xmrig | dd615805d2f791012c9da4c237ab3f7c1bf538d90588a0562f540c4d45fa91b9

Analysis

max time kernel
149s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
17-11-2024 09:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dd615805d2f791012c9da4c237ab3f7c1bf538d90588a0562f540c4d45fa91b9.exe
Size

1.4MB
MD5

bef191753e824b6bcc50ca273cb8a3c0
SHA1

bee951b3c060da81e6767d6a0235b3742bacabb6
SHA256

dd615805d2f791012c9da4c237ab3f7c1bf538d90588a0562f540c4d45fa91b9
SHA512

e80eccc0c48b008fdae02840c4775ff6838c42ebbdac73f6ca260c09ac37c901f668ca6c9982991ac94c8d6c85b85b373b04d006046d102d9b57e1493ebe269b
SSDEEP

24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbpwlKenszbWKDNEm/51m6PbWEJp8:GezaTF8FcNkNdfE0pZ9ozttwIRx3QiWB

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 32 IoCs

miner

resource	yara_rule
behavioral2/files/0x000a000000023c87-3.dat	xmrig
behavioral2/files/0x0008000000023c8a-7.dat	xmrig
behavioral2/files/0x0007000000023c8e-6.dat	xmrig
behavioral2/files/0x0007000000023c8f-18.dat	xmrig
behavioral2/files/0x0007000000023c90-24.dat	xmrig
behavioral2/files/0x0007000000023c91-25.dat	xmrig
behavioral2/files/0x0007000000023c92-34.dat	xmrig
behavioral2/files/0x0008000000023c8b-39.dat	xmrig
behavioral2/files/0x0007000000023c94-48.dat	xmrig
behavioral2/files/0x0007000000023c95-54.dat	xmrig
behavioral2/files/0x0007000000023c96-53.dat	xmrig
behavioral2/files/0x0007000000023c99-68.dat	xmrig
behavioral2/files/0x0007000000023c9c-84.dat	xmrig
behavioral2/files/0x0007000000023ca0-98.dat	xmrig
behavioral2/files/0x0007000000023ca5-130.dat	xmrig
behavioral2/files/0x0007000000023ca4-128.dat	xmrig
behavioral2/files/0x0007000000023ca3-125.dat	xmrig
behavioral2/files/0x0007000000023ca2-123.dat	xmrig
behavioral2/files/0x0007000000023ca1-121.dat	xmrig
behavioral2/files/0x0007000000023c9f-116.dat	xmrig
behavioral2/files/0x0007000000023c9d-110.dat	xmrig
behavioral2/files/0x0007000000023c9e-105.dat	xmrig
behavioral2/files/0x0007000000023c9b-101.dat	xmrig
behavioral2/files/0x0007000000023c9a-99.dat	xmrig
behavioral2/files/0x0007000000023c98-65.dat	xmrig
behavioral2/files/0x0007000000023c97-63.dat	xmrig
behavioral2/files/0x0007000000023ca6-134.dat	xmrig
behavioral2/files/0x0007000000023ca7-140.dat	xmrig
behavioral2/files/0x0007000000023ca8-145.dat	xmrig
behavioral2/files/0x0007000000023ca9-155.dat	xmrig
behavioral2/files/0x0007000000023cab-154.dat	xmrig
behavioral2/files/0x0007000000023caa-156.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
1356	gtWJIeN.exe
4472	aFhbINA.exe
2156	pBUqqwz.exe
2780	grjEtuv.exe
4180	uqvzTOj.exe
1368	Mfezouf.exe
4576	EkTeOeE.exe
2684	ICKGwLy.exe
1012	ReDMruz.exe
4772	TaFzZaR.exe
112	SMeNJgM.exe
2920	MmkTHzF.exe
2936	iwWqwjH.exe
844	ZyddXOx.exe
3484	iYlCfLQ.exe
4692	sQdjTkw.exe
1268	nfCIzuE.exe
1424	OXphaLb.exe
952	qtvyGFV.exe
2348	jNNlYZD.exe
4244	nRYiHOu.exe
408	lUlMgCi.exe
1564	MaDIwwP.exe
4612	aOOMutR.exe
4204	gwUcXtv.exe
4904	oYqkuSG.exe
3640	uphhzOi.exe
1812	YwjBcJx.exe
1648	czNDdIE.exe
4360	muBUgwv.exe
3832	AFdKjub.exe
208	FMlmcfW.exe
2184	rLPYyos.exe
3652	mTquqzR.exe
2188	qhOiqCi.exe
1744	CdwSSjL.exe
404	xvmwJTD.exe
4640	EbrVbDK.exe
3600	ekTOHcS.exe
4280	DYiSRvp.exe
4968	aixJQvP.exe
1548	PLsNxBX.exe
4636	JGOxqeg.exe
3008	HpkTghe.exe
4356	vcuhTJh.exe
4224	lKrbDkT.exe
2844	oXnKhBp.exe
3820	qkIQRMe.exe
3208	BOgaGzj.exe
4276	tsPnEeI.exe
2128	yNfSksy.exe
4608	qRnPvpR.exe
1428	ZQlRDqA.exe
2700	YRGFISG.exe
1148	kbbUBAs.exe
908	EvevLhE.exe
3936	BIJzCvk.exe
4708	uNdTyoC.exe
4900	jDqjJbL.exe
3524	aOsjwMT.exe
1592	MRWeMFI.exe
2992	eOCwrij.exe
2300	JNPtPmp.exe
4876	muRlbDG.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\ReDMruz.exe	dd615805d2f791012c9da4c237ab3f7c1bf538d90588a0562f540c4d45fa91b9.exe
File created	C:\Windows\System\AFdKjub.exe	dd615805d2f791012c9da4c237ab3f7c1bf538d90588a0562f540c4d45fa91b9.exe
File created	C:\Windows\System\kVUnuCh.exe	dd615805d2f791012c9da4c237ab3f7c1bf538d90588a0562f540c4d45fa91b9.exe
File created	C:\Windows\System\mGHNgmI.exe	dd615805d2f791012c9da4c237ab3f7c1bf538d90588a0562f540c4d45fa91b9.exe
File created	C:\Windows\System\zJLgmhA.exe	dd615805d2f791012c9da4c237ab3f7c1bf538d90588a0562f540c4d45fa91b9.exe
File created	C:\Windows\System\HBTKsQe.exe	dd615805d2f791012c9da4c237ab3f7c1bf538d90588a0562f540c4d45fa91b9.exe
File created	C:\Windows\System\CVYpjae.exe	dd615805d2f791012c9da4c237ab3f7c1bf538d90588a0562f540c4d45fa91b9.exe
File created	C:\Windows\System\NQzjdPL.exe	dd615805d2f791012c9da4c237ab3f7c1bf538d90588a0562f540c4d45fa91b9.exe
File created	C:\Windows\System\FsUEuIT.exe	dd615805d2f791012c9da4c237ab3f7c1bf538d90588a0562f540c4d45fa91b9.exe
File created	C:\Windows\System\yfwcnvK.exe	dd615805d2f791012c9da4c237ab3f7c1bf538d90588a0562f540c4d45fa91b9.exe
File created	C:\Windows\System\BIJzCvk.exe	dd615805d2f791012c9da4c237ab3f7c1bf538d90588a0562f540c4d45fa91b9.exe
File created	C:\Windows\System\jjGZAPy.exe	dd615805d2f791012c9da4c237ab3f7c1bf538d90588a0562f540c4d45fa91b9.exe
File created	C:\Windows\System\bUNPJYW.exe	dd615805d2f791012c9da4c237ab3f7c1bf538d90588a0562f540c4d45fa91b9.exe
File created	C:\Windows\System\kxcWubb.exe	dd615805d2f791012c9da4c237ab3f7c1bf538d90588a0562f540c4d45fa91b9.exe
File created	C:\Windows\System\ofYrNqm.exe	dd615805d2f791012c9da4c237ab3f7c1bf538d90588a0562f540c4d45fa91b9.exe
File created	C:\Windows\System\VoCJesx.exe	dd615805d2f791012c9da4c237ab3f7c1bf538d90588a0562f540c4d45fa91b9.exe
File created	C:\Windows\System\FbWfBuS.exe	dd615805d2f791012c9da4c237ab3f7c1bf538d90588a0562f540c4d45fa91b9.exe
File created	C:\Windows\System\tfqPzKC.exe	dd615805d2f791012c9da4c237ab3f7c1bf538d90588a0562f540c4d45fa91b9.exe
File created	C:\Windows\System\yORrHVH.exe	dd615805d2f791012c9da4c237ab3f7c1bf538d90588a0562f540c4d45fa91b9.exe
File created	C:\Windows\System\snxwwjV.exe	dd615805d2f791012c9da4c237ab3f7c1bf538d90588a0562f540c4d45fa91b9.exe
File created	C:\Windows\System\sJXarZM.exe	dd615805d2f791012c9da4c237ab3f7c1bf538d90588a0562f540c4d45fa91b9.exe
File created	C:\Windows\System\FLVEnaj.exe	dd615805d2f791012c9da4c237ab3f7c1bf538d90588a0562f540c4d45fa91b9.exe
File created	C:\Windows\System\VhrTKBN.exe	dd615805d2f791012c9da4c237ab3f7c1bf538d90588a0562f540c4d45fa91b9.exe
File created	C:\Windows\System\HjOmJvz.exe	dd615805d2f791012c9da4c237ab3f7c1bf538d90588a0562f540c4d45fa91b9.exe
File created	C:\Windows\System\RgInWTK.exe	dd615805d2f791012c9da4c237ab3f7c1bf538d90588a0562f540c4d45fa91b9.exe
File created	C:\Windows\System\CaFxgXa.exe	dd615805d2f791012c9da4c237ab3f7c1bf538d90588a0562f540c4d45fa91b9.exe
File created	C:\Windows\System\hQhjcno.exe	dd615805d2f791012c9da4c237ab3f7c1bf538d90588a0562f540c4d45fa91b9.exe
File created	C:\Windows\System\jeOaVEY.exe	dd615805d2f791012c9da4c237ab3f7c1bf538d90588a0562f540c4d45fa91b9.exe
File created	C:\Windows\System\YRGFISG.exe	dd615805d2f791012c9da4c237ab3f7c1bf538d90588a0562f540c4d45fa91b9.exe
File created	C:\Windows\System\rpoocZl.exe	dd615805d2f791012c9da4c237ab3f7c1bf538d90588a0562f540c4d45fa91b9.exe
File created	C:\Windows\System\EqQXPsE.exe	dd615805d2f791012c9da4c237ab3f7c1bf538d90588a0562f540c4d45fa91b9.exe
File created	C:\Windows\System\dxsHjQs.exe	dd615805d2f791012c9da4c237ab3f7c1bf538d90588a0562f540c4d45fa91b9.exe
File created	C:\Windows\System\MSLiBjM.exe	dd615805d2f791012c9da4c237ab3f7c1bf538d90588a0562f540c4d45fa91b9.exe
File created	C:\Windows\System\dsKHpFX.exe	dd615805d2f791012c9da4c237ab3f7c1bf538d90588a0562f540c4d45fa91b9.exe
File created	C:\Windows\System\GPOlPAG.exe	dd615805d2f791012c9da4c237ab3f7c1bf538d90588a0562f540c4d45fa91b9.exe
File created	C:\Windows\System\SGlspTJ.exe	dd615805d2f791012c9da4c237ab3f7c1bf538d90588a0562f540c4d45fa91b9.exe
File created	C:\Windows\System\bJZXytI.exe	dd615805d2f791012c9da4c237ab3f7c1bf538d90588a0562f540c4d45fa91b9.exe
File created	C:\Windows\System\uOATOHG.exe	dd615805d2f791012c9da4c237ab3f7c1bf538d90588a0562f540c4d45fa91b9.exe
File created	C:\Windows\System\nStgssJ.exe	dd615805d2f791012c9da4c237ab3f7c1bf538d90588a0562f540c4d45fa91b9.exe
File created	C:\Windows\System\jCqYZdv.exe	dd615805d2f791012c9da4c237ab3f7c1bf538d90588a0562f540c4d45fa91b9.exe
File created	C:\Windows\System\zOyUUJC.exe	dd615805d2f791012c9da4c237ab3f7c1bf538d90588a0562f540c4d45fa91b9.exe
File created	C:\Windows\System\xdnHGre.exe	dd615805d2f791012c9da4c237ab3f7c1bf538d90588a0562f540c4d45fa91b9.exe
File created	C:\Windows\System\ikrbGHY.exe	dd615805d2f791012c9da4c237ab3f7c1bf538d90588a0562f540c4d45fa91b9.exe
File created	C:\Windows\System\cwJVHhx.exe	dd615805d2f791012c9da4c237ab3f7c1bf538d90588a0562f540c4d45fa91b9.exe
File created	C:\Windows\System\euZLqNK.exe	dd615805d2f791012c9da4c237ab3f7c1bf538d90588a0562f540c4d45fa91b9.exe
File created	C:\Windows\System\tovXiKw.exe	dd615805d2f791012c9da4c237ab3f7c1bf538d90588a0562f540c4d45fa91b9.exe
File created	C:\Windows\System\SOItILZ.exe	dd615805d2f791012c9da4c237ab3f7c1bf538d90588a0562f540c4d45fa91b9.exe
File created	C:\Windows\System\hMtYELh.exe	dd615805d2f791012c9da4c237ab3f7c1bf538d90588a0562f540c4d45fa91b9.exe
File created	C:\Windows\System\MTvAIsE.exe	dd615805d2f791012c9da4c237ab3f7c1bf538d90588a0562f540c4d45fa91b9.exe
File created	C:\Windows\System\VAnvEpk.exe	dd615805d2f791012c9da4c237ab3f7c1bf538d90588a0562f540c4d45fa91b9.exe
File created	C:\Windows\System\mheElxZ.exe	dd615805d2f791012c9da4c237ab3f7c1bf538d90588a0562f540c4d45fa91b9.exe
File created	C:\Windows\System\LmGAQdQ.exe	dd615805d2f791012c9da4c237ab3f7c1bf538d90588a0562f540c4d45fa91b9.exe
File created	C:\Windows\System\xevgbhf.exe	dd615805d2f791012c9da4c237ab3f7c1bf538d90588a0562f540c4d45fa91b9.exe
File created	C:\Windows\System\XfaFOLx.exe	dd615805d2f791012c9da4c237ab3f7c1bf538d90588a0562f540c4d45fa91b9.exe
File created	C:\Windows\System\QlgfKSA.exe	dd615805d2f791012c9da4c237ab3f7c1bf538d90588a0562f540c4d45fa91b9.exe
File created	C:\Windows\System\CaXzxli.exe	dd615805d2f791012c9da4c237ab3f7c1bf538d90588a0562f540c4d45fa91b9.exe
File created	C:\Windows\System\MEVxaVe.exe	dd615805d2f791012c9da4c237ab3f7c1bf538d90588a0562f540c4d45fa91b9.exe
File created	C:\Windows\System\grjEtuv.exe	dd615805d2f791012c9da4c237ab3f7c1bf538d90588a0562f540c4d45fa91b9.exe
File created	C:\Windows\System\gQFYeOw.exe	dd615805d2f791012c9da4c237ab3f7c1bf538d90588a0562f540c4d45fa91b9.exe
File created	C:\Windows\System\ecUTeoU.exe	dd615805d2f791012c9da4c237ab3f7c1bf538d90588a0562f540c4d45fa91b9.exe
File created	C:\Windows\System\rLPYyos.exe	dd615805d2f791012c9da4c237ab3f7c1bf538d90588a0562f540c4d45fa91b9.exe
File created	C:\Windows\System\UpJqADQ.exe	dd615805d2f791012c9da4c237ab3f7c1bf538d90588a0562f540c4d45fa91b9.exe
File created	C:\Windows\System\bVmGyvn.exe	dd615805d2f791012c9da4c237ab3f7c1bf538d90588a0562f540c4d45fa91b9.exe
File created	C:\Windows\System\PUcZHrv.exe	dd615805d2f791012c9da4c237ab3f7c1bf538d90588a0562f540c4d45fa91b9.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	17128	dwm.exe
Token: SeChangeNotifyPrivilege	17128	dwm.exe
Token: 33	17128	dwm.exe
Token: SeIncBasePriorityPrivilege	17128	dwm.exe
Token: SeShutdownPrivilege	17128	dwm.exe
Token: SeCreatePagefilePrivilege	17128	dwm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3632 wrote to memory of 1356	3632	dd615805d2f791012c9da4c237ab3f7c1bf538d90588a0562f540c4d45fa91b9.exe	84
PID 3632 wrote to memory of 1356	3632	dd615805d2f791012c9da4c237ab3f7c1bf538d90588a0562f540c4d45fa91b9.exe	84
PID 3632 wrote to memory of 4472	3632	dd615805d2f791012c9da4c237ab3f7c1bf538d90588a0562f540c4d45fa91b9.exe	85
PID 3632 wrote to memory of 4472	3632	dd615805d2f791012c9da4c237ab3f7c1bf538d90588a0562f540c4d45fa91b9.exe	85
PID 3632 wrote to memory of 2156	3632	dd615805d2f791012c9da4c237ab3f7c1bf538d90588a0562f540c4d45fa91b9.exe	86
PID 3632 wrote to memory of 2156	3632	dd615805d2f791012c9da4c237ab3f7c1bf538d90588a0562f540c4d45fa91b9.exe	86
PID 3632 wrote to memory of 2780	3632	dd615805d2f791012c9da4c237ab3f7c1bf538d90588a0562f540c4d45fa91b9.exe	87
PID 3632 wrote to memory of 2780	3632	dd615805d2f791012c9da4c237ab3f7c1bf538d90588a0562f540c4d45fa91b9.exe	87
PID 3632 wrote to memory of 4180	3632	dd615805d2f791012c9da4c237ab3f7c1bf538d90588a0562f540c4d45fa91b9.exe	88
PID 3632 wrote to memory of 4180	3632	dd615805d2f791012c9da4c237ab3f7c1bf538d90588a0562f540c4d45fa91b9.exe	88
PID 3632 wrote to memory of 1368	3632	dd615805d2f791012c9da4c237ab3f7c1bf538d90588a0562f540c4d45fa91b9.exe	89
PID 3632 wrote to memory of 1368	3632	dd615805d2f791012c9da4c237ab3f7c1bf538d90588a0562f540c4d45fa91b9.exe	89
PID 3632 wrote to memory of 4576	3632	dd615805d2f791012c9da4c237ab3f7c1bf538d90588a0562f540c4d45fa91b9.exe	90
PID 3632 wrote to memory of 4576	3632	dd615805d2f791012c9da4c237ab3f7c1bf538d90588a0562f540c4d45fa91b9.exe	90
PID 3632 wrote to memory of 2684	3632	dd615805d2f791012c9da4c237ab3f7c1bf538d90588a0562f540c4d45fa91b9.exe	91
PID 3632 wrote to memory of 2684	3632	dd615805d2f791012c9da4c237ab3f7c1bf538d90588a0562f540c4d45fa91b9.exe	91
PID 3632 wrote to memory of 1012	3632	dd615805d2f791012c9da4c237ab3f7c1bf538d90588a0562f540c4d45fa91b9.exe	92
PID 3632 wrote to memory of 1012	3632	dd615805d2f791012c9da4c237ab3f7c1bf538d90588a0562f540c4d45fa91b9.exe	92
PID 3632 wrote to memory of 4772	3632	dd615805d2f791012c9da4c237ab3f7c1bf538d90588a0562f540c4d45fa91b9.exe	93
PID 3632 wrote to memory of 4772	3632	dd615805d2f791012c9da4c237ab3f7c1bf538d90588a0562f540c4d45fa91b9.exe	93
PID 3632 wrote to memory of 112	3632	dd615805d2f791012c9da4c237ab3f7c1bf538d90588a0562f540c4d45fa91b9.exe	94
PID 3632 wrote to memory of 112	3632	dd615805d2f791012c9da4c237ab3f7c1bf538d90588a0562f540c4d45fa91b9.exe	94
PID 3632 wrote to memory of 2920	3632	dd615805d2f791012c9da4c237ab3f7c1bf538d90588a0562f540c4d45fa91b9.exe	95
PID 3632 wrote to memory of 2920	3632	dd615805d2f791012c9da4c237ab3f7c1bf538d90588a0562f540c4d45fa91b9.exe	95
PID 3632 wrote to memory of 2936	3632	dd615805d2f791012c9da4c237ab3f7c1bf538d90588a0562f540c4d45fa91b9.exe	96
PID 3632 wrote to memory of 2936	3632	dd615805d2f791012c9da4c237ab3f7c1bf538d90588a0562f540c4d45fa91b9.exe	96
PID 3632 wrote to memory of 844	3632	dd615805d2f791012c9da4c237ab3f7c1bf538d90588a0562f540c4d45fa91b9.exe	98
PID 3632 wrote to memory of 844	3632	dd615805d2f791012c9da4c237ab3f7c1bf538d90588a0562f540c4d45fa91b9.exe	98
PID 3632 wrote to memory of 3484	3632	dd615805d2f791012c9da4c237ab3f7c1bf538d90588a0562f540c4d45fa91b9.exe	99
PID 3632 wrote to memory of 3484	3632	dd615805d2f791012c9da4c237ab3f7c1bf538d90588a0562f540c4d45fa91b9.exe	99
PID 3632 wrote to memory of 4692	3632	dd615805d2f791012c9da4c237ab3f7c1bf538d90588a0562f540c4d45fa91b9.exe	100
PID 3632 wrote to memory of 4692	3632	dd615805d2f791012c9da4c237ab3f7c1bf538d90588a0562f540c4d45fa91b9.exe	100
PID 3632 wrote to memory of 1268	3632	dd615805d2f791012c9da4c237ab3f7c1bf538d90588a0562f540c4d45fa91b9.exe	101
PID 3632 wrote to memory of 1268	3632	dd615805d2f791012c9da4c237ab3f7c1bf538d90588a0562f540c4d45fa91b9.exe	101
PID 3632 wrote to memory of 1424	3632	dd615805d2f791012c9da4c237ab3f7c1bf538d90588a0562f540c4d45fa91b9.exe	102
PID 3632 wrote to memory of 1424	3632	dd615805d2f791012c9da4c237ab3f7c1bf538d90588a0562f540c4d45fa91b9.exe	102
PID 3632 wrote to memory of 952	3632	dd615805d2f791012c9da4c237ab3f7c1bf538d90588a0562f540c4d45fa91b9.exe	103
PID 3632 wrote to memory of 952	3632	dd615805d2f791012c9da4c237ab3f7c1bf538d90588a0562f540c4d45fa91b9.exe	103
PID 3632 wrote to memory of 2348	3632	dd615805d2f791012c9da4c237ab3f7c1bf538d90588a0562f540c4d45fa91b9.exe	104
PID 3632 wrote to memory of 2348	3632	dd615805d2f791012c9da4c237ab3f7c1bf538d90588a0562f540c4d45fa91b9.exe	104
PID 3632 wrote to memory of 4244	3632	dd615805d2f791012c9da4c237ab3f7c1bf538d90588a0562f540c4d45fa91b9.exe	105
PID 3632 wrote to memory of 4244	3632	dd615805d2f791012c9da4c237ab3f7c1bf538d90588a0562f540c4d45fa91b9.exe	105
PID 3632 wrote to memory of 408	3632	dd615805d2f791012c9da4c237ab3f7c1bf538d90588a0562f540c4d45fa91b9.exe	106
PID 3632 wrote to memory of 408	3632	dd615805d2f791012c9da4c237ab3f7c1bf538d90588a0562f540c4d45fa91b9.exe	106
PID 3632 wrote to memory of 1564	3632	dd615805d2f791012c9da4c237ab3f7c1bf538d90588a0562f540c4d45fa91b9.exe	107
PID 3632 wrote to memory of 1564	3632	dd615805d2f791012c9da4c237ab3f7c1bf538d90588a0562f540c4d45fa91b9.exe	107
PID 3632 wrote to memory of 4612	3632	dd615805d2f791012c9da4c237ab3f7c1bf538d90588a0562f540c4d45fa91b9.exe	108
PID 3632 wrote to memory of 4612	3632	dd615805d2f791012c9da4c237ab3f7c1bf538d90588a0562f540c4d45fa91b9.exe	108
PID 3632 wrote to memory of 4204	3632	dd615805d2f791012c9da4c237ab3f7c1bf538d90588a0562f540c4d45fa91b9.exe	109
PID 3632 wrote to memory of 4204	3632	dd615805d2f791012c9da4c237ab3f7c1bf538d90588a0562f540c4d45fa91b9.exe	109
PID 3632 wrote to memory of 4904	3632	dd615805d2f791012c9da4c237ab3f7c1bf538d90588a0562f540c4d45fa91b9.exe	110
PID 3632 wrote to memory of 4904	3632	dd615805d2f791012c9da4c237ab3f7c1bf538d90588a0562f540c4d45fa91b9.exe	110
PID 3632 wrote to memory of 3640	3632	dd615805d2f791012c9da4c237ab3f7c1bf538d90588a0562f540c4d45fa91b9.exe	112
PID 3632 wrote to memory of 3640	3632	dd615805d2f791012c9da4c237ab3f7c1bf538d90588a0562f540c4d45fa91b9.exe	112
PID 3632 wrote to memory of 1812	3632	dd615805d2f791012c9da4c237ab3f7c1bf538d90588a0562f540c4d45fa91b9.exe	113
PID 3632 wrote to memory of 1812	3632	dd615805d2f791012c9da4c237ab3f7c1bf538d90588a0562f540c4d45fa91b9.exe	113
PID 3632 wrote to memory of 1648	3632	dd615805d2f791012c9da4c237ab3f7c1bf538d90588a0562f540c4d45fa91b9.exe	114
PID 3632 wrote to memory of 1648	3632	dd615805d2f791012c9da4c237ab3f7c1bf538d90588a0562f540c4d45fa91b9.exe	114
PID 3632 wrote to memory of 4360	3632	dd615805d2f791012c9da4c237ab3f7c1bf538d90588a0562f540c4d45fa91b9.exe	115
PID 3632 wrote to memory of 4360	3632	dd615805d2f791012c9da4c237ab3f7c1bf538d90588a0562f540c4d45fa91b9.exe	115
PID 3632 wrote to memory of 3832	3632	dd615805d2f791012c9da4c237ab3f7c1bf538d90588a0562f540c4d45fa91b9.exe	116
PID 3632 wrote to memory of 3832	3632	dd615805d2f791012c9da4c237ab3f7c1bf538d90588a0562f540c4d45fa91b9.exe	116
PID 3632 wrote to memory of 208	3632	dd615805d2f791012c9da4c237ab3f7c1bf538d90588a0562f540c4d45fa91b9.exe	117
PID 3632 wrote to memory of 208	3632	dd615805d2f791012c9da4c237ab3f7c1bf538d90588a0562f540c4d45fa91b9.exe	117

C:\Users\Admin\AppData\Local\Temp\dd615805d2f791012c9da4c237ab3f7c1bf538d90588a0562f540c4d45fa91b9.exe
"C:\Users\Admin\AppData\Local\Temp\dd615805d2f791012c9da4c237ab3f7c1bf538d90588a0562f540c4d45fa91b9.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3632
- C:\Windows\System\gtWJIeN.exe
  C:\Windows\System\gtWJIeN.exe
  2⤵
  - Executes dropped EXE
  PID:1356
- C:\Windows\System\aFhbINA.exe
  C:\Windows\System\aFhbINA.exe
  2⤵
  - Executes dropped EXE
  PID:4472
- C:\Windows\System\pBUqqwz.exe
  C:\Windows\System\pBUqqwz.exe
  2⤵
  - Executes dropped EXE
  PID:2156
- C:\Windows\System\grjEtuv.exe
  C:\Windows\System\grjEtuv.exe
  2⤵
  - Executes dropped EXE
  PID:2780
- C:\Windows\System\uqvzTOj.exe
  C:\Windows\System\uqvzTOj.exe
  2⤵
  - Executes dropped EXE
  PID:4180
- C:\Windows\System\Mfezouf.exe
  C:\Windows\System\Mfezouf.exe
  2⤵
  - Executes dropped EXE
  PID:1368
- C:\Windows\System\EkTeOeE.exe
  C:\Windows\System\EkTeOeE.exe
  2⤵
  - Executes dropped EXE
  PID:4576
- C:\Windows\System\ICKGwLy.exe
  C:\Windows\System\ICKGwLy.exe
  2⤵
  - Executes dropped EXE
  PID:2684
- C:\Windows\System\ReDMruz.exe
  C:\Windows\System\ReDMruz.exe
  2⤵
  - Executes dropped EXE
  PID:1012
- C:\Windows\System\TaFzZaR.exe
  C:\Windows\System\TaFzZaR.exe
  2⤵
  - Executes dropped EXE
  PID:4772
- C:\Windows\System\SMeNJgM.exe
  C:\Windows\System\SMeNJgM.exe
  2⤵
  - Executes dropped EXE
  PID:112
- C:\Windows\System\MmkTHzF.exe
  C:\Windows\System\MmkTHzF.exe
  2⤵
  - Executes dropped EXE
  PID:2920
- C:\Windows\System\iwWqwjH.exe
  C:\Windows\System\iwWqwjH.exe
  2⤵
  - Executes dropped EXE
  PID:2936
- C:\Windows\System\ZyddXOx.exe
  C:\Windows\System\ZyddXOx.exe
  2⤵
  - Executes dropped EXE
  PID:844
- C:\Windows\System\iYlCfLQ.exe
  C:\Windows\System\iYlCfLQ.exe
  2⤵
  - Executes dropped EXE
  PID:3484
- C:\Windows\System\sQdjTkw.exe
  C:\Windows\System\sQdjTkw.exe
  2⤵
  - Executes dropped EXE
  PID:4692
- C:\Windows\System\nfCIzuE.exe
  C:\Windows\System\nfCIzuE.exe
  2⤵
  - Executes dropped EXE
  PID:1268
- C:\Windows\System\OXphaLb.exe
  C:\Windows\System\OXphaLb.exe
  2⤵
  - Executes dropped EXE
  PID:1424
- C:\Windows\System\qtvyGFV.exe
  C:\Windows\System\qtvyGFV.exe
  2⤵
  - Executes dropped EXE
  PID:952
- C:\Windows\System\jNNlYZD.exe
  C:\Windows\System\jNNlYZD.exe
  2⤵
  - Executes dropped EXE
  PID:2348
- C:\Windows\System\nRYiHOu.exe
  C:\Windows\System\nRYiHOu.exe
  2⤵
  - Executes dropped EXE
  PID:4244
- C:\Windows\System\lUlMgCi.exe
  C:\Windows\System\lUlMgCi.exe
  2⤵
  - Executes dropped EXE
  PID:408
- C:\Windows\System\MaDIwwP.exe
  C:\Windows\System\MaDIwwP.exe
  2⤵
  - Executes dropped EXE
  PID:1564
- C:\Windows\System\aOOMutR.exe
  C:\Windows\System\aOOMutR.exe
  2⤵
  - Executes dropped EXE
  PID:4612
- C:\Windows\System\gwUcXtv.exe
  C:\Windows\System\gwUcXtv.exe
  2⤵
  - Executes dropped EXE
  PID:4204
- C:\Windows\System\oYqkuSG.exe
  C:\Windows\System\oYqkuSG.exe
  2⤵
  - Executes dropped EXE
  PID:4904
- C:\Windows\System\uphhzOi.exe
  C:\Windows\System\uphhzOi.exe
  2⤵
  - Executes dropped EXE
  PID:3640
- C:\Windows\System\YwjBcJx.exe
  C:\Windows\System\YwjBcJx.exe
  2⤵
  - Executes dropped EXE
  PID:1812
- C:\Windows\System\czNDdIE.exe
  C:\Windows\System\czNDdIE.exe
  2⤵
  - Executes dropped EXE
  PID:1648
- C:\Windows\System\muBUgwv.exe
  C:\Windows\System\muBUgwv.exe
  2⤵
  - Executes dropped EXE
  PID:4360
- C:\Windows\System\AFdKjub.exe
  C:\Windows\System\AFdKjub.exe
  2⤵
  - Executes dropped EXE
  PID:3832
- C:\Windows\System\FMlmcfW.exe
  C:\Windows\System\FMlmcfW.exe
  2⤵
  - Executes dropped EXE
  PID:208
- C:\Windows\System\rLPYyos.exe
  C:\Windows\System\rLPYyos.exe
  2⤵
  - Executes dropped EXE
  PID:2184
- C:\Windows\System\mTquqzR.exe
  C:\Windows\System\mTquqzR.exe
  2⤵
  - Executes dropped EXE
  PID:3652
- C:\Windows\System\qhOiqCi.exe
  C:\Windows\System\qhOiqCi.exe
  2⤵
  - Executes dropped EXE
  PID:2188
- C:\Windows\System\CdwSSjL.exe
  C:\Windows\System\CdwSSjL.exe
  2⤵
  - Executes dropped EXE
  PID:1744
- C:\Windows\System\xvmwJTD.exe
  C:\Windows\System\xvmwJTD.exe
  2⤵
  - Executes dropped EXE
  PID:404
- C:\Windows\System\EbrVbDK.exe
  C:\Windows\System\EbrVbDK.exe
  2⤵
  - Executes dropped EXE
  PID:4640
- C:\Windows\System\ekTOHcS.exe
  C:\Windows\System\ekTOHcS.exe
  2⤵
  - Executes dropped EXE
  PID:3600
- C:\Windows\System\DYiSRvp.exe
  C:\Windows\System\DYiSRvp.exe
  2⤵
  - Executes dropped EXE
  PID:4280
- C:\Windows\System\aixJQvP.exe
  C:\Windows\System\aixJQvP.exe
  2⤵
  - Executes dropped EXE
  PID:4968
- C:\Windows\System\PLsNxBX.exe
  C:\Windows\System\PLsNxBX.exe
  2⤵
  - Executes dropped EXE
  PID:1548
- C:\Windows\System\JGOxqeg.exe
  C:\Windows\System\JGOxqeg.exe
  2⤵
  - Executes dropped EXE
  PID:4636
- C:\Windows\System\HpkTghe.exe
  C:\Windows\System\HpkTghe.exe
  2⤵
  - Executes dropped EXE
  PID:3008
- C:\Windows\System\vcuhTJh.exe
  C:\Windows\System\vcuhTJh.exe
  2⤵
  - Executes dropped EXE
  PID:4356
- C:\Windows\System\lKrbDkT.exe
  C:\Windows\System\lKrbDkT.exe
  2⤵
  - Executes dropped EXE
  PID:4224
- C:\Windows\System\oXnKhBp.exe
  C:\Windows\System\oXnKhBp.exe
  2⤵
  - Executes dropped EXE
  PID:2844
- C:\Windows\System\qkIQRMe.exe
  C:\Windows\System\qkIQRMe.exe
  2⤵
  - Executes dropped EXE
  PID:3820
- C:\Windows\System\BOgaGzj.exe
  C:\Windows\System\BOgaGzj.exe
  2⤵
  - Executes dropped EXE
  PID:3208
- C:\Windows\System\tsPnEeI.exe
  C:\Windows\System\tsPnEeI.exe
  2⤵
  - Executes dropped EXE
  PID:4276
- C:\Windows\System\yNfSksy.exe
  C:\Windows\System\yNfSksy.exe
  2⤵
  - Executes dropped EXE
  PID:2128
- C:\Windows\System\qRnPvpR.exe
  C:\Windows\System\qRnPvpR.exe
  2⤵
  - Executes dropped EXE
  PID:4608
- C:\Windows\System\ZQlRDqA.exe
  C:\Windows\System\ZQlRDqA.exe
  2⤵
  - Executes dropped EXE
  PID:1428
- C:\Windows\System\YRGFISG.exe
  C:\Windows\System\YRGFISG.exe
  2⤵
  - Executes dropped EXE
  PID:2700
- C:\Windows\System\kbbUBAs.exe
  C:\Windows\System\kbbUBAs.exe
  2⤵
  - Executes dropped EXE
  PID:1148
- C:\Windows\System\EvevLhE.exe
  C:\Windows\System\EvevLhE.exe
  2⤵
  - Executes dropped EXE
  PID:908
- C:\Windows\System\BIJzCvk.exe
  C:\Windows\System\BIJzCvk.exe
  2⤵
  - Executes dropped EXE
  PID:3936
- C:\Windows\System\uNdTyoC.exe
  C:\Windows\System\uNdTyoC.exe
  2⤵
  - Executes dropped EXE
  PID:4708
- C:\Windows\System\jDqjJbL.exe
  C:\Windows\System\jDqjJbL.exe
  2⤵
  - Executes dropped EXE
  PID:4900
- C:\Windows\System\aOsjwMT.exe
  C:\Windows\System\aOsjwMT.exe
  2⤵
  - Executes dropped EXE
  PID:3524
- C:\Windows\System\eOCwrij.exe
  C:\Windows\System\eOCwrij.exe
  2⤵
  - Executes dropped EXE
  PID:2992
- C:\Windows\System\MRWeMFI.exe
  C:\Windows\System\MRWeMFI.exe
  2⤵
  - Executes dropped EXE
  PID:1592
- C:\Windows\System\JNPtPmp.exe
  C:\Windows\System\JNPtPmp.exe
  2⤵
  - Executes dropped EXE
  PID:2300
- C:\Windows\System\muRlbDG.exe
  C:\Windows\System\muRlbDG.exe
  2⤵
  - Executes dropped EXE
  PID:4876
- C:\Windows\System\yJWfAYM.exe
  C:\Windows\System\yJWfAYM.exe
  2⤵
  PID:3432
- C:\Windows\System\gMprpHz.exe
  C:\Windows\System\gMprpHz.exe
  2⤵
  PID:4128
- C:\Windows\System\oMqRYOz.exe
  C:\Windows\System\oMqRYOz.exe
  2⤵
  PID:1928
- C:\Windows\System\ZCuPfqN.exe
  C:\Windows\System\ZCuPfqN.exe
  2⤵
  PID:1528
- C:\Windows\System\IZNRkON.exe
  C:\Windows\System\IZNRkON.exe
  2⤵
  PID:1680
- C:\Windows\System\YqOmCSK.exe
  C:\Windows\System\YqOmCSK.exe
  2⤵
  PID:3452
- C:\Windows\System\uugFvvV.exe
  C:\Windows\System\uugFvvV.exe
  2⤵
  PID:5000
- C:\Windows\System\OfWeJaU.exe
  C:\Windows\System\OfWeJaU.exe
  2⤵
  PID:3768
- C:\Windows\System\wPUvKKn.exe
  C:\Windows\System\wPUvKKn.exe
  2⤵
  PID:4488
- C:\Windows\System\IHhHTKt.exe
  C:\Windows\System\IHhHTKt.exe
  2⤵
  PID:1616
- C:\Windows\System\DsGamQa.exe
  C:\Windows\System\DsGamQa.exe
  2⤵
  PID:2444
- C:\Windows\System\QVcFZnk.exe
  C:\Windows\System\QVcFZnk.exe
  2⤵
  PID:1308
- C:\Windows\System\UfManYq.exe
  C:\Windows\System\UfManYq.exe
  2⤵
  PID:4516
- C:\Windows\System\isUPruj.exe
  C:\Windows\System\isUPruj.exe
  2⤵
  PID:4716
- C:\Windows\System\UcpziXb.exe
  C:\Windows\System\UcpziXb.exe
  2⤵
  PID:3064
- C:\Windows\System\RLdQxyG.exe
  C:\Windows\System\RLdQxyG.exe
  2⤵
  PID:932
- C:\Windows\System\ektrUMK.exe
  C:\Windows\System\ektrUMK.exe
  2⤵
  PID:4768
- C:\Windows\System\KigNRPS.exe
  C:\Windows\System\KigNRPS.exe
  2⤵
  PID:4632
- C:\Windows\System\JVmSMSf.exe
  C:\Windows\System\JVmSMSf.exe
  2⤵
  PID:2672
- C:\Windows\System\IHZbVyS.exe
  C:\Windows\System\IHZbVyS.exe
  2⤵
  PID:664
- C:\Windows\System\NiQDgjG.exe
  C:\Windows\System\NiQDgjG.exe
  2⤵
  PID:2736
- C:\Windows\System\GcvbfVJ.exe
  C:\Windows\System\GcvbfVJ.exe
  2⤵
  PID:4884
- C:\Windows\System\ptENosM.exe
  C:\Windows\System\ptENosM.exe
  2⤵
  PID:3500
- C:\Windows\System\OKdUZOW.exe
  C:\Windows\System\OKdUZOW.exe
  2⤵
  PID:2796
- C:\Windows\System\xyYksNW.exe
  C:\Windows\System\xyYksNW.exe
  2⤵
  PID:1992
- C:\Windows\System\QgWMLZj.exe
  C:\Windows\System\QgWMLZj.exe
  2⤵
  PID:1352
- C:\Windows\System\xQpXEZI.exe
  C:\Windows\System\xQpXEZI.exe
  2⤵
  PID:2916
- C:\Windows\System\OBvWRGg.exe
  C:\Windows\System\OBvWRGg.exe
  2⤵
  PID:4988
- C:\Windows\System\UZjihHW.exe
  C:\Windows\System\UZjihHW.exe
  2⤵
  PID:1508
- C:\Windows\System\NmIAXoK.exe
  C:\Windows\System\NmIAXoK.exe
  2⤵
  PID:4088
- C:\Windows\System\LtXEMdS.exe
  C:\Windows\System\LtXEMdS.exe
  2⤵
  PID:4440
- C:\Windows\System\bVmGyvn.exe
  C:\Windows\System\bVmGyvn.exe
  2⤵
  PID:4544
- C:\Windows\System\sbzOeuL.exe
  C:\Windows\System\sbzOeuL.exe
  2⤵
  PID:2284
- C:\Windows\System\lSaCpmR.exe
  C:\Windows\System\lSaCpmR.exe
  2⤵
  PID:4888
- C:\Windows\System\qQEKzVv.exe
  C:\Windows\System\qQEKzVv.exe
  2⤵
  PID:4780
- C:\Windows\System\snxwwjV.exe
  C:\Windows\System\snxwwjV.exe
  2⤵
  PID:4436
- C:\Windows\System\KIKsKWY.exe
  C:\Windows\System\KIKsKWY.exe
  2⤵
  PID:4740
- C:\Windows\System\ZpfrZqN.exe
  C:\Windows\System\ZpfrZqN.exe
  2⤵
  PID:224
- C:\Windows\System\OiSbgWp.exe
  C:\Windows\System\OiSbgWp.exe
  2⤵
  PID:4288
- C:\Windows\System\rlmTDvE.exe
  C:\Windows\System\rlmTDvE.exe
  2⤵
  PID:2108
- C:\Windows\System\jsKNCsV.exe
  C:\Windows\System\jsKNCsV.exe
  2⤵
  PID:648
- C:\Windows\System\zOyUUJC.exe
  C:\Windows\System\zOyUUJC.exe
  2⤵
  PID:3988
- C:\Windows\System\gnntfhV.exe
  C:\Windows\System\gnntfhV.exe
  2⤵
  PID:5132
- C:\Windows\System\VNZvaXA.exe
  C:\Windows\System\VNZvaXA.exe
  2⤵
  PID:5168
- C:\Windows\System\aXxyILl.exe
  C:\Windows\System\aXxyILl.exe
  2⤵
  PID:5212
- C:\Windows\System\IGfzmCD.exe
  C:\Windows\System\IGfzmCD.exe
  2⤵
  PID:5268
- C:\Windows\System\iSWXtFl.exe
  C:\Windows\System\iSWXtFl.exe
  2⤵
  PID:5284
- C:\Windows\System\qaNEPmq.exe
  C:\Windows\System\qaNEPmq.exe
  2⤵
  PID:5312
- C:\Windows\System\cvCVNJl.exe
  C:\Windows\System\cvCVNJl.exe
  2⤵
  PID:5328
- C:\Windows\System\tLhnhek.exe
  C:\Windows\System\tLhnhek.exe
  2⤵
  PID:5352
- C:\Windows\System\iRhbMzo.exe
  C:\Windows\System\iRhbMzo.exe
  2⤵
  PID:5384
- C:\Windows\System\bmGkeyv.exe
  C:\Windows\System\bmGkeyv.exe
  2⤵
  PID:5420
- C:\Windows\System\vrzwcqs.exe
  C:\Windows\System\vrzwcqs.exe
  2⤵
  PID:5440
- C:\Windows\System\ykgEBwP.exe
  C:\Windows\System\ykgEBwP.exe
  2⤵
  PID:5460
- C:\Windows\System\rzxqhfb.exe
  C:\Windows\System\rzxqhfb.exe
  2⤵
  PID:5476
- C:\Windows\System\VrxrYmm.exe
  C:\Windows\System\VrxrYmm.exe
  2⤵
  PID:5508
- C:\Windows\System\IXqNbMa.exe
  C:\Windows\System\IXqNbMa.exe
  2⤵
  PID:5524
- C:\Windows\System\JEjqkCR.exe
  C:\Windows\System\JEjqkCR.exe
  2⤵
  PID:5544
- C:\Windows\System\VhrTKBN.exe
  C:\Windows\System\VhrTKBN.exe
  2⤵
  PID:5580
- C:\Windows\System\PsARofE.exe
  C:\Windows\System\PsARofE.exe
  2⤵
  PID:5604
- C:\Windows\System\vwnAiSe.exe
  C:\Windows\System\vwnAiSe.exe
  2⤵
  PID:5652
- C:\Windows\System\pZGklXY.exe
  C:\Windows\System\pZGklXY.exe
  2⤵
  PID:5680
- C:\Windows\System\okcGdJQ.exe
  C:\Windows\System\okcGdJQ.exe
  2⤵
  PID:5708
- C:\Windows\System\LuEHWFt.exe
  C:\Windows\System\LuEHWFt.exe
  2⤵
  PID:5740
- C:\Windows\System\vAVNWnY.exe
  C:\Windows\System\vAVNWnY.exe
  2⤵
  PID:5768
- C:\Windows\System\szwEuLR.exe
  C:\Windows\System\szwEuLR.exe
  2⤵
  PID:5800
- C:\Windows\System\mLMpnmN.exe
  C:\Windows\System\mLMpnmN.exe
  2⤵
  PID:5820
- C:\Windows\System\bQSFbqr.exe
  C:\Windows\System\bQSFbqr.exe
  2⤵
  PID:5848
- C:\Windows\System\YETpIpl.exe
  C:\Windows\System\YETpIpl.exe
  2⤵
  PID:5872
- C:\Windows\System\ZjskChl.exe
  C:\Windows\System\ZjskChl.exe
  2⤵
  PID:5896
- C:\Windows\System\ZRckrfK.exe
  C:\Windows\System\ZRckrfK.exe
  2⤵
  PID:5916
- C:\Windows\System\rjNcWuQ.exe
  C:\Windows\System\rjNcWuQ.exe
  2⤵
  PID:5940
- C:\Windows\System\PFGgIie.exe
  C:\Windows\System\PFGgIie.exe
  2⤵
  PID:5968
- C:\Windows\System\MTdUGVD.exe
  C:\Windows\System\MTdUGVD.exe
  2⤵
  PID:6000
- C:\Windows\System\yMpJkSF.exe
  C:\Windows\System\yMpJkSF.exe
  2⤵
  PID:6032
- C:\Windows\System\xbSHekk.exe
  C:\Windows\System\xbSHekk.exe
  2⤵
  PID:6052
- C:\Windows\System\xdnHGre.exe
  C:\Windows\System\xdnHGre.exe
  2⤵
  PID:6088
- C:\Windows\System\vMhUeBh.exe
  C:\Windows\System\vMhUeBh.exe
  2⤵
  PID:6120
- C:\Windows\System\eVSkLzK.exe
  C:\Windows\System\eVSkLzK.exe
  2⤵
  PID:3912
- C:\Windows\System\RPYiXna.exe
  C:\Windows\System\RPYiXna.exe
  2⤵
  PID:5164
- C:\Windows\System\FfCFIdc.exe
  C:\Windows\System\FfCFIdc.exe
  2⤵
  PID:5256
- C:\Windows\System\HUmykAq.exe
  C:\Windows\System\HUmykAq.exe
  2⤵
  PID:5292
- C:\Windows\System\WFUfLqG.exe
  C:\Windows\System\WFUfLqG.exe
  2⤵
  PID:5344
- C:\Windows\System\ZnCXRrJ.exe
  C:\Windows\System\ZnCXRrJ.exe
  2⤵
  PID:5428
- C:\Windows\System\LfswiaV.exe
  C:\Windows\System\LfswiaV.exe
  2⤵
  PID:5520
- C:\Windows\System\IiYipvC.exe
  C:\Windows\System\IiYipvC.exe
  2⤵
  PID:5540
- C:\Windows\System\SCLVfBR.exe
  C:\Windows\System\SCLVfBR.exe
  2⤵
  PID:5568
- C:\Windows\System\UlztkwJ.exe
  C:\Windows\System\UlztkwJ.exe
  2⤵
  PID:5668
- C:\Windows\System\uHBQxxi.exe
  C:\Windows\System\uHBQxxi.exe
  2⤵
  PID:5704
- C:\Windows\System\yJxFNix.exe
  C:\Windows\System\yJxFNix.exe
  2⤵
  PID:5784
- C:\Windows\System\nYICheM.exe
  C:\Windows\System\nYICheM.exe
  2⤵
  PID:5880
- C:\Windows\System\ZIUpFbT.exe
  C:\Windows\System\ZIUpFbT.exe
  2⤵
  PID:5932
- C:\Windows\System\CGEaasS.exe
  C:\Windows\System\CGEaasS.exe
  2⤵
  PID:6016
- C:\Windows\System\kMQeAHv.exe
  C:\Windows\System\kMQeAHv.exe
  2⤵
  PID:6012
- C:\Windows\System\mTLdLLz.exe
  C:\Windows\System\mTLdLLz.exe
  2⤵
  PID:6040
- C:\Windows\System\rrHGCMw.exe
  C:\Windows\System\rrHGCMw.exe
  2⤵
  PID:4416
- C:\Windows\System\jFULSdW.exe
  C:\Windows\System\jFULSdW.exe
  2⤵
  PID:5204
- C:\Windows\System\zGhkEXP.exe
  C:\Windows\System\zGhkEXP.exe
  2⤵
  PID:5340
- C:\Windows\System\GbZmoXN.exe
  C:\Windows\System\GbZmoXN.exe
  2⤵
  PID:5516
- C:\Windows\System\KglSFbq.exe
  C:\Windows\System\KglSFbq.exe
  2⤵
  PID:5556
- C:\Windows\System\ulNWrLj.exe
  C:\Windows\System\ulNWrLj.exe
  2⤵
  PID:5856
- C:\Windows\System\SBjhfiL.exe
  C:\Windows\System\SBjhfiL.exe
  2⤵
  PID:5996
- C:\Windows\System\HLeTXRn.exe
  C:\Windows\System\HLeTXRn.exe
  2⤵
  PID:5960
- C:\Windows\System\hOVZPgM.exe
  C:\Windows\System\hOVZPgM.exe
  2⤵
  PID:6108
- C:\Windows\System\xYRozmm.exe
  C:\Windows\System\xYRozmm.exe
  2⤵
  PID:6152
- C:\Windows\System\yAHvjWK.exe
  C:\Windows\System\yAHvjWK.exe
  2⤵
  PID:6180
- C:\Windows\System\bdcquHX.exe
  C:\Windows\System\bdcquHX.exe
  2⤵
  PID:6204
- C:\Windows\System\QbYeGKd.exe
  C:\Windows\System\QbYeGKd.exe
  2⤵
  PID:6236
- C:\Windows\System\YOfnxDy.exe
  C:\Windows\System\YOfnxDy.exe
  2⤵
  PID:6264
- C:\Windows\System\TvFJswn.exe
  C:\Windows\System\TvFJswn.exe
  2⤵
  PID:6296
- C:\Windows\System\MeeSQhr.exe
  C:\Windows\System\MeeSQhr.exe
  2⤵
  PID:6316
- C:\Windows\System\KPOBemV.exe
  C:\Windows\System\KPOBemV.exe
  2⤵
  PID:6344
- C:\Windows\System\QxxDaOr.exe
  C:\Windows\System\QxxDaOr.exe
  2⤵
  PID:6384
- C:\Windows\System\gpHdDNh.exe
  C:\Windows\System\gpHdDNh.exe
  2⤵
  PID:6420
- C:\Windows\System\lZkUFsc.exe
  C:\Windows\System\lZkUFsc.exe
  2⤵
  PID:6448
- C:\Windows\System\EKRoKLO.exe
  C:\Windows\System\EKRoKLO.exe
  2⤵
  PID:6472
- C:\Windows\System\MiEkOjN.exe
  C:\Windows\System\MiEkOjN.exe
  2⤵
  PID:6496
- C:\Windows\System\MZHOcfJ.exe
  C:\Windows\System\MZHOcfJ.exe
  2⤵
  PID:6520
- C:\Windows\System\GygQTet.exe
  C:\Windows\System\GygQTet.exe
  2⤵
  PID:6552
- C:\Windows\System\pSnxtuW.exe
  C:\Windows\System\pSnxtuW.exe
  2⤵
  PID:6584
- C:\Windows\System\AxxCKib.exe
  C:\Windows\System\AxxCKib.exe
  2⤵
  PID:6616
- C:\Windows\System\zPwGmmW.exe
  C:\Windows\System\zPwGmmW.exe
  2⤵
  PID:6632
- C:\Windows\System\iHwVTUw.exe
  C:\Windows\System\iHwVTUw.exe
  2⤵
  PID:6668
- C:\Windows\System\oouibuV.exe
  C:\Windows\System\oouibuV.exe
  2⤵
  PID:6692
- C:\Windows\System\TdkpaIH.exe
  C:\Windows\System\TdkpaIH.exe
  2⤵
  PID:6720
- C:\Windows\System\mEzwOlg.exe
  C:\Windows\System\mEzwOlg.exe
  2⤵
  PID:6744
- C:\Windows\System\UdLPKYd.exe
  C:\Windows\System\UdLPKYd.exe
  2⤵
  PID:6788
- C:\Windows\System\LBrHWmG.exe
  C:\Windows\System\LBrHWmG.exe
  2⤵
  PID:6820
- C:\Windows\System\ytZZKFX.exe
  C:\Windows\System\ytZZKFX.exe
  2⤵
  PID:6844
- C:\Windows\System\STnHbFz.exe
  C:\Windows\System\STnHbFz.exe
  2⤵
  PID:6872
- C:\Windows\System\auFaOoM.exe
  C:\Windows\System\auFaOoM.exe
  2⤵
  PID:6904
- C:\Windows\System\hsFiNiU.exe
  C:\Windows\System\hsFiNiU.exe
  2⤵
  PID:6936
- C:\Windows\System\QbklyNu.exe
  C:\Windows\System\QbklyNu.exe
  2⤵
  PID:6960
- C:\Windows\System\jfgdgVD.exe
  C:\Windows\System\jfgdgVD.exe
  2⤵
  PID:6992
- C:\Windows\System\ZHNZage.exe
  C:\Windows\System\ZHNZage.exe
  2⤵
  PID:7016
- C:\Windows\System\KUwyvNF.exe
  C:\Windows\System\KUwyvNF.exe
  2⤵
  PID:7044
- C:\Windows\System\feaFAlp.exe
  C:\Windows\System\feaFAlp.exe
  2⤵
  PID:7076
- C:\Windows\System\WkoOWJy.exe
  C:\Windows\System\WkoOWJy.exe
  2⤵
  PID:7100
- C:\Windows\System\PUcZHrv.exe
  C:\Windows\System\PUcZHrv.exe
  2⤵
  PID:7132
- C:\Windows\System\CqismRL.exe
  C:\Windows\System\CqismRL.exe
  2⤵
  PID:7164
- C:\Windows\System\gMFSJoZ.exe
  C:\Windows\System\gMFSJoZ.exe
  2⤵
  PID:5860
- C:\Windows\System\xevgbhf.exe
  C:\Windows\System\xevgbhf.exe
  2⤵
  PID:5536
- C:\Windows\System\JBdnjLt.exe
  C:\Windows\System\JBdnjLt.exe
  2⤵
  PID:6172
- C:\Windows\System\ADGCWOf.exe
  C:\Windows\System\ADGCWOf.exe
  2⤵
  PID:6252
- C:\Windows\System\RgInWTK.exe
  C:\Windows\System\RgInWTK.exe
  2⤵
  PID:6248
- C:\Windows\System\AzAUwUI.exe
  C:\Windows\System\AzAUwUI.exe
  2⤵
  PID:6440
- C:\Windows\System\aNjazcv.exe
  C:\Windows\System\aNjazcv.exe
  2⤵
  PID:6468
- C:\Windows\System\KiILjIT.exe
  C:\Windows\System\KiILjIT.exe
  2⤵
  PID:5152
- C:\Windows\System\WoLTZvU.exe
  C:\Windows\System\WoLTZvU.exe
  2⤵
  PID:6492
- C:\Windows\System\KRasdyo.exe
  C:\Windows\System\KRasdyo.exe
  2⤵
  PID:6600
- C:\Windows\System\rpoocZl.exe
  C:\Windows\System\rpoocZl.exe
  2⤵
  PID:6644
- C:\Windows\System\aJJDcYB.exe
  C:\Windows\System\aJJDcYB.exe
  2⤵
  PID:6752
- C:\Windows\System\ktZiosd.exe
  C:\Windows\System\ktZiosd.exe
  2⤵
  PID:5816
- C:\Windows\System\nCIvsFs.exe
  C:\Windows\System\nCIvsFs.exe
  2⤵
  PID:6812
- C:\Windows\System\HArXXFW.exe
  C:\Windows\System\HArXXFW.exe
  2⤵
  PID:6912
- C:\Windows\System\NBbzvEO.exe
  C:\Windows\System\NBbzvEO.exe
  2⤵
  PID:7032
- C:\Windows\System\fkZYYbw.exe
  C:\Windows\System\fkZYYbw.exe
  2⤵
  PID:7092
- C:\Windows\System\UbKksTl.exe
  C:\Windows\System\UbKksTl.exe
  2⤵
  PID:7144
- C:\Windows\System\qDIVdSN.exe
  C:\Windows\System\qDIVdSN.exe
  2⤵
  PID:6276
- C:\Windows\System\zZwwubM.exe
  C:\Windows\System\zZwwubM.exe
  2⤵
  PID:5648
- C:\Windows\System\esLDMvh.exe
  C:\Windows\System\esLDMvh.exe
  2⤵
  PID:6544
- C:\Windows\System\nBUYwve.exe
  C:\Windows\System\nBUYwve.exe
  2⤵
  PID:6404
- C:\Windows\System\zWOcZCB.exe
  C:\Windows\System\zWOcZCB.exe
  2⤵
  PID:6852
- C:\Windows\System\RDmilfz.exe
  C:\Windows\System\RDmilfz.exe
  2⤵
  PID:6864
- C:\Windows\System\JqgZRSr.exe
  C:\Windows\System\JqgZRSr.exe
  2⤵
  PID:6860
- C:\Windows\System\QsSFzau.exe
  C:\Windows\System\QsSFzau.exe
  2⤵
  PID:6116
- C:\Windows\System\dmEqtIu.exe
  C:\Windows\System\dmEqtIu.exe
  2⤵
  PID:6680
- C:\Windows\System\qTMUbke.exe
  C:\Windows\System\qTMUbke.exe
  2⤵
  PID:6880
- C:\Windows\System\bJaXnkf.exe
  C:\Windows\System\bJaXnkf.exe
  2⤵
  PID:7184
- C:\Windows\System\MTcEfGw.exe
  C:\Windows\System\MTcEfGw.exe
  2⤵
  PID:7212
- C:\Windows\System\vHxdpyE.exe
  C:\Windows\System\vHxdpyE.exe
  2⤵
  PID:7240
- C:\Windows\System\IboQxpZ.exe
  C:\Windows\System\IboQxpZ.exe
  2⤵
  PID:7268
- C:\Windows\System\kUhKnqi.exe
  C:\Windows\System\kUhKnqi.exe
  2⤵
  PID:7296
- C:\Windows\System\jqUvQOq.exe
  C:\Windows\System\jqUvQOq.exe
  2⤵
  PID:7324
- C:\Windows\System\kFIyihW.exe
  C:\Windows\System\kFIyihW.exe
  2⤵
  PID:7352
- C:\Windows\System\QZWnhvY.exe
  C:\Windows\System\QZWnhvY.exe
  2⤵
  PID:7380
- C:\Windows\System\QdisFEJ.exe
  C:\Windows\System\QdisFEJ.exe
  2⤵
  PID:7404
- C:\Windows\System\uIFTpug.exe
  C:\Windows\System\uIFTpug.exe
  2⤵
  PID:7436
- C:\Windows\System\KFlnLbm.exe
  C:\Windows\System\KFlnLbm.exe
  2⤵
  PID:7460
- C:\Windows\System\SvjQKZc.exe
  C:\Windows\System\SvjQKZc.exe
  2⤵
  PID:7488
- C:\Windows\System\rJlRpnn.exe
  C:\Windows\System\rJlRpnn.exe
  2⤵
  PID:7516
- C:\Windows\System\DAwPBaC.exe
  C:\Windows\System\DAwPBaC.exe
  2⤵
  PID:7540
- C:\Windows\System\eaugDEb.exe
  C:\Windows\System\eaugDEb.exe
  2⤵
  PID:7568
- C:\Windows\System\XGxrHHz.exe
  C:\Windows\System\XGxrHHz.exe
  2⤵
  PID:7600
- C:\Windows\System\QMlqIIQ.exe
  C:\Windows\System\QMlqIIQ.exe
  2⤵
  PID:7624
- C:\Windows\System\fxZWBsQ.exe
  C:\Windows\System\fxZWBsQ.exe
  2⤵
  PID:7660
- C:\Windows\System\GhcwNOc.exe
  C:\Windows\System\GhcwNOc.exe
  2⤵
  PID:7692
- C:\Windows\System\KuqCNJW.exe
  C:\Windows\System\KuqCNJW.exe
  2⤵
  PID:7716
- C:\Windows\System\xrZjKMi.exe
  C:\Windows\System\xrZjKMi.exe
  2⤵
  PID:7748
- C:\Windows\System\QRuHVvb.exe
  C:\Windows\System\QRuHVvb.exe
  2⤵
  PID:7772
- C:\Windows\System\gRTjlHD.exe
  C:\Windows\System\gRTjlHD.exe
  2⤵
  PID:7792
- C:\Windows\System\ixxHekE.exe
  C:\Windows\System\ixxHekE.exe
  2⤵
  PID:7824
- C:\Windows\System\VoCJesx.exe
  C:\Windows\System\VoCJesx.exe
  2⤵
  PID:7848
- C:\Windows\System\jiinilg.exe
  C:\Windows\System\jiinilg.exe
  2⤵
  PID:7872
- C:\Windows\System\hFagaZZ.exe
  C:\Windows\System\hFagaZZ.exe
  2⤵
  PID:7900
- C:\Windows\System\NqQiOTp.exe
  C:\Windows\System\NqQiOTp.exe
  2⤵
  PID:7928
- C:\Windows\System\ZylGMYN.exe
  C:\Windows\System\ZylGMYN.exe
  2⤵
  PID:7956
- C:\Windows\System\VAVlWJK.exe
  C:\Windows\System\VAVlWJK.exe
  2⤵
  PID:7988
- C:\Windows\System\pzgZjBW.exe
  C:\Windows\System\pzgZjBW.exe
  2⤵
  PID:8020
- C:\Windows\System\oRHylqI.exe
  C:\Windows\System\oRHylqI.exe
  2⤵
  PID:8048
- C:\Windows\System\QJQJrxM.exe
  C:\Windows\System\QJQJrxM.exe
  2⤵
  PID:8076
- C:\Windows\System\ftrdqgT.exe
  C:\Windows\System\ftrdqgT.exe
  2⤵
  PID:8100
- C:\Windows\System\HULeili.exe
  C:\Windows\System\HULeili.exe
  2⤵
  PID:8128
- C:\Windows\System\IzbPMiR.exe
  C:\Windows\System\IzbPMiR.exe
  2⤵
  PID:8156
- C:\Windows\System\GjLpKIZ.exe
  C:\Windows\System\GjLpKIZ.exe
  2⤵
  PID:8176
- C:\Windows\System\jPXDzRk.exe
  C:\Windows\System\jPXDzRk.exe
  2⤵
  PID:6528
- C:\Windows\System\AHmWSTP.exe
  C:\Windows\System\AHmWSTP.exe
  2⤵
  PID:6412
- C:\Windows\System\dqBTqDm.exe
  C:\Windows\System\dqBTqDm.exe
  2⤵
  PID:7116
- C:\Windows\System\VQgDTdE.exe
  C:\Windows\System\VQgDTdE.exe
  2⤵
  PID:7336
- C:\Windows\System\mlCTpSU.exe
  C:\Windows\System\mlCTpSU.exe
  2⤵
  PID:7392
- C:\Windows\System\thINfEp.exe
  C:\Windows\System\thINfEp.exe
  2⤵
  PID:7360
- C:\Windows\System\tOgiMhV.exe
  C:\Windows\System\tOgiMhV.exe
  2⤵
  PID:7472
- C:\Windows\System\BhKDAmO.exe
  C:\Windows\System\BhKDAmO.exe
  2⤵
  PID:7476
- C:\Windows\System\xnJxcJg.exe
  C:\Windows\System\xnJxcJg.exe
  2⤵
  PID:7636
- C:\Windows\System\OjKeAyN.exe
  C:\Windows\System\OjKeAyN.exe
  2⤵
  PID:7556
- C:\Windows\System\ltiGESw.exe
  C:\Windows\System\ltiGESw.exe
  2⤵
  PID:7644
- C:\Windows\System\vGWElUL.exe
  C:\Windows\System\vGWElUL.exe
  2⤵
  PID:7768
- C:\Windows\System\OmTHbnW.exe
  C:\Windows\System\OmTHbnW.exe
  2⤵
  PID:7812
- C:\Windows\System\aIxoOuS.exe
  C:\Windows\System\aIxoOuS.exe
  2⤵
  PID:7920
- C:\Windows\System\JvMlkNN.exe
  C:\Windows\System\JvMlkNN.exe
  2⤵
  PID:7836
- C:\Windows\System\aaRzDEU.exe
  C:\Windows\System\aaRzDEU.exe
  2⤵
  PID:8032
- C:\Windows\System\sRCJmgC.exe
  C:\Windows\System\sRCJmgC.exe
  2⤵
  PID:8088
- C:\Windows\System\PynslpW.exe
  C:\Windows\System\PynslpW.exe
  2⤵
  PID:8064
- C:\Windows\System\BKUzbdR.exe
  C:\Windows\System\BKUzbdR.exe
  2⤵
  PID:8060
- C:\Windows\System\hajPceL.exe
  C:\Windows\System\hajPceL.exe
  2⤵
  PID:7308
- C:\Windows\System\ZResNYT.exe
  C:\Windows\System\ZResNYT.exe
  2⤵
  PID:8164
- C:\Windows\System\MyPCYIr.exe
  C:\Windows\System\MyPCYIr.exe
  2⤵
  PID:6256
- C:\Windows\System\ggcaQcs.exe
  C:\Windows\System\ggcaQcs.exe
  2⤵
  PID:7256
- C:\Windows\System\WzrJzQV.exe
  C:\Windows\System\WzrJzQV.exe
  2⤵
  PID:7612
- C:\Windows\System\OASRBqH.exe
  C:\Windows\System\OASRBqH.exe
  2⤵
  PID:7856
- C:\Windows\System\wHcYhLD.exe
  C:\Windows\System\wHcYhLD.exe
  2⤵
  PID:7708
- C:\Windows\System\KguULWK.exe
  C:\Windows\System\KguULWK.exe
  2⤵
  PID:8208
- C:\Windows\System\OGwwdaU.exe
  C:\Windows\System\OGwwdaU.exe
  2⤵
  PID:8240
- C:\Windows\System\IGNJfks.exe
  C:\Windows\System\IGNJfks.exe
  2⤵
  PID:8264
- C:\Windows\System\ndRNsoR.exe
  C:\Windows\System\ndRNsoR.exe
  2⤵
  PID:8288
- C:\Windows\System\kmyZewS.exe
  C:\Windows\System\kmyZewS.exe
  2⤵
  PID:8308
- C:\Windows\System\cfqCaCy.exe
  C:\Windows\System\cfqCaCy.exe
  2⤵
  PID:8328
- C:\Windows\System\QANkPEZ.exe
  C:\Windows\System\QANkPEZ.exe
  2⤵
  PID:8368
- C:\Windows\System\TKjsiFM.exe
  C:\Windows\System\TKjsiFM.exe
  2⤵
  PID:8400
- C:\Windows\System\UbOqBTC.exe
  C:\Windows\System\UbOqBTC.exe
  2⤵
  PID:8432
- C:\Windows\System\sklgQNq.exe
  C:\Windows\System\sklgQNq.exe
  2⤵
  PID:8456
- C:\Windows\System\erWbIdB.exe
  C:\Windows\System\erWbIdB.exe
  2⤵
  PID:8476
- C:\Windows\System\zCvLiAN.exe
  C:\Windows\System\zCvLiAN.exe
  2⤵
  PID:8504
- C:\Windows\System\ZfWKkuN.exe
  C:\Windows\System\ZfWKkuN.exe
  2⤵
  PID:8528
- C:\Windows\System\hgmAxtc.exe
  C:\Windows\System\hgmAxtc.exe
  2⤵
  PID:8548
- C:\Windows\System\qxCwFlL.exe
  C:\Windows\System\qxCwFlL.exe
  2⤵
  PID:8580
- C:\Windows\System\LUIsiHd.exe
  C:\Windows\System\LUIsiHd.exe
  2⤵
  PID:8604
- C:\Windows\System\IGSbuLG.exe
  C:\Windows\System\IGSbuLG.exe
  2⤵
  PID:8628
- C:\Windows\System\lKDVNqo.exe
  C:\Windows\System\lKDVNqo.exe
  2⤵
  PID:8652
- C:\Windows\System\aoCwltI.exe
  C:\Windows\System\aoCwltI.exe
  2⤵
  PID:8680
- C:\Windows\System\YjVYsnu.exe
  C:\Windows\System\YjVYsnu.exe
  2⤵
  PID:8712
- C:\Windows\System\dGABRIW.exe
  C:\Windows\System\dGABRIW.exe
  2⤵
  PID:8736
- C:\Windows\System\eBWiHGu.exe
  C:\Windows\System\eBWiHGu.exe
  2⤵
  PID:8768
- C:\Windows\System\LEuCzlu.exe
  C:\Windows\System\LEuCzlu.exe
  2⤵
  PID:8792
- C:\Windows\System\BSVunSU.exe
  C:\Windows\System\BSVunSU.exe
  2⤵
  PID:8808
- C:\Windows\System\zlrELpw.exe
  C:\Windows\System\zlrELpw.exe
  2⤵
  PID:8836
- C:\Windows\System\RxJkELP.exe
  C:\Windows\System\RxJkELP.exe
  2⤵
  PID:8864
- C:\Windows\System\riQTJoK.exe
  C:\Windows\System\riQTJoK.exe
  2⤵
  PID:8892
- C:\Windows\System\LUCLffY.exe
  C:\Windows\System\LUCLffY.exe
  2⤵
  PID:8916
- C:\Windows\System\AOqpqzd.exe
  C:\Windows\System\AOqpqzd.exe
  2⤵
  PID:8936
- C:\Windows\System\WuaxKce.exe
  C:\Windows\System\WuaxKce.exe
  2⤵
  PID:8960
- C:\Windows\System\XwcYNJb.exe
  C:\Windows\System\XwcYNJb.exe
  2⤵
  PID:8984
- C:\Windows\System\CVYpjae.exe
  C:\Windows\System\CVYpjae.exe
  2⤵
  PID:9012
- C:\Windows\System\tOlbsxw.exe
  C:\Windows\System\tOlbsxw.exe
  2⤵
  PID:9040
- C:\Windows\System\RGrMlZW.exe
  C:\Windows\System\RGrMlZW.exe
  2⤵
  PID:9068
- C:\Windows\System\WGZNrdB.exe
  C:\Windows\System\WGZNrdB.exe
  2⤵
  PID:9096
- C:\Windows\System\WIdQuCC.exe
  C:\Windows\System\WIdQuCC.exe
  2⤵
  PID:9120
- C:\Windows\System\HjOmJvz.exe
  C:\Windows\System\HjOmJvz.exe
  2⤵
  PID:9148
- C:\Windows\System\aiQqDpa.exe
  C:\Windows\System\aiQqDpa.exe
  2⤵
  PID:9176
- C:\Windows\System\adBVRGd.exe
  C:\Windows\System\adBVRGd.exe
  2⤵
  PID:9204
- C:\Windows\System\snALYfd.exe
  C:\Windows\System\snALYfd.exe
  2⤵
  PID:7084
- C:\Windows\System\xGXgmKS.exe
  C:\Windows\System\xGXgmKS.exe
  2⤵
  PID:5936
- C:\Windows\System\yyGjfyB.exe
  C:\Windows\System\yyGjfyB.exe
  2⤵
  PID:7484
- C:\Windows\System\wcbzWiV.exe
  C:\Windows\System\wcbzWiV.exe
  2⤵
  PID:8284
- C:\Windows\System\bCSWkyV.exe
  C:\Windows\System\bCSWkyV.exe
  2⤵
  PID:7196
- C:\Windows\System\EBWQvnu.exe
  C:\Windows\System\EBWQvnu.exe
  2⤵
  PID:8232
- C:\Windows\System\WaBgEPB.exe
  C:\Windows\System\WaBgEPB.exe
  2⤵
  PID:8420
- C:\Windows\System\ZQKVGUh.exe
  C:\Windows\System\ZQKVGUh.exe
  2⤵
  PID:8488
- C:\Windows\System\tDivPzo.exe
  C:\Windows\System\tDivPzo.exe
  2⤵
  PID:8564
- C:\Windows\System\AxzOxnn.exe
  C:\Windows\System\AxzOxnn.exe
  2⤵
  PID:8340
- C:\Windows\System\issNhQO.exe
  C:\Windows\System\issNhQO.exe
  2⤵
  PID:8448
- C:\Windows\System\NsJzjel.exe
  C:\Windows\System\NsJzjel.exe
  2⤵
  PID:8592
- C:\Windows\System\LgfqlFT.exe
  C:\Windows\System\LgfqlFT.exe
  2⤵
  PID:8784
- C:\Windows\System\KNaSHGP.exe
  C:\Windows\System\KNaSHGP.exe
  2⤵
  PID:8664
- C:\Windows\System\oAWCazl.exe
  C:\Windows\System\oAWCazl.exe
  2⤵
  PID:8724
- C:\Windows\System\dWTtbED.exe
  C:\Windows\System\dWTtbED.exe
  2⤵
  PID:8972
- C:\Windows\System\UOsnQhH.exe
  C:\Windows\System\UOsnQhH.exe
  2⤵
  PID:9028
- C:\Windows\System\psgHswM.exe
  C:\Windows\System\psgHswM.exe
  2⤵
  PID:9092
- C:\Windows\System\hTNJUdN.exe
  C:\Windows\System\hTNJUdN.exe
  2⤵
  PID:8948
- C:\Windows\System\OBMxycC.exe
  C:\Windows\System\OBMxycC.exe
  2⤵
  PID:9020
- C:\Windows\System\rBHGHHj.exe
  C:\Windows\System\rBHGHHj.exe
  2⤵
  PID:7800
- C:\Windows\System\pnJZJcM.exe
  C:\Windows\System\pnJZJcM.exe
  2⤵
  PID:9200
- C:\Windows\System\tZKKqUZ.exe
  C:\Windows\System\tZKKqUZ.exe
  2⤵
  PID:7760
- C:\Windows\System\dDnUeOh.exe
  C:\Windows\System\dDnUeOh.exe
  2⤵
  PID:9228
- C:\Windows\System\zOxNQSV.exe
  C:\Windows\System\zOxNQSV.exe
  2⤵
  PID:9252
- C:\Windows\System\khsuEyP.exe
  C:\Windows\System\khsuEyP.exe
  2⤵
  PID:9280
- C:\Windows\System\JwUpqsI.exe
  C:\Windows\System\JwUpqsI.exe
  2⤵
  PID:9308
- C:\Windows\System\XZdMJgp.exe
  C:\Windows\System\XZdMJgp.exe
  2⤵
  PID:9332
- C:\Windows\System\FvlFhvV.exe
  C:\Windows\System\FvlFhvV.exe
  2⤵
  PID:9360
- C:\Windows\System\tCWCWDG.exe
  C:\Windows\System\tCWCWDG.exe
  2⤵
  PID:9380
- C:\Windows\System\hrrPZlF.exe
  C:\Windows\System\hrrPZlF.exe
  2⤵
  PID:9404
- C:\Windows\System\VPXMVKA.exe
  C:\Windows\System\VPXMVKA.exe
  2⤵
  PID:9424
- C:\Windows\System\QVEZIxa.exe
  C:\Windows\System\QVEZIxa.exe
  2⤵
  PID:9448
- C:\Windows\System\nJaihJB.exe
  C:\Windows\System\nJaihJB.exe
  2⤵
  PID:9480
- C:\Windows\System\utmXMHb.exe
  C:\Windows\System\utmXMHb.exe
  2⤵
  PID:9504
- C:\Windows\System\ZhXzXKX.exe
  C:\Windows\System\ZhXzXKX.exe
  2⤵
  PID:9532
- C:\Windows\System\xeEQlrW.exe
  C:\Windows\System\xeEQlrW.exe
  2⤵
  PID:9564
- C:\Windows\System\gAWwtji.exe
  C:\Windows\System\gAWwtji.exe
  2⤵
  PID:9616
- C:\Windows\System\FbWfBuS.exe
  C:\Windows\System\FbWfBuS.exe
  2⤵
  PID:9636
- C:\Windows\System\iUOzosb.exe
  C:\Windows\System\iUOzosb.exe
  2⤵
  PID:9656
- C:\Windows\System\kRhTkin.exe
  C:\Windows\System\kRhTkin.exe
  2⤵
  PID:9680
- C:\Windows\System\gbTXVQP.exe
  C:\Windows\System\gbTXVQP.exe
  2⤵
  PID:9700
- C:\Windows\System\fxCzZYM.exe
  C:\Windows\System\fxCzZYM.exe
  2⤵
  PID:9728
- C:\Windows\System\TgurVji.exe
  C:\Windows\System\TgurVji.exe
  2⤵
  PID:9756
- C:\Windows\System\pxghUJq.exe
  C:\Windows\System\pxghUJq.exe
  2⤵
  PID:9780
- C:\Windows\System\kIbPYvW.exe
  C:\Windows\System\kIbPYvW.exe
  2⤵
  PID:9804
- C:\Windows\System\tfezUaY.exe
  C:\Windows\System\tfezUaY.exe
  2⤵
  PID:9828
- C:\Windows\System\TJUELEp.exe
  C:\Windows\System\TJUELEp.exe
  2⤵
  PID:9988
- C:\Windows\System\nuUkjNk.exe
  C:\Windows\System\nuUkjNk.exe
  2⤵
  PID:10028
- C:\Windows\System\vxhHJPp.exe
  C:\Windows\System\vxhHJPp.exe
  2⤵
  PID:10064
- C:\Windows\System\NMuWcit.exe
  C:\Windows\System\NMuWcit.exe
  2⤵
  PID:10104
- C:\Windows\System\aWitsoJ.exe
  C:\Windows\System\aWitsoJ.exe
  2⤵
  PID:10132
- C:\Windows\System\fUawsIc.exe
  C:\Windows\System\fUawsIc.exe
  2⤵
  PID:10172
- C:\Windows\System\hMtYELh.exe
  C:\Windows\System\hMtYELh.exe
  2⤵
  PID:10196
- C:\Windows\System\VVWBCzw.exe
  C:\Windows\System\VVWBCzw.exe
  2⤵
  PID:10236
- C:\Windows\System\btkPgls.exe
  C:\Windows\System\btkPgls.exe
  2⤵
  PID:8144
- C:\Windows\System\HRSHOnl.exe
  C:\Windows\System\HRSHOnl.exe
  2⤵
  PID:8392
- C:\Windows\System\RkPVIue.exe
  C:\Windows\System\RkPVIue.exe
  2⤵
  PID:9160
- C:\Windows\System\ueQqZek.exe
  C:\Windows\System\ueQqZek.exe
  2⤵
  PID:7372
- C:\Windows\System\YrPKslV.exe
  C:\Windows\System\YrPKslV.exe
  2⤵
  PID:8880
- C:\Windows\System\MMHwXVl.exe
  C:\Windows\System\MMHwXVl.exe
  2⤵
  PID:9396
- C:\Windows\System\GNegwwR.exe
  C:\Windows\System\GNegwwR.exe
  2⤵
  PID:9268
- C:\Windows\System\FFxngNS.exe
  C:\Windows\System\FFxngNS.exe
  2⤵
  PID:9344
- C:\Windows\System\SuUTuKC.exe
  C:\Windows\System\SuUTuKC.exe
  2⤵
  PID:9460
- C:\Windows\System\FNcQIvW.exe
  C:\Windows\System\FNcQIvW.exe
  2⤵
  PID:9752
- C:\Windows\System\PiwXufM.exe
  C:\Windows\System\PiwXufM.exe
  2⤵
  PID:9696
- C:\Windows\System\nhpuZsV.exe
  C:\Windows\System\nhpuZsV.exe
  2⤵
  PID:9612
- C:\Windows\System\MTvAIsE.exe
  C:\Windows\System\MTvAIsE.exe
  2⤵
  PID:9668
- C:\Windows\System\vGaHliH.exe
  C:\Windows\System\vGaHliH.exe
  2⤵
  PID:9708
- C:\Windows\System\PtOldAT.exe
  C:\Windows\System\PtOldAT.exe
  2⤵
  PID:9908
- C:\Windows\System\qULeEye.exe
  C:\Windows\System\qULeEye.exe
  2⤵
  PID:10152
- C:\Windows\System\aWdcOzx.exe
  C:\Windows\System\aWdcOzx.exe
  2⤵
  PID:9872
- C:\Windows\System\IkXQYYs.exe
  C:\Windows\System\IkXQYYs.exe
  2⤵
  PID:8380
- C:\Windows\System\NWAbzqF.exe
  C:\Windows\System\NWAbzqF.exe
  2⤵
  PID:10184
- C:\Windows\System\GJIRslr.exe
  C:\Windows\System\GJIRslr.exe
  2⤵
  PID:10208
- C:\Windows\System\phPdkgV.exe
  C:\Windows\System\phPdkgV.exe
  2⤵
  PID:9220
- C:\Windows\System\rdhSFSh.exe
  C:\Windows\System\rdhSFSh.exe
  2⤵
  PID:8760
- C:\Windows\System\TACFFHp.exe
  C:\Windows\System\TACFFHp.exe
  2⤵
  PID:9352
- C:\Windows\System\ZTqrGAn.exe
  C:\Windows\System\ZTqrGAn.exe
  2⤵
  PID:9324
- C:\Windows\System\nwxdTMn.exe
  C:\Windows\System\nwxdTMn.exe
  2⤵
  PID:9400
- C:\Windows\System\ahWwKgT.exe
  C:\Windows\System\ahWwKgT.exe
  2⤵
  PID:4556
- C:\Windows\System\sqTkaOU.exe
  C:\Windows\System\sqTkaOU.exe
  2⤵
  PID:10016
- C:\Windows\System\WxpLZQv.exe
  C:\Windows\System\WxpLZQv.exe
  2⤵
  PID:10000
- C:\Windows\System\WVmUcVX.exe
  C:\Windows\System\WVmUcVX.exe
  2⤵
  PID:10192
- C:\Windows\System\ERjPKtI.exe
  C:\Windows\System\ERjPKtI.exe
  2⤵
  PID:10048
- C:\Windows\System\VAnvEpk.exe
  C:\Windows\System\VAnvEpk.exe
  2⤵
  PID:8704
- C:\Windows\System\USYlJCG.exe
  C:\Windows\System\USYlJCG.exe
  2⤵
  PID:9644
- C:\Windows\System\MwSVmGi.exe
  C:\Windows\System\MwSVmGi.exe
  2⤵
  PID:10256
- C:\Windows\System\PjbNupC.exe
  C:\Windows\System\PjbNupC.exe
  2⤵
  PID:10280
- C:\Windows\System\EmWQige.exe
  C:\Windows\System\EmWQige.exe
  2⤵
  PID:10312
- C:\Windows\System\tESMRSM.exe
  C:\Windows\System\tESMRSM.exe
  2⤵
  PID:10336
- C:\Windows\System\gQFYeOw.exe
  C:\Windows\System\gQFYeOw.exe
  2⤵
  PID:10368
- C:\Windows\System\euZLqNK.exe
  C:\Windows\System\euZLqNK.exe
  2⤵
  PID:10388
- C:\Windows\System\DJHWtWy.exe
  C:\Windows\System\DJHWtWy.exe
  2⤵
  PID:10416
- C:\Windows\System\OqUllOB.exe
  C:\Windows\System\OqUllOB.exe
  2⤵
  PID:10440
- C:\Windows\System\DpojZde.exe
  C:\Windows\System\DpojZde.exe
  2⤵
  PID:10472
- C:\Windows\System\drXVahb.exe
  C:\Windows\System\drXVahb.exe
  2⤵
  PID:10512
- C:\Windows\System\VLdUqOS.exe
  C:\Windows\System\VLdUqOS.exe
  2⤵
  PID:10540
- C:\Windows\System\PjQmwFf.exe
  C:\Windows\System\PjQmwFf.exe
  2⤵
  PID:10564
- C:\Windows\System\uMoJjhr.exe
  C:\Windows\System\uMoJjhr.exe
  2⤵
  PID:10600
- C:\Windows\System\aLFPRgA.exe
  C:\Windows\System\aLFPRgA.exe
  2⤵
  PID:10624
- C:\Windows\System\ssFoYln.exe
  C:\Windows\System\ssFoYln.exe
  2⤵
  PID:10652
- C:\Windows\System\YreQSQh.exe
  C:\Windows\System\YreQSQh.exe
  2⤵
  PID:10688
- C:\Windows\System\HZUuiLH.exe
  C:\Windows\System\HZUuiLH.exe
  2⤵
  PID:10712
- C:\Windows\System\KsXBhNU.exe
  C:\Windows\System\KsXBhNU.exe
  2⤵
  PID:10736
- C:\Windows\System\THPBdMF.exe
  C:\Windows\System\THPBdMF.exe
  2⤵
  PID:10756
- C:\Windows\System\JvbVHCM.exe
  C:\Windows\System\JvbVHCM.exe
  2⤵
  PID:10780
- C:\Windows\System\TfqYWkh.exe
  C:\Windows\System\TfqYWkh.exe
  2⤵
  PID:10804
- C:\Windows\System\gvgncVE.exe
  C:\Windows\System\gvgncVE.exe
  2⤵
  PID:10828
- C:\Windows\System\Lgcopia.exe
  C:\Windows\System\Lgcopia.exe
  2⤵
  PID:10856
- C:\Windows\System\AmRgqFn.exe
  C:\Windows\System\AmRgqFn.exe
  2⤵
  PID:10884
- C:\Windows\System\PdPsqOP.exe
  C:\Windows\System\PdPsqOP.exe
  2⤵
  PID:10908
- C:\Windows\System\JExRaFI.exe
  C:\Windows\System\JExRaFI.exe
  2⤵
  PID:10936
- C:\Windows\System\ZxqTbIR.exe
  C:\Windows\System\ZxqTbIR.exe
  2⤵
  PID:11060
- C:\Windows\System\eNtfXpe.exe
  C:\Windows\System\eNtfXpe.exe
  2⤵
  PID:11088
- C:\Windows\System\DaEQJLz.exe
  C:\Windows\System\DaEQJLz.exe
  2⤵
  PID:11116
- C:\Windows\System\CcKtGru.exe
  C:\Windows\System\CcKtGru.exe
  2⤵
  PID:11132
- C:\Windows\System\uYuBFcJ.exe
  C:\Windows\System\uYuBFcJ.exe
  2⤵
  PID:11156
- C:\Windows\System\mkSyJws.exe
  C:\Windows\System\mkSyJws.exe
  2⤵
  PID:11180
- C:\Windows\System\mheElxZ.exe
  C:\Windows\System\mheElxZ.exe
  2⤵
  PID:11204
- C:\Windows\System\FgxxzcU.exe
  C:\Windows\System\FgxxzcU.exe
  2⤵
  PID:11236
- C:\Windows\System\TtQQUdu.exe
  C:\Windows\System\TtQQUdu.exe
  2⤵
  PID:10040
- C:\Windows\System\tfqPzKC.exe
  C:\Windows\System\tfqPzKC.exe
  2⤵
  PID:9776
- C:\Windows\System\pBVJGaP.exe
  C:\Windows\System\pBVJGaP.exe
  2⤵
  PID:9824
- C:\Windows\System\AQksgVs.exe
  C:\Windows\System\AQksgVs.exe
  2⤵
  PID:9008
- C:\Windows\System\eAcJSif.exe
  C:\Windows\System\eAcJSif.exe
  2⤵
  PID:10276
- C:\Windows\System\fhxqWTi.exe
  C:\Windows\System\fhxqWTi.exe
  2⤵
  PID:10360
- C:\Windows\System\OxtcmCO.exe
  C:\Windows\System\OxtcmCO.exe
  2⤵
  PID:10408
- C:\Windows\System\LGBASEj.exe
  C:\Windows\System\LGBASEj.exe
  2⤵
  PID:10464
- C:\Windows\System\sydjMag.exe
  C:\Windows\System\sydjMag.exe
  2⤵
  PID:10532
- C:\Windows\System\aLqrymK.exe
  C:\Windows\System\aLqrymK.exe
  2⤵
  PID:10596
- C:\Windows\System\LuYOyoB.exe
  C:\Windows\System\LuYOyoB.exe
  2⤵
  PID:10612
- C:\Windows\System\BPHOXhO.exe
  C:\Windows\System\BPHOXhO.exe
  2⤵
  PID:10800
- C:\Windows\System\YwvVmew.exe
  C:\Windows\System\YwvVmew.exe
  2⤵
  PID:10844
- C:\Windows\System\UVYVpXs.exe
  C:\Windows\System\UVYVpXs.exe
  2⤵
  PID:10904
- C:\Windows\System\fWqeUed.exe
  C:\Windows\System\fWqeUed.exe
  2⤵
  PID:11096
- C:\Windows\System\pYWDLWy.exe
  C:\Windows\System\pYWDLWy.exe
  2⤵
  PID:11056
- C:\Windows\System\ZyQidjw.exe
  C:\Windows\System\ZyQidjw.exe
  2⤵
  PID:11152
- C:\Windows\System\LgyIxtt.exe
  C:\Windows\System\LgyIxtt.exe
  2⤵
  PID:11196
- C:\Windows\System\pOZIpQP.exe
  C:\Windows\System\pOZIpQP.exe
  2⤵
  PID:11244
- C:\Windows\System\WVaLtmV.exe
  C:\Windows\System\WVaLtmV.exe
  2⤵
  PID:9744
- C:\Windows\System\dNgcKMi.exe
  C:\Windows\System\dNgcKMi.exe
  2⤵
  PID:10320
- C:\Windows\System\VBJJugH.exe
  C:\Windows\System\VBJJugH.exe
  2⤵
  PID:10304
- C:\Windows\System\dsKHpFX.exe
  C:\Windows\System\dsKHpFX.exe
  2⤵
  PID:10548
- C:\Windows\System\VSaJHgP.exe
  C:\Windows\System\VSaJHgP.exe
  2⤵
  PID:8344
- C:\Windows\System\GoiLQmm.exe
  C:\Windows\System\GoiLQmm.exe
  2⤵
  PID:11216
- C:\Windows\System\jVibeLk.exe
  C:\Windows\System\jVibeLk.exe
  2⤵
  PID:10668
- C:\Windows\System\dNDjXNZ.exe
  C:\Windows\System\dNDjXNZ.exe
  2⤵
  PID:10868
- C:\Windows\System\JcCJyRH.exe
  C:\Windows\System\JcCJyRH.exe
  2⤵
  PID:11292
- C:\Windows\System\jcSUzRQ.exe
  C:\Windows\System\jcSUzRQ.exe
  2⤵
  PID:11324
- C:\Windows\System\xkVoWFQ.exe
  C:\Windows\System\xkVoWFQ.exe
  2⤵
  PID:11352
- C:\Windows\System\tSfyJyr.exe
  C:\Windows\System\tSfyJyr.exe
  2⤵
  PID:11384
- C:\Windows\System\PHAInkv.exe
  C:\Windows\System\PHAInkv.exe
  2⤵
  PID:11404
- C:\Windows\System\MUjgcVm.exe
  C:\Windows\System\MUjgcVm.exe
  2⤵
  PID:11424
- C:\Windows\System\yORrHVH.exe
  C:\Windows\System\yORrHVH.exe
  2⤵
  PID:11444
- C:\Windows\System\wgsZBDF.exe
  C:\Windows\System\wgsZBDF.exe
  2⤵
  PID:11468
- C:\Windows\System\xYQuPhc.exe
  C:\Windows\System\xYQuPhc.exe
  2⤵
  PID:11488
- C:\Windows\System\FCGsvip.exe
  C:\Windows\System\FCGsvip.exe
  2⤵
  PID:11512
- C:\Windows\System\lRZtVRT.exe
  C:\Windows\System\lRZtVRT.exe
  2⤵
  PID:11540
- C:\Windows\System\qxZRsXQ.exe
  C:\Windows\System\qxZRsXQ.exe
  2⤵
  PID:11568
- C:\Windows\System\HuTlSmE.exe
  C:\Windows\System\HuTlSmE.exe
  2⤵
  PID:11604
- C:\Windows\System\WxMyUkU.exe
  C:\Windows\System\WxMyUkU.exe
  2⤵
  PID:11628
- C:\Windows\System\ikrbGHY.exe
  C:\Windows\System\ikrbGHY.exe
  2⤵
  PID:11648
- C:\Windows\System\WEUkImg.exe
  C:\Windows\System\WEUkImg.exe
  2⤵
  PID:11676
- C:\Windows\System\WrRmZIA.exe
  C:\Windows\System\WrRmZIA.exe
  2⤵
  PID:11700
- C:\Windows\System\FWcMmWc.exe
  C:\Windows\System\FWcMmWc.exe
  2⤵
  PID:11728
- C:\Windows\System\GPOlPAG.exe
  C:\Windows\System\GPOlPAG.exe
  2⤵
  PID:11752
- C:\Windows\System\EVzwGun.exe
  C:\Windows\System\EVzwGun.exe
  2⤵
  PID:11784
- C:\Windows\System\odPGshE.exe
  C:\Windows\System\odPGshE.exe
  2⤵
  PID:11804
- C:\Windows\System\IrocGKh.exe
  C:\Windows\System\IrocGKh.exe
  2⤵
  PID:11828
- C:\Windows\System\oTCRIxr.exe
  C:\Windows\System\oTCRIxr.exe
  2⤵
  PID:11864
- C:\Windows\System\CaFxgXa.exe
  C:\Windows\System\CaFxgXa.exe
  2⤵
  PID:11884
- C:\Windows\System\CKbSUYD.exe
  C:\Windows\System\CKbSUYD.exe
  2⤵
  PID:11900
- C:\Windows\System\wDeBpKF.exe
  C:\Windows\System\wDeBpKF.exe
  2⤵
  PID:11928
- C:\Windows\System\scVLxFo.exe
  C:\Windows\System\scVLxFo.exe
  2⤵
  PID:11956
- C:\Windows\System\nStgssJ.exe
  C:\Windows\System\nStgssJ.exe
  2⤵
  PID:11988
- C:\Windows\System\YoIZgQw.exe
  C:\Windows\System\YoIZgQw.exe
  2⤵
  PID:12004
- C:\Windows\System\aZjYKLd.exe
  C:\Windows\System\aZjYKLd.exe
  2⤵
  PID:12032
- C:\Windows\System\oBBPdov.exe
  C:\Windows\System\oBBPdov.exe
  2⤵
  PID:12060
- C:\Windows\System\DWJJmUB.exe
  C:\Windows\System\DWJJmUB.exe
  2⤵
  PID:12088
- C:\Windows\System\QDtQUwV.exe
  C:\Windows\System\QDtQUwV.exe
  2⤵
  PID:12104
- C:\Windows\System\MqwCtZd.exe
  C:\Windows\System\MqwCtZd.exe
  2⤵
  PID:12128
- C:\Windows\System\jgOQeTC.exe
  C:\Windows\System\jgOQeTC.exe
  2⤵
  PID:12160
- C:\Windows\System\jLmxBhm.exe
  C:\Windows\System\jLmxBhm.exe
  2⤵
  PID:12184
- C:\Windows\System\cETKeBG.exe
  C:\Windows\System\cETKeBG.exe
  2⤵
  PID:12224
- C:\Windows\System\fORkIDL.exe
  C:\Windows\System\fORkIDL.exe
  2⤵
  PID:12252
- C:\Windows\System\MKiwdyz.exe
  C:\Windows\System\MKiwdyz.exe
  2⤵
  PID:12280
- C:\Windows\System\xqKYddS.exe
  C:\Windows\System\xqKYddS.exe
  2⤵
  PID:10732
- C:\Windows\System\atJGegq.exe
  C:\Windows\System\atJGegq.exe
  2⤵
  PID:10676
- C:\Windows\System\nCgmXns.exe
  C:\Windows\System\nCgmXns.exe
  2⤵
  PID:9652
- C:\Windows\System\LAyudLJ.exe
  C:\Windows\System\LAyudLJ.exe
  2⤵
  PID:11432
- C:\Windows\System\nGMLszF.exe
  C:\Windows\System\nGMLszF.exe
  2⤵
  PID:11464
- C:\Windows\System\dYQvwsg.exe
  C:\Windows\System\dYQvwsg.exe
  2⤵
  PID:11548
- C:\Windows\System\kWaoaUB.exe
  C:\Windows\System\kWaoaUB.exe
  2⤵
  PID:11460
- C:\Windows\System\UvUcJFR.exe
  C:\Windows\System\UvUcJFR.exe
  2⤵
  PID:11524
- C:\Windows\System\NFYKtPv.exe
  C:\Windows\System\NFYKtPv.exe
  2⤵
  PID:11664
- C:\Windows\System\uAnKChT.exe
  C:\Windows\System\uAnKChT.exe
  2⤵
  PID:11724
- C:\Windows\System\wBaZBrs.exe
  C:\Windows\System\wBaZBrs.exe
  2⤵
  PID:11844
- C:\Windows\System\xfGRbXc.exe
  C:\Windows\System\xfGRbXc.exe
  2⤵
  PID:11716
- C:\Windows\System\QlgfKSA.exe
  C:\Windows\System\QlgfKSA.exe
  2⤵
  PID:11764
- C:\Windows\System\VuWSiTd.exe
  C:\Windows\System\VuWSiTd.exe
  2⤵
  PID:11780
- C:\Windows\System\DfUhYJV.exe
  C:\Windows\System\DfUhYJV.exe
  2⤵
  PID:12052
- C:\Windows\System\AxWWtCW.exe
  C:\Windows\System\AxWWtCW.exe
  2⤵
  PID:11980
- C:\Windows\System\vzyIvOv.exe
  C:\Windows\System\vzyIvOv.exe
  2⤵
  PID:10380
- C:\Windows\System\ExDhSXb.exe
  C:\Windows\System\ExDhSXb.exe
  2⤵
  PID:10120
- C:\Windows\System\oBjWlOD.exe
  C:\Windows\System\oBjWlOD.exe
  2⤵
  PID:11536
- C:\Windows\System\TrMwDVp.exe
  C:\Windows\System\TrMwDVp.exe
  2⤵
  PID:12220
- C:\Windows\System\ozscyBj.exe
  C:\Windows\System\ozscyBj.exe
  2⤵
  PID:12268
- C:\Windows\System\ohoFhzL.exe
  C:\Windows\System\ohoFhzL.exe
  2⤵
  PID:12028
- C:\Windows\System\eHBqUoa.exe
  C:\Windows\System\eHBqUoa.exe
  2⤵
  PID:12072
- C:\Windows\System\BsZHZel.exe
  C:\Windows\System\BsZHZel.exe
  2⤵
  PID:12312
- C:\Windows\System\qRIMWrA.exe
  C:\Windows\System\qRIMWrA.exe
  2⤵
  PID:12412
- C:\Windows\System\oshhzHv.exe
  C:\Windows\System\oshhzHv.exe
  2⤵
  PID:12448
- C:\Windows\System\hdfwECD.exe
  C:\Windows\System\hdfwECD.exe
  2⤵
  PID:12492
- C:\Windows\System\YWPVqfx.exe
  C:\Windows\System\YWPVqfx.exe
  2⤵
  PID:12520
- C:\Windows\System\RnOrqiz.exe
  C:\Windows\System\RnOrqiz.exe
  2⤵
  PID:12552
- C:\Windows\System\EwezmTz.exe
  C:\Windows\System\EwezmTz.exe
  2⤵
  PID:12576
- C:\Windows\System\KtApnzV.exe
  C:\Windows\System\KtApnzV.exe
  2⤵
  PID:12608
- C:\Windows\System\jjGZAPy.exe
  C:\Windows\System\jjGZAPy.exe
  2⤵
  PID:12660
- C:\Windows\System\XrPHgFP.exe
  C:\Windows\System\XrPHgFP.exe
  2⤵
  PID:12684
- C:\Windows\System\rHzSZjF.exe
  C:\Windows\System\rHzSZjF.exe
  2⤵
  PID:12704
- C:\Windows\System\sJXarZM.exe
  C:\Windows\System\sJXarZM.exe
  2⤵
  PID:12728
- C:\Windows\System\qldJmCK.exe
  C:\Windows\System\qldJmCK.exe
  2⤵
  PID:12756
- C:\Windows\System\VvFOKei.exe
  C:\Windows\System\VvFOKei.exe
  2⤵
  PID:12792
- C:\Windows\System\hQhjcno.exe
  C:\Windows\System\hQhjcno.exe
  2⤵
  PID:12812
- C:\Windows\System\VjHaOFB.exe
  C:\Windows\System\VjHaOFB.exe
  2⤵
  PID:12844
- C:\Windows\System\FLVEnaj.exe
  C:\Windows\System\FLVEnaj.exe
  2⤵
  PID:12868
- C:\Windows\System\NTwcdqX.exe
  C:\Windows\System\NTwcdqX.exe
  2⤵
  PID:12896
- C:\Windows\System\xspbqRC.exe
  C:\Windows\System\xspbqRC.exe
  2⤵
  PID:12916
- C:\Windows\System\CGGPCsw.exe
  C:\Windows\System\CGGPCsw.exe
  2⤵
  PID:12940
- C:\Windows\System\SGlspTJ.exe
  C:\Windows\System\SGlspTJ.exe
  2⤵
  PID:12972
- C:\Windows\System\WKclopK.exe
  C:\Windows\System\WKclopK.exe
  2⤵
  PID:12992
- C:\Windows\System\QYIGiIQ.exe
  C:\Windows\System\QYIGiIQ.exe
  2⤵
  PID:13020
- C:\Windows\System\zYjUbyf.exe
  C:\Windows\System\zYjUbyf.exe
  2⤵
  PID:13052
- C:\Windows\System\TNKRXDa.exe
  C:\Windows\System\TNKRXDa.exe
  2⤵
  PID:13072
- C:\Windows\System\LekbGwF.exe
  C:\Windows\System\LekbGwF.exe
  2⤵
  PID:13092
- C:\Windows\System\zcWSCwL.exe
  C:\Windows\System\zcWSCwL.exe
  2⤵
  PID:13124
- C:\Windows\System\BfmpUlE.exe
  C:\Windows\System\BfmpUlE.exe
  2⤵
  PID:13156
- C:\Windows\System\cDomsML.exe
  C:\Windows\System\cDomsML.exe
  2⤵
  PID:13180
- C:\Windows\System\JebfkLa.exe
  C:\Windows\System\JebfkLa.exe
  2⤵
  PID:13208
- C:\Windows\System\MChIsMA.exe
  C:\Windows\System\MChIsMA.exe
  2⤵
  PID:13228
- C:\Windows\System\qdoKlEo.exe
  C:\Windows\System\qdoKlEo.exe
  2⤵
  PID:13252
- C:\Windows\System\yyiXhLc.exe
  C:\Windows\System\yyiXhLc.exe
  2⤵
  PID:13284
- C:\Windows\System\dqRWrTe.exe
  C:\Windows\System\dqRWrTe.exe
  2⤵
  PID:11872
- C:\Windows\System\YLUAbLz.exe
  C:\Windows\System\YLUAbLz.exe
  2⤵
  PID:11740
- C:\Windows\System\CnIWzRA.exe
  C:\Windows\System\CnIWzRA.exe
  2⤵
  PID:12120
- C:\Windows\System\iAxjzIx.exe
  C:\Windows\System\iAxjzIx.exe
  2⤵
  PID:12240
- C:\Windows\System\YPjkXuu.exe
  C:\Windows\System\YPjkXuu.exe
  2⤵
  PID:11552
- C:\Windows\System\XbNuhvB.exe
  C:\Windows\System\XbNuhvB.exe
  2⤵
  PID:12364
- C:\Windows\System\nEmGuGG.exe
  C:\Windows\System\nEmGuGG.exe
  2⤵
  PID:12444
- C:\Windows\System\PAUfFDI.exe
  C:\Windows\System\PAUfFDI.exe
  2⤵
  PID:12384
- C:\Windows\System\zzjhMPb.exe
  C:\Windows\System\zzjhMPb.exe
  2⤵
  PID:12476
- C:\Windows\System\EKJwhOp.exe
  C:\Windows\System\EKJwhOp.exe
  2⤵
  PID:12572
- C:\Windows\System\kiitalU.exe
  C:\Windows\System\kiitalU.exe
  2⤵
  PID:12560
- C:\Windows\System\WTOzJJB.exe
  C:\Windows\System\WTOzJJB.exe
  2⤵
  PID:12676
- C:\Windows\System\slYqBUd.exe
  C:\Windows\System\slYqBUd.exe
  2⤵
  PID:12700
- C:\Windows\System\PtFFgxk.exe
  C:\Windows\System\PtFFgxk.exe
  2⤵
  PID:12784
- C:\Windows\System\zPeHFHg.exe
  C:\Windows\System\zPeHFHg.exe
  2⤵
  PID:12852
- C:\Windows\System\wNRJPnd.exe
  C:\Windows\System\wNRJPnd.exe
  2⤵
  PID:12904
- C:\Windows\System\NQzjdPL.exe
  C:\Windows\System\NQzjdPL.exe
  2⤵
  PID:12932
- C:\Windows\System\SdzTpEW.exe
  C:\Windows\System\SdzTpEW.exe
  2⤵
  PID:13004
- C:\Windows\System\eEuzvpI.exe
  C:\Windows\System\eEuzvpI.exe
  2⤵
  PID:13036
- C:\Windows\System\YZfbhJR.exe
  C:\Windows\System\YZfbhJR.exe
  2⤵
  PID:13196
- C:\Windows\System\zJLgmhA.exe
  C:\Windows\System\zJLgmhA.exe
  2⤵
  PID:13236
- C:\Windows\System\bWRwXMH.exe
  C:\Windows\System\bWRwXMH.exe
  2⤵
  PID:11660
- C:\Windows\System\orgGjLX.exe
  C:\Windows\System\orgGjLX.exe
  2⤵
  PID:13280
- C:\Windows\System\CkDbsCL.exe
  C:\Windows\System\CkDbsCL.exe
  2⤵
  PID:13244
- C:\Windows\System\jlDpFuc.exe
  C:\Windows\System\jlDpFuc.exe
  2⤵
  PID:12016
- C:\Windows\System\jWXMTDv.exe
  C:\Windows\System\jWXMTDv.exe
  2⤵
  PID:11284
- C:\Windows\System\XunzvIj.exe
  C:\Windows\System\XunzvIj.exe
  2⤵
  PID:12836
- C:\Windows\System\vqXZxNx.exe
  C:\Windows\System\vqXZxNx.exe
  2⤵
  PID:11696
- C:\Windows\System\cnrpyyW.exe
  C:\Windows\System\cnrpyyW.exe
  2⤵
  PID:12044
- C:\Windows\System\wOnoDTi.exe
  C:\Windows\System\wOnoDTi.exe
  2⤵
  PID:12744
- C:\Windows\System\GxnnXkD.exe
  C:\Windows\System\GxnnXkD.exe
  2⤵
  PID:12888
- C:\Windows\System\oNNubqV.exe
  C:\Windows\System\oNNubqV.exe
  2⤵
  PID:13316
- C:\Windows\System\iKliaLi.exe
  C:\Windows\System\iKliaLi.exe
  2⤵
  PID:13344
- C:\Windows\System\lAoRFDt.exe
  C:\Windows\System\lAoRFDt.exe
  2⤵
  PID:13364
- C:\Windows\System\rxajLjq.exe
  C:\Windows\System\rxajLjq.exe
  2⤵
  PID:13392
- C:\Windows\System\XHEaocX.exe
  C:\Windows\System\XHEaocX.exe
  2⤵
  PID:13416
- C:\Windows\System\LrimBfn.exe
  C:\Windows\System\LrimBfn.exe
  2⤵
  PID:13444
- C:\Windows\System\qohADnn.exe
  C:\Windows\System\qohADnn.exe
  2⤵
  PID:13468
- C:\Windows\System\mLEnjUI.exe
  C:\Windows\System\mLEnjUI.exe
  2⤵
  PID:13488
- C:\Windows\System\taQOrOJ.exe
  C:\Windows\System\taQOrOJ.exe
  2⤵
  PID:13528
- C:\Windows\System\MnOyvef.exe
  C:\Windows\System\MnOyvef.exe
  2⤵
  PID:13548
- C:\Windows\System\chRAgzj.exe
  C:\Windows\System\chRAgzj.exe
  2⤵
  PID:13572
- C:\Windows\System\DCdzFVO.exe
  C:\Windows\System\DCdzFVO.exe
  2⤵
  PID:13592
- C:\Windows\System\zUkDAtv.exe
  C:\Windows\System\zUkDAtv.exe
  2⤵
  PID:13616
- C:\Windows\System\lfufiBj.exe
  C:\Windows\System\lfufiBj.exe
  2⤵
  PID:13636
- C:\Windows\System\gPtZizp.exe
  C:\Windows\System\gPtZizp.exe
  2⤵
  PID:13664
- C:\Windows\System\KmxzFDS.exe
  C:\Windows\System\KmxzFDS.exe
  2⤵
  PID:13688
- C:\Windows\System\hRYzCIn.exe
  C:\Windows\System\hRYzCIn.exe
  2⤵
  PID:13712
- C:\Windows\System\jqnFnXg.exe
  C:\Windows\System\jqnFnXg.exe
  2⤵
  PID:13740
- C:\Windows\System\axVsPla.exe
  C:\Windows\System\axVsPla.exe
  2⤵
  PID:13768
- C:\Windows\System\cMtNyWc.exe
  C:\Windows\System\cMtNyWc.exe
  2⤵
  PID:13788
- C:\Windows\System\tywIIgx.exe
  C:\Windows\System\tywIIgx.exe
  2⤵
  PID:13808
- C:\Windows\System\BKSJuxB.exe
  C:\Windows\System\BKSJuxB.exe
  2⤵
  PID:13828
- C:\Windows\System\rxnyOQE.exe
  C:\Windows\System\rxnyOQE.exe
  2⤵
  PID:13856
- C:\Windows\System\VVPWhQi.exe
  C:\Windows\System\VVPWhQi.exe
  2⤵
  PID:13884
- C:\Windows\System\vdQElao.exe
  C:\Windows\System\vdQElao.exe
  2⤵
  PID:13908
- C:\Windows\System\XtHzxXR.exe
  C:\Windows\System\XtHzxXR.exe
  2⤵
  PID:13940
- C:\Windows\System\KbIMsfy.exe
  C:\Windows\System\KbIMsfy.exe
  2⤵
  PID:13964
- C:\Windows\System\CaXzxli.exe
  C:\Windows\System\CaXzxli.exe
  2⤵
  PID:14000
- C:\Windows\System\uFKbkMj.exe
  C:\Windows\System\uFKbkMj.exe
  2⤵
  PID:14016
- C:\Windows\System\jHcqzav.exe
  C:\Windows\System\jHcqzav.exe
  2⤵
  PID:14120
- C:\Windows\System\gajjPwL.exe
  C:\Windows\System\gajjPwL.exe
  2⤵
  PID:14144
- C:\Windows\System\ZaQxhfw.exe
  C:\Windows\System\ZaQxhfw.exe
  2⤵
  PID:14176
- C:\Windows\System\VSixcqU.exe
  C:\Windows\System\VSixcqU.exe
  2⤵
  PID:14220
- C:\Windows\System\qzuIpUY.exe
  C:\Windows\System\qzuIpUY.exe
  2⤵
  PID:14260
- C:\Windows\System\zzKEvoZ.exe
  C:\Windows\System\zzKEvoZ.exe
  2⤵
  PID:14300
- C:\Windows\System\liNNUaa.exe
  C:\Windows\System\liNNUaa.exe
  2⤵
  PID:14316
- C:\Windows\System\HcIHlPC.exe
  C:\Windows\System\HcIHlPC.exe
  2⤵
  PID:13224
- C:\Windows\System\uhqLQSq.exe
  C:\Windows\System\uhqLQSq.exe
  2⤵
  PID:13136
- C:\Windows\System\HLWhOoW.exe
  C:\Windows\System\HLWhOoW.exe
  2⤵
  PID:12324
- C:\Windows\System\ROLsEUX.exe
  C:\Windows\System\ROLsEUX.exe
  2⤵
  PID:12516
- C:\Windows\System\kkDejnk.exe
  C:\Windows\System\kkDejnk.exe
  2⤵
  PID:13460
- C:\Windows\System\jRwDwuS.exe
  C:\Windows\System\jRwDwuS.exe
  2⤵
  PID:13216
- C:\Windows\System\ISiEgpi.exe
  C:\Windows\System\ISiEgpi.exe
  2⤵
  PID:13332
- C:\Windows\System\GYlwgKh.exe
  C:\Windows\System\GYlwgKh.exe
  2⤵
  PID:13628
- C:\Windows\System\MDNBpZj.exe
  C:\Windows\System\MDNBpZj.exe
  2⤵
  PID:13800
- C:\Windows\System\euCcNtI.exe
  C:\Windows\System\euCcNtI.exe
  2⤵
  PID:13816
- C:\Windows\System\TLgPqmU.exe
  C:\Windows\System\TLgPqmU.exe
  2⤵
  PID:13920
- C:\Windows\System\MnmCMNk.exe
  C:\Windows\System\MnmCMNk.exe
  2⤵
  PID:13656
- C:\Windows\System\UCWUolg.exe
  C:\Windows\System\UCWUolg.exe
  2⤵
  PID:13996
- C:\Windows\System\nALUtWB.exe
  C:\Windows\System\nALUtWB.exe
  2⤵
  PID:14088
- C:\Windows\System\xCKpthS.exe
  C:\Windows\System\xCKpthS.exe
  2⤵
  PID:13732
- C:\Windows\System\UpABXTn.exe
  C:\Windows\System\UpABXTn.exe
  2⤵
  PID:13868
- C:\Windows\System\TDQBMsV.exe
  C:\Windows\System\TDQBMsV.exe
  2⤵
  PID:14172
- C:\Windows\System\yAJYkNK.exe
  C:\Windows\System\yAJYkNK.exe
  2⤵
  PID:14192
- C:\Windows\System\JchJCSZ.exe
  C:\Windows\System\JchJCSZ.exe
  2⤵
  PID:14116
- C:\Windows\System\wETQfOr.exe
  C:\Windows\System\wETQfOr.exe
  2⤵
  PID:13308
- C:\Windows\System\AJhAlrD.exe
  C:\Windows\System\AJhAlrD.exe
  2⤵
  PID:13152
- C:\Windows\System\rPPTAsf.exe
  C:\Windows\System\rPPTAsf.exe
  2⤵
  PID:13356
- C:\Windows\System\KLUAOBM.exe
  C:\Windows\System\KLUAOBM.exe
  2⤵
  PID:14068
- C:\Windows\System\LmGAQdQ.exe
  C:\Windows\System\LmGAQdQ.exe
  2⤵
  PID:12716
- C:\Windows\System\iZVirfG.exe
  C:\Windows\System\iZVirfG.exe
  2⤵
  PID:11976
- C:\Windows\System\YuhtgnN.exe
  C:\Windows\System\YuhtgnN.exe
  2⤵
  PID:13604
- C:\Windows\System\EdsCvvh.exe
  C:\Windows\System\EdsCvvh.exe
  2⤵
  PID:14352
- C:\Windows\System\XYpskCW.exe
  C:\Windows\System\XYpskCW.exe
  2⤵
  PID:14376
- C:\Windows\System\HbUYPtR.exe
  C:\Windows\System\HbUYPtR.exe
  2⤵
  PID:14396
- C:\Windows\System\wihpyyF.exe
  C:\Windows\System\wihpyyF.exe
  2⤵
  PID:14420
- C:\Windows\System\tEauzSI.exe
  C:\Windows\System\tEauzSI.exe
  2⤵
  PID:14456
- C:\Windows\System\jeOaVEY.exe
  C:\Windows\System\jeOaVEY.exe
  2⤵
  PID:14480
- C:\Windows\System\jhghmem.exe
  C:\Windows\System\jhghmem.exe
  2⤵
  PID:14504
- C:\Windows\System\xkvoQLj.exe
  C:\Windows\System\xkvoQLj.exe
  2⤵
  PID:14524
- C:\Windows\System\ceHBIfT.exe
  C:\Windows\System\ceHBIfT.exe
  2⤵
  PID:14544
- C:\Windows\System\uVxKLzO.exe
  C:\Windows\System\uVxKLzO.exe
  2⤵
  PID:14568
- C:\Windows\System\MCRGtYf.exe
  C:\Windows\System\MCRGtYf.exe
  2⤵
  PID:14588
- C:\Windows\System\UfEnwwI.exe
  C:\Windows\System\UfEnwwI.exe
  2⤵
  PID:14604
- C:\Windows\System\LEjyPqW.exe
  C:\Windows\System\LEjyPqW.exe
  2⤵
  PID:14624
- C:\Windows\System\bJZXytI.exe
  C:\Windows\System\bJZXytI.exe
  2⤵
  PID:14656
- C:\Windows\System\icIpXiB.exe
  C:\Windows\System\icIpXiB.exe
  2⤵
  PID:14672
- C:\Windows\System\tqAqRMs.exe
  C:\Windows\System\tqAqRMs.exe
  2⤵
  PID:14692
- C:\Windows\System\jJaeZgU.exe
  C:\Windows\System\jJaeZgU.exe
  2⤵
  PID:14716
- C:\Windows\System\DELtlEB.exe
  C:\Windows\System\DELtlEB.exe
  2⤵
  PID:14740
- C:\Windows\System\tQcCAnK.exe
  C:\Windows\System\tQcCAnK.exe
  2⤵
  PID:14764
- C:\Windows\System\jyaQWDW.exe
  C:\Windows\System\jyaQWDW.exe
  2⤵
  PID:14784
- C:\Windows\System\uOATOHG.exe
  C:\Windows\System\uOATOHG.exe
  2⤵
  PID:14808
- C:\Windows\System\CseyDUD.exe
  C:\Windows\System\CseyDUD.exe
  2⤵
  PID:14824
- C:\Windows\System\mWCBnzv.exe
  C:\Windows\System\mWCBnzv.exe
  2⤵
  PID:14848
- C:\Windows\System\gcuUeBf.exe
  C:\Windows\System\gcuUeBf.exe
  2⤵
  PID:14864
- C:\Windows\System\EEYAdDc.exe
  C:\Windows\System\EEYAdDc.exe
  2⤵
  PID:14888
- C:\Windows\System\KJOsTky.exe
  C:\Windows\System\KJOsTky.exe
  2⤵
  PID:14912
- C:\Windows\System\QMnqxlD.exe
  C:\Windows\System\QMnqxlD.exe
  2⤵
  PID:14940
- C:\Windows\System\yNJYgov.exe
  C:\Windows\System\yNJYgov.exe
  2⤵
  PID:14960
- C:\Windows\System\oqabWAW.exe
  C:\Windows\System\oqabWAW.exe
  2⤵
  PID:14976
- C:\Windows\System\JCHdtxg.exe
  C:\Windows\System\JCHdtxg.exe
  2⤵
  PID:14992
- C:\Windows\System\OMQFJbx.exe
  C:\Windows\System\OMQFJbx.exe
  2⤵
  PID:15008
- C:\Windows\System\hbCTFds.exe
  C:\Windows\System\hbCTFds.exe
  2⤵
  PID:15032
- C:\Windows\System\UkCpQQF.exe
  C:\Windows\System\UkCpQQF.exe
  2⤵
  PID:15060
- C:\Windows\System\NWPZeoC.exe
  C:\Windows\System\NWPZeoC.exe
  2⤵
  PID:15080
- C:\Windows\System\tovXiKw.exe
  C:\Windows\System\tovXiKw.exe
  2⤵
  PID:15104
- C:\Windows\System\uruIYHE.exe
  C:\Windows\System\uruIYHE.exe
  2⤵
  PID:15128
- C:\Windows\System\oLtHLIi.exe
  C:\Windows\System\oLtHLIi.exe
  2⤵
  PID:15152
- C:\Windows\System\EqQXPsE.exe
  C:\Windows\System\EqQXPsE.exe
  2⤵
  PID:15172
- C:\Windows\System\bwyArQU.exe
  C:\Windows\System\bwyArQU.exe
  2⤵
  PID:15192
- C:\Windows\System\EWCxEfh.exe
  C:\Windows\System\EWCxEfh.exe
  2⤵
  PID:15216
- C:\Windows\System\IuMctOY.exe
  C:\Windows\System\IuMctOY.exe
  2⤵
  PID:15240
- C:\Windows\System\FkSAmYZ.exe
  C:\Windows\System\FkSAmYZ.exe
  2⤵
  PID:15260
- C:\Windows\System\xusQtoA.exe
  C:\Windows\System\xusQtoA.exe
  2⤵
  PID:15288
- C:\Windows\System\OToudMG.exe
  C:\Windows\System\OToudMG.exe
  2⤵
  PID:15308
- C:\Windows\System\unmdbKY.exe
  C:\Windows\System\unmdbKY.exe
  2⤵
  PID:15336
- C:\Windows\System\IhVRtch.exe
  C:\Windows\System\IhVRtch.exe
  2⤵
  PID:15356
- C:\Windows\System\AbIUSEC.exe
  C:\Windows\System\AbIUSEC.exe
  2⤵
  PID:13580
- C:\Windows\System\tuxNreO.exe
  C:\Windows\System\tuxNreO.exe
  2⤵
  PID:13904
- C:\Windows\System\uckzHjs.exe
  C:\Windows\System\uckzHjs.exe
  2⤵
  PID:14344
- C:\Windows\System\joefkBu.exe
  C:\Windows\System\joefkBu.exe
  2⤵
  PID:13760
- C:\Windows\System\doWmTcz.exe
  C:\Windows\System\doWmTcz.exe
  2⤵
  PID:12748
- C:\Windows\System\dbeLSvg.exe
  C:\Windows\System\dbeLSvg.exe
  2⤵
  PID:12980
- C:\Windows\System\STVlOQI.exe
  C:\Windows\System\STVlOQI.exe
  2⤵
  PID:14388
- C:\Windows\System\rhPSCVO.exe
  C:\Windows\System\rhPSCVO.exe
  2⤵
  PID:13376
- C:\Windows\System\bdIlYuZ.exe
  C:\Windows\System\bdIlYuZ.exe
  2⤵
  PID:14760
- C:\Windows\System\VBcmeht.exe
  C:\Windows\System\VBcmeht.exe
  2⤵
  PID:14560
- C:\Windows\System\kZuRBMq.exe
  C:\Windows\System\kZuRBMq.exe
  2⤵
  PID:14928
- C:\Windows\System\mtazIvw.exe
  C:\Windows\System\mtazIvw.exe
  2⤵
  PID:14416
- C:\Windows\System\TZiDZEf.exe
  C:\Windows\System\TZiDZEf.exe
  2⤵
  PID:14756
- C:\Windows\System\VcTmcsM.exe
  C:\Windows\System\VcTmcsM.exe
  2⤵
  PID:15112
- C:\Windows\System\DQjRdZP.exe
  C:\Windows\System\DQjRdZP.exe
  2⤵
  PID:14856
- C:\Windows\System\XsuDXzU.exe
  C:\Windows\System\XsuDXzU.exe
  2⤵
  PID:15268
- C:\Windows\System\grLdyHZ.exe
  C:\Windows\System\grLdyHZ.exe
  2⤵
  PID:14984
- C:\Windows\System\FnkwBMk.exe
  C:\Windows\System\FnkwBMk.exe
  2⤵
  PID:14728
- C:\Windows\System\VvefKzk.exe
  C:\Windows\System\VvefKzk.exe
  2⤵
  PID:14816
- C:\Windows\System\DWDLJGD.exe
  C:\Windows\System\DWDLJGD.exe
  2⤵
  PID:15376
- C:\Windows\System\jUftudl.exe
  C:\Windows\System\jUftudl.exe
  2⤵
  PID:15400
- C:\Windows\System\hnRtruZ.exe
  C:\Windows\System\hnRtruZ.exe
  2⤵
  PID:15432
- C:\Windows\System\gIchtqu.exe
  C:\Windows\System\gIchtqu.exe
  2⤵
  PID:15460
- C:\Windows\System\WaATOdS.exe
  C:\Windows\System\WaATOdS.exe
  2⤵
  PID:15476
- C:\Windows\System\HbclJOo.exe
  C:\Windows\System\HbclJOo.exe
  2⤵
  PID:15500
- C:\Windows\System\EjTassu.exe
  C:\Windows\System\EjTassu.exe
  2⤵
  PID:15528
- C:\Windows\System\PZyFDui.exe
  C:\Windows\System\PZyFDui.exe
  2⤵
  PID:15556
- C:\Windows\System\rPImUXF.exe
  C:\Windows\System\rPImUXF.exe
  2⤵
  PID:15576
- C:\Windows\System\TFSqijR.exe
  C:\Windows\System\TFSqijR.exe
  2⤵
  PID:15608
- C:\Windows\System\jCqYZdv.exe
  C:\Windows\System\jCqYZdv.exe
  2⤵
  PID:15636
- C:\Windows\System\RHlxfqv.exe
  C:\Windows\System\RHlxfqv.exe
  2⤵
  PID:15652
- C:\Windows\System\YfWSqBi.exe
  C:\Windows\System\YfWSqBi.exe
  2⤵
  PID:15940
- C:\Windows\System\jYORiWm.exe
  C:\Windows\System\jYORiWm.exe
  2⤵
  PID:15956
- C:\Windows\System\WaRNbLo.exe
  C:\Windows\System\WaRNbLo.exe
  2⤵
  PID:16008
- C:\Windows\System\EFtSAlo.exe
  C:\Windows\System\EFtSAlo.exe
  2⤵
  PID:16032
- C:\Windows\System\unMAJfq.exe
  C:\Windows\System\unMAJfq.exe
  2⤵
  PID:16048
- C:\Windows\System\CxuAZxw.exe
  C:\Windows\System\CxuAZxw.exe
  2⤵
  PID:16064
- C:\Windows\System\NNNHptu.exe
  C:\Windows\System\NNNHptu.exe
  2⤵
  PID:16084
- C:\Windows\System\cHDLNvB.exe
  C:\Windows\System\cHDLNvB.exe
  2⤵
  PID:16124
- C:\Windows\System\BzUzsCu.exe
  C:\Windows\System\BzUzsCu.exe
  2⤵
  PID:16280
- C:\Windows\System\WqcEjbb.exe
  C:\Windows\System\WqcEjbb.exe
  2⤵
  PID:16296
- C:\Windows\System\ogICooS.exe
  C:\Windows\System\ogICooS.exe
  2⤵
  PID:16324
- C:\Windows\System\ZuqGWjj.exe
  C:\Windows\System\ZuqGWjj.exe
  2⤵
  PID:16340
- C:\Windows\System\iCoMamJ.exe
  C:\Windows\System\iCoMamJ.exe
  2⤵
  PID:16360
- C:\Windows\System\yogvRoo.exe
  C:\Windows\System\yogvRoo.exe
  2⤵
  PID:15164
- C:\Windows\System\HBTKsQe.exe
  C:\Windows\System\HBTKsQe.exe
  2⤵
  PID:15232
- C:\Windows\System\AlAWdjb.exe
  C:\Windows\System\AlAWdjb.exe
  2⤵
  PID:15020
- C:\Windows\System\cBPGHdy.exe
  C:\Windows\System\cBPGHdy.exe
  2⤵
  PID:14632
- C:\Windows\System\hPSwKsN.exe
  C:\Windows\System\hPSwKsN.exe
  2⤵
  PID:15372
- C:\Windows\System\wlqvRgo.exe
  C:\Windows\System\wlqvRgo.exe
  2⤵
  PID:15212
- C:\Windows\System\qJnlscM.exe
  C:\Windows\System\qJnlscM.exe
  2⤵
  PID:15524
- C:\Windows\System\RLvmcYd.exe
  C:\Windows\System\RLvmcYd.exe
  2⤵
  PID:15496
- C:\Windows\System\ZIBjemA.exe
  C:\Windows\System\ZIBjemA.exe
  2⤵
  PID:14476
- C:\Windows\System\cwJVHhx.exe
  C:\Windows\System\cwJVHhx.exe
  2⤵
  PID:15124
- C:\Windows\System\IsqmsBo.exe
  C:\Windows\System\IsqmsBo.exe
  2⤵
  PID:15144
- C:\Windows\System\hhpodda.exe
  C:\Windows\System\hhpodda.exe
  2⤵
  PID:15392
- C:\Windows\System\ecUTeoU.exe
  C:\Windows\System\ecUTeoU.exe
  2⤵
  PID:15456
- C:\Windows\System\jYwauEw.exe
  C:\Windows\System\jYwauEw.exe
  2⤵
  PID:15568
- C:\Windows\System\xXQZYwt.exe
  C:\Windows\System\xXQZYwt.exe
  2⤵
  PID:15564
- C:\Windows\System\wCidBqt.exe
  C:\Windows\System\wCidBqt.exe
  2⤵
  PID:15452
- C:\Windows\System\OGvsQVA.exe
  C:\Windows\System\OGvsQVA.exe
  2⤵
  PID:15676
- C:\Windows\System\MpsyWgU.exe
  C:\Windows\System\MpsyWgU.exe
  2⤵
  PID:15736
- C:\Windows\System\XEBfEew.exe
  C:\Windows\System\XEBfEew.exe
  2⤵
  PID:15952
- C:\Windows\System\HXvywqk.exe
  C:\Windows\System\HXvywqk.exe
  2⤵
  PID:16132
- C:\Windows\System\DfzBXsb.exe
  C:\Windows\System\DfzBXsb.exe
  2⤵
  PID:15948
- C:\Windows\System\cXCFgLZ.exe
  C:\Windows\System\cXCFgLZ.exe
  2⤵
  PID:16044
- C:\Windows\System\jbFjzov.exe
  C:\Windows\System\jbFjzov.exe
  2⤵
  PID:16112
- C:\Windows\System\iNhwAuW.exe
  C:\Windows\System\iNhwAuW.exe
  2⤵
  PID:16172
- C:\Windows\System\igDEhDB.exe
  C:\Windows\System\igDEhDB.exe
  2⤵
  PID:16224
- C:\Windows\System\VzEnUeN.exe
  C:\Windows\System\VzEnUeN.exe
  2⤵
  PID:14688
- C:\Windows\System\GcABjdX.exe
  C:\Windows\System\GcABjdX.exe
  2⤵
  PID:16380
- C:\Windows\System\yyJuUkl.exe
  C:\Windows\System\yyJuUkl.exe
  2⤵
  PID:14532
- C:\Windows\System\PjISACU.exe
  C:\Windows\System\PjISACU.exe
  2⤵
  PID:11708
- C:\Windows\System\FsUEuIT.exe
  C:\Windows\System\FsUEuIT.exe
  2⤵
  PID:15140
- C:\Windows\System\HHZUaGv.exe
  C:\Windows\System\HHZUaGv.exe
  2⤵
  PID:15616
- C:\Windows\System\XWJLZio.exe
  C:\Windows\System\XWJLZio.exe
  2⤵
  PID:14448
- C:\Windows\System\fCQyoVH.exe
  C:\Windows\System\fCQyoVH.exe
  2⤵
  PID:15620
- C:\Windows\System\pqbyJLS.exe
  C:\Windows\System\pqbyJLS.exe
  2⤵
  PID:16176
- C:\Windows\System\DBnHEbP.exe
  C:\Windows\System\DBnHEbP.exe
  2⤵
  PID:16156
- C:\Windows\System\dwEypxf.exe
  C:\Windows\System\dwEypxf.exe
  2⤵
  PID:15668
- C:\Windows\System\hGFkpBR.exe
  C:\Windows\System\hGFkpBR.exe
  2⤵
  PID:12376
- C:\Windows\System\DiomktG.exe
  C:\Windows\System\DiomktG.exe
  2⤵
  PID:16140
- C:\Windows\System\rSKvIbK.exe
  C:\Windows\System\rSKvIbK.exe
  2⤵
  PID:16264
- C:\Windows\System\axwTjhd.exe
  C:\Windows\System\axwTjhd.exe
  2⤵
  PID:16408
- - C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -u -p 16408 -s 248
    3⤵
    PID:16076
- C:\Windows\System\vfNScBA.exe
  C:\Windows\System\vfNScBA.exe
  2⤵
  PID:16428
- C:\Windows\System\gvMjFQL.exe
  C:\Windows\System\gvMjFQL.exe
  2⤵
  PID:16456
- C:\Windows\System\RFqFJRI.exe
  C:\Windows\System\RFqFJRI.exe
  2⤵
  PID:16476
- C:\Windows\System\fAUIliQ.exe
  C:\Windows\System\fAUIliQ.exe
  2⤵
  PID:16492
- C:\Windows\System\dygGQBS.exe
  C:\Windows\System\dygGQBS.exe
  2⤵
  PID:16508
- C:\Windows\System\ftACIlF.exe
  C:\Windows\System\ftACIlF.exe
  2⤵
  PID:16528
- C:\Windows\System\abKwACh.exe
  C:\Windows\System\abKwACh.exe
  2⤵
  PID:16548
- C:\Windows\System\kVUnuCh.exe
  C:\Windows\System\kVUnuCh.exe
  2⤵
  PID:16576
- C:\Windows\System\namEhmy.exe
  C:\Windows\System\namEhmy.exe
  2⤵
  PID:16596
- C:\Windows\System\sqwbikU.exe
  C:\Windows\System\sqwbikU.exe
  2⤵
  PID:16620
- C:\Windows\System\diWKAtG.exe
  C:\Windows\System\diWKAtG.exe
  2⤵
  PID:16636
- C:\Windows\System\diBlRJg.exe
  C:\Windows\System\diBlRJg.exe
  2⤵
  PID:16668
- C:\Windows\System\fAVqpHf.exe
  C:\Windows\System\fAVqpHf.exe
  2⤵
  PID:16684
- C:\Windows\System\cxrvzuY.exe
  C:\Windows\System\cxrvzuY.exe
  2⤵
  PID:16700
- C:\Windows\System\MHFttCn.exe
  C:\Windows\System\MHFttCn.exe
  2⤵
  PID:16724
- C:\Windows\System\beZcGgF.exe
  C:\Windows\System\beZcGgF.exe
  2⤵
  PID:16756
- C:\Windows\System\UNyRMUW.exe
  C:\Windows\System\UNyRMUW.exe
  2⤵
  PID:16776
- C:\Windows\System\yJPQdlQ.exe
  C:\Windows\System\yJPQdlQ.exe
  2⤵
  PID:16804
- C:\Windows\System\xRNoUZR.exe
  C:\Windows\System\xRNoUZR.exe
  2⤵
  PID:16828
- C:\Windows\System\lTkWDZZ.exe
  C:\Windows\System\lTkWDZZ.exe
  2⤵
  PID:16844
- C:\Windows\System\FfSDTLI.exe
  C:\Windows\System\FfSDTLI.exe
  2⤵
  PID:16868
- C:\Windows\System\xmzQacf.exe
  C:\Windows\System\xmzQacf.exe
  2⤵
  PID:16892
- C:\Windows\System\etKHfDK.exe
  C:\Windows\System\etKHfDK.exe
  2⤵
  PID:16916
- C:\Windows\System\QLHYmnJ.exe
  C:\Windows\System\QLHYmnJ.exe
  2⤵
  PID:16948
- C:\Windows\System\srLHWri.exe
  C:\Windows\System\srLHWri.exe
  2⤵
  PID:16976
- C:\Windows\System\DhIMJFf.exe
  C:\Windows\System\DhIMJFf.exe
  2⤵
  PID:16996
- C:\Windows\System\bUNPJYW.exe
  C:\Windows\System\bUNPJYW.exe
  2⤵
  PID:17028
- C:\Windows\System\DOGOUhD.exe
  C:\Windows\System\DOGOUhD.exe
  2⤵
  PID:17048
- C:\Windows\System\HasxUzG.exe
  C:\Windows\System\HasxUzG.exe
  2⤵
  PID:17076
- C:\Windows\System\ghzLoPI.exe
  C:\Windows\System\ghzLoPI.exe
  2⤵
  PID:17104
- C:\Windows\System\gTGtPIO.exe
  C:\Windows\System\gTGtPIO.exe
  2⤵
  PID:17132
- C:\Windows\System\TyBsPJO.exe
  C:\Windows\System\TyBsPJO.exe
  2⤵
  PID:16716
- C:\Windows\System\dQNisMr.exe
  C:\Windows\System\dQNisMr.exe
  2⤵
  PID:17140
- C:\Windows\System\suncYpR.exe
  C:\Windows\System\suncYpR.exe
  2⤵
  PID:16572
- C:\Windows\System\CIfqynv.exe
  C:\Windows\System\CIfqynv.exe
  2⤵
  PID:16900
- C:\Windows\System\wvgCtKH.exe
  C:\Windows\System\wvgCtKH.exe
  2⤵
  PID:16968
- C:\Windows\System\RlafPkK.exe
  C:\Windows\System\RlafPkK.exe
  2⤵
  PID:16696
- C:\Windows\System\ZysNHgQ.exe
  C:\Windows\System\ZysNHgQ.exe
  2⤵
  PID:16748

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:17128

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\AFdKjub.exe

Filesize
1.4MB

MD5
00613ec198a6c9676c1e77fea4d56eaf

SHA1
ed7b4c26f4f23726b0530c53e72b9fa9eb103843

SHA256
2eddaf379e22df69e2ca43da21a33cfde926c7ae8c8266cc4cd14b41ae2ffea6

SHA512
163c8d53b30f782c362723e29acae0712265ae4dc63a614eac2327c4bd2aaf53adc127af1d5b3f481197432a1d91b4f0e220b0b792cbe0e7741b0ecf7cfcba4c

Download Submit
C:\Windows\System\EkTeOeE.exe

Filesize
1.4MB

MD5
917293e4026a804beb24e943973620f4

SHA1
7eb86830e241ecf217421fbe3b42a3e2e43bc045

SHA256
dca36768970872703f497dbb27972cad95f82ea3232dbadd46b13ae380e9fbc3

SHA512
cb2d670e5e7d7bfc32a4fcb6950fa1070878b982c68a1f70dd5440df3b01ebfa719aa21e5bc3d6775fdd8313f17addc2da3d6dc33cf50ef866ddaeb1d3b680a8

Download Submit
C:\Windows\System\FMlmcfW.exe

Filesize
1.4MB

MD5
0f2a77bfc58dcb66300f0fb99be2a40a

SHA1
0fe927dcc548bf836627bee2e606d8d6b9675652

SHA256
361d05614283f68dc68494bd88aa0877f0a33887a04e3391b1f1ae3ed1c5f416

SHA512
4d4fe5210dc0015493a34c55e5c94c03b7b177927c16717baa9231fb7157551752544639e66c8c6027c3651e00eb6aef1b0bc3f3103366765d89d65aea206ba1

Download Submit
C:\Windows\System\ICKGwLy.exe

Filesize
1.4MB

MD5
98a773c876e764a0462817576060d6a3

SHA1
a2db92078c388e0d86cf17caf1d633f0b208dfa2

SHA256
aaf1daf2aea32afd187131beddaaad54d6cf54474c4fc59cd498650910615c63

SHA512
e922c57ab35df25f9563e60750a9b6248626c64b40a54eb7a06651b5500001feb1ce761917edabd6e9082f574878b6ce4ab8c2dd784d6c44ca8a6bca43abcf86

Download Submit
C:\Windows\System\MaDIwwP.exe

Filesize
1.4MB

MD5
8a142e978eb3c076dff8c2e56ec15a38

SHA1
d8d4864c6f410b22f7fea7225efd332d1ccb58d8

SHA256
edc7d75dfc887c9ad517b607c0f34580450fdc89007d8dd6247a45c278195317

SHA512
d17f2c8336c6eec586a1ee2669ec57da34d3ff06fc098fc098d20ba4bba4f65082d4d79be2630a67bc4fd17ef1fca88c4e5fa0e9f08313303e7cd776676b9c26

Download Submit
C:\Windows\System\Mfezouf.exe

Filesize
1.4MB

MD5
6b500d9384e5b50b1065cffe72f9546d

SHA1
b6a04690804c0d7baaf8d65ebe26aec5a5376753

SHA256
15038cd4c58c453c979786c6833557583b7eb9181a0d24efdd88f95e9cf9f60c

SHA512
a4730d4b3549cdb13a2179ec793535bf2c29102238f9eff614bb3f5930242ffd9dbb47f83ec63e8f09481cefff749b72b1ac05519ef21da8a526aad8ed5fe2be

Download Submit
C:\Windows\System\MmkTHzF.exe

Filesize
1.4MB

MD5
e7781ef9f257fa087ecb042fae7cd4d6

SHA1
be1391c20d187c33d30abb5d21bc4a542f2039ab

SHA256
d68ef896e7a3376a251d549dce26c3af94ebaa7ab75d6a8de69ab7b8d5e289ea

SHA512
e38d6998f82602fd5bf6aad282a4805ff76a6ec95e17c973d053673c019472492c755d147246dd6b8b1fd5f9e319a4c84ff8e8af2a754bdbe0bc3218d941c429

Download Submit
C:\Windows\System\OXphaLb.exe

Filesize
1.4MB

MD5
8942de3fc961fc064c6aa38707a47226

SHA1
2a1bea42af74e585721211ad07e514b6281244fc

SHA256
323ce7c6547e51d7d8d9fefa4f00b8216a67d3986f98ea7cd6525bfd4c4bc3a7

SHA512
36beb4077c210d868f6322c14b526a19519b65f49cdf043e8b06712b2a0d7bc9a8255423cf4a6b0274bbb0716dd9ed125b2c6685a6aea1d44cb3b48d3f178735

Download Submit
C:\Windows\System\ReDMruz.exe

Filesize
1.4MB

MD5
ad2ddd39ed7789569927c13caa0e96f8

SHA1
d8c0e8c3d8829dd556367d475adcebc1cf865a11

SHA256
c9ff62de8e29525474ca69f8b90fcfae0a70ed6dfeb5815d359f55ba5a2923d0

SHA512
d31b3589e806d187f0eabbf6bcdb057906637ac8eb572b2bde800f27bc317e8c4c5ca4e3b70d2a5709bf413191cfda3b0ed8ede81272de1a7b41178671502257

Download Submit
C:\Windows\System\SMeNJgM.exe

Filesize
1.4MB

MD5
f1216df587e3d304e5283d09260451b1

SHA1
107842fcbdb3d5014c9a416d75d3846082b66afd

SHA256
34d925ba05ba6820feec2e10af44940d64cab052013a65535adffd6291c8b22d

SHA512
8ed299e71a072e90740c05ea43ae89c8a22e9a939be319cdc5643bd849e253ab189de5139f4f2cc80791a8e4d8354a868e0fed9e536786b92b44438b903eea91

Download Submit
C:\Windows\System\TaFzZaR.exe

Filesize
1.4MB

MD5
7fe1ae2b4cbf0d6560c68339ce9d6c4b

SHA1
c4039ce5e4ec854ea3b96c6ad67917f7bf8ea1f7

SHA256
e212a2fd77dbc3f79fe91e9bb63b3374c8dac493c05e54715a95154df98de127

SHA512
754c42f7c6ccfc4e3d2646f6d2e34e0dd2f98b5676da8eaa35f6d6264abe3fb398febbae55b5a5b7ff9c8ce3dbfb5cc8c7d01935d4431b8925ccf4cba88fa2cd

Download Submit
C:\Windows\System\YwjBcJx.exe

Filesize
1.4MB

MD5
e43a8fcf2f5abb2282100b366ea2acb8

SHA1
ac85edea2a4f2d415e33f5c092a5371b76af6f35

SHA256
010255451d7a634a28fa06201a7732c90a2880320aff71617186c88caad68a95

SHA512
fdd7784c703dfbcd5ff6e4adc6e5143befb30476936169f01c19e72dfc741d6f19ac7731ad9af46d1ae49455f4a3b92b042f64181bfd4ce54f02355f8b10dac3

Download Submit
C:\Windows\System\ZyddXOx.exe

Filesize
1.4MB

MD5
b39d0ae347ba65cb2bf314e0a76754c4

SHA1
4f1046036670826db7466ad17a54f77d4494d0af

SHA256
797d6abdacfd5f7013c29c733866aff3ae60c34c04f6b90bfa9783fa525c83a0

SHA512
65db1911e240007ab684823999ef6e0dc4af54af45ce2efb61958afeab3f9d10e45825f852ad96eb9251b9e1d20425d1a6346d990900a5409cd84f464266d3d4

Download Submit
C:\Windows\System\aFhbINA.exe

Filesize
1.4MB

MD5
e8a1af51fbbb0089b9f3b1e350912233

SHA1
19aacb7cee677e30f766fc52b8e55c830f7077bd

SHA256
49d63ce0b727440c14b553b9648f60f373d55b883efc13b8b368da8a36899900

SHA512
39972788ce217664085b316227b299d95b462e808c50c55f160ac69da1f8b77e550e8ff413445de29d7fbfe058f676ef4d3e42d6713372701412acc93f31c13e

Download Submit
C:\Windows\System\aOOMutR.exe

Filesize
1.4MB

MD5
2c80954f6d68e2d6d34235688984469a

SHA1
71a7a19315a4535bc27d8ee037dbea9835cf743f

SHA256
35b27b46442db31afdbf76579628394e7f7a5dd14c1f60d1d11f46821224ea48

SHA512
8c8a9ee0d474a0166ca03dead34a6260826b7a428dd02ccd256d0513537f68b9061a6fa933fdd61a4a3749ccda92b3bd78cec9b497a46b9a50a26325fb762c46

Download Submit
C:\Windows\System\czNDdIE.exe

Filesize
1.4MB

MD5
afbd8b89706b8382c211dc6efaf1772d

SHA1
ee5a623ac75511374a632641e9068a2838b08164

SHA256
0bd690f1ba8810a9a1322d9f32795f51a8c4111b9c62be70d69aedf1d7a4dd2f

SHA512
5c3386785b5d6c1b22fd56032b0d8a31f1e4dda0c130bfa0fa7b3be0e4406b7eff6f4063faef43a1388b720498b203e74e2fe0b9c0b6ea943adb77c565380473

Download Submit
C:\Windows\System\grjEtuv.exe

Filesize
1.4MB

MD5
05098076d2924179db84e80da5891087

SHA1
4c6576ed0b5e5332a61c9a6001540f96077bec9c

SHA256
5d8e676ae9290ce20ede6f9804b364ad635a23beedd56152464aa2d05563b9d9

SHA512
58ea4a3509053a6b0cbcfb8759fe4b6cc530bb1b87bfc076fb65d0d04142cea03aa3b30ca15a7846012983125fb037c085fe82107214992f4fa48253690f155a

Download Submit
C:\Windows\System\gtWJIeN.exe

Filesize
1.4MB

MD5
02f16406aef3538a23b4db5e564ac9b3

SHA1
7367c0a72e6d93acbd52291909b17099eb9b2a78

SHA256
48cbb50d2033d6e81dc97c8e704caa5d74f26d86b2abc588606ff98d6676f9c8

SHA512
3c4f4e3f84b0784333dfaaa1e00fe25ddf02153acaaa3046f51c09ec24faf16616b25b3accefd90f88f1fc18988dc487345e1bfdf93c8c1308f2f4803c36de50

Download Submit
C:\Windows\System\gwUcXtv.exe

Filesize
1.4MB

MD5
5995eeb1cccf68eed30872a2cfe43c36

SHA1
57c75bdc21da1ba30af098b310e52f4714ee455f

SHA256
d54f6ef41a2425f4775f46a25d5bc9f9971d4c06b55f2174353e6d695cf7029c

SHA512
9c2df68f9a9d9fc249e34d312f35523f202d23734ab0a80af4ec0e361318403db656a47dd8eaca59920c8a3fd7ea47fb5d252f8e0638f7bc3d79b500ba5be37b

Download Submit
C:\Windows\System\iYlCfLQ.exe

Filesize
1.4MB

MD5
033dca114b1b1e3300bee4a129412b55

SHA1
2c9b57e1ed0033ca011c6f98723ad5624c9a2601

SHA256
10403dcf6fb474eee2c9f05c92f2cfb6f1de77ef2033de1e5eb66e5c08aedef8

SHA512
410f83a38071cdf4fe252c6730b8b7192a035f3b7624dfd973a02cfa8e5e4512e0c6e63f28826736987987aeff00ba6daf64d34cc8a1b349ae22632bcf63f611

Download Submit
C:\Windows\System\iwWqwjH.exe

Filesize
1.4MB

MD5
eea5740eae39f11a5b09918399adbf29

SHA1
30effb18488ea1f7c61614d9b9131ff4636ca1e8

SHA256
f1377ecbe8ef6643c73906eac5dd02b4acd2eea40f8a120503fe1a1ba90372ae

SHA512
bc9bfff0560e7a0e1911c98390be3dc432625c3f6989386335f840fe8faf04083e31d04ebe261cf7aeabea5cea3acaa2d922c1d87df4e2c28a065ddf5825ea04

Download Submit
C:\Windows\System\jNNlYZD.exe

Filesize
1.4MB

MD5
3d13265aea9b8e500f33d2e6e6e6fba2

SHA1
1856f8e112f5711b0b7741a96fed9988dd999bf9

SHA256
8ec0bb575508a0563cb2f8cfa4aa7d7a2286849eb2aa54303f5db5e0af8d55db

SHA512
674b9d68f2cb727885d336c5928c665270bfa03c60595247aa1863715aa360f2817bb7073c7145ffab2516268441a2b89e51e21e55c450f64a736d6328f2566d

Download Submit
C:\Windows\System\lUlMgCi.exe

Filesize
1.4MB

MD5
86165e03a50b3b564743a4dcb4f1b7e2

SHA1
536a634849881f259d33a4993b017a80dc09c4e2

SHA256
65791958c54640d51d53d266c015fcb9719de775416dbe11174ddf787ecb9465

SHA512
6592429010c762a93891c9c5ab33d94f353efa44aef0e6239aa64c3d7f1b4bcd5f57448bcbc0df39c8106649b0f1fb891f80226531553cf5b77c740a93dea4da

Download Submit
C:\Windows\System\muBUgwv.exe

Filesize
1.4MB

MD5
6302ebb8b359cc8f4961af9bae9894bf

SHA1
a3376dce7d446012eb6ad235729b6dd58c0922d2

SHA256
e74b6f0ffb2c02cbe2793e86293123215facbd6c38c03caa8795164203b30478

SHA512
f8ec75d336c05f9aec85e47ab6d7ede631d3f37be13a6a83f004d8675abf69b1cb9966c84a5a6f4371d9bdce865d971ba80d6828755ce14d8560284b0858536e

Download Submit
C:\Windows\System\nRYiHOu.exe

Filesize
1.4MB

MD5
09faea273c2b0fb4e3ab326ae4e05aa6

SHA1
c53449a7b0a0f0d3944c0d685a214de0f26f5cd6

SHA256
6fb34b405f19511cc44a7a5012cd9189ca84b5a5caff0bb69bbb36ed97a988c5

SHA512
4230e522fab669d5dc81a476aac0cfa65cec3d1aaab8d4d15a1661d90f9d025c9b25559d98e89dcff08a676366f7012762125343fe672d400ad3e223130ce4f1

Download Submit
C:\Windows\System\nfCIzuE.exe

Filesize
1.4MB

MD5
1ba9a18870928e11d3b6fa622135b9fe

SHA1
fb02980b2d934ccbc219a12d084daba09f605926

SHA256
f7751cb1333fdccbcb2b5d8832a53f79cde89c383e9a3deec8460b738ad45a94

SHA512
bed4c9e43b84eb7bf4a89b281531860b0383953e888f4bbcb0b2d38091f6fa354086db8b1833d061deae52e99eaf541ae85b4a3b3fd1e1b45b5721cd197fd1f8

Download Submit
C:\Windows\System\oYqkuSG.exe

Filesize
1.4MB

MD5
b719185ddc79e0a88fa18cf45013f1da

SHA1
1ac8ff8ca1613d874fd3c3c1fb2edcb7cf236a5f

SHA256
bc918462b3b652d752f5540d2b22e704ecae20037d77b7aeb5ff02dfe22763d4

SHA512
a98a82e39c0a1440334c8a82e23b8bc5b52165e7d7ef0a1fcc46b82f6a95f1373b3b0b3a6083cc59c2c3e6e351c6073d2c5e735b2d1d82c57bce9c042d2a9b7a

Download Submit
C:\Windows\System\pBUqqwz.exe

Filesize
1.4MB

MD5
3d0c2d8bd039152477f13c5b693a6acf

SHA1
9464c8e1c33ed7d9dd1f6eb0b9482db4ad81eaa5

SHA256
19603508e3fb914fb6efda91b52875baa6072dca3e182afa2fd0ec0537b2fdc1

SHA512
b1e915189d2e585e4dd5d90d733baac2ce626ccee3344b5b47e7eebcff8eab502285a937536b3221fd732c6c7be2b481ad64c7a20346b8948ce486d26564f663

Download Submit
C:\Windows\System\qtvyGFV.exe

Filesize
1.4MB

MD5
0d4fd4414bcc7932f4b2b2086c9d7213

SHA1
58fdbf488968c1db0a67fe23213f37e4e3b97568

SHA256
de6d9326acb8b3c7964179fbc36d0e05297fb8e44f10b28d47c0f51b79a95f0a

SHA512
01c48b477ff72f397b8cb096f481c5f733fa6706cdd4e63cfce0cd8877106e30a0516b1a5b24d2bd655aed887b6ecb541cf63f2c9d2e18ee8eb206394b0024fe

Download Submit
C:\Windows\System\sQdjTkw.exe

Filesize
1.4MB

MD5
fa5642bd6af47cf102daccc9276f50e1

SHA1
1558017110592c1adfb248a0c0a38c675825fd16

SHA256
d2ebf66151619f7e6ad129f52f92724de31c7d8f5a053ab6b37dc207427ac75d

SHA512
ae5e1acf1adcc93b1c9eaebf0dde8b4898bfeb82f3ed1bcee50a4ff1a73ea2f5c2edf7afd3e6b80805256797741f71119a12a8edcf585156f3110889493dbc29

Download Submit
C:\Windows\System\uphhzOi.exe

Filesize
1.4MB

MD5
89ede58b5766ae3520c892bf37e7a54b

SHA1
9ceb59e6c68ed5ed5ea00082f636253d0aa4cf05

SHA256
77ffb1341f7d3dac0dbf5096c806694fff86597fbc560086b88fec53b7d114ad

SHA512
609696f22c039fcc829a4e9aa37c20e430f0bba93109aaf3111406f0c6a3ef70cc7bb48dfbf95a5196a742b98cd95c7c456178cff845ca053b1d1bf0a9ab5e76

Download Submit
C:\Windows\System\uqvzTOj.exe

Filesize
1.4MB

MD5
1d0b70910322787336a9ba2faa661f9c

SHA1
85d56ca75b5718b382af667ac52237e6038d2bb3

SHA256
51321850e08cc2e57b0903f94720e522742431bfc439c6885ce42e2fce3707c3

SHA512
7e67b67dd76201a95a60663c6cdcbd76a0b0ff20fb2eee1fd3da0e408b1d240b03e8573ba02af6955a15a8905641ca2391b2382a77803cb525adeaba70b5fc01

Download Submit
memory/3632-0-0x00000282C96B0000-0x00000282C96C0000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads