xmrig | fc3069a84822163c0754f6e0311a7bcb57dde78d89a4a80962dec9cb1295b9fc

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
24-12-2024 03:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fc3069a84822163c0754f6e0311a7bcb57dde78d89a4a80962dec9cb1295b9fc.exe
Size

1.3MB
MD5

5e776fbe82444e70222961199284c6b4
SHA1

e1fc2abd988ffbeebca42d5c05fbf3eb998bccb4
SHA256

fc3069a84822163c0754f6e0311a7bcb57dde78d89a4a80962dec9cb1295b9fc
SHA512

fccb01f543ca744361ca9e88b9be08cadae5f7cc689f029894db2e85d5d2484161551698a8b19567940384d6218947046b4ef143a78e6a3de994fbd6386fa982
SSDEEP

24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbpwlKenszaDw4BcYC8qKswr+WvmF:GezaTF8FcNkNdfE0pZ9ozttwIRakG376

Score

10^/10

xmrig miner persistence privilege_escalation

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 33 IoCs

miner

resource	yara_rule
behavioral2/files/0x0009000000023c59-4.dat	xmrig
behavioral2/files/0x0007000000023c65-9.dat	xmrig
behavioral2/files/0x0007000000023c66-14.dat	xmrig
behavioral2/files/0x0007000000023c6a-35.dat	xmrig
behavioral2/files/0x0007000000023c6c-44.dat	xmrig
behavioral2/files/0x0007000000023c70-64.dat	xmrig
behavioral2/files/0x0007000000023c73-77.dat	xmrig
behavioral2/files/0x0007000000023c75-87.dat	xmrig
behavioral2/files/0x0007000000023c79-115.dat	xmrig
behavioral2/files/0x0007000000023c7f-145.dat	xmrig
behavioral2/files/0x0007000000023c84-162.dat	xmrig
behavioral2/files/0x0007000000023c82-160.dat	xmrig
behavioral2/files/0x0007000000023c83-157.dat	xmrig
behavioral2/files/0x0007000000023c81-155.dat	xmrig
behavioral2/files/0x0007000000023c80-150.dat	xmrig
behavioral2/files/0x0007000000023c7e-140.dat	xmrig
behavioral2/files/0x0007000000023c7d-135.dat	xmrig
behavioral2/files/0x0007000000023c7c-130.dat	xmrig
behavioral2/files/0x0007000000023c7b-125.dat	xmrig
behavioral2/files/0x0007000000023c7a-120.dat	xmrig
behavioral2/files/0x0007000000023c78-110.dat	xmrig
behavioral2/files/0x0007000000023c77-105.dat	xmrig
behavioral2/files/0x0007000000023c76-100.dat	xmrig
behavioral2/files/0x0007000000023c74-90.dat	xmrig
behavioral2/files/0x0007000000023c72-80.dat	xmrig
behavioral2/files/0x0007000000023c71-75.dat	xmrig
behavioral2/files/0x0007000000023c6f-62.dat	xmrig
behavioral2/files/0x0007000000023c6e-58.dat	xmrig
behavioral2/files/0x0007000000023c6d-52.dat	xmrig
behavioral2/files/0x0007000000023c6b-40.dat	xmrig
behavioral2/files/0x0007000000023c69-30.dat	xmrig
behavioral2/files/0x0007000000023c68-25.dat	xmrig
behavioral2/files/0x0007000000023c67-20.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
4888	eSJQIWW.exe
728	yRQAFdm.exe
4120	cCQnHNc.exe
4752	Jkvbsnz.exe
1660	fjNLNKw.exe
1708	gIFLfbW.exe
1032	dtblUea.exe
1216	dNQFQnI.exe
1156	ukSMZJt.exe
3672	PebHsdh.exe
3960	VKqjhBt.exe
4872	vLXDaRV.exe
1772	RQPjQvT.exe
1376	fKKnjvv.exe
2312	yqxkeNP.exe
4000	SoQyHmW.exe
1792	IxXjTsj.exe
4960	JcMxuFO.exe
4548	bTKIzhx.exe
4328	yjFjcYh.exe
1528	AbsTKZo.exe
2872	ejoAMnh.exe
4696	wYqlITM.exe
5064	AjGZSPt.exe
4524	SVXbrGc.exe
1640	fuVhnrs.exe
4220	fZTbYfM.exe
3924	DPXIRdZ.exe
4092	tOtEGeu.exe
4780	qxpWekC.exe
2884	CbTtEoA.exe
2856	TFmJRsZ.exe
4068	CWAfHkD.exe
4972	KUYdTCC.exe
4876	ezzheNJ.exe
4420	dHAIUZB.exe
4488	sNjJaBR.exe
3412	PghOlwv.exe
4304	wtDqmNu.exe
5076	RtzZpAP.exe
2268	zwqWXYW.exe
3420	QljMfzK.exe
3048	SzuSbrw.exe
2692	zGaIhXY.exe
2488	vmgGQtB.exe
2200	PfGLgGV.exe
2236	NtXxjSh.exe
3264	NNhxFKR.exe
4268	VWzGEsU.exe
2752	UglxMLi.exe
4748	gCauSfD.exe
3980	bYkWwEk.exe
3324	fMupLXl.exe
2188	anVocuL.exe
3552	FAEsxat.exe
4356	ZIaQHqw.exe
4564	XWmKSSo.exe
3668	cDhlRko.exe
1980	pINyQvO.exe
208	vPxuJBT.exe
456	WBvyJKE.exe
4008	gJrgqSB.exe
2948	ZCjDXvH.exe
4652	strUKzr.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\gCauSfD.exe	fc3069a84822163c0754f6e0311a7bcb57dde78d89a4a80962dec9cb1295b9fc.exe
File created	C:\Windows\System\fMupLXl.exe	fc3069a84822163c0754f6e0311a7bcb57dde78d89a4a80962dec9cb1295b9fc.exe
File created	C:\Windows\System\hubTIKS.exe	fc3069a84822163c0754f6e0311a7bcb57dde78d89a4a80962dec9cb1295b9fc.exe
File created	C:\Windows\System\iJeIHiz.exe	fc3069a84822163c0754f6e0311a7bcb57dde78d89a4a80962dec9cb1295b9fc.exe
File created	C:\Windows\System\GaeUfmn.exe	fc3069a84822163c0754f6e0311a7bcb57dde78d89a4a80962dec9cb1295b9fc.exe
File created	C:\Windows\System\klItwnC.exe	fc3069a84822163c0754f6e0311a7bcb57dde78d89a4a80962dec9cb1295b9fc.exe
File created	C:\Windows\System\KgzbxVh.exe	fc3069a84822163c0754f6e0311a7bcb57dde78d89a4a80962dec9cb1295b9fc.exe
File created	C:\Windows\System\bUTLllB.exe	fc3069a84822163c0754f6e0311a7bcb57dde78d89a4a80962dec9cb1295b9fc.exe
File created	C:\Windows\System\pFHmVuF.exe	fc3069a84822163c0754f6e0311a7bcb57dde78d89a4a80962dec9cb1295b9fc.exe
File created	C:\Windows\System\xZhvaYj.exe	fc3069a84822163c0754f6e0311a7bcb57dde78d89a4a80962dec9cb1295b9fc.exe
File created	C:\Windows\System\Jkvbsnz.exe	fc3069a84822163c0754f6e0311a7bcb57dde78d89a4a80962dec9cb1295b9fc.exe
File created	C:\Windows\System\JtLeNdH.exe	fc3069a84822163c0754f6e0311a7bcb57dde78d89a4a80962dec9cb1295b9fc.exe
File created	C:\Windows\System\ONcXzEZ.exe	fc3069a84822163c0754f6e0311a7bcb57dde78d89a4a80962dec9cb1295b9fc.exe
File created	C:\Windows\System\ACEgikW.exe	fc3069a84822163c0754f6e0311a7bcb57dde78d89a4a80962dec9cb1295b9fc.exe
File created	C:\Windows\System\tLuQdEt.exe	fc3069a84822163c0754f6e0311a7bcb57dde78d89a4a80962dec9cb1295b9fc.exe
File created	C:\Windows\System\gvSXEvS.exe	fc3069a84822163c0754f6e0311a7bcb57dde78d89a4a80962dec9cb1295b9fc.exe
File created	C:\Windows\System\TJIQkkw.exe	fc3069a84822163c0754f6e0311a7bcb57dde78d89a4a80962dec9cb1295b9fc.exe
File created	C:\Windows\System\uVGGaZD.exe	fc3069a84822163c0754f6e0311a7bcb57dde78d89a4a80962dec9cb1295b9fc.exe
File created	C:\Windows\System\VkJBotz.exe	fc3069a84822163c0754f6e0311a7bcb57dde78d89a4a80962dec9cb1295b9fc.exe
File created	C:\Windows\System\sdrkmmP.exe	fc3069a84822163c0754f6e0311a7bcb57dde78d89a4a80962dec9cb1295b9fc.exe
File created	C:\Windows\System\BSOlWvz.exe	fc3069a84822163c0754f6e0311a7bcb57dde78d89a4a80962dec9cb1295b9fc.exe
File created	C:\Windows\System\vPxFFrK.exe	fc3069a84822163c0754f6e0311a7bcb57dde78d89a4a80962dec9cb1295b9fc.exe
File created	C:\Windows\System\tnYCtQi.exe	fc3069a84822163c0754f6e0311a7bcb57dde78d89a4a80962dec9cb1295b9fc.exe
File created	C:\Windows\System\OwSLVgm.exe	fc3069a84822163c0754f6e0311a7bcb57dde78d89a4a80962dec9cb1295b9fc.exe
File created	C:\Windows\System\bPgeuFN.exe	fc3069a84822163c0754f6e0311a7bcb57dde78d89a4a80962dec9cb1295b9fc.exe
File created	C:\Windows\System\XVDVSXN.exe	fc3069a84822163c0754f6e0311a7bcb57dde78d89a4a80962dec9cb1295b9fc.exe
File created	C:\Windows\System\jdEPvCu.exe	fc3069a84822163c0754f6e0311a7bcb57dde78d89a4a80962dec9cb1295b9fc.exe
File created	C:\Windows\System\sMAXpUq.exe	fc3069a84822163c0754f6e0311a7bcb57dde78d89a4a80962dec9cb1295b9fc.exe
File created	C:\Windows\System\cQNypBn.exe	fc3069a84822163c0754f6e0311a7bcb57dde78d89a4a80962dec9cb1295b9fc.exe
File created	C:\Windows\System\PIIVlZh.exe	fc3069a84822163c0754f6e0311a7bcb57dde78d89a4a80962dec9cb1295b9fc.exe
File created	C:\Windows\System\lLhcDIe.exe	fc3069a84822163c0754f6e0311a7bcb57dde78d89a4a80962dec9cb1295b9fc.exe
File created	C:\Windows\System\RlzikiJ.exe	fc3069a84822163c0754f6e0311a7bcb57dde78d89a4a80962dec9cb1295b9fc.exe
File created	C:\Windows\System\Fslgmbe.exe	fc3069a84822163c0754f6e0311a7bcb57dde78d89a4a80962dec9cb1295b9fc.exe
File created	C:\Windows\System\zLXrZZy.exe	fc3069a84822163c0754f6e0311a7bcb57dde78d89a4a80962dec9cb1295b9fc.exe
File created	C:\Windows\System\kLMOYOO.exe	fc3069a84822163c0754f6e0311a7bcb57dde78d89a4a80962dec9cb1295b9fc.exe
File created	C:\Windows\System\IEJPYut.exe	fc3069a84822163c0754f6e0311a7bcb57dde78d89a4a80962dec9cb1295b9fc.exe
File created	C:\Windows\System\oJMZnxk.exe	fc3069a84822163c0754f6e0311a7bcb57dde78d89a4a80962dec9cb1295b9fc.exe
File created	C:\Windows\System\UKccbQa.exe	fc3069a84822163c0754f6e0311a7bcb57dde78d89a4a80962dec9cb1295b9fc.exe
File created	C:\Windows\System\gIFLfbW.exe	fc3069a84822163c0754f6e0311a7bcb57dde78d89a4a80962dec9cb1295b9fc.exe
File created	C:\Windows\System\BzmTdLG.exe	fc3069a84822163c0754f6e0311a7bcb57dde78d89a4a80962dec9cb1295b9fc.exe
File created	C:\Windows\System\ptbZNYm.exe	fc3069a84822163c0754f6e0311a7bcb57dde78d89a4a80962dec9cb1295b9fc.exe
File created	C:\Windows\System\xYnThHN.exe	fc3069a84822163c0754f6e0311a7bcb57dde78d89a4a80962dec9cb1295b9fc.exe
File created	C:\Windows\System\CMHFEjM.exe	fc3069a84822163c0754f6e0311a7bcb57dde78d89a4a80962dec9cb1295b9fc.exe
File created	C:\Windows\System\HtIefyE.exe	fc3069a84822163c0754f6e0311a7bcb57dde78d89a4a80962dec9cb1295b9fc.exe
File created	C:\Windows\System\ZlMWRmz.exe	fc3069a84822163c0754f6e0311a7bcb57dde78d89a4a80962dec9cb1295b9fc.exe
File created	C:\Windows\System\DxAlXVg.exe	fc3069a84822163c0754f6e0311a7bcb57dde78d89a4a80962dec9cb1295b9fc.exe
File created	C:\Windows\System\LORKqWG.exe	fc3069a84822163c0754f6e0311a7bcb57dde78d89a4a80962dec9cb1295b9fc.exe
File created	C:\Windows\System\hObejIu.exe	fc3069a84822163c0754f6e0311a7bcb57dde78d89a4a80962dec9cb1295b9fc.exe
File created	C:\Windows\System\oyadZUS.exe	fc3069a84822163c0754f6e0311a7bcb57dde78d89a4a80962dec9cb1295b9fc.exe
File created	C:\Windows\System\gWnIYhX.exe	fc3069a84822163c0754f6e0311a7bcb57dde78d89a4a80962dec9cb1295b9fc.exe
File created	C:\Windows\System\dTHXSXe.exe	fc3069a84822163c0754f6e0311a7bcb57dde78d89a4a80962dec9cb1295b9fc.exe
File created	C:\Windows\System\Hliyrya.exe	fc3069a84822163c0754f6e0311a7bcb57dde78d89a4a80962dec9cb1295b9fc.exe
File created	C:\Windows\System\uepDEVM.exe	fc3069a84822163c0754f6e0311a7bcb57dde78d89a4a80962dec9cb1295b9fc.exe
File created	C:\Windows\System\BKMWsxS.exe	fc3069a84822163c0754f6e0311a7bcb57dde78d89a4a80962dec9cb1295b9fc.exe
File created	C:\Windows\System\PFfXKnC.exe	fc3069a84822163c0754f6e0311a7bcb57dde78d89a4a80962dec9cb1295b9fc.exe
File created	C:\Windows\System\iDpWipG.exe	fc3069a84822163c0754f6e0311a7bcb57dde78d89a4a80962dec9cb1295b9fc.exe
File created	C:\Windows\System\GxMSIld.exe	fc3069a84822163c0754f6e0311a7bcb57dde78d89a4a80962dec9cb1295b9fc.exe
File created	C:\Windows\System\XbSSDYT.exe	fc3069a84822163c0754f6e0311a7bcb57dde78d89a4a80962dec9cb1295b9fc.exe
File created	C:\Windows\System\bYkWwEk.exe	fc3069a84822163c0754f6e0311a7bcb57dde78d89a4a80962dec9cb1295b9fc.exe
File created	C:\Windows\System\fuMlTaM.exe	fc3069a84822163c0754f6e0311a7bcb57dde78d89a4a80962dec9cb1295b9fc.exe
File created	C:\Windows\System\JYxDsha.exe	fc3069a84822163c0754f6e0311a7bcb57dde78d89a4a80962dec9cb1295b9fc.exe
File created	C:\Windows\System\BYZOJfB.exe	fc3069a84822163c0754f6e0311a7bcb57dde78d89a4a80962dec9cb1295b9fc.exe
File created	C:\Windows\System\FSmHpAr.exe	fc3069a84822163c0754f6e0311a7bcb57dde78d89a4a80962dec9cb1295b9fc.exe
File created	C:\Windows\System\HXBhaCl.exe	fc3069a84822163c0754f6e0311a7bcb57dde78d89a4a80962dec9cb1295b9fc.exe

Event Triggered Execution: Accessibility Features 1 TTPs
Windows contains accessibility features that may be used by adversaries to establish persistence and/or elevate privileges.
persistence privilege_escalation

Accessibility Features
T1546.008

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	16444	dwm.exe
Token: SeChangeNotifyPrivilege	16444	dwm.exe
Token: 33	16444	dwm.exe
Token: SeIncBasePriorityPrivilege	16444	dwm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1016 wrote to memory of 4888	1016	fc3069a84822163c0754f6e0311a7bcb57dde78d89a4a80962dec9cb1295b9fc.exe	84
PID 1016 wrote to memory of 4888	1016	fc3069a84822163c0754f6e0311a7bcb57dde78d89a4a80962dec9cb1295b9fc.exe	84
PID 1016 wrote to memory of 728	1016	fc3069a84822163c0754f6e0311a7bcb57dde78d89a4a80962dec9cb1295b9fc.exe	85
PID 1016 wrote to memory of 728	1016	fc3069a84822163c0754f6e0311a7bcb57dde78d89a4a80962dec9cb1295b9fc.exe	85
PID 1016 wrote to memory of 4120	1016	fc3069a84822163c0754f6e0311a7bcb57dde78d89a4a80962dec9cb1295b9fc.exe	86
PID 1016 wrote to memory of 4120	1016	fc3069a84822163c0754f6e0311a7bcb57dde78d89a4a80962dec9cb1295b9fc.exe	86
PID 1016 wrote to memory of 4752	1016	fc3069a84822163c0754f6e0311a7bcb57dde78d89a4a80962dec9cb1295b9fc.exe	87
PID 1016 wrote to memory of 4752	1016	fc3069a84822163c0754f6e0311a7bcb57dde78d89a4a80962dec9cb1295b9fc.exe	87
PID 1016 wrote to memory of 1660	1016	fc3069a84822163c0754f6e0311a7bcb57dde78d89a4a80962dec9cb1295b9fc.exe	88
PID 1016 wrote to memory of 1660	1016	fc3069a84822163c0754f6e0311a7bcb57dde78d89a4a80962dec9cb1295b9fc.exe	88
PID 1016 wrote to memory of 1708	1016	fc3069a84822163c0754f6e0311a7bcb57dde78d89a4a80962dec9cb1295b9fc.exe	89
PID 1016 wrote to memory of 1708	1016	fc3069a84822163c0754f6e0311a7bcb57dde78d89a4a80962dec9cb1295b9fc.exe	89
PID 1016 wrote to memory of 1032	1016	fc3069a84822163c0754f6e0311a7bcb57dde78d89a4a80962dec9cb1295b9fc.exe	90
PID 1016 wrote to memory of 1032	1016	fc3069a84822163c0754f6e0311a7bcb57dde78d89a4a80962dec9cb1295b9fc.exe	90
PID 1016 wrote to memory of 1216	1016	fc3069a84822163c0754f6e0311a7bcb57dde78d89a4a80962dec9cb1295b9fc.exe	91
PID 1016 wrote to memory of 1216	1016	fc3069a84822163c0754f6e0311a7bcb57dde78d89a4a80962dec9cb1295b9fc.exe	91
PID 1016 wrote to memory of 1156	1016	fc3069a84822163c0754f6e0311a7bcb57dde78d89a4a80962dec9cb1295b9fc.exe	92
PID 1016 wrote to memory of 1156	1016	fc3069a84822163c0754f6e0311a7bcb57dde78d89a4a80962dec9cb1295b9fc.exe	92
PID 1016 wrote to memory of 3672	1016	fc3069a84822163c0754f6e0311a7bcb57dde78d89a4a80962dec9cb1295b9fc.exe	93
PID 1016 wrote to memory of 3672	1016	fc3069a84822163c0754f6e0311a7bcb57dde78d89a4a80962dec9cb1295b9fc.exe	93
PID 1016 wrote to memory of 3960	1016	fc3069a84822163c0754f6e0311a7bcb57dde78d89a4a80962dec9cb1295b9fc.exe	94
PID 1016 wrote to memory of 3960	1016	fc3069a84822163c0754f6e0311a7bcb57dde78d89a4a80962dec9cb1295b9fc.exe	94
PID 1016 wrote to memory of 4872	1016	fc3069a84822163c0754f6e0311a7bcb57dde78d89a4a80962dec9cb1295b9fc.exe	95
PID 1016 wrote to memory of 4872	1016	fc3069a84822163c0754f6e0311a7bcb57dde78d89a4a80962dec9cb1295b9fc.exe	95
PID 1016 wrote to memory of 1772	1016	fc3069a84822163c0754f6e0311a7bcb57dde78d89a4a80962dec9cb1295b9fc.exe	96
PID 1016 wrote to memory of 1772	1016	fc3069a84822163c0754f6e0311a7bcb57dde78d89a4a80962dec9cb1295b9fc.exe	96
PID 1016 wrote to memory of 1376	1016	fc3069a84822163c0754f6e0311a7bcb57dde78d89a4a80962dec9cb1295b9fc.exe	97
PID 1016 wrote to memory of 1376	1016	fc3069a84822163c0754f6e0311a7bcb57dde78d89a4a80962dec9cb1295b9fc.exe	97
PID 1016 wrote to memory of 2312	1016	fc3069a84822163c0754f6e0311a7bcb57dde78d89a4a80962dec9cb1295b9fc.exe	98
PID 1016 wrote to memory of 2312	1016	fc3069a84822163c0754f6e0311a7bcb57dde78d89a4a80962dec9cb1295b9fc.exe	98
PID 1016 wrote to memory of 4000	1016	fc3069a84822163c0754f6e0311a7bcb57dde78d89a4a80962dec9cb1295b9fc.exe	99
PID 1016 wrote to memory of 4000	1016	fc3069a84822163c0754f6e0311a7bcb57dde78d89a4a80962dec9cb1295b9fc.exe	99
PID 1016 wrote to memory of 1792	1016	fc3069a84822163c0754f6e0311a7bcb57dde78d89a4a80962dec9cb1295b9fc.exe	100
PID 1016 wrote to memory of 1792	1016	fc3069a84822163c0754f6e0311a7bcb57dde78d89a4a80962dec9cb1295b9fc.exe	100
PID 1016 wrote to memory of 4960	1016	fc3069a84822163c0754f6e0311a7bcb57dde78d89a4a80962dec9cb1295b9fc.exe	101
PID 1016 wrote to memory of 4960	1016	fc3069a84822163c0754f6e0311a7bcb57dde78d89a4a80962dec9cb1295b9fc.exe	101
PID 1016 wrote to memory of 4548	1016	fc3069a84822163c0754f6e0311a7bcb57dde78d89a4a80962dec9cb1295b9fc.exe	102
PID 1016 wrote to memory of 4548	1016	fc3069a84822163c0754f6e0311a7bcb57dde78d89a4a80962dec9cb1295b9fc.exe	102
PID 1016 wrote to memory of 4328	1016	fc3069a84822163c0754f6e0311a7bcb57dde78d89a4a80962dec9cb1295b9fc.exe	103
PID 1016 wrote to memory of 4328	1016	fc3069a84822163c0754f6e0311a7bcb57dde78d89a4a80962dec9cb1295b9fc.exe	103
PID 1016 wrote to memory of 1528	1016	fc3069a84822163c0754f6e0311a7bcb57dde78d89a4a80962dec9cb1295b9fc.exe	104
PID 1016 wrote to memory of 1528	1016	fc3069a84822163c0754f6e0311a7bcb57dde78d89a4a80962dec9cb1295b9fc.exe	104
PID 1016 wrote to memory of 2872	1016	fc3069a84822163c0754f6e0311a7bcb57dde78d89a4a80962dec9cb1295b9fc.exe	105
PID 1016 wrote to memory of 2872	1016	fc3069a84822163c0754f6e0311a7bcb57dde78d89a4a80962dec9cb1295b9fc.exe	105
PID 1016 wrote to memory of 4696	1016	fc3069a84822163c0754f6e0311a7bcb57dde78d89a4a80962dec9cb1295b9fc.exe	106
PID 1016 wrote to memory of 4696	1016	fc3069a84822163c0754f6e0311a7bcb57dde78d89a4a80962dec9cb1295b9fc.exe	106
PID 1016 wrote to memory of 5064	1016	fc3069a84822163c0754f6e0311a7bcb57dde78d89a4a80962dec9cb1295b9fc.exe	107
PID 1016 wrote to memory of 5064	1016	fc3069a84822163c0754f6e0311a7bcb57dde78d89a4a80962dec9cb1295b9fc.exe	107
PID 1016 wrote to memory of 4524	1016	fc3069a84822163c0754f6e0311a7bcb57dde78d89a4a80962dec9cb1295b9fc.exe	108
PID 1016 wrote to memory of 4524	1016	fc3069a84822163c0754f6e0311a7bcb57dde78d89a4a80962dec9cb1295b9fc.exe	108
PID 1016 wrote to memory of 1640	1016	fc3069a84822163c0754f6e0311a7bcb57dde78d89a4a80962dec9cb1295b9fc.exe	109
PID 1016 wrote to memory of 1640	1016	fc3069a84822163c0754f6e0311a7bcb57dde78d89a4a80962dec9cb1295b9fc.exe	109
PID 1016 wrote to memory of 4220	1016	fc3069a84822163c0754f6e0311a7bcb57dde78d89a4a80962dec9cb1295b9fc.exe	110
PID 1016 wrote to memory of 4220	1016	fc3069a84822163c0754f6e0311a7bcb57dde78d89a4a80962dec9cb1295b9fc.exe	110
PID 1016 wrote to memory of 3924	1016	fc3069a84822163c0754f6e0311a7bcb57dde78d89a4a80962dec9cb1295b9fc.exe	111
PID 1016 wrote to memory of 3924	1016	fc3069a84822163c0754f6e0311a7bcb57dde78d89a4a80962dec9cb1295b9fc.exe	111
PID 1016 wrote to memory of 4092	1016	fc3069a84822163c0754f6e0311a7bcb57dde78d89a4a80962dec9cb1295b9fc.exe	112
PID 1016 wrote to memory of 4092	1016	fc3069a84822163c0754f6e0311a7bcb57dde78d89a4a80962dec9cb1295b9fc.exe	112
PID 1016 wrote to memory of 4780	1016	fc3069a84822163c0754f6e0311a7bcb57dde78d89a4a80962dec9cb1295b9fc.exe	113
PID 1016 wrote to memory of 4780	1016	fc3069a84822163c0754f6e0311a7bcb57dde78d89a4a80962dec9cb1295b9fc.exe	113
PID 1016 wrote to memory of 2884	1016	fc3069a84822163c0754f6e0311a7bcb57dde78d89a4a80962dec9cb1295b9fc.exe	114
PID 1016 wrote to memory of 2884	1016	fc3069a84822163c0754f6e0311a7bcb57dde78d89a4a80962dec9cb1295b9fc.exe	114
PID 1016 wrote to memory of 2856	1016	fc3069a84822163c0754f6e0311a7bcb57dde78d89a4a80962dec9cb1295b9fc.exe	115
PID 1016 wrote to memory of 2856	1016	fc3069a84822163c0754f6e0311a7bcb57dde78d89a4a80962dec9cb1295b9fc.exe	115

C:\Users\Admin\AppData\Local\Temp\fc3069a84822163c0754f6e0311a7bcb57dde78d89a4a80962dec9cb1295b9fc.exe
"C:\Users\Admin\AppData\Local\Temp\fc3069a84822163c0754f6e0311a7bcb57dde78d89a4a80962dec9cb1295b9fc.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1016
- C:\Windows\System\eSJQIWW.exe
  C:\Windows\System\eSJQIWW.exe
  2⤵
  - Executes dropped EXE
  PID:4888
- C:\Windows\System\yRQAFdm.exe
  C:\Windows\System\yRQAFdm.exe
  2⤵
  - Executes dropped EXE
  PID:728
- C:\Windows\System\cCQnHNc.exe
  C:\Windows\System\cCQnHNc.exe
  2⤵
  - Executes dropped EXE
  PID:4120
- C:\Windows\System\Jkvbsnz.exe
  C:\Windows\System\Jkvbsnz.exe
  2⤵
  - Executes dropped EXE
  PID:4752
- C:\Windows\System\fjNLNKw.exe
  C:\Windows\System\fjNLNKw.exe
  2⤵
  - Executes dropped EXE
  PID:1660
- C:\Windows\System\gIFLfbW.exe
  C:\Windows\System\gIFLfbW.exe
  2⤵
  - Executes dropped EXE
  PID:1708
- C:\Windows\System\dtblUea.exe
  C:\Windows\System\dtblUea.exe
  2⤵
  - Executes dropped EXE
  PID:1032
- C:\Windows\System\dNQFQnI.exe
  C:\Windows\System\dNQFQnI.exe
  2⤵
  - Executes dropped EXE
  PID:1216
- C:\Windows\System\ukSMZJt.exe
  C:\Windows\System\ukSMZJt.exe
  2⤵
  - Executes dropped EXE
  PID:1156
- C:\Windows\System\PebHsdh.exe
  C:\Windows\System\PebHsdh.exe
  2⤵
  - Executes dropped EXE
  PID:3672
- C:\Windows\System\VKqjhBt.exe
  C:\Windows\System\VKqjhBt.exe
  2⤵
  - Executes dropped EXE
  PID:3960
- C:\Windows\System\vLXDaRV.exe
  C:\Windows\System\vLXDaRV.exe
  2⤵
  - Executes dropped EXE
  PID:4872
- C:\Windows\System\RQPjQvT.exe
  C:\Windows\System\RQPjQvT.exe
  2⤵
  - Executes dropped EXE
  PID:1772
- C:\Windows\System\fKKnjvv.exe
  C:\Windows\System\fKKnjvv.exe
  2⤵
  - Executes dropped EXE
  PID:1376
- C:\Windows\System\yqxkeNP.exe
  C:\Windows\System\yqxkeNP.exe
  2⤵
  - Executes dropped EXE
  PID:2312
- C:\Windows\System\SoQyHmW.exe
  C:\Windows\System\SoQyHmW.exe
  2⤵
  - Executes dropped EXE
  PID:4000
- C:\Windows\System\IxXjTsj.exe
  C:\Windows\System\IxXjTsj.exe
  2⤵
  - Executes dropped EXE
  PID:1792
- C:\Windows\System\JcMxuFO.exe
  C:\Windows\System\JcMxuFO.exe
  2⤵
  - Executes dropped EXE
  PID:4960
- C:\Windows\System\bTKIzhx.exe
  C:\Windows\System\bTKIzhx.exe
  2⤵
  - Executes dropped EXE
  PID:4548
- C:\Windows\System\yjFjcYh.exe
  C:\Windows\System\yjFjcYh.exe
  2⤵
  - Executes dropped EXE
  PID:4328
- C:\Windows\System\AbsTKZo.exe
  C:\Windows\System\AbsTKZo.exe
  2⤵
  - Executes dropped EXE
  PID:1528
- C:\Windows\System\ejoAMnh.exe
  C:\Windows\System\ejoAMnh.exe
  2⤵
  - Executes dropped EXE
  PID:2872
- C:\Windows\System\wYqlITM.exe
  C:\Windows\System\wYqlITM.exe
  2⤵
  - Executes dropped EXE
  PID:4696
- C:\Windows\System\AjGZSPt.exe
  C:\Windows\System\AjGZSPt.exe
  2⤵
  - Executes dropped EXE
  PID:5064
- C:\Windows\System\SVXbrGc.exe
  C:\Windows\System\SVXbrGc.exe
  2⤵
  - Executes dropped EXE
  PID:4524
- C:\Windows\System\fuVhnrs.exe
  C:\Windows\System\fuVhnrs.exe
  2⤵
  - Executes dropped EXE
  PID:1640
- C:\Windows\System\fZTbYfM.exe
  C:\Windows\System\fZTbYfM.exe
  2⤵
  - Executes dropped EXE
  PID:4220
- C:\Windows\System\DPXIRdZ.exe
  C:\Windows\System\DPXIRdZ.exe
  2⤵
  - Executes dropped EXE
  PID:3924
- C:\Windows\System\tOtEGeu.exe
  C:\Windows\System\tOtEGeu.exe
  2⤵
  - Executes dropped EXE
  PID:4092
- C:\Windows\System\qxpWekC.exe
  C:\Windows\System\qxpWekC.exe
  2⤵
  - Executes dropped EXE
  PID:4780
- C:\Windows\System\CbTtEoA.exe
  C:\Windows\System\CbTtEoA.exe
  2⤵
  - Executes dropped EXE
  PID:2884
- C:\Windows\System\TFmJRsZ.exe
  C:\Windows\System\TFmJRsZ.exe
  2⤵
  - Executes dropped EXE
  PID:2856
- C:\Windows\System\CWAfHkD.exe
  C:\Windows\System\CWAfHkD.exe
  2⤵
  - Executes dropped EXE
  PID:4068
- C:\Windows\System\KUYdTCC.exe
  C:\Windows\System\KUYdTCC.exe
  2⤵
  - Executes dropped EXE
  PID:4972
- C:\Windows\System\ezzheNJ.exe
  C:\Windows\System\ezzheNJ.exe
  2⤵
  - Executes dropped EXE
  PID:4876
- C:\Windows\System\dHAIUZB.exe
  C:\Windows\System\dHAIUZB.exe
  2⤵
  - Executes dropped EXE
  PID:4420
- C:\Windows\System\sNjJaBR.exe
  C:\Windows\System\sNjJaBR.exe
  2⤵
  - Executes dropped EXE
  PID:4488
- C:\Windows\System\PghOlwv.exe
  C:\Windows\System\PghOlwv.exe
  2⤵
  - Executes dropped EXE
  PID:3412
- C:\Windows\System\wtDqmNu.exe
  C:\Windows\System\wtDqmNu.exe
  2⤵
  - Executes dropped EXE
  PID:4304
- C:\Windows\System\RtzZpAP.exe
  C:\Windows\System\RtzZpAP.exe
  2⤵
  - Executes dropped EXE
  PID:5076
- C:\Windows\System\zwqWXYW.exe
  C:\Windows\System\zwqWXYW.exe
  2⤵
  - Executes dropped EXE
  PID:2268
- C:\Windows\System\QljMfzK.exe
  C:\Windows\System\QljMfzK.exe
  2⤵
  - Executes dropped EXE
  PID:3420
- C:\Windows\System\SzuSbrw.exe
  C:\Windows\System\SzuSbrw.exe
  2⤵
  - Executes dropped EXE
  PID:3048
- C:\Windows\System\zGaIhXY.exe
  C:\Windows\System\zGaIhXY.exe
  2⤵
  - Executes dropped EXE
  PID:2692
- C:\Windows\System\vmgGQtB.exe
  C:\Windows\System\vmgGQtB.exe
  2⤵
  - Executes dropped EXE
  PID:2488
- C:\Windows\System\PfGLgGV.exe
  C:\Windows\System\PfGLgGV.exe
  2⤵
  - Executes dropped EXE
  PID:2200
- C:\Windows\System\NtXxjSh.exe
  C:\Windows\System\NtXxjSh.exe
  2⤵
  - Executes dropped EXE
  PID:2236
- C:\Windows\System\NNhxFKR.exe
  C:\Windows\System\NNhxFKR.exe
  2⤵
  - Executes dropped EXE
  PID:3264
- C:\Windows\System\VWzGEsU.exe
  C:\Windows\System\VWzGEsU.exe
  2⤵
  - Executes dropped EXE
  PID:4268
- C:\Windows\System\UglxMLi.exe
  C:\Windows\System\UglxMLi.exe
  2⤵
  - Executes dropped EXE
  PID:2752
- C:\Windows\System\gCauSfD.exe
  C:\Windows\System\gCauSfD.exe
  2⤵
  - Executes dropped EXE
  PID:4748
- C:\Windows\System\bYkWwEk.exe
  C:\Windows\System\bYkWwEk.exe
  2⤵
  - Executes dropped EXE
  PID:3980
- C:\Windows\System\fMupLXl.exe
  C:\Windows\System\fMupLXl.exe
  2⤵
  - Executes dropped EXE
  PID:3324
- C:\Windows\System\anVocuL.exe
  C:\Windows\System\anVocuL.exe
  2⤵
  - Executes dropped EXE
  PID:2188
- C:\Windows\System\FAEsxat.exe
  C:\Windows\System\FAEsxat.exe
  2⤵
  - Executes dropped EXE
  PID:3552
- C:\Windows\System\ZIaQHqw.exe
  C:\Windows\System\ZIaQHqw.exe
  2⤵
  - Executes dropped EXE
  PID:4356
- C:\Windows\System\XWmKSSo.exe
  C:\Windows\System\XWmKSSo.exe
  2⤵
  - Executes dropped EXE
  PID:4564
- C:\Windows\System\cDhlRko.exe
  C:\Windows\System\cDhlRko.exe
  2⤵
  - Executes dropped EXE
  PID:3668
- C:\Windows\System\pINyQvO.exe
  C:\Windows\System\pINyQvO.exe
  2⤵
  - Executes dropped EXE
  PID:1980
- C:\Windows\System\vPxuJBT.exe
  C:\Windows\System\vPxuJBT.exe
  2⤵
  - Executes dropped EXE
  PID:208
- C:\Windows\System\WBvyJKE.exe
  C:\Windows\System\WBvyJKE.exe
  2⤵
  - Executes dropped EXE
  PID:456
- C:\Windows\System\gJrgqSB.exe
  C:\Windows\System\gJrgqSB.exe
  2⤵
  - Executes dropped EXE
  PID:4008
- C:\Windows\System\ZCjDXvH.exe
  C:\Windows\System\ZCjDXvH.exe
  2⤵
  - Executes dropped EXE
  PID:2948
- C:\Windows\System\strUKzr.exe
  C:\Windows\System\strUKzr.exe
  2⤵
  - Executes dropped EXE
  PID:4652
- C:\Windows\System\iaqEeGi.exe
  C:\Windows\System\iaqEeGi.exe
  2⤵
  PID:2284
- C:\Windows\System\UfiySaG.exe
  C:\Windows\System\UfiySaG.exe
  2⤵
  PID:32
- C:\Windows\System\JAjZoZj.exe
  C:\Windows\System\JAjZoZj.exe
  2⤵
  PID:5084
- C:\Windows\System\Qehamas.exe
  C:\Windows\System\Qehamas.exe
  2⤵
  PID:960
- C:\Windows\System\mNOojYi.exe
  C:\Windows\System\mNOojYi.exe
  2⤵
  PID:3752
- C:\Windows\System\VGoMLFj.exe
  C:\Windows\System\VGoMLFj.exe
  2⤵
  PID:4760
- C:\Windows\System\ycqXSTj.exe
  C:\Windows\System\ycqXSTj.exe
  2⤵
  PID:5088
- C:\Windows\System\wjFCtQd.exe
  C:\Windows\System\wjFCtQd.exe
  2⤵
  PID:1412
- C:\Windows\System\VtxmgSW.exe
  C:\Windows\System\VtxmgSW.exe
  2⤵
  PID:4164
- C:\Windows\System\TcSqEjt.exe
  C:\Windows\System\TcSqEjt.exe
  2⤵
  PID:2220
- C:\Windows\System\niWffYb.exe
  C:\Windows\System\niWffYb.exe
  2⤵
  PID:3876
- C:\Windows\System\VTzSgLf.exe
  C:\Windows\System\VTzSgLf.exe
  2⤵
  PID:3928
- C:\Windows\System\vwLkkuo.exe
  C:\Windows\System\vwLkkuo.exe
  2⤵
  PID:3816
- C:\Windows\System\zDGOjFh.exe
  C:\Windows\System\zDGOjFh.exe
  2⤵
  PID:1496
- C:\Windows\System\BwTuDNH.exe
  C:\Windows\System\BwTuDNH.exe
  2⤵
  PID:4228
- C:\Windows\System\zDRvkTx.exe
  C:\Windows\System\zDRvkTx.exe
  2⤵
  PID:3652
- C:\Windows\System\AooOwhS.exe
  C:\Windows\System\AooOwhS.exe
  2⤵
  PID:1272
- C:\Windows\System\PqFKdzo.exe
  C:\Windows\System\PqFKdzo.exe
  2⤵
  PID:1256
- C:\Windows\System\JTtFXgT.exe
  C:\Windows\System\JTtFXgT.exe
  2⤵
  PID:2208
- C:\Windows\System\CGJUHqa.exe
  C:\Windows\System\CGJUHqa.exe
  2⤵
  PID:1536
- C:\Windows\System\UtWSlzr.exe
  C:\Windows\System\UtWSlzr.exe
  2⤵
  PID:5144
- C:\Windows\System\fAHFaix.exe
  C:\Windows\System\fAHFaix.exe
  2⤵
  PID:5168
- C:\Windows\System\iEaPZSt.exe
  C:\Windows\System\iEaPZSt.exe
  2⤵
  PID:5200
- C:\Windows\System\JtLeNdH.exe
  C:\Windows\System\JtLeNdH.exe
  2⤵
  PID:5228
- C:\Windows\System\qSLFqcZ.exe
  C:\Windows\System\qSLFqcZ.exe
  2⤵
  PID:5256
- C:\Windows\System\CKdcdnf.exe
  C:\Windows\System\CKdcdnf.exe
  2⤵
  PID:5280
- C:\Windows\System\tLuQdEt.exe
  C:\Windows\System\tLuQdEt.exe
  2⤵
  PID:5316
- C:\Windows\System\qAPLzQX.exe
  C:\Windows\System\qAPLzQX.exe
  2⤵
  PID:5348
- C:\Windows\System\meYpyTN.exe
  C:\Windows\System\meYpyTN.exe
  2⤵
  PID:5380
- C:\Windows\System\YDqgWXc.exe
  C:\Windows\System\YDqgWXc.exe
  2⤵
  PID:5404
- C:\Windows\System\ExCPgNs.exe
  C:\Windows\System\ExCPgNs.exe
  2⤵
  PID:5424
- C:\Windows\System\CXgxuVU.exe
  C:\Windows\System\CXgxuVU.exe
  2⤵
  PID:5452
- C:\Windows\System\kEbbEHL.exe
  C:\Windows\System\kEbbEHL.exe
  2⤵
  PID:5476
- C:\Windows\System\EUKttTb.exe
  C:\Windows\System\EUKttTb.exe
  2⤵
  PID:5508
- C:\Windows\System\GcJlDVY.exe
  C:\Windows\System\GcJlDVY.exe
  2⤵
  PID:5536
- C:\Windows\System\KjpvRLG.exe
  C:\Windows\System\KjpvRLG.exe
  2⤵
  PID:5560
- C:\Windows\System\QAlVTBm.exe
  C:\Windows\System\QAlVTBm.exe
  2⤵
  PID:5592
- C:\Windows\System\PLmIDRw.exe
  C:\Windows\System\PLmIDRw.exe
  2⤵
  PID:5624
- C:\Windows\System\ZFbqRbd.exe
  C:\Windows\System\ZFbqRbd.exe
  2⤵
  PID:5652
- C:\Windows\System\mawjztR.exe
  C:\Windows\System\mawjztR.exe
  2⤵
  PID:5684
- C:\Windows\System\bpZmQlN.exe
  C:\Windows\System\bpZmQlN.exe
  2⤵
  PID:5716
- C:\Windows\System\BYIOFru.exe
  C:\Windows\System\BYIOFru.exe
  2⤵
  PID:5740
- C:\Windows\System\xkfSrcO.exe
  C:\Windows\System\xkfSrcO.exe
  2⤵
  PID:5760
- C:\Windows\System\pamJEij.exe
  C:\Windows\System\pamJEij.exe
  2⤵
  PID:5788
- C:\Windows\System\ZlYNbYj.exe
  C:\Windows\System\ZlYNbYj.exe
  2⤵
  PID:5812
- C:\Windows\System\LsKoQFY.exe
  C:\Windows\System\LsKoQFY.exe
  2⤵
  PID:5844
- C:\Windows\System\mwZMbtx.exe
  C:\Windows\System\mwZMbtx.exe
  2⤵
  PID:5872
- C:\Windows\System\HZDZxlG.exe
  C:\Windows\System\HZDZxlG.exe
  2⤵
  PID:5896
- C:\Windows\System\vHfBLnn.exe
  C:\Windows\System\vHfBLnn.exe
  2⤵
  PID:5928
- C:\Windows\System\oFyYvpQ.exe
  C:\Windows\System\oFyYvpQ.exe
  2⤵
  PID:5956
- C:\Windows\System\NhlIWPK.exe
  C:\Windows\System\NhlIWPK.exe
  2⤵
  PID:5984
- C:\Windows\System\GenSZdh.exe
  C:\Windows\System\GenSZdh.exe
  2⤵
  PID:6008
- C:\Windows\System\gvSXEvS.exe
  C:\Windows\System\gvSXEvS.exe
  2⤵
  PID:6040
- C:\Windows\System\aXvtJXD.exe
  C:\Windows\System\aXvtJXD.exe
  2⤵
  PID:6068
- C:\Windows\System\jwRtACI.exe
  C:\Windows\System\jwRtACI.exe
  2⤵
  PID:6096
- C:\Windows\System\aJeeOkz.exe
  C:\Windows\System\aJeeOkz.exe
  2⤵
  PID:6120
- C:\Windows\System\XUTaqBr.exe
  C:\Windows\System\XUTaqBr.exe
  2⤵
  PID:2580
- C:\Windows\System\MoWoMuS.exe
  C:\Windows\System\MoWoMuS.exe
  2⤵
  PID:4040
- C:\Windows\System\bqSTWOZ.exe
  C:\Windows\System\bqSTWOZ.exe
  2⤵
  PID:4244
- C:\Windows\System\iQancdq.exe
  C:\Windows\System\iQancdq.exe
  2⤵
  PID:4104
- C:\Windows\System\KJFdieH.exe
  C:\Windows\System\KJFdieH.exe
  2⤵
  PID:2404
- C:\Windows\System\BrYRCGD.exe
  C:\Windows\System\BrYRCGD.exe
  2⤵
  PID:2184
- C:\Windows\System\qCIdCem.exe
  C:\Windows\System\qCIdCem.exe
  2⤵
  PID:2320
- C:\Windows\System\YbWDFyZ.exe
  C:\Windows\System\YbWDFyZ.exe
  2⤵
  PID:2924
- C:\Windows\System\dhsMLUS.exe
  C:\Windows\System\dhsMLUS.exe
  2⤵
  PID:5160
- C:\Windows\System\xuAWwDk.exe
  C:\Windows\System\xuAWwDk.exe
  2⤵
  PID:5220
- C:\Windows\System\xcdrBdP.exe
  C:\Windows\System\xcdrBdP.exe
  2⤵
  PID:5292
- C:\Windows\System\nvEaaTI.exe
  C:\Windows\System\nvEaaTI.exe
  2⤵
  PID:5340
- C:\Windows\System\vqWDydi.exe
  C:\Windows\System\vqWDydi.exe
  2⤵
  PID:5412
- C:\Windows\System\bXoiRtT.exe
  C:\Windows\System\bXoiRtT.exe
  2⤵
  PID:5472
- C:\Windows\System\rjemitU.exe
  C:\Windows\System\rjemitU.exe
  2⤵
  PID:5528
- C:\Windows\System\guGBbML.exe
  C:\Windows\System\guGBbML.exe
  2⤵
  PID:5608
- C:\Windows\System\JVptWdb.exe
  C:\Windows\System\JVptWdb.exe
  2⤵
  PID:5672
- C:\Windows\System\FtFXUJf.exe
  C:\Windows\System\FtFXUJf.exe
  2⤵
  PID:5732
- C:\Windows\System\PAUTCLj.exe
  C:\Windows\System\PAUTCLj.exe
  2⤵
  PID:5860
- C:\Windows\System\fHsWVnr.exe
  C:\Windows\System\fHsWVnr.exe
  2⤵
  PID:5892
- C:\Windows\System\DGHJDCr.exe
  C:\Windows\System\DGHJDCr.exe
  2⤵
  PID:5936
- C:\Windows\System\zQLVtFt.exe
  C:\Windows\System\zQLVtFt.exe
  2⤵
  PID:6004
- C:\Windows\System\curuqnj.exe
  C:\Windows\System\curuqnj.exe
  2⤵
  PID:6076
- C:\Windows\System\ivYuaIJ.exe
  C:\Windows\System\ivYuaIJ.exe
  2⤵
  PID:6132
- C:\Windows\System\PIPtuzE.exe
  C:\Windows\System\PIPtuzE.exe
  2⤵
  PID:2704
- C:\Windows\System\amKrDou.exe
  C:\Windows\System\amKrDou.exe
  2⤵
  PID:1148
- C:\Windows\System\tRoHjzG.exe
  C:\Windows\System\tRoHjzG.exe
  2⤵
  PID:1740
- C:\Windows\System\zivpnVr.exe
  C:\Windows\System\zivpnVr.exe
  2⤵
  PID:2084
- C:\Windows\System\SpsIwwH.exe
  C:\Windows\System\SpsIwwH.exe
  2⤵
  PID:5136
- C:\Windows\System\xejWfeE.exe
  C:\Windows\System\xejWfeE.exe
  2⤵
  PID:5300
- C:\Windows\System\EwnqhGK.exe
  C:\Windows\System\EwnqhGK.exe
  2⤵
  PID:5444
- C:\Windows\System\cNaRXOv.exe
  C:\Windows\System\cNaRXOv.exe
  2⤵
  PID:1336
- C:\Windows\System\PLxcPkR.exe
  C:\Windows\System\PLxcPkR.exe
  2⤵
  PID:5696
- C:\Windows\System\TsnGjDT.exe
  C:\Windows\System\TsnGjDT.exe
  2⤵
  PID:4648
- C:\Windows\System\BiEcVdz.exe
  C:\Windows\System\BiEcVdz.exe
  2⤵
  PID:5880
- C:\Windows\System\ZEVnzpj.exe
  C:\Windows\System\ZEVnzpj.exe
  2⤵
  PID:6048
- C:\Windows\System\BUGhPPo.exe
  C:\Windows\System\BUGhPPo.exe
  2⤵
  PID:4032
- C:\Windows\System\JVkMnko.exe
  C:\Windows\System\JVkMnko.exe
  2⤵
  PID:4700
- C:\Windows\System\POKVNHS.exe
  C:\Windows\System\POKVNHS.exe
  2⤵
  PID:5132
- C:\Windows\System\LOFvIqF.exe
  C:\Windows\System\LOFvIqF.exe
  2⤵
  PID:3384
- C:\Windows\System\ONQXzEW.exe
  C:\Windows\System\ONQXzEW.exe
  2⤵
  PID:5524
- C:\Windows\System\wfMbfHB.exe
  C:\Windows\System\wfMbfHB.exe
  2⤵
  PID:3656
- C:\Windows\System\Bnizzpt.exe
  C:\Windows\System\Bnizzpt.exe
  2⤵
  PID:5964
- C:\Windows\System\DyvXELh.exe
  C:\Windows\System\DyvXELh.exe
  2⤵
  PID:6172
- C:\Windows\System\mFbHshA.exe
  C:\Windows\System\mFbHshA.exe
  2⤵
  PID:6200
- C:\Windows\System\emoawIg.exe
  C:\Windows\System\emoawIg.exe
  2⤵
  PID:6228
- C:\Windows\System\zzPLGWf.exe
  C:\Windows\System\zzPLGWf.exe
  2⤵
  PID:6288
- C:\Windows\System\GYEcBlk.exe
  C:\Windows\System\GYEcBlk.exe
  2⤵
  PID:6308
- C:\Windows\System\uVGGaZD.exe
  C:\Windows\System\uVGGaZD.exe
  2⤵
  PID:6324
- C:\Windows\System\DFJTTTS.exe
  C:\Windows\System\DFJTTTS.exe
  2⤵
  PID:6340
- C:\Windows\System\aLaxwtg.exe
  C:\Windows\System\aLaxwtg.exe
  2⤵
  PID:6360
- C:\Windows\System\zxfPyyp.exe
  C:\Windows\System\zxfPyyp.exe
  2⤵
  PID:6384
- C:\Windows\System\QiDXnny.exe
  C:\Windows\System\QiDXnny.exe
  2⤵
  PID:6444
- C:\Windows\System\UFvuHFC.exe
  C:\Windows\System\UFvuHFC.exe
  2⤵
  PID:6480
- C:\Windows\System\bUTLllB.exe
  C:\Windows\System\bUTLllB.exe
  2⤵
  PID:6512
- C:\Windows\System\jtoPkcx.exe
  C:\Windows\System\jtoPkcx.exe
  2⤵
  PID:6536
- C:\Windows\System\VlotxQZ.exe
  C:\Windows\System\VlotxQZ.exe
  2⤵
  PID:6572
- C:\Windows\System\TLqqGGj.exe
  C:\Windows\System\TLqqGGj.exe
  2⤵
  PID:6620
- C:\Windows\System\MenwKip.exe
  C:\Windows\System\MenwKip.exe
  2⤵
  PID:6636
- C:\Windows\System\RDzXhvF.exe
  C:\Windows\System\RDzXhvF.exe
  2⤵
  PID:6660
- C:\Windows\System\DbtthHd.exe
  C:\Windows\System\DbtthHd.exe
  2⤵
  PID:6700
- C:\Windows\System\BVNqkCF.exe
  C:\Windows\System\BVNqkCF.exe
  2⤵
  PID:6748
- C:\Windows\System\RAyaICa.exe
  C:\Windows\System\RAyaICa.exe
  2⤵
  PID:6780
- C:\Windows\System\cQNypBn.exe
  C:\Windows\System\cQNypBn.exe
  2⤵
  PID:6816
- C:\Windows\System\IEJPYut.exe
  C:\Windows\System\IEJPYut.exe
  2⤵
  PID:6848
- C:\Windows\System\iLSJsLM.exe
  C:\Windows\System\iLSJsLM.exe
  2⤵
  PID:6868
- C:\Windows\System\oXmmJVu.exe
  C:\Windows\System\oXmmJVu.exe
  2⤵
  PID:6892
- C:\Windows\System\xQpFJmA.exe
  C:\Windows\System\xQpFJmA.exe
  2⤵
  PID:6920
- C:\Windows\System\vWbmeuz.exe
  C:\Windows\System\vWbmeuz.exe
  2⤵
  PID:6948
- C:\Windows\System\uYfDtEt.exe
  C:\Windows\System\uYfDtEt.exe
  2⤵
  PID:6976
- C:\Windows\System\bJDEmzc.exe
  C:\Windows\System\bJDEmzc.exe
  2⤵
  PID:7004
- C:\Windows\System\ykpAZhY.exe
  C:\Windows\System\ykpAZhY.exe
  2⤵
  PID:7036
- C:\Windows\System\xUXJNrM.exe
  C:\Windows\System\xUXJNrM.exe
  2⤵
  PID:7060
- C:\Windows\System\oLliZrC.exe
  C:\Windows\System\oLliZrC.exe
  2⤵
  PID:7088
- C:\Windows\System\PpeDypg.exe
  C:\Windows\System\PpeDypg.exe
  2⤵
  PID:7116
- C:\Windows\System\hUoTcmA.exe
  C:\Windows\System\hUoTcmA.exe
  2⤵
  PID:7144
- C:\Windows\System\KHIJFrW.exe
  C:\Windows\System\KHIJFrW.exe
  2⤵
  PID:6116
- C:\Windows\System\IoRgdiL.exe
  C:\Windows\System\IoRgdiL.exe
  2⤵
  PID:1520
- C:\Windows\System\QFLKYSE.exe
  C:\Windows\System\QFLKYSE.exe
  2⤵
  PID:5264
- C:\Windows\System\HUmftAD.exe
  C:\Windows\System\HUmftAD.exe
  2⤵
  PID:3428
- C:\Windows\System\EtiMRtO.exe
  C:\Windows\System\EtiMRtO.exe
  2⤵
  PID:5516
- C:\Windows\System\hubTIKS.exe
  C:\Windows\System\hubTIKS.exe
  2⤵
  PID:5644
- C:\Windows\System\GgutRqM.exe
  C:\Windows\System\GgutRqM.exe
  2⤵
  PID:2264
- C:\Windows\System\RypCsEr.exe
  C:\Windows\System\RypCsEr.exe
  2⤵
  PID:4800
- C:\Windows\System\aNtUHla.exe
  C:\Windows\System\aNtUHla.exe
  2⤵
  PID:5048
- C:\Windows\System\AhRRRKh.exe
  C:\Windows\System\AhRRRKh.exe
  2⤵
  PID:6184
- C:\Windows\System\TbcpbSK.exe
  C:\Windows\System\TbcpbSK.exe
  2⤵
  PID:4552
- C:\Windows\System\vEfsPxy.exe
  C:\Windows\System\vEfsPxy.exe
  2⤵
  PID:6268
- C:\Windows\System\TXilnTN.exe
  C:\Windows\System\TXilnTN.exe
  2⤵
  PID:6304
- C:\Windows\System\DfNJeiK.exe
  C:\Windows\System\DfNJeiK.exe
  2⤵
  PID:6408
- C:\Windows\System\fwiVHSv.exe
  C:\Windows\System\fwiVHSv.exe
  2⤵
  PID:6472
- C:\Windows\System\UZNuqST.exe
  C:\Windows\System\UZNuqST.exe
  2⤵
  PID:6544
- C:\Windows\System\fuMlTaM.exe
  C:\Windows\System\fuMlTaM.exe
  2⤵
  PID:6532
- C:\Windows\System\SmVHpsm.exe
  C:\Windows\System\SmVHpsm.exe
  2⤵
  PID:6612
- C:\Windows\System\qPuiuDO.exe
  C:\Windows\System\qPuiuDO.exe
  2⤵
  PID:6720
- C:\Windows\System\VfFCyfQ.exe
  C:\Windows\System\VfFCyfQ.exe
  2⤵
  PID:6804
- C:\Windows\System\vUzbiCV.exe
  C:\Windows\System\vUzbiCV.exe
  2⤵
  PID:6884
- C:\Windows\System\qjRqFSg.exe
  C:\Windows\System\qjRqFSg.exe
  2⤵
  PID:6932
- C:\Windows\System\uzWnCdC.exe
  C:\Windows\System\uzWnCdC.exe
  2⤵
  PID:7048
- C:\Windows\System\YAoXFIv.exe
  C:\Windows\System\YAoXFIv.exe
  2⤵
  PID:7072
- C:\Windows\System\KokkYHJ.exe
  C:\Windows\System\KokkYHJ.exe
  2⤵
  PID:7128
- C:\Windows\System\quTcDnb.exe
  C:\Windows\System\quTcDnb.exe
  2⤵
  PID:6000
- C:\Windows\System\bPrUFmA.exe
  C:\Windows\System\bPrUFmA.exe
  2⤵
  PID:4880
- C:\Windows\System\BzmTdLG.exe
  C:\Windows\System\BzmTdLG.exe
  2⤵
  PID:4948
- C:\Windows\System\sSqMYqM.exe
  C:\Windows\System\sSqMYqM.exe
  2⤵
  PID:672
- C:\Windows\System\qagzozM.exe
  C:\Windows\System\qagzozM.exe
  2⤵
  PID:6164
- C:\Windows\System\mnnckJT.exe
  C:\Windows\System\mnnckJT.exe
  2⤵
  PID:6380
- C:\Windows\System\DBJgOJQ.exe
  C:\Windows\System\DBJgOJQ.exe
  2⤵
  PID:6504
- C:\Windows\System\iUDQtcz.exe
  C:\Windows\System\iUDQtcz.exe
  2⤵
  PID:3936
- C:\Windows\System\uhQtQIf.exe
  C:\Windows\System\uhQtQIf.exe
  2⤵
  PID:6904
- C:\Windows\System\UCtFSTZ.exe
  C:\Windows\System\UCtFSTZ.exe
  2⤵
  PID:7104
- C:\Windows\System\koXjTRc.exe
  C:\Windows\System\koXjTRc.exe
  2⤵
  PID:6160
- C:\Windows\System\mUDgiGc.exe
  C:\Windows\System\mUDgiGc.exe
  2⤵
  PID:1604
- C:\Windows\System\AQEypGk.exe
  C:\Windows\System\AQEypGk.exe
  2⤵
  PID:6760
- C:\Windows\System\CTmKJJw.exe
  C:\Windows\System\CTmKJJw.exe
  2⤵
  PID:6524
- C:\Windows\System\pYyKuAC.exe
  C:\Windows\System\pYyKuAC.exe
  2⤵
  PID:6988
- C:\Windows\System\RItPLOe.exe
  C:\Windows\System\RItPLOe.exe
  2⤵
  PID:6412
- C:\Windows\System\IVqsRzX.exe
  C:\Windows\System\IVqsRzX.exe
  2⤵
  PID:7180
- C:\Windows\System\EDyHZnL.exe
  C:\Windows\System\EDyHZnL.exe
  2⤵
  PID:7196
- C:\Windows\System\mMktwnx.exe
  C:\Windows\System\mMktwnx.exe
  2⤵
  PID:7224
- C:\Windows\System\bdCRhXR.exe
  C:\Windows\System\bdCRhXR.exe
  2⤵
  PID:7252
- C:\Windows\System\TklOFHw.exe
  C:\Windows\System\TklOFHw.exe
  2⤵
  PID:7268
- C:\Windows\System\CMwTSwK.exe
  C:\Windows\System\CMwTSwK.exe
  2⤵
  PID:7296
- C:\Windows\System\MDNBHnF.exe
  C:\Windows\System\MDNBHnF.exe
  2⤵
  PID:7320
- C:\Windows\System\pdHgqak.exe
  C:\Windows\System\pdHgqak.exe
  2⤵
  PID:7364
- C:\Windows\System\pERAyff.exe
  C:\Windows\System\pERAyff.exe
  2⤵
  PID:7392
- C:\Windows\System\MndQbxP.exe
  C:\Windows\System\MndQbxP.exe
  2⤵
  PID:7420
- C:\Windows\System\ABLtcGg.exe
  C:\Windows\System\ABLtcGg.exe
  2⤵
  PID:7448
- C:\Windows\System\NpwQsYC.exe
  C:\Windows\System\NpwQsYC.exe
  2⤵
  PID:7488
- C:\Windows\System\PTRdQso.exe
  C:\Windows\System\PTRdQso.exe
  2⤵
  PID:7504
- C:\Windows\System\nsJgAjg.exe
  C:\Windows\System\nsJgAjg.exe
  2⤵
  PID:7532
- C:\Windows\System\kwUAASZ.exe
  C:\Windows\System\kwUAASZ.exe
  2⤵
  PID:7560
- C:\Windows\System\jkguLSF.exe
  C:\Windows\System\jkguLSF.exe
  2⤵
  PID:7588
- C:\Windows\System\oyadZUS.exe
  C:\Windows\System\oyadZUS.exe
  2⤵
  PID:7604
- C:\Windows\System\NMjPhpG.exe
  C:\Windows\System\NMjPhpG.exe
  2⤵
  PID:7632
- C:\Windows\System\iCfkRMo.exe
  C:\Windows\System\iCfkRMo.exe
  2⤵
  PID:7660
- C:\Windows\System\tnYCtQi.exe
  C:\Windows\System\tnYCtQi.exe
  2⤵
  PID:7684
- C:\Windows\System\FZtATDm.exe
  C:\Windows\System\FZtATDm.exe
  2⤵
  PID:7708
- C:\Windows\System\zQeRPxC.exe
  C:\Windows\System\zQeRPxC.exe
  2⤵
  PID:7744
- C:\Windows\System\EhygBzO.exe
  C:\Windows\System\EhygBzO.exe
  2⤵
  PID:7784
- C:\Windows\System\HfXJxsQ.exe
  C:\Windows\System\HfXJxsQ.exe
  2⤵
  PID:7812
- C:\Windows\System\iQXfvZZ.exe
  C:\Windows\System\iQXfvZZ.exe
  2⤵
  PID:7828
- C:\Windows\System\qMFagsr.exe
  C:\Windows\System\qMFagsr.exe
  2⤵
  PID:7856
- C:\Windows\System\grNPLUX.exe
  C:\Windows\System\grNPLUX.exe
  2⤵
  PID:7880
- C:\Windows\System\IUtvfPx.exe
  C:\Windows\System\IUtvfPx.exe
  2⤵
  PID:7904
- C:\Windows\System\niQlEHe.exe
  C:\Windows\System\niQlEHe.exe
  2⤵
  PID:7932
- C:\Windows\System\WJelPsy.exe
  C:\Windows\System\WJelPsy.exe
  2⤵
  PID:7952
- C:\Windows\System\bdMXkni.exe
  C:\Windows\System\bdMXkni.exe
  2⤵
  PID:8008
- C:\Windows\System\iCLdPXv.exe
  C:\Windows\System\iCLdPXv.exe
  2⤵
  PID:8024
- C:\Windows\System\oJMZnxk.exe
  C:\Windows\System\oJMZnxk.exe
  2⤵
  PID:8044
- C:\Windows\System\CAKeOLo.exe
  C:\Windows\System\CAKeOLo.exe
  2⤵
  PID:8072
- C:\Windows\System\PIIVlZh.exe
  C:\Windows\System\PIIVlZh.exe
  2⤵
  PID:8104
- C:\Windows\System\HdPRuMd.exe
  C:\Windows\System\HdPRuMd.exe
  2⤵
  PID:8156
- C:\Windows\System\TyYTNrX.exe
  C:\Windows\System\TyYTNrX.exe
  2⤵
  PID:8176
- C:\Windows\System\AiGFfsY.exe
  C:\Windows\System\AiGFfsY.exe
  2⤵
  PID:7172
- C:\Windows\System\FTNRDxD.exe
  C:\Windows\System\FTNRDxD.exe
  2⤵
  PID:7188
- C:\Windows\System\xxAsLWG.exe
  C:\Windows\System\xxAsLWG.exe
  2⤵
  PID:7284
- C:\Windows\System\YffuCHE.exe
  C:\Windows\System\YffuCHE.exe
  2⤵
  PID:7340
- C:\Windows\System\dzZyifY.exe
  C:\Windows\System\dzZyifY.exe
  2⤵
  PID:7380
- C:\Windows\System\xWHuhcF.exe
  C:\Windows\System\xWHuhcF.exe
  2⤵
  PID:7476
- C:\Windows\System\oofDndb.exe
  C:\Windows\System\oofDndb.exe
  2⤵
  PID:7516
- C:\Windows\System\MQGNrlj.exe
  C:\Windows\System\MQGNrlj.exe
  2⤵
  PID:7572
- C:\Windows\System\GqOAvtn.exe
  C:\Windows\System\GqOAvtn.exe
  2⤵
  PID:7704
- C:\Windows\System\XwNoCgy.exe
  C:\Windows\System\XwNoCgy.exe
  2⤵
  PID:7756
- C:\Windows\System\FtgFFHP.exe
  C:\Windows\System\FtgFFHP.exe
  2⤵
  PID:7796
- C:\Windows\System\YXkEQfK.exe
  C:\Windows\System\YXkEQfK.exe
  2⤵
  PID:7888
- C:\Windows\System\qQGombB.exe
  C:\Windows\System\qQGombB.exe
  2⤵
  PID:7948
- C:\Windows\System\aOVCnLp.exe
  C:\Windows\System\aOVCnLp.exe
  2⤵
  PID:8032
- C:\Windows\System\GzdCEeJ.exe
  C:\Windows\System\GzdCEeJ.exe
  2⤵
  PID:8100
- C:\Windows\System\qgHPqnQ.exe
  C:\Windows\System\qgHPqnQ.exe
  2⤵
  PID:8168
- C:\Windows\System\ZAOYxwp.exe
  C:\Windows\System\ZAOYxwp.exe
  2⤵
  PID:8152
- C:\Windows\System\QUeVlcy.exe
  C:\Windows\System\QUeVlcy.exe
  2⤵
  PID:7248
- C:\Windows\System\IorUDGw.exe
  C:\Windows\System\IorUDGw.exe
  2⤵
  PID:7404
- C:\Windows\System\NrJEJed.exe
  C:\Windows\System\NrJEJed.exe
  2⤵
  PID:7652
- C:\Windows\System\qrjIzOV.exe
  C:\Windows\System\qrjIzOV.exe
  2⤵
  PID:7820
- C:\Windows\System\cmipZhx.exe
  C:\Windows\System\cmipZhx.exe
  2⤵
  PID:7996
- C:\Windows\System\yMeChVc.exe
  C:\Windows\System\yMeChVc.exe
  2⤵
  PID:8144
- C:\Windows\System\jUbwbtK.exe
  C:\Windows\System\jUbwbtK.exe
  2⤵
  PID:7108
- C:\Windows\System\PZkWlBQ.exe
  C:\Windows\System\PZkWlBQ.exe
  2⤵
  PID:7408
- C:\Windows\System\cPpJEMz.exe
  C:\Windows\System\cPpJEMz.exe
  2⤵
  PID:7940
- C:\Windows\System\pzyyfBA.exe
  C:\Windows\System\pzyyfBA.exe
  2⤵
  PID:7824
- C:\Windows\System\kVVmoXf.exe
  C:\Windows\System\kVVmoXf.exe
  2⤵
  PID:8204
- C:\Windows\System\lNHYnvd.exe
  C:\Windows\System\lNHYnvd.exe
  2⤵
  PID:8232
- C:\Windows\System\iwzhIRK.exe
  C:\Windows\System\iwzhIRK.exe
  2⤵
  PID:8260
- C:\Windows\System\pOpyTjZ.exe
  C:\Windows\System\pOpyTjZ.exe
  2⤵
  PID:8288
- C:\Windows\System\qFztTEN.exe
  C:\Windows\System\qFztTEN.exe
  2⤵
  PID:8304
- C:\Windows\System\VQkQeWo.exe
  C:\Windows\System\VQkQeWo.exe
  2⤵
  PID:8340
- C:\Windows\System\HIbcHNY.exe
  C:\Windows\System\HIbcHNY.exe
  2⤵
  PID:8356
- C:\Windows\System\YFMPUAl.exe
  C:\Windows\System\YFMPUAl.exe
  2⤵
  PID:8384
- C:\Windows\System\kimvuto.exe
  C:\Windows\System\kimvuto.exe
  2⤵
  PID:8404
- C:\Windows\System\uepDEVM.exe
  C:\Windows\System\uepDEVM.exe
  2⤵
  PID:8436
- C:\Windows\System\rnouTGD.exe
  C:\Windows\System\rnouTGD.exe
  2⤵
  PID:8468
- C:\Windows\System\BxgqONS.exe
  C:\Windows\System\BxgqONS.exe
  2⤵
  PID:8488
- C:\Windows\System\KgzbxVh.exe
  C:\Windows\System\KgzbxVh.exe
  2⤵
  PID:8512
- C:\Windows\System\AozEbNT.exe
  C:\Windows\System\AozEbNT.exe
  2⤵
  PID:8536
- C:\Windows\System\HkVrKLN.exe
  C:\Windows\System\HkVrKLN.exe
  2⤵
  PID:8592
- C:\Windows\System\WoAUQJH.exe
  C:\Windows\System\WoAUQJH.exe
  2⤵
  PID:8616
- C:\Windows\System\VzHsURm.exe
  C:\Windows\System\VzHsURm.exe
  2⤵
  PID:8640
- C:\Windows\System\irIruxu.exe
  C:\Windows\System\irIruxu.exe
  2⤵
  PID:8672
- C:\Windows\System\kdsLcWR.exe
  C:\Windows\System\kdsLcWR.exe
  2⤵
  PID:8696
- C:\Windows\System\hFlIsvC.exe
  C:\Windows\System\hFlIsvC.exe
  2⤵
  PID:8724
- C:\Windows\System\QtgcJvX.exe
  C:\Windows\System\QtgcJvX.exe
  2⤵
  PID:8764
- C:\Windows\System\VExiIAl.exe
  C:\Windows\System\VExiIAl.exe
  2⤵
  PID:8792
- C:\Windows\System\DxAlXVg.exe
  C:\Windows\System\DxAlXVg.exe
  2⤵
  PID:8820
- C:\Windows\System\qoMwAcj.exe
  C:\Windows\System\qoMwAcj.exe
  2⤵
  PID:8836
- C:\Windows\System\sNGzoSj.exe
  C:\Windows\System\sNGzoSj.exe
  2⤵
  PID:8876
- C:\Windows\System\DdErCHl.exe
  C:\Windows\System\DdErCHl.exe
  2⤵
  PID:8892
- C:\Windows\System\bXnfBfB.exe
  C:\Windows\System\bXnfBfB.exe
  2⤵
  PID:8928
- C:\Windows\System\sHczSTD.exe
  C:\Windows\System\sHczSTD.exe
  2⤵
  PID:8960
- C:\Windows\System\TnAaIkX.exe
  C:\Windows\System\TnAaIkX.exe
  2⤵
  PID:8988
- C:\Windows\System\xwuUOde.exe
  C:\Windows\System\xwuUOde.exe
  2⤵
  PID:9008
- C:\Windows\System\ezoAjjc.exe
  C:\Windows\System\ezoAjjc.exe
  2⤵
  PID:9032
- C:\Windows\System\VgsxnOl.exe
  C:\Windows\System\VgsxnOl.exe
  2⤵
  PID:9068
- C:\Windows\System\RhUOzJh.exe
  C:\Windows\System\RhUOzJh.exe
  2⤵
  PID:9092
- C:\Windows\System\JYxDsha.exe
  C:\Windows\System\JYxDsha.exe
  2⤵
  PID:9108
- C:\Windows\System\QRdcvNI.exe
  C:\Windows\System\QRdcvNI.exe
  2⤵
  PID:9132
- C:\Windows\System\njlnXrF.exe
  C:\Windows\System\njlnXrF.exe
  2⤵
  PID:9176
- C:\Windows\System\kiinsHZ.exe
  C:\Windows\System\kiinsHZ.exe
  2⤵
  PID:9200
- C:\Windows\System\iJeIHiz.exe
  C:\Windows\System\iJeIHiz.exe
  2⤵
  PID:8196
- C:\Windows\System\uZWjmth.exe
  C:\Windows\System\uZWjmth.exe
  2⤵
  PID:8244
- C:\Windows\System\yKXFyjl.exe
  C:\Windows\System\yKXFyjl.exe
  2⤵
  PID:8332
- C:\Windows\System\aLLZdQs.exe
  C:\Windows\System\aLLZdQs.exe
  2⤵
  PID:8460
- C:\Windows\System\bFijkMq.exe
  C:\Windows\System\bFijkMq.exe
  2⤵
  PID:8448
- C:\Windows\System\OXUNIQI.exe
  C:\Windows\System\OXUNIQI.exe
  2⤵
  PID:8532
- C:\Windows\System\lsHfiql.exe
  C:\Windows\System\lsHfiql.exe
  2⤵
  PID:8604
- C:\Windows\System\gXSvpge.exe
  C:\Windows\System\gXSvpge.exe
  2⤵
  PID:8668
- C:\Windows\System\IyuMwJY.exe
  C:\Windows\System\IyuMwJY.exe
  2⤵
  PID:8708
- C:\Windows\System\bDquwGU.exe
  C:\Windows\System\bDquwGU.exe
  2⤵
  PID:8784
- C:\Windows\System\mcQtyyK.exe
  C:\Windows\System\mcQtyyK.exe
  2⤵
  PID:4720
- C:\Windows\System\VkJBotz.exe
  C:\Windows\System\VkJBotz.exe
  2⤵
  PID:8884
- C:\Windows\System\pFpEKqR.exe
  C:\Windows\System\pFpEKqR.exe
  2⤵
  PID:8940
- C:\Windows\System\hWkYtfQ.exe
  C:\Windows\System\hWkYtfQ.exe
  2⤵
  PID:9000
- C:\Windows\System\cXdQGXR.exe
  C:\Windows\System\cXdQGXR.exe
  2⤵
  PID:9056
- C:\Windows\System\QPqkUTN.exe
  C:\Windows\System\QPqkUTN.exe
  2⤵
  PID:9120
- C:\Windows\System\qbBbPTV.exe
  C:\Windows\System\qbBbPTV.exe
  2⤵
  PID:9164
- C:\Windows\System\WyPPLZf.exe
  C:\Windows\System\WyPPLZf.exe
  2⤵
  PID:8092
- C:\Windows\System\QuJCIlJ.exe
  C:\Windows\System\QuJCIlJ.exe
  2⤵
  PID:8428
- C:\Windows\System\RxqEYBu.exe
  C:\Windows\System\RxqEYBu.exe
  2⤵
  PID:8508
- C:\Windows\System\rlHPuCx.exe
  C:\Windows\System\rlHPuCx.exe
  2⤵
  PID:8624
- C:\Windows\System\CVMVjsv.exe
  C:\Windows\System\CVMVjsv.exe
  2⤵
  PID:8868
- C:\Windows\System\mWKAKhA.exe
  C:\Windows\System\mWKAKhA.exe
  2⤵
  PID:9088
- C:\Windows\System\VmYEWse.exe
  C:\Windows\System\VmYEWse.exe
  2⤵
  PID:9192
- C:\Windows\System\vFNdCZS.exe
  C:\Windows\System\vFNdCZS.exe
  2⤵
  PID:8560
- C:\Windows\System\yJytUJL.exe
  C:\Windows\System\yJytUJL.exe
  2⤵
  PID:8400
- C:\Windows\System\XdjPrzG.exe
  C:\Windows\System\XdjPrzG.exe
  2⤵
  PID:8872
- C:\Windows\System\BsuehAO.exe
  C:\Windows\System\BsuehAO.exe
  2⤵
  PID:9084
- C:\Windows\System\bktWscq.exe
  C:\Windows\System\bktWscq.exe
  2⤵
  PID:8776
- C:\Windows\System\tqNHnzk.exe
  C:\Windows\System\tqNHnzk.exe
  2⤵
  PID:9240
- C:\Windows\System\beODjNU.exe
  C:\Windows\System\beODjNU.exe
  2⤵
  PID:9260
- C:\Windows\System\qBcurko.exe
  C:\Windows\System\qBcurko.exe
  2⤵
  PID:9312
- C:\Windows\System\HCAoawQ.exe
  C:\Windows\System\HCAoawQ.exe
  2⤵
  PID:9332
- C:\Windows\System\OwSLVgm.exe
  C:\Windows\System\OwSLVgm.exe
  2⤵
  PID:9356
- C:\Windows\System\ardExiq.exe
  C:\Windows\System\ardExiq.exe
  2⤵
  PID:9384
- C:\Windows\System\wwUmwhg.exe
  C:\Windows\System\wwUmwhg.exe
  2⤵
  PID:9408
- C:\Windows\System\FsyObTX.exe
  C:\Windows\System\FsyObTX.exe
  2⤵
  PID:9440
- C:\Windows\System\LORKqWG.exe
  C:\Windows\System\LORKqWG.exe
  2⤵
  PID:9464
- C:\Windows\System\uddJOKh.exe
  C:\Windows\System\uddJOKh.exe
  2⤵
  PID:9488
- C:\Windows\System\eIBUZeD.exe
  C:\Windows\System\eIBUZeD.exe
  2⤵
  PID:9532
- C:\Windows\System\bBALaCD.exe
  C:\Windows\System\bBALaCD.exe
  2⤵
  PID:9552
- C:\Windows\System\XrfPZCd.exe
  C:\Windows\System\XrfPZCd.exe
  2⤵
  PID:9576
- C:\Windows\System\KKrVaUn.exe
  C:\Windows\System\KKrVaUn.exe
  2⤵
  PID:9612
- C:\Windows\System\zTdcdEl.exe
  C:\Windows\System\zTdcdEl.exe
  2⤵
  PID:9636
- C:\Windows\System\zFWDtrK.exe
  C:\Windows\System\zFWDtrK.exe
  2⤵
  PID:9664
- C:\Windows\System\geYoscj.exe
  C:\Windows\System\geYoscj.exe
  2⤵
  PID:9684
- C:\Windows\System\ZDEPBTm.exe
  C:\Windows\System\ZDEPBTm.exe
  2⤵
  PID:9724
- C:\Windows\System\xHiTjmZ.exe
  C:\Windows\System\xHiTjmZ.exe
  2⤵
  PID:9772
- C:\Windows\System\NaXutmS.exe
  C:\Windows\System\NaXutmS.exe
  2⤵
  PID:9788
- C:\Windows\System\TJIQkkw.exe
  C:\Windows\System\TJIQkkw.exe
  2⤵
  PID:9812
- C:\Windows\System\znYyzsr.exe
  C:\Windows\System\znYyzsr.exe
  2⤵
  PID:9844
- C:\Windows\System\yQqbuoc.exe
  C:\Windows\System\yQqbuoc.exe
  2⤵
  PID:9860
- C:\Windows\System\lLhcDIe.exe
  C:\Windows\System\lLhcDIe.exe
  2⤵
  PID:9912
- C:\Windows\System\cdUQPCX.exe
  C:\Windows\System\cdUQPCX.exe
  2⤵
  PID:9940
- C:\Windows\System\sStQksA.exe
  C:\Windows\System\sStQksA.exe
  2⤵
  PID:9956
- C:\Windows\System\BKMWsxS.exe
  C:\Windows\System\BKMWsxS.exe
  2⤵
  PID:9996
- C:\Windows\System\hkNitPe.exe
  C:\Windows\System\hkNitPe.exe
  2⤵
  PID:10012
- C:\Windows\System\UdJOdJO.exe
  C:\Windows\System\UdJOdJO.exe
  2⤵
  PID:10040
- C:\Windows\System\WRcknnk.exe
  C:\Windows\System\WRcknnk.exe
  2⤵
  PID:10068
- C:\Windows\System\JcJYaQK.exe
  C:\Windows\System\JcJYaQK.exe
  2⤵
  PID:10108
- C:\Windows\System\hoGkLxC.exe
  C:\Windows\System\hoGkLxC.exe
  2⤵
  PID:10132
- C:\Windows\System\UXxSRZd.exe
  C:\Windows\System\UXxSRZd.exe
  2⤵
  PID:10148
- C:\Windows\System\kRAULcL.exe
  C:\Windows\System\kRAULcL.exe
  2⤵
  PID:10168
- C:\Windows\System\EpfGPbI.exe
  C:\Windows\System\EpfGPbI.exe
  2⤵
  PID:10184
- C:\Windows\System\HhNRPgH.exe
  C:\Windows\System\HhNRPgH.exe
  2⤵
  PID:10200
- C:\Windows\System\HLYLPTu.exe
  C:\Windows\System\HLYLPTu.exe
  2⤵
  PID:10224
- C:\Windows\System\BYZOJfB.exe
  C:\Windows\System\BYZOJfB.exe
  2⤵
  PID:3520
- C:\Windows\System\kiPcCLs.exe
  C:\Windows\System\kiPcCLs.exe
  2⤵
  PID:9276
- C:\Windows\System\SznwYSf.exe
  C:\Windows\System\SznwYSf.exe
  2⤵
  PID:9236
- C:\Windows\System\OhcCUkE.exe
  C:\Windows\System\OhcCUkE.exe
  2⤵
  PID:9320
- C:\Windows\System\aAdgDVp.exe
  C:\Windows\System\aAdgDVp.exe
  2⤵
  PID:9568
- C:\Windows\System\ljZLgyP.exe
  C:\Windows\System\ljZLgyP.exe
  2⤵
  PID:9604
- C:\Windows\System\dwUaBoz.exe
  C:\Windows\System\dwUaBoz.exe
  2⤵
  PID:9680
- C:\Windows\System\SSAsRqd.exe
  C:\Windows\System\SSAsRqd.exe
  2⤵
  PID:9756
- C:\Windows\System\plKvrxu.exe
  C:\Windows\System\plKvrxu.exe
  2⤵
  PID:9804
- C:\Windows\System\bUYfuNw.exe
  C:\Windows\System\bUYfuNw.exe
  2⤵
  PID:9852
- C:\Windows\System\RpqdUXw.exe
  C:\Windows\System\RpqdUXw.exe
  2⤵
  PID:9880
- C:\Windows\System\HgBFLnB.exe
  C:\Windows\System\HgBFLnB.exe
  2⤵
  PID:9972
- C:\Windows\System\qraPqmF.exe
  C:\Windows\System\qraPqmF.exe
  2⤵
  PID:10060
- C:\Windows\System\YjsxaKg.exe
  C:\Windows\System\YjsxaKg.exe
  2⤵
  PID:10124
- C:\Windows\System\NgXgweK.exe
  C:\Windows\System\NgXgweK.exe
  2⤵
  PID:10176
- C:\Windows\System\XLdCGjX.exe
  C:\Windows\System\XLdCGjX.exe
  2⤵
  PID:9280
- C:\Windows\System\CyPbinc.exe
  C:\Windows\System\CyPbinc.exe
  2⤵
  PID:9248
- C:\Windows\System\hOBBiGv.exe
  C:\Windows\System\hOBBiGv.exe
  2⤵
  PID:9496
- C:\Windows\System\ZigKQIw.exe
  C:\Windows\System\ZigKQIw.exe
  2⤵
  PID:9600
- C:\Windows\System\qmpspjS.exe
  C:\Windows\System\qmpspjS.exe
  2⤵
  PID:9752
- C:\Windows\System\OFbQdTW.exe
  C:\Windows\System\OFbQdTW.exe
  2⤵
  PID:9896
- C:\Windows\System\giJfESv.exe
  C:\Windows\System\giJfESv.exe
  2⤵
  PID:10104
- C:\Windows\System\ESamnwF.exe
  C:\Windows\System\ESamnwF.exe
  2⤵
  PID:9292
- C:\Windows\System\UHzJCwx.exe
  C:\Windows\System\UHzJCwx.exe
  2⤵
  PID:9676
- C:\Windows\System\KcuDIEN.exe
  C:\Windows\System\KcuDIEN.exe
  2⤵
  PID:9988
- C:\Windows\System\uUMyJTJ.exe
  C:\Windows\System\uUMyJTJ.exe
  2⤵
  PID:9300
- C:\Windows\System\MSwAWnW.exe
  C:\Windows\System\MSwAWnW.exe
  2⤵
  PID:9876
- C:\Windows\System\ulTIrID.exe
  C:\Windows\System\ulTIrID.exe
  2⤵
  PID:10260
- C:\Windows\System\xqrxuEK.exe
  C:\Windows\System\xqrxuEK.exe
  2⤵
  PID:10276
- C:\Windows\System\lCRCWwX.exe
  C:\Windows\System\lCRCWwX.exe
  2⤵
  PID:10300
- C:\Windows\System\vxvfndU.exe
  C:\Windows\System\vxvfndU.exe
  2⤵
  PID:10324
- C:\Windows\System\ZbHXhxn.exe
  C:\Windows\System\ZbHXhxn.exe
  2⤵
  PID:10352
- C:\Windows\System\ONcXzEZ.exe
  C:\Windows\System\ONcXzEZ.exe
  2⤵
  PID:10384
- C:\Windows\System\QxrSwiz.exe
  C:\Windows\System\QxrSwiz.exe
  2⤵
  PID:10412
- C:\Windows\System\QadGoSO.exe
  C:\Windows\System\QadGoSO.exe
  2⤵
  PID:10432
- C:\Windows\System\GAAJlGz.exe
  C:\Windows\System\GAAJlGz.exe
  2⤵
  PID:10472
- C:\Windows\System\PsfdtCf.exe
  C:\Windows\System\PsfdtCf.exe
  2⤵
  PID:10492
- C:\Windows\System\RdyYSqa.exe
  C:\Windows\System\RdyYSqa.exe
  2⤵
  PID:10540
- C:\Windows\System\gkIhZDA.exe
  C:\Windows\System\gkIhZDA.exe
  2⤵
  PID:10568
- C:\Windows\System\GaeUfmn.exe
  C:\Windows\System\GaeUfmn.exe
  2⤵
  PID:10584
- C:\Windows\System\YhlxTPA.exe
  C:\Windows\System\YhlxTPA.exe
  2⤵
  PID:10612
- C:\Windows\System\tbIIcYY.exe
  C:\Windows\System\tbIIcYY.exe
  2⤵
  PID:10664
- C:\Windows\System\lbtYqao.exe
  C:\Windows\System\lbtYqao.exe
  2⤵
  PID:10680
- C:\Windows\System\elfkQtX.exe
  C:\Windows\System\elfkQtX.exe
  2⤵
  PID:10700
- C:\Windows\System\GxMSIld.exe
  C:\Windows\System\GxMSIld.exe
  2⤵
  PID:10724
- C:\Windows\System\YjvNWVs.exe
  C:\Windows\System\YjvNWVs.exe
  2⤵
  PID:10748
- C:\Windows\System\LWEsTtH.exe
  C:\Windows\System\LWEsTtH.exe
  2⤵
  PID:10768
- C:\Windows\System\aFBPjFc.exe
  C:\Windows\System\aFBPjFc.exe
  2⤵
  PID:10788
- C:\Windows\System\mDjKPwk.exe
  C:\Windows\System\mDjKPwk.exe
  2⤵
  PID:10812
- C:\Windows\System\QkYIPQY.exe
  C:\Windows\System\QkYIPQY.exe
  2⤵
  PID:10844
- C:\Windows\System\zUCShbW.exe
  C:\Windows\System\zUCShbW.exe
  2⤵
  PID:10916
- C:\Windows\System\bRxBBdn.exe
  C:\Windows\System\bRxBBdn.exe
  2⤵
  PID:10932
- C:\Windows\System\ggqeYLA.exe
  C:\Windows\System\ggqeYLA.exe
  2⤵
  PID:10960
- C:\Windows\System\VeGYhVB.exe
  C:\Windows\System\VeGYhVB.exe
  2⤵
  PID:10976
- C:\Windows\System\IHTbtEf.exe
  C:\Windows\System\IHTbtEf.exe
  2⤵
  PID:10992
- C:\Windows\System\vPEtUFC.exe
  C:\Windows\System\vPEtUFC.exe
  2⤵
  PID:11016
- C:\Windows\System\lKbRctE.exe
  C:\Windows\System\lKbRctE.exe
  2⤵
  PID:11056
- C:\Windows\System\OXHyezm.exe
  C:\Windows\System\OXHyezm.exe
  2⤵
  PID:11100
- C:\Windows\System\xYnThHN.exe
  C:\Windows\System\xYnThHN.exe
  2⤵
  PID:11116
- C:\Windows\System\mHcWHAS.exe
  C:\Windows\System\mHcWHAS.exe
  2⤵
  PID:11176
- C:\Windows\System\wnMnQKt.exe
  C:\Windows\System\wnMnQKt.exe
  2⤵
  PID:11204
- C:\Windows\System\WIvTGbx.exe
  C:\Windows\System\WIvTGbx.exe
  2⤵
  PID:11232
- C:\Windows\System\qPgNEtj.exe
  C:\Windows\System\qPgNEtj.exe
  2⤵
  PID:10036
- C:\Windows\System\IRnnqnH.exe
  C:\Windows\System\IRnnqnH.exe
  2⤵
  PID:10288
- C:\Windows\System\igGhNDz.exe
  C:\Windows\System\igGhNDz.exe
  2⤵
  PID:10344
- C:\Windows\System\SdFoJDf.exe
  C:\Windows\System\SdFoJDf.exe
  2⤵
  PID:10380
- C:\Windows\System\JhSaamX.exe
  C:\Windows\System\JhSaamX.exe
  2⤵
  PID:10452
- C:\Windows\System\whLPbLN.exe
  C:\Windows\System\whLPbLN.exe
  2⤵
  PID:10552
- C:\Windows\System\rXEaXRZ.exe
  C:\Windows\System\rXEaXRZ.exe
  2⤵
  PID:10580
- C:\Windows\System\JFbSygF.exe
  C:\Windows\System\JFbSygF.exe
  2⤵
  PID:10712
- C:\Windows\System\TEagCLz.exe
  C:\Windows\System\TEagCLz.exe
  2⤵
  PID:10740
- C:\Windows\System\excDELB.exe
  C:\Windows\System\excDELB.exe
  2⤵
  PID:10836
- C:\Windows\System\PHMAJDA.exe
  C:\Windows\System\PHMAJDA.exe
  2⤵
  PID:10880
- C:\Windows\System\JczayuY.exe
  C:\Windows\System\JczayuY.exe
  2⤵
  PID:10944
- C:\Windows\System\gkjuVdi.exe
  C:\Windows\System\gkjuVdi.exe
  2⤵
  PID:10988
- C:\Windows\System\yMqoFKb.exe
  C:\Windows\System\yMqoFKb.exe
  2⤵
  PID:11108
- C:\Windows\System\UKwvXHT.exe
  C:\Windows\System\UKwvXHT.exe
  2⤵
  PID:11164
- C:\Windows\System\WtsAFcs.exe
  C:\Windows\System\WtsAFcs.exe
  2⤵
  PID:11248
- C:\Windows\System\OjUTJsQ.exe
  C:\Windows\System\OjUTJsQ.exe
  2⤵
  PID:10320
- C:\Windows\System\klItwnC.exe
  C:\Windows\System\klItwnC.exe
  2⤵
  PID:10556
- C:\Windows\System\HjcPzsc.exe
  C:\Windows\System\HjcPzsc.exe
  2⤵
  PID:10600
- C:\Windows\System\tIuSdRm.exe
  C:\Windows\System\tIuSdRm.exe
  2⤵
  PID:10868
- C:\Windows\System\zziLbca.exe
  C:\Windows\System\zziLbca.exe
  2⤵
  PID:10924
- C:\Windows\System\oVcWzNz.exe
  C:\Windows\System\oVcWzNz.exe
  2⤵
  PID:11064
- C:\Windows\System\WThHSbE.exe
  C:\Windows\System\WThHSbE.exe
  2⤵
  PID:11216
- C:\Windows\System\VLltfgp.exe
  C:\Windows\System\VLltfgp.exe
  2⤵
  PID:10404
- C:\Windows\System\kZJNFPB.exe
  C:\Windows\System\kZJNFPB.exe
  2⤵
  PID:10688
- C:\Windows\System\fteiuxH.exe
  C:\Windows\System\fteiuxH.exe
  2⤵
  PID:9372
- C:\Windows\System\coZegGa.exe
  C:\Windows\System\coZegGa.exe
  2⤵
  PID:11272
- C:\Windows\System\LHbueoH.exe
  C:\Windows\System\LHbueoH.exe
  2⤵
  PID:11300
- C:\Windows\System\KncWfYh.exe
  C:\Windows\System\KncWfYh.exe
  2⤵
  PID:11316
- C:\Windows\System\gWnIYhX.exe
  C:\Windows\System\gWnIYhX.exe
  2⤵
  PID:11344
- C:\Windows\System\MZOsSBo.exe
  C:\Windows\System\MZOsSBo.exe
  2⤵
  PID:11368
- C:\Windows\System\WMQRNMk.exe
  C:\Windows\System\WMQRNMk.exe
  2⤵
  PID:11388
- C:\Windows\System\NiMQLyN.exe
  C:\Windows\System\NiMQLyN.exe
  2⤵
  PID:11408
- C:\Windows\System\dbdDfTf.exe
  C:\Windows\System\dbdDfTf.exe
  2⤵
  PID:11460
- C:\Windows\System\IunWgCp.exe
  C:\Windows\System\IunWgCp.exe
  2⤵
  PID:11488
- C:\Windows\System\xaYqGNi.exe
  C:\Windows\System\xaYqGNi.exe
  2⤵
  PID:11508
- C:\Windows\System\KoYqHPf.exe
  C:\Windows\System\KoYqHPf.exe
  2⤵
  PID:11560
- C:\Windows\System\HennRtU.exe
  C:\Windows\System\HennRtU.exe
  2⤵
  PID:11576
- C:\Windows\System\BfnFNLE.exe
  C:\Windows\System\BfnFNLE.exe
  2⤵
  PID:11604
- C:\Windows\System\OrFuuai.exe
  C:\Windows\System\OrFuuai.exe
  2⤵
  PID:11620
- C:\Windows\System\EovOIEm.exe
  C:\Windows\System\EovOIEm.exe
  2⤵
  PID:11652
- C:\Windows\System\uAqlzQV.exe
  C:\Windows\System\uAqlzQV.exe
  2⤵
  PID:11676
- C:\Windows\System\JHTEcJC.exe
  C:\Windows\System\JHTEcJC.exe
  2⤵
  PID:11700
- C:\Windows\System\zjhJpaV.exe
  C:\Windows\System\zjhJpaV.exe
  2⤵
  PID:11744
- C:\Windows\System\zEtGJvC.exe
  C:\Windows\System\zEtGJvC.exe
  2⤵
  PID:11768
- C:\Windows\System\yBuSlSH.exe
  C:\Windows\System\yBuSlSH.exe
  2⤵
  PID:11800
- C:\Windows\System\eOdKhAj.exe
  C:\Windows\System\eOdKhAj.exe
  2⤵
  PID:11816
- C:\Windows\System\CMHFEjM.exe
  C:\Windows\System\CMHFEjM.exe
  2⤵
  PID:11860
- C:\Windows\System\DfNxkje.exe
  C:\Windows\System\DfNxkje.exe
  2⤵
  PID:11880
- C:\Windows\System\FIrKLEv.exe
  C:\Windows\System\FIrKLEv.exe
  2⤵
  PID:11916
- C:\Windows\System\cVipPQG.exe
  C:\Windows\System\cVipPQG.exe
  2⤵
  PID:11944
- C:\Windows\System\CreSphr.exe
  C:\Windows\System\CreSphr.exe
  2⤵
  PID:11964
- C:\Windows\System\Fslgmbe.exe
  C:\Windows\System\Fslgmbe.exe
  2⤵
  PID:12000
- C:\Windows\System\ZaEIUfI.exe
  C:\Windows\System\ZaEIUfI.exe
  2⤵
  PID:12016
- C:\Windows\System\UGNcezH.exe
  C:\Windows\System\UGNcezH.exe
  2⤵
  PID:12040
- C:\Windows\System\kQDJtkq.exe
  C:\Windows\System\kQDJtkq.exe
  2⤵
  PID:12068
- C:\Windows\System\xmoWgwa.exe
  C:\Windows\System\xmoWgwa.exe
  2⤵
  PID:12092
- C:\Windows\System\tFvxhSS.exe
  C:\Windows\System\tFvxhSS.exe
  2⤵
  PID:12116
- C:\Windows\System\iKNxkah.exe
  C:\Windows\System\iKNxkah.exe
  2⤵
  PID:12144
- C:\Windows\System\fWPFxRW.exe
  C:\Windows\System\fWPFxRW.exe
  2⤵
  PID:12192
- C:\Windows\System\ALhKsug.exe
  C:\Windows\System\ALhKsug.exe
  2⤵
  PID:12220
- C:\Windows\System\etSpJjd.exe
  C:\Windows\System\etSpJjd.exe
  2⤵
  PID:12240
- C:\Windows\System\owZucyG.exe
  C:\Windows\System\owZucyG.exe
  2⤵
  PID:12260
- C:\Windows\System\ieGPKuO.exe
  C:\Windows\System\ieGPKuO.exe
  2⤵
  PID:11268
- C:\Windows\System\rPRkYiF.exe
  C:\Windows\System\rPRkYiF.exe
  2⤵
  PID:11360
- C:\Windows\System\SOjIQIi.exe
  C:\Windows\System\SOjIQIi.exe
  2⤵
  PID:11384
- C:\Windows\System\pFHmVuF.exe
  C:\Windows\System\pFHmVuF.exe
  2⤵
  PID:11500
- C:\Windows\System\IAoRmlo.exe
  C:\Windows\System\IAoRmlo.exe
  2⤵
  PID:11504
- C:\Windows\System\EvmxmgW.exe
  C:\Windows\System\EvmxmgW.exe
  2⤵
  PID:11540
- C:\Windows\System\oDxhGuQ.exe
  C:\Windows\System\oDxhGuQ.exe
  2⤵
  PID:11612
- C:\Windows\System\IaIoYHI.exe
  C:\Windows\System\IaIoYHI.exe
  2⤵
  PID:11716
- C:\Windows\System\TIcYViL.exe
  C:\Windows\System\TIcYViL.exe
  2⤵
  PID:11780
- C:\Windows\System\vlXPrSH.exe
  C:\Windows\System\vlXPrSH.exe
  2⤵
  PID:11828
- C:\Windows\System\eLouVNA.exe
  C:\Windows\System\eLouVNA.exe
  2⤵
  PID:11960
- C:\Windows\System\WLlceVK.exe
  C:\Windows\System\WLlceVK.exe
  2⤵
  PID:12012
- C:\Windows\System\bwAxMZv.exe
  C:\Windows\System\bwAxMZv.exe
  2⤵
  PID:12108
- C:\Windows\System\YjGkLAI.exe
  C:\Windows\System\YjGkLAI.exe
  2⤵
  PID:12172
- C:\Windows\System\bBKCTNH.exe
  C:\Windows\System\bBKCTNH.exe
  2⤵
  PID:12268
- C:\Windows\System\blMzsdx.exe
  C:\Windows\System\blMzsdx.exe
  2⤵
  PID:11328
- C:\Windows\System\HtIefyE.exe
  C:\Windows\System\HtIefyE.exe
  2⤵
  PID:11480
- C:\Windows\System\KHwWLps.exe
  C:\Windows\System\KHwWLps.exe
  2⤵
  PID:11468
- C:\Windows\System\yatZktx.exe
  C:\Windows\System\yatZktx.exe
  2⤵
  PID:11664
- C:\Windows\System\JuoRReY.exe
  C:\Windows\System\JuoRReY.exe
  2⤵
  PID:11788
- C:\Windows\System\KknofNZ.exe
  C:\Windows\System\KknofNZ.exe
  2⤵
  PID:11928
- C:\Windows\System\FTtjdJP.exe
  C:\Windows\System\FTtjdJP.exe
  2⤵
  PID:12248
- C:\Windows\System\lNkaGLc.exe
  C:\Windows\System\lNkaGLc.exe
  2⤵
  PID:11572
- C:\Windows\System\iFZEZUl.exe
  C:\Windows\System\iFZEZUl.exe
  2⤵
  PID:11852
- C:\Windows\System\JGEdJhw.exe
  C:\Windows\System\JGEdJhw.exe
  2⤵
  PID:12176
- C:\Windows\System\eaAQepi.exe
  C:\Windows\System\eaAQepi.exe
  2⤵
  PID:11764
- C:\Windows\System\OGyAlvE.exe
  C:\Windows\System\OGyAlvE.exe
  2⤵
  PID:11972
- C:\Windows\System\MvTjIXc.exe
  C:\Windows\System\MvTjIXc.exe
  2⤵
  PID:12312
- C:\Windows\System\sdrkmmP.exe
  C:\Windows\System\sdrkmmP.exe
  2⤵
  PID:12328
- C:\Windows\System\gYhViez.exe
  C:\Windows\System\gYhViez.exe
  2⤵
  PID:12356
- C:\Windows\System\RlzikiJ.exe
  C:\Windows\System\RlzikiJ.exe
  2⤵
  PID:12376
- C:\Windows\System\OAijNYE.exe
  C:\Windows\System\OAijNYE.exe
  2⤵
  PID:12436
- C:\Windows\System\RFvOpTm.exe
  C:\Windows\System\RFvOpTm.exe
  2⤵
  PID:12464
- C:\Windows\System\hllQYrQ.exe
  C:\Windows\System\hllQYrQ.exe
  2⤵
  PID:12492
- C:\Windows\System\IyjMkXi.exe
  C:\Windows\System\IyjMkXi.exe
  2⤵
  PID:12520
- C:\Windows\System\EIRLaLu.exe
  C:\Windows\System\EIRLaLu.exe
  2⤵
  PID:12536
- C:\Windows\System\NDdAyub.exe
  C:\Windows\System\NDdAyub.exe
  2⤵
  PID:12564
- C:\Windows\System\edEjIGk.exe
  C:\Windows\System\edEjIGk.exe
  2⤵
  PID:12580
- C:\Windows\System\KDlLAkb.exe
  C:\Windows\System\KDlLAkb.exe
  2⤵
  PID:12596
- C:\Windows\System\KysdQJR.exe
  C:\Windows\System\KysdQJR.exe
  2⤵
  PID:12660
- C:\Windows\System\tngjzFo.exe
  C:\Windows\System\tngjzFo.exe
  2⤵
  PID:12688
- C:\Windows\System\xmytkgi.exe
  C:\Windows\System\xmytkgi.exe
  2⤵
  PID:12704
- C:\Windows\System\yGnDRfm.exe
  C:\Windows\System\yGnDRfm.exe
  2⤵
  PID:12720
- C:\Windows\System\XVDVSXN.exe
  C:\Windows\System\XVDVSXN.exe
  2⤵
  PID:12736
- C:\Windows\System\ZSeigma.exe
  C:\Windows\System\ZSeigma.exe
  2⤵
  PID:12788
- C:\Windows\System\JpeJShj.exe
  C:\Windows\System\JpeJShj.exe
  2⤵
  PID:12812
- C:\Windows\System\RDzzVKx.exe
  C:\Windows\System\RDzzVKx.exe
  2⤵
  PID:12832
- C:\Windows\System\fjfSERo.exe
  C:\Windows\System\fjfSERo.exe
  2⤵
  PID:12852
- C:\Windows\System\eCncidF.exe
  C:\Windows\System\eCncidF.exe
  2⤵
  PID:12912
- C:\Windows\System\OuAlWci.exe
  C:\Windows\System\OuAlWci.exe
  2⤵
  PID:12928
- C:\Windows\System\lLCeGhR.exe
  C:\Windows\System\lLCeGhR.exe
  2⤵
  PID:12944
- C:\Windows\System\PFfXKnC.exe
  C:\Windows\System\PFfXKnC.exe
  2⤵
  PID:12988
- C:\Windows\System\UdWsCAx.exe
  C:\Windows\System\UdWsCAx.exe
  2⤵
  PID:13012
- C:\Windows\System\TttwFpE.exe
  C:\Windows\System\TttwFpE.exe
  2⤵
  PID:13040
- C:\Windows\System\oRntupq.exe
  C:\Windows\System\oRntupq.exe
  2⤵
  PID:13056
- C:\Windows\System\YLtreFR.exe
  C:\Windows\System\YLtreFR.exe
  2⤵
  PID:13088
- C:\Windows\System\YAAxybD.exe
  C:\Windows\System\YAAxybD.exe
  2⤵
  PID:13120
- C:\Windows\System\cIobzpy.exe
  C:\Windows\System\cIobzpy.exe
  2⤵
  PID:13144
- C:\Windows\System\Eezlddw.exe
  C:\Windows\System\Eezlddw.exe
  2⤵
  PID:13172
- C:\Windows\System\pPyARTf.exe
  C:\Windows\System\pPyARTf.exe
  2⤵
  PID:13200
- C:\Windows\System\sIwpSkc.exe
  C:\Windows\System\sIwpSkc.exe
  2⤵
  PID:13224
- C:\Windows\System\seplmDm.exe
  C:\Windows\System\seplmDm.exe
  2⤵
  PID:13268
- C:\Windows\System\klPzYiN.exe
  C:\Windows\System\klPzYiN.exe
  2⤵
  PID:13304
- C:\Windows\System\ptbZNYm.exe
  C:\Windows\System\ptbZNYm.exe
  2⤵
  PID:12324
- C:\Windows\System\YlgSZJt.exe
  C:\Windows\System\YlgSZJt.exe
  2⤵
  PID:12384
- C:\Windows\System\SUZFNyF.exe
  C:\Windows\System\SUZFNyF.exe
  2⤵
  PID:12456
- C:\Windows\System\sWZtjrx.exe
  C:\Windows\System\sWZtjrx.exe
  2⤵
  PID:12512
- C:\Windows\System\icKbJlt.exe
  C:\Windows\System\icKbJlt.exe
  2⤵
  PID:12560
- C:\Windows\System\bPgeuFN.exe
  C:\Windows\System\bPgeuFN.exe
  2⤵
  PID:12616
- C:\Windows\System\rwTkhnp.exe
  C:\Windows\System\rwTkhnp.exe
  2⤵
  PID:12684
- C:\Windows\System\iOCuWtP.exe
  C:\Windows\System\iOCuWtP.exe
  2⤵
  PID:12752
- C:\Windows\System\CklHYma.exe
  C:\Windows\System\CklHYma.exe
  2⤵
  PID:12796
- C:\Windows\System\zxhMEnf.exe
  C:\Windows\System\zxhMEnf.exe
  2⤵
  PID:12820
- C:\Windows\System\KEjCdcx.exe
  C:\Windows\System\KEjCdcx.exe
  2⤵
  PID:12840
- C:\Windows\System\qFGjAGX.exe
  C:\Windows\System\qFGjAGX.exe
  2⤵
  PID:12980
- C:\Windows\System\oZNKwDy.exe
  C:\Windows\System\oZNKwDy.exe
  2⤵
  PID:12996
- C:\Windows\System\tbmZhdR.exe
  C:\Windows\System\tbmZhdR.exe
  2⤵
  PID:13184
- C:\Windows\System\kuWbDaA.exe
  C:\Windows\System\kuWbDaA.exe
  2⤵
  PID:13160
- C:\Windows\System\TANSmDP.exe
  C:\Windows\System\TANSmDP.exe
  2⤵
  PID:13300
- C:\Windows\System\JwwkqRt.exe
  C:\Windows\System\JwwkqRt.exe
  2⤵
  PID:12352
- C:\Windows\System\SXPCegm.exe
  C:\Windows\System\SXPCegm.exe
  2⤵
  PID:12428
- C:\Windows\System\MFjDpfU.exe
  C:\Windows\System\MFjDpfU.exe
  2⤵
  PID:12608
- C:\Windows\System\DKfmusK.exe
  C:\Windows\System\DKfmusK.exe
  2⤵
  PID:12036
- C:\Windows\System\yKDurGe.exe
  C:\Windows\System\yKDurGe.exe
  2⤵
  PID:12892
- C:\Windows\System\uFZnDDL.exe
  C:\Windows\System\uFZnDDL.exe
  2⤵
  PID:12964
- C:\Windows\System\jjeFZsT.exe
  C:\Windows\System\jjeFZsT.exe
  2⤵
  PID:13244
- C:\Windows\System\DfOdlAP.exe
  C:\Windows\System\DfOdlAP.exe
  2⤵
  PID:12320
- C:\Windows\System\yahFGjM.exe
  C:\Windows\System\yahFGjM.exe
  2⤵
  PID:12716
- C:\Windows\System\fWrEcas.exe
  C:\Windows\System\fWrEcas.exe
  2⤵
  PID:13128
- C:\Windows\System\CQaBLfM.exe
  C:\Windows\System\CQaBLfM.exe
  2⤵
  PID:12572
- C:\Windows\System\tLbKBul.exe
  C:\Windows\System\tLbKBul.exe
  2⤵
  PID:13320
- C:\Windows\System\XjDPVDH.exe
  C:\Windows\System\XjDPVDH.exe
  2⤵
  PID:13340
- C:\Windows\System\trkBgCX.exe
  C:\Windows\System\trkBgCX.exe
  2⤵
  PID:13364
- C:\Windows\System\eBTlOdY.exe
  C:\Windows\System\eBTlOdY.exe
  2⤵
  PID:13388
- C:\Windows\System\ohKoQef.exe
  C:\Windows\System\ohKoQef.exe
  2⤵
  PID:13432
- C:\Windows\System\FSmHpAr.exe
  C:\Windows\System\FSmHpAr.exe
  2⤵
  PID:13464
- C:\Windows\System\HTtWsZm.exe
  C:\Windows\System\HTtWsZm.exe
  2⤵
  PID:13488
- C:\Windows\System\TVNPYns.exe
  C:\Windows\System\TVNPYns.exe
  2⤵
  PID:13528
- C:\Windows\System\EAfWSxQ.exe
  C:\Windows\System\EAfWSxQ.exe
  2⤵
  PID:13544
- C:\Windows\System\OASOYst.exe
  C:\Windows\System\OASOYst.exe
  2⤵
  PID:13560
- C:\Windows\System\xTQhRkk.exe
  C:\Windows\System\xTQhRkk.exe
  2⤵
  PID:13576
- C:\Windows\System\BaGhEeE.exe
  C:\Windows\System\BaGhEeE.exe
  2⤵
  PID:13600
- C:\Windows\System\XdiFsKr.exe
  C:\Windows\System\XdiFsKr.exe
  2⤵
  PID:13636
- C:\Windows\System\fQVDoSk.exe
  C:\Windows\System\fQVDoSk.exe
  2⤵
  PID:13660
- C:\Windows\System\CdurwUW.exe
  C:\Windows\System\CdurwUW.exe
  2⤵
  PID:13684
- C:\Windows\System\hObejIu.exe
  C:\Windows\System\hObejIu.exe
  2⤵
  PID:13704
- C:\Windows\System\BgehxVS.exe
  C:\Windows\System\BgehxVS.exe
  2⤵
  PID:13740
- C:\Windows\System\wFLooIR.exe
  C:\Windows\System\wFLooIR.exe
  2⤵
  PID:13780
- C:\Windows\System\LhQEWrh.exe
  C:\Windows\System\LhQEWrh.exe
  2⤵
  PID:13816
- C:\Windows\System\eiJkmab.exe
  C:\Windows\System\eiJkmab.exe
  2⤵
  PID:13840
- C:\Windows\System\CjUvtzE.exe
  C:\Windows\System\CjUvtzE.exe
  2⤵
  PID:13860
- C:\Windows\System\XXWPlUs.exe
  C:\Windows\System\XXWPlUs.exe
  2⤵
  PID:13880
- C:\Windows\System\XfGuhbf.exe
  C:\Windows\System\XfGuhbf.exe
  2⤵
  PID:13916
- C:\Windows\System\DnbbUxP.exe
  C:\Windows\System\DnbbUxP.exe
  2⤵
  PID:13936
- C:\Windows\System\ZJevwzq.exe
  C:\Windows\System\ZJevwzq.exe
  2⤵
  PID:13960
- C:\Windows\System\RWIvGtG.exe
  C:\Windows\System\RWIvGtG.exe
  2⤵
  PID:13988
- C:\Windows\System\zLXrZZy.exe
  C:\Windows\System\zLXrZZy.exe
  2⤵
  PID:14060
- C:\Windows\System\ZsJrehu.exe
  C:\Windows\System\ZsJrehu.exe
  2⤵
  PID:14076
- C:\Windows\System\GKIeNCa.exe
  C:\Windows\System\GKIeNCa.exe
  2⤵
  PID:14108
- C:\Windows\System\xlSiEBT.exe
  C:\Windows\System\xlSiEBT.exe
  2⤵
  PID:14132
- C:\Windows\System\jdEPvCu.exe
  C:\Windows\System\jdEPvCu.exe
  2⤵
  PID:14156
- C:\Windows\System\ZXkcHRf.exe
  C:\Windows\System\ZXkcHRf.exe
  2⤵
  PID:14180
- C:\Windows\System\jmhVGWW.exe
  C:\Windows\System\jmhVGWW.exe
  2⤵
  PID:14216
- C:\Windows\System\aKiRCPz.exe
  C:\Windows\System\aKiRCPz.exe
  2⤵
  PID:14236
- C:\Windows\System\GOhBFBB.exe
  C:\Windows\System\GOhBFBB.exe
  2⤵
  PID:14260
- C:\Windows\System\IpuFGZr.exe
  C:\Windows\System\IpuFGZr.exe
  2⤵
  PID:14276
- C:\Windows\System\ACEgikW.exe
  C:\Windows\System\ACEgikW.exe
  2⤵
  PID:14292
- C:\Windows\System\OZzONPR.exe
  C:\Windows\System\OZzONPR.exe
  2⤵
  PID:14320
- C:\Windows\System\UuePpcQ.exe
  C:\Windows\System\UuePpcQ.exe
  2⤵
  PID:13328
- C:\Windows\System\HXBhaCl.exe
  C:\Windows\System\HXBhaCl.exe
  2⤵
  PID:13380
- C:\Windows\System\dvLbxEz.exe
  C:\Windows\System\dvLbxEz.exe
  2⤵
  PID:13444
- C:\Windows\System\JRxFJXi.exe
  C:\Windows\System\JRxFJXi.exe
  2⤵
  PID:13500
- C:\Windows\System\ltxcXep.exe
  C:\Windows\System\ltxcXep.exe
  2⤵
  PID:13612
- C:\Windows\System\mNtQtwS.exe
  C:\Windows\System\mNtQtwS.exe
  2⤵
  PID:13716
- C:\Windows\System\qjvSSvc.exe
  C:\Windows\System\qjvSSvc.exe
  2⤵
  PID:13736
- C:\Windows\System\neUniYf.exe
  C:\Windows\System\neUniYf.exe
  2⤵
  PID:13868
- C:\Windows\System\uQYrPMt.exe
  C:\Windows\System\uQYrPMt.exe
  2⤵
  PID:13908
- C:\Windows\System\zQCPyit.exe
  C:\Windows\System\zQCPyit.exe
  2⤵
  PID:13972
- C:\Windows\System\hDprxoU.exe
  C:\Windows\System\hDprxoU.exe
  2⤵
  PID:14044
- C:\Windows\System\sMAXpUq.exe
  C:\Windows\System\sMAXpUq.exe
  2⤵
  PID:14116
- C:\Windows\System\XSBtPrW.exe
  C:\Windows\System\XSBtPrW.exe
  2⤵
  PID:14152
- C:\Windows\System\sJvimlg.exe
  C:\Windows\System\sJvimlg.exe
  2⤵
  PID:14224
- C:\Windows\System\lAHBIdk.exe
  C:\Windows\System\lAHBIdk.exe
  2⤵
  PID:14308
- C:\Windows\System\YmyJOXh.exe
  C:\Windows\System\YmyJOXh.exe
  2⤵
  PID:13424
- C:\Windows\System\eWuNcet.exe
  C:\Windows\System\eWuNcet.exe
  2⤵
  PID:13348
- C:\Windows\System\fcZmzcq.exe
  C:\Windows\System\fcZmzcq.exe
  2⤵
  PID:13588
- C:\Windows\System\xTpvOZv.exe
  C:\Windows\System\xTpvOZv.exe
  2⤵
  PID:13796
- C:\Windows\System\hMymhjB.exe
  C:\Windows\System\hMymhjB.exe
  2⤵
  PID:13876
- C:\Windows\System\KJUaxvY.exe
  C:\Windows\System\KJUaxvY.exe
  2⤵
  PID:14036
- C:\Windows\System\VnrbvkG.exe
  C:\Windows\System\VnrbvkG.exe
  2⤵
  PID:14164
- C:\Windows\System\YSPvfSj.exe
  C:\Windows\System\YSPvfSj.exe
  2⤵
  PID:13776
- C:\Windows\System\jvfjZYn.exe
  C:\Windows\System\jvfjZYn.exe
  2⤵
  PID:13180
- C:\Windows\System\iksirnu.exe
  C:\Windows\System\iksirnu.exe
  2⤵
  PID:13356
- C:\Windows\System\tgPEBNM.exe
  C:\Windows\System\tgPEBNM.exe
  2⤵
  PID:14248
- C:\Windows\System\wbZBYkQ.exe
  C:\Windows\System\wbZBYkQ.exe
  2⤵
  PID:14356
- C:\Windows\System\fALKyrr.exe
  C:\Windows\System\fALKyrr.exe
  2⤵
  PID:14380
- C:\Windows\System\CxzMAoS.exe
  C:\Windows\System\CxzMAoS.exe
  2⤵
  PID:14412
- C:\Windows\System\EheCeLN.exe
  C:\Windows\System\EheCeLN.exe
  2⤵
  PID:14440
- C:\Windows\System\CDoDxOT.exe
  C:\Windows\System\CDoDxOT.exe
  2⤵
  PID:14468
- C:\Windows\System\QdIUsym.exe
  C:\Windows\System\QdIUsym.exe
  2⤵
  PID:14484
- C:\Windows\System\iKiRsEK.exe
  C:\Windows\System\iKiRsEK.exe
  2⤵
  PID:14524
- C:\Windows\System\TPsIFzc.exe
  C:\Windows\System\TPsIFzc.exe
  2⤵
  PID:14540
- C:\Windows\System\UKccbQa.exe
  C:\Windows\System\UKccbQa.exe
  2⤵
  PID:14568
- C:\Windows\System\jyygaMU.exe
  C:\Windows\System\jyygaMU.exe
  2⤵
  PID:14592
- C:\Windows\System\WfoIdsz.exe
  C:\Windows\System\WfoIdsz.exe
  2⤵
  PID:14624
- C:\Windows\System\ULVTJYf.exe
  C:\Windows\System\ULVTJYf.exe
  2⤵
  PID:14648
- C:\Windows\System\iJGaEIs.exe
  C:\Windows\System\iJGaEIs.exe
  2⤵
  PID:14688
- C:\Windows\System\FWAwbgf.exe
  C:\Windows\System\FWAwbgf.exe
  2⤵
  PID:14712
- C:\Windows\System\CBbBZji.exe
  C:\Windows\System\CBbBZji.exe
  2⤵
  PID:14756
- C:\Windows\System\HzMLnUY.exe
  C:\Windows\System\HzMLnUY.exe
  2⤵
  PID:14776
- C:\Windows\System\mZVIvPh.exe
  C:\Windows\System\mZVIvPh.exe
  2⤵
  PID:14800
- C:\Windows\System\vfOWFBK.exe
  C:\Windows\System\vfOWFBK.exe
  2⤵
  PID:14820
- C:\Windows\System\xQETpSk.exe
  C:\Windows\System\xQETpSk.exe
  2⤵
  PID:14840
- C:\Windows\System\tSdLnDC.exe
  C:\Windows\System\tSdLnDC.exe
  2⤵
  PID:14868
- C:\Windows\System\YAfpurk.exe
  C:\Windows\System\YAfpurk.exe
  2⤵
  PID:14896
- C:\Windows\System\AXOZdAQ.exe
  C:\Windows\System\AXOZdAQ.exe
  2⤵
  PID:14916
- C:\Windows\System\LxjmwEX.exe
  C:\Windows\System\LxjmwEX.exe
  2⤵
  PID:14944
- C:\Windows\System\FtJoByV.exe
  C:\Windows\System\FtJoByV.exe
  2⤵
  PID:15016
- C:\Windows\System\hjgYDni.exe
  C:\Windows\System\hjgYDni.exe
  2⤵
  PID:15052
- C:\Windows\System\FZcqyoA.exe
  C:\Windows\System\FZcqyoA.exe
  2⤵
  PID:15068
- C:\Windows\System\xZhvaYj.exe
  C:\Windows\System\xZhvaYj.exe
  2⤵
  PID:15092
- C:\Windows\System\kgrUVKb.exe
  C:\Windows\System\kgrUVKb.exe
  2⤵
  PID:15108
- C:\Windows\System\mEpRInK.exe
  C:\Windows\System\mEpRInK.exe
  2⤵
  PID:15140
- C:\Windows\System\ZlMWRmz.exe
  C:\Windows\System\ZlMWRmz.exe
  2⤵
  PID:15172
- C:\Windows\System\UYjQsZW.exe
  C:\Windows\System\UYjQsZW.exe
  2⤵
  PID:15220
- C:\Windows\System\YDmXKIc.exe
  C:\Windows\System\YDmXKIc.exe
  2⤵
  PID:15248
- C:\Windows\System\eqseWIz.exe
  C:\Windows\System\eqseWIz.exe
  2⤵
  PID:15264
- C:\Windows\System\BSOlWvz.exe
  C:\Windows\System\BSOlWvz.exe
  2⤵
  PID:15284
- C:\Windows\System\jIkeuTG.exe
  C:\Windows\System\jIkeuTG.exe
  2⤵
  PID:15316
- C:\Windows\System\kLMOYOO.exe
  C:\Windows\System\kLMOYOO.exe
  2⤵
  PID:15336
- C:\Windows\System\OcHihCt.exe
  C:\Windows\System\OcHihCt.exe
  2⤵
  PID:13952
- C:\Windows\System\WVnSvXb.exe
  C:\Windows\System\WVnSvXb.exe
  2⤵
  PID:14376
- C:\Windows\System\voGHBKN.exe
  C:\Windows\System\voGHBKN.exe
  2⤵
  PID:14428
- C:\Windows\System\WEXgfWe.exe
  C:\Windows\System\WEXgfWe.exe
  2⤵
  PID:14480
- C:\Windows\System\bzrRdSo.exe
  C:\Windows\System\bzrRdSo.exe
  2⤵
  PID:14580
- C:\Windows\System\HzubZSw.exe
  C:\Windows\System\HzubZSw.exe
  2⤵
  PID:14644
- C:\Windows\System\oLzXTMB.exe
  C:\Windows\System\oLzXTMB.exe
  2⤵
  PID:14700
- C:\Windows\System\CdpFkvP.exe
  C:\Windows\System\CdpFkvP.exe
  2⤵
  PID:14768
- C:\Windows\System\oeTtOpp.exe
  C:\Windows\System\oeTtOpp.exe
  2⤵
  PID:14788
- C:\Windows\System\VQfbSis.exe
  C:\Windows\System\VQfbSis.exe
  2⤵
  PID:14888
- C:\Windows\System\aIfxGoL.exe
  C:\Windows\System\aIfxGoL.exe
  2⤵
  PID:14940
- C:\Windows\System\RCpSQfF.exe
  C:\Windows\System\RCpSQfF.exe
  2⤵
  PID:15000
- C:\Windows\System\yQltozp.exe
  C:\Windows\System\yQltozp.exe
  2⤵
  PID:15064
- C:\Windows\System\WgPGvlw.exe
  C:\Windows\System\WgPGvlw.exe
  2⤵
  PID:15100
- C:\Windows\System\lUJSYjf.exe
  C:\Windows\System\lUJSYjf.exe
  2⤵
  PID:15160
- C:\Windows\System\cDhiitb.exe
  C:\Windows\System\cDhiitb.exe
  2⤵
  PID:15204
- C:\Windows\System\oSgXLzr.exe
  C:\Windows\System\oSgXLzr.exe
  2⤵
  PID:15328
- C:\Windows\System\TQdTgys.exe
  C:\Windows\System\TQdTgys.exe
  2⤵
  PID:15332
- C:\Windows\System\dPLGbbR.exe
  C:\Windows\System\dPLGbbR.exe
  2⤵
  PID:14556
- C:\Windows\System\tdfYQgQ.exe
  C:\Windows\System\tdfYQgQ.exe
  2⤵
  PID:14636
- C:\Windows\System\HbpolMz.exe
  C:\Windows\System\HbpolMz.exe
  2⤵
  PID:14724
- C:\Windows\System\iETkXju.exe
  C:\Windows\System\iETkXju.exe
  2⤵
  PID:15036
- C:\Windows\System\vgFahoM.exe
  C:\Windows\System\vgFahoM.exe
  2⤵
  PID:15256
- C:\Windows\System\EyuqzeF.exe
  C:\Windows\System\EyuqzeF.exe
  2⤵
  PID:14608
- C:\Windows\System\DHjLCXE.exe
  C:\Windows\System\DHjLCXE.exe
  2⤵
  PID:14616
- C:\Windows\System\QIyVHSe.exe
  C:\Windows\System\QIyVHSe.exe
  2⤵
  PID:14968
- C:\Windows\System\skQiSPI.exe
  C:\Windows\System\skQiSPI.exe
  2⤵
  PID:14372
- C:\Windows\System\NBbjvWQ.exe
  C:\Windows\System\NBbjvWQ.exe
  2⤵
  PID:14304
- C:\Windows\System\vPxFFrK.exe
  C:\Windows\System\vPxFFrK.exe
  2⤵
  PID:15380
- C:\Windows\System\tnCnPTU.exe
  C:\Windows\System\tnCnPTU.exe
  2⤵
  PID:15424
- C:\Windows\System\cuqLSzc.exe
  C:\Windows\System\cuqLSzc.exe
  2⤵
  PID:15448
- C:\Windows\System\yVDrXyE.exe
  C:\Windows\System\yVDrXyE.exe
  2⤵
  PID:15464
- C:\Windows\System\VilFJKc.exe
  C:\Windows\System\VilFJKc.exe
  2⤵
  PID:15480
- C:\Windows\System\eqclRmI.exe
  C:\Windows\System\eqclRmI.exe
  2⤵
  PID:15516
- C:\Windows\System\TLiCEGT.exe
  C:\Windows\System\TLiCEGT.exe
  2⤵
  PID:15560
- C:\Windows\System\BCKYGzi.exe
  C:\Windows\System\BCKYGzi.exe
  2⤵
  PID:15576
- C:\Windows\System\soPzaNG.exe
  C:\Windows\System\soPzaNG.exe
  2⤵
  PID:15604
- C:\Windows\System\lVpxgkV.exe
  C:\Windows\System\lVpxgkV.exe
  2⤵
  PID:15628
- C:\Windows\System\GLAzQSO.exe
  C:\Windows\System\GLAzQSO.exe
  2⤵
  PID:15664
- C:\Windows\System\fXdqZLt.exe
  C:\Windows\System\fXdqZLt.exe
  2⤵
  PID:15700
- C:\Windows\System\zydeYaK.exe
  C:\Windows\System\zydeYaK.exe
  2⤵
  PID:15716
- C:\Windows\System\GfADAPF.exe
  C:\Windows\System\GfADAPF.exe
  2⤵
  PID:15740
- C:\Windows\System\TCjymtj.exe
  C:\Windows\System\TCjymtj.exe
  2⤵
  PID:15764
- C:\Windows\System\XGomOHX.exe
  C:\Windows\System\XGomOHX.exe
  2⤵
  PID:15796
- C:\Windows\System\myWQUkD.exe
  C:\Windows\System\myWQUkD.exe
  2⤵
  PID:15816
- C:\Windows\System\UXIPTSc.exe
  C:\Windows\System\UXIPTSc.exe
  2⤵
  PID:15868
- C:\Windows\System\IWxaTaS.exe
  C:\Windows\System\IWxaTaS.exe
  2⤵
  PID:15888
- C:\Windows\System\DehjHbt.exe
  C:\Windows\System\DehjHbt.exe
  2⤵
  PID:15908
- C:\Windows\System\lbyCCmd.exe
  C:\Windows\System\lbyCCmd.exe
  2⤵
  PID:15956
- C:\Windows\System\NXDryqi.exe
  C:\Windows\System\NXDryqi.exe
  2⤵
  PID:15980
- C:\Windows\System\tEYVfdM.exe
  C:\Windows\System\tEYVfdM.exe
  2⤵
  PID:16020
- C:\Windows\System\yNKUsPA.exe
  C:\Windows\System\yNKUsPA.exe
  2⤵
  PID:16036
- C:\Windows\System\AluKoEd.exe
  C:\Windows\System\AluKoEd.exe
  2⤵
  PID:16064
- C:\Windows\System\fhXbbFD.exe
  C:\Windows\System\fhXbbFD.exe
  2⤵
  PID:16084
- C:\Windows\System\cDEnRcO.exe
  C:\Windows\System\cDEnRcO.exe
  2⤵
  PID:16108
- C:\Windows\System\WXXdKRH.exe
  C:\Windows\System\WXXdKRH.exe
  2⤵
  PID:16136
- C:\Windows\System\AIByrwT.exe
  C:\Windows\System\AIByrwT.exe
  2⤵
  PID:16152
- C:\Windows\System\SqnHvBz.exe
  C:\Windows\System\SqnHvBz.exe
  2⤵
  PID:16168
- C:\Windows\System\fgJLVHb.exe
  C:\Windows\System\fgJLVHb.exe
  2⤵
  PID:16188
- C:\Windows\System\qykEOjc.exe
  C:\Windows\System\qykEOjc.exe
  2⤵
  PID:16260
- C:\Windows\System\ieocAUD.exe
  C:\Windows\System\ieocAUD.exe
  2⤵
  PID:16288
- C:\Windows\System\PUhEjbZ.exe
  C:\Windows\System\PUhEjbZ.exe
  2⤵
  PID:16328
- C:\Windows\System\EVYzxTC.exe
  C:\Windows\System\EVYzxTC.exe
  2⤵
  PID:16356
- C:\Windows\System\oxfMNDy.exe
  C:\Windows\System\oxfMNDy.exe
  2⤵
  PID:15364
- C:\Windows\System\GlKsnvE.exe
  C:\Windows\System\GlKsnvE.exe
  2⤵
  PID:15432
- C:\Windows\System\HRBUTuo.exe
  C:\Windows\System\HRBUTuo.exe
  2⤵
  PID:15400
- C:\Windows\System\XMaaNQT.exe
  C:\Windows\System\XMaaNQT.exe
  2⤵
  PID:15472
- C:\Windows\System\gGRBMBN.exe
  C:\Windows\System\gGRBMBN.exe
  2⤵
  PID:15532
- C:\Windows\System\RSElDeI.exe
  C:\Windows\System\RSElDeI.exe
  2⤵
  PID:15596
- C:\Windows\System\WLDbBDf.exe
  C:\Windows\System\WLDbBDf.exe
  2⤵
  PID:15656
- C:\Windows\System\uQHyotP.exe
  C:\Windows\System\uQHyotP.exe
  2⤵
  PID:15752
- C:\Windows\System\hFhOdzL.exe
  C:\Windows\System\hFhOdzL.exe
  2⤵
  PID:15812
- C:\Windows\System\oyhKqvM.exe
  C:\Windows\System\oyhKqvM.exe
  2⤵
  PID:15860
- C:\Windows\System\GBcMQfH.exe
  C:\Windows\System\GBcMQfH.exe
  2⤵
  PID:15952
- C:\Windows\System\pSxxpcu.exe
  C:\Windows\System\pSxxpcu.exe
  2⤵
  PID:16032
- C:\Windows\System\iWScqwm.exe
  C:\Windows\System\iWScqwm.exe
  2⤵
  PID:16048
- C:\Windows\System\qVqHyNN.exe
  C:\Windows\System\qVqHyNN.exe
  2⤵
  PID:16164
- C:\Windows\System\unwxVtT.exe
  C:\Windows\System\unwxVtT.exe
  2⤵
  PID:16236
- C:\Windows\System\IabcTQG.exe
  C:\Windows\System\IabcTQG.exe
  2⤵
  PID:16300
- C:\Windows\System\EFlTNkc.exe
  C:\Windows\System\EFlTNkc.exe
  2⤵
  PID:16352
- C:\Windows\System\iyNTNkK.exe
  C:\Windows\System\iyNTNkK.exe
  2⤵
  PID:15420
- C:\Windows\System\ihhihTy.exe
  C:\Windows\System\ihhihTy.exe
  2⤵
  PID:15620
- C:\Windows\System\elrDGcq.exe
  C:\Windows\System\elrDGcq.exe
  2⤵
  PID:15760
- C:\Windows\System\RcfVjBs.exe
  C:\Windows\System\RcfVjBs.exe
  2⤵
  PID:15896
- C:\Windows\System\xquPFgS.exe
  C:\Windows\System\xquPFgS.exe
  2⤵
  PID:16004
- C:\Windows\System\JFcRFfz.exe
  C:\Windows\System\JFcRFfz.exe
  2⤵
  PID:14856
- C:\Windows\System\AYTqvbr.exe
  C:\Windows\System\AYTqvbr.exe
  2⤵
  PID:16312
- C:\Windows\System\iteBqie.exe
  C:\Windows\System\iteBqie.exe
  2⤵
  PID:15712
- C:\Windows\System\AqzGdPS.exe
  C:\Windows\System\AqzGdPS.exe
  2⤵
  PID:15876
- C:\Windows\System\sglUyBP.exe
  C:\Windows\System\sglUyBP.exe
  2⤵
  PID:16216
- C:\Windows\System\MhwBBbw.exe
  C:\Windows\System\MhwBBbw.exe
  2⤵
  PID:15736
- C:\Windows\System\nMeApLC.exe
  C:\Windows\System\nMeApLC.exe
  2⤵
  PID:16400
- C:\Windows\System\urhpcrc.exe
  C:\Windows\System\urhpcrc.exe
  2⤵
  PID:16420
- C:\Windows\System\GotbAem.exe
  C:\Windows\System\GotbAem.exe
  2⤵
  PID:16448
- C:\Windows\System\dTHXSXe.exe
  C:\Windows\System\dTHXSXe.exe
  2⤵
  PID:16472
- C:\Windows\System\IVUROyv.exe
  C:\Windows\System\IVUROyv.exe
  2⤵
  PID:16496
- C:\Windows\System\iDpWipG.exe
  C:\Windows\System\iDpWipG.exe
  2⤵
  PID:16536
- C:\Windows\System\VYIvwLh.exe
  C:\Windows\System\VYIvwLh.exe
  2⤵
  PID:16560
- C:\Windows\System\LOpGAwW.exe
  C:\Windows\System\LOpGAwW.exe
  2⤵
  PID:16576
- C:\Windows\System\uDcqfyh.exe
  C:\Windows\System\uDcqfyh.exe
  2⤵
  PID:16628
- C:\Windows\System\MJeWTsy.exe
  C:\Windows\System\MJeWTsy.exe
  2⤵
  PID:16648
- C:\Windows\System\ShAkTQO.exe
  C:\Windows\System\ShAkTQO.exe
  2⤵
  PID:16672
- C:\Windows\System\vSeikBI.exe
  C:\Windows\System\vSeikBI.exe
  2⤵
  PID:16708
- C:\Windows\System\XbSSDYT.exe
  C:\Windows\System\XbSSDYT.exe
  2⤵
  PID:16736
- C:\Windows\System\XajJEMO.exe
  C:\Windows\System\XajJEMO.exe
  2⤵
  PID:16756
- C:\Windows\System\UVpenMG.exe
  C:\Windows\System\UVpenMG.exe
  2⤵
  PID:16784
- C:\Windows\System\vNvJvTV.exe
  C:\Windows\System\vNvJvTV.exe
  2⤵
  PID:16836
- C:\Windows\System\RyjPqyX.exe
  C:\Windows\System\RyjPqyX.exe
  2⤵
  PID:16852
- C:\Windows\System\SjPlOGV.exe
  C:\Windows\System\SjPlOGV.exe
  2⤵
  PID:16888
- C:\Windows\System\LwtTNWA.exe
  C:\Windows\System\LwtTNWA.exe
  2⤵
  PID:16908
- - C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -u -p 16908 -s 248
    3⤵
    PID:17392
- C:\Windows\System\iovGblL.exe
  C:\Windows\System\iovGblL.exe
  2⤵
  PID:16924
- C:\Windows\System\FmHoVYS.exe
  C:\Windows\System\FmHoVYS.exe
  2⤵
  PID:16948
- C:\Windows\System\Lxpprud.exe
  C:\Windows\System\Lxpprud.exe
  2⤵
  PID:17084

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:16444

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Accessibility Features

T1546.008

Privilege Escalation

Event Triggered Execution

T1546

Accessibility Features

T1546.008

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\AbsTKZo.exe

Filesize
1.3MB

MD5
77597931384906ad31b986ed7da38a54

SHA1
6745163f032841333f5afa571ff6995d325df5cc

SHA256
357ebde821dcf095303b399d4ec7c171148ebaa1afb449b7d62cc696dae7a988

SHA512
bf4d0e278f836e667efb82cd40b82e12cf6a0aa115db96cc4ed6dd2edd1961f848b54c71188ef8c5c90abc744db7b7d9e5a8287281c72c144fbf912edd1b7972

Download Submit
C:\Windows\System\AjGZSPt.exe

Filesize
1.3MB

MD5
eb903f4ca835c9a8f8ef0c1a14a2816d

SHA1
4c6bc1288449e410d4b87791e438c878e743a58b

SHA256
d455d8a19be3811d94833bf562a13f2153dc51bea92543d02ac20caf4a114905

SHA512
2b1b8882afc8d40f5b70539def475272d24797aa49ef808ce89ef149e9f1b26ee4efc24d672193b6f10fdbdce404de4a714f1115d532f7a97f02539d40214c3a

Download Submit
C:\Windows\System\CWAfHkD.exe

Filesize
1.3MB

MD5
2e7c203491e9aab2cb6387b71cf1d1da

SHA1
3437c893930546b5590d3c46b21a6507417cd202

SHA256
137489f0252fba944e463a282197b070feef8e354cb648d60c15f97b2ed7199b

SHA512
dbfe311874af25332cfe41774e4700452585265b35af2ba1090c8fd77fcd6f1695df0f03dc600c2ef362120adbe8dd5ea6677cd7217bc829ed5735e26855e10b

Download Submit
C:\Windows\System\CbTtEoA.exe

Filesize
1.3MB

MD5
5bd0b332c878fc54419e37b870f78f3a

SHA1
a538928d477ee2700b26e804dfb4576e9c22666e

SHA256
061ca3656fecb97e05e4f8142e1c9f08780e3af13e5bc7e39feb6c68a456cac5

SHA512
6c82d51284404e09394bc67eb88a57ea2b50ff82689bbf943b724a46c82f638fabbfae1351ccfafdb177ef1280fdbef161962e64891e4194b515e56dfbc303f0

Download Submit
C:\Windows\System\DPXIRdZ.exe

Filesize
1.3MB

MD5
023e8f21b484e55c0cfba2d24ef3592f

SHA1
165aca40208ba8db868b595f9f49b7cb98931b18

SHA256
95eff95e38f00e2adbde01f9c1f9bf885c3929bfb92a918695381c5cdb13e586

SHA512
c118dee50e5f6bc24f6a54965b1443f6989217879ebba1ea7c7183ab42864a435baaedac057f766fb96bb384a41c540d22774b9168bc27160c6d76ff4dbd46c0

Download Submit
C:\Windows\System\IxXjTsj.exe

Filesize
1.3MB

MD5
06fb8d09c60c56751b739d1509c457df

SHA1
8b3b72f8d819bf173de942145dc06495b7dd9a03

SHA256
16a040ab1ffc8c654c7cbc09d2ef7c582c641a2791d87a75d10d34fbcdb0fc98

SHA512
22b758cdf0e71c5ea9e3c31fd82560a70108242d676bdbf68e02092a59a88060319a1d0c559f2b75e08a359085359d94972da41d7c693edd52a3c0409cd253f1

Download Submit
C:\Windows\System\JcMxuFO.exe

Filesize
1.3MB

MD5
69cad63673d00ba8333978f8a1a44699

SHA1
30ad811838b992e0f704f15d96b5cf9000b4d39c

SHA256
fe2a22e56f0472469fc86318928fd8c2cd33953024a74cca8e1b03129680bb02

SHA512
391966968873a2c649a3557067adfc2e299b1a6e6dfc868c7cb17402c12cd76688c4d36f6707ed517a6761af76a77b1d1ed42ad86bb42a099cf51d673c2b4832

Download Submit
C:\Windows\System\Jkvbsnz.exe

Filesize
1.3MB

MD5
c0ec2c6917e9eb4170d03386ca99eab2

SHA1
561fb639ef90ace8fe8bede79767a47aa0e80d9a

SHA256
90af972ad922a5581dae49aa5ef4c2c820e3903c945fe3f19cf91f818b45eb6d

SHA512
70841e3d65665af56c5d5fd42b07da0bae1bc53ff53ac721a9a2d377b1c0dbf852c1d66c932c95b45050a4fc064b92df5b76d72760e0adcf7e69c9e1e5f75d3c

Download Submit
C:\Windows\System\PebHsdh.exe

Filesize
1.3MB

MD5
71c0ddebddc0bfde04922f68d6ad5d27

SHA1
6a020afeb2dc4566c7d561a78b7cf5ea4309c667

SHA256
a25dbf5ffd439f3f3ae6c6d3efa7383ac7cfb1694813b69292b238ba51718dec

SHA512
1c36b4c23743d97e849952b5627ebd7c9ac53d18daf793a945374915f2da2a962268cf3d3f888fa5ae07feb104ba1cd0333871518291dbb17c803ffe4bc19cf2

Download Submit
C:\Windows\System\RQPjQvT.exe

Filesize
1.3MB

MD5
b3328f89498bcd5eef7540717bdbcf04

SHA1
d980132848f93d8c13849778f211a2953d8bd808

SHA256
c30b97e487bba4c186978af15f4f8705288a6ad35fa1543a6778ab7372eebf9a

SHA512
3a7fe4716c7a9888c6344039b021aecadc6e8c05424a646c37c612f62cf0eb3cf3c429b3a694699c721a102909b18d1471746792cae523da4f7d4777d591993f

Download Submit
C:\Windows\System\SVXbrGc.exe

Filesize
1.3MB

MD5
bff17e1d966d13885ba721ec629a4b48

SHA1
f5a0c07167f24a677d692da9e078aed20d459753

SHA256
fe72c136be26c8ffa61fd1e3bbd47b5734e134998368682c54a606cb058f5a88

SHA512
b7340c2f8d3c674a4d814683b26a850dc30eacef77a313e8afe461da557417eadbc21e66f3e652bee5f0fd25eca18ae5ed8b71049de30be26891f02286988e04

Download Submit
C:\Windows\System\SoQyHmW.exe

Filesize
1.3MB

MD5
5d079b0f2d32fd19a756545ddc5741b9

SHA1
f5fc3c590ddf91727bb14937a391d583da747e39

SHA256
fc622cce3d90a7b63f316854c722eb84201e1f82fa7f4f88fbda15c18e3d0ba7

SHA512
98a6a0fa732f992c82d9526c1bf90b539259642df485643287c3e340f17bc0c7b8a172cc9d018114f340a8586dfca36f34ad50b5c020648810e9d0dca0613d4e

Download Submit
C:\Windows\System\TFmJRsZ.exe

Filesize
1.3MB

MD5
e1b67d92e7e4741c56fd284349c72b91

SHA1
3c3f3014b597222369b46c92ce534ae882e29219

SHA256
dda53443d9c05e099ef4d04dd374b4f36ca296856a4e02d1ce774d3952cbcbc5

SHA512
1862309c3c17fb7e9285c9510589f439a795471fd73bf19ca300dd3f95cfe1e927d1f94c2a8f1e0ed6542de17f2135c636de37b0e53b251d11c0b67c700ccbae

Download Submit
C:\Windows\System\VKqjhBt.exe

Filesize
1.3MB

MD5
5fcd5ba90005c0685fdf2c5e81f8923f

SHA1
afbef007264688e020312a487e341d3d05317316

SHA256
da97c8121975e15a7c974cd8fbd4442d5fec202f0413dfcd7ca3f7199ee35a7a

SHA512
94e865a5e73334b6b25520be4047305d27db978e0ff0381638d507abf6363020df1468805bc2a924f230f3928fbee8080e4314bdf8cbdf6e978543daf68dd994

Download Submit
C:\Windows\System\bTKIzhx.exe

Filesize
1.3MB

MD5
1d897dc63ece1318eb6bcc7561a79add

SHA1
4e3fca3c82df15ab67996483062805e43f92b349

SHA256
866e5ca90c9ca833aab88e8ce75ef0f20d2fe6382c28f36ee9d2895d5d217581

SHA512
ac3d97bf4e4c5c476f7da16590c5eef409d2ba61fb0eac9d6e103c02679bd1b4d0385189b6105ceaa9c2f37d01edbf85471d1db564f27410f2a66792e0195bca

Download Submit
C:\Windows\System\cCQnHNc.exe

Filesize
1.3MB

MD5
55f1b6e4631231a1c8a83c608b7c400a

SHA1
c8a4a1b78784eac6d45bfe9ab5884d5f36712e28

SHA256
eb269bc503f59b84d3914ba9f5e68c68aef3577b1cfb0043f8425cc1a977c0bf

SHA512
bdbdf69d22f4ec15349770febb458a5018d21c57ef42f873ba4a02ea2fd4e2e23005ee1e31b9939506f0b409cf120f65da5a526765988989782611681f644959

Download Submit
C:\Windows\System\dNQFQnI.exe

Filesize
1.3MB

MD5
08e109e8d4f7246d8f2cce5eb2cdd5be

SHA1
4b6fb913dc667b01b83c611fc6438f42eb182daa

SHA256
9c8beb5621d4d39b5850ee832b6ccba83654100a0c5dd9ffd2b0813bf47c6842

SHA512
5fdf9d6bcb5cb7ca26bfe71b226681c39753d266a2feb665a54da1eb5108b9321f2692e62b26eee3287b13a33ef6387ca0033eaebfbd6eb6a8506a579cfd9f8a

Download Submit
C:\Windows\System\dtblUea.exe

Filesize
1.3MB

MD5
51c197bd0f11919cfee2139291f3bae8

SHA1
5fcb45bd58622cfc54948c89d9e27ad8a8783781

SHA256
cc36900a0cc1faec0530708a9ef8cf7589ee5ff88b55c971f05f4f1339ebf936

SHA512
a22237461691e518273cef5c7c91a084951c2deee691c7ec482d917bdd078049d6590ce2b0c5b8381ef8ccb09654813cb99bd6da84453d145f3805fffad8c5a5

Download Submit
C:\Windows\System\eSJQIWW.exe

Filesize
1.3MB

MD5
f3ded342fde78e1bd6676dea558f50b4

SHA1
cd47a0fcb5a8971c1faa84ebb123004befe583af

SHA256
6b7aa82d6a6c2bb5b2e4fc312af0a912f179cc1090ebe718edc1504212d1f285

SHA512
66f9f41d09d8a19d57f4fd8654686ec1dca1124333670f3f30d9eb715f3a062f42a42ba3635356ace06c6a76e2886a6d2ef57c97280e7254eb8bb0ddaf2d80fc

Download Submit
C:\Windows\System\ejoAMnh.exe

Filesize
1.3MB

MD5
cc7af016fd40f9cf1a95806af05d9009

SHA1
b7329dc81ff669a0bf026909f09b64cb2247ba51

SHA256
245406ee90f8e1f3e3950fa3c457775bd9475315cc142ec5afc7e31895e376e1

SHA512
d4e1c375a6d2ac4887752a791a94f9e1268295cfbe755f8938b91f4ac9d936fc8b3a64fdedaab77b5e054c82b45d03c8b114fd99addc7d41ae0188d904337104

Download Submit
C:\Windows\System\fKKnjvv.exe

Filesize
1.3MB

MD5
783d84786e04d4b85f1c110c4ba23e7c

SHA1
4d3a1e410fc1cbb4d95d4d9c93fa6ae299a7190d

SHA256
f2c4365195cc0c99219fe36083934cd42286139b1088a4db1ffd4391f37a2c95

SHA512
daf31fff590ef0be6a54d4cb9edf1a5948e44234c4566caef51f06e3935f4a75f6c8e399c2d0ccaf9aac68565a976c99420360648b6d47280b19eb87474c8955

Download Submit
C:\Windows\System\fZTbYfM.exe

Filesize
1.3MB

MD5
18eb838ee490b2aa2a12cc93649e912a

SHA1
4fd81d30e47537f65ffa25f43ba7b5cd14b7e0ae

SHA256
17f1794bc99703a358b8601b8122775cceea3c66e8b885c411789a3c3eecd410

SHA512
bcf7635e058833efe6d8a023f4fe9b4e8911d439d318146c081718fddfe85fadaa21ce8a4891d652396b7e0330ae7fc624f23e3834c08668af7dee6fb91d7573

Download Submit
C:\Windows\System\fjNLNKw.exe

Filesize
1.3MB

MD5
7ab640a6280cb037e642ddf721de8063

SHA1
7b0d3a4edf512867d16d139abaed3a3e8f8b8249

SHA256
c7874ae6da9bca363a0fa3815691fabc39a01f55d4c89efa29b264ce5794ac64

SHA512
f458484dfe07507c903f0a094ba01686cc5b07ab7a48faa7faa88f3876d70e17141673d3d220787abac4dfa725b97f0c25e0005540a0361c7abc0066aa02f777

Download Submit
C:\Windows\System\fuVhnrs.exe

Filesize
1.3MB

MD5
c96a1c3ad576d39cc10f27f68919829c

SHA1
84804fff87035c01927daf3bba0bfe2cefbb55a6

SHA256
fb8c32f8e3f7c160a0c7d693c01e832087809e99c4dd8e54cdf4822dcfd5f26f

SHA512
9a2b5ba1001a0453ef244cffc53b65c27fa4e0622d3e9bdf685c52c1def458f6f0760ff7748eeb9746efefdec477a55de369d8cef360ef475ed6556c2a3e8c25

Download Submit
C:\Windows\System\gIFLfbW.exe

Filesize
1.3MB

MD5
055ce38290831cb9ec66ab5ce556f665

SHA1
c4c779b96ff526e32a1a61047b1e6e89b5755fb6

SHA256
8fd855f9d8e0fb595362ab134490c4f70432e02ece1a95a324342b919e5654be

SHA512
f9c098037584b1880dfb6d3337aa2597bd89a7230807d25a10b7451b1a620b801fd9abce423f7bab1b424629d5a7231c504727806f814531e5fde1062540522b

Download Submit
C:\Windows\System\qxpWekC.exe

Filesize
1.3MB

MD5
4d3f95f3ca8ab4fbadfa7ffe9b1a15ec

SHA1
87e9a9fdf3097f35c87d7a1ad9566b7434c2b259

SHA256
0a3dcf096316bea5a808594f953d8a89cf28a5c465bf0f2de665480d4a4866cd

SHA512
2e51a0e14d3d89935ff938b818f58cfe8cc705adb3e1c8882e14b4a66bc6ca32978d480fe24402ac88d7f541fbc0144e12d06657c6d410ca6fad6016a4b37b78

Download Submit
C:\Windows\System\tOtEGeu.exe

Filesize
1.3MB

MD5
cf435e3a41f119f27b1714769db03793

SHA1
c6faadee4b73b64489c936ee22c4285d2a310325

SHA256
e0d625e0917d7d2fa801a66ba95cf8ae7d53180aa23d932f5c009ab46b326781

SHA512
f5b0c136dc3bdb3ef8793ac88505266d6ee0e9c3f605bb8bf59a0de26e3ba54182b5c3b0ebd75a78e44d8efacc0dc7d6e80501c26ab8a7f6e99ce8fd78ffd5f8

Download Submit
C:\Windows\System\ukSMZJt.exe

Filesize
1.3MB

MD5
c94dabb6886aedadf241178776d15df0

SHA1
4767645caff3eaa6af215b207653b940aa277b7e

SHA256
1cf6a3ebedb168ec248f43783ea411f05f4c71f9388a14ef4fdf1e1cde3029fd

SHA512
474ee238e308bf86b592d12ee92323a52aece788cc0a73ae99853b8eba612793887fbca30460b5d0fb00e59e1eb5400ce39d0dde61d889330951d08169559cac

Download Submit
C:\Windows\System\vLXDaRV.exe

Filesize
1.3MB

MD5
7d1c1930e7bbe4d999331fba590f9fa4

SHA1
6f50dcfb08c04b9aca268172fef1103e43e16787

SHA256
af26aabe7c8de73b62f21881015cea60d45d668379282257a10feb05ac96258f

SHA512
c03b235d0a2a923faa49a953c9928df864de18e966138246efc849ca215c2e8de47e9dfec36c6afc5eb02a70742c4515546162e69fab49b4893563d83b29adbd

Download Submit
C:\Windows\System\wYqlITM.exe

Filesize
1.3MB

MD5
370c87296d857cc0e1fd581e692b006b

SHA1
882c06893815119e4d4eaa5956cfb557e731aecc

SHA256
b04867bc901d5258e924bc33ddf8281dadc1411237168f47c94222f4408b1ccf

SHA512
035eed3c3ac72c43c0dfc3dd6e6945dfdbdec6d799df9afe796d76e0c66306cb2fa9cccdde96c996da30d3e5a9af22d4cc1317e707d00832b70432c37e2e26e4

Download Submit
C:\Windows\System\yRQAFdm.exe

Filesize
1.3MB

MD5
0c49d01aa5337ed8fe524d362977ba22

SHA1
4b4bb76174e1206e1a4138a58c1b4dad1978dce4

SHA256
4846f08d3039fb10761e71ac241d95ced3b90d9cb9013d4524c2dc5727794fac

SHA512
d6d7defe54b8c95a719b5ba7ca7e608827fc8cd6c47d2bc52f761bc0ce99e9c494a6f8fa313a170c49067a9989789daea73cc1f7bb6c49d644f9ba502ea62e6e

Download Submit
C:\Windows\System\yjFjcYh.exe

Filesize
1.3MB

MD5
46a8abde67a2c1fa1305d4d1c065466f

SHA1
c80f60da941ca8dab5768cb56ae5799db201f62b

SHA256
e282c6defaf0ae4401213e83030915d9d9c2211ccae7ee74b8d90a41c3a117b7

SHA512
ab7193446e4989b692d91fa7d645f03c1d36272f376bc1c5493e4d64ba542dfe3f65f33509814fe6af6924d2a0afde77fd99740b9230c707b432215c7fae7e42

Download Submit
C:\Windows\System\yqxkeNP.exe

Filesize
1.3MB

MD5
1051f1a0a1b49ec4b6275c7891182f83

SHA1
bbafa9727d86d7a012c4214d59b26c1499884ed3

SHA256
7cba90c1dd72a3c3fb859dc059767b5c973e10a671d04beb2f298442bfac72a6

SHA512
5d093038f090fb9113ecfe6350e543369898c7381f470650db12f71ec1ce3b1aaf2cb4bb47639fb60bcd5a36d34f79ba595b43298e5db689346b3a10b6e2ed1b

Download Submit
memory/1016-0-0x000001D6A73E0000-0x000001D6A73F0000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads