xmrig | 5511f7a259ea6185552cee192a24a1069ad77ebf1dac79853240cd241e650501

Analysis

max time kernel
143s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
11-11-2024 22:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5511f7a259ea6185552cee192a24a1069ad77ebf1dac79853240cd241e650501.exe
Size

1.4MB
MD5

00b32e994c31d5aa18fe10673cf3bee5
SHA1

19515b0d680b776f238330d22674d89a9f4b48aa
SHA256

5511f7a259ea6185552cee192a24a1069ad77ebf1dac79853240cd241e650501
SHA512

85ed96857e6c34e3848b3eb8827c290c1cc6ea0d3706a33f1604d69e330ccedca783ffc7b2f6547a80bf0f0b9ac7369ccfb587fe61a0019e4e9609a2c416e70c
SSDEEP

24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbpwlKenszaDw4BnT6DNtMiQkFrL0:GezaTF8FcNkNdfE0pZ9ozttwIRakGngU

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 33 IoCs

miner

resource	yara_rule
behavioral2/files/0x000c000000023b81-4.dat	xmrig
behavioral2/files/0x0007000000023c74-6.dat	xmrig
behavioral2/files/0x0008000000023c70-9.dat	xmrig
behavioral2/files/0x0007000000023c76-19.dat	xmrig
behavioral2/files/0x0007000000023c77-22.dat	xmrig
behavioral2/files/0x0007000000023c78-29.dat	xmrig
behavioral2/files/0x0007000000023c79-32.dat	xmrig
behavioral2/files/0x0007000000023c7a-39.dat	xmrig
behavioral2/files/0x0007000000023c7b-44.dat	xmrig
behavioral2/files/0x0007000000023c7d-52.dat	xmrig
behavioral2/files/0x0007000000023c7e-57.dat	xmrig
behavioral2/files/0x0007000000023c84-87.dat	xmrig
behavioral2/files/0x0007000000023c8c-127.dat	xmrig
behavioral2/files/0x0007000000023c8e-145.dat	xmrig
behavioral2/files/0x0007000000023c93-162.dat	xmrig
behavioral2/files/0x0007000000023c91-160.dat	xmrig
behavioral2/files/0x0007000000023c92-157.dat	xmrig
behavioral2/files/0x0007000000023c90-155.dat	xmrig
behavioral2/files/0x0007000000023c8f-150.dat	xmrig
behavioral2/files/0x0007000000023c8d-140.dat	xmrig
behavioral2/files/0x0007000000023c8b-130.dat	xmrig
behavioral2/files/0x0007000000023c8a-125.dat	xmrig
behavioral2/files/0x0007000000023c89-120.dat	xmrig
behavioral2/files/0x0007000000023c88-115.dat	xmrig
behavioral2/files/0x0007000000023c87-110.dat	xmrig
behavioral2/files/0x0007000000023c86-105.dat	xmrig
behavioral2/files/0x0007000000023c85-100.dat	xmrig
behavioral2/files/0x0007000000023c83-90.dat	xmrig
behavioral2/files/0x0007000000023c82-83.dat	xmrig
behavioral2/files/0x0007000000023c81-80.dat	xmrig
behavioral2/files/0x0007000000023c80-76.dat	xmrig
behavioral2/files/0x0007000000023c7f-72.dat	xmrig
behavioral2/files/0x0007000000023c7c-58.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
1668	NFaBmAk.exe
4952	zTclMdy.exe
3592	TmTHwsH.exe
1648	BuqePqH.exe
1232	ETDfsDY.exe
736	MILdMvW.exe
3404	uINYUYK.exe
2976	HmKKqYE.exe
4432	lbiSCNu.exe
4896	qgeDcAD.exe
3948	kpiVxvk.exe
3992	vEdqATn.exe
2848	mBwRmqa.exe
4048	PGZrREu.exe
5032	rYjZwlE.exe
5108	YbEbzlP.exe
4720	lzGzLZv.exe
1156	eGIRERP.exe
2596	ZznWjsB.exe
4328	qzKefwQ.exe
400	qFUtYRB.exe
1836	yTAirYO.exe
3716	fLAfceb.exe
452	Fgsgazw.exe
4624	bxHNGIc.exe
3884	YAdoCsx.exe
3236	AapqCnb.exe
3036	vHUIqFK.exe
2856	yhbvsxa.exe
4032	efYSWAQ.exe
4500	zMtDnWa.exe
2384	BOSrCEa.exe
4748	ShOfpGF.exe
3392	rJnjpEV.exe
1268	oyAwtdo.exe
1860	gdVpcVl.exe
388	XBmHRaG.exe
1732	OeJakhL.exe
4176	aalARRL.exe
5016	xpwgrZW.exe
3728	PQHdNyr.exe
2572	RUNGEBv.exe
2812	UVRNxnx.exe
2432	vhfywCf.exe
4528	NCGroDg.exe
4708	voOsCUo.exe
4168	CJuphbk.exe
1644	zvupkKM.exe
2364	dBLXlcQ.exe
2728	JdCzpFk.exe
4452	ydICwXx.exe
4360	NSjjBai.exe
4844	SlUbDlO.exe
1492	zzHXjMN.exe
1808	VXDVqSC.exe
3568	DlSAjxT.exe
2392	NThcVdl.exe
2452	vUXgScz.exe
3156	EpbkaLt.exe
2208	rlrceZi.exe
4304	wHoTlSk.exe
1280	DsAiRWU.exe
3996	lnVkvll.exe
4340	BXoMIZv.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\hxohKOA.exe	5511f7a259ea6185552cee192a24a1069ad77ebf1dac79853240cd241e650501.exe
File created	C:\Windows\System\DGqLjgZ.exe	5511f7a259ea6185552cee192a24a1069ad77ebf1dac79853240cd241e650501.exe
File created	C:\Windows\System\LTZgPUn.exe	5511f7a259ea6185552cee192a24a1069ad77ebf1dac79853240cd241e650501.exe
File created	C:\Windows\System\lpMGPgy.exe	5511f7a259ea6185552cee192a24a1069ad77ebf1dac79853240cd241e650501.exe
File created	C:\Windows\System\SFuDpgU.exe	5511f7a259ea6185552cee192a24a1069ad77ebf1dac79853240cd241e650501.exe
File created	C:\Windows\System\HjArxgW.exe	5511f7a259ea6185552cee192a24a1069ad77ebf1dac79853240cd241e650501.exe
File created	C:\Windows\System\ZGVvEsb.exe	5511f7a259ea6185552cee192a24a1069ad77ebf1dac79853240cd241e650501.exe
File created	C:\Windows\System\bvKDODr.exe	5511f7a259ea6185552cee192a24a1069ad77ebf1dac79853240cd241e650501.exe
File created	C:\Windows\System\tVCMZAX.exe	5511f7a259ea6185552cee192a24a1069ad77ebf1dac79853240cd241e650501.exe
File created	C:\Windows\System\djNKlSW.exe	5511f7a259ea6185552cee192a24a1069ad77ebf1dac79853240cd241e650501.exe
File created	C:\Windows\System\CJuphbk.exe	5511f7a259ea6185552cee192a24a1069ad77ebf1dac79853240cd241e650501.exe
File created	C:\Windows\System\JPVSTbg.exe	5511f7a259ea6185552cee192a24a1069ad77ebf1dac79853240cd241e650501.exe
File created	C:\Windows\System\wPMiGkr.exe	5511f7a259ea6185552cee192a24a1069ad77ebf1dac79853240cd241e650501.exe
File created	C:\Windows\System\nShwJzL.exe	5511f7a259ea6185552cee192a24a1069ad77ebf1dac79853240cd241e650501.exe
File created	C:\Windows\System\CBFCsjS.exe	5511f7a259ea6185552cee192a24a1069ad77ebf1dac79853240cd241e650501.exe
File created	C:\Windows\System\vjdsWfU.exe	5511f7a259ea6185552cee192a24a1069ad77ebf1dac79853240cd241e650501.exe
File created	C:\Windows\System\afxiLpA.exe	5511f7a259ea6185552cee192a24a1069ad77ebf1dac79853240cd241e650501.exe
File created	C:\Windows\System\Whxvbyb.exe	5511f7a259ea6185552cee192a24a1069ad77ebf1dac79853240cd241e650501.exe
File created	C:\Windows\System\topwAGR.exe	5511f7a259ea6185552cee192a24a1069ad77ebf1dac79853240cd241e650501.exe
File created	C:\Windows\System\YZNTtkE.exe	5511f7a259ea6185552cee192a24a1069ad77ebf1dac79853240cd241e650501.exe
File created	C:\Windows\System\XUKVBVs.exe	5511f7a259ea6185552cee192a24a1069ad77ebf1dac79853240cd241e650501.exe
File created	C:\Windows\System\sViqilW.exe	5511f7a259ea6185552cee192a24a1069ad77ebf1dac79853240cd241e650501.exe
File created	C:\Windows\System\YEVebtE.exe	5511f7a259ea6185552cee192a24a1069ad77ebf1dac79853240cd241e650501.exe
File created	C:\Windows\System\jlXSIVP.exe	5511f7a259ea6185552cee192a24a1069ad77ebf1dac79853240cd241e650501.exe
File created	C:\Windows\System\eeWNZjW.exe	5511f7a259ea6185552cee192a24a1069ad77ebf1dac79853240cd241e650501.exe
File created	C:\Windows\System\zMVkoKb.exe	5511f7a259ea6185552cee192a24a1069ad77ebf1dac79853240cd241e650501.exe
File created	C:\Windows\System\TSTfcXB.exe	5511f7a259ea6185552cee192a24a1069ad77ebf1dac79853240cd241e650501.exe
File created	C:\Windows\System\wXNXpvl.exe	5511f7a259ea6185552cee192a24a1069ad77ebf1dac79853240cd241e650501.exe
File created	C:\Windows\System\fzTkNVS.exe	5511f7a259ea6185552cee192a24a1069ad77ebf1dac79853240cd241e650501.exe
File created	C:\Windows\System\DOFMYpt.exe	5511f7a259ea6185552cee192a24a1069ad77ebf1dac79853240cd241e650501.exe
File created	C:\Windows\System\qvraqYV.exe	5511f7a259ea6185552cee192a24a1069ad77ebf1dac79853240cd241e650501.exe
File created	C:\Windows\System\nJyuymj.exe	5511f7a259ea6185552cee192a24a1069ad77ebf1dac79853240cd241e650501.exe
File created	C:\Windows\System\RfkhuKI.exe	5511f7a259ea6185552cee192a24a1069ad77ebf1dac79853240cd241e650501.exe
File created	C:\Windows\System\RMNLiQA.exe	5511f7a259ea6185552cee192a24a1069ad77ebf1dac79853240cd241e650501.exe
File created	C:\Windows\System\xzkmmPB.exe	5511f7a259ea6185552cee192a24a1069ad77ebf1dac79853240cd241e650501.exe
File created	C:\Windows\System\vYzUDXf.exe	5511f7a259ea6185552cee192a24a1069ad77ebf1dac79853240cd241e650501.exe
File created	C:\Windows\System\VFVZXkk.exe	5511f7a259ea6185552cee192a24a1069ad77ebf1dac79853240cd241e650501.exe
File created	C:\Windows\System\gwPmDqq.exe	5511f7a259ea6185552cee192a24a1069ad77ebf1dac79853240cd241e650501.exe
File created	C:\Windows\System\zUHGeiZ.exe	5511f7a259ea6185552cee192a24a1069ad77ebf1dac79853240cd241e650501.exe
File created	C:\Windows\System\lExtydq.exe	5511f7a259ea6185552cee192a24a1069ad77ebf1dac79853240cd241e650501.exe
File created	C:\Windows\System\aalARRL.exe	5511f7a259ea6185552cee192a24a1069ad77ebf1dac79853240cd241e650501.exe
File created	C:\Windows\System\XQKukSe.exe	5511f7a259ea6185552cee192a24a1069ad77ebf1dac79853240cd241e650501.exe
File created	C:\Windows\System\BjdIxBa.exe	5511f7a259ea6185552cee192a24a1069ad77ebf1dac79853240cd241e650501.exe
File created	C:\Windows\System\KpXlQQo.exe	5511f7a259ea6185552cee192a24a1069ad77ebf1dac79853240cd241e650501.exe
File created	C:\Windows\System\EbZwRBg.exe	5511f7a259ea6185552cee192a24a1069ad77ebf1dac79853240cd241e650501.exe
File created	C:\Windows\System\uKgQcJc.exe	5511f7a259ea6185552cee192a24a1069ad77ebf1dac79853240cd241e650501.exe
File created	C:\Windows\System\cIRNbfk.exe	5511f7a259ea6185552cee192a24a1069ad77ebf1dac79853240cd241e650501.exe
File created	C:\Windows\System\zSrSRBZ.exe	5511f7a259ea6185552cee192a24a1069ad77ebf1dac79853240cd241e650501.exe
File created	C:\Windows\System\oYZneYR.exe	5511f7a259ea6185552cee192a24a1069ad77ebf1dac79853240cd241e650501.exe
File created	C:\Windows\System\iIZaaFC.exe	5511f7a259ea6185552cee192a24a1069ad77ebf1dac79853240cd241e650501.exe
File created	C:\Windows\System\HXgIeqq.exe	5511f7a259ea6185552cee192a24a1069ad77ebf1dac79853240cd241e650501.exe
File created	C:\Windows\System\MHgSCJs.exe	5511f7a259ea6185552cee192a24a1069ad77ebf1dac79853240cd241e650501.exe
File created	C:\Windows\System\JyHgHTt.exe	5511f7a259ea6185552cee192a24a1069ad77ebf1dac79853240cd241e650501.exe
File created	C:\Windows\System\BznwBpD.exe	5511f7a259ea6185552cee192a24a1069ad77ebf1dac79853240cd241e650501.exe
File created	C:\Windows\System\jJgXTuo.exe	5511f7a259ea6185552cee192a24a1069ad77ebf1dac79853240cd241e650501.exe
File created	C:\Windows\System\ykoNxDB.exe	5511f7a259ea6185552cee192a24a1069ad77ebf1dac79853240cd241e650501.exe
File created	C:\Windows\System\CzJhItz.exe	5511f7a259ea6185552cee192a24a1069ad77ebf1dac79853240cd241e650501.exe
File created	C:\Windows\System\IwtbWPp.exe	5511f7a259ea6185552cee192a24a1069ad77ebf1dac79853240cd241e650501.exe
File created	C:\Windows\System\DVizVak.exe	5511f7a259ea6185552cee192a24a1069ad77ebf1dac79853240cd241e650501.exe
File created	C:\Windows\System\qtJAEPF.exe	5511f7a259ea6185552cee192a24a1069ad77ebf1dac79853240cd241e650501.exe
File created	C:\Windows\System\vVnypeh.exe	5511f7a259ea6185552cee192a24a1069ad77ebf1dac79853240cd241e650501.exe
File created	C:\Windows\System\kohYkev.exe	5511f7a259ea6185552cee192a24a1069ad77ebf1dac79853240cd241e650501.exe
File created	C:\Windows\System\eCqyxrK.exe	5511f7a259ea6185552cee192a24a1069ad77ebf1dac79853240cd241e650501.exe
File created	C:\Windows\System\EBPuAhe.exe	5511f7a259ea6185552cee192a24a1069ad77ebf1dac79853240cd241e650501.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	17396	dwm.exe
Token: SeChangeNotifyPrivilege	17396	dwm.exe
Token: 33	17396	dwm.exe
Token: SeIncBasePriorityPrivilege	17396	dwm.exe
Token: SeShutdownPrivilege	17396	dwm.exe
Token: SeCreatePagefilePrivilege	17396	dwm.exe
Token: SeShutdownPrivilege	17396	dwm.exe
Token: SeCreatePagefilePrivilege	17396	dwm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2600 wrote to memory of 1668	2600	5511f7a259ea6185552cee192a24a1069ad77ebf1dac79853240cd241e650501.exe	84
PID 2600 wrote to memory of 1668	2600	5511f7a259ea6185552cee192a24a1069ad77ebf1dac79853240cd241e650501.exe	84
PID 2600 wrote to memory of 4952	2600	5511f7a259ea6185552cee192a24a1069ad77ebf1dac79853240cd241e650501.exe	85
PID 2600 wrote to memory of 4952	2600	5511f7a259ea6185552cee192a24a1069ad77ebf1dac79853240cd241e650501.exe	85
PID 2600 wrote to memory of 3592	2600	5511f7a259ea6185552cee192a24a1069ad77ebf1dac79853240cd241e650501.exe	86
PID 2600 wrote to memory of 3592	2600	5511f7a259ea6185552cee192a24a1069ad77ebf1dac79853240cd241e650501.exe	86
PID 2600 wrote to memory of 1648	2600	5511f7a259ea6185552cee192a24a1069ad77ebf1dac79853240cd241e650501.exe	87
PID 2600 wrote to memory of 1648	2600	5511f7a259ea6185552cee192a24a1069ad77ebf1dac79853240cd241e650501.exe	87
PID 2600 wrote to memory of 1232	2600	5511f7a259ea6185552cee192a24a1069ad77ebf1dac79853240cd241e650501.exe	88
PID 2600 wrote to memory of 1232	2600	5511f7a259ea6185552cee192a24a1069ad77ebf1dac79853240cd241e650501.exe	88
PID 2600 wrote to memory of 736	2600	5511f7a259ea6185552cee192a24a1069ad77ebf1dac79853240cd241e650501.exe	89
PID 2600 wrote to memory of 736	2600	5511f7a259ea6185552cee192a24a1069ad77ebf1dac79853240cd241e650501.exe	89
PID 2600 wrote to memory of 3404	2600	5511f7a259ea6185552cee192a24a1069ad77ebf1dac79853240cd241e650501.exe	92
PID 2600 wrote to memory of 3404	2600	5511f7a259ea6185552cee192a24a1069ad77ebf1dac79853240cd241e650501.exe	92
PID 2600 wrote to memory of 2976	2600	5511f7a259ea6185552cee192a24a1069ad77ebf1dac79853240cd241e650501.exe	93
PID 2600 wrote to memory of 2976	2600	5511f7a259ea6185552cee192a24a1069ad77ebf1dac79853240cd241e650501.exe	93
PID 2600 wrote to memory of 4432	2600	5511f7a259ea6185552cee192a24a1069ad77ebf1dac79853240cd241e650501.exe	94
PID 2600 wrote to memory of 4432	2600	5511f7a259ea6185552cee192a24a1069ad77ebf1dac79853240cd241e650501.exe	94
PID 2600 wrote to memory of 4896	2600	5511f7a259ea6185552cee192a24a1069ad77ebf1dac79853240cd241e650501.exe	95
PID 2600 wrote to memory of 4896	2600	5511f7a259ea6185552cee192a24a1069ad77ebf1dac79853240cd241e650501.exe	95
PID 2600 wrote to memory of 3948	2600	5511f7a259ea6185552cee192a24a1069ad77ebf1dac79853240cd241e650501.exe	97
PID 2600 wrote to memory of 3948	2600	5511f7a259ea6185552cee192a24a1069ad77ebf1dac79853240cd241e650501.exe	97
PID 2600 wrote to memory of 3992	2600	5511f7a259ea6185552cee192a24a1069ad77ebf1dac79853240cd241e650501.exe	98
PID 2600 wrote to memory of 3992	2600	5511f7a259ea6185552cee192a24a1069ad77ebf1dac79853240cd241e650501.exe	98
PID 2600 wrote to memory of 2848	2600	5511f7a259ea6185552cee192a24a1069ad77ebf1dac79853240cd241e650501.exe	99
PID 2600 wrote to memory of 2848	2600	5511f7a259ea6185552cee192a24a1069ad77ebf1dac79853240cd241e650501.exe	99
PID 2600 wrote to memory of 4048	2600	5511f7a259ea6185552cee192a24a1069ad77ebf1dac79853240cd241e650501.exe	100
PID 2600 wrote to memory of 4048	2600	5511f7a259ea6185552cee192a24a1069ad77ebf1dac79853240cd241e650501.exe	100
PID 2600 wrote to memory of 5032	2600	5511f7a259ea6185552cee192a24a1069ad77ebf1dac79853240cd241e650501.exe	101
PID 2600 wrote to memory of 5032	2600	5511f7a259ea6185552cee192a24a1069ad77ebf1dac79853240cd241e650501.exe	101
PID 2600 wrote to memory of 5108	2600	5511f7a259ea6185552cee192a24a1069ad77ebf1dac79853240cd241e650501.exe	102
PID 2600 wrote to memory of 5108	2600	5511f7a259ea6185552cee192a24a1069ad77ebf1dac79853240cd241e650501.exe	102
PID 2600 wrote to memory of 4720	2600	5511f7a259ea6185552cee192a24a1069ad77ebf1dac79853240cd241e650501.exe	103
PID 2600 wrote to memory of 4720	2600	5511f7a259ea6185552cee192a24a1069ad77ebf1dac79853240cd241e650501.exe	103
PID 2600 wrote to memory of 1156	2600	5511f7a259ea6185552cee192a24a1069ad77ebf1dac79853240cd241e650501.exe	104
PID 2600 wrote to memory of 1156	2600	5511f7a259ea6185552cee192a24a1069ad77ebf1dac79853240cd241e650501.exe	104
PID 2600 wrote to memory of 2596	2600	5511f7a259ea6185552cee192a24a1069ad77ebf1dac79853240cd241e650501.exe	105
PID 2600 wrote to memory of 2596	2600	5511f7a259ea6185552cee192a24a1069ad77ebf1dac79853240cd241e650501.exe	105
PID 2600 wrote to memory of 4328	2600	5511f7a259ea6185552cee192a24a1069ad77ebf1dac79853240cd241e650501.exe	106
PID 2600 wrote to memory of 4328	2600	5511f7a259ea6185552cee192a24a1069ad77ebf1dac79853240cd241e650501.exe	106
PID 2600 wrote to memory of 400	2600	5511f7a259ea6185552cee192a24a1069ad77ebf1dac79853240cd241e650501.exe	107
PID 2600 wrote to memory of 400	2600	5511f7a259ea6185552cee192a24a1069ad77ebf1dac79853240cd241e650501.exe	107
PID 2600 wrote to memory of 1836	2600	5511f7a259ea6185552cee192a24a1069ad77ebf1dac79853240cd241e650501.exe	108
PID 2600 wrote to memory of 1836	2600	5511f7a259ea6185552cee192a24a1069ad77ebf1dac79853240cd241e650501.exe	108
PID 2600 wrote to memory of 3716	2600	5511f7a259ea6185552cee192a24a1069ad77ebf1dac79853240cd241e650501.exe	109
PID 2600 wrote to memory of 3716	2600	5511f7a259ea6185552cee192a24a1069ad77ebf1dac79853240cd241e650501.exe	109
PID 2600 wrote to memory of 452	2600	5511f7a259ea6185552cee192a24a1069ad77ebf1dac79853240cd241e650501.exe	110
PID 2600 wrote to memory of 452	2600	5511f7a259ea6185552cee192a24a1069ad77ebf1dac79853240cd241e650501.exe	110
PID 2600 wrote to memory of 4624	2600	5511f7a259ea6185552cee192a24a1069ad77ebf1dac79853240cd241e650501.exe	111
PID 2600 wrote to memory of 4624	2600	5511f7a259ea6185552cee192a24a1069ad77ebf1dac79853240cd241e650501.exe	111
PID 2600 wrote to memory of 3884	2600	5511f7a259ea6185552cee192a24a1069ad77ebf1dac79853240cd241e650501.exe	112
PID 2600 wrote to memory of 3884	2600	5511f7a259ea6185552cee192a24a1069ad77ebf1dac79853240cd241e650501.exe	112
PID 2600 wrote to memory of 3236	2600	5511f7a259ea6185552cee192a24a1069ad77ebf1dac79853240cd241e650501.exe	113
PID 2600 wrote to memory of 3236	2600	5511f7a259ea6185552cee192a24a1069ad77ebf1dac79853240cd241e650501.exe	113
PID 2600 wrote to memory of 3036	2600	5511f7a259ea6185552cee192a24a1069ad77ebf1dac79853240cd241e650501.exe	114
PID 2600 wrote to memory of 3036	2600	5511f7a259ea6185552cee192a24a1069ad77ebf1dac79853240cd241e650501.exe	114
PID 2600 wrote to memory of 2856	2600	5511f7a259ea6185552cee192a24a1069ad77ebf1dac79853240cd241e650501.exe	115
PID 2600 wrote to memory of 2856	2600	5511f7a259ea6185552cee192a24a1069ad77ebf1dac79853240cd241e650501.exe	115
PID 2600 wrote to memory of 4032	2600	5511f7a259ea6185552cee192a24a1069ad77ebf1dac79853240cd241e650501.exe	116
PID 2600 wrote to memory of 4032	2600	5511f7a259ea6185552cee192a24a1069ad77ebf1dac79853240cd241e650501.exe	116
PID 2600 wrote to memory of 4500	2600	5511f7a259ea6185552cee192a24a1069ad77ebf1dac79853240cd241e650501.exe	117
PID 2600 wrote to memory of 4500	2600	5511f7a259ea6185552cee192a24a1069ad77ebf1dac79853240cd241e650501.exe	117
PID 2600 wrote to memory of 2384	2600	5511f7a259ea6185552cee192a24a1069ad77ebf1dac79853240cd241e650501.exe	118
PID 2600 wrote to memory of 2384	2600	5511f7a259ea6185552cee192a24a1069ad77ebf1dac79853240cd241e650501.exe	118

C:\Users\Admin\AppData\Local\Temp\5511f7a259ea6185552cee192a24a1069ad77ebf1dac79853240cd241e650501.exe
"C:\Users\Admin\AppData\Local\Temp\5511f7a259ea6185552cee192a24a1069ad77ebf1dac79853240cd241e650501.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2600
- C:\Windows\System\NFaBmAk.exe
  C:\Windows\System\NFaBmAk.exe
  2⤵
  - Executes dropped EXE
  PID:1668
- C:\Windows\System\zTclMdy.exe
  C:\Windows\System\zTclMdy.exe
  2⤵
  - Executes dropped EXE
  PID:4952
- C:\Windows\System\TmTHwsH.exe
  C:\Windows\System\TmTHwsH.exe
  2⤵
  - Executes dropped EXE
  PID:3592
- C:\Windows\System\BuqePqH.exe
  C:\Windows\System\BuqePqH.exe
  2⤵
  - Executes dropped EXE
  PID:1648
- C:\Windows\System\ETDfsDY.exe
  C:\Windows\System\ETDfsDY.exe
  2⤵
  - Executes dropped EXE
  PID:1232
- C:\Windows\System\MILdMvW.exe
  C:\Windows\System\MILdMvW.exe
  2⤵
  - Executes dropped EXE
  PID:736
- C:\Windows\System\uINYUYK.exe
  C:\Windows\System\uINYUYK.exe
  2⤵
  - Executes dropped EXE
  PID:3404
- C:\Windows\System\HmKKqYE.exe
  C:\Windows\System\HmKKqYE.exe
  2⤵
  - Executes dropped EXE
  PID:2976
- C:\Windows\System\lbiSCNu.exe
  C:\Windows\System\lbiSCNu.exe
  2⤵
  - Executes dropped EXE
  PID:4432
- C:\Windows\System\qgeDcAD.exe
  C:\Windows\System\qgeDcAD.exe
  2⤵
  - Executes dropped EXE
  PID:4896
- C:\Windows\System\kpiVxvk.exe
  C:\Windows\System\kpiVxvk.exe
  2⤵
  - Executes dropped EXE
  PID:3948
- C:\Windows\System\vEdqATn.exe
  C:\Windows\System\vEdqATn.exe
  2⤵
  - Executes dropped EXE
  PID:3992
- C:\Windows\System\mBwRmqa.exe
  C:\Windows\System\mBwRmqa.exe
  2⤵
  - Executes dropped EXE
  PID:2848
- C:\Windows\System\PGZrREu.exe
  C:\Windows\System\PGZrREu.exe
  2⤵
  - Executes dropped EXE
  PID:4048
- C:\Windows\System\rYjZwlE.exe
  C:\Windows\System\rYjZwlE.exe
  2⤵
  - Executes dropped EXE
  PID:5032
- C:\Windows\System\YbEbzlP.exe
  C:\Windows\System\YbEbzlP.exe
  2⤵
  - Executes dropped EXE
  PID:5108
- C:\Windows\System\lzGzLZv.exe
  C:\Windows\System\lzGzLZv.exe
  2⤵
  - Executes dropped EXE
  PID:4720
- C:\Windows\System\eGIRERP.exe
  C:\Windows\System\eGIRERP.exe
  2⤵
  - Executes dropped EXE
  PID:1156
- C:\Windows\System\ZznWjsB.exe
  C:\Windows\System\ZznWjsB.exe
  2⤵
  - Executes dropped EXE
  PID:2596
- C:\Windows\System\qzKefwQ.exe
  C:\Windows\System\qzKefwQ.exe
  2⤵
  - Executes dropped EXE
  PID:4328
- C:\Windows\System\qFUtYRB.exe
  C:\Windows\System\qFUtYRB.exe
  2⤵
  - Executes dropped EXE
  PID:400
- C:\Windows\System\yTAirYO.exe
  C:\Windows\System\yTAirYO.exe
  2⤵
  - Executes dropped EXE
  PID:1836
- C:\Windows\System\fLAfceb.exe
  C:\Windows\System\fLAfceb.exe
  2⤵
  - Executes dropped EXE
  PID:3716
- C:\Windows\System\Fgsgazw.exe
  C:\Windows\System\Fgsgazw.exe
  2⤵
  - Executes dropped EXE
  PID:452
- C:\Windows\System\bxHNGIc.exe
  C:\Windows\System\bxHNGIc.exe
  2⤵
  - Executes dropped EXE
  PID:4624
- C:\Windows\System\YAdoCsx.exe
  C:\Windows\System\YAdoCsx.exe
  2⤵
  - Executes dropped EXE
  PID:3884
- C:\Windows\System\AapqCnb.exe
  C:\Windows\System\AapqCnb.exe
  2⤵
  - Executes dropped EXE
  PID:3236
- C:\Windows\System\vHUIqFK.exe
  C:\Windows\System\vHUIqFK.exe
  2⤵
  - Executes dropped EXE
  PID:3036
- C:\Windows\System\yhbvsxa.exe
  C:\Windows\System\yhbvsxa.exe
  2⤵
  - Executes dropped EXE
  PID:2856
- C:\Windows\System\efYSWAQ.exe
  C:\Windows\System\efYSWAQ.exe
  2⤵
  - Executes dropped EXE
  PID:4032
- C:\Windows\System\zMtDnWa.exe
  C:\Windows\System\zMtDnWa.exe
  2⤵
  - Executes dropped EXE
  PID:4500
- C:\Windows\System\BOSrCEa.exe
  C:\Windows\System\BOSrCEa.exe
  2⤵
  - Executes dropped EXE
  PID:2384
- C:\Windows\System\ShOfpGF.exe
  C:\Windows\System\ShOfpGF.exe
  2⤵
  - Executes dropped EXE
  PID:4748
- C:\Windows\System\rJnjpEV.exe
  C:\Windows\System\rJnjpEV.exe
  2⤵
  - Executes dropped EXE
  PID:3392
- C:\Windows\System\oyAwtdo.exe
  C:\Windows\System\oyAwtdo.exe
  2⤵
  - Executes dropped EXE
  PID:1268
- C:\Windows\System\gdVpcVl.exe
  C:\Windows\System\gdVpcVl.exe
  2⤵
  - Executes dropped EXE
  PID:1860
- C:\Windows\System\XBmHRaG.exe
  C:\Windows\System\XBmHRaG.exe
  2⤵
  - Executes dropped EXE
  PID:388
- C:\Windows\System\OeJakhL.exe
  C:\Windows\System\OeJakhL.exe
  2⤵
  - Executes dropped EXE
  PID:1732
- C:\Windows\System\aalARRL.exe
  C:\Windows\System\aalARRL.exe
  2⤵
  - Executes dropped EXE
  PID:4176
- C:\Windows\System\xpwgrZW.exe
  C:\Windows\System\xpwgrZW.exe
  2⤵
  - Executes dropped EXE
  PID:5016
- C:\Windows\System\PQHdNyr.exe
  C:\Windows\System\PQHdNyr.exe
  2⤵
  - Executes dropped EXE
  PID:3728
- C:\Windows\System\RUNGEBv.exe
  C:\Windows\System\RUNGEBv.exe
  2⤵
  - Executes dropped EXE
  PID:2572
- C:\Windows\System\UVRNxnx.exe
  C:\Windows\System\UVRNxnx.exe
  2⤵
  - Executes dropped EXE
  PID:2812
- C:\Windows\System\vhfywCf.exe
  C:\Windows\System\vhfywCf.exe
  2⤵
  - Executes dropped EXE
  PID:2432
- C:\Windows\System\NCGroDg.exe
  C:\Windows\System\NCGroDg.exe
  2⤵
  - Executes dropped EXE
  PID:4528
- C:\Windows\System\voOsCUo.exe
  C:\Windows\System\voOsCUo.exe
  2⤵
  - Executes dropped EXE
  PID:4708
- C:\Windows\System\CJuphbk.exe
  C:\Windows\System\CJuphbk.exe
  2⤵
  - Executes dropped EXE
  PID:4168
- C:\Windows\System\zvupkKM.exe
  C:\Windows\System\zvupkKM.exe
  2⤵
  - Executes dropped EXE
  PID:1644
- C:\Windows\System\dBLXlcQ.exe
  C:\Windows\System\dBLXlcQ.exe
  2⤵
  - Executes dropped EXE
  PID:2364
- C:\Windows\System\JdCzpFk.exe
  C:\Windows\System\JdCzpFk.exe
  2⤵
  - Executes dropped EXE
  PID:2728
- C:\Windows\System\ydICwXx.exe
  C:\Windows\System\ydICwXx.exe
  2⤵
  - Executes dropped EXE
  PID:4452
- C:\Windows\System\NSjjBai.exe
  C:\Windows\System\NSjjBai.exe
  2⤵
  - Executes dropped EXE
  PID:4360
- C:\Windows\System\SlUbDlO.exe
  C:\Windows\System\SlUbDlO.exe
  2⤵
  - Executes dropped EXE
  PID:4844
- C:\Windows\System\zzHXjMN.exe
  C:\Windows\System\zzHXjMN.exe
  2⤵
  - Executes dropped EXE
  PID:1492
- C:\Windows\System\VXDVqSC.exe
  C:\Windows\System\VXDVqSC.exe
  2⤵
  - Executes dropped EXE
  PID:1808
- C:\Windows\System\DlSAjxT.exe
  C:\Windows\System\DlSAjxT.exe
  2⤵
  - Executes dropped EXE
  PID:3568
- C:\Windows\System\NThcVdl.exe
  C:\Windows\System\NThcVdl.exe
  2⤵
  - Executes dropped EXE
  PID:2392
- C:\Windows\System\vUXgScz.exe
  C:\Windows\System\vUXgScz.exe
  2⤵
  - Executes dropped EXE
  PID:2452
- C:\Windows\System\EpbkaLt.exe
  C:\Windows\System\EpbkaLt.exe
  2⤵
  - Executes dropped EXE
  PID:3156
- C:\Windows\System\rlrceZi.exe
  C:\Windows\System\rlrceZi.exe
  2⤵
  - Executes dropped EXE
  PID:2208
- C:\Windows\System\wHoTlSk.exe
  C:\Windows\System\wHoTlSk.exe
  2⤵
  - Executes dropped EXE
  PID:4304
- C:\Windows\System\DsAiRWU.exe
  C:\Windows\System\DsAiRWU.exe
  2⤵
  - Executes dropped EXE
  PID:1280
- C:\Windows\System\lnVkvll.exe
  C:\Windows\System\lnVkvll.exe
  2⤵
  - Executes dropped EXE
  PID:3996
- C:\Windows\System\BXoMIZv.exe
  C:\Windows\System\BXoMIZv.exe
  2⤵
  - Executes dropped EXE
  PID:4340
- C:\Windows\System\XDNZhkm.exe
  C:\Windows\System\XDNZhkm.exe
  2⤵
  PID:3632
- C:\Windows\System\fWZQGJw.exe
  C:\Windows\System\fWZQGJw.exe
  2⤵
  PID:3844
- C:\Windows\System\RHAYdpu.exe
  C:\Windows\System\RHAYdpu.exe
  2⤵
  PID:4544
- C:\Windows\System\upsUqJP.exe
  C:\Windows\System\upsUqJP.exe
  2⤵
  PID:5008
- C:\Windows\System\VTQhLnq.exe
  C:\Windows\System\VTQhLnq.exe
  2⤵
  PID:5128
- C:\Windows\System\fxeasPO.exe
  C:\Windows\System\fxeasPO.exe
  2⤵
  PID:5152
- C:\Windows\System\hpXucaX.exe
  C:\Windows\System\hpXucaX.exe
  2⤵
  PID:5184
- C:\Windows\System\mrUGGbp.exe
  C:\Windows\System\mrUGGbp.exe
  2⤵
  PID:5212
- C:\Windows\System\mfQOkMx.exe
  C:\Windows\System\mfQOkMx.exe
  2⤵
  PID:5240
- C:\Windows\System\hxohKOA.exe
  C:\Windows\System\hxohKOA.exe
  2⤵
  PID:5268
- C:\Windows\System\GIaOjlw.exe
  C:\Windows\System\GIaOjlw.exe
  2⤵
  PID:5296
- C:\Windows\System\hyOMDkt.exe
  C:\Windows\System\hyOMDkt.exe
  2⤵
  PID:5324
- C:\Windows\System\jnLqpWZ.exe
  C:\Windows\System\jnLqpWZ.exe
  2⤵
  PID:5348
- C:\Windows\System\rlKPbxu.exe
  C:\Windows\System\rlKPbxu.exe
  2⤵
  PID:5380
- C:\Windows\System\zthmxLB.exe
  C:\Windows\System\zthmxLB.exe
  2⤵
  PID:5408
- C:\Windows\System\OobiuPK.exe
  C:\Windows\System\OobiuPK.exe
  2⤵
  PID:5436
- C:\Windows\System\HXgIeqq.exe
  C:\Windows\System\HXgIeqq.exe
  2⤵
  PID:5460
- C:\Windows\System\DyyRUBy.exe
  C:\Windows\System\DyyRUBy.exe
  2⤵
  PID:5492
- C:\Windows\System\liacfjL.exe
  C:\Windows\System\liacfjL.exe
  2⤵
  PID:5520
- C:\Windows\System\BcNzJKK.exe
  C:\Windows\System\BcNzJKK.exe
  2⤵
  PID:5544
- C:\Windows\System\XWFxEwM.exe
  C:\Windows\System\XWFxEwM.exe
  2⤵
  PID:5572
- C:\Windows\System\NqzPAuS.exe
  C:\Windows\System\NqzPAuS.exe
  2⤵
  PID:5604
- C:\Windows\System\MnnvlKe.exe
  C:\Windows\System\MnnvlKe.exe
  2⤵
  PID:5632
- C:\Windows\System\BDmYAty.exe
  C:\Windows\System\BDmYAty.exe
  2⤵
  PID:5656
- C:\Windows\System\qRtXist.exe
  C:\Windows\System\qRtXist.exe
  2⤵
  PID:5688
- C:\Windows\System\RfkhuKI.exe
  C:\Windows\System\RfkhuKI.exe
  2⤵
  PID:5716
- C:\Windows\System\wqagHyE.exe
  C:\Windows\System\wqagHyE.exe
  2⤵
  PID:5744
- C:\Windows\System\iRCocFO.exe
  C:\Windows\System\iRCocFO.exe
  2⤵
  PID:5768
- C:\Windows\System\EoaosEp.exe
  C:\Windows\System\EoaosEp.exe
  2⤵
  PID:5800
- C:\Windows\System\vJWwCoO.exe
  C:\Windows\System\vJWwCoO.exe
  2⤵
  PID:5828
- C:\Windows\System\zMzFIxH.exe
  C:\Windows\System\zMzFIxH.exe
  2⤵
  PID:5856
- C:\Windows\System\HDkByNZ.exe
  C:\Windows\System\HDkByNZ.exe
  2⤵
  PID:5884
- C:\Windows\System\surHEvW.exe
  C:\Windows\System\surHEvW.exe
  2⤵
  PID:5912
- C:\Windows\System\jIHgcxu.exe
  C:\Windows\System\jIHgcxu.exe
  2⤵
  PID:5936
- C:\Windows\System\RzYqDka.exe
  C:\Windows\System\RzYqDka.exe
  2⤵
  PID:5964
- C:\Windows\System\gQBDDZk.exe
  C:\Windows\System\gQBDDZk.exe
  2⤵
  PID:5996
- C:\Windows\System\SAvzzyi.exe
  C:\Windows\System\SAvzzyi.exe
  2⤵
  PID:6020
- C:\Windows\System\PqSGImN.exe
  C:\Windows\System\PqSGImN.exe
  2⤵
  PID:6048
- C:\Windows\System\GAGYWNp.exe
  C:\Windows\System\GAGYWNp.exe
  2⤵
  PID:6076
- C:\Windows\System\pHZNomu.exe
  C:\Windows\System\pHZNomu.exe
  2⤵
  PID:6108
- C:\Windows\System\xmQcRTj.exe
  C:\Windows\System\xmQcRTj.exe
  2⤵
  PID:6136
- C:\Windows\System\mrPLNWB.exe
  C:\Windows\System\mrPLNWB.exe
  2⤵
  PID:4936
- C:\Windows\System\cOhhydW.exe
  C:\Windows\System\cOhhydW.exe
  2⤵
  PID:2820
- C:\Windows\System\RZEORSG.exe
  C:\Windows\System\RZEORSG.exe
  2⤵
  PID:1124
- C:\Windows\System\RwHVnMR.exe
  C:\Windows\System\RwHVnMR.exe
  2⤵
  PID:4380
- C:\Windows\System\QQqeqkY.exe
  C:\Windows\System\QQqeqkY.exe
  2⤵
  PID:4580
- C:\Windows\System\NZiZuBD.exe
  C:\Windows\System\NZiZuBD.exe
  2⤵
  PID:5148
- C:\Windows\System\viRPWIZ.exe
  C:\Windows\System\viRPWIZ.exe
  2⤵
  PID:5220
- C:\Windows\System\XIPMZCB.exe
  C:\Windows\System\XIPMZCB.exe
  2⤵
  PID:5276
- C:\Windows\System\iBmfqad.exe
  C:\Windows\System\iBmfqad.exe
  2⤵
  PID:5340
- C:\Windows\System\eeWNZjW.exe
  C:\Windows\System\eeWNZjW.exe
  2⤵
  PID:5396
- C:\Windows\System\POENKFT.exe
  C:\Windows\System\POENKFT.exe
  2⤵
  PID:5456
- C:\Windows\System\JoVWxfS.exe
  C:\Windows\System\JoVWxfS.exe
  2⤵
  PID:5528
- C:\Windows\System\ZCABzqI.exe
  C:\Windows\System\ZCABzqI.exe
  2⤵
  PID:5704
- C:\Windows\System\iZRvhsp.exe
  C:\Windows\System\iZRvhsp.exe
  2⤵
  PID:5736
- C:\Windows\System\XUKVBVs.exe
  C:\Windows\System\XUKVBVs.exe
  2⤵
  PID:5780
- C:\Windows\System\xRzVrYm.exe
  C:\Windows\System\xRzVrYm.exe
  2⤵
  PID:5816
- C:\Windows\System\OajhRuD.exe
  C:\Windows\System\OajhRuD.exe
  2⤵
  PID:5876
- C:\Windows\System\qlQJhWv.exe
  C:\Windows\System\qlQJhWv.exe
  2⤵
  PID:5948
- C:\Windows\System\PhlOKiG.exe
  C:\Windows\System\PhlOKiG.exe
  2⤵
  PID:6004
- C:\Windows\System\NiFNerb.exe
  C:\Windows\System\NiFNerb.exe
  2⤵
  PID:6064
- C:\Windows\System\iIZaaFC.exe
  C:\Windows\System\iIZaaFC.exe
  2⤵
  PID:4136
- C:\Windows\System\EXgZpFE.exe
  C:\Windows\System\EXgZpFE.exe
  2⤵
  PID:2296
- C:\Windows\System\djGBauf.exe
  C:\Windows\System\djGBauf.exe
  2⤵
  PID:3708
- C:\Windows\System\rHbZTVZ.exe
  C:\Windows\System\rHbZTVZ.exe
  2⤵
  PID:5136
- C:\Windows\System\HqTujsA.exe
  C:\Windows\System\HqTujsA.exe
  2⤵
  PID:5304
- C:\Windows\System\CgeOYFH.exe
  C:\Windows\System\CgeOYFH.exe
  2⤵
  PID:5388
- C:\Windows\System\hQsmchw.exe
  C:\Windows\System\hQsmchw.exe
  2⤵
  PID:5556
- C:\Windows\System\eJlwXSc.exe
  C:\Windows\System\eJlwXSc.exe
  2⤵
  PID:5020
- C:\Windows\System\PRQvzFb.exe
  C:\Windows\System\PRQvzFb.exe
  2⤵
  PID:5760
- C:\Windows\System\FQDlHYe.exe
  C:\Windows\System\FQDlHYe.exe
  2⤵
  PID:5904
- C:\Windows\System\hJHlgBE.exe
  C:\Windows\System\hJHlgBE.exe
  2⤵
  PID:5976
- C:\Windows\System\xzkmmPB.exe
  C:\Windows\System\xzkmmPB.exe
  2⤵
  PID:4396
- C:\Windows\System\kruwCKT.exe
  C:\Windows\System\kruwCKT.exe
  2⤵
  PID:1852
- C:\Windows\System\kbiKzrK.exe
  C:\Windows\System\kbiKzrK.exe
  2⤵
  PID:4644
- C:\Windows\System\oMHbCmc.exe
  C:\Windows\System\oMHbCmc.exe
  2⤵
  PID:2860
- C:\Windows\System\sViqilW.exe
  C:\Windows\System\sViqilW.exe
  2⤵
  PID:2428
- C:\Windows\System\RDWnRQq.exe
  C:\Windows\System\RDWnRQq.exe
  2⤵
  PID:1292
- C:\Windows\System\YJDjNya.exe
  C:\Windows\System\YJDjNya.exe
  2⤵
  PID:2376
- C:\Windows\System\YiKILwQ.exe
  C:\Windows\System\YiKILwQ.exe
  2⤵
  PID:1892
- C:\Windows\System\cONNStV.exe
  C:\Windows\System\cONNStV.exe
  2⤵
  PID:4520
- C:\Windows\System\wPMiGkr.exe
  C:\Windows\System\wPMiGkr.exe
  2⤵
  PID:1324
- C:\Windows\System\BznwBpD.exe
  C:\Windows\System\BznwBpD.exe
  2⤵
  PID:1208
- C:\Windows\System\PIbcmeh.exe
  C:\Windows\System\PIbcmeh.exe
  2⤵
  PID:4280
- C:\Windows\System\MsNXJWR.exe
  C:\Windows\System\MsNXJWR.exe
  2⤵
  PID:2104
- C:\Windows\System\BFVNYEX.exe
  C:\Windows\System\BFVNYEX.exe
  2⤵
  PID:2232
- C:\Windows\System\paIMjHZ.exe
  C:\Windows\System\paIMjHZ.exe
  2⤵
  PID:2120
- C:\Windows\System\xeuqjHi.exe
  C:\Windows\System\xeuqjHi.exe
  2⤵
  PID:2548
- C:\Windows\System\eNaFmKC.exe
  C:\Windows\System\eNaFmKC.exe
  2⤵
  PID:4944
- C:\Windows\System\OMUFgUB.exe
  C:\Windows\System\OMUFgUB.exe
  2⤵
  PID:4696
- C:\Windows\System\kEvpJZz.exe
  C:\Windows\System\kEvpJZz.exe
  2⤵
  PID:1088
- C:\Windows\System\fzTkNVS.exe
  C:\Windows\System\fzTkNVS.exe
  2⤵
  PID:5368
- C:\Windows\System\hTtqqXb.exe
  C:\Windows\System\hTtqqXb.exe
  2⤵
  PID:4756
- C:\Windows\System\HnCGpZj.exe
  C:\Windows\System\HnCGpZj.exe
  2⤵
  PID:5956
- C:\Windows\System\MHgSCJs.exe
  C:\Windows\System\MHgSCJs.exe
  2⤵
  PID:180
- C:\Windows\System\hVyiftD.exe
  C:\Windows\System\hVyiftD.exe
  2⤵
  PID:1624
- C:\Windows\System\jmdDyUY.exe
  C:\Windows\System\jmdDyUY.exe
  2⤵
  PID:2692
- C:\Windows\System\bgjvNaS.exe
  C:\Windows\System\bgjvNaS.exe
  2⤵
  PID:5808
- C:\Windows\System\iegFqJX.exe
  C:\Windows\System\iegFqJX.exe
  2⤵
  PID:2464
- C:\Windows\System\lrqOhqn.exe
  C:\Windows\System\lrqOhqn.exe
  2⤵
  PID:2676
- C:\Windows\System\hwueSIl.exe
  C:\Windows\System\hwueSIl.exe
  2⤵
  PID:4772
- C:\Windows\System\qNeTvsY.exe
  C:\Windows\System\qNeTvsY.exe
  2⤵
  PID:1908
- C:\Windows\System\bhuZfTc.exe
  C:\Windows\System\bhuZfTc.exe
  2⤵
  PID:4800
- C:\Windows\System\kSitqNA.exe
  C:\Windows\System\kSitqNA.exe
  2⤵
  PID:1604
- C:\Windows\System\djoyYxH.exe
  C:\Windows\System\djoyYxH.exe
  2⤵
  PID:3924
- C:\Windows\System\HMylsCC.exe
  C:\Windows\System\HMylsCC.exe
  2⤵
  PID:6148
- C:\Windows\System\zEBIESx.exe
  C:\Windows\System\zEBIESx.exe
  2⤵
  PID:6192
- C:\Windows\System\RQYyymp.exe
  C:\Windows\System\RQYyymp.exe
  2⤵
  PID:6212
- C:\Windows\System\uTkNRZa.exe
  C:\Windows\System\uTkNRZa.exe
  2⤵
  PID:6236
- C:\Windows\System\XEeABuV.exe
  C:\Windows\System\XEeABuV.exe
  2⤵
  PID:6268
- C:\Windows\System\BdICSNK.exe
  C:\Windows\System\BdICSNK.exe
  2⤵
  PID:6304
- C:\Windows\System\ezIItsM.exe
  C:\Windows\System\ezIItsM.exe
  2⤵
  PID:6320
- C:\Windows\System\CzJhItz.exe
  C:\Windows\System\CzJhItz.exe
  2⤵
  PID:6336
- C:\Windows\System\vnLVgGS.exe
  C:\Windows\System\vnLVgGS.exe
  2⤵
  PID:6364
- C:\Windows\System\CbYPczu.exe
  C:\Windows\System\CbYPczu.exe
  2⤵
  PID:6384
- C:\Windows\System\XhnWLFQ.exe
  C:\Windows\System\XhnWLFQ.exe
  2⤵
  PID:6424
- C:\Windows\System\MRiTNEA.exe
  C:\Windows\System\MRiTNEA.exe
  2⤵
  PID:6444
- C:\Windows\System\EIXrXFT.exe
  C:\Windows\System\EIXrXFT.exe
  2⤵
  PID:6472
- C:\Windows\System\BiylUoF.exe
  C:\Windows\System\BiylUoF.exe
  2⤵
  PID:6516
- C:\Windows\System\rgwMdAD.exe
  C:\Windows\System\rgwMdAD.exe
  2⤵
  PID:6544
- C:\Windows\System\KpXlQQo.exe
  C:\Windows\System\KpXlQQo.exe
  2⤵
  PID:6572
- C:\Windows\System\xtTnqPd.exe
  C:\Windows\System\xtTnqPd.exe
  2⤵
  PID:6604
- C:\Windows\System\PZGgiXo.exe
  C:\Windows\System\PZGgiXo.exe
  2⤵
  PID:6628
- C:\Windows\System\MkdQkxe.exe
  C:\Windows\System\MkdQkxe.exe
  2⤵
  PID:6644
- C:\Windows\System\rHmRpIY.exe
  C:\Windows\System\rHmRpIY.exe
  2⤵
  PID:6664
- C:\Windows\System\afxiLpA.exe
  C:\Windows\System\afxiLpA.exe
  2⤵
  PID:6700
- C:\Windows\System\MJqfGOb.exe
  C:\Windows\System\MJqfGOb.exe
  2⤵
  PID:6728
- C:\Windows\System\MgdcOxu.exe
  C:\Windows\System\MgdcOxu.exe
  2⤵
  PID:6756
- C:\Windows\System\hqvNFgl.exe
  C:\Windows\System\hqvNFgl.exe
  2⤵
  PID:6784
- C:\Windows\System\rjeewiL.exe
  C:\Windows\System\rjeewiL.exe
  2⤵
  PID:6812
- C:\Windows\System\mvlbRJv.exe
  C:\Windows\System\mvlbRJv.exe
  2⤵
  PID:6852
- C:\Windows\System\RzzZKfJ.exe
  C:\Windows\System\RzzZKfJ.exe
  2⤵
  PID:6892
- C:\Windows\System\fDENFwU.exe
  C:\Windows\System\fDENFwU.exe
  2⤵
  PID:6908
- C:\Windows\System\IwtbWPp.exe
  C:\Windows\System\IwtbWPp.exe
  2⤵
  PID:6948
- C:\Windows\System\rGnLewh.exe
  C:\Windows\System\rGnLewh.exe
  2⤵
  PID:6976
- C:\Windows\System\gwPmDqq.exe
  C:\Windows\System\gwPmDqq.exe
  2⤵
  PID:6992
- C:\Windows\System\KJrrDgq.exe
  C:\Windows\System\KJrrDgq.exe
  2⤵
  PID:7016
- C:\Windows\System\LTuJXKR.exe
  C:\Windows\System\LTuJXKR.exe
  2⤵
  PID:7036
- C:\Windows\System\RHzwcAj.exe
  C:\Windows\System\RHzwcAj.exe
  2⤵
  PID:7060
- C:\Windows\System\tVaVpic.exe
  C:\Windows\System\tVaVpic.exe
  2⤵
  PID:7092
- C:\Windows\System\AppTwzW.exe
  C:\Windows\System\AppTwzW.exe
  2⤵
  PID:7124
- C:\Windows\System\RMNLiQA.exe
  C:\Windows\System\RMNLiQA.exe
  2⤵
  PID:7160
- C:\Windows\System\DVizVak.exe
  C:\Windows\System\DVizVak.exe
  2⤵
  PID:3096
- C:\Windows\System\SFuDpgU.exe
  C:\Windows\System\SFuDpgU.exe
  2⤵
  PID:6200
- C:\Windows\System\WUBrFsF.exe
  C:\Windows\System\WUBrFsF.exe
  2⤵
  PID:6292
- C:\Windows\System\EJORtma.exe
  C:\Windows\System\EJORtma.exe
  2⤵
  PID:6328
- C:\Windows\System\NpLixiW.exe
  C:\Windows\System\NpLixiW.exe
  2⤵
  PID:6436
- C:\Windows\System\dDYaDiQ.exe
  C:\Windows\System\dDYaDiQ.exe
  2⤵
  PID:6456
- C:\Windows\System\RTfjrON.exe
  C:\Windows\System\RTfjrON.exe
  2⤵
  PID:6512
- C:\Windows\System\zHtfMEt.exe
  C:\Windows\System\zHtfMEt.exe
  2⤵
  PID:6556
- C:\Windows\System\ZgQMvFl.exe
  C:\Windows\System\ZgQMvFl.exe
  2⤵
  PID:820
- C:\Windows\System\JHNCwUJ.exe
  C:\Windows\System\JHNCwUJ.exe
  2⤵
  PID:6640
- C:\Windows\System\EbZwRBg.exe
  C:\Windows\System\EbZwRBg.exe
  2⤵
  PID:6652
- C:\Windows\System\bJcjgUM.exe
  C:\Windows\System\bJcjgUM.exe
  2⤵
  PID:6720
- C:\Windows\System\bLtLdyq.exe
  C:\Windows\System\bLtLdyq.exe
  2⤵
  PID:6796
- C:\Windows\System\pDvtZbD.exe
  C:\Windows\System\pDvtZbD.exe
  2⤵
  PID:6936
- C:\Windows\System\OQhLONH.exe
  C:\Windows\System\OQhLONH.exe
  2⤵
  PID:6964
- C:\Windows\System\vkBRgwm.exe
  C:\Windows\System\vkBRgwm.exe
  2⤵
  PID:7012
- C:\Windows\System\ciEIPLW.exe
  C:\Windows\System\ciEIPLW.exe
  2⤵
  PID:7072
- C:\Windows\System\ixtgqcP.exe
  C:\Windows\System\ixtgqcP.exe
  2⤵
  PID:7104
- C:\Windows\System\flTTsDO.exe
  C:\Windows\System\flTTsDO.exe
  2⤵
  PID:6248
- C:\Windows\System\uKgQcJc.exe
  C:\Windows\System\uKgQcJc.exe
  2⤵
  PID:6408
- C:\Windows\System\Whxvbyb.exe
  C:\Windows\System\Whxvbyb.exe
  2⤵
  PID:6596
- C:\Windows\System\NELMPoK.exe
  C:\Windows\System\NELMPoK.exe
  2⤵
  PID:6884
- C:\Windows\System\TWYaPeG.exe
  C:\Windows\System\TWYaPeG.exe
  2⤵
  PID:7080
- C:\Windows\System\eYgYdPg.exe
  C:\Windows\System\eYgYdPg.exe
  2⤵
  PID:4636
- C:\Windows\System\WFJtIlH.exe
  C:\Windows\System\WFJtIlH.exe
  2⤵
  PID:6620
- C:\Windows\System\eFsjyMu.exe
  C:\Windows\System\eFsjyMu.exe
  2⤵
  PID:3448
- C:\Windows\System\PjKwjgs.exe
  C:\Windows\System\PjKwjgs.exe
  2⤵
  PID:3016
- C:\Windows\System\AuOVcuF.exe
  C:\Windows\System\AuOVcuF.exe
  2⤵
  PID:7176
- C:\Windows\System\ufyhoib.exe
  C:\Windows\System\ufyhoib.exe
  2⤵
  PID:7208
- C:\Windows\System\DGqLjgZ.exe
  C:\Windows\System\DGqLjgZ.exe
  2⤵
  PID:7232
- C:\Windows\System\GTCczlZ.exe
  C:\Windows\System\GTCczlZ.exe
  2⤵
  PID:7260
- C:\Windows\System\zGPycYz.exe
  C:\Windows\System\zGPycYz.exe
  2⤵
  PID:7296
- C:\Windows\System\DIhfeCS.exe
  C:\Windows\System\DIhfeCS.exe
  2⤵
  PID:7328
- C:\Windows\System\mNFnbMO.exe
  C:\Windows\System\mNFnbMO.exe
  2⤵
  PID:7344
- C:\Windows\System\nhGyzpR.exe
  C:\Windows\System\nhGyzpR.exe
  2⤵
  PID:7364
- C:\Windows\System\PeEeMmd.exe
  C:\Windows\System\PeEeMmd.exe
  2⤵
  PID:7392
- C:\Windows\System\xlTaZyw.exe
  C:\Windows\System\xlTaZyw.exe
  2⤵
  PID:7424
- C:\Windows\System\topwAGR.exe
  C:\Windows\System\topwAGR.exe
  2⤵
  PID:7448
- C:\Windows\System\CyoqSJe.exe
  C:\Windows\System\CyoqSJe.exe
  2⤵
  PID:7500
- C:\Windows\System\UBNtDGf.exe
  C:\Windows\System\UBNtDGf.exe
  2⤵
  PID:7520
- C:\Windows\System\JlFMDIC.exe
  C:\Windows\System\JlFMDIC.exe
  2⤵
  PID:7544
- C:\Windows\System\rSKqDjZ.exe
  C:\Windows\System\rSKqDjZ.exe
  2⤵
  PID:7572
- C:\Windows\System\BhSNlCG.exe
  C:\Windows\System\BhSNlCG.exe
  2⤵
  PID:7612
- C:\Windows\System\cZkYZjC.exe
  C:\Windows\System\cZkYZjC.exe
  2⤵
  PID:7640
- C:\Windows\System\keUBlok.exe
  C:\Windows\System\keUBlok.exe
  2⤵
  PID:7656
- C:\Windows\System\bmMGvuM.exe
  C:\Windows\System\bmMGvuM.exe
  2⤵
  PID:7684
- C:\Windows\System\cEdbFrg.exe
  C:\Windows\System\cEdbFrg.exe
  2⤵
  PID:7724
- C:\Windows\System\flfaQKu.exe
  C:\Windows\System\flfaQKu.exe
  2⤵
  PID:7744
- C:\Windows\System\DvLxrIc.exe
  C:\Windows\System\DvLxrIc.exe
  2⤵
  PID:7780
- C:\Windows\System\fSUtgQz.exe
  C:\Windows\System\fSUtgQz.exe
  2⤵
  PID:7808
- C:\Windows\System\QVyhzXG.exe
  C:\Windows\System\QVyhzXG.exe
  2⤵
  PID:7832
- C:\Windows\System\qtJAEPF.exe
  C:\Windows\System\qtJAEPF.exe
  2⤵
  PID:7860
- C:\Windows\System\nTkWOve.exe
  C:\Windows\System\nTkWOve.exe
  2⤵
  PID:7880
- C:\Windows\System\HktgcFb.exe
  C:\Windows\System\HktgcFb.exe
  2⤵
  PID:7908
- C:\Windows\System\XHzFZhL.exe
  C:\Windows\System\XHzFZhL.exe
  2⤵
  PID:7928
- C:\Windows\System\nShwJzL.exe
  C:\Windows\System\nShwJzL.exe
  2⤵
  PID:7944
- C:\Windows\System\vcBiVlY.exe
  C:\Windows\System\vcBiVlY.exe
  2⤵
  PID:7980
- C:\Windows\System\eBvQMib.exe
  C:\Windows\System\eBvQMib.exe
  2⤵
  PID:8012
- C:\Windows\System\wXUbUir.exe
  C:\Windows\System\wXUbUir.exe
  2⤵
  PID:8040
- C:\Windows\System\BzaVCtu.exe
  C:\Windows\System\BzaVCtu.exe
  2⤵
  PID:8080
- C:\Windows\System\exIcrLu.exe
  C:\Windows\System\exIcrLu.exe
  2⤵
  PID:8104
- C:\Windows\System\jJgXTuo.exe
  C:\Windows\System\jJgXTuo.exe
  2⤵
  PID:8136
- C:\Windows\System\ceufkZQ.exe
  C:\Windows\System\ceufkZQ.exe
  2⤵
  PID:8164
- C:\Windows\System\aQybfKy.exe
  C:\Windows\System\aQybfKy.exe
  2⤵
  PID:3628
- C:\Windows\System\ccRYFUK.exe
  C:\Windows\System\ccRYFUK.exe
  2⤵
  PID:7172
- C:\Windows\System\jxvhNkg.exe
  C:\Windows\System\jxvhNkg.exe
  2⤵
  PID:7248
- C:\Windows\System\uSMobNK.exe
  C:\Windows\System\uSMobNK.exe
  2⤵
  PID:7280
- C:\Windows\System\UxKTeHx.exe
  C:\Windows\System\UxKTeHx.exe
  2⤵
  PID:7376
- C:\Windows\System\YIteimH.exe
  C:\Windows\System\YIteimH.exe
  2⤵
  PID:7416
- C:\Windows\System\uhbzbEM.exe
  C:\Windows\System\uhbzbEM.exe
  2⤵
  PID:7508
- C:\Windows\System\tDZxfeP.exe
  C:\Windows\System\tDZxfeP.exe
  2⤵
  PID:7628
- C:\Windows\System\jjJNAJb.exe
  C:\Windows\System\jjJNAJb.exe
  2⤵
  PID:7680
- C:\Windows\System\qtelcVq.exe
  C:\Windows\System\qtelcVq.exe
  2⤵
  PID:7800
- C:\Windows\System\QImMKQu.exe
  C:\Windows\System\QImMKQu.exe
  2⤵
  PID:7772
- C:\Windows\System\EBPuAhe.exe
  C:\Windows\System\EBPuAhe.exe
  2⤵
  PID:7896
- C:\Windows\System\LIiLtwT.exe
  C:\Windows\System\LIiLtwT.exe
  2⤵
  PID:7956
- C:\Windows\System\WLozuLn.exe
  C:\Windows\System\WLozuLn.exe
  2⤵
  PID:8064
- C:\Windows\System\tfxFeWw.exe
  C:\Windows\System\tfxFeWw.exe
  2⤵
  PID:8060
- C:\Windows\System\viBHDiq.exe
  C:\Windows\System\viBHDiq.exe
  2⤵
  PID:8128
- C:\Windows\System\msbnnjR.exe
  C:\Windows\System\msbnnjR.exe
  2⤵
  PID:8188
- C:\Windows\System\ZLCazGB.exe
  C:\Windows\System\ZLCazGB.exe
  2⤵
  PID:7340
- C:\Windows\System\PSZkeyq.exe
  C:\Windows\System\PSZkeyq.exe
  2⤵
  PID:7400
- C:\Windows\System\FnrDSvd.exe
  C:\Windows\System\FnrDSvd.exe
  2⤵
  PID:7624
- C:\Windows\System\VRtXYcx.exe
  C:\Windows\System\VRtXYcx.exe
  2⤵
  PID:7768
- C:\Windows\System\flmfebR.exe
  C:\Windows\System\flmfebR.exe
  2⤵
  PID:7920
- C:\Windows\System\aNunkXT.exe
  C:\Windows\System\aNunkXT.exe
  2⤵
  PID:8152
- C:\Windows\System\NAvNqfm.exe
  C:\Windows\System\NAvNqfm.exe
  2⤵
  PID:8144
- C:\Windows\System\UVRtYHh.exe
  C:\Windows\System\UVRtYHh.exe
  2⤵
  PID:7676
- C:\Windows\System\msuuMcf.exe
  C:\Windows\System\msuuMcf.exe
  2⤵
  PID:8208
- C:\Windows\System\seznUKa.exe
  C:\Windows\System\seznUKa.exe
  2⤵
  PID:8240
- C:\Windows\System\iqmbiYm.exe
  C:\Windows\System\iqmbiYm.exe
  2⤵
  PID:8276
- C:\Windows\System\cFeUdIT.exe
  C:\Windows\System\cFeUdIT.exe
  2⤵
  PID:8296
- C:\Windows\System\RXMUyGk.exe
  C:\Windows\System\RXMUyGk.exe
  2⤵
  PID:8312
- C:\Windows\System\uAzDTLh.exe
  C:\Windows\System\uAzDTLh.exe
  2⤵
  PID:8340
- C:\Windows\System\uQFEonL.exe
  C:\Windows\System\uQFEonL.exe
  2⤵
  PID:8388
- C:\Windows\System\RAclaYd.exe
  C:\Windows\System\RAclaYd.exe
  2⤵
  PID:8408
- C:\Windows\System\mjNsiMj.exe
  C:\Windows\System\mjNsiMj.exe
  2⤵
  PID:8436
- C:\Windows\System\tftzxfe.exe
  C:\Windows\System\tftzxfe.exe
  2⤵
  PID:8464
- C:\Windows\System\KOqQdWw.exe
  C:\Windows\System\KOqQdWw.exe
  2⤵
  PID:8492
- C:\Windows\System\zeplyQu.exe
  C:\Windows\System\zeplyQu.exe
  2⤵
  PID:8512
- C:\Windows\System\ktXDHQQ.exe
  C:\Windows\System\ktXDHQQ.exe
  2⤵
  PID:8536
- C:\Windows\System\gZSRsxw.exe
  C:\Windows\System\gZSRsxw.exe
  2⤵
  PID:8564
- C:\Windows\System\spefFYJ.exe
  C:\Windows\System\spefFYJ.exe
  2⤵
  PID:8616
- C:\Windows\System\LxpTqfI.exe
  C:\Windows\System\LxpTqfI.exe
  2⤵
  PID:8644
- C:\Windows\System\rYrDNOP.exe
  C:\Windows\System\rYrDNOP.exe
  2⤵
  PID:8660
- C:\Windows\System\CElNCcO.exe
  C:\Windows\System\CElNCcO.exe
  2⤵
  PID:8688
- C:\Windows\System\hUfmqkR.exe
  C:\Windows\System\hUfmqkR.exe
  2⤵
  PID:8708
- C:\Windows\System\mvJIxSK.exe
  C:\Windows\System\mvJIxSK.exe
  2⤵
  PID:8768
- C:\Windows\System\tBntlwm.exe
  C:\Windows\System\tBntlwm.exe
  2⤵
  PID:8796
- C:\Windows\System\kfCFFbR.exe
  C:\Windows\System\kfCFFbR.exe
  2⤵
  PID:8824
- C:\Windows\System\QrXnnSu.exe
  C:\Windows\System\QrXnnSu.exe
  2⤵
  PID:8840
- C:\Windows\System\HjArxgW.exe
  C:\Windows\System\HjArxgW.exe
  2⤵
  PID:8880
- C:\Windows\System\uAbHrPZ.exe
  C:\Windows\System\uAbHrPZ.exe
  2⤵
  PID:8908
- C:\Windows\System\qJoZbCw.exe
  C:\Windows\System\qJoZbCw.exe
  2⤵
  PID:8936
- C:\Windows\System\tvLtUDb.exe
  C:\Windows\System\tvLtUDb.exe
  2⤵
  PID:8964
- C:\Windows\System\AIFUtgZ.exe
  C:\Windows\System\AIFUtgZ.exe
  2⤵
  PID:8988
- C:\Windows\System\GQcjuRH.exe
  C:\Windows\System\GQcjuRH.exe
  2⤵
  PID:9008
- C:\Windows\System\nkVaBVt.exe
  C:\Windows\System\nkVaBVt.exe
  2⤵
  PID:9036
- C:\Windows\System\DkGLeWN.exe
  C:\Windows\System\DkGLeWN.exe
  2⤵
  PID:9064
- C:\Windows\System\EHvizEN.exe
  C:\Windows\System\EHvizEN.exe
  2⤵
  PID:9084
- C:\Windows\System\cIRNbfk.exe
  C:\Windows\System\cIRNbfk.exe
  2⤵
  PID:9108
- C:\Windows\System\EGwhzWG.exe
  C:\Windows\System\EGwhzWG.exe
  2⤵
  PID:9140
- C:\Windows\System\wIsoNxd.exe
  C:\Windows\System\wIsoNxd.exe
  2⤵
  PID:9168
- C:\Windows\System\ndKnKLB.exe
  C:\Windows\System\ndKnKLB.exe
  2⤵
  PID:9200
- C:\Windows\System\DEWecCk.exe
  C:\Windows\System\DEWecCk.exe
  2⤵
  PID:8184
- C:\Windows\System\cwYOlox.exe
  C:\Windows\System\cwYOlox.exe
  2⤵
  PID:8256
- C:\Windows\System\gTvNBRF.exe
  C:\Windows\System\gTvNBRF.exe
  2⤵
  PID:8284
- C:\Windows\System\EHZnLAc.exe
  C:\Windows\System\EHZnLAc.exe
  2⤵
  PID:8372
- C:\Windows\System\KBaVMmd.exe
  C:\Windows\System\KBaVMmd.exe
  2⤵
  PID:8428
- C:\Windows\System\bzwxbqy.exe
  C:\Windows\System\bzwxbqy.exe
  2⤵
  PID:8520
- C:\Windows\System\DCxpmir.exe
  C:\Windows\System\DCxpmir.exe
  2⤵
  PID:8528
- C:\Windows\System\gdGrcDV.exe
  C:\Windows\System\gdGrcDV.exe
  2⤵
  PID:8596
- C:\Windows\System\bMHBlWX.exe
  C:\Windows\System\bMHBlWX.exe
  2⤵
  PID:8680
- C:\Windows\System\Iappkft.exe
  C:\Windows\System\Iappkft.exe
  2⤵
  PID:8780
- C:\Windows\System\pYkxhaA.exe
  C:\Windows\System\pYkxhaA.exe
  2⤵
  PID:8832
- C:\Windows\System\oPWLnIe.exe
  C:\Windows\System\oPWLnIe.exe
  2⤵
  PID:8876
- C:\Windows\System\higyohM.exe
  C:\Windows\System\higyohM.exe
  2⤵
  PID:8952
- C:\Windows\System\HXDpyLO.exe
  C:\Windows\System\HXDpyLO.exe
  2⤵
  PID:9000
- C:\Windows\System\tNANCmF.exe
  C:\Windows\System\tNANCmF.exe
  2⤵
  PID:9024
- C:\Windows\System\HMXBgvg.exe
  C:\Windows\System\HMXBgvg.exe
  2⤵
  PID:9100
- C:\Windows\System\tgPixiu.exe
  C:\Windows\System\tgPixiu.exe
  2⤵
  PID:9188
- C:\Windows\System\zeyBZNS.exe
  C:\Windows\System\zeyBZNS.exe
  2⤵
  PID:7272
- C:\Windows\System\ExrMqPw.exe
  C:\Windows\System\ExrMqPw.exe
  2⤵
  PID:8508
- C:\Windows\System\ObndxYR.exe
  C:\Windows\System\ObndxYR.exe
  2⤵
  PID:8588
- C:\Windows\System\UIjIgtU.exe
  C:\Windows\System\UIjIgtU.exe
  2⤵
  PID:8752
- C:\Windows\System\YLVDMLw.exe
  C:\Windows\System\YLVDMLw.exe
  2⤵
  PID:8904
- C:\Windows\System\twmkfwI.exe
  C:\Windows\System\twmkfwI.exe
  2⤵
  PID:9128
- C:\Windows\System\YsTciGR.exe
  C:\Windows\System\YsTciGR.exe
  2⤵
  PID:9060
- C:\Windows\System\aattvaB.exe
  C:\Windows\System\aattvaB.exe
  2⤵
  PID:8360
- C:\Windows\System\cRHSxvn.exe
  C:\Windows\System\cRHSxvn.exe
  2⤵
  PID:8836
- C:\Windows\System\zQbWajZ.exe
  C:\Windows\System\zQbWajZ.exe
  2⤵
  PID:8548
- C:\Windows\System\kegeuhy.exe
  C:\Windows\System\kegeuhy.exe
  2⤵
  PID:8980
- C:\Windows\System\kiePAdA.exe
  C:\Windows\System\kiePAdA.exe
  2⤵
  PID:8820
- C:\Windows\System\mQahsHc.exe
  C:\Windows\System\mQahsHc.exe
  2⤵
  PID:9228
- C:\Windows\System\nZBKgeI.exe
  C:\Windows\System\nZBKgeI.exe
  2⤵
  PID:9256
- C:\Windows\System\EVfJhic.exe
  C:\Windows\System\EVfJhic.exe
  2⤵
  PID:9272
- C:\Windows\System\XYPRZkH.exe
  C:\Windows\System\XYPRZkH.exe
  2⤵
  PID:9288
- C:\Windows\System\vYzUDXf.exe
  C:\Windows\System\vYzUDXf.exe
  2⤵
  PID:9316
- C:\Windows\System\BDcvWGz.exe
  C:\Windows\System\BDcvWGz.exe
  2⤵
  PID:9376
- C:\Windows\System\sdnHphw.exe
  C:\Windows\System\sdnHphw.exe
  2⤵
  PID:9396
- C:\Windows\System\fgEdFPU.exe
  C:\Windows\System\fgEdFPU.exe
  2⤵
  PID:9412
- C:\Windows\System\XfzyGlV.exe
  C:\Windows\System\XfzyGlV.exe
  2⤵
  PID:9444
- C:\Windows\System\SuwpXVc.exe
  C:\Windows\System\SuwpXVc.exe
  2⤵
  PID:9472
- C:\Windows\System\TTjNZeu.exe
  C:\Windows\System\TTjNZeu.exe
  2⤵
  PID:9496
- C:\Windows\System\fSfPfFM.exe
  C:\Windows\System\fSfPfFM.exe
  2⤵
  PID:9548
- C:\Windows\System\ZGVvEsb.exe
  C:\Windows\System\ZGVvEsb.exe
  2⤵
  PID:9564
- C:\Windows\System\qNRnibw.exe
  C:\Windows\System\qNRnibw.exe
  2⤵
  PID:9604
- C:\Windows\System\rNkVNSV.exe
  C:\Windows\System\rNkVNSV.exe
  2⤵
  PID:9620
- C:\Windows\System\jGYKjxp.exe
  C:\Windows\System\jGYKjxp.exe
  2⤵
  PID:9648
- C:\Windows\System\sPgnDdp.exe
  C:\Windows\System\sPgnDdp.exe
  2⤵
  PID:9676
- C:\Windows\System\HnPfCwo.exe
  C:\Windows\System\HnPfCwo.exe
  2⤵
  PID:9704
- C:\Windows\System\rlMJmlM.exe
  C:\Windows\System\rlMJmlM.exe
  2⤵
  PID:9728
- C:\Windows\System\hsbmusH.exe
  C:\Windows\System\hsbmusH.exe
  2⤵
  PID:9760
- C:\Windows\System\SPeLzFs.exe
  C:\Windows\System\SPeLzFs.exe
  2⤵
  PID:9784
- C:\Windows\System\BevxXoP.exe
  C:\Windows\System\BevxXoP.exe
  2⤵
  PID:9812
- C:\Windows\System\wEwXpbe.exe
  C:\Windows\System\wEwXpbe.exe
  2⤵
  PID:9836
- C:\Windows\System\IQZlnsq.exe
  C:\Windows\System\IQZlnsq.exe
  2⤵
  PID:9864
- C:\Windows\System\JBZiwPi.exe
  C:\Windows\System\JBZiwPi.exe
  2⤵
  PID:9892
- C:\Windows\System\cYzSpRo.exe
  C:\Windows\System\cYzSpRo.exe
  2⤵
  PID:9920
- C:\Windows\System\PJNzrLg.exe
  C:\Windows\System\PJNzrLg.exe
  2⤵
  PID:9960
- C:\Windows\System\CKMyHGj.exe
  C:\Windows\System\CKMyHGj.exe
  2⤵
  PID:10000
- C:\Windows\System\MokRKOJ.exe
  C:\Windows\System\MokRKOJ.exe
  2⤵
  PID:10016
- C:\Windows\System\KSvuRpF.exe
  C:\Windows\System\KSvuRpF.exe
  2⤵
  PID:10044
- C:\Windows\System\Cjozlyp.exe
  C:\Windows\System\Cjozlyp.exe
  2⤵
  PID:10072
- C:\Windows\System\jogIISd.exe
  C:\Windows\System\jogIISd.exe
  2⤵
  PID:10088
- C:\Windows\System\qBBsjcw.exe
  C:\Windows\System\qBBsjcw.exe
  2⤵
  PID:10112
- C:\Windows\System\VEHVNZQ.exe
  C:\Windows\System\VEHVNZQ.exe
  2⤵
  PID:10140
- C:\Windows\System\xzgywoX.exe
  C:\Windows\System\xzgywoX.exe
  2⤵
  PID:10156
- C:\Windows\System\PMZmqMZ.exe
  C:\Windows\System\PMZmqMZ.exe
  2⤵
  PID:10196
- C:\Windows\System\xmTEbyu.exe
  C:\Windows\System\xmTEbyu.exe
  2⤵
  PID:9244
- C:\Windows\System\LeAMohd.exe
  C:\Windows\System\LeAMohd.exe
  2⤵
  PID:9304
- C:\Windows\System\hlsMPPP.exe
  C:\Windows\System\hlsMPPP.exe
  2⤵
  PID:9364
- C:\Windows\System\SimSTKV.exe
  C:\Windows\System\SimSTKV.exe
  2⤵
  PID:9408
- C:\Windows\System\QBuDqAK.exe
  C:\Windows\System\QBuDqAK.exe
  2⤵
  PID:9480
- C:\Windows\System\iWELPNp.exe
  C:\Windows\System\iWELPNp.exe
  2⤵
  PID:9588
- C:\Windows\System\XPSRced.exe
  C:\Windows\System\XPSRced.exe
  2⤵
  PID:9632
- C:\Windows\System\JSZWmYm.exe
  C:\Windows\System\JSZWmYm.exe
  2⤵
  PID:9688
- C:\Windows\System\cuhDrTy.exe
  C:\Windows\System\cuhDrTy.exe
  2⤵
  PID:8760
- C:\Windows\System\AbLAEEQ.exe
  C:\Windows\System\AbLAEEQ.exe
  2⤵
  PID:9740
- C:\Windows\System\rSXBBnh.exe
  C:\Windows\System\rSXBBnh.exe
  2⤵
  PID:9916
- C:\Windows\System\JJErreC.exe
  C:\Windows\System\JJErreC.exe
  2⤵
  PID:9956
- C:\Windows\System\SHcXIao.exe
  C:\Windows\System\SHcXIao.exe
  2⤵
  PID:10008
- C:\Windows\System\sxrAoBx.exe
  C:\Windows\System\sxrAoBx.exe
  2⤵
  PID:10028
- C:\Windows\System\OJOCsJb.exe
  C:\Windows\System\OJOCsJb.exe
  2⤵
  PID:10080
- C:\Windows\System\zSrSRBZ.exe
  C:\Windows\System\zSrSRBZ.exe
  2⤵
  PID:10128
- C:\Windows\System\akeKpSZ.exe
  C:\Windows\System\akeKpSZ.exe
  2⤵
  PID:9224
- C:\Windows\System\YyATGyU.exe
  C:\Windows\System\YyATGyU.exe
  2⤵
  PID:9388
- C:\Windows\System\UZuoHxp.exe
  C:\Windows\System\UZuoHxp.exe
  2⤵
  PID:9540
- C:\Windows\System\kbKmDSM.exe
  C:\Windows\System\kbKmDSM.exe
  2⤵
  PID:9744
- C:\Windows\System\siSXsck.exe
  C:\Windows\System\siSXsck.exe
  2⤵
  PID:9936
- C:\Windows\System\iRfccGc.exe
  C:\Windows\System\iRfccGc.exe
  2⤵
  PID:9976
- C:\Windows\System\adCQBDr.exe
  C:\Windows\System\adCQBDr.exe
  2⤵
  PID:10216
- C:\Windows\System\qZXBJYV.exe
  C:\Windows\System\qZXBJYV.exe
  2⤵
  PID:9664
- C:\Windows\System\QQPpKoR.exe
  C:\Windows\System\QQPpKoR.exe
  2⤵
  PID:9880
- C:\Windows\System\scQZQur.exe
  C:\Windows\System\scQZQur.exe
  2⤵
  PID:10148
- C:\Windows\System\hmmzjPb.exe
  C:\Windows\System\hmmzjPb.exe
  2⤵
  PID:9776
- C:\Windows\System\MnRwYfZ.exe
  C:\Windows\System\MnRwYfZ.exe
  2⤵
  PID:10244
- C:\Windows\System\cIyxNHp.exe
  C:\Windows\System\cIyxNHp.exe
  2⤵
  PID:10260
- C:\Windows\System\lWHAuMr.exe
  C:\Windows\System\lWHAuMr.exe
  2⤵
  PID:10312
- C:\Windows\System\TfkQJbX.exe
  C:\Windows\System\TfkQJbX.exe
  2⤵
  PID:10340
- C:\Windows\System\RDWMOON.exe
  C:\Windows\System\RDWMOON.exe
  2⤵
  PID:10356
- C:\Windows\System\OgFweVk.exe
  C:\Windows\System\OgFweVk.exe
  2⤵
  PID:10372
- C:\Windows\System\saEcWHS.exe
  C:\Windows\System\saEcWHS.exe
  2⤵
  PID:10388
- C:\Windows\System\yxAOuff.exe
  C:\Windows\System\yxAOuff.exe
  2⤵
  PID:10444
- C:\Windows\System\CBFCsjS.exe
  C:\Windows\System\CBFCsjS.exe
  2⤵
  PID:10480
- C:\Windows\System\FNNYcHb.exe
  C:\Windows\System\FNNYcHb.exe
  2⤵
  PID:10496
- C:\Windows\System\YZNTtkE.exe
  C:\Windows\System\YZNTtkE.exe
  2⤵
  PID:10520
- C:\Windows\System\WpKoOPx.exe
  C:\Windows\System\WpKoOPx.exe
  2⤵
  PID:10560
- C:\Windows\System\dYIpkFG.exe
  C:\Windows\System\dYIpkFG.exe
  2⤵
  PID:10580
- C:\Windows\System\gCnFYRK.exe
  C:\Windows\System\gCnFYRK.exe
  2⤵
  PID:10608
- C:\Windows\System\DOFMYpt.exe
  C:\Windows\System\DOFMYpt.exe
  2⤵
  PID:10648
- C:\Windows\System\kzCsEer.exe
  C:\Windows\System\kzCsEer.exe
  2⤵
  PID:10676
- C:\Windows\System\EjXlhRL.exe
  C:\Windows\System\EjXlhRL.exe
  2⤵
  PID:10692
- C:\Windows\System\jUUOOVr.exe
  C:\Windows\System\jUUOOVr.exe
  2⤵
  PID:10732
- C:\Windows\System\bUxcWhI.exe
  C:\Windows\System\bUxcWhI.exe
  2⤵
  PID:10748
- C:\Windows\System\xVKcKiV.exe
  C:\Windows\System\xVKcKiV.exe
  2⤵
  PID:10764
- C:\Windows\System\NlHCKyj.exe
  C:\Windows\System\NlHCKyj.exe
  2⤵
  PID:10788
- C:\Windows\System\iLpWYVq.exe
  C:\Windows\System\iLpWYVq.exe
  2⤵
  PID:10824
- C:\Windows\System\ZTfmAdb.exe
  C:\Windows\System\ZTfmAdb.exe
  2⤵
  PID:10872
- C:\Windows\System\abmEdju.exe
  C:\Windows\System\abmEdju.exe
  2⤵
  PID:10888
- C:\Windows\System\LsqvDxg.exe
  C:\Windows\System\LsqvDxg.exe
  2⤵
  PID:10904
- C:\Windows\System\PeOunzA.exe
  C:\Windows\System\PeOunzA.exe
  2⤵
  PID:10956
- C:\Windows\System\Mgezawj.exe
  C:\Windows\System\Mgezawj.exe
  2⤵
  PID:10984
- C:\Windows\System\deWfwWu.exe
  C:\Windows\System\deWfwWu.exe
  2⤵
  PID:11012
- C:\Windows\System\FxqnOCe.exe
  C:\Windows\System\FxqnOCe.exe
  2⤵
  PID:11028
- C:\Windows\System\vjdsWfU.exe
  C:\Windows\System\vjdsWfU.exe
  2⤵
  PID:11068
- C:\Windows\System\VGnYqcv.exe
  C:\Windows\System\VGnYqcv.exe
  2⤵
  PID:11096
- C:\Windows\System\bGDEahF.exe
  C:\Windows\System\bGDEahF.exe
  2⤵
  PID:11112
- C:\Windows\System\bvKDODr.exe
  C:\Windows\System\bvKDODr.exe
  2⤵
  PID:11152
- C:\Windows\System\vVnypeh.exe
  C:\Windows\System\vVnypeh.exe
  2⤵
  PID:11168
- C:\Windows\System\hfAtVqX.exe
  C:\Windows\System\hfAtVqX.exe
  2⤵
  PID:11184
- C:\Windows\System\KLtsYJs.exe
  C:\Windows\System\KLtsYJs.exe
  2⤵
  PID:11204
- C:\Windows\System\nBVYSFg.exe
  C:\Windows\System\nBVYSFg.exe
  2⤵
  PID:11244
- C:\Windows\System\BrgDQip.exe
  C:\Windows\System\BrgDQip.exe
  2⤵
  PID:10288
- C:\Windows\System\qTyKoLz.exe
  C:\Windows\System\qTyKoLz.exe
  2⤵
  PID:10332
- C:\Windows\System\LTZgPUn.exe
  C:\Windows\System\LTZgPUn.exe
  2⤵
  PID:10384
- C:\Windows\System\fqQMOax.exe
  C:\Windows\System\fqQMOax.exe
  2⤵
  PID:10464
- C:\Windows\System\sdUXjhp.exe
  C:\Windows\System\sdUXjhp.exe
  2⤵
  PID:10516
- C:\Windows\System\vMTdNpQ.exe
  C:\Windows\System\vMTdNpQ.exe
  2⤵
  PID:10572
- C:\Windows\System\KeTUWRb.exe
  C:\Windows\System\KeTUWRb.exe
  2⤵
  PID:10660
- C:\Windows\System\zMVkoKb.exe
  C:\Windows\System\zMVkoKb.exe
  2⤵
  PID:10716
- C:\Windows\System\BOpFzkg.exe
  C:\Windows\System\BOpFzkg.exe
  2⤵
  PID:10740
- C:\Windows\System\LWPYtJy.exe
  C:\Windows\System\LWPYtJy.exe
  2⤵
  PID:10856
- C:\Windows\System\vIuQcjW.exe
  C:\Windows\System\vIuQcjW.exe
  2⤵
  PID:10952
- C:\Windows\System\rYyMThc.exe
  C:\Windows\System\rYyMThc.exe
  2⤵
  PID:11024
- C:\Windows\System\gsvYrPh.exe
  C:\Windows\System\gsvYrPh.exe
  2⤵
  PID:11084
- C:\Windows\System\oYZneYR.exe
  C:\Windows\System\oYZneYR.exe
  2⤵
  PID:11132
- C:\Windows\System\WrdADmC.exe
  C:\Windows\System\WrdADmC.exe
  2⤵
  PID:10220
- C:\Windows\System\EdYVkDx.exe
  C:\Windows\System\EdYVkDx.exe
  2⤵
  PID:9468
- C:\Windows\System\TRADwMQ.exe
  C:\Windows\System\TRADwMQ.exe
  2⤵
  PID:10368
- C:\Windows\System\TDHNERD.exe
  C:\Windows\System\TDHNERD.exe
  2⤵
  PID:10576
- C:\Windows\System\nakOpIO.exe
  C:\Windows\System\nakOpIO.exe
  2⤵
  PID:10548
- C:\Windows\System\eegxjQA.exe
  C:\Windows\System\eegxjQA.exe
  2⤵
  PID:10816
- C:\Windows\System\QGkuZLC.exe
  C:\Windows\System\QGkuZLC.exe
  2⤵
  PID:11000
- C:\Windows\System\xcrdUBR.exe
  C:\Windows\System\xcrdUBR.exe
  2⤵
  PID:11108
- C:\Windows\System\YDZlmko.exe
  C:\Windows\System\YDZlmko.exe
  2⤵
  PID:10284
- C:\Windows\System\chLckmX.exe
  C:\Windows\System\chLckmX.exe
  2⤵
  PID:10348
- C:\Windows\System\ifOQXzD.exe
  C:\Windows\System\ifOQXzD.exe
  2⤵
  PID:11044
- C:\Windows\System\RKRWfUP.exe
  C:\Windows\System\RKRWfUP.exe
  2⤵
  PID:11176
- C:\Windows\System\sNXdJPK.exe
  C:\Windows\System\sNXdJPK.exe
  2⤵
  PID:11004
- C:\Windows\System\FcSRfGb.exe
  C:\Windows\System\FcSRfGb.exe
  2⤵
  PID:11292
- C:\Windows\System\VIOnAut.exe
  C:\Windows\System\VIOnAut.exe
  2⤵
  PID:11308
- C:\Windows\System\VnIPQUL.exe
  C:\Windows\System\VnIPQUL.exe
  2⤵
  PID:11360
- C:\Windows\System\mxHxwGh.exe
  C:\Windows\System\mxHxwGh.exe
  2⤵
  PID:11376
- C:\Windows\System\baiZBWd.exe
  C:\Windows\System\baiZBWd.exe
  2⤵
  PID:11404
- C:\Windows\System\ijGVBzT.exe
  C:\Windows\System\ijGVBzT.exe
  2⤵
  PID:11432
- C:\Windows\System\PTYbPHU.exe
  C:\Windows\System\PTYbPHU.exe
  2⤵
  PID:11472
- C:\Windows\System\kohYkev.exe
  C:\Windows\System\kohYkev.exe
  2⤵
  PID:11500
- C:\Windows\System\GYoHyYZ.exe
  C:\Windows\System\GYoHyYZ.exe
  2⤵
  PID:11528
- C:\Windows\System\nPgTwfw.exe
  C:\Windows\System\nPgTwfw.exe
  2⤵
  PID:11556
- C:\Windows\System\fnNkmxp.exe
  C:\Windows\System\fnNkmxp.exe
  2⤵
  PID:11572
- C:\Windows\System\wMSpMfH.exe
  C:\Windows\System\wMSpMfH.exe
  2⤵
  PID:11596
- C:\Windows\System\DLOoDIO.exe
  C:\Windows\System\DLOoDIO.exe
  2⤵
  PID:11624
- C:\Windows\System\UNHrnaD.exe
  C:\Windows\System\UNHrnaD.exe
  2⤵
  PID:11644
- C:\Windows\System\UAlYgil.exe
  C:\Windows\System\UAlYgil.exe
  2⤵
  PID:11668
- C:\Windows\System\ANGKirZ.exe
  C:\Windows\System\ANGKirZ.exe
  2⤵
  PID:11700
- C:\Windows\System\GHxkimK.exe
  C:\Windows\System\GHxkimK.exe
  2⤵
  PID:11720
- C:\Windows\System\ZRFkGcc.exe
  C:\Windows\System\ZRFkGcc.exe
  2⤵
  PID:11752
- C:\Windows\System\QUWdlPx.exe
  C:\Windows\System\QUWdlPx.exe
  2⤵
  PID:11784
- C:\Windows\System\aZSWbjp.exe
  C:\Windows\System\aZSWbjp.exe
  2⤵
  PID:11808
- C:\Windows\System\BXoIzrN.exe
  C:\Windows\System\BXoIzrN.exe
  2⤵
  PID:11868
- C:\Windows\System\ISLdBJi.exe
  C:\Windows\System\ISLdBJi.exe
  2⤵
  PID:11896
- C:\Windows\System\ANfknhB.exe
  C:\Windows\System\ANfknhB.exe
  2⤵
  PID:11912
- C:\Windows\System\nOvQopc.exe
  C:\Windows\System\nOvQopc.exe
  2⤵
  PID:11952
- C:\Windows\System\QKxKSEn.exe
  C:\Windows\System\QKxKSEn.exe
  2⤵
  PID:11968
- C:\Windows\System\UZAYTyk.exe
  C:\Windows\System\UZAYTyk.exe
  2⤵
  PID:12000
- C:\Windows\System\yTnHmsG.exe
  C:\Windows\System\yTnHmsG.exe
  2⤵
  PID:12036
- C:\Windows\System\KREeKoa.exe
  C:\Windows\System\KREeKoa.exe
  2⤵
  PID:12052
- C:\Windows\System\QhvrrVD.exe
  C:\Windows\System\QhvrrVD.exe
  2⤵
  PID:12092
- C:\Windows\System\gAJDnLF.exe
  C:\Windows\System\gAJDnLF.exe
  2⤵
  PID:12108
- C:\Windows\System\cedFcRF.exe
  C:\Windows\System\cedFcRF.exe
  2⤵
  PID:12148
- C:\Windows\System\UpBSTOl.exe
  C:\Windows\System\UpBSTOl.exe
  2⤵
  PID:12176
- C:\Windows\System\WxHKfUV.exe
  C:\Windows\System\WxHKfUV.exe
  2⤵
  PID:12204
- C:\Windows\System\sWmZpjI.exe
  C:\Windows\System\sWmZpjI.exe
  2⤵
  PID:12232
- C:\Windows\System\tJQucgv.exe
  C:\Windows\System\tJQucgv.exe
  2⤵
  PID:12248
- C:\Windows\System\voYopcv.exe
  C:\Windows\System\voYopcv.exe
  2⤵
  PID:10640
- C:\Windows\System\ivVMrta.exe
  C:\Windows\System\ivVMrta.exe
  2⤵
  PID:11284
- C:\Windows\System\mIhOlbL.exe
  C:\Windows\System\mIhOlbL.exe
  2⤵
  PID:11344
- C:\Windows\System\YEVebtE.exe
  C:\Windows\System\YEVebtE.exe
  2⤵
  PID:11420
- C:\Windows\System\CAMJqWI.exe
  C:\Windows\System\CAMJqWI.exe
  2⤵
  PID:11448
- C:\Windows\System\iuZZAEa.exe
  C:\Windows\System\iuZZAEa.exe
  2⤵
  PID:11496
- C:\Windows\System\PyrKylv.exe
  C:\Windows\System\PyrKylv.exe
  2⤵
  PID:11544
- C:\Windows\System\xWfGiyv.exe
  C:\Windows\System\xWfGiyv.exe
  2⤵
  PID:11620
- C:\Windows\System\FVBDxGg.exe
  C:\Windows\System\FVBDxGg.exe
  2⤵
  PID:11744
- C:\Windows\System\VsAFAHv.exe
  C:\Windows\System\VsAFAHv.exe
  2⤵
  PID:11824
- C:\Windows\System\cUavSvj.exe
  C:\Windows\System\cUavSvj.exe
  2⤵
  PID:11864
- C:\Windows\System\OrAToeL.exe
  C:\Windows\System\OrAToeL.exe
  2⤵
  PID:11888
- C:\Windows\System\NKcSShi.exe
  C:\Windows\System\NKcSShi.exe
  2⤵
  PID:11960
- C:\Windows\System\yyrRGRc.exe
  C:\Windows\System\yyrRGRc.exe
  2⤵
  PID:12048
- C:\Windows\System\yHSXscp.exe
  C:\Windows\System\yHSXscp.exe
  2⤵
  PID:12100
- C:\Windows\System\zKOaTIS.exe
  C:\Windows\System\zKOaTIS.exe
  2⤵
  PID:12200
- C:\Windows\System\oPQhKaS.exe
  C:\Windows\System\oPQhKaS.exe
  2⤵
  PID:12240
- C:\Windows\System\myNWAUd.exe
  C:\Windows\System\myNWAUd.exe
  2⤵
  PID:11280
- C:\Windows\System\VJxADwE.exe
  C:\Windows\System\VJxADwE.exe
  2⤵
  PID:11368
- C:\Windows\System\HuGMUux.exe
  C:\Windows\System\HuGMUux.exe
  2⤵
  PID:11520
- C:\Windows\System\oHQdScU.exe
  C:\Windows\System\oHQdScU.exe
  2⤵
  PID:10944
- C:\Windows\System\JIBHCTV.exe
  C:\Windows\System\JIBHCTV.exe
  2⤵
  PID:11800
- C:\Windows\System\HjCjkqQ.exe
  C:\Windows\System\HjCjkqQ.exe
  2⤵
  PID:11880
- C:\Windows\System\mbdmAau.exe
  C:\Windows\System\mbdmAau.exe
  2⤵
  PID:12012
- C:\Windows\System\pDRNdvX.exe
  C:\Windows\System\pDRNdvX.exe
  2⤵
  PID:12268
- C:\Windows\System\DarItOP.exe
  C:\Windows\System\DarItOP.exe
  2⤵
  PID:11612
- C:\Windows\System\NAILnGG.exe
  C:\Windows\System\NAILnGG.exe
  2⤵
  PID:11908
- C:\Windows\System\SJbdENF.exe
  C:\Windows\System\SJbdENF.exe
  2⤵
  PID:11708
- C:\Windows\System\QbqWKws.exe
  C:\Windows\System\QbqWKws.exe
  2⤵
  PID:12296
- C:\Windows\System\ErFGyuF.exe
  C:\Windows\System\ErFGyuF.exe
  2⤵
  PID:12324
- C:\Windows\System\xKDroYI.exe
  C:\Windows\System\xKDroYI.exe
  2⤵
  PID:12348
- C:\Windows\System\uDvrxZf.exe
  C:\Windows\System\uDvrxZf.exe
  2⤵
  PID:12372
- C:\Windows\System\hBFsIVi.exe
  C:\Windows\System\hBFsIVi.exe
  2⤵
  PID:12420
- C:\Windows\System\ozONZaJ.exe
  C:\Windows\System\ozONZaJ.exe
  2⤵
  PID:12448
- C:\Windows\System\IVNOsyO.exe
  C:\Windows\System\IVNOsyO.exe
  2⤵
  PID:12464
- C:\Windows\System\NFlkWak.exe
  C:\Windows\System\NFlkWak.exe
  2⤵
  PID:12492
- C:\Windows\System\BOsrVGM.exe
  C:\Windows\System\BOsrVGM.exe
  2⤵
  PID:12520
- C:\Windows\System\EfHpMTI.exe
  C:\Windows\System\EfHpMTI.exe
  2⤵
  PID:12536
- C:\Windows\System\wmbAdrX.exe
  C:\Windows\System\wmbAdrX.exe
  2⤵
  PID:12568
- C:\Windows\System\YFzmnyS.exe
  C:\Windows\System\YFzmnyS.exe
  2⤵
  PID:12604
- C:\Windows\System\nJGIsSj.exe
  C:\Windows\System\nJGIsSj.exe
  2⤵
  PID:12624
- C:\Windows\System\crMqMjl.exe
  C:\Windows\System\crMqMjl.exe
  2⤵
  PID:12644
- C:\Windows\System\mHyNGVM.exe
  C:\Windows\System\mHyNGVM.exe
  2⤵
  PID:12664
- C:\Windows\System\sLmVCGH.exe
  C:\Windows\System\sLmVCGH.exe
  2⤵
  PID:12688
- C:\Windows\System\ButdTNU.exe
  C:\Windows\System\ButdTNU.exe
  2⤵
  PID:12756
- C:\Windows\System\TrNzmFx.exe
  C:\Windows\System\TrNzmFx.exe
  2⤵
  PID:12784
- C:\Windows\System\eUakbaX.exe
  C:\Windows\System\eUakbaX.exe
  2⤵
  PID:12812
- C:\Windows\System\XQKukSe.exe
  C:\Windows\System\XQKukSe.exe
  2⤵
  PID:12828
- C:\Windows\System\OvuVtXX.exe
  C:\Windows\System\OvuVtXX.exe
  2⤵
  PID:12868
- C:\Windows\System\UeOEWki.exe
  C:\Windows\System\UeOEWki.exe
  2⤵
  PID:12884
- C:\Windows\System\nfTcaTa.exe
  C:\Windows\System\nfTcaTa.exe
  2⤵
  PID:12904
- C:\Windows\System\bwlRPsW.exe
  C:\Windows\System\bwlRPsW.exe
  2⤵
  PID:12924
- C:\Windows\System\sArRzDG.exe
  C:\Windows\System\sArRzDG.exe
  2⤵
  PID:12956
- C:\Windows\System\SQPcxfO.exe
  C:\Windows\System\SQPcxfO.exe
  2⤵
  PID:13008
- C:\Windows\System\tVCMZAX.exe
  C:\Windows\System\tVCMZAX.exe
  2⤵
  PID:13036
- C:\Windows\System\NNnIWYJ.exe
  C:\Windows\System\NNnIWYJ.exe
  2⤵
  PID:13064
- C:\Windows\System\AJqaVRV.exe
  C:\Windows\System\AJqaVRV.exe
  2⤵
  PID:13092
- C:\Windows\System\OOOEBvD.exe
  C:\Windows\System\OOOEBvD.exe
  2⤵
  PID:13120
- C:\Windows\System\eVkmOTm.exe
  C:\Windows\System\eVkmOTm.exe
  2⤵
  PID:13148
- C:\Windows\System\eXrvUaV.exe
  C:\Windows\System\eXrvUaV.exe
  2⤵
  PID:13164
- C:\Windows\System\nWKbAXb.exe
  C:\Windows\System\nWKbAXb.exe
  2⤵
  PID:13196
- C:\Windows\System\VKytnLo.exe
  C:\Windows\System\VKytnLo.exe
  2⤵
  PID:13220
- C:\Windows\System\kYFWmTp.exe
  C:\Windows\System\kYFWmTp.exe
  2⤵
  PID:13260
- C:\Windows\System\AnmgHPj.exe
  C:\Windows\System\AnmgHPj.exe
  2⤵
  PID:13288
- C:\Windows\System\TSTfcXB.exe
  C:\Windows\System\TSTfcXB.exe
  2⤵
  PID:13308
- C:\Windows\System\BeVHixS.exe
  C:\Windows\System\BeVHixS.exe
  2⤵
  PID:12068
- C:\Windows\System\MnQtCVX.exe
  C:\Windows\System\MnQtCVX.exe
  2⤵
  PID:12336
- C:\Windows\System\emRtuOD.exe
  C:\Windows\System\emRtuOD.exe
  2⤵
  PID:12404
- C:\Windows\System\wrXaZQt.exe
  C:\Windows\System\wrXaZQt.exe
  2⤵
  PID:12528
- C:\Windows\System\zANrSPQ.exe
  C:\Windows\System\zANrSPQ.exe
  2⤵
  PID:12556
- C:\Windows\System\OcvWOIP.exe
  C:\Windows\System\OcvWOIP.exe
  2⤵
  PID:12636
- C:\Windows\System\xPHkPFX.exe
  C:\Windows\System\xPHkPFX.exe
  2⤵
  PID:12704
- C:\Windows\System\fLIziTj.exe
  C:\Windows\System\fLIziTj.exe
  2⤵
  PID:12748
- C:\Windows\System\qAZYabi.exe
  C:\Windows\System\qAZYabi.exe
  2⤵
  PID:12848
- C:\Windows\System\tmPadyi.exe
  C:\Windows\System\tmPadyi.exe
  2⤵
  PID:12892
- C:\Windows\System\IxRngpf.exe
  C:\Windows\System\IxRngpf.exe
  2⤵
  PID:12944
- C:\Windows\System\FKgtzog.exe
  C:\Windows\System\FKgtzog.exe
  2⤵
  PID:13024
- C:\Windows\System\szbOAqz.exe
  C:\Windows\System\szbOAqz.exe
  2⤵
  PID:13060
- C:\Windows\System\rmJADLc.exe
  C:\Windows\System\rmJADLc.exe
  2⤵
  PID:13116
- C:\Windows\System\yLRlIyI.exe
  C:\Windows\System\yLRlIyI.exe
  2⤵
  PID:13176
- C:\Windows\System\HPdYohG.exe
  C:\Windows\System\HPdYohG.exe
  2⤵
  PID:13252
- C:\Windows\System\LfPZBkf.exe
  C:\Windows\System\LfPZBkf.exe
  2⤵
  PID:12308
- C:\Windows\System\hgFJlwV.exe
  C:\Windows\System\hgFJlwV.exe
  2⤵
  PID:12460
- C:\Windows\System\qZxmtrh.exe
  C:\Windows\System\qZxmtrh.exe
  2⤵
  PID:12640
- C:\Windows\System\zKLgPBa.exe
  C:\Windows\System\zKLgPBa.exe
  2⤵
  PID:12744
- C:\Windows\System\iNwiJon.exe
  C:\Windows\System\iNwiJon.exe
  2⤵
  PID:12936
- C:\Windows\System\yRNqZYk.exe
  C:\Windows\System\yRNqZYk.exe
  2⤵
  PID:13180
- C:\Windows\System\wVHrEvY.exe
  C:\Windows\System\wVHrEvY.exe
  2⤵
  PID:13272
- C:\Windows\System\yvmSZht.exe
  C:\Windows\System\yvmSZht.exe
  2⤵
  PID:12512
- C:\Windows\System\dAAHAiz.exe
  C:\Windows\System\dAAHAiz.exe
  2⤵
  PID:12912
- C:\Windows\System\uowmWjx.exe
  C:\Windows\System\uowmWjx.exe
  2⤵
  PID:13112
- C:\Windows\System\OhlmfJn.exe
  C:\Windows\System\OhlmfJn.exe
  2⤵
  PID:13216
- C:\Windows\System\KcIAOGE.exe
  C:\Windows\System\KcIAOGE.exe
  2⤵
  PID:12560
- C:\Windows\System\pqAPUHc.exe
  C:\Windows\System\pqAPUHc.exe
  2⤵
  PID:13332
- C:\Windows\System\eIJqmOt.exe
  C:\Windows\System\eIJqmOt.exe
  2⤵
  PID:13368
- C:\Windows\System\iFNWWrD.exe
  C:\Windows\System\iFNWWrD.exe
  2⤵
  PID:13396
- C:\Windows\System\vldpGct.exe
  C:\Windows\System\vldpGct.exe
  2⤵
  PID:13424
- C:\Windows\System\htHSnJG.exe
  C:\Windows\System\htHSnJG.exe
  2⤵
  PID:13452
- C:\Windows\System\vmLvmjm.exe
  C:\Windows\System\vmLvmjm.exe
  2⤵
  PID:13476
- C:\Windows\System\fUjAzNj.exe
  C:\Windows\System\fUjAzNj.exe
  2⤵
  PID:13500
- C:\Windows\System\rbRSmMl.exe
  C:\Windows\System\rbRSmMl.exe
  2⤵
  PID:13524
- C:\Windows\System\sZYPWuI.exe
  C:\Windows\System\sZYPWuI.exe
  2⤵
  PID:13544
- C:\Windows\System\RTrQwpk.exe
  C:\Windows\System\RTrQwpk.exe
  2⤵
  PID:13564
- C:\Windows\System\vRIsQpE.exe
  C:\Windows\System\vRIsQpE.exe
  2⤵
  PID:13620
- C:\Windows\System\ZmbSuZh.exe
  C:\Windows\System\ZmbSuZh.exe
  2⤵
  PID:13660
- C:\Windows\System\JEDmiMP.exe
  C:\Windows\System\JEDmiMP.exe
  2⤵
  PID:13684
- C:\Windows\System\hMEQZJd.exe
  C:\Windows\System\hMEQZJd.exe
  2⤵
  PID:13704
- C:\Windows\System\kfwJldo.exe
  C:\Windows\System\kfwJldo.exe
  2⤵
  PID:13732
- C:\Windows\System\fuHDZJQ.exe
  C:\Windows\System\fuHDZJQ.exe
  2⤵
  PID:13752
- C:\Windows\System\lpMGPgy.exe
  C:\Windows\System\lpMGPgy.exe
  2⤵
  PID:13784
- C:\Windows\System\ocwifvg.exe
  C:\Windows\System\ocwifvg.exe
  2⤵
  PID:13828
- C:\Windows\System\UDdbDOQ.exe
  C:\Windows\System\UDdbDOQ.exe
  2⤵
  PID:13856
- C:\Windows\System\OqmXKuA.exe
  C:\Windows\System\OqmXKuA.exe
  2⤵
  PID:13876
- C:\Windows\System\beoymIJ.exe
  C:\Windows\System\beoymIJ.exe
  2⤵
  PID:13900
- C:\Windows\System\YcWvqOj.exe
  C:\Windows\System\YcWvqOj.exe
  2⤵
  PID:13916
- C:\Windows\System\yQfwtPN.exe
  C:\Windows\System\yQfwtPN.exe
  2⤵
  PID:13944
- C:\Windows\System\MlRyerw.exe
  C:\Windows\System\MlRyerw.exe
  2⤵
  PID:13996
- C:\Windows\System\OMALsgu.exe
  C:\Windows\System\OMALsgu.exe
  2⤵
  PID:14012
- C:\Windows\System\mpCSMZY.exe
  C:\Windows\System\mpCSMZY.exe
  2⤵
  PID:14036
- C:\Windows\System\uiNdeTu.exe
  C:\Windows\System\uiNdeTu.exe
  2⤵
  PID:14064
- C:\Windows\System\BqpBSVq.exe
  C:\Windows\System\BqpBSVq.exe
  2⤵
  PID:14108
- C:\Windows\System\UNNEEYi.exe
  C:\Windows\System\UNNEEYi.exe
  2⤵
  PID:14136
- C:\Windows\System\ORKeGcL.exe
  C:\Windows\System\ORKeGcL.exe
  2⤵
  PID:14164
- C:\Windows\System\ICCnaOH.exe
  C:\Windows\System\ICCnaOH.exe
  2⤵
  PID:14192
- C:\Windows\System\cPJZMGA.exe
  C:\Windows\System\cPJZMGA.exe
  2⤵
  PID:14208
- C:\Windows\System\rynxUyj.exe
  C:\Windows\System\rynxUyj.exe
  2⤵
  PID:14248
- C:\Windows\System\djNKlSW.exe
  C:\Windows\System\djNKlSW.exe
  2⤵
  PID:14276
- C:\Windows\System\EnXViMo.exe
  C:\Windows\System\EnXViMo.exe
  2⤵
  PID:14292
- C:\Windows\System\TOXPdod.exe
  C:\Windows\System\TOXPdod.exe
  2⤵
  PID:14308
- C:\Windows\System\ozLTbPF.exe
  C:\Windows\System\ozLTbPF.exe
  2⤵
  PID:13324
- C:\Windows\System\JOZYacj.exe
  C:\Windows\System\JOZYacj.exe
  2⤵
  PID:13412
- C:\Windows\System\kGhRAuO.exe
  C:\Windows\System\kGhRAuO.exe
  2⤵
  PID:13488
- C:\Windows\System\eOfXPAa.exe
  C:\Windows\System\eOfXPAa.exe
  2⤵
  PID:13556
- C:\Windows\System\FZjQnXK.exe
  C:\Windows\System\FZjQnXK.exe
  2⤵
  PID:13584
- C:\Windows\System\tTfpEqe.exe
  C:\Windows\System\tTfpEqe.exe
  2⤵
  PID:13632
- C:\Windows\System\qXdeHsL.exe
  C:\Windows\System\qXdeHsL.exe
  2⤵
  PID:13672
- C:\Windows\System\ptvFtjt.exe
  C:\Windows\System\ptvFtjt.exe
  2⤵
  PID:13740
- C:\Windows\System\TGyZxar.exe
  C:\Windows\System\TGyZxar.exe
  2⤵
  PID:13820
- C:\Windows\System\bfuUnfK.exe
  C:\Windows\System\bfuUnfK.exe
  2⤵
  PID:13892
- C:\Windows\System\qvraqYV.exe
  C:\Windows\System\qvraqYV.exe
  2⤵
  PID:13932
- C:\Windows\System\Cengcsm.exe
  C:\Windows\System\Cengcsm.exe
  2⤵
  PID:14024
- C:\Windows\System\CfxIScc.exe
  C:\Windows\System\CfxIScc.exe
  2⤵
  PID:14120
- C:\Windows\System\ImNnDGV.exe
  C:\Windows\System\ImNnDGV.exe
  2⤵
  PID:14156
- C:\Windows\System\sfmoppm.exe
  C:\Windows\System\sfmoppm.exe
  2⤵
  PID:14204
- C:\Windows\System\ttWwzAU.exe
  C:\Windows\System\ttWwzAU.exe
  2⤵
  PID:14260
- C:\Windows\System\nqRGYTc.exe
  C:\Windows\System\nqRGYTc.exe
  2⤵
  PID:14328
- C:\Windows\System\jnDijpy.exe
  C:\Windows\System\jnDijpy.exe
  2⤵
  PID:13468
- C:\Windows\System\gCRGcbY.exe
  C:\Windows\System\gCRGcbY.exe
  2⤵
  PID:13536
- C:\Windows\System\nlFjvrp.exe
  C:\Windows\System\nlFjvrp.exe
  2⤵
  PID:13680
- C:\Windows\System\dJWoLJF.exe
  C:\Windows\System\dJWoLJF.exe
  2⤵
  PID:13716
- C:\Windows\System\BBszzxO.exe
  C:\Windows\System\BBszzxO.exe
  2⤵
  PID:13992
- C:\Windows\System\QpOkLiu.exe
  C:\Windows\System\QpOkLiu.exe
  2⤵
  PID:14132
- C:\Windows\System\HwPWzne.exe
  C:\Windows\System\HwPWzne.exe
  2⤵
  PID:14240
- C:\Windows\System\fHFPJRQ.exe
  C:\Windows\System\fHFPJRQ.exe
  2⤵
  PID:13888
- C:\Windows\System\tYGuhxZ.exe
  C:\Windows\System\tYGuhxZ.exe
  2⤵
  PID:14300
- C:\Windows\System\yaQynxC.exe
  C:\Windows\System\yaQynxC.exe
  2⤵
  PID:14344
- C:\Windows\System\KgdCGpY.exe
  C:\Windows\System\KgdCGpY.exe
  2⤵
  PID:14372
- C:\Windows\System\jMJlGNc.exe
  C:\Windows\System\jMJlGNc.exe
  2⤵
  PID:14400
- C:\Windows\System\ZQbyaCY.exe
  C:\Windows\System\ZQbyaCY.exe
  2⤵
  PID:14420
- C:\Windows\System\aTxtnml.exe
  C:\Windows\System\aTxtnml.exe
  2⤵
  PID:14464
- C:\Windows\System\BjdIxBa.exe
  C:\Windows\System\BjdIxBa.exe
  2⤵
  PID:14496
- C:\Windows\System\moFeebb.exe
  C:\Windows\System\moFeebb.exe
  2⤵
  PID:14520
- C:\Windows\System\xWkgotS.exe
  C:\Windows\System\xWkgotS.exe
  2⤵
  PID:14560
- C:\Windows\System\scxxNPk.exe
  C:\Windows\System\scxxNPk.exe
  2⤵
  PID:14576
- C:\Windows\System\vUtlWKP.exe
  C:\Windows\System\vUtlWKP.exe
  2⤵
  PID:14600
- C:\Windows\System\JyHgHTt.exe
  C:\Windows\System\JyHgHTt.exe
  2⤵
  PID:14644
- C:\Windows\System\ykoNxDB.exe
  C:\Windows\System\ykoNxDB.exe
  2⤵
  PID:14660
- C:\Windows\System\jlXSIVP.exe
  C:\Windows\System\jlXSIVP.exe
  2⤵
  PID:14688
- C:\Windows\System\iZMpRWj.exe
  C:\Windows\System\iZMpRWj.exe
  2⤵
  PID:14708
- C:\Windows\System\OqmdetA.exe
  C:\Windows\System\OqmdetA.exe
  2⤵
  PID:14744
- C:\Windows\System\ipYaDaj.exe
  C:\Windows\System\ipYaDaj.exe
  2⤵
  PID:14772
- C:\Windows\System\EhmHZbD.exe
  C:\Windows\System\EhmHZbD.exe
  2⤵
  PID:14816
- C:\Windows\System\flzWuRE.exe
  C:\Windows\System\flzWuRE.exe
  2⤵
  PID:14844
- C:\Windows\System\wzCujBO.exe
  C:\Windows\System\wzCujBO.exe
  2⤵
  PID:14860
- C:\Windows\System\wVmWAkF.exe
  C:\Windows\System\wVmWAkF.exe
  2⤵
  PID:14896
- C:\Windows\System\acCUSDL.exe
  C:\Windows\System\acCUSDL.exe
  2⤵
  PID:14916
- C:\Windows\System\OKrLPQT.exe
  C:\Windows\System\OKrLPQT.exe
  2⤵
  PID:14956
- C:\Windows\System\lfzewmX.exe
  C:\Windows\System\lfzewmX.exe
  2⤵
  PID:14984
- C:\Windows\System\zUHGeiZ.exe
  C:\Windows\System\zUHGeiZ.exe
  2⤵
  PID:15000
- C:\Windows\System\sihZlIX.exe
  C:\Windows\System\sihZlIX.exe
  2⤵
  PID:15016
- C:\Windows\System\NVqrgUX.exe
  C:\Windows\System\NVqrgUX.exe
  2⤵
  PID:15056
- C:\Windows\System\skPqaGL.exe
  C:\Windows\System\skPqaGL.exe
  2⤵
  PID:15088
- C:\Windows\System\zvFaFSU.exe
  C:\Windows\System\zvFaFSU.exe
  2⤵
  PID:15116
- C:\Windows\System\BzOSBeC.exe
  C:\Windows\System\BzOSBeC.exe
  2⤵
  PID:15140
- C:\Windows\System\lfYiZsS.exe
  C:\Windows\System\lfYiZsS.exe
  2⤵
  PID:15168
- C:\Windows\System\yhchydX.exe
  C:\Windows\System\yhchydX.exe
  2⤵
  PID:15196
- C:\Windows\System\joellKS.exe
  C:\Windows\System\joellKS.exe
  2⤵
  PID:15232
- C:\Windows\System\KeZZhhc.exe
  C:\Windows\System\KeZZhhc.exe
  2⤵
  PID:15256
- C:\Windows\System\rfjDQhv.exe
  C:\Windows\System\rfjDQhv.exe
  2⤵
  PID:15280
- C:\Windows\System\yCogwPH.exe
  C:\Windows\System\yCogwPH.exe
  2⤵
  PID:15308
- C:\Windows\System\MPGQVsN.exe
  C:\Windows\System\MPGQVsN.exe
  2⤵
  PID:15336
- C:\Windows\System\djTeoRi.exe
  C:\Windows\System\djTeoRi.exe
  2⤵
  PID:13496
- C:\Windows\System\LqjRPtY.exe
  C:\Windows\System\LqjRPtY.exe
  2⤵
  PID:14412
- C:\Windows\System\CktyJxb.exe
  C:\Windows\System\CktyJxb.exe
  2⤵
  PID:14416
- C:\Windows\System\PYZvJhf.exe
  C:\Windows\System\PYZvJhf.exe
  2⤵
  PID:14460
- C:\Windows\System\xCNITGa.exe
  C:\Windows\System\xCNITGa.exe
  2⤵
  PID:14548
- C:\Windows\System\zQvMeKp.exe
  C:\Windows\System\zQvMeKp.exe
  2⤵
  PID:14568
- C:\Windows\System\tGYeAlx.exe
  C:\Windows\System\tGYeAlx.exe
  2⤵
  PID:14700
- C:\Windows\System\IXEmnXw.exe
  C:\Windows\System\IXEmnXw.exe
  2⤵
  PID:14768
- C:\Windows\System\JLyUnNk.exe
  C:\Windows\System\JLyUnNk.exe
  2⤵
  PID:14832
- C:\Windows\System\SEqJxKm.exe
  C:\Windows\System\SEqJxKm.exe
  2⤵
  PID:14884
- C:\Windows\System\PhAFOwL.exe
  C:\Windows\System\PhAFOwL.exe
  2⤵
  PID:14952
- C:\Windows\System\DPsuJom.exe
  C:\Windows\System\DPsuJom.exe
  2⤵
  PID:14996
- C:\Windows\System\zrVbyqi.exe
  C:\Windows\System\zrVbyqi.exe
  2⤵
  PID:15048
- C:\Windows\System\RksDxhE.exe
  C:\Windows\System\RksDxhE.exe
  2⤵
  PID:15136
- C:\Windows\System\rayNgPl.exe
  C:\Windows\System\rayNgPl.exe
  2⤵
  PID:15220
- C:\Windows\System\JoqIhEQ.exe
  C:\Windows\System\JoqIhEQ.exe
  2⤵
  PID:15320
- C:\Windows\System\vPfQBtl.exe
  C:\Windows\System\vPfQBtl.exe
  2⤵
  PID:14364
- C:\Windows\System\qbnjPpp.exe
  C:\Windows\System\qbnjPpp.exe
  2⤵
  PID:14452
- C:\Windows\System\cOIJZez.exe
  C:\Windows\System\cOIJZez.exe
  2⤵
  PID:14532
- C:\Windows\System\qgXPFwf.exe
  C:\Windows\System\qgXPFwf.exe
  2⤵
  PID:14572
- C:\Windows\System\WoSQYGN.exe
  C:\Windows\System\WoSQYGN.exe
  2⤵
  PID:14724
- C:\Windows\System\JPVSTbg.exe
  C:\Windows\System\JPVSTbg.exe
  2⤵
  PID:14936
- C:\Windows\System\mtnfZfo.exe
  C:\Windows\System\mtnfZfo.exe
  2⤵
  PID:15072
- C:\Windows\System\UVYKOVM.exe
  C:\Windows\System\UVYKOVM.exe
  2⤵
  PID:15292
- C:\Windows\System\VBNxuGi.exe
  C:\Windows\System\VBNxuGi.exe
  2⤵
  PID:14380
- C:\Windows\System\vXtknol.exe
  C:\Windows\System\vXtknol.exe
  2⤵
  PID:14504
- C:\Windows\System\UXbaLfJ.exe
  C:\Windows\System\UXbaLfJ.exe
  2⤵
  PID:14804
- C:\Windows\System\lHUlYUy.exe
  C:\Windows\System\lHUlYUy.exe
  2⤵
  PID:15348
- C:\Windows\System\VIEnRMF.exe
  C:\Windows\System\VIEnRMF.exe
  2⤵
  PID:15424
- C:\Windows\System\zcssOpV.exe
  C:\Windows\System\zcssOpV.exe
  2⤵
  PID:15452
- C:\Windows\System\DBkzkNU.exe
  C:\Windows\System\DBkzkNU.exe
  2⤵
  PID:15480
- C:\Windows\System\dVmxjCr.exe
  C:\Windows\System\dVmxjCr.exe
  2⤵
  PID:15508
- C:\Windows\System\VRYdzKL.exe
  C:\Windows\System\VRYdzKL.exe
  2⤵
  PID:15536
- C:\Windows\System\aWmampr.exe
  C:\Windows\System\aWmampr.exe
  2⤵
  PID:15576
- C:\Windows\System\ysjsosG.exe
  C:\Windows\System\ysjsosG.exe
  2⤵
  PID:15604
- C:\Windows\System\XqAqmsv.exe
  C:\Windows\System\XqAqmsv.exe
  2⤵
  PID:15620
- C:\Windows\System\RpIRtXM.exe
  C:\Windows\System\RpIRtXM.exe
  2⤵
  PID:15648
- C:\Windows\System\srYsCqy.exe
  C:\Windows\System\srYsCqy.exe
  2⤵
  PID:15676
- C:\Windows\System\jeaCsVe.exe
  C:\Windows\System\jeaCsVe.exe
  2⤵
  PID:15700
- C:\Windows\System\eLxJrov.exe
  C:\Windows\System\eLxJrov.exe
  2⤵
  PID:15728
- C:\Windows\System\xgJpQSm.exe
  C:\Windows\System\xgJpQSm.exe
  2⤵
  PID:15756
- C:\Windows\System\nJyuymj.exe
  C:\Windows\System\nJyuymj.exe
  2⤵
  PID:15780
- C:\Windows\System\ieyBYxb.exe
  C:\Windows\System\ieyBYxb.exe
  2⤵
  PID:15808
- C:\Windows\System\BAXhdFK.exe
  C:\Windows\System\BAXhdFK.exe
  2⤵
  PID:15840
- C:\Windows\System\rHVjsFN.exe
  C:\Windows\System\rHVjsFN.exe
  2⤵
  PID:15864
- C:\Windows\System\tzqdrqR.exe
  C:\Windows\System\tzqdrqR.exe
  2⤵
  PID:15884
- C:\Windows\System\GEumeGw.exe
  C:\Windows\System\GEumeGw.exe
  2⤵
  PID:15936
- C:\Windows\System\ZztMfHs.exe
  C:\Windows\System\ZztMfHs.exe
  2⤵
  PID:15956
- C:\Windows\System\CtdasCO.exe
  C:\Windows\System\CtdasCO.exe
  2⤵
  PID:15984
- C:\Windows\System\xAxNrtB.exe
  C:\Windows\System\xAxNrtB.exe
  2⤵
  PID:16024
- C:\Windows\System\rKOsDAw.exe
  C:\Windows\System\rKOsDAw.exe
  2⤵
  PID:16052
- C:\Windows\System\bvHmpbP.exe
  C:\Windows\System\bvHmpbP.exe
  2⤵
  PID:16068
- C:\Windows\System\KkQQyVQ.exe
  C:\Windows\System\KkQQyVQ.exe
  2⤵
  PID:16108
- C:\Windows\System\AJxcKZT.exe
  C:\Windows\System\AJxcKZT.exe
  2⤵
  PID:16124
- C:\Windows\System\rjBRYNw.exe
  C:\Windows\System\rjBRYNw.exe
  2⤵
  PID:16168
- C:\Windows\System\TuiUIaC.exe
  C:\Windows\System\TuiUIaC.exe
  2⤵
  PID:16188
- C:\Windows\System\RWqYbiI.exe
  C:\Windows\System\RWqYbiI.exe
  2⤵
  PID:16212
- C:\Windows\System\JLAxdWo.exe
  C:\Windows\System\JLAxdWo.exe
  2⤵
  PID:16228
- C:\Windows\System\bVEplAS.exe
  C:\Windows\System\bVEplAS.exe
  2⤵
  PID:16280
- C:\Windows\System\uLklLap.exe
  C:\Windows\System\uLklLap.exe
  2⤵
  PID:16296
- C:\Windows\System\vbVilAk.exe
  C:\Windows\System\vbVilAk.exe
  2⤵
  PID:16320
- C:\Windows\System\DSrlEmG.exe
  C:\Windows\System\DSrlEmG.exe
  2⤵
  PID:16352
- C:\Windows\System\PgvMjNo.exe
  C:\Windows\System\PgvMjNo.exe
  2⤵
  PID:16376
- C:\Windows\System\gBzzHde.exe
  C:\Windows\System\gBzzHde.exe
  2⤵
  PID:15364
- C:\Windows\System\ZxNoOsE.exe
  C:\Windows\System\ZxNoOsE.exe
  2⤵
  PID:15392
- C:\Windows\System\iUgiPNy.exe
  C:\Windows\System\iUgiPNy.exe
  2⤵
  PID:15436
- C:\Windows\System\QPjvRhj.exe
  C:\Windows\System\QPjvRhj.exe
  2⤵
  PID:15496
- C:\Windows\System\WhYrNmU.exe
  C:\Windows\System\WhYrNmU.exe
  2⤵
  PID:15600
- C:\Windows\System\iQDQsEC.exe
  C:\Windows\System\iQDQsEC.exe
  2⤵
  PID:15640
- C:\Windows\System\VFVZXkk.exe
  C:\Windows\System\VFVZXkk.exe
  2⤵
  PID:15712
- C:\Windows\System\HpcQdzk.exe
  C:\Windows\System\HpcQdzk.exe
  2⤵
  PID:15792
- C:\Windows\System\ysmEcgc.exe
  C:\Windows\System\ysmEcgc.exe
  2⤵
  PID:15856
- C:\Windows\System\CdtHfyG.exe
  C:\Windows\System\CdtHfyG.exe
  2⤵
  PID:15908
- C:\Windows\System\bkXQLYN.exe
  C:\Windows\System\bkXQLYN.exe
  2⤵
  PID:15976
- C:\Windows\System\YBeeImd.exe
  C:\Windows\System\YBeeImd.exe
  2⤵
  PID:16060
- C:\Windows\System\wycxuDb.exe
  C:\Windows\System\wycxuDb.exe
  2⤵
  PID:16120
- C:\Windows\System\MdVCTHe.exe
  C:\Windows\System\MdVCTHe.exe
  2⤵
  PID:16164
- C:\Windows\System\OeUmOTs.exe
  C:\Windows\System\OeUmOTs.exe
  2⤵
  PID:16224
- C:\Windows\System\pEanyPP.exe
  C:\Windows\System\pEanyPP.exe
  2⤵
  PID:16316
- C:\Windows\System\lnXLlVn.exe
  C:\Windows\System\lnXLlVn.exe
  2⤵
  PID:16344
- C:\Windows\System\rBeLJWA.exe
  C:\Windows\System\rBeLJWA.exe
  2⤵
  PID:15408
- C:\Windows\System\UvxQyag.exe
  C:\Windows\System\UvxQyag.exe
  2⤵
  PID:15500
- C:\Windows\System\PTUrvfF.exe
  C:\Windows\System\PTUrvfF.exe
  2⤵
  PID:15688
- C:\Windows\System\nZLtici.exe
  C:\Windows\System\nZLtici.exe
  2⤵
  PID:15900
- C:\Windows\System\wLIUOcx.exe
  C:\Windows\System\wLIUOcx.exe
  2⤵
  PID:16036
- C:\Windows\System\JkTibLA.exe
  C:\Windows\System\JkTibLA.exe
  2⤵
  PID:16176
- C:\Windows\System\sbaCbLU.exe
  C:\Windows\System\sbaCbLU.exe
  2⤵
  PID:16292
- C:\Windows\System\KHNIIgM.exe
  C:\Windows\System\KHNIIgM.exe
  2⤵
  PID:16364
- C:\Windows\System\xNWqZLB.exe
  C:\Windows\System\xNWqZLB.exe
  2⤵
  PID:15596
- C:\Windows\System\rTvQwYr.exe
  C:\Windows\System\rTvQwYr.exe
  2⤵
  PID:16512
- C:\Windows\System\RARLDkw.exe
  C:\Windows\System\RARLDkw.exe
  2⤵
  PID:16528
- C:\Windows\System\LBYpjsD.exe
  C:\Windows\System\LBYpjsD.exe
  2⤵
  PID:16556
- C:\Windows\System\wkIzVRq.exe
  C:\Windows\System\wkIzVRq.exe
  2⤵
  PID:16612
- C:\Windows\System\eCqyxrK.exe
  C:\Windows\System\eCqyxrK.exe
  2⤵
  PID:16636
- C:\Windows\System\EdXURVJ.exe
  C:\Windows\System\EdXURVJ.exe
  2⤵
  PID:16664
- C:\Windows\System\MrpuaVA.exe
  C:\Windows\System\MrpuaVA.exe
  2⤵
  PID:16684
- C:\Windows\System\NNSECLd.exe
  C:\Windows\System\NNSECLd.exe
  2⤵
  PID:16716
- C:\Windows\System\bKjpZRm.exe
  C:\Windows\System\bKjpZRm.exe
  2⤵
  PID:16748
- C:\Windows\System\qheMmtj.exe
  C:\Windows\System\qheMmtj.exe
  2⤵
  PID:16768
- C:\Windows\System\ggmHfoo.exe
  C:\Windows\System\ggmHfoo.exe
  2⤵
  PID:16804
- C:\Windows\System\yPkSDTP.exe
  C:\Windows\System\yPkSDTP.exe
  2⤵
  PID:16828
- C:\Windows\System\HiNDKzZ.exe
  C:\Windows\System\HiNDKzZ.exe
  2⤵
  PID:16856
- C:\Windows\System\Axmksnb.exe
  C:\Windows\System\Axmksnb.exe
  2⤵
  PID:16880
- C:\Windows\System\qHTTPkZ.exe
  C:\Windows\System\qHTTPkZ.exe
  2⤵
  PID:16900
- C:\Windows\System\cyyHPQi.exe
  C:\Windows\System\cyyHPQi.exe
  2⤵
  PID:16932
- C:\Windows\System\AiFuRqN.exe
  C:\Windows\System\AiFuRqN.exe
  2⤵
  PID:16960
- C:\Windows\System\iGXLDcV.exe
  C:\Windows\System\iGXLDcV.exe
  2⤵
  PID:16984
- C:\Windows\System\lrFLaoh.exe
  C:\Windows\System\lrFLaoh.exe
  2⤵
  PID:17016
- C:\Windows\System\ezQtUxe.exe
  C:\Windows\System\ezQtUxe.exe
  2⤵
  PID:17060
- C:\Windows\System\wxUwvJf.exe
  C:\Windows\System\wxUwvJf.exe
  2⤵
  PID:17088
- C:\Windows\System\lExtydq.exe
  C:\Windows\System\lExtydq.exe
  2⤵
  PID:17104
- C:\Windows\System\VmhJrCh.exe
  C:\Windows\System\VmhJrCh.exe
  2⤵
  PID:17120
- - C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -u -p 17120 -s 248
    3⤵
    PID:17264

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:17396

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\AapqCnb.exe

Filesize
1.4MB

MD5
beab835875329cd1a2fd76ba97182d11

SHA1
62c4ed2c7c8f11b50c1eb6638b3054243f588d1a

SHA256
069e6c4b356a87c806c8d7cdb90cddc9223d1a942823b93184d123606dc89125

SHA512
995c5a227a41e54b89f2619f2af1a73b06ac5fb120f4d615ea1db7c4d3b18e1bd5f41a9c8a8e1be53c3b289533df3303738aeb4a528f7b342ccb0162fc5b7de0

Download Submit
C:\Windows\System\BOSrCEa.exe

Filesize
1.4MB

MD5
2510f8f27d9833ba95e62e6285788c4d

SHA1
efa9d41520f416ad425a0f604a5be36851dd2bd1

SHA256
ebaf7e51ec5b713020b351b97f56f44c2e23720ea8a33464f79fa3d206159981

SHA512
10d634057f02a47f408b24207b10fb628bf1ffdc340138802dea6f4925171a1f0f537682776228afd5b6cb81f1391eb9418aab2aaacdddb058f8a91432d18a6d

Download Submit
C:\Windows\System\BuqePqH.exe

Filesize
1.4MB

MD5
b91a47ee6497e71e14f150a6fe0750c1

SHA1
19796e7b4f468b99059d15fbb863b7757c3ab281

SHA256
bfde54113f2eb92feb3efd011aa29524aa697fed0140dd88d798b50318632df3

SHA512
6fea86c7b3c00ee4b48f73593ed98ba08e8285a91417719dd3716d781b420d2d00df372c9ba23e5feb792eb5c928a92f216f758f7c853f6a1249309cb5ca446d

Download Submit
C:\Windows\System\ETDfsDY.exe

Filesize
1.4MB

MD5
db0a04c743d92ca51b9cc1bec70b2b54

SHA1
006c9bb649231b34cfe5aaca041fc9a360049379

SHA256
950282072fddf5784fd8d07be2d05366dc9e007f29f1197d4965f710c482931f

SHA512
96df4413e432e3269cdc7bbbbd6a85ccbac556d9c33002517050906dcd8bb8f915567d326ad04f13e521888700d008f6624509e03a6c81c6c11dcac1e6b8d790

Download Submit
C:\Windows\System\Fgsgazw.exe

Filesize
1.4MB

MD5
465d51deca51a640f17766e968f7854c

SHA1
60334f6413b8a5c2a8b838619f353d115982ea2f

SHA256
10d13c7564c7e5e0ff223420ffeb8e6f95e7b0fe6e4142d2952e50d8805121a3

SHA512
09b7c769030bbb0e4d00e568913cdc94ca342231b07279d7abf15b740dec3a60752bf3a9cef226eb7992e0992fd1ecf6b57380661f227fbb0d7209b7705b887e

Download Submit
C:\Windows\System\HmKKqYE.exe

Filesize
1.4MB

MD5
8e2a82b85bfc56fa3ccff4925423f656

SHA1
0cbb031186b7511154be2ba78472b197eed3b112

SHA256
a181145cbb895f571636bfa9e0dd85f79cbf063ff965cc47e462f31c300bc1ac

SHA512
472a60ed9ce30e738f2bbb8c81c857b1d33340f7565066bbd82e009d3ded0f238c9c85a29f42797a51a6f1e2d28a653e65e7c22308bb51b3c87e4dc01bff3c37

Download Submit
C:\Windows\System\MILdMvW.exe

Filesize
1.4MB

MD5
8b8e7d3369e204bde77e5d8ee503daea

SHA1
2c5909ff38c03e37ea5e3ac8d49a36e3b8175574

SHA256
22828fb0e213331c87083bb30c25b82c1cf74858b2f9b899bb9a4dedaf82b34c

SHA512
a129c0381d2f15762df79d44ffda0ac4eedfb98f441487cbb1cdb505e43355809976ac5b7644c308895a9c7f4164574fd4e0b5a5545c633ca26fa0187159f0e2

Download Submit
C:\Windows\System\NFaBmAk.exe

Filesize
1.4MB

MD5
3b734643557bf81546ad8ec126232fc2

SHA1
1f25d8d44bf79a2d84464b03885c100ddfa766b0

SHA256
7d1104125b59c278c44f14b6ab7d578342ced948d48eb7b017670a2f8be42105

SHA512
2d509395bb68377b93a68923eb58b87ef81f3795533ad069a92350f67f6974818941cf6a787940d7e4482e58ef1e6ee3e8593dac66fc01ea051f3c0052abeb11

Download Submit
C:\Windows\System\PGZrREu.exe

Filesize
1.4MB

MD5
0a10ef3fd79c73683f8ae028294fe917

SHA1
5fcfb6f0eb4b545556d0aba289412c2d72f9566a

SHA256
d588045258fdb29a7d13293b4c2e2a09127fbe8ccfff584d560dce4939d311ec

SHA512
b3250c983ab53b829d7382723624233f89c75b2ef93175cbb05177117094848edad375a82d81bf5eecf3f1fc4448f03fbfda0e49d4c81b617c4a2ef28e0824a9

Download Submit
C:\Windows\System\ShOfpGF.exe

Filesize
1.4MB

MD5
000bab2c114102ba5c45d1aad36c0a0a

SHA1
01eb1f763f59c31301e346a8af3ad73b0906a724

SHA256
214a91d32cea547526b80178b9f8374423763fd61c3b84ca80a723c6f4923f3f

SHA512
b53c63b3c4ada8c59495003970895fce8c26d76278df7236d8af7932e03701e92d1998d2c7895d9a848d33712be44810c463202f7ffcaaba4b58f658681d8cd0

Download Submit
C:\Windows\System\TmTHwsH.exe

Filesize
1.4MB

MD5
51f026265b62bc452bf39036c90145d8

SHA1
a76a4c18ad22eb9e91d3e660564e2bb695af1fea

SHA256
89d8115a40038e491cde4a84e7950f641a874d330ac22fdd51fd363dcaccb548

SHA512
2bb3c4dcb2e2a4291b1997bcd1ae22c02a861b373ebe9beaabf455f3efe091b74ea98619e8ebd5986d1ea6c83a86e0a021d33d7d55cb49ff33c7f43a8558e243

Download Submit
C:\Windows\System\YAdoCsx.exe

Filesize
1.4MB

MD5
09c28d7859d0b319bbaa703f0cd727ff

SHA1
91e21c954e130777b91fa0a876cbc02ebf748824

SHA256
cadbb0664cf23e6808f2895069d5532904c811cbd589769826f6172a721400f5

SHA512
57e0a848de678fc1e97257155b1a77c9bd24c022588105d9d5bc22a05b92d03cce9f4018a6876bbdd0c1c2b8a1031724280b0333d8328f13133a1fde62be5ac3

Download Submit
C:\Windows\System\YbEbzlP.exe

Filesize
1.4MB

MD5
4150d82c7fa739c2f0b36560f5ce1f5d

SHA1
7df4565a0814780c314368000b8370ae7e1ee8bb

SHA256
af8ab84b81f31d2819ab2a1453b4e6a1ac69357ccf2d65b28a9c2b8a712d383d

SHA512
9bb617af52a6ecc165bba5ad34cdb586012220164bfcfb38d918564b463a9f6c9753e22d81f330719756c72af652efa440f34034fe02519f835a32689333cf16

Download Submit
C:\Windows\System\ZznWjsB.exe

Filesize
1.4MB

MD5
5d65949f31b9e54580c5fcc9051a57ff

SHA1
4a92d0e38171fed529a5eb45b6e267e54a195fcf

SHA256
41138d1e04a0f3c8ce88bbcfbfdeb41f7fa70789e850109efd0080be76970715

SHA512
f8b47b058471c700ea99a90583cf6741e27ebef4ece87fdad536c1c5cb4fb476d989189440d14564b7902d3aa55bae9f0fd6ee5f1188fd283801793d1df3c747

Download Submit
C:\Windows\System\bxHNGIc.exe

Filesize
1.4MB

MD5
9344640c5863321bd9283986c563b459

SHA1
ec3bc19dcb513b7d591bf11b982253041a42cb66

SHA256
8d111ac7077d56f19a222e84bd6c4ccb9c9fff3396f6b9d6f00372d4b1ca4c94

SHA512
42836f72417985ad48501462500026a311f899de6c86c53d26be3d6488a315a0516143593baf42286e92d2cdb76f33dc426463f94babc4a28f396d18c92483ad

Download Submit
C:\Windows\System\eGIRERP.exe

Filesize
1.4MB

MD5
2b9ab237e10753e87f2e08ed58bfefca

SHA1
0f9884496189d5f9fbb891337edff59fbf8acb09

SHA256
16d29cf220ce983c72308c35d288b7035bd5d39431046dc67fecab10a11c6e53

SHA512
05fabf06dd7df92b7026253eca6f4badf47e1325799abe092db64546fafa69e144387d032065cdef344ec843ff74fd5e9ee73c23bf5a0e9830e4b42d384aa8b8

Download Submit
C:\Windows\System\efYSWAQ.exe

Filesize
1.4MB

MD5
452a20300036ab41a53b707f5258fb1a

SHA1
59777880c8d1f331fd79ff2b5c1ca7c61c79c6ab

SHA256
f4c0ce47606e8eea5ec2f25f9c4ffe8c60b788d966473d4f7bda1db8d8b616f6

SHA512
69555e3f9bd3ae35fc7f3e4908ff0b2eaf5db8f112ac194f9dd1929cdb53e7fc4b28777d307f0d27fec1b596aa207c0a1e49c5d7953b2622e129f12b849cd839

Download Submit
C:\Windows\System\fLAfceb.exe

Filesize
1.4MB

MD5
1928f483956b31ad897b9299b11011d3

SHA1
6eba65a130b9b4b1c481697c01e273858a0199fa

SHA256
460b7f9a5a03f2d6a45d45c768040218e0e9464eaddda0c166dcb5bc7267d19e

SHA512
45450270300a65cf448030c21af4492542beb90ae8ee96f1ab4e736c3f0f2d163ad33b4547a46ebb32075ceb9f575d63df05284a73373b85dec0aeb794054695

Download Submit
C:\Windows\System\kpiVxvk.exe

Filesize
1.4MB

MD5
adaa4e39cbd058b06307d2e4de6d2fc7

SHA1
6a85651365c6bb60678ae4ce03635d42fb497201

SHA256
fa87662df1a07e8d0db53e3505a4a360a940691557bf0c75ec020ffa71f5fb13

SHA512
e4451b4885862d1399a2dfaa2a9d9e4b7420f2e5b8a9498ff32ea456abf3442ee808d24655674c7d331807e1e3e7eb43dc4c550a8dcb5cc6083b30a46e556f6a

Download Submit
C:\Windows\System\lbiSCNu.exe

Filesize
1.4MB

MD5
3b032b514243d00001e42a2e7ad310dc

SHA1
9bf195098fdf69754123c1598b6f8dc44d4e036d

SHA256
e15f1c82c18ea87acbcbf0947e22b0a227132a82a87f7c01c2fac159ac15013d

SHA512
fd8eed31a0060cbd0c4f0230e45b9c0de81c72b4a1dfd8c52e1c4088f66c08a00c74aba8385d6c262f73f2657623bd04a3a7e03710b57ae30512549fc4f7e3b4

Download Submit
C:\Windows\System\lzGzLZv.exe

Filesize
1.4MB

MD5
5562ea9e2c6a07b05fc6db0274997294

SHA1
72235d4ded128312571f9c8523ed872c41a01e16

SHA256
8c5f9a5a5c9cbe8c5067a13e29ce43695da372c547d6ebca3093bb586a6276ff

SHA512
8eb1131374d6a715c473b85587c3f980b56b1391cec26daffb67d427cc01efe9d214d8907e04567046563207b8185e1227db0d4a4178e3bafe3e7b86cb379be9

Download Submit
C:\Windows\System\mBwRmqa.exe

Filesize
1.4MB

MD5
e9eb143be493534852685435133bde99

SHA1
4c839b943d36abbe6801d60ba280b33ce85ec382

SHA256
46dc51fbd4cb2be3fee8910a04acb23dbc04cd7ee26d8dd32c8456498a33bb71

SHA512
9e0ad0b825b72d6bb0ef18c6c6f2ae9b9117a5f51f0402d5aa4014252b6458f7a2509243082b54b3969bf2ae6d7060d79ad3d82a04c5b9c0cb67ed0c183d6883

Download Submit
C:\Windows\System\qFUtYRB.exe

Filesize
1.4MB

MD5
9a407e5d96ccb1b6a5129e8bef112176

SHA1
f4c949bbdbd9953a6091252a377a8369a2728c7e

SHA256
2b989e342d182c1376179e59af4e1f6df5a63c7ce4b31e01a47cf36160216a10

SHA512
cf4141a0be12ce175fb627a8b967d7336b6ee96d912e12982208b8c1e2ba7baa20872583a0eec57d85018d97ca039633d4231141a46182e770abc7acb1c01958

Download Submit
C:\Windows\System\qgeDcAD.exe

Filesize
1.4MB

MD5
01057856fe999f5a84fd0de77386951b

SHA1
a4994ae73fabd5b34c63bc6a458490460373ae56

SHA256
49e99897c386c8122eba6e7e2bb00afc5f700eb78a7553a93977f4f77638fabc

SHA512
c799bc44c53935fc1366aec84ae58e3fd3d19cd0968a1f359bdece845180a1b452915780cce36d80b72d1c4a799edc9aa7b9a1cbcf0787077523317573334ebb

Download Submit
C:\Windows\System\qzKefwQ.exe

Filesize
1.4MB

MD5
a185b7ac102fce2317cce7597f67bb1d

SHA1
0f31f95832bbcb7455b70fee27f605e79ff649ff

SHA256
b5140f2a3123bd0b8775a42f72a21f8047eda82fc86dd82b98a6c403c4894fd1

SHA512
e4084e9a4cccf55c3cc3c5de8314a4d8a57457cf215e8810cea848fcb37ef2df173b621f871b75ae8747fec2040d51521661679ddc2a71cf888cf72964e3e85c

Download Submit
C:\Windows\System\rYjZwlE.exe

Filesize
1.4MB

MD5
154adc377aac48157deab2762f9d8781

SHA1
6745f94346ca07ef4cf744c73e9bbd3a866cd32f

SHA256
22cb57a58b1934fd0aa47ee983c971e3e7fdea435ba96caf0edb91fd289cdfc6

SHA512
6fba7ede46062ba7715ad356d6c7f483718cca62c6afccc9f784ca65f168d2d98448ad9f260e1d69ab974f02450b42c87685df41a77bb92d5439f45c90a390f6

Download Submit
C:\Windows\System\uINYUYK.exe

Filesize
1.4MB

MD5
0342974d20fed0635e28e2aa35052444

SHA1
8fc103767274fa3490804292207572c06c18bf92

SHA256
9fa8ca0beccc521a8e34787637172999b1c598ee8aa85f2ec496eeed5d0e80ac

SHA512
c7f98ce4a8e6f09de2fb3d8e6ab45b321929e4fad29f75c018f253fb10d188d4ce72786fe4689d8d2cfe4dfaabcf1870510c4ae7318b5ad3cbe49eeda013484a

Download Submit
C:\Windows\System\vEdqATn.exe

Filesize
1.4MB

MD5
327d6ed5515c96be10d010c950d25ec2

SHA1
f8e3933795924d5a29a1a8fdc77e4945200d733d

SHA256
5973fbf93add0ead1d72bfcacff79051b445afaa4b96bde11ef10ac1f96217b6

SHA512
837a66683538718419e7040f39c8aad809bc915995c72e8424b2ee0ed4873150b39a8a580d0aef981f864b9fd83213ca2d3f437d9d44ae26ba894488b92b9aa7

Download Submit
C:\Windows\System\vHUIqFK.exe

Filesize
1.4MB

MD5
cc37f3ba5704b3ea21a9964ab1c99f5e

SHA1
8dc243b2ed2c012b327fa55e03ee385cab227048

SHA256
4a5daa82e60acdad7a6357ac15f1f7e35d1c58ef2638acd772d14a18df05e3ae

SHA512
20cecbc5708c0cce10481ade775ca29084b52269778e15094c1d9b94ba6784627007835957cca7e01bfac698cddead0a53014e42dcede8b96e6b19850abc6e1a

Download Submit
C:\Windows\System\yTAirYO.exe

Filesize
1.4MB

MD5
1c07a2d14528e71082674eaedf2caef3

SHA1
bb700f9cace9d21d1153f1cdec833c6c1204c09a

SHA256
31e2b1a0dc605ff974c34055202f87945a330f72406041028bcf4bef5a144257

SHA512
f2cf756de877dc22cd16cf7642aab4b64b106cc17ed3311b69dd7d172ef27fbcc4b76884d3849af0305682590054df88b6b8c334f89e96b964c566f7f4a481dc

Download Submit
C:\Windows\System\yhbvsxa.exe

Filesize
1.4MB

MD5
f7c5ef2da5c1fa7a329ba420aab945bc

SHA1
424ff7ce659f196aeea5a433302236025e634793

SHA256
84213c5a80b13550ff2fd70e60ac910432c5f1825737b4662fe3b3ed57a1c4b4

SHA512
08592cd4d9b694ba864c0d77f95a3e1780185e6f937dc1aaa6a309f3638d8ab129362a3aa56cca233bec6fa83493558e55402857db63182077dd070482bff2f2

Download Submit
C:\Windows\System\zMtDnWa.exe

Filesize
1.4MB

MD5
9dd62fe058f1a87f09fca4382d5323ad

SHA1
33cce051931556a9b1b78d5b1dd1b3108c43b804

SHA256
c51c673420213b44227d63e95a532b980c34969392bba9b5a10e8de20b269e9a

SHA512
aab1d713510820e8716a1aaad99e19c4d847e8c2fad331b514dea1d3d974226c5bab846e7ea397c93fe574b05419f5f430fbbb8aa47fcec4a18af06b971df851

Download Submit
C:\Windows\System\zTclMdy.exe

Filesize
1.4MB

MD5
f1d14203bb263928da0085d79a7d2419

SHA1
da84b84f2946f446c8107994325037b382014fb2

SHA256
d88962b74eab47df276ad2495fdeb28817bf122fb70d54502c368ace6c32e035

SHA512
53c3567a8c08a0ce9c92e4487c1767a1c9b2ea5dd9b6600c44a04413b9960e6b1013d762894114cdfac1f7f5d9ae559c028243831e1bfe0dbc19cb8d8827b091

Download Submit
memory/2600-0-0x000002634B3F0000-0x000002634B400000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads