xmrig | ab84be81833cc089c29cfb6b797b775d6536d849fa36affe5b8a11ad6c6897f9

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
25-12-2024 01:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ab84be81833cc089c29cfb6b797b775d6536d849fa36affe5b8a11ad6c6897f9.exe
Size

1.3MB
MD5

dd11fd02d81dac290edf814a8b5d7536
SHA1

39aea3b3388390f68be32df4aa80c5837ff96812
SHA256

ab84be81833cc089c29cfb6b797b775d6536d849fa36affe5b8a11ad6c6897f9
SHA512

6650b4734c4f02e99363343c399d570d315b3cc0e38774a39871dae9813b7fbf062eecdaf1f17eff6eea67af69f76f84bb7f660f9a47cbe17d523ad4c21b5aa4
SSDEEP

24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbpwlKenszaDw4BcYC8qKswr+WvWc:GezaTF8FcNkNdfE0pZ9ozttwIRakG37B

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 33 IoCs

miner

resource	yara_rule
behavioral2/files/0x000c000000023b94-4.dat	xmrig
behavioral2/files/0x0009000000023c35-10.dat	xmrig
behavioral2/files/0x0008000000023c4f-17.dat	xmrig
behavioral2/files/0x0008000000023c50-26.dat	xmrig
behavioral2/files/0x0008000000023c52-30.dat	xmrig
behavioral2/files/0x0008000000023c53-34.dat	xmrig
behavioral2/files/0x0008000000023c51-28.dat	xmrig
behavioral2/files/0x0008000000023c54-39.dat	xmrig
behavioral2/files/0x0009000000023c36-44.dat	xmrig
behavioral2/files/0x0016000000023c6a-49.dat	xmrig
behavioral2/files/0x0008000000023c70-52.dat	xmrig
behavioral2/files/0x0008000000023c74-59.dat	xmrig
behavioral2/files/0x0008000000023c80-62.dat	xmrig
behavioral2/files/0x0008000000023c81-69.dat	xmrig
behavioral2/files/0x0008000000023c82-74.dat	xmrig
behavioral2/files/0x0008000000023c83-79.dat	xmrig
behavioral2/files/0x0008000000023c84-84.dat	xmrig
behavioral2/files/0x0008000000023c85-87.dat	xmrig
behavioral2/files/0x0008000000023c86-95.dat	xmrig
behavioral2/files/0x0008000000023c87-99.dat	xmrig
behavioral2/files/0x0008000000023c88-102.dat	xmrig
behavioral2/files/0x0008000000023c89-108.dat	xmrig
behavioral2/files/0x0007000000023c93-115.dat	xmrig
behavioral2/files/0x0007000000023c94-119.dat	xmrig
behavioral2/files/0x0007000000023c95-122.dat	xmrig
behavioral2/files/0x0007000000023c9a-146.dat	xmrig
behavioral2/files/0x0007000000023c9d-162.dat	xmrig
behavioral2/files/0x0007000000023c9b-160.dat	xmrig
behavioral2/files/0x0007000000023c9c-157.dat	xmrig
behavioral2/files/0x0007000000023c99-155.dat	xmrig
behavioral2/files/0x0007000000023c98-144.dat	xmrig
behavioral2/files/0x0007000000023c96-138.dat	xmrig
behavioral2/files/0x0007000000023c97-136.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
4300	qOOPKba.exe
2248	VhQoxoL.exe
2848	HhVQQCL.exe
440	CjNLIvK.exe
828	tHGWKQa.exe
2444	cmOvDdh.exe
780	DKbbDpO.exe
4560	yKaqezV.exe
8	tEXHhxh.exe
976	BBqySWX.exe
4024	zajNbZD.exe
3444	wGLrXWI.exe
3384	bgcliZB.exe
4008	EwGeDFt.exe
2812	amHiEBN.exe
4248	PtHcyLj.exe
2560	TuUnGXH.exe
4348	gWIvEdQ.exe
5040	MalQBOD.exe
2616	rmsWklJ.exe
2340	LstNUte.exe
3652	McMCtsS.exe
4708	qFdjxQh.exe
1480	IvhaEKz.exe
2976	kuusRcq.exe
2084	JjZjeij.exe
4896	IaOtRtg.exe
5048	hbgeXMu.exe
4164	vpeobyO.exe
4636	gPkncFf.exe
4432	bgAtvRy.exe
4744	emvWObZ.exe
1988	vQGKkNe.exe
4584	pNPnVAa.exe
1732	dVDzugB.exe
3712	erBTIVO.exe
2892	yqARvTQ.exe
4416	lqdOsRb.exe
712	nOfmYLd.exe
1484	MIdJgdg.exe
2464	eFDkLiH.exe
3196	NFDuhrr.exe
1424	xaZFrRs.exe
4588	DaKKSAg.exe
4400	VFDTdVS.exe
772	yHgeBdr.exe
900	lAmVwIE.exe
4772	hkKhvDi.exe
1516	NbtkBUj.exe
4952	NgrsPfh.exe
4640	YhDCNvI.exe
3280	pjuQGaS.exe
1180	MtMmfCn.exe
3584	GvRuHjD.exe
3648	KqhPbee.exe
3176	QYiXsyf.exe
4616	LVgkxDs.exe
4700	aKfSGPu.exe
3200	aZzULHe.exe
4128	TVVpBwB.exe
1836	IzuTZje.exe
4260	RZLBBkh.exe
4340	TilMMPZ.exe
4504	IUbNvlm.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\isrjqVr.exe	ab84be81833cc089c29cfb6b797b775d6536d849fa36affe5b8a11ad6c6897f9.exe
File created	C:\Windows\System\pTkmBRr.exe	ab84be81833cc089c29cfb6b797b775d6536d849fa36affe5b8a11ad6c6897f9.exe
File created	C:\Windows\System\vVbkpvz.exe	ab84be81833cc089c29cfb6b797b775d6536d849fa36affe5b8a11ad6c6897f9.exe
File created	C:\Windows\System\PjWdpeo.exe	ab84be81833cc089c29cfb6b797b775d6536d849fa36affe5b8a11ad6c6897f9.exe
File created	C:\Windows\System\RjUlgUT.exe	ab84be81833cc089c29cfb6b797b775d6536d849fa36affe5b8a11ad6c6897f9.exe
File created	C:\Windows\System\IGDXtBf.exe	ab84be81833cc089c29cfb6b797b775d6536d849fa36affe5b8a11ad6c6897f9.exe
File created	C:\Windows\System\juowqbS.exe	ab84be81833cc089c29cfb6b797b775d6536d849fa36affe5b8a11ad6c6897f9.exe
File created	C:\Windows\System\XKXIKhI.exe	ab84be81833cc089c29cfb6b797b775d6536d849fa36affe5b8a11ad6c6897f9.exe
File created	C:\Windows\System\Ticyziq.exe	ab84be81833cc089c29cfb6b797b775d6536d849fa36affe5b8a11ad6c6897f9.exe
File created	C:\Windows\System\sNCQCnG.exe	ab84be81833cc089c29cfb6b797b775d6536d849fa36affe5b8a11ad6c6897f9.exe
File created	C:\Windows\System\TeQpijv.exe	ab84be81833cc089c29cfb6b797b775d6536d849fa36affe5b8a11ad6c6897f9.exe
File created	C:\Windows\System\UpBcItm.exe	ab84be81833cc089c29cfb6b797b775d6536d849fa36affe5b8a11ad6c6897f9.exe
File created	C:\Windows\System\RtYQWxi.exe	ab84be81833cc089c29cfb6b797b775d6536d849fa36affe5b8a11ad6c6897f9.exe
File created	C:\Windows\System\WdlRzUe.exe	ab84be81833cc089c29cfb6b797b775d6536d849fa36affe5b8a11ad6c6897f9.exe
File created	C:\Windows\System\jbqNczX.exe	ab84be81833cc089c29cfb6b797b775d6536d849fa36affe5b8a11ad6c6897f9.exe
File created	C:\Windows\System\fNWDntU.exe	ab84be81833cc089c29cfb6b797b775d6536d849fa36affe5b8a11ad6c6897f9.exe
File created	C:\Windows\System\pJWpQGw.exe	ab84be81833cc089c29cfb6b797b775d6536d849fa36affe5b8a11ad6c6897f9.exe
File created	C:\Windows\System\IKnOxVR.exe	ab84be81833cc089c29cfb6b797b775d6536d849fa36affe5b8a11ad6c6897f9.exe
File created	C:\Windows\System\SouhgJu.exe	ab84be81833cc089c29cfb6b797b775d6536d849fa36affe5b8a11ad6c6897f9.exe
File created	C:\Windows\System\LZLGcrh.exe	ab84be81833cc089c29cfb6b797b775d6536d849fa36affe5b8a11ad6c6897f9.exe
File created	C:\Windows\System\yzAEwPW.exe	ab84be81833cc089c29cfb6b797b775d6536d849fa36affe5b8a11ad6c6897f9.exe
File created	C:\Windows\System\NqymylU.exe	ab84be81833cc089c29cfb6b797b775d6536d849fa36affe5b8a11ad6c6897f9.exe
File created	C:\Windows\System\gAqJwCE.exe	ab84be81833cc089c29cfb6b797b775d6536d849fa36affe5b8a11ad6c6897f9.exe
File created	C:\Windows\System\VwJaYQN.exe	ab84be81833cc089c29cfb6b797b775d6536d849fa36affe5b8a11ad6c6897f9.exe
File created	C:\Windows\System\kBUQlad.exe	ab84be81833cc089c29cfb6b797b775d6536d849fa36affe5b8a11ad6c6897f9.exe
File created	C:\Windows\System\hmDGqas.exe	ab84be81833cc089c29cfb6b797b775d6536d849fa36affe5b8a11ad6c6897f9.exe
File created	C:\Windows\System\GxcvWjk.exe	ab84be81833cc089c29cfb6b797b775d6536d849fa36affe5b8a11ad6c6897f9.exe
File created	C:\Windows\System\xwwDFlp.exe	ab84be81833cc089c29cfb6b797b775d6536d849fa36affe5b8a11ad6c6897f9.exe
File created	C:\Windows\System\GbdRXgk.exe	ab84be81833cc089c29cfb6b797b775d6536d849fa36affe5b8a11ad6c6897f9.exe
File created	C:\Windows\System\fwERFek.exe	ab84be81833cc089c29cfb6b797b775d6536d849fa36affe5b8a11ad6c6897f9.exe
File created	C:\Windows\System\MIdJgdg.exe	ab84be81833cc089c29cfb6b797b775d6536d849fa36affe5b8a11ad6c6897f9.exe
File created	C:\Windows\System\PCNGutV.exe	ab84be81833cc089c29cfb6b797b775d6536d849fa36affe5b8a11ad6c6897f9.exe
File created	C:\Windows\System\ZLlbVEQ.exe	ab84be81833cc089c29cfb6b797b775d6536d849fa36affe5b8a11ad6c6897f9.exe
File created	C:\Windows\System\fcmCpfD.exe	ab84be81833cc089c29cfb6b797b775d6536d849fa36affe5b8a11ad6c6897f9.exe
File created	C:\Windows\System\DuHKQqK.exe	ab84be81833cc089c29cfb6b797b775d6536d849fa36affe5b8a11ad6c6897f9.exe
File created	C:\Windows\System\IeHJIMm.exe	ab84be81833cc089c29cfb6b797b775d6536d849fa36affe5b8a11ad6c6897f9.exe
File created	C:\Windows\System\Zlubxvp.exe	ab84be81833cc089c29cfb6b797b775d6536d849fa36affe5b8a11ad6c6897f9.exe
File created	C:\Windows\System\GZrhSwf.exe	ab84be81833cc089c29cfb6b797b775d6536d849fa36affe5b8a11ad6c6897f9.exe
File created	C:\Windows\System\StauIyD.exe	ab84be81833cc089c29cfb6b797b775d6536d849fa36affe5b8a11ad6c6897f9.exe
File created	C:\Windows\System\tXqvCWG.exe	ab84be81833cc089c29cfb6b797b775d6536d849fa36affe5b8a11ad6c6897f9.exe
File created	C:\Windows\System\izCKNpj.exe	ab84be81833cc089c29cfb6b797b775d6536d849fa36affe5b8a11ad6c6897f9.exe
File created	C:\Windows\System\QLlHsHx.exe	ab84be81833cc089c29cfb6b797b775d6536d849fa36affe5b8a11ad6c6897f9.exe
File created	C:\Windows\System\XkTsnmP.exe	ab84be81833cc089c29cfb6b797b775d6536d849fa36affe5b8a11ad6c6897f9.exe
File created	C:\Windows\System\ZbEvmwh.exe	ab84be81833cc089c29cfb6b797b775d6536d849fa36affe5b8a11ad6c6897f9.exe
File created	C:\Windows\System\oMuNBot.exe	ab84be81833cc089c29cfb6b797b775d6536d849fa36affe5b8a11ad6c6897f9.exe
File created	C:\Windows\System\AgvitFG.exe	ab84be81833cc089c29cfb6b797b775d6536d849fa36affe5b8a11ad6c6897f9.exe
File created	C:\Windows\System\sEMncuO.exe	ab84be81833cc089c29cfb6b797b775d6536d849fa36affe5b8a11ad6c6897f9.exe
File created	C:\Windows\System\kHiClnH.exe	ab84be81833cc089c29cfb6b797b775d6536d849fa36affe5b8a11ad6c6897f9.exe
File created	C:\Windows\System\XJVsMUm.exe	ab84be81833cc089c29cfb6b797b775d6536d849fa36affe5b8a11ad6c6897f9.exe
File created	C:\Windows\System\gDAtAqk.exe	ab84be81833cc089c29cfb6b797b775d6536d849fa36affe5b8a11ad6c6897f9.exe
File created	C:\Windows\System\sLiIkmI.exe	ab84be81833cc089c29cfb6b797b775d6536d849fa36affe5b8a11ad6c6897f9.exe
File created	C:\Windows\System\PQqYCQR.exe	ab84be81833cc089c29cfb6b797b775d6536d849fa36affe5b8a11ad6c6897f9.exe
File created	C:\Windows\System\QQvdqGf.exe	ab84be81833cc089c29cfb6b797b775d6536d849fa36affe5b8a11ad6c6897f9.exe
File created	C:\Windows\System\LLufllT.exe	ab84be81833cc089c29cfb6b797b775d6536d849fa36affe5b8a11ad6c6897f9.exe
File created	C:\Windows\System\PtHcyLj.exe	ab84be81833cc089c29cfb6b797b775d6536d849fa36affe5b8a11ad6c6897f9.exe
File created	C:\Windows\System\QYiXsyf.exe	ab84be81833cc089c29cfb6b797b775d6536d849fa36affe5b8a11ad6c6897f9.exe
File created	C:\Windows\System\PoKnTFI.exe	ab84be81833cc089c29cfb6b797b775d6536d849fa36affe5b8a11ad6c6897f9.exe
File created	C:\Windows\System\qjpddov.exe	ab84be81833cc089c29cfb6b797b775d6536d849fa36affe5b8a11ad6c6897f9.exe
File created	C:\Windows\System\KklDSft.exe	ab84be81833cc089c29cfb6b797b775d6536d849fa36affe5b8a11ad6c6897f9.exe
File created	C:\Windows\System\xHYDgTd.exe	ab84be81833cc089c29cfb6b797b775d6536d849fa36affe5b8a11ad6c6897f9.exe
File created	C:\Windows\System\yanEtUt.exe	ab84be81833cc089c29cfb6b797b775d6536d849fa36affe5b8a11ad6c6897f9.exe
File created	C:\Windows\System\xsGeaym.exe	ab84be81833cc089c29cfb6b797b775d6536d849fa36affe5b8a11ad6c6897f9.exe
File created	C:\Windows\System\wwXDXNu.exe	ab84be81833cc089c29cfb6b797b775d6536d849fa36affe5b8a11ad6c6897f9.exe
File created	C:\Windows\System\ykVRUyM.exe	ab84be81833cc089c29cfb6b797b775d6536d849fa36affe5b8a11ad6c6897f9.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	16388	dwm.exe
Token: SeChangeNotifyPrivilege	16388	dwm.exe
Token: 33	16388	dwm.exe
Token: SeIncBasePriorityPrivilege	16388	dwm.exe
Token: SeShutdownPrivilege	16388	dwm.exe
Token: SeCreatePagefilePrivilege	16388	dwm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 520 wrote to memory of 4300	520	ab84be81833cc089c29cfb6b797b775d6536d849fa36affe5b8a11ad6c6897f9.exe	85
PID 520 wrote to memory of 4300	520	ab84be81833cc089c29cfb6b797b775d6536d849fa36affe5b8a11ad6c6897f9.exe	85
PID 520 wrote to memory of 2248	520	ab84be81833cc089c29cfb6b797b775d6536d849fa36affe5b8a11ad6c6897f9.exe	86
PID 520 wrote to memory of 2248	520	ab84be81833cc089c29cfb6b797b775d6536d849fa36affe5b8a11ad6c6897f9.exe	86
PID 520 wrote to memory of 2848	520	ab84be81833cc089c29cfb6b797b775d6536d849fa36affe5b8a11ad6c6897f9.exe	87
PID 520 wrote to memory of 2848	520	ab84be81833cc089c29cfb6b797b775d6536d849fa36affe5b8a11ad6c6897f9.exe	87
PID 520 wrote to memory of 440	520	ab84be81833cc089c29cfb6b797b775d6536d849fa36affe5b8a11ad6c6897f9.exe	88
PID 520 wrote to memory of 440	520	ab84be81833cc089c29cfb6b797b775d6536d849fa36affe5b8a11ad6c6897f9.exe	88
PID 520 wrote to memory of 828	520	ab84be81833cc089c29cfb6b797b775d6536d849fa36affe5b8a11ad6c6897f9.exe	89
PID 520 wrote to memory of 828	520	ab84be81833cc089c29cfb6b797b775d6536d849fa36affe5b8a11ad6c6897f9.exe	89
PID 520 wrote to memory of 2444	520	ab84be81833cc089c29cfb6b797b775d6536d849fa36affe5b8a11ad6c6897f9.exe	90
PID 520 wrote to memory of 2444	520	ab84be81833cc089c29cfb6b797b775d6536d849fa36affe5b8a11ad6c6897f9.exe	90
PID 520 wrote to memory of 780	520	ab84be81833cc089c29cfb6b797b775d6536d849fa36affe5b8a11ad6c6897f9.exe	91
PID 520 wrote to memory of 780	520	ab84be81833cc089c29cfb6b797b775d6536d849fa36affe5b8a11ad6c6897f9.exe	91
PID 520 wrote to memory of 4560	520	ab84be81833cc089c29cfb6b797b775d6536d849fa36affe5b8a11ad6c6897f9.exe	92
PID 520 wrote to memory of 4560	520	ab84be81833cc089c29cfb6b797b775d6536d849fa36affe5b8a11ad6c6897f9.exe	92
PID 520 wrote to memory of 8	520	ab84be81833cc089c29cfb6b797b775d6536d849fa36affe5b8a11ad6c6897f9.exe	93
PID 520 wrote to memory of 8	520	ab84be81833cc089c29cfb6b797b775d6536d849fa36affe5b8a11ad6c6897f9.exe	93
PID 520 wrote to memory of 976	520	ab84be81833cc089c29cfb6b797b775d6536d849fa36affe5b8a11ad6c6897f9.exe	94
PID 520 wrote to memory of 976	520	ab84be81833cc089c29cfb6b797b775d6536d849fa36affe5b8a11ad6c6897f9.exe	94
PID 520 wrote to memory of 4024	520	ab84be81833cc089c29cfb6b797b775d6536d849fa36affe5b8a11ad6c6897f9.exe	95
PID 520 wrote to memory of 4024	520	ab84be81833cc089c29cfb6b797b775d6536d849fa36affe5b8a11ad6c6897f9.exe	95
PID 520 wrote to memory of 3444	520	ab84be81833cc089c29cfb6b797b775d6536d849fa36affe5b8a11ad6c6897f9.exe	96
PID 520 wrote to memory of 3444	520	ab84be81833cc089c29cfb6b797b775d6536d849fa36affe5b8a11ad6c6897f9.exe	96
PID 520 wrote to memory of 3384	520	ab84be81833cc089c29cfb6b797b775d6536d849fa36affe5b8a11ad6c6897f9.exe	97
PID 520 wrote to memory of 3384	520	ab84be81833cc089c29cfb6b797b775d6536d849fa36affe5b8a11ad6c6897f9.exe	97
PID 520 wrote to memory of 4008	520	ab84be81833cc089c29cfb6b797b775d6536d849fa36affe5b8a11ad6c6897f9.exe	98
PID 520 wrote to memory of 4008	520	ab84be81833cc089c29cfb6b797b775d6536d849fa36affe5b8a11ad6c6897f9.exe	98
PID 520 wrote to memory of 2812	520	ab84be81833cc089c29cfb6b797b775d6536d849fa36affe5b8a11ad6c6897f9.exe	99
PID 520 wrote to memory of 2812	520	ab84be81833cc089c29cfb6b797b775d6536d849fa36affe5b8a11ad6c6897f9.exe	99
PID 520 wrote to memory of 4248	520	ab84be81833cc089c29cfb6b797b775d6536d849fa36affe5b8a11ad6c6897f9.exe	100
PID 520 wrote to memory of 4248	520	ab84be81833cc089c29cfb6b797b775d6536d849fa36affe5b8a11ad6c6897f9.exe	100
PID 520 wrote to memory of 2560	520	ab84be81833cc089c29cfb6b797b775d6536d849fa36affe5b8a11ad6c6897f9.exe	101
PID 520 wrote to memory of 2560	520	ab84be81833cc089c29cfb6b797b775d6536d849fa36affe5b8a11ad6c6897f9.exe	101
PID 520 wrote to memory of 4348	520	ab84be81833cc089c29cfb6b797b775d6536d849fa36affe5b8a11ad6c6897f9.exe	102
PID 520 wrote to memory of 4348	520	ab84be81833cc089c29cfb6b797b775d6536d849fa36affe5b8a11ad6c6897f9.exe	102
PID 520 wrote to memory of 5040	520	ab84be81833cc089c29cfb6b797b775d6536d849fa36affe5b8a11ad6c6897f9.exe	103
PID 520 wrote to memory of 5040	520	ab84be81833cc089c29cfb6b797b775d6536d849fa36affe5b8a11ad6c6897f9.exe	103
PID 520 wrote to memory of 2616	520	ab84be81833cc089c29cfb6b797b775d6536d849fa36affe5b8a11ad6c6897f9.exe	104
PID 520 wrote to memory of 2616	520	ab84be81833cc089c29cfb6b797b775d6536d849fa36affe5b8a11ad6c6897f9.exe	104
PID 520 wrote to memory of 2340	520	ab84be81833cc089c29cfb6b797b775d6536d849fa36affe5b8a11ad6c6897f9.exe	105
PID 520 wrote to memory of 2340	520	ab84be81833cc089c29cfb6b797b775d6536d849fa36affe5b8a11ad6c6897f9.exe	105
PID 520 wrote to memory of 3652	520	ab84be81833cc089c29cfb6b797b775d6536d849fa36affe5b8a11ad6c6897f9.exe	106
PID 520 wrote to memory of 3652	520	ab84be81833cc089c29cfb6b797b775d6536d849fa36affe5b8a11ad6c6897f9.exe	106
PID 520 wrote to memory of 4708	520	ab84be81833cc089c29cfb6b797b775d6536d849fa36affe5b8a11ad6c6897f9.exe	107
PID 520 wrote to memory of 4708	520	ab84be81833cc089c29cfb6b797b775d6536d849fa36affe5b8a11ad6c6897f9.exe	107
PID 520 wrote to memory of 1480	520	ab84be81833cc089c29cfb6b797b775d6536d849fa36affe5b8a11ad6c6897f9.exe	108
PID 520 wrote to memory of 1480	520	ab84be81833cc089c29cfb6b797b775d6536d849fa36affe5b8a11ad6c6897f9.exe	108
PID 520 wrote to memory of 2976	520	ab84be81833cc089c29cfb6b797b775d6536d849fa36affe5b8a11ad6c6897f9.exe	109
PID 520 wrote to memory of 2976	520	ab84be81833cc089c29cfb6b797b775d6536d849fa36affe5b8a11ad6c6897f9.exe	109
PID 520 wrote to memory of 4896	520	ab84be81833cc089c29cfb6b797b775d6536d849fa36affe5b8a11ad6c6897f9.exe	110
PID 520 wrote to memory of 4896	520	ab84be81833cc089c29cfb6b797b775d6536d849fa36affe5b8a11ad6c6897f9.exe	110
PID 520 wrote to memory of 2084	520	ab84be81833cc089c29cfb6b797b775d6536d849fa36affe5b8a11ad6c6897f9.exe	111
PID 520 wrote to memory of 2084	520	ab84be81833cc089c29cfb6b797b775d6536d849fa36affe5b8a11ad6c6897f9.exe	111
PID 520 wrote to memory of 5048	520	ab84be81833cc089c29cfb6b797b775d6536d849fa36affe5b8a11ad6c6897f9.exe	112
PID 520 wrote to memory of 5048	520	ab84be81833cc089c29cfb6b797b775d6536d849fa36affe5b8a11ad6c6897f9.exe	112
PID 520 wrote to memory of 4636	520	ab84be81833cc089c29cfb6b797b775d6536d849fa36affe5b8a11ad6c6897f9.exe	113
PID 520 wrote to memory of 4636	520	ab84be81833cc089c29cfb6b797b775d6536d849fa36affe5b8a11ad6c6897f9.exe	113
PID 520 wrote to memory of 4164	520	ab84be81833cc089c29cfb6b797b775d6536d849fa36affe5b8a11ad6c6897f9.exe	114
PID 520 wrote to memory of 4164	520	ab84be81833cc089c29cfb6b797b775d6536d849fa36affe5b8a11ad6c6897f9.exe	114
PID 520 wrote to memory of 4432	520	ab84be81833cc089c29cfb6b797b775d6536d849fa36affe5b8a11ad6c6897f9.exe	115
PID 520 wrote to memory of 4432	520	ab84be81833cc089c29cfb6b797b775d6536d849fa36affe5b8a11ad6c6897f9.exe	115
PID 520 wrote to memory of 4744	520	ab84be81833cc089c29cfb6b797b775d6536d849fa36affe5b8a11ad6c6897f9.exe	116
PID 520 wrote to memory of 4744	520	ab84be81833cc089c29cfb6b797b775d6536d849fa36affe5b8a11ad6c6897f9.exe	116

C:\Users\Admin\AppData\Local\Temp\ab84be81833cc089c29cfb6b797b775d6536d849fa36affe5b8a11ad6c6897f9.exe
"C:\Users\Admin\AppData\Local\Temp\ab84be81833cc089c29cfb6b797b775d6536d849fa36affe5b8a11ad6c6897f9.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:520
- C:\Windows\System\qOOPKba.exe
  C:\Windows\System\qOOPKba.exe
  2⤵
  - Executes dropped EXE
  PID:4300
- C:\Windows\System\VhQoxoL.exe
  C:\Windows\System\VhQoxoL.exe
  2⤵
  - Executes dropped EXE
  PID:2248
- C:\Windows\System\HhVQQCL.exe
  C:\Windows\System\HhVQQCL.exe
  2⤵
  - Executes dropped EXE
  PID:2848
- C:\Windows\System\CjNLIvK.exe
  C:\Windows\System\CjNLIvK.exe
  2⤵
  - Executes dropped EXE
  PID:440
- C:\Windows\System\tHGWKQa.exe
  C:\Windows\System\tHGWKQa.exe
  2⤵
  - Executes dropped EXE
  PID:828
- C:\Windows\System\cmOvDdh.exe
  C:\Windows\System\cmOvDdh.exe
  2⤵
  - Executes dropped EXE
  PID:2444
- C:\Windows\System\DKbbDpO.exe
  C:\Windows\System\DKbbDpO.exe
  2⤵
  - Executes dropped EXE
  PID:780
- C:\Windows\System\yKaqezV.exe
  C:\Windows\System\yKaqezV.exe
  2⤵
  - Executes dropped EXE
  PID:4560
- C:\Windows\System\tEXHhxh.exe
  C:\Windows\System\tEXHhxh.exe
  2⤵
  - Executes dropped EXE
  PID:8
- C:\Windows\System\BBqySWX.exe
  C:\Windows\System\BBqySWX.exe
  2⤵
  - Executes dropped EXE
  PID:976
- C:\Windows\System\zajNbZD.exe
  C:\Windows\System\zajNbZD.exe
  2⤵
  - Executes dropped EXE
  PID:4024
- C:\Windows\System\wGLrXWI.exe
  C:\Windows\System\wGLrXWI.exe
  2⤵
  - Executes dropped EXE
  PID:3444
- C:\Windows\System\bgcliZB.exe
  C:\Windows\System\bgcliZB.exe
  2⤵
  - Executes dropped EXE
  PID:3384
- C:\Windows\System\EwGeDFt.exe
  C:\Windows\System\EwGeDFt.exe
  2⤵
  - Executes dropped EXE
  PID:4008
- C:\Windows\System\amHiEBN.exe
  C:\Windows\System\amHiEBN.exe
  2⤵
  - Executes dropped EXE
  PID:2812
- C:\Windows\System\PtHcyLj.exe
  C:\Windows\System\PtHcyLj.exe
  2⤵
  - Executes dropped EXE
  PID:4248
- C:\Windows\System\TuUnGXH.exe
  C:\Windows\System\TuUnGXH.exe
  2⤵
  - Executes dropped EXE
  PID:2560
- C:\Windows\System\gWIvEdQ.exe
  C:\Windows\System\gWIvEdQ.exe
  2⤵
  - Executes dropped EXE
  PID:4348
- C:\Windows\System\MalQBOD.exe
  C:\Windows\System\MalQBOD.exe
  2⤵
  - Executes dropped EXE
  PID:5040
- C:\Windows\System\rmsWklJ.exe
  C:\Windows\System\rmsWklJ.exe
  2⤵
  - Executes dropped EXE
  PID:2616
- C:\Windows\System\LstNUte.exe
  C:\Windows\System\LstNUte.exe
  2⤵
  - Executes dropped EXE
  PID:2340
- C:\Windows\System\McMCtsS.exe
  C:\Windows\System\McMCtsS.exe
  2⤵
  - Executes dropped EXE
  PID:3652
- C:\Windows\System\qFdjxQh.exe
  C:\Windows\System\qFdjxQh.exe
  2⤵
  - Executes dropped EXE
  PID:4708
- C:\Windows\System\IvhaEKz.exe
  C:\Windows\System\IvhaEKz.exe
  2⤵
  - Executes dropped EXE
  PID:1480
- C:\Windows\System\kuusRcq.exe
  C:\Windows\System\kuusRcq.exe
  2⤵
  - Executes dropped EXE
  PID:2976
- C:\Windows\System\IaOtRtg.exe
  C:\Windows\System\IaOtRtg.exe
  2⤵
  - Executes dropped EXE
  PID:4896
- C:\Windows\System\JjZjeij.exe
  C:\Windows\System\JjZjeij.exe
  2⤵
  - Executes dropped EXE
  PID:2084
- C:\Windows\System\hbgeXMu.exe
  C:\Windows\System\hbgeXMu.exe
  2⤵
  - Executes dropped EXE
  PID:5048
- C:\Windows\System\gPkncFf.exe
  C:\Windows\System\gPkncFf.exe
  2⤵
  - Executes dropped EXE
  PID:4636
- C:\Windows\System\vpeobyO.exe
  C:\Windows\System\vpeobyO.exe
  2⤵
  - Executes dropped EXE
  PID:4164
- C:\Windows\System\bgAtvRy.exe
  C:\Windows\System\bgAtvRy.exe
  2⤵
  - Executes dropped EXE
  PID:4432
- C:\Windows\System\emvWObZ.exe
  C:\Windows\System\emvWObZ.exe
  2⤵
  - Executes dropped EXE
  PID:4744
- C:\Windows\System\vQGKkNe.exe
  C:\Windows\System\vQGKkNe.exe
  2⤵
  - Executes dropped EXE
  PID:1988
- C:\Windows\System\pNPnVAa.exe
  C:\Windows\System\pNPnVAa.exe
  2⤵
  - Executes dropped EXE
  PID:4584
- C:\Windows\System\dVDzugB.exe
  C:\Windows\System\dVDzugB.exe
  2⤵
  - Executes dropped EXE
  PID:1732
- C:\Windows\System\erBTIVO.exe
  C:\Windows\System\erBTIVO.exe
  2⤵
  - Executes dropped EXE
  PID:3712
- C:\Windows\System\yqARvTQ.exe
  C:\Windows\System\yqARvTQ.exe
  2⤵
  - Executes dropped EXE
  PID:2892
- C:\Windows\System\lqdOsRb.exe
  C:\Windows\System\lqdOsRb.exe
  2⤵
  - Executes dropped EXE
  PID:4416
- C:\Windows\System\nOfmYLd.exe
  C:\Windows\System\nOfmYLd.exe
  2⤵
  - Executes dropped EXE
  PID:712
- C:\Windows\System\MIdJgdg.exe
  C:\Windows\System\MIdJgdg.exe
  2⤵
  - Executes dropped EXE
  PID:1484
- C:\Windows\System\eFDkLiH.exe
  C:\Windows\System\eFDkLiH.exe
  2⤵
  - Executes dropped EXE
  PID:2464
- C:\Windows\System\NFDuhrr.exe
  C:\Windows\System\NFDuhrr.exe
  2⤵
  - Executes dropped EXE
  PID:3196
- C:\Windows\System\xaZFrRs.exe
  C:\Windows\System\xaZFrRs.exe
  2⤵
  - Executes dropped EXE
  PID:1424
- C:\Windows\System\DaKKSAg.exe
  C:\Windows\System\DaKKSAg.exe
  2⤵
  - Executes dropped EXE
  PID:4588
- C:\Windows\System\VFDTdVS.exe
  C:\Windows\System\VFDTdVS.exe
  2⤵
  - Executes dropped EXE
  PID:4400
- C:\Windows\System\yHgeBdr.exe
  C:\Windows\System\yHgeBdr.exe
  2⤵
  - Executes dropped EXE
  PID:772
- C:\Windows\System\lAmVwIE.exe
  C:\Windows\System\lAmVwIE.exe
  2⤵
  - Executes dropped EXE
  PID:900
- C:\Windows\System\hkKhvDi.exe
  C:\Windows\System\hkKhvDi.exe
  2⤵
  - Executes dropped EXE
  PID:4772
- C:\Windows\System\NbtkBUj.exe
  C:\Windows\System\NbtkBUj.exe
  2⤵
  - Executes dropped EXE
  PID:1516
- C:\Windows\System\NgrsPfh.exe
  C:\Windows\System\NgrsPfh.exe
  2⤵
  - Executes dropped EXE
  PID:4952
- C:\Windows\System\YhDCNvI.exe
  C:\Windows\System\YhDCNvI.exe
  2⤵
  - Executes dropped EXE
  PID:4640
- C:\Windows\System\pjuQGaS.exe
  C:\Windows\System\pjuQGaS.exe
  2⤵
  - Executes dropped EXE
  PID:3280
- C:\Windows\System\MtMmfCn.exe
  C:\Windows\System\MtMmfCn.exe
  2⤵
  - Executes dropped EXE
  PID:1180
- C:\Windows\System\GvRuHjD.exe
  C:\Windows\System\GvRuHjD.exe
  2⤵
  - Executes dropped EXE
  PID:3584
- C:\Windows\System\KqhPbee.exe
  C:\Windows\System\KqhPbee.exe
  2⤵
  - Executes dropped EXE
  PID:3648
- C:\Windows\System\QYiXsyf.exe
  C:\Windows\System\QYiXsyf.exe
  2⤵
  - Executes dropped EXE
  PID:3176
- C:\Windows\System\LVgkxDs.exe
  C:\Windows\System\LVgkxDs.exe
  2⤵
  - Executes dropped EXE
  PID:4616
- C:\Windows\System\aKfSGPu.exe
  C:\Windows\System\aKfSGPu.exe
  2⤵
  - Executes dropped EXE
  PID:4700
- C:\Windows\System\aZzULHe.exe
  C:\Windows\System\aZzULHe.exe
  2⤵
  - Executes dropped EXE
  PID:3200
- C:\Windows\System\TVVpBwB.exe
  C:\Windows\System\TVVpBwB.exe
  2⤵
  - Executes dropped EXE
  PID:4128
- C:\Windows\System\IzuTZje.exe
  C:\Windows\System\IzuTZje.exe
  2⤵
  - Executes dropped EXE
  PID:1836
- C:\Windows\System\RZLBBkh.exe
  C:\Windows\System\RZLBBkh.exe
  2⤵
  - Executes dropped EXE
  PID:4260
- C:\Windows\System\TilMMPZ.exe
  C:\Windows\System\TilMMPZ.exe
  2⤵
  - Executes dropped EXE
  PID:4340
- C:\Windows\System\IUbNvlm.exe
  C:\Windows\System\IUbNvlm.exe
  2⤵
  - Executes dropped EXE
  PID:4504
- C:\Windows\System\sxgFqWT.exe
  C:\Windows\System\sxgFqWT.exe
  2⤵
  PID:1496
- C:\Windows\System\AUKSvOx.exe
  C:\Windows\System\AUKSvOx.exe
  2⤵
  PID:1556
- C:\Windows\System\nbsMsEI.exe
  C:\Windows\System\nbsMsEI.exe
  2⤵
  PID:3456
- C:\Windows\System\iPthfVy.exe
  C:\Windows\System\iPthfVy.exe
  2⤵
  PID:2392
- C:\Windows\System\EyZYHuU.exe
  C:\Windows\System\EyZYHuU.exe
  2⤵
  PID:2980
- C:\Windows\System\yanEtUt.exe
  C:\Windows\System\yanEtUt.exe
  2⤵
  PID:1264
- C:\Windows\System\vxinhru.exe
  C:\Windows\System\vxinhru.exe
  2⤵
  PID:3264
- C:\Windows\System\QLlHsHx.exe
  C:\Windows\System\QLlHsHx.exe
  2⤵
  PID:5012
- C:\Windows\System\YfkYHXr.exe
  C:\Windows\System\YfkYHXr.exe
  2⤵
  PID:1444
- C:\Windows\System\KgQdGCM.exe
  C:\Windows\System\KgQdGCM.exe
  2⤵
  PID:2500
- C:\Windows\System\XzBRyJV.exe
  C:\Windows\System\XzBRyJV.exe
  2⤵
  PID:5056
- C:\Windows\System\SeEQJbL.exe
  C:\Windows\System\SeEQJbL.exe
  2⤵
  PID:2964
- C:\Windows\System\LqeaYxz.exe
  C:\Windows\System\LqeaYxz.exe
  2⤵
  PID:2148
- C:\Windows\System\BgxddLN.exe
  C:\Windows\System\BgxddLN.exe
  2⤵
  PID:5144
- C:\Windows\System\OwvciYs.exe
  C:\Windows\System\OwvciYs.exe
  2⤵
  PID:5176
- C:\Windows\System\qTqvmiW.exe
  C:\Windows\System\qTqvmiW.exe
  2⤵
  PID:5196
- C:\Windows\System\uCyBgah.exe
  C:\Windows\System\uCyBgah.exe
  2⤵
  PID:5216
- C:\Windows\System\sMPDEUU.exe
  C:\Windows\System\sMPDEUU.exe
  2⤵
  PID:5232
- C:\Windows\System\EaPzkoH.exe
  C:\Windows\System\EaPzkoH.exe
  2⤵
  PID:5252
- C:\Windows\System\NqymylU.exe
  C:\Windows\System\NqymylU.exe
  2⤵
  PID:5272
- C:\Windows\System\uvooRdh.exe
  C:\Windows\System\uvooRdh.exe
  2⤵
  PID:5300
- C:\Windows\System\WhqKIHy.exe
  C:\Windows\System\WhqKIHy.exe
  2⤵
  PID:5320
- C:\Windows\System\ADVLiLs.exe
  C:\Windows\System\ADVLiLs.exe
  2⤵
  PID:5360
- C:\Windows\System\ocPpdQU.exe
  C:\Windows\System\ocPpdQU.exe
  2⤵
  PID:5400
- C:\Windows\System\FbgChIJ.exe
  C:\Windows\System\FbgChIJ.exe
  2⤵
  PID:5428
- C:\Windows\System\vdifnxT.exe
  C:\Windows\System\vdifnxT.exe
  2⤵
  PID:5500
- C:\Windows\System\Ticyziq.exe
  C:\Windows\System\Ticyziq.exe
  2⤵
  PID:5516
- C:\Windows\System\KxyjEae.exe
  C:\Windows\System\KxyjEae.exe
  2⤵
  PID:5556
- C:\Windows\System\fcmCpfD.exe
  C:\Windows\System\fcmCpfD.exe
  2⤵
  PID:5584
- C:\Windows\System\erXHjZf.exe
  C:\Windows\System\erXHjZf.exe
  2⤵
  PID:5600
- C:\Windows\System\PYUSWEn.exe
  C:\Windows\System\PYUSWEn.exe
  2⤵
  PID:5640
- C:\Windows\System\WfOjzYH.exe
  C:\Windows\System\WfOjzYH.exe
  2⤵
  PID:5656
- C:\Windows\System\lXexBuX.exe
  C:\Windows\System\lXexBuX.exe
  2⤵
  PID:5696
- C:\Windows\System\opMbpQM.exe
  C:\Windows\System\opMbpQM.exe
  2⤵
  PID:5736
- C:\Windows\System\WdlRzUe.exe
  C:\Windows\System\WdlRzUe.exe
  2⤵
  PID:5752
- C:\Windows\System\xAwSAch.exe
  C:\Windows\System\xAwSAch.exe
  2⤵
  PID:5768
- C:\Windows\System\sVVDHOU.exe
  C:\Windows\System\sVVDHOU.exe
  2⤵
  PID:5796
- C:\Windows\System\qnlLGKm.exe
  C:\Windows\System\qnlLGKm.exe
  2⤵
  PID:5820
- C:\Windows\System\RIGlpJG.exe
  C:\Windows\System\RIGlpJG.exe
  2⤵
  PID:5840
- C:\Windows\System\HzmckDY.exe
  C:\Windows\System\HzmckDY.exe
  2⤵
  PID:5880
- C:\Windows\System\HzZAMIL.exe
  C:\Windows\System\HzZAMIL.exe
  2⤵
  PID:5908
- C:\Windows\System\QeTKxIi.exe
  C:\Windows\System\QeTKxIi.exe
  2⤵
  PID:5932
- C:\Windows\System\ILDNdys.exe
  C:\Windows\System\ILDNdys.exe
  2⤵
  PID:5964
- C:\Windows\System\QdQXDww.exe
  C:\Windows\System\QdQXDww.exe
  2⤵
  PID:5992
- C:\Windows\System\bJkixXt.exe
  C:\Windows\System\bJkixXt.exe
  2⤵
  PID:6020
- C:\Windows\System\ldnvOSo.exe
  C:\Windows\System\ldnvOSo.exe
  2⤵
  PID:6048
- C:\Windows\System\UzIsKdP.exe
  C:\Windows\System\UzIsKdP.exe
  2⤵
  PID:6088
- C:\Windows\System\DCiofwK.exe
  C:\Windows\System\DCiofwK.exe
  2⤵
  PID:6108
- C:\Windows\System\MARygcg.exe
  C:\Windows\System\MARygcg.exe
  2⤵
  PID:6132
- C:\Windows\System\ykgKJVM.exe
  C:\Windows\System\ykgKJVM.exe
  2⤵
  PID:4704
- C:\Windows\System\tzcgmgM.exe
  C:\Windows\System\tzcgmgM.exe
  2⤵
  PID:3720
- C:\Windows\System\MPDthgz.exe
  C:\Windows\System\MPDthgz.exe
  2⤵
  PID:1920
- C:\Windows\System\uLNZZjs.exe
  C:\Windows\System\uLNZZjs.exe
  2⤵
  PID:3096
- C:\Windows\System\nhcOTwH.exe
  C:\Windows\System\nhcOTwH.exe
  2⤵
  PID:2744
- C:\Windows\System\iGRnSYi.exe
  C:\Windows\System\iGRnSYi.exe
  2⤵
  PID:3944
- C:\Windows\System\QWIgiak.exe
  C:\Windows\System\QWIgiak.exe
  2⤵
  PID:2660
- C:\Windows\System\aZnRBaZ.exe
  C:\Windows\System\aZnRBaZ.exe
  2⤵
  PID:4044
- C:\Windows\System\rxUEZXI.exe
  C:\Windows\System\rxUEZXI.exe
  2⤵
  PID:3692
- C:\Windows\System\WXLnRvc.exe
  C:\Windows\System\WXLnRvc.exe
  2⤵
  PID:5076
- C:\Windows\System\pujdwdm.exe
  C:\Windows\System\pujdwdm.exe
  2⤵
  PID:4424
- C:\Windows\System\TSXpzba.exe
  C:\Windows\System\TSXpzba.exe
  2⤵
  PID:2880
- C:\Windows\System\GhgHwzM.exe
  C:\Windows\System\GhgHwzM.exe
  2⤵
  PID:1748
- C:\Windows\System\byjCgos.exe
  C:\Windows\System\byjCgos.exe
  2⤵
  PID:1576
- C:\Windows\System\uRrBfnz.exe
  C:\Windows\System\uRrBfnz.exe
  2⤵
  PID:1608
- C:\Windows\System\WRjFQZi.exe
  C:\Windows\System\WRjFQZi.exe
  2⤵
  PID:680
- C:\Windows\System\BWqZJov.exe
  C:\Windows\System\BWqZJov.exe
  2⤵
  PID:3868
- C:\Windows\System\CRmPfTR.exe
  C:\Windows\System\CRmPfTR.exe
  2⤵
  PID:2996
- C:\Windows\System\pJWpQGw.exe
  C:\Windows\System\pJWpQGw.exe
  2⤵
  PID:2196
- C:\Windows\System\UVDqzms.exe
  C:\Windows\System\UVDqzms.exe
  2⤵
  PID:3336
- C:\Windows\System\KHtWgHD.exe
  C:\Windows\System\KHtWgHD.exe
  2⤵
  PID:2984
- C:\Windows\System\bzZxhEl.exe
  C:\Windows\System\bzZxhEl.exe
  2⤵
  PID:3068
- C:\Windows\System\YnJojHd.exe
  C:\Windows\System\YnJojHd.exe
  2⤵
  PID:5152
- C:\Windows\System\HTdcuhj.exe
  C:\Windows\System\HTdcuhj.exe
  2⤵
  PID:4624
- C:\Windows\System\sNCQCnG.exe
  C:\Windows\System\sNCQCnG.exe
  2⤵
  PID:5204
- C:\Windows\System\MgdhMaT.exe
  C:\Windows\System\MgdhMaT.exe
  2⤵
  PID:5188
- C:\Windows\System\wAxbJrf.exe
  C:\Windows\System\wAxbJrf.exe
  2⤵
  PID:5288
- C:\Windows\System\izxzLau.exe
  C:\Windows\System\izxzLau.exe
  2⤵
  PID:5388
- C:\Windows\System\ugxikEb.exe
  C:\Windows\System\ugxikEb.exe
  2⤵
  PID:5444
- C:\Windows\System\BIfAlLj.exe
  C:\Windows\System\BIfAlLj.exe
  2⤵
  PID:5496
- C:\Windows\System\CpLDhPw.exe
  C:\Windows\System\CpLDhPw.exe
  2⤵
  PID:5572
- C:\Windows\System\wbxBXYh.exe
  C:\Windows\System\wbxBXYh.exe
  2⤵
  PID:5620
- C:\Windows\System\yiswwlv.exe
  C:\Windows\System\yiswwlv.exe
  2⤵
  PID:5672
- C:\Windows\System\RNXbbDT.exe
  C:\Windows\System\RNXbbDT.exe
  2⤵
  PID:5764
- C:\Windows\System\gHCEmDx.exe
  C:\Windows\System\gHCEmDx.exe
  2⤵
  PID:5808
- C:\Windows\System\PwOfOKo.exe
  C:\Windows\System\PwOfOKo.exe
  2⤵
  PID:5868
- C:\Windows\System\TcYUEBF.exe
  C:\Windows\System\TcYUEBF.exe
  2⤵
  PID:5928
- C:\Windows\System\efeawZt.exe
  C:\Windows\System\efeawZt.exe
  2⤵
  PID:5984
- C:\Windows\System\RkVUZyd.exe
  C:\Windows\System\RkVUZyd.exe
  2⤵
  PID:6104
- C:\Windows\System\dqTavOw.exe
  C:\Windows\System\dqTavOw.exe
  2⤵
  PID:6140
- C:\Windows\System\DvxiGhf.exe
  C:\Windows\System\DvxiGhf.exe
  2⤵
  PID:2676
- C:\Windows\System\jbqNczX.exe
  C:\Windows\System\jbqNczX.exe
  2⤵
  PID:1340
- C:\Windows\System\GxcvWjk.exe
  C:\Windows\System\GxcvWjk.exe
  2⤵
  PID:460
- C:\Windows\System\rliWRzD.exe
  C:\Windows\System\rliWRzD.exe
  2⤵
  PID:932
- C:\Windows\System\VmDBJiz.exe
  C:\Windows\System\VmDBJiz.exe
  2⤵
  PID:980
- C:\Windows\System\nNVdCvC.exe
  C:\Windows\System\nNVdCvC.exe
  2⤵
  PID:1840
- C:\Windows\System\PDTnQKe.exe
  C:\Windows\System\PDTnQKe.exe
  2⤵
  PID:444
- C:\Windows\System\qPjLwiq.exe
  C:\Windows\System\qPjLwiq.exe
  2⤵
  PID:1536
- C:\Windows\System\SNUENhz.exe
  C:\Windows\System\SNUENhz.exe
  2⤵
  PID:4108
- C:\Windows\System\NseHMyM.exe
  C:\Windows\System\NseHMyM.exe
  2⤵
  PID:2900
- C:\Windows\System\dGfLVPP.exe
  C:\Windows\System\dGfLVPP.exe
  2⤵
  PID:5168
- C:\Windows\System\ozYFPSu.exe
  C:\Windows\System\ozYFPSu.exe
  2⤵
  PID:5340
- C:\Windows\System\ntBjuGY.exe
  C:\Windows\System\ntBjuGY.exe
  2⤵
  PID:5592
- C:\Windows\System\jwWrIdX.exe
  C:\Windows\System\jwWrIdX.exe
  2⤵
  PID:5596
- C:\Windows\System\PVuHgmM.exe
  C:\Windows\System\PVuHgmM.exe
  2⤵
  PID:5852
- C:\Windows\System\MNqDOyJ.exe
  C:\Windows\System\MNqDOyJ.exe
  2⤵
  PID:6064
- C:\Windows\System\RDhRcdb.exe
  C:\Windows\System\RDhRcdb.exe
  2⤵
  PID:3920
- C:\Windows\System\wLtNnsB.exe
  C:\Windows\System\wLtNnsB.exe
  2⤵
  PID:4900
- C:\Windows\System\DlJJiMa.exe
  C:\Windows\System\DlJJiMa.exe
  2⤵
  PID:1992
- C:\Windows\System\OrbyubU.exe
  C:\Windows\System\OrbyubU.exe
  2⤵
  PID:692
- C:\Windows\System\URDXYrP.exe
  C:\Windows\System\URDXYrP.exe
  2⤵
  PID:4188
- C:\Windows\System\fXzwOWQ.exe
  C:\Windows\System\fXzwOWQ.exe
  2⤵
  PID:5380
- C:\Windows\System\PrBzyVU.exe
  C:\Windows\System\PrBzyVU.exe
  2⤵
  PID:5784
- C:\Windows\System\OdHDcIk.exe
  C:\Windows\System\OdHDcIk.exe
  2⤵
  PID:3916
- C:\Windows\System\hEQpiQt.exe
  C:\Windows\System\hEQpiQt.exe
  2⤵
  PID:4444
- C:\Windows\System\kkIOnmt.exe
  C:\Windows\System\kkIOnmt.exe
  2⤵
  PID:5184
- C:\Windows\System\WRVnqcA.exe
  C:\Windows\System\WRVnqcA.exe
  2⤵
  PID:5980
- C:\Windows\System\mNsoeMV.exe
  C:\Windows\System\mNsoeMV.exe
  2⤵
  PID:6148
- C:\Windows\System\VwgpwTx.exe
  C:\Windows\System\VwgpwTx.exe
  2⤵
  PID:6192
- C:\Windows\System\mQaNbCc.exe
  C:\Windows\System\mQaNbCc.exe
  2⤵
  PID:6216
- C:\Windows\System\yoRWkgK.exe
  C:\Windows\System\yoRWkgK.exe
  2⤵
  PID:6244
- C:\Windows\System\QKWgpMN.exe
  C:\Windows\System\QKWgpMN.exe
  2⤵
  PID:6260
- C:\Windows\System\HvBTLoC.exe
  C:\Windows\System\HvBTLoC.exe
  2⤵
  PID:6312
- C:\Windows\System\hYiyiBe.exe
  C:\Windows\System\hYiyiBe.exe
  2⤵
  PID:6352
- C:\Windows\System\XgagtWa.exe
  C:\Windows\System\XgagtWa.exe
  2⤵
  PID:6372
- C:\Windows\System\skzGZBW.exe
  C:\Windows\System\skzGZBW.exe
  2⤵
  PID:6400
- C:\Windows\System\vaJkRUl.exe
  C:\Windows\System\vaJkRUl.exe
  2⤵
  PID:6432
- C:\Windows\System\HPqPVYL.exe
  C:\Windows\System\HPqPVYL.exe
  2⤵
  PID:6464
- C:\Windows\System\ykVRUyM.exe
  C:\Windows\System\ykVRUyM.exe
  2⤵
  PID:6488
- C:\Windows\System\jqKjMGJ.exe
  C:\Windows\System\jqKjMGJ.exe
  2⤵
  PID:6512
- C:\Windows\System\TrVUubb.exe
  C:\Windows\System\TrVUubb.exe
  2⤵
  PID:6556
- C:\Windows\System\iaKDubn.exe
  C:\Windows\System\iaKDubn.exe
  2⤵
  PID:6584
- C:\Windows\System\IDcovyB.exe
  C:\Windows\System\IDcovyB.exe
  2⤵
  PID:6612
- C:\Windows\System\yLcYXvz.exe
  C:\Windows\System\yLcYXvz.exe
  2⤵
  PID:6628
- C:\Windows\System\biPekkw.exe
  C:\Windows\System\biPekkw.exe
  2⤵
  PID:6668
- C:\Windows\System\SFJqOAr.exe
  C:\Windows\System\SFJqOAr.exe
  2⤵
  PID:6688
- C:\Windows\System\VrBdZRe.exe
  C:\Windows\System\VrBdZRe.exe
  2⤵
  PID:6724
- C:\Windows\System\RZYSjer.exe
  C:\Windows\System\RZYSjer.exe
  2⤵
  PID:6740
- C:\Windows\System\jxqUZes.exe
  C:\Windows\System\jxqUZes.exe
  2⤵
  PID:6768
- C:\Windows\System\jEQdeZW.exe
  C:\Windows\System\jEQdeZW.exe
  2⤵
  PID:6816
- C:\Windows\System\qKLUqXf.exe
  C:\Windows\System\qKLUqXf.exe
  2⤵
  PID:6844
- C:\Windows\System\KfcdJNu.exe
  C:\Windows\System\KfcdJNu.exe
  2⤵
  PID:6860
- C:\Windows\System\TyRAlxk.exe
  C:\Windows\System\TyRAlxk.exe
  2⤵
  PID:6876
- C:\Windows\System\ToIqOFY.exe
  C:\Windows\System\ToIqOFY.exe
  2⤵
  PID:6900
- C:\Windows\System\VFrKURQ.exe
  C:\Windows\System\VFrKURQ.exe
  2⤵
  PID:6920
- C:\Windows\System\yuBmMpo.exe
  C:\Windows\System\yuBmMpo.exe
  2⤵
  PID:6976
- C:\Windows\System\qaPhjDw.exe
  C:\Windows\System\qaPhjDw.exe
  2⤵
  PID:6992
- C:\Windows\System\tESviAY.exe
  C:\Windows\System\tESviAY.exe
  2⤵
  PID:7008
- C:\Windows\System\hJSgUpU.exe
  C:\Windows\System\hJSgUpU.exe
  2⤵
  PID:7032
- C:\Windows\System\WFCjHFI.exe
  C:\Windows\System\WFCjHFI.exe
  2⤵
  PID:7084
- C:\Windows\System\dvGjOPu.exe
  C:\Windows\System\dvGjOPu.exe
  2⤵
  PID:7116
- C:\Windows\System\HHnzcqI.exe
  C:\Windows\System\HHnzcqI.exe
  2⤵
  PID:7148
- C:\Windows\System\oHBYxiD.exe
  C:\Windows\System\oHBYxiD.exe
  2⤵
  PID:2024
- C:\Windows\System\qqLkzcR.exe
  C:\Windows\System\qqLkzcR.exe
  2⤵
  PID:6180
- C:\Windows\System\dYrIArA.exe
  C:\Windows\System\dYrIArA.exe
  2⤵
  PID:6256
- C:\Windows\System\owrglpT.exe
  C:\Windows\System\owrglpT.exe
  2⤵
  PID:6348
- C:\Windows\System\xJQtKcR.exe
  C:\Windows\System\xJQtKcR.exe
  2⤵
  PID:6396
- C:\Windows\System\gVBVNnY.exe
  C:\Windows\System\gVBVNnY.exe
  2⤵
  PID:6440
- C:\Windows\System\UqlYRPy.exe
  C:\Windows\System\UqlYRPy.exe
  2⤵
  PID:6328
- C:\Windows\System\LLufllT.exe
  C:\Windows\System\LLufllT.exe
  2⤵
  PID:6532
- C:\Windows\System\NLSIAtm.exe
  C:\Windows\System\NLSIAtm.exe
  2⤵
  PID:6608
- C:\Windows\System\PFJCgFD.exe
  C:\Windows\System\PFJCgFD.exe
  2⤵
  PID:6700
- C:\Windows\System\hrKJkzH.exe
  C:\Windows\System\hrKJkzH.exe
  2⤵
  PID:6812
- C:\Windows\System\Wmmhkty.exe
  C:\Windows\System\Wmmhkty.exe
  2⤵
  PID:6776
- C:\Windows\System\rxbPIZT.exe
  C:\Windows\System\rxbPIZT.exe
  2⤵
  PID:6940
- C:\Windows\System\ZJOrHQA.exe
  C:\Windows\System\ZJOrHQA.exe
  2⤵
  PID:6984
- C:\Windows\System\vfVUftI.exe
  C:\Windows\System\vfVUftI.exe
  2⤵
  PID:7048
- C:\Windows\System\YhzSgty.exe
  C:\Windows\System\YhzSgty.exe
  2⤵
  PID:7096
- C:\Windows\System\NmZqkeZ.exe
  C:\Windows\System\NmZqkeZ.exe
  2⤵
  PID:6176
- C:\Windows\System\kxlYmHx.exe
  C:\Windows\System\kxlYmHx.exe
  2⤵
  PID:6232
- C:\Windows\System\jPXZjYb.exe
  C:\Windows\System\jPXZjYb.exe
  2⤵
  PID:6448
- C:\Windows\System\ePtyZbC.exe
  C:\Windows\System\ePtyZbC.exe
  2⤵
  PID:6540
- C:\Windows\System\TeQpijv.exe
  C:\Windows\System\TeQpijv.exe
  2⤵
  PID:6720
- C:\Windows\System\HtsJpcM.exe
  C:\Windows\System\HtsJpcM.exe
  2⤵
  PID:6872
- C:\Windows\System\CNUxMai.exe
  C:\Windows\System\CNUxMai.exe
  2⤵
  PID:7112
- C:\Windows\System\icGrEhV.exe
  C:\Windows\System\icGrEhV.exe
  2⤵
  PID:6344
- C:\Windows\System\AfOfpEW.exe
  C:\Windows\System\AfOfpEW.exe
  2⤵
  PID:6680
- C:\Windows\System\QohKifO.exe
  C:\Windows\System\QohKifO.exe
  2⤵
  PID:7020
- C:\Windows\System\iGXkHYZ.exe
  C:\Windows\System\iGXkHYZ.exe
  2⤵
  PID:6388
- C:\Windows\System\YgaEvtW.exe
  C:\Windows\System\YgaEvtW.exe
  2⤵
  PID:6528
- C:\Windows\System\XvvcdEO.exe
  C:\Windows\System\XvvcdEO.exe
  2⤵
  PID:7184
- C:\Windows\System\vhNfmLM.exe
  C:\Windows\System\vhNfmLM.exe
  2⤵
  PID:7212
- C:\Windows\System\ihtSDmm.exe
  C:\Windows\System\ihtSDmm.exe
  2⤵
  PID:7248
- C:\Windows\System\dvodyWp.exe
  C:\Windows\System\dvodyWp.exe
  2⤵
  PID:7264
- C:\Windows\System\WlRXiOg.exe
  C:\Windows\System\WlRXiOg.exe
  2⤵
  PID:7284
- C:\Windows\System\CFdaouH.exe
  C:\Windows\System\CFdaouH.exe
  2⤵
  PID:7332
- C:\Windows\System\fXctJGJ.exe
  C:\Windows\System\fXctJGJ.exe
  2⤵
  PID:7356
- C:\Windows\System\VMIdvXi.exe
  C:\Windows\System\VMIdvXi.exe
  2⤵
  PID:7376
- C:\Windows\System\UwBJIpx.exe
  C:\Windows\System\UwBJIpx.exe
  2⤵
  PID:7408
- C:\Windows\System\HeZEvNn.exe
  C:\Windows\System\HeZEvNn.exe
  2⤵
  PID:7444
- C:\Windows\System\HhXacAt.exe
  C:\Windows\System\HhXacAt.exe
  2⤵
  PID:7472
- C:\Windows\System\TuxNYUj.exe
  C:\Windows\System\TuxNYUj.exe
  2⤵
  PID:7500
- C:\Windows\System\grmOUxm.exe
  C:\Windows\System\grmOUxm.exe
  2⤵
  PID:7520
- C:\Windows\System\QsOXtrK.exe
  C:\Windows\System\QsOXtrK.exe
  2⤵
  PID:7568
- C:\Windows\System\fqiuHYX.exe
  C:\Windows\System\fqiuHYX.exe
  2⤵
  PID:7584
- C:\Windows\System\DSxrMcF.exe
  C:\Windows\System\DSxrMcF.exe
  2⤵
  PID:7612
- C:\Windows\System\PHiMzKQ.exe
  C:\Windows\System\PHiMzKQ.exe
  2⤵
  PID:7636
- C:\Windows\System\mMcOSdk.exe
  C:\Windows\System\mMcOSdk.exe
  2⤵
  PID:7664
- C:\Windows\System\zZbsjVo.exe
  C:\Windows\System\zZbsjVo.exe
  2⤵
  PID:7696
- C:\Windows\System\JgiMpUw.exe
  C:\Windows\System\JgiMpUw.exe
  2⤵
  PID:7712
- C:\Windows\System\QhPSCLT.exe
  C:\Windows\System\QhPSCLT.exe
  2⤵
  PID:7744
- C:\Windows\System\fbnWyTJ.exe
  C:\Windows\System\fbnWyTJ.exe
  2⤵
  PID:7772
- C:\Windows\System\dVojnNE.exe
  C:\Windows\System\dVojnNE.exe
  2⤵
  PID:7808
- C:\Windows\System\cvVOQJZ.exe
  C:\Windows\System\cvVOQJZ.exe
  2⤵
  PID:7828
- C:\Windows\System\LeyoNFd.exe
  C:\Windows\System\LeyoNFd.exe
  2⤵
  PID:7844
- C:\Windows\System\UWNHzIy.exe
  C:\Windows\System\UWNHzIy.exe
  2⤵
  PID:7884
- C:\Windows\System\fVOhEQc.exe
  C:\Windows\System\fVOhEQc.exe
  2⤵
  PID:7912
- C:\Windows\System\GytGRWf.exe
  C:\Windows\System\GytGRWf.exe
  2⤵
  PID:7972
- C:\Windows\System\dFumrYM.exe
  C:\Windows\System\dFumrYM.exe
  2⤵
  PID:7996
- C:\Windows\System\UZlibFp.exe
  C:\Windows\System\UZlibFp.exe
  2⤵
  PID:8016
- C:\Windows\System\PCNGutV.exe
  C:\Windows\System\PCNGutV.exe
  2⤵
  PID:8044
- C:\Windows\System\mKjPASi.exe
  C:\Windows\System\mKjPASi.exe
  2⤵
  PID:8064
- C:\Windows\System\TYumUDC.exe
  C:\Windows\System\TYumUDC.exe
  2⤵
  PID:8112
- C:\Windows\System\WZBCrsI.exe
  C:\Windows\System\WZBCrsI.exe
  2⤵
  PID:8140
- C:\Windows\System\lwptCbm.exe
  C:\Windows\System\lwptCbm.exe
  2⤵
  PID:8168
- C:\Windows\System\IBtaxia.exe
  C:\Windows\System\IBtaxia.exe
  2⤵
  PID:6508
- C:\Windows\System\oBwPYLh.exe
  C:\Windows\System\oBwPYLh.exe
  2⤵
  PID:7200
- C:\Windows\System\BPzNEdk.exe
  C:\Windows\System\BPzNEdk.exe
  2⤵
  PID:7272
- C:\Windows\System\VdLzhCN.exe
  C:\Windows\System\VdLzhCN.exe
  2⤵
  PID:7352
- C:\Windows\System\PQqYCQR.exe
  C:\Windows\System\PQqYCQR.exe
  2⤵
  PID:7372
- C:\Windows\System\YvvNvvV.exe
  C:\Windows\System\YvvNvvV.exe
  2⤵
  PID:7436
- C:\Windows\System\DgXtgFR.exe
  C:\Windows\System\DgXtgFR.exe
  2⤵
  PID:7528
- C:\Windows\System\CjvFOvT.exe
  C:\Windows\System\CjvFOvT.exe
  2⤵
  PID:6536
- C:\Windows\System\qlbWYln.exe
  C:\Windows\System\qlbWYln.exe
  2⤵
  PID:7660
- C:\Windows\System\WBdIHGG.exe
  C:\Windows\System\WBdIHGG.exe
  2⤵
  PID:7728
- C:\Windows\System\ggXPyXc.exe
  C:\Windows\System\ggXPyXc.exe
  2⤵
  PID:7816
- C:\Windows\System\lBzVbuL.exe
  C:\Windows\System\lBzVbuL.exe
  2⤵
  PID:7856
- C:\Windows\System\xwwDFlp.exe
  C:\Windows\System\xwwDFlp.exe
  2⤵
  PID:7896
- C:\Windows\System\yhYEFGC.exe
  C:\Windows\System\yhYEFGC.exe
  2⤵
  PID:7988
- C:\Windows\System\vBzBunn.exe
  C:\Windows\System\vBzBunn.exe
  2⤵
  PID:8032
- C:\Windows\System\LfLDWLf.exe
  C:\Windows\System\LfLDWLf.exe
  2⤵
  PID:8108
- C:\Windows\System\FzQAWIw.exe
  C:\Windows\System\FzQAWIw.exe
  2⤵
  PID:8156
- C:\Windows\System\NieOPcn.exe
  C:\Windows\System\NieOPcn.exe
  2⤵
  PID:7236
- C:\Windows\System\EDovAWZ.exe
  C:\Windows\System\EDovAWZ.exe
  2⤵
  PID:7344
- C:\Windows\System\HPfcmox.exe
  C:\Windows\System\HPfcmox.exe
  2⤵
  PID:7556
- C:\Windows\System\RNMSWff.exe
  C:\Windows\System\RNMSWff.exe
  2⤵
  PID:7708
- C:\Windows\System\WgrwIti.exe
  C:\Windows\System\WgrwIti.exe
  2⤵
  PID:7840
- C:\Windows\System\BSNdZug.exe
  C:\Windows\System\BSNdZug.exe
  2⤵
  PID:7892
- C:\Windows\System\QmtJJVH.exe
  C:\Windows\System\QmtJJVH.exe
  2⤵
  PID:8088
- C:\Windows\System\YGqcjnT.exe
  C:\Windows\System\YGqcjnT.exe
  2⤵
  PID:7508
- C:\Windows\System\vaiDHTU.exe
  C:\Windows\System\vaiDHTU.exe
  2⤵
  PID:7804
- C:\Windows\System\isrjqVr.exe
  C:\Windows\System\isrjqVr.exe
  2⤵
  PID:7488
- C:\Windows\System\YfVDwyH.exe
  C:\Windows\System\YfVDwyH.exe
  2⤵
  PID:7652
- C:\Windows\System\SkjWgFQ.exe
  C:\Windows\System\SkjWgFQ.exe
  2⤵
  PID:8212
- C:\Windows\System\VnCzhOM.exe
  C:\Windows\System\VnCzhOM.exe
  2⤵
  PID:8232
- C:\Windows\System\mcGHGzW.exe
  C:\Windows\System\mcGHGzW.exe
  2⤵
  PID:8252
- C:\Windows\System\HCTNQAJ.exe
  C:\Windows\System\HCTNQAJ.exe
  2⤵
  PID:8276
- C:\Windows\System\MXuPqGc.exe
  C:\Windows\System\MXuPqGc.exe
  2⤵
  PID:8312
- C:\Windows\System\XkTsnmP.exe
  C:\Windows\System\XkTsnmP.exe
  2⤵
  PID:8340
- C:\Windows\System\gAqJwCE.exe
  C:\Windows\System\gAqJwCE.exe
  2⤵
  PID:8368
- C:\Windows\System\ujZEeVJ.exe
  C:\Windows\System\ujZEeVJ.exe
  2⤵
  PID:8412
- C:\Windows\System\rTwEHPB.exe
  C:\Windows\System\rTwEHPB.exe
  2⤵
  PID:8436
- C:\Windows\System\NUtMEIm.exe
  C:\Windows\System\NUtMEIm.exe
  2⤵
  PID:8464
- C:\Windows\System\LyiJhlV.exe
  C:\Windows\System\LyiJhlV.exe
  2⤵
  PID:8492
- C:\Windows\System\vtlijMv.exe
  C:\Windows\System\vtlijMv.exe
  2⤵
  PID:8520
- C:\Windows\System\CllWpOf.exe
  C:\Windows\System\CllWpOf.exe
  2⤵
  PID:8560
- C:\Windows\System\bVKCvaN.exe
  C:\Windows\System\bVKCvaN.exe
  2⤵
  PID:8576
- C:\Windows\System\cjXiMuN.exe
  C:\Windows\System\cjXiMuN.exe
  2⤵
  PID:8604
- C:\Windows\System\YWrBotv.exe
  C:\Windows\System\YWrBotv.exe
  2⤵
  PID:8632
- C:\Windows\System\GxyMarV.exe
  C:\Windows\System\GxyMarV.exe
  2⤵
  PID:8660
- C:\Windows\System\RsBzEcT.exe
  C:\Windows\System\RsBzEcT.exe
  2⤵
  PID:8700
- C:\Windows\System\oMuNBot.exe
  C:\Windows\System\oMuNBot.exe
  2⤵
  PID:8728
- C:\Windows\System\qeSxmFW.exe
  C:\Windows\System\qeSxmFW.exe
  2⤵
  PID:8744
- C:\Windows\System\QQvdqGf.exe
  C:\Windows\System\QQvdqGf.exe
  2⤵
  PID:8784
- C:\Windows\System\FDscfXt.exe
  C:\Windows\System\FDscfXt.exe
  2⤵
  PID:8812
- C:\Windows\System\RfWwXmx.exe
  C:\Windows\System\RfWwXmx.exe
  2⤵
  PID:8828
- C:\Windows\System\rESrGWU.exe
  C:\Windows\System\rESrGWU.exe
  2⤵
  PID:8856
- C:\Windows\System\idlmhCJ.exe
  C:\Windows\System\idlmhCJ.exe
  2⤵
  PID:8884
- C:\Windows\System\EiBWSXa.exe
  C:\Windows\System\EiBWSXa.exe
  2⤵
  PID:8916
- C:\Windows\System\LYUocZD.exe
  C:\Windows\System\LYUocZD.exe
  2⤵
  PID:8940
- C:\Windows\System\rBcgkam.exe
  C:\Windows\System\rBcgkam.exe
  2⤵
  PID:8964
- C:\Windows\System\kBUQlad.exe
  C:\Windows\System\kBUQlad.exe
  2⤵
  PID:8988
- C:\Windows\System\ifXlWpV.exe
  C:\Windows\System\ifXlWpV.exe
  2⤵
  PID:9012
- C:\Windows\System\FeKgjVy.exe
  C:\Windows\System\FeKgjVy.exe
  2⤵
  PID:9044
- C:\Windows\System\WtmPQRT.exe
  C:\Windows\System\WtmPQRT.exe
  2⤵
  PID:9072
- C:\Windows\System\YKYXeMI.exe
  C:\Windows\System\YKYXeMI.exe
  2⤵
  PID:9100
- C:\Windows\System\IAXGBbb.exe
  C:\Windows\System\IAXGBbb.exe
  2⤵
  PID:9124
- C:\Windows\System\MojinQu.exe
  C:\Windows\System\MojinQu.exe
  2⤵
  PID:9176
- C:\Windows\System\amFZjHx.exe
  C:\Windows\System\amFZjHx.exe
  2⤵
  PID:9192
- C:\Windows\System\xzXPoiv.exe
  C:\Windows\System\xzXPoiv.exe
  2⤵
  PID:8196
- C:\Windows\System\mjxmfVh.exe
  C:\Windows\System\mjxmfVh.exe
  2⤵
  PID:8240
- C:\Windows\System\ltjPrhP.exe
  C:\Windows\System\ltjPrhP.exe
  2⤵
  PID:8300
- C:\Windows\System\asiurRv.exe
  C:\Windows\System\asiurRv.exe
  2⤵
  PID:8328
- C:\Windows\System\gDXvGob.exe
  C:\Windows\System\gDXvGob.exe
  2⤵
  PID:8388
- C:\Windows\System\rqEbCNX.exe
  C:\Windows\System\rqEbCNX.exe
  2⤵
  PID:8452
- C:\Windows\System\EqLBQMz.exe
  C:\Windows\System\EqLBQMz.exe
  2⤵
  PID:8536
- C:\Windows\System\MedxRLH.exe
  C:\Windows\System\MedxRLH.exe
  2⤵
  PID:8572
- C:\Windows\System\VGKMGpW.exe
  C:\Windows\System\VGKMGpW.exe
  2⤵
  PID:8592
- C:\Windows\System\gXuxPPX.exe
  C:\Windows\System\gXuxPPX.exe
  2⤵
  PID:8644
- C:\Windows\System\YfKvqEK.exe
  C:\Windows\System\YfKvqEK.exe
  2⤵
  PID:8724
- C:\Windows\System\whKCBOo.exe
  C:\Windows\System\whKCBOo.exe
  2⤵
  PID:8764
- C:\Windows\System\kYwdAaw.exe
  C:\Windows\System\kYwdAaw.exe
  2⤵
  PID:8880
- C:\Windows\System\Ajpowuv.exe
  C:\Windows\System\Ajpowuv.exe
  2⤵
  PID:9052
- C:\Windows\System\HlfgFCG.exe
  C:\Windows\System\HlfgFCG.exe
  2⤵
  PID:9108
- C:\Windows\System\mpRxrdg.exe
  C:\Windows\System\mpRxrdg.exe
  2⤵
  PID:9168
- C:\Windows\System\FhdjRiY.exe
  C:\Windows\System\FhdjRiY.exe
  2⤵
  PID:8268
- C:\Windows\System\HhOBiWZ.exe
  C:\Windows\System\HhOBiWZ.exe
  2⤵
  PID:8476
- C:\Windows\System\zpEILxP.exe
  C:\Windows\System\zpEILxP.exe
  2⤵
  PID:8516
- C:\Windows\System\NVpoYhP.exe
  C:\Windows\System\NVpoYhP.exe
  2⤵
  PID:8556
- C:\Windows\System\ibhuDVF.exe
  C:\Windows\System\ibhuDVF.exe
  2⤵
  PID:8900
- C:\Windows\System\lQGRnmw.exe
  C:\Windows\System\lQGRnmw.exe
  2⤵
  PID:9064
- C:\Windows\System\umfBIJK.exe
  C:\Windows\System\umfBIJK.exe
  2⤵
  PID:9152
- C:\Windows\System\qVLjNjy.exe
  C:\Windows\System\qVLjNjy.exe
  2⤵
  PID:8288
- C:\Windows\System\JxSAcZR.exe
  C:\Windows\System\JxSAcZR.exe
  2⤵
  PID:8648
- C:\Windows\System\XohSmUP.exe
  C:\Windows\System\XohSmUP.exe
  2⤵
  PID:9088
- C:\Windows\System\bBCWfaS.exe
  C:\Windows\System\bBCWfaS.exe
  2⤵
  PID:8676
- C:\Windows\System\PzVKMcZ.exe
  C:\Windows\System\PzVKMcZ.exe
  2⤵
  PID:9224
- C:\Windows\System\laGYXrO.exe
  C:\Windows\System\laGYXrO.exe
  2⤵
  PID:9240
- C:\Windows\System\GbdRXgk.exe
  C:\Windows\System\GbdRXgk.exe
  2⤵
  PID:9264
- C:\Windows\System\XjlmScm.exe
  C:\Windows\System\XjlmScm.exe
  2⤵
  PID:9288
- C:\Windows\System\Podueif.exe
  C:\Windows\System\Podueif.exe
  2⤵
  PID:9312
- C:\Windows\System\GpRXsBa.exe
  C:\Windows\System\GpRXsBa.exe
  2⤵
  PID:9364
- C:\Windows\System\qrDSQyK.exe
  C:\Windows\System\qrDSQyK.exe
  2⤵
  PID:9388
- C:\Windows\System\BgTrJmI.exe
  C:\Windows\System\BgTrJmI.exe
  2⤵
  PID:9408
- C:\Windows\System\CvqfzOZ.exe
  C:\Windows\System\CvqfzOZ.exe
  2⤵
  PID:9436
- C:\Windows\System\eCTcTzK.exe
  C:\Windows\System\eCTcTzK.exe
  2⤵
  PID:9456
- C:\Windows\System\uKOleSN.exe
  C:\Windows\System\uKOleSN.exe
  2⤵
  PID:9480
- C:\Windows\System\UGOjSSL.exe
  C:\Windows\System\UGOjSSL.exe
  2⤵
  PID:9508
- C:\Windows\System\baoFpLZ.exe
  C:\Windows\System\baoFpLZ.exe
  2⤵
  PID:9536
- C:\Windows\System\QihsDfh.exe
  C:\Windows\System\QihsDfh.exe
  2⤵
  PID:9556
- C:\Windows\System\MesDWwo.exe
  C:\Windows\System\MesDWwo.exe
  2⤵
  PID:9616
- C:\Windows\System\cokfdZf.exe
  C:\Windows\System\cokfdZf.exe
  2⤵
  PID:9644
- C:\Windows\System\TQNxsIY.exe
  C:\Windows\System\TQNxsIY.exe
  2⤵
  PID:9660
- C:\Windows\System\zLqQMWs.exe
  C:\Windows\System\zLqQMWs.exe
  2⤵
  PID:9700
- C:\Windows\System\fSBzQar.exe
  C:\Windows\System\fSBzQar.exe
  2⤵
  PID:9720
- C:\Windows\System\ffGLMVq.exe
  C:\Windows\System\ffGLMVq.exe
  2⤵
  PID:9744
- C:\Windows\System\iAqgIUu.exe
  C:\Windows\System\iAqgIUu.exe
  2⤵
  PID:9760
- C:\Windows\System\COtXcwc.exe
  C:\Windows\System\COtXcwc.exe
  2⤵
  PID:9788
- C:\Windows\System\bAbpsEc.exe
  C:\Windows\System\bAbpsEc.exe
  2⤵
  PID:9812
- C:\Windows\System\qsGYBoB.exe
  C:\Windows\System\qsGYBoB.exe
  2⤵
  PID:9848
- C:\Windows\System\MGSLUvE.exe
  C:\Windows\System\MGSLUvE.exe
  2⤵
  PID:9872
- C:\Windows\System\ZbEvmwh.exe
  C:\Windows\System\ZbEvmwh.exe
  2⤵
  PID:9892
- C:\Windows\System\skVBIEd.exe
  C:\Windows\System\skVBIEd.exe
  2⤵
  PID:9920
- C:\Windows\System\QSaWVmY.exe
  C:\Windows\System\QSaWVmY.exe
  2⤵
  PID:9948
- C:\Windows\System\uCOOusv.exe
  C:\Windows\System\uCOOusv.exe
  2⤵
  PID:9992
- C:\Windows\System\dlisOVe.exe
  C:\Windows\System\dlisOVe.exe
  2⤵
  PID:10016
- C:\Windows\System\Jxjdoye.exe
  C:\Windows\System\Jxjdoye.exe
  2⤵
  PID:10040
- C:\Windows\System\WbDxhrw.exe
  C:\Windows\System\WbDxhrw.exe
  2⤵
  PID:10084
- C:\Windows\System\rrKsbyR.exe
  C:\Windows\System\rrKsbyR.exe
  2⤵
  PID:10120
- C:\Windows\System\kWKYHcv.exe
  C:\Windows\System\kWKYHcv.exe
  2⤵
  PID:10148
- C:\Windows\System\xRNkkum.exe
  C:\Windows\System\xRNkkum.exe
  2⤵
  PID:10176
- C:\Windows\System\nmbNnGH.exe
  C:\Windows\System\nmbNnGH.exe
  2⤵
  PID:10204
- C:\Windows\System\CVeEKpP.exe
  C:\Windows\System\CVeEKpP.exe
  2⤵
  PID:10232
- C:\Windows\System\xHGqJAG.exe
  C:\Windows\System\xHGqJAG.exe
  2⤵
  PID:8504
- C:\Windows\System\GnZGqRk.exe
  C:\Windows\System\GnZGqRk.exe
  2⤵
  PID:9308
- C:\Windows\System\cIoInxA.exe
  C:\Windows\System\cIoInxA.exe
  2⤵
  PID:9332
- C:\Windows\System\dHwofeK.exe
  C:\Windows\System\dHwofeK.exe
  2⤵
  PID:9404
- C:\Windows\System\Sxsruti.exe
  C:\Windows\System\Sxsruti.exe
  2⤵
  PID:9492
- C:\Windows\System\mHNvXfQ.exe
  C:\Windows\System\mHNvXfQ.exe
  2⤵
  PID:9524
- C:\Windows\System\LbuVyQG.exe
  C:\Windows\System\LbuVyQG.exe
  2⤵
  PID:9584
- C:\Windows\System\JtFLRBx.exe
  C:\Windows\System\JtFLRBx.exe
  2⤵
  PID:9696
- C:\Windows\System\zTpwFYU.exe
  C:\Windows\System\zTpwFYU.exe
  2⤵
  PID:9728
- C:\Windows\System\rPFiGKJ.exe
  C:\Windows\System\rPFiGKJ.exe
  2⤵
  PID:9808
- C:\Windows\System\okmVvxs.exe
  C:\Windows\System\okmVvxs.exe
  2⤵
  PID:9880
- C:\Windows\System\sNkofQt.exe
  C:\Windows\System\sNkofQt.exe
  2⤵
  PID:9968
- C:\Windows\System\msMsAwM.exe
  C:\Windows\System\msMsAwM.exe
  2⤵
  PID:9984
- C:\Windows\System\VBDOEhL.exe
  C:\Windows\System\VBDOEhL.exe
  2⤵
  PID:10108
- C:\Windows\System\BQALXTu.exe
  C:\Windows\System\BQALXTu.exe
  2⤵
  PID:10196
- C:\Windows\System\djPphtI.exe
  C:\Windows\System\djPphtI.exe
  2⤵
  PID:8876
- C:\Windows\System\eyHBGDj.exe
  C:\Windows\System\eyHBGDj.exe
  2⤵
  PID:9372
- C:\Windows\System\SnlRZCk.exe
  C:\Windows\System\SnlRZCk.exe
  2⤵
  PID:9448
- C:\Windows\System\msQXEPL.exe
  C:\Windows\System\msQXEPL.exe
  2⤵
  PID:9656
- C:\Windows\System\YeWcNXG.exe
  C:\Windows\System\YeWcNXG.exe
  2⤵
  PID:9844
- C:\Windows\System\QAxbwXE.exe
  C:\Windows\System\QAxbwXE.exe
  2⤵
  PID:9940
- C:\Windows\System\DoGPQfR.exe
  C:\Windows\System\DoGPQfR.exe
  2⤵
  PID:10060
- C:\Windows\System\bNdJLhL.exe
  C:\Windows\System\bNdJLhL.exe
  2⤵
  PID:9356
- C:\Windows\System\zlljVMA.exe
  C:\Windows\System\zlljVMA.exe
  2⤵
  PID:9572
- C:\Windows\System\XyHhfih.exe
  C:\Windows\System\XyHhfih.exe
  2⤵
  PID:9676
- C:\Windows\System\NWaaceb.exe
  C:\Windows\System\NWaaceb.exe
  2⤵
  PID:10092
- C:\Windows\System\QcCXiOw.exe
  C:\Windows\System\QcCXiOw.exe
  2⤵
  PID:3728
- C:\Windows\System\RjUlgUT.exe
  C:\Windows\System\RjUlgUT.exe
  2⤵
  PID:10160
- C:\Windows\System\eogLTJm.exe
  C:\Windows\System\eogLTJm.exe
  2⤵
  PID:10300
- C:\Windows\System\GxBASBr.exe
  C:\Windows\System\GxBASBr.exe
  2⤵
  PID:10324
- C:\Windows\System\xsGeaym.exe
  C:\Windows\System\xsGeaym.exe
  2⤵
  PID:10360
- C:\Windows\System\fwERFek.exe
  C:\Windows\System\fwERFek.exe
  2⤵
  PID:10384
- C:\Windows\System\YbkFwbb.exe
  C:\Windows\System\YbkFwbb.exe
  2⤵
  PID:10404
- C:\Windows\System\CxWDZwu.exe
  C:\Windows\System\CxWDZwu.exe
  2⤵
  PID:10424
- C:\Windows\System\qSwjhVu.exe
  C:\Windows\System\qSwjhVu.exe
  2⤵
  PID:10460
- C:\Windows\System\MhUiQbO.exe
  C:\Windows\System\MhUiQbO.exe
  2⤵
  PID:10492
- C:\Windows\System\nDlUKVn.exe
  C:\Windows\System\nDlUKVn.exe
  2⤵
  PID:10520
- C:\Windows\System\apYRdTs.exe
  C:\Windows\System\apYRdTs.exe
  2⤵
  PID:10556
- C:\Windows\System\PlgxSVm.exe
  C:\Windows\System\PlgxSVm.exe
  2⤵
  PID:10584
- C:\Windows\System\eQEisxg.exe
  C:\Windows\System\eQEisxg.exe
  2⤵
  PID:10608
- C:\Windows\System\CgLhrgW.exe
  C:\Windows\System\CgLhrgW.exe
  2⤵
  PID:10628
- C:\Windows\System\SetEJkc.exe
  C:\Windows\System\SetEJkc.exe
  2⤵
  PID:10660
- C:\Windows\System\IlSZXfM.exe
  C:\Windows\System\IlSZXfM.exe
  2⤵
  PID:10700
- C:\Windows\System\YVnkoMC.exe
  C:\Windows\System\YVnkoMC.exe
  2⤵
  PID:10716
- C:\Windows\System\CQJYxLB.exe
  C:\Windows\System\CQJYxLB.exe
  2⤵
  PID:10736
- C:\Windows\System\IpZOVzD.exe
  C:\Windows\System\IpZOVzD.exe
  2⤵
  PID:10772
- C:\Windows\System\vqBmLCM.exe
  C:\Windows\System\vqBmLCM.exe
  2⤵
  PID:10796
- C:\Windows\System\dfPQjSe.exe
  C:\Windows\System\dfPQjSe.exe
  2⤵
  PID:10828
- C:\Windows\System\sBoIQgF.exe
  C:\Windows\System\sBoIQgF.exe
  2⤵
  PID:10844
- C:\Windows\System\PzpbhGv.exe
  C:\Windows\System\PzpbhGv.exe
  2⤵
  PID:10872
- C:\Windows\System\DuHKQqK.exe
  C:\Windows\System\DuHKQqK.exe
  2⤵
  PID:10908
- C:\Windows\System\iLsbhGR.exe
  C:\Windows\System\iLsbhGR.exe
  2⤵
  PID:10940
- C:\Windows\System\vrBbSLb.exe
  C:\Windows\System\vrBbSLb.exe
  2⤵
  PID:10968
- C:\Windows\System\xvuvQXb.exe
  C:\Windows\System\xvuvQXb.exe
  2⤵
  PID:10996
- C:\Windows\System\PurkFtK.exe
  C:\Windows\System\PurkFtK.exe
  2⤵
  PID:11024
- C:\Windows\System\JYxdGVO.exe
  C:\Windows\System\JYxdGVO.exe
  2⤵
  PID:11052
- C:\Windows\System\CGCKOUi.exe
  C:\Windows\System\CGCKOUi.exe
  2⤵
  PID:11080
- C:\Windows\System\uietNgw.exe
  C:\Windows\System\uietNgw.exe
  2⤵
  PID:11108
- C:\Windows\System\vGOzxle.exe
  C:\Windows\System\vGOzxle.exe
  2⤵
  PID:11132
- C:\Windows\System\tQYZoVI.exe
  C:\Windows\System\tQYZoVI.exe
  2⤵
  PID:11164
- C:\Windows\System\GNQsNJr.exe
  C:\Windows\System\GNQsNJr.exe
  2⤵
  PID:11180
- C:\Windows\System\lzTQAlE.exe
  C:\Windows\System\lzTQAlE.exe
  2⤵
  PID:11208
- C:\Windows\System\cLGRGZy.exe
  C:\Windows\System\cLGRGZy.exe
  2⤵
  PID:11260
- C:\Windows\System\qJbUfbv.exe
  C:\Windows\System\qJbUfbv.exe
  2⤵
  PID:9736
- C:\Windows\System\RIyEPFk.exe
  C:\Windows\System\RIyEPFk.exe
  2⤵
  PID:10264
- C:\Windows\System\LvQqUdx.exe
  C:\Windows\System\LvQqUdx.exe
  2⤵
  PID:10332
- C:\Windows\System\nQCjlfr.exe
  C:\Windows\System\nQCjlfr.exe
  2⤵
  PID:10396
- C:\Windows\System\utwnIgR.exe
  C:\Windows\System\utwnIgR.exe
  2⤵
  PID:10392
- C:\Windows\System\deLypfx.exe
  C:\Windows\System\deLypfx.exe
  2⤵
  PID:10488
- C:\Windows\System\EonmhfQ.exe
  C:\Windows\System\EonmhfQ.exe
  2⤵
  PID:10552
- C:\Windows\System\XLTNFNF.exe
  C:\Windows\System\XLTNFNF.exe
  2⤵
  PID:752
- C:\Windows\System\edxjPGe.exe
  C:\Windows\System\edxjPGe.exe
  2⤵
  PID:10712
- C:\Windows\System\VNQFKiU.exe
  C:\Windows\System\VNQFKiU.exe
  2⤵
  PID:10792
- C:\Windows\System\dTLzMuP.exe
  C:\Windows\System\dTLzMuP.exe
  2⤵
  PID:10868
- C:\Windows\System\PTSUuEk.exe
  C:\Windows\System\PTSUuEk.exe
  2⤵
  PID:10988
- C:\Windows\System\RQhdNqf.exe
  C:\Windows\System\RQhdNqf.exe
  2⤵
  PID:11036
- C:\Windows\System\hvmqTvx.exe
  C:\Windows\System\hvmqTvx.exe
  2⤵
  PID:11092
- C:\Windows\System\blWeCfS.exe
  C:\Windows\System\blWeCfS.exe
  2⤵
  PID:11124
- C:\Windows\System\lSlNWFi.exe
  C:\Windows\System\lSlNWFi.exe
  2⤵
  PID:11228
- C:\Windows\System\IGDXtBf.exe
  C:\Windows\System\IGDXtBf.exe
  2⤵
  PID:9036
- C:\Windows\System\ljuddLF.exe
  C:\Windows\System\ljuddLF.exe
  2⤵
  PID:10296
- C:\Windows\System\SJWlDeo.exe
  C:\Windows\System\SJWlDeo.exe
  2⤵
  PID:10636
- C:\Windows\System\BhRFywm.exe
  C:\Windows\System\BhRFywm.exe
  2⤵
  PID:10620
- C:\Windows\System\tHCsnPR.exe
  C:\Windows\System\tHCsnPR.exe
  2⤵
  PID:10952
- C:\Windows\System\hkkYYjg.exe
  C:\Windows\System\hkkYYjg.exe
  2⤵
  PID:10904
- C:\Windows\System\tCronuY.exe
  C:\Windows\System\tCronuY.exe
  2⤵
  PID:11144
- C:\Windows\System\zDpFxPG.exe
  C:\Windows\System\zDpFxPG.exe
  2⤵
  PID:10164
- C:\Windows\System\QVQqQtJ.exe
  C:\Windows\System\QVQqQtJ.exe
  2⤵
  PID:10708
- C:\Windows\System\UctQPCM.exe
  C:\Windows\System\UctQPCM.exe
  2⤵
  PID:10900
- C:\Windows\System\VCSStlH.exe
  C:\Windows\System\VCSStlH.exe
  2⤵
  PID:11192
- C:\Windows\System\IPmTSRZ.exe
  C:\Windows\System\IPmTSRZ.exe
  2⤵
  PID:10344
- C:\Windows\System\YudsQJL.exe
  C:\Windows\System\YudsQJL.exe
  2⤵
  PID:11320
- C:\Windows\System\tkhViBO.exe
  C:\Windows\System\tkhViBO.exe
  2⤵
  PID:11348
- C:\Windows\System\Scixcpw.exe
  C:\Windows\System\Scixcpw.exe
  2⤵
  PID:11372
- C:\Windows\System\NRXmpOD.exe
  C:\Windows\System\NRXmpOD.exe
  2⤵
  PID:11392
- C:\Windows\System\LlLDjBn.exe
  C:\Windows\System\LlLDjBn.exe
  2⤵
  PID:11420
- C:\Windows\System\aGsCRAy.exe
  C:\Windows\System\aGsCRAy.exe
  2⤵
  PID:11440
- C:\Windows\System\kzslBXr.exe
  C:\Windows\System\kzslBXr.exe
  2⤵
  PID:11472
- C:\Windows\System\vVbkpvz.exe
  C:\Windows\System\vVbkpvz.exe
  2⤵
  PID:11500
- C:\Windows\System\LySpEms.exe
  C:\Windows\System\LySpEms.exe
  2⤵
  PID:11520
- C:\Windows\System\tUBbKos.exe
  C:\Windows\System\tUBbKos.exe
  2⤵
  PID:11536
- C:\Windows\System\mAGqvLh.exe
  C:\Windows\System\mAGqvLh.exe
  2⤵
  PID:11560
- C:\Windows\System\ArFLHQu.exe
  C:\Windows\System\ArFLHQu.exe
  2⤵
  PID:11628
- C:\Windows\System\NLEtlKT.exe
  C:\Windows\System\NLEtlKT.exe
  2⤵
  PID:11648
- C:\Windows\System\oLZohIB.exe
  C:\Windows\System\oLZohIB.exe
  2⤵
  PID:11672
- C:\Windows\System\KeNBTwJ.exe
  C:\Windows\System\KeNBTwJ.exe
  2⤵
  PID:11700
- C:\Windows\System\nIBKvMP.exe
  C:\Windows\System\nIBKvMP.exe
  2⤵
  PID:11732
- C:\Windows\System\WKTLHdA.exe
  C:\Windows\System\WKTLHdA.exe
  2⤵
  PID:11748
- C:\Windows\System\WpWNeBO.exe
  C:\Windows\System\WpWNeBO.exe
  2⤵
  PID:11768
- C:\Windows\System\xBebnOh.exe
  C:\Windows\System\xBebnOh.exe
  2⤵
  PID:11824
- C:\Windows\System\CLnRBdb.exe
  C:\Windows\System\CLnRBdb.exe
  2⤵
  PID:11868
- C:\Windows\System\PDxnULY.exe
  C:\Windows\System\PDxnULY.exe
  2⤵
  PID:11892
- C:\Windows\System\WMTHKUY.exe
  C:\Windows\System\WMTHKUY.exe
  2⤵
  PID:11928
- C:\Windows\System\EyNhVhD.exe
  C:\Windows\System\EyNhVhD.exe
  2⤵
  PID:11956
- C:\Windows\System\HtsnJfP.exe
  C:\Windows\System\HtsnJfP.exe
  2⤵
  PID:11984
- C:\Windows\System\qPVvmaf.exe
  C:\Windows\System\qPVvmaf.exe
  2⤵
  PID:12012
- C:\Windows\System\uWFQKLo.exe
  C:\Windows\System\uWFQKLo.exe
  2⤵
  PID:12028
- C:\Windows\System\UDDnhCX.exe
  C:\Windows\System\UDDnhCX.exe
  2⤵
  PID:12044
- C:\Windows\System\bWzSGdR.exe
  C:\Windows\System\bWzSGdR.exe
  2⤵
  PID:12084
- C:\Windows\System\wIMmbUQ.exe
  C:\Windows\System\wIMmbUQ.exe
  2⤵
  PID:12124
- C:\Windows\System\PoKnTFI.exe
  C:\Windows\System\PoKnTFI.exe
  2⤵
  PID:12152
- C:\Windows\System\BCvdPIH.exe
  C:\Windows\System\BCvdPIH.exe
  2⤵
  PID:12168
- C:\Windows\System\nWsvOWS.exe
  C:\Windows\System\nWsvOWS.exe
  2⤵
  PID:12184
- C:\Windows\System\REcaaoL.exe
  C:\Windows\System\REcaaoL.exe
  2⤵
  PID:12228
- C:\Windows\System\ugYRhXr.exe
  C:\Windows\System\ugYRhXr.exe
  2⤵
  PID:12264
- C:\Windows\System\BTqXWSF.exe
  C:\Windows\System\BTqXWSF.exe
  2⤵
  PID:11016
- C:\Windows\System\XbgRJBx.exe
  C:\Windows\System\XbgRJBx.exe
  2⤵
  PID:11284
- C:\Windows\System\xOgGtod.exe
  C:\Windows\System\xOgGtod.exe
  2⤵
  PID:11280
- C:\Windows\System\EuWXPiN.exe
  C:\Windows\System\EuWXPiN.exe
  2⤵
  PID:11404
- C:\Windows\System\OBdyWLa.exe
  C:\Windows\System\OBdyWLa.exe
  2⤵
  PID:11468
- C:\Windows\System\xxlQtgZ.exe
  C:\Windows\System\xxlQtgZ.exe
  2⤵
  PID:11528
- C:\Windows\System\AlXbUMl.exe
  C:\Windows\System\AlXbUMl.exe
  2⤵
  PID:11552
- C:\Windows\System\XSYegnh.exe
  C:\Windows\System\XSYegnh.exe
  2⤵
  PID:11612
- C:\Windows\System\JqZCVXC.exe
  C:\Windows\System\JqZCVXC.exe
  2⤵
  PID:11656
- C:\Windows\System\orAZXvF.exe
  C:\Windows\System\orAZXvF.exe
  2⤵
  PID:11740
- C:\Windows\System\brRZfzW.exe
  C:\Windows\System\brRZfzW.exe
  2⤵
  PID:11816
- C:\Windows\System\LBMSskO.exe
  C:\Windows\System\LBMSskO.exe
  2⤵
  PID:11864
- C:\Windows\System\juowqbS.exe
  C:\Windows\System\juowqbS.exe
  2⤵
  PID:11952
- C:\Windows\System\uKzOHPH.exe
  C:\Windows\System\uKzOHPH.exe
  2⤵
  PID:12000
- C:\Windows\System\QqseCmC.exe
  C:\Windows\System\QqseCmC.exe
  2⤵
  PID:12104
- C:\Windows\System\ylONaYW.exe
  C:\Windows\System\ylONaYW.exe
  2⤵
  PID:12136
- C:\Windows\System\ceRgJYz.exe
  C:\Windows\System\ceRgJYz.exe
  2⤵
  PID:12204
- C:\Windows\System\SnccfUP.exe
  C:\Windows\System\SnccfUP.exe
  2⤵
  PID:10680
- C:\Windows\System\Gzyebgs.exe
  C:\Windows\System\Gzyebgs.exe
  2⤵
  PID:11384
- C:\Windows\System\Zlubxvp.exe
  C:\Windows\System\Zlubxvp.exe
  2⤵
  PID:11492
- C:\Windows\System\FFSMtsY.exe
  C:\Windows\System\FFSMtsY.exe
  2⤵
  PID:11664
- C:\Windows\System\XKXIKhI.exe
  C:\Windows\System\XKXIKhI.exe
  2⤵
  PID:11644
- C:\Windows\System\oXlksXR.exe
  C:\Windows\System\oXlksXR.exe
  2⤵
  PID:11836
- C:\Windows\System\CzVFoMo.exe
  C:\Windows\System\CzVFoMo.exe
  2⤵
  PID:12160
- C:\Windows\System\nMFfzpm.exe
  C:\Windows\System\nMFfzpm.exe
  2⤵
  PID:11484
- C:\Windows\System\UEUxTRp.exe
  C:\Windows\System\UEUxTRp.exe
  2⤵
  PID:11596
- C:\Windows\System\xvACEEI.exe
  C:\Windows\System\xvACEEI.exe
  2⤵
  PID:11760
- C:\Windows\System\IKnOxVR.exe
  C:\Windows\System\IKnOxVR.exe
  2⤵
  PID:12260
- C:\Windows\System\OqEuKxY.exe
  C:\Windows\System\OqEuKxY.exe
  2⤵
  PID:12164
- C:\Windows\System\oDrsEfs.exe
  C:\Windows\System\oDrsEfs.exe
  2⤵
  PID:11584
- C:\Windows\System\cwtkzTi.exe
  C:\Windows\System\cwtkzTi.exe
  2⤵
  PID:12316
- C:\Windows\System\VoYAEFi.exe
  C:\Windows\System\VoYAEFi.exe
  2⤵
  PID:12336
- C:\Windows\System\qUfZOUE.exe
  C:\Windows\System\qUfZOUE.exe
  2⤵
  PID:12368
- C:\Windows\System\DFxCECM.exe
  C:\Windows\System\DFxCECM.exe
  2⤵
  PID:12392
- C:\Windows\System\GzXmScB.exe
  C:\Windows\System\GzXmScB.exe
  2⤵
  PID:12412
- C:\Windows\System\HrdELgk.exe
  C:\Windows\System\HrdELgk.exe
  2⤵
  PID:12448
- C:\Windows\System\wfVrJHI.exe
  C:\Windows\System\wfVrJHI.exe
  2⤵
  PID:12496
- C:\Windows\System\XJVsMUm.exe
  C:\Windows\System\XJVsMUm.exe
  2⤵
  PID:12520
- C:\Windows\System\QbycoKS.exe
  C:\Windows\System\QbycoKS.exe
  2⤵
  PID:12540
- C:\Windows\System\WIMvgsb.exe
  C:\Windows\System\WIMvgsb.exe
  2⤵
  PID:12568
- C:\Windows\System\utkmNfk.exe
  C:\Windows\System\utkmNfk.exe
  2⤵
  PID:12584
- C:\Windows\System\vAwVeZi.exe
  C:\Windows\System\vAwVeZi.exe
  2⤵
  PID:12608
- C:\Windows\System\zfhSvuo.exe
  C:\Windows\System\zfhSvuo.exe
  2⤵
  PID:12628
- C:\Windows\System\Srvpsun.exe
  C:\Windows\System\Srvpsun.exe
  2⤵
  PID:12660
- C:\Windows\System\AgvitFG.exe
  C:\Windows\System\AgvitFG.exe
  2⤵
  PID:12700
- C:\Windows\System\qEghYwl.exe
  C:\Windows\System\qEghYwl.exe
  2⤵
  PID:12736
- C:\Windows\System\yJCLarr.exe
  C:\Windows\System\yJCLarr.exe
  2⤵
  PID:12764
- C:\Windows\System\Lcqpygz.exe
  C:\Windows\System\Lcqpygz.exe
  2⤵
  PID:12788
- C:\Windows\System\imDCDlh.exe
  C:\Windows\System\imDCDlh.exe
  2⤵
  PID:12808
- C:\Windows\System\msscyUz.exe
  C:\Windows\System\msscyUz.exe
  2⤵
  PID:12832
- C:\Windows\System\BsbsCbY.exe
  C:\Windows\System\BsbsCbY.exe
  2⤵
  PID:12860
- C:\Windows\System\nNDEJrx.exe
  C:\Windows\System\nNDEJrx.exe
  2⤵
  PID:12888
- C:\Windows\System\DBZTpiX.exe
  C:\Windows\System\DBZTpiX.exe
  2⤵
  PID:12908
- C:\Windows\System\jFihcOm.exe
  C:\Windows\System\jFihcOm.exe
  2⤵
  PID:12932
- C:\Windows\System\XSNjHDl.exe
  C:\Windows\System\XSNjHDl.exe
  2⤵
  PID:12948
- C:\Windows\System\GZrhSwf.exe
  C:\Windows\System\GZrhSwf.exe
  2⤵
  PID:12976
- C:\Windows\System\kdRVVln.exe
  C:\Windows\System\kdRVVln.exe
  2⤵
  PID:13008
- C:\Windows\System\NZZsdGQ.exe
  C:\Windows\System\NZZsdGQ.exe
  2⤵
  PID:13032
- C:\Windows\System\KsYWWLN.exe
  C:\Windows\System\KsYWWLN.exe
  2⤵
  PID:13060
- C:\Windows\System\PjWdpeo.exe
  C:\Windows\System\PjWdpeo.exe
  2⤵
  PID:13120
- C:\Windows\System\NaPVktG.exe
  C:\Windows\System\NaPVktG.exe
  2⤵
  PID:13156
- C:\Windows\System\HLcyFGA.exe
  C:\Windows\System\HLcyFGA.exe
  2⤵
  PID:13176
- C:\Windows\System\GAIcrgE.exe
  C:\Windows\System\GAIcrgE.exe
  2⤵
  PID:13208
- C:\Windows\System\ThmKWTb.exe
  C:\Windows\System\ThmKWTb.exe
  2⤵
  PID:13236
- C:\Windows\System\pseoZDE.exe
  C:\Windows\System\pseoZDE.exe
  2⤵
  PID:13256
- C:\Windows\System\gDAtAqk.exe
  C:\Windows\System\gDAtAqk.exe
  2⤵
  PID:13304
- C:\Windows\System\QtfHlIr.exe
  C:\Windows\System\QtfHlIr.exe
  2⤵
  PID:12300
- C:\Windows\System\vhXVJGA.exe
  C:\Windows\System\vhXVJGA.exe
  2⤵
  PID:12364
- C:\Windows\System\DfZiQVL.exe
  C:\Windows\System\DfZiQVL.exe
  2⤵
  PID:12404
- C:\Windows\System\HwQHaBe.exe
  C:\Windows\System\HwQHaBe.exe
  2⤵
  PID:12464
- C:\Windows\System\MxMSYsy.exe
  C:\Windows\System\MxMSYsy.exe
  2⤵
  PID:12516
- C:\Windows\System\uScmbYa.exe
  C:\Windows\System\uScmbYa.exe
  2⤵
  PID:12580
- C:\Windows\System\fSIlnaX.exe
  C:\Windows\System\fSIlnaX.exe
  2⤵
  PID:12692
- C:\Windows\System\IpWBFvV.exe
  C:\Windows\System\IpWBFvV.exe
  2⤵
  PID:12752
- C:\Windows\System\DGeBMHw.exe
  C:\Windows\System\DGeBMHw.exe
  2⤵
  PID:12824
- C:\Windows\System\wJVIEws.exe
  C:\Windows\System\wJVIEws.exe
  2⤵
  PID:12852
- C:\Windows\System\QYUJERN.exe
  C:\Windows\System\QYUJERN.exe
  2⤵
  PID:12960
- C:\Windows\System\hKsTtRA.exe
  C:\Windows\System\hKsTtRA.exe
  2⤵
  PID:13024
- C:\Windows\System\tPSgzSx.exe
  C:\Windows\System\tPSgzSx.exe
  2⤵
  PID:13048
- C:\Windows\System\RCaTcVo.exe
  C:\Windows\System\RCaTcVo.exe
  2⤵
  PID:13112
- C:\Windows\System\MPNEWRX.exe
  C:\Windows\System\MPNEWRX.exe
  2⤵
  PID:13232
- C:\Windows\System\tDmDxsl.exe
  C:\Windows\System\tDmDxsl.exe
  2⤵
  PID:13300
- C:\Windows\System\EJbdGds.exe
  C:\Windows\System\EJbdGds.exe
  2⤵
  PID:12324
- C:\Windows\System\ghybvlA.exe
  C:\Windows\System\ghybvlA.exe
  2⤵
  PID:12488
- C:\Windows\System\FNpsrDg.exe
  C:\Windows\System\FNpsrDg.exe
  2⤵
  PID:12640
- C:\Windows\System\RxNqoUk.exe
  C:\Windows\System\RxNqoUk.exe
  2⤵
  PID:12756
- C:\Windows\System\Edisshu.exe
  C:\Windows\System\Edisshu.exe
  2⤵
  PID:12880
- C:\Windows\System\eFReIxx.exe
  C:\Windows\System\eFReIxx.exe
  2⤵
  PID:12968
- C:\Windows\System\sMbNlmi.exe
  C:\Windows\System\sMbNlmi.exe
  2⤵
  PID:13268
- C:\Windows\System\jAxRVZU.exe
  C:\Windows\System\jAxRVZU.exe
  2⤵
  PID:12116
- C:\Windows\System\BCAhune.exe
  C:\Windows\System\BCAhune.exe
  2⤵
  PID:12784
- C:\Windows\System\gyaysrN.exe
  C:\Windows\System\gyaysrN.exe
  2⤵
  PID:13080
- C:\Windows\System\lBljvvu.exe
  C:\Windows\System\lBljvvu.exe
  2⤵
  PID:13224
- C:\Windows\System\UpBcItm.exe
  C:\Windows\System\UpBcItm.exe
  2⤵
  PID:13336
- C:\Windows\System\aZgTyWz.exe
  C:\Windows\System\aZgTyWz.exe
  2⤵
  PID:13356
- C:\Windows\System\jzOaiLb.exe
  C:\Windows\System\jzOaiLb.exe
  2⤵
  PID:13380
- C:\Windows\System\StRTbzj.exe
  C:\Windows\System\StRTbzj.exe
  2⤵
  PID:13412
- C:\Windows\System\yovWazK.exe
  C:\Windows\System\yovWazK.exe
  2⤵
  PID:13432
- C:\Windows\System\RtYQWxi.exe
  C:\Windows\System\RtYQWxi.exe
  2⤵
  PID:13460
- C:\Windows\System\IBSpIjR.exe
  C:\Windows\System\IBSpIjR.exe
  2⤵
  PID:13484
- C:\Windows\System\JewxQUW.exe
  C:\Windows\System\JewxQUW.exe
  2⤵
  PID:13520
- C:\Windows\System\PedjkUg.exe
  C:\Windows\System\PedjkUg.exe
  2⤵
  PID:13548
- C:\Windows\System\rqRcXDh.exe
  C:\Windows\System\rqRcXDh.exe
  2⤵
  PID:13568
- C:\Windows\System\wTFTLhe.exe
  C:\Windows\System\wTFTLhe.exe
  2⤵
  PID:13612
- C:\Windows\System\tTcUGBG.exe
  C:\Windows\System\tTcUGBG.exe
  2⤵
  PID:13636
- C:\Windows\System\zcWYyDv.exe
  C:\Windows\System\zcWYyDv.exe
  2⤵
  PID:13676
- C:\Windows\System\ZQaVAdc.exe
  C:\Windows\System\ZQaVAdc.exe
  2⤵
  PID:13692
- C:\Windows\System\rIOpdIc.exe
  C:\Windows\System\rIOpdIc.exe
  2⤵
  PID:13708
- C:\Windows\System\HOPgzoo.exe
  C:\Windows\System\HOPgzoo.exe
  2⤵
  PID:13732
- C:\Windows\System\IxsavkO.exe
  C:\Windows\System\IxsavkO.exe
  2⤵
  PID:13768
- C:\Windows\System\IgLSJzn.exe
  C:\Windows\System\IgLSJzn.exe
  2⤵
  PID:13800
- C:\Windows\System\OndmXQx.exe
  C:\Windows\System\OndmXQx.exe
  2⤵
  PID:13832
- C:\Windows\System\GpdohfQ.exe
  C:\Windows\System\GpdohfQ.exe
  2⤵
  PID:13872
- C:\Windows\System\noDPvpf.exe
  C:\Windows\System\noDPvpf.exe
  2⤵
  PID:13888
- C:\Windows\System\bmCLOeY.exe
  C:\Windows\System\bmCLOeY.exe
  2⤵
  PID:13912
- C:\Windows\System\sbzUuta.exe
  C:\Windows\System\sbzUuta.exe
  2⤵
  PID:13936
- C:\Windows\System\smSpsno.exe
  C:\Windows\System\smSpsno.exe
  2⤵
  PID:13972
- C:\Windows\System\rmVaRRw.exe
  C:\Windows\System\rmVaRRw.exe
  2⤵
  PID:14000
- C:\Windows\System\iMPwcJk.exe
  C:\Windows\System\iMPwcJk.exe
  2⤵
  PID:14036
- C:\Windows\System\RrZytDq.exe
  C:\Windows\System\RrZytDq.exe
  2⤵
  PID:14052
- C:\Windows\System\TjLNJuE.exe
  C:\Windows\System\TjLNJuE.exe
  2⤵
  PID:14084
- C:\Windows\System\ZLlbVEQ.exe
  C:\Windows\System\ZLlbVEQ.exe
  2⤵
  PID:14124
- C:\Windows\System\MKInitw.exe
  C:\Windows\System\MKInitw.exe
  2⤵
  PID:14148
- C:\Windows\System\vrAayFQ.exe
  C:\Windows\System\vrAayFQ.exe
  2⤵
  PID:14172
- C:\Windows\System\ekVCoHK.exe
  C:\Windows\System\ekVCoHK.exe
  2⤵
  PID:14196
- C:\Windows\System\KFXqtRa.exe
  C:\Windows\System\KFXqtRa.exe
  2⤵
  PID:14216
- C:\Windows\System\lmGZjuw.exe
  C:\Windows\System\lmGZjuw.exe
  2⤵
  PID:14236
- C:\Windows\System\lJLCKzd.exe
  C:\Windows\System\lJLCKzd.exe
  2⤵
  PID:14280
- C:\Windows\System\YZeWrTK.exe
  C:\Windows\System\YZeWrTK.exe
  2⤵
  PID:14308
- C:\Windows\System\iFbpqsp.exe
  C:\Windows\System\iFbpqsp.exe
  2⤵
  PID:12648
- C:\Windows\System\DUyuiDO.exe
  C:\Windows\System\DUyuiDO.exe
  2⤵
  PID:13392
- C:\Windows\System\yKJNYxO.exe
  C:\Windows\System\yKJNYxO.exe
  2⤵
  PID:13420
- C:\Windows\System\lcPmVFJ.exe
  C:\Windows\System\lcPmVFJ.exe
  2⤵
  PID:13536
- C:\Windows\System\dTsYJZt.exe
  C:\Windows\System\dTsYJZt.exe
  2⤵
  PID:13528
- C:\Windows\System\hBwNrJP.exe
  C:\Windows\System\hBwNrJP.exe
  2⤵
  PID:13596
- C:\Windows\System\nILOxlf.exe
  C:\Windows\System\nILOxlf.exe
  2⤵
  PID:13684
- C:\Windows\System\kqPqCYC.exe
  C:\Windows\System\kqPqCYC.exe
  2⤵
  PID:13796
- C:\Windows\System\RngFWny.exe
  C:\Windows\System\RngFWny.exe
  2⤵
  PID:13756
- C:\Windows\System\XioLXGZ.exe
  C:\Windows\System\XioLXGZ.exe
  2⤵
  PID:13868
- C:\Windows\System\xXOISoQ.exe
  C:\Windows\System\xXOISoQ.exe
  2⤵
  PID:13956
- C:\Windows\System\yRKGWIB.exe
  C:\Windows\System\yRKGWIB.exe
  2⤵
  PID:13996
- C:\Windows\System\PciBlpQ.exe
  C:\Windows\System\PciBlpQ.exe
  2⤵
  PID:14064
- C:\Windows\System\ncTlcUN.exe
  C:\Windows\System\ncTlcUN.exe
  2⤵
  PID:14112
- C:\Windows\System\FuMCOcv.exe
  C:\Windows\System\FuMCOcv.exe
  2⤵
  PID:14204
- C:\Windows\System\omdWxVK.exe
  C:\Windows\System\omdWxVK.exe
  2⤵
  PID:14276
- C:\Windows\System\hmDGqas.exe
  C:\Windows\System\hmDGqas.exe
  2⤵
  PID:13388
- C:\Windows\System\SPExTGL.exe
  C:\Windows\System\SPExTGL.exe
  2⤵
  PID:13444
- C:\Windows\System\KpvWnni.exe
  C:\Windows\System\KpvWnni.exe
  2⤵
  PID:13620
- C:\Windows\System\CceZILG.exe
  C:\Windows\System\CceZILG.exe
  2⤵
  PID:13704
- C:\Windows\System\ihkxvag.exe
  C:\Windows\System\ihkxvag.exe
  2⤵
  PID:13896
- C:\Windows\System\qjpddov.exe
  C:\Windows\System\qjpddov.exe
  2⤵
  PID:13960
- C:\Windows\System\jCjLTge.exe
  C:\Windows\System\jCjLTge.exe
  2⤵
  PID:14208
- C:\Windows\System\ddmcRPN.exe
  C:\Windows\System\ddmcRPN.exe
  2⤵
  PID:13452
- C:\Windows\System\ngJeqpp.exe
  C:\Windows\System\ngJeqpp.exe
  2⤵
  PID:13584
- C:\Windows\System\VrlKVAH.exe
  C:\Windows\System\VrlKVAH.exe
  2⤵
  PID:13992
- C:\Windows\System\gXmbBAc.exe
  C:\Windows\System\gXmbBAc.exe
  2⤵
  PID:13332
- C:\Windows\System\lTxDTNo.exe
  C:\Windows\System\lTxDTNo.exe
  2⤵
  PID:14352
- C:\Windows\System\PoXiNef.exe
  C:\Windows\System\PoXiNef.exe
  2⤵
  PID:14376
- C:\Windows\System\uhtvwuU.exe
  C:\Windows\System\uhtvwuU.exe
  2⤵
  PID:14404
- C:\Windows\System\alDZIKZ.exe
  C:\Windows\System\alDZIKZ.exe
  2⤵
  PID:14424
- C:\Windows\System\lMYOBkE.exe
  C:\Windows\System\lMYOBkE.exe
  2⤵
  PID:14460
- C:\Windows\System\fKTWcmd.exe
  C:\Windows\System\fKTWcmd.exe
  2⤵
  PID:14492
- C:\Windows\System\jmlctud.exe
  C:\Windows\System\jmlctud.exe
  2⤵
  PID:14544
- C:\Windows\System\JscwGOs.exe
  C:\Windows\System\JscwGOs.exe
  2⤵
  PID:14560
- C:\Windows\System\MRGXXjN.exe
  C:\Windows\System\MRGXXjN.exe
  2⤵
  PID:14600
- C:\Windows\System\KklDSft.exe
  C:\Windows\System\KklDSft.exe
  2⤵
  PID:14628
- C:\Windows\System\fNWDntU.exe
  C:\Windows\System\fNWDntU.exe
  2⤵
  PID:14644
- C:\Windows\System\jxWnpUJ.exe
  C:\Windows\System\jxWnpUJ.exe
  2⤵
  PID:14672
- C:\Windows\System\ovjzwDf.exe
  C:\Windows\System\ovjzwDf.exe
  2⤵
  PID:14692
- C:\Windows\System\VPPOxqU.exe
  C:\Windows\System\VPPOxqU.exe
  2⤵
  PID:14728
- C:\Windows\System\DjEeRwe.exe
  C:\Windows\System\DjEeRwe.exe
  2⤵
  PID:14744
- C:\Windows\System\oCeuHlb.exe
  C:\Windows\System\oCeuHlb.exe
  2⤵
  PID:14796
- C:\Windows\System\IeHJIMm.exe
  C:\Windows\System\IeHJIMm.exe
  2⤵
  PID:14824
- C:\Windows\System\TfUeMuR.exe
  C:\Windows\System\TfUeMuR.exe
  2⤵
  PID:14844
- C:\Windows\System\ryrGTfL.exe
  C:\Windows\System\ryrGTfL.exe
  2⤵
  PID:14868
- C:\Windows\System\TEejipM.exe
  C:\Windows\System\TEejipM.exe
  2⤵
  PID:14896
- C:\Windows\System\qcorZxa.exe
  C:\Windows\System\qcorZxa.exe
  2⤵
  PID:14916
- C:\Windows\System\irBygLY.exe
  C:\Windows\System\irBygLY.exe
  2⤵
  PID:14948
- C:\Windows\System\whNdklC.exe
  C:\Windows\System\whNdklC.exe
  2⤵
  PID:14976
- C:\Windows\System\EGUZYCE.exe
  C:\Windows\System\EGUZYCE.exe
  2⤵
  PID:15016
- C:\Windows\System\LKbrzaO.exe
  C:\Windows\System\LKbrzaO.exe
  2⤵
  PID:15036
- C:\Windows\System\jZUlLvM.exe
  C:\Windows\System\jZUlLvM.exe
  2⤵
  PID:15056
- C:\Windows\System\DCYcUoM.exe
  C:\Windows\System\DCYcUoM.exe
  2⤵
  PID:15076
- C:\Windows\System\sEMncuO.exe
  C:\Windows\System\sEMncuO.exe
  2⤵
  PID:15096
- C:\Windows\System\aauIIOp.exe
  C:\Windows\System\aauIIOp.exe
  2⤵
  PID:15128
- C:\Windows\System\asJhIYV.exe
  C:\Windows\System\asJhIYV.exe
  2⤵
  PID:15168
- C:\Windows\System\ilarFzW.exe
  C:\Windows\System\ilarFzW.exe
  2⤵
  PID:15196
- C:\Windows\System\HJBlggN.exe
  C:\Windows\System\HJBlggN.exe
  2⤵
  PID:15220
- C:\Windows\System\StauIyD.exe
  C:\Windows\System\StauIyD.exe
  2⤵
  PID:15252
- C:\Windows\System\llwdzfa.exe
  C:\Windows\System\llwdzfa.exe
  2⤵
  PID:15280
- C:\Windows\System\KwyvEBu.exe
  C:\Windows\System\KwyvEBu.exe
  2⤵
  PID:15296
- C:\Windows\System\CBHjCgL.exe
  C:\Windows\System\CBHjCgL.exe
  2⤵
  PID:15324
- C:\Windows\System\fMXjJuj.exe
  C:\Windows\System\fMXjJuj.exe
  2⤵
  PID:13480
- C:\Windows\System\ZvwdYTW.exe
  C:\Windows\System\ZvwdYTW.exe
  2⤵
  PID:14348
- C:\Windows\System\lJViNuR.exe
  C:\Windows\System\lJViNuR.exe
  2⤵
  PID:14416
- C:\Windows\System\YXbTJDP.exe
  C:\Windows\System\YXbTJDP.exe
  2⤵
  PID:14444
- C:\Windows\System\wssOKGI.exe
  C:\Windows\System\wssOKGI.exe
  2⤵
  PID:14584
- C:\Windows\System\yIgbSTX.exe
  C:\Windows\System\yIgbSTX.exe
  2⤵
  PID:14636
- C:\Windows\System\cnbZSQR.exe
  C:\Windows\System\cnbZSQR.exe
  2⤵
  PID:14712
- C:\Windows\System\xSxKnYl.exe
  C:\Windows\System\xSxKnYl.exe
  2⤵
  PID:14736
- C:\Windows\System\oIwtTdc.exe
  C:\Windows\System\oIwtTdc.exe
  2⤵
  PID:14816
- C:\Windows\System\jAICXFk.exe
  C:\Windows\System\jAICXFk.exe
  2⤵
  PID:14852
- C:\Windows\System\OjeLfgF.exe
  C:\Windows\System\OjeLfgF.exe
  2⤵
  PID:14972
- C:\Windows\System\aywCZCG.exe
  C:\Windows\System\aywCZCG.exe
  2⤵
  PID:15052
- C:\Windows\System\qhuQToK.exe
  C:\Windows\System\qhuQToK.exe
  2⤵
  PID:15104
- C:\Windows\System\lSFxTJq.exe
  C:\Windows\System\lSFxTJq.exe
  2⤵
  PID:15164
- C:\Windows\System\LjmXULO.exe
  C:\Windows\System\LjmXULO.exe
  2⤵
  PID:15208
- C:\Windows\System\OSgFkYu.exe
  C:\Windows\System\OSgFkYu.exe
  2⤵
  PID:15240
- C:\Windows\System\kHiClnH.exe
  C:\Windows\System\kHiClnH.exe
  2⤵
  PID:15352
- C:\Windows\System\vJSCLEb.exe
  C:\Windows\System\vJSCLEb.exe
  2⤵
  PID:14080
- C:\Windows\System\Lnazhqs.exe
  C:\Windows\System\Lnazhqs.exe
  2⤵
  PID:14620
- C:\Windows\System\drEWQki.exe
  C:\Windows\System\drEWQki.exe
  2⤵
  PID:14764
- C:\Windows\System\FZaBVUc.exe
  C:\Windows\System\FZaBVUc.exe
  2⤵
  PID:14928
- C:\Windows\System\EKYPMQl.exe
  C:\Windows\System\EKYPMQl.exe
  2⤵
  PID:15000
- C:\Windows\System\VoEtFQB.exe
  C:\Windows\System\VoEtFQB.exe
  2⤵
  PID:15184
- C:\Windows\System\mbcgWBg.exe
  C:\Windows\System\mbcgWBg.exe
  2⤵
  PID:15216
- C:\Windows\System\pDFhmnr.exe
  C:\Windows\System\pDFhmnr.exe
  2⤵
  PID:13700
- C:\Windows\System\RWgqXrd.exe
  C:\Windows\System\RWgqXrd.exe
  2⤵
  PID:14720
- C:\Windows\System\EkDsaRq.exe
  C:\Windows\System\EkDsaRq.exe
  2⤵
  PID:14956
- C:\Windows\System\IVGLoxt.exe
  C:\Windows\System\IVGLoxt.exe
  2⤵
  PID:14516
- C:\Windows\System\EITXPZP.exe
  C:\Windows\System\EITXPZP.exe
  2⤵
  PID:15376
- C:\Windows\System\SouhgJu.exe
  C:\Windows\System\SouhgJu.exe
  2⤵
  PID:15412
- C:\Windows\System\zIpvKjq.exe
  C:\Windows\System\zIpvKjq.exe
  2⤵
  PID:15436
- C:\Windows\System\TWyUyyj.exe
  C:\Windows\System\TWyUyyj.exe
  2⤵
  PID:15464
- C:\Windows\System\bDDIolY.exe
  C:\Windows\System\bDDIolY.exe
  2⤵
  PID:15500
- C:\Windows\System\Rzqixis.exe
  C:\Windows\System\Rzqixis.exe
  2⤵
  PID:15520
- C:\Windows\System\tfnypqf.exe
  C:\Windows\System\tfnypqf.exe
  2⤵
  PID:15540
- C:\Windows\System\xQaRiHm.exe
  C:\Windows\System\xQaRiHm.exe
  2⤵
  PID:15572
- C:\Windows\System\ZHudeKw.exe
  C:\Windows\System\ZHudeKw.exe
  2⤵
  PID:15604
- C:\Windows\System\pXuVduc.exe
  C:\Windows\System\pXuVduc.exe
  2⤵
  PID:15620
- C:\Windows\System\xPCTVMY.exe
  C:\Windows\System\xPCTVMY.exe
  2⤵
  PID:15636
- C:\Windows\System\wSgUnzt.exe
  C:\Windows\System\wSgUnzt.exe
  2⤵
  PID:15676
- C:\Windows\System\mPMtLvq.exe
  C:\Windows\System\mPMtLvq.exe
  2⤵
  PID:15716
- C:\Windows\System\gOeJkuW.exe
  C:\Windows\System\gOeJkuW.exe
  2⤵
  PID:15740
- C:\Windows\System\MGriRxP.exe
  C:\Windows\System\MGriRxP.exe
  2⤵
  PID:15796
- C:\Windows\System\UFexMiR.exe
  C:\Windows\System\UFexMiR.exe
  2⤵
  PID:15812
- C:\Windows\System\byxzRth.exe
  C:\Windows\System\byxzRth.exe
  2⤵
  PID:15852
- C:\Windows\System\sKNDGvn.exe
  C:\Windows\System\sKNDGvn.exe
  2⤵
  PID:15880
- C:\Windows\System\gvBGxVs.exe
  C:\Windows\System\gvBGxVs.exe
  2⤵
  PID:15908
- C:\Windows\System\KpyIqPo.exe
  C:\Windows\System\KpyIqPo.exe
  2⤵
  PID:15924
- C:\Windows\System\KlDAylT.exe
  C:\Windows\System\KlDAylT.exe
  2⤵
  PID:15956
- C:\Windows\System\HxFhteR.exe
  C:\Windows\System\HxFhteR.exe
  2⤵
  PID:15980
- C:\Windows\System\dOlMXru.exe
  C:\Windows\System\dOlMXru.exe
  2⤵
  PID:16020
- C:\Windows\System\QPOUwDa.exe
  C:\Windows\System\QPOUwDa.exe
  2⤵
  PID:16044
- C:\Windows\System\jWSpRaU.exe
  C:\Windows\System\jWSpRaU.exe
  2⤵
  PID:16064
- C:\Windows\System\OQwOnAr.exe
  C:\Windows\System\OQwOnAr.exe
  2⤵
  PID:16092
- C:\Windows\System\tDsFvls.exe
  C:\Windows\System\tDsFvls.exe
  2⤵
  PID:16120
- C:\Windows\System\Wkvxfvq.exe
  C:\Windows\System\Wkvxfvq.exe
  2⤵
  PID:16144
- C:\Windows\System\sLiIkmI.exe
  C:\Windows\System\sLiIkmI.exe
  2⤵
  PID:16176
- C:\Windows\System\NUzULYa.exe
  C:\Windows\System\NUzULYa.exe
  2⤵
  PID:16192
- C:\Windows\System\bxclkzf.exe
  C:\Windows\System\bxclkzf.exe
  2⤵
  PID:16232
- C:\Windows\System\aYgqrSW.exe
  C:\Windows\System\aYgqrSW.exe
  2⤵
  PID:16248
- C:\Windows\System\HuCPoOw.exe
  C:\Windows\System\HuCPoOw.exe
  2⤵
  PID:16300
- C:\Windows\System\YRluDAk.exe
  C:\Windows\System\YRluDAk.exe
  2⤵
  PID:16328
- C:\Windows\System\MtyZoVs.exe
  C:\Windows\System\MtyZoVs.exe
  2⤵
  PID:16356
- C:\Windows\System\sYOYpfp.exe
  C:\Windows\System\sYOYpfp.exe
  2⤵
  PID:16372
- C:\Windows\System\FIUiysO.exe
  C:\Windows\System\FIUiysO.exe
  2⤵
  PID:15372
- C:\Windows\System\iIECpDD.exe
  C:\Windows\System\iIECpDD.exe
  2⤵
  PID:15400
- C:\Windows\System\zflBufG.exe
  C:\Windows\System\zflBufG.exe
  2⤵
  PID:15444
- C:\Windows\System\OquTjsC.exe
  C:\Windows\System\OquTjsC.exe
  2⤵
  PID:15508
- C:\Windows\System\SQAirEs.exe
  C:\Windows\System\SQAirEs.exe
  2⤵
  PID:15528
- C:\Windows\System\TyFBYVA.exe
  C:\Windows\System\TyFBYVA.exe
  2⤵
  PID:15616
- C:\Windows\System\dUooRcb.exe
  C:\Windows\System\dUooRcb.exe
  2⤵
  PID:15728
- C:\Windows\System\tPZPUIf.exe
  C:\Windows\System\tPZPUIf.exe
  2⤵
  PID:15804
- C:\Windows\System\ljYaBRx.exe
  C:\Windows\System\ljYaBRx.exe
  2⤵
  PID:15872
- C:\Windows\System\LsmWQPO.exe
  C:\Windows\System\LsmWQPO.exe
  2⤵
  PID:15916
- C:\Windows\System\ZtFexFr.exe
  C:\Windows\System\ZtFexFr.exe
  2⤵
  PID:15976
- C:\Windows\System\qarbiMb.exe
  C:\Windows\System\qarbiMb.exe
  2⤵
  PID:16032
- C:\Windows\System\rZGxLBr.exe
  C:\Windows\System\rZGxLBr.exe
  2⤵
  PID:16084
- C:\Windows\System\XawTuwY.exe
  C:\Windows\System\XawTuwY.exe
  2⤵
  PID:16184
- C:\Windows\System\NGshIHn.exe
  C:\Windows\System\NGshIHn.exe
  2⤵
  PID:16260
- C:\Windows\System\GQbAdkS.exe
  C:\Windows\System\GQbAdkS.exe
  2⤵
  PID:16324
- C:\Windows\System\gAcdTJb.exe
  C:\Windows\System\gAcdTJb.exe
  2⤵
  PID:14992
- C:\Windows\System\jarRHAy.exe
  C:\Windows\System\jarRHAy.exe
  2⤵
  PID:15420
- C:\Windows\System\kEIgRqo.exe
  C:\Windows\System\kEIgRqo.exe
  2⤵
  PID:15696
- C:\Windows\System\PuGQvUZ.exe
  C:\Windows\System\PuGQvUZ.exe
  2⤵
  PID:15760
- C:\Windows\System\mfQFteD.exe
  C:\Windows\System\mfQFteD.exe
  2⤵
  PID:15936
- C:\Windows\System\QUwfnZB.exe
  C:\Windows\System\QUwfnZB.exe
  2⤵
  PID:16056
- C:\Windows\System\vxNawNA.exe
  C:\Windows\System\vxNawNA.exe
  2⤵
  PID:16364
- C:\Windows\System\KXIBEqj.exe
  C:\Windows\System\KXIBEqj.exe
  2⤵
  PID:16348
- C:\Windows\System\VGJFpaH.exe
  C:\Windows\System\VGJFpaH.exe
  2⤵
  PID:15704
- C:\Windows\System\xEtLjKb.exe
  C:\Windows\System\xEtLjKb.exe
  2⤵
  PID:16016
- C:\Windows\System\fWVBIhQ.exe
  C:\Windows\System\fWVBIhQ.exe
  2⤵
  PID:15568
- C:\Windows\System\XEzhgwR.exe
  C:\Windows\System\XEzhgwR.exe
  2⤵
  PID:16296
- C:\Windows\System\bgQUrFO.exe
  C:\Windows\System\bgQUrFO.exe
  2⤵
  PID:16392
- C:\Windows\System\wxGftIs.exe
  C:\Windows\System\wxGftIs.exe
  2⤵
  PID:16408
- C:\Windows\System\besGANQ.exe
  C:\Windows\System\besGANQ.exe
  2⤵
  PID:16468
- C:\Windows\System\SWkTjXW.exe
  C:\Windows\System\SWkTjXW.exe
  2⤵
  PID:16488
- C:\Windows\System\KYjNKkG.exe
  C:\Windows\System\KYjNKkG.exe
  2⤵
  PID:16516
- C:\Windows\System\VUnbHDY.exe
  C:\Windows\System\VUnbHDY.exe
  2⤵
  PID:16536
- C:\Windows\System\XldGixT.exe
  C:\Windows\System\XldGixT.exe
  2⤵
  PID:16564
- C:\Windows\System\ptNsHAS.exe
  C:\Windows\System\ptNsHAS.exe
  2⤵
  PID:16584
- C:\Windows\System\XMVcgPA.exe
  C:\Windows\System\XMVcgPA.exe
  2⤵
  PID:16608
- C:\Windows\System\gQXKGXS.exe
  C:\Windows\System\gQXKGXS.exe
  2⤵
  PID:16660
- C:\Windows\System\VwJaYQN.exe
  C:\Windows\System\VwJaYQN.exe
  2⤵
  PID:16676
- C:\Windows\System\bfKsoYK.exe
  C:\Windows\System\bfKsoYK.exe
  2⤵
  PID:16692
- C:\Windows\System\IwtyozN.exe
  C:\Windows\System\IwtyozN.exe
  2⤵
  PID:16728
- C:\Windows\System\ljwDaot.exe
  C:\Windows\System\ljwDaot.exe
  2⤵
  PID:16748
- C:\Windows\System\tXqvCWG.exe
  C:\Windows\System\tXqvCWG.exe
  2⤵
  PID:16792
- C:\Windows\System\oGrntZi.exe
  C:\Windows\System\oGrntZi.exe
  2⤵
  PID:16816
- C:\Windows\System\bBJIebt.exe
  C:\Windows\System\bBJIebt.exe
  2⤵
  PID:16848
- C:\Windows\System\iWLfSAk.exe
  C:\Windows\System\iWLfSAk.exe
  2⤵
  PID:16868
- C:\Windows\System\TzXOzfy.exe
  C:\Windows\System\TzXOzfy.exe
  2⤵
  PID:16888
- C:\Windows\System\StgdFzI.exe
  C:\Windows\System\StgdFzI.exe
  2⤵
  PID:16912
- C:\Windows\System\hTvQkoC.exe
  C:\Windows\System\hTvQkoC.exe
  2⤵
  PID:16956

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:16388

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\BBqySWX.exe

Filesize
1.3MB

MD5
ac98a0586a66787ed19e9d28c303ed62

SHA1
247ee9faa0209df1d22ba6f70fc1a50ab7831149

SHA256
a96ba95be6227a95e0ef96514356bc5cd16789d2acf517821922d3813c617740

SHA512
b4b69edc7eb9dfb897503bea9d62e2416b277af8d25ad86adc5eaa31c1e8db9e0210c1039744e281d43e05bb8fa27b088120807ccfff5006e1367cec20844bd2

Download Submit
C:\Windows\System\CjNLIvK.exe

Filesize
1.3MB

MD5
a21985951d4d043efdd49547331b99b7

SHA1
72ef82612e548e78f97dabea71b7ba23344fbff6

SHA256
0afe6af25a3208c6f9e009c6981efb2ee2927a88884e273b9ec8e0d81c506802

SHA512
45b550cb6f68e67578903e96976c2673d6396fcc5c36999b75558a17b83f7d5a5a70842095be4301e9e2f619a432c781c0c0ce744f229c75e8bf6bc3ceafd1e4

Download Submit
C:\Windows\System\DKbbDpO.exe

Filesize
1.3MB

MD5
5d4ead7bfc75f09d52b2652069e66902

SHA1
49494f12c64aca21c94470ddcdba2594822d2023

SHA256
67299f276890e85a69faa4971ab2d2b23bf8740119678a827aa0a769324dc358

SHA512
b733b4bc78a716fb0663b2bd63e6d40de91ffaadf96740833f0449c2d15dafe3d03439c82dc4c37fd1d6a29d49ef98618d2ab51ffe74298a3960be230153402d

Download Submit
C:\Windows\System\EwGeDFt.exe

Filesize
1.4MB

MD5
7f324d9c564ca4fd474da69988faa980

SHA1
66e72789a4ccedf7de4b2951e486f4831fb1e20d

SHA256
325f690533f6fd7c98bdaeda85577dd99c1d323c354e086c450a283a534799cf

SHA512
1c05001625a483ed17a1f7e57c046a8add89c3dfe149845130db477405e4f5194ff752596c2a762839caa3b085e243a8ffe1f9490c2a7ece80b3acf148863004

Download Submit
C:\Windows\System\HhVQQCL.exe

Filesize
1.3MB

MD5
1418e096507ef04064005b78022ca934

SHA1
c64532c920af20719b6f95a3d7a5e94686cb67c3

SHA256
467486276bf0a9ce03c6a9337468afe2831207bd27abfb71aa5a6c9df25c6870

SHA512
3d39ccc715e03239c7cb21f6207ed352cab1840bb05a1561f05df2119fcb29049bd87911846d172b475a56778246552e7e65978add7470e208544ae31964088d

Download Submit
C:\Windows\System\IaOtRtg.exe

Filesize
1.4MB

MD5
8a66b05784910f9ebd49c1ea3a336846

SHA1
4c27b8a135a87e306d2ecbf0c6806febb696136e

SHA256
e06a6100e078ff88919000c59ee110a7ce0db27672aea62d6dabed51b00161f9

SHA512
e2b09fb2730068b9cbd4ce76864a0c17a1a2c528f454830da1d34c3ee1090b25750d6ef3bbc926a75eb02c4a4f106af99c8afb5bf40a7f8e3e1ebf313c642f47

Download Submit
C:\Windows\System\IvhaEKz.exe

Filesize
1.4MB

MD5
3627db3375aa634b86c81463f5ba0bc1

SHA1
46f389f820354914a2969397ec2904f4b8c880a6

SHA256
ec83714948f4c4845eee5b703b9e4ff51604bcb4220c0743bc6ed36411d023e0

SHA512
121767c53203e203a2d437c3c785979cfa45f2accd4ec9104499678232c79fd1a4918fc9e1ed45ab1a6b6a9c2feac14cb188a996503a49d86af605bad6f4caeb

Download Submit
C:\Windows\System\JjZjeij.exe

Filesize
1.4MB

MD5
432b3aa274ee49e77c5e133734b3ba4b

SHA1
6b99c30f9f22331a7d2e9d089fc77f856f6071cd

SHA256
09e76d4b73700996329e011582514f42198f3d4c7dc76229f9892c07f5998a5e

SHA512
ccadfaee77338216d3b252c17a2d5b856f8fadd41e21cdc157970f06d3904ed75ec163fbd7067b4710458192ca2c0016018af37bceb9058096a405aa85c11802

Download Submit
C:\Windows\System\LstNUte.exe

Filesize
1.4MB

MD5
b5c076257d36f0ab6a9cd4a20db995eb

SHA1
ca87bb77d044a1a43b21d40157f7112509915fc7

SHA256
0a69bb837c720fe3794ddf34174cadbe7f5b1569b044ccf0c17b5e328c5ec8fb

SHA512
4d02668940f67a08fb018b5ec4d8e4c0ecbef3a98791dd111721315a05cecf53b1c6424e995ae261b4c70fc306e09256e9738b27d71b5dcc40a10278efa64590

Download Submit
C:\Windows\System\MalQBOD.exe

Filesize
1.4MB

MD5
f5530f7a4d5bad6ad5c48ec94f36eb5e

SHA1
792cb32e1422c46cef6bab0c59c701cb83f0828a

SHA256
0ee1959efc5e23e997c314a9ec0857fea0c2d1c42895c9b6eba3ebf9fd1eb5ce

SHA512
b9bed408d302b0b86ec5f4f5e0969fb3f44d995c496b4fd806e51769a6e0a77c4ac67c01ac205b278a904e375af6272fbc3c5829ec259c98e17f6059b5cdf976

Download Submit
C:\Windows\System\McMCtsS.exe

Filesize
1.4MB

MD5
4e235081df87e1ef756ffffe4fbff9ed

SHA1
03f8cd782fdf616ba89a44c7452e058d26d0034a

SHA256
191ef37dff83a1b295c0298ce7ce99ca61c7f2b0f02b56daa1a7dc3e920852f4

SHA512
8b97a19147ae8c360884ade43aec4ab1c50f218d75bbf069d5aa5f63f4eb839af59a75b68528070a3fa64862339c37d21360033454ec38f6ffeea2835532a686

Download Submit
C:\Windows\System\PtHcyLj.exe

Filesize
1.4MB

MD5
706e1f048d6e902a746c55b16dc241ca

SHA1
82d2ec49cebde308d8cf02858ac183b43564d3a6

SHA256
b64ee3793727e4c2f4bc557ee906c5c51c84a815796f87dd5c300e1cd6f4c9c3

SHA512
be58bf6d9eb9e1fc8519bc3a08df9419ef5e652b3e1caf950d8c332d6dcfa072957759700ee84db73845c1850b920a638af17f17ddaada2ac5cbf291ce8b16e8

Download Submit
C:\Windows\System\TuUnGXH.exe

Filesize
1.4MB

MD5
77046967b3127124d29f0390e7a88a7d

SHA1
8a849a26c7fc1fc6a60163e2985736289e122aba

SHA256
3acbf710a8e0dc18f5152374685e8807c294a23600ce256ed2dff665301222f9

SHA512
c176b0ce8f04613e1405c9c53e1b18ab9ffdaab995545deaf61238ae1f7dd5d971e3d9d523a4c6b8e0b501f49ea584356d1178db5dfe5de726843d6b0f3ecf0e

Download Submit
C:\Windows\System\VhQoxoL.exe

Filesize
1.3MB

MD5
a287100e44ae4237d1119290dc01632c

SHA1
7c11bf094942e57d99fcb94044b190333e8cd9cb

SHA256
fdf7729915c31ac361c252e52773be2c135f53b90a3cf564d9dac8db1cfe2f18

SHA512
aa149a7e0ff781fa8a0ab082f3efcb1fba0e22b82f53352f45304677960431701e47c288914be32e6e50eeaded718c9877635bf48ef70e44cc0ec02e5f4bf97d

Download Submit
C:\Windows\System\amHiEBN.exe

Filesize
1.4MB

MD5
e0095237ec4abf5597bd73be658731f4

SHA1
bc5e63d471ceab3e5fc4754bc61dbd10112a465c

SHA256
080bc6e1af548d6c44a7a9ae0272c6f02a60ab882529329e286447a45fac0f75

SHA512
226b4fd6896d5813407c5ba1b878fb1c2497936f7bc4fcec5514521145fa2086fa854c950687b1585a146732ac30f6d485dcf1c4e89c6525dcdc5ae3fdc8408a

Download Submit
C:\Windows\System\bgAtvRy.exe

Filesize
1.4MB

MD5
b7f1418fdb96c9eaa7a9817e8775347e

SHA1
cf537682a3e0a6a3137e92643e2819ef31ea9c82

SHA256
d7828e62bad2c145d360b91107833683514beb985f7dea93030d69bd915355a3

SHA512
33ee57828879264462eba3ab6226c1f83104dd385ed1ce9020d97714f2d4139e7f97fe905738e3dfdaa9e959c1b2235ea604990fd288a95d8ab9d4ad41b7ec36

Download Submit
C:\Windows\System\bgcliZB.exe

Filesize
1.3MB

MD5
020fbfb68a49d5fcbf225e0716be2b85

SHA1
9378454239afa6beece8a26d04478b8330aadeba

SHA256
eb969dc85ec902d6911a911e73af5b0b318c81449fc6acd6ac76767151125bdd

SHA512
195668ed1434629cb70583659d7a92f71283aa31a838356934484c46323059f1601d2c17c6a48fe5ab40c175316b872c61c04fdb1a9397cf7db851df2b397b50

Download Submit
C:\Windows\System\cmOvDdh.exe

Filesize
1.3MB

MD5
a19d37936a2b0b20a7d196a0e3674b30

SHA1
44e9783a7cf2910880b33b04dad3e54ff860bec5

SHA256
49215f5ecc251e6b8e40b777f4c012d729b661a09d8b6fc481973a5bda76b379

SHA512
09598eebe84b5dcbb75a402a3cb1ae39cfa1192f260aac6bbc0d9dcbf750908f19fad30f3c04bddae5ec72b4b1b4ec08ad748669d0212c800740694ea23c24b1

Download Submit
C:\Windows\System\emvWObZ.exe

Filesize
1.4MB

MD5
245aea03d5f9a756ae12d5878c093019

SHA1
b13a02a1f41ddeea8d0ee6ab257e7b7431c66cd7

SHA256
089c199855b7c4dbe4819704e76d780704f20b9ce1cad6dc1ab8cbac068c737b

SHA512
1a4c11dfc95d52ac2218360a07b2710a82284c995225bc7ff91a557bae59f6abd88ee7322eee2e6b16eb37f18bb99dae3d15a9553f443f764d04362a098b235f

Download Submit
C:\Windows\System\gPkncFf.exe

Filesize
1.4MB

MD5
0aed173d56d396ceef3efd4f4a1d462a

SHA1
452a73bccbe4dc9774cff73d40606071ff295ba6

SHA256
157c229b450127afa1922cd80599f1e99ca54ff92dc255f9e313d36462816cc3

SHA512
471a7db29813b4d7599c4d50ded8f32b6d7da3f84e5951b47c16892b815c35587115a20990a651452ab1d80db40ed7d464cb42c4df3c732794cb4ed37ac2f2f9

Download Submit
C:\Windows\System\gWIvEdQ.exe

Filesize
1.4MB

MD5
8888571a9092293dcce950ee122adc3b

SHA1
b86de6f4e8816729e971a5ee749615d36dfb7e7c

SHA256
a126f2cd65c3c7c9db4df3c993b894b440b969eae12a8108d5dc1dcfc4343b7a

SHA512
c8913eb51c1fdbaa4094ce0238c542b10b2c47d4f095ddecfed99304dad110d933ee9f08a08ee75b10f3e8fffb5f58c5a2ee6571adcc907e9ec25da8d6b06287

Download Submit
C:\Windows\System\hbgeXMu.exe

Filesize
1.4MB

MD5
f6c497a53c38b72a8d7e641e76d51261

SHA1
37556dc1f797a4c1898a7779fa0c90d4435b4811

SHA256
89337c33f8024b3a565192ceb1a0961e5a1e227caa30aced6cf2b18268e3a9ff

SHA512
d03ed675bcc7a42f523097bc75807dd28f27769877fa815e301d41682581d82d269cacad5bfb8e5a65cd936b869d6c5730ecdd8658d0a3ec2d19f8799b1aa833

Download Submit
C:\Windows\System\kuusRcq.exe

Filesize
1.4MB

MD5
babfe5294ea6a99637835a2f37d38ba9

SHA1
a9f9582ae4d9b5a1b20ccd418a48c80c2a6e204c

SHA256
f1db162d1ef2f9ec5b775dd6386fdef28be52be679eac2e21b1d352bc1d7ccfd

SHA512
576f6b5e32a747b6fbcf0139c65aa3e806437753fe2454a9695a62b69842e57c92f338e87bb3918a52fa294eaa3b1466ad6662ecb11ea9e314a9682ecf100136

Download Submit
C:\Windows\System\qFdjxQh.exe

Filesize
1.4MB

MD5
dd9a0d792a1de8b68a86e42013f35110

SHA1
d3544a5a4a04324467192644fb23412d15cf3aee

SHA256
0fbea33ccc280560c51d2c4801c0a97ce7825c8c304b2aef73e463a85463a48d

SHA512
d74cd628b711d6d901a94ffabab7dc9e020ccb13f16cb11d63e50654aba716e8e1bf60c85aeada4eaf7c1b3c3515acd7e987bbe9a98b0c9ad65cbb921336a67b

Download Submit
C:\Windows\System\qOOPKba.exe

Filesize
1.3MB

MD5
0e628f64f9d8665379b992481b3d8eed

SHA1
0951b4869e0827a338fed92ac03018b1c556d58e

SHA256
f0a66ce1366899c3fc22a8bb42bbb489348bad122035f0eae7feb7f71cb944d9

SHA512
9535bdce77884f80ece282c2999eb847b74664766a9aef44dfba5cff88d8eb79144595faf94ab9132692a3590e995ab613c8821c6cd1e7a33eca9a67d45be6c4

Download Submit
C:\Windows\System\rmsWklJ.exe

Filesize
1.4MB

MD5
6865f52a6cddbd48703846a0e2464b3a

SHA1
a776bf2239665feece4d86df19dfb5996b897190

SHA256
b0c285b96b8670a102dfb00d96342514b0ebdfed36e269389df95289a7126531

SHA512
89e649f682133fbd87a35e58f3ebda03f7dfcccf0960cd9e920f7845baf4f2a95bbb664b2961aa643d46906e15e66bfcd98460308eed3d217774f36123e25cdc

Download Submit
C:\Windows\System\tEXHhxh.exe

Filesize
1.3MB

MD5
f6c1daeb60ac387703cc45246bb1bf58

SHA1
9d1c937179735d729a868b56877fe3916200d36e

SHA256
0d1cab0806121a3ad69cf40ece6c35a559611ed3eca7346ed81bfbf464155770

SHA512
7c1a47ae834adfd8197f8c4bd018690b7f17478f97bca6e472bea274b5d9c8d370291fa9e1a2d62df7249a981a04f767a9c4ae6e7791f7cba79840b127ff2657

Download Submit
C:\Windows\System\tHGWKQa.exe

Filesize
1.3MB

MD5
6481c1fc4347f0be33c95b01966a12ff

SHA1
b8be003df830f62805dad8d7406b8a604e0f6983

SHA256
6ad0a53de4c15ccca86e802109304e3ef114c7ff53d9eb5ccd294ed95aa31556

SHA512
2a7d91c8afb0eef31cba869d7a5a0e110aa069633a00ef75b0ca1776ea3a3529e227e4f0169baca41f5e92651de6c6bb98356d47925f4732fa93681ed05a948a

Download Submit
C:\Windows\System\vQGKkNe.exe

Filesize
1.4MB

MD5
8d88e657be921e073c0ea0a8981482fe

SHA1
33b913375ede7734b0fbc5c2011ff7198c0d2391

SHA256
73e673db9383d00a715c57fbdd4902b09a9c04736b7b14d7902470fa7da12c28

SHA512
8f7c1a5ec95a83f520cf651a8f8aac4f089ed2810b3fed9a9246dc25ce3f4180d556c35a9e353a0e645b2b91f0637f6736b12521d76eeef162abb99d2e8ce4cc

Download Submit
C:\Windows\System\vpeobyO.exe

Filesize
1.4MB

MD5
cb2d89e115a74ddbe4f2210d22cafc35

SHA1
ad9dc3ea49e47c17f43157a68692cab3be2b284f

SHA256
81519aee95bbf23798adaccea57f532a0d7b2fff5c687f4dea3debadd2839922

SHA512
a5541cead3994434f819e4e5d4c8d857efa4f220d63fffbd436727ac35e3a2b92918c3034f117a127bc4d0488cf3485f340dea5f078b6859030a77feb3385542

Download Submit
C:\Windows\System\wGLrXWI.exe

Filesize
1.3MB

MD5
e05a9d8966df79c558ac281552d22c5b

SHA1
4ba62c9296e42704c7bb9944e792a6d5b25617a2

SHA256
ae44f6d61d6411b4e66d5718ee914d11e7f4c8f0ddbebb7161ae9c858751bb6d

SHA512
a9b1a7705f3a95f8ac706bd54ae086ef338c9ad23ebfa85f8af693743f8e899b4c277cb38367d5d375ef7283162ad2054b6d8274a03554401277ba5a9de7171b

Download Submit
C:\Windows\System\yKaqezV.exe

Filesize
1.3MB

MD5
7a08a3a106a15fb0c6aec29cebf2c36c

SHA1
a872571b7e792995eff0e5502e08864d8386a334

SHA256
7673672f6743a0ffebc98d9da4e0c10d9aa091cdc68457a2ceec3a8a399d534b

SHA512
956952fe0dbbd8a25dc1c4c17efbed1a0f8c7dc2459684527d74389cb5735e54e8fae7319a7b323ac58c4a745c9433397e7ab756656bf2c87d954966d77f0443

Download Submit
C:\Windows\System\zajNbZD.exe

Filesize
1.3MB

MD5
7f20d7bb91b0d533b1bc89aba39d27ce

SHA1
520f758208d2806cc7fc7d137f652a8baa0411c4

SHA256
603929ebac77027b0710cd47cc0a7b96245693f54e587abd9481c931d9f145e6

SHA512
427671a0de4df40eb037cb71a57d1e5bdc63b5f8b07cecb177b52c72afd9327d9d8d0346640eb7eae7387252ca9c67a66f3551dc8c6eb3c1e52cd51d55eff4cc

Download Submit
memory/520-0-0x00000164CAA20000-0x00000164CAA30000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads