xmrig | 96bba8c289c9dfe1272f7f9cfc520be1acea44d89f91818ca704fd3ac204bdfa

Analysis

max time kernel
130s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20250129-en
resource tags

arch:x64arch:x86image:win10v2004-20250129-enlocale:en-usos:windows10-2004-x64system
submitted
03/02/2025, 02:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

96bba8c289c9dfe1272f7f9cfc520be1acea44d89f91818ca704fd3ac204bdfa.exe
Size

1.4MB
MD5

3af80488a7d49fd2f5b33e2d3430ac8a
SHA1

3b2c2fbf1fb63c953c082802f4ee8e19eef0497d
SHA256

96bba8c289c9dfe1272f7f9cfc520be1acea44d89f91818ca704fd3ac204bdfa
SHA512

765fe2fe81a5616fd8b88dc20c1825e62cf844b6b9b340fc07855279920e30b14a424c0e1dbc7152c0c37b864c0560985855977f7237191442071a27554df4da
SSDEEP

24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbpwlKenszbWKDNEm/5p904aohckx:GezaTF8FcNkNdfE0pZ9ozttwIRxGDK3v

Score

10^/10

xmrig discovery miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 33 IoCs

miner

resource	yara_rule
behavioral2/files/0x0008000000023c95-4.dat	xmrig
behavioral2/files/0x0008000000023c98-9.dat	xmrig
behavioral2/files/0x0007000000023c99-7.dat	xmrig
behavioral2/files/0x0007000000023c9b-24.dat	xmrig
behavioral2/files/0x0007000000023c9c-33.dat	xmrig
behavioral2/files/0x0007000000023c9f-42.dat	xmrig
behavioral2/files/0x0007000000023c9e-43.dat	xmrig
behavioral2/files/0x0007000000023ca0-50.dat	xmrig
behavioral2/files/0x0007000000023ca2-59.dat	xmrig
behavioral2/files/0x0007000000023ca1-57.dat	xmrig
behavioral2/files/0x0007000000023c9d-35.dat	xmrig
behavioral2/files/0x0007000000023c9a-20.dat	xmrig
behavioral2/files/0x0007000000023ca3-66.dat	xmrig
behavioral2/files/0x0007000000023ca4-67.dat	xmrig
behavioral2/files/0x0007000000023ca8-89.dat	xmrig
behavioral2/files/0x0007000000023caa-98.dat	xmrig
behavioral2/files/0x0007000000023ca9-104.dat	xmrig
behavioral2/files/0x0007000000023cab-110.dat	xmrig
behavioral2/files/0x0007000000023ca6-108.dat	xmrig
behavioral2/files/0x0007000000023ca7-100.dat	xmrig
behavioral2/files/0x0007000000023ca5-90.dat	xmrig
behavioral2/files/0x0008000000023c96-78.dat	xmrig
behavioral2/files/0x0007000000023cac-114.dat	xmrig
behavioral2/files/0x0004000000000034-121.dat	xmrig
behavioral2/files/0x000400000001da09-122.dat	xmrig
behavioral2/files/0x000600000001da0b-127.dat	xmrig
behavioral2/files/0x000400000001da21-144.dat	xmrig
behavioral2/files/0x000400000001da17-143.dat	xmrig
behavioral2/files/0x000400000001da2e-162.dat	xmrig
behavioral2/files/0x000400000001da2a-161.dat	xmrig
behavioral2/files/0x000600000001da29-156.dat	xmrig
behavioral2/files/0x000500000001da14-147.dat	xmrig
behavioral2/files/0x000400000001da10-140.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
1648	jtiamgf.exe
4928	uUnTIHq.exe
2752	XCfQZUn.exe
1992	XyhNOrG.exe
2252	aAfcQLy.exe
2052	RoFhAZy.exe
2220	ACYqIhx.exe
2020	wXBBiLE.exe
1416	QHPYqtq.exe
4072	peDVTYK.exe
1704	SoOErtd.exe
1600	DmzvAlY.exe
4824	PsvCFQc.exe
4904	hAwGyTx.exe
3028	WIaDdPN.exe
4780	FvuYcbP.exe
3568	kvnbzxq.exe
4732	CVBwgBe.exe
3472	hqetVlb.exe
4944	byTZNro.exe
4400	WPINgfG.exe
3600	OeDweIO.exe
4752	CIXcDqr.exe
3144	MZldGfH.exe
220	VDyJthD.exe
3920	ihvlKCj.exe
2796	kDJTDLh.exe
1168	JANtMal.exe
2904	WxyeUye.exe
4488	pefkFZM.exe
1896	wRNTNUU.exe
4984	GrRTQpy.exe
1864	sUWTgFr.exe
4684	cxaphIU.exe
2592	EpDVUaP.exe
3220	NrGLOJQ.exe
3888	YhRwBpJ.exe
1912	wLxFbMk.exe
752	pGtmbCw.exe
2388	iIQjyiv.exe
512	aDZWrpF.exe
1772	eidFQnS.exe
3880	qhlOWUB.exe
3440	DMXMAtA.exe
2660	JaAiFpL.exe
4272	oDCWDep.exe
4748	CSipGbD.exe
640	YvQNkFX.exe
2120	wKOqiou.exe
1604	kgjWVPi.exe
3908	vdzGJOn.exe
3196	mDbGnVj.exe
2880	eaUYjut.exe
116	FxwjWJg.exe
1016	ZYhHlip.exe
3076	mEkTjos.exe
2304	MouvoMB.exe
1396	sMbbPEa.exe
1248	lxwbLXU.exe
2972	pMPrdot.exe
976	AyTauxr.exe
2612	WEqTUoS.exe
4060	ciLwayl.exe
1408	LBBDPsJ.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\sStqjBp.exe	96bba8c289c9dfe1272f7f9cfc520be1acea44d89f91818ca704fd3ac204bdfa.exe
File created	C:\Windows\System\KIbtjKp.exe	96bba8c289c9dfe1272f7f9cfc520be1acea44d89f91818ca704fd3ac204bdfa.exe
File created	C:\Windows\System\BfhAdWP.exe	96bba8c289c9dfe1272f7f9cfc520be1acea44d89f91818ca704fd3ac204bdfa.exe
File created	C:\Windows\System\pzAjoUv.exe	96bba8c289c9dfe1272f7f9cfc520be1acea44d89f91818ca704fd3ac204bdfa.exe
File created	C:\Windows\System\RViSzLe.exe	96bba8c289c9dfe1272f7f9cfc520be1acea44d89f91818ca704fd3ac204bdfa.exe
File created	C:\Windows\System\LrgvcJr.exe	96bba8c289c9dfe1272f7f9cfc520be1acea44d89f91818ca704fd3ac204bdfa.exe
File created	C:\Windows\System\VvZWfIu.exe	96bba8c289c9dfe1272f7f9cfc520be1acea44d89f91818ca704fd3ac204bdfa.exe
File created	C:\Windows\System\yYpQSNh.exe	96bba8c289c9dfe1272f7f9cfc520be1acea44d89f91818ca704fd3ac204bdfa.exe
File created	C:\Windows\System\WxyeUye.exe	96bba8c289c9dfe1272f7f9cfc520be1acea44d89f91818ca704fd3ac204bdfa.exe
File created	C:\Windows\System\OuQLkUR.exe	96bba8c289c9dfe1272f7f9cfc520be1acea44d89f91818ca704fd3ac204bdfa.exe
File created	C:\Windows\System\vtgfIFV.exe	96bba8c289c9dfe1272f7f9cfc520be1acea44d89f91818ca704fd3ac204bdfa.exe
File created	C:\Windows\System\pOVIemx.exe	96bba8c289c9dfe1272f7f9cfc520be1acea44d89f91818ca704fd3ac204bdfa.exe
File created	C:\Windows\System\mmfylJF.exe	96bba8c289c9dfe1272f7f9cfc520be1acea44d89f91818ca704fd3ac204bdfa.exe
File created	C:\Windows\System\ApDzmgn.exe	96bba8c289c9dfe1272f7f9cfc520be1acea44d89f91818ca704fd3ac204bdfa.exe
File created	C:\Windows\System\PuWhcaf.exe	96bba8c289c9dfe1272f7f9cfc520be1acea44d89f91818ca704fd3ac204bdfa.exe
File created	C:\Windows\System\VGwDvIx.exe	96bba8c289c9dfe1272f7f9cfc520be1acea44d89f91818ca704fd3ac204bdfa.exe
File created	C:\Windows\System\DVLOSbE.exe	96bba8c289c9dfe1272f7f9cfc520be1acea44d89f91818ca704fd3ac204bdfa.exe
File created	C:\Windows\System\XDgAgDT.exe	96bba8c289c9dfe1272f7f9cfc520be1acea44d89f91818ca704fd3ac204bdfa.exe
File created	C:\Windows\System\PYnrRmQ.exe	96bba8c289c9dfe1272f7f9cfc520be1acea44d89f91818ca704fd3ac204bdfa.exe
File created	C:\Windows\System\XchmrgU.exe	96bba8c289c9dfe1272f7f9cfc520be1acea44d89f91818ca704fd3ac204bdfa.exe
File created	C:\Windows\System\mTZjcyT.exe	96bba8c289c9dfe1272f7f9cfc520be1acea44d89f91818ca704fd3ac204bdfa.exe
File created	C:\Windows\System\tcFFySO.exe	96bba8c289c9dfe1272f7f9cfc520be1acea44d89f91818ca704fd3ac204bdfa.exe
File created	C:\Windows\System\OcEEAEK.exe	96bba8c289c9dfe1272f7f9cfc520be1acea44d89f91818ca704fd3ac204bdfa.exe
File created	C:\Windows\System\waVOSjD.exe	96bba8c289c9dfe1272f7f9cfc520be1acea44d89f91818ca704fd3ac204bdfa.exe
File created	C:\Windows\System\KvPhpra.exe	96bba8c289c9dfe1272f7f9cfc520be1acea44d89f91818ca704fd3ac204bdfa.exe
File created	C:\Windows\System\CtxAjkD.exe	96bba8c289c9dfe1272f7f9cfc520be1acea44d89f91818ca704fd3ac204bdfa.exe
File created	C:\Windows\System\UFOYtpf.exe	96bba8c289c9dfe1272f7f9cfc520be1acea44d89f91818ca704fd3ac204bdfa.exe
File created	C:\Windows\System\lnGHpPS.exe	96bba8c289c9dfe1272f7f9cfc520be1acea44d89f91818ca704fd3ac204bdfa.exe
File created	C:\Windows\System\PDJjmkd.exe	96bba8c289c9dfe1272f7f9cfc520be1acea44d89f91818ca704fd3ac204bdfa.exe
File created	C:\Windows\System\FJVvLSG.exe	96bba8c289c9dfe1272f7f9cfc520be1acea44d89f91818ca704fd3ac204bdfa.exe
File created	C:\Windows\System\qsKPiKA.exe	96bba8c289c9dfe1272f7f9cfc520be1acea44d89f91818ca704fd3ac204bdfa.exe
File created	C:\Windows\System\YvQNkFX.exe	96bba8c289c9dfe1272f7f9cfc520be1acea44d89f91818ca704fd3ac204bdfa.exe
File created	C:\Windows\System\arTOiKX.exe	96bba8c289c9dfe1272f7f9cfc520be1acea44d89f91818ca704fd3ac204bdfa.exe
File created	C:\Windows\System\KWtVJEI.exe	96bba8c289c9dfe1272f7f9cfc520be1acea44d89f91818ca704fd3ac204bdfa.exe
File created	C:\Windows\System\CAAukAh.exe	96bba8c289c9dfe1272f7f9cfc520be1acea44d89f91818ca704fd3ac204bdfa.exe
File created	C:\Windows\System\JPpMoLg.exe	96bba8c289c9dfe1272f7f9cfc520be1acea44d89f91818ca704fd3ac204bdfa.exe
File created	C:\Windows\System\CFbgatq.exe	96bba8c289c9dfe1272f7f9cfc520be1acea44d89f91818ca704fd3ac204bdfa.exe
File created	C:\Windows\System\SZgMeip.exe	96bba8c289c9dfe1272f7f9cfc520be1acea44d89f91818ca704fd3ac204bdfa.exe
File created	C:\Windows\System\peDVTYK.exe	96bba8c289c9dfe1272f7f9cfc520be1acea44d89f91818ca704fd3ac204bdfa.exe
File created	C:\Windows\System\blFQngm.exe	96bba8c289c9dfe1272f7f9cfc520be1acea44d89f91818ca704fd3ac204bdfa.exe
File created	C:\Windows\System\hjfhAyb.exe	96bba8c289c9dfe1272f7f9cfc520be1acea44d89f91818ca704fd3ac204bdfa.exe
File created	C:\Windows\System\svlxhZS.exe	96bba8c289c9dfe1272f7f9cfc520be1acea44d89f91818ca704fd3ac204bdfa.exe
File created	C:\Windows\System\dULLFTq.exe	96bba8c289c9dfe1272f7f9cfc520be1acea44d89f91818ca704fd3ac204bdfa.exe
File created	C:\Windows\System\KvccXYt.exe	96bba8c289c9dfe1272f7f9cfc520be1acea44d89f91818ca704fd3ac204bdfa.exe
File created	C:\Windows\System\PnDMhHH.exe	96bba8c289c9dfe1272f7f9cfc520be1acea44d89f91818ca704fd3ac204bdfa.exe
File created	C:\Windows\System\UuONjtw.exe	96bba8c289c9dfe1272f7f9cfc520be1acea44d89f91818ca704fd3ac204bdfa.exe
File created	C:\Windows\System\JpZZAWy.exe	96bba8c289c9dfe1272f7f9cfc520be1acea44d89f91818ca704fd3ac204bdfa.exe
File created	C:\Windows\System\HlWGpRN.exe	96bba8c289c9dfe1272f7f9cfc520be1acea44d89f91818ca704fd3ac204bdfa.exe
File created	C:\Windows\System\AONTVIY.exe	96bba8c289c9dfe1272f7f9cfc520be1acea44d89f91818ca704fd3ac204bdfa.exe
File created	C:\Windows\System\uGWpBUK.exe	96bba8c289c9dfe1272f7f9cfc520be1acea44d89f91818ca704fd3ac204bdfa.exe
File created	C:\Windows\System\jEXrNHO.exe	96bba8c289c9dfe1272f7f9cfc520be1acea44d89f91818ca704fd3ac204bdfa.exe
File created	C:\Windows\System\YefuVHG.exe	96bba8c289c9dfe1272f7f9cfc520be1acea44d89f91818ca704fd3ac204bdfa.exe
File created	C:\Windows\System\hbluIqo.exe	96bba8c289c9dfe1272f7f9cfc520be1acea44d89f91818ca704fd3ac204bdfa.exe
File created	C:\Windows\System\CIXcDqr.exe	96bba8c289c9dfe1272f7f9cfc520be1acea44d89f91818ca704fd3ac204bdfa.exe
File created	C:\Windows\System\fmyhxvn.exe	96bba8c289c9dfe1272f7f9cfc520be1acea44d89f91818ca704fd3ac204bdfa.exe
File created	C:\Windows\System\OMkAODs.exe	96bba8c289c9dfe1272f7f9cfc520be1acea44d89f91818ca704fd3ac204bdfa.exe
File created	C:\Windows\System\JANtMal.exe	96bba8c289c9dfe1272f7f9cfc520be1acea44d89f91818ca704fd3ac204bdfa.exe
File created	C:\Windows\System\CILOIfo.exe	96bba8c289c9dfe1272f7f9cfc520be1acea44d89f91818ca704fd3ac204bdfa.exe
File created	C:\Windows\System\vrkNTma.exe	96bba8c289c9dfe1272f7f9cfc520be1acea44d89f91818ca704fd3ac204bdfa.exe
File created	C:\Windows\System\fwkOOoI.exe	96bba8c289c9dfe1272f7f9cfc520be1acea44d89f91818ca704fd3ac204bdfa.exe
File created	C:\Windows\System\gWSCmzn.exe	96bba8c289c9dfe1272f7f9cfc520be1acea44d89f91818ca704fd3ac204bdfa.exe
File created	C:\Windows\System\YPmbGGP.exe	96bba8c289c9dfe1272f7f9cfc520be1acea44d89f91818ca704fd3ac204bdfa.exe
File created	C:\Windows\System\YJtyanA.exe	96bba8c289c9dfe1272f7f9cfc520be1acea44d89f91818ca704fd3ac204bdfa.exe
File created	C:\Windows\System\KIuiAKK.exe	96bba8c289c9dfe1272f7f9cfc520be1acea44d89f91818ca704fd3ac204bdfa.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4400	WPINgfG.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	17292	dwm.exe
Token: SeChangeNotifyPrivilege	17292	dwm.exe
Token: 33	17292	dwm.exe
Token: SeIncBasePriorityPrivilege	17292	dwm.exe
Token: SeShutdownPrivilege	17292	dwm.exe
Token: SeCreatePagefilePrivilege	17292	dwm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4612 wrote to memory of 1648	4612	96bba8c289c9dfe1272f7f9cfc520be1acea44d89f91818ca704fd3ac204bdfa.exe	85
PID 4612 wrote to memory of 1648	4612	96bba8c289c9dfe1272f7f9cfc520be1acea44d89f91818ca704fd3ac204bdfa.exe	85
PID 4612 wrote to memory of 4928	4612	96bba8c289c9dfe1272f7f9cfc520be1acea44d89f91818ca704fd3ac204bdfa.exe	86
PID 4612 wrote to memory of 4928	4612	96bba8c289c9dfe1272f7f9cfc520be1acea44d89f91818ca704fd3ac204bdfa.exe	86
PID 4612 wrote to memory of 2752	4612	96bba8c289c9dfe1272f7f9cfc520be1acea44d89f91818ca704fd3ac204bdfa.exe	87
PID 4612 wrote to memory of 2752	4612	96bba8c289c9dfe1272f7f9cfc520be1acea44d89f91818ca704fd3ac204bdfa.exe	87
PID 4612 wrote to memory of 1992	4612	96bba8c289c9dfe1272f7f9cfc520be1acea44d89f91818ca704fd3ac204bdfa.exe	88
PID 4612 wrote to memory of 1992	4612	96bba8c289c9dfe1272f7f9cfc520be1acea44d89f91818ca704fd3ac204bdfa.exe	88
PID 4612 wrote to memory of 2252	4612	96bba8c289c9dfe1272f7f9cfc520be1acea44d89f91818ca704fd3ac204bdfa.exe	89
PID 4612 wrote to memory of 2252	4612	96bba8c289c9dfe1272f7f9cfc520be1acea44d89f91818ca704fd3ac204bdfa.exe	89
PID 4612 wrote to memory of 2052	4612	96bba8c289c9dfe1272f7f9cfc520be1acea44d89f91818ca704fd3ac204bdfa.exe	90
PID 4612 wrote to memory of 2052	4612	96bba8c289c9dfe1272f7f9cfc520be1acea44d89f91818ca704fd3ac204bdfa.exe	90
PID 4612 wrote to memory of 2220	4612	96bba8c289c9dfe1272f7f9cfc520be1acea44d89f91818ca704fd3ac204bdfa.exe	91
PID 4612 wrote to memory of 2220	4612	96bba8c289c9dfe1272f7f9cfc520be1acea44d89f91818ca704fd3ac204bdfa.exe	91
PID 4612 wrote to memory of 2020	4612	96bba8c289c9dfe1272f7f9cfc520be1acea44d89f91818ca704fd3ac204bdfa.exe	92
PID 4612 wrote to memory of 2020	4612	96bba8c289c9dfe1272f7f9cfc520be1acea44d89f91818ca704fd3ac204bdfa.exe	92
PID 4612 wrote to memory of 1416	4612	96bba8c289c9dfe1272f7f9cfc520be1acea44d89f91818ca704fd3ac204bdfa.exe	93
PID 4612 wrote to memory of 1416	4612	96bba8c289c9dfe1272f7f9cfc520be1acea44d89f91818ca704fd3ac204bdfa.exe	93
PID 4612 wrote to memory of 4072	4612	96bba8c289c9dfe1272f7f9cfc520be1acea44d89f91818ca704fd3ac204bdfa.exe	94
PID 4612 wrote to memory of 4072	4612	96bba8c289c9dfe1272f7f9cfc520be1acea44d89f91818ca704fd3ac204bdfa.exe	94
PID 4612 wrote to memory of 1704	4612	96bba8c289c9dfe1272f7f9cfc520be1acea44d89f91818ca704fd3ac204bdfa.exe	95
PID 4612 wrote to memory of 1704	4612	96bba8c289c9dfe1272f7f9cfc520be1acea44d89f91818ca704fd3ac204bdfa.exe	95
PID 4612 wrote to memory of 1600	4612	96bba8c289c9dfe1272f7f9cfc520be1acea44d89f91818ca704fd3ac204bdfa.exe	96
PID 4612 wrote to memory of 1600	4612	96bba8c289c9dfe1272f7f9cfc520be1acea44d89f91818ca704fd3ac204bdfa.exe	96
PID 4612 wrote to memory of 4824	4612	96bba8c289c9dfe1272f7f9cfc520be1acea44d89f91818ca704fd3ac204bdfa.exe	99
PID 4612 wrote to memory of 4824	4612	96bba8c289c9dfe1272f7f9cfc520be1acea44d89f91818ca704fd3ac204bdfa.exe	99
PID 4612 wrote to memory of 4904	4612	96bba8c289c9dfe1272f7f9cfc520be1acea44d89f91818ca704fd3ac204bdfa.exe	100
PID 4612 wrote to memory of 4904	4612	96bba8c289c9dfe1272f7f9cfc520be1acea44d89f91818ca704fd3ac204bdfa.exe	100
PID 4612 wrote to memory of 3028	4612	96bba8c289c9dfe1272f7f9cfc520be1acea44d89f91818ca704fd3ac204bdfa.exe	101
PID 4612 wrote to memory of 3028	4612	96bba8c289c9dfe1272f7f9cfc520be1acea44d89f91818ca704fd3ac204bdfa.exe	101
PID 4612 wrote to memory of 4780	4612	96bba8c289c9dfe1272f7f9cfc520be1acea44d89f91818ca704fd3ac204bdfa.exe	102
PID 4612 wrote to memory of 4780	4612	96bba8c289c9dfe1272f7f9cfc520be1acea44d89f91818ca704fd3ac204bdfa.exe	102
PID 4612 wrote to memory of 3568	4612	96bba8c289c9dfe1272f7f9cfc520be1acea44d89f91818ca704fd3ac204bdfa.exe	103
PID 4612 wrote to memory of 3568	4612	96bba8c289c9dfe1272f7f9cfc520be1acea44d89f91818ca704fd3ac204bdfa.exe	103
PID 4612 wrote to memory of 4732	4612	96bba8c289c9dfe1272f7f9cfc520be1acea44d89f91818ca704fd3ac204bdfa.exe	104
PID 4612 wrote to memory of 4732	4612	96bba8c289c9dfe1272f7f9cfc520be1acea44d89f91818ca704fd3ac204bdfa.exe	104
PID 4612 wrote to memory of 3472	4612	96bba8c289c9dfe1272f7f9cfc520be1acea44d89f91818ca704fd3ac204bdfa.exe	105
PID 4612 wrote to memory of 3472	4612	96bba8c289c9dfe1272f7f9cfc520be1acea44d89f91818ca704fd3ac204bdfa.exe	105
PID 4612 wrote to memory of 4944	4612	96bba8c289c9dfe1272f7f9cfc520be1acea44d89f91818ca704fd3ac204bdfa.exe	106
PID 4612 wrote to memory of 4944	4612	96bba8c289c9dfe1272f7f9cfc520be1acea44d89f91818ca704fd3ac204bdfa.exe	106
PID 4612 wrote to memory of 4400	4612	96bba8c289c9dfe1272f7f9cfc520be1acea44d89f91818ca704fd3ac204bdfa.exe	107
PID 4612 wrote to memory of 4400	4612	96bba8c289c9dfe1272f7f9cfc520be1acea44d89f91818ca704fd3ac204bdfa.exe	107
PID 4612 wrote to memory of 3600	4612	96bba8c289c9dfe1272f7f9cfc520be1acea44d89f91818ca704fd3ac204bdfa.exe	108
PID 4612 wrote to memory of 3600	4612	96bba8c289c9dfe1272f7f9cfc520be1acea44d89f91818ca704fd3ac204bdfa.exe	108
PID 4612 wrote to memory of 4752	4612	96bba8c289c9dfe1272f7f9cfc520be1acea44d89f91818ca704fd3ac204bdfa.exe	109
PID 4612 wrote to memory of 4752	4612	96bba8c289c9dfe1272f7f9cfc520be1acea44d89f91818ca704fd3ac204bdfa.exe	109
PID 4612 wrote to memory of 3144	4612	96bba8c289c9dfe1272f7f9cfc520be1acea44d89f91818ca704fd3ac204bdfa.exe	110
PID 4612 wrote to memory of 3144	4612	96bba8c289c9dfe1272f7f9cfc520be1acea44d89f91818ca704fd3ac204bdfa.exe	110
PID 4612 wrote to memory of 220	4612	96bba8c289c9dfe1272f7f9cfc520be1acea44d89f91818ca704fd3ac204bdfa.exe	111
PID 4612 wrote to memory of 220	4612	96bba8c289c9dfe1272f7f9cfc520be1acea44d89f91818ca704fd3ac204bdfa.exe	111
PID 4612 wrote to memory of 3920	4612	96bba8c289c9dfe1272f7f9cfc520be1acea44d89f91818ca704fd3ac204bdfa.exe	112
PID 4612 wrote to memory of 3920	4612	96bba8c289c9dfe1272f7f9cfc520be1acea44d89f91818ca704fd3ac204bdfa.exe	112
PID 4612 wrote to memory of 2796	4612	96bba8c289c9dfe1272f7f9cfc520be1acea44d89f91818ca704fd3ac204bdfa.exe	113
PID 4612 wrote to memory of 2796	4612	96bba8c289c9dfe1272f7f9cfc520be1acea44d89f91818ca704fd3ac204bdfa.exe	113
PID 4612 wrote to memory of 1168	4612	96bba8c289c9dfe1272f7f9cfc520be1acea44d89f91818ca704fd3ac204bdfa.exe	114
PID 4612 wrote to memory of 1168	4612	96bba8c289c9dfe1272f7f9cfc520be1acea44d89f91818ca704fd3ac204bdfa.exe	114
PID 4612 wrote to memory of 2904	4612	96bba8c289c9dfe1272f7f9cfc520be1acea44d89f91818ca704fd3ac204bdfa.exe	115
PID 4612 wrote to memory of 2904	4612	96bba8c289c9dfe1272f7f9cfc520be1acea44d89f91818ca704fd3ac204bdfa.exe	115
PID 4612 wrote to memory of 4488	4612	96bba8c289c9dfe1272f7f9cfc520be1acea44d89f91818ca704fd3ac204bdfa.exe	116
PID 4612 wrote to memory of 4488	4612	96bba8c289c9dfe1272f7f9cfc520be1acea44d89f91818ca704fd3ac204bdfa.exe	116
PID 4612 wrote to memory of 1896	4612	96bba8c289c9dfe1272f7f9cfc520be1acea44d89f91818ca704fd3ac204bdfa.exe	117
PID 4612 wrote to memory of 1896	4612	96bba8c289c9dfe1272f7f9cfc520be1acea44d89f91818ca704fd3ac204bdfa.exe	117
PID 4612 wrote to memory of 4984	4612	96bba8c289c9dfe1272f7f9cfc520be1acea44d89f91818ca704fd3ac204bdfa.exe	118
PID 4612 wrote to memory of 4984	4612	96bba8c289c9dfe1272f7f9cfc520be1acea44d89f91818ca704fd3ac204bdfa.exe	118

C:\Users\Admin\AppData\Local\Temp\96bba8c289c9dfe1272f7f9cfc520be1acea44d89f91818ca704fd3ac204bdfa.exe
"C:\Users\Admin\AppData\Local\Temp\96bba8c289c9dfe1272f7f9cfc520be1acea44d89f91818ca704fd3ac204bdfa.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4612
- C:\Windows\System\jtiamgf.exe
  C:\Windows\System\jtiamgf.exe
  2⤵
  - Executes dropped EXE
  PID:1648
- C:\Windows\System\uUnTIHq.exe
  C:\Windows\System\uUnTIHq.exe
  2⤵
  - Executes dropped EXE
  PID:4928
- C:\Windows\System\XCfQZUn.exe
  C:\Windows\System\XCfQZUn.exe
  2⤵
  - Executes dropped EXE
  PID:2752
- C:\Windows\System\XyhNOrG.exe
  C:\Windows\System\XyhNOrG.exe
  2⤵
  - Executes dropped EXE
  PID:1992
- C:\Windows\System\aAfcQLy.exe
  C:\Windows\System\aAfcQLy.exe
  2⤵
  - Executes dropped EXE
  PID:2252
- C:\Windows\System\RoFhAZy.exe
  C:\Windows\System\RoFhAZy.exe
  2⤵
  - Executes dropped EXE
  PID:2052
- C:\Windows\System\ACYqIhx.exe
  C:\Windows\System\ACYqIhx.exe
  2⤵
  - Executes dropped EXE
  PID:2220
- C:\Windows\System\wXBBiLE.exe
  C:\Windows\System\wXBBiLE.exe
  2⤵
  - Executes dropped EXE
  PID:2020
- C:\Windows\System\QHPYqtq.exe
  C:\Windows\System\QHPYqtq.exe
  2⤵
  - Executes dropped EXE
  PID:1416
- C:\Windows\System\peDVTYK.exe
  C:\Windows\System\peDVTYK.exe
  2⤵
  - Executes dropped EXE
  PID:4072
- C:\Windows\System\SoOErtd.exe
  C:\Windows\System\SoOErtd.exe
  2⤵
  - Executes dropped EXE
  PID:1704
- C:\Windows\System\DmzvAlY.exe
  C:\Windows\System\DmzvAlY.exe
  2⤵
  - Executes dropped EXE
  PID:1600
- C:\Windows\System\PsvCFQc.exe
  C:\Windows\System\PsvCFQc.exe
  2⤵
  - Executes dropped EXE
  PID:4824
- C:\Windows\System\hAwGyTx.exe
  C:\Windows\System\hAwGyTx.exe
  2⤵
  - Executes dropped EXE
  PID:4904
- C:\Windows\System\WIaDdPN.exe
  C:\Windows\System\WIaDdPN.exe
  2⤵
  - Executes dropped EXE
  PID:3028
- C:\Windows\System\FvuYcbP.exe
  C:\Windows\System\FvuYcbP.exe
  2⤵
  - Executes dropped EXE
  PID:4780
- C:\Windows\System\kvnbzxq.exe
  C:\Windows\System\kvnbzxq.exe
  2⤵
  - Executes dropped EXE
  PID:3568
- C:\Windows\System\CVBwgBe.exe
  C:\Windows\System\CVBwgBe.exe
  2⤵
  - Executes dropped EXE
  PID:4732
- C:\Windows\System\hqetVlb.exe
  C:\Windows\System\hqetVlb.exe
  2⤵
  - Executes dropped EXE
  PID:3472
- C:\Windows\System\byTZNro.exe
  C:\Windows\System\byTZNro.exe
  2⤵
  - Executes dropped EXE
  PID:4944
- C:\Windows\System\WPINgfG.exe
  C:\Windows\System\WPINgfG.exe
  2⤵
  - Executes dropped EXE
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:4400
- C:\Windows\System\OeDweIO.exe
  C:\Windows\System\OeDweIO.exe
  2⤵
  - Executes dropped EXE
  PID:3600
- C:\Windows\System\CIXcDqr.exe
  C:\Windows\System\CIXcDqr.exe
  2⤵
  - Executes dropped EXE
  PID:4752
- C:\Windows\System\MZldGfH.exe
  C:\Windows\System\MZldGfH.exe
  2⤵
  - Executes dropped EXE
  PID:3144
- C:\Windows\System\VDyJthD.exe
  C:\Windows\System\VDyJthD.exe
  2⤵
  - Executes dropped EXE
  PID:220
- C:\Windows\System\ihvlKCj.exe
  C:\Windows\System\ihvlKCj.exe
  2⤵
  - Executes dropped EXE
  PID:3920
- C:\Windows\System\kDJTDLh.exe
  C:\Windows\System\kDJTDLh.exe
  2⤵
  - Executes dropped EXE
  PID:2796
- C:\Windows\System\JANtMal.exe
  C:\Windows\System\JANtMal.exe
  2⤵
  - Executes dropped EXE
  PID:1168
- C:\Windows\System\WxyeUye.exe
  C:\Windows\System\WxyeUye.exe
  2⤵
  - Executes dropped EXE
  PID:2904
- C:\Windows\System\pefkFZM.exe
  C:\Windows\System\pefkFZM.exe
  2⤵
  - Executes dropped EXE
  PID:4488
- C:\Windows\System\wRNTNUU.exe
  C:\Windows\System\wRNTNUU.exe
  2⤵
  - Executes dropped EXE
  PID:1896
- C:\Windows\System\GrRTQpy.exe
  C:\Windows\System\GrRTQpy.exe
  2⤵
  - Executes dropped EXE
  PID:4984
- C:\Windows\System\sUWTgFr.exe
  C:\Windows\System\sUWTgFr.exe
  2⤵
  - Executes dropped EXE
  PID:1864
- C:\Windows\System\cxaphIU.exe
  C:\Windows\System\cxaphIU.exe
  2⤵
  - Executes dropped EXE
  PID:4684
- C:\Windows\System\EpDVUaP.exe
  C:\Windows\System\EpDVUaP.exe
  2⤵
  - Executes dropped EXE
  PID:2592
- C:\Windows\System\NrGLOJQ.exe
  C:\Windows\System\NrGLOJQ.exe
  2⤵
  - Executes dropped EXE
  PID:3220
- C:\Windows\System\YhRwBpJ.exe
  C:\Windows\System\YhRwBpJ.exe
  2⤵
  - Executes dropped EXE
  PID:3888
- C:\Windows\System\wLxFbMk.exe
  C:\Windows\System\wLxFbMk.exe
  2⤵
  - Executes dropped EXE
  PID:1912
- C:\Windows\System\pGtmbCw.exe
  C:\Windows\System\pGtmbCw.exe
  2⤵
  - Executes dropped EXE
  PID:752
- C:\Windows\System\iIQjyiv.exe
  C:\Windows\System\iIQjyiv.exe
  2⤵
  - Executes dropped EXE
  PID:2388
- C:\Windows\System\eidFQnS.exe
  C:\Windows\System\eidFQnS.exe
  2⤵
  - Executes dropped EXE
  PID:1772
- C:\Windows\System\aDZWrpF.exe
  C:\Windows\System\aDZWrpF.exe
  2⤵
  - Executes dropped EXE
  PID:512
- C:\Windows\System\qhlOWUB.exe
  C:\Windows\System\qhlOWUB.exe
  2⤵
  - Executes dropped EXE
  PID:3880
- C:\Windows\System\DMXMAtA.exe
  C:\Windows\System\DMXMAtA.exe
  2⤵
  - Executes dropped EXE
  PID:3440
- C:\Windows\System\JaAiFpL.exe
  C:\Windows\System\JaAiFpL.exe
  2⤵
  - Executes dropped EXE
  PID:2660
- C:\Windows\System\oDCWDep.exe
  C:\Windows\System\oDCWDep.exe
  2⤵
  - Executes dropped EXE
  PID:4272
- C:\Windows\System\CSipGbD.exe
  C:\Windows\System\CSipGbD.exe
  2⤵
  - Executes dropped EXE
  PID:4748
- C:\Windows\System\YvQNkFX.exe
  C:\Windows\System\YvQNkFX.exe
  2⤵
  - Executes dropped EXE
  PID:640
- C:\Windows\System\wKOqiou.exe
  C:\Windows\System\wKOqiou.exe
  2⤵
  - Executes dropped EXE
  PID:2120
- C:\Windows\System\kgjWVPi.exe
  C:\Windows\System\kgjWVPi.exe
  2⤵
  - Executes dropped EXE
  PID:1604
- C:\Windows\System\vdzGJOn.exe
  C:\Windows\System\vdzGJOn.exe
  2⤵
  - Executes dropped EXE
  PID:3908
- C:\Windows\System\mDbGnVj.exe
  C:\Windows\System\mDbGnVj.exe
  2⤵
  - Executes dropped EXE
  PID:3196
- C:\Windows\System\eaUYjut.exe
  C:\Windows\System\eaUYjut.exe
  2⤵
  - Executes dropped EXE
  PID:2880
- C:\Windows\System\FxwjWJg.exe
  C:\Windows\System\FxwjWJg.exe
  2⤵
  - Executes dropped EXE
  PID:116
- C:\Windows\System\ZYhHlip.exe
  C:\Windows\System\ZYhHlip.exe
  2⤵
  - Executes dropped EXE
  PID:1016
- C:\Windows\System\mEkTjos.exe
  C:\Windows\System\mEkTjos.exe
  2⤵
  - Executes dropped EXE
  PID:3076
- C:\Windows\System\MouvoMB.exe
  C:\Windows\System\MouvoMB.exe
  2⤵
  - Executes dropped EXE
  PID:2304
- C:\Windows\System\sMbbPEa.exe
  C:\Windows\System\sMbbPEa.exe
  2⤵
  - Executes dropped EXE
  PID:1396
- C:\Windows\System\lxwbLXU.exe
  C:\Windows\System\lxwbLXU.exe
  2⤵
  - Executes dropped EXE
  PID:1248
- C:\Windows\System\pMPrdot.exe
  C:\Windows\System\pMPrdot.exe
  2⤵
  - Executes dropped EXE
  PID:2972
- C:\Windows\System\AyTauxr.exe
  C:\Windows\System\AyTauxr.exe
  2⤵
  - Executes dropped EXE
  PID:976
- C:\Windows\System\WEqTUoS.exe
  C:\Windows\System\WEqTUoS.exe
  2⤵
  - Executes dropped EXE
  PID:2612
- C:\Windows\System\ciLwayl.exe
  C:\Windows\System\ciLwayl.exe
  2⤵
  - Executes dropped EXE
  PID:4060
- C:\Windows\System\LBBDPsJ.exe
  C:\Windows\System\LBBDPsJ.exe
  2⤵
  - Executes dropped EXE
  PID:1408
- C:\Windows\System\psEOUcF.exe
  C:\Windows\System\psEOUcF.exe
  2⤵
  PID:4020
- C:\Windows\System\grNTIBf.exe
  C:\Windows\System\grNTIBf.exe
  2⤵
  PID:4808
- C:\Windows\System\vmsdBkO.exe
  C:\Windows\System\vmsdBkO.exe
  2⤵
  PID:948
- C:\Windows\System\doIXRNz.exe
  C:\Windows\System\doIXRNz.exe
  2⤵
  PID:2408
- C:\Windows\System\XsnUTWt.exe
  C:\Windows\System\XsnUTWt.exe
  2⤵
  PID:1828
- C:\Windows\System\BfhAdWP.exe
  C:\Windows\System\BfhAdWP.exe
  2⤵
  PID:2152
- C:\Windows\System\uBKXXIs.exe
  C:\Windows\System\uBKXXIs.exe
  2⤵
  PID:820
- C:\Windows\System\QNqIfAu.exe
  C:\Windows\System\QNqIfAu.exe
  2⤵
  PID:5036
- C:\Windows\System\qeYJdcB.exe
  C:\Windows\System\qeYJdcB.exe
  2⤵
  PID:1580
- C:\Windows\System\bcqTCwz.exe
  C:\Windows\System\bcqTCwz.exe
  2⤵
  PID:4900
- C:\Windows\System\jEXrNHO.exe
  C:\Windows\System\jEXrNHO.exe
  2⤵
  PID:4204
- C:\Windows\System\CILOIfo.exe
  C:\Windows\System\CILOIfo.exe
  2⤵
  PID:3376
- C:\Windows\System\hHWHhTH.exe
  C:\Windows\System\hHWHhTH.exe
  2⤵
  PID:3636
- C:\Windows\System\EmDxiZC.exe
  C:\Windows\System\EmDxiZC.exe
  2⤵
  PID:1400
- C:\Windows\System\mBGLKvD.exe
  C:\Windows\System\mBGLKvD.exe
  2⤵
  PID:3488
- C:\Windows\System\OuQLkUR.exe
  C:\Windows\System\OuQLkUR.exe
  2⤵
  PID:688
- C:\Windows\System\sOruJwi.exe
  C:\Windows\System\sOruJwi.exe
  2⤵
  PID:3364
- C:\Windows\System\aHNZrIe.exe
  C:\Windows\System\aHNZrIe.exe
  2⤵
  PID:5052
- C:\Windows\System\mkwtqxm.exe
  C:\Windows\System\mkwtqxm.exe
  2⤵
  PID:1444
- C:\Windows\System\BXuAlDp.exe
  C:\Windows\System\BXuAlDp.exe
  2⤵
  PID:456
- C:\Windows\System\dqZBdzS.exe
  C:\Windows\System\dqZBdzS.exe
  2⤵
  PID:4388
- C:\Windows\System\EGtGqbh.exe
  C:\Windows\System\EGtGqbh.exe
  2⤵
  PID:4736
- C:\Windows\System\LpgNidd.exe
  C:\Windows\System\LpgNidd.exe
  2⤵
  PID:4608
- C:\Windows\System\jagCqGT.exe
  C:\Windows\System\jagCqGT.exe
  2⤵
  PID:1040
- C:\Windows\System\HsSasYq.exe
  C:\Windows\System\HsSasYq.exe
  2⤵
  PID:448
- C:\Windows\System\cPehyNB.exe
  C:\Windows\System\cPehyNB.exe
  2⤵
  PID:4892
- C:\Windows\System\SupdSUR.exe
  C:\Windows\System\SupdSUR.exe
  2⤵
  PID:3852
- C:\Windows\System\ssAUkFY.exe
  C:\Windows\System\ssAUkFY.exe
  2⤵
  PID:1076
- C:\Windows\System\uLaEILI.exe
  C:\Windows\System\uLaEILI.exe
  2⤵
  PID:3208
- C:\Windows\System\XKNDZsB.exe
  C:\Windows\System\XKNDZsB.exe
  2⤵
  PID:4304
- C:\Windows\System\WLaiVfU.exe
  C:\Windows\System\WLaiVfU.exe
  2⤵
  PID:1620
- C:\Windows\System\oMMXczx.exe
  C:\Windows\System\oMMXczx.exe
  2⤵
  PID:3460
- C:\Windows\System\QTtfLZz.exe
  C:\Windows\System\QTtfLZz.exe
  2⤵
  PID:1568
- C:\Windows\System\qIZFZzE.exe
  C:\Windows\System\qIZFZzE.exe
  2⤵
  PID:2280
- C:\Windows\System\YefuVHG.exe
  C:\Windows\System\YefuVHG.exe
  2⤵
  PID:4296
- C:\Windows\System\qZDRFkj.exe
  C:\Windows\System\qZDRFkj.exe
  2⤵
  PID:4000
- C:\Windows\System\zpuLrDB.exe
  C:\Windows\System\zpuLrDB.exe
  2⤵
  PID:2124
- C:\Windows\System\veCIoVf.exe
  C:\Windows\System\veCIoVf.exe
  2⤵
  PID:5144
- C:\Windows\System\EiXZUbH.exe
  C:\Windows\System\EiXZUbH.exe
  2⤵
  PID:5176
- C:\Windows\System\SeqXIMI.exe
  C:\Windows\System\SeqXIMI.exe
  2⤵
  PID:5200
- C:\Windows\System\ELpZBhK.exe
  C:\Windows\System\ELpZBhK.exe
  2⤵
  PID:5228
- C:\Windows\System\aIFLZFs.exe
  C:\Windows\System\aIFLZFs.exe
  2⤵
  PID:5260
- C:\Windows\System\eruMXhH.exe
  C:\Windows\System\eruMXhH.exe
  2⤵
  PID:5284
- C:\Windows\System\LfPZSRk.exe
  C:\Windows\System\LfPZSRk.exe
  2⤵
  PID:5300
- C:\Windows\System\auRojfp.exe
  C:\Windows\System\auRojfp.exe
  2⤵
  PID:5332
- C:\Windows\System\AOFDdcy.exe
  C:\Windows\System\AOFDdcy.exe
  2⤵
  PID:5368
- C:\Windows\System\JWIGvYn.exe
  C:\Windows\System\JWIGvYn.exe
  2⤵
  PID:5388
- C:\Windows\System\CEabgmK.exe
  C:\Windows\System\CEabgmK.exe
  2⤵
  PID:5424
- C:\Windows\System\DdqpMsQ.exe
  C:\Windows\System\DdqpMsQ.exe
  2⤵
  PID:5464
- C:\Windows\System\gCFzBAZ.exe
  C:\Windows\System\gCFzBAZ.exe
  2⤵
  PID:5516
- C:\Windows\System\YHrjcne.exe
  C:\Windows\System\YHrjcne.exe
  2⤵
  PID:5532
- C:\Windows\System\LMABXBy.exe
  C:\Windows\System\LMABXBy.exe
  2⤵
  PID:5560
- C:\Windows\System\HkxbnJi.exe
  C:\Windows\System\HkxbnJi.exe
  2⤵
  PID:5580
- C:\Windows\System\rpcpSWF.exe
  C:\Windows\System\rpcpSWF.exe
  2⤵
  PID:5600
- C:\Windows\System\ciZKKcH.exe
  C:\Windows\System\ciZKKcH.exe
  2⤵
  PID:5632
- C:\Windows\System\iitFIlA.exe
  C:\Windows\System\iitFIlA.exe
  2⤵
  PID:5660
- C:\Windows\System\yvxmFqk.exe
  C:\Windows\System\yvxmFqk.exe
  2⤵
  PID:5684
- C:\Windows\System\UlBPyuw.exe
  C:\Windows\System\UlBPyuw.exe
  2⤵
  PID:5708
- C:\Windows\System\dXUscTN.exe
  C:\Windows\System\dXUscTN.exe
  2⤵
  PID:5740
- C:\Windows\System\xxOUzUZ.exe
  C:\Windows\System\xxOUzUZ.exe
  2⤵
  PID:5756
- C:\Windows\System\hROhGok.exe
  C:\Windows\System\hROhGok.exe
  2⤵
  PID:5784
- C:\Windows\System\lWTQqmX.exe
  C:\Windows\System\lWTQqmX.exe
  2⤵
  PID:5808
- C:\Windows\System\xwajCCA.exe
  C:\Windows\System\xwajCCA.exe
  2⤵
  PID:5836
- C:\Windows\System\bgkmRCa.exe
  C:\Windows\System\bgkmRCa.exe
  2⤵
  PID:5864
- C:\Windows\System\tacKPNj.exe
  C:\Windows\System\tacKPNj.exe
  2⤵
  PID:5880
- C:\Windows\System\xXbgFRj.exe
  C:\Windows\System\xXbgFRj.exe
  2⤵
  PID:5912
- C:\Windows\System\TkGMLvc.exe
  C:\Windows\System\TkGMLvc.exe
  2⤵
  PID:5944
- C:\Windows\System\UuONjtw.exe
  C:\Windows\System\UuONjtw.exe
  2⤵
  PID:5972
- C:\Windows\System\MOARQku.exe
  C:\Windows\System\MOARQku.exe
  2⤵
  PID:6000
- C:\Windows\System\TFIrpHE.exe
  C:\Windows\System\TFIrpHE.exe
  2⤵
  PID:6024
- C:\Windows\System\evnheQv.exe
  C:\Windows\System\evnheQv.exe
  2⤵
  PID:6052
- C:\Windows\System\AAexVkO.exe
  C:\Windows\System\AAexVkO.exe
  2⤵
  PID:6080
- C:\Windows\System\lxUfYJd.exe
  C:\Windows\System\lxUfYJd.exe
  2⤵
  PID:6112
- C:\Windows\System\sTGHEXv.exe
  C:\Windows\System\sTGHEXv.exe
  2⤵
  PID:5124
- C:\Windows\System\VwMkBwl.exe
  C:\Windows\System\VwMkBwl.exe
  2⤵
  PID:5192
- C:\Windows\System\HlWGpRN.exe
  C:\Windows\System\HlWGpRN.exe
  2⤵
  PID:5252
- C:\Windows\System\ejxGDup.exe
  C:\Windows\System\ejxGDup.exe
  2⤵
  PID:5320
- C:\Windows\System\BLMMSBE.exe
  C:\Windows\System\BLMMSBE.exe
  2⤵
  PID:5376
- C:\Windows\System\blFQngm.exe
  C:\Windows\System\blFQngm.exe
  2⤵
  PID:5448
- C:\Windows\System\yGaUXxh.exe
  C:\Windows\System\yGaUXxh.exe
  2⤵
  PID:5524
- C:\Windows\System\KJYVWBK.exe
  C:\Windows\System\KJYVWBK.exe
  2⤵
  PID:5576
- C:\Windows\System\CixQHjo.exe
  C:\Windows\System\CixQHjo.exe
  2⤵
  PID:5680
- C:\Windows\System\SfWIOTN.exe
  C:\Windows\System\SfWIOTN.exe
  2⤵
  PID:5772
- C:\Windows\System\pzAjoUv.exe
  C:\Windows\System\pzAjoUv.exe
  2⤵
  PID:5724
- C:\Windows\System\syvfptR.exe
  C:\Windows\System\syvfptR.exe
  2⤵
  PID:5852
- C:\Windows\System\EZVsecQ.exe
  C:\Windows\System\EZVsecQ.exe
  2⤵
  PID:5964
- C:\Windows\System\CxQyRdj.exe
  C:\Windows\System\CxQyRdj.exe
  2⤵
  PID:5984
- C:\Windows\System\acvgMQv.exe
  C:\Windows\System\acvgMQv.exe
  2⤵
  PID:6076
- C:\Windows\System\NQMPrmB.exe
  C:\Windows\System\NQMPrmB.exe
  2⤵
  PID:6132
- C:\Windows\System\JPpMoLg.exe
  C:\Windows\System\JPpMoLg.exe
  2⤵
  PID:5292
- C:\Windows\System\bXFwOoU.exe
  C:\Windows\System\bXFwOoU.exe
  2⤵
  PID:5296
- C:\Windows\System\AONTVIY.exe
  C:\Windows\System\AONTVIY.exe
  2⤵
  PID:5552
- C:\Windows\System\vqcptsA.exe
  C:\Windows\System\vqcptsA.exe
  2⤵
  PID:5592
- C:\Windows\System\ANVCdVF.exe
  C:\Windows\System\ANVCdVF.exe
  2⤵
  PID:5848
- C:\Windows\System\eEXiRAR.exe
  C:\Windows\System\eEXiRAR.exe
  2⤵
  PID:5988
- C:\Windows\System\KyrUokn.exe
  C:\Windows\System\KyrUokn.exe
  2⤵
  PID:6048
- C:\Windows\System\CsfnRzs.exe
  C:\Windows\System\CsfnRzs.exe
  2⤵
  PID:5280
- C:\Windows\System\zsyMfFY.exe
  C:\Windows\System\zsyMfFY.exe
  2⤵
  PID:6156
- C:\Windows\System\QgHmMsj.exe
  C:\Windows\System\QgHmMsj.exe
  2⤵
  PID:6188
- C:\Windows\System\IuWTbFH.exe
  C:\Windows\System\IuWTbFH.exe
  2⤵
  PID:6220
- C:\Windows\System\ytDkucU.exe
  C:\Windows\System\ytDkucU.exe
  2⤵
  PID:6244
- C:\Windows\System\YIPXRHW.exe
  C:\Windows\System\YIPXRHW.exe
  2⤵
  PID:6276
- C:\Windows\System\AarlFWr.exe
  C:\Windows\System\AarlFWr.exe
  2⤵
  PID:6308
- C:\Windows\System\uBSxrqU.exe
  C:\Windows\System\uBSxrqU.exe
  2⤵
  PID:6336
- C:\Windows\System\JrMUtMH.exe
  C:\Windows\System\JrMUtMH.exe
  2⤵
  PID:6364
- C:\Windows\System\JBVKOnV.exe
  C:\Windows\System\JBVKOnV.exe
  2⤵
  PID:6396
- C:\Windows\System\JeLwdGk.exe
  C:\Windows\System\JeLwdGk.exe
  2⤵
  PID:6436
- C:\Windows\System\kBVLMPx.exe
  C:\Windows\System\kBVLMPx.exe
  2⤵
  PID:6460
- C:\Windows\System\YmKsxDq.exe
  C:\Windows\System\YmKsxDq.exe
  2⤵
  PID:6492
- C:\Windows\System\NRBAOyg.exe
  C:\Windows\System\NRBAOyg.exe
  2⤵
  PID:6512
- C:\Windows\System\BuoiYtx.exe
  C:\Windows\System\BuoiYtx.exe
  2⤵
  PID:6544
- C:\Windows\System\sPMjpab.exe
  C:\Windows\System\sPMjpab.exe
  2⤵
  PID:6572
- C:\Windows\System\MLVZdBr.exe
  C:\Windows\System\MLVZdBr.exe
  2⤵
  PID:6608
- C:\Windows\System\QeQYSgr.exe
  C:\Windows\System\QeQYSgr.exe
  2⤵
  PID:6632
- C:\Windows\System\YTnHknE.exe
  C:\Windows\System\YTnHknE.exe
  2⤵
  PID:6664
- C:\Windows\System\qbKVGjS.exe
  C:\Windows\System\qbKVGjS.exe
  2⤵
  PID:6696
- C:\Windows\System\vLgBODv.exe
  C:\Windows\System\vLgBODv.exe
  2⤵
  PID:6720
- C:\Windows\System\ajVDmPa.exe
  C:\Windows\System\ajVDmPa.exe
  2⤵
  PID:6748
- C:\Windows\System\vrkNTma.exe
  C:\Windows\System\vrkNTma.exe
  2⤵
  PID:6776
- C:\Windows\System\hVKUzUH.exe
  C:\Windows\System\hVKUzUH.exe
  2⤵
  PID:6800
- C:\Windows\System\xtnNhKD.exe
  C:\Windows\System\xtnNhKD.exe
  2⤵
  PID:6836
- C:\Windows\System\fbddDkt.exe
  C:\Windows\System\fbddDkt.exe
  2⤵
  PID:6868
- C:\Windows\System\oeceoGW.exe
  C:\Windows\System\oeceoGW.exe
  2⤵
  PID:6904
- C:\Windows\System\SdqFhOR.exe
  C:\Windows\System\SdqFhOR.exe
  2⤵
  PID:6936
- C:\Windows\System\FYpnAuU.exe
  C:\Windows\System\FYpnAuU.exe
  2⤵
  PID:6960
- C:\Windows\System\GDqxYds.exe
  C:\Windows\System\GDqxYds.exe
  2⤵
  PID:6988
- C:\Windows\System\oEoXSDA.exe
  C:\Windows\System\oEoXSDA.exe
  2⤵
  PID:7016
- C:\Windows\System\WpvGxPl.exe
  C:\Windows\System\WpvGxPl.exe
  2⤵
  PID:7044
- C:\Windows\System\OvKSRAi.exe
  C:\Windows\System\OvKSRAi.exe
  2⤵
  PID:7076
- C:\Windows\System\mgJYTpy.exe
  C:\Windows\System\mgJYTpy.exe
  2⤵
  PID:7100
- C:\Windows\System\WqZNPZA.exe
  C:\Windows\System\WqZNPZA.exe
  2⤵
  PID:7128
- C:\Windows\System\teKMNzu.exe
  C:\Windows\System\teKMNzu.exe
  2⤵
  PID:7160
- C:\Windows\System\BtadSdW.exe
  C:\Windows\System\BtadSdW.exe
  2⤵
  PID:5132
- C:\Windows\System\mCmqCOJ.exe
  C:\Windows\System\mCmqCOJ.exe
  2⤵
  PID:6172
- C:\Windows\System\jrfCBFT.exe
  C:\Windows\System\jrfCBFT.exe
  2⤵
  PID:6208
- C:\Windows\System\AQccxfe.exe
  C:\Windows\System\AQccxfe.exe
  2⤵
  PID:6328
- C:\Windows\System\ieCAavO.exe
  C:\Windows\System\ieCAavO.exe
  2⤵
  PID:6412
- C:\Windows\System\pritDNW.exe
  C:\Windows\System\pritDNW.exe
  2⤵
  PID:6452
- C:\Windows\System\mKuLPIX.exe
  C:\Windows\System\mKuLPIX.exe
  2⤵
  PID:6508
- C:\Windows\System\axTNhVS.exe
  C:\Windows\System\axTNhVS.exe
  2⤵
  PID:6564
- C:\Windows\System\PDJjmkd.exe
  C:\Windows\System\PDJjmkd.exe
  2⤵
  PID:6672
- C:\Windows\System\UoknCya.exe
  C:\Windows\System\UoknCya.exe
  2⤵
  PID:6684
- C:\Windows\System\moGQETS.exe
  C:\Windows\System\moGQETS.exe
  2⤵
  PID:6772
- C:\Windows\System\xLIjvsc.exe
  C:\Windows\System\xLIjvsc.exe
  2⤵
  PID:6848
- C:\Windows\System\WfdoTuT.exe
  C:\Windows\System\WfdoTuT.exe
  2⤵
  PID:6920
- C:\Windows\System\uGWpBUK.exe
  C:\Windows\System\uGWpBUK.exe
  2⤵
  PID:6948
- C:\Windows\System\aPwwGtS.exe
  C:\Windows\System\aPwwGtS.exe
  2⤵
  PID:7008
- C:\Windows\System\SCYPXbV.exe
  C:\Windows\System\SCYPXbV.exe
  2⤵
  PID:6952
- C:\Windows\System\GLCASDf.exe
  C:\Windows\System\GLCASDf.exe
  2⤵
  PID:7064
- C:\Windows\System\GfgulSU.exe
  C:\Windows\System\GfgulSU.exe
  2⤵
  PID:7092
- C:\Windows\System\vrmYbqy.exe
  C:\Windows\System\vrmYbqy.exe
  2⤵
  PID:7140
- C:\Windows\System\NYCNPdt.exe
  C:\Windows\System\NYCNPdt.exe
  2⤵
  PID:7028
- C:\Windows\System\mQVltcd.exe
  C:\Windows\System\mQVltcd.exe
  2⤵
  PID:7184
- C:\Windows\System\KwEpbwT.exe
  C:\Windows\System\KwEpbwT.exe
  2⤵
  PID:7204
- C:\Windows\System\wZSisfe.exe
  C:\Windows\System\wZSisfe.exe
  2⤵
  PID:7228
- C:\Windows\System\iANyIAR.exe
  C:\Windows\System\iANyIAR.exe
  2⤵
  PID:7252
- C:\Windows\System\rWCHcAX.exe
  C:\Windows\System\rWCHcAX.exe
  2⤵
  PID:7288
- C:\Windows\System\hjfhAyb.exe
  C:\Windows\System\hjfhAyb.exe
  2⤵
  PID:7312
- C:\Windows\System\QQmVFBj.exe
  C:\Windows\System\QQmVFBj.exe
  2⤵
  PID:7344
- C:\Windows\System\ARLwfds.exe
  C:\Windows\System\ARLwfds.exe
  2⤵
  PID:7372
- C:\Windows\System\GlHjjat.exe
  C:\Windows\System\GlHjjat.exe
  2⤵
  PID:7404
- C:\Windows\System\LKaZmmR.exe
  C:\Windows\System\LKaZmmR.exe
  2⤵
  PID:7424
- C:\Windows\System\XDgAgDT.exe
  C:\Windows\System\XDgAgDT.exe
  2⤵
  PID:7448
- C:\Windows\System\YOTKNrf.exe
  C:\Windows\System\YOTKNrf.exe
  2⤵
  PID:7476
- C:\Windows\System\ojZbEtB.exe
  C:\Windows\System\ojZbEtB.exe
  2⤵
  PID:7508
- C:\Windows\System\SwRWhDu.exe
  C:\Windows\System\SwRWhDu.exe
  2⤵
  PID:7536
- C:\Windows\System\CcmwCFj.exe
  C:\Windows\System\CcmwCFj.exe
  2⤵
  PID:7568
- C:\Windows\System\yadFwXr.exe
  C:\Windows\System\yadFwXr.exe
  2⤵
  PID:7596
- C:\Windows\System\SuuDdhw.exe
  C:\Windows\System\SuuDdhw.exe
  2⤵
  PID:7624
- C:\Windows\System\cYWnTpN.exe
  C:\Windows\System\cYWnTpN.exe
  2⤵
  PID:7656
- C:\Windows\System\TGtGtaL.exe
  C:\Windows\System\TGtGtaL.exe
  2⤵
  PID:7688
- C:\Windows\System\YveoiFP.exe
  C:\Windows\System\YveoiFP.exe
  2⤵
  PID:7716
- C:\Windows\System\JvlSeTa.exe
  C:\Windows\System\JvlSeTa.exe
  2⤵
  PID:7752
- C:\Windows\System\ArJuIGj.exe
  C:\Windows\System\ArJuIGj.exe
  2⤵
  PID:7776
- C:\Windows\System\fQqLYAD.exe
  C:\Windows\System\fQqLYAD.exe
  2⤵
  PID:7804
- C:\Windows\System\NWHVcRI.exe
  C:\Windows\System\NWHVcRI.exe
  2⤵
  PID:7840
- C:\Windows\System\GVzQusj.exe
  C:\Windows\System\GVzQusj.exe
  2⤵
  PID:7872
- C:\Windows\System\QrPqNbg.exe
  C:\Windows\System\QrPqNbg.exe
  2⤵
  PID:7896
- C:\Windows\System\EnIAeGo.exe
  C:\Windows\System\EnIAeGo.exe
  2⤵
  PID:7916
- C:\Windows\System\KSIodCX.exe
  C:\Windows\System\KSIodCX.exe
  2⤵
  PID:7944
- C:\Windows\System\AzDYNkF.exe
  C:\Windows\System\AzDYNkF.exe
  2⤵
  PID:7976
- C:\Windows\System\ehqJNWg.exe
  C:\Windows\System\ehqJNWg.exe
  2⤵
  PID:8004
- C:\Windows\System\VUeNfGF.exe
  C:\Windows\System\VUeNfGF.exe
  2⤵
  PID:8032
- C:\Windows\System\LdkmPTQ.exe
  C:\Windows\System\LdkmPTQ.exe
  2⤵
  PID:8064
- C:\Windows\System\fRLJBHM.exe
  C:\Windows\System\fRLJBHM.exe
  2⤵
  PID:8096
- C:\Windows\System\ayUAZUt.exe
  C:\Windows\System\ayUAZUt.exe
  2⤵
  PID:8124
- C:\Windows\System\ujWHglp.exe
  C:\Windows\System\ujWHglp.exe
  2⤵
  PID:8152
- C:\Windows\System\oUaSLxG.exe
  C:\Windows\System\oUaSLxG.exe
  2⤵
  PID:8180
- C:\Windows\System\xJaiMUy.exe
  C:\Windows\System\xJaiMUy.exe
  2⤵
  PID:7124
- C:\Windows\System\dLwrdRu.exe
  C:\Windows\System\dLwrdRu.exe
  2⤵
  PID:5240
- C:\Windows\System\sfIuihc.exe
  C:\Windows\System\sfIuihc.exe
  2⤵
  PID:6816
- C:\Windows\System\GzThGWb.exe
  C:\Windows\System\GzThGWb.exe
  2⤵
  PID:7284
- C:\Windows\System\MPsmqry.exe
  C:\Windows\System\MPsmqry.exe
  2⤵
  PID:7392
- C:\Windows\System\PidSHIj.exe
  C:\Windows\System\PidSHIj.exe
  2⤵
  PID:7436
- C:\Windows\System\NWssEer.exe
  C:\Windows\System\NWssEer.exe
  2⤵
  PID:7420
- C:\Windows\System\sStqjBp.exe
  C:\Windows\System\sStqjBp.exe
  2⤵
  PID:7556
- C:\Windows\System\pRQLThN.exe
  C:\Windows\System\pRQLThN.exe
  2⤵
  PID:6660
- C:\Windows\System\zryReub.exe
  C:\Windows\System\zryReub.exe
  2⤵
  PID:6656
- C:\Windows\System\aoVvDfw.exe
  C:\Windows\System\aoVvDfw.exe
  2⤵
  PID:7620
- C:\Windows\System\ABuxLWQ.exe
  C:\Windows\System\ABuxLWQ.exe
  2⤵
  PID:7764
- C:\Windows\System\NefCweY.exe
  C:\Windows\System\NefCweY.exe
  2⤵
  PID:7784
- C:\Windows\System\uVLaIbz.exe
  C:\Windows\System\uVLaIbz.exe
  2⤵
  PID:7796
- C:\Windows\System\WgokOHs.exe
  C:\Windows\System\WgokOHs.exe
  2⤵
  PID:7936
- C:\Windows\System\akzYUXk.exe
  C:\Windows\System\akzYUXk.exe
  2⤵
  PID:8000
- C:\Windows\System\wxtKTGQ.exe
  C:\Windows\System\wxtKTGQ.exe
  2⤵
  PID:8048
- C:\Windows\System\XAPjdZV.exe
  C:\Windows\System\XAPjdZV.exe
  2⤵
  PID:8024
- C:\Windows\System\PuWhcaf.exe
  C:\Windows\System\PuWhcaf.exe
  2⤵
  PID:8148
- C:\Windows\System\klAFkPW.exe
  C:\Windows\System\klAFkPW.exe
  2⤵
  PID:8172
- C:\Windows\System\vtgfIFV.exe
  C:\Windows\System\vtgfIFV.exe
  2⤵
  PID:8188
- C:\Windows\System\agTVRdx.exe
  C:\Windows\System\agTVRdx.exe
  2⤵
  PID:7244
- C:\Windows\System\aoULdaa.exe
  C:\Windows\System\aoULdaa.exe
  2⤵
  PID:7400
- C:\Windows\System\VwiWOOE.exe
  C:\Windows\System\VwiWOOE.exe
  2⤵
  PID:6736
- C:\Windows\System\kxRWwML.exe
  C:\Windows\System\kxRWwML.exe
  2⤵
  PID:7488
- C:\Windows\System\msaUwlA.exe
  C:\Windows\System\msaUwlA.exe
  2⤵
  PID:7612
- C:\Windows\System\FdfhtNi.exe
  C:\Windows\System\FdfhtNi.exe
  2⤵
  PID:7824
- C:\Windows\System\XAfsNuZ.exe
  C:\Windows\System\XAfsNuZ.exe
  2⤵
  PID:7940
- C:\Windows\System\cihyffu.exe
  C:\Windows\System\cihyffu.exe
  2⤵
  PID:8080
- C:\Windows\System\zlFTZoU.exe
  C:\Windows\System\zlFTZoU.exe
  2⤵
  PID:6944
- C:\Windows\System\QIntIFH.exe
  C:\Windows\System\QIntIFH.exe
  2⤵
  PID:7360
- C:\Windows\System\BZkpUFi.exe
  C:\Windows\System\BZkpUFi.exe
  2⤵
  PID:5748
- C:\Windows\System\rEMgcTh.exe
  C:\Windows\System\rEMgcTh.exe
  2⤵
  PID:8164
- C:\Windows\System\RltxzIJ.exe
  C:\Windows\System\RltxzIJ.exe
  2⤵
  PID:8072
- C:\Windows\System\TnHxwwS.exe
  C:\Windows\System\TnHxwwS.exe
  2⤵
  PID:6592
- C:\Windows\System\FekyPwD.exe
  C:\Windows\System\FekyPwD.exe
  2⤵
  PID:7416
- C:\Windows\System\gVSUIHP.exe
  C:\Windows\System\gVSUIHP.exe
  2⤵
  PID:8216
- C:\Windows\System\QEgnnim.exe
  C:\Windows\System\QEgnnim.exe
  2⤵
  PID:8248
- C:\Windows\System\tcFFySO.exe
  C:\Windows\System\tcFFySO.exe
  2⤵
  PID:8284
- C:\Windows\System\VBwkjtI.exe
  C:\Windows\System\VBwkjtI.exe
  2⤵
  PID:8312
- C:\Windows\System\SZrcLIt.exe
  C:\Windows\System\SZrcLIt.exe
  2⤵
  PID:8340
- C:\Windows\System\Cdjysrq.exe
  C:\Windows\System\Cdjysrq.exe
  2⤵
  PID:8368
- C:\Windows\System\iekwems.exe
  C:\Windows\System\iekwems.exe
  2⤵
  PID:8384
- C:\Windows\System\BEmcrrY.exe
  C:\Windows\System\BEmcrrY.exe
  2⤵
  PID:8400
- C:\Windows\System\mYSHJmO.exe
  C:\Windows\System\mYSHJmO.exe
  2⤵
  PID:8432
- C:\Windows\System\KQXCPOs.exe
  C:\Windows\System\KQXCPOs.exe
  2⤵
  PID:8460
- C:\Windows\System\CMIavdG.exe
  C:\Windows\System\CMIavdG.exe
  2⤵
  PID:8488
- C:\Windows\System\hwRJPBl.exe
  C:\Windows\System\hwRJPBl.exe
  2⤵
  PID:8516
- C:\Windows\System\FuXmXlw.exe
  C:\Windows\System\FuXmXlw.exe
  2⤵
  PID:8536
- C:\Windows\System\dULLFTq.exe
  C:\Windows\System\dULLFTq.exe
  2⤵
  PID:8564
- C:\Windows\System\PSswZUR.exe
  C:\Windows\System\PSswZUR.exe
  2⤵
  PID:8584
- C:\Windows\System\WbTegfH.exe
  C:\Windows\System\WbTegfH.exe
  2⤵
  PID:8612
- C:\Windows\System\qCPTOjL.exe
  C:\Windows\System\qCPTOjL.exe
  2⤵
  PID:8632
- C:\Windows\System\bxmahxD.exe
  C:\Windows\System\bxmahxD.exe
  2⤵
  PID:8656
- C:\Windows\System\UFOYtpf.exe
  C:\Windows\System\UFOYtpf.exe
  2⤵
  PID:8688
- C:\Windows\System\IoPEnyA.exe
  C:\Windows\System\IoPEnyA.exe
  2⤵
  PID:8716
- C:\Windows\System\wcKGfJD.exe
  C:\Windows\System\wcKGfJD.exe
  2⤵
  PID:8740
- C:\Windows\System\lWRfvdj.exe
  C:\Windows\System\lWRfvdj.exe
  2⤵
  PID:8764
- C:\Windows\System\wjKIPTx.exe
  C:\Windows\System\wjKIPTx.exe
  2⤵
  PID:8816
- C:\Windows\System\dOuaddk.exe
  C:\Windows\System\dOuaddk.exe
  2⤵
  PID:8848
- C:\Windows\System\ilWxtdd.exe
  C:\Windows\System\ilWxtdd.exe
  2⤵
  PID:8864
- C:\Windows\System\AWViVAv.exe
  C:\Windows\System\AWViVAv.exe
  2⤵
  PID:8900
- C:\Windows\System\hAPmayH.exe
  C:\Windows\System\hAPmayH.exe
  2⤵
  PID:8920
- C:\Windows\System\xPIgQhs.exe
  C:\Windows\System\xPIgQhs.exe
  2⤵
  PID:8944
- C:\Windows\System\QPyQpwT.exe
  C:\Windows\System\QPyQpwT.exe
  2⤵
  PID:8964
- C:\Windows\System\pOVIemx.exe
  C:\Windows\System\pOVIemx.exe
  2⤵
  PID:8988
- C:\Windows\System\mmfylJF.exe
  C:\Windows\System\mmfylJF.exe
  2⤵
  PID:9028
- C:\Windows\System\NKsahVg.exe
  C:\Windows\System\NKsahVg.exe
  2⤵
  PID:9064
- C:\Windows\System\pXcrgci.exe
  C:\Windows\System\pXcrgci.exe
  2⤵
  PID:9088
- C:\Windows\System\HVFCptf.exe
  C:\Windows\System\HVFCptf.exe
  2⤵
  PID:9116
- C:\Windows\System\YTkljGZ.exe
  C:\Windows\System\YTkljGZ.exe
  2⤵
  PID:9148
- C:\Windows\System\MIrVFAJ.exe
  C:\Windows\System\MIrVFAJ.exe
  2⤵
  PID:9180
- C:\Windows\System\BrTAYIa.exe
  C:\Windows\System\BrTAYIa.exe
  2⤵
  PID:9204
- C:\Windows\System\aqpAlLi.exe
  C:\Windows\System\aqpAlLi.exe
  2⤵
  PID:8228
- C:\Windows\System\avatReR.exe
  C:\Windows\System\avatReR.exe
  2⤵
  PID:8276
- C:\Windows\System\DPNByYc.exe
  C:\Windows\System\DPNByYc.exe
  2⤵
  PID:8332
- C:\Windows\System\tKzbZum.exe
  C:\Windows\System\tKzbZum.exe
  2⤵
  PID:8440
- C:\Windows\System\GntEybD.exe
  C:\Windows\System\GntEybD.exe
  2⤵
  PID:8472
- C:\Windows\System\WUIvOOQ.exe
  C:\Windows\System\WUIvOOQ.exe
  2⤵
  PID:8552
- C:\Windows\System\EKyQPdb.exe
  C:\Windows\System\EKyQPdb.exe
  2⤵
  PID:8548
- C:\Windows\System\FhKnGqm.exe
  C:\Windows\System\FhKnGqm.exe
  2⤵
  PID:8684
- C:\Windows\System\VGwDvIx.exe
  C:\Windows\System\VGwDvIx.exe
  2⤵
  PID:8648
- C:\Windows\System\aDMScvL.exe
  C:\Windows\System\aDMScvL.exe
  2⤵
  PID:8776
- C:\Windows\System\nwgIEBC.exe
  C:\Windows\System\nwgIEBC.exe
  2⤵
  PID:8784
- C:\Windows\System\VpqXYBP.exe
  C:\Windows\System\VpqXYBP.exe
  2⤵
  PID:8908
- C:\Windows\System\puxWSEw.exe
  C:\Windows\System\puxWSEw.exe
  2⤵
  PID:8960
- C:\Windows\System\KCPIxSl.exe
  C:\Windows\System\KCPIxSl.exe
  2⤵
  PID:8984
- C:\Windows\System\OpPCATr.exe
  C:\Windows\System\OpPCATr.exe
  2⤵
  PID:9080
- C:\Windows\System\KRBfMki.exe
  C:\Windows\System\KRBfMki.exe
  2⤵
  PID:9160
- C:\Windows\System\HxGfCdp.exe
  C:\Windows\System\HxGfCdp.exe
  2⤵
  PID:8236
- C:\Windows\System\tGbDTMa.exe
  C:\Windows\System\tGbDTMa.exe
  2⤵
  PID:8396
- C:\Windows\System\dCnBnZB.exe
  C:\Windows\System\dCnBnZB.exe
  2⤵
  PID:8524
- C:\Windows\System\EnfwInf.exe
  C:\Windows\System\EnfwInf.exe
  2⤵
  PID:8704
- C:\Windows\System\zwKwLkL.exe
  C:\Windows\System\zwKwLkL.exe
  2⤵
  PID:8728
- C:\Windows\System\wAWbtma.exe
  C:\Windows\System\wAWbtma.exe
  2⤵
  PID:8892
- C:\Windows\System\ndlBTgA.exe
  C:\Windows\System\ndlBTgA.exe
  2⤵
  PID:7648
- C:\Windows\System\CGgLqFp.exe
  C:\Windows\System\CGgLqFp.exe
  2⤵
  PID:9212
- C:\Windows\System\itVBCgw.exe
  C:\Windows\System\itVBCgw.exe
  2⤵
  PID:8832
- C:\Windows\System\MlDNXoR.exe
  C:\Windows\System\MlDNXoR.exe
  2⤵
  PID:9044
- C:\Windows\System\lzpCQHZ.exe
  C:\Windows\System\lzpCQHZ.exe
  2⤵
  PID:9236
- C:\Windows\System\DgbMFga.exe
  C:\Windows\System\DgbMFga.exe
  2⤵
  PID:9264
- C:\Windows\System\MQWIOup.exe
  C:\Windows\System\MQWIOup.exe
  2⤵
  PID:9284
- C:\Windows\System\ApDzmgn.exe
  C:\Windows\System\ApDzmgn.exe
  2⤵
  PID:9316
- C:\Windows\System\wLzfUda.exe
  C:\Windows\System\wLzfUda.exe
  2⤵
  PID:9348
- C:\Windows\System\kxqnvLP.exe
  C:\Windows\System\kxqnvLP.exe
  2⤵
  PID:9372
- C:\Windows\System\zoPVIkX.exe
  C:\Windows\System\zoPVIkX.exe
  2⤵
  PID:9396
- C:\Windows\System\ryMzFPm.exe
  C:\Windows\System\ryMzFPm.exe
  2⤵
  PID:9416
- C:\Windows\System\kfHQTvA.exe
  C:\Windows\System\kfHQTvA.exe
  2⤵
  PID:9452
- C:\Windows\System\fhdbAJs.exe
  C:\Windows\System\fhdbAJs.exe
  2⤵
  PID:9472
- C:\Windows\System\dFREwqZ.exe
  C:\Windows\System\dFREwqZ.exe
  2⤵
  PID:9492
- C:\Windows\System\oevgXme.exe
  C:\Windows\System\oevgXme.exe
  2⤵
  PID:9508
- C:\Windows\System\nfDjEek.exe
  C:\Windows\System\nfDjEek.exe
  2⤵
  PID:9540
- C:\Windows\System\KCPJHrF.exe
  C:\Windows\System\KCPJHrF.exe
  2⤵
  PID:9568
- C:\Windows\System\TVHNlcS.exe
  C:\Windows\System\TVHNlcS.exe
  2⤵
  PID:9596
- C:\Windows\System\wbkIkBx.exe
  C:\Windows\System\wbkIkBx.exe
  2⤵
  PID:9616
- C:\Windows\System\rYPkGEE.exe
  C:\Windows\System\rYPkGEE.exe
  2⤵
  PID:9632
- C:\Windows\System\YumTuon.exe
  C:\Windows\System\YumTuon.exe
  2⤵
  PID:9664
- C:\Windows\System\KIbtjKp.exe
  C:\Windows\System\KIbtjKp.exe
  2⤵
  PID:9688
- C:\Windows\System\LAYyCux.exe
  C:\Windows\System\LAYyCux.exe
  2⤵
  PID:9720
- C:\Windows\System\ItesNre.exe
  C:\Windows\System\ItesNre.exe
  2⤵
  PID:9744
- C:\Windows\System\TaCiGYv.exe
  C:\Windows\System\TaCiGYv.exe
  2⤵
  PID:9768
- C:\Windows\System\AqDqGqq.exe
  C:\Windows\System\AqDqGqq.exe
  2⤵
  PID:9796
- C:\Windows\System\MmBsaFy.exe
  C:\Windows\System\MmBsaFy.exe
  2⤵
  PID:9828
- C:\Windows\System\joWccSj.exe
  C:\Windows\System\joWccSj.exe
  2⤵
  PID:9844
- C:\Windows\System\OcEEAEK.exe
  C:\Windows\System\OcEEAEK.exe
  2⤵
  PID:9868
- C:\Windows\System\yMOqfns.exe
  C:\Windows\System\yMOqfns.exe
  2⤵
  PID:9888
- C:\Windows\System\vjSSeHT.exe
  C:\Windows\System\vjSSeHT.exe
  2⤵
  PID:9920
- C:\Windows\System\bMwFcmq.exe
  C:\Windows\System\bMwFcmq.exe
  2⤵
  PID:9948
- C:\Windows\System\kWsMQIP.exe
  C:\Windows\System\kWsMQIP.exe
  2⤵
  PID:9976
- C:\Windows\System\fwkOOoI.exe
  C:\Windows\System\fwkOOoI.exe
  2⤵
  PID:10004
- C:\Windows\System\GjMyfJC.exe
  C:\Windows\System\GjMyfJC.exe
  2⤵
  PID:10044
- C:\Windows\System\fmyhxvn.exe
  C:\Windows\System\fmyhxvn.exe
  2⤵
  PID:10088
- C:\Windows\System\vVjfZSP.exe
  C:\Windows\System\vVjfZSP.exe
  2⤵
  PID:10108
- C:\Windows\System\WOFERqp.exe
  C:\Windows\System\WOFERqp.exe
  2⤵
  PID:10136
- C:\Windows\System\mdEBvui.exe
  C:\Windows\System\mdEBvui.exe
  2⤵
  PID:10172
- C:\Windows\System\GKDQext.exe
  C:\Windows\System\GKDQext.exe
  2⤵
  PID:10208
- C:\Windows\System\oBiugOt.exe
  C:\Windows\System\oBiugOt.exe
  2⤵
  PID:8756
- C:\Windows\System\iJSsYdC.exe
  C:\Windows\System\iJSsYdC.exe
  2⤵
  PID:8884
- C:\Windows\System\kpenimO.exe
  C:\Windows\System\kpenimO.exe
  2⤵
  PID:9272
- C:\Windows\System\hSoOHog.exe
  C:\Windows\System\hSoOHog.exe
  2⤵
  PID:9336
- C:\Windows\System\fRNFSjs.exe
  C:\Windows\System\fRNFSjs.exe
  2⤵
  PID:9368
- C:\Windows\System\erbJuTa.exe
  C:\Windows\System\erbJuTa.exe
  2⤵
  PID:9444
- C:\Windows\System\CZfxNfu.exe
  C:\Windows\System\CZfxNfu.exe
  2⤵
  PID:9500
- C:\Windows\System\LArLGwS.exe
  C:\Windows\System\LArLGwS.exe
  2⤵
  PID:9628
- C:\Windows\System\BdInmNO.exe
  C:\Windows\System\BdInmNO.exe
  2⤵
  PID:9700
- C:\Windows\System\kUQqSEJ.exe
  C:\Windows\System\kUQqSEJ.exe
  2⤵
  PID:9760
- C:\Windows\System\GwhXYcx.exe
  C:\Windows\System\GwhXYcx.exe
  2⤵
  PID:9824
- C:\Windows\System\RURWxKd.exe
  C:\Windows\System\RURWxKd.exe
  2⤵
  PID:9860
- C:\Windows\System\GEmewDD.exe
  C:\Windows\System\GEmewDD.exe
  2⤵
  PID:9876
- C:\Windows\System\nGkqRrx.exe
  C:\Windows\System\nGkqRrx.exe
  2⤵
  PID:9960
- C:\Windows\System\ddgrHxG.exe
  C:\Windows\System\ddgrHxG.exe
  2⤵
  PID:10096
- C:\Windows\System\EiLGyQM.exe
  C:\Windows\System\EiLGyQM.exe
  2⤵
  PID:10068
- C:\Windows\System\bOKeWzD.exe
  C:\Windows\System\bOKeWzD.exe
  2⤵
  PID:6372
- C:\Windows\System\tAtdZfW.exe
  C:\Windows\System\tAtdZfW.exe
  2⤵
  PID:9332
- C:\Windows\System\aaJUQBn.exe
  C:\Windows\System\aaJUQBn.exe
  2⤵
  PID:9436
- C:\Windows\System\vktksLW.exe
  C:\Windows\System\vktksLW.exe
  2⤵
  PID:9556
- C:\Windows\System\dIkaNtp.exe
  C:\Windows\System\dIkaNtp.exe
  2⤵
  PID:9776
- C:\Windows\System\PsrHAal.exe
  C:\Windows\System\PsrHAal.exe
  2⤵
  PID:9296
- C:\Windows\System\EVVbvKP.exe
  C:\Windows\System\EVVbvKP.exe
  2⤵
  PID:9908
- C:\Windows\System\FMpEVkm.exe
  C:\Windows\System\FMpEVkm.exe
  2⤵
  PID:10204
- C:\Windows\System\FOIUCGk.exe
  C:\Windows\System\FOIUCGk.exe
  2⤵
  PID:10184
- C:\Windows\System\MRDksNT.exe
  C:\Windows\System\MRDksNT.exe
  2⤵
  PID:10244
- C:\Windows\System\iaiVeVV.exe
  C:\Windows\System\iaiVeVV.exe
  2⤵
  PID:10272
- C:\Windows\System\mSXwoMd.exe
  C:\Windows\System\mSXwoMd.exe
  2⤵
  PID:10308
- C:\Windows\System\QKXNKut.exe
  C:\Windows\System\QKXNKut.exe
  2⤵
  PID:10336
- C:\Windows\System\XlNDywD.exe
  C:\Windows\System\XlNDywD.exe
  2⤵
  PID:10368
- C:\Windows\System\qcGzrIW.exe
  C:\Windows\System\qcGzrIW.exe
  2⤵
  PID:10392
- C:\Windows\System\Rooqdmo.exe
  C:\Windows\System\Rooqdmo.exe
  2⤵
  PID:10420
- C:\Windows\System\puCByNA.exe
  C:\Windows\System\puCByNA.exe
  2⤵
  PID:10440
- C:\Windows\System\SiKcTzh.exe
  C:\Windows\System\SiKcTzh.exe
  2⤵
  PID:10472
- C:\Windows\System\mWXjkmI.exe
  C:\Windows\System\mWXjkmI.exe
  2⤵
  PID:10488
- C:\Windows\System\LrgvcJr.exe
  C:\Windows\System\LrgvcJr.exe
  2⤵
  PID:10520
- C:\Windows\System\iBvbvdj.exe
  C:\Windows\System\iBvbvdj.exe
  2⤵
  PID:10548
- C:\Windows\System\KYgffVJ.exe
  C:\Windows\System\KYgffVJ.exe
  2⤵
  PID:10576
- C:\Windows\System\OmPpkgm.exe
  C:\Windows\System\OmPpkgm.exe
  2⤵
  PID:10604
- C:\Windows\System\nCEFIcc.exe
  C:\Windows\System\nCEFIcc.exe
  2⤵
  PID:10624
- C:\Windows\System\aafhIgd.exe
  C:\Windows\System\aafhIgd.exe
  2⤵
  PID:10640
- C:\Windows\System\QcaPprr.exe
  C:\Windows\System\QcaPprr.exe
  2⤵
  PID:10668
- C:\Windows\System\vTeJULF.exe
  C:\Windows\System\vTeJULF.exe
  2⤵
  PID:10692
- C:\Windows\System\DHkJmBs.exe
  C:\Windows\System\DHkJmBs.exe
  2⤵
  PID:10720
- C:\Windows\System\DtIKNiR.exe
  C:\Windows\System\DtIKNiR.exe
  2⤵
  PID:10740
- C:\Windows\System\ocQVzzl.exe
  C:\Windows\System\ocQVzzl.exe
  2⤵
  PID:10768
- C:\Windows\System\SrbegHe.exe
  C:\Windows\System\SrbegHe.exe
  2⤵
  PID:10796
- C:\Windows\System\tdDMzSU.exe
  C:\Windows\System\tdDMzSU.exe
  2⤵
  PID:10816
- C:\Windows\System\idXIWLS.exe
  C:\Windows\System\idXIWLS.exe
  2⤵
  PID:10852
- C:\Windows\System\GBPsLIW.exe
  C:\Windows\System\GBPsLIW.exe
  2⤵
  PID:10892
- C:\Windows\System\rzzMZor.exe
  C:\Windows\System\rzzMZor.exe
  2⤵
  PID:10916
- C:\Windows\System\YvVcZCI.exe
  C:\Windows\System\YvVcZCI.exe
  2⤵
  PID:10940
- C:\Windows\System\ISAoTgA.exe
  C:\Windows\System\ISAoTgA.exe
  2⤵
  PID:10972
- C:\Windows\System\AqIMmlD.exe
  C:\Windows\System\AqIMmlD.exe
  2⤵
  PID:11004
- C:\Windows\System\cXNREbq.exe
  C:\Windows\System\cXNREbq.exe
  2⤵
  PID:11036
- C:\Windows\System\GFYrRIx.exe
  C:\Windows\System\GFYrRIx.exe
  2⤵
  PID:11056
- C:\Windows\System\yqiSdnF.exe
  C:\Windows\System\yqiSdnF.exe
  2⤵
  PID:11088
- C:\Windows\System\eZKsXXv.exe
  C:\Windows\System\eZKsXXv.exe
  2⤵
  PID:11112
- C:\Windows\System\TQduySc.exe
  C:\Windows\System\TQduySc.exe
  2⤵
  PID:11140
- C:\Windows\System\pHEGHdF.exe
  C:\Windows\System\pHEGHdF.exe
  2⤵
  PID:11160
- C:\Windows\System\ajMUBds.exe
  C:\Windows\System\ajMUBds.exe
  2⤵
  PID:11196
- C:\Windows\System\WrWAqnu.exe
  C:\Windows\System\WrWAqnu.exe
  2⤵
  PID:11232
- C:\Windows\System\coRKNsZ.exe
  C:\Windows\System\coRKNsZ.exe
  2⤵
  PID:9928
- C:\Windows\System\RHuXmGB.exe
  C:\Windows\System\RHuXmGB.exe
  2⤵
  PID:10264
- C:\Windows\System\zoeXdnI.exe
  C:\Windows\System\zoeXdnI.exe
  2⤵
  PID:9484
- C:\Windows\System\cLWvboC.exe
  C:\Windows\System\cLWvboC.exe
  2⤵
  PID:10416
- C:\Windows\System\EOYoTnV.exe
  C:\Windows\System\EOYoTnV.exe
  2⤵
  PID:10380
- C:\Windows\System\IjIeqUR.exe
  C:\Windows\System\IjIeqUR.exe
  2⤵
  PID:10500
- C:\Windows\System\nnqXDaU.exe
  C:\Windows\System\nnqXDaU.exe
  2⤵
  PID:10596
- C:\Windows\System\GEiPbin.exe
  C:\Windows\System\GEiPbin.exe
  2⤵
  PID:10536
- C:\Windows\System\KjcsJYi.exe
  C:\Windows\System\KjcsJYi.exe
  2⤵
  PID:10788
- C:\Windows\System\oQLfkdu.exe
  C:\Windows\System\oQLfkdu.exe
  2⤵
  PID:10680
- C:\Windows\System\EeSwskV.exe
  C:\Windows\System\EeSwskV.exe
  2⤵
  PID:10708
- C:\Windows\System\RhLOsiq.exe
  C:\Windows\System\RhLOsiq.exe
  2⤵
  PID:10988
- C:\Windows\System\XDlgTDL.exe
  C:\Windows\System\XDlgTDL.exe
  2⤵
  PID:10956
- C:\Windows\System\nyaVXea.exe
  C:\Windows\System\nyaVXea.exe
  2⤵
  PID:10924
- C:\Windows\System\EfROHNW.exe
  C:\Windows\System\EfROHNW.exe
  2⤵
  PID:11052
- C:\Windows\System\JrPvdJl.exe
  C:\Windows\System\JrPvdJl.exe
  2⤵
  PID:11128
- C:\Windows\System\zGdsCrV.exe
  C:\Windows\System\zGdsCrV.exe
  2⤵
  PID:11148
- C:\Windows\System\EKCWMTw.exe
  C:\Windows\System\EKCWMTw.exe
  2⤵
  PID:11244
- C:\Windows\System\EnHXOVT.exe
  C:\Windows\System\EnHXOVT.exe
  2⤵
  PID:9200
- C:\Windows\System\ujjYeRl.exe
  C:\Windows\System\ujjYeRl.exe
  2⤵
  PID:10284
- C:\Windows\System\pZCylmt.exe
  C:\Windows\System\pZCylmt.exe
  2⤵
  PID:10528
- C:\Windows\System\MkvJqBX.exe
  C:\Windows\System\MkvJqBX.exe
  2⤵
  PID:10880
- C:\Windows\System\svDUSIs.exe
  C:\Windows\System\svDUSIs.exe
  2⤵
  PID:11172
- C:\Windows\System\CJpByoW.exe
  C:\Windows\System\CJpByoW.exe
  2⤵
  PID:11076
- C:\Windows\System\PTgVkmP.exe
  C:\Windows\System\PTgVkmP.exe
  2⤵
  PID:10908
- C:\Windows\System\KvccXYt.exe
  C:\Windows\System\KvccXYt.exe
  2⤵
  PID:9820
- C:\Windows\System\MmMrMeK.exe
  C:\Windows\System\MmMrMeK.exe
  2⤵
  PID:10592
- C:\Windows\System\tUokGuD.exe
  C:\Windows\System\tUokGuD.exe
  2⤵
  PID:11268
- C:\Windows\System\iKQlozV.exe
  C:\Windows\System\iKQlozV.exe
  2⤵
  PID:11288
- C:\Windows\System\qpFUBVQ.exe
  C:\Windows\System\qpFUBVQ.exe
  2⤵
  PID:11324
- C:\Windows\System\qktRqet.exe
  C:\Windows\System\qktRqet.exe
  2⤵
  PID:11348
- C:\Windows\System\qjERAOL.exe
  C:\Windows\System\qjERAOL.exe
  2⤵
  PID:11376
- C:\Windows\System\Drlmetd.exe
  C:\Windows\System\Drlmetd.exe
  2⤵
  PID:11408
- C:\Windows\System\XRklNVP.exe
  C:\Windows\System\XRklNVP.exe
  2⤵
  PID:11436
- C:\Windows\System\yEicVCQ.exe
  C:\Windows\System\yEicVCQ.exe
  2⤵
  PID:11464
- C:\Windows\System\PnDMhHH.exe
  C:\Windows\System\PnDMhHH.exe
  2⤵
  PID:11496
- C:\Windows\System\TFtDHiK.exe
  C:\Windows\System\TFtDHiK.exe
  2⤵
  PID:11520
- C:\Windows\System\FIPnAOE.exe
  C:\Windows\System\FIPnAOE.exe
  2⤵
  PID:11544
- C:\Windows\System\qtLvOSb.exe
  C:\Windows\System\qtLvOSb.exe
  2⤵
  PID:11580
- C:\Windows\System\UTHtvQD.exe
  C:\Windows\System\UTHtvQD.exe
  2⤵
  PID:11604
- C:\Windows\System\jWAnHEf.exe
  C:\Windows\System\jWAnHEf.exe
  2⤵
  PID:11628
- C:\Windows\System\hobKNHg.exe
  C:\Windows\System\hobKNHg.exe
  2⤵
  PID:11656
- C:\Windows\System\BUzIbwD.exe
  C:\Windows\System\BUzIbwD.exe
  2⤵
  PID:11684
- C:\Windows\System\hrAJprc.exe
  C:\Windows\System\hrAJprc.exe
  2⤵
  PID:11700
- C:\Windows\System\XCLHffh.exe
  C:\Windows\System\XCLHffh.exe
  2⤵
  PID:11728
- C:\Windows\System\TrCbPcb.exe
  C:\Windows\System\TrCbPcb.exe
  2⤵
  PID:11752
- C:\Windows\System\cXceRMj.exe
  C:\Windows\System\cXceRMj.exe
  2⤵
  PID:11780
- C:\Windows\System\qFhMEaY.exe
  C:\Windows\System\qFhMEaY.exe
  2⤵
  PID:11808
- C:\Windows\System\RkiMxfN.exe
  C:\Windows\System\RkiMxfN.exe
  2⤵
  PID:11840
- C:\Windows\System\LgfgEln.exe
  C:\Windows\System\LgfgEln.exe
  2⤵
  PID:11868
- C:\Windows\System\NtBcJFH.exe
  C:\Windows\System\NtBcJFH.exe
  2⤵
  PID:11888
- C:\Windows\System\lnGHpPS.exe
  C:\Windows\System\lnGHpPS.exe
  2⤵
  PID:11920
- C:\Windows\System\zwnYAoR.exe
  C:\Windows\System\zwnYAoR.exe
  2⤵
  PID:11940
- C:\Windows\System\CXWCEBY.exe
  C:\Windows\System\CXWCEBY.exe
  2⤵
  PID:11960
- C:\Windows\System\ELTMdRD.exe
  C:\Windows\System\ELTMdRD.exe
  2⤵
  PID:11988
- C:\Windows\System\ZeORXuN.exe
  C:\Windows\System\ZeORXuN.exe
  2⤵
  PID:12008
- C:\Windows\System\SXBPHyE.exe
  C:\Windows\System\SXBPHyE.exe
  2⤵
  PID:12040
- C:\Windows\System\oVytlAQ.exe
  C:\Windows\System\oVytlAQ.exe
  2⤵
  PID:12068
- C:\Windows\System\VvZWfIu.exe
  C:\Windows\System\VvZWfIu.exe
  2⤵
  PID:12100
- C:\Windows\System\DVLOSbE.exe
  C:\Windows\System\DVLOSbE.exe
  2⤵
  PID:12116
- C:\Windows\System\eoDqEBz.exe
  C:\Windows\System\eoDqEBz.exe
  2⤵
  PID:12160
- C:\Windows\System\LtPtvlR.exe
  C:\Windows\System\LtPtvlR.exe
  2⤵
  PID:12188
- C:\Windows\System\LAMlxxa.exe
  C:\Windows\System\LAMlxxa.exe
  2⤵
  PID:12224
- C:\Windows\System\xyUyFWS.exe
  C:\Windows\System\xyUyFWS.exe
  2⤵
  PID:12260
- C:\Windows\System\FlnuVei.exe
  C:\Windows\System\FlnuVei.exe
  2⤵
  PID:12284
- C:\Windows\System\PrDyCxO.exe
  C:\Windows\System\PrDyCxO.exe
  2⤵
  PID:11024
- C:\Windows\System\iRDJkwh.exe
  C:\Windows\System\iRDJkwh.exe
  2⤵
  PID:10848
- C:\Windows\System\MkkPBYi.exe
  C:\Windows\System\MkkPBYi.exe
  2⤵
  PID:11368
- C:\Windows\System\hbluIqo.exe
  C:\Windows\System\hbluIqo.exe
  2⤵
  PID:11300
- C:\Windows\System\WJsAybq.exe
  C:\Windows\System\WJsAybq.exe
  2⤵
  PID:11592
- C:\Windows\System\QEplLls.exe
  C:\Windows\System\QEplLls.exe
  2⤵
  PID:11404
- C:\Windows\System\JSKEPcb.exe
  C:\Windows\System\JSKEPcb.exe
  2⤵
  PID:11488
- C:\Windows\System\lWNaicd.exe
  C:\Windows\System\lWNaicd.exe
  2⤵
  PID:11776
- C:\Windows\System\TUOfWef.exe
  C:\Windows\System\TUOfWef.exe
  2⤵
  PID:11576
- C:\Windows\System\IJNcANr.exe
  C:\Windows\System\IJNcANr.exe
  2⤵
  PID:11856
- C:\Windows\System\IBAqhcY.exe
  C:\Windows\System\IBAqhcY.exe
  2⤵
  PID:11824
- C:\Windows\System\qCEpaTW.exe
  C:\Windows\System\qCEpaTW.exe
  2⤵
  PID:11740
- C:\Windows\System\BswLXBq.exe
  C:\Windows\System\BswLXBq.exe
  2⤵
  PID:11884
- C:\Windows\System\bsyqaku.exe
  C:\Windows\System\bsyqaku.exe
  2⤵
  PID:12052
- C:\Windows\System\vozPAKn.exe
  C:\Windows\System\vozPAKn.exe
  2⤵
  PID:12000
- C:\Windows\System\iLnnLpY.exe
  C:\Windows\System\iLnnLpY.exe
  2⤵
  PID:9764
- C:\Windows\System\KUTiJDG.exe
  C:\Windows\System\KUTiJDG.exe
  2⤵
  PID:10824
- C:\Windows\System\dWVWbua.exe
  C:\Windows\System\dWVWbua.exe
  2⤵
  PID:12248
- C:\Windows\System\UVnqgNr.exe
  C:\Windows\System\UVnqgNr.exe
  2⤵
  PID:12168
- C:\Windows\System\mkKEedf.exe
  C:\Windows\System\mkKEedf.exe
  2⤵
  PID:12216
- C:\Windows\System\xJyEdWq.exe
  C:\Windows\System\xJyEdWq.exe
  2⤵
  PID:11508
- C:\Windows\System\gWSCmzn.exe
  C:\Windows\System\gWSCmzn.exe
  2⤵
  PID:11648
- C:\Windows\System\JIskJce.exe
  C:\Windows\System\JIskJce.exe
  2⤵
  PID:12280
- C:\Windows\System\OvUByoi.exe
  C:\Windows\System\OvUByoi.exe
  2⤵
  PID:11624
- C:\Windows\System\wcJAdql.exe
  C:\Windows\System\wcJAdql.exe
  2⤵
  PID:12304
- C:\Windows\System\aEZcrOq.exe
  C:\Windows\System\aEZcrOq.exe
  2⤵
  PID:12336
- C:\Windows\System\qpMwvFg.exe
  C:\Windows\System\qpMwvFg.exe
  2⤵
  PID:12364
- C:\Windows\System\sCsBqqy.exe
  C:\Windows\System\sCsBqqy.exe
  2⤵
  PID:12392
- C:\Windows\System\lqQafdG.exe
  C:\Windows\System\lqQafdG.exe
  2⤵
  PID:12424
- C:\Windows\System\moTaOzh.exe
  C:\Windows\System\moTaOzh.exe
  2⤵
  PID:12452
- C:\Windows\System\ZqoMoTy.exe
  C:\Windows\System\ZqoMoTy.exe
  2⤵
  PID:12480
- C:\Windows\System\xYRHuge.exe
  C:\Windows\System\xYRHuge.exe
  2⤵
  PID:12508
- C:\Windows\System\TwXodMr.exe
  C:\Windows\System\TwXodMr.exe
  2⤵
  PID:12540
- C:\Windows\System\OvDKzqK.exe
  C:\Windows\System\OvDKzqK.exe
  2⤵
  PID:12568
- C:\Windows\System\xEnAcga.exe
  C:\Windows\System\xEnAcga.exe
  2⤵
  PID:12604
- C:\Windows\System\dfxfavu.exe
  C:\Windows\System\dfxfavu.exe
  2⤵
  PID:12628
- C:\Windows\System\vSdSZXo.exe
  C:\Windows\System\vSdSZXo.exe
  2⤵
  PID:12652
- C:\Windows\System\kXKbMAz.exe
  C:\Windows\System\kXKbMAz.exe
  2⤵
  PID:12680
- C:\Windows\System\NcXxtNt.exe
  C:\Windows\System\NcXxtNt.exe
  2⤵
  PID:12712
- C:\Windows\System\kclAzfs.exe
  C:\Windows\System\kclAzfs.exe
  2⤵
  PID:12736
- C:\Windows\System\UeRccHR.exe
  C:\Windows\System\UeRccHR.exe
  2⤵
  PID:12756
- C:\Windows\System\YrhkzDE.exe
  C:\Windows\System\YrhkzDE.exe
  2⤵
  PID:12776
- C:\Windows\System\MMtPtZW.exe
  C:\Windows\System\MMtPtZW.exe
  2⤵
  PID:12792
- C:\Windows\System\psjcVLS.exe
  C:\Windows\System\psjcVLS.exe
  2⤵
  PID:12812
- C:\Windows\System\OMkAODs.exe
  C:\Windows\System\OMkAODs.exe
  2⤵
  PID:12836
- C:\Windows\System\iUbGcgt.exe
  C:\Windows\System\iUbGcgt.exe
  2⤵
  PID:12856
- C:\Windows\System\IMnZfNS.exe
  C:\Windows\System\IMnZfNS.exe
  2⤵
  PID:12888
- C:\Windows\System\DvTgDuu.exe
  C:\Windows\System\DvTgDuu.exe
  2⤵
  PID:12912
- C:\Windows\System\sylIFCr.exe
  C:\Windows\System\sylIFCr.exe
  2⤵
  PID:12932
- C:\Windows\System\Djbuctn.exe
  C:\Windows\System\Djbuctn.exe
  2⤵
  PID:12956
- C:\Windows\System\GATaujc.exe
  C:\Windows\System\GATaujc.exe
  2⤵
  PID:12984
- C:\Windows\System\IwOUHZH.exe
  C:\Windows\System\IwOUHZH.exe
  2⤵
  PID:13028
- C:\Windows\System\eVTHIHW.exe
  C:\Windows\System\eVTHIHW.exe
  2⤵
  PID:13052
- C:\Windows\System\ZcoZXbz.exe
  C:\Windows\System\ZcoZXbz.exe
  2⤵
  PID:13084
- C:\Windows\System\uHRHVya.exe
  C:\Windows\System\uHRHVya.exe
  2⤵
  PID:13108
- C:\Windows\System\iFBOcsQ.exe
  C:\Windows\System\iFBOcsQ.exe
  2⤵
  PID:13144
- C:\Windows\System\ysaLRAg.exe
  C:\Windows\System\ysaLRAg.exe
  2⤵
  PID:13160
- C:\Windows\System\bpYcHZS.exe
  C:\Windows\System\bpYcHZS.exe
  2⤵
  PID:13192
- C:\Windows\System\ixyAKNV.exe
  C:\Windows\System\ixyAKNV.exe
  2⤵
  PID:13216
- C:\Windows\System\PTlKlFK.exe
  C:\Windows\System\PTlKlFK.exe
  2⤵
  PID:13252
- C:\Windows\System\UsKTEtU.exe
  C:\Windows\System\UsKTEtU.exe
  2⤵
  PID:13280
- C:\Windows\System\mAWmhqB.exe
  C:\Windows\System\mAWmhqB.exe
  2⤵
  PID:13296
- C:\Windows\System\vJiOhco.exe
  C:\Windows\System\vJiOhco.exe
  2⤵
  PID:12112
- C:\Windows\System\Cehgiqv.exe
  C:\Windows\System\Cehgiqv.exe
  2⤵
  PID:11936
- C:\Windows\System\tGUZWNc.exe
  C:\Windows\System\tGUZWNc.exe
  2⤵
  PID:11620
- C:\Windows\System\ojEisLA.exe
  C:\Windows\System\ojEisLA.exe
  2⤵
  PID:11108
- C:\Windows\System\xkyzbtQ.exe
  C:\Windows\System\xkyzbtQ.exe
  2⤵
  PID:11792
- C:\Windows\System\MfswAis.exe
  C:\Windows\System\MfswAis.exe
  2⤵
  PID:11716
- C:\Windows\System\HjaDYlh.exe
  C:\Windows\System\HjaDYlh.exe
  2⤵
  PID:12312
- C:\Windows\System\LMMHPmc.exe
  C:\Windows\System\LMMHPmc.exe
  2⤵
  PID:12352
- C:\Windows\System\otOrPVh.exe
  C:\Windows\System\otOrPVh.exe
  2⤵
  PID:12400
- C:\Windows\System\UniKWmL.exe
  C:\Windows\System\UniKWmL.exe
  2⤵
  PID:12692
- C:\Windows\System\nGTPMVE.exe
  C:\Windows\System\nGTPMVE.exe
  2⤵
  PID:12532
- C:\Windows\System\TsdKlmH.exe
  C:\Windows\System\TsdKlmH.exe
  2⤵
  PID:12564
- C:\Windows\System\AIASzwy.exe
  C:\Windows\System\AIASzwy.exe
  2⤵
  PID:12612
- C:\Windows\System\LMpfZcm.exe
  C:\Windows\System\LMpfZcm.exe
  2⤵
  PID:12676
- C:\Windows\System\CEKTdjx.exe
  C:\Windows\System\CEKTdjx.exe
  2⤵
  PID:13008
- C:\Windows\System\RNDqNRz.exe
  C:\Windows\System\RNDqNRz.exe
  2⤵
  PID:12908
- C:\Windows\System\VPHFnCQ.exe
  C:\Windows\System\VPHFnCQ.exe
  2⤵
  PID:13096
- C:\Windows\System\YyxcexF.exe
  C:\Windows\System\YyxcexF.exe
  2⤵
  PID:12904
- C:\Windows\System\ViPWyRU.exe
  C:\Windows\System\ViPWyRU.exe
  2⤵
  PID:13272
- C:\Windows\System\NGLIdWP.exe
  C:\Windows\System\NGLIdWP.exe
  2⤵
  PID:13000
- C:\Windows\System\PdeVohH.exe
  C:\Windows\System\PdeVohH.exe
  2⤵
  PID:13068
- C:\Windows\System\xRMyWNG.exe
  C:\Windows\System\xRMyWNG.exe
  2⤵
  PID:13200
- C:\Windows\System\dThWSuQ.exe
  C:\Windows\System\dThWSuQ.exe
  2⤵
  PID:11124
- C:\Windows\System\HoGIOwT.exe
  C:\Windows\System\HoGIOwT.exe
  2⤵
  PID:12028
- C:\Windows\System\UTHFbsc.exe
  C:\Windows\System\UTHFbsc.exe
  2⤵
  PID:12520
- C:\Windows\System\FDpcpSk.exe
  C:\Windows\System\FDpcpSk.exe
  2⤵
  PID:12924
- C:\Windows\System\fVVcfNB.exe
  C:\Windows\System\fVVcfNB.exe
  2⤵
  PID:13328
- C:\Windows\System\EDDTXAR.exe
  C:\Windows\System\EDDTXAR.exe
  2⤵
  PID:13356
- C:\Windows\System\OqvcpRx.exe
  C:\Windows\System\OqvcpRx.exe
  2⤵
  PID:13380
- C:\Windows\System\vsSezyQ.exe
  C:\Windows\System\vsSezyQ.exe
  2⤵
  PID:13412
- C:\Windows\System\wMgvjUO.exe
  C:\Windows\System\wMgvjUO.exe
  2⤵
  PID:13440
- C:\Windows\System\wsmTWkW.exe
  C:\Windows\System\wsmTWkW.exe
  2⤵
  PID:13464
- C:\Windows\System\zHRdVnU.exe
  C:\Windows\System\zHRdVnU.exe
  2⤵
  PID:13484
- C:\Windows\System\tGydguN.exe
  C:\Windows\System\tGydguN.exe
  2⤵
  PID:13508
- C:\Windows\System\VvZMRoX.exe
  C:\Windows\System\VvZMRoX.exe
  2⤵
  PID:13540
- C:\Windows\System\qcZCStD.exe
  C:\Windows\System\qcZCStD.exe
  2⤵
  PID:13572
- C:\Windows\System\BEhglpa.exe
  C:\Windows\System\BEhglpa.exe
  2⤵
  PID:13588
- C:\Windows\System\AlMrcta.exe
  C:\Windows\System\AlMrcta.exe
  2⤵
  PID:13616
- C:\Windows\System\EphzTPy.exe
  C:\Windows\System\EphzTPy.exe
  2⤵
  PID:13636
- C:\Windows\System\AVXHxrg.exe
  C:\Windows\System\AVXHxrg.exe
  2⤵
  PID:13660
- C:\Windows\System\tlnrpOc.exe
  C:\Windows\System\tlnrpOc.exe
  2⤵
  PID:13692
- C:\Windows\System\IvHLFBb.exe
  C:\Windows\System\IvHLFBb.exe
  2⤵
  PID:13716
- C:\Windows\System\yidmUIT.exe
  C:\Windows\System\yidmUIT.exe
  2⤵
  PID:13748
- C:\Windows\System\PYnrRmQ.exe
  C:\Windows\System\PYnrRmQ.exe
  2⤵
  PID:13768
- C:\Windows\System\ZBgFYzo.exe
  C:\Windows\System\ZBgFYzo.exe
  2⤵
  PID:13784
- C:\Windows\System\BeRhoZo.exe
  C:\Windows\System\BeRhoZo.exe
  2⤵
  PID:13816
- C:\Windows\System\ZbfjzNs.exe
  C:\Windows\System\ZbfjzNs.exe
  2⤵
  PID:13848
- C:\Windows\System\yslCeVZ.exe
  C:\Windows\System\yslCeVZ.exe
  2⤵
  PID:13876
- C:\Windows\System\BHKAwKq.exe
  C:\Windows\System\BHKAwKq.exe
  2⤵
  PID:13908
- C:\Windows\System\ZWbvOcz.exe
  C:\Windows\System\ZWbvOcz.exe
  2⤵
  PID:13936
- C:\Windows\System\OwDoGkT.exe
  C:\Windows\System\OwDoGkT.exe
  2⤵
  PID:13960
- C:\Windows\System\ZFayypu.exe
  C:\Windows\System\ZFayypu.exe
  2⤵
  PID:13984
- C:\Windows\System\AVspnEh.exe
  C:\Windows\System\AVspnEh.exe
  2⤵
  PID:14004
- C:\Windows\System\bLDEhgW.exe
  C:\Windows\System\bLDEhgW.exe
  2⤵
  PID:14028
- C:\Windows\System\yDdJChz.exe
  C:\Windows\System\yDdJChz.exe
  2⤵
  PID:14048
- C:\Windows\System\ovgVNjP.exe
  C:\Windows\System\ovgVNjP.exe
  2⤵
  PID:14076
- C:\Windows\System\fxlrpmK.exe
  C:\Windows\System\fxlrpmK.exe
  2⤵
  PID:14104
- C:\Windows\System\rByjOhr.exe
  C:\Windows\System\rByjOhr.exe
  2⤵
  PID:14128
- C:\Windows\System\rqFZcqd.exe
  C:\Windows\System\rqFZcqd.exe
  2⤵
  PID:14152
- C:\Windows\System\JpgIIuI.exe
  C:\Windows\System\JpgIIuI.exe
  2⤵
  PID:14176
- C:\Windows\System\aHQCdre.exe
  C:\Windows\System\aHQCdre.exe
  2⤵
  PID:14192
- C:\Windows\System\FJVvLSG.exe
  C:\Windows\System\FJVvLSG.exe
  2⤵
  PID:14220
- C:\Windows\System\RViSzLe.exe
  C:\Windows\System\RViSzLe.exe
  2⤵
  PID:14244
- C:\Windows\System\PjfbUhZ.exe
  C:\Windows\System\PjfbUhZ.exe
  2⤵
  PID:14272
- C:\Windows\System\JOxBXaR.exe
  C:\Windows\System\JOxBXaR.exe
  2⤵
  PID:14308
- C:\Windows\System\HJQgVeu.exe
  C:\Windows\System\HJQgVeu.exe
  2⤵
  PID:14324
- C:\Windows\System\GUaIGmL.exe
  C:\Windows\System\GUaIGmL.exe
  2⤵
  PID:12876
- C:\Windows\System\aWSFCST.exe
  C:\Windows\System\aWSFCST.exe
  2⤵
  PID:12468
- C:\Windows\System\QveTdEq.exe
  C:\Windows\System\QveTdEq.exe
  2⤵
  PID:12056
- C:\Windows\System\NNzfgKs.exe
  C:\Windows\System\NNzfgKs.exe
  2⤵
  PID:12704
- C:\Windows\System\EHXtnvj.exe
  C:\Windows\System\EHXtnvj.exe
  2⤵
  PID:13092
- C:\Windows\System\DTsCrYp.exe
  C:\Windows\System\DTsCrYp.exe
  2⤵
  PID:13496
- C:\Windows\System\CFbgatq.exe
  C:\Windows\System\CFbgatq.exe
  2⤵
  PID:13556
- C:\Windows\System\mUEECkc.exe
  C:\Windows\System\mUEECkc.exe
  2⤵
  PID:13396
- C:\Windows\System\JQfjpJG.exe
  C:\Windows\System\JQfjpJG.exe
  2⤵
  PID:13624
- C:\Windows\System\JpZZAWy.exe
  C:\Windows\System\JpZZAWy.exe
  2⤵
  PID:13680
- C:\Windows\System\drWKwVh.exe
  C:\Windows\System\drWKwVh.exe
  2⤵
  PID:13344
- C:\Windows\System\qhsUTOS.exe
  C:\Windows\System\qhsUTOS.exe
  2⤵
  PID:13376
- C:\Windows\System\vFlhccW.exe
  C:\Windows\System\vFlhccW.exe
  2⤵
  PID:13832
- C:\Windows\System\QJBebuV.exe
  C:\Windows\System\QJBebuV.exe
  2⤵
  PID:13480
- C:\Windows\System\SnIZZFw.exe
  C:\Windows\System\SnIZZFw.exe
  2⤵
  PID:13968
- C:\Windows\System\FqwEalU.exe
  C:\Windows\System\FqwEalU.exe
  2⤵
  PID:13608
- C:\Windows\System\ObZHyLq.exe
  C:\Windows\System\ObZHyLq.exe
  2⤵
  PID:13776
- C:\Windows\System\YPmbGGP.exe
  C:\Windows\System\YPmbGGP.exe
  2⤵
  PID:13980
- C:\Windows\System\UtMsJfz.exe
  C:\Windows\System\UtMsJfz.exe
  2⤵
  PID:14120
- C:\Windows\System\NWpVGuJ.exe
  C:\Windows\System\NWpVGuJ.exe
  2⤵
  PID:12244
- C:\Windows\System\FGxhVxI.exe
  C:\Windows\System\FGxhVxI.exe
  2⤵
  PID:13952
- C:\Windows\System\TlyCVCf.exe
  C:\Windows\System\TlyCVCf.exe
  2⤵
  PID:14268
- C:\Windows\System\ebHBtTU.exe
  C:\Windows\System\ebHBtTU.exe
  2⤵
  PID:14060
- C:\Windows\System\nRycjiU.exe
  C:\Windows\System\nRycjiU.exe
  2⤵
  PID:14096
- C:\Windows\System\pALYEqu.exe
  C:\Windows\System\pALYEqu.exe
  2⤵
  PID:13176
- C:\Windows\System\xDRsaWu.exe
  C:\Windows\System\xDRsaWu.exe
  2⤵
  PID:12696
- C:\Windows\System\jrYFhDb.exe
  C:\Windows\System\jrYFhDb.exe
  2⤵
  PID:14344
- C:\Windows\System\AikyYUC.exe
  C:\Windows\System\AikyYUC.exe
  2⤵
  PID:14360
- C:\Windows\System\zTAtlaF.exe
  C:\Windows\System\zTAtlaF.exe
  2⤵
  PID:14392
- C:\Windows\System\zGBghvI.exe
  C:\Windows\System\zGBghvI.exe
  2⤵
  PID:14408
- C:\Windows\System\RIGFIKs.exe
  C:\Windows\System\RIGFIKs.exe
  2⤵
  PID:14436
- C:\Windows\System\WJvCcjw.exe
  C:\Windows\System\WJvCcjw.exe
  2⤵
  PID:14468
- C:\Windows\System\UtVLEms.exe
  C:\Windows\System\UtVLEms.exe
  2⤵
  PID:14488
- C:\Windows\System\OhnfHHj.exe
  C:\Windows\System\OhnfHHj.exe
  2⤵
  PID:14520
- C:\Windows\System\bKWMnNa.exe
  C:\Windows\System\bKWMnNa.exe
  2⤵
  PID:14552
- C:\Windows\System\WZBHuBu.exe
  C:\Windows\System\WZBHuBu.exe
  2⤵
  PID:14572
- C:\Windows\System\FadiEdP.exe
  C:\Windows\System\FadiEdP.exe
  2⤵
  PID:14596
- C:\Windows\System\FCvPrjx.exe
  C:\Windows\System\FCvPrjx.exe
  2⤵
  PID:14616
- C:\Windows\System\GMhjatT.exe
  C:\Windows\System\GMhjatT.exe
  2⤵
  PID:14644
- C:\Windows\System\JziwlPp.exe
  C:\Windows\System\JziwlPp.exe
  2⤵
  PID:14672
- C:\Windows\System\YiwQfzB.exe
  C:\Windows\System\YiwQfzB.exe
  2⤵
  PID:14696
- C:\Windows\System\NNVMZLa.exe
  C:\Windows\System\NNVMZLa.exe
  2⤵
  PID:14720
- C:\Windows\System\cxKfWST.exe
  C:\Windows\System\cxKfWST.exe
  2⤵
  PID:14760
- C:\Windows\System\KWyvGUq.exe
  C:\Windows\System\KWyvGUq.exe
  2⤵
  PID:14776
- C:\Windows\System\QCKYpSv.exe
  C:\Windows\System\QCKYpSv.exe
  2⤵
  PID:14796
- C:\Windows\System\sQhqccQ.exe
  C:\Windows\System\sQhqccQ.exe
  2⤵
  PID:14820
- C:\Windows\System\GsmlKXJ.exe
  C:\Windows\System\GsmlKXJ.exe
  2⤵
  PID:14848
- C:\Windows\System\SShLLxp.exe
  C:\Windows\System\SShLLxp.exe
  2⤵
  PID:14868
- C:\Windows\System\CxKRWWY.exe
  C:\Windows\System\CxKRWWY.exe
  2⤵
  PID:14900
- C:\Windows\System\DFtldQX.exe
  C:\Windows\System\DFtldQX.exe
  2⤵
  PID:14916
- C:\Windows\System\MUCEHnY.exe
  C:\Windows\System\MUCEHnY.exe
  2⤵
  PID:14936
- C:\Windows\System\EhoAqne.exe
  C:\Windows\System\EhoAqne.exe
  2⤵
  PID:14960
- C:\Windows\System\arTOiKX.exe
  C:\Windows\System\arTOiKX.exe
  2⤵
  PID:14984
- C:\Windows\System\JWzlmfr.exe
  C:\Windows\System\JWzlmfr.exe
  2⤵
  PID:15004
- C:\Windows\System\XchmrgU.exe
  C:\Windows\System\XchmrgU.exe
  2⤵
  PID:15032
- C:\Windows\System\LpMLqao.exe
  C:\Windows\System\LpMLqao.exe
  2⤵
  PID:15048
- C:\Windows\System\JbnLnBe.exe
  C:\Windows\System\JbnLnBe.exe
  2⤵
  PID:15072
- C:\Windows\System\ypBDrlN.exe
  C:\Windows\System\ypBDrlN.exe
  2⤵
  PID:15112
- C:\Windows\System\glQgzPd.exe
  C:\Windows\System\glQgzPd.exe
  2⤵
  PID:15132
- C:\Windows\System\MPfHbQf.exe
  C:\Windows\System\MPfHbQf.exe
  2⤵
  PID:15156
- C:\Windows\System\aPXIEpm.exe
  C:\Windows\System\aPXIEpm.exe
  2⤵
  PID:15180
- C:\Windows\System\hZPUTcN.exe
  C:\Windows\System\hZPUTcN.exe
  2⤵
  PID:15204
- C:\Windows\System\LUxxjmR.exe
  C:\Windows\System\LUxxjmR.exe
  2⤵
  PID:15220
- C:\Windows\System\bQfChVr.exe
  C:\Windows\System\bQfChVr.exe
  2⤵
  PID:15244
- C:\Windows\System\kuIIFgy.exe
  C:\Windows\System\kuIIFgy.exe
  2⤵
  PID:15268
- C:\Windows\System\nWwmlEz.exe
  C:\Windows\System\nWwmlEz.exe
  2⤵
  PID:15292
- C:\Windows\System\wtITaww.exe
  C:\Windows\System\wtITaww.exe
  2⤵
  PID:15316
- C:\Windows\System\TvvRckZ.exe
  C:\Windows\System\TvvRckZ.exe
  2⤵
  PID:15340
- C:\Windows\System\lEqigfz.exe
  C:\Windows\System\lEqigfz.exe
  2⤵
  PID:13560
- C:\Windows\System\tygQmPT.exe
  C:\Windows\System\tygQmPT.exe
  2⤵
  PID:13872
- C:\Windows\System\kCErCMe.exe
  C:\Windows\System\kCErCMe.exe
  2⤵
  PID:12444
- C:\Windows\System\MPHUxOr.exe
  C:\Windows\System\MPHUxOr.exe
  2⤵
  PID:14020
- C:\Windows\System\IthbGyM.exe
  C:\Windows\System\IthbGyM.exe
  2⤵
  PID:14188
- C:\Windows\System\rLavZpz.exe
  C:\Windows\System\rLavZpz.exe
  2⤵
  PID:14376
- C:\Windows\System\Vcfvsvk.exe
  C:\Windows\System\Vcfvsvk.exe
  2⤵
  PID:12324
- C:\Windows\System\OdTepdO.exe
  C:\Windows\System\OdTepdO.exe
  2⤵
  PID:13368
- C:\Windows\System\svlxhZS.exe
  C:\Windows\System\svlxhZS.exe
  2⤵
  PID:13652
- C:\Windows\System\EkvWZBr.exe
  C:\Windows\System\EkvWZBr.exe
  2⤵
  PID:13836
- C:\Windows\System\nVqbsQq.exe
  C:\Windows\System\nVqbsQq.exe
  2⤵
  PID:14680
- C:\Windows\System\afAFYIK.exe
  C:\Windows\System\afAFYIK.exe
  2⤵
  PID:12724
- C:\Windows\System\kciLeqS.exe
  C:\Windows\System\kciLeqS.exe
  2⤵
  PID:14908
- C:\Windows\System\QSGQYhx.exe
  C:\Windows\System\QSGQYhx.exe
  2⤵
  PID:14140
- C:\Windows\System\PRAjdSM.exe
  C:\Windows\System\PRAjdSM.exe
  2⤵
  PID:14660
- C:\Windows\System\qhIbJsh.exe
  C:\Windows\System\qhIbJsh.exe
  2⤵
  PID:15024
- C:\Windows\System\BaynuDv.exe
  C:\Windows\System\BaynuDv.exe
  2⤵
  PID:14452
- C:\Windows\System\QJExwGE.exe
  C:\Windows\System\QJExwGE.exe
  2⤵
  PID:14772
- C:\Windows\System\QtAHyJU.exe
  C:\Windows\System\QtAHyJU.exe
  2⤵
  PID:15188
- C:\Windows\System\lcczaaD.exe
  C:\Windows\System\lcczaaD.exe
  2⤵
  PID:14880
- C:\Windows\System\MPgsxbA.exe
  C:\Windows\System\MPgsxbA.exe
  2⤵
  PID:15020
- C:\Windows\System\ecMUJnL.exe
  C:\Windows\System\ecMUJnL.exe
  2⤵
  PID:14752
- C:\Windows\System\mqwheRW.exe
  C:\Windows\System\mqwheRW.exe
  2⤵
  PID:15376
- C:\Windows\System\GvYLVCF.exe
  C:\Windows\System\GvYLVCF.exe
  2⤵
  PID:15400
- C:\Windows\System\GfpuYYz.exe
  C:\Windows\System\GfpuYYz.exe
  2⤵
  PID:15420
- C:\Windows\System\MkiWcni.exe
  C:\Windows\System\MkiWcni.exe
  2⤵
  PID:15448
- C:\Windows\System\nqsLcsf.exe
  C:\Windows\System\nqsLcsf.exe
  2⤵
  PID:15468
- C:\Windows\System\KWtVJEI.exe
  C:\Windows\System\KWtVJEI.exe
  2⤵
  PID:15500
- C:\Windows\System\tGHyvJl.exe
  C:\Windows\System\tGHyvJl.exe
  2⤵
  PID:15532
- C:\Windows\System\ZwmkppB.exe
  C:\Windows\System\ZwmkppB.exe
  2⤵
  PID:15552
- C:\Windows\System\qcKcshj.exe
  C:\Windows\System\qcKcshj.exe
  2⤵
  PID:15592
- C:\Windows\System\BpNsrZb.exe
  C:\Windows\System\BpNsrZb.exe
  2⤵
  PID:15616
- C:\Windows\System\ubGUlXf.exe
  C:\Windows\System\ubGUlXf.exe
  2⤵
  PID:15632
- C:\Windows\System\YqaYItH.exe
  C:\Windows\System\YqaYItH.exe
  2⤵
  PID:15652
- C:\Windows\System\lgyxRAI.exe
  C:\Windows\System\lgyxRAI.exe
  2⤵
  PID:15668
- C:\Windows\System\sMRPaAV.exe
  C:\Windows\System\sMRPaAV.exe
  2⤵
  PID:15692
- C:\Windows\System\FIGPNDw.exe
  C:\Windows\System\FIGPNDw.exe
  2⤵
  PID:15712
- C:\Windows\System\XjYHWgH.exe
  C:\Windows\System\XjYHWgH.exe
  2⤵
  PID:15732
- C:\Windows\System\YcyBFPv.exe
  C:\Windows\System\YcyBFPv.exe
  2⤵
  PID:15756
- C:\Windows\System\xyisLDm.exe
  C:\Windows\System\xyisLDm.exe
  2⤵
  PID:15780
- C:\Windows\System\iyKQpmg.exe
  C:\Windows\System\iyKQpmg.exe
  2⤵
  PID:15804
- C:\Windows\System\DebimfV.exe
  C:\Windows\System\DebimfV.exe
  2⤵
  PID:15828
- C:\Windows\System\bKmcifP.exe
  C:\Windows\System\bKmcifP.exe
  2⤵
  PID:15856
- C:\Windows\System\XAHSCdz.exe
  C:\Windows\System\XAHSCdz.exe
  2⤵
  PID:15872
- C:\Windows\System\XQVtmKq.exe
  C:\Windows\System\XQVtmKq.exe
  2⤵
  PID:15900
- C:\Windows\System\waVOSjD.exe
  C:\Windows\System\waVOSjD.exe
  2⤵
  PID:15924
- C:\Windows\System\KTwbzuL.exe
  C:\Windows\System\KTwbzuL.exe
  2⤵
  PID:15948
- C:\Windows\System\ramJIMn.exe
  C:\Windows\System\ramJIMn.exe
  2⤵
  PID:15976
- C:\Windows\System\iQKZnlh.exe
  C:\Windows\System\iQKZnlh.exe
  2⤵
  PID:15996
- C:\Windows\System\HkkSvZZ.exe
  C:\Windows\System\HkkSvZZ.exe
  2⤵
  PID:16020
- C:\Windows\System\qsKPiKA.exe
  C:\Windows\System\qsKPiKA.exe
  2⤵
  PID:16044
- C:\Windows\System\ziKIkhs.exe
  C:\Windows\System\ziKIkhs.exe
  2⤵
  PID:16064
- C:\Windows\System\tEDBVEI.exe
  C:\Windows\System\tEDBVEI.exe
  2⤵
  PID:16092
- C:\Windows\System\bTOcojo.exe
  C:\Windows\System\bTOcojo.exe
  2⤵
  PID:16112
- C:\Windows\System\AqbbpYb.exe
  C:\Windows\System\AqbbpYb.exe
  2⤵
  PID:16136
- C:\Windows\System\abVksjE.exe
  C:\Windows\System\abVksjE.exe
  2⤵
  PID:16160
- C:\Windows\System\SZgMeip.exe
  C:\Windows\System\SZgMeip.exe
  2⤵
  PID:16180
- C:\Windows\System\hfCxqdJ.exe
  C:\Windows\System\hfCxqdJ.exe
  2⤵
  PID:16196
- C:\Windows\System\dvJwkOn.exe
  C:\Windows\System\dvJwkOn.exe
  2⤵
  PID:16216
- C:\Windows\System\HVbKXTH.exe
  C:\Windows\System\HVbKXTH.exe
  2⤵
  PID:16252
- C:\Windows\System\TGYHEXy.exe
  C:\Windows\System\TGYHEXy.exe
  2⤵
  PID:16268
- C:\Windows\System\gHsZyhn.exe
  C:\Windows\System\gHsZyhn.exe
  2⤵
  PID:16300
- C:\Windows\System\eLhPnUj.exe
  C:\Windows\System\eLhPnUj.exe
  2⤵
  PID:16320
- C:\Windows\System\Hczfzry.exe
  C:\Windows\System\Hczfzry.exe
  2⤵
  PID:15916
- C:\Windows\System\OGtIPOa.exe
  C:\Windows\System\OGtIPOa.exe
  2⤵
  PID:16012
- C:\Windows\System\dHurZzq.exe
  C:\Windows\System\dHurZzq.exe
  2⤵
  PID:16100
- C:\Windows\System\exqQkuY.exe
  C:\Windows\System\exqQkuY.exe
  2⤵
  PID:15700
- C:\Windows\System\OGrCNad.exe
  C:\Windows\System\OGrCNad.exe
  2⤵
  PID:16328
- C:\Windows\System\tWqjiYH.exe
  C:\Windows\System\tWqjiYH.exe
  2⤵
  PID:15256
- C:\Windows\System\VGXEfTH.exe
  C:\Windows\System\VGXEfTH.exe
  2⤵
  PID:16172
- C:\Windows\System\KtXjUSg.exe
  C:\Windows\System\KtXjUSg.exe
  2⤵
  PID:16204
- C:\Windows\System\ooQfKuQ.exe
  C:\Windows\System\ooQfKuQ.exe
  2⤵
  PID:15124
- C:\Windows\System\sqSMctJ.exe
  C:\Windows\System\sqSMctJ.exe
  2⤵
  PID:13944
- C:\Windows\System\OCnTvJC.exe
  C:\Windows\System\OCnTvJC.exe
  2⤵
  PID:12592
- C:\Windows\System\HbRHYNn.exe
  C:\Windows\System\HbRHYNn.exe
  2⤵
  PID:15476
- C:\Windows\System\DVgVcGf.exe
  C:\Windows\System\DVgVcGf.exe
  2⤵
  PID:14804
- C:\Windows\System\tnOoGfy.exe
  C:\Windows\System\tnOoGfy.exe
  2⤵
  PID:16212
- C:\Windows\System\jdGsnWe.exe
  C:\Windows\System\jdGsnWe.exe
  2⤵
  PID:16076
- C:\Windows\System\oDrHtmF.exe
  C:\Windows\System\oDrHtmF.exe
  2⤵
  PID:16128
- C:\Windows\System\RYyBtrG.exe
  C:\Windows\System\RYyBtrG.exe
  2⤵
  PID:16088
- C:\Windows\System\xEfXwIl.exe
  C:\Windows\System\xEfXwIl.exe
  2⤵
  PID:15888
- C:\Windows\System\DpgsTSR.exe
  C:\Windows\System\DpgsTSR.exe
  2⤵
  PID:16188
- C:\Windows\System\CQlGEeG.exe
  C:\Windows\System\CQlGEeG.exe
  2⤵
  PID:16176
- C:\Windows\System\jMTLWlU.exe
  C:\Windows\System\jMTLWlU.exe
  2⤵
  PID:15560
- C:\Windows\System\MpklJNm.exe
  C:\Windows\System\MpklJNm.exe
  2⤵
  PID:15308
- C:\Windows\System\DnEajeB.exe
  C:\Windows\System\DnEajeB.exe
  2⤵
  PID:15936
- C:\Windows\System\ewyZaUZ.exe
  C:\Windows\System\ewyZaUZ.exe
  2⤵
  PID:16120
- C:\Windows\System\rTCUxaw.exe
  C:\Windows\System\rTCUxaw.exe
  2⤵
  PID:16400
- C:\Windows\System\QVvNJsj.exe
  C:\Windows\System\QVvNJsj.exe
  2⤵
  PID:16432
- C:\Windows\System\TpeXyNp.exe
  C:\Windows\System\TpeXyNp.exe
  2⤵
  PID:16452
- C:\Windows\System\EGDeald.exe
  C:\Windows\System\EGDeald.exe
  2⤵
  PID:16476
- C:\Windows\System\WzrPAsI.exe
  C:\Windows\System\WzrPAsI.exe
  2⤵
  PID:16500
- C:\Windows\System\HyxKqgb.exe
  C:\Windows\System\HyxKqgb.exe
  2⤵
  PID:16536
- C:\Windows\System\onRaddi.exe
  C:\Windows\System\onRaddi.exe
  2⤵
  PID:16556
- C:\Windows\System\nhRINeN.exe
  C:\Windows\System\nhRINeN.exe
  2⤵
  PID:16584
- C:\Windows\System\RXMwAbZ.exe
  C:\Windows\System\RXMwAbZ.exe
  2⤵
  PID:16612
- C:\Windows\System\yKPHhsV.exe
  C:\Windows\System\yKPHhsV.exe
  2⤵
  PID:16628
- C:\Windows\System\ElDlUvS.exe
  C:\Windows\System\ElDlUvS.exe
  2⤵
  PID:16652
- C:\Windows\System\dxBlaqH.exe
  C:\Windows\System\dxBlaqH.exe
  2⤵
  PID:16692
- C:\Windows\System\sSlgNIk.exe
  C:\Windows\System\sSlgNIk.exe
  2⤵
  PID:16712
- C:\Windows\System\eGeBAjr.exe
  C:\Windows\System\eGeBAjr.exe
  2⤵
  PID:16736
- C:\Windows\System\dHoMBDK.exe
  C:\Windows\System\dHoMBDK.exe
  2⤵
  PID:16756
- C:\Windows\System\yiVQzdH.exe
  C:\Windows\System\yiVQzdH.exe
  2⤵
  PID:16780
- C:\Windows\System\CAAukAh.exe
  C:\Windows\System\CAAukAh.exe
  2⤵
  PID:16808
- C:\Windows\System\IErxGRI.exe
  C:\Windows\System\IErxGRI.exe
  2⤵
  PID:16828
- C:\Windows\System\QAlXPwi.exe
  C:\Windows\System\QAlXPwi.exe
  2⤵
  PID:16856
- C:\Windows\System\fNrlPqX.exe
  C:\Windows\System\fNrlPqX.exe
  2⤵
  PID:16872
- C:\Windows\System\wiRSKNb.exe
  C:\Windows\System\wiRSKNb.exe
  2⤵
  PID:16904
- C:\Windows\System\aTtiGfw.exe
  C:\Windows\System\aTtiGfw.exe
  2⤵
  PID:16928
- C:\Windows\System\dEqcEkV.exe
  C:\Windows\System\dEqcEkV.exe
  2⤵
  PID:16944
- C:\Windows\System\ltUGDji.exe
  C:\Windows\System\ltUGDji.exe
  2⤵
  PID:16964
- C:\Windows\System\XPIZMGz.exe
  C:\Windows\System\XPIZMGz.exe
  2⤵
  PID:16980
- C:\Windows\System\ZeBWCgq.exe
  C:\Windows\System\ZeBWCgq.exe
  2⤵
  PID:17016
- C:\Windows\System\bYwaIsz.exe
  C:\Windows\System\bYwaIsz.exe
  2⤵
  PID:17048
- C:\Windows\System\OJQeLbs.exe
  C:\Windows\System\OJQeLbs.exe
  2⤵
  PID:17068
- C:\Windows\System\CtxAjkD.exe
  C:\Windows\System\CtxAjkD.exe
  2⤵
  PID:17104
- C:\Windows\System\yjqIURb.exe
  C:\Windows\System\yjqIURb.exe
  2⤵
  PID:17132
- C:\Windows\System\vWMuSVO.exe
  C:\Windows\System\vWMuSVO.exe
  2⤵
  PID:17152
- C:\Windows\System\ZutlrGz.exe
  C:\Windows\System\ZutlrGz.exe
  2⤵
  PID:17176
- C:\Windows\System\fRIkYDt.exe
  C:\Windows\System\fRIkYDt.exe
  2⤵
  PID:12256
- - C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -u -p 12256 -s 252
    3⤵
    PID:17096
- C:\Windows\System\FxaWViu.exe
  C:\Windows\System\FxaWViu.exe
  2⤵
  PID:16608
- C:\Windows\System\MNgigBm.exe
  C:\Windows\System\MNgigBm.exe
  2⤵
  PID:16468
- C:\Windows\System\vkJqjJZ.exe
  C:\Windows\System\vkJqjJZ.exe
  2⤵
  PID:16700
- C:\Windows\System\VJmlJdL.exe
  C:\Windows\System\VJmlJdL.exe
  2⤵
  PID:16704

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:17292

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\ACYqIhx.exe

Filesize
1.4MB

MD5
e59a032156555e4531b2d691fdf8b52b

SHA1
5c74cc3072f00718ab83434b3a37372acda1bde9

SHA256
8fdaeb83feb6cc70763eb7fa953613347f844a569e0ba0ff480bf6123dd495a0

SHA512
f2e53440aeeb79268ded5b284f15486bacbba2d14783bcc3ca3c568951dac391532beebb2c54f58e775f8aefc923d0ac532b15310e7f87078b3af481b081d3ae

Download Submit
C:\Windows\System\CIXcDqr.exe

Filesize
1.4MB

MD5
bc53e4af67891e8d9ee3594c5982d26a

SHA1
d85afe4a85d6d0caa0237841a093004c58e90e10

SHA256
ef753cd28072ee1fa9d9d4477d1d799a36b4172e2b1a3263e9af5b26ea963963

SHA512
230296b8a5bb1d05865e658f18d7658b2d52b70c3a49a2b2993b54726a551d487a61fed8bf1343738e63a442a9f6ee9a2fdd34702460edce31093f8b197bc06b

Download Submit
C:\Windows\System\CVBwgBe.exe

Filesize
1.4MB

MD5
4fb3a4981c15a47c4df4058e226dca7a

SHA1
8ababeeeb45d7ec91f7342619c5b3afd2e5e9e81

SHA256
184e0b57f4f953717a5ee177000668f15de534584631a4e7a8d808e4b7fc0b02

SHA512
4389e780402c9cdad89542ccc6a0906633e2ba65805ad1f019626b4db09bb1a383928932296165bc1a23c8ba6f2cefdb13615730082eb2503590219c2604a94e

Download Submit
C:\Windows\System\DmzvAlY.exe

Filesize
1.4MB

MD5
08bc8d23e28d6737ee20b47a6300bc9c

SHA1
37b0758b6cfee528d7b90a8719a641c71d7c41b7

SHA256
f6e6e508fe10e7b0088fb820481426002b7c79291d46a81b02d33e7f75003d8d

SHA512
007082ca165ade20c6140fd3a4cb63c666ae5501ac42f87bb7f37af54cad34bdb0ef0acdd69a350ec262b0a7d70440c257a9dd76e4f93b3256f3eeda9cba3ca4

Download Submit
C:\Windows\System\FvuYcbP.exe

Filesize
1.4MB

MD5
b511e46ed3ccb6aae06e1afb113f7ad5

SHA1
97496964fa058040a573b257c0f40a18df5262c5

SHA256
4df1dd1c279a32b96ed7b36659d76aa54c2421339eda2163dfb7da648e4b6a1e

SHA512
44d667d583d1ec9a617e79d8a2a7150e4e8486537779619256c1424a1eed4989e7cf459717f742c3432fcddb92aea6b7cffb1e648f95a8d0bf51e059074537fb

Download Submit
C:\Windows\System\GrRTQpy.exe

Filesize
1.4MB

MD5
d2f1dc3f029d043e00b6965a3034aae6

SHA1
aa25a679dcd2e469a6b65fc942ce63379366d29b

SHA256
af976b57d736fd2b802ff6ddf2fca94f2293db4baa4abf65c4c52789207d4938

SHA512
fc85a5995ce35bd4f34661681ebd8d7605241826c5487ad9c0f8716385ad2ebaf26a759a136de6f6b6bc94fdbaa37ed1c10590c871d97cd3827d045085145b1e

Download Submit
C:\Windows\System\JANtMal.exe

Filesize
1.4MB

MD5
453be6aece33a99c624890fbc9740bea

SHA1
19b4ac47c0a7c0117136c73f2fa1c9179040140b

SHA256
272fb0fc0061540fb0675462e23e506273452f757a9674106d7f40c5f65bf396

SHA512
130af045247ca6e256682508d016f72b52f59379d6875d13bf8f34dea4ecf3d53acf1f3fd6f2cae8a9c6f464146e752295b31b90514e4d24706f1c215fab5822

Download Submit
C:\Windows\System\MZldGfH.exe

Filesize
1.4MB

MD5
7a5d99590b0f8b06a3da9014a7ab38be

SHA1
e847324f97703aa7eeb8b1c239c3627814197d9a

SHA256
6b44f432f44b5753b5162957d32b399a7022cb3aee941ee98d2a6924daaad880

SHA512
e2a42cdab33a3a4d48ba432994a29982c8b7fd6fc8d8d6daf5fd3976d77d1c0248fd260f8738547263e362ae613fc14843640cc4b71a8d6e847fdb66e1df1d67

Download Submit
C:\Windows\System\OeDweIO.exe

Filesize
1.4MB

MD5
3eb735497677b7ebe649cb21762d9a92

SHA1
ac74099dd27825fbd38d73e646f059f40731d43b

SHA256
c17babc735ed5e8c236baca3ff58b2dc154a251642bde7b4c2099853216e8320

SHA512
9d2341f1c2632d596c0e7c66c56fbbe0d80274200f2682874d5defe962b0a7ce647fc24c309a56ed98e13a56f357bec1191a907b3fd91ffd006d8d87a8182eb8

Download Submit
C:\Windows\System\PsvCFQc.exe

Filesize
1.4MB

MD5
f77ae192fbc721d298533f03da22af9c

SHA1
107404c13992762b6015ebd3427d6332db730ae4

SHA256
8e708442b80a7cc8de60fb3912cfef975aec3e6492c6b9578f4269eec4b15844

SHA512
31fee85e134f66fa58386336e1dd193c1adf9943cd9f0fbec623c19a72d6dd0daf0f929c3146dd4aab71068bbc146157988e5462d822a284fb149e0c0575cba2

Download Submit
C:\Windows\System\QHPYqtq.exe

Filesize
1.4MB

MD5
e387bc1c930144a7eff8aa2d9ae98dc9

SHA1
277775ac5e7bd37082e31146e58fa4a07642e3d4

SHA256
2536cb772d102c94e4f707d2623c1b8f98105b584cca22d77128174ce1d8647d

SHA512
868271dc382599f4497c4cc568f16209e29f97eeaec8edf5f005ed09b282d0f6b1d48237815b3625498ffdd7ef7a01521649c62c7371c8958a0a604bee90721a

Download Submit
C:\Windows\System\RoFhAZy.exe

Filesize
1.4MB

MD5
3cd3f5a9a408ee4b51abab63620ac854

SHA1
c4f1692b6b8f0f256d91eb07369bd8b27baa2e17

SHA256
caeeef3d31bf7d97c1c79498365adec99b5d458069758b63080dd21c4605e466

SHA512
9054f25340c5d9ae36b4b7ce3349aa69a343f8570c3dcae64713a0118e31eba17f28c13288a5190b2ae3bdab42fe5f4bea5a5ac9f9ac67957fbe771e5134f298

Download Submit
C:\Windows\System\SoOErtd.exe

Filesize
1.4MB

MD5
4ab8a38092a7fa28acce64768b7e1b46

SHA1
ec4667a05915c5c57a9989b4e1a62905e0d5f3e0

SHA256
6fb140fff857ccc58d0ab3888d7cf33105298aeec0e74bbde3d2460adac3761f

SHA512
12265cf31d6a541dda203dc21fa78c82016ab3536969d43da302cdcf84f02b89034328c6c5451c6af31b514613eb21609258d6b15fd4a0eb67bef49b34ae6584

Download Submit
C:\Windows\System\VDyJthD.exe

Filesize
1.4MB

MD5
aadab1ac80a7dc1d4e47195efe1e8af3

SHA1
0710ac024c3836a25f22b68ceec7519ed5ba7a54

SHA256
265e8a83ceaf4c07ac974711e8eaf1c1da8025abaa4d542ba332a6da064b2a50

SHA512
17cc68ce47db648ce193684ff61429f5f8d6d561814620c0accb28c0fb5ac6e99ceaed3d3a82b163b630258e91b86a3e95c262744c191437f15aec28edc844fc

Download Submit
C:\Windows\System\WIaDdPN.exe

Filesize
1.4MB

MD5
ef3c437cdff3d966defc45936b5a42d7

SHA1
e5169e29ee1a108c7aef4c608ed7de0cb7bd9067

SHA256
cc3441e76623828092f060dafbd98c09dc32e21d35e0efb5b909e5df7eaf8121

SHA512
a38e4fd95f9fe05bc7d69ffecd0081074ad0a840a023b4f2712ef323559dcb352e14fbba9d428d7965df6cd2feb7dd5ad6c40802e8f69d2ad731e02bc8555f88

Download Submit
C:\Windows\System\WPINgfG.exe

Filesize
1.4MB

MD5
6c80056c04c413bc945b891c9e0daef6

SHA1
03bd3c0a1205a364365a0bd71642cf4a77a76591

SHA256
dd132622c2d16b50207ed6220ea77b36df2dd4bf731add15dc3674982d635bf7

SHA512
fe884ce9b0f37bc22c8d190ab41e47c3663ba51e054b1b3403a96601bb302228584fca59f21b820f386356b9979b88d4d41ae9c4372bba93585a54fae3f00f59

Download Submit
C:\Windows\System\WxyeUye.exe

Filesize
1.4MB

MD5
4a0d4ece93f6d23959d45ba2e92ff698

SHA1
bae67f7c1200158f20c0a01ca7527ececb281b0b

SHA256
18818a324148511135a44f9d042122aa54cb2f0a54a0bbbd7ae934b4869f7b23

SHA512
7ae0824714f073e51ec88089119b89906f855c701fa185b068533dbef043e7f1f7d474ddc8531281012933850ef272db7003c280dcfa99325c86895bf423612b

Download Submit
C:\Windows\System\XCfQZUn.exe

Filesize
1.4MB

MD5
5f5f201914d64d50a0ef67bad36fe57f

SHA1
68427e7efecf2ec9e2cbedd75c4b07fd89b754c4

SHA256
6b5e02e8a33fad6cb325c283ee03a2325d8b5fe7e8426aa99c4bf01eda5d65f5

SHA512
7d789e68e14466979b36089a02cb5fe6feea019dd20c4c210759aa4f661832806f81a18bdbed6fe1f852267df59ed4bc9f2a2b5019e92643e78889197545c9c0

Download Submit
C:\Windows\System\XyhNOrG.exe

Filesize
1.4MB

MD5
c2f5cc39e4afc53e03293c8c302094b7

SHA1
8381d7ad7046246e219f38c4e17d978904a69dc6

SHA256
cd466bebfe0efcb17f8dfdf79a1977d135ef75c6dec2b5ac6876366365154660

SHA512
6d37b48fd0da6355dee26d0d9b9413598996c3ef37233e4311abb054b092d0f00edf81835446a1877337853f277a132436c6c1d5d09e8bd94e2f92ea161c0ad2

Download Submit
C:\Windows\System\aAfcQLy.exe

Filesize
1.4MB

MD5
142c196cf0b2c733b18c463e8431b699

SHA1
13c2f6611fbe44eeb6c9985ba87e81b6764b4f79

SHA256
e1fd068bc429425a5e98413d52b64e29ac2c5ab68a7b3ef007ab5ef5e0c9fda5

SHA512
86d2da457b24bd99f06abe7799185f72a95bf10fc47168f32441e20d6fb0897247de530721d7dd230d9b01122371f86be0535f845629b6fdc0dd597df02d42d4

Download Submit
C:\Windows\System\byTZNro.exe

Filesize
1.4MB

MD5
6467ecc723af4aeb5ed062f9ee491a1b

SHA1
ba1a969429cb703adc8f21f107cac5b2a7849102

SHA256
71a70edfcf234167e8650efa78f2c683f8c8170d8e3f0e5edbdd3b9e5874602c

SHA512
e50dd80ec44660c1e2bf29986d2181dba2d10261a6d39a5a96665e750d4925bd8c888cd6170cf8df54bedc0669f3fba410ed159496fb7c77ae7d80cae369d420

Download Submit
C:\Windows\System\hAwGyTx.exe

Filesize
1.4MB

MD5
2fae9a5b8e71e75be88b613d9b85160c

SHA1
54fbfe4c626ea9295e91d5853fa735b3a2b5b10e

SHA256
541f3bb0f25d29b01add90f254bd28ea9f2470006852150307dae3c38c26f1ef

SHA512
7a365db60436fc1d622077d37ce0f039094c6280b53a2f61928326bd294663f28f1194e8a4538bce9dae106272bb6df0fc90ddb8755ce619224b0638cb0c40db

Download Submit
C:\Windows\System\hqetVlb.exe

Filesize
1.4MB

MD5
3607841c7fa66b54b96716b346ed9531

SHA1
56083faa0493c017a24edf8927d107739cd2d76c

SHA256
1fcc07c751a76784c2340c318b31e8d22bf1b29f4a24ee4f2fc9036adc78e9ce

SHA512
43252644d6f329f9dfee33ad0ed51d6f49f9d3d4c6b46a9467c3095197796422ea2bdb35985209b1d61542c4db599b717d01ad507a2bb5436de9247c868fcd75

Download Submit
C:\Windows\System\ihvlKCj.exe

Filesize
1.4MB

MD5
ac399ed8863f70b01deeb5254847018c

SHA1
f60e4a82c0406a18726b805eaaf8c5fe250656ec

SHA256
7c4f0a0669c80404fb3465edf12a49cb7e9ded6c6222e3e238ac8cd8a591e579

SHA512
378880c27aa409e3418471b7a8ffc9e43fa8f0419a70666e7a54a5369eaba3db27c568db02bfec33b73ad49e732f66cc0124bdb218964c2179155abee1956910

Download Submit
C:\Windows\System\jtiamgf.exe

Filesize
1.4MB

MD5
67fb54afa9d9e410748aaca5d3bf0825

SHA1
571cadd33b90e394c3c326b83e615a25ac6eb18d

SHA256
fd01d6d8df7bccf9f7b90318fb4e424377a3954868f02003e61c946643d72d80

SHA512
33d2f7ae3043c7c593e807314316250a472173c2b3123bdc26ce1372ea5a966caa2de078c8db165bec1a91cf9507dc81313dfabad8b1de5ce09086a6193d100b

Download Submit
C:\Windows\System\kDJTDLh.exe

Filesize
1.4MB

MD5
5cca0b45f89cde9861c83a4967b3d3f6

SHA1
348b62caa22acba89a5ca97ef69fdf09d7daef6a

SHA256
a2caa23bda3b8d975e0ff61dc7bb29256bd91aecfaa4e8441fcfedc970f13d98

SHA512
008ff1c9ec7083fdb566f028e2da5828bd7de206bfc74740c09eccb1f7ac2e231ce59b03806f14fd4f1560fc5f060a5412a533b0e4f763496bdd437eef3611c8

Download Submit
C:\Windows\System\kvnbzxq.exe

Filesize
1.4MB

MD5
df8b04c72ad2ead58a2cf58fdcd809a6

SHA1
0903abf71f1a3c82f3b45533ea1c90456a15b585

SHA256
628ed816e73b6b409afc48475aeef4c71c2751eb6e37bfacc4d0f1827e921fc3

SHA512
a80eedee16b716b0c6d0a1e908c5ff32dbe2b35f77ce2ce832ef6391d4098cb4a73fb490c8e31b21526b0d97e2a3791e95a59cbb363ccdd9db92c307a234b147

Download Submit
C:\Windows\System\peDVTYK.exe

Filesize
1.4MB

MD5
9429ca555be3f37dfd240b146440d952

SHA1
2d9ea575d567af21aa1813621c7f5d24ad97a045

SHA256
9b76510a27ad8f464a8e8f01ff5bca6571a75f5037c3416baa639cae41b0d855

SHA512
6aa7ebfa095acec6d72223ffd7eba2c16abdfd1773779b538e594280166eacf46fb809d052c5e87096df6060e9be9fd7d918747842e13895fc8340c1fc2016ad

Download Submit
C:\Windows\System\pefkFZM.exe

Filesize
1.4MB

MD5
2d11205fcf54174c289f1e71c66dc204

SHA1
2bb3c2fd24367da8931f4229dbcf00da696329f7

SHA256
cbcfb0e03f1a9c1c3f6720bf7ff960320de543d77177cc602fd32862fe3e9a98

SHA512
ea6ebb3d1b8f4f4324f7b3696bf9d090e074b0463ca9f6c9111db20dd4e42aed179d0285633ae419ca9ebae02ef6319dc5d8515e9abdc12909a79a21d398ef96

Download Submit
C:\Windows\System\sUWTgFr.exe

Filesize
1.4MB

MD5
6139354bd0c75f99fafdd443fe81b302

SHA1
e446a80aa69f3eee4b583137add76b25597e0f16

SHA256
9557c5b8041202149455c434eae440428bd2ed311e18c8a31beed75e6425331e

SHA512
8903533b2e033ade3fe11f6fb6d4b59ac2e9a48121ecc4a3df1726153ce8c5275422564f0037d06f772cb4988634108aa3f2f563caf53aac49e4659cf87b6e9c

Download Submit
C:\Windows\System\uUnTIHq.exe

Filesize
1.4MB

MD5
3c13cce21443fce4a073676ef734b6b9

SHA1
7effc8b33dbb7f88aafad4607f15143561d4d349

SHA256
3bbb9619234c5f724217dc9e284f30c72e743e25f9b1f9588a84599ecb006961

SHA512
7d6d665311ecb11eca53cfb514264ff353da19f6ca4652d77efcc2ec400682241903e337d1f43db0f684daf49e2c0ee16da62a40d5ef17df94907899c0b104ed

Download Submit
C:\Windows\System\wRNTNUU.exe

Filesize
1.4MB

MD5
50e373c7bc5122d5363f561f0b9790f3

SHA1
dec621926f8613aea9f2ddd9f9df63c42341c597

SHA256
dff5361b2abdae7155666959a9d91ec01b4d347261fee73a5f4397e9aa782c08

SHA512
55a19f1996c417bb00492a1d18c7db99ed0c6e34d992b05553eb248561ead0459fac85ed9445d48f8b3ebb644ac08a2addee3a9d09cf664a04b10680d15411ea

Download Submit
C:\Windows\System\wXBBiLE.exe

Filesize
1.4MB

MD5
b55921c2c9fd5fbd7a421622d8498276

SHA1
78800bba16da8ef41d1f8545f2bf5175d8a085e5

SHA256
9c1d4b6259a0397eb85803d793bb97d2746d71a148ce184df372eab7ff82a449

SHA512
87612ca63b5dada142c0ec19e073887d5968dfe33543f6e2a775be3cfd733fe9336a58386d27148f67ddb271a4a67915365805a54a0a45f810232881d5c35aa7

Download Submit
memory/4612-0-0x000002C763B90000-0x000002C763BA0000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads