xmrig | 5a08a8c2dcc04967c811bd833ed77d2e861dc999c11d096e47aeeba21ef461ba

Analysis

max time kernel
122s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20250129-en
resource tags

arch:x64arch:x86image:win10v2004-20250129-enlocale:en-usos:windows10-2004-x64system
submitted
02/02/2025, 23:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5a08a8c2dcc04967c811bd833ed77d2e861dc999c11d096e47aeeba21ef461ba.exe
Size

1.6MB
MD5

6943b5e38d71a962b31d1c1a4775f733
SHA1

254dd4ed21620ec8b297bafbfff384059dbb26ed
SHA256

5a08a8c2dcc04967c811bd833ed77d2e861dc999c11d096e47aeeba21ef461ba
SHA512

689731bfc8b8cc9e97c560268aa541cc19a7bb3d541d32743d5bc056424e1854787f0398bf3968bd4386419cf12323ce1044f1ba27079564d823be73cda2523d
SSDEEP

49152:GezaTF8FcNkNdfE0pZ9ozttwIRxj4c5y2PF6fRYsO:GemTLkNdfE0pZyH

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 33 IoCs

miner

resource	yara_rule
behavioral2/files/0x000c000000023b22-3.dat	xmrig
behavioral2/files/0x000b000000023b84-9.dat	xmrig
behavioral2/files/0x000a000000023b85-15.dat	xmrig
behavioral2/files/0x000a000000023b86-19.dat	xmrig
behavioral2/files/0x000a000000023b87-22.dat	xmrig
behavioral2/files/0x000a000000023b8d-64.dat	xmrig
behavioral2/files/0x000a000000023b91-81.dat	xmrig
behavioral2/files/0x000a000000023b95-96.dat	xmrig
behavioral2/files/0x000a000000023b94-111.dat	xmrig
behavioral2/files/0x000a000000023ba1-135.dat	xmrig
behavioral2/files/0x0009000000023bb6-133.dat	xmrig
behavioral2/files/0x0008000000023bb1-131.dat	xmrig
behavioral2/files/0x000e000000023ba8-129.dat	xmrig
behavioral2/files/0x000b000000023b99-127.dat	xmrig
behavioral2/files/0x000b000000023b98-124.dat	xmrig
behavioral2/files/0x000b000000023b97-120.dat	xmrig
behavioral2/files/0x000a000000023b96-118.dat	xmrig
behavioral2/files/0x000a000000023b93-97.dat	xmrig
behavioral2/files/0x000a000000023b92-87.dat	xmrig
behavioral2/files/0x000a000000023b90-79.dat	xmrig
behavioral2/files/0x000a000000023b8f-76.dat	xmrig
behavioral2/files/0x000a000000023b8e-71.dat	xmrig
behavioral2/files/0x000a000000023b8c-57.dat	xmrig
behavioral2/files/0x000a000000023b8b-52.dat	xmrig
behavioral2/files/0x000a000000023b8a-41.dat	xmrig
behavioral2/files/0x000a000000023b89-37.dat	xmrig
behavioral2/files/0x000a000000023b88-29.dat	xmrig
behavioral2/files/0x0009000000023bb7-140.dat	xmrig
behavioral2/files/0x000c000000023b7e-147.dat	xmrig
behavioral2/files/0x000e000000023bbc-154.dat	xmrig
behavioral2/files/0x0008000000023bbe-157.dat	xmrig
behavioral2/files/0x0008000000023bc1-163.dat	xmrig
behavioral2/files/0x0009000000023bb8-162.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
1196	PtBKKzR.exe
1808	WbLHAVi.exe
4340	YqZdMhX.exe
1828	lMevLql.exe
4908	GBSKoIP.exe
232	xNHCCKh.exe
3024	AdzcelM.exe
4268	iFHcEOo.exe
2784	CRuDiyg.exe
1316	qcBqYeF.exe
4712	AhKiktS.exe
3524	eBWGgfz.exe
864	xQKOule.exe
3948	DDZjjkK.exe
1532	RMnuThZ.exe
2660	QYJwRxX.exe
2456	ZAMqXBp.exe
1284	UyAxQOJ.exe
4020	WTUiPDd.exe
5008	ykBUScl.exe
2028	dRInWkx.exe
5028	XpFvqwa.exe
2780	kvXGntF.exe
2420	KRafFgt.exe
3724	HvaqLwh.exe
4836	LLuLPNN.exe
4628	cVXalLp.exe
4352	AeYxBAM.exe
1372	WkJzoQX.exe
2932	wstlWBV.exe
4772	msLcowq.exe
2364	KZyhcbM.exe
3328	gxQVzdo.exe
3372	YfjQUfR.exe
1104	dxVjbgg.exe
528	LkbcJTi.exe
2132	BeJdHue.exe
776	klWzbjs.exe
3456	nVRQWFr.exe
3832	whTzcBT.exe
4304	LTawzBY.exe
4276	IyOoVBQ.exe
840	aHXBmVj.exe
1072	WLjxLXd.exe
2936	SDzBomM.exe
4504	MYqxBhT.exe
1420	yJMSNdL.exe
1984	EirFstu.exe
4996	XnKovoE.exe
228	BHDwxtz.exe
100	ubgvcdL.exe
4408	FYydbam.exe
1560	VGkAXrF.exe
1116	ODHPNdE.exe
4696	aHqGAmO.exe
2776	PiCwCRP.exe
4612	JGlhPql.exe
4688	EDfxuwz.exe
1320	xCXLgrh.exe
4360	RVByfzy.exe
4880	lMcEuTl.exe
1160	QxYONjY.exe
368	bQLLQoo.exe
1604	LSVVhcQ.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\HwAQuom.exe	5a08a8c2dcc04967c811bd833ed77d2e861dc999c11d096e47aeeba21ef461ba.exe
File created	C:\Windows\System\ohadfUy.exe	5a08a8c2dcc04967c811bd833ed77d2e861dc999c11d096e47aeeba21ef461ba.exe
File created	C:\Windows\System\naxqvgk.exe	5a08a8c2dcc04967c811bd833ed77d2e861dc999c11d096e47aeeba21ef461ba.exe
File created	C:\Windows\System\PWlAYoB.exe	5a08a8c2dcc04967c811bd833ed77d2e861dc999c11d096e47aeeba21ef461ba.exe
File created	C:\Windows\System\OioaaHE.exe	5a08a8c2dcc04967c811bd833ed77d2e861dc999c11d096e47aeeba21ef461ba.exe
File created	C:\Windows\System\XzTGztY.exe	5a08a8c2dcc04967c811bd833ed77d2e861dc999c11d096e47aeeba21ef461ba.exe
File created	C:\Windows\System\HewSmEf.exe	5a08a8c2dcc04967c811bd833ed77d2e861dc999c11d096e47aeeba21ef461ba.exe
File created	C:\Windows\System\MMBkfXA.exe	5a08a8c2dcc04967c811bd833ed77d2e861dc999c11d096e47aeeba21ef461ba.exe
File created	C:\Windows\System\mWBmRPc.exe	5a08a8c2dcc04967c811bd833ed77d2e861dc999c11d096e47aeeba21ef461ba.exe
File created	C:\Windows\System\vyObLge.exe	5a08a8c2dcc04967c811bd833ed77d2e861dc999c11d096e47aeeba21ef461ba.exe
File created	C:\Windows\System\XBqWTjg.exe	5a08a8c2dcc04967c811bd833ed77d2e861dc999c11d096e47aeeba21ef461ba.exe
File created	C:\Windows\System\paQZsoE.exe	5a08a8c2dcc04967c811bd833ed77d2e861dc999c11d096e47aeeba21ef461ba.exe
File created	C:\Windows\System\dLjDxQH.exe	5a08a8c2dcc04967c811bd833ed77d2e861dc999c11d096e47aeeba21ef461ba.exe
File created	C:\Windows\System\sFwVLty.exe	5a08a8c2dcc04967c811bd833ed77d2e861dc999c11d096e47aeeba21ef461ba.exe
File created	C:\Windows\System\pGOfguP.exe	5a08a8c2dcc04967c811bd833ed77d2e861dc999c11d096e47aeeba21ef461ba.exe
File created	C:\Windows\System\vqPQYBe.exe	5a08a8c2dcc04967c811bd833ed77d2e861dc999c11d096e47aeeba21ef461ba.exe
File created	C:\Windows\System\CpEWyIR.exe	5a08a8c2dcc04967c811bd833ed77d2e861dc999c11d096e47aeeba21ef461ba.exe
File created	C:\Windows\System\BqZPEht.exe	5a08a8c2dcc04967c811bd833ed77d2e861dc999c11d096e47aeeba21ef461ba.exe
File created	C:\Windows\System\pNbDMrZ.exe	5a08a8c2dcc04967c811bd833ed77d2e861dc999c11d096e47aeeba21ef461ba.exe
File created	C:\Windows\System\OByfqod.exe	5a08a8c2dcc04967c811bd833ed77d2e861dc999c11d096e47aeeba21ef461ba.exe
File created	C:\Windows\System\SIrPGLF.exe	5a08a8c2dcc04967c811bd833ed77d2e861dc999c11d096e47aeeba21ef461ba.exe
File created	C:\Windows\System\TIgNiVR.exe	5a08a8c2dcc04967c811bd833ed77d2e861dc999c11d096e47aeeba21ef461ba.exe
File created	C:\Windows\System\kEuZtvU.exe	5a08a8c2dcc04967c811bd833ed77d2e861dc999c11d096e47aeeba21ef461ba.exe
File created	C:\Windows\System\sZeOOui.exe	5a08a8c2dcc04967c811bd833ed77d2e861dc999c11d096e47aeeba21ef461ba.exe
File created	C:\Windows\System\Bntculc.exe	5a08a8c2dcc04967c811bd833ed77d2e861dc999c11d096e47aeeba21ef461ba.exe
File created	C:\Windows\System\cZyHmdy.exe	5a08a8c2dcc04967c811bd833ed77d2e861dc999c11d096e47aeeba21ef461ba.exe
File created	C:\Windows\System\QbYdjbx.exe	5a08a8c2dcc04967c811bd833ed77d2e861dc999c11d096e47aeeba21ef461ba.exe
File created	C:\Windows\System\podXFmX.exe	5a08a8c2dcc04967c811bd833ed77d2e861dc999c11d096e47aeeba21ef461ba.exe
File created	C:\Windows\System\SWAiMcJ.exe	5a08a8c2dcc04967c811bd833ed77d2e861dc999c11d096e47aeeba21ef461ba.exe
File created	C:\Windows\System\bJYmxJT.exe	5a08a8c2dcc04967c811bd833ed77d2e861dc999c11d096e47aeeba21ef461ba.exe
File created	C:\Windows\System\IbruIuK.exe	5a08a8c2dcc04967c811bd833ed77d2e861dc999c11d096e47aeeba21ef461ba.exe
File created	C:\Windows\System\ueDuSlI.exe	5a08a8c2dcc04967c811bd833ed77d2e861dc999c11d096e47aeeba21ef461ba.exe
File created	C:\Windows\System\rnEQPAU.exe	5a08a8c2dcc04967c811bd833ed77d2e861dc999c11d096e47aeeba21ef461ba.exe
File created	C:\Windows\System\mTLTHTX.exe	5a08a8c2dcc04967c811bd833ed77d2e861dc999c11d096e47aeeba21ef461ba.exe
File created	C:\Windows\System\MlbIsMM.exe	5a08a8c2dcc04967c811bd833ed77d2e861dc999c11d096e47aeeba21ef461ba.exe
File created	C:\Windows\System\BUOmoiG.exe	5a08a8c2dcc04967c811bd833ed77d2e861dc999c11d096e47aeeba21ef461ba.exe
File created	C:\Windows\System\UMZfldu.exe	5a08a8c2dcc04967c811bd833ed77d2e861dc999c11d096e47aeeba21ef461ba.exe
File created	C:\Windows\System\NSFlnkK.exe	5a08a8c2dcc04967c811bd833ed77d2e861dc999c11d096e47aeeba21ef461ba.exe
File created	C:\Windows\System\aWnbEIX.exe	5a08a8c2dcc04967c811bd833ed77d2e861dc999c11d096e47aeeba21ef461ba.exe
File created	C:\Windows\System\UFbUypU.exe	5a08a8c2dcc04967c811bd833ed77d2e861dc999c11d096e47aeeba21ef461ba.exe
File created	C:\Windows\System\MXupSTG.exe	5a08a8c2dcc04967c811bd833ed77d2e861dc999c11d096e47aeeba21ef461ba.exe
File created	C:\Windows\System\YCJlBbJ.exe	5a08a8c2dcc04967c811bd833ed77d2e861dc999c11d096e47aeeba21ef461ba.exe
File created	C:\Windows\System\RqRjAgL.exe	5a08a8c2dcc04967c811bd833ed77d2e861dc999c11d096e47aeeba21ef461ba.exe
File created	C:\Windows\System\tXCjJcr.exe	5a08a8c2dcc04967c811bd833ed77d2e861dc999c11d096e47aeeba21ef461ba.exe
File created	C:\Windows\System\qkRLggD.exe	5a08a8c2dcc04967c811bd833ed77d2e861dc999c11d096e47aeeba21ef461ba.exe
File created	C:\Windows\System\jpnJQwo.exe	5a08a8c2dcc04967c811bd833ed77d2e861dc999c11d096e47aeeba21ef461ba.exe
File created	C:\Windows\System\mPdHagE.exe	5a08a8c2dcc04967c811bd833ed77d2e861dc999c11d096e47aeeba21ef461ba.exe
File created	C:\Windows\System\wJcRPwn.exe	5a08a8c2dcc04967c811bd833ed77d2e861dc999c11d096e47aeeba21ef461ba.exe
File created	C:\Windows\System\UyAxQOJ.exe	5a08a8c2dcc04967c811bd833ed77d2e861dc999c11d096e47aeeba21ef461ba.exe
File created	C:\Windows\System\HHdejtD.exe	5a08a8c2dcc04967c811bd833ed77d2e861dc999c11d096e47aeeba21ef461ba.exe
File created	C:\Windows\System\bqulSrx.exe	5a08a8c2dcc04967c811bd833ed77d2e861dc999c11d096e47aeeba21ef461ba.exe
File created	C:\Windows\System\HCZEDgX.exe	5a08a8c2dcc04967c811bd833ed77d2e861dc999c11d096e47aeeba21ef461ba.exe
File created	C:\Windows\System\ijqyGfD.exe	5a08a8c2dcc04967c811bd833ed77d2e861dc999c11d096e47aeeba21ef461ba.exe
File created	C:\Windows\System\PwcOECN.exe	5a08a8c2dcc04967c811bd833ed77d2e861dc999c11d096e47aeeba21ef461ba.exe
File created	C:\Windows\System\dlGQWvW.exe	5a08a8c2dcc04967c811bd833ed77d2e861dc999c11d096e47aeeba21ef461ba.exe
File created	C:\Windows\System\YwctcOh.exe	5a08a8c2dcc04967c811bd833ed77d2e861dc999c11d096e47aeeba21ef461ba.exe
File created	C:\Windows\System\tAfldDd.exe	5a08a8c2dcc04967c811bd833ed77d2e861dc999c11d096e47aeeba21ef461ba.exe
File created	C:\Windows\System\jtZxnXI.exe	5a08a8c2dcc04967c811bd833ed77d2e861dc999c11d096e47aeeba21ef461ba.exe
File created	C:\Windows\System\fEWular.exe	5a08a8c2dcc04967c811bd833ed77d2e861dc999c11d096e47aeeba21ef461ba.exe
File created	C:\Windows\System\TKjRCgE.exe	5a08a8c2dcc04967c811bd833ed77d2e861dc999c11d096e47aeeba21ef461ba.exe
File created	C:\Windows\System\WcZwHRw.exe	5a08a8c2dcc04967c811bd833ed77d2e861dc999c11d096e47aeeba21ef461ba.exe
File created	C:\Windows\System\jztcKPf.exe	5a08a8c2dcc04967c811bd833ed77d2e861dc999c11d096e47aeeba21ef461ba.exe
File created	C:\Windows\System\FBCgHUR.exe	5a08a8c2dcc04967c811bd833ed77d2e861dc999c11d096e47aeeba21ef461ba.exe
File created	C:\Windows\System\mzKRQln.exe	5a08a8c2dcc04967c811bd833ed77d2e861dc999c11d096e47aeeba21ef461ba.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	17376	dwm.exe
Token: SeChangeNotifyPrivilege	17376	dwm.exe
Token: 33	17376	dwm.exe
Token: SeIncBasePriorityPrivilege	17376	dwm.exe
Token: SeShutdownPrivilege	17376	dwm.exe
Token: SeCreatePagefilePrivilege	17376	dwm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4224 wrote to memory of 1196	4224	5a08a8c2dcc04967c811bd833ed77d2e861dc999c11d096e47aeeba21ef461ba.exe	84
PID 4224 wrote to memory of 1196	4224	5a08a8c2dcc04967c811bd833ed77d2e861dc999c11d096e47aeeba21ef461ba.exe	84
PID 4224 wrote to memory of 1808	4224	5a08a8c2dcc04967c811bd833ed77d2e861dc999c11d096e47aeeba21ef461ba.exe	85
PID 4224 wrote to memory of 1808	4224	5a08a8c2dcc04967c811bd833ed77d2e861dc999c11d096e47aeeba21ef461ba.exe	85
PID 4224 wrote to memory of 4340	4224	5a08a8c2dcc04967c811bd833ed77d2e861dc999c11d096e47aeeba21ef461ba.exe	86
PID 4224 wrote to memory of 4340	4224	5a08a8c2dcc04967c811bd833ed77d2e861dc999c11d096e47aeeba21ef461ba.exe	86
PID 4224 wrote to memory of 1828	4224	5a08a8c2dcc04967c811bd833ed77d2e861dc999c11d096e47aeeba21ef461ba.exe	87
PID 4224 wrote to memory of 1828	4224	5a08a8c2dcc04967c811bd833ed77d2e861dc999c11d096e47aeeba21ef461ba.exe	87
PID 4224 wrote to memory of 4908	4224	5a08a8c2dcc04967c811bd833ed77d2e861dc999c11d096e47aeeba21ef461ba.exe	88
PID 4224 wrote to memory of 4908	4224	5a08a8c2dcc04967c811bd833ed77d2e861dc999c11d096e47aeeba21ef461ba.exe	88
PID 4224 wrote to memory of 232	4224	5a08a8c2dcc04967c811bd833ed77d2e861dc999c11d096e47aeeba21ef461ba.exe	89
PID 4224 wrote to memory of 232	4224	5a08a8c2dcc04967c811bd833ed77d2e861dc999c11d096e47aeeba21ef461ba.exe	89
PID 4224 wrote to memory of 3024	4224	5a08a8c2dcc04967c811bd833ed77d2e861dc999c11d096e47aeeba21ef461ba.exe	90
PID 4224 wrote to memory of 3024	4224	5a08a8c2dcc04967c811bd833ed77d2e861dc999c11d096e47aeeba21ef461ba.exe	90
PID 4224 wrote to memory of 4268	4224	5a08a8c2dcc04967c811bd833ed77d2e861dc999c11d096e47aeeba21ef461ba.exe	91
PID 4224 wrote to memory of 4268	4224	5a08a8c2dcc04967c811bd833ed77d2e861dc999c11d096e47aeeba21ef461ba.exe	91
PID 4224 wrote to memory of 2784	4224	5a08a8c2dcc04967c811bd833ed77d2e861dc999c11d096e47aeeba21ef461ba.exe	92
PID 4224 wrote to memory of 2784	4224	5a08a8c2dcc04967c811bd833ed77d2e861dc999c11d096e47aeeba21ef461ba.exe	92
PID 4224 wrote to memory of 1316	4224	5a08a8c2dcc04967c811bd833ed77d2e861dc999c11d096e47aeeba21ef461ba.exe	93
PID 4224 wrote to memory of 1316	4224	5a08a8c2dcc04967c811bd833ed77d2e861dc999c11d096e47aeeba21ef461ba.exe	93
PID 4224 wrote to memory of 4712	4224	5a08a8c2dcc04967c811bd833ed77d2e861dc999c11d096e47aeeba21ef461ba.exe	94
PID 4224 wrote to memory of 4712	4224	5a08a8c2dcc04967c811bd833ed77d2e861dc999c11d096e47aeeba21ef461ba.exe	94
PID 4224 wrote to memory of 3524	4224	5a08a8c2dcc04967c811bd833ed77d2e861dc999c11d096e47aeeba21ef461ba.exe	95
PID 4224 wrote to memory of 3524	4224	5a08a8c2dcc04967c811bd833ed77d2e861dc999c11d096e47aeeba21ef461ba.exe	95
PID 4224 wrote to memory of 864	4224	5a08a8c2dcc04967c811bd833ed77d2e861dc999c11d096e47aeeba21ef461ba.exe	96
PID 4224 wrote to memory of 864	4224	5a08a8c2dcc04967c811bd833ed77d2e861dc999c11d096e47aeeba21ef461ba.exe	96
PID 4224 wrote to memory of 3948	4224	5a08a8c2dcc04967c811bd833ed77d2e861dc999c11d096e47aeeba21ef461ba.exe	97
PID 4224 wrote to memory of 3948	4224	5a08a8c2dcc04967c811bd833ed77d2e861dc999c11d096e47aeeba21ef461ba.exe	97
PID 4224 wrote to memory of 1532	4224	5a08a8c2dcc04967c811bd833ed77d2e861dc999c11d096e47aeeba21ef461ba.exe	98
PID 4224 wrote to memory of 1532	4224	5a08a8c2dcc04967c811bd833ed77d2e861dc999c11d096e47aeeba21ef461ba.exe	98
PID 4224 wrote to memory of 2660	4224	5a08a8c2dcc04967c811bd833ed77d2e861dc999c11d096e47aeeba21ef461ba.exe	99
PID 4224 wrote to memory of 2660	4224	5a08a8c2dcc04967c811bd833ed77d2e861dc999c11d096e47aeeba21ef461ba.exe	99
PID 4224 wrote to memory of 2456	4224	5a08a8c2dcc04967c811bd833ed77d2e861dc999c11d096e47aeeba21ef461ba.exe	100
PID 4224 wrote to memory of 2456	4224	5a08a8c2dcc04967c811bd833ed77d2e861dc999c11d096e47aeeba21ef461ba.exe	100
PID 4224 wrote to memory of 1284	4224	5a08a8c2dcc04967c811bd833ed77d2e861dc999c11d096e47aeeba21ef461ba.exe	101
PID 4224 wrote to memory of 1284	4224	5a08a8c2dcc04967c811bd833ed77d2e861dc999c11d096e47aeeba21ef461ba.exe	101
PID 4224 wrote to memory of 4020	4224	5a08a8c2dcc04967c811bd833ed77d2e861dc999c11d096e47aeeba21ef461ba.exe	102
PID 4224 wrote to memory of 4020	4224	5a08a8c2dcc04967c811bd833ed77d2e861dc999c11d096e47aeeba21ef461ba.exe	102
PID 4224 wrote to memory of 5008	4224	5a08a8c2dcc04967c811bd833ed77d2e861dc999c11d096e47aeeba21ef461ba.exe	103
PID 4224 wrote to memory of 5008	4224	5a08a8c2dcc04967c811bd833ed77d2e861dc999c11d096e47aeeba21ef461ba.exe	103
PID 4224 wrote to memory of 2028	4224	5a08a8c2dcc04967c811bd833ed77d2e861dc999c11d096e47aeeba21ef461ba.exe	104
PID 4224 wrote to memory of 2028	4224	5a08a8c2dcc04967c811bd833ed77d2e861dc999c11d096e47aeeba21ef461ba.exe	104
PID 4224 wrote to memory of 5028	4224	5a08a8c2dcc04967c811bd833ed77d2e861dc999c11d096e47aeeba21ef461ba.exe	105
PID 4224 wrote to memory of 5028	4224	5a08a8c2dcc04967c811bd833ed77d2e861dc999c11d096e47aeeba21ef461ba.exe	105
PID 4224 wrote to memory of 2780	4224	5a08a8c2dcc04967c811bd833ed77d2e861dc999c11d096e47aeeba21ef461ba.exe	106
PID 4224 wrote to memory of 2780	4224	5a08a8c2dcc04967c811bd833ed77d2e861dc999c11d096e47aeeba21ef461ba.exe	106
PID 4224 wrote to memory of 2420	4224	5a08a8c2dcc04967c811bd833ed77d2e861dc999c11d096e47aeeba21ef461ba.exe	107
PID 4224 wrote to memory of 2420	4224	5a08a8c2dcc04967c811bd833ed77d2e861dc999c11d096e47aeeba21ef461ba.exe	107
PID 4224 wrote to memory of 3724	4224	5a08a8c2dcc04967c811bd833ed77d2e861dc999c11d096e47aeeba21ef461ba.exe	108
PID 4224 wrote to memory of 3724	4224	5a08a8c2dcc04967c811bd833ed77d2e861dc999c11d096e47aeeba21ef461ba.exe	108
PID 4224 wrote to memory of 4836	4224	5a08a8c2dcc04967c811bd833ed77d2e861dc999c11d096e47aeeba21ef461ba.exe	109
PID 4224 wrote to memory of 4836	4224	5a08a8c2dcc04967c811bd833ed77d2e861dc999c11d096e47aeeba21ef461ba.exe	109
PID 4224 wrote to memory of 4628	4224	5a08a8c2dcc04967c811bd833ed77d2e861dc999c11d096e47aeeba21ef461ba.exe	110
PID 4224 wrote to memory of 4628	4224	5a08a8c2dcc04967c811bd833ed77d2e861dc999c11d096e47aeeba21ef461ba.exe	110
PID 4224 wrote to memory of 4352	4224	5a08a8c2dcc04967c811bd833ed77d2e861dc999c11d096e47aeeba21ef461ba.exe	111
PID 4224 wrote to memory of 4352	4224	5a08a8c2dcc04967c811bd833ed77d2e861dc999c11d096e47aeeba21ef461ba.exe	111
PID 4224 wrote to memory of 1372	4224	5a08a8c2dcc04967c811bd833ed77d2e861dc999c11d096e47aeeba21ef461ba.exe	112
PID 4224 wrote to memory of 1372	4224	5a08a8c2dcc04967c811bd833ed77d2e861dc999c11d096e47aeeba21ef461ba.exe	112
PID 4224 wrote to memory of 2932	4224	5a08a8c2dcc04967c811bd833ed77d2e861dc999c11d096e47aeeba21ef461ba.exe	113
PID 4224 wrote to memory of 2932	4224	5a08a8c2dcc04967c811bd833ed77d2e861dc999c11d096e47aeeba21ef461ba.exe	113
PID 4224 wrote to memory of 4772	4224	5a08a8c2dcc04967c811bd833ed77d2e861dc999c11d096e47aeeba21ef461ba.exe	114
PID 4224 wrote to memory of 4772	4224	5a08a8c2dcc04967c811bd833ed77d2e861dc999c11d096e47aeeba21ef461ba.exe	114
PID 4224 wrote to memory of 2364	4224	5a08a8c2dcc04967c811bd833ed77d2e861dc999c11d096e47aeeba21ef461ba.exe	115
PID 4224 wrote to memory of 2364	4224	5a08a8c2dcc04967c811bd833ed77d2e861dc999c11d096e47aeeba21ef461ba.exe	115

C:\Users\Admin\AppData\Local\Temp\5a08a8c2dcc04967c811bd833ed77d2e861dc999c11d096e47aeeba21ef461ba.exe
"C:\Users\Admin\AppData\Local\Temp\5a08a8c2dcc04967c811bd833ed77d2e861dc999c11d096e47aeeba21ef461ba.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4224
- C:\Windows\System\PtBKKzR.exe
  C:\Windows\System\PtBKKzR.exe
  2⤵
  - Executes dropped EXE
  PID:1196
- C:\Windows\System\WbLHAVi.exe
  C:\Windows\System\WbLHAVi.exe
  2⤵
  - Executes dropped EXE
  PID:1808
- C:\Windows\System\YqZdMhX.exe
  C:\Windows\System\YqZdMhX.exe
  2⤵
  - Executes dropped EXE
  PID:4340
- C:\Windows\System\lMevLql.exe
  C:\Windows\System\lMevLql.exe
  2⤵
  - Executes dropped EXE
  PID:1828
- C:\Windows\System\GBSKoIP.exe
  C:\Windows\System\GBSKoIP.exe
  2⤵
  - Executes dropped EXE
  PID:4908
- C:\Windows\System\xNHCCKh.exe
  C:\Windows\System\xNHCCKh.exe
  2⤵
  - Executes dropped EXE
  PID:232
- C:\Windows\System\AdzcelM.exe
  C:\Windows\System\AdzcelM.exe
  2⤵
  - Executes dropped EXE
  PID:3024
- C:\Windows\System\iFHcEOo.exe
  C:\Windows\System\iFHcEOo.exe
  2⤵
  - Executes dropped EXE
  PID:4268
- C:\Windows\System\CRuDiyg.exe
  C:\Windows\System\CRuDiyg.exe
  2⤵
  - Executes dropped EXE
  PID:2784
- C:\Windows\System\qcBqYeF.exe
  C:\Windows\System\qcBqYeF.exe
  2⤵
  - Executes dropped EXE
  PID:1316
- C:\Windows\System\AhKiktS.exe
  C:\Windows\System\AhKiktS.exe
  2⤵
  - Executes dropped EXE
  PID:4712
- C:\Windows\System\eBWGgfz.exe
  C:\Windows\System\eBWGgfz.exe
  2⤵
  - Executes dropped EXE
  PID:3524
- C:\Windows\System\xQKOule.exe
  C:\Windows\System\xQKOule.exe
  2⤵
  - Executes dropped EXE
  PID:864
- C:\Windows\System\DDZjjkK.exe
  C:\Windows\System\DDZjjkK.exe
  2⤵
  - Executes dropped EXE
  PID:3948
- C:\Windows\System\RMnuThZ.exe
  C:\Windows\System\RMnuThZ.exe
  2⤵
  - Executes dropped EXE
  PID:1532
- C:\Windows\System\QYJwRxX.exe
  C:\Windows\System\QYJwRxX.exe
  2⤵
  - Executes dropped EXE
  PID:2660
- C:\Windows\System\ZAMqXBp.exe
  C:\Windows\System\ZAMqXBp.exe
  2⤵
  - Executes dropped EXE
  PID:2456
- C:\Windows\System\UyAxQOJ.exe
  C:\Windows\System\UyAxQOJ.exe
  2⤵
  - Executes dropped EXE
  PID:1284
- C:\Windows\System\WTUiPDd.exe
  C:\Windows\System\WTUiPDd.exe
  2⤵
  - Executes dropped EXE
  PID:4020
- C:\Windows\System\ykBUScl.exe
  C:\Windows\System\ykBUScl.exe
  2⤵
  - Executes dropped EXE
  PID:5008
- C:\Windows\System\dRInWkx.exe
  C:\Windows\System\dRInWkx.exe
  2⤵
  - Executes dropped EXE
  PID:2028
- C:\Windows\System\XpFvqwa.exe
  C:\Windows\System\XpFvqwa.exe
  2⤵
  - Executes dropped EXE
  PID:5028
- C:\Windows\System\kvXGntF.exe
  C:\Windows\System\kvXGntF.exe
  2⤵
  - Executes dropped EXE
  PID:2780
- C:\Windows\System\KRafFgt.exe
  C:\Windows\System\KRafFgt.exe
  2⤵
  - Executes dropped EXE
  PID:2420
- C:\Windows\System\HvaqLwh.exe
  C:\Windows\System\HvaqLwh.exe
  2⤵
  - Executes dropped EXE
  PID:3724
- C:\Windows\System\LLuLPNN.exe
  C:\Windows\System\LLuLPNN.exe
  2⤵
  - Executes dropped EXE
  PID:4836
- C:\Windows\System\cVXalLp.exe
  C:\Windows\System\cVXalLp.exe
  2⤵
  - Executes dropped EXE
  PID:4628
- C:\Windows\System\AeYxBAM.exe
  C:\Windows\System\AeYxBAM.exe
  2⤵
  - Executes dropped EXE
  PID:4352
- C:\Windows\System\WkJzoQX.exe
  C:\Windows\System\WkJzoQX.exe
  2⤵
  - Executes dropped EXE
  PID:1372
- C:\Windows\System\wstlWBV.exe
  C:\Windows\System\wstlWBV.exe
  2⤵
  - Executes dropped EXE
  PID:2932
- C:\Windows\System\msLcowq.exe
  C:\Windows\System\msLcowq.exe
  2⤵
  - Executes dropped EXE
  PID:4772
- C:\Windows\System\KZyhcbM.exe
  C:\Windows\System\KZyhcbM.exe
  2⤵
  - Executes dropped EXE
  PID:2364
- C:\Windows\System\gxQVzdo.exe
  C:\Windows\System\gxQVzdo.exe
  2⤵
  - Executes dropped EXE
  PID:3328
- C:\Windows\System\YfjQUfR.exe
  C:\Windows\System\YfjQUfR.exe
  2⤵
  - Executes dropped EXE
  PID:3372
- C:\Windows\System\dxVjbgg.exe
  C:\Windows\System\dxVjbgg.exe
  2⤵
  - Executes dropped EXE
  PID:1104
- C:\Windows\System\LkbcJTi.exe
  C:\Windows\System\LkbcJTi.exe
  2⤵
  - Executes dropped EXE
  PID:528
- C:\Windows\System\BeJdHue.exe
  C:\Windows\System\BeJdHue.exe
  2⤵
  - Executes dropped EXE
  PID:2132
- C:\Windows\System\klWzbjs.exe
  C:\Windows\System\klWzbjs.exe
  2⤵
  - Executes dropped EXE
  PID:776
- C:\Windows\System\nVRQWFr.exe
  C:\Windows\System\nVRQWFr.exe
  2⤵
  - Executes dropped EXE
  PID:3456
- C:\Windows\System\whTzcBT.exe
  C:\Windows\System\whTzcBT.exe
  2⤵
  - Executes dropped EXE
  PID:3832
- C:\Windows\System\LTawzBY.exe
  C:\Windows\System\LTawzBY.exe
  2⤵
  - Executes dropped EXE
  PID:4304
- C:\Windows\System\IyOoVBQ.exe
  C:\Windows\System\IyOoVBQ.exe
  2⤵
  - Executes dropped EXE
  PID:4276
- C:\Windows\System\aHXBmVj.exe
  C:\Windows\System\aHXBmVj.exe
  2⤵
  - Executes dropped EXE
  PID:840
- C:\Windows\System\WLjxLXd.exe
  C:\Windows\System\WLjxLXd.exe
  2⤵
  - Executes dropped EXE
  PID:1072
- C:\Windows\System\SDzBomM.exe
  C:\Windows\System\SDzBomM.exe
  2⤵
  - Executes dropped EXE
  PID:2936
- C:\Windows\System\MYqxBhT.exe
  C:\Windows\System\MYqxBhT.exe
  2⤵
  - Executes dropped EXE
  PID:4504
- C:\Windows\System\yJMSNdL.exe
  C:\Windows\System\yJMSNdL.exe
  2⤵
  - Executes dropped EXE
  PID:1420
- C:\Windows\System\EirFstu.exe
  C:\Windows\System\EirFstu.exe
  2⤵
  - Executes dropped EXE
  PID:1984
- C:\Windows\System\XnKovoE.exe
  C:\Windows\System\XnKovoE.exe
  2⤵
  - Executes dropped EXE
  PID:4996
- C:\Windows\System\BHDwxtz.exe
  C:\Windows\System\BHDwxtz.exe
  2⤵
  - Executes dropped EXE
  PID:228
- C:\Windows\System\ubgvcdL.exe
  C:\Windows\System\ubgvcdL.exe
  2⤵
  - Executes dropped EXE
  PID:100
- C:\Windows\System\FYydbam.exe
  C:\Windows\System\FYydbam.exe
  2⤵
  - Executes dropped EXE
  PID:4408
- C:\Windows\System\VGkAXrF.exe
  C:\Windows\System\VGkAXrF.exe
  2⤵
  - Executes dropped EXE
  PID:1560
- C:\Windows\System\ODHPNdE.exe
  C:\Windows\System\ODHPNdE.exe
  2⤵
  - Executes dropped EXE
  PID:1116
- C:\Windows\System\aHqGAmO.exe
  C:\Windows\System\aHqGAmO.exe
  2⤵
  - Executes dropped EXE
  PID:4696
- C:\Windows\System\PiCwCRP.exe
  C:\Windows\System\PiCwCRP.exe
  2⤵
  - Executes dropped EXE
  PID:2776
- C:\Windows\System\JGlhPql.exe
  C:\Windows\System\JGlhPql.exe
  2⤵
  - Executes dropped EXE
  PID:4612
- C:\Windows\System\EDfxuwz.exe
  C:\Windows\System\EDfxuwz.exe
  2⤵
  - Executes dropped EXE
  PID:4688
- C:\Windows\System\xCXLgrh.exe
  C:\Windows\System\xCXLgrh.exe
  2⤵
  - Executes dropped EXE
  PID:1320
- C:\Windows\System\RVByfzy.exe
  C:\Windows\System\RVByfzy.exe
  2⤵
  - Executes dropped EXE
  PID:4360
- C:\Windows\System\lMcEuTl.exe
  C:\Windows\System\lMcEuTl.exe
  2⤵
  - Executes dropped EXE
  PID:4880
- C:\Windows\System\QxYONjY.exe
  C:\Windows\System\QxYONjY.exe
  2⤵
  - Executes dropped EXE
  PID:1160
- C:\Windows\System\bQLLQoo.exe
  C:\Windows\System\bQLLQoo.exe
  2⤵
  - Executes dropped EXE
  PID:368
- C:\Windows\System\LSVVhcQ.exe
  C:\Windows\System\LSVVhcQ.exe
  2⤵
  - Executes dropped EXE
  PID:1604
- C:\Windows\System\LzCIrZf.exe
  C:\Windows\System\LzCIrZf.exe
  2⤵
  PID:396
- C:\Windows\System\JdzrQhh.exe
  C:\Windows\System\JdzrQhh.exe
  2⤵
  PID:4832
- C:\Windows\System\odADRgq.exe
  C:\Windows\System\odADRgq.exe
  2⤵
  PID:1428
- C:\Windows\System\yELURlC.exe
  C:\Windows\System\yELURlC.exe
  2⤵
  PID:2060
- C:\Windows\System\VfTBvMQ.exe
  C:\Windows\System\VfTBvMQ.exe
  2⤵
  PID:1824
- C:\Windows\System\RXYSiRi.exe
  C:\Windows\System\RXYSiRi.exe
  2⤵
  PID:4524
- C:\Windows\System\WQVfjSZ.exe
  C:\Windows\System\WQVfjSZ.exe
  2⤵
  PID:544
- C:\Windows\System\SGxCQFg.exe
  C:\Windows\System\SGxCQFg.exe
  2⤵
  PID:2232
- C:\Windows\System\IpupYqN.exe
  C:\Windows\System\IpupYqN.exe
  2⤵
  PID:4916
- C:\Windows\System\pxwUaGP.exe
  C:\Windows\System\pxwUaGP.exe
  2⤵
  PID:4684
- C:\Windows\System\xRiGVAm.exe
  C:\Windows\System\xRiGVAm.exe
  2⤵
  PID:1256
- C:\Windows\System\izzXrYt.exe
  C:\Windows\System\izzXrYt.exe
  2⤵
  PID:3896
- C:\Windows\System\BUOmoiG.exe
  C:\Windows\System\BUOmoiG.exe
  2⤵
  PID:3808
- C:\Windows\System\PdvavpA.exe
  C:\Windows\System\PdvavpA.exe
  2⤵
  PID:2252
- C:\Windows\System\zimDCbz.exe
  C:\Windows\System\zimDCbz.exe
  2⤵
  PID:4364
- C:\Windows\System\LCmCPiG.exe
  C:\Windows\System\LCmCPiG.exe
  2⤵
  PID:4004
- C:\Windows\System\geJYTFc.exe
  C:\Windows\System\geJYTFc.exe
  2⤵
  PID:2868
- C:\Windows\System\mXYzrjM.exe
  C:\Windows\System\mXYzrjM.exe
  2⤵
  PID:1680
- C:\Windows\System\biqJOYP.exe
  C:\Windows\System\biqJOYP.exe
  2⤵
  PID:4508
- C:\Windows\System\YWsUgnU.exe
  C:\Windows\System\YWsUgnU.exe
  2⤵
  PID:4692
- C:\Windows\System\fFEzkva.exe
  C:\Windows\System\fFEzkva.exe
  2⤵
  PID:3116
- C:\Windows\System\VGOclKD.exe
  C:\Windows\System\VGOclKD.exe
  2⤵
  PID:2072
- C:\Windows\System\WTWDYWj.exe
  C:\Windows\System\WTWDYWj.exe
  2⤵
  PID:1404
- C:\Windows\System\VxkLVBp.exe
  C:\Windows\System\VxkLVBp.exe
  2⤵
  PID:3596
- C:\Windows\System\YYCxQQP.exe
  C:\Windows\System\YYCxQQP.exe
  2⤵
  PID:552
- C:\Windows\System\eUvRqzR.exe
  C:\Windows\System\eUvRqzR.exe
  2⤵
  PID:3212
- C:\Windows\System\ORsuCbu.exe
  C:\Windows\System\ORsuCbu.exe
  2⤵
  PID:4204
- C:\Windows\System\EEGrgVg.exe
  C:\Windows\System\EEGrgVg.exe
  2⤵
  PID:2872
- C:\Windows\System\hGlqeDp.exe
  C:\Windows\System\hGlqeDp.exe
  2⤵
  PID:1996
- C:\Windows\System\YsxRSqh.exe
  C:\Windows\System\YsxRSqh.exe
  2⤵
  PID:4436
- C:\Windows\System\naxqvgk.exe
  C:\Windows\System\naxqvgk.exe
  2⤵
  PID:1528
- C:\Windows\System\oguutZb.exe
  C:\Windows\System\oguutZb.exe
  2⤵
  PID:4200
- C:\Windows\System\jtDSQCx.exe
  C:\Windows\System\jtDSQCx.exe
  2⤵
  PID:1976
- C:\Windows\System\QgKfCXM.exe
  C:\Windows\System\QgKfCXM.exe
  2⤵
  PID:3156
- C:\Windows\System\ZGjgpnj.exe
  C:\Windows\System\ZGjgpnj.exe
  2⤵
  PID:1216
- C:\Windows\System\jaeobgy.exe
  C:\Windows\System\jaeobgy.exe
  2⤵
  PID:1636
- C:\Windows\System\PByVBAh.exe
  C:\Windows\System\PByVBAh.exe
  2⤵
  PID:616
- C:\Windows\System\PMFKXln.exe
  C:\Windows\System\PMFKXln.exe
  2⤵
  PID:5156
- C:\Windows\System\WkbUiHI.exe
  C:\Windows\System\WkbUiHI.exe
  2⤵
  PID:5192
- C:\Windows\System\QqABpUz.exe
  C:\Windows\System\QqABpUz.exe
  2⤵
  PID:5212
- C:\Windows\System\aTNCLqe.exe
  C:\Windows\System\aTNCLqe.exe
  2⤵
  PID:5244
- C:\Windows\System\isiAvzH.exe
  C:\Windows\System\isiAvzH.exe
  2⤵
  PID:5268
- C:\Windows\System\ddIIWJw.exe
  C:\Windows\System\ddIIWJw.exe
  2⤵
  PID:5300
- C:\Windows\System\EJcvZdM.exe
  C:\Windows\System\EJcvZdM.exe
  2⤵
  PID:5336
- C:\Windows\System\jailTjp.exe
  C:\Windows\System\jailTjp.exe
  2⤵
  PID:5376
- C:\Windows\System\GXNZXbu.exe
  C:\Windows\System\GXNZXbu.exe
  2⤵
  PID:5396
- C:\Windows\System\jloxQRg.exe
  C:\Windows\System\jloxQRg.exe
  2⤵
  PID:5432
- C:\Windows\System\FltZCcm.exe
  C:\Windows\System\FltZCcm.exe
  2⤵
  PID:5452
- C:\Windows\System\cXBpIrh.exe
  C:\Windows\System\cXBpIrh.exe
  2⤵
  PID:5504
- C:\Windows\System\IKSqeir.exe
  C:\Windows\System\IKSqeir.exe
  2⤵
  PID:5528
- C:\Windows\System\XRNiIKA.exe
  C:\Windows\System\XRNiIKA.exe
  2⤵
  PID:5556
- C:\Windows\System\aNmrSAl.exe
  C:\Windows\System\aNmrSAl.exe
  2⤵
  PID:5588
- C:\Windows\System\FmxRgok.exe
  C:\Windows\System\FmxRgok.exe
  2⤵
  PID:5628
- C:\Windows\System\fntmxGf.exe
  C:\Windows\System\fntmxGf.exe
  2⤵
  PID:5648
- C:\Windows\System\FrpnsEV.exe
  C:\Windows\System\FrpnsEV.exe
  2⤵
  PID:5668
- C:\Windows\System\RxLILNX.exe
  C:\Windows\System\RxLILNX.exe
  2⤵
  PID:5692
- C:\Windows\System\EbBQHjo.exe
  C:\Windows\System\EbBQHjo.exe
  2⤵
  PID:5732
- C:\Windows\System\WlkBIsZ.exe
  C:\Windows\System\WlkBIsZ.exe
  2⤵
  PID:5760
- C:\Windows\System\FbGVwdl.exe
  C:\Windows\System\FbGVwdl.exe
  2⤵
  PID:5780
- C:\Windows\System\KjLFFtq.exe
  C:\Windows\System\KjLFFtq.exe
  2⤵
  PID:5816
- C:\Windows\System\RRIvGSm.exe
  C:\Windows\System\RRIvGSm.exe
  2⤵
  PID:5864
- C:\Windows\System\xgDDHZM.exe
  C:\Windows\System\xgDDHZM.exe
  2⤵
  PID:5880
- C:\Windows\System\vkXDDjI.exe
  C:\Windows\System\vkXDDjI.exe
  2⤵
  PID:5908
- C:\Windows\System\qGRjCYM.exe
  C:\Windows\System\qGRjCYM.exe
  2⤵
  PID:5924
- C:\Windows\System\VNuLcAP.exe
  C:\Windows\System\VNuLcAP.exe
  2⤵
  PID:5956
- C:\Windows\System\RlgxaZL.exe
  C:\Windows\System\RlgxaZL.exe
  2⤵
  PID:5980
- C:\Windows\System\oJlIAyg.exe
  C:\Windows\System\oJlIAyg.exe
  2⤵
  PID:6008
- C:\Windows\System\GInvvah.exe
  C:\Windows\System\GInvvah.exe
  2⤵
  PID:6028
- C:\Windows\System\NDBWxnQ.exe
  C:\Windows\System\NDBWxnQ.exe
  2⤵
  PID:6064
- C:\Windows\System\bUIoDis.exe
  C:\Windows\System\bUIoDis.exe
  2⤵
  PID:6080
- C:\Windows\System\WTbjxBz.exe
  C:\Windows\System\WTbjxBz.exe
  2⤵
  PID:6116
- C:\Windows\System\SVUTbJf.exe
  C:\Windows\System\SVUTbJf.exe
  2⤵
  PID:6136
- C:\Windows\System\sptIOFM.exe
  C:\Windows\System\sptIOFM.exe
  2⤵
  PID:5180
- C:\Windows\System\ZAFugWA.exe
  C:\Windows\System\ZAFugWA.exe
  2⤵
  PID:5288
- C:\Windows\System\PwcOECN.exe
  C:\Windows\System\PwcOECN.exe
  2⤵
  PID:5360
- C:\Windows\System\GUXNbvs.exe
  C:\Windows\System\GUXNbvs.exe
  2⤵
  PID:5448
- C:\Windows\System\iZUJtlr.exe
  C:\Windows\System\iZUJtlr.exe
  2⤵
  PID:3736
- C:\Windows\System\rkGPvAc.exe
  C:\Windows\System\rkGPvAc.exe
  2⤵
  PID:5552
- C:\Windows\System\LVoBfrO.exe
  C:\Windows\System\LVoBfrO.exe
  2⤵
  PID:5636
- C:\Windows\System\vmwoIkw.exe
  C:\Windows\System\vmwoIkw.exe
  2⤵
  PID:5684
- C:\Windows\System\EQqnsng.exe
  C:\Windows\System\EQqnsng.exe
  2⤵
  PID:5752
- C:\Windows\System\VZWcBfj.exe
  C:\Windows\System\VZWcBfj.exe
  2⤵
  PID:5824
- C:\Windows\System\MTaKbWQ.exe
  C:\Windows\System\MTaKbWQ.exe
  2⤵
  PID:5896
- C:\Windows\System\EYSgsou.exe
  C:\Windows\System\EYSgsou.exe
  2⤵
  PID:5996
- C:\Windows\System\pGOfguP.exe
  C:\Windows\System\pGOfguP.exe
  2⤵
  PID:6036
- C:\Windows\System\hwyShBB.exe
  C:\Windows\System\hwyShBB.exe
  2⤵
  PID:6092
- C:\Windows\System\izsIaIr.exe
  C:\Windows\System\izsIaIr.exe
  2⤵
  PID:5224
- C:\Windows\System\sPUvDVR.exe
  C:\Windows\System\sPUvDVR.exe
  2⤵
  PID:5384
- C:\Windows\System\QoGNKOX.exe
  C:\Windows\System\QoGNKOX.exe
  2⤵
  PID:3740
- C:\Windows\System\fyNeMRo.exe
  C:\Windows\System\fyNeMRo.exe
  2⤵
  PID:5676
- C:\Windows\System\EIvCiQk.exe
  C:\Windows\System\EIvCiQk.exe
  2⤵
  PID:5796
- C:\Windows\System\nzPGtbV.exe
  C:\Windows\System\nzPGtbV.exe
  2⤵
  PID:5940
- C:\Windows\System\tfgwaqm.exe
  C:\Windows\System\tfgwaqm.exe
  2⤵
  PID:6072
- C:\Windows\System\THQTCQW.exe
  C:\Windows\System\THQTCQW.exe
  2⤵
  PID:4620
- C:\Windows\System\iZzwqbE.exe
  C:\Windows\System\iZzwqbE.exe
  2⤵
  PID:5792
- C:\Windows\System\qZDRcyV.exe
  C:\Windows\System\qZDRcyV.exe
  2⤵
  PID:5420
- C:\Windows\System\pdJrWkA.exe
  C:\Windows\System\pdJrWkA.exe
  2⤵
  PID:5660
- C:\Windows\System\MXupSTG.exe
  C:\Windows\System\MXupSTG.exe
  2⤵
  PID:6160
- C:\Windows\System\RCbZRlW.exe
  C:\Windows\System\RCbZRlW.exe
  2⤵
  PID:6188
- C:\Windows\System\OFcZuYA.exe
  C:\Windows\System\OFcZuYA.exe
  2⤵
  PID:6216
- C:\Windows\System\pSuYCxT.exe
  C:\Windows\System\pSuYCxT.exe
  2⤵
  PID:6252
- C:\Windows\System\EADicdg.exe
  C:\Windows\System\EADicdg.exe
  2⤵
  PID:6284
- C:\Windows\System\EDIcKbj.exe
  C:\Windows\System\EDIcKbj.exe
  2⤵
  PID:6308
- C:\Windows\System\ksiNVEC.exe
  C:\Windows\System\ksiNVEC.exe
  2⤵
  PID:6340
- C:\Windows\System\QzIlvSG.exe
  C:\Windows\System\QzIlvSG.exe
  2⤵
  PID:6360
- C:\Windows\System\UcoPkte.exe
  C:\Windows\System\UcoPkte.exe
  2⤵
  PID:6396
- C:\Windows\System\ZRONAmu.exe
  C:\Windows\System\ZRONAmu.exe
  2⤵
  PID:6428
- C:\Windows\System\cqclTuc.exe
  C:\Windows\System\cqclTuc.exe
  2⤵
  PID:6456
- C:\Windows\System\siuMtWZ.exe
  C:\Windows\System\siuMtWZ.exe
  2⤵
  PID:6484
- C:\Windows\System\KhbiGIT.exe
  C:\Windows\System\KhbiGIT.exe
  2⤵
  PID:6512
- C:\Windows\System\HaUSVUe.exe
  C:\Windows\System\HaUSVUe.exe
  2⤵
  PID:6528
- C:\Windows\System\rCXRuQi.exe
  C:\Windows\System\rCXRuQi.exe
  2⤵
  PID:6556
- C:\Windows\System\ULzHxcM.exe
  C:\Windows\System\ULzHxcM.exe
  2⤵
  PID:6584
- C:\Windows\System\HQbvdDt.exe
  C:\Windows\System\HQbvdDt.exe
  2⤵
  PID:6600
- C:\Windows\System\tprLaEm.exe
  C:\Windows\System\tprLaEm.exe
  2⤵
  PID:6632
- C:\Windows\System\OByfqod.exe
  C:\Windows\System\OByfqod.exe
  2⤵
  PID:6660
- C:\Windows\System\xVMOAlK.exe
  C:\Windows\System\xVMOAlK.exe
  2⤵
  PID:6704
- C:\Windows\System\TCgnlMp.exe
  C:\Windows\System\TCgnlMp.exe
  2⤵
  PID:6724
- C:\Windows\System\aErZALZ.exe
  C:\Windows\System\aErZALZ.exe
  2⤵
  PID:6740
- C:\Windows\System\JqhvzNv.exe
  C:\Windows\System\JqhvzNv.exe
  2⤵
  PID:6768
- C:\Windows\System\NkRNvit.exe
  C:\Windows\System\NkRNvit.exe
  2⤵
  PID:6796
- C:\Windows\System\FMHcJES.exe
  C:\Windows\System\FMHcJES.exe
  2⤵
  PID:6828
- C:\Windows\System\ZLNmEXg.exe
  C:\Windows\System\ZLNmEXg.exe
  2⤵
  PID:6860
- C:\Windows\System\OaosLpw.exe
  C:\Windows\System\OaosLpw.exe
  2⤵
  PID:6888
- C:\Windows\System\WcZwHRw.exe
  C:\Windows\System\WcZwHRw.exe
  2⤵
  PID:6924
- C:\Windows\System\xQuFaxv.exe
  C:\Windows\System\xQuFaxv.exe
  2⤵
  PID:6952
- C:\Windows\System\yVzkvIP.exe
  C:\Windows\System\yVzkvIP.exe
  2⤵
  PID:6980
- C:\Windows\System\XdIokDM.exe
  C:\Windows\System\XdIokDM.exe
  2⤵
  PID:7008
- C:\Windows\System\CDnHeWk.exe
  C:\Windows\System\CDnHeWk.exe
  2⤵
  PID:7036
- C:\Windows\System\NLYisdV.exe
  C:\Windows\System\NLYisdV.exe
  2⤵
  PID:7076
- C:\Windows\System\gMEcuRv.exe
  C:\Windows\System\gMEcuRv.exe
  2⤵
  PID:7104
- C:\Windows\System\cBfCaFS.exe
  C:\Windows\System\cBfCaFS.exe
  2⤵
  PID:7120
- C:\Windows\System\SRhPBGx.exe
  C:\Windows\System\SRhPBGx.exe
  2⤵
  PID:7148
- C:\Windows\System\XuFDkas.exe
  C:\Windows\System\XuFDkas.exe
  2⤵
  PID:6172
- C:\Windows\System\ZKUIESL.exe
  C:\Windows\System\ZKUIESL.exe
  2⤵
  PID:6208
- C:\Windows\System\ivpLoMW.exe
  C:\Windows\System\ivpLoMW.exe
  2⤵
  PID:6236
- C:\Windows\System\rtEUUSs.exe
  C:\Windows\System\rtEUUSs.exe
  2⤵
  PID:6332
- C:\Windows\System\mhniDiV.exe
  C:\Windows\System\mhniDiV.exe
  2⤵
  PID:6420
- C:\Windows\System\JCTRqgg.exe
  C:\Windows\System\JCTRqgg.exe
  2⤵
  PID:6468
- C:\Windows\System\vqPQYBe.exe
  C:\Windows\System\vqPQYBe.exe
  2⤵
  PID:6520
- C:\Windows\System\IpUQFLj.exe
  C:\Windows\System\IpUQFLj.exe
  2⤵
  PID:6568
- C:\Windows\System\EScAYye.exe
  C:\Windows\System\EScAYye.exe
  2⤵
  PID:6656
- C:\Windows\System\eoOIMdD.exe
  C:\Windows\System\eoOIMdD.exe
  2⤵
  PID:6712
- C:\Windows\System\XsfETxF.exe
  C:\Windows\System\XsfETxF.exe
  2⤵
  PID:6788
- C:\Windows\System\UGSIGwq.exe
  C:\Windows\System\UGSIGwq.exe
  2⤵
  PID:6856
- C:\Windows\System\dyetWkC.exe
  C:\Windows\System\dyetWkC.exe
  2⤵
  PID:6912
- C:\Windows\System\GKXvOge.exe
  C:\Windows\System\GKXvOge.exe
  2⤵
  PID:6964
- C:\Windows\System\HPUSQst.exe
  C:\Windows\System\HPUSQst.exe
  2⤵
  PID:7056
- C:\Windows\System\kGGdvab.exe
  C:\Windows\System\kGGdvab.exe
  2⤵
  PID:7100
- C:\Windows\System\tqCRSHC.exe
  C:\Windows\System\tqCRSHC.exe
  2⤵
  PID:5176
- C:\Windows\System\xkeLRcQ.exe
  C:\Windows\System\xkeLRcQ.exe
  2⤵
  PID:6224
- C:\Windows\System\gzmuoqd.exe
  C:\Windows\System\gzmuoqd.exe
  2⤵
  PID:6392
- C:\Windows\System\XpyLxSd.exe
  C:\Windows\System\XpyLxSd.exe
  2⤵
  PID:6620
- C:\Windows\System\sHQDQDL.exe
  C:\Windows\System\sHQDQDL.exe
  2⤵
  PID:6756
- C:\Windows\System\mEgZNwR.exe
  C:\Windows\System\mEgZNwR.exe
  2⤵
  PID:6904
- C:\Windows\System\lewSVEv.exe
  C:\Windows\System\lewSVEv.exe
  2⤵
  PID:7000
- C:\Windows\System\yhzlxZH.exe
  C:\Windows\System\yhzlxZH.exe
  2⤵
  PID:216
- C:\Windows\System\YfjKXlR.exe
  C:\Windows\System\YfjKXlR.exe
  2⤵
  PID:6356
- C:\Windows\System\YYBwKHp.exe
  C:\Windows\System\YYBwKHp.exe
  2⤵
  PID:6784
- C:\Windows\System\dlGQWvW.exe
  C:\Windows\System\dlGQWvW.exe
  2⤵
  PID:6176
- C:\Windows\System\RlfilxE.exe
  C:\Windows\System\RlfilxE.exe
  2⤵
  PID:7160
- C:\Windows\System\xYAKgDf.exe
  C:\Windows\System\xYAKgDf.exe
  2⤵
  PID:7192
- C:\Windows\System\yjFxdMw.exe
  C:\Windows\System\yjFxdMw.exe
  2⤵
  PID:7220
- C:\Windows\System\QXuHdCP.exe
  C:\Windows\System\QXuHdCP.exe
  2⤵
  PID:7252
- C:\Windows\System\sZqzmaN.exe
  C:\Windows\System\sZqzmaN.exe
  2⤵
  PID:7280
- C:\Windows\System\Ystvqbr.exe
  C:\Windows\System\Ystvqbr.exe
  2⤵
  PID:7308
- C:\Windows\System\kaFOTJk.exe
  C:\Windows\System\kaFOTJk.exe
  2⤵
  PID:7336
- C:\Windows\System\ZZelEbd.exe
  C:\Windows\System\ZZelEbd.exe
  2⤵
  PID:7364
- C:\Windows\System\IzrygAz.exe
  C:\Windows\System\IzrygAz.exe
  2⤵
  PID:7392
- C:\Windows\System\HSHZXkR.exe
  C:\Windows\System\HSHZXkR.exe
  2⤵
  PID:7428
- C:\Windows\System\uryxuqe.exe
  C:\Windows\System\uryxuqe.exe
  2⤵
  PID:7448
- C:\Windows\System\HwAQuom.exe
  C:\Windows\System\HwAQuom.exe
  2⤵
  PID:7476
- C:\Windows\System\CpEWyIR.exe
  C:\Windows\System\CpEWyIR.exe
  2⤵
  PID:7496
- C:\Windows\System\BsIkhem.exe
  C:\Windows\System\BsIkhem.exe
  2⤵
  PID:7524
- C:\Windows\System\tXoUOtd.exe
  C:\Windows\System\tXoUOtd.exe
  2⤵
  PID:7560
- C:\Windows\System\GZoXczq.exe
  C:\Windows\System\GZoXczq.exe
  2⤵
  PID:7576
- C:\Windows\System\bPxOjbt.exe
  C:\Windows\System\bPxOjbt.exe
  2⤵
  PID:7608
- C:\Windows\System\zfOWgwQ.exe
  C:\Windows\System\zfOWgwQ.exe
  2⤵
  PID:7644
- C:\Windows\System\zXXQvqf.exe
  C:\Windows\System\zXXQvqf.exe
  2⤵
  PID:7668
- C:\Windows\System\oOqvKrv.exe
  C:\Windows\System\oOqvKrv.exe
  2⤵
  PID:7700
- C:\Windows\System\OioaaHE.exe
  C:\Windows\System\OioaaHE.exe
  2⤵
  PID:7716
- C:\Windows\System\CaaIeRQ.exe
  C:\Windows\System\CaaIeRQ.exe
  2⤵
  PID:7756
- C:\Windows\System\OQBIVEH.exe
  C:\Windows\System\OQBIVEH.exe
  2⤵
  PID:7784
- C:\Windows\System\lxCupin.exe
  C:\Windows\System\lxCupin.exe
  2⤵
  PID:7804
- C:\Windows\System\FNtTcLM.exe
  C:\Windows\System\FNtTcLM.exe
  2⤵
  PID:7836
- C:\Windows\System\YeMadlG.exe
  C:\Windows\System\YeMadlG.exe
  2⤵
  PID:7856
- C:\Windows\System\ykTCCun.exe
  C:\Windows\System\ykTCCun.exe
  2⤵
  PID:7880
- C:\Windows\System\tlhNLvT.exe
  C:\Windows\System\tlhNLvT.exe
  2⤵
  PID:7916
- C:\Windows\System\jpnJQwo.exe
  C:\Windows\System\jpnJQwo.exe
  2⤵
  PID:7940
- C:\Windows\System\UotdRyb.exe
  C:\Windows\System\UotdRyb.exe
  2⤵
  PID:7968
- C:\Windows\System\PSSeXYf.exe
  C:\Windows\System\PSSeXYf.exe
  2⤵
  PID:7984
- C:\Windows\System\opncKSD.exe
  C:\Windows\System\opncKSD.exe
  2⤵
  PID:8012
- C:\Windows\System\ldekpiD.exe
  C:\Windows\System\ldekpiD.exe
  2⤵
  PID:8040
- C:\Windows\System\aDxrTpW.exe
  C:\Windows\System\aDxrTpW.exe
  2⤵
  PID:8076
- C:\Windows\System\SBpXWQJ.exe
  C:\Windows\System\SBpXWQJ.exe
  2⤵
  PID:8108
- C:\Windows\System\JpHfWKU.exe
  C:\Windows\System\JpHfWKU.exe
  2⤵
  PID:8128
- C:\Windows\System\XSeTUCV.exe
  C:\Windows\System\XSeTUCV.exe
  2⤵
  PID:8152
- C:\Windows\System\GwZvqbd.exe
  C:\Windows\System\GwZvqbd.exe
  2⤵
  PID:8184
- C:\Windows\System\zhgDrRg.exe
  C:\Windows\System\zhgDrRg.exe
  2⤵
  PID:7204
- C:\Windows\System\MmYKUwN.exe
  C:\Windows\System\MmYKUwN.exe
  2⤵
  PID:7232
- C:\Windows\System\ohadfUy.exe
  C:\Windows\System\ohadfUy.exe
  2⤵
  PID:7292
- C:\Windows\System\oUfSWGG.exe
  C:\Windows\System\oUfSWGG.exe
  2⤵
  PID:7348
- C:\Windows\System\IpQbbrf.exe
  C:\Windows\System\IpQbbrf.exe
  2⤵
  PID:7460
- C:\Windows\System\kwjgtwk.exe
  C:\Windows\System\kwjgtwk.exe
  2⤵
  PID:7520
- C:\Windows\System\iHttfNG.exe
  C:\Windows\System\iHttfNG.exe
  2⤵
  PID:7588
- C:\Windows\System\AJxjpJd.exe
  C:\Windows\System\AJxjpJd.exe
  2⤵
  PID:7620
- C:\Windows\System\oHfYFNJ.exe
  C:\Windows\System\oHfYFNJ.exe
  2⤵
  PID:7740
- C:\Windows\System\YoVghKb.exe
  C:\Windows\System\YoVghKb.exe
  2⤵
  PID:7768
- C:\Windows\System\OtVhUuF.exe
  C:\Windows\System\OtVhUuF.exe
  2⤵
  PID:7828
- C:\Windows\System\tQPIaJc.exe
  C:\Windows\System\tQPIaJc.exe
  2⤵
  PID:7892
- C:\Windows\System\kbOsEuS.exe
  C:\Windows\System\kbOsEuS.exe
  2⤵
  PID:7956
- C:\Windows\System\hathoia.exe
  C:\Windows\System\hathoia.exe
  2⤵
  PID:8000
- C:\Windows\System\MQGPJNX.exe
  C:\Windows\System\MQGPJNX.exe
  2⤵
  PID:8136
- C:\Windows\System\zEqRbfz.exe
  C:\Windows\System\zEqRbfz.exe
  2⤵
  PID:8160
- C:\Windows\System\KYgqQXn.exe
  C:\Windows\System\KYgqQXn.exe
  2⤵
  PID:7244
- C:\Windows\System\IJZgwiR.exe
  C:\Windows\System\IJZgwiR.exe
  2⤵
  PID:7404
- C:\Windows\System\cSthkZQ.exe
  C:\Windows\System\cSthkZQ.exe
  2⤵
  PID:7664
- C:\Windows\System\xamaLxN.exe
  C:\Windows\System\xamaLxN.exe
  2⤵
  PID:7736
- C:\Windows\System\CzCOuxV.exe
  C:\Windows\System\CzCOuxV.exe
  2⤵
  PID:7952
- C:\Windows\System\FxBoDsj.exe
  C:\Windows\System\FxBoDsj.exe
  2⤵
  PID:8140
- C:\Windows\System\YVRZXds.exe
  C:\Windows\System\YVRZXds.exe
  2⤵
  PID:7320
- C:\Windows\System\widmkkO.exe
  C:\Windows\System\widmkkO.exe
  2⤵
  PID:7380
- C:\Windows\System\wHuUjWM.exe
  C:\Windows\System\wHuUjWM.exe
  2⤵
  PID:8028
- C:\Windows\System\gezlfMX.exe
  C:\Windows\System\gezlfMX.exe
  2⤵
  PID:7656
- C:\Windows\System\IxpeAoW.exe
  C:\Windows\System\IxpeAoW.exe
  2⤵
  PID:8220
- C:\Windows\System\asAClrU.exe
  C:\Windows\System\asAClrU.exe
  2⤵
  PID:8236
- C:\Windows\System\UDYojXm.exe
  C:\Windows\System\UDYojXm.exe
  2⤵
  PID:8256
- C:\Windows\System\MSXakOF.exe
  C:\Windows\System\MSXakOF.exe
  2⤵
  PID:8296
- C:\Windows\System\IbJUQAf.exe
  C:\Windows\System\IbJUQAf.exe
  2⤵
  PID:8336
- C:\Windows\System\nUvhtsT.exe
  C:\Windows\System\nUvhtsT.exe
  2⤵
  PID:8360
- C:\Windows\System\DmChUtK.exe
  C:\Windows\System\DmChUtK.exe
  2⤵
  PID:8404
- C:\Windows\System\XDgPtTb.exe
  C:\Windows\System\XDgPtTb.exe
  2⤵
  PID:8424
- C:\Windows\System\vbNEuUG.exe
  C:\Windows\System\vbNEuUG.exe
  2⤵
  PID:8456
- C:\Windows\System\LenqAKT.exe
  C:\Windows\System\LenqAKT.exe
  2⤵
  PID:8476
- C:\Windows\System\kvAhirb.exe
  C:\Windows\System\kvAhirb.exe
  2⤵
  PID:8492
- C:\Windows\System\pCgFalN.exe
  C:\Windows\System\pCgFalN.exe
  2⤵
  PID:8532
- C:\Windows\System\EaojeyM.exe
  C:\Windows\System\EaojeyM.exe
  2⤵
  PID:8548
- C:\Windows\System\bCmjIOO.exe
  C:\Windows\System\bCmjIOO.exe
  2⤵
  PID:8588
- C:\Windows\System\jsPTgka.exe
  C:\Windows\System\jsPTgka.exe
  2⤵
  PID:8616
- C:\Windows\System\SuWceOd.exe
  C:\Windows\System\SuWceOd.exe
  2⤵
  PID:8644
- C:\Windows\System\xzPKdRL.exe
  C:\Windows\System\xzPKdRL.exe
  2⤵
  PID:8664
- C:\Windows\System\bdCRsda.exe
  C:\Windows\System\bdCRsda.exe
  2⤵
  PID:8688
- C:\Windows\System\mPdHagE.exe
  C:\Windows\System\mPdHagE.exe
  2⤵
  PID:8728
- C:\Windows\System\NSFlnkK.exe
  C:\Windows\System\NSFlnkK.exe
  2⤵
  PID:8756
- C:\Windows\System\gseavpq.exe
  C:\Windows\System\gseavpq.exe
  2⤵
  PID:8772
- C:\Windows\System\bWTXwAc.exe
  C:\Windows\System\bWTXwAc.exe
  2⤵
  PID:8796
- C:\Windows\System\FcyhLQX.exe
  C:\Windows\System\FcyhLQX.exe
  2⤵
  PID:8840
- C:\Windows\System\ymoziHG.exe
  C:\Windows\System\ymoziHG.exe
  2⤵
  PID:8856
- C:\Windows\System\IOouieI.exe
  C:\Windows\System\IOouieI.exe
  2⤵
  PID:8904
- C:\Windows\System\wumHPhP.exe
  C:\Windows\System\wumHPhP.exe
  2⤵
  PID:8928
- C:\Windows\System\MgGtmld.exe
  C:\Windows\System\MgGtmld.exe
  2⤵
  PID:8952
- C:\Windows\System\HERXmfY.exe
  C:\Windows\System\HERXmfY.exe
  2⤵
  PID:8980
- C:\Windows\System\QtsVPvh.exe
  C:\Windows\System\QtsVPvh.exe
  2⤵
  PID:9008
- C:\Windows\System\xnPtpuI.exe
  C:\Windows\System\xnPtpuI.exe
  2⤵
  PID:9036
- C:\Windows\System\HjdJcBs.exe
  C:\Windows\System\HjdJcBs.exe
  2⤵
  PID:9068
- C:\Windows\System\RYVPOCS.exe
  C:\Windows\System\RYVPOCS.exe
  2⤵
  PID:9100
- C:\Windows\System\TcKqJMg.exe
  C:\Windows\System\TcKqJMg.exe
  2⤵
  PID:9124
- C:\Windows\System\YNnLmdH.exe
  C:\Windows\System\YNnLmdH.exe
  2⤵
  PID:9156
- C:\Windows\System\gzXSpfO.exe
  C:\Windows\System\gzXSpfO.exe
  2⤵
  PID:9188
- C:\Windows\System\duqBOxc.exe
  C:\Windows\System\duqBOxc.exe
  2⤵
  PID:8036
- C:\Windows\System\SIGiGBc.exe
  C:\Windows\System\SIGiGBc.exe
  2⤵
  PID:7844
- C:\Windows\System\IKkPByY.exe
  C:\Windows\System\IKkPByY.exe
  2⤵
  PID:8216
- C:\Windows\System\UYtanCL.exe
  C:\Windows\System\UYtanCL.exe
  2⤵
  PID:8304
- C:\Windows\System\qkRdSsL.exe
  C:\Windows\System\qkRdSsL.exe
  2⤵
  PID:8344
- C:\Windows\System\sZAnzJG.exe
  C:\Windows\System\sZAnzJG.exe
  2⤵
  PID:8384
- C:\Windows\System\OqExbXy.exe
  C:\Windows\System\OqExbXy.exe
  2⤵
  PID:8432
- C:\Windows\System\EOuQOCu.exe
  C:\Windows\System\EOuQOCu.exe
  2⤵
  PID:8468
- C:\Windows\System\jqjZXeR.exe
  C:\Windows\System\jqjZXeR.exe
  2⤵
  PID:8504
- C:\Windows\System\lLfyDvy.exe
  C:\Windows\System\lLfyDvy.exe
  2⤵
  PID:8600
- C:\Windows\System\vAqDTKy.exe
  C:\Windows\System\vAqDTKy.exe
  2⤵
  PID:8628
- C:\Windows\System\JWIOPjJ.exe
  C:\Windows\System\JWIOPjJ.exe
  2⤵
  PID:8716
- C:\Windows\System\WiDDKEA.exe
  C:\Windows\System\WiDDKEA.exe
  2⤵
  PID:8764
- C:\Windows\System\jztcKPf.exe
  C:\Windows\System\jztcKPf.exe
  2⤵
  PID:8816
- C:\Windows\System\KRGeYPm.exe
  C:\Windows\System\KRGeYPm.exe
  2⤵
  PID:8888
- C:\Windows\System\TrivBkH.exe
  C:\Windows\System\TrivBkH.exe
  2⤵
  PID:8936
- C:\Windows\System\ZMydSpM.exe
  C:\Windows\System\ZMydSpM.exe
  2⤵
  PID:9028
- C:\Windows\System\UMZfldu.exe
  C:\Windows\System\UMZfldu.exe
  2⤵
  PID:9052
- C:\Windows\System\LqyqptT.exe
  C:\Windows\System\LqyqptT.exe
  2⤵
  PID:9132
- C:\Windows\System\qkRLggD.exe
  C:\Windows\System\qkRLggD.exe
  2⤵
  PID:9204
- C:\Windows\System\SZetOjY.exe
  C:\Windows\System\SZetOjY.exe
  2⤵
  PID:8264
- C:\Windows\System\QEQkQJx.exe
  C:\Windows\System\QEQkQJx.exe
  2⤵
  PID:8704
- C:\Windows\System\EythFcL.exe
  C:\Windows\System\EythFcL.exe
  2⤵
  PID:8964
- C:\Windows\System\tkCXOay.exe
  C:\Windows\System\tkCXOay.exe
  2⤵
  PID:9004
- C:\Windows\System\sUdGFhp.exe
  C:\Windows\System\sUdGFhp.exe
  2⤵
  PID:9200
- C:\Windows\System\GgsQHgY.exe
  C:\Windows\System\GgsQHgY.exe
  2⤵
  PID:8440
- C:\Windows\System\zibrDRB.exe
  C:\Windows\System\zibrDRB.exe
  2⤵
  PID:9024
- C:\Windows\System\vHfOITw.exe
  C:\Windows\System\vHfOITw.exe
  2⤵
  PID:9224
- C:\Windows\System\AGtWKOY.exe
  C:\Windows\System\AGtWKOY.exe
  2⤵
  PID:9256
- C:\Windows\System\VSWDwdh.exe
  C:\Windows\System\VSWDwdh.exe
  2⤵
  PID:9284
- C:\Windows\System\QlqxZPp.exe
  C:\Windows\System\QlqxZPp.exe
  2⤵
  PID:9316
- C:\Windows\System\WFROvqP.exe
  C:\Windows\System\WFROvqP.exe
  2⤵
  PID:9340
- C:\Windows\System\bJYmxJT.exe
  C:\Windows\System\bJYmxJT.exe
  2⤵
  PID:9356
- C:\Windows\System\oCZpVuQ.exe
  C:\Windows\System\oCZpVuQ.exe
  2⤵
  PID:9384
- C:\Windows\System\YwctcOh.exe
  C:\Windows\System\YwctcOh.exe
  2⤵
  PID:9420
- C:\Windows\System\BRStGfa.exe
  C:\Windows\System\BRStGfa.exe
  2⤵
  PID:9452
- C:\Windows\System\tAfldDd.exe
  C:\Windows\System\tAfldDd.exe
  2⤵
  PID:9488
- C:\Windows\System\IbruIuK.exe
  C:\Windows\System\IbruIuK.exe
  2⤵
  PID:9524
- C:\Windows\System\MguaVBx.exe
  C:\Windows\System\MguaVBx.exe
  2⤵
  PID:9544
- C:\Windows\System\aWnbEIX.exe
  C:\Windows\System\aWnbEIX.exe
  2⤵
  PID:9564
- C:\Windows\System\mQXHyLz.exe
  C:\Windows\System\mQXHyLz.exe
  2⤵
  PID:9592
- C:\Windows\System\DdGjAxH.exe
  C:\Windows\System\DdGjAxH.exe
  2⤵
  PID:9616
- C:\Windows\System\nxnXJNQ.exe
  C:\Windows\System\nxnXJNQ.exe
  2⤵
  PID:9648
- C:\Windows\System\CFmXuZV.exe
  C:\Windows\System\CFmXuZV.exe
  2⤵
  PID:9676
- C:\Windows\System\WpZJemj.exe
  C:\Windows\System\WpZJemj.exe
  2⤵
  PID:9700
- C:\Windows\System\xUYvoEL.exe
  C:\Windows\System\xUYvoEL.exe
  2⤵
  PID:9728
- C:\Windows\System\ZFEPAWg.exe
  C:\Windows\System\ZFEPAWg.exe
  2⤵
  PID:9760
- C:\Windows\System\hiMKpCU.exe
  C:\Windows\System\hiMKpCU.exe
  2⤵
  PID:9780
- C:\Windows\System\tfoDVKH.exe
  C:\Windows\System\tfoDVKH.exe
  2⤵
  PID:9816
- C:\Windows\System\vWpgnqP.exe
  C:\Windows\System\vWpgnqP.exe
  2⤵
  PID:9848
- C:\Windows\System\rOxTWdT.exe
  C:\Windows\System\rOxTWdT.exe
  2⤵
  PID:9880
- C:\Windows\System\Ktzitec.exe
  C:\Windows\System\Ktzitec.exe
  2⤵
  PID:9904
- C:\Windows\System\nWPoFAB.exe
  C:\Windows\System\nWPoFAB.exe
  2⤵
  PID:9936
- C:\Windows\System\NvfeggS.exe
  C:\Windows\System\NvfeggS.exe
  2⤵
  PID:9964
- C:\Windows\System\IASvkWT.exe
  C:\Windows\System\IASvkWT.exe
  2⤵
  PID:9984
- C:\Windows\System\qSzYmUX.exe
  C:\Windows\System\qSzYmUX.exe
  2⤵
  PID:10008
- C:\Windows\System\HHdejtD.exe
  C:\Windows\System\HHdejtD.exe
  2⤵
  PID:10024
- C:\Windows\System\jKlIZfN.exe
  C:\Windows\System\jKlIZfN.exe
  2⤵
  PID:10052
- C:\Windows\System\VHpzdcf.exe
  C:\Windows\System\VHpzdcf.exe
  2⤵
  PID:10092
- C:\Windows\System\phIuGdL.exe
  C:\Windows\System\phIuGdL.exe
  2⤵
  PID:10116
- C:\Windows\System\XVYNwRx.exe
  C:\Windows\System\XVYNwRx.exe
  2⤵
  PID:10156
- C:\Windows\System\kqRiZwq.exe
  C:\Windows\System\kqRiZwq.exe
  2⤵
  PID:10180
- C:\Windows\System\KOkVzdo.exe
  C:\Windows\System\KOkVzdo.exe
  2⤵
  PID:10208
- C:\Windows\System\WEGbzeg.exe
  C:\Windows\System\WEGbzeg.exe
  2⤵
  PID:10232
- C:\Windows\System\zzZfiuq.exe
  C:\Windows\System\zzZfiuq.exe
  2⤵
  PID:8208
- C:\Windows\System\cVCYSJM.exe
  C:\Windows\System\cVCYSJM.exe
  2⤵
  PID:9280
- C:\Windows\System\doHOMYJ.exe
  C:\Windows\System\doHOMYJ.exe
  2⤵
  PID:9336
- C:\Windows\System\uYdrXNA.exe
  C:\Windows\System\uYdrXNA.exe
  2⤵
  PID:9352
- C:\Windows\System\MoneoQV.exe
  C:\Windows\System\MoneoQV.exe
  2⤵
  PID:9480
- C:\Windows\System\blaugdn.exe
  C:\Windows\System\blaugdn.exe
  2⤵
  PID:9508
- C:\Windows\System\YRwPCzm.exe
  C:\Windows\System\YRwPCzm.exe
  2⤵
  PID:9608
- C:\Windows\System\YuqUcVn.exe
  C:\Windows\System\YuqUcVn.exe
  2⤵
  PID:9692
- C:\Windows\System\NACfaqL.exe
  C:\Windows\System\NACfaqL.exe
  2⤵
  PID:9768
- C:\Windows\System\EdzKfGV.exe
  C:\Windows\System\EdzKfGV.exe
  2⤵
  PID:9752
- C:\Windows\System\dDfEGKF.exe
  C:\Windows\System\dDfEGKF.exe
  2⤵
  PID:9808
- C:\Windows\System\gGlJizH.exe
  C:\Windows\System\gGlJizH.exe
  2⤵
  PID:9956
- C:\Windows\System\UvktZJA.exe
  C:\Windows\System\UvktZJA.exe
  2⤵
  PID:9928
- C:\Windows\System\ySEsCFB.exe
  C:\Windows\System\ySEsCFB.exe
  2⤵
  PID:10040
- C:\Windows\System\TwHIxsL.exe
  C:\Windows\System\TwHIxsL.exe
  2⤵
  PID:10108
- C:\Windows\System\DMUVJyv.exe
  C:\Windows\System\DMUVJyv.exe
  2⤵
  PID:10172
- C:\Windows\System\gHbucrA.exe
  C:\Windows\System\gHbucrA.exe
  2⤵
  PID:10224
- C:\Windows\System\BqZPEht.exe
  C:\Windows\System\BqZPEht.exe
  2⤵
  PID:9048
- C:\Windows\System\CoRsLpY.exe
  C:\Windows\System\CoRsLpY.exe
  2⤵
  PID:9020
- C:\Windows\System\FRGFpyV.exe
  C:\Windows\System\FRGFpyV.exe
  2⤵
  PID:9556
- C:\Windows\System\bEUpjAf.exe
  C:\Windows\System\bEUpjAf.exe
  2⤵
  PID:9504
- C:\Windows\System\mhTFVEw.exe
  C:\Windows\System\mhTFVEw.exe
  2⤵
  PID:9740
- C:\Windows\System\ihByNSl.exe
  C:\Windows\System\ihByNSl.exe
  2⤵
  PID:10132
- C:\Windows\System\WbcjZDu.exe
  C:\Windows\System\WbcjZDu.exe
  2⤵
  PID:10216
- C:\Windows\System\drRiEwt.exe
  C:\Windows\System\drRiEwt.exe
  2⤵
  PID:10076
- C:\Windows\System\EYgLKIY.exe
  C:\Windows\System\EYgLKIY.exe
  2⤵
  PID:9720
- C:\Windows\System\EOhZJwZ.exe
  C:\Windows\System\EOhZJwZ.exe
  2⤵
  PID:10020
- C:\Windows\System\BeUpqhW.exe
  C:\Windows\System\BeUpqhW.exe
  2⤵
  PID:10268
- C:\Windows\System\goxCUgF.exe
  C:\Windows\System\goxCUgF.exe
  2⤵
  PID:10300
- C:\Windows\System\landwIn.exe
  C:\Windows\System\landwIn.exe
  2⤵
  PID:10336
- C:\Windows\System\PsNMnDC.exe
  C:\Windows\System\PsNMnDC.exe
  2⤵
  PID:10376
- C:\Windows\System\ZtnzSFQ.exe
  C:\Windows\System\ZtnzSFQ.exe
  2⤵
  PID:10416
- C:\Windows\System\lcVYaZI.exe
  C:\Windows\System\lcVYaZI.exe
  2⤵
  PID:10444
- C:\Windows\System\BsmQtgS.exe
  C:\Windows\System\BsmQtgS.exe
  2⤵
  PID:10472
- C:\Windows\System\XItJfPs.exe
  C:\Windows\System\XItJfPs.exe
  2⤵
  PID:10500
- C:\Windows\System\JZmjhfY.exe
  C:\Windows\System\JZmjhfY.exe
  2⤵
  PID:10520
- C:\Windows\System\QbACjDf.exe
  C:\Windows\System\QbACjDf.exe
  2⤵
  PID:10556
- C:\Windows\System\cjJODig.exe
  C:\Windows\System\cjJODig.exe
  2⤵
  PID:10584
- C:\Windows\System\JVSOsrL.exe
  C:\Windows\System\JVSOsrL.exe
  2⤵
  PID:10600
- C:\Windows\System\gOANFFb.exe
  C:\Windows\System\gOANFFb.exe
  2⤵
  PID:10632
- C:\Windows\System\ZGiKjQN.exe
  C:\Windows\System\ZGiKjQN.exe
  2⤵
  PID:10660
- C:\Windows\System\fWdKwzO.exe
  C:\Windows\System\fWdKwzO.exe
  2⤵
  PID:10688
- C:\Windows\System\aYYJaeP.exe
  C:\Windows\System\aYYJaeP.exe
  2⤵
  PID:10712
- C:\Windows\System\BPYsZFC.exe
  C:\Windows\System\BPYsZFC.exe
  2⤵
  PID:10744
- C:\Windows\System\SuTssmK.exe
  C:\Windows\System\SuTssmK.exe
  2⤵
  PID:10772
- C:\Windows\System\zYoVYKR.exe
  C:\Windows\System\zYoVYKR.exe
  2⤵
  PID:10796
- C:\Windows\System\SPbBmgd.exe
  C:\Windows\System\SPbBmgd.exe
  2⤵
  PID:10828
- C:\Windows\System\pGZwVws.exe
  C:\Windows\System\pGZwVws.exe
  2⤵
  PID:10856
- C:\Windows\System\nUPnPXy.exe
  C:\Windows\System\nUPnPXy.exe
  2⤵
  PID:10888
- C:\Windows\System\WVCtdco.exe
  C:\Windows\System\WVCtdco.exe
  2⤵
  PID:10916
- C:\Windows\System\tXCjJcr.exe
  C:\Windows\System\tXCjJcr.exe
  2⤵
  PID:10944
- C:\Windows\System\OlklEGL.exe
  C:\Windows\System\OlklEGL.exe
  2⤵
  PID:10980
- C:\Windows\System\tLxUgxE.exe
  C:\Windows\System\tLxUgxE.exe
  2⤵
  PID:10996
- C:\Windows\System\AxlTHUJ.exe
  C:\Windows\System\AxlTHUJ.exe
  2⤵
  PID:11024
- C:\Windows\System\yUzyoCa.exe
  C:\Windows\System\yUzyoCa.exe
  2⤵
  PID:11044
- C:\Windows\System\VWtpDTV.exe
  C:\Windows\System\VWtpDTV.exe
  2⤵
  PID:11064
- C:\Windows\System\yKpSQiL.exe
  C:\Windows\System\yKpSQiL.exe
  2⤵
  PID:11088
- C:\Windows\System\mWBmRPc.exe
  C:\Windows\System\mWBmRPc.exe
  2⤵
  PID:11120
- C:\Windows\System\XzTGztY.exe
  C:\Windows\System\XzTGztY.exe
  2⤵
  PID:11140
- C:\Windows\System\CGivkXI.exe
  C:\Windows\System\CGivkXI.exe
  2⤵
  PID:11164
- C:\Windows\System\OwFfmFL.exe
  C:\Windows\System\OwFfmFL.exe
  2⤵
  PID:11192
- C:\Windows\System\DJriKyC.exe
  C:\Windows\System\DJriKyC.exe
  2⤵
  PID:11216
- C:\Windows\System\hApPnpk.exe
  C:\Windows\System\hApPnpk.exe
  2⤵
  PID:11244
- C:\Windows\System\BbQwIVc.exe
  C:\Windows\System\BbQwIVc.exe
  2⤵
  PID:9380
- C:\Windows\System\gQbcABd.exe
  C:\Windows\System\gQbcABd.exe
  2⤵
  PID:9268
- C:\Windows\System\HjVRhBu.exe
  C:\Windows\System\HjVRhBu.exe
  2⤵
  PID:10280
- C:\Windows\System\oiulgkj.exe
  C:\Windows\System\oiulgkj.exe
  2⤵
  PID:10372
- C:\Windows\System\MYIxAGq.exe
  C:\Windows\System\MYIxAGq.exe
  2⤵
  PID:10440
- C:\Windows\System\vyObLge.exe
  C:\Windows\System\vyObLge.exe
  2⤵
  PID:10576
- C:\Windows\System\AlXfhGC.exe
  C:\Windows\System\AlXfhGC.exe
  2⤵
  PID:10652
- C:\Windows\System\YPUsdIh.exe
  C:\Windows\System\YPUsdIh.exe
  2⤵
  PID:10680
- C:\Windows\System\lHQjEox.exe
  C:\Windows\System\lHQjEox.exe
  2⤵
  PID:10752
- C:\Windows\System\FfozJEK.exe
  C:\Windows\System\FfozJEK.exe
  2⤵
  PID:10808
- C:\Windows\System\wlVgRpH.exe
  C:\Windows\System\wlVgRpH.exe
  2⤵
  PID:10884
- C:\Windows\System\xqQyJQN.exe
  C:\Windows\System\xqQyJQN.exe
  2⤵
  PID:10896
- C:\Windows\System\lthUNue.exe
  C:\Windows\System\lthUNue.exe
  2⤵
  PID:10928
- C:\Windows\System\XBqWTjg.exe
  C:\Windows\System\XBqWTjg.exe
  2⤵
  PID:11012
- C:\Windows\System\YEyMuqW.exe
  C:\Windows\System\YEyMuqW.exe
  2⤵
  PID:11072
- C:\Windows\System\ihlxcRd.exe
  C:\Windows\System\ihlxcRd.exe
  2⤵
  PID:11136
- C:\Windows\System\zkkLXgH.exe
  C:\Windows\System\zkkLXgH.exe
  2⤵
  PID:11172
- C:\Windows\System\eCoNKDC.exe
  C:\Windows\System\eCoNKDC.exe
  2⤵
  PID:11224
- C:\Windows\System\ueDuSlI.exe
  C:\Windows\System\ueDuSlI.exe
  2⤵
  PID:9536
- C:\Windows\System\sWHkGnv.exe
  C:\Windows\System\sWHkGnv.exe
  2⤵
  PID:10432
- C:\Windows\System\OiaQaDd.exe
  C:\Windows\System\OiaQaDd.exe
  2⤵
  PID:10532
- C:\Windows\System\aEYQbJB.exe
  C:\Windows\System\aEYQbJB.exe
  2⤵
  PID:10668
- C:\Windows\System\fCxbmUw.exe
  C:\Windows\System\fCxbmUw.exe
  2⤵
  PID:10992
- C:\Windows\System\mDIzcle.exe
  C:\Windows\System\mDIzcle.exe
  2⤵
  PID:10940
- C:\Windows\System\XcDuWUV.exe
  C:\Windows\System\XcDuWUV.exe
  2⤵
  PID:9376
- C:\Windows\System\xGxzbGW.exe
  C:\Windows\System\xGxzbGW.exe
  2⤵
  PID:10328
- C:\Windows\System\nrTMcXT.exe
  C:\Windows\System\nrTMcXT.exe
  2⤵
  PID:11236
- C:\Windows\System\sOXBtKW.exe
  C:\Windows\System\sOXBtKW.exe
  2⤵
  PID:11076
- C:\Windows\System\ptohACi.exe
  C:\Windows\System\ptohACi.exe
  2⤵
  PID:11296
- C:\Windows\System\dMDFVlN.exe
  C:\Windows\System\dMDFVlN.exe
  2⤵
  PID:11316
- C:\Windows\System\HTbcFZN.exe
  C:\Windows\System\HTbcFZN.exe
  2⤵
  PID:11344
- C:\Windows\System\qSVFoke.exe
  C:\Windows\System\qSVFoke.exe
  2⤵
  PID:11360
- C:\Windows\System\UfHHwlx.exe
  C:\Windows\System\UfHHwlx.exe
  2⤵
  PID:11392
- C:\Windows\System\JzNawoS.exe
  C:\Windows\System\JzNawoS.exe
  2⤵
  PID:11424
- C:\Windows\System\vbWfDCi.exe
  C:\Windows\System\vbWfDCi.exe
  2⤵
  PID:11452
- C:\Windows\System\ysyTPWe.exe
  C:\Windows\System\ysyTPWe.exe
  2⤵
  PID:11472
- C:\Windows\System\otVJhqD.exe
  C:\Windows\System\otVJhqD.exe
  2⤵
  PID:11512
- C:\Windows\System\rUmaobI.exe
  C:\Windows\System\rUmaobI.exe
  2⤵
  PID:11540
- C:\Windows\System\zgWfaoI.exe
  C:\Windows\System\zgWfaoI.exe
  2⤵
  PID:11556
- C:\Windows\System\CDvptCE.exe
  C:\Windows\System\CDvptCE.exe
  2⤵
  PID:11588
- C:\Windows\System\cxyKByS.exe
  C:\Windows\System\cxyKByS.exe
  2⤵
  PID:11612
- C:\Windows\System\DZFKQTe.exe
  C:\Windows\System\DZFKQTe.exe
  2⤵
  PID:11644
- C:\Windows\System\UWlwQeg.exe
  C:\Windows\System\UWlwQeg.exe
  2⤵
  PID:11672
- C:\Windows\System\rnEQPAU.exe
  C:\Windows\System\rnEQPAU.exe
  2⤵
  PID:11704
- C:\Windows\System\ysOadmU.exe
  C:\Windows\System\ysOadmU.exe
  2⤵
  PID:11732
- C:\Windows\System\smebyiw.exe
  C:\Windows\System\smebyiw.exe
  2⤵
  PID:11748
- C:\Windows\System\YBRVEqM.exe
  C:\Windows\System\YBRVEqM.exe
  2⤵
  PID:11772
- C:\Windows\System\dHgNfZS.exe
  C:\Windows\System\dHgNfZS.exe
  2⤵
  PID:11788
- C:\Windows\System\ypMNVuU.exe
  C:\Windows\System\ypMNVuU.exe
  2⤵
  PID:11816
- C:\Windows\System\kdRMyWr.exe
  C:\Windows\System\kdRMyWr.exe
  2⤵
  PID:11960
- C:\Windows\System\emNqyyF.exe
  C:\Windows\System\emNqyyF.exe
  2⤵
  PID:12056
- C:\Windows\System\SbuFcuI.exe
  C:\Windows\System\SbuFcuI.exe
  2⤵
  PID:12080
- C:\Windows\System\xGUIXUX.exe
  C:\Windows\System\xGUIXUX.exe
  2⤵
  PID:12108
- C:\Windows\System\gDfTQaK.exe
  C:\Windows\System\gDfTQaK.exe
  2⤵
  PID:12136
- C:\Windows\System\vaflTmy.exe
  C:\Windows\System\vaflTmy.exe
  2⤵
  PID:12152
- C:\Windows\System\bqulSrx.exe
  C:\Windows\System\bqulSrx.exe
  2⤵
  PID:12176
- C:\Windows\System\EsxmkeS.exe
  C:\Windows\System\EsxmkeS.exe
  2⤵
  PID:12204
- C:\Windows\System\HiRfdwN.exe
  C:\Windows\System\HiRfdwN.exe
  2⤵
  PID:12228
- C:\Windows\System\dsarsOg.exe
  C:\Windows\System\dsarsOg.exe
  2⤵
  PID:12252
- C:\Windows\System\UvIiEPj.exe
  C:\Windows\System\UvIiEPj.exe
  2⤵
  PID:12276
- C:\Windows\System\CQgOfHr.exe
  C:\Windows\System\CQgOfHr.exe
  2⤵
  PID:10296
- C:\Windows\System\CdfbdVR.exe
  C:\Windows\System\CdfbdVR.exe
  2⤵
  PID:11284
- C:\Windows\System\xQyQrik.exe
  C:\Windows\System\xQyQrik.exe
  2⤵
  PID:11280
- C:\Windows\System\tllwRuk.exe
  C:\Windows\System\tllwRuk.exe
  2⤵
  PID:11352
- C:\Windows\System\FBCgHUR.exe
  C:\Windows\System\FBCgHUR.exe
  2⤵
  PID:11528
- C:\Windows\System\DVVNyne.exe
  C:\Windows\System\DVVNyne.exe
  2⤵
  PID:11584
- C:\Windows\System\nYFmDZZ.exe
  C:\Windows\System\nYFmDZZ.exe
  2⤵
  PID:11636
- C:\Windows\System\KdAdxCf.exe
  C:\Windows\System\KdAdxCf.exe
  2⤵
  PID:11716
- C:\Windows\System\grrMmmi.exe
  C:\Windows\System\grrMmmi.exe
  2⤵
  PID:11728
- C:\Windows\System\HewSmEf.exe
  C:\Windows\System\HewSmEf.exe
  2⤵
  PID:11856
- C:\Windows\System\USkYDdK.exe
  C:\Windows\System\USkYDdK.exe
  2⤵
  PID:11896
- C:\Windows\System\QnvwOhA.exe
  C:\Windows\System\QnvwOhA.exe
  2⤵
  PID:11800
- C:\Windows\System\LTLGUvO.exe
  C:\Windows\System\LTLGUvO.exe
  2⤵
  PID:11904
- C:\Windows\System\UhPXdEk.exe
  C:\Windows\System\UhPXdEk.exe
  2⤵
  PID:12192
- C:\Windows\System\pwtWVbt.exe
  C:\Windows\System\pwtWVbt.exe
  2⤵
  PID:12248
- C:\Windows\System\UNMVRoP.exe
  C:\Windows\System\UNMVRoP.exe
  2⤵
  PID:11272
- C:\Windows\System\SZVRRGf.exe
  C:\Windows\System\SZVRRGf.exe
  2⤵
  PID:11492
- C:\Windows\System\neWDEJw.exe
  C:\Windows\System\neWDEJw.exe
  2⤵
  PID:12036
- C:\Windows\System\BnUeyFY.exe
  C:\Windows\System\BnUeyFY.exe
  2⤵
  PID:11436
- C:\Windows\System\UQRVmvt.exe
  C:\Windows\System\UQRVmvt.exe
  2⤵
  PID:11768
- C:\Windows\System\EeBDvKK.exe
  C:\Windows\System\EeBDvKK.exe
  2⤵
  PID:11184
- C:\Windows\System\SFsMZBB.exe
  C:\Windows\System\SFsMZBB.exe
  2⤵
  PID:11840
- C:\Windows\System\gAHIatL.exe
  C:\Windows\System\gAHIatL.exe
  2⤵
  PID:11784
- C:\Windows\System\otGsuMb.exe
  C:\Windows\System\otGsuMb.exe
  2⤵
  PID:12312
- C:\Windows\System\iCeZsWS.exe
  C:\Windows\System\iCeZsWS.exe
  2⤵
  PID:12336
- C:\Windows\System\xTyzluP.exe
  C:\Windows\System\xTyzluP.exe
  2⤵
  PID:12368
- C:\Windows\System\bIDicfS.exe
  C:\Windows\System\bIDicfS.exe
  2⤵
  PID:12396
- C:\Windows\System\WaLjioP.exe
  C:\Windows\System\WaLjioP.exe
  2⤵
  PID:12412
- C:\Windows\System\xjLUKlI.exe
  C:\Windows\System\xjLUKlI.exe
  2⤵
  PID:12444
- C:\Windows\System\kCwAHRk.exe
  C:\Windows\System\kCwAHRk.exe
  2⤵
  PID:12464
- C:\Windows\System\DoLFEbe.exe
  C:\Windows\System\DoLFEbe.exe
  2⤵
  PID:12488
- C:\Windows\System\eGkZhhC.exe
  C:\Windows\System\eGkZhhC.exe
  2⤵
  PID:12516
- C:\Windows\System\cFIqQtz.exe
  C:\Windows\System\cFIqQtz.exe
  2⤵
  PID:12572
- C:\Windows\System\rSiTcnI.exe
  C:\Windows\System\rSiTcnI.exe
  2⤵
  PID:12596
- C:\Windows\System\pwPArNq.exe
  C:\Windows\System\pwPArNq.exe
  2⤵
  PID:12628
- C:\Windows\System\SWAiMcJ.exe
  C:\Windows\System\SWAiMcJ.exe
  2⤵
  PID:12660
- C:\Windows\System\MXNCUIV.exe
  C:\Windows\System\MXNCUIV.exe
  2⤵
  PID:12692
- C:\Windows\System\wSVSmYd.exe
  C:\Windows\System\wSVSmYd.exe
  2⤵
  PID:12720
- C:\Windows\System\RNyhYQy.exe
  C:\Windows\System\RNyhYQy.exe
  2⤵
  PID:12748
- C:\Windows\System\jhuaEXs.exe
  C:\Windows\System\jhuaEXs.exe
  2⤵
  PID:12776
- C:\Windows\System\dUgtlDj.exe
  C:\Windows\System\dUgtlDj.exe
  2⤵
  PID:12804
- C:\Windows\System\nrueQfx.exe
  C:\Windows\System\nrueQfx.exe
  2⤵
  PID:12828
- C:\Windows\System\QsHumNx.exe
  C:\Windows\System\QsHumNx.exe
  2⤵
  PID:12864
- C:\Windows\System\IQXGtpN.exe
  C:\Windows\System\IQXGtpN.exe
  2⤵
  PID:12888
- C:\Windows\System\cqHCQTp.exe
  C:\Windows\System\cqHCQTp.exe
  2⤵
  PID:12916
- C:\Windows\System\vPrfuMM.exe
  C:\Windows\System\vPrfuMM.exe
  2⤵
  PID:12940
- C:\Windows\System\hzsKtpC.exe
  C:\Windows\System\hzsKtpC.exe
  2⤵
  PID:12968
- C:\Windows\System\naUvFdP.exe
  C:\Windows\System\naUvFdP.exe
  2⤵
  PID:12996
- C:\Windows\System\BaENRCX.exe
  C:\Windows\System\BaENRCX.exe
  2⤵
  PID:13020
- C:\Windows\System\iUOBhuR.exe
  C:\Windows\System\iUOBhuR.exe
  2⤵
  PID:13044
- C:\Windows\System\YCJlBbJ.exe
  C:\Windows\System\YCJlBbJ.exe
  2⤵
  PID:13076
- C:\Windows\System\gZDIynv.exe
  C:\Windows\System\gZDIynv.exe
  2⤵
  PID:13108
- C:\Windows\System\LCIFfVz.exe
  C:\Windows\System\LCIFfVz.exe
  2⤵
  PID:13132
- C:\Windows\System\XLPOJfd.exe
  C:\Windows\System\XLPOJfd.exe
  2⤵
  PID:13160
- C:\Windows\System\mRpGpMF.exe
  C:\Windows\System\mRpGpMF.exe
  2⤵
  PID:13188
- C:\Windows\System\mzKRQln.exe
  C:\Windows\System\mzKRQln.exe
  2⤵
  PID:13212
- C:\Windows\System\CHwVDcl.exe
  C:\Windows\System\CHwVDcl.exe
  2⤵
  PID:13236
- C:\Windows\System\rAstwbg.exe
  C:\Windows\System\rAstwbg.exe
  2⤵
  PID:13260
- C:\Windows\System\AMpFfNt.exe
  C:\Windows\System\AMpFfNt.exe
  2⤵
  PID:13300
- C:\Windows\System\qajmPUc.exe
  C:\Windows\System\qajmPUc.exe
  2⤵
  PID:11760
- C:\Windows\System\MxWKbdX.exe
  C:\Windows\System\MxWKbdX.exe
  2⤵
  PID:11852
- C:\Windows\System\jpUKUJQ.exe
  C:\Windows\System\jpUKUJQ.exe
  2⤵
  PID:12100
- C:\Windows\System\podXFmX.exe
  C:\Windows\System\podXFmX.exe
  2⤵
  PID:12024
- C:\Windows\System\gLRvDrT.exe
  C:\Windows\System\gLRvDrT.exe
  2⤵
  PID:12440
- C:\Windows\System\ctGFSpL.exe
  C:\Windows\System\ctGFSpL.exe
  2⤵
  PID:11884
- C:\Windows\System\qQXfwZn.exe
  C:\Windows\System\qQXfwZn.exe
  2⤵
  PID:12480
- C:\Windows\System\ibQXpVv.exe
  C:\Windows\System\ibQXpVv.exe
  2⤵
  PID:12404
- C:\Windows\System\hwShKXP.exe
  C:\Windows\System\hwShKXP.exe
  2⤵
  PID:12564
- C:\Windows\System\tUDXgYR.exe
  C:\Windows\System\tUDXgYR.exe
  2⤵
  PID:12620
- C:\Windows\System\mKHPcfA.exe
  C:\Windows\System\mKHPcfA.exe
  2⤵
  PID:12768
- C:\Windows\System\EDmlnRv.exe
  C:\Windows\System\EDmlnRv.exe
  2⤵
  PID:12672
- C:\Windows\System\GjGSKGh.exe
  C:\Windows\System\GjGSKGh.exe
  2⤵
  PID:12928
- C:\Windows\System\fvuMkQD.exe
  C:\Windows\System\fvuMkQD.exe
  2⤵
  PID:12792
- C:\Windows\System\UYqBjUQ.exe
  C:\Windows\System\UYqBjUQ.exe
  2⤵
  PID:12952
- C:\Windows\System\TbZzRCA.exe
  C:\Windows\System\TbZzRCA.exe
  2⤵
  PID:12980
- C:\Windows\System\ooXDdCT.exe
  C:\Windows\System\ooXDdCT.exe
  2⤵
  PID:11996
- C:\Windows\System\BlALduH.exe
  C:\Windows\System\BlALduH.exe
  2⤵
  PID:13124
- C:\Windows\System\evhVdOX.exe
  C:\Windows\System\evhVdOX.exe
  2⤵
  PID:13156
- C:\Windows\System\Wcqboqv.exe
  C:\Windows\System\Wcqboqv.exe
  2⤵
  PID:12124
- C:\Windows\System\loEedSb.exe
  C:\Windows\System\loEedSb.exe
  2⤵
  PID:12268
- C:\Windows\System\xkwryRF.exe
  C:\Windows\System\xkwryRF.exe
  2⤵
  PID:11912
- C:\Windows\System\rQjqLbQ.exe
  C:\Windows\System\rQjqLbQ.exe
  2⤵
  PID:12040
- C:\Windows\System\MaueLOf.exe
  C:\Windows\System\MaueLOf.exe
  2⤵
  PID:12392
- C:\Windows\System\IyjUyhe.exe
  C:\Windows\System\IyjUyhe.exe
  2⤵
  PID:11984
- C:\Windows\System\yVYfDll.exe
  C:\Windows\System\yVYfDll.exe
  2⤵
  PID:12008
- C:\Windows\System\oBvZBli.exe
  C:\Windows\System\oBvZBli.exe
  2⤵
  PID:12436
- C:\Windows\System\fJMadBd.exe
  C:\Windows\System\fJMadBd.exe
  2⤵
  PID:12936
- C:\Windows\System\vPgSSKZ.exe
  C:\Windows\System\vPgSSKZ.exe
  2⤵
  PID:13148
- C:\Windows\System\JneKiUN.exe
  C:\Windows\System\JneKiUN.exe
  2⤵
  PID:13096
- C:\Windows\System\UvZkdkh.exe
  C:\Windows\System\UvZkdkh.exe
  2⤵
  PID:12344
- C:\Windows\System\BhNujoq.exe
  C:\Windows\System\BhNujoq.exe
  2⤵
  PID:12964
- C:\Windows\System\XPRmenM.exe
  C:\Windows\System\XPRmenM.exe
  2⤵
  PID:10724
- C:\Windows\System\LheKcWb.exe
  C:\Windows\System\LheKcWb.exe
  2⤵
  PID:13332
- C:\Windows\System\pNbDMrZ.exe
  C:\Windows\System\pNbDMrZ.exe
  2⤵
  PID:13360
- C:\Windows\System\QbYdjbx.exe
  C:\Windows\System\QbYdjbx.exe
  2⤵
  PID:13388
- C:\Windows\System\nTYzOXD.exe
  C:\Windows\System\nTYzOXD.exe
  2⤵
  PID:13408
- C:\Windows\System\SdnonzK.exe
  C:\Windows\System\SdnonzK.exe
  2⤵
  PID:13428
- C:\Windows\System\iyqwytk.exe
  C:\Windows\System\iyqwytk.exe
  2⤵
  PID:13460
- C:\Windows\System\hNnFpCk.exe
  C:\Windows\System\hNnFpCk.exe
  2⤵
  PID:13492
- C:\Windows\System\qwYBaxJ.exe
  C:\Windows\System\qwYBaxJ.exe
  2⤵
  PID:13520
- C:\Windows\System\dWYVbXl.exe
  C:\Windows\System\dWYVbXl.exe
  2⤵
  PID:13540
- C:\Windows\System\FBYbVHb.exe
  C:\Windows\System\FBYbVHb.exe
  2⤵
  PID:13560
- C:\Windows\System\MhpuLWe.exe
  C:\Windows\System\MhpuLWe.exe
  2⤵
  PID:13588
- C:\Windows\System\TBOOCih.exe
  C:\Windows\System\TBOOCih.exe
  2⤵
  PID:13604
- C:\Windows\System\SUHhNtS.exe
  C:\Windows\System\SUHhNtS.exe
  2⤵
  PID:13628
- C:\Windows\System\wgIwPPp.exe
  C:\Windows\System\wgIwPPp.exe
  2⤵
  PID:13652
- C:\Windows\System\UlLJXrE.exe
  C:\Windows\System\UlLJXrE.exe
  2⤵
  PID:13680
- C:\Windows\System\DvbPwka.exe
  C:\Windows\System\DvbPwka.exe
  2⤵
  PID:13716
- C:\Windows\System\ocUFVsQ.exe
  C:\Windows\System\ocUFVsQ.exe
  2⤵
  PID:13744
- C:\Windows\System\iWQJdAQ.exe
  C:\Windows\System\iWQJdAQ.exe
  2⤵
  PID:13772
- C:\Windows\System\OGYjSoQ.exe
  C:\Windows\System\OGYjSoQ.exe
  2⤵
  PID:13796
- C:\Windows\System\SqfEwYP.exe
  C:\Windows\System\SqfEwYP.exe
  2⤵
  PID:13828
- C:\Windows\System\IQRGiIV.exe
  C:\Windows\System\IQRGiIV.exe
  2⤵
  PID:13848
- C:\Windows\System\wDEqUKD.exe
  C:\Windows\System\wDEqUKD.exe
  2⤵
  PID:13880
- C:\Windows\System\zzQnSbf.exe
  C:\Windows\System\zzQnSbf.exe
  2⤵
  PID:13912
- C:\Windows\System\YivPMcf.exe
  C:\Windows\System\YivPMcf.exe
  2⤵
  PID:13940
- C:\Windows\System\RltYbjO.exe
  C:\Windows\System\RltYbjO.exe
  2⤵
  PID:13964
- C:\Windows\System\dIYBlrc.exe
  C:\Windows\System\dIYBlrc.exe
  2⤵
  PID:14000
- C:\Windows\System\LzTkYCV.exe
  C:\Windows\System\LzTkYCV.exe
  2⤵
  PID:14020
- C:\Windows\System\kEuZtvU.exe
  C:\Windows\System\kEuZtvU.exe
  2⤵
  PID:14048
- C:\Windows\System\mkgXMqt.exe
  C:\Windows\System\mkgXMqt.exe
  2⤵
  PID:14080
- C:\Windows\System\XkCqCMJ.exe
  C:\Windows\System\XkCqCMJ.exe
  2⤵
  PID:14104
- C:\Windows\System\zhaNojF.exe
  C:\Windows\System\zhaNojF.exe
  2⤵
  PID:14136
- C:\Windows\System\lJdLPpT.exe
  C:\Windows\System\lJdLPpT.exe
  2⤵
  PID:14156
- C:\Windows\System\pPChRAQ.exe
  C:\Windows\System\pPChRAQ.exe
  2⤵
  PID:14192
- C:\Windows\System\mVuRPMR.exe
  C:\Windows\System\mVuRPMR.exe
  2⤵
  PID:14212
- C:\Windows\System\OSlrBaJ.exe
  C:\Windows\System\OSlrBaJ.exe
  2⤵
  PID:14228
- C:\Windows\System\XslJieB.exe
  C:\Windows\System\XslJieB.exe
  2⤵
  PID:14252
- C:\Windows\System\NnLCypQ.exe
  C:\Windows\System\NnLCypQ.exe
  2⤵
  PID:14272
- C:\Windows\System\PtAuJNc.exe
  C:\Windows\System\PtAuJNc.exe
  2⤵
  PID:14308
- C:\Windows\System\NCtLMBA.exe
  C:\Windows\System\NCtLMBA.exe
  2⤵
  PID:14332
- C:\Windows\System\mplkprq.exe
  C:\Windows\System\mplkprq.exe
  2⤵
  PID:13088
- C:\Windows\System\eNdxJjB.exe
  C:\Windows\System\eNdxJjB.exe
  2⤵
  PID:12820
- C:\Windows\System\yEFqEpc.exe
  C:\Windows\System\yEFqEpc.exe
  2⤵
  PID:11928
- C:\Windows\System\hougmpl.exe
  C:\Windows\System\hougmpl.exe
  2⤵
  PID:13396
- C:\Windows\System\paQZsoE.exe
  C:\Windows\System\paQZsoE.exe
  2⤵
  PID:13516
- C:\Windows\System\FrBFvbX.exe
  C:\Windows\System\FrBFvbX.exe
  2⤵
  PID:13452
- C:\Windows\System\tIDLbst.exe
  C:\Windows\System\tIDLbst.exe
  2⤵
  PID:13600
- C:\Windows\System\ELFfUGg.exe
  C:\Windows\System\ELFfUGg.exe
  2⤵
  PID:13692
- C:\Windows\System\pUFSTrl.exe
  C:\Windows\System\pUFSTrl.exe
  2⤵
  PID:13724
- C:\Windows\System\UFbUypU.exe
  C:\Windows\System\UFbUypU.exe
  2⤵
  PID:13792
- C:\Windows\System\maicuCX.exe
  C:\Windows\System\maicuCX.exe
  2⤵
  PID:13904
- C:\Windows\System\YjtouNR.exe
  C:\Windows\System\YjtouNR.exe
  2⤵
  PID:13908
- C:\Windows\System\VHzvKKQ.exe
  C:\Windows\System\VHzvKKQ.exe
  2⤵
  PID:13920
- C:\Windows\System\uwzuDuB.exe
  C:\Windows\System\uwzuDuB.exe
  2⤵
  PID:14116
- C:\Windows\System\gxalptv.exe
  C:\Windows\System\gxalptv.exe
  2⤵
  PID:14096
- C:\Windows\System\SFMORdQ.exe
  C:\Windows\System\SFMORdQ.exe
  2⤵
  PID:14068
- C:\Windows\System\sZeOOui.exe
  C:\Windows\System\sZeOOui.exe
  2⤵
  PID:14284
- C:\Windows\System\cDIiZHg.exe
  C:\Windows\System\cDIiZHg.exe
  2⤵
  PID:14260
- C:\Windows\System\iwuPtMs.exe
  C:\Windows\System\iwuPtMs.exe
  2⤵
  PID:14240
- C:\Windows\System\CrSCWpm.exe
  C:\Windows\System\CrSCWpm.exe
  2⤵
  PID:13224
- C:\Windows\System\FuthXLp.exe
  C:\Windows\System\FuthXLp.exe
  2⤵
  PID:12788
- C:\Windows\System\iwNcVLy.exe
  C:\Windows\System\iwNcVLy.exe
  2⤵
  PID:11460
- C:\Windows\System\YOilRxC.exe
  C:\Windows\System\YOilRxC.exe
  2⤵
  PID:13840
- C:\Windows\System\ineXynH.exe
  C:\Windows\System\ineXynH.exe
  2⤵
  PID:13808
- C:\Windows\System\YDsxlmA.exe
  C:\Windows\System\YDsxlmA.exe
  2⤵
  PID:13424
- C:\Windows\System\OEWCNjZ.exe
  C:\Windows\System\OEWCNjZ.exe
  2⤵
  PID:13956
- C:\Windows\System\tFKndnX.exe
  C:\Windows\System\tFKndnX.exe
  2⤵
  PID:14340
- C:\Windows\System\RILAdPn.exe
  C:\Windows\System\RILAdPn.exe
  2⤵
  PID:14360
- C:\Windows\System\DDctjep.exe
  C:\Windows\System\DDctjep.exe
  2⤵
  PID:14388
- C:\Windows\System\ioaPoOS.exe
  C:\Windows\System\ioaPoOS.exe
  2⤵
  PID:14416
- C:\Windows\System\FZpECwj.exe
  C:\Windows\System\FZpECwj.exe
  2⤵
  PID:14436
- C:\Windows\System\TCasYWP.exe
  C:\Windows\System\TCasYWP.exe
  2⤵
  PID:14468
- C:\Windows\System\kQRobCs.exe
  C:\Windows\System\kQRobCs.exe
  2⤵
  PID:14488
- C:\Windows\System\OypXhvx.exe
  C:\Windows\System\OypXhvx.exe
  2⤵
  PID:14504
- C:\Windows\System\ZtYBUoW.exe
  C:\Windows\System\ZtYBUoW.exe
  2⤵
  PID:14532
- C:\Windows\System\XbVKtwO.exe
  C:\Windows\System\XbVKtwO.exe
  2⤵
  PID:14568
- C:\Windows\System\lOBrYDr.exe
  C:\Windows\System\lOBrYDr.exe
  2⤵
  PID:14592
- C:\Windows\System\cUJXuSO.exe
  C:\Windows\System\cUJXuSO.exe
  2⤵
  PID:14616
- C:\Windows\System\GcTWMIS.exe
  C:\Windows\System\GcTWMIS.exe
  2⤵
  PID:14640
- C:\Windows\System\LejBwcp.exe
  C:\Windows\System\LejBwcp.exe
  2⤵
  PID:14664
- C:\Windows\System\ngWzGTS.exe
  C:\Windows\System\ngWzGTS.exe
  2⤵
  PID:14688
- C:\Windows\System\NJwLIaO.exe
  C:\Windows\System\NJwLIaO.exe
  2⤵
  PID:14720
- C:\Windows\System\TgeUMBl.exe
  C:\Windows\System\TgeUMBl.exe
  2⤵
  PID:14756
- C:\Windows\System\tAdaxrJ.exe
  C:\Windows\System\tAdaxrJ.exe
  2⤵
  PID:14772
- C:\Windows\System\fxSaIip.exe
  C:\Windows\System\fxSaIip.exe
  2⤵
  PID:14796
- C:\Windows\System\ItqUgPn.exe
  C:\Windows\System\ItqUgPn.exe
  2⤵
  PID:14820
- C:\Windows\System\jloOtiY.exe
  C:\Windows\System\jloOtiY.exe
  2⤵
  PID:14852
- C:\Windows\System\IMQuwWL.exe
  C:\Windows\System\IMQuwWL.exe
  2⤵
  PID:14868
- C:\Windows\System\YUlkYSD.exe
  C:\Windows\System\YUlkYSD.exe
  2⤵
  PID:14888
- C:\Windows\System\nqFDvyM.exe
  C:\Windows\System\nqFDvyM.exe
  2⤵
  PID:14920
- C:\Windows\System\mBtxiUO.exe
  C:\Windows\System\mBtxiUO.exe
  2⤵
  PID:14944
- C:\Windows\System\lXyWsVg.exe
  C:\Windows\System\lXyWsVg.exe
  2⤵
  PID:14968
- C:\Windows\System\dJZKibG.exe
  C:\Windows\System\dJZKibG.exe
  2⤵
  PID:14996
- C:\Windows\System\chPmSiu.exe
  C:\Windows\System\chPmSiu.exe
  2⤵
  PID:15012
- C:\Windows\System\EuSKyCn.exe
  C:\Windows\System\EuSKyCn.exe
  2⤵
  PID:15036
- C:\Windows\System\dLjDxQH.exe
  C:\Windows\System\dLjDxQH.exe
  2⤵
  PID:15072
- C:\Windows\System\kZtjtWF.exe
  C:\Windows\System\kZtjtWF.exe
  2⤵
  PID:15088
- C:\Windows\System\yISvlwg.exe
  C:\Windows\System\yISvlwg.exe
  2⤵
  PID:15112
- C:\Windows\System\LhBWGVM.exe
  C:\Windows\System\LhBWGVM.exe
  2⤵
  PID:15136
- C:\Windows\System\cWzpYWH.exe
  C:\Windows\System\cWzpYWH.exe
  2⤵
  PID:15160
- C:\Windows\System\oABwtPo.exe
  C:\Windows\System\oABwtPo.exe
  2⤵
  PID:15204
- C:\Windows\System\hNIIjos.exe
  C:\Windows\System\hNIIjos.exe
  2⤵
  PID:15232
- C:\Windows\System\QhcEVph.exe
  C:\Windows\System\QhcEVph.exe
  2⤵
  PID:15248
- C:\Windows\System\rZugXYm.exe
  C:\Windows\System\rZugXYm.exe
  2⤵
  PID:15288
- C:\Windows\System\XYtKAgZ.exe
  C:\Windows\System\XYtKAgZ.exe
  2⤵
  PID:15308
- C:\Windows\System\YFFCQno.exe
  C:\Windows\System\YFFCQno.exe
  2⤵
  PID:15336
- C:\Windows\System\iRKbXky.exe
  C:\Windows\System\iRKbXky.exe
  2⤵
  PID:14348
- C:\Windows\System\vvDBvKu.exe
  C:\Windows\System\vvDBvKu.exe
  2⤵
  PID:14408
- C:\Windows\System\Sdtdekh.exe
  C:\Windows\System\Sdtdekh.exe
  2⤵
  PID:14424
- C:\Windows\System\ZITHHNP.exe
  C:\Windows\System\ZITHHNP.exe
  2⤵
  PID:14548
- C:\Windows\System\STdcVBt.exe
  C:\Windows\System\STdcVBt.exe
  2⤵
  PID:14576
- C:\Windows\System\sEdgfol.exe
  C:\Windows\System\sEdgfol.exe
  2⤵
  PID:14584
- C:\Windows\System\HOkDwwr.exe
  C:\Windows\System\HOkDwwr.exe
  2⤵
  PID:14636
- C:\Windows\System\EfDEtZw.exe
  C:\Windows\System\EfDEtZw.exe
  2⤵
  PID:14684
- C:\Windows\System\FdDEcVF.exe
  C:\Windows\System\FdDEcVF.exe
  2⤵
  PID:14732
- C:\Windows\System\XDNnnAm.exe
  C:\Windows\System\XDNnnAm.exe
  2⤵
  PID:14780
- C:\Windows\System\cbiKEcj.exe
  C:\Windows\System\cbiKEcj.exe
  2⤵
  PID:14936
- C:\Windows\System\SsmGVJH.exe
  C:\Windows\System\SsmGVJH.exe
  2⤵
  PID:14884
- C:\Windows\System\ewjaJDB.exe
  C:\Windows\System\ewjaJDB.exe
  2⤵
  PID:15004
- C:\Windows\System\WstbQGz.exe
  C:\Windows\System\WstbQGz.exe
  2⤵
  PID:15100
- C:\Windows\System\crfbwMJ.exe
  C:\Windows\System\crfbwMJ.exe
  2⤵
  PID:15184
- C:\Windows\System\PAvQhWK.exe
  C:\Windows\System\PAvQhWK.exe
  2⤵
  PID:15244
- C:\Windows\System\CwlpWco.exe
  C:\Windows\System\CwlpWco.exe
  2⤵
  PID:15264
- C:\Windows\System\eYrReGf.exe
  C:\Windows\System\eYrReGf.exe
  2⤵
  PID:15284
- C:\Windows\System\FJqRtmG.exe
  C:\Windows\System\FJqRtmG.exe
  2⤵
  PID:14480
- C:\Windows\System\COcExIY.exe
  C:\Windows\System\COcExIY.exe
  2⤵
  PID:14460
- C:\Windows\System\hHtRDvr.exe
  C:\Windows\System\hHtRDvr.exe
  2⤵
  PID:14608
- C:\Windows\System\eZLtmZm.exe
  C:\Windows\System\eZLtmZm.exe
  2⤵
  PID:14916
- C:\Windows\System\SslOeFc.exe
  C:\Windows\System\SslOeFc.exe
  2⤵
  PID:14560
- C:\Windows\System\ySjehpX.exe
  C:\Windows\System\ySjehpX.exe
  2⤵
  PID:15328
- C:\Windows\System\sFwVLty.exe
  C:\Windows\System\sFwVLty.exe
  2⤵
  PID:14520
- C:\Windows\System\vXcCpbh.exe
  C:\Windows\System\vXcCpbh.exe
  2⤵
  PID:14992
- C:\Windows\System\FkkJZQF.exe
  C:\Windows\System\FkkJZQF.exe
  2⤵
  PID:15384
- C:\Windows\System\NkZYxLx.exe
  C:\Windows\System\NkZYxLx.exe
  2⤵
  PID:15404
- C:\Windows\System\AVFwVud.exe
  C:\Windows\System\AVFwVud.exe
  2⤵
  PID:15424
- C:\Windows\System\wvVvIsd.exe
  C:\Windows\System\wvVvIsd.exe
  2⤵
  PID:15444
- C:\Windows\System\luwyjnS.exe
  C:\Windows\System\luwyjnS.exe
  2⤵
  PID:15464
- C:\Windows\System\YRonZHg.exe
  C:\Windows\System\YRonZHg.exe
  2⤵
  PID:15492
- C:\Windows\System\IpuchvC.exe
  C:\Windows\System\IpuchvC.exe
  2⤵
  PID:15516
- C:\Windows\System\DUTlujN.exe
  C:\Windows\System\DUTlujN.exe
  2⤵
  PID:15552
- C:\Windows\System\SjQKPWS.exe
  C:\Windows\System\SjQKPWS.exe
  2⤵
  PID:15576
- C:\Windows\System\GpbysRj.exe
  C:\Windows\System\GpbysRj.exe
  2⤵
  PID:15600
- C:\Windows\System\EtsGvQZ.exe
  C:\Windows\System\EtsGvQZ.exe
  2⤵
  PID:15624
- C:\Windows\System\UfTTaiL.exe
  C:\Windows\System\UfTTaiL.exe
  2⤵
  PID:15652
- C:\Windows\System\XbmWSCG.exe
  C:\Windows\System\XbmWSCG.exe
  2⤵
  PID:15676
- C:\Windows\System\jtZxnXI.exe
  C:\Windows\System\jtZxnXI.exe
  2⤵
  PID:15700
- C:\Windows\System\YfbNINg.exe
  C:\Windows\System\YfbNINg.exe
  2⤵
  PID:15736
- C:\Windows\System\LYYpHeu.exe
  C:\Windows\System\LYYpHeu.exe
  2⤵
  PID:15764
- C:\Windows\System\zxVJgFg.exe
  C:\Windows\System\zxVJgFg.exe
  2⤵
  PID:15796
- C:\Windows\System\snrimVc.exe
  C:\Windows\System\snrimVc.exe
  2⤵
  PID:15828
- C:\Windows\System\jdetJKo.exe
  C:\Windows\System\jdetJKo.exe
  2⤵
  PID:15852
- C:\Windows\System\YNCiDuV.exe
  C:\Windows\System\YNCiDuV.exe
  2⤵
  PID:15880
- C:\Windows\System\NFxdnEq.exe
  C:\Windows\System\NFxdnEq.exe
  2⤵
  PID:15912
- C:\Windows\System\yFqgxNC.exe
  C:\Windows\System\yFqgxNC.exe
  2⤵
  PID:15952
- C:\Windows\System\NbmLbsl.exe
  C:\Windows\System\NbmLbsl.exe
  2⤵
  PID:15972
- C:\Windows\System\XALvAbH.exe
  C:\Windows\System\XALvAbH.exe
  2⤵
  PID:15996
- C:\Windows\System\VNoVgsW.exe
  C:\Windows\System\VNoVgsW.exe
  2⤵
  PID:16024
- C:\Windows\System\Zaqmwdh.exe
  C:\Windows\System\Zaqmwdh.exe
  2⤵
  PID:16052
- C:\Windows\System\NKDpOHv.exe
  C:\Windows\System\NKDpOHv.exe
  2⤵
  PID:16072
- C:\Windows\System\CZsyjaP.exe
  C:\Windows\System\CZsyjaP.exe
  2⤵
  PID:16088
- C:\Windows\System\dETCNzS.exe
  C:\Windows\System\dETCNzS.exe
  2⤵
  PID:16112
- C:\Windows\System\cuNEIvs.exe
  C:\Windows\System\cuNEIvs.exe
  2⤵
  PID:16140
- C:\Windows\System\DNXsCEs.exe
  C:\Windows\System\DNXsCEs.exe
  2⤵
  PID:16164
- C:\Windows\System\SIrPGLF.exe
  C:\Windows\System\SIrPGLF.exe
  2⤵
  PID:16188
- C:\Windows\System\fVpdJix.exe
  C:\Windows\System\fVpdJix.exe
  2⤵
  PID:16208
- C:\Windows\System\DLkjYsZ.exe
  C:\Windows\System\DLkjYsZ.exe
  2⤵
  PID:16232
- C:\Windows\System\ayAZDut.exe
  C:\Windows\System\ayAZDut.exe
  2⤵
  PID:16264
- C:\Windows\System\DYPCLlu.exe
  C:\Windows\System\DYPCLlu.exe
  2⤵
  PID:16288
- C:\Windows\System\WlTwwpf.exe
  C:\Windows\System\WlTwwpf.exe
  2⤵
  PID:16312
- C:\Windows\System\GXGmVTD.exe
  C:\Windows\System\GXGmVTD.exe
  2⤵
  PID:16340
- C:\Windows\System\wbWFoHV.exe
  C:\Windows\System\wbWFoHV.exe
  2⤵
  PID:16376
- C:\Windows\System\BBNGnOn.exe
  C:\Windows\System\BBNGnOn.exe
  2⤵
  PID:15180
- C:\Windows\System\fEWular.exe
  C:\Windows\System\fEWular.exe
  2⤵
  PID:14764
- C:\Windows\System\MQgzvVC.exe
  C:\Windows\System\MQgzvVC.exe
  2⤵
  PID:14804
- C:\Windows\System\Bntculc.exe
  C:\Windows\System\Bntculc.exe
  2⤵
  PID:15392
- C:\Windows\System\fhUCcww.exe
  C:\Windows\System\fhUCcww.exe
  2⤵
  PID:15616
- C:\Windows\System\yvBwztl.exe
  C:\Windows\System\yvBwztl.exe
  2⤵
  PID:15500
- C:\Windows\System\ADBnyEX.exe
  C:\Windows\System\ADBnyEX.exe
  2⤵
  PID:15396
- C:\Windows\System\TIgNiVR.exe
  C:\Windows\System\TIgNiVR.exe
  2⤵
  PID:15836
- C:\Windows\System\WiTKeUq.exe
  C:\Windows\System\WiTKeUq.exe
  2⤵
  PID:15724
- C:\Windows\System\dHZhaIH.exe
  C:\Windows\System\dHZhaIH.exe
  2⤵
  PID:15756
- C:\Windows\System\lYhgvaC.exe
  C:\Windows\System\lYhgvaC.exe
  2⤵
  PID:15992
- C:\Windows\System\UZlTIqY.exe
  C:\Windows\System\UZlTIqY.exe
  2⤵
  PID:15808
- C:\Windows\System\ZTBOPBk.exe
  C:\Windows\System\ZTBOPBk.exe
  2⤵
  PID:16020
- C:\Windows\System\CDNPwqt.exe
  C:\Windows\System\CDNPwqt.exe
  2⤵
  PID:15936
- C:\Windows\System\aGqBBZU.exe
  C:\Windows\System\aGqBBZU.exe
  2⤵
  PID:16360
- C:\Windows\System\IHMBUPG.exe
  C:\Windows\System\IHMBUPG.exe
  2⤵
  PID:14744
- C:\Windows\System\vbNEtWo.exe
  C:\Windows\System\vbNEtWo.exe
  2⤵
  PID:16180
- C:\Windows\System\YLTiLvR.exe
  C:\Windows\System\YLTiLvR.exe
  2⤵
  PID:16332
- C:\Windows\System\kzLZNAg.exe
  C:\Windows\System\kzLZNAg.exe
  2⤵
  PID:15812
- C:\Windows\System\HCZEDgX.exe
  C:\Windows\System\HCZEDgX.exe
  2⤵
  PID:14444
- C:\Windows\System\wXjwmwa.exe
  C:\Windows\System\wXjwmwa.exe
  2⤵
  PID:15368
- C:\Windows\System\ZcPOeJI.exe
  C:\Windows\System\ZcPOeJI.exe
  2⤵
  PID:16392
- C:\Windows\System\GSbpXKF.exe
  C:\Windows\System\GSbpXKF.exe
  2⤵
  PID:16412
- C:\Windows\System\pcxHVtj.exe
  C:\Windows\System\pcxHVtj.exe
  2⤵
  PID:16436
- C:\Windows\System\RYrnLEr.exe
  C:\Windows\System\RYrnLEr.exe
  2⤵
  PID:16468
- C:\Windows\System\OEUKfcP.exe
  C:\Windows\System\OEUKfcP.exe
  2⤵
  PID:16492
- C:\Windows\System\GwXyibk.exe
  C:\Windows\System\GwXyibk.exe
  2⤵
  PID:16508
- C:\Windows\System\NQuWLYQ.exe
  C:\Windows\System\NQuWLYQ.exe
  2⤵
  PID:16524
- C:\Windows\System\gUIIwMv.exe
  C:\Windows\System\gUIIwMv.exe
  2⤵
  PID:16552
- C:\Windows\System\weZvlIB.exe
  C:\Windows\System\weZvlIB.exe
  2⤵
  PID:16580
- C:\Windows\System\DeMDEbr.exe
  C:\Windows\System\DeMDEbr.exe
  2⤵
  PID:16608
- C:\Windows\System\ZYVoZMM.exe
  C:\Windows\System\ZYVoZMM.exe
  2⤵
  PID:16636
- C:\Windows\System\AmGklBw.exe
  C:\Windows\System\AmGklBw.exe
  2⤵
  PID:16668
- C:\Windows\System\ZUvVSUb.exe
  C:\Windows\System\ZUvVSUb.exe
  2⤵
  PID:16700
- C:\Windows\System\mloSHiz.exe
  C:\Windows\System\mloSHiz.exe
  2⤵
  PID:16716
- C:\Windows\System\iNLSJBR.exe
  C:\Windows\System\iNLSJBR.exe
  2⤵
  PID:16740
- C:\Windows\System\QcKVFnn.exe
  C:\Windows\System\QcKVFnn.exe
  2⤵
  PID:16768
- C:\Windows\System\AYUpdOJ.exe
  C:\Windows\System\AYUpdOJ.exe
  2⤵
  PID:16784
- C:\Windows\System\BiDtIBu.exe
  C:\Windows\System\BiDtIBu.exe
  2⤵
  PID:16820
- C:\Windows\System\CaLLdud.exe
  C:\Windows\System\CaLLdud.exe
  2⤵
  PID:16844
- C:\Windows\System\jShjDtH.exe
  C:\Windows\System\jShjDtH.exe
  2⤵
  PID:16868
- C:\Windows\System\SkMeESK.exe
  C:\Windows\System\SkMeESK.exe
  2⤵
  PID:16888
- C:\Windows\System\eibapiG.exe
  C:\Windows\System\eibapiG.exe
  2⤵
  PID:16960
- C:\Windows\System\MMBkfXA.exe
  C:\Windows\System\MMBkfXA.exe
  2⤵
  PID:16980
- C:\Windows\System\yPtruEw.exe
  C:\Windows\System\yPtruEw.exe
  2⤵
  PID:17016
- C:\Windows\System\DIOlBzB.exe
  C:\Windows\System\DIOlBzB.exe
  2⤵
  PID:17044
- C:\Windows\System\eKcZtkM.exe
  C:\Windows\System\eKcZtkM.exe
  2⤵
  PID:17060
- C:\Windows\System\fxrpRJF.exe
  C:\Windows\System\fxrpRJF.exe
  2⤵
  PID:17076
- C:\Windows\System\uQmcWOS.exe
  C:\Windows\System\uQmcWOS.exe
  2⤵
  PID:17116
- C:\Windows\System\TKjRCgE.exe
  C:\Windows\System\TKjRCgE.exe
  2⤵
  PID:17140
- C:\Windows\System\pEccKei.exe
  C:\Windows\System\pEccKei.exe
  2⤵
  PID:17172
- C:\Windows\System\boyQAZY.exe
  C:\Windows\System\boyQAZY.exe
  2⤵
  PID:17204
- C:\Windows\System\uPciGWw.exe
  C:\Windows\System\uPciGWw.exe
  2⤵
  PID:17252
- C:\Windows\System\eVKQtpc.exe
  C:\Windows\System\eVKQtpc.exe
  2⤵
  PID:17280
- C:\Windows\System\zTJgGnT.exe
  C:\Windows\System\zTJgGnT.exe
  2⤵
  PID:17320
- C:\Windows\System\pwwrjdW.exe
  C:\Windows\System\pwwrjdW.exe
  2⤵
  PID:17348
- C:\Windows\System\VwAIWje.exe
  C:\Windows\System\VwAIWje.exe
  2⤵
  PID:17388
- C:\Windows\System\tusWWLT.exe
  C:\Windows\System\tusWWLT.exe
  2⤵
  PID:15892
- C:\Windows\System\IVZHGfn.exe
  C:\Windows\System\IVZHGfn.exe
  2⤵
  PID:15412
- C:\Windows\System\JGXhAyx.exe
  C:\Windows\System\JGXhAyx.exe
  2⤵
  PID:14356
- C:\Windows\System\yPLaYMY.exe
  C:\Windows\System\yPLaYMY.exe
  2⤵
  PID:16224
- C:\Windows\System\owPlgjx.exe
  C:\Windows\System\owPlgjx.exe
  2⤵
  PID:16040
- C:\Windows\System\BdpcliA.exe
  C:\Windows\System\BdpcliA.exe
  2⤵
  PID:16660
- C:\Windows\System\qccDRKn.exe
  C:\Windows\System\qccDRKn.exe
  2⤵
  PID:16692
- C:\Windows\System\BYzOBnG.exe
  C:\Windows\System\BYzOBnG.exe
  2⤵
  PID:16752
- C:\Windows\System\goqUUcK.exe
  C:\Windows\System\goqUUcK.exe
  2⤵
  PID:16572
- C:\Windows\System\WsFCCyZ.exe
  C:\Windows\System\WsFCCyZ.exe
  2⤵
  PID:16840
- C:\Windows\System\fnUroyo.exe
  C:\Windows\System\fnUroyo.exe
  2⤵
  PID:17008
- C:\Windows\System\VnzZZWU.exe
  C:\Windows\System\VnzZZWU.exe
  2⤵
  PID:17128
- C:\Windows\System\MlbIsMM.exe
  C:\Windows\System\MlbIsMM.exe
  2⤵
  PID:16936

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:17376

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\AdzcelM.exe

Filesize
1.6MB

MD5
c99afc028ce8d30bd78072ccfc70e4a9

SHA1
a7d9d1f404eac96186585c4f1c6adc879132a4e7

SHA256
f304df777da79b09bbbcf01f313322c8a643e3e50a7456344e8ef15731b21f04

SHA512
2fb3a81dff60b1c7e202aa904a5a10ad2dbb904e497b91f26f6fb046c63c7fab52fe5b06efedbbe8561595c4dd52fb63afea1912d696606b6f3a65f02aa227eb

Download Submit
C:\Windows\System\AeYxBAM.exe

Filesize
1.6MB

MD5
72ad005181b87507d9f3b455b9f35032

SHA1
96ed8a1ffd2b39cd9e33d87d4432f23d2bc88754

SHA256
e7fe5b7f7a93410315b6efca2b499a872a5c70d6965ccaf01e667b780c937baa

SHA512
4871fbc38ca96829345f8f60151bd5f4f71e670c6c9357f5c9c224aea52e56e2bb16d7341aedb43017127ef569f2241987494e89ff58dee75ff3dad0440413ba

Download Submit
C:\Windows\System\AhKiktS.exe

Filesize
1.6MB

MD5
53b998ada37e0d011dcd4c2ea819a5a8

SHA1
1ca679bb7d07d4ce3cb8629cf3841a8b7540b0f6

SHA256
b62634630953fb14a4546344a6b24fc68b742886dca7100b47d4e334e9a5f6ca

SHA512
9ddd6c0dc5af593fec11279dda0cac06135661c8d50a33154582958c0b4b290d56b79a63b89e9b3bd538e43f0ea6800ccff287299b5d8e62ab0cabd502a0d79f

Download Submit
C:\Windows\System\CRuDiyg.exe

Filesize
1.6MB

MD5
c2bd202635d40fd62e595860ec9b4524

SHA1
724ce7399ce005b765c7f37ef25ab1d22e59ac3e

SHA256
28f512a36fff96b6236bd75037990550e4d4b9c34be20618aab7452d5ad6eb7e

SHA512
591059857ad152ebe970378f9b5984b66562277dd31404627af4672a10368356831f0eda89385b4b7cac36923ab1f9353aacf4757da9cd02d59db6ef1f98541a

Download Submit
C:\Windows\System\DDZjjkK.exe

Filesize
1.6MB

MD5
23d5678aa7168e1dbf468321f018deed

SHA1
d593847a4aa8922732b4fdc508953a63a2b56014

SHA256
060400c966644191c5799f2c8b752ac80338d9556e79b61b8c2614f88ff2f821

SHA512
8d638f02127ea1d5bec13e6552e9a67594d0ccdad1751b84d02554c41f0b5eac467055cca41d57ab022bbf6311ef81adbb1b4a50f8d898f3959dea911a134557

Download Submit
C:\Windows\System\GBSKoIP.exe

Filesize
1.6MB

MD5
beaad7b4593dfc8560f80b4793880bb8

SHA1
1389fcd2d458d1edd6367149eea07111f7fcb5b4

SHA256
e6b782690053b0f810c924e16c9f98067038725efbfe8be9313a1c2fe3fac4cf

SHA512
d861f53746169747c101e6f56a026c6f13ea71721d8a379e2da8d0cd193560edf396ef0d3d82432f76c98030e2262e914b2c32500f9160469bdc9496490cc996

Download Submit
C:\Windows\System\HvaqLwh.exe

Filesize
1.6MB

MD5
ae2b883d1eed717c8a4798b8356d8853

SHA1
ca7c6cc1acf3051480740d016d6ce4159bf08cb5

SHA256
0b627916cc6b53da1d20695380f2a5fd3804a1da8b0bc56d68bdc0f9e6bc10a4

SHA512
6118a6dac397fad75d79fe8765c40f3c78e67681ad258b5e0dc8aa12bc6b2391fda9e72cf7825ceb677d4bfb8e49ca3f048c823e0836a6b108b84610ae84a435

Download Submit
C:\Windows\System\KRafFgt.exe

Filesize
1.6MB

MD5
a3585c4cb8b6349a38585dd49a856dcd

SHA1
62f615c57200c6e9fdad72d3143b25ce1ac8c750

SHA256
8df91999292da3ae3b04170d72b718ab97f61f3f8c5fea239a755abf48615e0a

SHA512
78819e55befeeb515ec58260d72a63e91c12d291f76d5c7bdf50b43cdd95253fba641bd807fd77315c140b2862ec87d626efc3a54e7417b0249cf05fdc75732c

Download Submit
C:\Windows\System\KZyhcbM.exe

Filesize
1.6MB

MD5
0b44bd9b4dfe7a40e9876c7ed331624d

SHA1
62d6adee2f4271649c75cf456ae615ccdbc291cd

SHA256
16a1bcb15b34538c4da98a626a62f3868d283dd1ba506ef37aaf2c0c9485f27c

SHA512
b9a44edb146a784b86c88c39bc7515490184b59d0078c7ce65ded3f3a9ca7b0c873c998c1092616f9372fdb0fe303581095ff62b4de21d7232839c689da9cca1

Download Submit
C:\Windows\System\LLuLPNN.exe

Filesize
1.6MB

MD5
fa43259b58192bb3301956a05f79724b

SHA1
f7d12f31e31bfac1b9b90739030e3e06658f4cdb

SHA256
b0aa5c91a35aaff1c3da21647feaee45598ae709d7b6a28ef9b6ca6cf754e0b8

SHA512
78c588d19291a1cd41d2b24689364045d60873d1d791fcef34670b4d2ae7ca7ead3e1d8a86b4d8e795e091f6094a7bb0e263b3998571e956f0ad9078bec8a2dd

Download Submit
C:\Windows\System\PtBKKzR.exe

Filesize
1.6MB

MD5
953f2b21b60a5bd2bfc38b3d022d99cf

SHA1
0030f86b9fe3d6ab2e87c0a36068e9b9a82c2925

SHA256
ef34add8732b32a9556dd73eb843fb84c8d7a43697ff37365142c34494a63a3b

SHA512
2df9564d4bdcb2e353a4a180edd253fa2df596592214fdcaf7c9cd2fa0e07f35a62e71594c3cc92ad256559877ed715772d98a4ffb3d6aa4db5e60119b3115e6

Download Submit
C:\Windows\System\QYJwRxX.exe

Filesize
1.6MB

MD5
108230ea151b81be652ccd3188755359

SHA1
f5f44e5cc51d5054e877cdab63c7cebcdb5a16e2

SHA256
19c2496db81f059ea2d89107b50999ccbf2bf8f7530197e1abadb713cd1e0468

SHA512
9b3ce2fa9218f65bdcc1d1e6c53a376d5d51d99956481422779877f88dd442253b1e3cb79bca3ab5ee51a1508c44bb20cb6d689e7f0d6619a405bffd38f9da59

Download Submit
C:\Windows\System\RMnuThZ.exe

Filesize
1.6MB

MD5
480211ceb3dac53645a10484cadd5d86

SHA1
3ee4abf2c4d51b6a555b72ba10e42980a489a180

SHA256
d2665f2cc90d94a2443dcbe618a136a5e0e7ccfb306419d1354d74c3bffb7700

SHA512
085fb5d7b5416f4e97dcf14cd89a0afe1975fa9415f0da5935465ee52622cec9b5180a2689279d3c82b95ad5c7e3b96aa9ecb0897b9cb2d48a68eddd3a0a224d

Download Submit
C:\Windows\System\UyAxQOJ.exe

Filesize
1.6MB

MD5
ce9268cd51565db0865d93ae0313430a

SHA1
eb51f07fcd70529081924d4f1bf01381306c07b1

SHA256
88169d8b19cca3883615540ad0d7219849bd4f5762bb1f3335b33976fa4b84fc

SHA512
35abd32c8336c9ef1fccc2ebaf5fefbdd56a693fe2d1e802277cf2f7000b1051774126d6de443746b06d5024f6ed730007896459fd18001130b959f5def4bd68

Download Submit
C:\Windows\System\WTUiPDd.exe

Filesize
1.6MB

MD5
71f395d3ee28367419796862d03ec3d4

SHA1
7c07068374986291022f6dce1fcd76dd92729f2b

SHA256
90f301cc5d5d6ea724910ef771a7d03d78fa33768919b83650f6ff95a499a2d1

SHA512
5280f96f191c3cb43c0b2f8c8f4c6814140962533b72e7140517f21e04488fd6d060c1c6409dfbd820431935efb588f3e1ee04eb2f1065081bdf8a84f8d8ef62

Download Submit
C:\Windows\System\WbLHAVi.exe

Filesize
1.6MB

MD5
fb0c65b503f48b50b84cf86831655403

SHA1
75bf0f72a87212374e181e059c1ea8d3c9a5eca0

SHA256
26c8b8e58d8cb3ae690f5d45c7fea012ffb8f01a7e94e1062145cadd1fb9dadd

SHA512
5c4f739c6ba2090106fe1ba8e5791781ba3fb072006666853a6f31b58bbfa17118bd7f5b27ca35f56adf3f3c36d9b69dc40926a996846bb6879158b475efeca6

Download Submit
C:\Windows\System\WkJzoQX.exe

Filesize
1.6MB

MD5
2504227c57d08ec07af458963dff7d4a

SHA1
87ca44d4f3f3dc85d71c27ee8296b967c14abaf7

SHA256
ecb7f3e7740258125d4e25be6345504cd58f2716fc4b42350d80406d992cec16

SHA512
b674c6b550ba333bb847a6abdff55a8ea94d64efbe3c73c1886c7807daf407a0f9b1d2d646fb2fc075be48272d2221208ff22abf490a253882966c5885d40f7a

Download Submit
C:\Windows\System\XpFvqwa.exe

Filesize
1.6MB

MD5
3185e476b0f870bae1ba81036ef62a55

SHA1
ef279146b6fc2ec13bae60d709ff181b8bc6e9c5

SHA256
5e7bfd9d0c16b0b5ebc3ce7a547f0b665479403b1ab9af7e753e6e8ae53dd021

SHA512
82dbd0a2f63b205de2786e4fe4804f9820f0f16419992398c7881e6784c05367e8b65b53689464edc7cb50d7cf1603324ce1ba300316a3b4377eb38eed190f7b

Download Submit
C:\Windows\System\YqZdMhX.exe

Filesize
1.6MB

MD5
cd51c6bfb15ed726fefdb573e14ecf54

SHA1
6ec1e8abd8c6613eadae361a73a15b8bf85ddec7

SHA256
de0c187fb1045fa927fa97845b2dbdacf34e773e9dc27e47abefd39560474303

SHA512
590a8cf6e27599b1295b0c0b03b98a7a1d5f811e37800eda4213219c4d70eddac20ccdc10229170b673de1fa70c5a030acfa89177b83e066b24fee064f7cfc01

Download Submit
C:\Windows\System\ZAMqXBp.exe

Filesize
1.6MB

MD5
c0bfaf41edaa8f93ea7f21d5e5d17c4c

SHA1
e58e91f02455a716487db9b7cbed5e028ba86c0d

SHA256
4e4f3af582ee912c9ef9533d7f38fea45754f46131a743b26f99f35f1733bcd3

SHA512
2a53843aca7cd4f8aed5f739a8e5e5838002f6c27b5a211567b1b156ca58a3fc5e0d0b30f621314191e6a6136d7f6b4efb2db365b0fab77d2d158a5acb748a9f

Download Submit
C:\Windows\System\cVXalLp.exe

Filesize
1.6MB

MD5
82eaa479b4316e33ba74f05a5a09b010

SHA1
339d66f7a57b86ca7f7bfc0e62ada5fb97e8e300

SHA256
cd31703b0f01614572ff104b80c5440e6a621a761c7825a10b0168ef36b15782

SHA512
b14fa5f945b8e385d2289470b7a0d56b41227334d9ec6e6c49d6f1add71a94c7e26e29fa5c8fda9a35bc4f8173c5c6a806038bb913fbe9eb59b7fd3f37f25f32

Download Submit
C:\Windows\System\dRInWkx.exe

Filesize
1.6MB

MD5
fbf924ae972f69fdf36851594a2d359f

SHA1
560012f4e6aa88f5bedd5c468be839d81522c1ac

SHA256
4ba06187427958c45f94f891abce801efca5d1672b881ef24fa9c44a1370b329

SHA512
0407e39c503b119baae6c73d8454e751809d5b134d7bd76eb7c8957d05ff1be29b0b00c28146130f76938e88723ea1749dd4092a057d1dbbb68eaee4b2213974

Download Submit
C:\Windows\System\eBWGgfz.exe

Filesize
1.6MB

MD5
c00ad598ec97df36504245927d58588c

SHA1
139b4b5963121de69af805c95a775f037522b223

SHA256
7500788d8f92bd9f7959e27234b633da8549a773f9dfabe182c76c996fe993a6

SHA512
c5c31c5331cdec0d1a94127888561124308767e26984694fcdfdefd0fc5985b0cbcfdaa2994175f3ef374bf15e85fef351729e193431d8604c6bf1f089ce670f

Download Submit
C:\Windows\System\gxQVzdo.exe

Filesize
1.6MB

MD5
ad0c1698ba3f13d8f4714c9d8881ca27

SHA1
4b6ee54a16a5be4d86ce5c193912f0cf7b81b5bb

SHA256
3364895856c7638d3c290c6c2d3d4359a9f023f61063dfd8d44f264fc6aff215

SHA512
9220b5095de583fe008ee7e44018fbb296cb5fa6bc6241e5923e0d36845d13478adb093a70b6599d08e762b9ed816af469060b4e1ac29340114f19238671ad5d

Download Submit
C:\Windows\System\iFHcEOo.exe

Filesize
1.6MB

MD5
781722872eafb6de4a95ba4851a10fd3

SHA1
4da2d62865649abed608900ebd8761f3043d6a61

SHA256
ec8e98ad986ada8cea99bcc0b902818987f8516e0da78179a852de4b61e38411

SHA512
44c4a654e6cd692f68f776482c0e9d427683e9a71bf0532708711193ebed316566dd6b18244d607dc586aaaa3bce1fe65fab4e3b15ffa679df7402fb2460479d

Download Submit
C:\Windows\System\kvXGntF.exe

Filesize
1.6MB

MD5
1a09971ed7a267fab1a55408fb4ab438

SHA1
3a9ad41009594c3782f0ea58103c283336176301

SHA256
a7a4849a2056023f5d005a93849b0e94787ba65bfcc603314cd9fe716d616b84

SHA512
69f91a5a568ed36c535ce889375591ced73298dc3e2a1b6c8014995b732f7384592af9b67d86e151b5b123d4eb8155cac3e509086b57384c03b96c8d20801851

Download Submit
C:\Windows\System\lMevLql.exe

Filesize
1.6MB

MD5
9155f9fa65613773a5f325b4a11cc736

SHA1
5afee623437189ba469caa3ebb0250faa6517617

SHA256
a7d563dd43958dc1f76c4e1029da8edc4916a62d826ccdb6b93d771bc41fb243

SHA512
ead0a6a38c4c44ff3fecd3fed85d5dea2aea1db2ccb3c6c1d865c56feb6eea0943ffb0d9f54d6a9ff80b983fabf0663be46e66332acd27c4a72afdfd1806d9b8

Download Submit
C:\Windows\System\msLcowq.exe

Filesize
1.6MB

MD5
3c1fc6cedc1a4aed31deb156bfae72e7

SHA1
a52c3319f4d20a76cae81bb7dc697bce6f288bdb

SHA256
2fb252f0c281090e0ffca86973566c06376269228a3d6b923ff2e1c4bea472b5

SHA512
85428055640265bcb8b4256060bb3277febb1f5f828fe1886698df1358235957a4fa5812e9781c6185240a77e073e1832a99ae2ef22555b28c3125f445404afb

Download Submit
C:\Windows\System\qcBqYeF.exe

Filesize
1.6MB

MD5
172bddb694eb2d40c7f15ca1c6015a6e

SHA1
e8a46cb50c87deb77e9135380d1aff234dd0d2e1

SHA256
89be1c768499a98281ba8e9f89732f5e9ba262796861c0caaea94b07e705c418

SHA512
9ebc2d095f03982426b9a2d0c2fff9efacf3bbdaf729b14cce9b1f447a194b2b2cb35d57bac7b3b8fc58d6a81b8df9442326d9269308dd7e1125d8ed94f1f79f

Download Submit
C:\Windows\System\wstlWBV.exe

Filesize
1.6MB

MD5
89cb803a088fd593dc95937196a68ecd

SHA1
a933eb9c89a55204c39b3436ec8e535d2538b918

SHA256
9c567bfe6b39db88934019f7c94c7ff0181969afebc8c58db0621b85d33486d9

SHA512
f6765425eacf74ab701bd3eb5b73eb8e68b9059bc7714d7f45abaaa4686579a1d96a3844a342b930222ededc94bf7836628a298b14d3c225051b7b1eb34d26bc

Download Submit
C:\Windows\System\xNHCCKh.exe

Filesize
1.6MB

MD5
be431642e1f4ec23bfc9b02818ab5cee

SHA1
c242bb5a37d61acf91299463b86d5afcc6a50c53

SHA256
f14f07bdddfb2c73594002a41cdd606eb01b481a186554edbb8180f17f121cf3

SHA512
c0edd4e3fec80080fc5089068e2553e40217250f7e4a6be78be8d27d7a01dfcf7ffcd252a09e1d6beb21395fec4b18bf57464645d9a429fe934a0dc363ab6365

Download Submit
C:\Windows\System\xQKOule.exe

Filesize
1.6MB

MD5
00b0dae6c9266dffd1440b57651fe3af

SHA1
0b06a3ea83ee650be7081cb9d83bb6123a284635

SHA256
6503b4d900907a55a128de98ba7c4d53104c075bdb2270c02e11ff7a461720bc

SHA512
94b5d0430493dbaa71231bce6045371af9b2cefe8e65bb57de4234148f3679afd8057f3871d4f79b379bbf7343df29b56a64415c4343ae3e1e3e1e0c5d62150e

Download Submit
C:\Windows\System\ykBUScl.exe

Filesize
1.6MB

MD5
6779df65a09149005ed77988f1ad97ae

SHA1
b57606127f325cc9e6300f8f9441bb2b08a87488

SHA256
c49f74a3662adc3d98bef6dc508efe2eea9e5a399018bf5cfaf82a77cf3f0e45

SHA512
2f9d5bdf5c5aa914bc1a1ba04696af7020e83e5393bc1c406432070a4dd2af716d9591ad38809403548be6f7db8461a1bd98465fe63f5c95b9d4aa596dfc0aae

Download Submit
memory/4224-0-0x00000200F7AD0000-0x00000200F7AE0000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads