xmrig | 7b4a1c8ef300581ff1defe6d95e5e7ac684324f2982d60270db33aba7fbfc905

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
25-01-2025 02:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7b4a1c8ef300581ff1defe6d95e5e7ac684324f2982d60270db33aba7fbfc905.exe
Size

1.8MB
MD5

225883a03d8814ebc7ce9b9712fabe8e
SHA1

7a83df7da31224705c37138b73f28135e0266b86
SHA256

7b4a1c8ef300581ff1defe6d95e5e7ac684324f2982d60270db33aba7fbfc905
SHA512

1946a14b05c46027863e92471004b35ec0eec273b5a6ef003f54e308749c78c66ad2638d74de557698bac708929d18fe79568c5927dc7657785b963370ba3692
SSDEEP

49152:GezaTF8FcNkNdfE0pZ9ozttwIRxA1Mc2xU/b4ste:GemTLkNdfE0pZyb

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 33 IoCs

miner

resource	yara_rule
behavioral2/files/0x000c000000023ba9-4.dat	xmrig
behavioral2/files/0x0007000000023c9f-6.dat	xmrig
behavioral2/files/0x0008000000023c9b-10.dat	xmrig
behavioral2/files/0x0007000000023ca1-17.dat	xmrig
behavioral2/files/0x0007000000023ca2-22.dat	xmrig
behavioral2/files/0x0007000000023ca3-32.dat	xmrig
behavioral2/files/0x0007000000023ca6-43.dat	xmrig
behavioral2/files/0x0007000000023cab-61.dat	xmrig
behavioral2/files/0x0007000000023caa-59.dat	xmrig
behavioral2/files/0x0007000000023ca8-67.dat	xmrig
behavioral2/files/0x0007000000023cac-75.dat	xmrig
behavioral2/files/0x0007000000023ca9-70.dat	xmrig
behavioral2/files/0x0007000000023ca7-62.dat	xmrig
behavioral2/files/0x0007000000023ca5-47.dat	xmrig
behavioral2/files/0x0007000000023ca4-42.dat	xmrig
behavioral2/files/0x0008000000023c9c-82.dat	xmrig
behavioral2/files/0x0007000000023caf-90.dat	xmrig
behavioral2/files/0x0007000000023cae-91.dat	xmrig
behavioral2/files/0x0007000000023cb0-98.dat	xmrig
behavioral2/files/0x0007000000023cb1-105.dat	xmrig
behavioral2/files/0x0007000000023cad-87.dat	xmrig
behavioral2/files/0x0007000000023cb2-109.dat	xmrig
behavioral2/files/0x0007000000023cb3-114.dat	xmrig
behavioral2/files/0x0007000000023cb4-119.dat	xmrig
behavioral2/files/0x0007000000023cb5-122.dat	xmrig
behavioral2/files/0x0007000000023cb7-130.dat	xmrig
behavioral2/files/0x0007000000023cb8-135.dat	xmrig
behavioral2/files/0x0007000000023cb9-140.dat	xmrig
behavioral2/files/0x0007000000023cba-141.dat	xmrig
behavioral2/files/0x0007000000023cbc-150.dat	xmrig
behavioral2/files/0x0007000000023cbd-161.dat	xmrig
behavioral2/files/0x0007000000023cbe-158.dat	xmrig
behavioral2/files/0x0007000000023cbb-157.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
4180	Bltprrc.exe
4984	ATlxgtN.exe
4536	elesASk.exe
4392	tsDrrMh.exe
1428	oqzvSdw.exe
4108	PhIdQct.exe
4992	Mjcgbig.exe
3956	QrHPNvJ.exe
4652	EMLQFKg.exe
2200	KCvstHn.exe
5032	mzEveDK.exe
2996	TpqKqMt.exe
2628	vTMvXvH.exe
4144	KCOQxaF.exe
3172	tLeASqW.exe
4408	gZHGqWF.exe
2848	oACOehW.exe
3460	uDgKucM.exe
2976	seWnaCE.exe
2676	crztvrd.exe
1876	xfzPZPl.exe
2744	kEAXiIl.exe
1052	lmBLBun.exe
2180	HoDGrRd.exe
2224	jahOjri.exe
4948	yFOnGeq.exe
4976	QRajWni.exe
4708	UCMLSoz.exe
3396	UurntAI.exe
4504	mmABozt.exe
1768	jOpTHcI.exe
4492	zXgqLcF.exe
4032	IsdrnnN.exe
740	RDzLkQB.exe
876	miqdXVJ.exe
400	luYQweG.exe
1624	cwzrxUu.exe
3540	iLtqAzF.exe
3908	xfyeMDm.exe
2308	EAVxzzQ.exe
4796	EmoFyGT.exe
2024	MaMErhw.exe
5008	ISBNJaH.exe
3576	FureZzD.exe
1576	IWgasPf.exe
3300	uwtmadL.exe
1660	uTQXPAc.exe
4916	cEcyBvk.exe
1560	bzzXNzG.exe
3960	ihRoYww.exe
4040	AOCdtRG.exe
1352	hlWjNcC.exe
2268	wwmlpPa.exe
1988	zizoNUY.exe
3472	KwBwOjk.exe
2900	KCQYHcL.exe
4676	iAznfNP.exe
2460	bDIMmhV.exe
844	kmlWneh.exe
4056	FsMcbtz.exe
3488	xvtOpQX.exe
1064	YXAGIQu.exe
3772	rdHMgrW.exe
4312	lZIRPbC.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\gYYSjmG.exe	7b4a1c8ef300581ff1defe6d95e5e7ac684324f2982d60270db33aba7fbfc905.exe
File created	C:\Windows\System\KOtSSnt.exe	7b4a1c8ef300581ff1defe6d95e5e7ac684324f2982d60270db33aba7fbfc905.exe
File created	C:\Windows\System\ufJWBJW.exe	7b4a1c8ef300581ff1defe6d95e5e7ac684324f2982d60270db33aba7fbfc905.exe
File created	C:\Windows\System\oMGBFNV.exe	7b4a1c8ef300581ff1defe6d95e5e7ac684324f2982d60270db33aba7fbfc905.exe
File created	C:\Windows\System\DTUXEEY.exe	7b4a1c8ef300581ff1defe6d95e5e7ac684324f2982d60270db33aba7fbfc905.exe
File created	C:\Windows\System\WTeAtjN.exe	7b4a1c8ef300581ff1defe6d95e5e7ac684324f2982d60270db33aba7fbfc905.exe
File created	C:\Windows\System\CODaBNF.exe	7b4a1c8ef300581ff1defe6d95e5e7ac684324f2982d60270db33aba7fbfc905.exe
File created	C:\Windows\System\vnmmoNW.exe	7b4a1c8ef300581ff1defe6d95e5e7ac684324f2982d60270db33aba7fbfc905.exe
File created	C:\Windows\System\hpLnAPR.exe	7b4a1c8ef300581ff1defe6d95e5e7ac684324f2982d60270db33aba7fbfc905.exe
File created	C:\Windows\System\pFFHMxn.exe	7b4a1c8ef300581ff1defe6d95e5e7ac684324f2982d60270db33aba7fbfc905.exe
File created	C:\Windows\System\ZQnmBoA.exe	7b4a1c8ef300581ff1defe6d95e5e7ac684324f2982d60270db33aba7fbfc905.exe
File created	C:\Windows\System\SNtwXiQ.exe	7b4a1c8ef300581ff1defe6d95e5e7ac684324f2982d60270db33aba7fbfc905.exe
File created	C:\Windows\System\OpKbVgw.exe	7b4a1c8ef300581ff1defe6d95e5e7ac684324f2982d60270db33aba7fbfc905.exe
File created	C:\Windows\System\BQMBopQ.exe	7b4a1c8ef300581ff1defe6d95e5e7ac684324f2982d60270db33aba7fbfc905.exe
File created	C:\Windows\System\wjIAMsC.exe	7b4a1c8ef300581ff1defe6d95e5e7ac684324f2982d60270db33aba7fbfc905.exe
File created	C:\Windows\System\TFpeedX.exe	7b4a1c8ef300581ff1defe6d95e5e7ac684324f2982d60270db33aba7fbfc905.exe
File created	C:\Windows\System\yeDkcII.exe	7b4a1c8ef300581ff1defe6d95e5e7ac684324f2982d60270db33aba7fbfc905.exe
File created	C:\Windows\System\kkoaCuz.exe	7b4a1c8ef300581ff1defe6d95e5e7ac684324f2982d60270db33aba7fbfc905.exe
File created	C:\Windows\System\DhKZJBq.exe	7b4a1c8ef300581ff1defe6d95e5e7ac684324f2982d60270db33aba7fbfc905.exe
File created	C:\Windows\System\kTNVNBX.exe	7b4a1c8ef300581ff1defe6d95e5e7ac684324f2982d60270db33aba7fbfc905.exe
File created	C:\Windows\System\uTnfnRk.exe	7b4a1c8ef300581ff1defe6d95e5e7ac684324f2982d60270db33aba7fbfc905.exe
File created	C:\Windows\System\YYJJqIT.exe	7b4a1c8ef300581ff1defe6d95e5e7ac684324f2982d60270db33aba7fbfc905.exe
File created	C:\Windows\System\Ndntdoq.exe	7b4a1c8ef300581ff1defe6d95e5e7ac684324f2982d60270db33aba7fbfc905.exe
File created	C:\Windows\System\EOGFBCm.exe	7b4a1c8ef300581ff1defe6d95e5e7ac684324f2982d60270db33aba7fbfc905.exe
File created	C:\Windows\System\gwEyNUx.exe	7b4a1c8ef300581ff1defe6d95e5e7ac684324f2982d60270db33aba7fbfc905.exe
File created	C:\Windows\System\gSqtcDQ.exe	7b4a1c8ef300581ff1defe6d95e5e7ac684324f2982d60270db33aba7fbfc905.exe
File created	C:\Windows\System\gluciwl.exe	7b4a1c8ef300581ff1defe6d95e5e7ac684324f2982d60270db33aba7fbfc905.exe
File created	C:\Windows\System\DwOwnGY.exe	7b4a1c8ef300581ff1defe6d95e5e7ac684324f2982d60270db33aba7fbfc905.exe
File created	C:\Windows\System\ZHFquoT.exe	7b4a1c8ef300581ff1defe6d95e5e7ac684324f2982d60270db33aba7fbfc905.exe
File created	C:\Windows\System\OGGYcZZ.exe	7b4a1c8ef300581ff1defe6d95e5e7ac684324f2982d60270db33aba7fbfc905.exe
File created	C:\Windows\System\JfmwzMV.exe	7b4a1c8ef300581ff1defe6d95e5e7ac684324f2982d60270db33aba7fbfc905.exe
File created	C:\Windows\System\uDgKucM.exe	7b4a1c8ef300581ff1defe6d95e5e7ac684324f2982d60270db33aba7fbfc905.exe
File created	C:\Windows\System\KthbLsn.exe	7b4a1c8ef300581ff1defe6d95e5e7ac684324f2982d60270db33aba7fbfc905.exe
File created	C:\Windows\System\Mjcgbig.exe	7b4a1c8ef300581ff1defe6d95e5e7ac684324f2982d60270db33aba7fbfc905.exe
File created	C:\Windows\System\eWyvjMi.exe	7b4a1c8ef300581ff1defe6d95e5e7ac684324f2982d60270db33aba7fbfc905.exe
File created	C:\Windows\System\esLxKvV.exe	7b4a1c8ef300581ff1defe6d95e5e7ac684324f2982d60270db33aba7fbfc905.exe
File created	C:\Windows\System\opXgSpi.exe	7b4a1c8ef300581ff1defe6d95e5e7ac684324f2982d60270db33aba7fbfc905.exe
File created	C:\Windows\System\JBoJFYf.exe	7b4a1c8ef300581ff1defe6d95e5e7ac684324f2982d60270db33aba7fbfc905.exe
File created	C:\Windows\System\kHFMExB.exe	7b4a1c8ef300581ff1defe6d95e5e7ac684324f2982d60270db33aba7fbfc905.exe
File created	C:\Windows\System\pulyUoO.exe	7b4a1c8ef300581ff1defe6d95e5e7ac684324f2982d60270db33aba7fbfc905.exe
File created	C:\Windows\System\MIOSNMR.exe	7b4a1c8ef300581ff1defe6d95e5e7ac684324f2982d60270db33aba7fbfc905.exe
File created	C:\Windows\System\wbrfPZW.exe	7b4a1c8ef300581ff1defe6d95e5e7ac684324f2982d60270db33aba7fbfc905.exe
File created	C:\Windows\System\UPdaiTI.exe	7b4a1c8ef300581ff1defe6d95e5e7ac684324f2982d60270db33aba7fbfc905.exe
File created	C:\Windows\System\luYQweG.exe	7b4a1c8ef300581ff1defe6d95e5e7ac684324f2982d60270db33aba7fbfc905.exe
File created	C:\Windows\System\ETtfhHx.exe	7b4a1c8ef300581ff1defe6d95e5e7ac684324f2982d60270db33aba7fbfc905.exe
File created	C:\Windows\System\hDYqieP.exe	7b4a1c8ef300581ff1defe6d95e5e7ac684324f2982d60270db33aba7fbfc905.exe
File created	C:\Windows\System\lSLuHNW.exe	7b4a1c8ef300581ff1defe6d95e5e7ac684324f2982d60270db33aba7fbfc905.exe
File created	C:\Windows\System\VNybLao.exe	7b4a1c8ef300581ff1defe6d95e5e7ac684324f2982d60270db33aba7fbfc905.exe
File created	C:\Windows\System\ATlxgtN.exe	7b4a1c8ef300581ff1defe6d95e5e7ac684324f2982d60270db33aba7fbfc905.exe
File created	C:\Windows\System\yFOnGeq.exe	7b4a1c8ef300581ff1defe6d95e5e7ac684324f2982d60270db33aba7fbfc905.exe
File created	C:\Windows\System\jhUReSw.exe	7b4a1c8ef300581ff1defe6d95e5e7ac684324f2982d60270db33aba7fbfc905.exe
File created	C:\Windows\System\WnuBEkz.exe	7b4a1c8ef300581ff1defe6d95e5e7ac684324f2982d60270db33aba7fbfc905.exe
File created	C:\Windows\System\wQKnigJ.exe	7b4a1c8ef300581ff1defe6d95e5e7ac684324f2982d60270db33aba7fbfc905.exe
File created	C:\Windows\System\yFJmTSU.exe	7b4a1c8ef300581ff1defe6d95e5e7ac684324f2982d60270db33aba7fbfc905.exe
File created	C:\Windows\System\plWkEJz.exe	7b4a1c8ef300581ff1defe6d95e5e7ac684324f2982d60270db33aba7fbfc905.exe
File created	C:\Windows\System\MJKKwhg.exe	7b4a1c8ef300581ff1defe6d95e5e7ac684324f2982d60270db33aba7fbfc905.exe
File created	C:\Windows\System\KNOpPYc.exe	7b4a1c8ef300581ff1defe6d95e5e7ac684324f2982d60270db33aba7fbfc905.exe
File created	C:\Windows\System\WprFCDh.exe	7b4a1c8ef300581ff1defe6d95e5e7ac684324f2982d60270db33aba7fbfc905.exe
File created	C:\Windows\System\YFcZHMw.exe	7b4a1c8ef300581ff1defe6d95e5e7ac684324f2982d60270db33aba7fbfc905.exe
File created	C:\Windows\System\NfcDHJJ.exe	7b4a1c8ef300581ff1defe6d95e5e7ac684324f2982d60270db33aba7fbfc905.exe
File created	C:\Windows\System\XEpwlHW.exe	7b4a1c8ef300581ff1defe6d95e5e7ac684324f2982d60270db33aba7fbfc905.exe
File created	C:\Windows\System\KKgbgNG.exe	7b4a1c8ef300581ff1defe6d95e5e7ac684324f2982d60270db33aba7fbfc905.exe
File created	C:\Windows\System\bHuJfFW.exe	7b4a1c8ef300581ff1defe6d95e5e7ac684324f2982d60270db33aba7fbfc905.exe
File created	C:\Windows\System\IgUBpIQ.exe	7b4a1c8ef300581ff1defe6d95e5e7ac684324f2982d60270db33aba7fbfc905.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	17136	dwm.exe
Token: SeChangeNotifyPrivilege	17136	dwm.exe
Token: 33	17136	dwm.exe
Token: SeIncBasePriorityPrivilege	17136	dwm.exe
Token: SeShutdownPrivilege	17136	dwm.exe
Token: SeCreatePagefilePrivilege	17136	dwm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4588 wrote to memory of 4180	4588	7b4a1c8ef300581ff1defe6d95e5e7ac684324f2982d60270db33aba7fbfc905.exe	84
PID 4588 wrote to memory of 4180	4588	7b4a1c8ef300581ff1defe6d95e5e7ac684324f2982d60270db33aba7fbfc905.exe	84
PID 4588 wrote to memory of 4984	4588	7b4a1c8ef300581ff1defe6d95e5e7ac684324f2982d60270db33aba7fbfc905.exe	85
PID 4588 wrote to memory of 4984	4588	7b4a1c8ef300581ff1defe6d95e5e7ac684324f2982d60270db33aba7fbfc905.exe	85
PID 4588 wrote to memory of 4536	4588	7b4a1c8ef300581ff1defe6d95e5e7ac684324f2982d60270db33aba7fbfc905.exe	86
PID 4588 wrote to memory of 4536	4588	7b4a1c8ef300581ff1defe6d95e5e7ac684324f2982d60270db33aba7fbfc905.exe	86
PID 4588 wrote to memory of 4392	4588	7b4a1c8ef300581ff1defe6d95e5e7ac684324f2982d60270db33aba7fbfc905.exe	87
PID 4588 wrote to memory of 4392	4588	7b4a1c8ef300581ff1defe6d95e5e7ac684324f2982d60270db33aba7fbfc905.exe	87
PID 4588 wrote to memory of 1428	4588	7b4a1c8ef300581ff1defe6d95e5e7ac684324f2982d60270db33aba7fbfc905.exe	88
PID 4588 wrote to memory of 1428	4588	7b4a1c8ef300581ff1defe6d95e5e7ac684324f2982d60270db33aba7fbfc905.exe	88
PID 4588 wrote to memory of 4108	4588	7b4a1c8ef300581ff1defe6d95e5e7ac684324f2982d60270db33aba7fbfc905.exe	89
PID 4588 wrote to memory of 4108	4588	7b4a1c8ef300581ff1defe6d95e5e7ac684324f2982d60270db33aba7fbfc905.exe	89
PID 4588 wrote to memory of 4992	4588	7b4a1c8ef300581ff1defe6d95e5e7ac684324f2982d60270db33aba7fbfc905.exe	90
PID 4588 wrote to memory of 4992	4588	7b4a1c8ef300581ff1defe6d95e5e7ac684324f2982d60270db33aba7fbfc905.exe	90
PID 4588 wrote to memory of 3956	4588	7b4a1c8ef300581ff1defe6d95e5e7ac684324f2982d60270db33aba7fbfc905.exe	91
PID 4588 wrote to memory of 3956	4588	7b4a1c8ef300581ff1defe6d95e5e7ac684324f2982d60270db33aba7fbfc905.exe	91
PID 4588 wrote to memory of 4652	4588	7b4a1c8ef300581ff1defe6d95e5e7ac684324f2982d60270db33aba7fbfc905.exe	92
PID 4588 wrote to memory of 4652	4588	7b4a1c8ef300581ff1defe6d95e5e7ac684324f2982d60270db33aba7fbfc905.exe	92
PID 4588 wrote to memory of 2200	4588	7b4a1c8ef300581ff1defe6d95e5e7ac684324f2982d60270db33aba7fbfc905.exe	93
PID 4588 wrote to memory of 2200	4588	7b4a1c8ef300581ff1defe6d95e5e7ac684324f2982d60270db33aba7fbfc905.exe	93
PID 4588 wrote to memory of 5032	4588	7b4a1c8ef300581ff1defe6d95e5e7ac684324f2982d60270db33aba7fbfc905.exe	94
PID 4588 wrote to memory of 5032	4588	7b4a1c8ef300581ff1defe6d95e5e7ac684324f2982d60270db33aba7fbfc905.exe	94
PID 4588 wrote to memory of 2996	4588	7b4a1c8ef300581ff1defe6d95e5e7ac684324f2982d60270db33aba7fbfc905.exe	95
PID 4588 wrote to memory of 2996	4588	7b4a1c8ef300581ff1defe6d95e5e7ac684324f2982d60270db33aba7fbfc905.exe	95
PID 4588 wrote to memory of 2628	4588	7b4a1c8ef300581ff1defe6d95e5e7ac684324f2982d60270db33aba7fbfc905.exe	96
PID 4588 wrote to memory of 2628	4588	7b4a1c8ef300581ff1defe6d95e5e7ac684324f2982d60270db33aba7fbfc905.exe	96
PID 4588 wrote to memory of 4144	4588	7b4a1c8ef300581ff1defe6d95e5e7ac684324f2982d60270db33aba7fbfc905.exe	97
PID 4588 wrote to memory of 4144	4588	7b4a1c8ef300581ff1defe6d95e5e7ac684324f2982d60270db33aba7fbfc905.exe	97
PID 4588 wrote to memory of 3172	4588	7b4a1c8ef300581ff1defe6d95e5e7ac684324f2982d60270db33aba7fbfc905.exe	98
PID 4588 wrote to memory of 3172	4588	7b4a1c8ef300581ff1defe6d95e5e7ac684324f2982d60270db33aba7fbfc905.exe	98
PID 4588 wrote to memory of 4408	4588	7b4a1c8ef300581ff1defe6d95e5e7ac684324f2982d60270db33aba7fbfc905.exe	99
PID 4588 wrote to memory of 4408	4588	7b4a1c8ef300581ff1defe6d95e5e7ac684324f2982d60270db33aba7fbfc905.exe	99
PID 4588 wrote to memory of 2848	4588	7b4a1c8ef300581ff1defe6d95e5e7ac684324f2982d60270db33aba7fbfc905.exe	100
PID 4588 wrote to memory of 2848	4588	7b4a1c8ef300581ff1defe6d95e5e7ac684324f2982d60270db33aba7fbfc905.exe	100
PID 4588 wrote to memory of 3460	4588	7b4a1c8ef300581ff1defe6d95e5e7ac684324f2982d60270db33aba7fbfc905.exe	101
PID 4588 wrote to memory of 3460	4588	7b4a1c8ef300581ff1defe6d95e5e7ac684324f2982d60270db33aba7fbfc905.exe	101
PID 4588 wrote to memory of 2976	4588	7b4a1c8ef300581ff1defe6d95e5e7ac684324f2982d60270db33aba7fbfc905.exe	102
PID 4588 wrote to memory of 2976	4588	7b4a1c8ef300581ff1defe6d95e5e7ac684324f2982d60270db33aba7fbfc905.exe	102
PID 4588 wrote to memory of 2676	4588	7b4a1c8ef300581ff1defe6d95e5e7ac684324f2982d60270db33aba7fbfc905.exe	103
PID 4588 wrote to memory of 2676	4588	7b4a1c8ef300581ff1defe6d95e5e7ac684324f2982d60270db33aba7fbfc905.exe	103
PID 4588 wrote to memory of 1876	4588	7b4a1c8ef300581ff1defe6d95e5e7ac684324f2982d60270db33aba7fbfc905.exe	104
PID 4588 wrote to memory of 1876	4588	7b4a1c8ef300581ff1defe6d95e5e7ac684324f2982d60270db33aba7fbfc905.exe	104
PID 4588 wrote to memory of 2744	4588	7b4a1c8ef300581ff1defe6d95e5e7ac684324f2982d60270db33aba7fbfc905.exe	105
PID 4588 wrote to memory of 2744	4588	7b4a1c8ef300581ff1defe6d95e5e7ac684324f2982d60270db33aba7fbfc905.exe	105
PID 4588 wrote to memory of 1052	4588	7b4a1c8ef300581ff1defe6d95e5e7ac684324f2982d60270db33aba7fbfc905.exe	106
PID 4588 wrote to memory of 1052	4588	7b4a1c8ef300581ff1defe6d95e5e7ac684324f2982d60270db33aba7fbfc905.exe	106
PID 4588 wrote to memory of 2180	4588	7b4a1c8ef300581ff1defe6d95e5e7ac684324f2982d60270db33aba7fbfc905.exe	107
PID 4588 wrote to memory of 2180	4588	7b4a1c8ef300581ff1defe6d95e5e7ac684324f2982d60270db33aba7fbfc905.exe	107
PID 4588 wrote to memory of 2224	4588	7b4a1c8ef300581ff1defe6d95e5e7ac684324f2982d60270db33aba7fbfc905.exe	108
PID 4588 wrote to memory of 2224	4588	7b4a1c8ef300581ff1defe6d95e5e7ac684324f2982d60270db33aba7fbfc905.exe	108
PID 4588 wrote to memory of 4948	4588	7b4a1c8ef300581ff1defe6d95e5e7ac684324f2982d60270db33aba7fbfc905.exe	109
PID 4588 wrote to memory of 4948	4588	7b4a1c8ef300581ff1defe6d95e5e7ac684324f2982d60270db33aba7fbfc905.exe	109
PID 4588 wrote to memory of 4976	4588	7b4a1c8ef300581ff1defe6d95e5e7ac684324f2982d60270db33aba7fbfc905.exe	110
PID 4588 wrote to memory of 4976	4588	7b4a1c8ef300581ff1defe6d95e5e7ac684324f2982d60270db33aba7fbfc905.exe	110
PID 4588 wrote to memory of 4708	4588	7b4a1c8ef300581ff1defe6d95e5e7ac684324f2982d60270db33aba7fbfc905.exe	111
PID 4588 wrote to memory of 4708	4588	7b4a1c8ef300581ff1defe6d95e5e7ac684324f2982d60270db33aba7fbfc905.exe	111
PID 4588 wrote to memory of 3396	4588	7b4a1c8ef300581ff1defe6d95e5e7ac684324f2982d60270db33aba7fbfc905.exe	112
PID 4588 wrote to memory of 3396	4588	7b4a1c8ef300581ff1defe6d95e5e7ac684324f2982d60270db33aba7fbfc905.exe	112
PID 4588 wrote to memory of 4492	4588	7b4a1c8ef300581ff1defe6d95e5e7ac684324f2982d60270db33aba7fbfc905.exe	113
PID 4588 wrote to memory of 4492	4588	7b4a1c8ef300581ff1defe6d95e5e7ac684324f2982d60270db33aba7fbfc905.exe	113
PID 4588 wrote to memory of 4504	4588	7b4a1c8ef300581ff1defe6d95e5e7ac684324f2982d60270db33aba7fbfc905.exe	114
PID 4588 wrote to memory of 4504	4588	7b4a1c8ef300581ff1defe6d95e5e7ac684324f2982d60270db33aba7fbfc905.exe	114
PID 4588 wrote to memory of 1768	4588	7b4a1c8ef300581ff1defe6d95e5e7ac684324f2982d60270db33aba7fbfc905.exe	115
PID 4588 wrote to memory of 1768	4588	7b4a1c8ef300581ff1defe6d95e5e7ac684324f2982d60270db33aba7fbfc905.exe	115

C:\Users\Admin\AppData\Local\Temp\7b4a1c8ef300581ff1defe6d95e5e7ac684324f2982d60270db33aba7fbfc905.exe
"C:\Users\Admin\AppData\Local\Temp\7b4a1c8ef300581ff1defe6d95e5e7ac684324f2982d60270db33aba7fbfc905.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4588
- C:\Windows\System\Bltprrc.exe
  C:\Windows\System\Bltprrc.exe
  2⤵
  - Executes dropped EXE
  PID:4180
- C:\Windows\System\ATlxgtN.exe
  C:\Windows\System\ATlxgtN.exe
  2⤵
  - Executes dropped EXE
  PID:4984
- C:\Windows\System\elesASk.exe
  C:\Windows\System\elesASk.exe
  2⤵
  - Executes dropped EXE
  PID:4536
- C:\Windows\System\tsDrrMh.exe
  C:\Windows\System\tsDrrMh.exe
  2⤵
  - Executes dropped EXE
  PID:4392
- C:\Windows\System\oqzvSdw.exe
  C:\Windows\System\oqzvSdw.exe
  2⤵
  - Executes dropped EXE
  PID:1428
- C:\Windows\System\PhIdQct.exe
  C:\Windows\System\PhIdQct.exe
  2⤵
  - Executes dropped EXE
  PID:4108
- C:\Windows\System\Mjcgbig.exe
  C:\Windows\System\Mjcgbig.exe
  2⤵
  - Executes dropped EXE
  PID:4992
- C:\Windows\System\QrHPNvJ.exe
  C:\Windows\System\QrHPNvJ.exe
  2⤵
  - Executes dropped EXE
  PID:3956
- C:\Windows\System\EMLQFKg.exe
  C:\Windows\System\EMLQFKg.exe
  2⤵
  - Executes dropped EXE
  PID:4652
- C:\Windows\System\KCvstHn.exe
  C:\Windows\System\KCvstHn.exe
  2⤵
  - Executes dropped EXE
  PID:2200
- C:\Windows\System\mzEveDK.exe
  C:\Windows\System\mzEveDK.exe
  2⤵
  - Executes dropped EXE
  PID:5032
- C:\Windows\System\TpqKqMt.exe
  C:\Windows\System\TpqKqMt.exe
  2⤵
  - Executes dropped EXE
  PID:2996
- C:\Windows\System\vTMvXvH.exe
  C:\Windows\System\vTMvXvH.exe
  2⤵
  - Executes dropped EXE
  PID:2628
- C:\Windows\System\KCOQxaF.exe
  C:\Windows\System\KCOQxaF.exe
  2⤵
  - Executes dropped EXE
  PID:4144
- C:\Windows\System\tLeASqW.exe
  C:\Windows\System\tLeASqW.exe
  2⤵
  - Executes dropped EXE
  PID:3172
- C:\Windows\System\gZHGqWF.exe
  C:\Windows\System\gZHGqWF.exe
  2⤵
  - Executes dropped EXE
  PID:4408
- C:\Windows\System\oACOehW.exe
  C:\Windows\System\oACOehW.exe
  2⤵
  - Executes dropped EXE
  PID:2848
- C:\Windows\System\uDgKucM.exe
  C:\Windows\System\uDgKucM.exe
  2⤵
  - Executes dropped EXE
  PID:3460
- C:\Windows\System\seWnaCE.exe
  C:\Windows\System\seWnaCE.exe
  2⤵
  - Executes dropped EXE
  PID:2976
- C:\Windows\System\crztvrd.exe
  C:\Windows\System\crztvrd.exe
  2⤵
  - Executes dropped EXE
  PID:2676
- C:\Windows\System\xfzPZPl.exe
  C:\Windows\System\xfzPZPl.exe
  2⤵
  - Executes dropped EXE
  PID:1876
- C:\Windows\System\kEAXiIl.exe
  C:\Windows\System\kEAXiIl.exe
  2⤵
  - Executes dropped EXE
  PID:2744
- C:\Windows\System\lmBLBun.exe
  C:\Windows\System\lmBLBun.exe
  2⤵
  - Executes dropped EXE
  PID:1052
- C:\Windows\System\HoDGrRd.exe
  C:\Windows\System\HoDGrRd.exe
  2⤵
  - Executes dropped EXE
  PID:2180
- C:\Windows\System\jahOjri.exe
  C:\Windows\System\jahOjri.exe
  2⤵
  - Executes dropped EXE
  PID:2224
- C:\Windows\System\yFOnGeq.exe
  C:\Windows\System\yFOnGeq.exe
  2⤵
  - Executes dropped EXE
  PID:4948
- C:\Windows\System\QRajWni.exe
  C:\Windows\System\QRajWni.exe
  2⤵
  - Executes dropped EXE
  PID:4976
- C:\Windows\System\UCMLSoz.exe
  C:\Windows\System\UCMLSoz.exe
  2⤵
  - Executes dropped EXE
  PID:4708
- C:\Windows\System\UurntAI.exe
  C:\Windows\System\UurntAI.exe
  2⤵
  - Executes dropped EXE
  PID:3396
- C:\Windows\System\zXgqLcF.exe
  C:\Windows\System\zXgqLcF.exe
  2⤵
  - Executes dropped EXE
  PID:4492
- C:\Windows\System\mmABozt.exe
  C:\Windows\System\mmABozt.exe
  2⤵
  - Executes dropped EXE
  PID:4504
- C:\Windows\System\jOpTHcI.exe
  C:\Windows\System\jOpTHcI.exe
  2⤵
  - Executes dropped EXE
  PID:1768
- C:\Windows\System\IsdrnnN.exe
  C:\Windows\System\IsdrnnN.exe
  2⤵
  - Executes dropped EXE
  PID:4032
- C:\Windows\System\RDzLkQB.exe
  C:\Windows\System\RDzLkQB.exe
  2⤵
  - Executes dropped EXE
  PID:740
- C:\Windows\System\miqdXVJ.exe
  C:\Windows\System\miqdXVJ.exe
  2⤵
  - Executes dropped EXE
  PID:876
- C:\Windows\System\luYQweG.exe
  C:\Windows\System\luYQweG.exe
  2⤵
  - Executes dropped EXE
  PID:400
- C:\Windows\System\cwzrxUu.exe
  C:\Windows\System\cwzrxUu.exe
  2⤵
  - Executes dropped EXE
  PID:1624
- C:\Windows\System\iLtqAzF.exe
  C:\Windows\System\iLtqAzF.exe
  2⤵
  - Executes dropped EXE
  PID:3540
- C:\Windows\System\xfyeMDm.exe
  C:\Windows\System\xfyeMDm.exe
  2⤵
  - Executes dropped EXE
  PID:3908
- C:\Windows\System\EAVxzzQ.exe
  C:\Windows\System\EAVxzzQ.exe
  2⤵
  - Executes dropped EXE
  PID:2308
- C:\Windows\System\EmoFyGT.exe
  C:\Windows\System\EmoFyGT.exe
  2⤵
  - Executes dropped EXE
  PID:4796
- C:\Windows\System\MaMErhw.exe
  C:\Windows\System\MaMErhw.exe
  2⤵
  - Executes dropped EXE
  PID:2024
- C:\Windows\System\ISBNJaH.exe
  C:\Windows\System\ISBNJaH.exe
  2⤵
  - Executes dropped EXE
  PID:5008
- C:\Windows\System\FureZzD.exe
  C:\Windows\System\FureZzD.exe
  2⤵
  - Executes dropped EXE
  PID:3576
- C:\Windows\System\IWgasPf.exe
  C:\Windows\System\IWgasPf.exe
  2⤵
  - Executes dropped EXE
  PID:1576
- C:\Windows\System\uwtmadL.exe
  C:\Windows\System\uwtmadL.exe
  2⤵
  - Executes dropped EXE
  PID:3300
- C:\Windows\System\uTQXPAc.exe
  C:\Windows\System\uTQXPAc.exe
  2⤵
  - Executes dropped EXE
  PID:1660
- C:\Windows\System\cEcyBvk.exe
  C:\Windows\System\cEcyBvk.exe
  2⤵
  - Executes dropped EXE
  PID:4916
- C:\Windows\System\bzzXNzG.exe
  C:\Windows\System\bzzXNzG.exe
  2⤵
  - Executes dropped EXE
  PID:1560
- C:\Windows\System\ihRoYww.exe
  C:\Windows\System\ihRoYww.exe
  2⤵
  - Executes dropped EXE
  PID:3960
- C:\Windows\System\AOCdtRG.exe
  C:\Windows\System\AOCdtRG.exe
  2⤵
  - Executes dropped EXE
  PID:4040
- C:\Windows\System\hlWjNcC.exe
  C:\Windows\System\hlWjNcC.exe
  2⤵
  - Executes dropped EXE
  PID:1352
- C:\Windows\System\wwmlpPa.exe
  C:\Windows\System\wwmlpPa.exe
  2⤵
  - Executes dropped EXE
  PID:2268
- C:\Windows\System\zizoNUY.exe
  C:\Windows\System\zizoNUY.exe
  2⤵
  - Executes dropped EXE
  PID:1988
- C:\Windows\System\KwBwOjk.exe
  C:\Windows\System\KwBwOjk.exe
  2⤵
  - Executes dropped EXE
  PID:3472
- C:\Windows\System\KCQYHcL.exe
  C:\Windows\System\KCQYHcL.exe
  2⤵
  - Executes dropped EXE
  PID:2900
- C:\Windows\System\iAznfNP.exe
  C:\Windows\System\iAznfNP.exe
  2⤵
  - Executes dropped EXE
  PID:4676
- C:\Windows\System\bDIMmhV.exe
  C:\Windows\System\bDIMmhV.exe
  2⤵
  - Executes dropped EXE
  PID:2460
- C:\Windows\System\kmlWneh.exe
  C:\Windows\System\kmlWneh.exe
  2⤵
  - Executes dropped EXE
  PID:844
- C:\Windows\System\FsMcbtz.exe
  C:\Windows\System\FsMcbtz.exe
  2⤵
  - Executes dropped EXE
  PID:4056
- C:\Windows\System\xvtOpQX.exe
  C:\Windows\System\xvtOpQX.exe
  2⤵
  - Executes dropped EXE
  PID:3488
- C:\Windows\System\YXAGIQu.exe
  C:\Windows\System\YXAGIQu.exe
  2⤵
  - Executes dropped EXE
  PID:1064
- C:\Windows\System\rdHMgrW.exe
  C:\Windows\System\rdHMgrW.exe
  2⤵
  - Executes dropped EXE
  PID:3772
- C:\Windows\System\lZIRPbC.exe
  C:\Windows\System\lZIRPbC.exe
  2⤵
  - Executes dropped EXE
  PID:4312
- C:\Windows\System\oIBmucd.exe
  C:\Windows\System\oIBmucd.exe
  2⤵
  PID:4688
- C:\Windows\System\ikQjWFG.exe
  C:\Windows\System\ikQjWFG.exe
  2⤵
  PID:4444
- C:\Windows\System\WUVAVwz.exe
  C:\Windows\System\WUVAVwz.exe
  2⤵
  PID:2512
- C:\Windows\System\qcMylAq.exe
  C:\Windows\System\qcMylAq.exe
  2⤵
  PID:1196
- C:\Windows\System\TyRdRLL.exe
  C:\Windows\System\TyRdRLL.exe
  2⤵
  PID:3528
- C:\Windows\System\PNawoOM.exe
  C:\Windows\System\PNawoOM.exe
  2⤵
  PID:4020
- C:\Windows\System\yJbExfZ.exe
  C:\Windows\System\yJbExfZ.exe
  2⤵
  PID:592
- C:\Windows\System\mvwDJup.exe
  C:\Windows\System\mvwDJup.exe
  2⤵
  PID:3808
- C:\Windows\System\LFukIvq.exe
  C:\Windows\System\LFukIvq.exe
  2⤵
  PID:708
- C:\Windows\System\DnDaaFb.exe
  C:\Windows\System\DnDaaFb.exe
  2⤵
  PID:4208
- C:\Windows\System\GbgcWFH.exe
  C:\Windows\System\GbgcWFH.exe
  2⤵
  PID:3316
- C:\Windows\System\IvjfMFO.exe
  C:\Windows\System\IvjfMFO.exe
  2⤵
  PID:2572
- C:\Windows\System\JGdiAHf.exe
  C:\Windows\System\JGdiAHf.exe
  2⤵
  PID:3880
- C:\Windows\System\xXcNECA.exe
  C:\Windows\System\xXcNECA.exe
  2⤵
  PID:436
- C:\Windows\System\iZjaOVr.exe
  C:\Windows\System\iZjaOVr.exe
  2⤵
  PID:3712
- C:\Windows\System\YkgSryx.exe
  C:\Windows\System\YkgSryx.exe
  2⤵
  PID:3128
- C:\Windows\System\ZISNmIi.exe
  C:\Windows\System\ZISNmIi.exe
  2⤵
  PID:1944
- C:\Windows\System\QKZHuPP.exe
  C:\Windows\System\QKZHuPP.exe
  2⤵
  PID:3588
- C:\Windows\System\flPPUkb.exe
  C:\Windows\System\flPPUkb.exe
  2⤵
  PID:3464
- C:\Windows\System\JiehQfL.exe
  C:\Windows\System\JiehQfL.exe
  2⤵
  PID:1432
- C:\Windows\System\IbnLmiQ.exe
  C:\Windows\System\IbnLmiQ.exe
  2⤵
  PID:3932
- C:\Windows\System\JRjgrTn.exe
  C:\Windows\System\JRjgrTn.exe
  2⤵
  PID:3632
- C:\Windows\System\mzdaRiJ.exe
  C:\Windows\System\mzdaRiJ.exe
  2⤵
  PID:2624
- C:\Windows\System\liMdCVC.exe
  C:\Windows\System\liMdCVC.exe
  2⤵
  PID:3100
- C:\Windows\System\lwCKMKB.exe
  C:\Windows\System\lwCKMKB.exe
  2⤵
  PID:3624
- C:\Windows\System\KNOpPYc.exe
  C:\Windows\System\KNOpPYc.exe
  2⤵
  PID:732
- C:\Windows\System\pcfoDbR.exe
  C:\Windows\System\pcfoDbR.exe
  2⤵
  PID:2368
- C:\Windows\System\ETtfhHx.exe
  C:\Windows\System\ETtfhHx.exe
  2⤵
  PID:5092
- C:\Windows\System\DzjldSx.exe
  C:\Windows\System\DzjldSx.exe
  2⤵
  PID:1060
- C:\Windows\System\dyfrkvk.exe
  C:\Windows\System\dyfrkvk.exe
  2⤵
  PID:2832
- C:\Windows\System\VFtlUzJ.exe
  C:\Windows\System\VFtlUzJ.exe
  2⤵
  PID:4980
- C:\Windows\System\WzsQlZY.exe
  C:\Windows\System\WzsQlZY.exe
  2⤵
  PID:1504
- C:\Windows\System\hDYqieP.exe
  C:\Windows\System\hDYqieP.exe
  2⤵
  PID:4712
- C:\Windows\System\CiOVuHo.exe
  C:\Windows\System\CiOVuHo.exe
  2⤵
  PID:4896
- C:\Windows\System\CzGxeNh.exe
  C:\Windows\System\CzGxeNh.exe
  2⤵
  PID:3996
- C:\Windows\System\MykeyuP.exe
  C:\Windows\System\MykeyuP.exe
  2⤵
  PID:1116
- C:\Windows\System\JnHLGSc.exe
  C:\Windows\System\JnHLGSc.exe
  2⤵
  PID:1320
- C:\Windows\System\srnLgpM.exe
  C:\Windows\System\srnLgpM.exe
  2⤵
  PID:2040
- C:\Windows\System\LTVyArh.exe
  C:\Windows\System\LTVyArh.exe
  2⤵
  PID:3840
- C:\Windows\System\BCrBPgB.exe
  C:\Windows\System\BCrBPgB.exe
  2⤵
  PID:2236
- C:\Windows\System\kxYyrOU.exe
  C:\Windows\System\kxYyrOU.exe
  2⤵
  PID:1216
- C:\Windows\System\LaGkLQj.exe
  C:\Windows\System\LaGkLQj.exe
  2⤵
  PID:4728
- C:\Windows\System\qBYIwvb.exe
  C:\Windows\System\qBYIwvb.exe
  2⤵
  PID:4280
- C:\Windows\System\XHccBnT.exe
  C:\Windows\System\XHccBnT.exe
  2⤵
  PID:3680
- C:\Windows\System\WnFUyJk.exe
  C:\Windows\System\WnFUyJk.exe
  2⤵
  PID:3400
- C:\Windows\System\eLjAvgA.exe
  C:\Windows\System\eLjAvgA.exe
  2⤵
  PID:1204
- C:\Windows\System\ZJDIycR.exe
  C:\Windows\System\ZJDIycR.exe
  2⤵
  PID:372
- C:\Windows\System\dLvMorP.exe
  C:\Windows\System\dLvMorP.exe
  2⤵
  PID:4396
- C:\Windows\System\HEGBtrS.exe
  C:\Windows\System\HEGBtrS.exe
  2⤵
  PID:4380
- C:\Windows\System\AOmNJFQ.exe
  C:\Windows\System\AOmNJFQ.exe
  2⤵
  PID:5124
- C:\Windows\System\nSvFEBC.exe
  C:\Windows\System\nSvFEBC.exe
  2⤵
  PID:5164
- C:\Windows\System\gwEyNUx.exe
  C:\Windows\System\gwEyNUx.exe
  2⤵
  PID:5188
- C:\Windows\System\JwDDpvQ.exe
  C:\Windows\System\JwDDpvQ.exe
  2⤵
  PID:5208
- C:\Windows\System\iPhgaBS.exe
  C:\Windows\System\iPhgaBS.exe
  2⤵
  PID:5248
- C:\Windows\System\vWGvUTQ.exe
  C:\Windows\System\vWGvUTQ.exe
  2⤵
  PID:5272
- C:\Windows\System\UORzzvm.exe
  C:\Windows\System\UORzzvm.exe
  2⤵
  PID:5296
- C:\Windows\System\NEhwZIr.exe
  C:\Windows\System\NEhwZIr.exe
  2⤵
  PID:5328
- C:\Windows\System\zGmAOPX.exe
  C:\Windows\System\zGmAOPX.exe
  2⤵
  PID:5352
- C:\Windows\System\DYvlqTT.exe
  C:\Windows\System\DYvlqTT.exe
  2⤵
  PID:5384
- C:\Windows\System\JzzZAgf.exe
  C:\Windows\System\JzzZAgf.exe
  2⤵
  PID:5408
- C:\Windows\System\LmtDtYW.exe
  C:\Windows\System\LmtDtYW.exe
  2⤵
  PID:5444
- C:\Windows\System\iQwkrOb.exe
  C:\Windows\System\iQwkrOb.exe
  2⤵
  PID:5480
- C:\Windows\System\kETTkkB.exe
  C:\Windows\System\kETTkkB.exe
  2⤵
  PID:5508
- C:\Windows\System\ZsJUhQi.exe
  C:\Windows\System\ZsJUhQi.exe
  2⤵
  PID:5548
- C:\Windows\System\DjmURwm.exe
  C:\Windows\System\DjmURwm.exe
  2⤵
  PID:5564
- C:\Windows\System\qMWNhnN.exe
  C:\Windows\System\qMWNhnN.exe
  2⤵
  PID:5580
- C:\Windows\System\JOprwLg.exe
  C:\Windows\System\JOprwLg.exe
  2⤵
  PID:5612
- C:\Windows\System\osjjiSb.exe
  C:\Windows\System\osjjiSb.exe
  2⤵
  PID:5636
- C:\Windows\System\GgSWxRE.exe
  C:\Windows\System\GgSWxRE.exe
  2⤵
  PID:5676
- C:\Windows\System\nmDMTOj.exe
  C:\Windows\System\nmDMTOj.exe
  2⤵
  PID:5692
- C:\Windows\System\gQrNaPK.exe
  C:\Windows\System\gQrNaPK.exe
  2⤵
  PID:5720
- C:\Windows\System\yiGXyFP.exe
  C:\Windows\System\yiGXyFP.exe
  2⤵
  PID:5760
- C:\Windows\System\UereXqs.exe
  C:\Windows\System\UereXqs.exe
  2⤵
  PID:5788
- C:\Windows\System\EbjIAcU.exe
  C:\Windows\System\EbjIAcU.exe
  2⤵
  PID:5816
- C:\Windows\System\YeVhEyS.exe
  C:\Windows\System\YeVhEyS.exe
  2⤵
  PID:5848
- C:\Windows\System\WGBBQIg.exe
  C:\Windows\System\WGBBQIg.exe
  2⤵
  PID:5872
- C:\Windows\System\iZjQacV.exe
  C:\Windows\System\iZjQacV.exe
  2⤵
  PID:5904
- C:\Windows\System\RkjhyhL.exe
  C:\Windows\System\RkjhyhL.exe
  2⤵
  PID:5928
- C:\Windows\System\vnpJVqP.exe
  C:\Windows\System\vnpJVqP.exe
  2⤵
  PID:5952
- C:\Windows\System\ujNVhTD.exe
  C:\Windows\System\ujNVhTD.exe
  2⤵
  PID:5984
- C:\Windows\System\bhoRBev.exe
  C:\Windows\System\bhoRBev.exe
  2⤵
  PID:6012
- C:\Windows\System\hgLTkrI.exe
  C:\Windows\System\hgLTkrI.exe
  2⤵
  PID:6036
- C:\Windows\System\wqjDcyH.exe
  C:\Windows\System\wqjDcyH.exe
  2⤵
  PID:6064
- C:\Windows\System\LRoCoEy.exe
  C:\Windows\System\LRoCoEy.exe
  2⤵
  PID:6096
- C:\Windows\System\reLKIGm.exe
  C:\Windows\System\reLKIGm.exe
  2⤵
  PID:6124
- C:\Windows\System\vcQfndZ.exe
  C:\Windows\System\vcQfndZ.exe
  2⤵
  PID:5144
- C:\Windows\System\wbrfPZW.exe
  C:\Windows\System\wbrfPZW.exe
  2⤵
  PID:5184
- C:\Windows\System\DLlvyHG.exe
  C:\Windows\System\DLlvyHG.exe
  2⤵
  PID:5220
- C:\Windows\System\dIFHxID.exe
  C:\Windows\System\dIFHxID.exe
  2⤵
  PID:5292
- C:\Windows\System\IXmbhqt.exe
  C:\Windows\System\IXmbhqt.exe
  2⤵
  PID:5348
- C:\Windows\System\ZZLNZoD.exe
  C:\Windows\System\ZZLNZoD.exe
  2⤵
  PID:5460
- C:\Windows\System\BgVBEpn.exe
  C:\Windows\System\BgVBEpn.exe
  2⤵
  PID:5532
- C:\Windows\System\hfAOiBd.exe
  C:\Windows\System\hfAOiBd.exe
  2⤵
  PID:5592
- C:\Windows\System\cWoOsxD.exe
  C:\Windows\System\cWoOsxD.exe
  2⤵
  PID:5656
- C:\Windows\System\JEkuwSM.exe
  C:\Windows\System\JEkuwSM.exe
  2⤵
  PID:5744
- C:\Windows\System\wVHRtfn.exe
  C:\Windows\System\wVHRtfn.exe
  2⤵
  PID:5704
- C:\Windows\System\jrYXXDE.exe
  C:\Windows\System\jrYXXDE.exe
  2⤵
  PID:5804
- C:\Windows\System\qMdLhrI.exe
  C:\Windows\System\qMdLhrI.exe
  2⤵
  PID:5892
- C:\Windows\System\wRGQlCj.exe
  C:\Windows\System\wRGQlCj.exe
  2⤵
  PID:5972
- C:\Windows\System\xOSdqeQ.exe
  C:\Windows\System\xOSdqeQ.exe
  2⤵
  PID:6028
- C:\Windows\System\CxjGplo.exe
  C:\Windows\System\CxjGplo.exe
  2⤵
  PID:6116
- C:\Windows\System\PRmaafz.exe
  C:\Windows\System\PRmaafz.exe
  2⤵
  PID:6136
- C:\Windows\System\mkvEGiU.exe
  C:\Windows\System\mkvEGiU.exe
  2⤵
  PID:5200
- C:\Windows\System\OuNUphg.exe
  C:\Windows\System\OuNUphg.exe
  2⤵
  PID:5436
- C:\Windows\System\pkLNDBw.exe
  C:\Windows\System\pkLNDBw.exe
  2⤵
  PID:5556
- C:\Windows\System\ZCHzwng.exe
  C:\Windows\System\ZCHzwng.exe
  2⤵
  PID:5664
- C:\Windows\System\yzKDYqx.exe
  C:\Windows\System\yzKDYqx.exe
  2⤵
  PID:5832
- C:\Windows\System\mNcHPFn.exe
  C:\Windows\System\mNcHPFn.exe
  2⤵
  PID:6056
- C:\Windows\System\vbXusAj.exe
  C:\Windows\System\vbXusAj.exe
  2⤵
  PID:5316
- C:\Windows\System\WqMgvPl.exe
  C:\Windows\System\WqMgvPl.exe
  2⤵
  PID:5376
- C:\Windows\System\RfwWJHC.exe
  C:\Windows\System\RfwWJHC.exe
  2⤵
  PID:5688
- C:\Windows\System\pANBIsA.exe
  C:\Windows\System\pANBIsA.exe
  2⤵
  PID:5152
- C:\Windows\System\LRnoDiP.exe
  C:\Windows\System\LRnoDiP.exe
  2⤵
  PID:5732
- C:\Windows\System\wZARkjW.exe
  C:\Windows\System\wZARkjW.exe
  2⤵
  PID:6172
- C:\Windows\System\sFgtRCL.exe
  C:\Windows\System\sFgtRCL.exe
  2⤵
  PID:6204
- C:\Windows\System\ZkRqljb.exe
  C:\Windows\System\ZkRqljb.exe
  2⤵
  PID:6228
- C:\Windows\System\hyFUOXt.exe
  C:\Windows\System\hyFUOXt.exe
  2⤵
  PID:6252
- C:\Windows\System\LaRdRAQ.exe
  C:\Windows\System\LaRdRAQ.exe
  2⤵
  PID:6284
- C:\Windows\System\uOBVAwz.exe
  C:\Windows\System\uOBVAwz.exe
  2⤵
  PID:6316
- C:\Windows\System\pMSVnzy.exe
  C:\Windows\System\pMSVnzy.exe
  2⤵
  PID:6344
- C:\Windows\System\lqhmDZs.exe
  C:\Windows\System\lqhmDZs.exe
  2⤵
  PID:6360
- C:\Windows\System\fUMHjau.exe
  C:\Windows\System\fUMHjau.exe
  2⤵
  PID:6380
- C:\Windows\System\dkyYvkM.exe
  C:\Windows\System\dkyYvkM.exe
  2⤵
  PID:6404
- C:\Windows\System\DmQIUxD.exe
  C:\Windows\System\DmQIUxD.exe
  2⤵
  PID:6432
- C:\Windows\System\VHqYPqC.exe
  C:\Windows\System\VHqYPqC.exe
  2⤵
  PID:6460
- C:\Windows\System\mSWfwrg.exe
  C:\Windows\System\mSWfwrg.exe
  2⤵
  PID:6480
- C:\Windows\System\yQpnkVp.exe
  C:\Windows\System\yQpnkVp.exe
  2⤵
  PID:6516
- C:\Windows\System\JGmrjez.exe
  C:\Windows\System\JGmrjez.exe
  2⤵
  PID:6548
- C:\Windows\System\UMikuib.exe
  C:\Windows\System\UMikuib.exe
  2⤵
  PID:6576
- C:\Windows\System\Kvtesxj.exe
  C:\Windows\System\Kvtesxj.exe
  2⤵
  PID:6608
- C:\Windows\System\zyduUeH.exe
  C:\Windows\System\zyduUeH.exe
  2⤵
  PID:6636
- C:\Windows\System\jhUReSw.exe
  C:\Windows\System\jhUReSw.exe
  2⤵
  PID:6668
- C:\Windows\System\wRgfCQD.exe
  C:\Windows\System\wRgfCQD.exe
  2⤵
  PID:6692
- C:\Windows\System\UoFmVZd.exe
  C:\Windows\System\UoFmVZd.exe
  2⤵
  PID:6724
- C:\Windows\System\MPaMWFw.exe
  C:\Windows\System\MPaMWFw.exe
  2⤵
  PID:6764
- C:\Windows\System\mstmAlz.exe
  C:\Windows\System\mstmAlz.exe
  2⤵
  PID:6780
- C:\Windows\System\dnrWAYf.exe
  C:\Windows\System\dnrWAYf.exe
  2⤵
  PID:6808
- C:\Windows\System\DOPaTwE.exe
  C:\Windows\System\DOPaTwE.exe
  2⤵
  PID:6840
- C:\Windows\System\KnpCKVX.exe
  C:\Windows\System\KnpCKVX.exe
  2⤵
  PID:6876
- C:\Windows\System\umepMav.exe
  C:\Windows\System\umepMav.exe
  2⤵
  PID:6904
- C:\Windows\System\TScORuZ.exe
  C:\Windows\System\TScORuZ.exe
  2⤵
  PID:6936
- C:\Windows\System\CmpNQKm.exe
  C:\Windows\System\CmpNQKm.exe
  2⤵
  PID:6964
- C:\Windows\System\GBOeXig.exe
  C:\Windows\System\GBOeXig.exe
  2⤵
  PID:6996
- C:\Windows\System\sXFMXUD.exe
  C:\Windows\System\sXFMXUD.exe
  2⤵
  PID:7032
- C:\Windows\System\eTkDHiT.exe
  C:\Windows\System\eTkDHiT.exe
  2⤵
  PID:7048
- C:\Windows\System\GNVzsbb.exe
  C:\Windows\System\GNVzsbb.exe
  2⤵
  PID:7076
- C:\Windows\System\xWILRlG.exe
  C:\Windows\System\xWILRlG.exe
  2⤵
  PID:7104
- C:\Windows\System\iZHNDtY.exe
  C:\Windows\System\iZHNDtY.exe
  2⤵
  PID:7132
- C:\Windows\System\AUehXqB.exe
  C:\Windows\System\AUehXqB.exe
  2⤵
  PID:7160
- C:\Windows\System\TSXPuKL.exe
  C:\Windows\System\TSXPuKL.exe
  2⤵
  PID:5936
- C:\Windows\System\ndDlhuL.exe
  C:\Windows\System\ndDlhuL.exe
  2⤵
  PID:6220
- C:\Windows\System\bquBnVX.exe
  C:\Windows\System\bquBnVX.exe
  2⤵
  PID:6304
- C:\Windows\System\qXDWAtK.exe
  C:\Windows\System\qXDWAtK.exe
  2⤵
  PID:6372
- C:\Windows\System\NxigtlD.exe
  C:\Windows\System\NxigtlD.exe
  2⤵
  PID:6428
- C:\Windows\System\RNkygSz.exe
  C:\Windows\System\RNkygSz.exe
  2⤵
  PID:6424
- C:\Windows\System\QmXgOmB.exe
  C:\Windows\System\QmXgOmB.exe
  2⤵
  PID:6536
- C:\Windows\System\KKgbgNG.exe
  C:\Windows\System\KKgbgNG.exe
  2⤵
  PID:6628
- C:\Windows\System\lSLuHNW.exe
  C:\Windows\System\lSLuHNW.exe
  2⤵
  PID:6664
- C:\Windows\System\NstxvUg.exe
  C:\Windows\System\NstxvUg.exe
  2⤵
  PID:6740
- C:\Windows\System\NvmSSdT.exe
  C:\Windows\System\NvmSSdT.exe
  2⤵
  PID:6792
- C:\Windows\System\mkPqAOd.exe
  C:\Windows\System\mkPqAOd.exe
  2⤵
  PID:6860
- C:\Windows\System\lgHQKbL.exe
  C:\Windows\System\lgHQKbL.exe
  2⤵
  PID:6916
- C:\Windows\System\erKStHr.exe
  C:\Windows\System\erKStHr.exe
  2⤵
  PID:7016
- C:\Windows\System\iHODSMy.exe
  C:\Windows\System\iHODSMy.exe
  2⤵
  PID:7028
- C:\Windows\System\Ndntdoq.exe
  C:\Windows\System\Ndntdoq.exe
  2⤵
  PID:7144
- C:\Windows\System\Hvkrkna.exe
  C:\Windows\System\Hvkrkna.exe
  2⤵
  PID:6240
- C:\Windows\System\yeDkcII.exe
  C:\Windows\System\yeDkcII.exe
  2⤵
  PID:3080
- C:\Windows\System\hFcbDDZ.exe
  C:\Windows\System\hFcbDDZ.exe
  2⤵
  PID:6496
- C:\Windows\System\kQEJWuh.exe
  C:\Windows\System\kQEJWuh.exe
  2⤵
  PID:6568
- C:\Windows\System\arCjNzr.exe
  C:\Windows\System\arCjNzr.exe
  2⤵
  PID:6800
- C:\Windows\System\hUxRawV.exe
  C:\Windows\System\hUxRawV.exe
  2⤵
  PID:6796
- C:\Windows\System\CWGfgmL.exe
  C:\Windows\System\CWGfgmL.exe
  2⤵
  PID:7156
- C:\Windows\System\Xlgkgks.exe
  C:\Windows\System\Xlgkgks.exe
  2⤵
  PID:6244
- C:\Windows\System\EzalZjL.exe
  C:\Windows\System\EzalZjL.exe
  2⤵
  PID:6544
- C:\Windows\System\KCwlPcm.exe
  C:\Windows\System\KCwlPcm.exe
  2⤵
  PID:6584
- C:\Windows\System\kkoaCuz.exe
  C:\Windows\System\kkoaCuz.exe
  2⤵
  PID:7040
- C:\Windows\System\pzqZhgH.exe
  C:\Windows\System\pzqZhgH.exe
  2⤵
  PID:7192
- C:\Windows\System\EHWVQJa.exe
  C:\Windows\System\EHWVQJa.exe
  2⤵
  PID:7212
- C:\Windows\System\gqphukr.exe
  C:\Windows\System\gqphukr.exe
  2⤵
  PID:7232
- C:\Windows\System\CYzbHlN.exe
  C:\Windows\System\CYzbHlN.exe
  2⤵
  PID:7268
- C:\Windows\System\obzJcHb.exe
  C:\Windows\System\obzJcHb.exe
  2⤵
  PID:7296
- C:\Windows\System\epzYgyW.exe
  C:\Windows\System\epzYgyW.exe
  2⤵
  PID:7316
- C:\Windows\System\htuwjRP.exe
  C:\Windows\System\htuwjRP.exe
  2⤵
  PID:7356
- C:\Windows\System\dFnnRDN.exe
  C:\Windows\System\dFnnRDN.exe
  2⤵
  PID:7388
- C:\Windows\System\fcbqktd.exe
  C:\Windows\System\fcbqktd.exe
  2⤵
  PID:7408
- C:\Windows\System\iFyDZNA.exe
  C:\Windows\System\iFyDZNA.exe
  2⤵
  PID:7424
- C:\Windows\System\mwlSwiL.exe
  C:\Windows\System\mwlSwiL.exe
  2⤵
  PID:7460
- C:\Windows\System\vWHEQAL.exe
  C:\Windows\System\vWHEQAL.exe
  2⤵
  PID:7484
- C:\Windows\System\SnLlSEN.exe
  C:\Windows\System\SnLlSEN.exe
  2⤵
  PID:7516
- C:\Windows\System\rdSIxOO.exe
  C:\Windows\System\rdSIxOO.exe
  2⤵
  PID:7544
- C:\Windows\System\aEhtirB.exe
  C:\Windows\System\aEhtirB.exe
  2⤵
  PID:7588
- C:\Windows\System\cXzqrBv.exe
  C:\Windows\System\cXzqrBv.exe
  2⤵
  PID:7612
- C:\Windows\System\WprFCDh.exe
  C:\Windows\System\WprFCDh.exe
  2⤵
  PID:7644
- C:\Windows\System\cpsrNTD.exe
  C:\Windows\System\cpsrNTD.exe
  2⤵
  PID:7676
- C:\Windows\System\AxZZVlU.exe
  C:\Windows\System\AxZZVlU.exe
  2⤵
  PID:7704
- C:\Windows\System\vCfxOuy.exe
  C:\Windows\System\vCfxOuy.exe
  2⤵
  PID:7744
- C:\Windows\System\RBiwAEs.exe
  C:\Windows\System\RBiwAEs.exe
  2⤵
  PID:7772
- C:\Windows\System\yOahrel.exe
  C:\Windows\System\yOahrel.exe
  2⤵
  PID:7800
- C:\Windows\System\RXOoxKR.exe
  C:\Windows\System\RXOoxKR.exe
  2⤵
  PID:7824
- C:\Windows\System\pZrdHlh.exe
  C:\Windows\System\pZrdHlh.exe
  2⤵
  PID:7844
- C:\Windows\System\IaNvZtS.exe
  C:\Windows\System\IaNvZtS.exe
  2⤵
  PID:7872
- C:\Windows\System\qffPfBv.exe
  C:\Windows\System\qffPfBv.exe
  2⤵
  PID:7900
- C:\Windows\System\vnaaaMv.exe
  C:\Windows\System\vnaaaMv.exe
  2⤵
  PID:7932
- C:\Windows\System\auwKHyh.exe
  C:\Windows\System\auwKHyh.exe
  2⤵
  PID:7956
- C:\Windows\System\OpKbVgw.exe
  C:\Windows\System\OpKbVgw.exe
  2⤵
  PID:7984
- C:\Windows\System\EMpYUyO.exe
  C:\Windows\System\EMpYUyO.exe
  2⤵
  PID:8008
- C:\Windows\System\ixYgktp.exe
  C:\Windows\System\ixYgktp.exe
  2⤵
  PID:8040
- C:\Windows\System\IbOKHeF.exe
  C:\Windows\System\IbOKHeF.exe
  2⤵
  PID:8068
- C:\Windows\System\KVeLhoL.exe
  C:\Windows\System\KVeLhoL.exe
  2⤵
  PID:8096
- C:\Windows\System\lIvTEvo.exe
  C:\Windows\System\lIvTEvo.exe
  2⤵
  PID:8128
- C:\Windows\System\pFFHMxn.exe
  C:\Windows\System\pFFHMxn.exe
  2⤵
  PID:8148
- C:\Windows\System\CmNNNgb.exe
  C:\Windows\System\CmNNNgb.exe
  2⤵
  PID:8180
- C:\Windows\System\dUWMcnX.exe
  C:\Windows\System\dUWMcnX.exe
  2⤵
  PID:7172
- C:\Windows\System\gKIpIpZ.exe
  C:\Windows\System\gKIpIpZ.exe
  2⤵
  PID:7260
- C:\Windows\System\PzZVCtR.exe
  C:\Windows\System\PzZVCtR.exe
  2⤵
  PID:7312
- C:\Windows\System\XczLxLH.exe
  C:\Windows\System\XczLxLH.exe
  2⤵
  PID:7336
- C:\Windows\System\wQKnigJ.exe
  C:\Windows\System\wQKnigJ.exe
  2⤵
  PID:7456
- C:\Windows\System\eoSZCRQ.exe
  C:\Windows\System\eoSZCRQ.exe
  2⤵
  PID:6264
- C:\Windows\System\EQJOkwA.exe
  C:\Windows\System\EQJOkwA.exe
  2⤵
  PID:7524
- C:\Windows\System\UUUdrpI.exe
  C:\Windows\System\UUUdrpI.exe
  2⤵
  PID:7532
- C:\Windows\System\DrxjgxS.exe
  C:\Windows\System\DrxjgxS.exe
  2⤵
  PID:7656
- C:\Windows\System\GLkzZrm.exe
  C:\Windows\System\GLkzZrm.exe
  2⤵
  PID:7728
- C:\Windows\System\TYQyxIo.exe
  C:\Windows\System\TYQyxIo.exe
  2⤵
  PID:7788
- C:\Windows\System\mzdDBsa.exe
  C:\Windows\System\mzdDBsa.exe
  2⤵
  PID:7836
- C:\Windows\System\rBcekpv.exe
  C:\Windows\System\rBcekpv.exe
  2⤵
  PID:7884
- C:\Windows\System\bzaIPMv.exe
  C:\Windows\System\bzaIPMv.exe
  2⤵
  PID:7968
- C:\Windows\System\bHuJfFW.exe
  C:\Windows\System\bHuJfFW.exe
  2⤵
  PID:8020
- C:\Windows\System\JBoJFYf.exe
  C:\Windows\System\JBoJFYf.exe
  2⤵
  PID:8032
- C:\Windows\System\MUHMpoS.exe
  C:\Windows\System\MUHMpoS.exe
  2⤵
  PID:8116
- C:\Windows\System\IBAJlmJ.exe
  C:\Windows\System\IBAJlmJ.exe
  2⤵
  PID:6772
- C:\Windows\System\IgUBpIQ.exe
  C:\Windows\System\IgUBpIQ.exe
  2⤵
  PID:7208
- C:\Windows\System\cPSKjmA.exe
  C:\Windows\System\cPSKjmA.exe
  2⤵
  PID:7376
- C:\Windows\System\zVmLcCi.exe
  C:\Windows\System\zVmLcCi.exe
  2⤵
  PID:7608
- C:\Windows\System\zsglgUk.exe
  C:\Windows\System\zsglgUk.exe
  2⤵
  PID:7688
- C:\Windows\System\DTUXEEY.exe
  C:\Windows\System\DTUXEEY.exe
  2⤵
  PID:7892
- C:\Windows\System\HdBWtKD.exe
  C:\Windows\System\HdBWtKD.exe
  2⤵
  PID:8052
- C:\Windows\System\yeiZMNv.exe
  C:\Windows\System\yeiZMNv.exe
  2⤵
  PID:8136
- C:\Windows\System\LrvAznk.exe
  C:\Windows\System\LrvAznk.exe
  2⤵
  PID:7280
- C:\Windows\System\QqWKjgT.exe
  C:\Windows\System\QqWKjgT.exe
  2⤵
  PID:7364
- C:\Windows\System\SrzGkAs.exe
  C:\Windows\System\SrzGkAs.exe
  2⤵
  PID:8108
- C:\Windows\System\LFQwCQA.exe
  C:\Windows\System\LFQwCQA.exe
  2⤵
  PID:7952
- C:\Windows\System\fEghUBk.exe
  C:\Windows\System\fEghUBk.exe
  2⤵
  PID:8228
- C:\Windows\System\wqSotiZ.exe
  C:\Windows\System\wqSotiZ.exe
  2⤵
  PID:8268
- C:\Windows\System\BhIjVdU.exe
  C:\Windows\System\BhIjVdU.exe
  2⤵
  PID:8300
- C:\Windows\System\jeRRjQE.exe
  C:\Windows\System\jeRRjQE.exe
  2⤵
  PID:8332
- C:\Windows\System\xZbZRKs.exe
  C:\Windows\System\xZbZRKs.exe
  2⤵
  PID:8412
- C:\Windows\System\aqFVmLi.exe
  C:\Windows\System\aqFVmLi.exe
  2⤵
  PID:8444
- C:\Windows\System\RUhRYIB.exe
  C:\Windows\System\RUhRYIB.exe
  2⤵
  PID:8472
- C:\Windows\System\FHnoYfx.exe
  C:\Windows\System\FHnoYfx.exe
  2⤵
  PID:8496
- C:\Windows\System\BQMBopQ.exe
  C:\Windows\System\BQMBopQ.exe
  2⤵
  PID:8512
- C:\Windows\System\yenkLcA.exe
  C:\Windows\System\yenkLcA.exe
  2⤵
  PID:8544
- C:\Windows\System\TrRdSHH.exe
  C:\Windows\System\TrRdSHH.exe
  2⤵
  PID:8572
- C:\Windows\System\SCfJGuq.exe
  C:\Windows\System\SCfJGuq.exe
  2⤵
  PID:8600
- C:\Windows\System\VsxzxkD.exe
  C:\Windows\System\VsxzxkD.exe
  2⤵
  PID:8624
- C:\Windows\System\ykbtIFF.exe
  C:\Windows\System\ykbtIFF.exe
  2⤵
  PID:8644
- C:\Windows\System\GvYwMYx.exe
  C:\Windows\System\GvYwMYx.exe
  2⤵
  PID:8672
- C:\Windows\System\hCPYWfC.exe
  C:\Windows\System\hCPYWfC.exe
  2⤵
  PID:8708
- C:\Windows\System\ihTgvLA.exe
  C:\Windows\System\ihTgvLA.exe
  2⤵
  PID:8736
- C:\Windows\System\RiRzPej.exe
  C:\Windows\System\RiRzPej.exe
  2⤵
  PID:8768
- C:\Windows\System\kshbQwX.exe
  C:\Windows\System\kshbQwX.exe
  2⤵
  PID:8796
- C:\Windows\System\xjcFcYs.exe
  C:\Windows\System\xjcFcYs.exe
  2⤵
  PID:8824
- C:\Windows\System\yFJmTSU.exe
  C:\Windows\System\yFJmTSU.exe
  2⤵
  PID:8852
- C:\Windows\System\LAhinSj.exe
  C:\Windows\System\LAhinSj.exe
  2⤵
  PID:8880
- C:\Windows\System\kwlzXSN.exe
  C:\Windows\System\kwlzXSN.exe
  2⤵
  PID:8908
- C:\Windows\System\cZFGZAA.exe
  C:\Windows\System\cZFGZAA.exe
  2⤵
  PID:8928
- C:\Windows\System\wXnDFOX.exe
  C:\Windows\System\wXnDFOX.exe
  2⤵
  PID:8952
- C:\Windows\System\fubCvIw.exe
  C:\Windows\System\fubCvIw.exe
  2⤵
  PID:8968
- C:\Windows\System\sbpSBNr.exe
  C:\Windows\System\sbpSBNr.exe
  2⤵
  PID:9000
- C:\Windows\System\FcwwqfQ.exe
  C:\Windows\System\FcwwqfQ.exe
  2⤵
  PID:9036
- C:\Windows\System\oIiokNd.exe
  C:\Windows\System\oIiokNd.exe
  2⤵
  PID:9064
- C:\Windows\System\nZhcpCC.exe
  C:\Windows\System\nZhcpCC.exe
  2⤵
  PID:9080
- C:\Windows\System\gdTBogR.exe
  C:\Windows\System\gdTBogR.exe
  2⤵
  PID:9112
- C:\Windows\System\EXrEtqc.exe
  C:\Windows\System\EXrEtqc.exe
  2⤵
  PID:9144
- C:\Windows\System\gqNXdNv.exe
  C:\Windows\System\gqNXdNv.exe
  2⤵
  PID:9176
- C:\Windows\System\kuiaTKF.exe
  C:\Windows\System\kuiaTKF.exe
  2⤵
  PID:9192
- C:\Windows\System\MXFrqZh.exe
  C:\Windows\System\MXFrqZh.exe
  2⤵
  PID:7304
- C:\Windows\System\NHGGGkf.exe
  C:\Windows\System\NHGGGkf.exe
  2⤵
  PID:7420
- C:\Windows\System\JuoAZrL.exe
  C:\Windows\System\JuoAZrL.exe
  2⤵
  PID:8216
- C:\Windows\System\wiOvGzb.exe
  C:\Windows\System\wiOvGzb.exe
  2⤵
  PID:8344
- C:\Windows\System\KdEMlHl.exe
  C:\Windows\System\KdEMlHl.exe
  2⤵
  PID:8432
- C:\Windows\System\DpPBAab.exe
  C:\Windows\System\DpPBAab.exe
  2⤵
  PID:8536
- C:\Windows\System\OTnqfNL.exe
  C:\Windows\System\OTnqfNL.exe
  2⤵
  PID:8592
- C:\Windows\System\NFVulDc.exe
  C:\Windows\System\NFVulDc.exe
  2⤵
  PID:8640
- C:\Windows\System\QfSwKve.exe
  C:\Windows\System\QfSwKve.exe
  2⤵
  PID:8720
- C:\Windows\System\OnanMOM.exe
  C:\Windows\System\OnanMOM.exe
  2⤵
  PID:8728
- C:\Windows\System\ZcvnrBN.exe
  C:\Windows\System\ZcvnrBN.exe
  2⤵
  PID:8836
- C:\Windows\System\bpRJjbQ.exe
  C:\Windows\System\bpRJjbQ.exe
  2⤵
  PID:8864
- C:\Windows\System\NuUHQoj.exe
  C:\Windows\System\NuUHQoj.exe
  2⤵
  PID:8924
- C:\Windows\System\oXmgEyc.exe
  C:\Windows\System\oXmgEyc.exe
  2⤵
  PID:9024
- C:\Windows\System\dkWtGSC.exe
  C:\Windows\System\dkWtGSC.exe
  2⤵
  PID:9092
- C:\Windows\System\iiaPxAm.exe
  C:\Windows\System\iiaPxAm.exe
  2⤵
  PID:9104
- C:\Windows\System\kjlKncd.exe
  C:\Windows\System\kjlKncd.exe
  2⤵
  PID:8288
- C:\Windows\System\hGrezpp.exe
  C:\Windows\System\hGrezpp.exe
  2⤵
  PID:7620
- C:\Windows\System\OpOVJPo.exe
  C:\Windows\System\OpOVJPo.exe
  2⤵
  PID:7448
- C:\Windows\System\qjAUsjn.exe
  C:\Windows\System\qjAUsjn.exe
  2⤵
  PID:8464
- C:\Windows\System\hXUgvNV.exe
  C:\Windows\System\hXUgvNV.exe
  2⤵
  PID:8656
- C:\Windows\System\rCzDuge.exe
  C:\Windows\System\rCzDuge.exe
  2⤵
  PID:8948
- C:\Windows\System\yLKMwRD.exe
  C:\Windows\System\yLKMwRD.exe
  2⤵
  PID:7664
- C:\Windows\System\BhrRssc.exe
  C:\Windows\System\BhrRssc.exe
  2⤵
  PID:9164
- C:\Windows\System\ZQnmBoA.exe
  C:\Windows\System\ZQnmBoA.exe
  2⤵
  PID:8312
- C:\Windows\System\QucCqCl.exe
  C:\Windows\System\QucCqCl.exe
  2⤵
  PID:8840
- C:\Windows\System\DhKZJBq.exe
  C:\Windows\System\DhKZJBq.exe
  2⤵
  PID:8084
- C:\Windows\System\cqClvro.exe
  C:\Windows\System\cqClvro.exe
  2⤵
  PID:9232
- C:\Windows\System\LFnqcmQ.exe
  C:\Windows\System\LFnqcmQ.exe
  2⤵
  PID:9256
- C:\Windows\System\vkjomKw.exe
  C:\Windows\System\vkjomKw.exe
  2⤵
  PID:9280
- C:\Windows\System\lzaECUt.exe
  C:\Windows\System\lzaECUt.exe
  2⤵
  PID:9312
- C:\Windows\System\HkTvRZV.exe
  C:\Windows\System\HkTvRZV.exe
  2⤵
  PID:9336
- C:\Windows\System\pfTkCYe.exe
  C:\Windows\System\pfTkCYe.exe
  2⤵
  PID:9372
- C:\Windows\System\wUXNraP.exe
  C:\Windows\System\wUXNraP.exe
  2⤵
  PID:9396
- C:\Windows\System\lxqfiJO.exe
  C:\Windows\System\lxqfiJO.exe
  2⤵
  PID:9412
- C:\Windows\System\wTvTfNe.exe
  C:\Windows\System\wTvTfNe.exe
  2⤵
  PID:9440
- C:\Windows\System\vSCCkiY.exe
  C:\Windows\System\vSCCkiY.exe
  2⤵
  PID:9472
- C:\Windows\System\peCzPxG.exe
  C:\Windows\System\peCzPxG.exe
  2⤵
  PID:9504
- C:\Windows\System\OGGYcZZ.exe
  C:\Windows\System\OGGYcZZ.exe
  2⤵
  PID:9536
- C:\Windows\System\lGKKvAL.exe
  C:\Windows\System\lGKKvAL.exe
  2⤵
  PID:9552
- C:\Windows\System\AAgZAEU.exe
  C:\Windows\System\AAgZAEU.exe
  2⤵
  PID:9580
- C:\Windows\System\xTMBvFZ.exe
  C:\Windows\System\xTMBvFZ.exe
  2⤵
  PID:9596
- C:\Windows\System\pDxDQNB.exe
  C:\Windows\System\pDxDQNB.exe
  2⤵
  PID:9632
- C:\Windows\System\cePmJxx.exe
  C:\Windows\System\cePmJxx.exe
  2⤵
  PID:9660
- C:\Windows\System\TdtGFUp.exe
  C:\Windows\System\TdtGFUp.exe
  2⤵
  PID:9696
- C:\Windows\System\lYxJJRI.exe
  C:\Windows\System\lYxJJRI.exe
  2⤵
  PID:9720
- C:\Windows\System\DwOwnGY.exe
  C:\Windows\System\DwOwnGY.exe
  2⤵
  PID:9744
- C:\Windows\System\cOZdmTR.exe
  C:\Windows\System\cOZdmTR.exe
  2⤵
  PID:9776
- C:\Windows\System\yrUOSoR.exe
  C:\Windows\System\yrUOSoR.exe
  2⤵
  PID:9808
- C:\Windows\System\QAqtURN.exe
  C:\Windows\System\QAqtURN.exe
  2⤵
  PID:9840
- C:\Windows\System\nUWpvBj.exe
  C:\Windows\System\nUWpvBj.exe
  2⤵
  PID:9872
- C:\Windows\System\iNWatcN.exe
  C:\Windows\System\iNWatcN.exe
  2⤵
  PID:9900
- C:\Windows\System\lFEdoMI.exe
  C:\Windows\System\lFEdoMI.exe
  2⤵
  PID:9924
- C:\Windows\System\pAvjYiL.exe
  C:\Windows\System\pAvjYiL.exe
  2⤵
  PID:9944
- C:\Windows\System\NxUYzHh.exe
  C:\Windows\System\NxUYzHh.exe
  2⤵
  PID:9968
- C:\Windows\System\ajYFFcE.exe
  C:\Windows\System\ajYFFcE.exe
  2⤵
  PID:9996
- C:\Windows\System\mtgynze.exe
  C:\Windows\System\mtgynze.exe
  2⤵
  PID:10028
- C:\Windows\System\jEGVteW.exe
  C:\Windows\System\jEGVteW.exe
  2⤵
  PID:10056
- C:\Windows\System\IciBOex.exe
  C:\Windows\System\IciBOex.exe
  2⤵
  PID:10080
- C:\Windows\System\NpwegyH.exe
  C:\Windows\System\NpwegyH.exe
  2⤵
  PID:10112
- C:\Windows\System\nitaCrv.exe
  C:\Windows\System\nitaCrv.exe
  2⤵
  PID:10144
- C:\Windows\System\OTdvNVB.exe
  C:\Windows\System\OTdvNVB.exe
  2⤵
  PID:10180
- C:\Windows\System\dynWAnd.exe
  C:\Windows\System\dynWAnd.exe
  2⤵
  PID:10200
- C:\Windows\System\vRQUPPy.exe
  C:\Windows\System\vRQUPPy.exe
  2⤵
  PID:10228
- C:\Windows\System\OJLnDGY.exe
  C:\Windows\System\OJLnDGY.exe
  2⤵
  PID:9228
- C:\Windows\System\EUnoYPV.exe
  C:\Windows\System\EUnoYPV.exe
  2⤵
  PID:9252
- C:\Windows\System\YvxBlbt.exe
  C:\Windows\System\YvxBlbt.exe
  2⤵
  PID:9332
- C:\Windows\System\ShwWJwJ.exe
  C:\Windows\System\ShwWJwJ.exe
  2⤵
  PID:9360
- C:\Windows\System\ocOlpSN.exe
  C:\Windows\System\ocOlpSN.exe
  2⤵
  PID:9424
- C:\Windows\System\bObVwXe.exe
  C:\Windows\System\bObVwXe.exe
  2⤵
  PID:9528
- C:\Windows\System\JQnKeyA.exe
  C:\Windows\System\JQnKeyA.exe
  2⤵
  PID:9680
- C:\Windows\System\GpStvOy.exe
  C:\Windows\System\GpStvOy.exe
  2⤵
  PID:9648
- C:\Windows\System\WTeAtjN.exe
  C:\Windows\System\WTeAtjN.exe
  2⤵
  PID:9732
- C:\Windows\System\tybvmQI.exe
  C:\Windows\System\tybvmQI.exe
  2⤵
  PID:9792
- C:\Windows\System\haNYjZl.exe
  C:\Windows\System\haNYjZl.exe
  2⤵
  PID:9868
- C:\Windows\System\HXhZPMY.exe
  C:\Windows\System\HXhZPMY.exe
  2⤵
  PID:9960
- C:\Windows\System\kDjewkO.exe
  C:\Windows\System\kDjewkO.exe
  2⤵
  PID:9956
- C:\Windows\System\fOMjKVK.exe
  C:\Windows\System\fOMjKVK.exe
  2⤵
  PID:10104
- C:\Windows\System\BYFluAj.exe
  C:\Windows\System\BYFluAj.exe
  2⤵
  PID:10164
- C:\Windows\System\JPaIxnV.exe
  C:\Windows\System\JPaIxnV.exe
  2⤵
  PID:10188
- C:\Windows\System\JSTQsOv.exe
  C:\Windows\System\JSTQsOv.exe
  2⤵
  PID:8508
- C:\Windows\System\mGzgSyJ.exe
  C:\Windows\System\mGzgSyJ.exe
  2⤵
  PID:9296
- C:\Windows\System\lAiScfg.exe
  C:\Windows\System\lAiScfg.exe
  2⤵
  PID:9368
- C:\Windows\System\iualnVT.exe
  C:\Windows\System\iualnVT.exe
  2⤵
  PID:9672
- C:\Windows\System\CODaBNF.exe
  C:\Windows\System\CODaBNF.exe
  2⤵
  PID:9888
- C:\Windows\System\doaFmtz.exe
  C:\Windows\System\doaFmtz.exe
  2⤵
  PID:9920
- C:\Windows\System\FllCJMp.exe
  C:\Windows\System\FllCJMp.exe
  2⤵
  PID:10160
- C:\Windows\System\aJKGQcX.exe
  C:\Windows\System\aJKGQcX.exe
  2⤵
  PID:8992
- C:\Windows\System\AQnvDxY.exe
  C:\Windows\System\AQnvDxY.exe
  2⤵
  PID:9736
- C:\Windows\System\ygqqlrg.exe
  C:\Windows\System\ygqqlrg.exe
  2⤵
  PID:9860
- C:\Windows\System\wLbkFdL.exe
  C:\Windows\System\wLbkFdL.exe
  2⤵
  PID:9588
- C:\Windows\System\kToePsR.exe
  C:\Windows\System\kToePsR.exe
  2⤵
  PID:10052
- C:\Windows\System\MVeikih.exe
  C:\Windows\System\MVeikih.exe
  2⤵
  PID:10264
- C:\Windows\System\MwhOtzN.exe
  C:\Windows\System\MwhOtzN.exe
  2⤵
  PID:10288
- C:\Windows\System\bUYfVdn.exe
  C:\Windows\System\bUYfVdn.exe
  2⤵
  PID:10308
- C:\Windows\System\kRUGOsb.exe
  C:\Windows\System\kRUGOsb.exe
  2⤵
  PID:10348
- C:\Windows\System\utUKOGx.exe
  C:\Windows\System\utUKOGx.exe
  2⤵
  PID:10364
- C:\Windows\System\hdBhFxE.exe
  C:\Windows\System\hdBhFxE.exe
  2⤵
  PID:10396
- C:\Windows\System\vSSLifp.exe
  C:\Windows\System\vSSLifp.exe
  2⤵
  PID:10412
- C:\Windows\System\zwWnEpO.exe
  C:\Windows\System\zwWnEpO.exe
  2⤵
  PID:10444
- C:\Windows\System\hzwHZsl.exe
  C:\Windows\System\hzwHZsl.exe
  2⤵
  PID:10468
- C:\Windows\System\WiisFNf.exe
  C:\Windows\System\WiisFNf.exe
  2⤵
  PID:10496
- C:\Windows\System\KOtSSnt.exe
  C:\Windows\System\KOtSSnt.exe
  2⤵
  PID:10520
- C:\Windows\System\stqzvfg.exe
  C:\Windows\System\stqzvfg.exe
  2⤵
  PID:10552
- C:\Windows\System\balCUwk.exe
  C:\Windows\System\balCUwk.exe
  2⤵
  PID:10584
- C:\Windows\System\njZkZhu.exe
  C:\Windows\System\njZkZhu.exe
  2⤵
  PID:10620
- C:\Windows\System\ZkElekS.exe
  C:\Windows\System\ZkElekS.exe
  2⤵
  PID:10660
- C:\Windows\System\zsiZlYB.exe
  C:\Windows\System\zsiZlYB.exe
  2⤵
  PID:10680
- C:\Windows\System\UeuwQMr.exe
  C:\Windows\System\UeuwQMr.exe
  2⤵
  PID:10704
- C:\Windows\System\Sjpbnii.exe
  C:\Windows\System\Sjpbnii.exe
  2⤵
  PID:10736
- C:\Windows\System\HNBTvbS.exe
  C:\Windows\System\HNBTvbS.exe
  2⤵
  PID:10760
- C:\Windows\System\jFhyiIV.exe
  C:\Windows\System\jFhyiIV.exe
  2⤵
  PID:10800
- C:\Windows\System\hiWbbcz.exe
  C:\Windows\System\hiWbbcz.exe
  2⤵
  PID:10828
- C:\Windows\System\nDNkefR.exe
  C:\Windows\System\nDNkefR.exe
  2⤵
  PID:10856
- C:\Windows\System\kBxlOKr.exe
  C:\Windows\System\kBxlOKr.exe
  2⤵
  PID:10876
- C:\Windows\System\mrlvdVD.exe
  C:\Windows\System\mrlvdVD.exe
  2⤵
  PID:10900
- C:\Windows\System\FKOrfSQ.exe
  C:\Windows\System\FKOrfSQ.exe
  2⤵
  PID:10940
- C:\Windows\System\HkbVmue.exe
  C:\Windows\System\HkbVmue.exe
  2⤵
  PID:10968
- C:\Windows\System\tmEsXiC.exe
  C:\Windows\System\tmEsXiC.exe
  2⤵
  PID:10988
- C:\Windows\System\kHFMExB.exe
  C:\Windows\System\kHFMExB.exe
  2⤵
  PID:11024
- C:\Windows\System\WPhFzfU.exe
  C:\Windows\System\WPhFzfU.exe
  2⤵
  PID:11040
- C:\Windows\System\UUglEan.exe
  C:\Windows\System\UUglEan.exe
  2⤵
  PID:11076
- C:\Windows\System\SItgMyN.exe
  C:\Windows\System\SItgMyN.exe
  2⤵
  PID:11096
- C:\Windows\System\YmJZXoM.exe
  C:\Windows\System\YmJZXoM.exe
  2⤵
  PID:11124
- C:\Windows\System\RNiYmTk.exe
  C:\Windows\System\RNiYmTk.exe
  2⤵
  PID:11144
- C:\Windows\System\JfmwzMV.exe
  C:\Windows\System\JfmwzMV.exe
  2⤵
  PID:11168
- C:\Windows\System\SNtwXiQ.exe
  C:\Windows\System\SNtwXiQ.exe
  2⤵
  PID:11196
- C:\Windows\System\kcZTpZK.exe
  C:\Windows\System\kcZTpZK.exe
  2⤵
  PID:11216
- C:\Windows\System\uvPseND.exe
  C:\Windows\System\uvPseND.exe
  2⤵
  PID:11244
- C:\Windows\System\KoLFIBh.exe
  C:\Windows\System\KoLFIBh.exe
  2⤵
  PID:9244
- C:\Windows\System\wMxItmA.exe
  C:\Windows\System\wMxItmA.exe
  2⤵
  PID:10320
- C:\Windows\System\eZVmYEr.exe
  C:\Windows\System\eZVmYEr.exe
  2⤵
  PID:10356
- C:\Windows\System\NeQSLvz.exe
  C:\Windows\System\NeQSLvz.exe
  2⤵
  PID:10436
- C:\Windows\System\ZZYvEOV.exe
  C:\Windows\System\ZZYvEOV.exe
  2⤵
  PID:9308
- C:\Windows\System\DroKKPv.exe
  C:\Windows\System\DroKKPv.exe
  2⤵
  PID:10596
- C:\Windows\System\ejcwbzP.exe
  C:\Windows\System\ejcwbzP.exe
  2⤵
  PID:10644
- C:\Windows\System\JfFysiP.exe
  C:\Windows\System\JfFysiP.exe
  2⤵
  PID:10676
- C:\Windows\System\XHEWlOq.exe
  C:\Windows\System\XHEWlOq.exe
  2⤵
  PID:10716
- C:\Windows\System\uBZGDLB.exe
  C:\Windows\System\uBZGDLB.exe
  2⤵
  PID:10848
- C:\Windows\System\sNPquIY.exe
  C:\Windows\System\sNPquIY.exe
  2⤵
  PID:10912
- C:\Windows\System\iTvKKdr.exe
  C:\Windows\System\iTvKKdr.exe
  2⤵
  PID:10960
- C:\Windows\System\rdTMPQI.exe
  C:\Windows\System\rdTMPQI.exe
  2⤵
  PID:11036
- C:\Windows\System\tjcgbXC.exe
  C:\Windows\System\tjcgbXC.exe
  2⤵
  PID:11088
- C:\Windows\System\wPbaefh.exe
  C:\Windows\System\wPbaefh.exe
  2⤵
  PID:11136
- C:\Windows\System\Teschap.exe
  C:\Windows\System\Teschap.exe
  2⤵
  PID:11188
- C:\Windows\System\KAntLAw.exe
  C:\Windows\System\KAntLAw.exe
  2⤵
  PID:11236
- C:\Windows\System\RhclvOv.exe
  C:\Windows\System\RhclvOv.exe
  2⤵
  PID:10484
- C:\Windows\System\ryeHOJj.exe
  C:\Windows\System\ryeHOJj.exe
  2⤵
  PID:10512
- C:\Windows\System\GklcQyi.exe
  C:\Windows\System\GklcQyi.exe
  2⤵
  PID:10488
- C:\Windows\System\IWogmlJ.exe
  C:\Windows\System\IWogmlJ.exe
  2⤵
  PID:10932
- C:\Windows\System\KhnEUGo.exe
  C:\Windows\System\KhnEUGo.exe
  2⤵
  PID:11032
- C:\Windows\System\BkFvKiD.exe
  C:\Windows\System\BkFvKiD.exe
  2⤵
  PID:11140
- C:\Windows\System\kJBmVhl.exe
  C:\Windows\System\kJBmVhl.exe
  2⤵
  PID:10332
- C:\Windows\System\WZQClyK.exe
  C:\Windows\System\WZQClyK.exe
  2⤵
  PID:10568
- C:\Windows\System\GaOAQph.exe
  C:\Windows\System\GaOAQph.exe
  2⤵
  PID:10816
- C:\Windows\System\OwAQVzz.exe
  C:\Windows\System\OwAQVzz.exe
  2⤵
  PID:11280
- C:\Windows\System\LfBZOad.exe
  C:\Windows\System\LfBZOad.exe
  2⤵
  PID:11312
- C:\Windows\System\OEoJfvS.exe
  C:\Windows\System\OEoJfvS.exe
  2⤵
  PID:11340
- C:\Windows\System\zlKxKWY.exe
  C:\Windows\System\zlKxKWY.exe
  2⤵
  PID:11364
- C:\Windows\System\plWkEJz.exe
  C:\Windows\System\plWkEJz.exe
  2⤵
  PID:11388
- C:\Windows\System\VwfWpqI.exe
  C:\Windows\System\VwfWpqI.exe
  2⤵
  PID:11420
- C:\Windows\System\YFcZHMw.exe
  C:\Windows\System\YFcZHMw.exe
  2⤵
  PID:11440
- C:\Windows\System\xoFQNLb.exe
  C:\Windows\System\xoFQNLb.exe
  2⤵
  PID:11460
- C:\Windows\System\vTUgMgi.exe
  C:\Windows\System\vTUgMgi.exe
  2⤵
  PID:11488
- C:\Windows\System\BOJzDDg.exe
  C:\Windows\System\BOJzDDg.exe
  2⤵
  PID:11516
- C:\Windows\System\UPdaiTI.exe
  C:\Windows\System\UPdaiTI.exe
  2⤵
  PID:11544
- C:\Windows\System\KtzvMgL.exe
  C:\Windows\System\KtzvMgL.exe
  2⤵
  PID:11568
- C:\Windows\System\lrlAtUP.exe
  C:\Windows\System\lrlAtUP.exe
  2⤵
  PID:11596
- C:\Windows\System\GBpAkKh.exe
  C:\Windows\System\GBpAkKh.exe
  2⤵
  PID:11624
- C:\Windows\System\sNWjtGR.exe
  C:\Windows\System\sNWjtGR.exe
  2⤵
  PID:11648
- C:\Windows\System\ndsgnCs.exe
  C:\Windows\System\ndsgnCs.exe
  2⤵
  PID:11668
- C:\Windows\System\LeDpkhl.exe
  C:\Windows\System\LeDpkhl.exe
  2⤵
  PID:11700
- C:\Windows\System\XJolhVX.exe
  C:\Windows\System\XJolhVX.exe
  2⤵
  PID:11736
- C:\Windows\System\MvQjAGo.exe
  C:\Windows\System\MvQjAGo.exe
  2⤵
  PID:11764
- C:\Windows\System\KFlTwES.exe
  C:\Windows\System\KFlTwES.exe
  2⤵
  PID:11796
- C:\Windows\System\EqiTcvW.exe
  C:\Windows\System\EqiTcvW.exe
  2⤵
  PID:11824
- C:\Windows\System\KChOWFB.exe
  C:\Windows\System\KChOWFB.exe
  2⤵
  PID:11848
- C:\Windows\System\gBvrVVz.exe
  C:\Windows\System\gBvrVVz.exe
  2⤵
  PID:11876
- C:\Windows\System\rpGHXGy.exe
  C:\Windows\System\rpGHXGy.exe
  2⤵
  PID:11908
- C:\Windows\System\clGSxhB.exe
  C:\Windows\System\clGSxhB.exe
  2⤵
  PID:11948
- C:\Windows\System\BldEmxv.exe
  C:\Windows\System\BldEmxv.exe
  2⤵
  PID:11980
- C:\Windows\System\iZtdfyO.exe
  C:\Windows\System\iZtdfyO.exe
  2⤵
  PID:12008
- C:\Windows\System\dyVLkxA.exe
  C:\Windows\System\dyVLkxA.exe
  2⤵
  PID:12028
- C:\Windows\System\ChanhXV.exe
  C:\Windows\System\ChanhXV.exe
  2⤵
  PID:12060
- C:\Windows\System\fGIVnSL.exe
  C:\Windows\System\fGIVnSL.exe
  2⤵
  PID:12088
- C:\Windows\System\EOGFBCm.exe
  C:\Windows\System\EOGFBCm.exe
  2⤵
  PID:12116
- C:\Windows\System\tNNNNRM.exe
  C:\Windows\System\tNNNNRM.exe
  2⤵
  PID:12152
- C:\Windows\System\kQQuFVl.exe
  C:\Windows\System\kQQuFVl.exe
  2⤵
  PID:12180
- C:\Windows\System\WToZCnb.exe
  C:\Windows\System\WToZCnb.exe
  2⤵
  PID:12212
- C:\Windows\System\ufJWBJW.exe
  C:\Windows\System\ufJWBJW.exe
  2⤵
  PID:12228
- C:\Windows\System\ijcuMdW.exe
  C:\Windows\System\ijcuMdW.exe
  2⤵
  PID:12252
- C:\Windows\System\gFnBIXX.exe
  C:\Windows\System\gFnBIXX.exe
  2⤵
  PID:12276
- C:\Windows\System\zyVLdGm.exe
  C:\Windows\System\zyVLdGm.exe
  2⤵
  PID:10892
- C:\Windows\System\QjnLZRX.exe
  C:\Windows\System\QjnLZRX.exe
  2⤵
  PID:11304
- C:\Windows\System\uKCILki.exe
  C:\Windows\System\uKCILki.exe
  2⤵
  PID:11356
- C:\Windows\System\KiPpJyp.exe
  C:\Windows\System\KiPpJyp.exe
  2⤵
  PID:11376
- C:\Windows\System\ZHFquoT.exe
  C:\Windows\System\ZHFquoT.exe
  2⤵
  PID:11496
- C:\Windows\System\nUkWTAR.exe
  C:\Windows\System\nUkWTAR.exe
  2⤵
  PID:11448
- C:\Windows\System\kOwWLeE.exe
  C:\Windows\System\kOwWLeE.exe
  2⤵
  PID:11524
- C:\Windows\System\RwhbjLp.exe
  C:\Windows\System\RwhbjLp.exe
  2⤵
  PID:11684
- C:\Windows\System\KMyBVbi.exe
  C:\Windows\System\KMyBVbi.exe
  2⤵
  PID:11724
- C:\Windows\System\kTNVNBX.exe
  C:\Windows\System\kTNVNBX.exe
  2⤵
  PID:11772
- C:\Windows\System\sUOnGpY.exe
  C:\Windows\System\sUOnGpY.exe
  2⤵
  PID:11864
- C:\Windows\System\DsmqZnR.exe
  C:\Windows\System\DsmqZnR.exe
  2⤵
  PID:11960
- C:\Windows\System\zCilJae.exe
  C:\Windows\System\zCilJae.exe
  2⤵
  PID:12004
- C:\Windows\System\AVAjgcy.exe
  C:\Windows\System\AVAjgcy.exe
  2⤵
  PID:12044
- C:\Windows\System\TsXvRKz.exe
  C:\Windows\System\TsXvRKz.exe
  2⤵
  PID:12072
- C:\Windows\System\pWDWwIs.exe
  C:\Windows\System\pWDWwIs.exe
  2⤵
  PID:12176
- C:\Windows\System\uKWVQdz.exe
  C:\Windows\System\uKWVQdz.exe
  2⤵
  PID:12200
- C:\Windows\System\hqsGIzh.exe
  C:\Windows\System\hqsGIzh.exe
  2⤵
  PID:10376
- C:\Windows\System\PSsuwHv.exe
  C:\Windows\System\PSsuwHv.exe
  2⤵
  PID:11564
- C:\Windows\System\FDhPXMn.exe
  C:\Windows\System\FDhPXMn.exe
  2⤵
  PID:11404
- C:\Windows\System\psoRcvK.exe
  C:\Windows\System\psoRcvK.exe
  2⤵
  PID:11536
- C:\Windows\System\fJzocki.exe
  C:\Windows\System\fJzocki.exe
  2⤵
  PID:11748
- C:\Windows\System\jAKBHFq.exe
  C:\Windows\System\jAKBHFq.exe
  2⤵
  PID:11928
- C:\Windows\System\UWMMhIq.exe
  C:\Windows\System\UWMMhIq.exe
  2⤵
  PID:12240
- C:\Windows\System\KGJTvDu.exe
  C:\Windows\System\KGJTvDu.exe
  2⤵
  PID:12264
- C:\Windows\System\KEOWToq.exe
  C:\Windows\System\KEOWToq.exe
  2⤵
  PID:11164
- C:\Windows\System\OBcxbyj.exe
  C:\Windows\System\OBcxbyj.exe
  2⤵
  PID:12292
- C:\Windows\System\tiSwCis.exe
  C:\Windows\System\tiSwCis.exe
  2⤵
  PID:12312
- C:\Windows\System\OdRQVOu.exe
  C:\Windows\System\OdRQVOu.exe
  2⤵
  PID:12344
- C:\Windows\System\FFCSxOL.exe
  C:\Windows\System\FFCSxOL.exe
  2⤵
  PID:12364
- C:\Windows\System\jItrfDD.exe
  C:\Windows\System\jItrfDD.exe
  2⤵
  PID:12396
- C:\Windows\System\ZzvezpZ.exe
  C:\Windows\System\ZzvezpZ.exe
  2⤵
  PID:12424
- C:\Windows\System\kDQYblr.exe
  C:\Windows\System\kDQYblr.exe
  2⤵
  PID:12456
- C:\Windows\System\jTaDnwN.exe
  C:\Windows\System\jTaDnwN.exe
  2⤵
  PID:12484
- C:\Windows\System\RKuIHOa.exe
  C:\Windows\System\RKuIHOa.exe
  2⤵
  PID:12508
- C:\Windows\System\MuzXnZu.exe
  C:\Windows\System\MuzXnZu.exe
  2⤵
  PID:12536
- C:\Windows\System\dIXnnaK.exe
  C:\Windows\System\dIXnnaK.exe
  2⤵
  PID:12564
- C:\Windows\System\PcCqfQS.exe
  C:\Windows\System\PcCqfQS.exe
  2⤵
  PID:12592
- C:\Windows\System\gSqtcDQ.exe
  C:\Windows\System\gSqtcDQ.exe
  2⤵
  PID:12628
- C:\Windows\System\yzYcppg.exe
  C:\Windows\System\yzYcppg.exe
  2⤵
  PID:12668
- C:\Windows\System\DsTELvS.exe
  C:\Windows\System\DsTELvS.exe
  2⤵
  PID:12692
- C:\Windows\System\NzAShbH.exe
  C:\Windows\System\NzAShbH.exe
  2⤵
  PID:12720
- C:\Windows\System\dyDxffa.exe
  C:\Windows\System\dyDxffa.exe
  2⤵
  PID:12736
- C:\Windows\System\YqhTudG.exe
  C:\Windows\System\YqhTudG.exe
  2⤵
  PID:12760
- C:\Windows\System\hfBxmzt.exe
  C:\Windows\System\hfBxmzt.exe
  2⤵
  PID:12780
- C:\Windows\System\wjIAMsC.exe
  C:\Windows\System\wjIAMsC.exe
  2⤵
  PID:12808
- C:\Windows\System\MgMKfKZ.exe
  C:\Windows\System\MgMKfKZ.exe
  2⤵
  PID:12836
- C:\Windows\System\NOHUCKq.exe
  C:\Windows\System\NOHUCKq.exe
  2⤵
  PID:12868
- C:\Windows\System\kHfuxKj.exe
  C:\Windows\System\kHfuxKj.exe
  2⤵
  PID:12904
- C:\Windows\System\pulyUoO.exe
  C:\Windows\System\pulyUoO.exe
  2⤵
  PID:12920
- C:\Windows\System\PPOSUxa.exe
  C:\Windows\System\PPOSUxa.exe
  2⤵
  PID:12944
- C:\Windows\System\Kcazwjv.exe
  C:\Windows\System\Kcazwjv.exe
  2⤵
  PID:12972
- C:\Windows\System\beIpLpY.exe
  C:\Windows\System\beIpLpY.exe
  2⤵
  PID:13000
- C:\Windows\System\HCpuvbt.exe
  C:\Windows\System\HCpuvbt.exe
  2⤵
  PID:13116
- C:\Windows\System\PgmyaAB.exe
  C:\Windows\System\PgmyaAB.exe
  2⤵
  PID:13132
- C:\Windows\System\KmctuNT.exe
  C:\Windows\System\KmctuNT.exe
  2⤵
  PID:13156
- C:\Windows\System\JRxaFoe.exe
  C:\Windows\System\JRxaFoe.exe
  2⤵
  PID:13176
- C:\Windows\System\jPsVDQj.exe
  C:\Windows\System\jPsVDQj.exe
  2⤵
  PID:13196
- C:\Windows\System\ljbIhac.exe
  C:\Windows\System\ljbIhac.exe
  2⤵
  PID:13224
- C:\Windows\System\JuqdmVj.exe
  C:\Windows\System\JuqdmVj.exe
  2⤵
  PID:13248
- C:\Windows\System\bEppoYv.exe
  C:\Windows\System\bEppoYv.exe
  2⤵
  PID:13272
- C:\Windows\System\QppyWJb.exe
  C:\Windows\System\QppyWJb.exe
  2⤵
  PID:13300
- C:\Windows\System\tjOYulO.exe
  C:\Windows\System\tjOYulO.exe
  2⤵
  PID:11664
- C:\Windows\System\oEQuvGK.exe
  C:\Windows\System\oEQuvGK.exe
  2⤵
  PID:11872
- C:\Windows\System\xOVozel.exe
  C:\Windows\System\xOVozel.exe
  2⤵
  PID:11412
- C:\Windows\System\kIAvbhg.exe
  C:\Windows\System\kIAvbhg.exe
  2⤵
  PID:12380
- C:\Windows\System\MIOSNMR.exe
  C:\Windows\System\MIOSNMR.exe
  2⤵
  PID:12500
- C:\Windows\System\IbQZKTv.exe
  C:\Windows\System\IbQZKTv.exe
  2⤵
  PID:12604
- C:\Windows\System\NuPGKmh.exe
  C:\Windows\System\NuPGKmh.exe
  2⤵
  PID:12640
- C:\Windows\System\TnqfNgE.exe
  C:\Windows\System\TnqfNgE.exe
  2⤵
  PID:12612
- C:\Windows\System\obFFagT.exe
  C:\Windows\System\obFFagT.exe
  2⤵
  PID:12616
- C:\Windows\System\oMGBFNV.exe
  C:\Windows\System\oMGBFNV.exe
  2⤵
  PID:12768
- C:\Windows\System\PqlqVIR.exe
  C:\Windows\System\PqlqVIR.exe
  2⤵
  PID:12792
- C:\Windows\System\MxGLqcN.exe
  C:\Windows\System\MxGLqcN.exe
  2⤵
  PID:12968
- C:\Windows\System\nUSBgIw.exe
  C:\Windows\System\nUSBgIw.exe
  2⤵
  PID:12956
- C:\Windows\System\GQkLTUJ.exe
  C:\Windows\System\GQkLTUJ.exe
  2⤵
  PID:13032
- C:\Windows\System\rbybQMn.exe
  C:\Windows\System\rbybQMn.exe
  2⤵
  PID:11348
- C:\Windows\System\qhLLwco.exe
  C:\Windows\System\qhLLwco.exe
  2⤵
  PID:13220
- C:\Windows\System\xwPCkib.exe
  C:\Windows\System\xwPCkib.exe
  2⤵
  PID:13212
- C:\Windows\System\NfcDHJJ.exe
  C:\Windows\System\NfcDHJJ.exe
  2⤵
  PID:13284
- C:\Windows\System\arLIzTZ.exe
  C:\Windows\System\arLIzTZ.exe
  2⤵
  PID:12436
- C:\Windows\System\XKMrSCU.exe
  C:\Windows\System\XKMrSCU.exe
  2⤵
  PID:12524
- C:\Windows\System\tomUJrf.exe
  C:\Windows\System\tomUJrf.exe
  2⤵
  PID:12528
- C:\Windows\System\MVxIbVg.exe
  C:\Windows\System\MVxIbVg.exe
  2⤵
  PID:12644
- C:\Windows\System\XXzadFY.exe
  C:\Windows\System\XXzadFY.exe
  2⤵
  PID:12988
- C:\Windows\System\ghYyipX.exe
  C:\Windows\System\ghYyipX.exe
  2⤵
  PID:13104
- C:\Windows\System\HxlKMxy.exe
  C:\Windows\System\HxlKMxy.exe
  2⤵
  PID:13152
- C:\Windows\System\mCQAxKj.exe
  C:\Windows\System\mCQAxKj.exe
  2⤵
  PID:13296
- C:\Windows\System\YbYSnEv.exe
  C:\Windows\System\YbYSnEv.exe
  2⤵
  PID:12384
- C:\Windows\System\hmVapck.exe
  C:\Windows\System\hmVapck.exe
  2⤵
  PID:13208
- C:\Windows\System\edPpJbR.exe
  C:\Windows\System\edPpJbR.exe
  2⤵
  PID:13336
- C:\Windows\System\ltPhXri.exe
  C:\Windows\System\ltPhXri.exe
  2⤵
  PID:13360
- C:\Windows\System\wJlOlTK.exe
  C:\Windows\System\wJlOlTK.exe
  2⤵
  PID:13376
- C:\Windows\System\iaCJtLg.exe
  C:\Windows\System\iaCJtLg.exe
  2⤵
  PID:13404
- C:\Windows\System\pxDlhxT.exe
  C:\Windows\System\pxDlhxT.exe
  2⤵
  PID:13448
- C:\Windows\System\tkRnIjq.exe
  C:\Windows\System\tkRnIjq.exe
  2⤵
  PID:13464
- C:\Windows\System\kTwfcui.exe
  C:\Windows\System\kTwfcui.exe
  2⤵
  PID:13500
- C:\Windows\System\pHpaXcU.exe
  C:\Windows\System\pHpaXcU.exe
  2⤵
  PID:13528
- C:\Windows\System\OddEBEh.exe
  C:\Windows\System\OddEBEh.exe
  2⤵
  PID:13544
- C:\Windows\System\PJVQhCj.exe
  C:\Windows\System\PJVQhCj.exe
  2⤵
  PID:13564
- C:\Windows\System\IVJffyF.exe
  C:\Windows\System\IVJffyF.exe
  2⤵
  PID:13588
- C:\Windows\System\DWBASkX.exe
  C:\Windows\System\DWBASkX.exe
  2⤵
  PID:13612
- C:\Windows\System\qLZFpyq.exe
  C:\Windows\System\qLZFpyq.exe
  2⤵
  PID:13636
- C:\Windows\System\mSscBbo.exe
  C:\Windows\System\mSscBbo.exe
  2⤵
  PID:13664
- C:\Windows\System\dgfyZuD.exe
  C:\Windows\System\dgfyZuD.exe
  2⤵
  PID:13700
- C:\Windows\System\BexwTwe.exe
  C:\Windows\System\BexwTwe.exe
  2⤵
  PID:13732
- C:\Windows\System\FIcUnKk.exe
  C:\Windows\System\FIcUnKk.exe
  2⤵
  PID:13760
- C:\Windows\System\eWyvjMi.exe
  C:\Windows\System\eWyvjMi.exe
  2⤵
  PID:13796
- C:\Windows\System\rzfyMxJ.exe
  C:\Windows\System\rzfyMxJ.exe
  2⤵
  PID:13824
- C:\Windows\System\pjiHzRM.exe
  C:\Windows\System\pjiHzRM.exe
  2⤵
  PID:13852
- C:\Windows\System\axQMLwt.exe
  C:\Windows\System\axQMLwt.exe
  2⤵
  PID:13872
- C:\Windows\System\ZZrcOxk.exe
  C:\Windows\System\ZZrcOxk.exe
  2⤵
  PID:13896
- C:\Windows\System\OMnAMZN.exe
  C:\Windows\System\OMnAMZN.exe
  2⤵
  PID:13920
- C:\Windows\System\JdQplYA.exe
  C:\Windows\System\JdQplYA.exe
  2⤵
  PID:13948
- C:\Windows\System\sRTjsei.exe
  C:\Windows\System\sRTjsei.exe
  2⤵
  PID:13988
- C:\Windows\System\esLxKvV.exe
  C:\Windows\System\esLxKvV.exe
  2⤵
  PID:14012
- C:\Windows\System\ZOHCkBq.exe
  C:\Windows\System\ZOHCkBq.exe
  2⤵
  PID:14036
- C:\Windows\System\QEwNqEw.exe
  C:\Windows\System\QEwNqEw.exe
  2⤵
  PID:14068
- C:\Windows\System\JBLptcM.exe
  C:\Windows\System\JBLptcM.exe
  2⤵
  PID:14096
- C:\Windows\System\yytnlQP.exe
  C:\Windows\System\yytnlQP.exe
  2⤵
  PID:14124
- C:\Windows\System\UlJlfcx.exe
  C:\Windows\System\UlJlfcx.exe
  2⤵
  PID:14152
- C:\Windows\System\eiLglBe.exe
  C:\Windows\System\eiLglBe.exe
  2⤵
  PID:14188
- C:\Windows\System\KpYUVOk.exe
  C:\Windows\System\KpYUVOk.exe
  2⤵
  PID:14212
- C:\Windows\System\AZhxqTE.exe
  C:\Windows\System\AZhxqTE.exe
  2⤵
  PID:14228
- C:\Windows\System\aHfGyxe.exe
  C:\Windows\System\aHfGyxe.exe
  2⤵
  PID:14328
- C:\Windows\System\TaIgyvF.exe
  C:\Windows\System\TaIgyvF.exe
  2⤵
  PID:11888
- C:\Windows\System\fWRmhVs.exe
  C:\Windows\System\fWRmhVs.exe
  2⤵
  PID:12392
- C:\Windows\System\fPCPAmE.exe
  C:\Windows\System\fPCPAmE.exe
  2⤵
  PID:13388
- C:\Windows\System\cmoKIZk.exe
  C:\Windows\System\cmoKIZk.exe
  2⤵
  PID:13472
- C:\Windows\System\XAdEXpG.exe
  C:\Windows\System\XAdEXpG.exe
  2⤵
  PID:13520
- C:\Windows\System\LQsCarA.exe
  C:\Windows\System\LQsCarA.exe
  2⤵
  PID:13608
- C:\Windows\System\bdTOqql.exe
  C:\Windows\System\bdTOqql.exe
  2⤵
  PID:13716
- C:\Windows\System\DEJuncO.exe
  C:\Windows\System\DEJuncO.exe
  2⤵
  PID:13776
- C:\Windows\System\sTSNKLj.exe
  C:\Windows\System\sTSNKLj.exe
  2⤵
  PID:13780
- C:\Windows\System\TCKbVQd.exe
  C:\Windows\System\TCKbVQd.exe
  2⤵
  PID:13864
- C:\Windows\System\pmIvcHw.exe
  C:\Windows\System\pmIvcHw.exe
  2⤵
  PID:13888
- C:\Windows\System\hsyhtGg.exe
  C:\Windows\System\hsyhtGg.exe
  2⤵
  PID:13980
- C:\Windows\System\XeINAYi.exe
  C:\Windows\System\XeINAYi.exe
  2⤵
  PID:13916
- C:\Windows\System\rkYYZPR.exe
  C:\Windows\System\rkYYZPR.exe
  2⤵
  PID:14032
- C:\Windows\System\vEURAUi.exe
  C:\Windows\System\vEURAUi.exe
  2⤵
  PID:14092
- C:\Windows\System\mryJVrH.exe
  C:\Windows\System\mryJVrH.exe
  2⤵
  PID:14120
- C:\Windows\System\ROBRqya.exe
  C:\Windows\System\ROBRqya.exe
  2⤵
  PID:14208
- C:\Windows\System\qHrkknM.exe
  C:\Windows\System\qHrkknM.exe
  2⤵
  PID:12860
- C:\Windows\System\tXxjLXg.exe
  C:\Windows\System\tXxjLXg.exe
  2⤵
  PID:13392
- C:\Windows\System\UFupkjn.exe
  C:\Windows\System\UFupkjn.exe
  2⤵
  PID:12504
- C:\Windows\System\VYZLeKx.exe
  C:\Windows\System\VYZLeKx.exe
  2⤵
  PID:13436
- C:\Windows\System\tOfQwez.exe
  C:\Windows\System\tOfQwez.exe
  2⤵
  PID:13680
- C:\Windows\System\orrvLZE.exe
  C:\Windows\System\orrvLZE.exe
  2⤵
  PID:13972
- C:\Windows\System\NceGQcE.exe
  C:\Windows\System\NceGQcE.exe
  2⤵
  PID:14080
- C:\Windows\System\utQifQp.exe
  C:\Windows\System\utQifQp.exe
  2⤵
  PID:13996
- C:\Windows\System\eSgPBeM.exe
  C:\Windows\System\eSgPBeM.exe
  2⤵
  PID:14104
- C:\Windows\System\opXgSpi.exe
  C:\Windows\System\opXgSpi.exe
  2⤵
  PID:13696
- C:\Windows\System\cWgWabo.exe
  C:\Windows\System\cWgWabo.exe
  2⤵
  PID:14344
- C:\Windows\System\fznlcEw.exe
  C:\Windows\System\fznlcEw.exe
  2⤵
  PID:14376
- C:\Windows\System\oaNdlmH.exe
  C:\Windows\System\oaNdlmH.exe
  2⤵
  PID:14396
- C:\Windows\System\KEBAWez.exe
  C:\Windows\System\KEBAWez.exe
  2⤵
  PID:14420
- C:\Windows\System\pXMYLls.exe
  C:\Windows\System\pXMYLls.exe
  2⤵
  PID:14436
- C:\Windows\System\jckdFbd.exe
  C:\Windows\System\jckdFbd.exe
  2⤵
  PID:14464
- C:\Windows\System\TSeGZAe.exe
  C:\Windows\System\TSeGZAe.exe
  2⤵
  PID:14484
- C:\Windows\System\vkvAFBs.exe
  C:\Windows\System\vkvAFBs.exe
  2⤵
  PID:14516
- C:\Windows\System\SMVcxWq.exe
  C:\Windows\System\SMVcxWq.exe
  2⤵
  PID:14532
- C:\Windows\System\WewstVa.exe
  C:\Windows\System\WewstVa.exe
  2⤵
  PID:14556
- C:\Windows\System\AMuTZkk.exe
  C:\Windows\System\AMuTZkk.exe
  2⤵
  PID:14588
- C:\Windows\System\KthbLsn.exe
  C:\Windows\System\KthbLsn.exe
  2⤵
  PID:14612
- C:\Windows\System\ycHGhfv.exe
  C:\Windows\System\ycHGhfv.exe
  2⤵
  PID:14632
- C:\Windows\System\ZwKjNWB.exe
  C:\Windows\System\ZwKjNWB.exe
  2⤵
  PID:14672
- C:\Windows\System\fBwKTGH.exe
  C:\Windows\System\fBwKTGH.exe
  2⤵
  PID:14704
- C:\Windows\System\NYHcKlt.exe
  C:\Windows\System\NYHcKlt.exe
  2⤵
  PID:14720
- C:\Windows\System\cVlGiMM.exe
  C:\Windows\System\cVlGiMM.exe
  2⤵
  PID:14752
- C:\Windows\System\zlDOZHk.exe
  C:\Windows\System\zlDOZHk.exe
  2⤵
  PID:14776
- C:\Windows\System\yPrQVAS.exe
  C:\Windows\System\yPrQVAS.exe
  2⤵
  PID:14796
- C:\Windows\System\eGxYENL.exe
  C:\Windows\System\eGxYENL.exe
  2⤵
  PID:14812
- C:\Windows\System\ovlicQI.exe
  C:\Windows\System\ovlicQI.exe
  2⤵
  PID:14848
- C:\Windows\System\CNLMFQm.exe
  C:\Windows\System\CNLMFQm.exe
  2⤵
  PID:14880
- C:\Windows\System\mFEiQbQ.exe
  C:\Windows\System\mFEiQbQ.exe
  2⤵
  PID:14908
- C:\Windows\System\QyAgjRc.exe
  C:\Windows\System\QyAgjRc.exe
  2⤵
  PID:14932
- C:\Windows\System\WWZXNfr.exe
  C:\Windows\System\WWZXNfr.exe
  2⤵
  PID:14952
- C:\Windows\System\vbPnowh.exe
  C:\Windows\System\vbPnowh.exe
  2⤵
  PID:14980
- C:\Windows\System\XrjOMum.exe
  C:\Windows\System\XrjOMum.exe
  2⤵
  PID:15004
- C:\Windows\System\PUvNfbM.exe
  C:\Windows\System\PUvNfbM.exe
  2⤵
  PID:15036
- C:\Windows\System\iZOmTKc.exe
  C:\Windows\System\iZOmTKc.exe
  2⤵
  PID:15060
- C:\Windows\System\rfoCJnM.exe
  C:\Windows\System\rfoCJnM.exe
  2⤵
  PID:15092
- C:\Windows\System\FkInJdl.exe
  C:\Windows\System\FkInJdl.exe
  2⤵
  PID:15120
- C:\Windows\System\oMHZIbV.exe
  C:\Windows\System\oMHZIbV.exe
  2⤵
  PID:15136
- C:\Windows\System\Iaeegzk.exe
  C:\Windows\System\Iaeegzk.exe
  2⤵
  PID:15160
- C:\Windows\System\jMVLpUf.exe
  C:\Windows\System\jMVLpUf.exe
  2⤵
  PID:15188
- C:\Windows\System\EQiKnQF.exe
  C:\Windows\System\EQiKnQF.exe
  2⤵
  PID:15208
- C:\Windows\System\ztnaxkq.exe
  C:\Windows\System\ztnaxkq.exe
  2⤵
  PID:15244
- C:\Windows\System\ldRGyfD.exe
  C:\Windows\System\ldRGyfD.exe
  2⤵
  PID:15264
- C:\Windows\System\jRuzVNO.exe
  C:\Windows\System\jRuzVNO.exe
  2⤵
  PID:15288
- C:\Windows\System\toIbxWY.exe
  C:\Windows\System\toIbxWY.exe
  2⤵
  PID:15320
- C:\Windows\System\xzUYmSH.exe
  C:\Windows\System\xzUYmSH.exe
  2⤵
  PID:15344
- C:\Windows\System\cvICgOX.exe
  C:\Windows\System\cvICgOX.exe
  2⤵
  PID:13368
- C:\Windows\System\meuIzLH.exe
  C:\Windows\System\meuIzLH.exe
  2⤵
  PID:14204
- C:\Windows\System\czMjCQf.exe
  C:\Windows\System\czMjCQf.exe
  2⤵
  PID:14416
- C:\Windows\System\zrMhIwk.exe
  C:\Windows\System\zrMhIwk.exe
  2⤵
  PID:14428
- C:\Windows\System\VQLBFns.exe
  C:\Windows\System\VQLBFns.exe
  2⤵
  PID:14524
- C:\Windows\System\uYIZTlv.exe
  C:\Windows\System\uYIZTlv.exe
  2⤵
  PID:14660
- C:\Windows\System\ysHiuQc.exe
  C:\Windows\System\ysHiuQc.exe
  2⤵
  PID:14624
- C:\Windows\System\OryUgRA.exe
  C:\Windows\System\OryUgRA.exe
  2⤵
  PID:14788
- C:\Windows\System\VjddQMT.exe
  C:\Windows\System\VjddQMT.exe
  2⤵
  PID:14764
- C:\Windows\System\hSFrHMM.exe
  C:\Windows\System\hSFrHMM.exe
  2⤵
  PID:14892
- C:\Windows\System\xpgxFsV.exe
  C:\Windows\System\xpgxFsV.exe
  2⤵
  PID:14760
- C:\Windows\System\BVWZHHa.exe
  C:\Windows\System\BVWZHHa.exe
  2⤵
  PID:14944
- C:\Windows\System\kShrPeo.exe
  C:\Windows\System\kShrPeo.exe
  2⤵
  PID:15044
- C:\Windows\System\poJcUjR.exe
  C:\Windows\System\poJcUjR.exe
  2⤵
  PID:15088
- C:\Windows\System\OcXiZko.exe
  C:\Windows\System\OcXiZko.exe
  2⤵
  PID:15172
- C:\Windows\System\IemLMFp.exe
  C:\Windows\System\IemLMFp.exe
  2⤵
  PID:15276
- C:\Windows\System\GvLPFbS.exe
  C:\Windows\System\GvLPFbS.exe
  2⤵
  PID:15200
- C:\Windows\System\VNybLao.exe
  C:\Windows\System\VNybLao.exe
  2⤵
  PID:15148
- C:\Windows\System\qZiCjrr.exe
  C:\Windows\System\qZiCjrr.exe
  2⤵
  PID:14384
- C:\Windows\System\NNckhIw.exe
  C:\Windows\System\NNckhIw.exe
  2⤵
  PID:15232
- C:\Windows\System\dRJmHPa.exe
  C:\Windows\System\dRJmHPa.exe
  2⤵
  PID:14320
- C:\Windows\System\yGaITDa.exe
  C:\Windows\System\yGaITDa.exe
  2⤵
  PID:14652
- C:\Windows\System\NILXofg.exe
  C:\Windows\System\NILXofg.exe
  2⤵
  PID:14716
- C:\Windows\System\UfHTYhT.exe
  C:\Windows\System\UfHTYhT.exe
  2⤵
  PID:14804
- C:\Windows\System\VFfvNuF.exe
  C:\Windows\System\VFfvNuF.exe
  2⤵
  PID:15112
- C:\Windows\System\QmWjZdW.exe
  C:\Windows\System\QmWjZdW.exe
  2⤵
  PID:15332
- C:\Windows\System\THgMNUt.exe
  C:\Windows\System\THgMNUt.exe
  2⤵
  PID:13648
- C:\Windows\System\YwiUBxR.exe
  C:\Windows\System\YwiUBxR.exe
  2⤵
  PID:15380
- C:\Windows\System\FUsqJgU.exe
  C:\Windows\System\FUsqJgU.exe
  2⤵
  PID:15412
- C:\Windows\System\qbAbHNj.exe
  C:\Windows\System\qbAbHNj.exe
  2⤵
  PID:15444
- C:\Windows\System\MxhDBcA.exe
  C:\Windows\System\MxhDBcA.exe
  2⤵
  PID:15476
- C:\Windows\System\IKtBwnd.exe
  C:\Windows\System\IKtBwnd.exe
  2⤵
  PID:15508
- C:\Windows\System\VBlTIth.exe
  C:\Windows\System\VBlTIth.exe
  2⤵
  PID:15528
- C:\Windows\System\PEeaMju.exe
  C:\Windows\System\PEeaMju.exe
  2⤵
  PID:15548
- C:\Windows\System\jAJTtXT.exe
  C:\Windows\System\jAJTtXT.exe
  2⤵
  PID:15580
- C:\Windows\System\vyobDGo.exe
  C:\Windows\System\vyobDGo.exe
  2⤵
  PID:15608
- C:\Windows\System\wpJdfwy.exe
  C:\Windows\System\wpJdfwy.exe
  2⤵
  PID:15632
- C:\Windows\System\jLRcXnC.exe
  C:\Windows\System\jLRcXnC.exe
  2⤵
  PID:15656
- C:\Windows\System\TrTeeGl.exe
  C:\Windows\System\TrTeeGl.exe
  2⤵
  PID:15684
- C:\Windows\System\PIvPREl.exe
  C:\Windows\System\PIvPREl.exe
  2⤵
  PID:15724
- C:\Windows\System\EOdrGtZ.exe
  C:\Windows\System\EOdrGtZ.exe
  2⤵
  PID:15748
- C:\Windows\System\xBwsNGX.exe
  C:\Windows\System\xBwsNGX.exe
  2⤵
  PID:15768
- C:\Windows\System\EfsOPUh.exe
  C:\Windows\System\EfsOPUh.exe
  2⤵
  PID:15804
- C:\Windows\System\uTnfnRk.exe
  C:\Windows\System\uTnfnRk.exe
  2⤵
  PID:15840
- C:\Windows\System\IUPFEIB.exe
  C:\Windows\System\IUPFEIB.exe
  2⤵
  PID:15864
- C:\Windows\System\xzyiPCJ.exe
  C:\Windows\System\xzyiPCJ.exe
  2⤵
  PID:15888
- C:\Windows\System\ywcMGvk.exe
  C:\Windows\System\ywcMGvk.exe
  2⤵
  PID:15920
- C:\Windows\System\LGtjNGP.exe
  C:\Windows\System\LGtjNGP.exe
  2⤵
  PID:15940
- C:\Windows\System\XEpwlHW.exe
  C:\Windows\System\XEpwlHW.exe
  2⤵
  PID:15968
- C:\Windows\System\ZgyRbJD.exe
  C:\Windows\System\ZgyRbJD.exe
  2⤵
  PID:16000
- C:\Windows\System\mjwfShW.exe
  C:\Windows\System\mjwfShW.exe
  2⤵
  PID:16024
- C:\Windows\System\MFcCXlq.exe
  C:\Windows\System\MFcCXlq.exe
  2⤵
  PID:16064
- C:\Windows\System\uHRmzDz.exe
  C:\Windows\System\uHRmzDz.exe
  2⤵
  PID:16096
- C:\Windows\System\HKrIaYs.exe
  C:\Windows\System\HKrIaYs.exe
  2⤵
  PID:16128
- C:\Windows\System\FiRmKXk.exe
  C:\Windows\System\FiRmKXk.exe
  2⤵
  PID:16152
- C:\Windows\System\upomVjN.exe
  C:\Windows\System\upomVjN.exe
  2⤵
  PID:16180
- C:\Windows\System\WnuBEkz.exe
  C:\Windows\System\WnuBEkz.exe
  2⤵
  PID:16200
- C:\Windows\System\MBcFjXW.exe
  C:\Windows\System\MBcFjXW.exe
  2⤵
  PID:16236
- C:\Windows\System\XITRYxB.exe
  C:\Windows\System\XITRYxB.exe
  2⤵
  PID:16268
- C:\Windows\System\IBCWjAg.exe
  C:\Windows\System\IBCWjAg.exe
  2⤵
  PID:16300
- C:\Windows\System\mdrVjKP.exe
  C:\Windows\System\mdrVjKP.exe
  2⤵
  PID:16320
- C:\Windows\System\AsRfLgP.exe
  C:\Windows\System\AsRfLgP.exe
  2⤵
  PID:16348
- C:\Windows\System\tcDYqUe.exe
  C:\Windows\System\tcDYqUe.exe
  2⤵
  PID:16376
- C:\Windows\System\Czydynp.exe
  C:\Windows\System\Czydynp.exe
  2⤵
  PID:15260
- C:\Windows\System\tpDDLmz.exe
  C:\Windows\System\tpDDLmz.exe
  2⤵
  PID:14744
- C:\Windows\System\YYmnBZq.exe
  C:\Windows\System\YYmnBZq.exe
  2⤵
  PID:13512
- C:\Windows\System\KEfqtIu.exe
  C:\Windows\System\KEfqtIu.exe
  2⤵
  PID:14496
- C:\Windows\System\cSfKapq.exe
  C:\Windows\System\cSfKapq.exe
  2⤵
  PID:15560
- C:\Windows\System\iPmXUfd.exe
  C:\Windows\System\iPmXUfd.exe
  2⤵
  PID:15500
- C:\Windows\System\tmoDCZP.exe
  C:\Windows\System\tmoDCZP.exe
  2⤵
  PID:15736
- C:\Windows\System\rdIYDIe.exe
  C:\Windows\System\rdIYDIe.exe
  2⤵
  PID:15392
- C:\Windows\System\tLnZBxb.exe
  C:\Windows\System\tLnZBxb.exe
  2⤵
  PID:15792
- C:\Windows\System\GmabdkC.exe
  C:\Windows\System\GmabdkC.exe
  2⤵
  PID:15696
- C:\Windows\System\DsnMceF.exe
  C:\Windows\System\DsnMceF.exe
  2⤵
  PID:15756
- C:\Windows\System\LbTkQoB.exe
  C:\Windows\System\LbTkQoB.exe
  2⤵
  PID:15980
- C:\Windows\System\oOaHbYf.exe
  C:\Windows\System\oOaHbYf.exe
  2⤵
  PID:15964
- C:\Windows\System\OrBpvKY.exe
  C:\Windows\System\OrBpvKY.exe
  2⤵
  PID:15992
- C:\Windows\System\WuCFpyr.exe
  C:\Windows\System\WuCFpyr.exe
  2⤵
  PID:16212
- C:\Windows\System\toLQwWh.exe
  C:\Windows\System\toLQwWh.exe
  2⤵
  PID:16252
- C:\Windows\System\NXbSrgx.exe
  C:\Windows\System\NXbSrgx.exe
  2⤵
  PID:16076
- C:\Windows\System\mqCfFMs.exe
  C:\Windows\System\mqCfFMs.exe
  2⤵
  PID:16288
- C:\Windows\System\hpLnAPR.exe
  C:\Windows\System\hpLnAPR.exe
  2⤵
  PID:16344
- C:\Windows\System\wQKZZrn.exe
  C:\Windows\System\wQKZZrn.exe
  2⤵
  PID:15312
- C:\Windows\System\scjCPBp.exe
  C:\Windows\System\scjCPBp.exe
  2⤵
  PID:16104
- C:\Windows\System\VflCsHK.exe
  C:\Windows\System\VflCsHK.exe
  2⤵
  PID:15056
- C:\Windows\System\SExjiwc.exe
  C:\Windows\System\SExjiwc.exe
  2⤵
  PID:15436
- C:\Windows\System\KqevwZO.exe
  C:\Windows\System\KqevwZO.exe
  2⤵
  PID:15404
- C:\Windows\System\nrPygVv.exe
  C:\Windows\System\nrPygVv.exe
  2⤵
  PID:15816
- C:\Windows\System\vscjCuu.exe
  C:\Windows\System\vscjCuu.exe
  2⤵
  PID:15016
- C:\Windows\System\gYYSjmG.exe
  C:\Windows\System\gYYSjmG.exe
  2⤵
  PID:15564
- C:\Windows\System\ylesAos.exe
  C:\Windows\System\ylesAos.exe
  2⤵
  PID:15396
- C:\Windows\System\bRQDbiT.exe
  C:\Windows\System\bRQDbiT.exe
  2⤵
  PID:16396
- C:\Windows\System\YwYzIXD.exe
  C:\Windows\System\YwYzIXD.exe
  2⤵
  PID:16428
- C:\Windows\System\hnnXdyQ.exe
  C:\Windows\System\hnnXdyQ.exe
  2⤵
  PID:16452
- C:\Windows\System\YioEDAT.exe
  C:\Windows\System\YioEDAT.exe
  2⤵
  PID:16480
- C:\Windows\System\VnTFEio.exe
  C:\Windows\System\VnTFEio.exe
  2⤵
  PID:16508
- C:\Windows\System\RDjTPKJ.exe
  C:\Windows\System\RDjTPKJ.exe
  2⤵
  PID:16532
- C:\Windows\System\altYslD.exe
  C:\Windows\System\altYslD.exe
  2⤵
  PID:16556
- - C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -u -p 16556 -s 168
    3⤵
    PID:16976
- C:\Windows\System\HVGkTwC.exe
  C:\Windows\System\HVGkTwC.exe
  2⤵
  PID:16580
- C:\Windows\System\gYUgOWU.exe
  C:\Windows\System\gYUgOWU.exe
  2⤵
  PID:16616
- C:\Windows\System\sGwQLus.exe
  C:\Windows\System\sGwQLus.exe
  2⤵
  PID:16636
- C:\Windows\System\XbGyUTY.exe
  C:\Windows\System\XbGyUTY.exe
  2⤵
  PID:16668
- C:\Windows\System\mDKqOXC.exe
  C:\Windows\System\mDKqOXC.exe
  2⤵
  PID:16700
- C:\Windows\System\QzTKEPL.exe
  C:\Windows\System\QzTKEPL.exe
  2⤵
  PID:16716
- C:\Windows\System\pDvaety.exe
  C:\Windows\System\pDvaety.exe
  2⤵
  PID:16752
- C:\Windows\System\exCFGVV.exe
  C:\Windows\System\exCFGVV.exe
  2⤵
  PID:16768
- C:\Windows\System\rvwqEbD.exe
  C:\Windows\System\rvwqEbD.exe
  2⤵
  PID:16792
- C:\Windows\System\gluciwl.exe
  C:\Windows\System\gluciwl.exe
  2⤵
  PID:16820
- C:\Windows\System\XFFBygD.exe
  C:\Windows\System\XFFBygD.exe
  2⤵
  PID:16848
- C:\Windows\System\yPaynnq.exe
  C:\Windows\System\yPaynnq.exe
  2⤵
  PID:17176
- C:\Windows\System\XIYKLdN.exe
  C:\Windows\System\XIYKLdN.exe
  2⤵
  PID:17260

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:17136

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\ATlxgtN.exe

Filesize
1.8MB

MD5
14f9723363a57c78279519b787c2c82d

SHA1
ac961176d570e3f38161a2587926a281d2438c13

SHA256
c830f00e2aa9b0c9d2df6adb743ba2e025fc94166687aaf238871d3a2f8a432d

SHA512
6dc15032c325779dc88cb196aa5d851e3c224ddac240e31a5e1d2c2fca09834f847434eea2b6b3899d58bf99dd147b79d8daa8f1b5bf2aa92ff91687aee810fd

Download Submit
C:\Windows\System\Bltprrc.exe

Filesize
1.8MB

MD5
eb20370f6d52b1c301a6e56da8f6bbc1

SHA1
d1360554add811211f76e13edd5707ef8676cea0

SHA256
7da7f3a2b3609581dd536ad01407d1525ab975001712fb9c39650f3ba725c335

SHA512
85757d761a6d889c18979263277a681000a4c57535da6bc8abf38f287bee6603a82cc7632fda4e6188e0c6fd7596ab98a8323797f3cafeded9ae03cc7ec8a179

Download Submit
C:\Windows\System\EMLQFKg.exe

Filesize
1.8MB

MD5
4a368a061dbc06ffe1ebf86105f2e180

SHA1
f6796b745680ee25ac4ae4598244af3377b5a9d6

SHA256
0c6f7ff198cf134aba93a2fe632a837a8931bc37b23fe718aaa58fca08bfdd5e

SHA512
53637646e7644fa3350a075c87c4e2dc1bc9a3edce673bd0bf5db7cbe04ac8ea2553817988770679ffba1dcf7dca3672879bb994679d59a5614908b700baec8c

Download Submit
C:\Windows\System\HoDGrRd.exe

Filesize
1.8MB

MD5
9670fe1aa9b0b3ec1cdd7d14582ec02f

SHA1
24322d35a3c11af60d26e95355cd5858ec2df218

SHA256
0acd1b418a625a4cf9e0d3545e173bdf19a7790960c6e6dfff6625bb4933b7ea

SHA512
31d6f2e58f929f62822bc3f1d750f095350144df59ded7c66717f4099fc54c77b90fcfdf4fb8067d8fef64fe976c065ea024415c541d3cec2455019a53145c09

Download Submit
C:\Windows\System\IsdrnnN.exe

Filesize
1.8MB

MD5
c06d692398be9722548a3cd742fb99c6

SHA1
e3fb77f9be131b76f470bfd35c48c62006edd891

SHA256
739f255e5dbeaf88fdd0001c67828788758c249ade3dbd935d2446a7e2165b4a

SHA512
cd8b20cca9e22b19950b2c468f9300be025e34b1669aa9ef1dfb7f1956b39efda77587ca92dfff76f76507b0830deafd236d4376b00e26fd6c45209b3e510150

Download Submit
C:\Windows\System\KCOQxaF.exe

Filesize
1.8MB

MD5
fe3e38e2bf2e0fa29778d3ba116c24d6

SHA1
92a5752f7bee6c28abfac44e9537952845ba3e64

SHA256
e27c025e00074440b752bb71789ac5f3e975cde28f1acf4706cd467c7c1788da

SHA512
5244a452f81262a7707702866cbcf7d11d3e73233678c85d76f3e01405ffc9010ac781ca06356a16ab145aef216d2eb7dc3b528b2d6bc4db0208b3b22b26f53d

Download Submit
C:\Windows\System\KCvstHn.exe

Filesize
1.8MB

MD5
fbeaa0224e3bfac1b3a9f1d72e1e1c34

SHA1
47f32f644ab49fd1c0049491206074393521cce4

SHA256
03c2ffd75e13862df4766b949444fcec8080cd1ba62d02cfc6731e5ff408cf58

SHA512
11558e1dc10e92e0b82bf6ebdfeb7de848feb48408db7fcdc27112bc01dd81969d93ad4eab23c0fa67b412e784ae0ded63e9b481719f963ac82529407a4876c9

Download Submit
C:\Windows\System\Mjcgbig.exe

Filesize
1.8MB

MD5
afb6bbeea7f5b8bc3b73b89b60979d6f

SHA1
3fb257e0fa04b9c149b8a55edc4c7605dc099abd

SHA256
5ec409c08b3984978f3b909a8afb7736922cdf6c16543bef2619fa5842a5419f

SHA512
5e70aacc67ccca8003f1ec58941ff3bbac41101535a9aa0779273d3187c5e4a33d4869d367a4a25a238a30b4b0317cdad75ec58a2a05e1ec850b89f557694f56

Download Submit
C:\Windows\System\PhIdQct.exe

Filesize
1.8MB

MD5
1bcd818db0e2f066002cdadcc8fcc323

SHA1
2fd5b65043d605d7d145189afe8490e8f2e2d5e6

SHA256
2898ebccda3d906cf4fb50f781077702e96c5e751d773d3ddb55a5c2b21a55bf

SHA512
c848d925f99be13a85a76433a8fb8c29525d5bf389a4e32ddf9879b1bd747b3e5e32846c9214bfc180097dcf69ca53e7a8beb8b6a96661c6b562c7fb65c44733

Download Submit
C:\Windows\System\QRajWni.exe

Filesize
1.8MB

MD5
118f01b2b42fdb1ee146bf04b5149fa5

SHA1
7a35ece37332cc67c5ebff0f6802797768aee5d8

SHA256
9733acb9087f582cde3d131b94f941d540ffb7b6cc8f9583cbba673e50da6426

SHA512
1a8af77decd526e27a0960612e7aaf9e35b8bd707476a12340703f14f3cb505c6dbadea7e0c0cbce8903d73e6f1e54ea9c3418471e9c7d40f6af8db34103173e

Download Submit
C:\Windows\System\QrHPNvJ.exe

Filesize
1.8MB

MD5
8e4555a10ccd9e52df5a901e39b7f891

SHA1
242eaef0cc4cc59e9030e3faff09843d6da0d1a7

SHA256
43f3961a7a74457ebe38ce4e7d584586aadffd855afdd8905ca021a84e5dbc6d

SHA512
3fbe9ab79757c54522c92e91f2cdf752049b3cbb933a32213127f84fec74b25bf5f346b889089a466bf22e635486785951c6dcad9e39051fc64f113b88f5caa2

Download Submit
C:\Windows\System\TpqKqMt.exe

Filesize
1.8MB

MD5
5c01dd27ab8afdf34aa63e2a2f8f1af3

SHA1
e144df9eddbe8ec63f6e71b28be978346217396c

SHA256
a6851b52d06052819a7b8aae8cc5784aaba1c16679e000d8e0767fe948fe14cc

SHA512
906873d2395f0ba96944e3a4e0c548f73ca843635c048b387297b87b26b795943a33396a5d92c18eeb2e3e6b871aa70c55c3b0c14806a43b617d9323d3acc7db

Download Submit
C:\Windows\System\UCMLSoz.exe

Filesize
1.8MB

MD5
bfd8d2c5b6acd09e9d99aacf48fec84e

SHA1
cae4124598d852edf98ba6e1fef5abf3b5c71825

SHA256
9c1fb943114feb2692c4621e2304afa866c6a2669da63262242f7d6a8309988b

SHA512
b4f1e183359f627b5ec09b833603bad692cc6f7bca541d6e53c7b5a799f7f485dcfee0c999e2ee4f2adf9ed74dc0c777e54d2f2314fa1108d20e812dd9d2d040

Download Submit
C:\Windows\System\UurntAI.exe

Filesize
1.8MB

MD5
a9327353c72ea4fec47034fd1568161c

SHA1
6d0360848cb4788f3a42c1474b3611addf222f1e

SHA256
4499e68dbb06d1bcc70def0a90491228708051aad47c8db5ab75f636240ebad8

SHA512
cfcf1922016af15f4e2275ad084d3309aa0ebd4aec37fb1d9fed92baff8d2aa51051bf82c67059c78f72659f4410832f44b358be916df31f4c9e71e60656d382

Download Submit
C:\Windows\System\crztvrd.exe

Filesize
1.8MB

MD5
109f8de6d75331119f528dbf03e9657d

SHA1
bf8c59cd7a7690453e9081a2e94b4f5a95943b34

SHA256
f228768103cbaf1b7c39768f10a6dfeb5dc1513f60866e462eb8491909f72902

SHA512
e9dc9594635d854e29f8b98e756fe513a81b62d985baeae24366494b6245fa401b8b9635309c5d7eed6c358f1c9c930d6691bfd82befb46072b103910d47a1cf

Download Submit
C:\Windows\System\elesASk.exe

Filesize
1.8MB

MD5
701c318457112f7b4ec904ca81683938

SHA1
5bb28e89ef84e0de4dda0bc91a3131f19817c013

SHA256
fb5610b0eee5aafffc73db67d7b304ba793ba301d5172cda0e2777605e87976a

SHA512
27897de2b8d2eecfa36ba12a09c9d24ec7db5a93d594e5f65af00a462d0fcc834ed8030cc8bcd4d8c86b7fdb8334d8ea88d3e8dc26beead615444a09b96d4aa1

Download Submit
C:\Windows\System\gZHGqWF.exe

Filesize
1.8MB

MD5
a37c8b45dbe8b4d0a232b59f19df6fcf

SHA1
bb7b9fb201cd2a99d4b6d65e1f518aa6c063ac93

SHA256
0a463769e89959c88f4fe29df89d1758086f6904b04675a0b0b00ce0c52656b3

SHA512
42845fa03ea0fa6d3b9440c09e8635a564b52b59ce379f73874fc33c2b2c5c82d88f719c4cfaef52d56100b60f20d465f1dc1c498431f440e2a41ff68e0ff7ca

Download Submit
C:\Windows\System\jOpTHcI.exe

Filesize
1.8MB

MD5
50d95aa181e874bfd67cdd4837599116

SHA1
d2828fbebcf4f1badccd54b4d7820f81d636dc48

SHA256
d0d013fd17f12261643892b82d183d9200dca8ed35c0cbb9d8f5674ab415ffa3

SHA512
4d93eef4e1d7e2fea9d7881d7bb3af0f144e102178ddf37c34fe1547911c0e323ef65a09e269323274adcd2ec9a34865ec6dbaf033feffff3db6089d05ac6673

Download Submit
C:\Windows\System\jahOjri.exe

Filesize
1.8MB

MD5
5e4881244d22c9e2cd3251b0bb4edee9

SHA1
69167c58e6f22b60ee417fea20b3afd90a45ea65

SHA256
10063e9af14930238538613203d7eea057e251ada89725c8cecb1a1ea8542e2c

SHA512
4f750d2cb8c9795dd338aeadc0f0d6f687722c89ee6788caddcf83d214058eb83fa8b832794a63dbe40037d4d88d204fd1f7001fda5012ddd6124bcc44070c55

Download Submit
C:\Windows\System\kEAXiIl.exe

Filesize
1.8MB

MD5
e84787b8b09cda5d0a9e7cd9031a8021

SHA1
ce9b1252ccf2e5c33e76c0b20d8117fdd8bae3b1

SHA256
9749fc783167301579c8e0682ad45e6386af865001ecf4267fd0a2c4a43a0493

SHA512
b6f3c3314271deb66c2a18496090fcf23ef279f9e1b428b023185c9e30e73057251348af6917e144e7640b5882acbf0d32a11855b91d8f4a79a5e81189bc941a

Download Submit
C:\Windows\System\lmBLBun.exe

Filesize
1.8MB

MD5
81fcd2d3bc655cb6ed9e08868471ea44

SHA1
fc2dfdc22ecc727267cfdbe3ffde8ae97ece2f1a

SHA256
57604a6f9734b36dc434c214057c2c6037e28f3f5063b38161d9bb42b7357050

SHA512
5932806f21eb6d452baedb5d730d45d85363dd4c17787b290b648d5e08e603322c9fcbbc87a27495212c27667b9528fe18a172ecae172c4c65cb266585666b9e

Download Submit
C:\Windows\System\mmABozt.exe

Filesize
1.8MB

MD5
99177b79a9f96475b68ffd3f3b7fd225

SHA1
8049f092c536916c4f725617944a02464f60ff9c

SHA256
95c3d4ad020aff6335eedfeec1a960f4f27f1f4cb04213b4dfab866e898d71d7

SHA512
140d1bb2c0167f8ce76a9fb44a7316e0ed21525868963a656dd10d9b2923d7c62497b48783f8928a91158f5004ac1025e44f7c3ff18c3358700352d250bedf9f

Download Submit
C:\Windows\System\mzEveDK.exe

Filesize
1.8MB

MD5
fe6e553b19a7108e707d5d4d8c4590f5

SHA1
aacccdf5ba1fb18f599b1bb05c1ea4ed688413a2

SHA256
fbbd9337ede2d6cbc7f7323da4385abd69293ddd98327d8172fd59ef55bd19d2

SHA512
5cdf1c6eff5ef9f31187374faad4e0e4f738c5d3c49554a967c1db371a10bcd9623bc80ecc498eeb5004353746a8eae4dc251f2a02499f27838472bbec2d679e

Download Submit
C:\Windows\System\oACOehW.exe

Filesize
1.8MB

MD5
b1d2c24f98baa335f4afd59488c853ca

SHA1
efc49c775737fe392ce05c70e137fb9f50147402

SHA256
c4619092305cb81721cb9b6c552cf7cfb2028438ea643ad520c8b98d968120ef

SHA512
c043a58b199bf75b60a5e65e3b60a0067f662814e9c5f0b295d9374fae626b2d4ca2ad3c55bab72c65d5f2f5aa20f11607cf8e47fc89879c438ced600f5856a5

Download Submit
C:\Windows\System\oqzvSdw.exe

Filesize
1.8MB

MD5
1679c3c2609424ae442eb98bfbc76ed4

SHA1
560c73fd572cab04ec9a24f71c1bdfc14487b8cd

SHA256
c1304cbd95ff30138a15ef48fa299a9a76cd51a83b2852306a3fb5371a09ecdf

SHA512
22fddaaa3df09032b8cce9b7499d7ff7c857fec76c5ebf68cad0bfcd3232fa2d791889c2474e035742858151b186471d125eb72e175b57bac2a5755d066087d4

Download Submit
C:\Windows\System\seWnaCE.exe

Filesize
1.8MB

MD5
a640da97ae50bd36063ce0ac72da5551

SHA1
da4cbb2866d5fd08dec125616b2f0da1bb7a2908

SHA256
026730fea92f95edc0aa82021cd6e709a028dc9a07a9a5f620fe4497164b69d2

SHA512
f7c180f9c776604ff06dd9450574b5131b9ec29629e745eab67b42cc902b92ec06dba4056b82cf4b5bc0fd94c78b00c6b7127e3495a1e8b61fd5b25fe5b0c504

Download Submit
C:\Windows\System\tLeASqW.exe

Filesize
1.8MB

MD5
d02c966a7bab926c22b0661454b933c6

SHA1
c54ecd98f053f37d1abf5c3f7667e8efc5880bea

SHA256
f1ee73db4c8d1e80f7b7edbbb2f33bc65b1d62b3a96091cf85402a3b69ec496a

SHA512
26bd40c1cd18cf3cd8311dd8eebbe8e119e15d7c104e95299c9adac040b7a794baf71db143247c81762dc3953b880600f88c0571e891a72679cab1d9cb80bf14

Download Submit
C:\Windows\System\tsDrrMh.exe

Filesize
1.8MB

MD5
5aae172749ba2063d7f5d6e66036a7c2

SHA1
5ff1478e3958e89285cc0cc921df75901c32685a

SHA256
92a432e915494e4343a408eb37371f6b70f69c4acd5d1d504dc46b2527cb12ab

SHA512
7bf3e8dd18819ba1a2a3d759c21fbb1d8f443e1a3974a56e8abf6ab4eb2865c589dc2250af7391f6efdb2e8bdae15e110e54cb8d6ca7584bd15fce5bff38edb2

Download Submit
C:\Windows\System\uDgKucM.exe

Filesize
1.8MB

MD5
f1405afe4bcb3c81dd90143516a27bc8

SHA1
8af3460e71326a55ddc69dc223f693258f78a5c7

SHA256
93cacabe0ad82350b625b8641ffbb3550cd702187a6b0a4610be88891d0a3817

SHA512
306938d848eed4f00c25d39ac478673a884551aa9e67a999a744ebd42167dc9cd3fffd33bd81ca853008ddfa128a11d81078bcdb6a27256f7b296ac5e79b3127

Download Submit
C:\Windows\System\vTMvXvH.exe

Filesize
1.8MB

MD5
7ec5dd3eaa7c93ccd01cd4e9eb35f828

SHA1
223c7eeb6f59d4a7567db752956475ba0b2ab83d

SHA256
0fa243b2f7b813c7174f41f9d42f0b3ae5be4da9e22921f18c8305f7037e2beb

SHA512
d7a24b95ad4efada7f286c15f7275a06a34db1c50748293743b2a5b10cc0651875f51079ca8a0c25f5ec06a045bb65e0b3ecd1e0f25f2f0a7d030cc244ee6d7f

Download Submit
C:\Windows\System\xfzPZPl.exe

Filesize
1.8MB

MD5
dc19d441111ae64ab55270b5dd34e609

SHA1
b22288988bd8b0808f3d2011c7eabb720f49c343

SHA256
062ddf5332d8175062512ec3f0dfd34e85c54c1adb7652324337bbd38309ec7d

SHA512
faddff959d46997f9113bfaa53832a9cb739a603ac091888a96756728bc4a507bc8c0f21c7a49313b8c49db8174eb1ff65f81d62009bd07996e480db9cfa2299

Download Submit
C:\Windows\System\yFOnGeq.exe

Filesize
1.8MB

MD5
99512561279a0263f16742b1ec8385fd

SHA1
b3a10c7806a00c65a90506dc3f6fe1186bb47448

SHA256
9012f0832f69a155f0e8513bcaf93715da2387c096486788726f929d3e488760

SHA512
f32628fdf066d9bdba239aacb1e674fb2a7e2e5c7d01bd6eaa6b7b50f52e28c09f33818b741d90e04629eca3cb906ad002f22acfdfad0f31159dda5fc2a48c6a

Download Submit
C:\Windows\System\zXgqLcF.exe

Filesize
1.8MB

MD5
04e7f241e5c25ba3f0a7b61eb1530bb8

SHA1
e9d04b11855dc973f6c4af3296f38ce16f82584e

SHA256
fd5d400adaeb36dd53c33003f240659cdf0a953733b1dd9319c0fb69d49cef40

SHA512
f8120d96034b98902df7a606e9df722a3230dddf956cc06ca11c701ac4177ea8201eda745432ba577026d7b15e00c37e58adf8f0264ecb1b7f8cf767fc3345df

Download Submit
memory/4588-0-0x0000029A40A60000-0x0000029A40A70000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads