xmrig | ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
21-12-2024 03:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe
Size

1.7MB
MD5

6208557397a6e9dccf6fcfc3405835a3
SHA1

57e9ff8a809f3c4a63c759f053fd2ae97cb43add
SHA256

ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f
SHA512

573ecdc2fba7d0001e863ab3d7c6946e7fc31668941b1bcecb24d1786562ab6652eb2def7b90006b76f347ebef23d461aea11d91bcba429184f6253307d3a844
SSDEEP

49152:GezaTF8FcNkNdfE0pZ9ozttwIRxj4c5yOBZnQbZLjAN:GemTLkNdfE0pZyL

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 33 IoCs

miner

resource	yara_rule
behavioral2/files/0x000c000000023b9c-4.dat	xmrig
behavioral2/files/0x0007000000023c86-9.dat	xmrig
behavioral2/files/0x0007000000023c87-8.dat	xmrig
behavioral2/files/0x0007000000023c88-17.dat	xmrig
behavioral2/files/0x0007000000023c89-23.dat	xmrig
behavioral2/files/0x0007000000023c8a-29.dat	xmrig
behavioral2/files/0x0007000000023c8b-32.dat	xmrig
behavioral2/files/0x0007000000023c8c-37.dat	xmrig
behavioral2/files/0x0007000000023c8d-41.dat	xmrig
behavioral2/files/0x0007000000023c90-57.dat	xmrig
behavioral2/files/0x0007000000023c91-70.dat	xmrig
behavioral2/files/0x0007000000023c93-80.dat	xmrig
behavioral2/files/0x0007000000023c9a-107.dat	xmrig
behavioral2/files/0x0007000000023c9d-122.dat	xmrig
behavioral2/files/0x0007000000023ca0-137.dat	xmrig
behavioral2/files/0x0007000000023ca5-162.dat	xmrig
behavioral2/files/0x0007000000023ca3-160.dat	xmrig
behavioral2/files/0x0007000000023ca4-157.dat	xmrig
behavioral2/files/0x0007000000023ca2-155.dat	xmrig
behavioral2/files/0x0007000000023ca1-150.dat	xmrig
behavioral2/files/0x0007000000023c9f-140.dat	xmrig
behavioral2/files/0x0007000000023c9e-135.dat	xmrig
behavioral2/files/0x0007000000023c9c-125.dat	xmrig
behavioral2/files/0x0007000000023c9b-120.dat	xmrig
behavioral2/files/0x0007000000023c99-110.dat	xmrig
behavioral2/files/0x0007000000023c98-105.dat	xmrig
behavioral2/files/0x0007000000023c97-100.dat	xmrig
behavioral2/files/0x0007000000023c96-95.dat	xmrig
behavioral2/files/0x0007000000023c95-90.dat	xmrig
behavioral2/files/0x0007000000023c94-85.dat	xmrig
behavioral2/files/0x0007000000023c92-75.dat	xmrig
behavioral2/files/0x0007000000023c8f-60.dat	xmrig
behavioral2/files/0x0007000000023c8e-55.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2376	kvQsCXX.exe
2340	NRaRMqz.exe
1664	RSNHUCm.exe
3760	HigHjYX.exe
1592	DXYuzmZ.exe
2908	DlcOFWn.exe
4972	ZNHXoWs.exe
4264	drZdVwQ.exe
1984	lJqFZfX.exe
4760	QquTrRN.exe
464	qVpNHQM.exe
1512	tGsDIDI.exe
2852	lKhLVbI.exe
1700	cIcapkp.exe
996	xFKiXjP.exe
1768	fbBkUQY.exe
2412	HSfthQd.exe
4584	UqOFRxg.exe
4576	qNddIEu.exe
3232	lhYhAbt.exe
3412	AGgFzrV.exe
1300	DKLsRkv.exe
5052	FBBsLde.exe
3692	hrWXeHk.exe
2604	cxHEIVe.exe
4788	ngeRLST.exe
3460	QikHjka.exe
3816	AuQNblx.exe
3920	Skrewfk.exe
976	lJDTtzt.exe
316	LEhvcWS.exe
4956	tpKSEVD.exe
1256	NMPWhLc.exe
112	ZeOqlDw.exe
5044	vRFeWAF.exe
3680	BfBzmoT.exe
2504	giohhqn.exe
3052	KaPBiwL.exe
4556	wyDBNod.exe
672	KqYedKP.exe
5008	NZBLGrW.exe
4548	STorYkN.exe
2204	rVercKc.exe
3504	UMdZbNF.exe
2476	KyYvmrY.exe
2544	QTwFaKN.exe
4420	SDbkneM.exe
4476	AcvurEe.exe
3416	wnOoaxW.exe
632	XBiEqQX.exe
2860	LdDNgtc.exe
2668	EGnMrFq.exe
1476	VeORkxV.exe
4880	umkRFsw.exe
2832	OaYxdJP.exe
1872	ROneaQU.exe
396	aXOvskW.exe
3536	khGFhGQ.exe
4692	oqHklXo.exe
3344	sqinYqg.exe
3684	FpfwlUA.exe
460	wUHhHfo.exe
3472	oysvSqs.exe
3848	KTPVFrb.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\kuLGTWG.exe	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe
File created	C:\Windows\System\PgYDTni.exe	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe
File created	C:\Windows\System\DietCRw.exe	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe
File created	C:\Windows\System\UjGZYlh.exe	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe
File created	C:\Windows\System\SMToPAH.exe	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe
File created	C:\Windows\System\EHccasi.exe	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe
File created	C:\Windows\System\AChaoWb.exe	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe
File created	C:\Windows\System\oyaCiqj.exe	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe
File created	C:\Windows\System\rsvBEfu.exe	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe
File created	C:\Windows\System\TqetCcg.exe	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe
File created	C:\Windows\System\QyfhWvy.exe	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe
File created	C:\Windows\System\YucFJqD.exe	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe
File created	C:\Windows\System\DKZdBSC.exe	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe
File created	C:\Windows\System\yTwOmqW.exe	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe
File created	C:\Windows\System\sMEjWor.exe	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe
File created	C:\Windows\System\cstdkJp.exe	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe
File created	C:\Windows\System\zoipHqA.exe	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe
File created	C:\Windows\System\nmLcqxm.exe	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe
File created	C:\Windows\System\GEGLnnn.exe	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe
File created	C:\Windows\System\elPjOAn.exe	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe
File created	C:\Windows\System\ANRjBYu.exe	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe
File created	C:\Windows\System\ZCSbSuo.exe	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe
File created	C:\Windows\System\KqYedKP.exe	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe
File created	C:\Windows\System\UfSjFVJ.exe	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe
File created	C:\Windows\System\DxMveOJ.exe	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe
File created	C:\Windows\System\BqZUPki.exe	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe
File created	C:\Windows\System\jsnloBY.exe	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe
File created	C:\Windows\System\oxCmrSy.exe	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe
File created	C:\Windows\System\lgdtfAF.exe	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe
File created	C:\Windows\System\NrXIytx.exe	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe
File created	C:\Windows\System\UtanQWm.exe	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe
File created	C:\Windows\System\Bawaplj.exe	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe
File created	C:\Windows\System\VYUbvTQ.exe	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe
File created	C:\Windows\System\meBxjsA.exe	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe
File created	C:\Windows\System\dXqWHLt.exe	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe
File created	C:\Windows\System\TnRQzPM.exe	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe
File created	C:\Windows\System\UhWEYqG.exe	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe
File created	C:\Windows\System\AbPGsgk.exe	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe
File created	C:\Windows\System\eTVZixp.exe	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe
File created	C:\Windows\System\oaCfQsj.exe	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe
File created	C:\Windows\System\JtWbJXs.exe	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe
File created	C:\Windows\System\vQnsNNC.exe	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe
File created	C:\Windows\System\zCOioXl.exe	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe
File created	C:\Windows\System\nlSjTkb.exe	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe
File created	C:\Windows\System\sJoUchU.exe	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe
File created	C:\Windows\System\JsjkUCe.exe	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe
File created	C:\Windows\System\nXepkDW.exe	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe
File created	C:\Windows\System\QRgEsIR.exe	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe
File created	C:\Windows\System\yXItnKr.exe	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe
File created	C:\Windows\System\kMfqhZm.exe	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe
File created	C:\Windows\System\YgmKQkS.exe	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe
File created	C:\Windows\System\qTNRSZv.exe	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe
File created	C:\Windows\System\ZjdCEzZ.exe	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe
File created	C:\Windows\System\drlygAm.exe	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe
File created	C:\Windows\System\xKoPHvz.exe	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe
File created	C:\Windows\System\nemNBhn.exe	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe
File created	C:\Windows\System\qeAZtKI.exe	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe
File created	C:\Windows\System\OhBdDVH.exe	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe
File created	C:\Windows\System\SDsstEf.exe	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe
File created	C:\Windows\System\XuISnOW.exe	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe
File created	C:\Windows\System\lKhLVbI.exe	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe
File created	C:\Windows\System\Bvalmvk.exe	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe
File created	C:\Windows\System\yccuEgw.exe	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe
File created	C:\Windows\System\BUIYIPt.exe	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	14356	dwm.exe
Token: SeChangeNotifyPrivilege	14356	dwm.exe
Token: 33	14356	dwm.exe
Token: SeIncBasePriorityPrivilege	14356	dwm.exe
Token: SeShutdownPrivilege	14356	dwm.exe
Token: SeCreatePagefilePrivilege	14356	dwm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 728 wrote to memory of 2376	728	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe	84
PID 728 wrote to memory of 2376	728	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe	84
PID 728 wrote to memory of 2340	728	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe	85
PID 728 wrote to memory of 2340	728	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe	85
PID 728 wrote to memory of 1664	728	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe	86
PID 728 wrote to memory of 1664	728	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe	86
PID 728 wrote to memory of 3760	728	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe	87
PID 728 wrote to memory of 3760	728	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe	87
PID 728 wrote to memory of 1592	728	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe	88
PID 728 wrote to memory of 1592	728	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe	88
PID 728 wrote to memory of 2908	728	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe	89
PID 728 wrote to memory of 2908	728	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe	89
PID 728 wrote to memory of 4972	728	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe	90
PID 728 wrote to memory of 4972	728	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe	90
PID 728 wrote to memory of 4264	728	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe	91
PID 728 wrote to memory of 4264	728	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe	91
PID 728 wrote to memory of 1984	728	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe	92
PID 728 wrote to memory of 1984	728	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe	92
PID 728 wrote to memory of 4760	728	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe	93
PID 728 wrote to memory of 4760	728	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe	93
PID 728 wrote to memory of 464	728	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe	94
PID 728 wrote to memory of 464	728	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe	94
PID 728 wrote to memory of 1512	728	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe	95
PID 728 wrote to memory of 1512	728	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe	95
PID 728 wrote to memory of 2852	728	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe	96
PID 728 wrote to memory of 2852	728	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe	96
PID 728 wrote to memory of 1700	728	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe	97
PID 728 wrote to memory of 1700	728	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe	97
PID 728 wrote to memory of 996	728	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe	98
PID 728 wrote to memory of 996	728	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe	98
PID 728 wrote to memory of 1768	728	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe	99
PID 728 wrote to memory of 1768	728	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe	99
PID 728 wrote to memory of 2412	728	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe	100
PID 728 wrote to memory of 2412	728	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe	100
PID 728 wrote to memory of 4584	728	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe	101
PID 728 wrote to memory of 4584	728	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe	101
PID 728 wrote to memory of 4576	728	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe	102
PID 728 wrote to memory of 4576	728	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe	102
PID 728 wrote to memory of 3232	728	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe	103
PID 728 wrote to memory of 3232	728	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe	103
PID 728 wrote to memory of 3412	728	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe	104
PID 728 wrote to memory of 3412	728	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe	104
PID 728 wrote to memory of 1300	728	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe	105
PID 728 wrote to memory of 1300	728	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe	105
PID 728 wrote to memory of 5052	728	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe	106
PID 728 wrote to memory of 5052	728	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe	106
PID 728 wrote to memory of 3692	728	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe	107
PID 728 wrote to memory of 3692	728	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe	107
PID 728 wrote to memory of 2604	728	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe	108
PID 728 wrote to memory of 2604	728	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe	108
PID 728 wrote to memory of 4788	728	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe	109
PID 728 wrote to memory of 4788	728	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe	109
PID 728 wrote to memory of 3460	728	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe	110
PID 728 wrote to memory of 3460	728	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe	110
PID 728 wrote to memory of 3816	728	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe	111
PID 728 wrote to memory of 3816	728	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe	111
PID 728 wrote to memory of 3920	728	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe	112
PID 728 wrote to memory of 3920	728	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe	112
PID 728 wrote to memory of 976	728	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe	113
PID 728 wrote to memory of 976	728	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe	113
PID 728 wrote to memory of 316	728	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe	114
PID 728 wrote to memory of 316	728	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe	114
PID 728 wrote to memory of 4956	728	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe	115
PID 728 wrote to memory of 4956	728	ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe	115

C:\Users\Admin\AppData\Local\Temp\ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe
"C:\Users\Admin\AppData\Local\Temp\ab07a71c6c3708ca5d46b54c8500eea0a37df1070b3ae57ca8bbe5f09a99811f.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:728
- C:\Windows\System\kvQsCXX.exe
  C:\Windows\System\kvQsCXX.exe
  2⤵
  - Executes dropped EXE
  PID:2376
- C:\Windows\System\NRaRMqz.exe
  C:\Windows\System\NRaRMqz.exe
  2⤵
  - Executes dropped EXE
  PID:2340
- C:\Windows\System\RSNHUCm.exe
  C:\Windows\System\RSNHUCm.exe
  2⤵
  - Executes dropped EXE
  PID:1664
- C:\Windows\System\HigHjYX.exe
  C:\Windows\System\HigHjYX.exe
  2⤵
  - Executes dropped EXE
  PID:3760
- C:\Windows\System\DXYuzmZ.exe
  C:\Windows\System\DXYuzmZ.exe
  2⤵
  - Executes dropped EXE
  PID:1592
- C:\Windows\System\DlcOFWn.exe
  C:\Windows\System\DlcOFWn.exe
  2⤵
  - Executes dropped EXE
  PID:2908
- C:\Windows\System\ZNHXoWs.exe
  C:\Windows\System\ZNHXoWs.exe
  2⤵
  - Executes dropped EXE
  PID:4972
- C:\Windows\System\drZdVwQ.exe
  C:\Windows\System\drZdVwQ.exe
  2⤵
  - Executes dropped EXE
  PID:4264
- C:\Windows\System\lJqFZfX.exe
  C:\Windows\System\lJqFZfX.exe
  2⤵
  - Executes dropped EXE
  PID:1984
- C:\Windows\System\QquTrRN.exe
  C:\Windows\System\QquTrRN.exe
  2⤵
  - Executes dropped EXE
  PID:4760
- C:\Windows\System\qVpNHQM.exe
  C:\Windows\System\qVpNHQM.exe
  2⤵
  - Executes dropped EXE
  PID:464
- C:\Windows\System\tGsDIDI.exe
  C:\Windows\System\tGsDIDI.exe
  2⤵
  - Executes dropped EXE
  PID:1512
- C:\Windows\System\lKhLVbI.exe
  C:\Windows\System\lKhLVbI.exe
  2⤵
  - Executes dropped EXE
  PID:2852
- C:\Windows\System\cIcapkp.exe
  C:\Windows\System\cIcapkp.exe
  2⤵
  - Executes dropped EXE
  PID:1700
- C:\Windows\System\xFKiXjP.exe
  C:\Windows\System\xFKiXjP.exe
  2⤵
  - Executes dropped EXE
  PID:996
- C:\Windows\System\fbBkUQY.exe
  C:\Windows\System\fbBkUQY.exe
  2⤵
  - Executes dropped EXE
  PID:1768
- C:\Windows\System\HSfthQd.exe
  C:\Windows\System\HSfthQd.exe
  2⤵
  - Executes dropped EXE
  PID:2412
- C:\Windows\System\UqOFRxg.exe
  C:\Windows\System\UqOFRxg.exe
  2⤵
  - Executes dropped EXE
  PID:4584
- C:\Windows\System\qNddIEu.exe
  C:\Windows\System\qNddIEu.exe
  2⤵
  - Executes dropped EXE
  PID:4576
- C:\Windows\System\lhYhAbt.exe
  C:\Windows\System\lhYhAbt.exe
  2⤵
  - Executes dropped EXE
  PID:3232
- C:\Windows\System\AGgFzrV.exe
  C:\Windows\System\AGgFzrV.exe
  2⤵
  - Executes dropped EXE
  PID:3412
- C:\Windows\System\DKLsRkv.exe
  C:\Windows\System\DKLsRkv.exe
  2⤵
  - Executes dropped EXE
  PID:1300
- C:\Windows\System\FBBsLde.exe
  C:\Windows\System\FBBsLde.exe
  2⤵
  - Executes dropped EXE
  PID:5052
- C:\Windows\System\hrWXeHk.exe
  C:\Windows\System\hrWXeHk.exe
  2⤵
  - Executes dropped EXE
  PID:3692
- C:\Windows\System\cxHEIVe.exe
  C:\Windows\System\cxHEIVe.exe
  2⤵
  - Executes dropped EXE
  PID:2604
- C:\Windows\System\ngeRLST.exe
  C:\Windows\System\ngeRLST.exe
  2⤵
  - Executes dropped EXE
  PID:4788
- C:\Windows\System\QikHjka.exe
  C:\Windows\System\QikHjka.exe
  2⤵
  - Executes dropped EXE
  PID:3460
- C:\Windows\System\AuQNblx.exe
  C:\Windows\System\AuQNblx.exe
  2⤵
  - Executes dropped EXE
  PID:3816
- C:\Windows\System\Skrewfk.exe
  C:\Windows\System\Skrewfk.exe
  2⤵
  - Executes dropped EXE
  PID:3920
- C:\Windows\System\lJDTtzt.exe
  C:\Windows\System\lJDTtzt.exe
  2⤵
  - Executes dropped EXE
  PID:976
- C:\Windows\System\LEhvcWS.exe
  C:\Windows\System\LEhvcWS.exe
  2⤵
  - Executes dropped EXE
  PID:316
- C:\Windows\System\tpKSEVD.exe
  C:\Windows\System\tpKSEVD.exe
  2⤵
  - Executes dropped EXE
  PID:4956
- C:\Windows\System\NMPWhLc.exe
  C:\Windows\System\NMPWhLc.exe
  2⤵
  - Executes dropped EXE
  PID:1256
- C:\Windows\System\ZeOqlDw.exe
  C:\Windows\System\ZeOqlDw.exe
  2⤵
  - Executes dropped EXE
  PID:112
- C:\Windows\System\vRFeWAF.exe
  C:\Windows\System\vRFeWAF.exe
  2⤵
  - Executes dropped EXE
  PID:5044
- C:\Windows\System\BfBzmoT.exe
  C:\Windows\System\BfBzmoT.exe
  2⤵
  - Executes dropped EXE
  PID:3680
- C:\Windows\System\giohhqn.exe
  C:\Windows\System\giohhqn.exe
  2⤵
  - Executes dropped EXE
  PID:2504
- C:\Windows\System\KaPBiwL.exe
  C:\Windows\System\KaPBiwL.exe
  2⤵
  - Executes dropped EXE
  PID:3052
- C:\Windows\System\wyDBNod.exe
  C:\Windows\System\wyDBNod.exe
  2⤵
  - Executes dropped EXE
  PID:4556
- C:\Windows\System\KqYedKP.exe
  C:\Windows\System\KqYedKP.exe
  2⤵
  - Executes dropped EXE
  PID:672
- C:\Windows\System\NZBLGrW.exe
  C:\Windows\System\NZBLGrW.exe
  2⤵
  - Executes dropped EXE
  PID:5008
- C:\Windows\System\STorYkN.exe
  C:\Windows\System\STorYkN.exe
  2⤵
  - Executes dropped EXE
  PID:4548
- C:\Windows\System\rVercKc.exe
  C:\Windows\System\rVercKc.exe
  2⤵
  - Executes dropped EXE
  PID:2204
- C:\Windows\System\UMdZbNF.exe
  C:\Windows\System\UMdZbNF.exe
  2⤵
  - Executes dropped EXE
  PID:3504
- C:\Windows\System\KyYvmrY.exe
  C:\Windows\System\KyYvmrY.exe
  2⤵
  - Executes dropped EXE
  PID:2476
- C:\Windows\System\QTwFaKN.exe
  C:\Windows\System\QTwFaKN.exe
  2⤵
  - Executes dropped EXE
  PID:2544
- C:\Windows\System\SDbkneM.exe
  C:\Windows\System\SDbkneM.exe
  2⤵
  - Executes dropped EXE
  PID:4420
- C:\Windows\System\AcvurEe.exe
  C:\Windows\System\AcvurEe.exe
  2⤵
  - Executes dropped EXE
  PID:4476
- C:\Windows\System\wnOoaxW.exe
  C:\Windows\System\wnOoaxW.exe
  2⤵
  - Executes dropped EXE
  PID:3416
- C:\Windows\System\XBiEqQX.exe
  C:\Windows\System\XBiEqQX.exe
  2⤵
  - Executes dropped EXE
  PID:632
- C:\Windows\System\LdDNgtc.exe
  C:\Windows\System\LdDNgtc.exe
  2⤵
  - Executes dropped EXE
  PID:2860
- C:\Windows\System\EGnMrFq.exe
  C:\Windows\System\EGnMrFq.exe
  2⤵
  - Executes dropped EXE
  PID:2668
- C:\Windows\System\VeORkxV.exe
  C:\Windows\System\VeORkxV.exe
  2⤵
  - Executes dropped EXE
  PID:1476
- C:\Windows\System\umkRFsw.exe
  C:\Windows\System\umkRFsw.exe
  2⤵
  - Executes dropped EXE
  PID:4880
- C:\Windows\System\OaYxdJP.exe
  C:\Windows\System\OaYxdJP.exe
  2⤵
  - Executes dropped EXE
  PID:2832
- C:\Windows\System\ROneaQU.exe
  C:\Windows\System\ROneaQU.exe
  2⤵
  - Executes dropped EXE
  PID:1872
- C:\Windows\System\aXOvskW.exe
  C:\Windows\System\aXOvskW.exe
  2⤵
  - Executes dropped EXE
  PID:396
- C:\Windows\System\khGFhGQ.exe
  C:\Windows\System\khGFhGQ.exe
  2⤵
  - Executes dropped EXE
  PID:3536
- C:\Windows\System\oqHklXo.exe
  C:\Windows\System\oqHklXo.exe
  2⤵
  - Executes dropped EXE
  PID:4692
- C:\Windows\System\sqinYqg.exe
  C:\Windows\System\sqinYqg.exe
  2⤵
  - Executes dropped EXE
  PID:3344
- C:\Windows\System\FpfwlUA.exe
  C:\Windows\System\FpfwlUA.exe
  2⤵
  - Executes dropped EXE
  PID:3684
- C:\Windows\System\wUHhHfo.exe
  C:\Windows\System\wUHhHfo.exe
  2⤵
  - Executes dropped EXE
  PID:460
- C:\Windows\System\oysvSqs.exe
  C:\Windows\System\oysvSqs.exe
  2⤵
  - Executes dropped EXE
  PID:3472
- C:\Windows\System\KTPVFrb.exe
  C:\Windows\System\KTPVFrb.exe
  2⤵
  - Executes dropped EXE
  PID:3848
- C:\Windows\System\mCwcKin.exe
  C:\Windows\System\mCwcKin.exe
  2⤵
  PID:2432
- C:\Windows\System\gbBMgqt.exe
  C:\Windows\System\gbBMgqt.exe
  2⤵
  PID:4188
- C:\Windows\System\XiMTPnj.exe
  C:\Windows\System\XiMTPnj.exe
  2⤵
  PID:5092
- C:\Windows\System\oQEYXjB.exe
  C:\Windows\System\oQEYXjB.exe
  2⤵
  PID:808
- C:\Windows\System\CnfPIHW.exe
  C:\Windows\System\CnfPIHW.exe
  2⤵
  PID:4380
- C:\Windows\System\BXlRGKb.exe
  C:\Windows\System\BXlRGKb.exe
  2⤵
  PID:1596
- C:\Windows\System\SXkwiYs.exe
  C:\Windows\System\SXkwiYs.exe
  2⤵
  PID:1320
- C:\Windows\System\XZhNNNX.exe
  C:\Windows\System\XZhNNNX.exe
  2⤵
  PID:4836
- C:\Windows\System\keKrWes.exe
  C:\Windows\System\keKrWes.exe
  2⤵
  PID:3228
- C:\Windows\System\rIushVQ.exe
  C:\Windows\System\rIushVQ.exe
  2⤵
  PID:2312
- C:\Windows\System\RMGXGZM.exe
  C:\Windows\System\RMGXGZM.exe
  2⤵
  PID:3964
- C:\Windows\System\gqjLStw.exe
  C:\Windows\System\gqjLStw.exe
  2⤵
  PID:4448
- C:\Windows\System\kgRjJPz.exe
  C:\Windows\System\kgRjJPz.exe
  2⤵
  PID:5136
- C:\Windows\System\KbFKFId.exe
  C:\Windows\System\KbFKFId.exe
  2⤵
  PID:5152
- C:\Windows\System\urdRbOO.exe
  C:\Windows\System\urdRbOO.exe
  2⤵
  PID:5180
- C:\Windows\System\gaZIxvg.exe
  C:\Windows\System\gaZIxvg.exe
  2⤵
  PID:5208
- C:\Windows\System\zCOioXl.exe
  C:\Windows\System\zCOioXl.exe
  2⤵
  PID:5232
- C:\Windows\System\CxkdEjn.exe
  C:\Windows\System\CxkdEjn.exe
  2⤵
  PID:5260
- C:\Windows\System\MjqXcJC.exe
  C:\Windows\System\MjqXcJC.exe
  2⤵
  PID:5288
- C:\Windows\System\WCGitsg.exe
  C:\Windows\System\WCGitsg.exe
  2⤵
  PID:5320
- C:\Windows\System\YxJlDdB.exe
  C:\Windows\System\YxJlDdB.exe
  2⤵
  PID:5348
- C:\Windows\System\QhktJdX.exe
  C:\Windows\System\QhktJdX.exe
  2⤵
  PID:5372
- C:\Windows\System\dZSQVUg.exe
  C:\Windows\System\dZSQVUg.exe
  2⤵
  PID:5400
- C:\Windows\System\ioCItCo.exe
  C:\Windows\System\ioCItCo.exe
  2⤵
  PID:5432
- C:\Windows\System\jsnloBY.exe
  C:\Windows\System\jsnloBY.exe
  2⤵
  PID:5456
- C:\Windows\System\GHXrJyU.exe
  C:\Windows\System\GHXrJyU.exe
  2⤵
  PID:5484
- C:\Windows\System\XiGqpkn.exe
  C:\Windows\System\XiGqpkn.exe
  2⤵
  PID:5512
- C:\Windows\System\zQzMIIm.exe
  C:\Windows\System\zQzMIIm.exe
  2⤵
  PID:5540
- C:\Windows\System\QSfLnJf.exe
  C:\Windows\System\QSfLnJf.exe
  2⤵
  PID:5568
- C:\Windows\System\zyJKFUu.exe
  C:\Windows\System\zyJKFUu.exe
  2⤵
  PID:5604
- C:\Windows\System\SgAvWJB.exe
  C:\Windows\System\SgAvWJB.exe
  2⤵
  PID:5632
- C:\Windows\System\oHpqbmq.exe
  C:\Windows\System\oHpqbmq.exe
  2⤵
  PID:5660
- C:\Windows\System\pEHyZsu.exe
  C:\Windows\System\pEHyZsu.exe
  2⤵
  PID:5688
- C:\Windows\System\EnfAJWN.exe
  C:\Windows\System\EnfAJWN.exe
  2⤵
  PID:5712
- C:\Windows\System\craEhTN.exe
  C:\Windows\System\craEhTN.exe
  2⤵
  PID:5736
- C:\Windows\System\EBSquBS.exe
  C:\Windows\System\EBSquBS.exe
  2⤵
  PID:5768
- C:\Windows\System\IWfexQl.exe
  C:\Windows\System\IWfexQl.exe
  2⤵
  PID:5792
- C:\Windows\System\qgGujPR.exe
  C:\Windows\System\qgGujPR.exe
  2⤵
  PID:5820
- C:\Windows\System\xzrqpet.exe
  C:\Windows\System\xzrqpet.exe
  2⤵
  PID:5852
- C:\Windows\System\siOKliZ.exe
  C:\Windows\System\siOKliZ.exe
  2⤵
  PID:5876
- C:\Windows\System\mZnRwqm.exe
  C:\Windows\System\mZnRwqm.exe
  2⤵
  PID:5904
- C:\Windows\System\jFLhhhR.exe
  C:\Windows\System\jFLhhhR.exe
  2⤵
  PID:5936
- C:\Windows\System\bRvFJgR.exe
  C:\Windows\System\bRvFJgR.exe
  2⤵
  PID:5960
- C:\Windows\System\Bvalmvk.exe
  C:\Windows\System\Bvalmvk.exe
  2⤵
  PID:5992
- C:\Windows\System\QOlvzit.exe
  C:\Windows\System\QOlvzit.exe
  2⤵
  PID:6016
- C:\Windows\System\nEcxbFd.exe
  C:\Windows\System\nEcxbFd.exe
  2⤵
  PID:6044
- C:\Windows\System\hCkoDEd.exe
  C:\Windows\System\hCkoDEd.exe
  2⤵
  PID:6072
- C:\Windows\System\nQPbvFH.exe
  C:\Windows\System\nQPbvFH.exe
  2⤵
  PID:6104
- C:\Windows\System\OYZGJGM.exe
  C:\Windows\System\OYZGJGM.exe
  2⤵
  PID:6128
- C:\Windows\System\IdPiuuw.exe
  C:\Windows\System\IdPiuuw.exe
  2⤵
  PID:540
- C:\Windows\System\NJqCEBq.exe
  C:\Windows\System\NJqCEBq.exe
  2⤵
  PID:4392
- C:\Windows\System\nlSjTkb.exe
  C:\Windows\System\nlSjTkb.exe
  2⤵
  PID:1532
- C:\Windows\System\TRIVhEy.exe
  C:\Windows\System\TRIVhEy.exe
  2⤵
  PID:3120
- C:\Windows\System\pqNbQfq.exe
  C:\Windows\System\pqNbQfq.exe
  2⤵
  PID:4408
- C:\Windows\System\iVEZAQA.exe
  C:\Windows\System\iVEZAQA.exe
  2⤵
  PID:5164
- C:\Windows\System\YucFJqD.exe
  C:\Windows\System\YucFJqD.exe
  2⤵
  PID:5228
- C:\Windows\System\FRRjNtT.exe
  C:\Windows\System\FRRjNtT.exe
  2⤵
  PID:5284
- C:\Windows\System\IYOwePe.exe
  C:\Windows\System\IYOwePe.exe
  2⤵
  PID:5364
- C:\Windows\System\AWpjikm.exe
  C:\Windows\System\AWpjikm.exe
  2⤵
  PID:5424
- C:\Windows\System\YbDWrhI.exe
  C:\Windows\System\YbDWrhI.exe
  2⤵
  PID:5480
- C:\Windows\System\mRosxWC.exe
  C:\Windows\System\mRosxWC.exe
  2⤵
  PID:5556
- C:\Windows\System\XooYkrd.exe
  C:\Windows\System\XooYkrd.exe
  2⤵
  PID:5652
- C:\Windows\System\anzokgB.exe
  C:\Windows\System\anzokgB.exe
  2⤵
  PID:5724
- C:\Windows\System\OhBdDVH.exe
  C:\Windows\System\OhBdDVH.exe
  2⤵
  PID:5868
- C:\Windows\System\dWIaFWz.exe
  C:\Windows\System\dWIaFWz.exe
  2⤵
  PID:5928
- C:\Windows\System\VJzIdDd.exe
  C:\Windows\System\VJzIdDd.exe
  2⤵
  PID:1092
- C:\Windows\System\nmLcqxm.exe
  C:\Windows\System\nmLcqxm.exe
  2⤵
  PID:6064
- C:\Windows\System\RnKtaFu.exe
  C:\Windows\System\RnKtaFu.exe
  2⤵
  PID:6120
- C:\Windows\System\HjVEuBR.exe
  C:\Windows\System\HjVEuBR.exe
  2⤵
  PID:3424
- C:\Windows\System\cOEfRTv.exe
  C:\Windows\System\cOEfRTv.exe
  2⤵
  PID:740
- C:\Windows\System\gavxXqo.exe
  C:\Windows\System\gavxXqo.exe
  2⤵
  PID:5196
- C:\Windows\System\wTQzJTk.exe
  C:\Windows\System\wTQzJTk.exe
  2⤵
  PID:5340
- C:\Windows\System\FtLEFul.exe
  C:\Windows\System\FtLEFul.exe
  2⤵
  PID:5396
- C:\Windows\System\JeJKssp.exe
  C:\Windows\System\JeJKssp.exe
  2⤵
  PID:4340
- C:\Windows\System\ejyZhYd.exe
  C:\Windows\System\ejyZhYd.exe
  2⤵
  PID:4876
- C:\Windows\System\psrWyLn.exe
  C:\Windows\System\psrWyLn.exe
  2⤵
  PID:2164
- C:\Windows\System\qTNRSZv.exe
  C:\Windows\System\qTNRSZv.exe
  2⤵
  PID:2052
- C:\Windows\System\ykLyUvF.exe
  C:\Windows\System\ykLyUvF.exe
  2⤵
  PID:1408
- C:\Windows\System\Hormeit.exe
  C:\Windows\System\Hormeit.exe
  2⤵
  PID:1176
- C:\Windows\System\QFtFHVi.exe
  C:\Windows\System\QFtFHVi.exe
  2⤵
  PID:2368
- C:\Windows\System\wgmWZrp.exe
  C:\Windows\System\wgmWZrp.exe
  2⤵
  PID:4048
- C:\Windows\System\ufHRQwL.exe
  C:\Windows\System\ufHRQwL.exe
  2⤵
  PID:4708
- C:\Windows\System\dpeukgU.exe
  C:\Windows\System\dpeukgU.exe
  2⤵
  PID:5476
- C:\Windows\System\MNmXcdb.exe
  C:\Windows\System\MNmXcdb.exe
  2⤵
  PID:5676
- C:\Windows\System\HcyqrBf.exe
  C:\Windows\System\HcyqrBf.exe
  2⤵
  PID:5708
- C:\Windows\System\lCjILRb.exe
  C:\Windows\System\lCjILRb.exe
  2⤵
  PID:2424
- C:\Windows\System\ljRzSHl.exe
  C:\Windows\System\ljRzSHl.exe
  2⤵
  PID:2152
- C:\Windows\System\ZjdCEzZ.exe
  C:\Windows\System\ZjdCEzZ.exe
  2⤵
  PID:5920
- C:\Windows\System\DisBDut.exe
  C:\Windows\System\DisBDut.exe
  2⤵
  PID:1248
- C:\Windows\System\HfPXkBK.exe
  C:\Windows\System\HfPXkBK.exe
  2⤵
  PID:5956
- C:\Windows\System\EnENxDi.exe
  C:\Windows\System\EnENxDi.exe
  2⤵
  PID:3000
- C:\Windows\System\vMbtZbS.exe
  C:\Windows\System\vMbtZbS.exe
  2⤵
  PID:384
- C:\Windows\System\MpmeLqj.exe
  C:\Windows\System\MpmeLqj.exe
  2⤵
  PID:1648
- C:\Windows\System\KOwdfAi.exe
  C:\Windows\System\KOwdfAi.exe
  2⤵
  PID:4044
- C:\Windows\System\OWRWUBY.exe
  C:\Windows\System\OWRWUBY.exe
  2⤵
  PID:1284
- C:\Windows\System\xNUSMtz.exe
  C:\Windows\System\xNUSMtz.exe
  2⤵
  PID:2452
- C:\Windows\System\OhYXPWv.exe
  C:\Windows\System\OhYXPWv.exe
  2⤵
  PID:5332
- C:\Windows\System\trTfajo.exe
  C:\Windows\System\trTfajo.exe
  2⤵
  PID:4848
- C:\Windows\System\kRKcFJj.exe
  C:\Windows\System\kRKcFJj.exe
  2⤵
  PID:3036
- C:\Windows\System\UOxZwFd.exe
  C:\Windows\System\UOxZwFd.exe
  2⤵
  PID:1988
- C:\Windows\System\neJgRng.exe
  C:\Windows\System\neJgRng.exe
  2⤵
  PID:2284
- C:\Windows\System\PpmBGxX.exe
  C:\Windows\System\PpmBGxX.exe
  2⤵
  PID:1108
- C:\Windows\System\XacLrEt.exe
  C:\Windows\System\XacLrEt.exe
  2⤵
  PID:5472
- C:\Windows\System\TqPqWQJ.exe
  C:\Windows\System\TqPqWQJ.exe
  2⤵
  PID:5696
- C:\Windows\System\eHTapJj.exe
  C:\Windows\System\eHTapJj.exe
  2⤵
  PID:1600
- C:\Windows\System\CHaHWxW.exe
  C:\Windows\System\CHaHWxW.exe
  2⤵
  PID:708
- C:\Windows\System\OQLoGIr.exe
  C:\Windows\System\OQLoGIr.exe
  2⤵
  PID:6116
- C:\Windows\System\uQtrXhP.exe
  C:\Windows\System\uQtrXhP.exe
  2⤵
  PID:864
- C:\Windows\System\KyTjkHE.exe
  C:\Windows\System\KyTjkHE.exe
  2⤵
  PID:4396
- C:\Windows\System\ThWQTJd.exe
  C:\Windows\System\ThWQTJd.exe
  2⤵
  PID:908
- C:\Windows\System\ZwmChyu.exe
  C:\Windows\System\ZwmChyu.exe
  2⤵
  PID:2212
- C:\Windows\System\wfGMrbe.exe
  C:\Windows\System\wfGMrbe.exe
  2⤵
  PID:1920
- C:\Windows\System\ZLGcFMq.exe
  C:\Windows\System\ZLGcFMq.exe
  2⤵
  PID:6008
- C:\Windows\System\oKjSGZb.exe
  C:\Windows\System\oKjSGZb.exe
  2⤵
  PID:6040
- C:\Windows\System\RVokVjO.exe
  C:\Windows\System\RVokVjO.exe
  2⤵
  PID:2228
- C:\Windows\System\HJGiaPg.exe
  C:\Windows\System\HJGiaPg.exe
  2⤵
  PID:820
- C:\Windows\System\vYRbYJB.exe
  C:\Windows\System\vYRbYJB.exe
  2⤵
  PID:6164
- C:\Windows\System\IQtQmtg.exe
  C:\Windows\System\IQtQmtg.exe
  2⤵
  PID:6184
- C:\Windows\System\PPWQubt.exe
  C:\Windows\System\PPWQubt.exe
  2⤵
  PID:6204
- C:\Windows\System\XGheVqz.exe
  C:\Windows\System\XGheVqz.exe
  2⤵
  PID:6236
- C:\Windows\System\tCtDhNp.exe
  C:\Windows\System\tCtDhNp.exe
  2⤵
  PID:6296
- C:\Windows\System\vnKgPDV.exe
  C:\Windows\System\vnKgPDV.exe
  2⤵
  PID:6332
- C:\Windows\System\XfTQDgu.exe
  C:\Windows\System\XfTQDgu.exe
  2⤵
  PID:6360
- C:\Windows\System\QXDjFkM.exe
  C:\Windows\System\QXDjFkM.exe
  2⤵
  PID:6376
- C:\Windows\System\WZSlZOJ.exe
  C:\Windows\System\WZSlZOJ.exe
  2⤵
  PID:6408
- C:\Windows\System\dXqWHLt.exe
  C:\Windows\System\dXqWHLt.exe
  2⤵
  PID:6432
- C:\Windows\System\DKZdBSC.exe
  C:\Windows\System\DKZdBSC.exe
  2⤵
  PID:6476
- C:\Windows\System\twYOhFB.exe
  C:\Windows\System\twYOhFB.exe
  2⤵
  PID:6504
- C:\Windows\System\UxOYjpL.exe
  C:\Windows\System\UxOYjpL.exe
  2⤵
  PID:6532
- C:\Windows\System\qcNdajj.exe
  C:\Windows\System\qcNdajj.exe
  2⤵
  PID:6568
- C:\Windows\System\iqNKKiL.exe
  C:\Windows\System\iqNKKiL.exe
  2⤵
  PID:6596
- C:\Windows\System\bhSRrIG.exe
  C:\Windows\System\bhSRrIG.exe
  2⤵
  PID:6620
- C:\Windows\System\sHnvlOx.exe
  C:\Windows\System\sHnvlOx.exe
  2⤵
  PID:6640
- C:\Windows\System\roRAcXy.exe
  C:\Windows\System\roRAcXy.exe
  2⤵
  PID:6668
- C:\Windows\System\epLIDIs.exe
  C:\Windows\System\epLIDIs.exe
  2⤵
  PID:6696
- C:\Windows\System\bhvmuQT.exe
  C:\Windows\System\bhvmuQT.exe
  2⤵
  PID:6728
- C:\Windows\System\qfexjBd.exe
  C:\Windows\System\qfexjBd.exe
  2⤵
  PID:6756
- C:\Windows\System\tQYFLNU.exe
  C:\Windows\System\tQYFLNU.exe
  2⤵
  PID:6772
- C:\Windows\System\DTPNptk.exe
  C:\Windows\System\DTPNptk.exe
  2⤵
  PID:6820
- C:\Windows\System\uopYdhS.exe
  C:\Windows\System\uopYdhS.exe
  2⤵
  PID:6840
- C:\Windows\System\nZoQEmo.exe
  C:\Windows\System\nZoQEmo.exe
  2⤵
  PID:6876
- C:\Windows\System\Czwgpas.exe
  C:\Windows\System\Czwgpas.exe
  2⤵
  PID:6896
- C:\Windows\System\dmpSYKo.exe
  C:\Windows\System\dmpSYKo.exe
  2⤵
  PID:6928
- C:\Windows\System\vxcnist.exe
  C:\Windows\System\vxcnist.exe
  2⤵
  PID:6956
- C:\Windows\System\yEHBBao.exe
  C:\Windows\System\yEHBBao.exe
  2⤵
  PID:7000
- C:\Windows\System\JVYfgaZ.exe
  C:\Windows\System\JVYfgaZ.exe
  2⤵
  PID:7028
- C:\Windows\System\AHCbWpH.exe
  C:\Windows\System\AHCbWpH.exe
  2⤵
  PID:7056
- C:\Windows\System\SPzvzqi.exe
  C:\Windows\System\SPzvzqi.exe
  2⤵
  PID:7076
- C:\Windows\System\xgfoccL.exe
  C:\Windows\System\xgfoccL.exe
  2⤵
  PID:7100
- C:\Windows\System\mFfvsOi.exe
  C:\Windows\System\mFfvsOi.exe
  2⤵
  PID:7116
- C:\Windows\System\XUKyJzK.exe
  C:\Windows\System\XUKyJzK.exe
  2⤵
  PID:7156
- C:\Windows\System\CNANQjB.exe
  C:\Windows\System\CNANQjB.exe
  2⤵
  PID:6156
- C:\Windows\System\nWvokWa.exe
  C:\Windows\System\nWvokWa.exe
  2⤵
  PID:6220
- C:\Windows\System\vmrHIhO.exe
  C:\Windows\System\vmrHIhO.exe
  2⤵
  PID:6304
- C:\Windows\System\UfVSxAX.exe
  C:\Windows\System\UfVSxAX.exe
  2⤵
  PID:6328
- C:\Windows\System\HTuKbGG.exe
  C:\Windows\System\HTuKbGG.exe
  2⤵
  PID:6392
- C:\Windows\System\UjGZYlh.exe
  C:\Windows\System\UjGZYlh.exe
  2⤵
  PID:6448
- C:\Windows\System\drlygAm.exe
  C:\Windows\System\drlygAm.exe
  2⤵
  PID:6552
- C:\Windows\System\KijscBz.exe
  C:\Windows\System\KijscBz.exe
  2⤵
  PID:6592
- C:\Windows\System\yIuHkSi.exe
  C:\Windows\System\yIuHkSi.exe
  2⤵
  PID:6684
- C:\Windows\System\MRfWUQZ.exe
  C:\Windows\System\MRfWUQZ.exe
  2⤵
  PID:6736
- C:\Windows\System\MQXrsuZ.exe
  C:\Windows\System\MQXrsuZ.exe
  2⤵
  PID:6764
- C:\Windows\System\qvmUBUu.exe
  C:\Windows\System\qvmUBUu.exe
  2⤵
  PID:6908
- C:\Windows\System\gpuuVCj.exe
  C:\Windows\System\gpuuVCj.exe
  2⤵
  PID:6952
- C:\Windows\System\NrXIytx.exe
  C:\Windows\System\NrXIytx.exe
  2⤵
  PID:7040
- C:\Windows\System\xDvoLcE.exe
  C:\Windows\System\xDvoLcE.exe
  2⤵
  PID:7132
- C:\Windows\System\tzDmbbt.exe
  C:\Windows\System\tzDmbbt.exe
  2⤵
  PID:4936
- C:\Windows\System\aWMzTov.exe
  C:\Windows\System\aWMzTov.exe
  2⤵
  PID:6176
- C:\Windows\System\IIAFkVv.exe
  C:\Windows\System\IIAFkVv.exe
  2⤵
  PID:6316
- C:\Windows\System\HttLEfm.exe
  C:\Windows\System\HttLEfm.exe
  2⤵
  PID:6452
- C:\Windows\System\UjAwcjf.exe
  C:\Windows\System\UjAwcjf.exe
  2⤵
  PID:6660
- C:\Windows\System\nXepkDW.exe
  C:\Windows\System\nXepkDW.exe
  2⤵
  PID:6800
- C:\Windows\System\OzEhKiA.exe
  C:\Windows\System\OzEhKiA.exe
  2⤵
  PID:6868
- C:\Windows\System\rnFKeEn.exe
  C:\Windows\System\rnFKeEn.exe
  2⤵
  PID:7088
- C:\Windows\System\FMtoiMu.exe
  C:\Windows\System\FMtoiMu.exe
  2⤵
  PID:6244
- C:\Windows\System\IWtvwga.exe
  C:\Windows\System\IWtvwga.exe
  2⤵
  PID:7012
- C:\Windows\System\BMtppqv.exe
  C:\Windows\System\BMtppqv.exe
  2⤵
  PID:6712
- C:\Windows\System\mevSPrs.exe
  C:\Windows\System\mevSPrs.exe
  2⤵
  PID:6516
- C:\Windows\System\YSerCjA.exe
  C:\Windows\System\YSerCjA.exe
  2⤵
  PID:7184
- C:\Windows\System\fLgzbSo.exe
  C:\Windows\System\fLgzbSo.exe
  2⤵
  PID:7220
- C:\Windows\System\iXqpjVp.exe
  C:\Windows\System\iXqpjVp.exe
  2⤵
  PID:7252
- C:\Windows\System\bgCxakt.exe
  C:\Windows\System\bgCxakt.exe
  2⤵
  PID:7268
- C:\Windows\System\JbCieaq.exe
  C:\Windows\System\JbCieaq.exe
  2⤵
  PID:7308
- C:\Windows\System\UfSjFVJ.exe
  C:\Windows\System\UfSjFVJ.exe
  2⤵
  PID:7336
- C:\Windows\System\aFHZslR.exe
  C:\Windows\System\aFHZslR.exe
  2⤵
  PID:7364
- C:\Windows\System\kXxlhoN.exe
  C:\Windows\System\kXxlhoN.exe
  2⤵
  PID:7392
- C:\Windows\System\oHUVZyD.exe
  C:\Windows\System\oHUVZyD.exe
  2⤵
  PID:7432
- C:\Windows\System\IcgAxIk.exe
  C:\Windows\System\IcgAxIk.exe
  2⤵
  PID:7464
- C:\Windows\System\JaWvmoq.exe
  C:\Windows\System\JaWvmoq.exe
  2⤵
  PID:7488
- C:\Windows\System\dnZbWQZ.exe
  C:\Windows\System\dnZbWQZ.exe
  2⤵
  PID:7508
- C:\Windows\System\WHQcxAC.exe
  C:\Windows\System\WHQcxAC.exe
  2⤵
  PID:7536
- C:\Windows\System\LyVQRfd.exe
  C:\Windows\System\LyVQRfd.exe
  2⤵
  PID:7556
- C:\Windows\System\MCGgXhm.exe
  C:\Windows\System\MCGgXhm.exe
  2⤵
  PID:7584
- C:\Windows\System\FWPQYKm.exe
  C:\Windows\System\FWPQYKm.exe
  2⤵
  PID:7616
- C:\Windows\System\LTvGrAd.exe
  C:\Windows\System\LTvGrAd.exe
  2⤵
  PID:7640
- C:\Windows\System\SFAcwgD.exe
  C:\Windows\System\SFAcwgD.exe
  2⤵
  PID:7668
- C:\Windows\System\qoYnUdv.exe
  C:\Windows\System\qoYnUdv.exe
  2⤵
  PID:7704
- C:\Windows\System\PjIwVcF.exe
  C:\Windows\System\PjIwVcF.exe
  2⤵
  PID:7720
- C:\Windows\System\BRRvtPs.exe
  C:\Windows\System\BRRvtPs.exe
  2⤵
  PID:7748
- C:\Windows\System\kQFGEnU.exe
  C:\Windows\System\kQFGEnU.exe
  2⤵
  PID:7772
- C:\Windows\System\wCKonJh.exe
  C:\Windows\System\wCKonJh.exe
  2⤵
  PID:7812
- C:\Windows\System\QKqGnAU.exe
  C:\Windows\System\QKqGnAU.exe
  2⤵
  PID:7856
- C:\Windows\System\SCXZpJJ.exe
  C:\Windows\System\SCXZpJJ.exe
  2⤵
  PID:7872
- C:\Windows\System\YiMGHPw.exe
  C:\Windows\System\YiMGHPw.exe
  2⤵
  PID:7904
- C:\Windows\System\mouNSoE.exe
  C:\Windows\System\mouNSoE.exe
  2⤵
  PID:7932
- C:\Windows\System\vYtiViz.exe
  C:\Windows\System\vYtiViz.exe
  2⤵
  PID:7956
- C:\Windows\System\EHaiYyS.exe
  C:\Windows\System\EHaiYyS.exe
  2⤵
  PID:7984
- C:\Windows\System\coSvVaC.exe
  C:\Windows\System\coSvVaC.exe
  2⤵
  PID:8024
- C:\Windows\System\UDvsoeD.exe
  C:\Windows\System\UDvsoeD.exe
  2⤵
  PID:8052
- C:\Windows\System\zIqChXl.exe
  C:\Windows\System\zIqChXl.exe
  2⤵
  PID:8068
- C:\Windows\System\GJusXsX.exe
  C:\Windows\System\GJusXsX.exe
  2⤵
  PID:8092
- C:\Windows\System\YKqqrHs.exe
  C:\Windows\System\YKqqrHs.exe
  2⤵
  PID:8124
- C:\Windows\System\CjgTxMU.exe
  C:\Windows\System\CjgTxMU.exe
  2⤵
  PID:8140
- C:\Windows\System\AKxdkXt.exe
  C:\Windows\System\AKxdkXt.exe
  2⤵
  PID:8164
- C:\Windows\System\ZfoDqOC.exe
  C:\Windows\System\ZfoDqOC.exe
  2⤵
  PID:7196
- C:\Windows\System\jrqBZEV.exe
  C:\Windows\System\jrqBZEV.exe
  2⤵
  PID:7240
- C:\Windows\System\AQoesTD.exe
  C:\Windows\System\AQoesTD.exe
  2⤵
  PID:7320
- C:\Windows\System\SxupwAj.exe
  C:\Windows\System\SxupwAj.exe
  2⤵
  PID:7384
- C:\Windows\System\DACYFiV.exe
  C:\Windows\System\DACYFiV.exe
  2⤵
  PID:7496
- C:\Windows\System\cHpalpV.exe
  C:\Windows\System\cHpalpV.exe
  2⤵
  PID:7520
- C:\Windows\System\qyIJNCx.exe
  C:\Windows\System\qyIJNCx.exe
  2⤵
  PID:7568
- C:\Windows\System\FzvXINK.exe
  C:\Windows\System\FzvXINK.exe
  2⤵
  PID:7632
- C:\Windows\System\zRzVzpV.exe
  C:\Windows\System\zRzVzpV.exe
  2⤵
  PID:7676
- C:\Windows\System\davOetC.exe
  C:\Windows\System\davOetC.exe
  2⤵
  PID:7804
- C:\Windows\System\izUMEyq.exe
  C:\Windows\System\izUMEyq.exe
  2⤵
  PID:7868
- C:\Windows\System\HwSgSnf.exe
  C:\Windows\System\HwSgSnf.exe
  2⤵
  PID:7940
- C:\Windows\System\ChquiqL.exe
  C:\Windows\System\ChquiqL.exe
  2⤵
  PID:7944
- C:\Windows\System\VSgrswh.exe
  C:\Windows\System\VSgrswh.exe
  2⤵
  PID:8060
- C:\Windows\System\JbgITZg.exe
  C:\Windows\System\JbgITZg.exe
  2⤵
  PID:8080
- C:\Windows\System\rwqeIPR.exe
  C:\Windows\System\rwqeIPR.exe
  2⤵
  PID:8132
- C:\Windows\System\QWcAzpU.exe
  C:\Windows\System\QWcAzpU.exe
  2⤵
  PID:7284
- C:\Windows\System\Xaguhya.exe
  C:\Windows\System\Xaguhya.exe
  2⤵
  PID:7448
- C:\Windows\System\eeTEVYK.exe
  C:\Windows\System\eeTEVYK.exe
  2⤵
  PID:7580
- C:\Windows\System\MQnYqEH.exe
  C:\Windows\System\MQnYqEH.exe
  2⤵
  PID:7628
- C:\Windows\System\gbzhfHZ.exe
  C:\Windows\System\gbzhfHZ.exe
  2⤵
  PID:7848
- C:\Windows\System\dcUCXBs.exe
  C:\Windows\System\dcUCXBs.exe
  2⤵
  PID:7920
- C:\Windows\System\UnkEswS.exe
  C:\Windows\System\UnkEswS.exe
  2⤵
  PID:7176
- C:\Windows\System\oPmMPgW.exe
  C:\Windows\System\oPmMPgW.exe
  2⤵
  PID:7500
- C:\Windows\System\qtexdey.exe
  C:\Windows\System\qtexdey.exe
  2⤵
  PID:7692
- C:\Windows\System\XKgXmOj.exe
  C:\Windows\System\XKgXmOj.exe
  2⤵
  PID:7244
- C:\Windows\System\RsFRzUU.exe
  C:\Windows\System\RsFRzUU.exe
  2⤵
  PID:7836
- C:\Windows\System\nvqzAKq.exe
  C:\Windows\System\nvqzAKq.exe
  2⤵
  PID:8196
- C:\Windows\System\FSLToJU.exe
  C:\Windows\System\FSLToJU.exe
  2⤵
  PID:8212
- C:\Windows\System\IIgbDBw.exe
  C:\Windows\System\IIgbDBw.exe
  2⤵
  PID:8232
- C:\Windows\System\YLuJrur.exe
  C:\Windows\System\YLuJrur.exe
  2⤵
  PID:8300
- C:\Windows\System\UrAEVXW.exe
  C:\Windows\System\UrAEVXW.exe
  2⤵
  PID:8324
- C:\Windows\System\TAXrlSm.exe
  C:\Windows\System\TAXrlSm.exe
  2⤵
  PID:8348
- C:\Windows\System\MDymuJR.exe
  C:\Windows\System\MDymuJR.exe
  2⤵
  PID:8388
- C:\Windows\System\nOXvZSO.exe
  C:\Windows\System\nOXvZSO.exe
  2⤵
  PID:8408
- C:\Windows\System\gCogMsI.exe
  C:\Windows\System\gCogMsI.exe
  2⤵
  PID:8432
- C:\Windows\System\sAYwkqC.exe
  C:\Windows\System\sAYwkqC.exe
  2⤵
  PID:8464
- C:\Windows\System\GEGLnnn.exe
  C:\Windows\System\GEGLnnn.exe
  2⤵
  PID:8500
- C:\Windows\System\iXbmYQR.exe
  C:\Windows\System\iXbmYQR.exe
  2⤵
  PID:8528
- C:\Windows\System\tqCfvgc.exe
  C:\Windows\System\tqCfvgc.exe
  2⤵
  PID:8548
- C:\Windows\System\xzAbHqC.exe
  C:\Windows\System\xzAbHqC.exe
  2⤵
  PID:8572
- C:\Windows\System\ndvvQPy.exe
  C:\Windows\System\ndvvQPy.exe
  2⤵
  PID:8612
- C:\Windows\System\FNUsGdc.exe
  C:\Windows\System\FNUsGdc.exe
  2⤵
  PID:8640
- C:\Windows\System\yJEomOL.exe
  C:\Windows\System\yJEomOL.exe
  2⤵
  PID:8656
- C:\Windows\System\zbguYxp.exe
  C:\Windows\System\zbguYxp.exe
  2⤵
  PID:8684
- C:\Windows\System\VQfTqjb.exe
  C:\Windows\System\VQfTqjb.exe
  2⤵
  PID:8716
- C:\Windows\System\QsSDwef.exe
  C:\Windows\System\QsSDwef.exe
  2⤵
  PID:8736
- C:\Windows\System\sJoUchU.exe
  C:\Windows\System\sJoUchU.exe
  2⤵
  PID:8772
- C:\Windows\System\gvMhppj.exe
  C:\Windows\System\gvMhppj.exe
  2⤵
  PID:8800
- C:\Windows\System\ZaDHSci.exe
  C:\Windows\System\ZaDHSci.exe
  2⤵
  PID:8828
- C:\Windows\System\GQUTWkE.exe
  C:\Windows\System\GQUTWkE.exe
  2⤵
  PID:8856
- C:\Windows\System\CNwboaa.exe
  C:\Windows\System\CNwboaa.exe
  2⤵
  PID:8884
- C:\Windows\System\fiCjWun.exe
  C:\Windows\System\fiCjWun.exe
  2⤵
  PID:8912
- C:\Windows\System\zuVyzWy.exe
  C:\Windows\System\zuVyzWy.exe
  2⤵
  PID:8932
- C:\Windows\System\waZiMxF.exe
  C:\Windows\System\waZiMxF.exe
  2⤵
  PID:8972
- C:\Windows\System\QLNjwaF.exe
  C:\Windows\System\QLNjwaF.exe
  2⤵
  PID:8996
- C:\Windows\System\bCQUjzY.exe
  C:\Windows\System\bCQUjzY.exe
  2⤵
  PID:9036
- C:\Windows\System\EMpXlFx.exe
  C:\Windows\System\EMpXlFx.exe
  2⤵
  PID:9052
- C:\Windows\System\yTwOmqW.exe
  C:\Windows\System\yTwOmqW.exe
  2⤵
  PID:9084
- C:\Windows\System\DLfKrKS.exe
  C:\Windows\System\DLfKrKS.exe
  2⤵
  PID:9108
- C:\Windows\System\zUVPWyF.exe
  C:\Windows\System\zUVPWyF.exe
  2⤵
  PID:9140
- C:\Windows\System\gkiwHUG.exe
  C:\Windows\System\gkiwHUG.exe
  2⤵
  PID:9164
- C:\Windows\System\hOMjnXb.exe
  C:\Windows\System\hOMjnXb.exe
  2⤵
  PID:9192
- C:\Windows\System\TiICqkc.exe
  C:\Windows\System\TiICqkc.exe
  2⤵
  PID:9208
- C:\Windows\System\DIAYzZy.exe
  C:\Windows\System\DIAYzZy.exe
  2⤵
  PID:8228
- C:\Windows\System\iuYLegw.exe
  C:\Windows\System\iuYLegw.exe
  2⤵
  PID:8336
- C:\Windows\System\SMToPAH.exe
  C:\Windows\System\SMToPAH.exe
  2⤵
  PID:8396
- C:\Windows\System\LxVAxtn.exe
  C:\Windows\System\LxVAxtn.exe
  2⤵
  PID:8484
- C:\Windows\System\wUyLXLo.exe
  C:\Windows\System\wUyLXLo.exe
  2⤵
  PID:8540
- C:\Windows\System\VqPyBlI.exe
  C:\Windows\System\VqPyBlI.exe
  2⤵
  PID:8560
- C:\Windows\System\yljTLNS.exe
  C:\Windows\System\yljTLNS.exe
  2⤵
  PID:8624
- C:\Windows\System\WNfHeiV.exe
  C:\Windows\System\WNfHeiV.exe
  2⤵
  PID:8648
- C:\Windows\System\ARkWkim.exe
  C:\Windows\System\ARkWkim.exe
  2⤵
  PID:8756
- C:\Windows\System\ulIuIqk.exe
  C:\Windows\System\ulIuIqk.exe
  2⤵
  PID:8840
- C:\Windows\System\BbCJWQS.exe
  C:\Windows\System\BbCJWQS.exe
  2⤵
  PID:8876
- C:\Windows\System\QVhjAWy.exe
  C:\Windows\System\QVhjAWy.exe
  2⤵
  PID:8940
- C:\Windows\System\eUxVESm.exe
  C:\Windows\System\eUxVESm.exe
  2⤵
  PID:9012
- C:\Windows\System\KVAnOdD.exe
  C:\Windows\System\KVAnOdD.exe
  2⤵
  PID:9092
- C:\Windows\System\fbdtJHI.exe
  C:\Windows\System\fbdtJHI.exe
  2⤵
  PID:9132
- C:\Windows\System\GLDjyWG.exe
  C:\Windows\System\GLDjyWG.exe
  2⤵
  PID:9204
- C:\Windows\System\UcaaRoX.exe
  C:\Windows\System\UcaaRoX.exe
  2⤵
  PID:8292
- C:\Windows\System\GvwujSf.exe
  C:\Windows\System\GvwujSf.exe
  2⤵
  PID:8448
- C:\Windows\System\ojcbRAO.exe
  C:\Windows\System\ojcbRAO.exe
  2⤵
  PID:8520
- C:\Windows\System\bWdSlqh.exe
  C:\Windows\System\bWdSlqh.exe
  2⤵
  PID:8652
- C:\Windows\System\jTTfzlU.exe
  C:\Windows\System\jTTfzlU.exe
  2⤵
  PID:8900
- C:\Windows\System\UnsKJAC.exe
  C:\Windows\System\UnsKJAC.exe
  2⤵
  PID:8980
- C:\Windows\System\aEcvXPq.exe
  C:\Windows\System\aEcvXPq.exe
  2⤵
  PID:9156
- C:\Windows\System\upsQvEY.exe
  C:\Windows\System\upsQvEY.exe
  2⤵
  PID:8556
- C:\Windows\System\rhpWUoi.exe
  C:\Windows\System\rhpWUoi.exe
  2⤵
  PID:8816
- C:\Windows\System\QmCMQXT.exe
  C:\Windows\System\QmCMQXT.exe
  2⤵
  PID:9068
- C:\Windows\System\SNHJQKo.exe
  C:\Windows\System\SNHJQKo.exe
  2⤵
  PID:8676
- C:\Windows\System\rQBOmUe.exe
  C:\Windows\System\rQBOmUe.exe
  2⤵
  PID:9236
- C:\Windows\System\NOYALad.exe
  C:\Windows\System\NOYALad.exe
  2⤵
  PID:9260
- C:\Windows\System\yTFjagE.exe
  C:\Windows\System\yTFjagE.exe
  2⤵
  PID:9280
- C:\Windows\System\cuSRTqH.exe
  C:\Windows\System\cuSRTqH.exe
  2⤵
  PID:9328
- C:\Windows\System\xvRvGuq.exe
  C:\Windows\System\xvRvGuq.exe
  2⤵
  PID:9356
- C:\Windows\System\mEdrLRW.exe
  C:\Windows\System\mEdrLRW.exe
  2⤵
  PID:9376
- C:\Windows\System\ejmWYYC.exe
  C:\Windows\System\ejmWYYC.exe
  2⤵
  PID:9404
- C:\Windows\System\dpgYBHu.exe
  C:\Windows\System\dpgYBHu.exe
  2⤵
  PID:9440
- C:\Windows\System\XOPvnyU.exe
  C:\Windows\System\XOPvnyU.exe
  2⤵
  PID:9484
- C:\Windows\System\bxUPgcL.exe
  C:\Windows\System\bxUPgcL.exe
  2⤵
  PID:9504
- C:\Windows\System\LWLStbC.exe
  C:\Windows\System\LWLStbC.exe
  2⤵
  PID:9532
- C:\Windows\System\yjbmyOd.exe
  C:\Windows\System\yjbmyOd.exe
  2⤵
  PID:9556
- C:\Windows\System\untWKhE.exe
  C:\Windows\System\untWKhE.exe
  2⤵
  PID:9584
- C:\Windows\System\xYGtwcC.exe
  C:\Windows\System\xYGtwcC.exe
  2⤵
  PID:9624
- C:\Windows\System\SAUjddF.exe
  C:\Windows\System\SAUjddF.exe
  2⤵
  PID:9652
- C:\Windows\System\eurDrFD.exe
  C:\Windows\System\eurDrFD.exe
  2⤵
  PID:9668
- C:\Windows\System\WwhdBUJ.exe
  C:\Windows\System\WwhdBUJ.exe
  2⤵
  PID:9692
- C:\Windows\System\ebFwakb.exe
  C:\Windows\System\ebFwakb.exe
  2⤵
  PID:9720
- C:\Windows\System\REUYgie.exe
  C:\Windows\System\REUYgie.exe
  2⤵
  PID:9764
- C:\Windows\System\oBydstM.exe
  C:\Windows\System\oBydstM.exe
  2⤵
  PID:9792
- C:\Windows\System\lxVKKem.exe
  C:\Windows\System\lxVKKem.exe
  2⤵
  PID:9820
- C:\Windows\System\AkayxUG.exe
  C:\Windows\System\AkayxUG.exe
  2⤵
  PID:9836
- C:\Windows\System\MxNNAEl.exe
  C:\Windows\System\MxNNAEl.exe
  2⤵
  PID:9864
- C:\Windows\System\VrswfYD.exe
  C:\Windows\System\VrswfYD.exe
  2⤵
  PID:9880
- C:\Windows\System\yEeaFdl.exe
  C:\Windows\System\yEeaFdl.exe
  2⤵
  PID:9904
- C:\Windows\System\AChaoWb.exe
  C:\Windows\System\AChaoWb.exe
  2⤵
  PID:9920
- C:\Windows\System\eEoResg.exe
  C:\Windows\System\eEoResg.exe
  2⤵
  PID:9960
- C:\Windows\System\ZhHAUjD.exe
  C:\Windows\System\ZhHAUjD.exe
  2⤵
  PID:9976
- C:\Windows\System\WFOvFJv.exe
  C:\Windows\System\WFOvFJv.exe
  2⤵
  PID:10000
- C:\Windows\System\bPDqUnJ.exe
  C:\Windows\System\bPDqUnJ.exe
  2⤵
  PID:10020
- C:\Windows\System\voPVWnF.exe
  C:\Windows\System\voPVWnF.exe
  2⤵
  PID:10044
- C:\Windows\System\yaSauOk.exe
  C:\Windows\System\yaSauOk.exe
  2⤵
  PID:10080
- C:\Windows\System\KGwLxip.exe
  C:\Windows\System\KGwLxip.exe
  2⤵
  PID:10096
- C:\Windows\System\iqcHZJx.exe
  C:\Windows\System\iqcHZJx.exe
  2⤵
  PID:10128
- C:\Windows\System\TsUlJpD.exe
  C:\Windows\System\TsUlJpD.exe
  2⤵
  PID:10160
- C:\Windows\System\qigIarD.exe
  C:\Windows\System\qigIarD.exe
  2⤵
  PID:10180
- C:\Windows\System\mfenbdK.exe
  C:\Windows\System\mfenbdK.exe
  2⤵
  PID:10208
- C:\Windows\System\irOYGxq.exe
  C:\Windows\System\irOYGxq.exe
  2⤵
  PID:8248
- C:\Windows\System\nsKdIiw.exe
  C:\Windows\System\nsKdIiw.exe
  2⤵
  PID:9388
- C:\Windows\System\wCPwgkv.exe
  C:\Windows\System\wCPwgkv.exe
  2⤵
  PID:9436
- C:\Windows\System\HsbMOAT.exe
  C:\Windows\System\HsbMOAT.exe
  2⤵
  PID:9464
- C:\Windows\System\UtanQWm.exe
  C:\Windows\System\UtanQWm.exe
  2⤵
  PID:9540
- C:\Windows\System\MreMnEj.exe
  C:\Windows\System\MreMnEj.exe
  2⤵
  PID:9608
- C:\Windows\System\OHkqZqp.exe
  C:\Windows\System\OHkqZqp.exe
  2⤵
  PID:9660
- C:\Windows\System\LdAyXLg.exe
  C:\Windows\System\LdAyXLg.exe
  2⤵
  PID:9784
- C:\Windows\System\iIfJgas.exe
  C:\Windows\System\iIfJgas.exe
  2⤵
  PID:8680
- C:\Windows\System\SIJXrdo.exe
  C:\Windows\System\SIJXrdo.exe
  2⤵
  PID:9896
- C:\Windows\System\oxCmrSy.exe
  C:\Windows\System\oxCmrSy.exe
  2⤵
  PID:9968
- C:\Windows\System\jGkacUD.exe
  C:\Windows\System\jGkacUD.exe
  2⤵
  PID:10036
- C:\Windows\System\UGcFCMe.exe
  C:\Windows\System\UGcFCMe.exe
  2⤵
  PID:10068
- C:\Windows\System\wvGWHeg.exe
  C:\Windows\System\wvGWHeg.exe
  2⤵
  PID:10012
- C:\Windows\System\VoyQkDO.exe
  C:\Windows\System\VoyQkDO.exe
  2⤵
  PID:10232
- C:\Windows\System\VQiXcNa.exe
  C:\Windows\System\VQiXcNa.exe
  2⤵
  PID:9300
- C:\Windows\System\snqWJyu.exe
  C:\Windows\System\snqWJyu.exe
  2⤵
  PID:9428
- C:\Windows\System\VgvqaVh.exe
  C:\Windows\System\VgvqaVh.exe
  2⤵
  PID:9596
- C:\Windows\System\ARrAkcE.exe
  C:\Windows\System\ARrAkcE.exe
  2⤵
  PID:9716
- C:\Windows\System\MJGetCl.exe
  C:\Windows\System\MJGetCl.exe
  2⤵
  PID:9832
- C:\Windows\System\BeCTaKs.exe
  C:\Windows\System\BeCTaKs.exe
  2⤵
  PID:9992
- C:\Windows\System\TBJlpbM.exe
  C:\Windows\System\TBJlpbM.exe
  2⤵
  PID:9044
- C:\Windows\System\RNcAOJU.exe
  C:\Windows\System\RNcAOJU.exe
  2⤵
  PID:9492
- C:\Windows\System\YCAAdHO.exe
  C:\Windows\System\YCAAdHO.exe
  2⤵
  PID:9744
- C:\Windows\System\SDqhkHB.exe
  C:\Windows\System\SDqhkHB.exe
  2⤵
  PID:10064
- C:\Windows\System\sGrCHCM.exe
  C:\Windows\System\sGrCHCM.exe
  2⤵
  PID:9276
- C:\Windows\System\YROvook.exe
  C:\Windows\System\YROvook.exe
  2⤵
  PID:10272
- C:\Windows\System\htMWoIE.exe
  C:\Windows\System\htMWoIE.exe
  2⤵
  PID:10288
- C:\Windows\System\oHtrSsD.exe
  C:\Windows\System\oHtrSsD.exe
  2⤵
  PID:10304
- C:\Windows\System\YAgyDcL.exe
  C:\Windows\System\YAgyDcL.exe
  2⤵
  PID:10332
- C:\Windows\System\LqNDgzs.exe
  C:\Windows\System\LqNDgzs.exe
  2⤵
  PID:10360
- C:\Windows\System\DeDBPRW.exe
  C:\Windows\System\DeDBPRW.exe
  2⤵
  PID:10384
- C:\Windows\System\JOqXLRZ.exe
  C:\Windows\System\JOqXLRZ.exe
  2⤵
  PID:10412
- C:\Windows\System\XodnKBF.exe
  C:\Windows\System\XodnKBF.exe
  2⤵
  PID:10440
- C:\Windows\System\zqLYjkC.exe
  C:\Windows\System\zqLYjkC.exe
  2⤵
  PID:10476
- C:\Windows\System\YVtwTOZ.exe
  C:\Windows\System\YVtwTOZ.exe
  2⤵
  PID:10536
- C:\Windows\System\QRgEsIR.exe
  C:\Windows\System\QRgEsIR.exe
  2⤵
  PID:10556
- C:\Windows\System\iRscduU.exe
  C:\Windows\System\iRscduU.exe
  2⤵
  PID:10572
- C:\Windows\System\Vkjnwmr.exe
  C:\Windows\System\Vkjnwmr.exe
  2⤵
  PID:10608
- C:\Windows\System\YWBhcaK.exe
  C:\Windows\System\YWBhcaK.exe
  2⤵
  PID:10628
- C:\Windows\System\pwSyjLd.exe
  C:\Windows\System\pwSyjLd.exe
  2⤵
  PID:10652
- C:\Windows\System\TnFlKyN.exe
  C:\Windows\System\TnFlKyN.exe
  2⤵
  PID:10684
- C:\Windows\System\oRoiDld.exe
  C:\Windows\System\oRoiDld.exe
  2⤵
  PID:10728
- C:\Windows\System\JvaqJJF.exe
  C:\Windows\System\JvaqJJF.exe
  2⤵
  PID:10756
- C:\Windows\System\TQZWUZy.exe
  C:\Windows\System\TQZWUZy.exe
  2⤵
  PID:10772
- C:\Windows\System\ZuGwAxl.exe
  C:\Windows\System\ZuGwAxl.exe
  2⤵
  PID:10788
- C:\Windows\System\KdfVFiH.exe
  C:\Windows\System\KdfVFiH.exe
  2⤵
  PID:10840
- C:\Windows\System\TnRQzPM.exe
  C:\Windows\System\TnRQzPM.exe
  2⤵
  PID:10860
- C:\Windows\System\lCwWfPw.exe
  C:\Windows\System\lCwWfPw.exe
  2⤵
  PID:10888
- C:\Windows\System\tXXBYdf.exe
  C:\Windows\System\tXXBYdf.exe
  2⤵
  PID:10912
- C:\Windows\System\FNhxQUa.exe
  C:\Windows\System\FNhxQUa.exe
  2⤵
  PID:10932
- C:\Windows\System\RGHWniO.exe
  C:\Windows\System\RGHWniO.exe
  2⤵
  PID:10968
- C:\Windows\System\bBcKOfo.exe
  C:\Windows\System\bBcKOfo.exe
  2⤵
  PID:11008
- C:\Windows\System\RZAkIrG.exe
  C:\Windows\System\RZAkIrG.exe
  2⤵
  PID:11036
- C:\Windows\System\QIpsoIL.exe
  C:\Windows\System\QIpsoIL.exe
  2⤵
  PID:11052
- C:\Windows\System\BghuJxd.exe
  C:\Windows\System\BghuJxd.exe
  2⤵
  PID:11092
- C:\Windows\System\XeIvkLu.exe
  C:\Windows\System\XeIvkLu.exe
  2⤵
  PID:11108
- C:\Windows\System\YkEIXLT.exe
  C:\Windows\System\YkEIXLT.exe
  2⤵
  PID:11128
- C:\Windows\System\uHCqBPe.exe
  C:\Windows\System\uHCqBPe.exe
  2⤵
  PID:11160
- C:\Windows\System\PlwNsxZ.exe
  C:\Windows\System\PlwNsxZ.exe
  2⤵
  PID:11188
- C:\Windows\System\odfUMPn.exe
  C:\Windows\System\odfUMPn.exe
  2⤵
  PID:11224
- C:\Windows\System\UuMhlLQ.exe
  C:\Windows\System\UuMhlLQ.exe
  2⤵
  PID:11248
- C:\Windows\System\uSnfpOZ.exe
  C:\Windows\System\uSnfpOZ.exe
  2⤵
  PID:9468
- C:\Windows\System\SHAKmGM.exe
  C:\Windows\System\SHAKmGM.exe
  2⤵
  PID:10284
- C:\Windows\System\awZHDtF.exe
  C:\Windows\System\awZHDtF.exe
  2⤵
  PID:10320
- C:\Windows\System\ovLxPmW.exe
  C:\Windows\System\ovLxPmW.exe
  2⤵
  PID:10408
- C:\Windows\System\TSkMMhv.exe
  C:\Windows\System\TSkMMhv.exe
  2⤵
  PID:10520
- C:\Windows\System\mstRtxW.exe
  C:\Windows\System\mstRtxW.exe
  2⤵
  PID:10548
- C:\Windows\System\OGSZnMJ.exe
  C:\Windows\System\OGSZnMJ.exe
  2⤵
  PID:10616
- C:\Windows\System\DyfJNMh.exe
  C:\Windows\System\DyfJNMh.exe
  2⤵
  PID:10720
- C:\Windows\System\vuiBAti.exe
  C:\Windows\System\vuiBAti.exe
  2⤵
  PID:10764
- C:\Windows\System\NTLsjwX.exe
  C:\Windows\System\NTLsjwX.exe
  2⤵
  PID:10824
- C:\Windows\System\BosYXed.exe
  C:\Windows\System\BosYXed.exe
  2⤵
  PID:10856
- C:\Windows\System\BTypqTV.exe
  C:\Windows\System\BTypqTV.exe
  2⤵
  PID:10904
- C:\Windows\System\QmkmyIK.exe
  C:\Windows\System\QmkmyIK.exe
  2⤵
  PID:10984
- C:\Windows\System\lTmuwTe.exe
  C:\Windows\System\lTmuwTe.exe
  2⤵
  PID:11020
- C:\Windows\System\QJijRQc.exe
  C:\Windows\System\QJijRQc.exe
  2⤵
  PID:11044
- C:\Windows\System\HSdIKsd.exe
  C:\Windows\System\HSdIKsd.exe
  2⤵
  PID:11148
- C:\Windows\System\UhWEYqG.exe
  C:\Windows\System\UhWEYqG.exe
  2⤵
  PID:11232
- C:\Windows\System\truWYQW.exe
  C:\Windows\System\truWYQW.exe
  2⤵
  PID:9804
- C:\Windows\System\lNsCVRw.exe
  C:\Windows\System\lNsCVRw.exe
  2⤵
  PID:10372
- C:\Windows\System\yAboKde.exe
  C:\Windows\System\yAboKde.exe
  2⤵
  PID:9936
- C:\Windows\System\gyDgaMH.exe
  C:\Windows\System\gyDgaMH.exe
  2⤵
  PID:10744
- C:\Windows\System\RQjCtRD.exe
  C:\Windows\System\RQjCtRD.exe
  2⤵
  PID:10828
- C:\Windows\System\hSkknxr.exe
  C:\Windows\System\hSkknxr.exe
  2⤵
  PID:10992
- C:\Windows\System\DABfcBp.exe
  C:\Windows\System\DABfcBp.exe
  2⤵
  PID:11240
- C:\Windows\System\geYODhj.exe
  C:\Windows\System\geYODhj.exe
  2⤵
  PID:10784
- C:\Windows\System\nYlbLng.exe
  C:\Windows\System\nYlbLng.exe
  2⤵
  PID:11032
- C:\Windows\System\EbwjoBg.exe
  C:\Windows\System\EbwjoBg.exe
  2⤵
  PID:10460
- C:\Windows\System\LuBOujO.exe
  C:\Windows\System\LuBOujO.exe
  2⤵
  PID:11176
- C:\Windows\System\KHXMemY.exe
  C:\Windows\System\KHXMemY.exe
  2⤵
  PID:11292
- C:\Windows\System\mauCPKH.exe
  C:\Windows\System\mauCPKH.exe
  2⤵
  PID:11316
- C:\Windows\System\ZUteqZo.exe
  C:\Windows\System\ZUteqZo.exe
  2⤵
  PID:11340
- C:\Windows\System\vzFwvLO.exe
  C:\Windows\System\vzFwvLO.exe
  2⤵
  PID:11364
- C:\Windows\System\hGJmpHv.exe
  C:\Windows\System\hGJmpHv.exe
  2⤵
  PID:11384
- C:\Windows\System\FuGCVQS.exe
  C:\Windows\System\FuGCVQS.exe
  2⤵
  PID:11408
- C:\Windows\System\NbEdqVd.exe
  C:\Windows\System\NbEdqVd.exe
  2⤵
  PID:11436
- C:\Windows\System\uZIxVke.exe
  C:\Windows\System\uZIxVke.exe
  2⤵
  PID:11492
- C:\Windows\System\mVbLtdp.exe
  C:\Windows\System\mVbLtdp.exe
  2⤵
  PID:11508
- C:\Windows\System\YNjlvUp.exe
  C:\Windows\System\YNjlvUp.exe
  2⤵
  PID:11548
- C:\Windows\System\YmwiJih.exe
  C:\Windows\System\YmwiJih.exe
  2⤵
  PID:11564
- C:\Windows\System\VbYJfeS.exe
  C:\Windows\System\VbYJfeS.exe
  2⤵
  PID:11592
- C:\Windows\System\idiBIEm.exe
  C:\Windows\System\idiBIEm.exe
  2⤵
  PID:11632
- C:\Windows\System\qfHmNfp.exe
  C:\Windows\System\qfHmNfp.exe
  2⤵
  PID:11660
- C:\Windows\System\ilwydRY.exe
  C:\Windows\System\ilwydRY.exe
  2⤵
  PID:11676
- C:\Windows\System\AyFPDMv.exe
  C:\Windows\System\AyFPDMv.exe
  2⤵
  PID:11720
- C:\Windows\System\mfCTmyS.exe
  C:\Windows\System\mfCTmyS.exe
  2⤵
  PID:11736
- C:\Windows\System\fKqGtTn.exe
  C:\Windows\System\fKqGtTn.exe
  2⤵
  PID:11760
- C:\Windows\System\rdumvZe.exe
  C:\Windows\System\rdumvZe.exe
  2⤵
  PID:11784
- C:\Windows\System\WjOgyVo.exe
  C:\Windows\System\WjOgyVo.exe
  2⤵
  PID:11832
- C:\Windows\System\rSnprKP.exe
  C:\Windows\System\rSnprKP.exe
  2⤵
  PID:11860
- C:\Windows\System\BLWYqVS.exe
  C:\Windows\System\BLWYqVS.exe
  2⤵
  PID:11876
- C:\Windows\System\SDpWHhW.exe
  C:\Windows\System\SDpWHhW.exe
  2⤵
  PID:11892
- C:\Windows\System\OWAtoVW.exe
  C:\Windows\System\OWAtoVW.exe
  2⤵
  PID:11944
- C:\Windows\System\plMRaYA.exe
  C:\Windows\System\plMRaYA.exe
  2⤵
  PID:11960
- C:\Windows\System\DxMveOJ.exe
  C:\Windows\System\DxMveOJ.exe
  2⤵
  PID:11980
- C:\Windows\System\IhqDVvg.exe
  C:\Windows\System\IhqDVvg.exe
  2⤵
  PID:11996
- C:\Windows\System\abqCEuv.exe
  C:\Windows\System\abqCEuv.exe
  2⤵
  PID:12016
- C:\Windows\System\KbiQYbN.exe
  C:\Windows\System\KbiQYbN.exe
  2⤵
  PID:12040
- C:\Windows\System\omlZDlu.exe
  C:\Windows\System\omlZDlu.exe
  2⤵
  PID:12072
- C:\Windows\System\hjrTXkj.exe
  C:\Windows\System\hjrTXkj.exe
  2⤵
  PID:12140
- C:\Windows\System\gINEVxu.exe
  C:\Windows\System\gINEVxu.exe
  2⤵
  PID:12156
- C:\Windows\System\WVoxCvz.exe
  C:\Windows\System\WVoxCvz.exe
  2⤵
  PID:12196
- C:\Windows\System\rgUdrvr.exe
  C:\Windows\System\rgUdrvr.exe
  2⤵
  PID:12220
- C:\Windows\System\VYJOdrC.exe
  C:\Windows\System\VYJOdrC.exe
  2⤵
  PID:12240
- C:\Windows\System\leiBlNV.exe
  C:\Windows\System\leiBlNV.exe
  2⤵
  PID:12280
- C:\Windows\System\NNmOxnl.exe
  C:\Windows\System\NNmOxnl.exe
  2⤵
  PID:11284
- C:\Windows\System\zApUYcl.exe
  C:\Windows\System\zApUYcl.exe
  2⤵
  PID:11332
- C:\Windows\System\nPmVrZM.exe
  C:\Windows\System\nPmVrZM.exe
  2⤵
  PID:11396
- C:\Windows\System\rCcpywt.exe
  C:\Windows\System\rCcpywt.exe
  2⤵
  PID:11424
- C:\Windows\System\OkkiiuC.exe
  C:\Windows\System\OkkiiuC.exe
  2⤵
  PID:11520
- C:\Windows\System\XszLXUa.exe
  C:\Windows\System\XszLXUa.exe
  2⤵
  PID:11584
- C:\Windows\System\szqHOzh.exe
  C:\Windows\System\szqHOzh.exe
  2⤵
  PID:11648
- C:\Windows\System\GbRiswr.exe
  C:\Windows\System\GbRiswr.exe
  2⤵
  PID:11748
- C:\Windows\System\MebakXE.exe
  C:\Windows\System\MebakXE.exe
  2⤵
  PID:11812
- C:\Windows\System\fTsRpdp.exe
  C:\Windows\System\fTsRpdp.exe
  2⤵
  PID:11848
- C:\Windows\System\YXmSonN.exe
  C:\Windows\System\YXmSonN.exe
  2⤵
  PID:11916
- C:\Windows\System\DWOcGOc.exe
  C:\Windows\System\DWOcGOc.exe
  2⤵
  PID:11956
- C:\Windows\System\tUvRsWh.exe
  C:\Windows\System\tUvRsWh.exe
  2⤵
  PID:12008
- C:\Windows\System\KYsAcZH.exe
  C:\Windows\System\KYsAcZH.exe
  2⤵
  PID:12108
- C:\Windows\System\MYsZcfQ.exe
  C:\Windows\System\MYsZcfQ.exe
  2⤵
  PID:12176
- C:\Windows\System\asBFkZa.exe
  C:\Windows\System\asBFkZa.exe
  2⤵
  PID:12272
- C:\Windows\System\jKmAUOH.exe
  C:\Windows\System\jKmAUOH.exe
  2⤵
  PID:11380
- C:\Windows\System\yogoXIJ.exe
  C:\Windows\System\yogoXIJ.exe
  2⤵
  PID:11420
- C:\Windows\System\vsHRWkG.exe
  C:\Windows\System\vsHRWkG.exe
  2⤵
  PID:11560
- C:\Windows\System\VpxXSkL.exe
  C:\Windows\System\VpxXSkL.exe
  2⤵
  PID:11652
- C:\Windows\System\YdIcCgt.exe
  C:\Windows\System\YdIcCgt.exe
  2⤵
  PID:11828
- C:\Windows\System\bTwUaaG.exe
  C:\Windows\System\bTwUaaG.exe
  2⤵
  PID:11884
- C:\Windows\System\EXrtUKr.exe
  C:\Windows\System\EXrtUKr.exe
  2⤵
  PID:12212
- C:\Windows\System\UiZQpYu.exe
  C:\Windows\System\UiZQpYu.exe
  2⤵
  PID:11488
- C:\Windows\System\tLrWkfn.exe
  C:\Windows\System\tLrWkfn.exe
  2⤵
  PID:11728
- C:\Windows\System\vRNJiUN.exe
  C:\Windows\System\vRNJiUN.exe
  2⤵
  PID:12236
- C:\Windows\System\wifZBkD.exe
  C:\Windows\System\wifZBkD.exe
  2⤵
  PID:11936
- C:\Windows\System\oyaCiqj.exe
  C:\Windows\System\oyaCiqj.exe
  2⤵
  PID:11444
- C:\Windows\System\tbeRShf.exe
  C:\Windows\System\tbeRShf.exe
  2⤵
  PID:12316
- C:\Windows\System\pDUAXLc.exe
  C:\Windows\System\pDUAXLc.exe
  2⤵
  PID:12348
- C:\Windows\System\NFtHXwu.exe
  C:\Windows\System\NFtHXwu.exe
  2⤵
  PID:12384
- C:\Windows\System\iQrhKvd.exe
  C:\Windows\System\iQrhKvd.exe
  2⤵
  PID:12404
- C:\Windows\System\JxDqspM.exe
  C:\Windows\System\JxDqspM.exe
  2⤵
  PID:12424
- C:\Windows\System\oJfSjox.exe
  C:\Windows\System\oJfSjox.exe
  2⤵
  PID:12444
- C:\Windows\System\eVPfkJD.exe
  C:\Windows\System\eVPfkJD.exe
  2⤵
  PID:12464
- C:\Windows\System\tqbJMxA.exe
  C:\Windows\System\tqbJMxA.exe
  2⤵
  PID:12512
- C:\Windows\System\qvdlcKE.exe
  C:\Windows\System\qvdlcKE.exe
  2⤵
  PID:12536
- C:\Windows\System\fdhExUR.exe
  C:\Windows\System\fdhExUR.exe
  2⤵
  PID:12572
- C:\Windows\System\SQHRuqW.exe
  C:\Windows\System\SQHRuqW.exe
  2⤵
  PID:12596
- C:\Windows\System\FQxxMCU.exe
  C:\Windows\System\FQxxMCU.exe
  2⤵
  PID:12624
- C:\Windows\System\qnhNwNL.exe
  C:\Windows\System\qnhNwNL.exe
  2⤵
  PID:12644
- C:\Windows\System\hnHPVUT.exe
  C:\Windows\System\hnHPVUT.exe
  2⤵
  PID:12672
- C:\Windows\System\fFLuZsG.exe
  C:\Windows\System\fFLuZsG.exe
  2⤵
  PID:12688
- C:\Windows\System\ihFTGhH.exe
  C:\Windows\System\ihFTGhH.exe
  2⤵
  PID:12720
- C:\Windows\System\ReWXLik.exe
  C:\Windows\System\ReWXLik.exe
  2⤵
  PID:12760
- C:\Windows\System\TZiCiUG.exe
  C:\Windows\System\TZiCiUG.exe
  2⤵
  PID:12780
- C:\Windows\System\mWejrqh.exe
  C:\Windows\System\mWejrqh.exe
  2⤵
  PID:12808
- C:\Windows\System\IlTPsxH.exe
  C:\Windows\System\IlTPsxH.exe
  2⤵
  PID:12840
- C:\Windows\System\XjfCtjZ.exe
  C:\Windows\System\XjfCtjZ.exe
  2⤵
  PID:12892
- C:\Windows\System\kmoEAer.exe
  C:\Windows\System\kmoEAer.exe
  2⤵
  PID:12920
- C:\Windows\System\seXEeoE.exe
  C:\Windows\System\seXEeoE.exe
  2⤵
  PID:12936
- C:\Windows\System\EdQvEiy.exe
  C:\Windows\System\EdQvEiy.exe
  2⤵
  PID:12968
- C:\Windows\System\mjYMkYe.exe
  C:\Windows\System\mjYMkYe.exe
  2⤵
  PID:12992
- C:\Windows\System\nwENFgZ.exe
  C:\Windows\System\nwENFgZ.exe
  2⤵
  PID:13032
- C:\Windows\System\oqhyxpA.exe
  C:\Windows\System\oqhyxpA.exe
  2⤵
  PID:13048
- C:\Windows\System\nIajDhP.exe
  C:\Windows\System\nIajDhP.exe
  2⤵
  PID:13064
- C:\Windows\System\GmPSNgR.exe
  C:\Windows\System\GmPSNgR.exe
  2⤵
  PID:13116
- C:\Windows\System\Qunican.exe
  C:\Windows\System\Qunican.exe
  2⤵
  PID:13132
- C:\Windows\System\evQiUtX.exe
  C:\Windows\System\evQiUtX.exe
  2⤵
  PID:13164
- C:\Windows\System\mYqNHVH.exe
  C:\Windows\System\mYqNHVH.exe
  2⤵
  PID:13188
- C:\Windows\System\veAHSzo.exe
  C:\Windows\System\veAHSzo.exe
  2⤵
  PID:13204
- C:\Windows\System\yXItnKr.exe
  C:\Windows\System\yXItnKr.exe
  2⤵
  PID:13224
- C:\Windows\System\AbPdlxP.exe
  C:\Windows\System\AbPdlxP.exe
  2⤵
  PID:13260
- C:\Windows\System\LAhHjmd.exe
  C:\Windows\System\LAhHjmd.exe
  2⤵
  PID:13288
- C:\Windows\System\HRJzBSz.exe
  C:\Windows\System\HRJzBSz.exe
  2⤵
  PID:12300
- C:\Windows\System\kMfqhZm.exe
  C:\Windows\System\kMfqhZm.exe
  2⤵
  PID:12356
- C:\Windows\System\QsoqGhm.exe
  C:\Windows\System\QsoqGhm.exe
  2⤵
  PID:12412
- C:\Windows\System\ANRjBYu.exe
  C:\Windows\System\ANRjBYu.exe
  2⤵
  PID:12504
- C:\Windows\System\ulAULIh.exe
  C:\Windows\System\ulAULIh.exe
  2⤵
  PID:12612
- C:\Windows\System\PwgbjZP.exe
  C:\Windows\System\PwgbjZP.exe
  2⤵
  PID:12660
- C:\Windows\System\PgNLycD.exe
  C:\Windows\System\PgNLycD.exe
  2⤵
  PID:12700
- C:\Windows\System\OyRCrIB.exe
  C:\Windows\System\OyRCrIB.exe
  2⤵
  PID:12792
- C:\Windows\System\LFYYUiw.exe
  C:\Windows\System\LFYYUiw.exe
  2⤵
  PID:12876
- C:\Windows\System\uajFduX.exe
  C:\Windows\System\uajFduX.exe
  2⤵
  PID:12912
- C:\Windows\System\YgmKQkS.exe
  C:\Windows\System\YgmKQkS.exe
  2⤵
  PID:12928
- C:\Windows\System\PNmEfMU.exe
  C:\Windows\System\PNmEfMU.exe
  2⤵
  PID:13044
- C:\Windows\System\edoTxxQ.exe
  C:\Windows\System\edoTxxQ.exe
  2⤵
  PID:13112
- C:\Windows\System\VJGDGNp.exe
  C:\Windows\System\VJGDGNp.exe
  2⤵
  PID:13176
- C:\Windows\System\iDWkYTx.exe
  C:\Windows\System\iDWkYTx.exe
  2⤵
  PID:13200
- C:\Windows\System\KfEdRDG.exe
  C:\Windows\System\KfEdRDG.exe
  2⤵
  PID:13248
- C:\Windows\System\MTxewlG.exe
  C:\Windows\System\MTxewlG.exe
  2⤵
  PID:12060
- C:\Windows\System\TcbFMnk.exe
  C:\Windows\System\TcbFMnk.exe
  2⤵
  PID:12392
- C:\Windows\System\xKoPHvz.exe
  C:\Windows\System\xKoPHvz.exe
  2⤵
  PID:12500
- C:\Windows\System\DSUgzEz.exe
  C:\Windows\System\DSUgzEz.exe
  2⤵
  PID:12564
- C:\Windows\System\Bawaplj.exe
  C:\Windows\System\Bawaplj.exe
  2⤵
  PID:12948
- C:\Windows\System\pugOckI.exe
  C:\Windows\System\pugOckI.exe
  2⤵
  PID:13088
- C:\Windows\System\RPMIixA.exe
  C:\Windows\System\RPMIixA.exe
  2⤵
  PID:13212
- C:\Windows\System\pJkdlHK.exe
  C:\Windows\System\pJkdlHK.exe
  2⤵
  PID:11756
- C:\Windows\System\dQiuZHl.exe
  C:\Windows\System\dQiuZHl.exe
  2⤵
  PID:12636
- C:\Windows\System\zcpWlsp.exe
  C:\Windows\System\zcpWlsp.exe
  2⤵
  PID:13016
- C:\Windows\System\gOtluXd.exe
  C:\Windows\System\gOtluXd.exe
  2⤵
  PID:13172
- C:\Windows\System\neugLDQ.exe
  C:\Windows\System\neugLDQ.exe
  2⤵
  PID:12608
- C:\Windows\System\ppitWvu.exe
  C:\Windows\System\ppitWvu.exe
  2⤵
  PID:13320
- C:\Windows\System\DMtjMJj.exe
  C:\Windows\System\DMtjMJj.exe
  2⤵
  PID:13376
- C:\Windows\System\faJBUJN.exe
  C:\Windows\System\faJBUJN.exe
  2⤵
  PID:13396
- C:\Windows\System\HnLRjXv.exe
  C:\Windows\System\HnLRjXv.exe
  2⤵
  PID:13416
- C:\Windows\System\QJycmha.exe
  C:\Windows\System\QJycmha.exe
  2⤵
  PID:13476
- C:\Windows\System\zGORfHI.exe
  C:\Windows\System\zGORfHI.exe
  2⤵
  PID:13492
- C:\Windows\System\bZFUYZC.exe
  C:\Windows\System\bZFUYZC.exe
  2⤵
  PID:13532
- C:\Windows\System\RfxBxoM.exe
  C:\Windows\System\RfxBxoM.exe
  2⤵
  PID:13548
- C:\Windows\System\iDlrnHX.exe
  C:\Windows\System\iDlrnHX.exe
  2⤵
  PID:13588
- C:\Windows\System\AluQGjQ.exe
  C:\Windows\System\AluQGjQ.exe
  2⤵
  PID:13604
- C:\Windows\System\TRCFQdh.exe
  C:\Windows\System\TRCFQdh.exe
  2⤵
  PID:13624
- C:\Windows\System\ZmQUIah.exe
  C:\Windows\System\ZmQUIah.exe
  2⤵
  PID:13644
- C:\Windows\System\YswRFzq.exe
  C:\Windows\System\YswRFzq.exe
  2⤵
  PID:13692
- C:\Windows\System\skoHrSw.exe
  C:\Windows\System\skoHrSw.exe
  2⤵
  PID:13716
- C:\Windows\System\SvHghfw.exe
  C:\Windows\System\SvHghfw.exe
  2⤵
  PID:13756
- C:\Windows\System\QEEoZEI.exe
  C:\Windows\System\QEEoZEI.exe
  2⤵
  PID:13776
- C:\Windows\System\VYUbvTQ.exe
  C:\Windows\System\VYUbvTQ.exe
  2⤵
  PID:13804
- C:\Windows\System\mxBvvLz.exe
  C:\Windows\System\mxBvvLz.exe
  2⤵
  PID:13824
- C:\Windows\System\bvZhXyN.exe
  C:\Windows\System\bvZhXyN.exe
  2⤵
  PID:13860
- C:\Windows\System\qGTRLVV.exe
  C:\Windows\System\qGTRLVV.exe
  2⤵
  PID:13880
- C:\Windows\System\uMOFAvp.exe
  C:\Windows\System\uMOFAvp.exe
  2⤵
  PID:13900
- C:\Windows\System\gaAjREI.exe
  C:\Windows\System\gaAjREI.exe
  2⤵
  PID:13924
- C:\Windows\System\SfOmkfB.exe
  C:\Windows\System\SfOmkfB.exe
  2⤵
  PID:13948
- C:\Windows\System\OMUOGWt.exe
  C:\Windows\System\OMUOGWt.exe
  2⤵
  PID:13968
- C:\Windows\System\XrfWghP.exe
  C:\Windows\System\XrfWghP.exe
  2⤵
  PID:14000
- C:\Windows\System\SDsstEf.exe
  C:\Windows\System\SDsstEf.exe
  2⤵
  PID:14068
- C:\Windows\System\nemNBhn.exe
  C:\Windows\System\nemNBhn.exe
  2⤵
  PID:14084
- C:\Windows\System\wbDXNoj.exe
  C:\Windows\System\wbDXNoj.exe
  2⤵
  PID:14108
- C:\Windows\System\JyrNPXu.exe
  C:\Windows\System\JyrNPXu.exe
  2⤵
  PID:14132
- C:\Windows\System\JQrTMic.exe
  C:\Windows\System\JQrTMic.exe
  2⤵
  PID:14176
- C:\Windows\System\JwikMqH.exe
  C:\Windows\System\JwikMqH.exe
  2⤵
  PID:14200
- C:\Windows\System\XRnDmLK.exe
  C:\Windows\System\XRnDmLK.exe
  2⤵
  PID:14236
- C:\Windows\System\NqdthQx.exe
  C:\Windows\System\NqdthQx.exe
  2⤵
  PID:14256
- C:\Windows\System\QPrvoHU.exe
  C:\Windows\System\QPrvoHU.exe
  2⤵
  PID:14288
- C:\Windows\System\KScNnZl.exe
  C:\Windows\System\KScNnZl.exe
  2⤵
  PID:14308
- C:\Windows\System\lgdtfAF.exe
  C:\Windows\System\lgdtfAF.exe
  2⤵
  PID:13148
- C:\Windows\System\ravNPDq.exe
  C:\Windows\System\ravNPDq.exe
  2⤵
  PID:13368
- C:\Windows\System\qSGLYvb.exe
  C:\Windows\System\qSGLYvb.exe
  2⤵
  PID:13436
- C:\Windows\System\tEMjgJd.exe
  C:\Windows\System\tEMjgJd.exe
  2⤵
  PID:13484
- C:\Windows\System\MMBuOOl.exe
  C:\Windows\System\MMBuOOl.exe
  2⤵
  PID:13528
- C:\Windows\System\ngbNDZD.exe
  C:\Windows\System\ngbNDZD.exe
  2⤵
  PID:13580
- C:\Windows\System\loBvzsP.exe
  C:\Windows\System\loBvzsP.exe
  2⤵
  PID:13636
- C:\Windows\System\uhjwaEz.exe
  C:\Windows\System\uhjwaEz.exe
  2⤵
  PID:13708
- C:\Windows\System\jPSkske.exe
  C:\Windows\System\jPSkske.exe
  2⤵
  PID:13728
- C:\Windows\System\powUZwp.exe
  C:\Windows\System\powUZwp.exe
  2⤵
  PID:13788
- C:\Windows\System\KSXYFXs.exe
  C:\Windows\System\KSXYFXs.exe
  2⤵
  PID:13888
- C:\Windows\System\cXjKDJZ.exe
  C:\Windows\System\cXjKDJZ.exe
  2⤵
  PID:13932
- C:\Windows\System\ZxlmIAK.exe
  C:\Windows\System\ZxlmIAK.exe
  2⤵
  PID:14056
- C:\Windows\System\YXGUIvn.exe
  C:\Windows\System\YXGUIvn.exe
  2⤵
  PID:14100
- C:\Windows\System\bDPPrjB.exe
  C:\Windows\System\bDPPrjB.exe
  2⤵
  PID:14120
- C:\Windows\System\qaDZNec.exe
  C:\Windows\System\qaDZNec.exe
  2⤵
  PID:14244
- C:\Windows\System\rNQdgtG.exe
  C:\Windows\System\rNQdgtG.exe
  2⤵
  PID:14284
- C:\Windows\System\EEhRatW.exe
  C:\Windows\System\EEhRatW.exe
  2⤵
  PID:13392
- C:\Windows\System\NlYKoPP.exe
  C:\Windows\System\NlYKoPP.exe
  2⤵
  PID:13600
- C:\Windows\System\gmGUauY.exe
  C:\Windows\System\gmGUauY.exe
  2⤵
  PID:13664
- C:\Windows\System\YDahZnQ.exe
  C:\Windows\System\YDahZnQ.exe
  2⤵
  PID:13768
- C:\Windows\System\vpJkqdo.exe
  C:\Windows\System\vpJkqdo.exe
  2⤵
  PID:13996
- C:\Windows\System\dRYyOVW.exe
  C:\Windows\System\dRYyOVW.exe
  2⤵
  PID:14156
- C:\Windows\System\pPqopSo.exe
  C:\Windows\System\pPqopSo.exe
  2⤵
  PID:11708
- C:\Windows\System\bLUYgyq.exe
  C:\Windows\System\bLUYgyq.exe
  2⤵
  PID:13540
- C:\Windows\System\jmoDPtV.exe
  C:\Windows\System\jmoDPtV.exe
  2⤵
  PID:13800
- C:\Windows\System\slYCCEu.exe
  C:\Windows\System\slYCCEu.exe
  2⤵
  PID:14076
- C:\Windows\System\chrdByu.exe
  C:\Windows\System\chrdByu.exe
  2⤵
  PID:14212
- C:\Windows\System\aTnyNeI.exe
  C:\Windows\System\aTnyNeI.exe
  2⤵
  PID:14364
- C:\Windows\System\tpEkkip.exe
  C:\Windows\System\tpEkkip.exe
  2⤵
  PID:14392
- C:\Windows\System\oSWrJlz.exe
  C:\Windows\System\oSWrJlz.exe
  2⤵
  PID:14416
- C:\Windows\System\EHccasi.exe
  C:\Windows\System\EHccasi.exe
  2⤵
  PID:14444
- C:\Windows\System\nAgoPDd.exe
  C:\Windows\System\nAgoPDd.exe
  2⤵
  PID:14464
- C:\Windows\System\JqYKKEO.exe
  C:\Windows\System\JqYKKEO.exe
  2⤵
  PID:14500
- C:\Windows\System\HpvHBzn.exe
  C:\Windows\System\HpvHBzn.exe
  2⤵
  PID:14540
- C:\Windows\System\NAEvrlo.exe
  C:\Windows\System\NAEvrlo.exe
  2⤵
  PID:14560
- C:\Windows\System\dkTjNCd.exe
  C:\Windows\System\dkTjNCd.exe
  2⤵
  PID:14588
- C:\Windows\System\ncubMVd.exe
  C:\Windows\System\ncubMVd.exe
  2⤵
  PID:14640
- C:\Windows\System\zWLxtfg.exe
  C:\Windows\System\zWLxtfg.exe
  2⤵
  PID:14656
- C:\Windows\System\XuISnOW.exe
  C:\Windows\System\XuISnOW.exe
  2⤵
  PID:14672
- C:\Windows\System\yOMuDOi.exe
  C:\Windows\System\yOMuDOi.exe
  2⤵
  PID:14696
- C:\Windows\System\ZROrmEK.exe
  C:\Windows\System\ZROrmEK.exe
  2⤵
  PID:14728
- C:\Windows\System\AkbuXjm.exe
  C:\Windows\System\AkbuXjm.exe
  2⤵
  PID:14780
- C:\Windows\System\wPiGneG.exe
  C:\Windows\System\wPiGneG.exe
  2⤵
  PID:14800
- C:\Windows\System\sAjOIIj.exe
  C:\Windows\System\sAjOIIj.exe
  2⤵
  PID:14816
- C:\Windows\System\VjnRGfV.exe
  C:\Windows\System\VjnRGfV.exe
  2⤵
  PID:14840
- C:\Windows\System\vkcOCkC.exe
  C:\Windows\System\vkcOCkC.exe
  2⤵
  PID:14876
- C:\Windows\System\rEIoMPK.exe
  C:\Windows\System\rEIoMPK.exe
  2⤵
  PID:14900
- C:\Windows\System\JdTaSUW.exe
  C:\Windows\System\JdTaSUW.exe
  2⤵
  PID:14944
- C:\Windows\System\btlokwm.exe
  C:\Windows\System\btlokwm.exe
  2⤵
  PID:14968
- C:\Windows\System\IBuVgJo.exe
  C:\Windows\System\IBuVgJo.exe
  2⤵
  PID:14984
- C:\Windows\System\GmEGRDW.exe
  C:\Windows\System\GmEGRDW.exe
  2⤵
  PID:15008
- C:\Windows\System\yccuEgw.exe
  C:\Windows\System\yccuEgw.exe
  2⤵
  PID:15036
- C:\Windows\System\ZhCDTlF.exe
  C:\Windows\System\ZhCDTlF.exe
  2⤵
  PID:15064
- C:\Windows\System\PbgYWSW.exe
  C:\Windows\System\PbgYWSW.exe
  2⤵
  PID:15108
- C:\Windows\System\wCIeqjT.exe
  C:\Windows\System\wCIeqjT.exe
  2⤵
  PID:15164
- C:\Windows\System\aTKCNfj.exe
  C:\Windows\System\aTKCNfj.exe
  2⤵
  PID:15188
- C:\Windows\System\XBfhxcs.exe
  C:\Windows\System\XBfhxcs.exe
  2⤵
  PID:15220
- C:\Windows\System\aMATCGo.exe
  C:\Windows\System\aMATCGo.exe
  2⤵
  PID:15236
- C:\Windows\System\YkylWrb.exe
  C:\Windows\System\YkylWrb.exe
  2⤵
  PID:15276
- C:\Windows\System\vdjyqMG.exe
  C:\Windows\System\vdjyqMG.exe
  2⤵
  PID:15292
- C:\Windows\System\DrTtClN.exe
  C:\Windows\System\DrTtClN.exe
  2⤵
  PID:15332
- C:\Windows\System\sqyRdjb.exe
  C:\Windows\System\sqyRdjb.exe
  2⤵
  PID:15348
- C:\Windows\System\OdZfBLZ.exe
  C:\Windows\System\OdZfBLZ.exe
  2⤵
  PID:14052
- C:\Windows\System\UbDSSeJ.exe
  C:\Windows\System\UbDSSeJ.exe
  2⤵
  PID:14376
- C:\Windows\System\KaZjsqS.exe
  C:\Windows\System\KaZjsqS.exe
  2⤵
  PID:14412
- C:\Windows\System\UGDruMj.exe
  C:\Windows\System\UGDruMj.exe
  2⤵
  PID:14460
- C:\Windows\System\chmyktC.exe
  C:\Windows\System\chmyktC.exe
  2⤵
  PID:14496
- C:\Windows\System\bzljPHd.exe
  C:\Windows\System\bzljPHd.exe
  2⤵
  PID:14556
- C:\Windows\System\scvxFPd.exe
  C:\Windows\System\scvxFPd.exe
  2⤵
  PID:14624
- C:\Windows\System\eNShkGA.exe
  C:\Windows\System\eNShkGA.exe
  2⤵
  PID:14664
- C:\Windows\System\THJRjCl.exe
  C:\Windows\System\THJRjCl.exe
  2⤵
  PID:14720
- C:\Windows\System\YzmCEED.exe
  C:\Windows\System\YzmCEED.exe
  2⤵
  PID:13772
- C:\Windows\System\lwJAvMo.exe
  C:\Windows\System\lwJAvMo.exe
  2⤵
  PID:14832
- C:\Windows\System\apYDzhh.exe
  C:\Windows\System\apYDzhh.exe
  2⤵
  PID:14872
- C:\Windows\System\mIWacaZ.exe
  C:\Windows\System\mIWacaZ.exe
  2⤵
  PID:14952
- C:\Windows\System\HEokWSG.exe
  C:\Windows\System\HEokWSG.exe
  2⤵
  PID:15032
- C:\Windows\System\PMjMeyd.exe
  C:\Windows\System\PMjMeyd.exe
  2⤵
  PID:15052
- C:\Windows\System\kQYsqLu.exe
  C:\Windows\System\kQYsqLu.exe
  2⤵
  PID:15096
- C:\Windows\System\dpwDCWk.exe
  C:\Windows\System\dpwDCWk.exe
  2⤵
  PID:15124
- C:\Windows\System\IBevKrx.exe
  C:\Windows\System\IBevKrx.exe
  2⤵
  PID:15184
- C:\Windows\System\GxfWXkY.exe
  C:\Windows\System\GxfWXkY.exe
  2⤵
  PID:15228
- C:\Windows\System\IpHVjzF.exe
  C:\Windows\System\IpHVjzF.exe
  2⤵
  PID:15304
- C:\Windows\System\PBGsoxh.exe
  C:\Windows\System\PBGsoxh.exe
  2⤵
  PID:15344
- C:\Windows\System\jtMHfMa.exe
  C:\Windows\System\jtMHfMa.exe
  2⤵
  PID:13256
- C:\Windows\System\BTHVatZ.exe
  C:\Windows\System\BTHVatZ.exe
  2⤵
  PID:14576
- C:\Windows\System\YAovJAv.exe
  C:\Windows\System\YAovJAv.exe
  2⤵
  PID:14668
- C:\Windows\System\AALtAJM.exe
  C:\Windows\System\AALtAJM.exe
  2⤵
  PID:14792
- C:\Windows\System\OHlfGqa.exe
  C:\Windows\System\OHlfGqa.exe
  2⤵
  PID:14760
- C:\Windows\System\gXyOKdj.exe
  C:\Windows\System\gXyOKdj.exe
  2⤵
  PID:14924
- C:\Windows\System\OMIxxBy.exe
  C:\Windows\System\OMIxxBy.exe
  2⤵
  PID:15172
- C:\Windows\System\ShUIrRc.exe
  C:\Windows\System\ShUIrRc.exe
  2⤵
  PID:15128
- C:\Windows\System\rTnKHct.exe
  C:\Windows\System\rTnKHct.exe
  2⤵
  PID:14408
- C:\Windows\System\JjnScBr.exe
  C:\Windows\System\JjnScBr.exe
  2⤵
  PID:15268
- C:\Windows\System\zPvZWot.exe
  C:\Windows\System\zPvZWot.exe
  2⤵
  PID:15372
- C:\Windows\System\oAPIYlZ.exe
  C:\Windows\System\oAPIYlZ.exe
  2⤵
  PID:15388
- C:\Windows\System\tkDKOXq.exe
  C:\Windows\System\tkDKOXq.exe
  2⤵
  PID:15424
- C:\Windows\System\ZCplqQz.exe
  C:\Windows\System\ZCplqQz.exe
  2⤵
  PID:15452
- C:\Windows\System\sqxFCTp.exe
  C:\Windows\System\sqxFCTp.exe
  2⤵
  PID:15488
- C:\Windows\System\QVszMRV.exe
  C:\Windows\System\QVszMRV.exe
  2⤵
  PID:15508
- C:\Windows\System\XZtOLdo.exe
  C:\Windows\System\XZtOLdo.exe
  2⤵
  PID:15536
- C:\Windows\System\hsxTvKv.exe
  C:\Windows\System\hsxTvKv.exe
  2⤵
  PID:15560
- C:\Windows\System\eqPnUSq.exe
  C:\Windows\System\eqPnUSq.exe
  2⤵
  PID:15584
- C:\Windows\System\ZwyVSYk.exe
  C:\Windows\System\ZwyVSYk.exe
  2⤵
  PID:15624
- C:\Windows\System\MlikcHL.exe
  C:\Windows\System\MlikcHL.exe
  2⤵
  PID:15640
- C:\Windows\System\FTwSIPU.exe
  C:\Windows\System\FTwSIPU.exe
  2⤵
  PID:15672
- C:\Windows\System\UJjQzZG.exe
  C:\Windows\System\UJjQzZG.exe
  2⤵
  PID:15692
- C:\Windows\System\otquTdD.exe
  C:\Windows\System\otquTdD.exe
  2⤵
  PID:15716
- C:\Windows\System\WDSVMbj.exe
  C:\Windows\System\WDSVMbj.exe
  2⤵
  PID:15732
- C:\Windows\System\WxoTzYR.exe
  C:\Windows\System\WxoTzYR.exe
  2⤵
  PID:15748
- C:\Windows\System\rsvBEfu.exe
  C:\Windows\System\rsvBEfu.exe
  2⤵
  PID:15772
- C:\Windows\System\xtjVKvh.exe
  C:\Windows\System\xtjVKvh.exe
  2⤵
  PID:15792
- C:\Windows\System\YGWmnZo.exe
  C:\Windows\System\YGWmnZo.exe
  2⤵
  PID:15824
- C:\Windows\System\XPktoct.exe
  C:\Windows\System\XPktoct.exe
  2⤵
  PID:15852
- C:\Windows\System\dFumiLk.exe
  C:\Windows\System\dFumiLk.exe
  2⤵
  PID:15868
- C:\Windows\System\xfDKMqW.exe
  C:\Windows\System\xfDKMqW.exe
  2⤵
  PID:15884
- C:\Windows\System\tbknGse.exe
  C:\Windows\System\tbknGse.exe
  2⤵
  PID:15908
- C:\Windows\System\QisIgqp.exe
  C:\Windows\System\QisIgqp.exe
  2⤵
  PID:15928
- C:\Windows\System\DKLWzeb.exe
  C:\Windows\System\DKLWzeb.exe
  2⤵
  PID:15944
- C:\Windows\System\ULQfXno.exe
  C:\Windows\System\ULQfXno.exe
  2⤵
  PID:15964
- C:\Windows\System\NeSYzSf.exe
  C:\Windows\System\NeSYzSf.exe
  2⤵
  PID:15984
- C:\Windows\System\fZTSAoR.exe
  C:\Windows\System\fZTSAoR.exe
  2⤵
  PID:16012
- C:\Windows\System\jyLBrDs.exe
  C:\Windows\System\jyLBrDs.exe
  2⤵
  PID:16032
- C:\Windows\System\PhryToC.exe
  C:\Windows\System\PhryToC.exe
  2⤵
  PID:16052
- C:\Windows\System\ZCSbSuo.exe
  C:\Windows\System\ZCSbSuo.exe
  2⤵
  PID:16072
- C:\Windows\System\CiMhChB.exe
  C:\Windows\System\CiMhChB.exe
  2⤵
  PID:16088
- C:\Windows\System\meBxjsA.exe
  C:\Windows\System\meBxjsA.exe
  2⤵
  PID:16108
- C:\Windows\System\mUeakDr.exe
  C:\Windows\System\mUeakDr.exe
  2⤵
  PID:16124
- C:\Windows\System\AbPGsgk.exe
  C:\Windows\System\AbPGsgk.exe
  2⤵
  PID:16152
- C:\Windows\System\HqCAHsF.exe
  C:\Windows\System\HqCAHsF.exe
  2⤵
  PID:16172
- C:\Windows\System\PdyCPKr.exe
  C:\Windows\System\PdyCPKr.exe
  2⤵
  PID:16204
- C:\Windows\System\jFdhDRA.exe
  C:\Windows\System\jFdhDRA.exe
  2⤵
  PID:16228
- C:\Windows\System\MngApxf.exe
  C:\Windows\System\MngApxf.exe
  2⤵
  PID:16252
- C:\Windows\System\SfxAeQf.exe
  C:\Windows\System\SfxAeQf.exe
  2⤵
  PID:16292
- C:\Windows\System\mZyQFqW.exe
  C:\Windows\System\mZyQFqW.exe
  2⤵
  PID:16316
- C:\Windows\System\yQnosJg.exe
  C:\Windows\System\yQnosJg.exe
  2⤵
  PID:16332
- C:\Windows\System\mcyPGpf.exe
  C:\Windows\System\mcyPGpf.exe
  2⤵
  PID:16352
- C:\Windows\System\sjURpGN.exe
  C:\Windows\System\sjURpGN.exe
  2⤵
  PID:16372
- C:\Windows\System\nBEgzuy.exe
  C:\Windows\System\nBEgzuy.exe
  2⤵
  PID:14960
- C:\Windows\System\LbrcoTc.exe
  C:\Windows\System\LbrcoTc.exe
  2⤵
  PID:15272
- C:\Windows\System\LgvAMuH.exe
  C:\Windows\System\LgvAMuH.exe
  2⤵
  PID:15412
- C:\Windows\System\qrAPuRD.exe
  C:\Windows\System\qrAPuRD.exe
  2⤵
  PID:15444
- C:\Windows\System\vGgOVRN.exe
  C:\Windows\System\vGgOVRN.exe
  2⤵
  PID:15204
- C:\Windows\System\jMFuQhi.exe
  C:\Windows\System\jMFuQhi.exe
  2⤵
  PID:14488
- C:\Windows\System\eTVZixp.exe
  C:\Windows\System\eTVZixp.exe
  2⤵
  PID:15404
- C:\Windows\System\zWKDGpc.exe
  C:\Windows\System\zWKDGpc.exe
  2⤵
  PID:15636
- C:\Windows\System\DynQAGf.exe
  C:\Windows\System\DynQAGf.exe
  2⤵
  PID:15744
- C:\Windows\System\HxcwMhV.exe
  C:\Windows\System\HxcwMhV.exe
  2⤵
  PID:15580
- - C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -u -p 15580 -s 248
    3⤵
    PID:16892
- C:\Windows\System\myJTSbr.exe
  C:\Windows\System\myJTSbr.exe
  2⤵
  PID:15660
- C:\Windows\System\wuXhdeS.exe
  C:\Windows\System\wuXhdeS.exe
  2⤵
  PID:15700
- C:\Windows\System\xsDFUWs.exe
  C:\Windows\System\xsDFUWs.exe
  2⤵
  PID:15916
- C:\Windows\System\ZUYILSb.exe
  C:\Windows\System\ZUYILSb.exe
  2⤵
  PID:15972
- C:\Windows\System\BxEpeVx.exe
  C:\Windows\System\BxEpeVx.exe
  2⤵
  PID:15780
- C:\Windows\System\QBPmhsy.exe
  C:\Windows\System\QBPmhsy.exe
  2⤵
  PID:15668
- C:\Windows\System\waizAJJ.exe
  C:\Windows\System\waizAJJ.exe
  2⤵
  PID:16104
- C:\Windows\System\UQCWsAN.exe
  C:\Windows\System\UQCWsAN.exe
  2⤵
  PID:15936
- C:\Windows\System\iEmrZDI.exe
  C:\Windows\System\iEmrZDI.exe
  2⤵
  PID:16312
- C:\Windows\System\XAsDjvF.exe
  C:\Windows\System\XAsDjvF.exe
  2⤵
  PID:16388
- C:\Windows\System\htcPEdY.exe
  C:\Windows\System\htcPEdY.exe
  2⤵
  PID:16420
- C:\Windows\System\vdJNrlZ.exe
  C:\Windows\System\vdJNrlZ.exe
  2⤵
  PID:16440
- C:\Windows\System\bBcEfLr.exe
  C:\Windows\System\bBcEfLr.exe
  2⤵
  PID:16468
- C:\Windows\System\kuLGTWG.exe
  C:\Windows\System\kuLGTWG.exe
  2⤵
  PID:16484
- C:\Windows\System\atkpSvf.exe
  C:\Windows\System\atkpSvf.exe
  2⤵
  PID:16508
- C:\Windows\System\TbuRwii.exe
  C:\Windows\System\TbuRwii.exe
  2⤵
  PID:16532
- C:\Windows\System\IrqpRvh.exe
  C:\Windows\System\IrqpRvh.exe
  2⤵
  PID:16548
- C:\Windows\System\TqetCcg.exe
  C:\Windows\System\TqetCcg.exe
  2⤵
  PID:16568
- C:\Windows\System\PSfCDax.exe
  C:\Windows\System\PSfCDax.exe
  2⤵
  PID:16588
- C:\Windows\System\OxkcyRA.exe
  C:\Windows\System\OxkcyRA.exe
  2⤵
  PID:16608
- C:\Windows\System\OJukDTf.exe
  C:\Windows\System\OJukDTf.exe
  2⤵
  PID:16632
- C:\Windows\System\nNNGSwI.exe
  C:\Windows\System\nNNGSwI.exe
  2⤵
  PID:16648
- C:\Windows\System\mtlRtmj.exe
  C:\Windows\System\mtlRtmj.exe
  2⤵
  PID:16668
- C:\Windows\System\YWLqOkU.exe
  C:\Windows\System\YWLqOkU.exe
  2⤵
  PID:16692
- C:\Windows\System\YrhpJxp.exe
  C:\Windows\System\YrhpJxp.exe
  2⤵
  PID:16712
- C:\Windows\System\LlnwPhB.exe
  C:\Windows\System\LlnwPhB.exe
  2⤵
  PID:16736
- C:\Windows\System\dQtaIUn.exe
  C:\Windows\System\dQtaIUn.exe
  2⤵
  PID:16756
- C:\Windows\System\uqNmYpC.exe
  C:\Windows\System\uqNmYpC.exe
  2⤵
  PID:16780
- C:\Windows\System\EBepPNI.exe
  C:\Windows\System\EBepPNI.exe
  2⤵
  PID:16812
- C:\Windows\System\hsuvJCZ.exe
  C:\Windows\System\hsuvJCZ.exe
  2⤵
  PID:16828
- C:\Windows\System\DsPPrFM.exe
  C:\Windows\System\DsPPrFM.exe
  2⤵
  PID:16856
- C:\Windows\System\amzhpVm.exe
  C:\Windows\System\amzhpVm.exe
  2⤵
  PID:16896
- C:\Windows\System\uGnhFmx.exe
  C:\Windows\System\uGnhFmx.exe
  2⤵
  PID:16916
- C:\Windows\System\EsEBJiU.exe
  C:\Windows\System\EsEBJiU.exe
  2⤵
  PID:15076
- C:\Windows\System\czlqaUO.exe
  C:\Windows\System\czlqaUO.exe
  2⤵
  PID:15420
- C:\Windows\System\ibwNlec.exe
  C:\Windows\System\ibwNlec.exe
  2⤵
  PID:16308
- C:\Windows\System\SAABYbt.exe
  C:\Windows\System\SAABYbt.exe
  2⤵
  PID:16060
- C:\Windows\System\xetFjhZ.exe
  C:\Windows\System\xetFjhZ.exe
  2⤵
  PID:14964
- C:\Windows\System\wfSqqRQ.exe
  C:\Windows\System\wfSqqRQ.exe
  2⤵
  PID:15464
- C:\Windows\System\WmModFi.exe
  C:\Windows\System\WmModFi.exe
  2⤵
  PID:16640
- C:\Windows\System\RntZMoG.exe
  C:\Windows\System\RntZMoG.exe
  2⤵
  PID:16660
- C:\Windows\System\ZvNhwwb.exe
  C:\Windows\System\ZvNhwwb.exe
  2⤵
  PID:16792
- C:\Windows\System\WjlsALm.exe
  C:\Windows\System\WjlsALm.exe
  2⤵
  PID:16280
- C:\Windows\System\CYTrjjl.exe
  C:\Windows\System\CYTrjjl.exe
  2⤵
  PID:17192

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:14356

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\AGgFzrV.exe

Filesize
1.7MB

MD5
39c5113f327d9cdcaada0b0e5bf0ed4f

SHA1
ca199e898896d1a06044d95238eec5310f69daaf

SHA256
49199400253d6d1cf2fefd0dd58ab4708cf4437916f8e5270d573222eed6fb9c

SHA512
bd32fd98a789bbaadc3071325efaeba0a02bb1a05deca13ec28c9c825b006945925e3ec6adcbcdce37a42ed2ad84081fba9e7e00be9e73e3ab90717a0072f917

Download Submit
C:\Windows\System\AuQNblx.exe

Filesize
1.7MB

MD5
fb13bc8109726ad00ae35946c39fb177

SHA1
2bad448aa507063e134027a27daffc77a7e18518

SHA256
8dece6e97630b5a27ffbf5c7221f9040c3c44cf3a9cabcb02ea5907a3bf2f0b6

SHA512
32a9ee98d63b5e3073534a2b69494c1e7a8bb47cb726c15b0845d64b484e37eb7db87d249c84e1a75192d6b9f692b8d07a8fea4cd932537a72d353e61649dd3c

Download Submit
C:\Windows\System\DKLsRkv.exe

Filesize
1.7MB

MD5
8f297d8bbc8455f5e0bf41570279e861

SHA1
e7fa5ff3da0eb462c7b23eb5720485196959465c

SHA256
9d13313eadd4efbe1da415f921a9a25b57d7dcc3ddac6050daf5de2fbeab646a

SHA512
a01828dc0767071532fe5af16fc9eb73ff3f8d856f7269785d2c6f0e10158a0609bf2472c11642522b777a17e78a142a1811382367917e880b44ea5a278dbe29

Download Submit
C:\Windows\System\DXYuzmZ.exe

Filesize
1.7MB

MD5
d92f732bab70b718e14232f251dfc644

SHA1
8ea7578c4865d6784bce3b39216702a6671b8d60

SHA256
d35806923f8d6bea19cfd552adde414b27d6bd2756953126ffee89d9d9431128

SHA512
145d7f70be68b89264e5286d75894ca4d234a8a5b577154128f41ab3c9062a5c82ceb4f3a4fc5acf8ed85bddb751cf7333cd7263aad8027941936c62c2b50d80

Download Submit
C:\Windows\System\DlcOFWn.exe

Filesize
1.7MB

MD5
94be918e4076025ff6b7d2fd15906c93

SHA1
91e70a7f48e2d1d78582a09861fd1497a14b79e4

SHA256
c82daf5369026eefa37a96e697498b42e4819f9f4407bd6315d94df8ec285abc

SHA512
0e8eddcbb91b2762a94a1888cd810fd9e9162a16efe740f5b4d24ca13e6eab3a0474301f32aad245017fe1306e0d09bc2dfa862a0ae480d002ace64d074ebc71

Download Submit
C:\Windows\System\FBBsLde.exe

Filesize
1.7MB

MD5
165269712b3f860693176216e2d35ccf

SHA1
2a83efb2f2e40e5adeb22f965fc4d394833fdb82

SHA256
92935cd2f97fb0c1a9b414d93c1f45ca4d86f35c80bb8234d2a484d55c337078

SHA512
3239d8e07229c5e5535e7c353e45878168cc4cf87dc5f01f89eb5b891c80a749103564f716168d8fe108e79084243c706066ca047dafe5b88fef2d3706be82a1

Download Submit
C:\Windows\System\HSfthQd.exe

Filesize
1.7MB

MD5
e94c0154fc36060027ff629d5ccde7f5

SHA1
5a27d9cfbe29de76b0cd032fa8df0d9959720164

SHA256
364c710372636a5933f0ab25b3901344d97fa01e300aef8728ea67d2ec1479e9

SHA512
91d4768f2be40f03af44b8fb4832618481407c10774c82ba711990a8505abe6184990234350a257a589b979a9b61140fbfb6af71de9bd55d179f3592b693bd41

Download Submit
C:\Windows\System\HigHjYX.exe

Filesize
1.7MB

MD5
787a392c121ba322d0450cd67aeb1572

SHA1
165f2c3f0a353a6341be7421e5891ff26c050dcf

SHA256
5daacf48acb67c2a3b9ca7fff87bbaf5564acf4f2ffeded5cdad4ab063b0ab42

SHA512
5efcaed960d7101638cb7c2f8e77a1853071abcad191a9014f5489464499dff610a73ffb6f07b988ae6d4f63babe957998b1b0a8562f6358f9327334e2d8ef27

Download Submit
C:\Windows\System\LEhvcWS.exe

Filesize
1.7MB

MD5
5a8df38ca9fff4f1b20c03ddbc3424e8

SHA1
87333e5f7f55562540ab150a6ae6946616f78891

SHA256
67ad446a7306e673a97821fb8c1588b76ae1e1017bf40789fa26077160f3735d

SHA512
3ae0788c6d1763ea58b16f9fea29f2fa02117a5d59690ee3baba59efdfb61a3822f102cf73edacc8d7b9c5deebe2b81267feff15870b053225361a206eec033e

Download Submit
C:\Windows\System\NMPWhLc.exe

Filesize
1.7MB

MD5
3ff7c08650641f8fb8562fcb787fbed1

SHA1
0c806e8e52395f37fcd2bd3aa40c3bf1063dfafe

SHA256
d70e197501d00638352a667ed96b65acbd7802c722d9ad3159dc5a818fccd0e8

SHA512
bb226c842301d335dc6c4744d402cb395b375aef6693862a38be474e9bc229312ccb0971e303ae950c81e3d63a38648a2b480e1626046fc69b4a1d8526567059

Download Submit
C:\Windows\System\NRaRMqz.exe

Filesize
1.7MB

MD5
87eddec1f793c57e4113998f56d32738

SHA1
8a3ed0102c397b7cfbc659875598a477278523b8

SHA256
7d4adcf6d3d8318c35ae53151345b7c8a550fd5e1634beee68dd70490f94d956

SHA512
648bb92b6a28eae1c4c1fdab18a70d10774bd817bf49b3ef688a66affd89ee503e782c25f8aa938bc928a778dcc9861fa74682350199a6c217dfd86e08d7cfb2

Download Submit
C:\Windows\System\QikHjka.exe

Filesize
1.7MB

MD5
2a208f0e93c61c5052f3986527d78ac7

SHA1
7b0754254a9aa5a06d4e7b38f13ce7792fe0426e

SHA256
cb7982bbe44b7391eb5a6400911c24d140415481ad1c96798d93bf5cc8ad72b0

SHA512
34a143dc1158af0621701237c7b870b27c1a31e213336cb3e301b23331f02c66ac4a78e03ad4f4fcb0925701dd73e2b0fdef797654aa9f0e944edf55182c5878

Download Submit
C:\Windows\System\QquTrRN.exe

Filesize
1.7MB

MD5
1a91cfc617edcdb3cd91810ad11de463

SHA1
fe11d95b998104836f811e2769bb68c5e4e97ef5

SHA256
5bf1eacf0c9747e05b82a15c3664f794e37051b8f61684f651830940c79f11be

SHA512
c381d00dd77362f809536aa67b1b2a31befa72bdee7271446ed66fa090d47a635a93fb8a72536c53eaf4075952925cd280208ad5fd8114d2e0e82eb4b9cf1bdf

Download Submit
C:\Windows\System\RSNHUCm.exe

Filesize
1.7MB

MD5
5d13ce686618afb32012b25cecf1f8c7

SHA1
f4adca755e9339d11913db1851bde4472bf7745f

SHA256
c78d2288b6344b03bf0e15a7e09d3b9339343b8405fe9b439d636c9c9434e799

SHA512
66cc32861fdac3784f609ab1ace59099cc698a3c4596f5af9aa793fcbbb75d347f4c5448ab37e8e7b199b0ff546b996cadff21e0a695b3313e29a002b91df099

Download Submit
C:\Windows\System\Skrewfk.exe

Filesize
1.7MB

MD5
8a1fce930dd174539a2be564cfcbf083

SHA1
e388c71fed19ba071139a6e5a9145e12c2be3bd6

SHA256
b85f2da379ff1c785dd5ba1f7e9ceb9bf0bfe5632299c6b99f8294af51be9f9f

SHA512
d2cd2b66b948f8fea7349b40359558cfb508e98359e95bb4a15961f8b58aea7a182667fb4f2be1cebecfc2b4ada947dfcdc247b2cb19de737d6ff5438ca2797f

Download Submit
C:\Windows\System\UqOFRxg.exe

Filesize
1.7MB

MD5
cbd10a15a5cf80128f04e26a64508201

SHA1
393bfaa6091b2df701fa7d9e7815d5f773eeb236

SHA256
030c0e04769e963fea9c397c14f828cb1642fd5461905c4e035d42ff422afd64

SHA512
0c252f754a655ef746d348bb31a6305b7c0ed8cf6eff5e9b7a6a0c62e9d56cf2d4725d7a503c15ec9e26a0ed8f74713a1e38a0e7e3baf228f3df5185e1c57fab

Download Submit
C:\Windows\System\ZNHXoWs.exe

Filesize
1.7MB

MD5
f1d963c5a18ef78e902763a38b7945d1

SHA1
a8badbc4e80d5be7fb255c590085671733242188

SHA256
82ba75bd0d28fc0762cdf2472afca2793bf711fce2e5089923f83302a6547f0a

SHA512
346f85f9c11337dc8b46356e106b11db94b4d9f830129f9cddf5cb67b1c2e784f4694897faffa0f7e7503f6ab61cfd52512b59e7f53d4513a78c79bbb0acd0d8

Download Submit
C:\Windows\System\cIcapkp.exe

Filesize
1.7MB

MD5
794417a8c16fa928cd7357422eb0e828

SHA1
bcd4b0819202238093e6a7bfdc1f095123f53b81

SHA256
32ba08150217738af2cdfa25a81daa1ebef5da93530caa7ba78b2cfbf2d65929

SHA512
6150d94b6411a1ccae5a2cc3d0c9b63b30d6bcc7bc70625d4bc554eed25c8e7cb712d340460f609b88be1a2eab63afe7ee99bce891dcc8f02b1a05a56a9f104a

Download Submit
C:\Windows\System\cxHEIVe.exe

Filesize
1.7MB

MD5
ee73a73d07581b0fbed5c19535686582

SHA1
fdff315fae01ddce602db06b5a4800b20bc9263c

SHA256
0c8960bf9ec321710b84f9282edb49eb20dc3b61cef2c602c20196b5b02c922e

SHA512
90eb3923d19b4ca41d7bd6db3d5b0c5386706e0cbe4b568606b2b6d5413d91af83e90375e625a33c69daa7098229bc31d65e95bd304b00f377c95d960bb72e42

Download Submit
C:\Windows\System\drZdVwQ.exe

Filesize
1.7MB

MD5
475e0a1dacd1eee8f8abfe83aade5d8b

SHA1
6ddb625788ddafc65a659df95794648b31378cf8

SHA256
ad3693c3ec8a7337c5755e7b688f4a108b66a1c8cb39656fb7e939b535778368

SHA512
fd4f8ecd7cfb410cd29cacec80f7d625708db9a85e29fa8fa396b40fa8c9cf63d86e4409a61d161603b5fbf112b3482b16624a0863e8513f579606bedd50a760

Download Submit
C:\Windows\System\fbBkUQY.exe

Filesize
1.7MB

MD5
723dbcda5d9d177eafd4d6bd864c0a75

SHA1
a851a4031b38301231388d6f874349acaa2ab6e2

SHA256
534e3e5e29f3b2574a2dcfa5563c1c999e778ae4f9a7c8cef6befb08f921c244

SHA512
2414470e75bca95a8d1eabf2766c94df7ac687a2b3f302b9f50baf6fb2675235fdcce5d6bef9e562c6f2c1ecc9029f3526b638e4d94642a0496c39b03a734e50

Download Submit
C:\Windows\System\hrWXeHk.exe

Filesize
1.7MB

MD5
e7da276506348ae72696cd629ab0cc2b

SHA1
75178c895f2b34a3c2ce090cc467196586ff4bff

SHA256
a5543675d73f8898bc63c4c1a364036883c4be48dc3ed586b91ed854525eb360

SHA512
1e776d7dddd16c88f0b74aade0bae2a564401a586ae91b6877120c36777799873aeba2f65c3daa597ff5216a53b32ce733db4d23c93831fa80cc571ba5f932a6

Download Submit
C:\Windows\System\kvQsCXX.exe

Filesize
1.7MB

MD5
c52be2bfc0e2766a0fa9eee6058e03bd

SHA1
8bacdfea5ff58fb2c272605f63f4dec86a1f0488

SHA256
8ebb82b54df263c9f6ad99006615b3e2185e28d18d63bd0772c99ef20799b864

SHA512
03560a87170964800dba69accfc31621bd4772a9ad2116a347224183c104bdc9a5e0ca144cdc0598f2c8fc1ffe3ce945979029faf35e4abb1579bb6b1fd97ed7

Download Submit
C:\Windows\System\lJDTtzt.exe

Filesize
1.7MB

MD5
f7b506d852395bfac2f8e76f9dcb23f6

SHA1
84d14e1bbf812e28fbd5110479ab5e2020747a98

SHA256
25e642345e8be839bd0d62a338563e886339bf5481b50eb6c53051520b3598e0

SHA512
6828c3f66af175b1a9f3ad87507d3fcb3f1d79b1147075a5facca39aa6f0f190b3f896e5cd756b90a0014d22c7a78447fdd97edd92b7ba9a9747878abdcdee2d

Download Submit
C:\Windows\System\lJqFZfX.exe

Filesize
1.7MB

MD5
cfb4a7b5f6be56c8e52ffb83420d417d

SHA1
effcfa1282e634670ba3900ab9332d02ff541dc5

SHA256
dd51340af31d23fb3c48267ba1b31eb4ab13a8eeb80c6c761de773c0bb588482

SHA512
39bfb9b5b2c094b779258555add635d5971318f8d0ea6aa841452d1bee3b4028a3a6592e9a577f91295232df55dff4ae261bdec4f67f768c2b96a6c0a21c1371

Download Submit
C:\Windows\System\lKhLVbI.exe

Filesize
1.7MB

MD5
126719a90d36d1a14820a05f34e4a1ce

SHA1
fb00735f6c0365e64b41eac3e690a1930a665ff2

SHA256
2a67fada3e23295d1e215eac98303a57a9f74d83efaa5fbffa2a53538fa2e096

SHA512
f14f8844866965987d65764274be9277ec23ca220523a6d105f3ca5353402ce321658427d8a08f88edf7accd941e947f7bcb52ce621f4d5c43584549a0e06bf6

Download Submit
C:\Windows\System\lhYhAbt.exe

Filesize
1.7MB

MD5
fd92199f84cf4c7026610a7cadac8a19

SHA1
a7a2e9a0e9ef6c0db185c39c02d117a02c2e9393

SHA256
c2e2ab076337d2bbb5862462fadbbad9c4d52d166ef46f88bca98c3beb56e29a

SHA512
fc5be03bb88b1d2d0b0ae76cbc14d7dd1cf98bdd22f7a9f37eae58eb4de8ef9e7bfcdaf6e0c33834b9231fddbdc6483e3eccacb59429a99063bf7b7aa70a8d16

Download Submit
C:\Windows\System\ngeRLST.exe

Filesize
1.7MB

MD5
31a18b02c8fa8571d25a07f14a61eeb9

SHA1
63715b825dbe94a986d01fdaa354c09bc1fcc274

SHA256
41178c944ee632f6a9b8f255afd068c57e2832fe92edee9eaf2034225fbb0bf8

SHA512
61609b24247a6b3aa3289062b5942966b902847e148daa0bfcaa33ed243d6eef69e5dbe619cd95ed8aa084f863336df67eee6171832bd0fa7df36f12e89bb455

Download Submit
C:\Windows\System\qNddIEu.exe

Filesize
1.7MB

MD5
7aadf0d595e52657ebcb719059e68e84

SHA1
207ab12bec5349ede9079f13faccd2855fb69567

SHA256
f26d86003425c39372a4431dbab195fef572e8a1d0fee42dd43af66273620e72

SHA512
78f9b0f9b7a88e36f18b96bae729c62c2e3830ece58740b1a439af27fbd989b38d4ba8e9f76af433d9e8ae0bc0f3d0093b752cd9f366bc699c9eab294a9ac6b1

Download Submit
C:\Windows\System\qVpNHQM.exe

Filesize
1.7MB

MD5
6ed2d193d06bdf444e57f70e83afa64b

SHA1
d7cde495309730cdcdfb820db0c1eb863f51d723

SHA256
a179643fa86b8f4ef34a1bcf6c4458a00bdc6a74a2e76dd1730758892bb1a84c

SHA512
66d06feaf9c241b56326acde1e3e948937582233a7727f2c956c403fc6f0e701d21ae0e51126eae6c797c43a688c20fcf023a1cb23b4097811bef9fbf41984c5

Download Submit
C:\Windows\System\tGsDIDI.exe

Filesize
1.7MB

MD5
ad0c2067446b87c973bbd93be9fa87a5

SHA1
4365c19b8f8646d7379c1e6b475b4a635e9ce8d1

SHA256
2dbaa26b5da6231a20dfb4977e9c898d1e9f15933b4c59af9e093c690a3c6fc5

SHA512
55cece3bec0e33fdb2def836191db146e1e8725c24d98ac542d658edfc1a64e49aaa31fe66747c19a860b786d802565afabe1232640137023b300e8a91979ec9

Download Submit
C:\Windows\System\tpKSEVD.exe

Filesize
1.7MB

MD5
121fd96099193ea80e44ecaaf3091adb

SHA1
09a9bc62f04488459ec5fa2bb010ae1a1f65121f

SHA256
e53accc81e8ca9cc97a70ad2ac4122947447065dff2e9e0a955c27abf3851fac

SHA512
9cf3d728c2ad74d8ab065378963baf3a833fe44212108405b86220ca6aba87bccae88a519256219cd3a1bb880dae64d24270706d57b9cfb84b92fff17f063a5a

Download Submit
C:\Windows\System\xFKiXjP.exe

Filesize
1.7MB

MD5
f75a1ac1eca6a6376083d13abd088f2b

SHA1
20a72734ad1c1994af49c8194fdaff2bb51c17ef

SHA256
12f4e4a8b3f964ed6f47777f0c3ee15c39a390004e8153bd2859937dc2506d67

SHA512
ae0bf8be7a3ff1f6dcdfcefb060f20665f61ff64a67d40eb4dee8fb85683bd9c5b57fd089883c853d70ea0f1cc9b3fcbf79b135cefcb4d4f65f1d96c2f89defa

Download Submit
memory/728-0-0x0000019A3B100000-0x0000019A3B110000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads