xmrig | d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9

Analysis

max time kernel
109s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
25-12-2024 03:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe
Size

1.5MB
MD5

ce2b49633b416f7b2bbb83226c09f4ff
SHA1

36b3f85d4016d23c716645219614519dff7e2de0
SHA256

d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9
SHA512

ddcbd2bb3d08a3c4e5b9ac552a5073fb53a02f4b4b0a7bdfcd5c85728a3c52b03ce0f11576aa06868df8554aad2ed746277010a1ac042edbc7423b25953c3b98
SSDEEP

49152:GezaTF8FcNkNdfE0pZ9ozttwIRx3QjVwiPk:GemTLkNdfE0pZyf

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 33 IoCs

miner

resource	yara_rule
behavioral2/files/0x000c000000023ba4-4.dat	xmrig
behavioral2/files/0x0007000000023cae-7.dat	xmrig
behavioral2/files/0x0007000000023caf-10.dat	xmrig
behavioral2/files/0x0007000000023cb0-19.dat	xmrig
behavioral2/files/0x0007000000023cb1-22.dat	xmrig
behavioral2/files/0x0007000000023cb2-29.dat	xmrig
behavioral2/files/0x0008000000023cab-35.dat	xmrig
behavioral2/files/0x0007000000023cb3-39.dat	xmrig
behavioral2/files/0x0007000000023cb4-44.dat	xmrig
behavioral2/files/0x0007000000023cb5-51.dat	xmrig
behavioral2/files/0x0007000000023cb6-54.dat	xmrig
behavioral2/files/0x0007000000023cb7-60.dat	xmrig
behavioral2/files/0x0007000000023cb8-64.dat	xmrig
behavioral2/files/0x0007000000023cb9-68.dat	xmrig
behavioral2/files/0x0007000000023cba-74.dat	xmrig
behavioral2/files/0x0007000000023cbb-77.dat	xmrig
behavioral2/files/0x0007000000023cbc-85.dat	xmrig
behavioral2/files/0x0007000000023cbd-89.dat	xmrig
behavioral2/files/0x0007000000023cbe-95.dat	xmrig
behavioral2/files/0x0007000000023cbf-99.dat	xmrig
behavioral2/files/0x0007000000023cc2-109.dat	xmrig
behavioral2/files/0x0007000000023cc3-114.dat	xmrig
behavioral2/files/0x0007000000023cc5-127.dat	xmrig
behavioral2/files/0x0007000000023cc9-145.dat	xmrig
behavioral2/files/0x0007000000023ccd-162.dat	xmrig
behavioral2/files/0x0007000000023ccc-159.dat	xmrig
behavioral2/files/0x0007000000023ccb-157.dat	xmrig
behavioral2/files/0x0007000000023cca-153.dat	xmrig
behavioral2/files/0x0007000000023cc8-143.dat	xmrig
behavioral2/files/0x0007000000023cc7-140.dat	xmrig
behavioral2/files/0x0007000000023cc6-135.dat	xmrig
behavioral2/files/0x0007000000023cc4-123.dat	xmrig
behavioral2/files/0x0007000000023cc1-105.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
3340	CgZKlMx.exe
4056	tDqrSdZ.exe
4880	sHafFSf.exe
1800	DEKmZMt.exe
2428	peylAHF.exe
4688	rFmMfWf.exe
3328	xlDNqXW.exe
4604	eiXsqiY.exe
3744	rXcKrPb.exe
2392	YWRhyqE.exe
876	OgTUFXr.exe
384	KVVuMJN.exe
4864	ddVfTJJ.exe
1696	rqGjqod.exe
2436	toKqUMH.exe
2532	mzevgqn.exe
2676	JwsZBzr.exe
4928	IoPUVHg.exe
3872	FmPcRHn.exe
4740	afunQOy.exe
380	jzBSMKZ.exe
3876	duEoObm.exe
536	CeBdXpw.exe
4916	jnigagi.exe
2236	XEJqeXE.exe
4128	GIOADwY.exe
4320	JvkUYCI.exe
4820	NLVubyt.exe
4048	gjLcVGN.exe
1636	TKclUEK.exe
1444	tQgXSVV.exe
1700	SjZevye.exe
4016	ZbyjXpV.exe
3048	NxFAJbq.exe
4080	LavYkFS.exe
4324	uoYxpNF.exe
4884	lWdboZM.exe
3788	LYcRlid.exe
1964	YeUyTgK.exe
1532	eoYFPEj.exe
456	ytwDgyK.exe
1596	XVfeWhR.exe
3780	CgCJOnz.exe
840	TnZKaCX.exe
3464	OQnBWSV.exe
3392	JvAwudo.exe
1440	LCDqvME.exe
4364	MyqSIqU.exe
220	gIcOtVl.exe
4732	WoVJNwY.exe
3156	XcrqlCi.exe
4492	SxPLclx.exe
1432	KIdXqSM.exe
1452	qZwGzAD.exe
3672	UMazpRS.exe
4312	ZjxlsJs.exe
2928	idIxSdu.exe
412	TPrnYFF.exe
4416	UEKjiED.exe
4392	HVgpDsb.exe
3264	rzQVVbY.exe
4836	zhiLYnq.exe
2340	CjArGXd.exe
1916	YUSRWdc.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\LEPGeJs.exe	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe
File created	C:\Windows\System\bTsmBcO.exe	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe
File created	C:\Windows\System\wNBywzy.exe	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe
File created	C:\Windows\System\hCDSFZr.exe	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe
File created	C:\Windows\System\cCkcYEN.exe	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe
File created	C:\Windows\System\FCVSnmi.exe	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe
File created	C:\Windows\System\JvkUYCI.exe	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe
File created	C:\Windows\System\UhSeLEQ.exe	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe
File created	C:\Windows\System\OPIfzNn.exe	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe
File created	C:\Windows\System\RSbkWFR.exe	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe
File created	C:\Windows\System\vUPKbEW.exe	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe
File created	C:\Windows\System\AbeionI.exe	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe
File created	C:\Windows\System\buopHsb.exe	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe
File created	C:\Windows\System\mzevgqn.exe	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe
File created	C:\Windows\System\MNVhING.exe	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe
File created	C:\Windows\System\EpfAnAF.exe	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe
File created	C:\Windows\System\ZIPfXhQ.exe	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe
File created	C:\Windows\System\gVoiisG.exe	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe
File created	C:\Windows\System\TsBzdst.exe	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe
File created	C:\Windows\System\yZifMNJ.exe	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe
File created	C:\Windows\System\bpUQIjX.exe	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe
File created	C:\Windows\System\JbDXhda.exe	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe
File created	C:\Windows\System\TVCuEES.exe	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe
File created	C:\Windows\System\LMWlSwx.exe	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe
File created	C:\Windows\System\iBKoxwA.exe	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe
File created	C:\Windows\System\ouBRXkj.exe	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe
File created	C:\Windows\System\WPcmLBJ.exe	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe
File created	C:\Windows\System\eCaSOrT.exe	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe
File created	C:\Windows\System\zFoZGFF.exe	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe
File created	C:\Windows\System\GwQGxvB.exe	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe
File created	C:\Windows\System\aNAtHaK.exe	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe
File created	C:\Windows\System\vkUMBna.exe	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe
File created	C:\Windows\System\fyHMDiY.exe	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe
File created	C:\Windows\System\BhzroVf.exe	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe
File created	C:\Windows\System\eukKsEd.exe	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe
File created	C:\Windows\System\NDZItNo.exe	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe
File created	C:\Windows\System\ItvIAFH.exe	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe
File created	C:\Windows\System\jHgESgz.exe	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe
File created	C:\Windows\System\DnThpVH.exe	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe
File created	C:\Windows\System\YADyWMY.exe	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe
File created	C:\Windows\System\hpQmFLv.exe	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe
File created	C:\Windows\System\rDATyLl.exe	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe
File created	C:\Windows\System\xxjOxxA.exe	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe
File created	C:\Windows\System\nmSBwqO.exe	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe
File created	C:\Windows\System\WesmmbE.exe	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe
File created	C:\Windows\System\iBXMImM.exe	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe
File created	C:\Windows\System\CgZKlMx.exe	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe
File created	C:\Windows\System\nGXKXUi.exe	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe
File created	C:\Windows\System\xvhUEze.exe	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe
File created	C:\Windows\System\LqnpKXb.exe	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe
File created	C:\Windows\System\dwOsDTX.exe	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe
File created	C:\Windows\System\dFsNfZy.exe	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe
File created	C:\Windows\System\bOvrGRB.exe	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe
File created	C:\Windows\System\EFiHBrH.exe	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe
File created	C:\Windows\System\sBXNDso.exe	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe
File created	C:\Windows\System\LlctLEH.exe	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe
File created	C:\Windows\System\AvMLnLl.exe	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe
File created	C:\Windows\System\zTokcNY.exe	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe
File created	C:\Windows\System\EGXCGsZ.exe	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe
File created	C:\Windows\System\NKwkkeT.exe	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe
File created	C:\Windows\System\GOGhjkL.exe	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe
File created	C:\Windows\System\CjArGXd.exe	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe
File created	C:\Windows\System\VHlvtWN.exe	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe
File created	C:\Windows\System\dglbtqO.exe	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	15532	dwm.exe
Token: SeChangeNotifyPrivilege	15532	dwm.exe
Token: 33	15532	dwm.exe
Token: SeIncBasePriorityPrivilege	15532	dwm.exe
Token: SeShutdownPrivilege	15532	dwm.exe
Token: SeCreatePagefilePrivilege	15532	dwm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3180 wrote to memory of 3340	3180	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe	86
PID 3180 wrote to memory of 3340	3180	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe	86
PID 3180 wrote to memory of 4056	3180	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe	87
PID 3180 wrote to memory of 4056	3180	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe	87
PID 3180 wrote to memory of 4880	3180	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe	88
PID 3180 wrote to memory of 4880	3180	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe	88
PID 3180 wrote to memory of 1800	3180	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe	89
PID 3180 wrote to memory of 1800	3180	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe	89
PID 3180 wrote to memory of 2428	3180	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe	90
PID 3180 wrote to memory of 2428	3180	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe	90
PID 3180 wrote to memory of 4688	3180	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe	91
PID 3180 wrote to memory of 4688	3180	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe	91
PID 3180 wrote to memory of 3328	3180	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe	92
PID 3180 wrote to memory of 3328	3180	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe	92
PID 3180 wrote to memory of 4604	3180	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe	93
PID 3180 wrote to memory of 4604	3180	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe	93
PID 3180 wrote to memory of 3744	3180	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe	94
PID 3180 wrote to memory of 3744	3180	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe	94
PID 3180 wrote to memory of 2392	3180	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe	95
PID 3180 wrote to memory of 2392	3180	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe	95
PID 3180 wrote to memory of 876	3180	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe	96
PID 3180 wrote to memory of 876	3180	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe	96
PID 3180 wrote to memory of 384	3180	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe	97
PID 3180 wrote to memory of 384	3180	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe	97
PID 3180 wrote to memory of 4864	3180	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe	98
PID 3180 wrote to memory of 4864	3180	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe	98
PID 3180 wrote to memory of 1696	3180	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe	99
PID 3180 wrote to memory of 1696	3180	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe	99
PID 3180 wrote to memory of 2436	3180	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe	100
PID 3180 wrote to memory of 2436	3180	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe	100
PID 3180 wrote to memory of 2532	3180	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe	101
PID 3180 wrote to memory of 2532	3180	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe	101
PID 3180 wrote to memory of 2676	3180	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe	102
PID 3180 wrote to memory of 2676	3180	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe	102
PID 3180 wrote to memory of 4928	3180	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe	103
PID 3180 wrote to memory of 4928	3180	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe	103
PID 3180 wrote to memory of 3872	3180	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe	104
PID 3180 wrote to memory of 3872	3180	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe	104
PID 3180 wrote to memory of 4740	3180	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe	105
PID 3180 wrote to memory of 4740	3180	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe	105
PID 3180 wrote to memory of 380	3180	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe	106
PID 3180 wrote to memory of 380	3180	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe	106
PID 3180 wrote to memory of 3876	3180	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe	107
PID 3180 wrote to memory of 3876	3180	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe	107
PID 3180 wrote to memory of 536	3180	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe	108
PID 3180 wrote to memory of 536	3180	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe	108
PID 3180 wrote to memory of 4916	3180	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe	109
PID 3180 wrote to memory of 4916	3180	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe	109
PID 3180 wrote to memory of 2236	3180	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe	110
PID 3180 wrote to memory of 2236	3180	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe	110
PID 3180 wrote to memory of 4128	3180	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe	111
PID 3180 wrote to memory of 4128	3180	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe	111
PID 3180 wrote to memory of 4320	3180	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe	112
PID 3180 wrote to memory of 4320	3180	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe	112
PID 3180 wrote to memory of 4820	3180	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe	113
PID 3180 wrote to memory of 4820	3180	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe	113
PID 3180 wrote to memory of 4048	3180	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe	114
PID 3180 wrote to memory of 4048	3180	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe	114
PID 3180 wrote to memory of 1636	3180	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe	115
PID 3180 wrote to memory of 1636	3180	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe	115
PID 3180 wrote to memory of 1444	3180	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe	116
PID 3180 wrote to memory of 1444	3180	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe	116
PID 3180 wrote to memory of 1700	3180	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe	117
PID 3180 wrote to memory of 1700	3180	d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe	117

C:\Users\Admin\AppData\Local\Temp\d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe
"C:\Users\Admin\AppData\Local\Temp\d04228c107e9f1adbb1ce17b25a30c8e3a4fc66dc7977ab1b0660e71da1b41b9.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3180
- C:\Windows\System\CgZKlMx.exe
  C:\Windows\System\CgZKlMx.exe
  2⤵
  - Executes dropped EXE
  PID:3340
- C:\Windows\System\tDqrSdZ.exe
  C:\Windows\System\tDqrSdZ.exe
  2⤵
  - Executes dropped EXE
  PID:4056
- C:\Windows\System\sHafFSf.exe
  C:\Windows\System\sHafFSf.exe
  2⤵
  - Executes dropped EXE
  PID:4880
- C:\Windows\System\DEKmZMt.exe
  C:\Windows\System\DEKmZMt.exe
  2⤵
  - Executes dropped EXE
  PID:1800
- C:\Windows\System\peylAHF.exe
  C:\Windows\System\peylAHF.exe
  2⤵
  - Executes dropped EXE
  PID:2428
- C:\Windows\System\rFmMfWf.exe
  C:\Windows\System\rFmMfWf.exe
  2⤵
  - Executes dropped EXE
  PID:4688
- C:\Windows\System\xlDNqXW.exe
  C:\Windows\System\xlDNqXW.exe
  2⤵
  - Executes dropped EXE
  PID:3328
- C:\Windows\System\eiXsqiY.exe
  C:\Windows\System\eiXsqiY.exe
  2⤵
  - Executes dropped EXE
  PID:4604
- C:\Windows\System\rXcKrPb.exe
  C:\Windows\System\rXcKrPb.exe
  2⤵
  - Executes dropped EXE
  PID:3744
- C:\Windows\System\YWRhyqE.exe
  C:\Windows\System\YWRhyqE.exe
  2⤵
  - Executes dropped EXE
  PID:2392
- C:\Windows\System\OgTUFXr.exe
  C:\Windows\System\OgTUFXr.exe
  2⤵
  - Executes dropped EXE
  PID:876
- C:\Windows\System\KVVuMJN.exe
  C:\Windows\System\KVVuMJN.exe
  2⤵
  - Executes dropped EXE
  PID:384
- C:\Windows\System\ddVfTJJ.exe
  C:\Windows\System\ddVfTJJ.exe
  2⤵
  - Executes dropped EXE
  PID:4864
- C:\Windows\System\rqGjqod.exe
  C:\Windows\System\rqGjqod.exe
  2⤵
  - Executes dropped EXE
  PID:1696
- C:\Windows\System\toKqUMH.exe
  C:\Windows\System\toKqUMH.exe
  2⤵
  - Executes dropped EXE
  PID:2436
- C:\Windows\System\mzevgqn.exe
  C:\Windows\System\mzevgqn.exe
  2⤵
  - Executes dropped EXE
  PID:2532
- C:\Windows\System\JwsZBzr.exe
  C:\Windows\System\JwsZBzr.exe
  2⤵
  - Executes dropped EXE
  PID:2676
- C:\Windows\System\IoPUVHg.exe
  C:\Windows\System\IoPUVHg.exe
  2⤵
  - Executes dropped EXE
  PID:4928
- C:\Windows\System\FmPcRHn.exe
  C:\Windows\System\FmPcRHn.exe
  2⤵
  - Executes dropped EXE
  PID:3872
- C:\Windows\System\afunQOy.exe
  C:\Windows\System\afunQOy.exe
  2⤵
  - Executes dropped EXE
  PID:4740
- C:\Windows\System\jzBSMKZ.exe
  C:\Windows\System\jzBSMKZ.exe
  2⤵
  - Executes dropped EXE
  PID:380
- C:\Windows\System\duEoObm.exe
  C:\Windows\System\duEoObm.exe
  2⤵
  - Executes dropped EXE
  PID:3876
- C:\Windows\System\CeBdXpw.exe
  C:\Windows\System\CeBdXpw.exe
  2⤵
  - Executes dropped EXE
  PID:536
- C:\Windows\System\jnigagi.exe
  C:\Windows\System\jnigagi.exe
  2⤵
  - Executes dropped EXE
  PID:4916
- C:\Windows\System\XEJqeXE.exe
  C:\Windows\System\XEJqeXE.exe
  2⤵
  - Executes dropped EXE
  PID:2236
- C:\Windows\System\GIOADwY.exe
  C:\Windows\System\GIOADwY.exe
  2⤵
  - Executes dropped EXE
  PID:4128
- C:\Windows\System\JvkUYCI.exe
  C:\Windows\System\JvkUYCI.exe
  2⤵
  - Executes dropped EXE
  PID:4320
- C:\Windows\System\NLVubyt.exe
  C:\Windows\System\NLVubyt.exe
  2⤵
  - Executes dropped EXE
  PID:4820
- C:\Windows\System\gjLcVGN.exe
  C:\Windows\System\gjLcVGN.exe
  2⤵
  - Executes dropped EXE
  PID:4048
- C:\Windows\System\TKclUEK.exe
  C:\Windows\System\TKclUEK.exe
  2⤵
  - Executes dropped EXE
  PID:1636
- C:\Windows\System\tQgXSVV.exe
  C:\Windows\System\tQgXSVV.exe
  2⤵
  - Executes dropped EXE
  PID:1444
- C:\Windows\System\SjZevye.exe
  C:\Windows\System\SjZevye.exe
  2⤵
  - Executes dropped EXE
  PID:1700
- C:\Windows\System\ZbyjXpV.exe
  C:\Windows\System\ZbyjXpV.exe
  2⤵
  - Executes dropped EXE
  PID:4016
- C:\Windows\System\NxFAJbq.exe
  C:\Windows\System\NxFAJbq.exe
  2⤵
  - Executes dropped EXE
  PID:3048
- C:\Windows\System\LavYkFS.exe
  C:\Windows\System\LavYkFS.exe
  2⤵
  - Executes dropped EXE
  PID:4080
- C:\Windows\System\uoYxpNF.exe
  C:\Windows\System\uoYxpNF.exe
  2⤵
  - Executes dropped EXE
  PID:4324
- C:\Windows\System\lWdboZM.exe
  C:\Windows\System\lWdboZM.exe
  2⤵
  - Executes dropped EXE
  PID:4884
- C:\Windows\System\LYcRlid.exe
  C:\Windows\System\LYcRlid.exe
  2⤵
  - Executes dropped EXE
  PID:3788
- C:\Windows\System\YeUyTgK.exe
  C:\Windows\System\YeUyTgK.exe
  2⤵
  - Executes dropped EXE
  PID:1964
- C:\Windows\System\eoYFPEj.exe
  C:\Windows\System\eoYFPEj.exe
  2⤵
  - Executes dropped EXE
  PID:1532
- C:\Windows\System\ytwDgyK.exe
  C:\Windows\System\ytwDgyK.exe
  2⤵
  - Executes dropped EXE
  PID:456
- C:\Windows\System\XVfeWhR.exe
  C:\Windows\System\XVfeWhR.exe
  2⤵
  - Executes dropped EXE
  PID:1596
- C:\Windows\System\CgCJOnz.exe
  C:\Windows\System\CgCJOnz.exe
  2⤵
  - Executes dropped EXE
  PID:3780
- C:\Windows\System\TnZKaCX.exe
  C:\Windows\System\TnZKaCX.exe
  2⤵
  - Executes dropped EXE
  PID:840
- C:\Windows\System\OQnBWSV.exe
  C:\Windows\System\OQnBWSV.exe
  2⤵
  - Executes dropped EXE
  PID:3464
- C:\Windows\System\JvAwudo.exe
  C:\Windows\System\JvAwudo.exe
  2⤵
  - Executes dropped EXE
  PID:3392
- C:\Windows\System\LCDqvME.exe
  C:\Windows\System\LCDqvME.exe
  2⤵
  - Executes dropped EXE
  PID:1440
- C:\Windows\System\MyqSIqU.exe
  C:\Windows\System\MyqSIqU.exe
  2⤵
  - Executes dropped EXE
  PID:4364
- C:\Windows\System\gIcOtVl.exe
  C:\Windows\System\gIcOtVl.exe
  2⤵
  - Executes dropped EXE
  PID:220
- C:\Windows\System\WoVJNwY.exe
  C:\Windows\System\WoVJNwY.exe
  2⤵
  - Executes dropped EXE
  PID:4732
- C:\Windows\System\XcrqlCi.exe
  C:\Windows\System\XcrqlCi.exe
  2⤵
  - Executes dropped EXE
  PID:3156
- C:\Windows\System\SxPLclx.exe
  C:\Windows\System\SxPLclx.exe
  2⤵
  - Executes dropped EXE
  PID:4492
- C:\Windows\System\KIdXqSM.exe
  C:\Windows\System\KIdXqSM.exe
  2⤵
  - Executes dropped EXE
  PID:1432
- C:\Windows\System\qZwGzAD.exe
  C:\Windows\System\qZwGzAD.exe
  2⤵
  - Executes dropped EXE
  PID:1452
- C:\Windows\System\UMazpRS.exe
  C:\Windows\System\UMazpRS.exe
  2⤵
  - Executes dropped EXE
  PID:3672
- C:\Windows\System\ZjxlsJs.exe
  C:\Windows\System\ZjxlsJs.exe
  2⤵
  - Executes dropped EXE
  PID:4312
- C:\Windows\System\idIxSdu.exe
  C:\Windows\System\idIxSdu.exe
  2⤵
  - Executes dropped EXE
  PID:2928
- C:\Windows\System\TPrnYFF.exe
  C:\Windows\System\TPrnYFF.exe
  2⤵
  - Executes dropped EXE
  PID:412
- C:\Windows\System\UEKjiED.exe
  C:\Windows\System\UEKjiED.exe
  2⤵
  - Executes dropped EXE
  PID:4416
- C:\Windows\System\HVgpDsb.exe
  C:\Windows\System\HVgpDsb.exe
  2⤵
  - Executes dropped EXE
  PID:4392
- C:\Windows\System\rzQVVbY.exe
  C:\Windows\System\rzQVVbY.exe
  2⤵
  - Executes dropped EXE
  PID:3264
- C:\Windows\System\zhiLYnq.exe
  C:\Windows\System\zhiLYnq.exe
  2⤵
  - Executes dropped EXE
  PID:4836
- C:\Windows\System\CjArGXd.exe
  C:\Windows\System\CjArGXd.exe
  2⤵
  - Executes dropped EXE
  PID:2340
- C:\Windows\System\YUSRWdc.exe
  C:\Windows\System\YUSRWdc.exe
  2⤵
  - Executes dropped EXE
  PID:1916
- C:\Windows\System\IAdVumf.exe
  C:\Windows\System\IAdVumf.exe
  2⤵
  PID:3764
- C:\Windows\System\BnaGire.exe
  C:\Windows\System\BnaGire.exe
  2⤵
  PID:3676
- C:\Windows\System\feFdNrI.exe
  C:\Windows\System\feFdNrI.exe
  2⤵
  PID:2712
- C:\Windows\System\lCHKOyQ.exe
  C:\Windows\System\lCHKOyQ.exe
  2⤵
  PID:3988
- C:\Windows\System\sEaNZFZ.exe
  C:\Windows\System\sEaNZFZ.exe
  2⤵
  PID:1188
- C:\Windows\System\wUDxpaS.exe
  C:\Windows\System\wUDxpaS.exe
  2⤵
  PID:4844
- C:\Windows\System\cEpFshk.exe
  C:\Windows\System\cEpFshk.exe
  2⤵
  PID:1540
- C:\Windows\System\BNNdQEM.exe
  C:\Windows\System\BNNdQEM.exe
  2⤵
  PID:4588
- C:\Windows\System\vdTPUyj.exe
  C:\Windows\System\vdTPUyj.exe
  2⤵
  PID:4620
- C:\Windows\System\cLAIRJj.exe
  C:\Windows\System\cLAIRJj.exe
  2⤵
  PID:1180
- C:\Windows\System\mkeukdA.exe
  C:\Windows\System\mkeukdA.exe
  2⤵
  PID:2308
- C:\Windows\System\cHFrDbj.exe
  C:\Windows\System\cHFrDbj.exe
  2⤵
  PID:2136
- C:\Windows\System\wPEjSnI.exe
  C:\Windows\System\wPEjSnI.exe
  2⤵
  PID:1060
- C:\Windows\System\lTEtAHq.exe
  C:\Windows\System\lTEtAHq.exe
  2⤵
  PID:396
- C:\Windows\System\bQjxwsm.exe
  C:\Windows\System\bQjxwsm.exe
  2⤵
  PID:2292
- C:\Windows\System\FTWXrPh.exe
  C:\Windows\System\FTWXrPh.exe
  2⤵
  PID:1584
- C:\Windows\System\lDIwwWM.exe
  C:\Windows\System\lDIwwWM.exe
  2⤵
  PID:4008
- C:\Windows\System\CyvhAFE.exe
  C:\Windows\System\CyvhAFE.exe
  2⤵
  PID:2188
- C:\Windows\System\cRwCSqW.exe
  C:\Windows\System\cRwCSqW.exe
  2⤵
  PID:2892
- C:\Windows\System\VfwsuAF.exe
  C:\Windows\System\VfwsuAF.exe
  2⤵
  PID:1568
- C:\Windows\System\AmcPrrM.exe
  C:\Windows\System\AmcPrrM.exe
  2⤵
  PID:4900
- C:\Windows\System\YYssmEk.exe
  C:\Windows\System\YYssmEk.exe
  2⤵
  PID:4816
- C:\Windows\System\INbRkxX.exe
  C:\Windows\System\INbRkxX.exe
  2⤵
  PID:4152
- C:\Windows\System\sTTzTWS.exe
  C:\Windows\System\sTTzTWS.exe
  2⤵
  PID:1496
- C:\Windows\System\RnLGerR.exe
  C:\Windows\System\RnLGerR.exe
  2⤵
  PID:3360
- C:\Windows\System\wDBaxNJ.exe
  C:\Windows\System\wDBaxNJ.exe
  2⤵
  PID:1572
- C:\Windows\System\dFsNfZy.exe
  C:\Windows\System\dFsNfZy.exe
  2⤵
  PID:320
- C:\Windows\System\GJGHlrg.exe
  C:\Windows\System\GJGHlrg.exe
  2⤵
  PID:1192
- C:\Windows\System\ORZlgto.exe
  C:\Windows\System\ORZlgto.exe
  2⤵
  PID:4488
- C:\Windows\System\jwGfAqD.exe
  C:\Windows\System\jwGfAqD.exe
  2⤵
  PID:4380
- C:\Windows\System\tspygLf.exe
  C:\Windows\System\tspygLf.exe
  2⤵
  PID:4280
- C:\Windows\System\OEQTYWc.exe
  C:\Windows\System\OEQTYWc.exe
  2⤵
  PID:3968
- C:\Windows\System\QemyKTf.exe
  C:\Windows\System\QemyKTf.exe
  2⤵
  PID:3576
- C:\Windows\System\fCONFKh.exe
  C:\Windows\System\fCONFKh.exe
  2⤵
  PID:1580
- C:\Windows\System\grnoYjd.exe
  C:\Windows\System\grnoYjd.exe
  2⤵
  PID:3468
- C:\Windows\System\WTlllso.exe
  C:\Windows\System\WTlllso.exe
  2⤵
  PID:5148
- C:\Windows\System\UDULuXI.exe
  C:\Windows\System\UDULuXI.exe
  2⤵
  PID:5176
- C:\Windows\System\mrcXaeY.exe
  C:\Windows\System\mrcXaeY.exe
  2⤵
  PID:5204
- C:\Windows\System\DnThpVH.exe
  C:\Windows\System\DnThpVH.exe
  2⤵
  PID:5232
- C:\Windows\System\fMDQYAN.exe
  C:\Windows\System\fMDQYAN.exe
  2⤵
  PID:5264
- C:\Windows\System\dlEKtrE.exe
  C:\Windows\System\dlEKtrE.exe
  2⤵
  PID:5292
- C:\Windows\System\zFoZGFF.exe
  C:\Windows\System\zFoZGFF.exe
  2⤵
  PID:5316
- C:\Windows\System\ObovXVA.exe
  C:\Windows\System\ObovXVA.exe
  2⤵
  PID:5344
- C:\Windows\System\VPvutEk.exe
  C:\Windows\System\VPvutEk.exe
  2⤵
  PID:5372
- C:\Windows\System\ImbutTe.exe
  C:\Windows\System\ImbutTe.exe
  2⤵
  PID:5400
- C:\Windows\System\DyoMrTv.exe
  C:\Windows\System\DyoMrTv.exe
  2⤵
  PID:5428
- C:\Windows\System\fyIahCI.exe
  C:\Windows\System\fyIahCI.exe
  2⤵
  PID:5456
- C:\Windows\System\XWlpVEi.exe
  C:\Windows\System\XWlpVEi.exe
  2⤵
  PID:5484
- C:\Windows\System\IKnheWL.exe
  C:\Windows\System\IKnheWL.exe
  2⤵
  PID:5516
- C:\Windows\System\iflzrbC.exe
  C:\Windows\System\iflzrbC.exe
  2⤵
  PID:5540
- C:\Windows\System\JIJVNnf.exe
  C:\Windows\System\JIJVNnf.exe
  2⤵
  PID:5568
- C:\Windows\System\aRtNEoW.exe
  C:\Windows\System\aRtNEoW.exe
  2⤵
  PID:5596
- C:\Windows\System\zyisWLj.exe
  C:\Windows\System\zyisWLj.exe
  2⤵
  PID:5624
- C:\Windows\System\ifAjSOS.exe
  C:\Windows\System\ifAjSOS.exe
  2⤵
  PID:5652
- C:\Windows\System\FVuymcX.exe
  C:\Windows\System\FVuymcX.exe
  2⤵
  PID:5680
- C:\Windows\System\JsEZoVy.exe
  C:\Windows\System\JsEZoVy.exe
  2⤵
  PID:5712
- C:\Windows\System\kyQZqld.exe
  C:\Windows\System\kyQZqld.exe
  2⤵
  PID:5740
- C:\Windows\System\CqpdHWO.exe
  C:\Windows\System\CqpdHWO.exe
  2⤵
  PID:5764
- C:\Windows\System\sBlcOXZ.exe
  C:\Windows\System\sBlcOXZ.exe
  2⤵
  PID:5796
- C:\Windows\System\XAfZhMw.exe
  C:\Windows\System\XAfZhMw.exe
  2⤵
  PID:5836
- C:\Windows\System\AXnMOfp.exe
  C:\Windows\System\AXnMOfp.exe
  2⤵
  PID:5852
- C:\Windows\System\rAygpIl.exe
  C:\Windows\System\rAygpIl.exe
  2⤵
  PID:5900
- C:\Windows\System\gyUPTiA.exe
  C:\Windows\System\gyUPTiA.exe
  2⤵
  PID:5964
- C:\Windows\System\osTwsRV.exe
  C:\Windows\System\osTwsRV.exe
  2⤵
  PID:5992
- C:\Windows\System\UndWnCC.exe
  C:\Windows\System\UndWnCC.exe
  2⤵
  PID:6020
- C:\Windows\System\FmwYRJf.exe
  C:\Windows\System\FmwYRJf.exe
  2⤵
  PID:6048
- C:\Windows\System\LsjfgDl.exe
  C:\Windows\System\LsjfgDl.exe
  2⤵
  PID:6072
- C:\Windows\System\vVYLZfn.exe
  C:\Windows\System\vVYLZfn.exe
  2⤵
  PID:6104
- C:\Windows\System\MtrFYvF.exe
  C:\Windows\System\MtrFYvF.exe
  2⤵
  PID:6132
- C:\Windows\System\Rrvzhfu.exe
  C:\Windows\System\Rrvzhfu.exe
  2⤵
  PID:4264
- C:\Windows\System\ivaCzcX.exe
  C:\Windows\System\ivaCzcX.exe
  2⤵
  PID:3148
- C:\Windows\System\tJxhRaY.exe
  C:\Windows\System\tJxhRaY.exe
  2⤵
  PID:1100
- C:\Windows\System\xgJcZiF.exe
  C:\Windows\System\xgJcZiF.exe
  2⤵
  PID:5164
- C:\Windows\System\gqwfKIC.exe
  C:\Windows\System\gqwfKIC.exe
  2⤵
  PID:5228
- C:\Windows\System\veLHWjV.exe
  C:\Windows\System\veLHWjV.exe
  2⤵
  PID:5308
- C:\Windows\System\hQiRTAv.exe
  C:\Windows\System\hQiRTAv.exe
  2⤵
  PID:5368
- C:\Windows\System\FqgiEJn.exe
  C:\Windows\System\FqgiEJn.exe
  2⤵
  PID:5424
- C:\Windows\System\SsKvqEX.exe
  C:\Windows\System\SsKvqEX.exe
  2⤵
  PID:5472
- C:\Windows\System\xdVaBGy.exe
  C:\Windows\System\xdVaBGy.exe
  2⤵
  PID:5508
- C:\Windows\System\MOchtQP.exe
  C:\Windows\System\MOchtQP.exe
  2⤵
  PID:2840
- C:\Windows\System\rhzHkcW.exe
  C:\Windows\System\rhzHkcW.exe
  2⤵
  PID:4644
- C:\Windows\System\FOMQCrF.exe
  C:\Windows\System\FOMQCrF.exe
  2⤵
  PID:5676
- C:\Windows\System\kSyTtFQ.exe
  C:\Windows\System\kSyTtFQ.exe
  2⤵
  PID:1844
- C:\Windows\System\WDyzdIi.exe
  C:\Windows\System\WDyzdIi.exe
  2⤵
  PID:4580
- C:\Windows\System\BjsrAwD.exe
  C:\Windows\System\BjsrAwD.exe
  2⤵
  PID:2112
- C:\Windows\System\OirxAzE.exe
  C:\Windows\System\OirxAzE.exe
  2⤵
  PID:5808
- C:\Windows\System\EsgbTgD.exe
  C:\Windows\System\EsgbTgD.exe
  2⤵
  PID:1848
- C:\Windows\System\ihKZSkN.exe
  C:\Windows\System\ihKZSkN.exe
  2⤵
  PID:5916
- C:\Windows\System\KRSEGyH.exe
  C:\Windows\System\KRSEGyH.exe
  2⤵
  PID:6004
- C:\Windows\System\YNKkWhR.exe
  C:\Windows\System\YNKkWhR.exe
  2⤵
  PID:6068
- C:\Windows\System\tuVJdIY.exe
  C:\Windows\System\tuVJdIY.exe
  2⤵
  PID:6140
- C:\Windows\System\hnuOQWw.exe
  C:\Windows\System\hnuOQWw.exe
  2⤵
  PID:2992
- C:\Windows\System\QyJCczb.exe
  C:\Windows\System\QyJCczb.exe
  2⤵
  PID:5136
- C:\Windows\System\TVrWeeB.exe
  C:\Windows\System\TVrWeeB.exe
  2⤵
  PID:5340
- C:\Windows\System\UntOTOi.exe
  C:\Windows\System\UntOTOi.exe
  2⤵
  PID:5420
- C:\Windows\System\SUcyYOI.exe
  C:\Windows\System\SUcyYOI.exe
  2⤵
  PID:5564
- C:\Windows\System\KCKTGEb.exe
  C:\Windows\System\KCKTGEb.exe
  2⤵
  PID:5672
- C:\Windows\System\NSFsIOP.exe
  C:\Windows\System\NSFsIOP.exe
  2⤵
  PID:5988
- C:\Windows\System\CiNPmCr.exe
  C:\Windows\System\CiNPmCr.exe
  2⤵
  PID:5976
- C:\Windows\System\ZWJvSiJ.exe
  C:\Windows\System\ZWJvSiJ.exe
  2⤵
  PID:2256
- C:\Windows\System\pOEqnBM.exe
  C:\Windows\System\pOEqnBM.exe
  2⤵
  PID:5284
- C:\Windows\System\kywNcRa.exe
  C:\Windows\System\kywNcRa.exe
  2⤵
  PID:3056
- C:\Windows\System\McChlPx.exe
  C:\Windows\System\McChlPx.exe
  2⤵
  PID:4032
- C:\Windows\System\pKHdggb.exe
  C:\Windows\System\pKHdggb.exe
  2⤵
  PID:4992
- C:\Windows\System\KSwaDqR.exe
  C:\Windows\System\KSwaDqR.exe
  2⤵
  PID:5556
- C:\Windows\System\HHrrxAY.exe
  C:\Windows\System\HHrrxAY.exe
  2⤵
  PID:6160
- C:\Windows\System\zkYIyXc.exe
  C:\Windows\System\zkYIyXc.exe
  2⤵
  PID:6188
- C:\Windows\System\tHWaRrj.exe
  C:\Windows\System\tHWaRrj.exe
  2⤵
  PID:6212
- C:\Windows\System\PqImSDz.exe
  C:\Windows\System\PqImSDz.exe
  2⤵
  PID:6236
- C:\Windows\System\XNDBubf.exe
  C:\Windows\System\XNDBubf.exe
  2⤵
  PID:6256
- C:\Windows\System\JTFjkJh.exe
  C:\Windows\System\JTFjkJh.exe
  2⤵
  PID:6280
- C:\Windows\System\uHKfIpc.exe
  C:\Windows\System\uHKfIpc.exe
  2⤵
  PID:6300
- C:\Windows\System\AZqyMoi.exe
  C:\Windows\System\AZqyMoi.exe
  2⤵
  PID:6320
- C:\Windows\System\nkjFszA.exe
  C:\Windows\System\nkjFszA.exe
  2⤵
  PID:6352
- C:\Windows\System\jvUAQgL.exe
  C:\Windows\System\jvUAQgL.exe
  2⤵
  PID:6384
- C:\Windows\System\FVLEJGg.exe
  C:\Windows\System\FVLEJGg.exe
  2⤵
  PID:6408
- C:\Windows\System\pxhURJG.exe
  C:\Windows\System\pxhURJG.exe
  2⤵
  PID:6440
- C:\Windows\System\ppXBVbH.exe
  C:\Windows\System\ppXBVbH.exe
  2⤵
  PID:6476
- C:\Windows\System\xKIupVe.exe
  C:\Windows\System\xKIupVe.exe
  2⤵
  PID:6504
- C:\Windows\System\JHvxeBE.exe
  C:\Windows\System\JHvxeBE.exe
  2⤵
  PID:6568
- C:\Windows\System\UqQxjPy.exe
  C:\Windows\System\UqQxjPy.exe
  2⤵
  PID:6596
- C:\Windows\System\aXwaGqi.exe
  C:\Windows\System\aXwaGqi.exe
  2⤵
  PID:6628
- C:\Windows\System\goRIJuH.exe
  C:\Windows\System\goRIJuH.exe
  2⤵
  PID:6644
- C:\Windows\System\twxuQOf.exe
  C:\Windows\System\twxuQOf.exe
  2⤵
  PID:6676
- C:\Windows\System\gVoiisG.exe
  C:\Windows\System\gVoiisG.exe
  2⤵
  PID:6692
- C:\Windows\System\SbeZPPG.exe
  C:\Windows\System\SbeZPPG.exe
  2⤵
  PID:6716
- C:\Windows\System\lOgbkTs.exe
  C:\Windows\System\lOgbkTs.exe
  2⤵
  PID:6768
- C:\Windows\System\ESWzRVy.exe
  C:\Windows\System\ESWzRVy.exe
  2⤵
  PID:6788
- C:\Windows\System\XHZnRTi.exe
  C:\Windows\System\XHZnRTi.exe
  2⤵
  PID:6820
- C:\Windows\System\OeblbaT.exe
  C:\Windows\System\OeblbaT.exe
  2⤵
  PID:6844
- C:\Windows\System\TsBzdst.exe
  C:\Windows\System\TsBzdst.exe
  2⤵
  PID:6888
- C:\Windows\System\PMAFoih.exe
  C:\Windows\System\PMAFoih.exe
  2⤵
  PID:6916
- C:\Windows\System\xrrQSZR.exe
  C:\Windows\System\xrrQSZR.exe
  2⤵
  PID:6936
- C:\Windows\System\rinSEHY.exe
  C:\Windows\System\rinSEHY.exe
  2⤵
  PID:6980
- C:\Windows\System\CiLRPKI.exe
  C:\Windows\System\CiLRPKI.exe
  2⤵
  PID:6996
- C:\Windows\System\ZcKhsoP.exe
  C:\Windows\System\ZcKhsoP.exe
  2⤵
  PID:7028
- C:\Windows\System\RvLPbIg.exe
  C:\Windows\System\RvLPbIg.exe
  2⤵
  PID:7052
- C:\Windows\System\ZrOJeMZ.exe
  C:\Windows\System\ZrOJeMZ.exe
  2⤵
  PID:7080
- C:\Windows\System\gyawXlZ.exe
  C:\Windows\System\gyawXlZ.exe
  2⤵
  PID:7104
- C:\Windows\System\QSGcnDE.exe
  C:\Windows\System\QSGcnDE.exe
  2⤵
  PID:7132
- C:\Windows\System\uvuYZMW.exe
  C:\Windows\System\uvuYZMW.exe
  2⤵
  PID:6176
- C:\Windows\System\xFfDsgf.exe
  C:\Windows\System\xFfDsgf.exe
  2⤵
  PID:6232
- C:\Windows\System\hVmQnCo.exe
  C:\Windows\System\hVmQnCo.exe
  2⤵
  PID:6340
- C:\Windows\System\bOvrGRB.exe
  C:\Windows\System\bOvrGRB.exe
  2⤵
  PID:6364
- C:\Windows\System\rcJAYbK.exe
  C:\Windows\System\rcJAYbK.exe
  2⤵
  PID:6372
- C:\Windows\System\klHnvJd.exe
  C:\Windows\System\klHnvJd.exe
  2⤵
  PID:6484
- C:\Windows\System\sSmEHXe.exe
  C:\Windows\System\sSmEHXe.exe
  2⤵
  PID:6540
- C:\Windows\System\GDniMqJ.exe
  C:\Windows\System\GDniMqJ.exe
  2⤵
  PID:6612
- C:\Windows\System\jmBHYZF.exe
  C:\Windows\System\jmBHYZF.exe
  2⤵
  PID:6656
- C:\Windows\System\vgaoeNl.exe
  C:\Windows\System\vgaoeNl.exe
  2⤵
  PID:6732
- C:\Windows\System\HToJlMM.exe
  C:\Windows\System\HToJlMM.exe
  2⤵
  PID:6784
- C:\Windows\System\xmvGYuB.exe
  C:\Windows\System\xmvGYuB.exe
  2⤵
  PID:6840
- C:\Windows\System\dYzIfXG.exe
  C:\Windows\System\dYzIfXG.exe
  2⤵
  PID:6912
- C:\Windows\System\QIosCOg.exe
  C:\Windows\System\QIosCOg.exe
  2⤵
  PID:6964
- C:\Windows\System\GEQctrJ.exe
  C:\Windows\System\GEQctrJ.exe
  2⤵
  PID:7036
- C:\Windows\System\rwKdjEm.exe
  C:\Windows\System\rwKdjEm.exe
  2⤵
  PID:7164
- C:\Windows\System\oNLJruB.exe
  C:\Windows\System\oNLJruB.exe
  2⤵
  PID:6276
- C:\Windows\System\peJWMYt.exe
  C:\Windows\System\peJWMYt.exe
  2⤵
  PID:6460
- C:\Windows\System\ynpfXoI.exe
  C:\Windows\System\ynpfXoI.exe
  2⤵
  PID:6580
- C:\Windows\System\TdtYTLt.exe
  C:\Windows\System\TdtYTLt.exe
  2⤵
  PID:6688
- C:\Windows\System\KdWNuLo.exe
  C:\Windows\System\KdWNuLo.exe
  2⤵
  PID:6956
- C:\Windows\System\VHlvtWN.exe
  C:\Windows\System\VHlvtWN.exe
  2⤵
  PID:7096
- C:\Windows\System\hLYBqtN.exe
  C:\Windows\System\hLYBqtN.exe
  2⤵
  PID:6396
- C:\Windows\System\yRRSTmT.exe
  C:\Windows\System\yRRSTmT.exe
  2⤵
  PID:6592
- C:\Windows\System\ioShuMX.exe
  C:\Windows\System\ioShuMX.exe
  2⤵
  PID:7012
- C:\Windows\System\UNIxSWY.exe
  C:\Windows\System\UNIxSWY.exe
  2⤵
  PID:6528
- C:\Windows\System\segORoN.exe
  C:\Windows\System\segORoN.exe
  2⤵
  PID:6268
- C:\Windows\System\UhSeLEQ.exe
  C:\Windows\System\UhSeLEQ.exe
  2⤵
  PID:7196
- C:\Windows\System\OHcDZYj.exe
  C:\Windows\System\OHcDZYj.exe
  2⤵
  PID:7224
- C:\Windows\System\REEhmsG.exe
  C:\Windows\System\REEhmsG.exe
  2⤵
  PID:7252
- C:\Windows\System\NDZItNo.exe
  C:\Windows\System\NDZItNo.exe
  2⤵
  PID:7292
- C:\Windows\System\naoIBVH.exe
  C:\Windows\System\naoIBVH.exe
  2⤵
  PID:7320
- C:\Windows\System\KFfqecU.exe
  C:\Windows\System\KFfqecU.exe
  2⤵
  PID:7348
- C:\Windows\System\NZywVyp.exe
  C:\Windows\System\NZywVyp.exe
  2⤵
  PID:7376
- C:\Windows\System\PvOtEuD.exe
  C:\Windows\System\PvOtEuD.exe
  2⤵
  PID:7396
- C:\Windows\System\KnkgGiW.exe
  C:\Windows\System\KnkgGiW.exe
  2⤵
  PID:7440
- C:\Windows\System\OPIfzNn.exe
  C:\Windows\System\OPIfzNn.exe
  2⤵
  PID:7468
- C:\Windows\System\EDrBoTe.exe
  C:\Windows\System\EDrBoTe.exe
  2⤵
  PID:7496
- C:\Windows\System\VPtOlIP.exe
  C:\Windows\System\VPtOlIP.exe
  2⤵
  PID:7516
- C:\Windows\System\KBsMKtn.exe
  C:\Windows\System\KBsMKtn.exe
  2⤵
  PID:7540
- C:\Windows\System\HDlgSOo.exe
  C:\Windows\System\HDlgSOo.exe
  2⤵
  PID:7580
- C:\Windows\System\nbWsqNR.exe
  C:\Windows\System\nbWsqNR.exe
  2⤵
  PID:7604
- C:\Windows\System\DznTcAe.exe
  C:\Windows\System\DznTcAe.exe
  2⤵
  PID:7624
- C:\Windows\System\CBZUnJx.exe
  C:\Windows\System\CBZUnJx.exe
  2⤵
  PID:7656
- C:\Windows\System\mrQnULY.exe
  C:\Windows\System\mrQnULY.exe
  2⤵
  PID:7684
- C:\Windows\System\yStanfZ.exe
  C:\Windows\System\yStanfZ.exe
  2⤵
  PID:7708
- C:\Windows\System\hGnTnRw.exe
  C:\Windows\System\hGnTnRw.exe
  2⤵
  PID:7736
- C:\Windows\System\mUHUEvc.exe
  C:\Windows\System\mUHUEvc.exe
  2⤵
  PID:7752
- C:\Windows\System\WhKPxZq.exe
  C:\Windows\System\WhKPxZq.exe
  2⤵
  PID:7780
- C:\Windows\System\fPdrVIp.exe
  C:\Windows\System\fPdrVIp.exe
  2⤵
  PID:7808
- C:\Windows\System\XtgFSWe.exe
  C:\Windows\System\XtgFSWe.exe
  2⤵
  PID:7832
- C:\Windows\System\hniFBea.exe
  C:\Windows\System\hniFBea.exe
  2⤵
  PID:7864
- C:\Windows\System\ROIqQYp.exe
  C:\Windows\System\ROIqQYp.exe
  2⤵
  PID:7904
- C:\Windows\System\wFBGkoy.exe
  C:\Windows\System\wFBGkoy.exe
  2⤵
  PID:7932
- C:\Windows\System\oaGHBhs.exe
  C:\Windows\System\oaGHBhs.exe
  2⤵
  PID:7960
- C:\Windows\System\msAtrfU.exe
  C:\Windows\System\msAtrfU.exe
  2⤵
  PID:7988
- C:\Windows\System\qknObwE.exe
  C:\Windows\System\qknObwE.exe
  2⤵
  PID:8028
- C:\Windows\System\hCDSFZr.exe
  C:\Windows\System\hCDSFZr.exe
  2⤵
  PID:8044
- C:\Windows\System\pSTYHav.exe
  C:\Windows\System\pSTYHav.exe
  2⤵
  PID:8084
- C:\Windows\System\GhtjNmK.exe
  C:\Windows\System\GhtjNmK.exe
  2⤵
  PID:8112
- C:\Windows\System\YSErmBZ.exe
  C:\Windows\System\YSErmBZ.exe
  2⤵
  PID:8140
- C:\Windows\System\OCGqJYT.exe
  C:\Windows\System\OCGqJYT.exe
  2⤵
  PID:8168
- C:\Windows\System\KkOEDTp.exe
  C:\Windows\System\KkOEDTp.exe
  2⤵
  PID:6224
- C:\Windows\System\OAGoMTn.exe
  C:\Windows\System\OAGoMTn.exe
  2⤵
  PID:7240
- C:\Windows\System\UbmFAHM.exe
  C:\Windows\System\UbmFAHM.exe
  2⤵
  PID:7336
- C:\Windows\System\zTokcNY.exe
  C:\Windows\System\zTokcNY.exe
  2⤵
  PID:7308
- C:\Windows\System\LCuTRlX.exe
  C:\Windows\System\LCuTRlX.exe
  2⤵
  PID:7420
- C:\Windows\System\UlswNHO.exe
  C:\Windows\System\UlswNHO.exe
  2⤵
  PID:7484
- C:\Windows\System\HbHStlw.exe
  C:\Windows\System\HbHStlw.exe
  2⤵
  PID:7576
- C:\Windows\System\LtUaGHA.exe
  C:\Windows\System\LtUaGHA.exe
  2⤵
  PID:7612
- C:\Windows\System\RzQLDGY.exe
  C:\Windows\System\RzQLDGY.exe
  2⤵
  PID:7672
- C:\Windows\System\gXYXfiO.exe
  C:\Windows\System\gXYXfiO.exe
  2⤵
  PID:7760
- C:\Windows\System\VjxqmDr.exe
  C:\Windows\System\VjxqmDr.exe
  2⤵
  PID:7856
- C:\Windows\System\iWdAhMY.exe
  C:\Windows\System\iWdAhMY.exe
  2⤵
  PID:7816
- C:\Windows\System\JDttJqA.exe
  C:\Windows\System\JDttJqA.exe
  2⤵
  PID:7948
- C:\Windows\System\UsdqgYc.exe
  C:\Windows\System\UsdqgYc.exe
  2⤵
  PID:8004
- C:\Windows\System\nbJYVaf.exe
  C:\Windows\System\nbJYVaf.exe
  2⤵
  PID:8068
- C:\Windows\System\oKcccuM.exe
  C:\Windows\System\oKcccuM.exe
  2⤵
  PID:8132
- C:\Windows\System\HdVXUfu.exe
  C:\Windows\System\HdVXUfu.exe
  2⤵
  PID:8188
- C:\Windows\System\HaSKTjh.exe
  C:\Windows\System\HaSKTjh.exe
  2⤵
  PID:7288
- C:\Windows\System\zmSgxFb.exe
  C:\Windows\System\zmSgxFb.exe
  2⤵
  PID:7392
- C:\Windows\System\eMOHSgK.exe
  C:\Windows\System\eMOHSgK.exe
  2⤵
  PID:7556
- C:\Windows\System\umIpfMe.exe
  C:\Windows\System\umIpfMe.exe
  2⤵
  PID:7724
- C:\Windows\System\QwJCUPR.exe
  C:\Windows\System\QwJCUPR.exe
  2⤵
  PID:8020
- C:\Windows\System\NpdszAU.exe
  C:\Windows\System\NpdszAU.exe
  2⤵
  PID:8040
- C:\Windows\System\NjDZRqn.exe
  C:\Windows\System\NjDZRqn.exe
  2⤵
  PID:7364
- C:\Windows\System\geBSdQj.exe
  C:\Windows\System\geBSdQj.exe
  2⤵
  PID:7432
- C:\Windows\System\qAJKpML.exe
  C:\Windows\System\qAJKpML.exe
  2⤵
  PID:8080
- C:\Windows\System\PXaewme.exe
  C:\Windows\System\PXaewme.exe
  2⤵
  PID:7216
- C:\Windows\System\WEkGNRV.exe
  C:\Windows\System\WEkGNRV.exe
  2⤵
  PID:7968
- C:\Windows\System\iDbQxTj.exe
  C:\Windows\System\iDbQxTj.exe
  2⤵
  PID:8212
- C:\Windows\System\PztzUFl.exe
  C:\Windows\System\PztzUFl.exe
  2⤵
  PID:8240
- C:\Windows\System\osvGogq.exe
  C:\Windows\System\osvGogq.exe
  2⤵
  PID:8268
- C:\Windows\System\uKSNusl.exe
  C:\Windows\System\uKSNusl.exe
  2⤵
  PID:8288
- C:\Windows\System\skYbVbY.exe
  C:\Windows\System\skYbVbY.exe
  2⤵
  PID:8312
- C:\Windows\System\wGNKnhc.exe
  C:\Windows\System\wGNKnhc.exe
  2⤵
  PID:8352
- C:\Windows\System\iNMUQtI.exe
  C:\Windows\System\iNMUQtI.exe
  2⤵
  PID:8380
- C:\Windows\System\vctbFyl.exe
  C:\Windows\System\vctbFyl.exe
  2⤵
  PID:8400
- C:\Windows\System\zUCkAOz.exe
  C:\Windows\System\zUCkAOz.exe
  2⤵
  PID:8436
- C:\Windows\System\LlctLEH.exe
  C:\Windows\System\LlctLEH.exe
  2⤵
  PID:8452
- C:\Windows\System\GKOluTC.exe
  C:\Windows\System\GKOluTC.exe
  2⤵
  PID:8492
- C:\Windows\System\eRYRnvo.exe
  C:\Windows\System\eRYRnvo.exe
  2⤵
  PID:8508
- C:\Windows\System\FKDbhtK.exe
  C:\Windows\System\FKDbhtK.exe
  2⤵
  PID:8548
- C:\Windows\System\mJVVkGR.exe
  C:\Windows\System\mJVVkGR.exe
  2⤵
  PID:8576
- C:\Windows\System\WwLqlQK.exe
  C:\Windows\System\WwLqlQK.exe
  2⤵
  PID:8604
- C:\Windows\System\XyoQTuk.exe
  C:\Windows\System\XyoQTuk.exe
  2⤵
  PID:8624
- C:\Windows\System\UBlKsGw.exe
  C:\Windows\System\UBlKsGw.exe
  2⤵
  PID:8652
- C:\Windows\System\rEwCPSq.exe
  C:\Windows\System\rEwCPSq.exe
  2⤵
  PID:8680
- C:\Windows\System\LEPGeJs.exe
  C:\Windows\System\LEPGeJs.exe
  2⤵
  PID:8716
- C:\Windows\System\HakuqsY.exe
  C:\Windows\System\HakuqsY.exe
  2⤵
  PID:8736
- C:\Windows\System\jVqBsAA.exe
  C:\Windows\System\jVqBsAA.exe
  2⤵
  PID:8760
- C:\Windows\System\ikkvsZi.exe
  C:\Windows\System\ikkvsZi.exe
  2⤵
  PID:8788
- C:\Windows\System\onSwuKm.exe
  C:\Windows\System\onSwuKm.exe
  2⤵
  PID:8816
- C:\Windows\System\XernsjJ.exe
  C:\Windows\System\XernsjJ.exe
  2⤵
  PID:8844
- C:\Windows\System\Zhzzhnh.exe
  C:\Windows\System\Zhzzhnh.exe
  2⤵
  PID:8872
- C:\Windows\System\DBwOzyG.exe
  C:\Windows\System\DBwOzyG.exe
  2⤵
  PID:8900
- C:\Windows\System\RGThQuF.exe
  C:\Windows\System\RGThQuF.exe
  2⤵
  PID:8924
- C:\Windows\System\mKzNzSG.exe
  C:\Windows\System\mKzNzSG.exe
  2⤵
  PID:8956
- C:\Windows\System\FSXVvyI.exe
  C:\Windows\System\FSXVvyI.exe
  2⤵
  PID:8972
- C:\Windows\System\jPMZzyk.exe
  C:\Windows\System\jPMZzyk.exe
  2⤵
  PID:8996
- C:\Windows\System\YSqfOjS.exe
  C:\Windows\System\YSqfOjS.exe
  2⤵
  PID:9024
- C:\Windows\System\NNfoaxY.exe
  C:\Windows\System\NNfoaxY.exe
  2⤵
  PID:9068
- C:\Windows\System\TJztQEI.exe
  C:\Windows\System\TJztQEI.exe
  2⤵
  PID:9088
- C:\Windows\System\LMWlSwx.exe
  C:\Windows\System\LMWlSwx.exe
  2⤵
  PID:9120
- C:\Windows\System\aFqAFsH.exe
  C:\Windows\System\aFqAFsH.exe
  2⤵
  PID:9140
- C:\Windows\System\IAfaawV.exe
  C:\Windows\System\IAfaawV.exe
  2⤵
  PID:9184
- C:\Windows\System\ZUYqFhY.exe
  C:\Windows\System\ZUYqFhY.exe
  2⤵
  PID:9208
- C:\Windows\System\iahCKGr.exe
  C:\Windows\System\iahCKGr.exe
  2⤵
  PID:8200
- C:\Windows\System\CxnJCqe.exe
  C:\Windows\System\CxnJCqe.exe
  2⤵
  PID:8256
- C:\Windows\System\MNVhING.exe
  C:\Windows\System\MNVhING.exe
  2⤵
  PID:8332
- C:\Windows\System\NHGPjdo.exe
  C:\Windows\System\NHGPjdo.exe
  2⤵
  PID:8408
- C:\Windows\System\USHXXkH.exe
  C:\Windows\System\USHXXkH.exe
  2⤵
  PID:8444
- C:\Windows\System\oWptqks.exe
  C:\Windows\System\oWptqks.exe
  2⤵
  PID:8572
- C:\Windows\System\YbiPgRE.exe
  C:\Windows\System\YbiPgRE.exe
  2⤵
  PID:8592
- C:\Windows\System\rzLxeSx.exe
  C:\Windows\System\rzLxeSx.exe
  2⤵
  PID:8640
- C:\Windows\System\FQhsURU.exe
  C:\Windows\System\FQhsURU.exe
  2⤵
  PID:8744
- C:\Windows\System\wOecXpI.exe
  C:\Windows\System\wOecXpI.exe
  2⤵
  PID:8824
- C:\Windows\System\ntrEEeB.exe
  C:\Windows\System\ntrEEeB.exe
  2⤵
  PID:8860
- C:\Windows\System\ZiIetfY.exe
  C:\Windows\System\ZiIetfY.exe
  2⤵
  PID:8968
- C:\Windows\System\ftdWgOS.exe
  C:\Windows\System\ftdWgOS.exe
  2⤵
  PID:9052
- C:\Windows\System\TjOlcIi.exe
  C:\Windows\System\TjOlcIi.exe
  2⤵
  PID:9132
- C:\Windows\System\tWJjJHT.exe
  C:\Windows\System\tWJjJHT.exe
  2⤵
  PID:9152
- C:\Windows\System\FMHkiyy.exe
  C:\Windows\System\FMHkiyy.exe
  2⤵
  PID:9192
- C:\Windows\System\bAVHUlK.exe
  C:\Windows\System\bAVHUlK.exe
  2⤵
  PID:8252
- C:\Windows\System\EGXCGsZ.exe
  C:\Windows\System\EGXCGsZ.exe
  2⤵
  PID:8500
- C:\Windows\System\paqlxSZ.exe
  C:\Windows\System\paqlxSZ.exe
  2⤵
  PID:8596
- C:\Windows\System\NKwkkeT.exe
  C:\Windows\System\NKwkkeT.exe
  2⤵
  PID:8892
- C:\Windows\System\eCmuXMd.exe
  C:\Windows\System\eCmuXMd.exe
  2⤵
  PID:8988
- C:\Windows\System\CFHdtwA.exe
  C:\Windows\System\CFHdtwA.exe
  2⤵
  PID:9172
- C:\Windows\System\pJGunKw.exe
  C:\Windows\System\pJGunKw.exe
  2⤵
  PID:8448
- C:\Windows\System\cXcuzjs.exe
  C:\Windows\System\cXcuzjs.exe
  2⤵
  PID:8660
- C:\Windows\System\dzFPDoc.exe
  C:\Windows\System\dzFPDoc.exe
  2⤵
  PID:8856
- C:\Windows\System\OlXrtNM.exe
  C:\Windows\System\OlXrtNM.exe
  2⤵
  PID:9096
- C:\Windows\System\swzkgSi.exe
  C:\Windows\System\swzkgSi.exe
  2⤵
  PID:9244
- C:\Windows\System\TNYjKYy.exe
  C:\Windows\System\TNYjKYy.exe
  2⤵
  PID:9264
- C:\Windows\System\rnHWcRa.exe
  C:\Windows\System\rnHWcRa.exe
  2⤵
  PID:9296
- C:\Windows\System\lBCmAJQ.exe
  C:\Windows\System\lBCmAJQ.exe
  2⤵
  PID:9324
- C:\Windows\System\xHyhxUm.exe
  C:\Windows\System\xHyhxUm.exe
  2⤵
  PID:9344
- C:\Windows\System\jPpNROP.exe
  C:\Windows\System\jPpNROP.exe
  2⤵
  PID:9384
- C:\Windows\System\AneWdXI.exe
  C:\Windows\System\AneWdXI.exe
  2⤵
  PID:9420
- C:\Windows\System\rseuSir.exe
  C:\Windows\System\rseuSir.exe
  2⤵
  PID:9440
- C:\Windows\System\zwbvlNX.exe
  C:\Windows\System\zwbvlNX.exe
  2⤵
  PID:9460
- C:\Windows\System\FxShJXx.exe
  C:\Windows\System\FxShJXx.exe
  2⤵
  PID:9484
- C:\Windows\System\sRpsWFr.exe
  C:\Windows\System\sRpsWFr.exe
  2⤵
  PID:9524
- C:\Windows\System\BBUlCgW.exe
  C:\Windows\System\BBUlCgW.exe
  2⤵
  PID:9552
- C:\Windows\System\hkTgoHh.exe
  C:\Windows\System\hkTgoHh.exe
  2⤵
  PID:9576
- C:\Windows\System\AvMLnLl.exe
  C:\Windows\System\AvMLnLl.exe
  2⤵
  PID:9600
- C:\Windows\System\ceRkbKz.exe
  C:\Windows\System\ceRkbKz.exe
  2⤵
  PID:9624
- C:\Windows\System\xGHLnmL.exe
  C:\Windows\System\xGHLnmL.exe
  2⤵
  PID:9656
- C:\Windows\System\OQSBUdu.exe
  C:\Windows\System\OQSBUdu.exe
  2⤵
  PID:9692
- C:\Windows\System\oWzNYdY.exe
  C:\Windows\System\oWzNYdY.exe
  2⤵
  PID:9708
- C:\Windows\System\RGlTWSK.exe
  C:\Windows\System\RGlTWSK.exe
  2⤵
  PID:9748
- C:\Windows\System\XGuiRhG.exe
  C:\Windows\System\XGuiRhG.exe
  2⤵
  PID:9776
- C:\Windows\System\gdUQcJL.exe
  C:\Windows\System\gdUQcJL.exe
  2⤵
  PID:9804
- C:\Windows\System\ZLnerwY.exe
  C:\Windows\System\ZLnerwY.exe
  2⤵
  PID:9828
- C:\Windows\System\dglbtqO.exe
  C:\Windows\System\dglbtqO.exe
  2⤵
  PID:9860
- C:\Windows\System\rDATyLl.exe
  C:\Windows\System\rDATyLl.exe
  2⤵
  PID:9888
- C:\Windows\System\aOaQDYn.exe
  C:\Windows\System\aOaQDYn.exe
  2⤵
  PID:9912
- C:\Windows\System\ZhSbwGi.exe
  C:\Windows\System\ZhSbwGi.exe
  2⤵
  PID:9944
- C:\Windows\System\ZKsaknC.exe
  C:\Windows\System\ZKsaknC.exe
  2⤵
  PID:9972
- C:\Windows\System\EiWaEaq.exe
  C:\Windows\System\EiWaEaq.exe
  2⤵
  PID:10000
- C:\Windows\System\VtcAdFd.exe
  C:\Windows\System\VtcAdFd.exe
  2⤵
  PID:10016
- C:\Windows\System\XFbHJTr.exe
  C:\Windows\System\XFbHJTr.exe
  2⤵
  PID:10056
- C:\Windows\System\ferjkvr.exe
  C:\Windows\System\ferjkvr.exe
  2⤵
  PID:10076
- C:\Windows\System\TDujIhJ.exe
  C:\Windows\System\TDujIhJ.exe
  2⤵
  PID:10100
- C:\Windows\System\rEaaMMr.exe
  C:\Windows\System\rEaaMMr.exe
  2⤵
  PID:10128
- C:\Windows\System\bFnGtgK.exe
  C:\Windows\System\bFnGtgK.exe
  2⤵
  PID:10148
- C:\Windows\System\hpQmFLv.exe
  C:\Windows\System\hpQmFLv.exe
  2⤵
  PID:10172
- C:\Windows\System\nweqpsn.exe
  C:\Windows\System\nweqpsn.exe
  2⤵
  PID:10204
- C:\Windows\System\PTSpyQj.exe
  C:\Windows\System\PTSpyQj.exe
  2⤵
  PID:10224
- C:\Windows\System\BiEElUo.exe
  C:\Windows\System\BiEElUo.exe
  2⤵
  PID:9224
- C:\Windows\System\GAMQMji.exe
  C:\Windows\System\GAMQMji.exe
  2⤵
  PID:9340
- C:\Windows\System\loncztI.exe
  C:\Windows\System\loncztI.exe
  2⤵
  PID:9396
- C:\Windows\System\ruZUwvK.exe
  C:\Windows\System\ruZUwvK.exe
  2⤵
  PID:9468
- C:\Windows\System\tfasngm.exe
  C:\Windows\System\tfasngm.exe
  2⤵
  PID:9516
- C:\Windows\System\ORrasaA.exe
  C:\Windows\System\ORrasaA.exe
  2⤵
  PID:9584
- C:\Windows\System\xtPxtiV.exe
  C:\Windows\System\xtPxtiV.exe
  2⤵
  PID:9688
- C:\Windows\System\hYdfgby.exe
  C:\Windows\System\hYdfgby.exe
  2⤵
  PID:9720
- C:\Windows\System\RFcXYhy.exe
  C:\Windows\System\RFcXYhy.exe
  2⤵
  PID:9788
- C:\Windows\System\RARHlJv.exe
  C:\Windows\System\RARHlJv.exe
  2⤵
  PID:9872
- C:\Windows\System\gzcNvuC.exe
  C:\Windows\System\gzcNvuC.exe
  2⤵
  PID:9908
- C:\Windows\System\MDZqwmX.exe
  C:\Windows\System\MDZqwmX.exe
  2⤵
  PID:9968
- C:\Windows\System\YCUgBRj.exe
  C:\Windows\System\YCUgBRj.exe
  2⤵
  PID:10008
- C:\Windows\System\wHncNpR.exe
  C:\Windows\System\wHncNpR.exe
  2⤵
  PID:10096
- C:\Windows\System\SyvEPnL.exe
  C:\Windows\System\SyvEPnL.exe
  2⤵
  PID:10112
- C:\Windows\System\vsJlsUR.exe
  C:\Windows\System\vsJlsUR.exe
  2⤵
  PID:10168
- C:\Windows\System\TUDBuyC.exe
  C:\Windows\System\TUDBuyC.exe
  2⤵
  PID:9284
- C:\Windows\System\InIOBwh.exe
  C:\Windows\System\InIOBwh.exe
  2⤵
  PID:9368
- C:\Windows\System\BnSndbm.exe
  C:\Windows\System\BnSndbm.exe
  2⤵
  PID:9496
- C:\Windows\System\DXGYxWC.exe
  C:\Windows\System\DXGYxWC.exe
  2⤵
  PID:9764
- C:\Windows\System\COKEJqs.exe
  C:\Windows\System\COKEJqs.exe
  2⤵
  PID:9848
- C:\Windows\System\plYmCwQ.exe
  C:\Windows\System\plYmCwQ.exe
  2⤵
  PID:9956
- C:\Windows\System\WpOyflH.exe
  C:\Windows\System\WpOyflH.exe
  2⤵
  PID:10200
- C:\Windows\System\GZjqEaJ.exe
  C:\Windows\System\GZjqEaJ.exe
  2⤵
  PID:9376
- C:\Windows\System\wzYpwmY.exe
  C:\Windows\System\wzYpwmY.exe
  2⤵
  PID:9732
- C:\Windows\System\KfARqKH.exe
  C:\Windows\System\KfARqKH.exe
  2⤵
  PID:10160
- C:\Windows\System\oRyPUYr.exe
  C:\Windows\System\oRyPUYr.exe
  2⤵
  PID:9608
- C:\Windows\System\UnKvgKi.exe
  C:\Windows\System\UnKvgKi.exe
  2⤵
  PID:10252
- C:\Windows\System\XWWnwTP.exe
  C:\Windows\System\XWWnwTP.exe
  2⤵
  PID:10276
- C:\Windows\System\TZOEeRC.exe
  C:\Windows\System\TZOEeRC.exe
  2⤵
  PID:10300
- C:\Windows\System\lrlactW.exe
  C:\Windows\System\lrlactW.exe
  2⤵
  PID:10344
- C:\Windows\System\bhAEWYc.exe
  C:\Windows\System\bhAEWYc.exe
  2⤵
  PID:10376
- C:\Windows\System\blXnfMu.exe
  C:\Windows\System\blXnfMu.exe
  2⤵
  PID:10404
- C:\Windows\System\XLrnjbJ.exe
  C:\Windows\System\XLrnjbJ.exe
  2⤵
  PID:10424
- C:\Windows\System\EFiHBrH.exe
  C:\Windows\System\EFiHBrH.exe
  2⤵
  PID:10452
- C:\Windows\System\JQtZyue.exe
  C:\Windows\System\JQtZyue.exe
  2⤵
  PID:10476
- C:\Windows\System\WeODjzA.exe
  C:\Windows\System\WeODjzA.exe
  2⤵
  PID:10492
- C:\Windows\System\CvcXYPI.exe
  C:\Windows\System\CvcXYPI.exe
  2⤵
  PID:10520
- C:\Windows\System\DINFGLE.exe
  C:\Windows\System\DINFGLE.exe
  2⤵
  PID:10584
- C:\Windows\System\sGsmATB.exe
  C:\Windows\System\sGsmATB.exe
  2⤵
  PID:10600
- C:\Windows\System\luhWwww.exe
  C:\Windows\System\luhWwww.exe
  2⤵
  PID:10628
- C:\Windows\System\ZCBPGkQ.exe
  C:\Windows\System\ZCBPGkQ.exe
  2⤵
  PID:10656
- C:\Windows\System\dGEsQPY.exe
  C:\Windows\System\dGEsQPY.exe
  2⤵
  PID:10684
- C:\Windows\System\sbAneNB.exe
  C:\Windows\System\sbAneNB.exe
  2⤵
  PID:10700
- C:\Windows\System\GwQGxvB.exe
  C:\Windows\System\GwQGxvB.exe
  2⤵
  PID:10724
- C:\Windows\System\MFwXvSW.exe
  C:\Windows\System\MFwXvSW.exe
  2⤵
  PID:10744
- C:\Windows\System\hTsfYYx.exe
  C:\Windows\System\hTsfYYx.exe
  2⤵
  PID:10764
- C:\Windows\System\qnSmdWV.exe
  C:\Windows\System\qnSmdWV.exe
  2⤵
  PID:10804
- C:\Windows\System\AbeionI.exe
  C:\Windows\System\AbeionI.exe
  2⤵
  PID:10828
- C:\Windows\System\qISsjEL.exe
  C:\Windows\System\qISsjEL.exe
  2⤵
  PID:10860
- C:\Windows\System\mtLmcgl.exe
  C:\Windows\System\mtLmcgl.exe
  2⤵
  PID:10888
- C:\Windows\System\nGXKXUi.exe
  C:\Windows\System\nGXKXUi.exe
  2⤵
  PID:10916
- C:\Windows\System\wZIIwbh.exe
  C:\Windows\System\wZIIwbh.exe
  2⤵
  PID:10944
- C:\Windows\System\QoSSIUx.exe
  C:\Windows\System\QoSSIUx.exe
  2⤵
  PID:10992
- C:\Windows\System\qiAIsoW.exe
  C:\Windows\System\qiAIsoW.exe
  2⤵
  PID:11020
- C:\Windows\System\AiFBNzr.exe
  C:\Windows\System\AiFBNzr.exe
  2⤵
  PID:11036
- C:\Windows\System\KBAAMlJ.exe
  C:\Windows\System\KBAAMlJ.exe
  2⤵
  PID:11072
- C:\Windows\System\maCNuib.exe
  C:\Windows\System\maCNuib.exe
  2⤵
  PID:11092
- C:\Windows\System\SecykIq.exe
  C:\Windows\System\SecykIq.exe
  2⤵
  PID:11116
- C:\Windows\System\pYoOasb.exe
  C:\Windows\System\pYoOasb.exe
  2⤵
  PID:11140
- C:\Windows\System\epqlPSZ.exe
  C:\Windows\System\epqlPSZ.exe
  2⤵
  PID:11168
- C:\Windows\System\ggoqLFZ.exe
  C:\Windows\System\ggoqLFZ.exe
  2⤵
  PID:11196
- C:\Windows\System\ycbGWLV.exe
  C:\Windows\System\ycbGWLV.exe
  2⤵
  PID:11224
- C:\Windows\System\iBKoxwA.exe
  C:\Windows\System\iBKoxwA.exe
  2⤵
  PID:11248
- C:\Windows\System\ZfVtZjq.exe
  C:\Windows\System\ZfVtZjq.exe
  2⤵
  PID:9932
- C:\Windows\System\bmbIyDm.exe
  C:\Windows\System\bmbIyDm.exe
  2⤵
  PID:10324
- C:\Windows\System\oCfjGwN.exe
  C:\Windows\System\oCfjGwN.exe
  2⤵
  PID:10364
- C:\Windows\System\lcBdBuo.exe
  C:\Windows\System\lcBdBuo.exe
  2⤵
  PID:10432
- C:\Windows\System\XoqWGxq.exe
  C:\Windows\System\XoqWGxq.exe
  2⤵
  PID:10484
- C:\Windows\System\UrZQrUk.exe
  C:\Windows\System\UrZQrUk.exe
  2⤵
  PID:10528
- C:\Windows\System\gUAOjKf.exe
  C:\Windows\System\gUAOjKf.exe
  2⤵
  PID:10668
- C:\Windows\System\SjjHnxR.exe
  C:\Windows\System\SjjHnxR.exe
  2⤵
  PID:10736
- C:\Windows\System\UxjYYQS.exe
  C:\Windows\System\UxjYYQS.exe
  2⤵
  PID:10784
- C:\Windows\System\jJdLCcp.exe
  C:\Windows\System\jJdLCcp.exe
  2⤵
  PID:10844
- C:\Windows\System\ozgRhMy.exe
  C:\Windows\System\ozgRhMy.exe
  2⤵
  PID:10884
- C:\Windows\System\revFEEf.exe
  C:\Windows\System\revFEEf.exe
  2⤵
  PID:10940
- C:\Windows\System\OmLfbCP.exe
  C:\Windows\System\OmLfbCP.exe
  2⤵
  PID:11012
- C:\Windows\System\toGuGbW.exe
  C:\Windows\System\toGuGbW.exe
  2⤵
  PID:11132
- C:\Windows\System\EVLTOAd.exe
  C:\Windows\System\EVLTOAd.exe
  2⤵
  PID:11184
- C:\Windows\System\mpBSTRL.exe
  C:\Windows\System\mpBSTRL.exe
  2⤵
  PID:11212
- C:\Windows\System\qnZRRdK.exe
  C:\Windows\System\qnZRRdK.exe
  2⤵
  PID:10268
- C:\Windows\System\RFfWDKN.exe
  C:\Windows\System\RFfWDKN.exe
  2⤵
  PID:10612
- C:\Windows\System\bmCsXKT.exe
  C:\Windows\System\bmCsXKT.exe
  2⤵
  PID:10752
- C:\Windows\System\zBeABpI.exe
  C:\Windows\System\zBeABpI.exe
  2⤵
  PID:10740
- C:\Windows\System\bmhmfhI.exe
  C:\Windows\System\bmhmfhI.exe
  2⤵
  PID:10984
- C:\Windows\System\MrIZiZL.exe
  C:\Windows\System\MrIZiZL.exe
  2⤵
  PID:11192
- C:\Windows\System\VFMQeUT.exe
  C:\Windows\System\VFMQeUT.exe
  2⤵
  PID:10372
- C:\Windows\System\ggOKUzZ.exe
  C:\Windows\System\ggOKUzZ.exe
  2⤵
  PID:10516
- C:\Windows\System\lQOgfmB.exe
  C:\Windows\System\lQOgfmB.exe
  2⤵
  PID:10816
- C:\Windows\System\uLfAGyI.exe
  C:\Windows\System\uLfAGyI.exe
  2⤵
  PID:11156
- C:\Windows\System\ALfSOnA.exe
  C:\Windows\System\ALfSOnA.exe
  2⤵
  PID:10676
- C:\Windows\System\WzYPRPv.exe
  C:\Windows\System\WzYPRPv.exe
  2⤵
  PID:11280
- C:\Windows\System\VYPUCNx.exe
  C:\Windows\System\VYPUCNx.exe
  2⤵
  PID:11300
- C:\Windows\System\kOGajaR.exe
  C:\Windows\System\kOGajaR.exe
  2⤵
  PID:11336
- C:\Windows\System\kQbUNXb.exe
  C:\Windows\System\kQbUNXb.exe
  2⤵
  PID:11352
- C:\Windows\System\XyvpWUR.exe
  C:\Windows\System\XyvpWUR.exe
  2⤵
  PID:11380
- C:\Windows\System\zMjovvp.exe
  C:\Windows\System\zMjovvp.exe
  2⤵
  PID:11396
- C:\Windows\System\grQyOSo.exe
  C:\Windows\System\grQyOSo.exe
  2⤵
  PID:11448
- C:\Windows\System\iEfDosq.exe
  C:\Windows\System\iEfDosq.exe
  2⤵
  PID:11464
- C:\Windows\System\aojDPRu.exe
  C:\Windows\System\aojDPRu.exe
  2⤵
  PID:11504
- C:\Windows\System\aLdBthN.exe
  C:\Windows\System\aLdBthN.exe
  2⤵
  PID:11532
- C:\Windows\System\YYpsdNs.exe
  C:\Windows\System\YYpsdNs.exe
  2⤵
  PID:11560
- C:\Windows\System\gPSPAQT.exe
  C:\Windows\System\gPSPAQT.exe
  2⤵
  PID:11588
- C:\Windows\System\AeqDOom.exe
  C:\Windows\System\AeqDOom.exe
  2⤵
  PID:11616
- C:\Windows\System\CDVEcNO.exe
  C:\Windows\System\CDVEcNO.exe
  2⤵
  PID:11644
- C:\Windows\System\tjdYOne.exe
  C:\Windows\System\tjdYOne.exe
  2⤵
  PID:11664
- C:\Windows\System\iFPfYRd.exe
  C:\Windows\System\iFPfYRd.exe
  2⤵
  PID:11688
- C:\Windows\System\EdNfpMd.exe
  C:\Windows\System\EdNfpMd.exe
  2⤵
  PID:11728
- C:\Windows\System\rmZnefQ.exe
  C:\Windows\System\rmZnefQ.exe
  2⤵
  PID:11744
- C:\Windows\System\nbwOeLa.exe
  C:\Windows\System\nbwOeLa.exe
  2⤵
  PID:11772
- C:\Windows\System\aUeNcoy.exe
  C:\Windows\System\aUeNcoy.exe
  2⤵
  PID:11812
- C:\Windows\System\ZGGepXb.exe
  C:\Windows\System\ZGGepXb.exe
  2⤵
  PID:11828
- C:\Windows\System\bpuZNzk.exe
  C:\Windows\System\bpuZNzk.exe
  2⤵
  PID:11844
- C:\Windows\System\NFnrxpm.exe
  C:\Windows\System\NFnrxpm.exe
  2⤵
  PID:11880
- C:\Windows\System\maUUtRX.exe
  C:\Windows\System\maUUtRX.exe
  2⤵
  PID:11900
- C:\Windows\System\TmJEIpL.exe
  C:\Windows\System\TmJEIpL.exe
  2⤵
  PID:11924
- C:\Windows\System\CBfGkut.exe
  C:\Windows\System\CBfGkut.exe
  2⤵
  PID:11968
- C:\Windows\System\QZZEuVs.exe
  C:\Windows\System\QZZEuVs.exe
  2⤵
  PID:11992
- C:\Windows\System\miKbCxu.exe
  C:\Windows\System\miKbCxu.exe
  2⤵
  PID:12012
- C:\Windows\System\wCpiEhV.exe
  C:\Windows\System\wCpiEhV.exe
  2⤵
  PID:12048
- C:\Windows\System\VgvEnWz.exe
  C:\Windows\System\VgvEnWz.exe
  2⤵
  PID:12084
- C:\Windows\System\PBxpELg.exe
  C:\Windows\System\PBxpELg.exe
  2⤵
  PID:12104
- C:\Windows\System\KrzVErM.exe
  C:\Windows\System\KrzVErM.exe
  2⤵
  PID:12124
- C:\Windows\System\xMmnFyt.exe
  C:\Windows\System\xMmnFyt.exe
  2⤵
  PID:12148
- C:\Windows\System\PFldqvT.exe
  C:\Windows\System\PFldqvT.exe
  2⤵
  PID:12180
- C:\Windows\System\ouBRXkj.exe
  C:\Windows\System\ouBRXkj.exe
  2⤵
  PID:12212
- C:\Windows\System\TrXWvIs.exe
  C:\Windows\System\TrXWvIs.exe
  2⤵
  PID:12236
- C:\Windows\System\OtYdiEB.exe
  C:\Windows\System\OtYdiEB.exe
  2⤵
  PID:12260
- C:\Windows\System\dlPWDVV.exe
  C:\Windows\System\dlPWDVV.exe
  2⤵
  PID:11268
- C:\Windows\System\YdZcKYz.exe
  C:\Windows\System\YdZcKYz.exe
  2⤵
  PID:11332
- C:\Windows\System\kuKwXfJ.exe
  C:\Windows\System\kuKwXfJ.exe
  2⤵
  PID:11372
- C:\Windows\System\lGUCTQQ.exe
  C:\Windows\System\lGUCTQQ.exe
  2⤵
  PID:11456
- C:\Windows\System\IaFdvXA.exe
  C:\Windows\System\IaFdvXA.exe
  2⤵
  PID:11556
- C:\Windows\System\TqoilSL.exe
  C:\Windows\System\TqoilSL.exe
  2⤵
  PID:11672
- C:\Windows\System\OHBpXsj.exe
  C:\Windows\System\OHBpXsj.exe
  2⤵
  PID:11724
- C:\Windows\System\UkyxNQv.exe
  C:\Windows\System\UkyxNQv.exe
  2⤵
  PID:11760
- C:\Windows\System\zfTXvce.exe
  C:\Windows\System\zfTXvce.exe
  2⤵
  PID:11824
- C:\Windows\System\cZRYZxQ.exe
  C:\Windows\System\cZRYZxQ.exe
  2⤵
  PID:11892
- C:\Windows\System\dsCwOuH.exe
  C:\Windows\System\dsCwOuH.exe
  2⤵
  PID:11984
- C:\Windows\System\MBYRFcU.exe
  C:\Windows\System\MBYRFcU.exe
  2⤵
  PID:12064
- C:\Windows\System\yZifMNJ.exe
  C:\Windows\System\yZifMNJ.exe
  2⤵
  PID:12068
- C:\Windows\System\aHPfoiY.exe
  C:\Windows\System\aHPfoiY.exe
  2⤵
  PID:12116
- C:\Windows\System\EpfAnAF.exe
  C:\Windows\System\EpfAnAF.exe
  2⤵
  PID:12176
- C:\Windows\System\JbEqPzd.exe
  C:\Windows\System\JbEqPzd.exe
  2⤵
  PID:12224
- C:\Windows\System\qdowLdd.exe
  C:\Windows\System\qdowLdd.exe
  2⤵
  PID:11324
- C:\Windows\System\QLNHdGD.exe
  C:\Windows\System\QLNHdGD.exe
  2⤵
  PID:11420
- C:\Windows\System\ZIPfXhQ.exe
  C:\Windows\System\ZIPfXhQ.exe
  2⤵
  PID:11784
- C:\Windows\System\uTteGNs.exe
  C:\Windows\System\uTteGNs.exe
  2⤵
  PID:11856
- C:\Windows\System\RSbkWFR.exe
  C:\Windows\System\RSbkWFR.exe
  2⤵
  PID:11964
- C:\Windows\System\InajWqa.exe
  C:\Windows\System\InajWqa.exe
  2⤵
  PID:12092
- C:\Windows\System\DKBESuF.exe
  C:\Windows\System\DKBESuF.exe
  2⤵
  PID:12192
- C:\Windows\System\aIaYWXZ.exe
  C:\Windows\System\aIaYWXZ.exe
  2⤵
  PID:11308
- C:\Windows\System\zMqxsJl.exe
  C:\Windows\System\zMqxsJl.exe
  2⤵
  PID:11720
- C:\Windows\System\FytsqhW.exe
  C:\Windows\System\FytsqhW.exe
  2⤵
  PID:11888
- C:\Windows\System\wHJoaSy.exe
  C:\Windows\System\wHJoaSy.exe
  2⤵
  PID:11364
- C:\Windows\System\gviJWXS.exe
  C:\Windows\System\gviJWXS.exe
  2⤵
  PID:12304
- C:\Windows\System\eWUfFQO.exe
  C:\Windows\System\eWUfFQO.exe
  2⤵
  PID:12348
- C:\Windows\System\WIhiTDN.exe
  C:\Windows\System\WIhiTDN.exe
  2⤵
  PID:12372
- C:\Windows\System\tqJzGfh.exe
  C:\Windows\System\tqJzGfh.exe
  2⤵
  PID:12416
- C:\Windows\System\fxYKIoO.exe
  C:\Windows\System\fxYKIoO.exe
  2⤵
  PID:12456
- C:\Windows\System\MiRXziP.exe
  C:\Windows\System\MiRXziP.exe
  2⤵
  PID:12472
- C:\Windows\System\vIAZSWg.exe
  C:\Windows\System\vIAZSWg.exe
  2⤵
  PID:12496
- C:\Windows\System\kJaqJBI.exe
  C:\Windows\System\kJaqJBI.exe
  2⤵
  PID:12516
- C:\Windows\System\SoUzNOA.exe
  C:\Windows\System\SoUzNOA.exe
  2⤵
  PID:12544
- C:\Windows\System\FIAdkJw.exe
  C:\Windows\System\FIAdkJw.exe
  2⤵
  PID:12596
- C:\Windows\System\jGLxsDf.exe
  C:\Windows\System\jGLxsDf.exe
  2⤵
  PID:12612
- C:\Windows\System\bTDSFrc.exe
  C:\Windows\System\bTDSFrc.exe
  2⤵
  PID:12628
- C:\Windows\System\kEibPMF.exe
  C:\Windows\System\kEibPMF.exe
  2⤵
  PID:12680
- C:\Windows\System\cyaSOvk.exe
  C:\Windows\System\cyaSOvk.exe
  2⤵
  PID:12696
- C:\Windows\System\XYMFClG.exe
  C:\Windows\System\XYMFClG.exe
  2⤵
  PID:12712
- C:\Windows\System\bZASyHd.exe
  C:\Windows\System\bZASyHd.exe
  2⤵
  PID:12728
- C:\Windows\System\XAacdGj.exe
  C:\Windows\System\XAacdGj.exe
  2⤵
  PID:12760
- C:\Windows\System\iIOKhFJ.exe
  C:\Windows\System\iIOKhFJ.exe
  2⤵
  PID:12808
- C:\Windows\System\jTNZAoR.exe
  C:\Windows\System\jTNZAoR.exe
  2⤵
  PID:12836
- C:\Windows\System\maYctzY.exe
  C:\Windows\System\maYctzY.exe
  2⤵
  PID:12860
- C:\Windows\System\MjXurEp.exe
  C:\Windows\System\MjXurEp.exe
  2⤵
  PID:12892
- C:\Windows\System\bpUQIjX.exe
  C:\Windows\System\bpUQIjX.exe
  2⤵
  PID:12916
- C:\Windows\System\wFqCQsX.exe
  C:\Windows\System\wFqCQsX.exe
  2⤵
  PID:12948
- C:\Windows\System\XxTFFeS.exe
  C:\Windows\System\XxTFFeS.exe
  2⤵
  PID:12988
- C:\Windows\System\ByORdRO.exe
  C:\Windows\System\ByORdRO.exe
  2⤵
  PID:13016
- C:\Windows\System\OZEpxQD.exe
  C:\Windows\System\OZEpxQD.exe
  2⤵
  PID:13036
- C:\Windows\System\ocxqbyK.exe
  C:\Windows\System\ocxqbyK.exe
  2⤵
  PID:13056
- C:\Windows\System\sPPLoYR.exe
  C:\Windows\System\sPPLoYR.exe
  2⤵
  PID:13080
- C:\Windows\System\NfOSeAb.exe
  C:\Windows\System\NfOSeAb.exe
  2⤵
  PID:13104
- C:\Windows\System\ZwYzQQx.exe
  C:\Windows\System\ZwYzQQx.exe
  2⤵
  PID:13128
- C:\Windows\System\PZbaqLb.exe
  C:\Windows\System\PZbaqLb.exe
  2⤵
  PID:13148
- C:\Windows\System\aWUyVip.exe
  C:\Windows\System\aWUyVip.exe
  2⤵
  PID:13168
- C:\Windows\System\LoMNVvl.exe
  C:\Windows\System\LoMNVvl.exe
  2⤵
  PID:13188
- C:\Windows\System\UZrCFNq.exe
  C:\Windows\System\UZrCFNq.exe
  2⤵
  PID:13212
- C:\Windows\System\ElMDGLo.exe
  C:\Windows\System\ElMDGLo.exe
  2⤵
  PID:13264
- C:\Windows\System\MDmggkN.exe
  C:\Windows\System\MDmggkN.exe
  2⤵
  PID:13296
- C:\Windows\System\bTsmBcO.exe
  C:\Windows\System\bTsmBcO.exe
  2⤵
  PID:12172
- C:\Windows\System\buopHsb.exe
  C:\Windows\System\buopHsb.exe
  2⤵
  PID:12300
- C:\Windows\System\fLrmWXC.exe
  C:\Windows\System\fLrmWXC.exe
  2⤵
  PID:12368
- C:\Windows\System\ZhJZwCC.exe
  C:\Windows\System\ZhJZwCC.exe
  2⤵
  PID:12428
- C:\Windows\System\JgXMipV.exe
  C:\Windows\System\JgXMipV.exe
  2⤵
  PID:12488
- C:\Windows\System\ozjWoAI.exe
  C:\Windows\System\ozjWoAI.exe
  2⤵
  PID:12576
- C:\Windows\System\KXJWyUL.exe
  C:\Windows\System\KXJWyUL.exe
  2⤵
  PID:12688
- C:\Windows\System\yiRAfwF.exe
  C:\Windows\System\yiRAfwF.exe
  2⤵
  PID:12800
- C:\Windows\System\TzyTVeB.exe
  C:\Windows\System\TzyTVeB.exe
  2⤵
  PID:12852
- C:\Windows\System\UvleNTS.exe
  C:\Windows\System\UvleNTS.exe
  2⤵
  PID:12924
- C:\Windows\System\wyMbLEQ.exe
  C:\Windows\System\wyMbLEQ.exe
  2⤵
  PID:12972
- C:\Windows\System\DYReNFr.exe
  C:\Windows\System\DYReNFr.exe
  2⤵
  PID:13012
- C:\Windows\System\FctafeD.exe
  C:\Windows\System\FctafeD.exe
  2⤵
  PID:13068
- C:\Windows\System\dawADmc.exe
  C:\Windows\System\dawADmc.exe
  2⤵
  PID:13124
- C:\Windows\System\AICLWlJ.exe
  C:\Windows\System\AICLWlJ.exe
  2⤵
  PID:13236
- C:\Windows\System\rwqivGm.exe
  C:\Windows\System\rwqivGm.exe
  2⤵
  PID:13156
- C:\Windows\System\oHUWHof.exe
  C:\Windows\System\oHUWHof.exe
  2⤵
  PID:12292
- C:\Windows\System\foxSXtU.exe
  C:\Windows\System\foxSXtU.exe
  2⤵
  PID:12448
- C:\Windows\System\FSDxxcP.exe
  C:\Windows\System\FSDxxcP.exe
  2⤵
  PID:12672
- C:\Windows\System\EMTpiwE.exe
  C:\Windows\System\EMTpiwE.exe
  2⤵
  PID:12844
- C:\Windows\System\cCkcYEN.exe
  C:\Windows\System\cCkcYEN.exe
  2⤵
  PID:12940
- C:\Windows\System\zGskdkQ.exe
  C:\Windows\System\zGskdkQ.exe
  2⤵
  PID:13176
- C:\Windows\System\gtCEgjs.exe
  C:\Windows\System\gtCEgjs.exe
  2⤵
  PID:12364
- C:\Windows\System\zyXBCmU.exe
  C:\Windows\System\zyXBCmU.exe
  2⤵
  PID:12396
- C:\Windows\System\lvwZboB.exe
  C:\Windows\System\lvwZboB.exe
  2⤵
  PID:12756
- C:\Windows\System\xxjOxxA.exe
  C:\Windows\System\xxjOxxA.exe
  2⤵
  PID:13116
- C:\Windows\System\CqXGXRu.exe
  C:\Windows\System\CqXGXRu.exe
  2⤵
  PID:13276
- C:\Windows\System\ZltFFhj.exe
  C:\Windows\System\ZltFFhj.exe
  2⤵
  PID:13280
- C:\Windows\System\HzwjAsS.exe
  C:\Windows\System\HzwjAsS.exe
  2⤵
  PID:13340
- C:\Windows\System\toQzNCD.exe
  C:\Windows\System\toQzNCD.exe
  2⤵
  PID:13368
- C:\Windows\System\wVdalLc.exe
  C:\Windows\System\wVdalLc.exe
  2⤵
  PID:13388
- C:\Windows\System\MLnfpat.exe
  C:\Windows\System\MLnfpat.exe
  2⤵
  PID:13428
- C:\Windows\System\geaPlUO.exe
  C:\Windows\System\geaPlUO.exe
  2⤵
  PID:13448
- C:\Windows\System\tuYSIBh.exe
  C:\Windows\System\tuYSIBh.exe
  2⤵
  PID:13476
- C:\Windows\System\aYrxSxG.exe
  C:\Windows\System\aYrxSxG.exe
  2⤵
  PID:13500
- C:\Windows\System\vRHtpjW.exe
  C:\Windows\System\vRHtpjW.exe
  2⤵
  PID:13528
- C:\Windows\System\dAhkAxU.exe
  C:\Windows\System\dAhkAxU.exe
  2⤵
  PID:13572
- C:\Windows\System\eOLqLro.exe
  C:\Windows\System\eOLqLro.exe
  2⤵
  PID:13596
- C:\Windows\System\PmPZCZq.exe
  C:\Windows\System\PmPZCZq.exe
  2⤵
  PID:13612
- C:\Windows\System\gCPawof.exe
  C:\Windows\System\gCPawof.exe
  2⤵
  PID:13632
- C:\Windows\System\lEXOfJp.exe
  C:\Windows\System\lEXOfJp.exe
  2⤵
  PID:13656
- C:\Windows\System\WPcmLBJ.exe
  C:\Windows\System\WPcmLBJ.exe
  2⤵
  PID:13696
- C:\Windows\System\ItvIAFH.exe
  C:\Windows\System\ItvIAFH.exe
  2⤵
  PID:13748
- C:\Windows\System\ZICkjuJ.exe
  C:\Windows\System\ZICkjuJ.exe
  2⤵
  PID:13764
- C:\Windows\System\tvHNdlb.exe
  C:\Windows\System\tvHNdlb.exe
  2⤵
  PID:13788
- C:\Windows\System\BSqKTpr.exe
  C:\Windows\System\BSqKTpr.exe
  2⤵
  PID:13808
- C:\Windows\System\rZNKxVA.exe
  C:\Windows\System\rZNKxVA.exe
  2⤵
  PID:13860
- C:\Windows\System\ogxhCEB.exe
  C:\Windows\System\ogxhCEB.exe
  2⤵
  PID:13888
- C:\Windows\System\AfudzWa.exe
  C:\Windows\System\AfudzWa.exe
  2⤵
  PID:13912
- C:\Windows\System\QokWNnR.exe
  C:\Windows\System\QokWNnR.exe
  2⤵
  PID:13932
- C:\Windows\System\dSCjDVJ.exe
  C:\Windows\System\dSCjDVJ.exe
  2⤵
  PID:13948
- C:\Windows\System\sBXNDso.exe
  C:\Windows\System\sBXNDso.exe
  2⤵
  PID:13968
- C:\Windows\System\nuTqTzy.exe
  C:\Windows\System\nuTqTzy.exe
  2⤵
  PID:14016
- C:\Windows\System\ciatXYL.exe
  C:\Windows\System\ciatXYL.exe
  2⤵
  PID:14040
- C:\Windows\System\FhwSCno.exe
  C:\Windows\System\FhwSCno.exe
  2⤵
  PID:14060
- C:\Windows\System\SvYtCEh.exe
  C:\Windows\System\SvYtCEh.exe
  2⤵
  PID:14112
- C:\Windows\System\uXpROXZ.exe
  C:\Windows\System\uXpROXZ.exe
  2⤵
  PID:14128
- C:\Windows\System\uLqmvNy.exe
  C:\Windows\System\uLqmvNy.exe
  2⤵
  PID:14156
- C:\Windows\System\mVRwOoA.exe
  C:\Windows\System\mVRwOoA.exe
  2⤵
  PID:14176
- C:\Windows\System\zsLnGxu.exe
  C:\Windows\System\zsLnGxu.exe
  2⤵
  PID:14200
- C:\Windows\System\IsyMNuS.exe
  C:\Windows\System\IsyMNuS.exe
  2⤵
  PID:14252
- C:\Windows\System\OVtsVii.exe
  C:\Windows\System\OVtsVii.exe
  2⤵
  PID:14272
- C:\Windows\System\wrFUnBl.exe
  C:\Windows\System\wrFUnBl.exe
  2⤵
  PID:14292
- C:\Windows\System\ijamHdA.exe
  C:\Windows\System\ijamHdA.exe
  2⤵
  PID:14312
- C:\Windows\System\EvhZAdK.exe
  C:\Windows\System\EvhZAdK.exe
  2⤵
  PID:14328
- C:\Windows\System\cVaHyzY.exe
  C:\Windows\System\cVaHyzY.exe
  2⤵
  PID:13404
- C:\Windows\System\oeJVSFf.exe
  C:\Windows\System\oeJVSFf.exe
  2⤵
  PID:13380
- C:\Windows\System\bxDdPuu.exe
  C:\Windows\System\bxDdPuu.exe
  2⤵
  PID:13464
- C:\Windows\System\mnOspHL.exe
  C:\Windows\System\mnOspHL.exe
  2⤵
  PID:13516
- C:\Windows\System\GUSzqAF.exe
  C:\Windows\System\GUSzqAF.exe
  2⤵
  PID:13628
- C:\Windows\System\WHIFpCe.exe
  C:\Windows\System\WHIFpCe.exe
  2⤵
  PID:13652
- C:\Windows\System\xqxdMHB.exe
  C:\Windows\System\xqxdMHB.exe
  2⤵
  PID:13740
- C:\Windows\System\fIcUAFW.exe
  C:\Windows\System\fIcUAFW.exe
  2⤵
  PID:13784
- C:\Windows\System\oVIwxvF.exe
  C:\Windows\System\oVIwxvF.exe
  2⤵
  PID:13884
- C:\Windows\System\qHCOHRu.exe
  C:\Windows\System\qHCOHRu.exe
  2⤵
  PID:13940
- C:\Windows\System\ByaQHDb.exe
  C:\Windows\System\ByaQHDb.exe
  2⤵
  PID:14008
- C:\Windows\System\nzRhGek.exe
  C:\Windows\System\nzRhGek.exe
  2⤵
  PID:14032
- C:\Windows\System\qGejOhF.exe
  C:\Windows\System\qGejOhF.exe
  2⤵
  PID:14120
- C:\Windows\System\DnumeMy.exe
  C:\Windows\System\DnumeMy.exe
  2⤵
  PID:14196
- C:\Windows\System\ZQJlpGx.exe
  C:\Windows\System\ZQJlpGx.exe
  2⤵
  PID:14280
- C:\Windows\System\NCyIZZc.exe
  C:\Windows\System\NCyIZZc.exe
  2⤵
  PID:12884
- C:\Windows\System\kBDjGtL.exe
  C:\Windows\System\kBDjGtL.exe
  2⤵
  PID:13604
- C:\Windows\System\qBAMIoc.exe
  C:\Windows\System\qBAMIoc.exe
  2⤵
  PID:13648
- C:\Windows\System\PmIfUkc.exe
  C:\Windows\System\PmIfUkc.exe
  2⤵
  PID:13876
- C:\Windows\System\hgXwiJw.exe
  C:\Windows\System\hgXwiJw.exe
  2⤵
  PID:14056
- C:\Windows\System\PXhdZos.exe
  C:\Windows\System\PXhdZos.exe
  2⤵
  PID:14072
- C:\Windows\System\qVLoFAG.exe
  C:\Windows\System\qVLoFAG.exe
  2⤵
  PID:14236
- C:\Windows\System\tPMnXkV.exe
  C:\Windows\System\tPMnXkV.exe
  2⤵
  PID:14308
- C:\Windows\System\RDcSXks.exe
  C:\Windows\System\RDcSXks.exe
  2⤵
  PID:13672
- C:\Windows\System\MBWyvZs.exe
  C:\Windows\System\MBWyvZs.exe
  2⤵
  PID:14124
- C:\Windows\System\ymZJZYA.exe
  C:\Windows\System\ymZJZYA.exe
  2⤵
  PID:13708
- C:\Windows\System\GOGhjkL.exe
  C:\Windows\System\GOGhjkL.exe
  2⤵
  PID:14356
- C:\Windows\System\KPxnXgs.exe
  C:\Windows\System\KPxnXgs.exe
  2⤵
  PID:14380
- C:\Windows\System\fSUPJlL.exe
  C:\Windows\System\fSUPJlL.exe
  2⤵
  PID:14416
- C:\Windows\System\XnWJuEG.exe
  C:\Windows\System\XnWJuEG.exe
  2⤵
  PID:14440
- C:\Windows\System\aNAtHaK.exe
  C:\Windows\System\aNAtHaK.exe
  2⤵
  PID:14464
- C:\Windows\System\GRzulxK.exe
  C:\Windows\System\GRzulxK.exe
  2⤵
  PID:14492
- C:\Windows\System\wYZMtAG.exe
  C:\Windows\System\wYZMtAG.exe
  2⤵
  PID:14516
- C:\Windows\System\TlfrbNN.exe
  C:\Windows\System\TlfrbNN.exe
  2⤵
  PID:14544
- C:\Windows\System\LGBmHMA.exe
  C:\Windows\System\LGBmHMA.exe
  2⤵
  PID:14568
- C:\Windows\System\SAmGnyK.exe
  C:\Windows\System\SAmGnyK.exe
  2⤵
  PID:14592
- C:\Windows\System\xvhUEze.exe
  C:\Windows\System\xvhUEze.exe
  2⤵
  PID:14644
- C:\Windows\System\XBEASHp.exe
  C:\Windows\System\XBEASHp.exe
  2⤵
  PID:14660
- C:\Windows\System\dijjjwT.exe
  C:\Windows\System\dijjjwT.exe
  2⤵
  PID:14676
- C:\Windows\System\LSOctqI.exe
  C:\Windows\System\LSOctqI.exe
  2⤵
  PID:14716
- C:\Windows\System\FCVSnmi.exe
  C:\Windows\System\FCVSnmi.exe
  2⤵
  PID:14736
- C:\Windows\System\juaExjW.exe
  C:\Windows\System\juaExjW.exe
  2⤵
  PID:14772
- C:\Windows\System\fNeJqkE.exe
  C:\Windows\System\fNeJqkE.exe
  2⤵
  PID:14812
- C:\Windows\System\ROTMmmp.exe
  C:\Windows\System\ROTMmmp.exe
  2⤵
  PID:14828
- C:\Windows\System\tEervfr.exe
  C:\Windows\System\tEervfr.exe
  2⤵
  PID:14844
- C:\Windows\System\wBCflyC.exe
  C:\Windows\System\wBCflyC.exe
  2⤵
  PID:14864
- C:\Windows\System\xCCGQzq.exe
  C:\Windows\System\xCCGQzq.exe
  2⤵
  PID:14892
- C:\Windows\System\pJKTfDn.exe
  C:\Windows\System\pJKTfDn.exe
  2⤵
  PID:14932
- C:\Windows\System\tMJahvQ.exe
  C:\Windows\System\tMJahvQ.exe
  2⤵
  PID:14964
- C:\Windows\System\gbVJYMJ.exe
  C:\Windows\System\gbVJYMJ.exe
  2⤵
  PID:15000
- C:\Windows\System\SgxAstC.exe
  C:\Windows\System\SgxAstC.exe
  2⤵
  PID:15024
- C:\Windows\System\uzfQZGA.exe
  C:\Windows\System\uzfQZGA.exe
  2⤵
  PID:15048
- C:\Windows\System\CazbdJI.exe
  C:\Windows\System\CazbdJI.exe
  2⤵
  PID:15076
- C:\Windows\System\SljiAQq.exe
  C:\Windows\System\SljiAQq.exe
  2⤵
  PID:15092
- C:\Windows\System\isZnpHj.exe
  C:\Windows\System\isZnpHj.exe
  2⤵
  PID:15120
- C:\Windows\System\wElctJK.exe
  C:\Windows\System\wElctJK.exe
  2⤵
  PID:15140
- C:\Windows\System\bQlTtzY.exe
  C:\Windows\System\bQlTtzY.exe
  2⤵
  PID:15172
- C:\Windows\System\LNOHuUu.exe
  C:\Windows\System\LNOHuUu.exe
  2⤵
  PID:15204
- C:\Windows\System\JbDXhda.exe
  C:\Windows\System\JbDXhda.exe
  2⤵
  PID:15228
- C:\Windows\System\kYfoKbZ.exe
  C:\Windows\System\kYfoKbZ.exe
  2⤵
  PID:15248
- C:\Windows\System\sNDAGBw.exe
  C:\Windows\System\sNDAGBw.exe
  2⤵
  PID:15268
- C:\Windows\System\xKkhfoV.exe
  C:\Windows\System\xKkhfoV.exe
  2⤵
  PID:15300
- C:\Windows\System\kCASuYs.exe
  C:\Windows\System\kCASuYs.exe
  2⤵
  PID:15348
- C:\Windows\System\iJEAhpK.exe
  C:\Windows\System\iJEAhpK.exe
  2⤵
  PID:14372
- C:\Windows\System\nmSBwqO.exe
  C:\Windows\System\nmSBwqO.exe
  2⤵
  PID:14428
- C:\Windows\System\oFyhIpl.exe
  C:\Windows\System\oFyhIpl.exe
  2⤵
  PID:14512
- C:\Windows\System\drOIcyV.exe
  C:\Windows\System\drOIcyV.exe
  2⤵
  PID:14556
- C:\Windows\System\nVUIQfM.exe
  C:\Windows\System\nVUIQfM.exe
  2⤵
  PID:14584
- C:\Windows\System\HuUSsJj.exe
  C:\Windows\System\HuUSsJj.exe
  2⤵
  PID:14672
- C:\Windows\System\jBgoGAU.exe
  C:\Windows\System\jBgoGAU.exe
  2⤵
  PID:14788
- C:\Windows\System\nioqNXi.exe
  C:\Windows\System\nioqNXi.exe
  2⤵
  PID:14852
- C:\Windows\System\jHgESgz.exe
  C:\Windows\System\jHgESgz.exe
  2⤵
  PID:14920
- C:\Windows\System\mmpGsrw.exe
  C:\Windows\System\mmpGsrw.exe
  2⤵
  PID:14952
- C:\Windows\System\HsRSvMK.exe
  C:\Windows\System\HsRSvMK.exe
  2⤵
  PID:15068
- C:\Windows\System\QSlIAtO.exe
  C:\Windows\System\QSlIAtO.exe
  2⤵
  PID:15148
- C:\Windows\System\tGpQppC.exe
  C:\Windows\System\tGpQppC.exe
  2⤵
  PID:15108
- C:\Windows\System\WesmmbE.exe
  C:\Windows\System\WesmmbE.exe
  2⤵
  PID:15224
- C:\Windows\System\vkUMBna.exe
  C:\Windows\System\vkUMBna.exe
  2⤵
  PID:15320
- C:\Windows\System\xgUVTTF.exe
  C:\Windows\System\xgUVTTF.exe
  2⤵
  PID:15332
- C:\Windows\System\yvtORLI.exe
  C:\Windows\System\yvtORLI.exe
  2⤵
  PID:14528
- C:\Windows\System\lprbjVF.exe
  C:\Windows\System\lprbjVF.exe
  2⤵
  PID:14656
- C:\Windows\System\BXxUVCq.exe
  C:\Windows\System\BXxUVCq.exe
  2⤵
  PID:14916
- C:\Windows\System\MOqYgUA.exe
  C:\Windows\System\MOqYgUA.exe
  2⤵
  PID:14820
- C:\Windows\System\geJlFUt.exe
  C:\Windows\System\geJlFUt.exe
  2⤵
  PID:15040
- C:\Windows\System\Vnuvqnn.exe
  C:\Windows\System\Vnuvqnn.exe
  2⤵
  PID:15132
- C:\Windows\System\TfZUwyw.exe
  C:\Windows\System\TfZUwyw.exe
  2⤵
  PID:15256
- C:\Windows\System\PvEWBsz.exe
  C:\Windows\System\PvEWBsz.exe
  2⤵
  PID:14368
- C:\Windows\System\FSlihtT.exe
  C:\Windows\System\FSlihtT.exe
  2⤵
  PID:14704
- C:\Windows\System\fPLxJFS.exe
  C:\Windows\System\fPLxJFS.exe
  2⤵
  PID:14980
- C:\Windows\System\diqEbIX.exe
  C:\Windows\System\diqEbIX.exe
  2⤵
  PID:15376
- C:\Windows\System\sUBYjQr.exe
  C:\Windows\System\sUBYjQr.exe
  2⤵
  PID:15396
- C:\Windows\System\rvGYaSY.exe
  C:\Windows\System\rvGYaSY.exe
  2⤵
  PID:15424
- C:\Windows\System\cVDFufs.exe
  C:\Windows\System\cVDFufs.exe
  2⤵
  PID:15448
- C:\Windows\System\PsxHdWF.exe
  C:\Windows\System\PsxHdWF.exe
  2⤵
  PID:15464
- C:\Windows\System\PbovXoB.exe
  C:\Windows\System\PbovXoB.exe
  2⤵
  PID:15488
- C:\Windows\System\MqcMDFq.exe
  C:\Windows\System\MqcMDFq.exe
  2⤵
  PID:15508
- C:\Windows\System\SMHdIDT.exe
  C:\Windows\System\SMHdIDT.exe
  2⤵
  PID:15544
- C:\Windows\System\OKGxpMK.exe
  C:\Windows\System\OKGxpMK.exe
  2⤵
  PID:15560
- C:\Windows\System\TZJDsel.exe
  C:\Windows\System\TZJDsel.exe
  2⤵
  PID:15592
- C:\Windows\System\FFqhUKl.exe
  C:\Windows\System\FFqhUKl.exe
  2⤵
  PID:15612
- C:\Windows\System\gNmEIFx.exe
  C:\Windows\System\gNmEIFx.exe
  2⤵
  PID:15636
- C:\Windows\System\cabyVZk.exe
  C:\Windows\System\cabyVZk.exe
  2⤵
  PID:15656
- C:\Windows\System\EBmqvpx.exe
  C:\Windows\System\EBmqvpx.exe
  2⤵
  PID:15680
- C:\Windows\System\aOnWKHT.exe
  C:\Windows\System\aOnWKHT.exe
  2⤵
  PID:15704
- C:\Windows\System\pkbYpsj.exe
  C:\Windows\System\pkbYpsj.exe
  2⤵
  PID:15724
- C:\Windows\System\lrghEUH.exe
  C:\Windows\System\lrghEUH.exe
  2⤵
  PID:15744
- C:\Windows\System\rYDVIWX.exe
  C:\Windows\System\rYDVIWX.exe
  2⤵
  PID:15768
- C:\Windows\System\fyHMDiY.exe
  C:\Windows\System\fyHMDiY.exe
  2⤵
  PID:15792
- C:\Windows\System\hPtJDkU.exe
  C:\Windows\System\hPtJDkU.exe
  2⤵
  PID:15808
- C:\Windows\System\WUkbbbR.exe
  C:\Windows\System\WUkbbbR.exe
  2⤵
  PID:15840
- C:\Windows\System\pcjJnsC.exe
  C:\Windows\System\pcjJnsC.exe
  2⤵
  PID:15856
- C:\Windows\System\aYZAFdU.exe
  C:\Windows\System\aYZAFdU.exe
  2⤵
  PID:15872
- C:\Windows\System\bvIqwHi.exe
  C:\Windows\System\bvIqwHi.exe
  2⤵
  PID:15888
- C:\Windows\System\jnIsASL.exe
  C:\Windows\System\jnIsASL.exe
  2⤵
  PID:15904
- C:\Windows\System\sdweEPX.exe
  C:\Windows\System\sdweEPX.exe
  2⤵
  PID:15928
- C:\Windows\System\ZbPTxkE.exe
  C:\Windows\System\ZbPTxkE.exe
  2⤵
  PID:15948
- C:\Windows\System\iHDRopP.exe
  C:\Windows\System\iHDRopP.exe
  2⤵
  PID:15964
- C:\Windows\System\kyBVJJj.exe
  C:\Windows\System\kyBVJJj.exe
  2⤵
  PID:15988
- C:\Windows\System\AJNbxUy.exe
  C:\Windows\System\AJNbxUy.exe
  2⤵
  PID:16004
- C:\Windows\System\rMsFXkr.exe
  C:\Windows\System\rMsFXkr.exe
  2⤵
  PID:16032
- C:\Windows\System\BDDkSRA.exe
  C:\Windows\System\BDDkSRA.exe
  2⤵
  PID:16048
- C:\Windows\System\jNzEWWC.exe
  C:\Windows\System\jNzEWWC.exe
  2⤵
  PID:16072
- C:\Windows\System\LpBqzgy.exe
  C:\Windows\System\LpBqzgy.exe
  2⤵
  PID:16096
- C:\Windows\System\LQrNDyy.exe
  C:\Windows\System\LQrNDyy.exe
  2⤵
  PID:16112
- C:\Windows\System\EFYEHZQ.exe
  C:\Windows\System\EFYEHZQ.exe
  2⤵
  PID:16136
- C:\Windows\System\XcYAqkN.exe
  C:\Windows\System\XcYAqkN.exe
  2⤵
  PID:16152
- C:\Windows\System\ECbbCKO.exe
  C:\Windows\System\ECbbCKO.exe
  2⤵
  PID:16168
- C:\Windows\System\QtAOMGF.exe
  C:\Windows\System\QtAOMGF.exe
  2⤵
  PID:16184
- C:\Windows\System\SFTSNpu.exe
  C:\Windows\System\SFTSNpu.exe
  2⤵
  PID:16204
- C:\Windows\System\LYmjOHB.exe
  C:\Windows\System\LYmjOHB.exe
  2⤵
  PID:16220
- C:\Windows\System\nkDKxNg.exe
  C:\Windows\System\nkDKxNg.exe
  2⤵
  PID:16256
- C:\Windows\System\Womilqe.exe
  C:\Windows\System\Womilqe.exe
  2⤵
  PID:16272
- C:\Windows\System\LbNeTsQ.exe
  C:\Windows\System\LbNeTsQ.exe
  2⤵
  PID:16292
- C:\Windows\System\ERGOzrb.exe
  C:\Windows\System\ERGOzrb.exe
  2⤵
  PID:16324
- C:\Windows\System\jJAFjyx.exe
  C:\Windows\System\jJAFjyx.exe
  2⤵
  PID:16352
- C:\Windows\System\YYCDuLQ.exe
  C:\Windows\System\YYCDuLQ.exe
  2⤵
  PID:16372
- C:\Windows\System\QQYOGzH.exe
  C:\Windows\System\QQYOGzH.exe
  2⤵
  PID:15160
- C:\Windows\System\iBXMImM.exe
  C:\Windows\System\iBXMImM.exe
  2⤵
  PID:15384
- C:\Windows\System\fIBsHQp.exe
  C:\Windows\System\fIBsHQp.exe
  2⤵
  PID:15444
- C:\Windows\System\RNZhAhm.exe
  C:\Windows\System\RNZhAhm.exe
  2⤵
  PID:15420
- C:\Windows\System\BuxreWk.exe
  C:\Windows\System\BuxreWk.exe
  2⤵
  PID:15496
- C:\Windows\System\roTuvaq.exe
  C:\Windows\System\roTuvaq.exe
  2⤵
  PID:15620
- C:\Windows\System\YADyWMY.exe
  C:\Windows\System\YADyWMY.exe
  2⤵
  PID:15652
- C:\Windows\System\PeyLBht.exe
  C:\Windows\System\PeyLBht.exe
  2⤵
  PID:15480
- C:\Windows\System\EOJXvZf.exe
  C:\Windows\System\EOJXvZf.exe
  2⤵
  PID:15644
- C:\Windows\System\eCaSOrT.exe
  C:\Windows\System\eCaSOrT.exe
  2⤵
  PID:15736
- C:\Windows\System\AgSEXnv.exe
  C:\Windows\System\AgSEXnv.exe
  2⤵
  PID:15940
- C:\Windows\System\BhzroVf.exe
  C:\Windows\System\BhzroVf.exe
  2⤵
  PID:15984
- C:\Windows\System\vUPKbEW.exe
  C:\Windows\System\vUPKbEW.exe
  2⤵
  PID:16064
- C:\Windows\System\WUqqmPl.exe
  C:\Windows\System\WUqqmPl.exe
  2⤵
  PID:15896
- C:\Windows\System\bMMaPiT.exe
  C:\Windows\System\bMMaPiT.exe
  2⤵
  PID:15924
- C:\Windows\System\afQVOat.exe
  C:\Windows\System\afQVOat.exe
  2⤵
  PID:15832
- C:\Windows\System\jvdrhRZ.exe
  C:\Windows\System\jvdrhRZ.exe
  2⤵
  PID:16248
- C:\Windows\System\yyThiDg.exe
  C:\Windows\System\yyThiDg.exe
  2⤵
  PID:16360
- C:\Windows\System\DNqnyTn.exe
  C:\Windows\System\DNqnyTn.exe
  2⤵
  PID:15368
- C:\Windows\System\DrzSWmF.exe
  C:\Windows\System\DrzSWmF.exe
  2⤵
  PID:16392
- C:\Windows\System\jrSoYXK.exe
  C:\Windows\System\jrSoYXK.exe
  2⤵
  PID:16420
- C:\Windows\System\XfOMzHH.exe
  C:\Windows\System\XfOMzHH.exe
  2⤵
  PID:16440
- C:\Windows\System\TtJvbVW.exe
  C:\Windows\System\TtJvbVW.exe
  2⤵
  PID:16456
- C:\Windows\System\eOcacup.exe
  C:\Windows\System\eOcacup.exe
  2⤵
  PID:16472
- C:\Windows\System\SKsmOic.exe
  C:\Windows\System\SKsmOic.exe
  2⤵
  PID:16496
- C:\Windows\System\QjgpPxB.exe
  C:\Windows\System\QjgpPxB.exe
  2⤵
  PID:16512
- C:\Windows\System\ovfuvkm.exe
  C:\Windows\System\ovfuvkm.exe
  2⤵
  PID:16536
- C:\Windows\System\wNBywzy.exe
  C:\Windows\System\wNBywzy.exe
  2⤵
  PID:16556
- C:\Windows\System\VecUqma.exe
  C:\Windows\System\VecUqma.exe
  2⤵
  PID:16576
- C:\Windows\System\alInnAe.exe
  C:\Windows\System\alInnAe.exe
  2⤵
  PID:16604
- C:\Windows\System\dBdZPJp.exe
  C:\Windows\System\dBdZPJp.exe
  2⤵
  PID:16620
- C:\Windows\System\lFFLxgR.exe
  C:\Windows\System\lFFLxgR.exe
  2⤵
  PID:16648
- C:\Windows\System\dQWiWmA.exe
  C:\Windows\System\dQWiWmA.exe
  2⤵
  PID:16664
- C:\Windows\System\WEyPzih.exe
  C:\Windows\System\WEyPzih.exe
  2⤵
  PID:16692
- C:\Windows\System\GZfhtpC.exe
  C:\Windows\System\GZfhtpC.exe
  2⤵
  PID:16708
- C:\Windows\System\NtiStXN.exe
  C:\Windows\System\NtiStXN.exe
  2⤵
  PID:16728
- C:\Windows\System\PxcMfef.exe
  C:\Windows\System\PxcMfef.exe
  2⤵
  PID:16744
- C:\Windows\System\YUYNgYG.exe
  C:\Windows\System\YUYNgYG.exe
  2⤵
  PID:16768
- C:\Windows\System\LqnpKXb.exe
  C:\Windows\System\LqnpKXb.exe
  2⤵
  PID:16784
- C:\Windows\System\AeABRfI.exe
  C:\Windows\System\AeABRfI.exe
  2⤵
  PID:16804
- C:\Windows\System\GDtZdff.exe
  C:\Windows\System\GDtZdff.exe
  2⤵
  PID:16828
- C:\Windows\System\TIvkGJO.exe
  C:\Windows\System\TIvkGJO.exe
  2⤵
  PID:16860
- C:\Windows\System\TVpIWVo.exe
  C:\Windows\System\TVpIWVo.exe
  2⤵
  PID:16876
- C:\Windows\System\GYXsskd.exe
  C:\Windows\System\GYXsskd.exe
  2⤵
  PID:16900
- C:\Windows\System\wooNXvQ.exe
  C:\Windows\System\wooNXvQ.exe
  2⤵
  PID:16920
- C:\Windows\System\zRATsnU.exe
  C:\Windows\System\zRATsnU.exe
  2⤵
  PID:16944
- C:\Windows\System\ZtZHucH.exe
  C:\Windows\System\ZtZHucH.exe
  2⤵
  PID:16964
- C:\Windows\System\SCbtLPz.exe
  C:\Windows\System\SCbtLPz.exe
  2⤵
  PID:16980
- C:\Windows\System\zEWrKPs.exe
  C:\Windows\System\zEWrKPs.exe
  2⤵
  PID:17004
- C:\Windows\System\ZVsxHaw.exe
  C:\Windows\System\ZVsxHaw.exe
  2⤵
  PID:17020
- C:\Windows\System\OwoMjkC.exe
  C:\Windows\System\OwoMjkC.exe
  2⤵
  PID:17040
- C:\Windows\System\IAEUafg.exe
  C:\Windows\System\IAEUafg.exe
  2⤵
  PID:17072
- C:\Windows\System\KGRmBIS.exe
  C:\Windows\System\KGRmBIS.exe
  2⤵
  PID:17088
- C:\Windows\System\iUFjUDN.exe
  C:\Windows\System\iUFjUDN.exe
  2⤵
  PID:17104
- C:\Windows\System\vDVZayh.exe
  C:\Windows\System\vDVZayh.exe
  2⤵
  PID:17128
- C:\Windows\System\XgiTfjQ.exe
  C:\Windows\System\XgiTfjQ.exe
  2⤵
  PID:17144
- C:\Windows\System\ymeVkJD.exe
  C:\Windows\System\ymeVkJD.exe
  2⤵
  PID:17160
- C:\Windows\System\ZrXdgTT.exe
  C:\Windows\System\ZrXdgTT.exe
  2⤵
  PID:17176
- C:\Windows\System\iDpTUpz.exe
  C:\Windows\System\iDpTUpz.exe
  2⤵
  PID:17204
- C:\Windows\System\vacFCeF.exe
  C:\Windows\System\vacFCeF.exe
  2⤵
  PID:17224
- C:\Windows\System\sfOsoxI.exe
  C:\Windows\System\sfOsoxI.exe
  2⤵
  PID:16024
- C:\Windows\System\guMPvdD.exe
  C:\Windows\System\guMPvdD.exe
  2⤵
  PID:15972
- C:\Windows\System\ixnkHEZ.exe
  C:\Windows\System\ixnkHEZ.exe
  2⤵
  PID:16240

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:15532

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
1⤵
PID:15984

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\CeBdXpw.exe

Filesize
1.5MB

MD5
501b571b8c14d21b370c79161db272ef

SHA1
366f7273904f96335c9c280f044bf9f41e0d4d48

SHA256
61af2ac2f19660638e1c5caf038c0aad45f3a384678a8786faca9606092add87

SHA512
8442d018a37b34f8d886dc8ac06596eb7a1321a51b76f9291f20509bfb8f4a096e152423fe6efc464b8d50c4f13265e925f2434e9e8347337ae363a2d95652e4

Download Submit
C:\Windows\System\CgZKlMx.exe

Filesize
1.5MB

MD5
b56e61362c196761ece7370a866fdaf3

SHA1
daf1112cde972ba118c8fca797f61724986969fe

SHA256
26fc428ffb86d115ec948160fc075bdc7c4649f812306ed29b5d9f249f81a19e

SHA512
543daa19b6a724d5a4b4063c24980da6fae3ecfc8db012e419145d3146d24317e2270356902bc22dcc66e976ab865c8491d0daef0ddc1f6ff7a224f58ebe9b33

Download Submit
C:\Windows\System\DEKmZMt.exe

Filesize
1.5MB

MD5
b1194e6d25476e21081bccdca12f390e

SHA1
4b9c84817f8f9233636e9e674404b16501ffcc30

SHA256
5064c479de55e25d1327b4c67cd2eff58dd70b430227e40b070a27fdc622a54a

SHA512
f415d5b6ee69c9bf7c00e31a17e45bdb4f5e92eb86ecd3297b59f7d4c5b930d3fe05a0dca415d80a9e95b996cf07c1346d170037f8dca3526402497cebb7c643

Download Submit
C:\Windows\System\FmPcRHn.exe

Filesize
1.5MB

MD5
692d405d5e7823f73f9778ed5727c702

SHA1
a88a4a5c1ebce0985f0d7f4a554313dee1acc4de

SHA256
16890086ae75bd5c47561e4f1c8ee688e62609b1d0044b3875036c0443edc47e

SHA512
4b6555368af727f7b71091a7eb16860ba3686388a88a0ec284a9950805e2b4de78d3653f9b1762fa1d4a9f65814fbc815ac58d774f6c08d456d470da51a7a6bc

Download Submit
C:\Windows\System\GIOADwY.exe

Filesize
1.5MB

MD5
1e7d11612ed977121183bfd19b27ad4f

SHA1
0ee998dfac9308882d51bd49d7b4254c0362f522

SHA256
71df66d5ad7b08cb0e54601b017fc0db33fb0c0b105d5fd74d60bd316431641e

SHA512
5ad358e3778f9d30d48a9c59147a87f5d9af2adf93febce7b30d7341b30358e8457429ab55b85ae6db14a65ded9885fe1052639c022f259132258f49b891c344

Download Submit
C:\Windows\System\IoPUVHg.exe

Filesize
1.5MB

MD5
e72945ed09d0ac4e4a4762507e97aad6

SHA1
94909ea3f7a7033ec2604b72db9edcf2e4a4d274

SHA256
c6d6339606d39c4f01ee6ac54b8155d4eb86b75cbb195cb048526ba8a0f50157

SHA512
f8a11bf04011b096e0bcb1486bb0cea8d1972b1033b143c95ec232557179c29a6fc6fd7d54dd9be690f827b332cc161e6d456f68d3e990661364aac4c6766f00

Download Submit
C:\Windows\System\JvkUYCI.exe

Filesize
1.5MB

MD5
d10958e60de6aa519f635d4e2f26bb4d

SHA1
72507f7514d6ebf6fff329df67562081e01c701f

SHA256
c3ce96cfff3629f7c71317268278747b6ea2f0d5c1678217cf69e0a1fa0f6f9b

SHA512
bc4973e7b2f688d1cf8772d89c3db4faeb3d19f6ee9331170b17ce1331bb7d0d492b655c50e72f2cce0fa4a6e03b05a56b6c18d111b0baf23a9d916216c28142

Download Submit
C:\Windows\System\JwsZBzr.exe

Filesize
1.5MB

MD5
7a956729e0409ca94e6f59b6ecb26b65

SHA1
84426e3a3b016fa996e84f73ca2564acc75e2852

SHA256
c6b61a3930ee82e2c7919bdf27a8c6513fba29c2725503cfee58f164468c86f5

SHA512
bbad3cd33f5cc4469dc76f956bb17963f4c6dc8dd87cb0a7ac46765cd4edabe9623c0dc6f44433639ea6ced9a1a3f42a12a31db958bec1a58757888e0fa09a50

Download Submit
C:\Windows\System\KVVuMJN.exe

Filesize
1.5MB

MD5
05260911e7e94197ffb5846788b22d04

SHA1
83affcecba48473bf881884ced74a513bc3a7018

SHA256
41cb235e7e480a4f1ea45896617d0b30e013a4a2bf4ad1d91d11937ecd5fb088

SHA512
26fc5d1e00f11fdc2ca47d8dc2ac8e4f15e8b7fa917851aeb7fd03ae1641a92bd6d600d779aa1a620f5f784a633759effb032e45f06bfe0dd6755b877ecc7928

Download Submit
C:\Windows\System\NLVubyt.exe

Filesize
1.5MB

MD5
923d2ccb368e0f55d06bf58363e15dc2

SHA1
2312f7255dd4a5425dd9399cd539ea0c1d0a7862

SHA256
2564ecf07aba68d9841afe74b5d251489b4ef46359f05206bbb0d1c54de8adca

SHA512
063e67489a361168d033bda12acde21fb7e2d12c6da7fca0210132d8c153d5e61afeaf3c6b6c9036139911d259f9b5ece238daebd2fea0a5d7332e79c123878f

Download Submit
C:\Windows\System\OgTUFXr.exe

Filesize
1.5MB

MD5
c3bf94b1705e89aa0ba70de402f9b52a

SHA1
b3a4c5bbf2d03150e24d915a8e52755b70e7ff0c

SHA256
78e0bf511e07095ae1f2f680ea000269dc296f01d2b4b34b58483b182234ccb7

SHA512
14c321a346e65b4f6563d10a29e75764ee78d754c62a460f641a4a454fc0fe38ed1383e1da24c5444417b1ab4e13354a2193e0e0595721713780e85cff03c231

Download Submit
C:\Windows\System\SjZevye.exe

Filesize
1.5MB

MD5
ee3a087d3bd4bb6890d53edf5c263fba

SHA1
c480f22002de6d053c6d8c6fd9bea489af2b9e46

SHA256
03bbf4f72497d91c619291b6b9ff9864c5e8500917df5f25fe1977cd79d84875

SHA512
fa79b59caecdc911c181be91113cef817dd3e55cf06c2158af64cdea67805f52a87d9de293bb7ebb8d17c63fdd266965719a326961321b90fd19979e26793e90

Download Submit
C:\Windows\System\TKclUEK.exe

Filesize
1.5MB

MD5
1a2cc5f1104ebf75e7c858a7356ef6f9

SHA1
eb6dc477d3cbd0c73a1526196b489d08a591765a

SHA256
4cadb6ee7e44dbd112eeddbb433856ff21e040b8164569ad6d5e56a49b38fd66

SHA512
deb2aa523752818e04cf41429a923551edbabf5bde8a9e21214dbbf988f02b88d91a88a58fd530f03664ea1704e674210885c83caede3c28bff7ab508e513d05

Download Submit
C:\Windows\System\XEJqeXE.exe

Filesize
1.5MB

MD5
4c2e19c7ad2445a0725e0e7fa0fe5e94

SHA1
d8ffbacd4fab5d5b922428c05f14ca0a8921d9c2

SHA256
07f478f1199a3eb4c487cf85bea7fd43a51ee1b8b60694da6257751a7104ae32

SHA512
c147e4c54dec9933d68889a08885082868b14f7ffc53f9eec430f651639c13af10694f3f18163daed8f36ef81e0d462d123c3e8b752aabc56b2514099d18bb7d

Download Submit
C:\Windows\System\YWRhyqE.exe

Filesize
1.5MB

MD5
f437458eb0a0786927f01b2c5aebb6ee

SHA1
e323f6af70c0a8b19404620cbc4d750b8da188c5

SHA256
27b103d5e2f5fb0896738eceb2af09a59e566904ff3a408d6df187100f42263f

SHA512
2597aec3ab60deef904262f4970569d2fd94dbaa20b0e83203f72714b43b62bae58b9a5f8648d27b8fc00f567ccffa3810b1f8938cf5fc357d3c7f9274b2df46

Download Submit
C:\Windows\System\ZbyjXpV.exe

Filesize
1.5MB

MD5
1fdcbdb7c0dc512f0846426afd7472e3

SHA1
fff75de2c54b562acef37049cbf9e9fb9d5a0267

SHA256
c285ab794ee98989b0b76ad50901e76880b8f63cd03fe369f607f1f94514de6f

SHA512
5eb0a89f8f0f292be88ca2b2c98990f7830054c9b8a0f715b4e3b4ef47904343c3b063995bde96ca2afc8dd9d0cfb5a1f368d33617dabdd1a1402a0ad39ed6d9

Download Submit
C:\Windows\System\afunQOy.exe

Filesize
1.5MB

MD5
27e799b4e2d037a57571922a13b58d98

SHA1
f28612377e1ddc9331e855dbe3daf5164f95a66e

SHA256
2e5be3d4e3e94d8fd8a8b87d20eaeec4a1789d0280b4ab2b649421a4bfbac076

SHA512
c08ab9c6b288c1ea01caee339c4b4778ba61d332735065c7e0663b07ea91538681b1ed0df5bca87ce7a53a269abb86c029655e0e01b30b61322c11e2a9c85ec0

Download Submit
C:\Windows\System\ddVfTJJ.exe

Filesize
1.5MB

MD5
cee0dfd68a223e0da9a772d8520f1c14

SHA1
d2cb577cb22a53d6fb17a0a090bd349f047fe31f

SHA256
15078a97d3613c9a0c039ad988fc9a00867a409e2a9f280bbe8b9f6ad8e328fd

SHA512
621b5f86c57c04b9aa4e214b7caa352b9df1043e0a48832b62c605ad4000e109789065904d98c88fefddd4db214200dee997e5dc813214c5e7da05b6f825a9b1

Download Submit
C:\Windows\System\duEoObm.exe

Filesize
1.5MB

MD5
88c4f50cab9245040340d7013868224c

SHA1
7e18ae23fbbd79c6e96a5bf8a0160b5f715618c5

SHA256
9d9c4e27e77ff44cf6cb75f595059087d483fec66a71c1816a5ac45eaf32747f

SHA512
a6752aec05a733b233fb8d5257e11e0ea25c8f3deb2d72eb12b18dc1fb2d867bdd3943b70d2f23dfc08a8fd85a5937e2e96cd8729fe74969fd301aa08ba5389b

Download Submit
C:\Windows\System\eiXsqiY.exe

Filesize
1.5MB

MD5
703b4395b6b1fb2124c288f59a7a3a46

SHA1
680ebc893ff000f80aa7edc507638203fd6a7f16

SHA256
bba89d26cf3e8efedcb95cde4458840d8bef4a56f4bffba5c0587d3b71a9c6dc

SHA512
cdc3df58d65a342368b72c673f9b9f7a9959d3f7f7207b5a416c61c452116f5566a89ffa50b6e25e1c3b4fe0ea681180faa9797b4da2d2aab353ad0100085202

Download Submit
C:\Windows\System\gjLcVGN.exe

Filesize
1.5MB

MD5
c1dd2205fc16186f12a8e5fddfb172a3

SHA1
75e75cad4dbdfef829bdd59a4f65eb0fd0957f49

SHA256
897d6f136a468d1ba4577a8158c95159258aa267b5110e22cf2460302d6f9a29

SHA512
3228fec6722be38b251f236202ead8b1dd1f3c2acb29cbdc0c3fe8313ea75221cac58f4815e534bab48f3db006cabc5fbd00ff3032f0e85d1006f25b252173ee

Download Submit
C:\Windows\System\jnigagi.exe

Filesize
1.5MB

MD5
2c0c129fe6c84eb2403aa7abc83c55fb

SHA1
af146b63700a3f52ac4581cb17cb46ce7e6644ad

SHA256
efeb89f6773a68d06d4f0dbe811f6b4b55946c4940bd6c25c6216abd852dc759

SHA512
ab4632ffe26043b18a69d1202d7514d951cd9e708a4756ad863833028d43eedf325c2cc41ed416da4a880c9d3e22bca31fd8095a260edfc028f0346084e68eb9

Download Submit
C:\Windows\System\jzBSMKZ.exe

Filesize
1.5MB

MD5
fbc6869315d8a3b6fc69f3625694af8e

SHA1
5fd3777a8d987afa389c49e459ff3b2042eadae4

SHA256
6a899c576bf06094cc459b42c442a519fd578e767391b02eb11c9324cd862aab

SHA512
da2dbbc7d00127a2624166bead79613f8b807c3b16518322f861d7f062d7bafb8eba8889ccfd2dd9107e16925af8cf146d2114444a3ab41378ed6f6eed4e70a5

Download Submit
C:\Windows\System\mzevgqn.exe

Filesize
1.5MB

MD5
46a21eef0459b6a52a8a72ef1f68e076

SHA1
019c422ad881dcf9a249ec4076c9ba5a9b6b709d

SHA256
b811349dc5faebf36a3c313053530a430e1dd3ae8c7f7a7dc2d0f743b9e0d623

SHA512
5791283af54a222f251781cc591338e01c2078d98c2502274c7a350928a945a957e840c49cec2782e60f309232bec53d696472c64b38eb0f6753282a3ed61694

Download Submit
C:\Windows\System\peylAHF.exe

Filesize
1.5MB

MD5
6a78c058d151bdd4b5f607fc1995cb35

SHA1
9ddeee8f8efea11fb439a6d52f54dcbc75785157

SHA256
537e04677e6ef00261081c79875c4946458c61d25362c9d12cfb3e69c5e12d72

SHA512
cebfd251bf37a29d71d393bae202e7c62bceaefdb7acf1cf4948fc33d8d56864adcfd27b9d1ef638b78b965a26f74f5cc1f81e01a89d8c37ab1db78ffdc9a315

Download Submit
C:\Windows\System\rFmMfWf.exe

Filesize
1.5MB

MD5
1a5b4e53165d3953cc51d36fd613478f

SHA1
0c4a26586f484e6e14efcf37b2b78780c1403aff

SHA256
8c61e6814a79922a183a65af638417e19ce3693fefe9f9a067d04239fcec8329

SHA512
d802b130b7841c71303a709ae1c2639017bd4f893b8f58596cb1473bdaddf2542e7143172e8a1bca20bbcf1179c211bcdc5ba0f76febdf3e726afb72f8b1db2a

Download Submit
C:\Windows\System\rXcKrPb.exe

Filesize
1.5MB

MD5
b0cdef5e6929e9ec9879ba589c893df2

SHA1
822346f2fabc0452bc06a85c2b28711aac71cb39

SHA256
4924bea5a1fc8ebfda56697ad846da02135402d728b9c749b2e04b042b36455c

SHA512
ce6de5edae47ebc6e46ab7cb448b5fd4d577d9820cac127d2cc2cf7805ddd535574adeb3ddb8a5ddb16049916b28619e42e7b21f8a2b09fd5be2b3dee8fe16b1

Download Submit
C:\Windows\System\rqGjqod.exe

Filesize
1.5MB

MD5
26dde5322b0113b4d501d178d6a84227

SHA1
e55c358ca21f595a94d0dab9c95bf416e5e59830

SHA256
6b1411525f2c1337b900697df7d805c0a301352fdb428f29bf9ac99174d29f6e

SHA512
f8f7eed126b7c6b63999cb1f33e15a8dc53125c7c4855c21231d0194d6e0c28a3d09fb2087674de21f327c8fe29cf508e906d747cfe55e1ce038d9a6eec79e9d

Download Submit
C:\Windows\System\sHafFSf.exe

Filesize
1.5MB

MD5
689e934eee6857c0c736c188c7c8e17a

SHA1
b831c3bb16b4e4e7174daf9e5f1f2b13ba2ab702

SHA256
dcd0e9b64bd9f0dfea03d8c0012e0ab6b16f38e67977084541f1d012855ef7ad

SHA512
f8dabefe71fe0c9630b28e8b2e98c68a9b840b07a6bb58decd2a16938592b908a1864a583c31b3fc2289400181752eeaa8728fd02a23c990c4a17162857b7509

Download Submit
C:\Windows\System\tDqrSdZ.exe

Filesize
1.5MB

MD5
dccdaa943438b7bf207ca6fd011a6a81

SHA1
0c022dc97e3697fd574a9b4add57af628fce308f

SHA256
8b6005a1a8a117c454fff3ead6e3c52855086d2ebdac70639c49ddb61034a612

SHA512
35ea2677fc918ff0c8a3e7abafabf040ab9049576f25da0ca45ef288c128fdb39918a25327648acd65942e8cc2ce3e266f6cee2b9abce6a55c7676dabb0d9154

Download Submit
C:\Windows\System\tQgXSVV.exe

Filesize
1.5MB

MD5
03ecf1f3f024128012b1cc5a4d668e34

SHA1
25577d0b811bd021a146a4dab54c4dc4dc2ce9a5

SHA256
9ab5767544f2980a6bda46222a94b84bf267b051e3fba9c9651cfb3d3d6ecb72

SHA512
a3646fcaebb1dc3b680d85a94f84eae4e923f2171f987d98003f0fa95be93635b15ee19b23601c54f8d3c7d01bb153de5c5ef0198a4f0ca6cceaa3f0004c9ffe

Download Submit
C:\Windows\System\toKqUMH.exe

Filesize
1.5MB

MD5
b92b3dacac2b3a208f5075f27f5cfc9e

SHA1
2bc257661c40d1961cff9e7b78485f2c7c3d5483

SHA256
0fd50c19c6f667c79b16eeb8aec04aa632b6ca14fac2eb6d1af019ed19e52cec

SHA512
6a306c929b5e53ef955ecd8456f5373d544b5b4352ba73897cbfbbc3b2052064b946378d6bccece4e945c150faa4535dcb35c4c3ef1a3ed18b60f9bd780dd000

Download Submit
C:\Windows\System\xlDNqXW.exe

Filesize
1.5MB

MD5
2ac983b00c0356494ed1db126f6200e6

SHA1
13696bd7fdc7b1d8a604fac7c57b238b1f214b61

SHA256
e05b59aa6315fe92ebd74301d6899831b50d9dcaf24b5256c98d56bd7a0dcc54

SHA512
1157692f8e7ac6f358da56f542c09647c1442d5949a098eac41bed05323cecba5978757c89f4c3eacbe982e41d26acb3c04ef3e79b803932c7f27296e16676aa

Download Submit
memory/3180-0-0x000002202BBD0000-0x000002202BBE0000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads