTEeU.exe
  C:\Windows\System\lbwTEeU.exe
  2⤵
  PID:6704
- C:\Windows\System\OvjXvMk.exe
  C:\Windows\System\OvjXvMk.exe
  2⤵
  PID:6728
- C:\Windows\System\eCyUBlM.exe
  C:\Windows\System\eCyUBlM.exe
  2⤵
  PID:6752
- C:\Windows\System\ukSpAck.exe
  C:\Windows\System\ukSpAck.exe
  2⤵
  PID:6776
- C:\Windows\System\GoHfczn.exe
  C:\Windows\System\GoHfczn.exe
  2⤵
  PID:6808
- C:\Windows\System\MZjAfTJ.exe
  C:\Windows\System\MZjAfTJ.exe
  2⤵
  PID:6844
- C:\Windows\System\uyvkQdi.exe
  C:\Windows\System\uyvkQdi.exe
  2⤵
  PID:6884
- C:\Windows\System\SYOtOzy.exe
  C:\Windows\System\SYOtOzy.exe
  2⤵
  PID:6908
- C:\Windows\System\eaVHLRa.exe
  C:\Windows\System\eaVHLRa.exe
  2⤵
  PID:6936
- C:\Windows\System\jpntnGO.exe
  C:\Windows\System\jpntnGO.exe
  2⤵
  PID:6972
- C:\Windows\System\BHIYlZF.exe
  C:\Windows\System\BHIYlZF.exe
  2⤵
  PID:6996
- C:\Windows\System\ziUupwF.exe
  C:\Windows\System\ziUupwF.exe
  2⤵
  PID:7032
- C:\Windows\System\EzrlncQ.exe
  C:\Windows\System\EzrlncQ.exe
  2⤵
  PID:7060
- C:\Windows\System\KEEnzpg.exe
  C:\Windows\System\KEEnzpg.exe
  2⤵
  PID:7080
- C:\Windows\System\NKwujXr.exe
  C:\Windows\System\NKwujXr.exe
  2⤵
  PID:7112
- C:\Windows\System\jvcmOkP.exe
  C:\Windows\System\jvcmOkP.exe
  2⤵
  PID:7144
- C:\Windows\System\lzofyws.exe
  C:\Windows\System\lzofyws.exe
  2⤵
  PID:7160
- C:\Windows\System\cejjzLw.exe
  C:\Windows\System\cejjzLw.exe
  2⤵
  PID:6208
- C:\Windows\System\HgjtUPP.exe
  C:\Windows\System\HgjtUPP.exe
  2⤵
  PID:6248
- C:\Windows\System\KVyJbTP.exe
  C:\Windows\System\KVyJbTP.exe
  2⤵
  PID:6312
- C:\Windows\System\IIxDkNS.exe
  C:\Windows\System\IIxDkNS.exe
  2⤵
  PID:6360
- C:\Windows\System\FmvCfEp.exe
  C:\Windows\System\FmvCfEp.exe
  2⤵
  PID:6444
- C:\Windows\System\tXeSzAS.exe
  C:\Windows\System\tXeSzAS.exe
  2⤵
  PID:6500
- C:\Windows\System\kfyJeqO.exe
  C:\Windows\System\kfyJeqO.exe
  2⤵
  PID:6596
- C:\Windows\System\OKNWhBA.exe
  C:\Windows\System\OKNWhBA.exe
  2⤵
  PID:6620
- C:\Windows\System\zwWSVAI.exe
  C:\Windows\System\zwWSVAI.exe
  2⤵
  PID:6768
- C:\Windows\System\hbyAyYZ.exe
  C:\Windows\System\hbyAyYZ.exe
  2⤵
  PID:6744
- C:\Windows\System\rGsbmwa.exe
  C:\Windows\System\rGsbmwa.exe
  2⤵
  PID:6868
- C:\Windows\System\wCyneCE.exe
  C:\Windows\System\wCyneCE.exe
  2⤵
  PID:6956
- C:\Windows\System\xlrSoDo.exe
  C:\Windows\System\xlrSoDo.exe
  2⤵
  PID:6984
- C:\Windows\System\wkyHCMD.exe
  C:\Windows\System\wkyHCMD.exe
  2⤵
  PID:7020
- C:\Windows\System\Cxzjqtq.exe
  C:\Windows\System\Cxzjqtq.exe
  2⤵
  PID:7068
- C:\Windows\System\qANGopo.exe
  C:\Windows\System\qANGopo.exe
  2⤵
  PID:6180
- C:\Windows\System\vqNpkhD.exe
  C:\Windows\System\vqNpkhD.exe
  2⤵
  PID:6388
- C:\Windows\System\ufjUBTC.exe
  C:\Windows\System\ufjUBTC.exe
  2⤵
  PID:6560
- C:\Windows\System\MsRcNzl.exe
  C:\Windows\System\MsRcNzl.exe
  2⤵
  PID:6564
- C:\Windows\System\pmMAacK.exe
  C:\Windows\System\pmMAacK.exe
  2⤵
  PID:6640
- C:\Windows\System\Mshlfiq.exe
  C:\Windows\System\Mshlfiq.exe
  2⤵
  PID:6932
- C:\Windows\System\HzTUaYs.exe
  C:\Windows\System\HzTUaYs.exe
  2⤵
  PID:7016
- C:\Windows\System\gCvMIBR.exe
  C:\Windows\System\gCvMIBR.exe
  2⤵
  PID:6276
- C:\Windows\System\ytKCLhr.exe
  C:\Windows\System\ytKCLhr.exe
  2⤵
  PID:6656
- C:\Windows\System\WhBXBao.exe
  C:\Windows\System\WhBXBao.exe
  2⤵
  PID:7136
- C:\Windows\System\sgqePUy.exe
  C:\Windows\System\sgqePUy.exe
  2⤵
  PID:6832
- C:\Windows\System\lMcoCXH.exe
  C:\Windows\System\lMcoCXH.exe
  2⤵
  PID:7176
- C:\Windows\System\pLpotGc.exe
  C:\Windows\System\pLpotGc.exe
  2⤵
  PID:7196
- C:\Windows\System\CvgNUoW.exe
  C:\Windows\System\CvgNUoW.exe
  2⤵
  PID:7228
- C:\Windows\System\zOlGeKi.exe
  C:\Windows\System\zOlGeKi.exe
  2⤵
  PID:7248
- C:\Windows\System\Yfauhqa.exe
  C:\Windows\System\Yfauhqa.exe
  2⤵
  PID:7276
- C:\Windows\System\aGZSPwC.exe
  C:\Windows\System\aGZSPwC.exe
  2⤵
  PID:7316
- C:\Windows\System\YdpAAbR.exe
  C:\Windows\System\YdpAAbR.exe
  2⤵
  PID:7332
- C:\Windows\System\lhXxWsq.exe
  C:\Windows\System\lhXxWsq.exe
  2⤵
  PID:7360
- C:\Windows\System\IYUJnBY.exe
  C:\Windows\System\IYUJnBY.exe
  2⤵
  PID:7388
- C:\Windows\System\nZuueoU.exe
  C:\Windows\System\nZuueoU.exe
  2⤵
  PID:7416
- C:\Windows\System\ojQyDMH.exe
  C:\Windows\System\ojQyDMH.exe
  2⤵
  PID:7444
- C:\Windows\System\ZFtFBJC.exe
  C:\Windows\System\ZFtFBJC.exe
  2⤵
  PID:7480
- C:\Windows\System\hLIePKI.exe
  C:\Windows\System\hLIePKI.exe
  2⤵
  PID:7512
- C:\Windows\System\ZRoVUQS.exe
  C:\Windows\System\ZRoVUQS.exe
  2⤵
  PID:7540
- C:\Windows\System\fxqYYUv.exe
  C:\Windows\System\fxqYYUv.exe
  2⤵
  PID:7568
- C:\Windows\System\vwpZyaV.exe
  C:\Windows\System\vwpZyaV.exe
  2⤵
  PID:7600
- C:\Windows\System\mOEdsxG.exe
  C:\Windows\System\mOEdsxG.exe
  2⤵
  PID:7628
- C:\Windows\System\lHxCAfQ.exe
  C:\Windows\System\lHxCAfQ.exe
  2⤵
  PID:7652
- C:\Windows\System\BnpmRBw.exe
  C:\Windows\System\BnpmRBw.exe
  2⤵
  PID:7668
- C:\Windows\System\FjNPNqv.exe
  C:\Windows\System\FjNPNqv.exe
  2⤵
  PID:7700
- C:\Windows\System\KAhiwuA.exe
  C:\Windows\System\KAhiwuA.exe
  2⤵
  PID:7732
- C:\Windows\System\xzoBbIN.exe
  C:\Windows\System\xzoBbIN.exe
  2⤵
  PID:7752
- C:\Windows\System\OekXtOo.exe
  C:\Windows\System\OekXtOo.exe
  2⤵
  PID:7776
- C:\Windows\System\MkaJPmV.exe
  C:\Windows\System\MkaJPmV.exe
  2⤵
  PID:7800
- C:\Windows\System\YyFGkeq.exe
  C:\Windows\System\YyFGkeq.exe
  2⤵
  PID:7832
- C:\Windows\System\EeDdBSV.exe
  C:\Windows\System\EeDdBSV.exe
  2⤵
  PID:7864
- C:\Windows\System\DXiBhFq.exe
  C:\Windows\System\DXiBhFq.exe
  2⤵
  PID:7912
- C:\Windows\System\axgdfFN.exe
  C:\Windows\System\axgdfFN.exe
  2⤵
  PID:7936
- C:\Windows\System\UrBJYVZ.exe
  C:\Windows\System\UrBJYVZ.exe
  2⤵
  PID:7960
- C:\Windows\System\twBKGwW.exe
  C:\Windows\System\twBKGwW.exe
  2⤵
  PID:7988
- C:\Windows\System\sTqaLvq.exe
  C:\Windows\System\sTqaLvq.exe
  2⤵
  PID:8016
- C:\Windows\System\wcrFNfY.exe
  C:\Windows\System\wcrFNfY.exe
  2⤵
  PID:8032
- C:\Windows\System\DSHQEqh.exe
  C:\Windows\System\DSHQEqh.exe
  2⤵
  PID:8072
- C:\Windows\System\bKPxwcw.exe
  C:\Windows\System\bKPxwcw.exe
  2⤵
  PID:8096
- C:\Windows\System\GDXHKLt.exe
  C:\Windows\System\GDXHKLt.exe
  2⤵
  PID:8124
- C:\Windows\System\VkddQRD.exe
  C:\Windows\System\VkddQRD.exe
  2⤵
  PID:8144
- C:\Windows\System\qhjDxxJ.exe
  C:\Windows\System\qhjDxxJ.exe
  2⤵
  PID:8184
- C:\Windows\System\EOFPVrD.exe
  C:\Windows\System\EOFPVrD.exe
  2⤵
  PID:6788
- C:\Windows\System\QzbHJlb.exe
  C:\Windows\System\QzbHJlb.exe
  2⤵
  PID:7212
- C:\Windows\System\WNaoYdg.exe
  C:\Windows\System\WNaoYdg.exe
  2⤵
  PID:7288
- C:\Windows\System\MrUxMDd.exe
  C:\Windows\System\MrUxMDd.exe
  2⤵
  PID:7344
- C:\Windows\System\fBsWpVP.exe
  C:\Windows\System\fBsWpVP.exe
  2⤵
  PID:7400
- C:\Windows\System\VqmvipG.exe
  C:\Windows\System\VqmvipG.exe
  2⤵
  PID:7524
- C:\Windows\System\BPfjrQx.exe
  C:\Windows\System\BPfjrQx.exe
  2⤵
  PID:7584
- C:\Windows\System\KsEOsqt.exe
  C:\Windows\System\KsEOsqt.exe
  2⤵
  PID:7680
- C:\Windows\System\aNYEUro.exe
  C:\Windows\System\aNYEUro.exe
  2⤵
  PID:7724
- C:\Windows\System\JGowVWg.exe
  C:\Windows\System\JGowVWg.exe
  2⤵
  PID:7744
- C:\Windows\System\DSVFxHz.exe
  C:\Windows\System\DSVFxHz.exe
  2⤵
  PID:7844
- C:\Windows\System\OIxbpfZ.exe
  C:\Windows\System\OIxbpfZ.exe
  2⤵
  PID:7900
- C:\Windows\System\ZNSJRMG.exe
  C:\Windows\System\ZNSJRMG.exe
  2⤵
  PID:7984
- C:\Windows\System\wVaDmhT.exe
  C:\Windows\System\wVaDmhT.exe
  2⤵
  PID:8000
- C:\Windows\System\NqyxzFa.exe
  C:\Windows\System\NqyxzFa.exe
  2⤵
  PID:8088
- C:\Windows\System\txtsiew.exe
  C:\Windows\System\txtsiew.exe
  2⤵
  PID:8112
- C:\Windows\System\OwTphsM.exe
  C:\Windows\System\OwTphsM.exe
  2⤵
  PID:7184
- C:\Windows\System\QCdbgyn.exe
  C:\Windows\System\QCdbgyn.exe
  2⤵
  PID:7304
- C:\Windows\System\PpBtkgu.exe
  C:\Windows\System\PpBtkgu.exe
  2⤵
  PID:7532
- C:\Windows\System\IZNIdIE.exe
  C:\Windows\System\IZNIdIE.exe
  2⤵
  PID:7716
- C:\Windows\System\CEEefcS.exe
  C:\Windows\System\CEEefcS.exe
  2⤵
  PID:7824
- C:\Windows\System\jfzYaOW.exe
  C:\Windows\System\jfzYaOW.exe
  2⤵
  PID:7956
- C:\Windows\System\OiHeeaC.exe
  C:\Windows\System\OiHeeaC.exe
  2⤵
  PID:8024
- C:\Windows\System\hAfIerW.exe
  C:\Windows\System\hAfIerW.exe
  2⤵
  PID:7172
- C:\Windows\System\XGKFpUA.exe
  C:\Windows\System\XGKFpUA.exe
  2⤵
  PID:7468
- C:\Windows\System\ynZQMYi.exe
  C:\Windows\System\ynZQMYi.exe
  2⤵
  PID:7976
- C:\Windows\System\cLdNwRe.exe
  C:\Windows\System\cLdNwRe.exe
  2⤵
  PID:7496
- C:\Windows\System\wEhXOHu.exe
  C:\Windows\System\wEhXOHu.exe
  2⤵
  PID:8212
- C:\Windows\System\xwVPdks.exe
  C:\Windows\System\xwVPdks.exe
  2⤵
  PID:8240
- C:\Windows\System\YYyhKRp.exe
  C:\Windows\System\YYyhKRp.exe
  2⤵
  PID:8272
- C:\Windows\System\pXVsucE.exe
  C:\Windows\System\pXVsucE.exe
  2⤵
  PID:8312
- C:\Windows\System\EqMNbBF.exe
  C:\Windows\System\EqMNbBF.exe
  2⤵
  PID:8328
- C:\Windows\System\NuxHXRt.exe
  C:\Windows\System\NuxHXRt.exe
  2⤵
  PID:8368
- C:\Windows\System\cbgmbwt.exe
  C:\Windows\System\cbgmbwt.exe
  2⤵
  PID:8384
- C:\Windows\System\WiIHKHO.exe
  C:\Windows\System\WiIHKHO.exe
  2⤵
  PID:8420
- C:\Windows\System\ndLsvsf.exe
  C:\Windows\System\ndLsvsf.exe
  2⤵
  PID:8440
- C:\Windows\System\guqZLxM.exe
  C:\Windows\System\guqZLxM.exe
  2⤵
  PID:8472
- C:\Windows\System\gfCwDPr.exe
  C:\Windows\System\gfCwDPr.exe
  2⤵
  PID:8508
- C:\Windows\System\FqAbOuR.exe
  C:\Windows\System\FqAbOuR.exe
  2⤵
  PID:8524
- C:\Windows\System\akPbyGG.exe
  C:\Windows\System\akPbyGG.exe
  2⤵
  PID:8560
- C:\Windows\System\rWEfOOr.exe
  C:\Windows\System\rWEfOOr.exe
  2⤵
  PID:8580
- C:\Windows\System\wGJmkSp.exe
  C:\Windows\System\wGJmkSp.exe
  2⤵
  PID:8608
- C:\Windows\System\GwzgPrc.exe
  C:\Windows\System\GwzgPrc.exe
  2⤵
  PID:8624
- C:\Windows\System\JBnKkyV.exe
  C:\Windows\System\JBnKkyV.exe
  2⤵
  PID:8640
- C:\Windows\System\PQtfhUN.exe
  C:\Windows\System\PQtfhUN.exe
  2⤵
  PID:8668
- C:\Windows\System\dnlumvp.exe
  C:\Windows\System\dnlumvp.exe
  2⤵
  PID:8700
- C:\Windows\System\ggFIxao.exe
  C:\Windows\System\ggFIxao.exe
  2⤵
  PID:8740
- C:\Windows\System\KerNuCi.exe
  C:\Windows\System\KerNuCi.exe
  2⤵
  PID:8764
- C:\Windows\System\NwkicFV.exe
  C:\Windows\System\NwkicFV.exe
  2⤵
  PID:8808
- C:\Windows\System\EUQPGhQ.exe
  C:\Windows\System\EUQPGhQ.exe
  2⤵
  PID:8832
- C:\Windows\System\TdwLysb.exe
  C:\Windows\System\TdwLysb.exe
  2⤵
  PID:8856
- C:\Windows\System\BhdabKH.exe
  C:\Windows\System\BhdabKH.exe
  2⤵
  PID:8888
- C:\Windows\System\ofNHxWi.exe
  C:\Windows\System\ofNHxWi.exe
  2⤵
  PID:8916
- C:\Windows\System\SSetYCd.exe
  C:\Windows\System\SSetYCd.exe
  2⤵
  PID:8944
- C:\Windows\System\IOmQTUq.exe
  C:\Windows\System\IOmQTUq.exe
  2⤵
  PID:8980
- C:\Windows\System\roGhpEx.exe
  C:\Windows\System\roGhpEx.exe
  2⤵
  PID:9000
- C:\Windows\System\sHuEDPh.exe
  C:\Windows\System\sHuEDPh.exe
  2⤵
  PID:9028
- C:\Windows\System\slqjSFC.exe
  C:\Windows\System\slqjSFC.exe
  2⤵
  PID:9060
- C:\Windows\System\AciGIzk.exe
  C:\Windows\System\AciGIzk.exe
  2⤵
  PID:9088
- C:\Windows\System\miHUFvj.exe
  C:\Windows\System\miHUFvj.exe
  2⤵
  PID:9112
- C:\Windows\System\wtSBGcE.exe
  C:\Windows\System\wtSBGcE.exe
  2⤵
  PID:9136
- C:\Windows\System\iWSyfzB.exe
  C:\Windows\System\iWSyfzB.exe
  2⤵
  PID:9168
- C:\Windows\System\qziHOnm.exe
  C:\Windows\System\qziHOnm.exe
  2⤵
  PID:9192
- C:\Windows\System\TONMlft.exe
  C:\Windows\System\TONMlft.exe
  2⤵
  PID:7296
- C:\Windows\System\Xysluii.exe
  C:\Windows\System\Xysluii.exe
  2⤵
  PID:8204
- C:\Windows\System\xqljCon.exe
  C:\Windows\System\xqljCon.exe
  2⤵
  PID:8296
- C:\Windows\System\exsifgC.exe
  C:\Windows\System\exsifgC.exe
  2⤵
  PID:8352
- C:\Windows\System\JPHwLrB.exe
  C:\Windows\System\JPHwLrB.exe
  2⤵
  PID:8432
- C:\Windows\System\PuWaiDt.exe
  C:\Windows\System\PuWaiDt.exe
  2⤵
  PID:8464
- C:\Windows\System\YCSCHaa.exe
  C:\Windows\System\YCSCHaa.exe
  2⤵
  PID:8572
- C:\Windows\System\hNZiNPL.exe
  C:\Windows\System\hNZiNPL.exe
  2⤵
  PID:8632
- C:\Windows\System\uZdzrmh.exe
  C:\Windows\System\uZdzrmh.exe
  2⤵
  PID:8720
- C:\Windows\System\lMcxxFC.exe
  C:\Windows\System\lMcxxFC.exe
  2⤵
  PID:8776
- C:\Windows\System\JmsylFY.exe
  C:\Windows\System\JmsylFY.exe
  2⤵
  PID:8868
- C:\Windows\System\HoWGwyL.exe
  C:\Windows\System\HoWGwyL.exe
  2⤵
  PID:8848
- C:\Windows\System\hgrJBeG.exe
  C:\Windows\System\hgrJBeG.exe
  2⤵
  PID:8964
- C:\Windows\System\XDWbAnP.exe
  C:\Windows\System\XDWbAnP.exe
  2⤵
  PID:9020
- C:\Windows\System\anGadbh.exe
  C:\Windows\System\anGadbh.exe
  2⤵
  PID:9048
- C:\Windows\System\RCGRatV.exe
  C:\Windows\System\RCGRatV.exe
  2⤵
  PID:9132
- C:\Windows\System\hLilNFy.exe
  C:\Windows\System\hLilNFy.exe
  2⤵
  PID:9212
- C:\Windows\System\aKVHXDX.exe
  C:\Windows\System\aKVHXDX.exe
  2⤵
  PID:8208
- C:\Windows\System\PyMtPbo.exe
  C:\Windows\System\PyMtPbo.exe
  2⤵
  PID:8380
- C:\Windows\System\tCEPOeC.exe
  C:\Windows\System\tCEPOeC.exe
  2⤵
  PID:8536
- C:\Windows\System\TPRDukK.exe
  C:\Windows\System\TPRDukK.exe
  2⤵
  PID:8712
- C:\Windows\System\FNYALEy.exe
  C:\Windows\System\FNYALEy.exe
  2⤵
  PID:8756
- C:\Windows\System\NelsnMo.exe
  C:\Windows\System\NelsnMo.exe
  2⤵
  PID:9012
- C:\Windows\System\lDbTbKH.exe
  C:\Windows\System\lDbTbKH.exe
  2⤵
  PID:9160
- C:\Windows\System\nBewPfB.exe
  C:\Windows\System\nBewPfB.exe
  2⤵
  PID:9148
- C:\Windows\System\MYjWoXQ.exe
  C:\Windows\System\MYjWoXQ.exe
  2⤵
  PID:8820
- C:\Windows\System\UEHVPCo.exe
  C:\Windows\System\UEHVPCo.exe
  2⤵
  PID:8840
- C:\Windows\System\dQrdNXq.exe
  C:\Windows\System\dQrdNXq.exe
  2⤵
  PID:9228
- C:\Windows\System\gxLooRA.exe
  C:\Windows\System\gxLooRA.exe
  2⤵
  PID:9248
- C:\Windows\System\TEjpkzB.exe
  C:\Windows\System\TEjpkzB.exe
  2⤵
  PID:9272
- C:\Windows\System\OaNjKRK.exe
  C:\Windows\System\OaNjKRK.exe
  2⤵
  PID:9292
- C:\Windows\System\XEjJbpA.exe
  C:\Windows\System\XEjJbpA.exe
  2⤵
  PID:9320
- C:\Windows\System\iJKUDep.exe
  C:\Windows\System\iJKUDep.exe
  2⤵
  PID:9348
- C:\Windows\System\kuFGsCS.exe
  C:\Windows\System\kuFGsCS.exe
  2⤵
  PID:9384
- C:\Windows\System\KcikCeV.exe
  C:\Windows\System\KcikCeV.exe
  2⤵
  PID:9420
- C:\Windows\System\VmzpdaK.exe
  C:\Windows\System\VmzpdaK.exe
  2⤵
  PID:9452
- C:\Windows\System\yvOhpfR.exe
  C:\Windows\System\yvOhpfR.exe
  2⤵
  PID:9476
- C:\Windows\System\XyyMQHU.exe
  C:\Windows\System\XyyMQHU.exe
  2⤵
  PID:9508
- C:\Windows\System\zgscBxO.exe
  C:\Windows\System\zgscBxO.exe
  2⤵
  PID:9536
- C:\Windows\System\JgNfQaq.exe
  C:\Windows\System\JgNfQaq.exe
  2⤵
  PID:9556
- C:\Windows\System\lbJcMjE.exe
  C:\Windows\System\lbJcMjE.exe
  2⤵
  PID:9580
- C:\Windows\System\vkoOuzj.exe
  C:\Windows\System\vkoOuzj.exe
  2⤵
  PID:9608
- C:\Windows\System\bSnnMyg.exe
  C:\Windows\System\bSnnMyg.exe
  2⤵
  PID:9632
- C:\Windows\System\msLrglr.exe
  C:\Windows\System\msLrglr.exe
  2⤵
  PID:9660
- C:\Windows\System\bWoMxih.exe
  C:\Windows\System\bWoMxih.exe
  2⤵
  PID:9692
- C:\Windows\System\RMUDypk.exe
  C:\Windows\System\RMUDypk.exe
  2⤵
  PID:9724
- C:\Windows\System\BnxoAkk.exe
  C:\Windows\System\BnxoAkk.exe
  2⤵
  PID:9756
- C:\Windows\System\GutDneg.exe
  C:\Windows\System\GutDneg.exe
  2⤵
  PID:9780
- C:\Windows\System\vOHgXPd.exe
  C:\Windows\System\vOHgXPd.exe
  2⤵
  PID:9812
- C:\Windows\System\lGccrtP.exe
  C:\Windows\System\lGccrtP.exe
  2⤵
  PID:9852
- C:\Windows\System\UlTnDZm.exe
  C:\Windows\System\UlTnDZm.exe
  2⤵
  PID:9872
- C:\Windows\System\lKZoYqu.exe
  C:\Windows\System\lKZoYqu.exe
  2⤵
  PID:9896
- C:\Windows\System\CyWEjtS.exe
  C:\Windows\System\CyWEjtS.exe
  2⤵
  PID:9916
- C:\Windows\System\FwSiMHF.exe
  C:\Windows\System\FwSiMHF.exe
  2⤵
  PID:9940
- C:\Windows\System\UbzqRtr.exe
  C:\Windows\System\UbzqRtr.exe
  2⤵
  PID:9964
- C:\Windows\System\DPECaGO.exe
  C:\Windows\System\DPECaGO.exe
  2⤵
  PID:9984
- C:\Windows\System\MRqNvtR.exe
  C:\Windows\System\MRqNvtR.exe
  2⤵
  PID:10020
- C:\Windows\System\zkfIdIC.exe
  C:\Windows\System\zkfIdIC.exe
  2⤵
  PID:10040
- C:\Windows\System\JxmfpoK.exe
  C:\Windows\System\JxmfpoK.exe
  2⤵
  PID:10068
- C:\Windows\System\iznAqMx.exe
  C:\Windows\System\iznAqMx.exe
  2⤵
  PID:10092
- C:\Windows\System\JcvHDbd.exe
  C:\Windows\System\JcvHDbd.exe
  2⤵
  PID:10116
- C:\Windows\System\qSjyTmi.exe
  C:\Windows\System\qSjyTmi.exe
  2⤵
  PID:10148
- C:\Windows\System\erpfyPs.exe
  C:\Windows\System\erpfyPs.exe
  2⤵
  PID:10168
- C:\Windows\System\WLguarv.exe
  C:\Windows\System\WLguarv.exe
  2⤵
  PID:10196
- C:\Windows\System\ZySRbWl.exe
  C:\Windows\System\ZySRbWl.exe
  2⤵
  PID:9176
- C:\Windows\System\hvixAIP.exe
  C:\Windows\System\hvixAIP.exe
  2⤵
  PID:9220
- C:\Windows\System\ElmLXAz.exe
  C:\Windows\System\ElmLXAz.exe
  2⤵
  PID:9288
- C:\Windows\System\AMJhSkp.exe
  C:\Windows\System\AMJhSkp.exe
  2⤵
  PID:9316
- C:\Windows\System\iHXEjRs.exe
  C:\Windows\System\iHXEjRs.exe
  2⤵
  PID:9364
- C:\Windows\System\NJypjlc.exe
  C:\Windows\System\NJypjlc.exe
  2⤵
  PID:9468
- C:\Windows\System\UMDTilU.exe
  C:\Windows\System\UMDTilU.exe
  2⤵
  PID:9548
- C:\Windows\System\wsHDApc.exe
  C:\Windows\System\wsHDApc.exe
  2⤵
  PID:9524
- C:\Windows\System\nAYUVcG.exe
  C:\Windows\System\nAYUVcG.exe
  2⤵
  PID:9672
- C:\Windows\System\HJZjshj.exe
  C:\Windows\System\HJZjshj.exe
  2⤵
  PID:9700
- C:\Windows\System\CZzHlBt.exe
  C:\Windows\System\CZzHlBt.exe
  2⤵
  PID:9808
- C:\Windows\System\sBiLXLW.exe
  C:\Windows\System\sBiLXLW.exe
  2⤵
  PID:9864
- C:\Windows\System\XRtxzwW.exe
  C:\Windows\System\XRtxzwW.exe
  2⤵
  PID:9904
- C:\Windows\System\jxgyrLO.exe
  C:\Windows\System\jxgyrLO.exe
  2⤵
  PID:9980
- C:\Windows\System\HefAyzV.exe
  C:\Windows\System\HefAyzV.exe
  2⤵
  PID:10012
- C:\Windows\System\pSPTTMi.exe
  C:\Windows\System\pSPTTMi.exe
  2⤵
  PID:10080
- C:\Windows\System\LxOeDkt.exe
  C:\Windows\System\LxOeDkt.exe
  2⤵
  PID:10124
- C:\Windows\System\hskmCcF.exe
  C:\Windows\System\hskmCcF.exe
  2⤵
  PID:10216
- C:\Windows\System\zQWLOym.exe
  C:\Windows\System\zQWLOym.exe
  2⤵
  PID:9336
- C:\Windows\System\auToHxm.exe
  C:\Windows\System\auToHxm.exe
  2⤵
  PID:9436
- C:\Windows\System\CKyYdDC.exe
  C:\Windows\System\CKyYdDC.exe
  2⤵
  PID:9360
- C:\Windows\System\JZGPGur.exe
  C:\Windows\System\JZGPGur.exe
  2⤵
  PID:9620
- C:\Windows\System\cbIGJmd.exe
  C:\Windows\System\cbIGJmd.exe
  2⤵
  PID:9860
- C:\Windows\System\HVzJqmm.exe
  C:\Windows\System\HVzJqmm.exe
  2⤵
  PID:10208
- C:\Windows\System\rVjowMf.exe
  C:\Windows\System\rVjowMf.exe
  2⤵
  PID:10160
- C:\Windows\System\NPVhpEH.exe
  C:\Windows\System\NPVhpEH.exe
  2⤵
  PID:10088
- C:\Windows\System\sMIaWWj.exe
  C:\Windows\System\sMIaWWj.exe
  2⤵
  PID:10192
- C:\Windows\System\vhDMJSv.exe
  C:\Windows\System\vhDMJSv.exe
  2⤵
  PID:10268
- C:\Windows\System\PnWQnLR.exe
  C:\Windows\System\PnWQnLR.exe
  2⤵
  PID:10288
- C:\Windows\System\OzLoPrT.exe
  C:\Windows\System\OzLoPrT.exe
  2⤵
  PID:10312
- C:\Windows\System\LlRXbQS.exe
  C:\Windows\System\LlRXbQS.exe
  2⤵
  PID:10344
- C:\Windows\System\FXtbqZn.exe
  C:\Windows\System\FXtbqZn.exe
  2⤵
  PID:10360
- C:\Windows\System\hDibwMF.exe
  C:\Windows\System\hDibwMF.exe
  2⤵
  PID:10384
- C:\Windows\System\CsHjHRC.exe
  C:\Windows\System\CsHjHRC.exe
  2⤵
  PID:10416
- C:\Windows\System\iRSXdcm.exe
  C:\Windows\System\iRSXdcm.exe
  2⤵
  PID:10436
- C:\Windows\System\GkFkrmX.exe
  C:\Windows\System\GkFkrmX.exe
  2⤵
  PID:10456
- C:\Windows\System\lmSZcdN.exe
  C:\Windows\System\lmSZcdN.exe
  2⤵
  PID:10476
- C:\Windows\System\AYnEEGt.exe
  C:\Windows\System\AYnEEGt.exe
  2⤵
  PID:10512
- C:\Windows\System\SCzmtCo.exe
  C:\Windows\System\SCzmtCo.exe
  2⤵
  PID:10544
- C:\Windows\System\wnxJdKu.exe
  C:\Windows\System\wnxJdKu.exe
  2⤵
  PID:10564
- C:\Windows\System\RyCNClT.exe
  C:\Windows\System\RyCNClT.exe
  2⤵
  PID:10600
- C:\Windows\System\ATlwjDJ.exe
  C:\Windows\System\ATlwjDJ.exe
  2⤵
  PID:10628
- C:\Windows\System\fxwpUPj.exe
  C:\Windows\System\fxwpUPj.exe
  2⤵
  PID:10660
- C:\Windows\System\syOLIBc.exe
  C:\Windows\System\syOLIBc.exe
  2⤵
  PID:10688
- C:\Windows\System\dfMtYuM.exe
  C:\Windows\System\dfMtYuM.exe
  2⤵
  PID:10704
- C:\Windows\System\OzREHAK.exe
  C:\Windows\System\OzREHAK.exe
  2⤵
  PID:10732
- C:\Windows\System\swmhcUF.exe
  C:\Windows\System\swmhcUF.exe
  2⤵
  PID:10764
- C:\Windows\System\cVOUqUf.exe
  C:\Windows\System\cVOUqUf.exe
  2⤵
  PID:10792
- C:\Windows\System\JSmjbhE.exe
  C:\Windows\System\JSmjbhE.exe
  2⤵
  PID:10824
- C:\Windows\System\cxmhcIY.exe
  C:\Windows\System\cxmhcIY.exe
  2⤵
  PID:10852
- C:\Windows\System\dlQHgWs.exe
  C:\Windows\System\dlQHgWs.exe
  2⤵
  PID:10880
- C:\Windows\System\YlJuNWt.exe
  C:\Windows\System\YlJuNWt.exe
  2⤵
  PID:10900
- C:\Windows\System\zTDAtkg.exe
  C:\Windows\System\zTDAtkg.exe
  2⤵
  PID:10928
- C:\Windows\System\cwFQcOU.exe
  C:\Windows\System\cwFQcOU.exe
  2⤵
  PID:10952
- C:\Windows\System\jYgKsNz.exe
  C:\Windows\System\jYgKsNz.exe
  2⤵
  PID:10992
- C:\Windows\System\NGDdtjw.exe
  C:\Windows\System\NGDdtjw.exe
  2⤵
  PID:11028
- C:\Windows\System\LgEanmH.exe
  C:\Windows\System\LgEanmH.exe
  2⤵
  PID:11060
- C:\Windows\System\ZZhPBZq.exe
  C:\Windows\System\ZZhPBZq.exe
  2⤵
  PID:11076
- C:\Windows\System\rBcgjII.exe
  C:\Windows\System\rBcgjII.exe
  2⤵
  PID:11116
- C:\Windows\System\FifVBVq.exe
  C:\Windows\System\FifVBVq.exe
  2⤵
  PID:11148
- C:\Windows\System\ITcfTSE.exe
  C:\Windows\System\ITcfTSE.exe
  2⤵
  PID:11180
- C:\Windows\System\GDznnxE.exe
  C:\Windows\System\GDznnxE.exe
  2⤵
  PID:11200
- C:\Windows\System\plBOyCx.exe
  C:\Windows\System\plBOyCx.exe
  2⤵
  PID:11224
- C:\Windows\System\CEawMWT.exe
  C:\Windows\System\CEawMWT.exe
  2⤵
  PID:11248
- C:\Windows\System\RuSmCKl.exe
  C:\Windows\System\RuSmCKl.exe
  2⤵
  PID:9492
- C:\Windows\System\XFSDctm.exe
  C:\Windows\System\XFSDctm.exe
  2⤵
  PID:9848
- C:\Windows\System\AXyfEqU.exe
  C:\Windows\System\AXyfEqU.exe
  2⤵
  PID:10244
- C:\Windows\System\HScjFNs.exe
  C:\Windows\System\HScjFNs.exe
  2⤵
  PID:10300
- C:\Windows\System\vBDfRqV.exe
  C:\Windows\System\vBDfRqV.exe
  2⤵
  PID:10428
- C:\Windows\System\ckxofNL.exe
  C:\Windows\System\ckxofNL.exe
  2⤵
  PID:10468
- C:\Windows\System\HKteyoZ.exe
  C:\Windows\System\HKteyoZ.exe
  2⤵
  PID:10520
- C:\Windows\System\LffapWj.exe
  C:\Windows\System\LffapWj.exe
  2⤵
  PID:10700
- C:\Windows\System\SyDCKGT.exe
  C:\Windows\System\SyDCKGT.exe
  2⤵
  PID:10576
- C:\Windows\System\hzysodv.exe
  C:\Windows\System\hzysodv.exe
  2⤵
  PID:10812
- C:\Windows\System\BsFFpre.exe
  C:\Windows\System\BsFFpre.exe
  2⤵
  PID:10864
- C:\Windows\System\TRohJdf.exe
  C:\Windows\System\TRohJdf.exe
  2⤵
  PID:10800
- C:\Windows\System\dXlbHJg.exe
  C:\Windows\System\dXlbHJg.exe
  2⤵
  PID:10872
- C:\Windows\System\UJAtWoF.exe
  C:\Windows\System\UJAtWoF.exe
  2⤵
  PID:11048
- C:\Windows\System\oqIvtWU.exe
  C:\Windows\System\oqIvtWU.exe
  2⤵
  PID:11100
- C:\Windows\System\JYcfNOC.exe
  C:\Windows\System\JYcfNOC.exe
  2⤵
  PID:11016
- C:\Windows\System\qPUrWlR.exe
  C:\Windows\System\qPUrWlR.exe
  2⤵
  PID:11168
- C:\Windows\System\YwUEoNl.exe
  C:\Windows\System\YwUEoNl.exe
  2⤵
  PID:10264
- C:\Windows\System\BmLqZCA.exe
  C:\Windows\System\BmLqZCA.exe
  2⤵
  PID:10184
- C:\Windows\System\DpbKllU.exe
  C:\Windows\System\DpbKllU.exe
  2⤵
  PID:11260
- C:\Windows\System\FmcfZxC.exe
  C:\Windows\System\FmcfZxC.exe
  2⤵
  PID:10496
- C:\Windows\System\jcPlRps.exe
  C:\Windows\System\jcPlRps.exe
  2⤵
  PID:10672
- C:\Windows\System\hFQHsOA.exe
  C:\Windows\System\hFQHsOA.exe
  2⤵
  PID:10744
- C:\Windows\System\tAtGrFY.exe
  C:\Windows\System\tAtGrFY.exe
  2⤵
  PID:10696
- C:\Windows\System\MsmdIaf.exe
  C:\Windows\System\MsmdIaf.exe
  2⤵
  PID:10964
- C:\Windows\System\tXLCgQk.exe
  C:\Windows\System\tXLCgQk.exe
  2⤵
  PID:11212
- C:\Windows\System\uQDvkur.exe
  C:\Windows\System\uQDvkur.exe
  2⤵
  PID:11272
- C:\Windows\System\EVavZeJ.exe
  C:\Windows\System\EVavZeJ.exe
  2⤵
  PID:11300
- C:\Windows\System\qyhVMMk.exe
  C:\Windows\System\qyhVMMk.exe
  2⤵
  PID:11332
- C:\Windows\System\GGPidwZ.exe
  C:\Windows\System\GGPidwZ.exe
  2⤵
  PID:11356
- C:\Windows\System\ItOpOLp.exe
  C:\Windows\System\ItOpOLp.exe
  2⤵
  PID:11376
- C:\Windows\System\zrnATQs.exe
  C:\Windows\System\zrnATQs.exe
  2⤵
  PID:11400
- C:\Windows\System\WUFigXK.exe
  C:\Windows\System\WUFigXK.exe
  2⤵
  PID:11428
- C:\Windows\System\QjcWUPN.exe
  C:\Windows\System\QjcWUPN.exe
  2⤵
  PID:11444
- C:\Windows\System\PsmlQMT.exe
  C:\Windows\System\PsmlQMT.exe
  2⤵
  PID:11472
- C:\Windows\System\gyGbaEQ.exe
  C:\Windows\System\gyGbaEQ.exe
  2⤵
  PID:11500
- C:\Windows\System\cvnWdFk.exe
  C:\Windows\System\cvnWdFk.exe
  2⤵
  PID:11532
- C:\Windows\System\yeArsTi.exe
  C:\Windows\System\yeArsTi.exe
  2⤵
  PID:11560
- C:\Windows\System\FdjqGzk.exe
  C:\Windows\System\FdjqGzk.exe
  2⤵
  PID:11596
- C:\Windows\System\mQbxrhQ.exe
  C:\Windows\System\mQbxrhQ.exe
  2⤵
  PID:11628
- C:\Windows\System\TceubEv.exe
  C:\Windows\System\TceubEv.exe
  2⤵
  PID:11660
- C:\Windows\System\EwHkmea.exe
  C:\Windows\System\EwHkmea.exe
  2⤵
  PID:11680
- C:\Windows\System\dTPgHBD.exe
  C:\Windows\System\dTPgHBD.exe
  2⤵
  PID:11716
- C:\Windows\System\coIuYNU.exe
  C:\Windows\System\coIuYNU.exe
  2⤵
  PID:11740
- C:\Windows\System\LaOgssy.exe
  C:\Windows\System\LaOgssy.exe
  2⤵
  PID:11780
- C:\Windows\System\AFtQLfS.exe
  C:\Windows\System\AFtQLfS.exe
  2⤵
  PID:11804
- C:\Windows\System\XzAMhLi.exe
  C:\Windows\System\XzAMhLi.exe
  2⤵
  PID:11836
- C:\Windows\System\BasjTeU.exe
  C:\Windows\System\BasjTeU.exe
  2⤵
  PID:11872
- C:\Windows\System\GkbGvUw.exe
  C:\Windows\System\GkbGvUw.exe
  2⤵
  PID:11896
- C:\Windows\System\vJTMWzk.exe
  C:\Windows\System\vJTMWzk.exe
  2⤵
  PID:11936
- C:\Windows\System\kUjHtde.exe
  C:\Windows\System\kUjHtde.exe
  2⤵
  PID:11956
- C:\Windows\System\sYDoing.exe
  C:\Windows\System\sYDoing.exe
  2⤵
  PID:11984
- C:\Windows\System\nyFOwiE.exe
  C:\Windows\System\nyFOwiE.exe
  2⤵
  PID:12008
- C:\Windows\System\pLDOTNk.exe
  C:\Windows\System\pLDOTNk.exe
  2⤵
  PID:12036
- C:\Windows\System\AXuDNXm.exe
  C:\Windows\System\AXuDNXm.exe
  2⤵
  PID:12072
- C:\Windows\System\elnvjUd.exe
  C:\Windows\System\elnvjUd.exe
  2⤵
  PID:12092
- C:\Windows\System\XjpuwVM.exe
  C:\Windows\System\XjpuwVM.exe
  2⤵
  PID:12124
- C:\Windows\System\vgETfVF.exe
  C:\Windows\System\vgETfVF.exe
  2⤵
  PID:12160
- C:\Windows\System\TIlKJpF.exe
  C:\Windows\System\TIlKJpF.exe
  2⤵
  PID:12184
- C:\Windows\System\WzJXbMI.exe
  C:\Windows\System\WzJXbMI.exe
  2⤵
  PID:12216
- C:\Windows\System\vvuSBcr.exe
  C:\Windows\System\vvuSBcr.exe
  2⤵
  PID:12252
- C:\Windows\System\zTmDzlO.exe
  C:\Windows\System\zTmDzlO.exe
  2⤵
  PID:12268
- C:\Windows\System\oQWzojx.exe
  C:\Windows\System\oQWzojx.exe
  2⤵
  PID:11216
- C:\Windows\System\ZbFIvZu.exe
  C:\Windows\System\ZbFIvZu.exe
  2⤵
  PID:11096
- C:\Windows\System\HQUDIUC.exe
  C:\Windows\System\HQUDIUC.exe
  2⤵
  PID:11236
- C:\Windows\System\hpaIdVY.exe
  C:\Windows\System\hpaIdVY.exe
  2⤵
  PID:9772
- C:\Windows\System\vcVcIkS.exe
  C:\Windows\System\vcVcIkS.exe
  2⤵
  PID:11396
- C:\Windows\System\wgOSDHQ.exe
  C:\Windows\System\wgOSDHQ.exe
  2⤵
  PID:11524
- C:\Windows\System\XQsXZjR.exe
  C:\Windows\System\XQsXZjR.exe
  2⤵
  PID:11612
- C:\Windows\System\pdXkXSz.exe
  C:\Windows\System\pdXkXSz.exe
  2⤵
  PID:9716
- C:\Windows\System\pKnjMGo.exe
  C:\Windows\System\pKnjMGo.exe
  2⤵
  PID:11608
- C:\Windows\System\esOLMiB.exe
  C:\Windows\System\esOLMiB.exe
  2⤵
  PID:11576
- C:\Windows\System\Xwzroyl.exe
  C:\Windows\System\Xwzroyl.exe
  2⤵
  PID:11792
- C:\Windows\System\DKojekR.exe
  C:\Windows\System\DKojekR.exe
  2⤵
  PID:11888
- C:\Windows\System\SWKYkNA.exe
  C:\Windows\System\SWKYkNA.exe
  2⤵
  PID:11908
- C:\Windows\System\zsxeLAk.exe
  C:\Windows\System\zsxeLAk.exe
  2⤵
  PID:11952
- C:\Windows\System\GaYvghS.exe
  C:\Windows\System\GaYvghS.exe
  2⤵
  PID:11980
- C:\Windows\System\DNzvYmJ.exe
  C:\Windows\System\DNzvYmJ.exe
  2⤵
  PID:12120
- C:\Windows\System\FvWhFpq.exe
  C:\Windows\System\FvWhFpq.exe
  2⤵
  PID:12060
- C:\Windows\System\gzmtgYY.exe
  C:\Windows\System\gzmtgYY.exe
  2⤵
  PID:12260
- C:\Windows\System\DTswMyt.exe
  C:\Windows\System\DTswMyt.exe
  2⤵
  PID:11244
- C:\Windows\System\DRUoiBg.exe
  C:\Windows\System\DRUoiBg.exe
  2⤵
  PID:10328
- C:\Windows\System\VvWwjzD.exe
  C:\Windows\System\VvWwjzD.exe
  2⤵
  PID:11240
- C:\Windows\System\rLnAKbu.exe
  C:\Windows\System\rLnAKbu.exe
  2⤵
  PID:11372
- C:\Windows\System\nTCEoyf.exe
  C:\Windows\System\nTCEoyf.exe
  2⤵
  PID:11488
- C:\Windows\System\mTSAUBW.exe
  C:\Windows\System\mTSAUBW.exe
  2⤵
  PID:11968
- C:\Windows\System\jgICJqb.exe
  C:\Windows\System\jgICJqb.exe
  2⤵
  PID:11860
- C:\Windows\System\WseNlbo.exe
  C:\Windows\System\WseNlbo.exe
  2⤵
  PID:12100
- C:\Windows\System\faNRNBP.exe
  C:\Windows\System\faNRNBP.exe
  2⤵
  PID:11308
- C:\Windows\System\pAKxIYY.exe
  C:\Windows\System\pAKxIYY.exe
  2⤵
  PID:12276
- C:\Windows\System\JalYacf.exe
  C:\Windows\System\JalYacf.exe
  2⤵
  PID:10464
- C:\Windows\System\loAHNbr.exe
  C:\Windows\System\loAHNbr.exe
  2⤵
  PID:10508
- C:\Windows\System\YbxZDUC.exe
  C:\Windows\System\YbxZDUC.exe
  2⤵
  PID:12308
- C:\Windows\System\FfFZXHQ.exe
  C:\Windows\System\FfFZXHQ.exe
  2⤵
  PID:12344
- C:\Windows\System\dzndfAC.exe
  C:\Windows\System\dzndfAC.exe
  2⤵
  PID:12380
- C:\Windows\System\MwWHJCQ.exe
  C:\Windows\System\MwWHJCQ.exe
  2⤵
  PID:12408
- C:\Windows\System\McmlkzL.exe
  C:\Windows\System\McmlkzL.exe
  2⤵
  PID:12440
- C:\Windows\System\KDXoiNH.exe
  C:\Windows\System\KDXoiNH.exe
  2⤵
  PID:12472
- C:\Windows\System\SfLrqaF.exe
  C:\Windows\System\SfLrqaF.exe
  2⤵
  PID:12488
- C:\Windows\System\crVibLS.exe
  C:\Windows\System\crVibLS.exe
  2⤵
  PID:12508
- C:\Windows\System\yAIegVB.exe
  C:\Windows\System\yAIegVB.exe
  2⤵
  PID:12544
- C:\Windows\System\mwnHYoN.exe
  C:\Windows\System\mwnHYoN.exe
  2⤵
  PID:12576
- C:\Windows\System\rFkQwiT.exe
  C:\Windows\System\rFkQwiT.exe
  2⤵
  PID:12600
- C:\Windows\System\VdJcSuJ.exe
  C:\Windows\System\VdJcSuJ.exe
  2⤵
  PID:12628
- C:\Windows\System\SqYgwRn.exe
  C:\Windows\System\SqYgwRn.exe
  2⤵
  PID:12656
- C:\Windows\System\QNZBHJt.exe
  C:\Windows\System\QNZBHJt.exe
  2⤵
  PID:12684
- C:\Windows\System\QcFKiAv.exe
  C:\Windows\System\QcFKiAv.exe
  2⤵
  PID:12712
- C:\Windows\System\BhoWoni.exe
  C:\Windows\System\BhoWoni.exe
  2⤵
  PID:12748
- C:\Windows\System\siwieWP.exe
  C:\Windows\System\siwieWP.exe
  2⤵
  PID:12788
- C:\Windows\System\AiQNzga.exe
  C:\Windows\System\AiQNzga.exe
  2⤵
  PID:12812
- C:\Windows\System\yPScVZh.exe
  C:\Windows\System\yPScVZh.exe
  2⤵
  PID:12836
- C:\Windows\System\KTjENHz.exe
  C:\Windows\System\KTjENHz.exe
  2⤵
  PID:12860
- C:\Windows\System\keXlncF.exe
  C:\Windows\System\keXlncF.exe
  2⤵
  PID:12876
- C:\Windows\System\pDahNse.exe
  C:\Windows\System\pDahNse.exe
  2⤵
  PID:12896
- C:\Windows\System\AKisdUx.exe
  C:\Windows\System\AKisdUx.exe
  2⤵
  PID:12932
- C:\Windows\System\zCkKjpV.exe
  C:\Windows\System\zCkKjpV.exe
  2⤵
  PID:12964
- C:\Windows\System\ndjeZqz.exe
  C:\Windows\System\ndjeZqz.exe
  2⤵
  PID:12996
- C:\Windows\System\ndwRFug.exe
  C:\Windows\System\ndwRFug.exe
  2⤵
  PID:13028
- C:\Windows\System\BWdjjIH.exe
  C:\Windows\System\BWdjjIH.exe
  2⤵
  PID:13056
- C:\Windows\System\AqjbSLR.exe
  C:\Windows\System\AqjbSLR.exe
  2⤵
  PID:13084
- C:\Windows\System\hJtuHUn.exe
  C:\Windows\System\hJtuHUn.exe
  2⤵
  PID:13112
- C:\Windows\System\FjPxWsi.exe
  C:\Windows\System\FjPxWsi.exe
  2⤵
  PID:13144
- C:\Windows\System\RewLzzg.exe
  C:\Windows\System\RewLzzg.exe
  2⤵
  PID:13168
- C:\Windows\System\dLqUMMP.exe
  C:\Windows\System\dLqUMMP.exe
  2⤵
  PID:13204
- C:\Windows\System\FkomZCw.exe
  C:\Windows\System\FkomZCw.exe
  2⤵
  PID:13224
- C:\Windows\System\GKTonuR.exe
  C:\Windows\System\GKTonuR.exe
  2⤵
  PID:13256
- C:\Windows\System\XkTvMMs.exe
  C:\Windows\System\XkTvMMs.exe
  2⤵
  PID:13284
- C:\Windows\System\EHQVgXb.exe
  C:\Windows\System\EHQVgXb.exe
  2⤵
  PID:13300
- C:\Windows\System\iyJcdfQ.exe
  C:\Windows\System\iyJcdfQ.exe
  2⤵
  PID:11348
- C:\Windows\System\mGjyYYJ.exe
  C:\Windows\System\mGjyYYJ.exe
  2⤵
  PID:12172
- C:\Windows\System\CUGwEkc.exe
  C:\Windows\System\CUGwEkc.exe
  2⤵
  PID:12304
- C:\Windows\System\rBHtAfc.exe
  C:\Windows\System\rBHtAfc.exe
  2⤵
  PID:12424
- C:\Windows\System\HISiWqw.exe
  C:\Windows\System\HISiWqw.exe
  2⤵
  PID:12568
- C:\Windows\System\sybsvMb.exe
  C:\Windows\System\sybsvMb.exe
  2⤵
  PID:12552
- C:\Windows\System\DzuOTrr.exe
  C:\Windows\System\DzuOTrr.exe
  2⤵
  PID:12724
- C:\Windows\System\ImTelZt.exe
  C:\Windows\System\ImTelZt.exe
  2⤵
  PID:12652
- C:\Windows\System\RxfZYjI.exe
  C:\Windows\System\RxfZYjI.exe
  2⤵
  PID:12612
- C:\Windows\System\JWKUlhy.exe
  C:\Windows\System\JWKUlhy.exe
  2⤵
  PID:12848
- C:\Windows\System\wOtuaNn.exe
  C:\Windows\System\wOtuaNn.exe
  2⤵
  PID:12868
- C:\Windows\System\NedMoBa.exe
  C:\Windows\System\NedMoBa.exe
  2⤵
  PID:12920
- C:\Windows\System\DjdhasW.exe
  C:\Windows\System\DjdhasW.exe
  2⤵
  PID:13008
- C:\Windows\System\rsFKhGJ.exe
  C:\Windows\System\rsFKhGJ.exe
  2⤵
  PID:13020
- C:\Windows\System\BeRtHLC.exe
  C:\Windows\System\BeRtHLC.exe
  2⤵
  PID:13180
- C:\Windows\System\jLpJCQl.exe
  C:\Windows\System\jLpJCQl.exe
  2⤵
  PID:13156
- C:\Windows\System\GuAhVZq.exe
  C:\Windows\System\GuAhVZq.exe
  2⤵
  PID:13200
- C:\Windows\System\pvRybQF.exe
  C:\Windows\System\pvRybQF.exe
  2⤵
  PID:13240
- C:\Windows\System\GbrHxRy.exe
  C:\Windows\System\GbrHxRy.exe
  2⤵
  PID:12392
- C:\Windows\System\kFVyiGY.exe
  C:\Windows\System\kFVyiGY.exe
  2⤵
  PID:11436
- C:\Windows\System\NpQHvSo.exe
  C:\Windows\System\NpQHvSo.exe
  2⤵
  PID:12484
- C:\Windows\System\DkAeKPN.exe
  C:\Windows\System\DkAeKPN.exe
  2⤵
  PID:12676
- C:\Windows\System\gUdHEhP.exe
  C:\Windows\System\gUdHEhP.exe
  2⤵
  PID:12644
- C:\Windows\System\rKBWtQr.exe
  C:\Windows\System\rKBWtQr.exe
  2⤵
  PID:13164
- C:\Windows\System\EEiGYdk.exe
  C:\Windows\System\EEiGYdk.exe
  2⤵
  PID:13124
- C:\Windows\System\IiybGCX.exe
  C:\Windows\System\IiybGCX.exe
  2⤵
  PID:12744
- C:\Windows\System\xUKyQnQ.exe
  C:\Windows\System\xUKyQnQ.exe
  2⤵
  PID:13324
- C:\Windows\System\lCwzwau.exe
  C:\Windows\System\lCwzwau.exe
  2⤵
  PID:13348
- C:\Windows\System\KVSfrHS.exe
  C:\Windows\System\KVSfrHS.exe
  2⤵
  PID:13372
- C:\Windows\System\VYZkErL.exe
  C:\Windows\System\VYZkErL.exe
  2⤵
  PID:13400
- C:\Windows\System\FtkUyNK.exe
  C:\Windows\System\FtkUyNK.exe
  2⤵
  PID:13424
- C:\Windows\System\piiodbr.exe
  C:\Windows\System\piiodbr.exe
  2⤵
  PID:13448
- C:\Windows\System\NzqcYAN.exe
  C:\Windows\System\NzqcYAN.exe
  2⤵
  PID:13472
- C:\Windows\System\XYWzyiL.exe
  C:\Windows\System\XYWzyiL.exe
  2⤵
  PID:13508
- C:\Windows\System\vQUSIgQ.exe
  C:\Windows\System\vQUSIgQ.exe
  2⤵
  PID:13544
- C:\Windows\System\RontFrd.exe
  C:\Windows\System\RontFrd.exe
  2⤵
  PID:13576
- C:\Windows\System\PDqUsdJ.exe
  C:\Windows\System\PDqUsdJ.exe
  2⤵
  PID:13600
- C:\Windows\System\fYMqHTL.exe
  C:\Windows\System\fYMqHTL.exe
  2⤵
  PID:13632
- C:\Windows\System\ZzxpsFA.exe
  C:\Windows\System\ZzxpsFA.exe
  2⤵
  PID:13660
- C:\Windows\System\PEAczfF.exe
  C:\Windows\System\PEAczfF.exe
  2⤵
  PID:13684
- C:\Windows\System\TqIZJyQ.exe
  C:\Windows\System\TqIZJyQ.exe
  2⤵
  PID:13704
- C:\Windows\System\fcExlew.exe
  C:\Windows\System\fcExlew.exe
  2⤵
  PID:13720
- C:\Windows\System\pkZoosI.exe
  C:\Windows\System\pkZoosI.exe
  2⤵
  PID:13748
- C:\Windows\System\EobmHOg.exe
  C:\Windows\System\EobmHOg.exe
  2⤵
  PID:13776
- C:\Windows\System\RivRlbm.exe
  C:\Windows\System\RivRlbm.exe
  2⤵
  PID:13792
- C:\Windows\System\pftOPCi.exe
  C:\Windows\System\pftOPCi.exe
  2⤵
  PID:13816
- C:\Windows\System\wsdXpKS.exe
  C:\Windows\System\wsdXpKS.exe
  2⤵
  PID:13852
- C:\Windows\System\vGGwOvq.exe
  C:\Windows\System\vGGwOvq.exe
  2⤵
  PID:13872
- C:\Windows\System\vfKsGqu.exe
  C:\Windows\System\vfKsGqu.exe
  2⤵
  PID:13904
- C:\Windows\System\zlZQPpq.exe
  C:\Windows\System\zlZQPpq.exe
  2⤵
  PID:13940
- C:\Windows\System\eMflgZV.exe
  C:\Windows\System\eMflgZV.exe
  2⤵
  PID:13968
- C:\Windows\System\ujzsYUt.exe
  C:\Windows\System\ujzsYUt.exe
  2⤵
  PID:13988
- C:\Windows\System\jGKwzeF.exe
  C:\Windows\System\jGKwzeF.exe
  2⤵
  PID:14016
- C:\Windows\System\LmbYLQF.exe
  C:\Windows\System\LmbYLQF.exe
  2⤵
  PID:14048
- C:\Windows\System\yXUluJP.exe
  C:\Windows\System\yXUluJP.exe
  2⤵
  PID:14072
- C:\Windows\System\AYgReWb.exe
  C:\Windows\System\AYgReWb.exe
  2⤵
  PID:14092
- C:\Windows\System\cqnnfNK.exe
  C:\Windows\System\cqnnfNK.exe
  2⤵
  PID:14116
- C:\Windows\System\awXqPqW.exe
  C:\Windows\System\awXqPqW.exe
  2⤵
  PID:14148
- C:\Windows\System\FHaYMLX.exe
  C:\Windows\System\FHaYMLX.exe
  2⤵
  PID:14176
- C:\Windows\System\VvBGplC.exe
  C:\Windows\System\VvBGplC.exe
  2⤵
  PID:14212
- C:\Windows\System\PCHlKys.exe
  C:\Windows\System\PCHlKys.exe
  2⤵
  PID:14236
- C:\Windows\System\XxrFrsx.exe
  C:\Windows\System\XxrFrsx.exe
  2⤵
  PID:14256
- C:\Windows\System\hJxYRpN.exe
  C:\Windows\System\hJxYRpN.exe
  2⤵
  PID:14292
- C:\Windows\System\KfodTIX.exe
  C:\Windows\System\KfodTIX.exe
  2⤵
  PID:14316
- C:\Windows\System\vqohTye.exe
  C:\Windows\System\vqohTye.exe
  2⤵
  PID:13296
- C:\Windows\System\HHEHVDw.exe
  C:\Windows\System\HHEHVDw.exe
  2⤵
  PID:12588
- C:\Windows\System\YPxFENv.exe
  C:\Windows\System\YPxFENv.exe
  2⤵
  PID:12824
- C:\Windows\System\PYOUSTp.exe
  C:\Windows\System\PYOUSTp.exe
  2⤵
  PID:13064
- C:\Windows\System\WhQfxht.exe
  C:\Windows\System\WhQfxht.exe
  2⤵
  PID:13316
- C:\Windows\System\wSuzmPB.exe
  C:\Windows\System\wSuzmPB.exe
  2⤵
  PID:13360
- C:\Windows\System\VlhswAP.exe
  C:\Windows\System\VlhswAP.exe
  2⤵
  PID:13552
- C:\Windows\System\mZAgTkQ.exe
  C:\Windows\System\mZAgTkQ.exe
  2⤵
  PID:13612
- C:\Windows\System\lVRWhtf.exe
  C:\Windows\System\lVRWhtf.exe
  2⤵
  PID:13528
- C:\Windows\System\mLpvPqK.exe
  C:\Windows\System\mLpvPqK.exe
  2⤵
  PID:13648
- C:\Windows\System\kyyIAiK.exe
  C:\Windows\System\kyyIAiK.exe
  2⤵
  PID:13800
- C:\Windows\System\RYfGxSc.exe
  C:\Windows\System\RYfGxSc.exe
  2⤵
  PID:13840
- C:\Windows\System\AAmVLqM.exe
  C:\Windows\System\AAmVLqM.exe
  2⤵
  PID:13924
- C:\Windows\System\FOadPmW.exe
  C:\Windows\System\FOadPmW.exe
  2⤵
  PID:13768
- C:\Windows\System\FtYnbUZ.exe
  C:\Windows\System\FtYnbUZ.exe
  2⤵
  PID:14108
- C:\Windows\System\RsEQZEN.exe
  C:\Windows\System\RsEQZEN.exe
  2⤵
  PID:14188
- C:\Windows\System\atWHyFo.exe
  C:\Windows\System\atWHyFo.exe
  2⤵
  PID:14036
- C:\Windows\System\TWKqBqd.exe
  C:\Windows\System\TWKqBqd.exe
  2⤵
  PID:14288
- C:\Windows\System\ZeIpmEC.exe
  C:\Windows\System\ZeIpmEC.exe
  2⤵
  PID:14164
- C:\Windows\System\uhagndw.exe
  C:\Windows\System\uhagndw.exe
  2⤵
  PID:14248
- C:\Windows\System\mIYFxGD.exe
  C:\Windows\System\mIYFxGD.exe
  2⤵
  PID:14276
- C:\Windows\System\CBslwhQ.exe
  C:\Windows\System\CBslwhQ.exe
  2⤵
  PID:13588
- C:\Windows\System\ViKShHP.exe
  C:\Windows\System\ViKShHP.exe
  2⤵
  PID:13368
- C:\Windows\System\QoYRyhx.exe
  C:\Windows\System\QoYRyhx.exe
  2⤵
  PID:13568
- C:\Windows\System\CERakXt.exe
  C:\Windows\System\CERakXt.exe
  2⤵
  PID:13536
- C:\Windows\System\PKavaMc.exe
  C:\Windows\System\PKavaMc.exe
  2⤵
  PID:14024
- C:\Windows\System\nERrJnt.exe
  C:\Windows\System\nERrJnt.exe
  2⤵
  PID:14352
- C:\Windows\System\KzjDHay.exe
  C:\Windows\System\KzjDHay.exe
  2⤵
  PID:14376
- C:\Windows\System\oLrrRth.exe
  C:\Windows\System\oLrrRth.exe
  2⤵
  PID:14396
- C:\Windows\System\ikozubD.exe
  C:\Windows\System\ikozubD.exe
  2⤵
  PID:14432
- C:\Windows\System\xhTsJIZ.exe
  C:\Windows\System\xhTsJIZ.exe
  2⤵
  PID:14456
- C:\Windows\System\ZqnvKYo.exe
  C:\Windows\System\ZqnvKYo.exe
  2⤵
  PID:14492
- C:\Windows\System\OhJwnGM.exe
  C:\Windows\System\OhJwnGM.exe
  2⤵
  PID:14516
- C:\Windows\System\zPBJQSy.exe
  C:\Windows\System\zPBJQSy.exe
  2⤵
  PID:14540
- C:\Windows\System\lVaBtDH.exe
  C:\Windows\System\lVaBtDH.exe
  2⤵
  PID:14564
- C:\Windows\System\QjDsCUI.exe
  C:\Windows\System\QjDsCUI.exe
  2⤵
  PID:14588
- C:\Windows\System\BKtnqTQ.exe
  C:\Windows\System\BKtnqTQ.exe
  2⤵
  PID:14616
- C:\Windows\System\uLgKaez.exe
  C:\Windows\System\uLgKaez.exe
  2⤵
  PID:14644
- C:\Windows\System\LKCDCjY.exe
  C:\Windows\System\LKCDCjY.exe
  2⤵
  PID:14660
- C:\Windows\System\svDvKHr.exe
  C:\Windows\System\svDvKHr.exe
  2⤵
  PID:14692
- C:\Windows\System\ehPTVdV.exe
  C:\Windows\System\ehPTVdV.exe
  2⤵
  PID:14732
- C:\Windows\System\ujrgJzo.exe
  C:\Windows\System\ujrgJzo.exe
  2⤵
  PID:14752
- C:\Windows\System\gckPKBZ.exe
  C:\Windows\System\gckPKBZ.exe
  2⤵
  PID:14776
- C:\Windows\System\ILRNieL.exe
  C:\Windows\System\ILRNieL.exe
  2⤵
  PID:14804
- C:\Windows\System\pVCSzjU.exe
  C:\Windows\System\pVCSzjU.exe
  2⤵
  PID:14840
- C:\Windows\System\QyZTitQ.exe
  C:\Windows\System\QyZTitQ.exe
  2⤵
  PID:14860
- C:\Windows\System\CqNUwny.exe
  C:\Windows\System\CqNUwny.exe
  2⤵
  PID:14888
- C:\Windows\System\fJNxTKT.exe
  C:\Windows\System\fJNxTKT.exe
  2⤵
  PID:14916
- C:\Windows\System\kjXAxAE.exe
  C:\Windows\System\kjXAxAE.exe
  2⤵
  PID:14948
- C:\Windows\System\NdxNSka.exe
  C:\Windows\System\NdxNSka.exe
  2⤵
  PID:14976
- C:\Windows\System\SlaVkGa.exe
  C:\Windows\System\SlaVkGa.exe
  2⤵
  PID:15008
- C:\Windows\System\MvROkBH.exe
  C:\Windows\System\MvROkBH.exe
  2⤵
  PID:15032
- C:\Windows\System\aYWtrBV.exe
  C:\Windows\System\aYWtrBV.exe
  2⤵
  PID:15052
- C:\Windows\System\cCZPdrT.exe
  C:\Windows\System\cCZPdrT.exe
  2⤵
  PID:15092
- C:\Windows\System\PdIRMoO.exe
  C:\Windows\System\PdIRMoO.exe
  2⤵
  PID:15124
- C:\Windows\System\VrhNkYQ.exe
  C:\Windows\System\VrhNkYQ.exe
  2⤵
  PID:15140
- C:\Windows\System\JOIgiLW.exe
  C:\Windows\System\JOIgiLW.exe
  2⤵
  PID:15172
- C:\Windows\System\XSERVow.exe
  C:\Windows\System\XSERVow.exe
  2⤵
  PID:15200
- C:\Windows\System\uPrOhDz.exe
  C:\Windows\System\uPrOhDz.exe
  2⤵
  PID:15228
- C:\Windows\System\fCAkaPO.exe
  C:\Windows\System\fCAkaPO.exe
  2⤵
  PID:15248
- C:\Windows\System\wBOSMOa.exe
  C:\Windows\System\wBOSMOa.exe
  2⤵
  PID:15280
- C:\Windows\System\WChCasy.exe
  C:\Windows\System\WChCasy.exe
  2⤵
  PID:15312
- C:\Windows\System\GPMwIMB.exe
  C:\Windows\System\GPMwIMB.exe
  2⤵
  PID:15332
- C:\Windows\System\RBxETkW.exe
  C:\Windows\System\RBxETkW.exe
  2⤵
  PID:14008
- C:\Windows\System\WOqXPrF.exe
  C:\Windows\System\WOqXPrF.exe
  2⤵
  PID:11320
- C:\Windows\System\IeCVbUC.exe
  C:\Windows\System\IeCVbUC.exe
  2⤵
  PID:13736
- C:\Windows\System\jOzWLHX.exe
  C:\Windows\System\jOzWLHX.exe
  2⤵
  PID:14332
- C:\Windows\System\ZDQfbBH.exe
  C:\Windows\System\ZDQfbBH.exe
  2⤵
  PID:14372
- C:\Windows\System\yfvOWXp.exe
  C:\Windows\System\yfvOWXp.exe
  2⤵
  PID:13628
- C:\Windows\System\yVbHMvm.exe
  C:\Windows\System\yVbHMvm.exe
  2⤵
  PID:14344
- C:\Windows\System\bwtXjfn.exe
  C:\Windows\System\bwtXjfn.exe
  2⤵
  PID:14328
- C:\Windows\System\HmtYWmi.exe
  C:\Windows\System\HmtYWmi.exe
  2⤵
  PID:15048
- C:\Windows\System\aMFwNtr.exe
  C:\Windows\System\aMFwNtr.exe
  2⤵
  PID:14896
- C:\Windows\System\rthQJzo.exe
  C:\Windows\System\rthQJzo.exe
  2⤵
  PID:14944
- C:\Windows\System\NJzDGPa.exe
  C:\Windows\System\NJzDGPa.exe
  2⤵
  PID:15236
- C:\Windows\System\eEIYqMX.exe
  C:\Windows\System\eEIYqMX.exe
  2⤵
  PID:15152
- C:\Windows\System\QLPgFwV.exe
  C:\Windows\System\QLPgFwV.exe
  2⤵
  PID:15308
- C:\Windows\System\RDhZkoU.exe
  C:\Windows\System\RDhZkoU.exe
  2⤵
  PID:15196
- C:\Windows\System\pWAvcMD.exe
  C:\Windows\System\pWAvcMD.exe
  2⤵
  PID:15328
- C:\Windows\System\cycIZbb.exe
  C:\Windows\System\cycIZbb.exe
  2⤵
  PID:14484
- C:\Windows\System\kqSIXii.exe
  C:\Windows\System\kqSIXii.exe
  2⤵
  PID:3556
- C:\Windows\System\wWMYtrg.exe
  C:\Windows\System\wWMYtrg.exe
  2⤵
  PID:14364
- C:\Windows\System\BciMkcD.exe
  C:\Windows\System\BciMkcD.exe
  2⤵
  PID:13900
- C:\Windows\System\vlxujeH.exe
  C:\Windows\System\vlxujeH.exe
  2⤵
  PID:15372
- C:\Windows\System\blEcIgE.exe
  C:\Windows\System\blEcIgE.exe
  2⤵
  PID:15396
- C:\Windows\System\yxUMGZM.exe
  C:\Windows\System\yxUMGZM.exe
  2⤵
  PID:15420
- C:\Windows\System\lYovXkl.exe
  C:\Windows\System\lYovXkl.exe
  2⤵
  PID:15452
- C:\Windows\System\AogWNkF.exe
  C:\Windows\System\AogWNkF.exe
  2⤵
  PID:15476
- C:\Windows\System\WEcvPpn.exe
  C:\Windows\System\WEcvPpn.exe
  2⤵
  PID:15508
- C:\Windows\System\GGLoXFb.exe
  C:\Windows\System\GGLoXFb.exe
  2⤵
  PID:15540
- C:\Windows\System\jEDFmAH.exe
  C:\Windows\System\jEDFmAH.exe
  2⤵
  PID:15564
- C:\Windows\System\VbQLKWC.exe
  C:\Windows\System\VbQLKWC.exe
  2⤵
  PID:15600
- C:\Windows\System\tjRNwuz.exe
  C:\Windows\System\tjRNwuz.exe
  2⤵
  PID:15620
- C:\Windows\System\BHObDRI.exe
  C:\Windows\System\BHObDRI.exe
  2⤵
  PID:15648
- C:\Windows\System\ROiLnny.exe
  C:\Windows\System\ROiLnny.exe
  2⤵
  PID:15672
- C:\Windows\System\FCYIdfc.exe
  C:\Windows\System\FCYIdfc.exe
  2⤵
  PID:15696
- C:\Windows\System\eOyTxJz.exe
  C:\Windows\System\eOyTxJz.exe
  2⤵
  PID:15728
- C:\Windows\System\wqhZHNj.exe
  C:\Windows\System\wqhZHNj.exe
  2⤵
  PID:15756
- C:\Windows\System\lVsYeoH.exe
  C:\Windows\System\lVsYeoH.exe
  2⤵
  PID:15780
- C:\Windows\System\hyyXDaI.exe
  C:\Windows\System\hyyXDaI.exe
  2⤵
  PID:15824
- C:\Windows\System\tzQJNgx.exe
  C:\Windows\System\tzQJNgx.exe
  2⤵
  PID:15848
- C:\Windows\System\jSDqVXv.exe
  C:\Windows\System\jSDqVXv.exe
  2⤵
  PID:15872
- C:\Windows\System\EpZQWYz.exe
  C:\Windows\System\EpZQWYz.exe
  2⤵
  PID:15896
- C:\Windows\System\CUzPzDk.exe
  C:\Windows\System\CUzPzDk.exe
  2⤵
  PID:15928
- C:\Windows\System\qUFRZBU.exe
  C:\Windows\System\qUFRZBU.exe
  2⤵
  PID:15952
- C:\Windows\System\cMjkPOA.exe
  C:\Windows\System\cMjkPOA.exe
  2⤵
  PID:15980
- C:\Windows\System\kDelgos.exe
  C:\Windows\System\kDelgos.exe
  2⤵
  PID:16008
- C:\Windows\System\KyVdNDW.exe
  C:\Windows\System\KyVdNDW.exe
  2⤵
  PID:16024
- C:\Windows\System\lsOytSc.exe
  C:\Windows\System\lsOytSc.exe
  2⤵
  PID:16048
- C:\Windows\System\JlzplZK.exe
  C:\Windows\System\JlzplZK.exe
  2⤵
  PID:16076
- C:\Windows\System\bNtsQeZ.exe
  C:\Windows\System\bNtsQeZ.exe
  2⤵
  PID:16100
- C:\Windows\System\jGuNvhC.exe
  C:\Windows\System\jGuNvhC.exe
  2⤵
  PID:16128
- C:\Windows\System\jGjkUsm.exe
  C:\Windows\System\jGjkUsm.exe
  2⤵
  PID:16148
- C:\Windows\System\yVdQOXw.exe
  C:\Windows\System\yVdQOXw.exe
  2⤵
  PID:16172
- C:\Windows\System\vYQKCxj.exe
  C:\Windows\System\vYQKCxj.exe
  2⤵
  PID:16208
- C:\Windows\System\nWKMDGl.exe
  C:\Windows\System\nWKMDGl.exe
  2⤵
  PID:16232
- C:\Windows\System\BvavVLg.exe
  C:\Windows\System\BvavVLg.exe
  2⤵
  PID:16260
- C:\Windows\System\PFVKjXx.exe
  C:\Windows\System\PFVKjXx.exe
  2⤵
  PID:16288
- C:\Windows\System\DMIjHzA.exe
  C:\Windows\System\DMIjHzA.exe
  2⤵
  PID:16304
- C:\Windows\System\NnUzEZU.exe
  C:\Windows\System\NnUzEZU.exe
  2⤵
  PID:16332
- C:\Windows\System\EqgddqC.exe
  C:\Windows\System\EqgddqC.exe
  2⤵
  PID:16360
- C:\Windows\System\zBVyJUd.exe
  C:\Windows\System\zBVyJUd.exe
  2⤵
  PID:15120
- C:\Windows\System\wbuzmpj.exe
  C:\Windows\System\wbuzmpj.exe
  2⤵
  PID:14984
- C:\Windows\System\fowuqna.exe
  C:\Windows\System\fowuqna.exe
  2⤵
  PID:14796
- C:\Windows\System\hynVAZH.exe
  C:\Windows\System\hynVAZH.exe
  2⤵
  PID:15216
- C:\Windows\System\mWaMQEj.exe
  C:\Windows\System\mWaMQEj.exe
  2⤵
  PID:15368
- C:\Windows\System\gOzSkOP.exe
  C:\Windows\System\gOzSkOP.exe
  2⤵
  PID:14416
- C:\Windows\System\aAXkJrf.exe
  C:\Windows\System\aAXkJrf.exe
  2⤵
  PID:15356
- C:\Windows\System\qJjxMRl.exe
  C:\Windows\System\qJjxMRl.exe
  2⤵
  PID:13828
- C:\Windows\System\EScGXpb.exe
  C:\Windows\System\EScGXpb.exe
  2⤵
  PID:15536
- C:\Windows\System\rbYHeOX.exe
  C:\Windows\System\rbYHeOX.exe
  2⤵
  PID:15560
- C:\Windows\System\sBwvfcB.exe
  C:\Windows\System\sBwvfcB.exe
  2⤵
  PID:15468
- C:\Windows\System\oyTvMYI.exe
  C:\Windows\System\oyTvMYI.exe
  2⤵
  PID:15516
- C:\Windows\System\hHwLHBR.exe
  C:\Windows\System\hHwLHBR.exe
  2⤵
  PID:15612
- C:\Windows\System\kNxxzRN.exe
  C:\Windows\System\kNxxzRN.exe
  2⤵
  PID:15704
- C:\Windows\System\AfsBDma.exe
  C:\Windows\System\AfsBDma.exe
  2⤵
  PID:15860
- C:\Windows\System\BSAOdhT.exe
  C:\Windows\System\BSAOdhT.exe
  2⤵
  PID:15768
- C:\Windows\System\PYRLGCs.exe
  C:\Windows\System\PYRLGCs.exe
  2⤵
  PID:15972
- C:\Windows\System\MMOGASv.exe
  C:\Windows\System\MMOGASv.exe
  2⤵
  PID:16068
- C:\Windows\System\lIDWyEf.exe
  C:\Windows\System\lIDWyEf.exe
  2⤵
  PID:16196
- C:\Windows\System\AbqgQsN.exe
  C:\Windows\System\AbqgQsN.exe
  2⤵
  PID:16244
- C:\Windows\System\rUPgMWG.exe
  C:\Windows\System\rUPgMWG.exe
  2⤵
  PID:15992
- C:\Windows\System\gDkNXvr.exe
  C:\Windows\System\gDkNXvr.exe
  2⤵
  PID:16300
- C:\Windows\System\VlFzwJk.exe
  C:\Windows\System\VlFzwJk.exe
  2⤵
  PID:16344
- C:\Windows\System\APCWXVB.exe
  C:\Windows\System\APCWXVB.exe
  2⤵
  PID:16084
- C:\Windows\System\GLLpSol.exe
  C:\Windows\System\GLLpSol.exe
  2⤵
  PID:16140
- C:\Windows\System\fhwPUZA.exe
  C:\Windows\System\fhwPUZA.exe
  2⤵
  PID:16376
- C:\Windows\System\ZInUuAQ.exe
  C:\Windows\System\ZInUuAQ.exe
  2⤵
  PID:16296
- C:\Windows\System\EXkOIeJ.exe
  C:\Windows\System\EXkOIeJ.exe
  2⤵
  PID:15632
- C:\Windows\System\sgZbrtp.exe
  C:\Windows\System\sgZbrtp.exe
  2⤵
  PID:16060
- C:\Windows\System\RkjafYC.exe
  C:\Windows\System\RkjafYC.exe
  2⤵
  PID:14836
- C:\Windows\System\cMIZGOA.exe
  C:\Windows\System\cMIZGOA.exe
  2⤵
  PID:16404
- C:\Windows\System\UXMElpu.exe
  C:\Windows\System\UXMElpu.exe
  2⤵
  PID:16420
- C:\Windows\System\koBImxO.exe
  C:\Windows\System\koBImxO.exe
  2⤵
  PID:16448
- C:\Windows\System\hzoiOiS.exe
  C:\Windows\System\hzoiOiS.exe
  2⤵
  PID:16472
- C:\Windows\System\BTMjccf.exe
  C:\Windows\System\BTMjccf.exe
  2⤵
  PID:16504
- C:\Windows\System\KczZJOb.exe
  C:\Windows\System\KczZJOb.exe
  2⤵
  PID:16528
- C:\Windows\System\uZCaXgh.exe
  C:\Windows\System\uZCaXgh.exe
  2⤵
  PID:16564
- C:\Windows\System\UoZsStm.exe
  C:\Windows\System\UoZsStm.exe
  2⤵
  PID:16588
- C:\Windows\System\JYyXmOT.exe
  C:\Windows\System\JYyXmOT.exe
  2⤵
  PID:16612
- C:\Windows\System\fDqLsKL.exe
  C:\Windows\System\fDqLsKL.exe
  2⤵
  PID:16652
- C:\Windows\System\oPeSMXn.exe
  C:\Windows\System\oPeSMXn.exe
  2⤵
  PID:16680
- C:\Windows\System\aQcLTGz.exe
  C:\Windows\System\aQcLTGz.exe
  2⤵
  PID:16700
- C:\Windows\System\fzMGzFR.exe
  C:\Windows\System\fzMGzFR.exe
  2⤵
  PID:16724
- C:\Windows\System\GlTGyJJ.exe
  C:\Windows\System\GlTGyJJ.exe
  2⤵
  PID:16752
- C:\Windows\System\BUBaLNI.exe
  C:\Windows\System\BUBaLNI.exe
  2⤵
  PID:16772
- C:\Windows\System\hGsfzYo.exe
  C:\Windows\System\hGsfzYo.exe
  2⤵
  PID:16800
- C:\Windows\System\GSjWhpQ.exe
  C:\Windows\System\GSjWhpQ.exe
  2⤵
  PID:16828
- C:\Windows\System\sxqnAuq.exe
  C:\Windows\System\sxqnAuq.exe
  2⤵
  PID:16860
- C:\Windows\System\XGoCSBC.exe
  C:\Windows\System\XGoCSBC.exe
  2⤵
  PID:16892
- C:\Windows\System\acuYdff.exe
  C:\Windows\System\acuYdff.exe
  2⤵
  PID:16916
- C:\Windows\System\afDubVS.exe
  C:\Windows\System\afDubVS.exe
  2⤵
  PID:16944
- C:\Windows\System\JUXcmED.exe
  C:\Windows\System\JUXcmED.exe
  2⤵
  PID:16972
- C:\Windows\System\vHUSfvM.exe
  C:\Windows\System\vHUSfvM.exe
  2⤵
  PID:17004
- C:\Windows\System\whVJtBn.exe
  C:\Windows\System\whVJtBn.exe
  2⤵
  PID:17028
- C:\Windows\System\esCLcmE.exe
  C:\Windows\System\esCLcmE.exe
  2⤵
  PID:17064
- C:\Windows\System\blKnqld.exe
  C:\Windows\System\blKnqld.exe
  2⤵
  PID:17080
- C:\Windows\System\zLKispE.exe
  C:\Windows\System\zLKispE.exe
  2⤵
  PID:17116
- C:\Windows\System\CTBjJdI.exe
  C:\Windows\System\CTBjJdI.exe
  2⤵
  PID:17136
- C:\Windows\System\oOpngci.exe
  C:\Windows\System\oOpngci.exe
  2⤵
  PID:16000
- C:\Windows\System\fVoNImN.exe
  C:\Windows\System\fVoNImN.exe
  2⤵
  PID:16180
- C:\Windows\System\ebneOMH.exe
  C:\Windows\System\ebneOMH.exe
  2⤵
  PID:15808
- C:\Windows\System\AJDIeSl.exe
  C:\Windows\System\AJDIeSl.exe
  2⤵
  PID:16632
- C:\Windows\System\XKDvSLI.exe
  C:\Windows\System\XKDvSLI.exe
  2⤵
  PID:16428
- C:\Windows\System\CuyPwaO.exe
  C:\Windows\System\CuyPwaO.exe
  2⤵
  PID:16252
- C:\Windows\System\JGToAPf.exe
  C:\Windows\System\JGToAPf.exe
  2⤵
  PID:17012
- - C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -u -p 17012 -s 248
    3⤵
    PID:15388
- C:\Windows\System\WHUHWPl.exe
  C:\Windows\System\WHUHWPl.exe
  2⤵
  PID:17052
- C:\Windows\System\heLPIzV.exe
  C:\Windows\System\heLPIzV.exe
  2⤵
  PID:17072
- C:\Windows\System\HiIhcOM.exe
  C:\Windows\System\HiIhcOM.exe
  2⤵
  PID:16768
- C:\Windows\System\StxcLiP.exe
  C:\Windows\System\StxcLiP.exe
  2⤵
  PID:16788
- C:\Windows\System\yCfpCoD.exe
  C:\Windows\System\yCfpCoD.exe
  2⤵
  PID:17160
- C:\Windows\System\BppnWNW.exe
  C:\Windows\System\BppnWNW.exe
  2⤵
  PID:16908

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
- Modifies data under HKEY_USERS
PID:17024

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:16936

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\DcgMaLM.exe

Filesize
1.6MB

MD5
92360455f0788f858923198952d1cdb7

SHA1
df4c9e130cf602fa9f104372711011ac24db9b44

SHA256
5d523fef5f210516029e4e7a601c26e5c5b7af44007412f8c12981619929fb34

SHA512
d1cfa6a7482b97d4809e5e1554ebe018b5d0c1deacb9b7f549ec77dc04ac061b78835bd0813829bc4a9f9c540fc6001165642b1f4840423a59e0dd51caef77e2

Download Submit
C:\Windows\System\GmKXMdh.exe

Filesize
1.7MB

MD5
f43abbaceef7f926922310d2bc7de284

SHA1
c166a071ce471b1f53db3f2b0d70db9436e95484

SHA256
6e5ed7ba6fb11191871f5db63e7f2e05ae71924ae2b30f517d71ec6a12a592bf

SHA512
70c8dfd9bd93ae4535b8f3b4d63cf82100e4b42fcb6a0aa48fc271f6e605bd02d015f5b07312b3700eae41e30824842769f9a9136287c5584e4c95bb7f305645

Download Submit
C:\Windows\System\HPwiNlm.exe

Filesize
1.6MB

MD5
74e251dc7ae5c0be7b4128ad6da9ee9a

SHA1
4cc153fb6f9b27caf91bc40866408f4a2d058799

SHA256
b1f352d71541f3ea0c3040b2fab7dac401fa622d6b618858514fc02f6c9a2c19

SHA512
12bcae8acd7ddb99ffc996be2505cb1bd083a2b79997aa17be9a69811f391336d3535356130e9029d2598e33ba49d64a1807af03e3db6d50393d1e719af02b66

Download Submit
C:\Windows\System\HgYJRYD.exe

Filesize
1.6MB

MD5
de29ffe7985327cab14f480d8025f741

SHA1
1fd21648f2e8af1ab299822c1e31e31cf74244e1

SHA256
8c31553f3e64eafceefcd1e6f739fdcaf3ad47e10f8574ec3afcc446ffb1a85a

SHA512
75b6999a6a39462f8af23446c5276a4fd5da71482050967150338e5d76f3f0acc7d576fd47ab620dc092ec44508aca8bb78fa74d052ba90a5842702b3027e1be

Download Submit
C:\Windows\System\IuIpbNU.exe

Filesize
1.6MB

MD5
535bad79848e2b3b844b07f26e56909f

SHA1
cfc0a9962117b46ddd0de5ddd02ff76b014a68e0

SHA256
64b5bfc62a1444e693d91a52a3d3d53835dc23cf913ef12b6b4e15dd02dbb76d

SHA512
e371d66d1a3b490955e5c8609a4f548c4e7d24b28f2061b46d22446f9095e0038adc4ae3d7f9e9bfc0b953989feb78b4c164675666ef9e3f06fb696ff690113d

Download Submit
C:\Windows\System\JCuJGbQ.exe

Filesize
1.6MB

MD5
03705f6eecb5b6aefb13918ceee8b2e1

SHA1
2df3889b73ee31422139f6e644e7a3b2b505e378

SHA256
36040385a865601edb360d914645250cd3bc5c0b1f5683a4df083c34314776c4

SHA512
2fc3a04b512cd8eb9e9237870a5be0b421f81a8b9bcbe0ac5e1ab5dae0c868e4739ed28b737e2da86f752a5e344a99017dfa240ce8d92a96b20b77725a60937e

Download Submit
C:\Windows\System\JbXWTJI.exe

Filesize
1.6MB

MD5
3558af6ddc34f9a41414fd86b984d971

SHA1
a6c2ba39dccd026d7db21d8b0b126ea57a9160c9

SHA256
37283b5609158a8116eeaac066536e3d8341bf0ef65b6b5e9201c2d218bb4e23

SHA512
6d16e3654b5c46626c220adfaa8258aaf7cfa7e6d95e414a36cd6eba204c0a22f5a01d114a566491f9a03bf6e7c1b292f79adb3c2ec2ed3de35b57fe3fa1dd77

Download Submit
C:\Windows\System\MFsPgAW.exe

Filesize
1.7MB

MD5
eeaa3b1ab2c8fcec549b75c58c379fad

SHA1
5b5ec8d2059f31c827a224f01930936c7ba9b15a

SHA256
76f278eabbce558dc46c9b6edb6748103306bd525eea6502729106183ae22327

SHA512
ecb74f3c483f7a9f5039c10ea03768fb41ab8ce55fbd5c7d3571e9c4516fa786cef657517ad9b9e1f2ed1ec63fa70e0b3a6499775624bfcb6adad570af35d35a

Download Submit
C:\Windows\System\MSsMBNP.exe

Filesize
1.7MB

MD5
56cf8028ac63fe39150424ef90a6ad16

SHA1
e8cfd3c6106587acd266e71cf5ec52666f970d9d

SHA256
d37e629d440112dca3d403bae899cfddf30b89955c1d5e10f6cf6c6d78f2f3f8

SHA512
a50f743c2a878b0e981f7eae43eb452a43162da6442d52ea9ecf6d0c9827f31e084dbcdd4c692642642bdc8b7768198f48f73fde95ac58b0e1c6f38a793f1631

Download Submit
C:\Windows\System\MoQmecF.exe

Filesize
1.7MB

MD5
8bff1d13eb13b53c2831764216390bd2

SHA1
74644527d9e3839786f5461042269adae19bbb4d

SHA256
06a7ce3fdc0b4195d924c62eadd211ead22a5acccb1e3ca622bb81739cf3de2a

SHA512
e2c14419596166fac0eb92d32584e560bf74e0ef5ac8a68036860993f746b4fa9a50244cb569348f025f353a2bbfb7223748b9df9e334635bf385aed2982cfcb

Download Submit
C:\Windows\System\NFRijCd.exe

Filesize
1.6MB

MD5
91b9e0ccd471bc09bfb4c8c7ea78441f

SHA1
426b2eca81810e44f75bf9d2ff8c1ad7e8d00fe1

SHA256
085c58e987c5cc0148ffa7d32243fbe3fc3e71c1c15d99e9025a750e79e14bab

SHA512
76520098c8c0bd01e86e0cb8354a3d7ecfc8aaae93c3e4e5a950a5af52a93a5a0997b15f22a6f4865c3fea404d629e928981c1425acddf25f381686dcdca6c63

Download Submit
C:\Windows\System\NLXABXI.exe

Filesize
1.7MB

MD5
52c69c386edbf65cbc413edee4a183d0

SHA1
7fac2609a19cadebed9e9e951233d3c1a4d2e884

SHA256
6e9f3a0462ec2386a3da5877cf1dc1b0e52290ac13475d69f1acdfeff0cf11a2

SHA512
6b5a0fef6169837bd2f7d7ff3fb0e8d99fd2080f68e49bbab9d666f5da4e9f0fc7025098b370f40e9c49b0ced3e3aef8779e2059c96d80eac4ee9e91431cff7d

Download Submit
C:\Windows\System\OrERCqe.exe

Filesize
1.6MB

MD5
24fd1e76078a83e40a0c7b6a3a2c91a3

SHA1
f78102705a3f7c0c49d72f1f7114d41c19bcc6ad

SHA256
7e7344b5c1b138bb8bb1f7dcf8a34bccb0d5d099ca6f1a43c70183382bffde7b

SHA512
b9960da2f04212ff19a7e1d7c577fca4b976920586a85ec64adc0b430f37319a944504566a485409a0b0ef2f8e78c6418cc10365caa4bb8a11672ef1016b2f0a

Download Submit
C:\Windows\System\OrUekIn.exe

Filesize
1.6MB

MD5
766df4318daf258963812ccc21c79e83

SHA1
300947fd8a08531341dbf16180e905854feaf946

SHA256
48b91b0a1aa2de25828c1b4ae00c627ea7bf452193adf7276ab216830964681f

SHA512
cde2892da1e3cb293eba20a6b1d6092fa5145d253a5571632771a82b792ea4285a15296423e5bc8ded5b6a0c8d708e188e228f53f9163414899c870e366ace1f

Download Submit
C:\Windows\System\PQalowQ.exe

Filesize
1.6MB

MD5
e252d6fe825218177809209f47a666db

SHA1
614cb73b24e03414fab01adf552d45c8e4063a7e

SHA256
51e3f2dc993e8b4ae0cb3f766a621f84a838dae07fd3ab93b3af61f668de0fca

SHA512
837a46d4f9dea526cfa478b61c26ae5b6ef0316aa5e7826886e5f25c7ac3445bb404e5af22cbb789a920c75edef3d8b3191a51900834c94ecbf3eb1316947e73

Download Submit
C:\Windows\System\QkbekUn.exe

Filesize
1.7MB

MD5
f73bf7403ebb27b2727af17c3506193c

SHA1
32fdd9aa8f3f4d49a3b73c8b4268416592091e54

SHA256
bf7d668a0a614d00f0bfb13f1a62dee8a7d74e1f76f4080877ed4a2c3b03d756

SHA512
a069f37547121a3f9d0b87d2df39d23c25fa7407d0c5823cbf8f1b78c851a0610b16f94b16b5c60e66748c6c47f61d64ce3fe1f4371b8b99aedc4fef1b1043e8

Download Submit
C:\Windows\System\QqXRCsu.exe

Filesize
1.6MB

MD5
6bfecd829671923c7dd0c29f57d72d58

SHA1
1321496a4743f59fee2b2881ede481e3812dbc30

SHA256
067a62eb2b5746c02cc4694985e842bbfc5ef91241ee6cc7038531b56bc4658a

SHA512
a41d8535baa8c31345e194280ff6c19d054a2d66658c3e4c615f4c32f9b7a7b8e5f9be0b9dec0186b3752446f16570b998ad0cb2182ea0f1500530d0e78b7b35

Download Submit
C:\Windows\System\RhnofEk.exe

Filesize
1.6MB

MD5
8d7a63d8072b6c6ec81dead1c848e9bc

SHA1
31a6db1f186d4b2678ea543ebf1c65513dd1940c

SHA256
24c24b19e05e6454a170a9836403c92df09ec5af927735467b21ca5c4173556c

SHA512
d9c8cb0f65ae9735b40e1d87823ce949e4a428b88323088949809ab6681c5b4a4b6842edfa538da0eb8316168eaba03bdf8f3fef9947bcd813e5c04592bc519c

Download Submit
C:\Windows\System\RnHRQxz.exe

Filesize
1.6MB

MD5
82d02bd0aabb9a2a07e1b4fb0b609b91

SHA1
8ca4bd06f8cea741aee8669d3b021fe0e43159d7

SHA256
e51feb4dd0c1cc2ac5c41c03b2a6c50c3ebbd4b169524c1b56b04fb191cb5de2

SHA512
7300ee8b2a9e7d5aa3c7996621338da0b046851da9c588c1452eaccc67b72a3a9ce166a67ebb8083fded5eb1211dbe8cfced8eec0bcb914d43d98e4aa64b4d2d

Download Submit
C:\Windows\System\SrQjPdj.exe

Filesize
1.6MB

MD5
228c569de69a679051ea56e2c8479018

SHA1
56925f1a16217f2448e81b06d90e5ae721ee8b21

SHA256
d0843754dfb38398deea0cb330f5b2198759d9bcb96fac6cdf20601daed6d46d

SHA512
737bda1df2fe5563d85104023cdedf8fa40ac83fceb3411338d9698794c5b6858627498d4492050414508fb7cbc2ad45c0e2d8c05e85e44ed0c23a4f1d661b2a

Download Submit
C:\Windows\System\TrHDXbb.exe

Filesize
1.7MB

MD5
96cccffa71b2df450629612b475a3a73

SHA1
98bcae6670c14772bd72d6c43f2b637f8afb10fe

SHA256
ad2ca74aa1d4e95741cebf250b3cc318b4cd7e4e8ec75938e481b05de08ef7f0

SHA512
63693073f69515490a1c6424132791dce75b981260a17d8f015ea02a1c21f23f047e0360d96d3c7ee799a99f1676b31919807c55b2fc17a96f0aec72e0c68658

Download Submit
C:\Windows\System\TrbsDfq.exe

Filesize
1.6MB

MD5
aba5d4b4678db66b7c7486f82e30291e

SHA1
9660d4ea4a0bc49ef24b1b30b43822a962372993

SHA256
c62be615152001b5d9d82625b1b1e9aba4869d0867f028fc246bd1bd719acd6b

SHA512
ea63dc5fd342f4dff122c80d85a1fe4956eed4dd1b5f7da9375c95dc3d1a1a167b8a57e7732f5714cab6aced571536cf0fcf9c3ca155993cde7ddcd103e9a0d2

Download Submit
C:\Windows\System\UIcVUPy.exe

Filesize
1.7MB

MD5
8c53c01eac6b47fc096c1dc75a301fbc

SHA1
c9cd4829d6f3c88142a49c6a8f3ecd1bf322aa52

SHA256
4565ac8629297176c2041eabae8bfb5685e613d973c81f8c4cabca3242144062

SHA512
d543dbe259082b9e06a4797c25c5e18e02536d4522c8fbbcab52e99d116a8c3f16405a295620973689f23f34e7daa391aa2b5c18258f3ee6632337b8731d4529

Download Submit
C:\Windows\System\WtwpvgK.exe

Filesize
1.6MB

MD5
788220d12610ad91d0052aa52f70a56c

SHA1
dea8f6958c0d42e51303f7f58f4c2843c8078b0f

SHA256
0db7da95966c20bc211d7f03cf1d0f6c288ad2ed1ebcc04cdacfa40ac4b3579f

SHA512
958636dddc527894878779aabc00695e75749856f632c3e07264d0f7623eb959256cd8c8afe762f2107f21cbefefa5c528860a10ddb309536832c661f547621d

Download Submit
C:\Windows\System\XtLIrNf.exe

Filesize
1.6MB

MD5
8016721b925a7e58c8c2f0cea564ee49

SHA1
0bf89ab1d82ef0e314c3ff808d6fc9310107b50a

SHA256
b36304e938706fa950a9fe57623b1e0810b6ff18deb91b4e8930245595b7719b

SHA512
a74cb0e12f154dac89d18d9e2c634caf9741f7aed4614e6f4c66ce5aa463ac3ac8c47790e283b41cb141f4bf52e816744aef25c4cf827207ef1672d57e4b7c7d

Download Submit
C:\Windows\System\YGaxNVI.exe

Filesize
1.6MB

MD5
30e6f524031654f72edc84dfb53d3112

SHA1
2badfcbe0cc1d07dd7b2235ca85632ad760d7083

SHA256
4b6ae3b68275042aa68e09d72a61ac03846255c381863732f9819c0ebb519d35

SHA512
7021dd6ee23dddcb42563fb0b64047c632db4edd5f4f2bf12ece4eba17840549098fc4d49fbaded22c3a0abf6d17e1e494b00b5f01f88cd55e4ceabef94a3176

Download Submit
C:\Windows\System\bwHuzUf.exe

Filesize
1.6MB

MD5
5b0e25f1bd955175ab17b804b1b69386

SHA1
5a1791989a7ac212b329216926c282042091ca1f

SHA256
5158a720bd07ed4a09d5b645f3826bc983449a16f01aec80a906441eac9efc2a

SHA512
9fc137242424150689b2f972b2bf013c991c61f888d042ebfab0f9f00929ef050bad222d4719463cacaade68a036ffa7d345886b2178783caef305d88c7847ec

Download Submit
C:\Windows\System\bwxNHMP.exe

Filesize
1.6MB

MD5
c7f568092ffcbf7e61d4a08951988c75

SHA1
c172813be2b4ad8f7d966db951c2215b2fc894d3

SHA256
be46d2ce6b5a23f28afb3b1e255be5ccc9ebce61597ba835be5ef2872220ec0d

SHA512
5e32ca9cb2dfe6734643675c2be534a7f3182d16aadac68b37f013295cdad37e0d8c34e3515503a4dd5d5598ecb151b194c3c1376288132a2c7e5dbce7492df0

Download Submit
C:\Windows\System\dKkgQta.exe

Filesize
1.6MB

MD5
cb33eec7bc21a21c797682286baf0b56

SHA1
84e00838fec9fe645a0afe69eaba5663ff86de48

SHA256
74e6d8a05f87d3c337eabb9faa929ef8716017ed1038e5a14c97735c1dedd60c

SHA512
fcf329cba53206c30ae94757ff15e6c41fbb9a1940a767509e661297afe1243be9ab1e372619c8e9df65c56ad5b2e3f4ecd3174e097b31d6351f059f4608e4fd

Download Submit
C:\Windows\System\ekXiBxJ.exe

Filesize
1.7MB

MD5
25c798654a9dc4141b10404ea9eb0128

SHA1
80db84201df909e645156278b0fb1ae5d406e563

SHA256
12a40132df8a7a046088ba70ac264187c59ce66790adb5511eefb1d6d17de2ff

SHA512
f7aaae5372c803cbe944d67c79611ef3588d00af5dfa14e243f0218b744cfd068462f3969b1495f9ddab5f3a306a664842a3f811c193c3876a6fdea87afdb437

Download Submit
C:\Windows\System\fPQJVnV.exe

Filesize
1.6MB

MD5
945334f3dd2de42b78a30997a6b7346b

SHA1
0f748381ade2297cac0cdefeee7dbbb1c2de588c

SHA256
3efe22b9eacf60bd4df9a226b2587796655f3bc46b54f00686420f3d7e31226b

SHA512
81624279ae40be7095f9cb6f7ef35305ef5d89f2057abd7cf0e4c47acc7ace4c64a2125f484f7f5ab9d6ef7d1273b1558af1683c2fba5772b1a0e1b97bfbf3f2

Download Submit
C:\Windows\System\hqnleHg.exe

Filesize
1.7MB

MD5
f5731e086ab39e953027f7613ca76d5d

SHA1
4598eed5a9fee44097fff57d9f18a202d4f680b0

SHA256
7daa7a80acc2b57269fc0cd8c5e9bf5fbec8356df7584ad7957c8677878f3ca3

SHA512
a7068fc43bdba157cd7ef0a3ce5cc13caddac7e7ec3f0b3395783622049ecb17a8c8276ab5e30e4662b5cc4b6c998994feee7c10d621dd5a8ba85587a152937e

Download Submit
C:\Windows\System\nQKWxWC.exe

Filesize
1.6MB

MD5
1adf73b5ba15cef7758d1a8b6ee46975

SHA1
a3e6cc59bb283f76d9e7872e7c8ff8cfc7e74b81

SHA256
3d184da9a7fd2de69f7bfef666c4ab6a4e7fec03d80c0cc516ef2484e3e35648

SHA512
f994f9bba91ff5385aa5ba01d07d42901e475af3e8ed6aaab2c38ba9ff66cb08c8dacf921b433781a43cdb8ae26fac077d4a361d600b9004bd830fee4422b956

Download Submit
C:\Windows\System\nscNxcG.exe

Filesize
1.6MB

MD5
282356556668a9db70978b4480eec9e1

SHA1
d393d4e00639627a972c5d1426dd710e5470ce96

SHA256
a3a3a2aaa70ae3cbe7956c41132d2fa106275f01316e83e898f8970dcef61ce3

SHA512
884c6734301275ab2b73cfa1e59091a671e8bccca3659d98500d667a37b8677c78035b6431d620c8f3edb31df4a2b61e6624a6cccee179834937bfc81aa2bf62

Download Submit
C:\Windows\System\uPONTzB.exe

Filesize
1.6MB

MD5
c32b896aee860a5f31a6a0d4a346eb07

SHA1
9557e5ec5fd0d835629285d9ed2a1df4e7ae9428

SHA256
c5e58917ea3403e6f2b2ff90aa75e54f7bf54a6ff35db26e834da264021643d6

SHA512
781cc0401ad8055b49c6bd3e399ce1819af274762d561499c18311c5c904012369fae7c35dab241b968367b956989986cf9f78e3844364a66fe19c03fe10f074

Download Submit
C:\Windows\System\xSxcIim.exe

Filesize
1.6MB

MD5
b34834b720150de1ad7e5654288db7be

SHA1
653e747f2624606a9b7be2887afbf800d8a330f7

SHA256
154f9370c1e500fbdd44ef05d766d9d005e5785f2b18d9a052e17e7100c807ab

SHA512
8914227550629038fa549d7afe007ad5f8257b8c9d2259d039bd884c6e97ca2eb1c260f26dd50b21b8b030d8e9146b930baef193943aa00f0979edf8a638eb16

Download Submit
C:\Windows\System\zYHrOHd.exe

Filesize
1.6MB

MD5
01b48f584cf3b58ba8f5eb6166361ff3

SHA1
a4b069dee804d336c116e912ea4e1617da86197f

SHA256
f9b8c8e822d57b3d34355582c4eff6b4b2b6bad072fdf1823b94ab1a01938d85

SHA512
c9b87dd950e581640c65ba653ae5c0d5c411bd0d62cff8df9ed8358a6c46217c2240594ffcb3abd85b75d3a8c5af04ce63d030dd27eafa88cee5f8ca4c3947d5

Download Submit
memory/1576-0-0x0000022DEAF20000-0x0000022DEAF30000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads