xmrig | 70818b38a07c89739b36f99cb627c0204831f50d4fe456c1ac2ad3a8b667b7ad

Analysis

max time kernel
107s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20250129-en
resource tags

arch:x64arch:x86image:win10v2004-20250129-enlocale:en-usos:windows10-2004-x64system
submitted
03/02/2025, 00:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

70818b38a07c89739b36f99cb627c0204831f50d4fe456c1ac2ad3a8b667b7ad.exe
Size

1.4MB
MD5

65d7c5f2ee39229ef3b162202fa950aa
SHA1

eb2006ea57ce3849f9926e05a717b855c7e6e20f
SHA256

70818b38a07c89739b36f99cb627c0204831f50d4fe456c1ac2ad3a8b667b7ad
SHA512

b0bfda7f94ee0f08717f5edfd78eb02a98e77ed48aa15a5e0eb71ad9293a3c46a69b7533fdcf6ce2d7d3b95cc69fff3abd6841c79713de7e01047ef2f53dcc21
SSDEEP

24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbpwlKenszbWKDNEm/5O+7MMKTbcn:GezaTF8FcNkNdfE0pZ9ozttwIRxj4c5V

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 33 IoCs

miner

resource	yara_rule
behavioral2/files/0x000c000000023b92-4.dat	xmrig
behavioral2/files/0x0008000000023c8b-8.dat	xmrig
behavioral2/files/0x0007000000023c8c-7.dat	xmrig
behavioral2/files/0x0007000000023c8e-20.dat	xmrig
behavioral2/files/0x0007000000023c8d-23.dat	xmrig
behavioral2/files/0x0007000000023c8f-28.dat	xmrig
behavioral2/files/0x0007000000023c94-52.dat	xmrig
behavioral2/files/0x0007000000023c96-70.dat	xmrig
behavioral2/files/0x0007000000023c99-85.dat	xmrig
behavioral2/files/0x0007000000023ca8-152.dat	xmrig
behavioral2/files/0x0007000000023caa-162.dat	xmrig
behavioral2/files/0x0007000000023ca9-157.dat	xmrig
behavioral2/files/0x0007000000023ca7-155.dat	xmrig
behavioral2/files/0x0007000000023ca6-150.dat	xmrig
behavioral2/files/0x0007000000023ca5-145.dat	xmrig
behavioral2/files/0x0007000000023ca4-140.dat	xmrig
behavioral2/files/0x0007000000023ca3-135.dat	xmrig
behavioral2/files/0x0007000000023ca2-130.dat	xmrig
behavioral2/files/0x0007000000023ca1-125.dat	xmrig
behavioral2/files/0x0007000000023ca0-120.dat	xmrig
behavioral2/files/0x0007000000023c9f-115.dat	xmrig
behavioral2/files/0x0007000000023c9e-110.dat	xmrig
behavioral2/files/0x0007000000023c9d-105.dat	xmrig
behavioral2/files/0x0007000000023c9c-100.dat	xmrig
behavioral2/files/0x0007000000023c9b-95.dat	xmrig
behavioral2/files/0x0007000000023c9a-90.dat	xmrig
behavioral2/files/0x0007000000023c98-80.dat	xmrig
behavioral2/files/0x0007000000023c97-75.dat	xmrig
behavioral2/files/0x0007000000023c95-65.dat	xmrig
behavioral2/files/0x0007000000023c93-55.dat	xmrig
behavioral2/files/0x0007000000023c92-50.dat	xmrig
behavioral2/files/0x0007000000023c91-42.dat	xmrig
behavioral2/files/0x0007000000023c90-35.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2084	zelZGck.exe
4516	iBnNUql.exe
408	SXeXRNX.exe
4640	ZhivPRu.exe
1192	itzqwql.exe
3476	wiEYoBP.exe
1452	dCiwaeC.exe
1656	gOwfGxq.exe
1380	VOKLPKn.exe
4332	TKJpjAM.exe
3492	JQLcfls.exe
3600	rnTOQho.exe
5024	xnatKcc.exe
5068	KQNCPxF.exe
1472	FlJswJh.exe
1076	vLENugn.exe
1740	iJQowrt.exe
5016	PtMmlVY.exe
1012	beAvaZI.exe
876	ScOCXtA.exe
4688	uOSemOx.exe
2796	MFTXDgL.exe
1376	YhRxIXK.exe
4876	GALtsMF.exe
3876	tWdNPRP.exe
2844	OWlmmhp.exe
4756	aDCRESk.exe
4772	AOoIpAC.exe
3692	XJARUIh.exe
3864	hOMXLYR.exe
4244	JyKyJaK.exe
924	VcEwefw.exe
3228	OSoLdEn.exe
2872	GTxWiIg.exe
1520	XptJJVR.exe
1264	PezMWVI.exe
3896	dODbgSY.exe
3744	gHaIFjY.exe
1148	YHyQFkX.exe
5048	TNmyOQp.exe
2432	OYYBYAu.exe
2980	tBUiJNm.exe
4116	oAPQulX.exe
4692	bDtNJyQ.exe
5112	ORseCGY.exe
4388	GSnNckk.exe
4800	EKKtSLh.exe
528	RgxkgUo.exe
3180	WocHoGE.exe
1500	oSahyRZ.exe
4024	DsTHowh.exe
1800	fuuhVRu.exe
3736	gRfIlzP.exe
4012	CdRzyBQ.exe
3832	rnhrjRh.exe
3796	bZRebBe.exe
3056	DWJmqDS.exe
1048	PanrrDt.exe
4256	kwaNWyU.exe
4056	eMYmHre.exe
4844	iBfVOdH.exe
4452	RYFvQim.exe
1720	BDgVVPV.exe
2284	yMWMbsx.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\yoRwBKQ.exe	70818b38a07c89739b36f99cb627c0204831f50d4fe456c1ac2ad3a8b667b7ad.exe
File created	C:\Windows\System\IQoSfYW.exe	70818b38a07c89739b36f99cb627c0204831f50d4fe456c1ac2ad3a8b667b7ad.exe
File created	C:\Windows\System\BoeGnKW.exe	70818b38a07c89739b36f99cb627c0204831f50d4fe456c1ac2ad3a8b667b7ad.exe
File created	C:\Windows\System\FKzGSaD.exe	70818b38a07c89739b36f99cb627c0204831f50d4fe456c1ac2ad3a8b667b7ad.exe
File created	C:\Windows\System\XfDxRqY.exe	70818b38a07c89739b36f99cb627c0204831f50d4fe456c1ac2ad3a8b667b7ad.exe
File created	C:\Windows\System\CQySUxl.exe	70818b38a07c89739b36f99cb627c0204831f50d4fe456c1ac2ad3a8b667b7ad.exe
File created	C:\Windows\System\PtMmlVY.exe	70818b38a07c89739b36f99cb627c0204831f50d4fe456c1ac2ad3a8b667b7ad.exe
File created	C:\Windows\System\ifsezMC.exe	70818b38a07c89739b36f99cb627c0204831f50d4fe456c1ac2ad3a8b667b7ad.exe
File created	C:\Windows\System\lKoJzOy.exe	70818b38a07c89739b36f99cb627c0204831f50d4fe456c1ac2ad3a8b667b7ad.exe
File created	C:\Windows\System\pDvBLkU.exe	70818b38a07c89739b36f99cb627c0204831f50d4fe456c1ac2ad3a8b667b7ad.exe
File created	C:\Windows\System\lisTgWm.exe	70818b38a07c89739b36f99cb627c0204831f50d4fe456c1ac2ad3a8b667b7ad.exe
File created	C:\Windows\System\HRMvhCY.exe	70818b38a07c89739b36f99cb627c0204831f50d4fe456c1ac2ad3a8b667b7ad.exe
File created	C:\Windows\System\jSuxvIc.exe	70818b38a07c89739b36f99cb627c0204831f50d4fe456c1ac2ad3a8b667b7ad.exe
File created	C:\Windows\System\IWjWfMA.exe	70818b38a07c89739b36f99cb627c0204831f50d4fe456c1ac2ad3a8b667b7ad.exe
File created	C:\Windows\System\oSahyRZ.exe	70818b38a07c89739b36f99cb627c0204831f50d4fe456c1ac2ad3a8b667b7ad.exe
File created	C:\Windows\System\sJHGICb.exe	70818b38a07c89739b36f99cb627c0204831f50d4fe456c1ac2ad3a8b667b7ad.exe
File created	C:\Windows\System\EDgbpZT.exe	70818b38a07c89739b36f99cb627c0204831f50d4fe456c1ac2ad3a8b667b7ad.exe
File created	C:\Windows\System\TPvMUWJ.exe	70818b38a07c89739b36f99cb627c0204831f50d4fe456c1ac2ad3a8b667b7ad.exe
File created	C:\Windows\System\rZWzPBY.exe	70818b38a07c89739b36f99cb627c0204831f50d4fe456c1ac2ad3a8b667b7ad.exe
File created	C:\Windows\System\hIWuveo.exe	70818b38a07c89739b36f99cb627c0204831f50d4fe456c1ac2ad3a8b667b7ad.exe
File created	C:\Windows\System\lFNdAul.exe	70818b38a07c89739b36f99cb627c0204831f50d4fe456c1ac2ad3a8b667b7ad.exe
File created	C:\Windows\System\hTGlTgv.exe	70818b38a07c89739b36f99cb627c0204831f50d4fe456c1ac2ad3a8b667b7ad.exe
File created	C:\Windows\System\fxRKwpG.exe	70818b38a07c89739b36f99cb627c0204831f50d4fe456c1ac2ad3a8b667b7ad.exe
File created	C:\Windows\System\UQSOFhP.exe	70818b38a07c89739b36f99cb627c0204831f50d4fe456c1ac2ad3a8b667b7ad.exe
File created	C:\Windows\System\VPZVqPx.exe	70818b38a07c89739b36f99cb627c0204831f50d4fe456c1ac2ad3a8b667b7ad.exe
File created	C:\Windows\System\xMkrcpa.exe	70818b38a07c89739b36f99cb627c0204831f50d4fe456c1ac2ad3a8b667b7ad.exe
File created	C:\Windows\System\rvrWSyB.exe	70818b38a07c89739b36f99cb627c0204831f50d4fe456c1ac2ad3a8b667b7ad.exe
File created	C:\Windows\System\vbASgyt.exe	70818b38a07c89739b36f99cb627c0204831f50d4fe456c1ac2ad3a8b667b7ad.exe
File created	C:\Windows\System\uhKEDWs.exe	70818b38a07c89739b36f99cb627c0204831f50d4fe456c1ac2ad3a8b667b7ad.exe
File created	C:\Windows\System\bjhoiut.exe	70818b38a07c89739b36f99cb627c0204831f50d4fe456c1ac2ad3a8b667b7ad.exe
File created	C:\Windows\System\WHLdkEQ.exe	70818b38a07c89739b36f99cb627c0204831f50d4fe456c1ac2ad3a8b667b7ad.exe
File created	C:\Windows\System\fElWCVY.exe	70818b38a07c89739b36f99cb627c0204831f50d4fe456c1ac2ad3a8b667b7ad.exe
File created	C:\Windows\System\zsZbPPW.exe	70818b38a07c89739b36f99cb627c0204831f50d4fe456c1ac2ad3a8b667b7ad.exe
File created	C:\Windows\System\QNjKazM.exe	70818b38a07c89739b36f99cb627c0204831f50d4fe456c1ac2ad3a8b667b7ad.exe
File created	C:\Windows\System\DkqSqWO.exe	70818b38a07c89739b36f99cb627c0204831f50d4fe456c1ac2ad3a8b667b7ad.exe
File created	C:\Windows\System\ZcwgMZw.exe	70818b38a07c89739b36f99cb627c0204831f50d4fe456c1ac2ad3a8b667b7ad.exe
File created	C:\Windows\System\KeTIhdI.exe	70818b38a07c89739b36f99cb627c0204831f50d4fe456c1ac2ad3a8b667b7ad.exe
File created	C:\Windows\System\NEPpRLr.exe	70818b38a07c89739b36f99cb627c0204831f50d4fe456c1ac2ad3a8b667b7ad.exe
File created	C:\Windows\System\ihRHoOg.exe	70818b38a07c89739b36f99cb627c0204831f50d4fe456c1ac2ad3a8b667b7ad.exe
File created	C:\Windows\System\Ntywrvp.exe	70818b38a07c89739b36f99cb627c0204831f50d4fe456c1ac2ad3a8b667b7ad.exe
File created	C:\Windows\System\UPgSTqX.exe	70818b38a07c89739b36f99cb627c0204831f50d4fe456c1ac2ad3a8b667b7ad.exe
File created	C:\Windows\System\zHqsJIb.exe	70818b38a07c89739b36f99cb627c0204831f50d4fe456c1ac2ad3a8b667b7ad.exe
File created	C:\Windows\System\BxjpLSy.exe	70818b38a07c89739b36f99cb627c0204831f50d4fe456c1ac2ad3a8b667b7ad.exe
File created	C:\Windows\System\KqpwYOT.exe	70818b38a07c89739b36f99cb627c0204831f50d4fe456c1ac2ad3a8b667b7ad.exe
File created	C:\Windows\System\lfmyiFg.exe	70818b38a07c89739b36f99cb627c0204831f50d4fe456c1ac2ad3a8b667b7ad.exe
File created	C:\Windows\System\YOHWQlc.exe	70818b38a07c89739b36f99cb627c0204831f50d4fe456c1ac2ad3a8b667b7ad.exe
File created	C:\Windows\System\bZNqcnL.exe	70818b38a07c89739b36f99cb627c0204831f50d4fe456c1ac2ad3a8b667b7ad.exe
File created	C:\Windows\System\itTNBbA.exe	70818b38a07c89739b36f99cb627c0204831f50d4fe456c1ac2ad3a8b667b7ad.exe
File created	C:\Windows\System\NSILgrd.exe	70818b38a07c89739b36f99cb627c0204831f50d4fe456c1ac2ad3a8b667b7ad.exe
File created	C:\Windows\System\kcDDBzX.exe	70818b38a07c89739b36f99cb627c0204831f50d4fe456c1ac2ad3a8b667b7ad.exe
File created	C:\Windows\System\wwohQHI.exe	70818b38a07c89739b36f99cb627c0204831f50d4fe456c1ac2ad3a8b667b7ad.exe
File created	C:\Windows\System\JyKyJaK.exe	70818b38a07c89739b36f99cb627c0204831f50d4fe456c1ac2ad3a8b667b7ad.exe
File created	C:\Windows\System\INNPykk.exe	70818b38a07c89739b36f99cb627c0204831f50d4fe456c1ac2ad3a8b667b7ad.exe
File created	C:\Windows\System\MCfrVhN.exe	70818b38a07c89739b36f99cb627c0204831f50d4fe456c1ac2ad3a8b667b7ad.exe
File created	C:\Windows\System\aoHPSqQ.exe	70818b38a07c89739b36f99cb627c0204831f50d4fe456c1ac2ad3a8b667b7ad.exe
File created	C:\Windows\System\BEFZsBM.exe	70818b38a07c89739b36f99cb627c0204831f50d4fe456c1ac2ad3a8b667b7ad.exe
File created	C:\Windows\System\LQfLkcs.exe	70818b38a07c89739b36f99cb627c0204831f50d4fe456c1ac2ad3a8b667b7ad.exe
File created	C:\Windows\System\BNeBUhP.exe	70818b38a07c89739b36f99cb627c0204831f50d4fe456c1ac2ad3a8b667b7ad.exe
File created	C:\Windows\System\GALtsMF.exe	70818b38a07c89739b36f99cb627c0204831f50d4fe456c1ac2ad3a8b667b7ad.exe
File created	C:\Windows\System\KjRdaWX.exe	70818b38a07c89739b36f99cb627c0204831f50d4fe456c1ac2ad3a8b667b7ad.exe
File created	C:\Windows\System\QeKsZYZ.exe	70818b38a07c89739b36f99cb627c0204831f50d4fe456c1ac2ad3a8b667b7ad.exe
File created	C:\Windows\System\JJtQAav.exe	70818b38a07c89739b36f99cb627c0204831f50d4fe456c1ac2ad3a8b667b7ad.exe
File created	C:\Windows\System\fvBbcRP.exe	70818b38a07c89739b36f99cb627c0204831f50d4fe456c1ac2ad3a8b667b7ad.exe
File created	C:\Windows\System\vfDYPkk.exe	70818b38a07c89739b36f99cb627c0204831f50d4fe456c1ac2ad3a8b667b7ad.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	15940	dwm.exe
Token: SeChangeNotifyPrivilege	15940	dwm.exe
Token: 33	15940	dwm.exe
Token: SeIncBasePriorityPrivilege	15940	dwm.exe
Token: SeShutdownPrivilege	15940	dwm.exe
Token: SeCreatePagefilePrivilege	15940	dwm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4112 wrote to memory of 2084	4112	70818b38a07c89739b36f99cb627c0204831f50d4fe456c1ac2ad3a8b667b7ad.exe	84
PID 4112 wrote to memory of 2084	4112	70818b38a07c89739b36f99cb627c0204831f50d4fe456c1ac2ad3a8b667b7ad.exe	84
PID 4112 wrote to memory of 4516	4112	70818b38a07c89739b36f99cb627c0204831f50d4fe456c1ac2ad3a8b667b7ad.exe	86
PID 4112 wrote to memory of 4516	4112	70818b38a07c89739b36f99cb627c0204831f50d4fe456c1ac2ad3a8b667b7ad.exe	86
PID 4112 wrote to memory of 408	4112	70818b38a07c89739b36f99cb627c0204831f50d4fe456c1ac2ad3a8b667b7ad.exe	87
PID 4112 wrote to memory of 408	4112	70818b38a07c89739b36f99cb627c0204831f50d4fe456c1ac2ad3a8b667b7ad.exe	87
PID 4112 wrote to memory of 4640	4112	70818b38a07c89739b36f99cb627c0204831f50d4fe456c1ac2ad3a8b667b7ad.exe	90
PID 4112 wrote to memory of 4640	4112	70818b38a07c89739b36f99cb627c0204831f50d4fe456c1ac2ad3a8b667b7ad.exe	90
PID 4112 wrote to memory of 1192	4112	70818b38a07c89739b36f99cb627c0204831f50d4fe456c1ac2ad3a8b667b7ad.exe	91
PID 4112 wrote to memory of 1192	4112	70818b38a07c89739b36f99cb627c0204831f50d4fe456c1ac2ad3a8b667b7ad.exe	91
PID 4112 wrote to memory of 3476	4112	70818b38a07c89739b36f99cb627c0204831f50d4fe456c1ac2ad3a8b667b7ad.exe	92
PID 4112 wrote to memory of 3476	4112	70818b38a07c89739b36f99cb627c0204831f50d4fe456c1ac2ad3a8b667b7ad.exe	92
PID 4112 wrote to memory of 1452	4112	70818b38a07c89739b36f99cb627c0204831f50d4fe456c1ac2ad3a8b667b7ad.exe	93
PID 4112 wrote to memory of 1452	4112	70818b38a07c89739b36f99cb627c0204831f50d4fe456c1ac2ad3a8b667b7ad.exe	93
PID 4112 wrote to memory of 1656	4112	70818b38a07c89739b36f99cb627c0204831f50d4fe456c1ac2ad3a8b667b7ad.exe	94
PID 4112 wrote to memory of 1656	4112	70818b38a07c89739b36f99cb627c0204831f50d4fe456c1ac2ad3a8b667b7ad.exe	94
PID 4112 wrote to memory of 1380	4112	70818b38a07c89739b36f99cb627c0204831f50d4fe456c1ac2ad3a8b667b7ad.exe	95
PID 4112 wrote to memory of 1380	4112	70818b38a07c89739b36f99cb627c0204831f50d4fe456c1ac2ad3a8b667b7ad.exe	95
PID 4112 wrote to memory of 4332	4112	70818b38a07c89739b36f99cb627c0204831f50d4fe456c1ac2ad3a8b667b7ad.exe	96
PID 4112 wrote to memory of 4332	4112	70818b38a07c89739b36f99cb627c0204831f50d4fe456c1ac2ad3a8b667b7ad.exe	96
PID 4112 wrote to memory of 3492	4112	70818b38a07c89739b36f99cb627c0204831f50d4fe456c1ac2ad3a8b667b7ad.exe	97
PID 4112 wrote to memory of 3492	4112	70818b38a07c89739b36f99cb627c0204831f50d4fe456c1ac2ad3a8b667b7ad.exe	97
PID 4112 wrote to memory of 3600	4112	70818b38a07c89739b36f99cb627c0204831f50d4fe456c1ac2ad3a8b667b7ad.exe	98
PID 4112 wrote to memory of 3600	4112	70818b38a07c89739b36f99cb627c0204831f50d4fe456c1ac2ad3a8b667b7ad.exe	98
PID 4112 wrote to memory of 5024	4112	70818b38a07c89739b36f99cb627c0204831f50d4fe456c1ac2ad3a8b667b7ad.exe	99
PID 4112 wrote to memory of 5024	4112	70818b38a07c89739b36f99cb627c0204831f50d4fe456c1ac2ad3a8b667b7ad.exe	99
PID 4112 wrote to memory of 5068	4112	70818b38a07c89739b36f99cb627c0204831f50d4fe456c1ac2ad3a8b667b7ad.exe	100
PID 4112 wrote to memory of 5068	4112	70818b38a07c89739b36f99cb627c0204831f50d4fe456c1ac2ad3a8b667b7ad.exe	100
PID 4112 wrote to memory of 1472	4112	70818b38a07c89739b36f99cb627c0204831f50d4fe456c1ac2ad3a8b667b7ad.exe	101
PID 4112 wrote to memory of 1472	4112	70818b38a07c89739b36f99cb627c0204831f50d4fe456c1ac2ad3a8b667b7ad.exe	101
PID 4112 wrote to memory of 1076	4112	70818b38a07c89739b36f99cb627c0204831f50d4fe456c1ac2ad3a8b667b7ad.exe	102
PID 4112 wrote to memory of 1076	4112	70818b38a07c89739b36f99cb627c0204831f50d4fe456c1ac2ad3a8b667b7ad.exe	102
PID 4112 wrote to memory of 1740	4112	70818b38a07c89739b36f99cb627c0204831f50d4fe456c1ac2ad3a8b667b7ad.exe	103
PID 4112 wrote to memory of 1740	4112	70818b38a07c89739b36f99cb627c0204831f50d4fe456c1ac2ad3a8b667b7ad.exe	103
PID 4112 wrote to memory of 5016	4112	70818b38a07c89739b36f99cb627c0204831f50d4fe456c1ac2ad3a8b667b7ad.exe	104
PID 4112 wrote to memory of 5016	4112	70818b38a07c89739b36f99cb627c0204831f50d4fe456c1ac2ad3a8b667b7ad.exe	104
PID 4112 wrote to memory of 1012	4112	70818b38a07c89739b36f99cb627c0204831f50d4fe456c1ac2ad3a8b667b7ad.exe	105
PID 4112 wrote to memory of 1012	4112	70818b38a07c89739b36f99cb627c0204831f50d4fe456c1ac2ad3a8b667b7ad.exe	105
PID 4112 wrote to memory of 876	4112	70818b38a07c89739b36f99cb627c0204831f50d4fe456c1ac2ad3a8b667b7ad.exe	106
PID 4112 wrote to memory of 876	4112	70818b38a07c89739b36f99cb627c0204831f50d4fe456c1ac2ad3a8b667b7ad.exe	106
PID 4112 wrote to memory of 4688	4112	70818b38a07c89739b36f99cb627c0204831f50d4fe456c1ac2ad3a8b667b7ad.exe	107
PID 4112 wrote to memory of 4688	4112	70818b38a07c89739b36f99cb627c0204831f50d4fe456c1ac2ad3a8b667b7ad.exe	107
PID 4112 wrote to memory of 2796	4112	70818b38a07c89739b36f99cb627c0204831f50d4fe456c1ac2ad3a8b667b7ad.exe	108
PID 4112 wrote to memory of 2796	4112	70818b38a07c89739b36f99cb627c0204831f50d4fe456c1ac2ad3a8b667b7ad.exe	108
PID 4112 wrote to memory of 1376	4112	70818b38a07c89739b36f99cb627c0204831f50d4fe456c1ac2ad3a8b667b7ad.exe	109
PID 4112 wrote to memory of 1376	4112	70818b38a07c89739b36f99cb627c0204831f50d4fe456c1ac2ad3a8b667b7ad.exe	109
PID 4112 wrote to memory of 4876	4112	70818b38a07c89739b36f99cb627c0204831f50d4fe456c1ac2ad3a8b667b7ad.exe	110
PID 4112 wrote to memory of 4876	4112	70818b38a07c89739b36f99cb627c0204831f50d4fe456c1ac2ad3a8b667b7ad.exe	110
PID 4112 wrote to memory of 3876	4112	70818b38a07c89739b36f99cb627c0204831f50d4fe456c1ac2ad3a8b667b7ad.exe	111
PID 4112 wrote to memory of 3876	4112	70818b38a07c89739b36f99cb627c0204831f50d4fe456c1ac2ad3a8b667b7ad.exe	111
PID 4112 wrote to memory of 2844	4112	70818b38a07c89739b36f99cb627c0204831f50d4fe456c1ac2ad3a8b667b7ad.exe	112
PID 4112 wrote to memory of 2844	4112	70818b38a07c89739b36f99cb627c0204831f50d4fe456c1ac2ad3a8b667b7ad.exe	112
PID 4112 wrote to memory of 4756	4112	70818b38a07c89739b36f99cb627c0204831f50d4fe456c1ac2ad3a8b667b7ad.exe	113
PID 4112 wrote to memory of 4756	4112	70818b38a07c89739b36f99cb627c0204831f50d4fe456c1ac2ad3a8b667b7ad.exe	113
PID 4112 wrote to memory of 4772	4112	70818b38a07c89739b36f99cb627c0204831f50d4fe456c1ac2ad3a8b667b7ad.exe	114
PID 4112 wrote to memory of 4772	4112	70818b38a07c89739b36f99cb627c0204831f50d4fe456c1ac2ad3a8b667b7ad.exe	114
PID 4112 wrote to memory of 3692	4112	70818b38a07c89739b36f99cb627c0204831f50d4fe456c1ac2ad3a8b667b7ad.exe	115
PID 4112 wrote to memory of 3692	4112	70818b38a07c89739b36f99cb627c0204831f50d4fe456c1ac2ad3a8b667b7ad.exe	115
PID 4112 wrote to memory of 3864	4112	70818b38a07c89739b36f99cb627c0204831f50d4fe456c1ac2ad3a8b667b7ad.exe	116
PID 4112 wrote to memory of 3864	4112	70818b38a07c89739b36f99cb627c0204831f50d4fe456c1ac2ad3a8b667b7ad.exe	116
PID 4112 wrote to memory of 4244	4112	70818b38a07c89739b36f99cb627c0204831f50d4fe456c1ac2ad3a8b667b7ad.exe	117
PID 4112 wrote to memory of 4244	4112	70818b38a07c89739b36f99cb627c0204831f50d4fe456c1ac2ad3a8b667b7ad.exe	117
PID 4112 wrote to memory of 924	4112	70818b38a07c89739b36f99cb627c0204831f50d4fe456c1ac2ad3a8b667b7ad.exe	118
PID 4112 wrote to memory of 924	4112	70818b38a07c89739b36f99cb627c0204831f50d4fe456c1ac2ad3a8b667b7ad.exe	118

C:\Users\Admin\AppData\Local\Temp\70818b38a07c89739b36f99cb627c0204831f50d4fe456c1ac2ad3a8b667b7ad.exe
"C:\Users\Admin\AppData\Local\Temp\70818b38a07c89739b36f99cb627c0204831f50d4fe456c1ac2ad3a8b667b7ad.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4112
- C:\Windows\System\zelZGck.exe
  C:\Windows\System\zelZGck.exe
  2⤵
  - Executes dropped EXE
  PID:2084
- C:\Windows\System\iBnNUql.exe
  C:\Windows\System\iBnNUql.exe
  2⤵
  - Executes dropped EXE
  PID:4516
- C:\Windows\System\SXeXRNX.exe
  C:\Windows\System\SXeXRNX.exe
  2⤵
  - Executes dropped EXE
  PID:408
- C:\Windows\System\ZhivPRu.exe
  C:\Windows\System\ZhivPRu.exe
  2⤵
  - Executes dropped EXE
  PID:4640
- C:\Windows\System\itzqwql.exe
  C:\Windows\System\itzqwql.exe
  2⤵
  - Executes dropped EXE
  PID:1192
- C:\Windows\System\wiEYoBP.exe
  C:\Windows\System\wiEYoBP.exe
  2⤵
  - Executes dropped EXE
  PID:3476
- C:\Windows\System\dCiwaeC.exe
  C:\Windows\System\dCiwaeC.exe
  2⤵
  - Executes dropped EXE
  PID:1452
- C:\Windows\System\gOwfGxq.exe
  C:\Windows\System\gOwfGxq.exe
  2⤵
  - Executes dropped EXE
  PID:1656
- C:\Windows\System\VOKLPKn.exe
  C:\Windows\System\VOKLPKn.exe
  2⤵
  - Executes dropped EXE
  PID:1380
- C:\Windows\System\TKJpjAM.exe
  C:\Windows\System\TKJpjAM.exe
  2⤵
  - Executes dropped EXE
  PID:4332
- C:\Windows\System\JQLcfls.exe
  C:\Windows\System\JQLcfls.exe
  2⤵
  - Executes dropped EXE
  PID:3492
- C:\Windows\System\rnTOQho.exe
  C:\Windows\System\rnTOQho.exe
  2⤵
  - Executes dropped EXE
  PID:3600
- C:\Windows\System\xnatKcc.exe
  C:\Windows\System\xnatKcc.exe
  2⤵
  - Executes dropped EXE
  PID:5024
- C:\Windows\System\KQNCPxF.exe
  C:\Windows\System\KQNCPxF.exe
  2⤵
  - Executes dropped EXE
  PID:5068
- C:\Windows\System\FlJswJh.exe
  C:\Windows\System\FlJswJh.exe
  2⤵
  - Executes dropped EXE
  PID:1472
- C:\Windows\System\vLENugn.exe
  C:\Windows\System\vLENugn.exe
  2⤵
  - Executes dropped EXE
  PID:1076
- C:\Windows\System\iJQowrt.exe
  C:\Windows\System\iJQowrt.exe
  2⤵
  - Executes dropped EXE
  PID:1740
- C:\Windows\System\PtMmlVY.exe
  C:\Windows\System\PtMmlVY.exe
  2⤵
  - Executes dropped EXE
  PID:5016
- C:\Windows\System\beAvaZI.exe
  C:\Windows\System\beAvaZI.exe
  2⤵
  - Executes dropped EXE
  PID:1012
- C:\Windows\System\ScOCXtA.exe
  C:\Windows\System\ScOCXtA.exe
  2⤵
  - Executes dropped EXE
  PID:876
- C:\Windows\System\uOSemOx.exe
  C:\Windows\System\uOSemOx.exe
  2⤵
  - Executes dropped EXE
  PID:4688
- C:\Windows\System\MFTXDgL.exe
  C:\Windows\System\MFTXDgL.exe
  2⤵
  - Executes dropped EXE
  PID:2796
- C:\Windows\System\YhRxIXK.exe
  C:\Windows\System\YhRxIXK.exe
  2⤵
  - Executes dropped EXE
  PID:1376
- C:\Windows\System\GALtsMF.exe
  C:\Windows\System\GALtsMF.exe
  2⤵
  - Executes dropped EXE
  PID:4876
- C:\Windows\System\tWdNPRP.exe
  C:\Windows\System\tWdNPRP.exe
  2⤵
  - Executes dropped EXE
  PID:3876
- C:\Windows\System\OWlmmhp.exe
  C:\Windows\System\OWlmmhp.exe
  2⤵
  - Executes dropped EXE
  PID:2844
- C:\Windows\System\aDCRESk.exe
  C:\Windows\System\aDCRESk.exe
  2⤵
  - Executes dropped EXE
  PID:4756
- C:\Windows\System\AOoIpAC.exe
  C:\Windows\System\AOoIpAC.exe
  2⤵
  - Executes dropped EXE
  PID:4772
- C:\Windows\System\XJARUIh.exe
  C:\Windows\System\XJARUIh.exe
  2⤵
  - Executes dropped EXE
  PID:3692
- C:\Windows\System\hOMXLYR.exe
  C:\Windows\System\hOMXLYR.exe
  2⤵
  - Executes dropped EXE
  PID:3864
- C:\Windows\System\JyKyJaK.exe
  C:\Windows\System\JyKyJaK.exe
  2⤵
  - Executes dropped EXE
  PID:4244
- C:\Windows\System\VcEwefw.exe
  C:\Windows\System\VcEwefw.exe
  2⤵
  - Executes dropped EXE
  PID:924
- C:\Windows\System\OSoLdEn.exe
  C:\Windows\System\OSoLdEn.exe
  2⤵
  - Executes dropped EXE
  PID:3228
- C:\Windows\System\GTxWiIg.exe
  C:\Windows\System\GTxWiIg.exe
  2⤵
  - Executes dropped EXE
  PID:2872
- C:\Windows\System\XptJJVR.exe
  C:\Windows\System\XptJJVR.exe
  2⤵
  - Executes dropped EXE
  PID:1520
- C:\Windows\System\PezMWVI.exe
  C:\Windows\System\PezMWVI.exe
  2⤵
  - Executes dropped EXE
  PID:1264
- C:\Windows\System\dODbgSY.exe
  C:\Windows\System\dODbgSY.exe
  2⤵
  - Executes dropped EXE
  PID:3896
- C:\Windows\System\gHaIFjY.exe
  C:\Windows\System\gHaIFjY.exe
  2⤵
  - Executes dropped EXE
  PID:3744
- C:\Windows\System\YHyQFkX.exe
  C:\Windows\System\YHyQFkX.exe
  2⤵
  - Executes dropped EXE
  PID:1148
- C:\Windows\System\TNmyOQp.exe
  C:\Windows\System\TNmyOQp.exe
  2⤵
  - Executes dropped EXE
  PID:5048
- C:\Windows\System\OYYBYAu.exe
  C:\Windows\System\OYYBYAu.exe
  2⤵
  - Executes dropped EXE
  PID:2432
- C:\Windows\System\tBUiJNm.exe
  C:\Windows\System\tBUiJNm.exe
  2⤵
  - Executes dropped EXE
  PID:2980
- C:\Windows\System\oAPQulX.exe
  C:\Windows\System\oAPQulX.exe
  2⤵
  - Executes dropped EXE
  PID:4116
- C:\Windows\System\bDtNJyQ.exe
  C:\Windows\System\bDtNJyQ.exe
  2⤵
  - Executes dropped EXE
  PID:4692
- C:\Windows\System\ORseCGY.exe
  C:\Windows\System\ORseCGY.exe
  2⤵
  - Executes dropped EXE
  PID:5112
- C:\Windows\System\GSnNckk.exe
  C:\Windows\System\GSnNckk.exe
  2⤵
  - Executes dropped EXE
  PID:4388
- C:\Windows\System\EKKtSLh.exe
  C:\Windows\System\EKKtSLh.exe
  2⤵
  - Executes dropped EXE
  PID:4800
- C:\Windows\System\RgxkgUo.exe
  C:\Windows\System\RgxkgUo.exe
  2⤵
  - Executes dropped EXE
  PID:528
- C:\Windows\System\WocHoGE.exe
  C:\Windows\System\WocHoGE.exe
  2⤵
  - Executes dropped EXE
  PID:3180
- C:\Windows\System\oSahyRZ.exe
  C:\Windows\System\oSahyRZ.exe
  2⤵
  - Executes dropped EXE
  PID:1500
- C:\Windows\System\DsTHowh.exe
  C:\Windows\System\DsTHowh.exe
  2⤵
  - Executes dropped EXE
  PID:4024
- C:\Windows\System\fuuhVRu.exe
  C:\Windows\System\fuuhVRu.exe
  2⤵
  - Executes dropped EXE
  PID:1800
- C:\Windows\System\gRfIlzP.exe
  C:\Windows\System\gRfIlzP.exe
  2⤵
  - Executes dropped EXE
  PID:3736
- C:\Windows\System\CdRzyBQ.exe
  C:\Windows\System\CdRzyBQ.exe
  2⤵
  - Executes dropped EXE
  PID:4012
- C:\Windows\System\rnhrjRh.exe
  C:\Windows\System\rnhrjRh.exe
  2⤵
  - Executes dropped EXE
  PID:3832
- C:\Windows\System\bZRebBe.exe
  C:\Windows\System\bZRebBe.exe
  2⤵
  - Executes dropped EXE
  PID:3796
- C:\Windows\System\DWJmqDS.exe
  C:\Windows\System\DWJmqDS.exe
  2⤵
  - Executes dropped EXE
  PID:3056
- C:\Windows\System\PanrrDt.exe
  C:\Windows\System\PanrrDt.exe
  2⤵
  - Executes dropped EXE
  PID:1048
- C:\Windows\System\kwaNWyU.exe
  C:\Windows\System\kwaNWyU.exe
  2⤵
  - Executes dropped EXE
  PID:4256
- C:\Windows\System\eMYmHre.exe
  C:\Windows\System\eMYmHre.exe
  2⤵
  - Executes dropped EXE
  PID:4056
- C:\Windows\System\iBfVOdH.exe
  C:\Windows\System\iBfVOdH.exe
  2⤵
  - Executes dropped EXE
  PID:4844
- C:\Windows\System\RYFvQim.exe
  C:\Windows\System\RYFvQim.exe
  2⤵
  - Executes dropped EXE
  PID:4452
- C:\Windows\System\BDgVVPV.exe
  C:\Windows\System\BDgVVPV.exe
  2⤵
  - Executes dropped EXE
  PID:1720
- C:\Windows\System\yMWMbsx.exe
  C:\Windows\System\yMWMbsx.exe
  2⤵
  - Executes dropped EXE
  PID:2284
- C:\Windows\System\MTKHoDp.exe
  C:\Windows\System\MTKHoDp.exe
  2⤵
  PID:4952
- C:\Windows\System\XHTgaIc.exe
  C:\Windows\System\XHTgaIc.exe
  2⤵
  PID:4708
- C:\Windows\System\dyvvhaj.exe
  C:\Windows\System\dyvvhaj.exe
  2⤵
  PID:2496
- C:\Windows\System\tXcAVzq.exe
  C:\Windows\System\tXcAVzq.exe
  2⤵
  PID:1700
- C:\Windows\System\PwuXYPG.exe
  C:\Windows\System\PwuXYPG.exe
  2⤵
  PID:4352
- C:\Windows\System\JcmGrMB.exe
  C:\Windows\System\JcmGrMB.exe
  2⤵
  PID:4068
- C:\Windows\System\ZIkSDFY.exe
  C:\Windows\System\ZIkSDFY.exe
  2⤵
  PID:2640
- C:\Windows\System\pMWlFLb.exe
  C:\Windows\System\pMWlFLb.exe
  2⤵
  PID:4828
- C:\Windows\System\kzCGuFq.exe
  C:\Windows\System\kzCGuFq.exe
  2⤵
  PID:1644
- C:\Windows\System\dEvVedu.exe
  C:\Windows\System\dEvVedu.exe
  2⤵
  PID:3852
- C:\Windows\System\PqeMKJl.exe
  C:\Windows\System\PqeMKJl.exe
  2⤵
  PID:3620
- C:\Windows\System\CFeKdOq.exe
  C:\Windows\System\CFeKdOq.exe
  2⤵
  PID:1184
- C:\Windows\System\TJLJkKB.exe
  C:\Windows\System\TJLJkKB.exe
  2⤵
  PID:4464
- C:\Windows\System\btdHSOv.exe
  C:\Windows\System\btdHSOv.exe
  2⤵
  PID:228
- C:\Windows\System\lisTgWm.exe
  C:\Windows\System\lisTgWm.exe
  2⤵
  PID:4904
- C:\Windows\System\xhKBnCn.exe
  C:\Windows\System\xhKBnCn.exe
  2⤵
  PID:3336
- C:\Windows\System\UPgSTqX.exe
  C:\Windows\System\UPgSTqX.exe
  2⤵
  PID:4404
- C:\Windows\System\tTBLBpU.exe
  C:\Windows\System\tTBLBpU.exe
  2⤵
  PID:3988
- C:\Windows\System\mTrPeOz.exe
  C:\Windows\System\mTrPeOz.exe
  2⤵
  PID:2340
- C:\Windows\System\tuWhsFu.exe
  C:\Windows\System\tuWhsFu.exe
  2⤵
  PID:5140
- C:\Windows\System\zsZbPPW.exe
  C:\Windows\System\zsZbPPW.exe
  2⤵
  PID:5168
- C:\Windows\System\msxYMHO.exe
  C:\Windows\System\msxYMHO.exe
  2⤵
  PID:5196
- C:\Windows\System\rSZkXGK.exe
  C:\Windows\System\rSZkXGK.exe
  2⤵
  PID:5228
- C:\Windows\System\spGpmIb.exe
  C:\Windows\System\spGpmIb.exe
  2⤵
  PID:5256
- C:\Windows\System\xtawVUX.exe
  C:\Windows\System\xtawVUX.exe
  2⤵
  PID:5280
- C:\Windows\System\XcosExx.exe
  C:\Windows\System\XcosExx.exe
  2⤵
  PID:5308
- C:\Windows\System\vaCvSQO.exe
  C:\Windows\System\vaCvSQO.exe
  2⤵
  PID:5340
- C:\Windows\System\FHYsoCG.exe
  C:\Windows\System\FHYsoCG.exe
  2⤵
  PID:5368
- C:\Windows\System\DuyMcQT.exe
  C:\Windows\System\DuyMcQT.exe
  2⤵
  PID:5396
- C:\Windows\System\UtNQVOJ.exe
  C:\Windows\System\UtNQVOJ.exe
  2⤵
  PID:5420
- C:\Windows\System\mhthmas.exe
  C:\Windows\System\mhthmas.exe
  2⤵
  PID:5484
- C:\Windows\System\bSqdwWF.exe
  C:\Windows\System\bSqdwWF.exe
  2⤵
  PID:5500
- C:\Windows\System\LQfLkcs.exe
  C:\Windows\System\LQfLkcs.exe
  2⤵
  PID:5516
- C:\Windows\System\YmBfGBr.exe
  C:\Windows\System\YmBfGBr.exe
  2⤵
  PID:5540
- C:\Windows\System\DesGPwi.exe
  C:\Windows\System\DesGPwi.exe
  2⤵
  PID:5568
- C:\Windows\System\bRfvcZn.exe
  C:\Windows\System\bRfvcZn.exe
  2⤵
  PID:5596
- C:\Windows\System\ApkPLEz.exe
  C:\Windows\System\ApkPLEz.exe
  2⤵
  PID:5628
- C:\Windows\System\VVCXJLt.exe
  C:\Windows\System\VVCXJLt.exe
  2⤵
  PID:5652
- C:\Windows\System\ClNJUTr.exe
  C:\Windows\System\ClNJUTr.exe
  2⤵
  PID:5680
- C:\Windows\System\hbkLvpj.exe
  C:\Windows\System\hbkLvpj.exe
  2⤵
  PID:5708
- C:\Windows\System\eIkOauO.exe
  C:\Windows\System\eIkOauO.exe
  2⤵
  PID:5736
- C:\Windows\System\GKelBXO.exe
  C:\Windows\System\GKelBXO.exe
  2⤵
  PID:5764
- C:\Windows\System\lSccthO.exe
  C:\Windows\System\lSccthO.exe
  2⤵
  PID:5784
- C:\Windows\System\sDkMFPP.exe
  C:\Windows\System\sDkMFPP.exe
  2⤵
  PID:5812
- C:\Windows\System\tUdMqDd.exe
  C:\Windows\System\tUdMqDd.exe
  2⤵
  PID:5840
- C:\Windows\System\xBjIagY.exe
  C:\Windows\System\xBjIagY.exe
  2⤵
  PID:5868
- C:\Windows\System\LQjmzFJ.exe
  C:\Windows\System\LQjmzFJ.exe
  2⤵
  PID:5896
- C:\Windows\System\JCIhkKi.exe
  C:\Windows\System\JCIhkKi.exe
  2⤵
  PID:5920
- C:\Windows\System\crPKsiZ.exe
  C:\Windows\System\crPKsiZ.exe
  2⤵
  PID:5952
- C:\Windows\System\fVmEDJh.exe
  C:\Windows\System\fVmEDJh.exe
  2⤵
  PID:5980
- C:\Windows\System\Gbddqws.exe
  C:\Windows\System\Gbddqws.exe
  2⤵
  PID:6008
- C:\Windows\System\ewIZrij.exe
  C:\Windows\System\ewIZrij.exe
  2⤵
  PID:6036
- C:\Windows\System\DrwZGeS.exe
  C:\Windows\System\DrwZGeS.exe
  2⤵
  PID:6064
- C:\Windows\System\fxRKwpG.exe
  C:\Windows\System\fxRKwpG.exe
  2⤵
  PID:6092
- C:\Windows\System\jCYQZwe.exe
  C:\Windows\System\jCYQZwe.exe
  2⤵
  PID:6120
- C:\Windows\System\ygbYyvJ.exe
  C:\Windows\System\ygbYyvJ.exe
  2⤵
  PID:3076
- C:\Windows\System\OIZgrGE.exe
  C:\Windows\System\OIZgrGE.exe
  2⤵
  PID:1188
- C:\Windows\System\ejYRhgQ.exe
  C:\Windows\System\ejYRhgQ.exe
  2⤵
  PID:2660
- C:\Windows\System\LHYoQRK.exe
  C:\Windows\System\LHYoQRK.exe
  2⤵
  PID:2800
- C:\Windows\System\tHsutpi.exe
  C:\Windows\System\tHsutpi.exe
  2⤵
  PID:1804
- C:\Windows\System\GkQxITh.exe
  C:\Windows\System\GkQxITh.exe
  2⤵
  PID:1608
- C:\Windows\System\WxyjtgX.exe
  C:\Windows\System\WxyjtgX.exe
  2⤵
  PID:208
- C:\Windows\System\ayShntm.exe
  C:\Windows\System\ayShntm.exe
  2⤵
  PID:5124
- C:\Windows\System\zZlmIEH.exe
  C:\Windows\System\zZlmIEH.exe
  2⤵
  PID:5180
- C:\Windows\System\htTAgBJ.exe
  C:\Windows\System\htTAgBJ.exe
  2⤵
  PID:5244
- C:\Windows\System\dYKyjMv.exe
  C:\Windows\System\dYKyjMv.exe
  2⤵
  PID:5300
- C:\Windows\System\NdKmBoc.exe
  C:\Windows\System\NdKmBoc.exe
  2⤵
  PID:5376
- C:\Windows\System\RXeocxk.exe
  C:\Windows\System\RXeocxk.exe
  2⤵
  PID:5436
- C:\Windows\System\lvVIbBD.exe
  C:\Windows\System\lvVIbBD.exe
  2⤵
  PID:5508
- C:\Windows\System\JaYLsdW.exe
  C:\Windows\System\JaYLsdW.exe
  2⤵
  PID:5564
- C:\Windows\System\ugnatXI.exe
  C:\Windows\System\ugnatXI.exe
  2⤵
  PID:5640
- C:\Windows\System\HoDrIJh.exe
  C:\Windows\System\HoDrIJh.exe
  2⤵
  PID:5700
- C:\Windows\System\eWeaPvD.exe
  C:\Windows\System\eWeaPvD.exe
  2⤵
  PID:5760
- C:\Windows\System\FkTkxXM.exe
  C:\Windows\System\FkTkxXM.exe
  2⤵
  PID:5828
- C:\Windows\System\voEEEVC.exe
  C:\Windows\System\voEEEVC.exe
  2⤵
  PID:5880
- C:\Windows\System\phNYEmG.exe
  C:\Windows\System\phNYEmG.exe
  2⤵
  PID:5916
- C:\Windows\System\LirRiZi.exe
  C:\Windows\System\LirRiZi.exe
  2⤵
  PID:5992
- C:\Windows\System\QTdeTKo.exe
  C:\Windows\System\QTdeTKo.exe
  2⤵
  PID:6028
- C:\Windows\System\AEoRBmu.exe
  C:\Windows\System\AEoRBmu.exe
  2⤵
  PID:6104
- C:\Windows\System\YjHqHBb.exe
  C:\Windows\System\YjHqHBb.exe
  2⤵
  PID:2364
- C:\Windows\System\GqGrkwk.exe
  C:\Windows\System\GqGrkwk.exe
  2⤵
  PID:3412
- C:\Windows\System\goZkonk.exe
  C:\Windows\System\goZkonk.exe
  2⤵
  PID:2896
- C:\Windows\System\iPQeptL.exe
  C:\Windows\System\iPQeptL.exe
  2⤵
  PID:5156
- C:\Windows\System\YhzKzki.exe
  C:\Windows\System\YhzKzki.exe
  2⤵
  PID:5328
- C:\Windows\System\pWThnOL.exe
  C:\Windows\System\pWThnOL.exe
  2⤵
  PID:5440
- C:\Windows\System\nQHMiQg.exe
  C:\Windows\System\nQHMiQg.exe
  2⤵
  PID:5616
- C:\Windows\System\tcNEMtw.exe
  C:\Windows\System\tcNEMtw.exe
  2⤵
  PID:5752
- C:\Windows\System\AdPtTku.exe
  C:\Windows\System\AdPtTku.exe
  2⤵
  PID:5064
- C:\Windows\System\xmvtobK.exe
  C:\Windows\System\xmvtobK.exe
  2⤵
  PID:6000
- C:\Windows\System\JpGuOHe.exe
  C:\Windows\System\JpGuOHe.exe
  2⤵
  PID:6168
- C:\Windows\System\ZAiKoYi.exe
  C:\Windows\System\ZAiKoYi.exe
  2⤵
  PID:6196
- C:\Windows\System\hgILdHI.exe
  C:\Windows\System\hgILdHI.exe
  2⤵
  PID:6228
- C:\Windows\System\AvTmgaR.exe
  C:\Windows\System\AvTmgaR.exe
  2⤵
  PID:6256
- C:\Windows\System\DVufJDc.exe
  C:\Windows\System\DVufJDc.exe
  2⤵
  PID:6284
- C:\Windows\System\qIxzJqQ.exe
  C:\Windows\System\qIxzJqQ.exe
  2⤵
  PID:6312
- C:\Windows\System\XejyVCx.exe
  C:\Windows\System\XejyVCx.exe
  2⤵
  PID:6336
- C:\Windows\System\YeGBoYL.exe
  C:\Windows\System\YeGBoYL.exe
  2⤵
  PID:6368
- C:\Windows\System\bUHPpvf.exe
  C:\Windows\System\bUHPpvf.exe
  2⤵
  PID:6396
- C:\Windows\System\UibwAlT.exe
  C:\Windows\System\UibwAlT.exe
  2⤵
  PID:6424
- C:\Windows\System\XxsLFnA.exe
  C:\Windows\System\XxsLFnA.exe
  2⤵
  PID:6452
- C:\Windows\System\xHMAjCT.exe
  C:\Windows\System\xHMAjCT.exe
  2⤵
  PID:6480
- C:\Windows\System\NYCtLeG.exe
  C:\Windows\System\NYCtLeG.exe
  2⤵
  PID:6508
- C:\Windows\System\wHYdFcl.exe
  C:\Windows\System\wHYdFcl.exe
  2⤵
  PID:6536
- C:\Windows\System\sNnHYCJ.exe
  C:\Windows\System\sNnHYCJ.exe
  2⤵
  PID:6560
- C:\Windows\System\mtIKJvQ.exe
  C:\Windows\System\mtIKJvQ.exe
  2⤵
  PID:6592
- C:\Windows\System\xCUBkGz.exe
  C:\Windows\System\xCUBkGz.exe
  2⤵
  PID:6620
- C:\Windows\System\bQqkkqu.exe
  C:\Windows\System\bQqkkqu.exe
  2⤵
  PID:6648
- C:\Windows\System\QNjKazM.exe
  C:\Windows\System\QNjKazM.exe
  2⤵
  PID:6672
- C:\Windows\System\GKtzqET.exe
  C:\Windows\System\GKtzqET.exe
  2⤵
  PID:6700
- C:\Windows\System\jKfeegO.exe
  C:\Windows\System\jKfeegO.exe
  2⤵
  PID:6728
- C:\Windows\System\zXlcKHw.exe
  C:\Windows\System\zXlcKHw.exe
  2⤵
  PID:6760
- C:\Windows\System\QTLxcil.exe
  C:\Windows\System\QTLxcil.exe
  2⤵
  PID:6788
- C:\Windows\System\WLCcuSN.exe
  C:\Windows\System\WLCcuSN.exe
  2⤵
  PID:6816
- C:\Windows\System\MDRSQZG.exe
  C:\Windows\System\MDRSQZG.exe
  2⤵
  PID:6844
- C:\Windows\System\rZWzPBY.exe
  C:\Windows\System\rZWzPBY.exe
  2⤵
  PID:6872
- C:\Windows\System\EwjPCjf.exe
  C:\Windows\System\EwjPCjf.exe
  2⤵
  PID:6900
- C:\Windows\System\AMAXiJO.exe
  C:\Windows\System\AMAXiJO.exe
  2⤵
  PID:6928
- C:\Windows\System\cJmniwD.exe
  C:\Windows\System\cJmniwD.exe
  2⤵
  PID:6956
- C:\Windows\System\XfpcUaq.exe
  C:\Windows\System\XfpcUaq.exe
  2⤵
  PID:6984
- C:\Windows\System\LaLvgDI.exe
  C:\Windows\System\LaLvgDI.exe
  2⤵
  PID:7012
- C:\Windows\System\DzTgFZM.exe
  C:\Windows\System\DzTgFZM.exe
  2⤵
  PID:7064
- C:\Windows\System\voXkHmn.exe
  C:\Windows\System\voXkHmn.exe
  2⤵
  PID:7084
- C:\Windows\System\INEzBdQ.exe
  C:\Windows\System\INEzBdQ.exe
  2⤵
  PID:7108
- C:\Windows\System\DDQkZxq.exe
  C:\Windows\System\DDQkZxq.exe
  2⤵
  PID:7160
- C:\Windows\System\xOcZqLs.exe
  C:\Windows\System\xOcZqLs.exe
  2⤵
  PID:6136
- C:\Windows\System\eoABPcb.exe
  C:\Windows\System\eoABPcb.exe
  2⤵
  PID:1920
- C:\Windows\System\qeszHia.exe
  C:\Windows\System\qeszHia.exe
  2⤵
  PID:5224
- C:\Windows\System\ipzPNFq.exe
  C:\Windows\System\ipzPNFq.exe
  2⤵
  PID:5416
- C:\Windows\System\yoRwBKQ.exe
  C:\Windows\System\yoRwBKQ.exe
  2⤵
  PID:3004
- C:\Windows\System\VAEJcsz.exe
  C:\Windows\System\VAEJcsz.exe
  2⤵
  PID:6184
- C:\Windows\System\kKzSIDl.exe
  C:\Windows\System\kKzSIDl.exe
  2⤵
  PID:6220
- C:\Windows\System\VwipJpc.exe
  C:\Windows\System\VwipJpc.exe
  2⤵
  PID:6272
- C:\Windows\System\ABCtWjR.exe
  C:\Windows\System\ABCtWjR.exe
  2⤵
  PID:6300
- C:\Windows\System\hCHxGup.exe
  C:\Windows\System\hCHxGup.exe
  2⤵
  PID:6332
- C:\Windows\System\dpjYlQf.exe
  C:\Windows\System\dpjYlQf.exe
  2⤵
  PID:6388
- C:\Windows\System\bnCJrtj.exe
  C:\Windows\System\bnCJrtj.exe
  2⤵
  PID:1576
- C:\Windows\System\bxiJlff.exe
  C:\Windows\System\bxiJlff.exe
  2⤵
  PID:6524
- C:\Windows\System\iUJAojj.exe
  C:\Windows\System\iUJAojj.exe
  2⤵
  PID:6580
- C:\Windows\System\UVMYLqB.exe
  C:\Windows\System\UVMYLqB.exe
  2⤵
  PID:4592
- C:\Windows\System\nlAdQCZ.exe
  C:\Windows\System\nlAdQCZ.exe
  2⤵
  PID:6716
- C:\Windows\System\RqSBjpc.exe
  C:\Windows\System\RqSBjpc.exe
  2⤵
  PID:6772
- C:\Windows\System\QeGOeWI.exe
  C:\Windows\System\QeGOeWI.exe
  2⤵
  PID:6800
- C:\Windows\System\PEMsdgw.exe
  C:\Windows\System\PEMsdgw.exe
  2⤵
  PID:640
- C:\Windows\System\NrPqPBM.exe
  C:\Windows\System\NrPqPBM.exe
  2⤵
  PID:6836
- C:\Windows\System\XuYpzVj.exe
  C:\Windows\System\XuYpzVj.exe
  2⤵
  PID:6892
- C:\Windows\System\RbTUvGR.exe
  C:\Windows\System\RbTUvGR.exe
  2⤵
  PID:6976
- C:\Windows\System\bXtasAf.exe
  C:\Windows\System\bXtasAf.exe
  2⤵
  PID:6948
- C:\Windows\System\PJZNoKB.exe
  C:\Windows\System\PJZNoKB.exe
  2⤵
  PID:4236
- C:\Windows\System\peAQLSq.exe
  C:\Windows\System\peAQLSq.exe
  2⤵
  PID:7056
- C:\Windows\System\cgKeGEI.exe
  C:\Windows\System\cgKeGEI.exe
  2⤵
  PID:7000
- C:\Windows\System\DfBXaDF.exe
  C:\Windows\System\DfBXaDF.exe
  2⤵
  PID:6020
- C:\Windows\System\BxjpLSy.exe
  C:\Windows\System\BxjpLSy.exe
  2⤵
  PID:1996
- C:\Windows\System\RDpAVwI.exe
  C:\Windows\System\RDpAVwI.exe
  2⤵
  PID:2692
- C:\Windows\System\BNeBUhP.exe
  C:\Windows\System\BNeBUhP.exe
  2⤵
  PID:5728
- C:\Windows\System\oufNRhS.exe
  C:\Windows\System\oufNRhS.exe
  2⤵
  PID:6212
- C:\Windows\System\ejZUrXQ.exe
  C:\Windows\System\ejZUrXQ.exe
  2⤵
  PID:6412
- C:\Windows\System\vfDYPkk.exe
  C:\Windows\System\vfDYPkk.exe
  2⤵
  PID:6556
- C:\Windows\System\FOktOjx.exe
  C:\Windows\System\FOktOjx.exe
  2⤵
  PID:6640
- C:\Windows\System\GRGeOkr.exe
  C:\Windows\System\GRGeOkr.exe
  2⤵
  PID:3928
- C:\Windows\System\YJyIBjb.exe
  C:\Windows\System\YJyIBjb.exe
  2⤵
  PID:6864
- C:\Windows\System\cNmBCrt.exe
  C:\Windows\System\cNmBCrt.exe
  2⤵
  PID:6944
- C:\Windows\System\DCEgwWT.exe
  C:\Windows\System\DCEgwWT.exe
  2⤵
  PID:1612
- C:\Windows\System\MdICFrI.exe
  C:\Windows\System\MdICFrI.exe
  2⤵
  PID:4568
- C:\Windows\System\DOWCDFY.exe
  C:\Windows\System\DOWCDFY.exe
  2⤵
  PID:4368
- C:\Windows\System\HEDCSlr.exe
  C:\Windows\System\HEDCSlr.exe
  2⤵
  PID:6132
- C:\Windows\System\tEUYylg.exe
  C:\Windows\System\tEUYylg.exe
  2⤵
  PID:4676
- C:\Windows\System\uvYWQNF.exe
  C:\Windows\System\uvYWQNF.exe
  2⤵
  PID:1980
- C:\Windows\System\ZeSzoor.exe
  C:\Windows\System\ZeSzoor.exe
  2⤵
  PID:6828
- C:\Windows\System\KLxQrYd.exe
  C:\Windows\System\KLxQrYd.exe
  2⤵
  PID:2312
- C:\Windows\System\hpEZuOB.exe
  C:\Windows\System\hpEZuOB.exe
  2⤵
  PID:1292
- C:\Windows\System\bkckysi.exe
  C:\Windows\System\bkckysi.exe
  2⤵
  PID:6548
- C:\Windows\System\AZLJZaN.exe
  C:\Windows\System\AZLJZaN.exe
  2⤵
  PID:7140
- C:\Windows\System\wsjxxPZ.exe
  C:\Windows\System\wsjxxPZ.exe
  2⤵
  PID:6744
- C:\Windows\System\BzkSzbr.exe
  C:\Windows\System\BzkSzbr.exe
  2⤵
  PID:7184
- C:\Windows\System\yzQReXq.exe
  C:\Windows\System\yzQReXq.exe
  2⤵
  PID:7216
- C:\Windows\System\vbASgyt.exe
  C:\Windows\System\vbASgyt.exe
  2⤵
  PID:7244
- C:\Windows\System\PLyzhBb.exe
  C:\Windows\System\PLyzhBb.exe
  2⤵
  PID:7276
- C:\Windows\System\iYGRtWb.exe
  C:\Windows\System\iYGRtWb.exe
  2⤵
  PID:7304
- C:\Windows\System\yyNJUmF.exe
  C:\Windows\System\yyNJUmF.exe
  2⤵
  PID:7324
- C:\Windows\System\vkrPkax.exe
  C:\Windows\System\vkrPkax.exe
  2⤵
  PID:7352
- C:\Windows\System\DkqSqWO.exe
  C:\Windows\System\DkqSqWO.exe
  2⤵
  PID:7388
- C:\Windows\System\xWQuLeT.exe
  C:\Windows\System\xWQuLeT.exe
  2⤵
  PID:7404
- C:\Windows\System\bZmyVwM.exe
  C:\Windows\System\bZmyVwM.exe
  2⤵
  PID:7432
- C:\Windows\System\FCydffI.exe
  C:\Windows\System\FCydffI.exe
  2⤵
  PID:7460
- C:\Windows\System\ZbtqdKe.exe
  C:\Windows\System\ZbtqdKe.exe
  2⤵
  PID:7476
- C:\Windows\System\VwcahlX.exe
  C:\Windows\System\VwcahlX.exe
  2⤵
  PID:7504
- C:\Windows\System\CaziySu.exe
  C:\Windows\System\CaziySu.exe
  2⤵
  PID:7536
- C:\Windows\System\xBVwGBY.exe
  C:\Windows\System\xBVwGBY.exe
  2⤵
  PID:7584
- C:\Windows\System\EYDCfgn.exe
  C:\Windows\System\EYDCfgn.exe
  2⤵
  PID:7600
- C:\Windows\System\uvKOTAK.exe
  C:\Windows\System\uvKOTAK.exe
  2⤵
  PID:7640
- C:\Windows\System\asjfNKw.exe
  C:\Windows\System\asjfNKw.exe
  2⤵
  PID:7668
- C:\Windows\System\uIwlCfu.exe
  C:\Windows\System\uIwlCfu.exe
  2⤵
  PID:7684
- C:\Windows\System\KgDxLat.exe
  C:\Windows\System\KgDxLat.exe
  2⤵
  PID:7712
- C:\Windows\System\OHAMhev.exe
  C:\Windows\System\OHAMhev.exe
  2⤵
  PID:7740
- C:\Windows\System\AXrWzLf.exe
  C:\Windows\System\AXrWzLf.exe
  2⤵
  PID:7768
- C:\Windows\System\kdmZIAH.exe
  C:\Windows\System\kdmZIAH.exe
  2⤵
  PID:7784
- C:\Windows\System\NuKuZvE.exe
  C:\Windows\System\NuKuZvE.exe
  2⤵
  PID:7812
- C:\Windows\System\FKzGSaD.exe
  C:\Windows\System\FKzGSaD.exe
  2⤵
  PID:7844
- C:\Windows\System\tjvlCst.exe
  C:\Windows\System\tjvlCst.exe
  2⤵
  PID:7892
- C:\Windows\System\RqTAlSu.exe
  C:\Windows\System\RqTAlSu.exe
  2⤵
  PID:7908
- C:\Windows\System\txIqxgx.exe
  C:\Windows\System\txIqxgx.exe
  2⤵
  PID:7936
- C:\Windows\System\tHjbiLz.exe
  C:\Windows\System\tHjbiLz.exe
  2⤵
  PID:7964
- C:\Windows\System\LhfYdtD.exe
  C:\Windows\System\LhfYdtD.exe
  2⤵
  PID:7992
- C:\Windows\System\JzpAVwj.exe
  C:\Windows\System\JzpAVwj.exe
  2⤵
  PID:8020
- C:\Windows\System\sJHGICb.exe
  C:\Windows\System\sJHGICb.exe
  2⤵
  PID:8060
- C:\Windows\System\UmjWKUO.exe
  C:\Windows\System\UmjWKUO.exe
  2⤵
  PID:8076
- C:\Windows\System\eQpadiF.exe
  C:\Windows\System\eQpadiF.exe
  2⤵
  PID:8104
- C:\Windows\System\jPlbmme.exe
  C:\Windows\System\jPlbmme.exe
  2⤵
  PID:8140
- C:\Windows\System\kTOCTtp.exe
  C:\Windows\System\kTOCTtp.exe
  2⤵
  PID:8172
- C:\Windows\System\UKwFByX.exe
  C:\Windows\System\UKwFByX.exe
  2⤵
  PID:7180
- C:\Windows\System\zBsuLQw.exe
  C:\Windows\System\zBsuLQw.exe
  2⤵
  PID:7228
- C:\Windows\System\lCnmKPT.exe
  C:\Windows\System\lCnmKPT.exe
  2⤵
  PID:7300
- C:\Windows\System\nuwuTER.exe
  C:\Windows\System\nuwuTER.exe
  2⤵
  PID:7340
- C:\Windows\System\YOWeTIn.exe
  C:\Windows\System\YOWeTIn.exe
  2⤵
  PID:7372
- C:\Windows\System\EcysWUI.exe
  C:\Windows\System\EcysWUI.exe
  2⤵
  PID:7520
- C:\Windows\System\APNWLKK.exe
  C:\Windows\System\APNWLKK.exe
  2⤵
  PID:7576
- C:\Windows\System\YOHWQlc.exe
  C:\Windows\System\YOHWQlc.exe
  2⤵
  PID:7616
- C:\Windows\System\OltANRF.exe
  C:\Windows\System\OltANRF.exe
  2⤵
  PID:7676
- C:\Windows\System\irIlGPH.exe
  C:\Windows\System\irIlGPH.exe
  2⤵
  PID:7724
- C:\Windows\System\JjSnDjM.exe
  C:\Windows\System\JjSnDjM.exe
  2⤵
  PID:7780
- C:\Windows\System\INNPykk.exe
  C:\Windows\System\INNPykk.exe
  2⤵
  PID:7828
- C:\Windows\System\rMjQQqB.exe
  C:\Windows\System\rMjQQqB.exe
  2⤵
  PID:7928
- C:\Windows\System\BLXHQyF.exe
  C:\Windows\System\BLXHQyF.exe
  2⤵
  PID:7976
- C:\Windows\System\TcwqmaR.exe
  C:\Windows\System\TcwqmaR.exe
  2⤵
  PID:8068
- C:\Windows\System\MCfrVhN.exe
  C:\Windows\System\MCfrVhN.exe
  2⤵
  PID:8160
- C:\Windows\System\ifoxSnk.exe
  C:\Windows\System\ifoxSnk.exe
  2⤵
  PID:7264
- C:\Windows\System\EkLcRdy.exe
  C:\Windows\System\EkLcRdy.exe
  2⤵
  PID:7336
- C:\Windows\System\uZoOyeq.exe
  C:\Windows\System\uZoOyeq.exe
  2⤵
  PID:7424
- C:\Windows\System\HRMvhCY.exe
  C:\Windows\System\HRMvhCY.exe
  2⤵
  PID:7636
- C:\Windows\System\xRiWSGy.exe
  C:\Windows\System\xRiWSGy.exe
  2⤵
  PID:7696
- C:\Windows\System\HLYtYxg.exe
  C:\Windows\System\HLYtYxg.exe
  2⤵
  PID:7880
- C:\Windows\System\XXbsgPP.exe
  C:\Windows\System\XXbsgPP.exe
  2⤵
  PID:7888
- C:\Windows\System\FSGXivV.exe
  C:\Windows\System\FSGXivV.exe
  2⤵
  PID:7172
- C:\Windows\System\zEGQgHT.exe
  C:\Windows\System\zEGQgHT.exe
  2⤵
  PID:7380
- C:\Windows\System\RDMUoDj.exe
  C:\Windows\System\RDMUoDj.exe
  2⤵
  PID:8132
- C:\Windows\System\sBonhsc.exe
  C:\Windows\System\sBonhsc.exe
  2⤵
  PID:8040
- C:\Windows\System\cIzLgjg.exe
  C:\Windows\System\cIzLgjg.exe
  2⤵
  PID:7268
- C:\Windows\System\nmuErpm.exe
  C:\Windows\System\nmuErpm.exe
  2⤵
  PID:8208
- C:\Windows\System\AgLIYOu.exe
  C:\Windows\System\AgLIYOu.exe
  2⤵
  PID:8236
- C:\Windows\System\VbfqjAV.exe
  C:\Windows\System\VbfqjAV.exe
  2⤵
  PID:8264
- C:\Windows\System\oVbBySF.exe
  C:\Windows\System\oVbBySF.exe
  2⤵
  PID:8296
- C:\Windows\System\htPgJJR.exe
  C:\Windows\System\htPgJJR.exe
  2⤵
  PID:8344
- C:\Windows\System\SWbvsKi.exe
  C:\Windows\System\SWbvsKi.exe
  2⤵
  PID:8372
- C:\Windows\System\JKwROpi.exe
  C:\Windows\System\JKwROpi.exe
  2⤵
  PID:8400
- C:\Windows\System\zIWoKQI.exe
  C:\Windows\System\zIWoKQI.exe
  2⤵
  PID:8416
- C:\Windows\System\CZubNbZ.exe
  C:\Windows\System\CZubNbZ.exe
  2⤵
  PID:8432
- C:\Windows\System\qYnmcAJ.exe
  C:\Windows\System\qYnmcAJ.exe
  2⤵
  PID:8456
- C:\Windows\System\hycHpBY.exe
  C:\Windows\System\hycHpBY.exe
  2⤵
  PID:8488
- C:\Windows\System\mgcDSCU.exe
  C:\Windows\System\mgcDSCU.exe
  2⤵
  PID:8516
- C:\Windows\System\KjRdaWX.exe
  C:\Windows\System\KjRdaWX.exe
  2⤵
  PID:8540
- C:\Windows\System\aLdtvBF.exe
  C:\Windows\System\aLdtvBF.exe
  2⤵
  PID:8592
- C:\Windows\System\TrfyJAU.exe
  C:\Windows\System\TrfyJAU.exe
  2⤵
  PID:8636
- C:\Windows\System\CIsncuX.exe
  C:\Windows\System\CIsncuX.exe
  2⤵
  PID:8652
- C:\Windows\System\mAJMtzX.exe
  C:\Windows\System\mAJMtzX.exe
  2⤵
  PID:8680
- C:\Windows\System\VyyuIRR.exe
  C:\Windows\System\VyyuIRR.exe
  2⤵
  PID:8712
- C:\Windows\System\YyXnaSS.exe
  C:\Windows\System\YyXnaSS.exe
  2⤵
  PID:8740
- C:\Windows\System\KROEUCN.exe
  C:\Windows\System\KROEUCN.exe
  2⤵
  PID:8764
- C:\Windows\System\FhznVBk.exe
  C:\Windows\System\FhznVBk.exe
  2⤵
  PID:8780
- C:\Windows\System\VLqGJJG.exe
  C:\Windows\System\VLqGJJG.exe
  2⤵
  PID:8808
- C:\Windows\System\TUWycDV.exe
  C:\Windows\System\TUWycDV.exe
  2⤵
  PID:8840
- C:\Windows\System\IWIkYEj.exe
  C:\Windows\System\IWIkYEj.exe
  2⤵
  PID:8868
- C:\Windows\System\UUHkbBU.exe
  C:\Windows\System\UUHkbBU.exe
  2⤵
  PID:8916
- C:\Windows\System\gXrDhjO.exe
  C:\Windows\System\gXrDhjO.exe
  2⤵
  PID:8944
- C:\Windows\System\IQoSfYW.exe
  C:\Windows\System\IQoSfYW.exe
  2⤵
  PID:8960
- C:\Windows\System\OTpJXHy.exe
  C:\Windows\System\OTpJXHy.exe
  2⤵
  PID:8988
- C:\Windows\System\OIzrQlk.exe
  C:\Windows\System\OIzrQlk.exe
  2⤵
  PID:9016
- C:\Windows\System\fokwmdD.exe
  C:\Windows\System\fokwmdD.exe
  2⤵
  PID:9048
- C:\Windows\System\KqpwYOT.exe
  C:\Windows\System\KqpwYOT.exe
  2⤵
  PID:9072
- C:\Windows\System\VDPqRhW.exe
  C:\Windows\System\VDPqRhW.exe
  2⤵
  PID:9088
- C:\Windows\System\zTprYWP.exe
  C:\Windows\System\zTprYWP.exe
  2⤵
  PID:9128
- C:\Windows\System\IauugjF.exe
  C:\Windows\System\IauugjF.exe
  2⤵
  PID:9144
- C:\Windows\System\QeKsZYZ.exe
  C:\Windows\System\QeKsZYZ.exe
  2⤵
  PID:9164
- C:\Windows\System\xGBtsMm.exe
  C:\Windows\System\xGBtsMm.exe
  2⤵
  PID:9188
- C:\Windows\System\xsnrMDp.exe
  C:\Windows\System\xsnrMDp.exe
  2⤵
  PID:8044
- C:\Windows\System\MDZmdSG.exe
  C:\Windows\System\MDZmdSG.exe
  2⤵
  PID:8220
- C:\Windows\System\yYqBOEr.exe
  C:\Windows\System\yYqBOEr.exe
  2⤵
  PID:8292
- C:\Windows\System\uhKEDWs.exe
  C:\Windows\System\uhKEDWs.exe
  2⤵
  PID:8392
- C:\Windows\System\ZRTcSDs.exe
  C:\Windows\System\ZRTcSDs.exe
  2⤵
  PID:8468
- C:\Windows\System\xhIDrIi.exe
  C:\Windows\System\xhIDrIi.exe
  2⤵
  PID:8560
- C:\Windows\System\BoeGnKW.exe
  C:\Windows\System\BoeGnKW.exe
  2⤵
  PID:8576
- C:\Windows\System\PemlMhe.exe
  C:\Windows\System\PemlMhe.exe
  2⤵
  PID:8612
- C:\Windows\System\RYrnyuA.exe
  C:\Windows\System\RYrnyuA.exe
  2⤵
  PID:8752
- C:\Windows\System\RvDEGKV.exe
  C:\Windows\System\RvDEGKV.exe
  2⤵
  PID:8848
- C:\Windows\System\BFItVZG.exe
  C:\Windows\System\BFItVZG.exe
  2⤵
  PID:8864
- C:\Windows\System\OzdJwIc.exe
  C:\Windows\System\OzdJwIc.exe
  2⤵
  PID:8936
- C:\Windows\System\UQSOFhP.exe
  C:\Windows\System\UQSOFhP.exe
  2⤵
  PID:9008
- C:\Windows\System\NSILgrd.exe
  C:\Windows\System\NSILgrd.exe
  2⤵
  PID:9032
- C:\Windows\System\UNQgOuz.exe
  C:\Windows\System\UNQgOuz.exe
  2⤵
  PID:9152
- C:\Windows\System\sAkkveR.exe
  C:\Windows\System\sAkkveR.exe
  2⤵
  PID:7660
- C:\Windows\System\CqGqAEt.exe
  C:\Windows\System\CqGqAEt.exe
  2⤵
  PID:8204
- C:\Windows\System\fZlSSRJ.exe
  C:\Windows\System\fZlSSRJ.exe
  2⤵
  PID:8508
- C:\Windows\System\UMrhnvL.exe
  C:\Windows\System\UMrhnvL.exe
  2⤵
  PID:8700
- C:\Windows\System\hYnArzG.exe
  C:\Windows\System\hYnArzG.exe
  2⤵
  PID:8616
- C:\Windows\System\ADwlJyW.exe
  C:\Windows\System\ADwlJyW.exe
  2⤵
  PID:8792
- C:\Windows\System\YZJLucq.exe
  C:\Windows\System\YZJLucq.exe
  2⤵
  PID:8984
- C:\Windows\System\Pqmowsj.exe
  C:\Windows\System\Pqmowsj.exe
  2⤵
  PID:9172
- C:\Windows\System\kOdtuir.exe
  C:\Windows\System\kOdtuir.exe
  2⤵
  PID:8356
- C:\Windows\System\WlUMGRK.exe
  C:\Windows\System\WlUMGRK.exe
  2⤵
  PID:8828
- C:\Windows\System\gaPYNPB.exe
  C:\Windows\System\gaPYNPB.exe
  2⤵
  PID:9176
- C:\Windows\System\kWZzzaR.exe
  C:\Windows\System\kWZzzaR.exe
  2⤵
  PID:8620
- C:\Windows\System\qMbabQI.exe
  C:\Windows\System\qMbabQI.exe
  2⤵
  PID:9220
- C:\Windows\System\UtIVXKs.exe
  C:\Windows\System\UtIVXKs.exe
  2⤵
  PID:9244
- C:\Windows\System\OKfhHdp.exe
  C:\Windows\System\OKfhHdp.exe
  2⤵
  PID:9268
- C:\Windows\System\QhCvqbB.exe
  C:\Windows\System\QhCvqbB.exe
  2⤵
  PID:9288
- C:\Windows\System\IoZRdLd.exe
  C:\Windows\System\IoZRdLd.exe
  2⤵
  PID:9364
- C:\Windows\System\vIRsxgz.exe
  C:\Windows\System\vIRsxgz.exe
  2⤵
  PID:9384
- C:\Windows\System\otMtlGg.exe
  C:\Windows\System\otMtlGg.exe
  2⤵
  PID:9412
- C:\Windows\System\exxibjy.exe
  C:\Windows\System\exxibjy.exe
  2⤵
  PID:9440
- C:\Windows\System\ZOaCBXu.exe
  C:\Windows\System\ZOaCBXu.exe
  2⤵
  PID:9456
- C:\Windows\System\WcNiZrR.exe
  C:\Windows\System\WcNiZrR.exe
  2⤵
  PID:9488
- C:\Windows\System\FEVEgUE.exe
  C:\Windows\System\FEVEgUE.exe
  2⤵
  PID:9536
- C:\Windows\System\OtEKmkJ.exe
  C:\Windows\System\OtEKmkJ.exe
  2⤵
  PID:9552
- C:\Windows\System\XfDxRqY.exe
  C:\Windows\System\XfDxRqY.exe
  2⤵
  PID:9576
- C:\Windows\System\XiXMKfs.exe
  C:\Windows\System\XiXMKfs.exe
  2⤵
  PID:9608
- C:\Windows\System\wCNZvlp.exe
  C:\Windows\System\wCNZvlp.exe
  2⤵
  PID:9636
- C:\Windows\System\sbKPeWk.exe
  C:\Windows\System\sbKPeWk.exe
  2⤵
  PID:9660
- C:\Windows\System\doIfwGk.exe
  C:\Windows\System\doIfwGk.exe
  2⤵
  PID:9692
- C:\Windows\System\JihJMxv.exe
  C:\Windows\System\JihJMxv.exe
  2⤵
  PID:9720
- C:\Windows\System\giiuEbh.exe
  C:\Windows\System\giiuEbh.exe
  2⤵
  PID:9748
- C:\Windows\System\DfBtpuf.exe
  C:\Windows\System\DfBtpuf.exe
  2⤵
  PID:9776
- C:\Windows\System\lfmyiFg.exe
  C:\Windows\System\lfmyiFg.exe
  2⤵
  PID:9816
- C:\Windows\System\uicjFBu.exe
  C:\Windows\System\uicjFBu.exe
  2⤵
  PID:9832
- C:\Windows\System\YyQuLvZ.exe
  C:\Windows\System\YyQuLvZ.exe
  2⤵
  PID:9848
- C:\Windows\System\hEriGFt.exe
  C:\Windows\System\hEriGFt.exe
  2⤵
  PID:9888
- C:\Windows\System\lpFdeiL.exe
  C:\Windows\System\lpFdeiL.exe
  2⤵
  PID:9916
- C:\Windows\System\fPENvjL.exe
  C:\Windows\System\fPENvjL.exe
  2⤵
  PID:9944
- C:\Windows\System\bjhoiut.exe
  C:\Windows\System\bjhoiut.exe
  2⤵
  PID:9972
- C:\Windows\System\JdPRMrO.exe
  C:\Windows\System\JdPRMrO.exe
  2⤵
  PID:10000
- C:\Windows\System\qeManlp.exe
  C:\Windows\System\qeManlp.exe
  2⤵
  PID:10028
- C:\Windows\System\YFFfKoN.exe
  C:\Windows\System\YFFfKoN.exe
  2⤵
  PID:10056
- C:\Windows\System\lKoJzOy.exe
  C:\Windows\System\lKoJzOy.exe
  2⤵
  PID:10084
- C:\Windows\System\cifPNLO.exe
  C:\Windows\System\cifPNLO.exe
  2⤵
  PID:10112
- C:\Windows\System\fkijJsu.exe
  C:\Windows\System\fkijJsu.exe
  2⤵
  PID:10140
- C:\Windows\System\yRoGYmO.exe
  C:\Windows\System\yRoGYmO.exe
  2⤵
  PID:10156
- C:\Windows\System\mxpggXr.exe
  C:\Windows\System\mxpggXr.exe
  2⤵
  PID:10184
- C:\Windows\System\xUONcYM.exe
  C:\Windows\System\xUONcYM.exe
  2⤵
  PID:10228
- C:\Windows\System\xhpScHZ.exe
  C:\Windows\System\xhpScHZ.exe
  2⤵
  PID:9028
- C:\Windows\System\TxhMZxU.exe
  C:\Windows\System\TxhMZxU.exe
  2⤵
  PID:9252
- C:\Windows\System\WUJqvhY.exe
  C:\Windows\System\WUJqvhY.exe
  2⤵
  PID:9312
- C:\Windows\System\EbVXXnC.exe
  C:\Windows\System\EbVXXnC.exe
  2⤵
  PID:9424
- C:\Windows\System\vDqrmpQ.exe
  C:\Windows\System\vDqrmpQ.exe
  2⤵
  PID:9516
- C:\Windows\System\YBkRaEI.exe
  C:\Windows\System\YBkRaEI.exe
  2⤵
  PID:9548
- C:\Windows\System\ZknEmzn.exe
  C:\Windows\System\ZknEmzn.exe
  2⤵
  PID:9628
- C:\Windows\System\nJWfSXo.exe
  C:\Windows\System\nJWfSXo.exe
  2⤵
  PID:9656
- C:\Windows\System\FDSzqYH.exe
  C:\Windows\System\FDSzqYH.exe
  2⤵
  PID:9736
- C:\Windows\System\ZtjqKgj.exe
  C:\Windows\System\ZtjqKgj.exe
  2⤵
  PID:9764
- C:\Windows\System\RVEDyun.exe
  C:\Windows\System\RVEDyun.exe
  2⤵
  PID:9828
- C:\Windows\System\YHfocfC.exe
  C:\Windows\System\YHfocfC.exe
  2⤵
  PID:9936
- C:\Windows\System\WpQAjuV.exe
  C:\Windows\System\WpQAjuV.exe
  2⤵
  PID:9960
- C:\Windows\System\hIWuveo.exe
  C:\Windows\System\hIWuveo.exe
  2⤵
  PID:9992
- C:\Windows\System\HOvERrw.exe
  C:\Windows\System\HOvERrw.exe
  2⤵
  PID:10044
- C:\Windows\System\KWYyBSy.exe
  C:\Windows\System\KWYyBSy.exe
  2⤵
  PID:10128
- C:\Windows\System\DTqmtKP.exe
  C:\Windows\System\DTqmtKP.exe
  2⤵
  PID:10220
- C:\Windows\System\PFfMmCP.exe
  C:\Windows\System\PFfMmCP.exe
  2⤵
  PID:9136
- C:\Windows\System\rGyQlKs.exe
  C:\Windows\System\rGyQlKs.exe
  2⤵
  PID:9284
- C:\Windows\System\vxjmuqH.exe
  C:\Windows\System\vxjmuqH.exe
  2⤵
  PID:9528
- C:\Windows\System\wDaWFSo.exe
  C:\Windows\System\wDaWFSo.exe
  2⤵
  PID:9620
- C:\Windows\System\GrrXBGV.exe
  C:\Windows\System\GrrXBGV.exe
  2⤵
  PID:9768
- C:\Windows\System\oMLflyW.exe
  C:\Windows\System\oMLflyW.exe
  2⤵
  PID:9988
- C:\Windows\System\lQVlnmb.exe
  C:\Windows\System\lQVlnmb.exe
  2⤵
  PID:10048
- C:\Windows\System\WHLdkEQ.exe
  C:\Windows\System\WHLdkEQ.exe
  2⤵
  PID:9400
- C:\Windows\System\XGzELBB.exe
  C:\Windows\System\XGzELBB.exe
  2⤵
  PID:9588
- C:\Windows\System\JIwdaYP.exe
  C:\Windows\System\JIwdaYP.exe
  2⤵
  PID:9740
- C:\Windows\System\DdHxvGy.exe
  C:\Windows\System\DdHxvGy.exe
  2⤵
  PID:10268
- C:\Windows\System\lXBJpmc.exe
  C:\Windows\System\lXBJpmc.exe
  2⤵
  PID:10328
- C:\Windows\System\lqYriyh.exe
  C:\Windows\System\lqYriyh.exe
  2⤵
  PID:10356
- C:\Windows\System\YSnogGe.exe
  C:\Windows\System\YSnogGe.exe
  2⤵
  PID:10384
- C:\Windows\System\MfiAMLj.exe
  C:\Windows\System\MfiAMLj.exe
  2⤵
  PID:10412
- C:\Windows\System\kcDDBzX.exe
  C:\Windows\System\kcDDBzX.exe
  2⤵
  PID:10428
- C:\Windows\System\KTrTpdb.exe
  C:\Windows\System\KTrTpdb.exe
  2⤵
  PID:10456
- C:\Windows\System\fbkfcvf.exe
  C:\Windows\System\fbkfcvf.exe
  2⤵
  PID:10484
- C:\Windows\System\DByolIc.exe
  C:\Windows\System\DByolIc.exe
  2⤵
  PID:10512
- C:\Windows\System\NsARsLs.exe
  C:\Windows\System\NsARsLs.exe
  2⤵
  PID:10528
- C:\Windows\System\RJgkeWx.exe
  C:\Windows\System\RJgkeWx.exe
  2⤵
  PID:10568
- C:\Windows\System\zRQwSjq.exe
  C:\Windows\System\zRQwSjq.exe
  2⤵
  PID:10596
- C:\Windows\System\pIzFPMb.exe
  C:\Windows\System\pIzFPMb.exe
  2⤵
  PID:10636
- C:\Windows\System\fOXKmUS.exe
  C:\Windows\System\fOXKmUS.exe
  2⤵
  PID:10652
- C:\Windows\System\PzZvrmN.exe
  C:\Windows\System\PzZvrmN.exe
  2⤵
  PID:10672
- C:\Windows\System\nFAIPpp.exe
  C:\Windows\System\nFAIPpp.exe
  2⤵
  PID:10696
- C:\Windows\System\BgNxQjC.exe
  C:\Windows\System\BgNxQjC.exe
  2⤵
  PID:10720
- C:\Windows\System\BenQUOR.exe
  C:\Windows\System\BenQUOR.exe
  2⤵
  PID:10752
- C:\Windows\System\AFBUxiV.exe
  C:\Windows\System\AFBUxiV.exe
  2⤵
  PID:10780
- C:\Windows\System\juexXVr.exe
  C:\Windows\System\juexXVr.exe
  2⤵
  PID:10816
- C:\Windows\System\MzhjNbt.exe
  C:\Windows\System\MzhjNbt.exe
  2⤵
  PID:10840
- C:\Windows\System\ECuNpOF.exe
  C:\Windows\System\ECuNpOF.exe
  2⤵
  PID:10872
- C:\Windows\System\dXUKIWR.exe
  C:\Windows\System\dXUKIWR.exe
  2⤵
  PID:10892
- C:\Windows\System\NEMbpPo.exe
  C:\Windows\System\NEMbpPo.exe
  2⤵
  PID:10936
- C:\Windows\System\gCJMuGw.exe
  C:\Windows\System\gCJMuGw.exe
  2⤵
  PID:10960
- C:\Windows\System\DnxjcCk.exe
  C:\Windows\System\DnxjcCk.exe
  2⤵
  PID:10996
- C:\Windows\System\VvycXsd.exe
  C:\Windows\System\VvycXsd.exe
  2⤵
  PID:11028
- C:\Windows\System\dRbXMrT.exe
  C:\Windows\System\dRbXMrT.exe
  2⤵
  PID:11044
- C:\Windows\System\fpMcZPb.exe
  C:\Windows\System\fpMcZPb.exe
  2⤵
  PID:11072
- C:\Windows\System\jRrNgWw.exe
  C:\Windows\System\jRrNgWw.exe
  2⤵
  PID:11112
- C:\Windows\System\jyCHzMm.exe
  C:\Windows\System\jyCHzMm.exe
  2⤵
  PID:11128
- C:\Windows\System\hHDZMoj.exe
  C:\Windows\System\hHDZMoj.exe
  2⤵
  PID:11148
- C:\Windows\System\MPRUgvc.exe
  C:\Windows\System\MPRUgvc.exe
  2⤵
  PID:11168
- C:\Windows\System\zVDEtFa.exe
  C:\Windows\System\zVDEtFa.exe
  2⤵
  PID:11196
- C:\Windows\System\ZorDpmM.exe
  C:\Windows\System\ZorDpmM.exe
  2⤵
  PID:11252
- C:\Windows\System\PNXNqWA.exe
  C:\Windows\System\PNXNqWA.exe
  2⤵
  PID:9236
- C:\Windows\System\NpAKikj.exe
  C:\Windows\System\NpAKikj.exe
  2⤵
  PID:10256
- C:\Windows\System\JaqJlAj.exe
  C:\Windows\System\JaqJlAj.exe
  2⤵
  PID:10284
- C:\Windows\System\jSuxvIc.exe
  C:\Windows\System\jSuxvIc.exe
  2⤵
  PID:10376
- C:\Windows\System\awkDQRX.exe
  C:\Windows\System\awkDQRX.exe
  2⤵
  PID:10448
- C:\Windows\System\lYJKSWo.exe
  C:\Windows\System\lYJKSWo.exe
  2⤵
  PID:10500
- C:\Windows\System\hQiRsCl.exe
  C:\Windows\System\hQiRsCl.exe
  2⤵
  PID:10584
- C:\Windows\System\EDZHYlH.exe
  C:\Windows\System\EDZHYlH.exe
  2⤵
  PID:10648
- C:\Windows\System\OYSYjqa.exe
  C:\Windows\System\OYSYjqa.exe
  2⤵
  PID:10712
- C:\Windows\System\LpEERqq.exe
  C:\Windows\System\LpEERqq.exe
  2⤵
  PID:10776
- C:\Windows\System\oRSLliT.exe
  C:\Windows\System\oRSLliT.exe
  2⤵
  PID:10832
- C:\Windows\System\kuOBnsH.exe
  C:\Windows\System\kuOBnsH.exe
  2⤵
  PID:10864
- C:\Windows\System\nMtraPN.exe
  C:\Windows\System\nMtraPN.exe
  2⤵
  PID:10920
- C:\Windows\System\jyiKFMC.exe
  C:\Windows\System\jyiKFMC.exe
  2⤵
  PID:10988
- C:\Windows\System\nVefxxr.exe
  C:\Windows\System\nVefxxr.exe
  2⤵
  PID:11012
- C:\Windows\System\eOGwKvk.exe
  C:\Windows\System\eOGwKvk.exe
  2⤵
  PID:11068
- C:\Windows\System\yfBohaR.exe
  C:\Windows\System\yfBohaR.exe
  2⤵
  PID:11120
- C:\Windows\System\aKdcsAi.exe
  C:\Windows\System\aKdcsAi.exe
  2⤵
  PID:11192
- C:\Windows\System\qDlLGtb.exe
  C:\Windows\System\qDlLGtb.exe
  2⤵
  PID:10176
- C:\Windows\System\urqxzGq.exe
  C:\Windows\System\urqxzGq.exe
  2⤵
  PID:10424
- C:\Windows\System\MpxeZoh.exe
  C:\Windows\System\MpxeZoh.exe
  2⤵
  PID:10620
- C:\Windows\System\wPjxukh.exe
  C:\Windows\System\wPjxukh.exe
  2⤵
  PID:10704
- C:\Windows\System\ZNLTaqv.exe
  C:\Windows\System\ZNLTaqv.exe
  2⤵
  PID:10916
- C:\Windows\System\BDXLKZC.exe
  C:\Windows\System\BDXLKZC.exe
  2⤵
  PID:11020
- C:\Windows\System\doNMODd.exe
  C:\Windows\System\doNMODd.exe
  2⤵
  PID:11144
- C:\Windows\System\kyuOyAY.exe
  C:\Windows\System\kyuOyAY.exe
  2⤵
  PID:10352
- C:\Windows\System\ghPIgFg.exe
  C:\Windows\System\ghPIgFg.exe
  2⤵
  PID:10680
- C:\Windows\System\JBqYsVt.exe
  C:\Windows\System\JBqYsVt.exe
  2⤵
  PID:11136
- C:\Windows\System\MdMNLDe.exe
  C:\Windows\System\MdMNLDe.exe
  2⤵
  PID:10768
- C:\Windows\System\lFNdAul.exe
  C:\Windows\System\lFNdAul.exe
  2⤵
  PID:10564
- C:\Windows\System\udpIftx.exe
  C:\Windows\System\udpIftx.exe
  2⤵
  PID:11284
- C:\Windows\System\aoHPSqQ.exe
  C:\Windows\System\aoHPSqQ.exe
  2⤵
  PID:11300
- C:\Windows\System\VqUqCjX.exe
  C:\Windows\System\VqUqCjX.exe
  2⤵
  PID:11348
- C:\Windows\System\Tjepych.exe
  C:\Windows\System\Tjepych.exe
  2⤵
  PID:11380
- C:\Windows\System\YeyojSY.exe
  C:\Windows\System\YeyojSY.exe
  2⤵
  PID:11412
- C:\Windows\System\uJXmozv.exe
  C:\Windows\System\uJXmozv.exe
  2⤵
  PID:11428
- C:\Windows\System\YBmVEFu.exe
  C:\Windows\System\YBmVEFu.exe
  2⤵
  PID:11452
- C:\Windows\System\wKpZtcN.exe
  C:\Windows\System\wKpZtcN.exe
  2⤵
  PID:11488
- C:\Windows\System\OUAgSMr.exe
  C:\Windows\System\OUAgSMr.exe
  2⤵
  PID:11512
- C:\Windows\System\EDgbpZT.exe
  C:\Windows\System\EDgbpZT.exe
  2⤵
  PID:11548
- C:\Windows\System\NUTOVxz.exe
  C:\Windows\System\NUTOVxz.exe
  2⤵
  PID:11568
- C:\Windows\System\eVZEotR.exe
  C:\Windows\System\eVZEotR.exe
  2⤵
  PID:11608
- C:\Windows\System\njIVkOr.exe
  C:\Windows\System\njIVkOr.exe
  2⤵
  PID:11636
- C:\Windows\System\ETZniiQ.exe
  C:\Windows\System\ETZniiQ.exe
  2⤵
  PID:11652
- C:\Windows\System\wqOUHDz.exe
  C:\Windows\System\wqOUHDz.exe
  2⤵
  PID:11680
- C:\Windows\System\BisWDIO.exe
  C:\Windows\System\BisWDIO.exe
  2⤵
  PID:11696
- C:\Windows\System\AIwVAQf.exe
  C:\Windows\System\AIwVAQf.exe
  2⤵
  PID:11720
- C:\Windows\System\OuetHCe.exe
  C:\Windows\System\OuetHCe.exe
  2⤵
  PID:11740
- C:\Windows\System\pAcertb.exe
  C:\Windows\System\pAcertb.exe
  2⤵
  PID:11760
- C:\Windows\System\HjUhwSz.exe
  C:\Windows\System\HjUhwSz.exe
  2⤵
  PID:11792
- C:\Windows\System\zDzXnLp.exe
  C:\Windows\System\zDzXnLp.exe
  2⤵
  PID:11820
- C:\Windows\System\pDvBLkU.exe
  C:\Windows\System\pDvBLkU.exe
  2⤵
  PID:11852
- C:\Windows\System\QhbLubh.exe
  C:\Windows\System\QhbLubh.exe
  2⤵
  PID:11888
- C:\Windows\System\FoIoDGC.exe
  C:\Windows\System\FoIoDGC.exe
  2⤵
  PID:11908
- C:\Windows\System\OQnARCx.exe
  C:\Windows\System\OQnARCx.exe
  2⤵
  PID:11960
- C:\Windows\System\okwlOUu.exe
  C:\Windows\System\okwlOUu.exe
  2⤵
  PID:11992
- C:\Windows\System\zfhDcEr.exe
  C:\Windows\System\zfhDcEr.exe
  2⤵
  PID:12024
- C:\Windows\System\cAYDuBo.exe
  C:\Windows\System\cAYDuBo.exe
  2⤵
  PID:12040
- C:\Windows\System\rOzqaLM.exe
  C:\Windows\System\rOzqaLM.exe
  2⤵
  PID:12056
- C:\Windows\System\NFawkth.exe
  C:\Windows\System\NFawkth.exe
  2⤵
  PID:12072
- C:\Windows\System\KgYyVLs.exe
  C:\Windows\System\KgYyVLs.exe
  2⤵
  PID:12108
- C:\Windows\System\FRQzEug.exe
  C:\Windows\System\FRQzEug.exe
  2⤵
  PID:12128
- C:\Windows\System\NEPpRLr.exe
  C:\Windows\System\NEPpRLr.exe
  2⤵
  PID:12156
- C:\Windows\System\DRHLcxx.exe
  C:\Windows\System\DRHLcxx.exe
  2⤵
  PID:12176
- C:\Windows\System\NazjNBD.exe
  C:\Windows\System\NazjNBD.exe
  2⤵
  PID:12204
- C:\Windows\System\ihRHoOg.exe
  C:\Windows\System\ihRHoOg.exe
  2⤵
  PID:12272
- C:\Windows\System\tMDyTRD.exe
  C:\Windows\System\tMDyTRD.exe
  2⤵
  PID:11268
- C:\Windows\System\oVNfsRM.exe
  C:\Windows\System\oVNfsRM.exe
  2⤵
  PID:11368
- C:\Windows\System\QrxjOWT.exe
  C:\Windows\System\QrxjOWT.exe
  2⤵
  PID:11424
- C:\Windows\System\FuqYaAE.exe
  C:\Windows\System\FuqYaAE.exe
  2⤵
  PID:11496
- C:\Windows\System\VgYcbwe.exe
  C:\Windows\System\VgYcbwe.exe
  2⤵
  PID:11556
- C:\Windows\System\DdgYctA.exe
  C:\Windows\System\DdgYctA.exe
  2⤵
  PID:11628
- C:\Windows\System\yhpxJrE.exe
  C:\Windows\System\yhpxJrE.exe
  2⤵
  PID:11708
- C:\Windows\System\BEFZsBM.exe
  C:\Windows\System\BEFZsBM.exe
  2⤵
  PID:11768
- C:\Windows\System\JYXYKAu.exe
  C:\Windows\System\JYXYKAu.exe
  2⤵
  PID:11860
- C:\Windows\System\nibMqEv.exe
  C:\Windows\System\nibMqEv.exe
  2⤵
  PID:11840
- C:\Windows\System\HdArCBN.exe
  C:\Windows\System\HdArCBN.exe
  2⤵
  PID:11928
- C:\Windows\System\hTGlTgv.exe
  C:\Windows\System\hTGlTgv.exe
  2⤵
  PID:12036
- C:\Windows\System\SsfSyFt.exe
  C:\Windows\System\SsfSyFt.exe
  2⤵
  PID:12116
- C:\Windows\System\uVAQIjK.exe
  C:\Windows\System\uVAQIjK.exe
  2⤵
  PID:12164
- C:\Windows\System\whdyRgR.exe
  C:\Windows\System\whdyRgR.exe
  2⤵
  PID:12228
- C:\Windows\System\vhuefbz.exe
  C:\Windows\System\vhuefbz.exe
  2⤵
  PID:11276
- C:\Windows\System\UIoiMQC.exe
  C:\Windows\System\UIoiMQC.exe
  2⤵
  PID:11440
- C:\Windows\System\DZMnQbp.exe
  C:\Windows\System\DZMnQbp.exe
  2⤵
  PID:11604
- C:\Windows\System\nIbhcYd.exe
  C:\Windows\System\nIbhcYd.exe
  2⤵
  PID:11688
- C:\Windows\System\OaAWkCG.exe
  C:\Windows\System\OaAWkCG.exe
  2⤵
  PID:11868
- C:\Windows\System\TWKpArP.exe
  C:\Windows\System\TWKpArP.exe
  2⤵
  PID:11944
- C:\Windows\System\PVodKzG.exe
  C:\Windows\System\PVodKzG.exe
  2⤵
  PID:12200
- C:\Windows\System\Mdoolbb.exe
  C:\Windows\System\Mdoolbb.exe
  2⤵
  PID:11396
- C:\Windows\System\tuRTdUG.exe
  C:\Windows\System\tuRTdUG.exe
  2⤵
  PID:11748
- C:\Windows\System\ahrIehi.exe
  C:\Windows\System\ahrIehi.exe
  2⤵
  PID:11976
- C:\Windows\System\yYjJlfO.exe
  C:\Windows\System\yYjJlfO.exe
  2⤵
  PID:12140
- C:\Windows\System\MpHiHvS.exe
  C:\Windows\System\MpHiHvS.exe
  2⤵
  PID:11668
- C:\Windows\System\rdFnPYK.exe
  C:\Windows\System\rdFnPYK.exe
  2⤵
  PID:12332
- C:\Windows\System\wGcjAGm.exe
  C:\Windows\System\wGcjAGm.exe
  2⤵
  PID:12348
- C:\Windows\System\ifsezMC.exe
  C:\Windows\System\ifsezMC.exe
  2⤵
  PID:12392
- C:\Windows\System\isGZPrN.exe
  C:\Windows\System\isGZPrN.exe
  2⤵
  PID:12420
- C:\Windows\System\fPwLQDD.exe
  C:\Windows\System\fPwLQDD.exe
  2⤵
  PID:12448
- C:\Windows\System\fElWCVY.exe
  C:\Windows\System\fElWCVY.exe
  2⤵
  PID:12476
- C:\Windows\System\YKNiLGX.exe
  C:\Windows\System\YKNiLGX.exe
  2⤵
  PID:12504
- C:\Windows\System\nhKgfRq.exe
  C:\Windows\System\nhKgfRq.exe
  2⤵
  PID:12532
- C:\Windows\System\BUMHiUt.exe
  C:\Windows\System\BUMHiUt.exe
  2⤵
  PID:12548
- C:\Windows\System\RUYutmH.exe
  C:\Windows\System\RUYutmH.exe
  2⤵
  PID:12572
- C:\Windows\System\fSRZarz.exe
  C:\Windows\System\fSRZarz.exe
  2⤵
  PID:12604
- C:\Windows\System\TrLjbCy.exe
  C:\Windows\System\TrLjbCy.exe
  2⤵
  PID:12624
- C:\Windows\System\IddLxfY.exe
  C:\Windows\System\IddLxfY.exe
  2⤵
  PID:12656
- C:\Windows\System\bZNqcnL.exe
  C:\Windows\System\bZNqcnL.exe
  2⤵
  PID:12676
- C:\Windows\System\yfACaeu.exe
  C:\Windows\System\yfACaeu.exe
  2⤵
  PID:12700
- C:\Windows\System\fDaoWas.exe
  C:\Windows\System\fDaoWas.exe
  2⤵
  PID:12728
- C:\Windows\System\dRsghDt.exe
  C:\Windows\System\dRsghDt.exe
  2⤵
  PID:12748
- C:\Windows\System\HhwWHuO.exe
  C:\Windows\System\HhwWHuO.exe
  2⤵
  PID:12772
- C:\Windows\System\YrvsHxq.exe
  C:\Windows\System\YrvsHxq.exe
  2⤵
  PID:12792
- C:\Windows\System\DDRBYhn.exe
  C:\Windows\System\DDRBYhn.exe
  2⤵
  PID:12816
- C:\Windows\System\TNunKhq.exe
  C:\Windows\System\TNunKhq.exe
  2⤵
  PID:12840
- C:\Windows\System\ZFsvBvf.exe
  C:\Windows\System\ZFsvBvf.exe
  2⤵
  PID:12900
- C:\Windows\System\CZQJmPn.exe
  C:\Windows\System\CZQJmPn.exe
  2⤵
  PID:12920
- C:\Windows\System\MOwsvpy.exe
  C:\Windows\System\MOwsvpy.exe
  2⤵
  PID:12944
- C:\Windows\System\HjvzWxa.exe
  C:\Windows\System\HjvzWxa.exe
  2⤵
  PID:12960
- C:\Windows\System\QpUOGov.exe
  C:\Windows\System\QpUOGov.exe
  2⤵
  PID:13008
- C:\Windows\System\lerYeYd.exe
  C:\Windows\System\lerYeYd.exe
  2⤵
  PID:13040
- C:\Windows\System\RTgudwq.exe
  C:\Windows\System\RTgudwq.exe
  2⤵
  PID:13060
- C:\Windows\System\pODCujm.exe
  C:\Windows\System\pODCujm.exe
  2⤵
  PID:13088
- C:\Windows\System\CYrBHHQ.exe
  C:\Windows\System\CYrBHHQ.exe
  2⤵
  PID:13112
- C:\Windows\System\EXIskPc.exe
  C:\Windows\System\EXIskPc.exe
  2⤵
  PID:13136
- C:\Windows\System\RXorprC.exe
  C:\Windows\System\RXorprC.exe
  2⤵
  PID:13156
- C:\Windows\System\hFPpWAf.exe
  C:\Windows\System\hFPpWAf.exe
  2⤵
  PID:13196
- C:\Windows\System\MnxKQWx.exe
  C:\Windows\System\MnxKQWx.exe
  2⤵
  PID:13260
- C:\Windows\System\dLQhIbE.exe
  C:\Windows\System\dLQhIbE.exe
  2⤵
  PID:13288
- C:\Windows\System\VwTMeeV.exe
  C:\Windows\System\VwTMeeV.exe
  2⤵
  PID:13304
- C:\Windows\System\ddoMeBo.exe
  C:\Windows\System\ddoMeBo.exe
  2⤵
  PID:12328
- C:\Windows\System\EDcewNC.exe
  C:\Windows\System\EDcewNC.exe
  2⤵
  PID:12368
- C:\Windows\System\TPvMUWJ.exe
  C:\Windows\System\TPvMUWJ.exe
  2⤵
  PID:12460
- C:\Windows\System\gFlcKIT.exe
  C:\Windows\System\gFlcKIT.exe
  2⤵
  PID:12516
- C:\Windows\System\WkjHJUj.exe
  C:\Windows\System\WkjHJUj.exe
  2⤵
  PID:12564
- C:\Windows\System\HTsbMPs.exe
  C:\Windows\System\HTsbMPs.exe
  2⤵
  PID:12596
- C:\Windows\System\BtjGCpo.exe
  C:\Windows\System\BtjGCpo.exe
  2⤵
  PID:12620
- C:\Windows\System\pvmkhwV.exe
  C:\Windows\System\pvmkhwV.exe
  2⤵
  PID:12644
- C:\Windows\System\gCUSqSY.exe
  C:\Windows\System\gCUSqSY.exe
  2⤵
  PID:12768
- C:\Windows\System\zwhYtYX.exe
  C:\Windows\System\zwhYtYX.exe
  2⤵
  PID:12808
- C:\Windows\System\ZljUCxd.exe
  C:\Windows\System\ZljUCxd.exe
  2⤵
  PID:12836
- C:\Windows\System\otpzxxZ.exe
  C:\Windows\System\otpzxxZ.exe
  2⤵
  PID:12980
- C:\Windows\System\foXnEHg.exe
  C:\Windows\System\foXnEHg.exe
  2⤵
  PID:13036
- C:\Windows\System\HPKxXHA.exe
  C:\Windows\System\HPKxXHA.exe
  2⤵
  PID:13100
- C:\Windows\System\OhxCDtD.exe
  C:\Windows\System\OhxCDtD.exe
  2⤵
  PID:13248
- C:\Windows\System\qZtyIRg.exe
  C:\Windows\System\qZtyIRg.exe
  2⤵
  PID:13280
- C:\Windows\System\vnVIuLU.exe
  C:\Windows\System\vnVIuLU.exe
  2⤵
  PID:12436
- C:\Windows\System\iGsPXOQ.exe
  C:\Windows\System\iGsPXOQ.exe
  2⤵
  PID:12524
- C:\Windows\System\iBtkJRh.exe
  C:\Windows\System\iBtkJRh.exe
  2⤵
  PID:12692
- C:\Windows\System\caUvPYz.exe
  C:\Windows\System\caUvPYz.exe
  2⤵
  PID:12784
- C:\Windows\System\LGhloCG.exe
  C:\Windows\System\LGhloCG.exe
  2⤵
  PID:12932
- C:\Windows\System\jeYPwFP.exe
  C:\Windows\System\jeYPwFP.exe
  2⤵
  PID:13032
- C:\Windows\System\QwdKGso.exe
  C:\Windows\System\QwdKGso.exe
  2⤵
  PID:13184
- C:\Windows\System\YcrSdjT.exe
  C:\Windows\System\YcrSdjT.exe
  2⤵
  PID:12404
- C:\Windows\System\AivYjxk.exe
  C:\Windows\System\AivYjxk.exe
  2⤵
  PID:12804
- C:\Windows\System\zpwaRoH.exe
  C:\Windows\System\zpwaRoH.exe
  2⤵
  PID:11272
- C:\Windows\System\gyHxdmf.exe
  C:\Windows\System\gyHxdmf.exe
  2⤵
  PID:13080
- C:\Windows\System\OQcHzvC.exe
  C:\Windows\System\OQcHzvC.exe
  2⤵
  PID:12992
- C:\Windows\System\xDgzQWa.exe
  C:\Windows\System\xDgzQWa.exe
  2⤵
  PID:13340
- C:\Windows\System\MGKqFvU.exe
  C:\Windows\System\MGKqFvU.exe
  2⤵
  PID:13360
- C:\Windows\System\ifwLTuL.exe
  C:\Windows\System\ifwLTuL.exe
  2⤵
  PID:13376
- C:\Windows\System\nysrICv.exe
  C:\Windows\System\nysrICv.exe
  2⤵
  PID:13400
- C:\Windows\System\YONgdun.exe
  C:\Windows\System\YONgdun.exe
  2⤵
  PID:13436
- C:\Windows\System\iPFGvSu.exe
  C:\Windows\System\iPFGvSu.exe
  2⤵
  PID:13468
- C:\Windows\System\ImreRuc.exe
  C:\Windows\System\ImreRuc.exe
  2⤵
  PID:13496
- C:\Windows\System\XhqOhOS.exe
  C:\Windows\System\XhqOhOS.exe
  2⤵
  PID:13520
- C:\Windows\System\VLrUVaj.exe
  C:\Windows\System\VLrUVaj.exe
  2⤵
  PID:13548
- C:\Windows\System\CLRtGlz.exe
  C:\Windows\System\CLRtGlz.exe
  2⤵
  PID:13576
- C:\Windows\System\KGCEEvf.exe
  C:\Windows\System\KGCEEvf.exe
  2⤵
  PID:13600
- C:\Windows\System\ggYBdaE.exe
  C:\Windows\System\ggYBdaE.exe
  2⤵
  PID:13628
- C:\Windows\System\cxDeVik.exe
  C:\Windows\System\cxDeVik.exe
  2⤵
  PID:13660
- C:\Windows\System\uEztJPt.exe
  C:\Windows\System\uEztJPt.exe
  2⤵
  PID:13688
- C:\Windows\System\LGxVJkC.exe
  C:\Windows\System\LGxVJkC.exe
  2⤵
  PID:13712
- C:\Windows\System\rDBMxqy.exe
  C:\Windows\System\rDBMxqy.exe
  2⤵
  PID:13740
- C:\Windows\System\VlNNYiX.exe
  C:\Windows\System\VlNNYiX.exe
  2⤵
  PID:13796
- C:\Windows\System\xxqDiqZ.exe
  C:\Windows\System\xxqDiqZ.exe
  2⤵
  PID:13812
- C:\Windows\System\KViNxDc.exe
  C:\Windows\System\KViNxDc.exe
  2⤵
  PID:13832
- C:\Windows\System\MzYWkUx.exe
  C:\Windows\System\MzYWkUx.exe
  2⤵
  PID:13852
- C:\Windows\System\trGRhaN.exe
  C:\Windows\System\trGRhaN.exe
  2⤵
  PID:13884
- C:\Windows\System\DvDhCrM.exe
  C:\Windows\System\DvDhCrM.exe
  2⤵
  PID:13908
- C:\Windows\System\BfAFAfc.exe
  C:\Windows\System\BfAFAfc.exe
  2⤵
  PID:13952
- C:\Windows\System\NZMErwD.exe
  C:\Windows\System\NZMErwD.exe
  2⤵
  PID:13992
- C:\Windows\System\QsvXGPF.exe
  C:\Windows\System\QsvXGPF.exe
  2⤵
  PID:14012
- C:\Windows\System\jBMYjSC.exe
  C:\Windows\System\jBMYjSC.exe
  2⤵
  PID:14036
- C:\Windows\System\LpylnSD.exe
  C:\Windows\System\LpylnSD.exe
  2⤵
  PID:14052
- C:\Windows\System\yoQkJzv.exe
  C:\Windows\System\yoQkJzv.exe
  2⤵
  PID:14092
- C:\Windows\System\VPZVqPx.exe
  C:\Windows\System\VPZVqPx.exe
  2⤵
  PID:14108
- C:\Windows\System\xMkrcpa.exe
  C:\Windows\System\xMkrcpa.exe
  2⤵
  PID:14140
- C:\Windows\System\JJtQAav.exe
  C:\Windows\System\JJtQAav.exe
  2⤵
  PID:14168
- C:\Windows\System\OmCoZkg.exe
  C:\Windows\System\OmCoZkg.exe
  2⤵
  PID:14196
- C:\Windows\System\VBTUhyc.exe
  C:\Windows\System\VBTUhyc.exe
  2⤵
  PID:14244
- C:\Windows\System\dtWvLWH.exe
  C:\Windows\System\dtWvLWH.exe
  2⤵
  PID:14260
- C:\Windows\System\bphwGEG.exe
  C:\Windows\System\bphwGEG.exe
  2⤵
  PID:14288
- C:\Windows\System\CTDCdHK.exe
  C:\Windows\System\CTDCdHK.exe
  2⤵
  PID:14316
- C:\Windows\System\JLuaXdC.exe
  C:\Windows\System\JLuaXdC.exe
  2⤵
  PID:12648
- C:\Windows\System\zDnHhwA.exe
  C:\Windows\System\zDnHhwA.exe
  2⤵
  PID:13372
- C:\Windows\System\UJsWptK.exe
  C:\Windows\System\UJsWptK.exe
  2⤵
  PID:13424
- C:\Windows\System\FqogHXo.exe
  C:\Windows\System\FqogHXo.exe
  2⤵
  PID:13480
- C:\Windows\System\icxFYEV.exe
  C:\Windows\System\icxFYEV.exe
  2⤵
  PID:13596
- C:\Windows\System\eqTmueb.exe
  C:\Windows\System\eqTmueb.exe
  2⤵
  PID:13676
- C:\Windows\System\ItSjFzr.exe
  C:\Windows\System\ItSjFzr.exe
  2⤵
  PID:13704
- C:\Windows\System\IWjWfMA.exe
  C:\Windows\System\IWjWfMA.exe
  2⤵
  PID:13804
- C:\Windows\System\VzeHgkw.exe
  C:\Windows\System\VzeHgkw.exe
  2⤵
  PID:13844
- C:\Windows\System\sSbyVkP.exe
  C:\Windows\System\sSbyVkP.exe
  2⤵
  PID:13896
- C:\Windows\System\kQyLhoO.exe
  C:\Windows\System\kQyLhoO.exe
  2⤵
  PID:13944
- C:\Windows\System\LIVbjGV.exe
  C:\Windows\System\LIVbjGV.exe
  2⤵
  PID:14000
- C:\Windows\System\ILIfFdf.exe
  C:\Windows\System\ILIfFdf.exe
  2⤵
  PID:14072
- C:\Windows\System\ZcwgMZw.exe
  C:\Windows\System\ZcwgMZw.exe
  2⤵
  PID:14120
- C:\Windows\System\NScKfLz.exe
  C:\Windows\System\NScKfLz.exe
  2⤵
  PID:14156
- C:\Windows\System\jZqEotd.exe
  C:\Windows\System\jZqEotd.exe
  2⤵
  PID:14324
- C:\Windows\System\jRrTopN.exe
  C:\Windows\System\jRrTopN.exe
  2⤵
  PID:13396
- C:\Windows\System\ktEalGw.exe
  C:\Windows\System\ktEalGw.exe
  2⤵
  PID:13528
- C:\Windows\System\mkISpkW.exe
  C:\Windows\System\mkISpkW.exe
  2⤵
  PID:13624
- C:\Windows\System\TLDqZWo.exe
  C:\Windows\System\TLDqZWo.exe
  2⤵
  PID:13848
- C:\Windows\System\YvTjFCY.exe
  C:\Windows\System\YvTjFCY.exe
  2⤵
  PID:13980
- C:\Windows\System\NhpphoA.exe
  C:\Windows\System\NhpphoA.exe
  2⤵
  PID:14084
- C:\Windows\System\tArcBwi.exe
  C:\Windows\System\tArcBwi.exe
  2⤵
  PID:14300
- C:\Windows\System\DvDKzNG.exe
  C:\Windows\System\DvDKzNG.exe
  2⤵
  PID:13616
- C:\Windows\System\YdcldLX.exe
  C:\Windows\System\YdcldLX.exe
  2⤵
  PID:13876
- C:\Windows\System\MTxPOru.exe
  C:\Windows\System\MTxPOru.exe
  2⤵
  PID:14128
- C:\Windows\System\HXdqpJN.exe
  C:\Windows\System\HXdqpJN.exe
  2⤵
  PID:13764
- C:\Windows\System\hqEkKBG.exe
  C:\Windows\System\hqEkKBG.exe
  2⤵
  PID:14352
- C:\Windows\System\zyRCyPR.exe
  C:\Windows\System\zyRCyPR.exe
  2⤵
  PID:14368
- C:\Windows\System\SGKBeiT.exe
  C:\Windows\System\SGKBeiT.exe
  2⤵
  PID:14400
- C:\Windows\System\xNmWwTq.exe
  C:\Windows\System\xNmWwTq.exe
  2⤵
  PID:14432
- C:\Windows\System\vKLSEkH.exe
  C:\Windows\System\vKLSEkH.exe
  2⤵
  PID:14460
- C:\Windows\System\jAgGqGW.exe
  C:\Windows\System\jAgGqGW.exe
  2⤵
  PID:14504
- C:\Windows\System\lQmluWj.exe
  C:\Windows\System\lQmluWj.exe
  2⤵
  PID:14520
- C:\Windows\System\GhDNzHS.exe
  C:\Windows\System\GhDNzHS.exe
  2⤵
  PID:14536
- C:\Windows\System\hoMZTYj.exe
  C:\Windows\System\hoMZTYj.exe
  2⤵
  PID:14564
- C:\Windows\System\UYDfegM.exe
  C:\Windows\System\UYDfegM.exe
  2⤵
  PID:14616
- C:\Windows\System\wtKMwWg.exe
  C:\Windows\System\wtKMwWg.exe
  2⤵
  PID:14632
- C:\Windows\System\QrcWIjc.exe
  C:\Windows\System\QrcWIjc.exe
  2⤵
  PID:14672
- C:\Windows\System\JNNaOhd.exe
  C:\Windows\System\JNNaOhd.exe
  2⤵
  PID:14700
- C:\Windows\System\ugxxsnQ.exe
  C:\Windows\System\ugxxsnQ.exe
  2⤵
  PID:14716
- C:\Windows\System\lAtaMuL.exe
  C:\Windows\System\lAtaMuL.exe
  2⤵
  PID:14748
- C:\Windows\System\NgNFYQS.exe
  C:\Windows\System\NgNFYQS.exe
  2⤵
  PID:14764
- C:\Windows\System\ReHYTnV.exe
  C:\Windows\System\ReHYTnV.exe
  2⤵
  PID:14804
- C:\Windows\System\tCTUEjE.exe
  C:\Windows\System\tCTUEjE.exe
  2⤵
  PID:14824
- C:\Windows\System\QwfNdXp.exe
  C:\Windows\System\QwfNdXp.exe
  2⤵
  PID:14844
- C:\Windows\System\vNMpcdt.exe
  C:\Windows\System\vNMpcdt.exe
  2⤵
  PID:14876
- C:\Windows\System\NQHxUWR.exe
  C:\Windows\System\NQHxUWR.exe
  2⤵
  PID:14924
- C:\Windows\System\dAZMTgp.exe
  C:\Windows\System\dAZMTgp.exe
  2⤵
  PID:14956
- C:\Windows\System\VPBJcpU.exe
  C:\Windows\System\VPBJcpU.exe
  2⤵
  PID:14972
- C:\Windows\System\mIDUCdw.exe
  C:\Windows\System\mIDUCdw.exe
  2⤵
  PID:14988
- C:\Windows\System\tcCNgQe.exe
  C:\Windows\System\tcCNgQe.exe
  2⤵
  PID:15004
- C:\Windows\System\wSvlUsS.exe
  C:\Windows\System\wSvlUsS.exe
  2⤵
  PID:15020
- C:\Windows\System\LPCODGt.exe
  C:\Windows\System\LPCODGt.exe
  2⤵
  PID:15096
- C:\Windows\System\IuWpnYY.exe
  C:\Windows\System\IuWpnYY.exe
  2⤵
  PID:15112
- C:\Windows\System\zyZXBlU.exe
  C:\Windows\System\zyZXBlU.exe
  2⤵
  PID:15128
- C:\Windows\System\qAlIuLA.exe
  C:\Windows\System\qAlIuLA.exe
  2⤵
  PID:15176
- C:\Windows\System\csSTErH.exe
  C:\Windows\System\csSTErH.exe
  2⤵
  PID:15192
- C:\Windows\System\XZlBUnw.exe
  C:\Windows\System\XZlBUnw.exe
  2⤵
  PID:15220
- C:\Windows\System\wwohQHI.exe
  C:\Windows\System\wwohQHI.exe
  2⤵
  PID:15236
- C:\Windows\System\kzEJWyI.exe
  C:\Windows\System\kzEJWyI.exe
  2⤵
  PID:15256
- C:\Windows\System\sWGltHW.exe
  C:\Windows\System\sWGltHW.exe
  2⤵
  PID:15320
- C:\Windows\System\IhfyCVX.exe
  C:\Windows\System\IhfyCVX.exe
  2⤵
  PID:15348
- C:\Windows\System\SIxvhrp.exe
  C:\Windows\System\SIxvhrp.exe
  2⤵
  PID:13368
- C:\Windows\System\TFXvcWQ.exe
  C:\Windows\System\TFXvcWQ.exe
  2⤵
  PID:14428
- C:\Windows\System\NYeLtSE.exe
  C:\Windows\System\NYeLtSE.exe
  2⤵
  PID:14452
- C:\Windows\System\KeTIhdI.exe
  C:\Windows\System\KeTIhdI.exe
  2⤵
  PID:14516
- C:\Windows\System\TPdNjzF.exe
  C:\Windows\System\TPdNjzF.exe
  2⤵
  PID:14584
- C:\Windows\System\lBvFekt.exe
  C:\Windows\System\lBvFekt.exe
  2⤵
  PID:14648
- C:\Windows\System\XQNpXMW.exe
  C:\Windows\System\XQNpXMW.exe
  2⤵
  PID:14692
- C:\Windows\System\ujGeVwk.exe
  C:\Windows\System\ujGeVwk.exe
  2⤵
  PID:14760
- C:\Windows\System\Hqouyui.exe
  C:\Windows\System\Hqouyui.exe
  2⤵
  PID:14796
- C:\Windows\System\nXDEazw.exe
  C:\Windows\System\nXDEazw.exe
  2⤵
  PID:14864
- C:\Windows\System\AAdbTjN.exe
  C:\Windows\System\AAdbTjN.exe
  2⤵
  PID:14920
- C:\Windows\System\tdzrfEZ.exe
  C:\Windows\System\tdzrfEZ.exe
  2⤵
  PID:14984
- C:\Windows\System\gbAzJHL.exe
  C:\Windows\System\gbAzJHL.exe
  2⤵
  PID:15056
- C:\Windows\System\KHihxGV.exe
  C:\Windows\System\KHihxGV.exe
  2⤵
  PID:15144
- C:\Windows\System\dxAYooA.exe
  C:\Windows\System\dxAYooA.exe
  2⤵
  PID:15216
- C:\Windows\System\MkvlhYt.exe
  C:\Windows\System\MkvlhYt.exe
  2⤵
  PID:15252
- C:\Windows\System\QbHBtht.exe
  C:\Windows\System\QbHBtht.exe
  2⤵
  PID:15340
- C:\Windows\System\itTNBbA.exe
  C:\Windows\System\itTNBbA.exe
  2⤵
  PID:14360
- C:\Windows\System\Fexvfyz.exe
  C:\Windows\System\Fexvfyz.exe
  2⤵
  PID:14424
- C:\Windows\System\zHqsJIb.exe
  C:\Windows\System\zHqsJIb.exe
  2⤵
  PID:14532
- C:\Windows\System\vDNBLIz.exe
  C:\Windows\System\vDNBLIz.exe
  2⤵
  PID:14740
- C:\Windows\System\oxGKghF.exe
  C:\Windows\System\oxGKghF.exe
  2⤵
  PID:14968
- C:\Windows\System\FgxnxwB.exe
  C:\Windows\System\FgxnxwB.exe
  2⤵
  PID:15108
- C:\Windows\System\eRJYBTV.exe
  C:\Windows\System\eRJYBTV.exe
  2⤵
  PID:14392
- C:\Windows\System\ZcMNTTs.exe
  C:\Windows\System\ZcMNTTs.exe
  2⤵
  PID:14688
- C:\Windows\System\ijrvyrj.exe
  C:\Windows\System\ijrvyrj.exe
  2⤵
  PID:14964
- C:\Windows\System\hCDygkM.exe
  C:\Windows\System\hCDygkM.exe
  2⤵
  PID:15204
- C:\Windows\System\MnaGluX.exe
  C:\Windows\System\MnaGluX.exe
  2⤵
  PID:14528
- C:\Windows\System\OTaZJoo.exe
  C:\Windows\System\OTaZJoo.exe
  2⤵
  PID:14940
- C:\Windows\System\UTqCWXK.exe
  C:\Windows\System\UTqCWXK.exe
  2⤵
  PID:14420
- C:\Windows\System\VENNOSC.exe
  C:\Windows\System\VENNOSC.exe
  2⤵
  PID:15396
- C:\Windows\System\AfQrqfY.exe
  C:\Windows\System\AfQrqfY.exe
  2⤵
  PID:15412
- C:\Windows\System\bjzstCR.exe
  C:\Windows\System\bjzstCR.exe
  2⤵
  PID:15432
- C:\Windows\System\wtSPPEr.exe
  C:\Windows\System\wtSPPEr.exe
  2⤵
  PID:15468
- C:\Windows\System\vubGSWv.exe
  C:\Windows\System\vubGSWv.exe
  2⤵
  PID:15500
- C:\Windows\System\NjthxWE.exe
  C:\Windows\System\NjthxWE.exe
  2⤵
  PID:15520
- C:\Windows\System\QakEBaR.exe
  C:\Windows\System\QakEBaR.exe
  2⤵
  PID:15552
- C:\Windows\System\AdUgcEv.exe
  C:\Windows\System\AdUgcEv.exe
  2⤵
  PID:15604
- C:\Windows\System\cWhchcK.exe
  C:\Windows\System\cWhchcK.exe
  2⤵
  PID:15632
- C:\Windows\System\xRyqxSR.exe
  C:\Windows\System\xRyqxSR.exe
  2⤵
  PID:15648
- C:\Windows\System\CQTpcUc.exe
  C:\Windows\System\CQTpcUc.exe
  2⤵
  PID:15676
- C:\Windows\System\xNhNAgJ.exe
  C:\Windows\System\xNhNAgJ.exe
  2⤵
  PID:15716
- C:\Windows\System\nhotttC.exe
  C:\Windows\System\nhotttC.exe
  2⤵
  PID:15736
- C:\Windows\System\kAAZmYz.exe
  C:\Windows\System\kAAZmYz.exe
  2⤵
  PID:15760
- C:\Windows\System\lQjARil.exe
  C:\Windows\System\lQjARil.exe
  2⤵
  PID:15788
- C:\Windows\System\YdFdfEH.exe
  C:\Windows\System\YdFdfEH.exe
  2⤵
  PID:15824
- C:\Windows\System\tiHSfNp.exe
  C:\Windows\System\tiHSfNp.exe
  2⤵
  PID:15844
- C:\Windows\System\EOIyZSo.exe
  C:\Windows\System\EOIyZSo.exe
  2⤵
  PID:15868
- C:\Windows\System\mujbDDd.exe
  C:\Windows\System\mujbDDd.exe
  2⤵
  PID:15976
- C:\Windows\System\WUfXcvG.exe
  C:\Windows\System\WUfXcvG.exe
  2⤵
  PID:16000
- C:\Windows\System\uUdMcia.exe
  C:\Windows\System\uUdMcia.exe
  2⤵
  PID:16028
- C:\Windows\System\toMQQgC.exe
  C:\Windows\System\toMQQgC.exe
  2⤵
  PID:16044
- C:\Windows\System\NucWLVw.exe
  C:\Windows\System\NucWLVw.exe
  2⤵
  PID:16064
- C:\Windows\System\sxIOQBb.exe
  C:\Windows\System\sxIOQBb.exe
  2⤵
  PID:16092
- C:\Windows\System\Ntywrvp.exe
  C:\Windows\System\Ntywrvp.exe
  2⤵
  PID:16112
- C:\Windows\System\AkLaYln.exe
  C:\Windows\System\AkLaYln.exe
  2⤵
  PID:16156
- C:\Windows\System\fBSskii.exe
  C:\Windows\System\fBSskii.exe
  2⤵
  PID:16172
- C:\Windows\System\onzoRBw.exe
  C:\Windows\System\onzoRBw.exe
  2⤵
  PID:16224
- C:\Windows\System\uxkMlsa.exe
  C:\Windows\System\uxkMlsa.exe
  2⤵
  PID:16252
- C:\Windows\System\XhLyrQs.exe
  C:\Windows\System\XhLyrQs.exe
  2⤵
  PID:16272
- C:\Windows\System\ctjCLST.exe
  C:\Windows\System\ctjCLST.exe
  2⤵
  PID:16296
- C:\Windows\System\jWNplWf.exe
  C:\Windows\System\jWNplWf.exe
  2⤵
  PID:16336
- C:\Windows\System\QmQKPxu.exe
  C:\Windows\System\QmQKPxu.exe
  2⤵
  PID:16352
- C:\Windows\System\tClyoka.exe
  C:\Windows\System\tClyoka.exe
  2⤵
  PID:14612
- C:\Windows\System\mVOWfWL.exe
  C:\Windows\System\mVOWfWL.exe
  2⤵
  PID:15404
- C:\Windows\System\fOOZgUb.exe
  C:\Windows\System\fOOZgUb.exe
  2⤵
  PID:15424
- C:\Windows\System\zCVxqTf.exe
  C:\Windows\System\zCVxqTf.exe
  2⤵
  PID:15528
- C:\Windows\System\OqJWAaX.exe
  C:\Windows\System\OqJWAaX.exe
  2⤵
  PID:15620
- C:\Windows\System\ciVSbRT.exe
  C:\Windows\System\ciVSbRT.exe
  2⤵
  PID:15668
- C:\Windows\System\UXikViU.exe
  C:\Windows\System\UXikViU.exe
  2⤵
  PID:15688
- C:\Windows\System\WQGQkqS.exe
  C:\Windows\System\WQGQkqS.exe
  2⤵
  PID:15776
- C:\Windows\System\LqDzIZY.exe
  C:\Windows\System\LqDzIZY.exe
  2⤵
  PID:14744
- C:\Windows\System\pseczsv.exe
  C:\Windows\System\pseczsv.exe
  2⤵
  PID:15864
- C:\Windows\System\jfKaXjl.exe
  C:\Windows\System\jfKaXjl.exe
  2⤵
  PID:15992
- C:\Windows\System\FMRdLMS.exe
  C:\Windows\System\FMRdLMS.exe
  2⤵
  PID:16040
- C:\Windows\System\TajKJwM.exe
  C:\Windows\System\TajKJwM.exe
  2⤵
  PID:16072
- C:\Windows\System\CtebfuA.exe
  C:\Windows\System\CtebfuA.exe
  2⤵
  PID:16136
- C:\Windows\System\vMElGWV.exe
  C:\Windows\System\vMElGWV.exe
  2⤵
  PID:16208
- C:\Windows\System\TdXrkBU.exe
  C:\Windows\System\TdXrkBU.exe
  2⤵
  PID:16268
- C:\Windows\System\PbmdJNy.exe
  C:\Windows\System\PbmdJNy.exe
  2⤵
  PID:16332
- C:\Windows\System\QOdLtPY.exe
  C:\Windows\System\QOdLtPY.exe
  2⤵
  PID:14736
- C:\Windows\System\iASYjTn.exe
  C:\Windows\System\iASYjTn.exe
  2⤵
  PID:15384
- C:\Windows\System\ezDCkNB.exe
  C:\Windows\System\ezDCkNB.exe
  2⤵
  PID:15664
- C:\Windows\System\CQySUxl.exe
  C:\Windows\System\CQySUxl.exe
  2⤵
  PID:15660
- C:\Windows\System\hLCEpoC.exe
  C:\Windows\System\hLCEpoC.exe
  2⤵
  PID:16100
- C:\Windows\System\wQVQpPQ.exe
  C:\Windows\System\wQVQpPQ.exe
  2⤵
  PID:15376
- C:\Windows\System\iFXqouL.exe
  C:\Windows\System\iFXqouL.exe
  2⤵
  PID:15596
- C:\Windows\System\DLIjrpU.exe
  C:\Windows\System\DLIjrpU.exe
  2⤵
  PID:16076
- C:\Windows\System\gGRZUMo.exe
  C:\Windows\System\gGRZUMo.exe
  2⤵
  PID:16128
- C:\Windows\System\tAxkXHv.exe
  C:\Windows\System\tAxkXHv.exe
  2⤵
  PID:16312
- C:\Windows\System\NuNfAlh.exe
  C:\Windows\System\NuNfAlh.exe
  2⤵
  PID:16404
- C:\Windows\System\fvBbcRP.exe
  C:\Windows\System\fvBbcRP.exe
  2⤵
  PID:16424
- C:\Windows\System\lgzyEdO.exe
  C:\Windows\System\lgzyEdO.exe
  2⤵
  PID:16452
- C:\Windows\System\lQzpLOe.exe
  C:\Windows\System\lQzpLOe.exe
  2⤵
  PID:16488
- C:\Windows\System\eqfwSKK.exe
  C:\Windows\System\eqfwSKK.exe
  2⤵
  PID:16504
- C:\Windows\System\rvrWSyB.exe
  C:\Windows\System\rvrWSyB.exe
  2⤵
  PID:16520
- C:\Windows\System\iJHgguO.exe
  C:\Windows\System\iJHgguO.exe
  2⤵
  PID:16572
- C:\Windows\System\qGOFzbY.exe
  C:\Windows\System\qGOFzbY.exe
  2⤵
  PID:16612
- C:\Windows\System\xNBlkVF.exe
  C:\Windows\System\xNBlkVF.exe
  2⤵
  PID:16628
- C:\Windows\System\VZSNChP.exe
  C:\Windows\System\VZSNChP.exe
  2⤵
  PID:16664
- C:\Windows\System\NDnvPfP.exe
  C:\Windows\System\NDnvPfP.exe
  2⤵
  PID:16688
- C:\Windows\System\XkujMYW.exe
  C:\Windows\System\XkujMYW.exe
  2⤵
  PID:16708
- C:\Windows\System\tCHHFGU.exe
  C:\Windows\System\tCHHFGU.exe
  2⤵
  PID:16728
- C:\Windows\System\PBpoVYI.exe
  C:\Windows\System\PBpoVYI.exe
  2⤵
  PID:16744
- C:\Windows\System\SESyPRq.exe
  C:\Windows\System\SESyPRq.exe
  2⤵
  PID:16764
- C:\Windows\System\yaAorHK.exe
  C:\Windows\System\yaAorHK.exe
  2⤵
  PID:16828
- C:\Windows\System\JLYmPul.exe
  C:\Windows\System\JLYmPul.exe
  2⤵
  PID:16872
- C:\Windows\System\dphcoxw.exe
  C:\Windows\System\dphcoxw.exe
  2⤵
  PID:16900
- C:\Windows\System\axhQLBx.exe
  C:\Windows\System\axhQLBx.exe
  2⤵
  PID:16924
- C:\Windows\System\OIUFWgY.exe
  C:\Windows\System\OIUFWgY.exe
  2⤵
  PID:16944
- C:\Windows\System\XcJQcYq.exe
  C:\Windows\System\XcJQcYq.exe
  2⤵
  PID:16964
- C:\Windows\System\lsTegJb.exe
  C:\Windows\System\lsTegJb.exe
  2⤵
  PID:17000
- C:\Windows\System\WSXmrbb.exe
  C:\Windows\System\WSXmrbb.exe
  2⤵
  PID:17016

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:15940

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\AOoIpAC.exe

Filesize
1.4MB

MD5
4d8695efe884eae6155c42c2423ff7e8

SHA1
0b6f92aa1fad076450b5d79e5d25ded75859f98a

SHA256
0b876bfbb24219fb1e9c6f3c252a8a82a4368652df1a9eeb934b20049849128a

SHA512
caf810bd311fb5429bd4ba5b00224dce3662b782ec09700cc2700eb15f16467cbb0a1fe7378822c167df8160efc94adfffc9c1c706753b1229aa3553fce61178

Download Submit
C:\Windows\System\FlJswJh.exe

Filesize
1.4MB

MD5
cd2c87feadc313dfc0fe426227c43fd3

SHA1
213967605c157c4ee935e5bf2d46976c84fed68c

SHA256
771482493bb3cac810e44f1d4fafa4ac46e27beb1f7b43a3bb0512e67e2fe09c

SHA512
bae0f623809667b75900569abd0c8f65680537912148d4b532e0f2118b451a43e474dfb3efe2be812688a2e346e2dfb890cacf6093580abddee1cb0c6fdc0bda

Download Submit
C:\Windows\System\GALtsMF.exe

Filesize
1.4MB

MD5
d42d5fb59c9892678f1aaac0a2185116

SHA1
db888fc36a2aa4954b5a608c43710d0b8494862b

SHA256
7949fd098127ae2b3d0ba265e7cecbdc26ba561150a238d029b529c0c90d1ad9

SHA512
7afe17c3863ea558449c4c58666d6cda090203767baae81e2926505630dd8798f402fce4af0a9fbfdeee415043b89bdfb41018fac5c49cde3c7c370dbf42f6ae

Download Submit
C:\Windows\System\JQLcfls.exe

Filesize
1.4MB

MD5
04597180c84d3b64a17cfa00bed1d8fc

SHA1
fc24be9a98c69f650c147a23e23e7feead87ee99

SHA256
30b58b7c607ac0c7090fe21195e3d95a32b8994cf3012c7bb4d18bc7b83fdf77

SHA512
dd960443e83e98c2ad71fbf7548500a57b32cb50fc2fb7e3f6a51a09d60c1cc5e6603d53414e17d946055ca059ced16cc18ce6e4a6694da7705e4590ab76f5f8

Download Submit
C:\Windows\System\JyKyJaK.exe

Filesize
1.4MB

MD5
96007579d91997ae5d0d49f226ff2bac

SHA1
483567b16f9befd80935ff714a1f2bc276880169

SHA256
eabaf371c0ad319ef2cbbf9eee85c24c599ca8876c94e98a6a45ee3d89d7adbf

SHA512
473c6e2cea5ac930696d655569549463aa8229bda4d229d66f85bc49287a3a1b7dab0144be7830791336aeaae47d6d686463f2af3a401ee44ae9abf7813656cf

Download Submit
C:\Windows\System\KQNCPxF.exe

Filesize
1.4MB

MD5
81d33a8a223ca7a4d43027b2193f6ad0

SHA1
8b82a30cab2f2665984ace7e96c58d40ed71a53f

SHA256
5f41615a7f0f8aac0b18b51f31fe4b4e0fd828027108c95cf11c373a34fa9c33

SHA512
d5408eacea815d71289092a0e51118d570ff7401330f5fa455d586f5dd3a1f7b594a23793b4929b3596ea818a66fe22519b2ed99d767e8ea3a5502b1accab218

Download Submit
C:\Windows\System\MFTXDgL.exe

Filesize
1.4MB

MD5
1146afbfe82bd711f3d38b699a6612d1

SHA1
41055cbeb0910cf195fb44e425e697a14dc8afcd

SHA256
832a166a14130a25f2bf4468aaca023369db471dc69f8de953b030df3990eaea

SHA512
7293c37fb89429d44eea10a6583ababc910e06cf05ce97c59de1a97e04860ef2088be58bde6d10e0af54392ae29bbe4e8bfdb6f256765314d0f55861e41a103a

Download Submit
C:\Windows\System\OSoLdEn.exe

Filesize
1.4MB

MD5
743c01765d42dd97c487f85f3e5ee2c5

SHA1
51e8e717c99a99572b335898ca32150bd34be557

SHA256
e8e841187f1ae98f17113f11a7c05c6b6d3224891efcd94ec08da5e2803f9c9e

SHA512
45fb2c5c1a2f3abc6242ea17799355831416be6014bb5e3fccd675ff1dd7c13d4738f81797c27523c592f09cbacce5a477d2afbfc000f6b82af3c0330a57e439

Download Submit
C:\Windows\System\OWlmmhp.exe

Filesize
1.4MB

MD5
ea0304ce037d5986e73e81be18f87ef0

SHA1
27c6feacff0ba947e7f501cfaffea106e7325e0e

SHA256
7919cf9b66c4b090ab93553fd1236b3dd4b4c73958497fd2057092e9c1c85202

SHA512
5a5077c717a9bb1f30a73433139345e243ed1d3cc271b87b053dd9ca38458173b8fa6c16e0042d76fe016e6cc4d9f122fbbcc9ece99ab697baba8098fa6a9a07

Download Submit
C:\Windows\System\PtMmlVY.exe

Filesize
1.4MB

MD5
ae66feeff9a4e0f6a6d695401b717143

SHA1
bd0932bad125bb95a7f4a3ee535b984e485e7492

SHA256
1623e142f5ce6a4511f1e42c51efaf2ef11a82f19cc48c30ed7ff0df4dfe1d38

SHA512
d58c930f01a381c7063202dcbd100a55e4ccf6a24b72fc6143c287eb9e14f20b401d47cce66d07e941567d4e47b395654c247255f6efec20f371eab4755a767e

Download Submit
C:\Windows\System\SXeXRNX.exe

Filesize
1.4MB

MD5
06774bb7f03821f09504139eb7b260b1

SHA1
02bee667bb755ce9b07c0890b62aa5460dec5f24

SHA256
517d287fb12b613acb37ffb6dcce3a325725b733350a3ef5d2f285233aeccd1d

SHA512
ccaa7a928921d02a28606a6c7383597d586e6277566c010fc191c6c8fc4d8ee81ac2ac5a6e6b0b7aae8ff3168dfae482eebea152ad25fc77eb604d9af81cfeb2

Download Submit
C:\Windows\System\ScOCXtA.exe

Filesize
1.4MB

MD5
9e6ca0de748c590b8df058aa4abd996c

SHA1
8a29152209560bb87fada3c9aebb282fc690bfbe

SHA256
c513f093e7a9ee9349f3ff70f4e71f65055459c9ef9eb9af1d8222596cf65b55

SHA512
8c52bd17620deadfb1bfe5eda7bae23b78a00024feb3db417aca540537c06b13d09018b844fd8f11212939d7fee8949872527a7d99fcacc4f62ae4f6dfcf4134

Download Submit
C:\Windows\System\TKJpjAM.exe

Filesize
1.4MB

MD5
fce58ff200a47f7592417d0203637783

SHA1
8751d7efee47419d8a371187740f73aefee29ee3

SHA256
c8610d14885029b4695dd16a8e4bddbedf082466d08dc0080e561c159ff0ae47

SHA512
40bf46d6e65431a7b7a2d69439625d3a99e5c3e83c65fca946e79da4fec87989c7300f42cdd133cb3d949f68780936545a7431d537763179ea92270de6255fef

Download Submit
C:\Windows\System\VOKLPKn.exe

Filesize
1.4MB

MD5
2c99c99053b57d4fef59c4e4ab812f5a

SHA1
b7ff9d859bdf70317e188b0c7170d86d2dfc90e5

SHA256
9fb9f64e62a2893bd7f48f970c70915d50528b3e739b708fc8ce43ed4c16ae7c

SHA512
29668a00bcf99f022e286df9904319c4c8e74d4715ad953a1394d27f074fbb0c9a94e3d43cefe4acb6da64ed2c84ed1164c3096845202f4074d4e70169722b31

Download Submit
C:\Windows\System\VcEwefw.exe

Filesize
1.4MB

MD5
93e5d52b9b4b9e598c2d31585b11aad8

SHA1
f716b8975c525548bc2caaf95e4eab3c72488d87

SHA256
97b7303f63d1077fef982a0468eb7d666c6aff031a67123f45aacc0d47313bcd

SHA512
c5760a5124c9429ea6f9531032acac6ac137bcb9ecfdb909f783be165779f4aa5ec847d86d6cd4249bfba114c90356899334bda8845dcf2133b87351bc4d71bc

Download Submit
C:\Windows\System\XJARUIh.exe

Filesize
1.4MB

MD5
a83ea42eda89e83ffa848a9caf8ef448

SHA1
6b91fa09e02c38de8d909384b8b569137eb31606

SHA256
0486489f3e92ef8b8684c153e247b019e21c9e0d0105e93a9f3fdb518c1a90ce

SHA512
7d1f851b84502badc4bce5d6320ae7a278e2d3add5327618836dc6da4a6c8fc4fc5ec213f5d9120c947f8a27f2e605bf9cf50f0a7c72d81cd9062e19e9185f09

Download Submit
C:\Windows\System\YhRxIXK.exe

Filesize
1.4MB

MD5
143d7427ebb3948bb4bcd04d1c8d10aa

SHA1
dc36e125a271878764f1982c8677ad89b98e1cdc

SHA256
a3e6d7ce0e2043989d5b8a9cd5585859f17ded742a21fe595e2344bdb508b089

SHA512
8a5c5018e3c9baee449c9b63e63c721fbdefdcf6b4ea1093e95a6b29be8fc43a0688865dd860b9564f7e5f5c480f953de5e6400f4bba48208d5d162d9cc516b5

Download Submit
C:\Windows\System\ZhivPRu.exe

Filesize
1.4MB

MD5
c807a687da6299f921e2d517b943a1ca

SHA1
4d01314f643550a5108828cf7ab065acc49e7f16

SHA256
1922f6f4632a9c897e551971678e563df596f2c0a60dcf6ef6b67d14a490bc95

SHA512
441c588d22b1806b4e68c7441e3c12cfdec85145f7a4e6a9112e91f89fe2e5162ba374df43d92778d657cbc80425881170a55d3169859431bc2c01d2c8f58a8f

Download Submit
C:\Windows\System\aDCRESk.exe

Filesize
1.4MB

MD5
df29a0751a2d6f75f22db508f200405f

SHA1
9b16f44ea7fe587d50f549528a02fd9e50ed7b30

SHA256
5d473fe72955c7d53d6f8b73e423cb316bf79b89c00f7af7c34b5e7ebc4652ea

SHA512
b088901eba201640f4639873f99b80b95e1e6121c3b9f39222e42bb2f7509559f7d8a8fd0418f6f6f4e541dc5a756ce45a50b1f64f40e7c60229e052f37497c0

Download Submit
C:\Windows\System\beAvaZI.exe

Filesize
1.4MB

MD5
4d9a81e5b425c8d5f7447602ff805ad2

SHA1
a91a8f16b5647b6e32af6f2972321135fe8c8160

SHA256
79f810b58b4d4ff4561b8f08c760fad5b1a106c48f92d807aa46d84c01f6bd5a

SHA512
25bd26a2c0514b3133a91999be840c7e5c5c3dea15b2d07c601fa0b2192932eed9a1279a7b4164bb6d5866c93bf95b6a7c4f56ab22c85776782e7f703c690c6f

Download Submit
C:\Windows\System\dCiwaeC.exe

Filesize
1.4MB

MD5
9e5996c184a0fb6452733f0a89649f2b

SHA1
e6497f33d6d04967fa9a29a930d52411ad642395

SHA256
5519f4022f5f614f4344dfae3a080e8cfdb315f33451d7f4d6b72554ca71f826

SHA512
f06cfc03f94af19cc317947edd554fc84a6292bddfae9b9c5bd7c7ec4997ca70429596ac175347c8a3765fc0a1669fd80b25ad937a677e2ef2715d4210ab4ea0

Download Submit
C:\Windows\System\gOwfGxq.exe

Filesize
1.4MB

MD5
5205e8d52386ac6bcb4bc22f706119a9

SHA1
0dfd5838247fb8942b821ff83b223e32564b0bb4

SHA256
b21c241a438c9d57668a2fd10adccc386e7cc76f66ec72ea2883cad188ea2000

SHA512
85711f3a3a33f53beb377de80fc5d5df6996e6056e0e09cf2bb79661bbcf255b06370393c129848b070834083107b75414745ba74ce12903ba1577643f20a3d2

Download Submit
C:\Windows\System\hOMXLYR.exe

Filesize
1.4MB

MD5
8fef7b9b8eddd507d515044d476d502f

SHA1
c9ae0e4dcd297d93954f29df277bb6d434306d1c

SHA256
0d98a727d41a12962827a352fc1a614dd8f42a958c380af627979df89ad1fa00

SHA512
e9d2259f5e73418ab63afb9e9c06082c755076be2e13f0ca4a6de4761c54023d024bcc7deabb05c63f77fc2611ec6587ff118dd42dcfff647b6ccef36bcdb705

Download Submit
C:\Windows\System\iBnNUql.exe

Filesize
1.4MB

MD5
dddf5f8a7677b47e7eb254c7c420f3be

SHA1
70635664d2610bd0e5e1d6a2bd2d88dd532a036b

SHA256
12b60e735fb85eb8a74abc91f980d7f2a49a4e44b5a1d6659645c2567086aa22

SHA512
aecd80e5469bd1cf461bf1f7079a576a3afd30660f1d5a72cf1a842926aaa2ee0496875bc29de48f97af95957637b268d8971a794e9f997d41a82aef8552c896

Download Submit
C:\Windows\System\iJQowrt.exe

Filesize
1.4MB

MD5
df2a84491353812825d9d612dcafa1d9

SHA1
f5be23674aca6166db37fc81028364f1a0ecc5c7

SHA256
df7171962246c9286af8530aa01aa9ad7f26a6db7be34a00201fefc1d19b976b

SHA512
1a972c4fb5a633ca5d34b03b7fa52f81dd25c5d298e1c4b16607249da96492cc08ffa151f37898fae1e0c632aa2bbff6dcaaa3992a5e382b0189cbc2038bd19a

Download Submit
C:\Windows\System\itzqwql.exe

Filesize
1.4MB

MD5
347862ff2328117179293332e7095a84

SHA1
d5c494a4437eb013ed9a74aa87642fe43ef85616

SHA256
8a8201cb5bf7002f85a35529c6f9a5294a71c8150946540cd15bb65cddad7a6a

SHA512
98e88d80106d3a2673ee26b94a1d5dcb4c32d13a2d1c1d5b63b3aa4d09d577cb1be61a16047af21f29edf06abf266edb3b7780427f9e2b5e0c4daddc396ebf9b

Download Submit
C:\Windows\System\rnTOQho.exe

Filesize
1.4MB

MD5
e4191d9d8c7cb2763f677278cf20bd82

SHA1
b62a7619d8ead2b5926fb715f36ad0bc043b1e63

SHA256
6853e0deb38a44eb1c5b9ca493720e22b6fe902e1216cc8dc3b1bd57396709ad

SHA512
6e3e326aa6de7cc74f5305364faa1272a303786b74d76f50e00219b379ebbd3a99a179c6c2bd1f061a67fdd57c6feaac3c7f0e9be4f9cd13c1ff97cdc09f29fd

Download Submit
C:\Windows\System\tWdNPRP.exe

Filesize
1.4MB

MD5
cd7e5f72fd5ad301650c5fb9c54b50cc

SHA1
966622ae5d656db40f80e76bcefc95ab7a08ea59

SHA256
02e20945be1c3896efed2f8eba1ca87d0b0c8cce035f341dd015f5df0682e821

SHA512
61409f6ebf9e80a4023a745735b01d5dba432ce7a4b09c5720b7887b7ea22b70853ff279965355a17722761e96dc1f0acc7dce3d70824cbb2fc58cad4303cb26

Download Submit
C:\Windows\System\uOSemOx.exe

Filesize
1.4MB

MD5
c04d01cb4abbb11159915adadb8341f0

SHA1
06585439ccc0748855769b9a827d4b8ebe677c5f

SHA256
ab0b0122664b84cef7d9ebdd17d99de12a2496781c8ad9c315022264a57603a2

SHA512
1b9a368e861c3304f3c69265127160d7658c297862fe10079550d3895cd1730ec12b4e4ebc7c2f147dcf3295c0a8b4ab04a1a9bc268b280f46a0768ed81020aa

Download Submit
C:\Windows\System\vLENugn.exe

Filesize
1.4MB

MD5
3ecd17c4df7508f27edb34026828da2b

SHA1
26c62bbb042aadc8564e00e4a0c4a694098c3664

SHA256
4a254884c992abda326e33ad20d6033905c99d5362848b783dae3703c572397d

SHA512
0846840a6dea44538c4ccf553d8fa0ecbaefa74b47aa76b5cbd7e14ce8e8262ffcf72ef2b25563f5603cf239f8b9f1fecd0ce1da713644fa16ff7f5bca935b1f

Download Submit
C:\Windows\System\wiEYoBP.exe

Filesize
1.4MB

MD5
73f97eb6ff2301e09122e5ebb0ec44e0

SHA1
3f139e9c6a69eec2e46ac1c693a6fcb59d6bce76

SHA256
73279aab1f6704fb0039f732f40ec1e7db889395e84b4d22ba9c5cde37d84cf4

SHA512
797ee2656178033df6ca128e6eea1e944ede093e1c989ddba5b61e466f6c611412fc23dfde57295b813fdab13f8e00b592ce134f074729d9dafae75b3f57cfe0

Download Submit
C:\Windows\System\xnatKcc.exe

Filesize
1.4MB

MD5
c56393df5959b387675226448b547a72

SHA1
ee5962c89b3943155739368445490287697de5fa

SHA256
fbdcd6e7dbe5761ddcc442c21188710e45f4846f4e490b416c68c9dc37b3ae3b

SHA512
9af047809695885e8252f6cd1275311d7840b5123b66cb47a434f12c87bd12195a59887b1955fe4755f2d8d0a5814edb839743cbeb75f7b8aeca539af09e72b7

Download Submit
C:\Windows\System\zelZGck.exe

Filesize
1.4MB

MD5
a7cc3cb468f77edcba1cbdbac3eba8f7

SHA1
4c3525271003dce1fd90c47d259d7edf52de0c6d

SHA256
69e9affe53af58fce0cf7b94f6b54d8fdf2e6308da945d388ca74627ce986eb4

SHA512
8ca298a653aa428ad428cf0a4e6bf8b42e7cc61bc1490bb8b692a16f285f0de4cfa2170a8bb41ab25f15babd8606341af27a28af542b938b24dc69b27a1f72c4

Download Submit
memory/4112-0-0x0000022EE0470000-0x0000022EE0480000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads