xmrig | 82d343cc8684150a55a5adf912c5f721faeef233cec1f2b8ea07e2d9e123fdbf

Analysis

max time kernel
137s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
25-12-2024 00:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

82d343cc8684150a55a5adf912c5f721faeef233cec1f2b8ea07e2d9e123fdbf.exe
Size

1.4MB
MD5

f5934d086b583c568d7e5e7af956fc7a
SHA1

6e2b4b67ad082d80e80217a8a3c7d27998437eec
SHA256

82d343cc8684150a55a5adf912c5f721faeef233cec1f2b8ea07e2d9e123fdbf
SHA512

cf88ebf9a7f3391b7213ac376b36880921452e4ffc900632200e5ba2903ff252d55314c5ceb034511c1a1d5a751e7c2e1b86505d59643197665899f3ba1ca429
SSDEEP

24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbpwlKenszaDw4BnTLkpLYvHGSx2v:GezaTF8FcNkNdfE0pZ9ozttwIRakGn3i

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 32 IoCs

miner

resource	yara_rule
behavioral2/files/0x000c000000023c16-4.dat	xmrig
behavioral2/files/0x0008000000023c61-7.dat	xmrig
behavioral2/files/0x0008000000023c60-9.dat	xmrig
behavioral2/files/0x0008000000023c62-19.dat	xmrig
behavioral2/files/0x0008000000023c63-24.dat	xmrig
behavioral2/files/0x0008000000023c64-35.dat	xmrig
behavioral2/files/0x0008000000023c65-37.dat	xmrig
behavioral2/files/0x0008000000023c66-43.dat	xmrig
behavioral2/files/0x0008000000023c67-50.dat	xmrig
behavioral2/files/0x0009000000023c4f-32.dat	xmrig
behavioral2/files/0x0008000000023c68-54.dat	xmrig
behavioral2/files/0x0008000000023c69-57.dat	xmrig
behavioral2/files/0x0007000000023c72-61.dat	xmrig
behavioral2/files/0x0007000000023c73-69.dat	xmrig
behavioral2/files/0x0007000000023c75-72.dat	xmrig
behavioral2/files/0x0007000000023c76-79.dat	xmrig
behavioral2/files/0x0007000000023c77-83.dat	xmrig
behavioral2/files/0x0007000000023c78-89.dat	xmrig
behavioral2/files/0x0007000000023c79-95.dat	xmrig
behavioral2/files/0x0007000000023c7a-99.dat	xmrig
behavioral2/files/0x0007000000023c7b-105.dat	xmrig
behavioral2/files/0x0007000000023c7c-109.dat	xmrig
behavioral2/files/0x0007000000023c7d-113.dat	xmrig
behavioral2/files/0x0007000000023c7e-116.dat	xmrig
behavioral2/files/0x0007000000023c7f-123.dat	xmrig
behavioral2/files/0x0007000000023c80-129.dat	xmrig
behavioral2/files/0x0007000000023c81-134.dat	xmrig
behavioral2/files/0x0007000000023c82-138.dat	xmrig
behavioral2/files/0x0007000000023c83-143.dat	xmrig
behavioral2/files/0x0007000000023c84-152.dat	xmrig
behavioral2/files/0x0007000000023c85-153.dat	xmrig
behavioral2/files/0x0007000000023c86-160.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
4372	XyEBgiD.exe
3508	JEaHDYl.exe
4832	hsKjPmz.exe
3184	rTEdkyf.exe
2180	kCMihgK.exe
3944	oARGCMt.exe
616	fxziYvg.exe
1856	OrpJQJk.exe
3080	fyVwXeH.exe
1800	wVFgMKk.exe
1844	MtiMoSF.exe
2096	weoGjRd.exe
2192	jbDOhBB.exe
3228	LlYhMIj.exe
2476	RoCGLOL.exe
3636	oPrIfEy.exe
1592	SAHLAvf.exe
2844	zZjvYEM.exe
4656	YaHCpka.exe
4996	PpNYmrR.exe
400	FSmhlkr.exe
4752	SySGsTM.exe
4336	sdocUJZ.exe
2700	EMqFikc.exe
536	pwKCFED.exe
2116	UWWGwjm.exe
1196	heIIygm.exe
408	FeeNyos.exe
1768	ufeZKQt.exe
3044	QXKXQFZ.exe
4788	rZxOfNC.exe
1552	huVxejE.exe
3244	ANgCdZu.exe
4920	YJPTbcG.exe
1576	ogTKrFT.exe
2004	NnsrJKS.exe
1384	vpQPhEY.exe
3840	dtoDHYV.exe
4792	VGXNhyV.exe
1156	TVJtALW.exe
2704	HAhEKTq.exe
3744	QoagLsi.exe
4356	LLHVxKn.exe
4328	wkhIMkE.exe
2776	BFpKdTA.exe
744	mqjvJUJ.exe
2136	FFkuDiG.exe
3832	MwIYeAD.exe
3028	AebxKVN.exe
2832	oUDHbvc.exe
2028	VpJuFcd.exe
3848	joPAGrx.exe
2972	WhpkUpM.exe
4064	kpxxydz.exe
4124	PHxvXpP.exe
4732	wMiKqVV.exe
4532	sYVwLNY.exe
2992	NsBDofG.exe
4948	wLQyVkt.exe
4352	UziyYiO.exe
4980	WEAhRsa.exe
2504	EvlRbap.exe
2052	IHEhqUE.exe
4368	ezSzbzM.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\NFGPhpb.exe	82d343cc8684150a55a5adf912c5f721faeef233cec1f2b8ea07e2d9e123fdbf.exe
File created	C:\Windows\System\ASdWHOf.exe	82d343cc8684150a55a5adf912c5f721faeef233cec1f2b8ea07e2d9e123fdbf.exe
File created	C:\Windows\System\QXNhHKZ.exe	82d343cc8684150a55a5adf912c5f721faeef233cec1f2b8ea07e2d9e123fdbf.exe
File created	C:\Windows\System\rlywOiZ.exe	82d343cc8684150a55a5adf912c5f721faeef233cec1f2b8ea07e2d9e123fdbf.exe
File created	C:\Windows\System\gzJqlow.exe	82d343cc8684150a55a5adf912c5f721faeef233cec1f2b8ea07e2d9e123fdbf.exe
File created	C:\Windows\System\QoagLsi.exe	82d343cc8684150a55a5adf912c5f721faeef233cec1f2b8ea07e2d9e123fdbf.exe
File created	C:\Windows\System\POTaqlE.exe	82d343cc8684150a55a5adf912c5f721faeef233cec1f2b8ea07e2d9e123fdbf.exe
File created	C:\Windows\System\asqtbXt.exe	82d343cc8684150a55a5adf912c5f721faeef233cec1f2b8ea07e2d9e123fdbf.exe
File created	C:\Windows\System\yuiJMUU.exe	82d343cc8684150a55a5adf912c5f721faeef233cec1f2b8ea07e2d9e123fdbf.exe
File created	C:\Windows\System\hixROIF.exe	82d343cc8684150a55a5adf912c5f721faeef233cec1f2b8ea07e2d9e123fdbf.exe
File created	C:\Windows\System\nHcuFXo.exe	82d343cc8684150a55a5adf912c5f721faeef233cec1f2b8ea07e2d9e123fdbf.exe
File created	C:\Windows\System\oLvWBFN.exe	82d343cc8684150a55a5adf912c5f721faeef233cec1f2b8ea07e2d9e123fdbf.exe
File created	C:\Windows\System\ntpjgwb.exe	82d343cc8684150a55a5adf912c5f721faeef233cec1f2b8ea07e2d9e123fdbf.exe
File created	C:\Windows\System\zLAYPTU.exe	82d343cc8684150a55a5adf912c5f721faeef233cec1f2b8ea07e2d9e123fdbf.exe
File created	C:\Windows\System\yWHaYPG.exe	82d343cc8684150a55a5adf912c5f721faeef233cec1f2b8ea07e2d9e123fdbf.exe
File created	C:\Windows\System\rniyhNP.exe	82d343cc8684150a55a5adf912c5f721faeef233cec1f2b8ea07e2d9e123fdbf.exe
File created	C:\Windows\System\VzjZCFP.exe	82d343cc8684150a55a5adf912c5f721faeef233cec1f2b8ea07e2d9e123fdbf.exe
File created	C:\Windows\System\jPDQuwe.exe	82d343cc8684150a55a5adf912c5f721faeef233cec1f2b8ea07e2d9e123fdbf.exe
File created	C:\Windows\System\oKuOUNa.exe	82d343cc8684150a55a5adf912c5f721faeef233cec1f2b8ea07e2d9e123fdbf.exe
File created	C:\Windows\System\hPrcfZl.exe	82d343cc8684150a55a5adf912c5f721faeef233cec1f2b8ea07e2d9e123fdbf.exe
File created	C:\Windows\System\KUSUFDu.exe	82d343cc8684150a55a5adf912c5f721faeef233cec1f2b8ea07e2d9e123fdbf.exe
File created	C:\Windows\System\CVLbxEr.exe	82d343cc8684150a55a5adf912c5f721faeef233cec1f2b8ea07e2d9e123fdbf.exe
File created	C:\Windows\System\EmRVtBd.exe	82d343cc8684150a55a5adf912c5f721faeef233cec1f2b8ea07e2d9e123fdbf.exe
File created	C:\Windows\System\cJinTRW.exe	82d343cc8684150a55a5adf912c5f721faeef233cec1f2b8ea07e2d9e123fdbf.exe
File created	C:\Windows\System\ecVNLqd.exe	82d343cc8684150a55a5adf912c5f721faeef233cec1f2b8ea07e2d9e123fdbf.exe
File created	C:\Windows\System\tmLpekl.exe	82d343cc8684150a55a5adf912c5f721faeef233cec1f2b8ea07e2d9e123fdbf.exe
File created	C:\Windows\System\XyEBgiD.exe	82d343cc8684150a55a5adf912c5f721faeef233cec1f2b8ea07e2d9e123fdbf.exe
File created	C:\Windows\System\zqJpzfR.exe	82d343cc8684150a55a5adf912c5f721faeef233cec1f2b8ea07e2d9e123fdbf.exe
File created	C:\Windows\System\LjhNCJp.exe	82d343cc8684150a55a5adf912c5f721faeef233cec1f2b8ea07e2d9e123fdbf.exe
File created	C:\Windows\System\mdPdBHr.exe	82d343cc8684150a55a5adf912c5f721faeef233cec1f2b8ea07e2d9e123fdbf.exe
File created	C:\Windows\System\nPshYtg.exe	82d343cc8684150a55a5adf912c5f721faeef233cec1f2b8ea07e2d9e123fdbf.exe
File created	C:\Windows\System\QThpHEl.exe	82d343cc8684150a55a5adf912c5f721faeef233cec1f2b8ea07e2d9e123fdbf.exe
File created	C:\Windows\System\FsPLddW.exe	82d343cc8684150a55a5adf912c5f721faeef233cec1f2b8ea07e2d9e123fdbf.exe
File created	C:\Windows\System\ANvpaBe.exe	82d343cc8684150a55a5adf912c5f721faeef233cec1f2b8ea07e2d9e123fdbf.exe
File created	C:\Windows\System\cXIMMvv.exe	82d343cc8684150a55a5adf912c5f721faeef233cec1f2b8ea07e2d9e123fdbf.exe
File created	C:\Windows\System\EvlRbap.exe	82d343cc8684150a55a5adf912c5f721faeef233cec1f2b8ea07e2d9e123fdbf.exe
File created	C:\Windows\System\JNYEYNt.exe	82d343cc8684150a55a5adf912c5f721faeef233cec1f2b8ea07e2d9e123fdbf.exe
File created	C:\Windows\System\aXrzJTe.exe	82d343cc8684150a55a5adf912c5f721faeef233cec1f2b8ea07e2d9e123fdbf.exe
File created	C:\Windows\System\dsVEGwQ.exe	82d343cc8684150a55a5adf912c5f721faeef233cec1f2b8ea07e2d9e123fdbf.exe
File created	C:\Windows\System\ZjRrhuQ.exe	82d343cc8684150a55a5adf912c5f721faeef233cec1f2b8ea07e2d9e123fdbf.exe
File created	C:\Windows\System\fbJuRNd.exe	82d343cc8684150a55a5adf912c5f721faeef233cec1f2b8ea07e2d9e123fdbf.exe
File created	C:\Windows\System\HkTrQsa.exe	82d343cc8684150a55a5adf912c5f721faeef233cec1f2b8ea07e2d9e123fdbf.exe
File created	C:\Windows\System\bDEHQKw.exe	82d343cc8684150a55a5adf912c5f721faeef233cec1f2b8ea07e2d9e123fdbf.exe
File created	C:\Windows\System\LAGWcPu.exe	82d343cc8684150a55a5adf912c5f721faeef233cec1f2b8ea07e2d9e123fdbf.exe
File created	C:\Windows\System\JPsMBoJ.exe	82d343cc8684150a55a5adf912c5f721faeef233cec1f2b8ea07e2d9e123fdbf.exe
File created	C:\Windows\System\PnaAusG.exe	82d343cc8684150a55a5adf912c5f721faeef233cec1f2b8ea07e2d9e123fdbf.exe
File created	C:\Windows\System\LaVISjZ.exe	82d343cc8684150a55a5adf912c5f721faeef233cec1f2b8ea07e2d9e123fdbf.exe
File created	C:\Windows\System\oCygCqp.exe	82d343cc8684150a55a5adf912c5f721faeef233cec1f2b8ea07e2d9e123fdbf.exe
File created	C:\Windows\System\OSVEgGT.exe	82d343cc8684150a55a5adf912c5f721faeef233cec1f2b8ea07e2d9e123fdbf.exe
File created	C:\Windows\System\lJIDvGg.exe	82d343cc8684150a55a5adf912c5f721faeef233cec1f2b8ea07e2d9e123fdbf.exe
File created	C:\Windows\System\ZOFkscz.exe	82d343cc8684150a55a5adf912c5f721faeef233cec1f2b8ea07e2d9e123fdbf.exe
File created	C:\Windows\System\thcZNqw.exe	82d343cc8684150a55a5adf912c5f721faeef233cec1f2b8ea07e2d9e123fdbf.exe
File created	C:\Windows\System\QXKXQFZ.exe	82d343cc8684150a55a5adf912c5f721faeef233cec1f2b8ea07e2d9e123fdbf.exe
File created	C:\Windows\System\joPAGrx.exe	82d343cc8684150a55a5adf912c5f721faeef233cec1f2b8ea07e2d9e123fdbf.exe
File created	C:\Windows\System\jdUpNpD.exe	82d343cc8684150a55a5adf912c5f721faeef233cec1f2b8ea07e2d9e123fdbf.exe
File created	C:\Windows\System\JnhsOae.exe	82d343cc8684150a55a5adf912c5f721faeef233cec1f2b8ea07e2d9e123fdbf.exe
File created	C:\Windows\System\EKRMTNP.exe	82d343cc8684150a55a5adf912c5f721faeef233cec1f2b8ea07e2d9e123fdbf.exe
File created	C:\Windows\System\BCoQuOt.exe	82d343cc8684150a55a5adf912c5f721faeef233cec1f2b8ea07e2d9e123fdbf.exe
File created	C:\Windows\System\xaKVqhj.exe	82d343cc8684150a55a5adf912c5f721faeef233cec1f2b8ea07e2d9e123fdbf.exe
File created	C:\Windows\System\yYWqbBo.exe	82d343cc8684150a55a5adf912c5f721faeef233cec1f2b8ea07e2d9e123fdbf.exe
File created	C:\Windows\System\XYYUpws.exe	82d343cc8684150a55a5adf912c5f721faeef233cec1f2b8ea07e2d9e123fdbf.exe
File created	C:\Windows\System\JNvWuQy.exe	82d343cc8684150a55a5adf912c5f721faeef233cec1f2b8ea07e2d9e123fdbf.exe
File created	C:\Windows\System\szfeVFz.exe	82d343cc8684150a55a5adf912c5f721faeef233cec1f2b8ea07e2d9e123fdbf.exe
File created	C:\Windows\System\XIUbYeL.exe	82d343cc8684150a55a5adf912c5f721faeef233cec1f2b8ea07e2d9e123fdbf.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	15848	dwm.exe
Token: SeChangeNotifyPrivilege	15848	dwm.exe
Token: 33	15848	dwm.exe
Token: SeIncBasePriorityPrivilege	15848	dwm.exe
Token: SeShutdownPrivilege	15848	dwm.exe
Token: SeCreatePagefilePrivilege	15848	dwm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1388 wrote to memory of 4372	1388	82d343cc8684150a55a5adf912c5f721faeef233cec1f2b8ea07e2d9e123fdbf.exe	84
PID 1388 wrote to memory of 4372	1388	82d343cc8684150a55a5adf912c5f721faeef233cec1f2b8ea07e2d9e123fdbf.exe	84
PID 1388 wrote to memory of 3508	1388	82d343cc8684150a55a5adf912c5f721faeef233cec1f2b8ea07e2d9e123fdbf.exe	85
PID 1388 wrote to memory of 3508	1388	82d343cc8684150a55a5adf912c5f721faeef233cec1f2b8ea07e2d9e123fdbf.exe	85
PID 1388 wrote to memory of 4832	1388	82d343cc8684150a55a5adf912c5f721faeef233cec1f2b8ea07e2d9e123fdbf.exe	86
PID 1388 wrote to memory of 4832	1388	82d343cc8684150a55a5adf912c5f721faeef233cec1f2b8ea07e2d9e123fdbf.exe	86
PID 1388 wrote to memory of 3184	1388	82d343cc8684150a55a5adf912c5f721faeef233cec1f2b8ea07e2d9e123fdbf.exe	87
PID 1388 wrote to memory of 3184	1388	82d343cc8684150a55a5adf912c5f721faeef233cec1f2b8ea07e2d9e123fdbf.exe	87
PID 1388 wrote to memory of 2180	1388	82d343cc8684150a55a5adf912c5f721faeef233cec1f2b8ea07e2d9e123fdbf.exe	88
PID 1388 wrote to memory of 2180	1388	82d343cc8684150a55a5adf912c5f721faeef233cec1f2b8ea07e2d9e123fdbf.exe	88
PID 1388 wrote to memory of 3944	1388	82d343cc8684150a55a5adf912c5f721faeef233cec1f2b8ea07e2d9e123fdbf.exe	89
PID 1388 wrote to memory of 3944	1388	82d343cc8684150a55a5adf912c5f721faeef233cec1f2b8ea07e2d9e123fdbf.exe	89
PID 1388 wrote to memory of 616	1388	82d343cc8684150a55a5adf912c5f721faeef233cec1f2b8ea07e2d9e123fdbf.exe	90
PID 1388 wrote to memory of 616	1388	82d343cc8684150a55a5adf912c5f721faeef233cec1f2b8ea07e2d9e123fdbf.exe	90
PID 1388 wrote to memory of 1856	1388	82d343cc8684150a55a5adf912c5f721faeef233cec1f2b8ea07e2d9e123fdbf.exe	91
PID 1388 wrote to memory of 1856	1388	82d343cc8684150a55a5adf912c5f721faeef233cec1f2b8ea07e2d9e123fdbf.exe	91
PID 1388 wrote to memory of 3080	1388	82d343cc8684150a55a5adf912c5f721faeef233cec1f2b8ea07e2d9e123fdbf.exe	92
PID 1388 wrote to memory of 3080	1388	82d343cc8684150a55a5adf912c5f721faeef233cec1f2b8ea07e2d9e123fdbf.exe	92
PID 1388 wrote to memory of 1800	1388	82d343cc8684150a55a5adf912c5f721faeef233cec1f2b8ea07e2d9e123fdbf.exe	93
PID 1388 wrote to memory of 1800	1388	82d343cc8684150a55a5adf912c5f721faeef233cec1f2b8ea07e2d9e123fdbf.exe	93
PID 1388 wrote to memory of 1844	1388	82d343cc8684150a55a5adf912c5f721faeef233cec1f2b8ea07e2d9e123fdbf.exe	94
PID 1388 wrote to memory of 1844	1388	82d343cc8684150a55a5adf912c5f721faeef233cec1f2b8ea07e2d9e123fdbf.exe	94
PID 1388 wrote to memory of 2096	1388	82d343cc8684150a55a5adf912c5f721faeef233cec1f2b8ea07e2d9e123fdbf.exe	95
PID 1388 wrote to memory of 2096	1388	82d343cc8684150a55a5adf912c5f721faeef233cec1f2b8ea07e2d9e123fdbf.exe	95
PID 1388 wrote to memory of 2192	1388	82d343cc8684150a55a5adf912c5f721faeef233cec1f2b8ea07e2d9e123fdbf.exe	96
PID 1388 wrote to memory of 2192	1388	82d343cc8684150a55a5adf912c5f721faeef233cec1f2b8ea07e2d9e123fdbf.exe	96
PID 1388 wrote to memory of 3228	1388	82d343cc8684150a55a5adf912c5f721faeef233cec1f2b8ea07e2d9e123fdbf.exe	97
PID 1388 wrote to memory of 3228	1388	82d343cc8684150a55a5adf912c5f721faeef233cec1f2b8ea07e2d9e123fdbf.exe	97
PID 1388 wrote to memory of 2476	1388	82d343cc8684150a55a5adf912c5f721faeef233cec1f2b8ea07e2d9e123fdbf.exe	98
PID 1388 wrote to memory of 2476	1388	82d343cc8684150a55a5adf912c5f721faeef233cec1f2b8ea07e2d9e123fdbf.exe	98
PID 1388 wrote to memory of 3636	1388	82d343cc8684150a55a5adf912c5f721faeef233cec1f2b8ea07e2d9e123fdbf.exe	99
PID 1388 wrote to memory of 3636	1388	82d343cc8684150a55a5adf912c5f721faeef233cec1f2b8ea07e2d9e123fdbf.exe	99
PID 1388 wrote to memory of 1592	1388	82d343cc8684150a55a5adf912c5f721faeef233cec1f2b8ea07e2d9e123fdbf.exe	100
PID 1388 wrote to memory of 1592	1388	82d343cc8684150a55a5adf912c5f721faeef233cec1f2b8ea07e2d9e123fdbf.exe	100
PID 1388 wrote to memory of 2844	1388	82d343cc8684150a55a5adf912c5f721faeef233cec1f2b8ea07e2d9e123fdbf.exe	101
PID 1388 wrote to memory of 2844	1388	82d343cc8684150a55a5adf912c5f721faeef233cec1f2b8ea07e2d9e123fdbf.exe	101
PID 1388 wrote to memory of 4656	1388	82d343cc8684150a55a5adf912c5f721faeef233cec1f2b8ea07e2d9e123fdbf.exe	102
PID 1388 wrote to memory of 4656	1388	82d343cc8684150a55a5adf912c5f721faeef233cec1f2b8ea07e2d9e123fdbf.exe	102
PID 1388 wrote to memory of 4996	1388	82d343cc8684150a55a5adf912c5f721faeef233cec1f2b8ea07e2d9e123fdbf.exe	103
PID 1388 wrote to memory of 4996	1388	82d343cc8684150a55a5adf912c5f721faeef233cec1f2b8ea07e2d9e123fdbf.exe	103
PID 1388 wrote to memory of 400	1388	82d343cc8684150a55a5adf912c5f721faeef233cec1f2b8ea07e2d9e123fdbf.exe	104
PID 1388 wrote to memory of 400	1388	82d343cc8684150a55a5adf912c5f721faeef233cec1f2b8ea07e2d9e123fdbf.exe	104
PID 1388 wrote to memory of 4752	1388	82d343cc8684150a55a5adf912c5f721faeef233cec1f2b8ea07e2d9e123fdbf.exe	105
PID 1388 wrote to memory of 4752	1388	82d343cc8684150a55a5adf912c5f721faeef233cec1f2b8ea07e2d9e123fdbf.exe	105
PID 1388 wrote to memory of 4336	1388	82d343cc8684150a55a5adf912c5f721faeef233cec1f2b8ea07e2d9e123fdbf.exe	106
PID 1388 wrote to memory of 4336	1388	82d343cc8684150a55a5adf912c5f721faeef233cec1f2b8ea07e2d9e123fdbf.exe	106
PID 1388 wrote to memory of 2700	1388	82d343cc8684150a55a5adf912c5f721faeef233cec1f2b8ea07e2d9e123fdbf.exe	107
PID 1388 wrote to memory of 2700	1388	82d343cc8684150a55a5adf912c5f721faeef233cec1f2b8ea07e2d9e123fdbf.exe	107
PID 1388 wrote to memory of 536	1388	82d343cc8684150a55a5adf912c5f721faeef233cec1f2b8ea07e2d9e123fdbf.exe	108
PID 1388 wrote to memory of 536	1388	82d343cc8684150a55a5adf912c5f721faeef233cec1f2b8ea07e2d9e123fdbf.exe	108
PID 1388 wrote to memory of 2116	1388	82d343cc8684150a55a5adf912c5f721faeef233cec1f2b8ea07e2d9e123fdbf.exe	109
PID 1388 wrote to memory of 2116	1388	82d343cc8684150a55a5adf912c5f721faeef233cec1f2b8ea07e2d9e123fdbf.exe	109
PID 1388 wrote to memory of 1196	1388	82d343cc8684150a55a5adf912c5f721faeef233cec1f2b8ea07e2d9e123fdbf.exe	110
PID 1388 wrote to memory of 1196	1388	82d343cc8684150a55a5adf912c5f721faeef233cec1f2b8ea07e2d9e123fdbf.exe	110
PID 1388 wrote to memory of 408	1388	82d343cc8684150a55a5adf912c5f721faeef233cec1f2b8ea07e2d9e123fdbf.exe	111
PID 1388 wrote to memory of 408	1388	82d343cc8684150a55a5adf912c5f721faeef233cec1f2b8ea07e2d9e123fdbf.exe	111
PID 1388 wrote to memory of 1768	1388	82d343cc8684150a55a5adf912c5f721faeef233cec1f2b8ea07e2d9e123fdbf.exe	112
PID 1388 wrote to memory of 1768	1388	82d343cc8684150a55a5adf912c5f721faeef233cec1f2b8ea07e2d9e123fdbf.exe	112
PID 1388 wrote to memory of 4788	1388	82d343cc8684150a55a5adf912c5f721faeef233cec1f2b8ea07e2d9e123fdbf.exe	113
PID 1388 wrote to memory of 4788	1388	82d343cc8684150a55a5adf912c5f721faeef233cec1f2b8ea07e2d9e123fdbf.exe	113
PID 1388 wrote to memory of 3044	1388	82d343cc8684150a55a5adf912c5f721faeef233cec1f2b8ea07e2d9e123fdbf.exe	114
PID 1388 wrote to memory of 3044	1388	82d343cc8684150a55a5adf912c5f721faeef233cec1f2b8ea07e2d9e123fdbf.exe	114
PID 1388 wrote to memory of 1552	1388	82d343cc8684150a55a5adf912c5f721faeef233cec1f2b8ea07e2d9e123fdbf.exe	115
PID 1388 wrote to memory of 1552	1388	82d343cc8684150a55a5adf912c5f721faeef233cec1f2b8ea07e2d9e123fdbf.exe	115

C:\Users\Admin\AppData\Local\Temp\82d343cc8684150a55a5adf912c5f721faeef233cec1f2b8ea07e2d9e123fdbf.exe
"C:\Users\Admin\AppData\Local\Temp\82d343cc8684150a55a5adf912c5f721faeef233cec1f2b8ea07e2d9e123fdbf.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1388
- C:\Windows\System\XyEBgiD.exe
  C:\Windows\System\XyEBgiD.exe
  2⤵
  - Executes dropped EXE
  PID:4372
- C:\Windows\System\JEaHDYl.exe
  C:\Windows\System\JEaHDYl.exe
  2⤵
  - Executes dropped EXE
  PID:3508
- C:\Windows\System\hsKjPmz.exe
  C:\Windows\System\hsKjPmz.exe
  2⤵
  - Executes dropped EXE
  PID:4832
- C:\Windows\System\rTEdkyf.exe
  C:\Windows\System\rTEdkyf.exe
  2⤵
  - Executes dropped EXE
  PID:3184
- C:\Windows\System\kCMihgK.exe
  C:\Windows\System\kCMihgK.exe
  2⤵
  - Executes dropped EXE
  PID:2180
- C:\Windows\System\oARGCMt.exe
  C:\Windows\System\oARGCMt.exe
  2⤵
  - Executes dropped EXE
  PID:3944
- C:\Windows\System\fxziYvg.exe
  C:\Windows\System\fxziYvg.exe
  2⤵
  - Executes dropped EXE
  PID:616
- C:\Windows\System\OrpJQJk.exe
  C:\Windows\System\OrpJQJk.exe
  2⤵
  - Executes dropped EXE
  PID:1856
- C:\Windows\System\fyVwXeH.exe
  C:\Windows\System\fyVwXeH.exe
  2⤵
  - Executes dropped EXE
  PID:3080
- C:\Windows\System\wVFgMKk.exe
  C:\Windows\System\wVFgMKk.exe
  2⤵
  - Executes dropped EXE
  PID:1800
- C:\Windows\System\MtiMoSF.exe
  C:\Windows\System\MtiMoSF.exe
  2⤵
  - Executes dropped EXE
  PID:1844
- C:\Windows\System\weoGjRd.exe
  C:\Windows\System\weoGjRd.exe
  2⤵
  - Executes dropped EXE
  PID:2096
- C:\Windows\System\jbDOhBB.exe
  C:\Windows\System\jbDOhBB.exe
  2⤵
  - Executes dropped EXE
  PID:2192
- C:\Windows\System\LlYhMIj.exe
  C:\Windows\System\LlYhMIj.exe
  2⤵
  - Executes dropped EXE
  PID:3228
- C:\Windows\System\RoCGLOL.exe
  C:\Windows\System\RoCGLOL.exe
  2⤵
  - Executes dropped EXE
  PID:2476
- C:\Windows\System\oPrIfEy.exe
  C:\Windows\System\oPrIfEy.exe
  2⤵
  - Executes dropped EXE
  PID:3636
- C:\Windows\System\SAHLAvf.exe
  C:\Windows\System\SAHLAvf.exe
  2⤵
  - Executes dropped EXE
  PID:1592
- C:\Windows\System\zZjvYEM.exe
  C:\Windows\System\zZjvYEM.exe
  2⤵
  - Executes dropped EXE
  PID:2844
- C:\Windows\System\YaHCpka.exe
  C:\Windows\System\YaHCpka.exe
  2⤵
  - Executes dropped EXE
  PID:4656
- C:\Windows\System\PpNYmrR.exe
  C:\Windows\System\PpNYmrR.exe
  2⤵
  - Executes dropped EXE
  PID:4996
- C:\Windows\System\FSmhlkr.exe
  C:\Windows\System\FSmhlkr.exe
  2⤵
  - Executes dropped EXE
  PID:400
- C:\Windows\System\SySGsTM.exe
  C:\Windows\System\SySGsTM.exe
  2⤵
  - Executes dropped EXE
  PID:4752
- C:\Windows\System\sdocUJZ.exe
  C:\Windows\System\sdocUJZ.exe
  2⤵
  - Executes dropped EXE
  PID:4336
- C:\Windows\System\EMqFikc.exe
  C:\Windows\System\EMqFikc.exe
  2⤵
  - Executes dropped EXE
  PID:2700
- C:\Windows\System\pwKCFED.exe
  C:\Windows\System\pwKCFED.exe
  2⤵
  - Executes dropped EXE
  PID:536
- C:\Windows\System\UWWGwjm.exe
  C:\Windows\System\UWWGwjm.exe
  2⤵
  - Executes dropped EXE
  PID:2116
- C:\Windows\System\heIIygm.exe
  C:\Windows\System\heIIygm.exe
  2⤵
  - Executes dropped EXE
  PID:1196
- C:\Windows\System\FeeNyos.exe
  C:\Windows\System\FeeNyos.exe
  2⤵
  - Executes dropped EXE
  PID:408
- C:\Windows\System\ufeZKQt.exe
  C:\Windows\System\ufeZKQt.exe
  2⤵
  - Executes dropped EXE
  PID:1768
- C:\Windows\System\rZxOfNC.exe
  C:\Windows\System\rZxOfNC.exe
  2⤵
  - Executes dropped EXE
  PID:4788
- C:\Windows\System\QXKXQFZ.exe
  C:\Windows\System\QXKXQFZ.exe
  2⤵
  - Executes dropped EXE
  PID:3044
- C:\Windows\System\huVxejE.exe
  C:\Windows\System\huVxejE.exe
  2⤵
  - Executes dropped EXE
  PID:1552
- C:\Windows\System\ANgCdZu.exe
  C:\Windows\System\ANgCdZu.exe
  2⤵
  - Executes dropped EXE
  PID:3244
- C:\Windows\System\YJPTbcG.exe
  C:\Windows\System\YJPTbcG.exe
  2⤵
  - Executes dropped EXE
  PID:4920
- C:\Windows\System\ogTKrFT.exe
  C:\Windows\System\ogTKrFT.exe
  2⤵
  - Executes dropped EXE
  PID:1576
- C:\Windows\System\NnsrJKS.exe
  C:\Windows\System\NnsrJKS.exe
  2⤵
  - Executes dropped EXE
  PID:2004
- C:\Windows\System\vpQPhEY.exe
  C:\Windows\System\vpQPhEY.exe
  2⤵
  - Executes dropped EXE
  PID:1384
- C:\Windows\System\dtoDHYV.exe
  C:\Windows\System\dtoDHYV.exe
  2⤵
  - Executes dropped EXE
  PID:3840
- C:\Windows\System\VGXNhyV.exe
  C:\Windows\System\VGXNhyV.exe
  2⤵
  - Executes dropped EXE
  PID:4792
- C:\Windows\System\TVJtALW.exe
  C:\Windows\System\TVJtALW.exe
  2⤵
  - Executes dropped EXE
  PID:1156
- C:\Windows\System\HAhEKTq.exe
  C:\Windows\System\HAhEKTq.exe
  2⤵
  - Executes dropped EXE
  PID:2704
- C:\Windows\System\QoagLsi.exe
  C:\Windows\System\QoagLsi.exe
  2⤵
  - Executes dropped EXE
  PID:3744
- C:\Windows\System\LLHVxKn.exe
  C:\Windows\System\LLHVxKn.exe
  2⤵
  - Executes dropped EXE
  PID:4356
- C:\Windows\System\wkhIMkE.exe
  C:\Windows\System\wkhIMkE.exe
  2⤵
  - Executes dropped EXE
  PID:4328
- C:\Windows\System\BFpKdTA.exe
  C:\Windows\System\BFpKdTA.exe
  2⤵
  - Executes dropped EXE
  PID:2776
- C:\Windows\System\mqjvJUJ.exe
  C:\Windows\System\mqjvJUJ.exe
  2⤵
  - Executes dropped EXE
  PID:744
- C:\Windows\System\FFkuDiG.exe
  C:\Windows\System\FFkuDiG.exe
  2⤵
  - Executes dropped EXE
  PID:2136
- C:\Windows\System\MwIYeAD.exe
  C:\Windows\System\MwIYeAD.exe
  2⤵
  - Executes dropped EXE
  PID:3832
- C:\Windows\System\AebxKVN.exe
  C:\Windows\System\AebxKVN.exe
  2⤵
  - Executes dropped EXE
  PID:3028
- C:\Windows\System\oUDHbvc.exe
  C:\Windows\System\oUDHbvc.exe
  2⤵
  - Executes dropped EXE
  PID:2832
- C:\Windows\System\VpJuFcd.exe
  C:\Windows\System\VpJuFcd.exe
  2⤵
  - Executes dropped EXE
  PID:2028
- C:\Windows\System\joPAGrx.exe
  C:\Windows\System\joPAGrx.exe
  2⤵
  - Executes dropped EXE
  PID:3848
- C:\Windows\System\WhpkUpM.exe
  C:\Windows\System\WhpkUpM.exe
  2⤵
  - Executes dropped EXE
  PID:2972
- C:\Windows\System\kpxxydz.exe
  C:\Windows\System\kpxxydz.exe
  2⤵
  - Executes dropped EXE
  PID:4064
- C:\Windows\System\PHxvXpP.exe
  C:\Windows\System\PHxvXpP.exe
  2⤵
  - Executes dropped EXE
  PID:4124
- C:\Windows\System\wMiKqVV.exe
  C:\Windows\System\wMiKqVV.exe
  2⤵
  - Executes dropped EXE
  PID:4732
- C:\Windows\System\sYVwLNY.exe
  C:\Windows\System\sYVwLNY.exe
  2⤵
  - Executes dropped EXE
  PID:4532
- C:\Windows\System\NsBDofG.exe
  C:\Windows\System\NsBDofG.exe
  2⤵
  - Executes dropped EXE
  PID:2992
- C:\Windows\System\wLQyVkt.exe
  C:\Windows\System\wLQyVkt.exe
  2⤵
  - Executes dropped EXE
  PID:4948
- C:\Windows\System\UziyYiO.exe
  C:\Windows\System\UziyYiO.exe
  2⤵
  - Executes dropped EXE
  PID:4352
- C:\Windows\System\WEAhRsa.exe
  C:\Windows\System\WEAhRsa.exe
  2⤵
  - Executes dropped EXE
  PID:4980
- C:\Windows\System\EvlRbap.exe
  C:\Windows\System\EvlRbap.exe
  2⤵
  - Executes dropped EXE
  PID:2504
- C:\Windows\System\IHEhqUE.exe
  C:\Windows\System\IHEhqUE.exe
  2⤵
  - Executes dropped EXE
  PID:2052
- C:\Windows\System\ezSzbzM.exe
  C:\Windows\System\ezSzbzM.exe
  2⤵
  - Executes dropped EXE
  PID:4368
- C:\Windows\System\PWpLqbS.exe
  C:\Windows\System\PWpLqbS.exe
  2⤵
  PID:4232
- C:\Windows\System\TXRlSHK.exe
  C:\Windows\System\TXRlSHK.exe
  2⤵
  PID:2340
- C:\Windows\System\HBMuikq.exe
  C:\Windows\System\HBMuikq.exe
  2⤵
  PID:3692
- C:\Windows\System\VJSGXFZ.exe
  C:\Windows\System\VJSGXFZ.exe
  2⤵
  PID:2720
- C:\Windows\System\CqbgcLR.exe
  C:\Windows\System\CqbgcLR.exe
  2⤵
  PID:2056
- C:\Windows\System\tLpJUKB.exe
  C:\Windows\System\tLpJUKB.exe
  2⤵
  PID:4604
- C:\Windows\System\McfDcmy.exe
  C:\Windows\System\McfDcmy.exe
  2⤵
  PID:4300
- C:\Windows\System\MugSRGl.exe
  C:\Windows\System\MugSRGl.exe
  2⤵
  PID:3964
- C:\Windows\System\GwMiWRm.exe
  C:\Windows\System\GwMiWRm.exe
  2⤵
  PID:3372
- C:\Windows\System\nigTNZx.exe
  C:\Windows\System\nigTNZx.exe
  2⤵
  PID:5084
- C:\Windows\System\auEGMJH.exe
  C:\Windows\System\auEGMJH.exe
  2⤵
  PID:3052
- C:\Windows\System\BMiDtgE.exe
  C:\Windows\System\BMiDtgE.exe
  2⤵
  PID:4380
- C:\Windows\System\khlPUEu.exe
  C:\Windows\System\khlPUEu.exe
  2⤵
  PID:5104
- C:\Windows\System\dqpYRDS.exe
  C:\Windows\System\dqpYRDS.exe
  2⤵
  PID:776
- C:\Windows\System\obaWOKQ.exe
  C:\Windows\System\obaWOKQ.exe
  2⤵
  PID:232
- C:\Windows\System\ZAsOUAM.exe
  C:\Windows\System\ZAsOUAM.exe
  2⤵
  PID:3284
- C:\Windows\System\pvPjPcP.exe
  C:\Windows\System\pvPjPcP.exe
  2⤵
  PID:4440
- C:\Windows\System\bPDHfLt.exe
  C:\Windows\System\bPDHfLt.exe
  2⤵
  PID:3928
- C:\Windows\System\NJxSuse.exe
  C:\Windows\System\NJxSuse.exe
  2⤵
  PID:1328
- C:\Windows\System\zwEowvH.exe
  C:\Windows\System\zwEowvH.exe
  2⤵
  PID:2228
- C:\Windows\System\csatDOh.exe
  C:\Windows\System\csatDOh.exe
  2⤵
  PID:3924
- C:\Windows\System\KcCcmTd.exe
  C:\Windows\System\KcCcmTd.exe
  2⤵
  PID:364
- C:\Windows\System\NYwlDFS.exe
  C:\Windows\System\NYwlDFS.exe
  2⤵
  PID:4316
- C:\Windows\System\UuXUcpV.exe
  C:\Windows\System\UuXUcpV.exe
  2⤵
  PID:2964
- C:\Windows\System\IqlnWgR.exe
  C:\Windows\System\IqlnWgR.exe
  2⤵
  PID:4116
- C:\Windows\System\tUkJimA.exe
  C:\Windows\System\tUkJimA.exe
  2⤵
  PID:4976
- C:\Windows\System\lDFDzjJ.exe
  C:\Windows\System\lDFDzjJ.exe
  2⤵
  PID:3488
- C:\Windows\System\KbZqfzS.exe
  C:\Windows\System\KbZqfzS.exe
  2⤵
  PID:3464
- C:\Windows\System\hdlwtau.exe
  C:\Windows\System\hdlwtau.exe
  2⤵
  PID:3144
- C:\Windows\System\yVikiJQ.exe
  C:\Windows\System\yVikiJQ.exe
  2⤵
  PID:1364
- C:\Windows\System\OJlIcsA.exe
  C:\Windows\System\OJlIcsA.exe
  2⤵
  PID:1408
- C:\Windows\System\WlnlKZy.exe
  C:\Windows\System\WlnlKZy.exe
  2⤵
  PID:4412
- C:\Windows\System\LAGWcPu.exe
  C:\Windows\System\LAGWcPu.exe
  2⤵
  PID:1112
- C:\Windows\System\rIfUUVy.exe
  C:\Windows\System\rIfUUVy.exe
  2⤵
  PID:4184
- C:\Windows\System\bBnkEdU.exe
  C:\Windows\System\bBnkEdU.exe
  2⤵
  PID:1416
- C:\Windows\System\vZuGwii.exe
  C:\Windows\System\vZuGwii.exe
  2⤵
  PID:4588
- C:\Windows\System\xHqasYv.exe
  C:\Windows\System\xHqasYv.exe
  2⤵
  PID:4020
- C:\Windows\System\qsVhFGm.exe
  C:\Windows\System\qsVhFGm.exe
  2⤵
  PID:5080
- C:\Windows\System\YSNTzcU.exe
  C:\Windows\System\YSNTzcU.exe
  2⤵
  PID:3940
- C:\Windows\System\rEpRTqx.exe
  C:\Windows\System\rEpRTqx.exe
  2⤵
  PID:4100
- C:\Windows\System\sESintF.exe
  C:\Windows\System\sESintF.exe
  2⤵
  PID:2460
- C:\Windows\System\WsxNsao.exe
  C:\Windows\System\WsxNsao.exe
  2⤵
  PID:1420
- C:\Windows\System\YGRtNRV.exe
  C:\Windows\System\YGRtNRV.exe
  2⤵
  PID:5052
- C:\Windows\System\DMyGNJH.exe
  C:\Windows\System\DMyGNJH.exe
  2⤵
  PID:2300
- C:\Windows\System\MMZOOUb.exe
  C:\Windows\System\MMZOOUb.exe
  2⤵
  PID:5148
- C:\Windows\System\vRzqxJw.exe
  C:\Windows\System\vRzqxJw.exe
  2⤵
  PID:5172
- C:\Windows\System\TMEMfeV.exe
  C:\Windows\System\TMEMfeV.exe
  2⤵
  PID:5204
- C:\Windows\System\LzhrrTq.exe
  C:\Windows\System\LzhrrTq.exe
  2⤵
  PID:5244
- C:\Windows\System\ycQQauv.exe
  C:\Windows\System\ycQQauv.exe
  2⤵
  PID:5264
- C:\Windows\System\ZXGyNsM.exe
  C:\Windows\System\ZXGyNsM.exe
  2⤵
  PID:5308
- C:\Windows\System\kwNOwdZ.exe
  C:\Windows\System\kwNOwdZ.exe
  2⤵
  PID:5332
- C:\Windows\System\PrinQwN.exe
  C:\Windows\System\PrinQwN.exe
  2⤵
  PID:5360
- C:\Windows\System\UqQNVTu.exe
  C:\Windows\System\UqQNVTu.exe
  2⤵
  PID:5412
- C:\Windows\System\gjWJyKa.exe
  C:\Windows\System\gjWJyKa.exe
  2⤵
  PID:5432
- C:\Windows\System\mXEQQco.exe
  C:\Windows\System\mXEQQco.exe
  2⤵
  PID:5460
- C:\Windows\System\JPsMBoJ.exe
  C:\Windows\System\JPsMBoJ.exe
  2⤵
  PID:5476
- C:\Windows\System\NUniTki.exe
  C:\Windows\System\NUniTki.exe
  2⤵
  PID:5516
- C:\Windows\System\NhDkCaM.exe
  C:\Windows\System\NhDkCaM.exe
  2⤵
  PID:5544
- C:\Windows\System\MyBqyat.exe
  C:\Windows\System\MyBqyat.exe
  2⤵
  PID:5572
- C:\Windows\System\cDEXoYX.exe
  C:\Windows\System\cDEXoYX.exe
  2⤵
  PID:5600
- C:\Windows\System\aGCfVpy.exe
  C:\Windows\System\aGCfVpy.exe
  2⤵
  PID:5628
- C:\Windows\System\dJNjlYX.exe
  C:\Windows\System\dJNjlYX.exe
  2⤵
  PID:5644
- C:\Windows\System\uEURPAx.exe
  C:\Windows\System\uEURPAx.exe
  2⤵
  PID:5672
- C:\Windows\System\JNUIjJS.exe
  C:\Windows\System\JNUIjJS.exe
  2⤵
  PID:5700
- C:\Windows\System\eFkWmVj.exe
  C:\Windows\System\eFkWmVj.exe
  2⤵
  PID:5728
- C:\Windows\System\oYjFlzA.exe
  C:\Windows\System\oYjFlzA.exe
  2⤵
  PID:5764
- C:\Windows\System\bTiUhmd.exe
  C:\Windows\System\bTiUhmd.exe
  2⤵
  PID:5792
- C:\Windows\System\YbUbzqD.exe
  C:\Windows\System\YbUbzqD.exe
  2⤵
  PID:5824
- C:\Windows\System\rrJBaaw.exe
  C:\Windows\System\rrJBaaw.exe
  2⤵
  PID:5840
- C:\Windows\System\lbDVLtr.exe
  C:\Windows\System\lbDVLtr.exe
  2⤵
  PID:5872
- C:\Windows\System\FSRKGTc.exe
  C:\Windows\System\FSRKGTc.exe
  2⤵
  PID:5896
- C:\Windows\System\QzyVfTK.exe
  C:\Windows\System\QzyVfTK.exe
  2⤵
  PID:5932
- C:\Windows\System\BCoQuOt.exe
  C:\Windows\System\BCoQuOt.exe
  2⤵
  PID:5968
- C:\Windows\System\jNjZiXn.exe
  C:\Windows\System\jNjZiXn.exe
  2⤵
  PID:5996
- C:\Windows\System\KYiEgSW.exe
  C:\Windows\System\KYiEgSW.exe
  2⤵
  PID:6012
- C:\Windows\System\TFqipAG.exe
  C:\Windows\System\TFqipAG.exe
  2⤵
  PID:6040
- C:\Windows\System\ERSOqOU.exe
  C:\Windows\System\ERSOqOU.exe
  2⤵
  PID:6068
- C:\Windows\System\cPgKMLY.exe
  C:\Windows\System\cPgKMLY.exe
  2⤵
  PID:6100
- C:\Windows\System\CRLWird.exe
  C:\Windows\System\CRLWird.exe
  2⤵
  PID:6124
- C:\Windows\System\TmAzRGz.exe
  C:\Windows\System\TmAzRGz.exe
  2⤵
  PID:5132
- C:\Windows\System\gVJEBFm.exe
  C:\Windows\System\gVJEBFm.exe
  2⤵
  PID:5228
- C:\Windows\System\pjDZDuv.exe
  C:\Windows\System\pjDZDuv.exe
  2⤵
  PID:932
- C:\Windows\System\tsDRPck.exe
  C:\Windows\System\tsDRPck.exe
  2⤵
  PID:5260
- C:\Windows\System\qeYtwBl.exe
  C:\Windows\System\qeYtwBl.exe
  2⤵
  PID:5276
- C:\Windows\System\dHcPsEA.exe
  C:\Windows\System\dHcPsEA.exe
  2⤵
  PID:5352
- C:\Windows\System\SCHeLOZ.exe
  C:\Windows\System\SCHeLOZ.exe
  2⤵
  PID:5420
- C:\Windows\System\miWCneb.exe
  C:\Windows\System\miWCneb.exe
  2⤵
  PID:5496
- C:\Windows\System\aqfaayv.exe
  C:\Windows\System\aqfaayv.exe
  2⤵
  PID:5640
- C:\Windows\System\DTWJZVW.exe
  C:\Windows\System\DTWJZVW.exe
  2⤵
  PID:5716
- C:\Windows\System\ZnNPUFz.exe
  C:\Windows\System\ZnNPUFz.exe
  2⤵
  PID:5784
- C:\Windows\System\QZiogqV.exe
  C:\Windows\System\QZiogqV.exe
  2⤵
  PID:5852
- C:\Windows\System\IJdfmIy.exe
  C:\Windows\System\IJdfmIy.exe
  2⤵
  PID:5892
- C:\Windows\System\SYcKjYU.exe
  C:\Windows\System\SYcKjYU.exe
  2⤵
  PID:5952
- C:\Windows\System\BWdCouh.exe
  C:\Windows\System\BWdCouh.exe
  2⤵
  PID:5988
- C:\Windows\System\zGNiylf.exe
  C:\Windows\System\zGNiylf.exe
  2⤵
  PID:6052
- C:\Windows\System\BuIQuvw.exe
  C:\Windows\System\BuIQuvw.exe
  2⤵
  PID:6088
- C:\Windows\System\fYhzpOB.exe
  C:\Windows\System\fYhzpOB.exe
  2⤵
  PID:4580
- C:\Windows\System\derzmeq.exe
  C:\Windows\System\derzmeq.exe
  2⤵
  PID:1888
- C:\Windows\System\QgONVpa.exe
  C:\Windows\System\QgONVpa.exe
  2⤵
  PID:5348
- C:\Windows\System\mDBBejF.exe
  C:\Windows\System\mDBBejF.exe
  2⤵
  PID:5532
- C:\Windows\System\tLswOqP.exe
  C:\Windows\System\tLswOqP.exe
  2⤵
  PID:5660
- C:\Windows\System\jPvjCCm.exe
  C:\Windows\System\jPvjCCm.exe
  2⤵
  PID:5964
- C:\Windows\System\rWllcox.exe
  C:\Windows\System\rWllcox.exe
  2⤵
  PID:6032
- C:\Windows\System\ImNgXMV.exe
  C:\Windows\System\ImNgXMV.exe
  2⤵
  PID:6112
- C:\Windows\System\JbRFPRi.exe
  C:\Windows\System\JbRFPRi.exe
  2⤵
  PID:5296
- C:\Windows\System\WGzMFDa.exe
  C:\Windows\System\WGzMFDa.exe
  2⤵
  PID:5664
- C:\Windows\System\EwnwhuR.exe
  C:\Windows\System\EwnwhuR.exe
  2⤵
  PID:5744
- C:\Windows\System\DjcNFZg.exe
  C:\Windows\System\DjcNFZg.exe
  2⤵
  PID:5612
- C:\Windows\System\AYYQSsI.exe
  C:\Windows\System\AYYQSsI.exe
  2⤵
  PID:6056
- C:\Windows\System\dHwhzEy.exe
  C:\Windows\System\dHwhzEy.exe
  2⤵
  PID:6156
- C:\Windows\System\eqNiYIc.exe
  C:\Windows\System\eqNiYIc.exe
  2⤵
  PID:6208
- C:\Windows\System\olVdgOl.exe
  C:\Windows\System\olVdgOl.exe
  2⤵
  PID:6232
- C:\Windows\System\hqTLZVM.exe
  C:\Windows\System\hqTLZVM.exe
  2⤵
  PID:6256
- C:\Windows\System\YbzImVU.exe
  C:\Windows\System\YbzImVU.exe
  2⤵
  PID:6288
- C:\Windows\System\olcfLDN.exe
  C:\Windows\System\olcfLDN.exe
  2⤵
  PID:6316
- C:\Windows\System\uZrDRjw.exe
  C:\Windows\System\uZrDRjw.exe
  2⤵
  PID:6352
- C:\Windows\System\IUSUTRN.exe
  C:\Windows\System\IUSUTRN.exe
  2⤵
  PID:6388
- C:\Windows\System\UtgKUSc.exe
  C:\Windows\System\UtgKUSc.exe
  2⤵
  PID:6416
- C:\Windows\System\OzsmIEE.exe
  C:\Windows\System\OzsmIEE.exe
  2⤵
  PID:6436
- C:\Windows\System\AsWadeh.exe
  C:\Windows\System\AsWadeh.exe
  2⤵
  PID:6460
- C:\Windows\System\GXGYSMq.exe
  C:\Windows\System\GXGYSMq.exe
  2⤵
  PID:6488
- C:\Windows\System\MHEflBw.exe
  C:\Windows\System\MHEflBw.exe
  2⤵
  PID:6528
- C:\Windows\System\dQJcfVl.exe
  C:\Windows\System\dQJcfVl.exe
  2⤵
  PID:6552
- C:\Windows\System\reitFsn.exe
  C:\Windows\System\reitFsn.exe
  2⤵
  PID:6580
- C:\Windows\System\xaKVqhj.exe
  C:\Windows\System\xaKVqhj.exe
  2⤵
  PID:6608
- C:\Windows\System\KvmdSQf.exe
  C:\Windows\System\KvmdSQf.exe
  2⤵
  PID:6624
- C:\Windows\System\PqRBiVZ.exe
  C:\Windows\System\PqRBiVZ.exe
  2⤵
  PID:6652
- C:\Windows\System\TFAUPyd.exe
  C:\Windows\System\TFAUPyd.exe
  2⤵
  PID:6680
- C:\Windows\System\qEEmdhM.exe
  C:\Windows\System\qEEmdhM.exe
  2⤵
  PID:6708
- C:\Windows\System\CGPzdlL.exe
  C:\Windows\System\CGPzdlL.exe
  2⤵
  PID:6736
- C:\Windows\System\ZjrAgba.exe
  C:\Windows\System\ZjrAgba.exe
  2⤵
  PID:6756
- C:\Windows\System\XYYUpws.exe
  C:\Windows\System\XYYUpws.exe
  2⤵
  PID:6788
- C:\Windows\System\itCQdZB.exe
  C:\Windows\System\itCQdZB.exe
  2⤵
  PID:6816
- C:\Windows\System\ilaKBFh.exe
  C:\Windows\System\ilaKBFh.exe
  2⤵
  PID:6836
- C:\Windows\System\voHtiSq.exe
  C:\Windows\System\voHtiSq.exe
  2⤵
  PID:6860
- C:\Windows\System\LVXfBzx.exe
  C:\Windows\System\LVXfBzx.exe
  2⤵
  PID:6892
- C:\Windows\System\kXVEVYC.exe
  C:\Windows\System\kXVEVYC.exe
  2⤵
  PID:6920
- C:\Windows\System\OWsmIgN.exe
  C:\Windows\System\OWsmIgN.exe
  2⤵
  PID:6952
- C:\Windows\System\wEfQVgK.exe
  C:\Windows\System\wEfQVgK.exe
  2⤵
  PID:7012
- C:\Windows\System\cKnJsfX.exe
  C:\Windows\System\cKnJsfX.exe
  2⤵
  PID:7028
- C:\Windows\System\hSiMNQv.exe
  C:\Windows\System\hSiMNQv.exe
  2⤵
  PID:7068
- C:\Windows\System\oLvWBFN.exe
  C:\Windows\System\oLvWBFN.exe
  2⤵
  PID:7084
- C:\Windows\System\lzEyZCB.exe
  C:\Windows\System\lzEyZCB.exe
  2⤵
  PID:7112
- C:\Windows\System\POTaqlE.exe
  C:\Windows\System\POTaqlE.exe
  2⤵
  PID:7152
- C:\Windows\System\nPshYtg.exe
  C:\Windows\System\nPshYtg.exe
  2⤵
  PID:6148
- C:\Windows\System\JclPOpr.exe
  C:\Windows\System\JclPOpr.exe
  2⤵
  PID:6180
- C:\Windows\System\WiTGAzP.exe
  C:\Windows\System\WiTGAzP.exe
  2⤵
  PID:6220
- C:\Windows\System\aguveRa.exe
  C:\Windows\System\aguveRa.exe
  2⤵
  PID:6312
- C:\Windows\System\AUykuCb.exe
  C:\Windows\System\AUykuCb.exe
  2⤵
  PID:6384
- C:\Windows\System\ecVNLqd.exe
  C:\Windows\System\ecVNLqd.exe
  2⤵
  PID:6400
- C:\Windows\System\MMloSJH.exe
  C:\Windows\System\MMloSJH.exe
  2⤵
  PID:6544
- C:\Windows\System\CsKTDKr.exe
  C:\Windows\System\CsKTDKr.exe
  2⤵
  PID:6564
- C:\Windows\System\mgLPqYe.exe
  C:\Windows\System\mgLPqYe.exe
  2⤵
  PID:6620
- C:\Windows\System\CYKnDLH.exe
  C:\Windows\System\CYKnDLH.exe
  2⤵
  PID:6664
- C:\Windows\System\ImxUCoO.exe
  C:\Windows\System\ImxUCoO.exe
  2⤵
  PID:6768
- C:\Windows\System\BJmpXnm.exe
  C:\Windows\System\BJmpXnm.exe
  2⤵
  PID:6804
- C:\Windows\System\xByzGan.exe
  C:\Windows\System\xByzGan.exe
  2⤵
  PID:6852
- C:\Windows\System\QmxcvUF.exe
  C:\Windows\System\QmxcvUF.exe
  2⤵
  PID:6968
- C:\Windows\System\pHGtqHE.exe
  C:\Windows\System\pHGtqHE.exe
  2⤵
  PID:7052
- C:\Windows\System\itENOww.exe
  C:\Windows\System\itENOww.exe
  2⤵
  PID:7096
- C:\Windows\System\nORRBPn.exe
  C:\Windows\System\nORRBPn.exe
  2⤵
  PID:7160
- C:\Windows\System\YRdRPfc.exe
  C:\Windows\System\YRdRPfc.exe
  2⤵
  PID:6360
- C:\Windows\System\HtspOwV.exe
  C:\Windows\System\HtspOwV.exe
  2⤵
  PID:6300
- C:\Windows\System\RAKBpGY.exe
  C:\Windows\System\RAKBpGY.exe
  2⤵
  PID:6472
- C:\Windows\System\ygZtJFM.exe
  C:\Windows\System\ygZtJFM.exe
  2⤵
  PID:6716
- C:\Windows\System\MuryEPp.exe
  C:\Windows\System\MuryEPp.exe
  2⤵
  PID:6692
- C:\Windows\System\XKLwbRW.exe
  C:\Windows\System\XKLwbRW.exe
  2⤵
  PID:7008
- C:\Windows\System\AAQVHuP.exe
  C:\Windows\System\AAQVHuP.exe
  2⤵
  PID:6340
- C:\Windows\System\CKkZFeL.exe
  C:\Windows\System\CKkZFeL.exe
  2⤵
  PID:7124
- C:\Windows\System\MdsKGZt.exe
  C:\Windows\System\MdsKGZt.exe
  2⤵
  PID:6476
- C:\Windows\System\tmLpekl.exe
  C:\Windows\System\tmLpekl.exe
  2⤵
  PID:7080
- C:\Windows\System\mmjYmyJ.exe
  C:\Windows\System\mmjYmyJ.exe
  2⤵
  PID:7172
- C:\Windows\System\zqJpzfR.exe
  C:\Windows\System\zqJpzfR.exe
  2⤵
  PID:7204
- C:\Windows\System\GNKVANy.exe
  C:\Windows\System\GNKVANy.exe
  2⤵
  PID:7220
- C:\Windows\System\RIAxQQp.exe
  C:\Windows\System\RIAxQQp.exe
  2⤵
  PID:7240
- C:\Windows\System\gXwGVIe.exe
  C:\Windows\System\gXwGVIe.exe
  2⤵
  PID:7260
- C:\Windows\System\UMWDqRQ.exe
  C:\Windows\System\UMWDqRQ.exe
  2⤵
  PID:7292
- C:\Windows\System\FWfVsCW.exe
  C:\Windows\System\FWfVsCW.exe
  2⤵
  PID:7324
- C:\Windows\System\PnaAusG.exe
  C:\Windows\System\PnaAusG.exe
  2⤵
  PID:7364
- C:\Windows\System\qLNTcLS.exe
  C:\Windows\System\qLNTcLS.exe
  2⤵
  PID:7416
- C:\Windows\System\urMvhym.exe
  C:\Windows\System\urMvhym.exe
  2⤵
  PID:7444
- C:\Windows\System\sXPjIyt.exe
  C:\Windows\System\sXPjIyt.exe
  2⤵
  PID:7472
- C:\Windows\System\hvpIxqU.exe
  C:\Windows\System\hvpIxqU.exe
  2⤵
  PID:7512
- C:\Windows\System\xiuSpsP.exe
  C:\Windows\System\xiuSpsP.exe
  2⤵
  PID:7532
- C:\Windows\System\vCiXWJm.exe
  C:\Windows\System\vCiXWJm.exe
  2⤵
  PID:7556
- C:\Windows\System\gfMxHHR.exe
  C:\Windows\System\gfMxHHR.exe
  2⤵
  PID:7596
- C:\Windows\System\pLspQjb.exe
  C:\Windows\System\pLspQjb.exe
  2⤵
  PID:7612
- C:\Windows\System\PECoKdL.exe
  C:\Windows\System\PECoKdL.exe
  2⤵
  PID:7644
- C:\Windows\System\NYOgPkM.exe
  C:\Windows\System\NYOgPkM.exe
  2⤵
  PID:7668
- C:\Windows\System\rdAcIdT.exe
  C:\Windows\System\rdAcIdT.exe
  2⤵
  PID:7700
- C:\Windows\System\pySurgo.exe
  C:\Windows\System\pySurgo.exe
  2⤵
  PID:7724
- C:\Windows\System\vOweLTF.exe
  C:\Windows\System\vOweLTF.exe
  2⤵
  PID:7740
- C:\Windows\System\CrUmBfr.exe
  C:\Windows\System\CrUmBfr.exe
  2⤵
  PID:7768
- C:\Windows\System\nuUgtUr.exe
  C:\Windows\System\nuUgtUr.exe
  2⤵
  PID:7796
- C:\Windows\System\CpTwXMb.exe
  C:\Windows\System\CpTwXMb.exe
  2⤵
  PID:7824
- C:\Windows\System\NBhTeId.exe
  C:\Windows\System\NBhTeId.exe
  2⤵
  PID:7840
- C:\Windows\System\qtvqTPq.exe
  C:\Windows\System\qtvqTPq.exe
  2⤵
  PID:7904
- C:\Windows\System\DUSbwoK.exe
  C:\Windows\System\DUSbwoK.exe
  2⤵
  PID:7920
- C:\Windows\System\Utbcgii.exe
  C:\Windows\System\Utbcgii.exe
  2⤵
  PID:7936
- C:\Windows\System\vNzDajp.exe
  C:\Windows\System\vNzDajp.exe
  2⤵
  PID:7956
- C:\Windows\System\PsLMeEy.exe
  C:\Windows\System\PsLMeEy.exe
  2⤵
  PID:7992
- C:\Windows\System\bQdtlBt.exe
  C:\Windows\System\bQdtlBt.exe
  2⤵
  PID:8016
- C:\Windows\System\hazvBNL.exe
  C:\Windows\System\hazvBNL.exe
  2⤵
  PID:8044
- C:\Windows\System\OSVEgGT.exe
  C:\Windows\System\OSVEgGT.exe
  2⤵
  PID:8064
- C:\Windows\System\xplUkBX.exe
  C:\Windows\System\xplUkBX.exe
  2⤵
  PID:8088
- C:\Windows\System\bqXWYtO.exe
  C:\Windows\System\bqXWYtO.exe
  2⤵
  PID:8116
- C:\Windows\System\QRUsdDo.exe
  C:\Windows\System\QRUsdDo.exe
  2⤵
  PID:8144
- C:\Windows\System\asqtbXt.exe
  C:\Windows\System\asqtbXt.exe
  2⤵
  PID:8176
- C:\Windows\System\CBooemq.exe
  C:\Windows\System\CBooemq.exe
  2⤵
  PID:6936
- C:\Windows\System\forrijf.exe
  C:\Windows\System\forrijf.exe
  2⤵
  PID:7212
- C:\Windows\System\mdnedaf.exe
  C:\Windows\System\mdnedaf.exe
  2⤵
  PID:7252
- C:\Windows\System\OyouiqW.exe
  C:\Windows\System\OyouiqW.exe
  2⤵
  PID:7316
- C:\Windows\System\mafUMrE.exe
  C:\Windows\System\mafUMrE.exe
  2⤵
  PID:7404
- C:\Windows\System\SxgEIvf.exe
  C:\Windows\System\SxgEIvf.exe
  2⤵
  PID:7460
- C:\Windows\System\ClxTeFq.exe
  C:\Windows\System\ClxTeFq.exe
  2⤵
  PID:7520
- C:\Windows\System\wHUOhRz.exe
  C:\Windows\System\wHUOhRz.exe
  2⤵
  PID:7604
- C:\Windows\System\ZJhmlcV.exe
  C:\Windows\System\ZJhmlcV.exe
  2⤵
  PID:7652
- C:\Windows\System\eDFmRRY.exe
  C:\Windows\System\eDFmRRY.exe
  2⤵
  PID:7752
- C:\Windows\System\LssKvOl.exe
  C:\Windows\System\LssKvOl.exe
  2⤵
  PID:7860
- C:\Windows\System\LaVISjZ.exe
  C:\Windows\System\LaVISjZ.exe
  2⤵
  PID:7916
- C:\Windows\System\DTLapDz.exe
  C:\Windows\System\DTLapDz.exe
  2⤵
  PID:8008
- C:\Windows\System\bldchEo.exe
  C:\Windows\System\bldchEo.exe
  2⤵
  PID:8004
- C:\Windows\System\HEpZcnx.exe
  C:\Windows\System\HEpZcnx.exe
  2⤵
  PID:8132
- C:\Windows\System\Nlnkiho.exe
  C:\Windows\System\Nlnkiho.exe
  2⤵
  PID:8080
- C:\Windows\System\LlaradI.exe
  C:\Windows\System\LlaradI.exe
  2⤵
  PID:6848
- C:\Windows\System\WlrmRvm.exe
  C:\Windows\System\WlrmRvm.exe
  2⤵
  PID:7380
- C:\Windows\System\JrGUnfh.exe
  C:\Windows\System\JrGUnfh.exe
  2⤵
  PID:7496
- C:\Windows\System\UUXazDC.exe
  C:\Windows\System\UUXazDC.exe
  2⤵
  PID:7576
- C:\Windows\System\WvsQAzz.exe
  C:\Windows\System\WvsQAzz.exe
  2⤵
  PID:7804
- C:\Windows\System\ZAMmxan.exe
  C:\Windows\System\ZAMmxan.exe
  2⤵
  PID:7948
- C:\Windows\System\LGVEBwC.exe
  C:\Windows\System\LGVEBwC.exe
  2⤵
  PID:8028
- C:\Windows\System\xxKxTQR.exe
  C:\Windows\System\xxKxTQR.exe
  2⤵
  PID:8168
- C:\Windows\System\rYhZNFz.exe
  C:\Windows\System\rYhZNFz.exe
  2⤵
  PID:7592
- C:\Windows\System\ESkvgWq.exe
  C:\Windows\System\ESkvgWq.exe
  2⤵
  PID:7400
- C:\Windows\System\AXndqkD.exe
  C:\Windows\System\AXndqkD.exe
  2⤵
  PID:6404
- C:\Windows\System\KwUoGAx.exe
  C:\Windows\System\KwUoGAx.exe
  2⤵
  PID:8036
- C:\Windows\System\oWmlsrY.exe
  C:\Windows\System\oWmlsrY.exe
  2⤵
  PID:8220
- C:\Windows\System\vqBJSsq.exe
  C:\Windows\System\vqBJSsq.exe
  2⤵
  PID:8260
- C:\Windows\System\gWsNxaZ.exe
  C:\Windows\System\gWsNxaZ.exe
  2⤵
  PID:8276
- C:\Windows\System\yoeSqyw.exe
  C:\Windows\System\yoeSqyw.exe
  2⤵
  PID:8300
- C:\Windows\System\bdPUFrn.exe
  C:\Windows\System\bdPUFrn.exe
  2⤵
  PID:8328
- C:\Windows\System\oCygCqp.exe
  C:\Windows\System\oCygCqp.exe
  2⤵
  PID:8352
- C:\Windows\System\sfrLtcx.exe
  C:\Windows\System\sfrLtcx.exe
  2⤵
  PID:8376
- C:\Windows\System\eJkQyNM.exe
  C:\Windows\System\eJkQyNM.exe
  2⤵
  PID:8400
- C:\Windows\System\HxYoTvP.exe
  C:\Windows\System\HxYoTvP.exe
  2⤵
  PID:8424
- C:\Windows\System\wgiUOZN.exe
  C:\Windows\System\wgiUOZN.exe
  2⤵
  PID:8468
- C:\Windows\System\dSYTdpe.exe
  C:\Windows\System\dSYTdpe.exe
  2⤵
  PID:8488
- C:\Windows\System\cGesxuC.exe
  C:\Windows\System\cGesxuC.exe
  2⤵
  PID:8524
- C:\Windows\System\xxTWwVQ.exe
  C:\Windows\System\xxTWwVQ.exe
  2⤵
  PID:8552
- C:\Windows\System\HQntCpy.exe
  C:\Windows\System\HQntCpy.exe
  2⤵
  PID:8588
- C:\Windows\System\LwaJOFS.exe
  C:\Windows\System\LwaJOFS.exe
  2⤵
  PID:8612
- C:\Windows\System\zCDzoQa.exe
  C:\Windows\System\zCDzoQa.exe
  2⤵
  PID:8652
- C:\Windows\System\HDkPAnb.exe
  C:\Windows\System\HDkPAnb.exe
  2⤵
  PID:8672
- C:\Windows\System\BqYTJwy.exe
  C:\Windows\System\BqYTJwy.exe
  2⤵
  PID:8704
- C:\Windows\System\PHVQqBi.exe
  C:\Windows\System\PHVQqBi.exe
  2⤵
  PID:8724
- C:\Windows\System\KtfDkwW.exe
  C:\Windows\System\KtfDkwW.exe
  2⤵
  PID:8752
- C:\Windows\System\ORiGzuu.exe
  C:\Windows\System\ORiGzuu.exe
  2⤵
  PID:8780
- C:\Windows\System\RHnMMud.exe
  C:\Windows\System\RHnMMud.exe
  2⤵
  PID:8820
- C:\Windows\System\gYNNPca.exe
  C:\Windows\System\gYNNPca.exe
  2⤵
  PID:8840
- C:\Windows\System\UJAihNc.exe
  C:\Windows\System\UJAihNc.exe
  2⤵
  PID:8888
- C:\Windows\System\RbyfGtB.exe
  C:\Windows\System\RbyfGtB.exe
  2⤵
  PID:8904
- C:\Windows\System\smHBSTW.exe
  C:\Windows\System\smHBSTW.exe
  2⤵
  PID:8920
- C:\Windows\System\CvMENkJ.exe
  C:\Windows\System\CvMENkJ.exe
  2⤵
  PID:8936
- C:\Windows\System\amnqsGD.exe
  C:\Windows\System\amnqsGD.exe
  2⤵
  PID:8980
- C:\Windows\System\eQWsxie.exe
  C:\Windows\System\eQWsxie.exe
  2⤵
  PID:9008
- C:\Windows\System\nkRTbub.exe
  C:\Windows\System\nkRTbub.exe
  2⤵
  PID:9032
- C:\Windows\System\rlywOiZ.exe
  C:\Windows\System\rlywOiZ.exe
  2⤵
  PID:9052
- C:\Windows\System\casBbQT.exe
  C:\Windows\System\casBbQT.exe
  2⤵
  PID:9072
- C:\Windows\System\bCEcADY.exe
  C:\Windows\System\bCEcADY.exe
  2⤵
  PID:9096
- C:\Windows\System\iKBfVSZ.exe
  C:\Windows\System\iKBfVSZ.exe
  2⤵
  PID:9132
- C:\Windows\System\PrQOgdi.exe
  C:\Windows\System\PrQOgdi.exe
  2⤵
  PID:9184
- C:\Windows\System\jXDdVQM.exe
  C:\Windows\System\jXDdVQM.exe
  2⤵
  PID:9212
- C:\Windows\System\FWunSkq.exe
  C:\Windows\System\FWunSkq.exe
  2⤵
  PID:7708
- C:\Windows\System\LEUNexx.exe
  C:\Windows\System\LEUNexx.exe
  2⤵
  PID:8272
- C:\Windows\System\kZVcfAk.exe
  C:\Windows\System\kZVcfAk.exe
  2⤵
  PID:8312
- C:\Windows\System\qbnBclZ.exe
  C:\Windows\System\qbnBclZ.exe
  2⤵
  PID:8384
- C:\Windows\System\NWLaaAP.exe
  C:\Windows\System\NWLaaAP.exe
  2⤵
  PID:8436
- C:\Windows\System\KSBwfLZ.exe
  C:\Windows\System\KSBwfLZ.exe
  2⤵
  PID:8540
- C:\Windows\System\rmSCxII.exe
  C:\Windows\System\rmSCxII.exe
  2⤵
  PID:8568
- C:\Windows\System\YspoHBJ.exe
  C:\Windows\System\YspoHBJ.exe
  2⤵
  PID:8608
- C:\Windows\System\tZZefHj.exe
  C:\Windows\System\tZZefHj.exe
  2⤵
  PID:8692
- C:\Windows\System\cXIMMvv.exe
  C:\Windows\System\cXIMMvv.exe
  2⤵
  PID:8776
- C:\Windows\System\ADertgA.exe
  C:\Windows\System\ADertgA.exe
  2⤵
  PID:8832
- C:\Windows\System\RWYYLBw.exe
  C:\Windows\System\RWYYLBw.exe
  2⤵
  PID:8860
- C:\Windows\System\OrMMAMJ.exe
  C:\Windows\System\OrMMAMJ.exe
  2⤵
  PID:9040
- C:\Windows\System\fILnliL.exe
  C:\Windows\System\fILnliL.exe
  2⤵
  PID:9088
- C:\Windows\System\FQgVttx.exe
  C:\Windows\System\FQgVttx.exe
  2⤵
  PID:9124
- C:\Windows\System\uiCjbxW.exe
  C:\Windows\System\uiCjbxW.exe
  2⤵
  PID:9140
- C:\Windows\System\fbJuRNd.exe
  C:\Windows\System\fbJuRNd.exe
  2⤵
  PID:8156
- C:\Windows\System\mUkZTfm.exe
  C:\Windows\System\mUkZTfm.exe
  2⤵
  PID:8292
- C:\Windows\System\QrOxVhH.exe
  C:\Windows\System\QrOxVhH.exe
  2⤵
  PID:8420
- C:\Windows\System\TkmTbFX.exe
  C:\Windows\System\TkmTbFX.exe
  2⤵
  PID:8580
- C:\Windows\System\UgDCjRy.exe
  C:\Windows\System\UgDCjRy.exe
  2⤵
  PID:8792
- C:\Windows\System\GKNGsPF.exe
  C:\Windows\System\GKNGsPF.exe
  2⤵
  PID:8848
- C:\Windows\System\zJIksEB.exe
  C:\Windows\System\zJIksEB.exe
  2⤵
  PID:8992
- C:\Windows\System\hPrcfZl.exe
  C:\Windows\System\hPrcfZl.exe
  2⤵
  PID:9160
- C:\Windows\System\BrHGnaC.exe
  C:\Windows\System\BrHGnaC.exe
  2⤵
  PID:7356
- C:\Windows\System\bBkiKKw.exe
  C:\Windows\System\bBkiKKw.exe
  2⤵
  PID:8644
- C:\Windows\System\OIFQHlC.exe
  C:\Windows\System\OIFQHlC.exe
  2⤵
  PID:8720
- C:\Windows\System\yuiJMUU.exe
  C:\Windows\System\yuiJMUU.exe
  2⤵
  PID:9276
- C:\Windows\System\jweYGys.exe
  C:\Windows\System\jweYGys.exe
  2⤵
  PID:9296
- C:\Windows\System\BAliycR.exe
  C:\Windows\System\BAliycR.exe
  2⤵
  PID:9324
- C:\Windows\System\jvIhZtV.exe
  C:\Windows\System\jvIhZtV.exe
  2⤵
  PID:9348
- C:\Windows\System\ZSrYznL.exe
  C:\Windows\System\ZSrYznL.exe
  2⤵
  PID:9376
- C:\Windows\System\OWdpWuB.exe
  C:\Windows\System\OWdpWuB.exe
  2⤵
  PID:9416
- C:\Windows\System\hcFCvep.exe
  C:\Windows\System\hcFCvep.exe
  2⤵
  PID:9432
- C:\Windows\System\zMXRldd.exe
  C:\Windows\System\zMXRldd.exe
  2⤵
  PID:9460
- C:\Windows\System\SWIhpVx.exe
  C:\Windows\System\SWIhpVx.exe
  2⤵
  PID:9488
- C:\Windows\System\dMMTFEC.exe
  C:\Windows\System\dMMTFEC.exe
  2⤵
  PID:9512
- C:\Windows\System\EBAvXlM.exe
  C:\Windows\System\EBAvXlM.exe
  2⤵
  PID:9544
- C:\Windows\System\lJIDvGg.exe
  C:\Windows\System\lJIDvGg.exe
  2⤵
  PID:9572
- C:\Windows\System\RgtRNzK.exe
  C:\Windows\System\RgtRNzK.exe
  2⤵
  PID:9588
- C:\Windows\System\SrNelqK.exe
  C:\Windows\System\SrNelqK.exe
  2⤵
  PID:9612
- C:\Windows\System\ATVMUbp.exe
  C:\Windows\System\ATVMUbp.exe
  2⤵
  PID:9640
- C:\Windows\System\feHzMzC.exe
  C:\Windows\System\feHzMzC.exe
  2⤵
  PID:9660
- C:\Windows\System\KgkaMpP.exe
  C:\Windows\System\KgkaMpP.exe
  2⤵
  PID:9688
- C:\Windows\System\sAOYWCz.exe
  C:\Windows\System\sAOYWCz.exe
  2⤵
  PID:9712
- C:\Windows\System\SzUYEpU.exe
  C:\Windows\System\SzUYEpU.exe
  2⤵
  PID:9780
- C:\Windows\System\pHlXIrs.exe
  C:\Windows\System\pHlXIrs.exe
  2⤵
  PID:9796
- C:\Windows\System\iVdLoFR.exe
  C:\Windows\System\iVdLoFR.exe
  2⤵
  PID:9824
- C:\Windows\System\PHJowrE.exe
  C:\Windows\System\PHJowrE.exe
  2⤵
  PID:9852
- C:\Windows\System\yaJvIgH.exe
  C:\Windows\System\yaJvIgH.exe
  2⤵
  PID:9872
- C:\Windows\System\JNvWuQy.exe
  C:\Windows\System\JNvWuQy.exe
  2⤵
  PID:9892
- C:\Windows\System\YtHxJUK.exe
  C:\Windows\System\YtHxJUK.exe
  2⤵
  PID:9924
- C:\Windows\System\aiseJGV.exe
  C:\Windows\System\aiseJGV.exe
  2⤵
  PID:9956
- C:\Windows\System\KIKcKhB.exe
  C:\Windows\System\KIKcKhB.exe
  2⤵
  PID:9980
- C:\Windows\System\UYaZXzE.exe
  C:\Windows\System\UYaZXzE.exe
  2⤵
  PID:10004
- C:\Windows\System\zlpwbZF.exe
  C:\Windows\System\zlpwbZF.exe
  2⤵
  PID:10060
- C:\Windows\System\uIztyxM.exe
  C:\Windows\System\uIztyxM.exe
  2⤵
  PID:10088
- C:\Windows\System\cVgsYuZ.exe
  C:\Windows\System\cVgsYuZ.exe
  2⤵
  PID:10116
- C:\Windows\System\EacQayl.exe
  C:\Windows\System\EacQayl.exe
  2⤵
  PID:10132
- C:\Windows\System\uyIakTV.exe
  C:\Windows\System\uyIakTV.exe
  2⤵
  PID:10160
- C:\Windows\System\nopxjrH.exe
  C:\Windows\System\nopxjrH.exe
  2⤵
  PID:10180
- C:\Windows\System\GNsUNdU.exe
  C:\Windows\System\GNsUNdU.exe
  2⤵
  PID:10204
- C:\Windows\System\iYBkdpj.exe
  C:\Windows\System\iYBkdpj.exe
  2⤵
  PID:10228
- C:\Windows\System\uwAdyiD.exe
  C:\Windows\System\uwAdyiD.exe
  2⤵
  PID:8976
- C:\Windows\System\oegukRS.exe
  C:\Windows\System\oegukRS.exe
  2⤵
  PID:9304
- C:\Windows\System\JvYeuDX.exe
  C:\Windows\System\JvYeuDX.exe
  2⤵
  PID:9364
- C:\Windows\System\sHPJkSv.exe
  C:\Windows\System\sHPJkSv.exe
  2⤵
  PID:9396
- C:\Windows\System\msINAZP.exe
  C:\Windows\System\msINAZP.exe
  2⤵
  PID:9480
- C:\Windows\System\HkTrQsa.exe
  C:\Windows\System\HkTrQsa.exe
  2⤵
  PID:9528
- C:\Windows\System\KLelFIG.exe
  C:\Windows\System\KLelFIG.exe
  2⤵
  PID:9608
- C:\Windows\System\dbIqGbV.exe
  C:\Windows\System\dbIqGbV.exe
  2⤵
  PID:9580
- C:\Windows\System\HuFoisv.exe
  C:\Windows\System\HuFoisv.exe
  2⤵
  PID:9696
- C:\Windows\System\kNqCGKB.exe
  C:\Windows\System\kNqCGKB.exe
  2⤵
  PID:9744
- C:\Windows\System\jteMnIS.exe
  C:\Windows\System\jteMnIS.exe
  2⤵
  PID:9788
- C:\Windows\System\TIfnrZR.exe
  C:\Windows\System\TIfnrZR.exe
  2⤵
  PID:9932
- C:\Windows\System\vqsMCgt.exe
  C:\Windows\System\vqsMCgt.exe
  2⤵
  PID:9972
- C:\Windows\System\ghDIwNX.exe
  C:\Windows\System\ghDIwNX.exe
  2⤵
  PID:10028
- C:\Windows\System\qHOcPRU.exe
  C:\Windows\System\qHOcPRU.exe
  2⤵
  PID:10128
- C:\Windows\System\nkJJPwI.exe
  C:\Windows\System\nkJJPwI.exe
  2⤵
  PID:10168
- C:\Windows\System\RWzczWF.exe
  C:\Windows\System\RWzczWF.exe
  2⤵
  PID:10212
- C:\Windows\System\Icgibbc.exe
  C:\Windows\System\Icgibbc.exe
  2⤵
  PID:9060
- C:\Windows\System\PIDXVzT.exe
  C:\Windows\System\PIDXVzT.exe
  2⤵
  PID:9312
- C:\Windows\System\ShuEmjd.exe
  C:\Windows\System\ShuEmjd.exe
  2⤵
  PID:9404
- C:\Windows\System\qgipZxr.exe
  C:\Windows\System\qgipZxr.exe
  2⤵
  PID:9472
- C:\Windows\System\suxiiOX.exe
  C:\Windows\System\suxiiOX.exe
  2⤵
  PID:10072
- C:\Windows\System\vbEjVFF.exe
  C:\Windows\System\vbEjVFF.exe
  2⤵
  PID:10044
- C:\Windows\System\HvFBlDb.exe
  C:\Windows\System\HvFBlDb.exe
  2⤵
  PID:9220
- C:\Windows\System\LjXtfCK.exe
  C:\Windows\System\LjXtfCK.exe
  2⤵
  PID:9676
- C:\Windows\System\GkCrLQg.exe
  C:\Windows\System\GkCrLQg.exe
  2⤵
  PID:9496
- C:\Windows\System\TluwvSS.exe
  C:\Windows\System\TluwvSS.exe
  2⤵
  PID:9888
- C:\Windows\System\NInpUNu.exe
  C:\Windows\System\NInpUNu.exe
  2⤵
  PID:10148
- C:\Windows\System\yXYycqa.exe
  C:\Windows\System\yXYycqa.exe
  2⤵
  PID:10268
- C:\Windows\System\QThpHEl.exe
  C:\Windows\System\QThpHEl.exe
  2⤵
  PID:10288
- C:\Windows\System\KQugdSY.exe
  C:\Windows\System\KQugdSY.exe
  2⤵
  PID:10328
- C:\Windows\System\yYWqbBo.exe
  C:\Windows\System\yYWqbBo.exe
  2⤵
  PID:10348
- C:\Windows\System\HqXMxEk.exe
  C:\Windows\System\HqXMxEk.exe
  2⤵
  PID:10376
- C:\Windows\System\qrkeVfm.exe
  C:\Windows\System\qrkeVfm.exe
  2⤵
  PID:10404
- C:\Windows\System\szfeVFz.exe
  C:\Windows\System\szfeVFz.exe
  2⤵
  PID:10432
- C:\Windows\System\wLqxUIu.exe
  C:\Windows\System\wLqxUIu.exe
  2⤵
  PID:10460
- C:\Windows\System\LXxvuyk.exe
  C:\Windows\System\LXxvuyk.exe
  2⤵
  PID:10476
- C:\Windows\System\eMPpbAy.exe
  C:\Windows\System\eMPpbAy.exe
  2⤵
  PID:10496
- C:\Windows\System\AdWSFDS.exe
  C:\Windows\System\AdWSFDS.exe
  2⤵
  PID:10544
- C:\Windows\System\VMQrPUt.exe
  C:\Windows\System\VMQrPUt.exe
  2⤵
  PID:10568
- C:\Windows\System\lPnRhcz.exe
  C:\Windows\System\lPnRhcz.exe
  2⤵
  PID:10588
- C:\Windows\System\IUQSLsz.exe
  C:\Windows\System\IUQSLsz.exe
  2⤵
  PID:10612
- C:\Windows\System\boCtzoy.exe
  C:\Windows\System\boCtzoy.exe
  2⤵
  PID:10636
- C:\Windows\System\lGscOEY.exe
  C:\Windows\System\lGscOEY.exe
  2⤵
  PID:10664
- C:\Windows\System\eCkHunY.exe
  C:\Windows\System\eCkHunY.exe
  2⤵
  PID:10692
- C:\Windows\System\mWjojFB.exe
  C:\Windows\System\mWjojFB.exe
  2⤵
  PID:10724
- C:\Windows\System\kgWMpTp.exe
  C:\Windows\System\kgWMpTp.exe
  2⤵
  PID:10752
- C:\Windows\System\rTzKvXo.exe
  C:\Windows\System\rTzKvXo.exe
  2⤵
  PID:10792
- C:\Windows\System\MoGNsZE.exe
  C:\Windows\System\MoGNsZE.exe
  2⤵
  PID:10824
- C:\Windows\System\DkiiTpp.exe
  C:\Windows\System\DkiiTpp.exe
  2⤵
  PID:10848
- C:\Windows\System\BnHUIZC.exe
  C:\Windows\System\BnHUIZC.exe
  2⤵
  PID:10880
- C:\Windows\System\nPFVCoj.exe
  C:\Windows\System\nPFVCoj.exe
  2⤵
  PID:10920
- C:\Windows\System\fdjFcFo.exe
  C:\Windows\System\fdjFcFo.exe
  2⤵
  PID:10940
- C:\Windows\System\CPyEEgi.exe
  C:\Windows\System\CPyEEgi.exe
  2⤵
  PID:10964
- C:\Windows\System\ntpjgwb.exe
  C:\Windows\System\ntpjgwb.exe
  2⤵
  PID:10992
- C:\Windows\System\iotOTwJ.exe
  C:\Windows\System\iotOTwJ.exe
  2⤵
  PID:11020
- C:\Windows\System\GJrtxcE.exe
  C:\Windows\System\GJrtxcE.exe
  2⤵
  PID:11040
- C:\Windows\System\ZwYHdem.exe
  C:\Windows\System\ZwYHdem.exe
  2⤵
  PID:11080
- C:\Windows\System\HMGPaqQ.exe
  C:\Windows\System\HMGPaqQ.exe
  2⤵
  PID:11112
- C:\Windows\System\acaqPGZ.exe
  C:\Windows\System\acaqPGZ.exe
  2⤵
  PID:11132
- C:\Windows\System\IWyDLLr.exe
  C:\Windows\System\IWyDLLr.exe
  2⤵
  PID:11160
- C:\Windows\System\BYymmou.exe
  C:\Windows\System\BYymmou.exe
  2⤵
  PID:11180
- C:\Windows\System\RngWnKd.exe
  C:\Windows\System\RngWnKd.exe
  2⤵
  PID:11208
- C:\Windows\System\qMcbcyP.exe
  C:\Windows\System\qMcbcyP.exe
  2⤵
  PID:11232
- C:\Windows\System\bDEHQKw.exe
  C:\Windows\System\bDEHQKw.exe
  2⤵
  PID:11252
- C:\Windows\System\bzXqQTh.exe
  C:\Windows\System\bzXqQTh.exe
  2⤵
  PID:10280
- C:\Windows\System\ijAymUH.exe
  C:\Windows\System\ijAymUH.exe
  2⤵
  PID:10344
- C:\Windows\System\DHclqYe.exe
  C:\Windows\System\DHclqYe.exe
  2⤵
  PID:10400
- C:\Windows\System\vRqNHzs.exe
  C:\Windows\System\vRqNHzs.exe
  2⤵
  PID:10424
- C:\Windows\System\uIhyOsu.exe
  C:\Windows\System\uIhyOsu.exe
  2⤵
  PID:10608
- C:\Windows\System\yfJWxuG.exe
  C:\Windows\System\yfJWxuG.exe
  2⤵
  PID:10624
- C:\Windows\System\jjEmBBO.exe
  C:\Windows\System\jjEmBBO.exe
  2⤵
  PID:10680
- C:\Windows\System\LSxnUCr.exe
  C:\Windows\System\LSxnUCr.exe
  2⤵
  PID:10748
- C:\Windows\System\EdMjkkB.exe
  C:\Windows\System\EdMjkkB.exe
  2⤵
  PID:10844
- C:\Windows\System\NFGPhpb.exe
  C:\Windows\System\NFGPhpb.exe
  2⤵
  PID:10872
- C:\Windows\System\ZTvxIun.exe
  C:\Windows\System\ZTvxIun.exe
  2⤵
  PID:10952
- C:\Windows\System\NVSAoJu.exe
  C:\Windows\System\NVSAoJu.exe
  2⤵
  PID:11008
- C:\Windows\System\kkujjxX.exe
  C:\Windows\System\kkujjxX.exe
  2⤵
  PID:11028
- C:\Windows\System\COmRLSh.exe
  C:\Windows\System\COmRLSh.exe
  2⤵
  PID:11108
- C:\Windows\System\GQzPIFO.exe
  C:\Windows\System\GQzPIFO.exe
  2⤵
  PID:11196
- C:\Windows\System\vHQwElN.exe
  C:\Windows\System\vHQwElN.exe
  2⤵
  PID:10276
- C:\Windows\System\ASdWHOf.exe
  C:\Windows\System\ASdWHOf.exe
  2⤵
  PID:9476
- C:\Windows\System\LpqfnqN.exe
  C:\Windows\System\LpqfnqN.exe
  2⤵
  PID:10600
- C:\Windows\System\hEEfMNp.exe
  C:\Windows\System\hEEfMNp.exe
  2⤵
  PID:10684
- C:\Windows\System\uMzfFHa.exe
  C:\Windows\System\uMzfFHa.exe
  2⤵
  PID:10816
- C:\Windows\System\iCyCdfU.exe
  C:\Windows\System\iCyCdfU.exe
  2⤵
  PID:10984
- C:\Windows\System\JNYEYNt.exe
  C:\Windows\System\JNYEYNt.exe
  2⤵
  PID:11176
- C:\Windows\System\PSqfVSU.exe
  C:\Windows\System\PSqfVSU.exe
  2⤵
  PID:10252
- C:\Windows\System\HYSYcXQ.exe
  C:\Windows\System\HYSYcXQ.exe
  2⤵
  PID:10804
- C:\Windows\System\AKCNRYh.exe
  C:\Windows\System\AKCNRYh.exe
  2⤵
  PID:10740
- C:\Windows\System\xroBtCC.exe
  C:\Windows\System\xroBtCC.exe
  2⤵
  PID:11168
- C:\Windows\System\jdUpNpD.exe
  C:\Windows\System\jdUpNpD.exe
  2⤵
  PID:10644
- C:\Windows\System\eRUwmiY.exe
  C:\Windows\System\eRUwmiY.exe
  2⤵
  PID:11308
- C:\Windows\System\rAwAgWv.exe
  C:\Windows\System\rAwAgWv.exe
  2⤵
  PID:11324
- C:\Windows\System\YpAOqxp.exe
  C:\Windows\System\YpAOqxp.exe
  2⤵
  PID:11352
- C:\Windows\System\xxpUDrW.exe
  C:\Windows\System\xxpUDrW.exe
  2⤵
  PID:11372
- C:\Windows\System\HXfUyFZ.exe
  C:\Windows\System\HXfUyFZ.exe
  2⤵
  PID:11408
- C:\Windows\System\tjstyWL.exe
  C:\Windows\System\tjstyWL.exe
  2⤵
  PID:11436
- C:\Windows\System\KMLRMUF.exe
  C:\Windows\System\KMLRMUF.exe
  2⤵
  PID:11460
- C:\Windows\System\AUxcMoM.exe
  C:\Windows\System\AUxcMoM.exe
  2⤵
  PID:11484
- C:\Windows\System\PTTqChX.exe
  C:\Windows\System\PTTqChX.exe
  2⤵
  PID:11532
- C:\Windows\System\dyxClMj.exe
  C:\Windows\System\dyxClMj.exe
  2⤵
  PID:11556
- C:\Windows\System\pdFNmmo.exe
  C:\Windows\System\pdFNmmo.exe
  2⤵
  PID:11572
- C:\Windows\System\FSeEdkB.exe
  C:\Windows\System\FSeEdkB.exe
  2⤵
  PID:11604
- C:\Windows\System\mQIvCgy.exe
  C:\Windows\System\mQIvCgy.exe
  2⤵
  PID:11620
- C:\Windows\System\ZOFkscz.exe
  C:\Windows\System\ZOFkscz.exe
  2⤵
  PID:11672
- C:\Windows\System\AOLiOUP.exe
  C:\Windows\System\AOLiOUP.exe
  2⤵
  PID:11688
- C:\Windows\System\NUMQvwK.exe
  C:\Windows\System\NUMQvwK.exe
  2⤵
  PID:11716
- C:\Windows\System\zLAYPTU.exe
  C:\Windows\System\zLAYPTU.exe
  2⤵
  PID:11732
- C:\Windows\System\LzjKgnn.exe
  C:\Windows\System\LzjKgnn.exe
  2⤵
  PID:11756
- C:\Windows\System\lcYyRvR.exe
  C:\Windows\System\lcYyRvR.exe
  2⤵
  PID:11812
- C:\Windows\System\SCJdFpE.exe
  C:\Windows\System\SCJdFpE.exe
  2⤵
  PID:11840
- C:\Windows\System\VLiKlIZ.exe
  C:\Windows\System\VLiKlIZ.exe
  2⤵
  PID:11860
- C:\Windows\System\LBDMntN.exe
  C:\Windows\System\LBDMntN.exe
  2⤵
  PID:11884
- C:\Windows\System\WRPwZmz.exe
  C:\Windows\System\WRPwZmz.exe
  2⤵
  PID:11904
- C:\Windows\System\wHFmFwy.exe
  C:\Windows\System\wHFmFwy.exe
  2⤵
  PID:11944
- C:\Windows\System\OwdeafJ.exe
  C:\Windows\System\OwdeafJ.exe
  2⤵
  PID:11960
- C:\Windows\System\nSPYMQM.exe
  C:\Windows\System\nSPYMQM.exe
  2⤵
  PID:12204
- C:\Windows\System\ZyCyRRM.exe
  C:\Windows\System\ZyCyRRM.exe
  2⤵
  PID:12228
- C:\Windows\System\QIZYmeO.exe
  C:\Windows\System\QIZYmeO.exe
  2⤵
  PID:12244
- C:\Windows\System\fYYYfCN.exe
  C:\Windows\System\fYYYfCN.exe
  2⤵
  PID:12280
- C:\Windows\System\VzjZCFP.exe
  C:\Windows\System\VzjZCFP.exe
  2⤵
  PID:4668
- C:\Windows\System\FtLJAix.exe
  C:\Windows\System\FtLJAix.exe
  2⤵
  PID:11320
- C:\Windows\System\nIWMwGP.exe
  C:\Windows\System\nIWMwGP.exe
  2⤵
  PID:11360
- C:\Windows\System\OFIdUdY.exe
  C:\Windows\System\OFIdUdY.exe
  2⤵
  PID:11432
- C:\Windows\System\eOKxOMH.exe
  C:\Windows\System\eOKxOMH.exe
  2⤵
  PID:11540
- C:\Windows\System\BRRBCoG.exe
  C:\Windows\System\BRRBCoG.exe
  2⤵
  PID:11588
- C:\Windows\System\ZlnfNJH.exe
  C:\Windows\System\ZlnfNJH.exe
  2⤵
  PID:11684
- C:\Windows\System\aXrzJTe.exe
  C:\Windows\System\aXrzJTe.exe
  2⤵
  PID:11728
- C:\Windows\System\fncvjOD.exe
  C:\Windows\System\fncvjOD.exe
  2⤵
  PID:11776
- C:\Windows\System\tpqxCxs.exe
  C:\Windows\System\tpqxCxs.exe
  2⤵
  PID:11868
- C:\Windows\System\PBcrftG.exe
  C:\Windows\System\PBcrftG.exe
  2⤵
  PID:11928
- C:\Windows\System\PlBuTnZ.exe
  C:\Windows\System\PlBuTnZ.exe
  2⤵
  PID:12012
- C:\Windows\System\gxWwcwI.exe
  C:\Windows\System\gxWwcwI.exe
  2⤵
  PID:12048
- C:\Windows\System\LjNkGut.exe
  C:\Windows\System\LjNkGut.exe
  2⤵
  PID:12072
- C:\Windows\System\CrwbOEd.exe
  C:\Windows\System\CrwbOEd.exe
  2⤵
  PID:12112
- C:\Windows\System\uwjVyJA.exe
  C:\Windows\System\uwjVyJA.exe
  2⤵
  PID:12148
- C:\Windows\System\skTpsLB.exe
  C:\Windows\System\skTpsLB.exe
  2⤵
  PID:12192
- C:\Windows\System\ySqVACx.exe
  C:\Windows\System\ySqVACx.exe
  2⤵
  PID:12184
- C:\Windows\System\wAeuGDe.exe
  C:\Windows\System\wAeuGDe.exe
  2⤵
  PID:12212
- C:\Windows\System\fsVyEYR.exe
  C:\Windows\System\fsVyEYR.exe
  2⤵
  PID:10604
- C:\Windows\System\ZtDNHZA.exe
  C:\Windows\System\ZtDNHZA.exe
  2⤵
  PID:11380
- C:\Windows\System\aIYzWpk.exe
  C:\Windows\System\aIYzWpk.exe
  2⤵
  PID:11396
- C:\Windows\System\AjRxeLr.exe
  C:\Windows\System\AjRxeLr.exe
  2⤵
  PID:11548
- C:\Windows\System\bNoqgRX.exe
  C:\Windows\System\bNoqgRX.exe
  2⤵
  PID:11656
- C:\Windows\System\VajztPl.exe
  C:\Windows\System\VajztPl.exe
  2⤵
  PID:11856
- C:\Windows\System\usRiJNI.exe
  C:\Windows\System\usRiJNI.exe
  2⤵
  PID:12008
- C:\Windows\System\DFunSqe.exe
  C:\Windows\System\DFunSqe.exe
  2⤵
  PID:12120
- C:\Windows\System\xHBeHGQ.exe
  C:\Windows\System\xHBeHGQ.exe
  2⤵
  PID:12052
- C:\Windows\System\brzTkMn.exe
  C:\Windows\System\brzTkMn.exe
  2⤵
  PID:12216
- C:\Windows\System\eNZWGvw.exe
  C:\Windows\System\eNZWGvw.exe
  2⤵
  PID:11704
- C:\Windows\System\vIdBTwU.exe
  C:\Windows\System\vIdBTwU.exe
  2⤵
  PID:12124
- C:\Windows\System\VLgjkDr.exe
  C:\Windows\System\VLgjkDr.exe
  2⤵
  PID:11612
- C:\Windows\System\CDrolNC.exe
  C:\Windows\System\CDrolNC.exe
  2⤵
  PID:11892
- C:\Windows\System\uLZwnKD.exe
  C:\Windows\System\uLZwnKD.exe
  2⤵
  PID:12304
- C:\Windows\System\nIUvusd.exe
  C:\Windows\System\nIUvusd.exe
  2⤵
  PID:12320
- C:\Windows\System\GOxWOjw.exe
  C:\Windows\System\GOxWOjw.exe
  2⤵
  PID:12340
- C:\Windows\System\NaJbyka.exe
  C:\Windows\System\NaJbyka.exe
  2⤵
  PID:12364
- C:\Windows\System\axgNRml.exe
  C:\Windows\System\axgNRml.exe
  2⤵
  PID:12392
- C:\Windows\System\dBJCSPC.exe
  C:\Windows\System\dBJCSPC.exe
  2⤵
  PID:12420
- C:\Windows\System\daJeoxk.exe
  C:\Windows\System\daJeoxk.exe
  2⤵
  PID:12444
- C:\Windows\System\JnhsOae.exe
  C:\Windows\System\JnhsOae.exe
  2⤵
  PID:12496
- C:\Windows\System\mCbnunQ.exe
  C:\Windows\System\mCbnunQ.exe
  2⤵
  PID:12516
- C:\Windows\System\ZqmukTP.exe
  C:\Windows\System\ZqmukTP.exe
  2⤵
  PID:12536
- C:\Windows\System\TXGZnRV.exe
  C:\Windows\System\TXGZnRV.exe
  2⤵
  PID:12572
- C:\Windows\System\duqhTwB.exe
  C:\Windows\System\duqhTwB.exe
  2⤵
  PID:12596
- C:\Windows\System\BhZaBrE.exe
  C:\Windows\System\BhZaBrE.exe
  2⤵
  PID:12640
- C:\Windows\System\JwZFpaM.exe
  C:\Windows\System\JwZFpaM.exe
  2⤵
  PID:12656
- C:\Windows\System\qWEcKEJ.exe
  C:\Windows\System\qWEcKEJ.exe
  2⤵
  PID:12684
- C:\Windows\System\fnGqvOi.exe
  C:\Windows\System\fnGqvOi.exe
  2⤵
  PID:12700
- C:\Windows\System\DuqExNd.exe
  C:\Windows\System\DuqExNd.exe
  2⤵
  PID:12740
- C:\Windows\System\orOGlJd.exe
  C:\Windows\System\orOGlJd.exe
  2⤵
  PID:12764
- C:\Windows\System\rQtBWIY.exe
  C:\Windows\System\rQtBWIY.exe
  2⤵
  PID:12784
- C:\Windows\System\CEqPOQW.exe
  C:\Windows\System\CEqPOQW.exe
  2⤵
  PID:12800
- C:\Windows\System\LQgYiQU.exe
  C:\Windows\System\LQgYiQU.exe
  2⤵
  PID:12840
- C:\Windows\System\gdoRkwr.exe
  C:\Windows\System\gdoRkwr.exe
  2⤵
  PID:12876
- C:\Windows\System\oNBCObL.exe
  C:\Windows\System\oNBCObL.exe
  2⤵
  PID:12904
- C:\Windows\System\IqFnSLt.exe
  C:\Windows\System\IqFnSLt.exe
  2⤵
  PID:12936
- C:\Windows\System\BJfqFit.exe
  C:\Windows\System\BJfqFit.exe
  2⤵
  PID:12964
- C:\Windows\System\rxIixTB.exe
  C:\Windows\System\rxIixTB.exe
  2⤵
  PID:12984
- C:\Windows\System\SToABvY.exe
  C:\Windows\System\SToABvY.exe
  2⤵
  PID:13008
- C:\Windows\System\SmmjzFU.exe
  C:\Windows\System\SmmjzFU.exe
  2⤵
  PID:13032
- C:\Windows\System\iTrfvDg.exe
  C:\Windows\System\iTrfvDg.exe
  2⤵
  PID:13080
- C:\Windows\System\uMaHfLi.exe
  C:\Windows\System\uMaHfLi.exe
  2⤵
  PID:13096
- C:\Windows\System\CYcxiUf.exe
  C:\Windows\System\CYcxiUf.exe
  2⤵
  PID:13120
- C:\Windows\System\piLMadT.exe
  C:\Windows\System\piLMadT.exe
  2⤵
  PID:13152
- C:\Windows\System\FYcRydq.exe
  C:\Windows\System\FYcRydq.exe
  2⤵
  PID:13192
- C:\Windows\System\eCKrdti.exe
  C:\Windows\System\eCKrdti.exe
  2⤵
  PID:13208
- C:\Windows\System\UXwojxI.exe
  C:\Windows\System\UXwojxI.exe
  2⤵
  PID:13228
- C:\Windows\System\IVlmxLQ.exe
  C:\Windows\System\IVlmxLQ.exe
  2⤵
  PID:13252
- C:\Windows\System\NXPwkAm.exe
  C:\Windows\System\NXPwkAm.exe
  2⤵
  PID:13276
- C:\Windows\System\sdYHgSV.exe
  C:\Windows\System\sdYHgSV.exe
  2⤵
  PID:13308
- C:\Windows\System\nRdSbTd.exe
  C:\Windows\System\nRdSbTd.exe
  2⤵
  PID:12356
- C:\Windows\System\PyCcPfc.exe
  C:\Windows\System\PyCcPfc.exe
  2⤵
  PID:12372
- C:\Windows\System\BUXKXqS.exe
  C:\Windows\System\BUXKXqS.exe
  2⤵
  PID:12432
- C:\Windows\System\JEDwpKk.exe
  C:\Windows\System\JEDwpKk.exe
  2⤵
  PID:12504
- C:\Windows\System\oBhXiUl.exe
  C:\Windows\System\oBhXiUl.exe
  2⤵
  PID:12532
- C:\Windows\System\UrDpWfq.exe
  C:\Windows\System\UrDpWfq.exe
  2⤵
  PID:12588
- C:\Windows\System\IDeCuQD.exe
  C:\Windows\System\IDeCuQD.exe
  2⤵
  PID:12692
- C:\Windows\System\kfSFWYg.exe
  C:\Windows\System\kfSFWYg.exe
  2⤵
  PID:12696
- C:\Windows\System\HPhpBKm.exe
  C:\Windows\System\HPhpBKm.exe
  2⤵
  PID:12832
- C:\Windows\System\orzbKnH.exe
  C:\Windows\System\orzbKnH.exe
  2⤵
  PID:12868
- C:\Windows\System\YhapUOE.exe
  C:\Windows\System\YhapUOE.exe
  2⤵
  PID:13024
- C:\Windows\System\hydNJHG.exe
  C:\Windows\System\hydNJHG.exe
  2⤵
  PID:13044
- C:\Windows\System\pypjdgY.exe
  C:\Windows\System\pypjdgY.exe
  2⤵
  PID:13136
- C:\Windows\System\BIgJOJe.exe
  C:\Windows\System\BIgJOJe.exe
  2⤵
  PID:13288
- C:\Windows\System\SWuFulb.exe
  C:\Windows\System\SWuFulb.exe
  2⤵
  PID:13248
- C:\Windows\System\LmBXrXP.exe
  C:\Windows\System\LmBXrXP.exe
  2⤵
  PID:12296
- C:\Windows\System\QWefhkp.exe
  C:\Windows\System\QWefhkp.exe
  2⤵
  PID:12360
- C:\Windows\System\RLidZdJ.exe
  C:\Windows\System\RLidZdJ.exe
  2⤵
  PID:12632
- C:\Windows\System\OhaQovh.exe
  C:\Windows\System\OhaQovh.exe
  2⤵
  PID:12556
- C:\Windows\System\nETDsXE.exe
  C:\Windows\System\nETDsXE.exe
  2⤵
  PID:12892
- C:\Windows\System\tCMajKN.exe
  C:\Windows\System\tCMajKN.exe
  2⤵
  PID:13176
- C:\Windows\System\FiOQEkL.exe
  C:\Windows\System\FiOQEkL.exe
  2⤵
  PID:13220
- C:\Windows\System\USUdNKq.exe
  C:\Windows\System\USUdNKq.exe
  2⤵
  PID:12440
- C:\Windows\System\LdlcPzQ.exe
  C:\Windows\System\LdlcPzQ.exe
  2⤵
  PID:12848
- C:\Windows\System\JwOYVWz.exe
  C:\Windows\System\JwOYVWz.exe
  2⤵
  PID:11508
- C:\Windows\System\DoqnokN.exe
  C:\Windows\System\DoqnokN.exe
  2⤵
  PID:12408
- C:\Windows\System\VoUiVFG.exe
  C:\Windows\System\VoUiVFG.exe
  2⤵
  PID:13320
- C:\Windows\System\xFvYvYo.exe
  C:\Windows\System\xFvYvYo.exe
  2⤵
  PID:13368
- C:\Windows\System\zOrCMBv.exe
  C:\Windows\System\zOrCMBv.exe
  2⤵
  PID:13388
- C:\Windows\System\cKGMcBS.exe
  C:\Windows\System\cKGMcBS.exe
  2⤵
  PID:13428
- C:\Windows\System\wAFpWVF.exe
  C:\Windows\System\wAFpWVF.exe
  2⤵
  PID:13456
- C:\Windows\System\AcjMOdH.exe
  C:\Windows\System\AcjMOdH.exe
  2⤵
  PID:13484
- C:\Windows\System\KbvOKNH.exe
  C:\Windows\System\KbvOKNH.exe
  2⤵
  PID:13508
- C:\Windows\System\gunMLEt.exe
  C:\Windows\System\gunMLEt.exe
  2⤵
  PID:13536
- C:\Windows\System\HyegktR.exe
  C:\Windows\System\HyegktR.exe
  2⤵
  PID:13568
- C:\Windows\System\sKzysCH.exe
  C:\Windows\System\sKzysCH.exe
  2⤵
  PID:13592
- C:\Windows\System\QXDNrbS.exe
  C:\Windows\System\QXDNrbS.exe
  2⤵
  PID:13612
- C:\Windows\System\kgWjWbQ.exe
  C:\Windows\System\kgWjWbQ.exe
  2⤵
  PID:13636
- C:\Windows\System\eErOumw.exe
  C:\Windows\System\eErOumw.exe
  2⤵
  PID:13656
- C:\Windows\System\WhVrfOO.exe
  C:\Windows\System\WhVrfOO.exe
  2⤵
  PID:13680
- C:\Windows\System\cuHwnEC.exe
  C:\Windows\System\cuHwnEC.exe
  2⤵
  PID:13712
- C:\Windows\System\pDFUQKB.exe
  C:\Windows\System\pDFUQKB.exe
  2⤵
  PID:13764
- C:\Windows\System\wwteEBV.exe
  C:\Windows\System\wwteEBV.exe
  2⤵
  PID:13792
- C:\Windows\System\UIUrAZO.exe
  C:\Windows\System\UIUrAZO.exe
  2⤵
  PID:13812
- C:\Windows\System\rkrUTvm.exe
  C:\Windows\System\rkrUTvm.exe
  2⤵
  PID:13840
- C:\Windows\System\XIUbYeL.exe
  C:\Windows\System\XIUbYeL.exe
  2⤵
  PID:13868
- C:\Windows\System\RQtHlbm.exe
  C:\Windows\System\RQtHlbm.exe
  2⤵
  PID:13888
- C:\Windows\System\LkdKipV.exe
  C:\Windows\System\LkdKipV.exe
  2⤵
  PID:13920
- C:\Windows\System\RMQkPWC.exe
  C:\Windows\System\RMQkPWC.exe
  2⤵
  PID:13960
- C:\Windows\System\RaRPzaT.exe
  C:\Windows\System\RaRPzaT.exe
  2⤵
  PID:13992
- C:\Windows\System\rzqrJbY.exe
  C:\Windows\System\rzqrJbY.exe
  2⤵
  PID:14008
- C:\Windows\System\ggbdlxG.exe
  C:\Windows\System\ggbdlxG.exe
  2⤵
  PID:14036
- C:\Windows\System\FavWuAn.exe
  C:\Windows\System\FavWuAn.exe
  2⤵
  PID:14052
- C:\Windows\System\ckZBXtk.exe
  C:\Windows\System\ckZBXtk.exe
  2⤵
  PID:14084
- C:\Windows\System\IruwILw.exe
  C:\Windows\System\IruwILw.exe
  2⤵
  PID:14104
- C:\Windows\System\xflGycd.exe
  C:\Windows\System\xflGycd.exe
  2⤵
  PID:14128
- C:\Windows\System\jNTGMWt.exe
  C:\Windows\System\jNTGMWt.exe
  2⤵
  PID:14148
- C:\Windows\System\RwUIXem.exe
  C:\Windows\System\RwUIXem.exe
  2⤵
  PID:14200
- C:\Windows\System\XcLwUMp.exe
  C:\Windows\System\XcLwUMp.exe
  2⤵
  PID:14228
- C:\Windows\System\TRsOywa.exe
  C:\Windows\System\TRsOywa.exe
  2⤵
  PID:14248
- C:\Windows\System\ySAzMPf.exe
  C:\Windows\System\ySAzMPf.exe
  2⤵
  PID:14264
- C:\Windows\System\lqjjBmj.exe
  C:\Windows\System\lqjjBmj.exe
  2⤵
  PID:14288
- C:\Windows\System\pkWsYFG.exe
  C:\Windows\System\pkWsYFG.exe
  2⤵
  PID:12316
- C:\Windows\System\IgCAOUj.exe
  C:\Windows\System\IgCAOUj.exe
  2⤵
  PID:13376
- C:\Windows\System\KUSUFDu.exe
  C:\Windows\System\KUSUFDu.exe
  2⤵
  PID:13448
- C:\Windows\System\iONeiOQ.exe
  C:\Windows\System\iONeiOQ.exe
  2⤵
  PID:13532
- C:\Windows\System\klsVfyp.exe
  C:\Windows\System\klsVfyp.exe
  2⤵
  PID:13564
- C:\Windows\System\qleLbrP.exe
  C:\Windows\System\qleLbrP.exe
  2⤵
  PID:13620
- C:\Windows\System\IgSeHvj.exe
  C:\Windows\System\IgSeHvj.exe
  2⤵
  PID:13652
- C:\Windows\System\WfXQFOO.exe
  C:\Windows\System\WfXQFOO.exe
  2⤵
  PID:13732
- C:\Windows\System\UucyAzc.exe
  C:\Windows\System\UucyAzc.exe
  2⤵
  PID:13808
- C:\Windows\System\OOMzzbS.exe
  C:\Windows\System\OOMzzbS.exe
  2⤵
  PID:13912
- C:\Windows\System\yoCMQYF.exe
  C:\Windows\System\yoCMQYF.exe
  2⤵
  PID:13956
- C:\Windows\System\UtMyedd.exe
  C:\Windows\System\UtMyedd.exe
  2⤵
  PID:14004
- C:\Windows\System\UBgAPeM.exe
  C:\Windows\System\UBgAPeM.exe
  2⤵
  PID:14064
- C:\Windows\System\JVqDPnf.exe
  C:\Windows\System\JVqDPnf.exe
  2⤵
  PID:14124
- C:\Windows\System\wIiyhaa.exe
  C:\Windows\System\wIiyhaa.exe
  2⤵
  PID:14196
- C:\Windows\System\HsAkiot.exe
  C:\Windows\System\HsAkiot.exe
  2⤵
  PID:14244
- C:\Windows\System\mTyEpvp.exe
  C:\Windows\System\mTyEpvp.exe
  2⤵
  PID:14332
- C:\Windows\System\JczuqRP.exe
  C:\Windows\System\JczuqRP.exe
  2⤵
  PID:13384
- C:\Windows\System\oHcuivN.exe
  C:\Windows\System\oHcuivN.exe
  2⤵
  PID:13608
- C:\Windows\System\WzKLTal.exe
  C:\Windows\System\WzKLTal.exe
  2⤵
  PID:13776
- C:\Windows\System\UTSEuRm.exe
  C:\Windows\System\UTSEuRm.exe
  2⤵
  PID:14000
- C:\Windows\System\JgPhGPz.exe
  C:\Windows\System\JgPhGPz.exe
  2⤵
  PID:14068
- C:\Windows\System\cYFeBZC.exe
  C:\Windows\System\cYFeBZC.exe
  2⤵
  PID:14216
- C:\Windows\System\qDUrrck.exe
  C:\Windows\System\qDUrrck.exe
  2⤵
  PID:13500
- C:\Windows\System\mWzwfHr.exe
  C:\Windows\System\mWzwfHr.exe
  2⤵
  PID:13676
- C:\Windows\System\QGWwwPS.exe
  C:\Windows\System\QGWwwPS.exe
  2⤵
  PID:14144
- C:\Windows\System\QCSLhOF.exe
  C:\Windows\System\QCSLhOF.exe
  2⤵
  PID:13704
- C:\Windows\System\ucZLotM.exe
  C:\Windows\System\ucZLotM.exe
  2⤵
  PID:14364
- C:\Windows\System\eLAKYUt.exe
  C:\Windows\System\eLAKYUt.exe
  2⤵
  PID:14408
- C:\Windows\System\VjFwMqB.exe
  C:\Windows\System\VjFwMqB.exe
  2⤵
  PID:14424
- C:\Windows\System\XuXdwyq.exe
  C:\Windows\System\XuXdwyq.exe
  2⤵
  PID:14440
- C:\Windows\System\eMZXVmD.exe
  C:\Windows\System\eMZXVmD.exe
  2⤵
  PID:14460
- C:\Windows\System\KkOBpJo.exe
  C:\Windows\System\KkOBpJo.exe
  2⤵
  PID:14496
- C:\Windows\System\QgxEsQO.exe
  C:\Windows\System\QgxEsQO.exe
  2⤵
  PID:14516
- C:\Windows\System\oBcxoVg.exe
  C:\Windows\System\oBcxoVg.exe
  2⤵
  PID:14544
- C:\Windows\System\ohaIToD.exe
  C:\Windows\System\ohaIToD.exe
  2⤵
  PID:14604
- C:\Windows\System\roBLPvD.exe
  C:\Windows\System\roBLPvD.exe
  2⤵
  PID:14620
- C:\Windows\System\aQTFMYM.exe
  C:\Windows\System\aQTFMYM.exe
  2⤵
  PID:14636
- C:\Windows\System\daJRhvD.exe
  C:\Windows\System\daJRhvD.exe
  2⤵
  PID:14688
- C:\Windows\System\KblYwGE.exe
  C:\Windows\System\KblYwGE.exe
  2⤵
  PID:14728
- C:\Windows\System\jLaQZub.exe
  C:\Windows\System\jLaQZub.exe
  2⤵
  PID:14748
- C:\Windows\System\ymbekXf.exe
  C:\Windows\System\ymbekXf.exe
  2⤵
  PID:14768
- C:\Windows\System\IwCWHDH.exe
  C:\Windows\System\IwCWHDH.exe
  2⤵
  PID:14792
- C:\Windows\System\zQFPTnS.exe
  C:\Windows\System\zQFPTnS.exe
  2⤵
  PID:14808
- C:\Windows\System\IvvaHUZ.exe
  C:\Windows\System\IvvaHUZ.exe
  2⤵
  PID:14828
- C:\Windows\System\vqRWasU.exe
  C:\Windows\System\vqRWasU.exe
  2⤵
  PID:14864
- C:\Windows\System\QQXbxMX.exe
  C:\Windows\System\QQXbxMX.exe
  2⤵
  PID:14892
- C:\Windows\System\utyRuXl.exe
  C:\Windows\System\utyRuXl.exe
  2⤵
  PID:14936
- C:\Windows\System\fvvirYU.exe
  C:\Windows\System\fvvirYU.exe
  2⤵
  PID:14964
- C:\Windows\System\KimYWAi.exe
  C:\Windows\System\KimYWAi.exe
  2⤵
  PID:14988
- C:\Windows\System\kMZhUBS.exe
  C:\Windows\System\kMZhUBS.exe
  2⤵
  PID:15004
- C:\Windows\System\yeGcDrt.exe
  C:\Windows\System\yeGcDrt.exe
  2⤵
  PID:15032
- C:\Windows\System\OagPaXI.exe
  C:\Windows\System\OagPaXI.exe
  2⤵
  PID:15060
- C:\Windows\System\DBRjlIb.exe
  C:\Windows\System\DBRjlIb.exe
  2⤵
  PID:15084
- C:\Windows\System\FAAUpzR.exe
  C:\Windows\System\FAAUpzR.exe
  2⤵
  PID:15108
- C:\Windows\System\UvHJaMy.exe
  C:\Windows\System\UvHJaMy.exe
  2⤵
  PID:15148
- C:\Windows\System\CzSFWlD.exe
  C:\Windows\System\CzSFWlD.exe
  2⤵
  PID:15172
- C:\Windows\System\nWAKrkj.exe
  C:\Windows\System\nWAKrkj.exe
  2⤵
  PID:15200
- C:\Windows\System\PcRxTzp.exe
  C:\Windows\System\PcRxTzp.exe
  2⤵
  PID:15224
- C:\Windows\System\BnaQrmA.exe
  C:\Windows\System\BnaQrmA.exe
  2⤵
  PID:15268
- C:\Windows\System\mVaiDrp.exe
  C:\Windows\System\mVaiDrp.exe
  2⤵
  PID:15284
- C:\Windows\System\ayKjUmH.exe
  C:\Windows\System\ayKjUmH.exe
  2⤵
  PID:15308
- C:\Windows\System\lrefMWJ.exe
  C:\Windows\System\lrefMWJ.exe
  2⤵
  PID:14280
- C:\Windows\System\PgApVlT.exe
  C:\Windows\System\PgApVlT.exe
  2⤵
  PID:14360
- C:\Windows\System\ROqUiYU.exe
  C:\Windows\System\ROqUiYU.exe
  2⤵
  PID:14400
- C:\Windows\System\gzJqlow.exe
  C:\Windows\System\gzJqlow.exe
  2⤵
  PID:14468
- C:\Windows\System\QhLFbCL.exe
  C:\Windows\System\QhLFbCL.exe
  2⤵
  PID:14488
- C:\Windows\System\mokRimI.exe
  C:\Windows\System\mokRimI.exe
  2⤵
  PID:14568
- C:\Windows\System\tYIAECJ.exe
  C:\Windows\System\tYIAECJ.exe
  2⤵
  PID:14696
- C:\Windows\System\Fvfxdvj.exe
  C:\Windows\System\Fvfxdvj.exe
  2⤵
  PID:14684
- C:\Windows\System\dIkQWjF.exe
  C:\Windows\System\dIkQWjF.exe
  2⤵
  PID:14776
- C:\Windows\System\iZeScNT.exe
  C:\Windows\System\iZeScNT.exe
  2⤵
  PID:14820
- C:\Windows\System\pZbhYpx.exe
  C:\Windows\System\pZbhYpx.exe
  2⤵
  PID:14904
- C:\Windows\System\ZRUiOab.exe
  C:\Windows\System\ZRUiOab.exe
  2⤵
  PID:14960
- C:\Windows\System\DGuuGlF.exe
  C:\Windows\System\DGuuGlF.exe
  2⤵
  PID:15044
- C:\Windows\System\AfeJINO.exe
  C:\Windows\System\AfeJINO.exe
  2⤵
  PID:15068
- C:\Windows\System\LjhNCJp.exe
  C:\Windows\System\LjhNCJp.exe
  2⤵
  PID:15096
- C:\Windows\System\DPnINCh.exe
  C:\Windows\System\DPnINCh.exe
  2⤵
  PID:15128
- C:\Windows\System\ieYtntb.exe
  C:\Windows\System\ieYtntb.exe
  2⤵
  PID:15296
- C:\Windows\System\ceTdGrt.exe
  C:\Windows\System\ceTdGrt.exe
  2⤵
  PID:14344
- C:\Windows\System\mICEtyC.exe
  C:\Windows\System\mICEtyC.exe
  2⤵
  PID:14432
- C:\Windows\System\YuVObkl.exe
  C:\Windows\System\YuVObkl.exe
  2⤵
  PID:14552
- C:\Windows\System\mjuILJp.exe
  C:\Windows\System\mjuILJp.exe
  2⤵
  PID:14664
- C:\Windows\System\bfTOHbZ.exe
  C:\Windows\System\bfTOHbZ.exe
  2⤵
  PID:14824
- C:\Windows\System\JTeLdzN.exe
  C:\Windows\System\JTeLdzN.exe
  2⤵
  PID:14928
- C:\Windows\System\GybqsfT.exe
  C:\Windows\System\GybqsfT.exe
  2⤵
  PID:15028
- C:\Windows\System\AmObOtS.exe
  C:\Windows\System\AmObOtS.exe
  2⤵
  PID:15356
- C:\Windows\System\BlSIHLe.exe
  C:\Windows\System\BlSIHLe.exe
  2⤵
  PID:14380
- C:\Windows\System\YFYMqdP.exe
  C:\Windows\System\YFYMqdP.exe
  2⤵
  PID:14596
- C:\Windows\System\IDkwxic.exe
  C:\Windows\System\IDkwxic.exe
  2⤵
  PID:14836
- C:\Windows\System\QKWmOBT.exe
  C:\Windows\System\QKWmOBT.exe
  2⤵
  PID:15280
- C:\Windows\System\IYGQjLG.exe
  C:\Windows\System\IYGQjLG.exe
  2⤵
  PID:15368
- C:\Windows\System\VPWNiuF.exe
  C:\Windows\System\VPWNiuF.exe
  2⤵
  PID:15392
- C:\Windows\System\DmLeWwn.exe
  C:\Windows\System\DmLeWwn.exe
  2⤵
  PID:15420
- C:\Windows\System\QSjSfcQ.exe
  C:\Windows\System\QSjSfcQ.exe
  2⤵
  PID:15452
- C:\Windows\System\CrclrvC.exe
  C:\Windows\System\CrclrvC.exe
  2⤵
  PID:15468
- C:\Windows\System\kCpuCHK.exe
  C:\Windows\System\kCpuCHK.exe
  2⤵
  PID:15488
- C:\Windows\System\IvAARws.exe
  C:\Windows\System\IvAARws.exe
  2⤵
  PID:15508
- C:\Windows\System\pRPrKYy.exe
  C:\Windows\System\pRPrKYy.exe
  2⤵
  PID:15532
- C:\Windows\System\ogfFhdA.exe
  C:\Windows\System\ogfFhdA.exe
  2⤵
  PID:15548
- C:\Windows\System\VUiIVNy.exe
  C:\Windows\System\VUiIVNy.exe
  2⤵
  PID:15568
- C:\Windows\System\ibWWMWX.exe
  C:\Windows\System\ibWWMWX.exe
  2⤵
  PID:15584
- C:\Windows\System\yBjbRkG.exe
  C:\Windows\System\yBjbRkG.exe
  2⤵
  PID:15608
- C:\Windows\System\Zrwbrgi.exe
  C:\Windows\System\Zrwbrgi.exe
  2⤵
  PID:15632
- C:\Windows\System\EuBaqcd.exe
  C:\Windows\System\EuBaqcd.exe
  2⤵
  PID:15648
- C:\Windows\System\bXFNXJo.exe
  C:\Windows\System\bXFNXJo.exe
  2⤵
  PID:15672
- C:\Windows\System\ybLTkqC.exe
  C:\Windows\System\ybLTkqC.exe
  2⤵
  PID:15692
- C:\Windows\System\RgRzlBK.exe
  C:\Windows\System\RgRzlBK.exe
  2⤵
  PID:15724
- C:\Windows\System\dYIFHYD.exe
  C:\Windows\System\dYIFHYD.exe
  2⤵
  PID:15752
- C:\Windows\System\wCGgkkD.exe
  C:\Windows\System\wCGgkkD.exe
  2⤵
  PID:15776
- C:\Windows\System\QXguHak.exe
  C:\Windows\System\QXguHak.exe
  2⤵
  PID:15792
- C:\Windows\System\YvaqwPn.exe
  C:\Windows\System\YvaqwPn.exe
  2⤵
  PID:15816
- C:\Windows\System\ySaqzmI.exe
  C:\Windows\System\ySaqzmI.exe
  2⤵
  PID:15840
- C:\Windows\System\tElqsQu.exe
  C:\Windows\System\tElqsQu.exe
  2⤵
  PID:15856
- C:\Windows\System\lHCsBnf.exe
  C:\Windows\System\lHCsBnf.exe
  2⤵
  PID:15888
- C:\Windows\System\TerZMax.exe
  C:\Windows\System\TerZMax.exe
  2⤵
  PID:15908
- C:\Windows\System\QXNhHKZ.exe
  C:\Windows\System\QXNhHKZ.exe
  2⤵
  PID:15936
- C:\Windows\System\NEFDtii.exe
  C:\Windows\System\NEFDtii.exe
  2⤵
  PID:15956
- C:\Windows\System\ROKgDIz.exe
  C:\Windows\System\ROKgDIz.exe
  2⤵
  PID:15972
- C:\Windows\System\dsVEGwQ.exe
  C:\Windows\System\dsVEGwQ.exe
  2⤵
  PID:15996
- C:\Windows\System\oWLwzIA.exe
  C:\Windows\System\oWLwzIA.exe
  2⤵
  PID:16012
- C:\Windows\System\SBFCONc.exe
  C:\Windows\System\SBFCONc.exe
  2⤵
  PID:16044
- C:\Windows\System\YJeimsG.exe
  C:\Windows\System\YJeimsG.exe
  2⤵
  PID:16068
- C:\Windows\System\NItNRTR.exe
  C:\Windows\System\NItNRTR.exe
  2⤵
  PID:16096
- C:\Windows\System\FsPLddW.exe
  C:\Windows\System\FsPLddW.exe
  2⤵
  PID:16112
- C:\Windows\System\IMvTRBV.exe
  C:\Windows\System\IMvTRBV.exe
  2⤵
  PID:16132
- C:\Windows\System\wthAiDe.exe
  C:\Windows\System\wthAiDe.exe
  2⤵
  PID:16152
- C:\Windows\System\UUdPJwI.exe
  C:\Windows\System\UUdPJwI.exe
  2⤵
  PID:16172
- C:\Windows\System\OWsxzJR.exe
  C:\Windows\System\OWsxzJR.exe
  2⤵
  PID:16196
- C:\Windows\System\EKRMTNP.exe
  C:\Windows\System\EKRMTNP.exe
  2⤵
  PID:16224
- C:\Windows\System\rUScxhN.exe
  C:\Windows\System\rUScxhN.exe
  2⤵
  PID:16244
- C:\Windows\System\WveUhkq.exe
  C:\Windows\System\WveUhkq.exe
  2⤵
  PID:16268
- C:\Windows\System\AUnIAtH.exe
  C:\Windows\System\AUnIAtH.exe
  2⤵
  PID:16292
- C:\Windows\System\CnEKbro.exe
  C:\Windows\System\CnEKbro.exe
  2⤵
  PID:16320
- C:\Windows\System\GCbMbiK.exe
  C:\Windows\System\GCbMbiK.exe
  2⤵
  PID:16336
- C:\Windows\System\dZbXWjV.exe
  C:\Windows\System\dZbXWjV.exe
  2⤵
  PID:16360
- C:\Windows\System\ujUWjbA.exe
  C:\Windows\System\ujUWjbA.exe
  2⤵
  PID:15104
- C:\Windows\System\rgpSQor.exe
  C:\Windows\System\rgpSQor.exe
  2⤵
  PID:15380
- C:\Windows\System\GXFypma.exe
  C:\Windows\System\GXFypma.exe
  2⤵
  PID:15496
- C:\Windows\System\QlClhzG.exe
  C:\Windows\System\QlClhzG.exe
  2⤵
  PID:15440
- C:\Windows\System\zDOhOcj.exe
  C:\Windows\System\zDOhOcj.exe
  2⤵
  PID:15524
- C:\Windows\System\XGyDYRM.exe
  C:\Windows\System\XGyDYRM.exe
  2⤵
  PID:15700
- C:\Windows\System\xcDNzCP.exe
  C:\Windows\System\xcDNzCP.exe
  2⤵
  PID:15628
- C:\Windows\System\ulBOutz.exe
  C:\Windows\System\ulBOutz.exe
  2⤵
  PID:15720
- C:\Windows\System\OEcQosm.exe
  C:\Windows\System\OEcQosm.exe
  2⤵
  PID:15620
- C:\Windows\System\PsITaFH.exe
  C:\Windows\System\PsITaFH.exe
  2⤵
  PID:15764
- C:\Windows\System\SIWpkTL.exe
  C:\Windows\System\SIWpkTL.exe
  2⤵
  PID:15988
- C:\Windows\System\ESelBzH.exe
  C:\Windows\System\ESelBzH.exe
  2⤵
  PID:15744
- C:\Windows\System\TdEFfcs.exe
  C:\Windows\System\TdEFfcs.exe
  2⤵
  PID:16160
- C:\Windows\System\EVVNuvc.exe
  C:\Windows\System\EVVNuvc.exe
  2⤵
  PID:15964
- C:\Windows\System\kAFRNak.exe
  C:\Windows\System\kAFRNak.exe
  2⤵
  PID:16024
- C:\Windows\System\yFTEbCR.exe
  C:\Windows\System\yFTEbCR.exe
  2⤵
  PID:16260
- C:\Windows\System\qlNpcJO.exe
  C:\Windows\System\qlNpcJO.exe
  2⤵
  PID:16124
- C:\Windows\System\hXHtHqd.exe
  C:\Windows\System\hXHtHqd.exe
  2⤵
  PID:16372
- C:\Windows\System\DgNqzPr.exe
  C:\Windows\System\DgNqzPr.exe
  2⤵
  PID:15416
- C:\Windows\System\asgpwfT.exe
  C:\Windows\System\asgpwfT.exe
  2⤵
  PID:15712
- C:\Windows\System\CVLbxEr.exe
  C:\Windows\System\CVLbxEr.exe
  2⤵
  PID:16284
- C:\Windows\System\AojXreB.exe
  C:\Windows\System\AojXreB.exe
  2⤵
  PID:16388
- C:\Windows\System\chxHwnp.exe
  C:\Windows\System\chxHwnp.exe
  2⤵
  PID:16412
- C:\Windows\System\XwmOeXu.exe
  C:\Windows\System\XwmOeXu.exe
  2⤵
  PID:16436
- C:\Windows\System\aJNTpaH.exe
  C:\Windows\System\aJNTpaH.exe
  2⤵
  PID:16464
- C:\Windows\System\IZBwoHy.exe
  C:\Windows\System\IZBwoHy.exe
  2⤵
  PID:16480
- C:\Windows\System\zuqjkXR.exe
  C:\Windows\System\zuqjkXR.exe
  2⤵
  PID:16508
- C:\Windows\System\QqlqUIM.exe
  C:\Windows\System\QqlqUIM.exe
  2⤵
  PID:16540
- C:\Windows\System\KVugYue.exe
  C:\Windows\System\KVugYue.exe
  2⤵
  PID:16564
- C:\Windows\System\YfoqQYy.exe
  C:\Windows\System\YfoqQYy.exe
  2⤵
  PID:16580
- C:\Windows\System\bnPoHLB.exe
  C:\Windows\System\bnPoHLB.exe
  2⤵
  PID:16608
- C:\Windows\System\aeRFCCE.exe
  C:\Windows\System\aeRFCCE.exe
  2⤵
  PID:16644
- C:\Windows\System\hMeVyHC.exe
  C:\Windows\System\hMeVyHC.exe
  2⤵
  PID:16660
- C:\Windows\System\HjxdXqX.exe
  C:\Windows\System\HjxdXqX.exe
  2⤵
  PID:16692
- C:\Windows\System\uAEntkm.exe
  C:\Windows\System\uAEntkm.exe
  2⤵
  PID:16712
- C:\Windows\System\QjMDQpm.exe
  C:\Windows\System\QjMDQpm.exe
  2⤵
  PID:16744
- C:\Windows\System\ZbYWqDW.exe
  C:\Windows\System\ZbYWqDW.exe
  2⤵
  PID:16760
- C:\Windows\System\rANxXGP.exe
  C:\Windows\System\rANxXGP.exe
  2⤵
  PID:16788
- C:\Windows\System\RrlOOyE.exe
  C:\Windows\System\RrlOOyE.exe
  2⤵
  PID:16820
- C:\Windows\System\XoyJyzH.exe
  C:\Windows\System\XoyJyzH.exe
  2⤵
  PID:16836
- C:\Windows\System\kkHyxyc.exe
  C:\Windows\System\kkHyxyc.exe
  2⤵
  PID:16852
- C:\Windows\System\EmRVtBd.exe
  C:\Windows\System\EmRVtBd.exe
  2⤵
  PID:16884
- C:\Windows\System\UvqOadt.exe
  C:\Windows\System\UvqOadt.exe
  2⤵
  PID:16908
- C:\Windows\System\YVemHKd.exe
  C:\Windows\System\YVemHKd.exe
  2⤵
  PID:16936
- C:\Windows\System\rFZCPhv.exe
  C:\Windows\System\rFZCPhv.exe
  2⤵
  PID:16964
- C:\Windows\System\cYxaWXu.exe
  C:\Windows\System\cYxaWXu.exe
  2⤵
  PID:16984
- C:\Windows\System\BDSUTTH.exe
  C:\Windows\System\BDSUTTH.exe
  2⤵
  PID:17000
- C:\Windows\System\tjtSCXk.exe
  C:\Windows\System\tjtSCXk.exe
  2⤵
  PID:17016
- C:\Windows\System\KheTGRh.exe
  C:\Windows\System\KheTGRh.exe
  2⤵
  PID:17032
- C:\Windows\System\FLjzfkh.exe
  C:\Windows\System\FLjzfkh.exe
  2⤵
  PID:17056
- C:\Windows\System\AXLKBYV.exe
  C:\Windows\System\AXLKBYV.exe
  2⤵
  PID:17088
- C:\Windows\System\umarFGS.exe
  C:\Windows\System\umarFGS.exe
  2⤵
  PID:17128
- C:\Windows\System\dBgGgfU.exe
  C:\Windows\System\dBgGgfU.exe
  2⤵
  PID:17144
- C:\Windows\System\nwTJjuM.exe
  C:\Windows\System\nwTJjuM.exe
  2⤵
  PID:17164
- C:\Windows\System\GGZJZFL.exe
  C:\Windows\System\GGZJZFL.exe
  2⤵
  PID:17184
- C:\Windows\System\XuUzNuC.exe
  C:\Windows\System\XuUzNuC.exe
  2⤵
  PID:17216
- C:\Windows\System\KCirRPu.exe
  C:\Windows\System\KCirRPu.exe
  2⤵
  PID:17236
- C:\Windows\System\cJinTRW.exe
  C:\Windows\System\cJinTRW.exe
  2⤵
  PID:17252
- C:\Windows\System\xURSzwN.exe
  C:\Windows\System\xURSzwN.exe
  2⤵
  PID:17276
- C:\Windows\System\WVMsaMw.exe
  C:\Windows\System\WVMsaMw.exe
  2⤵
  PID:17292
- C:\Windows\System\BatAtoV.exe
  C:\Windows\System\BatAtoV.exe
  2⤵
  PID:17312
- C:\Windows\System\ZEYeGWO.exe
  C:\Windows\System\ZEYeGWO.exe
  2⤵
  PID:17336
- C:\Windows\System\XdEAuFi.exe
  C:\Windows\System\XdEAuFi.exe
  2⤵
  PID:17352
- C:\Windows\System\BeBSphU.exe
  C:\Windows\System\BeBSphU.exe
  2⤵
  PID:17376
- C:\Windows\System\oKuOUNa.exe
  C:\Windows\System\oKuOUNa.exe
  2⤵
  PID:16524
- C:\Windows\System\uALxlHi.exe
  C:\Windows\System\uALxlHi.exe
  2⤵
  PID:16996
- C:\Windows\System\xMoBJGx.exe
  C:\Windows\System\xMoBJGx.exe
  2⤵
  PID:16376
- C:\Windows\System\bFBHqgU.exe
  C:\Windows\System\bFBHqgU.exe
  2⤵
  PID:15080
- C:\Windows\System\BhngJFu.exe
  C:\Windows\System\BhngJFu.exe
  2⤵
  PID:17176
- C:\Windows\System\PUBrhva.exe
  C:\Windows\System\PUBrhva.exe
  2⤵
  PID:17232
- C:\Windows\System\Yxdaizh.exe
  C:\Windows\System\Yxdaizh.exe
  2⤵
  PID:17284
- C:\Windows\System\NCXahLX.exe
  C:\Windows\System\NCXahLX.exe
  2⤵
  PID:17324
- C:\Windows\System\IeuRhQw.exe
  C:\Windows\System\IeuRhQw.exe
  2⤵
  PID:17396
- C:\Windows\System\yKAZBem.exe
  C:\Windows\System\yKAZBem.exe
  2⤵
  PID:16316

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:15848

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\EMqFikc.exe

Filesize
1.4MB

MD5
bcbb15ca2e213dd087b3832bd78ddead

SHA1
aa7dc50ae61a1e53ddeba6ab2c9f261b382cfe69

SHA256
c473d946796b556307185b83a5dac6f72eb208f774ebded0d81531c87c8c3950

SHA512
50bf112f7dd2ebc4a002c04e52471941fe90fbcb7f531705b98995700009c348d2ecc04fe410ad476c8faed50d17fed10a367294fc209db28c37e569a76aefc9

Download Submit
C:\Windows\System\FSmhlkr.exe

Filesize
1.4MB

MD5
b76cc21b60aa202fac708b94a189a85b

SHA1
70b2b3b98a7f7617a810489e23f8f077a799fe16

SHA256
c58936bbc60dff3fd62747836ab42223fff628640f654156ff60671b2a7e50bc

SHA512
14702b2293dc6c7f45fa5a0b7d225621f5623fb706b4508a633dcd3214c162a170274c9003332d3d2ce55b6a6d7380c767764a67b21354f8708df9278e1c4ca0

Download Submit
C:\Windows\System\FeeNyos.exe

Filesize
1.4MB

MD5
9e39ca62a857c479b70ad14fa024fffc

SHA1
236838852aa8085c1efe0c5f7b7b549d2dbfe299

SHA256
7d6d46bbbf7e9d24fc3e76929d01643eb40557fbfdd3be8374151548f8d00cc8

SHA512
e80b0f9c5edfff3a6b945f9d0242f31940e43e00cbd545dbc77c1438d2e849cc2d54d863fd257df944bbfe3903ecf68abf73e7c823315cd6d485afa683d82aae

Download Submit
C:\Windows\System\JEaHDYl.exe

Filesize
1.4MB

MD5
5ed28da6e66d5daa9b1554c957a09895

SHA1
6410cd802939d4df70f36709ada3f6fb44a502a7

SHA256
898485c39c8cfc93e25f7dad77eebf93debfd01cdb7088333949780d44c12c0c

SHA512
c7786ffddb193273b2a6b432290513574ec84338fe5941b8049ddfd5ece71ec339954230e928dc6d1ba90fb9353bf4b883a8aaef0ac720db1c5138ce343c0929

Download Submit
C:\Windows\System\LlYhMIj.exe

Filesize
1.4MB

MD5
15b97b28022c77386db6e6d903984201

SHA1
98d8e43935d7e1ad024a987a9f500d0ee328b8e1

SHA256
7d90c0e26f436ee98b2e9c1618a88a15161eee4f66cc169cfa2a2c4acd18ea18

SHA512
d2fa1339b248ec0bc2d31a57d8ebe333f7576296ba5fb943be0702852cb84e37b31cd6b742df1a1be6da6a359a71b7106d82a3a723cb26ab04ec9e25f0ba7ac3

Download Submit
C:\Windows\System\MtiMoSF.exe

Filesize
1.4MB

MD5
bfc0fe4f2e868cefd3a149d2c9578535

SHA1
711c40da90ffc9c63cc30495c6d4366d8b2a5ff5

SHA256
4503df846bc2a396e138ec20e9e7ad9ccd83c80ee41a181f30b2d7e1a0d9581e

SHA512
978ada4fc37ce2ec76cd091798aa45d9dc438779216b19c582acaffaf109d429c2fc9a15ee949fcd99831aa5c91297c3253e1252d74de45919be9a3539c46082

Download Submit
C:\Windows\System\OrpJQJk.exe

Filesize
1.4MB

MD5
b38a684f8725235748e55ed3d4f32cf7

SHA1
c643d6e70f6a956b0edfc8757c124d3ffd235216

SHA256
8b009823f0a8a3210eafe2d0ca9944f4dafaef465a404f36a4009974fb6f101c

SHA512
ed3a1db32a0c7fe7dab98b333fdb8193b571f5347657520bed44e3d0b2ff8ad9890f39406b66435848e6f70b386e0804a7678227d55c0a526c4702e7e2e34c5f

Download Submit
C:\Windows\System\PpNYmrR.exe

Filesize
1.4MB

MD5
e2da5ce535dd5796194515c284fe47aa

SHA1
29457e308d4f047b3b5aa0f7df2df8b710a68cc0

SHA256
7e13185a03d9eb4eddcef994ae042e8bbb14c8d435bc3ba61b13d068ce303753

SHA512
b16455eeb0faa1c3377393893bb7deb37f0ef65f502775736e35e5c12d1101ee45d5e0973ffa61d1b5052ce58bf2d68c2128705130660a6bf57200aecb83ab66

Download Submit
C:\Windows\System\QXKXQFZ.exe

Filesize
1.4MB

MD5
aecfc34c6a2868f11619ad699a7d76b2

SHA1
6a173cc02b0cec4211456901b786fcb8c28e07cd

SHA256
70ea1056cdc3bab61c7613d02d2c6a3b560c85eac93a70e2788e27ddc3949b4c

SHA512
d83ecc372d1e7e80aede7dab9a2adf19a0f221faa32ab69c75d16e3a10302cf6d4071685d1569debf04af1e03f9e335dfb1760720e630edcdfe22ffe46dd22fd

Download Submit
C:\Windows\System\RoCGLOL.exe

Filesize
1.4MB

MD5
62c294822bb8f1f8c8b775cfb08dd50f

SHA1
a2a2a26ccb742f360f0e8d8b010c70f6491230d6

SHA256
fd582f181793b700c4f25ea2e7bff05ac61a4967353d685f0f57467d79f69237

SHA512
f6af74d33088b0fa5671c61012df48a1390a38a2b07c891f08c07b9cde15e0e2bb9a9a1a9d029cf91ab8dd9b5e54de81c6afb7a702046ef87bcb6c98b131847b

Download Submit
C:\Windows\System\SAHLAvf.exe

Filesize
1.4MB

MD5
3b2349e3711a3d75dc5f351b0aab81d3

SHA1
a33947c67ccdde84e803e3e4074da349d87b9dd9

SHA256
aac8cf0201a014b65b05ef7823a1e796424fbed2c962af85f8acf861efd596e5

SHA512
9b13c4daa33d23a18809ec78527072db09604428ad38e036dac0e1263c3d77900fd1120a2959369e03b1cb7092750266c40fa0a4e2c498b27d8ab42f2cc9e9fb

Download Submit
C:\Windows\System\SySGsTM.exe

Filesize
1.4MB

MD5
73c5a2222981fd2b24b2ad47023a043b

SHA1
728395c9e72b8a639144e68f0f78a73cbd0a60cb

SHA256
190576f1f5124e5a4ca6de5d37a0aee5792a4a5e67f38cd193f545b00495542a

SHA512
198233191054d01a6759ef6fefb2c538bbae3ff68b9eb81f65fc65e60b2660031b8ccdb9828b70189348da63a0868365a74de754960d13b71ca336368a118235

Download Submit
C:\Windows\System\UWWGwjm.exe

Filesize
1.4MB

MD5
1925f409b7fff83ba42431c1738c4f6f

SHA1
29e7cd946d741886c31ab531daa0d0067ca847fe

SHA256
f07b789f5daaa25ad34910e76f01479fd304155a1c6c1f3a7d3ab18efba0cc52

SHA512
e983dac333979413f0b7527e024252b94f3548d707be915e3c0b88b52df63fe5251c2542dec0f20e343af15785e47cacbd5ea16fb173b29c76e40dd6ba61af20

Download Submit
C:\Windows\System\XyEBgiD.exe

Filesize
1.4MB

MD5
f81e050862a5da86895995a0d74a4209

SHA1
cffd581fa797e36c787fd25e52490000e1ca7b3d

SHA256
a83fba4afb069ac2fcd6a74d980212684bcb060474c4c4f1664167cb7cd0b05d

SHA512
7960d76a553dcded55f35e1f54945ffb3b99124f4d99619f5bda4b7903740790724ac49f646fd00dad151440a24118083c590d1f464362a4434e69dab2168535

Download Submit
C:\Windows\System\YaHCpka.exe

Filesize
1.4MB

MD5
2c839db7f89a7f31ca884f9fd8badaac

SHA1
1979d32e0195e79feca7400248a95e924a611915

SHA256
6f07d9676affe8c73a27c85bb486922cbca87dbf83026e202795219ea5f77643

SHA512
c40c2ee5464484581f7cfc33d08fd155ffbda66dac5debdcc642a84400e7de7f297bedcd783beb18d41b126682ea7fa2f05d3d90f70fb20e97507c12378d00f6

Download Submit
C:\Windows\System\fxziYvg.exe

Filesize
1.4MB

MD5
5fb3c0457f1ae726e097b2018f78a366

SHA1
d571cd2be46f7a208dbe8a098f0aa58dca0c65ae

SHA256
d1940ac12bb5fa69508cb087bfc1eccc6ebc840cc143278a1fbe9c56e6e9d08f

SHA512
0dbc9b881412958bac561b6023ba0fafd0d4aeec46541eabfea41dcec5546258f6b01bb5408615d9c89bcfe49b657824acaee688f7664bcfabe8578b4322aaac

Download Submit
C:\Windows\System\fyVwXeH.exe

Filesize
1.4MB

MD5
6fdb22481494506c9a5e5a541fc00a05

SHA1
7c5c8595016994123daaac49a18955ce3cfa371e

SHA256
fd86fd034d0aed89a330ab9dd1d474b30fb064ca1004bf5a4819587559cfe92f

SHA512
2edc64c7b4a3e9501750e9b56219953cb4987c36d5f56cb51ec063854c273de0b5aef01ecbddc707e2ce14e1748d4991f2b78060d96d8133e0ec6f26ab6b55d7

Download Submit
C:\Windows\System\heIIygm.exe

Filesize
1.4MB

MD5
20abefadbd1ae0e63647fe2bed3c7294

SHA1
7d875bb4ac55f12db101f204cf3335f21a6d5a6f

SHA256
f11adaa159b22f1a42fef6b153db003382ed242cd98b0fb2d41154d2f62d462a

SHA512
8e459ca23636eb96a4290da16e31793a9e94d66538c6dfea7faea0f7963eacb67c326c94f2f2b79582c75970c8b947d41e109c64e4167c866a248a8851f7ea7a

Download Submit
C:\Windows\System\hsKjPmz.exe

Filesize
1.4MB

MD5
e8a8f425bc211147fd1606dd5f4acd89

SHA1
a829d370795e940afc7026f6d464aa4fd56683c9

SHA256
9b08181c98c7860d69add9ee4a426749ef25e133af1cfc2b7c0754904b3fdebe

SHA512
8973a067b69f9c7e25f4c47b9f2a48e97ac934bd958a403677f0ec534210feca07304ae7a3304d9835dd052bcca5e1b0975407026fcc3698af6a54bb33aa47a3

Download Submit
C:\Windows\System\huVxejE.exe

Filesize
1.4MB

MD5
3cd70a7a37601bb6341bbf49faa98dea

SHA1
881864db5e5d74a08df46dc12acffea5776b3503

SHA256
2128f0a77c540a9a5d5f4173daceb9a8e2b8ae1f456048952526deeb25bd5528

SHA512
34573eca7eb7b87f54c4018aa05375350d1213b17d8124b167a00088e05bdb421a2057eb2a7942edf7fba3d6161c7e714263c493e9c6c49eab0937fd905dd6f1

Download Submit
C:\Windows\System\jbDOhBB.exe

Filesize
1.4MB

MD5
1530acf5c959efda4de27e1e835ca657

SHA1
4a3b1447b845d6dc9c5c39ca721abf0ff41239b9

SHA256
0d4727707cca168ae7b28da16f41a8921dff69ae6942929db71f91acc67673e9

SHA512
b78f69c2d8790702fbb2ba5e5d2b47844dfd3dfaaa2e53c602a3b303272f192c9c5b662c33a3bd06291322b2e582b42d28eade894844c68d625e77bc7a31f41b

Download Submit
C:\Windows\System\kCMihgK.exe

Filesize
1.4MB

MD5
0d0e1c43b609e10646616d166a710819

SHA1
ea18019122b2fef48f6b6ccb6877e5bc0132f65b

SHA256
cd33946e9d187a64ed2a5dc09f37871e1af336243eaafbb58e4d15f7493e5cc1

SHA512
0e249ddc718b7f6b7a684400dabaef7e3e9fa5d393d34d05f16c71de23158a4834060bb79960b995c25f9e69e8535607ca057df7cd8530eb9561941666afddf3

Download Submit
C:\Windows\System\oARGCMt.exe

Filesize
1.4MB

MD5
66d16faee767adcccb4c900fc1451417

SHA1
25054b936ef29e64122f390cb868a2d73db2aa96

SHA256
bd88506d5b5cb7c84b5221313a5b09efbf90f0aea816bd9e8b19973801acd51c

SHA512
87d181397649a914c534a1c5399a251f98413762500b990fcf54af8e21e1be7165b972dc90eae98e9fcb204698a35c3b5ba95a12191076b191eea4e91cbd4620

Download Submit
C:\Windows\System\oPrIfEy.exe

Filesize
1.4MB

MD5
c88dc2516546481b98d32902c87d3f30

SHA1
75cbe94299540d8de41f78d3cfd7eab52199246e

SHA256
7cfc6dc7e7f26a07db915b28727a6de8da6d156d144781054e433baf6d8c17d9

SHA512
c02b60c41bd2c83a9fb956067da0be38054750b1e8dd529e00d576508292248d23944b2d1a20746ffea5096e5e10d205088d02d60ed3e3c42afc0f13ab85c7ba

Download Submit
C:\Windows\System\pwKCFED.exe

Filesize
1.4MB

MD5
78eaf71ac4dc5a6c5d3fe1f7d0cd8893

SHA1
1d8b77faad228f12f31d8583686c94911de27861

SHA256
c5ccd309c4e65a8ca6e38af6063aba8e3c2b30b647408ca5c67899999add7792

SHA512
bf024b13e7d3197f3662ac6220bba3d118d6383e1df0a2e2b12f3be9cf88d204810efeb9b7b0c59e7b37e788660abba19b3ecf2bf16ad7601eb6da68995b17fe

Download Submit
C:\Windows\System\rTEdkyf.exe

Filesize
1.4MB

MD5
f2a8bcf71f84d355fa1f257abef23c10

SHA1
bff35c89a3ddaff8bc5f13b62cc50b469eeaf77c

SHA256
5a8be377a9292f79a3731cbb8ec9ef07a9827bbc2a5f27186092e0b6a88d3adb

SHA512
18c9dff4988045918510f2f8aeecbfdb31bd44db505ec65bee87297bafde5cbbffea168af460b263b01ab306c238e4c4ed526105bb911743513684d343f50e94

Download Submit
C:\Windows\System\rZxOfNC.exe

Filesize
1.4MB

MD5
17c04b353ab86196c393e96a88fdfade

SHA1
481a66a549077133ffabdaf47766a5ff290d9cf5

SHA256
09f17e679bc705d086cbcf6af8efcae1e5b51e56da319cf97c4dbfb29e5e8003

SHA512
28f32cbdc73f5014e2e9ba1e752787eb7444ee8b5eeda02d8dc91aa36cbbd9dbacc725decaacf5f996625471002c2cefd97fe3aeb62da9a1b0a2da7ffa9d727d

Download Submit
C:\Windows\System\sdocUJZ.exe

Filesize
1.4MB

MD5
c51a81be61d7245ab4d8a7bc7cc18f12

SHA1
e4dd18d9bcfaae37ff905220121b4f467d51e8b0

SHA256
ab0b4616902d17ab6f2a2258178aa899f44a4b918d4bda68e36f924fbeffb961

SHA512
d0523fd005f90a4edb27b176f22b1704da093aeaa51aeecee2aa7b775e762685704f0aeba48127e2b45aee05637cfcb94d2591d09739c88d7ca502c917026933

Download Submit
C:\Windows\System\ufeZKQt.exe

Filesize
1.4MB

MD5
f2fb19c53f345c0c002bba238fce3648

SHA1
60035327d11732e38a831e47f7c73e7fbd90a826

SHA256
ab6e726461d7e20f765740ee095df3a6ab51e92728c6a3f03b0bdb85479255a3

SHA512
ffa6baebeea486af94de5a35c1d9dd3d98078ae5986b21d4da806aef8e4f758ee46fb9fe61b3c538560e1a18c0a91dbede2bb5674c62689f07a00015a41f7021

Download Submit
C:\Windows\System\wVFgMKk.exe

Filesize
1.4MB

MD5
c5f8bf872f4dae11d46aca49a796cbb5

SHA1
6a87de164543959a83540cc0a801acb3a6b41700

SHA256
446183df0b02dbb6768e21347a0af35ca4a3021e04de561cf4ee8239f37e4527

SHA512
f31526db9d0c3945af39c230fceaf958d89bd5a7068413b51382c125bb3258aa1b031c35b635aec63eb18490f7383f247f555ac79855af53237f5ccaa60fc467

Download Submit
C:\Windows\System\weoGjRd.exe

Filesize
1.4MB

MD5
50294c7f30495d76d305e87b0ccb89fc

SHA1
6810d1396586588460be072f2c99657ac5563030

SHA256
2fadca418c9c07c31959337a47f97276f0e4f187ec1e5b516b328e0dbc74f7b8

SHA512
1779b7217e94fd4c3fde8e083dee06c37276ec97ab926a34ab2bc320661f908493cbb9c0e24ba3aed8cee6493a5395a097432ee274a3f7b233fa1b6f6b1cc300

Download Submit
C:\Windows\System\zZjvYEM.exe

Filesize
1.4MB

MD5
bc84acfdbc9066c2adc8a1a4c9c83948

SHA1
6f0dca1179f38b9c3092034d23acffd11956a719

SHA256
8843dab54a8e0e90ed2f29e6f735fe08c012095120a8a21106056ea6bef809ae

SHA512
742ff0e78fa24863468daa80eccbc0a47538e074b294a9fd8d8ac7ddd1015993ee5333ab4fe7ead254b1671f389f9f3556725f64ecd44f0f308561e14e272304

Download Submit
memory/1388-0-0x0000016BB4C70000-0x0000016BB4C80000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads