xmrig | 9484efcd68c9f08af17542da0e0278d88ed2d5bdcc110ab43a138ca29b20ad71

Analysis

max time kernel
138s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
15/11/2024, 00:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9484efcd68c9f08af17542da0e0278d88ed2d5bdcc110ab43a138ca29b20ad71.exe
Size

1.4MB
MD5

db1ea7e8ac015023cdb27e6960bfa9c5
SHA1

9167b8734fede024e2dce4f8be32520f59e4ff4c
SHA256

9484efcd68c9f08af17542da0e0278d88ed2d5bdcc110ab43a138ca29b20ad71
SHA512

a1f8d2fb932f2639c316820c58b4ad6e48184b57bfdcce044b8aa7de60fc4b83db3c340f0796088bfe5d8fb8b8ec38851887794498ad173df5ad4e742143cae6
SSDEEP

24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbpwlKenszbWKDNEm/51m6PbWggry:GezaTF8FcNkNdfE0pZ9ozttwIRx3Qx+

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 33 IoCs

miner

resource	yara_rule
behavioral2/files/0x000a000000023bc4-4.dat	xmrig
behavioral2/files/0x0009000000023c8f-11.dat	xmrig
behavioral2/files/0x0007000000023c99-29.dat	xmrig
behavioral2/files/0x0007000000023c9a-38.dat	xmrig
behavioral2/files/0x0007000000023c9c-44.dat	xmrig
behavioral2/files/0x0007000000023c9e-50.dat	xmrig
behavioral2/files/0x0007000000023c9d-68.dat	xmrig
behavioral2/files/0x0007000000023ca4-99.dat	xmrig
behavioral2/files/0x0007000000023caa-121.dat	xmrig
behavioral2/files/0x0007000000023cb1-150.dat	xmrig
behavioral2/files/0x0007000000023cb0-148.dat	xmrig
behavioral2/files/0x0007000000023caf-146.dat	xmrig
behavioral2/files/0x0007000000023cae-142.dat	xmrig
behavioral2/files/0x0007000000023cad-140.dat	xmrig
behavioral2/files/0x0007000000023cac-138.dat	xmrig
behavioral2/files/0x0007000000023cab-136.dat	xmrig
behavioral2/files/0x0007000000023ca9-134.dat	xmrig
behavioral2/files/0x0007000000023ca8-127.dat	xmrig
behavioral2/files/0x0007000000023ca7-125.dat	xmrig
behavioral2/files/0x0007000000023ca6-114.dat	xmrig
behavioral2/files/0x0007000000023ca5-110.dat	xmrig
behavioral2/files/0x0007000000023ca3-79.dat	xmrig
behavioral2/files/0x0007000000023ca2-78.dat	xmrig
behavioral2/files/0x0007000000023ca1-76.dat	xmrig
behavioral2/files/0x0007000000023ca0-74.dat	xmrig
behavioral2/files/0x0007000000023c9f-72.dat	xmrig
behavioral2/files/0x0007000000023c9b-42.dat	xmrig
behavioral2/files/0x0007000000023cb6-160.dat	xmrig
behavioral2/files/0x0007000000023cb2-161.dat	xmrig
behavioral2/files/0x0007000000023cb5-159.dat	xmrig
behavioral2/files/0x0007000000023c98-36.dat	xmrig
behavioral2/files/0x0007000000023c97-24.dat	xmrig
behavioral2/files/0x0007000000023c96-17.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
4836	TSsiwJC.exe
3604	HfjFzqn.exe
1288	vGiBpaR.exe
380	olEQggF.exe
732	PDlXwjA.exe
3772	MzELvDx.exe
3616	MnMSDUb.exe
3872	MyfEcWp.exe
2996	TfKBNdT.exe
1908	ZPqAWTX.exe
2464	ZZaklLB.exe
3632	xCkWUVI.exe
4972	xyZiszj.exe
2100	cVdybij.exe
3688	DfbGWJl.exe
5104	LbUvwTT.exe
232	WkzpPKi.exe
2972	tutpnQg.exe
116	qzGTuHC.exe
2276	GSdWerG.exe
2844	dyHkLDZ.exe
1284	JwCgBWc.exe
1972	DCfRtdJ.exe
1372	JJPoCFo.exe
2876	xFguoIm.exe
2384	DPUPCwX.exe
1636	wnVlwqi.exe
2912	Npfaate.exe
1580	RrKrbtS.exe
3432	VqwzwVo.exe
4524	jtNwlrC.exe
1528	gkoDpHx.exe
876	rXINaMu.exe
1832	zmkSNJl.exe
1488	QsrVFai.exe
1640	ByzXnyn.exe
1032	nZdSswu.exe
1368	QpFXfpd.exe
3564	IryzvtW.exe
2556	ASEpBRO.exe
4412	tnYlrda.exe
2976	mSeGebh.exe
2476	xqZIBIv.exe
2924	nsxjqaF.exe
4936	tRsKrkV.exe
3960	AnzwxBN.exe
324	DAiCXfc.exe
2764	UdPNFzB.exe
3404	gzgCnIV.exe
2020	LwdYYTA.exe
408	ideVfdX.exe
2560	ouXZwoc.exe
3876	wuzCLBJ.exe
3768	ALhRfmk.exe
4000	uckWhGd.exe
2448	idspRAn.exe
5076	iFkaGdk.exe
1536	ecjRKzV.exe
4448	ZuTBkNT.exe
4064	XQXQiYx.exe
3556	WpDJuea.exe
1700	OntVMCO.exe
3112	EfHxBWt.exe
3148	TAuVPzn.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\qzLCcjF.exe	9484efcd68c9f08af17542da0e0278d88ed2d5bdcc110ab43a138ca29b20ad71.exe
File created	C:\Windows\System\OsCoWRU.exe	9484efcd68c9f08af17542da0e0278d88ed2d5bdcc110ab43a138ca29b20ad71.exe
File created	C:\Windows\System\IhjVibN.exe	9484efcd68c9f08af17542da0e0278d88ed2d5bdcc110ab43a138ca29b20ad71.exe
File created	C:\Windows\System\patPsOd.exe	9484efcd68c9f08af17542da0e0278d88ed2d5bdcc110ab43a138ca29b20ad71.exe
File created	C:\Windows\System\WBYOKBE.exe	9484efcd68c9f08af17542da0e0278d88ed2d5bdcc110ab43a138ca29b20ad71.exe
File created	C:\Windows\System\keDFGCK.exe	9484efcd68c9f08af17542da0e0278d88ed2d5bdcc110ab43a138ca29b20ad71.exe
File created	C:\Windows\System\XWREsIK.exe	9484efcd68c9f08af17542da0e0278d88ed2d5bdcc110ab43a138ca29b20ad71.exe
File created	C:\Windows\System\SFxclOs.exe	9484efcd68c9f08af17542da0e0278d88ed2d5bdcc110ab43a138ca29b20ad71.exe
File created	C:\Windows\System\dyHkLDZ.exe	9484efcd68c9f08af17542da0e0278d88ed2d5bdcc110ab43a138ca29b20ad71.exe
File created	C:\Windows\System\elLtbHE.exe	9484efcd68c9f08af17542da0e0278d88ed2d5bdcc110ab43a138ca29b20ad71.exe
File created	C:\Windows\System\EverqUG.exe	9484efcd68c9f08af17542da0e0278d88ed2d5bdcc110ab43a138ca29b20ad71.exe
File created	C:\Windows\System\EfHxBWt.exe	9484efcd68c9f08af17542da0e0278d88ed2d5bdcc110ab43a138ca29b20ad71.exe
File created	C:\Windows\System\MtMhXHN.exe	9484efcd68c9f08af17542da0e0278d88ed2d5bdcc110ab43a138ca29b20ad71.exe
File created	C:\Windows\System\sRHawmk.exe	9484efcd68c9f08af17542da0e0278d88ed2d5bdcc110ab43a138ca29b20ad71.exe
File created	C:\Windows\System\GSdWerG.exe	9484efcd68c9f08af17542da0e0278d88ed2d5bdcc110ab43a138ca29b20ad71.exe
File created	C:\Windows\System\xBhnViC.exe	9484efcd68c9f08af17542da0e0278d88ed2d5bdcc110ab43a138ca29b20ad71.exe
File created	C:\Windows\System\oSDnsfa.exe	9484efcd68c9f08af17542da0e0278d88ed2d5bdcc110ab43a138ca29b20ad71.exe
File created	C:\Windows\System\rlSgDPe.exe	9484efcd68c9f08af17542da0e0278d88ed2d5bdcc110ab43a138ca29b20ad71.exe
File created	C:\Windows\System\FygHkBB.exe	9484efcd68c9f08af17542da0e0278d88ed2d5bdcc110ab43a138ca29b20ad71.exe
File created	C:\Windows\System\wnVlwqi.exe	9484efcd68c9f08af17542da0e0278d88ed2d5bdcc110ab43a138ca29b20ad71.exe
File created	C:\Windows\System\cSpOFFC.exe	9484efcd68c9f08af17542da0e0278d88ed2d5bdcc110ab43a138ca29b20ad71.exe
File created	C:\Windows\System\xltqDrc.exe	9484efcd68c9f08af17542da0e0278d88ed2d5bdcc110ab43a138ca29b20ad71.exe
File created	C:\Windows\System\CAOVQYP.exe	9484efcd68c9f08af17542da0e0278d88ed2d5bdcc110ab43a138ca29b20ad71.exe
File created	C:\Windows\System\GJjqqAZ.exe	9484efcd68c9f08af17542da0e0278d88ed2d5bdcc110ab43a138ca29b20ad71.exe
File created	C:\Windows\System\qJzrQrG.exe	9484efcd68c9f08af17542da0e0278d88ed2d5bdcc110ab43a138ca29b20ad71.exe
File created	C:\Windows\System\BTTVjdL.exe	9484efcd68c9f08af17542da0e0278d88ed2d5bdcc110ab43a138ca29b20ad71.exe
File created	C:\Windows\System\kXdfgqi.exe	9484efcd68c9f08af17542da0e0278d88ed2d5bdcc110ab43a138ca29b20ad71.exe
File created	C:\Windows\System\wPRLrvD.exe	9484efcd68c9f08af17542da0e0278d88ed2d5bdcc110ab43a138ca29b20ad71.exe
File created	C:\Windows\System\CtQXlCw.exe	9484efcd68c9f08af17542da0e0278d88ed2d5bdcc110ab43a138ca29b20ad71.exe
File created	C:\Windows\System\IHTdAhp.exe	9484efcd68c9f08af17542da0e0278d88ed2d5bdcc110ab43a138ca29b20ad71.exe
File created	C:\Windows\System\CcAobcL.exe	9484efcd68c9f08af17542da0e0278d88ed2d5bdcc110ab43a138ca29b20ad71.exe
File created	C:\Windows\System\ArAbCgs.exe	9484efcd68c9f08af17542da0e0278d88ed2d5bdcc110ab43a138ca29b20ad71.exe
File created	C:\Windows\System\hrGGsnk.exe	9484efcd68c9f08af17542da0e0278d88ed2d5bdcc110ab43a138ca29b20ad71.exe
File created	C:\Windows\System\WLwJUdm.exe	9484efcd68c9f08af17542da0e0278d88ed2d5bdcc110ab43a138ca29b20ad71.exe
File created	C:\Windows\System\lGYqknr.exe	9484efcd68c9f08af17542da0e0278d88ed2d5bdcc110ab43a138ca29b20ad71.exe
File created	C:\Windows\System\BWRMeuZ.exe	9484efcd68c9f08af17542da0e0278d88ed2d5bdcc110ab43a138ca29b20ad71.exe
File created	C:\Windows\System\WyEkpPD.exe	9484efcd68c9f08af17542da0e0278d88ed2d5bdcc110ab43a138ca29b20ad71.exe
File created	C:\Windows\System\gkNCjpX.exe	9484efcd68c9f08af17542da0e0278d88ed2d5bdcc110ab43a138ca29b20ad71.exe
File created	C:\Windows\System\WQjhSAu.exe	9484efcd68c9f08af17542da0e0278d88ed2d5bdcc110ab43a138ca29b20ad71.exe
File created	C:\Windows\System\zAkJYQq.exe	9484efcd68c9f08af17542da0e0278d88ed2d5bdcc110ab43a138ca29b20ad71.exe
File created	C:\Windows\System\DcWvlLg.exe	9484efcd68c9f08af17542da0e0278d88ed2d5bdcc110ab43a138ca29b20ad71.exe
File created	C:\Windows\System\gccPhbU.exe	9484efcd68c9f08af17542da0e0278d88ed2d5bdcc110ab43a138ca29b20ad71.exe
File created	C:\Windows\System\oxCMFov.exe	9484efcd68c9f08af17542da0e0278d88ed2d5bdcc110ab43a138ca29b20ad71.exe
File created	C:\Windows\System\nFJHyZy.exe	9484efcd68c9f08af17542da0e0278d88ed2d5bdcc110ab43a138ca29b20ad71.exe
File created	C:\Windows\System\GPWtfGX.exe	9484efcd68c9f08af17542da0e0278d88ed2d5bdcc110ab43a138ca29b20ad71.exe
File created	C:\Windows\System\uPkhjHF.exe	9484efcd68c9f08af17542da0e0278d88ed2d5bdcc110ab43a138ca29b20ad71.exe
File created	C:\Windows\System\gJSFIAs.exe	9484efcd68c9f08af17542da0e0278d88ed2d5bdcc110ab43a138ca29b20ad71.exe
File created	C:\Windows\System\WmcSBuq.exe	9484efcd68c9f08af17542da0e0278d88ed2d5bdcc110ab43a138ca29b20ad71.exe
File created	C:\Windows\System\tLoyFMV.exe	9484efcd68c9f08af17542da0e0278d88ed2d5bdcc110ab43a138ca29b20ad71.exe
File created	C:\Windows\System\LmPsjYN.exe	9484efcd68c9f08af17542da0e0278d88ed2d5bdcc110ab43a138ca29b20ad71.exe
File created	C:\Windows\System\MTUgyqK.exe	9484efcd68c9f08af17542da0e0278d88ed2d5bdcc110ab43a138ca29b20ad71.exe
File created	C:\Windows\System\UVscDCu.exe	9484efcd68c9f08af17542da0e0278d88ed2d5bdcc110ab43a138ca29b20ad71.exe
File created	C:\Windows\System\hBbXRNT.exe	9484efcd68c9f08af17542da0e0278d88ed2d5bdcc110ab43a138ca29b20ad71.exe
File created	C:\Windows\System\WDysqaE.exe	9484efcd68c9f08af17542da0e0278d88ed2d5bdcc110ab43a138ca29b20ad71.exe
File created	C:\Windows\System\GtDllgV.exe	9484efcd68c9f08af17542da0e0278d88ed2d5bdcc110ab43a138ca29b20ad71.exe
File created	C:\Windows\System\iTvSWbG.exe	9484efcd68c9f08af17542da0e0278d88ed2d5bdcc110ab43a138ca29b20ad71.exe
File created	C:\Windows\System\xUgbgRg.exe	9484efcd68c9f08af17542da0e0278d88ed2d5bdcc110ab43a138ca29b20ad71.exe
File created	C:\Windows\System\DUtGBRT.exe	9484efcd68c9f08af17542da0e0278d88ed2d5bdcc110ab43a138ca29b20ad71.exe
File created	C:\Windows\System\cfutKaG.exe	9484efcd68c9f08af17542da0e0278d88ed2d5bdcc110ab43a138ca29b20ad71.exe
File created	C:\Windows\System\vumsryd.exe	9484efcd68c9f08af17542da0e0278d88ed2d5bdcc110ab43a138ca29b20ad71.exe
File created	C:\Windows\System\lGtjNkh.exe	9484efcd68c9f08af17542da0e0278d88ed2d5bdcc110ab43a138ca29b20ad71.exe
File created	C:\Windows\System\OPnLYcx.exe	9484efcd68c9f08af17542da0e0278d88ed2d5bdcc110ab43a138ca29b20ad71.exe
File created	C:\Windows\System\wlokvDc.exe	9484efcd68c9f08af17542da0e0278d88ed2d5bdcc110ab43a138ca29b20ad71.exe
File created	C:\Windows\System\gkoDpHx.exe	9484efcd68c9f08af17542da0e0278d88ed2d5bdcc110ab43a138ca29b20ad71.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	16524	dwm.exe
Token: SeChangeNotifyPrivilege	16524	dwm.exe
Token: 33	16524	dwm.exe
Token: SeIncBasePriorityPrivilege	16524	dwm.exe
Token: SeShutdownPrivilege	16524	dwm.exe
Token: SeCreatePagefilePrivilege	16524	dwm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3568 wrote to memory of 4836	3568	9484efcd68c9f08af17542da0e0278d88ed2d5bdcc110ab43a138ca29b20ad71.exe	84
PID 3568 wrote to memory of 4836	3568	9484efcd68c9f08af17542da0e0278d88ed2d5bdcc110ab43a138ca29b20ad71.exe	84
PID 3568 wrote to memory of 3604	3568	9484efcd68c9f08af17542da0e0278d88ed2d5bdcc110ab43a138ca29b20ad71.exe	85
PID 3568 wrote to memory of 3604	3568	9484efcd68c9f08af17542da0e0278d88ed2d5bdcc110ab43a138ca29b20ad71.exe	85
PID 3568 wrote to memory of 1288	3568	9484efcd68c9f08af17542da0e0278d88ed2d5bdcc110ab43a138ca29b20ad71.exe	86
PID 3568 wrote to memory of 1288	3568	9484efcd68c9f08af17542da0e0278d88ed2d5bdcc110ab43a138ca29b20ad71.exe	86
PID 3568 wrote to memory of 380	3568	9484efcd68c9f08af17542da0e0278d88ed2d5bdcc110ab43a138ca29b20ad71.exe	87
PID 3568 wrote to memory of 380	3568	9484efcd68c9f08af17542da0e0278d88ed2d5bdcc110ab43a138ca29b20ad71.exe	87
PID 3568 wrote to memory of 732	3568	9484efcd68c9f08af17542da0e0278d88ed2d5bdcc110ab43a138ca29b20ad71.exe	88
PID 3568 wrote to memory of 732	3568	9484efcd68c9f08af17542da0e0278d88ed2d5bdcc110ab43a138ca29b20ad71.exe	88
PID 3568 wrote to memory of 3772	3568	9484efcd68c9f08af17542da0e0278d88ed2d5bdcc110ab43a138ca29b20ad71.exe	89
PID 3568 wrote to memory of 3772	3568	9484efcd68c9f08af17542da0e0278d88ed2d5bdcc110ab43a138ca29b20ad71.exe	89
PID 3568 wrote to memory of 3616	3568	9484efcd68c9f08af17542da0e0278d88ed2d5bdcc110ab43a138ca29b20ad71.exe	90
PID 3568 wrote to memory of 3616	3568	9484efcd68c9f08af17542da0e0278d88ed2d5bdcc110ab43a138ca29b20ad71.exe	90
PID 3568 wrote to memory of 3872	3568	9484efcd68c9f08af17542da0e0278d88ed2d5bdcc110ab43a138ca29b20ad71.exe	91
PID 3568 wrote to memory of 3872	3568	9484efcd68c9f08af17542da0e0278d88ed2d5bdcc110ab43a138ca29b20ad71.exe	91
PID 3568 wrote to memory of 2996	3568	9484efcd68c9f08af17542da0e0278d88ed2d5bdcc110ab43a138ca29b20ad71.exe	92
PID 3568 wrote to memory of 2996	3568	9484efcd68c9f08af17542da0e0278d88ed2d5bdcc110ab43a138ca29b20ad71.exe	92
PID 3568 wrote to memory of 1908	3568	9484efcd68c9f08af17542da0e0278d88ed2d5bdcc110ab43a138ca29b20ad71.exe	93
PID 3568 wrote to memory of 1908	3568	9484efcd68c9f08af17542da0e0278d88ed2d5bdcc110ab43a138ca29b20ad71.exe	93
PID 3568 wrote to memory of 2464	3568	9484efcd68c9f08af17542da0e0278d88ed2d5bdcc110ab43a138ca29b20ad71.exe	94
PID 3568 wrote to memory of 2464	3568	9484efcd68c9f08af17542da0e0278d88ed2d5bdcc110ab43a138ca29b20ad71.exe	94
PID 3568 wrote to memory of 3632	3568	9484efcd68c9f08af17542da0e0278d88ed2d5bdcc110ab43a138ca29b20ad71.exe	95
PID 3568 wrote to memory of 3632	3568	9484efcd68c9f08af17542da0e0278d88ed2d5bdcc110ab43a138ca29b20ad71.exe	95
PID 3568 wrote to memory of 4972	3568	9484efcd68c9f08af17542da0e0278d88ed2d5bdcc110ab43a138ca29b20ad71.exe	96
PID 3568 wrote to memory of 4972	3568	9484efcd68c9f08af17542da0e0278d88ed2d5bdcc110ab43a138ca29b20ad71.exe	96
PID 3568 wrote to memory of 2100	3568	9484efcd68c9f08af17542da0e0278d88ed2d5bdcc110ab43a138ca29b20ad71.exe	97
PID 3568 wrote to memory of 2100	3568	9484efcd68c9f08af17542da0e0278d88ed2d5bdcc110ab43a138ca29b20ad71.exe	97
PID 3568 wrote to memory of 3688	3568	9484efcd68c9f08af17542da0e0278d88ed2d5bdcc110ab43a138ca29b20ad71.exe	98
PID 3568 wrote to memory of 3688	3568	9484efcd68c9f08af17542da0e0278d88ed2d5bdcc110ab43a138ca29b20ad71.exe	98
PID 3568 wrote to memory of 5104	3568	9484efcd68c9f08af17542da0e0278d88ed2d5bdcc110ab43a138ca29b20ad71.exe	99
PID 3568 wrote to memory of 5104	3568	9484efcd68c9f08af17542da0e0278d88ed2d5bdcc110ab43a138ca29b20ad71.exe	99
PID 3568 wrote to memory of 232	3568	9484efcd68c9f08af17542da0e0278d88ed2d5bdcc110ab43a138ca29b20ad71.exe	100
PID 3568 wrote to memory of 232	3568	9484efcd68c9f08af17542da0e0278d88ed2d5bdcc110ab43a138ca29b20ad71.exe	100
PID 3568 wrote to memory of 2972	3568	9484efcd68c9f08af17542da0e0278d88ed2d5bdcc110ab43a138ca29b20ad71.exe	101
PID 3568 wrote to memory of 2972	3568	9484efcd68c9f08af17542da0e0278d88ed2d5bdcc110ab43a138ca29b20ad71.exe	101
PID 3568 wrote to memory of 116	3568	9484efcd68c9f08af17542da0e0278d88ed2d5bdcc110ab43a138ca29b20ad71.exe	102
PID 3568 wrote to memory of 116	3568	9484efcd68c9f08af17542da0e0278d88ed2d5bdcc110ab43a138ca29b20ad71.exe	102
PID 3568 wrote to memory of 2276	3568	9484efcd68c9f08af17542da0e0278d88ed2d5bdcc110ab43a138ca29b20ad71.exe	103
PID 3568 wrote to memory of 2276	3568	9484efcd68c9f08af17542da0e0278d88ed2d5bdcc110ab43a138ca29b20ad71.exe	103
PID 3568 wrote to memory of 2844	3568	9484efcd68c9f08af17542da0e0278d88ed2d5bdcc110ab43a138ca29b20ad71.exe	104
PID 3568 wrote to memory of 2844	3568	9484efcd68c9f08af17542da0e0278d88ed2d5bdcc110ab43a138ca29b20ad71.exe	104
PID 3568 wrote to memory of 1284	3568	9484efcd68c9f08af17542da0e0278d88ed2d5bdcc110ab43a138ca29b20ad71.exe	105
PID 3568 wrote to memory of 1284	3568	9484efcd68c9f08af17542da0e0278d88ed2d5bdcc110ab43a138ca29b20ad71.exe	105
PID 3568 wrote to memory of 1972	3568	9484efcd68c9f08af17542da0e0278d88ed2d5bdcc110ab43a138ca29b20ad71.exe	106
PID 3568 wrote to memory of 1972	3568	9484efcd68c9f08af17542da0e0278d88ed2d5bdcc110ab43a138ca29b20ad71.exe	106
PID 3568 wrote to memory of 1372	3568	9484efcd68c9f08af17542da0e0278d88ed2d5bdcc110ab43a138ca29b20ad71.exe	107
PID 3568 wrote to memory of 1372	3568	9484efcd68c9f08af17542da0e0278d88ed2d5bdcc110ab43a138ca29b20ad71.exe	107
PID 3568 wrote to memory of 2876	3568	9484efcd68c9f08af17542da0e0278d88ed2d5bdcc110ab43a138ca29b20ad71.exe	108
PID 3568 wrote to memory of 2876	3568	9484efcd68c9f08af17542da0e0278d88ed2d5bdcc110ab43a138ca29b20ad71.exe	108
PID 3568 wrote to memory of 2384	3568	9484efcd68c9f08af17542da0e0278d88ed2d5bdcc110ab43a138ca29b20ad71.exe	109
PID 3568 wrote to memory of 2384	3568	9484efcd68c9f08af17542da0e0278d88ed2d5bdcc110ab43a138ca29b20ad71.exe	109
PID 3568 wrote to memory of 1636	3568	9484efcd68c9f08af17542da0e0278d88ed2d5bdcc110ab43a138ca29b20ad71.exe	110
PID 3568 wrote to memory of 1636	3568	9484efcd68c9f08af17542da0e0278d88ed2d5bdcc110ab43a138ca29b20ad71.exe	110
PID 3568 wrote to memory of 2912	3568	9484efcd68c9f08af17542da0e0278d88ed2d5bdcc110ab43a138ca29b20ad71.exe	111
PID 3568 wrote to memory of 2912	3568	9484efcd68c9f08af17542da0e0278d88ed2d5bdcc110ab43a138ca29b20ad71.exe	111
PID 3568 wrote to memory of 1580	3568	9484efcd68c9f08af17542da0e0278d88ed2d5bdcc110ab43a138ca29b20ad71.exe	112
PID 3568 wrote to memory of 1580	3568	9484efcd68c9f08af17542da0e0278d88ed2d5bdcc110ab43a138ca29b20ad71.exe	112
PID 3568 wrote to memory of 3432	3568	9484efcd68c9f08af17542da0e0278d88ed2d5bdcc110ab43a138ca29b20ad71.exe	113
PID 3568 wrote to memory of 3432	3568	9484efcd68c9f08af17542da0e0278d88ed2d5bdcc110ab43a138ca29b20ad71.exe	113
PID 3568 wrote to memory of 4524	3568	9484efcd68c9f08af17542da0e0278d88ed2d5bdcc110ab43a138ca29b20ad71.exe	114
PID 3568 wrote to memory of 4524	3568	9484efcd68c9f08af17542da0e0278d88ed2d5bdcc110ab43a138ca29b20ad71.exe	114
PID 3568 wrote to memory of 1528	3568	9484efcd68c9f08af17542da0e0278d88ed2d5bdcc110ab43a138ca29b20ad71.exe	115
PID 3568 wrote to memory of 1528	3568	9484efcd68c9f08af17542da0e0278d88ed2d5bdcc110ab43a138ca29b20ad71.exe	115

C:\Users\Admin\AppData\Local\Temp\9484efcd68c9f08af17542da0e0278d88ed2d5bdcc110ab43a138ca29b20ad71.exe
"C:\Users\Admin\AppData\Local\Temp\9484efcd68c9f08af17542da0e0278d88ed2d5bdcc110ab43a138ca29b20ad71.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3568
- C:\Windows\System\TSsiwJC.exe
  C:\Windows\System\TSsiwJC.exe
  2⤵
  - Executes dropped EXE
  PID:4836
- C:\Windows\System\HfjFzqn.exe
  C:\Windows\System\HfjFzqn.exe
  2⤵
  - Executes dropped EXE
  PID:3604
- C:\Windows\System\vGiBpaR.exe
  C:\Windows\System\vGiBpaR.exe
  2⤵
  - Executes dropped EXE
  PID:1288
- C:\Windows\System\olEQggF.exe
  C:\Windows\System\olEQggF.exe
  2⤵
  - Executes dropped EXE
  PID:380
- C:\Windows\System\PDlXwjA.exe
  C:\Windows\System\PDlXwjA.exe
  2⤵
  - Executes dropped EXE
  PID:732
- C:\Windows\System\MzELvDx.exe
  C:\Windows\System\MzELvDx.exe
  2⤵
  - Executes dropped EXE
  PID:3772
- C:\Windows\System\MnMSDUb.exe
  C:\Windows\System\MnMSDUb.exe
  2⤵
  - Executes dropped EXE
  PID:3616
- C:\Windows\System\MyfEcWp.exe
  C:\Windows\System\MyfEcWp.exe
  2⤵
  - Executes dropped EXE
  PID:3872
- C:\Windows\System\TfKBNdT.exe
  C:\Windows\System\TfKBNdT.exe
  2⤵
  - Executes dropped EXE
  PID:2996
- C:\Windows\System\ZPqAWTX.exe
  C:\Windows\System\ZPqAWTX.exe
  2⤵
  - Executes dropped EXE
  PID:1908
- C:\Windows\System\ZZaklLB.exe
  C:\Windows\System\ZZaklLB.exe
  2⤵
  - Executes dropped EXE
  PID:2464
- C:\Windows\System\xCkWUVI.exe
  C:\Windows\System\xCkWUVI.exe
  2⤵
  - Executes dropped EXE
  PID:3632
- C:\Windows\System\xyZiszj.exe
  C:\Windows\System\xyZiszj.exe
  2⤵
  - Executes dropped EXE
  PID:4972
- C:\Windows\System\cVdybij.exe
  C:\Windows\System\cVdybij.exe
  2⤵
  - Executes dropped EXE
  PID:2100
- C:\Windows\System\DfbGWJl.exe
  C:\Windows\System\DfbGWJl.exe
  2⤵
  - Executes dropped EXE
  PID:3688
- C:\Windows\System\LbUvwTT.exe
  C:\Windows\System\LbUvwTT.exe
  2⤵
  - Executes dropped EXE
  PID:5104
- C:\Windows\System\WkzpPKi.exe
  C:\Windows\System\WkzpPKi.exe
  2⤵
  - Executes dropped EXE
  PID:232
- C:\Windows\System\tutpnQg.exe
  C:\Windows\System\tutpnQg.exe
  2⤵
  - Executes dropped EXE
  PID:2972
- C:\Windows\System\qzGTuHC.exe
  C:\Windows\System\qzGTuHC.exe
  2⤵
  - Executes dropped EXE
  PID:116
- C:\Windows\System\GSdWerG.exe
  C:\Windows\System\GSdWerG.exe
  2⤵
  - Executes dropped EXE
  PID:2276
- C:\Windows\System\dyHkLDZ.exe
  C:\Windows\System\dyHkLDZ.exe
  2⤵
  - Executes dropped EXE
  PID:2844
- C:\Windows\System\JwCgBWc.exe
  C:\Windows\System\JwCgBWc.exe
  2⤵
  - Executes dropped EXE
  PID:1284
- C:\Windows\System\DCfRtdJ.exe
  C:\Windows\System\DCfRtdJ.exe
  2⤵
  - Executes dropped EXE
  PID:1972
- C:\Windows\System\JJPoCFo.exe
  C:\Windows\System\JJPoCFo.exe
  2⤵
  - Executes dropped EXE
  PID:1372
- C:\Windows\System\xFguoIm.exe
  C:\Windows\System\xFguoIm.exe
  2⤵
  - Executes dropped EXE
  PID:2876
- C:\Windows\System\DPUPCwX.exe
  C:\Windows\System\DPUPCwX.exe
  2⤵
  - Executes dropped EXE
  PID:2384
- C:\Windows\System\wnVlwqi.exe
  C:\Windows\System\wnVlwqi.exe
  2⤵
  - Executes dropped EXE
  PID:1636
- C:\Windows\System\Npfaate.exe
  C:\Windows\System\Npfaate.exe
  2⤵
  - Executes dropped EXE
  PID:2912
- C:\Windows\System\RrKrbtS.exe
  C:\Windows\System\RrKrbtS.exe
  2⤵
  - Executes dropped EXE
  PID:1580
- C:\Windows\System\VqwzwVo.exe
  C:\Windows\System\VqwzwVo.exe
  2⤵
  - Executes dropped EXE
  PID:3432
- C:\Windows\System\jtNwlrC.exe
  C:\Windows\System\jtNwlrC.exe
  2⤵
  - Executes dropped EXE
  PID:4524
- C:\Windows\System\gkoDpHx.exe
  C:\Windows\System\gkoDpHx.exe
  2⤵
  - Executes dropped EXE
  PID:1528
- C:\Windows\System\rXINaMu.exe
  C:\Windows\System\rXINaMu.exe
  2⤵
  - Executes dropped EXE
  PID:876
- C:\Windows\System\zmkSNJl.exe
  C:\Windows\System\zmkSNJl.exe
  2⤵
  - Executes dropped EXE
  PID:1832
- C:\Windows\System\QsrVFai.exe
  C:\Windows\System\QsrVFai.exe
  2⤵
  - Executes dropped EXE
  PID:1488
- C:\Windows\System\ByzXnyn.exe
  C:\Windows\System\ByzXnyn.exe
  2⤵
  - Executes dropped EXE
  PID:1640
- C:\Windows\System\QpFXfpd.exe
  C:\Windows\System\QpFXfpd.exe
  2⤵
  - Executes dropped EXE
  PID:1368
- C:\Windows\System\nZdSswu.exe
  C:\Windows\System\nZdSswu.exe
  2⤵
  - Executes dropped EXE
  PID:1032
- C:\Windows\System\tnYlrda.exe
  C:\Windows\System\tnYlrda.exe
  2⤵
  - Executes dropped EXE
  PID:4412
- C:\Windows\System\IryzvtW.exe
  C:\Windows\System\IryzvtW.exe
  2⤵
  - Executes dropped EXE
  PID:3564
- C:\Windows\System\ASEpBRO.exe
  C:\Windows\System\ASEpBRO.exe
  2⤵
  - Executes dropped EXE
  PID:2556
- C:\Windows\System\mSeGebh.exe
  C:\Windows\System\mSeGebh.exe
  2⤵
  - Executes dropped EXE
  PID:2976
- C:\Windows\System\xqZIBIv.exe
  C:\Windows\System\xqZIBIv.exe
  2⤵
  - Executes dropped EXE
  PID:2476
- C:\Windows\System\nsxjqaF.exe
  C:\Windows\System\nsxjqaF.exe
  2⤵
  - Executes dropped EXE
  PID:2924
- C:\Windows\System\tRsKrkV.exe
  C:\Windows\System\tRsKrkV.exe
  2⤵
  - Executes dropped EXE
  PID:4936
- C:\Windows\System\DAiCXfc.exe
  C:\Windows\System\DAiCXfc.exe
  2⤵
  - Executes dropped EXE
  PID:324
- C:\Windows\System\AnzwxBN.exe
  C:\Windows\System\AnzwxBN.exe
  2⤵
  - Executes dropped EXE
  PID:3960
- C:\Windows\System\UdPNFzB.exe
  C:\Windows\System\UdPNFzB.exe
  2⤵
  - Executes dropped EXE
  PID:2764
- C:\Windows\System\gzgCnIV.exe
  C:\Windows\System\gzgCnIV.exe
  2⤵
  - Executes dropped EXE
  PID:3404
- C:\Windows\System\LwdYYTA.exe
  C:\Windows\System\LwdYYTA.exe
  2⤵
  - Executes dropped EXE
  PID:2020
- C:\Windows\System\ideVfdX.exe
  C:\Windows\System\ideVfdX.exe
  2⤵
  - Executes dropped EXE
  PID:408
- C:\Windows\System\ouXZwoc.exe
  C:\Windows\System\ouXZwoc.exe
  2⤵
  - Executes dropped EXE
  PID:2560
- C:\Windows\System\wuzCLBJ.exe
  C:\Windows\System\wuzCLBJ.exe
  2⤵
  - Executes dropped EXE
  PID:3876
- C:\Windows\System\ALhRfmk.exe
  C:\Windows\System\ALhRfmk.exe
  2⤵
  - Executes dropped EXE
  PID:3768
- C:\Windows\System\uckWhGd.exe
  C:\Windows\System\uckWhGd.exe
  2⤵
  - Executes dropped EXE
  PID:4000
- C:\Windows\System\idspRAn.exe
  C:\Windows\System\idspRAn.exe
  2⤵
  - Executes dropped EXE
  PID:2448
- C:\Windows\System\iFkaGdk.exe
  C:\Windows\System\iFkaGdk.exe
  2⤵
  - Executes dropped EXE
  PID:5076
- C:\Windows\System\ecjRKzV.exe
  C:\Windows\System\ecjRKzV.exe
  2⤵
  - Executes dropped EXE
  PID:1536
- C:\Windows\System\ZuTBkNT.exe
  C:\Windows\System\ZuTBkNT.exe
  2⤵
  - Executes dropped EXE
  PID:4448
- C:\Windows\System\XQXQiYx.exe
  C:\Windows\System\XQXQiYx.exe
  2⤵
  - Executes dropped EXE
  PID:4064
- C:\Windows\System\WpDJuea.exe
  C:\Windows\System\WpDJuea.exe
  2⤵
  - Executes dropped EXE
  PID:3556
- C:\Windows\System\OntVMCO.exe
  C:\Windows\System\OntVMCO.exe
  2⤵
  - Executes dropped EXE
  PID:1700
- C:\Windows\System\EfHxBWt.exe
  C:\Windows\System\EfHxBWt.exe
  2⤵
  - Executes dropped EXE
  PID:3112
- C:\Windows\System\TAuVPzn.exe
  C:\Windows\System\TAuVPzn.exe
  2⤵
  - Executes dropped EXE
  PID:3148
- C:\Windows\System\FEIiViA.exe
  C:\Windows\System\FEIiViA.exe
  2⤵
  PID:3468
- C:\Windows\System\YkbIoRg.exe
  C:\Windows\System\YkbIoRg.exe
  2⤵
  PID:2732
- C:\Windows\System\Vqyfhpt.exe
  C:\Windows\System\Vqyfhpt.exe
  2⤵
  PID:2088
- C:\Windows\System\qcDkury.exe
  C:\Windows\System\qcDkury.exe
  2⤵
  PID:3888
- C:\Windows\System\TtBepZu.exe
  C:\Windows\System\TtBepZu.exe
  2⤵
  PID:2756
- C:\Windows\System\XrGrFZh.exe
  C:\Windows\System\XrGrFZh.exe
  2⤵
  PID:4424
- C:\Windows\System\pLrtOtC.exe
  C:\Windows\System\pLrtOtC.exe
  2⤵
  PID:2312
- C:\Windows\System\TihspsH.exe
  C:\Windows\System\TihspsH.exe
  2⤵
  PID:4184
- C:\Windows\System\COHbqRP.exe
  C:\Windows\System\COHbqRP.exe
  2⤵
  PID:3412
- C:\Windows\System\FZoVAZS.exe
  C:\Windows\System\FZoVAZS.exe
  2⤵
  PID:2236
- C:\Windows\System\jaVvUBK.exe
  C:\Windows\System\jaVvUBK.exe
  2⤵
  PID:1324
- C:\Windows\System\vumsryd.exe
  C:\Windows\System\vumsryd.exe
  2⤵
  PID:644
- C:\Windows\System\IxIaiDk.exe
  C:\Windows\System\IxIaiDk.exe
  2⤵
  PID:5048
- C:\Windows\System\nRYgvBs.exe
  C:\Windows\System\nRYgvBs.exe
  2⤵
  PID:4200
- C:\Windows\System\buWuuGw.exe
  C:\Windows\System\buWuuGw.exe
  2⤵
  PID:3048
- C:\Windows\System\BHXHTKq.exe
  C:\Windows\System\BHXHTKq.exe
  2⤵
  PID:1080
- C:\Windows\System\IQwKuMv.exe
  C:\Windows\System\IQwKuMv.exe
  2⤵
  PID:4376
- C:\Windows\System\TjgRROA.exe
  C:\Windows\System\TjgRROA.exe
  2⤵
  PID:3344
- C:\Windows\System\PRpkubU.exe
  C:\Windows\System\PRpkubU.exe
  2⤵
  PID:2440
- C:\Windows\System\fFIjHYA.exe
  C:\Windows\System\fFIjHYA.exe
  2⤵
  PID:1712
- C:\Windows\System\QDNEFnh.exe
  C:\Windows\System\QDNEFnh.exe
  2⤵
  PID:4124
- C:\Windows\System\MySaUIv.exe
  C:\Windows\System\MySaUIv.exe
  2⤵
  PID:3236
- C:\Windows\System\esamSAo.exe
  C:\Windows\System\esamSAo.exe
  2⤵
  PID:2032
- C:\Windows\System\gSTNBmw.exe
  C:\Windows\System\gSTNBmw.exe
  2⤵
  PID:2432
- C:\Windows\System\KIcXHdy.exe
  C:\Windows\System\KIcXHdy.exe
  2⤵
  PID:220
- C:\Windows\System\ZXmGKeD.exe
  C:\Windows\System\ZXmGKeD.exe
  2⤵
  PID:4676
- C:\Windows\System\ISEqqMS.exe
  C:\Windows\System\ISEqqMS.exe
  2⤵
  PID:2120
- C:\Windows\System\YEEsTPr.exe
  C:\Windows\System\YEEsTPr.exe
  2⤵
  PID:2796
- C:\Windows\System\xaPcAkq.exe
  C:\Windows\System\xaPcAkq.exe
  2⤵
  PID:2460
- C:\Windows\System\OsCoWRU.exe
  C:\Windows\System\OsCoWRU.exe
  2⤵
  PID:4272
- C:\Windows\System\RWqCGgo.exe
  C:\Windows\System\RWqCGgo.exe
  2⤵
  PID:3736
- C:\Windows\System\NjtycFm.exe
  C:\Windows\System\NjtycFm.exe
  2⤵
  PID:628
- C:\Windows\System\MTdbIYH.exe
  C:\Windows\System\MTdbIYH.exe
  2⤵
  PID:3092
- C:\Windows\System\opjRLwt.exe
  C:\Windows\System\opjRLwt.exe
  2⤵
  PID:1460
- C:\Windows\System\qXSSWKj.exe
  C:\Windows\System\qXSSWKj.exe
  2⤵
  PID:4244
- C:\Windows\System\XwXqhbP.exe
  C:\Windows\System\XwXqhbP.exe
  2⤵
  PID:3992
- C:\Windows\System\RoSUfqx.exe
  C:\Windows\System\RoSUfqx.exe
  2⤵
  PID:4956
- C:\Windows\System\dSxJLlC.exe
  C:\Windows\System\dSxJLlC.exe
  2⤵
  PID:1800
- C:\Windows\System\QbDJoPr.exe
  C:\Windows\System\QbDJoPr.exe
  2⤵
  PID:4848
- C:\Windows\System\juSeGkr.exe
  C:\Windows\System\juSeGkr.exe
  2⤵
  PID:4896
- C:\Windows\System\FZpjMNz.exe
  C:\Windows\System\FZpjMNz.exe
  2⤵
  PID:2416
- C:\Windows\System\dpFdrLW.exe
  C:\Windows\System\dpFdrLW.exe
  2⤵
  PID:5140
- C:\Windows\System\ZIBdrgB.exe
  C:\Windows\System\ZIBdrgB.exe
  2⤵
  PID:5172
- C:\Windows\System\lkumPnX.exe
  C:\Windows\System\lkumPnX.exe
  2⤵
  PID:5208
- C:\Windows\System\QzOWPQC.exe
  C:\Windows\System\QzOWPQC.exe
  2⤵
  PID:5232
- C:\Windows\System\LgpkRzr.exe
  C:\Windows\System\LgpkRzr.exe
  2⤵
  PID:5264
- C:\Windows\System\MkwPxNz.exe
  C:\Windows\System\MkwPxNz.exe
  2⤵
  PID:5292
- C:\Windows\System\PZCSXAK.exe
  C:\Windows\System\PZCSXAK.exe
  2⤵
  PID:5312
- C:\Windows\System\KZDWqZo.exe
  C:\Windows\System\KZDWqZo.exe
  2⤵
  PID:5348
- C:\Windows\System\WQqoogM.exe
  C:\Windows\System\WQqoogM.exe
  2⤵
  PID:5368
- C:\Windows\System\XbJRgRw.exe
  C:\Windows\System\XbJRgRw.exe
  2⤵
  PID:5384
- C:\Windows\System\oAXwpdd.exe
  C:\Windows\System\oAXwpdd.exe
  2⤵
  PID:5420
- C:\Windows\System\uxVWcwj.exe
  C:\Windows\System\uxVWcwj.exe
  2⤵
  PID:5460
- C:\Windows\System\iTvSWbG.exe
  C:\Windows\System\iTvSWbG.exe
  2⤵
  PID:5504
- C:\Windows\System\rjWhweN.exe
  C:\Windows\System\rjWhweN.exe
  2⤵
  PID:5536
- C:\Windows\System\KVThSmD.exe
  C:\Windows\System\KVThSmD.exe
  2⤵
  PID:5552
- C:\Windows\System\EjMELHk.exe
  C:\Windows\System\EjMELHk.exe
  2⤵
  PID:5580
- C:\Windows\System\TJtNWbe.exe
  C:\Windows\System\TJtNWbe.exe
  2⤵
  PID:5608
- C:\Windows\System\kOGcqlB.exe
  C:\Windows\System\kOGcqlB.exe
  2⤵
  PID:5624
- C:\Windows\System\TfLeJvn.exe
  C:\Windows\System\TfLeJvn.exe
  2⤵
  PID:5672
- C:\Windows\System\nbXxQaZ.exe
  C:\Windows\System\nbXxQaZ.exe
  2⤵
  PID:5692
- C:\Windows\System\QVHTwzc.exe
  C:\Windows\System\QVHTwzc.exe
  2⤵
  PID:5716
- C:\Windows\System\xSWpbGt.exe
  C:\Windows\System\xSWpbGt.exe
  2⤵
  PID:5744
- C:\Windows\System\bsripzK.exe
  C:\Windows\System\bsripzK.exe
  2⤵
  PID:5768
- C:\Windows\System\mzmqDWY.exe
  C:\Windows\System\mzmqDWY.exe
  2⤵
  PID:5804
- C:\Windows\System\tqVmqMd.exe
  C:\Windows\System\tqVmqMd.exe
  2⤵
  PID:5836
- C:\Windows\System\PEzZIlu.exe
  C:\Windows\System\PEzZIlu.exe
  2⤵
  PID:5868
- C:\Windows\System\kcxpcvC.exe
  C:\Windows\System\kcxpcvC.exe
  2⤵
  PID:5884
- C:\Windows\System\fBntUcI.exe
  C:\Windows\System\fBntUcI.exe
  2⤵
  PID:5912
- C:\Windows\System\EDYcolk.exe
  C:\Windows\System\EDYcolk.exe
  2⤵
  PID:5940
- C:\Windows\System\iiyFJwz.exe
  C:\Windows\System\iiyFJwz.exe
  2⤵
  PID:5972
- C:\Windows\System\qcfntfA.exe
  C:\Windows\System\qcfntfA.exe
  2⤵
  PID:5992
- C:\Windows\System\MCIevzU.exe
  C:\Windows\System\MCIevzU.exe
  2⤵
  PID:6020
- C:\Windows\System\aCslMHN.exe
  C:\Windows\System\aCslMHN.exe
  2⤵
  PID:6040
- C:\Windows\System\qFlGygy.exe
  C:\Windows\System\qFlGygy.exe
  2⤵
  PID:6060
- C:\Windows\System\yefIqIg.exe
  C:\Windows\System\yefIqIg.exe
  2⤵
  PID:6096
- C:\Windows\System\oBFNsEp.exe
  C:\Windows\System\oBFNsEp.exe
  2⤵
  PID:6124
- C:\Windows\System\sojPIBL.exe
  C:\Windows\System\sojPIBL.exe
  2⤵
  PID:5132
- C:\Windows\System\nFJHyZy.exe
  C:\Windows\System\nFJHyZy.exe
  2⤵
  PID:5192
- C:\Windows\System\XRLaYqZ.exe
  C:\Windows\System\XRLaYqZ.exe
  2⤵
  PID:5280
- C:\Windows\System\yhxVoEV.exe
  C:\Windows\System\yhxVoEV.exe
  2⤵
  PID:5304
- C:\Windows\System\WyEkpPD.exe
  C:\Windows\System\WyEkpPD.exe
  2⤵
  PID:5380
- C:\Windows\System\YNLYljh.exe
  C:\Windows\System\YNLYljh.exe
  2⤵
  PID:5488
- C:\Windows\System\btWkpLc.exe
  C:\Windows\System\btWkpLc.exe
  2⤵
  PID:5568
- C:\Windows\System\tLoyFMV.exe
  C:\Windows\System\tLoyFMV.exe
  2⤵
  PID:5596
- C:\Windows\System\KUKJDsc.exe
  C:\Windows\System\KUKJDsc.exe
  2⤵
  PID:5664
- C:\Windows\System\wDLOHMl.exe
  C:\Windows\System\wDLOHMl.exe
  2⤵
  PID:5728
- C:\Windows\System\JQkFXYw.exe
  C:\Windows\System\JQkFXYw.exe
  2⤵
  PID:5788
- C:\Windows\System\laThGsX.exe
  C:\Windows\System\laThGsX.exe
  2⤵
  PID:5848
- C:\Windows\System\AxhcJRx.exe
  C:\Windows\System\AxhcJRx.exe
  2⤵
  PID:5880
- C:\Windows\System\VvYfrSq.exe
  C:\Windows\System\VvYfrSq.exe
  2⤵
  PID:5960
- C:\Windows\System\OvoiMHJ.exe
  C:\Windows\System\OvoiMHJ.exe
  2⤵
  PID:5980
- C:\Windows\System\ifWwPYl.exe
  C:\Windows\System\ifWwPYl.exe
  2⤵
  PID:6112
- C:\Windows\System\VjkuOUL.exe
  C:\Windows\System\VjkuOUL.exe
  2⤵
  PID:5156
- C:\Windows\System\xSPRkMM.exe
  C:\Windows\System\xSPRkMM.exe
  2⤵
  PID:5248
- C:\Windows\System\foGpuaf.exe
  C:\Windows\System\foGpuaf.exe
  2⤵
  PID:5336
- C:\Windows\System\YoNmmnt.exe
  C:\Windows\System\YoNmmnt.exe
  2⤵
  PID:5520
- C:\Windows\System\ebMrTLG.exe
  C:\Windows\System\ebMrTLG.exe
  2⤵
  PID:5656
- C:\Windows\System\kcWjHVL.exe
  C:\Windows\System\kcWjHVL.exe
  2⤵
  PID:5764
- C:\Windows\System\geTJknh.exe
  C:\Windows\System\geTJknh.exe
  2⤵
  PID:6072
- C:\Windows\System\kBlYpnV.exe
  C:\Windows\System\kBlYpnV.exe
  2⤵
  PID:6052
- C:\Windows\System\iIJEpMH.exe
  C:\Windows\System\iIJEpMH.exe
  2⤵
  PID:5684
- C:\Windows\System\eOZRxLw.exe
  C:\Windows\System\eOZRxLw.exe
  2⤵
  PID:5688
- C:\Windows\System\LPYZnDk.exe
  C:\Windows\System\LPYZnDk.exe
  2⤵
  PID:5452
- C:\Windows\System\wMpzrQF.exe
  C:\Windows\System\wMpzrQF.exe
  2⤵
  PID:6164
- C:\Windows\System\UzBmffS.exe
  C:\Windows\System\UzBmffS.exe
  2⤵
  PID:6188
- C:\Windows\System\rFCyxgz.exe
  C:\Windows\System\rFCyxgz.exe
  2⤵
  PID:6216
- C:\Windows\System\CUEmAjC.exe
  C:\Windows\System\CUEmAjC.exe
  2⤵
  PID:6252
- C:\Windows\System\NPlEhBu.exe
  C:\Windows\System\NPlEhBu.exe
  2⤵
  PID:6284
- C:\Windows\System\qvrUNxH.exe
  C:\Windows\System\qvrUNxH.exe
  2⤵
  PID:6316
- C:\Windows\System\rQIqWHL.exe
  C:\Windows\System\rQIqWHL.exe
  2⤵
  PID:6332
- C:\Windows\System\bIfqDiX.exe
  C:\Windows\System\bIfqDiX.exe
  2⤵
  PID:6360
- C:\Windows\System\HcmbBkx.exe
  C:\Windows\System\HcmbBkx.exe
  2⤵
  PID:6380
- C:\Windows\System\daxCVjj.exe
  C:\Windows\System\daxCVjj.exe
  2⤵
  PID:6412
- C:\Windows\System\AWddAiN.exe
  C:\Windows\System\AWddAiN.exe
  2⤵
  PID:6436
- C:\Windows\System\TuDsPvb.exe
  C:\Windows\System\TuDsPvb.exe
  2⤵
  PID:6464
- C:\Windows\System\JxlubfF.exe
  C:\Windows\System\JxlubfF.exe
  2⤵
  PID:6496
- C:\Windows\System\gDtQzTx.exe
  C:\Windows\System\gDtQzTx.exe
  2⤵
  PID:6528
- C:\Windows\System\WCDtjbq.exe
  C:\Windows\System\WCDtjbq.exe
  2⤵
  PID:6556
- C:\Windows\System\fjjYRsf.exe
  C:\Windows\System\fjjYRsf.exe
  2⤵
  PID:6576
- C:\Windows\System\VFXvAve.exe
  C:\Windows\System\VFXvAve.exe
  2⤵
  PID:6596
- C:\Windows\System\NElRcLC.exe
  C:\Windows\System\NElRcLC.exe
  2⤵
  PID:6616
- C:\Windows\System\kcPOGya.exe
  C:\Windows\System\kcPOGya.exe
  2⤵
  PID:6636
- C:\Windows\System\CePRQbS.exe
  C:\Windows\System\CePRQbS.exe
  2⤵
  PID:6664
- C:\Windows\System\YkNdAul.exe
  C:\Windows\System\YkNdAul.exe
  2⤵
  PID:6696
- C:\Windows\System\YsRWubj.exe
  C:\Windows\System\YsRWubj.exe
  2⤵
  PID:6728
- C:\Windows\System\UksSxlA.exe
  C:\Windows\System\UksSxlA.exe
  2⤵
  PID:6768
- C:\Windows\System\PTqCffI.exe
  C:\Windows\System\PTqCffI.exe
  2⤵
  PID:6796
- C:\Windows\System\lGtjNkh.exe
  C:\Windows\System\lGtjNkh.exe
  2⤵
  PID:6840
- C:\Windows\System\UvEfMbp.exe
  C:\Windows\System\UvEfMbp.exe
  2⤵
  PID:6864
- C:\Windows\System\WoGtyYe.exe
  C:\Windows\System\WoGtyYe.exe
  2⤵
  PID:6888
- C:\Windows\System\AUaDHGn.exe
  C:\Windows\System\AUaDHGn.exe
  2⤵
  PID:6920
- C:\Windows\System\QfDSSry.exe
  C:\Windows\System\QfDSSry.exe
  2⤵
  PID:6944
- C:\Windows\System\kXKiPTr.exe
  C:\Windows\System\kXKiPTr.exe
  2⤵
  PID:6976
- C:\Windows\System\cSpOFFC.exe
  C:\Windows\System\cSpOFFC.exe
  2⤵
  PID:7008
- C:\Windows\System\lIoJIKZ.exe
  C:\Windows\System\lIoJIKZ.exe
  2⤵
  PID:7036
- C:\Windows\System\kRgOwKY.exe
  C:\Windows\System\kRgOwKY.exe
  2⤵
  PID:7060
- C:\Windows\System\YRxtLqX.exe
  C:\Windows\System\YRxtLqX.exe
  2⤵
  PID:7088
- C:\Windows\System\yzkYPGt.exe
  C:\Windows\System\yzkYPGt.exe
  2⤵
  PID:7112
- C:\Windows\System\dXwECQh.exe
  C:\Windows\System\dXwECQh.exe
  2⤵
  PID:7144
- C:\Windows\System\hgvXAQd.exe
  C:\Windows\System\hgvXAQd.exe
  2⤵
  PID:5896
- C:\Windows\System\couPewY.exe
  C:\Windows\System\couPewY.exe
  2⤵
  PID:6156
- C:\Windows\System\QDfQIXE.exe
  C:\Windows\System\QDfQIXE.exe
  2⤵
  PID:6200
- C:\Windows\System\FEBXEFv.exe
  C:\Windows\System\FEBXEFv.exe
  2⤵
  PID:6236
- C:\Windows\System\OOhQoSc.exe
  C:\Windows\System\OOhQoSc.exe
  2⤵
  PID:6300
- C:\Windows\System\CfSCUWD.exe
  C:\Windows\System\CfSCUWD.exe
  2⤵
  PID:6352
- C:\Windows\System\eYOLugx.exe
  C:\Windows\System\eYOLugx.exe
  2⤵
  PID:6424
- C:\Windows\System\CNbHbYC.exe
  C:\Windows\System\CNbHbYC.exe
  2⤵
  PID:6492
- C:\Windows\System\KNpfLJM.exe
  C:\Windows\System\KNpfLJM.exe
  2⤵
  PID:6484
- C:\Windows\System\TyymYTC.exe
  C:\Windows\System\TyymYTC.exe
  2⤵
  PID:6584
- C:\Windows\System\VCtSJTf.exe
  C:\Windows\System\VCtSJTf.exe
  2⤵
  PID:6720
- C:\Windows\System\BpjcYKc.exe
  C:\Windows\System\BpjcYKc.exe
  2⤵
  PID:6680
- C:\Windows\System\jBSBSZp.exe
  C:\Windows\System\jBSBSZp.exe
  2⤵
  PID:6760
- C:\Windows\System\YtphLjg.exe
  C:\Windows\System\YtphLjg.exe
  2⤵
  PID:6880
- C:\Windows\System\jKVuWoB.exe
  C:\Windows\System\jKVuWoB.exe
  2⤵
  PID:6940
- C:\Windows\System\WyYqCRp.exe
  C:\Windows\System\WyYqCRp.exe
  2⤵
  PID:7032
- C:\Windows\System\sSLjoAc.exe
  C:\Windows\System\sSLjoAc.exe
  2⤵
  PID:7052
- C:\Windows\System\mJCtJgL.exe
  C:\Windows\System\mJCtJgL.exe
  2⤵
  PID:7128
- C:\Windows\System\vbzlimd.exe
  C:\Windows\System\vbzlimd.exe
  2⤵
  PID:7132
- C:\Windows\System\GIZfvsT.exe
  C:\Windows\System\GIZfvsT.exe
  2⤵
  PID:6376
- C:\Windows\System\KJVOoAR.exe
  C:\Windows\System\KJVOoAR.exe
  2⤵
  PID:6176
- C:\Windows\System\FrqYmWO.exe
  C:\Windows\System\FrqYmWO.exe
  2⤵
  PID:6652
- C:\Windows\System\zPHXOJy.exe
  C:\Windows\System\zPHXOJy.exe
  2⤵
  PID:6808
- C:\Windows\System\bUHWXFd.exe
  C:\Windows\System\bUHWXFd.exe
  2⤵
  PID:6716
- C:\Windows\System\zwhXSUg.exe
  C:\Windows\System\zwhXSUg.exe
  2⤵
  PID:6952
- C:\Windows\System\luZlVhd.exe
  C:\Windows\System\luZlVhd.exe
  2⤵
  PID:6884
- C:\Windows\System\yPsSzac.exe
  C:\Windows\System\yPsSzac.exe
  2⤵
  PID:7136
- C:\Windows\System\fTDbkiN.exe
  C:\Windows\System\fTDbkiN.exe
  2⤵
  PID:6712
- C:\Windows\System\VIBcXht.exe
  C:\Windows\System\VIBcXht.exe
  2⤵
  PID:7192
- C:\Windows\System\ojwMhnH.exe
  C:\Windows\System\ojwMhnH.exe
  2⤵
  PID:7220
- C:\Windows\System\hTVpJJI.exe
  C:\Windows\System\hTVpJJI.exe
  2⤵
  PID:7256
- C:\Windows\System\yhoTeQj.exe
  C:\Windows\System\yhoTeQj.exe
  2⤵
  PID:7280
- C:\Windows\System\RFKiOOC.exe
  C:\Windows\System\RFKiOOC.exe
  2⤵
  PID:7308
- C:\Windows\System\TvGsgpk.exe
  C:\Windows\System\TvGsgpk.exe
  2⤵
  PID:7332
- C:\Windows\System\sVcObLR.exe
  C:\Windows\System\sVcObLR.exe
  2⤵
  PID:7364
- C:\Windows\System\QNmxCYr.exe
  C:\Windows\System\QNmxCYr.exe
  2⤵
  PID:7388
- C:\Windows\System\GvcFZqX.exe
  C:\Windows\System\GvcFZqX.exe
  2⤵
  PID:7412
- C:\Windows\System\wKmIWtu.exe
  C:\Windows\System\wKmIWtu.exe
  2⤵
  PID:7440
- C:\Windows\System\nHvPvmu.exe
  C:\Windows\System\nHvPvmu.exe
  2⤵
  PID:7460
- C:\Windows\System\pQSBtXH.exe
  C:\Windows\System\pQSBtXH.exe
  2⤵
  PID:7496
- C:\Windows\System\UYrZtqW.exe
  C:\Windows\System\UYrZtqW.exe
  2⤵
  PID:7524
- C:\Windows\System\vjSHHgW.exe
  C:\Windows\System\vjSHHgW.exe
  2⤵
  PID:7548
- C:\Windows\System\MtMhXHN.exe
  C:\Windows\System\MtMhXHN.exe
  2⤵
  PID:7580
- C:\Windows\System\wrMrDmP.exe
  C:\Windows\System\wrMrDmP.exe
  2⤵
  PID:7612
- C:\Windows\System\EQOfCql.exe
  C:\Windows\System\EQOfCql.exe
  2⤵
  PID:7644
- C:\Windows\System\PFioNoS.exe
  C:\Windows\System\PFioNoS.exe
  2⤵
  PID:7672
- C:\Windows\System\MsibMuT.exe
  C:\Windows\System\MsibMuT.exe
  2⤵
  PID:7700
- C:\Windows\System\bJHKUCy.exe
  C:\Windows\System\bJHKUCy.exe
  2⤵
  PID:7728
- C:\Windows\System\iygHPWY.exe
  C:\Windows\System\iygHPWY.exe
  2⤵
  PID:7752
- C:\Windows\System\vTqJQgM.exe
  C:\Windows\System\vTqJQgM.exe
  2⤵
  PID:7772
- C:\Windows\System\GPWtfGX.exe
  C:\Windows\System\GPWtfGX.exe
  2⤵
  PID:7804
- C:\Windows\System\MzKKOKu.exe
  C:\Windows\System\MzKKOKu.exe
  2⤵
  PID:7832
- C:\Windows\System\zBfiAMQ.exe
  C:\Windows\System\zBfiAMQ.exe
  2⤵
  PID:7856
- C:\Windows\System\LadMUqp.exe
  C:\Windows\System\LadMUqp.exe
  2⤵
  PID:7892
- C:\Windows\System\xiyUCIN.exe
  C:\Windows\System\xiyUCIN.exe
  2⤵
  PID:7916
- C:\Windows\System\ycgCbPd.exe
  C:\Windows\System\ycgCbPd.exe
  2⤵
  PID:7948
- C:\Windows\System\JkAvrub.exe
  C:\Windows\System\JkAvrub.exe
  2⤵
  PID:7976
- C:\Windows\System\uPkhjHF.exe
  C:\Windows\System\uPkhjHF.exe
  2⤵
  PID:7992
- C:\Windows\System\SvPMFBm.exe
  C:\Windows\System\SvPMFBm.exe
  2⤵
  PID:8020
- C:\Windows\System\ivOmeRp.exe
  C:\Windows\System\ivOmeRp.exe
  2⤵
  PID:8056
- C:\Windows\System\LNjMegY.exe
  C:\Windows\System\LNjMegY.exe
  2⤵
  PID:8084
- C:\Windows\System\eioHRkl.exe
  C:\Windows\System\eioHRkl.exe
  2⤵
  PID:8100
- C:\Windows\System\mqnJSIc.exe
  C:\Windows\System\mqnJSIc.exe
  2⤵
  PID:8132
- C:\Windows\System\CzlGiHP.exe
  C:\Windows\System\CzlGiHP.exe
  2⤵
  PID:8156
- C:\Windows\System\mhitqVN.exe
  C:\Windows\System\mhitqVN.exe
  2⤵
  PID:8176
- C:\Windows\System\DAAgEhb.exe
  C:\Windows\System\DAAgEhb.exe
  2⤵
  PID:6228
- C:\Windows\System\ZidTNKB.exe
  C:\Windows\System\ZidTNKB.exe
  2⤵
  PID:7164
- C:\Windows\System\IGpkGdN.exe
  C:\Windows\System\IGpkGdN.exe
  2⤵
  PID:6324
- C:\Windows\System\snVlUDV.exe
  C:\Windows\System\snVlUDV.exe
  2⤵
  PID:7252
- C:\Windows\System\aXlDCUp.exe
  C:\Windows\System\aXlDCUp.exe
  2⤵
  PID:7268
- C:\Windows\System\txbtapy.exe
  C:\Windows\System\txbtapy.exe
  2⤵
  PID:7292
- C:\Windows\System\zZZOFcB.exe
  C:\Windows\System\zZZOFcB.exe
  2⤵
  PID:7356
- C:\Windows\System\zdUIsOT.exe
  C:\Windows\System\zdUIsOT.exe
  2⤵
  PID:7400
- C:\Windows\System\yshTBDm.exe
  C:\Windows\System\yshTBDm.exe
  2⤵
  PID:7604
- C:\Windows\System\wJiXzAP.exe
  C:\Windows\System\wJiXzAP.exe
  2⤵
  PID:7640
- C:\Windows\System\HsfmnAr.exe
  C:\Windows\System\HsfmnAr.exe
  2⤵
  PID:7572
- C:\Windows\System\krVWeJt.exe
  C:\Windows\System\krVWeJt.exe
  2⤵
  PID:7660
- C:\Windows\System\MQAWHBG.exe
  C:\Windows\System\MQAWHBG.exe
  2⤵
  PID:7800
- C:\Windows\System\aPINoXo.exe
  C:\Windows\System\aPINoXo.exe
  2⤵
  PID:7764
- C:\Windows\System\tufbIJC.exe
  C:\Windows\System\tufbIJC.exe
  2⤵
  PID:7928
- C:\Windows\System\WcBxUQv.exe
  C:\Windows\System\WcBxUQv.exe
  2⤵
  PID:7880
- C:\Windows\System\fwbiKHx.exe
  C:\Windows\System\fwbiKHx.exe
  2⤵
  PID:8072
- C:\Windows\System\UQvmdBo.exe
  C:\Windows\System\UQvmdBo.exe
  2⤵
  PID:8116
- C:\Windows\System\hFSTKuL.exe
  C:\Windows\System\hFSTKuL.exe
  2⤵
  PID:6908
- C:\Windows\System\YeVjXTz.exe
  C:\Windows\System\YeVjXTz.exe
  2⤵
  PID:8092
- C:\Windows\System\sNqMfVq.exe
  C:\Windows\System\sNqMfVq.exe
  2⤵
  PID:8112
- C:\Windows\System\LoKqDxe.exe
  C:\Windows\System\LoKqDxe.exe
  2⤵
  PID:7344
- C:\Windows\System\ZOicTFv.exe
  C:\Windows\System\ZOicTFv.exe
  2⤵
  PID:7480
- C:\Windows\System\qWvdOZD.exe
  C:\Windows\System\qWvdOZD.exe
  2⤵
  PID:7868
- C:\Windows\System\HIwjVYe.exe
  C:\Windows\System\HIwjVYe.exe
  2⤵
  PID:7544
- C:\Windows\System\ljSReSJ.exe
  C:\Windows\System\ljSReSJ.exe
  2⤵
  PID:7632
- C:\Windows\System\LMEgetB.exe
  C:\Windows\System\LMEgetB.exe
  2⤵
  PID:8208
- C:\Windows\System\hAQuHYC.exe
  C:\Windows\System\hAQuHYC.exe
  2⤵
  PID:8228
- C:\Windows\System\VVvwCYL.exe
  C:\Windows\System\VVvwCYL.exe
  2⤵
  PID:8252
- C:\Windows\System\fEmMcBl.exe
  C:\Windows\System\fEmMcBl.exe
  2⤵
  PID:8268
- C:\Windows\System\QRdRlUq.exe
  C:\Windows\System\QRdRlUq.exe
  2⤵
  PID:8288
- C:\Windows\System\PdILaTm.exe
  C:\Windows\System\PdILaTm.exe
  2⤵
  PID:8316
- C:\Windows\System\vbgyBDf.exe
  C:\Windows\System\vbgyBDf.exe
  2⤵
  PID:8340
- C:\Windows\System\QOgYRew.exe
  C:\Windows\System\QOgYRew.exe
  2⤵
  PID:8364
- C:\Windows\System\mYCkgGf.exe
  C:\Windows\System\mYCkgGf.exe
  2⤵
  PID:8388
- C:\Windows\System\YmxMBJL.exe
  C:\Windows\System\YmxMBJL.exe
  2⤵
  PID:8412
- C:\Windows\System\dtcZxDJ.exe
  C:\Windows\System\dtcZxDJ.exe
  2⤵
  PID:8436
- C:\Windows\System\mzWJgzK.exe
  C:\Windows\System\mzWJgzK.exe
  2⤵
  PID:8472
- C:\Windows\System\WOyfIup.exe
  C:\Windows\System\WOyfIup.exe
  2⤵
  PID:8492
- C:\Windows\System\kJXfhRj.exe
  C:\Windows\System\kJXfhRj.exe
  2⤵
  PID:8516
- C:\Windows\System\OPnLYcx.exe
  C:\Windows\System\OPnLYcx.exe
  2⤵
  PID:8536
- C:\Windows\System\kohrMpe.exe
  C:\Windows\System\kohrMpe.exe
  2⤵
  PID:8552
- C:\Windows\System\qBgZAAK.exe
  C:\Windows\System\qBgZAAK.exe
  2⤵
  PID:8580
- C:\Windows\System\eXIoZaW.exe
  C:\Windows\System\eXIoZaW.exe
  2⤵
  PID:8616
- C:\Windows\System\hVaaxkO.exe
  C:\Windows\System\hVaaxkO.exe
  2⤵
  PID:8644
- C:\Windows\System\xKWIKDw.exe
  C:\Windows\System\xKWIKDw.exe
  2⤵
  PID:8672
- C:\Windows\System\DcWvlLg.exe
  C:\Windows\System\DcWvlLg.exe
  2⤵
  PID:8708
- C:\Windows\System\NbBZUqq.exe
  C:\Windows\System\NbBZUqq.exe
  2⤵
  PID:8744
- C:\Windows\System\ZiTyKkn.exe
  C:\Windows\System\ZiTyKkn.exe
  2⤵
  PID:8772
- C:\Windows\System\DGgdexl.exe
  C:\Windows\System\DGgdexl.exe
  2⤵
  PID:8804
- C:\Windows\System\imLIRao.exe
  C:\Windows\System\imLIRao.exe
  2⤵
  PID:8820
- C:\Windows\System\YYEqXOg.exe
  C:\Windows\System\YYEqXOg.exe
  2⤵
  PID:8840
- C:\Windows\System\mHgHLKQ.exe
  C:\Windows\System\mHgHLKQ.exe
  2⤵
  PID:8864
- C:\Windows\System\NawvdYs.exe
  C:\Windows\System\NawvdYs.exe
  2⤵
  PID:8896
- C:\Windows\System\rshDHSu.exe
  C:\Windows\System\rshDHSu.exe
  2⤵
  PID:8924
- C:\Windows\System\HaLXKVE.exe
  C:\Windows\System\HaLXKVE.exe
  2⤵
  PID:8952
- C:\Windows\System\LPdmjdw.exe
  C:\Windows\System\LPdmjdw.exe
  2⤵
  PID:8980
- C:\Windows\System\qPYrCqw.exe
  C:\Windows\System\qPYrCqw.exe
  2⤵
  PID:9016
- C:\Windows\System\bAFjGUx.exe
  C:\Windows\System\bAFjGUx.exe
  2⤵
  PID:9044
- C:\Windows\System\REbCJwj.exe
  C:\Windows\System\REbCJwj.exe
  2⤵
  PID:9072
- C:\Windows\System\RJVVBLD.exe
  C:\Windows\System\RJVVBLD.exe
  2⤵
  PID:9096
- C:\Windows\System\fwtBkTj.exe
  C:\Windows\System\fwtBkTj.exe
  2⤵
  PID:9124
- C:\Windows\System\WbltXfi.exe
  C:\Windows\System\WbltXfi.exe
  2⤵
  PID:9148
- C:\Windows\System\skoRrSF.exe
  C:\Windows\System\skoRrSF.exe
  2⤵
  PID:9180
- C:\Windows\System\gkNCjpX.exe
  C:\Windows\System\gkNCjpX.exe
  2⤵
  PID:9208
- C:\Windows\System\AJebYbv.exe
  C:\Windows\System\AJebYbv.exe
  2⤵
  PID:7084
- C:\Windows\System\AzWkMpz.exe
  C:\Windows\System\AzWkMpz.exe
  2⤵
  PID:7932
- C:\Windows\System\xUgbgRg.exe
  C:\Windows\System\xUgbgRg.exe
  2⤵
  PID:8140
- C:\Windows\System\SgykGOE.exe
  C:\Windows\System\SgykGOE.exe
  2⤵
  PID:8204
- C:\Windows\System\kXdfgqi.exe
  C:\Windows\System\kXdfgqi.exe
  2⤵
  PID:8008
- C:\Windows\System\OBRnhJN.exe
  C:\Windows\System\OBRnhJN.exe
  2⤵
  PID:8384
- C:\Windows\System\BjMjoEm.exe
  C:\Windows\System\BjMjoEm.exe
  2⤵
  PID:8424
- C:\Windows\System\QWYiien.exe
  C:\Windows\System\QWYiien.exe
  2⤵
  PID:8324
- C:\Windows\System\RRbyaPw.exe
  C:\Windows\System\RRbyaPw.exe
  2⤵
  PID:8484
- C:\Windows\System\xBhnViC.exe
  C:\Windows\System\xBhnViC.exe
  2⤵
  PID:8460
- C:\Windows\System\rajUDmD.exe
  C:\Windows\System\rajUDmD.exe
  2⤵
  PID:8592
- C:\Windows\System\JgQdCcX.exe
  C:\Windows\System\JgQdCcX.exe
  2⤵
  PID:8756
- C:\Windows\System\VOVzJBv.exe
  C:\Windows\System\VOVzJBv.exe
  2⤵
  PID:8788
- C:\Windows\System\OJPZHnJ.exe
  C:\Windows\System\OJPZHnJ.exe
  2⤵
  PID:8888
- C:\Windows\System\JDVWzol.exe
  C:\Windows\System\JDVWzol.exe
  2⤵
  PID:8916
- C:\Windows\System\dfzTmvE.exe
  C:\Windows\System\dfzTmvE.exe
  2⤵
  PID:8784
- C:\Windows\System\gJSFIAs.exe
  C:\Windows\System\gJSFIAs.exe
  2⤵
  PID:9024
- C:\Windows\System\lpVvgEf.exe
  C:\Windows\System\lpVvgEf.exe
  2⤵
  PID:8848
- C:\Windows\System\TDYtLQa.exe
  C:\Windows\System\TDYtLQa.exe
  2⤵
  PID:9000
- C:\Windows\System\ExLTzRl.exe
  C:\Windows\System\ExLTzRl.exe
  2⤵
  PID:9060
- C:\Windows\System\MfjgfhU.exe
  C:\Windows\System\MfjgfhU.exe
  2⤵
  PID:8828
- C:\Windows\System\NMpTnve.exe
  C:\Windows\System\NMpTnve.exe
  2⤵
  PID:8408
- C:\Windows\System\nVvPhbu.exe
  C:\Windows\System\nVvPhbu.exe
  2⤵
  PID:7596
- C:\Windows\System\fWPaOpU.exe
  C:\Windows\System\fWPaOpU.exe
  2⤵
  PID:7740
- C:\Windows\System\qHnRttM.exe
  C:\Windows\System\qHnRttM.exe
  2⤵
  PID:9136
- C:\Windows\System\McKYUEJ.exe
  C:\Windows\System\McKYUEJ.exe
  2⤵
  PID:8724
- C:\Windows\System\IHTdAhp.exe
  C:\Windows\System\IHTdAhp.exe
  2⤵
  PID:9008
- C:\Windows\System\iVNfelq.exe
  C:\Windows\System\iVNfelq.exe
  2⤵
  PID:8600
- C:\Windows\System\PnUpdGO.exe
  C:\Windows\System\PnUpdGO.exe
  2⤵
  PID:9220
- C:\Windows\System\FKBlExP.exe
  C:\Windows\System\FKBlExP.exe
  2⤵
  PID:9248
- C:\Windows\System\dTNnhYZ.exe
  C:\Windows\System\dTNnhYZ.exe
  2⤵
  PID:9280
- C:\Windows\System\arhVujE.exe
  C:\Windows\System\arhVujE.exe
  2⤵
  PID:9308
- C:\Windows\System\qzLCcjF.exe
  C:\Windows\System\qzLCcjF.exe
  2⤵
  PID:9336
- C:\Windows\System\gJMCZsO.exe
  C:\Windows\System\gJMCZsO.exe
  2⤵
  PID:9360
- C:\Windows\System\IhjVibN.exe
  C:\Windows\System\IhjVibN.exe
  2⤵
  PID:9384
- C:\Windows\System\GhApzln.exe
  C:\Windows\System\GhApzln.exe
  2⤵
  PID:9412
- C:\Windows\System\JdICIUK.exe
  C:\Windows\System\JdICIUK.exe
  2⤵
  PID:9432
- C:\Windows\System\pUkCTbx.exe
  C:\Windows\System\pUkCTbx.exe
  2⤵
  PID:9460
- C:\Windows\System\gYUsgZg.exe
  C:\Windows\System\gYUsgZg.exe
  2⤵
  PID:9488
- C:\Windows\System\HDYcmNl.exe
  C:\Windows\System\HDYcmNl.exe
  2⤵
  PID:9508
- C:\Windows\System\DDWmWxo.exe
  C:\Windows\System\DDWmWxo.exe
  2⤵
  PID:9532
- C:\Windows\System\EdIhjfA.exe
  C:\Windows\System\EdIhjfA.exe
  2⤵
  PID:9556
- C:\Windows\System\HxGDohk.exe
  C:\Windows\System\HxGDohk.exe
  2⤵
  PID:9596
- C:\Windows\System\FuSrjZK.exe
  C:\Windows\System\FuSrjZK.exe
  2⤵
  PID:9624
- C:\Windows\System\OCDjGjx.exe
  C:\Windows\System\OCDjGjx.exe
  2⤵
  PID:9652
- C:\Windows\System\aglqLXs.exe
  C:\Windows\System\aglqLXs.exe
  2⤵
  PID:9688
- C:\Windows\System\MtEOFut.exe
  C:\Windows\System\MtEOFut.exe
  2⤵
  PID:9712
- C:\Windows\System\RhTsqqv.exe
  C:\Windows\System\RhTsqqv.exe
  2⤵
  PID:9744
- C:\Windows\System\WVFuKmA.exe
  C:\Windows\System\WVFuKmA.exe
  2⤵
  PID:9768
- C:\Windows\System\keDFGCK.exe
  C:\Windows\System\keDFGCK.exe
  2⤵
  PID:9800
- C:\Windows\System\jjCiLyq.exe
  C:\Windows\System\jjCiLyq.exe
  2⤵
  PID:9828
- C:\Windows\System\iGEWgBk.exe
  C:\Windows\System\iGEWgBk.exe
  2⤵
  PID:9860
- C:\Windows\System\CcAobcL.exe
  C:\Windows\System\CcAobcL.exe
  2⤵
  PID:9880
- C:\Windows\System\vhagvrX.exe
  C:\Windows\System\vhagvrX.exe
  2⤵
  PID:9908
- C:\Windows\System\ijTibhI.exe
  C:\Windows\System\ijTibhI.exe
  2⤵
  PID:9940
- C:\Windows\System\rbtPIxR.exe
  C:\Windows\System\rbtPIxR.exe
  2⤵
  PID:9972
- C:\Windows\System\RvaTkKk.exe
  C:\Windows\System\RvaTkKk.exe
  2⤵
  PID:9996
- C:\Windows\System\oaDyZYx.exe
  C:\Windows\System\oaDyZYx.exe
  2⤵
  PID:10016
- C:\Windows\System\VYuSRez.exe
  C:\Windows\System\VYuSRez.exe
  2⤵
  PID:10048
- C:\Windows\System\IyTeMtE.exe
  C:\Windows\System\IyTeMtE.exe
  2⤵
  PID:10076
- C:\Windows\System\JMAQtyW.exe
  C:\Windows\System\JMAQtyW.exe
  2⤵
  PID:10104
- C:\Windows\System\AIthIOM.exe
  C:\Windows\System\AIthIOM.exe
  2⤵
  PID:10136
- C:\Windows\System\elLtbHE.exe
  C:\Windows\System\elLtbHE.exe
  2⤵
  PID:10168
- C:\Windows\System\IkfpGuQ.exe
  C:\Windows\System\IkfpGuQ.exe
  2⤵
  PID:10188
- C:\Windows\System\yMDRHXO.exe
  C:\Windows\System\yMDRHXO.exe
  2⤵
  PID:10224
- C:\Windows\System\dRpsMFs.exe
  C:\Windows\System\dRpsMFs.exe
  2⤵
  PID:9056
- C:\Windows\System\VFgCamB.exe
  C:\Windows\System\VFgCamB.exe
  2⤵
  PID:8300
- C:\Windows\System\gEFTOZu.exe
  C:\Windows\System\gEFTOZu.exe
  2⤵
  PID:7812
- C:\Windows\System\sgxTSvZ.exe
  C:\Windows\System\sgxTSvZ.exe
  2⤵
  PID:9196
- C:\Windows\System\lquVIdD.exe
  C:\Windows\System\lquVIdD.exe
  2⤵
  PID:8768
- C:\Windows\System\QzSKWxY.exe
  C:\Windows\System\QzSKWxY.exe
  2⤵
  PID:9296
- C:\Windows\System\QorlVfG.exe
  C:\Windows\System\QorlVfG.exe
  2⤵
  PID:9396
- C:\Windows\System\WgLNGgT.exe
  C:\Windows\System\WgLNGgT.exe
  2⤵
  PID:9420
- C:\Windows\System\sFVYtFB.exe
  C:\Windows\System\sFVYtFB.exe
  2⤵
  PID:9320
- C:\Windows\System\BBVOYei.exe
  C:\Windows\System\BBVOYei.exe
  2⤵
  PID:9348
- C:\Windows\System\TjZsQTl.exe
  C:\Windows\System\TjZsQTl.exe
  2⤵
  PID:9440
- C:\Windows\System\oHoEgEt.exe
  C:\Windows\System\oHoEgEt.exe
  2⤵
  PID:9708
- C:\Windows\System\aJlFzvK.exe
  C:\Windows\System\aJlFzvK.exe
  2⤵
  PID:9484
- C:\Windows\System\hdKHFwc.exe
  C:\Windows\System\hdKHFwc.exe
  2⤵
  PID:9776
- C:\Windows\System\jiYKMau.exe
  C:\Windows\System\jiYKMau.exe
  2⤵
  PID:9552
- C:\Windows\System\XWREsIK.exe
  C:\Windows\System\XWREsIK.exe
  2⤵
  PID:9960
- C:\Windows\System\yDxWMuW.exe
  C:\Windows\System\yDxWMuW.exe
  2⤵
  PID:9988
- C:\Windows\System\mYnNkjH.exe
  C:\Windows\System\mYnNkjH.exe
  2⤵
  PID:9580
- C:\Windows\System\AvOhWgA.exe
  C:\Windows\System\AvOhWgA.exe
  2⤵
  PID:9408
- C:\Windows\System\dYyhiRn.exe
  C:\Windows\System\dYyhiRn.exe
  2⤵
  PID:9848
- C:\Windows\System\oSDnsfa.exe
  C:\Windows\System\oSDnsfa.exe
  2⤵
  PID:9872
- C:\Windows\System\ArAbCgs.exe
  C:\Windows\System\ArAbCgs.exe
  2⤵
  PID:9936
- C:\Windows\System\CdhWDgD.exe
  C:\Windows\System\CdhWDgD.exe
  2⤵
  PID:9240
- C:\Windows\System\ansCNJM.exe
  C:\Windows\System\ansCNJM.exe
  2⤵
  PID:9268
- C:\Windows\System\GqzrMjs.exe
  C:\Windows\System\GqzrMjs.exe
  2⤵
  PID:7352
- C:\Windows\System\iDyFCES.exe
  C:\Windows\System\iDyFCES.exe
  2⤵
  PID:9796
- C:\Windows\System\wzEhsJx.exe
  C:\Windows\System\wzEhsJx.exe
  2⤵
  PID:10264
- C:\Windows\System\CMsOhyq.exe
  C:\Windows\System\CMsOhyq.exe
  2⤵
  PID:10284
- C:\Windows\System\pyYBkVJ.exe
  C:\Windows\System\pyYBkVJ.exe
  2⤵
  PID:10316
- C:\Windows\System\gDSKmNY.exe
  C:\Windows\System\gDSKmNY.exe
  2⤵
  PID:10344
- C:\Windows\System\XbuYIFv.exe
  C:\Windows\System\XbuYIFv.exe
  2⤵
  PID:10372
- C:\Windows\System\boWeDJX.exe
  C:\Windows\System\boWeDJX.exe
  2⤵
  PID:10400
- C:\Windows\System\jFsugCt.exe
  C:\Windows\System\jFsugCt.exe
  2⤵
  PID:10428
- C:\Windows\System\QIELkvw.exe
  C:\Windows\System\QIELkvw.exe
  2⤵
  PID:10452
- C:\Windows\System\HoSEDIF.exe
  C:\Windows\System\HoSEDIF.exe
  2⤵
  PID:10484
- C:\Windows\System\JFqeSNp.exe
  C:\Windows\System\JFqeSNp.exe
  2⤵
  PID:10508
- C:\Windows\System\LCzTEBe.exe
  C:\Windows\System\LCzTEBe.exe
  2⤵
  PID:10528
- C:\Windows\System\FOjYaks.exe
  C:\Windows\System\FOjYaks.exe
  2⤵
  PID:10552
- C:\Windows\System\DUtGBRT.exe
  C:\Windows\System\DUtGBRT.exe
  2⤵
  PID:10576
- C:\Windows\System\hrGGsnk.exe
  C:\Windows\System\hrGGsnk.exe
  2⤵
  PID:10604
- C:\Windows\System\PQnhgNX.exe
  C:\Windows\System\PQnhgNX.exe
  2⤵
  PID:10636
- C:\Windows\System\GcUucux.exe
  C:\Windows\System\GcUucux.exe
  2⤵
  PID:10664
- C:\Windows\System\patPsOd.exe
  C:\Windows\System\patPsOd.exe
  2⤵
  PID:10688
- C:\Windows\System\UpTeQwt.exe
  C:\Windows\System\UpTeQwt.exe
  2⤵
  PID:10712
- C:\Windows\System\jEICxAu.exe
  C:\Windows\System\jEICxAu.exe
  2⤵
  PID:10748
- C:\Windows\System\AuANjuG.exe
  C:\Windows\System\AuANjuG.exe
  2⤵
  PID:10772
- C:\Windows\System\cgYUGxF.exe
  C:\Windows\System\cgYUGxF.exe
  2⤵
  PID:10804
- C:\Windows\System\rECsTlp.exe
  C:\Windows\System\rECsTlp.exe
  2⤵
  PID:10832
- C:\Windows\System\nVAOWuf.exe
  C:\Windows\System\nVAOWuf.exe
  2⤵
  PID:10848
- C:\Windows\System\pGSsUMG.exe
  C:\Windows\System\pGSsUMG.exe
  2⤵
  PID:10888
- C:\Windows\System\nnOcUti.exe
  C:\Windows\System\nnOcUti.exe
  2⤵
  PID:10912
- C:\Windows\System\kgdpncF.exe
  C:\Windows\System\kgdpncF.exe
  2⤵
  PID:10928
- C:\Windows\System\BFKPpTn.exe
  C:\Windows\System\BFKPpTn.exe
  2⤵
  PID:10956
- C:\Windows\System\NGSIsEo.exe
  C:\Windows\System\NGSIsEo.exe
  2⤵
  PID:10988
- C:\Windows\System\xXWCufH.exe
  C:\Windows\System\xXWCufH.exe
  2⤵
  PID:11020
- C:\Windows\System\ScnxCEd.exe
  C:\Windows\System\ScnxCEd.exe
  2⤵
  PID:11044
- C:\Windows\System\rbClWvM.exe
  C:\Windows\System\rbClWvM.exe
  2⤵
  PID:11064
- C:\Windows\System\gccPhbU.exe
  C:\Windows\System\gccPhbU.exe
  2⤵
  PID:11092
- C:\Windows\System\UFzGmAZ.exe
  C:\Windows\System\UFzGmAZ.exe
  2⤵
  PID:11116
- C:\Windows\System\nixPcoI.exe
  C:\Windows\System\nixPcoI.exe
  2⤵
  PID:11152
- C:\Windows\System\VAseDrr.exe
  C:\Windows\System\VAseDrr.exe
  2⤵
  PID:11188
- C:\Windows\System\pQHPBpL.exe
  C:\Windows\System\pQHPBpL.exe
  2⤵
  PID:11216
- C:\Windows\System\uIwOGtw.exe
  C:\Windows\System\uIwOGtw.exe
  2⤵
  PID:11236
- C:\Windows\System\iEcXeZz.exe
  C:\Windows\System\iEcXeZz.exe
  2⤵
  PID:9892
- C:\Windows\System\GVdeSxN.exe
  C:\Windows\System\GVdeSxN.exe
  2⤵
  PID:9672
- C:\Windows\System\wKKugdb.exe
  C:\Windows\System\wKKugdb.exe
  2⤵
  PID:10232
- C:\Windows\System\xltqDrc.exe
  C:\Windows\System\xltqDrc.exe
  2⤵
  PID:10068
- C:\Windows\System\drrzNgt.exe
  C:\Windows\System\drrzNgt.exe
  2⤵
  PID:8812
- C:\Windows\System\ayGclPz.exe
  C:\Windows\System\ayGclPz.exe
  2⤵
  PID:10088
- C:\Windows\System\rlSgDPe.exe
  C:\Windows\System\rlSgDPe.exe
  2⤵
  PID:10300
- C:\Windows\System\zCpuPqj.exe
  C:\Windows\System\zCpuPqj.exe
  2⤵
  PID:10116
- C:\Windows\System\tAjSPfQ.exe
  C:\Windows\System\tAjSPfQ.exe
  2⤵
  PID:9608
- C:\Windows\System\DOGXsvn.exe
  C:\Windows\System\DOGXsvn.exe
  2⤵
  PID:8264
- C:\Windows\System\Ggqjrkr.exe
  C:\Windows\System\Ggqjrkr.exe
  2⤵
  PID:10540
- C:\Windows\System\JwheAOm.exe
  C:\Windows\System\JwheAOm.exe
  2⤵
  PID:10328
- C:\Windows\System\BDoEyvD.exe
  C:\Windows\System\BDoEyvD.exe
  2⤵
  PID:9812
- C:\Windows\System\dEMNXNw.exe
  C:\Windows\System\dEMNXNw.exe
  2⤵
  PID:10424
- C:\Windows\System\thtypQJ.exe
  C:\Windows\System\thtypQJ.exe
  2⤵
  PID:10764
- C:\Windows\System\bNfWGrk.exe
  C:\Windows\System\bNfWGrk.exe
  2⤵
  PID:10820
- C:\Windows\System\wQUBFOp.exe
  C:\Windows\System\wQUBFOp.exe
  2⤵
  PID:10304
- C:\Windows\System\LmPsjYN.exe
  C:\Windows\System\LmPsjYN.exe
  2⤵
  PID:10924
- C:\Windows\System\fdGVFpK.exe
  C:\Windows\System\fdGVFpK.exe
  2⤵
  PID:10984
- C:\Windows\System\uDHKnML.exe
  C:\Windows\System\uDHKnML.exe
  2⤵
  PID:10708
- C:\Windows\System\OMqZQtt.exe
  C:\Windows\System\OMqZQtt.exe
  2⤵
  PID:10860
- C:\Windows\System\WJNwmKV.exe
  C:\Windows\System\WJNwmKV.exe
  2⤵
  PID:11260
- C:\Windows\System\lHTXRWS.exe
  C:\Windows\System\lHTXRWS.exe
  2⤵
  PID:10656
- C:\Windows\System\sXPfpGM.exe
  C:\Windows\System\sXPfpGM.exe
  2⤵
  PID:10980
- C:\Windows\System\ZIdQmsX.exe
  C:\Windows\System\ZIdQmsX.exe
  2⤵
  PID:11072
- C:\Windows\System\xakpzfz.exe
  C:\Windows\System\xakpzfz.exe
  2⤵
  PID:11140
- C:\Windows\System\ezUnMap.exe
  C:\Windows\System\ezUnMap.exe
  2⤵
  PID:11268
- C:\Windows\System\WPQXhSA.exe
  C:\Windows\System\WPQXhSA.exe
  2⤵
  PID:11296
- C:\Windows\System\HjayXXq.exe
  C:\Windows\System\HjayXXq.exe
  2⤵
  PID:11320
- C:\Windows\System\PngbILx.exe
  C:\Windows\System\PngbILx.exe
  2⤵
  PID:11352
- C:\Windows\System\bJuMeur.exe
  C:\Windows\System\bJuMeur.exe
  2⤵
  PID:11380
- C:\Windows\System\SHDyGCj.exe
  C:\Windows\System\SHDyGCj.exe
  2⤵
  PID:11404
- C:\Windows\System\fqhTXKf.exe
  C:\Windows\System\fqhTXKf.exe
  2⤵
  PID:11440
- C:\Windows\System\iWBqiEA.exe
  C:\Windows\System\iWBqiEA.exe
  2⤵
  PID:11464
- C:\Windows\System\FvYFusJ.exe
  C:\Windows\System\FvYFusJ.exe
  2⤵
  PID:11496
- C:\Windows\System\iJlmCfq.exe
  C:\Windows\System\iJlmCfq.exe
  2⤵
  PID:11528
- C:\Windows\System\ajXNDaQ.exe
  C:\Windows\System\ajXNDaQ.exe
  2⤵
  PID:11556
- C:\Windows\System\PBNcFOo.exe
  C:\Windows\System\PBNcFOo.exe
  2⤵
  PID:11572
- C:\Windows\System\fFDEaIE.exe
  C:\Windows\System\fFDEaIE.exe
  2⤵
  PID:11596
- C:\Windows\System\RQJmEzH.exe
  C:\Windows\System\RQJmEzH.exe
  2⤵
  PID:11624
- C:\Windows\System\RGewXou.exe
  C:\Windows\System\RGewXou.exe
  2⤵
  PID:11656
- C:\Windows\System\vUrktfx.exe
  C:\Windows\System\vUrktfx.exe
  2⤵
  PID:11684
- C:\Windows\System\cjNXJlm.exe
  C:\Windows\System\cjNXJlm.exe
  2⤵
  PID:11708
- C:\Windows\System\totzcXX.exe
  C:\Windows\System\totzcXX.exe
  2⤵
  PID:11728
- C:\Windows\System\nRXARNR.exe
  C:\Windows\System\nRXARNR.exe
  2⤵
  PID:11760
- C:\Windows\System\LrCnnzt.exe
  C:\Windows\System\LrCnnzt.exe
  2⤵
  PID:11784
- C:\Windows\System\gxKllSo.exe
  C:\Windows\System\gxKllSo.exe
  2⤵
  PID:11812
- C:\Windows\System\VPbwmjM.exe
  C:\Windows\System\VPbwmjM.exe
  2⤵
  PID:11848
- C:\Windows\System\cAyTwSj.exe
  C:\Windows\System\cAyTwSj.exe
  2⤵
  PID:11872
- C:\Windows\System\WCqSkPP.exe
  C:\Windows\System\WCqSkPP.exe
  2⤵
  PID:11896
- C:\Windows\System\hBbXRNT.exe
  C:\Windows\System\hBbXRNT.exe
  2⤵
  PID:11928
- C:\Windows\System\MrdJHtx.exe
  C:\Windows\System\MrdJHtx.exe
  2⤵
  PID:11952
- C:\Windows\System\lXQxGcL.exe
  C:\Windows\System\lXQxGcL.exe
  2⤵
  PID:11972
- C:\Windows\System\yeOfXgY.exe
  C:\Windows\System\yeOfXgY.exe
  2⤵
  PID:12000
- C:\Windows\System\ZPFZjAU.exe
  C:\Windows\System\ZPFZjAU.exe
  2⤵
  PID:12028
- C:\Windows\System\uoqFVoT.exe
  C:\Windows\System\uoqFVoT.exe
  2⤵
  PID:12052
- C:\Windows\System\OQEPNfY.exe
  C:\Windows\System\OQEPNfY.exe
  2⤵
  PID:12068
- C:\Windows\System\lyWverv.exe
  C:\Windows\System\lyWverv.exe
  2⤵
  PID:12096
- C:\Windows\System\doSJZRX.exe
  C:\Windows\System\doSJZRX.exe
  2⤵
  PID:12124
- C:\Windows\System\BywBiDm.exe
  C:\Windows\System\BywBiDm.exe
  2⤵
  PID:12156
- C:\Windows\System\SebIGbt.exe
  C:\Windows\System\SebIGbt.exe
  2⤵
  PID:12176
- C:\Windows\System\ctLsFab.exe
  C:\Windows\System\ctLsFab.exe
  2⤵
  PID:12212
- C:\Windows\System\diCReGN.exe
  C:\Windows\System\diCReGN.exe
  2⤵
  PID:12232
- C:\Windows\System\PAsHzTt.exe
  C:\Windows\System\PAsHzTt.exe
  2⤵
  PID:12256
- C:\Windows\System\tnMauVW.exe
  C:\Windows\System\tnMauVW.exe
  2⤵
  PID:12284
- C:\Windows\System\DYDjLKW.exe
  C:\Windows\System\DYDjLKW.exe
  2⤵
  PID:10940
- C:\Windows\System\xfhcuCu.exe
  C:\Windows\System\xfhcuCu.exe
  2⤵
  PID:11028
- C:\Windows\System\gNrMXSl.exe
  C:\Windows\System\gNrMXSl.exe
  2⤵
  PID:10036
- C:\Windows\System\WgWBQpM.exe
  C:\Windows\System\WgWBQpM.exe
  2⤵
  PID:11112
- C:\Windows\System\iPOIOLF.exe
  C:\Windows\System\iPOIOLF.exe
  2⤵
  PID:7300
- C:\Windows\System\LijRnIU.exe
  C:\Windows\System\LijRnIU.exe
  2⤵
  PID:11232
- C:\Windows\System\FxfovrV.exe
  C:\Windows\System\FxfovrV.exe
  2⤵
  PID:11284
- C:\Windows\System\GnKEUdW.exe
  C:\Windows\System\GnKEUdW.exe
  2⤵
  PID:10816
- C:\Windows\System\vSRWmet.exe
  C:\Windows\System\vSRWmet.exe
  2⤵
  PID:10952
- C:\Windows\System\FrvoWsy.exe
  C:\Windows\System\FrvoWsy.exe
  2⤵
  PID:11416
- C:\Windows\System\sruWDZy.exe
  C:\Windows\System\sruWDZy.exe
  2⤵
  PID:11456
- C:\Windows\System\SgCgTGx.exe
  C:\Windows\System\SgCgTGx.exe
  2⤵
  PID:9276
- C:\Windows\System\aMCTsqY.exe
  C:\Windows\System\aMCTsqY.exe
  2⤵
  PID:10596
- C:\Windows\System\anCxLQj.exe
  C:\Windows\System\anCxLQj.exe
  2⤵
  PID:11580
- C:\Windows\System\apXHpKo.exe
  C:\Windows\System\apXHpKo.exe
  2⤵
  PID:11636
- C:\Windows\System\nVSyOin.exe
  C:\Windows\System\nVSyOin.exe
  2⤵
  PID:11740
- C:\Windows\System\JcSGxqX.exe
  C:\Windows\System\JcSGxqX.exe
  2⤵
  PID:11372
- C:\Windows\System\bCQPGAq.exe
  C:\Windows\System\bCQPGAq.exe
  2⤵
  PID:11396
- C:\Windows\System\XRNXjbZ.exe
  C:\Windows\System\XRNXjbZ.exe
  2⤵
  PID:11940
- C:\Windows\System\FCXlIxn.exe
  C:\Windows\System\FCXlIxn.exe
  2⤵
  PID:12120
- C:\Windows\System\CHbfUmx.exe
  C:\Windows\System\CHbfUmx.exe
  2⤵
  PID:11768
- C:\Windows\System\DxQywvD.exe
  C:\Windows\System\DxQywvD.exe
  2⤵
  PID:12188
- C:\Windows\System\gmJRkuz.exe
  C:\Windows\System\gmJRkuz.exe
  2⤵
  PID:12248
- C:\Windows\System\atKfbpe.exe
  C:\Windows\System\atKfbpe.exe
  2⤵
  PID:9660
- C:\Windows\System\YAAyMmS.exe
  C:\Windows\System\YAAyMmS.exe
  2⤵
  PID:10644
- C:\Windows\System\VEKlDZF.exe
  C:\Windows\System\VEKlDZF.exe
  2⤵
  PID:10700
- C:\Windows\System\FyrYNrj.exe
  C:\Windows\System\FyrYNrj.exe
  2⤵
  PID:12296
- C:\Windows\System\gsRFEUN.exe
  C:\Windows\System\gsRFEUN.exe
  2⤵
  PID:12316
- C:\Windows\System\sQTyWve.exe
  C:\Windows\System\sQTyWve.exe
  2⤵
  PID:12344
- C:\Windows\System\bOraQEZ.exe
  C:\Windows\System\bOraQEZ.exe
  2⤵
  PID:12376
- C:\Windows\System\FfIgdkJ.exe
  C:\Windows\System\FfIgdkJ.exe
  2⤵
  PID:12400
- C:\Windows\System\lfLlQJt.exe
  C:\Windows\System\lfLlQJt.exe
  2⤵
  PID:12436
- C:\Windows\System\COUVCuH.exe
  C:\Windows\System\COUVCuH.exe
  2⤵
  PID:12468
- C:\Windows\System\qHsNRAP.exe
  C:\Windows\System\qHsNRAP.exe
  2⤵
  PID:12500
- C:\Windows\System\lsJjgND.exe
  C:\Windows\System\lsJjgND.exe
  2⤵
  PID:12524
- C:\Windows\System\wPRLrvD.exe
  C:\Windows\System\wPRLrvD.exe
  2⤵
  PID:12552
- C:\Windows\System\ibanChZ.exe
  C:\Windows\System\ibanChZ.exe
  2⤵
  PID:12572
- C:\Windows\System\RvZWNAb.exe
  C:\Windows\System\RvZWNAb.exe
  2⤵
  PID:12592
- C:\Windows\System\SJIGkbY.exe
  C:\Windows\System\SJIGkbY.exe
  2⤵
  PID:12608
- C:\Windows\System\QqBimeB.exe
  C:\Windows\System\QqBimeB.exe
  2⤵
  PID:12644
- C:\Windows\System\DTlzcyG.exe
  C:\Windows\System\DTlzcyG.exe
  2⤵
  PID:12668
- C:\Windows\System\cfutKaG.exe
  C:\Windows\System\cfutKaG.exe
  2⤵
  PID:12692
- C:\Windows\System\SUrJSoS.exe
  C:\Windows\System\SUrJSoS.exe
  2⤵
  PID:12724
- C:\Windows\System\ScORBOI.exe
  C:\Windows\System\ScORBOI.exe
  2⤵
  PID:12752
- C:\Windows\System\tPgFTli.exe
  C:\Windows\System\tPgFTli.exe
  2⤵
  PID:12780
- C:\Windows\System\GWpLFTF.exe
  C:\Windows\System\GWpLFTF.exe
  2⤵
  PID:12804
- C:\Windows\System\tCLpbMd.exe
  C:\Windows\System\tCLpbMd.exe
  2⤵
  PID:12832
- C:\Windows\System\rrmTZSz.exe
  C:\Windows\System\rrmTZSz.exe
  2⤵
  PID:12848
- C:\Windows\System\CJXMZXM.exe
  C:\Windows\System\CJXMZXM.exe
  2⤵
  PID:12884
- C:\Windows\System\IVLMffO.exe
  C:\Windows\System\IVLMffO.exe
  2⤵
  PID:12904
- C:\Windows\System\CAOVQYP.exe
  C:\Windows\System\CAOVQYP.exe
  2⤵
  PID:12940
- C:\Windows\System\MgIwHgB.exe
  C:\Windows\System\MgIwHgB.exe
  2⤵
  PID:12960
- C:\Windows\System\iyZElgb.exe
  C:\Windows\System\iyZElgb.exe
  2⤵
  PID:12992
- C:\Windows\System\RiPpMQn.exe
  C:\Windows\System\RiPpMQn.exe
  2⤵
  PID:13020
- C:\Windows\System\OlZyzLc.exe
  C:\Windows\System\OlZyzLc.exe
  2⤵
  PID:13044
- C:\Windows\System\FhAPIRZ.exe
  C:\Windows\System\FhAPIRZ.exe
  2⤵
  PID:13072
- C:\Windows\System\FPEIhqJ.exe
  C:\Windows\System\FPEIhqJ.exe
  2⤵
  PID:13092
- C:\Windows\System\tlcIfqM.exe
  C:\Windows\System\tlcIfqM.exe
  2⤵
  PID:13112
- C:\Windows\System\SeUTpqK.exe
  C:\Windows\System\SeUTpqK.exe
  2⤵
  PID:13140
- C:\Windows\System\FADpaib.exe
  C:\Windows\System\FADpaib.exe
  2⤵
  PID:13176
- C:\Windows\System\zWOfBzF.exe
  C:\Windows\System\zWOfBzF.exe
  2⤵
  PID:13204
- C:\Windows\System\ZZFayrH.exe
  C:\Windows\System\ZZFayrH.exe
  2⤵
  PID:13228
- C:\Windows\System\PlBmUCv.exe
  C:\Windows\System\PlBmUCv.exe
  2⤵
  PID:13248
- C:\Windows\System\neEHnbz.exe
  C:\Windows\System\neEHnbz.exe
  2⤵
  PID:13272
- C:\Windows\System\ScDYrGi.exe
  C:\Windows\System\ScDYrGi.exe
  2⤵
  PID:13292
- C:\Windows\System\MBbylBA.exe
  C:\Windows\System\MBbylBA.exe
  2⤵
  PID:12104
- C:\Windows\System\HTfxepe.exe
  C:\Windows\System\HTfxepe.exe
  2⤵
  PID:11720
- C:\Windows\System\ErnLpmi.exe
  C:\Windows\System\ErnLpmi.exe
  2⤵
  PID:12208
- C:\Windows\System\AfFxQhk.exe
  C:\Windows\System\AfFxQhk.exe
  2⤵
  PID:12244
- C:\Windows\System\EAexxix.exe
  C:\Windows\System\EAexxix.exe
  2⤵
  PID:12280
- C:\Windows\System\JUQfzit.exe
  C:\Windows\System\JUQfzit.exe
  2⤵
  PID:11920
- C:\Windows\System\nDWbVsO.exe
  C:\Windows\System\nDWbVsO.exe
  2⤵
  PID:11168
- C:\Windows\System\EverqUG.exe
  C:\Windows\System\EverqUG.exe
  2⤵
  PID:10520
- C:\Windows\System\WmcSBuq.exe
  C:\Windows\System\WmcSBuq.exe
  2⤵
  PID:12312
- C:\Windows\System\IYIiMUW.exe
  C:\Windows\System\IYIiMUW.exe
  2⤵
  PID:12388
- C:\Windows\System\bYZiCZm.exe
  C:\Windows\System\bYZiCZm.exe
  2⤵
  PID:10672
- C:\Windows\System\yUjJelG.exe
  C:\Windows\System\yUjJelG.exe
  2⤵
  PID:12516
- C:\Windows\System\bDgqptf.exe
  C:\Windows\System\bDgqptf.exe
  2⤵
  PID:11460
- C:\Windows\System\DASdEHu.exe
  C:\Windows\System\DASdEHu.exe
  2⤵
  PID:11548
- C:\Windows\System\WLwJUdm.exe
  C:\Windows\System\WLwJUdm.exe
  2⤵
  PID:12684
- C:\Windows\System\XJbiVFJ.exe
  C:\Windows\System\XJbiVFJ.exe
  2⤵
  PID:12760
- C:\Windows\System\JUyqZiL.exe
  C:\Windows\System\JUyqZiL.exe
  2⤵
  PID:11968
- C:\Windows\System\yOpPdvv.exe
  C:\Windows\System\yOpPdvv.exe
  2⤵
  PID:12880
- C:\Windows\System\oZTjbBQ.exe
  C:\Windows\System\oZTjbBQ.exe
  2⤵
  PID:11084
- C:\Windows\System\xGcybpW.exe
  C:\Windows\System\xGcybpW.exe
  2⤵
  PID:12420
- C:\Windows\System\ytmnVxk.exe
  C:\Windows\System\ytmnVxk.exe
  2⤵
  PID:13016
- C:\Windows\System\nFWVfrv.exe
  C:\Windows\System\nFWVfrv.exe
  2⤵
  PID:13068
- C:\Windows\System\GNKbRYE.exe
  C:\Windows\System\GNKbRYE.exe
  2⤵
  PID:13108
- C:\Windows\System\kQhXoKg.exe
  C:\Windows\System\kQhXoKg.exe
  2⤵
  PID:12604
- C:\Windows\System\KUYFPfG.exe
  C:\Windows\System\KUYFPfG.exe
  2⤵
  PID:12708
- C:\Windows\System\JSDbHcl.exe
  C:\Windows\System\JSDbHcl.exe
  2⤵
  PID:12772
- C:\Windows\System\WjVEodJ.exe
  C:\Windows\System\WjVEodJ.exe
  2⤵
  PID:13336
- C:\Windows\System\sdBdbZR.exe
  C:\Windows\System\sdBdbZR.exe
  2⤵
  PID:13368
- C:\Windows\System\gcJiJZj.exe
  C:\Windows\System\gcJiJZj.exe
  2⤵
  PID:13392
- C:\Windows\System\OoUzZdA.exe
  C:\Windows\System\OoUzZdA.exe
  2⤵
  PID:13420
- C:\Windows\System\SFxclOs.exe
  C:\Windows\System\SFxclOs.exe
  2⤵
  PID:13448
- C:\Windows\System\SjcMZdh.exe
  C:\Windows\System\SjcMZdh.exe
  2⤵
  PID:13472
- C:\Windows\System\lGYqknr.exe
  C:\Windows\System\lGYqknr.exe
  2⤵
  PID:13500
- C:\Windows\System\shoEsAg.exe
  C:\Windows\System\shoEsAg.exe
  2⤵
  PID:13520
- C:\Windows\System\uFRJJJB.exe
  C:\Windows\System\uFRJJJB.exe
  2⤵
  PID:13544
- C:\Windows\System\reXbMzr.exe
  C:\Windows\System\reXbMzr.exe
  2⤵
  PID:13572
- C:\Windows\System\sWJcvLi.exe
  C:\Windows\System\sWJcvLi.exe
  2⤵
  PID:13600
- C:\Windows\System\yincQqP.exe
  C:\Windows\System\yincQqP.exe
  2⤵
  PID:13624
- C:\Windows\System\KeQBijZ.exe
  C:\Windows\System\KeQBijZ.exe
  2⤵
  PID:13652
- C:\Windows\System\QvoMlhE.exe
  C:\Windows\System\QvoMlhE.exe
  2⤵
  PID:13668
- C:\Windows\System\fmaIXNf.exe
  C:\Windows\System\fmaIXNf.exe
  2⤵
  PID:13696
- C:\Windows\System\UiGnTVI.exe
  C:\Windows\System\UiGnTVI.exe
  2⤵
  PID:13732
- C:\Windows\System\KlSREDz.exe
  C:\Windows\System\KlSREDz.exe
  2⤵
  PID:13748
- C:\Windows\System\vnZoTFQ.exe
  C:\Windows\System\vnZoTFQ.exe
  2⤵
  PID:13780
- C:\Windows\System\HVikzze.exe
  C:\Windows\System\HVikzze.exe
  2⤵
  PID:13808
- C:\Windows\System\gKygxmI.exe
  C:\Windows\System\gKygxmI.exe
  2⤵
  PID:13828
- C:\Windows\System\gLmVgMB.exe
  C:\Windows\System\gLmVgMB.exe
  2⤵
  PID:13856
- C:\Windows\System\rSUaBAg.exe
  C:\Windows\System\rSUaBAg.exe
  2⤵
  PID:13872
- C:\Windows\System\WQjhSAu.exe
  C:\Windows\System\WQjhSAu.exe
  2⤵
  PID:13900
- C:\Windows\System\xUpAUgw.exe
  C:\Windows\System\xUpAUgw.exe
  2⤵
  PID:13920
- C:\Windows\System\PmySTRm.exe
  C:\Windows\System\PmySTRm.exe
  2⤵
  PID:13944
- C:\Windows\System\YHIqpeb.exe
  C:\Windows\System\YHIqpeb.exe
  2⤵
  PID:13968
- C:\Windows\System\GjqZsvy.exe
  C:\Windows\System\GjqZsvy.exe
  2⤵
  PID:13992
- C:\Windows\System\wlokvDc.exe
  C:\Windows\System\wlokvDc.exe
  2⤵
  PID:14028
- C:\Windows\System\uWgowij.exe
  C:\Windows\System\uWgowij.exe
  2⤵
  PID:14052
- C:\Windows\System\hesISyf.exe
  C:\Windows\System\hesISyf.exe
  2⤵
  PID:14076
- C:\Windows\System\oxCMFov.exe
  C:\Windows\System\oxCMFov.exe
  2⤵
  PID:14104
- C:\Windows\System\MTUgyqK.exe
  C:\Windows\System\MTUgyqK.exe
  2⤵
  PID:14132
- C:\Windows\System\BoUJyqL.exe
  C:\Windows\System\BoUJyqL.exe
  2⤵
  PID:14148
- C:\Windows\System\TfQUduV.exe
  C:\Windows\System\TfQUduV.exe
  2⤵
  PID:14176
- C:\Windows\System\WjfSYZF.exe
  C:\Windows\System\WjfSYZF.exe
  2⤵
  PID:14200
- C:\Windows\System\BFBiSIL.exe
  C:\Windows\System\BFBiSIL.exe
  2⤵
  PID:14220
- C:\Windows\System\vGINFLt.exe
  C:\Windows\System\vGINFLt.exe
  2⤵
  PID:14252
- C:\Windows\System\dnYcdXy.exe
  C:\Windows\System\dnYcdXy.exe
  2⤵
  PID:14276
- C:\Windows\System\vLsapWD.exe
  C:\Windows\System\vLsapWD.exe
  2⤵
  PID:14296
- C:\Windows\System\vDUFEEa.exe
  C:\Windows\System\vDUFEEa.exe
  2⤵
  PID:14324
- C:\Windows\System\OFCoZwY.exe
  C:\Windows\System\OFCoZwY.exe
  2⤵
  PID:12332
- C:\Windows\System\BUgnuNh.exe
  C:\Windows\System\BUgnuNh.exe
  2⤵
  PID:12356
- C:\Windows\System\xlmIKkS.exe
  C:\Windows\System\xlmIKkS.exe
  2⤵
  PID:12948
- C:\Windows\System\szVEwrn.exe
  C:\Windows\System\szVEwrn.exe
  2⤵
  PID:9192
- C:\Windows\System\lzgPYOD.exe
  C:\Windows\System\lzgPYOD.exe
  2⤵
  PID:12580
- C:\Windows\System\hfQEFjv.exe
  C:\Windows\System\hfQEFjv.exe
  2⤵
  PID:12620
- C:\Windows\System\vChitWU.exe
  C:\Windows\System\vChitWU.exe
  2⤵
  PID:12428
- C:\Windows\System\ITQeQrG.exe
  C:\Windows\System\ITQeQrG.exe
  2⤵
  PID:11508
- C:\Windows\System\iymwzUP.exe
  C:\Windows\System\iymwzUP.exe
  2⤵
  PID:12220
- C:\Windows\System\YUJZIhl.exe
  C:\Windows\System\YUJZIhl.exe
  2⤵
  PID:12860
- C:\Windows\System\CtQXlCw.exe
  C:\Windows\System\CtQXlCw.exe
  2⤵
  PID:10448
- C:\Windows\System\XMlcFnO.exe
  C:\Windows\System\XMlcFnO.exe
  2⤵
  PID:13444
- C:\Windows\System\fwRRbKq.exe
  C:\Windows\System\fwRRbKq.exe
  2⤵
  PID:13028
- C:\Windows\System\Sramczn.exe
  C:\Windows\System\Sramczn.exe
  2⤵
  PID:12636
- C:\Windows\System\uywFYpv.exe
  C:\Windows\System\uywFYpv.exe
  2⤵
  PID:13160
- C:\Windows\System\llvtjjQ.exe
  C:\Windows\System\llvtjjQ.exe
  2⤵
  PID:13684
- C:\Windows\System\bTYtACd.exe
  C:\Windows\System\bTYtACd.exe
  2⤵
  PID:12980
- C:\Windows\System\XFNHDGR.exe
  C:\Windows\System\XFNHDGR.exe
  2⤵
  PID:11564
- C:\Windows\System\CveYojl.exe
  C:\Windows\System\CveYojl.exe
  2⤵
  PID:13816
- C:\Windows\System\dDbtzTZ.exe
  C:\Windows\System\dDbtzTZ.exe
  2⤵
  PID:13844
- C:\Windows\System\wqCIvdS.exe
  C:\Windows\System\wqCIvdS.exe
  2⤵
  PID:10276
- C:\Windows\System\YqzbGWa.exe
  C:\Windows\System\YqzbGWa.exe
  2⤵
  PID:13916
- C:\Windows\System\SgRhHza.exe
  C:\Windows\System\SgRhHza.exe
  2⤵
  PID:14000
- C:\Windows\System\VtAuHKq.exe
  C:\Windows\System\VtAuHKq.exe
  2⤵
  PID:12324
- C:\Windows\System\gUgtfnv.exe
  C:\Windows\System\gUgtfnv.exe
  2⤵
  PID:13512
- C:\Windows\System\eifrSSq.exe
  C:\Windows\System\eifrSSq.exe
  2⤵
  PID:14248
- C:\Windows\System\ZFWuVbg.exe
  C:\Windows\System\ZFWuVbg.exe
  2⤵
  PID:13588
- C:\Windows\System\NQPvhQR.exe
  C:\Windows\System\NQPvhQR.exe
  2⤵
  PID:14368
- C:\Windows\System\OmmEHlV.exe
  C:\Windows\System\OmmEHlV.exe
  2⤵
  PID:14388
- C:\Windows\System\cfuVDku.exe
  C:\Windows\System\cfuVDku.exe
  2⤵
  PID:14416
- C:\Windows\System\qGEwsbB.exe
  C:\Windows\System\qGEwsbB.exe
  2⤵
  PID:14440
- C:\Windows\System\IsEXPrI.exe
  C:\Windows\System\IsEXPrI.exe
  2⤵
  PID:14456
- C:\Windows\System\AeWlayj.exe
  C:\Windows\System\AeWlayj.exe
  2⤵
  PID:14480
- C:\Windows\System\UVscDCu.exe
  C:\Windows\System\UVscDCu.exe
  2⤵
  PID:14508
- C:\Windows\System\IYyZrjh.exe
  C:\Windows\System\IYyZrjh.exe
  2⤵
  PID:14536
- C:\Windows\System\UquzdCn.exe
  C:\Windows\System\UquzdCn.exe
  2⤵
  PID:14556
- C:\Windows\System\qaTSOWc.exe
  C:\Windows\System\qaTSOWc.exe
  2⤵
  PID:14584
- C:\Windows\System\OmNQBoI.exe
  C:\Windows\System\OmNQBoI.exe
  2⤵
  PID:14608
- C:\Windows\System\xtnQWKq.exe
  C:\Windows\System\xtnQWKq.exe
  2⤵
  PID:14632
- C:\Windows\System\rKDfCCd.exe
  C:\Windows\System\rKDfCCd.exe
  2⤵
  PID:14652
- C:\Windows\System\GAYQtQS.exe
  C:\Windows\System\GAYQtQS.exe
  2⤵
  PID:14680
- C:\Windows\System\ivqgTqY.exe
  C:\Windows\System\ivqgTqY.exe
  2⤵
  PID:14712
- C:\Windows\System\iOtgNIm.exe
  C:\Windows\System\iOtgNIm.exe
  2⤵
  PID:14736
- C:\Windows\System\deEsTuo.exe
  C:\Windows\System\deEsTuo.exe
  2⤵
  PID:14772
- C:\Windows\System\pPKXvPE.exe
  C:\Windows\System\pPKXvPE.exe
  2⤵
  PID:14796
- C:\Windows\System\sqUnXAz.exe
  C:\Windows\System\sqUnXAz.exe
  2⤵
  PID:14824
- C:\Windows\System\agKXJLc.exe
  C:\Windows\System\agKXJLc.exe
  2⤵
  PID:14848
- C:\Windows\System\cVqqaUa.exe
  C:\Windows\System\cVqqaUa.exe
  2⤵
  PID:14872
- C:\Windows\System\jDKUCZr.exe
  C:\Windows\System\jDKUCZr.exe
  2⤵
  PID:14888
- C:\Windows\System\NIzBdpt.exe
  C:\Windows\System\NIzBdpt.exe
  2⤵
  PID:14908
- C:\Windows\System\wiubDnl.exe
  C:\Windows\System\wiubDnl.exe
  2⤵
  PID:14948
- C:\Windows\System\pqzbXCU.exe
  C:\Windows\System\pqzbXCU.exe
  2⤵
  PID:14968
- C:\Windows\System\izXlhkb.exe
  C:\Windows\System\izXlhkb.exe
  2⤵
  PID:14992
- C:\Windows\System\WAabSmR.exe
  C:\Windows\System\WAabSmR.exe
  2⤵
  PID:15016
- C:\Windows\System\pljVHJr.exe
  C:\Windows\System\pljVHJr.exe
  2⤵
  PID:15048
- C:\Windows\System\LjzFiNa.exe
  C:\Windows\System\LjzFiNa.exe
  2⤵
  PID:15064
- C:\Windows\System\yrcEbJY.exe
  C:\Windows\System\yrcEbJY.exe
  2⤵
  PID:15092
- C:\Windows\System\DgmJSvq.exe
  C:\Windows\System\DgmJSvq.exe
  2⤵
  PID:15124
- C:\Windows\System\ojKxZXq.exe
  C:\Windows\System\ojKxZXq.exe
  2⤵
  PID:15152
- C:\Windows\System\eWArFQV.exe
  C:\Windows\System\eWArFQV.exe
  2⤵
  PID:15176
- C:\Windows\System\KeLbndY.exe
  C:\Windows\System\KeLbndY.exe
  2⤵
  PID:15196
- C:\Windows\System\MArvKzN.exe
  C:\Windows\System\MArvKzN.exe
  2⤵
  PID:15220
- C:\Windows\System\QkuyNFz.exe
  C:\Windows\System\QkuyNFz.exe
  2⤵
  PID:15244
- C:\Windows\System\rOboEXb.exe
  C:\Windows\System\rOboEXb.exe
  2⤵
  PID:15268
- C:\Windows\System\RAqIjde.exe
  C:\Windows\System\RAqIjde.exe
  2⤵
  PID:15304
- C:\Windows\System\oZTHxEz.exe
  C:\Windows\System\oZTHxEz.exe
  2⤵
  PID:15320
- C:\Windows\System\DEsGeKW.exe
  C:\Windows\System\DEsGeKW.exe
  2⤵
  PID:15348
- C:\Windows\System\hNylJOO.exe
  C:\Windows\System\hNylJOO.exe
  2⤵
  PID:11884
- C:\Windows\System\PzzwiOD.exe
  C:\Windows\System\PzzwiOD.exe
  2⤵
  PID:13648
- C:\Windows\System\TBIQreo.exe
  C:\Windows\System\TBIQreo.exe
  2⤵
  PID:9300
- C:\Windows\System\WBYOKBE.exe
  C:\Windows\System\WBYOKBE.exe
  2⤵
  PID:13776
- C:\Windows\System\ZwysDyl.exe
  C:\Windows\System\ZwysDyl.exe
  2⤵
  PID:12796
- C:\Windows\System\YycBYkr.exe
  C:\Windows\System\YycBYkr.exe
  2⤵
  PID:13416
- C:\Windows\System\tJRCfoa.exe
  C:\Windows\System\tJRCfoa.exe
  2⤵
  PID:13976
- C:\Windows\System\oRpHPms.exe
  C:\Windows\System\oRpHPms.exe
  2⤵
  PID:13436
- C:\Windows\System\yzvwpgj.exe
  C:\Windows\System\yzvwpgj.exe
  2⤵
  PID:14100
- C:\Windows\System\eiHWacE.exe
  C:\Windows\System\eiHWacE.exe
  2⤵
  PID:14144
- C:\Windows\System\WDysqaE.exe
  C:\Windows\System\WDysqaE.exe
  2⤵
  PID:13492
- C:\Windows\System\OLNyzXI.exe
  C:\Windows\System\OLNyzXI.exe
  2⤵
  PID:14064
- C:\Windows\System\YZOvKHh.exe
  C:\Windows\System\YZOvKHh.exe
  2⤵
  PID:13592
- C:\Windows\System\PLuywmG.exe
  C:\Windows\System\PLuywmG.exe
  2⤵
  PID:11012
- C:\Windows\System\fYqRPFu.exe
  C:\Windows\System\fYqRPFu.exe
  2⤵
  PID:12660
- C:\Windows\System\WTLpWhm.exe
  C:\Windows\System\WTLpWhm.exe
  2⤵
  PID:14624
- C:\Windows\System\FygHkBB.exe
  C:\Windows\System\FygHkBB.exe
  2⤵
  PID:14704
- C:\Windows\System\KbtDGJT.exe
  C:\Windows\System\KbtDGJT.exe
  2⤵
  PID:14016
- C:\Windows\System\NvwpcKQ.exe
  C:\Windows\System\NvwpcKQ.exe
  2⤵
  PID:14804
- C:\Windows\System\dlqPYIj.exe
  C:\Windows\System\dlqPYIj.exe
  2⤵
  PID:15368
- C:\Windows\System\WKrQfXo.exe
  C:\Windows\System\WKrQfXo.exe
  2⤵
  PID:15384
- C:\Windows\System\zAkJYQq.exe
  C:\Windows\System\zAkJYQq.exe
  2⤵
  PID:15400
- C:\Windows\System\DbthlYA.exe
  C:\Windows\System\DbthlYA.exe
  2⤵
  PID:15428
- C:\Windows\System\DAgdrdR.exe
  C:\Windows\System\DAgdrdR.exe
  2⤵
  PID:15444
- C:\Windows\System\cRPVWZf.exe
  C:\Windows\System\cRPVWZf.exe
  2⤵
  PID:15468
- C:\Windows\System\EMbKprr.exe
  C:\Windows\System\EMbKprr.exe
  2⤵
  PID:15488
- C:\Windows\System\KxyRvKo.exe
  C:\Windows\System\KxyRvKo.exe
  2⤵
  PID:15508
- C:\Windows\System\uqbYxdA.exe
  C:\Windows\System\uqbYxdA.exe
  2⤵
  PID:15544
- C:\Windows\System\tdFmATI.exe
  C:\Windows\System\tdFmATI.exe
  2⤵
  PID:15560
- C:\Windows\System\ooJRCYV.exe
  C:\Windows\System\ooJRCYV.exe
  2⤵
  PID:15580
- C:\Windows\System\OAdSern.exe
  C:\Windows\System\OAdSern.exe
  2⤵
  PID:16364
- C:\Windows\System\MotxiDb.exe
  C:\Windows\System\MotxiDb.exe
  2⤵
  PID:15316
- C:\Windows\System\RHJPXcR.exe
  C:\Windows\System\RHJPXcR.exe
  2⤵
  PID:13616
- C:\Windows\System\heVEMmc.exe
  C:\Windows\System\heVEMmc.exe
  2⤵
  PID:14600
- C:\Windows\System\UDssgjV.exe
  C:\Windows\System\UDssgjV.exe
  2⤵
  PID:14648
- C:\Windows\System\hRuBdBK.exe
  C:\Windows\System\hRuBdBK.exe
  2⤵
  PID:14140
- C:\Windows\System\ColTAIa.exe
  C:\Windows\System\ColTAIa.exe
  2⤵
  PID:14272
- C:\Windows\System\sRHawmk.exe
  C:\Windows\System\sRHawmk.exe
  2⤵
  PID:13896
- C:\Windows\System\RgzSYqi.exe
  C:\Windows\System\RgzSYqi.exe
  2⤵
  PID:14288
- C:\Windows\System\xyBoxxi.exe
  C:\Windows\System\xyBoxxi.exe
  2⤵
  PID:12228
- C:\Windows\System\FduJOxK.exe
  C:\Windows\System\FduJOxK.exe
  2⤵
  PID:14916
- C:\Windows\System\cugbmtJ.exe
  C:\Windows\System\cugbmtJ.exe
  2⤵
  PID:15060
- C:\Windows\System\XvlcYxS.exe
  C:\Windows\System\XvlcYxS.exe
  2⤵
  PID:15144
- C:\Windows\System\VohrtQw.exe
  C:\Windows\System\VohrtQw.exe
  2⤵
  PID:10628
- C:\Windows\System\YFUEzRL.exe
  C:\Windows\System\YFUEzRL.exe
  2⤵
  PID:15556
- C:\Windows\System\gyUsbWL.exe
  C:\Windows\System\gyUsbWL.exe
  2⤵
  PID:15252
- C:\Windows\System\ANBhhDF.exe
  C:\Windows\System\ANBhhDF.exe
  2⤵
  PID:14164
- C:\Windows\System\SXVBFgj.exe
  C:\Windows\System\SXVBFgj.exe
  2⤵
  PID:14944
- C:\Windows\System\VTGAkfr.exe
  C:\Windows\System\VTGAkfr.exe
  2⤵
  PID:15292
- C:\Windows\System\IAWEWQw.exe
  C:\Windows\System\IAWEWQw.exe
  2⤵
  PID:12512
- C:\Windows\System\DzpZYmj.exe
  C:\Windows\System\DzpZYmj.exe
  2⤵
  PID:14720
- C:\Windows\System\FKrEikV.exe
  C:\Windows\System\FKrEikV.exe
  2⤵
  PID:16404
- C:\Windows\System\GtDllgV.exe
  C:\Windows\System\GtDllgV.exe
  2⤵
  PID:16420
- C:\Windows\System\XnkyAIw.exe
  C:\Windows\System\XnkyAIw.exe
  2⤵
  PID:16452
- C:\Windows\System\ZOQUfTG.exe
  C:\Windows\System\ZOQUfTG.exe
  2⤵
  PID:16476
- C:\Windows\System\GBDAFFX.exe
  C:\Windows\System\GBDAFFX.exe
  2⤵
  PID:16492
- C:\Windows\System\iPPZoSY.exe
  C:\Windows\System\iPPZoSY.exe
  2⤵
  PID:16516
- C:\Windows\System\oOKbBuW.exe
  C:\Windows\System\oOKbBuW.exe
  2⤵
  PID:16544
- C:\Windows\System\YnrBmQZ.exe
  C:\Windows\System\YnrBmQZ.exe
  2⤵
  PID:16576
- C:\Windows\System\fqTMWjh.exe
  C:\Windows\System\fqTMWjh.exe
  2⤵
  PID:16596
- C:\Windows\System\IuLefea.exe
  C:\Windows\System\IuLefea.exe
  2⤵
  PID:16632
- C:\Windows\System\VakbMvj.exe
  C:\Windows\System\VakbMvj.exe
  2⤵
  PID:16660
- C:\Windows\System\KCNYJgL.exe
  C:\Windows\System\KCNYJgL.exe
  2⤵
  PID:16680
- C:\Windows\System\mJUwcgC.exe
  C:\Windows\System\mJUwcgC.exe
  2⤵
  PID:16704
- C:\Windows\System\mRWsHQr.exe
  C:\Windows\System\mRWsHQr.exe
  2⤵
  PID:16720
- - C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -u -p 16720 -s 248
    3⤵
    PID:16848
- C:\Windows\System\fLpGaMX.exe
  C:\Windows\System\fLpGaMX.exe
  2⤵
  PID:16736
- C:\Windows\System\xZtnnFc.exe
  C:\Windows\System\xZtnnFc.exe
  2⤵
  PID:16756
- C:\Windows\System\rVEIHpx.exe
  C:\Windows\System\rVEIHpx.exe
  2⤵
  PID:16784
- C:\Windows\System\mXFlgeM.exe
  C:\Windows\System\mXFlgeM.exe
  2⤵
  PID:16808
- C:\Windows\System\gQpUjLE.exe
  C:\Windows\System\gQpUjLE.exe
  2⤵
  PID:16828
- C:\Windows\System\BVeYvJo.exe
  C:\Windows\System\BVeYvJo.exe
  2⤵
  PID:16860
- C:\Windows\System\oINWUvE.exe
  C:\Windows\System\oINWUvE.exe
  2⤵
  PID:16876
- C:\Windows\System\TDJJrQe.exe
  C:\Windows\System\TDJJrQe.exe
  2⤵
  PID:16892
- C:\Windows\System\ZkLxOhg.exe
  C:\Windows\System\ZkLxOhg.exe
  2⤵
  PID:16920
- C:\Windows\System\WGcOWBN.exe
  C:\Windows\System\WGcOWBN.exe
  2⤵
  PID:16940
- C:\Windows\System\EFekrbK.exe
  C:\Windows\System\EFekrbK.exe
  2⤵
  PID:16972
- C:\Windows\System\scTQNwe.exe
  C:\Windows\System\scTQNwe.exe
  2⤵
  PID:17016
- C:\Windows\System\kdmiWrS.exe
  C:\Windows\System\kdmiWrS.exe
  2⤵
  PID:17032
- C:\Windows\System\qbuQwSA.exe
  C:\Windows\System\qbuQwSA.exe
  2⤵
  PID:17056
- C:\Windows\System\KOqIHjy.exe
  C:\Windows\System\KOqIHjy.exe
  2⤵
  PID:17084
- C:\Windows\System\cxkKBFq.exe
  C:\Windows\System\cxkKBFq.exe
  2⤵
  PID:17108
- C:\Windows\System\JpkuOud.exe
  C:\Windows\System\JpkuOud.exe
  2⤵
  PID:17132
- C:\Windows\System\bFFPXqh.exe
  C:\Windows\System\bFFPXqh.exe
  2⤵
  PID:17160
- C:\Windows\System\GJjqqAZ.exe
  C:\Windows\System\GJjqqAZ.exe
  2⤵
  PID:17176
- C:\Windows\System\shwqRhh.exe
  C:\Windows\System\shwqRhh.exe
  2⤵
  PID:17196
- C:\Windows\System\rZRVzyo.exe
  C:\Windows\System\rZRVzyo.exe
  2⤵
  PID:17224
- C:\Windows\System\KIfYFRY.exe
  C:\Windows\System\KIfYFRY.exe
  2⤵
  PID:14364
- C:\Windows\System\qJzrQrG.exe
  C:\Windows\System\qJzrQrG.exe
  2⤵
  PID:15500
- C:\Windows\System\JqOEPck.exe
  C:\Windows\System\JqOEPck.exe
  2⤵
  PID:15376
- C:\Windows\System\NqEcUCr.exe
  C:\Windows\System\NqEcUCr.exe
  2⤵
  PID:14464
- C:\Windows\System\AJntSlc.exe
  C:\Windows\System\AJntSlc.exe
  2⤵
  PID:14092
- C:\Windows\System\BWRMeuZ.exe
  C:\Windows\System\BWRMeuZ.exe
  2⤵
  PID:12060
- C:\Windows\System\ecJMMSs.exe
  C:\Windows\System\ecJMMSs.exe
  2⤵
  PID:16356
- C:\Windows\System\IpeUIWS.exe
  C:\Windows\System\IpeUIWS.exe
  2⤵
  PID:14572
- C:\Windows\System\szNRqjm.exe
  C:\Windows\System\szNRqjm.exe
  2⤵
  PID:13760
- C:\Windows\System\RqRcbwF.exe
  C:\Windows\System\RqRcbwF.exe
  2⤵
  PID:14644
- C:\Windows\System\cZDodZZ.exe
  C:\Windows\System\cZDodZZ.exe
  2⤵
  PID:14044
- C:\Windows\System\KabHmxV.exe
  C:\Windows\System\KabHmxV.exe
  2⤵
  PID:13308
- C:\Windows\System\DOsbmCp.exe
  C:\Windows\System\DOsbmCp.exe
  2⤵
  PID:15032
- C:\Windows\System\UtSzFzs.exe
  C:\Windows\System\UtSzFzs.exe
  2⤵
  PID:15108

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:16524

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\DCfRtdJ.exe

Filesize
1.4MB

MD5
df6b88a5d37f5560c90c3feb88a18ecc

SHA1
91331e971d23de436d181216251d3561896cf592

SHA256
e39ce7c7d88759b4751f1f40d70daff4e42683d8ee99c61aab5d3e9a993f739b

SHA512
3871407741ad8441cb70879c8b99f579d9c4d6de0aa1012e149498ad3da2dc21bea7868d25d614a665c352cda1081d3561fe510e0cb0958fb7118579cb571095

Download Submit
C:\Windows\System\DPUPCwX.exe

Filesize
1.4MB

MD5
0ec31e5b12dda9d65a46a57781fbfc1a

SHA1
a741a6d93cd960110810b3b53b888b5c24413ed7

SHA256
8ef1215d6e15dc64f7639202576ae25702438f4eea4ca6ac4864640de7926430

SHA512
e6df229c39f50335a040b274413d2f297f56a081fd55bc1b7197901828ca924a96b7d2a48fc6afe4784f6c23866a8f1780c178626a2f93e09dd3322f8d80f02a

Download Submit
C:\Windows\System\DfbGWJl.exe

Filesize
1.4MB

MD5
a169e8c110e52b4102707ff6d34c161a

SHA1
8543320d04142ed860dd0204c8df9c0ac53a92f0

SHA256
56cc1ea7d5f2939686bec9ac45045a3f6838f5cc01e0dd9001bcf7baddfb2a23

SHA512
8b9c9767cee7d3b75461139de511f38e48b32286ddc19a3084dd9fd2e1e285b1e99864b9b4e5d0a5b34504c077c67fc67c91b909abde517af6edafc9f49c6a34

Download Submit
C:\Windows\System\GSdWerG.exe

Filesize
1.4MB

MD5
eff43297a37e7e8fc691131c41fe1d51

SHA1
c1b41ed55ac1bdf5e2f1803a20346ad4cfc63498

SHA256
1447c8118a3f0d2c3bc4b77bd87dea1a8ab5c84f64a724ae35dcea7703d25372

SHA512
b136ee98586c12c16c2a2303ec28cbab8d2bc191adcebe642a15c6c5058dd6e95144054ccac0846ddd8facc674436b889a5e4958c044dbb8fb18aeccd0637f0f

Download Submit
C:\Windows\System\HfjFzqn.exe

Filesize
1.4MB

MD5
0109e52f332163b7b43bcb3f5cf0b3cc

SHA1
ed2120aac33e4330bbdd94f495e1e437c0216327

SHA256
a85621fa777015214bbfac624b7128de475f796aac62e3fbd774297f9f7a1a28

SHA512
2b0baab6e181710bf0b7694a3d3b0233bbc376c4674231a9093a7f9de531e5f9565426d18dcbbea61c1e173d5a2e79c8fd6d7d481141548870ecd8a7a64f5b10

Download Submit
C:\Windows\System\JJPoCFo.exe

Filesize
1.4MB

MD5
94e26ab1d1142f83fbdd5b69e301d74d

SHA1
966f96d551c335b498089145673f2441affdc4a9

SHA256
379c754488a93bf9a11277542b0d51ce3ba2bae40995d33122426c6f78a83998

SHA512
f133bea2716aa49cf35cecfc751ec28a6b0c54ac12161d072e7605cf4a606f08dc652b73c26c3c0d652cef4ce22a351ebd293dcf2d2bf7f930dae53c2c76ce96

Download Submit
C:\Windows\System\JwCgBWc.exe

Filesize
1.4MB

MD5
5497c57211c07870be44f8ab9ad793dd

SHA1
043bfc8bb319c5fd93fdcb4f6a280bd450d3c040

SHA256
6819d97e597e2da7ce0372e3a7c09716ae32d96539a3909b2be78430e8c02002

SHA512
17cf6dac412f38591cc0b0ab3308ef9be330e4f18d9fe40f81689468a761fe80c7a5db1b7992c777727b4d3c94c1abd356a1d3c48df80c71d862b4f79f92676f

Download Submit
C:\Windows\System\LbUvwTT.exe

Filesize
1.4MB

MD5
f727da5314d2ff1d39ef66f31c22c2d2

SHA1
6eadc54b5dfc7d258848f809b9dc26069a937320

SHA256
212246ad42e53cfdee0d19afca8530fdbca3971104c06775a2c6847b8153cc8f

SHA512
e93b546098feeedc13dcf0ea6ac45426a8d38f0fec779a13470bfb4df229ed09abff153336a868002c2c4fbd64e4dcc447a39383a97f8b85c5bb462720d5aa72

Download Submit
C:\Windows\System\MnMSDUb.exe

Filesize
1.4MB

MD5
a01990ae7b12b3239ff1c26f80ea3233

SHA1
cf60b115bd4f786dcd565722eb0763f95be92dd6

SHA256
495dbf0dd8112dc0ca69fd4098bdf7140e331bf622d6c598c01e8b38c8ae1104

SHA512
dea2b989e67b7a5b9f279bff4fe3a005435f7ed4602553187de2d227167363075854fc335891601d6bf3220178160dc2bcca7e669f45faa91070d406641b4e0c

Download Submit
C:\Windows\System\MyfEcWp.exe

Filesize
1.4MB

MD5
340806733a2e9651b7c55906d45a30f5

SHA1
95ef5710c46cb78637d256f426c831a844e63eb5

SHA256
31887cd150e38bbaaad51efe2cc0360ee34728da87ea787d1d69722ea42f8032

SHA512
564c6303f23b2bdd2c24d799ec6e7e52d959975b881912baba8fa500f7ab265e734c842670ba874ee34a43928df3832d3a8370100db9892a530c835785f4659a

Download Submit
C:\Windows\System\MzELvDx.exe

Filesize
1.4MB

MD5
d748a51f92f0e8d96fa3ab56986c3a29

SHA1
4b457505944f5c1b8d2950887eee1405e02ed19c

SHA256
057b473ff31e8b83ef1b5726a3a41fcedeb05e4702df4db3bd685e969d4be2b9

SHA512
0caecb44861b4fd2eac20979727ee45778b7f9321208ac93b52978dab90874ecf87466fab23bb947f8d0d2ed34b4471ed8985fac1e70195e2087bdb7552bf1ca

Download Submit
C:\Windows\System\Npfaate.exe

Filesize
1.4MB

MD5
935fd690b0f50c47db81d6823c9692f1

SHA1
5b85c8c83e22cba5b30cdc39865463e4f9cddb76

SHA256
ce452f3b05faded8c3c71a6f48121e82433b7429d71cee9f7589cbcb4c9cdb1d

SHA512
a31539f0126b9441c8c7417af7d196f7d476c76524ff3587d99f119ed254a3b95bd224889601ea3c2b885335c0235a3544a0693802c64bc5aaea270ca04d09b7

Download Submit
C:\Windows\System\PDlXwjA.exe

Filesize
1.4MB

MD5
14b7c274f82bbf287aedff74fcb865cb

SHA1
894c2387854de43400e89fb200507b4360867c21

SHA256
6c1f9eb280b3bf13be93fb6ccc3478b137d2c8eca018900b20d588aae4a522d1

SHA512
aadd63db86951f976270216f65f4d2649486e6dc413b1505a529300e9190f3149ae1f137e043e2dcaa4099461529ba2731bc49a45b0213956d6eca078292e6b2

Download Submit
C:\Windows\System\RrKrbtS.exe

Filesize
1.4MB

MD5
ffab9d117d8cdf2ddca96f89d42b1b85

SHA1
31e5d5a79b4b9b55946604fa78ecbf1f955c2ea1

SHA256
d9903faf2a25c9e24279438b91e87762f864bd96362c8fad74a04e2ad7fe17fe

SHA512
c6f43f0db7649acefd12c1802a1c289f48230c7ae8b4c1f0a62c3d81bc2e97e87e0e0a88e2b757b21c91421a58c180db76b3076afa4e579b0e7ccf35d399f8ef

Download Submit
C:\Windows\System\TSsiwJC.exe

Filesize
1.4MB

MD5
6c7e67bdd1dd9e501e04d2f85fe29a1f

SHA1
daeeacfed95914878c4cd594cd95341d8f3c1345

SHA256
8a9e77c2bd16e133f1925df86baba3d4acc642dacf2ed9d2f180b7b136c04cd7

SHA512
4b31158e896c18f27b0cf68b7a0164dc548a4aca09e0c480da3aef08abd4cf3b388eb2e2ac77e71b8f8e93a4d56f8fc41cf47ddd00635cf36eaab570f9ac43ef

Download Submit
C:\Windows\System\TfKBNdT.exe

Filesize
1.4MB

MD5
eb5a0f771c854dbf779c627c252e50d1

SHA1
4be181f33b6c9773afedd618e7abc4296a562852

SHA256
a32edc889ddf86864ece92573f440c0f4a3ad2e02f55a20695baf7aa2aee28cc

SHA512
ce7e4287669608f8998b54414b841b626e4b88420670972c98cd4a8106e5e8c436e123a790f72adf47a4a59c31889994a077f39bb3172f993b24d4263af1f572

Download Submit
C:\Windows\System\VqwzwVo.exe

Filesize
1.4MB

MD5
0e2b0d9da66019c0ff4abe899697c04b

SHA1
2b80222557ac3cb1be596f01d55bc6b4e605b78f

SHA256
bcabcee207aa3767ed633080362f6fa4698f2b140fa1c48a149717c6e1ea6d22

SHA512
fffd14915e90af004065d987b1fdad4bee245b3e7d1408e2351618031252982ed652894912ee13d93b928dc02ce80bf99bdd56055763e605284b059f653f67f5

Download Submit
C:\Windows\System\WkzpPKi.exe

Filesize
1.4MB

MD5
368f6d2fba20d20594926bf0d2d2bb02

SHA1
afdfd84136d7a43e5f6c8092b253dff2e4781ed6

SHA256
1b505f290faa54d838d587f21fa057df5508a1ecaa2a4f5800952e9c1e53b58d

SHA512
97a736bd4a470093157cd1a76b18dd21f500671b358acc4dee869b1ebc6869312c18eec44a7b817045cb6a9ae4a133fb2a3f916293feb3656cb2377a07c48e6c

Download Submit
C:\Windows\System\ZPqAWTX.exe

Filesize
1.4MB

MD5
62ca4c0eec4498cf2da97486d0942a7a

SHA1
08daef23ead9f2a810184eaa427a37a5b3a7dd17

SHA256
d2cf2f558fc412b20a4ac6d542221d47b9ff81c4c6cefc43dfee742440c4773f

SHA512
f144aadce4d1f274ad9d3978e21a5606aa380e3d87022e7089fa243350519ce253f5b6ffd4e0c39ca15124fc5ecfd190b947314728f6fd925df2255483e51442

Download Submit
C:\Windows\System\ZZaklLB.exe

Filesize
1.4MB

MD5
94e992a3a9798c9c57fdf29fe684dae0

SHA1
56a6cdbea53285787d6d2ea9d105ba10ad7d077e

SHA256
318a9cab3a174cc57eac494f1ed534594b4978424d97a55f050e541a904288a1

SHA512
e4809a293b9ee41ef0745f7a24ae861067a03737ad6609ec4632a0cf27acc3332be4fb11d901eb3600a57c81010989b8275a784e6e14d5a66cd95cc7b4de65bc

Download Submit
C:\Windows\System\cVdybij.exe

Filesize
1.4MB

MD5
1a9c4dbd90738403de8b5cc7d95b7937

SHA1
ac933487012280c3185e7a6104dba65f454f5f8c

SHA256
b15a3bcec0b1c10b68c34c884ef48b3bbc8c3bebfbc77d07e2e0d1f98d0b2c46

SHA512
ab17af4e89d2746bf37e588de4b66e3fb674390940c8eac64398e7e90a301f3f49edd1bb820e41efb51ff023d7e6b62f44baaea78132ef044bf5925ecf6d4892

Download Submit
C:\Windows\System\dyHkLDZ.exe

Filesize
1.4MB

MD5
5fee7c480e58e93331c324936372aff9

SHA1
fdbfe53d8a955d5085eee6284319770980bdcc09

SHA256
8a98e6651f9bf365998f19a70f5b235b8291f94bd04a6f0f8aa3bcba6aab5883

SHA512
2d4ae202aed2910acd3392930d55a163ba80b0ce0b37edbbbb5cf6793c0e2b63c7ea0fb13474f65259bc6952890917de0d2b4cd5a9bd5b3131887635b15d78b8

Download Submit
C:\Windows\System\gkoDpHx.exe

Filesize
1.4MB

MD5
329eb7cb5153b4a82f12b892db0971cd

SHA1
cc7462b03742acf5c5b4e2b4d46e0631883b73f3

SHA256
c46575aac0ae3e340b265006c0fa8e42f862196d04eb043b5bf95de573b1c2e5

SHA512
c96971ff81d01e71314f2c2f75fb8c6a8c03f61fffdc393e671a1c23925c6a3c83234476e00bc5aaa1e9f9aaa7bfcc1cc5349d39e7574ed63b833612f1abbe62

Download Submit
C:\Windows\System\jtNwlrC.exe

Filesize
1.4MB

MD5
e64086965b6d45cb4f1a1612beb4e9a6

SHA1
b4dfdd8a93cd8a30041b13b8610b12787bc49510

SHA256
46adffa86a66000d2501b8d0da705c3f8a5b2e4ddc0a6d4a7dd4485e8bc45ef5

SHA512
9ca5f9c260ad29e6889491f3dde79b08d69828a1e5a64655cf8c19a858b0156271e371f4dce96508ecbcc561ac148a935bbbb8594fcd2c881c4280aae2e65ac2

Download Submit
C:\Windows\System\olEQggF.exe

Filesize
1.4MB

MD5
c1ac35ef3d29b8f9e6f73a674ffce36d

SHA1
96fd1f13a78f99984822c450249e3517aaca80cf

SHA256
677ac13be92d1e178f6ec5787d82bb1be9380067f189a1095cf77185d215ded3

SHA512
e37125416f1c79c20ec8ab913e597cb9955e077b3b207bb025b005f1b22cfd45dde489e4345fd67c3742d6816cbe521b17200682a88dc486cd635508a62996fe

Download Submit
C:\Windows\System\qzGTuHC.exe

Filesize
1.4MB

MD5
45d21232b7e65f761056af2eeae7bc37

SHA1
b9f7f4c96591c395dacb4fe4ecb8a1f8dd7c7c54

SHA256
2c70bfbd4ce6b82eafdd0381d656e0150398303e844378e04b722c19fb4093be

SHA512
94844b19465060c02d4f05c0ff1b0c5580e47b2a9c9bdd95de269ceee1b89168f15eb4a6068c40fde04072764d61a8eca8efa33f6596f6121e03faad87e132d7

Download Submit
C:\Windows\System\rXINaMu.exe

Filesize
1.4MB

MD5
9214872b90b9d3ed5896b68ec8f5ea82

SHA1
9af6bfe16abec952ffd812c2f9043049fd355aa8

SHA256
9ec422c9c1898b6c3fa0d59de54e4fe5a3bfcaf157ea838a6ff190a192e24aa3

SHA512
41c057d4e6d59bd19b5096ef3fcc439e9eed7b0c7d80ed71ac1561755b4c8e51e076ea7c3bf0aacf68a9bec1a9ba0aa4b92c6502c0bb65d3206a66672d900a96

Download Submit
C:\Windows\System\tutpnQg.exe

Filesize
1.4MB

MD5
591fec168c96b0efa092b57d0a0d64ed

SHA1
495a49e0e7ca5b56f3928aa592fbd7ff737df750

SHA256
6a7e9637d4e92fbfa32ed4c2bf3226874417213db62eb7cef082e9fc40c31090

SHA512
9822ae853a82d91b8751953f913573abcb0ba172f229332f116d04c1073eecaabd423dfb03ccd27dfa3545bd1301f253afc44369688ca65e9bd07abe799d67f9

Download Submit
C:\Windows\System\vGiBpaR.exe

Filesize
1.4MB

MD5
19cb249c89f44178abb021b0dd06f1ca

SHA1
ab262ffedd1e8fd4fa3a2b01ed35987494630de8

SHA256
3ffe4e0a917c99b1f38494eb2f19b385fdda070b51e9b09b10ee99112e709709

SHA512
f609081d44df227393a1f74a01d4e2a4da7eeb710ac6f832df51d9b1c9d62578cc12906eb73b04b122d75586ccd1acb1e0f06f4952c1d8d96e852973f3dc34c1

Download Submit
C:\Windows\System\wnVlwqi.exe

Filesize
1.4MB

MD5
d921396c0b885acef75953807e37b15b

SHA1
3a03e95921f198eec05eed1bba3d628c8ea9233c

SHA256
b13d51e8bf4fbda5eb9e2ced80d13b2710419dbd7f7071613bc92632d6da29bf

SHA512
8ea2584c5c7b663efc3e218f9cfbccd34a0dfa1ca04a1541f8cd61344046b3ceca01ec32f57aeacb91412977dc65dfce9ffcd9a46dc5f89a2ecf56287624cd26

Download Submit
C:\Windows\System\xCkWUVI.exe

Filesize
1.4MB

MD5
8d97a7372889e4b7d429be1cc7921266

SHA1
2fe99496d5569b1c42d28924c671b6694adb33e1

SHA256
3337fdb0dc65c2fe0f930ec43ea6988af766e00904ac8742581ea14ed5c2e905

SHA512
59b3f5c8e7c4eea7014ec0f5c1cb5340f869d72a0fb39cab5d0ecafb35ff2d53982b811e32854703fb6ddc14d8e38e77ee1a0473fecd39fb076d4e03a4d99bac

Download Submit
C:\Windows\System\xFguoIm.exe

Filesize
1.4MB

MD5
0b41efbc337a3119bb41e73efd81e3e3

SHA1
a79531261b850ded6a479393b632f6277545b601

SHA256
ab41f944ffc01a7e0f477927c9855225fcf7081b17ad8b00edbb09df857c8124

SHA512
6dba75091c4c310e0f32ba98b3bf749265ae2cb6b1c986a47421e863f8806a4b4b3ec0a0dc6e0e18d1e0740b6d0c0fa245f7bcb2ca5ead2f0f4b5c9ea240dc75

Download Submit
C:\Windows\System\xyZiszj.exe

Filesize
1.4MB

MD5
04d42a6ac2b25b8bbd70352c8b5c26c3

SHA1
d667415835d38560d97489a99af863652cca2ba2

SHA256
dc393c3ef2da5e26e56bceeb39bf29aa19d2c5aab48b7f35448768154884f87c

SHA512
0be74d22d54cf7030c2f398ee49190f85fa30db4ccd3206145335b42ffe3d470dbaace850533b343c70cfa3a123dff0b75d14f82fb6427c3a0763d60eb7c2fa0

Download Submit
memory/3568-0-0x00000176DE180000-0x00000176DE190000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads