xmrig | 9f66573b77957d512bd68c732795f8ac89459c319d40dcc31a29e758f5ec9dd7

Analysis

max time kernel
133s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20250129-en
resource tags

arch:x64arch:x86image:win10v2004-20250129-enlocale:en-usos:windows10-2004-x64system
submitted
03/02/2025, 02:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9f66573b77957d512bd68c732795f8ac89459c319d40dcc31a29e758f5ec9dd7.exe
Size

1.4MB
MD5

69a08285a018ec90bda2869218f8d065
SHA1

f7ba96bff8de0a705359cb083ffcf42a7827ee8f
SHA256

9f66573b77957d512bd68c732795f8ac89459c319d40dcc31a29e758f5ec9dd7
SHA512

fd340089e6903137dd9123c51b5a36e91b1a1ced0fe57ab9b48d422aefd40766f6ef14817b71fc0b77741ba4e537215f2d962df45e676f551ebdfe6392daa6f8
SSDEEP

24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbpwlKenszbWKDNEm/5p84nesnQfr:GezaTF8FcNkNdfE0pZ9ozttwIRxA1sfC

Score

10^/10

xmrig miner persistence privilege_escalation

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 33 IoCs

miner

resource	yara_rule
behavioral2/files/0x000a000000023c8c-4.dat	xmrig
behavioral2/files/0x0007000000023ca7-8.dat	xmrig
behavioral2/files/0x0007000000023ca9-25.dat	xmrig
behavioral2/files/0x0007000000023cac-41.dat	xmrig
behavioral2/files/0x0007000000023caf-52.dat	xmrig
behavioral2/files/0x0007000000023cb0-62.dat	xmrig
behavioral2/files/0x0007000000023cb1-70.dat	xmrig
behavioral2/files/0x0007000000023cb4-77.dat	xmrig
behavioral2/files/0x0007000000023cb8-97.dat	xmrig
behavioral2/files/0x0007000000023cb9-110.dat	xmrig
behavioral2/files/0x0007000000023cbd-122.dat	xmrig
behavioral2/files/0x0007000000023cbf-140.dat	xmrig
behavioral2/files/0x0007000000023cc2-155.dat	xmrig
behavioral2/files/0x0007000000023cc5-162.dat	xmrig
behavioral2/files/0x0007000000023cc3-160.dat	xmrig
behavioral2/files/0x0007000000023cc4-157.dat	xmrig
behavioral2/files/0x0007000000023cc1-150.dat	xmrig
behavioral2/files/0x0007000000023cc0-145.dat	xmrig
behavioral2/files/0x0007000000023cbe-135.dat	xmrig
behavioral2/files/0x0007000000023cbc-125.dat	xmrig
behavioral2/files/0x0007000000023cbb-120.dat	xmrig
behavioral2/files/0x0007000000023cba-115.dat	xmrig
behavioral2/files/0x0007000000023cb7-100.dat	xmrig
behavioral2/files/0x0007000000023cb6-95.dat	xmrig
behavioral2/files/0x0007000000023cb5-90.dat	xmrig
behavioral2/files/0x0007000000023cb3-80.dat	xmrig
behavioral2/files/0x0007000000023cb2-75.dat	xmrig
behavioral2/files/0x0007000000023cae-55.dat	xmrig
behavioral2/files/0x0007000000023cad-50.dat	xmrig
behavioral2/files/0x0007000000023cab-37.dat	xmrig
behavioral2/files/0x0007000000023caa-33.dat	xmrig
behavioral2/files/0x0007000000023ca8-20.dat	xmrig
behavioral2/files/0x0008000000023ca6-10.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
1456	rbovXXt.exe
3356	yctUHCR.exe
116	jxIWiSr.exe
3712	grYaYRf.exe
2888	YxmixcB.exe
208	WePHvwA.exe
3568	VfhNJiA.exe
1508	zONHZBF.exe
1056	KVQsFRi.exe
2804	oBPyZOR.exe
2572	vlOmbFf.exe
1856	XFIjYaq.exe
648	cnjtQDm.exe
4492	PLuOyox.exe
2584	vNhGtZR.exe
3976	WPFFTJD.exe
3248	VtxRBlt.exe
2164	LeoQmcB.exe
3564	oIrAkuG.exe
3984	vOHKQgy.exe
1824	QpHXaWl.exe
4660	NUFTngC.exe
3884	NpCmYDE.exe
3032	FEHFqDQ.exe
2180	EapNivd.exe
3076	QmuCIlM.exe
2828	AiSLoSk.exe
2548	PLVDQbe.exe
2944	zYjrQeJ.exe
1272	rkhotoG.exe
4788	yIzmshb.exe
4340	YDcTGYt.exe
452	jniHDdg.exe
1844	RqOcJOd.exe
2352	oNFlLps.exe
1616	bIiAMsn.exe
1764	dVnPMWD.exe
2900	frHehwr.exe
3472	ryvSjEp.exe
1536	poGUBwW.exe
728	DmKjCRK.exe
4876	PlKnarZ.exe
2356	DJHCjiC.exe
2528	jxaoSxu.exe
4128	sYjyJBV.exe
1932	EjnSMEN.exe
1452	koJHywp.exe
3708	XSWgzQL.exe
3476	DnGojrU.exe
2872	PfevpmX.exe
1376	UdCTvQS.exe
4448	YmWbjIT.exe
3468	CehfNkg.exe
1528	MisNKnG.exe
4280	JoUsEsm.exe
4068	NGUtrsL.exe
4592	patXPQQ.exe
4012	rfQSMFU.exe
4120	jWPyjmI.exe
1648	sddfqel.exe
2652	pMvnRaK.exe
3868	KctRhOI.exe
5068	toeCaPV.exe
5008	JTVSPTu.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\PQAIREi.exe	9f66573b77957d512bd68c732795f8ac89459c319d40dcc31a29e758f5ec9dd7.exe
File created	C:\Windows\System\RqOcJOd.exe	9f66573b77957d512bd68c732795f8ac89459c319d40dcc31a29e758f5ec9dd7.exe
File created	C:\Windows\System\gNPssNJ.exe	9f66573b77957d512bd68c732795f8ac89459c319d40dcc31a29e758f5ec9dd7.exe
File created	C:\Windows\System\cylFVnk.exe	9f66573b77957d512bd68c732795f8ac89459c319d40dcc31a29e758f5ec9dd7.exe
File created	C:\Windows\System\xKTdUMa.exe	9f66573b77957d512bd68c732795f8ac89459c319d40dcc31a29e758f5ec9dd7.exe
File created	C:\Windows\System\FrhwwAa.exe	9f66573b77957d512bd68c732795f8ac89459c319d40dcc31a29e758f5ec9dd7.exe
File created	C:\Windows\System\akErHwk.exe	9f66573b77957d512bd68c732795f8ac89459c319d40dcc31a29e758f5ec9dd7.exe
File created	C:\Windows\System\lsGVyKx.exe	9f66573b77957d512bd68c732795f8ac89459c319d40dcc31a29e758f5ec9dd7.exe
File created	C:\Windows\System\YKVnaOb.exe	9f66573b77957d512bd68c732795f8ac89459c319d40dcc31a29e758f5ec9dd7.exe
File created	C:\Windows\System\pHEbrGV.exe	9f66573b77957d512bd68c732795f8ac89459c319d40dcc31a29e758f5ec9dd7.exe
File created	C:\Windows\System\swHFCQT.exe	9f66573b77957d512bd68c732795f8ac89459c319d40dcc31a29e758f5ec9dd7.exe
File created	C:\Windows\System\ckhmHgf.exe	9f66573b77957d512bd68c732795f8ac89459c319d40dcc31a29e758f5ec9dd7.exe
File created	C:\Windows\System\GkWhyqm.exe	9f66573b77957d512bd68c732795f8ac89459c319d40dcc31a29e758f5ec9dd7.exe
File created	C:\Windows\System\mCiaUvz.exe	9f66573b77957d512bd68c732795f8ac89459c319d40dcc31a29e758f5ec9dd7.exe
File created	C:\Windows\System\YefIFPs.exe	9f66573b77957d512bd68c732795f8ac89459c319d40dcc31a29e758f5ec9dd7.exe
File created	C:\Windows\System\OqqFFpb.exe	9f66573b77957d512bd68c732795f8ac89459c319d40dcc31a29e758f5ec9dd7.exe
File created	C:\Windows\System\hQNknJF.exe	9f66573b77957d512bd68c732795f8ac89459c319d40dcc31a29e758f5ec9dd7.exe
File created	C:\Windows\System\usIxvRh.exe	9f66573b77957d512bd68c732795f8ac89459c319d40dcc31a29e758f5ec9dd7.exe
File created	C:\Windows\System\vBZPUCk.exe	9f66573b77957d512bd68c732795f8ac89459c319d40dcc31a29e758f5ec9dd7.exe
File created	C:\Windows\System\BUzMJkp.exe	9f66573b77957d512bd68c732795f8ac89459c319d40dcc31a29e758f5ec9dd7.exe
File created	C:\Windows\System\Iisylap.exe	9f66573b77957d512bd68c732795f8ac89459c319d40dcc31a29e758f5ec9dd7.exe
File created	C:\Windows\System\xQadvzz.exe	9f66573b77957d512bd68c732795f8ac89459c319d40dcc31a29e758f5ec9dd7.exe
File created	C:\Windows\System\BNfODwR.exe	9f66573b77957d512bd68c732795f8ac89459c319d40dcc31a29e758f5ec9dd7.exe
File created	C:\Windows\System\wxcXomF.exe	9f66573b77957d512bd68c732795f8ac89459c319d40dcc31a29e758f5ec9dd7.exe
File created	C:\Windows\System\popeHGo.exe	9f66573b77957d512bd68c732795f8ac89459c319d40dcc31a29e758f5ec9dd7.exe
File created	C:\Windows\System\xTxEHOB.exe	9f66573b77957d512bd68c732795f8ac89459c319d40dcc31a29e758f5ec9dd7.exe
File created	C:\Windows\System\eWPLRmq.exe	9f66573b77957d512bd68c732795f8ac89459c319d40dcc31a29e758f5ec9dd7.exe
File created	C:\Windows\System\PcQzCMP.exe	9f66573b77957d512bd68c732795f8ac89459c319d40dcc31a29e758f5ec9dd7.exe
File created	C:\Windows\System\QUPBRda.exe	9f66573b77957d512bd68c732795f8ac89459c319d40dcc31a29e758f5ec9dd7.exe
File created	C:\Windows\System\rbovXXt.exe	9f66573b77957d512bd68c732795f8ac89459c319d40dcc31a29e758f5ec9dd7.exe
File created	C:\Windows\System\ynhDEWm.exe	9f66573b77957d512bd68c732795f8ac89459c319d40dcc31a29e758f5ec9dd7.exe
File created	C:\Windows\System\yMokvAU.exe	9f66573b77957d512bd68c732795f8ac89459c319d40dcc31a29e758f5ec9dd7.exe
File created	C:\Windows\System\LhCZGQk.exe	9f66573b77957d512bd68c732795f8ac89459c319d40dcc31a29e758f5ec9dd7.exe
File created	C:\Windows\System\jniHDdg.exe	9f66573b77957d512bd68c732795f8ac89459c319d40dcc31a29e758f5ec9dd7.exe
File created	C:\Windows\System\WrNhbfZ.exe	9f66573b77957d512bd68c732795f8ac89459c319d40dcc31a29e758f5ec9dd7.exe
File created	C:\Windows\System\FFRMlHY.exe	9f66573b77957d512bd68c732795f8ac89459c319d40dcc31a29e758f5ec9dd7.exe
File created	C:\Windows\System\KyZYmcf.exe	9f66573b77957d512bd68c732795f8ac89459c319d40dcc31a29e758f5ec9dd7.exe
File created	C:\Windows\System\hMyWfHX.exe	9f66573b77957d512bd68c732795f8ac89459c319d40dcc31a29e758f5ec9dd7.exe
File created	C:\Windows\System\IxXPteC.exe	9f66573b77957d512bd68c732795f8ac89459c319d40dcc31a29e758f5ec9dd7.exe
File created	C:\Windows\System\LOhsZOI.exe	9f66573b77957d512bd68c732795f8ac89459c319d40dcc31a29e758f5ec9dd7.exe
File created	C:\Windows\System\ELeuszP.exe	9f66573b77957d512bd68c732795f8ac89459c319d40dcc31a29e758f5ec9dd7.exe
File created	C:\Windows\System\gcVCMPx.exe	9f66573b77957d512bd68c732795f8ac89459c319d40dcc31a29e758f5ec9dd7.exe
File created	C:\Windows\System\DcECxRE.exe	9f66573b77957d512bd68c732795f8ac89459c319d40dcc31a29e758f5ec9dd7.exe
File created	C:\Windows\System\dOXLGCM.exe	9f66573b77957d512bd68c732795f8ac89459c319d40dcc31a29e758f5ec9dd7.exe
File created	C:\Windows\System\OpBuLOV.exe	9f66573b77957d512bd68c732795f8ac89459c319d40dcc31a29e758f5ec9dd7.exe
File created	C:\Windows\System\XdszxXJ.exe	9f66573b77957d512bd68c732795f8ac89459c319d40dcc31a29e758f5ec9dd7.exe
File created	C:\Windows\System\AiSLoSk.exe	9f66573b77957d512bd68c732795f8ac89459c319d40dcc31a29e758f5ec9dd7.exe
File created	C:\Windows\System\GakqVgs.exe	9f66573b77957d512bd68c732795f8ac89459c319d40dcc31a29e758f5ec9dd7.exe
File created	C:\Windows\System\mOAXiSL.exe	9f66573b77957d512bd68c732795f8ac89459c319d40dcc31a29e758f5ec9dd7.exe
File created	C:\Windows\System\yoLWeND.exe	9f66573b77957d512bd68c732795f8ac89459c319d40dcc31a29e758f5ec9dd7.exe
File created	C:\Windows\System\LDHlMdR.exe	9f66573b77957d512bd68c732795f8ac89459c319d40dcc31a29e758f5ec9dd7.exe
File created	C:\Windows\System\GgdIIoW.exe	9f66573b77957d512bd68c732795f8ac89459c319d40dcc31a29e758f5ec9dd7.exe
File created	C:\Windows\System\cTpbIVo.exe	9f66573b77957d512bd68c732795f8ac89459c319d40dcc31a29e758f5ec9dd7.exe
File created	C:\Windows\System\ymDBVvD.exe	9f66573b77957d512bd68c732795f8ac89459c319d40dcc31a29e758f5ec9dd7.exe
File created	C:\Windows\System\ySAdvTW.exe	9f66573b77957d512bd68c732795f8ac89459c319d40dcc31a29e758f5ec9dd7.exe
File created	C:\Windows\System\AFYzwVf.exe	9f66573b77957d512bd68c732795f8ac89459c319d40dcc31a29e758f5ec9dd7.exe
File created	C:\Windows\System\ixWtDJF.exe	9f66573b77957d512bd68c732795f8ac89459c319d40dcc31a29e758f5ec9dd7.exe
File created	C:\Windows\System\lzGHSsk.exe	9f66573b77957d512bd68c732795f8ac89459c319d40dcc31a29e758f5ec9dd7.exe
File created	C:\Windows\System\OQURMCV.exe	9f66573b77957d512bd68c732795f8ac89459c319d40dcc31a29e758f5ec9dd7.exe
File created	C:\Windows\System\kiikJkr.exe	9f66573b77957d512bd68c732795f8ac89459c319d40dcc31a29e758f5ec9dd7.exe
File created	C:\Windows\System\AdgOUbU.exe	9f66573b77957d512bd68c732795f8ac89459c319d40dcc31a29e758f5ec9dd7.exe
File created	C:\Windows\System\RHqPdiw.exe	9f66573b77957d512bd68c732795f8ac89459c319d40dcc31a29e758f5ec9dd7.exe
File created	C:\Windows\System\tFEoWaq.exe	9f66573b77957d512bd68c732795f8ac89459c319d40dcc31a29e758f5ec9dd7.exe
File created	C:\Windows\System\pYEcalZ.exe	9f66573b77957d512bd68c732795f8ac89459c319d40dcc31a29e758f5ec9dd7.exe

Event Triggered Execution: Accessibility Features 1 TTPs
Windows contains accessibility features that may be used by adversaries to establish persistence and/or elevate privileges.
persistence privilege_escalation

Accessibility Features
T1546.008

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	16460	dwm.exe
Token: SeChangeNotifyPrivilege	16460	dwm.exe
Token: 33	16460	dwm.exe
Token: SeIncBasePriorityPrivilege	16460	dwm.exe
Token: SeShutdownPrivilege	16460	dwm.exe
Token: SeCreatePagefilePrivilege	16460	dwm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4960 wrote to memory of 1456	4960	9f66573b77957d512bd68c732795f8ac89459c319d40dcc31a29e758f5ec9dd7.exe	85
PID 4960 wrote to memory of 1456	4960	9f66573b77957d512bd68c732795f8ac89459c319d40dcc31a29e758f5ec9dd7.exe	85
PID 4960 wrote to memory of 3356	4960	9f66573b77957d512bd68c732795f8ac89459c319d40dcc31a29e758f5ec9dd7.exe	86
PID 4960 wrote to memory of 3356	4960	9f66573b77957d512bd68c732795f8ac89459c319d40dcc31a29e758f5ec9dd7.exe	86
PID 4960 wrote to memory of 116	4960	9f66573b77957d512bd68c732795f8ac89459c319d40dcc31a29e758f5ec9dd7.exe	88
PID 4960 wrote to memory of 116	4960	9f66573b77957d512bd68c732795f8ac89459c319d40dcc31a29e758f5ec9dd7.exe	88
PID 4960 wrote to memory of 3712	4960	9f66573b77957d512bd68c732795f8ac89459c319d40dcc31a29e758f5ec9dd7.exe	89
PID 4960 wrote to memory of 3712	4960	9f66573b77957d512bd68c732795f8ac89459c319d40dcc31a29e758f5ec9dd7.exe	89
PID 4960 wrote to memory of 2888	4960	9f66573b77957d512bd68c732795f8ac89459c319d40dcc31a29e758f5ec9dd7.exe	90
PID 4960 wrote to memory of 2888	4960	9f66573b77957d512bd68c732795f8ac89459c319d40dcc31a29e758f5ec9dd7.exe	90
PID 4960 wrote to memory of 208	4960	9f66573b77957d512bd68c732795f8ac89459c319d40dcc31a29e758f5ec9dd7.exe	91
PID 4960 wrote to memory of 208	4960	9f66573b77957d512bd68c732795f8ac89459c319d40dcc31a29e758f5ec9dd7.exe	91
PID 4960 wrote to memory of 3568	4960	9f66573b77957d512bd68c732795f8ac89459c319d40dcc31a29e758f5ec9dd7.exe	92
PID 4960 wrote to memory of 3568	4960	9f66573b77957d512bd68c732795f8ac89459c319d40dcc31a29e758f5ec9dd7.exe	92
PID 4960 wrote to memory of 1508	4960	9f66573b77957d512bd68c732795f8ac89459c319d40dcc31a29e758f5ec9dd7.exe	93
PID 4960 wrote to memory of 1508	4960	9f66573b77957d512bd68c732795f8ac89459c319d40dcc31a29e758f5ec9dd7.exe	93
PID 4960 wrote to memory of 1056	4960	9f66573b77957d512bd68c732795f8ac89459c319d40dcc31a29e758f5ec9dd7.exe	94
PID 4960 wrote to memory of 1056	4960	9f66573b77957d512bd68c732795f8ac89459c319d40dcc31a29e758f5ec9dd7.exe	94
PID 4960 wrote to memory of 2804	4960	9f66573b77957d512bd68c732795f8ac89459c319d40dcc31a29e758f5ec9dd7.exe	95
PID 4960 wrote to memory of 2804	4960	9f66573b77957d512bd68c732795f8ac89459c319d40dcc31a29e758f5ec9dd7.exe	95
PID 4960 wrote to memory of 2572	4960	9f66573b77957d512bd68c732795f8ac89459c319d40dcc31a29e758f5ec9dd7.exe	96
PID 4960 wrote to memory of 2572	4960	9f66573b77957d512bd68c732795f8ac89459c319d40dcc31a29e758f5ec9dd7.exe	96
PID 4960 wrote to memory of 1856	4960	9f66573b77957d512bd68c732795f8ac89459c319d40dcc31a29e758f5ec9dd7.exe	97
PID 4960 wrote to memory of 1856	4960	9f66573b77957d512bd68c732795f8ac89459c319d40dcc31a29e758f5ec9dd7.exe	97
PID 4960 wrote to memory of 648	4960	9f66573b77957d512bd68c732795f8ac89459c319d40dcc31a29e758f5ec9dd7.exe	98
PID 4960 wrote to memory of 648	4960	9f66573b77957d512bd68c732795f8ac89459c319d40dcc31a29e758f5ec9dd7.exe	98
PID 4960 wrote to memory of 4492	4960	9f66573b77957d512bd68c732795f8ac89459c319d40dcc31a29e758f5ec9dd7.exe	99
PID 4960 wrote to memory of 4492	4960	9f66573b77957d512bd68c732795f8ac89459c319d40dcc31a29e758f5ec9dd7.exe	99
PID 4960 wrote to memory of 2584	4960	9f66573b77957d512bd68c732795f8ac89459c319d40dcc31a29e758f5ec9dd7.exe	100
PID 4960 wrote to memory of 2584	4960	9f66573b77957d512bd68c732795f8ac89459c319d40dcc31a29e758f5ec9dd7.exe	100
PID 4960 wrote to memory of 3976	4960	9f66573b77957d512bd68c732795f8ac89459c319d40dcc31a29e758f5ec9dd7.exe	101
PID 4960 wrote to memory of 3976	4960	9f66573b77957d512bd68c732795f8ac89459c319d40dcc31a29e758f5ec9dd7.exe	101
PID 4960 wrote to memory of 3248	4960	9f66573b77957d512bd68c732795f8ac89459c319d40dcc31a29e758f5ec9dd7.exe	102
PID 4960 wrote to memory of 3248	4960	9f66573b77957d512bd68c732795f8ac89459c319d40dcc31a29e758f5ec9dd7.exe	102
PID 4960 wrote to memory of 2164	4960	9f66573b77957d512bd68c732795f8ac89459c319d40dcc31a29e758f5ec9dd7.exe	103
PID 4960 wrote to memory of 2164	4960	9f66573b77957d512bd68c732795f8ac89459c319d40dcc31a29e758f5ec9dd7.exe	103
PID 4960 wrote to memory of 3564	4960	9f66573b77957d512bd68c732795f8ac89459c319d40dcc31a29e758f5ec9dd7.exe	104
PID 4960 wrote to memory of 3564	4960	9f66573b77957d512bd68c732795f8ac89459c319d40dcc31a29e758f5ec9dd7.exe	104
PID 4960 wrote to memory of 3984	4960	9f66573b77957d512bd68c732795f8ac89459c319d40dcc31a29e758f5ec9dd7.exe	105
PID 4960 wrote to memory of 3984	4960	9f66573b77957d512bd68c732795f8ac89459c319d40dcc31a29e758f5ec9dd7.exe	105
PID 4960 wrote to memory of 1824	4960	9f66573b77957d512bd68c732795f8ac89459c319d40dcc31a29e758f5ec9dd7.exe	106
PID 4960 wrote to memory of 1824	4960	9f66573b77957d512bd68c732795f8ac89459c319d40dcc31a29e758f5ec9dd7.exe	106
PID 4960 wrote to memory of 4660	4960	9f66573b77957d512bd68c732795f8ac89459c319d40dcc31a29e758f5ec9dd7.exe	107
PID 4960 wrote to memory of 4660	4960	9f66573b77957d512bd68c732795f8ac89459c319d40dcc31a29e758f5ec9dd7.exe	107
PID 4960 wrote to memory of 3884	4960	9f66573b77957d512bd68c732795f8ac89459c319d40dcc31a29e758f5ec9dd7.exe	108
PID 4960 wrote to memory of 3884	4960	9f66573b77957d512bd68c732795f8ac89459c319d40dcc31a29e758f5ec9dd7.exe	108
PID 4960 wrote to memory of 3032	4960	9f66573b77957d512bd68c732795f8ac89459c319d40dcc31a29e758f5ec9dd7.exe	109
PID 4960 wrote to memory of 3032	4960	9f66573b77957d512bd68c732795f8ac89459c319d40dcc31a29e758f5ec9dd7.exe	109
PID 4960 wrote to memory of 2180	4960	9f66573b77957d512bd68c732795f8ac89459c319d40dcc31a29e758f5ec9dd7.exe	110
PID 4960 wrote to memory of 2180	4960	9f66573b77957d512bd68c732795f8ac89459c319d40dcc31a29e758f5ec9dd7.exe	110
PID 4960 wrote to memory of 3076	4960	9f66573b77957d512bd68c732795f8ac89459c319d40dcc31a29e758f5ec9dd7.exe	111
PID 4960 wrote to memory of 3076	4960	9f66573b77957d512bd68c732795f8ac89459c319d40dcc31a29e758f5ec9dd7.exe	111
PID 4960 wrote to memory of 2828	4960	9f66573b77957d512bd68c732795f8ac89459c319d40dcc31a29e758f5ec9dd7.exe	112
PID 4960 wrote to memory of 2828	4960	9f66573b77957d512bd68c732795f8ac89459c319d40dcc31a29e758f5ec9dd7.exe	112
PID 4960 wrote to memory of 2548	4960	9f66573b77957d512bd68c732795f8ac89459c319d40dcc31a29e758f5ec9dd7.exe	113
PID 4960 wrote to memory of 2548	4960	9f66573b77957d512bd68c732795f8ac89459c319d40dcc31a29e758f5ec9dd7.exe	113
PID 4960 wrote to memory of 2944	4960	9f66573b77957d512bd68c732795f8ac89459c319d40dcc31a29e758f5ec9dd7.exe	114
PID 4960 wrote to memory of 2944	4960	9f66573b77957d512bd68c732795f8ac89459c319d40dcc31a29e758f5ec9dd7.exe	114
PID 4960 wrote to memory of 1272	4960	9f66573b77957d512bd68c732795f8ac89459c319d40dcc31a29e758f5ec9dd7.exe	115
PID 4960 wrote to memory of 1272	4960	9f66573b77957d512bd68c732795f8ac89459c319d40dcc31a29e758f5ec9dd7.exe	115
PID 4960 wrote to memory of 4788	4960	9f66573b77957d512bd68c732795f8ac89459c319d40dcc31a29e758f5ec9dd7.exe	116
PID 4960 wrote to memory of 4788	4960	9f66573b77957d512bd68c732795f8ac89459c319d40dcc31a29e758f5ec9dd7.exe	116
PID 4960 wrote to memory of 4340	4960	9f66573b77957d512bd68c732795f8ac89459c319d40dcc31a29e758f5ec9dd7.exe	117
PID 4960 wrote to memory of 4340	4960	9f66573b77957d512bd68c732795f8ac89459c319d40dcc31a29e758f5ec9dd7.exe	117

C:\Users\Admin\AppData\Local\Temp\9f66573b77957d512bd68c732795f8ac89459c319d40dcc31a29e758f5ec9dd7.exe
"C:\Users\Admin\AppData\Local\Temp\9f66573b77957d512bd68c732795f8ac89459c319d40dcc31a29e758f5ec9dd7.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4960
- C:\Windows\System\rbovXXt.exe
  C:\Windows\System\rbovXXt.exe
  2⤵
  - Executes dropped EXE
  PID:1456
- C:\Windows\System\yctUHCR.exe
  C:\Windows\System\yctUHCR.exe
  2⤵
  - Executes dropped EXE
  PID:3356
- C:\Windows\System\jxIWiSr.exe
  C:\Windows\System\jxIWiSr.exe
  2⤵
  - Executes dropped EXE
  PID:116
- C:\Windows\System\grYaYRf.exe
  C:\Windows\System\grYaYRf.exe
  2⤵
  - Executes dropped EXE
  PID:3712
- C:\Windows\System\YxmixcB.exe
  C:\Windows\System\YxmixcB.exe
  2⤵
  - Executes dropped EXE
  PID:2888
- C:\Windows\System\WePHvwA.exe
  C:\Windows\System\WePHvwA.exe
  2⤵
  - Executes dropped EXE
  PID:208
- C:\Windows\System\VfhNJiA.exe
  C:\Windows\System\VfhNJiA.exe
  2⤵
  - Executes dropped EXE
  PID:3568
- C:\Windows\System\zONHZBF.exe
  C:\Windows\System\zONHZBF.exe
  2⤵
  - Executes dropped EXE
  PID:1508
- C:\Windows\System\KVQsFRi.exe
  C:\Windows\System\KVQsFRi.exe
  2⤵
  - Executes dropped EXE
  PID:1056
- C:\Windows\System\oBPyZOR.exe
  C:\Windows\System\oBPyZOR.exe
  2⤵
  - Executes dropped EXE
  PID:2804
- C:\Windows\System\vlOmbFf.exe
  C:\Windows\System\vlOmbFf.exe
  2⤵
  - Executes dropped EXE
  PID:2572
- C:\Windows\System\XFIjYaq.exe
  C:\Windows\System\XFIjYaq.exe
  2⤵
  - Executes dropped EXE
  PID:1856
- C:\Windows\System\cnjtQDm.exe
  C:\Windows\System\cnjtQDm.exe
  2⤵
  - Executes dropped EXE
  PID:648
- C:\Windows\System\PLuOyox.exe
  C:\Windows\System\PLuOyox.exe
  2⤵
  - Executes dropped EXE
  PID:4492
- C:\Windows\System\vNhGtZR.exe
  C:\Windows\System\vNhGtZR.exe
  2⤵
  - Executes dropped EXE
  PID:2584
- C:\Windows\System\WPFFTJD.exe
  C:\Windows\System\WPFFTJD.exe
  2⤵
  - Executes dropped EXE
  PID:3976
- C:\Windows\System\VtxRBlt.exe
  C:\Windows\System\VtxRBlt.exe
  2⤵
  - Executes dropped EXE
  PID:3248
- C:\Windows\System\LeoQmcB.exe
  C:\Windows\System\LeoQmcB.exe
  2⤵
  - Executes dropped EXE
  PID:2164
- C:\Windows\System\oIrAkuG.exe
  C:\Windows\System\oIrAkuG.exe
  2⤵
  - Executes dropped EXE
  PID:3564
- C:\Windows\System\vOHKQgy.exe
  C:\Windows\System\vOHKQgy.exe
  2⤵
  - Executes dropped EXE
  PID:3984
- C:\Windows\System\QpHXaWl.exe
  C:\Windows\System\QpHXaWl.exe
  2⤵
  - Executes dropped EXE
  PID:1824
- C:\Windows\System\NUFTngC.exe
  C:\Windows\System\NUFTngC.exe
  2⤵
  - Executes dropped EXE
  PID:4660
- C:\Windows\System\NpCmYDE.exe
  C:\Windows\System\NpCmYDE.exe
  2⤵
  - Executes dropped EXE
  PID:3884
- C:\Windows\System\FEHFqDQ.exe
  C:\Windows\System\FEHFqDQ.exe
  2⤵
  - Executes dropped EXE
  PID:3032
- C:\Windows\System\EapNivd.exe
  C:\Windows\System\EapNivd.exe
  2⤵
  - Executes dropped EXE
  PID:2180
- C:\Windows\System\QmuCIlM.exe
  C:\Windows\System\QmuCIlM.exe
  2⤵
  - Executes dropped EXE
  PID:3076
- C:\Windows\System\AiSLoSk.exe
  C:\Windows\System\AiSLoSk.exe
  2⤵
  - Executes dropped EXE
  PID:2828
- C:\Windows\System\PLVDQbe.exe
  C:\Windows\System\PLVDQbe.exe
  2⤵
  - Executes dropped EXE
  PID:2548
- C:\Windows\System\zYjrQeJ.exe
  C:\Windows\System\zYjrQeJ.exe
  2⤵
  - Executes dropped EXE
  PID:2944
- C:\Windows\System\rkhotoG.exe
  C:\Windows\System\rkhotoG.exe
  2⤵
  - Executes dropped EXE
  PID:1272
- C:\Windows\System\yIzmshb.exe
  C:\Windows\System\yIzmshb.exe
  2⤵
  - Executes dropped EXE
  PID:4788
- C:\Windows\System\YDcTGYt.exe
  C:\Windows\System\YDcTGYt.exe
  2⤵
  - Executes dropped EXE
  PID:4340
- C:\Windows\System\jniHDdg.exe
  C:\Windows\System\jniHDdg.exe
  2⤵
  - Executes dropped EXE
  PID:452
- C:\Windows\System\RqOcJOd.exe
  C:\Windows\System\RqOcJOd.exe
  2⤵
  - Executes dropped EXE
  PID:1844
- C:\Windows\System\oNFlLps.exe
  C:\Windows\System\oNFlLps.exe
  2⤵
  - Executes dropped EXE
  PID:2352
- C:\Windows\System\bIiAMsn.exe
  C:\Windows\System\bIiAMsn.exe
  2⤵
  - Executes dropped EXE
  PID:1616
- C:\Windows\System\dVnPMWD.exe
  C:\Windows\System\dVnPMWD.exe
  2⤵
  - Executes dropped EXE
  PID:1764
- C:\Windows\System\frHehwr.exe
  C:\Windows\System\frHehwr.exe
  2⤵
  - Executes dropped EXE
  PID:2900
- C:\Windows\System\ryvSjEp.exe
  C:\Windows\System\ryvSjEp.exe
  2⤵
  - Executes dropped EXE
  PID:3472
- C:\Windows\System\poGUBwW.exe
  C:\Windows\System\poGUBwW.exe
  2⤵
  - Executes dropped EXE
  PID:1536
- C:\Windows\System\DmKjCRK.exe
  C:\Windows\System\DmKjCRK.exe
  2⤵
  - Executes dropped EXE
  PID:728
- C:\Windows\System\PlKnarZ.exe
  C:\Windows\System\PlKnarZ.exe
  2⤵
  - Executes dropped EXE
  PID:4876
- C:\Windows\System\DJHCjiC.exe
  C:\Windows\System\DJHCjiC.exe
  2⤵
  - Executes dropped EXE
  PID:2356
- C:\Windows\System\jxaoSxu.exe
  C:\Windows\System\jxaoSxu.exe
  2⤵
  - Executes dropped EXE
  PID:2528
- C:\Windows\System\sYjyJBV.exe
  C:\Windows\System\sYjyJBV.exe
  2⤵
  - Executes dropped EXE
  PID:4128
- C:\Windows\System\EjnSMEN.exe
  C:\Windows\System\EjnSMEN.exe
  2⤵
  - Executes dropped EXE
  PID:1932
- C:\Windows\System\koJHywp.exe
  C:\Windows\System\koJHywp.exe
  2⤵
  - Executes dropped EXE
  PID:1452
- C:\Windows\System\XSWgzQL.exe
  C:\Windows\System\XSWgzQL.exe
  2⤵
  - Executes dropped EXE
  PID:3708
- C:\Windows\System\DnGojrU.exe
  C:\Windows\System\DnGojrU.exe
  2⤵
  - Executes dropped EXE
  PID:3476
- C:\Windows\System\PfevpmX.exe
  C:\Windows\System\PfevpmX.exe
  2⤵
  - Executes dropped EXE
  PID:2872
- C:\Windows\System\UdCTvQS.exe
  C:\Windows\System\UdCTvQS.exe
  2⤵
  - Executes dropped EXE
  PID:1376
- C:\Windows\System\YmWbjIT.exe
  C:\Windows\System\YmWbjIT.exe
  2⤵
  - Executes dropped EXE
  PID:4448
- C:\Windows\System\CehfNkg.exe
  C:\Windows\System\CehfNkg.exe
  2⤵
  - Executes dropped EXE
  PID:3468
- C:\Windows\System\MisNKnG.exe
  C:\Windows\System\MisNKnG.exe
  2⤵
  - Executes dropped EXE
  PID:1528
- C:\Windows\System\JoUsEsm.exe
  C:\Windows\System\JoUsEsm.exe
  2⤵
  - Executes dropped EXE
  PID:4280
- C:\Windows\System\NGUtrsL.exe
  C:\Windows\System\NGUtrsL.exe
  2⤵
  - Executes dropped EXE
  PID:4068
- C:\Windows\System\patXPQQ.exe
  C:\Windows\System\patXPQQ.exe
  2⤵
  - Executes dropped EXE
  PID:4592
- C:\Windows\System\rfQSMFU.exe
  C:\Windows\System\rfQSMFU.exe
  2⤵
  - Executes dropped EXE
  PID:4012
- C:\Windows\System\jWPyjmI.exe
  C:\Windows\System\jWPyjmI.exe
  2⤵
  - Executes dropped EXE
  PID:4120
- C:\Windows\System\sddfqel.exe
  C:\Windows\System\sddfqel.exe
  2⤵
  - Executes dropped EXE
  PID:1648
- C:\Windows\System\pMvnRaK.exe
  C:\Windows\System\pMvnRaK.exe
  2⤵
  - Executes dropped EXE
  PID:2652
- C:\Windows\System\KctRhOI.exe
  C:\Windows\System\KctRhOI.exe
  2⤵
  - Executes dropped EXE
  PID:3868
- C:\Windows\System\toeCaPV.exe
  C:\Windows\System\toeCaPV.exe
  2⤵
  - Executes dropped EXE
  PID:5068
- C:\Windows\System\JTVSPTu.exe
  C:\Windows\System\JTVSPTu.exe
  2⤵
  - Executes dropped EXE
  PID:5008
- C:\Windows\System\QHIJrRV.exe
  C:\Windows\System\QHIJrRV.exe
  2⤵
  PID:2668
- C:\Windows\System\XhGqOPu.exe
  C:\Windows\System\XhGqOPu.exe
  2⤵
  PID:3536
- C:\Windows\System\ipZWKgm.exe
  C:\Windows\System\ipZWKgm.exe
  2⤵
  PID:684
- C:\Windows\System\LlJYhYV.exe
  C:\Windows\System\LlJYhYV.exe
  2⤵
  PID:5100
- C:\Windows\System\ZJGAIJG.exe
  C:\Windows\System\ZJGAIJG.exe
  2⤵
  PID:3484
- C:\Windows\System\gNPssNJ.exe
  C:\Windows\System\gNPssNJ.exe
  2⤵
  PID:4988
- C:\Windows\System\FpXokmA.exe
  C:\Windows\System\FpXokmA.exe
  2⤵
  PID:3856
- C:\Windows\System\lsGVyKx.exe
  C:\Windows\System\lsGVyKx.exe
  2⤵
  PID:428
- C:\Windows\System\KYJoEkx.exe
  C:\Windows\System\KYJoEkx.exe
  2⤵
  PID:4020
- C:\Windows\System\MrIKSyr.exe
  C:\Windows\System\MrIKSyr.exe
  2⤵
  PID:5056
- C:\Windows\System\dYFGYwu.exe
  C:\Windows\System\dYFGYwu.exe
  2⤵
  PID:4516
- C:\Windows\System\swHFCQT.exe
  C:\Windows\System\swHFCQT.exe
  2⤵
  PID:1924
- C:\Windows\System\JFpdHlp.exe
  C:\Windows\System\JFpdHlp.exe
  2⤵
  PID:1228
- C:\Windows\System\MgfkTud.exe
  C:\Windows\System\MgfkTud.exe
  2⤵
  PID:3716
- C:\Windows\System\YYrRNpq.exe
  C:\Windows\System\YYrRNpq.exe
  2⤵
  PID:2748
- C:\Windows\System\kTTdbJN.exe
  C:\Windows\System\kTTdbJN.exe
  2⤵
  PID:2432
- C:\Windows\System\UrgBaQQ.exe
  C:\Windows\System\UrgBaQQ.exe
  2⤵
  PID:1380
- C:\Windows\System\NcURoXX.exe
  C:\Windows\System\NcURoXX.exe
  2⤵
  PID:1784
- C:\Windows\System\WcFVaMY.exe
  C:\Windows\System\WcFVaMY.exe
  2⤵
  PID:2092
- C:\Windows\System\NsqcYHV.exe
  C:\Windows\System\NsqcYHV.exe
  2⤵
  PID:2876
- C:\Windows\System\FxZbHVq.exe
  C:\Windows\System\FxZbHVq.exe
  2⤵
  PID:4752
- C:\Windows\System\ynhDEWm.exe
  C:\Windows\System\ynhDEWm.exe
  2⤵
  PID:1180
- C:\Windows\System\cpipJOA.exe
  C:\Windows\System\cpipJOA.exe
  2⤵
  PID:868
- C:\Windows\System\QMzuTea.exe
  C:\Windows\System\QMzuTea.exe
  2⤵
  PID:5124
- C:\Windows\System\ioIEyoE.exe
  C:\Windows\System\ioIEyoE.exe
  2⤵
  PID:5148
- C:\Windows\System\tjGyhBQ.exe
  C:\Windows\System\tjGyhBQ.exe
  2⤵
  PID:5180
- C:\Windows\System\LMGTusy.exe
  C:\Windows\System\LMGTusy.exe
  2⤵
  PID:5208
- C:\Windows\System\XxNQcTT.exe
  C:\Windows\System\XxNQcTT.exe
  2⤵
  PID:5236
- C:\Windows\System\lsESGJm.exe
  C:\Windows\System\lsESGJm.exe
  2⤵
  PID:5260
- C:\Windows\System\CXUFEAm.exe
  C:\Windows\System\CXUFEAm.exe
  2⤵
  PID:5292
- C:\Windows\System\hIavIWc.exe
  C:\Windows\System\hIavIWc.exe
  2⤵
  PID:5320
- C:\Windows\System\BjUxlmY.exe
  C:\Windows\System\BjUxlmY.exe
  2⤵
  PID:5348
- C:\Windows\System\yMokvAU.exe
  C:\Windows\System\yMokvAU.exe
  2⤵
  PID:5372
- C:\Windows\System\WQEdFhT.exe
  C:\Windows\System\WQEdFhT.exe
  2⤵
  PID:5404
- C:\Windows\System\QWuNvRM.exe
  C:\Windows\System\QWuNvRM.exe
  2⤵
  PID:5432
- C:\Windows\System\EaLNlNG.exe
  C:\Windows\System\EaLNlNG.exe
  2⤵
  PID:5460
- C:\Windows\System\oImjlYP.exe
  C:\Windows\System\oImjlYP.exe
  2⤵
  PID:5484
- C:\Windows\System\EeCONmh.exe
  C:\Windows\System\EeCONmh.exe
  2⤵
  PID:5516
- C:\Windows\System\YLaaIwE.exe
  C:\Windows\System\YLaaIwE.exe
  2⤵
  PID:5544
- C:\Windows\System\jLXtDnz.exe
  C:\Windows\System\jLXtDnz.exe
  2⤵
  PID:5616
- C:\Windows\System\PcQzCMP.exe
  C:\Windows\System\PcQzCMP.exe
  2⤵
  PID:5632
- C:\Windows\System\hHIwFMy.exe
  C:\Windows\System\hHIwFMy.exe
  2⤵
  PID:5648
- C:\Windows\System\xzlXLFc.exe
  C:\Windows\System\xzlXLFc.exe
  2⤵
  PID:5664
- C:\Windows\System\ZCSCeyl.exe
  C:\Windows\System\ZCSCeyl.exe
  2⤵
  PID:5692
- C:\Windows\System\tAVCsVe.exe
  C:\Windows\System\tAVCsVe.exe
  2⤵
  PID:5716
- C:\Windows\System\tadhfFL.exe
  C:\Windows\System\tadhfFL.exe
  2⤵
  PID:5748
- C:\Windows\System\TbbZBNL.exe
  C:\Windows\System\TbbZBNL.exe
  2⤵
  PID:5772
- C:\Windows\System\GNetaZY.exe
  C:\Windows\System\GNetaZY.exe
  2⤵
  PID:5800
- C:\Windows\System\ptYmXkb.exe
  C:\Windows\System\ptYmXkb.exe
  2⤵
  PID:5828
- C:\Windows\System\trKbgja.exe
  C:\Windows\System\trKbgja.exe
  2⤵
  PID:5860
- C:\Windows\System\eaUclAF.exe
  C:\Windows\System\eaUclAF.exe
  2⤵
  PID:5884
- C:\Windows\System\iHhZKcb.exe
  C:\Windows\System\iHhZKcb.exe
  2⤵
  PID:5944
- C:\Windows\System\cylFVnk.exe
  C:\Windows\System\cylFVnk.exe
  2⤵
  PID:5992
- C:\Windows\System\XqQvzXT.exe
  C:\Windows\System\XqQvzXT.exe
  2⤵
  PID:6012
- C:\Windows\System\xTxEHOB.exe
  C:\Windows\System\xTxEHOB.exe
  2⤵
  PID:6048
- C:\Windows\System\HzMuRpm.exe
  C:\Windows\System\HzMuRpm.exe
  2⤵
  PID:6076
- C:\Windows\System\QulGVJZ.exe
  C:\Windows\System\QulGVJZ.exe
  2⤵
  PID:6104
- C:\Windows\System\WbSTzdw.exe
  C:\Windows\System\WbSTzdw.exe
  2⤵
  PID:6132
- C:\Windows\System\HrgHHNx.exe
  C:\Windows\System\HrgHHNx.exe
  2⤵
  PID:2644
- C:\Windows\System\QtSJDOx.exe
  C:\Windows\System\QtSJDOx.exe
  2⤵
  PID:4236
- C:\Windows\System\DihOkIs.exe
  C:\Windows\System\DihOkIs.exe
  2⤵
  PID:5032
- C:\Windows\System\fhtXiFS.exe
  C:\Windows\System\fhtXiFS.exe
  2⤵
  PID:3100
- C:\Windows\System\jpVKaOF.exe
  C:\Windows\System\jpVKaOF.exe
  2⤵
  PID:4076
- C:\Windows\System\pPbVMhw.exe
  C:\Windows\System\pPbVMhw.exe
  2⤵
  PID:4144
- C:\Windows\System\hQNknJF.exe
  C:\Windows\System\hQNknJF.exe
  2⤵
  PID:5196
- C:\Windows\System\QwHbmwp.exe
  C:\Windows\System\QwHbmwp.exe
  2⤵
  PID:5252
- C:\Windows\System\hMyWfHX.exe
  C:\Windows\System\hMyWfHX.exe
  2⤵
  PID:5312
- C:\Windows\System\CEMUcuY.exe
  C:\Windows\System\CEMUcuY.exe
  2⤵
  PID:5356
- C:\Windows\System\tkyeAfg.exe
  C:\Windows\System\tkyeAfg.exe
  2⤵
  PID:1464
- C:\Windows\System\ckhmHgf.exe
  C:\Windows\System\ckhmHgf.exe
  2⤵
  PID:1460
- C:\Windows\System\usIxvRh.exe
  C:\Windows\System\usIxvRh.exe
  2⤵
  PID:4328
- C:\Windows\System\vhQKVMn.exe
  C:\Windows\System\vhQKVMn.exe
  2⤵
  PID:5524
- C:\Windows\System\edktFGw.exe
  C:\Windows\System\edktFGw.exe
  2⤵
  PID:5584
- C:\Windows\System\nYMRbUu.exe
  C:\Windows\System\nYMRbUu.exe
  2⤵
  PID:5624
- C:\Windows\System\liFNTvH.exe
  C:\Windows\System\liFNTvH.exe
  2⤵
  PID:5660
- C:\Windows\System\SHgcwAc.exe
  C:\Windows\System\SHgcwAc.exe
  2⤵
  PID:5684
- C:\Windows\System\KaYZzHT.exe
  C:\Windows\System\KaYZzHT.exe
  2⤵
  PID:5760
- C:\Windows\System\JRXQcNR.exe
  C:\Windows\System\JRXQcNR.exe
  2⤵
  PID:3688
- C:\Windows\System\yAkVvzo.exe
  C:\Windows\System\yAkVvzo.exe
  2⤵
  PID:5816
- C:\Windows\System\tQJohqx.exe
  C:\Windows\System\tQJohqx.exe
  2⤵
  PID:5852
- C:\Windows\System\IpCviOW.exe
  C:\Windows\System\IpCviOW.exe
  2⤵
  PID:916
- C:\Windows\System\PhEtkCc.exe
  C:\Windows\System\PhEtkCc.exe
  2⤵
  PID:1520
- C:\Windows\System\gKDqZfh.exe
  C:\Windows\System\gKDqZfh.exe
  2⤵
  PID:5960
- C:\Windows\System\RFYsLIV.exe
  C:\Windows\System\RFYsLIV.exe
  2⤵
  PID:2704
- C:\Windows\System\UNYqeEp.exe
  C:\Windows\System\UNYqeEp.exe
  2⤵
  PID:6004
- C:\Windows\System\sTIYAfT.exe
  C:\Windows\System\sTIYAfT.exe
  2⤵
  PID:6040
- C:\Windows\System\dagdCbJ.exe
  C:\Windows\System\dagdCbJ.exe
  2⤵
  PID:6100
- C:\Windows\System\eWPLRmq.exe
  C:\Windows\System\eWPLRmq.exe
  2⤵
  PID:4924
- C:\Windows\System\KvZxydz.exe
  C:\Windows\System\KvZxydz.exe
  2⤵
  PID:5144
- C:\Windows\System\avvViCG.exe
  C:\Windows\System\avvViCG.exe
  2⤵
  PID:2832
- C:\Windows\System\JsazAne.exe
  C:\Windows\System\JsazAne.exe
  2⤵
  PID:1072
- C:\Windows\System\kKvfbft.exe
  C:\Windows\System\kKvfbft.exe
  2⤵
  PID:3448
- C:\Windows\System\baRdaqx.exe
  C:\Windows\System\baRdaqx.exe
  2⤵
  PID:5540
- C:\Windows\System\TXJNvWS.exe
  C:\Windows\System\TXJNvWS.exe
  2⤵
  PID:5572
- C:\Windows\System\SlPmsah.exe
  C:\Windows\System\SlPmsah.exe
  2⤵
  PID:5644
- C:\Windows\System\GakqVgs.exe
  C:\Windows\System\GakqVgs.exe
  2⤵
  PID:3084
- C:\Windows\System\qhRdaik.exe
  C:\Windows\System\qhRdaik.exe
  2⤵
  PID:2376
- C:\Windows\System\qlBGRNT.exe
  C:\Windows\System\qlBGRNT.exe
  2⤵
  PID:4256
- C:\Windows\System\yajhNOC.exe
  C:\Windows\System\yajhNOC.exe
  2⤵
  PID:3664
- C:\Windows\System\OCxIIgE.exe
  C:\Windows\System\OCxIIgE.exe
  2⤵
  PID:3164
- C:\Windows\System\dewSsCt.exe
  C:\Windows\System\dewSsCt.exe
  2⤵
  PID:3900
- C:\Windows\System\KyIkkHX.exe
  C:\Windows\System\KyIkkHX.exe
  2⤵
  PID:5564
- C:\Windows\System\xgUvQGO.exe
  C:\Windows\System\xgUvQGO.exe
  2⤵
  PID:3684
- C:\Windows\System\EWcnGza.exe
  C:\Windows\System\EWcnGza.exe
  2⤵
  PID:832
- C:\Windows\System\cHMptVI.exe
  C:\Windows\System\cHMptVI.exe
  2⤵
  PID:1680
- C:\Windows\System\hznyVNo.exe
  C:\Windows\System\hznyVNo.exe
  2⤵
  PID:6072
- C:\Windows\System\HkyMMSN.exe
  C:\Windows\System\HkyMMSN.exe
  2⤵
  PID:6148
- C:\Windows\System\jAEDVOx.exe
  C:\Windows\System\jAEDVOx.exe
  2⤵
  PID:6176
- C:\Windows\System\KSoupWF.exe
  C:\Windows\System\KSoupWF.exe
  2⤵
  PID:6204
- C:\Windows\System\XuZthUF.exe
  C:\Windows\System\XuZthUF.exe
  2⤵
  PID:6244
- C:\Windows\System\QjTpAAl.exe
  C:\Windows\System\QjTpAAl.exe
  2⤵
  PID:6260
- C:\Windows\System\JOCqiiz.exe
  C:\Windows\System\JOCqiiz.exe
  2⤵
  PID:6288
- C:\Windows\System\HfVqDLi.exe
  C:\Windows\System\HfVqDLi.exe
  2⤵
  PID:6316
- C:\Windows\System\idjHQJY.exe
  C:\Windows\System\idjHQJY.exe
  2⤵
  PID:6344
- C:\Windows\System\DBOcMhH.exe
  C:\Windows\System\DBOcMhH.exe
  2⤵
  PID:6372
- C:\Windows\System\gCBglva.exe
  C:\Windows\System\gCBglva.exe
  2⤵
  PID:6396
- C:\Windows\System\JFaCyTj.exe
  C:\Windows\System\JFaCyTj.exe
  2⤵
  PID:6424
- C:\Windows\System\oTeTbFz.exe
  C:\Windows\System\oTeTbFz.exe
  2⤵
  PID:6456
- C:\Windows\System\WKoAxjf.exe
  C:\Windows\System\WKoAxjf.exe
  2⤵
  PID:6496
- C:\Windows\System\ZaFmLcS.exe
  C:\Windows\System\ZaFmLcS.exe
  2⤵
  PID:6524
- C:\Windows\System\ZrvLhFq.exe
  C:\Windows\System\ZrvLhFq.exe
  2⤵
  PID:6544
- C:\Windows\System\dCxcnyV.exe
  C:\Windows\System\dCxcnyV.exe
  2⤵
  PID:6568
- C:\Windows\System\rnmpMMw.exe
  C:\Windows\System\rnmpMMw.exe
  2⤵
  PID:6608
- C:\Windows\System\OdxcMpI.exe
  C:\Windows\System\OdxcMpI.exe
  2⤵
  PID:6624
- C:\Windows\System\YdilEPI.exe
  C:\Windows\System\YdilEPI.exe
  2⤵
  PID:6660
- C:\Windows\System\ozfrOzk.exe
  C:\Windows\System\ozfrOzk.exe
  2⤵
  PID:6680
- C:\Windows\System\amhQJXK.exe
  C:\Windows\System\amhQJXK.exe
  2⤵
  PID:6708
- C:\Windows\System\vAhIWro.exe
  C:\Windows\System\vAhIWro.exe
  2⤵
  PID:6752
- C:\Windows\System\MOYkJIh.exe
  C:\Windows\System\MOYkJIh.exe
  2⤵
  PID:6776
- C:\Windows\System\ASFETGq.exe
  C:\Windows\System\ASFETGq.exe
  2⤵
  PID:6792
- C:\Windows\System\rljZCGy.exe
  C:\Windows\System\rljZCGy.exe
  2⤵
  PID:6820
- C:\Windows\System\fXllwiL.exe
  C:\Windows\System\fXllwiL.exe
  2⤵
  PID:6848
- C:\Windows\System\AFPzxVN.exe
  C:\Windows\System\AFPzxVN.exe
  2⤵
  PID:6876
- C:\Windows\System\RHqPdiw.exe
  C:\Windows\System\RHqPdiw.exe
  2⤵
  PID:6900
- C:\Windows\System\BnynlWB.exe
  C:\Windows\System\BnynlWB.exe
  2⤵
  PID:6932
- C:\Windows\System\vBZPUCk.exe
  C:\Windows\System\vBZPUCk.exe
  2⤵
  PID:6960
- C:\Windows\System\YKVnaOb.exe
  C:\Windows\System\YKVnaOb.exe
  2⤵
  PID:6988
- C:\Windows\System\xIREWdo.exe
  C:\Windows\System\xIREWdo.exe
  2⤵
  PID:7004
- C:\Windows\System\UGVcqom.exe
  C:\Windows\System\UGVcqom.exe
  2⤵
  PID:7032
- C:\Windows\System\tXbZdce.exe
  C:\Windows\System\tXbZdce.exe
  2⤵
  PID:7076
- C:\Windows\System\dmylJyr.exe
  C:\Windows\System\dmylJyr.exe
  2⤵
  PID:7108
- C:\Windows\System\HjwpXgl.exe
  C:\Windows\System\HjwpXgl.exe
  2⤵
  PID:7132
- C:\Windows\System\VRvrdQq.exe
  C:\Windows\System\VRvrdQq.exe
  2⤵
  PID:7156
- C:\Windows\System\mlXXfQX.exe
  C:\Windows\System\mlXXfQX.exe
  2⤵
  PID:6160
- C:\Windows\System\qkyqWbt.exe
  C:\Windows\System\qkyqWbt.exe
  2⤵
  PID:6252
- C:\Windows\System\fNtIcTv.exe
  C:\Windows\System\fNtIcTv.exe
  2⤵
  PID:6300
- C:\Windows\System\ITtuwqU.exe
  C:\Windows\System\ITtuwqU.exe
  2⤵
  PID:6368
- C:\Windows\System\uUoWEEk.exe
  C:\Windows\System\uUoWEEk.exe
  2⤵
  PID:6448
- C:\Windows\System\XrepxHm.exe
  C:\Windows\System\XrepxHm.exe
  2⤵
  PID:6520
- C:\Windows\System\jQRuPqM.exe
  C:\Windows\System\jQRuPqM.exe
  2⤵
  PID:6588
- C:\Windows\System\CrICVrp.exe
  C:\Windows\System\CrICVrp.exe
  2⤵
  PID:6672
- C:\Windows\System\QPQTsmg.exe
  C:\Windows\System\QPQTsmg.exe
  2⤵
  PID:6720
- C:\Windows\System\LuUzMkj.exe
  C:\Windows\System\LuUzMkj.exe
  2⤵
  PID:6788
- C:\Windows\System\OpYkBbn.exe
  C:\Windows\System\OpYkBbn.exe
  2⤵
  PID:6868
- C:\Windows\System\uHqtYfv.exe
  C:\Windows\System\uHqtYfv.exe
  2⤵
  PID:6892
- C:\Windows\System\LxgLaty.exe
  C:\Windows\System\LxgLaty.exe
  2⤵
  PID:6924
- C:\Windows\System\vbWQiLG.exe
  C:\Windows\System\vbWQiLG.exe
  2⤵
  PID:6980
- C:\Windows\System\lfkBMTy.exe
  C:\Windows\System\lfkBMTy.exe
  2⤵
  PID:7048
- C:\Windows\System\jfeLmwK.exe
  C:\Windows\System\jfeLmwK.exe
  2⤵
  PID:6044
- C:\Windows\System\rncjiPn.exe
  C:\Windows\System\rncjiPn.exe
  2⤵
  PID:6272
- C:\Windows\System\ojbBwmc.exe
  C:\Windows\System\ojbBwmc.exe
  2⤵
  PID:6388
- C:\Windows\System\xQbvDNa.exe
  C:\Windows\System\xQbvDNa.exe
  2⤵
  PID:6636
- C:\Windows\System\jBYkQrX.exe
  C:\Windows\System\jBYkQrX.exe
  2⤵
  PID:6888
- C:\Windows\System\xdBQDVT.exe
  C:\Windows\System\xdBQDVT.exe
  2⤵
  PID:6860
- C:\Windows\System\mPHJkVZ.exe
  C:\Windows\System\mPHJkVZ.exe
  2⤵
  PID:1744
- C:\Windows\System\dOXLGCM.exe
  C:\Windows\System\dOXLGCM.exe
  2⤵
  PID:6488
- C:\Windows\System\wxcXomF.exe
  C:\Windows\System\wxcXomF.exe
  2⤵
  PID:6916
- C:\Windows\System\ASyMTUw.exe
  C:\Windows\System\ASyMTUw.exe
  2⤵
  PID:6336
- C:\Windows\System\rOHIUtF.exe
  C:\Windows\System\rOHIUtF.exe
  2⤵
  PID:6996
- C:\Windows\System\tSmaagN.exe
  C:\Windows\System\tSmaagN.exe
  2⤵
  PID:7176
- C:\Windows\System\UQEJCqv.exe
  C:\Windows\System\UQEJCqv.exe
  2⤵
  PID:7196
- C:\Windows\System\rCgkfFA.exe
  C:\Windows\System\rCgkfFA.exe
  2⤵
  PID:7220
- C:\Windows\System\FeKWTvV.exe
  C:\Windows\System\FeKWTvV.exe
  2⤵
  PID:7240
- C:\Windows\System\mOAXiSL.exe
  C:\Windows\System\mOAXiSL.exe
  2⤵
  PID:7264
- C:\Windows\System\OwUGhnb.exe
  C:\Windows\System\OwUGhnb.exe
  2⤵
  PID:7292
- C:\Windows\System\vGaTzkp.exe
  C:\Windows\System\vGaTzkp.exe
  2⤵
  PID:7344
- C:\Windows\System\TbMkaVd.exe
  C:\Windows\System\TbMkaVd.exe
  2⤵
  PID:7360
- C:\Windows\System\ayLOFLE.exe
  C:\Windows\System\ayLOFLE.exe
  2⤵
  PID:7388
- C:\Windows\System\TXwsNuL.exe
  C:\Windows\System\TXwsNuL.exe
  2⤵
  PID:7412
- C:\Windows\System\kdkgyUO.exe
  C:\Windows\System\kdkgyUO.exe
  2⤵
  PID:7456
- C:\Windows\System\maefUbn.exe
  C:\Windows\System\maefUbn.exe
  2⤵
  PID:7472
- C:\Windows\System\FMSliKU.exe
  C:\Windows\System\FMSliKU.exe
  2⤵
  PID:7500
- C:\Windows\System\RJBrCmm.exe
  C:\Windows\System\RJBrCmm.exe
  2⤵
  PID:7524
- C:\Windows\System\OpBuLOV.exe
  C:\Windows\System\OpBuLOV.exe
  2⤵
  PID:7556
- C:\Windows\System\mJLyRjo.exe
  C:\Windows\System\mJLyRjo.exe
  2⤵
  PID:7584
- C:\Windows\System\ecgtIHQ.exe
  C:\Windows\System\ecgtIHQ.exe
  2⤵
  PID:7620
- C:\Windows\System\uRUVrAd.exe
  C:\Windows\System\uRUVrAd.exe
  2⤵
  PID:7640
- C:\Windows\System\RSLxkij.exe
  C:\Windows\System\RSLxkij.exe
  2⤵
  PID:7680
- C:\Windows\System\AQHrpCD.exe
  C:\Windows\System\AQHrpCD.exe
  2⤵
  PID:7708
- C:\Windows\System\miDQVXe.exe
  C:\Windows\System\miDQVXe.exe
  2⤵
  PID:7724
- C:\Windows\System\uMLXHDr.exe
  C:\Windows\System\uMLXHDr.exe
  2⤵
  PID:7764
- C:\Windows\System\RZArGvy.exe
  C:\Windows\System\RZArGvy.exe
  2⤵
  PID:7784
- C:\Windows\System\gsNzzdp.exe
  C:\Windows\System\gsNzzdp.exe
  2⤵
  PID:7808
- C:\Windows\System\PXnYdZS.exe
  C:\Windows\System\PXnYdZS.exe
  2⤵
  PID:7840
- C:\Windows\System\rNAwBhM.exe
  C:\Windows\System\rNAwBhM.exe
  2⤵
  PID:7868
- C:\Windows\System\lzpwORh.exe
  C:\Windows\System\lzpwORh.exe
  2⤵
  PID:7896
- C:\Windows\System\mdnPUpA.exe
  C:\Windows\System\mdnPUpA.exe
  2⤵
  PID:7912
- C:\Windows\System\mgYpLzy.exe
  C:\Windows\System\mgYpLzy.exe
  2⤵
  PID:7936
- C:\Windows\System\IfjvCym.exe
  C:\Windows\System\IfjvCym.exe
  2⤵
  PID:7960
- C:\Windows\System\DfLMxVK.exe
  C:\Windows\System\DfLMxVK.exe
  2⤵
  PID:7984
- C:\Windows\System\XoxfqRP.exe
  C:\Windows\System\XoxfqRP.exe
  2⤵
  PID:8008
- C:\Windows\System\OqKjFYs.exe
  C:\Windows\System\OqKjFYs.exe
  2⤵
  PID:8044
- C:\Windows\System\ztRvHtE.exe
  C:\Windows\System\ztRvHtE.exe
  2⤵
  PID:8100
- C:\Windows\System\tQwgROP.exe
  C:\Windows\System\tQwgROP.exe
  2⤵
  PID:8120
- C:\Windows\System\wggIHVF.exe
  C:\Windows\System\wggIHVF.exe
  2⤵
  PID:8136
- C:\Windows\System\XeAEWtd.exe
  C:\Windows\System\XeAEWtd.exe
  2⤵
  PID:8160
- C:\Windows\System\mGkXCwo.exe
  C:\Windows\System\mGkXCwo.exe
  2⤵
  PID:7188
- C:\Windows\System\popeHGo.exe
  C:\Windows\System\popeHGo.exe
  2⤵
  PID:7184
- C:\Windows\System\Enwqkmt.exe
  C:\Windows\System\Enwqkmt.exe
  2⤵
  PID:7340
- C:\Windows\System\fXaMSvY.exe
  C:\Windows\System\fXaMSvY.exe
  2⤵
  PID:7408
- C:\Windows\System\kWzmNOp.exe
  C:\Windows\System\kWzmNOp.exe
  2⤵
  PID:7464
- C:\Windows\System\UzeaZOk.exe
  C:\Windows\System\UzeaZOk.exe
  2⤵
  PID:7492
- C:\Windows\System\NvdbScK.exe
  C:\Windows\System\NvdbScK.exe
  2⤵
  PID:7572
- C:\Windows\System\bCkrClR.exe
  C:\Windows\System\bCkrClR.exe
  2⤵
  PID:7636
- C:\Windows\System\hZDWkOq.exe
  C:\Windows\System\hZDWkOq.exe
  2⤵
  PID:7676
- C:\Windows\System\ZLofAkA.exe
  C:\Windows\System\ZLofAkA.exe
  2⤵
  PID:7740
- C:\Windows\System\myNSGia.exe
  C:\Windows\System\myNSGia.exe
  2⤵
  PID:7800
- C:\Windows\System\JKZvJUt.exe
  C:\Windows\System\JKZvJUt.exe
  2⤵
  PID:7884
- C:\Windows\System\ONOARnL.exe
  C:\Windows\System\ONOARnL.exe
  2⤵
  PID:7944
- C:\Windows\System\KMqdABI.exe
  C:\Windows\System\KMqdABI.exe
  2⤵
  PID:7980
- C:\Windows\System\LzMigFW.exe
  C:\Windows\System\LzMigFW.exe
  2⤵
  PID:8108
- C:\Windows\System\QgNIJna.exe
  C:\Windows\System\QgNIJna.exe
  2⤵
  PID:7216
- C:\Windows\System\KhsJsNb.exe
  C:\Windows\System\KhsJsNb.exe
  2⤵
  PID:7312
- C:\Windows\System\ymMjQyk.exe
  C:\Windows\System\ymMjQyk.exe
  2⤵
  PID:7520
- C:\Windows\System\CiDSqxI.exe
  C:\Windows\System\CiDSqxI.exe
  2⤵
  PID:7632
- C:\Windows\System\sOVbeiW.exe
  C:\Windows\System\sOVbeiW.exe
  2⤵
  PID:7720
- C:\Windows\System\ouuvMxZ.exe
  C:\Windows\System\ouuvMxZ.exe
  2⤵
  PID:7856
- C:\Windows\System\GWQetNy.exe
  C:\Windows\System\GWQetNy.exe
  2⤵
  PID:8068
- C:\Windows\System\ZixzxRz.exe
  C:\Windows\System\ZixzxRz.exe
  2⤵
  PID:7320
- C:\Windows\System\FSpEUcu.exe
  C:\Windows\System\FSpEUcu.exe
  2⤵
  PID:7628
- C:\Windows\System\JfqXuNY.exe
  C:\Windows\System\JfqXuNY.exe
  2⤵
  PID:7976
- C:\Windows\System\MeDtIVf.exe
  C:\Windows\System\MeDtIVf.exe
  2⤵
  PID:7512
- C:\Windows\System\ymDBVvD.exe
  C:\Windows\System\ymDBVvD.exe
  2⤵
  PID:7384
- C:\Windows\System\bHRvIWI.exe
  C:\Windows\System\bHRvIWI.exe
  2⤵
  PID:8212
- C:\Windows\System\kSqeZIs.exe
  C:\Windows\System\kSqeZIs.exe
  2⤵
  PID:8248
- C:\Windows\System\gdyQFqY.exe
  C:\Windows\System\gdyQFqY.exe
  2⤵
  PID:8276
- C:\Windows\System\jaAtuVU.exe
  C:\Windows\System\jaAtuVU.exe
  2⤵
  PID:8300
- C:\Windows\System\WDYXPyp.exe
  C:\Windows\System\WDYXPyp.exe
  2⤵
  PID:8320
- C:\Windows\System\JikMCLx.exe
  C:\Windows\System\JikMCLx.exe
  2⤵
  PID:8340
- C:\Windows\System\MMbDqHs.exe
  C:\Windows\System\MMbDqHs.exe
  2⤵
  PID:8368
- C:\Windows\System\MORkQRE.exe
  C:\Windows\System\MORkQRE.exe
  2⤵
  PID:8396
- C:\Windows\System\ySAdvTW.exe
  C:\Windows\System\ySAdvTW.exe
  2⤵
  PID:8432
- C:\Windows\System\GEvUuRl.exe
  C:\Windows\System\GEvUuRl.exe
  2⤵
  PID:8460
- C:\Windows\System\QYJvPwq.exe
  C:\Windows\System\QYJvPwq.exe
  2⤵
  PID:8508
- C:\Windows\System\BmnnDvS.exe
  C:\Windows\System\BmnnDvS.exe
  2⤵
  PID:8536
- C:\Windows\System\sycYkql.exe
  C:\Windows\System\sycYkql.exe
  2⤵
  PID:8552
- C:\Windows\System\YypbyMt.exe
  C:\Windows\System\YypbyMt.exe
  2⤵
  PID:8592
- C:\Windows\System\zyGmvqm.exe
  C:\Windows\System\zyGmvqm.exe
  2⤵
  PID:8608
- C:\Windows\System\Bfhzpkd.exe
  C:\Windows\System\Bfhzpkd.exe
  2⤵
  PID:8648
- C:\Windows\System\WkDpLpW.exe
  C:\Windows\System\WkDpLpW.exe
  2⤵
  PID:8664
- C:\Windows\System\guqKGAY.exe
  C:\Windows\System\guqKGAY.exe
  2⤵
  PID:8692
- C:\Windows\System\xzmMrCT.exe
  C:\Windows\System\xzmMrCT.exe
  2⤵
  PID:8720
- C:\Windows\System\fNZNTOn.exe
  C:\Windows\System\fNZNTOn.exe
  2⤵
  PID:8760
- C:\Windows\System\GppHHyo.exe
  C:\Windows\System\GppHHyo.exe
  2⤵
  PID:8776
- C:\Windows\System\LTgMhdM.exe
  C:\Windows\System\LTgMhdM.exe
  2⤵
  PID:8796
- C:\Windows\System\GkWhyqm.exe
  C:\Windows\System\GkWhyqm.exe
  2⤵
  PID:8824
- C:\Windows\System\uTtbsJF.exe
  C:\Windows\System\uTtbsJF.exe
  2⤵
  PID:8860
- C:\Windows\System\dyBExAv.exe
  C:\Windows\System\dyBExAv.exe
  2⤵
  PID:8876
- C:\Windows\System\jHZbiqz.exe
  C:\Windows\System\jHZbiqz.exe
  2⤵
  PID:8892
- C:\Windows\System\MsuNzfM.exe
  C:\Windows\System\MsuNzfM.exe
  2⤵
  PID:8916
- C:\Windows\System\zfwYPEd.exe
  C:\Windows\System\zfwYPEd.exe
  2⤵
  PID:8976
- C:\Windows\System\tBJcIeQ.exe
  C:\Windows\System\tBJcIeQ.exe
  2⤵
  PID:9012
- C:\Windows\System\ZTmwNgL.exe
  C:\Windows\System\ZTmwNgL.exe
  2⤵
  PID:9040
- C:\Windows\System\urkljRH.exe
  C:\Windows\System\urkljRH.exe
  2⤵
  PID:9068
- C:\Windows\System\HmGpRni.exe
  C:\Windows\System\HmGpRni.exe
  2⤵
  PID:9096
- C:\Windows\System\eKbxKjG.exe
  C:\Windows\System\eKbxKjG.exe
  2⤵
  PID:9112
- C:\Windows\System\MWplkmH.exe
  C:\Windows\System\MWplkmH.exe
  2⤵
  PID:9152
- C:\Windows\System\qCXAkup.exe
  C:\Windows\System\qCXAkup.exe
  2⤵
  PID:9180
- C:\Windows\System\qMnDetd.exe
  C:\Windows\System\qMnDetd.exe
  2⤵
  PID:9208
- C:\Windows\System\sBxNcVx.exe
  C:\Windows\System\sBxNcVx.exe
  2⤵
  PID:8224
- C:\Windows\System\PAHFyuW.exe
  C:\Windows\System\PAHFyuW.exe
  2⤵
  PID:8268
- C:\Windows\System\kycoAdv.exe
  C:\Windows\System\kycoAdv.exe
  2⤵
  PID:8336
- C:\Windows\System\nIcVqvs.exe
  C:\Windows\System\nIcVqvs.exe
  2⤵
  PID:8388
- C:\Windows\System\iILjYNP.exe
  C:\Windows\System\iILjYNP.exe
  2⤵
  PID:8448
- C:\Windows\System\jQCBTik.exe
  C:\Windows\System\jQCBTik.exe
  2⤵
  PID:8532
- C:\Windows\System\HPyPygk.exe
  C:\Windows\System\HPyPygk.exe
  2⤵
  PID:8604
- C:\Windows\System\KXMWodD.exe
  C:\Windows\System\KXMWodD.exe
  2⤵
  PID:8676
- C:\Windows\System\UgdNnFm.exe
  C:\Windows\System\UgdNnFm.exe
  2⤵
  PID:8740
- C:\Windows\System\NMHjJjL.exe
  C:\Windows\System\NMHjJjL.exe
  2⤵
  PID:8812
- C:\Windows\System\INpORtC.exe
  C:\Windows\System\INpORtC.exe
  2⤵
  PID:8868
- C:\Windows\System\FSUHuqe.exe
  C:\Windows\System\FSUHuqe.exe
  2⤵
  PID:8952
- C:\Windows\System\nBqJyXa.exe
  C:\Windows\System\nBqJyXa.exe
  2⤵
  PID:9000
- C:\Windows\System\GZOCrYi.exe
  C:\Windows\System\GZOCrYi.exe
  2⤵
  PID:9056
- C:\Windows\System\LDHlMdR.exe
  C:\Windows\System\LDHlMdR.exe
  2⤵
  PID:9128
- C:\Windows\System\itVMGzj.exe
  C:\Windows\System\itVMGzj.exe
  2⤵
  PID:9176
- C:\Windows\System\AFYzwVf.exe
  C:\Windows\System\AFYzwVf.exe
  2⤵
  PID:9200
- C:\Windows\System\mgTpZNo.exe
  C:\Windows\System\mgTpZNo.exe
  2⤵
  PID:8440
- C:\Windows\System\IJVYTvD.exe
  C:\Windows\System\IJVYTvD.exe
  2⤵
  PID:8568
- C:\Windows\System\uleNCOU.exe
  C:\Windows\System\uleNCOU.exe
  2⤵
  PID:8684
- C:\Windows\System\CWjrGoB.exe
  C:\Windows\System\CWjrGoB.exe
  2⤵
  PID:8884
- C:\Windows\System\vZjpuky.exe
  C:\Windows\System\vZjpuky.exe
  2⤵
  PID:9004
- C:\Windows\System\fDgCBop.exe
  C:\Windows\System\fDgCBop.exe
  2⤵
  PID:9164
- C:\Windows\System\QMsVLFD.exe
  C:\Windows\System\QMsVLFD.exe
  2⤵
  PID:8380
- C:\Windows\System\mLoaMNY.exe
  C:\Windows\System\mLoaMNY.exe
  2⤵
  PID:8932
- C:\Windows\System\mCiaUvz.exe
  C:\Windows\System\mCiaUvz.exe
  2⤵
  PID:9080
- C:\Windows\System\WrNhbfZ.exe
  C:\Windows\System\WrNhbfZ.exe
  2⤵
  PID:8292
- C:\Windows\System\LDKUyIs.exe
  C:\Windows\System\LDKUyIs.exe
  2⤵
  PID:8768
- C:\Windows\System\pHEbrGV.exe
  C:\Windows\System\pHEbrGV.exe
  2⤵
  PID:9244
- C:\Windows\System\fjEKpaO.exe
  C:\Windows\System\fjEKpaO.exe
  2⤵
  PID:9304
- C:\Windows\System\OFelheX.exe
  C:\Windows\System\OFelheX.exe
  2⤵
  PID:9324
- C:\Windows\System\pwLoWbC.exe
  C:\Windows\System\pwLoWbC.exe
  2⤵
  PID:9360
- C:\Windows\System\MdHwWRo.exe
  C:\Windows\System\MdHwWRo.exe
  2⤵
  PID:9376
- C:\Windows\System\VcXFtjr.exe
  C:\Windows\System\VcXFtjr.exe
  2⤵
  PID:9408
- C:\Windows\System\IxXPteC.exe
  C:\Windows\System\IxXPteC.exe
  2⤵
  PID:9428
- C:\Windows\System\CfMVREs.exe
  C:\Windows\System\CfMVREs.exe
  2⤵
  PID:9452
- C:\Windows\System\QUJEmGu.exe
  C:\Windows\System\QUJEmGu.exe
  2⤵
  PID:9500
- C:\Windows\System\BnBnlPZ.exe
  C:\Windows\System\BnBnlPZ.exe
  2⤵
  PID:9516
- C:\Windows\System\yApDqWm.exe
  C:\Windows\System\yApDqWm.exe
  2⤵
  PID:9544
- C:\Windows\System\UxQzYZa.exe
  C:\Windows\System\UxQzYZa.exe
  2⤵
  PID:9572
- C:\Windows\System\rIQVNoG.exe
  C:\Windows\System\rIQVNoG.exe
  2⤵
  PID:9600
- C:\Windows\System\JXqFSMs.exe
  C:\Windows\System\JXqFSMs.exe
  2⤵
  PID:9616
- C:\Windows\System\ytGpdya.exe
  C:\Windows\System\ytGpdya.exe
  2⤵
  PID:9644
- C:\Windows\System\hthFHcb.exe
  C:\Windows\System\hthFHcb.exe
  2⤵
  PID:9676
- C:\Windows\System\Wfetegp.exe
  C:\Windows\System\Wfetegp.exe
  2⤵
  PID:9724
- C:\Windows\System\xdcSell.exe
  C:\Windows\System\xdcSell.exe
  2⤵
  PID:9740
- C:\Windows\System\WFoUmVj.exe
  C:\Windows\System\WFoUmVj.exe
  2⤵
  PID:9768
- C:\Windows\System\qIaLOnS.exe
  C:\Windows\System\qIaLOnS.exe
  2⤵
  PID:9808
- C:\Windows\System\GgdIIoW.exe
  C:\Windows\System\GgdIIoW.exe
  2⤵
  PID:9836
- C:\Windows\System\iOSnZuB.exe
  C:\Windows\System\iOSnZuB.exe
  2⤵
  PID:9864
- C:\Windows\System\OJRPwXo.exe
  C:\Windows\System\OJRPwXo.exe
  2⤵
  PID:9884
- C:\Windows\System\MXfsYcu.exe
  C:\Windows\System\MXfsYcu.exe
  2⤵
  PID:9908
- C:\Windows\System\usGoZUr.exe
  C:\Windows\System\usGoZUr.exe
  2⤵
  PID:9924
- C:\Windows\System\fMPVMbZ.exe
  C:\Windows\System\fMPVMbZ.exe
  2⤵
  PID:9952
- C:\Windows\System\sFCvInb.exe
  C:\Windows\System\sFCvInb.exe
  2⤵
  PID:9972
- C:\Windows\System\QBJYwNQ.exe
  C:\Windows\System\QBJYwNQ.exe
  2⤵
  PID:10008
- C:\Windows\System\xKTdUMa.exe
  C:\Windows\System\xKTdUMa.exe
  2⤵
  PID:10048
- C:\Windows\System\HsLDFuE.exe
  C:\Windows\System\HsLDFuE.exe
  2⤵
  PID:10076
- C:\Windows\System\UGaBGBZ.exe
  C:\Windows\System\UGaBGBZ.exe
  2⤵
  PID:10096
- C:\Windows\System\IdGxXXC.exe
  C:\Windows\System\IdGxXXC.exe
  2⤵
  PID:10120
- C:\Windows\System\hGsbUze.exe
  C:\Windows\System\hGsbUze.exe
  2⤵
  PID:10144
- C:\Windows\System\JiBXfZF.exe
  C:\Windows\System\JiBXfZF.exe
  2⤵
  PID:10164
- C:\Windows\System\RsIyOWX.exe
  C:\Windows\System\RsIyOWX.exe
  2⤵
  PID:10196
- C:\Windows\System\rcRePSj.exe
  C:\Windows\System\rcRePSj.exe
  2⤵
  PID:4576
- C:\Windows\System\GhZbtzR.exe
  C:\Windows\System\GhZbtzR.exe
  2⤵
  PID:9240
- C:\Windows\System\auEgync.exe
  C:\Windows\System\auEgync.exe
  2⤵
  PID:9284
- C:\Windows\System\iyOqetT.exe
  C:\Windows\System\iyOqetT.exe
  2⤵
  PID:9348
- C:\Windows\System\QsKNqMn.exe
  C:\Windows\System\QsKNqMn.exe
  2⤵
  PID:9420
- C:\Windows\System\wPMZsvE.exe
  C:\Windows\System\wPMZsvE.exe
  2⤵
  PID:9484
- C:\Windows\System\pxMNWTp.exe
  C:\Windows\System\pxMNWTp.exe
  2⤵
  PID:9536
- C:\Windows\System\QTwqlTo.exe
  C:\Windows\System\QTwqlTo.exe
  2⤵
  PID:9652
- C:\Windows\System\GcjIjmP.exe
  C:\Windows\System\GcjIjmP.exe
  2⤵
  PID:9668
- C:\Windows\System\yDFQIRD.exe
  C:\Windows\System\yDFQIRD.exe
  2⤵
  PID:9756
- C:\Windows\System\efqxKPk.exe
  C:\Windows\System\efqxKPk.exe
  2⤵
  PID:9824
- C:\Windows\System\LCGxDAi.exe
  C:\Windows\System\LCGxDAi.exe
  2⤵
  PID:9900
- C:\Windows\System\tYByuVN.exe
  C:\Windows\System\tYByuVN.exe
  2⤵
  PID:9968
- C:\Windows\System\EAnXQFp.exe
  C:\Windows\System\EAnXQFp.exe
  2⤵
  PID:10004
- C:\Windows\System\UsigGNa.exe
  C:\Windows\System\UsigGNa.exe
  2⤵
  PID:10084
- C:\Windows\System\pIuqQub.exe
  C:\Windows\System\pIuqQub.exe
  2⤵
  PID:10116
- C:\Windows\System\beTuKin.exe
  C:\Windows\System\beTuKin.exe
  2⤵
  PID:7864
- C:\Windows\System\NXdFTGD.exe
  C:\Windows\System\NXdFTGD.exe
  2⤵
  PID:9144
- C:\Windows\System\PwVelgR.exe
  C:\Windows\System\PwVelgR.exe
  2⤵
  PID:9352
- C:\Windows\System\yeZnLDN.exe
  C:\Windows\System\yeZnLDN.exe
  2⤵
  PID:9628
- C:\Windows\System\LpvxpCJ.exe
  C:\Windows\System\LpvxpCJ.exe
  2⤵
  PID:9796
- C:\Windows\System\yapzHWe.exe
  C:\Windows\System\yapzHWe.exe
  2⤵
  PID:10064
- C:\Windows\System\CYFbQrl.exe
  C:\Windows\System\CYFbQrl.exe
  2⤵
  PID:10160
- C:\Windows\System\GUTXVis.exe
  C:\Windows\System\GUTXVis.exe
  2⤵
  PID:10224
- C:\Windows\System\GRXLuFF.exe
  C:\Windows\System\GRXLuFF.exe
  2⤵
  PID:9396
- C:\Windows\System\RVuWfEX.exe
  C:\Windows\System\RVuWfEX.exe
  2⤵
  PID:9736
- C:\Windows\System\QaUqEci.exe
  C:\Windows\System\QaUqEci.exe
  2⤵
  PID:9856
- C:\Windows\System\MgftSKZ.exe
  C:\Windows\System\MgftSKZ.exe
  2⤵
  PID:9416
- C:\Windows\System\EwGoVse.exe
  C:\Windows\System\EwGoVse.exe
  2⤵
  PID:10248
- C:\Windows\System\iGsSgKd.exe
  C:\Windows\System\iGsSgKd.exe
  2⤵
  PID:10276
- C:\Windows\System\uiXueIX.exe
  C:\Windows\System\uiXueIX.exe
  2⤵
  PID:10308
- C:\Windows\System\JyYztVL.exe
  C:\Windows\System\JyYztVL.exe
  2⤵
  PID:10332
- C:\Windows\System\hMyGrOR.exe
  C:\Windows\System\hMyGrOR.exe
  2⤵
  PID:10388
- C:\Windows\System\mHIrZfW.exe
  C:\Windows\System\mHIrZfW.exe
  2⤵
  PID:10416
- C:\Windows\System\qTfWAdW.exe
  C:\Windows\System\qTfWAdW.exe
  2⤵
  PID:10432
- C:\Windows\System\YxkLSKC.exe
  C:\Windows\System\YxkLSKC.exe
  2⤵
  PID:10460
- C:\Windows\System\lEBExCb.exe
  C:\Windows\System\lEBExCb.exe
  2⤵
  PID:10484
- C:\Windows\System\CxKyWvY.exe
  C:\Windows\System\CxKyWvY.exe
  2⤵
  PID:10520
- C:\Windows\System\mRneYDj.exe
  C:\Windows\System\mRneYDj.exe
  2⤵
  PID:10544
- C:\Windows\System\htCgJXu.exe
  C:\Windows\System\htCgJXu.exe
  2⤵
  PID:10576
- C:\Windows\System\CGtbhqB.exe
  C:\Windows\System\CGtbhqB.exe
  2⤵
  PID:10600
- C:\Windows\System\ULjnNRk.exe
  C:\Windows\System\ULjnNRk.exe
  2⤵
  PID:10640
- C:\Windows\System\SYOcYTv.exe
  C:\Windows\System\SYOcYTv.exe
  2⤵
  PID:10668
- C:\Windows\System\UgjwYHb.exe
  C:\Windows\System\UgjwYHb.exe
  2⤵
  PID:10684
- C:\Windows\System\ChvcsmV.exe
  C:\Windows\System\ChvcsmV.exe
  2⤵
  PID:10712
- C:\Windows\System\xQadvzz.exe
  C:\Windows\System\xQadvzz.exe
  2⤵
  PID:10740
- C:\Windows\System\hTvtUzI.exe
  C:\Windows\System\hTvtUzI.exe
  2⤵
  PID:10760
- C:\Windows\System\VDwKPqH.exe
  C:\Windows\System\VDwKPqH.exe
  2⤵
  PID:10796
- C:\Windows\System\bLYcXMP.exe
  C:\Windows\System\bLYcXMP.exe
  2⤵
  PID:10824
- C:\Windows\System\sBceJsF.exe
  C:\Windows\System\sBceJsF.exe
  2⤵
  PID:10840
- C:\Windows\System\ZujXdKL.exe
  C:\Windows\System\ZujXdKL.exe
  2⤵
  PID:10876
- C:\Windows\System\JunxbUB.exe
  C:\Windows\System\JunxbUB.exe
  2⤵
  PID:10920
- C:\Windows\System\fHavTtS.exe
  C:\Windows\System\fHavTtS.exe
  2⤵
  PID:10948
- C:\Windows\System\msxfXpN.exe
  C:\Windows\System\msxfXpN.exe
  2⤵
  PID:10976
- C:\Windows\System\ZccLfcd.exe
  C:\Windows\System\ZccLfcd.exe
  2⤵
  PID:11004
- C:\Windows\System\NjkvHGy.exe
  C:\Windows\System\NjkvHGy.exe
  2⤵
  PID:11020
- C:\Windows\System\XwuHOWh.exe
  C:\Windows\System\XwuHOWh.exe
  2⤵
  PID:11048
- C:\Windows\System\ihMAvYp.exe
  C:\Windows\System\ihMAvYp.exe
  2⤵
  PID:11076
- C:\Windows\System\uubkzVd.exe
  C:\Windows\System\uubkzVd.exe
  2⤵
  PID:11104
- C:\Windows\System\ackhmOy.exe
  C:\Windows\System\ackhmOy.exe
  2⤵
  PID:11132
- C:\Windows\System\jIISsil.exe
  C:\Windows\System\jIISsil.exe
  2⤵
  PID:11160
- C:\Windows\System\MQSNvbB.exe
  C:\Windows\System\MQSNvbB.exe
  2⤵
  PID:11188
- C:\Windows\System\ZhdJHIV.exe
  C:\Windows\System\ZhdJHIV.exe
  2⤵
  PID:11220
- C:\Windows\System\NrDZjYJ.exe
  C:\Windows\System\NrDZjYJ.exe
  2⤵
  PID:11252
- C:\Windows\System\LSMkZsj.exe
  C:\Windows\System\LSMkZsj.exe
  2⤵
  PID:10092
- C:\Windows\System\FOrTpkm.exe
  C:\Windows\System\FOrTpkm.exe
  2⤵
  PID:10260
- C:\Windows\System\SNvlEWz.exe
  C:\Windows\System\SNvlEWz.exe
  2⤵
  PID:10356
- C:\Windows\System\yJJvRhK.exe
  C:\Windows\System\yJJvRhK.exe
  2⤵
  PID:10424
- C:\Windows\System\SiKemXf.exe
  C:\Windows\System\SiKemXf.exe
  2⤵
  PID:10476
- C:\Windows\System\FZVHhOz.exe
  C:\Windows\System\FZVHhOz.exe
  2⤵
  PID:10540
- C:\Windows\System\GMzDrZM.exe
  C:\Windows\System\GMzDrZM.exe
  2⤵
  PID:10616
- C:\Windows\System\JENmjSM.exe
  C:\Windows\System\JENmjSM.exe
  2⤵
  PID:10652
- C:\Windows\System\ixWtDJF.exe
  C:\Windows\System\ixWtDJF.exe
  2⤵
  PID:10732
- C:\Windows\System\eOaucvQ.exe
  C:\Windows\System\eOaucvQ.exe
  2⤵
  PID:10780
- C:\Windows\System\YDzZaRJ.exe
  C:\Windows\System\YDzZaRJ.exe
  2⤵
  PID:10832
- C:\Windows\System\VGLoXPo.exe
  C:\Windows\System\VGLoXPo.exe
  2⤵
  PID:10916
- C:\Windows\System\XdszxXJ.exe
  C:\Windows\System\XdszxXJ.exe
  2⤵
  PID:10936
- C:\Windows\System\QkFkAtZ.exe
  C:\Windows\System\QkFkAtZ.exe
  2⤵
  PID:11064
- C:\Windows\System\aReGmDc.exe
  C:\Windows\System\aReGmDc.exe
  2⤵
  PID:11128
- C:\Windows\System\jEadHXR.exe
  C:\Windows\System\jEadHXR.exe
  2⤵
  PID:11184
- C:\Windows\System\wKZzXxh.exe
  C:\Windows\System\wKZzXxh.exe
  2⤵
  PID:11244
- C:\Windows\System\LOhsZOI.exe
  C:\Windows\System\LOhsZOI.exe
  2⤵
  PID:10352
- C:\Windows\System\hAtOYpj.exe
  C:\Windows\System\hAtOYpj.exe
  2⤵
  PID:10500
- C:\Windows\System\yVaHIJI.exe
  C:\Windows\System\yVaHIJI.exe
  2⤵
  PID:10660
- C:\Windows\System\NGaDkJJ.exe
  C:\Windows\System\NGaDkJJ.exe
  2⤵
  PID:11000
- C:\Windows\System\qXzSFRU.exe
  C:\Windows\System\qXzSFRU.exe
  2⤵
  PID:10892
- C:\Windows\System\olqZkHV.exe
  C:\Windows\System\olqZkHV.exe
  2⤵
  PID:11096
- C:\Windows\System\JqcqZeD.exe
  C:\Windows\System\JqcqZeD.exe
  2⤵
  PID:11240
- C:\Windows\System\LwugfHR.exe
  C:\Windows\System\LwugfHR.exe
  2⤵
  PID:10536
- C:\Windows\System\toyweJR.exe
  C:\Windows\System\toyweJR.exe
  2⤵
  PID:10808
- C:\Windows\System\wysnYLd.exe
  C:\Windows\System\wysnYLd.exe
  2⤵
  PID:11200
- C:\Windows\System\BXZRrZT.exe
  C:\Windows\System\BXZRrZT.exe
  2⤵
  PID:10564
- C:\Windows\System\HSlqYKo.exe
  C:\Windows\System\HSlqYKo.exe
  2⤵
  PID:11268
- C:\Windows\System\KTDadLO.exe
  C:\Windows\System\KTDadLO.exe
  2⤵
  PID:11308
- C:\Windows\System\jAdNtHa.exe
  C:\Windows\System\jAdNtHa.exe
  2⤵
  PID:11328
- C:\Windows\System\dnxowKv.exe
  C:\Windows\System\dnxowKv.exe
  2⤵
  PID:11352
- C:\Windows\System\pMwUBCq.exe
  C:\Windows\System\pMwUBCq.exe
  2⤵
  PID:11380
- C:\Windows\System\OibgHLR.exe
  C:\Windows\System\OibgHLR.exe
  2⤵
  PID:11408
- C:\Windows\System\VqNueqI.exe
  C:\Windows\System\VqNueqI.exe
  2⤵
  PID:11432
- C:\Windows\System\yzhyzKk.exe
  C:\Windows\System\yzhyzKk.exe
  2⤵
  PID:11456
- C:\Windows\System\daNYdCf.exe
  C:\Windows\System\daNYdCf.exe
  2⤵
  PID:11492
- C:\Windows\System\SkPQgoB.exe
  C:\Windows\System\SkPQgoB.exe
  2⤵
  PID:11520
- C:\Windows\System\vqmJhzg.exe
  C:\Windows\System\vqmJhzg.exe
  2⤵
  PID:11536
- C:\Windows\System\JmFXvje.exe
  C:\Windows\System\JmFXvje.exe
  2⤵
  PID:11564
- C:\Windows\System\fiOOwRq.exe
  C:\Windows\System\fiOOwRq.exe
  2⤵
  PID:11596
- C:\Windows\System\qfTPUIJ.exe
  C:\Windows\System\qfTPUIJ.exe
  2⤵
  PID:11624
- C:\Windows\System\hOUFWVa.exe
  C:\Windows\System\hOUFWVa.exe
  2⤵
  PID:11672
- C:\Windows\System\qgMWUMS.exe
  C:\Windows\System\qgMWUMS.exe
  2⤵
  PID:11688
- C:\Windows\System\kNwGhXS.exe
  C:\Windows\System\kNwGhXS.exe
  2⤵
  PID:11716
- C:\Windows\System\KEtEhXr.exe
  C:\Windows\System\KEtEhXr.exe
  2⤵
  PID:11732
- C:\Windows\System\AItlfFS.exe
  C:\Windows\System\AItlfFS.exe
  2⤵
  PID:11756
- C:\Windows\System\cXWyoan.exe
  C:\Windows\System\cXWyoan.exe
  2⤵
  PID:11784
- C:\Windows\System\sEuxIGi.exe
  C:\Windows\System\sEuxIGi.exe
  2⤵
  PID:11804
- C:\Windows\System\HuUioXA.exe
  C:\Windows\System\HuUioXA.exe
  2⤵
  PID:11828
- C:\Windows\System\SvCFPEI.exe
  C:\Windows\System\SvCFPEI.exe
  2⤵
  PID:11848
- C:\Windows\System\TxGCbGj.exe
  C:\Windows\System\TxGCbGj.exe
  2⤵
  PID:11892
- C:\Windows\System\EkQkhJr.exe
  C:\Windows\System\EkQkhJr.exe
  2⤵
  PID:11944
- C:\Windows\System\ynPymuN.exe
  C:\Windows\System\ynPymuN.exe
  2⤵
  PID:11980
- C:\Windows\System\KmSYriL.exe
  C:\Windows\System\KmSYriL.exe
  2⤵
  PID:12008
- C:\Windows\System\zOMxCni.exe
  C:\Windows\System\zOMxCni.exe
  2⤵
  PID:12036
- C:\Windows\System\qLHypIF.exe
  C:\Windows\System\qLHypIF.exe
  2⤵
  PID:12064
- C:\Windows\System\YzrVJDX.exe
  C:\Windows\System\YzrVJDX.exe
  2⤵
  PID:12080
- C:\Windows\System\GxYCMcu.exe
  C:\Windows\System\GxYCMcu.exe
  2⤵
  PID:12108
- C:\Windows\System\SVKYoDd.exe
  C:\Windows\System\SVKYoDd.exe
  2⤵
  PID:12132
- C:\Windows\System\GpkVFwp.exe
  C:\Windows\System\GpkVFwp.exe
  2⤵
  PID:12164
- C:\Windows\System\BNfODwR.exe
  C:\Windows\System\BNfODwR.exe
  2⤵
  PID:12200
- C:\Windows\System\ELeuszP.exe
  C:\Windows\System\ELeuszP.exe
  2⤵
  PID:12220
- C:\Windows\System\tiFqTwD.exe
  C:\Windows\System\tiFqTwD.exe
  2⤵
  PID:12248
- C:\Windows\System\HCXCgWu.exe
  C:\Windows\System\HCXCgWu.exe
  2⤵
  PID:10932
- C:\Windows\System\RTHkRAb.exe
  C:\Windows\System\RTHkRAb.exe
  2⤵
  PID:11340
- C:\Windows\System\HJlnmYp.exe
  C:\Windows\System\HJlnmYp.exe
  2⤵
  PID:11368
- C:\Windows\System\uSUYhaf.exe
  C:\Windows\System\uSUYhaf.exe
  2⤵
  PID:11444
- C:\Windows\System\IIpBJgO.exe
  C:\Windows\System\IIpBJgO.exe
  2⤵
  PID:11416
- C:\Windows\System\dSuBbVR.exe
  C:\Windows\System\dSuBbVR.exe
  2⤵
  PID:11532
- C:\Windows\System\yyNiwDy.exe
  C:\Windows\System\yyNiwDy.exe
  2⤵
  PID:11604
- C:\Windows\System\YefIFPs.exe
  C:\Windows\System\YefIFPs.exe
  2⤵
  PID:11660
- C:\Windows\System\gcVCMPx.exe
  C:\Windows\System\gcVCMPx.exe
  2⤵
  PID:11776
- C:\Windows\System\Oymwbsm.exe
  C:\Windows\System\Oymwbsm.exe
  2⤵
  PID:11816
- C:\Windows\System\wjiPKer.exe
  C:\Windows\System\wjiPKer.exe
  2⤵
  PID:11840
- C:\Windows\System\GssSUul.exe
  C:\Windows\System\GssSUul.exe
  2⤵
  PID:11864
- C:\Windows\System\ukGVLDd.exe
  C:\Windows\System\ukGVLDd.exe
  2⤵
  PID:12020
- C:\Windows\System\PUCNsBk.exe
  C:\Windows\System\PUCNsBk.exe
  2⤵
  PID:12048
- C:\Windows\System\Dpjrvit.exe
  C:\Windows\System\Dpjrvit.exe
  2⤵
  PID:12144
- C:\Windows\System\XitKhOf.exe
  C:\Windows\System\XitKhOf.exe
  2⤵
  PID:12212
- C:\Windows\System\lkHANWl.exe
  C:\Windows\System\lkHANWl.exe
  2⤵
  PID:12260
- C:\Windows\System\HhqJuYY.exe
  C:\Windows\System\HhqJuYY.exe
  2⤵
  PID:11296
- C:\Windows\System\cFnKesE.exe
  C:\Windows\System\cFnKesE.exe
  2⤵
  PID:11392
- C:\Windows\System\WcnyzPu.exe
  C:\Windows\System\WcnyzPu.exe
  2⤵
  PID:11724
- C:\Windows\System\YDfWCeC.exe
  C:\Windows\System\YDfWCeC.exe
  2⤵
  PID:11728
- C:\Windows\System\NcJMFIt.exe
  C:\Windows\System\NcJMFIt.exe
  2⤵
  PID:12092
- C:\Windows\System\hskaILU.exe
  C:\Windows\System\hskaILU.exe
  2⤵
  PID:12032
- C:\Windows\System\KJvKDdy.exe
  C:\Windows\System\KJvKDdy.exe
  2⤵
  PID:12236
- C:\Windows\System\MOJJUZQ.exe
  C:\Windows\System\MOJJUZQ.exe
  2⤵
  PID:11656
- C:\Windows\System\RboXIij.exe
  C:\Windows\System\RboXIij.exe
  2⤵
  PID:11964
- C:\Windows\System\sijWHhZ.exe
  C:\Windows\System\sijWHhZ.exe
  2⤵
  PID:11400
- C:\Windows\System\FVjwNJf.exe
  C:\Windows\System\FVjwNJf.exe
  2⤵
  PID:12208
- C:\Windows\System\HompSLC.exe
  C:\Windows\System\HompSLC.exe
  2⤵
  PID:12296
- C:\Windows\System\tjLFAMm.exe
  C:\Windows\System\tjLFAMm.exe
  2⤵
  PID:12336
- C:\Windows\System\khgIIPX.exe
  C:\Windows\System\khgIIPX.exe
  2⤵
  PID:12356
- C:\Windows\System\SETBVmH.exe
  C:\Windows\System\SETBVmH.exe
  2⤵
  PID:12372
- C:\Windows\System\AlrSseK.exe
  C:\Windows\System\AlrSseK.exe
  2⤵
  PID:12388
- C:\Windows\System\CRIKcKM.exe
  C:\Windows\System\CRIKcKM.exe
  2⤵
  PID:12408
- C:\Windows\System\oStfbVv.exe
  C:\Windows\System\oStfbVv.exe
  2⤵
  PID:12432
- C:\Windows\System\IUBhikM.exe
  C:\Windows\System\IUBhikM.exe
  2⤵
  PID:12452
- C:\Windows\System\noiCbVG.exe
  C:\Windows\System\noiCbVG.exe
  2⤵
  PID:12504
- C:\Windows\System\KKkGnFX.exe
  C:\Windows\System\KKkGnFX.exe
  2⤵
  PID:12548
- C:\Windows\System\jdJznzC.exe
  C:\Windows\System\jdJznzC.exe
  2⤵
  PID:12568
- C:\Windows\System\uELsQdT.exe
  C:\Windows\System\uELsQdT.exe
  2⤵
  PID:12592
- C:\Windows\System\zAzNMMh.exe
  C:\Windows\System\zAzNMMh.exe
  2⤵
  PID:12632
- C:\Windows\System\JbupLme.exe
  C:\Windows\System\JbupLme.exe
  2⤵
  PID:12652
- C:\Windows\System\tFEoWaq.exe
  C:\Windows\System\tFEoWaq.exe
  2⤵
  PID:12704
- C:\Windows\System\DodEhOs.exe
  C:\Windows\System\DodEhOs.exe
  2⤵
  PID:12724
- C:\Windows\System\YGCpZqA.exe
  C:\Windows\System\YGCpZqA.exe
  2⤵
  PID:12760
- C:\Windows\System\TrxfIDZ.exe
  C:\Windows\System\TrxfIDZ.exe
  2⤵
  PID:12800
- C:\Windows\System\HnUTzwl.exe
  C:\Windows\System\HnUTzwl.exe
  2⤵
  PID:12816
- C:\Windows\System\JKGjnsf.exe
  C:\Windows\System\JKGjnsf.exe
  2⤵
  PID:12844
- C:\Windows\System\bbsmTon.exe
  C:\Windows\System\bbsmTon.exe
  2⤵
  PID:12884
- C:\Windows\System\HfDQfVy.exe
  C:\Windows\System\HfDQfVy.exe
  2⤵
  PID:12904
- C:\Windows\System\QUPBRda.exe
  C:\Windows\System\QUPBRda.exe
  2⤵
  PID:12928
- C:\Windows\System\wSZbQYk.exe
  C:\Windows\System\wSZbQYk.exe
  2⤵
  PID:12944
- C:\Windows\System\FqwCqwL.exe
  C:\Windows\System\FqwCqwL.exe
  2⤵
  PID:12984
- C:\Windows\System\ZtxpaUn.exe
  C:\Windows\System\ZtxpaUn.exe
  2⤵
  PID:13020
- C:\Windows\System\PTopUBv.exe
  C:\Windows\System\PTopUBv.exe
  2⤵
  PID:13040
- C:\Windows\System\XdGMgvd.exe
  C:\Windows\System\XdGMgvd.exe
  2⤵
  PID:13080
- C:\Windows\System\kgQlZae.exe
  C:\Windows\System\kgQlZae.exe
  2⤵
  PID:13096
- C:\Windows\System\sfUfGFa.exe
  C:\Windows\System\sfUfGFa.exe
  2⤵
  PID:13124
- C:\Windows\System\DcECxRE.exe
  C:\Windows\System\DcECxRE.exe
  2⤵
  PID:13148
- C:\Windows\System\VMwfaOa.exe
  C:\Windows\System\VMwfaOa.exe
  2⤵
  PID:13168
- C:\Windows\System\TFiBUUV.exe
  C:\Windows\System\TFiBUUV.exe
  2⤵
  PID:13220
- C:\Windows\System\OMVHISw.exe
  C:\Windows\System\OMVHISw.exe
  2⤵
  PID:13244
- C:\Windows\System\yHCzyvH.exe
  C:\Windows\System\yHCzyvH.exe
  2⤵
  PID:13264
- C:\Windows\System\TaEVbnt.exe
  C:\Windows\System\TaEVbnt.exe
  2⤵
  PID:13292
- C:\Windows\System\hdakgUC.exe
  C:\Windows\System\hdakgUC.exe
  2⤵
  PID:13308
- C:\Windows\System\GRVrvyH.exe
  C:\Windows\System\GRVrvyH.exe
  2⤵
  PID:12344
- C:\Windows\System\ZRYHuRg.exe
  C:\Windows\System\ZRYHuRg.exe
  2⤵
  PID:12460
- C:\Windows\System\VLChibO.exe
  C:\Windows\System\VLChibO.exe
  2⤵
  PID:12516
- C:\Windows\System\EChWHBi.exe
  C:\Windows\System\EChWHBi.exe
  2⤵
  PID:12544
- C:\Windows\System\hhPfeVs.exe
  C:\Windows\System\hhPfeVs.exe
  2⤵
  PID:12584
- C:\Windows\System\JfMUfSB.exe
  C:\Windows\System\JfMUfSB.exe
  2⤵
  PID:12676
- C:\Windows\System\AIYUdnh.exe
  C:\Windows\System\AIYUdnh.exe
  2⤵
  PID:12748
- C:\Windows\System\aasfnrf.exe
  C:\Windows\System\aasfnrf.exe
  2⤵
  PID:12784
- C:\Windows\System\AnntBLL.exe
  C:\Windows\System\AnntBLL.exe
  2⤵
  PID:12840
- C:\Windows\System\swTuoeQ.exe
  C:\Windows\System\swTuoeQ.exe
  2⤵
  PID:12936
- C:\Windows\System\HlBgxzL.exe
  C:\Windows\System\HlBgxzL.exe
  2⤵
  PID:13012
- C:\Windows\System\OvRtNul.exe
  C:\Windows\System\OvRtNul.exe
  2⤵
  PID:13076
- C:\Windows\System\yyAGyuy.exe
  C:\Windows\System\yyAGyuy.exe
  2⤵
  PID:13144
- C:\Windows\System\LojzpNr.exe
  C:\Windows\System\LojzpNr.exe
  2⤵
  PID:13212
- C:\Windows\System\lwXsWUx.exe
  C:\Windows\System\lwXsWUx.exe
  2⤵
  PID:13240
- C:\Windows\System\oxdMxGj.exe
  C:\Windows\System\oxdMxGj.exe
  2⤵
  PID:12324
- C:\Windows\System\DtqPaFB.exe
  C:\Windows\System\DtqPaFB.exe
  2⤵
  PID:12404
- C:\Windows\System\NTvpoHy.exe
  C:\Windows\System\NTvpoHy.exe
  2⤵
  PID:12712
- C:\Windows\System\pYEcalZ.exe
  C:\Windows\System\pYEcalZ.exe
  2⤵
  PID:12732
- C:\Windows\System\whaIzGH.exe
  C:\Windows\System\whaIzGH.exe
  2⤵
  PID:12940
- C:\Windows\System\vXDfJgF.exe
  C:\Windows\System\vXDfJgF.exe
  2⤵
  PID:13068
- C:\Windows\System\tiKjiUO.exe
  C:\Windows\System\tiKjiUO.exe
  2⤵
  PID:13208
- C:\Windows\System\cRQcAKC.exe
  C:\Windows\System\cRQcAKC.exe
  2⤵
  PID:13276
- C:\Windows\System\HGYCXzw.exe
  C:\Windows\System\HGYCXzw.exe
  2⤵
  PID:12500
- C:\Windows\System\rLEEJJi.exe
  C:\Windows\System\rLEEJJi.exe
  2⤵
  PID:12188
- C:\Windows\System\mQXnRdM.exe
  C:\Windows\System\mQXnRdM.exe
  2⤵
  PID:12612
- C:\Windows\System\spFTgZp.exe
  C:\Windows\System\spFTgZp.exe
  2⤵
  PID:13204
- C:\Windows\System\YINXfCo.exe
  C:\Windows\System\YINXfCo.exe
  2⤵
  PID:13328
- C:\Windows\System\cKinQib.exe
  C:\Windows\System\cKinQib.exe
  2⤵
  PID:13352
- C:\Windows\System\kECfpgm.exe
  C:\Windows\System\kECfpgm.exe
  2⤵
  PID:13396
- C:\Windows\System\YLwlTcw.exe
  C:\Windows\System\YLwlTcw.exe
  2⤵
  PID:13420
- C:\Windows\System\qWivxLr.exe
  C:\Windows\System\qWivxLr.exe
  2⤵
  PID:13476
- C:\Windows\System\YtbCAsu.exe
  C:\Windows\System\YtbCAsu.exe
  2⤵
  PID:13492
- C:\Windows\System\lLQSnfJ.exe
  C:\Windows\System\lLQSnfJ.exe
  2⤵
  PID:13520
- C:\Windows\System\MryIypC.exe
  C:\Windows\System\MryIypC.exe
  2⤵
  PID:13536
- C:\Windows\System\Vniaxfe.exe
  C:\Windows\System\Vniaxfe.exe
  2⤵
  PID:13560
- C:\Windows\System\lzGHSsk.exe
  C:\Windows\System\lzGHSsk.exe
  2⤵
  PID:13592
- C:\Windows\System\dXQluBb.exe
  C:\Windows\System\dXQluBb.exe
  2⤵
  PID:13628
- C:\Windows\System\IbDzEWT.exe
  C:\Windows\System\IbDzEWT.exe
  2⤵
  PID:13652
- C:\Windows\System\KJkQNAy.exe
  C:\Windows\System\KJkQNAy.exe
  2⤵
  PID:13696
- C:\Windows\System\tsusAnI.exe
  C:\Windows\System\tsusAnI.exe
  2⤵
  PID:13716
- C:\Windows\System\WBigKdB.exe
  C:\Windows\System\WBigKdB.exe
  2⤵
  PID:13732
- C:\Windows\System\uWjqAhU.exe
  C:\Windows\System\uWjqAhU.exe
  2⤵
  PID:13760
- C:\Windows\System\gLPxDwK.exe
  C:\Windows\System\gLPxDwK.exe
  2⤵
  PID:13784
- C:\Windows\System\PAUBUFt.exe
  C:\Windows\System\PAUBUFt.exe
  2⤵
  PID:13820
- C:\Windows\System\wliqkID.exe
  C:\Windows\System\wliqkID.exe
  2⤵
  PID:13840
- C:\Windows\System\yjwGuBz.exe
  C:\Windows\System\yjwGuBz.exe
  2⤵
  PID:13868
- C:\Windows\System\ateyvkC.exe
  C:\Windows\System\ateyvkC.exe
  2⤵
  PID:13904
- C:\Windows\System\QGznlZJ.exe
  C:\Windows\System\QGznlZJ.exe
  2⤵
  PID:13928
- C:\Windows\System\DeiSuNk.exe
  C:\Windows\System\DeiSuNk.exe
  2⤵
  PID:13980
- C:\Windows\System\VmgfKDq.exe
  C:\Windows\System\VmgfKDq.exe
  2⤵
  PID:14000
- C:\Windows\System\ggKmrtU.exe
  C:\Windows\System\ggKmrtU.exe
  2⤵
  PID:14020
- C:\Windows\System\ChcXHaX.exe
  C:\Windows\System\ChcXHaX.exe
  2⤵
  PID:14040
- C:\Windows\System\izKeOVd.exe
  C:\Windows\System\izKeOVd.exe
  2⤵
  PID:14080
- C:\Windows\System\rBWFhWx.exe
  C:\Windows\System\rBWFhWx.exe
  2⤵
  PID:14120
- C:\Windows\System\ZgCYyhK.exe
  C:\Windows\System\ZgCYyhK.exe
  2⤵
  PID:14148
- C:\Windows\System\czgOHBQ.exe
  C:\Windows\System\czgOHBQ.exe
  2⤵
  PID:14168
- C:\Windows\System\trFgQxF.exe
  C:\Windows\System\trFgQxF.exe
  2⤵
  PID:14192
- C:\Windows\System\cOruuQS.exe
  C:\Windows\System\cOruuQS.exe
  2⤵
  PID:14216
- C:\Windows\System\cHmjzTJ.exe
  C:\Windows\System\cHmjzTJ.exe
  2⤵
  PID:14248
- C:\Windows\System\eeHHPoQ.exe
  C:\Windows\System\eeHHPoQ.exe
  2⤵
  PID:14264
- C:\Windows\System\ApvzhUZ.exe
  C:\Windows\System\ApvzhUZ.exe
  2⤵
  PID:14280
- C:\Windows\System\OqqFFpb.exe
  C:\Windows\System\OqqFFpb.exe
  2⤵
  PID:14308
- C:\Windows\System\vvFlhoR.exe
  C:\Windows\System\vvFlhoR.exe
  2⤵
  PID:13320
- C:\Windows\System\EPlcBXo.exe
  C:\Windows\System\EPlcBXo.exe
  2⤵
  PID:13408
- C:\Windows\System\gqmMeUf.exe
  C:\Windows\System\gqmMeUf.exe
  2⤵
  PID:13460
- C:\Windows\System\INulJpX.exe
  C:\Windows\System\INulJpX.exe
  2⤵
  PID:13512
- C:\Windows\System\xmAJofC.exe
  C:\Windows\System\xmAJofC.exe
  2⤵
  PID:13612
- C:\Windows\System\HUdErSi.exe
  C:\Windows\System\HUdErSi.exe
  2⤵
  PID:13664
- C:\Windows\System\AejFyGb.exe
  C:\Windows\System\AejFyGb.exe
  2⤵
  PID:13728
- C:\Windows\System\pvTFJdB.exe
  C:\Windows\System\pvTFJdB.exe
  2⤵
  PID:13752
- C:\Windows\System\zajfmzb.exe
  C:\Windows\System\zajfmzb.exe
  2⤵
  PID:13856
- C:\Windows\System\OIHbWJh.exe
  C:\Windows\System\OIHbWJh.exe
  2⤵
  PID:13924
- C:\Windows\System\KeuUFZl.exe
  C:\Windows\System\KeuUFZl.exe
  2⤵
  PID:13976
- C:\Windows\System\qUSiYYo.exe
  C:\Windows\System\qUSiYYo.exe
  2⤵
  PID:14100
- C:\Windows\System\jOHiBrl.exe
  C:\Windows\System\jOHiBrl.exe
  2⤵
  PID:14116
- C:\Windows\System\ouiWMHp.exe
  C:\Windows\System\ouiWMHp.exe
  2⤵
  PID:14176
- C:\Windows\System\SpIoVRQ.exe
  C:\Windows\System\SpIoVRQ.exe
  2⤵
  PID:14272
- C:\Windows\System\TXebPEo.exe
  C:\Windows\System\TXebPEo.exe
  2⤵
  PID:14328
- C:\Windows\System\akjoBwn.exe
  C:\Windows\System\akjoBwn.exe
  2⤵
  PID:13464
- C:\Windows\System\tekImJK.exe
  C:\Windows\System\tekImJK.exe
  2⤵
  PID:13604
- C:\Windows\System\etxNQjE.exe
  C:\Windows\System\etxNQjE.exe
  2⤵
  PID:13704
- C:\Windows\System\rsZLrJf.exe
  C:\Windows\System\rsZLrJf.exe
  2⤵
  PID:13748
- C:\Windows\System\qHXPbRw.exe
  C:\Windows\System\qHXPbRw.exe
  2⤵
  PID:13972
- C:\Windows\System\NcqVTFu.exe
  C:\Windows\System\NcqVTFu.exe
  2⤵
  PID:14072
- C:\Windows\System\EPwrpGF.exe
  C:\Windows\System\EPwrpGF.exe
  2⤵
  PID:14240
- C:\Windows\System\QtUABOp.exe
  C:\Windows\System\QtUABOp.exe
  2⤵
  PID:13676
- C:\Windows\System\VZgSjXH.exe
  C:\Windows\System\VZgSjXH.exe
  2⤵
  PID:13880
- C:\Windows\System\OvfqNaV.exe
  C:\Windows\System\OvfqNaV.exe
  2⤵
  PID:14076
- C:\Windows\System\hqmaecU.exe
  C:\Windows\System\hqmaecU.exe
  2⤵
  PID:13384
- C:\Windows\System\OQURMCV.exe
  C:\Windows\System\OQURMCV.exe
  2⤵
  PID:13712
- C:\Windows\System\vjvhHAW.exe
  C:\Windows\System\vjvhHAW.exe
  2⤵
  PID:14340
- C:\Windows\System\dDqBdVf.exe
  C:\Windows\System\dDqBdVf.exe
  2⤵
  PID:14368
- C:\Windows\System\PyxFLhX.exe
  C:\Windows\System\PyxFLhX.exe
  2⤵
  PID:14440
- C:\Windows\System\sxrmDZk.exe
  C:\Windows\System\sxrmDZk.exe
  2⤵
  PID:14456
- C:\Windows\System\TxawbZP.exe
  C:\Windows\System\TxawbZP.exe
  2⤵
  PID:14496
- C:\Windows\System\DuoYnkd.exe
  C:\Windows\System\DuoYnkd.exe
  2⤵
  PID:14512
- C:\Windows\System\esFybnY.exe
  C:\Windows\System\esFybnY.exe
  2⤵
  PID:14552
- C:\Windows\System\AVUCHEa.exe
  C:\Windows\System\AVUCHEa.exe
  2⤵
  PID:14584
- C:\Windows\System\tHcXerm.exe
  C:\Windows\System\tHcXerm.exe
  2⤵
  PID:14600
- C:\Windows\System\XGjobvz.exe
  C:\Windows\System\XGjobvz.exe
  2⤵
  PID:14616
- C:\Windows\System\TczGarW.exe
  C:\Windows\System\TczGarW.exe
  2⤵
  PID:14652
- C:\Windows\System\sGkTnSs.exe
  C:\Windows\System\sGkTnSs.exe
  2⤵
  PID:14672
- C:\Windows\System\AleCnYV.exe
  C:\Windows\System\AleCnYV.exe
  2⤵
  PID:14696
- C:\Windows\System\XixFNiy.exe
  C:\Windows\System\XixFNiy.exe
  2⤵
  PID:14736
- C:\Windows\System\wNiStWx.exe
  C:\Windows\System\wNiStWx.exe
  2⤵
  PID:14756
- C:\Windows\System\RvsPrcJ.exe
  C:\Windows\System\RvsPrcJ.exe
  2⤵
  PID:14796
- C:\Windows\System\llubxtV.exe
  C:\Windows\System\llubxtV.exe
  2⤵
  PID:14812
- C:\Windows\System\LkMUqeo.exe
  C:\Windows\System\LkMUqeo.exe
  2⤵
  PID:14852
- C:\Windows\System\dexUyYH.exe
  C:\Windows\System\dexUyYH.exe
  2⤵
  PID:14868
- C:\Windows\System\xYADoZb.exe
  C:\Windows\System\xYADoZb.exe
  2⤵
  PID:14940
- C:\Windows\System\wyAWMjz.exe
  C:\Windows\System\wyAWMjz.exe
  2⤵
  PID:14956
- C:\Windows\System\WZmoaMU.exe
  C:\Windows\System\WZmoaMU.exe
  2⤵
  PID:14976
- C:\Windows\System\HEnVabG.exe
  C:\Windows\System\HEnVabG.exe
  2⤵
  PID:15000
- C:\Windows\System\UlXjWqj.exe
  C:\Windows\System\UlXjWqj.exe
  2⤵
  PID:15020
- C:\Windows\System\wnXMepN.exe
  C:\Windows\System\wnXMepN.exe
  2⤵
  PID:15064
- C:\Windows\System\bUWNdhJ.exe
  C:\Windows\System\bUWNdhJ.exe
  2⤵
  PID:15084
- C:\Windows\System\RxozepN.exe
  C:\Windows\System\RxozepN.exe
  2⤵
  PID:15124
- C:\Windows\System\FFRMlHY.exe
  C:\Windows\System\FFRMlHY.exe
  2⤵
  PID:15152
- C:\Windows\System\BuTmQNA.exe
  C:\Windows\System\BuTmQNA.exe
  2⤵
  PID:15168
- C:\Windows\System\yARkmoL.exe
  C:\Windows\System\yARkmoL.exe
  2⤵
  PID:15196
- C:\Windows\System\dDJTDXn.exe
  C:\Windows\System\dDJTDXn.exe
  2⤵
  PID:15224
- C:\Windows\System\KyZYmcf.exe
  C:\Windows\System\KyZYmcf.exe
  2⤵
  PID:15252
- C:\Windows\System\jJAeEgG.exe
  C:\Windows\System\jJAeEgG.exe
  2⤵
  PID:15292
- C:\Windows\System\pOQTKLz.exe
  C:\Windows\System\pOQTKLz.exe
  2⤵
  PID:15316
- C:\Windows\System\MGMrtJh.exe
  C:\Windows\System\MGMrtJh.exe
  2⤵
  PID:15332
- C:\Windows\System\WMifXtK.exe
  C:\Windows\System\WMifXtK.exe
  2⤵
  PID:15356
- C:\Windows\System\TgYqfnK.exe
  C:\Windows\System\TgYqfnK.exe
  2⤵
  PID:14360
- C:\Windows\System\Iisylap.exe
  C:\Windows\System\Iisylap.exe
  2⤵
  PID:14452
- C:\Windows\System\wAlIlqG.exe
  C:\Windows\System\wAlIlqG.exe
  2⤵
  PID:14536
- C:\Windows\System\NPlJYgL.exe
  C:\Windows\System\NPlJYgL.exe
  2⤵
  PID:14592
- C:\Windows\System\EadBFVO.exe
  C:\Windows\System\EadBFVO.exe
  2⤵
  PID:14688
- C:\Windows\System\ZAuYMrW.exe
  C:\Windows\System\ZAuYMrW.exe
  2⤵
  PID:14752
- C:\Windows\System\BUaDzyf.exe
  C:\Windows\System\BUaDzyf.exe
  2⤵
  PID:14776
- C:\Windows\System\CvgcMmm.exe
  C:\Windows\System\CvgcMmm.exe
  2⤵
  PID:14884
- C:\Windows\System\CxjnfUJ.exe
  C:\Windows\System\CxjnfUJ.exe
  2⤵
  PID:14964
- C:\Windows\System\yaZzWhT.exe
  C:\Windows\System\yaZzWhT.exe
  2⤵
  PID:14996
- C:\Windows\System\AhjGaZT.exe
  C:\Windows\System\AhjGaZT.exe
  2⤵
  PID:15060
- C:\Windows\System\AesHQxb.exe
  C:\Windows\System\AesHQxb.exe
  2⤵
  PID:15116
- C:\Windows\System\BCLJoHd.exe
  C:\Windows\System\BCLJoHd.exe
  2⤵
  PID:15184
- C:\Windows\System\cxYmcFq.exe
  C:\Windows\System\cxYmcFq.exe
  2⤵
  PID:15276
- C:\Windows\System\cdhEiif.exe
  C:\Windows\System\cdhEiif.exe
  2⤵
  PID:15344
- C:\Windows\System\CKXRijK.exe
  C:\Windows\System\CKXRijK.exe
  2⤵
  PID:15348
- C:\Windows\System\keNsTiK.exe
  C:\Windows\System\keNsTiK.exe
  2⤵
  PID:14612
- C:\Windows\System\TvwRoDn.exe
  C:\Windows\System\TvwRoDn.exe
  2⤵
  PID:14692
- C:\Windows\System\VXZiITm.exe
  C:\Windows\System\VXZiITm.exe
  2⤵
  PID:14804
- C:\Windows\System\kiikJkr.exe
  C:\Windows\System\kiikJkr.exe
  2⤵
  PID:15032
- C:\Windows\System\sKGTaiZ.exe
  C:\Windows\System\sKGTaiZ.exe
  2⤵
  PID:15248
- C:\Windows\System\ZpsWRiV.exe
  C:\Windows\System\ZpsWRiV.exe
  2⤵
  PID:14356
- C:\Windows\System\GDGgddO.exe
  C:\Windows\System\GDGgddO.exe
  2⤵
  PID:14572
- C:\Windows\System\kdZxgBd.exe
  C:\Windows\System\kdZxgBd.exe
  2⤵
  PID:14988
- C:\Windows\System\nfXuEHA.exe
  C:\Windows\System\nfXuEHA.exe
  2⤵
  PID:14416
- C:\Windows\System\LsTfADH.exe
  C:\Windows\System\LsTfADH.exe
  2⤵
  PID:14824
- C:\Windows\System\FknWftb.exe
  C:\Windows\System\FknWftb.exe
  2⤵
  PID:15308
- C:\Windows\System\HKGHZkf.exe
  C:\Windows\System\HKGHZkf.exe
  2⤵
  PID:15376
- C:\Windows\System\KoueCZE.exe
  C:\Windows\System\KoueCZE.exe
  2⤵
  PID:15420
- C:\Windows\System\eXSjLUB.exe
  C:\Windows\System\eXSjLUB.exe
  2⤵
  PID:15452
- C:\Windows\System\taUrqCr.exe
  C:\Windows\System\taUrqCr.exe
  2⤵
  PID:15472
- C:\Windows\System\xRExKlI.exe
  C:\Windows\System\xRExKlI.exe
  2⤵
  PID:15496
- C:\Windows\System\DnBFJPZ.exe
  C:\Windows\System\DnBFJPZ.exe
  2⤵
  PID:15516
- C:\Windows\System\HLsnlDo.exe
  C:\Windows\System\HLsnlDo.exe
  2⤵
  PID:15548
- C:\Windows\System\xKcgpzv.exe
  C:\Windows\System\xKcgpzv.exe
  2⤵
  PID:15588
- C:\Windows\System\LetQpfl.exe
  C:\Windows\System\LetQpfl.exe
  2⤵
  PID:15616
- C:\Windows\System\qLbiiKm.exe
  C:\Windows\System\qLbiiKm.exe
  2⤵
  PID:15640
- C:\Windows\System\QstxluA.exe
  C:\Windows\System\QstxluA.exe
  2⤵
  PID:15660
- C:\Windows\System\NLaPIJv.exe
  C:\Windows\System\NLaPIJv.exe
  2⤵
  PID:15700
- C:\Windows\System\YOsgKkh.exe
  C:\Windows\System\YOsgKkh.exe
  2⤵
  PID:15744
- C:\Windows\System\VTzDWtH.exe
  C:\Windows\System\VTzDWtH.exe
  2⤵
  PID:15772
- C:\Windows\System\JoKklks.exe
  C:\Windows\System\JoKklks.exe
  2⤵
  PID:15800
- C:\Windows\System\bGllDed.exe
  C:\Windows\System\bGllDed.exe
  2⤵
  PID:15828
- C:\Windows\System\HaOEMAh.exe
  C:\Windows\System\HaOEMAh.exe
  2⤵
  PID:15856
- C:\Windows\System\wjibqBr.exe
  C:\Windows\System\wjibqBr.exe
  2⤵
  PID:15872
- C:\Windows\System\NCwNERc.exe
  C:\Windows\System\NCwNERc.exe
  2⤵
  PID:15900
- C:\Windows\System\dlUetdZ.exe
  C:\Windows\System\dlUetdZ.exe
  2⤵
  PID:15916
- C:\Windows\System\ZyzJtrw.exe
  C:\Windows\System\ZyzJtrw.exe
  2⤵
  PID:15944
- C:\Windows\System\tluqKAX.exe
  C:\Windows\System\tluqKAX.exe
  2⤵
  PID:15984
- C:\Windows\System\lIbHqOD.exe
  C:\Windows\System\lIbHqOD.exe
  2⤵
  PID:16024
- C:\Windows\System\APnJBkk.exe
  C:\Windows\System\APnJBkk.exe
  2⤵
  PID:16048
- C:\Windows\System\HzeDyPK.exe
  C:\Windows\System\HzeDyPK.exe
  2⤵
  PID:16080
- C:\Windows\System\ZqJLBTK.exe
  C:\Windows\System\ZqJLBTK.exe
  2⤵
  PID:16108
- C:\Windows\System\POBeERO.exe
  C:\Windows\System\POBeERO.exe
  2⤵
  PID:16128
- C:\Windows\System\HRiTvZc.exe
  C:\Windows\System\HRiTvZc.exe
  2⤵
  PID:16152
- C:\Windows\System\YClsYbE.exe
  C:\Windows\System\YClsYbE.exe
  2⤵
  PID:16188
- C:\Windows\System\cTpbIVo.exe
  C:\Windows\System\cTpbIVo.exe
  2⤵
  PID:16208
- C:\Windows\System\htRTpiS.exe
  C:\Windows\System\htRTpiS.exe
  2⤵
  PID:16236
- C:\Windows\System\BUzMJkp.exe
  C:\Windows\System\BUzMJkp.exe
  2⤵
  PID:16252
- C:\Windows\System\mBTSIgC.exe
  C:\Windows\System\mBTSIgC.exe
  2⤵
  PID:16276
- C:\Windows\System\PQAIREi.exe
  C:\Windows\System\PQAIREi.exe
  2⤵
  PID:16316
- C:\Windows\System\PayavbE.exe
  C:\Windows\System\PayavbE.exe
  2⤵
  PID:16336
- C:\Windows\System\sudvnnw.exe
  C:\Windows\System\sudvnnw.exe
  2⤵
  PID:16376
- C:\Windows\System\TNMTMYo.exe
  C:\Windows\System\TNMTMYo.exe
  2⤵
  PID:15392
- C:\Windows\System\LfAOaIp.exe
  C:\Windows\System\LfAOaIp.exe
  2⤵
  PID:15484
- C:\Windows\System\lOYWdkq.exe
  C:\Windows\System\lOYWdkq.exe
  2⤵
  PID:15524
- C:\Windows\System\GqXovih.exe
  C:\Windows\System\GqXovih.exe
  2⤵
  PID:15572
- C:\Windows\System\CXMVBco.exe
  C:\Windows\System\CXMVBco.exe
  2⤵
  PID:15648
- C:\Windows\System\zqoqwJa.exe
  C:\Windows\System\zqoqwJa.exe
  2⤵
  PID:15688
- C:\Windows\System\OTAlvpA.exe
  C:\Windows\System\OTAlvpA.exe
  2⤵
  PID:15796
- C:\Windows\System\GAGDxbF.exe
  C:\Windows\System\GAGDxbF.exe
  2⤵
  PID:15848
- C:\Windows\System\irHIatL.exe
  C:\Windows\System\irHIatL.exe
  2⤵
  PID:15884
- C:\Windows\System\FzXLAtm.exe
  C:\Windows\System\FzXLAtm.exe
  2⤵
  PID:15928
- C:\Windows\System\TQVwCBZ.exe
  C:\Windows\System\TQVwCBZ.exe
  2⤵
  PID:16004
- C:\Windows\System\YsHKlpF.exe
  C:\Windows\System\YsHKlpF.exe
  2⤵
  PID:4812
- C:\Windows\System\OfREJXg.exe
  C:\Windows\System\OfREJXg.exe
  2⤵
  PID:1592
- C:\Windows\System\oblSLqC.exe
  C:\Windows\System\oblSLqC.exe
  2⤵
  PID:16148
- C:\Windows\System\UfCBNYK.exe
  C:\Windows\System\UfCBNYK.exe
  2⤵
  PID:16164
- C:\Windows\System\yHGnzbI.exe
  C:\Windows\System\yHGnzbI.exe
  2⤵
  PID:16204
- C:\Windows\System\baXslNh.exe
  C:\Windows\System\baXslNh.exe
  2⤵
  PID:16332
- C:\Windows\System\kzTHJNK.exe
  C:\Windows\System\kzTHJNK.exe
  2⤵
  PID:16360
- C:\Windows\System\LhCZGQk.exe
  C:\Windows\System\LhCZGQk.exe
  2⤵
  PID:15444
- C:\Windows\System\IDvGLFY.exe
  C:\Windows\System\IDvGLFY.exe
  2⤵
  PID:15508
- C:\Windows\System\IfHGQxp.exe
  C:\Windows\System\IfHGQxp.exe
  2⤵
  PID:15888
- C:\Windows\System\MuoNwmy.exe
  C:\Windows\System\MuoNwmy.exe
  2⤵
  PID:16072
- C:\Windows\System\tcrUBkH.exe
  C:\Windows\System\tcrUBkH.exe
  2⤵
  PID:16116
- C:\Windows\System\MNIbKsa.exe
  C:\Windows\System\MNIbKsa.exe
  2⤵
  PID:16228
- C:\Windows\System\ZjNITGd.exe
  C:\Windows\System\ZjNITGd.exe
  2⤵
  PID:15412
- C:\Windows\System\YbbmWLz.exe
  C:\Windows\System\YbbmWLz.exe
  2⤵
  PID:15656
- C:\Windows\System\YqKMqdi.exe
  C:\Windows\System\YqKMqdi.exe
  2⤵
  PID:16008
- C:\Windows\System\yXqziyz.exe
  C:\Windows\System\yXqziyz.exe
  2⤵
  PID:15540
- C:\Windows\System\gCxNkqk.exe
  C:\Windows\System\gCxNkqk.exe
  2⤵
  PID:14544
- C:\Windows\System\PlLENUn.exe
  C:\Windows\System\PlLENUn.exe
  2⤵
  PID:16400
- C:\Windows\System\dKWFyMp.exe
  C:\Windows\System\dKWFyMp.exe
  2⤵
  PID:16428
- C:\Windows\System\iaDkSNc.exe
  C:\Windows\System\iaDkSNc.exe
  2⤵
  PID:16444
- C:\Windows\System\ahXtobh.exe
  C:\Windows\System\ahXtobh.exe
  2⤵
  PID:16464
- C:\Windows\System\DTQlBqh.exe
  C:\Windows\System\DTQlBqh.exe
  2⤵
  PID:16488
- C:\Windows\System\IBZveAk.exe
  C:\Windows\System\IBZveAk.exe
  2⤵
  PID:16536
- C:\Windows\System\pUpIfQu.exe
  C:\Windows\System\pUpIfQu.exe
  2⤵
  PID:16560
- C:\Windows\System\JJCFAiV.exe
  C:\Windows\System\JJCFAiV.exe
  2⤵
  PID:16596
- C:\Windows\System\EYpipjK.exe
  C:\Windows\System\EYpipjK.exe
  2⤵
  PID:16612
- C:\Windows\System\hNnlomv.exe
  C:\Windows\System\hNnlomv.exe
  2⤵
  PID:16640
- C:\Windows\System\BcRsKcG.exe
  C:\Windows\System\BcRsKcG.exe
  2⤵
  PID:16656
- C:\Windows\System\WiGMfJp.exe
  C:\Windows\System\WiGMfJp.exe
  2⤵
  PID:16680
- C:\Windows\System\uAxhmzW.exe
  C:\Windows\System\uAxhmzW.exe
  2⤵
  PID:16712
- C:\Windows\System\FrhwwAa.exe
  C:\Windows\System\FrhwwAa.exe
  2⤵
  PID:16752
- C:\Windows\System\YzdGMdc.exe
  C:\Windows\System\YzdGMdc.exe
  2⤵
  PID:16784
- C:\Windows\System\dQnZFkj.exe
  C:\Windows\System\dQnZFkj.exe
  2⤵
  PID:16808
- C:\Windows\System\omVhuTG.exe
  C:\Windows\System\omVhuTG.exe
  2⤵
  PID:16824
- C:\Windows\System\mkMbPwD.exe
  C:\Windows\System\mkMbPwD.exe
  2⤵
  PID:16856
- C:\Windows\System\rTrfdbp.exe
  C:\Windows\System\rTrfdbp.exe
  2⤵
  PID:16880
- C:\Windows\System\OULlRQF.exe
  C:\Windows\System\OULlRQF.exe
  2⤵
  PID:16896
- C:\Windows\System\JXBpFds.exe
  C:\Windows\System\JXBpFds.exe
  2⤵
  PID:16936
- C:\Windows\System\DmnjGPe.exe
  C:\Windows\System\DmnjGPe.exe
  2⤵
  PID:17020

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:16460

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Accessibility Features

T1546.008

Privilege Escalation

Event Triggered Execution

T1546

Accessibility Features

T1546.008

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\AiSLoSk.exe

Filesize
1.4MB

MD5
a94b5a789e77ed4738761b674311124c

SHA1
8a9581dbdce4d45198e87f34fb96d9cf43abbb72

SHA256
85d5bb5b840b8cc58450663c045bfd690ce40b09425988f682b2dd3fea3be7a1

SHA512
1cbacfbd80b234f003b9b9f540ae621f920c46575457ead8914b3495fe7958d8483aa01ccfc4ed50d134afdb2ae7645bf744eec4434dfff77e49f1c7c7a89234

Download Submit
C:\Windows\System\EapNivd.exe

Filesize
1.4MB

MD5
64ee9f3d9b92ab16876b6a056d62cfe3

SHA1
065410a319402e383cc3d300ec2b8cbcfb41ee0a

SHA256
751e037f0c026a2580344026b89adf4bfe363605c1818790380d3d3d3ffff373

SHA512
2e8d414484ba4cfb7e5fa9a1c54e82e7cc376f4eed1962cc91d4b7aad1495ea0d7c7d367be54702193203116a285a0b54ce1dd223b3aff5b4671143f1cb7bfc6

Download Submit
C:\Windows\System\FEHFqDQ.exe

Filesize
1.4MB

MD5
323c4c6cad5638f1e33f5ef8cc181810

SHA1
4e6e5ca6dc44fee00564836f1c82007a53691d09

SHA256
43f21f05dcee12aff3386f175db7450bc2090b9273b9d650f73477f9ff4d12e7

SHA512
38f2f75480879348c10b35d49908d0865cad6d1c12c277dea3748a4627118b8f2e7efbfd77116d5d260b72268d81be449889a3c34d808b6eeb219a783a37797c

Download Submit
C:\Windows\System\KVQsFRi.exe

Filesize
1.4MB

MD5
738ea117b55da0e5f27c22a40f834c37

SHA1
548e8d8f461c8a3b799c27b3f9c79ed647bb3956

SHA256
873c61e0bebd8541267ef51e2ff30e5498e826f2fe715cd6bf2436c10bc73822

SHA512
112c85f1476a490dcaf8686c43494e3f329edcedd2cad7d5e56c2132f0a235c36bffe318d27291b3ac13d99910c468bcbd7f81a6fc7aa0e95b289942f02b69a1

Download Submit
C:\Windows\System\LeoQmcB.exe

Filesize
1.4MB

MD5
3e2758e04500d8e7c0e992fa17aa0579

SHA1
e508ce6a6642dc56634e48aa3a530357e14611f6

SHA256
24a1b9d5e0b50f38cd7a3725c860f0a94a64043f9f14d9ee3f49cfa3ea5dd6d1

SHA512
aed12b5759256ae4cb5d191732c4a1cff861babb2069ca1eecb23f333cfbd13140d2fdeb1ca6449b708e68f0d2f2f19a3d60f48c2196b5d2ff08d6105492aead

Download Submit
C:\Windows\System\NUFTngC.exe

Filesize
1.4MB

MD5
8ef72d51c5ad20a59203632fcb91f2af

SHA1
9032d73b4785877ef3907aafa6a262a49c2f83b2

SHA256
3fdc41268e495f69b4ac4b53db88236dce875d2bf7a7e1493abb4e38a68609f2

SHA512
0a32f9c767115da9c9ba0e8bbc02ffe60f2c1aac7e333bd16d8fde754050e0753bc87712412646dbe4b6f828470f6132e0e7a862368931c592746adb4b6482fa

Download Submit
C:\Windows\System\NpCmYDE.exe

Filesize
1.4MB

MD5
58d064893cff54a188e060988bda97da

SHA1
39d4dbf4e798268319e1fc92c06dcd5039d7be78

SHA256
81de794e2d0f433a41c7c25789594c0f0753e85a5822990d6059d8deb4cae165

SHA512
4e0ae54314702452857ee382fdfd1eb73c52d367b7e732385663cf8fc0bf077b9a5cc7d60fbb342b110ceea3cc531c995b6e027d2c6dc51dfc41069b5e8969e3

Download Submit
C:\Windows\System\PLVDQbe.exe

Filesize
1.4MB

MD5
5bfe7ede33890f384b4caaf0e1a6a1ae

SHA1
d9377b5fea94968b93dbf004ab320ad27f936808

SHA256
096e4d99a8907e54a6cde7cb01d8f437c53a4c4c1910a3b8a3223c1cb998a256

SHA512
6632d4783c99e189b8d15a963159b87b276c743f247cbe8a056122e640955b2c463bc61dd1737ba9943a9a54b6c810e891171951b255450de4bbaf849c1c9c44

Download Submit
C:\Windows\System\PLuOyox.exe

Filesize
1.4MB

MD5
d87d285afb34cde7a201c9b5619bd270

SHA1
f467efa763321a40873904fcf6f2d8ba1c3c2be3

SHA256
5a785642176d73f8bb49e12bbebf4a1f6aa2c8051018b3f8d36f4580ed491e8e

SHA512
24e6bd193f7d317947363b6f7b682794bf400d7f6d51618a5640a1eee56ee922c118dd95da3dfde6a2c20d56745770ae7099dd97a4cdacf4b4924eb8801a00db

Download Submit
C:\Windows\System\QmuCIlM.exe

Filesize
1.4MB

MD5
f38d989bd3dc25aa67d62e1b533af357

SHA1
d8485d6e9747b21ccdaa62e37243fc7c400144f9

SHA256
7703c1745135ce59b18c547de3e92413788c3193f7b4bd62c2f5f43604b7a4d2

SHA512
945a9b915e568a725efb6fcc6beb9c4a2b3487d437f15a7718e3d50ab53a51764edcef782451ba1e4c0520128f258ce464dc92fb7da3010fe98e62260987eac2

Download Submit
C:\Windows\System\QpHXaWl.exe

Filesize
1.4MB

MD5
7f2fc76d544d0bbdde9850592ce0dcf9

SHA1
c3a04d9547e132e203f2c08c50fc62db618fc014

SHA256
5bf2b5feae09f2a38a54a20e0390fbc6ea070bdf3af22dacf80150297ef87aec

SHA512
44ee11214ed67ce28fb9bc2a823ddff34b095aa2affaeba58c7a2fd93cc1b6f942c9eac4f429e8e62c3e43b3fa6706d666fc6df171e2ccc253c6f9e97c61ae1b

Download Submit
C:\Windows\System\VfhNJiA.exe

Filesize
1.4MB

MD5
6ee48cc6e36cb2e8325080563202bee0

SHA1
2407629271781a59ef07df3b6382230af59fe030

SHA256
38c9e69b65aafef406d7968ef99bbc9acbf9cc9ecb5975156ceb8b557de8f60e

SHA512
609fa1119198b3e5a1bec46fb6d95ae2f2660d2d2143f55a7fe52c0fb9f4fb75dac9cfa0ee4213b8e6e45c0f2047fea287c39148b56ca92d87c694dcf7739423

Download Submit
C:\Windows\System\VtxRBlt.exe

Filesize
1.4MB

MD5
ed8193b1273e9fc41bfd6d1b9b0fcff5

SHA1
5da05344f96db34bdae95c51599ea3dfb9be2b2f

SHA256
5096a738ea01c9a6dfb66d96b6036cfcd581049b19e42ccab07e05bbb76aeebe

SHA512
faa1c3e0da08565cdcd5c315555d3551cc3378d05704ff6620e54bc159195466f9fb5a3807c14a4187521a9414af475fb3d02ab46f60905050534261357ce8f7

Download Submit
C:\Windows\System\WPFFTJD.exe

Filesize
1.4MB

MD5
bd98af4ee198bc11a63d8ca27a022c7b

SHA1
d849bce356cdc05d0f76ae128e13f8a529608f3a

SHA256
f5973c7d33e0a9f85eccd877f92fb6383f4b77e21779a8c1d756ab4ab841051c

SHA512
4002285a5f59d67b4f730ee277582c2ec52c728c2eec841d3ed1ae179719705ab9b20fa3487761f8f08abfdcaeeb4e71a240eda654cf09bd927643adfd4ad277

Download Submit
C:\Windows\System\WePHvwA.exe

Filesize
1.4MB

MD5
f8ae720aeb189e636073e7c474bdb542

SHA1
83c540d89f0dccd191cd8592699078b28977ed51

SHA256
a16cd1d72e43ea43b577c30c53299a69ce09bb4f8efeb85209dd435bd54f6df6

SHA512
31f116cb074a3931f52575480fccbef4d1f8ea6a81ceccca2901c0b77df5a8837bc46687b80af42ac158f562d67a91832fe365d9ba43f43994684a4658219146

Download Submit
C:\Windows\System\XFIjYaq.exe

Filesize
1.4MB

MD5
a726bf48caae8e0f538770a5ac005604

SHA1
197dd40a23ca1df0052c6d2236379373fa7e4f57

SHA256
277a3f8afce7959a9d5d90cf318a6ebf640f3562c7d4d763e76408a67ae86482

SHA512
d229f5b0cd4a29f90615bdf6d55fd52bcb8a63615d988e3a4caabbbf9e7993465d8667b0ee6eeb3aa6a0106597627feefb845349ce571eb043ccd56383464492

Download Submit
C:\Windows\System\YDcTGYt.exe

Filesize
1.4MB

MD5
2f2690f5efd4b34276dab6331d8f63d2

SHA1
6e72038761c90bc8fae6a9128f48f3e75e1e018a

SHA256
570358eb5a70783960da97e36b485fbb5d9c04c019141f636e2c38a7b7303999

SHA512
4d4ed2833b08d3a39b5abbdacb0a40347f341e8cfe56ba0a10261c7c0ba30f4443e4cd1140a4f8a66917e23cd64acc45db2fc30723473115ba7634f7b365ba40

Download Submit
C:\Windows\System\YxmixcB.exe

Filesize
1.4MB

MD5
71338228cc291c7d16e2f00f8f5d594a

SHA1
1780949dfbb0b181af68b2b257790458f8e8832a

SHA256
2abcd40160b87a918259795cf51e0ad74141128ea4ebfdcbf7c29a793081d798

SHA512
e2be71ddc89997c4d79feea48555319ee9c981e3d55398fd8e2d10ecbbae2ee945547e56b7e9ca457c5dd51919d82eca969149d95e68bba032cdd8e00dbe0c25

Download Submit
C:\Windows\System\cnjtQDm.exe

Filesize
1.4MB

MD5
4fddb168d7f25a0a257c33f70dfecff5

SHA1
18929eaa88fd4a299c842e4536303561a8d045b8

SHA256
83fa5f622180c39faf7fd732db5cc25a9a2300e017525c031a2dc3aeb4536288

SHA512
71d1da1b95566c0b659168c40088154df99c073a0af904974fbceea977bcc570a064fbc1509d27e03f79b04dc44335d00ba314fedad8b0bd5e39596f2e2e2a38

Download Submit
C:\Windows\System\grYaYRf.exe

Filesize
1.4MB

MD5
6e49f871d037c1c8ac634c2531c6d5fc

SHA1
f4bfab115095587e22540c60774c23115100fcc7

SHA256
34fd2c58094ec2beb59f83b412b199810b9bf8ae5ef2d699c304e2da4b9cf25f

SHA512
d9cee88acb42ada5e54824e660c7b44cb5f91670d356950e5590e6166dda7fc5fc8424ea2a96f47aa90e36ee542c322b58ddef9b3e0539d558a81cc71123abf5

Download Submit
C:\Windows\System\jniHDdg.exe

Filesize
1.4MB

MD5
2084dba891a5a513adda562cc1a2c3b8

SHA1
0826829cd5feba870bfdce060f968c526b4b469a

SHA256
fef59da1062e59a62b4f7cb9dec6b95675decd71c13d8a4f112f85cde93a629b

SHA512
4fdeb52d01f3fe85193c7faa26ebc2a004d9a5ed4b405baf4b150eeab7c77e57e431c8d105818c4b1ece2d544739067cbd82e6fc3639f30ebb7fd34dfc1ba841

Download Submit
C:\Windows\System\jxIWiSr.exe

Filesize
1.4MB

MD5
6ee6d066282457785b1a15af578f7a52

SHA1
4cc05efbf8c38a20fd2ded51589c12df07d9f30c

SHA256
b4836a7b1877041f20dece235fe4349bf869c0d0d0362dfceb30ff4f924b9ea4

SHA512
0febbe564581202c326f63a06623e1368a61635f96b2b45dd29889664de0b1aded533c07bad43bfec6eb6ccfbdc062487126aab71e9195c87b4aa7fc0f449a5e

Download Submit
C:\Windows\System\oBPyZOR.exe

Filesize
1.4MB

MD5
c78535f1532601d315b444e2690714a1

SHA1
e6578a27a2593f1103ebef7b50781c7ecda50f7f

SHA256
0e2f6cf4621b2dce0c7769d7f3e683ef9c29f2e7b406ccc49f2ccc7a81dbddb9

SHA512
e4339f540ae058bc9769274a74b1ed6c0b34fd1b32315628555136b7e4be061269e1d23a11f7d7a7f25668f68cf971f6315acc8a3219fe351ad7cbbd4b3a70e0

Download Submit
C:\Windows\System\oIrAkuG.exe

Filesize
1.4MB

MD5
cd63e8e4c8c4cf177dc1af7d0a65d407

SHA1
e8516aedb6d4f318eb10f87852279c8474c48fc0

SHA256
5aa661fdc041c7fa143d4962c1e0e0ae763b5bd234d6376216b28834a9a97a44

SHA512
a0d3c105e17264a06537f5b8add03fd802e35eb4faf184f932a04c409fa9f78a4ad40a5761976106314bc3843401c85ed291adc34f0dabca3a6dbd21aa2804d9

Download Submit
C:\Windows\System\rbovXXt.exe

Filesize
1.4MB

MD5
299220e794691b48efd359559f717807

SHA1
12c371fc8a9ee516aa4fd90dc831f5315871c441

SHA256
3eb5c137168c2541b3ad68a71143e1238c0d3e486e576cc6016fa51db3bc6699

SHA512
aed44082fedb3a2e9785a02b13c9480df4e66a412ea482078312bf9f9c0215af7806e2e629c89bcf43e21be29f76656f1ad4e774c434fb51ce158a67e3086bfe

Download Submit
C:\Windows\System\rkhotoG.exe

Filesize
1.4MB

MD5
7818fda0cc1a4bde5dabd3b8f639b97a

SHA1
d445f2d50a121828afb63157ef806369ee74ea0e

SHA256
9e0903118ad4ee1c60d2163e2d5dfcb61a9709c603675b4578cda7017b2f127c

SHA512
e1fcdc6fc9815bfe2def257fae825d06b272ef744d24ab64e7a8461177650fe76d8183356227b8e4d9ebf30ff30534cdbce0e8468631799f9184a260e5ec42b5

Download Submit
C:\Windows\System\vNhGtZR.exe

Filesize
1.4MB

MD5
e26ee9b761141897af3dc3afdd258d9c

SHA1
17ba2a50b6a1d3b8695cec15b4d79bcce85238fc

SHA256
838b620f6970f3fef17ea765b685b2d60c610dd18193fb8a6f8c869bcb54e5ec

SHA512
b28ab1136aabf2fca6d304cac6c96fc2552df8327c7a7597ee1f7e2e2d5b554befb5e1fb810e626e58a5421d8e630afe0f12bb5c69247548507445bf2296d06b

Download Submit
C:\Windows\System\vOHKQgy.exe

Filesize
1.4MB

MD5
1770e0bd86a455b0d632cab15833dce2

SHA1
2ce6d7753b12118e45c7907b8f1ed62fa89482a6

SHA256
8e66b39cfa533d70508091844e61a3a1d9444a9089a335f68b6c77a6a8093ce8

SHA512
8a2c48dfdb6c5bc96da5ff6d49371154171ec87caa4f9e22153313b8ab0e9c459b20487d45eb0c7b8cd2bc70278820a8bfb2ebb4936e3c3faccb586d3b96cafc

Download Submit
C:\Windows\System\vlOmbFf.exe

Filesize
1.4MB

MD5
182485977a6f74dd37da62c5aee14e2e

SHA1
845fef25b5e4c05207e8599ae7378e304f442438

SHA256
70916910728c6fb7ccfa3ab4e70925c34451c2678694ac22e844e5de39b9c5d8

SHA512
cc38f6f1c0f956f1c7e80d318eb3608d5c482240dc2b63e0ff199e6ebbe0af38284f8458a1c420aee334a658fdcfc76c31cbb50da7268ae8585272a464ab18c8

Download Submit
C:\Windows\System\yIzmshb.exe

Filesize
1.4MB

MD5
b4002e7a0456803e6809184cee04ce7e

SHA1
40c8da485f0252165279533b9bf15b322106964e

SHA256
157d254af5dede23818a8bbfe09478a49baf30d4ac599a5b68170a4e948d1a4e

SHA512
73beac297ab65cb49a949339066ca7ec5e8bed43f461ec0fdacaec66002aa9532b73a9d3018593418ca0d313caf1e24e99d038792a3ef7d44ebc78da0c26855b

Download Submit
C:\Windows\System\yctUHCR.exe

Filesize
1.4MB

MD5
da0d9d9c106f44e9a1adc4e5e1fcf326

SHA1
88533c10ef0ef78c44eb5223e5683959a3148cd6

SHA256
558a089c63a20bc3a95e9ba622853151d09469779d701a5ab7c0f9923339bf05

SHA512
2364f4effdd09e644ece814694e510dc263dd7fe504a8ee83475d5d2d6dbdb71043ec08c0521fc940d7a6de9c67b0442061423885c84474825f70977a7cb5ee3

Download Submit
C:\Windows\System\zONHZBF.exe

Filesize
1.4MB

MD5
13ef0b629bba33c22070c73c42370e86

SHA1
9e7e34ef3fbf6b34ba4c40f994f34002a5dbbf48

SHA256
ee90d64c5a4088d363d97fadcfde2b0e23c38ee401f603267f64b21acdf626b7

SHA512
1065d3f0e5fb6fecc0ce8215ccfd927de077b0bd37c18d40edfaa2ad24fdda8d1464b0c2af73237f58905d4d538e5449bea6958c1a227b0369fbf9a075c2d14a

Download Submit
C:\Windows\System\zYjrQeJ.exe

Filesize
1.4MB

MD5
e258d88a1bf3b1309fc4a3b477c971c4

SHA1
dc767c36d5cd1a59a3bdc728e50e89277f391c1f

SHA256
c8cd3b9345d373fa14f18e1db8ce5cfae3882baf00769d86ce0888862e41cd4e

SHA512
c8eef6ce920041cb668f3d6b9cac223cc75457186347709f3ff44fd0d9ce5d7616d04efe6f17ad3c0b9c70835e1a6b017c4bd5e7c382008bc031c0e89e9430cf

Download Submit
memory/4960-0-0x000001FC0F170000-0x000001FC0F180000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads