xmrig | 55627c375fa2e3695d0ed6293e55f0bcae0539e279e944ee151c9b53968a4f78

Analysis

max time kernel
134s
max time network
136s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
14/11/2024, 22:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

55627c375fa2e3695d0ed6293e55f0bcae0539e279e944ee151c9b53968a4f78.exe
Size

1.5MB
MD5

e3859045dbc11faa37f03ff61db38faf
SHA1

4c897a289090301ee27f860034527efb67cf67b0
SHA256

55627c375fa2e3695d0ed6293e55f0bcae0539e279e944ee151c9b53968a4f78
SHA512

71aceb02c6d3b017a150691323e68bfb3ce339f97a3b8b07ccecc142b4b25ec5d6e5f72baa37734f52fc8c24ab3e810d38086d2cefbaaab391638bece1557354
SSDEEP

24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbpwlKenszbWKDNEm/5O+7MMKTbcb:GezaTF8FcNkNdfE0pZ9ozttwIRxj4c5t

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 36 IoCs

miner

resource	yara_rule
behavioral2/files/0x000e000000023b26-4.dat	xmrig
behavioral2/files/0x000a000000023b31-9.dat	xmrig
behavioral2/files/0x000a000000023b33-14.dat	xmrig
behavioral2/files/0x000a000000023b36-27.dat	xmrig
behavioral2/files/0x000a000000023b37-39.dat	xmrig
behavioral2/files/0x000a000000023b39-50.dat	xmrig
behavioral2/files/0x000a000000023b38-46.dat	xmrig
behavioral2/files/0x000a000000023b35-42.dat	xmrig
behavioral2/files/0x000a000000023b34-30.dat	xmrig
behavioral2/files/0x000a000000023b32-16.dat	xmrig
behavioral2/files/0x000a000000023b3a-54.dat	xmrig
behavioral2/files/0x000d000000023b2e-60.dat	xmrig
behavioral2/files/0x000a000000023b3c-68.dat	xmrig
behavioral2/files/0x000a000000023b3b-67.dat	xmrig
behavioral2/files/0x000a000000023b3e-79.dat	xmrig
behavioral2/files/0x000a000000023b3d-75.dat	xmrig
behavioral2/files/0x000a000000023b46-105.dat	xmrig
behavioral2/files/0x000a000000023b49-114.dat	xmrig
behavioral2/files/0x000a000000023b4f-163.dat	xmrig
behavioral2/files/0x000a000000023b54-176.dat	xmrig
behavioral2/files/0x000a000000023b53-175.dat	xmrig
behavioral2/files/0x000a000000023b52-172.dat	xmrig
behavioral2/files/0x000a000000023b51-169.dat	xmrig
behavioral2/files/0x000a000000023b50-166.dat	xmrig
behavioral2/files/0x000a000000023b4a-158.dat	xmrig
behavioral2/files/0x000a000000023b48-156.dat	xmrig
behavioral2/files/0x000a000000023b45-150.dat	xmrig
behavioral2/files/0x000a000000023b44-148.dat	xmrig
behavioral2/files/0x000a000000023b43-146.dat	xmrig
behavioral2/files/0x000a000000023b42-143.dat	xmrig
behavioral2/files/0x000a000000023b41-139.dat	xmrig
behavioral2/files/0x000a000000023b4d-136.dat	xmrig
behavioral2/files/0x000a000000023b4c-132.dat	xmrig
behavioral2/files/0x000a000000023b4b-118.dat	xmrig
behavioral2/files/0x000a000000023b47-110.dat	xmrig
behavioral2/files/0x000a000000023b3f-85.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
4812	SBngScE.exe
3980	XhQVebw.exe
3764	NPXDHxn.exe
2376	QJFGDyf.exe
3548	JWwaxzL.exe
3280	qxDnIjz.exe
2576	xyBBHDZ.exe
2632	uiokKII.exe
2412	OEHZobL.exe
844	GmzsNBt.exe
2036	DvzoRPF.exe
3328	HorSGKi.exe
1664	HkaoShb.exe
2272	ZbHfPGM.exe
3560	ZyPFsth.exe
704	WAoICoc.exe
4468	pWPzBye.exe
1144	nYSzqmX.exe
436	JtoBReH.exe
5096	vmEpZjz.exe
2152	NlNpTxM.exe
2228	lTWksCh.exe
1504	wzkDtNJ.exe
3728	JtzOhXc.exe
2608	OfUuwpy.exe
2724	EBZnvkw.exe
4908	iYDWFJm.exe
228	uLoMjdt.exe
3752	jJOOnSc.exe
4656	EQUdYrH.exe
4524	YjJTgON.exe
2932	ITsTaSe.exe
2856	ePYuVPx.exe
5084	XndzFHO.exe
2804	JgfLBmv.exe
660	PQzXLLg.exe
1748	qUZYrTz.exe
2920	YzUjgBx.exe
3908	IQkhddV.exe
4716	URChcmM.exe
4056	GIiheNJ.exe
2304	ITpcUCb.exe
740	nVgCKLR.exe
4164	yBstTSG.exe
2232	jnvToKp.exe
3696	pFFeJUK.exe
3504	tcFdDmG.exe
4984	jsdHUrJ.exe
3080	IqXeLVD.exe
1508	NoQWEdi.exe
3168	DUlPGvB.exe
4532	uTWazmK.exe
4828	JPutPou.exe
1348	uknVBwM.exe
2204	oYeOIrU.exe
1576	MmRxkbq.exe
2692	zRoRUpo.exe
2100	oClazDU.exe
1404	cjFRBOp.exe
4536	VqeDFoV.exe
4564	VNFfopE.exe
1160	BPuycik.exe
2844	kIxpbBR.exe
2044	uKQkkIr.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\XKugvlr.exe	55627c375fa2e3695d0ed6293e55f0bcae0539e279e944ee151c9b53968a4f78.exe
File created	C:\Windows\System\OFxmFYu.exe	55627c375fa2e3695d0ed6293e55f0bcae0539e279e944ee151c9b53968a4f78.exe
File created	C:\Windows\System\XHbKdpr.exe	55627c375fa2e3695d0ed6293e55f0bcae0539e279e944ee151c9b53968a4f78.exe
File created	C:\Windows\System\hpJMNdV.exe	55627c375fa2e3695d0ed6293e55f0bcae0539e279e944ee151c9b53968a4f78.exe
File created	C:\Windows\System\ZxyBXaX.exe	55627c375fa2e3695d0ed6293e55f0bcae0539e279e944ee151c9b53968a4f78.exe
File created	C:\Windows\System\TfUksCR.exe	55627c375fa2e3695d0ed6293e55f0bcae0539e279e944ee151c9b53968a4f78.exe
File created	C:\Windows\System\vHQVitE.exe	55627c375fa2e3695d0ed6293e55f0bcae0539e279e944ee151c9b53968a4f78.exe
File created	C:\Windows\System\KAdEESp.exe	55627c375fa2e3695d0ed6293e55f0bcae0539e279e944ee151c9b53968a4f78.exe
File created	C:\Windows\System\cLbhVGa.exe	55627c375fa2e3695d0ed6293e55f0bcae0539e279e944ee151c9b53968a4f78.exe
File created	C:\Windows\System\LbMKXyo.exe	55627c375fa2e3695d0ed6293e55f0bcae0539e279e944ee151c9b53968a4f78.exe
File created	C:\Windows\System\NxDyMbe.exe	55627c375fa2e3695d0ed6293e55f0bcae0539e279e944ee151c9b53968a4f78.exe
File created	C:\Windows\System\sLQIhZB.exe	55627c375fa2e3695d0ed6293e55f0bcae0539e279e944ee151c9b53968a4f78.exe
File created	C:\Windows\System\jOayuvE.exe	55627c375fa2e3695d0ed6293e55f0bcae0539e279e944ee151c9b53968a4f78.exe
File created	C:\Windows\System\tRacogH.exe	55627c375fa2e3695d0ed6293e55f0bcae0539e279e944ee151c9b53968a4f78.exe
File created	C:\Windows\System\GYWwBSq.exe	55627c375fa2e3695d0ed6293e55f0bcae0539e279e944ee151c9b53968a4f78.exe
File created	C:\Windows\System\sxHFHQZ.exe	55627c375fa2e3695d0ed6293e55f0bcae0539e279e944ee151c9b53968a4f78.exe
File created	C:\Windows\System\UOrPHUq.exe	55627c375fa2e3695d0ed6293e55f0bcae0539e279e944ee151c9b53968a4f78.exe
File created	C:\Windows\System\YjJTgON.exe	55627c375fa2e3695d0ed6293e55f0bcae0539e279e944ee151c9b53968a4f78.exe
File created	C:\Windows\System\cdLhCqb.exe	55627c375fa2e3695d0ed6293e55f0bcae0539e279e944ee151c9b53968a4f78.exe
File created	C:\Windows\System\kBJnRSp.exe	55627c375fa2e3695d0ed6293e55f0bcae0539e279e944ee151c9b53968a4f78.exe
File created	C:\Windows\System\RZbqAcM.exe	55627c375fa2e3695d0ed6293e55f0bcae0539e279e944ee151c9b53968a4f78.exe
File created	C:\Windows\System\UOokOBZ.exe	55627c375fa2e3695d0ed6293e55f0bcae0539e279e944ee151c9b53968a4f78.exe
File created	C:\Windows\System\gjInCdy.exe	55627c375fa2e3695d0ed6293e55f0bcae0539e279e944ee151c9b53968a4f78.exe
File created	C:\Windows\System\GqsVjoe.exe	55627c375fa2e3695d0ed6293e55f0bcae0539e279e944ee151c9b53968a4f78.exe
File created	C:\Windows\System\DumbXiY.exe	55627c375fa2e3695d0ed6293e55f0bcae0539e279e944ee151c9b53968a4f78.exe
File created	C:\Windows\System\IQwnBhH.exe	55627c375fa2e3695d0ed6293e55f0bcae0539e279e944ee151c9b53968a4f78.exe
File created	C:\Windows\System\GsWkkOu.exe	55627c375fa2e3695d0ed6293e55f0bcae0539e279e944ee151c9b53968a4f78.exe
File created	C:\Windows\System\kZUXQLS.exe	55627c375fa2e3695d0ed6293e55f0bcae0539e279e944ee151c9b53968a4f78.exe
File created	C:\Windows\System\ZHcqnYC.exe	55627c375fa2e3695d0ed6293e55f0bcae0539e279e944ee151c9b53968a4f78.exe
File created	C:\Windows\System\EuWSVFF.exe	55627c375fa2e3695d0ed6293e55f0bcae0539e279e944ee151c9b53968a4f78.exe
File created	C:\Windows\System\SQoTbSS.exe	55627c375fa2e3695d0ed6293e55f0bcae0539e279e944ee151c9b53968a4f78.exe
File created	C:\Windows\System\rQZuwTp.exe	55627c375fa2e3695d0ed6293e55f0bcae0539e279e944ee151c9b53968a4f78.exe
File created	C:\Windows\System\pJnAvSB.exe	55627c375fa2e3695d0ed6293e55f0bcae0539e279e944ee151c9b53968a4f78.exe
File created	C:\Windows\System\ancVMsF.exe	55627c375fa2e3695d0ed6293e55f0bcae0539e279e944ee151c9b53968a4f78.exe
File created	C:\Windows\System\huRpoMr.exe	55627c375fa2e3695d0ed6293e55f0bcae0539e279e944ee151c9b53968a4f78.exe
File created	C:\Windows\System\iEUjfOW.exe	55627c375fa2e3695d0ed6293e55f0bcae0539e279e944ee151c9b53968a4f78.exe
File created	C:\Windows\System\XZFFoXg.exe	55627c375fa2e3695d0ed6293e55f0bcae0539e279e944ee151c9b53968a4f78.exe
File created	C:\Windows\System\UrwmrfZ.exe	55627c375fa2e3695d0ed6293e55f0bcae0539e279e944ee151c9b53968a4f78.exe
File created	C:\Windows\System\LNYBCUr.exe	55627c375fa2e3695d0ed6293e55f0bcae0539e279e944ee151c9b53968a4f78.exe
File created	C:\Windows\System\zVViZVG.exe	55627c375fa2e3695d0ed6293e55f0bcae0539e279e944ee151c9b53968a4f78.exe
File created	C:\Windows\System\QAtclEx.exe	55627c375fa2e3695d0ed6293e55f0bcae0539e279e944ee151c9b53968a4f78.exe
File created	C:\Windows\System\ixfiBYr.exe	55627c375fa2e3695d0ed6293e55f0bcae0539e279e944ee151c9b53968a4f78.exe
File created	C:\Windows\System\AKCSiYt.exe	55627c375fa2e3695d0ed6293e55f0bcae0539e279e944ee151c9b53968a4f78.exe
File created	C:\Windows\System\RTtifVL.exe	55627c375fa2e3695d0ed6293e55f0bcae0539e279e944ee151c9b53968a4f78.exe
File created	C:\Windows\System\bawZfxt.exe	55627c375fa2e3695d0ed6293e55f0bcae0539e279e944ee151c9b53968a4f78.exe
File created	C:\Windows\System\AHEsDhR.exe	55627c375fa2e3695d0ed6293e55f0bcae0539e279e944ee151c9b53968a4f78.exe
File created	C:\Windows\System\mAuiNyG.exe	55627c375fa2e3695d0ed6293e55f0bcae0539e279e944ee151c9b53968a4f78.exe
File created	C:\Windows\System\RbKuitS.exe	55627c375fa2e3695d0ed6293e55f0bcae0539e279e944ee151c9b53968a4f78.exe
File created	C:\Windows\System\IQCkNXW.exe	55627c375fa2e3695d0ed6293e55f0bcae0539e279e944ee151c9b53968a4f78.exe
File created	C:\Windows\System\TBZtuUW.exe	55627c375fa2e3695d0ed6293e55f0bcae0539e279e944ee151c9b53968a4f78.exe
File created	C:\Windows\System\mueOkAg.exe	55627c375fa2e3695d0ed6293e55f0bcae0539e279e944ee151c9b53968a4f78.exe
File created	C:\Windows\System\xdlShUs.exe	55627c375fa2e3695d0ed6293e55f0bcae0539e279e944ee151c9b53968a4f78.exe
File created	C:\Windows\System\ALprwto.exe	55627c375fa2e3695d0ed6293e55f0bcae0539e279e944ee151c9b53968a4f78.exe
File created	C:\Windows\System\bOQHUZU.exe	55627c375fa2e3695d0ed6293e55f0bcae0539e279e944ee151c9b53968a4f78.exe
File created	C:\Windows\System\pqKPxqJ.exe	55627c375fa2e3695d0ed6293e55f0bcae0539e279e944ee151c9b53968a4f78.exe
File created	C:\Windows\System\SnaHerI.exe	55627c375fa2e3695d0ed6293e55f0bcae0539e279e944ee151c9b53968a4f78.exe
File created	C:\Windows\System\MzPFYHU.exe	55627c375fa2e3695d0ed6293e55f0bcae0539e279e944ee151c9b53968a4f78.exe
File created	C:\Windows\System\XcTjyve.exe	55627c375fa2e3695d0ed6293e55f0bcae0539e279e944ee151c9b53968a4f78.exe
File created	C:\Windows\System\tcFdDmG.exe	55627c375fa2e3695d0ed6293e55f0bcae0539e279e944ee151c9b53968a4f78.exe
File created	C:\Windows\System\JPutPou.exe	55627c375fa2e3695d0ed6293e55f0bcae0539e279e944ee151c9b53968a4f78.exe
File created	C:\Windows\System\gAKxKUq.exe	55627c375fa2e3695d0ed6293e55f0bcae0539e279e944ee151c9b53968a4f78.exe
File created	C:\Windows\System\XGkhoLn.exe	55627c375fa2e3695d0ed6293e55f0bcae0539e279e944ee151c9b53968a4f78.exe
File created	C:\Windows\System\UzIxAtP.exe	55627c375fa2e3695d0ed6293e55f0bcae0539e279e944ee151c9b53968a4f78.exe
File created	C:\Windows\System\PBjRyWF.exe	55627c375fa2e3695d0ed6293e55f0bcae0539e279e944ee151c9b53968a4f78.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	15184	dwm.exe
Token: SeChangeNotifyPrivilege	15184	dwm.exe
Token: 33	15184	dwm.exe
Token: SeIncBasePriorityPrivilege	15184	dwm.exe
Token: SeShutdownPrivilege	15184	dwm.exe
Token: SeCreatePagefilePrivilege	15184	dwm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3088 wrote to memory of 4812	3088	55627c375fa2e3695d0ed6293e55f0bcae0539e279e944ee151c9b53968a4f78.exe	84
PID 3088 wrote to memory of 4812	3088	55627c375fa2e3695d0ed6293e55f0bcae0539e279e944ee151c9b53968a4f78.exe	84
PID 3088 wrote to memory of 3980	3088	55627c375fa2e3695d0ed6293e55f0bcae0539e279e944ee151c9b53968a4f78.exe	85
PID 3088 wrote to memory of 3980	3088	55627c375fa2e3695d0ed6293e55f0bcae0539e279e944ee151c9b53968a4f78.exe	85
PID 3088 wrote to memory of 3764	3088	55627c375fa2e3695d0ed6293e55f0bcae0539e279e944ee151c9b53968a4f78.exe	86
PID 3088 wrote to memory of 3764	3088	55627c375fa2e3695d0ed6293e55f0bcae0539e279e944ee151c9b53968a4f78.exe	86
PID 3088 wrote to memory of 2376	3088	55627c375fa2e3695d0ed6293e55f0bcae0539e279e944ee151c9b53968a4f78.exe	87
PID 3088 wrote to memory of 2376	3088	55627c375fa2e3695d0ed6293e55f0bcae0539e279e944ee151c9b53968a4f78.exe	87
PID 3088 wrote to memory of 3548	3088	55627c375fa2e3695d0ed6293e55f0bcae0539e279e944ee151c9b53968a4f78.exe	88
PID 3088 wrote to memory of 3548	3088	55627c375fa2e3695d0ed6293e55f0bcae0539e279e944ee151c9b53968a4f78.exe	88
PID 3088 wrote to memory of 3280	3088	55627c375fa2e3695d0ed6293e55f0bcae0539e279e944ee151c9b53968a4f78.exe	89
PID 3088 wrote to memory of 3280	3088	55627c375fa2e3695d0ed6293e55f0bcae0539e279e944ee151c9b53968a4f78.exe	89
PID 3088 wrote to memory of 2576	3088	55627c375fa2e3695d0ed6293e55f0bcae0539e279e944ee151c9b53968a4f78.exe	90
PID 3088 wrote to memory of 2576	3088	55627c375fa2e3695d0ed6293e55f0bcae0539e279e944ee151c9b53968a4f78.exe	90
PID 3088 wrote to memory of 2632	3088	55627c375fa2e3695d0ed6293e55f0bcae0539e279e944ee151c9b53968a4f78.exe	91
PID 3088 wrote to memory of 2632	3088	55627c375fa2e3695d0ed6293e55f0bcae0539e279e944ee151c9b53968a4f78.exe	91
PID 3088 wrote to memory of 2412	3088	55627c375fa2e3695d0ed6293e55f0bcae0539e279e944ee151c9b53968a4f78.exe	92
PID 3088 wrote to memory of 2412	3088	55627c375fa2e3695d0ed6293e55f0bcae0539e279e944ee151c9b53968a4f78.exe	92
PID 3088 wrote to memory of 844	3088	55627c375fa2e3695d0ed6293e55f0bcae0539e279e944ee151c9b53968a4f78.exe	93
PID 3088 wrote to memory of 844	3088	55627c375fa2e3695d0ed6293e55f0bcae0539e279e944ee151c9b53968a4f78.exe	93
PID 3088 wrote to memory of 2036	3088	55627c375fa2e3695d0ed6293e55f0bcae0539e279e944ee151c9b53968a4f78.exe	94
PID 3088 wrote to memory of 2036	3088	55627c375fa2e3695d0ed6293e55f0bcae0539e279e944ee151c9b53968a4f78.exe	94
PID 3088 wrote to memory of 3328	3088	55627c375fa2e3695d0ed6293e55f0bcae0539e279e944ee151c9b53968a4f78.exe	95
PID 3088 wrote to memory of 3328	3088	55627c375fa2e3695d0ed6293e55f0bcae0539e279e944ee151c9b53968a4f78.exe	95
PID 3088 wrote to memory of 1664	3088	55627c375fa2e3695d0ed6293e55f0bcae0539e279e944ee151c9b53968a4f78.exe	96
PID 3088 wrote to memory of 1664	3088	55627c375fa2e3695d0ed6293e55f0bcae0539e279e944ee151c9b53968a4f78.exe	96
PID 3088 wrote to memory of 2272	3088	55627c375fa2e3695d0ed6293e55f0bcae0539e279e944ee151c9b53968a4f78.exe	97
PID 3088 wrote to memory of 2272	3088	55627c375fa2e3695d0ed6293e55f0bcae0539e279e944ee151c9b53968a4f78.exe	97
PID 3088 wrote to memory of 3560	3088	55627c375fa2e3695d0ed6293e55f0bcae0539e279e944ee151c9b53968a4f78.exe	98
PID 3088 wrote to memory of 3560	3088	55627c375fa2e3695d0ed6293e55f0bcae0539e279e944ee151c9b53968a4f78.exe	98
PID 3088 wrote to memory of 704	3088	55627c375fa2e3695d0ed6293e55f0bcae0539e279e944ee151c9b53968a4f78.exe	99
PID 3088 wrote to memory of 704	3088	55627c375fa2e3695d0ed6293e55f0bcae0539e279e944ee151c9b53968a4f78.exe	99
PID 3088 wrote to memory of 4468	3088	55627c375fa2e3695d0ed6293e55f0bcae0539e279e944ee151c9b53968a4f78.exe	101
PID 3088 wrote to memory of 4468	3088	55627c375fa2e3695d0ed6293e55f0bcae0539e279e944ee151c9b53968a4f78.exe	101
PID 3088 wrote to memory of 1144	3088	55627c375fa2e3695d0ed6293e55f0bcae0539e279e944ee151c9b53968a4f78.exe	102
PID 3088 wrote to memory of 1144	3088	55627c375fa2e3695d0ed6293e55f0bcae0539e279e944ee151c9b53968a4f78.exe	102
PID 3088 wrote to memory of 436	3088	55627c375fa2e3695d0ed6293e55f0bcae0539e279e944ee151c9b53968a4f78.exe	103
PID 3088 wrote to memory of 436	3088	55627c375fa2e3695d0ed6293e55f0bcae0539e279e944ee151c9b53968a4f78.exe	103
PID 3088 wrote to memory of 5096	3088	55627c375fa2e3695d0ed6293e55f0bcae0539e279e944ee151c9b53968a4f78.exe	104
PID 3088 wrote to memory of 5096	3088	55627c375fa2e3695d0ed6293e55f0bcae0539e279e944ee151c9b53968a4f78.exe	104
PID 3088 wrote to memory of 2152	3088	55627c375fa2e3695d0ed6293e55f0bcae0539e279e944ee151c9b53968a4f78.exe	105
PID 3088 wrote to memory of 2152	3088	55627c375fa2e3695d0ed6293e55f0bcae0539e279e944ee151c9b53968a4f78.exe	105
PID 3088 wrote to memory of 2228	3088	55627c375fa2e3695d0ed6293e55f0bcae0539e279e944ee151c9b53968a4f78.exe	106
PID 3088 wrote to memory of 2228	3088	55627c375fa2e3695d0ed6293e55f0bcae0539e279e944ee151c9b53968a4f78.exe	106
PID 3088 wrote to memory of 1504	3088	55627c375fa2e3695d0ed6293e55f0bcae0539e279e944ee151c9b53968a4f78.exe	107
PID 3088 wrote to memory of 1504	3088	55627c375fa2e3695d0ed6293e55f0bcae0539e279e944ee151c9b53968a4f78.exe	107
PID 3088 wrote to memory of 3728	3088	55627c375fa2e3695d0ed6293e55f0bcae0539e279e944ee151c9b53968a4f78.exe	108
PID 3088 wrote to memory of 3728	3088	55627c375fa2e3695d0ed6293e55f0bcae0539e279e944ee151c9b53968a4f78.exe	108
PID 3088 wrote to memory of 2608	3088	55627c375fa2e3695d0ed6293e55f0bcae0539e279e944ee151c9b53968a4f78.exe	109
PID 3088 wrote to memory of 2608	3088	55627c375fa2e3695d0ed6293e55f0bcae0539e279e944ee151c9b53968a4f78.exe	109
PID 3088 wrote to memory of 2724	3088	55627c375fa2e3695d0ed6293e55f0bcae0539e279e944ee151c9b53968a4f78.exe	110
PID 3088 wrote to memory of 2724	3088	55627c375fa2e3695d0ed6293e55f0bcae0539e279e944ee151c9b53968a4f78.exe	110
PID 3088 wrote to memory of 4908	3088	55627c375fa2e3695d0ed6293e55f0bcae0539e279e944ee151c9b53968a4f78.exe	111
PID 3088 wrote to memory of 4908	3088	55627c375fa2e3695d0ed6293e55f0bcae0539e279e944ee151c9b53968a4f78.exe	111
PID 3088 wrote to memory of 228	3088	55627c375fa2e3695d0ed6293e55f0bcae0539e279e944ee151c9b53968a4f78.exe	112
PID 3088 wrote to memory of 228	3088	55627c375fa2e3695d0ed6293e55f0bcae0539e279e944ee151c9b53968a4f78.exe	112
PID 3088 wrote to memory of 3752	3088	55627c375fa2e3695d0ed6293e55f0bcae0539e279e944ee151c9b53968a4f78.exe	113
PID 3088 wrote to memory of 3752	3088	55627c375fa2e3695d0ed6293e55f0bcae0539e279e944ee151c9b53968a4f78.exe	113
PID 3088 wrote to memory of 4656	3088	55627c375fa2e3695d0ed6293e55f0bcae0539e279e944ee151c9b53968a4f78.exe	114
PID 3088 wrote to memory of 4656	3088	55627c375fa2e3695d0ed6293e55f0bcae0539e279e944ee151c9b53968a4f78.exe	114
PID 3088 wrote to memory of 740	3088	55627c375fa2e3695d0ed6293e55f0bcae0539e279e944ee151c9b53968a4f78.exe	115
PID 3088 wrote to memory of 740	3088	55627c375fa2e3695d0ed6293e55f0bcae0539e279e944ee151c9b53968a4f78.exe	115
PID 3088 wrote to memory of 4524	3088	55627c375fa2e3695d0ed6293e55f0bcae0539e279e944ee151c9b53968a4f78.exe	116
PID 3088 wrote to memory of 4524	3088	55627c375fa2e3695d0ed6293e55f0bcae0539e279e944ee151c9b53968a4f78.exe	116

C:\Users\Admin\AppData\Local\Temp\55627c375fa2e3695d0ed6293e55f0bcae0539e279e944ee151c9b53968a4f78.exe
"C:\Users\Admin\AppData\Local\Temp\55627c375fa2e3695d0ed6293e55f0bcae0539e279e944ee151c9b53968a4f78.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3088
- C:\Windows\System\SBngScE.exe
  C:\Windows\System\SBngScE.exe
  2⤵
  - Executes dropped EXE
  PID:4812
- C:\Windows\System\XhQVebw.exe
  C:\Windows\System\XhQVebw.exe
  2⤵
  - Executes dropped EXE
  PID:3980
- C:\Windows\System\NPXDHxn.exe
  C:\Windows\System\NPXDHxn.exe
  2⤵
  - Executes dropped EXE
  PID:3764
- C:\Windows\System\QJFGDyf.exe
  C:\Windows\System\QJFGDyf.exe
  2⤵
  - Executes dropped EXE
  PID:2376
- C:\Windows\System\JWwaxzL.exe
  C:\Windows\System\JWwaxzL.exe
  2⤵
  - Executes dropped EXE
  PID:3548
- C:\Windows\System\qxDnIjz.exe
  C:\Windows\System\qxDnIjz.exe
  2⤵
  - Executes dropped EXE
  PID:3280
- C:\Windows\System\xyBBHDZ.exe
  C:\Windows\System\xyBBHDZ.exe
  2⤵
  - Executes dropped EXE
  PID:2576
- C:\Windows\System\uiokKII.exe
  C:\Windows\System\uiokKII.exe
  2⤵
  - Executes dropped EXE
  PID:2632
- C:\Windows\System\OEHZobL.exe
  C:\Windows\System\OEHZobL.exe
  2⤵
  - Executes dropped EXE
  PID:2412
- C:\Windows\System\GmzsNBt.exe
  C:\Windows\System\GmzsNBt.exe
  2⤵
  - Executes dropped EXE
  PID:844
- C:\Windows\System\DvzoRPF.exe
  C:\Windows\System\DvzoRPF.exe
  2⤵
  - Executes dropped EXE
  PID:2036
- C:\Windows\System\HorSGKi.exe
  C:\Windows\System\HorSGKi.exe
  2⤵
  - Executes dropped EXE
  PID:3328
- C:\Windows\System\HkaoShb.exe
  C:\Windows\System\HkaoShb.exe
  2⤵
  - Executes dropped EXE
  PID:1664
- C:\Windows\System\ZbHfPGM.exe
  C:\Windows\System\ZbHfPGM.exe
  2⤵
  - Executes dropped EXE
  PID:2272
- C:\Windows\System\ZyPFsth.exe
  C:\Windows\System\ZyPFsth.exe
  2⤵
  - Executes dropped EXE
  PID:3560
- C:\Windows\System\WAoICoc.exe
  C:\Windows\System\WAoICoc.exe
  2⤵
  - Executes dropped EXE
  PID:704
- C:\Windows\System\pWPzBye.exe
  C:\Windows\System\pWPzBye.exe
  2⤵
  - Executes dropped EXE
  PID:4468
- C:\Windows\System\nYSzqmX.exe
  C:\Windows\System\nYSzqmX.exe
  2⤵
  - Executes dropped EXE
  PID:1144
- C:\Windows\System\JtoBReH.exe
  C:\Windows\System\JtoBReH.exe
  2⤵
  - Executes dropped EXE
  PID:436
- C:\Windows\System\vmEpZjz.exe
  C:\Windows\System\vmEpZjz.exe
  2⤵
  - Executes dropped EXE
  PID:5096
- C:\Windows\System\NlNpTxM.exe
  C:\Windows\System\NlNpTxM.exe
  2⤵
  - Executes dropped EXE
  PID:2152
- C:\Windows\System\lTWksCh.exe
  C:\Windows\System\lTWksCh.exe
  2⤵
  - Executes dropped EXE
  PID:2228
- C:\Windows\System\wzkDtNJ.exe
  C:\Windows\System\wzkDtNJ.exe
  2⤵
  - Executes dropped EXE
  PID:1504
- C:\Windows\System\JtzOhXc.exe
  C:\Windows\System\JtzOhXc.exe
  2⤵
  - Executes dropped EXE
  PID:3728
- C:\Windows\System\OfUuwpy.exe
  C:\Windows\System\OfUuwpy.exe
  2⤵
  - Executes dropped EXE
  PID:2608
- C:\Windows\System\EBZnvkw.exe
  C:\Windows\System\EBZnvkw.exe
  2⤵
  - Executes dropped EXE
  PID:2724
- C:\Windows\System\iYDWFJm.exe
  C:\Windows\System\iYDWFJm.exe
  2⤵
  - Executes dropped EXE
  PID:4908
- C:\Windows\System\uLoMjdt.exe
  C:\Windows\System\uLoMjdt.exe
  2⤵
  - Executes dropped EXE
  PID:228
- C:\Windows\System\jJOOnSc.exe
  C:\Windows\System\jJOOnSc.exe
  2⤵
  - Executes dropped EXE
  PID:3752
- C:\Windows\System\EQUdYrH.exe
  C:\Windows\System\EQUdYrH.exe
  2⤵
  - Executes dropped EXE
  PID:4656
- C:\Windows\System\nVgCKLR.exe
  C:\Windows\System\nVgCKLR.exe
  2⤵
  - Executes dropped EXE
  PID:740
- C:\Windows\System\YjJTgON.exe
  C:\Windows\System\YjJTgON.exe
  2⤵
  - Executes dropped EXE
  PID:4524
- C:\Windows\System\ITsTaSe.exe
  C:\Windows\System\ITsTaSe.exe
  2⤵
  - Executes dropped EXE
  PID:2932
- C:\Windows\System\ePYuVPx.exe
  C:\Windows\System\ePYuVPx.exe
  2⤵
  - Executes dropped EXE
  PID:2856
- C:\Windows\System\XndzFHO.exe
  C:\Windows\System\XndzFHO.exe
  2⤵
  - Executes dropped EXE
  PID:5084
- C:\Windows\System\JgfLBmv.exe
  C:\Windows\System\JgfLBmv.exe
  2⤵
  - Executes dropped EXE
  PID:2804
- C:\Windows\System\PQzXLLg.exe
  C:\Windows\System\PQzXLLg.exe
  2⤵
  - Executes dropped EXE
  PID:660
- C:\Windows\System\qUZYrTz.exe
  C:\Windows\System\qUZYrTz.exe
  2⤵
  - Executes dropped EXE
  PID:1748
- C:\Windows\System\YzUjgBx.exe
  C:\Windows\System\YzUjgBx.exe
  2⤵
  - Executes dropped EXE
  PID:2920
- C:\Windows\System\IQkhddV.exe
  C:\Windows\System\IQkhddV.exe
  2⤵
  - Executes dropped EXE
  PID:3908
- C:\Windows\System\URChcmM.exe
  C:\Windows\System\URChcmM.exe
  2⤵
  - Executes dropped EXE
  PID:4716
- C:\Windows\System\GIiheNJ.exe
  C:\Windows\System\GIiheNJ.exe
  2⤵
  - Executes dropped EXE
  PID:4056
- C:\Windows\System\ITpcUCb.exe
  C:\Windows\System\ITpcUCb.exe
  2⤵
  - Executes dropped EXE
  PID:2304
- C:\Windows\System\yBstTSG.exe
  C:\Windows\System\yBstTSG.exe
  2⤵
  - Executes dropped EXE
  PID:4164
- C:\Windows\System\jnvToKp.exe
  C:\Windows\System\jnvToKp.exe
  2⤵
  - Executes dropped EXE
  PID:2232
- C:\Windows\System\pFFeJUK.exe
  C:\Windows\System\pFFeJUK.exe
  2⤵
  - Executes dropped EXE
  PID:3696
- C:\Windows\System\tcFdDmG.exe
  C:\Windows\System\tcFdDmG.exe
  2⤵
  - Executes dropped EXE
  PID:3504
- C:\Windows\System\jsdHUrJ.exe
  C:\Windows\System\jsdHUrJ.exe
  2⤵
  - Executes dropped EXE
  PID:4984
- C:\Windows\System\IqXeLVD.exe
  C:\Windows\System\IqXeLVD.exe
  2⤵
  - Executes dropped EXE
  PID:3080
- C:\Windows\System\NoQWEdi.exe
  C:\Windows\System\NoQWEdi.exe
  2⤵
  - Executes dropped EXE
  PID:1508
- C:\Windows\System\DUlPGvB.exe
  C:\Windows\System\DUlPGvB.exe
  2⤵
  - Executes dropped EXE
  PID:3168
- C:\Windows\System\uTWazmK.exe
  C:\Windows\System\uTWazmK.exe
  2⤵
  - Executes dropped EXE
  PID:4532
- C:\Windows\System\JPutPou.exe
  C:\Windows\System\JPutPou.exe
  2⤵
  - Executes dropped EXE
  PID:4828
- C:\Windows\System\uknVBwM.exe
  C:\Windows\System\uknVBwM.exe
  2⤵
  - Executes dropped EXE
  PID:1348
- C:\Windows\System\oYeOIrU.exe
  C:\Windows\System\oYeOIrU.exe
  2⤵
  - Executes dropped EXE
  PID:2204
- C:\Windows\System\MmRxkbq.exe
  C:\Windows\System\MmRxkbq.exe
  2⤵
  - Executes dropped EXE
  PID:1576
- C:\Windows\System\zRoRUpo.exe
  C:\Windows\System\zRoRUpo.exe
  2⤵
  - Executes dropped EXE
  PID:2692
- C:\Windows\System\oClazDU.exe
  C:\Windows\System\oClazDU.exe
  2⤵
  - Executes dropped EXE
  PID:2100
- C:\Windows\System\cjFRBOp.exe
  C:\Windows\System\cjFRBOp.exe
  2⤵
  - Executes dropped EXE
  PID:1404
- C:\Windows\System\VqeDFoV.exe
  C:\Windows\System\VqeDFoV.exe
  2⤵
  - Executes dropped EXE
  PID:4536
- C:\Windows\System\VNFfopE.exe
  C:\Windows\System\VNFfopE.exe
  2⤵
  - Executes dropped EXE
  PID:4564
- C:\Windows\System\BPuycik.exe
  C:\Windows\System\BPuycik.exe
  2⤵
  - Executes dropped EXE
  PID:1160
- C:\Windows\System\kIxpbBR.exe
  C:\Windows\System\kIxpbBR.exe
  2⤵
  - Executes dropped EXE
  PID:2844
- C:\Windows\System\uKQkkIr.exe
  C:\Windows\System\uKQkkIr.exe
  2⤵
  - Executes dropped EXE
  PID:2044
- C:\Windows\System\tSIOjRy.exe
  C:\Windows\System\tSIOjRy.exe
  2⤵
  PID:3044
- C:\Windows\System\XKugvlr.exe
  C:\Windows\System\XKugvlr.exe
  2⤵
  PID:1472
- C:\Windows\System\jYUiOrJ.exe
  C:\Windows\System\jYUiOrJ.exe
  2⤵
  PID:1668
- C:\Windows\System\RItwpTg.exe
  C:\Windows\System\RItwpTg.exe
  2⤵
  PID:392
- C:\Windows\System\GinYvkc.exe
  C:\Windows\System\GinYvkc.exe
  2⤵
  PID:1064
- C:\Windows\System\mPmufNV.exe
  C:\Windows\System\mPmufNV.exe
  2⤵
  PID:3008
- C:\Windows\System\ZfYeQLK.exe
  C:\Windows\System\ZfYeQLK.exe
  2⤵
  PID:3852
- C:\Windows\System\kaLUqlX.exe
  C:\Windows\System\kaLUqlX.exe
  2⤵
  PID:2620
- C:\Windows\System\lrYNaqM.exe
  C:\Windows\System\lrYNaqM.exe
  2⤵
  PID:3856
- C:\Windows\System\DsIHIcq.exe
  C:\Windows\System\DsIHIcq.exe
  2⤵
  PID:3316
- C:\Windows\System\BTjUZpt.exe
  C:\Windows\System\BTjUZpt.exe
  2⤵
  PID:2428
- C:\Windows\System\ruqmkyN.exe
  C:\Windows\System\ruqmkyN.exe
  2⤵
  PID:3124
- C:\Windows\System\XSKqFsg.exe
  C:\Windows\System\XSKqFsg.exe
  2⤵
  PID:3776
- C:\Windows\System\MdbSVND.exe
  C:\Windows\System\MdbSVND.exe
  2⤵
  PID:2968
- C:\Windows\System\ewUqMVL.exe
  C:\Windows\System\ewUqMVL.exe
  2⤵
  PID:4944
- C:\Windows\System\KKwXeXr.exe
  C:\Windows\System\KKwXeXr.exe
  2⤵
  PID:180
- C:\Windows\System\YwIODwT.exe
  C:\Windows\System\YwIODwT.exe
  2⤵
  PID:2544
- C:\Windows\System\mvOPgSn.exe
  C:\Windows\System\mvOPgSn.exe
  2⤵
  PID:3948
- C:\Windows\System\XSezykU.exe
  C:\Windows\System\XSezykU.exe
  2⤵
  PID:116
- C:\Windows\System\qYaWrXU.exe
  C:\Windows\System\qYaWrXU.exe
  2⤵
  PID:4672
- C:\Windows\System\PKtvwCQ.exe
  C:\Windows\System\PKtvwCQ.exe
  2⤵
  PID:1072
- C:\Windows\System\sLQIhZB.exe
  C:\Windows\System\sLQIhZB.exe
  2⤵
  PID:920
- C:\Windows\System\sncuJwR.exe
  C:\Windows\System\sncuJwR.exe
  2⤵
  PID:1988
- C:\Windows\System\FHwvWfI.exe
  C:\Windows\System\FHwvWfI.exe
  2⤵
  PID:672
- C:\Windows\System\dLyXlai.exe
  C:\Windows\System\dLyXlai.exe
  2⤵
  PID:4668
- C:\Windows\System\YudAcLr.exe
  C:\Windows\System\YudAcLr.exe
  2⤵
  PID:2040
- C:\Windows\System\osqMDeg.exe
  C:\Windows\System\osqMDeg.exe
  2⤵
  PID:232
- C:\Windows\System\vSQKYcf.exe
  C:\Windows\System\vSQKYcf.exe
  2⤵
  PID:1292
- C:\Windows\System\BtcdKLm.exe
  C:\Windows\System\BtcdKLm.exe
  2⤵
  PID:3100
- C:\Windows\System\zVViZVG.exe
  C:\Windows\System\zVViZVG.exe
  2⤵
  PID:2940
- C:\Windows\System\orVPgoF.exe
  C:\Windows\System\orVPgoF.exe
  2⤵
  PID:1796
- C:\Windows\System\ZxyBXaX.exe
  C:\Windows\System\ZxyBXaX.exe
  2⤵
  PID:4956
- C:\Windows\System\MRrNplP.exe
  C:\Windows\System\MRrNplP.exe
  2⤵
  PID:836
- C:\Windows\System\xdlShUs.exe
  C:\Windows\System\xdlShUs.exe
  2⤵
  PID:1288
- C:\Windows\System\jilSKoT.exe
  C:\Windows\System\jilSKoT.exe
  2⤵
  PID:3052
- C:\Windows\System\ogZhxty.exe
  C:\Windows\System\ogZhxty.exe
  2⤵
  PID:3912
- C:\Windows\System\cvrEisW.exe
  C:\Windows\System\cvrEisW.exe
  2⤵
  PID:5128
- C:\Windows\System\zTpjrvs.exe
  C:\Windows\System\zTpjrvs.exe
  2⤵
  PID:5148
- C:\Windows\System\kTTdRxD.exe
  C:\Windows\System\kTTdRxD.exe
  2⤵
  PID:5192
- C:\Windows\System\oeOpMBz.exe
  C:\Windows\System\oeOpMBz.exe
  2⤵
  PID:5240
- C:\Windows\System\xuaWyQW.exe
  C:\Windows\System\xuaWyQW.exe
  2⤵
  PID:5256
- C:\Windows\System\fSkObuI.exe
  C:\Windows\System\fSkObuI.exe
  2⤵
  PID:5296
- C:\Windows\System\ynJndgZ.exe
  C:\Windows\System\ynJndgZ.exe
  2⤵
  PID:5316
- C:\Windows\System\VeSLlOt.exe
  C:\Windows\System\VeSLlOt.exe
  2⤵
  PID:5344
- C:\Windows\System\dqmhqnG.exe
  C:\Windows\System\dqmhqnG.exe
  2⤵
  PID:5376
- C:\Windows\System\OOWyPLe.exe
  C:\Windows\System\OOWyPLe.exe
  2⤵
  PID:5400
- C:\Windows\System\ImYkQzm.exe
  C:\Windows\System\ImYkQzm.exe
  2⤵
  PID:5428
- C:\Windows\System\sVRgUzN.exe
  C:\Windows\System\sVRgUzN.exe
  2⤵
  PID:5456
- C:\Windows\System\YpyNXCO.exe
  C:\Windows\System\YpyNXCO.exe
  2⤵
  PID:5484
- C:\Windows\System\hYjPlLa.exe
  C:\Windows\System\hYjPlLa.exe
  2⤵
  PID:5512
- C:\Windows\System\ubhCDpO.exe
  C:\Windows\System\ubhCDpO.exe
  2⤵
  PID:5540
- C:\Windows\System\OCyiWcl.exe
  C:\Windows\System\OCyiWcl.exe
  2⤵
  PID:5572
- C:\Windows\System\nrKqSSY.exe
  C:\Windows\System\nrKqSSY.exe
  2⤵
  PID:5600
- C:\Windows\System\GsWkkOu.exe
  C:\Windows\System\GsWkkOu.exe
  2⤵
  PID:5636
- C:\Windows\System\YDGjUGZ.exe
  C:\Windows\System\YDGjUGZ.exe
  2⤵
  PID:5656
- C:\Windows\System\WaBObpN.exe
  C:\Windows\System\WaBObpN.exe
  2⤵
  PID:5684
- C:\Windows\System\ddWctel.exe
  C:\Windows\System\ddWctel.exe
  2⤵
  PID:5720
- C:\Windows\System\YHBlRHp.exe
  C:\Windows\System\YHBlRHp.exe
  2⤵
  PID:5740
- C:\Windows\System\tuVlQwk.exe
  C:\Windows\System\tuVlQwk.exe
  2⤵
  PID:5768
- C:\Windows\System\ssViuDI.exe
  C:\Windows\System\ssViuDI.exe
  2⤵
  PID:5796
- C:\Windows\System\RbKuitS.exe
  C:\Windows\System\RbKuitS.exe
  2⤵
  PID:5820
- C:\Windows\System\HqrMOrk.exe
  C:\Windows\System\HqrMOrk.exe
  2⤵
  PID:5840
- C:\Windows\System\rDbJycj.exe
  C:\Windows\System\rDbJycj.exe
  2⤵
  PID:5876
- C:\Windows\System\kIRCIVy.exe
  C:\Windows\System\kIRCIVy.exe
  2⤵
  PID:5896
- C:\Windows\System\mENIkaB.exe
  C:\Windows\System\mENIkaB.exe
  2⤵
  PID:5928
- C:\Windows\System\UKBsrgB.exe
  C:\Windows\System\UKBsrgB.exe
  2⤵
  PID:5964
- C:\Windows\System\NxTiPvW.exe
  C:\Windows\System\NxTiPvW.exe
  2⤵
  PID:5992
- C:\Windows\System\QUgpOze.exe
  C:\Windows\System\QUgpOze.exe
  2⤵
  PID:6032
- C:\Windows\System\nsHfTJr.exe
  C:\Windows\System\nsHfTJr.exe
  2⤵
  PID:6048
- C:\Windows\System\ojfPdCs.exe
  C:\Windows\System\ojfPdCs.exe
  2⤵
  PID:6072
- C:\Windows\System\Yzvapbs.exe
  C:\Windows\System\Yzvapbs.exe
  2⤵
  PID:6092
- C:\Windows\System\GOnlkUd.exe
  C:\Windows\System\GOnlkUd.exe
  2⤵
  PID:6120
- C:\Windows\System\KnkMbgC.exe
  C:\Windows\System\KnkMbgC.exe
  2⤵
  PID:6136
- C:\Windows\System\siqbKha.exe
  C:\Windows\System\siqbKha.exe
  2⤵
  PID:5176
- C:\Windows\System\vfgFcMg.exe
  C:\Windows\System\vfgFcMg.exe
  2⤵
  PID:5276
- C:\Windows\System\ltgaOhy.exe
  C:\Windows\System\ltgaOhy.exe
  2⤵
  PID:5336
- C:\Windows\System\AXrFqEc.exe
  C:\Windows\System\AXrFqEc.exe
  2⤵
  PID:5392
- C:\Windows\System\olfEjjc.exe
  C:\Windows\System\olfEjjc.exe
  2⤵
  PID:5440
- C:\Windows\System\CqIBYIl.exe
  C:\Windows\System\CqIBYIl.exe
  2⤵
  PID:5508
- C:\Windows\System\jjYWfUo.exe
  C:\Windows\System\jjYWfUo.exe
  2⤵
  PID:5560
- C:\Windows\System\spkMOmp.exe
  C:\Windows\System\spkMOmp.exe
  2⤵
  PID:5652
- C:\Windows\System\QpYVMwS.exe
  C:\Windows\System\QpYVMwS.exe
  2⤵
  PID:5708
- C:\Windows\System\BnACdEE.exe
  C:\Windows\System\BnACdEE.exe
  2⤵
  PID:5780
- C:\Windows\System\OjONtki.exe
  C:\Windows\System\OjONtki.exe
  2⤵
  PID:5828
- C:\Windows\System\dlaiIBQ.exe
  C:\Windows\System\dlaiIBQ.exe
  2⤵
  PID:5892
- C:\Windows\System\KvtCmRi.exe
  C:\Windows\System\KvtCmRi.exe
  2⤵
  PID:5952
- C:\Windows\System\jhjspKi.exe
  C:\Windows\System\jhjspKi.exe
  2⤵
  PID:6008
- C:\Windows\System\BZXtIRT.exe
  C:\Windows\System\BZXtIRT.exe
  2⤵
  PID:6080
- C:\Windows\System\jGXLBnA.exe
  C:\Windows\System\jGXLBnA.exe
  2⤵
  PID:4748
- C:\Windows\System\gfaBfLF.exe
  C:\Windows\System\gfaBfLF.exe
  2⤵
  PID:5360
- C:\Windows\System\hDarXpE.exe
  C:\Windows\System\hDarXpE.exe
  2⤵
  PID:5588
- C:\Windows\System\lIjfVLP.exe
  C:\Windows\System\lIjfVLP.exe
  2⤵
  PID:5696
- C:\Windows\System\YIwdHCz.exe
  C:\Windows\System\YIwdHCz.exe
  2⤵
  PID:5832
- C:\Windows\System\UDelWKq.exe
  C:\Windows\System\UDelWKq.exe
  2⤵
  PID:5976
- C:\Windows\System\gjInCdy.exe
  C:\Windows\System\gjInCdy.exe
  2⤵
  PID:6064
- C:\Windows\System\SPYhkMI.exe
  C:\Windows\System\SPYhkMI.exe
  2⤵
  PID:5308
- C:\Windows\System\rQZuwTp.exe
  C:\Windows\System\rQZuwTp.exe
  2⤵
  PID:5764
- C:\Windows\System\PzLSgae.exe
  C:\Windows\System\PzLSgae.exe
  2⤵
  PID:6132
- C:\Windows\System\zQWKerk.exe
  C:\Windows\System\zQWKerk.exe
  2⤵
  PID:6108
- C:\Windows\System\otlUhHO.exe
  C:\Windows\System\otlUhHO.exe
  2⤵
  PID:6168
- C:\Windows\System\WavVXTP.exe
  C:\Windows\System\WavVXTP.exe
  2⤵
  PID:6192
- C:\Windows\System\TfUksCR.exe
  C:\Windows\System\TfUksCR.exe
  2⤵
  PID:6220
- C:\Windows\System\lWoiuoJ.exe
  C:\Windows\System\lWoiuoJ.exe
  2⤵
  PID:6252
- C:\Windows\System\IUxelbg.exe
  C:\Windows\System\IUxelbg.exe
  2⤵
  PID:6276
- C:\Windows\System\VtiOvOx.exe
  C:\Windows\System\VtiOvOx.exe
  2⤵
  PID:6308
- C:\Windows\System\IQCkNXW.exe
  C:\Windows\System\IQCkNXW.exe
  2⤵
  PID:6332
- C:\Windows\System\hLWypYV.exe
  C:\Windows\System\hLWypYV.exe
  2⤵
  PID:6360
- C:\Windows\System\ObALLlG.exe
  C:\Windows\System\ObALLlG.exe
  2⤵
  PID:6388
- C:\Windows\System\oZaExWe.exe
  C:\Windows\System\oZaExWe.exe
  2⤵
  PID:6420
- C:\Windows\System\ONNlahc.exe
  C:\Windows\System\ONNlahc.exe
  2⤵
  PID:6444
- C:\Windows\System\xateWwM.exe
  C:\Windows\System\xateWwM.exe
  2⤵
  PID:6492
- C:\Windows\System\cGCZPgY.exe
  C:\Windows\System\cGCZPgY.exe
  2⤵
  PID:6516
- C:\Windows\System\OeMaUWu.exe
  C:\Windows\System\OeMaUWu.exe
  2⤵
  PID:6532
- C:\Windows\System\uIXMAYg.exe
  C:\Windows\System\uIXMAYg.exe
  2⤵
  PID:6560
- C:\Windows\System\WSGJhMp.exe
  C:\Windows\System\WSGJhMp.exe
  2⤵
  PID:6592
- C:\Windows\System\kfQdSGO.exe
  C:\Windows\System\kfQdSGO.exe
  2⤵
  PID:6620
- C:\Windows\System\eKQXnyM.exe
  C:\Windows\System\eKQXnyM.exe
  2⤵
  PID:6656
- C:\Windows\System\dpBFXHG.exe
  C:\Windows\System\dpBFXHG.exe
  2⤵
  PID:6672
- C:\Windows\System\WswBIsu.exe
  C:\Windows\System\WswBIsu.exe
  2⤵
  PID:6704
- C:\Windows\System\gdSAtKA.exe
  C:\Windows\System\gdSAtKA.exe
  2⤵
  PID:6732
- C:\Windows\System\ueWRFff.exe
  C:\Windows\System\ueWRFff.exe
  2⤵
  PID:6768
- C:\Windows\System\kHfhVsg.exe
  C:\Windows\System\kHfhVsg.exe
  2⤵
  PID:6792
- C:\Windows\System\OFxmFYu.exe
  C:\Windows\System\OFxmFYu.exe
  2⤵
  PID:6816
- C:\Windows\System\eNUMjRI.exe
  C:\Windows\System\eNUMjRI.exe
  2⤵
  PID:6852
- C:\Windows\System\inwSaGW.exe
  C:\Windows\System\inwSaGW.exe
  2⤵
  PID:6880
- C:\Windows\System\XnrRbQw.exe
  C:\Windows\System\XnrRbQw.exe
  2⤵
  PID:6904
- C:\Windows\System\bAYkCbv.exe
  C:\Windows\System\bAYkCbv.exe
  2⤵
  PID:6924
- C:\Windows\System\xGkTGYh.exe
  C:\Windows\System\xGkTGYh.exe
  2⤵
  PID:6952
- C:\Windows\System\uBYDsOS.exe
  C:\Windows\System\uBYDsOS.exe
  2⤵
  PID:6980
- C:\Windows\System\sRiRhli.exe
  C:\Windows\System\sRiRhli.exe
  2⤵
  PID:7004
- C:\Windows\System\fpOTqgS.exe
  C:\Windows\System\fpOTqgS.exe
  2⤵
  PID:7032
- C:\Windows\System\qmCgcEx.exe
  C:\Windows\System\qmCgcEx.exe
  2⤵
  PID:7064
- C:\Windows\System\wXAmyIu.exe
  C:\Windows\System\wXAmyIu.exe
  2⤵
  PID:7088
- C:\Windows\System\MInEkzs.exe
  C:\Windows\System\MInEkzs.exe
  2⤵
  PID:7120
- C:\Windows\System\IEERWCX.exe
  C:\Windows\System\IEERWCX.exe
  2⤵
  PID:7148
- C:\Windows\System\QBpOIBK.exe
  C:\Windows\System\QBpOIBK.exe
  2⤵
  PID:6156
- C:\Windows\System\cBvUteO.exe
  C:\Windows\System\cBvUteO.exe
  2⤵
  PID:6188
- C:\Windows\System\uMJOuEO.exe
  C:\Windows\System\uMJOuEO.exe
  2⤵
  PID:6248
- C:\Windows\System\emFGYJq.exe
  C:\Windows\System\emFGYJq.exe
  2⤵
  PID:6348
- C:\Windows\System\ROqXEJH.exe
  C:\Windows\System\ROqXEJH.exe
  2⤵
  PID:6396
- C:\Windows\System\ccuYxiT.exe
  C:\Windows\System\ccuYxiT.exe
  2⤵
  PID:6468
- C:\Windows\System\HWGAyJa.exe
  C:\Windows\System\HWGAyJa.exe
  2⤵
  PID:6528
- C:\Windows\System\wrnyIPN.exe
  C:\Windows\System\wrnyIPN.exe
  2⤵
  PID:6604
- C:\Windows\System\znqKfSR.exe
  C:\Windows\System\znqKfSR.exe
  2⤵
  PID:6664
- C:\Windows\System\jaodpUY.exe
  C:\Windows\System\jaodpUY.exe
  2⤵
  PID:6744
- C:\Windows\System\jOayuvE.exe
  C:\Windows\System\jOayuvE.exe
  2⤵
  PID:6760
- C:\Windows\System\LbMKXyo.exe
  C:\Windows\System\LbMKXyo.exe
  2⤵
  PID:6844
- C:\Windows\System\pMunaQt.exe
  C:\Windows\System\pMunaQt.exe
  2⤵
  PID:6936
- C:\Windows\System\khkdOuq.exe
  C:\Windows\System\khkdOuq.exe
  2⤵
  PID:6992
- C:\Windows\System\hSxbzgd.exe
  C:\Windows\System\hSxbzgd.exe
  2⤵
  PID:7056
- C:\Windows\System\QAtclEx.exe
  C:\Windows\System\QAtclEx.exe
  2⤵
  PID:7144
- C:\Windows\System\tenHdgB.exe
  C:\Windows\System\tenHdgB.exe
  2⤵
  PID:6244
- C:\Windows\System\GaHCGPK.exe
  C:\Windows\System\GaHCGPK.exe
  2⤵
  PID:6324
- C:\Windows\System\pIlDcNC.exe
  C:\Windows\System\pIlDcNC.exe
  2⤵
  PID:6404
- C:\Windows\System\iJnTJFw.exe
  C:\Windows\System\iJnTJFw.exe
  2⤵
  PID:6588
- C:\Windows\System\eDpaaFM.exe
  C:\Windows\System\eDpaaFM.exe
  2⤵
  PID:6872
- C:\Windows\System\uiYpLqL.exe
  C:\Windows\System\uiYpLqL.exe
  2⤵
  PID:6896
- C:\Windows\System\UzCrgnj.exe
  C:\Windows\System\UzCrgnj.exe
  2⤵
  PID:6964
- C:\Windows\System\phPFoSh.exe
  C:\Windows\System\phPFoSh.exe
  2⤵
  PID:7164
- C:\Windows\System\sxHFHQZ.exe
  C:\Windows\System\sxHFHQZ.exe
  2⤵
  PID:6576
- C:\Windows\System\TZmRqBA.exe
  C:\Windows\System\TZmRqBA.exe
  2⤵
  PID:7020
- C:\Windows\System\adqPphO.exe
  C:\Windows\System\adqPphO.exe
  2⤵
  PID:7184
- C:\Windows\System\Dzrzlzo.exe
  C:\Windows\System\Dzrzlzo.exe
  2⤵
  PID:7208
- C:\Windows\System\yfNjdNQ.exe
  C:\Windows\System\yfNjdNQ.exe
  2⤵
  PID:7232
- C:\Windows\System\jEhKTLD.exe
  C:\Windows\System\jEhKTLD.exe
  2⤵
  PID:7260
- C:\Windows\System\wNWDFdg.exe
  C:\Windows\System\wNWDFdg.exe
  2⤵
  PID:7292
- C:\Windows\System\hFVujLd.exe
  C:\Windows\System\hFVujLd.exe
  2⤵
  PID:7324
- C:\Windows\System\YpBIxfp.exe
  C:\Windows\System\YpBIxfp.exe
  2⤵
  PID:7356
- C:\Windows\System\DapghnB.exe
  C:\Windows\System\DapghnB.exe
  2⤵
  PID:7384
- C:\Windows\System\hZSWynC.exe
  C:\Windows\System\hZSWynC.exe
  2⤵
  PID:7412
- C:\Windows\System\HylROel.exe
  C:\Windows\System\HylROel.exe
  2⤵
  PID:7440
- C:\Windows\System\VTRuZII.exe
  C:\Windows\System\VTRuZII.exe
  2⤵
  PID:7472
- C:\Windows\System\mnLUffB.exe
  C:\Windows\System\mnLUffB.exe
  2⤵
  PID:7508
- C:\Windows\System\kZUXQLS.exe
  C:\Windows\System\kZUXQLS.exe
  2⤵
  PID:7536
- C:\Windows\System\svefoBq.exe
  C:\Windows\System\svefoBq.exe
  2⤵
  PID:7556
- C:\Windows\System\kStwMrn.exe
  C:\Windows\System\kStwMrn.exe
  2⤵
  PID:7588
- C:\Windows\System\idYuZuM.exe
  C:\Windows\System\idYuZuM.exe
  2⤵
  PID:7612
- C:\Windows\System\CfIyZuW.exe
  C:\Windows\System\CfIyZuW.exe
  2⤵
  PID:7640
- C:\Windows\System\LwplSsY.exe
  C:\Windows\System\LwplSsY.exe
  2⤵
  PID:7668
- C:\Windows\System\zlJmeAo.exe
  C:\Windows\System\zlJmeAo.exe
  2⤵
  PID:7692
- C:\Windows\System\QFnFeoc.exe
  C:\Windows\System\QFnFeoc.exe
  2⤵
  PID:7724
- C:\Windows\System\ixfiBYr.exe
  C:\Windows\System\ixfiBYr.exe
  2⤵
  PID:7752
- C:\Windows\System\KKSrBih.exe
  C:\Windows\System\KKSrBih.exe
  2⤵
  PID:7780
- C:\Windows\System\WoUzhMJ.exe
  C:\Windows\System\WoUzhMJ.exe
  2⤵
  PID:7804
- C:\Windows\System\EFOVeAm.exe
  C:\Windows\System\EFOVeAm.exe
  2⤵
  PID:7824
- C:\Windows\System\lgadvnz.exe
  C:\Windows\System\lgadvnz.exe
  2⤵
  PID:7856
- C:\Windows\System\YvDYApX.exe
  C:\Windows\System\YvDYApX.exe
  2⤵
  PID:7892
- C:\Windows\System\OvVJgjh.exe
  C:\Windows\System\OvVJgjh.exe
  2⤵
  PID:7916
- C:\Windows\System\uQwfJFC.exe
  C:\Windows\System\uQwfJFC.exe
  2⤵
  PID:7944
- C:\Windows\System\iGqwJly.exe
  C:\Windows\System\iGqwJly.exe
  2⤵
  PID:7976
- C:\Windows\System\KXNRiCk.exe
  C:\Windows\System\KXNRiCk.exe
  2⤵
  PID:8000
- C:\Windows\System\iLHmLID.exe
  C:\Windows\System\iLHmLID.exe
  2⤵
  PID:8036
- C:\Windows\System\XHbKdpr.exe
  C:\Windows\System\XHbKdpr.exe
  2⤵
  PID:8068
- C:\Windows\System\NxDyMbe.exe
  C:\Windows\System\NxDyMbe.exe
  2⤵
  PID:8088
- C:\Windows\System\JdmEvnC.exe
  C:\Windows\System\JdmEvnC.exe
  2⤵
  PID:8124
- C:\Windows\System\xpTOqvZ.exe
  C:\Windows\System\xpTOqvZ.exe
  2⤵
  PID:8140
- C:\Windows\System\uhuqWxw.exe
  C:\Windows\System\uhuqWxw.exe
  2⤵
  PID:8164
- C:\Windows\System\iaPSbcd.exe
  C:\Windows\System\iaPSbcd.exe
  2⤵
  PID:6464
- C:\Windows\System\rOUKQFH.exe
  C:\Windows\System\rOUKQFH.exe
  2⤵
  PID:6920
- C:\Windows\System\eAHEDwW.exe
  C:\Windows\System\eAHEDwW.exe
  2⤵
  PID:7200
- C:\Windows\System\NYWUPTu.exe
  C:\Windows\System\NYWUPTu.exe
  2⤵
  PID:7276
- C:\Windows\System\fxuXXEE.exe
  C:\Windows\System\fxuXXEE.exe
  2⤵
  PID:7348
- C:\Windows\System\YWkknbX.exe
  C:\Windows\System\YWkknbX.exe
  2⤵
  PID:7432
- C:\Windows\System\zAegysm.exe
  C:\Windows\System\zAegysm.exe
  2⤵
  PID:7464
- C:\Windows\System\toRAGRO.exe
  C:\Windows\System\toRAGRO.exe
  2⤵
  PID:7552
- C:\Windows\System\kBJnRSp.exe
  C:\Windows\System\kBJnRSp.exe
  2⤵
  PID:7608
- C:\Windows\System\slpyIFC.exe
  C:\Windows\System\slpyIFC.exe
  2⤵
  PID:7652
- C:\Windows\System\rnVTlex.exe
  C:\Windows\System\rnVTlex.exe
  2⤵
  PID:7716
- C:\Windows\System\oqascqb.exe
  C:\Windows\System\oqascqb.exe
  2⤵
  PID:7748
- C:\Windows\System\pvmNyIt.exe
  C:\Windows\System\pvmNyIt.exe
  2⤵
  PID:7788
- C:\Windows\System\pTpyTaO.exe
  C:\Windows\System\pTpyTaO.exe
  2⤵
  PID:7908
- C:\Windows\System\CLxjogG.exe
  C:\Windows\System\CLxjogG.exe
  2⤵
  PID:8012
- C:\Windows\System\GUgeKsc.exe
  C:\Windows\System\GUgeKsc.exe
  2⤵
  PID:8044
- C:\Windows\System\DaJSTfw.exe
  C:\Windows\System\DaJSTfw.exe
  2⤵
  PID:8104
- C:\Windows\System\MqmriGM.exe
  C:\Windows\System\MqmriGM.exe
  2⤵
  PID:8152
- C:\Windows\System\FHzyoxW.exe
  C:\Windows\System\FHzyoxW.exe
  2⤵
  PID:6320
- C:\Windows\System\MAmvjYa.exe
  C:\Windows\System\MAmvjYa.exe
  2⤵
  PID:6180
- C:\Windows\System\xXESkJa.exe
  C:\Windows\System\xXESkJa.exe
  2⤵
  PID:7244
- C:\Windows\System\ILVzFLj.exe
  C:\Windows\System\ILVzFLj.exe
  2⤵
  PID:7336
- C:\Windows\System\RwOgzrN.exe
  C:\Windows\System\RwOgzrN.exe
  2⤵
  PID:7812
- C:\Windows\System\lsuWkfX.exe
  C:\Windows\System\lsuWkfX.exe
  2⤵
  PID:7676
- C:\Windows\System\hItEWvh.exe
  C:\Windows\System\hItEWvh.exe
  2⤵
  PID:7776
- C:\Windows\System\NxRGivw.exe
  C:\Windows\System\NxRGivw.exe
  2⤵
  PID:8032
- C:\Windows\System\tewmtVB.exe
  C:\Windows\System\tewmtVB.exe
  2⤵
  PID:7268
- C:\Windows\System\OkiHBek.exe
  C:\Windows\System\OkiHBek.exe
  2⤵
  PID:7964
- C:\Windows\System\BaOxLmS.exe
  C:\Windows\System\BaOxLmS.exe
  2⤵
  PID:8156
- C:\Windows\System\nwDBFtT.exe
  C:\Windows\System\nwDBFtT.exe
  2⤵
  PID:8224
- C:\Windows\System\KQMUdnb.exe
  C:\Windows\System\KQMUdnb.exe
  2⤵
  PID:8252
- C:\Windows\System\werBsUj.exe
  C:\Windows\System\werBsUj.exe
  2⤵
  PID:8280
- C:\Windows\System\TAjVKEr.exe
  C:\Windows\System\TAjVKEr.exe
  2⤵
  PID:8308
- C:\Windows\System\GjpwYqO.exe
  C:\Windows\System\GjpwYqO.exe
  2⤵
  PID:8336
- C:\Windows\System\AKCSiYt.exe
  C:\Windows\System\AKCSiYt.exe
  2⤵
  PID:8356
- C:\Windows\System\rUTFPgC.exe
  C:\Windows\System\rUTFPgC.exe
  2⤵
  PID:8380
- C:\Windows\System\LqLNNob.exe
  C:\Windows\System\LqLNNob.exe
  2⤵
  PID:8412
- C:\Windows\System\NRMKeRk.exe
  C:\Windows\System\NRMKeRk.exe
  2⤵
  PID:8440
- C:\Windows\System\fQNMnfI.exe
  C:\Windows\System\fQNMnfI.exe
  2⤵
  PID:8476
- C:\Windows\System\xxFIIpL.exe
  C:\Windows\System\xxFIIpL.exe
  2⤵
  PID:8504
- C:\Windows\System\DHZHTYG.exe
  C:\Windows\System\DHZHTYG.exe
  2⤵
  PID:8532
- C:\Windows\System\RadTyNu.exe
  C:\Windows\System\RadTyNu.exe
  2⤵
  PID:8552
- C:\Windows\System\xqcHLQY.exe
  C:\Windows\System\xqcHLQY.exe
  2⤵
  PID:8584
- C:\Windows\System\AxIYyNm.exe
  C:\Windows\System\AxIYyNm.exe
  2⤵
  PID:8612
- C:\Windows\System\bifltNi.exe
  C:\Windows\System\bifltNi.exe
  2⤵
  PID:8640
- C:\Windows\System\TywZxKK.exe
  C:\Windows\System\TywZxKK.exe
  2⤵
  PID:8668
- C:\Windows\System\dIiCyWP.exe
  C:\Windows\System\dIiCyWP.exe
  2⤵
  PID:8696
- C:\Windows\System\TwfPnHg.exe
  C:\Windows\System\TwfPnHg.exe
  2⤵
  PID:8712
- C:\Windows\System\Fdskwgp.exe
  C:\Windows\System\Fdskwgp.exe
  2⤵
  PID:8736
- C:\Windows\System\sunrZAt.exe
  C:\Windows\System\sunrZAt.exe
  2⤵
  PID:8772
- C:\Windows\System\ZHcqnYC.exe
  C:\Windows\System\ZHcqnYC.exe
  2⤵
  PID:8804
- C:\Windows\System\NqYMjEP.exe
  C:\Windows\System\NqYMjEP.exe
  2⤵
  PID:8828
- C:\Windows\System\hHSKbgB.exe
  C:\Windows\System\hHSKbgB.exe
  2⤵
  PID:8856
- C:\Windows\System\VtNOins.exe
  C:\Windows\System\VtNOins.exe
  2⤵
  PID:8876
- C:\Windows\System\MOOQtVc.exe
  C:\Windows\System\MOOQtVc.exe
  2⤵
  PID:8900
- C:\Windows\System\rEMwehR.exe
  C:\Windows\System\rEMwehR.exe
  2⤵
  PID:8924
- C:\Windows\System\KOdOXpx.exe
  C:\Windows\System\KOdOXpx.exe
  2⤵
  PID:8948
- C:\Windows\System\PrwZOUR.exe
  C:\Windows\System\PrwZOUR.exe
  2⤵
  PID:8968
- C:\Windows\System\UcMBJah.exe
  C:\Windows\System\UcMBJah.exe
  2⤵
  PID:8992
- C:\Windows\System\DqNPjwO.exe
  C:\Windows\System\DqNPjwO.exe
  2⤵
  PID:9028
- C:\Windows\System\ysFAuDu.exe
  C:\Windows\System\ysFAuDu.exe
  2⤵
  PID:9056
- C:\Windows\System\LJgGiIx.exe
  C:\Windows\System\LJgGiIx.exe
  2⤵
  PID:9092
- C:\Windows\System\OuHmMjS.exe
  C:\Windows\System\OuHmMjS.exe
  2⤵
  PID:9116
- C:\Windows\System\HXFWNIV.exe
  C:\Windows\System\HXFWNIV.exe
  2⤵
  PID:9136
- C:\Windows\System\PiCEWRf.exe
  C:\Windows\System\PiCEWRf.exe
  2⤵
  PID:9176
- C:\Windows\System\bPMSBPM.exe
  C:\Windows\System\bPMSBPM.exe
  2⤵
  PID:9204
- C:\Windows\System\FKfaDAx.exe
  C:\Windows\System\FKfaDAx.exe
  2⤵
  PID:7844
- C:\Windows\System\RZbqAcM.exe
  C:\Windows\System\RZbqAcM.exe
  2⤵
  PID:8220
- C:\Windows\System\BtDADyK.exe
  C:\Windows\System\BtDADyK.exe
  2⤵
  PID:8248
- C:\Windows\System\TYYuArn.exe
  C:\Windows\System\TYYuArn.exe
  2⤵
  PID:8288
- C:\Windows\System\wUJPcSy.exe
  C:\Windows\System\wUJPcSy.exe
  2⤵
  PID:8372
- C:\Windows\System\GgKQZuf.exe
  C:\Windows\System\GgKQZuf.exe
  2⤵
  PID:8408
- C:\Windows\System\naeUDzN.exe
  C:\Windows\System\naeUDzN.exe
  2⤵
  PID:8492
- C:\Windows\System\bpaZkfh.exe
  C:\Windows\System\bpaZkfh.exe
  2⤵
  PID:8548
- C:\Windows\System\EnxwxwM.exe
  C:\Windows\System\EnxwxwM.exe
  2⤵
  PID:8656
- C:\Windows\System\UPQeLvJ.exe
  C:\Windows\System\UPQeLvJ.exe
  2⤵
  PID:8652
- C:\Windows\System\YkbwQyR.exe
  C:\Windows\System\YkbwQyR.exe
  2⤵
  PID:8728
- C:\Windows\System\QfGDMnL.exe
  C:\Windows\System\QfGDMnL.exe
  2⤵
  PID:8792
- C:\Windows\System\ZUfGWXQ.exe
  C:\Windows\System\ZUfGWXQ.exe
  2⤵
  PID:8848
- C:\Windows\System\JCZGIkM.exe
  C:\Windows\System\JCZGIkM.exe
  2⤵
  PID:7364
- C:\Windows\System\zoPEdRd.exe
  C:\Windows\System\zoPEdRd.exe
  2⤵
  PID:8912
- C:\Windows\System\xwjkSrd.exe
  C:\Windows\System\xwjkSrd.exe
  2⤵
  PID:8944
- C:\Windows\System\ZgVWJLO.exe
  C:\Windows\System\ZgVWJLO.exe
  2⤵
  PID:9044
- C:\Windows\System\TnMHfnH.exe
  C:\Windows\System\TnMHfnH.exe
  2⤵
  PID:9076
- C:\Windows\System\yjNqVDO.exe
  C:\Windows\System\yjNqVDO.exe
  2⤵
  PID:7196
- C:\Windows\System\FVsjvGV.exe
  C:\Windows\System\FVsjvGV.exe
  2⤵
  PID:8272
- C:\Windows\System\KiuxtNc.exe
  C:\Windows\System\KiuxtNc.exe
  2⤵
  PID:8400
- C:\Windows\System\sqxgETd.exe
  C:\Windows\System\sqxgETd.exe
  2⤵
  PID:8576
- C:\Windows\System\szHLYTF.exe
  C:\Windows\System\szHLYTF.exe
  2⤵
  PID:8352
- C:\Windows\System\PyeZojI.exe
  C:\Windows\System\PyeZojI.exe
  2⤵
  PID:9016
- C:\Windows\System\vCFjAAj.exe
  C:\Windows\System\vCFjAAj.exe
  2⤵
  PID:8760
- C:\Windows\System\ytuHBri.exe
  C:\Windows\System\ytuHBri.exe
  2⤵
  PID:9240
- C:\Windows\System\gbLLgZt.exe
  C:\Windows\System\gbLLgZt.exe
  2⤵
  PID:9260
- C:\Windows\System\UOrPHUq.exe
  C:\Windows\System\UOrPHUq.exe
  2⤵
  PID:9284
- C:\Windows\System\NxyoxwL.exe
  C:\Windows\System\NxyoxwL.exe
  2⤵
  PID:9308
- C:\Windows\System\SwnMMAF.exe
  C:\Windows\System\SwnMMAF.exe
  2⤵
  PID:9340
- C:\Windows\System\JVfqjuo.exe
  C:\Windows\System\JVfqjuo.exe
  2⤵
  PID:9368
- C:\Windows\System\KapdeEQ.exe
  C:\Windows\System\KapdeEQ.exe
  2⤵
  PID:9400
- C:\Windows\System\geIEaPs.exe
  C:\Windows\System\geIEaPs.exe
  2⤵
  PID:9424
- C:\Windows\System\uUsggZw.exe
  C:\Windows\System\uUsggZw.exe
  2⤵
  PID:9448
- C:\Windows\System\hnJVSHy.exe
  C:\Windows\System\hnJVSHy.exe
  2⤵
  PID:9528
- C:\Windows\System\wUpSsWi.exe
  C:\Windows\System\wUpSsWi.exe
  2⤵
  PID:9564
- C:\Windows\System\afIIadg.exe
  C:\Windows\System\afIIadg.exe
  2⤵
  PID:9596
- C:\Windows\System\IjskqRU.exe
  C:\Windows\System\IjskqRU.exe
  2⤵
  PID:9624
- C:\Windows\System\FTWWyNK.exe
  C:\Windows\System\FTWWyNK.exe
  2⤵
  PID:9656
- C:\Windows\System\xiAFsxX.exe
  C:\Windows\System\xiAFsxX.exe
  2⤵
  PID:9692
- C:\Windows\System\JaxmcmN.exe
  C:\Windows\System\JaxmcmN.exe
  2⤵
  PID:9716
- C:\Windows\System\ELUdPEW.exe
  C:\Windows\System\ELUdPEW.exe
  2⤵
  PID:9744
- C:\Windows\System\Qputyfa.exe
  C:\Windows\System\Qputyfa.exe
  2⤵
  PID:9764
- C:\Windows\System\Lbwnauf.exe
  C:\Windows\System\Lbwnauf.exe
  2⤵
  PID:9780
- C:\Windows\System\xNOoCrX.exe
  C:\Windows\System\xNOoCrX.exe
  2⤵
  PID:9808
- C:\Windows\System\pzUWSIW.exe
  C:\Windows\System\pzUWSIW.exe
  2⤵
  PID:9836
- C:\Windows\System\yooWsNM.exe
  C:\Windows\System\yooWsNM.exe
  2⤵
  PID:9864
- C:\Windows\System\lATulRi.exe
  C:\Windows\System\lATulRi.exe
  2⤵
  PID:9888
- C:\Windows\System\TFUWjtN.exe
  C:\Windows\System\TFUWjtN.exe
  2⤵
  PID:9912
- C:\Windows\System\wQuNkvM.exe
  C:\Windows\System\wQuNkvM.exe
  2⤵
  PID:9936
- C:\Windows\System\azQsWqe.exe
  C:\Windows\System\azQsWqe.exe
  2⤵
  PID:9964
- C:\Windows\System\vPppxQw.exe
  C:\Windows\System\vPppxQw.exe
  2⤵
  PID:9988
- C:\Windows\System\AUeqPKv.exe
  C:\Windows\System\AUeqPKv.exe
  2⤵
  PID:10004
- C:\Windows\System\UfCCMEr.exe
  C:\Windows\System\UfCCMEr.exe
  2⤵
  PID:10044
- C:\Windows\System\cwXDoJZ.exe
  C:\Windows\System\cwXDoJZ.exe
  2⤵
  PID:10072
- C:\Windows\System\pJnAvSB.exe
  C:\Windows\System\pJnAvSB.exe
  2⤵
  PID:10092
- C:\Windows\System\pBWsiyV.exe
  C:\Windows\System\pBWsiyV.exe
  2⤵
  PID:10124
- C:\Windows\System\lzKXMvG.exe
  C:\Windows\System\lzKXMvG.exe
  2⤵
  PID:10144
- C:\Windows\System\zulCGlQ.exe
  C:\Windows\System\zulCGlQ.exe
  2⤵
  PID:10168
- C:\Windows\System\NIXYMmu.exe
  C:\Windows\System\NIXYMmu.exe
  2⤵
  PID:10196
- C:\Windows\System\qVfJmel.exe
  C:\Windows\System\qVfJmel.exe
  2⤵
  PID:10216
- C:\Windows\System\xsSYmcd.exe
  C:\Windows\System\xsSYmcd.exe
  2⤵
  PID:7576
- C:\Windows\System\dMzElZu.exe
  C:\Windows\System\dMzElZu.exe
  2⤵
  PID:9004
- C:\Windows\System\WJfwHFr.exe
  C:\Windows\System\WJfwHFr.exe
  2⤵
  PID:8816
- C:\Windows\System\jRAZmRc.exe
  C:\Windows\System\jRAZmRc.exe
  2⤵
  PID:8768
- C:\Windows\System\CckvqkH.exe
  C:\Windows\System\CckvqkH.exe
  2⤵
  PID:9300
- C:\Windows\System\TOpGtqu.exe
  C:\Windows\System\TOpGtqu.exe
  2⤵
  PID:9476
- C:\Windows\System\RTtifVL.exe
  C:\Windows\System\RTtifVL.exe
  2⤵
  PID:9224
- C:\Windows\System\GqsVjoe.exe
  C:\Windows\System\GqsVjoe.exe
  2⤵
  PID:9524
- C:\Windows\System\vHQVitE.exe
  C:\Windows\System\vHQVitE.exe
  2⤵
  PID:9328
- C:\Windows\System\gAKxKUq.exe
  C:\Windows\System\gAKxKUq.exe
  2⤵
  PID:9388
- C:\Windows\System\XCHicxY.exe
  C:\Windows\System\XCHicxY.exe
  2⤵
  PID:9512
- C:\Windows\System\FyPOXLS.exe
  C:\Windows\System\FyPOXLS.exe
  2⤵
  PID:9636
- C:\Windows\System\ZxIGmUj.exe
  C:\Windows\System\ZxIGmUj.exe
  2⤵
  PID:9736
- C:\Windows\System\XlxLFmR.exe
  C:\Windows\System\XlxLFmR.exe
  2⤵
  PID:9820
- C:\Windows\System\yelQQdo.exe
  C:\Windows\System\yelQQdo.exe
  2⤵
  PID:9852
- C:\Windows\System\aeBgJuu.exe
  C:\Windows\System\aeBgJuu.exe
  2⤵
  PID:9976
- C:\Windows\System\QtWwxGI.exe
  C:\Windows\System\QtWwxGI.exe
  2⤵
  PID:9884
- C:\Windows\System\JHNJOXy.exe
  C:\Windows\System\JHNJOXy.exe
  2⤵
  PID:10000
- C:\Windows\System\kRCkHQW.exe
  C:\Windows\System\kRCkHQW.exe
  2⤵
  PID:10080
- C:\Windows\System\SgBSgkt.exe
  C:\Windows\System\SgBSgkt.exe
  2⤵
  PID:10104
- C:\Windows\System\tJSZgfl.exe
  C:\Windows\System\tJSZgfl.exe
  2⤵
  PID:10204
- C:\Windows\System\HWfSxmE.exe
  C:\Windows\System\HWfSxmE.exe
  2⤵
  PID:10188
- C:\Windows\System\XGkhoLn.exe
  C:\Windows\System\XGkhoLn.exe
  2⤵
  PID:9576
- C:\Windows\System\tuOwumx.exe
  C:\Windows\System\tuOwumx.exe
  2⤵
  PID:8688
- C:\Windows\System\vMBWiYy.exe
  C:\Windows\System\vMBWiYy.exe
  2⤵
  PID:9108
- C:\Windows\System\qIUJJTd.exe
  C:\Windows\System\qIUJJTd.exe
  2⤵
  PID:9320
- C:\Windows\System\XxirmGy.exe
  C:\Windows\System\XxirmGy.exe
  2⤵
  PID:10236
- C:\Windows\System\srYlSUx.exe
  C:\Windows\System\srYlSUx.exe
  2⤵
  PID:9972
- C:\Windows\System\VXsSQQY.exe
  C:\Windows\System\VXsSQQY.exe
  2⤵
  PID:9160
- C:\Windows\System\LTRmbSz.exe
  C:\Windows\System\LTRmbSz.exe
  2⤵
  PID:9920
- C:\Windows\System\UzIxAtP.exe
  C:\Windows\System\UzIxAtP.exe
  2⤵
  PID:9616
- C:\Windows\System\qhfSFpk.exe
  C:\Windows\System\qhfSFpk.exe
  2⤵
  PID:10252
- C:\Windows\System\EREPypr.exe
  C:\Windows\System\EREPypr.exe
  2⤵
  PID:10280
- C:\Windows\System\YYuuEQa.exe
  C:\Windows\System\YYuuEQa.exe
  2⤵
  PID:10312
- C:\Windows\System\YzbtbGa.exe
  C:\Windows\System\YzbtbGa.exe
  2⤵
  PID:10340
- C:\Windows\System\ZWnALLy.exe
  C:\Windows\System\ZWnALLy.exe
  2⤵
  PID:10368
- C:\Windows\System\OlcfqGY.exe
  C:\Windows\System\OlcfqGY.exe
  2⤵
  PID:10400
- C:\Windows\System\qDQhpTY.exe
  C:\Windows\System\qDQhpTY.exe
  2⤵
  PID:10424
- C:\Windows\System\bGCkUEb.exe
  C:\Windows\System\bGCkUEb.exe
  2⤵
  PID:10472
- C:\Windows\System\ocyXYjl.exe
  C:\Windows\System\ocyXYjl.exe
  2⤵
  PID:10488
- C:\Windows\System\bBVmyiA.exe
  C:\Windows\System\bBVmyiA.exe
  2⤵
  PID:10520
- C:\Windows\System\OsKkhhg.exe
  C:\Windows\System\OsKkhhg.exe
  2⤵
  PID:10548
- C:\Windows\System\eZayrgo.exe
  C:\Windows\System\eZayrgo.exe
  2⤵
  PID:10576
- C:\Windows\System\mtrmDOI.exe
  C:\Windows\System\mtrmDOI.exe
  2⤵
  PID:10664
- C:\Windows\System\GKWJdzX.exe
  C:\Windows\System\GKWJdzX.exe
  2⤵
  PID:10744
- C:\Windows\System\NUnpWph.exe
  C:\Windows\System\NUnpWph.exe
  2⤵
  PID:10780
- C:\Windows\System\kIeQlYb.exe
  C:\Windows\System\kIeQlYb.exe
  2⤵
  PID:10812
- C:\Windows\System\UcoWqgt.exe
  C:\Windows\System\UcoWqgt.exe
  2⤵
  PID:10832
- C:\Windows\System\IdfaIin.exe
  C:\Windows\System\IdfaIin.exe
  2⤵
  PID:10860
- C:\Windows\System\lAbmzMA.exe
  C:\Windows\System\lAbmzMA.exe
  2⤵
  PID:10884
- C:\Windows\System\XzufuyN.exe
  C:\Windows\System\XzufuyN.exe
  2⤵
  PID:10912
- C:\Windows\System\enaSJwo.exe
  C:\Windows\System\enaSJwo.exe
  2⤵
  PID:10936
- C:\Windows\System\kgbddPX.exe
  C:\Windows\System\kgbddPX.exe
  2⤵
  PID:10960
- C:\Windows\System\DOmKKau.exe
  C:\Windows\System\DOmKKau.exe
  2⤵
  PID:11028
- C:\Windows\System\lMyNXpm.exe
  C:\Windows\System\lMyNXpm.exe
  2⤵
  PID:11076
- C:\Windows\System\uGpHkzU.exe
  C:\Windows\System\uGpHkzU.exe
  2⤵
  PID:11104
- C:\Windows\System\ZHUlNHM.exe
  C:\Windows\System\ZHUlNHM.exe
  2⤵
  PID:11132
- C:\Windows\System\FYPKuBS.exe
  C:\Windows\System\FYPKuBS.exe
  2⤵
  PID:11148
- C:\Windows\System\yhUGXLx.exe
  C:\Windows\System\yhUGXLx.exe
  2⤵
  PID:11176
- C:\Windows\System\XZFFoXg.exe
  C:\Windows\System\XZFFoXg.exe
  2⤵
  PID:11192
- C:\Windows\System\AaCtFCH.exe
  C:\Windows\System\AaCtFCH.exe
  2⤵
  PID:11220
- C:\Windows\System\QhKmEYe.exe
  C:\Windows\System\QhKmEYe.exe
  2⤵
  PID:11260
- C:\Windows\System\AjiHfmH.exe
  C:\Windows\System\AjiHfmH.exe
  2⤵
  PID:7664
- C:\Windows\System\YlhbBwA.exe
  C:\Windows\System\YlhbBwA.exe
  2⤵
  PID:9252
- C:\Windows\System\TZfOBaU.exe
  C:\Windows\System\TZfOBaU.exe
  2⤵
  PID:9248
- C:\Windows\System\SkYHcYj.exe
  C:\Windows\System\SkYHcYj.exe
  2⤵
  PID:10292
- C:\Windows\System\vQFdIjG.exe
  C:\Windows\System\vQFdIjG.exe
  2⤵
  PID:10592
- C:\Windows\System\SzyImRe.exe
  C:\Windows\System\SzyImRe.exe
  2⤵
  PID:10300
- C:\Windows\System\hYvTxtX.exe
  C:\Windows\System\hYvTxtX.exe
  2⤵
  PID:10508
- C:\Windows\System\cmBRZna.exe
  C:\Windows\System\cmBRZna.exe
  2⤵
  PID:10380
- C:\Windows\System\ERPlEox.exe
  C:\Windows\System\ERPlEox.exe
  2⤵
  PID:10564
- C:\Windows\System\zhSBxWU.exe
  C:\Windows\System\zhSBxWU.exe
  2⤵
  PID:10764
- C:\Windows\System\cfbTSpY.exe
  C:\Windows\System\cfbTSpY.exe
  2⤵
  PID:10804
- C:\Windows\System\TMSPpBM.exe
  C:\Windows\System\TMSPpBM.exe
  2⤵
  PID:10824
- C:\Windows\System\Fhaykrc.exe
  C:\Windows\System\Fhaykrc.exe
  2⤵
  PID:10920
- C:\Windows\System\dyhADwv.exe
  C:\Windows\System\dyhADwv.exe
  2⤵
  PID:10948
- C:\Windows\System\shYtSou.exe
  C:\Windows\System\shYtSou.exe
  2⤵
  PID:11040
- C:\Windows\System\WpQMEwD.exe
  C:\Windows\System\WpQMEwD.exe
  2⤵
  PID:2240
- C:\Windows\System\xZqrOuY.exe
  C:\Windows\System\xZqrOuY.exe
  2⤵
  PID:11144
- C:\Windows\System\WJRlXUi.exe
  C:\Windows\System\WJRlXUi.exe
  2⤵
  PID:11212
- C:\Windows\System\LbdKzpf.exe
  C:\Windows\System\LbdKzpf.exe
  2⤵
  PID:11240
- C:\Windows\System\hAlRDlR.exe
  C:\Windows\System\hAlRDlR.exe
  2⤵
  PID:10024
- C:\Windows\System\iXtrTxZ.exe
  C:\Windows\System\iXtrTxZ.exe
  2⤵
  PID:10432
- C:\Windows\System\yMVWZtX.exe
  C:\Windows\System\yMVWZtX.exe
  2⤵
  PID:10324
- C:\Windows\System\pHuLKyY.exe
  C:\Windows\System\pHuLKyY.exe
  2⤵
  PID:10608
- C:\Windows\System\TVamyGi.exe
  C:\Windows\System\TVamyGi.exe
  2⤵
  PID:10616
- C:\Windows\System\VHOTeSb.exe
  C:\Windows\System\VHOTeSb.exe
  2⤵
  PID:10900
- C:\Windows\System\zgkSwSy.exe
  C:\Windows\System\zgkSwSy.exe
  2⤵
  PID:11024
- C:\Windows\System\qxvpGuX.exe
  C:\Windows\System\qxvpGuX.exe
  2⤵
  PID:11140
- C:\Windows\System\qngVAWL.exe
  C:\Windows\System\qngVAWL.exe
  2⤵
  PID:9708
- C:\Windows\System\hpJMNdV.exe
  C:\Windows\System\hpJMNdV.exe
  2⤵
  PID:10420
- C:\Windows\System\mbzoCre.exe
  C:\Windows\System\mbzoCre.exe
  2⤵
  PID:10712
- C:\Windows\System\CeKcLUQ.exe
  C:\Windows\System\CeKcLUQ.exe
  2⤵
  PID:840
- C:\Windows\System\ancVMsF.exe
  C:\Windows\System\ancVMsF.exe
  2⤵
  PID:11124
- C:\Windows\System\JIGtiUv.exe
  C:\Windows\System\JIGtiUv.exe
  2⤵
  PID:11288
- C:\Windows\System\AGHzRdq.exe
  C:\Windows\System\AGHzRdq.exe
  2⤵
  PID:11308
- C:\Windows\System\OpWDCXU.exe
  C:\Windows\System\OpWDCXU.exe
  2⤵
  PID:11340
- C:\Windows\System\GMpUBiV.exe
  C:\Windows\System\GMpUBiV.exe
  2⤵
  PID:11360
- C:\Windows\System\URgfFPb.exe
  C:\Windows\System\URgfFPb.exe
  2⤵
  PID:11388
- C:\Windows\System\FCsDHtL.exe
  C:\Windows\System\FCsDHtL.exe
  2⤵
  PID:11420
- C:\Windows\System\cAHjhus.exe
  C:\Windows\System\cAHjhus.exe
  2⤵
  PID:11448
- C:\Windows\System\QnweOxh.exe
  C:\Windows\System\QnweOxh.exe
  2⤵
  PID:11480
- C:\Windows\System\mYluysL.exe
  C:\Windows\System\mYluysL.exe
  2⤵
  PID:11500
- C:\Windows\System\oifZzFA.exe
  C:\Windows\System\oifZzFA.exe
  2⤵
  PID:11524
- C:\Windows\System\KaWQdtY.exe
  C:\Windows\System\KaWQdtY.exe
  2⤵
  PID:11552
- C:\Windows\System\kfNUISL.exe
  C:\Windows\System\kfNUISL.exe
  2⤵
  PID:11572
- C:\Windows\System\ekzJpQL.exe
  C:\Windows\System\ekzJpQL.exe
  2⤵
  PID:11596
- C:\Windows\System\DsWbYkb.exe
  C:\Windows\System\DsWbYkb.exe
  2⤵
  PID:11624
- C:\Windows\System\frvLeph.exe
  C:\Windows\System\frvLeph.exe
  2⤵
  PID:11656
- C:\Windows\System\OtENrWz.exe
  C:\Windows\System\OtENrWz.exe
  2⤵
  PID:11680
- C:\Windows\System\chIXWnK.exe
  C:\Windows\System\chIXWnK.exe
  2⤵
  PID:11708
- C:\Windows\System\MNeRDQP.exe
  C:\Windows\System\MNeRDQP.exe
  2⤵
  PID:11740
- C:\Windows\System\DumbXiY.exe
  C:\Windows\System\DumbXiY.exe
  2⤵
  PID:11772
- C:\Windows\System\KeBZaMF.exe
  C:\Windows\System\KeBZaMF.exe
  2⤵
  PID:11808
- C:\Windows\System\YoYjLCs.exe
  C:\Windows\System\YoYjLCs.exe
  2⤵
  PID:11840
- C:\Windows\System\EBtzVUO.exe
  C:\Windows\System\EBtzVUO.exe
  2⤵
  PID:11860
- C:\Windows\System\PWXTORu.exe
  C:\Windows\System\PWXTORu.exe
  2⤵
  PID:11884
- C:\Windows\System\EMWxpDF.exe
  C:\Windows\System\EMWxpDF.exe
  2⤵
  PID:11900
- C:\Windows\System\TtYxylo.exe
  C:\Windows\System\TtYxylo.exe
  2⤵
  PID:11928
- C:\Windows\System\GPLaiUe.exe
  C:\Windows\System\GPLaiUe.exe
  2⤵
  PID:11948
- C:\Windows\System\eGQMcho.exe
  C:\Windows\System\eGQMcho.exe
  2⤵
  PID:11972
- C:\Windows\System\gFXwRgg.exe
  C:\Windows\System\gFXwRgg.exe
  2⤵
  PID:11996
- C:\Windows\System\eStSjIC.exe
  C:\Windows\System\eStSjIC.exe
  2⤵
  PID:12032
- C:\Windows\System\dZlGtCn.exe
  C:\Windows\System\dZlGtCn.exe
  2⤵
  PID:12056
- C:\Windows\System\SDJWvQZ.exe
  C:\Windows\System\SDJWvQZ.exe
  2⤵
  PID:12080
- C:\Windows\System\BDkhwFL.exe
  C:\Windows\System\BDkhwFL.exe
  2⤵
  PID:12116
- C:\Windows\System\nVfzFvH.exe
  C:\Windows\System\nVfzFvH.exe
  2⤵
  PID:12140
- C:\Windows\System\UrTrjLx.exe
  C:\Windows\System\UrTrjLx.exe
  2⤵
  PID:12168
- C:\Windows\System\ZWGQOdy.exe
  C:\Windows\System\ZWGQOdy.exe
  2⤵
  PID:12208
- C:\Windows\System\dZcgIQg.exe
  C:\Windows\System\dZcgIQg.exe
  2⤵
  PID:12224
- C:\Windows\System\KpKUmAr.exe
  C:\Windows\System\KpKUmAr.exe
  2⤵
  PID:12252
- C:\Windows\System\oMBxRxS.exe
  C:\Windows\System\oMBxRxS.exe
  2⤵
  PID:12276
- C:\Windows\System\XyStbUA.exe
  C:\Windows\System\XyStbUA.exe
  2⤵
  PID:3136
- C:\Windows\System\OZuYHmF.exe
  C:\Windows\System\OZuYHmF.exe
  2⤵
  PID:1936
- C:\Windows\System\XzHuPxb.exe
  C:\Windows\System\XzHuPxb.exe
  2⤵
  PID:3588
- C:\Windows\System\uCfkYIj.exe
  C:\Windows\System\uCfkYIj.exe
  2⤵
  PID:11324
- C:\Windows\System\BRLNbrn.exe
  C:\Windows\System\BRLNbrn.exe
  2⤵
  PID:10720
- C:\Windows\System\EKxRgJo.exe
  C:\Windows\System\EKxRgJo.exe
  2⤵
  PID:11384
- C:\Windows\System\impxdEy.exe
  C:\Windows\System\impxdEy.exe
  2⤵
  PID:11332
- C:\Windows\System\msAPayg.exe
  C:\Windows\System\msAPayg.exe
  2⤵
  PID:11592
- C:\Windows\System\KrXjpkr.exe
  C:\Windows\System\KrXjpkr.exe
  2⤵
  PID:11412
- C:\Windows\System\qtItsXR.exe
  C:\Windows\System\qtItsXR.exe
  2⤵
  PID:11564
- C:\Windows\System\bLXFXTa.exe
  C:\Windows\System\bLXFXTa.exe
  2⤵
  PID:11616
- C:\Windows\System\HjcsZjD.exe
  C:\Windows\System\HjcsZjD.exe
  2⤵
  PID:11568
- C:\Windows\System\KAdEESp.exe
  C:\Windows\System\KAdEESp.exe
  2⤵
  PID:11752
- C:\Windows\System\MelbIeh.exe
  C:\Windows\System\MelbIeh.exe
  2⤵
  PID:11728
- C:\Windows\System\pKfIIhZ.exe
  C:\Windows\System\pKfIIhZ.exe
  2⤵
  PID:11820
- C:\Windows\System\jzWQBhJ.exe
  C:\Windows\System\jzWQBhJ.exe
  2⤵
  PID:11872
- C:\Windows\System\rbGqjll.exe
  C:\Windows\System\rbGqjll.exe
  2⤵
  PID:12016
- C:\Windows\System\wEGXiYD.exe
  C:\Windows\System\wEGXiYD.exe
  2⤵
  PID:11940
- C:\Windows\System\TApdPmi.exe
  C:\Windows\System\TApdPmi.exe
  2⤵
  PID:12200
- C:\Windows\System\SnaHerI.exe
  C:\Windows\System\SnaHerI.exe
  2⤵
  PID:12220
- C:\Windows\System\CxpUgbT.exe
  C:\Windows\System\CxpUgbT.exe
  2⤵
  PID:12268
- C:\Windows\System\UHQkyZZ.exe
  C:\Windows\System\UHQkyZZ.exe
  2⤵
  PID:2936
- C:\Windows\System\JfcHrQt.exe
  C:\Windows\System\JfcHrQt.exe
  2⤵
  PID:4684
- C:\Windows\System\ISITTiO.exe
  C:\Windows\System\ISITTiO.exe
  2⤵
  PID:11544
- C:\Windows\System\ZEDgjcw.exe
  C:\Windows\System\ZEDgjcw.exe
  2⤵
  PID:11668
- C:\Windows\System\BHhWMXV.exe
  C:\Windows\System\BHhWMXV.exe
  2⤵
  PID:3260
- C:\Windows\System\yIqlDwH.exe
  C:\Windows\System\yIqlDwH.exe
  2⤵
  PID:11280
- C:\Windows\System\VdWzmJl.exe
  C:\Windows\System\VdWzmJl.exe
  2⤵
  PID:11404
- C:\Windows\System\oSSEorD.exe
  C:\Windows\System\oSSEorD.exe
  2⤵
  PID:11644
- C:\Windows\System\eOWgLnh.exe
  C:\Windows\System\eOWgLnh.exe
  2⤵
  PID:11992
- C:\Windows\System\SZtsnkE.exe
  C:\Windows\System\SZtsnkE.exe
  2⤵
  PID:12304
- C:\Windows\System\SpKEdhL.exe
  C:\Windows\System\SpKEdhL.exe
  2⤵
  PID:12340
- C:\Windows\System\ZVFDXJO.exe
  C:\Windows\System\ZVFDXJO.exe
  2⤵
  PID:12368
- C:\Windows\System\aWCrFNi.exe
  C:\Windows\System\aWCrFNi.exe
  2⤵
  PID:12400
- C:\Windows\System\dxdpiau.exe
  C:\Windows\System\dxdpiau.exe
  2⤵
  PID:12440
- C:\Windows\System\iBkxZSz.exe
  C:\Windows\System\iBkxZSz.exe
  2⤵
  PID:12460
- C:\Windows\System\JyVeRKm.exe
  C:\Windows\System\JyVeRKm.exe
  2⤵
  PID:12484
- C:\Windows\System\oPsfzFf.exe
  C:\Windows\System\oPsfzFf.exe
  2⤵
  PID:12508
- C:\Windows\System\fezngiI.exe
  C:\Windows\System\fezngiI.exe
  2⤵
  PID:12672
- C:\Windows\System\YSaAgvV.exe
  C:\Windows\System\YSaAgvV.exe
  2⤵
  PID:12688
- C:\Windows\System\VCAYYDs.exe
  C:\Windows\System\VCAYYDs.exe
  2⤵
  PID:12712
- C:\Windows\System\AjTaPEs.exe
  C:\Windows\System\AjTaPEs.exe
  2⤵
  PID:12736
- C:\Windows\System\hZMaxQF.exe
  C:\Windows\System\hZMaxQF.exe
  2⤵
  PID:12756
- C:\Windows\System\GTPgnUv.exe
  C:\Windows\System\GTPgnUv.exe
  2⤵
  PID:12780
- C:\Windows\System\uwybJgz.exe
  C:\Windows\System\uwybJgz.exe
  2⤵
  PID:12800
- C:\Windows\System\qpKOejs.exe
  C:\Windows\System\qpKOejs.exe
  2⤵
  PID:12832
- C:\Windows\System\uilVPmh.exe
  C:\Windows\System\uilVPmh.exe
  2⤵
  PID:12856
- C:\Windows\System\LmtpASL.exe
  C:\Windows\System\LmtpASL.exe
  2⤵
  PID:12880
- C:\Windows\System\tRacogH.exe
  C:\Windows\System\tRacogH.exe
  2⤵
  PID:12908
- C:\Windows\System\FnSZWSb.exe
  C:\Windows\System\FnSZWSb.exe
  2⤵
  PID:12936
- C:\Windows\System\NNTqseJ.exe
  C:\Windows\System\NNTqseJ.exe
  2⤵
  PID:12968
- C:\Windows\System\VdIAHMx.exe
  C:\Windows\System\VdIAHMx.exe
  2⤵
  PID:12988
- C:\Windows\System\YkVXBwP.exe
  C:\Windows\System\YkVXBwP.exe
  2⤵
  PID:13008
- C:\Windows\System\dMCAbOP.exe
  C:\Windows\System\dMCAbOP.exe
  2⤵
  PID:13040
- C:\Windows\System\XBpYYZA.exe
  C:\Windows\System\XBpYYZA.exe
  2⤵
  PID:13056
- C:\Windows\System\TgLLEPJ.exe
  C:\Windows\System\TgLLEPJ.exe
  2⤵
  PID:13088
- C:\Windows\System\DdrGYyZ.exe
  C:\Windows\System\DdrGYyZ.exe
  2⤵
  PID:13116
- C:\Windows\System\mEHGXfb.exe
  C:\Windows\System\mEHGXfb.exe
  2⤵
  PID:13148
- C:\Windows\System\FTSbxbv.exe
  C:\Windows\System\FTSbxbv.exe
  2⤵
  PID:13172
- C:\Windows\System\CXkaVRT.exe
  C:\Windows\System\CXkaVRT.exe
  2⤵
  PID:13208
- C:\Windows\System\LCunhCI.exe
  C:\Windows\System\LCunhCI.exe
  2⤵
  PID:13240
- C:\Windows\System\FoHAHzn.exe
  C:\Windows\System\FoHAHzn.exe
  2⤵
  PID:13268
- C:\Windows\System\gcGnsVp.exe
  C:\Windows\System\gcGnsVp.exe
  2⤵
  PID:13300
- C:\Windows\System\TBZtuUW.exe
  C:\Windows\System\TBZtuUW.exe
  2⤵
  PID:11320
- C:\Windows\System\jRsBZMS.exe
  C:\Windows\System\jRsBZMS.exe
  2⤵
  PID:1900
- C:\Windows\System\ckonEOf.exe
  C:\Windows\System\ckonEOf.exe
  2⤵
  PID:12284
- C:\Windows\System\mUrncIU.exe
  C:\Windows\System\mUrncIU.exe
  2⤵
  PID:12348
- C:\Windows\System\vsDNrJU.exe
  C:\Windows\System\vsDNrJU.exe
  2⤵
  PID:11824
- C:\Windows\System\TkEgTWN.exe
  C:\Windows\System\TkEgTWN.exe
  2⤵
  PID:3508
- C:\Windows\System\gNuhUkV.exe
  C:\Windows\System\gNuhUkV.exe
  2⤵
  PID:4632
- C:\Windows\System\RsfuCMp.exe
  C:\Windows\System\RsfuCMp.exe
  2⤵
  PID:12292
- C:\Windows\System\jzJjWWD.exe
  C:\Windows\System\jzJjWWD.exe
  2⤵
  PID:12516
- C:\Windows\System\NHZjJIA.exe
  C:\Windows\System\NHZjJIA.exe
  2⤵
  PID:12664
- C:\Windows\System\tYVKHQy.exe
  C:\Windows\System\tYVKHQy.exe
  2⤵
  PID:12380
- C:\Windows\System\SpxNNjo.exe
  C:\Windows\System\SpxNNjo.exe
  2⤵
  PID:12772
- C:\Windows\System\iKLZoEN.exe
  C:\Windows\System\iKLZoEN.exe
  2⤵
  PID:12796
- C:\Windows\System\FhCgiMu.exe
  C:\Windows\System\FhCgiMu.exe
  2⤵
  PID:12960
- C:\Windows\System\kPMHCra.exe
  C:\Windows\System\kPMHCra.exe
  2⤵
  PID:12852
- C:\Windows\System\TfAcpha.exe
  C:\Windows\System\TfAcpha.exe
  2⤵
  PID:13004
- C:\Windows\System\YWdeeWx.exe
  C:\Windows\System\YWdeeWx.exe
  2⤵
  PID:13096
- C:\Windows\System\DJUJULS.exe
  C:\Windows\System\DJUJULS.exe
  2⤵
  PID:12996
- C:\Windows\System\Kqfxgcv.exe
  C:\Windows\System\Kqfxgcv.exe
  2⤵
  PID:13132
- C:\Windows\System\JIAwOwN.exe
  C:\Windows\System\JIAwOwN.exe
  2⤵
  PID:13184
- C:\Windows\System\HMqyLzM.exe
  C:\Windows\System\HMqyLzM.exe
  2⤵
  PID:13080
- C:\Windows\System\JCkpANu.exe
  C:\Windows\System\JCkpANu.exe
  2⤵
  PID:12312
- C:\Windows\System\XMCKMoJ.exe
  C:\Windows\System\XMCKMoJ.exe
  2⤵
  PID:4856
- C:\Windows\System\DrNhybB.exe
  C:\Windows\System\DrNhybB.exe
  2⤵
  PID:11520
- C:\Windows\System\GmiLbgG.exe
  C:\Windows\System\GmiLbgG.exe
  2⤵
  PID:12192
- C:\Windows\System\WqCzygK.exe
  C:\Windows\System\WqCzygK.exe
  2⤵
  PID:12436
- C:\Windows\System\EuWSVFF.exe
  C:\Windows\System\EuWSVFF.exe
  2⤵
  PID:12104
- C:\Windows\System\WELJOyK.exe
  C:\Windows\System\WELJOyK.exe
  2⤵
  PID:13164
- C:\Windows\System\ABZFGRG.exe
  C:\Windows\System\ABZFGRG.exe
  2⤵
  PID:12384
- C:\Windows\System\meWxsNW.exe
  C:\Windows\System\meWxsNW.exe
  2⤵
  PID:13248
- C:\Windows\System\YiPUJfC.exe
  C:\Windows\System\YiPUJfC.exe
  2⤵
  PID:12916
- C:\Windows\System\mLggRFW.exe
  C:\Windows\System\mLggRFW.exe
  2⤵
  PID:13352
- C:\Windows\System\fogFhez.exe
  C:\Windows\System\fogFhez.exe
  2⤵
  PID:13388
- C:\Windows\System\gHrJBQh.exe
  C:\Windows\System\gHrJBQh.exe
  2⤵
  PID:13424
- C:\Windows\System\BpkBveu.exe
  C:\Windows\System\BpkBveu.exe
  2⤵
  PID:13448
- C:\Windows\System\gbmwteo.exe
  C:\Windows\System\gbmwteo.exe
  2⤵
  PID:13480
- C:\Windows\System\yPHAADE.exe
  C:\Windows\System\yPHAADE.exe
  2⤵
  PID:13500
- C:\Windows\System\hWtWMIE.exe
  C:\Windows\System\hWtWMIE.exe
  2⤵
  PID:13532
- C:\Windows\System\XZtgaJk.exe
  C:\Windows\System\XZtgaJk.exe
  2⤵
  PID:13552
- C:\Windows\System\vlvQyNh.exe
  C:\Windows\System\vlvQyNh.exe
  2⤵
  PID:13576
- C:\Windows\System\FVHCtIq.exe
  C:\Windows\System\FVHCtIq.exe
  2⤵
  PID:13604
- C:\Windows\System\eazglUo.exe
  C:\Windows\System\eazglUo.exe
  2⤵
  PID:13652
- C:\Windows\System\pYHQZIp.exe
  C:\Windows\System\pYHQZIp.exe
  2⤵
  PID:13668
- C:\Windows\System\illOuqa.exe
  C:\Windows\System\illOuqa.exe
  2⤵
  PID:13696
- C:\Windows\System\PDsFkkH.exe
  C:\Windows\System\PDsFkkH.exe
  2⤵
  PID:13728
- C:\Windows\System\xRcRYPC.exe
  C:\Windows\System\xRcRYPC.exe
  2⤵
  PID:13752
- C:\Windows\System\zyfqxtP.exe
  C:\Windows\System\zyfqxtP.exe
  2⤵
  PID:13784
- C:\Windows\System\vGWTQdu.exe
  C:\Windows\System\vGWTQdu.exe
  2⤵
  PID:13808
- C:\Windows\System\qvSfgSH.exe
  C:\Windows\System\qvSfgSH.exe
  2⤵
  PID:13840
- C:\Windows\System\whowted.exe
  C:\Windows\System\whowted.exe
  2⤵
  PID:13860
- C:\Windows\System\qdMZFPx.exe
  C:\Windows\System\qdMZFPx.exe
  2⤵
  PID:13896
- C:\Windows\System\jNYQkdB.exe
  C:\Windows\System\jNYQkdB.exe
  2⤵
  PID:13916
- C:\Windows\System\yRpRxoF.exe
  C:\Windows\System\yRpRxoF.exe
  2⤵
  PID:13948
- C:\Windows\System\NqLYZBe.exe
  C:\Windows\System\NqLYZBe.exe
  2⤵
  PID:13972
- C:\Windows\System\ggQjZtw.exe
  C:\Windows\System\ggQjZtw.exe
  2⤵
  PID:13996
- C:\Windows\System\OZoBJBk.exe
  C:\Windows\System\OZoBJBk.exe
  2⤵
  PID:14020
- C:\Windows\System\FbdddJt.exe
  C:\Windows\System\FbdddJt.exe
  2⤵
  PID:14040
- C:\Windows\System\ZQFkqfN.exe
  C:\Windows\System\ZQFkqfN.exe
  2⤵
  PID:14060
- C:\Windows\System\AVPfzYq.exe
  C:\Windows\System\AVPfzYq.exe
  2⤵
  PID:14092
- C:\Windows\System\AhxgDrp.exe
  C:\Windows\System\AhxgDrp.exe
  2⤵
  PID:14116
- C:\Windows\System\OwEckSO.exe
  C:\Windows\System\OwEckSO.exe
  2⤵
  PID:14136
- C:\Windows\System\RurriFc.exe
  C:\Windows\System\RurriFc.exe
  2⤵
  PID:14164
- C:\Windows\System\ssGrjRT.exe
  C:\Windows\System\ssGrjRT.exe
  2⤵
  PID:14196
- C:\Windows\System\jRVYmVg.exe
  C:\Windows\System\jRVYmVg.exe
  2⤵
  PID:14220
- C:\Windows\System\yuXHRMh.exe
  C:\Windows\System\yuXHRMh.exe
  2⤵
  PID:14248
- C:\Windows\System\InFRATB.exe
  C:\Windows\System\InFRATB.exe
  2⤵
  PID:14272
- C:\Windows\System\bfXEGJB.exe
  C:\Windows\System\bfXEGJB.exe
  2⤵
  PID:14304
- C:\Windows\System\VdFZYMs.exe
  C:\Windows\System\VdFZYMs.exe
  2⤵
  PID:14328
- C:\Windows\System\eQiCyyZ.exe
  C:\Windows\System\eQiCyyZ.exe
  2⤵
  PID:13296
- C:\Windows\System\cqSQNba.exe
  C:\Windows\System\cqSQNba.exe
  2⤵
  PID:13408
- C:\Windows\System\ZGvonnG.exe
  C:\Windows\System\ZGvonnG.exe
  2⤵
  PID:13524
- C:\Windows\System\usbSGkk.exe
  C:\Windows\System\usbSGkk.exe
  2⤵
  PID:13560
- C:\Windows\System\ZwznNkS.exe
  C:\Windows\System\ZwznNkS.exe
  2⤵
  PID:13456
- C:\Windows\System\PwiihrH.exe
  C:\Windows\System\PwiihrH.exe
  2⤵
  PID:13488
- C:\Windows\System\MDssYfR.exe
  C:\Windows\System\MDssYfR.exe
  2⤵
  PID:13548
- C:\Windows\System\ZztJZAN.exe
  C:\Windows\System\ZztJZAN.exe
  2⤵
  PID:13712
- C:\Windows\System\wWRdTOl.exe
  C:\Windows\System\wWRdTOl.exe
  2⤵
  PID:13684
- C:\Windows\System\YasIvcj.exe
  C:\Windows\System\YasIvcj.exe
  2⤵
  PID:13820
- C:\Windows\System\LIKCcfA.exe
  C:\Windows\System\LIKCcfA.exe
  2⤵
  PID:13852
- C:\Windows\System\zWsmGkw.exe
  C:\Windows\System\zWsmGkw.exe
  2⤵
  PID:13980
- C:\Windows\System\JBQoOsp.exe
  C:\Windows\System\JBQoOsp.exe
  2⤵
  PID:14012
- C:\Windows\System\CBGeehl.exe
  C:\Windows\System\CBGeehl.exe
  2⤵
  PID:14032
- C:\Windows\System\zDtsgmC.exe
  C:\Windows\System\zDtsgmC.exe
  2⤵
  PID:14152
- C:\Windows\System\zkVkTkr.exe
  C:\Windows\System\zkVkTkr.exe
  2⤵
  PID:1908
- C:\Windows\System\DnqkRmM.exe
  C:\Windows\System\DnqkRmM.exe
  2⤵
  PID:14264
- C:\Windows\System\cGtlzsU.exe
  C:\Windows\System\cGtlzsU.exe
  2⤵
  PID:14104
- C:\Windows\System\SQoTbSS.exe
  C:\Windows\System\SQoTbSS.exe
  2⤵
  PID:14320
- C:\Windows\System\McamplM.exe
  C:\Windows\System\McamplM.exe
  2⤵
  PID:14216
- C:\Windows\System\gYxnKrY.exe
  C:\Windows\System\gYxnKrY.exe
  2⤵
  PID:13640
- C:\Windows\System\yrtJmzN.exe
  C:\Windows\System\yrtJmzN.exe
  2⤵
  PID:13664
- C:\Windows\System\QJJMRMz.exe
  C:\Windows\System\QJJMRMz.exe
  2⤵
  PID:13636
- C:\Windows\System\vzsqjaY.exe
  C:\Windows\System\vzsqjaY.exe
  2⤵
  PID:13932
- C:\Windows\System\CnqOfsj.exe
  C:\Windows\System\CnqOfsj.exe
  2⤵
  PID:12336
- C:\Windows\System\UOokOBZ.exe
  C:\Windows\System\UOokOBZ.exe
  2⤵
  PID:13968
- C:\Windows\System\IfzaiMV.exe
  C:\Windows\System\IfzaiMV.exe
  2⤵
  PID:14236
- C:\Windows\System\lWfyfdy.exe
  C:\Windows\System\lWfyfdy.exe
  2⤵
  PID:14344
- C:\Windows\System\Urwrbtx.exe
  C:\Windows\System\Urwrbtx.exe
  2⤵
  PID:14368
- C:\Windows\System\MzPFYHU.exe
  C:\Windows\System\MzPFYHU.exe
  2⤵
  PID:14384
- C:\Windows\System\rQUQelw.exe
  C:\Windows\System\rQUQelw.exe
  2⤵
  PID:14412
- C:\Windows\System\jToUlLy.exe
  C:\Windows\System\jToUlLy.exe
  2⤵
  PID:14428
- C:\Windows\System\UOOyzka.exe
  C:\Windows\System\UOOyzka.exe
  2⤵
  PID:14476
- C:\Windows\System\EaxulwI.exe
  C:\Windows\System\EaxulwI.exe
  2⤵
  PID:14492
- C:\Windows\System\jdRUGYn.exe
  C:\Windows\System\jdRUGYn.exe
  2⤵
  PID:14520
- C:\Windows\System\hmJrhXb.exe
  C:\Windows\System\hmJrhXb.exe
  2⤵
  PID:14536
- C:\Windows\System\qaZZpOa.exe
  C:\Windows\System\qaZZpOa.exe
  2⤵
  PID:14560
- C:\Windows\System\JguSzNp.exe
  C:\Windows\System\JguSzNp.exe
  2⤵
  PID:14576
- C:\Windows\System\bhgPNFI.exe
  C:\Windows\System\bhgPNFI.exe
  2⤵
  PID:14612
- C:\Windows\System\vADySSb.exe
  C:\Windows\System\vADySSb.exe
  2⤵
  PID:14640
- C:\Windows\System\SEbwFXB.exe
  C:\Windows\System\SEbwFXB.exe
  2⤵
  PID:14676
- C:\Windows\System\RFXXiEw.exe
  C:\Windows\System\RFXXiEw.exe
  2⤵
  PID:14704
- C:\Windows\System\fxDllYc.exe
  C:\Windows\System\fxDllYc.exe
  2⤵
  PID:14724
- C:\Windows\System\mQFaadN.exe
  C:\Windows\System\mQFaadN.exe
  2⤵
  PID:14744
- C:\Windows\System\trMynUL.exe
  C:\Windows\System\trMynUL.exe
  2⤵
  PID:14772
- C:\Windows\System\RESOvkd.exe
  C:\Windows\System\RESOvkd.exe
  2⤵
  PID:14800
- C:\Windows\System\LarKatV.exe
  C:\Windows\System\LarKatV.exe
  2⤵
  PID:14828
- C:\Windows\System\xRNWOlx.exe
  C:\Windows\System\xRNWOlx.exe
  2⤵
  PID:14852
- C:\Windows\System\QKwovXK.exe
  C:\Windows\System\QKwovXK.exe
  2⤵
  PID:14880
- C:\Windows\System\XUalanz.exe
  C:\Windows\System\XUalanz.exe
  2⤵
  PID:14924
- C:\Windows\System\lKKNoLN.exe
  C:\Windows\System\lKKNoLN.exe
  2⤵
  PID:14952
- C:\Windows\System\cQCZepl.exe
  C:\Windows\System\cQCZepl.exe
  2⤵
  PID:14984
- C:\Windows\System\sytcIJF.exe
  C:\Windows\System\sytcIJF.exe
  2⤵
  PID:15008
- C:\Windows\System\huRpoMr.exe
  C:\Windows\System\huRpoMr.exe
  2⤵
  PID:15040
- C:\Windows\System\pisMqJQ.exe
  C:\Windows\System\pisMqJQ.exe
  2⤵
  PID:15060
- C:\Windows\System\zLdZXye.exe
  C:\Windows\System\zLdZXye.exe
  2⤵
  PID:15092
- C:\Windows\System\UfPwXHC.exe
  C:\Windows\System\UfPwXHC.exe
  2⤵
  PID:15120
- C:\Windows\System\XFZPRpk.exe
  C:\Windows\System\XFZPRpk.exe
  2⤵
  PID:15140
- C:\Windows\System\CeHEzLc.exe
  C:\Windows\System\CeHEzLc.exe
  2⤵
  PID:15168
- C:\Windows\System\ovvjIto.exe
  C:\Windows\System\ovvjIto.exe
  2⤵
  PID:15200
- C:\Windows\System\ZGRdvWL.exe
  C:\Windows\System\ZGRdvWL.exe
  2⤵
  PID:15220
- C:\Windows\System\klxryaW.exe
  C:\Windows\System\klxryaW.exe
  2⤵
  PID:15244
- C:\Windows\System\pmTRfwd.exe
  C:\Windows\System\pmTRfwd.exe
  2⤵
  PID:15276
- C:\Windows\System\lWQjVGP.exe
  C:\Windows\System\lWQjVGP.exe
  2⤵
  PID:15292
- C:\Windows\System\TmkotiY.exe
  C:\Windows\System\TmkotiY.exe
  2⤵
  PID:15328
- C:\Windows\System\GYWwBSq.exe
  C:\Windows\System\GYWwBSq.exe
  2⤵
  PID:15348
- C:\Windows\System\pBjJTKF.exe
  C:\Windows\System\pBjJTKF.exe
  2⤵
  PID:12748
- C:\Windows\System\hOPJjAd.exe
  C:\Windows\System\hOPJjAd.exe
  2⤵
  PID:12976
- C:\Windows\System\SGuASDD.exe
  C:\Windows\System\SGuASDD.exe
  2⤵
  PID:13584
- C:\Windows\System\fPDUVSn.exe
  C:\Windows\System\fPDUVSn.exe
  2⤵
  PID:14512
- C:\Windows\System\cSrfzjU.exe
  C:\Windows\System\cSrfzjU.exe
  2⤵
  PID:14288
- C:\Windows\System\QYNFMzu.exe
  C:\Windows\System\QYNFMzu.exe
  2⤵
  PID:14420
- C:\Windows\System\otOgODN.exe
  C:\Windows\System\otOgODN.exe
  2⤵
  PID:13876
- C:\Windows\System\HiYIOaG.exe
  C:\Windows\System\HiYIOaG.exe
  2⤵
  PID:14604
- C:\Windows\System\nIcQBDT.exe
  C:\Windows\System\nIcQBDT.exe
  2⤵
  PID:14652
- C:\Windows\System\RTjPDXg.exe
  C:\Windows\System\RTjPDXg.exe
  2⤵
  PID:14672
- C:\Windows\System\qLJkAQI.exe
  C:\Windows\System\qLJkAQI.exe
  2⤵
  PID:14740
- C:\Windows\System\aCLhLHF.exe
  C:\Windows\System\aCLhLHF.exe
  2⤵
  PID:14572
- C:\Windows\System\whlPuBs.exe
  C:\Windows\System\whlPuBs.exe
  2⤵
  PID:14896
- C:\Windows\System\lvTNedD.exe
  C:\Windows\System\lvTNedD.exe
  2⤵
  PID:14732
- C:\Windows\System\xrRhPGW.exe
  C:\Windows\System\xrRhPGW.exe
  2⤵
  PID:14688
- C:\Windows\System\QdPTvlt.exe
  C:\Windows\System\QdPTvlt.exe
  2⤵
  PID:14892
- C:\Windows\System\uEJJBjd.exe
  C:\Windows\System\uEJJBjd.exe
  2⤵
  PID:15116
- C:\Windows\System\GDeJcLv.exe
  C:\Windows\System\GDeJcLv.exe
  2⤵
  PID:15156
- C:\Windows\System\rvNISvq.exe
  C:\Windows\System\rvNISvq.exe
  2⤵
  PID:15196
- C:\Windows\System\PBjRyWF.exe
  C:\Windows\System\PBjRyWF.exe
  2⤵
  PID:14764
- C:\Windows\System\oMRRSgJ.exe
  C:\Windows\System\oMRRSgJ.exe
  2⤵
  PID:15252
- C:\Windows\System\sbbIGrF.exe
  C:\Windows\System\sbbIGrF.exe
  2⤵
  PID:14816
- C:\Windows\System\ZfrCkTy.exe
  C:\Windows\System\ZfrCkTy.exe
  2⤵
  PID:13984
- C:\Windows\System\npqqXaO.exe
  C:\Windows\System\npqqXaO.exe
  2⤵
  PID:14584
- C:\Windows\System\mueOkAg.exe
  C:\Windows\System\mueOkAg.exe
  2⤵
  PID:14360
- C:\Windows\System\FvpvBVy.exe
  C:\Windows\System\FvpvBVy.exe
  2⤵
  PID:14848
- C:\Windows\System\xVhpEST.exe
  C:\Windows\System\xVhpEST.exe
  2⤵
  PID:15376
- C:\Windows\System\vFDxTCd.exe
  C:\Windows\System\vFDxTCd.exe
  2⤵
  PID:15400
- C:\Windows\System\RKNzcyG.exe
  C:\Windows\System\RKNzcyG.exe
  2⤵
  PID:15416
- C:\Windows\System\qsXdMxO.exe
  C:\Windows\System\qsXdMxO.exe
  2⤵
  PID:15436
- C:\Windows\System\AuUuyoh.exe
  C:\Windows\System\AuUuyoh.exe
  2⤵
  PID:15452
- C:\Windows\System\UWvWkxo.exe
  C:\Windows\System\UWvWkxo.exe
  2⤵
  PID:15480
- C:\Windows\System\KuFfpfO.exe
  C:\Windows\System\KuFfpfO.exe
  2⤵
  PID:15504
- C:\Windows\System\xEzhwYH.exe
  C:\Windows\System\xEzhwYH.exe
  2⤵
  PID:15528
- C:\Windows\System\gQYEfWB.exe
  C:\Windows\System\gQYEfWB.exe
  2⤵
  PID:15548
- C:\Windows\System\CAsrxuX.exe
  C:\Windows\System\CAsrxuX.exe
  2⤵
  PID:15580
- C:\Windows\System\AmWCnAH.exe
  C:\Windows\System\AmWCnAH.exe
  2⤵
  PID:15600
- C:\Windows\System\IDybsfK.exe
  C:\Windows\System\IDybsfK.exe
  2⤵
  PID:15628
- C:\Windows\System\TLNmtWc.exe
  C:\Windows\System\TLNmtWc.exe
  2⤵
  PID:15648
- C:\Windows\System\QlfWmat.exe
  C:\Windows\System\QlfWmat.exe
  2⤵
  PID:15676
- C:\Windows\System\QBtCVOy.exe
  C:\Windows\System\QBtCVOy.exe
  2⤵
  PID:15696
- C:\Windows\System\rbAxfUp.exe
  C:\Windows\System\rbAxfUp.exe
  2⤵
  PID:15728
- C:\Windows\System\MPTREfh.exe
  C:\Windows\System\MPTREfh.exe
  2⤵
  PID:15744
- C:\Windows\System\JceLchh.exe
  C:\Windows\System\JceLchh.exe
  2⤵
  PID:15780
- C:\Windows\System\xDfjNVh.exe
  C:\Windows\System\xDfjNVh.exe
  2⤵
  PID:15812
- C:\Windows\System\zIQpyLL.exe
  C:\Windows\System\zIQpyLL.exe
  2⤵
  PID:15828
- C:\Windows\System\VZXayOM.exe
  C:\Windows\System\VZXayOM.exe
  2⤵
  PID:15844
- C:\Windows\System\AOavevQ.exe
  C:\Windows\System\AOavevQ.exe
  2⤵
  PID:15864
- C:\Windows\System\ICihqIg.exe
  C:\Windows\System\ICihqIg.exe
  2⤵
  PID:15888
- C:\Windows\System\rzQMjhi.exe
  C:\Windows\System\rzQMjhi.exe
  2⤵
  PID:15916
- C:\Windows\System\Kohvemk.exe
  C:\Windows\System\Kohvemk.exe
  2⤵
  PID:15936
- C:\Windows\System\YRBxCFB.exe
  C:\Windows\System\YRBxCFB.exe
  2⤵
  PID:15960
- C:\Windows\System\riTDmVG.exe
  C:\Windows\System\riTDmVG.exe
  2⤵
  PID:15980
- C:\Windows\System\fsfbpmX.exe
  C:\Windows\System\fsfbpmX.exe
  2⤵
  PID:16016
- C:\Windows\System\wPpfOcT.exe
  C:\Windows\System\wPpfOcT.exe
  2⤵
  PID:16036
- C:\Windows\System\CIoYLDT.exe
  C:\Windows\System\CIoYLDT.exe
  2⤵
  PID:16060
- C:\Windows\System\VGcsrJC.exe
  C:\Windows\System\VGcsrJC.exe
  2⤵
  PID:16096
- - C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -u -p 16096 -s 220
    3⤵
    PID:15216
- C:\Windows\System\EChxWhh.exe
  C:\Windows\System\EChxWhh.exe
  2⤵
  PID:16124
- C:\Windows\System\YmpwKZA.exe
  C:\Windows\System\YmpwKZA.exe
  2⤵
  PID:16140
- C:\Windows\System\GKhDpUn.exe
  C:\Windows\System\GKhDpUn.exe
  2⤵
  PID:16160
- C:\Windows\System\oQEmpuY.exe
  C:\Windows\System\oQEmpuY.exe
  2⤵
  PID:16188
- C:\Windows\System\AqvaZZp.exe
  C:\Windows\System\AqvaZZp.exe
  2⤵
  PID:16208
- C:\Windows\System\jNRWgKH.exe
  C:\Windows\System\jNRWgKH.exe
  2⤵
  PID:16228
- C:\Windows\System\nBCpvWW.exe
  C:\Windows\System\nBCpvWW.exe
  2⤵
  PID:16256
- C:\Windows\System\bRTNCdd.exe
  C:\Windows\System\bRTNCdd.exe
  2⤵
  PID:16284
- C:\Windows\System\yZPmQUb.exe
  C:\Windows\System\yZPmQUb.exe
  2⤵
  PID:16312
- C:\Windows\System\vvWpwUA.exe
  C:\Windows\System\vvWpwUA.exe
  2⤵
  PID:16352
- C:\Windows\System\lbWURIw.exe
  C:\Windows\System\lbWURIw.exe
  2⤵
  PID:16368
- C:\Windows\System\IQwnBhH.exe
  C:\Windows\System\IQwnBhH.exe
  2⤵
  PID:15112
- C:\Windows\System\rdfjRbN.exe
  C:\Windows\System\rdfjRbN.exe
  2⤵
  PID:15316
- C:\Windows\System\ioWKMrC.exe
  C:\Windows\System\ioWKMrC.exe
  2⤵
  PID:14736
- C:\Windows\System\bawZfxt.exe
  C:\Windows\System\bawZfxt.exe
  2⤵
  PID:15236
- C:\Windows\System\GRghHbg.exe
  C:\Windows\System\GRghHbg.exe
  2⤵
  PID:15392
- C:\Windows\System\pthzMaA.exe
  C:\Windows\System\pthzMaA.exe
  2⤵
  PID:15460
- C:\Windows\System\vxDwcuC.exe
  C:\Windows\System\vxDwcuC.exe
  2⤵
  PID:15000
- C:\Windows\System\lNvYFop.exe
  C:\Windows\System\lNvYFop.exe
  2⤵
  PID:14768
- C:\Windows\System\SqxXGix.exe
  C:\Windows\System\SqxXGix.exe
  2⤵
  PID:14548
- C:\Windows\System\AnqibAX.exe
  C:\Windows\System\AnqibAX.exe
  2⤵
  PID:1588
- C:\Windows\System\JNEEyxB.exe
  C:\Windows\System\JNEEyxB.exe
  2⤵
  PID:15692
- C:\Windows\System\gFmNScF.exe
  C:\Windows\System\gFmNScF.exe
  2⤵
  PID:15740
- C:\Windows\System\ALprwto.exe
  C:\Windows\System\ALprwto.exe
  2⤵
  PID:15804
- C:\Windows\System\fsNrzUz.exe
  C:\Windows\System\fsNrzUz.exe
  2⤵
  PID:15836
- C:\Windows\System\VZuqciS.exe
  C:\Windows\System\VZuqciS.exe
  2⤵
  PID:14980
- C:\Windows\System\DhREGoX.exe
  C:\Windows\System\DhREGoX.exe
  2⤵
  PID:15612
- C:\Windows\System\bCCcizG.exe
  C:\Windows\System\bCCcizG.exe
  2⤵
  PID:16044
- C:\Windows\System\StbHnax.exe
  C:\Windows\System\StbHnax.exe
  2⤵
  PID:15820
- C:\Windows\System\GMCEJCS.exe
  C:\Windows\System\GMCEJCS.exe
  2⤵
  PID:15852
- C:\Windows\System\tsSGCpq.exe
  C:\Windows\System\tsSGCpq.exe
  2⤵
  PID:15900
- C:\Windows\System\ieolynN.exe
  C:\Windows\System\ieolynN.exe
  2⤵
  PID:15544
- C:\Windows\System\IxiufVY.exe
  C:\Windows\System\IxiufVY.exe
  2⤵
  PID:15976
- C:\Windows\System\aaLgGos.exe
  C:\Windows\System\aaLgGos.exe
  2⤵
  PID:14940
- C:\Windows\System\hASThYY.exe
  C:\Windows\System\hASThYY.exe
  2⤵
  PID:16052
- C:\Windows\System\YwTLYor.exe
  C:\Windows\System\YwTLYor.exe
  2⤵
  PID:16092
- C:\Windows\System\mYUiApm.exe
  C:\Windows\System\mYUiApm.exe
  2⤵
  PID:16416
- C:\Windows\System\rExtGUN.exe
  C:\Windows\System\rExtGUN.exe
  2⤵
  PID:16444
- C:\Windows\System\EFvDJtn.exe
  C:\Windows\System\EFvDJtn.exe
  2⤵
  PID:16460
- C:\Windows\System\vloQlZX.exe
  C:\Windows\System\vloQlZX.exe
  2⤵
  PID:16488
- C:\Windows\System\nMTVTef.exe
  C:\Windows\System\nMTVTef.exe
  2⤵
  PID:16520
- C:\Windows\System\RVVITEQ.exe
  C:\Windows\System\RVVITEQ.exe
  2⤵
  PID:16540
- C:\Windows\System\ZxNbnSr.exe
  C:\Windows\System\ZxNbnSr.exe
  2⤵
  PID:16568
- C:\Windows\System\miFCvtk.exe
  C:\Windows\System\miFCvtk.exe
  2⤵
  PID:16596
- C:\Windows\System\JyTUvLN.exe
  C:\Windows\System\JyTUvLN.exe
  2⤵
  PID:16624
- C:\Windows\System\JQDPyYk.exe
  C:\Windows\System\JQDPyYk.exe
  2⤵
  PID:16656
- C:\Windows\System\chkuAWt.exe
  C:\Windows\System\chkuAWt.exe
  2⤵
  PID:16692
- C:\Windows\System\gfbGdPl.exe
  C:\Windows\System\gfbGdPl.exe
  2⤵
  PID:16712
- C:\Windows\System\KYeiwem.exe
  C:\Windows\System\KYeiwem.exe
  2⤵
  PID:16748
- C:\Windows\System\PLUCXnf.exe
  C:\Windows\System\PLUCXnf.exe
  2⤵
  PID:16772
- C:\Windows\System\WZOzGCm.exe
  C:\Windows\System\WZOzGCm.exe
  2⤵
  PID:16800
- C:\Windows\System\eowBOvA.exe
  C:\Windows\System\eowBOvA.exe
  2⤵
  PID:16824
- C:\Windows\System\mLDUgjN.exe
  C:\Windows\System\mLDUgjN.exe
  2⤵
  PID:16844
- C:\Windows\System\YOAWQZU.exe
  C:\Windows\System\YOAWQZU.exe
  2⤵
  PID:16868
- C:\Windows\System\GHcVzEo.exe
  C:\Windows\System\GHcVzEo.exe
  2⤵
  PID:16908
- C:\Windows\System\yXWkxNc.exe
  C:\Windows\System\yXWkxNc.exe
  2⤵
  PID:16932
- C:\Windows\System\NpUNswZ.exe
  C:\Windows\System\NpUNswZ.exe
  2⤵
  PID:16952
- C:\Windows\System\FSbrZGP.exe
  C:\Windows\System\FSbrZGP.exe
  2⤵
  PID:16996
- C:\Windows\System\ENTbINt.exe
  C:\Windows\System\ENTbINt.exe
  2⤵
  PID:17024
- C:\Windows\System\BmWuNCC.exe
  C:\Windows\System\BmWuNCC.exe
  2⤵
  PID:17056
- C:\Windows\System\yMFGdDe.exe
  C:\Windows\System\yMFGdDe.exe
  2⤵
  PID:17088
- C:\Windows\System\LNvZxIZ.exe
  C:\Windows\System\LNvZxIZ.exe
  2⤵
  PID:17112
- C:\Windows\System\UrwmrfZ.exe
  C:\Windows\System\UrwmrfZ.exe
  2⤵
  PID:17128
- C:\Windows\System\GrLyjnl.exe
  C:\Windows\System\GrLyjnl.exe
  2⤵
  PID:17156
- C:\Windows\System\mwZWwpn.exe
  C:\Windows\System\mwZWwpn.exe
  2⤵
  PID:17172
- C:\Windows\System\AapzQOp.exe
  C:\Windows\System\AapzQOp.exe
  2⤵
  PID:17200
- C:\Windows\System\CIrnMaG.exe
  C:\Windows\System\CIrnMaG.exe
  2⤵
  PID:17228
- C:\Windows\System\qejViVf.exe
  C:\Windows\System\qejViVf.exe
  2⤵
  PID:17256
- C:\Windows\System\ASExbya.exe
  C:\Windows\System\ASExbya.exe
  2⤵
  PID:17280
- C:\Windows\System\grCSvas.exe
  C:\Windows\System\grCSvas.exe
  2⤵
  PID:17304
- C:\Windows\System\BmoOPoY.exe
  C:\Windows\System\BmoOPoY.exe
  2⤵
  PID:17332
- C:\Windows\System\TOlIarW.exe
  C:\Windows\System\TOlIarW.exe
  2⤵
  PID:17376
- C:\Windows\System\IDHIFqn.exe
  C:\Windows\System\IDHIFqn.exe
  2⤵
  PID:15720
- C:\Windows\System\eXpTYxy.exe
  C:\Windows\System\eXpTYxy.exe
  2⤵
  PID:14932
- C:\Windows\System\EEBYRQq.exe
  C:\Windows\System\EEBYRQq.exe
  2⤵
  PID:15136
- C:\Windows\System\xbNoqQo.exe
  C:\Windows\System\xbNoqQo.exe
  2⤵
  PID:16172
- C:\Windows\System\HkKMoog.exe
  C:\Windows\System\HkKMoog.exe
  2⤵
  PID:17404
- C:\Windows\System\zBVnAYC.exe
  C:\Windows\System\zBVnAYC.exe
  2⤵
  PID:16436
- C:\Windows\System\TfIkJBU.exe
  C:\Windows\System\TfIkJBU.exe
  2⤵
  PID:17264
- C:\Windows\System\nYFvSuw.exe
  C:\Windows\System\nYFvSuw.exe
  2⤵
  PID:17296
- C:\Windows\System\mAuiNyG.exe
  C:\Windows\System\mAuiNyG.exe
  2⤵
  PID:17364
- C:\Windows\System\xLmwpMk.exe
  C:\Windows\System\xLmwpMk.exe
  2⤵
  PID:17392
- C:\Windows\System\wWslwFa.exe
  C:\Windows\System\wWslwFa.exe
  2⤵
  PID:16560

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:15184

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\DvzoRPF.exe

Filesize
1.5MB

MD5
287b2b8f81610b0754cb2f81b9d390fe

SHA1
3300ba741f1b55af75de6626267a728aeb432af0

SHA256
00a45334e210fbcbea8f5fbdf96241f3520a804133cffe8ec02a35ece1146a43

SHA512
37a08f387df8203105df28d0de92140e7254b095538d7b66c3bc308ca323dd92164040f235a57ea70abfc4934f72faacb4a15c1cfac68b889a40f848a06d7f65

Download Submit
C:\Windows\System\EBZnvkw.exe

Filesize
1.5MB

MD5
e5846d6ad378b615f830c65e8ea69bc2

SHA1
cce574fc36c0b6f1e9f7c96005d1d46c927bf39b

SHA256
1b4ac19894892862eb70827a297e1c3814fa3bce7234e0de450aec218aa86a4b

SHA512
81a2521d4fba4dbc795fc09b5cbdffbd0a138d8577e385b0441b8595ee3824ce2a978a64dc69e98a4d12e4793accfdd1c8f10a259f3a97ab3d0b2918bd592079

Download Submit
C:\Windows\System\EQUdYrH.exe

Filesize
1.5MB

MD5
5e597ed992a45f5f0586300ae74a3a07

SHA1
edac5c0bea3143569ce2fcbd7a33f3e832f8de42

SHA256
d30dc117aef63217905819a38af2bd6f1530be5a0fe3493df7a847e184c0ac9b

SHA512
eb970b00c425a4164e293e1b36a7daf87200b98ee6f6c3d6de8412a0c48c47c9d72f119b3c16f0b137940d4128c645f10cdece27671e11bfcec087e29e6cc3d7

Download Submit
C:\Windows\System\GmzsNBt.exe

Filesize
1.5MB

MD5
2c175c81fb400191cdfd01062b88d780

SHA1
ef5471f17a78602d612e4ae1d865173da8ffbc60

SHA256
8bb35ea18c7bb56b8bf1396b570bcc92898148e5029803736b1a84dff03490ba

SHA512
766f0f8d5b0b1a84ccc0f6e717fcce2bf91142a9a8f11e7fd6606ec794139bd677a3131e24de5966dced9f8543b899b933d661dc6dc58ea7f7623009fde1fc94

Download Submit
C:\Windows\System\HkaoShb.exe

Filesize
1.5MB

MD5
2db8d26ef60081f0d7860edae6a5d639

SHA1
07525dbcff4a0869bee2e6859c69fee0f25d92dd

SHA256
7163db2f317bcb68df8d06367f6cac5ea8efd7dc7cba54b873d226a7c42c0730

SHA512
7b4027b5f39820be46e44afcd1d5746da9f19d65787cf7dc277ef5e465c1a1f6f66d4f363065b27c869f79a9694dcd69058f8fbf7967151db2027b305b05e4c3

Download Submit
C:\Windows\System\HorSGKi.exe

Filesize
1.5MB

MD5
14259b372773dee9aab5d9b11a1e0d21

SHA1
c3984054cea1b5482ed90ad13a89abd1ce5f0c12

SHA256
608d74d1cd54e233ce7b086078a4ef5ad3870632f984895b9795decf17b8d46f

SHA512
b5308d50b595dc2214142d752e4d02ff917b6edfdcf7550655db6a0a4dd5f1cc1b6b9d1bc4bf8231f93f1c353f3b4baef2c390ba19152032c7aec2ab2fcc7eae

Download Submit
C:\Windows\System\ITsTaSe.exe

Filesize
1.5MB

MD5
ff3d67df96468bdc0c1cffc5349a4c9b

SHA1
214fb0e767c869eaa4dcdd9959f36c034e9c79a2

SHA256
0c9bc288461087401714ff331907e261ff87e953edca2f64916bd273ace944ff

SHA512
b1f1cdc18be79eb6a7ea5e808a0e138ef7b64cbc770ef2916c90de7eaa32a6329d602d8fae7d16247f27bc089c28a3c6cb0d4b9ed99e854f198a4998946f9873

Download Submit
C:\Windows\System\JWwaxzL.exe

Filesize
1.5MB

MD5
0c76b7877b154eb0c68d7d5a8dcb2bc5

SHA1
31b347dcfe2a8618edaf3152260aecb454389c20

SHA256
2feb79e193b69d4864fb311c798bc8c579e14164a8f2b63c702a32f904199a62

SHA512
ce33b9f15297510974208faf4f388362dc4989a3e854d60851760ad3bb8edc70760ae844ba924ed565488863d1e5630fb585f4d6b7b50694136c7faf7ed37a69

Download Submit
C:\Windows\System\JgfLBmv.exe

Filesize
1.5MB

MD5
cb00938ced261280c79dbb2c79449690

SHA1
15b7175efd8620fa67fb193f86c55498fb84c4bd

SHA256
5c0d3466a7a86cb0fb178ab0c0a8bf756be96ad9824077aa7ee4d9497a23d411

SHA512
64c1ed2db7f3292380d241601f7083511087b5c6b0d68408db3163d66a382c1ccd68172f00d48b9f92f2a7cc42e8abad49c1f60865eb31b72f8ec5f755dc7342

Download Submit
C:\Windows\System\JtoBReH.exe

Filesize
1.5MB

MD5
15db1520b1b2752c565e178554757bd1

SHA1
d36473041be9793ccd4da166e56e56200d8266ed

SHA256
7b6c0fc61b9962e1facdd0468398359438a3f7b3c4fe51ab6d794314ba4e668e

SHA512
c3032f648b8502b980d9572a77ced8ecff7adbe92254cd11a1bf70703b8c8e7912dbfc5521d5e1504c8185a168d8a0c68b8494fb18e3293799335082ae2cb7f3

Download Submit
C:\Windows\System\JtzOhXc.exe

Filesize
1.5MB

MD5
d9298183aa5723d564c33f85cdf326ae

SHA1
f9cf9e65adf6eb9642c1107aea163c173ac7af32

SHA256
f9a5a0603cb234ce69633e072fcc58d1dab74108fe255eb294d1f59af7a85409

SHA512
6a4f37ce79cbead1139d195c27fd532af558729bdc3ecdb0bb29d5f809efb0da83971f4c6f9acd2ddb12b41810c813c2b0e744c32431a4992637c8437814e9ef

Download Submit
C:\Windows\System\NPXDHxn.exe

Filesize
1.5MB

MD5
39a437bd945623026394945e52f1aa5b

SHA1
953db788386c44e4d0624413431f14cfee913983

SHA256
27d6c0a288087dd5c56f481e3964ab9a36bc7e90b954487c64a98e3afcc90695

SHA512
ed15a4c8a727cda419b4caf0aaddb110ef042472a0e75b1c3ce43bacb555f556330fe136a1cdb7e27a3ec663c94178ef365e0d97dc744aaf288e98118a44e470

Download Submit
C:\Windows\System\NlNpTxM.exe

Filesize
1.5MB

MD5
7f34e5c30b132ba095a28f07d31569aa

SHA1
47ddf1e00a2f884bbf087b7ec00c3260e9fa9cc1

SHA256
8d1be9839e8731ee4d45385104077bed0429babc777bf3de4250502d51025b3d

SHA512
615b009bf9f0aca2e6108429948e1f5f395d29d941bf6dce7c4d9a9b42aaabdfea360c55506c64c377e95fe139fbd5b9b49621f8dead2f1823430c640f559cd6

Download Submit
C:\Windows\System\OEHZobL.exe

Filesize
1.5MB

MD5
c9a5aa494794d8f474ac88cf193eff85

SHA1
a9a8226e5c702808fd5f2b41f657c37e7ee6fa3c

SHA256
0f98280eb9fded33209cc11edadcec634890b4ef84855af44bfcfbfe7dc39061

SHA512
dcf41c78419d6973596204cb09775e95c6d6690c83b33e1eaff33334d796f9c902b89b4994cdf2eac6bffc97d08755b49adee2fd5f32c6acf061da3a47b78460

Download Submit
C:\Windows\System\OfUuwpy.exe

Filesize
1.5MB

MD5
81ce0dcf2fa8303c24500c5865d0afd6

SHA1
cb643550ff27906a6005c26d86b641743a759fba

SHA256
fd924a2b7be9ebf1051e140ca1df83ae19ce094c62639629e7886264ce8c535a

SHA512
05dc72b30b6403d9bb9bb0d1772cd60584ebf107f07beca219b752f40bbff925d7d37e00cfc3165cf09dc1f89a827f064e2e192faba56da3140c9bf1043e9ffd

Download Submit
C:\Windows\System\PQzXLLg.exe

Filesize
1.5MB

MD5
e2bdbcf591a291966e043eac344063ee

SHA1
fe085851c3df6990fab05a32c3d736b4a5790861

SHA256
2245001452e2dffd8f9c000bd8ec862deadea304f92f15e78454076939a7f798

SHA512
72592a0254bf2649f8804fcc47cc3ffa8e1c630c60924f23f03753ef64cf9d983936623f86147a272c1fe6b66f7df6b3853df3d15b9869909d03d2367978694a

Download Submit
C:\Windows\System\QJFGDyf.exe

Filesize
1.5MB

MD5
e6bae1495aab84c56764066f712a0586

SHA1
6412b212b8c3fb5077764e888d7fc5506f34b7e4

SHA256
2483331252d8a306af73aa8f655800200941165b94dc30363d58958ec94946d0

SHA512
5bc587cebf4babe0371d439e0abdaa58c1f3f24447669e0e7ba7f07a1bfa2435fb289bbd3ee51fe077a694048ba7adbccd1206194ef42a36d01b995b7b190692

Download Submit
C:\Windows\System\SBngScE.exe

Filesize
1.5MB

MD5
ad12794d200630eb2841810fb30b9bff

SHA1
4b4d41021573155f464ade62531ef6f26e07aea1

SHA256
6c25fb4cc1115708186b905ee649b9694798d67dbfe09edd1381708e87d1bb03

SHA512
90a79f12ee230b3da2c6fcc2f843b12f93fce4ae37db3863fb52fc642ec88d2f667e7bb6feaf10f7146a1575c84d4bfe4b7cdc520901feae5b4b600791fec1ff

Download Submit
C:\Windows\System\WAoICoc.exe

Filesize
1.5MB

MD5
2a3d9ce941fde825cf0a626b5344b590

SHA1
c7888335c1adf99c35c45d0b02c6adae6b361313

SHA256
554d58d386590a4b8f7f389d6fb4566abdc6cc6771dbc54830a419c499507cfe

SHA512
9faa78cd69750dd6f1688e6aa98ed6d4f95233dea36006c51b89180ecc7cffb1d1dd881e14db70b38785c0853eabdb85f54f057e6587d8ad6a605337a371b7ac

Download Submit
C:\Windows\System\XhQVebw.exe

Filesize
1.5MB

MD5
7026b38d48b13f078aa471599a423740

SHA1
e959370f0f6d81419bb717a56cb7c6b9909702be

SHA256
38d329ddd6f68a276efda4305a70fca2f4df7aa83cece066399add08981f14a3

SHA512
3a206f80a49abc534d4cb4948f05a75362920da1ddec6b006d2fd35c646b0eef851f291134b27850f2e15a35d8881099a4637e1a0559481bdc53471b651d4a14

Download Submit
C:\Windows\System\XndzFHO.exe

Filesize
1.5MB

MD5
5c9e1f82ff10a4c38c83e7e1a49b890d

SHA1
b1f4477fc4e930ff786670f427c7dce1adfe6c95

SHA256
222a9fa908dde5083137985b8ce5a8351e8cbd75b86b81f2d304c312efb0b38c

SHA512
be451e6b40e6a8ac33312df403ba16b1ed7795fac0e01545afc1ad4c7fb82e4a54c77feb40cf2b8740fb595ecb0f207e9541d1be6f43e556d8f6811690b1dd1d

Download Submit
C:\Windows\System\YjJTgON.exe

Filesize
1.5MB

MD5
5a5a1eff235c5b0bb969d91a2fbbba12

SHA1
eaa887c2d2fd6acb2fee51be8cccfc740cd02ede

SHA256
74dd7e27f7ccd843cb9b17bf9a3e3d776f4276737c5417209a6217b2fbeae96a

SHA512
30f69d351bda9d744093cb9b8cea441c6960efcd4951a7f3a84fd070b1b57b168ccde1df20fb56cfd236f199fa0ca5153bad603791f78c092fd9f2bf4a387fb9

Download Submit
C:\Windows\System\ZbHfPGM.exe

Filesize
1.5MB

MD5
868a022a8cd73fedee3865ebce28ad94

SHA1
d3326dec6241c18c4b749ce4aeb1005fca716854

SHA256
df00bb271a0ed357a4389068c6c7ca67a3b6438bfe6187c74907e5032fbed193

SHA512
3d8dc88cc0d54066930009c6902229f2c48174f06ea21efe6f1e0fd122a6b9ef8db48c3c0c15b14533f7ac42a0ac0d635e384e5e7e6057609890023f3f328e1b

Download Submit
C:\Windows\System\ZyPFsth.exe

Filesize
1.5MB

MD5
dbcb6df1efcca2de30bc2a8867dbf38b

SHA1
1618e05e8ca8c8f8137035e72ca950d66b01d00d

SHA256
6c80e85a7e3339ab67ce628199c5b8c62ed94213c66538a60e180f6fcca5bd68

SHA512
31a5784d7e7dc169b78305d75c2dda1712c9eabd6d39d65bdf16de9687316330b7cd3c4423327522b8da316efda2d0a00b1c04abdb9bd4d8386e58804c493bb9

Download Submit
C:\Windows\System\ePYuVPx.exe

Filesize
1.5MB

MD5
608f58e4bc720c455a63811d631a52e5

SHA1
57cfe8db7a44f748050fddbd9311c5a623cae6f5

SHA256
9e6aa1c62f5d0ef6a5863f814f7e5e0980a14058bab37da3de69e383a6ae74cf

SHA512
3bf262a2237ab20dafa81e6e2b9494fc5a858b3d6e632ea18c4f961d8b787e86494cbb529fd2da513b2ba2227d166f128a04978a6f8b07e89503f05cc596e70f

Download Submit
C:\Windows\System\iYDWFJm.exe

Filesize
1.5MB

MD5
9ac4cfb4fc6471387b871ec65c924621

SHA1
cd4cae8db0fd4c16d114eb6a717b664c4971bf81

SHA256
4b6727fdb34be0cfd2cd367719d249d9044553c7e061547f53c1bc0dc3bc4d5f

SHA512
02451259df6c19a6f0b7252df744bee58be7c4d23bd0e6ef38fb38c5cabd5581778396d912830c1c136ab8ab14bebc005630f333fb619f81863dd0c1a3357abf

Download Submit
C:\Windows\System\jJOOnSc.exe

Filesize
1.5MB

MD5
8090a4b661466ccd2062ccb973b7db59

SHA1
fc23f791276552c278b88b70a61ac0d694a8f6fe

SHA256
e2f278498e20afbd80d3e39c6577d984222df9d61b980baab3dc0b07637f3236

SHA512
513ab92f4a0041e2dce1e744a7f933ab31ea14bdfe14c8b7e0be595601d013878a094bec9483361d2d7d37091605ad25af5b7065205c267918f89de7506e0eec

Download Submit
C:\Windows\System\lTWksCh.exe

Filesize
1.5MB

MD5
c1e0bc6d69c260d15e9435a344a160aa

SHA1
0c5696e8536a216e028158e02761b59da3fa6fd3

SHA256
f5a77082d8ce99ff61b1e40ad7895ea49c71b320ea042da75cc22e35e8f5da20

SHA512
1c1ce1614eb545918d42a05e26e4e7771e29ffc154d32717b15b7499cb450b2e9ae29c391d44720639fffc03e96d52df16b49b827824bbd4041d803ac3f2683f

Download Submit
C:\Windows\System\nYSzqmX.exe

Filesize
1.5MB

MD5
d4e1c863fbb33c22811366af840ed04b

SHA1
3ec4841a933ec471bac2f6544a3b492b300e2434

SHA256
ac8b3fa5604212e14148dfaabfa40c33236e0336c913c8121a6f46f3829e0746

SHA512
ade85acd8b5bd452ad57bbb8a7715a3377f9a46e24ff659a7cf27854637f2f434f60db60af93e33e80aae6efbd415ca797172061ffc67d09466992542567a1c2

Download Submit
C:\Windows\System\pWPzBye.exe

Filesize
1.5MB

MD5
3f4221adf549ac905ce60f4043760c6a

SHA1
c4827f7855193011a4b5b4335a075be9848626e6

SHA256
e26cfdcbe8c4de70cd4e3a4fd6d18c26ce65a8be78de6d1c17af903c7b67563d

SHA512
ae48c5a6c530dc15256bdbb02d4a1aa102008e1264da015f6b82202f6bb2d726353d4eb7a6672d5d6968f9ae1300d97e8b0a6628901d7151060c878e916ccc34

Download Submit
C:\Windows\System\qxDnIjz.exe

Filesize
1.5MB

MD5
4e36b168a8e88184ca9bd8edb243f44e

SHA1
c68e1858fe91361e79dd1c45c146059d09e72741

SHA256
c1fdf2df8951bdde1609a60c5e160f219d802168c81f97cb8c492b4bc268dd7c

SHA512
0b4935ff909c49cc65ed33b3d4128d89b722418d0f6f5dfe5717404f9f3ae26dcb688be58506a90fb02aeba817f5251fde5c709ebfef5a2fb2f0bdf75261ad15

Download Submit
C:\Windows\System\uLoMjdt.exe

Filesize
1.5MB

MD5
a12ead554979ca1a946a0869d9f08309

SHA1
e198118e6c8d106a74d4d0fff39d2256980d4d33

SHA256
cef47f687e918fe517e2e7038a12bcd7058ba7c38658acf59960a4fc659a60a9

SHA512
035a6f9ae7ce55c0c71ab31679a7b6e18ee8716297448ad73415a7a9876d50c8d95b4ab16ef4eee61d94348f65b83e1de451c37af9884a975fc52d4295980569

Download Submit
C:\Windows\System\uiokKII.exe

Filesize
1.5MB

MD5
992bc21311a00f1a3f15da0c6d95c73b

SHA1
6165c3a53d9d05ab361e4af98579b48a530b8c83

SHA256
8ebc9a86469e588654bda691244e848f802013476f05aa09449a71e045ad2917

SHA512
c9027d12c5299cf08d653f1be74b735e3686fc181b024a9748c9b93f7540fa4b35531dd9100172cf9bd8842e75b9a1da6b5b154486aa42e43f81bc14bdc73d7d

Download Submit
C:\Windows\System\vmEpZjz.exe

Filesize
1.5MB

MD5
32ff17181db1f766fdad825caa7b8060

SHA1
89124b07f79f6a750b4dadeb31a0e5274bb21d7b

SHA256
f63b973be8bf95f3d3e684b8123739c8a78574dbf115aba06075d3bdb6ef02f4

SHA512
ea72c5f24e17e34185b00b9f0e9956ff561469f8b5fc60aa1272a0d93f7a7d0a286908daff4b352f520d09b027ec4a8cf11ff2fa7c95e8bd789e16ea343188de

Download Submit
C:\Windows\System\wzkDtNJ.exe

Filesize
1.5MB

MD5
7c511d61a37620aa283d5c40091b992c

SHA1
93e38cb16777e9ab8f203f1e3789f75838161967

SHA256
75be8d8751afc2ad5bb99214a1a9eed03b08121e5922c99bec538a38cc6ba30f

SHA512
98291fc94a31a2d27f40a2b5d469d99abf94dc0f6c94d07ffda210dd3efe1bbc68836cc18544a9b7e0efcc28abfb8decd5b445125eac660cf8339657d06e4109

Download Submit
C:\Windows\System\xyBBHDZ.exe

Filesize
1.5MB

MD5
1a64cc6f211071bee4c5a70e7360502a

SHA1
e54d85ec27eb4d27045428ea2bc97f92165c35a3

SHA256
787bb0d7cbdf3f62f998d16e25ec376fa914768e0167193a7b4cf560c43376a3

SHA512
1632d28b2d8406c77d311fbb39d45a7e94ed4a251a0bde40b1e6b800c57603e8d0dd351a17973e74464ca9db0c3418022d47c47d43487051a376cdabe34f348b

Download Submit
memory/3088-0-0x000001B56EE80000-0x000001B56EE90000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads