xmrig | dcbec8dda52ee47b530df52259867d693bc665845c1fd59aca06da6b86b86fa2

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
24-12-2024 02:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dcbec8dda52ee47b530df52259867d693bc665845c1fd59aca06da6b86b86fa2.exe
Size

1.8MB
MD5

a6468947d369a9a3b7a9c96ad5fa1cb4
SHA1

9d28d3dd5d51981a3293f558846726dfa1221f8d
SHA256

dcbec8dda52ee47b530df52259867d693bc665845c1fd59aca06da6b86b86fa2
SHA512

c93c536d2c0920180c4c00e2baa2d1f28498b8f847bd7c8484c6ef68db87f28341b35f38cfb54767ea1ecfd91f8394ccb5c2f796ab7e54603f3c366ab2b3d49b
SSDEEP

49152:GezaTF8FcNkNdfE0pZ9ozttwIRRR/1fGkv+ih9:GemTLkNdfE0pZyt

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 35 IoCs

miner

resource	yara_rule
behavioral2/files/0x000c000000023baa-4.dat	xmrig
behavioral2/files/0x0007000000023ca1-8.dat	xmrig
behavioral2/files/0x0007000000023ca4-29.dat	xmrig
behavioral2/files/0x0007000000023ca2-27.dat	xmrig
behavioral2/files/0x0007000000023ca3-25.dat	xmrig
behavioral2/files/0x0008000000023c9d-10.dat	xmrig
behavioral2/files/0x0007000000023ca6-37.dat	xmrig
behavioral2/files/0x0007000000023ca5-35.dat	xmrig
behavioral2/files/0x0007000000023ca7-44.dat	xmrig
behavioral2/files/0x0007000000023caa-56.dat	xmrig
behavioral2/files/0x0007000000023cab-63.dat	xmrig
behavioral2/files/0x0007000000023cad-72.dat	xmrig
behavioral2/files/0x0007000000023cb0-93.dat	xmrig
behavioral2/files/0x0007000000023cac-86.dat	xmrig
behavioral2/files/0x0007000000023caf-107.dat	xmrig
behavioral2/files/0x0007000000023cb3-114.dat	xmrig
behavioral2/files/0x0007000000023cb8-127.dat	xmrig
behavioral2/files/0x0007000000023cbb-141.dat	xmrig
behavioral2/files/0x0007000000023cb9-162.dat	xmrig
behavioral2/files/0x0007000000023cba-170.dat	xmrig
behavioral2/files/0x0007000000023cc1-156.dat	xmrig
behavioral2/files/0x0007000000023cbf-152.dat	xmrig
behavioral2/files/0x0007000000023cbe-151.dat	xmrig
behavioral2/files/0x0007000000023cbd-149.dat	xmrig
behavioral2/files/0x0007000000023cbc-144.dat	xmrig
behavioral2/files/0x0007000000023cc0-155.dat	xmrig
behavioral2/files/0x0007000000023cb7-132.dat	xmrig
behavioral2/files/0x0007000000023cb6-120.dat	xmrig
behavioral2/files/0x0007000000023cb5-118.dat	xmrig
behavioral2/files/0x0007000000023cb4-116.dat	xmrig
behavioral2/files/0x0007000000023cb2-112.dat	xmrig
behavioral2/files/0x0007000000023cb1-98.dat	xmrig
behavioral2/files/0x0007000000023cae-73.dat	xmrig
behavioral2/files/0x0008000000023c9e-60.dat	xmrig
behavioral2/files/0x0007000000023ca8-50.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
1364	UoCIoAn.exe
1736	VboKCGH.exe
1576	eAAgTdA.exe
2648	DelPrpC.exe
4356	jXtjMMz.exe
4956	QrsvRti.exe
1252	TYOmEri.exe
400	ggcuOBu.exe
4952	juDmHJt.exe
4692	JRkwuop.exe
244	qplzDxe.exe
5036	RSsHBFF.exe
2620	AApCVwk.exe
4024	iMWGIHz.exe
208	taBDviK.exe
3052	HHJeHCE.exe
2308	VKmmdhl.exe
1060	AEWWCZI.exe
4760	XtXlpUP.exe
2208	ntCYfex.exe
4540	XnlooPr.exe
3720	FYHyIdH.exe
956	YgrfXIo.exe
2468	zOIvrlk.exe
2316	TcOepAi.exe
936	tgVdkvx.exe
4512	TADYsnJ.exe
3664	eEVlnwy.exe
2412	TMsEVoZ.exe
4492	Feoiwah.exe
3384	HogCzDp.exe
4920	dzYIEIY.exe
2472	xTYEpbP.exe
5100	alnBCmb.exe
4820	GFFabFq.exe
3188	FTlhLKW.exe
3968	KovghDI.exe
5028	EsQoMpx.exe
872	InQnQLq.exe
1012	yDFGTwL.exe
3832	WDhWBSL.exe
3172	zCCVyHk.exe
1676	UezaAjG.exe
3204	YcJluSx.exe
2024	CRnZiAu.exe
2224	RZtmrjI.exe
3952	PeJrUae.exe
548	ffYIWfY.exe
1712	gydhkIw.exe
1664	HuApSqA.exe
3472	aOIvXHq.exe
4044	xYMCdTY.exe
5044	mVCSWxt.exe
3628	ceJWbNo.exe
4784	LqrCEyb.exe
4364	HgoadqG.exe
1780	EzDKDFC.exe
1268	HgUeUPX.exe
436	xlBUlyL.exe
3728	WXDLJEz.exe
4200	fIFuThD.exe
2608	TfdjNfl.exe
2988	jRBqCmM.exe
4992	bPNPLMb.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\zCCVyHk.exe	dcbec8dda52ee47b530df52259867d693bc665845c1fd59aca06da6b86b86fa2.exe
File created	C:\Windows\System\WrrDaqi.exe	dcbec8dda52ee47b530df52259867d693bc665845c1fd59aca06da6b86b86fa2.exe
File created	C:\Windows\System\unxExKS.exe	dcbec8dda52ee47b530df52259867d693bc665845c1fd59aca06da6b86b86fa2.exe
File created	C:\Windows\System\QOHUKkw.exe	dcbec8dda52ee47b530df52259867d693bc665845c1fd59aca06da6b86b86fa2.exe
File created	C:\Windows\System\DQxhjyK.exe	dcbec8dda52ee47b530df52259867d693bc665845c1fd59aca06da6b86b86fa2.exe
File created	C:\Windows\System\lhJOxmy.exe	dcbec8dda52ee47b530df52259867d693bc665845c1fd59aca06da6b86b86fa2.exe
File created	C:\Windows\System\GQPehox.exe	dcbec8dda52ee47b530df52259867d693bc665845c1fd59aca06da6b86b86fa2.exe
File created	C:\Windows\System\UdLCXUF.exe	dcbec8dda52ee47b530df52259867d693bc665845c1fd59aca06da6b86b86fa2.exe
File created	C:\Windows\System\DiNCunz.exe	dcbec8dda52ee47b530df52259867d693bc665845c1fd59aca06da6b86b86fa2.exe
File created	C:\Windows\System\VGalCLF.exe	dcbec8dda52ee47b530df52259867d693bc665845c1fd59aca06da6b86b86fa2.exe
File created	C:\Windows\System\JKqYpEn.exe	dcbec8dda52ee47b530df52259867d693bc665845c1fd59aca06da6b86b86fa2.exe
File created	C:\Windows\System\nlPfRrg.exe	dcbec8dda52ee47b530df52259867d693bc665845c1fd59aca06da6b86b86fa2.exe
File created	C:\Windows\System\GUBkXZt.exe	dcbec8dda52ee47b530df52259867d693bc665845c1fd59aca06da6b86b86fa2.exe
File created	C:\Windows\System\EFrdYvq.exe	dcbec8dda52ee47b530df52259867d693bc665845c1fd59aca06da6b86b86fa2.exe
File created	C:\Windows\System\IPujmjK.exe	dcbec8dda52ee47b530df52259867d693bc665845c1fd59aca06da6b86b86fa2.exe
File created	C:\Windows\System\VrGciku.exe	dcbec8dda52ee47b530df52259867d693bc665845c1fd59aca06da6b86b86fa2.exe
File created	C:\Windows\System\QmZuyZs.exe	dcbec8dda52ee47b530df52259867d693bc665845c1fd59aca06da6b86b86fa2.exe
File created	C:\Windows\System\GJLVUxQ.exe	dcbec8dda52ee47b530df52259867d693bc665845c1fd59aca06da6b86b86fa2.exe
File created	C:\Windows\System\tgVdkvx.exe	dcbec8dda52ee47b530df52259867d693bc665845c1fd59aca06da6b86b86fa2.exe
File created	C:\Windows\System\VeWKSdX.exe	dcbec8dda52ee47b530df52259867d693bc665845c1fd59aca06da6b86b86fa2.exe
File created	C:\Windows\System\DluUPhK.exe	dcbec8dda52ee47b530df52259867d693bc665845c1fd59aca06da6b86b86fa2.exe
File created	C:\Windows\System\InEPrFc.exe	dcbec8dda52ee47b530df52259867d693bc665845c1fd59aca06da6b86b86fa2.exe
File created	C:\Windows\System\RZtmrjI.exe	dcbec8dda52ee47b530df52259867d693bc665845c1fd59aca06da6b86b86fa2.exe
File created	C:\Windows\System\ylsXBEi.exe	dcbec8dda52ee47b530df52259867d693bc665845c1fd59aca06da6b86b86fa2.exe
File created	C:\Windows\System\zWKGzev.exe	dcbec8dda52ee47b530df52259867d693bc665845c1fd59aca06da6b86b86fa2.exe
File created	C:\Windows\System\SQHPgpt.exe	dcbec8dda52ee47b530df52259867d693bc665845c1fd59aca06da6b86b86fa2.exe
File created	C:\Windows\System\hNFpCPR.exe	dcbec8dda52ee47b530df52259867d693bc665845c1fd59aca06da6b86b86fa2.exe
File created	C:\Windows\System\HJbCyGE.exe	dcbec8dda52ee47b530df52259867d693bc665845c1fd59aca06da6b86b86fa2.exe
File created	C:\Windows\System\JHIlxrN.exe	dcbec8dda52ee47b530df52259867d693bc665845c1fd59aca06da6b86b86fa2.exe
File created	C:\Windows\System\CRnZiAu.exe	dcbec8dda52ee47b530df52259867d693bc665845c1fd59aca06da6b86b86fa2.exe
File created	C:\Windows\System\JPzIrXc.exe	dcbec8dda52ee47b530df52259867d693bc665845c1fd59aca06da6b86b86fa2.exe
File created	C:\Windows\System\nsZFGPg.exe	dcbec8dda52ee47b530df52259867d693bc665845c1fd59aca06da6b86b86fa2.exe
File created	C:\Windows\System\qAwGnYi.exe	dcbec8dda52ee47b530df52259867d693bc665845c1fd59aca06da6b86b86fa2.exe
File created	C:\Windows\System\iELYOJl.exe	dcbec8dda52ee47b530df52259867d693bc665845c1fd59aca06da6b86b86fa2.exe
File created	C:\Windows\System\fbyRXUL.exe	dcbec8dda52ee47b530df52259867d693bc665845c1fd59aca06da6b86b86fa2.exe
File created	C:\Windows\System\cPxplDY.exe	dcbec8dda52ee47b530df52259867d693bc665845c1fd59aca06da6b86b86fa2.exe
File created	C:\Windows\System\gOmGHwe.exe	dcbec8dda52ee47b530df52259867d693bc665845c1fd59aca06da6b86b86fa2.exe
File created	C:\Windows\System\DgSCeJy.exe	dcbec8dda52ee47b530df52259867d693bc665845c1fd59aca06da6b86b86fa2.exe
File created	C:\Windows\System\wNqNLnh.exe	dcbec8dda52ee47b530df52259867d693bc665845c1fd59aca06da6b86b86fa2.exe
File created	C:\Windows\System\INhjqxi.exe	dcbec8dda52ee47b530df52259867d693bc665845c1fd59aca06da6b86b86fa2.exe
File created	C:\Windows\System\cKApWOk.exe	dcbec8dda52ee47b530df52259867d693bc665845c1fd59aca06da6b86b86fa2.exe
File created	C:\Windows\System\zvBNwhI.exe	dcbec8dda52ee47b530df52259867d693bc665845c1fd59aca06da6b86b86fa2.exe
File created	C:\Windows\System\yTfhdqn.exe	dcbec8dda52ee47b530df52259867d693bc665845c1fd59aca06da6b86b86fa2.exe
File created	C:\Windows\System\vsuYDVt.exe	dcbec8dda52ee47b530df52259867d693bc665845c1fd59aca06da6b86b86fa2.exe
File created	C:\Windows\System\pSBKzjK.exe	dcbec8dda52ee47b530df52259867d693bc665845c1fd59aca06da6b86b86fa2.exe
File created	C:\Windows\System\bYVjixd.exe	dcbec8dda52ee47b530df52259867d693bc665845c1fd59aca06da6b86b86fa2.exe
File created	C:\Windows\System\DHqabAn.exe	dcbec8dda52ee47b530df52259867d693bc665845c1fd59aca06da6b86b86fa2.exe
File created	C:\Windows\System\kQVbkgL.exe	dcbec8dda52ee47b530df52259867d693bc665845c1fd59aca06da6b86b86fa2.exe
File created	C:\Windows\System\AObHhZj.exe	dcbec8dda52ee47b530df52259867d693bc665845c1fd59aca06da6b86b86fa2.exe
File created	C:\Windows\System\wVqwRTv.exe	dcbec8dda52ee47b530df52259867d693bc665845c1fd59aca06da6b86b86fa2.exe
File created	C:\Windows\System\vATmXGq.exe	dcbec8dda52ee47b530df52259867d693bc665845c1fd59aca06da6b86b86fa2.exe
File created	C:\Windows\System\UdpukGx.exe	dcbec8dda52ee47b530df52259867d693bc665845c1fd59aca06da6b86b86fa2.exe
File created	C:\Windows\System\ybUiaUJ.exe	dcbec8dda52ee47b530df52259867d693bc665845c1fd59aca06da6b86b86fa2.exe
File created	C:\Windows\System\rDqsKop.exe	dcbec8dda52ee47b530df52259867d693bc665845c1fd59aca06da6b86b86fa2.exe
File created	C:\Windows\System\nZJilxQ.exe	dcbec8dda52ee47b530df52259867d693bc665845c1fd59aca06da6b86b86fa2.exe
File created	C:\Windows\System\TfdjNfl.exe	dcbec8dda52ee47b530df52259867d693bc665845c1fd59aca06da6b86b86fa2.exe
File created	C:\Windows\System\litDeWV.exe	dcbec8dda52ee47b530df52259867d693bc665845c1fd59aca06da6b86b86fa2.exe
File created	C:\Windows\System\iXtXdHL.exe	dcbec8dda52ee47b530df52259867d693bc665845c1fd59aca06da6b86b86fa2.exe
File created	C:\Windows\System\ypPhpfn.exe	dcbec8dda52ee47b530df52259867d693bc665845c1fd59aca06da6b86b86fa2.exe
File created	C:\Windows\System\vmZuhNU.exe	dcbec8dda52ee47b530df52259867d693bc665845c1fd59aca06da6b86b86fa2.exe
File created	C:\Windows\System\EhelTGu.exe	dcbec8dda52ee47b530df52259867d693bc665845c1fd59aca06da6b86b86fa2.exe
File created	C:\Windows\System\sHwYYIm.exe	dcbec8dda52ee47b530df52259867d693bc665845c1fd59aca06da6b86b86fa2.exe
File created	C:\Windows\System\CBgrWtP.exe	dcbec8dda52ee47b530df52259867d693bc665845c1fd59aca06da6b86b86fa2.exe
File created	C:\Windows\System\TxRYvmJ.exe	dcbec8dda52ee47b530df52259867d693bc665845c1fd59aca06da6b86b86fa2.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	17180	dwm.exe
Token: SeChangeNotifyPrivilege	17180	dwm.exe
Token: 33	17180	dwm.exe
Token: SeIncBasePriorityPrivilege	17180	dwm.exe
Token: SeShutdownPrivilege	17180	dwm.exe
Token: SeCreatePagefilePrivilege	17180	dwm.exe
Token: SeShutdownPrivilege	17180	dwm.exe
Token: SeCreatePagefilePrivilege	17180	dwm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1668 wrote to memory of 1364	1668	dcbec8dda52ee47b530df52259867d693bc665845c1fd59aca06da6b86b86fa2.exe	84
PID 1668 wrote to memory of 1364	1668	dcbec8dda52ee47b530df52259867d693bc665845c1fd59aca06da6b86b86fa2.exe	84
PID 1668 wrote to memory of 1736	1668	dcbec8dda52ee47b530df52259867d693bc665845c1fd59aca06da6b86b86fa2.exe	85
PID 1668 wrote to memory of 1736	1668	dcbec8dda52ee47b530df52259867d693bc665845c1fd59aca06da6b86b86fa2.exe	85
PID 1668 wrote to memory of 1576	1668	dcbec8dda52ee47b530df52259867d693bc665845c1fd59aca06da6b86b86fa2.exe	86
PID 1668 wrote to memory of 1576	1668	dcbec8dda52ee47b530df52259867d693bc665845c1fd59aca06da6b86b86fa2.exe	86
PID 1668 wrote to memory of 2648	1668	dcbec8dda52ee47b530df52259867d693bc665845c1fd59aca06da6b86b86fa2.exe	87
PID 1668 wrote to memory of 2648	1668	dcbec8dda52ee47b530df52259867d693bc665845c1fd59aca06da6b86b86fa2.exe	87
PID 1668 wrote to memory of 4356	1668	dcbec8dda52ee47b530df52259867d693bc665845c1fd59aca06da6b86b86fa2.exe	88
PID 1668 wrote to memory of 4356	1668	dcbec8dda52ee47b530df52259867d693bc665845c1fd59aca06da6b86b86fa2.exe	88
PID 1668 wrote to memory of 4956	1668	dcbec8dda52ee47b530df52259867d693bc665845c1fd59aca06da6b86b86fa2.exe	89
PID 1668 wrote to memory of 4956	1668	dcbec8dda52ee47b530df52259867d693bc665845c1fd59aca06da6b86b86fa2.exe	89
PID 1668 wrote to memory of 1252	1668	dcbec8dda52ee47b530df52259867d693bc665845c1fd59aca06da6b86b86fa2.exe	90
PID 1668 wrote to memory of 1252	1668	dcbec8dda52ee47b530df52259867d693bc665845c1fd59aca06da6b86b86fa2.exe	90
PID 1668 wrote to memory of 400	1668	dcbec8dda52ee47b530df52259867d693bc665845c1fd59aca06da6b86b86fa2.exe	91
PID 1668 wrote to memory of 400	1668	dcbec8dda52ee47b530df52259867d693bc665845c1fd59aca06da6b86b86fa2.exe	91
PID 1668 wrote to memory of 4952	1668	dcbec8dda52ee47b530df52259867d693bc665845c1fd59aca06da6b86b86fa2.exe	92
PID 1668 wrote to memory of 4952	1668	dcbec8dda52ee47b530df52259867d693bc665845c1fd59aca06da6b86b86fa2.exe	92
PID 1668 wrote to memory of 4692	1668	dcbec8dda52ee47b530df52259867d693bc665845c1fd59aca06da6b86b86fa2.exe	93
PID 1668 wrote to memory of 4692	1668	dcbec8dda52ee47b530df52259867d693bc665845c1fd59aca06da6b86b86fa2.exe	93
PID 1668 wrote to memory of 244	1668	dcbec8dda52ee47b530df52259867d693bc665845c1fd59aca06da6b86b86fa2.exe	94
PID 1668 wrote to memory of 244	1668	dcbec8dda52ee47b530df52259867d693bc665845c1fd59aca06da6b86b86fa2.exe	94
PID 1668 wrote to memory of 5036	1668	dcbec8dda52ee47b530df52259867d693bc665845c1fd59aca06da6b86b86fa2.exe	95
PID 1668 wrote to memory of 5036	1668	dcbec8dda52ee47b530df52259867d693bc665845c1fd59aca06da6b86b86fa2.exe	95
PID 1668 wrote to memory of 2620	1668	dcbec8dda52ee47b530df52259867d693bc665845c1fd59aca06da6b86b86fa2.exe	96
PID 1668 wrote to memory of 2620	1668	dcbec8dda52ee47b530df52259867d693bc665845c1fd59aca06da6b86b86fa2.exe	96
PID 1668 wrote to memory of 4024	1668	dcbec8dda52ee47b530df52259867d693bc665845c1fd59aca06da6b86b86fa2.exe	97
PID 1668 wrote to memory of 4024	1668	dcbec8dda52ee47b530df52259867d693bc665845c1fd59aca06da6b86b86fa2.exe	97
PID 1668 wrote to memory of 208	1668	dcbec8dda52ee47b530df52259867d693bc665845c1fd59aca06da6b86b86fa2.exe	98
PID 1668 wrote to memory of 208	1668	dcbec8dda52ee47b530df52259867d693bc665845c1fd59aca06da6b86b86fa2.exe	98
PID 1668 wrote to memory of 3052	1668	dcbec8dda52ee47b530df52259867d693bc665845c1fd59aca06da6b86b86fa2.exe	99
PID 1668 wrote to memory of 3052	1668	dcbec8dda52ee47b530df52259867d693bc665845c1fd59aca06da6b86b86fa2.exe	99
PID 1668 wrote to memory of 2308	1668	dcbec8dda52ee47b530df52259867d693bc665845c1fd59aca06da6b86b86fa2.exe	100
PID 1668 wrote to memory of 2308	1668	dcbec8dda52ee47b530df52259867d693bc665845c1fd59aca06da6b86b86fa2.exe	100
PID 1668 wrote to memory of 1060	1668	dcbec8dda52ee47b530df52259867d693bc665845c1fd59aca06da6b86b86fa2.exe	101
PID 1668 wrote to memory of 1060	1668	dcbec8dda52ee47b530df52259867d693bc665845c1fd59aca06da6b86b86fa2.exe	101
PID 1668 wrote to memory of 4760	1668	dcbec8dda52ee47b530df52259867d693bc665845c1fd59aca06da6b86b86fa2.exe	102
PID 1668 wrote to memory of 4760	1668	dcbec8dda52ee47b530df52259867d693bc665845c1fd59aca06da6b86b86fa2.exe	102
PID 1668 wrote to memory of 2208	1668	dcbec8dda52ee47b530df52259867d693bc665845c1fd59aca06da6b86b86fa2.exe	103
PID 1668 wrote to memory of 2208	1668	dcbec8dda52ee47b530df52259867d693bc665845c1fd59aca06da6b86b86fa2.exe	103
PID 1668 wrote to memory of 4540	1668	dcbec8dda52ee47b530df52259867d693bc665845c1fd59aca06da6b86b86fa2.exe	104
PID 1668 wrote to memory of 4540	1668	dcbec8dda52ee47b530df52259867d693bc665845c1fd59aca06da6b86b86fa2.exe	104
PID 1668 wrote to memory of 3720	1668	dcbec8dda52ee47b530df52259867d693bc665845c1fd59aca06da6b86b86fa2.exe	105
PID 1668 wrote to memory of 3720	1668	dcbec8dda52ee47b530df52259867d693bc665845c1fd59aca06da6b86b86fa2.exe	105
PID 1668 wrote to memory of 956	1668	dcbec8dda52ee47b530df52259867d693bc665845c1fd59aca06da6b86b86fa2.exe	106
PID 1668 wrote to memory of 956	1668	dcbec8dda52ee47b530df52259867d693bc665845c1fd59aca06da6b86b86fa2.exe	106
PID 1668 wrote to memory of 2468	1668	dcbec8dda52ee47b530df52259867d693bc665845c1fd59aca06da6b86b86fa2.exe	107
PID 1668 wrote to memory of 2468	1668	dcbec8dda52ee47b530df52259867d693bc665845c1fd59aca06da6b86b86fa2.exe	107
PID 1668 wrote to memory of 2316	1668	dcbec8dda52ee47b530df52259867d693bc665845c1fd59aca06da6b86b86fa2.exe	108
PID 1668 wrote to memory of 2316	1668	dcbec8dda52ee47b530df52259867d693bc665845c1fd59aca06da6b86b86fa2.exe	108
PID 1668 wrote to memory of 936	1668	dcbec8dda52ee47b530df52259867d693bc665845c1fd59aca06da6b86b86fa2.exe	109
PID 1668 wrote to memory of 936	1668	dcbec8dda52ee47b530df52259867d693bc665845c1fd59aca06da6b86b86fa2.exe	109
PID 1668 wrote to memory of 4512	1668	dcbec8dda52ee47b530df52259867d693bc665845c1fd59aca06da6b86b86fa2.exe	110
PID 1668 wrote to memory of 4512	1668	dcbec8dda52ee47b530df52259867d693bc665845c1fd59aca06da6b86b86fa2.exe	110
PID 1668 wrote to memory of 3664	1668	dcbec8dda52ee47b530df52259867d693bc665845c1fd59aca06da6b86b86fa2.exe	111
PID 1668 wrote to memory of 3664	1668	dcbec8dda52ee47b530df52259867d693bc665845c1fd59aca06da6b86b86fa2.exe	111
PID 1668 wrote to memory of 2412	1668	dcbec8dda52ee47b530df52259867d693bc665845c1fd59aca06da6b86b86fa2.exe	112
PID 1668 wrote to memory of 2412	1668	dcbec8dda52ee47b530df52259867d693bc665845c1fd59aca06da6b86b86fa2.exe	112
PID 1668 wrote to memory of 4492	1668	dcbec8dda52ee47b530df52259867d693bc665845c1fd59aca06da6b86b86fa2.exe	113
PID 1668 wrote to memory of 4492	1668	dcbec8dda52ee47b530df52259867d693bc665845c1fd59aca06da6b86b86fa2.exe	113
PID 1668 wrote to memory of 3384	1668	dcbec8dda52ee47b530df52259867d693bc665845c1fd59aca06da6b86b86fa2.exe	114
PID 1668 wrote to memory of 3384	1668	dcbec8dda52ee47b530df52259867d693bc665845c1fd59aca06da6b86b86fa2.exe	114
PID 1668 wrote to memory of 4920	1668	dcbec8dda52ee47b530df52259867d693bc665845c1fd59aca06da6b86b86fa2.exe	115
PID 1668 wrote to memory of 4920	1668	dcbec8dda52ee47b530df52259867d693bc665845c1fd59aca06da6b86b86fa2.exe	115

C:\Users\Admin\AppData\Local\Temp\dcbec8dda52ee47b530df52259867d693bc665845c1fd59aca06da6b86b86fa2.exe
"C:\Users\Admin\AppData\Local\Temp\dcbec8dda52ee47b530df52259867d693bc665845c1fd59aca06da6b86b86fa2.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1668
- C:\Windows\System\UoCIoAn.exe
  C:\Windows\System\UoCIoAn.exe
  2⤵
  - Executes dropped EXE
  PID:1364
- C:\Windows\System\VboKCGH.exe
  C:\Windows\System\VboKCGH.exe
  2⤵
  - Executes dropped EXE
  PID:1736
- C:\Windows\System\eAAgTdA.exe
  C:\Windows\System\eAAgTdA.exe
  2⤵
  - Executes dropped EXE
  PID:1576
- C:\Windows\System\DelPrpC.exe
  C:\Windows\System\DelPrpC.exe
  2⤵
  - Executes dropped EXE
  PID:2648
- C:\Windows\System\jXtjMMz.exe
  C:\Windows\System\jXtjMMz.exe
  2⤵
  - Executes dropped EXE
  PID:4356
- C:\Windows\System\QrsvRti.exe
  C:\Windows\System\QrsvRti.exe
  2⤵
  - Executes dropped EXE
  PID:4956
- C:\Windows\System\TYOmEri.exe
  C:\Windows\System\TYOmEri.exe
  2⤵
  - Executes dropped EXE
  PID:1252
- C:\Windows\System\ggcuOBu.exe
  C:\Windows\System\ggcuOBu.exe
  2⤵
  - Executes dropped EXE
  PID:400
- C:\Windows\System\juDmHJt.exe
  C:\Windows\System\juDmHJt.exe
  2⤵
  - Executes dropped EXE
  PID:4952
- C:\Windows\System\JRkwuop.exe
  C:\Windows\System\JRkwuop.exe
  2⤵
  - Executes dropped EXE
  PID:4692
- C:\Windows\System\qplzDxe.exe
  C:\Windows\System\qplzDxe.exe
  2⤵
  - Executes dropped EXE
  PID:244
- C:\Windows\System\RSsHBFF.exe
  C:\Windows\System\RSsHBFF.exe
  2⤵
  - Executes dropped EXE
  PID:5036
- C:\Windows\System\AApCVwk.exe
  C:\Windows\System\AApCVwk.exe
  2⤵
  - Executes dropped EXE
  PID:2620
- C:\Windows\System\iMWGIHz.exe
  C:\Windows\System\iMWGIHz.exe
  2⤵
  - Executes dropped EXE
  PID:4024
- C:\Windows\System\taBDviK.exe
  C:\Windows\System\taBDviK.exe
  2⤵
  - Executes dropped EXE
  PID:208
- C:\Windows\System\HHJeHCE.exe
  C:\Windows\System\HHJeHCE.exe
  2⤵
  - Executes dropped EXE
  PID:3052
- C:\Windows\System\VKmmdhl.exe
  C:\Windows\System\VKmmdhl.exe
  2⤵
  - Executes dropped EXE
  PID:2308
- C:\Windows\System\AEWWCZI.exe
  C:\Windows\System\AEWWCZI.exe
  2⤵
  - Executes dropped EXE
  PID:1060
- C:\Windows\System\XtXlpUP.exe
  C:\Windows\System\XtXlpUP.exe
  2⤵
  - Executes dropped EXE
  PID:4760
- C:\Windows\System\ntCYfex.exe
  C:\Windows\System\ntCYfex.exe
  2⤵
  - Executes dropped EXE
  PID:2208
- C:\Windows\System\XnlooPr.exe
  C:\Windows\System\XnlooPr.exe
  2⤵
  - Executes dropped EXE
  PID:4540
- C:\Windows\System\FYHyIdH.exe
  C:\Windows\System\FYHyIdH.exe
  2⤵
  - Executes dropped EXE
  PID:3720
- C:\Windows\System\YgrfXIo.exe
  C:\Windows\System\YgrfXIo.exe
  2⤵
  - Executes dropped EXE
  PID:956
- C:\Windows\System\zOIvrlk.exe
  C:\Windows\System\zOIvrlk.exe
  2⤵
  - Executes dropped EXE
  PID:2468
- C:\Windows\System\TcOepAi.exe
  C:\Windows\System\TcOepAi.exe
  2⤵
  - Executes dropped EXE
  PID:2316
- C:\Windows\System\tgVdkvx.exe
  C:\Windows\System\tgVdkvx.exe
  2⤵
  - Executes dropped EXE
  PID:936
- C:\Windows\System\TADYsnJ.exe
  C:\Windows\System\TADYsnJ.exe
  2⤵
  - Executes dropped EXE
  PID:4512
- C:\Windows\System\eEVlnwy.exe
  C:\Windows\System\eEVlnwy.exe
  2⤵
  - Executes dropped EXE
  PID:3664
- C:\Windows\System\TMsEVoZ.exe
  C:\Windows\System\TMsEVoZ.exe
  2⤵
  - Executes dropped EXE
  PID:2412
- C:\Windows\System\Feoiwah.exe
  C:\Windows\System\Feoiwah.exe
  2⤵
  - Executes dropped EXE
  PID:4492
- C:\Windows\System\HogCzDp.exe
  C:\Windows\System\HogCzDp.exe
  2⤵
  - Executes dropped EXE
  PID:3384
- C:\Windows\System\dzYIEIY.exe
  C:\Windows\System\dzYIEIY.exe
  2⤵
  - Executes dropped EXE
  PID:4920
- C:\Windows\System\xTYEpbP.exe
  C:\Windows\System\xTYEpbP.exe
  2⤵
  - Executes dropped EXE
  PID:2472
- C:\Windows\System\alnBCmb.exe
  C:\Windows\System\alnBCmb.exe
  2⤵
  - Executes dropped EXE
  PID:5100
- C:\Windows\System\GFFabFq.exe
  C:\Windows\System\GFFabFq.exe
  2⤵
  - Executes dropped EXE
  PID:4820
- C:\Windows\System\FTlhLKW.exe
  C:\Windows\System\FTlhLKW.exe
  2⤵
  - Executes dropped EXE
  PID:3188
- C:\Windows\System\KovghDI.exe
  C:\Windows\System\KovghDI.exe
  2⤵
  - Executes dropped EXE
  PID:3968
- C:\Windows\System\EsQoMpx.exe
  C:\Windows\System\EsQoMpx.exe
  2⤵
  - Executes dropped EXE
  PID:5028
- C:\Windows\System\InQnQLq.exe
  C:\Windows\System\InQnQLq.exe
  2⤵
  - Executes dropped EXE
  PID:872
- C:\Windows\System\yDFGTwL.exe
  C:\Windows\System\yDFGTwL.exe
  2⤵
  - Executes dropped EXE
  PID:1012
- C:\Windows\System\WDhWBSL.exe
  C:\Windows\System\WDhWBSL.exe
  2⤵
  - Executes dropped EXE
  PID:3832
- C:\Windows\System\zCCVyHk.exe
  C:\Windows\System\zCCVyHk.exe
  2⤵
  - Executes dropped EXE
  PID:3172
- C:\Windows\System\UezaAjG.exe
  C:\Windows\System\UezaAjG.exe
  2⤵
  - Executes dropped EXE
  PID:1676
- C:\Windows\System\YcJluSx.exe
  C:\Windows\System\YcJluSx.exe
  2⤵
  - Executes dropped EXE
  PID:3204
- C:\Windows\System\CRnZiAu.exe
  C:\Windows\System\CRnZiAu.exe
  2⤵
  - Executes dropped EXE
  PID:2024
- C:\Windows\System\RZtmrjI.exe
  C:\Windows\System\RZtmrjI.exe
  2⤵
  - Executes dropped EXE
  PID:2224
- C:\Windows\System\PeJrUae.exe
  C:\Windows\System\PeJrUae.exe
  2⤵
  - Executes dropped EXE
  PID:3952
- C:\Windows\System\ffYIWfY.exe
  C:\Windows\System\ffYIWfY.exe
  2⤵
  - Executes dropped EXE
  PID:548
- C:\Windows\System\gydhkIw.exe
  C:\Windows\System\gydhkIw.exe
  2⤵
  - Executes dropped EXE
  PID:1712
- C:\Windows\System\HuApSqA.exe
  C:\Windows\System\HuApSqA.exe
  2⤵
  - Executes dropped EXE
  PID:1664
- C:\Windows\System\aOIvXHq.exe
  C:\Windows\System\aOIvXHq.exe
  2⤵
  - Executes dropped EXE
  PID:3472
- C:\Windows\System\xYMCdTY.exe
  C:\Windows\System\xYMCdTY.exe
  2⤵
  - Executes dropped EXE
  PID:4044
- C:\Windows\System\mVCSWxt.exe
  C:\Windows\System\mVCSWxt.exe
  2⤵
  - Executes dropped EXE
  PID:5044
- C:\Windows\System\ceJWbNo.exe
  C:\Windows\System\ceJWbNo.exe
  2⤵
  - Executes dropped EXE
  PID:3628
- C:\Windows\System\LqrCEyb.exe
  C:\Windows\System\LqrCEyb.exe
  2⤵
  - Executes dropped EXE
  PID:4784
- C:\Windows\System\HgoadqG.exe
  C:\Windows\System\HgoadqG.exe
  2⤵
  - Executes dropped EXE
  PID:4364
- C:\Windows\System\EzDKDFC.exe
  C:\Windows\System\EzDKDFC.exe
  2⤵
  - Executes dropped EXE
  PID:1780
- C:\Windows\System\HgUeUPX.exe
  C:\Windows\System\HgUeUPX.exe
  2⤵
  - Executes dropped EXE
  PID:1268
- C:\Windows\System\xlBUlyL.exe
  C:\Windows\System\xlBUlyL.exe
  2⤵
  - Executes dropped EXE
  PID:436
- C:\Windows\System\WXDLJEz.exe
  C:\Windows\System\WXDLJEz.exe
  2⤵
  - Executes dropped EXE
  PID:3728
- C:\Windows\System\fIFuThD.exe
  C:\Windows\System\fIFuThD.exe
  2⤵
  - Executes dropped EXE
  PID:4200
- C:\Windows\System\TfdjNfl.exe
  C:\Windows\System\TfdjNfl.exe
  2⤵
  - Executes dropped EXE
  PID:2608
- C:\Windows\System\jRBqCmM.exe
  C:\Windows\System\jRBqCmM.exe
  2⤵
  - Executes dropped EXE
  PID:2988
- C:\Windows\System\bPNPLMb.exe
  C:\Windows\System\bPNPLMb.exe
  2⤵
  - Executes dropped EXE
  PID:4992
- C:\Windows\System\vsuYDVt.exe
  C:\Windows\System\vsuYDVt.exe
  2⤵
  PID:940
- C:\Windows\System\gnlhMmU.exe
  C:\Windows\System\gnlhMmU.exe
  2⤵
  PID:3248
- C:\Windows\System\uFERCGZ.exe
  C:\Windows\System\uFERCGZ.exe
  2⤵
  PID:1900
- C:\Windows\System\SCQeYWs.exe
  C:\Windows\System\SCQeYWs.exe
  2⤵
  PID:4308
- C:\Windows\System\jMUANNK.exe
  C:\Windows\System\jMUANNK.exe
  2⤵
  PID:4440
- C:\Windows\System\jkspuNe.exe
  C:\Windows\System\jkspuNe.exe
  2⤵
  PID:4924
- C:\Windows\System\RohfChY.exe
  C:\Windows\System\RohfChY.exe
  2⤵
  PID:3160
- C:\Windows\System\znPYkZv.exe
  C:\Windows\System\znPYkZv.exe
  2⤵
  PID:1628
- C:\Windows\System\gNzoocV.exe
  C:\Windows\System\gNzoocV.exe
  2⤵
  PID:2240
- C:\Windows\System\WrrDaqi.exe
  C:\Windows\System\WrrDaqi.exe
  2⤵
  PID:904
- C:\Windows\System\hheIbjJ.exe
  C:\Windows\System\hheIbjJ.exe
  2⤵
  PID:1296
- C:\Windows\System\DHqabAn.exe
  C:\Windows\System\DHqabAn.exe
  2⤵
  PID:2080
- C:\Windows\System\saoceIF.exe
  C:\Windows\System\saoceIF.exe
  2⤵
  PID:1692
- C:\Windows\System\TqVjSTE.exe
  C:\Windows\System\TqVjSTE.exe
  2⤵
  PID:1956
- C:\Windows\System\QfXxpLn.exe
  C:\Windows\System\QfXxpLn.exe
  2⤵
  PID:264
- C:\Windows\System\hzPvtsO.exe
  C:\Windows\System\hzPvtsO.exe
  2⤵
  PID:456
- C:\Windows\System\umbyFbX.exe
  C:\Windows\System\umbyFbX.exe
  2⤵
  PID:4464
- C:\Windows\System\ERSfkVk.exe
  C:\Windows\System\ERSfkVk.exe
  2⤵
  PID:1540
- C:\Windows\System\TRcwqgT.exe
  C:\Windows\System\TRcwqgT.exe
  2⤵
  PID:4176
- C:\Windows\System\vrQtSBg.exe
  C:\Windows\System\vrQtSBg.exe
  2⤵
  PID:2128
- C:\Windows\System\myzOwfs.exe
  C:\Windows\System\myzOwfs.exe
  2⤵
  PID:3704
- C:\Windows\System\vhoNyxC.exe
  C:\Windows\System\vhoNyxC.exe
  2⤵
  PID:4444
- C:\Windows\System\OlsqjYa.exe
  C:\Windows\System\OlsqjYa.exe
  2⤵
  PID:2780
- C:\Windows\System\nZWCdNg.exe
  C:\Windows\System\nZWCdNg.exe
  2⤵
  PID:2200
- C:\Windows\System\oPIeEwX.exe
  C:\Windows\System\oPIeEwX.exe
  2⤵
  PID:2772
- C:\Windows\System\lLYSRvh.exe
  C:\Windows\System\lLYSRvh.exe
  2⤵
  PID:4968
- C:\Windows\System\fhMAtiH.exe
  C:\Windows\System\fhMAtiH.exe
  2⤵
  PID:2324
- C:\Windows\System\ANOWsIR.exe
  C:\Windows\System\ANOWsIR.exe
  2⤵
  PID:3672
- C:\Windows\System\NaHOuAI.exe
  C:\Windows\System\NaHOuAI.exe
  2⤵
  PID:4688
- C:\Windows\System\NRlAJqq.exe
  C:\Windows\System\NRlAJqq.exe
  2⤵
  PID:1528
- C:\Windows\System\MlThKIm.exe
  C:\Windows\System\MlThKIm.exe
  2⤵
  PID:428
- C:\Windows\System\wlwtkOO.exe
  C:\Windows\System\wlwtkOO.exe
  2⤵
  PID:636
- C:\Windows\System\mocLNLG.exe
  C:\Windows\System\mocLNLG.exe
  2⤵
  PID:4596
- C:\Windows\System\OFZBZFX.exe
  C:\Windows\System\OFZBZFX.exe
  2⤵
  PID:3208
- C:\Windows\System\HltUHKh.exe
  C:\Windows\System\HltUHKh.exe
  2⤵
  PID:4504
- C:\Windows\System\kEXnMxM.exe
  C:\Windows\System\kEXnMxM.exe
  2⤵
  PID:3908
- C:\Windows\System\rZdUChs.exe
  C:\Windows\System\rZdUChs.exe
  2⤵
  PID:3632
- C:\Windows\System\LrcGtHO.exe
  C:\Windows\System\LrcGtHO.exe
  2⤵
  PID:3476
- C:\Windows\System\nHpWkRn.exe
  C:\Windows\System\nHpWkRn.exe
  2⤵
  PID:5076
- C:\Windows\System\ZtBISvu.exe
  C:\Windows\System\ZtBISvu.exe
  2⤵
  PID:3408
- C:\Windows\System\ZBnDlRv.exe
  C:\Windows\System\ZBnDlRv.exe
  2⤵
  PID:1472
- C:\Windows\System\vIzOFHx.exe
  C:\Windows\System\vIzOFHx.exe
  2⤵
  PID:388
- C:\Windows\System\NbOSwSp.exe
  C:\Windows\System\NbOSwSp.exe
  2⤵
  PID:4684
- C:\Windows\System\rwtqjJT.exe
  C:\Windows\System\rwtqjJT.exe
  2⤵
  PID:4208
- C:\Windows\System\nlPfRrg.exe
  C:\Windows\System\nlPfRrg.exe
  2⤵
  PID:2248
- C:\Windows\System\cvSErTX.exe
  C:\Windows\System\cvSErTX.exe
  2⤵
  PID:2304
- C:\Windows\System\tZylTtZ.exe
  C:\Windows\System\tZylTtZ.exe
  2⤵
  PID:4296
- C:\Windows\System\EGhfrWS.exe
  C:\Windows\System\EGhfrWS.exe
  2⤵
  PID:540
- C:\Windows\System\cbaNZkb.exe
  C:\Windows\System\cbaNZkb.exe
  2⤵
  PID:3128
- C:\Windows\System\INhjqxi.exe
  C:\Windows\System\INhjqxi.exe
  2⤵
  PID:4432
- C:\Windows\System\uAqQSSA.exe
  C:\Windows\System\uAqQSSA.exe
  2⤵
  PID:3688
- C:\Windows\System\wnlfNsU.exe
  C:\Windows\System\wnlfNsU.exe
  2⤵
  PID:3024
- C:\Windows\System\sUPvhex.exe
  C:\Windows\System\sUPvhex.exe
  2⤵
  PID:4372
- C:\Windows\System\hNFpCPR.exe
  C:\Windows\System\hNFpCPR.exe
  2⤵
  PID:5140
- C:\Windows\System\fzqjGNN.exe
  C:\Windows\System\fzqjGNN.exe
  2⤵
  PID:5164
- C:\Windows\System\DRfOQRr.exe
  C:\Windows\System\DRfOQRr.exe
  2⤵
  PID:5196
- C:\Windows\System\aawEZBx.exe
  C:\Windows\System\aawEZBx.exe
  2⤵
  PID:5228
- C:\Windows\System\RMNioRG.exe
  C:\Windows\System\RMNioRG.exe
  2⤵
  PID:5260
- C:\Windows\System\cmtehrx.exe
  C:\Windows\System\cmtehrx.exe
  2⤵
  PID:5300
- C:\Windows\System\tPdiQES.exe
  C:\Windows\System\tPdiQES.exe
  2⤵
  PID:5332
- C:\Windows\System\FVZNJpM.exe
  C:\Windows\System\FVZNJpM.exe
  2⤵
  PID:5348
- C:\Windows\System\pZIwkwx.exe
  C:\Windows\System\pZIwkwx.exe
  2⤵
  PID:5388
- C:\Windows\System\ALgsClS.exe
  C:\Windows\System\ALgsClS.exe
  2⤵
  PID:5420
- C:\Windows\System\MmIzDrK.exe
  C:\Windows\System\MmIzDrK.exe
  2⤵
  PID:5444
- C:\Windows\System\YHeTfIG.exe
  C:\Windows\System\YHeTfIG.exe
  2⤵
  PID:5472
- C:\Windows\System\IpbilcW.exe
  C:\Windows\System\IpbilcW.exe
  2⤵
  PID:5496
- C:\Windows\System\UwpHESi.exe
  C:\Windows\System\UwpHESi.exe
  2⤵
  PID:5532
- C:\Windows\System\wVqwRTv.exe
  C:\Windows\System\wVqwRTv.exe
  2⤵
  PID:5564
- C:\Windows\System\TdNbxXi.exe
  C:\Windows\System\TdNbxXi.exe
  2⤵
  PID:5600
- C:\Windows\System\hoAXIhA.exe
  C:\Windows\System\hoAXIhA.exe
  2⤵
  PID:5624
- C:\Windows\System\GLAUlIY.exe
  C:\Windows\System\GLAUlIY.exe
  2⤵
  PID:5656
- C:\Windows\System\qnvrlvo.exe
  C:\Windows\System\qnvrlvo.exe
  2⤵
  PID:5680
- C:\Windows\System\cuzOeHw.exe
  C:\Windows\System\cuzOeHw.exe
  2⤵
  PID:5708
- C:\Windows\System\JhjPdjC.exe
  C:\Windows\System\JhjPdjC.exe
  2⤵
  PID:5740
- C:\Windows\System\MSULuXE.exe
  C:\Windows\System\MSULuXE.exe
  2⤵
  PID:5768
- C:\Windows\System\kKMFKAQ.exe
  C:\Windows\System\kKMFKAQ.exe
  2⤵
  PID:5796
- C:\Windows\System\hYlqCCZ.exe
  C:\Windows\System\hYlqCCZ.exe
  2⤵
  PID:5824
- C:\Windows\System\rwcLVLO.exe
  C:\Windows\System\rwcLVLO.exe
  2⤵
  PID:5840
- C:\Windows\System\ODoTjIX.exe
  C:\Windows\System\ODoTjIX.exe
  2⤵
  PID:5856
- C:\Windows\System\sSLxlQE.exe
  C:\Windows\System\sSLxlQE.exe
  2⤵
  PID:5884
- C:\Windows\System\aoYOvWD.exe
  C:\Windows\System\aoYOvWD.exe
  2⤵
  PID:5912
- C:\Windows\System\izpBczr.exe
  C:\Windows\System\izpBczr.exe
  2⤵
  PID:5940
- C:\Windows\System\HJbCyGE.exe
  C:\Windows\System\HJbCyGE.exe
  2⤵
  PID:5968
- C:\Windows\System\yMtiDIt.exe
  C:\Windows\System\yMtiDIt.exe
  2⤵
  PID:6004
- C:\Windows\System\jTWxayt.exe
  C:\Windows\System\jTWxayt.exe
  2⤵
  PID:6036
- C:\Windows\System\PdxIgWM.exe
  C:\Windows\System\PdxIgWM.exe
  2⤵
  PID:6052
- C:\Windows\System\rElFPDL.exe
  C:\Windows\System\rElFPDL.exe
  2⤵
  PID:6096
- C:\Windows\System\zJbjGEL.exe
  C:\Windows\System\zJbjGEL.exe
  2⤵
  PID:6128
- C:\Windows\System\RxaCBlK.exe
  C:\Windows\System\RxaCBlK.exe
  2⤵
  PID:5136
- C:\Windows\System\VLVpglc.exe
  C:\Windows\System\VLVpglc.exe
  2⤵
  PID:5212
- C:\Windows\System\hDjOtIp.exe
  C:\Windows\System\hDjOtIp.exe
  2⤵
  PID:5256
- C:\Windows\System\IRmDxRi.exe
  C:\Windows\System\IRmDxRi.exe
  2⤵
  PID:5344
- C:\Windows\System\zdPPJXL.exe
  C:\Windows\System\zdPPJXL.exe
  2⤵
  PID:5380
- C:\Windows\System\xzmCOch.exe
  C:\Windows\System\xzmCOch.exe
  2⤵
  PID:5468
- C:\Windows\System\yolcOlt.exe
  C:\Windows\System\yolcOlt.exe
  2⤵
  PID:5556
- C:\Windows\System\HkuULWR.exe
  C:\Windows\System\HkuULWR.exe
  2⤵
  PID:5636
- C:\Windows\System\DZYOxYQ.exe
  C:\Windows\System\DZYOxYQ.exe
  2⤵
  PID:5696
- C:\Windows\System\icpPsmO.exe
  C:\Windows\System\icpPsmO.exe
  2⤵
  PID:5752
- C:\Windows\System\heonjFs.exe
  C:\Windows\System\heonjFs.exe
  2⤵
  PID:5820
- C:\Windows\System\WlJdSEl.exe
  C:\Windows\System\WlJdSEl.exe
  2⤵
  PID:5876
- C:\Windows\System\WzOaBlk.exe
  C:\Windows\System\WzOaBlk.exe
  2⤵
  PID:5952
- C:\Windows\System\YQQQDut.exe
  C:\Windows\System\YQQQDut.exe
  2⤵
  PID:6028
- C:\Windows\System\adCRxIj.exe
  C:\Windows\System\adCRxIj.exe
  2⤵
  PID:6084
- C:\Windows\System\tHnpVwG.exe
  C:\Windows\System\tHnpVwG.exe
  2⤵
  PID:6136
- C:\Windows\System\vmZuhNU.exe
  C:\Windows\System\vmZuhNU.exe
  2⤵
  PID:5248
- C:\Windows\System\ciHtUxx.exe
  C:\Windows\System\ciHtUxx.exe
  2⤵
  PID:5412
- C:\Windows\System\asgkOrs.exe
  C:\Windows\System\asgkOrs.exe
  2⤵
  PID:5592
- C:\Windows\System\dqOaJZf.exe
  C:\Windows\System\dqOaJZf.exe
  2⤵
  PID:5764
- C:\Windows\System\xOGySxv.exe
  C:\Windows\System\xOGySxv.exe
  2⤵
  PID:5956
- C:\Windows\System\RsveRXB.exe
  C:\Windows\System\RsveRXB.exe
  2⤵
  PID:6024
- C:\Windows\System\HuQnmdy.exe
  C:\Windows\System\HuQnmdy.exe
  2⤵
  PID:5188
- C:\Windows\System\yTMorUA.exe
  C:\Windows\System\yTMorUA.exe
  2⤵
  PID:5524
- C:\Windows\System\UbvlHJs.exe
  C:\Windows\System\UbvlHJs.exe
  2⤵
  PID:5832
- C:\Windows\System\utxWsjM.exe
  C:\Windows\System\utxWsjM.exe
  2⤵
  PID:6124
- C:\Windows\System\rbmSzYz.exe
  C:\Windows\System\rbmSzYz.exe
  2⤵
  PID:6152
- C:\Windows\System\nJzsvZe.exe
  C:\Windows\System\nJzsvZe.exe
  2⤵
  PID:6168
- C:\Windows\System\EhelTGu.exe
  C:\Windows\System\EhelTGu.exe
  2⤵
  PID:6200
- C:\Windows\System\RFeEdCj.exe
  C:\Windows\System\RFeEdCj.exe
  2⤵
  PID:6228
- C:\Windows\System\litDeWV.exe
  C:\Windows\System\litDeWV.exe
  2⤵
  PID:6256
- C:\Windows\System\IsxUffR.exe
  C:\Windows\System\IsxUffR.exe
  2⤵
  PID:6272
- C:\Windows\System\EbUKImL.exe
  C:\Windows\System\EbUKImL.exe
  2⤵
  PID:6304
- C:\Windows\System\FklDbJq.exe
  C:\Windows\System\FklDbJq.exe
  2⤵
  PID:6332
- C:\Windows\System\kYXbpac.exe
  C:\Windows\System\kYXbpac.exe
  2⤵
  PID:6368
- C:\Windows\System\PGsVEpy.exe
  C:\Windows\System\PGsVEpy.exe
  2⤵
  PID:6396
- C:\Windows\System\QqbGazB.exe
  C:\Windows\System\QqbGazB.exe
  2⤵
  PID:6428
- C:\Windows\System\GfDcQqz.exe
  C:\Windows\System\GfDcQqz.exe
  2⤵
  PID:6452
- C:\Windows\System\BsbDWRv.exe
  C:\Windows\System\BsbDWRv.exe
  2⤵
  PID:6492
- C:\Windows\System\uVZJxgR.exe
  C:\Windows\System\uVZJxgR.exe
  2⤵
  PID:6520
- C:\Windows\System\sBqxQft.exe
  C:\Windows\System\sBqxQft.exe
  2⤵
  PID:6536
- C:\Windows\System\xPBEesQ.exe
  C:\Windows\System\xPBEesQ.exe
  2⤵
  PID:6576
- C:\Windows\System\OXRXVYb.exe
  C:\Windows\System\OXRXVYb.exe
  2⤵
  PID:6604
- C:\Windows\System\tTRlMBh.exe
  C:\Windows\System\tTRlMBh.exe
  2⤵
  PID:6632
- C:\Windows\System\VzscrNW.exe
  C:\Windows\System\VzscrNW.exe
  2⤵
  PID:6660
- C:\Windows\System\GWUFmuZ.exe
  C:\Windows\System\GWUFmuZ.exe
  2⤵
  PID:6692
- C:\Windows\System\ONwAArX.exe
  C:\Windows\System\ONwAArX.exe
  2⤵
  PID:6720
- C:\Windows\System\qzeIdze.exe
  C:\Windows\System\qzeIdze.exe
  2⤵
  PID:6748
- C:\Windows\System\IyvQKHE.exe
  C:\Windows\System\IyvQKHE.exe
  2⤵
  PID:6776
- C:\Windows\System\wAexCHi.exe
  C:\Windows\System\wAexCHi.exe
  2⤵
  PID:6792
- C:\Windows\System\UXpchiQ.exe
  C:\Windows\System\UXpchiQ.exe
  2⤵
  PID:6808
- C:\Windows\System\AsOPTMr.exe
  C:\Windows\System\AsOPTMr.exe
  2⤵
  PID:6840
- C:\Windows\System\YLhjtHv.exe
  C:\Windows\System\YLhjtHv.exe
  2⤵
  PID:6860
- C:\Windows\System\WMPXFgb.exe
  C:\Windows\System\WMPXFgb.exe
  2⤵
  PID:6892
- C:\Windows\System\kRqUUCx.exe
  C:\Windows\System\kRqUUCx.exe
  2⤵
  PID:6916
- C:\Windows\System\VvlFEEW.exe
  C:\Windows\System\VvlFEEW.exe
  2⤵
  PID:6948
- C:\Windows\System\pyJdJRG.exe
  C:\Windows\System\pyJdJRG.exe
  2⤵
  PID:6992
- C:\Windows\System\UlJZRhn.exe
  C:\Windows\System\UlJZRhn.exe
  2⤵
  PID:7024
- C:\Windows\System\lCYVVrd.exe
  C:\Windows\System\lCYVVrd.exe
  2⤵
  PID:7052
- C:\Windows\System\MDjrJwY.exe
  C:\Windows\System\MDjrJwY.exe
  2⤵
  PID:7092
- C:\Windows\System\lMIKAfB.exe
  C:\Windows\System\lMIKAfB.exe
  2⤵
  PID:7120
- C:\Windows\System\THSGZfT.exe
  C:\Windows\System\THSGZfT.exe
  2⤵
  PID:7148
- C:\Windows\System\HTrTlsO.exe
  C:\Windows\System\HTrTlsO.exe
  2⤵
  PID:5988
- C:\Windows\System\hlZJqlv.exe
  C:\Windows\System\hlZJqlv.exe
  2⤵
  PID:6216
- C:\Windows\System\YeAFvKu.exe
  C:\Windows\System\YeAFvKu.exe
  2⤵
  PID:6268
- C:\Windows\System\vrUdTbD.exe
  C:\Windows\System\vrUdTbD.exe
  2⤵
  PID:6328
- C:\Windows\System\gSARxRc.exe
  C:\Windows\System\gSARxRc.exe
  2⤵
  PID:6408
- C:\Windows\System\gTOTomd.exe
  C:\Windows\System\gTOTomd.exe
  2⤵
  PID:6476
- C:\Windows\System\DIaEsJG.exe
  C:\Windows\System\DIaEsJG.exe
  2⤵
  PID:6532
- C:\Windows\System\QUPghyr.exe
  C:\Windows\System\QUPghyr.exe
  2⤵
  PID:6600
- C:\Windows\System\aOcSbUb.exe
  C:\Windows\System\aOcSbUb.exe
  2⤵
  PID:6672
- C:\Windows\System\kIaNhdY.exe
  C:\Windows\System\kIaNhdY.exe
  2⤵
  PID:6744
- C:\Windows\System\vvsEbyw.exe
  C:\Windows\System\vvsEbyw.exe
  2⤵
  PID:6804
- C:\Windows\System\EhvmKeK.exe
  C:\Windows\System\EhvmKeK.exe
  2⤵
  PID:6904
- C:\Windows\System\obcDmXj.exe
  C:\Windows\System\obcDmXj.exe
  2⤵
  PID:6912
- C:\Windows\System\yIQeZhQ.exe
  C:\Windows\System\yIQeZhQ.exe
  2⤵
  PID:7004
- C:\Windows\System\DVMVkwU.exe
  C:\Windows\System\DVMVkwU.exe
  2⤵
  PID:7076
- C:\Windows\System\RUIFmFO.exe
  C:\Windows\System\RUIFmFO.exe
  2⤵
  PID:7140
- C:\Windows\System\oWgHbYE.exe
  C:\Windows\System\oWgHbYE.exe
  2⤵
  PID:5720
- C:\Windows\System\SFCTTYh.exe
  C:\Windows\System\SFCTTYh.exe
  2⤵
  PID:6296
- C:\Windows\System\civmUZz.exe
  C:\Windows\System\civmUZz.exe
  2⤵
  PID:6356
- C:\Windows\System\WecaduC.exe
  C:\Windows\System\WecaduC.exe
  2⤵
  PID:6596
- C:\Windows\System\hdUDBUH.exe
  C:\Windows\System\hdUDBUH.exe
  2⤵
  PID:6764
- C:\Windows\System\nrCnIhR.exe
  C:\Windows\System\nrCnIhR.exe
  2⤵
  PID:6940
- C:\Windows\System\kriEjRf.exe
  C:\Windows\System\kriEjRf.exe
  2⤵
  PID:7104
- C:\Windows\System\GUBkXZt.exe
  C:\Windows\System\GUBkXZt.exe
  2⤵
  PID:6504
- C:\Windows\System\cdukXZd.exe
  C:\Windows\System\cdukXZd.exe
  2⤵
  PID:6648
- C:\Windows\System\BMZjugO.exe
  C:\Windows\System\BMZjugO.exe
  2⤵
  PID:7108
- C:\Windows\System\WxUcCnA.exe
  C:\Windows\System\WxUcCnA.exe
  2⤵
  PID:6556
- C:\Windows\System\pySKmIx.exe
  C:\Windows\System\pySKmIx.exe
  2⤵
  PID:5376
- C:\Windows\System\RyIqUxO.exe
  C:\Windows\System\RyIqUxO.exe
  2⤵
  PID:7192
- C:\Windows\System\EixcFcf.exe
  C:\Windows\System\EixcFcf.exe
  2⤵
  PID:7232
- C:\Windows\System\YCyhZQX.exe
  C:\Windows\System\YCyhZQX.exe
  2⤵
  PID:7260
- C:\Windows\System\VFTemZM.exe
  C:\Windows\System\VFTemZM.exe
  2⤵
  PID:7288
- C:\Windows\System\fzhLmfX.exe
  C:\Windows\System\fzhLmfX.exe
  2⤵
  PID:7316
- C:\Windows\System\eiwPknO.exe
  C:\Windows\System\eiwPknO.exe
  2⤵
  PID:7344
- C:\Windows\System\VjcUZoP.exe
  C:\Windows\System\VjcUZoP.exe
  2⤵
  PID:7372
- C:\Windows\System\lQAGBzB.exe
  C:\Windows\System\lQAGBzB.exe
  2⤵
  PID:7400
- C:\Windows\System\FDQUAoi.exe
  C:\Windows\System\FDQUAoi.exe
  2⤵
  PID:7420
- C:\Windows\System\UIWvNvM.exe
  C:\Windows\System\UIWvNvM.exe
  2⤵
  PID:7452
- C:\Windows\System\UjClTEC.exe
  C:\Windows\System\UjClTEC.exe
  2⤵
  PID:7484
- C:\Windows\System\jnOzVIY.exe
  C:\Windows\System\jnOzVIY.exe
  2⤵
  PID:7512
- C:\Windows\System\AjRtAOl.exe
  C:\Windows\System\AjRtAOl.exe
  2⤵
  PID:7540
- C:\Windows\System\NJlMfpc.exe
  C:\Windows\System\NJlMfpc.exe
  2⤵
  PID:7568
- C:\Windows\System\sZCbivW.exe
  C:\Windows\System\sZCbivW.exe
  2⤵
  PID:7596
- C:\Windows\System\HiUMdsN.exe
  C:\Windows\System\HiUMdsN.exe
  2⤵
  PID:7624
- C:\Windows\System\Saeoadc.exe
  C:\Windows\System\Saeoadc.exe
  2⤵
  PID:7652
- C:\Windows\System\inkHvbt.exe
  C:\Windows\System\inkHvbt.exe
  2⤵
  PID:7680
- C:\Windows\System\YdOaWpO.exe
  C:\Windows\System\YdOaWpO.exe
  2⤵
  PID:7704
- C:\Windows\System\abQSKsL.exe
  C:\Windows\System\abQSKsL.exe
  2⤵
  PID:7736
- C:\Windows\System\aZXMpfr.exe
  C:\Windows\System\aZXMpfr.exe
  2⤵
  PID:7752
- C:\Windows\System\QwzDljc.exe
  C:\Windows\System\QwzDljc.exe
  2⤵
  PID:7780
- C:\Windows\System\XFMhKcO.exe
  C:\Windows\System\XFMhKcO.exe
  2⤵
  PID:7808
- C:\Windows\System\hQihEhz.exe
  C:\Windows\System\hQihEhz.exe
  2⤵
  PID:7840
- C:\Windows\System\etMyOkz.exe
  C:\Windows\System\etMyOkz.exe
  2⤵
  PID:7868
- C:\Windows\System\TIJtcZo.exe
  C:\Windows\System\TIJtcZo.exe
  2⤵
  PID:7904
- C:\Windows\System\YHupnDA.exe
  C:\Windows\System\YHupnDA.exe
  2⤵
  PID:7932
- C:\Windows\System\QLHuzVO.exe
  C:\Windows\System\QLHuzVO.exe
  2⤵
  PID:7960
- C:\Windows\System\caApVBZ.exe
  C:\Windows\System\caApVBZ.exe
  2⤵
  PID:7976
- C:\Windows\System\aIUbzpY.exe
  C:\Windows\System\aIUbzpY.exe
  2⤵
  PID:7992
- C:\Windows\System\fJeABlC.exe
  C:\Windows\System\fJeABlC.exe
  2⤵
  PID:8016
- C:\Windows\System\UIQagUD.exe
  C:\Windows\System\UIQagUD.exe
  2⤵
  PID:8048
- C:\Windows\System\kwYCrHP.exe
  C:\Windows\System\kwYCrHP.exe
  2⤵
  PID:8068
- C:\Windows\System\pRFnkta.exe
  C:\Windows\System\pRFnkta.exe
  2⤵
  PID:8092
- C:\Windows\System\MdgJVPC.exe
  C:\Windows\System\MdgJVPC.exe
  2⤵
  PID:8128
- C:\Windows\System\iELYOJl.exe
  C:\Windows\System\iELYOJl.exe
  2⤵
  PID:8156
- C:\Windows\System\agIVhJD.exe
  C:\Windows\System\agIVhJD.exe
  2⤵
  PID:7180
- C:\Windows\System\USxxlpD.exe
  C:\Windows\System\USxxlpD.exe
  2⤵
  PID:7204
- C:\Windows\System\SFnhisB.exe
  C:\Windows\System\SFnhisB.exe
  2⤵
  PID:7272
- C:\Windows\System\iXtXdHL.exe
  C:\Windows\System\iXtXdHL.exe
  2⤵
  PID:7368
- C:\Windows\System\DtjtTwK.exe
  C:\Windows\System\DtjtTwK.exe
  2⤵
  PID:7436
- C:\Windows\System\nEXTQIT.exe
  C:\Windows\System\nEXTQIT.exe
  2⤵
  PID:7496
- C:\Windows\System\AsjISiZ.exe
  C:\Windows\System\AsjISiZ.exe
  2⤵
  PID:7560
- C:\Windows\System\aXpxgxu.exe
  C:\Windows\System\aXpxgxu.exe
  2⤵
  PID:7640
- C:\Windows\System\lzDUCrS.exe
  C:\Windows\System\lzDUCrS.exe
  2⤵
  PID:7732
- C:\Windows\System\hsNrbbD.exe
  C:\Windows\System\hsNrbbD.exe
  2⤵
  PID:7796
- C:\Windows\System\qBQmesK.exe
  C:\Windows\System\qBQmesK.exe
  2⤵
  PID:7828
- C:\Windows\System\XCDTbBq.exe
  C:\Windows\System\XCDTbBq.exe
  2⤵
  PID:7876
- C:\Windows\System\EFrdYvq.exe
  C:\Windows\System\EFrdYvq.exe
  2⤵
  PID:7968
- C:\Windows\System\mZzLGVt.exe
  C:\Windows\System\mZzLGVt.exe
  2⤵
  PID:8012
- C:\Windows\System\sXdWBVo.exe
  C:\Windows\System\sXdWBVo.exe
  2⤵
  PID:8084
- C:\Windows\System\EiImXhy.exe
  C:\Windows\System\EiImXhy.exe
  2⤵
  PID:8144
- C:\Windows\System\dSGlCMw.exe
  C:\Windows\System\dSGlCMw.exe
  2⤵
  PID:7216
- C:\Windows\System\gEceILl.exe
  C:\Windows\System\gEceILl.exe
  2⤵
  PID:7408
- C:\Windows\System\McCdfON.exe
  C:\Windows\System\McCdfON.exe
  2⤵
  PID:7480
- C:\Windows\System\BCocSui.exe
  C:\Windows\System\BCocSui.exe
  2⤵
  PID:7648
- C:\Windows\System\hHdMWLz.exe
  C:\Windows\System\hHdMWLz.exe
  2⤵
  PID:7944
- C:\Windows\System\ILjyMbR.exe
  C:\Windows\System\ILjyMbR.exe
  2⤵
  PID:8056
- C:\Windows\System\MZdTvUa.exe
  C:\Windows\System\MZdTvUa.exe
  2⤵
  PID:7184
- C:\Windows\System\KaKBjWv.exe
  C:\Windows\System\KaKBjWv.exe
  2⤵
  PID:7468
- C:\Windows\System\AEoZJCK.exe
  C:\Windows\System\AEoZJCK.exe
  2⤵
  PID:7792
- C:\Windows\System\VZkQcbM.exe
  C:\Windows\System\VZkQcbM.exe
  2⤵
  PID:7356
- C:\Windows\System\giizyZh.exe
  C:\Windows\System\giizyZh.exe
  2⤵
  PID:8124
- C:\Windows\System\NXyFDrb.exe
  C:\Windows\System\NXyFDrb.exe
  2⤵
  PID:8212
- C:\Windows\System\hbYEwgW.exe
  C:\Windows\System\hbYEwgW.exe
  2⤵
  PID:8228
- C:\Windows\System\ZdmklrZ.exe
  C:\Windows\System\ZdmklrZ.exe
  2⤵
  PID:8256
- C:\Windows\System\uEpGhic.exe
  C:\Windows\System\uEpGhic.exe
  2⤵
  PID:8288
- C:\Windows\System\HbJoYev.exe
  C:\Windows\System\HbJoYev.exe
  2⤵
  PID:8320
- C:\Windows\System\kQVbkgL.exe
  C:\Windows\System\kQVbkgL.exe
  2⤵
  PID:8352
- C:\Windows\System\WGxwRbw.exe
  C:\Windows\System\WGxwRbw.exe
  2⤵
  PID:8380
- C:\Windows\System\pilRqix.exe
  C:\Windows\System\pilRqix.exe
  2⤵
  PID:8408
- C:\Windows\System\axEvvpx.exe
  C:\Windows\System\axEvvpx.exe
  2⤵
  PID:8436
- C:\Windows\System\HTOkSFI.exe
  C:\Windows\System\HTOkSFI.exe
  2⤵
  PID:8464
- C:\Windows\System\MMNAgOR.exe
  C:\Windows\System\MMNAgOR.exe
  2⤵
  PID:8492
- C:\Windows\System\yVJliQQ.exe
  C:\Windows\System\yVJliQQ.exe
  2⤵
  PID:8520
- C:\Windows\System\uyuunHa.exe
  C:\Windows\System\uyuunHa.exe
  2⤵
  PID:8548
- C:\Windows\System\nFwfrnS.exe
  C:\Windows\System\nFwfrnS.exe
  2⤵
  PID:8576
- C:\Windows\System\BOyBwPH.exe
  C:\Windows\System\BOyBwPH.exe
  2⤵
  PID:8604
- C:\Windows\System\ucqxVMd.exe
  C:\Windows\System\ucqxVMd.exe
  2⤵
  PID:8632
- C:\Windows\System\HlBibpH.exe
  C:\Windows\System\HlBibpH.exe
  2⤵
  PID:8660
- C:\Windows\System\mbiTttZ.exe
  C:\Windows\System\mbiTttZ.exe
  2⤵
  PID:8688
- C:\Windows\System\tKqQADr.exe
  C:\Windows\System\tKqQADr.exe
  2⤵
  PID:8704
- C:\Windows\System\HgdSLwq.exe
  C:\Windows\System\HgdSLwq.exe
  2⤵
  PID:8724
- C:\Windows\System\hjYHnKL.exe
  C:\Windows\System\hjYHnKL.exe
  2⤵
  PID:8748
- C:\Windows\System\oEDsnwC.exe
  C:\Windows\System\oEDsnwC.exe
  2⤵
  PID:8776
- C:\Windows\System\rCiXLNO.exe
  C:\Windows\System\rCiXLNO.exe
  2⤵
  PID:8804
- C:\Windows\System\EKIqEVD.exe
  C:\Windows\System\EKIqEVD.exe
  2⤵
  PID:8832
- C:\Windows\System\nQtaEqv.exe
  C:\Windows\System\nQtaEqv.exe
  2⤵
  PID:8860
- C:\Windows\System\YcpmfYe.exe
  C:\Windows\System\YcpmfYe.exe
  2⤵
  PID:8884
- C:\Windows\System\djgzfqv.exe
  C:\Windows\System\djgzfqv.exe
  2⤵
  PID:8904
- C:\Windows\System\sHulJpp.exe
  C:\Windows\System\sHulJpp.exe
  2⤵
  PID:8932
- C:\Windows\System\KcexlUb.exe
  C:\Windows\System\KcexlUb.exe
  2⤵
  PID:8960
- C:\Windows\System\cmCSzRz.exe
  C:\Windows\System\cmCSzRz.exe
  2⤵
  PID:8980
- C:\Windows\System\ZaDSZmG.exe
  C:\Windows\System\ZaDSZmG.exe
  2⤵
  PID:9008
- C:\Windows\System\hsHfhaF.exe
  C:\Windows\System\hsHfhaF.exe
  2⤵
  PID:9028
- C:\Windows\System\wbFtKbL.exe
  C:\Windows\System\wbFtKbL.exe
  2⤵
  PID:9056
- C:\Windows\System\EyRAJyI.exe
  C:\Windows\System\EyRAJyI.exe
  2⤵
  PID:9076
- C:\Windows\System\pamDYOV.exe
  C:\Windows\System\pamDYOV.exe
  2⤵
  PID:9092
- C:\Windows\System\cHOZRJX.exe
  C:\Windows\System\cHOZRJX.exe
  2⤵
  PID:9120
- C:\Windows\System\sbAicfJ.exe
  C:\Windows\System\sbAicfJ.exe
  2⤵
  PID:9156
- C:\Windows\System\UruqJnm.exe
  C:\Windows\System\UruqJnm.exe
  2⤵
  PID:9192
- C:\Windows\System\cksPcgL.exe
  C:\Windows\System\cksPcgL.exe
  2⤵
  PID:7956
- C:\Windows\System\QDxrWWf.exe
  C:\Windows\System\QDxrWWf.exe
  2⤵
  PID:8252
- C:\Windows\System\CBgrWtP.exe
  C:\Windows\System\CBgrWtP.exe
  2⤵
  PID:8316
- C:\Windows\System\ENwsAep.exe
  C:\Windows\System\ENwsAep.exe
  2⤵
  PID:8392
- C:\Windows\System\FQDXxra.exe
  C:\Windows\System\FQDXxra.exe
  2⤵
  PID:8460
- C:\Windows\System\qAyVDBJ.exe
  C:\Windows\System\qAyVDBJ.exe
  2⤵
  PID:8540
- C:\Windows\System\XtyexwQ.exe
  C:\Windows\System\XtyexwQ.exe
  2⤵
  PID:8588
- C:\Windows\System\fuuGtCI.exe
  C:\Windows\System\fuuGtCI.exe
  2⤵
  PID:8656
- C:\Windows\System\AZiGzHa.exe
  C:\Windows\System\AZiGzHa.exe
  2⤵
  PID:8732
- C:\Windows\System\QZlctXK.exe
  C:\Windows\System\QZlctXK.exe
  2⤵
  PID:8796
- C:\Windows\System\DQxhjyK.exe
  C:\Windows\System\DQxhjyK.exe
  2⤵
  PID:8920
- C:\Windows\System\JHIlxrN.exe
  C:\Windows\System\JHIlxrN.exe
  2⤵
  PID:8916
- C:\Windows\System\dVWozDc.exe
  C:\Windows\System\dVWozDc.exe
  2⤵
  PID:8120
- C:\Windows\System\CDPxilM.exe
  C:\Windows\System\CDPxilM.exe
  2⤵
  PID:8976
- C:\Windows\System\jLwrsyD.exe
  C:\Windows\System\jLwrsyD.exe
  2⤵
  PID:9108
- C:\Windows\System\Jcbenha.exe
  C:\Windows\System\Jcbenha.exe
  2⤵
  PID:9204
- C:\Windows\System\XoJfYwx.exe
  C:\Windows\System\XoJfYwx.exe
  2⤵
  PID:9132
- C:\Windows\System\bQgMTgZ.exe
  C:\Windows\System\bQgMTgZ.exe
  2⤵
  PID:8448
- C:\Windows\System\JKqYpEn.exe
  C:\Windows\System\JKqYpEn.exe
  2⤵
  PID:8376
- C:\Windows\System\nGBPCdO.exe
  C:\Windows\System\nGBPCdO.exe
  2⤵
  PID:8560
- C:\Windows\System\rRbCJMr.exe
  C:\Windows\System\rRbCJMr.exe
  2⤵
  PID:8756
- C:\Windows\System\JANnpCJ.exe
  C:\Windows\System\JANnpCJ.exe
  2⤵
  PID:8876
- C:\Windows\System\dOIuMlv.exe
  C:\Windows\System\dOIuMlv.exe
  2⤵
  PID:9112
- C:\Windows\System\PAWtgAJ.exe
  C:\Windows\System\PAWtgAJ.exe
  2⤵
  PID:8296
- C:\Windows\System\mjRWNtm.exe
  C:\Windows\System\mjRWNtm.exe
  2⤵
  PID:8816
- C:\Windows\System\dOPBHAt.exe
  C:\Windows\System\dOPBHAt.exe
  2⤵
  PID:8628
- C:\Windows\System\aNIEqNx.exe
  C:\Windows\System\aNIEqNx.exe
  2⤵
  PID:9240
- C:\Windows\System\ZPbvCZd.exe
  C:\Windows\System\ZPbvCZd.exe
  2⤵
  PID:9280
- C:\Windows\System\ZXQUdSy.exe
  C:\Windows\System\ZXQUdSy.exe
  2⤵
  PID:9300
- C:\Windows\System\EmjhVNR.exe
  C:\Windows\System\EmjhVNR.exe
  2⤵
  PID:9324
- C:\Windows\System\hISqHOQ.exe
  C:\Windows\System\hISqHOQ.exe
  2⤵
  PID:9352
- C:\Windows\System\wXcybih.exe
  C:\Windows\System\wXcybih.exe
  2⤵
  PID:9376
- C:\Windows\System\aqtTppa.exe
  C:\Windows\System\aqtTppa.exe
  2⤵
  PID:9404
- C:\Windows\System\ErxxtNZ.exe
  C:\Windows\System\ErxxtNZ.exe
  2⤵
  PID:9440
- C:\Windows\System\lviVPVB.exe
  C:\Windows\System\lviVPVB.exe
  2⤵
  PID:9468
- C:\Windows\System\fbyRXUL.exe
  C:\Windows\System\fbyRXUL.exe
  2⤵
  PID:9496
- C:\Windows\System\cbzqnAf.exe
  C:\Windows\System\cbzqnAf.exe
  2⤵
  PID:9516
- C:\Windows\System\kwVPFPN.exe
  C:\Windows\System\kwVPFPN.exe
  2⤵
  PID:9544
- C:\Windows\System\BXZVWbL.exe
  C:\Windows\System\BXZVWbL.exe
  2⤵
  PID:9564
- C:\Windows\System\hVjUQRV.exe
  C:\Windows\System\hVjUQRV.exe
  2⤵
  PID:9592
- C:\Windows\System\bfyjYde.exe
  C:\Windows\System\bfyjYde.exe
  2⤵
  PID:9612
- C:\Windows\System\YxXWuJm.exe
  C:\Windows\System\YxXWuJm.exe
  2⤵
  PID:9644
- C:\Windows\System\rdwJtOx.exe
  C:\Windows\System\rdwJtOx.exe
  2⤵
  PID:9676
- C:\Windows\System\sHwYYIm.exe
  C:\Windows\System\sHwYYIm.exe
  2⤵
  PID:9696
- C:\Windows\System\sXxAqSb.exe
  C:\Windows\System\sXxAqSb.exe
  2⤵
  PID:9728
- C:\Windows\System\sjjPbua.exe
  C:\Windows\System\sjjPbua.exe
  2⤵
  PID:9752
- C:\Windows\System\bWwTmhS.exe
  C:\Windows\System\bWwTmhS.exe
  2⤵
  PID:9772
- C:\Windows\System\WifHKlH.exe
  C:\Windows\System\WifHKlH.exe
  2⤵
  PID:9808
- C:\Windows\System\KcXdVlU.exe
  C:\Windows\System\KcXdVlU.exe
  2⤵
  PID:9844
- C:\Windows\System\pSBKzjK.exe
  C:\Windows\System\pSBKzjK.exe
  2⤵
  PID:9876
- C:\Windows\System\pNyADqE.exe
  C:\Windows\System\pNyADqE.exe
  2⤵
  PID:9908
- C:\Windows\System\AjkjvLC.exe
  C:\Windows\System\AjkjvLC.exe
  2⤵
  PID:9944
- C:\Windows\System\KpiAvZM.exe
  C:\Windows\System\KpiAvZM.exe
  2⤵
  PID:9964
- C:\Windows\System\aUrmxCi.exe
  C:\Windows\System\aUrmxCi.exe
  2⤵
  PID:9984
- C:\Windows\System\yUOsZua.exe
  C:\Windows\System\yUOsZua.exe
  2⤵
  PID:10000
- C:\Windows\System\zEIzXhQ.exe
  C:\Windows\System\zEIzXhQ.exe
  2⤵
  PID:10028
- C:\Windows\System\kMrbFZU.exe
  C:\Windows\System\kMrbFZU.exe
  2⤵
  PID:10060
- C:\Windows\System\FhZxrDe.exe
  C:\Windows\System\FhZxrDe.exe
  2⤵
  PID:10092
- C:\Windows\System\mgMyQgv.exe
  C:\Windows\System\mgMyQgv.exe
  2⤵
  PID:10124
- C:\Windows\System\VRxItLl.exe
  C:\Windows\System\VRxItLl.exe
  2⤵
  PID:10156
- C:\Windows\System\lZsmpAH.exe
  C:\Windows\System\lZsmpAH.exe
  2⤵
  PID:10184
- C:\Windows\System\lufnQqp.exe
  C:\Windows\System\lufnQqp.exe
  2⤵
  PID:10208
- C:\Windows\System\VBurUHn.exe
  C:\Windows\System\VBurUHn.exe
  2⤵
  PID:10236
- C:\Windows\System\uxwLaJQ.exe
  C:\Windows\System\uxwLaJQ.exe
  2⤵
  PID:9144
- C:\Windows\System\ZORbJBX.exe
  C:\Windows\System\ZORbJBX.exe
  2⤵
  PID:8340
- C:\Windows\System\IIMabRe.exe
  C:\Windows\System\IIMabRe.exe
  2⤵
  PID:8944
- C:\Windows\System\PXuYuGm.exe
  C:\Windows\System\PXuYuGm.exe
  2⤵
  PID:9424
- C:\Windows\System\GlIgFnv.exe
  C:\Windows\System\GlIgFnv.exe
  2⤵
  PID:9464
- C:\Windows\System\maciTyc.exe
  C:\Windows\System\maciTyc.exe
  2⤵
  PID:9540
- C:\Windows\System\tNkMISg.exe
  C:\Windows\System\tNkMISg.exe
  2⤵
  PID:9556
- C:\Windows\System\DOInDAT.exe
  C:\Windows\System\DOInDAT.exe
  2⤵
  PID:9624
- C:\Windows\System\hgBbeXc.exe
  C:\Windows\System\hgBbeXc.exe
  2⤵
  PID:9668
- C:\Windows\System\cfAYzJS.exe
  C:\Windows\System\cfAYzJS.exe
  2⤵
  PID:9768
- C:\Windows\System\xsxhXqs.exe
  C:\Windows\System\xsxhXqs.exe
  2⤵
  PID:9840
- C:\Windows\System\ISmdmSe.exe
  C:\Windows\System\ISmdmSe.exe
  2⤵
  PID:9920
- C:\Windows\System\UvDWxAR.exe
  C:\Windows\System\UvDWxAR.exe
  2⤵
  PID:9960
- C:\Windows\System\cwhMFht.exe
  C:\Windows\System\cwhMFht.exe
  2⤵
  PID:10104
- C:\Windows\System\KiMReoY.exe
  C:\Windows\System\KiMReoY.exe
  2⤵
  PID:10144
- C:\Windows\System\pLBzHnr.exe
  C:\Windows\System\pLBzHnr.exe
  2⤵
  PID:10196
- C:\Windows\System\wBlXJTZ.exe
  C:\Windows\System\wBlXJTZ.exe
  2⤵
  PID:9004
- C:\Windows\System\UdLCXUF.exe
  C:\Windows\System\UdLCXUF.exe
  2⤵
  PID:9392
- C:\Windows\System\yUbSMym.exe
  C:\Windows\System\yUbSMym.exe
  2⤵
  PID:9372
- C:\Windows\System\fvqKshU.exe
  C:\Windows\System\fvqKshU.exe
  2⤵
  PID:9576
- C:\Windows\System\BibzpJy.exe
  C:\Windows\System\BibzpJy.exe
  2⤵
  PID:9748
- C:\Windows\System\WSwJXXP.exe
  C:\Windows\System\WSwJXXP.exe
  2⤵
  PID:9860
- C:\Windows\System\vLopcOZ.exe
  C:\Windows\System\vLopcOZ.exe
  2⤵
  PID:10088
- C:\Windows\System\zWBeKQl.exe
  C:\Windows\System\zWBeKQl.exe
  2⤵
  PID:9400
- C:\Windows\System\WwkawmT.exe
  C:\Windows\System\WwkawmT.exe
  2⤵
  PID:10036
- C:\Windows\System\cKApWOk.exe
  C:\Windows\System\cKApWOk.exe
  2⤵
  PID:10180
- C:\Windows\System\NksjZAD.exe
  C:\Windows\System\NksjZAD.exe
  2⤵
  PID:9652
- C:\Windows\System\AHgGVdr.exe
  C:\Windows\System\AHgGVdr.exe
  2⤵
  PID:10120
- C:\Windows\System\fRfUxeY.exe
  C:\Windows\System\fRfUxeY.exe
  2⤵
  PID:10268
- C:\Windows\System\QnKjrnJ.exe
  C:\Windows\System\QnKjrnJ.exe
  2⤵
  PID:10288
- C:\Windows\System\gOmGHwe.exe
  C:\Windows\System\gOmGHwe.exe
  2⤵
  PID:10312
- C:\Windows\System\VrbjfUH.exe
  C:\Windows\System\VrbjfUH.exe
  2⤵
  PID:10328
- C:\Windows\System\SUshvpS.exe
  C:\Windows\System\SUshvpS.exe
  2⤵
  PID:10352
- C:\Windows\System\oyvHQlU.exe
  C:\Windows\System\oyvHQlU.exe
  2⤵
  PID:10388
- C:\Windows\System\WLyNUAc.exe
  C:\Windows\System\WLyNUAc.exe
  2⤵
  PID:10420
- C:\Windows\System\xtDdfbA.exe
  C:\Windows\System\xtDdfbA.exe
  2⤵
  PID:10444
- C:\Windows\System\XDdgrqu.exe
  C:\Windows\System\XDdgrqu.exe
  2⤵
  PID:10480
- C:\Windows\System\LRyfAEw.exe
  C:\Windows\System\LRyfAEw.exe
  2⤵
  PID:10512
- C:\Windows\System\UbrvXAu.exe
  C:\Windows\System\UbrvXAu.exe
  2⤵
  PID:10532
- C:\Windows\System\zTFjrHh.exe
  C:\Windows\System\zTFjrHh.exe
  2⤵
  PID:10556
- C:\Windows\System\KcCWFvt.exe
  C:\Windows\System\KcCWFvt.exe
  2⤵
  PID:10584
- C:\Windows\System\xBsbjlJ.exe
  C:\Windows\System\xBsbjlJ.exe
  2⤵
  PID:10612
- C:\Windows\System\JZrfbqd.exe
  C:\Windows\System\JZrfbqd.exe
  2⤵
  PID:10652
- C:\Windows\System\VeWKSdX.exe
  C:\Windows\System\VeWKSdX.exe
  2⤵
  PID:10672
- C:\Windows\System\nhEymJs.exe
  C:\Windows\System\nhEymJs.exe
  2⤵
  PID:10688
- C:\Windows\System\lgtIhjW.exe
  C:\Windows\System\lgtIhjW.exe
  2⤵
  PID:10724
- C:\Windows\System\vATmXGq.exe
  C:\Windows\System\vATmXGq.exe
  2⤵
  PID:10768
- C:\Windows\System\pbRLFVj.exe
  C:\Windows\System\pbRLFVj.exe
  2⤵
  PID:10792
- C:\Windows\System\bmPuKrW.exe
  C:\Windows\System\bmPuKrW.exe
  2⤵
  PID:10820
- C:\Windows\System\jSfNKsq.exe
  C:\Windows\System\jSfNKsq.exe
  2⤵
  PID:10844
- C:\Windows\System\hFCXLuS.exe
  C:\Windows\System\hFCXLuS.exe
  2⤵
  PID:10880
- C:\Windows\System\tuhtNoR.exe
  C:\Windows\System\tuhtNoR.exe
  2⤵
  PID:10900
- C:\Windows\System\hnpfCle.exe
  C:\Windows\System\hnpfCle.exe
  2⤵
  PID:10928
- C:\Windows\System\DpBBsHT.exe
  C:\Windows\System\DpBBsHT.exe
  2⤵
  PID:10948
- C:\Windows\System\JeHRFWY.exe
  C:\Windows\System\JeHRFWY.exe
  2⤵
  PID:10976
- C:\Windows\System\OPiytWj.exe
  C:\Windows\System\OPiytWj.exe
  2⤵
  PID:11004
- C:\Windows\System\pNayDBq.exe
  C:\Windows\System\pNayDBq.exe
  2⤵
  PID:11032
- C:\Windows\System\BTBFpDe.exe
  C:\Windows\System\BTBFpDe.exe
  2⤵
  PID:11060
- C:\Windows\System\VMmrapc.exe
  C:\Windows\System\VMmrapc.exe
  2⤵
  PID:11092
- C:\Windows\System\BIlEYoT.exe
  C:\Windows\System\BIlEYoT.exe
  2⤵
  PID:11124
- C:\Windows\System\HluGhiT.exe
  C:\Windows\System\HluGhiT.exe
  2⤵
  PID:11148
- C:\Windows\System\rifJDzj.exe
  C:\Windows\System\rifJDzj.exe
  2⤵
  PID:11176
- C:\Windows\System\whlKayO.exe
  C:\Windows\System\whlKayO.exe
  2⤵
  PID:11216
- C:\Windows\System\imDkECs.exe
  C:\Windows\System\imDkECs.exe
  2⤵
  PID:11236
- C:\Windows\System\ayuwdIr.exe
  C:\Windows\System\ayuwdIr.exe
  2⤵
  PID:10072
- C:\Windows\System\jZIMShr.exe
  C:\Windows\System\jZIMShr.exe
  2⤵
  PID:9580
- C:\Windows\System\ErHQNxb.exe
  C:\Windows\System\ErHQNxb.exe
  2⤵
  PID:10340
- C:\Windows\System\lhJOxmy.exe
  C:\Windows\System\lhJOxmy.exe
  2⤵
  PID:10376
- C:\Windows\System\ueSpxmS.exe
  C:\Windows\System\ueSpxmS.exe
  2⤵
  PID:10452
- C:\Windows\System\uHdAyWE.exe
  C:\Windows\System\uHdAyWE.exe
  2⤵
  PID:10520
- C:\Windows\System\JPzIrXc.exe
  C:\Windows\System\JPzIrXc.exe
  2⤵
  PID:10576
- C:\Windows\System\LBBbWZZ.exe
  C:\Windows\System\LBBbWZZ.exe
  2⤵
  PID:10624
- C:\Windows\System\eccYQzK.exe
  C:\Windows\System\eccYQzK.exe
  2⤵
  PID:10664
- C:\Windows\System\NxBXZzZ.exe
  C:\Windows\System\NxBXZzZ.exe
  2⤵
  PID:10832
- C:\Windows\System\yNWFtCx.exe
  C:\Windows\System\yNWFtCx.exe
  2⤵
  PID:10912
- C:\Windows\System\ylsXBEi.exe
  C:\Windows\System\ylsXBEi.exe
  2⤵
  PID:10864
- C:\Windows\System\LuUehBE.exe
  C:\Windows\System\LuUehBE.exe
  2⤵
  PID:11024
- C:\Windows\System\takkpEA.exe
  C:\Windows\System\takkpEA.exe
  2⤵
  PID:11068
- C:\Windows\System\KHHPNek.exe
  C:\Windows\System\KHHPNek.exe
  2⤵
  PID:11136
- C:\Windows\System\idpbnJB.exe
  C:\Windows\System\idpbnJB.exe
  2⤵
  PID:11088
- C:\Windows\System\KJHTHlr.exe
  C:\Windows\System\KJHTHlr.exe
  2⤵
  PID:9664
- C:\Windows\System\BuHaxWh.exe
  C:\Windows\System\BuHaxWh.exe
  2⤵
  PID:10320
- C:\Windows\System\DluUPhK.exe
  C:\Windows\System\DluUPhK.exe
  2⤵
  PID:10500
- C:\Windows\System\lBUBCsN.exe
  C:\Windows\System\lBUBCsN.exe
  2⤵
  PID:10628
- C:\Windows\System\IGzNQAW.exe
  C:\Windows\System\IGzNQAW.exe
  2⤵
  PID:10648
- C:\Windows\System\UNFkTCp.exe
  C:\Windows\System\UNFkTCp.exe
  2⤵
  PID:10916
- C:\Windows\System\nTNBthg.exe
  C:\Windows\System\nTNBthg.exe
  2⤵
  PID:11256
- C:\Windows\System\sjzyWId.exe
  C:\Windows\System\sjzyWId.exe
  2⤵
  PID:10276
- C:\Windows\System\vqihldi.exe
  C:\Windows\System\vqihldi.exe
  2⤵
  PID:11276
- C:\Windows\System\PZmjtxb.exe
  C:\Windows\System\PZmjtxb.exe
  2⤵
  PID:11304
- C:\Windows\System\QJStRYz.exe
  C:\Windows\System\QJStRYz.exe
  2⤵
  PID:11332
- C:\Windows\System\QfStoYq.exe
  C:\Windows\System\QfStoYq.exe
  2⤵
  PID:11360
- C:\Windows\System\iOSiGNo.exe
  C:\Windows\System\iOSiGNo.exe
  2⤵
  PID:11384
- C:\Windows\System\CaROuwy.exe
  C:\Windows\System\CaROuwy.exe
  2⤵
  PID:11408
- C:\Windows\System\xFPMVdY.exe
  C:\Windows\System\xFPMVdY.exe
  2⤵
  PID:11444
- C:\Windows\System\BJdUseR.exe
  C:\Windows\System\BJdUseR.exe
  2⤵
  PID:11492
- C:\Windows\System\lkgMkAA.exe
  C:\Windows\System\lkgMkAA.exe
  2⤵
  PID:11520
- C:\Windows\System\njnVCAK.exe
  C:\Windows\System\njnVCAK.exe
  2⤵
  PID:11548
- C:\Windows\System\jVrFpkE.exe
  C:\Windows\System\jVrFpkE.exe
  2⤵
  PID:11572
- C:\Windows\System\KkRDVsQ.exe
  C:\Windows\System\KkRDVsQ.exe
  2⤵
  PID:11600
- C:\Windows\System\FteQCjo.exe
  C:\Windows\System\FteQCjo.exe
  2⤵
  PID:11624
- C:\Windows\System\ItdjqUL.exe
  C:\Windows\System\ItdjqUL.exe
  2⤵
  PID:11648
- C:\Windows\System\NnjQMjo.exe
  C:\Windows\System\NnjQMjo.exe
  2⤵
  PID:11676
- C:\Windows\System\oRpBgYy.exe
  C:\Windows\System\oRpBgYy.exe
  2⤵
  PID:11700
- C:\Windows\System\fiKibfJ.exe
  C:\Windows\System\fiKibfJ.exe
  2⤵
  PID:11728
- C:\Windows\System\hvAhyLx.exe
  C:\Windows\System\hvAhyLx.exe
  2⤵
  PID:11748
- C:\Windows\System\BcQYSln.exe
  C:\Windows\System\BcQYSln.exe
  2⤵
  PID:11780
- C:\Windows\System\jrOlGvW.exe
  C:\Windows\System\jrOlGvW.exe
  2⤵
  PID:11808
- C:\Windows\System\fbXybsp.exe
  C:\Windows\System\fbXybsp.exe
  2⤵
  PID:11832
- C:\Windows\System\yKoYhES.exe
  C:\Windows\System\yKoYhES.exe
  2⤵
  PID:11848
- C:\Windows\System\iANzxgC.exe
  C:\Windows\System\iANzxgC.exe
  2⤵
  PID:11880
- C:\Windows\System\JKRXxRi.exe
  C:\Windows\System\JKRXxRi.exe
  2⤵
  PID:11908
- C:\Windows\System\zpXMUtf.exe
  C:\Windows\System\zpXMUtf.exe
  2⤵
  PID:11944
- C:\Windows\System\FqYSGes.exe
  C:\Windows\System\FqYSGes.exe
  2⤵
  PID:11972
- C:\Windows\System\YmLawlJ.exe
  C:\Windows\System\YmLawlJ.exe
  2⤵
  PID:12000
- C:\Windows\System\PAmTPtS.exe
  C:\Windows\System\PAmTPtS.exe
  2⤵
  PID:12032
- C:\Windows\System\DTMHEtu.exe
  C:\Windows\System\DTMHEtu.exe
  2⤵
  PID:12060
- C:\Windows\System\eIIByzB.exe
  C:\Windows\System\eIIByzB.exe
  2⤵
  PID:12088
- C:\Windows\System\lgdeHEG.exe
  C:\Windows\System\lgdeHEG.exe
  2⤵
  PID:12116
- C:\Windows\System\hEVEjiT.exe
  C:\Windows\System\hEVEjiT.exe
  2⤵
  PID:12144
- C:\Windows\System\uAUqhTH.exe
  C:\Windows\System\uAUqhTH.exe
  2⤵
  PID:12172
- C:\Windows\System\THGiwbt.exe
  C:\Windows\System\THGiwbt.exe
  2⤵
  PID:12200
- C:\Windows\System\wfcpOAt.exe
  C:\Windows\System\wfcpOAt.exe
  2⤵
  PID:12236
- C:\Windows\System\FikYkev.exe
  C:\Windows\System\FikYkev.exe
  2⤵
  PID:12260
- C:\Windows\System\XpqljpU.exe
  C:\Windows\System\XpqljpU.exe
  2⤵
  PID:10944
- C:\Windows\System\RnJQHOx.exe
  C:\Windows\System\RnJQHOx.exe
  2⤵
  PID:10368
- C:\Windows\System\vZxbQEH.exe
  C:\Windows\System\vZxbQEH.exe
  2⤵
  PID:11288
- C:\Windows\System\htJdqPC.exe
  C:\Windows\System\htJdqPC.exe
  2⤵
  PID:11416
- C:\Windows\System\yagMkQx.exe
  C:\Windows\System\yagMkQx.exe
  2⤵
  PID:11312
- C:\Windows\System\DxRqZDP.exe
  C:\Windows\System\DxRqZDP.exe
  2⤵
  PID:10996
- C:\Windows\System\vdaiYNf.exe
  C:\Windows\System\vdaiYNf.exe
  2⤵
  PID:11488
- C:\Windows\System\JNTfAFD.exe
  C:\Windows\System\JNTfAFD.exe
  2⤵
  PID:11584
- C:\Windows\System\WnZpsAZ.exe
  C:\Windows\System\WnZpsAZ.exe
  2⤵
  PID:11664
- C:\Windows\System\SXCLqba.exe
  C:\Windows\System\SXCLqba.exe
  2⤵
  PID:11760
- C:\Windows\System\bpkCGWn.exe
  C:\Windows\System\bpkCGWn.exe
  2⤵
  PID:11792
- C:\Windows\System\VXbzyWd.exe
  C:\Windows\System\VXbzyWd.exe
  2⤵
  PID:11696
- C:\Windows\System\qPTELxC.exe
  C:\Windows\System\qPTELxC.exe
  2⤵
  PID:11924
- C:\Windows\System\YcEPHLJ.exe
  C:\Windows\System\YcEPHLJ.exe
  2⤵
  PID:11872
- C:\Windows\System\dJemAjL.exe
  C:\Windows\System\dJemAjL.exe
  2⤵
  PID:12024
- C:\Windows\System\hRVqKZW.exe
  C:\Windows\System\hRVqKZW.exe
  2⤵
  PID:11956
- C:\Windows\System\gLfSbcg.exe
  C:\Windows\System\gLfSbcg.exe
  2⤵
  PID:12180
- C:\Windows\System\qePEaTC.exe
  C:\Windows\System\qePEaTC.exe
  2⤵
  PID:12160
- C:\Windows\System\oUYGDqJ.exe
  C:\Windows\System\oUYGDqJ.exe
  2⤵
  PID:10476
- C:\Windows\System\eymDgwx.exe
  C:\Windows\System\eymDgwx.exe
  2⤵
  PID:12268
- C:\Windows\System\EbVwroA.exe
  C:\Windows\System\EbVwroA.exe
  2⤵
  PID:11440
- C:\Windows\System\ofGczzu.exe
  C:\Windows\System\ofGczzu.exe
  2⤵
  PID:11544
- C:\Windows\System\wadCPBo.exe
  C:\Windows\System\wadCPBo.exe
  2⤵
  PID:11580
- C:\Windows\System\lEoWDea.exe
  C:\Windows\System\lEoWDea.exe
  2⤵
  PID:12008
- C:\Windows\System\BTiVOxq.exe
  C:\Windows\System\BTiVOxq.exe
  2⤵
  PID:12164
- C:\Windows\System\RAumEOa.exe
  C:\Windows\System\RAumEOa.exe
  2⤵
  PID:11896
- C:\Windows\System\gEkeZvA.exe
  C:\Windows\System\gEkeZvA.exe
  2⤵
  PID:12292
- C:\Windows\System\UYdKuwU.exe
  C:\Windows\System\UYdKuwU.exe
  2⤵
  PID:12320
- C:\Windows\System\MDwxDlc.exe
  C:\Windows\System\MDwxDlc.exe
  2⤵
  PID:12336
- C:\Windows\System\UdpukGx.exe
  C:\Windows\System\UdpukGx.exe
  2⤵
  PID:12364
- C:\Windows\System\fNAKlNt.exe
  C:\Windows\System\fNAKlNt.exe
  2⤵
  PID:12388
- C:\Windows\System\oSqylaE.exe
  C:\Windows\System\oSqylaE.exe
  2⤵
  PID:12416
- C:\Windows\System\WtjySSA.exe
  C:\Windows\System\WtjySSA.exe
  2⤵
  PID:12436
- C:\Windows\System\owDAepZ.exe
  C:\Windows\System\owDAepZ.exe
  2⤵
  PID:12452
- C:\Windows\System\PWbkGtx.exe
  C:\Windows\System\PWbkGtx.exe
  2⤵
  PID:12472
- C:\Windows\System\wmHwSJY.exe
  C:\Windows\System\wmHwSJY.exe
  2⤵
  PID:12500
- C:\Windows\System\ybUiaUJ.exe
  C:\Windows\System\ybUiaUJ.exe
  2⤵
  PID:12528
- C:\Windows\System\TxRYvmJ.exe
  C:\Windows\System\TxRYvmJ.exe
  2⤵
  PID:12560
- C:\Windows\System\cDwVzVn.exe
  C:\Windows\System\cDwVzVn.exe
  2⤵
  PID:12584
- C:\Windows\System\IwWSLgZ.exe
  C:\Windows\System\IwWSLgZ.exe
  2⤵
  PID:12608
- C:\Windows\System\YOxWVWf.exe
  C:\Windows\System\YOxWVWf.exe
  2⤵
  PID:12636
- C:\Windows\System\hEEzRRQ.exe
  C:\Windows\System\hEEzRRQ.exe
  2⤵
  PID:12668
- C:\Windows\System\nsenwVC.exe
  C:\Windows\System\nsenwVC.exe
  2⤵
  PID:12692
- C:\Windows\System\ULZHPKd.exe
  C:\Windows\System\ULZHPKd.exe
  2⤵
  PID:12716
- C:\Windows\System\GjZrDOC.exe
  C:\Windows\System\GjZrDOC.exe
  2⤵
  PID:12740
- C:\Windows\System\iTONPBs.exe
  C:\Windows\System\iTONPBs.exe
  2⤵
  PID:12776
- C:\Windows\System\QxZEiku.exe
  C:\Windows\System\QxZEiku.exe
  2⤵
  PID:12800
- C:\Windows\System\XNTRVPM.exe
  C:\Windows\System\XNTRVPM.exe
  2⤵
  PID:12820
- C:\Windows\System\xmfvvSn.exe
  C:\Windows\System\xmfvvSn.exe
  2⤵
  PID:12848
- C:\Windows\System\WUrXylg.exe
  C:\Windows\System\WUrXylg.exe
  2⤵
  PID:12872
- C:\Windows\System\qWFJziL.exe
  C:\Windows\System\qWFJziL.exe
  2⤵
  PID:12892
- C:\Windows\System\xoKCDCy.exe
  C:\Windows\System\xoKCDCy.exe
  2⤵
  PID:12924
- C:\Windows\System\SSTaesu.exe
  C:\Windows\System\SSTaesu.exe
  2⤵
  PID:12956
- C:\Windows\System\NWQRFeq.exe
  C:\Windows\System\NWQRFeq.exe
  2⤵
  PID:12980
- C:\Windows\System\CWQiqhf.exe
  C:\Windows\System\CWQiqhf.exe
  2⤵
  PID:13000
- C:\Windows\System\JLeCIEH.exe
  C:\Windows\System\JLeCIEH.exe
  2⤵
  PID:13020
- C:\Windows\System\aIRiRQy.exe
  C:\Windows\System\aIRiRQy.exe
  2⤵
  PID:13056
- C:\Windows\System\FhflJng.exe
  C:\Windows\System\FhflJng.exe
  2⤵
  PID:13088
- C:\Windows\System\OzJUNtH.exe
  C:\Windows\System\OzJUNtH.exe
  2⤵
  PID:13120
- C:\Windows\System\nsZFGPg.exe
  C:\Windows\System\nsZFGPg.exe
  2⤵
  PID:13156
- C:\Windows\System\qunpMFl.exe
  C:\Windows\System\qunpMFl.exe
  2⤵
  PID:13188
- C:\Windows\System\WHojHiM.exe
  C:\Windows\System\WHojHiM.exe
  2⤵
  PID:13224
- C:\Windows\System\VIeCXrZ.exe
  C:\Windows\System\VIeCXrZ.exe
  2⤵
  PID:13240
- C:\Windows\System\qchGHbk.exe
  C:\Windows\System\qchGHbk.exe
  2⤵
  PID:13268
- C:\Windows\System\rWEWRaO.exe
  C:\Windows\System\rWEWRaO.exe
  2⤵
  PID:13284
- C:\Windows\System\CWXGbGh.exe
  C:\Windows\System\CWXGbGh.exe
  2⤵
  PID:11868
- C:\Windows\System\cKQmslh.exe
  C:\Windows\System\cKQmslh.exe
  2⤵
  PID:11516
- C:\Windows\System\nPbxRsr.exe
  C:\Windows\System\nPbxRsr.exe
  2⤵
  PID:11916
- C:\Windows\System\NwaQJkg.exe
  C:\Windows\System\NwaQJkg.exe
  2⤵
  PID:11632
- C:\Windows\System\vRQiIAg.exe
  C:\Windows\System\vRQiIAg.exe
  2⤵
  PID:12424
- C:\Windows\System\BGtPBes.exe
  C:\Windows\System\BGtPBes.exe
  2⤵
  PID:12480
- C:\Windows\System\dtvhFuH.exe
  C:\Windows\System\dtvhFuH.exe
  2⤵
  PID:9940
- C:\Windows\System\TmTlmVs.exe
  C:\Windows\System\TmTlmVs.exe
  2⤵
  PID:12348
- C:\Windows\System\IpjJQAq.exe
  C:\Windows\System\IpjJQAq.exe
  2⤵
  PID:12624
- C:\Windows\System\lMsinbH.exe
  C:\Windows\System\lMsinbH.exe
  2⤵
  PID:12464
- C:\Windows\System\PoFCTcn.exe
  C:\Windows\System\PoFCTcn.exe
  2⤵
  PID:12516
- C:\Windows\System\cFbFLrs.exe
  C:\Windows\System\cFbFLrs.exe
  2⤵
  PID:12832
- C:\Windows\System\zvBNwhI.exe
  C:\Windows\System\zvBNwhI.exe
  2⤵
  PID:12736
- C:\Windows\System\cjzSAAA.exe
  C:\Windows\System\cjzSAAA.exe
  2⤵
  PID:12908
- C:\Windows\System\CFQzjJj.exe
  C:\Windows\System\CFQzjJj.exe
  2⤵
  PID:12712
- C:\Windows\System\CohIVFQ.exe
  C:\Windows\System\CohIVFQ.exe
  2⤵
  PID:12968
- C:\Windows\System\FcDDoLy.exe
  C:\Windows\System\FcDDoLy.exe
  2⤵
  PID:13128
- C:\Windows\System\LCzHgcx.exe
  C:\Windows\System\LCzHgcx.exe
  2⤵
  PID:13044
- C:\Windows\System\uKjmGrr.exe
  C:\Windows\System\uKjmGrr.exe
  2⤵
  PID:13140
- C:\Windows\System\MzDzAri.exe
  C:\Windows\System\MzDzAri.exe
  2⤵
  PID:12444
- C:\Windows\System\gyOkfrO.exe
  C:\Windows\System\gyOkfrO.exe
  2⤵
  PID:12600
- C:\Windows\System\oJsLHJI.exe
  C:\Windows\System\oJsLHJI.exe
  2⤵
  PID:12356
- C:\Windows\System\OfSccrX.exe
  C:\Windows\System\OfSccrX.exe
  2⤵
  PID:11856
- C:\Windows\System\DgSCeJy.exe
  C:\Windows\System\DgSCeJy.exe
  2⤵
  PID:12596
- C:\Windows\System\WQMclqI.exe
  C:\Windows\System\WQMclqI.exe
  2⤵
  PID:12384
- C:\Windows\System\hhxxsjs.exe
  C:\Windows\System\hhxxsjs.exe
  2⤵
  PID:13076
- C:\Windows\System\gTDNENA.exe
  C:\Windows\System\gTDNENA.exe
  2⤵
  PID:12684
- C:\Windows\System\AaTcvJr.exe
  C:\Windows\System\AaTcvJr.exe
  2⤵
  PID:12576
- C:\Windows\System\xyDOlyE.exe
  C:\Windows\System\xyDOlyE.exe
  2⤵
  PID:12492
- C:\Windows\System\MnGLrGt.exe
  C:\Windows\System\MnGLrGt.exe
  2⤵
  PID:13108
- C:\Windows\System\unxExKS.exe
  C:\Windows\System\unxExKS.exe
  2⤵
  PID:13344
- C:\Windows\System\vYqIhPT.exe
  C:\Windows\System\vYqIhPT.exe
  2⤵
  PID:13364
- C:\Windows\System\kwtbPTq.exe
  C:\Windows\System\kwtbPTq.exe
  2⤵
  PID:13400
- C:\Windows\System\GWFZaLb.exe
  C:\Windows\System\GWFZaLb.exe
  2⤵
  PID:13424
- C:\Windows\System\WxksKkW.exe
  C:\Windows\System\WxksKkW.exe
  2⤵
  PID:13448
- C:\Windows\System\OoNHxpY.exe
  C:\Windows\System\OoNHxpY.exe
  2⤵
  PID:13468
- C:\Windows\System\sglpoSv.exe
  C:\Windows\System\sglpoSv.exe
  2⤵
  PID:13744
- C:\Windows\System\jSBgmiv.exe
  C:\Windows\System\jSBgmiv.exe
  2⤵
  PID:13760
- C:\Windows\System\fMtHUKZ.exe
  C:\Windows\System\fMtHUKZ.exe
  2⤵
  PID:13788
- C:\Windows\System\ktiOKwL.exe
  C:\Windows\System\ktiOKwL.exe
  2⤵
  PID:13804
- C:\Windows\System\NpfPlmr.exe
  C:\Windows\System\NpfPlmr.exe
  2⤵
  PID:13832
- C:\Windows\System\yxnnfCU.exe
  C:\Windows\System\yxnnfCU.exe
  2⤵
  PID:13852
- C:\Windows\System\PuBszYa.exe
  C:\Windows\System\PuBszYa.exe
  2⤵
  PID:13884
- C:\Windows\System\VGlmYvp.exe
  C:\Windows\System\VGlmYvp.exe
  2⤵
  PID:13912
- C:\Windows\System\rSuuDBw.exe
  C:\Windows\System\rSuuDBw.exe
  2⤵
  PID:13944
- C:\Windows\System\mlKMHfk.exe
  C:\Windows\System\mlKMHfk.exe
  2⤵
  PID:13960
- C:\Windows\System\QgPvPqP.exe
  C:\Windows\System\QgPvPqP.exe
  2⤵
  PID:13988
- C:\Windows\System\rRZCSXp.exe
  C:\Windows\System\rRZCSXp.exe
  2⤵
  PID:14016
- C:\Windows\System\GQPehox.exe
  C:\Windows\System\GQPehox.exe
  2⤵
  PID:14044
- C:\Windows\System\gYDFUqY.exe
  C:\Windows\System\gYDFUqY.exe
  2⤵
  PID:14060
- C:\Windows\System\oRrZGLC.exe
  C:\Windows\System\oRrZGLC.exe
  2⤵
  PID:14088
- C:\Windows\System\oeHcSwf.exe
  C:\Windows\System\oeHcSwf.exe
  2⤵
  PID:14112
- C:\Windows\System\xGJNrFt.exe
  C:\Windows\System\xGJNrFt.exe
  2⤵
  PID:14144
- C:\Windows\System\gEBpmxK.exe
  C:\Windows\System\gEBpmxK.exe
  2⤵
  PID:14172
- C:\Windows\System\QqXwMGZ.exe
  C:\Windows\System\QqXwMGZ.exe
  2⤵
  PID:14192
- C:\Windows\System\nWJqpZG.exe
  C:\Windows\System\nWJqpZG.exe
  2⤵
  PID:14236
- C:\Windows\System\DZjBdDe.exe
  C:\Windows\System\DZjBdDe.exe
  2⤵
  PID:14260
- C:\Windows\System\dKnwKlh.exe
  C:\Windows\System\dKnwKlh.exe
  2⤵
  PID:14276
- C:\Windows\System\QWSGCsM.exe
  C:\Windows\System\QWSGCsM.exe
  2⤵
  PID:14304
- C:\Windows\System\VTRMMny.exe
  C:\Windows\System\VTRMMny.exe
  2⤵
  PID:14324
- C:\Windows\System\GcJrggK.exe
  C:\Windows\System\GcJrggK.exe
  2⤵
  PID:13036
- C:\Windows\System\yHQCpLC.exe
  C:\Windows\System\yHQCpLC.exe
  2⤵
  PID:12540
- C:\Windows\System\cPxplDY.exe
  C:\Windows\System\cPxplDY.exe
  2⤵
  PID:12508
- C:\Windows\System\FswgWpg.exe
  C:\Windows\System\FswgWpg.exe
  2⤵
  PID:13412
- C:\Windows\System\qQKIhab.exe
  C:\Windows\System\qQKIhab.exe
  2⤵
  PID:13532
- C:\Windows\System\WnZGEpq.exe
  C:\Windows\System\WnZGEpq.exe
  2⤵
  PID:13332
- C:\Windows\System\lwIddZV.exe
  C:\Windows\System\lwIddZV.exe
  2⤵
  PID:13512
- C:\Windows\System\HBIIzpy.exe
  C:\Windows\System\HBIIzpy.exe
  2⤵
  PID:13480
- C:\Windows\System\tKpgicc.exe
  C:\Windows\System\tKpgicc.exe
  2⤵
  PID:13688
- C:\Windows\System\OJoUvcI.exe
  C:\Windows\System\OJoUvcI.exe
  2⤵
  PID:13736
- C:\Windows\System\jpVwOCv.exe
  C:\Windows\System\jpVwOCv.exe
  2⤵
  PID:13796
- C:\Windows\System\egvsTEP.exe
  C:\Windows\System\egvsTEP.exe
  2⤵
  PID:13840
- C:\Windows\System\yBxDKhE.exe
  C:\Windows\System\yBxDKhE.exe
  2⤵
  PID:13932
- C:\Windows\System\VoOPYjT.exe
  C:\Windows\System\VoOPYjT.exe
  2⤵
  PID:13976
- C:\Windows\System\IPYRBCf.exe
  C:\Windows\System\IPYRBCf.exe
  2⤵
  PID:14000
- C:\Windows\System\zNSAMWI.exe
  C:\Windows\System\zNSAMWI.exe
  2⤵
  PID:14080
- C:\Windows\System\rHERADU.exe
  C:\Windows\System\rHERADU.exe
  2⤵
  PID:14156
- C:\Windows\System\GtgSmCD.exe
  C:\Windows\System\GtgSmCD.exe
  2⤵
  PID:14204
- C:\Windows\System\DiNCunz.exe
  C:\Windows\System\DiNCunz.exe
  2⤵
  PID:14272
- C:\Windows\System\txUgOxI.exe
  C:\Windows\System\txUgOxI.exe
  2⤵
  PID:13276
- C:\Windows\System\kiaKnMT.exe
  C:\Windows\System\kiaKnMT.exe
  2⤵
  PID:13320
- C:\Windows\System\Dwsetyq.exe
  C:\Windows\System\Dwsetyq.exe
  2⤵
  PID:12976
- C:\Windows\System\gwzdxzv.exe
  C:\Windows\System\gwzdxzv.exe
  2⤵
  PID:13264
- C:\Windows\System\IPujmjK.exe
  C:\Windows\System\IPujmjK.exe
  2⤵
  PID:13572
- C:\Windows\System\wshpHxz.exe
  C:\Windows\System\wshpHxz.exe
  2⤵
  PID:13956
- C:\Windows\System\jjjUpNz.exe
  C:\Windows\System\jjjUpNz.exe
  2⤵
  PID:14052
- C:\Windows\System\AGjsPOk.exe
  C:\Windows\System\AGjsPOk.exe
  2⤵
  PID:13924
- C:\Windows\System\uOxRKgi.exe
  C:\Windows\System\uOxRKgi.exe
  2⤵
  PID:13084
- C:\Windows\System\xwFtYrh.exe
  C:\Windows\System\xwFtYrh.exe
  2⤵
  PID:13380
- C:\Windows\System\gPkCjKE.exe
  C:\Windows\System\gPkCjKE.exe
  2⤵
  PID:13352
- C:\Windows\System\ihxcmjz.exe
  C:\Windows\System\ihxcmjz.exe
  2⤵
  PID:14340
- C:\Windows\System\OEKWTux.exe
  C:\Windows\System\OEKWTux.exe
  2⤵
  PID:14356
- C:\Windows\System\MHSYuZj.exe
  C:\Windows\System\MHSYuZj.exe
  2⤵
  PID:14376
- C:\Windows\System\NQYYGAT.exe
  C:\Windows\System\NQYYGAT.exe
  2⤵
  PID:14416
- C:\Windows\System\ZExMVxR.exe
  C:\Windows\System\ZExMVxR.exe
  2⤵
  PID:14432
- C:\Windows\System\honzkVL.exe
  C:\Windows\System\honzkVL.exe
  2⤵
  PID:14452
- C:\Windows\System\PDsENSF.exe
  C:\Windows\System\PDsENSF.exe
  2⤵
  PID:14476
- C:\Windows\System\ToIMRUk.exe
  C:\Windows\System\ToIMRUk.exe
  2⤵
  PID:14500
- C:\Windows\System\gLeseQV.exe
  C:\Windows\System\gLeseQV.exe
  2⤵
  PID:14528
- C:\Windows\System\eJZZGic.exe
  C:\Windows\System\eJZZGic.exe
  2⤵
  PID:14552
- C:\Windows\System\anHoTdu.exe
  C:\Windows\System\anHoTdu.exe
  2⤵
  PID:14592
- C:\Windows\System\alafqQu.exe
  C:\Windows\System\alafqQu.exe
  2⤵
  PID:14616
- C:\Windows\System\jladtHp.exe
  C:\Windows\System\jladtHp.exe
  2⤵
  PID:14632
- C:\Windows\System\ZsBrjIe.exe
  C:\Windows\System\ZsBrjIe.exe
  2⤵
  PID:14660
- C:\Windows\System\htHfqhR.exe
  C:\Windows\System\htHfqhR.exe
  2⤵
  PID:14680
- C:\Windows\System\KDaRmGC.exe
  C:\Windows\System\KDaRmGC.exe
  2⤵
  PID:14716
- C:\Windows\System\NhFBnjp.exe
  C:\Windows\System\NhFBnjp.exe
  2⤵
  PID:14740
- C:\Windows\System\insqOgq.exe
  C:\Windows\System\insqOgq.exe
  2⤵
  PID:14760
- C:\Windows\System\GXUkHTk.exe
  C:\Windows\System\GXUkHTk.exe
  2⤵
  PID:14788
- C:\Windows\System\PHLDpMY.exe
  C:\Windows\System\PHLDpMY.exe
  2⤵
  PID:14816
- C:\Windows\System\yzlCwIl.exe
  C:\Windows\System\yzlCwIl.exe
  2⤵
  PID:14840
- C:\Windows\System\fNSLAPr.exe
  C:\Windows\System\fNSLAPr.exe
  2⤵
  PID:14884
- C:\Windows\System\cWOJIrQ.exe
  C:\Windows\System\cWOJIrQ.exe
  2⤵
  PID:14908
- C:\Windows\System\mnfyoMY.exe
  C:\Windows\System\mnfyoMY.exe
  2⤵
  PID:14932
- C:\Windows\System\iBogxJP.exe
  C:\Windows\System\iBogxJP.exe
  2⤵
  PID:14964
- C:\Windows\System\VVbRGgn.exe
  C:\Windows\System\VVbRGgn.exe
  2⤵
  PID:14988
- C:\Windows\System\iUtvYnP.exe
  C:\Windows\System\iUtvYnP.exe
  2⤵
  PID:15012
- C:\Windows\System\MhOoamD.exe
  C:\Windows\System\MhOoamD.exe
  2⤵
  PID:15036
- C:\Windows\System\ZOfSWjO.exe
  C:\Windows\System\ZOfSWjO.exe
  2⤵
  PID:15068
- C:\Windows\System\QYygduO.exe
  C:\Windows\System\QYygduO.exe
  2⤵
  PID:15092
- C:\Windows\System\gUeULIC.exe
  C:\Windows\System\gUeULIC.exe
  2⤵
  PID:15108
- C:\Windows\System\siwlGfj.exe
  C:\Windows\System\siwlGfj.exe
  2⤵
  PID:15152
- C:\Windows\System\MniXHCZ.exe
  C:\Windows\System\MniXHCZ.exe
  2⤵
  PID:15172
- C:\Windows\System\syArpip.exe
  C:\Windows\System\syArpip.exe
  2⤵
  PID:15208
- C:\Windows\System\kmIckgp.exe
  C:\Windows\System\kmIckgp.exe
  2⤵
  PID:15232
- C:\Windows\System\SFyrZLR.exe
  C:\Windows\System\SFyrZLR.exe
  2⤵
  PID:15256
- C:\Windows\System\ouqiKZZ.exe
  C:\Windows\System\ouqiKZZ.exe
  2⤵
  PID:15284
- C:\Windows\System\UeiRaHq.exe
  C:\Windows\System\UeiRaHq.exe
  2⤵
  PID:15308
- C:\Windows\System\hIMSkXj.exe
  C:\Windows\System\hIMSkXj.exe
  2⤵
  PID:15332
- C:\Windows\System\NtYIznQ.exe
  C:\Windows\System\NtYIznQ.exe
  2⤵
  PID:14244
- C:\Windows\System\aPSxCEC.exe
  C:\Windows\System\aPSxCEC.exe
  2⤵
  PID:14368
- C:\Windows\System\MAfnebC.exe
  C:\Windows\System\MAfnebC.exe
  2⤵
  PID:14076
- C:\Windows\System\nPwIDGl.exe
  C:\Windows\System\nPwIDGl.exe
  2⤵
  PID:13136
- C:\Windows\System\uOPJZKe.exe
  C:\Windows\System\uOPJZKe.exe
  2⤵
  PID:14548
- C:\Windows\System\SaFeREP.exe
  C:\Windows\System\SaFeREP.exe
  2⤵
  PID:14440
- C:\Windows\System\WgRAvBW.exe
  C:\Windows\System\WgRAvBW.exe
  2⤵
  PID:14700
- C:\Windows\System\SZSsekY.exe
  C:\Windows\System\SZSsekY.exe
  2⤵
  PID:14648
- C:\Windows\System\ywSaAKb.exe
  C:\Windows\System\ywSaAKb.exe
  2⤵
  PID:14568
- C:\Windows\System\MhaYFJJ.exe
  C:\Windows\System\MhaYFJJ.exe
  2⤵
  PID:14728
- C:\Windows\System\MkyUrVb.exe
  C:\Windows\System\MkyUrVb.exe
  2⤵
  PID:14748
- C:\Windows\System\lMajwrQ.exe
  C:\Windows\System\lMajwrQ.exe
  2⤵
  PID:14780
- C:\Windows\System\vclZBsU.exe
  C:\Windows\System\vclZBsU.exe
  2⤵
  PID:14944
- C:\Windows\System\KvcydMY.exe
  C:\Windows\System\KvcydMY.exe
  2⤵
  PID:14872
- C:\Windows\System\REeWGYY.exe
  C:\Windows\System\REeWGYY.exe
  2⤵
  PID:15032
- C:\Windows\System\KCOEHJH.exe
  C:\Windows\System\KCOEHJH.exe
  2⤵
  PID:15168
- C:\Windows\System\QPMawtr.exe
  C:\Windows\System\QPMawtr.exe
  2⤵
  PID:15220
- C:\Windows\System\eRQjyTJ.exe
  C:\Windows\System\eRQjyTJ.exe
  2⤵
  PID:15252
- C:\Windows\System\zBgmWAx.exe
  C:\Windows\System\zBgmWAx.exe
  2⤵
  PID:15296
- C:\Windows\System\mIKIKWr.exe
  C:\Windows\System\mIKIKWr.exe
  2⤵
  PID:14448
- C:\Windows\System\dTKckHv.exe
  C:\Windows\System\dTKckHv.exe
  2⤵
  PID:14580
- C:\Windows\System\TnKuCgi.exe
  C:\Windows\System\TnKuCgi.exe
  2⤵
  PID:15248
- C:\Windows\System\udtuZOy.exe
  C:\Windows\System\udtuZOy.exe
  2⤵
  PID:14800
- C:\Windows\System\DSyesok.exe
  C:\Windows\System\DSyesok.exe
  2⤵
  PID:14540
- C:\Windows\System\MxaEFsg.exe
  C:\Windows\System\MxaEFsg.exe
  2⤵
  PID:15124
- C:\Windows\System\IdYvOhM.exe
  C:\Windows\System\IdYvOhM.exe
  2⤵
  PID:15160
- C:\Windows\System\QpQhJkJ.exe
  C:\Windows\System\QpQhJkJ.exe
  2⤵
  PID:15008
- C:\Windows\System\EFUEmnS.exe
  C:\Windows\System\EFUEmnS.exe
  2⤵
  PID:15376
- C:\Windows\System\IbuUuHU.exe
  C:\Windows\System\IbuUuHU.exe
  2⤵
  PID:15408
- C:\Windows\System\FRMyLrY.exe
  C:\Windows\System\FRMyLrY.exe
  2⤵
  PID:15436
- C:\Windows\System\lAaQerr.exe
  C:\Windows\System\lAaQerr.exe
  2⤵
  PID:15456
- C:\Windows\System\ShPOtRG.exe
  C:\Windows\System\ShPOtRG.exe
  2⤵
  PID:15484
- C:\Windows\System\smOlkTS.exe
  C:\Windows\System\smOlkTS.exe
  2⤵
  PID:15516
- C:\Windows\System\cTRPwMv.exe
  C:\Windows\System\cTRPwMv.exe
  2⤵
  PID:15548
- C:\Windows\System\gnqubcH.exe
  C:\Windows\System\gnqubcH.exe
  2⤵
  PID:15572
- C:\Windows\System\daMoOft.exe
  C:\Windows\System\daMoOft.exe
  2⤵
  PID:15592
- C:\Windows\System\cOUNkiL.exe
  C:\Windows\System\cOUNkiL.exe
  2⤵
  PID:15620
- C:\Windows\System\wmhBELm.exe
  C:\Windows\System\wmhBELm.exe
  2⤵
  PID:15640
- C:\Windows\System\fQKGXrR.exe
  C:\Windows\System\fQKGXrR.exe
  2⤵
  PID:15676
- C:\Windows\System\TomWQfM.exe
  C:\Windows\System\TomWQfM.exe
  2⤵
  PID:15708
- C:\Windows\System\DGehLUc.exe
  C:\Windows\System\DGehLUc.exe
  2⤵
  PID:15736
- C:\Windows\System\TmRJJqX.exe
  C:\Windows\System\TmRJJqX.exe
  2⤵
  PID:15772
- C:\Windows\System\fHgdsiK.exe
  C:\Windows\System\fHgdsiK.exe
  2⤵
  PID:15800
- C:\Windows\System\LctAWQs.exe
  C:\Windows\System\LctAWQs.exe
  2⤵
  PID:15816
- C:\Windows\System\kIEqQYO.exe
  C:\Windows\System\kIEqQYO.exe
  2⤵
  PID:15848
- C:\Windows\System\SbxPBMI.exe
  C:\Windows\System\SbxPBMI.exe
  2⤵
  PID:15872
- C:\Windows\System\DOBRqJV.exe
  C:\Windows\System\DOBRqJV.exe
  2⤵
  PID:15896
- C:\Windows\System\lIOXdix.exe
  C:\Windows\System\lIOXdix.exe
  2⤵
  PID:15928
- C:\Windows\System\yGuJjRN.exe
  C:\Windows\System\yGuJjRN.exe
  2⤵
  PID:15952
- C:\Windows\System\DXlWeYm.exe
  C:\Windows\System\DXlWeYm.exe
  2⤵
  PID:15976
- C:\Windows\System\tGceMNU.exe
  C:\Windows\System\tGceMNU.exe
  2⤵
  PID:16008
- C:\Windows\System\puXHlby.exe
  C:\Windows\System\puXHlby.exe
  2⤵
  PID:16036
- C:\Windows\System\khQWccv.exe
  C:\Windows\System\khQWccv.exe
  2⤵
  PID:16068
- C:\Windows\System\anUvpOw.exe
  C:\Windows\System\anUvpOw.exe
  2⤵
  PID:16088
- C:\Windows\System\mXGXLoi.exe
  C:\Windows\System\mXGXLoi.exe
  2⤵
  PID:16112
- C:\Windows\System\YRSjdmU.exe
  C:\Windows\System\YRSjdmU.exe
  2⤵
  PID:16148
- C:\Windows\System\VrGciku.exe
  C:\Windows\System\VrGciku.exe
  2⤵
  PID:16180
- C:\Windows\System\rDqsKop.exe
  C:\Windows\System\rDqsKop.exe
  2⤵
  PID:16204
- C:\Windows\System\tcPtvKK.exe
  C:\Windows\System\tcPtvKK.exe
  2⤵
  PID:16228
- C:\Windows\System\mYFeInU.exe
  C:\Windows\System\mYFeInU.exe
  2⤵
  PID:16256
- C:\Windows\System\aCAnZMX.exe
  C:\Windows\System\aCAnZMX.exe
  2⤵
  PID:16284
- C:\Windows\System\YayIWyO.exe
  C:\Windows\System\YayIWyO.exe
  2⤵
  PID:16320
- C:\Windows\System\UkOCucM.exe
  C:\Windows\System\UkOCucM.exe
  2⤵
  PID:16356
- C:\Windows\System\vLvzolu.exe
  C:\Windows\System\vLvzolu.exe
  2⤵
  PID:16372
- C:\Windows\System\JspMJYu.exe
  C:\Windows\System\JspMJYu.exe
  2⤵
  PID:15188
- C:\Windows\System\mQFYgCt.exe
  C:\Windows\System\mQFYgCt.exe
  2⤵
  PID:15080
- C:\Windows\System\wuRqWBc.exe
  C:\Windows\System\wuRqWBc.exe
  2⤵
  PID:14408
- C:\Windows\System\TZWtcXN.exe
  C:\Windows\System\TZWtcXN.exe
  2⤵
  PID:15024
- C:\Windows\System\OXPdZFa.exe
  C:\Windows\System\OXPdZFa.exe
  2⤵
  PID:15468
- C:\Windows\System\qALNMhE.exe
  C:\Windows\System\qALNMhE.exe
  2⤵
  PID:15372
- C:\Windows\System\KIaGmqu.exe
  C:\Windows\System\KIaGmqu.exe
  2⤵
  PID:13524
- C:\Windows\System\qPEZDHv.exe
  C:\Windows\System\qPEZDHv.exe
  2⤵
  PID:15692
- C:\Windows\System\zRoafPX.exe
  C:\Windows\System\zRoafPX.exe
  2⤵
  PID:15580
- C:\Windows\System\npIKJtq.exe
  C:\Windows\System\npIKJtq.exe
  2⤵
  PID:15868
- C:\Windows\System\MNSfqNT.exe
  C:\Windows\System\MNSfqNT.exe
  2⤵
  PID:15648
- C:\Windows\System\QmZuyZs.exe
  C:\Windows\System\QmZuyZs.exe
  2⤵
  PID:15504
- C:\Windows\System\jfyEMMf.exe
  C:\Windows\System\jfyEMMf.exe
  2⤵
  PID:15748
- C:\Windows\System\ORBcTwF.exe
  C:\Windows\System\ORBcTwF.exe
  2⤵
  PID:15760
- C:\Windows\System\mTuldus.exe
  C:\Windows\System\mTuldus.exe
  2⤵
  PID:15568
- C:\Windows\System\TkOKgHt.exe
  C:\Windows\System\TkOKgHt.exe
  2⤵
  PID:15916
- C:\Windows\System\bvdovcg.exe
  C:\Windows\System\bvdovcg.exe
  2⤵
  PID:16224
- C:\Windows\System\mwixnwS.exe
  C:\Windows\System\mwixnwS.exe
  2⤵
  PID:16276
- C:\Windows\System\hejFett.exe
  C:\Windows\System\hejFett.exe
  2⤵
  PID:15812
- C:\Windows\System\hUhtgKA.exe
  C:\Windows\System\hUhtgKA.exe
  2⤵
  PID:16368
- C:\Windows\System\uyaYZVO.exe
  C:\Windows\System\uyaYZVO.exe
  2⤵
  PID:16080
- C:\Windows\System\nsSFjNb.exe
  C:\Windows\System\nsSFjNb.exe
  2⤵
  PID:16100
- C:\Windows\System\HUMMHez.exe
  C:\Windows\System\HUMMHez.exe
  2⤵
  PID:16164
- C:\Windows\System\ZuMLtOt.exe
  C:\Windows\System\ZuMLtOt.exe
  2⤵
  PID:15060
- C:\Windows\System\OgtgRoU.exe
  C:\Windows\System\OgtgRoU.exe
  2⤵
  PID:16188
- C:\Windows\System\BwSlDUf.exe
  C:\Windows\System\BwSlDUf.exe
  2⤵
  PID:16240
- C:\Windows\System\NEfHEKj.exe
  C:\Windows\System\NEfHEKj.exe
  2⤵
  PID:16408
- C:\Windows\System\VjASlDl.exe
  C:\Windows\System\VjASlDl.exe
  2⤵
  PID:16432
- C:\Windows\System\jZAAzSi.exe
  C:\Windows\System\jZAAzSi.exe
  2⤵
  PID:16456
- C:\Windows\System\CcEVFDT.exe
  C:\Windows\System\CcEVFDT.exe
  2⤵
  PID:16480
- C:\Windows\System\FGTXOfA.exe
  C:\Windows\System\FGTXOfA.exe
  2⤵
  PID:16516
- C:\Windows\System\YhyHBpu.exe
  C:\Windows\System\YhyHBpu.exe
  2⤵
  PID:16540
- C:\Windows\System\rlqXtdQ.exe
  C:\Windows\System\rlqXtdQ.exe
  2⤵
  PID:16564
- C:\Windows\System\DqjWSSD.exe
  C:\Windows\System\DqjWSSD.exe
  2⤵
  PID:16604
- C:\Windows\System\OEOiuCt.exe
  C:\Windows\System\OEOiuCt.exe
  2⤵
  PID:16620
- C:\Windows\System\JnmiMDH.exe
  C:\Windows\System\JnmiMDH.exe
  2⤵
  PID:16644
- C:\Windows\System\tJJLySm.exe
  C:\Windows\System\tJJLySm.exe
  2⤵
  PID:16668
- C:\Windows\System\XcujeRq.exe
  C:\Windows\System\XcujeRq.exe
  2⤵
  PID:16692
- C:\Windows\System\bYVjixd.exe
  C:\Windows\System\bYVjixd.exe
  2⤵
  PID:16720
- C:\Windows\System\wNqNLnh.exe
  C:\Windows\System\wNqNLnh.exe
  2⤵
  PID:16748
- C:\Windows\System\mlSewRG.exe
  C:\Windows\System\mlSewRG.exe
  2⤵
  PID:16772
- C:\Windows\System\guumZyK.exe
  C:\Windows\System\guumZyK.exe
  2⤵
  PID:16796
- C:\Windows\System\neoUdsM.exe
  C:\Windows\System\neoUdsM.exe
  2⤵
  PID:16824
- C:\Windows\System\UFTWYww.exe
  C:\Windows\System\UFTWYww.exe
  2⤵
  PID:16860
- C:\Windows\System\JQfRTVB.exe
  C:\Windows\System\JQfRTVB.exe
  2⤵
  PID:17284
- C:\Windows\System\otarjje.exe
  C:\Windows\System\otarjje.exe
  2⤵
  PID:17328
- C:\Windows\System\cnbjspO.exe
  C:\Windows\System\cnbjspO.exe
  2⤵
  PID:17348
- C:\Windows\System\BTjMfQs.exe
  C:\Windows\System\BTjMfQs.exe
  2⤵
  PID:15796
- C:\Windows\System\AOiNQmr.exe
  C:\Windows\System\AOiNQmr.exe
  2⤵
  PID:15244
- C:\Windows\System\YtFVHlM.exe
  C:\Windows\System\YtFVHlM.exe
  2⤵
  PID:15324
- C:\Windows\System\CLFaEWt.exe
  C:\Windows\System\CLFaEWt.exe
  2⤵
  PID:15532
- C:\Windows\System\FwOXjRn.exe
  C:\Windows\System\FwOXjRn.exe
  2⤵
  PID:14732
- C:\Windows\System\lqompUz.exe
  C:\Windows\System\lqompUz.exe
  2⤵
  PID:16476
- C:\Windows\System\VingWLl.exe
  C:\Windows\System\VingWLl.exe
  2⤵
  PID:15424
- C:\Windows\System\quekALn.exe
  C:\Windows\System\quekALn.exe
  2⤵
  PID:16788

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:17180

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\AApCVwk.exe

Filesize
1.8MB

MD5
fb5fb9873be05230c6638ec3669919b2

SHA1
c15b320ba26bcbd61ac31d3eecec7ffd96472045

SHA256
0527490b3cedc799b74ac58c6301c10b148d3cf2bca037ee260ec3465eb878a4

SHA512
b037bdedc72966f8a519c3504215d1bbba0bdf0ddec5d125a63678a97d052cbdc5c108ab539ad856675995c8215fad6c30cef6637ddf44a5f25b9c388e8399a6

Download Submit
C:\Windows\System\AEWWCZI.exe

Filesize
1.8MB

MD5
ce8e7ebb1110b9921dd5e2b543db8794

SHA1
cedc7c898d988a496dcf5402e2fdb55c7195a9ae

SHA256
8d7040c69c0fb6a2a63481ab7458c6f94a212938e2d0aab9e7baae2a6310c41b

SHA512
ac972d4dbcc72959bf0efa16c2ad997226daeffa3b72f5e223ed674370650d44f6821d0fe1d3c541f4578fe998b325d1600991cfe81674ab4b6399cc33cbfc4f

Download Submit
C:\Windows\System\DelPrpC.exe

Filesize
1.8MB

MD5
29a48fb1a638ec7478df2b25d08064c2

SHA1
aadcaf10a68c048f81bcbbce838d64b8f777f4ff

SHA256
39efbf56e05d04a96951f73363ae1862d12a2c9d27538598a296bb4b97664c0e

SHA512
2b1ce812051cef05bce0ce2ef6c6a7e5c394d241a067c4031fad9adf95bf16cf86538883008f773a34b87141415cdeef72f4f4ee8f8daad3b80d51e8f41ea77d

Download Submit
C:\Windows\System\FYHyIdH.exe

Filesize
1.8MB

MD5
67bea894ca8bbcd797e147b7bfca5264

SHA1
86bdd564222c0714bbcb3a2acdbe65d5dc1f186f

SHA256
e0a003eceb6f5151ab096d788d4bac64a2a69d017491816155feecf0ff5dec16

SHA512
6192de36fd737ff88d6ae71286be6b47e6ba908ca1b52074653cb018f6bf2569723707a92a132b1faa415b6c7a3fc948658108d0293b963a534b6857ab9bbdc6

Download Submit
C:\Windows\System\Feoiwah.exe

Filesize
1.8MB

MD5
5104c18a0225687b16fb833abf80c125

SHA1
354d218d65d1414f5cdcb4974b816e9ed4140c06

SHA256
12ea8b9d353557da57b7b13e788319eb94e02df933dff071e7986b55726f51b6

SHA512
58720f183346c0c44dfc53177628ec5198bb0ac686d7cda943f1bb2c24e00f0e61c81cba3d11a9d702c93297d0b46f59c2b0472c8d83faf4683702c8979ed8d6

Download Submit
C:\Windows\System\GFFabFq.exe

Filesize
1.8MB

MD5
9068faa55af08ac8fe328196509f6b50

SHA1
0976bcdf1b07e2198eee3c954a12ebdf7708f60e

SHA256
0ba42a4bd44c1e28b804e050ce719da57436853ee4282f477724011636940393

SHA512
bc6670a0c4f1baa983fcc12d27f254147c85a46b2076851d6d2dd75ffaca7cc30d362f2395101a3e1e79bc84611b4d66dfbef0a41f22fa64ccb80094185c30be

Download Submit
C:\Windows\System\HHJeHCE.exe

Filesize
1.8MB

MD5
095fd78c91effcbfe38ca6bc18b42b11

SHA1
e1b364d7b459e1a6e7703b084ce5fab09829b75d

SHA256
ad7bbeaf4b2fcc09173217917db1aeec8839e7ccbbab30abeb82d741aba919cf

SHA512
7cdd492d5040649f480afe60b3087208620b550b5b5e744e60a06125ca0062f793ca605f1192f15be79812924f8ec96c52d134f2f9c607167298acec38bfb9f6

Download Submit
C:\Windows\System\HogCzDp.exe

Filesize
1.8MB

MD5
5ac237cabcc8156ef8ddd0ab3e34fd8a

SHA1
1ee0c168a1c0a9c4d93d29cb94293e4ccedef4da

SHA256
c44914014dce63cb600704b370e647ec49dcad1c02c1bd36b62e32957b9fd8ae

SHA512
d9a6f70f5ffbe0a910731fa165cf5311d16b9f99cc4e4367463b53c3fe21697135a1617db7969013c27f42240ffc66e52017dbed4ad01616ecd16019bdc4d3b9

Download Submit
C:\Windows\System\JRkwuop.exe

Filesize
1.8MB

MD5
5370e17512f0af847fa4cbcf23e73cc5

SHA1
319680a6c15ea0e5272b65b04a07556d6b6c8498

SHA256
1044cb23cacee0b7e2bad0ca09adeb445fcdab329669bf2a520e76d0971c9cc9

SHA512
b5e629aaf97b34dc435070140a601b4a3006c5d6a4ea197207f32df269f15a90fbf5fa5e2b2db456cc0a128a5d056998f4b0bd609343ad5f04e3df1fd1558a21

Download Submit
C:\Windows\System\QrsvRti.exe

Filesize
1.8MB

MD5
d3673c6af16ba2dd6b9beaac7d68f2bf

SHA1
dc311366d6d27542353eb4dcbb8c3c82f4762b69

SHA256
87821ffe9874941c06e5640dbeb7ffc82cf1e7a71e15c6bfb2fd5f8643a1ff4a

SHA512
885f283e538eebbd4b89ae49b611109c53290930bbe1c8316d8e8a593b1de5ceb317443b91b66c4264f1dcd931f603639509f1bef81a5a0495acf695091f6a67

Download Submit
C:\Windows\System\RSsHBFF.exe

Filesize
1.8MB

MD5
8e2c0901b9ab745c3b147706c758607c

SHA1
256c1d4b72f3006b7d25bd2d54d7d912d110e85a

SHA256
8e9fce7908269e6017ba47e787695ea09858f5683585218419039dead73e4e3a

SHA512
b6fd61cbbde1bcef1b670a597b6c2ef3dfd2e0aeee90772605a4c5ae7bba949dbc16b135549b21f7428ca2b3de7bf04552e6a961439ff0c6541f2aca9a2927bf

Download Submit
C:\Windows\System\TADYsnJ.exe

Filesize
1.8MB

MD5
677783da6f6ad54d0e9f2b754eb9f414

SHA1
398cf05111ef0423d5253dfa65c55f5476fba406

SHA256
074d26bf8267950ada4377b5d58c51b0451948884d11aad1c64bbd5b7e057281

SHA512
446d05db623dbd1b6cac98083d7912cd3d0eec1c202263e81abcc3cb54424aa683b8565ed2aaf1cad258746535df01a6e83d646efd1216be2d1a413489f022fc

Download Submit
C:\Windows\System\TMsEVoZ.exe

Filesize
1.8MB

MD5
d24441491788a5286630aa6e82a4b74f

SHA1
046fe103d010daef783ccd365917a4b257e2d27f

SHA256
dbcb727fc90a7f748758cfc4886ae091ed86309a9cfbe1fc0e8f3f27d3cadc8f

SHA512
51a44448e4902b3103b62ee15b6eefeaaba91640e3872306a09974f22c36ad8805429bcb39cb1f2e999d6803e34ae334418b7e572007b9e6cb15a19c3d440558

Download Submit
C:\Windows\System\TYOmEri.exe

Filesize
1.8MB

MD5
55503155681fd4a57a368c62c81f1140

SHA1
87d74715246044a74b99ce60884d3b5a54546f03

SHA256
f6248458f40c7c5a26b1cfa1ba854e188a490dc9565b5843f8ec1042975155de

SHA512
61ec72343b1b60424e02a0b4c639a15231414553f2ccdd2f4d07a36a5c3ceb8c7f8b4720a44e423d4aace7c503b4eaff5f8fad06e44097874206537b19f2a95a

Download Submit
C:\Windows\System\TcOepAi.exe

Filesize
1.8MB

MD5
68f0c71e4ce0ccdb294ce6139d605afa

SHA1
b2c0b50541034fe4db48b9fc5433527db76aa2d8

SHA256
375d91596242ba0b58384975451380537f02cab436c37498d756c4e705fe8ce4

SHA512
f56f495abcc71a67d56ec24eff5398d96a653a4c644885249e857e3d5a7aac4884efe76e60772e34d2fcb83c069a63e77159cb09365926a1105d4d0dc506c943

Download Submit
C:\Windows\System\UoCIoAn.exe

Filesize
1.8MB

MD5
38c9e0037aa5fdd02d602af55f2ad54a

SHA1
ec4890890b73df95a76daae4d4b94390b61fab21

SHA256
c92c65b7cfc3635fad1ed97c4981c7da31b2967dbc32d98067df38ca1bc8b2c1

SHA512
022fcaff84ebadd36d4f53cddce8da0f354a43e0259b0ff4f3593cb8ae7d5c7aa10987d2940b546d0b148e935a93f9aa2db47d6e2f438e393e58e00145086627

Download Submit
C:\Windows\System\VKmmdhl.exe

Filesize
1.8MB

MD5
15b832afdd8c3e0919af9ef022917d66

SHA1
3aa7fd6b52229414df8b239eccaea2becf9a2902

SHA256
fa8b77a465539cb7013e481d03221d93675a5325683be0cf2fd0247ac270c31f

SHA512
9279537102e2eb182c1c4fcdfd4f33603508c7ad3a273b7bb483541fe963f7a62da4fe84ceca482ceaf824f6c6b8bb59f5c3ee651628e65d4fd75cc46fe85ad1

Download Submit
C:\Windows\System\VboKCGH.exe

Filesize
1.8MB

MD5
b8634441b2f170580e7928160be22ef8

SHA1
5a2fbdfd65656805304f001b36880c5457b582a5

SHA256
508014f6975d98b5c606c31633b937f68330e4e37a012b986212065a261e2d30

SHA512
abf887232f8d0573c729a7d5f438bf61aad860ce0a2ca7b4ea4bc305234aa76d69a1470c740fc03dc24822ba804b95654fc6925760b1049663e67ebb243b180b

Download Submit
C:\Windows\System\XnlooPr.exe

Filesize
1.8MB

MD5
717f31767210fb5a4732701246584cc7

SHA1
af7707543869bba64ac3199941b5e880637666ac

SHA256
46b24b48e573c0bac862232aee47596391fd9483663c06dd766bbae02e18a29c

SHA512
26d237b76d28dde5531b1e2a3def46b8769e316a6e3b69cd0dc19c4931933bca376106c187e386fa0e91b2e0e12b6eea822fb6de96c6883905864326fd432945

Download Submit
C:\Windows\System\XtXlpUP.exe

Filesize
1.8MB

MD5
d2fff8f9f6181588583b1cc26077f54c

SHA1
7102289eed081fecaa2f75a80921234c2b7d236a

SHA256
aca734f49c172fefbb14e9fac0a9dd62a046df9770df0e1f79623e28f8d322a8

SHA512
752c26f63b2b7ebf653e50109e6605782188685bfb2228fff85e8681c13c17dde15271586fc7c8d3cc68a55f273fbebb7e6b23c61a2c970e4443622dd58bf9a7

Download Submit
C:\Windows\System\YgrfXIo.exe

Filesize
1.8MB

MD5
cebaa852e43a783144882f42096ec5df

SHA1
dd1277624942a46cca586f2a82f8d6ca423b24cb

SHA256
38503a45aa47797191d4ab7020f7a2b6493f67835b3015f62c4ea5ea6892c9a3

SHA512
ccd24879119bb7a4af60cf9f3f7bdd0cf6908fff06bda84186dfa918328ce078ff01035bcf5a42b1363f7d61a499b5be91319f81962e056d439cd293f1aed748

Download Submit
C:\Windows\System\alnBCmb.exe

Filesize
1.8MB

MD5
38163b0fa14e8cd2d1d22b40bc3645a7

SHA1
505c2098697ebb953c2383853707f46dd2d90d9b

SHA256
80d5a1d9ab58b9b0d4188b100e67c5f0cfe50a9a556f0a1117f13f5b084644b2

SHA512
34643b4851ddf10e748bd9fdd59843e7bca26aaaf7b0f2fe5b8fbe65fa396b1220af8447c01cf6617faf962e74a541c1963496e6c052caf2872975f62739a96c

Download Submit
C:\Windows\System\dzYIEIY.exe

Filesize
1.8MB

MD5
657bdbfac4afa5bdca7bc35fbee3451c

SHA1
a75c2f3a143f1d10368636e17d661ff8bd735aae

SHA256
071708933f777a1ed6efdfd3a4d92691fd65d09bf075d714b710a5077bc53083

SHA512
d597bdf972c4a436043494e737073744a9b41b4cc31a3b349d429513da6545288147c8c0c87c7933e4e6fb12514a9cfac37900df1ddc1d63bbe2b334241a1afe

Download Submit
C:\Windows\System\eAAgTdA.exe

Filesize
1.8MB

MD5
357aad86bcb7a890bda246f483f7a448

SHA1
c38f7935b5f01ce30d9fd35a2fd8ec6a1f59d391

SHA256
8d5046c55176021c84cd226edde511f40b45beb6a62a855065758baa03613fc4

SHA512
7c34c353bbc2da25260338a38472ddab099ffff1e4f817ea6d90f2172899f213ba0d0876a4f525d57e549535fd3efb54d05041d5db7bad71ffb1aecf3c07053f

Download Submit
C:\Windows\System\eEVlnwy.exe

Filesize
1.8MB

MD5
5a7a350b4f7aad6e64c249836889ee90

SHA1
53da8a1b76b9ddee1dba4284b45537b42ae5718b

SHA256
a0109898c97ac4c09c3991d7717d5871e6d623ca6ccb7d9318dbfaa8d39c5dd7

SHA512
6538140b0432ed561b2212690d8fd6827f522f234363f802f152752dd45cf221f24d3adfb9dfc8189db9ea362770367326afebd2680c0cdc08b4d0ec0b3748ee

Download Submit
C:\Windows\System\ggcuOBu.exe

Filesize
1.8MB

MD5
5580ebe4d6d4889cca18ede05f98d499

SHA1
e31b49c507bd9736ce258ab6f282061e7a8c98dd

SHA256
002a822a3ca7847b80a7078dd21f1ff62607433136dcdc6bc0c9fda33ea20f05

SHA512
61e44d13f98be364651464d8a6b56b883c134d739c0655087faae6dbc1f91ad9013b37d3222823dc3ea2a5adbced40746ed8ebd319b175b80d36c49a2a59e13a

Download Submit
C:\Windows\System\iMWGIHz.exe

Filesize
1.8MB

MD5
7fa5363340afb4f92465ea52b3ce2959

SHA1
59949add1910bbfeeace4d3452b431f468ca96a1

SHA256
01151f0ee1eca2b63984a17ea7330f8fe618b7ad1be773414535b4e5e5aca72b

SHA512
d57b36da325addcad39277e16635356a8fcda7f28f0c08b603ec87082c54335ec619402957c3ad092c394be016dc5a5c75b1c73fe3a7c155af38c6d6b07b0d63

Download Submit
C:\Windows\System\jXtjMMz.exe

Filesize
1.8MB

MD5
3bd447e4a647d027ffb491bd2fb4ffba

SHA1
259b1940159dc6a55f50fde6058ab24b8cdcfffe

SHA256
5553479c46e0b14fe52e5d00a043e19aab229fb38cfc3f086369f88d07a07059

SHA512
7ba41c072d5b69c584db5898f4ea3b5e41a22e52e040fc148d6df093e664266c8ca0dacefa041870bfa15cf9d535a75502bf53b08f1fcc919c16cba61e5164b9

Download Submit
C:\Windows\System\juDmHJt.exe

Filesize
1.8MB

MD5
86b5e29b5e21f82b1ceb5fa1efd61154

SHA1
67c1e23b60054f6eb7b9579592b17f97c5785909

SHA256
20d4b59b3edca652b2d8110b2c5fdd24ae5a7759373357f2348e7f58ed95e070

SHA512
0b890fd377bd77cbc7d34727fcc101c6181d3ada29d8fe50a7c81866956f42eebb09410f0d37ffedb92bf9ad0bbad90a91bc90a363f0965cb2e2fc14215ef902

Download Submit
C:\Windows\System\ntCYfex.exe

Filesize
1.8MB

MD5
d462739f805782bf318cf4c3cf944436

SHA1
5d71cce5bc8ccf9746688a57a08d5b3fc80af3b4

SHA256
ae83b5fe7361868872487d0778f029f203e93b49ef47fa6ac3bb2d12137b6702

SHA512
df577543088c8ba5ca8c9580f71f4bae107904fd88f52ff3c7e9eeaa8a71beb3039c161396a3da8fa1772fdfc2558df9da6ebb27f539b7778574cf2bceca370d

Download Submit
C:\Windows\System\qplzDxe.exe

Filesize
1.8MB

MD5
2531599347a712d4829df1f7e2c3e59c

SHA1
e504ab5fe6b7370c7551fd81e881c1431998fd4e

SHA256
856b7cc1d91a5437c242861276031d40eb5ca926305e080254a353fea734dd0b

SHA512
58930d8e242e4479d7cf1d1f4da6bc98c1a2a7f26bc08677bdfa956fa21d6a0c2a5f2bba78f9a310c24f4b02a830f8eba4cdeb5a836da3b88012d52293ace6ba

Download Submit
C:\Windows\System\taBDviK.exe

Filesize
1.8MB

MD5
6d2d33113b1a65945750596d54c774c4

SHA1
28d46762f91b5c8d67188f9eec44d88dcc549a44

SHA256
657d68d15e0577c63892e1e7d5b7fa4a859960da64aac4991db9b1a388eee0ef

SHA512
30f12905acf8db4277275ebbb362b94ca79b6a29abf5a315d1ec84a8b4f0da3f2b185b9eb838d0b9c06030227fa572ab3bbb9f69dd79199c92c079ba0e546f77

Download Submit
C:\Windows\System\tgVdkvx.exe

Filesize
1.8MB

MD5
9a5dc9327347cf84bd244aba60935a16

SHA1
a3e2c9fe5b255f41cf056ba16cb6a932126a711c

SHA256
bb27b20d0178edd04edd12b5f6a7039b42e1ddba2e98765b212653749b5be8aa

SHA512
18fc2fd334ff7f8247ebddb63c38a8230f2b58fc61874eba7ef5d211784276b94239fe4027a2102999971d4f76c2de10cd7f0390564809c723c4d7344faf1516

Download Submit
C:\Windows\System\xTYEpbP.exe

Filesize
1.8MB

MD5
7e8f294b69b984641ccf5ba2f87e44c3

SHA1
f3db2b6b4582f6d2cee858e50d9427acafa5758a

SHA256
a02886b2dc5af647b8660df7b237a8410ad91c3fa4e196caa50f187ea62514aa

SHA512
f9ccfb56cb376e1ab793d2a5dda7d58054abb35bc19886f5a19cc9715d4d21838139e2c00e702c0a71d434aa66eeb2a28eec8f8127c25c542ae00321e8dffaef

Download Submit
C:\Windows\System\zOIvrlk.exe

Filesize
1.8MB

MD5
d4b011b482e16306934ad3528f7fda28

SHA1
19975da19b44e9ec4a853431abef336ad3de3098

SHA256
7124e39bbe0694da3a625573b4bdd1e8a1fc651a2af748437369b6bf80530a17

SHA512
93df5d3565147b3a05834206fefab00f55815e7968eee64354aaa7dfca8b14c9fb318d9d931103b6bf6a9cf8841508b9b25664511487decf9b9ddb7f392884c0

Download Submit
memory/1668-0-0x0000027CB0D40000-0x0000027CB0D50000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads