xmrig | e196ecebfa22ebd0c45e1e0f4f4bc3c2aac0d9c0870dbc49f9d0ee950cd9632b

Analysis

max time kernel
102s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
24-12-2024 02:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e196ecebfa22ebd0c45e1e0f4f4bc3c2aac0d9c0870dbc49f9d0ee950cd9632b.exe
Size

1.4MB
MD5

69a2274a875c42397d1b51bb253b5503
SHA1

cd65d0e089e813e6ce853f0965a39fcd867d553c
SHA256

e196ecebfa22ebd0c45e1e0f4f4bc3c2aac0d9c0870dbc49f9d0ee950cd9632b
SHA512

3f15d6f8cd8a288a5842e80174be9dfc6232d2aa1169ff95bebb9859954fab5ec249ff42f3462024b4a890094a1a61eddeefa6c63bb63d1182af2d4f48f80081
SSDEEP

24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbpwlKenszbWKDNEm/5p904aohckh:GezaTF8FcNkNdfE0pZ9ozttwIRxGDK3j

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 35 IoCs

miner

resource	yara_rule
behavioral2/files/0x000c000000023b74-4.dat	xmrig
behavioral2/files/0x0009000000023c59-8.dat	xmrig
behavioral2/files/0x0007000000023c66-17.dat	xmrig
behavioral2/files/0x0007000000023c65-18.dat	xmrig
behavioral2/files/0x0007000000023c67-24.dat	xmrig
behavioral2/files/0x0007000000023c6a-37.dat	xmrig
behavioral2/files/0x0007000000023c69-36.dat	xmrig
behavioral2/files/0x0007000000023c68-32.dat	xmrig
behavioral2/files/0x0007000000023c6c-47.dat	xmrig
behavioral2/files/0x0007000000023c6b-54.dat	xmrig
behavioral2/files/0x0007000000023c6d-58.dat	xmrig
behavioral2/files/0x0007000000023c71-70.dat	xmrig
behavioral2/files/0x0007000000023c70-78.dat	xmrig
behavioral2/files/0x0007000000023c73-84.dat	xmrig
behavioral2/files/0x0007000000023c72-82.dat	xmrig
behavioral2/files/0x0007000000023c6e-76.dat	xmrig
behavioral2/files/0x0007000000023c6f-73.dat	xmrig
behavioral2/files/0x0007000000023c74-91.dat	xmrig
behavioral2/files/0x0009000000023c5a-92.dat	xmrig
behavioral2/files/0x0007000000023c76-108.dat	xmrig
behavioral2/files/0x0007000000023c78-112.dat	xmrig
behavioral2/files/0x0007000000023c7a-121.dat	xmrig
behavioral2/files/0x0007000000023c80-152.dat	xmrig
behavioral2/files/0x0007000000023c83-163.dat	xmrig
behavioral2/files/0x0007000000023c7f-166.dat	xmrig
behavioral2/files/0x0007000000023c84-165.dat	xmrig
behavioral2/files/0x0007000000023c82-160.dat	xmrig
behavioral2/files/0x0007000000023c81-157.dat	xmrig
behavioral2/files/0x0007000000023c7d-142.dat	xmrig
behavioral2/files/0x0007000000023c7c-140.dat	xmrig
behavioral2/files/0x0007000000023c7b-138.dat	xmrig
behavioral2/files/0x0007000000023c7e-135.dat	xmrig
behavioral2/files/0x0007000000023c79-133.dat	xmrig
behavioral2/files/0x0007000000023c77-117.dat	xmrig
behavioral2/files/0x0007000000023c75-104.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
1064	ihWtgER.exe
2268	SsSSVIi.exe
3496	sxKVsrY.exe
1964	KcUjPFa.exe
3936	WqmptuU.exe
4076	zpANgJB.exe
1772	BVuKCYw.exe
2780	lCbSwpb.exe
3948	JqZFMRV.exe
3960	WFBDHzq.exe
1288	rdcDHQo.exe
2704	QYnzGZO.exe
2288	fCZgjBM.exe
1612	ROuUKMU.exe
4260	rTuLNbl.exe
2388	qAfnhFj.exe
3056	jdTkhvM.exe
2052	DfYfofk.exe
1904	qqyHecI.exe
316	PevbdNh.exe
4668	JfbZlBv.exe
4744	aTJySpC.exe
3356	GpPCYah.exe
932	VIgmAgB.exe
1400	MfQwEqS.exe
2316	nxCgQde.exe
5028	HNDEAiC.exe
4496	OXQHuEA.exe
1696	OseyrNe.exe
4556	tYTBPEA.exe
1572	pQXpuTl.exe
2540	dIaaAHI.exe
1528	PPywHjr.exe
2752	VWhTbwd.exe
980	voaUzFK.exe
2684	ECojHWX.exe
1372	QilvfuC.exe
2580	ZnXsMBK.exe
4364	NLvXycm.exe
3760	PKlZZhh.exe
3368	gzZvvRb.exe
2104	aLNQJly.exe
1184	wHcMZDV.exe
3300	Tilnoig.exe
4944	yNXdoYk.exe
2380	weVWWOo.exe
2760	jyeBPxs.exe
1376	gMaNKsp.exe
4032	NHsMqHb.exe
1048	Bqnytwu.exe
4872	knPqWYH.exe
4176	cuCkrAz.exe
1144	BdOsrRp.exe
4464	daxVNqr.exe
548	kimmHqA.exe
3504	lIWQBmD.exe
4604	mSUAIDk.exe
3048	fNkUQBB.exe
1364	exaIFXh.exe
4648	MntEBjp.exe
2148	jJwNEVZ.exe
680	CLfzSOp.exe
2196	uBwvaiN.exe
1840	hWebIhZ.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\IywynQP.exe	e196ecebfa22ebd0c45e1e0f4f4bc3c2aac0d9c0870dbc49f9d0ee950cd9632b.exe
File created	C:\Windows\System\cepENnu.exe	e196ecebfa22ebd0c45e1e0f4f4bc3c2aac0d9c0870dbc49f9d0ee950cd9632b.exe
File created	C:\Windows\System\EuTPmtq.exe	e196ecebfa22ebd0c45e1e0f4f4bc3c2aac0d9c0870dbc49f9d0ee950cd9632b.exe
File created	C:\Windows\System\WKUKDfV.exe	e196ecebfa22ebd0c45e1e0f4f4bc3c2aac0d9c0870dbc49f9d0ee950cd9632b.exe
File created	C:\Windows\System\hvdLzlY.exe	e196ecebfa22ebd0c45e1e0f4f4bc3c2aac0d9c0870dbc49f9d0ee950cd9632b.exe
File created	C:\Windows\System\mYagoIb.exe	e196ecebfa22ebd0c45e1e0f4f4bc3c2aac0d9c0870dbc49f9d0ee950cd9632b.exe
File created	C:\Windows\System\viZRiWu.exe	e196ecebfa22ebd0c45e1e0f4f4bc3c2aac0d9c0870dbc49f9d0ee950cd9632b.exe
File created	C:\Windows\System\ElmWvjn.exe	e196ecebfa22ebd0c45e1e0f4f4bc3c2aac0d9c0870dbc49f9d0ee950cd9632b.exe
File created	C:\Windows\System\oxqxiDA.exe	e196ecebfa22ebd0c45e1e0f4f4bc3c2aac0d9c0870dbc49f9d0ee950cd9632b.exe
File created	C:\Windows\System\gDHjMxj.exe	e196ecebfa22ebd0c45e1e0f4f4bc3c2aac0d9c0870dbc49f9d0ee950cd9632b.exe
File created	C:\Windows\System\ZlaeZbu.exe	e196ecebfa22ebd0c45e1e0f4f4bc3c2aac0d9c0870dbc49f9d0ee950cd9632b.exe
File created	C:\Windows\System\loefYTs.exe	e196ecebfa22ebd0c45e1e0f4f4bc3c2aac0d9c0870dbc49f9d0ee950cd9632b.exe
File created	C:\Windows\System\TehOssX.exe	e196ecebfa22ebd0c45e1e0f4f4bc3c2aac0d9c0870dbc49f9d0ee950cd9632b.exe
File created	C:\Windows\System\KAiJztI.exe	e196ecebfa22ebd0c45e1e0f4f4bc3c2aac0d9c0870dbc49f9d0ee950cd9632b.exe
File created	C:\Windows\System\FmUgKno.exe	e196ecebfa22ebd0c45e1e0f4f4bc3c2aac0d9c0870dbc49f9d0ee950cd9632b.exe
File created	C:\Windows\System\wdTdzxh.exe	e196ecebfa22ebd0c45e1e0f4f4bc3c2aac0d9c0870dbc49f9d0ee950cd9632b.exe
File created	C:\Windows\System\MboQhCm.exe	e196ecebfa22ebd0c45e1e0f4f4bc3c2aac0d9c0870dbc49f9d0ee950cd9632b.exe
File created	C:\Windows\System\aKesQxF.exe	e196ecebfa22ebd0c45e1e0f4f4bc3c2aac0d9c0870dbc49f9d0ee950cd9632b.exe
File created	C:\Windows\System\RPTgvOr.exe	e196ecebfa22ebd0c45e1e0f4f4bc3c2aac0d9c0870dbc49f9d0ee950cd9632b.exe
File created	C:\Windows\System\oUWzfRB.exe	e196ecebfa22ebd0c45e1e0f4f4bc3c2aac0d9c0870dbc49f9d0ee950cd9632b.exe
File created	C:\Windows\System\zpANgJB.exe	e196ecebfa22ebd0c45e1e0f4f4bc3c2aac0d9c0870dbc49f9d0ee950cd9632b.exe
File created	C:\Windows\System\cXEFgko.exe	e196ecebfa22ebd0c45e1e0f4f4bc3c2aac0d9c0870dbc49f9d0ee950cd9632b.exe
File created	C:\Windows\System\ezdZDrL.exe	e196ecebfa22ebd0c45e1e0f4f4bc3c2aac0d9c0870dbc49f9d0ee950cd9632b.exe
File created	C:\Windows\System\UBaDSvP.exe	e196ecebfa22ebd0c45e1e0f4f4bc3c2aac0d9c0870dbc49f9d0ee950cd9632b.exe
File created	C:\Windows\System\oULmhSR.exe	e196ecebfa22ebd0c45e1e0f4f4bc3c2aac0d9c0870dbc49f9d0ee950cd9632b.exe
File created	C:\Windows\System\cCcthuR.exe	e196ecebfa22ebd0c45e1e0f4f4bc3c2aac0d9c0870dbc49f9d0ee950cd9632b.exe
File created	C:\Windows\System\BFfZlKq.exe	e196ecebfa22ebd0c45e1e0f4f4bc3c2aac0d9c0870dbc49f9d0ee950cd9632b.exe
File created	C:\Windows\System\FWGAooe.exe	e196ecebfa22ebd0c45e1e0f4f4bc3c2aac0d9c0870dbc49f9d0ee950cd9632b.exe
File created	C:\Windows\System\EPPpGQu.exe	e196ecebfa22ebd0c45e1e0f4f4bc3c2aac0d9c0870dbc49f9d0ee950cd9632b.exe
File created	C:\Windows\System\RMYsVsd.exe	e196ecebfa22ebd0c45e1e0f4f4bc3c2aac0d9c0870dbc49f9d0ee950cd9632b.exe
File created	C:\Windows\System\KcjaSRp.exe	e196ecebfa22ebd0c45e1e0f4f4bc3c2aac0d9c0870dbc49f9d0ee950cd9632b.exe
File created	C:\Windows\System\hzxesjw.exe	e196ecebfa22ebd0c45e1e0f4f4bc3c2aac0d9c0870dbc49f9d0ee950cd9632b.exe
File created	C:\Windows\System\hFKkiXk.exe	e196ecebfa22ebd0c45e1e0f4f4bc3c2aac0d9c0870dbc49f9d0ee950cd9632b.exe
File created	C:\Windows\System\KXWzdXI.exe	e196ecebfa22ebd0c45e1e0f4f4bc3c2aac0d9c0870dbc49f9d0ee950cd9632b.exe
File created	C:\Windows\System\ROuUKMU.exe	e196ecebfa22ebd0c45e1e0f4f4bc3c2aac0d9c0870dbc49f9d0ee950cd9632b.exe
File created	C:\Windows\System\UcGSpWb.exe	e196ecebfa22ebd0c45e1e0f4f4bc3c2aac0d9c0870dbc49f9d0ee950cd9632b.exe
File created	C:\Windows\System\hpeMiys.exe	e196ecebfa22ebd0c45e1e0f4f4bc3c2aac0d9c0870dbc49f9d0ee950cd9632b.exe
File created	C:\Windows\System\uRMnuDk.exe	e196ecebfa22ebd0c45e1e0f4f4bc3c2aac0d9c0870dbc49f9d0ee950cd9632b.exe
File created	C:\Windows\System\bXumvuz.exe	e196ecebfa22ebd0c45e1e0f4f4bc3c2aac0d9c0870dbc49f9d0ee950cd9632b.exe
File created	C:\Windows\System\lZcxGkG.exe	e196ecebfa22ebd0c45e1e0f4f4bc3c2aac0d9c0870dbc49f9d0ee950cd9632b.exe
File created	C:\Windows\System\vxjAbMU.exe	e196ecebfa22ebd0c45e1e0f4f4bc3c2aac0d9c0870dbc49f9d0ee950cd9632b.exe
File created	C:\Windows\System\TPMbqPm.exe	e196ecebfa22ebd0c45e1e0f4f4bc3c2aac0d9c0870dbc49f9d0ee950cd9632b.exe
File created	C:\Windows\System\GOSrfAf.exe	e196ecebfa22ebd0c45e1e0f4f4bc3c2aac0d9c0870dbc49f9d0ee950cd9632b.exe
File created	C:\Windows\System\eFjyAWC.exe	e196ecebfa22ebd0c45e1e0f4f4bc3c2aac0d9c0870dbc49f9d0ee950cd9632b.exe
File created	C:\Windows\System\mfJbfPk.exe	e196ecebfa22ebd0c45e1e0f4f4bc3c2aac0d9c0870dbc49f9d0ee950cd9632b.exe
File created	C:\Windows\System\yokoWfK.exe	e196ecebfa22ebd0c45e1e0f4f4bc3c2aac0d9c0870dbc49f9d0ee950cd9632b.exe
File created	C:\Windows\System\AKIrlSw.exe	e196ecebfa22ebd0c45e1e0f4f4bc3c2aac0d9c0870dbc49f9d0ee950cd9632b.exe
File created	C:\Windows\System\XyzjCOm.exe	e196ecebfa22ebd0c45e1e0f4f4bc3c2aac0d9c0870dbc49f9d0ee950cd9632b.exe
File created	C:\Windows\System\gRDmrRe.exe	e196ecebfa22ebd0c45e1e0f4f4bc3c2aac0d9c0870dbc49f9d0ee950cd9632b.exe
File created	C:\Windows\System\CLpkPtU.exe	e196ecebfa22ebd0c45e1e0f4f4bc3c2aac0d9c0870dbc49f9d0ee950cd9632b.exe
File created	C:\Windows\System\pQXpuTl.exe	e196ecebfa22ebd0c45e1e0f4f4bc3c2aac0d9c0870dbc49f9d0ee950cd9632b.exe
File created	C:\Windows\System\QClOLqh.exe	e196ecebfa22ebd0c45e1e0f4f4bc3c2aac0d9c0870dbc49f9d0ee950cd9632b.exe
File created	C:\Windows\System\ATqqIBs.exe	e196ecebfa22ebd0c45e1e0f4f4bc3c2aac0d9c0870dbc49f9d0ee950cd9632b.exe
File created	C:\Windows\System\vkmXKTD.exe	e196ecebfa22ebd0c45e1e0f4f4bc3c2aac0d9c0870dbc49f9d0ee950cd9632b.exe
File created	C:\Windows\System\rbiUfEM.exe	e196ecebfa22ebd0c45e1e0f4f4bc3c2aac0d9c0870dbc49f9d0ee950cd9632b.exe
File created	C:\Windows\System\QxWEwzM.exe	e196ecebfa22ebd0c45e1e0f4f4bc3c2aac0d9c0870dbc49f9d0ee950cd9632b.exe
File created	C:\Windows\System\XbnfXpp.exe	e196ecebfa22ebd0c45e1e0f4f4bc3c2aac0d9c0870dbc49f9d0ee950cd9632b.exe
File created	C:\Windows\System\VgWszSv.exe	e196ecebfa22ebd0c45e1e0f4f4bc3c2aac0d9c0870dbc49f9d0ee950cd9632b.exe
File created	C:\Windows\System\wwWccqp.exe	e196ecebfa22ebd0c45e1e0f4f4bc3c2aac0d9c0870dbc49f9d0ee950cd9632b.exe
File created	C:\Windows\System\VUdBBXq.exe	e196ecebfa22ebd0c45e1e0f4f4bc3c2aac0d9c0870dbc49f9d0ee950cd9632b.exe
File created	C:\Windows\System\kwCLlSL.exe	e196ecebfa22ebd0c45e1e0f4f4bc3c2aac0d9c0870dbc49f9d0ee950cd9632b.exe
File created	C:\Windows\System\dARinME.exe	e196ecebfa22ebd0c45e1e0f4f4bc3c2aac0d9c0870dbc49f9d0ee950cd9632b.exe
File created	C:\Windows\System\jberyNv.exe	e196ecebfa22ebd0c45e1e0f4f4bc3c2aac0d9c0870dbc49f9d0ee950cd9632b.exe
File created	C:\Windows\System\BkQSeAa.exe	e196ecebfa22ebd0c45e1e0f4f4bc3c2aac0d9c0870dbc49f9d0ee950cd9632b.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	16496	dwm.exe
Token: SeChangeNotifyPrivilege	16496	dwm.exe
Token: 33	16496	dwm.exe
Token: SeIncBasePriorityPrivilege	16496	dwm.exe
Token: SeShutdownPrivilege	16496	dwm.exe
Token: SeCreatePagefilePrivilege	16496	dwm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3672 wrote to memory of 1064	3672	e196ecebfa22ebd0c45e1e0f4f4bc3c2aac0d9c0870dbc49f9d0ee950cd9632b.exe	84
PID 3672 wrote to memory of 1064	3672	e196ecebfa22ebd0c45e1e0f4f4bc3c2aac0d9c0870dbc49f9d0ee950cd9632b.exe	84
PID 3672 wrote to memory of 2268	3672	e196ecebfa22ebd0c45e1e0f4f4bc3c2aac0d9c0870dbc49f9d0ee950cd9632b.exe	85
PID 3672 wrote to memory of 2268	3672	e196ecebfa22ebd0c45e1e0f4f4bc3c2aac0d9c0870dbc49f9d0ee950cd9632b.exe	85
PID 3672 wrote to memory of 3496	3672	e196ecebfa22ebd0c45e1e0f4f4bc3c2aac0d9c0870dbc49f9d0ee950cd9632b.exe	86
PID 3672 wrote to memory of 3496	3672	e196ecebfa22ebd0c45e1e0f4f4bc3c2aac0d9c0870dbc49f9d0ee950cd9632b.exe	86
PID 3672 wrote to memory of 1964	3672	e196ecebfa22ebd0c45e1e0f4f4bc3c2aac0d9c0870dbc49f9d0ee950cd9632b.exe	87
PID 3672 wrote to memory of 1964	3672	e196ecebfa22ebd0c45e1e0f4f4bc3c2aac0d9c0870dbc49f9d0ee950cd9632b.exe	87
PID 3672 wrote to memory of 3936	3672	e196ecebfa22ebd0c45e1e0f4f4bc3c2aac0d9c0870dbc49f9d0ee950cd9632b.exe	88
PID 3672 wrote to memory of 3936	3672	e196ecebfa22ebd0c45e1e0f4f4bc3c2aac0d9c0870dbc49f9d0ee950cd9632b.exe	88
PID 3672 wrote to memory of 4076	3672	e196ecebfa22ebd0c45e1e0f4f4bc3c2aac0d9c0870dbc49f9d0ee950cd9632b.exe	89
PID 3672 wrote to memory of 4076	3672	e196ecebfa22ebd0c45e1e0f4f4bc3c2aac0d9c0870dbc49f9d0ee950cd9632b.exe	89
PID 3672 wrote to memory of 1772	3672	e196ecebfa22ebd0c45e1e0f4f4bc3c2aac0d9c0870dbc49f9d0ee950cd9632b.exe	90
PID 3672 wrote to memory of 1772	3672	e196ecebfa22ebd0c45e1e0f4f4bc3c2aac0d9c0870dbc49f9d0ee950cd9632b.exe	90
PID 3672 wrote to memory of 2780	3672	e196ecebfa22ebd0c45e1e0f4f4bc3c2aac0d9c0870dbc49f9d0ee950cd9632b.exe	91
PID 3672 wrote to memory of 2780	3672	e196ecebfa22ebd0c45e1e0f4f4bc3c2aac0d9c0870dbc49f9d0ee950cd9632b.exe	91
PID 3672 wrote to memory of 3948	3672	e196ecebfa22ebd0c45e1e0f4f4bc3c2aac0d9c0870dbc49f9d0ee950cd9632b.exe	92
PID 3672 wrote to memory of 3948	3672	e196ecebfa22ebd0c45e1e0f4f4bc3c2aac0d9c0870dbc49f9d0ee950cd9632b.exe	92
PID 3672 wrote to memory of 3960	3672	e196ecebfa22ebd0c45e1e0f4f4bc3c2aac0d9c0870dbc49f9d0ee950cd9632b.exe	93
PID 3672 wrote to memory of 3960	3672	e196ecebfa22ebd0c45e1e0f4f4bc3c2aac0d9c0870dbc49f9d0ee950cd9632b.exe	93
PID 3672 wrote to memory of 1288	3672	e196ecebfa22ebd0c45e1e0f4f4bc3c2aac0d9c0870dbc49f9d0ee950cd9632b.exe	94
PID 3672 wrote to memory of 1288	3672	e196ecebfa22ebd0c45e1e0f4f4bc3c2aac0d9c0870dbc49f9d0ee950cd9632b.exe	94
PID 3672 wrote to memory of 2704	3672	e196ecebfa22ebd0c45e1e0f4f4bc3c2aac0d9c0870dbc49f9d0ee950cd9632b.exe	95
PID 3672 wrote to memory of 2704	3672	e196ecebfa22ebd0c45e1e0f4f4bc3c2aac0d9c0870dbc49f9d0ee950cd9632b.exe	95
PID 3672 wrote to memory of 2288	3672	e196ecebfa22ebd0c45e1e0f4f4bc3c2aac0d9c0870dbc49f9d0ee950cd9632b.exe	96
PID 3672 wrote to memory of 2288	3672	e196ecebfa22ebd0c45e1e0f4f4bc3c2aac0d9c0870dbc49f9d0ee950cd9632b.exe	96
PID 3672 wrote to memory of 1612	3672	e196ecebfa22ebd0c45e1e0f4f4bc3c2aac0d9c0870dbc49f9d0ee950cd9632b.exe	97
PID 3672 wrote to memory of 1612	3672	e196ecebfa22ebd0c45e1e0f4f4bc3c2aac0d9c0870dbc49f9d0ee950cd9632b.exe	97
PID 3672 wrote to memory of 4260	3672	e196ecebfa22ebd0c45e1e0f4f4bc3c2aac0d9c0870dbc49f9d0ee950cd9632b.exe	98
PID 3672 wrote to memory of 4260	3672	e196ecebfa22ebd0c45e1e0f4f4bc3c2aac0d9c0870dbc49f9d0ee950cd9632b.exe	98
PID 3672 wrote to memory of 2388	3672	e196ecebfa22ebd0c45e1e0f4f4bc3c2aac0d9c0870dbc49f9d0ee950cd9632b.exe	99
PID 3672 wrote to memory of 2388	3672	e196ecebfa22ebd0c45e1e0f4f4bc3c2aac0d9c0870dbc49f9d0ee950cd9632b.exe	99
PID 3672 wrote to memory of 3056	3672	e196ecebfa22ebd0c45e1e0f4f4bc3c2aac0d9c0870dbc49f9d0ee950cd9632b.exe	100
PID 3672 wrote to memory of 3056	3672	e196ecebfa22ebd0c45e1e0f4f4bc3c2aac0d9c0870dbc49f9d0ee950cd9632b.exe	100
PID 3672 wrote to memory of 2052	3672	e196ecebfa22ebd0c45e1e0f4f4bc3c2aac0d9c0870dbc49f9d0ee950cd9632b.exe	101
PID 3672 wrote to memory of 2052	3672	e196ecebfa22ebd0c45e1e0f4f4bc3c2aac0d9c0870dbc49f9d0ee950cd9632b.exe	101
PID 3672 wrote to memory of 1904	3672	e196ecebfa22ebd0c45e1e0f4f4bc3c2aac0d9c0870dbc49f9d0ee950cd9632b.exe	102
PID 3672 wrote to memory of 1904	3672	e196ecebfa22ebd0c45e1e0f4f4bc3c2aac0d9c0870dbc49f9d0ee950cd9632b.exe	102
PID 3672 wrote to memory of 316	3672	e196ecebfa22ebd0c45e1e0f4f4bc3c2aac0d9c0870dbc49f9d0ee950cd9632b.exe	103
PID 3672 wrote to memory of 316	3672	e196ecebfa22ebd0c45e1e0f4f4bc3c2aac0d9c0870dbc49f9d0ee950cd9632b.exe	103
PID 3672 wrote to memory of 4668	3672	e196ecebfa22ebd0c45e1e0f4f4bc3c2aac0d9c0870dbc49f9d0ee950cd9632b.exe	104
PID 3672 wrote to memory of 4668	3672	e196ecebfa22ebd0c45e1e0f4f4bc3c2aac0d9c0870dbc49f9d0ee950cd9632b.exe	104
PID 3672 wrote to memory of 4744	3672	e196ecebfa22ebd0c45e1e0f4f4bc3c2aac0d9c0870dbc49f9d0ee950cd9632b.exe	105
PID 3672 wrote to memory of 4744	3672	e196ecebfa22ebd0c45e1e0f4f4bc3c2aac0d9c0870dbc49f9d0ee950cd9632b.exe	105
PID 3672 wrote to memory of 3356	3672	e196ecebfa22ebd0c45e1e0f4f4bc3c2aac0d9c0870dbc49f9d0ee950cd9632b.exe	106
PID 3672 wrote to memory of 3356	3672	e196ecebfa22ebd0c45e1e0f4f4bc3c2aac0d9c0870dbc49f9d0ee950cd9632b.exe	106
PID 3672 wrote to memory of 932	3672	e196ecebfa22ebd0c45e1e0f4f4bc3c2aac0d9c0870dbc49f9d0ee950cd9632b.exe	107
PID 3672 wrote to memory of 932	3672	e196ecebfa22ebd0c45e1e0f4f4bc3c2aac0d9c0870dbc49f9d0ee950cd9632b.exe	107
PID 3672 wrote to memory of 1400	3672	e196ecebfa22ebd0c45e1e0f4f4bc3c2aac0d9c0870dbc49f9d0ee950cd9632b.exe	108
PID 3672 wrote to memory of 1400	3672	e196ecebfa22ebd0c45e1e0f4f4bc3c2aac0d9c0870dbc49f9d0ee950cd9632b.exe	108
PID 3672 wrote to memory of 2316	3672	e196ecebfa22ebd0c45e1e0f4f4bc3c2aac0d9c0870dbc49f9d0ee950cd9632b.exe	109
PID 3672 wrote to memory of 2316	3672	e196ecebfa22ebd0c45e1e0f4f4bc3c2aac0d9c0870dbc49f9d0ee950cd9632b.exe	109
PID 3672 wrote to memory of 5028	3672	e196ecebfa22ebd0c45e1e0f4f4bc3c2aac0d9c0870dbc49f9d0ee950cd9632b.exe	110
PID 3672 wrote to memory of 5028	3672	e196ecebfa22ebd0c45e1e0f4f4bc3c2aac0d9c0870dbc49f9d0ee950cd9632b.exe	110
PID 3672 wrote to memory of 4496	3672	e196ecebfa22ebd0c45e1e0f4f4bc3c2aac0d9c0870dbc49f9d0ee950cd9632b.exe	111
PID 3672 wrote to memory of 4496	3672	e196ecebfa22ebd0c45e1e0f4f4bc3c2aac0d9c0870dbc49f9d0ee950cd9632b.exe	111
PID 3672 wrote to memory of 1696	3672	e196ecebfa22ebd0c45e1e0f4f4bc3c2aac0d9c0870dbc49f9d0ee950cd9632b.exe	112
PID 3672 wrote to memory of 1696	3672	e196ecebfa22ebd0c45e1e0f4f4bc3c2aac0d9c0870dbc49f9d0ee950cd9632b.exe	112
PID 3672 wrote to memory of 4556	3672	e196ecebfa22ebd0c45e1e0f4f4bc3c2aac0d9c0870dbc49f9d0ee950cd9632b.exe	113
PID 3672 wrote to memory of 4556	3672	e196ecebfa22ebd0c45e1e0f4f4bc3c2aac0d9c0870dbc49f9d0ee950cd9632b.exe	113
PID 3672 wrote to memory of 1572	3672	e196ecebfa22ebd0c45e1e0f4f4bc3c2aac0d9c0870dbc49f9d0ee950cd9632b.exe	114
PID 3672 wrote to memory of 1572	3672	e196ecebfa22ebd0c45e1e0f4f4bc3c2aac0d9c0870dbc49f9d0ee950cd9632b.exe	114
PID 3672 wrote to memory of 2540	3672	e196ecebfa22ebd0c45e1e0f4f4bc3c2aac0d9c0870dbc49f9d0ee950cd9632b.exe	115
PID 3672 wrote to memory of 2540	3672	e196ecebfa22ebd0c45e1e0f4f4bc3c2aac0d9c0870dbc49f9d0ee950cd9632b.exe	115

C:\Users\Admin\AppData\Local\Temp\e196ecebfa22ebd0c45e1e0f4f4bc3c2aac0d9c0870dbc49f9d0ee950cd9632b.exe
"C:\Users\Admin\AppData\Local\Temp\e196ecebfa22ebd0c45e1e0f4f4bc3c2aac0d9c0870dbc49f9d0ee950cd9632b.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3672
- C:\Windows\System\ihWtgER.exe
  C:\Windows\System\ihWtgER.exe
  2⤵
  - Executes dropped EXE
  PID:1064
- C:\Windows\System\SsSSVIi.exe
  C:\Windows\System\SsSSVIi.exe
  2⤵
  - Executes dropped EXE
  PID:2268
- C:\Windows\System\sxKVsrY.exe
  C:\Windows\System\sxKVsrY.exe
  2⤵
  - Executes dropped EXE
  PID:3496
- C:\Windows\System\KcUjPFa.exe
  C:\Windows\System\KcUjPFa.exe
  2⤵
  - Executes dropped EXE
  PID:1964
- C:\Windows\System\WqmptuU.exe
  C:\Windows\System\WqmptuU.exe
  2⤵
  - Executes dropped EXE
  PID:3936
- C:\Windows\System\zpANgJB.exe
  C:\Windows\System\zpANgJB.exe
  2⤵
  - Executes dropped EXE
  PID:4076
- C:\Windows\System\BVuKCYw.exe
  C:\Windows\System\BVuKCYw.exe
  2⤵
  - Executes dropped EXE
  PID:1772
- C:\Windows\System\lCbSwpb.exe
  C:\Windows\System\lCbSwpb.exe
  2⤵
  - Executes dropped EXE
  PID:2780
- C:\Windows\System\JqZFMRV.exe
  C:\Windows\System\JqZFMRV.exe
  2⤵
  - Executes dropped EXE
  PID:3948
- C:\Windows\System\WFBDHzq.exe
  C:\Windows\System\WFBDHzq.exe
  2⤵
  - Executes dropped EXE
  PID:3960
- C:\Windows\System\rdcDHQo.exe
  C:\Windows\System\rdcDHQo.exe
  2⤵
  - Executes dropped EXE
  PID:1288
- C:\Windows\System\QYnzGZO.exe
  C:\Windows\System\QYnzGZO.exe
  2⤵
  - Executes dropped EXE
  PID:2704
- C:\Windows\System\fCZgjBM.exe
  C:\Windows\System\fCZgjBM.exe
  2⤵
  - Executes dropped EXE
  PID:2288
- C:\Windows\System\ROuUKMU.exe
  C:\Windows\System\ROuUKMU.exe
  2⤵
  - Executes dropped EXE
  PID:1612
- C:\Windows\System\rTuLNbl.exe
  C:\Windows\System\rTuLNbl.exe
  2⤵
  - Executes dropped EXE
  PID:4260
- C:\Windows\System\qAfnhFj.exe
  C:\Windows\System\qAfnhFj.exe
  2⤵
  - Executes dropped EXE
  PID:2388
- C:\Windows\System\jdTkhvM.exe
  C:\Windows\System\jdTkhvM.exe
  2⤵
  - Executes dropped EXE
  PID:3056
- C:\Windows\System\DfYfofk.exe
  C:\Windows\System\DfYfofk.exe
  2⤵
  - Executes dropped EXE
  PID:2052
- C:\Windows\System\qqyHecI.exe
  C:\Windows\System\qqyHecI.exe
  2⤵
  - Executes dropped EXE
  PID:1904
- C:\Windows\System\PevbdNh.exe
  C:\Windows\System\PevbdNh.exe
  2⤵
  - Executes dropped EXE
  PID:316
- C:\Windows\System\JfbZlBv.exe
  C:\Windows\System\JfbZlBv.exe
  2⤵
  - Executes dropped EXE
  PID:4668
- C:\Windows\System\aTJySpC.exe
  C:\Windows\System\aTJySpC.exe
  2⤵
  - Executes dropped EXE
  PID:4744
- C:\Windows\System\GpPCYah.exe
  C:\Windows\System\GpPCYah.exe
  2⤵
  - Executes dropped EXE
  PID:3356
- C:\Windows\System\VIgmAgB.exe
  C:\Windows\System\VIgmAgB.exe
  2⤵
  - Executes dropped EXE
  PID:932
- C:\Windows\System\MfQwEqS.exe
  C:\Windows\System\MfQwEqS.exe
  2⤵
  - Executes dropped EXE
  PID:1400
- C:\Windows\System\nxCgQde.exe
  C:\Windows\System\nxCgQde.exe
  2⤵
  - Executes dropped EXE
  PID:2316
- C:\Windows\System\HNDEAiC.exe
  C:\Windows\System\HNDEAiC.exe
  2⤵
  - Executes dropped EXE
  PID:5028
- C:\Windows\System\OXQHuEA.exe
  C:\Windows\System\OXQHuEA.exe
  2⤵
  - Executes dropped EXE
  PID:4496
- C:\Windows\System\OseyrNe.exe
  C:\Windows\System\OseyrNe.exe
  2⤵
  - Executes dropped EXE
  PID:1696
- C:\Windows\System\tYTBPEA.exe
  C:\Windows\System\tYTBPEA.exe
  2⤵
  - Executes dropped EXE
  PID:4556
- C:\Windows\System\pQXpuTl.exe
  C:\Windows\System\pQXpuTl.exe
  2⤵
  - Executes dropped EXE
  PID:1572
- C:\Windows\System\dIaaAHI.exe
  C:\Windows\System\dIaaAHI.exe
  2⤵
  - Executes dropped EXE
  PID:2540
- C:\Windows\System\PPywHjr.exe
  C:\Windows\System\PPywHjr.exe
  2⤵
  - Executes dropped EXE
  PID:1528
- C:\Windows\System\VWhTbwd.exe
  C:\Windows\System\VWhTbwd.exe
  2⤵
  - Executes dropped EXE
  PID:2752
- C:\Windows\System\voaUzFK.exe
  C:\Windows\System\voaUzFK.exe
  2⤵
  - Executes dropped EXE
  PID:980
- C:\Windows\System\ECojHWX.exe
  C:\Windows\System\ECojHWX.exe
  2⤵
  - Executes dropped EXE
  PID:2684
- C:\Windows\System\QilvfuC.exe
  C:\Windows\System\QilvfuC.exe
  2⤵
  - Executes dropped EXE
  PID:1372
- C:\Windows\System\ZnXsMBK.exe
  C:\Windows\System\ZnXsMBK.exe
  2⤵
  - Executes dropped EXE
  PID:2580
- C:\Windows\System\NLvXycm.exe
  C:\Windows\System\NLvXycm.exe
  2⤵
  - Executes dropped EXE
  PID:4364
- C:\Windows\System\PKlZZhh.exe
  C:\Windows\System\PKlZZhh.exe
  2⤵
  - Executes dropped EXE
  PID:3760
- C:\Windows\System\gzZvvRb.exe
  C:\Windows\System\gzZvvRb.exe
  2⤵
  - Executes dropped EXE
  PID:3368
- C:\Windows\System\aLNQJly.exe
  C:\Windows\System\aLNQJly.exe
  2⤵
  - Executes dropped EXE
  PID:2104
- C:\Windows\System\wHcMZDV.exe
  C:\Windows\System\wHcMZDV.exe
  2⤵
  - Executes dropped EXE
  PID:1184
- C:\Windows\System\Tilnoig.exe
  C:\Windows\System\Tilnoig.exe
  2⤵
  - Executes dropped EXE
  PID:3300
- C:\Windows\System\yNXdoYk.exe
  C:\Windows\System\yNXdoYk.exe
  2⤵
  - Executes dropped EXE
  PID:4944
- C:\Windows\System\weVWWOo.exe
  C:\Windows\System\weVWWOo.exe
  2⤵
  - Executes dropped EXE
  PID:2380
- C:\Windows\System\jyeBPxs.exe
  C:\Windows\System\jyeBPxs.exe
  2⤵
  - Executes dropped EXE
  PID:2760
- C:\Windows\System\gMaNKsp.exe
  C:\Windows\System\gMaNKsp.exe
  2⤵
  - Executes dropped EXE
  PID:1376
- C:\Windows\System\NHsMqHb.exe
  C:\Windows\System\NHsMqHb.exe
  2⤵
  - Executes dropped EXE
  PID:4032
- C:\Windows\System\Bqnytwu.exe
  C:\Windows\System\Bqnytwu.exe
  2⤵
  - Executes dropped EXE
  PID:1048
- C:\Windows\System\knPqWYH.exe
  C:\Windows\System\knPqWYH.exe
  2⤵
  - Executes dropped EXE
  PID:4872
- C:\Windows\System\cuCkrAz.exe
  C:\Windows\System\cuCkrAz.exe
  2⤵
  - Executes dropped EXE
  PID:4176
- C:\Windows\System\BdOsrRp.exe
  C:\Windows\System\BdOsrRp.exe
  2⤵
  - Executes dropped EXE
  PID:1144
- C:\Windows\System\daxVNqr.exe
  C:\Windows\System\daxVNqr.exe
  2⤵
  - Executes dropped EXE
  PID:4464
- C:\Windows\System\kimmHqA.exe
  C:\Windows\System\kimmHqA.exe
  2⤵
  - Executes dropped EXE
  PID:548
- C:\Windows\System\lIWQBmD.exe
  C:\Windows\System\lIWQBmD.exe
  2⤵
  - Executes dropped EXE
  PID:3504
- C:\Windows\System\mSUAIDk.exe
  C:\Windows\System\mSUAIDk.exe
  2⤵
  - Executes dropped EXE
  PID:4604
- C:\Windows\System\fNkUQBB.exe
  C:\Windows\System\fNkUQBB.exe
  2⤵
  - Executes dropped EXE
  PID:3048
- C:\Windows\System\exaIFXh.exe
  C:\Windows\System\exaIFXh.exe
  2⤵
  - Executes dropped EXE
  PID:1364
- C:\Windows\System\MntEBjp.exe
  C:\Windows\System\MntEBjp.exe
  2⤵
  - Executes dropped EXE
  PID:4648
- C:\Windows\System\jJwNEVZ.exe
  C:\Windows\System\jJwNEVZ.exe
  2⤵
  - Executes dropped EXE
  PID:2148
- C:\Windows\System\CLfzSOp.exe
  C:\Windows\System\CLfzSOp.exe
  2⤵
  - Executes dropped EXE
  PID:680
- C:\Windows\System\uBwvaiN.exe
  C:\Windows\System\uBwvaiN.exe
  2⤵
  - Executes dropped EXE
  PID:2196
- C:\Windows\System\hWebIhZ.exe
  C:\Windows\System\hWebIhZ.exe
  2⤵
  - Executes dropped EXE
  PID:1840
- C:\Windows\System\ArdawqX.exe
  C:\Windows\System\ArdawqX.exe
  2⤵
  PID:1788
- C:\Windows\System\SMOuFTI.exe
  C:\Windows\System\SMOuFTI.exe
  2⤵
  PID:628
- C:\Windows\System\QlzKrGt.exe
  C:\Windows\System\QlzKrGt.exe
  2⤵
  PID:4972
- C:\Windows\System\WfMlTWR.exe
  C:\Windows\System\WfMlTWR.exe
  2⤵
  PID:2172
- C:\Windows\System\vbBXRWs.exe
  C:\Windows\System\vbBXRWs.exe
  2⤵
  PID:2840
- C:\Windows\System\mghcyhU.exe
  C:\Windows\System\mghcyhU.exe
  2⤵
  PID:4216
- C:\Windows\System\kjiyubc.exe
  C:\Windows\System\kjiyubc.exe
  2⤵
  PID:2368
- C:\Windows\System\tmDBEoK.exe
  C:\Windows\System\tmDBEoK.exe
  2⤵
  PID:4052
- C:\Windows\System\GVGxVEw.exe
  C:\Windows\System\GVGxVEw.exe
  2⤵
  PID:4044
- C:\Windows\System\EljYlzA.exe
  C:\Windows\System\EljYlzA.exe
  2⤵
  PID:916
- C:\Windows\System\fUReHlp.exe
  C:\Windows\System\fUReHlp.exe
  2⤵
  PID:1092
- C:\Windows\System\AShIKpS.exe
  C:\Windows\System\AShIKpS.exe
  2⤵
  PID:3980
- C:\Windows\System\fknUFnw.exe
  C:\Windows\System\fknUFnw.exe
  2⤵
  PID:4476
- C:\Windows\System\PpwAMEn.exe
  C:\Windows\System\PpwAMEn.exe
  2⤵
  PID:3376
- C:\Windows\System\gDHjMxj.exe
  C:\Windows\System\gDHjMxj.exe
  2⤵
  PID:3260
- C:\Windows\System\pklOwlQ.exe
  C:\Windows\System\pklOwlQ.exe
  2⤵
  PID:2900
- C:\Windows\System\YCCJnxd.exe
  C:\Windows\System\YCCJnxd.exe
  2⤵
  PID:5072
- C:\Windows\System\OvriNHH.exe
  C:\Windows\System\OvriNHH.exe
  2⤵
  PID:4824
- C:\Windows\System\OBQOMVs.exe
  C:\Windows\System\OBQOMVs.exe
  2⤵
  PID:2000
- C:\Windows\System\GXWBilt.exe
  C:\Windows\System\GXWBilt.exe
  2⤵
  PID:3424
- C:\Windows\System\rXcGChg.exe
  C:\Windows\System\rXcGChg.exe
  2⤵
  PID:872
- C:\Windows\System\RSaZDZU.exe
  C:\Windows\System\RSaZDZU.exe
  2⤵
  PID:1312
- C:\Windows\System\SbJmEmR.exe
  C:\Windows\System\SbJmEmR.exe
  2⤵
  PID:4420
- C:\Windows\System\QoOIFoK.exe
  C:\Windows\System\QoOIFoK.exe
  2⤵
  PID:1900
- C:\Windows\System\iSyoRrB.exe
  C:\Windows\System\iSyoRrB.exe
  2⤵
  PID:2984
- C:\Windows\System\Infmkbj.exe
  C:\Windows\System\Infmkbj.exe
  2⤵
  PID:4912
- C:\Windows\System\XFQcPZh.exe
  C:\Windows\System\XFQcPZh.exe
  2⤵
  PID:64
- C:\Windows\System\iSPwrBU.exe
  C:\Windows\System\iSPwrBU.exe
  2⤵
  PID:3580
- C:\Windows\System\EPPpGQu.exe
  C:\Windows\System\EPPpGQu.exe
  2⤵
  PID:3872
- C:\Windows\System\UcGSpWb.exe
  C:\Windows\System\UcGSpWb.exe
  2⤵
  PID:5044
- C:\Windows\System\SAscjVa.exe
  C:\Windows\System\SAscjVa.exe
  2⤵
  PID:2396
- C:\Windows\System\WMmnHOJ.exe
  C:\Windows\System\WMmnHOJ.exe
  2⤵
  PID:2412
- C:\Windows\System\PnMOmsF.exe
  C:\Windows\System\PnMOmsF.exe
  2⤵
  PID:4664
- C:\Windows\System\RFJkmqE.exe
  C:\Windows\System\RFJkmqE.exe
  2⤵
  PID:3896
- C:\Windows\System\CbKGWfb.exe
  C:\Windows\System\CbKGWfb.exe
  2⤵
  PID:1492
- C:\Windows\System\DsDQCOl.exe
  C:\Windows\System\DsDQCOl.exe
  2⤵
  PID:4456
- C:\Windows\System\KbdJmMd.exe
  C:\Windows\System\KbdJmMd.exe
  2⤵
  PID:4724
- C:\Windows\System\iIujFsV.exe
  C:\Windows\System\iIujFsV.exe
  2⤵
  PID:3656
- C:\Windows\System\YMsyiEb.exe
  C:\Windows\System\YMsyiEb.exe
  2⤵
  PID:2628
- C:\Windows\System\TscppQp.exe
  C:\Windows\System\TscppQp.exe
  2⤵
  PID:2256
- C:\Windows\System\JmHpFdE.exe
  C:\Windows\System\JmHpFdE.exe
  2⤵
  PID:4536
- C:\Windows\System\xcIEJPD.exe
  C:\Windows\System\xcIEJPD.exe
  2⤵
  PID:3680
- C:\Windows\System\KSzewig.exe
  C:\Windows\System\KSzewig.exe
  2⤵
  PID:716
- C:\Windows\System\vIPyVGN.exe
  C:\Windows\System\vIPyVGN.exe
  2⤵
  PID:1988
- C:\Windows\System\mylCiFU.exe
  C:\Windows\System\mylCiFU.exe
  2⤵
  PID:1620
- C:\Windows\System\upTRZHF.exe
  C:\Windows\System\upTRZHF.exe
  2⤵
  PID:364
- C:\Windows\System\CYlaZSe.exe
  C:\Windows\System\CYlaZSe.exe
  2⤵
  PID:2992
- C:\Windows\System\sFqbnCJ.exe
  C:\Windows\System\sFqbnCJ.exe
  2⤵
  PID:5128
- C:\Windows\System\tTGpcpj.exe
  C:\Windows\System\tTGpcpj.exe
  2⤵
  PID:5168
- C:\Windows\System\TFiruUS.exe
  C:\Windows\System\TFiruUS.exe
  2⤵
  PID:5208
- C:\Windows\System\rIQiMVb.exe
  C:\Windows\System\rIQiMVb.exe
  2⤵
  PID:5232
- C:\Windows\System\lGrLnLW.exe
  C:\Windows\System\lGrLnLW.exe
  2⤵
  PID:5256
- C:\Windows\System\YioQivk.exe
  C:\Windows\System\YioQivk.exe
  2⤵
  PID:5284
- C:\Windows\System\bjskAFl.exe
  C:\Windows\System\bjskAFl.exe
  2⤵
  PID:5304
- C:\Windows\System\UsFxfbo.exe
  C:\Windows\System\UsFxfbo.exe
  2⤵
  PID:5332
- C:\Windows\System\MHITpyw.exe
  C:\Windows\System\MHITpyw.exe
  2⤵
  PID:5360
- C:\Windows\System\MZnuWRA.exe
  C:\Windows\System\MZnuWRA.exe
  2⤵
  PID:5408
- C:\Windows\System\aYfVuBR.exe
  C:\Windows\System\aYfVuBR.exe
  2⤵
  PID:5428
- C:\Windows\System\aFxLWsG.exe
  C:\Windows\System\aFxLWsG.exe
  2⤵
  PID:5452
- C:\Windows\System\FOhwyZO.exe
  C:\Windows\System\FOhwyZO.exe
  2⤵
  PID:5480
- C:\Windows\System\FudiaQa.exe
  C:\Windows\System\FudiaQa.exe
  2⤵
  PID:5516
- C:\Windows\System\BDryQgm.exe
  C:\Windows\System\BDryQgm.exe
  2⤵
  PID:5544
- C:\Windows\System\xCkfyPC.exe
  C:\Windows\System\xCkfyPC.exe
  2⤵
  PID:5572
- C:\Windows\System\bzDYdyZ.exe
  C:\Windows\System\bzDYdyZ.exe
  2⤵
  PID:5600
- C:\Windows\System\RltoGSY.exe
  C:\Windows\System\RltoGSY.exe
  2⤵
  PID:5628
- C:\Windows\System\llalAqs.exe
  C:\Windows\System\llalAqs.exe
  2⤵
  PID:5656
- C:\Windows\System\VHXZRIP.exe
  C:\Windows\System\VHXZRIP.exe
  2⤵
  PID:5684
- C:\Windows\System\PzVeBxv.exe
  C:\Windows\System\PzVeBxv.exe
  2⤵
  PID:5712
- C:\Windows\System\tRqsqxa.exe
  C:\Windows\System\tRqsqxa.exe
  2⤵
  PID:5728
- C:\Windows\System\FbTwaab.exe
  C:\Windows\System\FbTwaab.exe
  2⤵
  PID:5756
- C:\Windows\System\nHwvkfv.exe
  C:\Windows\System\nHwvkfv.exe
  2⤵
  PID:5784
- C:\Windows\System\MQOaMuy.exe
  C:\Windows\System\MQOaMuy.exe
  2⤵
  PID:5812
- C:\Windows\System\cHABsRj.exe
  C:\Windows\System\cHABsRj.exe
  2⤵
  PID:5840
- C:\Windows\System\sAgrbDg.exe
  C:\Windows\System\sAgrbDg.exe
  2⤵
  PID:5868
- C:\Windows\System\JclvYGL.exe
  C:\Windows\System\JclvYGL.exe
  2⤵
  PID:5892
- C:\Windows\System\Qgkedmt.exe
  C:\Windows\System\Qgkedmt.exe
  2⤵
  PID:5924
- C:\Windows\System\dARinME.exe
  C:\Windows\System\dARinME.exe
  2⤵
  PID:5952
- C:\Windows\System\xIrtMCt.exe
  C:\Windows\System\xIrtMCt.exe
  2⤵
  PID:5984
- C:\Windows\System\BGRYtFh.exe
  C:\Windows\System\BGRYtFh.exe
  2⤵
  PID:6008
- C:\Windows\System\GOSrfAf.exe
  C:\Windows\System\GOSrfAf.exe
  2⤵
  PID:6036
- C:\Windows\System\CojKshV.exe
  C:\Windows\System\CojKshV.exe
  2⤵
  PID:6064
- C:\Windows\System\AEdJpLE.exe
  C:\Windows\System\AEdJpLE.exe
  2⤵
  PID:6080
- C:\Windows\System\YdAOuet.exe
  C:\Windows\System\YdAOuet.exe
  2⤵
  PID:6096
- C:\Windows\System\hxZoAij.exe
  C:\Windows\System\hxZoAij.exe
  2⤵
  PID:6124
- C:\Windows\System\UtXuLdh.exe
  C:\Windows\System\UtXuLdh.exe
  2⤵
  PID:5124
- C:\Windows\System\hNogNfl.exe
  C:\Windows\System\hNogNfl.exe
  2⤵
  PID:5220
- C:\Windows\System\aFgjFov.exe
  C:\Windows\System\aFgjFov.exe
  2⤵
  PID:5248
- C:\Windows\System\piftWIr.exe
  C:\Windows\System\piftWIr.exe
  2⤵
  PID:5312
- C:\Windows\System\RhWFsls.exe
  C:\Windows\System\RhWFsls.exe
  2⤵
  PID:5380
- C:\Windows\System\vDXJkle.exe
  C:\Windows\System\vDXJkle.exe
  2⤵
  PID:5448
- C:\Windows\System\xGgeRkZ.exe
  C:\Windows\System\xGgeRkZ.exe
  2⤵
  PID:5504
- C:\Windows\System\LNTilsW.exe
  C:\Windows\System\LNTilsW.exe
  2⤵
  PID:5584
- C:\Windows\System\BHjzNyU.exe
  C:\Windows\System\BHjzNyU.exe
  2⤵
  PID:5644
- C:\Windows\System\UgeTMNK.exe
  C:\Windows\System\UgeTMNK.exe
  2⤵
  PID:5708
- C:\Windows\System\LIidzxP.exe
  C:\Windows\System\LIidzxP.exe
  2⤵
  PID:5776
- C:\Windows\System\MFhvzxo.exe
  C:\Windows\System\MFhvzxo.exe
  2⤵
  PID:5884
- C:\Windows\System\TWiQrum.exe
  C:\Windows\System\TWiQrum.exe
  2⤵
  PID:5936
- C:\Windows\System\DJIIeho.exe
  C:\Windows\System\DJIIeho.exe
  2⤵
  PID:6004
- C:\Windows\System\uPZzFNq.exe
  C:\Windows\System\uPZzFNq.exe
  2⤵
  PID:6092
- C:\Windows\System\WpfPPof.exe
  C:\Windows\System\WpfPPof.exe
  2⤵
  PID:5180
- C:\Windows\System\qulyZCt.exe
  C:\Windows\System\qulyZCt.exe
  2⤵
  PID:5244
- C:\Windows\System\IBDjAIf.exe
  C:\Windows\System\IBDjAIf.exe
  2⤵
  PID:5276
- C:\Windows\System\ktzJJlv.exe
  C:\Windows\System\ktzJJlv.exe
  2⤵
  PID:5356
- C:\Windows\System\EpDsBmG.exe
  C:\Windows\System\EpDsBmG.exe
  2⤵
  PID:5500
- C:\Windows\System\rklUGWA.exe
  C:\Windows\System\rklUGWA.exe
  2⤵
  PID:5880
- C:\Windows\System\RLyuxMm.exe
  C:\Windows\System\RLyuxMm.exe
  2⤵
  PID:5992
- C:\Windows\System\JrBjzdg.exe
  C:\Windows\System\JrBjzdg.exe
  2⤵
  PID:5384
- C:\Windows\System\vaSeFBJ.exe
  C:\Windows\System\vaSeFBJ.exe
  2⤵
  PID:5292
- C:\Windows\System\HlKRfLt.exe
  C:\Windows\System\HlKRfLt.exe
  2⤵
  PID:5748
- C:\Windows\System\QgyNWBJ.exe
  C:\Windows\System\QgyNWBJ.exe
  2⤵
  PID:6112
- C:\Windows\System\luqvVgE.exe
  C:\Windows\System\luqvVgE.exe
  2⤵
  PID:6160
- C:\Windows\System\jIhnVLS.exe
  C:\Windows\System\jIhnVLS.exe
  2⤵
  PID:6192
- C:\Windows\System\YOtrEYj.exe
  C:\Windows\System\YOtrEYj.exe
  2⤵
  PID:6224
- C:\Windows\System\PFYfjTU.exe
  C:\Windows\System\PFYfjTU.exe
  2⤵
  PID:6260
- C:\Windows\System\IPQwyyN.exe
  C:\Windows\System\IPQwyyN.exe
  2⤵
  PID:6292
- C:\Windows\System\adlOZbl.exe
  C:\Windows\System\adlOZbl.exe
  2⤵
  PID:6316
- C:\Windows\System\GtdjJwo.exe
  C:\Windows\System\GtdjJwo.exe
  2⤵
  PID:6344
- C:\Windows\System\IsNLSSN.exe
  C:\Windows\System\IsNLSSN.exe
  2⤵
  PID:6372
- C:\Windows\System\MGsUGCJ.exe
  C:\Windows\System\MGsUGCJ.exe
  2⤵
  PID:6396
- C:\Windows\System\QYxSCNa.exe
  C:\Windows\System\QYxSCNa.exe
  2⤵
  PID:6428
- C:\Windows\System\jIPlSLs.exe
  C:\Windows\System\jIPlSLs.exe
  2⤵
  PID:6448
- C:\Windows\System\mctgQIu.exe
  C:\Windows\System\mctgQIu.exe
  2⤵
  PID:6468
- C:\Windows\System\VEuMill.exe
  C:\Windows\System\VEuMill.exe
  2⤵
  PID:6492
- C:\Windows\System\mchsyxu.exe
  C:\Windows\System\mchsyxu.exe
  2⤵
  PID:6512
- C:\Windows\System\JNlVpmI.exe
  C:\Windows\System\JNlVpmI.exe
  2⤵
  PID:6548
- C:\Windows\System\crTWhYi.exe
  C:\Windows\System\crTWhYi.exe
  2⤵
  PID:6572
- C:\Windows\System\UwosNKK.exe
  C:\Windows\System\UwosNKK.exe
  2⤵
  PID:6608
- C:\Windows\System\DRkrnru.exe
  C:\Windows\System\DRkrnru.exe
  2⤵
  PID:6628
- C:\Windows\System\HuTbOXt.exe
  C:\Windows\System\HuTbOXt.exe
  2⤵
  PID:6660
- C:\Windows\System\CYVSIEA.exe
  C:\Windows\System\CYVSIEA.exe
  2⤵
  PID:6692
- C:\Windows\System\haRnoqe.exe
  C:\Windows\System\haRnoqe.exe
  2⤵
  PID:6724
- C:\Windows\System\oCoVSSY.exe
  C:\Windows\System\oCoVSSY.exe
  2⤵
  PID:6748
- C:\Windows\System\mFXEPJk.exe
  C:\Windows\System\mFXEPJk.exe
  2⤵
  PID:6780
- C:\Windows\System\BOmFcaM.exe
  C:\Windows\System\BOmFcaM.exe
  2⤵
  PID:6812
- C:\Windows\System\Scnggph.exe
  C:\Windows\System\Scnggph.exe
  2⤵
  PID:6840
- C:\Windows\System\pbUyQgn.exe
  C:\Windows\System\pbUyQgn.exe
  2⤵
  PID:6868
- C:\Windows\System\KUnqurA.exe
  C:\Windows\System\KUnqurA.exe
  2⤵
  PID:6900
- C:\Windows\System\CAYZxjt.exe
  C:\Windows\System\CAYZxjt.exe
  2⤵
  PID:6928
- C:\Windows\System\hpBjwKq.exe
  C:\Windows\System\hpBjwKq.exe
  2⤵
  PID:6968
- C:\Windows\System\clrICqT.exe
  C:\Windows\System\clrICqT.exe
  2⤵
  PID:6992
- C:\Windows\System\ihBXABu.exe
  C:\Windows\System\ihBXABu.exe
  2⤵
  PID:7028
- C:\Windows\System\jberyNv.exe
  C:\Windows\System\jberyNv.exe
  2⤵
  PID:7060
- C:\Windows\System\umceQWC.exe
  C:\Windows\System\umceQWC.exe
  2⤵
  PID:7088
- C:\Windows\System\qaTTXHu.exe
  C:\Windows\System\qaTTXHu.exe
  2⤵
  PID:7116
- C:\Windows\System\UNEAbnA.exe
  C:\Windows\System\UNEAbnA.exe
  2⤵
  PID:7144
- C:\Windows\System\ngnZOGC.exe
  C:\Windows\System\ngnZOGC.exe
  2⤵
  PID:5808
- C:\Windows\System\MqQesbf.exe
  C:\Windows\System\MqQesbf.exe
  2⤵
  PID:6152
- C:\Windows\System\nmyYhKR.exe
  C:\Windows\System\nmyYhKR.exe
  2⤵
  PID:6252
- C:\Windows\System\GouEooE.exe
  C:\Windows\System\GouEooE.exe
  2⤵
  PID:6308
- C:\Windows\System\IQHbyHB.exe
  C:\Windows\System\IQHbyHB.exe
  2⤵
  PID:6368
- C:\Windows\System\DyhdtQh.exe
  C:\Windows\System\DyhdtQh.exe
  2⤵
  PID:6420
- C:\Windows\System\YmkpHey.exe
  C:\Windows\System\YmkpHey.exe
  2⤵
  PID:6480
- C:\Windows\System\DIuOtEN.exe
  C:\Windows\System\DIuOtEN.exe
  2⤵
  PID:6520
- C:\Windows\System\dkDosWB.exe
  C:\Windows\System\dkDosWB.exe
  2⤵
  PID:6588
- C:\Windows\System\wBPWYXC.exe
  C:\Windows\System\wBPWYXC.exe
  2⤵
  PID:6704
- C:\Windows\System\BvcIZlk.exe
  C:\Windows\System\BvcIZlk.exe
  2⤵
  PID:6644
- C:\Windows\System\MFGIIQX.exe
  C:\Windows\System\MFGIIQX.exe
  2⤵
  PID:6800
- C:\Windows\System\LYjlOKv.exe
  C:\Windows\System\LYjlOKv.exe
  2⤵
  PID:6880
- C:\Windows\System\ErmxJXj.exe
  C:\Windows\System\ErmxJXj.exe
  2⤵
  PID:6936
- C:\Windows\System\RAMmGYX.exe
  C:\Windows\System\RAMmGYX.exe
  2⤵
  PID:7020
- C:\Windows\System\XteXTjN.exe
  C:\Windows\System\XteXTjN.exe
  2⤵
  PID:7072
- C:\Windows\System\LDHbqXd.exe
  C:\Windows\System\LDHbqXd.exe
  2⤵
  PID:7164
- C:\Windows\System\VxjuobC.exe
  C:\Windows\System\VxjuobC.exe
  2⤵
  PID:6216
- C:\Windows\System\xSoNiHE.exe
  C:\Windows\System\xSoNiHE.exe
  2⤵
  PID:6384
- C:\Windows\System\cvrJojr.exe
  C:\Windows\System\cvrJojr.exe
  2⤵
  PID:6532
- C:\Windows\System\pGgwNKk.exe
  C:\Windows\System\pGgwNKk.exe
  2⤵
  PID:6636
- C:\Windows\System\DVmRfcj.exe
  C:\Windows\System\DVmRfcj.exe
  2⤵
  PID:6836
- C:\Windows\System\cXEFgko.exe
  C:\Windows\System\cXEFgko.exe
  2⤵
  PID:7056
- C:\Windows\System\kxZbsRH.exe
  C:\Windows\System\kxZbsRH.exe
  2⤵
  PID:6180
- C:\Windows\System\MYEDJOB.exe
  C:\Windows\System\MYEDJOB.exe
  2⤵
  PID:6336
- C:\Windows\System\mqmGZHS.exe
  C:\Windows\System\mqmGZHS.exe
  2⤵
  PID:6624
- C:\Windows\System\XbnfXpp.exe
  C:\Windows\System\XbnfXpp.exe
  2⤵
  PID:6924
- C:\Windows\System\WNKUtPT.exe
  C:\Windows\System\WNKUtPT.exe
  2⤵
  PID:6540
- C:\Windows\System\OOXhJGg.exe
  C:\Windows\System\OOXhJGg.exe
  2⤵
  PID:6328
- C:\Windows\System\YTTpfAQ.exe
  C:\Windows\System\YTTpfAQ.exe
  2⤵
  PID:7184
- C:\Windows\System\PgLuinX.exe
  C:\Windows\System\PgLuinX.exe
  2⤵
  PID:7212
- C:\Windows\System\AJZtWoF.exe
  C:\Windows\System\AJZtWoF.exe
  2⤵
  PID:7244
- C:\Windows\System\SjhNPiG.exe
  C:\Windows\System\SjhNPiG.exe
  2⤵
  PID:7264
- C:\Windows\System\sLLpICg.exe
  C:\Windows\System\sLLpICg.exe
  2⤵
  PID:7288
- C:\Windows\System\OUkKVVy.exe
  C:\Windows\System\OUkKVVy.exe
  2⤵
  PID:7320
- C:\Windows\System\ZphFYpu.exe
  C:\Windows\System\ZphFYpu.exe
  2⤵
  PID:7352
- C:\Windows\System\CVXbxpd.exe
  C:\Windows\System\CVXbxpd.exe
  2⤵
  PID:7380
- C:\Windows\System\djNYHeM.exe
  C:\Windows\System\djNYHeM.exe
  2⤵
  PID:7404
- C:\Windows\System\KeZmfoC.exe
  C:\Windows\System\KeZmfoC.exe
  2⤵
  PID:7432
- C:\Windows\System\WWYEgkD.exe
  C:\Windows\System\WWYEgkD.exe
  2⤵
  PID:7452
- C:\Windows\System\oieyeHr.exe
  C:\Windows\System\oieyeHr.exe
  2⤵
  PID:7484
- C:\Windows\System\qYXozdd.exe
  C:\Windows\System\qYXozdd.exe
  2⤵
  PID:7516
- C:\Windows\System\nCzgfGJ.exe
  C:\Windows\System\nCzgfGJ.exe
  2⤵
  PID:7548
- C:\Windows\System\zekTkEw.exe
  C:\Windows\System\zekTkEw.exe
  2⤵
  PID:7580
- C:\Windows\System\QClOLqh.exe
  C:\Windows\System\QClOLqh.exe
  2⤵
  PID:7604
- C:\Windows\System\rdKJOPl.exe
  C:\Windows\System\rdKJOPl.exe
  2⤵
  PID:7636
- C:\Windows\System\UBIhNIM.exe
  C:\Windows\System\UBIhNIM.exe
  2⤵
  PID:7664
- C:\Windows\System\hTJediM.exe
  C:\Windows\System\hTJediM.exe
  2⤵
  PID:7692
- C:\Windows\System\ddDCkei.exe
  C:\Windows\System\ddDCkei.exe
  2⤵
  PID:7712
- C:\Windows\System\vTjAjPa.exe
  C:\Windows\System\vTjAjPa.exe
  2⤵
  PID:7736
- C:\Windows\System\pdbIwsh.exe
  C:\Windows\System\pdbIwsh.exe
  2⤵
  PID:7772
- C:\Windows\System\lHzDZsw.exe
  C:\Windows\System\lHzDZsw.exe
  2⤵
  PID:7804
- C:\Windows\System\ppGiUvl.exe
  C:\Windows\System\ppGiUvl.exe
  2⤵
  PID:7828
- C:\Windows\System\KcjaSRp.exe
  C:\Windows\System\KcjaSRp.exe
  2⤵
  PID:7856
- C:\Windows\System\HolJfey.exe
  C:\Windows\System\HolJfey.exe
  2⤵
  PID:7884
- C:\Windows\System\vabMBnx.exe
  C:\Windows\System\vabMBnx.exe
  2⤵
  PID:7924
- C:\Windows\System\WBLVbeb.exe
  C:\Windows\System\WBLVbeb.exe
  2⤵
  PID:7952
- C:\Windows\System\MZvqNPa.exe
  C:\Windows\System\MZvqNPa.exe
  2⤵
  PID:7976
- C:\Windows\System\AKIrlSw.exe
  C:\Windows\System\AKIrlSw.exe
  2⤵
  PID:8008
- C:\Windows\System\sApXWaE.exe
  C:\Windows\System\sApXWaE.exe
  2⤵
  PID:8032
- C:\Windows\System\OtzaXWY.exe
  C:\Windows\System\OtzaXWY.exe
  2⤵
  PID:8056
- C:\Windows\System\fsgFSVi.exe
  C:\Windows\System\fsgFSVi.exe
  2⤵
  PID:8080
- C:\Windows\System\LfDandO.exe
  C:\Windows\System\LfDandO.exe
  2⤵
  PID:8096
- C:\Windows\System\eFjyAWC.exe
  C:\Windows\System\eFjyAWC.exe
  2⤵
  PID:8124
- C:\Windows\System\wdTdzxh.exe
  C:\Windows\System\wdTdzxh.exe
  2⤵
  PID:8148
- C:\Windows\System\LeTMuDz.exe
  C:\Windows\System\LeTMuDz.exe
  2⤵
  PID:8172
- C:\Windows\System\SGAAAWP.exe
  C:\Windows\System\SGAAAWP.exe
  2⤵
  PID:6920
- C:\Windows\System\XpEulLE.exe
  C:\Windows\System\XpEulLE.exe
  2⤵
  PID:7228
- C:\Windows\System\UuwIdER.exe
  C:\Windows\System\UuwIdER.exe
  2⤵
  PID:7284
- C:\Windows\System\joGTflt.exe
  C:\Windows\System\joGTflt.exe
  2⤵
  PID:7344
- C:\Windows\System\SjUnLlK.exe
  C:\Windows\System\SjUnLlK.exe
  2⤵
  PID:7412
- C:\Windows\System\GiEgMqF.exe
  C:\Windows\System\GiEgMqF.exe
  2⤵
  PID:7472
- C:\Windows\System\gXOFoDl.exe
  C:\Windows\System\gXOFoDl.exe
  2⤵
  PID:7568
- C:\Windows\System\muuJrBJ.exe
  C:\Windows\System\muuJrBJ.exe
  2⤵
  PID:7596
- C:\Windows\System\CBiXbrJ.exe
  C:\Windows\System\CBiXbrJ.exe
  2⤵
  PID:7684
- C:\Windows\System\tsNnfdD.exe
  C:\Windows\System\tsNnfdD.exe
  2⤵
  PID:7752
- C:\Windows\System\OPFgtUf.exe
  C:\Windows\System\OPFgtUf.exe
  2⤵
  PID:7852
- C:\Windows\System\RJSHkaV.exe
  C:\Windows\System\RJSHkaV.exe
  2⤵
  PID:7964
- C:\Windows\System\kpNnCGk.exe
  C:\Windows\System\kpNnCGk.exe
  2⤵
  PID:7920
- C:\Windows\System\LbjPUAN.exe
  C:\Windows\System\LbjPUAN.exe
  2⤵
  PID:8076
- C:\Windows\System\JaUgyxT.exe
  C:\Windows\System\JaUgyxT.exe
  2⤵
  PID:8072
- C:\Windows\System\aNhMLwC.exe
  C:\Windows\System\aNhMLwC.exe
  2⤵
  PID:8136
- C:\Windows\System\suGVsZz.exe
  C:\Windows\System\suGVsZz.exe
  2⤵
  PID:8188
- C:\Windows\System\YBdGUrZ.exe
  C:\Windows\System\YBdGUrZ.exe
  2⤵
  PID:7388
- C:\Windows\System\jSXdVmo.exe
  C:\Windows\System\jSXdVmo.exe
  2⤵
  PID:6288
- C:\Windows\System\TRfNKhl.exe
  C:\Windows\System\TRfNKhl.exe
  2⤵
  PID:7652
- C:\Windows\System\yyVNMpz.exe
  C:\Windows\System\yyVNMpz.exe
  2⤵
  PID:7764
- C:\Windows\System\KiiDBKl.exe
  C:\Windows\System\KiiDBKl.exe
  2⤵
  PID:7792
- C:\Windows\System\hCwfVzW.exe
  C:\Windows\System\hCwfVzW.exe
  2⤵
  PID:8028
- C:\Windows\System\aKesQxF.exe
  C:\Windows\System\aKesQxF.exe
  2⤵
  PID:7532
- C:\Windows\System\HXYIjCH.exe
  C:\Windows\System\HXYIjCH.exe
  2⤵
  PID:7336
- C:\Windows\System\kSyQHEa.exe
  C:\Windows\System\kSyQHEa.exe
  2⤵
  PID:8200
- C:\Windows\System\NUYOyDu.exe
  C:\Windows\System\NUYOyDu.exe
  2⤵
  PID:8224
- C:\Windows\System\HDOgzuA.exe
  C:\Windows\System\HDOgzuA.exe
  2⤵
  PID:8268
- C:\Windows\System\WeNMEDe.exe
  C:\Windows\System\WeNMEDe.exe
  2⤵
  PID:8300
- C:\Windows\System\cXagKWP.exe
  C:\Windows\System\cXagKWP.exe
  2⤵
  PID:8324
- C:\Windows\System\SPZOIpy.exe
  C:\Windows\System\SPZOIpy.exe
  2⤵
  PID:8352
- C:\Windows\System\hpeMiys.exe
  C:\Windows\System\hpeMiys.exe
  2⤵
  PID:8384
- C:\Windows\System\LqRnLRn.exe
  C:\Windows\System\LqRnLRn.exe
  2⤵
  PID:8416
- C:\Windows\System\XapePaY.exe
  C:\Windows\System\XapePaY.exe
  2⤵
  PID:8440
- C:\Windows\System\wdmwvRs.exe
  C:\Windows\System\wdmwvRs.exe
  2⤵
  PID:8468
- C:\Windows\System\dEPxxsq.exe
  C:\Windows\System\dEPxxsq.exe
  2⤵
  PID:8492
- C:\Windows\System\PrwSQWq.exe
  C:\Windows\System\PrwSQWq.exe
  2⤵
  PID:8516
- C:\Windows\System\wwWccqp.exe
  C:\Windows\System\wwWccqp.exe
  2⤵
  PID:8532
- C:\Windows\System\lKSmQuC.exe
  C:\Windows\System\lKSmQuC.exe
  2⤵
  PID:8556
- C:\Windows\System\FRnvANC.exe
  C:\Windows\System\FRnvANC.exe
  2⤵
  PID:8584
- C:\Windows\System\kgeyKtz.exe
  C:\Windows\System\kgeyKtz.exe
  2⤵
  PID:8604
- C:\Windows\System\HweXHdY.exe
  C:\Windows\System\HweXHdY.exe
  2⤵
  PID:8624
- C:\Windows\System\ndYLkxn.exe
  C:\Windows\System\ndYLkxn.exe
  2⤵
  PID:8644
- C:\Windows\System\HNVLANY.exe
  C:\Windows\System\HNVLANY.exe
  2⤵
  PID:8676
- C:\Windows\System\cDPeWEn.exe
  C:\Windows\System\cDPeWEn.exe
  2⤵
  PID:8696
- C:\Windows\System\HbRWmSv.exe
  C:\Windows\System\HbRWmSv.exe
  2⤵
  PID:8720
- C:\Windows\System\arotEYt.exe
  C:\Windows\System\arotEYt.exe
  2⤵
  PID:8748
- C:\Windows\System\PllLKQj.exe
  C:\Windows\System\PllLKQj.exe
  2⤵
  PID:8772
- C:\Windows\System\aHwQtgQ.exe
  C:\Windows\System\aHwQtgQ.exe
  2⤵
  PID:8800
- C:\Windows\System\uSXoCuV.exe
  C:\Windows\System\uSXoCuV.exe
  2⤵
  PID:8828
- C:\Windows\System\cbHPXVM.exe
  C:\Windows\System\cbHPXVM.exe
  2⤵
  PID:8860
- C:\Windows\System\BMltyra.exe
  C:\Windows\System\BMltyra.exe
  2⤵
  PID:8892
- C:\Windows\System\QmRCQHK.exe
  C:\Windows\System\QmRCQHK.exe
  2⤵
  PID:8920
- C:\Windows\System\ZfpiHRd.exe
  C:\Windows\System\ZfpiHRd.exe
  2⤵
  PID:8944
- C:\Windows\System\wkFoVxm.exe
  C:\Windows\System\wkFoVxm.exe
  2⤵
  PID:8968
- C:\Windows\System\ghpveuz.exe
  C:\Windows\System\ghpveuz.exe
  2⤵
  PID:8996
- C:\Windows\System\lHeGGZw.exe
  C:\Windows\System\lHeGGZw.exe
  2⤵
  PID:9024
- C:\Windows\System\JUQdUyc.exe
  C:\Windows\System\JUQdUyc.exe
  2⤵
  PID:9052
- C:\Windows\System\knaVJFY.exe
  C:\Windows\System\knaVJFY.exe
  2⤵
  PID:9080
- C:\Windows\System\xrdktJt.exe
  C:\Windows\System\xrdktJt.exe
  2⤵
  PID:9104
- C:\Windows\System\nGFDGDI.exe
  C:\Windows\System\nGFDGDI.exe
  2⤵
  PID:9136
- C:\Windows\System\YqjNXMg.exe
  C:\Windows\System\YqjNXMg.exe
  2⤵
  PID:9164
- C:\Windows\System\cLPfsjJ.exe
  C:\Windows\System\cLPfsjJ.exe
  2⤵
  PID:9192
- C:\Windows\System\PKtJErP.exe
  C:\Windows\System\PKtJErP.exe
  2⤵
  PID:7912
- C:\Windows\System\KWzBZVf.exe
  C:\Windows\System\KWzBZVf.exe
  2⤵
  PID:8044
- C:\Windows\System\BQJxmZu.exe
  C:\Windows\System\BQJxmZu.exe
  2⤵
  PID:8220
- C:\Windows\System\kwlAhzT.exe
  C:\Windows\System\kwlAhzT.exe
  2⤵
  PID:8252
- C:\Windows\System\gwBCLUZ.exe
  C:\Windows\System\gwBCLUZ.exe
  2⤵
  PID:8320
- C:\Windows\System\dufINHb.exe
  C:\Windows\System\dufINHb.exe
  2⤵
  PID:8412
- C:\Windows\System\ZQmOtdV.exe
  C:\Windows\System\ZQmOtdV.exe
  2⤵
  PID:8464
- C:\Windows\System\OzQhgwb.exe
  C:\Windows\System\OzQhgwb.exe
  2⤵
  PID:8508
- C:\Windows\System\GEfDaWE.exe
  C:\Windows\System\GEfDaWE.exe
  2⤵
  PID:8664
- C:\Windows\System\DOlPIPU.exe
  C:\Windows\System\DOlPIPU.exe
  2⤵
  PID:8736
- C:\Windows\System\odehaXY.exe
  C:\Windows\System\odehaXY.exe
  2⤵
  PID:8784
- C:\Windows\System\eVlbHsz.exe
  C:\Windows\System\eVlbHsz.exe
  2⤵
  PID:8816
- C:\Windows\System\HAPpezL.exe
  C:\Windows\System\HAPpezL.exe
  2⤵
  PID:9016
- C:\Windows\System\RXFbCse.exe
  C:\Windows\System\RXFbCse.exe
  2⤵
  PID:8936
- C:\Windows\System\XlpHccv.exe
  C:\Windows\System\XlpHccv.exe
  2⤵
  PID:9124
- C:\Windows\System\RfFomuu.exe
  C:\Windows\System\RfFomuu.exe
  2⤵
  PID:9092
- C:\Windows\System\duGgihw.exe
  C:\Windows\System\duGgihw.exe
  2⤵
  PID:9180
- C:\Windows\System\faltnYC.exe
  C:\Windows\System\faltnYC.exe
  2⤵
  PID:7940
- C:\Windows\System\aJNrDkM.exe
  C:\Windows\System\aJNrDkM.exe
  2⤵
  PID:8504
- C:\Windows\System\FCzbaUr.exe
  C:\Windows\System\FCzbaUr.exe
  2⤵
  PID:8396
- C:\Windows\System\axxmjff.exe
  C:\Windows\System\axxmjff.exe
  2⤵
  PID:8612
- C:\Windows\System\eQUztmX.exe
  C:\Windows\System\eQUztmX.exe
  2⤵
  PID:8704
- C:\Windows\System\YbgYLAX.exe
  C:\Windows\System\YbgYLAX.exe
  2⤵
  PID:8980
- C:\Windows\System\VCkZOfY.exe
  C:\Windows\System\VCkZOfY.exe
  2⤵
  PID:9008
- C:\Windows\System\LMNIDDU.exe
  C:\Windows\System\LMNIDDU.exe
  2⤵
  PID:7220
- C:\Windows\System\oULmhSR.exe
  C:\Windows\System\oULmhSR.exe
  2⤵
  PID:8276
- C:\Windows\System\sWYkSAK.exe
  C:\Windows\System\sWYkSAK.exe
  2⤵
  PID:9224
- C:\Windows\System\veDPaPM.exe
  C:\Windows\System\veDPaPM.exe
  2⤵
  PID:9244
- C:\Windows\System\HrhXuZn.exe
  C:\Windows\System\HrhXuZn.exe
  2⤵
  PID:9272
- C:\Windows\System\eupJmPu.exe
  C:\Windows\System\eupJmPu.exe
  2⤵
  PID:9300
- C:\Windows\System\lJJLMqU.exe
  C:\Windows\System\lJJLMqU.exe
  2⤵
  PID:9328
- C:\Windows\System\ZxFZOLi.exe
  C:\Windows\System\ZxFZOLi.exe
  2⤵
  PID:9356
- C:\Windows\System\ZNLGgqJ.exe
  C:\Windows\System\ZNLGgqJ.exe
  2⤵
  PID:9388
- C:\Windows\System\VgWszSv.exe
  C:\Windows\System\VgWszSv.exe
  2⤵
  PID:9416
- C:\Windows\System\KeTBHKE.exe
  C:\Windows\System\KeTBHKE.exe
  2⤵
  PID:9440
- C:\Windows\System\dFKpbXG.exe
  C:\Windows\System\dFKpbXG.exe
  2⤵
  PID:9456
- C:\Windows\System\ScyKWED.exe
  C:\Windows\System\ScyKWED.exe
  2⤵
  PID:9492
- C:\Windows\System\ZMbIlkD.exe
  C:\Windows\System\ZMbIlkD.exe
  2⤵
  PID:9516
- C:\Windows\System\viZRiWu.exe
  C:\Windows\System\viZRiWu.exe
  2⤵
  PID:9544
- C:\Windows\System\ozuVzpm.exe
  C:\Windows\System\ozuVzpm.exe
  2⤵
  PID:9560
- C:\Windows\System\GsachBU.exe
  C:\Windows\System\GsachBU.exe
  2⤵
  PID:9584
- C:\Windows\System\mBJMcul.exe
  C:\Windows\System\mBJMcul.exe
  2⤵
  PID:9608
- C:\Windows\System\BsLHuKO.exe
  C:\Windows\System\BsLHuKO.exe
  2⤵
  PID:9632
- C:\Windows\System\TMsALJA.exe
  C:\Windows\System\TMsALJA.exe
  2⤵
  PID:9656
- C:\Windows\System\SZRaZIJ.exe
  C:\Windows\System\SZRaZIJ.exe
  2⤵
  PID:9684
- C:\Windows\System\TuRVcYz.exe
  C:\Windows\System\TuRVcYz.exe
  2⤵
  PID:9720
- C:\Windows\System\lPJjoJB.exe
  C:\Windows\System\lPJjoJB.exe
  2⤵
  PID:9744
- C:\Windows\System\dDEucxN.exe
  C:\Windows\System\dDEucxN.exe
  2⤵
  PID:9776
- C:\Windows\System\pyJUipi.exe
  C:\Windows\System\pyJUipi.exe
  2⤵
  PID:9800
- C:\Windows\System\bJJQHiP.exe
  C:\Windows\System\bJJQHiP.exe
  2⤵
  PID:9828
- C:\Windows\System\Sblnbcf.exe
  C:\Windows\System\Sblnbcf.exe
  2⤵
  PID:9860
- C:\Windows\System\EwySPmv.exe
  C:\Windows\System\EwySPmv.exe
  2⤵
  PID:9888
- C:\Windows\System\JHzxpKV.exe
  C:\Windows\System\JHzxpKV.exe
  2⤵
  PID:9916
- C:\Windows\System\IHcNccy.exe
  C:\Windows\System\IHcNccy.exe
  2⤵
  PID:9944
- C:\Windows\System\XobpfoT.exe
  C:\Windows\System\XobpfoT.exe
  2⤵
  PID:9972
- C:\Windows\System\ElmWvjn.exe
  C:\Windows\System\ElmWvjn.exe
  2⤵
  PID:9996
- C:\Windows\System\rsyXbKh.exe
  C:\Windows\System\rsyXbKh.exe
  2⤵
  PID:10032
- C:\Windows\System\xHdmlRP.exe
  C:\Windows\System\xHdmlRP.exe
  2⤵
  PID:10060
- C:\Windows\System\gPCqzuB.exe
  C:\Windows\System\gPCqzuB.exe
  2⤵
  PID:10084
- C:\Windows\System\bkZApFO.exe
  C:\Windows\System\bkZApFO.exe
  2⤵
  PID:10112
- C:\Windows\System\eJzzeDM.exe
  C:\Windows\System\eJzzeDM.exe
  2⤵
  PID:10160
- C:\Windows\System\EuTPmtq.exe
  C:\Windows\System\EuTPmtq.exe
  2⤵
  PID:10192
- C:\Windows\System\ytYBpCM.exe
  C:\Windows\System\ytYBpCM.exe
  2⤵
  PID:10228
- C:\Windows\System\CbWshFu.exe
  C:\Windows\System\CbWshFu.exe
  2⤵
  PID:8928
- C:\Windows\System\eBuIyTp.exe
  C:\Windows\System\eBuIyTp.exe
  2⤵
  PID:8716
- C:\Windows\System\RKnmMBm.exe
  C:\Windows\System\RKnmMBm.exe
  2⤵
  PID:9160
- C:\Windows\System\OAVoMPQ.exe
  C:\Windows\System\OAVoMPQ.exe
  2⤵
  PID:9240
- C:\Windows\System\IioucsF.exe
  C:\Windows\System\IioucsF.exe
  2⤵
  PID:9436
- C:\Windows\System\gQclJcE.exe
  C:\Windows\System\gQclJcE.exe
  2⤵
  PID:9484
- C:\Windows\System\PaJDuFd.exe
  C:\Windows\System\PaJDuFd.exe
  2⤵
  PID:9384
- C:\Windows\System\oyOBghA.exe
  C:\Windows\System\oyOBghA.exe
  2⤵
  PID:9616
- C:\Windows\System\OiZrowt.exe
  C:\Windows\System\OiZrowt.exe
  2⤵
  PID:9532
- C:\Windows\System\RMYsVsd.exe
  C:\Windows\System\RMYsVsd.exe
  2⤵
  PID:9672
- C:\Windows\System\xXOPnFo.exe
  C:\Windows\System\xXOPnFo.exe
  2⤵
  PID:9760
- C:\Windows\System\qsPtZDK.exe
  C:\Windows\System\qsPtZDK.exe
  2⤵
  PID:9704
- C:\Windows\System\OYxTrtu.exe
  C:\Windows\System\OYxTrtu.exe
  2⤵
  PID:9816
- C:\Windows\System\oWSACJR.exe
  C:\Windows\System\oWSACJR.exe
  2⤵
  PID:9928
- C:\Windows\System\wnVJeKV.exe
  C:\Windows\System\wnVJeKV.exe
  2⤵
  PID:10008
- C:\Windows\System\bjowulQ.exe
  C:\Windows\System\bjowulQ.exe
  2⤵
  PID:10096
- C:\Windows\System\bigqWrb.exe
  C:\Windows\System\bigqWrb.exe
  2⤵
  PID:10144
- C:\Windows\System\eRmHhtH.exe
  C:\Windows\System\eRmHhtH.exe
  2⤵
  PID:10156
- C:\Windows\System\eSZthwp.exe
  C:\Windows\System\eSZthwp.exe
  2⤵
  PID:9340
- C:\Windows\System\mXFKHkB.exe
  C:\Windows\System\mXFKHkB.exe
  2⤵
  PID:8552
- C:\Windows\System\LikqSDl.exe
  C:\Windows\System\LikqSDl.exe
  2⤵
  PID:9480
- C:\Windows\System\KcAQHTQ.exe
  C:\Windows\System\KcAQHTQ.exe
  2⤵
  PID:9452
- C:\Windows\System\AjbYhDU.exe
  C:\Windows\System\AjbYhDU.exe
  2⤵
  PID:9736
- C:\Windows\System\eYPpsoT.exe
  C:\Windows\System\eYPpsoT.exe
  2⤵
  PID:9884
- C:\Windows\System\egnXuXT.exe
  C:\Windows\System\egnXuXT.exe
  2⤵
  PID:9652
- C:\Windows\System\PDIjKIR.exe
  C:\Windows\System\PDIjKIR.exe
  2⤵
  PID:8064
- C:\Windows\System\QIqcdfO.exe
  C:\Windows\System\QIqcdfO.exe
  2⤵
  PID:9576
- C:\Windows\System\hzxesjw.exe
  C:\Windows\System\hzxesjw.exe
  2⤵
  PID:9528
- C:\Windows\System\SfjhfgA.exe
  C:\Windows\System\SfjhfgA.exe
  2⤵
  PID:10248
- C:\Windows\System\KTOXimZ.exe
  C:\Windows\System\KTOXimZ.exe
  2⤵
  PID:10276
- C:\Windows\System\BbUgIvI.exe
  C:\Windows\System\BbUgIvI.exe
  2⤵
  PID:10320
- C:\Windows\System\tbkHlcs.exe
  C:\Windows\System\tbkHlcs.exe
  2⤵
  PID:10348
- C:\Windows\System\KgDDvBU.exe
  C:\Windows\System\KgDDvBU.exe
  2⤵
  PID:10368
- C:\Windows\System\uGYPGOf.exe
  C:\Windows\System\uGYPGOf.exe
  2⤵
  PID:10392
- C:\Windows\System\iGVtVdy.exe
  C:\Windows\System\iGVtVdy.exe
  2⤵
  PID:10420
- C:\Windows\System\YjJCeKJ.exe
  C:\Windows\System\YjJCeKJ.exe
  2⤵
  PID:10452
- C:\Windows\System\TMDrpCT.exe
  C:\Windows\System\TMDrpCT.exe
  2⤵
  PID:10480
- C:\Windows\System\LQDkBRI.exe
  C:\Windows\System\LQDkBRI.exe
  2⤵
  PID:10512
- C:\Windows\System\mwsliOy.exe
  C:\Windows\System\mwsliOy.exe
  2⤵
  PID:10528
- C:\Windows\System\KkZfzvC.exe
  C:\Windows\System\KkZfzvC.exe
  2⤵
  PID:10548
- C:\Windows\System\ZGVPxfD.exe
  C:\Windows\System\ZGVPxfD.exe
  2⤵
  PID:10584
- C:\Windows\System\RxofWcn.exe
  C:\Windows\System\RxofWcn.exe
  2⤵
  PID:10604
- C:\Windows\System\vuWmIol.exe
  C:\Windows\System\vuWmIol.exe
  2⤵
  PID:10624
- C:\Windows\System\GBLMWHl.exe
  C:\Windows\System\GBLMWHl.exe
  2⤵
  PID:10656
- C:\Windows\System\LONLAMU.exe
  C:\Windows\System\LONLAMU.exe
  2⤵
  PID:10672
- C:\Windows\System\OdKRQGi.exe
  C:\Windows\System\OdKRQGi.exe
  2⤵
  PID:10704
- C:\Windows\System\jzGXynV.exe
  C:\Windows\System\jzGXynV.exe
  2⤵
  PID:10720
- C:\Windows\System\MSncRxt.exe
  C:\Windows\System\MSncRxt.exe
  2⤵
  PID:10752
- C:\Windows\System\vEDKICG.exe
  C:\Windows\System\vEDKICG.exe
  2⤵
  PID:10776
- C:\Windows\System\FvEFxFh.exe
  C:\Windows\System\FvEFxFh.exe
  2⤵
  PID:10800
- C:\Windows\System\ceMVsts.exe
  C:\Windows\System\ceMVsts.exe
  2⤵
  PID:10836
- C:\Windows\System\zBKyhSG.exe
  C:\Windows\System\zBKyhSG.exe
  2⤵
  PID:10864
- C:\Windows\System\IipJGbx.exe
  C:\Windows\System\IipJGbx.exe
  2⤵
  PID:10892
- C:\Windows\System\BKHspLj.exe
  C:\Windows\System\BKHspLj.exe
  2⤵
  PID:10932
- C:\Windows\System\pUqUYwg.exe
  C:\Windows\System\pUqUYwg.exe
  2⤵
  PID:10972
- C:\Windows\System\NofQwFZ.exe
  C:\Windows\System\NofQwFZ.exe
  2⤵
  PID:10996
- C:\Windows\System\ezeviRQ.exe
  C:\Windows\System\ezeviRQ.exe
  2⤵
  PID:11028
- C:\Windows\System\QAOlAVF.exe
  C:\Windows\System\QAOlAVF.exe
  2⤵
  PID:11056
- C:\Windows\System\OnurCvx.exe
  C:\Windows\System\OnurCvx.exe
  2⤵
  PID:11076
- C:\Windows\System\lWTBNtv.exe
  C:\Windows\System\lWTBNtv.exe
  2⤵
  PID:11104
- C:\Windows\System\iVZdgjR.exe
  C:\Windows\System\iVZdgjR.exe
  2⤵
  PID:11128
- C:\Windows\System\UfTkCvl.exe
  C:\Windows\System\UfTkCvl.exe
  2⤵
  PID:11160
- C:\Windows\System\IVMxnai.exe
  C:\Windows\System\IVMxnai.exe
  2⤵
  PID:11252
- C:\Windows\System\oNGJASk.exe
  C:\Windows\System\oNGJASk.exe
  2⤵
  PID:10092
- C:\Windows\System\uRMnuDk.exe
  C:\Windows\System\uRMnuDk.exe
  2⤵
  PID:9268
- C:\Windows\System\nNuydqs.exe
  C:\Windows\System\nNuydqs.exe
  2⤵
  PID:10408
- C:\Windows\System\cCcthuR.exe
  C:\Windows\System\cCcthuR.exe
  2⤵
  PID:10432
- C:\Windows\System\dmQplJz.exe
  C:\Windows\System\dmQplJz.exe
  2⤵
  PID:10308
- C:\Windows\System\MboQhCm.exe
  C:\Windows\System\MboQhCm.exe
  2⤵
  PID:10504
- C:\Windows\System\VUdBBXq.exe
  C:\Windows\System\VUdBBXq.exe
  2⤵
  PID:10472
- C:\Windows\System\DAeJjrs.exe
  C:\Windows\System\DAeJjrs.exe
  2⤵
  PID:10560
- C:\Windows\System\jbfxGcN.exe
  C:\Windows\System\jbfxGcN.exe
  2⤵
  PID:10696
- C:\Windows\System\MpxkREx.exe
  C:\Windows\System\MpxkREx.exe
  2⤵
  PID:10796
- C:\Windows\System\lCYXEhe.exe
  C:\Windows\System\lCYXEhe.exe
  2⤵
  PID:10692
- C:\Windows\System\WUzAXwi.exe
  C:\Windows\System\WUzAXwi.exe
  2⤵
  PID:10748
- C:\Windows\System\pofwAoZ.exe
  C:\Windows\System\pofwAoZ.exe
  2⤵
  PID:10988
- C:\Windows\System\WCPPxRY.exe
  C:\Windows\System\WCPPxRY.exe
  2⤵
  PID:10920
- C:\Windows\System\KnCgkFJ.exe
  C:\Windows\System\KnCgkFJ.exe
  2⤵
  PID:11084
- C:\Windows\System\aRcCabF.exe
  C:\Windows\System\aRcCabF.exe
  2⤵
  PID:10948
- C:\Windows\System\vJBumEl.exe
  C:\Windows\System\vJBumEl.exe
  2⤵
  PID:11068
- C:\Windows\System\UmXfKEB.exe
  C:\Windows\System\UmXfKEB.exe
  2⤵
  PID:11124
- C:\Windows\System\eFJNRpT.exe
  C:\Windows\System\eFJNRpT.exe
  2⤵
  PID:8432
- C:\Windows\System\hNjaxSe.exe
  C:\Windows\System\hNjaxSe.exe
  2⤵
  PID:10492
- C:\Windows\System\xiQrKfL.exe
  C:\Windows\System\xiQrKfL.exe
  2⤵
  PID:10544
- C:\Windows\System\xhytXDD.exe
  C:\Windows\System\xhytXDD.exe
  2⤵
  PID:10360
- C:\Windows\System\qzoeIVz.exe
  C:\Windows\System\qzoeIVz.exe
  2⤵
  PID:10464
- C:\Windows\System\RXRAVoK.exe
  C:\Windows\System\RXRAVoK.exe
  2⤵
  PID:10684
- C:\Windows\System\MwfHbyv.exe
  C:\Windows\System\MwfHbyv.exe
  2⤵
  PID:10848
- C:\Windows\System\hHtOTnf.exe
  C:\Windows\System\hHtOTnf.exe
  2⤵
  PID:11120
- C:\Windows\System\FEdVFdD.exe
  C:\Windows\System\FEdVFdD.exe
  2⤵
  PID:10268
- C:\Windows\System\lHrzHNu.exe
  C:\Windows\System\lHrzHNu.exe
  2⤵
  PID:10404
- C:\Windows\System\lJOHWDW.exe
  C:\Windows\System\lJOHWDW.exe
  2⤵
  PID:11268
- C:\Windows\System\RgwkvGM.exe
  C:\Windows\System\RgwkvGM.exe
  2⤵
  PID:11288
- C:\Windows\System\abMklty.exe
  C:\Windows\System\abMklty.exe
  2⤵
  PID:11328
- C:\Windows\System\yGrCGSu.exe
  C:\Windows\System\yGrCGSu.exe
  2⤵
  PID:11356
- C:\Windows\System\lItYHfU.exe
  C:\Windows\System\lItYHfU.exe
  2⤵
  PID:11384
- C:\Windows\System\Nslccbj.exe
  C:\Windows\System\Nslccbj.exe
  2⤵
  PID:11408
- C:\Windows\System\WtoOFVr.exe
  C:\Windows\System\WtoOFVr.exe
  2⤵
  PID:11424
- C:\Windows\System\vrgkFxY.exe
  C:\Windows\System\vrgkFxY.exe
  2⤵
  PID:11448
- C:\Windows\System\QxWjqlj.exe
  C:\Windows\System\QxWjqlj.exe
  2⤵
  PID:11464
- C:\Windows\System\WXCVhXM.exe
  C:\Windows\System\WXCVhXM.exe
  2⤵
  PID:11496
- C:\Windows\System\sIQaasQ.exe
  C:\Windows\System\sIQaasQ.exe
  2⤵
  PID:11520
- C:\Windows\System\psdocbW.exe
  C:\Windows\System\psdocbW.exe
  2⤵
  PID:11548
- C:\Windows\System\BFfZlKq.exe
  C:\Windows\System\BFfZlKq.exe
  2⤵
  PID:11568
- C:\Windows\System\HPqbodC.exe
  C:\Windows\System\HPqbodC.exe
  2⤵
  PID:11596
- C:\Windows\System\bXumvuz.exe
  C:\Windows\System\bXumvuz.exe
  2⤵
  PID:11620
- C:\Windows\System\dKpqysd.exe
  C:\Windows\System\dKpqysd.exe
  2⤵
  PID:11644
- C:\Windows\System\AgGBRrp.exe
  C:\Windows\System\AgGBRrp.exe
  2⤵
  PID:11668
- C:\Windows\System\bDbFjEM.exe
  C:\Windows\System\bDbFjEM.exe
  2⤵
  PID:11700
- C:\Windows\System\lZcxGkG.exe
  C:\Windows\System\lZcxGkG.exe
  2⤵
  PID:11724
- C:\Windows\System\BdPLhub.exe
  C:\Windows\System\BdPLhub.exe
  2⤵
  PID:11752
- C:\Windows\System\mmWWwCJ.exe
  C:\Windows\System\mmWWwCJ.exe
  2⤵
  PID:11784
- C:\Windows\System\yDJMoic.exe
  C:\Windows\System\yDJMoic.exe
  2⤵
  PID:11808
- C:\Windows\System\sTHAJBG.exe
  C:\Windows\System\sTHAJBG.exe
  2⤵
  PID:11836
- C:\Windows\System\Krsiruh.exe
  C:\Windows\System\Krsiruh.exe
  2⤵
  PID:11860
- C:\Windows\System\PBrTXQO.exe
  C:\Windows\System\PBrTXQO.exe
  2⤵
  PID:11892
- C:\Windows\System\hjeoeTu.exe
  C:\Windows\System\hjeoeTu.exe
  2⤵
  PID:11916
- C:\Windows\System\xRLdwJh.exe
  C:\Windows\System\xRLdwJh.exe
  2⤵
  PID:11940
- C:\Windows\System\oYQBwZL.exe
  C:\Windows\System\oYQBwZL.exe
  2⤵
  PID:11972
- C:\Windows\System\PozBMHH.exe
  C:\Windows\System\PozBMHH.exe
  2⤵
  PID:12000
- C:\Windows\System\fvmBBjv.exe
  C:\Windows\System\fvmBBjv.exe
  2⤵
  PID:12032
- C:\Windows\System\qaFveLR.exe
  C:\Windows\System\qaFveLR.exe
  2⤵
  PID:12068
- C:\Windows\System\ySzJdyb.exe
  C:\Windows\System\ySzJdyb.exe
  2⤵
  PID:12100
- C:\Windows\System\AEvPPIi.exe
  C:\Windows\System\AEvPPIi.exe
  2⤵
  PID:12124
- C:\Windows\System\NGbCJSC.exe
  C:\Windows\System\NGbCJSC.exe
  2⤵
  PID:12160
- C:\Windows\System\pwLNska.exe
  C:\Windows\System\pwLNska.exe
  2⤵
  PID:12192
- C:\Windows\System\SEcmPzr.exe
  C:\Windows\System\SEcmPzr.exe
  2⤵
  PID:12212
- C:\Windows\System\TMdiukD.exe
  C:\Windows\System\TMdiukD.exe
  2⤵
  PID:12240
- C:\Windows\System\QVNVYIw.exe
  C:\Windows\System\QVNVYIw.exe
  2⤵
  PID:12260
- C:\Windows\System\hvdLzlY.exe
  C:\Windows\System\hvdLzlY.exe
  2⤵
  PID:10732
- C:\Windows\System\EVmTlCi.exe
  C:\Windows\System\EVmTlCi.exe
  2⤵
  PID:9568
- C:\Windows\System\yFGcfOg.exe
  C:\Windows\System\yFGcfOg.exe
  2⤵
  PID:10812
- C:\Windows\System\gYNflyF.exe
  C:\Windows\System\gYNflyF.exe
  2⤵
  PID:11188
- C:\Windows\System\isDqjGE.exe
  C:\Windows\System\isDqjGE.exe
  2⤵
  PID:11140
- C:\Windows\System\lQSaBYk.exe
  C:\Windows\System\lQSaBYk.exe
  2⤵
  PID:11488
- C:\Windows\System\iQhllYK.exe
  C:\Windows\System\iQhllYK.exe
  2⤵
  PID:11508
- C:\Windows\System\cvocyQO.exe
  C:\Windows\System\cvocyQO.exe
  2⤵
  PID:11640
- C:\Windows\System\HZbhkFV.exe
  C:\Windows\System\HZbhkFV.exe
  2⤵
  PID:11436
- C:\Windows\System\owOGKdX.exe
  C:\Windows\System\owOGKdX.exe
  2⤵
  PID:11480
- C:\Windows\System\zOiicIe.exe
  C:\Windows\System\zOiicIe.exe
  2⤵
  PID:11844
- C:\Windows\System\iXqxCuh.exe
  C:\Windows\System\iXqxCuh.exe
  2⤵
  PID:11772
- C:\Windows\System\QJSElfw.exe
  C:\Windows\System\QJSElfw.exe
  2⤵
  PID:11852
- C:\Windows\System\NciaqIa.exe
  C:\Windows\System\NciaqIa.exe
  2⤵
  PID:11912
- C:\Windows\System\AiCsAss.exe
  C:\Windows\System\AiCsAss.exe
  2⤵
  PID:11980
- C:\Windows\System\KABrPAT.exe
  C:\Windows\System\KABrPAT.exe
  2⤵
  PID:11928
- C:\Windows\System\PbjdkRt.exe
  C:\Windows\System\PbjdkRt.exe
  2⤵
  PID:12184
- C:\Windows\System\tIlIvKy.exe
  C:\Windows\System\tIlIvKy.exe
  2⤵
  PID:12272
- C:\Windows\System\tjuoOjO.exe
  C:\Windows\System\tjuoOjO.exe
  2⤵
  PID:12136
- C:\Windows\System\LAJlDCX.exe
  C:\Windows\System\LAJlDCX.exe
  2⤵
  PID:11312
- C:\Windows\System\OVNpYIO.exe
  C:\Windows\System\OVNpYIO.exe
  2⤵
  PID:12248
- C:\Windows\System\HpqySYq.exe
  C:\Windows\System\HpqySYq.exe
  2⤵
  PID:11696
- C:\Windows\System\SYQBIRh.exe
  C:\Windows\System\SYQBIRh.exe
  2⤵
  PID:11444
- C:\Windows\System\PQCUDjA.exe
  C:\Windows\System\PQCUDjA.exe
  2⤵
  PID:11560
- C:\Windows\System\xGiqRxX.exe
  C:\Windows\System\xGiqRxX.exe
  2⤵
  PID:11748
- C:\Windows\System\ieZnYJp.exe
  C:\Windows\System\ieZnYJp.exe
  2⤵
  PID:11952
- C:\Windows\System\jaCSJae.exe
  C:\Windows\System\jaCSJae.exe
  2⤵
  PID:12252
- C:\Windows\System\kwCLlSL.exe
  C:\Windows\System\kwCLlSL.exe
  2⤵
  PID:11800
- C:\Windows\System\WifBCZC.exe
  C:\Windows\System\WifBCZC.exe
  2⤵
  PID:12152
- C:\Windows\System\RXJysIt.exe
  C:\Windows\System\RXJysIt.exe
  2⤵
  PID:12292
- C:\Windows\System\iJuNcTy.exe
  C:\Windows\System\iJuNcTy.exe
  2⤵
  PID:12320
- C:\Windows\System\KrNfNgX.exe
  C:\Windows\System\KrNfNgX.exe
  2⤵
  PID:12344
- C:\Windows\System\cSagwfD.exe
  C:\Windows\System\cSagwfD.exe
  2⤵
  PID:12364
- C:\Windows\System\tUZfYMZ.exe
  C:\Windows\System\tUZfYMZ.exe
  2⤵
  PID:12392
- C:\Windows\System\yJVxGsu.exe
  C:\Windows\System\yJVxGsu.exe
  2⤵
  PID:12428
- C:\Windows\System\IaVwrGX.exe
  C:\Windows\System\IaVwrGX.exe
  2⤵
  PID:12460
- C:\Windows\System\BYyxOVW.exe
  C:\Windows\System\BYyxOVW.exe
  2⤵
  PID:12484
- C:\Windows\System\OfpiVoP.exe
  C:\Windows\System\OfpiVoP.exe
  2⤵
  PID:12500
- C:\Windows\System\VdSvePs.exe
  C:\Windows\System\VdSvePs.exe
  2⤵
  PID:12524
- C:\Windows\System\NFjGPGt.exe
  C:\Windows\System\NFjGPGt.exe
  2⤵
  PID:12552
- C:\Windows\System\mPqjVZB.exe
  C:\Windows\System\mPqjVZB.exe
  2⤵
  PID:12572
- C:\Windows\System\XukZCqQ.exe
  C:\Windows\System\XukZCqQ.exe
  2⤵
  PID:12608
- C:\Windows\System\Jxlopbu.exe
  C:\Windows\System\Jxlopbu.exe
  2⤵
  PID:12628
- C:\Windows\System\PJqNUeW.exe
  C:\Windows\System\PJqNUeW.exe
  2⤵
  PID:12676
- C:\Windows\System\FMUZVJN.exe
  C:\Windows\System\FMUZVJN.exe
  2⤵
  PID:12692
- C:\Windows\System\yBiyXMb.exe
  C:\Windows\System\yBiyXMb.exe
  2⤵
  PID:12712
- C:\Windows\System\hsWIBFF.exe
  C:\Windows\System\hsWIBFF.exe
  2⤵
  PID:12732
- C:\Windows\System\ksHpVSP.exe
  C:\Windows\System\ksHpVSP.exe
  2⤵
  PID:12748
- C:\Windows\System\YAohsxw.exe
  C:\Windows\System\YAohsxw.exe
  2⤵
  PID:12768
- C:\Windows\System\roxEklp.exe
  C:\Windows\System\roxEklp.exe
  2⤵
  PID:12804
- C:\Windows\System\ATqqIBs.exe
  C:\Windows\System\ATqqIBs.exe
  2⤵
  PID:12840
- C:\Windows\System\lHPVRIm.exe
  C:\Windows\System\lHPVRIm.exe
  2⤵
  PID:12880
- C:\Windows\System\xfhmxdJ.exe
  C:\Windows\System\xfhmxdJ.exe
  2⤵
  PID:12908
- C:\Windows\System\qVYIpon.exe
  C:\Windows\System\qVYIpon.exe
  2⤵
  PID:12944
- C:\Windows\System\ezdZDrL.exe
  C:\Windows\System\ezdZDrL.exe
  2⤵
  PID:12968
- C:\Windows\System\dxFTLEu.exe
  C:\Windows\System\dxFTLEu.exe
  2⤵
  PID:12984
- C:\Windows\System\oFDGfuv.exe
  C:\Windows\System\oFDGfuv.exe
  2⤵
  PID:13008
- C:\Windows\System\zVRjLHf.exe
  C:\Windows\System\zVRjLHf.exe
  2⤵
  PID:13060
- C:\Windows\System\JvmomXj.exe
  C:\Windows\System\JvmomXj.exe
  2⤵
  PID:13108
- C:\Windows\System\sCtjbDW.exe
  C:\Windows\System\sCtjbDW.exe
  2⤵
  PID:13132
- C:\Windows\System\HdpmIHa.exe
  C:\Windows\System\HdpmIHa.exe
  2⤵
  PID:13156
- C:\Windows\System\WKUKDfV.exe
  C:\Windows\System\WKUKDfV.exe
  2⤵
  PID:13180
- C:\Windows\System\ObdsxQF.exe
  C:\Windows\System\ObdsxQF.exe
  2⤵
  PID:13204
- C:\Windows\System\sOuOZhE.exe
  C:\Windows\System\sOuOZhE.exe
  2⤵
  PID:13244
- C:\Windows\System\vCISmvh.exe
  C:\Windows\System\vCISmvh.exe
  2⤵
  PID:13260
- C:\Windows\System\vkmXKTD.exe
  C:\Windows\System\vkmXKTD.exe
  2⤵
  PID:13284
- C:\Windows\System\lmUqpDq.exe
  C:\Windows\System\lmUqpDq.exe
  2⤵
  PID:13308
- C:\Windows\System\dFjyKIU.exe
  C:\Windows\System\dFjyKIU.exe
  2⤵
  PID:11776
- C:\Windows\System\rbiUfEM.exe
  C:\Windows\System\rbiUfEM.exe
  2⤵
  PID:11988
- C:\Windows\System\xZqhGIR.exe
  C:\Windows\System\xZqhGIR.exe
  2⤵
  PID:12360
- C:\Windows\System\VQsKvRu.exe
  C:\Windows\System\VQsKvRu.exe
  2⤵
  PID:12476
- C:\Windows\System\mmvKGHw.exe
  C:\Windows\System\mmvKGHw.exe
  2⤵
  PID:12352
- C:\Windows\System\MqNtbJx.exe
  C:\Windows\System\MqNtbJx.exe
  2⤵
  PID:12120
- C:\Windows\System\WkaQHPv.exe
  C:\Windows\System\WkaQHPv.exe
  2⤵
  PID:12588
- C:\Windows\System\CZMOLfM.exe
  C:\Windows\System\CZMOLfM.exe
  2⤵
  PID:11692
- C:\Windows\System\qkuOkMB.exe
  C:\Windows\System\qkuOkMB.exe
  2⤵
  PID:12380
- C:\Windows\System\qJIEXSb.exe
  C:\Windows\System\qJIEXSb.exe
  2⤵
  PID:12544
- C:\Windows\System\vxjAbMU.exe
  C:\Windows\System\vxjAbMU.exe
  2⤵
  PID:12616
- C:\Windows\System\pSNrUKb.exe
  C:\Windows\System\pSNrUKb.exe
  2⤵
  PID:12708
- C:\Windows\System\TvWBvwz.exe
  C:\Windows\System\TvWBvwz.exe
  2⤵
  PID:12784
- C:\Windows\System\jbcUsQD.exe
  C:\Windows\System\jbcUsQD.exe
  2⤵
  PID:12892
- C:\Windows\System\MjdzrHK.exe
  C:\Windows\System\MjdzrHK.exe
  2⤵
  PID:12960
- C:\Windows\System\spnKqVW.exe
  C:\Windows\System\spnKqVW.exe
  2⤵
  PID:12996
- C:\Windows\System\mmBSpGH.exe
  C:\Windows\System\mmBSpGH.exe
  2⤵
  PID:13220
- C:\Windows\System\ObLVOxF.exe
  C:\Windows\System\ObLVOxF.exe
  2⤵
  PID:13252
- C:\Windows\System\EtKzqDX.exe
  C:\Windows\System\EtKzqDX.exe
  2⤵
  PID:12816
- C:\Windows\System\RPTgvOr.exe
  C:\Windows\System\RPTgvOr.exe
  2⤵
  PID:13144
- C:\Windows\System\LKyZcyy.exe
  C:\Windows\System\LKyZcyy.exe
  2⤵
  PID:11656
- C:\Windows\System\zHqlkZb.exe
  C:\Windows\System\zHqlkZb.exe
  2⤵
  PID:12648
- C:\Windows\System\nZIrmPf.exe
  C:\Windows\System\nZIrmPf.exe
  2⤵
  PID:12964
- C:\Windows\System\kcFAjsH.exe
  C:\Windows\System\kcFAjsH.exe
  2⤵
  PID:12924
- C:\Windows\System\bsdflMM.exe
  C:\Windows\System\bsdflMM.exe
  2⤵
  PID:12480
- C:\Windows\System\uRMDpTd.exe
  C:\Windows\System\uRMDpTd.exe
  2⤵
  PID:13316
- C:\Windows\System\CtBZzXi.exe
  C:\Windows\System\CtBZzXi.exe
  2⤵
  PID:13348
- C:\Windows\System\KtdLGaX.exe
  C:\Windows\System\KtdLGaX.exe
  2⤵
  PID:13376
- C:\Windows\System\dehxXRA.exe
  C:\Windows\System\dehxXRA.exe
  2⤵
  PID:13400
- C:\Windows\System\ksYlOih.exe
  C:\Windows\System\ksYlOih.exe
  2⤵
  PID:13432
- C:\Windows\System\zUDCwHN.exe
  C:\Windows\System\zUDCwHN.exe
  2⤵
  PID:13456
- C:\Windows\System\TPMbqPm.exe
  C:\Windows\System\TPMbqPm.exe
  2⤵
  PID:13484
- C:\Windows\System\eASYMKd.exe
  C:\Windows\System\eASYMKd.exe
  2⤵
  PID:13512
- C:\Windows\System\aaupbvE.exe
  C:\Windows\System\aaupbvE.exe
  2⤵
  PID:13532
- C:\Windows\System\pvIDjJJ.exe
  C:\Windows\System\pvIDjJJ.exe
  2⤵
  PID:13560
- C:\Windows\System\MxVihtW.exe
  C:\Windows\System\MxVihtW.exe
  2⤵
  PID:13588
- C:\Windows\System\UNrwpLC.exe
  C:\Windows\System\UNrwpLC.exe
  2⤵
  PID:13612
- C:\Windows\System\UBaDSvP.exe
  C:\Windows\System\UBaDSvP.exe
  2⤵
  PID:13640
- C:\Windows\System\dmQmAdm.exe
  C:\Windows\System\dmQmAdm.exe
  2⤵
  PID:13676
- C:\Windows\System\LDDhMWc.exe
  C:\Windows\System\LDDhMWc.exe
  2⤵
  PID:13704
- C:\Windows\System\TaDhkFM.exe
  C:\Windows\System\TaDhkFM.exe
  2⤵
  PID:13728
- C:\Windows\System\ByAmWrv.exe
  C:\Windows\System\ByAmWrv.exe
  2⤵
  PID:13756
- C:\Windows\System\sLtARLw.exe
  C:\Windows\System\sLtARLw.exe
  2⤵
  PID:13772
- C:\Windows\System\jLPLtWz.exe
  C:\Windows\System\jLPLtWz.exe
  2⤵
  PID:13800
- C:\Windows\System\QOHRZuk.exe
  C:\Windows\System\QOHRZuk.exe
  2⤵
  PID:13828
- C:\Windows\System\TehOssX.exe
  C:\Windows\System\TehOssX.exe
  2⤵
  PID:13856
- C:\Windows\System\hZAjzdY.exe
  C:\Windows\System\hZAjzdY.exe
  2⤵
  PID:13884
- C:\Windows\System\oqpECFS.exe
  C:\Windows\System\oqpECFS.exe
  2⤵
  PID:13916
- C:\Windows\System\REitqfy.exe
  C:\Windows\System\REitqfy.exe
  2⤵
  PID:13944
- C:\Windows\System\JpEIcjV.exe
  C:\Windows\System\JpEIcjV.exe
  2⤵
  PID:13964
- C:\Windows\System\VXsTeEQ.exe
  C:\Windows\System\VXsTeEQ.exe
  2⤵
  PID:13988
- C:\Windows\System\QSszrZa.exe
  C:\Windows\System\QSszrZa.exe
  2⤵
  PID:14020
- C:\Windows\System\eIyHWtD.exe
  C:\Windows\System\eIyHWtD.exe
  2⤵
  PID:14044
- C:\Windows\System\TmJVUoW.exe
  C:\Windows\System\TmJVUoW.exe
  2⤵
  PID:14076
- C:\Windows\System\goxVzFz.exe
  C:\Windows\System\goxVzFz.exe
  2⤵
  PID:14104
- C:\Windows\System\gotXRlw.exe
  C:\Windows\System\gotXRlw.exe
  2⤵
  PID:14128
- C:\Windows\System\TORRsCe.exe
  C:\Windows\System\TORRsCe.exe
  2⤵
  PID:14156
- C:\Windows\System\FmUgKno.exe
  C:\Windows\System\FmUgKno.exe
  2⤵
  PID:14176
- C:\Windows\System\QxWEwzM.exe
  C:\Windows\System\QxWEwzM.exe
  2⤵
  PID:14204
- C:\Windows\System\gRDmrRe.exe
  C:\Windows\System\gRDmrRe.exe
  2⤵
  PID:14220
- C:\Windows\System\KcVhXyG.exe
  C:\Windows\System\KcVhXyG.exe
  2⤵
  PID:14240
- C:\Windows\System\yLVcJSH.exe
  C:\Windows\System\yLVcJSH.exe
  2⤵
  PID:14260
- C:\Windows\System\zGeHGpT.exe
  C:\Windows\System\zGeHGpT.exe
  2⤵
  PID:14288
- C:\Windows\System\ulcDjYE.exe
  C:\Windows\System\ulcDjYE.exe
  2⤵
  PID:14316
- C:\Windows\System\ZlaeZbu.exe
  C:\Windows\System\ZlaeZbu.exe
  2⤵
  PID:12308
- C:\Windows\System\FWGOabr.exe
  C:\Windows\System\FWGOabr.exe
  2⤵
  PID:11516
- C:\Windows\System\HUQDEVE.exe
  C:\Windows\System\HUQDEVE.exe
  2⤵
  PID:12644
- C:\Windows\System\xQtUvYu.exe
  C:\Windows\System\xQtUvYu.exe
  2⤵
  PID:12864
- C:\Windows\System\yXQTrKD.exe
  C:\Windows\System\yXQTrKD.exe
  2⤵
  PID:13364
- C:\Windows\System\HISYDtS.exe
  C:\Windows\System\HISYDtS.exe
  2⤵
  PID:12792
- C:\Windows\System\gInTnzX.exe
  C:\Windows\System\gInTnzX.exe
  2⤵
  PID:13416
- C:\Windows\System\UGJVbji.exe
  C:\Windows\System\UGJVbji.exe
  2⤵
  PID:12048
- C:\Windows\System\GxbpEwI.exe
  C:\Windows\System\GxbpEwI.exe
  2⤵
  PID:13004
- C:\Windows\System\UGDqjvI.exe
  C:\Windows\System\UGDqjvI.exe
  2⤵
  PID:13388
- C:\Windows\System\ijvlPkX.exe
  C:\Windows\System\ijvlPkX.exe
  2⤵
  PID:13696
- C:\Windows\System\RakGyxZ.exe
  C:\Windows\System\RakGyxZ.exe
  2⤵
  PID:13468
- C:\Windows\System\GYumgfo.exe
  C:\Windows\System\GYumgfo.exe
  2⤵
  PID:13492
- C:\Windows\System\oNwSkLH.exe
  C:\Windows\System\oNwSkLH.exe
  2⤵
  PID:12020
- C:\Windows\System\MZqOZyB.exe
  C:\Windows\System\MZqOZyB.exe
  2⤵
  PID:13840
- C:\Windows\System\Zxooasj.exe
  C:\Windows\System\Zxooasj.exe
  2⤵
  PID:13876
- C:\Windows\System\AArXhPi.exe
  C:\Windows\System\AArXhPi.exe
  2⤵
  PID:13960
- C:\Windows\System\aBfRKDq.exe
  C:\Windows\System\aBfRKDq.exe
  2⤵
  PID:13788
- C:\Windows\System\fPSLbak.exe
  C:\Windows\System\fPSLbak.exe
  2⤵
  PID:14096
- C:\Windows\System\vuuEttM.exe
  C:\Windows\System\vuuEttM.exe
  2⤵
  PID:13600
- C:\Windows\System\UKVZFZx.exe
  C:\Windows\System\UKVZFZx.exe
  2⤵
  PID:14012
- C:\Windows\System\zxZyUNw.exe
  C:\Windows\System\zxZyUNw.exe
  2⤵
  PID:13764
- C:\Windows\System\MUEAfSo.exe
  C:\Windows\System\MUEAfSo.exe
  2⤵
  PID:13304
- C:\Windows\System\SbvkmOp.exe
  C:\Windows\System\SbvkmOp.exe
  2⤵
  PID:14196
- C:\Windows\System\mUSPzkd.exe
  C:\Windows\System\mUSPzkd.exe
  2⤵
  PID:12756
- C:\Windows\System\KnVimyk.exe
  C:\Windows\System\KnVimyk.exe
  2⤵
  PID:13716
- C:\Windows\System\BpZDNZU.exe
  C:\Windows\System\BpZDNZU.exe
  2⤵
  PID:14348
- C:\Windows\System\XGRSvOM.exe
  C:\Windows\System\XGRSvOM.exe
  2⤵
  PID:14372
- C:\Windows\System\LIAypVC.exe
  C:\Windows\System\LIAypVC.exe
  2⤵
  PID:14396
- C:\Windows\System\rYywhvE.exe
  C:\Windows\System\rYywhvE.exe
  2⤵
  PID:14428
- C:\Windows\System\oUWzfRB.exe
  C:\Windows\System\oUWzfRB.exe
  2⤵
  PID:14452
- C:\Windows\System\dbDbmKE.exe
  C:\Windows\System\dbDbmKE.exe
  2⤵
  PID:14476
- C:\Windows\System\pGfMCsz.exe
  C:\Windows\System\pGfMCsz.exe
  2⤵
  PID:14504
- C:\Windows\System\jFDBfzV.exe
  C:\Windows\System\jFDBfzV.exe
  2⤵
  PID:14528
- C:\Windows\System\iVamVpo.exe
  C:\Windows\System\iVamVpo.exe
  2⤵
  PID:14548
- C:\Windows\System\ElSOVtm.exe
  C:\Windows\System\ElSOVtm.exe
  2⤵
  PID:14576
- C:\Windows\System\xKewwsj.exe
  C:\Windows\System\xKewwsj.exe
  2⤵
  PID:14616
- C:\Windows\System\Qwltccj.exe
  C:\Windows\System\Qwltccj.exe
  2⤵
  PID:14632
- C:\Windows\System\LdqTweD.exe
  C:\Windows\System\LdqTweD.exe
  2⤵
  PID:14672
- C:\Windows\System\ILftcNz.exe
  C:\Windows\System\ILftcNz.exe
  2⤵
  PID:14692
- C:\Windows\System\bytZZCB.exe
  C:\Windows\System\bytZZCB.exe
  2⤵
  PID:14716
- C:\Windows\System\hFKkiXk.exe
  C:\Windows\System\hFKkiXk.exe
  2⤵
  PID:14748
- C:\Windows\System\FWGAooe.exe
  C:\Windows\System\FWGAooe.exe
  2⤵
  PID:14776
- C:\Windows\System\WRxneUs.exe
  C:\Windows\System\WRxneUs.exe
  2⤵
  PID:14796
- C:\Windows\System\ZurPGhF.exe
  C:\Windows\System\ZurPGhF.exe
  2⤵
  PID:14820
- C:\Windows\System\EaFFozH.exe
  C:\Windows\System\EaFFozH.exe
  2⤵
  PID:14852
- C:\Windows\System\zVXDQLb.exe
  C:\Windows\System\zVXDQLb.exe
  2⤵
  PID:14868
- C:\Windows\System\eHrhApO.exe
  C:\Windows\System\eHrhApO.exe
  2⤵
  PID:14896
- C:\Windows\System\KXWzdXI.exe
  C:\Windows\System\KXWzdXI.exe
  2⤵
  PID:14924
- C:\Windows\System\VKsTFiA.exe
  C:\Windows\System\VKsTFiA.exe
  2⤵
  PID:14980
- C:\Windows\System\znnUzXn.exe
  C:\Windows\System\znnUzXn.exe
  2⤵
  PID:15004
- C:\Windows\System\TtNtFEh.exe
  C:\Windows\System\TtNtFEh.exe
  2⤵
  PID:15028
- C:\Windows\System\ttvehdB.exe
  C:\Windows\System\ttvehdB.exe
  2⤵
  PID:15044
- C:\Windows\System\oBpVWpS.exe
  C:\Windows\System\oBpVWpS.exe
  2⤵
  PID:15060
- C:\Windows\System\hqGMEWq.exe
  C:\Windows\System\hqGMEWq.exe
  2⤵
  PID:15084
- C:\Windows\System\NGSdczi.exe
  C:\Windows\System\NGSdczi.exe
  2⤵
  PID:15104
- C:\Windows\System\OmqojKk.exe
  C:\Windows\System\OmqojKk.exe
  2⤵
  PID:15140
- C:\Windows\System\XyzjCOm.exe
  C:\Windows\System\XyzjCOm.exe
  2⤵
  PID:15168
- C:\Windows\System\oJHdcTw.exe
  C:\Windows\System\oJHdcTw.exe
  2⤵
  PID:15188
- C:\Windows\System\jzZZvwy.exe
  C:\Windows\System\jzZZvwy.exe
  2⤵
  PID:15220
- C:\Windows\System\jhrPVSZ.exe
  C:\Windows\System\jhrPVSZ.exe
  2⤵
  PID:15240
- C:\Windows\System\DauNUzn.exe
  C:\Windows\System\DauNUzn.exe
  2⤵
  PID:15264
- C:\Windows\System\XkETwRu.exe
  C:\Windows\System\XkETwRu.exe
  2⤵
  PID:15288
- C:\Windows\System\ytIrtsY.exe
  C:\Windows\System\ytIrtsY.exe
  2⤵
  PID:15304
- C:\Windows\System\OoqbjIc.exe
  C:\Windows\System\OoqbjIc.exe
  2⤵
  PID:15332
- C:\Windows\System\yokoWfK.exe
  C:\Windows\System\yokoWfK.exe
  2⤵
  PID:15356
- C:\Windows\System\bluYyVs.exe
  C:\Windows\System\bluYyVs.exe
  2⤵
  PID:13336
- C:\Windows\System\ZMWKBdM.exe
  C:\Windows\System\ZMWKBdM.exe
  2⤵
  PID:12312
- C:\Windows\System\VxNCQAL.exe
  C:\Windows\System\VxNCQAL.exe
  2⤵
  PID:14120
- C:\Windows\System\TQKCaMt.exe
  C:\Windows\System\TQKCaMt.exe
  2⤵
  PID:12684
- C:\Windows\System\azNusdi.exe
  C:\Windows\System\azNusdi.exe
  2⤵
  PID:14004
- C:\Windows\System\wxNLPKK.exe
  C:\Windows\System\wxNLPKK.exe
  2⤵
  PID:12052
- C:\Windows\System\aKtIvaC.exe
  C:\Windows\System\aKtIvaC.exe
  2⤵
  PID:14420
- C:\Windows\System\iSzweqV.exe
  C:\Windows\System\iSzweqV.exe
  2⤵
  PID:14536
- C:\Windows\System\wDyJsoA.exe
  C:\Windows\System\wDyJsoA.exe
  2⤵
  PID:14064
- C:\Windows\System\aGZizTK.exe
  C:\Windows\System\aGZizTK.exe
  2⤵
  PID:14368
- C:\Windows\System\PPWSdTu.exe
  C:\Windows\System\PPWSdTu.exe
  2⤵
  PID:14436
- C:\Windows\System\ggwWwuH.exe
  C:\Windows\System\ggwWwuH.exe
  2⤵
  PID:14860
- C:\Windows\System\krgqtzq.exe
  C:\Windows\System\krgqtzq.exe
  2⤵
  PID:14688
- C:\Windows\System\EDbYaWF.exe
  C:\Windows\System\EDbYaWF.exe
  2⤵
  PID:15024
- C:\Windows\System\jiRJrmI.exe
  C:\Windows\System\jiRJrmI.exe
  2⤵
  PID:14344
- C:\Windows\System\fWfmMjW.exe
  C:\Windows\System\fWfmMjW.exe
  2⤵
  PID:14768
- C:\Windows\System\jOIRIhb.exe
  C:\Windows\System\jOIRIhb.exe
  2⤵
  PID:15276
- C:\Windows\System\aMjJstQ.exe
  C:\Windows\System\aMjJstQ.exe
  2⤵
  PID:14516
- C:\Windows\System\YEsvCzy.exe
  C:\Windows\System\YEsvCzy.exe
  2⤵
  PID:14908
- C:\Windows\System\BIzeIcT.exe
  C:\Windows\System\BIzeIcT.exe
  2⤵
  PID:14572
- C:\Windows\System\taKueDh.exe
  C:\Windows\System\taKueDh.exe
  2⤵
  PID:14612
- C:\Windows\System\aIkQpEs.exe
  C:\Windows\System\aIkQpEs.exe
  2⤵
  PID:14056
- C:\Windows\System\CTbcjxW.exe
  C:\Windows\System\CTbcjxW.exe
  2⤵
  PID:14988
- C:\Windows\System\uBXFpvJ.exe
  C:\Windows\System\uBXFpvJ.exe
  2⤵
  PID:14040
- C:\Windows\System\uKkbQOW.exe
  C:\Windows\System\uKkbQOW.exe
  2⤵
  PID:15052
- C:\Windows\System\oxqxiDA.exe
  C:\Windows\System\oxqxiDA.exe
  2⤵
  PID:15080
- C:\Windows\System\mzCtPVS.exe
  C:\Windows\System\mzCtPVS.exe
  2⤵
  PID:15160
- C:\Windows\System\zRiSgVw.exe
  C:\Windows\System\zRiSgVw.exe
  2⤵
  PID:15380
- C:\Windows\System\mYagoIb.exe
  C:\Windows\System\mYagoIb.exe
  2⤵
  PID:15408
- C:\Windows\System\BkQSeAa.exe
  C:\Windows\System\BkQSeAa.exe
  2⤵
  PID:16072
- C:\Windows\System\LQeBvEs.exe
  C:\Windows\System\LQeBvEs.exe
  2⤵
  PID:16088
- C:\Windows\System\FzpWQMm.exe
  C:\Windows\System\FzpWQMm.exe
  2⤵
  PID:16104
- C:\Windows\System\SQPITkU.exe
  C:\Windows\System\SQPITkU.exe
  2⤵
  PID:16132
- C:\Windows\System\jRcfcXC.exe
  C:\Windows\System\jRcfcXC.exe
  2⤵
  PID:16160
- C:\Windows\System\RCMbnEu.exe
  C:\Windows\System\RCMbnEu.exe
  2⤵
  PID:16176
- C:\Windows\System\qdHmSec.exe
  C:\Windows\System\qdHmSec.exe
  2⤵
  PID:16204
- C:\Windows\System\VgQNycD.exe
  C:\Windows\System\VgQNycD.exe
  2⤵
  PID:16220
- C:\Windows\System\PEHMsQn.exe
  C:\Windows\System\PEHMsQn.exe
  2⤵
  PID:16236
- C:\Windows\System\TjvbpEF.exe
  C:\Windows\System\TjvbpEF.exe
  2⤵
  PID:16260
- C:\Windows\System\ReBGEQE.exe
  C:\Windows\System\ReBGEQE.exe
  2⤵
  PID:16288
- C:\Windows\System\gznTSWN.exe
  C:\Windows\System\gznTSWN.exe
  2⤵
  PID:16312
- C:\Windows\System\BPRHVop.exe
  C:\Windows\System\BPRHVop.exe
  2⤵
  PID:16340
- C:\Windows\System\xTuADMY.exe
  C:\Windows\System\xTuADMY.exe
  2⤵
  PID:16356
- C:\Windows\System\OEEawZA.exe
  C:\Windows\System\OEEawZA.exe
  2⤵
  PID:16376
- C:\Windows\System\tcwzoaM.exe
  C:\Windows\System\tcwzoaM.exe
  2⤵
  PID:14788
- C:\Windows\System\CloJjZX.exe
  C:\Windows\System\CloJjZX.exe
  2⤵
  PID:14340
- C:\Windows\System\zrDNipe.exe
  C:\Windows\System\zrDNipe.exe
  2⤵
  PID:13372
- C:\Windows\System\OgNyMbi.exe
  C:\Windows\System\OgNyMbi.exe
  2⤵
  PID:14968
- C:\Windows\System\nhdbUua.exe
  C:\Windows\System\nhdbUua.exe
  2⤵
  PID:13120
- C:\Windows\System\hUOHKdb.exe
  C:\Windows\System\hUOHKdb.exe
  2⤵
  PID:15036
- C:\Windows\System\GAzwotQ.exe
  C:\Windows\System\GAzwotQ.exe
  2⤵
  PID:748
- C:\Windows\System\PllJgKv.exe
  C:\Windows\System\PllJgKv.exe
  2⤵
  PID:15020
- C:\Windows\System\mIkIMMU.exe
  C:\Windows\System\mIkIMMU.exe
  2⤵
  PID:15296
- C:\Windows\System\RenNHRm.exe
  C:\Windows\System\RenNHRm.exe
  2⤵
  PID:15216
- C:\Windows\System\OZkcVYC.exe
  C:\Windows\System\OZkcVYC.exe
  2⤵
  PID:14904
- C:\Windows\System\SCcKstM.exe
  C:\Windows\System\SCcKstM.exe
  2⤵
  PID:14604
- C:\Windows\System\XMMBZGa.exe
  C:\Windows\System\XMMBZGa.exe
  2⤵
  PID:15128
- C:\Windows\System\eZZdZsl.exe
  C:\Windows\System\eZZdZsl.exe
  2⤵
  PID:15564
- C:\Windows\System\ljNEXyt.exe
  C:\Windows\System\ljNEXyt.exe
  2⤵
  PID:15424
- C:\Windows\System\eGGYThz.exe
  C:\Windows\System\eGGYThz.exe
  2⤵
  PID:14972
- C:\Windows\System\vVGcQDY.exe
  C:\Windows\System\vVGcQDY.exe
  2⤵
  PID:15604
- C:\Windows\System\rnbZHgJ.exe
  C:\Windows\System\rnbZHgJ.exe
  2⤵
  PID:15868
- C:\Windows\System\GYIgDGc.exe
  C:\Windows\System\GYIgDGc.exe
  2⤵
  PID:15936
- C:\Windows\System\MOKHBOo.exe
  C:\Windows\System\MOKHBOo.exe
  2⤵
  PID:15672
- C:\Windows\System\hnffcUg.exe
  C:\Windows\System\hnffcUg.exe
  2⤵
  PID:15768
- C:\Windows\System\IfdVtTt.exe
  C:\Windows\System\IfdVtTt.exe
  2⤵
  PID:15892
- C:\Windows\System\xxpohmY.exe
  C:\Windows\System\xxpohmY.exe
  2⤵
  PID:16032
- C:\Windows\System\COWeOkk.exe
  C:\Windows\System\COWeOkk.exe
  2⤵
  PID:16084
- C:\Windows\System\IywynQP.exe
  C:\Windows\System\IywynQP.exe
  2⤵
  PID:16120
- C:\Windows\System\mVlnLYD.exe
  C:\Windows\System\mVlnLYD.exe
  2⤵
  PID:16188
- C:\Windows\System\zOMTwBc.exe
  C:\Windows\System\zOMTwBc.exe
  2⤵
  PID:16256
- C:\Windows\System\oeROrWN.exe
  C:\Windows\System\oeROrWN.exe
  2⤵
  PID:16276
- C:\Windows\System\YBlHUzm.exe
  C:\Windows\System\YBlHUzm.exe
  2⤵
  PID:16304
- C:\Windows\System\DKbbJBG.exe
  C:\Windows\System\DKbbJBG.exe
  2⤵
  PID:14252
- C:\Windows\System\Cfkoupu.exe
  C:\Windows\System\Cfkoupu.exe
  2⤵
  PID:14564
- C:\Windows\System\CYOZEgB.exe
  C:\Windows\System\CYOZEgB.exe
  2⤵
  PID:14248
- C:\Windows\System\wJXSoBD.exe
  C:\Windows\System\wJXSoBD.exe
  2⤵
  PID:15184
- C:\Windows\System\hqWrSgk.exe
  C:\Windows\System\hqWrSgk.exe
  2⤵
  PID:15148
- C:\Windows\System\BDRfHXh.exe
  C:\Windows\System\BDRfHXh.exe
  2⤵
  PID:15320
- C:\Windows\System\zHxbphi.exe
  C:\Windows\System\zHxbphi.exe
  2⤵
  PID:14808
- C:\Windows\System\yKKGpQT.exe
  C:\Windows\System\yKKGpQT.exe
  2⤵
  PID:16056
- C:\Windows\System\FPtyijk.exe
  C:\Windows\System\FPtyijk.exe
  2⤵
  PID:15568
- C:\Windows\System\CLpkPtU.exe
  C:\Windows\System\CLpkPtU.exe
  2⤵
  PID:15572
- C:\Windows\System\qJcFDzC.exe
  C:\Windows\System\qJcFDzC.exe
  2⤵
  PID:15400
- C:\Windows\System\WzcsjqQ.exe
  C:\Windows\System\WzcsjqQ.exe
  2⤵
  PID:16368
- C:\Windows\System\ZHoBAKs.exe
  C:\Windows\System\ZHoBAKs.exe
  2⤵
  PID:16388
- C:\Windows\System\FiCKhYZ.exe
  C:\Windows\System\FiCKhYZ.exe
  2⤵
  PID:16416
- C:\Windows\System\uTXwaRy.exe
  C:\Windows\System\uTXwaRy.exe
  2⤵
  PID:16440
- C:\Windows\System\OdXyffy.exe
  C:\Windows\System\OdXyffy.exe
  2⤵
  PID:16460
- C:\Windows\System\hJZFLiH.exe
  C:\Windows\System\hJZFLiH.exe
  2⤵
  PID:16488
- C:\Windows\System\wMcvlFi.exe
  C:\Windows\System\wMcvlFi.exe
  2⤵
  PID:16508
- C:\Windows\System\JcZCriR.exe
  C:\Windows\System\JcZCriR.exe
  2⤵
  PID:16536
- C:\Windows\System\wwEhLsl.exe
  C:\Windows\System\wwEhLsl.exe
  2⤵
  PID:16556
- C:\Windows\System\krQfSZu.exe
  C:\Windows\System\krQfSZu.exe
  2⤵
  PID:16588
- C:\Windows\System\CtqvylY.exe
  C:\Windows\System\CtqvylY.exe
  2⤵
  PID:16612
- C:\Windows\System\KJAcwHh.exe
  C:\Windows\System\KJAcwHh.exe
  2⤵
  PID:16632
- C:\Windows\System\jJEAhYd.exe
  C:\Windows\System\jJEAhYd.exe
  2⤵
  PID:16668
- C:\Windows\System\XIToeOF.exe
  C:\Windows\System\XIToeOF.exe
  2⤵
  PID:16700
- C:\Windows\System\iCSUjgm.exe
  C:\Windows\System\iCSUjgm.exe
  2⤵
  PID:16716
- C:\Windows\System\SMQhHSC.exe
  C:\Windows\System\SMQhHSC.exe
  2⤵
  PID:16744
- C:\Windows\System\HzcrDUS.exe
  C:\Windows\System\HzcrDUS.exe
  2⤵
  PID:16760
- C:\Windows\System\IRThveK.exe
  C:\Windows\System\IRThveK.exe
  2⤵
  PID:16996
- C:\Windows\System\Rjqkpii.exe
  C:\Windows\System\Rjqkpii.exe
  2⤵
  PID:17052
- C:\Windows\System\efiCPCU.exe
  C:\Windows\System\efiCPCU.exe
  2⤵
  PID:17080
- C:\Windows\System\sRwOPLN.exe
  C:\Windows\System\sRwOPLN.exe
  2⤵
  PID:17108
- C:\Windows\System\nRVIVkF.exe
  C:\Windows\System\nRVIVkF.exe
  2⤵
  PID:17132
- C:\Windows\System\nemJowi.exe
  C:\Windows\System\nemJowi.exe
  2⤵
  PID:17148
- C:\Windows\System\XbaMYbs.exe
  C:\Windows\System\XbaMYbs.exe
  2⤵
  PID:17168
- C:\Windows\System\gDLUWHi.exe
  C:\Windows\System\gDLUWHi.exe
  2⤵
  PID:17188
- C:\Windows\System\dWMWXtU.exe
  C:\Windows\System\dWMWXtU.exe
  2⤵
  PID:17208

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:16496

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
1⤵
PID:15184

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\BVuKCYw.exe

Filesize
1.4MB

MD5
19baab3bd07dd1fe1390d1488c7cdeb7

SHA1
6500ccf8e514818c22a469a8e808bfaecd7db0d7

SHA256
df1657d40affde6955cbf0a8b21dc0e83c10f4e11a0a416a73ff626778f5f89d

SHA512
04772cce101452206086331c28b0296e822357e3c2b8b54fc9eef5f00e491dbfe9194b01f1359a21121b963b066d653786943500e7eae599fa88c9eaa055b881

Download Submit
C:\Windows\System\DfYfofk.exe

Filesize
1.4MB

MD5
380ad2eb20682d5f177026a60a95ed87

SHA1
933240e5a816c0656396be56ba6a58e1dc454374

SHA256
b6e250ce6f39cf71d46f65d614a9f7355516dc03a41f8f7fa74824ad5cf999bb

SHA512
400f5a5a639f9c76ce457ed6bd18943bb85bee495f3e309ab56cddcd1060213198b8efd117292d99d430bdb7025aa32a7e98419f5f62cebe58057a7b6c020865

Download Submit
C:\Windows\System\GpPCYah.exe

Filesize
1.4MB

MD5
a1bff6520df4822792676521b6a0a513

SHA1
43ebffe5ad35ca044c5f399e24f14c93a38ce775

SHA256
dd7cddf3ccb71b3efc73dbee0934b0d391154f875137c04b355c633e8c7f23c0

SHA512
9641cdf71571570313ff4dc6ad24a030cd6bc6e8642e04a2f0ca32ab472bc88717ca88b91dbb3bdd500e42669a51400e644e9a54a109c96ed716ff4136eb922c

Download Submit
C:\Windows\System\HNDEAiC.exe

Filesize
1.4MB

MD5
8ac78fea6ec8ae0b88d5747cf4e053ce

SHA1
8bffb37d23f1f495e2daf62d78afcc232a879081

SHA256
28da48d5a806432f996febf2baba7be4f07f12bff3eb9b83c69ab3eca4488906

SHA512
52bf25b8c4edce58a86941a9cd399ef45db08ae530b908a7abc3b386297dae97171927aea036254fa229304cb3f4c475134e7d249680fe558ee4de0480598166

Download Submit
C:\Windows\System\JfbZlBv.exe

Filesize
1.4MB

MD5
041fef3bdfb5245586d549f4a42af6c5

SHA1
707eed88f3c8e1aef47772aec8a07c32a5ecc5d6

SHA256
91d2e0f00b087bba3b130a32935bb2031ff67eb63ff319ea66d4c9619a2f4362

SHA512
27d3ce43fc33e8e1a07fc162bebf62e52a8539a5c84bcfd677dcd0a252e02cce995ff6675d9982fc6c8464cc92cf6edf0cfd48415152b63f2fe269ae8a162aa1

Download Submit
C:\Windows\System\JqZFMRV.exe

Filesize
1.4MB

MD5
e6bfde9ff43e5d2884fd3077f0b15433

SHA1
1332ad72bc9c8c290ce477a89c07dcc1354e7c74

SHA256
ecd7d2afb805938f658e7a275ba2ef8b1f3f1b29f368ff455f1b6ae9e765cb42

SHA512
9d89a9b02ea4924c4c352a27022db74beadd4607d576c8c5463350cc9c9a86bdaf888bdb823178272f62dca471ee00fe44cb67f2a011627e270afcd812e26203

Download Submit
C:\Windows\System\KcUjPFa.exe

Filesize
1.4MB

MD5
8e3f3da2dce7af3e5deb1dbdd3a2704e

SHA1
82fe53706e57f1a26b8a713cf3855be5b6097dab

SHA256
3d0f905f95e3556b5d65e5f4419f5adb5de939840915be5a65e7f7fbb5104ea2

SHA512
297a3eb5a0a6243c4b88cbff2957ffbf8235543ba39d70d9a1eeea88a47d06a6a590c549094444ba7342d03da744a9f04ef04f210a5feee76ce334d89e9b0921

Download Submit
C:\Windows\System\MfQwEqS.exe

Filesize
1.4MB

MD5
0b5dcc80f88dd88162e1f3ad2d232661

SHA1
204502307a9b29cfb6cf0e01d060849f5e53c63b

SHA256
ac3d6001838f7786f3d4ee624ae0302744803095165bb153473bed036863903d

SHA512
9721c0d843df6e3b3d1bada6ff394a11e8e517d9ab7db075fbf8ed8bf9663ce97fed144e256e76bc6b66d6ae4d03c476ea7b0288fe5a6ee8440e5b74608769f2

Download Submit
C:\Windows\System\OXQHuEA.exe

Filesize
1.4MB

MD5
87edf9eebb16dc9faf49cf33e34e100e

SHA1
f8d0c36d859394620210a50c9d172ac63faf8adc

SHA256
65292f9c113c8d70eb5866ce2e4794d2a23b7211318507caa7ab827a9559554c

SHA512
f51e4268ad62cd8b2bad4b167d31f3c866637e450fb5efa4f39e07d9381f1e96f11fbac9b8d84d2ce2a23145df762535b8039778dba784e17f5113c2d829b080

Download Submit
C:\Windows\System\OseyrNe.exe

Filesize
1.4MB

MD5
c947ef3a7145fa701997f338d8e303b1

SHA1
09cf26bf06f63dd4043b9a7b1c191ae8a5639603

SHA256
78c438e396f29a526cbbe527ee3bd4b8e918c963639981c26594cae381cae8c4

SHA512
bfb7b4e9c65c65d462fa5d00ac8213156c81b5c7d39155c280381f84678ef59801759e3eaa18aaad8e56a4aa0e8de947c171d456134c8d64650f3407acc68b9e

Download Submit
C:\Windows\System\PPywHjr.exe

Filesize
1.4MB

MD5
4e730078dd587a00e374b8f4b5541823

SHA1
3f5f0fd0c8950334f00cef236c8534346d3d69bb

SHA256
5d20d165f5a580d11801a415f9b9a75a2a5f3c23d0bd0373b3c145b431aa0473

SHA512
b80e6986d92ccb9d6c6c0c98a93f3ef2fbf5249f7eef8dbfc11d1114608aadac52f9a7c9a9b9b392f389a16345667d255ff536a1b9ad20c44760cafa212fb78a

Download Submit
C:\Windows\System\PevbdNh.exe

Filesize
1.4MB

MD5
86a3e98467c5e2cb27c30ba19ff37a2c

SHA1
1d27e23b55d68a16e21e8e38ec0766219c3d8ac1

SHA256
ecd44f7d4bc74b9683156d2dd7d3625d02ebf5f73bc3c84e9843396eebe151cc

SHA512
220f1a0d72cf93c659016b378adb58ae6c5364adbd24ab1c3e27692fb5a5f349e21f762bc8b803ccb2da1117eff92a22ed73b0974f190e7c196b8db80588eb30

Download Submit
C:\Windows\System\QYnzGZO.exe

Filesize
1.4MB

MD5
bf8257abba3fcf704a569be0bd6abd87

SHA1
6429170f448ef15e7c429e07039b46eb6114ac22

SHA256
2f0492306e7e740d02ee8a26274502fda92d1482f26f4e9e8fb4b6e6edef1d69

SHA512
091dae79e6c69213ced39b243505a96f98413363991a1b1bc98637ec6cc985b6862bd441e1255f1d96eccb1d7d05caf0fdce957e047bb238d2d8a9c2a1126d8e

Download Submit
C:\Windows\System\ROuUKMU.exe

Filesize
1.4MB

MD5
fdabfb14d36c4ec0945550d045aa3fbf

SHA1
10ed3b6273ac2a36bea3e4c7686069cd245a9a15

SHA256
17d297c722f8d527fc5e1bb7177d622a332c54837ec59849f712bc8ce1305583

SHA512
387361000af506662ce961c3b19ea32077fe7dc00ec661999035ade832fb18467b6350b054e6b2f24f1bc8cf6b2c41c7a2af06aef86a81fd1cba75341adc82a6

Download Submit
C:\Windows\System\SsSSVIi.exe

Filesize
1.4MB

MD5
ea7ff9c5abdaf25753ce392d73e4c666

SHA1
1dc5a2e7707e00388c64326cae2f6e97bacd63b0

SHA256
4bf6f8a7f7b26c62df1ef89d1a5516b207888ed00ef28c0adc9d033a323f53ea

SHA512
e07d8f5c43bb9ef1fb390eba11981f45bdbb164d90dd883197983279cacc98b76599b99202e377deb956c7dc32db4e584737bfb260c8c46b13bb9fcc07da43bd

Download Submit
C:\Windows\System\VIgmAgB.exe

Filesize
1.4MB

MD5
ce6a4c7fd1321d2313a6f0e5347710f1

SHA1
5aa5142c419335e48343d5111a5b1c188bb164da

SHA256
7ab773f9995a888a027128e22281c7b3907cab74fe92d6bbb316212710404ecd

SHA512
6fc85cb22f8c8f73c3dfb5d920f67f93981b0c33455247ebb7f44932b7bc910a62968891359bd9696be48df0775c89da2f3a64848f65e3693aa07a53e00d668c

Download Submit
C:\Windows\System\VWhTbwd.exe

Filesize
1.4MB

MD5
72a1f2a033cae43b0792ba124309bac5

SHA1
6d4f51eec7e4af580ed77c8a5d6d49619f95645f

SHA256
48402d3a722abb3d776804733f409311960eb5055f4b0cbe260ae26369275ce6

SHA512
3eb840966616ca757f0e099548ba1d83eb19ae658987fc0d44f85a4ecdedc77efa0e5610417b2931d9896e5601b4da4445f11da785b1dabbe91ff4a307fda0a5

Download Submit
C:\Windows\System\WFBDHzq.exe

Filesize
1.4MB

MD5
c64da547d455e10b362c5c0e4281404c

SHA1
bb8052b66ab4b28d1b304ba603b448b080e3a655

SHA256
cad4ba460059af35dc3a14d7233c83a6afd3ebc196ebe7f197ad0f8b5d4a1d83

SHA512
5d72d79fb3c02c969ab55bf3a893f90ed7adb23dd3bea47e3d7c3c6e343e474da54d9f9bff128d9c50aae39f94c80e9a57cdfb7be9dd49fefc23a62445034713

Download Submit
C:\Windows\System\WqmptuU.exe

Filesize
1.4MB

MD5
d3c4659eb892d50f1273e6d4fac94471

SHA1
495bf523d4e72313782e098ee39880e928191ebe

SHA256
b10e9cbb8deb51c519d1e39b5047c9318fa4c1ebe1b5bdb909c675c940cf798c

SHA512
d0cfda213a97a5281b9adb739e314099ea374cdb305e5fc0e05f50207d4a865458eff961e41f23cc7b8299ae861fde05ab2bb14fb6192cc70a82ac20688eba90

Download Submit
C:\Windows\System\aTJySpC.exe

Filesize
1.4MB

MD5
37cc28e8c9b4c2d44f186c9cc8972cfb

SHA1
362b51b873e456b5f23412f7aeb580da25b7e7ed

SHA256
f3b18a633f4917056f00e8f52fe2331d8efa8567f744a82c63c8852027e0de78

SHA512
914199f5eb340018baecc48c623e7ee252682b8dc0a2a5b1bf6adb301bafa74050c7b98b6e016bd1ae28fce6b2f9f75deede476ffabada785a1afebd489c4b79

Download Submit
C:\Windows\System\dIaaAHI.exe

Filesize
1.4MB

MD5
8b93a9ba0b9e98c3789f209e666ec8e1

SHA1
791548307deb99b2867beeea2267332358ba1c3c

SHA256
b97c4261603f2f1e9875b355376d981195c21dfe86d615164de9d43ff098fe34

SHA512
e7612e182a4147c6281b7e3f83c033070d3c80c1c9b03a152ee173132351842b75796ae372b83556e73937ca21e3783ec5e6c66e6dd093b52dafcccd01096a24

Download Submit
C:\Windows\System\fCZgjBM.exe

Filesize
1.4MB

MD5
f4ec33f68247089056e310c0d16d39b6

SHA1
390fd11f3c218d6961b5f63e3b8a0c763c792091

SHA256
fdcf9f5e7437bcd140b871b815302874204863749c238227b8d41270279a835f

SHA512
57aa5514b2463f792016cfc697b6b7b62e2bb3b6566a12dc3bd58f8d00f66b88d48d36b4079733c7d251c298a0add16abacb2f46e0d851ea9986bb7fac349abb

Download Submit
C:\Windows\System\ihWtgER.exe

Filesize
1.4MB

MD5
d6d0b5a1afb3a024c47ac0258a47adc2

SHA1
c3f8a396e75b9a569682a191062d24dd96b4f272

SHA256
10e0d54f872ff3401a104ec09f80e81851c6de796fc0330fab3d654d606255c7

SHA512
235538fca209533b02579d255e07e814a012e6e9f6e9fa38a781dd4b5051e8f7198c1a0408b258b81c136a8842ac2d6bdedd7cb6a047139aabf7c18f3a07c522

Download Submit
C:\Windows\System\jdTkhvM.exe

Filesize
1.4MB

MD5
8de422134ea9aea714392ae72d5e6ebd

SHA1
36348f0b890ec35de181726afed4ad24e33d4b84

SHA256
103bcadf11553ddab1c8d523cc45fcadd0aac89417fac1ef96bc57331db080f4

SHA512
5e5f4c3ca48d9d44a38a0e41f28af95ea612d2cd63a50aa9f604eda204f64c5bcf8a71eba506a8654182a93cfb74d25d2f9217c6d2d5b70e691924a02cd6a70e

Download Submit
C:\Windows\System\lCbSwpb.exe

Filesize
1.4MB

MD5
0806f25607906711c3f4858b2e688b4c

SHA1
51b5c818609bcda5a93d8f00593563bdb750009a

SHA256
eacd28d55e4acfa572482b4718a7b4da67636fbe1193a82d6c35f04e7b556cd1

SHA512
d986db803f113bfaa542f6c670ce6c18f78e3e82287100322b57867d621bca069e8d8893c43c5e1cd612e7c9c2206b30dd8420255eaa60494ba83afa363d10f0

Download Submit
C:\Windows\System\nxCgQde.exe

Filesize
1.4MB

MD5
5358693deae5187c7bfb208de5666a4b

SHA1
3feef30c8f2e6ca69a5aa18ca3ac7d538afa2098

SHA256
93f762a3ac490f4dd289665b87e938711b2ba6710ad30e931d5ab3a33d2f42a2

SHA512
403ef5f76486df4dadd1f349a0d8a1181446f784df9c09050f9fb1b1222b97719e5335e16b2c95f759c5a47ea5fc65679312f4538ce65579d7411379e22b6b39

Download Submit
C:\Windows\System\pQXpuTl.exe

Filesize
1.4MB

MD5
98dec3c9bbe81b6f2f817363d13cc07f

SHA1
7f3077d49e9b6eab6c4c1de9be83dda6ebc86474

SHA256
a6de56a94c7c8d50e5ab5903963a680f506f3baef0e9df0a2aa770d23aa9225f

SHA512
8662de5bc4668b87445b860f4a82fb1f53b408e89e567bd07b93db4916e659e5d7751941d488a83dceb4a34f82ae32e706f93403a1198288547acb6bf345c095

Download Submit
C:\Windows\System\qAfnhFj.exe

Filesize
1.4MB

MD5
bcca16e0842a369dcf85a03948a5faaf

SHA1
5632af07210c2c98037e0c6af90947f91557df08

SHA256
727c98e1cf36a1100a64820e7290d455f446767a4dcb6c62c214c20cbd356e8a

SHA512
76c518292e68b7a5ac70591c70b9fb83ddaa9223669fb7b6f8627c4e7d7b706e7f3faa825e62a711eabd923d4f72266c883f8a04ebf8d011c186ca89eb391da7

Download Submit
C:\Windows\System\qqyHecI.exe

Filesize
1.4MB

MD5
ad83c93b847c441c59e426feba1ae451

SHA1
c4af99b0ca431c9bdedf95fcc54a85d5060a9a48

SHA256
afaf5766d6f0683a9ac4172e0d99e98a2b4aa73eecc4317fffd515fe16f5e086

SHA512
5551c077f7d6a4b9382171d736bf90523a3f0409178736dd374497a901000d9ff2b552170263ebd14ce3fed73414c06b995a7e0ad8dcbda7bb591c14153f2aab

Download Submit
C:\Windows\System\rTuLNbl.exe

Filesize
1.4MB

MD5
5317887d7b23a1f8d51a8a07d9a23211

SHA1
d76b103b2f6438837fa563d728030fbe308dc594

SHA256
1bfd7ae26e5b6d8edd02dd8b53ba2d1a95049b5c335db5ad9a3105d58044763c

SHA512
f655141e23f70c10fe8894227de9160fce08addb63aa86ffaf20564253810275d7eb4bffcd64dab003f175b7518a6e874f35162d3dc8e1a73b56eb89a5a1ef5f

Download Submit
C:\Windows\System\rdcDHQo.exe

Filesize
1.4MB

MD5
3a060e0baf5534cf6fc7135ae20e8388

SHA1
e09ff238ccc00eb06d8e86533eacf7a656a99517

SHA256
7d21c851a7e16c2ecffd5573360704a306c177328984de4c94fd5b1d06dbcc24

SHA512
b9b9899365ad7f947f34e9184e07481150b47d29b3ccdf5d74cd32cef11fe7338912b1535f50b97abf9a320de97b7f13dce9b879d67fde0b50dfaef7c8915adb

Download Submit
C:\Windows\System\sxKVsrY.exe

Filesize
1.4MB

MD5
7491d43d4d6db89a56bdbbeabcadf340

SHA1
61302945529e83b93890863cb8ded29786a609ef

SHA256
32452d7cfaadcc98006fd104ba6e43a34a9ee4f26941c4a64bd12731fcc8c85a

SHA512
206d06c1e2b882acc0cc940c6021d6201b58b8ada24610dd127a4e25d85700b00290dd22a277b9ec4b286eedefffda08547e5bb788d8ec68764081a61c42fceb

Download Submit
C:\Windows\System\tYTBPEA.exe

Filesize
1.4MB

MD5
13c365685c7db6251169b59207559241

SHA1
3ac1dce6b4a2cfee93156176bc1bbb679b30d61a

SHA256
6d5d9f7ee26f48abf133498cb2ea802da5c93e04a6a56d1bf0e9be9043fd7b4b

SHA512
7e5996a1024a33867326f13f4600e0c657af3eaa7b70bd5b86089c3d85307ffd6b1fac4a30386e1c1f3e81c659f3a3a7bada1e7c826d3a72f2dd8378a509a471

Download Submit
C:\Windows\System\voaUzFK.exe

Filesize
1.4MB

MD5
c52d0034d0f1bbfe675c5384e2ab1779

SHA1
494b3776f999082cc89c64140652ab98e41f52fc

SHA256
5eb6effdec531722c6f414c90053b1aabb98ca702ec037978f648583083b55a0

SHA512
31c71f5b751487008d7fbcc9b928b43da10cb6721a25d167684ca80a14fd45bf39e322b93bd14a15e6a7570acd6714d487261e739cbed96865e3f72cfab15dd0

Download Submit
C:\Windows\System\zpANgJB.exe

Filesize
1.4MB

MD5
1af2f3d799bd9be29fc564fbeda57606

SHA1
64affaa445084a262e681fa530b9a4523c8db3cb

SHA256
f7e6e9fe5b5b916fc4a11cf7b31af01013ba986e91c8ca12cae744c60568e511

SHA512
093d37282dd2fb207a86bdeecd03fd16e9e2d6c01dd0e57bf0207b6cf1fa714fa32a2f02e86cbcb2edf617a6a1bc7f00249feff77caeee332dfa7a725089c4c6

Download Submit
memory/3672-0-0x0000010ED28C0000-0x0000010ED28D0000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads