xmrig | 114cfff18e6b695957a7c3fc12b98e578cc98114c8f858656b616db6cefb1533

Analysis

max time kernel
130s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
25-01-2025 19:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

114cfff18e6b695957a7c3fc12b98e578cc98114c8f858656b616db6cefb1533.exe
Size

1.3MB
MD5

02b4d1a526ee915dfbef72c5fe5e5d18
SHA1

bda84de5049276b6789f4d522a45c29688bdcc83
SHA256

114cfff18e6b695957a7c3fc12b98e578cc98114c8f858656b616db6cefb1533
SHA512

67b03313612c52e89f5d51605baa9681b99a48420194db35384f36bbe3c906332f4a6514b17cfdfd699905c8ca347f85e24bf496e473e4dc4ca438b7d656f81e
SSDEEP

24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbpwlKenszbWKDNEm/5QbhJGRA6nb:GezaTF8FcNkNdfE0pZ9ozttwIRx28rb

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 33 IoCs

miner

resource	yara_rule
behavioral2/files/0x000b000000023b6d-4.dat	xmrig
behavioral2/files/0x000a000000023b74-6.dat	xmrig
behavioral2/files/0x000a000000023b76-20.dat	xmrig
behavioral2/files/0x000a000000023b77-29.dat	xmrig
behavioral2/files/0x000a000000023b7a-36.dat	xmrig
behavioral2/files/0x000a000000023b79-39.dat	xmrig
behavioral2/files/0x000a000000023b78-38.dat	xmrig
behavioral2/files/0x000a000000023b75-24.dat	xmrig
behavioral2/files/0x000b000000023b70-15.dat	xmrig
behavioral2/files/0x000a000000023b7b-49.dat	xmrig
behavioral2/files/0x000b000000023b71-52.dat	xmrig
behavioral2/files/0x000a000000023b7f-65.dat	xmrig
behavioral2/files/0x000a000000023b80-74.dat	xmrig
behavioral2/files/0x000a000000023b82-85.dat	xmrig
behavioral2/files/0x000a000000023b81-83.dat	xmrig
behavioral2/files/0x000a000000023b7d-68.dat	xmrig
behavioral2/files/0x000a000000023b7e-66.dat	xmrig
behavioral2/files/0x000a000000023b83-88.dat	xmrig
behavioral2/files/0x0031000000023b84-91.dat	xmrig
behavioral2/files/0x0031000000023b85-99.dat	xmrig
behavioral2/files/0x0031000000023b86-104.dat	xmrig
behavioral2/files/0x000a000000023b87-107.dat	xmrig
behavioral2/files/0x000a000000023b88-115.dat	xmrig
behavioral2/files/0x000a000000023b89-120.dat	xmrig
behavioral2/files/0x000a000000023b8a-124.dat	xmrig
behavioral2/files/0x000a000000023b8b-128.dat	xmrig
behavioral2/files/0x000a000000023b8c-135.dat	xmrig
behavioral2/files/0x000a000000023b8d-139.dat	xmrig
behavioral2/files/0x000a000000023b8f-143.dat	xmrig
behavioral2/files/0x000a000000023b91-152.dat	xmrig
behavioral2/files/0x000a000000023b90-161.dat	xmrig
behavioral2/files/0x000a000000023b93-158.dat	xmrig
behavioral2/files/0x000a000000023b92-156.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
1984	PDEwFjI.exe
5116	valysXL.exe
1076	obihmVS.exe
4532	zjvzdIi.exe
3036	kZdHZUY.exe
384	HrMhjyG.exe
1484	PldRyVx.exe
4648	baYGsYf.exe
3004	gOqUjBw.exe
1036	yTauGNS.exe
2244	mRmDGXQ.exe
2388	OIjMdss.exe
2212	JIjXAHp.exe
1532	OMpellX.exe
3300	WcpeZzN.exe
3424	hOBhYfP.exe
636	oZqYnYl.exe
4548	UnIraCG.exe
1268	Egppema.exe
4216	iadvJxs.exe
716	MQoXtFs.exe
4144	xAtleed.exe
3272	IvLtsMV.exe
5096	rGkyhFO.exe
4040	LWruDhk.exe
2424	RrUlCiB.exe
1396	IFvdmHL.exe
1864	WfQEfED.exe
2660	tRVWqcT.exe
3860	qmiWPLA.exe
4776	vWrVbDT.exe
1956	sDJnVnW.exe
5000	MKGNmsO.exe
3708	yonjeYx.exe
3304	AHxWgxx.exe
1128	sHYrMFN.exe
4792	eJnKSMc.exe
3476	lADSBhe.exe
3404	BSJHYQl.exe
2452	zqADUqy.exe
2820	vePMpix.exe
3596	XMSTjKA.exe
4848	pTMIkiE.exe
368	IsYrIQS.exe
4292	nwUEJAf.exe
4780	thMNOGD.exe
2432	DMsuVUE.exe
4336	RHLYixm.exe
4104	yqFDZpX.exe
5104	MxBZRJS.exe
1520	bouuOHa.exe
2976	SGjOzkW.exe
1996	mfOMcKJ.exe
2520	wEXtzhf.exe
1012	sgsUjkn.exe
4740	DtHFlZZ.exe
3680	ncgwwkF.exe
1784	ZrAbojv.exe
4564	XFsnhas.exe
4272	xgUtIGM.exe
4832	aeBuZXc.exe
1228	sKUswJg.exe
4568	oBupqwN.exe
3460	VdRONBw.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\PvLesIb.exe	114cfff18e6b695957a7c3fc12b98e578cc98114c8f858656b616db6cefb1533.exe
File created	C:\Windows\System\IgHQnZY.exe	114cfff18e6b695957a7c3fc12b98e578cc98114c8f858656b616db6cefb1533.exe
File created	C:\Windows\System\flDmFbh.exe	114cfff18e6b695957a7c3fc12b98e578cc98114c8f858656b616db6cefb1533.exe
File created	C:\Windows\System\YPrtCZs.exe	114cfff18e6b695957a7c3fc12b98e578cc98114c8f858656b616db6cefb1533.exe
File created	C:\Windows\System\LlFiGoH.exe	114cfff18e6b695957a7c3fc12b98e578cc98114c8f858656b616db6cefb1533.exe
File created	C:\Windows\System\shswRuf.exe	114cfff18e6b695957a7c3fc12b98e578cc98114c8f858656b616db6cefb1533.exe
File created	C:\Windows\System\hTnNLrn.exe	114cfff18e6b695957a7c3fc12b98e578cc98114c8f858656b616db6cefb1533.exe
File created	C:\Windows\System\cjMMiIq.exe	114cfff18e6b695957a7c3fc12b98e578cc98114c8f858656b616db6cefb1533.exe
File created	C:\Windows\System\fbweESW.exe	114cfff18e6b695957a7c3fc12b98e578cc98114c8f858656b616db6cefb1533.exe
File created	C:\Windows\System\EJlvjsa.exe	114cfff18e6b695957a7c3fc12b98e578cc98114c8f858656b616db6cefb1533.exe
File created	C:\Windows\System\joGjQBS.exe	114cfff18e6b695957a7c3fc12b98e578cc98114c8f858656b616db6cefb1533.exe
File created	C:\Windows\System\hNCyUgv.exe	114cfff18e6b695957a7c3fc12b98e578cc98114c8f858656b616db6cefb1533.exe
File created	C:\Windows\System\ZfZtHqq.exe	114cfff18e6b695957a7c3fc12b98e578cc98114c8f858656b616db6cefb1533.exe
File created	C:\Windows\System\dteaLFG.exe	114cfff18e6b695957a7c3fc12b98e578cc98114c8f858656b616db6cefb1533.exe
File created	C:\Windows\System\valysXL.exe	114cfff18e6b695957a7c3fc12b98e578cc98114c8f858656b616db6cefb1533.exe
File created	C:\Windows\System\ncgwwkF.exe	114cfff18e6b695957a7c3fc12b98e578cc98114c8f858656b616db6cefb1533.exe
File created	C:\Windows\System\SMymePt.exe	114cfff18e6b695957a7c3fc12b98e578cc98114c8f858656b616db6cefb1533.exe
File created	C:\Windows\System\HvvMxpF.exe	114cfff18e6b695957a7c3fc12b98e578cc98114c8f858656b616db6cefb1533.exe
File created	C:\Windows\System\BSqTNwo.exe	114cfff18e6b695957a7c3fc12b98e578cc98114c8f858656b616db6cefb1533.exe
File created	C:\Windows\System\jomaVOK.exe	114cfff18e6b695957a7c3fc12b98e578cc98114c8f858656b616db6cefb1533.exe
File created	C:\Windows\System\nQQLNrK.exe	114cfff18e6b695957a7c3fc12b98e578cc98114c8f858656b616db6cefb1533.exe
File created	C:\Windows\System\PuaLkoP.exe	114cfff18e6b695957a7c3fc12b98e578cc98114c8f858656b616db6cefb1533.exe
File created	C:\Windows\System\nDuZEFc.exe	114cfff18e6b695957a7c3fc12b98e578cc98114c8f858656b616db6cefb1533.exe
File created	C:\Windows\System\smwWClY.exe	114cfff18e6b695957a7c3fc12b98e578cc98114c8f858656b616db6cefb1533.exe
File created	C:\Windows\System\DCmfQrw.exe	114cfff18e6b695957a7c3fc12b98e578cc98114c8f858656b616db6cefb1533.exe
File created	C:\Windows\System\PDEwFjI.exe	114cfff18e6b695957a7c3fc12b98e578cc98114c8f858656b616db6cefb1533.exe
File created	C:\Windows\System\vdzZIaZ.exe	114cfff18e6b695957a7c3fc12b98e578cc98114c8f858656b616db6cefb1533.exe
File created	C:\Windows\System\WTcFcYP.exe	114cfff18e6b695957a7c3fc12b98e578cc98114c8f858656b616db6cefb1533.exe
File created	C:\Windows\System\ofbBGpN.exe	114cfff18e6b695957a7c3fc12b98e578cc98114c8f858656b616db6cefb1533.exe
File created	C:\Windows\System\NwfkyyT.exe	114cfff18e6b695957a7c3fc12b98e578cc98114c8f858656b616db6cefb1533.exe
File created	C:\Windows\System\hWjUOVV.exe	114cfff18e6b695957a7c3fc12b98e578cc98114c8f858656b616db6cefb1533.exe
File created	C:\Windows\System\BiIdTOZ.exe	114cfff18e6b695957a7c3fc12b98e578cc98114c8f858656b616db6cefb1533.exe
File created	C:\Windows\System\bTfBjbP.exe	114cfff18e6b695957a7c3fc12b98e578cc98114c8f858656b616db6cefb1533.exe
File created	C:\Windows\System\zcsmSlS.exe	114cfff18e6b695957a7c3fc12b98e578cc98114c8f858656b616db6cefb1533.exe
File created	C:\Windows\System\ZgxlcFZ.exe	114cfff18e6b695957a7c3fc12b98e578cc98114c8f858656b616db6cefb1533.exe
File created	C:\Windows\System\OvzBuMS.exe	114cfff18e6b695957a7c3fc12b98e578cc98114c8f858656b616db6cefb1533.exe
File created	C:\Windows\System\JIjXAHp.exe	114cfff18e6b695957a7c3fc12b98e578cc98114c8f858656b616db6cefb1533.exe
File created	C:\Windows\System\soEMUNM.exe	114cfff18e6b695957a7c3fc12b98e578cc98114c8f858656b616db6cefb1533.exe
File created	C:\Windows\System\umaHhhh.exe	114cfff18e6b695957a7c3fc12b98e578cc98114c8f858656b616db6cefb1533.exe
File created	C:\Windows\System\Grufxxl.exe	114cfff18e6b695957a7c3fc12b98e578cc98114c8f858656b616db6cefb1533.exe
File created	C:\Windows\System\KgeaSkf.exe	114cfff18e6b695957a7c3fc12b98e578cc98114c8f858656b616db6cefb1533.exe
File created	C:\Windows\System\nuTaDHv.exe	114cfff18e6b695957a7c3fc12b98e578cc98114c8f858656b616db6cefb1533.exe
File created	C:\Windows\System\ANcFOwO.exe	114cfff18e6b695957a7c3fc12b98e578cc98114c8f858656b616db6cefb1533.exe
File created	C:\Windows\System\augEzWr.exe	114cfff18e6b695957a7c3fc12b98e578cc98114c8f858656b616db6cefb1533.exe
File created	C:\Windows\System\MRQdULQ.exe	114cfff18e6b695957a7c3fc12b98e578cc98114c8f858656b616db6cefb1533.exe
File created	C:\Windows\System\HGxylVh.exe	114cfff18e6b695957a7c3fc12b98e578cc98114c8f858656b616db6cefb1533.exe
File created	C:\Windows\System\uMDHHdy.exe	114cfff18e6b695957a7c3fc12b98e578cc98114c8f858656b616db6cefb1533.exe
File created	C:\Windows\System\PUvrBUC.exe	114cfff18e6b695957a7c3fc12b98e578cc98114c8f858656b616db6cefb1533.exe
File created	C:\Windows\System\DUDNwJH.exe	114cfff18e6b695957a7c3fc12b98e578cc98114c8f858656b616db6cefb1533.exe
File created	C:\Windows\System\ZUVENee.exe	114cfff18e6b695957a7c3fc12b98e578cc98114c8f858656b616db6cefb1533.exe
File created	C:\Windows\System\YipYCXW.exe	114cfff18e6b695957a7c3fc12b98e578cc98114c8f858656b616db6cefb1533.exe
File created	C:\Windows\System\QgDbQAb.exe	114cfff18e6b695957a7c3fc12b98e578cc98114c8f858656b616db6cefb1533.exe
File created	C:\Windows\System\FlQQbBp.exe	114cfff18e6b695957a7c3fc12b98e578cc98114c8f858656b616db6cefb1533.exe
File created	C:\Windows\System\cATMTMj.exe	114cfff18e6b695957a7c3fc12b98e578cc98114c8f858656b616db6cefb1533.exe
File created	C:\Windows\System\lgZStjL.exe	114cfff18e6b695957a7c3fc12b98e578cc98114c8f858656b616db6cefb1533.exe
File created	C:\Windows\System\WQrsYDe.exe	114cfff18e6b695957a7c3fc12b98e578cc98114c8f858656b616db6cefb1533.exe
File created	C:\Windows\System\WFYbUDF.exe	114cfff18e6b695957a7c3fc12b98e578cc98114c8f858656b616db6cefb1533.exe
File created	C:\Windows\System\WsxmuRX.exe	114cfff18e6b695957a7c3fc12b98e578cc98114c8f858656b616db6cefb1533.exe
File created	C:\Windows\System\CtmTPtm.exe	114cfff18e6b695957a7c3fc12b98e578cc98114c8f858656b616db6cefb1533.exe
File created	C:\Windows\System\nPtjmpg.exe	114cfff18e6b695957a7c3fc12b98e578cc98114c8f858656b616db6cefb1533.exe
File created	C:\Windows\System\LBuWvCm.exe	114cfff18e6b695957a7c3fc12b98e578cc98114c8f858656b616db6cefb1533.exe
File created	C:\Windows\System\xbxsUTd.exe	114cfff18e6b695957a7c3fc12b98e578cc98114c8f858656b616db6cefb1533.exe
File created	C:\Windows\System\aGjftoQ.exe	114cfff18e6b695957a7c3fc12b98e578cc98114c8f858656b616db6cefb1533.exe
File created	C:\Windows\System\YrYvnLW.exe	114cfff18e6b695957a7c3fc12b98e578cc98114c8f858656b616db6cefb1533.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	12876	dwm.exe
Token: SeChangeNotifyPrivilege	12876	dwm.exe
Token: 33	12876	dwm.exe
Token: SeIncBasePriorityPrivilege	12876	dwm.exe
Token: SeShutdownPrivilege	12876	dwm.exe
Token: SeCreatePagefilePrivilege	12876	dwm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1260 wrote to memory of 1984	1260	114cfff18e6b695957a7c3fc12b98e578cc98114c8f858656b616db6cefb1533.exe	84
PID 1260 wrote to memory of 1984	1260	114cfff18e6b695957a7c3fc12b98e578cc98114c8f858656b616db6cefb1533.exe	84
PID 1260 wrote to memory of 5116	1260	114cfff18e6b695957a7c3fc12b98e578cc98114c8f858656b616db6cefb1533.exe	85
PID 1260 wrote to memory of 5116	1260	114cfff18e6b695957a7c3fc12b98e578cc98114c8f858656b616db6cefb1533.exe	85
PID 1260 wrote to memory of 1076	1260	114cfff18e6b695957a7c3fc12b98e578cc98114c8f858656b616db6cefb1533.exe	86
PID 1260 wrote to memory of 1076	1260	114cfff18e6b695957a7c3fc12b98e578cc98114c8f858656b616db6cefb1533.exe	86
PID 1260 wrote to memory of 4532	1260	114cfff18e6b695957a7c3fc12b98e578cc98114c8f858656b616db6cefb1533.exe	87
PID 1260 wrote to memory of 4532	1260	114cfff18e6b695957a7c3fc12b98e578cc98114c8f858656b616db6cefb1533.exe	87
PID 1260 wrote to memory of 3036	1260	114cfff18e6b695957a7c3fc12b98e578cc98114c8f858656b616db6cefb1533.exe	88
PID 1260 wrote to memory of 3036	1260	114cfff18e6b695957a7c3fc12b98e578cc98114c8f858656b616db6cefb1533.exe	88
PID 1260 wrote to memory of 384	1260	114cfff18e6b695957a7c3fc12b98e578cc98114c8f858656b616db6cefb1533.exe	89
PID 1260 wrote to memory of 384	1260	114cfff18e6b695957a7c3fc12b98e578cc98114c8f858656b616db6cefb1533.exe	89
PID 1260 wrote to memory of 1484	1260	114cfff18e6b695957a7c3fc12b98e578cc98114c8f858656b616db6cefb1533.exe	90
PID 1260 wrote to memory of 1484	1260	114cfff18e6b695957a7c3fc12b98e578cc98114c8f858656b616db6cefb1533.exe	90
PID 1260 wrote to memory of 4648	1260	114cfff18e6b695957a7c3fc12b98e578cc98114c8f858656b616db6cefb1533.exe	91
PID 1260 wrote to memory of 4648	1260	114cfff18e6b695957a7c3fc12b98e578cc98114c8f858656b616db6cefb1533.exe	91
PID 1260 wrote to memory of 3004	1260	114cfff18e6b695957a7c3fc12b98e578cc98114c8f858656b616db6cefb1533.exe	92
PID 1260 wrote to memory of 3004	1260	114cfff18e6b695957a7c3fc12b98e578cc98114c8f858656b616db6cefb1533.exe	92
PID 1260 wrote to memory of 1036	1260	114cfff18e6b695957a7c3fc12b98e578cc98114c8f858656b616db6cefb1533.exe	93
PID 1260 wrote to memory of 1036	1260	114cfff18e6b695957a7c3fc12b98e578cc98114c8f858656b616db6cefb1533.exe	93
PID 1260 wrote to memory of 2244	1260	114cfff18e6b695957a7c3fc12b98e578cc98114c8f858656b616db6cefb1533.exe	94
PID 1260 wrote to memory of 2244	1260	114cfff18e6b695957a7c3fc12b98e578cc98114c8f858656b616db6cefb1533.exe	94
PID 1260 wrote to memory of 2388	1260	114cfff18e6b695957a7c3fc12b98e578cc98114c8f858656b616db6cefb1533.exe	95
PID 1260 wrote to memory of 2388	1260	114cfff18e6b695957a7c3fc12b98e578cc98114c8f858656b616db6cefb1533.exe	95
PID 1260 wrote to memory of 2212	1260	114cfff18e6b695957a7c3fc12b98e578cc98114c8f858656b616db6cefb1533.exe	96
PID 1260 wrote to memory of 2212	1260	114cfff18e6b695957a7c3fc12b98e578cc98114c8f858656b616db6cefb1533.exe	96
PID 1260 wrote to memory of 1532	1260	114cfff18e6b695957a7c3fc12b98e578cc98114c8f858656b616db6cefb1533.exe	97
PID 1260 wrote to memory of 1532	1260	114cfff18e6b695957a7c3fc12b98e578cc98114c8f858656b616db6cefb1533.exe	97
PID 1260 wrote to memory of 3300	1260	114cfff18e6b695957a7c3fc12b98e578cc98114c8f858656b616db6cefb1533.exe	98
PID 1260 wrote to memory of 3300	1260	114cfff18e6b695957a7c3fc12b98e578cc98114c8f858656b616db6cefb1533.exe	98
PID 1260 wrote to memory of 3424	1260	114cfff18e6b695957a7c3fc12b98e578cc98114c8f858656b616db6cefb1533.exe	99
PID 1260 wrote to memory of 3424	1260	114cfff18e6b695957a7c3fc12b98e578cc98114c8f858656b616db6cefb1533.exe	99
PID 1260 wrote to memory of 636	1260	114cfff18e6b695957a7c3fc12b98e578cc98114c8f858656b616db6cefb1533.exe	100
PID 1260 wrote to memory of 636	1260	114cfff18e6b695957a7c3fc12b98e578cc98114c8f858656b616db6cefb1533.exe	100
PID 1260 wrote to memory of 4548	1260	114cfff18e6b695957a7c3fc12b98e578cc98114c8f858656b616db6cefb1533.exe	101
PID 1260 wrote to memory of 4548	1260	114cfff18e6b695957a7c3fc12b98e578cc98114c8f858656b616db6cefb1533.exe	101
PID 1260 wrote to memory of 1268	1260	114cfff18e6b695957a7c3fc12b98e578cc98114c8f858656b616db6cefb1533.exe	102
PID 1260 wrote to memory of 1268	1260	114cfff18e6b695957a7c3fc12b98e578cc98114c8f858656b616db6cefb1533.exe	102
PID 1260 wrote to memory of 4216	1260	114cfff18e6b695957a7c3fc12b98e578cc98114c8f858656b616db6cefb1533.exe	103
PID 1260 wrote to memory of 4216	1260	114cfff18e6b695957a7c3fc12b98e578cc98114c8f858656b616db6cefb1533.exe	103
PID 1260 wrote to memory of 716	1260	114cfff18e6b695957a7c3fc12b98e578cc98114c8f858656b616db6cefb1533.exe	104
PID 1260 wrote to memory of 716	1260	114cfff18e6b695957a7c3fc12b98e578cc98114c8f858656b616db6cefb1533.exe	104
PID 1260 wrote to memory of 4144	1260	114cfff18e6b695957a7c3fc12b98e578cc98114c8f858656b616db6cefb1533.exe	105
PID 1260 wrote to memory of 4144	1260	114cfff18e6b695957a7c3fc12b98e578cc98114c8f858656b616db6cefb1533.exe	105
PID 1260 wrote to memory of 3272	1260	114cfff18e6b695957a7c3fc12b98e578cc98114c8f858656b616db6cefb1533.exe	106
PID 1260 wrote to memory of 3272	1260	114cfff18e6b695957a7c3fc12b98e578cc98114c8f858656b616db6cefb1533.exe	106
PID 1260 wrote to memory of 5096	1260	114cfff18e6b695957a7c3fc12b98e578cc98114c8f858656b616db6cefb1533.exe	107
PID 1260 wrote to memory of 5096	1260	114cfff18e6b695957a7c3fc12b98e578cc98114c8f858656b616db6cefb1533.exe	107
PID 1260 wrote to memory of 4040	1260	114cfff18e6b695957a7c3fc12b98e578cc98114c8f858656b616db6cefb1533.exe	108
PID 1260 wrote to memory of 4040	1260	114cfff18e6b695957a7c3fc12b98e578cc98114c8f858656b616db6cefb1533.exe	108
PID 1260 wrote to memory of 2424	1260	114cfff18e6b695957a7c3fc12b98e578cc98114c8f858656b616db6cefb1533.exe	109
PID 1260 wrote to memory of 2424	1260	114cfff18e6b695957a7c3fc12b98e578cc98114c8f858656b616db6cefb1533.exe	109
PID 1260 wrote to memory of 1396	1260	114cfff18e6b695957a7c3fc12b98e578cc98114c8f858656b616db6cefb1533.exe	110
PID 1260 wrote to memory of 1396	1260	114cfff18e6b695957a7c3fc12b98e578cc98114c8f858656b616db6cefb1533.exe	110
PID 1260 wrote to memory of 1864	1260	114cfff18e6b695957a7c3fc12b98e578cc98114c8f858656b616db6cefb1533.exe	111
PID 1260 wrote to memory of 1864	1260	114cfff18e6b695957a7c3fc12b98e578cc98114c8f858656b616db6cefb1533.exe	111
PID 1260 wrote to memory of 2660	1260	114cfff18e6b695957a7c3fc12b98e578cc98114c8f858656b616db6cefb1533.exe	112
PID 1260 wrote to memory of 2660	1260	114cfff18e6b695957a7c3fc12b98e578cc98114c8f858656b616db6cefb1533.exe	112
PID 1260 wrote to memory of 4776	1260	114cfff18e6b695957a7c3fc12b98e578cc98114c8f858656b616db6cefb1533.exe	113
PID 1260 wrote to memory of 4776	1260	114cfff18e6b695957a7c3fc12b98e578cc98114c8f858656b616db6cefb1533.exe	113
PID 1260 wrote to memory of 3860	1260	114cfff18e6b695957a7c3fc12b98e578cc98114c8f858656b616db6cefb1533.exe	114
PID 1260 wrote to memory of 3860	1260	114cfff18e6b695957a7c3fc12b98e578cc98114c8f858656b616db6cefb1533.exe	114
PID 1260 wrote to memory of 1956	1260	114cfff18e6b695957a7c3fc12b98e578cc98114c8f858656b616db6cefb1533.exe	115
PID 1260 wrote to memory of 1956	1260	114cfff18e6b695957a7c3fc12b98e578cc98114c8f858656b616db6cefb1533.exe	115

C:\Users\Admin\AppData\Local\Temp\114cfff18e6b695957a7c3fc12b98e578cc98114c8f858656b616db6cefb1533.exe
"C:\Users\Admin\AppData\Local\Temp\114cfff18e6b695957a7c3fc12b98e578cc98114c8f858656b616db6cefb1533.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1260
- C:\Windows\System\PDEwFjI.exe
  C:\Windows\System\PDEwFjI.exe
  2⤵
  - Executes dropped EXE
  PID:1984
- C:\Windows\System\valysXL.exe
  C:\Windows\System\valysXL.exe
  2⤵
  - Executes dropped EXE
  PID:5116
- C:\Windows\System\obihmVS.exe
  C:\Windows\System\obihmVS.exe
  2⤵
  - Executes dropped EXE
  PID:1076
- C:\Windows\System\zjvzdIi.exe
  C:\Windows\System\zjvzdIi.exe
  2⤵
  - Executes dropped EXE
  PID:4532
- C:\Windows\System\kZdHZUY.exe
  C:\Windows\System\kZdHZUY.exe
  2⤵
  - Executes dropped EXE
  PID:3036
- C:\Windows\System\HrMhjyG.exe
  C:\Windows\System\HrMhjyG.exe
  2⤵
  - Executes dropped EXE
  PID:384
- C:\Windows\System\PldRyVx.exe
  C:\Windows\System\PldRyVx.exe
  2⤵
  - Executes dropped EXE
  PID:1484
- C:\Windows\System\baYGsYf.exe
  C:\Windows\System\baYGsYf.exe
  2⤵
  - Executes dropped EXE
  PID:4648
- C:\Windows\System\gOqUjBw.exe
  C:\Windows\System\gOqUjBw.exe
  2⤵
  - Executes dropped EXE
  PID:3004
- C:\Windows\System\yTauGNS.exe
  C:\Windows\System\yTauGNS.exe
  2⤵
  - Executes dropped EXE
  PID:1036
- C:\Windows\System\mRmDGXQ.exe
  C:\Windows\System\mRmDGXQ.exe
  2⤵
  - Executes dropped EXE
  PID:2244
- C:\Windows\System\OIjMdss.exe
  C:\Windows\System\OIjMdss.exe
  2⤵
  - Executes dropped EXE
  PID:2388
- C:\Windows\System\JIjXAHp.exe
  C:\Windows\System\JIjXAHp.exe
  2⤵
  - Executes dropped EXE
  PID:2212
- C:\Windows\System\OMpellX.exe
  C:\Windows\System\OMpellX.exe
  2⤵
  - Executes dropped EXE
  PID:1532
- C:\Windows\System\WcpeZzN.exe
  C:\Windows\System\WcpeZzN.exe
  2⤵
  - Executes dropped EXE
  PID:3300
- C:\Windows\System\hOBhYfP.exe
  C:\Windows\System\hOBhYfP.exe
  2⤵
  - Executes dropped EXE
  PID:3424
- C:\Windows\System\oZqYnYl.exe
  C:\Windows\System\oZqYnYl.exe
  2⤵
  - Executes dropped EXE
  PID:636
- C:\Windows\System\UnIraCG.exe
  C:\Windows\System\UnIraCG.exe
  2⤵
  - Executes dropped EXE
  PID:4548
- C:\Windows\System\Egppema.exe
  C:\Windows\System\Egppema.exe
  2⤵
  - Executes dropped EXE
  PID:1268
- C:\Windows\System\iadvJxs.exe
  C:\Windows\System\iadvJxs.exe
  2⤵
  - Executes dropped EXE
  PID:4216
- C:\Windows\System\MQoXtFs.exe
  C:\Windows\System\MQoXtFs.exe
  2⤵
  - Executes dropped EXE
  PID:716
- C:\Windows\System\xAtleed.exe
  C:\Windows\System\xAtleed.exe
  2⤵
  - Executes dropped EXE
  PID:4144
- C:\Windows\System\IvLtsMV.exe
  C:\Windows\System\IvLtsMV.exe
  2⤵
  - Executes dropped EXE
  PID:3272
- C:\Windows\System\rGkyhFO.exe
  C:\Windows\System\rGkyhFO.exe
  2⤵
  - Executes dropped EXE
  PID:5096
- C:\Windows\System\LWruDhk.exe
  C:\Windows\System\LWruDhk.exe
  2⤵
  - Executes dropped EXE
  PID:4040
- C:\Windows\System\RrUlCiB.exe
  C:\Windows\System\RrUlCiB.exe
  2⤵
  - Executes dropped EXE
  PID:2424
- C:\Windows\System\IFvdmHL.exe
  C:\Windows\System\IFvdmHL.exe
  2⤵
  - Executes dropped EXE
  PID:1396
- C:\Windows\System\WfQEfED.exe
  C:\Windows\System\WfQEfED.exe
  2⤵
  - Executes dropped EXE
  PID:1864
- C:\Windows\System\tRVWqcT.exe
  C:\Windows\System\tRVWqcT.exe
  2⤵
  - Executes dropped EXE
  PID:2660
- C:\Windows\System\vWrVbDT.exe
  C:\Windows\System\vWrVbDT.exe
  2⤵
  - Executes dropped EXE
  PID:4776
- C:\Windows\System\qmiWPLA.exe
  C:\Windows\System\qmiWPLA.exe
  2⤵
  - Executes dropped EXE
  PID:3860
- C:\Windows\System\sDJnVnW.exe
  C:\Windows\System\sDJnVnW.exe
  2⤵
  - Executes dropped EXE
  PID:1956
- C:\Windows\System\MKGNmsO.exe
  C:\Windows\System\MKGNmsO.exe
  2⤵
  - Executes dropped EXE
  PID:5000
- C:\Windows\System\yonjeYx.exe
  C:\Windows\System\yonjeYx.exe
  2⤵
  - Executes dropped EXE
  PID:3708
- C:\Windows\System\AHxWgxx.exe
  C:\Windows\System\AHxWgxx.exe
  2⤵
  - Executes dropped EXE
  PID:3304
- C:\Windows\System\sHYrMFN.exe
  C:\Windows\System\sHYrMFN.exe
  2⤵
  - Executes dropped EXE
  PID:1128
- C:\Windows\System\eJnKSMc.exe
  C:\Windows\System\eJnKSMc.exe
  2⤵
  - Executes dropped EXE
  PID:4792
- C:\Windows\System\lADSBhe.exe
  C:\Windows\System\lADSBhe.exe
  2⤵
  - Executes dropped EXE
  PID:3476
- C:\Windows\System\BSJHYQl.exe
  C:\Windows\System\BSJHYQl.exe
  2⤵
  - Executes dropped EXE
  PID:3404
- C:\Windows\System\zqADUqy.exe
  C:\Windows\System\zqADUqy.exe
  2⤵
  - Executes dropped EXE
  PID:2452
- C:\Windows\System\vePMpix.exe
  C:\Windows\System\vePMpix.exe
  2⤵
  - Executes dropped EXE
  PID:2820
- C:\Windows\System\XMSTjKA.exe
  C:\Windows\System\XMSTjKA.exe
  2⤵
  - Executes dropped EXE
  PID:3596
- C:\Windows\System\pTMIkiE.exe
  C:\Windows\System\pTMIkiE.exe
  2⤵
  - Executes dropped EXE
  PID:4848
- C:\Windows\System\IsYrIQS.exe
  C:\Windows\System\IsYrIQS.exe
  2⤵
  - Executes dropped EXE
  PID:368
- C:\Windows\System\nwUEJAf.exe
  C:\Windows\System\nwUEJAf.exe
  2⤵
  - Executes dropped EXE
  PID:4292
- C:\Windows\System\thMNOGD.exe
  C:\Windows\System\thMNOGD.exe
  2⤵
  - Executes dropped EXE
  PID:4780
- C:\Windows\System\bouuOHa.exe
  C:\Windows\System\bouuOHa.exe
  2⤵
  - Executes dropped EXE
  PID:1520
- C:\Windows\System\DMsuVUE.exe
  C:\Windows\System\DMsuVUE.exe
  2⤵
  - Executes dropped EXE
  PID:2432
- C:\Windows\System\RHLYixm.exe
  C:\Windows\System\RHLYixm.exe
  2⤵
  - Executes dropped EXE
  PID:4336
- C:\Windows\System\yqFDZpX.exe
  C:\Windows\System\yqFDZpX.exe
  2⤵
  - Executes dropped EXE
  PID:4104
- C:\Windows\System\MxBZRJS.exe
  C:\Windows\System\MxBZRJS.exe
  2⤵
  - Executes dropped EXE
  PID:5104
- C:\Windows\System\SGjOzkW.exe
  C:\Windows\System\SGjOzkW.exe
  2⤵
  - Executes dropped EXE
  PID:2976
- C:\Windows\System\mfOMcKJ.exe
  C:\Windows\System\mfOMcKJ.exe
  2⤵
  - Executes dropped EXE
  PID:1996
- C:\Windows\System\wEXtzhf.exe
  C:\Windows\System\wEXtzhf.exe
  2⤵
  - Executes dropped EXE
  PID:2520
- C:\Windows\System\sgsUjkn.exe
  C:\Windows\System\sgsUjkn.exe
  2⤵
  - Executes dropped EXE
  PID:1012
- C:\Windows\System\DtHFlZZ.exe
  C:\Windows\System\DtHFlZZ.exe
  2⤵
  - Executes dropped EXE
  PID:4740
- C:\Windows\System\ncgwwkF.exe
  C:\Windows\System\ncgwwkF.exe
  2⤵
  - Executes dropped EXE
  PID:3680
- C:\Windows\System\ZrAbojv.exe
  C:\Windows\System\ZrAbojv.exe
  2⤵
  - Executes dropped EXE
  PID:1784
- C:\Windows\System\XFsnhas.exe
  C:\Windows\System\XFsnhas.exe
  2⤵
  - Executes dropped EXE
  PID:4564
- C:\Windows\System\xgUtIGM.exe
  C:\Windows\System\xgUtIGM.exe
  2⤵
  - Executes dropped EXE
  PID:4272
- C:\Windows\System\aeBuZXc.exe
  C:\Windows\System\aeBuZXc.exe
  2⤵
  - Executes dropped EXE
  PID:4832
- C:\Windows\System\sKUswJg.exe
  C:\Windows\System\sKUswJg.exe
  2⤵
  - Executes dropped EXE
  PID:1228
- C:\Windows\System\oBupqwN.exe
  C:\Windows\System\oBupqwN.exe
  2⤵
  - Executes dropped EXE
  PID:4568
- C:\Windows\System\VdRONBw.exe
  C:\Windows\System\VdRONBw.exe
  2⤵
  - Executes dropped EXE
  PID:3460
- C:\Windows\System\ydsCkLj.exe
  C:\Windows\System\ydsCkLj.exe
  2⤵
  PID:4076
- C:\Windows\System\fYQzXNq.exe
  C:\Windows\System\fYQzXNq.exe
  2⤵
  PID:1408
- C:\Windows\System\OVrNQBt.exe
  C:\Windows\System\OVrNQBt.exe
  2⤵
  PID:2032
- C:\Windows\System\cnFBFAP.exe
  C:\Windows\System\cnFBFAP.exe
  2⤵
  PID:3508
- C:\Windows\System\NJbzQbA.exe
  C:\Windows\System\NJbzQbA.exe
  2⤵
  PID:1200
- C:\Windows\System\ajxBsdl.exe
  C:\Windows\System\ajxBsdl.exe
  2⤵
  PID:2888
- C:\Windows\System\ytfIaJz.exe
  C:\Windows\System\ytfIaJz.exe
  2⤵
  PID:704
- C:\Windows\System\wVCHlfg.exe
  C:\Windows\System\wVCHlfg.exe
  2⤵
  PID:1184
- C:\Windows\System\ZHEhTke.exe
  C:\Windows\System\ZHEhTke.exe
  2⤵
  PID:2240
- C:\Windows\System\nojmwgj.exe
  C:\Windows\System\nojmwgj.exe
  2⤵
  PID:4544
- C:\Windows\System\GGsaPTX.exe
  C:\Windows\System\GGsaPTX.exe
  2⤵
  PID:4744
- C:\Windows\System\iFdxXXN.exe
  C:\Windows\System\iFdxXXN.exe
  2⤵
  PID:1576
- C:\Windows\System\fOEoONk.exe
  C:\Windows\System\fOEoONk.exe
  2⤵
  PID:1032
- C:\Windows\System\ONXduyP.exe
  C:\Windows\System\ONXduyP.exe
  2⤵
  PID:4608
- C:\Windows\System\wUYMrgM.exe
  C:\Windows\System\wUYMrgM.exe
  2⤵
  PID:3684
- C:\Windows\System\ndYeivO.exe
  C:\Windows\System\ndYeivO.exe
  2⤵
  PID:2712
- C:\Windows\System\OLaOhWo.exe
  C:\Windows\System\OLaOhWo.exe
  2⤵
  PID:4232
- C:\Windows\System\QMzjkqN.exe
  C:\Windows\System\QMzjkqN.exe
  2⤵
  PID:1508
- C:\Windows\System\ICRaNtQ.exe
  C:\Windows\System\ICRaNtQ.exe
  2⤵
  PID:3780
- C:\Windows\System\wkdnWqD.exe
  C:\Windows\System\wkdnWqD.exe
  2⤵
  PID:4784
- C:\Windows\System\IphNzNw.exe
  C:\Windows\System\IphNzNw.exe
  2⤵
  PID:4128
- C:\Windows\System\utKWvMM.exe
  C:\Windows\System\utKWvMM.exe
  2⤵
  PID:2368
- C:\Windows\System\LAxmxfR.exe
  C:\Windows\System\LAxmxfR.exe
  2⤵
  PID:3972
- C:\Windows\System\EnGKlVA.exe
  C:\Windows\System\EnGKlVA.exe
  2⤵
  PID:2288
- C:\Windows\System\YjuQLns.exe
  C:\Windows\System\YjuQLns.exe
  2⤵
  PID:4332
- C:\Windows\System\uAqtoGY.exe
  C:\Windows\System\uAqtoGY.exe
  2⤵
  PID:4436
- C:\Windows\System\YwaUspx.exe
  C:\Windows\System\YwaUspx.exe
  2⤵
  PID:4312
- C:\Windows\System\iJjTpTp.exe
  C:\Windows\System\iJjTpTp.exe
  2⤵
  PID:4408
- C:\Windows\System\aKCisDE.exe
  C:\Windows\System\aKCisDE.exe
  2⤵
  PID:2860
- C:\Windows\System\CUnaXsd.exe
  C:\Windows\System\CUnaXsd.exe
  2⤵
  PID:4668
- C:\Windows\System\gGoDQrM.exe
  C:\Windows\System\gGoDQrM.exe
  2⤵
  PID:2412
- C:\Windows\System\jscyqjJ.exe
  C:\Windows\System\jscyqjJ.exe
  2⤵
  PID:2892
- C:\Windows\System\ifgFZDA.exe
  C:\Windows\System\ifgFZDA.exe
  2⤵
  PID:3700
- C:\Windows\System\vqMEjjv.exe
  C:\Windows\System\vqMEjjv.exe
  2⤵
  PID:1472
- C:\Windows\System\qgZeDdM.exe
  C:\Windows\System\qgZeDdM.exe
  2⤵
  PID:4536
- C:\Windows\System\pJkbAFE.exe
  C:\Windows\System\pJkbAFE.exe
  2⤵
  PID:2184
- C:\Windows\System\GGhQYCm.exe
  C:\Windows\System\GGhQYCm.exe
  2⤵
  PID:5056
- C:\Windows\System\PyeASbA.exe
  C:\Windows\System\PyeASbA.exe
  2⤵
  PID:1568
- C:\Windows\System\hDnvuao.exe
  C:\Windows\System\hDnvuao.exe
  2⤵
  PID:968
- C:\Windows\System\NEwbSZr.exe
  C:\Windows\System\NEwbSZr.exe
  2⤵
  PID:5128
- C:\Windows\System\CftaPxc.exe
  C:\Windows\System\CftaPxc.exe
  2⤵
  PID:5160
- C:\Windows\System\mecokng.exe
  C:\Windows\System\mecokng.exe
  2⤵
  PID:5192
- C:\Windows\System\EpDZJTm.exe
  C:\Windows\System\EpDZJTm.exe
  2⤵
  PID:5220
- C:\Windows\System\OZBpvzE.exe
  C:\Windows\System\OZBpvzE.exe
  2⤵
  PID:5244
- C:\Windows\System\VJQJRXK.exe
  C:\Windows\System\VJQJRXK.exe
  2⤵
  PID:5268
- C:\Windows\System\KiLZxZA.exe
  C:\Windows\System\KiLZxZA.exe
  2⤵
  PID:5300
- C:\Windows\System\hiGyJzE.exe
  C:\Windows\System\hiGyJzE.exe
  2⤵
  PID:5356
- C:\Windows\System\SUEpbbp.exe
  C:\Windows\System\SUEpbbp.exe
  2⤵
  PID:5396
- C:\Windows\System\yYxMFfQ.exe
  C:\Windows\System\yYxMFfQ.exe
  2⤵
  PID:5424
- C:\Windows\System\GOiWhwG.exe
  C:\Windows\System\GOiWhwG.exe
  2⤵
  PID:5452
- C:\Windows\System\wiTqmMj.exe
  C:\Windows\System\wiTqmMj.exe
  2⤵
  PID:5476
- C:\Windows\System\LKIdUUA.exe
  C:\Windows\System\LKIdUUA.exe
  2⤵
  PID:5508
- C:\Windows\System\sycPlUf.exe
  C:\Windows\System\sycPlUf.exe
  2⤵
  PID:5536
- C:\Windows\System\EiOAjad.exe
  C:\Windows\System\EiOAjad.exe
  2⤵
  PID:5568
- C:\Windows\System\IBftWtz.exe
  C:\Windows\System\IBftWtz.exe
  2⤵
  PID:5588
- C:\Windows\System\kCQsTJr.exe
  C:\Windows\System\kCQsTJr.exe
  2⤵
  PID:5616
- C:\Windows\System\SxPryXh.exe
  C:\Windows\System\SxPryXh.exe
  2⤵
  PID:5652
- C:\Windows\System\MtXYCFA.exe
  C:\Windows\System\MtXYCFA.exe
  2⤵
  PID:5680
- C:\Windows\System\taYsvtT.exe
  C:\Windows\System\taYsvtT.exe
  2⤵
  PID:5704
- C:\Windows\System\GqSckyP.exe
  C:\Windows\System\GqSckyP.exe
  2⤵
  PID:5728
- C:\Windows\System\rptKgqh.exe
  C:\Windows\System\rptKgqh.exe
  2⤵
  PID:5760
- C:\Windows\System\FoEZLgf.exe
  C:\Windows\System\FoEZLgf.exe
  2⤵
  PID:5792
- C:\Windows\System\RPaNAjX.exe
  C:\Windows\System\RPaNAjX.exe
  2⤵
  PID:5828
- C:\Windows\System\bvdPhMq.exe
  C:\Windows\System\bvdPhMq.exe
  2⤵
  PID:5852
- C:\Windows\System\QvbUQdo.exe
  C:\Windows\System\QvbUQdo.exe
  2⤵
  PID:5872
- C:\Windows\System\sNQuVwQ.exe
  C:\Windows\System\sNQuVwQ.exe
  2⤵
  PID:5892
- C:\Windows\System\lhCtsBD.exe
  C:\Windows\System\lhCtsBD.exe
  2⤵
  PID:5920
- C:\Windows\System\gjKQFfN.exe
  C:\Windows\System\gjKQFfN.exe
  2⤵
  PID:5940
- C:\Windows\System\rceqeTn.exe
  C:\Windows\System\rceqeTn.exe
  2⤵
  PID:5972
- C:\Windows\System\HIqjGPl.exe
  C:\Windows\System\HIqjGPl.exe
  2⤵
  PID:6000
- C:\Windows\System\oOMVTDL.exe
  C:\Windows\System\oOMVTDL.exe
  2⤵
  PID:6028
- C:\Windows\System\GykSzmY.exe
  C:\Windows\System\GykSzmY.exe
  2⤵
  PID:6060
- C:\Windows\System\BDeHmha.exe
  C:\Windows\System\BDeHmha.exe
  2⤵
  PID:6088
- C:\Windows\System\gcSdcvx.exe
  C:\Windows\System\gcSdcvx.exe
  2⤵
  PID:6116
- C:\Windows\System\DAQkAfz.exe
  C:\Windows\System\DAQkAfz.exe
  2⤵
  PID:3756
- C:\Windows\System\yfHcFks.exe
  C:\Windows\System\yfHcFks.exe
  2⤵
  PID:5124
- C:\Windows\System\OCHZmIE.exe
  C:\Windows\System\OCHZmIE.exe
  2⤵
  PID:5180
- C:\Windows\System\gCOlzaW.exe
  C:\Windows\System\gCOlzaW.exe
  2⤵
  PID:5288
- C:\Windows\System\SMymePt.exe
  C:\Windows\System\SMymePt.exe
  2⤵
  PID:5080
- C:\Windows\System\BuhWjEx.exe
  C:\Windows\System\BuhWjEx.exe
  2⤵
  PID:5376
- C:\Windows\System\eVNkcLh.exe
  C:\Windows\System\eVNkcLh.exe
  2⤵
  PID:5448
- C:\Windows\System\ofbBGpN.exe
  C:\Windows\System\ofbBGpN.exe
  2⤵
  PID:5492
- C:\Windows\System\ACzeLEp.exe
  C:\Windows\System\ACzeLEp.exe
  2⤵
  PID:5552
- C:\Windows\System\lKcUjlH.exe
  C:\Windows\System\lKcUjlH.exe
  2⤵
  PID:5352
- C:\Windows\System\MlQprET.exe
  C:\Windows\System\MlQprET.exe
  2⤵
  PID:5700
- C:\Windows\System\eNPDMYY.exe
  C:\Windows\System\eNPDMYY.exe
  2⤵
  PID:5780
- C:\Windows\System\sacoCFu.exe
  C:\Windows\System\sacoCFu.exe
  2⤵
  PID:5836
- C:\Windows\System\FCpYjRS.exe
  C:\Windows\System\FCpYjRS.exe
  2⤵
  PID:5900
- C:\Windows\System\IEhXbch.exe
  C:\Windows\System\IEhXbch.exe
  2⤵
  PID:5952
- C:\Windows\System\oHWsRTw.exe
  C:\Windows\System\oHWsRTw.exe
  2⤵
  PID:5980
- C:\Windows\System\BKHCpvK.exe
  C:\Windows\System\BKHCpvK.exe
  2⤵
  PID:6068
- C:\Windows\System\tTWqXnh.exe
  C:\Windows\System\tTWqXnh.exe
  2⤵
  PID:6136
- C:\Windows\System\hchhgnU.exe
  C:\Windows\System\hchhgnU.exe
  2⤵
  PID:2312
- C:\Windows\System\UOKfZbU.exe
  C:\Windows\System\UOKfZbU.exe
  2⤵
  PID:5252
- C:\Windows\System\gPaqWRK.exe
  C:\Windows\System\gPaqWRK.exe
  2⤵
  PID:5312
- C:\Windows\System\ALZsqgh.exe
  C:\Windows\System\ALZsqgh.exe
  2⤵
  PID:5524
- C:\Windows\System\sjtCNIT.exe
  C:\Windows\System\sjtCNIT.exe
  2⤵
  PID:5660
- C:\Windows\System\MVPbCNp.exe
  C:\Windows\System\MVPbCNp.exe
  2⤵
  PID:5756
- C:\Windows\System\aLXxsxn.exe
  C:\Windows\System\aLXxsxn.exe
  2⤵
  PID:5868
- C:\Windows\System\YTrlpyV.exe
  C:\Windows\System\YTrlpyV.exe
  2⤵
  PID:5912
- C:\Windows\System\OKxQJTc.exe
  C:\Windows\System\OKxQJTc.exe
  2⤵
  PID:6052
- C:\Windows\System\oQNscQj.exe
  C:\Windows\System\oQNscQj.exe
  2⤵
  PID:4684
- C:\Windows\System\bfYklxV.exe
  C:\Windows\System\bfYklxV.exe
  2⤵
  PID:5412
- C:\Windows\System\YQqymon.exe
  C:\Windows\System\YQqymon.exe
  2⤵
  PID:2688
- C:\Windows\System\YrjRpvg.exe
  C:\Windows\System\YrjRpvg.exe
  2⤵
  PID:5904
- C:\Windows\System\FjkVoob.exe
  C:\Windows\System\FjkVoob.exe
  2⤵
  PID:4892
- C:\Windows\System\DUDNwJH.exe
  C:\Windows\System\DUDNwJH.exe
  2⤵
  PID:5884
- C:\Windows\System\mqbYIdD.exe
  C:\Windows\System\mqbYIdD.exe
  2⤵
  PID:6160
- C:\Windows\System\Awxinhh.exe
  C:\Windows\System\Awxinhh.exe
  2⤵
  PID:6192
- C:\Windows\System\JTxCxCr.exe
  C:\Windows\System\JTxCxCr.exe
  2⤵
  PID:6220
- C:\Windows\System\OQWDcmk.exe
  C:\Windows\System\OQWDcmk.exe
  2⤵
  PID:6248
- C:\Windows\System\jfuWHyu.exe
  C:\Windows\System\jfuWHyu.exe
  2⤵
  PID:6276
- C:\Windows\System\OMSeciM.exe
  C:\Windows\System\OMSeciM.exe
  2⤵
  PID:6312
- C:\Windows\System\iQpcboh.exe
  C:\Windows\System\iQpcboh.exe
  2⤵
  PID:6340
- C:\Windows\System\QyMWljl.exe
  C:\Windows\System\QyMWljl.exe
  2⤵
  PID:6372
- C:\Windows\System\jvFpCuM.exe
  C:\Windows\System\jvFpCuM.exe
  2⤵
  PID:6400
- C:\Windows\System\bjQydiI.exe
  C:\Windows\System\bjQydiI.exe
  2⤵
  PID:6432
- C:\Windows\System\UNUolNV.exe
  C:\Windows\System\UNUolNV.exe
  2⤵
  PID:6456
- C:\Windows\System\yndXxYK.exe
  C:\Windows\System\yndXxYK.exe
  2⤵
  PID:6484
- C:\Windows\System\dsOyCVE.exe
  C:\Windows\System\dsOyCVE.exe
  2⤵
  PID:6516
- C:\Windows\System\XumfwFb.exe
  C:\Windows\System\XumfwFb.exe
  2⤵
  PID:6536
- C:\Windows\System\ANcFOwO.exe
  C:\Windows\System\ANcFOwO.exe
  2⤵
  PID:6556
- C:\Windows\System\UVyXTBe.exe
  C:\Windows\System\UVyXTBe.exe
  2⤵
  PID:6588
- C:\Windows\System\vsNFlzI.exe
  C:\Windows\System\vsNFlzI.exe
  2⤵
  PID:6624
- C:\Windows\System\avzhORx.exe
  C:\Windows\System\avzhORx.exe
  2⤵
  PID:6652
- C:\Windows\System\EaXzrIo.exe
  C:\Windows\System\EaXzrIo.exe
  2⤵
  PID:6680
- C:\Windows\System\EZRWDUD.exe
  C:\Windows\System\EZRWDUD.exe
  2⤵
  PID:6704
- C:\Windows\System\VfKOQPW.exe
  C:\Windows\System\VfKOQPW.exe
  2⤵
  PID:6732
- C:\Windows\System\FyCTElC.exe
  C:\Windows\System\FyCTElC.exe
  2⤵
  PID:6760
- C:\Windows\System\icliNSa.exe
  C:\Windows\System\icliNSa.exe
  2⤵
  PID:6792
- C:\Windows\System\hnvzTlG.exe
  C:\Windows\System\hnvzTlG.exe
  2⤵
  PID:6824
- C:\Windows\System\qTfIyvF.exe
  C:\Windows\System\qTfIyvF.exe
  2⤵
  PID:6852
- C:\Windows\System\OUHMmTr.exe
  C:\Windows\System\OUHMmTr.exe
  2⤵
  PID:6884
- C:\Windows\System\uYaVdnb.exe
  C:\Windows\System\uYaVdnb.exe
  2⤵
  PID:6912
- C:\Windows\System\ACFywLh.exe
  C:\Windows\System\ACFywLh.exe
  2⤵
  PID:6940
- C:\Windows\System\RJAlJJU.exe
  C:\Windows\System\RJAlJJU.exe
  2⤵
  PID:6968
- C:\Windows\System\wLcCPkf.exe
  C:\Windows\System\wLcCPkf.exe
  2⤵
  PID:6988
- C:\Windows\System\CtmTPtm.exe
  C:\Windows\System\CtmTPtm.exe
  2⤵
  PID:7008
- C:\Windows\System\UtBKjeG.exe
  C:\Windows\System\UtBKjeG.exe
  2⤵
  PID:7032
- C:\Windows\System\kUkHkDI.exe
  C:\Windows\System\kUkHkDI.exe
  2⤵
  PID:7064
- C:\Windows\System\NwfkyyT.exe
  C:\Windows\System\NwfkyyT.exe
  2⤵
  PID:7084
- C:\Windows\System\dHYiFMu.exe
  C:\Windows\System\dHYiFMu.exe
  2⤵
  PID:7112
- C:\Windows\System\OxLiqsM.exe
  C:\Windows\System\OxLiqsM.exe
  2⤵
  PID:7136
- C:\Windows\System\TyMtbVM.exe
  C:\Windows\System\TyMtbVM.exe
  2⤵
  PID:7164
- C:\Windows\System\yYoUrRM.exe
  C:\Windows\System\yYoUrRM.exe
  2⤵
  PID:6152
- C:\Windows\System\NIFvONb.exe
  C:\Windows\System\NIFvONb.exe
  2⤵
  PID:6180
- C:\Windows\System\dVWtTXW.exe
  C:\Windows\System\dVWtTXW.exe
  2⤵
  PID:6236
- C:\Windows\System\ksXnhGB.exe
  C:\Windows\System\ksXnhGB.exe
  2⤵
  PID:6352
- C:\Windows\System\RDgJege.exe
  C:\Windows\System\RDgJege.exe
  2⤵
  PID:6440
- C:\Windows\System\BNXqqWT.exe
  C:\Windows\System\BNXqqWT.exe
  2⤵
  PID:6452
- C:\Windows\System\zLSPzld.exe
  C:\Windows\System\zLSPzld.exe
  2⤵
  PID:6524
- C:\Windows\System\jQWdMdL.exe
  C:\Windows\System\jQWdMdL.exe
  2⤵
  PID:6584
- C:\Windows\System\augEzWr.exe
  C:\Windows\System\augEzWr.exe
  2⤵
  PID:6664
- C:\Windows\System\uccSZAH.exe
  C:\Windows\System\uccSZAH.exe
  2⤵
  PID:6720
- C:\Windows\System\HShPRNr.exe
  C:\Windows\System\HShPRNr.exe
  2⤵
  PID:6748
- C:\Windows\System\PKsLOiP.exe
  C:\Windows\System\PKsLOiP.exe
  2⤵
  PID:6836
- C:\Windows\System\jdiMHqg.exe
  C:\Windows\System\jdiMHqg.exe
  2⤵
  PID:6896
- C:\Windows\System\VoJWfBC.exe
  C:\Windows\System\VoJWfBC.exe
  2⤵
  PID:6904
- C:\Windows\System\anwKdgp.exe
  C:\Windows\System\anwKdgp.exe
  2⤵
  PID:6952
- C:\Windows\System\cQXxgtr.exe
  C:\Windows\System\cQXxgtr.exe
  2⤵
  PID:3516
- C:\Windows\System\gYWYJHU.exe
  C:\Windows\System\gYWYJHU.exe
  2⤵
  PID:7028
- C:\Windows\System\GnnSXkj.exe
  C:\Windows\System\GnnSXkj.exe
  2⤵
  PID:7132
- C:\Windows\System\OQafoJh.exe
  C:\Windows\System\OQafoJh.exe
  2⤵
  PID:6208
- C:\Windows\System\GOubOWY.exe
  C:\Windows\System\GOubOWY.exe
  2⤵
  PID:6300
- C:\Windows\System\HvvMxpF.exe
  C:\Windows\System\HvvMxpF.exe
  2⤵
  PID:2444
- C:\Windows\System\XTvlvnL.exe
  C:\Windows\System\XTvlvnL.exe
  2⤵
  PID:6696
- C:\Windows\System\Vcljxyf.exe
  C:\Windows\System\Vcljxyf.exe
  2⤵
  PID:6572
- C:\Windows\System\TWdExzr.exe
  C:\Windows\System\TWdExzr.exe
  2⤵
  PID:6808
- C:\Windows\System\gzNQgUC.exe
  C:\Windows\System\gzNQgUC.exe
  2⤵
  PID:6784
- C:\Windows\System\iOptKce.exe
  C:\Windows\System\iOptKce.exe
  2⤵
  PID:2528
- C:\Windows\System\KyhPWLn.exe
  C:\Windows\System\KyhPWLn.exe
  2⤵
  PID:7000
- C:\Windows\System\OsgYdGw.exe
  C:\Windows\System\OsgYdGw.exe
  2⤵
  PID:6384
- C:\Windows\System\YdQFXgU.exe
  C:\Windows\System\YdQFXgU.exe
  2⤵
  PID:7176
- C:\Windows\System\HsPPhRY.exe
  C:\Windows\System\HsPPhRY.exe
  2⤵
  PID:7208
- C:\Windows\System\ZCWdkuZ.exe
  C:\Windows\System\ZCWdkuZ.exe
  2⤵
  PID:7232
- C:\Windows\System\cEyniFT.exe
  C:\Windows\System\cEyniFT.exe
  2⤵
  PID:7252
- C:\Windows\System\FRvMzoV.exe
  C:\Windows\System\FRvMzoV.exe
  2⤵
  PID:7276
- C:\Windows\System\EUaypgM.exe
  C:\Windows\System\EUaypgM.exe
  2⤵
  PID:7292
- C:\Windows\System\ZfZtHqq.exe
  C:\Windows\System\ZfZtHqq.exe
  2⤵
  PID:7324
- C:\Windows\System\RLCOFCF.exe
  C:\Windows\System\RLCOFCF.exe
  2⤵
  PID:7348
- C:\Windows\System\SCtLPwh.exe
  C:\Windows\System\SCtLPwh.exe
  2⤵
  PID:7384
- C:\Windows\System\dbfZjfO.exe
  C:\Windows\System\dbfZjfO.exe
  2⤵
  PID:7412
- C:\Windows\System\TgKLtFi.exe
  C:\Windows\System\TgKLtFi.exe
  2⤵
  PID:7444
- C:\Windows\System\ANpjplR.exe
  C:\Windows\System\ANpjplR.exe
  2⤵
  PID:7472
- C:\Windows\System\vzAwnMW.exe
  C:\Windows\System\vzAwnMW.exe
  2⤵
  PID:7508
- C:\Windows\System\wrDcxji.exe
  C:\Windows\System\wrDcxji.exe
  2⤵
  PID:7536
- C:\Windows\System\UiZOyJd.exe
  C:\Windows\System\UiZOyJd.exe
  2⤵
  PID:7556
- C:\Windows\System\qrTSGvO.exe
  C:\Windows\System\qrTSGvO.exe
  2⤵
  PID:7588
- C:\Windows\System\hGaTaVo.exe
  C:\Windows\System\hGaTaVo.exe
  2⤵
  PID:7620
- C:\Windows\System\uUuGLKq.exe
  C:\Windows\System\uUuGLKq.exe
  2⤵
  PID:7648
- C:\Windows\System\eghROjV.exe
  C:\Windows\System\eghROjV.exe
  2⤵
  PID:7680
- C:\Windows\System\YKVRJWz.exe
  C:\Windows\System\YKVRJWz.exe
  2⤵
  PID:7700
- C:\Windows\System\UAdcBbi.exe
  C:\Windows\System\UAdcBbi.exe
  2⤵
  PID:7728
- C:\Windows\System\soEMUNM.exe
  C:\Windows\System\soEMUNM.exe
  2⤵
  PID:7744
- C:\Windows\System\VzJFkVX.exe
  C:\Windows\System\VzJFkVX.exe
  2⤵
  PID:7768
- C:\Windows\System\fbweESW.exe
  C:\Windows\System\fbweESW.exe
  2⤵
  PID:7792
- C:\Windows\System\NHlRhaB.exe
  C:\Windows\System\NHlRhaB.exe
  2⤵
  PID:7820
- C:\Windows\System\xNSMsVT.exe
  C:\Windows\System\xNSMsVT.exe
  2⤵
  PID:7848
- C:\Windows\System\OPKxauo.exe
  C:\Windows\System\OPKxauo.exe
  2⤵
  PID:7876
- C:\Windows\System\BSqTNwo.exe
  C:\Windows\System\BSqTNwo.exe
  2⤵
  PID:7904
- C:\Windows\System\artnUJK.exe
  C:\Windows\System\artnUJK.exe
  2⤵
  PID:7932
- C:\Windows\System\lFQNpIH.exe
  C:\Windows\System\lFQNpIH.exe
  2⤵
  PID:7956
- C:\Windows\System\KbsOwqA.exe
  C:\Windows\System\KbsOwqA.exe
  2⤵
  PID:7976
- C:\Windows\System\QKZIHUm.exe
  C:\Windows\System\QKZIHUm.exe
  2⤵
  PID:8008
- C:\Windows\System\REVTUNZ.exe
  C:\Windows\System\REVTUNZ.exe
  2⤵
  PID:8040
- C:\Windows\System\gYOBogn.exe
  C:\Windows\System\gYOBogn.exe
  2⤵
  PID:8064
- C:\Windows\System\NVRuCvk.exe
  C:\Windows\System\NVRuCvk.exe
  2⤵
  PID:8084
- C:\Windows\System\HAwwFKL.exe
  C:\Windows\System\HAwwFKL.exe
  2⤵
  PID:8116
- C:\Windows\System\QbGVbWI.exe
  C:\Windows\System\QbGVbWI.exe
  2⤵
  PID:8144
- C:\Windows\System\SsMAskS.exe
  C:\Windows\System\SsMAskS.exe
  2⤵
  PID:8172
- C:\Windows\System\mZqQiiv.exe
  C:\Windows\System\mZqQiiv.exe
  2⤵
  PID:7128
- C:\Windows\System\equWgFt.exe
  C:\Windows\System\equWgFt.exe
  2⤵
  PID:1872
- C:\Windows\System\yAeoYAN.exe
  C:\Windows\System\yAeoYAN.exe
  2⤵
  PID:7104
- C:\Windows\System\eaPNwjz.exe
  C:\Windows\System\eaPNwjz.exe
  2⤵
  PID:6392
- C:\Windows\System\GtXXlja.exe
  C:\Windows\System\GtXXlja.exe
  2⤵
  PID:7172
- C:\Windows\System\aUASshT.exe
  C:\Windows\System\aUASshT.exe
  2⤵
  PID:7264
- C:\Windows\System\jbKqxbw.exe
  C:\Windows\System\jbKqxbw.exe
  2⤵
  PID:7456
- C:\Windows\System\QXEXPth.exe
  C:\Windows\System\QXEXPth.exe
  2⤵
  PID:7392
- C:\Windows\System\NwinTDH.exe
  C:\Windows\System\NwinTDH.exe
  2⤵
  PID:7520
- C:\Windows\System\vMqJGKG.exe
  C:\Windows\System\vMqJGKG.exe
  2⤵
  PID:7432
- C:\Windows\System\akQJVSD.exe
  C:\Windows\System\akQJVSD.exe
  2⤵
  PID:7644
- C:\Windows\System\kXAZFQc.exe
  C:\Windows\System\kXAZFQc.exe
  2⤵
  PID:7668
- C:\Windows\System\oPdTtCd.exe
  C:\Windows\System\oPdTtCd.exe
  2⤵
  PID:7724
- C:\Windows\System\ajmmtmm.exe
  C:\Windows\System\ajmmtmm.exe
  2⤵
  PID:7816
- C:\Windows\System\eAKPmpL.exe
  C:\Windows\System\eAKPmpL.exe
  2⤵
  PID:7924
- C:\Windows\System\MHVTMeU.exe
  C:\Windows\System\MHVTMeU.exe
  2⤵
  PID:7916
- C:\Windows\System\qfHBnFy.exe
  C:\Windows\System\qfHBnFy.exe
  2⤵
  PID:8028
- C:\Windows\System\msFrAws.exe
  C:\Windows\System\msFrAws.exe
  2⤵
  PID:8100
- C:\Windows\System\lrSbPvp.exe
  C:\Windows\System\lrSbPvp.exe
  2⤵
  PID:8140
- C:\Windows\System\EJlvjsa.exe
  C:\Windows\System\EJlvjsa.exe
  2⤵
  PID:8052
- C:\Windows\System\UwdytuD.exe
  C:\Windows\System\UwdytuD.exe
  2⤵
  PID:1496
- C:\Windows\System\niVJWHv.exe
  C:\Windows\System\niVJWHv.exe
  2⤵
  PID:7368
- C:\Windows\System\icuNfee.exe
  C:\Windows\System\icuNfee.exe
  2⤵
  PID:7400
- C:\Windows\System\PPQAXZk.exe
  C:\Windows\System\PPQAXZk.exe
  2⤵
  PID:6552
- C:\Windows\System\rBFdPVg.exe
  C:\Windows\System\rBFdPVg.exe
  2⤵
  PID:7688
- C:\Windows\System\IhdmHYj.exe
  C:\Windows\System\IhdmHYj.exe
  2⤵
  PID:7344
- C:\Windows\System\pgNvzua.exe
  C:\Windows\System\pgNvzua.exe
  2⤵
  PID:7468
- C:\Windows\System\ItUOaWG.exe
  C:\Windows\System\ItUOaWG.exe
  2⤵
  PID:8020
- C:\Windows\System\ndBBtpg.exe
  C:\Windows\System\ndBBtpg.exe
  2⤵
  PID:8180
- C:\Windows\System\lKPXAsb.exe
  C:\Windows\System\lKPXAsb.exe
  2⤵
  PID:8200
- C:\Windows\System\KSXzIMl.exe
  C:\Windows\System\KSXzIMl.exe
  2⤵
  PID:8232
- C:\Windows\System\hfkClDW.exe
  C:\Windows\System\hfkClDW.exe
  2⤵
  PID:8256
- C:\Windows\System\LPBfrFa.exe
  C:\Windows\System\LPBfrFa.exe
  2⤵
  PID:8280
- C:\Windows\System\GLLwsov.exe
  C:\Windows\System\GLLwsov.exe
  2⤵
  PID:8304
- C:\Windows\System\KwLAIGy.exe
  C:\Windows\System\KwLAIGy.exe
  2⤵
  PID:8344
- C:\Windows\System\JuAnNuR.exe
  C:\Windows\System\JuAnNuR.exe
  2⤵
  PID:8376
- C:\Windows\System\nKcsNoT.exe
  C:\Windows\System\nKcsNoT.exe
  2⤵
  PID:8400
- C:\Windows\System\iIOXGpp.exe
  C:\Windows\System\iIOXGpp.exe
  2⤵
  PID:8420
- C:\Windows\System\lFCSzeP.exe
  C:\Windows\System\lFCSzeP.exe
  2⤵
  PID:8452
- C:\Windows\System\CoTjPmH.exe
  C:\Windows\System\CoTjPmH.exe
  2⤵
  PID:8480
- C:\Windows\System\NdGTfNz.exe
  C:\Windows\System\NdGTfNz.exe
  2⤵
  PID:8500
- C:\Windows\System\rJElsha.exe
  C:\Windows\System\rJElsha.exe
  2⤵
  PID:8532
- C:\Windows\System\wAYghxo.exe
  C:\Windows\System\wAYghxo.exe
  2⤵
  PID:8556
- C:\Windows\System\OLIyArG.exe
  C:\Windows\System\OLIyArG.exe
  2⤵
  PID:8596
- C:\Windows\System\vSgMukZ.exe
  C:\Windows\System\vSgMukZ.exe
  2⤵
  PID:8624
- C:\Windows\System\QiqPWJv.exe
  C:\Windows\System\QiqPWJv.exe
  2⤵
  PID:8648
- C:\Windows\System\mnvqukI.exe
  C:\Windows\System\mnvqukI.exe
  2⤵
  PID:8672
- C:\Windows\System\PPdRaIh.exe
  C:\Windows\System\PPdRaIh.exe
  2⤵
  PID:8700
- C:\Windows\System\dhtSklp.exe
  C:\Windows\System\dhtSklp.exe
  2⤵
  PID:8728
- C:\Windows\System\TEBcmfV.exe
  C:\Windows\System\TEBcmfV.exe
  2⤵
  PID:8748
- C:\Windows\System\dIJdzjc.exe
  C:\Windows\System\dIJdzjc.exe
  2⤵
  PID:8772
- C:\Windows\System\qhKZExY.exe
  C:\Windows\System\qhKZExY.exe
  2⤵
  PID:8808
- C:\Windows\System\XgqJJGh.exe
  C:\Windows\System\XgqJJGh.exe
  2⤵
  PID:8832
- C:\Windows\System\ZKmEgHn.exe
  C:\Windows\System\ZKmEgHn.exe
  2⤵
  PID:8864
- C:\Windows\System\aguoWhO.exe
  C:\Windows\System\aguoWhO.exe
  2⤵
  PID:8888
- C:\Windows\System\oLIpJPf.exe
  C:\Windows\System\oLIpJPf.exe
  2⤵
  PID:8908
- C:\Windows\System\kYUpELC.exe
  C:\Windows\System\kYUpELC.exe
  2⤵
  PID:8936
- C:\Windows\System\IHWOjsS.exe
  C:\Windows\System\IHWOjsS.exe
  2⤵
  PID:8960
- C:\Windows\System\CqwhQkr.exe
  C:\Windows\System\CqwhQkr.exe
  2⤵
  PID:8988
- C:\Windows\System\GSXsLKG.exe
  C:\Windows\System\GSXsLKG.exe
  2⤵
  PID:9020
- C:\Windows\System\CFuovxK.exe
  C:\Windows\System\CFuovxK.exe
  2⤵
  PID:9052
- C:\Windows\System\rMKhafV.exe
  C:\Windows\System\rMKhafV.exe
  2⤵
  PID:9072
- C:\Windows\System\YppLgly.exe
  C:\Windows\System\YppLgly.exe
  2⤵
  PID:9100
- C:\Windows\System\MldEOQQ.exe
  C:\Windows\System\MldEOQQ.exe
  2⤵
  PID:9136
- C:\Windows\System\YsVRsOc.exe
  C:\Windows\System\YsVRsOc.exe
  2⤵
  PID:9160
- C:\Windows\System\ixsvEzD.exe
  C:\Windows\System\ixsvEzD.exe
  2⤵
  PID:9184
- C:\Windows\System\wSxCMMs.exe
  C:\Windows\System\wSxCMMs.exe
  2⤵
  PID:9208
- C:\Windows\System\NiHaTWk.exe
  C:\Windows\System\NiHaTWk.exe
  2⤵
  PID:7408
- C:\Windows\System\GbMIMXs.exe
  C:\Windows\System\GbMIMXs.exe
  2⤵
  PID:7604
- C:\Windows\System\VGIOqOc.exe
  C:\Windows\System\VGIOqOc.exe
  2⤵
  PID:7568
- C:\Windows\System\zNkxiGW.exe
  C:\Windows\System\zNkxiGW.exe
  2⤵
  PID:8296
- C:\Windows\System\ANtfUiv.exe
  C:\Windows\System\ANtfUiv.exe
  2⤵
  PID:8392
- C:\Windows\System\URbyAtb.exe
  C:\Windows\System\URbyAtb.exe
  2⤵
  PID:7496
- C:\Windows\System\mLLYWhX.exe
  C:\Windows\System\mLLYWhX.exe
  2⤵
  PID:8364
- C:\Windows\System\aMsKBWi.exe
  C:\Windows\System\aMsKBWi.exe
  2⤵
  PID:8580
- C:\Windows\System\xlSGdyh.exe
  C:\Windows\System\xlSGdyh.exe
  2⤵
  PID:8276
- C:\Windows\System\QMappWI.exe
  C:\Windows\System\QMappWI.exe
  2⤵
  PID:8692
- C:\Windows\System\MRQdULQ.exe
  C:\Windows\System\MRQdULQ.exe
  2⤵
  PID:8712
- C:\Windows\System\DRawUgn.exe
  C:\Windows\System\DRawUgn.exe
  2⤵
  PID:8760
- C:\Windows\System\gZgsjBJ.exe
  C:\Windows\System\gZgsjBJ.exe
  2⤵
  PID:8828
- C:\Windows\System\LUutUWM.exe
  C:\Windows\System\LUutUWM.exe
  2⤵
  PID:8616
- C:\Windows\System\pSLoOsG.exe
  C:\Windows\System\pSLoOsG.exe
  2⤵
  PID:8880
- C:\Windows\System\jBPJYpd.exe
  C:\Windows\System\jBPJYpd.exe
  2⤵
  PID:9084
- C:\Windows\System\dkKuPji.exe
  C:\Windows\System\dkKuPji.exe
  2⤵
  PID:9120
- C:\Windows\System\vFFrSDJ.exe
  C:\Windows\System\vFFrSDJ.exe
  2⤵
  PID:8784
- C:\Windows\System\rhoqSKy.exe
  C:\Windows\System\rhoqSKy.exe
  2⤵
  PID:7436
- C:\Windows\System\kAOgrKz.exe
  C:\Windows\System\kAOgrKz.exe
  2⤵
  PID:7316
- C:\Windows\System\wWECirf.exe
  C:\Windows\System\wWECirf.exe
  2⤵
  PID:7376
- C:\Windows\System\oraybHA.exe
  C:\Windows\System\oraybHA.exe
  2⤵
  PID:8360
- C:\Windows\System\QvpcJkr.exe
  C:\Windows\System\QvpcJkr.exe
  2⤵
  PID:8196
- C:\Windows\System\iuTlEBk.exe
  C:\Windows\System\iuTlEBk.exe
  2⤵
  PID:9152
- C:\Windows\System\DXOGXhe.exe
  C:\Windows\System\DXOGXhe.exe
  2⤵
  PID:9204
- C:\Windows\System\kDrVudx.exe
  C:\Windows\System\kDrVudx.exe
  2⤵
  PID:9088
- C:\Windows\System\rDSGYfz.exe
  C:\Windows\System\rDSGYfz.exe
  2⤵
  PID:7308
- C:\Windows\System\CGDIYqp.exe
  C:\Windows\System\CGDIYqp.exe
  2⤵
  PID:4364
- C:\Windows\System\kXMWvTs.exe
  C:\Windows\System\kXMWvTs.exe
  2⤵
  PID:9236
- C:\Windows\System\VdWESwv.exe
  C:\Windows\System\VdWESwv.exe
  2⤵
  PID:9264
- C:\Windows\System\mgLvERY.exe
  C:\Windows\System\mgLvERY.exe
  2⤵
  PID:9284
- C:\Windows\System\mrPPfQi.exe
  C:\Windows\System\mrPPfQi.exe
  2⤵
  PID:9304
- C:\Windows\System\sYyHxod.exe
  C:\Windows\System\sYyHxod.exe
  2⤵
  PID:9336
- C:\Windows\System\VolBmdi.exe
  C:\Windows\System\VolBmdi.exe
  2⤵
  PID:9368
- C:\Windows\System\aRVuyuB.exe
  C:\Windows\System\aRVuyuB.exe
  2⤵
  PID:9396
- C:\Windows\System\SzQOXuW.exe
  C:\Windows\System\SzQOXuW.exe
  2⤵
  PID:9420
- C:\Windows\System\rahdfVr.exe
  C:\Windows\System\rahdfVr.exe
  2⤵
  PID:9440
- C:\Windows\System\uDdMDVh.exe
  C:\Windows\System\uDdMDVh.exe
  2⤵
  PID:9468
- C:\Windows\System\QkKkfcE.exe
  C:\Windows\System\QkKkfcE.exe
  2⤵
  PID:9500
- C:\Windows\System\IYWkKBH.exe
  C:\Windows\System\IYWkKBH.exe
  2⤵
  PID:9524
- C:\Windows\System\BNSoaKD.exe
  C:\Windows\System\BNSoaKD.exe
  2⤵
  PID:9552
- C:\Windows\System\epahSTO.exe
  C:\Windows\System\epahSTO.exe
  2⤵
  PID:9584
- C:\Windows\System\NcgEsIP.exe
  C:\Windows\System\NcgEsIP.exe
  2⤵
  PID:9612
- C:\Windows\System\HatFgeH.exe
  C:\Windows\System\HatFgeH.exe
  2⤵
  PID:9636
- C:\Windows\System\aYDlibW.exe
  C:\Windows\System\aYDlibW.exe
  2⤵
  PID:9660
- C:\Windows\System\LBuWvCm.exe
  C:\Windows\System\LBuWvCm.exe
  2⤵
  PID:9692
- C:\Windows\System\ZUVENee.exe
  C:\Windows\System\ZUVENee.exe
  2⤵
  PID:9712
- C:\Windows\System\abzBLry.exe
  C:\Windows\System\abzBLry.exe
  2⤵
  PID:9732
- C:\Windows\System\hudDgHX.exe
  C:\Windows\System\hudDgHX.exe
  2⤵
  PID:9764
- C:\Windows\System\XJqiopQ.exe
  C:\Windows\System\XJqiopQ.exe
  2⤵
  PID:9792
- C:\Windows\System\xTLslrS.exe
  C:\Windows\System\xTLslrS.exe
  2⤵
  PID:9824
- C:\Windows\System\AYrjUSp.exe
  C:\Windows\System\AYrjUSp.exe
  2⤵
  PID:9844
- C:\Windows\System\wzFtYjL.exe
  C:\Windows\System\wzFtYjL.exe
  2⤵
  PID:9876
- C:\Windows\System\AXSIPHw.exe
  C:\Windows\System\AXSIPHw.exe
  2⤵
  PID:9900
- C:\Windows\System\GhiJkxz.exe
  C:\Windows\System\GhiJkxz.exe
  2⤵
  PID:9932
- C:\Windows\System\DPuWPTN.exe
  C:\Windows\System\DPuWPTN.exe
  2⤵
  PID:9956
- C:\Windows\System\vfEliKf.exe
  C:\Windows\System\vfEliKf.exe
  2⤵
  PID:9984
- C:\Windows\System\umaHhhh.exe
  C:\Windows\System\umaHhhh.exe
  2⤵
  PID:10008
- C:\Windows\System\LmiKNgq.exe
  C:\Windows\System\LmiKNgq.exe
  2⤵
  PID:10040
- C:\Windows\System\HYmGliK.exe
  C:\Windows\System\HYmGliK.exe
  2⤵
  PID:10064
- C:\Windows\System\DhIXVEB.exe
  C:\Windows\System\DhIXVEB.exe
  2⤵
  PID:10092
- C:\Windows\System\KZJqctU.exe
  C:\Windows\System\KZJqctU.exe
  2⤵
  PID:10128
- C:\Windows\System\NDGRMqa.exe
  C:\Windows\System\NDGRMqa.exe
  2⤵
  PID:10156
- C:\Windows\System\DjKLvsy.exe
  C:\Windows\System\DjKLvsy.exe
  2⤵
  PID:10176
- C:\Windows\System\rHOwOiH.exe
  C:\Windows\System\rHOwOiH.exe
  2⤵
  PID:10208
- C:\Windows\System\mZZTARo.exe
  C:\Windows\System\mZZTARo.exe
  2⤵
  PID:7268
- C:\Windows\System\lKZJrij.exe
  C:\Windows\System\lKZJrij.exe
  2⤵
  PID:7420
- C:\Windows\System\tmGFdHF.exe
  C:\Windows\System\tmGFdHF.exe
  2⤵
  PID:8764
- C:\Windows\System\cYkjTbR.exe
  C:\Windows\System\cYkjTbR.exe
  2⤵
  PID:9224
- C:\Windows\System\bTfBjbP.exe
  C:\Windows\System\bTfBjbP.exe
  2⤵
  PID:9360
- C:\Windows\System\MmsVjyN.exe
  C:\Windows\System\MmsVjyN.exe
  2⤵
  PID:9412
- C:\Windows\System\PDWmgyp.exe
  C:\Windows\System\PDWmgyp.exe
  2⤵
  PID:9256
- C:\Windows\System\GvModCb.exe
  C:\Windows\System\GvModCb.exe
  2⤵
  PID:9536
- C:\Windows\System\eNyESlf.exe
  C:\Windows\System\eNyESlf.exe
  2⤵
  PID:9700
- C:\Windows\System\SgbfmQV.exe
  C:\Windows\System\SgbfmQV.exe
  2⤵
  PID:9280
- C:\Windows\System\XCCxiOh.exe
  C:\Windows\System\XCCxiOh.exe
  2⤵
  PID:9564
- C:\Windows\System\fBJcwMm.exe
  C:\Windows\System\fBJcwMm.exe
  2⤵
  PID:9332
- C:\Windows\System\dQCUQmB.exe
  C:\Windows\System\dQCUQmB.exe
  2⤵
  PID:9864
- C:\Windows\System\nhNKtip.exe
  C:\Windows\System\nhNKtip.exe
  2⤵
  PID:9632
- C:\Windows\System\qlRifTd.exe
  C:\Windows\System\qlRifTd.exe
  2⤵
  PID:9676
- C:\Windows\System\PvLesIb.exe
  C:\Windows\System\PvLesIb.exe
  2⤵
  PID:9704
- C:\Windows\System\weNIcPg.exe
  C:\Windows\System\weNIcPg.exe
  2⤵
  PID:9516
- C:\Windows\System\INgyFCZ.exe
  C:\Windows\System\INgyFCZ.exe
  2⤵
  PID:10172
- C:\Windows\System\wVrTUBy.exe
  C:\Windows\System\wVrTUBy.exe
  2⤵
  PID:9004
- C:\Windows\System\KbOvsck.exe
  C:\Windows\System\KbOvsck.exe
  2⤵
  PID:10060
- C:\Windows\System\RjsKVZX.exe
  C:\Windows\System\RjsKVZX.exe
  2⤵
  PID:9884
- C:\Windows\System\kNJcgbB.exe
  C:\Windows\System\kNJcgbB.exe
  2⤵
  PID:9916
- C:\Windows\System\HlnexEq.exe
  C:\Windows\System\HlnexEq.exe
  2⤵
  PID:9260
- C:\Windows\System\pwefxqg.exe
  C:\Windows\System\pwefxqg.exe
  2⤵
  PID:10224
- C:\Windows\System\PuaLkoP.exe
  C:\Windows\System\PuaLkoP.exe
  2⤵
  PID:10000
- C:\Windows\System\GuKJmGP.exe
  C:\Windows\System\GuKJmGP.exe
  2⤵
  PID:10268
- C:\Windows\System\tHLKuKY.exe
  C:\Windows\System\tHLKuKY.exe
  2⤵
  PID:10296
- C:\Windows\System\CampMDJ.exe
  C:\Windows\System\CampMDJ.exe
  2⤵
  PID:10324
- C:\Windows\System\UlFkUca.exe
  C:\Windows\System\UlFkUca.exe
  2⤵
  PID:10348
- C:\Windows\System\cAucIXi.exe
  C:\Windows\System\cAucIXi.exe
  2⤵
  PID:10376
- C:\Windows\System\fhBmKGe.exe
  C:\Windows\System\fhBmKGe.exe
  2⤵
  PID:10404
- C:\Windows\System\ifvrwMr.exe
  C:\Windows\System\ifvrwMr.exe
  2⤵
  PID:10424
- C:\Windows\System\CidUEUL.exe
  C:\Windows\System\CidUEUL.exe
  2⤵
  PID:10440
- C:\Windows\System\GcBRYjJ.exe
  C:\Windows\System\GcBRYjJ.exe
  2⤵
  PID:10460
- C:\Windows\System\dsBmQUT.exe
  C:\Windows\System\dsBmQUT.exe
  2⤵
  PID:10488
- C:\Windows\System\JHNqaAL.exe
  C:\Windows\System\JHNqaAL.exe
  2⤵
  PID:10508
- C:\Windows\System\TClcqiS.exe
  C:\Windows\System\TClcqiS.exe
  2⤵
  PID:10536
- C:\Windows\System\rjztuOn.exe
  C:\Windows\System\rjztuOn.exe
  2⤵
  PID:10560
- C:\Windows\System\hWjUOVV.exe
  C:\Windows\System\hWjUOVV.exe
  2⤵
  PID:10588
- C:\Windows\System\fcMKYiu.exe
  C:\Windows\System\fcMKYiu.exe
  2⤵
  PID:10616
- C:\Windows\System\MwVXnwR.exe
  C:\Windows\System\MwVXnwR.exe
  2⤵
  PID:10648
- C:\Windows\System\iVMUegC.exe
  C:\Windows\System\iVMUegC.exe
  2⤵
  PID:10676
- C:\Windows\System\eRuZfvE.exe
  C:\Windows\System\eRuZfvE.exe
  2⤵
  PID:10696
- C:\Windows\System\TTftxqe.exe
  C:\Windows\System\TTftxqe.exe
  2⤵
  PID:10712
- C:\Windows\System\Voyxkmb.exe
  C:\Windows\System\Voyxkmb.exe
  2⤵
  PID:10732
- C:\Windows\System\qpssMHA.exe
  C:\Windows\System\qpssMHA.exe
  2⤵
  PID:10764
- C:\Windows\System\ngebabE.exe
  C:\Windows\System\ngebabE.exe
  2⤵
  PID:10792
- C:\Windows\System\bDQJNfT.exe
  C:\Windows\System\bDQJNfT.exe
  2⤵
  PID:10824
- C:\Windows\System\aKJkEeg.exe
  C:\Windows\System\aKJkEeg.exe
  2⤵
  PID:10852
- C:\Windows\System\TXiHtaR.exe
  C:\Windows\System\TXiHtaR.exe
  2⤵
  PID:10888
- C:\Windows\System\dFvTfeI.exe
  C:\Windows\System\dFvTfeI.exe
  2⤵
  PID:10920
- C:\Windows\System\sZMzpOz.exe
  C:\Windows\System\sZMzpOz.exe
  2⤵
  PID:10944
- C:\Windows\System\AsBykPe.exe
  C:\Windows\System\AsBykPe.exe
  2⤵
  PID:10972
- C:\Windows\System\ejmxZtC.exe
  C:\Windows\System\ejmxZtC.exe
  2⤵
  PID:11000
- C:\Windows\System\tRMHNyX.exe
  C:\Windows\System\tRMHNyX.exe
  2⤵
  PID:11032
- C:\Windows\System\yRpOvxF.exe
  C:\Windows\System\yRpOvxF.exe
  2⤵
  PID:11056
- C:\Windows\System\EjafjLj.exe
  C:\Windows\System\EjafjLj.exe
  2⤵
  PID:11076
- C:\Windows\System\wmbaDGw.exe
  C:\Windows\System\wmbaDGw.exe
  2⤵
  PID:11104
- C:\Windows\System\xPwmnRH.exe
  C:\Windows\System\xPwmnRH.exe
  2⤵
  PID:11132
- C:\Windows\System\yOJakwr.exe
  C:\Windows\System\yOJakwr.exe
  2⤵
  PID:11156
- C:\Windows\System\tkKyvxf.exe
  C:\Windows\System\tkKyvxf.exe
  2⤵
  PID:11180
- C:\Windows\System\neoAQQb.exe
  C:\Windows\System\neoAQQb.exe
  2⤵
  PID:11208
- C:\Windows\System\uhBoslb.exe
  C:\Windows\System\uhBoslb.exe
  2⤵
  PID:11228
- C:\Windows\System\QccTHdM.exe
  C:\Windows\System\QccTHdM.exe
  2⤵
  PID:11256
- C:\Windows\System\AXxmkVq.exe
  C:\Windows\System\AXxmkVq.exe
  2⤵
  PID:9920
- C:\Windows\System\tQNCbDr.exe
  C:\Windows\System\tQNCbDr.exe
  2⤵
  PID:9608
- C:\Windows\System\WMjGkem.exe
  C:\Windows\System\WMjGkem.exe
  2⤵
  PID:9464
- C:\Windows\System\sWMllND.exe
  C:\Windows\System\sWMllND.exe
  2⤵
  PID:8904
- C:\Windows\System\jTwiBZT.exe
  C:\Windows\System\jTwiBZT.exe
  2⤵
  PID:8948
- C:\Windows\System\YsVWEFy.exe
  C:\Windows\System\YsVWEFy.exe
  2⤵
  PID:10368
- C:\Windows\System\sJtRmmH.exe
  C:\Windows\System\sJtRmmH.exe
  2⤵
  PID:10420
- C:\Windows\System\dGSTBkP.exe
  C:\Windows\System\dGSTBkP.exe
  2⤵
  PID:9244
- C:\Windows\System\UOmZjJd.exe
  C:\Windows\System\UOmZjJd.exe
  2⤵
  PID:10308
- C:\Windows\System\aGnpbCa.exe
  C:\Windows\System\aGnpbCa.exe
  2⤵
  PID:9628
- C:\Windows\System\Grufxxl.exe
  C:\Windows\System\Grufxxl.exe
  2⤵
  PID:10664
- C:\Windows\System\ozIHIDi.exe
  C:\Windows\System\ozIHIDi.exe
  2⤵
  PID:10720
- C:\Windows\System\DFcDjrJ.exe
  C:\Windows\System\DFcDjrJ.exe
  2⤵
  PID:10280
- C:\Windows\System\jomaVOK.exe
  C:\Windows\System\jomaVOK.exe
  2⤵
  PID:10844
- C:\Windows\System\lHGKdyZ.exe
  C:\Windows\System\lHGKdyZ.exe
  2⤵
  PID:10688
- C:\Windows\System\tKIcJQz.exe
  C:\Windows\System\tKIcJQz.exe
  2⤵
  PID:11052
- C:\Windows\System\UfwjiBp.exe
  C:\Windows\System\UfwjiBp.exe
  2⤵
  PID:11168
- C:\Windows\System\CkNAOZT.exe
  C:\Windows\System\CkNAOZT.exe
  2⤵
  PID:10628
- C:\Windows\System\mGHzhln.exe
  C:\Windows\System\mGHzhln.exe
  2⤵
  PID:10928
- C:\Windows\System\teePBhW.exe
  C:\Windows\System\teePBhW.exe
  2⤵
  PID:9292
- C:\Windows\System\LlFiGoH.exe
  C:\Windows\System\LlFiGoH.exe
  2⤵
  PID:9852
- C:\Windows\System\xbxsUTd.exe
  C:\Windows\System\xbxsUTd.exe
  2⤵
  PID:9272
- C:\Windows\System\enhhMnH.exe
  C:\Windows\System\enhhMnH.exe
  2⤵
  PID:11100
- C:\Windows\System\KGDaguz.exe
  C:\Windows\System\KGDaguz.exe
  2⤵
  PID:11148
- C:\Windows\System\JJQBHBT.exe
  C:\Windows\System\JJQBHBT.exe
  2⤵
  PID:11192
- C:\Windows\System\qXwmoSi.exe
  C:\Windows\System\qXwmoSi.exe
  2⤵
  PID:10432
- C:\Windows\System\aYCcQss.exe
  C:\Windows\System\aYCcQss.exe
  2⤵
  PID:11012
- C:\Windows\System\uDlrszm.exe
  C:\Windows\System\uDlrszm.exe
  2⤵
  PID:11028
- C:\Windows\System\nTZEIwy.exe
  C:\Windows\System\nTZEIwy.exe
  2⤵
  PID:11284
- C:\Windows\System\BNaFZUJ.exe
  C:\Windows\System\BNaFZUJ.exe
  2⤵
  PID:11308
- C:\Windows\System\FsxIGQt.exe
  C:\Windows\System\FsxIGQt.exe
  2⤵
  PID:11340
- C:\Windows\System\CiTBVyr.exe
  C:\Windows\System\CiTBVyr.exe
  2⤵
  PID:11364
- C:\Windows\System\hMhMWFB.exe
  C:\Windows\System\hMhMWFB.exe
  2⤵
  PID:11388
- C:\Windows\System\TFfKRvl.exe
  C:\Windows\System\TFfKRvl.exe
  2⤵
  PID:11412
- C:\Windows\System\gCOIBcJ.exe
  C:\Windows\System\gCOIBcJ.exe
  2⤵
  PID:11444
- C:\Windows\System\guuGfQG.exe
  C:\Windows\System\guuGfQG.exe
  2⤵
  PID:11464
- C:\Windows\System\awzbfOg.exe
  C:\Windows\System\awzbfOg.exe
  2⤵
  PID:11488
- C:\Windows\System\gWrXSDU.exe
  C:\Windows\System\gWrXSDU.exe
  2⤵
  PID:11508
- C:\Windows\System\TyViZBH.exe
  C:\Windows\System\TyViZBH.exe
  2⤵
  PID:11536
- C:\Windows\System\nzNePZi.exe
  C:\Windows\System\nzNePZi.exe
  2⤵
  PID:11560
- C:\Windows\System\VmDCpLh.exe
  C:\Windows\System\VmDCpLh.exe
  2⤵
  PID:11588
- C:\Windows\System\XgZbmPB.exe
  C:\Windows\System\XgZbmPB.exe
  2⤵
  PID:11616
- C:\Windows\System\zcsmSlS.exe
  C:\Windows\System\zcsmSlS.exe
  2⤵
  PID:11640
- C:\Windows\System\DtxIWxa.exe
  C:\Windows\System\DtxIWxa.exe
  2⤵
  PID:11668
- C:\Windows\System\LMiDgzf.exe
  C:\Windows\System\LMiDgzf.exe
  2⤵
  PID:11696
- C:\Windows\System\ipLewes.exe
  C:\Windows\System\ipLewes.exe
  2⤵
  PID:11724
- C:\Windows\System\VTLBLXN.exe
  C:\Windows\System\VTLBLXN.exe
  2⤵
  PID:11752
- C:\Windows\System\QAjFTuB.exe
  C:\Windows\System\QAjFTuB.exe
  2⤵
  PID:11784
- C:\Windows\System\LXYEpUh.exe
  C:\Windows\System\LXYEpUh.exe
  2⤵
  PID:11804
- C:\Windows\System\tNWZXKn.exe
  C:\Windows\System\tNWZXKn.exe
  2⤵
  PID:11832
- C:\Windows\System\lGPEbIe.exe
  C:\Windows\System\lGPEbIe.exe
  2⤵
  PID:11856
- C:\Windows\System\xGNptli.exe
  C:\Windows\System\xGNptli.exe
  2⤵
  PID:11876
- C:\Windows\System\YDzCIsz.exe
  C:\Windows\System\YDzCIsz.exe
  2⤵
  PID:11904
- C:\Windows\System\FZVGDbe.exe
  C:\Windows\System\FZVGDbe.exe
  2⤵
  PID:11936
- C:\Windows\System\gyhiSdI.exe
  C:\Windows\System\gyhiSdI.exe
  2⤵
  PID:11964
- C:\Windows\System\kzJlQNx.exe
  C:\Windows\System\kzJlQNx.exe
  2⤵
  PID:11992
- C:\Windows\System\uMaMOqB.exe
  C:\Windows\System\uMaMOqB.exe
  2⤵
  PID:12016
- C:\Windows\System\asuFUvR.exe
  C:\Windows\System\asuFUvR.exe
  2⤵
  PID:12048
- C:\Windows\System\SGFEFmq.exe
  C:\Windows\System\SGFEFmq.exe
  2⤵
  PID:12080
- C:\Windows\System\aGjftoQ.exe
  C:\Windows\System\aGjftoQ.exe
  2⤵
  PID:12100
- C:\Windows\System\ZFJFdVO.exe
  C:\Windows\System\ZFJFdVO.exe
  2⤵
  PID:12120
- C:\Windows\System\DRREJbh.exe
  C:\Windows\System\DRREJbh.exe
  2⤵
  PID:12144
- C:\Windows\System\aipXAZo.exe
  C:\Windows\System\aipXAZo.exe
  2⤵
  PID:12180
- C:\Windows\System\ItHknun.exe
  C:\Windows\System\ItHknun.exe
  2⤵
  PID:12212
- C:\Windows\System\ZZdroYx.exe
  C:\Windows\System\ZZdroYx.exe
  2⤵
  PID:12240
- C:\Windows\System\GsNIZkm.exe
  C:\Windows\System\GsNIZkm.exe
  2⤵
  PID:12264
- C:\Windows\System\KWHYEDl.exe
  C:\Windows\System\KWHYEDl.exe
  2⤵
  PID:10472
- C:\Windows\System\GmiLmmI.exe
  C:\Windows\System\GmiLmmI.exe
  2⤵
  PID:10900
- C:\Windows\System\kyiXaUm.exe
  C:\Windows\System\kyiXaUm.exe
  2⤵
  PID:10780
- C:\Windows\System\TMNcunz.exe
  C:\Windows\System\TMNcunz.exe
  2⤵
  PID:10756
- C:\Windows\System\ecyPeSl.exe
  C:\Windows\System\ecyPeSl.exe
  2⤵
  PID:11020
- C:\Windows\System\edLPOgA.exe
  C:\Windows\System\edLPOgA.exe
  2⤵
  PID:10120
- C:\Windows\System\bumaZro.exe
  C:\Windows\System\bumaZro.exe
  2⤵
  PID:9356
- C:\Windows\System\mKSWmDb.exe
  C:\Windows\System\mKSWmDb.exe
  2⤵
  PID:11504
- C:\Windows\System\nQQLNrK.exe
  C:\Windows\System\nQQLNrK.exe
  2⤵
  PID:10504
- C:\Windows\System\ZktSTji.exe
  C:\Windows\System\ZktSTji.exe
  2⤵
  PID:10788
- C:\Windows\System\aJctMYZ.exe
  C:\Windows\System\aJctMYZ.exe
  2⤵
  PID:11648
- C:\Windows\System\GWXaWkh.exe
  C:\Windows\System\GWXaWkh.exe
  2⤵
  PID:11688
- C:\Windows\System\pDHNeQw.exe
  C:\Windows\System\pDHNeQw.exe
  2⤵
  PID:11356
- C:\Windows\System\lZkOLZb.exe
  C:\Windows\System\lZkOLZb.exe
  2⤵
  PID:10932
- C:\Windows\System\OYfTBhg.exe
  C:\Windows\System\OYfTBhg.exe
  2⤵
  PID:11452
- C:\Windows\System\QtQaKxt.exe
  C:\Windows\System\QtQaKxt.exe
  2⤵
  PID:11920
- C:\Windows\System\fzLZPgp.exe
  C:\Windows\System\fzLZPgp.exe
  2⤵
  PID:11604
- C:\Windows\System\ETsmtnL.exe
  C:\Windows\System\ETsmtnL.exe
  2⤵
  PID:11276
- C:\Windows\System\OtvEJyW.exe
  C:\Windows\System\OtvEJyW.exe
  2⤵
  PID:11384
- C:\Windows\System\iJciIyi.exe
  C:\Windows\System\iJciIyi.exe
  2⤵
  PID:12176
- C:\Windows\System\oDcAuqI.exe
  C:\Windows\System\oDcAuqI.exe
  2⤵
  PID:11400
- C:\Windows\System\tQLZXXs.exe
  C:\Windows\System\tQLZXXs.exe
  2⤵
  PID:12236
- C:\Windows\System\CslxiYt.exe
  C:\Windows\System\CslxiYt.exe
  2⤵
  PID:11840
- C:\Windows\System\SbMLQux.exe
  C:\Windows\System\SbMLQux.exe
  2⤵
  PID:10864
- C:\Windows\System\ZmZUPQp.exe
  C:\Windows\System\ZmZUPQp.exe
  2⤵
  PID:12032
- C:\Windows\System\CmqsnQv.exe
  C:\Windows\System\CmqsnQv.exe
  2⤵
  PID:12060
- C:\Windows\System\zPzqvMh.exe
  C:\Windows\System\zPzqvMh.exe
  2⤵
  PID:12296
- C:\Windows\System\YipYCXW.exe
  C:\Windows\System\YipYCXW.exe
  2⤵
  PID:12312
- C:\Windows\System\fmutuDA.exe
  C:\Windows\System\fmutuDA.exe
  2⤵
  PID:12344
- C:\Windows\System\FxjAeWM.exe
  C:\Windows\System\FxjAeWM.exe
  2⤵
  PID:12364
- C:\Windows\System\HGxylVh.exe
  C:\Windows\System\HGxylVh.exe
  2⤵
  PID:12392
- C:\Windows\System\QgDbQAb.exe
  C:\Windows\System\QgDbQAb.exe
  2⤵
  PID:12420
- C:\Windows\System\QEbXjfQ.exe
  C:\Windows\System\QEbXjfQ.exe
  2⤵
  PID:12448
- C:\Windows\System\cXwlvbB.exe
  C:\Windows\System\cXwlvbB.exe
  2⤵
  PID:12476
- C:\Windows\System\tjyhnTg.exe
  C:\Windows\System\tjyhnTg.exe
  2⤵
  PID:12500
- C:\Windows\System\wFzSOBT.exe
  C:\Windows\System\wFzSOBT.exe
  2⤵
  PID:12528
- C:\Windows\System\FlQQbBp.exe
  C:\Windows\System\FlQQbBp.exe
  2⤵
  PID:12548
- C:\Windows\System\SBuKvzR.exe
  C:\Windows\System\SBuKvzR.exe
  2⤵
  PID:12572
- C:\Windows\System\MJUObpX.exe
  C:\Windows\System\MJUObpX.exe
  2⤵
  PID:12608
- C:\Windows\System\pUkBIjE.exe
  C:\Windows\System\pUkBIjE.exe
  2⤵
  PID:12640
- C:\Windows\System\QvgQSWK.exe
  C:\Windows\System\QvgQSWK.exe
  2⤵
  PID:12672
- C:\Windows\System\tEgxCYu.exe
  C:\Windows\System\tEgxCYu.exe
  2⤵
  PID:12704
- C:\Windows\System\PrdYvov.exe
  C:\Windows\System\PrdYvov.exe
  2⤵
  PID:12732
- C:\Windows\System\QWaZBXq.exe
  C:\Windows\System\QWaZBXq.exe
  2⤵
  PID:12760
- C:\Windows\System\fUOKXIC.exe
  C:\Windows\System\fUOKXIC.exe
  2⤵
  PID:12784
- C:\Windows\System\odRyFSl.exe
  C:\Windows\System\odRyFSl.exe
  2⤵
  PID:12808
- C:\Windows\System\rEbsiVZ.exe
  C:\Windows\System\rEbsiVZ.exe
  2⤵
  PID:12832
- C:\Windows\System\zsULNGt.exe
  C:\Windows\System\zsULNGt.exe
  2⤵
  PID:12860
- C:\Windows\System\wniuTHF.exe
  C:\Windows\System\wniuTHF.exe
  2⤵
  PID:12888
- C:\Windows\System\nkvWkhx.exe
  C:\Windows\System\nkvWkhx.exe
  2⤵
  PID:12916
- C:\Windows\System\JEKyrEX.exe
  C:\Windows\System\JEKyrEX.exe
  2⤵
  PID:12932
- C:\Windows\System\rvQYKmY.exe
  C:\Windows\System\rvQYKmY.exe
  2⤵
  PID:12960
- C:\Windows\System\jtzENMA.exe
  C:\Windows\System\jtzENMA.exe
  2⤵
  PID:12984
- C:\Windows\System\xNlpBUv.exe
  C:\Windows\System\xNlpBUv.exe
  2⤵
  PID:13008
- C:\Windows\System\FdhPWgK.exe
  C:\Windows\System\FdhPWgK.exe
  2⤵
  PID:13032
- C:\Windows\System\Ismnjlx.exe
  C:\Windows\System\Ismnjlx.exe
  2⤵
  PID:13060
- C:\Windows\System\lmOWgie.exe
  C:\Windows\System\lmOWgie.exe
  2⤵
  PID:13088
- C:\Windows\System\jwSwBBQ.exe
  C:\Windows\System\jwSwBBQ.exe
  2⤵
  PID:13120
- C:\Windows\System\aEmThoN.exe
  C:\Windows\System\aEmThoN.exe
  2⤵
  PID:13152
- C:\Windows\System\KUZVrBx.exe
  C:\Windows\System\KUZVrBx.exe
  2⤵
  PID:13180
- C:\Windows\System\vxjOjOl.exe
  C:\Windows\System\vxjOjOl.exe
  2⤵
  PID:13208
- C:\Windows\System\CilZhNH.exe
  C:\Windows\System\CilZhNH.exe
  2⤵
  PID:13236
- C:\Windows\System\YDhNSoe.exe
  C:\Windows\System\YDhNSoe.exe
  2⤵
  PID:13264
- C:\Windows\System\kKMwGhR.exe
  C:\Windows\System\kKMwGhR.exe
  2⤵
  PID:13292
- C:\Windows\System\swMjkPO.exe
  C:\Windows\System\swMjkPO.exe
  2⤵
  PID:11820
- C:\Windows\System\nAhPlMZ.exe
  C:\Windows\System\nAhPlMZ.exe
  2⤵
  PID:12276
- C:\Windows\System\FLfndOQ.exe
  C:\Windows\System\FLfndOQ.exe
  2⤵
  PID:11496
- C:\Windows\System\ofBwpqj.exe
  C:\Windows\System\ofBwpqj.exe
  2⤵
  PID:11576
- C:\Windows\System\UdgcgOr.exe
  C:\Windows\System\UdgcgOr.exe
  2⤵
  PID:11984
- C:\Windows\System\eELEMmf.exe
  C:\Windows\System\eELEMmf.exe
  2⤵
  PID:10956
- C:\Windows\System\yklJwoV.exe
  C:\Windows\System\yklJwoV.exe
  2⤵
  PID:12000
- C:\Windows\System\OwWOEpU.exe
  C:\Windows\System\OwWOEpU.exe
  2⤵
  PID:11680
- C:\Windows\System\jlTclPB.exe
  C:\Windows\System\jlTclPB.exe
  2⤵
  PID:11336
- C:\Windows\System\zOTfUaJ.exe
  C:\Windows\System\zOTfUaJ.exe
  2⤵
  PID:12436
- C:\Windows\System\iTFCkQh.exe
  C:\Windows\System\iTFCkQh.exe
  2⤵
  PID:12464
- C:\Windows\System\nxcffsK.exe
  C:\Windows\System\nxcffsK.exe
  2⤵
  PID:12520
- C:\Windows\System\OOzoNnr.exe
  C:\Windows\System\OOzoNnr.exe
  2⤵
  PID:12544
- C:\Windows\System\MMwyiZu.exe
  C:\Windows\System\MMwyiZu.exe
  2⤵
  PID:10364
- C:\Windows\System\UCBccLY.exe
  C:\Windows\System\UCBccLY.exe
  2⤵
  PID:12752
- C:\Windows\System\DgBjMxb.exe
  C:\Windows\System\DgBjMxb.exe
  2⤵
  PID:12820
- C:\Windows\System\bEOkqNN.exe
  C:\Windows\System\bEOkqNN.exe
  2⤵
  PID:12852
- C:\Windows\System\grPBLoH.exe
  C:\Windows\System\grPBLoH.exe
  2⤵
  PID:12904
- C:\Windows\System\BDDantI.exe
  C:\Windows\System\BDDantI.exe
  2⤵
  PID:13024
- C:\Windows\System\NPPxpfd.exe
  C:\Windows\System\NPPxpfd.exe
  2⤵
  PID:13056
- C:\Windows\System\kEpaKSx.exe
  C:\Windows\System\kEpaKSx.exe
  2⤵
  PID:12664
- C:\Windows\System\LuXOLTy.exe
  C:\Windows\System\LuXOLTy.exe
  2⤵
  PID:13228
- C:\Windows\System\JrmiqhI.exe
  C:\Windows\System\JrmiqhI.exe
  2⤵
  PID:12412
- C:\Windows\System\WsxmuRX.exe
  C:\Windows\System\WsxmuRX.exe
  2⤵
  PID:12944
- C:\Windows\System\QrXdqDN.exe
  C:\Windows\System\QrXdqDN.exe
  2⤵
  PID:12132
- C:\Windows\System\DHEAgoj.exe
  C:\Windows\System\DHEAgoj.exe
  2⤵
  PID:11528
- C:\Windows\System\MlXQAvk.exe
  C:\Windows\System\MlXQAvk.exe
  2⤵
  PID:13336
- C:\Windows\System\zXngJkJ.exe
  C:\Windows\System\zXngJkJ.exe
  2⤵
  PID:13364
- C:\Windows\System\CiBNQxv.exe
  C:\Windows\System\CiBNQxv.exe
  2⤵
  PID:13392
- C:\Windows\System\iwTMIoX.exe
  C:\Windows\System\iwTMIoX.exe
  2⤵
  PID:13420
- C:\Windows\System\shswRuf.exe
  C:\Windows\System\shswRuf.exe
  2⤵
  PID:13440
- C:\Windows\System\eWYfDle.exe
  C:\Windows\System\eWYfDle.exe
  2⤵
  PID:13456
- C:\Windows\System\MiHbaTZ.exe
  C:\Windows\System\MiHbaTZ.exe
  2⤵
  PID:13492
- C:\Windows\System\QypLeDX.exe
  C:\Windows\System\QypLeDX.exe
  2⤵
  PID:13512
- C:\Windows\System\UZLDOHt.exe
  C:\Windows\System\UZLDOHt.exe
  2⤵
  PID:13540
- C:\Windows\System\nAfyfdP.exe
  C:\Windows\System\nAfyfdP.exe
  2⤵
  PID:13572
- C:\Windows\System\XNllXRy.exe
  C:\Windows\System\XNllXRy.exe
  2⤵
  PID:13600
- C:\Windows\System\HknAbiw.exe
  C:\Windows\System\HknAbiw.exe
  2⤵
  PID:13624
- C:\Windows\System\qttHidO.exe
  C:\Windows\System\qttHidO.exe
  2⤵
  PID:13648
- C:\Windows\System\UHJLGba.exe
  C:\Windows\System\UHJLGba.exe
  2⤵
  PID:13680
- C:\Windows\System\nPtjmpg.exe
  C:\Windows\System\nPtjmpg.exe
  2⤵
  PID:13700
- C:\Windows\System\zSNWdox.exe
  C:\Windows\System\zSNWdox.exe
  2⤵
  PID:13724
- C:\Windows\System\TUxNYBX.exe
  C:\Windows\System\TUxNYBX.exe
  2⤵
  PID:13752
- C:\Windows\System\JfJFCLx.exe
  C:\Windows\System\JfJFCLx.exe
  2⤵
  PID:13776
- C:\Windows\System\KgeaSkf.exe
  C:\Windows\System\KgeaSkf.exe
  2⤵
  PID:13800
- C:\Windows\System\maLxkZK.exe
  C:\Windows\System\maLxkZK.exe
  2⤵
  PID:13820
- C:\Windows\System\ZhlmERK.exe
  C:\Windows\System\ZhlmERK.exe
  2⤵
  PID:13844
- C:\Windows\System\aqsrUqi.exe
  C:\Windows\System\aqsrUqi.exe
  2⤵
  PID:13868
- C:\Windows\System\ZgxlcFZ.exe
  C:\Windows\System\ZgxlcFZ.exe
  2⤵
  PID:13896
- C:\Windows\System\hNXOpFf.exe
  C:\Windows\System\hNXOpFf.exe
  2⤵
  PID:13920
- C:\Windows\System\nDuZEFc.exe
  C:\Windows\System\nDuZEFc.exe
  2⤵
  PID:13940
- C:\Windows\System\ElzExgc.exe
  C:\Windows\System\ElzExgc.exe
  2⤵
  PID:13972
- C:\Windows\System\zWKCCoV.exe
  C:\Windows\System\zWKCCoV.exe
  2⤵
  PID:13992
- C:\Windows\System\gbkWQpy.exe
  C:\Windows\System\gbkWQpy.exe
  2⤵
  PID:14016
- C:\Windows\System\smwWClY.exe
  C:\Windows\System\smwWClY.exe
  2⤵
  PID:14032
- C:\Windows\System\LTFAJnR.exe
  C:\Windows\System\LTFAJnR.exe
  2⤵
  PID:14060
- C:\Windows\System\WhqiIDx.exe
  C:\Windows\System\WhqiIDx.exe
  2⤵
  PID:14096
- C:\Windows\System\IgHQnZY.exe
  C:\Windows\System\IgHQnZY.exe
  2⤵
  PID:14120
- C:\Windows\System\LulIIoA.exe
  C:\Windows\System\LulIIoA.exe
  2⤵
  PID:14148
- C:\Windows\System\zPuzeNu.exe
  C:\Windows\System\zPuzeNu.exe
  2⤵
  PID:14168
- C:\Windows\System\ouzAMeS.exe
  C:\Windows\System\ouzAMeS.exe
  2⤵
  PID:14192
- C:\Windows\System\PUPrHbs.exe
  C:\Windows\System\PUPrHbs.exe
  2⤵
  PID:14220
- C:\Windows\System\aKwPkvc.exe
  C:\Windows\System\aKwPkvc.exe
  2⤵
  PID:14240
- C:\Windows\System\ffgziiz.exe
  C:\Windows\System\ffgziiz.exe
  2⤵
  PID:14268
- C:\Windows\System\dOgwtkk.exe
  C:\Windows\System\dOgwtkk.exe
  2⤵
  PID:14296
- C:\Windows\System\OgTLbdx.exe
  C:\Windows\System\OgTLbdx.exe
  2⤵
  PID:14324
- C:\Windows\System\PakBDdq.exe
  C:\Windows\System\PakBDdq.exe
  2⤵
  PID:13080
- C:\Windows\System\kyldMTU.exe
  C:\Windows\System\kyldMTU.exe
  2⤵
  PID:12652
- C:\Windows\System\HFMduHc.exe
  C:\Windows\System\HFMduHc.exe
  2⤵
  PID:13176
- C:\Windows\System\lbgumaA.exe
  C:\Windows\System\lbgumaA.exe
  2⤵
  PID:13200
- C:\Windows\System\LtAhDfD.exe
  C:\Windows\System\LtAhDfD.exe
  2⤵
  PID:11420
- C:\Windows\System\XUvsBDo.exe
  C:\Windows\System\XUvsBDo.exe
  2⤵
  PID:11740
- C:\Windows\System\ZbFCGJu.exe
  C:\Windows\System\ZbFCGJu.exe
  2⤵
  PID:11656
- C:\Windows\System\RTqEohQ.exe
  C:\Windows\System\RTqEohQ.exe
  2⤵
  PID:12172
- C:\Windows\System\GioCSNp.exe
  C:\Windows\System\GioCSNp.exe
  2⤵
  PID:13104
- C:\Windows\System\oIkuwfg.exe
  C:\Windows\System\oIkuwfg.exe
  2⤵
  PID:13132
- C:\Windows\System\faYBXVN.exe
  C:\Windows\System\faYBXVN.exe
  2⤵
  PID:13484
- C:\Windows\System\NjEDNnO.exe
  C:\Windows\System\NjEDNnO.exe
  2⤵
  PID:13584
- C:\Windows\System\LbjqELG.exe
  C:\Windows\System\LbjqELG.exe
  2⤵
  PID:12912
- C:\Windows\System\KdgvJtQ.exe
  C:\Windows\System\KdgvJtQ.exe
  2⤵
  PID:9300
- C:\Windows\System\NpNXpoK.exe
  C:\Windows\System\NpNXpoK.exe
  2⤵
  PID:13672
- C:\Windows\System\RZvPfOE.exe
  C:\Windows\System\RZvPfOE.exe
  2⤵
  PID:13748
- C:\Windows\System\JsEWTUe.exe
  C:\Windows\System\JsEWTUe.exe
  2⤵
  PID:13816
- C:\Windows\System\LSNtOSN.exe
  C:\Windows\System\LSNtOSN.exe
  2⤵
  PID:12340
- C:\Windows\System\wQTvtVB.exe
  C:\Windows\System\wQTvtVB.exe
  2⤵
  PID:13376
- C:\Windows\System\joGjQBS.exe
  C:\Windows\System\joGjQBS.exe
  2⤵
  PID:13968
- C:\Windows\System\HqbACQZ.exe
  C:\Windows\System\HqbACQZ.exe
  2⤵
  PID:14004
- C:\Windows\System\IwUFoJx.exe
  C:\Windows\System\IwUFoJx.exe
  2⤵
  PID:13448
- C:\Windows\System\dwpDKHa.exe
  C:\Windows\System\dwpDKHa.exe
  2⤵
  PID:13500
- C:\Windows\System\ZqszHJP.exe
  C:\Windows\System\ZqszHJP.exe
  2⤵
  PID:14092
- C:\Windows\System\ZiEhMDS.exe
  C:\Windows\System\ZiEhMDS.exe
  2⤵
  PID:12292
- C:\Windows\System\fwpMPHV.exe
  C:\Windows\System\fwpMPHV.exe
  2⤵
  PID:14288
- C:\Windows\System\lcxpwIF.exe
  C:\Windows\System\lcxpwIF.exe
  2⤵
  PID:14340
- C:\Windows\System\isHFKtr.exe
  C:\Windows\System\isHFKtr.exe
  2⤵
  PID:14376
- C:\Windows\System\LPnjRuW.exe
  C:\Windows\System\LPnjRuW.exe
  2⤵
  PID:14404
- C:\Windows\System\JZTxLyc.exe
  C:\Windows\System\JZTxLyc.exe
  2⤵
  PID:14436
- C:\Windows\System\GIbIJyE.exe
  C:\Windows\System\GIbIJyE.exe
  2⤵
  PID:14456
- C:\Windows\System\JnLwvvO.exe
  C:\Windows\System\JnLwvvO.exe
  2⤵
  PID:14480
- C:\Windows\System\MxejfIV.exe
  C:\Windows\System\MxejfIV.exe
  2⤵
  PID:14504
- C:\Windows\System\EcantMh.exe
  C:\Windows\System\EcantMh.exe
  2⤵
  PID:14524
- C:\Windows\System\XMEhtGX.exe
  C:\Windows\System\XMEhtGX.exe
  2⤵
  PID:14548
- C:\Windows\System\cLzDXnq.exe
  C:\Windows\System\cLzDXnq.exe
  2⤵
  PID:14576
- C:\Windows\System\eYyxiac.exe
  C:\Windows\System\eYyxiac.exe
  2⤵
  PID:14600
- C:\Windows\System\IYzHBGE.exe
  C:\Windows\System\IYzHBGE.exe
  2⤵
  PID:14636
- C:\Windows\System\RWdYfCf.exe
  C:\Windows\System\RWdYfCf.exe
  2⤵
  PID:14656
- C:\Windows\System\ZlLWeHE.exe
  C:\Windows\System\ZlLWeHE.exe
  2⤵
  PID:14684
- C:\Windows\System\LDuccaO.exe
  C:\Windows\System\LDuccaO.exe
  2⤵
  PID:14720
- C:\Windows\System\YgbqgwW.exe
  C:\Windows\System\YgbqgwW.exe
  2⤵
  PID:14748
- C:\Windows\System\WhIhPRL.exe
  C:\Windows\System\WhIhPRL.exe
  2⤵
  PID:14776
- C:\Windows\System\qHkgIyh.exe
  C:\Windows\System\qHkgIyh.exe
  2⤵
  PID:14812
- C:\Windows\System\ODXVKSl.exe
  C:\Windows\System\ODXVKSl.exe
  2⤵
  PID:14840
- C:\Windows\System\uuVLfaQ.exe
  C:\Windows\System\uuVLfaQ.exe
  2⤵
  PID:14860
- C:\Windows\System\ZpoKdxg.exe
  C:\Windows\System\ZpoKdxg.exe
  2⤵
  PID:14884
- C:\Windows\System\cTYGVgB.exe
  C:\Windows\System\cTYGVgB.exe
  2⤵
  PID:14900
- C:\Windows\System\Zxwogyk.exe
  C:\Windows\System\Zxwogyk.exe
  2⤵
  PID:14920
- C:\Windows\System\nYRstsd.exe
  C:\Windows\System\nYRstsd.exe
  2⤵
  PID:14952
- C:\Windows\System\TRIfLLl.exe
  C:\Windows\System\TRIfLLl.exe
  2⤵
  PID:14976
- C:\Windows\System\mNXkHYX.exe
  C:\Windows\System\mNXkHYX.exe
  2⤵
  PID:15000
- C:\Windows\System\pjTjqbP.exe
  C:\Windows\System\pjTjqbP.exe
  2⤵
  PID:15024
- C:\Windows\System\jrkBqlR.exe
  C:\Windows\System\jrkBqlR.exe
  2⤵
  PID:15044
- C:\Windows\System\TJKeIfQ.exe
  C:\Windows\System\TJKeIfQ.exe
  2⤵
  PID:15072
- C:\Windows\System\SveikSI.exe
  C:\Windows\System\SveikSI.exe
  2⤵
  PID:15108
- C:\Windows\System\YZNxydS.exe
  C:\Windows\System\YZNxydS.exe
  2⤵
  PID:15132
- C:\Windows\System\DyaThnC.exe
  C:\Windows\System\DyaThnC.exe
  2⤵
  PID:15152
- C:\Windows\System\CdYhgbG.exe
  C:\Windows\System\CdYhgbG.exe
  2⤵
  PID:15176
- C:\Windows\System\OZEjWuE.exe
  C:\Windows\System\OZEjWuE.exe
  2⤵
  PID:15192
- C:\Windows\System\vofDmYx.exe
  C:\Windows\System\vofDmYx.exe
  2⤵
  PID:15224
- C:\Windows\System\SFCaUbd.exe
  C:\Windows\System\SFCaUbd.exe
  2⤵
  PID:15248
- C:\Windows\System\wxvurkP.exe
  C:\Windows\System\wxvurkP.exe
  2⤵
  PID:15288
- C:\Windows\System\ZGueYnV.exe
  C:\Windows\System\ZGueYnV.exe
  2⤵
  PID:15320
- C:\Windows\System\FjYfPEc.exe
  C:\Windows\System\FjYfPEc.exe
  2⤵
  PID:15340
- C:\Windows\System\XdkGcLn.exe
  C:\Windows\System\XdkGcLn.exe
  2⤵
  PID:12684
- C:\Windows\System\bSSwODh.exe
  C:\Windows\System\bSSwODh.exe
  2⤵
  PID:13880
- C:\Windows\System\vawCdpi.exe
  C:\Windows\System\vawCdpi.exe
  2⤵
  PID:12976
- C:\Windows\System\nuTaDHv.exe
  C:\Windows\System\nuTaDHv.exe
  2⤵
  PID:14024
- C:\Windows\System\pimzIxk.exe
  C:\Windows\System\pimzIxk.exe
  2⤵
  PID:13556
- C:\Windows\System\ygHBbNY.exe
  C:\Windows\System\ygHBbNY.exe
  2⤵
  PID:14108
- C:\Windows\System\YCsHLJT.exe
  C:\Windows\System\YCsHLJT.exe
  2⤵
  PID:14136
- C:\Windows\System\bVQJMfY.exe
  C:\Windows\System\bVQJMfY.exe
  2⤵
  PID:13744
- C:\Windows\System\uMcuDbD.exe
  C:\Windows\System\uMcuDbD.exe
  2⤵
  PID:14188
- C:\Windows\System\hNCyUgv.exe
  C:\Windows\System\hNCyUgv.exe
  2⤵
  PID:12384
- C:\Windows\System\tDLYFjE.exe
  C:\Windows\System\tDLYFjE.exe
  2⤵
  PID:12620
- C:\Windows\System\FVdVVBi.exe
  C:\Windows\System\FVdVVBi.exe
  2⤵
  PID:14428
- C:\Windows\System\WUEzhxV.exe
  C:\Windows\System\WUEzhxV.exe
  2⤵
  PID:14468
- C:\Windows\System\DCHYtNd.exe
  C:\Windows\System\DCHYtNd.exe
  2⤵
  PID:13956
- C:\Windows\System\SkZDWoM.exe
  C:\Windows\System\SkZDWoM.exe
  2⤵
  PID:14624
- C:\Windows\System\qSHifDE.exe
  C:\Windows\System\qSHifDE.exe
  2⤵
  PID:14664
- C:\Windows\System\fUTGljf.exe
  C:\Windows\System\fUTGljf.exe
  2⤵
  PID:14700
- C:\Windows\System\RTTwzZo.exe
  C:\Windows\System\RTTwzZo.exe
  2⤵
  PID:14784
- C:\Windows\System\TGJiRtI.exe
  C:\Windows\System\TGJiRtI.exe
  2⤵
  PID:14832
- C:\Windows\System\DKwHXxD.exe
  C:\Windows\System\DKwHXxD.exe
  2⤵
  PID:13360
- C:\Windows\System\ORhzbtT.exe
  C:\Windows\System\ORhzbtT.exe
  2⤵
  PID:13488
- C:\Windows\System\YiDfvmU.exe
  C:\Windows\System\YiDfvmU.exe
  2⤵
  PID:15020
- C:\Windows\System\zPSVmtX.exe
  C:\Windows\System\zPSVmtX.exe
  2⤵
  PID:14260
- C:\Windows\System\DofEboo.exe
  C:\Windows\System\DofEboo.exe
  2⤵
  PID:14392
- C:\Windows\System\DRbDjcb.exe
  C:\Windows\System\DRbDjcb.exe
  2⤵
  PID:15368
- C:\Windows\System\RofLDrz.exe
  C:\Windows\System\RofLDrz.exe
  2⤵
  PID:15396
- C:\Windows\System\xfijNXq.exe
  C:\Windows\System\xfijNXq.exe
  2⤵
  PID:15412
- C:\Windows\System\FuCkqwb.exe
  C:\Windows\System\FuCkqwb.exe
  2⤵
  PID:15436
- C:\Windows\System\YrYvnLW.exe
  C:\Windows\System\YrYvnLW.exe
  2⤵
  PID:15452
- C:\Windows\System\PHyytKd.exe
  C:\Windows\System\PHyytKd.exe
  2⤵
  PID:15476
- C:\Windows\System\CuvpfTz.exe
  C:\Windows\System\CuvpfTz.exe
  2⤵
  PID:15496
- C:\Windows\System\tzWXfVN.exe
  C:\Windows\System\tzWXfVN.exe
  2⤵
  PID:15524
- C:\Windows\System\kHhqnNZ.exe
  C:\Windows\System\kHhqnNZ.exe
  2⤵
  PID:15560
- C:\Windows\System\rwJIrbo.exe
  C:\Windows\System\rwJIrbo.exe
  2⤵
  PID:15580
- C:\Windows\System\OLnLxnB.exe
  C:\Windows\System\OLnLxnB.exe
  2⤵
  PID:15596
- C:\Windows\System\BDOxCiO.exe
  C:\Windows\System\BDOxCiO.exe
  2⤵
  PID:15624
- C:\Windows\System\cgbzwqC.exe
  C:\Windows\System\cgbzwqC.exe
  2⤵
  PID:15648
- C:\Windows\System\tugpJhE.exe
  C:\Windows\System\tugpJhE.exe
  2⤵
  PID:15668
- C:\Windows\System\ZXzKeDK.exe
  C:\Windows\System\ZXzKeDK.exe
  2⤵
  PID:15692
- C:\Windows\System\AoeDmvF.exe
  C:\Windows\System\AoeDmvF.exe
  2⤵
  PID:15716
- C:\Windows\System\mqVdLgU.exe
  C:\Windows\System\mqVdLgU.exe
  2⤵
  PID:15736
- C:\Windows\System\mxnnbOb.exe
  C:\Windows\System\mxnnbOb.exe
  2⤵
  PID:15752
- C:\Windows\System\WJdMURK.exe
  C:\Windows\System\WJdMURK.exe
  2⤵
  PID:15784
- C:\Windows\System\CRxQVhx.exe
  C:\Windows\System\CRxQVhx.exe
  2⤵
  PID:15812
- C:\Windows\System\jRAeoWE.exe
  C:\Windows\System\jRAeoWE.exe
  2⤵
  PID:15836
- C:\Windows\System\PXqnvMs.exe
  C:\Windows\System\PXqnvMs.exe
  2⤵
  PID:15872
- C:\Windows\System\cATMTMj.exe
  C:\Windows\System\cATMTMj.exe
  2⤵
  PID:15900
- C:\Windows\System\kgMJzLH.exe
  C:\Windows\System\kgMJzLH.exe
  2⤵
  PID:15916
- C:\Windows\System\wuzehnA.exe
  C:\Windows\System\wuzehnA.exe
  2⤵
  PID:15936
- C:\Windows\System\lirvOvw.exe
  C:\Windows\System\lirvOvw.exe
  2⤵
  PID:15972
- C:\Windows\System\ufGoWhS.exe
  C:\Windows\System\ufGoWhS.exe
  2⤵
  PID:15996
- C:\Windows\System\lFxhkLl.exe
  C:\Windows\System\lFxhkLl.exe
  2⤵
  PID:16028
- C:\Windows\System\XuSQtrN.exe
  C:\Windows\System\XuSQtrN.exe
  2⤵
  PID:16048
- C:\Windows\System\qklEdgq.exe
  C:\Windows\System\qklEdgq.exe
  2⤵
  PID:16068
- C:\Windows\System\gPHoQLj.exe
  C:\Windows\System\gPHoQLj.exe
  2⤵
  PID:16092
- C:\Windows\System\XDusKdo.exe
  C:\Windows\System\XDusKdo.exe
  2⤵
  PID:16120
- C:\Windows\System\KhuLFkf.exe
  C:\Windows\System\KhuLFkf.exe
  2⤵
  PID:16144
- C:\Windows\System\AmTROAy.exe
  C:\Windows\System\AmTROAy.exe
  2⤵
  PID:16164
- C:\Windows\System\AKhslAN.exe
  C:\Windows\System\AKhslAN.exe
  2⤵
  PID:14808
- C:\Windows\System\mnxEZnG.exe
  C:\Windows\System\mnxEZnG.exe
  2⤵
  PID:16396
- C:\Windows\System\RilvAkv.exe
  C:\Windows\System\RilvAkv.exe
  2⤵
  PID:16432
- C:\Windows\System\mPPwhdt.exe
  C:\Windows\System\mPPwhdt.exe
  2⤵
  PID:16492
- C:\Windows\System\djCcDVJ.exe
  C:\Windows\System\djCcDVJ.exe
  2⤵
  PID:16548
- C:\Windows\System\YmlVPzS.exe
  C:\Windows\System\YmlVPzS.exe
  2⤵
  PID:16588
- C:\Windows\System\opnZpdL.exe
  C:\Windows\System\opnZpdL.exe
  2⤵
  PID:16612
- C:\Windows\System\fmxbkMp.exe
  C:\Windows\System\fmxbkMp.exe
  2⤵
  PID:16692
- C:\Windows\System\HhvXVhK.exe
  C:\Windows\System\HhvXVhK.exe
  2⤵
  PID:16712
- C:\Windows\System\xfpAkiF.exe
  C:\Windows\System\xfpAkiF.exe
  2⤵
  PID:16728
- C:\Windows\System\UansujP.exe
  C:\Windows\System\UansujP.exe
  2⤵
  PID:16744
- C:\Windows\System\iSRZJTM.exe
  C:\Windows\System\iSRZJTM.exe
  2⤵
  PID:16760
- C:\Windows\System\XqHuMxd.exe
  C:\Windows\System\XqHuMxd.exe
  2⤵
  PID:16788
- C:\Windows\System\IhOrroi.exe
  C:\Windows\System\IhOrroi.exe
  2⤵
  PID:16804
- C:\Windows\System\wbkTeKw.exe
  C:\Windows\System\wbkTeKw.exe
  2⤵
  PID:16832
- C:\Windows\System\QybGjTh.exe
  C:\Windows\System\QybGjTh.exe
  2⤵
  PID:16848
- C:\Windows\System\EqOPxRL.exe
  C:\Windows\System\EqOPxRL.exe
  2⤵
  PID:16868
- C:\Windows\System\eqHeKCT.exe
  C:\Windows\System\eqHeKCT.exe
  2⤵
  PID:16892
- C:\Windows\System\PNWVAOt.exe
  C:\Windows\System\PNWVAOt.exe
  2⤵
  PID:16912
- C:\Windows\System\WUROlcS.exe
  C:\Windows\System\WUROlcS.exe
  2⤵
  PID:16928
- C:\Windows\System\sqlHwGP.exe
  C:\Windows\System\sqlHwGP.exe
  2⤵
  PID:16944
- C:\Windows\System\XXnJoml.exe
  C:\Windows\System\XXnJoml.exe
  2⤵
  PID:16976
- C:\Windows\System\iHhMjKT.exe
  C:\Windows\System\iHhMjKT.exe
  2⤵
  PID:16992
- C:\Windows\System\GTBzzZs.exe
  C:\Windows\System\GTBzzZs.exe
  2⤵
  PID:17008
- C:\Windows\System\cwzqjvb.exe
  C:\Windows\System\cwzqjvb.exe
  2⤵
  PID:17040
- C:\Windows\System\CBorRNz.exe
  C:\Windows\System\CBorRNz.exe
  2⤵
  PID:17060
- C:\Windows\System\QNPQKVE.exe
  C:\Windows\System\QNPQKVE.exe
  2⤵
  PID:17092
- C:\Windows\System\HsAzAfA.exe
  C:\Windows\System\HsAzAfA.exe
  2⤵
  PID:17128
- C:\Windows\System\peFXKuC.exe
  C:\Windows\System\peFXKuC.exe
  2⤵
  PID:17160
- C:\Windows\System\alvbpAm.exe
  C:\Windows\System\alvbpAm.exe
  2⤵
  PID:17184
- C:\Windows\System\ZKVerfP.exe
  C:\Windows\System\ZKVerfP.exe
  2⤵
  PID:17208
- C:\Windows\System\yyTttql.exe
  C:\Windows\System\yyTttql.exe
  2⤵
  PID:17224
- C:\Windows\System\qTBGFsN.exe
  C:\Windows\System\qTBGFsN.exe
  2⤵
  PID:17244
- C:\Windows\System\GsgNUwq.exe
  C:\Windows\System\GsgNUwq.exe
  2⤵
  PID:17268
- C:\Windows\System\wfKdNNU.exe
  C:\Windows\System\wfKdNNU.exe
  2⤵
  PID:17288
- C:\Windows\System\OZZduln.exe
  C:\Windows\System\OZZduln.exe
  2⤵
  PID:17320
- C:\Windows\System\AQQlZDZ.exe
  C:\Windows\System\AQQlZDZ.exe
  2⤵
  PID:17336
- C:\Windows\System\XzoRGSQ.exe
  C:\Windows\System\XzoRGSQ.exe
  2⤵
  PID:17364
- C:\Windows\System\TDYlOHu.exe
  C:\Windows\System\TDYlOHu.exe
  2⤵
  PID:17392
- C:\Windows\System\jbTmbjo.exe
  C:\Windows\System\jbTmbjo.exe
  2⤵
  PID:16044
- C:\Windows\System\YauYzYm.exe
  C:\Windows\System\YauYzYm.exe
  2⤵
  PID:16084
- C:\Windows\System\PfqBHgf.exe
  C:\Windows\System\PfqBHgf.exe
  2⤵
  PID:15332
- C:\Windows\System\NBZaBnn.exe
  C:\Windows\System\NBZaBnn.exe
  2⤵
  PID:16412
- C:\Windows\System\QOAssrb.exe
  C:\Windows\System\QOAssrb.exe
  2⤵
  PID:16536
- C:\Windows\System\UvRIBPc.exe
  C:\Windows\System\UvRIBPc.exe
  2⤵
  PID:16564
- C:\Windows\System\SXLBzxT.exe
  C:\Windows\System\SXLBzxT.exe
  2⤵
  PID:15980
- C:\Windows\System\XPeMmSo.exe
  C:\Windows\System\XPeMmSo.exe
  2⤵
  PID:15764
- C:\Windows\System\rzINRXu.exe
  C:\Windows\System\rzINRXu.exe
  2⤵
  PID:15512
- C:\Windows\System\kbuCNCI.exe
  C:\Windows\System\kbuCNCI.exe
  2⤵
  PID:12628
- C:\Windows\System\cOOFlDT.exe
  C:\Windows\System\cOOFlDT.exe
  2⤵
  PID:15404
- C:\Windows\System\wtJoMbx.exe
  C:\Windows\System\wtJoMbx.exe
  2⤵
  PID:16816
- C:\Windows\System\YIQSCMN.exe
  C:\Windows\System\YIQSCMN.exe
  2⤵
  PID:16484
- C:\Windows\System\kbsJhwg.exe
  C:\Windows\System\kbsJhwg.exe
  2⤵
  PID:16608
- C:\Windows\System\kiZhcsC.exe
  C:\Windows\System\kiZhcsC.exe
  2⤵
  PID:16700
- C:\Windows\System\IFZlWrk.exe
  C:\Windows\System\IFZlWrk.exe
  2⤵
  PID:16968
- C:\Windows\System\uxTtfuT.exe
  C:\Windows\System\uxTtfuT.exe
  2⤵
  PID:15468
- C:\Windows\System\hpUICMq.exe
  C:\Windows\System\hpUICMq.exe
  2⤵
  PID:16756
- C:\Windows\System\zqLvCuj.exe
  C:\Windows\System\zqLvCuj.exe
  2⤵
  PID:17108
- C:\Windows\System\YTVvDJU.exe
  C:\Windows\System\YTVvDJU.exe
  2⤵
  PID:15120
- C:\Windows\System\DcobfoR.exe
  C:\Windows\System\DcobfoR.exe
  2⤵
  PID:15408
- C:\Windows\System\vrTCqMa.exe
  C:\Windows\System\vrTCqMa.exe
  2⤵
  PID:16392
- C:\Windows\System\lvdxIJI.exe
  C:\Windows\System\lvdxIJI.exe
  2⤵
  PID:16604
- C:\Windows\System\UXesThP.exe
  C:\Windows\System\UXesThP.exe
  2⤵
  PID:17236
- C:\Windows\System\DaubOYj.exe
  C:\Windows\System\DaubOYj.exe
  2⤵
  PID:17316
- C:\Windows\System\YfDzzBy.exe
  C:\Windows\System\YfDzzBy.exe
  2⤵
  PID:17140
- C:\Windows\System\dteaLFG.exe
  C:\Windows\System\dteaLFG.exe
  2⤵
  PID:15264
- C:\Windows\System\smngyyv.exe
  C:\Windows\System\smngyyv.exe
  2⤵
  PID:16796
- C:\Windows\System\lgkDwBc.exe
  C:\Windows\System\lgkDwBc.exe
  2⤵
  PID:15348
- C:\Windows\System\WFYbUDF.exe
  C:\Windows\System\WFYbUDF.exe
  2⤵
  PID:16708
- C:\Windows\System\BiIdTOZ.exe
  C:\Windows\System\BiIdTOZ.exe
  2⤵
  PID:15144

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:12876

C:\Windows\System32\WaaSMedicAgent.exe
C:\Windows\System32\WaaSMedicAgent.exe 509d37a02d74ee6d67bf460462e18e4a n6NjhQC210KUulrglNWfiw.0.1.0.0.0
1⤵
PID:15980

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\Egppema.exe

Filesize
1.3MB

MD5
741739d4d75b822361e1d801db629966

SHA1
4c29e836037065eb678622884c1111e05a8e5cab

SHA256
46b7e8aa3fe522379c1f7dde4851494df0542f9f5a8a959f9af28c6bdfc77bc5

SHA512
a3e574f55b3cc638d28baf05582f2764b5c7677eaa4781772423be6e1b29767662b83c7cb74ab4ef22828a976a75cac13736717752f8418deed66288f64f89dd

Download Submit
C:\Windows\System\HrMhjyG.exe

Filesize
1.3MB

MD5
334cb0fb71626b69c998fa08157e8866

SHA1
d0e692574abe4cbdeac6ca828ce5ad3c15f8bf92

SHA256
0c56a786dfed9b62ff40b317cea6a4caf206800ae89c07ccbd2440ab1d508130

SHA512
f83c0130276ab3d693ff19a5dc1af22d2dc7bea9cf1479a2cb598b5c21c6ca10a2f0790a531fc8b8fd9b069ae850751df247970c268a6f2d4e01c62538a0dc6d

Download Submit
C:\Windows\System\IFvdmHL.exe

Filesize
1.3MB

MD5
d07a08fb8c597d1784752ca180529027

SHA1
6c05b1867e11c07cfe73f17c7e77640a321ca619

SHA256
12b7817859afb92ecb67372038b19c9e650511dd916b7dee4d6b12e8d0ef4d78

SHA512
993ab5aa5deeeb2174a64438545fff9772d433254e5339f3c8a6f76ac340af808df3739f740a61b22ea6549ed84b4483dce0518fb2c251ff911e96dc54caa061

Download Submit
C:\Windows\System\IvLtsMV.exe

Filesize
1.3MB

MD5
519b8b6c9a54268613afda697d6a3d4c

SHA1
b7895e826bbeb864acad2950b5f989becb3f6827

SHA256
d7c94c3fabecb1604608c4ad43a8413fb394bb41aabf3ce4651cfd3011e65b25

SHA512
11667737fcf284c4c2d27d85e64a41f6c3aa1a66640a966fafce0c5180c70ef3079b5cedb8b273e8f0fb7a57818b4ad42df998109c0678118cb745dd67f2af7f

Download Submit
C:\Windows\System\JIjXAHp.exe

Filesize
1.3MB

MD5
0d0d1e0d082dee888375ac7e203f878b

SHA1
504bf260516862a0e76e8953aab0c18437295f44

SHA256
44abde4cc9ac09ff6c55142ed05502334e4f4d4d0be059458fab889508b4d780

SHA512
128fad327c059509fd0ab946dae36a4734c2c0066a472c5c325f2a818314ff23a657bb33866630c7d8ce00d03788b1e52a04496ce641f45fc2084828f0d5897e

Download Submit
C:\Windows\System\LWruDhk.exe

Filesize
1.3MB

MD5
61ccbef5ef35467c09fc2941c4c7ce01

SHA1
666b2337bf97fe6b72d0487c87d784fef0c76aa2

SHA256
5d0c78aa601ddd944076d4285e90d419aee47be086f634e98621e6a69379b219

SHA512
0f2b2f352591a2da38a0747e697af63173a19ba35af554b97822f5c6c7bf3a823af2ae0a9b4e44be38df123716b29be5c92afa040f1fcdd7c7c5195eb842074a

Download Submit
C:\Windows\System\MKGNmsO.exe

Filesize
1.3MB

MD5
5d0845cef3c333921551827611121c73

SHA1
2e3aa8ffbb287e812e1bc8ab08c440332cc075eb

SHA256
c37611919010b1bdac41aedd9cceb1e27ba742448710c689bd629b0e4d0398f8

SHA512
3fe8dc67d32c200a6374273eb2e2b524ec924b51747cfcebb3579ac1f375c6c25499355f390410e48413216a41a277821d15ac1296764f4c2396701956611512

Download Submit
C:\Windows\System\MQoXtFs.exe

Filesize
1.3MB

MD5
e1c25e4d78f6d927e4574c00f8ed7a73

SHA1
62265f1f505e273ea22ae97001a18631378aec23

SHA256
3553751c42029e388bd48f4e11dbde042ac8e0439cde839418b215426758cdcc

SHA512
65d11fe6100a33cc79306e1ae2094c3305427f4ef2649307aa50bcb63d64ff0c3f42ab05fd6bb71d34ad971b965b0acb4d0792d6eba26d32158a188560b1323d

Download Submit
C:\Windows\System\OIjMdss.exe

Filesize
1.3MB

MD5
01031eb8ecb580ce473106a756e530c3

SHA1
45dca036be24c194c6132fca849e8b0667ff105d

SHA256
57ae6981a7374db39ddd3bcff15ed964563a4a543f17910385bdc410a207890e

SHA512
ae662485c064aff58e7e9063f9cd2ea33f126b7e8886e9a9c95fee75699e50a7fed34c5ddf4e6aed9b59ed4d09b9dbce45b5ad0f38a5e30799becc58169179ae

Download Submit
C:\Windows\System\OMpellX.exe

Filesize
1.3MB

MD5
2119534b90bf4e3cafe7e5bc2774dcbb

SHA1
6cf4a095d748f0978cf0767a379069c7e1254cbc

SHA256
0b0225b6dbe488cf786a503bc6072d9cb94fbb362ceac1a4cefd94093af7d2c2

SHA512
8ac40a6dfc7b0eb1b3c2245e0ecf5875bb05f02602244235f41029a9924013d9085b1544a0be0693ad1116f0abb427895f5d460411593d67270644f799e63a33

Download Submit
C:\Windows\System\PDEwFjI.exe

Filesize
1.3MB

MD5
5526821dd63e982578490970b2739353

SHA1
9b33ee35dab881a1127661e6688c582d368dba03

SHA256
c48f72bb134f96cbae873dc119e2de4b2c5592a0b675df0ec894c28f739b524f

SHA512
e03a042aced556af1a4522c5fb802af6329aa9c8df7b729720a6f86459a2f557eaab24ba75496fd3a93d866d5301a427025cee30c21b0c99bcd80c608d4e3eaf

Download Submit
C:\Windows\System\PldRyVx.exe

Filesize
1.3MB

MD5
c59317d3d4273c6f3460093dce041ee9

SHA1
ebd596d8273b5ea689d584c877899295189e54cb

SHA256
597bccf670a54f1370a76d17b48d3d200eaf0a4e0d5aa9d2235212c27b81ecdb

SHA512
05c877d3c19e1350c9594f605850aa3e123f6fdcb787cec59df82b4de4172e0ce0aed652fca142382ad95d9ae84950eca5dd4119337f028c4e31df175bfc3f8e

Download Submit
C:\Windows\System\RrUlCiB.exe

Filesize
1.3MB

MD5
45023dcfeb0f9e9027e599713dea8f92

SHA1
0add74fe29093eba16e38ee5573eea787e2f2c57

SHA256
07ae1170e944747c06ea445cb3e1b362eaffa9638febef20ae1fea480f0e2ebf

SHA512
d8bc1842ef6608ba4dc261ae4adcf25847398b6e294a3c1d289bf2de8bf4acd347742cfea007579403b6c29a8590d4323c5795094bd1b43732e549ecb546a2f4

Download Submit
C:\Windows\System\UnIraCG.exe

Filesize
1.3MB

MD5
5d7820602be44d8631c55c0ad5ad43c5

SHA1
1cd14dca46f3f9f6c511f749cac76f10917e80d4

SHA256
e8c017c774c085a92dfb17a484c311bb5a87f6d505b003c5f7c4a85aa517633e

SHA512
2bd2e02fb66ab3086628c80834cd63fa9b9776b49c025e9179dec0c0567ff8e74021a1c65280c353a4967215213e49d4a45ce083566e11690dd45c819b59d760

Download Submit
C:\Windows\System\WcpeZzN.exe

Filesize
1.3MB

MD5
5e23ae2a275d0f9449bb363ff692a385

SHA1
140e2e119318f8efccc00b7cbf5174df476fad0d

SHA256
c76201e0431a4a304bec086ec03c18fa11005f612088637f60d942dc34619fdf

SHA512
b5bf860f79699d1e1b6cda1f337b383721be41fd118e025020c54824e526e4a8d11bbda900298245ea45a0c8c5904567d0ad68e4e3e6476afcd831df7436cc42

Download Submit
C:\Windows\System\WfQEfED.exe

Filesize
1.3MB

MD5
47be614a0861a70f4f674fc0f47d820a

SHA1
a7538901c4b35c419c467975c6c4b29075a0e21b

SHA256
96cc798148c1f6a105eb3dab3ce9d02cc7559dccdb935c5477ff32b28e728361

SHA512
8147f6f64148f9ee2cc92329a4d833a549f38b65cf61b0ee2e5b8dfe34cf0c3bbacac0a5bbda71de0ea15c33270349116c71d0234273bb254e56d0231108872f

Download Submit
C:\Windows\System\baYGsYf.exe

Filesize
1.3MB

MD5
83effb4368f84af718d9fcd96997b041

SHA1
c3f4324e833faf3d9bd6ff2074bdd2c497ec0b5f

SHA256
7a3b17d8a6b9aa949ea065ffe02f3f773b51d560e05258eea0ab6d0cb9e5de7f

SHA512
fe2c97797c3c1a37659b1295a92c6352c6331fa90f3a2837c0fb2142de81a4398373f9d19071910ca2acbe7b8807646b446eae317df5d1928b9e7185238ba300

Download Submit
C:\Windows\System\gOqUjBw.exe

Filesize
1.3MB

MD5
8c5b808a6a06113563591aed8d2b7281

SHA1
0a966efd78591e0d30b5dc50fa856299afa05118

SHA256
63e8cf3cc0bfb784a53bf6c0c4fceefa6c8774bd16b2cbddc6fbf02989c404cf

SHA512
80ec5aa3e5016b25a7877904aeae94e0b3f909dc25f460810bf8cdf398984b6ebdfd0d0dd31ff01891e59e358aa154589db1b7a03801c70cebf883b9ffcd1596

Download Submit
C:\Windows\System\hOBhYfP.exe

Filesize
1.3MB

MD5
83dcd1602b0241358a2c6920d773a4d0

SHA1
805b2b2bb0e1ff0226dc959ab22cac2d706f0a71

SHA256
f5b0092c8dbb7fb9089b419674d3bfca38787b4865fc4faece2f63b7fac47f52

SHA512
5a973ef4e97ef7be88f994c2d9048e16da1875e496084b6f5205d0a1d12ab86dedfd6081ade82c94e4154c942df43d80fca25c3b6f21d9322c37901542670d09

Download Submit
C:\Windows\System\iadvJxs.exe

Filesize
1.3MB

MD5
ad7460fc5e6ffacd10ad908333039780

SHA1
297d860b0794cd02ab36e04a5f5ba7eb843d62a0

SHA256
73568867caf58385d15290f524d158f19473b9c25555c8ff4ed30a2ffe4aabb1

SHA512
785851789ecb5ce04343ce0a7ebf3d87cc932f116f055cdb4d67e5917e0f8763a99a24ac13db93955b18e882b75e4b377efcb5658a74de2ebddc0bda8d401728

Download Submit
C:\Windows\System\kZdHZUY.exe

Filesize
1.3MB

MD5
3a97b3f349eabe3e63d2471642d010ef

SHA1
11128af673a33979df597407e882e98b97198474

SHA256
9c37d716c1a7d86f5d7ec55a8e8fe6a02b9dd4c3f402605b1dd79bf0bde77a54

SHA512
c47478303ef8802651f9ecb3649c9d2b124606d3a63b7c674ce47b5c863875ecb366aba0980b660bafeade19ccf89d2527caac179c1ca207914ad7bc0d1bb097

Download Submit
C:\Windows\System\mRmDGXQ.exe

Filesize
1.3MB

MD5
23a7a6234ee4514835311dff01841fea

SHA1
0e3674350e36f671de25c99fd17829a08ae2c224

SHA256
8ae743dcc27b6f2d75b0b31dbbf486c95e22b95051af9f840fa64e3b4c6c8b02

SHA512
4b79b901c0a09302803e7b00b6333f746bc24ace2528bd5e0a6d01dbbed163baf752d93c22544b5c68b1f32df7db0cc833eb7ea9285dedf9628bfdc2a69ac053

Download Submit
C:\Windows\System\oZqYnYl.exe

Filesize
1.3MB

MD5
117320d1b1eb530c7b4d4d8224c006f3

SHA1
f79bc818ef43509aaf9128edbb4c592e470763c7

SHA256
ffb87379cceb10349f36ce4ac2bb99cd3480d3948d31e770048a3234f08f8410

SHA512
db628d4bbedbd6543e5738beec25e19d1ed40128efe8dd6906210e9f478ff3e9f1277492cffdb0d7ecb5fc6bd27e07b39e7db37ac1873e5c9405d9dd0a05d88d

Download Submit
C:\Windows\System\obihmVS.exe

Filesize
1.3MB

MD5
7a7e5974388e9d70ae6ea67c7fa0070f

SHA1
27eabe22db142a715ad287d4d97571baae86e14c

SHA256
4c142709ca0fe33abf7577d576b27990c3221ba26c44e06b83c60a6345ac51e8

SHA512
b52416eb59e9205a86700e6d281f951270d8812307940b40a991674ba58f31048db112f5cd5104dd6319de7ccffdc8093e235dd5c5d183079f5b91b58fba346c

Download Submit
C:\Windows\System\qmiWPLA.exe

Filesize
1.3MB

MD5
9c531154eef7f867416d75ff3cdcef2c

SHA1
117904b819ce9cd0773981a889f4b58340849313

SHA256
5001736dd87f2a0637a274171aa68cf9ae51fcaecf804cf09308af902c650dce

SHA512
72e074523873439a6fae5cf5c9645c24284a4c6edaffa2ebe9e52ecc2203522d9ab5c80b6a184eb05057b82d685689b4d9628551d8f14c639493a9b0ba126d43

Download Submit
C:\Windows\System\rGkyhFO.exe

Filesize
1.3MB

MD5
af5137f2bff2ab0ab165d3f53ae1aac8

SHA1
eeb3f2fdccc831c17d21721f24dc6981a6a35573

SHA256
2fb00c06369c264a181a211b463b446de90369ba55bc646dc1d5959de110d931

SHA512
f801a1a3677ec23b07213c31fc4d416f9b1c75ea2a119346d4a5f3c4f11b3b5b3903f9ea65cb14709c904ba56884683c308f1c9243bcb288c11fe8369fb00823

Download Submit
C:\Windows\System\sDJnVnW.exe

Filesize
1.3MB

MD5
d4953af83ae2ec37d6614a0d0551990a

SHA1
cfbf338ae9747f08f3cdbcee67e534a482a66adf

SHA256
6c3759eeb81c21fd7eda9aae043354e66ab96c2c5a1ee0a49788868af32375b6

SHA512
37597353c017a3ae5875a465337ecc4bf6054a24476c6de36cec0aa8ec37259657bd637b82a6c03dc3e498a8b6e08da9b8d7f9f418555b57488e07280b369ef1

Download Submit
C:\Windows\System\tRVWqcT.exe

Filesize
1.3MB

MD5
45520b588272fe617ea128e9c46eec5b

SHA1
e3c08f94b2033c744fe716bbc90c84bd1edaa4b6

SHA256
4ca50d0de658c78a2354f91e4c2fa2c038ac419524eaf723834b3b11e0855729

SHA512
524f841088907b7d48b3b2a64e220c8f9d222cfdbdfe154923f2add95ef3d32792da62cf34f71a9cb31a4f5254f14f41fc2a17aa72d672cf92ed1b4e7836b62c

Download Submit
C:\Windows\System\vWrVbDT.exe

Filesize
1.3MB

MD5
0fabf34e7019b5ae89979fa9d4adb730

SHA1
6744b0e1029c4130fd73a3ca21d22cc8330cccf6

SHA256
761bbfc34bdeda00d1b19f67b95178f6ca6074c2fa71ad7a68d7d44ed8efb912

SHA512
3ecf812c0ff32ccaa31ea9e299f4856da8c4063e84ef343898b3e8c2363e7fe82cca1e74a9e770ee5436eb2a7de8f5824fc1d6eeaf77239137df1c90177018eb

Download Submit
C:\Windows\System\valysXL.exe

Filesize
1.3MB

MD5
c69e43cf1104a72915ff85b37bc66968

SHA1
d9e30ed9ed23e436778954d33951b69547a26bd5

SHA256
c56e11e33e812c454b5de094e4e3314123f396b732501f1bb2415d1ccacc8d64

SHA512
d5eb49bf3b7988dca25b9b80f24570985ad2342d19a199a8e9f9ee297e6fad65c60d73c595880b8ac02a5b1c0ae218922edcd5580edb3aa5c376ed93a436415c

Download Submit
C:\Windows\System\xAtleed.exe

Filesize
1.3MB

MD5
f9fd7eef1fbad6fce0116d909c1f9554

SHA1
24dc2e7edbf5caf0530435f9ce58f9dd4a79b58c

SHA256
772ad39d5b74bf7e62fdb45048a52c18889fbad5973f98cea951665a8a102923

SHA512
4536779d3c6ecc9556b518fccdc7faeade04e73c45d225b55ac54f7192e9c5c1e5bf72f843f2261d57a72b1245b14e3699b41c1c6172f607e8a4f1a09df8ee04

Download Submit
C:\Windows\System\yTauGNS.exe

Filesize
1.3MB

MD5
b63109b94749a9eef531a5e590886dcc

SHA1
aa11ea8e14cbd616fec6b740ba74f9a02f1f56cd

SHA256
1cba357a78f01b475e35c3dd261b4dab6b5b3226ef6b6975822548ad627a1014

SHA512
d2a81ddcef4e8483ef29361794d5e2310e30748441db1c8e77325375845b037b2432e7572b3942dea02a6f2f2059100d5bb368d9bdd10e1d37919b42ab9024c7

Download Submit
C:\Windows\System\zjvzdIi.exe

Filesize
1.3MB

MD5
16f14ea132a5702aea86bb508f0601fd

SHA1
5e370a72b3b81d9462f3253160b8845a0574d12b

SHA256
0f04c58793ecc5c5842cbf83e50ec14dd6aa6809b0fea481da2006a9c0234c50

SHA512
f14b911251fec4f35c6bea5572abd7ab6dbf9a0f824b126735b122c589b838c2008931a532225851640388609cb5042f7f63b2b354d9490e5ed862b65cb8dfdb

Download Submit
memory/1260-0-0x00000187DEAD0000-0x00000187DEAE0000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads