xmrig | 4c13c3df7f626bc5d5789460d3db0cd899366b759069fdf3308d0c74fe2e8eb4

Analysis

max time kernel
132s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
25/01/2025, 22:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4c13c3df7f626bc5d5789460d3db0cd899366b759069fdf3308d0c74fe2e8eb4.exe
Size

1.3MB
MD5

08e56b6dff8498641245bce707f94b83
SHA1

055022f4381573f20cccf0df3efd4c8c86d85c55
SHA256

4c13c3df7f626bc5d5789460d3db0cd899366b759069fdf3308d0c74fe2e8eb4
SHA512

ce5e1a3f328d790b0f8150e81621e8024746e69a034ccf990944ad96d25e111a01ce5756f8ea6f96db3e251dddd156f7d9e66b01c76bb776f9bac6cda748b736
SSDEEP

24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbpwlKensz0rMpGCFQrMo/vtDby0:GezaTF8FcNkNdfE0pZ9ozttwIR0//rlb

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 33 IoCs

miner

resource	yara_rule
behavioral2/files/0x0008000000023c70-2.dat	xmrig
behavioral2/files/0x0007000000023c75-6.dat	xmrig
behavioral2/files/0x0007000000023c77-21.dat	xmrig
behavioral2/files/0x0007000000023c79-38.dat	xmrig
behavioral2/files/0x0007000000023c7e-57.dat	xmrig
behavioral2/files/0x0007000000023c82-77.dat	xmrig
behavioral2/files/0x0007000000023c86-103.dat	xmrig
behavioral2/files/0x0007000000023c8b-122.dat	xmrig
behavioral2/files/0x0007000000023c8d-140.dat	xmrig
behavioral2/files/0x0007000000023c92-157.dat	xmrig
behavioral2/files/0x0007000000023c93-162.dat	xmrig
behavioral2/files/0x0007000000023c91-160.dat	xmrig
behavioral2/files/0x0007000000023c90-155.dat	xmrig
behavioral2/files/0x0007000000023c8f-150.dat	xmrig
behavioral2/files/0x0007000000023c8e-145.dat	xmrig
behavioral2/files/0x0007000000023c8c-135.dat	xmrig
behavioral2/files/0x0007000000023c8a-125.dat	xmrig
behavioral2/files/0x0007000000023c89-120.dat	xmrig
behavioral2/files/0x0007000000023c88-115.dat	xmrig
behavioral2/files/0x0007000000023c87-110.dat	xmrig
behavioral2/files/0x0007000000023c85-100.dat	xmrig
behavioral2/files/0x0007000000023c84-95.dat	xmrig
behavioral2/files/0x0007000000023c83-90.dat	xmrig
behavioral2/files/0x0007000000023c81-80.dat	xmrig
behavioral2/files/0x0007000000023c80-75.dat	xmrig
behavioral2/files/0x0007000000023c7f-70.dat	xmrig
behavioral2/files/0x0007000000023c7d-60.dat	xmrig
behavioral2/files/0x0007000000023c7c-52.dat	xmrig
behavioral2/files/0x0007000000023c7b-48.dat	xmrig
behavioral2/files/0x0007000000023c7a-42.dat	xmrig
behavioral2/files/0x0007000000023c78-33.dat	xmrig
behavioral2/files/0x0007000000023c76-24.dat	xmrig
behavioral2/files/0x0007000000023c74-13.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
3192	CJOKzTT.exe
3500	EZGVwpP.exe
1280	IQNAqrl.exe
3584	octfYvl.exe
1856	riqKnOU.exe
3908	vRodIey.exe
4284	DOwYWDK.exe
3624	OXDIwtH.exe
4528	zyYMSgx.exe
1004	RBaHJIV.exe
1432	kyqVVOe.exe
2864	tvBaOrD.exe
4244	tWXyCbx.exe
4432	mPIwcej.exe
3708	yEiANHt.exe
2176	nrVoSdy.exe
3992	gqECbaq.exe
2344	YQkHtKt.exe
936	dTsBfJN.exe
2316	mTCiCer.exe
4976	JXHTHUn.exe
1716	KZNMkPI.exe
2876	dXQUAkr.exe
4360	NJSftbX.exe
972	DKyuokC.exe
400	YhOYZQU.exe
1836	QEhkEHW.exe
316	sShVnNZ.exe
368	mgwbJxN.exe
2860	WcsPYwe.exe
4804	MHYRGXL.exe
1808	lALJlcL.exe
2980	AbzzfdF.exe
3036	FrqWVBg.exe
4336	RNmLPsw.exe
1096	aqfSnsU.exe
4480	MivcMYt.exe
920	EOyzzEV.exe
5084	uuKLdGK.exe
1088	WkiPQVC.exe
3596	JuGpWCo.exe
2464	qcaPYfF.exe
1532	Wdzugjr.exe
4324	EJdFili.exe
2184	pouGcij.exe
3232	jcyUjub.exe
1848	QAudaMP.exe
4292	BesyySs.exe
3728	XAnIkow.exe
4220	OlYyGLv.exe
736	EDaTgUV.exe
4788	TmvDCfi.exe
2360	KsnMjcF.exe
848	QqmjDFE.exe
4468	aWMmEpu.exe
2568	hlQDpXD.exe
4864	xcIBbuP.exe
4204	AzkKiwA.exe
928	FKQvlBq.exe
1492	IxalJWJ.exe
2828	rCeZuVI.exe
4456	woMPbOC.exe
4536	HnWXcyY.exe
2384	PIVRcQl.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\TviyLHm.exe	4c13c3df7f626bc5d5789460d3db0cd899366b759069fdf3308d0c74fe2e8eb4.exe
File created	C:\Windows\System\lNibZLQ.exe	4c13c3df7f626bc5d5789460d3db0cd899366b759069fdf3308d0c74fe2e8eb4.exe
File created	C:\Windows\System\BesyySs.exe	4c13c3df7f626bc5d5789460d3db0cd899366b759069fdf3308d0c74fe2e8eb4.exe
File created	C:\Windows\System\MOsSNfR.exe	4c13c3df7f626bc5d5789460d3db0cd899366b759069fdf3308d0c74fe2e8eb4.exe
File created	C:\Windows\System\NDsJzUC.exe	4c13c3df7f626bc5d5789460d3db0cd899366b759069fdf3308d0c74fe2e8eb4.exe
File created	C:\Windows\System\IRCvmiF.exe	4c13c3df7f626bc5d5789460d3db0cd899366b759069fdf3308d0c74fe2e8eb4.exe
File created	C:\Windows\System\QAudaMP.exe	4c13c3df7f626bc5d5789460d3db0cd899366b759069fdf3308d0c74fe2e8eb4.exe
File created	C:\Windows\System\RdDEDfg.exe	4c13c3df7f626bc5d5789460d3db0cd899366b759069fdf3308d0c74fe2e8eb4.exe
File created	C:\Windows\System\PHWBtBz.exe	4c13c3df7f626bc5d5789460d3db0cd899366b759069fdf3308d0c74fe2e8eb4.exe
File created	C:\Windows\System\mdQaoEz.exe	4c13c3df7f626bc5d5789460d3db0cd899366b759069fdf3308d0c74fe2e8eb4.exe
File created	C:\Windows\System\WJUxyPq.exe	4c13c3df7f626bc5d5789460d3db0cd899366b759069fdf3308d0c74fe2e8eb4.exe
File created	C:\Windows\System\WkiPQVC.exe	4c13c3df7f626bc5d5789460d3db0cd899366b759069fdf3308d0c74fe2e8eb4.exe
File created	C:\Windows\System\OTZpWMI.exe	4c13c3df7f626bc5d5789460d3db0cd899366b759069fdf3308d0c74fe2e8eb4.exe
File created	C:\Windows\System\ASiHGfH.exe	4c13c3df7f626bc5d5789460d3db0cd899366b759069fdf3308d0c74fe2e8eb4.exe
File created	C:\Windows\System\YNnSsXm.exe	4c13c3df7f626bc5d5789460d3db0cd899366b759069fdf3308d0c74fe2e8eb4.exe
File created	C:\Windows\System\VtWKWHi.exe	4c13c3df7f626bc5d5789460d3db0cd899366b759069fdf3308d0c74fe2e8eb4.exe
File created	C:\Windows\System\lstmuVD.exe	4c13c3df7f626bc5d5789460d3db0cd899366b759069fdf3308d0c74fe2e8eb4.exe
File created	C:\Windows\System\vQCDaBk.exe	4c13c3df7f626bc5d5789460d3db0cd899366b759069fdf3308d0c74fe2e8eb4.exe
File created	C:\Windows\System\pUcHCru.exe	4c13c3df7f626bc5d5789460d3db0cd899366b759069fdf3308d0c74fe2e8eb4.exe
File created	C:\Windows\System\apLPfKK.exe	4c13c3df7f626bc5d5789460d3db0cd899366b759069fdf3308d0c74fe2e8eb4.exe
File created	C:\Windows\System\RKVUczc.exe	4c13c3df7f626bc5d5789460d3db0cd899366b759069fdf3308d0c74fe2e8eb4.exe
File created	C:\Windows\System\GGWsFit.exe	4c13c3df7f626bc5d5789460d3db0cd899366b759069fdf3308d0c74fe2e8eb4.exe
File created	C:\Windows\System\jcoFWCr.exe	4c13c3df7f626bc5d5789460d3db0cd899366b759069fdf3308d0c74fe2e8eb4.exe
File created	C:\Windows\System\knKUWBS.exe	4c13c3df7f626bc5d5789460d3db0cd899366b759069fdf3308d0c74fe2e8eb4.exe
File created	C:\Windows\System\FKQvlBq.exe	4c13c3df7f626bc5d5789460d3db0cd899366b759069fdf3308d0c74fe2e8eb4.exe
File created	C:\Windows\System\YaqqQip.exe	4c13c3df7f626bc5d5789460d3db0cd899366b759069fdf3308d0c74fe2e8eb4.exe
File created	C:\Windows\System\YSKQtke.exe	4c13c3df7f626bc5d5789460d3db0cd899366b759069fdf3308d0c74fe2e8eb4.exe
File created	C:\Windows\System\wJmQrFk.exe	4c13c3df7f626bc5d5789460d3db0cd899366b759069fdf3308d0c74fe2e8eb4.exe
File created	C:\Windows\System\mPIwcej.exe	4c13c3df7f626bc5d5789460d3db0cd899366b759069fdf3308d0c74fe2e8eb4.exe
File created	C:\Windows\System\TfjJrEg.exe	4c13c3df7f626bc5d5789460d3db0cd899366b759069fdf3308d0c74fe2e8eb4.exe
File created	C:\Windows\System\tbKbCbJ.exe	4c13c3df7f626bc5d5789460d3db0cd899366b759069fdf3308d0c74fe2e8eb4.exe
File created	C:\Windows\System\PFbjmEl.exe	4c13c3df7f626bc5d5789460d3db0cd899366b759069fdf3308d0c74fe2e8eb4.exe
File created	C:\Windows\System\xizalHO.exe	4c13c3df7f626bc5d5789460d3db0cd899366b759069fdf3308d0c74fe2e8eb4.exe
File created	C:\Windows\System\MBUiOIP.exe	4c13c3df7f626bc5d5789460d3db0cd899366b759069fdf3308d0c74fe2e8eb4.exe
File created	C:\Windows\System\prNjsCm.exe	4c13c3df7f626bc5d5789460d3db0cd899366b759069fdf3308d0c74fe2e8eb4.exe
File created	C:\Windows\System\ShZMbmE.exe	4c13c3df7f626bc5d5789460d3db0cd899366b759069fdf3308d0c74fe2e8eb4.exe
File created	C:\Windows\System\qjocdiL.exe	4c13c3df7f626bc5d5789460d3db0cd899366b759069fdf3308d0c74fe2e8eb4.exe
File created	C:\Windows\System\fhnPKqG.exe	4c13c3df7f626bc5d5789460d3db0cd899366b759069fdf3308d0c74fe2e8eb4.exe
File created	C:\Windows\System\DkWEYlx.exe	4c13c3df7f626bc5d5789460d3db0cd899366b759069fdf3308d0c74fe2e8eb4.exe
File created	C:\Windows\System\GOSppBW.exe	4c13c3df7f626bc5d5789460d3db0cd899366b759069fdf3308d0c74fe2e8eb4.exe
File created	C:\Windows\System\lQvmJhM.exe	4c13c3df7f626bc5d5789460d3db0cd899366b759069fdf3308d0c74fe2e8eb4.exe
File created	C:\Windows\System\ENjShTw.exe	4c13c3df7f626bc5d5789460d3db0cd899366b759069fdf3308d0c74fe2e8eb4.exe
File created	C:\Windows\System\wJrLaJk.exe	4c13c3df7f626bc5d5789460d3db0cd899366b759069fdf3308d0c74fe2e8eb4.exe
File created	C:\Windows\System\EZGVwpP.exe	4c13c3df7f626bc5d5789460d3db0cd899366b759069fdf3308d0c74fe2e8eb4.exe
File created	C:\Windows\System\oMyosHD.exe	4c13c3df7f626bc5d5789460d3db0cd899366b759069fdf3308d0c74fe2e8eb4.exe
File created	C:\Windows\System\hlpmzTb.exe	4c13c3df7f626bc5d5789460d3db0cd899366b759069fdf3308d0c74fe2e8eb4.exe
File created	C:\Windows\System\iDtXzWx.exe	4c13c3df7f626bc5d5789460d3db0cd899366b759069fdf3308d0c74fe2e8eb4.exe
File created	C:\Windows\System\dqKWKAa.exe	4c13c3df7f626bc5d5789460d3db0cd899366b759069fdf3308d0c74fe2e8eb4.exe
File created	C:\Windows\System\dMaGbRK.exe	4c13c3df7f626bc5d5789460d3db0cd899366b759069fdf3308d0c74fe2e8eb4.exe
File created	C:\Windows\System\oMVUouY.exe	4c13c3df7f626bc5d5789460d3db0cd899366b759069fdf3308d0c74fe2e8eb4.exe
File created	C:\Windows\System\EsAkQPH.exe	4c13c3df7f626bc5d5789460d3db0cd899366b759069fdf3308d0c74fe2e8eb4.exe
File created	C:\Windows\System\YeNblEB.exe	4c13c3df7f626bc5d5789460d3db0cd899366b759069fdf3308d0c74fe2e8eb4.exe
File created	C:\Windows\System\aeqvZvh.exe	4c13c3df7f626bc5d5789460d3db0cd899366b759069fdf3308d0c74fe2e8eb4.exe
File created	C:\Windows\System\EitZkNa.exe	4c13c3df7f626bc5d5789460d3db0cd899366b759069fdf3308d0c74fe2e8eb4.exe
File created	C:\Windows\System\CrPeHHC.exe	4c13c3df7f626bc5d5789460d3db0cd899366b759069fdf3308d0c74fe2e8eb4.exe
File created	C:\Windows\System\gdVrOmH.exe	4c13c3df7f626bc5d5789460d3db0cd899366b759069fdf3308d0c74fe2e8eb4.exe
File created	C:\Windows\System\yzgfNOs.exe	4c13c3df7f626bc5d5789460d3db0cd899366b759069fdf3308d0c74fe2e8eb4.exe
File created	C:\Windows\System\TKENDnx.exe	4c13c3df7f626bc5d5789460d3db0cd899366b759069fdf3308d0c74fe2e8eb4.exe
File created	C:\Windows\System\SuZPTIa.exe	4c13c3df7f626bc5d5789460d3db0cd899366b759069fdf3308d0c74fe2e8eb4.exe
File created	C:\Windows\System\MnLfJPd.exe	4c13c3df7f626bc5d5789460d3db0cd899366b759069fdf3308d0c74fe2e8eb4.exe
File created	C:\Windows\System\RILINXO.exe	4c13c3df7f626bc5d5789460d3db0cd899366b759069fdf3308d0c74fe2e8eb4.exe
File created	C:\Windows\System\UQFjVhX.exe	4c13c3df7f626bc5d5789460d3db0cd899366b759069fdf3308d0c74fe2e8eb4.exe
File created	C:\Windows\System\BMysODw.exe	4c13c3df7f626bc5d5789460d3db0cd899366b759069fdf3308d0c74fe2e8eb4.exe
File created	C:\Windows\System\Cebobok.exe	4c13c3df7f626bc5d5789460d3db0cd899366b759069fdf3308d0c74fe2e8eb4.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	17064	dwm.exe
Token: SeChangeNotifyPrivilege	17064	dwm.exe
Token: 33	17064	dwm.exe
Token: SeIncBasePriorityPrivilege	17064	dwm.exe
Token: SeShutdownPrivilege	17064	dwm.exe
Token: SeCreatePagefilePrivilege	17064	dwm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1544 wrote to memory of 3192	1544	4c13c3df7f626bc5d5789460d3db0cd899366b759069fdf3308d0c74fe2e8eb4.exe	84
PID 1544 wrote to memory of 3192	1544	4c13c3df7f626bc5d5789460d3db0cd899366b759069fdf3308d0c74fe2e8eb4.exe	84
PID 1544 wrote to memory of 3500	1544	4c13c3df7f626bc5d5789460d3db0cd899366b759069fdf3308d0c74fe2e8eb4.exe	85
PID 1544 wrote to memory of 3500	1544	4c13c3df7f626bc5d5789460d3db0cd899366b759069fdf3308d0c74fe2e8eb4.exe	85
PID 1544 wrote to memory of 1280	1544	4c13c3df7f626bc5d5789460d3db0cd899366b759069fdf3308d0c74fe2e8eb4.exe	86
PID 1544 wrote to memory of 1280	1544	4c13c3df7f626bc5d5789460d3db0cd899366b759069fdf3308d0c74fe2e8eb4.exe	86
PID 1544 wrote to memory of 3584	1544	4c13c3df7f626bc5d5789460d3db0cd899366b759069fdf3308d0c74fe2e8eb4.exe	87
PID 1544 wrote to memory of 3584	1544	4c13c3df7f626bc5d5789460d3db0cd899366b759069fdf3308d0c74fe2e8eb4.exe	87
PID 1544 wrote to memory of 1856	1544	4c13c3df7f626bc5d5789460d3db0cd899366b759069fdf3308d0c74fe2e8eb4.exe	88
PID 1544 wrote to memory of 1856	1544	4c13c3df7f626bc5d5789460d3db0cd899366b759069fdf3308d0c74fe2e8eb4.exe	88
PID 1544 wrote to memory of 3908	1544	4c13c3df7f626bc5d5789460d3db0cd899366b759069fdf3308d0c74fe2e8eb4.exe	89
PID 1544 wrote to memory of 3908	1544	4c13c3df7f626bc5d5789460d3db0cd899366b759069fdf3308d0c74fe2e8eb4.exe	89
PID 1544 wrote to memory of 4284	1544	4c13c3df7f626bc5d5789460d3db0cd899366b759069fdf3308d0c74fe2e8eb4.exe	90
PID 1544 wrote to memory of 4284	1544	4c13c3df7f626bc5d5789460d3db0cd899366b759069fdf3308d0c74fe2e8eb4.exe	90
PID 1544 wrote to memory of 3624	1544	4c13c3df7f626bc5d5789460d3db0cd899366b759069fdf3308d0c74fe2e8eb4.exe	91
PID 1544 wrote to memory of 3624	1544	4c13c3df7f626bc5d5789460d3db0cd899366b759069fdf3308d0c74fe2e8eb4.exe	91
PID 1544 wrote to memory of 4528	1544	4c13c3df7f626bc5d5789460d3db0cd899366b759069fdf3308d0c74fe2e8eb4.exe	92
PID 1544 wrote to memory of 4528	1544	4c13c3df7f626bc5d5789460d3db0cd899366b759069fdf3308d0c74fe2e8eb4.exe	92
PID 1544 wrote to memory of 1004	1544	4c13c3df7f626bc5d5789460d3db0cd899366b759069fdf3308d0c74fe2e8eb4.exe	93
PID 1544 wrote to memory of 1004	1544	4c13c3df7f626bc5d5789460d3db0cd899366b759069fdf3308d0c74fe2e8eb4.exe	93
PID 1544 wrote to memory of 1432	1544	4c13c3df7f626bc5d5789460d3db0cd899366b759069fdf3308d0c74fe2e8eb4.exe	94
PID 1544 wrote to memory of 1432	1544	4c13c3df7f626bc5d5789460d3db0cd899366b759069fdf3308d0c74fe2e8eb4.exe	94
PID 1544 wrote to memory of 2864	1544	4c13c3df7f626bc5d5789460d3db0cd899366b759069fdf3308d0c74fe2e8eb4.exe	95
PID 1544 wrote to memory of 2864	1544	4c13c3df7f626bc5d5789460d3db0cd899366b759069fdf3308d0c74fe2e8eb4.exe	95
PID 1544 wrote to memory of 4244	1544	4c13c3df7f626bc5d5789460d3db0cd899366b759069fdf3308d0c74fe2e8eb4.exe	96
PID 1544 wrote to memory of 4244	1544	4c13c3df7f626bc5d5789460d3db0cd899366b759069fdf3308d0c74fe2e8eb4.exe	96
PID 1544 wrote to memory of 4432	1544	4c13c3df7f626bc5d5789460d3db0cd899366b759069fdf3308d0c74fe2e8eb4.exe	97
PID 1544 wrote to memory of 4432	1544	4c13c3df7f626bc5d5789460d3db0cd899366b759069fdf3308d0c74fe2e8eb4.exe	97
PID 1544 wrote to memory of 3708	1544	4c13c3df7f626bc5d5789460d3db0cd899366b759069fdf3308d0c74fe2e8eb4.exe	98
PID 1544 wrote to memory of 3708	1544	4c13c3df7f626bc5d5789460d3db0cd899366b759069fdf3308d0c74fe2e8eb4.exe	98
PID 1544 wrote to memory of 2176	1544	4c13c3df7f626bc5d5789460d3db0cd899366b759069fdf3308d0c74fe2e8eb4.exe	99
PID 1544 wrote to memory of 2176	1544	4c13c3df7f626bc5d5789460d3db0cd899366b759069fdf3308d0c74fe2e8eb4.exe	99
PID 1544 wrote to memory of 3992	1544	4c13c3df7f626bc5d5789460d3db0cd899366b759069fdf3308d0c74fe2e8eb4.exe	100
PID 1544 wrote to memory of 3992	1544	4c13c3df7f626bc5d5789460d3db0cd899366b759069fdf3308d0c74fe2e8eb4.exe	100
PID 1544 wrote to memory of 2344	1544	4c13c3df7f626bc5d5789460d3db0cd899366b759069fdf3308d0c74fe2e8eb4.exe	101
PID 1544 wrote to memory of 2344	1544	4c13c3df7f626bc5d5789460d3db0cd899366b759069fdf3308d0c74fe2e8eb4.exe	101
PID 1544 wrote to memory of 936	1544	4c13c3df7f626bc5d5789460d3db0cd899366b759069fdf3308d0c74fe2e8eb4.exe	102
PID 1544 wrote to memory of 936	1544	4c13c3df7f626bc5d5789460d3db0cd899366b759069fdf3308d0c74fe2e8eb4.exe	102
PID 1544 wrote to memory of 2316	1544	4c13c3df7f626bc5d5789460d3db0cd899366b759069fdf3308d0c74fe2e8eb4.exe	103
PID 1544 wrote to memory of 2316	1544	4c13c3df7f626bc5d5789460d3db0cd899366b759069fdf3308d0c74fe2e8eb4.exe	103
PID 1544 wrote to memory of 4976	1544	4c13c3df7f626bc5d5789460d3db0cd899366b759069fdf3308d0c74fe2e8eb4.exe	104
PID 1544 wrote to memory of 4976	1544	4c13c3df7f626bc5d5789460d3db0cd899366b759069fdf3308d0c74fe2e8eb4.exe	104
PID 1544 wrote to memory of 1716	1544	4c13c3df7f626bc5d5789460d3db0cd899366b759069fdf3308d0c74fe2e8eb4.exe	105
PID 1544 wrote to memory of 1716	1544	4c13c3df7f626bc5d5789460d3db0cd899366b759069fdf3308d0c74fe2e8eb4.exe	105
PID 1544 wrote to memory of 2876	1544	4c13c3df7f626bc5d5789460d3db0cd899366b759069fdf3308d0c74fe2e8eb4.exe	106
PID 1544 wrote to memory of 2876	1544	4c13c3df7f626bc5d5789460d3db0cd899366b759069fdf3308d0c74fe2e8eb4.exe	106
PID 1544 wrote to memory of 4360	1544	4c13c3df7f626bc5d5789460d3db0cd899366b759069fdf3308d0c74fe2e8eb4.exe	107
PID 1544 wrote to memory of 4360	1544	4c13c3df7f626bc5d5789460d3db0cd899366b759069fdf3308d0c74fe2e8eb4.exe	107
PID 1544 wrote to memory of 972	1544	4c13c3df7f626bc5d5789460d3db0cd899366b759069fdf3308d0c74fe2e8eb4.exe	108
PID 1544 wrote to memory of 972	1544	4c13c3df7f626bc5d5789460d3db0cd899366b759069fdf3308d0c74fe2e8eb4.exe	108
PID 1544 wrote to memory of 400	1544	4c13c3df7f626bc5d5789460d3db0cd899366b759069fdf3308d0c74fe2e8eb4.exe	109
PID 1544 wrote to memory of 400	1544	4c13c3df7f626bc5d5789460d3db0cd899366b759069fdf3308d0c74fe2e8eb4.exe	109
PID 1544 wrote to memory of 1836	1544	4c13c3df7f626bc5d5789460d3db0cd899366b759069fdf3308d0c74fe2e8eb4.exe	110
PID 1544 wrote to memory of 1836	1544	4c13c3df7f626bc5d5789460d3db0cd899366b759069fdf3308d0c74fe2e8eb4.exe	110
PID 1544 wrote to memory of 316	1544	4c13c3df7f626bc5d5789460d3db0cd899366b759069fdf3308d0c74fe2e8eb4.exe	111
PID 1544 wrote to memory of 316	1544	4c13c3df7f626bc5d5789460d3db0cd899366b759069fdf3308d0c74fe2e8eb4.exe	111
PID 1544 wrote to memory of 368	1544	4c13c3df7f626bc5d5789460d3db0cd899366b759069fdf3308d0c74fe2e8eb4.exe	112
PID 1544 wrote to memory of 368	1544	4c13c3df7f626bc5d5789460d3db0cd899366b759069fdf3308d0c74fe2e8eb4.exe	112
PID 1544 wrote to memory of 2860	1544	4c13c3df7f626bc5d5789460d3db0cd899366b759069fdf3308d0c74fe2e8eb4.exe	113
PID 1544 wrote to memory of 2860	1544	4c13c3df7f626bc5d5789460d3db0cd899366b759069fdf3308d0c74fe2e8eb4.exe	113
PID 1544 wrote to memory of 4804	1544	4c13c3df7f626bc5d5789460d3db0cd899366b759069fdf3308d0c74fe2e8eb4.exe	114
PID 1544 wrote to memory of 4804	1544	4c13c3df7f626bc5d5789460d3db0cd899366b759069fdf3308d0c74fe2e8eb4.exe	114
PID 1544 wrote to memory of 1808	1544	4c13c3df7f626bc5d5789460d3db0cd899366b759069fdf3308d0c74fe2e8eb4.exe	115
PID 1544 wrote to memory of 1808	1544	4c13c3df7f626bc5d5789460d3db0cd899366b759069fdf3308d0c74fe2e8eb4.exe	115

C:\Users\Admin\AppData\Local\Temp\4c13c3df7f626bc5d5789460d3db0cd899366b759069fdf3308d0c74fe2e8eb4.exe
"C:\Users\Admin\AppData\Local\Temp\4c13c3df7f626bc5d5789460d3db0cd899366b759069fdf3308d0c74fe2e8eb4.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1544
- C:\Windows\System\CJOKzTT.exe
  C:\Windows\System\CJOKzTT.exe
  2⤵
  - Executes dropped EXE
  PID:3192
- C:\Windows\System\EZGVwpP.exe
  C:\Windows\System\EZGVwpP.exe
  2⤵
  - Executes dropped EXE
  PID:3500
- C:\Windows\System\IQNAqrl.exe
  C:\Windows\System\IQNAqrl.exe
  2⤵
  - Executes dropped EXE
  PID:1280
- C:\Windows\System\octfYvl.exe
  C:\Windows\System\octfYvl.exe
  2⤵
  - Executes dropped EXE
  PID:3584
- C:\Windows\System\riqKnOU.exe
  C:\Windows\System\riqKnOU.exe
  2⤵
  - Executes dropped EXE
  PID:1856
- C:\Windows\System\vRodIey.exe
  C:\Windows\System\vRodIey.exe
  2⤵
  - Executes dropped EXE
  PID:3908
- C:\Windows\System\DOwYWDK.exe
  C:\Windows\System\DOwYWDK.exe
  2⤵
  - Executes dropped EXE
  PID:4284
- C:\Windows\System\OXDIwtH.exe
  C:\Windows\System\OXDIwtH.exe
  2⤵
  - Executes dropped EXE
  PID:3624
- C:\Windows\System\zyYMSgx.exe
  C:\Windows\System\zyYMSgx.exe
  2⤵
  - Executes dropped EXE
  PID:4528
- C:\Windows\System\RBaHJIV.exe
  C:\Windows\System\RBaHJIV.exe
  2⤵
  - Executes dropped EXE
  PID:1004
- C:\Windows\System\kyqVVOe.exe
  C:\Windows\System\kyqVVOe.exe
  2⤵
  - Executes dropped EXE
  PID:1432
- C:\Windows\System\tvBaOrD.exe
  C:\Windows\System\tvBaOrD.exe
  2⤵
  - Executes dropped EXE
  PID:2864
- C:\Windows\System\tWXyCbx.exe
  C:\Windows\System\tWXyCbx.exe
  2⤵
  - Executes dropped EXE
  PID:4244
- C:\Windows\System\mPIwcej.exe
  C:\Windows\System\mPIwcej.exe
  2⤵
  - Executes dropped EXE
  PID:4432
- C:\Windows\System\yEiANHt.exe
  C:\Windows\System\yEiANHt.exe
  2⤵
  - Executes dropped EXE
  PID:3708
- C:\Windows\System\nrVoSdy.exe
  C:\Windows\System\nrVoSdy.exe
  2⤵
  - Executes dropped EXE
  PID:2176
- C:\Windows\System\gqECbaq.exe
  C:\Windows\System\gqECbaq.exe
  2⤵
  - Executes dropped EXE
  PID:3992
- C:\Windows\System\YQkHtKt.exe
  C:\Windows\System\YQkHtKt.exe
  2⤵
  - Executes dropped EXE
  PID:2344
- C:\Windows\System\dTsBfJN.exe
  C:\Windows\System\dTsBfJN.exe
  2⤵
  - Executes dropped EXE
  PID:936
- C:\Windows\System\mTCiCer.exe
  C:\Windows\System\mTCiCer.exe
  2⤵
  - Executes dropped EXE
  PID:2316
- C:\Windows\System\JXHTHUn.exe
  C:\Windows\System\JXHTHUn.exe
  2⤵
  - Executes dropped EXE
  PID:4976
- C:\Windows\System\KZNMkPI.exe
  C:\Windows\System\KZNMkPI.exe
  2⤵
  - Executes dropped EXE
  PID:1716
- C:\Windows\System\dXQUAkr.exe
  C:\Windows\System\dXQUAkr.exe
  2⤵
  - Executes dropped EXE
  PID:2876
- C:\Windows\System\NJSftbX.exe
  C:\Windows\System\NJSftbX.exe
  2⤵
  - Executes dropped EXE
  PID:4360
- C:\Windows\System\DKyuokC.exe
  C:\Windows\System\DKyuokC.exe
  2⤵
  - Executes dropped EXE
  PID:972
- C:\Windows\System\YhOYZQU.exe
  C:\Windows\System\YhOYZQU.exe
  2⤵
  - Executes dropped EXE
  PID:400
- C:\Windows\System\QEhkEHW.exe
  C:\Windows\System\QEhkEHW.exe
  2⤵
  - Executes dropped EXE
  PID:1836
- C:\Windows\System\sShVnNZ.exe
  C:\Windows\System\sShVnNZ.exe
  2⤵
  - Executes dropped EXE
  PID:316
- C:\Windows\System\mgwbJxN.exe
  C:\Windows\System\mgwbJxN.exe
  2⤵
  - Executes dropped EXE
  PID:368
- C:\Windows\System\WcsPYwe.exe
  C:\Windows\System\WcsPYwe.exe
  2⤵
  - Executes dropped EXE
  PID:2860
- C:\Windows\System\MHYRGXL.exe
  C:\Windows\System\MHYRGXL.exe
  2⤵
  - Executes dropped EXE
  PID:4804
- C:\Windows\System\lALJlcL.exe
  C:\Windows\System\lALJlcL.exe
  2⤵
  - Executes dropped EXE
  PID:1808
- C:\Windows\System\AbzzfdF.exe
  C:\Windows\System\AbzzfdF.exe
  2⤵
  - Executes dropped EXE
  PID:2980
- C:\Windows\System\FrqWVBg.exe
  C:\Windows\System\FrqWVBg.exe
  2⤵
  - Executes dropped EXE
  PID:3036
- C:\Windows\System\RNmLPsw.exe
  C:\Windows\System\RNmLPsw.exe
  2⤵
  - Executes dropped EXE
  PID:4336
- C:\Windows\System\aqfSnsU.exe
  C:\Windows\System\aqfSnsU.exe
  2⤵
  - Executes dropped EXE
  PID:1096
- C:\Windows\System\MivcMYt.exe
  C:\Windows\System\MivcMYt.exe
  2⤵
  - Executes dropped EXE
  PID:4480
- C:\Windows\System\EOyzzEV.exe
  C:\Windows\System\EOyzzEV.exe
  2⤵
  - Executes dropped EXE
  PID:920
- C:\Windows\System\uuKLdGK.exe
  C:\Windows\System\uuKLdGK.exe
  2⤵
  - Executes dropped EXE
  PID:5084
- C:\Windows\System\WkiPQVC.exe
  C:\Windows\System\WkiPQVC.exe
  2⤵
  - Executes dropped EXE
  PID:1088
- C:\Windows\System\JuGpWCo.exe
  C:\Windows\System\JuGpWCo.exe
  2⤵
  - Executes dropped EXE
  PID:3596
- C:\Windows\System\qcaPYfF.exe
  C:\Windows\System\qcaPYfF.exe
  2⤵
  - Executes dropped EXE
  PID:2464
- C:\Windows\System\Wdzugjr.exe
  C:\Windows\System\Wdzugjr.exe
  2⤵
  - Executes dropped EXE
  PID:1532
- C:\Windows\System\EJdFili.exe
  C:\Windows\System\EJdFili.exe
  2⤵
  - Executes dropped EXE
  PID:4324
- C:\Windows\System\pouGcij.exe
  C:\Windows\System\pouGcij.exe
  2⤵
  - Executes dropped EXE
  PID:2184
- C:\Windows\System\jcyUjub.exe
  C:\Windows\System\jcyUjub.exe
  2⤵
  - Executes dropped EXE
  PID:3232
- C:\Windows\System\QAudaMP.exe
  C:\Windows\System\QAudaMP.exe
  2⤵
  - Executes dropped EXE
  PID:1848
- C:\Windows\System\BesyySs.exe
  C:\Windows\System\BesyySs.exe
  2⤵
  - Executes dropped EXE
  PID:4292
- C:\Windows\System\XAnIkow.exe
  C:\Windows\System\XAnIkow.exe
  2⤵
  - Executes dropped EXE
  PID:3728
- C:\Windows\System\OlYyGLv.exe
  C:\Windows\System\OlYyGLv.exe
  2⤵
  - Executes dropped EXE
  PID:4220
- C:\Windows\System\EDaTgUV.exe
  C:\Windows\System\EDaTgUV.exe
  2⤵
  - Executes dropped EXE
  PID:736
- C:\Windows\System\TmvDCfi.exe
  C:\Windows\System\TmvDCfi.exe
  2⤵
  - Executes dropped EXE
  PID:4788
- C:\Windows\System\KsnMjcF.exe
  C:\Windows\System\KsnMjcF.exe
  2⤵
  - Executes dropped EXE
  PID:2360
- C:\Windows\System\QqmjDFE.exe
  C:\Windows\System\QqmjDFE.exe
  2⤵
  - Executes dropped EXE
  PID:848
- C:\Windows\System\aWMmEpu.exe
  C:\Windows\System\aWMmEpu.exe
  2⤵
  - Executes dropped EXE
  PID:4468
- C:\Windows\System\hlQDpXD.exe
  C:\Windows\System\hlQDpXD.exe
  2⤵
  - Executes dropped EXE
  PID:2568
- C:\Windows\System\xcIBbuP.exe
  C:\Windows\System\xcIBbuP.exe
  2⤵
  - Executes dropped EXE
  PID:4864
- C:\Windows\System\AzkKiwA.exe
  C:\Windows\System\AzkKiwA.exe
  2⤵
  - Executes dropped EXE
  PID:4204
- C:\Windows\System\FKQvlBq.exe
  C:\Windows\System\FKQvlBq.exe
  2⤵
  - Executes dropped EXE
  PID:928
- C:\Windows\System\IxalJWJ.exe
  C:\Windows\System\IxalJWJ.exe
  2⤵
  - Executes dropped EXE
  PID:1492
- C:\Windows\System\rCeZuVI.exe
  C:\Windows\System\rCeZuVI.exe
  2⤵
  - Executes dropped EXE
  PID:2828
- C:\Windows\System\woMPbOC.exe
  C:\Windows\System\woMPbOC.exe
  2⤵
  - Executes dropped EXE
  PID:4456
- C:\Windows\System\HnWXcyY.exe
  C:\Windows\System\HnWXcyY.exe
  2⤵
  - Executes dropped EXE
  PID:4536
- C:\Windows\System\PIVRcQl.exe
  C:\Windows\System\PIVRcQl.exe
  2⤵
  - Executes dropped EXE
  PID:2384
- C:\Windows\System\VbqEVLX.exe
  C:\Windows\System\VbqEVLX.exe
  2⤵
  PID:4888
- C:\Windows\System\MZSAbLv.exe
  C:\Windows\System\MZSAbLv.exe
  2⤵
  PID:2072
- C:\Windows\System\pwQmfnJ.exe
  C:\Windows\System\pwQmfnJ.exe
  2⤵
  PID:1116
- C:\Windows\System\UNdkLAH.exe
  C:\Windows\System\UNdkLAH.exe
  2⤵
  PID:4296
- C:\Windows\System\KojewgQ.exe
  C:\Windows\System\KojewgQ.exe
  2⤵
  PID:3096
- C:\Windows\System\EYyNwmx.exe
  C:\Windows\System\EYyNwmx.exe
  2⤵
  PID:3112
- C:\Windows\System\QToTOPw.exe
  C:\Windows\System\QToTOPw.exe
  2⤵
  PID:3948
- C:\Windows\System\tRfHzdu.exe
  C:\Windows\System\tRfHzdu.exe
  2⤵
  PID:2116
- C:\Windows\System\weyfNpH.exe
  C:\Windows\System\weyfNpH.exe
  2⤵
  PID:4356
- C:\Windows\System\GOoTwKo.exe
  C:\Windows\System\GOoTwKo.exe
  2⤵
  PID:4624
- C:\Windows\System\htPOqqR.exe
  C:\Windows\System\htPOqqR.exe
  2⤵
  PID:5144
- C:\Windows\System\ysCKGhD.exe
  C:\Windows\System\ysCKGhD.exe
  2⤵
  PID:5176
- C:\Windows\System\zpFrmrj.exe
  C:\Windows\System\zpFrmrj.exe
  2⤵
  PID:5204
- C:\Windows\System\kIewsJM.exe
  C:\Windows\System\kIewsJM.exe
  2⤵
  PID:5228
- C:\Windows\System\rkpiYNv.exe
  C:\Windows\System\rkpiYNv.exe
  2⤵
  PID:5260
- C:\Windows\System\tKUQXfm.exe
  C:\Windows\System\tKUQXfm.exe
  2⤵
  PID:5288
- C:\Windows\System\Pibsoqg.exe
  C:\Windows\System\Pibsoqg.exe
  2⤵
  PID:5312
- C:\Windows\System\kYhPVhp.exe
  C:\Windows\System\kYhPVhp.exe
  2⤵
  PID:5340
- C:\Windows\System\PdejDvj.exe
  C:\Windows\System\PdejDvj.exe
  2⤵
  PID:5372
- C:\Windows\System\tJnWmpU.exe
  C:\Windows\System\tJnWmpU.exe
  2⤵
  PID:5400
- C:\Windows\System\SYUbQEu.exe
  C:\Windows\System\SYUbQEu.exe
  2⤵
  PID:5428
- C:\Windows\System\kcmgCHV.exe
  C:\Windows\System\kcmgCHV.exe
  2⤵
  PID:5460
- C:\Windows\System\LUbYvBL.exe
  C:\Windows\System\LUbYvBL.exe
  2⤵
  PID:5480
- C:\Windows\System\XQnzuzW.exe
  C:\Windows\System\XQnzuzW.exe
  2⤵
  PID:5512
- C:\Windows\System\SCPSjty.exe
  C:\Windows\System\SCPSjty.exe
  2⤵
  PID:5540
- C:\Windows\System\RWhWGSU.exe
  C:\Windows\System\RWhWGSU.exe
  2⤵
  PID:5564
- C:\Windows\System\lvsnvga.exe
  C:\Windows\System\lvsnvga.exe
  2⤵
  PID:5596
- C:\Windows\System\LzNeKkq.exe
  C:\Windows\System\LzNeKkq.exe
  2⤵
  PID:5624
- C:\Windows\System\ncTxpOH.exe
  C:\Windows\System\ncTxpOH.exe
  2⤵
  PID:5648
- C:\Windows\System\dJRhDJt.exe
  C:\Windows\System\dJRhDJt.exe
  2⤵
  PID:5680
- C:\Windows\System\BmhDfhR.exe
  C:\Windows\System\BmhDfhR.exe
  2⤵
  PID:5708
- C:\Windows\System\JuexzGF.exe
  C:\Windows\System\JuexzGF.exe
  2⤵
  PID:5736
- C:\Windows\System\FBKQRHF.exe
  C:\Windows\System\FBKQRHF.exe
  2⤵
  PID:5760
- C:\Windows\System\tRZNUWJ.exe
  C:\Windows\System\tRZNUWJ.exe
  2⤵
  PID:5788
- C:\Windows\System\CbBmkWt.exe
  C:\Windows\System\CbBmkWt.exe
  2⤵
  PID:5816
- C:\Windows\System\JPSqFqS.exe
  C:\Windows\System\JPSqFqS.exe
  2⤵
  PID:5844
- C:\Windows\System\MIGCvWt.exe
  C:\Windows\System\MIGCvWt.exe
  2⤵
  PID:5876
- C:\Windows\System\bNvuumB.exe
  C:\Windows\System\bNvuumB.exe
  2⤵
  PID:5904
- C:\Windows\System\zoLbrNJ.exe
  C:\Windows\System\zoLbrNJ.exe
  2⤵
  PID:5928
- C:\Windows\System\ZEGRcXW.exe
  C:\Windows\System\ZEGRcXW.exe
  2⤵
  PID:5960
- C:\Windows\System\roEVPSE.exe
  C:\Windows\System\roEVPSE.exe
  2⤵
  PID:5984
- C:\Windows\System\FvullNr.exe
  C:\Windows\System\FvullNr.exe
  2⤵
  PID:6012
- C:\Windows\System\NDeNjIB.exe
  C:\Windows\System\NDeNjIB.exe
  2⤵
  PID:6044
- C:\Windows\System\WUfCXDP.exe
  C:\Windows\System\WUfCXDP.exe
  2⤵
  PID:6072
- C:\Windows\System\vVvYwti.exe
  C:\Windows\System\vVvYwti.exe
  2⤵
  PID:6100
- C:\Windows\System\NDsJzUC.exe
  C:\Windows\System\NDsJzUC.exe
  2⤵
  PID:6128
- C:\Windows\System\bpoJZcF.exe
  C:\Windows\System\bpoJZcF.exe
  2⤵
  PID:1876
- C:\Windows\System\UQFjVhX.exe
  C:\Windows\System\UQFjVhX.exe
  2⤵
  PID:2452
- C:\Windows\System\ZFBVohp.exe
  C:\Windows\System\ZFBVohp.exe
  2⤵
  PID:4868
- C:\Windows\System\BKkdSgH.exe
  C:\Windows\System\BKkdSgH.exe
  2⤵
  PID:3348
- C:\Windows\System\hzIgRQI.exe
  C:\Windows\System\hzIgRQI.exe
  2⤵
  PID:2644
- C:\Windows\System\cdiexDL.exe
  C:\Windows\System\cdiexDL.exe
  2⤵
  PID:4376
- C:\Windows\System\wQKqaFv.exe
  C:\Windows\System\wQKqaFv.exe
  2⤵
  PID:5224
- C:\Windows\System\IhhbFio.exe
  C:\Windows\System\IhhbFio.exe
  2⤵
  PID:5492
- C:\Windows\System\JNpTZUE.exe
  C:\Windows\System\JNpTZUE.exe
  2⤵
  PID:5528
- C:\Windows\System\LBRvKmT.exe
  C:\Windows\System\LBRvKmT.exe
  2⤵
  PID:5580
- C:\Windows\System\YaqqQip.exe
  C:\Windows\System\YaqqQip.exe
  2⤵
  PID:5640
- C:\Windows\System\PXOqyfS.exe
  C:\Windows\System\PXOqyfS.exe
  2⤵
  PID:2696
- C:\Windows\System\oNUACPN.exe
  C:\Windows\System\oNUACPN.exe
  2⤵
  PID:5728
- C:\Windows\System\rtXzqRd.exe
  C:\Windows\System\rtXzqRd.exe
  2⤵
  PID:5756
- C:\Windows\System\gCxQvEL.exe
  C:\Windows\System\gCxQvEL.exe
  2⤵
  PID:5780
- C:\Windows\System\wXilYBD.exe
  C:\Windows\System\wXilYBD.exe
  2⤵
  PID:5860
- C:\Windows\System\uXioJyC.exe
  C:\Windows\System\uXioJyC.exe
  2⤵
  PID:5944
- C:\Windows\System\whvvUWD.exe
  C:\Windows\System\whvvUWD.exe
  2⤵
  PID:6032
- C:\Windows\System\JFsvvCI.exe
  C:\Windows\System\JFsvvCI.exe
  2⤵
  PID:6080
- C:\Windows\System\sPhuKLB.exe
  C:\Windows\System\sPhuKLB.exe
  2⤵
  PID:6136
- C:\Windows\System\UgfJZgc.exe
  C:\Windows\System\UgfJZgc.exe
  2⤵
  PID:1748
- C:\Windows\System\lzHztDd.exe
  C:\Windows\System\lzHztDd.exe
  2⤵
  PID:2152
- C:\Windows\System\UtMmRij.exe
  C:\Windows\System\UtMmRij.exe
  2⤵
  PID:1036
- C:\Windows\System\VIiLmoN.exe
  C:\Windows\System\VIiLmoN.exe
  2⤵
  PID:180
- C:\Windows\System\NvCIIxN.exe
  C:\Windows\System\NvCIIxN.exe
  2⤵
  PID:2588
- C:\Windows\System\IfyKTGn.exe
  C:\Windows\System\IfyKTGn.exe
  2⤵
  PID:4964
- C:\Windows\System\SuZPTIa.exe
  C:\Windows\System\SuZPTIa.exe
  2⤵
  PID:5004
- C:\Windows\System\bBxfQIq.exe
  C:\Windows\System\bBxfQIq.exe
  2⤵
  PID:3832
- C:\Windows\System\SynDkTH.exe
  C:\Windows\System\SynDkTH.exe
  2⤵
  PID:4512
- C:\Windows\System\RaEktbT.exe
  C:\Windows\System\RaEktbT.exe
  2⤵
  PID:2616
- C:\Windows\System\UwadONc.exe
  C:\Windows\System\UwadONc.exe
  2⤵
  PID:2428
- C:\Windows\System\nlmCCfR.exe
  C:\Windows\System\nlmCCfR.exe
  2⤵
  PID:2068
- C:\Windows\System\lFaupag.exe
  C:\Windows\System\lFaupag.exe
  2⤵
  PID:4520
- C:\Windows\System\yzgfNOs.exe
  C:\Windows\System\yzgfNOs.exe
  2⤵
  PID:5324
- C:\Windows\System\PbjAcEd.exe
  C:\Windows\System\PbjAcEd.exe
  2⤵
  PID:2436
- C:\Windows\System\WORCpIy.exe
  C:\Windows\System\WORCpIy.exe
  2⤵
  PID:4348
- C:\Windows\System\rSsUwuP.exe
  C:\Windows\System\rSsUwuP.exe
  2⤵
  PID:3736
- C:\Windows\System\oUZbJBh.exe
  C:\Windows\System\oUZbJBh.exe
  2⤵
  PID:4396
- C:\Windows\System\lstmuVD.exe
  C:\Windows\System\lstmuVD.exe
  2⤵
  PID:3384
- C:\Windows\System\ajYWjBq.exe
  C:\Windows\System\ajYWjBq.exe
  2⤵
  PID:4720
- C:\Windows\System\jJxKCoS.exe
  C:\Windows\System\jJxKCoS.exe
  2⤵
  PID:5308
- C:\Windows\System\ZELaPwX.exe
  C:\Windows\System\ZELaPwX.exe
  2⤵
  PID:3576
- C:\Windows\System\ZjhcJNf.exe
  C:\Windows\System\ZjhcJNf.exe
  2⤵
  PID:3512
- C:\Windows\System\ayZUgme.exe
  C:\Windows\System\ayZUgme.exe
  2⤵
  PID:856
- C:\Windows\System\RlaGDuU.exe
  C:\Windows\System\RlaGDuU.exe
  2⤵
  PID:4828
- C:\Windows\System\vBXpRuI.exe
  C:\Windows\System\vBXpRuI.exe
  2⤵
  PID:6004
- C:\Windows\System\YuSwzjo.exe
  C:\Windows\System\YuSwzjo.exe
  2⤵
  PID:6116
- C:\Windows\System\RGcgxnM.exe
  C:\Windows\System\RGcgxnM.exe
  2⤵
  PID:436
- C:\Windows\System\PvFHUVU.exe
  C:\Windows\System\PvFHUVU.exe
  2⤵
  PID:2376
- C:\Windows\System\YSKQtke.exe
  C:\Windows\System\YSKQtke.exe
  2⤵
  PID:1328
- C:\Windows\System\oTjSeDi.exe
  C:\Windows\System\oTjSeDi.exe
  2⤵
  PID:1208
- C:\Windows\System\UhZDgrr.exe
  C:\Windows\System\UhZDgrr.exe
  2⤵
  PID:1680
- C:\Windows\System\ZXUIyJd.exe
  C:\Windows\System\ZXUIyJd.exe
  2⤵
  PID:5248
- C:\Windows\System\RdDEDfg.exe
  C:\Windows\System\RdDEDfg.exe
  2⤵
  PID:1764
- C:\Windows\System\kchwfAP.exe
  C:\Windows\System\kchwfAP.exe
  2⤵
  PID:2336
- C:\Windows\System\vlafoVh.exe
  C:\Windows\System\vlafoVh.exe
  2⤵
  PID:5008
- C:\Windows\System\SAiwjjY.exe
  C:\Windows\System\SAiwjjY.exe
  2⤵
  PID:5520
- C:\Windows\System\LWRMBKQ.exe
  C:\Windows\System\LWRMBKQ.exe
  2⤵
  PID:4028
- C:\Windows\System\Zrgirdx.exe
  C:\Windows\System\Zrgirdx.exe
  2⤵
  PID:1920
- C:\Windows\System\QmCOwPU.exe
  C:\Windows\System\QmCOwPU.exe
  2⤵
  PID:6108
- C:\Windows\System\jjoIvhS.exe
  C:\Windows\System\jjoIvhS.exe
  2⤵
  PID:1912
- C:\Windows\System\SYPMjQZ.exe
  C:\Windows\System\SYPMjQZ.exe
  2⤵
  PID:5220
- C:\Windows\System\UVVJRgI.exe
  C:\Windows\System\UVVJRgI.exe
  2⤵
  PID:5700
- C:\Windows\System\dCFPLaV.exe
  C:\Windows\System\dCFPLaV.exe
  2⤵
  PID:5632
- C:\Windows\System\DGscaGC.exe
  C:\Windows\System\DGscaGC.exe
  2⤵
  PID:1636
- C:\Windows\System\ndzImkI.exe
  C:\Windows\System\ndzImkI.exe
  2⤵
  PID:4452
- C:\Windows\System\EOBkAAX.exe
  C:\Windows\System\EOBkAAX.exe
  2⤵
  PID:6156
- C:\Windows\System\rydhTGe.exe
  C:\Windows\System\rydhTGe.exe
  2⤵
  PID:6188
- C:\Windows\System\ZlWNWNl.exe
  C:\Windows\System\ZlWNWNl.exe
  2⤵
  PID:6216
- C:\Windows\System\ucICApA.exe
  C:\Windows\System\ucICApA.exe
  2⤵
  PID:6264
- C:\Windows\System\NDBfnSn.exe
  C:\Windows\System\NDBfnSn.exe
  2⤵
  PID:6292
- C:\Windows\System\lQvYyFN.exe
  C:\Windows\System\lQvYyFN.exe
  2⤵
  PID:6320
- C:\Windows\System\ZgraZvV.exe
  C:\Windows\System\ZgraZvV.exe
  2⤵
  PID:6348
- C:\Windows\System\svamEtB.exe
  C:\Windows\System\svamEtB.exe
  2⤵
  PID:6376
- C:\Windows\System\UtmxgCI.exe
  C:\Windows\System\UtmxgCI.exe
  2⤵
  PID:6392
- C:\Windows\System\xjMJeWf.exe
  C:\Windows\System\xjMJeWf.exe
  2⤵
  PID:6420
- C:\Windows\System\OqxZdmH.exe
  C:\Windows\System\OqxZdmH.exe
  2⤵
  PID:6452
- C:\Windows\System\IRCvmiF.exe
  C:\Windows\System\IRCvmiF.exe
  2⤵
  PID:6484
- C:\Windows\System\TysehIZ.exe
  C:\Windows\System\TysehIZ.exe
  2⤵
  PID:6512
- C:\Windows\System\guvZjbg.exe
  C:\Windows\System\guvZjbg.exe
  2⤵
  PID:6548
- C:\Windows\System\DARKZsx.exe
  C:\Windows\System\DARKZsx.exe
  2⤵
  PID:6568
- C:\Windows\System\Josfddn.exe
  C:\Windows\System\Josfddn.exe
  2⤵
  PID:6596
- C:\Windows\System\SggtDzA.exe
  C:\Windows\System\SggtDzA.exe
  2⤵
  PID:6628
- C:\Windows\System\XRlVfLV.exe
  C:\Windows\System\XRlVfLV.exe
  2⤵
  PID:6652
- C:\Windows\System\fZZOYpU.exe
  C:\Windows\System\fZZOYpU.exe
  2⤵
  PID:6680
- C:\Windows\System\PNYIbJj.exe
  C:\Windows\System\PNYIbJj.exe
  2⤵
  PID:6712
- C:\Windows\System\cZZhcYQ.exe
  C:\Windows\System\cZZhcYQ.exe
  2⤵
  PID:6736
- C:\Windows\System\gxwWPpd.exe
  C:\Windows\System\gxwWPpd.exe
  2⤵
  PID:6764
- C:\Windows\System\AlSKeSO.exe
  C:\Windows\System\AlSKeSO.exe
  2⤵
  PID:6792
- C:\Windows\System\iCqosEy.exe
  C:\Windows\System\iCqosEy.exe
  2⤵
  PID:6832
- C:\Windows\System\tTSGVaF.exe
  C:\Windows\System\tTSGVaF.exe
  2⤵
  PID:6848
- C:\Windows\System\rPXPlKZ.exe
  C:\Windows\System\rPXPlKZ.exe
  2⤵
  PID:6876
- C:\Windows\System\FKEXHVe.exe
  C:\Windows\System\FKEXHVe.exe
  2⤵
  PID:6904
- C:\Windows\System\JotzmXW.exe
  C:\Windows\System\JotzmXW.exe
  2⤵
  PID:6932
- C:\Windows\System\NMMScXj.exe
  C:\Windows\System\NMMScXj.exe
  2⤵
  PID:6972
- C:\Windows\System\vrEFQca.exe
  C:\Windows\System\vrEFQca.exe
  2⤵
  PID:7000
- C:\Windows\System\rPRPmSK.exe
  C:\Windows\System\rPRPmSK.exe
  2⤵
  PID:7028
- C:\Windows\System\XPbaYag.exe
  C:\Windows\System\XPbaYag.exe
  2⤵
  PID:7060
- C:\Windows\System\JhKeblT.exe
  C:\Windows\System\JhKeblT.exe
  2⤵
  PID:7084
- C:\Windows\System\oPqdHoW.exe
  C:\Windows\System\oPqdHoW.exe
  2⤵
  PID:7104
- C:\Windows\System\zhOxnaR.exe
  C:\Windows\System\zhOxnaR.exe
  2⤵
  PID:7136
- C:\Windows\System\RQGKXdS.exe
  C:\Windows\System\RQGKXdS.exe
  2⤵
  PID:7160
- C:\Windows\System\gSeRxbb.exe
  C:\Windows\System\gSeRxbb.exe
  2⤵
  PID:1456
- C:\Windows\System\ZuRaQOr.exe
  C:\Windows\System\ZuRaQOr.exe
  2⤵
  PID:6208
- C:\Windows\System\vKkOXlN.exe
  C:\Windows\System\vKkOXlN.exe
  2⤵
  PID:6276
- C:\Windows\System\WYoBWBR.exe
  C:\Windows\System\WYoBWBR.exe
  2⤵
  PID:6336
- C:\Windows\System\BgGMHwY.exe
  C:\Windows\System\BgGMHwY.exe
  2⤵
  PID:6388
- C:\Windows\System\mJJxodq.exe
  C:\Windows\System\mJJxodq.exe
  2⤵
  PID:4252
- C:\Windows\System\heppIFs.exe
  C:\Windows\System\heppIFs.exe
  2⤵
  PID:6508
- C:\Windows\System\oQItHGe.exe
  C:\Windows\System\oQItHGe.exe
  2⤵
  PID:6580
- C:\Windows\System\jugiqha.exe
  C:\Windows\System\jugiqha.exe
  2⤵
  PID:6668
- C:\Windows\System\GkycvVX.exe
  C:\Windows\System\GkycvVX.exe
  2⤵
  PID:6672
- C:\Windows\System\CEuRwFP.exe
  C:\Windows\System\CEuRwFP.exe
  2⤵
  PID:6732
- C:\Windows\System\fcxGNbJ.exe
  C:\Windows\System\fcxGNbJ.exe
  2⤵
  PID:6824
- C:\Windows\System\sevHudv.exe
  C:\Windows\System\sevHudv.exe
  2⤵
  PID:6860
- C:\Windows\System\DvdiRBk.exe
  C:\Windows\System\DvdiRBk.exe
  2⤵
  PID:2088
- C:\Windows\System\HqXNeAW.exe
  C:\Windows\System\HqXNeAW.exe
  2⤵
  PID:6968
- C:\Windows\System\aIiLwKm.exe
  C:\Windows\System\aIiLwKm.exe
  2⤵
  PID:7076
- C:\Windows\System\WoclALr.exe
  C:\Windows\System\WoclALr.exe
  2⤵
  PID:7100
- C:\Windows\System\xuDdtwd.exe
  C:\Windows\System\xuDdtwd.exe
  2⤵
  PID:6148
- C:\Windows\System\dfvbKDk.exe
  C:\Windows\System\dfvbKDk.exe
  2⤵
  PID:6332
- C:\Windows\System\hbhODms.exe
  C:\Windows\System\hbhODms.exe
  2⤵
  PID:6496
- C:\Windows\System\dmbyeCi.exe
  C:\Windows\System\dmbyeCi.exe
  2⤵
  PID:6648
- C:\Windows\System\xXCsraq.exe
  C:\Windows\System\xXCsraq.exe
  2⤵
  PID:6724
- C:\Windows\System\wTrSxjQ.exe
  C:\Windows\System\wTrSxjQ.exe
  2⤵
  PID:6952
- C:\Windows\System\yVMQmfT.exe
  C:\Windows\System\yVMQmfT.exe
  2⤵
  PID:6900
- C:\Windows\System\cbLqzQc.exe
  C:\Windows\System\cbLqzQc.exe
  2⤵
  PID:7048
- C:\Windows\System\FixPzWs.exe
  C:\Windows\System\FixPzWs.exe
  2⤵
  PID:6240
- C:\Windows\System\BMysODw.exe
  C:\Windows\System\BMysODw.exe
  2⤵
  PID:6696
- C:\Windows\System\tMRwMEr.exe
  C:\Windows\System\tMRwMEr.exe
  2⤵
  PID:7044
- C:\Windows\System\opXRjLQ.exe
  C:\Windows\System\opXRjLQ.exe
  2⤵
  PID:5212
- C:\Windows\System\QQyERUa.exe
  C:\Windows\System\QQyERUa.exe
  2⤵
  PID:6556
- C:\Windows\System\MOsSNfR.exe
  C:\Windows\System\MOsSNfR.exe
  2⤵
  PID:7176
- C:\Windows\System\VkQEByG.exe
  C:\Windows\System\VkQEByG.exe
  2⤵
  PID:7204
- C:\Windows\System\BdQYEwa.exe
  C:\Windows\System\BdQYEwa.exe
  2⤵
  PID:7228
- C:\Windows\System\zECWlkm.exe
  C:\Windows\System\zECWlkm.exe
  2⤵
  PID:7260
- C:\Windows\System\pMQqQQL.exe
  C:\Windows\System\pMQqQQL.exe
  2⤵
  PID:7276
- C:\Windows\System\NYbsQdE.exe
  C:\Windows\System\NYbsQdE.exe
  2⤵
  PID:7304
- C:\Windows\System\JMwxfAz.exe
  C:\Windows\System\JMwxfAz.exe
  2⤵
  PID:7332
- C:\Windows\System\TMuYASi.exe
  C:\Windows\System\TMuYASi.exe
  2⤵
  PID:7356
- C:\Windows\System\TOOtVly.exe
  C:\Windows\System\TOOtVly.exe
  2⤵
  PID:7388
- C:\Windows\System\BGDMaCo.exe
  C:\Windows\System\BGDMaCo.exe
  2⤵
  PID:7416
- C:\Windows\System\OPDjtgE.exe
  C:\Windows\System\OPDjtgE.exe
  2⤵
  PID:7440
- C:\Windows\System\KLSmGIS.exe
  C:\Windows\System\KLSmGIS.exe
  2⤵
  PID:7472
- C:\Windows\System\pNSrIks.exe
  C:\Windows\System\pNSrIks.exe
  2⤵
  PID:7500
- C:\Windows\System\FuiILkJ.exe
  C:\Windows\System\FuiILkJ.exe
  2⤵
  PID:7520
- C:\Windows\System\FvHESjB.exe
  C:\Windows\System\FvHESjB.exe
  2⤵
  PID:7556
- C:\Windows\System\wwtLcTj.exe
  C:\Windows\System\wwtLcTj.exe
  2⤵
  PID:7600
- C:\Windows\System\VCcsYvb.exe
  C:\Windows\System\VCcsYvb.exe
  2⤵
  PID:7632
- C:\Windows\System\bFaGDlJ.exe
  C:\Windows\System\bFaGDlJ.exe
  2⤵
  PID:7648
- C:\Windows\System\oMyosHD.exe
  C:\Windows\System\oMyosHD.exe
  2⤵
  PID:7688
- C:\Windows\System\FmYnwRx.exe
  C:\Windows\System\FmYnwRx.exe
  2⤵
  PID:7704
- C:\Windows\System\FPEOfeY.exe
  C:\Windows\System\FPEOfeY.exe
  2⤵
  PID:7744
- C:\Windows\System\bxWZzSf.exe
  C:\Windows\System\bxWZzSf.exe
  2⤵
  PID:7760
- C:\Windows\System\ZxyKCuU.exe
  C:\Windows\System\ZxyKCuU.exe
  2⤵
  PID:7788
- C:\Windows\System\KbqKXKj.exe
  C:\Windows\System\KbqKXKj.exe
  2⤵
  PID:7816
- C:\Windows\System\oBpwnTY.exe
  C:\Windows\System\oBpwnTY.exe
  2⤵
  PID:7844
- C:\Windows\System\FXgozda.exe
  C:\Windows\System\FXgozda.exe
  2⤵
  PID:7872
- C:\Windows\System\RAyuWhk.exe
  C:\Windows\System\RAyuWhk.exe
  2⤵
  PID:7904
- C:\Windows\System\oFEGUPj.exe
  C:\Windows\System\oFEGUPj.exe
  2⤵
  PID:7940
- C:\Windows\System\DSiSKgQ.exe
  C:\Windows\System\DSiSKgQ.exe
  2⤵
  PID:7960
- C:\Windows\System\venolyu.exe
  C:\Windows\System\venolyu.exe
  2⤵
  PID:7996
- C:\Windows\System\YUHlyVE.exe
  C:\Windows\System\YUHlyVE.exe
  2⤵
  PID:8012
- C:\Windows\System\keLwaJv.exe
  C:\Windows\System\keLwaJv.exe
  2⤵
  PID:8028
- C:\Windows\System\CrQBOOJ.exe
  C:\Windows\System\CrQBOOJ.exe
  2⤵
  PID:8080
- C:\Windows\System\bMFfYXj.exe
  C:\Windows\System\bMFfYXj.exe
  2⤵
  PID:8108
- C:\Windows\System\erTwFpo.exe
  C:\Windows\System\erTwFpo.exe
  2⤵
  PID:8136
- C:\Windows\System\xPrATOo.exe
  C:\Windows\System\xPrATOo.exe
  2⤵
  PID:8164
- C:\Windows\System\koKTkOx.exe
  C:\Windows\System\koKTkOx.exe
  2⤵
  PID:8188
- C:\Windows\System\NWFICsO.exe
  C:\Windows\System\NWFICsO.exe
  2⤵
  PID:7192
- C:\Windows\System\LClVrJJ.exe
  C:\Windows\System\LClVrJJ.exe
  2⤵
  PID:7272
- C:\Windows\System\kiBSceU.exe
  C:\Windows\System\kiBSceU.exe
  2⤵
  PID:7320
- C:\Windows\System\zBIbCsb.exe
  C:\Windows\System\zBIbCsb.exe
  2⤵
  PID:7436
- C:\Windows\System\yruUHZI.exe
  C:\Windows\System\yruUHZI.exe
  2⤵
  PID:7492
- C:\Windows\System\dlPLWcf.exe
  C:\Windows\System\dlPLWcf.exe
  2⤵
  PID:7532
- C:\Windows\System\YOefHdr.exe
  C:\Windows\System\YOefHdr.exe
  2⤵
  PID:7620
- C:\Windows\System\eJygHmh.exe
  C:\Windows\System\eJygHmh.exe
  2⤵
  PID:7684
- C:\Windows\System\QiJQNrG.exe
  C:\Windows\System\QiJQNrG.exe
  2⤵
  PID:7740
- C:\Windows\System\RqcQxbP.exe
  C:\Windows\System\RqcQxbP.exe
  2⤵
  PID:7860
- C:\Windows\System\IgNzIIk.exe
  C:\Windows\System\IgNzIIk.exe
  2⤵
  PID:7836
- C:\Windows\System\lAqOLBu.exe
  C:\Windows\System\lAqOLBu.exe
  2⤵
  PID:7948
- C:\Windows\System\oTsBUMI.exe
  C:\Windows\System\oTsBUMI.exe
  2⤵
  PID:8008
- C:\Windows\System\wNXySWh.exe
  C:\Windows\System\wNXySWh.exe
  2⤵
  PID:8064
- C:\Windows\System\QvPJFlp.exe
  C:\Windows\System\QvPJFlp.exe
  2⤵
  PID:8128
- C:\Windows\System\GQqEJCr.exe
  C:\Windows\System\GQqEJCr.exe
  2⤵
  PID:7172
- C:\Windows\System\ZDZrmyD.exe
  C:\Windows\System\ZDZrmyD.exe
  2⤵
  PID:7316
- C:\Windows\System\OaXCEuT.exe
  C:\Windows\System\OaXCEuT.exe
  2⤵
  PID:7548
- C:\Windows\System\ivCtwGL.exe
  C:\Windows\System\ivCtwGL.exe
  2⤵
  PID:7576
- C:\Windows\System\YdCAMSF.exe
  C:\Windows\System\YdCAMSF.exe
  2⤵
  PID:7828
- C:\Windows\System\zKkmldd.exe
  C:\Windows\System\zKkmldd.exe
  2⤵
  PID:7980
- C:\Windows\System\nEVCKBu.exe
  C:\Windows\System\nEVCKBu.exe
  2⤵
  PID:7244
- C:\Windows\System\PHWBtBz.exe
  C:\Windows\System\PHWBtBz.exe
  2⤵
  PID:7352
- C:\Windows\System\jnCpySS.exe
  C:\Windows\System\jnCpySS.exe
  2⤵
  PID:7804
- C:\Windows\System\nSSdzdR.exe
  C:\Windows\System\nSSdzdR.exe
  2⤵
  PID:7936
- C:\Windows\System\FfDXUHG.exe
  C:\Windows\System\FfDXUHG.exe
  2⤵
  PID:7736
- C:\Windows\System\YNPGZfl.exe
  C:\Windows\System\YNPGZfl.exe
  2⤵
  PID:7596
- C:\Windows\System\vxOSZtq.exe
  C:\Windows\System\vxOSZtq.exe
  2⤵
  PID:8220
- C:\Windows\System\xwOAuRz.exe
  C:\Windows\System\xwOAuRz.exe
  2⤵
  PID:8248
- C:\Windows\System\tSrpPzC.exe
  C:\Windows\System\tSrpPzC.exe
  2⤵
  PID:8276
- C:\Windows\System\mdQaoEz.exe
  C:\Windows\System\mdQaoEz.exe
  2⤵
  PID:8292
- C:\Windows\System\jcLczjk.exe
  C:\Windows\System\jcLczjk.exe
  2⤵
  PID:8324
- C:\Windows\System\sncvstS.exe
  C:\Windows\System\sncvstS.exe
  2⤵
  PID:8348
- C:\Windows\System\zBUQNMe.exe
  C:\Windows\System\zBUQNMe.exe
  2⤵
  PID:8376
- C:\Windows\System\zpcPvPw.exe
  C:\Windows\System\zpcPvPw.exe
  2⤵
  PID:8408
- C:\Windows\System\bkHBOYL.exe
  C:\Windows\System\bkHBOYL.exe
  2⤵
  PID:8432
- C:\Windows\System\MnjHENt.exe
  C:\Windows\System\MnjHENt.exe
  2⤵
  PID:8460
- C:\Windows\System\EQatxda.exe
  C:\Windows\System\EQatxda.exe
  2⤵
  PID:8488
- C:\Windows\System\VDOxsXv.exe
  C:\Windows\System\VDOxsXv.exe
  2⤵
  PID:8508
- C:\Windows\System\cbARTDr.exe
  C:\Windows\System\cbARTDr.exe
  2⤵
  PID:8540
- C:\Windows\System\IbAwHkl.exe
  C:\Windows\System\IbAwHkl.exe
  2⤵
  PID:8572
- C:\Windows\System\MPQoFJe.exe
  C:\Windows\System\MPQoFJe.exe
  2⤵
  PID:8592
- C:\Windows\System\hDlQPIb.exe
  C:\Windows\System\hDlQPIb.exe
  2⤵
  PID:8628
- C:\Windows\System\KxwJiRY.exe
  C:\Windows\System\KxwJiRY.exe
  2⤵
  PID:8668
- C:\Windows\System\ggjaWFP.exe
  C:\Windows\System\ggjaWFP.exe
  2⤵
  PID:8684
- C:\Windows\System\ENjShTw.exe
  C:\Windows\System\ENjShTw.exe
  2⤵
  PID:8724
- C:\Windows\System\ODqSost.exe
  C:\Windows\System\ODqSost.exe
  2⤵
  PID:8752
- C:\Windows\System\KiZQPwK.exe
  C:\Windows\System\KiZQPwK.exe
  2⤵
  PID:8780
- C:\Windows\System\zmWnTUf.exe
  C:\Windows\System\zmWnTUf.exe
  2⤵
  PID:8808
- C:\Windows\System\rrPDhRP.exe
  C:\Windows\System\rrPDhRP.exe
  2⤵
  PID:8824
- C:\Windows\System\AWIZyGr.exe
  C:\Windows\System\AWIZyGr.exe
  2⤵
  PID:8856
- C:\Windows\System\WSSjUWA.exe
  C:\Windows\System\WSSjUWA.exe
  2⤵
  PID:8884
- C:\Windows\System\TKlykau.exe
  C:\Windows\System\TKlykau.exe
  2⤵
  PID:8908
- C:\Windows\System\POwSqgf.exe
  C:\Windows\System\POwSqgf.exe
  2⤵
  PID:8948
- C:\Windows\System\GEqpExJ.exe
  C:\Windows\System\GEqpExJ.exe
  2⤵
  PID:8964
- C:\Windows\System\NpGCWJC.exe
  C:\Windows\System\NpGCWJC.exe
  2⤵
  PID:8992
- C:\Windows\System\ljfuiTb.exe
  C:\Windows\System\ljfuiTb.exe
  2⤵
  PID:9024
- C:\Windows\System\TviyLHm.exe
  C:\Windows\System\TviyLHm.exe
  2⤵
  PID:9060
- C:\Windows\System\MUQHuKv.exe
  C:\Windows\System\MUQHuKv.exe
  2⤵
  PID:9080
- C:\Windows\System\ssSNrWz.exe
  C:\Windows\System\ssSNrWz.exe
  2⤵
  PID:9116
- C:\Windows\System\BNyeskE.exe
  C:\Windows\System\BNyeskE.exe
  2⤵
  PID:9132
- C:\Windows\System\frxfyQM.exe
  C:\Windows\System\frxfyQM.exe
  2⤵
  PID:9160
- C:\Windows\System\rTgXJQd.exe
  C:\Windows\System\rTgXJQd.exe
  2⤵
  PID:9200
- C:\Windows\System\HbKeYkJ.exe
  C:\Windows\System\HbKeYkJ.exe
  2⤵
  PID:8208
- C:\Windows\System\oLSirqV.exe
  C:\Windows\System\oLSirqV.exe
  2⤵
  PID:8284
- C:\Windows\System\WULQPtq.exe
  C:\Windows\System\WULQPtq.exe
  2⤵
  PID:8332
- C:\Windows\System\aeqvZvh.exe
  C:\Windows\System\aeqvZvh.exe
  2⤵
  PID:8372
- C:\Windows\System\ZzTsyID.exe
  C:\Windows\System\ZzTsyID.exe
  2⤵
  PID:8476
- C:\Windows\System\KKqwDvi.exe
  C:\Windows\System\KKqwDvi.exe
  2⤵
  PID:8504
- C:\Windows\System\zLzQvfF.exe
  C:\Windows\System\zLzQvfF.exe
  2⤵
  PID:8532
- C:\Windows\System\ESoDLou.exe
  C:\Windows\System\ESoDLou.exe
  2⤵
  PID:8644
- C:\Windows\System\cbshNbI.exe
  C:\Windows\System\cbshNbI.exe
  2⤵
  PID:8716
- C:\Windows\System\JmJaHXh.exe
  C:\Windows\System\JmJaHXh.exe
  2⤵
  PID:8796
- C:\Windows\System\LSEkrDc.exe
  C:\Windows\System\LSEkrDc.exe
  2⤵
  PID:8844
- C:\Windows\System\BoFdvLR.exe
  C:\Windows\System\BoFdvLR.exe
  2⤵
  PID:8880
- C:\Windows\System\GxBjpFY.exe
  C:\Windows\System\GxBjpFY.exe
  2⤵
  PID:9000
- C:\Windows\System\bbLfzYe.exe
  C:\Windows\System\bbLfzYe.exe
  2⤵
  PID:9040
- C:\Windows\System\cuyqCWN.exe
  C:\Windows\System\cuyqCWN.exe
  2⤵
  PID:9100
- C:\Windows\System\fmMuYdN.exe
  C:\Windows\System\fmMuYdN.exe
  2⤵
  PID:9176
- C:\Windows\System\MBUiOIP.exe
  C:\Windows\System\MBUiOIP.exe
  2⤵
  PID:8244
- C:\Windows\System\RWJsuvn.exe
  C:\Windows\System\RWJsuvn.exe
  2⤵
  PID:8392
- C:\Windows\System\snKNtwU.exe
  C:\Windows\System\snKNtwU.exe
  2⤵
  PID:8568
- C:\Windows\System\VFCBueO.exe
  C:\Windows\System\VFCBueO.exe
  2⤵
  PID:8704
- C:\Windows\System\IlluPJI.exe
  C:\Windows\System\IlluPJI.exe
  2⤵
  PID:8816
- C:\Windows\System\OgqJjhn.exe
  C:\Windows\System\OgqJjhn.exe
  2⤵
  PID:8960
- C:\Windows\System\tXTaaCX.exe
  C:\Windows\System\tXTaaCX.exe
  2⤵
  PID:9108
- C:\Windows\System\NYdIymz.exe
  C:\Windows\System\NYdIymz.exe
  2⤵
  PID:8388
- C:\Windows\System\vmFJtYc.exe
  C:\Windows\System\vmFJtYc.exe
  2⤵
  PID:8344
- C:\Windows\System\PfQszqY.exe
  C:\Windows\System\PfQszqY.exe
  2⤵
  PID:8804
- C:\Windows\System\HfdPRDI.exe
  C:\Windows\System\HfdPRDI.exe
  2⤵
  PID:8424
- C:\Windows\System\kocVeGO.exe
  C:\Windows\System\kocVeGO.exe
  2⤵
  PID:9224
- C:\Windows\System\sgsCfQS.exe
  C:\Windows\System\sgsCfQS.exe
  2⤵
  PID:9260
- C:\Windows\System\DJqBOrk.exe
  C:\Windows\System\DJqBOrk.exe
  2⤵
  PID:9284
- C:\Windows\System\XhvJfKp.exe
  C:\Windows\System\XhvJfKp.exe
  2⤵
  PID:9320
- C:\Windows\System\mqsIyot.exe
  C:\Windows\System\mqsIyot.exe
  2⤵
  PID:9340
- C:\Windows\System\fGUMQli.exe
  C:\Windows\System\fGUMQli.exe
  2⤵
  PID:9368
- C:\Windows\System\ChxhNzv.exe
  C:\Windows\System\ChxhNzv.exe
  2⤵
  PID:9396
- C:\Windows\System\ylizeLV.exe
  C:\Windows\System\ylizeLV.exe
  2⤵
  PID:9424
- C:\Windows\System\agyaLBL.exe
  C:\Windows\System\agyaLBL.exe
  2⤵
  PID:9460
- C:\Windows\System\OBIJEFT.exe
  C:\Windows\System\OBIJEFT.exe
  2⤵
  PID:9492
- C:\Windows\System\kxhQdGt.exe
  C:\Windows\System\kxhQdGt.exe
  2⤵
  PID:9508
- C:\Windows\System\pPxObve.exe
  C:\Windows\System\pPxObve.exe
  2⤵
  PID:9536
- C:\Windows\System\RNBqCpB.exe
  C:\Windows\System\RNBqCpB.exe
  2⤵
  PID:9576
- C:\Windows\System\EitZkNa.exe
  C:\Windows\System\EitZkNa.exe
  2⤵
  PID:9604
- C:\Windows\System\OWyMrIX.exe
  C:\Windows\System\OWyMrIX.exe
  2⤵
  PID:9632
- C:\Windows\System\ZbyPffT.exe
  C:\Windows\System\ZbyPffT.exe
  2⤵
  PID:9660
- C:\Windows\System\GwBFfWJ.exe
  C:\Windows\System\GwBFfWJ.exe
  2⤵
  PID:9688
- C:\Windows\System\fDvmsVn.exe
  C:\Windows\System\fDvmsVn.exe
  2⤵
  PID:9712
- C:\Windows\System\hQxAFmu.exe
  C:\Windows\System\hQxAFmu.exe
  2⤵
  PID:9732
- C:\Windows\System\KwBQLrX.exe
  C:\Windows\System\KwBQLrX.exe
  2⤵
  PID:9760
- C:\Windows\System\gGveulJ.exe
  C:\Windows\System\gGveulJ.exe
  2⤵
  PID:9780
- C:\Windows\System\wJrLaJk.exe
  C:\Windows\System\wJrLaJk.exe
  2⤵
  PID:9828
- C:\Windows\System\Cebobok.exe
  C:\Windows\System\Cebobok.exe
  2⤵
  PID:9856
- C:\Windows\System\luXjgbG.exe
  C:\Windows\System\luXjgbG.exe
  2⤵
  PID:9884
- C:\Windows\System\lIiDaiB.exe
  C:\Windows\System\lIiDaiB.exe
  2⤵
  PID:9908
- C:\Windows\System\iaLLOuu.exe
  C:\Windows\System\iaLLOuu.exe
  2⤵
  PID:9928
- C:\Windows\System\XngCvSr.exe
  C:\Windows\System\XngCvSr.exe
  2⤵
  PID:9956
- C:\Windows\System\hTCKHMV.exe
  C:\Windows\System\hTCKHMV.exe
  2⤵
  PID:9996
- C:\Windows\System\BMThfqa.exe
  C:\Windows\System\BMThfqa.exe
  2⤵
  PID:10024
- C:\Windows\System\zcbkwlU.exe
  C:\Windows\System\zcbkwlU.exe
  2⤵
  PID:10040
- C:\Windows\System\DzTUpRt.exe
  C:\Windows\System\DzTUpRt.exe
  2⤵
  PID:10072
- C:\Windows\System\ITsFcUE.exe
  C:\Windows\System\ITsFcUE.exe
  2⤵
  PID:10096
- C:\Windows\System\zhBxjMF.exe
  C:\Windows\System\zhBxjMF.exe
  2⤵
  PID:10112
- C:\Windows\System\RQgIFcw.exe
  C:\Windows\System\RQgIFcw.exe
  2⤵
  PID:10140
- C:\Windows\System\NWtKTXW.exe
  C:\Windows\System\NWtKTXW.exe
  2⤵
  PID:10172
- C:\Windows\System\nOiVcUq.exe
  C:\Windows\System\nOiVcUq.exe
  2⤵
  PID:10208
- C:\Windows\System\KxrjrYO.exe
  C:\Windows\System\KxrjrYO.exe
  2⤵
  PID:8700
- C:\Windows\System\WnQOLGd.exe
  C:\Windows\System\WnQOLGd.exe
  2⤵
  PID:9280
- C:\Windows\System\quoQVOG.exe
  C:\Windows\System\quoQVOG.exe
  2⤵
  PID:9356
- C:\Windows\System\dPWdBnz.exe
  C:\Windows\System\dPWdBnz.exe
  2⤵
  PID:9404
- C:\Windows\System\vkWbExf.exe
  C:\Windows\System\vkWbExf.exe
  2⤵
  PID:9476
- C:\Windows\System\dMaGbRK.exe
  C:\Windows\System\dMaGbRK.exe
  2⤵
  PID:9504
- C:\Windows\System\OTZpWMI.exe
  C:\Windows\System\OTZpWMI.exe
  2⤵
  PID:9560
- C:\Windows\System\wYWFFry.exe
  C:\Windows\System\wYWFFry.exe
  2⤵
  PID:9592
- C:\Windows\System\cpAoFJm.exe
  C:\Windows\System\cpAoFJm.exe
  2⤵
  PID:9676
- C:\Windows\System\qmELOSM.exe
  C:\Windows\System\qmELOSM.exe
  2⤵
  PID:9728
- C:\Windows\System\gUNMCMG.exe
  C:\Windows\System\gUNMCMG.exe
  2⤵
  PID:9868
- C:\Windows\System\CXWlghF.exe
  C:\Windows\System\CXWlghF.exe
  2⤵
  PID:9940
- C:\Windows\System\kTdCzbY.exe
  C:\Windows\System\kTdCzbY.exe
  2⤵
  PID:9988
- C:\Windows\System\hERkons.exe
  C:\Windows\System\hERkons.exe
  2⤵
  PID:10060
- C:\Windows\System\rURUdHJ.exe
  C:\Windows\System\rURUdHJ.exe
  2⤵
  PID:10124
- C:\Windows\System\YdmezLT.exe
  C:\Windows\System\YdmezLT.exe
  2⤵
  PID:10156
- C:\Windows\System\YITRyPe.exe
  C:\Windows\System\YITRyPe.exe
  2⤵
  PID:10224
- C:\Windows\System\XGjmTsj.exe
  C:\Windows\System\XGjmTsj.exe
  2⤵
  PID:9316
- C:\Windows\System\gLeJnpi.exe
  C:\Windows\System\gLeJnpi.exe
  2⤵
  PID:9456
- C:\Windows\System\TMHFKiN.exe
  C:\Windows\System\TMHFKiN.exe
  2⤵
  PID:9628
- C:\Windows\System\gmbJxjH.exe
  C:\Windows\System\gmbJxjH.exe
  2⤵
  PID:9820
- C:\Windows\System\CggbExF.exe
  C:\Windows\System\CggbExF.exe
  2⤵
  PID:9880
- C:\Windows\System\aeTWkEV.exe
  C:\Windows\System\aeTWkEV.exe
  2⤵
  PID:10108
- C:\Windows\System\HlSaoxN.exe
  C:\Windows\System\HlSaoxN.exe
  2⤵
  PID:9240
- C:\Windows\System\RWnFrGu.exe
  C:\Windows\System\RWnFrGu.exe
  2⤵
  PID:9384
- C:\Windows\System\gSxRnVu.exe
  C:\Windows\System\gSxRnVu.exe
  2⤵
  PID:9892
- C:\Windows\System\CumYIkq.exe
  C:\Windows\System\CumYIkq.exe
  2⤵
  PID:10196
- C:\Windows\System\PbGRiZS.exe
  C:\Windows\System\PbGRiZS.exe
  2⤵
  PID:10036
- C:\Windows\System\eDtHDbd.exe
  C:\Windows\System\eDtHDbd.exe
  2⤵
  PID:10268
- C:\Windows\System\lwjVRAL.exe
  C:\Windows\System\lwjVRAL.exe
  2⤵
  PID:10284
- C:\Windows\System\NrgMtkO.exe
  C:\Windows\System\NrgMtkO.exe
  2⤵
  PID:10316
- C:\Windows\System\duWpXii.exe
  C:\Windows\System\duWpXii.exe
  2⤵
  PID:10352
- C:\Windows\System\TsiAPeC.exe
  C:\Windows\System\TsiAPeC.exe
  2⤵
  PID:10368
- C:\Windows\System\zTXFxCE.exe
  C:\Windows\System\zTXFxCE.exe
  2⤵
  PID:10388
- C:\Windows\System\sqefUsJ.exe
  C:\Windows\System\sqefUsJ.exe
  2⤵
  PID:10436
- C:\Windows\System\HTmlytJ.exe
  C:\Windows\System\HTmlytJ.exe
  2⤵
  PID:10452
- C:\Windows\System\RKVUczc.exe
  C:\Windows\System\RKVUczc.exe
  2⤵
  PID:10480
- C:\Windows\System\kJBIHqA.exe
  C:\Windows\System\kJBIHqA.exe
  2⤵
  PID:10508
- C:\Windows\System\tjoKqBl.exe
  C:\Windows\System\tjoKqBl.exe
  2⤵
  PID:10536
- C:\Windows\System\CNsmqRX.exe
  C:\Windows\System\CNsmqRX.exe
  2⤵
  PID:10564
- C:\Windows\System\iPapSey.exe
  C:\Windows\System\iPapSey.exe
  2⤵
  PID:10604
- C:\Windows\System\ppsixyd.exe
  C:\Windows\System\ppsixyd.exe
  2⤵
  PID:10632
- C:\Windows\System\HEwTwlf.exe
  C:\Windows\System\HEwTwlf.exe
  2⤵
  PID:10660
- C:\Windows\System\Ttvnsuo.exe
  C:\Windows\System\Ttvnsuo.exe
  2⤵
  PID:10688
- C:\Windows\System\VQZOQYG.exe
  C:\Windows\System\VQZOQYG.exe
  2⤵
  PID:10716
- C:\Windows\System\eTWSQAc.exe
  C:\Windows\System\eTWSQAc.exe
  2⤵
  PID:10744
- C:\Windows\System\kdOjrjc.exe
  C:\Windows\System\kdOjrjc.exe
  2⤵
  PID:10772
- C:\Windows\System\zDaaiRR.exe
  C:\Windows\System\zDaaiRR.exe
  2⤵
  PID:10792
- C:\Windows\System\wVVQcMO.exe
  C:\Windows\System\wVVQcMO.exe
  2⤵
  PID:10832
- C:\Windows\System\oBsfFZW.exe
  C:\Windows\System\oBsfFZW.exe
  2⤵
  PID:10852
- C:\Windows\System\Zczshjc.exe
  C:\Windows\System\Zczshjc.exe
  2⤵
  PID:10888
- C:\Windows\System\RyVPKEa.exe
  C:\Windows\System\RyVPKEa.exe
  2⤵
  PID:10908
- C:\Windows\System\qENhATR.exe
  C:\Windows\System\qENhATR.exe
  2⤵
  PID:10940
- C:\Windows\System\KoIWKeG.exe
  C:\Windows\System\KoIWKeG.exe
  2⤵
  PID:10960
- C:\Windows\System\DTKclIz.exe
  C:\Windows\System\DTKclIz.exe
  2⤵
  PID:10992
- C:\Windows\System\CilCNsE.exe
  C:\Windows\System\CilCNsE.exe
  2⤵
  PID:11016
- C:\Windows\System\Jglvphw.exe
  C:\Windows\System\Jglvphw.exe
  2⤵
  PID:11044
- C:\Windows\System\CBPYdva.exe
  C:\Windows\System\CBPYdva.exe
  2⤵
  PID:11084
- C:\Windows\System\IxThJzq.exe
  C:\Windows\System\IxThJzq.exe
  2⤵
  PID:11112
- C:\Windows\System\CbblHva.exe
  C:\Windows\System\CbblHva.exe
  2⤵
  PID:11140
- C:\Windows\System\lFvKqyt.exe
  C:\Windows\System\lFvKqyt.exe
  2⤵
  PID:11164
- C:\Windows\System\xyPErSn.exe
  C:\Windows\System\xyPErSn.exe
  2⤵
  PID:11184
- C:\Windows\System\vQCDaBk.exe
  C:\Windows\System\vQCDaBk.exe
  2⤵
  PID:11200
- C:\Windows\System\COESoce.exe
  C:\Windows\System\COESoce.exe
  2⤵
  PID:11220
- C:\Windows\System\VTsNsog.exe
  C:\Windows\System\VTsNsog.exe
  2⤵
  PID:11260
- C:\Windows\System\PDwcdqh.exe
  C:\Windows\System\PDwcdqh.exe
  2⤵
  PID:10280
- C:\Windows\System\rRBxYeW.exe
  C:\Windows\System\rRBxYeW.exe
  2⤵
  PID:10332
- C:\Windows\System\erHfnoZ.exe
  C:\Windows\System\erHfnoZ.exe
  2⤵
  PID:10360
- C:\Windows\System\ftPLoLj.exe
  C:\Windows\System\ftPLoLj.exe
  2⤵
  PID:10444
- C:\Windows\System\prNjsCm.exe
  C:\Windows\System\prNjsCm.exe
  2⤵
  PID:10496
- C:\Windows\System\gjCkgzz.exe
  C:\Windows\System\gjCkgzz.exe
  2⤵
  PID:10616
- C:\Windows\System\nDNlpEN.exe
  C:\Windows\System\nDNlpEN.exe
  2⤵
  PID:10680
- C:\Windows\System\KiOvjRi.exe
  C:\Windows\System\KiOvjRi.exe
  2⤵
  PID:10756
- C:\Windows\System\GiOUuEH.exe
  C:\Windows\System\GiOUuEH.exe
  2⤵
  PID:10848
- C:\Windows\System\DhVtCFZ.exe
  C:\Windows\System\DhVtCFZ.exe
  2⤵
  PID:10872
- C:\Windows\System\LIuodKS.exe
  C:\Windows\System\LIuodKS.exe
  2⤵
  PID:10932
- C:\Windows\System\HEFuBwW.exe
  C:\Windows\System\HEFuBwW.exe
  2⤵
  PID:11036
- C:\Windows\System\QZAIAlS.exe
  C:\Windows\System\QZAIAlS.exe
  2⤵
  PID:11108
- C:\Windows\System\gZhOaxz.exe
  C:\Windows\System\gZhOaxz.exe
  2⤵
  PID:11156
- C:\Windows\System\DCKScYU.exe
  C:\Windows\System\DCKScYU.exe
  2⤵
  PID:11196
- C:\Windows\System\qHlOwcm.exe
  C:\Windows\System\qHlOwcm.exe
  2⤵
  PID:11212
- C:\Windows\System\PdBLfbX.exe
  C:\Windows\System\PdBLfbX.exe
  2⤵
  PID:10448
- C:\Windows\System\eWyFlbX.exe
  C:\Windows\System\eWyFlbX.exe
  2⤵
  PID:10600
- C:\Windows\System\nKeSxRP.exe
  C:\Windows\System\nKeSxRP.exe
  2⤵
  PID:10672
- C:\Windows\System\CqjtdAy.exe
  C:\Windows\System\CqjtdAy.exe
  2⤵
  PID:10868
- C:\Windows\System\wGzculZ.exe
  C:\Windows\System\wGzculZ.exe
  2⤵
  PID:11064
- C:\Windows\System\ShZMbmE.exe
  C:\Windows\System\ShZMbmE.exe
  2⤵
  PID:11124
- C:\Windows\System\TKENDnx.exe
  C:\Windows\System\TKENDnx.exe
  2⤵
  PID:10248
- C:\Windows\System\OduUGpa.exe
  C:\Windows\System\OduUGpa.exe
  2⤵
  PID:10468
- C:\Windows\System\mbcMkZk.exe
  C:\Windows\System\mbcMkZk.exe
  2⤵
  PID:10948
- C:\Windows\System\pUcHCru.exe
  C:\Windows\System\pUcHCru.exe
  2⤵
  PID:10256
- C:\Windows\System\XzUcRes.exe
  C:\Windows\System\XzUcRes.exe
  2⤵
  PID:11268
- C:\Windows\System\IvCQKHe.exe
  C:\Windows\System\IvCQKHe.exe
  2⤵
  PID:11304
- C:\Windows\System\hYhMwAT.exe
  C:\Windows\System\hYhMwAT.exe
  2⤵
  PID:11328
- C:\Windows\System\xlYYvff.exe
  C:\Windows\System\xlYYvff.exe
  2⤵
  PID:11380
- C:\Windows\System\GGWsFit.exe
  C:\Windows\System\GGWsFit.exe
  2⤵
  PID:11396
- C:\Windows\System\ZeypUqr.exe
  C:\Windows\System\ZeypUqr.exe
  2⤵
  PID:11424
- C:\Windows\System\geAwgCa.exe
  C:\Windows\System\geAwgCa.exe
  2⤵
  PID:11456
- C:\Windows\System\RukIIfx.exe
  C:\Windows\System\RukIIfx.exe
  2⤵
  PID:11484
- C:\Windows\System\gxBENVg.exe
  C:\Windows\System\gxBENVg.exe
  2⤵
  PID:11504
- C:\Windows\System\DaLSfpc.exe
  C:\Windows\System\DaLSfpc.exe
  2⤵
  PID:11536
- C:\Windows\System\NEWmPTs.exe
  C:\Windows\System\NEWmPTs.exe
  2⤵
  PID:11576
- C:\Windows\System\TfeOuIF.exe
  C:\Windows\System\TfeOuIF.exe
  2⤵
  PID:11604
- C:\Windows\System\hFsCGcj.exe
  C:\Windows\System\hFsCGcj.exe
  2⤵
  PID:11624
- C:\Windows\System\waqVNlE.exe
  C:\Windows\System\waqVNlE.exe
  2⤵
  PID:11660
- C:\Windows\System\LBWhRJd.exe
  C:\Windows\System\LBWhRJd.exe
  2⤵
  PID:11688
- C:\Windows\System\sAiOznF.exe
  C:\Windows\System\sAiOznF.exe
  2⤵
  PID:11716
- C:\Windows\System\eiacsxB.exe
  C:\Windows\System\eiacsxB.exe
  2⤵
  PID:11732
- C:\Windows\System\HyanqzY.exe
  C:\Windows\System\HyanqzY.exe
  2⤵
  PID:11760
- C:\Windows\System\tGeKYhH.exe
  C:\Windows\System\tGeKYhH.exe
  2⤵
  PID:11788
- C:\Windows\System\cXhAgxr.exe
  C:\Windows\System\cXhAgxr.exe
  2⤵
  PID:11816
- C:\Windows\System\wEUoiyo.exe
  C:\Windows\System\wEUoiyo.exe
  2⤵
  PID:11844
- C:\Windows\System\cESvNbe.exe
  C:\Windows\System\cESvNbe.exe
  2⤵
  PID:11864
- C:\Windows\System\gyvyqPM.exe
  C:\Windows\System\gyvyqPM.exe
  2⤵
  PID:11900
- C:\Windows\System\OVrswYC.exe
  C:\Windows\System\OVrswYC.exe
  2⤵
  PID:11940
- C:\Windows\System\SSxSPXF.exe
  C:\Windows\System\SSxSPXF.exe
  2⤵
  PID:11960
- C:\Windows\System\RLzjWhX.exe
  C:\Windows\System\RLzjWhX.exe
  2⤵
  PID:11984
- C:\Windows\System\WZtQGaI.exe
  C:\Windows\System\WZtQGaI.exe
  2⤵
  PID:12012
- C:\Windows\System\kdNbfFP.exe
  C:\Windows\System\kdNbfFP.exe
  2⤵
  PID:12052
- C:\Windows\System\icjFYNJ.exe
  C:\Windows\System\icjFYNJ.exe
  2⤵
  PID:12076
- C:\Windows\System\XdWOife.exe
  C:\Windows\System\XdWOife.exe
  2⤵
  PID:12096
- C:\Windows\System\jqJtyrR.exe
  C:\Windows\System\jqJtyrR.exe
  2⤵
  PID:12124
- C:\Windows\System\AmXiFul.exe
  C:\Windows\System\AmXiFul.exe
  2⤵
  PID:12152
- C:\Windows\System\qYZLixg.exe
  C:\Windows\System\qYZLixg.exe
  2⤵
  PID:12192
- C:\Windows\System\qjocdiL.exe
  C:\Windows\System\qjocdiL.exe
  2⤵
  PID:12220
- C:\Windows\System\UeZDTEU.exe
  C:\Windows\System\UeZDTEU.exe
  2⤵
  PID:12252
- C:\Windows\System\JDivcil.exe
  C:\Windows\System\JDivcil.exe
  2⤵
  PID:12268
- C:\Windows\System\MOVYItg.exe
  C:\Windows\System\MOVYItg.exe
  2⤵
  PID:10760
- C:\Windows\System\aOfdgqN.exe
  C:\Windows\System\aOfdgqN.exe
  2⤵
  PID:11276
- C:\Windows\System\tQyYedp.exe
  C:\Windows\System\tQyYedp.exe
  2⤵
  PID:11356
- C:\Windows\System\cRaOQbj.exe
  C:\Windows\System\cRaOQbj.exe
  2⤵
  PID:11420
- C:\Windows\System\UbfbQIO.exe
  C:\Windows\System\UbfbQIO.exe
  2⤵
  PID:11444
- C:\Windows\System\zdvvxWe.exe
  C:\Windows\System\zdvvxWe.exe
  2⤵
  PID:11492
- C:\Windows\System\MUgrLQR.exe
  C:\Windows\System\MUgrLQR.exe
  2⤵
  PID:11568
- C:\Windows\System\edNNewJ.exe
  C:\Windows\System\edNNewJ.exe
  2⤵
  PID:11596
- C:\Windows\System\SkhNhdm.exe
  C:\Windows\System\SkhNhdm.exe
  2⤵
  PID:11644
- C:\Windows\System\VrGIADZ.exe
  C:\Windows\System\VrGIADZ.exe
  2⤵
  PID:11728
- C:\Windows\System\rCXFlQC.exe
  C:\Windows\System\rCXFlQC.exe
  2⤵
  PID:10788
- C:\Windows\System\hlpmzTb.exe
  C:\Windows\System\hlpmzTb.exe
  2⤵
  PID:11972
- C:\Windows\System\cLcMUGQ.exe
  C:\Windows\System\cLcMUGQ.exe
  2⤵
  PID:12004
- C:\Windows\System\JfSTAFq.exe
  C:\Windows\System\JfSTAFq.exe
  2⤵
  PID:12084
- C:\Windows\System\CaMIlQn.exe
  C:\Windows\System\CaMIlQn.exe
  2⤵
  PID:12120
- C:\Windows\System\bDTeLlK.exe
  C:\Windows\System\bDTeLlK.exe
  2⤵
  PID:12244
- C:\Windows\System\JLRJDGq.exe
  C:\Windows\System\JLRJDGq.exe
  2⤵
  PID:12260
- C:\Windows\System\SvJANIz.exe
  C:\Windows\System\SvJANIz.exe
  2⤵
  PID:11284
- C:\Windows\System\MMdPeIj.exe
  C:\Windows\System\MMdPeIj.exe
  2⤵
  PID:11600
- C:\Windows\System\bRnpdWq.exe
  C:\Windows\System\bRnpdWq.exe
  2⤵
  PID:11620
- C:\Windows\System\pRnicEk.exe
  C:\Windows\System\pRnicEk.exe
  2⤵
  PID:11784
- C:\Windows\System\jcoFWCr.exe
  C:\Windows\System\jcoFWCr.exe
  2⤵
  PID:11948
- C:\Windows\System\giKQdOa.exe
  C:\Windows\System\giKQdOa.exe
  2⤵
  PID:12136
- C:\Windows\System\ERpBrGu.exe
  C:\Windows\System\ERpBrGu.exe
  2⤵
  PID:12240
- C:\Windows\System\TljAKyQ.exe
  C:\Windows\System\TljAKyQ.exe
  2⤵
  PID:11316
- C:\Windows\System\QgQMRqy.exe
  C:\Windows\System\QgQMRqy.exe
  2⤵
  PID:11884
- C:\Windows\System\ZURgUDr.exe
  C:\Windows\System\ZURgUDr.exe
  2⤵
  PID:12216
- C:\Windows\System\nwjqWaE.exe
  C:\Windows\System\nwjqWaE.exe
  2⤵
  PID:11652
- C:\Windows\System\VdVQLhn.exe
  C:\Windows\System\VdVQLhn.exe
  2⤵
  PID:11572
- C:\Windows\System\wfAJCVR.exe
  C:\Windows\System\wfAJCVR.exe
  2⤵
  PID:12312
- C:\Windows\System\PuAThVB.exe
  C:\Windows\System\PuAThVB.exe
  2⤵
  PID:12352
- C:\Windows\System\SIfeglV.exe
  C:\Windows\System\SIfeglV.exe
  2⤵
  PID:12368
- C:\Windows\System\ddKYlnC.exe
  C:\Windows\System\ddKYlnC.exe
  2⤵
  PID:12388
- C:\Windows\System\xBEjHet.exe
  C:\Windows\System\xBEjHet.exe
  2⤵
  PID:12432
- C:\Windows\System\DdfpXIl.exe
  C:\Windows\System\DdfpXIl.exe
  2⤵
  PID:12464
- C:\Windows\System\ZHhhdik.exe
  C:\Windows\System\ZHhhdik.exe
  2⤵
  PID:12492
- C:\Windows\System\rbJMAEA.exe
  C:\Windows\System\rbJMAEA.exe
  2⤵
  PID:12516
- C:\Windows\System\cdermxy.exe
  C:\Windows\System\cdermxy.exe
  2⤵
  PID:12544
- C:\Windows\System\iJbZRlO.exe
  C:\Windows\System\iJbZRlO.exe
  2⤵
  PID:12576
- C:\Windows\System\aPWMBFS.exe
  C:\Windows\System\aPWMBFS.exe
  2⤵
  PID:12592
- C:\Windows\System\ogDOTzG.exe
  C:\Windows\System\ogDOTzG.exe
  2⤵
  PID:12620
- C:\Windows\System\YNnSsXm.exe
  C:\Windows\System\YNnSsXm.exe
  2⤵
  PID:12648
- C:\Windows\System\KZNJkyw.exe
  C:\Windows\System\KZNJkyw.exe
  2⤵
  PID:12688
- C:\Windows\System\vHURPhm.exe
  C:\Windows\System\vHURPhm.exe
  2⤵
  PID:12716
- C:\Windows\System\apLPfKK.exe
  C:\Windows\System\apLPfKK.exe
  2⤵
  PID:12736
- C:\Windows\System\tbKbCbJ.exe
  C:\Windows\System\tbKbCbJ.exe
  2⤵
  PID:12760
- C:\Windows\System\CIlFKmh.exe
  C:\Windows\System\CIlFKmh.exe
  2⤵
  PID:12800
- C:\Windows\System\xxSHEjS.exe
  C:\Windows\System\xxSHEjS.exe
  2⤵
  PID:12828
- C:\Windows\System\jbClHQK.exe
  C:\Windows\System\jbClHQK.exe
  2⤵
  PID:12844
- C:\Windows\System\KxRYKcH.exe
  C:\Windows\System\KxRYKcH.exe
  2⤵
  PID:12868
- C:\Windows\System\CrPeHHC.exe
  C:\Windows\System\CrPeHHC.exe
  2⤵
  PID:12892
- C:\Windows\System\vRYkUNK.exe
  C:\Windows\System\vRYkUNK.exe
  2⤵
  PID:12936
- C:\Windows\System\oGfCIAt.exe
  C:\Windows\System\oGfCIAt.exe
  2⤵
  PID:12968
- C:\Windows\System\UxesazD.exe
  C:\Windows\System\UxesazD.exe
  2⤵
  PID:12988
- C:\Windows\System\EhvrgMZ.exe
  C:\Windows\System\EhvrgMZ.exe
  2⤵
  PID:13012
- C:\Windows\System\jLSgHtY.exe
  C:\Windows\System\jLSgHtY.exe
  2⤵
  PID:13052
- C:\Windows\System\eJmEBfl.exe
  C:\Windows\System\eJmEBfl.exe
  2⤵
  PID:13080
- C:\Windows\System\OzdbjIY.exe
  C:\Windows\System\OzdbjIY.exe
  2⤵
  PID:13108
- C:\Windows\System\UzAwmbP.exe
  C:\Windows\System\UzAwmbP.exe
  2⤵
  PID:13136
- C:\Windows\System\ceXmbGi.exe
  C:\Windows\System\ceXmbGi.exe
  2⤵
  PID:13164
- C:\Windows\System\amcrAur.exe
  C:\Windows\System\amcrAur.exe
  2⤵
  PID:13192
- C:\Windows\System\irpJSZn.exe
  C:\Windows\System\irpJSZn.exe
  2⤵
  PID:13220
- C:\Windows\System\CSAVdjK.exe
  C:\Windows\System\CSAVdjK.exe
  2⤵
  PID:13248
- C:\Windows\System\YyPMgNL.exe
  C:\Windows\System\YyPMgNL.exe
  2⤵
  PID:13276
- C:\Windows\System\KYDRKqc.exe
  C:\Windows\System\KYDRKqc.exe
  2⤵
  PID:13304
- C:\Windows\System\gdVrOmH.exe
  C:\Windows\System\gdVrOmH.exe
  2⤵
  PID:11412
- C:\Windows\System\opDpbKZ.exe
  C:\Windows\System\opDpbKZ.exe
  2⤵
  PID:12344
- C:\Windows\System\DkYfJUP.exe
  C:\Windows\System\DkYfJUP.exe
  2⤵
  PID:12384
- C:\Windows\System\oMVUouY.exe
  C:\Windows\System\oMVUouY.exe
  2⤵
  PID:12484
- C:\Windows\System\pPgObpH.exe
  C:\Windows\System\pPgObpH.exe
  2⤵
  PID:12564
- C:\Windows\System\iVgjTzu.exe
  C:\Windows\System\iVgjTzu.exe
  2⤵
  PID:12608
- C:\Windows\System\mPGvqVo.exe
  C:\Windows\System\mPGvqVo.exe
  2⤵
  PID:12680
- C:\Windows\System\opAhHft.exe
  C:\Windows\System\opAhHft.exe
  2⤵
  PID:12784
- C:\Windows\System\VJQDsQR.exe
  C:\Windows\System\VJQDsQR.exe
  2⤵
  PID:12864
- C:\Windows\System\dOFxknK.exe
  C:\Windows\System\dOFxknK.exe
  2⤵
  PID:12980
- C:\Windows\System\WTOyaCG.exe
  C:\Windows\System\WTOyaCG.exe
  2⤵
  PID:13040
- C:\Windows\System\HlEGDoJ.exe
  C:\Windows\System\HlEGDoJ.exe
  2⤵
  PID:13072
- C:\Windows\System\aiyegvT.exe
  C:\Windows\System\aiyegvT.exe
  2⤵
  PID:13160
- C:\Windows\System\gdnbTHp.exe
  C:\Windows\System\gdnbTHp.exe
  2⤵
  PID:13204
- C:\Windows\System\PFbjmEl.exe
  C:\Windows\System\PFbjmEl.exe
  2⤵
  PID:13260
- C:\Windows\System\mVRgnJn.exe
  C:\Windows\System\mVRgnJn.exe
  2⤵
  PID:11700
- C:\Windows\System\mMTkAGv.exe
  C:\Windows\System\mMTkAGv.exe
  2⤵
  PID:12376
- C:\Windows\System\mnLTMsg.exe
  C:\Windows\System\mnLTMsg.exe
  2⤵
  PID:12456
- C:\Windows\System\TqDJqmr.exe
  C:\Windows\System\TqDJqmr.exe
  2⤵
  PID:12732
- C:\Windows\System\DQqjeFa.exe
  C:\Windows\System\DQqjeFa.exe
  2⤵
  PID:12824
- C:\Windows\System\UhRYEpq.exe
  C:\Windows\System\UhRYEpq.exe
  2⤵
  PID:12932
- C:\Windows\System\UNWQKUJ.exe
  C:\Windows\System\UNWQKUJ.exe
  2⤵
  PID:13212
- C:\Windows\System\DxsGRdx.exe
  C:\Windows\System\DxsGRdx.exe
  2⤵
  PID:12296
- C:\Windows\System\iDtXzWx.exe
  C:\Windows\System\iDtXzWx.exe
  2⤵
  PID:12704
- C:\Windows\System\rIcmviq.exe
  C:\Windows\System\rIcmviq.exe
  2⤵
  PID:12876
- C:\Windows\System\tWAyjfR.exe
  C:\Windows\System\tWAyjfR.exe
  2⤵
  PID:12308
- C:\Windows\System\LXtIiOg.exe
  C:\Windows\System\LXtIiOg.exe
  2⤵
  PID:12852
- C:\Windows\System\MnLfJPd.exe
  C:\Windows\System\MnLfJPd.exe
  2⤵
  PID:13340
- C:\Windows\System\kFxenLe.exe
  C:\Windows\System\kFxenLe.exe
  2⤵
  PID:13360
- C:\Windows\System\RWuxvzl.exe
  C:\Windows\System\RWuxvzl.exe
  2⤵
  PID:13412
- C:\Windows\System\kYfScZP.exe
  C:\Windows\System\kYfScZP.exe
  2⤵
  PID:13428
- C:\Windows\System\IjCWBJF.exe
  C:\Windows\System\IjCWBJF.exe
  2⤵
  PID:13452
- C:\Windows\System\JhBAqQL.exe
  C:\Windows\System\JhBAqQL.exe
  2⤵
  PID:13484
- C:\Windows\System\qdRfFpz.exe
  C:\Windows\System\qdRfFpz.exe
  2⤵
  PID:13524
- C:\Windows\System\wQbJTtk.exe
  C:\Windows\System\wQbJTtk.exe
  2⤵
  PID:13544
- C:\Windows\System\fvInVuf.exe
  C:\Windows\System\fvInVuf.exe
  2⤵
  PID:13576
- C:\Windows\System\QSZoXcK.exe
  C:\Windows\System\QSZoXcK.exe
  2⤵
  PID:13604
- C:\Windows\System\FwhHzQW.exe
  C:\Windows\System\FwhHzQW.exe
  2⤵
  PID:13624
- C:\Windows\System\mPwrGoz.exe
  C:\Windows\System\mPwrGoz.exe
  2⤵
  PID:13652
- C:\Windows\System\xizalHO.exe
  C:\Windows\System\xizalHO.exe
  2⤵
  PID:13672
- C:\Windows\System\AtuSKcc.exe
  C:\Windows\System\AtuSKcc.exe
  2⤵
  PID:13720
- C:\Windows\System\TWeDmjs.exe
  C:\Windows\System\TWeDmjs.exe
  2⤵
  PID:13736
- C:\Windows\System\qFnvwcE.exe
  C:\Windows\System\qFnvwcE.exe
  2⤵
  PID:13752
- C:\Windows\System\LcXIhdk.exe
  C:\Windows\System\LcXIhdk.exe
  2⤵
  PID:13776
- C:\Windows\System\pfLuyDQ.exe
  C:\Windows\System\pfLuyDQ.exe
  2⤵
  PID:13808
- C:\Windows\System\XcJxlQE.exe
  C:\Windows\System\XcJxlQE.exe
  2⤵
  PID:13836
- C:\Windows\System\bEVPLTZ.exe
  C:\Windows\System\bEVPLTZ.exe
  2⤵
  PID:13864
- C:\Windows\System\WJUxyPq.exe
  C:\Windows\System\WJUxyPq.exe
  2⤵
  PID:13904
- C:\Windows\System\lNibZLQ.exe
  C:\Windows\System\lNibZLQ.exe
  2⤵
  PID:13940
- C:\Windows\System\ldCDWro.exe
  C:\Windows\System\ldCDWro.exe
  2⤵
  PID:13960
- C:\Windows\System\vrBPFHg.exe
  C:\Windows\System\vrBPFHg.exe
  2⤵
  PID:13976
- C:\Windows\System\zMHkTII.exe
  C:\Windows\System\zMHkTII.exe
  2⤵
  PID:14008
- C:\Windows\System\GZdRHbx.exe
  C:\Windows\System\GZdRHbx.exe
  2⤵
  PID:14024
- C:\Windows\System\tLUpPeP.exe
  C:\Windows\System\tLUpPeP.exe
  2⤵
  PID:14056
- C:\Windows\System\GlSjHDN.exe
  C:\Windows\System\GlSjHDN.exe
  2⤵
  PID:14080
- C:\Windows\System\MMpyKNv.exe
  C:\Windows\System\MMpyKNv.exe
  2⤵
  PID:14140
- C:\Windows\System\VtWKWHi.exe
  C:\Windows\System\VtWKWHi.exe
  2⤵
  PID:14156
- C:\Windows\System\LBaRxVO.exe
  C:\Windows\System\LBaRxVO.exe
  2⤵
  PID:14172
- C:\Windows\System\OMUaXaJ.exe
  C:\Windows\System\OMUaXaJ.exe
  2⤵
  PID:14196
- C:\Windows\System\nACAFlN.exe
  C:\Windows\System\nACAFlN.exe
  2⤵
  PID:14248
- C:\Windows\System\mLXlLWG.exe
  C:\Windows\System\mLXlLWG.exe
  2⤵
  PID:14280
- C:\Windows\System\UrfDffM.exe
  C:\Windows\System\UrfDffM.exe
  2⤵
  PID:14308
- C:\Windows\System\dizSMbl.exe
  C:\Windows\System\dizSMbl.exe
  2⤵
  PID:14324
- C:\Windows\System\KBhlVEq.exe
  C:\Windows\System\KBhlVEq.exe
  2⤵
  PID:13332
- C:\Windows\System\bdoOhmF.exe
  C:\Windows\System\bdoOhmF.exe
  2⤵
  PID:13380
- C:\Windows\System\ovlYKae.exe
  C:\Windows\System\ovlYKae.exe
  2⤵
  PID:13440
- C:\Windows\System\qeybUeY.exe
  C:\Windows\System\qeybUeY.exe
  2⤵
  PID:13500
- C:\Windows\System\IOobjre.exe
  C:\Windows\System\IOobjre.exe
  2⤵
  PID:13568
- C:\Windows\System\DMlhiWG.exe
  C:\Windows\System\DMlhiWG.exe
  2⤵
  PID:13640
- C:\Windows\System\fQPDYWR.exe
  C:\Windows\System\fQPDYWR.exe
  2⤵
  PID:13700
- C:\Windows\System\PCdTyoS.exe
  C:\Windows\System\PCdTyoS.exe
  2⤵
  PID:13744
- C:\Windows\System\mncchBH.exe
  C:\Windows\System\mncchBH.exe
  2⤵
  PID:13832
- C:\Windows\System\uzBXoEh.exe
  C:\Windows\System\uzBXoEh.exe
  2⤵
  PID:13932
- C:\Windows\System\YstmldR.exe
  C:\Windows\System\YstmldR.exe
  2⤵
  PID:13968
- C:\Windows\System\eoSiVto.exe
  C:\Windows\System\eoSiVto.exe
  2⤵
  PID:14048
- C:\Windows\System\CBOdJRy.exe
  C:\Windows\System\CBOdJRy.exe
  2⤵
  PID:14108
- C:\Windows\System\ufLqZmj.exe
  C:\Windows\System\ufLqZmj.exe
  2⤵
  PID:14164
- C:\Windows\System\kyruHDK.exe
  C:\Windows\System\kyruHDK.exe
  2⤵
  PID:14236
- C:\Windows\System\jNJiRZM.exe
  C:\Windows\System\jNJiRZM.exe
  2⤵
  PID:14292
- C:\Windows\System\fHZiwYW.exe
  C:\Windows\System\fHZiwYW.exe
  2⤵
  PID:14316
- C:\Windows\System\XRXZvHk.exe
  C:\Windows\System\XRXZvHk.exe
  2⤵
  PID:13420
- C:\Windows\System\uLfqOfU.exe
  C:\Windows\System\uLfqOfU.exe
  2⤵
  PID:13600
- C:\Windows\System\WBQYgau.exe
  C:\Windows\System\WBQYgau.exe
  2⤵
  PID:13900
- C:\Windows\System\TfjJrEg.exe
  C:\Windows\System\TfjJrEg.exe
  2⤵
  PID:13948
- C:\Windows\System\vRiHzcY.exe
  C:\Windows\System\vRiHzcY.exe
  2⤵
  PID:14020
- C:\Windows\System\znZYLir.exe
  C:\Windows\System\znZYLir.exe
  2⤵
  PID:14264
- C:\Windows\System\UyNuKzU.exe
  C:\Windows\System\UyNuKzU.exe
  2⤵
  PID:12452
- C:\Windows\System\AAAtxTY.exe
  C:\Windows\System\AAAtxTY.exe
  2⤵
  PID:13764
- C:\Windows\System\sRiqoMi.exe
  C:\Windows\System\sRiqoMi.exe
  2⤵
  PID:14192
- C:\Windows\System\nRpRuLA.exe
  C:\Windows\System\nRpRuLA.exe
  2⤵
  PID:13376
- C:\Windows\System\ndwuMKe.exe
  C:\Windows\System\ndwuMKe.exe
  2⤵
  PID:14276
- C:\Windows\System\UVsTloM.exe
  C:\Windows\System\UVsTloM.exe
  2⤵
  PID:14356
- C:\Windows\System\fhnPKqG.exe
  C:\Windows\System\fhnPKqG.exe
  2⤵
  PID:14380
- C:\Windows\System\KhRrVJf.exe
  C:\Windows\System\KhRrVJf.exe
  2⤵
  PID:14408
- C:\Windows\System\DkWEYlx.exe
  C:\Windows\System\DkWEYlx.exe
  2⤵
  PID:14436
- C:\Windows\System\nnihuTL.exe
  C:\Windows\System\nnihuTL.exe
  2⤵
  PID:14468
- C:\Windows\System\zGPmDwF.exe
  C:\Windows\System\zGPmDwF.exe
  2⤵
  PID:14496
- C:\Windows\System\DVYrewt.exe
  C:\Windows\System\DVYrewt.exe
  2⤵
  PID:14516
- C:\Windows\System\iPltqaP.exe
  C:\Windows\System\iPltqaP.exe
  2⤵
  PID:14572
- C:\Windows\System\XfhbuOb.exe
  C:\Windows\System\XfhbuOb.exe
  2⤵
  PID:14600
- C:\Windows\System\HfkRshn.exe
  C:\Windows\System\HfkRshn.exe
  2⤵
  PID:14616
- C:\Windows\System\MrjoroY.exe
  C:\Windows\System\MrjoroY.exe
  2⤵
  PID:14648
- C:\Windows\System\EsAkQPH.exe
  C:\Windows\System\EsAkQPH.exe
  2⤵
  PID:14668
- C:\Windows\System\aWXloUc.exe
  C:\Windows\System\aWXloUc.exe
  2⤵
  PID:14704
- C:\Windows\System\aGIvqvy.exe
  C:\Windows\System\aGIvqvy.exe
  2⤵
  PID:14728
- C:\Windows\System\IMmnDub.exe
  C:\Windows\System\IMmnDub.exe
  2⤵
  PID:14764
- C:\Windows\System\vdRJCQx.exe
  C:\Windows\System\vdRJCQx.exe
  2⤵
  PID:14796
- C:\Windows\System\FUQibQp.exe
  C:\Windows\System\FUQibQp.exe
  2⤵
  PID:14812
- C:\Windows\System\VZHeIsd.exe
  C:\Windows\System\VZHeIsd.exe
  2⤵
  PID:14828
- C:\Windows\System\nrxvZqC.exe
  C:\Windows\System\nrxvZqC.exe
  2⤵
  PID:14872
- C:\Windows\System\vXyEJCU.exe
  C:\Windows\System\vXyEJCU.exe
  2⤵
  PID:14908
- C:\Windows\System\MiamWTb.exe
  C:\Windows\System\MiamWTb.exe
  2⤵
  PID:14924
- C:\Windows\System\lbBzLNt.exe
  C:\Windows\System\lbBzLNt.exe
  2⤵
  PID:14944
- C:\Windows\System\pTbHFdH.exe
  C:\Windows\System\pTbHFdH.exe
  2⤵
  PID:14968
- C:\Windows\System\mUlDglQ.exe
  C:\Windows\System\mUlDglQ.exe
  2⤵
  PID:15012
- C:\Windows\System\jSizmnQ.exe
  C:\Windows\System\jSizmnQ.exe
  2⤵
  PID:15036
- C:\Windows\System\DMUZZWe.exe
  C:\Windows\System\DMUZZWe.exe
  2⤵
  PID:15072
- C:\Windows\System\aMqaPwQ.exe
  C:\Windows\System\aMqaPwQ.exe
  2⤵
  PID:15096
- C:\Windows\System\ThQfugt.exe
  C:\Windows\System\ThQfugt.exe
  2⤵
  PID:15132
- C:\Windows\System\OGHwxIX.exe
  C:\Windows\System\OGHwxIX.exe
  2⤵
  PID:15160
- C:\Windows\System\islmJBg.exe
  C:\Windows\System\islmJBg.exe
  2⤵
  PID:15176
- C:\Windows\System\PkXPzRh.exe
  C:\Windows\System\PkXPzRh.exe
  2⤵
  PID:15192
- C:\Windows\System\AtgKXLD.exe
  C:\Windows\System\AtgKXLD.exe
  2⤵
  PID:15216
- C:\Windows\System\KfSXNvQ.exe
  C:\Windows\System\KfSXNvQ.exe
  2⤵
  PID:15244
- C:\Windows\System\kFpOiba.exe
  C:\Windows\System\kFpOiba.exe
  2⤵
  PID:15276
- C:\Windows\System\NEitagX.exe
  C:\Windows\System\NEitagX.exe
  2⤵
  PID:15304
- C:\Windows\System\abZWvnn.exe
  C:\Windows\System\abZWvnn.exe
  2⤵
  PID:15340
- C:\Windows\System\qZbtFDT.exe
  C:\Windows\System\qZbtFDT.exe
  2⤵
  PID:13512
- C:\Windows\System\ASiHGfH.exe
  C:\Windows\System\ASiHGfH.exe
  2⤵
  PID:14368
- C:\Windows\System\GOSppBW.exe
  C:\Windows\System\GOSppBW.exe
  2⤵
  PID:14464
- C:\Windows\System\nzEzkIg.exe
  C:\Windows\System\nzEzkIg.exe
  2⤵
  PID:14536
- C:\Windows\System\JUmYOXL.exe
  C:\Windows\System\JUmYOXL.exe
  2⤵
  PID:14592
- C:\Windows\System\HDGrKSH.exe
  C:\Windows\System\HDGrKSH.exe
  2⤵
  PID:14700
- C:\Windows\System\gVXuLKj.exe
  C:\Windows\System\gVXuLKj.exe
  2⤵
  PID:14740
- C:\Windows\System\BtGlENh.exe
  C:\Windows\System\BtGlENh.exe
  2⤵
  PID:14840
- C:\Windows\System\qpMrZwy.exe
  C:\Windows\System\qpMrZwy.exe
  2⤵
  PID:14864
- C:\Windows\System\QynVWzW.exe
  C:\Windows\System\QynVWzW.exe
  2⤵
  PID:14936
- C:\Windows\System\gGEkiNZ.exe
  C:\Windows\System\gGEkiNZ.exe
  2⤵
  PID:14960
- C:\Windows\System\lQvmJhM.exe
  C:\Windows\System\lQvmJhM.exe
  2⤵
  PID:15064
- C:\Windows\System\jBrbKNg.exe
  C:\Windows\System\jBrbKNg.exe
  2⤵
  PID:15148
- C:\Windows\System\iiUtvxd.exe
  C:\Windows\System\iiUtvxd.exe
  2⤵
  PID:15204
- C:\Windows\System\bujpwMZ.exe
  C:\Windows\System\bujpwMZ.exe
  2⤵
  PID:15236
- C:\Windows\System\toJqnJb.exe
  C:\Windows\System\toJqnJb.exe
  2⤵
  PID:15328
- C:\Windows\System\STZoSwn.exe
  C:\Windows\System\STZoSwn.exe
  2⤵
  PID:14456
- C:\Windows\System\qbZlxLl.exe
  C:\Windows\System\qbZlxLl.exe
  2⤵
  PID:14452
- C:\Windows\System\uYteCAd.exe
  C:\Windows\System\uYteCAd.exe
  2⤵
  PID:14332
- C:\Windows\System\JbBTSCD.exe
  C:\Windows\System\JbBTSCD.exe
  2⤵
  PID:14856
- C:\Windows\System\rITxDCu.exe
  C:\Windows\System\rITxDCu.exe
  2⤵
  PID:14952
- C:\Windows\System\NjvlIYf.exe
  C:\Windows\System\NjvlIYf.exe
  2⤵
  PID:15184
- C:\Windows\System\VrZDaNL.exe
  C:\Windows\System\VrZDaNL.exe
  2⤵
  PID:14348
- C:\Windows\System\NQUXCHG.exe
  C:\Windows\System\NQUXCHG.exe
  2⤵
  PID:14508
- C:\Windows\System\ZLrvkMt.exe
  C:\Windows\System\ZLrvkMt.exe
  2⤵
  PID:14940
- C:\Windows\System\hSybgVy.exe
  C:\Windows\System\hSybgVy.exe
  2⤵
  PID:15260
- C:\Windows\System\tcImXkT.exe
  C:\Windows\System\tcImXkT.exe
  2⤵
  PID:14560
- C:\Windows\System\upWfDfu.exe
  C:\Windows\System\upWfDfu.exe
  2⤵
  PID:15120
- C:\Windows\System\RILINXO.exe
  C:\Windows\System\RILINXO.exe
  2⤵
  PID:15384
- C:\Windows\System\RgdrFpX.exe
  C:\Windows\System\RgdrFpX.exe
  2⤵
  PID:15440
- C:\Windows\System\PPwANoz.exe
  C:\Windows\System\PPwANoz.exe
  2⤵
  PID:15456
- C:\Windows\System\TFbeOeb.exe
  C:\Windows\System\TFbeOeb.exe
  2⤵
  PID:15476
- C:\Windows\System\UuCrNSO.exe
  C:\Windows\System\UuCrNSO.exe
  2⤵
  PID:15512
- C:\Windows\System\muMBwPj.exe
  C:\Windows\System\muMBwPj.exe
  2⤵
  PID:15540
- C:\Windows\System\FeKMKiY.exe
  C:\Windows\System\FeKMKiY.exe
  2⤵
  PID:15560
- C:\Windows\System\zVjpiPY.exe
  C:\Windows\System\zVjpiPY.exe
  2⤵
  PID:15584
- C:\Windows\System\pPEASlD.exe
  C:\Windows\System\pPEASlD.exe
  2⤵
  PID:15604
- C:\Windows\System\BxPVvak.exe
  C:\Windows\System\BxPVvak.exe
  2⤵
  PID:15636
- C:\Windows\System\mIACMUg.exe
  C:\Windows\System\mIACMUg.exe
  2⤵
  PID:15692
- C:\Windows\System\SOrSQXE.exe
  C:\Windows\System\SOrSQXE.exe
  2⤵
  PID:15708
- C:\Windows\System\alXEUhR.exe
  C:\Windows\System\alXEUhR.exe
  2⤵
  PID:15736
- C:\Windows\System\IPrVmAc.exe
  C:\Windows\System\IPrVmAc.exe
  2⤵
  PID:15764
- C:\Windows\System\jycdHPv.exe
  C:\Windows\System\jycdHPv.exe
  2⤵
  PID:15792
- C:\Windows\System\kgwOVIo.exe
  C:\Windows\System\kgwOVIo.exe
  2⤵
  PID:15816
- C:\Windows\System\wcvWvpv.exe
  C:\Windows\System\wcvWvpv.exe
  2⤵
  PID:15836
- C:\Windows\System\saUtSNo.exe
  C:\Windows\System\saUtSNo.exe
  2⤵
  PID:15860
- C:\Windows\System\mopKqFa.exe
  C:\Windows\System\mopKqFa.exe
  2⤵
  PID:15880
- C:\Windows\System\TreUizH.exe
  C:\Windows\System\TreUizH.exe
  2⤵
  PID:15900
- C:\Windows\System\daIWKDQ.exe
  C:\Windows\System\daIWKDQ.exe
  2⤵
  PID:15920
- C:\Windows\System\ydSxJWq.exe
  C:\Windows\System\ydSxJWq.exe
  2⤵
  PID:15948
- C:\Windows\System\mCLLPhh.exe
  C:\Windows\System\mCLLPhh.exe
  2⤵
  PID:15976
- C:\Windows\System\fgyprAf.exe
  C:\Windows\System\fgyprAf.exe
  2⤵
  PID:16028
- C:\Windows\System\wJmQrFk.exe
  C:\Windows\System\wJmQrFk.exe
  2⤵
  PID:16072
- C:\Windows\System\PFjZUaA.exe
  C:\Windows\System\PFjZUaA.exe
  2⤵
  PID:16096
- C:\Windows\System\dMorQkL.exe
  C:\Windows\System\dMorQkL.exe
  2⤵
  PID:16128
- C:\Windows\System\NMwJcgy.exe
  C:\Windows\System\NMwJcgy.exe
  2⤵
  PID:16348
- C:\Windows\System\aPOmEfN.exe
  C:\Windows\System\aPOmEfN.exe
  2⤵
  PID:16364
- C:\Windows\System\knKUWBS.exe
  C:\Windows\System\knKUWBS.exe
  2⤵
  PID:16380
- C:\Windows\System\UIxbsgr.exe
  C:\Windows\System\UIxbsgr.exe
  2⤵
  PID:15424
- C:\Windows\System\UtlCcsS.exe
  C:\Windows\System\UtlCcsS.exe
  2⤵
  PID:15492
- C:\Windows\System\Oywbxob.exe
  C:\Windows\System\Oywbxob.exe
  2⤵
  PID:15528
- C:\Windows\System\GhDpKcZ.exe
  C:\Windows\System\GhDpKcZ.exe
  2⤵
  PID:15596
- C:\Windows\System\ITJWfJQ.exe
  C:\Windows\System\ITJWfJQ.exe
  2⤵
  PID:15748
- C:\Windows\System\VoBsxGV.exe
  C:\Windows\System\VoBsxGV.exe
  2⤵
  PID:15780
- C:\Windows\System\RLKRSuJ.exe
  C:\Windows\System\RLKRSuJ.exe
  2⤵
  PID:15896
- C:\Windows\System\dnaJOUt.exe
  C:\Windows\System\dnaJOUt.exe
  2⤵
  PID:15912
- C:\Windows\System\QhFbuKb.exe
  C:\Windows\System\QhFbuKb.exe
  2⤵
  PID:15940
- C:\Windows\System\AiebEYa.exe
  C:\Windows\System\AiebEYa.exe
  2⤵
  PID:16060
- C:\Windows\System\ALSHPpx.exe
  C:\Windows\System\ALSHPpx.exe
  2⤵
  PID:16116
- C:\Windows\System\rJDtvkW.exe
  C:\Windows\System\rJDtvkW.exe
  2⤵
  PID:16152
- C:\Windows\System\zCfuKiW.exe
  C:\Windows\System\zCfuKiW.exe
  2⤵
  PID:16172
- C:\Windows\System\IlOMqlM.exe
  C:\Windows\System\IlOMqlM.exe
  2⤵
  PID:16192
- C:\Windows\System\lFwymMk.exe
  C:\Windows\System\lFwymMk.exe
  2⤵
  PID:16228
- C:\Windows\System\HeQQzkm.exe
  C:\Windows\System\HeQQzkm.exe
  2⤵
  PID:16248
- C:\Windows\System\NwNMKAR.exe
  C:\Windows\System\NwNMKAR.exe
  2⤵
  PID:16276
- C:\Windows\System\kmQtDKi.exe
  C:\Windows\System\kmQtDKi.exe
  2⤵
  PID:16320
- C:\Windows\System\ppBVWPa.exe
  C:\Windows\System\ppBVWPa.exe
  2⤵
  PID:16112
- C:\Windows\System\QUpUWFB.exe
  C:\Windows\System\QUpUWFB.exe
  2⤵
  PID:15556
- C:\Windows\System\CZXrppx.exe
  C:\Windows\System\CZXrppx.exe
  2⤵
  PID:15572
- C:\Windows\System\IFgBEky.exe
  C:\Windows\System\IFgBEky.exe
  2⤵
  PID:15676
- C:\Windows\System\dqKWKAa.exe
  C:\Windows\System\dqKWKAa.exe
  2⤵
  PID:15812
- C:\Windows\System\utVtGdm.exe
  C:\Windows\System\utVtGdm.exe
  2⤵
  PID:16140
- C:\Windows\System\YeNblEB.exe
  C:\Windows\System\YeNblEB.exe
  2⤵
  PID:16160
- C:\Windows\System\WEelKEX.exe
  C:\Windows\System\WEelKEX.exe
  2⤵
  PID:16264
- C:\Windows\System\FlQjufE.exe
  C:\Windows\System\FlQjufE.exe
  2⤵
  PID:16312
- C:\Windows\System\XoIXpNd.exe
  C:\Windows\System\XoIXpNd.exe
  2⤵
  PID:16360
- C:\Windows\System\KSJmFpV.exe
  C:\Windows\System\KSJmFpV.exe
  2⤵
  PID:15632
- C:\Windows\System\PCUtuet.exe
  C:\Windows\System\PCUtuet.exe
  2⤵
  PID:16016
- C:\Windows\System\dxqAQuo.exe
  C:\Windows\System\dxqAQuo.exe
  2⤵
  PID:16240
- C:\Windows\System\kUIZsxP.exe
  C:\Windows\System\kUIZsxP.exe
  2⤵
  PID:15856
- C:\Windows\System\BXxhoRG.exe
  C:\Windows\System\BXxhoRG.exe
  2⤵
  PID:16412
- C:\Windows\System\BktZfBZ.exe
  C:\Windows\System\BktZfBZ.exe
  2⤵
  PID:16428
- C:\Windows\System\rgAnYJt.exe
  C:\Windows\System\rgAnYJt.exe
  2⤵
  PID:16480
- C:\Windows\System\ryryONH.exe
  C:\Windows\System\ryryONH.exe
  2⤵
  PID:16496
- C:\Windows\System\qofeCLa.exe
  C:\Windows\System\qofeCLa.exe
  2⤵
  PID:16520
- C:\Windows\System\FbarwrV.exe
  C:\Windows\System\FbarwrV.exe
  2⤵
  PID:16552
- C:\Windows\System\YzuYgCQ.exe
  C:\Windows\System\YzuYgCQ.exe
  2⤵
  PID:16572
- C:\Windows\System\yMHmsJZ.exe
  C:\Windows\System\yMHmsJZ.exe
  2⤵
  PID:16600
- C:\Windows\System\kDOHmqD.exe
  C:\Windows\System\kDOHmqD.exe
  2⤵
  PID:16632
- C:\Windows\System\XahYHMD.exe
  C:\Windows\System\XahYHMD.exe
  2⤵
  PID:16660
- C:\Windows\System\tYBfBWr.exe
  C:\Windows\System\tYBfBWr.exe
  2⤵
  PID:16700
- - C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -u -p 16700 -s 248
    3⤵
    PID:17016

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:17064

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\AbzzfdF.exe

Filesize
1.3MB

MD5
1376b5d6c9bb4f45762f825539f926bf

SHA1
b96b29184f5be0e15abce47d7f0d358f7f149b9f

SHA256
1137837c618763c73bee4f7c0bf37fa3de28bfd414088ff737e9d920a4b324d1

SHA512
16cc385444a02e46b74b15d1e8a3c95c7af9e4e3e4dcfe0d85baa293ab2dcc84a1042877748873ab6186673b1c7e987a3ff749e150c8905450156ba3d300cfe8

Download Submit
C:\Windows\System\CJOKzTT.exe

Filesize
1.3MB

MD5
e75c582d01407f4c7e3ab4924cffa0c6

SHA1
0ee8d6244119e8ba4e00fb898ec4237ec529ac81

SHA256
c3742e3406db375908fc18322e246dee82640174ec5579654f189f65c19a2433

SHA512
a41409fc699fe1335123dad9db340fd77a0af76fb23a640d60a4bd4b2401b7f858481eb6b22b43f7bd20d020ece21a3442d7fbbc2bffbff58e1353494228ac43

Download Submit
C:\Windows\System\DKyuokC.exe

Filesize
1.3MB

MD5
cbedbc5a5312680d722bda4162b966e0

SHA1
0f332aff9d48b299c29d99810b4e1e9314105d02

SHA256
ccd3e19870ddf5bf9a4f5af8de61de226ce3c0dd3069a72ff1d1fd242b3b64a1

SHA512
bd01e1194e6f31fc06bc5966d2fc68c0c13defe06b1d3c76f72b2d5adb425f76bb1bc12bdd22b499001f897fd8c4e8acfedf91837ac0706b8c5dcefab5a51eb3

Download Submit
C:\Windows\System\DOwYWDK.exe

Filesize
1.3MB

MD5
dfda8d36037f61f244c033e7ccea68b2

SHA1
bb1242206ffd140b056619332b98b0ee95cd8a0e

SHA256
6b955610cccc5b00ed7b1a2e7f4a696432b6cf792d5d22e4909f8ad42d61bd54

SHA512
1676d1bdce3b19035586018586ab4bc7f7fea3153c9d4234a1fb0ff1d3f16ff25b779d2dcd078167006dd50fa7b4cb91f15e90af6ac4e25bf6f426e61d998750

Download Submit
C:\Windows\System\EZGVwpP.exe

Filesize
1.3MB

MD5
2f3aebbe5f9e05ee76f995d84e535035

SHA1
6820ddb15164d74ccb4fb0c3496f8e3a500a8884

SHA256
46df80662a6b22146e26016c5cefc5fc4a84e36f74578a8fce632f8b3a5dc1e8

SHA512
d81cfce844095b66ac6020a4900cd5656ff499183063e41ce2fc1447ca206af59a24bdbb5a30bf55b5bf29f8a53de48ab020048537fad68de17fecdd3549bf42

Download Submit
C:\Windows\System\IQNAqrl.exe

Filesize
1.3MB

MD5
8fa890257e7d46ed3c7f0c68dc424a99

SHA1
05efc676220582130b515da8fde12f9c2d437bad

SHA256
10ed093c3e4a23511f2297eda534d798cfdb750b1461bd3b74104e2d913d0eb2

SHA512
d6d76bcf8283451ef3b40f92161a5328861683363309bd66a72957707d27cfeb7d63c3f76557c299f4eefe40315a827c972f0afb1ae11ff3dcf0746ff153d12a

Download Submit
C:\Windows\System\JXHTHUn.exe

Filesize
1.3MB

MD5
eb734e1a5fe30ebc59a4725c729f7291

SHA1
9f3568af2639bc6dd155af90f7d538c34aff793c

SHA256
6a314145b541b27500f19f2efd7c31d6664aba630e324f43b4f58626ab5dbbb8

SHA512
b22a44c44a946a1448889d686daa46b7ccf89cb2677e93c0ab57dc50cc9e7888507bb9045bc224de47601afe52593f8115da7f7c17169d16e7d334a6a76fdbb0

Download Submit
C:\Windows\System\KZNMkPI.exe

Filesize
1.3MB

MD5
474b7d3b55ae1bffd4aae1f5139b5680

SHA1
ff50e95c192deb37ad93c0d2b3f9b2bd539b0e4d

SHA256
03d8f2e107f7bb1de950c6d457a47f586cfbd1bcffc1a359a57cdf62e8f31139

SHA512
2f7c391bad557d1cc54ecb27b7c5ef0e6b347bb262bbeee6a0289e9f9f309ef2167f30fe094cbb8747304a328770e846c1e16120a68fa9f6a8adaefa87359071

Download Submit
C:\Windows\System\MHYRGXL.exe

Filesize
1.3MB

MD5
e8778d3a59c66224941b6463c6c628c8

SHA1
3ef9bfb9c29c02af1d17589e6a0d99dea00d9090

SHA256
e0acb6f146733598a7cb7d4211a5da5afa7b9ea0ddaece8890839accf3e99f61

SHA512
31dfe912f93fa4c882262fa25c4f5ab344dc8fa805079764956c3fdfc1229e3f310aaab134e8f8adeec945b605b9f4846b7107f2de061b15c9712474e733acf4

Download Submit
C:\Windows\System\NJSftbX.exe

Filesize
1.3MB

MD5
cf34e4df582f65ed9cb242ed445c42e0

SHA1
af1ecd17edaef58a87c3c22366eb40f57a0315c3

SHA256
d39e7ddda010eb9ac650addbfb8628bb426b5e5e8f788dcd0e783b61d55398f6

SHA512
3a8bec84e443dac5d9f180daa27ddb002f4e99daf9f634dea9e6e48cd521ce398f3f358d56aad1c8a06223375a56ee34678aab5c2c4d2271802de17363b7616e

Download Submit
C:\Windows\System\OXDIwtH.exe

Filesize
1.3MB

MD5
7caebc801a87a7bcc431937832c78aec

SHA1
a739cd0db349b026f26a43b5e53bc1c00781d9ee

SHA256
57473d70cb0f4d3076fcc7f88aa0fc7b5ae5ea525d109940ed2e3ab424af0000

SHA512
e67433676011f5c79836029377cfac63f5db954ba335828211d0e9768d648d60190a9d0732d6241d6394a93a365e029e6999621ba53ed237845c026e6de1e6b7

Download Submit
C:\Windows\System\QEhkEHW.exe

Filesize
1.3MB

MD5
37f60b3653018147b5d7005df413186f

SHA1
364f6912f2b986190cc2decf518004945ee0a6fa

SHA256
636b3a01e9eeb9a423f0a0f088c8f6e00c96c32388059424604b43f8f84c992c

SHA512
fc84fe6c4874195f8461aa663d687f311b2bafdc4ad5e179091496f52d7413503d6edb1dd4e0f5a7808d32469b534fb1712a7163d47046829455e51da4bdc566

Download Submit
C:\Windows\System\RBaHJIV.exe

Filesize
1.3MB

MD5
7d8b17b9f14f6ce0fa99ab78bcaf2702

SHA1
661a93a346baaacd0d8ec7db820129f9138aae92

SHA256
4bd9b06f54b9c649db95c2d66142c2530e3a305e632cba6c5c529cc89d8bf8f4

SHA512
6220c655a76f7e6a4d28e782971cb294a60358f6d8942970f6410ea810dde485aaccdf8f24df15f6bda1f1b6c25b00fb7086c68d97fa0edb0890be15b4744e02

Download Submit
C:\Windows\System\WcsPYwe.exe

Filesize
1.3MB

MD5
8175a2b4a533e08807f74ecba5c634d9

SHA1
8580694d710168063498e2ae625a9eaf1b291a62

SHA256
d297e138d239e55bfbaa27b35a2383ee1692fdedfb4bdcca96c544c8fa7a7ac0

SHA512
73ee5283cb8be8a9e4ec5c079d24b80478d431dadf0c7413384d5b818d0f676d55acbdc192195c011eda43070a6c37867753ca0d9d32816d57419a42ab97a711

Download Submit
C:\Windows\System\YQkHtKt.exe

Filesize
1.3MB

MD5
34f36a165990bda018ea550f75aaa8fa

SHA1
9d83545fe624359c7771cf37cb3fe7eba05d9597

SHA256
a6ed29709b4407502443d9f979ec4cf4e2c7b724be52002fdc3e68c41307c559

SHA512
2704ef3404d81e1cb4b9b79a1c51959251812dff00b006c979fea23b3ca42af61c01bfc2223c1ffd6c6d4192cd70e71b447dc705a988fd65f968e3394fa7cc99

Download Submit
C:\Windows\System\YhOYZQU.exe

Filesize
1.3MB

MD5
848450f2234f64375d966edab4069dff

SHA1
ddba4a8e885a0d8a8808f995369cc6f706b3bf12

SHA256
dbdd64bc9245ef29a7059c2633018092d6c140d6cec0373840a4dc57f1de9f57

SHA512
11c6facad32041c8632383f3cd868469ad3bb675208dda6cb520adbd485986939c48a2535eebeebbd7163f94d1e197b1d819b2ed0702456c6d27b5e869e9e8f0

Download Submit
C:\Windows\System\dTsBfJN.exe

Filesize
1.3MB

MD5
b1414900beffb511196014fc4ef7a4e3

SHA1
28d45dbe91e1ac09a9ae7b2c90af6e35f69a38b3

SHA256
63961f22e5b80be86d88ba81f402fa0c1bcdf260de1e48c4dd4e7e0d9a697bd8

SHA512
38113e72a9e40bba1ba081b6ec68422cba45ee0b8cdf5f37fae6ee34d55bd3ec3b91bb648b82e2ba56d4607d2b1d5adb23f9339818dda13f3f7a1cadeb535c71

Download Submit
C:\Windows\System\dXQUAkr.exe

Filesize
1.3MB

MD5
bf5ebce051acc4f40bc71da7369fbfba

SHA1
1799ee84934f7cb364d7c7367eeb7cb5bdfefb1e

SHA256
fffd197a48b4e71bbe7081a3008703950d5c52fc039ead2cf171ec0defbb7aba

SHA512
c577b99fe49ba0492a7b87c4a9841a3df441d1cff22d7220aabab5900d5ad95fdf02544af6fc3cce4c10b607a534f493aa6d9be9570df4c0e5dbbc52169aed1e

Download Submit
C:\Windows\System\gqECbaq.exe

Filesize
1.3MB

MD5
bde14b7482dcbaf8f4f6b69cf7a2b022

SHA1
76a259efaeaccd2010697353798d8275a881df10

SHA256
5006e92c836ef5f22e3d3efe96129910f177b6e370ffdcc68ca32a3b407b5c98

SHA512
c6011b910d118220bfd4cf891f7d07ac9ac34236c1c3a2552a4200247ef2c94768e25f53f930f2b8b71848e282000c8111bac398f3801884d4f38f87b7d7a04b

Download Submit
C:\Windows\System\kyqVVOe.exe

Filesize
1.3MB

MD5
5f2d32a0b0d035ee7a6626721ca307f6

SHA1
07ffa8d6d92d133c184b2262d2b0111adc12ce40

SHA256
7847875038ec8ce724c88f606b4c3383f271e255a000ffc8e36c03ed5979ce74

SHA512
8232637f5915749ebb51a48912a550c0002f114e17c0569eccae9f94eadce402758a7de28ad89196853a8517f26bf4e02cca526f70abb3220630431cb8e7a771

Download Submit
C:\Windows\System\lALJlcL.exe

Filesize
1.3MB

MD5
128c638768098bf2a09b004cc2a2590a

SHA1
f360b6b0fb6aa06a8d517f791ec6a68aff8cd532

SHA256
c457f516408e3457394923952887d7aa727c1407dec094e77e2ec781fae56c6f

SHA512
643b7458dced9b8448b62d552556f50f0034242a998fe86f3d115d0354377f03a8d2590eb2e5ab0b25545d49a0a541f6d2900d84e02388424cbfb9cf1d782c1c

Download Submit
C:\Windows\System\mPIwcej.exe

Filesize
1.3MB

MD5
9e977d599e1d3258311d15235f5bc1f1

SHA1
4481e62e0073ac2251bd00ce8ab9572ed66dc988

SHA256
4623e1ad301ad60b52fb7771d9faa65baf418173c9ce2437232dfe03aeeb323e

SHA512
0bfcd85601635dbe4ae600e9d44aad3cc833137a240f7da458cb883af3318f3692208308ca3b0e58584f244de11837aefdec623bc66dea3caa21363d1eec8d14

Download Submit
C:\Windows\System\mTCiCer.exe

Filesize
1.3MB

MD5
91b82c413e04c62841e60bf5da7d69c9

SHA1
0180d5a65ebdb1c25fa217cb50015b2cc6809b63

SHA256
2560a8c1bd878c5937d23b369041794919a253ab9e1bfd222509dd71faa2c838

SHA512
b2703daee5307ae3fcafe9fd75f9e172f23a61bf4776e7ca0c55267039fc9a766c05f69293ba916a4a155de8ad4a50a19a07e5060890736738ba00382200ab88

Download Submit
C:\Windows\System\mgwbJxN.exe

Filesize
1.3MB

MD5
45dd06eccff23facbef1cfe4f36483d2

SHA1
28a4393970ed873484b75fe27afe119cebdd1dd9

SHA256
b790ddf4c992b4e1062dd815abf15be7af3e54a7f14baa0abe6cd2120eaf33f9

SHA512
6cf3632ffb24ba84528c74639838d95ff62e237cf871867a452f156eabc5d21303aa28349e41ee9391173b62980b3eae5a9123e02643eb76721d8d530902f54d

Download Submit
C:\Windows\System\nrVoSdy.exe

Filesize
1.3MB

MD5
2d62098221bba4d07b28dd09bfa495b3

SHA1
c07cdbcce7b1d08e81a01be5bc7570f266cc8322

SHA256
ade6ec4667e301bc3bd70d4f414788df632827b3fb4c6115be2f414772fd30f2

SHA512
28079fd43d98f7ea074a05ea5eb2e62037c1fc3266b99e7c5b9e3f17272e1c7b08ccf19ba23298899c79a02271b2a934601383bf8542164b34cd3e45a2efab9b

Download Submit
C:\Windows\System\octfYvl.exe

Filesize
1.3MB

MD5
cd8dab2cea52df04e278f90941fad8ad

SHA1
24414aad07d1d576f46539ef3dd91ff5544a72b8

SHA256
9c8148306123258a27852f2b59e9f8b8363da1913997d4c7ab91e5098edd0508

SHA512
4ac3f4efc346bed818b9329174ac081a3fabab9b59465637bf9a9490036da7f523443df4cf8aa762a5dc03c5bc6c4aef728f2032566f9f1a33950d44203b4394

Download Submit
C:\Windows\System\riqKnOU.exe

Filesize
1.3MB

MD5
247dcdb01684eef20188c2ed40815b6c

SHA1
4d6ab9799064ef89b08fc372691239ce7b9d0524

SHA256
384ba472fb5058752558646c2e3d037ad289be76b9cbffb6b89989da1eb5733a

SHA512
778edf08595b4566ed2c7e344b45320dc62ee7baf50370a026db84e4d7979ca56176e3dc557c367dcea5e71188bfa37eac3723ea622e95edb89dddf9a18297e9

Download Submit
C:\Windows\System\sShVnNZ.exe

Filesize
1.3MB

MD5
3725b4c32dbce8c235f0385319819960

SHA1
2a0b71fd885fac6d06b0756ecac2ab1b702abcf9

SHA256
f06beb85e19004dc13c8eaf11cf3230fa97af63a6d1ff9364d7d50565cfc0ca1

SHA512
3a2bc5414f8065c39fc1b10b58bbbcb2f4a72542cbe459f4e6f86fcf4753eeee412ca53ff88aa0c6424d95c862efc29481d90bc68c5abf8d3f3e6ae4153c5314

Download Submit
C:\Windows\System\tWXyCbx.exe

Filesize
1.3MB

MD5
f65804e7e30d232208c596ff7758e566

SHA1
f92ae5872e49dfefd25692132cc32b73fdcbc93b

SHA256
2325f22457c4a10f84ed956ee9a7ebb805b1fd666a85601138d9f4e0212aa0d3

SHA512
c673dfe1cf39446fdd57a256c3c9a613c2b54f59ba7429ffc491da9bc6faef2a5c5aab4f319fd7b290de3543ba839cdf9fb90f601c806f9d6f2624548aa312d1

Download Submit
C:\Windows\System\tvBaOrD.exe

Filesize
1.3MB

MD5
daeaffaaff8f1be4530c3fe50c6c5685

SHA1
cbc88c6f3b4375ea52a71384d35018e404bc4760

SHA256
0d56223a3842f29ed5b9e421d68753883dfeedce282e176ad0fb1febd946cf23

SHA512
b3eebe23ef99b087142249ee121c0939cf3fb1adadac443b6eeb16bb3d2da9e972b9f740b07bad4b13effcfbbc74a1da0ac2e1b2a469055c9c456149a984f574

Download Submit
C:\Windows\System\vRodIey.exe

Filesize
1.3MB

MD5
2d4992d172221652a53fc52dcc51f718

SHA1
0d474404332e97d3f05410d73ca2891365347204

SHA256
c6e901de24beabc4509cb884978873b27dbb33d6d28fe22b04a4d40a1152df58

SHA512
dc55148465d4eaed93af4997d59dae3982722a17a8a0badedb3ca9e5069cec96910dcce0940f8b78de88fb208e6453a9874e067b6ef8515c0cc762d029298aef

Download Submit
C:\Windows\System\yEiANHt.exe

Filesize
1.3MB

MD5
c3e15ce7d7a4daf7ef594f11fe359b2b

SHA1
6cc5151b1c0013176f050a8afe0bdecd1310761d

SHA256
54ff50b4dd454a78d5d21ee8533b0260b2ea9c288ff01f27d7c543b4a730dd66

SHA512
0578035ee93374b42c1583c56c351e37689bd4aa23719d2824dba1462c3643275093aa342cd20fb1dbbeea24aed07e5691689123fa8811f16c62cde6b1218d76

Download Submit
C:\Windows\System\zyYMSgx.exe

Filesize
1.3MB

MD5
e9916572b17387254615b7b6454149d9

SHA1
8733fd8cdf699def11cc8faab9f6f49cf76ade01

SHA256
61d6dbccef85144d5a7334262cf533c40756fbb84929b9af39b34b87d7d5f20f

SHA512
978822722044e22d2171c2f520f4da216ad28270b7b43a3485b745e6035e48bdbb16428d295ea7370f62c485fd1e3a36adb394dbaaadce5af8c054c5636556f9

Download Submit
memory/1544-0-0x0000015772F70000-0x0000015772F80000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads