xmrig | 1aeddc18af31b25c17cab27440387242d7d7f871079179c40d09c315ed44022c

Analysis

max time kernel
149s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
21-11-2024 20:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1aeddc18af31b25c17cab27440387242d7d7f871079179c40d09c315ed44022c.exe
Size

1.4MB
MD5

0f1f2f8b9724cd5ed0374504a1244658
SHA1

db2c24ee02dc4891e2ec9a044423e22a592bc547
SHA256

1aeddc18af31b25c17cab27440387242d7d7f871079179c40d09c315ed44022c
SHA512

47b2a910ae0dca723ce8c93d950e929af918d11e3242c34378d5560ceb994b157c918e45364e611793470f6146960ae2d3d308e58097752b3c49a3f2cb4131bf
SSDEEP

24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbpwlKenszbWKDNEm/5QbPrQtOQzX:GezaTF8FcNkNdfE0pZ9ozttwIRx2T9c/

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 40 IoCs

miner

resource	yara_rule
behavioral2/files/0x000a000000023b9e-24.dat	xmrig
behavioral2/files/0x000a000000023bac-99.dat	xmrig
behavioral2/files/0x000a000000023baf-118.dat	xmrig
behavioral2/files/0x000a000000023bb5-142.dat	xmrig
behavioral2/files/0x000a000000023bc0-177.dat	xmrig
behavioral2/files/0x000a000000023bbf-176.dat	xmrig
behavioral2/files/0x000a000000023bbe-175.dat	xmrig
behavioral2/files/0x000a000000023bbd-174.dat	xmrig
behavioral2/files/0x000a000000023bbc-173.dat	xmrig
behavioral2/files/0x000a000000023bbb-170.dat	xmrig
behavioral2/files/0x000a000000023bba-169.dat	xmrig
behavioral2/files/0x000a000000023bb9-165.dat	xmrig
behavioral2/files/0x000a000000023bb0-163.dat	xmrig
behavioral2/files/0x000a000000023bae-161.dat	xmrig
behavioral2/files/0x000a000000023bb8-160.dat	xmrig
behavioral2/files/0x000a000000023bb7-153.dat	xmrig
behavioral2/files/0x000a000000023bad-150.dat	xmrig
behavioral2/files/0x000a000000023bb6-145.dat	xmrig
behavioral2/files/0x000a000000023bb4-137.dat	xmrig
behavioral2/files/0x000a000000023bb3-134.dat	xmrig
behavioral2/files/0x000a000000023bb1-126.dat	xmrig
behavioral2/files/0x000a000000023bab-110.dat	xmrig
behavioral2/files/0x000a000000023bb2-129.dat	xmrig
behavioral2/files/0x000a000000023baa-90.dat	xmrig
behavioral2/files/0x000a000000023ba9-88.dat	xmrig
behavioral2/files/0x000a000000023ba8-86.dat	xmrig
behavioral2/files/0x000a000000023ba7-84.dat	xmrig
behavioral2/files/0x000a000000023ba1-82.dat	xmrig
behavioral2/files/0x0058000000023ba6-80.dat	xmrig
behavioral2/files/0x0031000000023ba4-78.dat	xmrig
behavioral2/files/0x000a000000023ba5-76.dat	xmrig
behavioral2/files/0x000a000000023ba3-73.dat	xmrig
behavioral2/files/0x000a000000023ba2-71.dat	xmrig
behavioral2/files/0x000a000000023b9f-68.dat	xmrig
behavioral2/files/0x000a000000023ba0-61.dat	xmrig
behavioral2/files/0x000a000000023b9d-39.dat	xmrig
behavioral2/files/0x000a000000023b9c-25.dat	xmrig
behavioral2/files/0x000a000000023b9b-21.dat	xmrig
behavioral2/files/0x000a000000023b9a-18.dat	xmrig
behavioral2/files/0x000d000000023b83-8.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
4136	vYrQkMH.exe
696	Bysvejw.exe
384	nQwSjMM.exe
5024	ROuqcIm.exe
3248	QcBmhUV.exe
3232	hFwjgyq.exe
3808	xNaAuog.exe
4052	KlnqTMr.exe
3716	ShRYHpn.exe
1660	vuGdyAc.exe
4496	tirjudV.exe
464	YORgNcz.exe
3564	gKjCdOG.exe
1296	SElDaDZ.exe
2056	zGPaYeb.exe
1284	HLqPcYh.exe
1624	jvlAgYC.exe
4468	vRnhPiA.exe
4992	eaVcUzC.exe
4676	XGApBdf.exe
1848	fuKiDUr.exe
1820	QTCjpgM.exe
2008	PwYKGLy.exe
2692	IioMGHB.exe
4200	oLiaoeJ.exe
2940	FJXRDPp.exe
1728	sZpVxmu.exe
2748	jaRHyGK.exe
1752	sShsKzD.exe
4692	pfrabfG.exe
2696	KIhbvTV.exe
1356	ZIALMsl.exe
1540	rrcKcUH.exe
2384	XTYQgKx.exe
4432	TDAFMgP.exe
3296	vVMKcLq.exe
4604	ZjhAzPW.exe
2316	iYsgnNP.exe
3324	uRKBiLa.exe
1300	kAlHzwv.exe
3576	MLyjPoc.exe
760	DPINzrz.exe
3348	QocrCWG.exe
4696	SMGOCnb.exe
1056	VekUXzn.exe
2504	nIeUwAr.exe
1948	swaUpDS.exe
3008	ODqBJPF.exe
4560	xUMBQcg.exe
4480	pBmazhQ.exe
1516	oVJaVEx.exe
3188	MnWHmoQ.exe
3588	JQqquTt.exe
2424	OflAsKQ.exe
3020	ZWNcaJG.exe
228	BulCOQd.exe
1780	stFOVOk.exe
3904	GXMJCeN.exe
820	DQdReQP.exe
4988	ECDHWrR.exe
2992	laSiTRy.exe
4356	cOxvkFR.exe
4440	MSkYALo.exe
4932	WiZjpnm.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\eNXtzUD.exe	1aeddc18af31b25c17cab27440387242d7d7f871079179c40d09c315ed44022c.exe
File created	C:\Windows\System\yDbOIOc.exe	1aeddc18af31b25c17cab27440387242d7d7f871079179c40d09c315ed44022c.exe
File created	C:\Windows\System\SpFRYjg.exe	1aeddc18af31b25c17cab27440387242d7d7f871079179c40d09c315ed44022c.exe
File created	C:\Windows\System\StiBUVF.exe	1aeddc18af31b25c17cab27440387242d7d7f871079179c40d09c315ed44022c.exe
File created	C:\Windows\System\XPLOIGb.exe	1aeddc18af31b25c17cab27440387242d7d7f871079179c40d09c315ed44022c.exe
File created	C:\Windows\System\cSaNcyl.exe	1aeddc18af31b25c17cab27440387242d7d7f871079179c40d09c315ed44022c.exe
File created	C:\Windows\System\odTauPv.exe	1aeddc18af31b25c17cab27440387242d7d7f871079179c40d09c315ed44022c.exe
File created	C:\Windows\System\lQqLfTe.exe	1aeddc18af31b25c17cab27440387242d7d7f871079179c40d09c315ed44022c.exe
File created	C:\Windows\System\PgDELmZ.exe	1aeddc18af31b25c17cab27440387242d7d7f871079179c40d09c315ed44022c.exe
File created	C:\Windows\System\MiffzZn.exe	1aeddc18af31b25c17cab27440387242d7d7f871079179c40d09c315ed44022c.exe
File created	C:\Windows\System\muGcvha.exe	1aeddc18af31b25c17cab27440387242d7d7f871079179c40d09c315ed44022c.exe
File created	C:\Windows\System\HarMeuw.exe	1aeddc18af31b25c17cab27440387242d7d7f871079179c40d09c315ed44022c.exe
File created	C:\Windows\System\iHwFEwv.exe	1aeddc18af31b25c17cab27440387242d7d7f871079179c40d09c315ed44022c.exe
File created	C:\Windows\System\nDhiHGY.exe	1aeddc18af31b25c17cab27440387242d7d7f871079179c40d09c315ed44022c.exe
File created	C:\Windows\System\HarARMh.exe	1aeddc18af31b25c17cab27440387242d7d7f871079179c40d09c315ed44022c.exe
File created	C:\Windows\System\vNuzEFU.exe	1aeddc18af31b25c17cab27440387242d7d7f871079179c40d09c315ed44022c.exe
File created	C:\Windows\System\tbtxczf.exe	1aeddc18af31b25c17cab27440387242d7d7f871079179c40d09c315ed44022c.exe
File created	C:\Windows\System\IPbaPgd.exe	1aeddc18af31b25c17cab27440387242d7d7f871079179c40d09c315ed44022c.exe
File created	C:\Windows\System\JruuKvY.exe	1aeddc18af31b25c17cab27440387242d7d7f871079179c40d09c315ed44022c.exe
File created	C:\Windows\System\bOZIgff.exe	1aeddc18af31b25c17cab27440387242d7d7f871079179c40d09c315ed44022c.exe
File created	C:\Windows\System\jdcrsmV.exe	1aeddc18af31b25c17cab27440387242d7d7f871079179c40d09c315ed44022c.exe
File created	C:\Windows\System\ZXJsUsQ.exe	1aeddc18af31b25c17cab27440387242d7d7f871079179c40d09c315ed44022c.exe
File created	C:\Windows\System\jkIBkEX.exe	1aeddc18af31b25c17cab27440387242d7d7f871079179c40d09c315ed44022c.exe
File created	C:\Windows\System\xvglNzG.exe	1aeddc18af31b25c17cab27440387242d7d7f871079179c40d09c315ed44022c.exe
File created	C:\Windows\System\IrnQqYv.exe	1aeddc18af31b25c17cab27440387242d7d7f871079179c40d09c315ed44022c.exe
File created	C:\Windows\System\rWcOyba.exe	1aeddc18af31b25c17cab27440387242d7d7f871079179c40d09c315ed44022c.exe
File created	C:\Windows\System\jUcAXfe.exe	1aeddc18af31b25c17cab27440387242d7d7f871079179c40d09c315ed44022c.exe
File created	C:\Windows\System\rseBWdi.exe	1aeddc18af31b25c17cab27440387242d7d7f871079179c40d09c315ed44022c.exe
File created	C:\Windows\System\NTqruDD.exe	1aeddc18af31b25c17cab27440387242d7d7f871079179c40d09c315ed44022c.exe
File created	C:\Windows\System\wBBNDgM.exe	1aeddc18af31b25c17cab27440387242d7d7f871079179c40d09c315ed44022c.exe
File created	C:\Windows\System\tLjqfli.exe	1aeddc18af31b25c17cab27440387242d7d7f871079179c40d09c315ed44022c.exe
File created	C:\Windows\System\pjDcpZF.exe	1aeddc18af31b25c17cab27440387242d7d7f871079179c40d09c315ed44022c.exe
File created	C:\Windows\System\gwkNFMH.exe	1aeddc18af31b25c17cab27440387242d7d7f871079179c40d09c315ed44022c.exe
File created	C:\Windows\System\LmQqPdB.exe	1aeddc18af31b25c17cab27440387242d7d7f871079179c40d09c315ed44022c.exe
File created	C:\Windows\System\uTcyByN.exe	1aeddc18af31b25c17cab27440387242d7d7f871079179c40d09c315ed44022c.exe
File created	C:\Windows\System\uRTpWNy.exe	1aeddc18af31b25c17cab27440387242d7d7f871079179c40d09c315ed44022c.exe
File created	C:\Windows\System\cuDGExz.exe	1aeddc18af31b25c17cab27440387242d7d7f871079179c40d09c315ed44022c.exe
File created	C:\Windows\System\wgXBVcc.exe	1aeddc18af31b25c17cab27440387242d7d7f871079179c40d09c315ed44022c.exe
File created	C:\Windows\System\xiivFAU.exe	1aeddc18af31b25c17cab27440387242d7d7f871079179c40d09c315ed44022c.exe
File created	C:\Windows\System\idjsAYw.exe	1aeddc18af31b25c17cab27440387242d7d7f871079179c40d09c315ed44022c.exe
File created	C:\Windows\System\CkUgOmY.exe	1aeddc18af31b25c17cab27440387242d7d7f871079179c40d09c315ed44022c.exe
File created	C:\Windows\System\gaozkZm.exe	1aeddc18af31b25c17cab27440387242d7d7f871079179c40d09c315ed44022c.exe
File created	C:\Windows\System\RIXWzXm.exe	1aeddc18af31b25c17cab27440387242d7d7f871079179c40d09c315ed44022c.exe
File created	C:\Windows\System\ZYWYPUN.exe	1aeddc18af31b25c17cab27440387242d7d7f871079179c40d09c315ed44022c.exe
File created	C:\Windows\System\SUJkwLQ.exe	1aeddc18af31b25c17cab27440387242d7d7f871079179c40d09c315ed44022c.exe
File created	C:\Windows\System\oXfTXxI.exe	1aeddc18af31b25c17cab27440387242d7d7f871079179c40d09c315ed44022c.exe
File created	C:\Windows\System\YPPYCPg.exe	1aeddc18af31b25c17cab27440387242d7d7f871079179c40d09c315ed44022c.exe
File created	C:\Windows\System\FUZwtHN.exe	1aeddc18af31b25c17cab27440387242d7d7f871079179c40d09c315ed44022c.exe
File created	C:\Windows\System\bRGzkyb.exe	1aeddc18af31b25c17cab27440387242d7d7f871079179c40d09c315ed44022c.exe
File created	C:\Windows\System\wWWkTZO.exe	1aeddc18af31b25c17cab27440387242d7d7f871079179c40d09c315ed44022c.exe
File created	C:\Windows\System\Tgpdqha.exe	1aeddc18af31b25c17cab27440387242d7d7f871079179c40d09c315ed44022c.exe
File created	C:\Windows\System\vAmBdCV.exe	1aeddc18af31b25c17cab27440387242d7d7f871079179c40d09c315ed44022c.exe
File created	C:\Windows\System\RxLKMVi.exe	1aeddc18af31b25c17cab27440387242d7d7f871079179c40d09c315ed44022c.exe
File created	C:\Windows\System\dRrDTSH.exe	1aeddc18af31b25c17cab27440387242d7d7f871079179c40d09c315ed44022c.exe
File created	C:\Windows\System\uIsYdks.exe	1aeddc18af31b25c17cab27440387242d7d7f871079179c40d09c315ed44022c.exe
File created	C:\Windows\System\pmwLhLj.exe	1aeddc18af31b25c17cab27440387242d7d7f871079179c40d09c315ed44022c.exe
File created	C:\Windows\System\hIfVpYz.exe	1aeddc18af31b25c17cab27440387242d7d7f871079179c40d09c315ed44022c.exe
File created	C:\Windows\System\ZQVVfrM.exe	1aeddc18af31b25c17cab27440387242d7d7f871079179c40d09c315ed44022c.exe
File created	C:\Windows\System\ZAkYYUn.exe	1aeddc18af31b25c17cab27440387242d7d7f871079179c40d09c315ed44022c.exe
File created	C:\Windows\System\KKNMprb.exe	1aeddc18af31b25c17cab27440387242d7d7f871079179c40d09c315ed44022c.exe
File created	C:\Windows\System\DPINzrz.exe	1aeddc18af31b25c17cab27440387242d7d7f871079179c40d09c315ed44022c.exe
File created	C:\Windows\System\omHqVlX.exe	1aeddc18af31b25c17cab27440387242d7d7f871079179c40d09c315ed44022c.exe
File created	C:\Windows\System\HFVUGSL.exe	1aeddc18af31b25c17cab27440387242d7d7f871079179c40d09c315ed44022c.exe
File created	C:\Windows\System\tphdLwU.exe	1aeddc18af31b25c17cab27440387242d7d7f871079179c40d09c315ed44022c.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	17164	dwm.exe
Token: SeChangeNotifyPrivilege	17164	dwm.exe
Token: 33	17164	dwm.exe
Token: SeIncBasePriorityPrivilege	17164	dwm.exe
Token: SeShutdownPrivilege	17164	dwm.exe
Token: SeCreatePagefilePrivilege	17164	dwm.exe
Token: SeShutdownPrivilege	17164	dwm.exe
Token: SeCreatePagefilePrivilege	17164	dwm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3256 wrote to memory of 4136	3256	1aeddc18af31b25c17cab27440387242d7d7f871079179c40d09c315ed44022c.exe	84
PID 3256 wrote to memory of 4136	3256	1aeddc18af31b25c17cab27440387242d7d7f871079179c40d09c315ed44022c.exe	84
PID 3256 wrote to memory of 696	3256	1aeddc18af31b25c17cab27440387242d7d7f871079179c40d09c315ed44022c.exe	85
PID 3256 wrote to memory of 696	3256	1aeddc18af31b25c17cab27440387242d7d7f871079179c40d09c315ed44022c.exe	85
PID 3256 wrote to memory of 384	3256	1aeddc18af31b25c17cab27440387242d7d7f871079179c40d09c315ed44022c.exe	86
PID 3256 wrote to memory of 384	3256	1aeddc18af31b25c17cab27440387242d7d7f871079179c40d09c315ed44022c.exe	86
PID 3256 wrote to memory of 5024	3256	1aeddc18af31b25c17cab27440387242d7d7f871079179c40d09c315ed44022c.exe	87
PID 3256 wrote to memory of 5024	3256	1aeddc18af31b25c17cab27440387242d7d7f871079179c40d09c315ed44022c.exe	87
PID 3256 wrote to memory of 3248	3256	1aeddc18af31b25c17cab27440387242d7d7f871079179c40d09c315ed44022c.exe	88
PID 3256 wrote to memory of 3248	3256	1aeddc18af31b25c17cab27440387242d7d7f871079179c40d09c315ed44022c.exe	88
PID 3256 wrote to memory of 3232	3256	1aeddc18af31b25c17cab27440387242d7d7f871079179c40d09c315ed44022c.exe	89
PID 3256 wrote to memory of 3232	3256	1aeddc18af31b25c17cab27440387242d7d7f871079179c40d09c315ed44022c.exe	89
PID 3256 wrote to memory of 3808	3256	1aeddc18af31b25c17cab27440387242d7d7f871079179c40d09c315ed44022c.exe	90
PID 3256 wrote to memory of 3808	3256	1aeddc18af31b25c17cab27440387242d7d7f871079179c40d09c315ed44022c.exe	90
PID 3256 wrote to memory of 4052	3256	1aeddc18af31b25c17cab27440387242d7d7f871079179c40d09c315ed44022c.exe	91
PID 3256 wrote to memory of 4052	3256	1aeddc18af31b25c17cab27440387242d7d7f871079179c40d09c315ed44022c.exe	91
PID 3256 wrote to memory of 1296	3256	1aeddc18af31b25c17cab27440387242d7d7f871079179c40d09c315ed44022c.exe	92
PID 3256 wrote to memory of 1296	3256	1aeddc18af31b25c17cab27440387242d7d7f871079179c40d09c315ed44022c.exe	92
PID 3256 wrote to memory of 3716	3256	1aeddc18af31b25c17cab27440387242d7d7f871079179c40d09c315ed44022c.exe	93
PID 3256 wrote to memory of 3716	3256	1aeddc18af31b25c17cab27440387242d7d7f871079179c40d09c315ed44022c.exe	93
PID 3256 wrote to memory of 1660	3256	1aeddc18af31b25c17cab27440387242d7d7f871079179c40d09c315ed44022c.exe	94
PID 3256 wrote to memory of 1660	3256	1aeddc18af31b25c17cab27440387242d7d7f871079179c40d09c315ed44022c.exe	94
PID 3256 wrote to memory of 4496	3256	1aeddc18af31b25c17cab27440387242d7d7f871079179c40d09c315ed44022c.exe	95
PID 3256 wrote to memory of 4496	3256	1aeddc18af31b25c17cab27440387242d7d7f871079179c40d09c315ed44022c.exe	95
PID 3256 wrote to memory of 464	3256	1aeddc18af31b25c17cab27440387242d7d7f871079179c40d09c315ed44022c.exe	96
PID 3256 wrote to memory of 464	3256	1aeddc18af31b25c17cab27440387242d7d7f871079179c40d09c315ed44022c.exe	96
PID 3256 wrote to memory of 3564	3256	1aeddc18af31b25c17cab27440387242d7d7f871079179c40d09c315ed44022c.exe	97
PID 3256 wrote to memory of 3564	3256	1aeddc18af31b25c17cab27440387242d7d7f871079179c40d09c315ed44022c.exe	97
PID 3256 wrote to memory of 2056	3256	1aeddc18af31b25c17cab27440387242d7d7f871079179c40d09c315ed44022c.exe	98
PID 3256 wrote to memory of 2056	3256	1aeddc18af31b25c17cab27440387242d7d7f871079179c40d09c315ed44022c.exe	98
PID 3256 wrote to memory of 1284	3256	1aeddc18af31b25c17cab27440387242d7d7f871079179c40d09c315ed44022c.exe	99
PID 3256 wrote to memory of 1284	3256	1aeddc18af31b25c17cab27440387242d7d7f871079179c40d09c315ed44022c.exe	99
PID 3256 wrote to memory of 1624	3256	1aeddc18af31b25c17cab27440387242d7d7f871079179c40d09c315ed44022c.exe	100
PID 3256 wrote to memory of 1624	3256	1aeddc18af31b25c17cab27440387242d7d7f871079179c40d09c315ed44022c.exe	100
PID 3256 wrote to memory of 4468	3256	1aeddc18af31b25c17cab27440387242d7d7f871079179c40d09c315ed44022c.exe	101
PID 3256 wrote to memory of 4468	3256	1aeddc18af31b25c17cab27440387242d7d7f871079179c40d09c315ed44022c.exe	101
PID 3256 wrote to memory of 4992	3256	1aeddc18af31b25c17cab27440387242d7d7f871079179c40d09c315ed44022c.exe	102
PID 3256 wrote to memory of 4992	3256	1aeddc18af31b25c17cab27440387242d7d7f871079179c40d09c315ed44022c.exe	102
PID 3256 wrote to memory of 4676	3256	1aeddc18af31b25c17cab27440387242d7d7f871079179c40d09c315ed44022c.exe	103
PID 3256 wrote to memory of 4676	3256	1aeddc18af31b25c17cab27440387242d7d7f871079179c40d09c315ed44022c.exe	103
PID 3256 wrote to memory of 1848	3256	1aeddc18af31b25c17cab27440387242d7d7f871079179c40d09c315ed44022c.exe	104
PID 3256 wrote to memory of 1848	3256	1aeddc18af31b25c17cab27440387242d7d7f871079179c40d09c315ed44022c.exe	104
PID 3256 wrote to memory of 1820	3256	1aeddc18af31b25c17cab27440387242d7d7f871079179c40d09c315ed44022c.exe	105
PID 3256 wrote to memory of 1820	3256	1aeddc18af31b25c17cab27440387242d7d7f871079179c40d09c315ed44022c.exe	105
PID 3256 wrote to memory of 2008	3256	1aeddc18af31b25c17cab27440387242d7d7f871079179c40d09c315ed44022c.exe	106
PID 3256 wrote to memory of 2008	3256	1aeddc18af31b25c17cab27440387242d7d7f871079179c40d09c315ed44022c.exe	106
PID 3256 wrote to memory of 2696	3256	1aeddc18af31b25c17cab27440387242d7d7f871079179c40d09c315ed44022c.exe	107
PID 3256 wrote to memory of 2696	3256	1aeddc18af31b25c17cab27440387242d7d7f871079179c40d09c315ed44022c.exe	107
PID 3256 wrote to memory of 2692	3256	1aeddc18af31b25c17cab27440387242d7d7f871079179c40d09c315ed44022c.exe	108
PID 3256 wrote to memory of 2692	3256	1aeddc18af31b25c17cab27440387242d7d7f871079179c40d09c315ed44022c.exe	108
PID 3256 wrote to memory of 4200	3256	1aeddc18af31b25c17cab27440387242d7d7f871079179c40d09c315ed44022c.exe	109
PID 3256 wrote to memory of 4200	3256	1aeddc18af31b25c17cab27440387242d7d7f871079179c40d09c315ed44022c.exe	109
PID 3256 wrote to memory of 2940	3256	1aeddc18af31b25c17cab27440387242d7d7f871079179c40d09c315ed44022c.exe	110
PID 3256 wrote to memory of 2940	3256	1aeddc18af31b25c17cab27440387242d7d7f871079179c40d09c315ed44022c.exe	110
PID 3256 wrote to memory of 1728	3256	1aeddc18af31b25c17cab27440387242d7d7f871079179c40d09c315ed44022c.exe	111
PID 3256 wrote to memory of 1728	3256	1aeddc18af31b25c17cab27440387242d7d7f871079179c40d09c315ed44022c.exe	111
PID 3256 wrote to memory of 2748	3256	1aeddc18af31b25c17cab27440387242d7d7f871079179c40d09c315ed44022c.exe	112
PID 3256 wrote to memory of 2748	3256	1aeddc18af31b25c17cab27440387242d7d7f871079179c40d09c315ed44022c.exe	112
PID 3256 wrote to memory of 1752	3256	1aeddc18af31b25c17cab27440387242d7d7f871079179c40d09c315ed44022c.exe	113
PID 3256 wrote to memory of 1752	3256	1aeddc18af31b25c17cab27440387242d7d7f871079179c40d09c315ed44022c.exe	113
PID 3256 wrote to memory of 4692	3256	1aeddc18af31b25c17cab27440387242d7d7f871079179c40d09c315ed44022c.exe	114
PID 3256 wrote to memory of 4692	3256	1aeddc18af31b25c17cab27440387242d7d7f871079179c40d09c315ed44022c.exe	114
PID 3256 wrote to memory of 1356	3256	1aeddc18af31b25c17cab27440387242d7d7f871079179c40d09c315ed44022c.exe	115
PID 3256 wrote to memory of 1356	3256	1aeddc18af31b25c17cab27440387242d7d7f871079179c40d09c315ed44022c.exe	115

C:\Users\Admin\AppData\Local\Temp\1aeddc18af31b25c17cab27440387242d7d7f871079179c40d09c315ed44022c.exe
"C:\Users\Admin\AppData\Local\Temp\1aeddc18af31b25c17cab27440387242d7d7f871079179c40d09c315ed44022c.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3256
- C:\Windows\System\vYrQkMH.exe
  C:\Windows\System\vYrQkMH.exe
  2⤵
  - Executes dropped EXE
  PID:4136
- C:\Windows\System\Bysvejw.exe
  C:\Windows\System\Bysvejw.exe
  2⤵
  - Executes dropped EXE
  PID:696
- C:\Windows\System\nQwSjMM.exe
  C:\Windows\System\nQwSjMM.exe
  2⤵
  - Executes dropped EXE
  PID:384
- C:\Windows\System\ROuqcIm.exe
  C:\Windows\System\ROuqcIm.exe
  2⤵
  - Executes dropped EXE
  PID:5024
- C:\Windows\System\QcBmhUV.exe
  C:\Windows\System\QcBmhUV.exe
  2⤵
  - Executes dropped EXE
  PID:3248
- C:\Windows\System\hFwjgyq.exe
  C:\Windows\System\hFwjgyq.exe
  2⤵
  - Executes dropped EXE
  PID:3232
- C:\Windows\System\xNaAuog.exe
  C:\Windows\System\xNaAuog.exe
  2⤵
  - Executes dropped EXE
  PID:3808
- C:\Windows\System\KlnqTMr.exe
  C:\Windows\System\KlnqTMr.exe
  2⤵
  - Executes dropped EXE
  PID:4052
- C:\Windows\System\SElDaDZ.exe
  C:\Windows\System\SElDaDZ.exe
  2⤵
  - Executes dropped EXE
  PID:1296
- C:\Windows\System\ShRYHpn.exe
  C:\Windows\System\ShRYHpn.exe
  2⤵
  - Executes dropped EXE
  PID:3716
- C:\Windows\System\vuGdyAc.exe
  C:\Windows\System\vuGdyAc.exe
  2⤵
  - Executes dropped EXE
  PID:1660
- C:\Windows\System\tirjudV.exe
  C:\Windows\System\tirjudV.exe
  2⤵
  - Executes dropped EXE
  PID:4496
- C:\Windows\System\YORgNcz.exe
  C:\Windows\System\YORgNcz.exe
  2⤵
  - Executes dropped EXE
  PID:464
- C:\Windows\System\gKjCdOG.exe
  C:\Windows\System\gKjCdOG.exe
  2⤵
  - Executes dropped EXE
  PID:3564
- C:\Windows\System\zGPaYeb.exe
  C:\Windows\System\zGPaYeb.exe
  2⤵
  - Executes dropped EXE
  PID:2056
- C:\Windows\System\HLqPcYh.exe
  C:\Windows\System\HLqPcYh.exe
  2⤵
  - Executes dropped EXE
  PID:1284
- C:\Windows\System\jvlAgYC.exe
  C:\Windows\System\jvlAgYC.exe
  2⤵
  - Executes dropped EXE
  PID:1624
- C:\Windows\System\vRnhPiA.exe
  C:\Windows\System\vRnhPiA.exe
  2⤵
  - Executes dropped EXE
  PID:4468
- C:\Windows\System\eaVcUzC.exe
  C:\Windows\System\eaVcUzC.exe
  2⤵
  - Executes dropped EXE
  PID:4992
- C:\Windows\System\XGApBdf.exe
  C:\Windows\System\XGApBdf.exe
  2⤵
  - Executes dropped EXE
  PID:4676
- C:\Windows\System\fuKiDUr.exe
  C:\Windows\System\fuKiDUr.exe
  2⤵
  - Executes dropped EXE
  PID:1848
- C:\Windows\System\QTCjpgM.exe
  C:\Windows\System\QTCjpgM.exe
  2⤵
  - Executes dropped EXE
  PID:1820
- C:\Windows\System\PwYKGLy.exe
  C:\Windows\System\PwYKGLy.exe
  2⤵
  - Executes dropped EXE
  PID:2008
- C:\Windows\System\KIhbvTV.exe
  C:\Windows\System\KIhbvTV.exe
  2⤵
  - Executes dropped EXE
  PID:2696
- C:\Windows\System\IioMGHB.exe
  C:\Windows\System\IioMGHB.exe
  2⤵
  - Executes dropped EXE
  PID:2692
- C:\Windows\System\oLiaoeJ.exe
  C:\Windows\System\oLiaoeJ.exe
  2⤵
  - Executes dropped EXE
  PID:4200
- C:\Windows\System\FJXRDPp.exe
  C:\Windows\System\FJXRDPp.exe
  2⤵
  - Executes dropped EXE
  PID:2940
- C:\Windows\System\sZpVxmu.exe
  C:\Windows\System\sZpVxmu.exe
  2⤵
  - Executes dropped EXE
  PID:1728
- C:\Windows\System\jaRHyGK.exe
  C:\Windows\System\jaRHyGK.exe
  2⤵
  - Executes dropped EXE
  PID:2748
- C:\Windows\System\sShsKzD.exe
  C:\Windows\System\sShsKzD.exe
  2⤵
  - Executes dropped EXE
  PID:1752
- C:\Windows\System\pfrabfG.exe
  C:\Windows\System\pfrabfG.exe
  2⤵
  - Executes dropped EXE
  PID:4692
- C:\Windows\System\ZIALMsl.exe
  C:\Windows\System\ZIALMsl.exe
  2⤵
  - Executes dropped EXE
  PID:1356
- C:\Windows\System\rrcKcUH.exe
  C:\Windows\System\rrcKcUH.exe
  2⤵
  - Executes dropped EXE
  PID:1540
- C:\Windows\System\XTYQgKx.exe
  C:\Windows\System\XTYQgKx.exe
  2⤵
  - Executes dropped EXE
  PID:2384
- C:\Windows\System\TDAFMgP.exe
  C:\Windows\System\TDAFMgP.exe
  2⤵
  - Executes dropped EXE
  PID:4432
- C:\Windows\System\vVMKcLq.exe
  C:\Windows\System\vVMKcLq.exe
  2⤵
  - Executes dropped EXE
  PID:3296
- C:\Windows\System\ZjhAzPW.exe
  C:\Windows\System\ZjhAzPW.exe
  2⤵
  - Executes dropped EXE
  PID:4604
- C:\Windows\System\iYsgnNP.exe
  C:\Windows\System\iYsgnNP.exe
  2⤵
  - Executes dropped EXE
  PID:2316
- C:\Windows\System\uRKBiLa.exe
  C:\Windows\System\uRKBiLa.exe
  2⤵
  - Executes dropped EXE
  PID:3324
- C:\Windows\System\kAlHzwv.exe
  C:\Windows\System\kAlHzwv.exe
  2⤵
  - Executes dropped EXE
  PID:1300
- C:\Windows\System\MLyjPoc.exe
  C:\Windows\System\MLyjPoc.exe
  2⤵
  - Executes dropped EXE
  PID:3576
- C:\Windows\System\DPINzrz.exe
  C:\Windows\System\DPINzrz.exe
  2⤵
  - Executes dropped EXE
  PID:760
- C:\Windows\System\QocrCWG.exe
  C:\Windows\System\QocrCWG.exe
  2⤵
  - Executes dropped EXE
  PID:3348
- C:\Windows\System\SMGOCnb.exe
  C:\Windows\System\SMGOCnb.exe
  2⤵
  - Executes dropped EXE
  PID:4696
- C:\Windows\System\VekUXzn.exe
  C:\Windows\System\VekUXzn.exe
  2⤵
  - Executes dropped EXE
  PID:1056
- C:\Windows\System\nIeUwAr.exe
  C:\Windows\System\nIeUwAr.exe
  2⤵
  - Executes dropped EXE
  PID:2504
- C:\Windows\System\swaUpDS.exe
  C:\Windows\System\swaUpDS.exe
  2⤵
  - Executes dropped EXE
  PID:1948
- C:\Windows\System\ODqBJPF.exe
  C:\Windows\System\ODqBJPF.exe
  2⤵
  - Executes dropped EXE
  PID:3008
- C:\Windows\System\xUMBQcg.exe
  C:\Windows\System\xUMBQcg.exe
  2⤵
  - Executes dropped EXE
  PID:4560
- C:\Windows\System\pBmazhQ.exe
  C:\Windows\System\pBmazhQ.exe
  2⤵
  - Executes dropped EXE
  PID:4480
- C:\Windows\System\oVJaVEx.exe
  C:\Windows\System\oVJaVEx.exe
  2⤵
  - Executes dropped EXE
  PID:1516
- C:\Windows\System\MnWHmoQ.exe
  C:\Windows\System\MnWHmoQ.exe
  2⤵
  - Executes dropped EXE
  PID:3188
- C:\Windows\System\JQqquTt.exe
  C:\Windows\System\JQqquTt.exe
  2⤵
  - Executes dropped EXE
  PID:3588
- C:\Windows\System\OflAsKQ.exe
  C:\Windows\System\OflAsKQ.exe
  2⤵
  - Executes dropped EXE
  PID:2424
- C:\Windows\System\ZWNcaJG.exe
  C:\Windows\System\ZWNcaJG.exe
  2⤵
  - Executes dropped EXE
  PID:3020
- C:\Windows\System\BulCOQd.exe
  C:\Windows\System\BulCOQd.exe
  2⤵
  - Executes dropped EXE
  PID:228
- C:\Windows\System\stFOVOk.exe
  C:\Windows\System\stFOVOk.exe
  2⤵
  - Executes dropped EXE
  PID:1780
- C:\Windows\System\GXMJCeN.exe
  C:\Windows\System\GXMJCeN.exe
  2⤵
  - Executes dropped EXE
  PID:3904
- C:\Windows\System\DQdReQP.exe
  C:\Windows\System\DQdReQP.exe
  2⤵
  - Executes dropped EXE
  PID:820
- C:\Windows\System\ECDHWrR.exe
  C:\Windows\System\ECDHWrR.exe
  2⤵
  - Executes dropped EXE
  PID:4988
- C:\Windows\System\laSiTRy.exe
  C:\Windows\System\laSiTRy.exe
  2⤵
  - Executes dropped EXE
  PID:2992
- C:\Windows\System\cOxvkFR.exe
  C:\Windows\System\cOxvkFR.exe
  2⤵
  - Executes dropped EXE
  PID:4356
- C:\Windows\System\MSkYALo.exe
  C:\Windows\System\MSkYALo.exe
  2⤵
  - Executes dropped EXE
  PID:4440
- C:\Windows\System\WiZjpnm.exe
  C:\Windows\System\WiZjpnm.exe
  2⤵
  - Executes dropped EXE
  PID:4932
- C:\Windows\System\UysMwsp.exe
  C:\Windows\System\UysMwsp.exe
  2⤵
  PID:2480
- C:\Windows\System\jwrVjqZ.exe
  C:\Windows\System\jwrVjqZ.exe
  2⤵
  PID:3952
- C:\Windows\System\iAKHEKW.exe
  C:\Windows\System\iAKHEKW.exe
  2⤵
  PID:1872
- C:\Windows\System\XUJXlSd.exe
  C:\Windows\System\XUJXlSd.exe
  2⤵
  PID:2436
- C:\Windows\System\PgaATCJ.exe
  C:\Windows\System\PgaATCJ.exe
  2⤵
  PID:212
- C:\Windows\System\XPLOIGb.exe
  C:\Windows\System\XPLOIGb.exe
  2⤵
  PID:3372
- C:\Windows\System\wIwDHYe.exe
  C:\Windows\System\wIwDHYe.exe
  2⤵
  PID:5104
- C:\Windows\System\uUjgIxd.exe
  C:\Windows\System\uUjgIxd.exe
  2⤵
  PID:3604
- C:\Windows\System\TvfDoFb.exe
  C:\Windows\System\TvfDoFb.exe
  2⤵
  PID:2164
- C:\Windows\System\SRrWdjQ.exe
  C:\Windows\System\SRrWdjQ.exe
  2⤵
  PID:4140
- C:\Windows\System\iHwFEwv.exe
  C:\Windows\System\iHwFEwv.exe
  2⤵
  PID:4680
- C:\Windows\System\MgqRCEI.exe
  C:\Windows\System\MgqRCEI.exe
  2⤵
  PID:3288
- C:\Windows\System\ZaJfYwL.exe
  C:\Windows\System\ZaJfYwL.exe
  2⤵
  PID:4436
- C:\Windows\System\YPPYCPg.exe
  C:\Windows\System\YPPYCPg.exe
  2⤵
  PID:4164
- C:\Windows\System\Ikdoqdu.exe
  C:\Windows\System\Ikdoqdu.exe
  2⤵
  PID:5108
- C:\Windows\System\oWjWJVJ.exe
  C:\Windows\System\oWjWJVJ.exe
  2⤵
  PID:1264
- C:\Windows\System\WHhVLwo.exe
  C:\Windows\System\WHhVLwo.exe
  2⤵
  PID:4016
- C:\Windows\System\XjRULwS.exe
  C:\Windows\System\XjRULwS.exe
  2⤵
  PID:1776
- C:\Windows\System\iEKSKJW.exe
  C:\Windows\System\iEKSKJW.exe
  2⤵
  PID:2416
- C:\Windows\System\RTtnWZg.exe
  C:\Windows\System\RTtnWZg.exe
  2⤵
  PID:1032
- C:\Windows\System\LiiPgoz.exe
  C:\Windows\System\LiiPgoz.exe
  2⤵
  PID:4724
- C:\Windows\System\IDQovRs.exe
  C:\Windows\System\IDQovRs.exe
  2⤵
  PID:2760
- C:\Windows\System\utyzDAm.exe
  C:\Windows\System\utyzDAm.exe
  2⤵
  PID:3316
- C:\Windows\System\tzwJHnQ.exe
  C:\Windows\System\tzwJHnQ.exe
  2⤵
  PID:2400
- C:\Windows\System\wDbbEWE.exe
  C:\Windows\System\wDbbEWE.exe
  2⤵
  PID:5028
- C:\Windows\System\sIYWefT.exe
  C:\Windows\System\sIYWefT.exe
  2⤵
  PID:4236
- C:\Windows\System\LnjyqHJ.exe
  C:\Windows\System\LnjyqHJ.exe
  2⤵
  PID:2128
- C:\Windows\System\OdJKRbb.exe
  C:\Windows\System\OdJKRbb.exe
  2⤵
  PID:4752
- C:\Windows\System\fvRjYwb.exe
  C:\Windows\System\fvRjYwb.exe
  2⤵
  PID:4732
- C:\Windows\System\QqCqfdO.exe
  C:\Windows\System\QqCqfdO.exe
  2⤵
  PID:3748
- C:\Windows\System\MisWXzx.exe
  C:\Windows\System\MisWXzx.exe
  2⤵
  PID:3032
- C:\Windows\System\YhgFrTl.exe
  C:\Windows\System\YhgFrTl.exe
  2⤵
  PID:5068
- C:\Windows\System\yWRLXOH.exe
  C:\Windows\System\yWRLXOH.exe
  2⤵
  PID:1476
- C:\Windows\System\cPEuOzl.exe
  C:\Windows\System\cPEuOzl.exe
  2⤵
  PID:5000
- C:\Windows\System\OZQIuJY.exe
  C:\Windows\System\OZQIuJY.exe
  2⤵
  PID:4736
- C:\Windows\System\nYglXAP.exe
  C:\Windows\System\nYglXAP.exe
  2⤵
  PID:2456
- C:\Windows\System\trqusyz.exe
  C:\Windows\System\trqusyz.exe
  2⤵
  PID:1772
- C:\Windows\System\SLkRGTx.exe
  C:\Windows\System\SLkRGTx.exe
  2⤵
  PID:2348
- C:\Windows\System\SzTMtzE.exe
  C:\Windows\System\SzTMtzE.exe
  2⤵
  PID:3092
- C:\Windows\System\wlevMVc.exe
  C:\Windows\System\wlevMVc.exe
  2⤵
  PID:880
- C:\Windows\System\NcAOnuh.exe
  C:\Windows\System\NcAOnuh.exe
  2⤵
  PID:4844
- C:\Windows\System\YDuYTOJ.exe
  C:\Windows\System\YDuYTOJ.exe
  2⤵
  PID:1972
- C:\Windows\System\ItTQIfi.exe
  C:\Windows\System\ItTQIfi.exe
  2⤵
  PID:4900
- C:\Windows\System\ylgUfLe.exe
  C:\Windows\System\ylgUfLe.exe
  2⤵
  PID:1896
- C:\Windows\System\CROinOC.exe
  C:\Windows\System\CROinOC.exe
  2⤵
  PID:4032
- C:\Windows\System\Yxdfyyl.exe
  C:\Windows\System\Yxdfyyl.exe
  2⤵
  PID:3760
- C:\Windows\System\Dapvahb.exe
  C:\Windows\System\Dapvahb.exe
  2⤵
  PID:456
- C:\Windows\System\pxEoYeK.exe
  C:\Windows\System\pxEoYeK.exe
  2⤵
  PID:372
- C:\Windows\System\qVhYeiN.exe
  C:\Windows\System\qVhYeiN.exe
  2⤵
  PID:1684
- C:\Windows\System\xuyDUaN.exe
  C:\Windows\System\xuyDUaN.exe
  2⤵
  PID:3220
- C:\Windows\System\TVPUzNx.exe
  C:\Windows\System\TVPUzNx.exe
  2⤵
  PID:4040
- C:\Windows\System\UOUOSuu.exe
  C:\Windows\System\UOUOSuu.exe
  2⤵
  PID:5124
- C:\Windows\System\HseAQAy.exe
  C:\Windows\System\HseAQAy.exe
  2⤵
  PID:5156
- C:\Windows\System\JQIvCUW.exe
  C:\Windows\System\JQIvCUW.exe
  2⤵
  PID:5184
- C:\Windows\System\cSaNcyl.exe
  C:\Windows\System\cSaNcyl.exe
  2⤵
  PID:5212
- C:\Windows\System\PnirbLa.exe
  C:\Windows\System\PnirbLa.exe
  2⤵
  PID:5240
- C:\Windows\System\MZXgQtu.exe
  C:\Windows\System\MZXgQtu.exe
  2⤵
  PID:5276
- C:\Windows\System\yAGpTAr.exe
  C:\Windows\System\yAGpTAr.exe
  2⤵
  PID:5320
- C:\Windows\System\OTtTsMb.exe
  C:\Windows\System\OTtTsMb.exe
  2⤵
  PID:5344
- C:\Windows\System\viCznLN.exe
  C:\Windows\System\viCznLN.exe
  2⤵
  PID:5372
- C:\Windows\System\YVwRVyx.exe
  C:\Windows\System\YVwRVyx.exe
  2⤵
  PID:5400
- C:\Windows\System\MloJevQ.exe
  C:\Windows\System\MloJevQ.exe
  2⤵
  PID:5432
- C:\Windows\System\hKvFjVB.exe
  C:\Windows\System\hKvFjVB.exe
  2⤵
  PID:5460
- C:\Windows\System\XvlmCrT.exe
  C:\Windows\System\XvlmCrT.exe
  2⤵
  PID:5496
- C:\Windows\System\BzKevMc.exe
  C:\Windows\System\BzKevMc.exe
  2⤵
  PID:5516
- C:\Windows\System\LeBtSPA.exe
  C:\Windows\System\LeBtSPA.exe
  2⤵
  PID:5544
- C:\Windows\System\jQtNdBa.exe
  C:\Windows\System\jQtNdBa.exe
  2⤵
  PID:5568
- C:\Windows\System\RBGEgIQ.exe
  C:\Windows\System\RBGEgIQ.exe
  2⤵
  PID:5600
- C:\Windows\System\odTauPv.exe
  C:\Windows\System\odTauPv.exe
  2⤵
  PID:5632
- C:\Windows\System\FEDcqHj.exe
  C:\Windows\System\FEDcqHj.exe
  2⤵
  PID:5656
- C:\Windows\System\YtEtccI.exe
  C:\Windows\System\YtEtccI.exe
  2⤵
  PID:5684
- C:\Windows\System\FLePxAB.exe
  C:\Windows\System\FLePxAB.exe
  2⤵
  PID:5708
- C:\Windows\System\YPAPpTr.exe
  C:\Windows\System\YPAPpTr.exe
  2⤵
  PID:5740
- C:\Windows\System\FFUecHy.exe
  C:\Windows\System\FFUecHy.exe
  2⤵
  PID:5792
- C:\Windows\System\LMHisuH.exe
  C:\Windows\System\LMHisuH.exe
  2⤵
  PID:5828
- C:\Windows\System\MprKxQf.exe
  C:\Windows\System\MprKxQf.exe
  2⤵
  PID:5864
- C:\Windows\System\xjhsguQ.exe
  C:\Windows\System\xjhsguQ.exe
  2⤵
  PID:5884
- C:\Windows\System\yrBPZId.exe
  C:\Windows\System\yrBPZId.exe
  2⤵
  PID:5916
- C:\Windows\System\qfltWdN.exe
  C:\Windows\System\qfltWdN.exe
  2⤵
  PID:5936
- C:\Windows\System\ZBoCmxk.exe
  C:\Windows\System\ZBoCmxk.exe
  2⤵
  PID:5968
- C:\Windows\System\FJKaFYq.exe
  C:\Windows\System\FJKaFYq.exe
  2⤵
  PID:6000
- C:\Windows\System\aJwsNfB.exe
  C:\Windows\System\aJwsNfB.exe
  2⤵
  PID:6020
- C:\Windows\System\waOudJd.exe
  C:\Windows\System\waOudJd.exe
  2⤵
  PID:6052
- C:\Windows\System\XLXvSJV.exe
  C:\Windows\System\XLXvSJV.exe
  2⤵
  PID:6084
- C:\Windows\System\ypqZkmY.exe
  C:\Windows\System\ypqZkmY.exe
  2⤵
  PID:6112
- C:\Windows\System\tsMAYBs.exe
  C:\Windows\System\tsMAYBs.exe
  2⤵
  PID:6140
- C:\Windows\System\VxygHht.exe
  C:\Windows\System\VxygHht.exe
  2⤵
  PID:5144
- C:\Windows\System\uPHUMNw.exe
  C:\Windows\System\uPHUMNw.exe
  2⤵
  PID:5220
- C:\Windows\System\ofIxwZx.exe
  C:\Windows\System\ofIxwZx.exe
  2⤵
  PID:3580
- C:\Windows\System\mSGfMqm.exe
  C:\Windows\System\mSGfMqm.exe
  2⤵
  PID:5176
- C:\Windows\System\IuKMhsu.exe
  C:\Windows\System\IuKMhsu.exe
  2⤵
  PID:5332
- C:\Windows\System\dgGtXnH.exe
  C:\Windows\System\dgGtXnH.exe
  2⤵
  PID:5420
- C:\Windows\System\NwVgPUA.exe
  C:\Windows\System\NwVgPUA.exe
  2⤵
  PID:5360
- C:\Windows\System\IYwLyjY.exe
  C:\Windows\System\IYwLyjY.exe
  2⤵
  PID:5564
- C:\Windows\System\MXwkyfM.exe
  C:\Windows\System\MXwkyfM.exe
  2⤵
  PID:5552
- C:\Windows\System\uPoQTwb.exe
  C:\Windows\System\uPoQTwb.exe
  2⤵
  PID:5592
- C:\Windows\System\mvcPhwL.exe
  C:\Windows\System\mvcPhwL.exe
  2⤵
  PID:5732
- C:\Windows\System\gQtwETD.exe
  C:\Windows\System\gQtwETD.exe
  2⤵
  PID:5804
- C:\Windows\System\WHgAngz.exe
  C:\Windows\System\WHgAngz.exe
  2⤵
  PID:5820
- C:\Windows\System\UFuIWEE.exe
  C:\Windows\System\UFuIWEE.exe
  2⤵
  PID:5932
- C:\Windows\System\MgaFBIy.exe
  C:\Windows\System\MgaFBIy.exe
  2⤵
  PID:6008
- C:\Windows\System\uxhZsuj.exe
  C:\Windows\System\uxhZsuj.exe
  2⤵
  PID:6064
- C:\Windows\System\STFpvPK.exe
  C:\Windows\System\STFpvPK.exe
  2⤵
  PID:1004
- C:\Windows\System\eHGMaLX.exe
  C:\Windows\System\eHGMaLX.exe
  2⤵
  PID:5264
- C:\Windows\System\uEDdRAy.exe
  C:\Windows\System\uEDdRAy.exe
  2⤵
  PID:5448
- C:\Windows\System\crbgozj.exe
  C:\Windows\System\crbgozj.exe
  2⤵
  PID:5596
- C:\Windows\System\uGdFdOP.exe
  C:\Windows\System\uGdFdOP.exe
  2⤵
  PID:5528
- C:\Windows\System\aggonmx.exe
  C:\Windows\System\aggonmx.exe
  2⤵
  PID:5640
- C:\Windows\System\RIXWzXm.exe
  C:\Windows\System\RIXWzXm.exe
  2⤵
  PID:5880
- C:\Windows\System\pcBwXPq.exe
  C:\Windows\System\pcBwXPq.exe
  2⤵
  PID:5964
- C:\Windows\System\zrKJiTX.exe
  C:\Windows\System\zrKJiTX.exe
  2⤵
  PID:5168
- C:\Windows\System\HABVvrZ.exe
  C:\Windows\System\HABVvrZ.exe
  2⤵
  PID:6104
- C:\Windows\System\IPbaPgd.exe
  C:\Windows\System\IPbaPgd.exe
  2⤵
  PID:5172
- C:\Windows\System\fKaGKMr.exe
  C:\Windows\System\fKaGKMr.exe
  2⤵
  PID:6148
- C:\Windows\System\kNJGfoW.exe
  C:\Windows\System\kNJGfoW.exe
  2⤵
  PID:6176
- C:\Windows\System\pjDcpZF.exe
  C:\Windows\System\pjDcpZF.exe
  2⤵
  PID:6208
- C:\Windows\System\XjJyAms.exe
  C:\Windows\System\XjJyAms.exe
  2⤵
  PID:6232
- C:\Windows\System\wDkYiTT.exe
  C:\Windows\System\wDkYiTT.exe
  2⤵
  PID:6264
- C:\Windows\System\rVpdZcw.exe
  C:\Windows\System\rVpdZcw.exe
  2⤵
  PID:6292
- C:\Windows\System\PlDYfYN.exe
  C:\Windows\System\PlDYfYN.exe
  2⤵
  PID:6316
- C:\Windows\System\BszGqEf.exe
  C:\Windows\System\BszGqEf.exe
  2⤵
  PID:6348
- C:\Windows\System\iRoLkhk.exe
  C:\Windows\System\iRoLkhk.exe
  2⤵
  PID:6384
- C:\Windows\System\QVsOmbS.exe
  C:\Windows\System\QVsOmbS.exe
  2⤵
  PID:6408
- C:\Windows\System\awOuysU.exe
  C:\Windows\System\awOuysU.exe
  2⤵
  PID:6444
- C:\Windows\System\GsOFMFJ.exe
  C:\Windows\System\GsOFMFJ.exe
  2⤵
  PID:6468
- C:\Windows\System\xjlNyGD.exe
  C:\Windows\System\xjlNyGD.exe
  2⤵
  PID:6496
- C:\Windows\System\rkfxuTC.exe
  C:\Windows\System\rkfxuTC.exe
  2⤵
  PID:6520
- C:\Windows\System\GxFCMqu.exe
  C:\Windows\System\GxFCMqu.exe
  2⤵
  PID:6548
- C:\Windows\System\jBdEZkB.exe
  C:\Windows\System\jBdEZkB.exe
  2⤵
  PID:6580
- C:\Windows\System\mRvWpml.exe
  C:\Windows\System\mRvWpml.exe
  2⤵
  PID:6608
- C:\Windows\System\XwvboDb.exe
  C:\Windows\System\XwvboDb.exe
  2⤵
  PID:6636
- C:\Windows\System\ovIshXO.exe
  C:\Windows\System\ovIshXO.exe
  2⤵
  PID:6652
- C:\Windows\System\omHqVlX.exe
  C:\Windows\System\omHqVlX.exe
  2⤵
  PID:6680
- C:\Windows\System\MuBaDHS.exe
  C:\Windows\System\MuBaDHS.exe
  2⤵
  PID:6716
- C:\Windows\System\AgpaGwe.exe
  C:\Windows\System\AgpaGwe.exe
  2⤵
  PID:6748
- C:\Windows\System\KXALDhy.exe
  C:\Windows\System\KXALDhy.exe
  2⤵
  PID:6768
- C:\Windows\System\aiKZYVw.exe
  C:\Windows\System\aiKZYVw.exe
  2⤵
  PID:6796
- C:\Windows\System\CJZfHRK.exe
  C:\Windows\System\CJZfHRK.exe
  2⤵
  PID:6824
- C:\Windows\System\nydwAaF.exe
  C:\Windows\System\nydwAaF.exe
  2⤵
  PID:6856
- C:\Windows\System\QrOaanp.exe
  C:\Windows\System\QrOaanp.exe
  2⤵
  PID:6892
- C:\Windows\System\DYoPkqz.exe
  C:\Windows\System\DYoPkqz.exe
  2⤵
  PID:6920
- C:\Windows\System\HdVMfiz.exe
  C:\Windows\System\HdVMfiz.exe
  2⤵
  PID:6948
- C:\Windows\System\MNvQtJn.exe
  C:\Windows\System\MNvQtJn.exe
  2⤵
  PID:6972
- C:\Windows\System\YAhMErw.exe
  C:\Windows\System\YAhMErw.exe
  2⤵
  PID:6992
- C:\Windows\System\iBBxFtw.exe
  C:\Windows\System\iBBxFtw.exe
  2⤵
  PID:7020
- C:\Windows\System\wsuBvUn.exe
  C:\Windows\System\wsuBvUn.exe
  2⤵
  PID:7048
- C:\Windows\System\BRanork.exe
  C:\Windows\System\BRanork.exe
  2⤵
  PID:7080
- C:\Windows\System\OpjTENx.exe
  C:\Windows\System\OpjTENx.exe
  2⤵
  PID:7108
- C:\Windows\System\HFVUGSL.exe
  C:\Windows\System\HFVUGSL.exe
  2⤵
  PID:7128
- C:\Windows\System\OVVPsmo.exe
  C:\Windows\System\OVVPsmo.exe
  2⤵
  PID:7148
- C:\Windows\System\sWfUqaz.exe
  C:\Windows\System\sWfUqaz.exe
  2⤵
  PID:6136
- C:\Windows\System\qCeUBNC.exe
  C:\Windows\System\qCeUBNC.exe
  2⤵
  PID:5228
- C:\Windows\System\lAvGAgn.exe
  C:\Windows\System\lAvGAgn.exe
  2⤵
  PID:5924
- C:\Windows\System\OjYBooj.exe
  C:\Windows\System\OjYBooj.exe
  2⤵
  PID:6224
- C:\Windows\System\zsdXxQu.exe
  C:\Windows\System\zsdXxQu.exe
  2⤵
  PID:6344
- C:\Windows\System\JZFwgUy.exe
  C:\Windows\System\JZFwgUy.exe
  2⤵
  PID:6328
- C:\Windows\System\ClUuGmM.exe
  C:\Windows\System\ClUuGmM.exe
  2⤵
  PID:6440
- C:\Windows\System\ZtcjLyf.exe
  C:\Windows\System\ZtcjLyf.exe
  2⤵
  PID:6484
- C:\Windows\System\IiUqTLO.exe
  C:\Windows\System\IiUqTLO.exe
  2⤵
  PID:6596
- C:\Windows\System\HJEFrQL.exe
  C:\Windows\System\HJEFrQL.exe
  2⤵
  PID:6628
- C:\Windows\System\WLNeKXP.exe
  C:\Windows\System\WLNeKXP.exe
  2⤵
  PID:6664
- C:\Windows\System\yktLzdm.exe
  C:\Windows\System\yktLzdm.exe
  2⤵
  PID:6700
- C:\Windows\System\WFsqicn.exe
  C:\Windows\System\WFsqicn.exe
  2⤵
  PID:6884
- C:\Windows\System\tphdLwU.exe
  C:\Windows\System\tphdLwU.exe
  2⤵
  PID:6880
- C:\Windows\System\VpCpTPa.exe
  C:\Windows\System\VpCpTPa.exe
  2⤵
  PID:7004
- C:\Windows\System\QYIAscU.exe
  C:\Windows\System\QYIAscU.exe
  2⤵
  PID:7060
- C:\Windows\System\rZliTfH.exe
  C:\Windows\System\rZliTfH.exe
  2⤵
  PID:7028
- C:\Windows\System\ywDuQLX.exe
  C:\Windows\System\ywDuQLX.exe
  2⤵
  PID:7096
- C:\Windows\System\wSEXOua.exe
  C:\Windows\System\wSEXOua.exe
  2⤵
  PID:6216
- C:\Windows\System\GHUOJiQ.exe
  C:\Windows\System\GHUOJiQ.exe
  2⤵
  PID:6376
- C:\Windows\System\TQbwkPR.exe
  C:\Windows\System\TQbwkPR.exe
  2⤵
  PID:6516
- C:\Windows\System\GddUemU.exe
  C:\Windows\System\GddUemU.exe
  2⤵
  PID:6676
- C:\Windows\System\nDhiHGY.exe
  C:\Windows\System\nDhiHGY.exe
  2⤵
  PID:6816
- C:\Windows\System\ARjhWIT.exe
  C:\Windows\System\ARjhWIT.exe
  2⤵
  PID:6808
- C:\Windows\System\YpwzMhs.exe
  C:\Windows\System\YpwzMhs.exe
  2⤵
  PID:7068
- C:\Windows\System\TXdzQiu.exe
  C:\Windows\System\TXdzQiu.exe
  2⤵
  PID:6280
- C:\Windows\System\vQjvaSo.exe
  C:\Windows\System\vQjvaSo.exe
  2⤵
  PID:6544
- C:\Windows\System\sLmWgNX.exe
  C:\Windows\System\sLmWgNX.exe
  2⤵
  PID:7184
- C:\Windows\System\gJjySSM.exe
  C:\Windows\System\gJjySSM.exe
  2⤵
  PID:7212
- C:\Windows\System\TiMhvnj.exe
  C:\Windows\System\TiMhvnj.exe
  2⤵
  PID:7248
- C:\Windows\System\OjIKgjX.exe
  C:\Windows\System\OjIKgjX.exe
  2⤵
  PID:7276
- C:\Windows\System\vAmBdCV.exe
  C:\Windows\System\vAmBdCV.exe
  2⤵
  PID:7304
- C:\Windows\System\zSppJhq.exe
  C:\Windows\System\zSppJhq.exe
  2⤵
  PID:7336
- C:\Windows\System\TXLfFbi.exe
  C:\Windows\System\TXLfFbi.exe
  2⤵
  PID:7352
- C:\Windows\System\qYsDifI.exe
  C:\Windows\System\qYsDifI.exe
  2⤵
  PID:7380
- C:\Windows\System\AKmFFLS.exe
  C:\Windows\System\AKmFFLS.exe
  2⤵
  PID:7408
- C:\Windows\System\VMPuUUy.exe
  C:\Windows\System\VMPuUUy.exe
  2⤵
  PID:7436
- C:\Windows\System\uIsYdks.exe
  C:\Windows\System\uIsYdks.exe
  2⤵
  PID:7468
- C:\Windows\System\iHbFwTY.exe
  C:\Windows\System\iHbFwTY.exe
  2⤵
  PID:7496
- C:\Windows\System\WzAYRQl.exe
  C:\Windows\System\WzAYRQl.exe
  2⤵
  PID:7516
- C:\Windows\System\uMpkihG.exe
  C:\Windows\System\uMpkihG.exe
  2⤵
  PID:7536
- C:\Windows\System\AvhXamS.exe
  C:\Windows\System\AvhXamS.exe
  2⤵
  PID:7560
- C:\Windows\System\GNuhhEj.exe
  C:\Windows\System\GNuhhEj.exe
  2⤵
  PID:7588
- C:\Windows\System\AbBwobn.exe
  C:\Windows\System\AbBwobn.exe
  2⤵
  PID:7612
- C:\Windows\System\mRMDHvi.exe
  C:\Windows\System\mRMDHvi.exe
  2⤵
  PID:7632
- C:\Windows\System\IbgnixI.exe
  C:\Windows\System\IbgnixI.exe
  2⤵
  PID:7664
- C:\Windows\System\ribTdxU.exe
  C:\Windows\System\ribTdxU.exe
  2⤵
  PID:7688
- C:\Windows\System\UHRHXkh.exe
  C:\Windows\System\UHRHXkh.exe
  2⤵
  PID:7724
- C:\Windows\System\ZBbSwpT.exe
  C:\Windows\System\ZBbSwpT.exe
  2⤵
  PID:7760
- C:\Windows\System\ynyLSha.exe
  C:\Windows\System\ynyLSha.exe
  2⤵
  PID:7788
- C:\Windows\System\JruuKvY.exe
  C:\Windows\System\JruuKvY.exe
  2⤵
  PID:7804
- C:\Windows\System\SpGNXZL.exe
  C:\Windows\System\SpGNXZL.exe
  2⤵
  PID:7836
- C:\Windows\System\pMHHltc.exe
  C:\Windows\System\pMHHltc.exe
  2⤵
  PID:7860
- C:\Windows\System\dHSBiLM.exe
  C:\Windows\System\dHSBiLM.exe
  2⤵
  PID:7880
- C:\Windows\System\gVIOdEw.exe
  C:\Windows\System\gVIOdEw.exe
  2⤵
  PID:7900
- C:\Windows\System\uhWcsfI.exe
  C:\Windows\System\uhWcsfI.exe
  2⤵
  PID:7928
- C:\Windows\System\bNGsuWV.exe
  C:\Windows\System\bNGsuWV.exe
  2⤵
  PID:7956
- C:\Windows\System\hbdSmTR.exe
  C:\Windows\System\hbdSmTR.exe
  2⤵
  PID:7988
- C:\Windows\System\zyWAkJF.exe
  C:\Windows\System\zyWAkJF.exe
  2⤵
  PID:8008
- C:\Windows\System\UWUXWAx.exe
  C:\Windows\System\UWUXWAx.exe
  2⤵
  PID:8036
- C:\Windows\System\kXhFUQG.exe
  C:\Windows\System\kXhFUQG.exe
  2⤵
  PID:8068
- C:\Windows\System\mhtKlWx.exe
  C:\Windows\System\mhtKlWx.exe
  2⤵
  PID:8096
- C:\Windows\System\olUcQcY.exe
  C:\Windows\System\olUcQcY.exe
  2⤵
  PID:8128
- C:\Windows\System\HbsCKGH.exe
  C:\Windows\System\HbsCKGH.exe
  2⤵
  PID:8156
- C:\Windows\System\IeXUzEF.exe
  C:\Windows\System\IeXUzEF.exe
  2⤵
  PID:7016
- C:\Windows\System\NGchXTt.exe
  C:\Windows\System\NGchXTt.exe
  2⤵
  PID:7124
- C:\Windows\System\XHTbRvQ.exe
  C:\Windows\System\XHTbRvQ.exe
  2⤵
  PID:7224
- C:\Windows\System\SEWwIXu.exe
  C:\Windows\System\SEWwIXu.exe
  2⤵
  PID:7264
- C:\Windows\System\pXgIqiT.exe
  C:\Windows\System\pXgIqiT.exe
  2⤵
  PID:7176
- C:\Windows\System\ZoGqgxp.exe
  C:\Windows\System\ZoGqgxp.exe
  2⤵
  PID:7260
- C:\Windows\System\mGHKebZ.exe
  C:\Windows\System\mGHKebZ.exe
  2⤵
  PID:7428
- C:\Windows\System\jwxiUst.exe
  C:\Windows\System\jwxiUst.exe
  2⤵
  PID:7344
- C:\Windows\System\ZTTjLbc.exe
  C:\Windows\System\ZTTjLbc.exe
  2⤵
  PID:7368
- C:\Windows\System\WDDfHdI.exe
  C:\Windows\System\WDDfHdI.exe
  2⤵
  PID:7528
- C:\Windows\System\jAvcRxu.exe
  C:\Windows\System\jAvcRxu.exe
  2⤵
  PID:7608
- C:\Windows\System\HVEUvpo.exe
  C:\Windows\System\HVEUvpo.exe
  2⤵
  PID:7584
- C:\Windows\System\gvDklnR.exe
  C:\Windows\System\gvDklnR.exe
  2⤵
  PID:7744
- C:\Windows\System\XCOmehU.exe
  C:\Windows\System\XCOmehU.exe
  2⤵
  PID:7660
- C:\Windows\System\xiivFAU.exe
  C:\Windows\System\xiivFAU.exe
  2⤵
  PID:7856
- C:\Windows\System\iuUOrjJ.exe
  C:\Windows\System\iuUOrjJ.exe
  2⤵
  PID:7916
- C:\Windows\System\IdTiZoF.exe
  C:\Windows\System\IdTiZoF.exe
  2⤵
  PID:8044
- C:\Windows\System\iCrWbWt.exe
  C:\Windows\System\iCrWbWt.exe
  2⤵
  PID:8116
- C:\Windows\System\fGbkxEq.exe
  C:\Windows\System\fGbkxEq.exe
  2⤵
  PID:8056
- C:\Windows\System\jUcAXfe.exe
  C:\Windows\System\jUcAXfe.exe
  2⤵
  PID:8112
- C:\Windows\System\zptcnHS.exe
  C:\Windows\System\zptcnHS.exe
  2⤵
  PID:7300
- C:\Windows\System\kxIPPmC.exe
  C:\Windows\System\kxIPPmC.exe
  2⤵
  PID:7704
- C:\Windows\System\bOZIgff.exe
  C:\Windows\System\bOZIgff.exe
  2⤵
  PID:7328
- C:\Windows\System\ioDhMWQ.exe
  C:\Windows\System\ioDhMWQ.exe
  2⤵
  PID:7976
- C:\Windows\System\pmwLhLj.exe
  C:\Windows\System\pmwLhLj.exe
  2⤵
  PID:7700
- C:\Windows\System\iuNqYDJ.exe
  C:\Windows\System\iuNqYDJ.exe
  2⤵
  PID:8140
- C:\Windows\System\GPgbolj.exe
  C:\Windows\System\GPgbolj.exe
  2⤵
  PID:7464
- C:\Windows\System\QnOWLjx.exe
  C:\Windows\System\QnOWLjx.exe
  2⤵
  PID:8196
- C:\Windows\System\LmQqPdB.exe
  C:\Windows\System\LmQqPdB.exe
  2⤵
  PID:8220
- C:\Windows\System\JrmCjep.exe
  C:\Windows\System\JrmCjep.exe
  2⤵
  PID:8244
- C:\Windows\System\QnzSEeR.exe
  C:\Windows\System\QnzSEeR.exe
  2⤵
  PID:8272
- C:\Windows\System\PsSBLUK.exe
  C:\Windows\System\PsSBLUK.exe
  2⤵
  PID:8292
- C:\Windows\System\MQTYLWY.exe
  C:\Windows\System\MQTYLWY.exe
  2⤵
  PID:8324
- C:\Windows\System\sxDTPwQ.exe
  C:\Windows\System\sxDTPwQ.exe
  2⤵
  PID:8352
- C:\Windows\System\sbzmhCV.exe
  C:\Windows\System\sbzmhCV.exe
  2⤵
  PID:8380
- C:\Windows\System\NkXdkAF.exe
  C:\Windows\System\NkXdkAF.exe
  2⤵
  PID:8412
- C:\Windows\System\YWdfHDM.exe
  C:\Windows\System\YWdfHDM.exe
  2⤵
  PID:8444
- C:\Windows\System\KmLuVBD.exe
  C:\Windows\System\KmLuVBD.exe
  2⤵
  PID:8468
- C:\Windows\System\RysgEmA.exe
  C:\Windows\System\RysgEmA.exe
  2⤵
  PID:8500
- C:\Windows\System\QgknDbG.exe
  C:\Windows\System\QgknDbG.exe
  2⤵
  PID:8524
- C:\Windows\System\aXoamkW.exe
  C:\Windows\System\aXoamkW.exe
  2⤵
  PID:8552
- C:\Windows\System\cpgllNg.exe
  C:\Windows\System\cpgllNg.exe
  2⤵
  PID:8572
- C:\Windows\System\NwRhzlE.exe
  C:\Windows\System\NwRhzlE.exe
  2⤵
  PID:8608
- C:\Windows\System\oCTXMSb.exe
  C:\Windows\System\oCTXMSb.exe
  2⤵
  PID:8628
- C:\Windows\System\jFloyZz.exe
  C:\Windows\System\jFloyZz.exe
  2⤵
  PID:8652
- C:\Windows\System\QSepZMC.exe
  C:\Windows\System\QSepZMC.exe
  2⤵
  PID:8672
- C:\Windows\System\AfzlCQr.exe
  C:\Windows\System\AfzlCQr.exe
  2⤵
  PID:8696
- C:\Windows\System\smKKFBY.exe
  C:\Windows\System\smKKFBY.exe
  2⤵
  PID:8720
- C:\Windows\System\vFQGkpY.exe
  C:\Windows\System\vFQGkpY.exe
  2⤵
  PID:8744
- C:\Windows\System\BvgelKi.exe
  C:\Windows\System\BvgelKi.exe
  2⤵
  PID:8768
- C:\Windows\System\wKPzjxs.exe
  C:\Windows\System\wKPzjxs.exe
  2⤵
  PID:8796
- C:\Windows\System\AyeITbK.exe
  C:\Windows\System\AyeITbK.exe
  2⤵
  PID:8816
- C:\Windows\System\udcvGZJ.exe
  C:\Windows\System\udcvGZJ.exe
  2⤵
  PID:8848
- C:\Windows\System\TWcsFvl.exe
  C:\Windows\System\TWcsFvl.exe
  2⤵
  PID:8876
- C:\Windows\System\EveGqwm.exe
  C:\Windows\System\EveGqwm.exe
  2⤵
  PID:8900
- C:\Windows\System\FgQfLdw.exe
  C:\Windows\System\FgQfLdw.exe
  2⤵
  PID:8932
- C:\Windows\System\imTmuyf.exe
  C:\Windows\System\imTmuyf.exe
  2⤵
  PID:8960
- C:\Windows\System\tWBlCdg.exe
  C:\Windows\System\tWBlCdg.exe
  2⤵
  PID:8980
- C:\Windows\System\oXEVRmu.exe
  C:\Windows\System\oXEVRmu.exe
  2⤵
  PID:9008
- C:\Windows\System\nlRDBeC.exe
  C:\Windows\System\nlRDBeC.exe
  2⤵
  PID:9040
- C:\Windows\System\yRwRdSx.exe
  C:\Windows\System\yRwRdSx.exe
  2⤵
  PID:9080
- C:\Windows\System\DXsIRrt.exe
  C:\Windows\System\DXsIRrt.exe
  2⤵
  PID:9100
- C:\Windows\System\CpqpHMe.exe
  C:\Windows\System\CpqpHMe.exe
  2⤵
  PID:9124
- C:\Windows\System\CXtfXrK.exe
  C:\Windows\System\CXtfXrK.exe
  2⤵
  PID:9148
- C:\Windows\System\BYrqiRT.exe
  C:\Windows\System\BYrqiRT.exe
  2⤵
  PID:9176
- C:\Windows\System\KKNMprb.exe
  C:\Windows\System\KKNMprb.exe
  2⤵
  PID:9208
- C:\Windows\System\lpNOKrI.exe
  C:\Windows\System\lpNOKrI.exe
  2⤵
  PID:8016
- C:\Windows\System\IqrEMRP.exe
  C:\Windows\System\IqrEMRP.exe
  2⤵
  PID:2556
- C:\Windows\System\iWmGgSx.exe
  C:\Windows\System\iWmGgSx.exe
  2⤵
  PID:8256
- C:\Windows\System\mJMjaSE.exe
  C:\Windows\System\mJMjaSE.exe
  2⤵
  PID:8404
- C:\Windows\System\QHWyHxE.exe
  C:\Windows\System\QHWyHxE.exe
  2⤵
  PID:8312
- C:\Windows\System\ZEMUDDK.exe
  C:\Windows\System\ZEMUDDK.exe
  2⤵
  PID:8340
- C:\Windows\System\PvfTavK.exe
  C:\Windows\System\PvfTavK.exe
  2⤵
  PID:8344
- C:\Windows\System\EtGRpRS.exe
  C:\Windows\System\EtGRpRS.exe
  2⤵
  PID:8644
- C:\Windows\System\dwiKvMl.exe
  C:\Windows\System\dwiKvMl.exe
  2⤵
  PID:8476
- C:\Windows\System\rKQynoe.exe
  C:\Windows\System\rKQynoe.exe
  2⤵
  PID:8740
- C:\Windows\System\lWeoVQs.exe
  C:\Windows\System\lWeoVQs.exe
  2⤵
  PID:8812
- C:\Windows\System\OStlpav.exe
  C:\Windows\System\OStlpav.exe
  2⤵
  PID:8688
- C:\Windows\System\ILlNkQs.exe
  C:\Windows\System\ILlNkQs.exe
  2⤵
  PID:8872
- C:\Windows\System\YyTHlyq.exe
  C:\Windows\System\YyTHlyq.exe
  2⤵
  PID:8912
- C:\Windows\System\qMCRfIR.exe
  C:\Windows\System\qMCRfIR.exe
  2⤵
  PID:8928
- C:\Windows\System\bAeOXaB.exe
  C:\Windows\System\bAeOXaB.exe
  2⤵
  PID:9184
- C:\Windows\System\PgDELmZ.exe
  C:\Windows\System\PgDELmZ.exe
  2⤵
  PID:8092
- C:\Windows\System\LcAkWGG.exe
  C:\Windows\System\LcAkWGG.exe
  2⤵
  PID:9060
- C:\Windows\System\dzaNyEI.exe
  C:\Windows\System\dzaNyEI.exe
  2⤵
  PID:9096
- C:\Windows\System\yDZNnyP.exe
  C:\Windows\System\yDZNnyP.exe
  2⤵
  PID:8204
- C:\Windows\System\nCuvmmc.exe
  C:\Windows\System\nCuvmmc.exe
  2⤵
  PID:9144
- C:\Windows\System\CZdwpAk.exe
  C:\Windows\System\CZdwpAk.exe
  2⤵
  PID:8004
- C:\Windows\System\bRGzkyb.exe
  C:\Windows\System\bRGzkyb.exe
  2⤵
  PID:8536
- C:\Windows\System\rGZiiSJ.exe
  C:\Windows\System\rGZiiSJ.exe
  2⤵
  PID:8868
- C:\Windows\System\hQEapzO.exe
  C:\Windows\System\hQEapzO.exe
  2⤵
  PID:9048
- C:\Windows\System\mIpUDsw.exe
  C:\Windows\System\mIpUDsw.exe
  2⤵
  PID:9240
- C:\Windows\System\BKpkoTf.exe
  C:\Windows\System\BKpkoTf.exe
  2⤵
  PID:9264
- C:\Windows\System\ouGVOcy.exe
  C:\Windows\System\ouGVOcy.exe
  2⤵
  PID:9292
- C:\Windows\System\QHxEBUA.exe
  C:\Windows\System\QHxEBUA.exe
  2⤵
  PID:9320
- C:\Windows\System\IZoEPPi.exe
  C:\Windows\System\IZoEPPi.exe
  2⤵
  PID:9420
- C:\Windows\System\dlvykoG.exe
  C:\Windows\System\dlvykoG.exe
  2⤵
  PID:9444
- C:\Windows\System\VnjMabU.exe
  C:\Windows\System\VnjMabU.exe
  2⤵
  PID:9472
- C:\Windows\System\HLQRfNe.exe
  C:\Windows\System\HLQRfNe.exe
  2⤵
  PID:9496
- C:\Windows\System\MZAmCbS.exe
  C:\Windows\System\MZAmCbS.exe
  2⤵
  PID:9524
- C:\Windows\System\eNXtzUD.exe
  C:\Windows\System\eNXtzUD.exe
  2⤵
  PID:9552
- C:\Windows\System\EacfxGt.exe
  C:\Windows\System\EacfxGt.exe
  2⤵
  PID:9588
- C:\Windows\System\vRAXdcZ.exe
  C:\Windows\System\vRAXdcZ.exe
  2⤵
  PID:9612
- C:\Windows\System\LUeZXNQ.exe
  C:\Windows\System\LUeZXNQ.exe
  2⤵
  PID:9640
- C:\Windows\System\OPNssaF.exe
  C:\Windows\System\OPNssaF.exe
  2⤵
  PID:9668
- C:\Windows\System\DAycxFj.exe
  C:\Windows\System\DAycxFj.exe
  2⤵
  PID:9684
- C:\Windows\System\JReIRxE.exe
  C:\Windows\System\JReIRxE.exe
  2⤵
  PID:9716
- C:\Windows\System\bJYPhDB.exe
  C:\Windows\System\bJYPhDB.exe
  2⤵
  PID:9736
- C:\Windows\System\niqKWJB.exe
  C:\Windows\System\niqKWJB.exe
  2⤵
  PID:9768
- C:\Windows\System\NTqruDD.exe
  C:\Windows\System\NTqruDD.exe
  2⤵
  PID:9796
- C:\Windows\System\YgqATxz.exe
  C:\Windows\System\YgqATxz.exe
  2⤵
  PID:9824
- C:\Windows\System\BHdhOWX.exe
  C:\Windows\System\BHdhOWX.exe
  2⤵
  PID:9844
- C:\Windows\System\RKOoGCx.exe
  C:\Windows\System\RKOoGCx.exe
  2⤵
  PID:9864
- C:\Windows\System\eXCxhqZ.exe
  C:\Windows\System\eXCxhqZ.exe
  2⤵
  PID:9892
- C:\Windows\System\cHejmUT.exe
  C:\Windows\System\cHejmUT.exe
  2⤵
  PID:9916
- C:\Windows\System\tieskXC.exe
  C:\Windows\System\tieskXC.exe
  2⤵
  PID:9952
- C:\Windows\System\VblVUwo.exe
  C:\Windows\System\VblVUwo.exe
  2⤵
  PID:9972
- C:\Windows\System\dXTVqPL.exe
  C:\Windows\System\dXTVqPL.exe
  2⤵
  PID:10004
- C:\Windows\System\zIVEwWC.exe
  C:\Windows\System\zIVEwWC.exe
  2⤵
  PID:10032
- C:\Windows\System\ZMZOlHJ.exe
  C:\Windows\System\ZMZOlHJ.exe
  2⤵
  PID:10052
- C:\Windows\System\XzhPROI.exe
  C:\Windows\System\XzhPROI.exe
  2⤵
  PID:10072
- C:\Windows\System\cFpCxlR.exe
  C:\Windows\System\cFpCxlR.exe
  2⤵
  PID:10100
- C:\Windows\System\uJEmxWD.exe
  C:\Windows\System\uJEmxWD.exe
  2⤵
  PID:10124
- C:\Windows\System\dUmzFmI.exe
  C:\Windows\System\dUmzFmI.exe
  2⤵
  PID:10156
- C:\Windows\System\XczBinW.exe
  C:\Windows\System\XczBinW.exe
  2⤵
  PID:10176
- C:\Windows\System\wfdZfjI.exe
  C:\Windows\System\wfdZfjI.exe
  2⤵
  PID:10208
- C:\Windows\System\ghcLSCe.exe
  C:\Windows\System\ghcLSCe.exe
  2⤵
  PID:10228
- C:\Windows\System\VFHQeQQ.exe
  C:\Windows\System\VFHQeQQ.exe
  2⤵
  PID:8840
- C:\Windows\System\vESbxrx.exe
  C:\Windows\System\vESbxrx.exe
  2⤵
  PID:9232
- C:\Windows\System\KqrPwxF.exe
  C:\Windows\System\KqrPwxF.exe
  2⤵
  PID:8624
- C:\Windows\System\IRMdNGV.exe
  C:\Windows\System\IRMdNGV.exe
  2⤵
  PID:8456
- C:\Windows\System\MzPauJk.exe
  C:\Windows\System\MzPauJk.exe
  2⤵
  PID:8400
- C:\Windows\System\RJYwOYt.exe
  C:\Windows\System\RJYwOYt.exe
  2⤵
  PID:9228
- C:\Windows\System\vILszzu.exe
  C:\Windows\System\vILszzu.exe
  2⤵
  PID:9468
- C:\Windows\System\RYswYqw.exe
  C:\Windows\System\RYswYqw.exe
  2⤵
  PID:9440
- C:\Windows\System\IvJNwab.exe
  C:\Windows\System\IvJNwab.exe
  2⤵
  PID:9512
- C:\Windows\System\twtmfIL.exe
  C:\Windows\System\twtmfIL.exe
  2⤵
  PID:9676
- C:\Windows\System\wMNBeKG.exe
  C:\Windows\System\wMNBeKG.exe
  2⤵
  PID:9544
- C:\Windows\System\niwaoOL.exe
  C:\Windows\System\niwaoOL.exe
  2⤵
  PID:9776
- C:\Windows\System\lnvQswf.exe
  C:\Windows\System\lnvQswf.exe
  2⤵
  PID:9808
- C:\Windows\System\YxZguvB.exe
  C:\Windows\System\YxZguvB.exe
  2⤵
  PID:9880
- C:\Windows\System\hgBYiOm.exe
  C:\Windows\System\hgBYiOm.exe
  2⤵
  PID:9832
- C:\Windows\System\BgwZAiN.exe
  C:\Windows\System\BgwZAiN.exe
  2⤵
  PID:10024
- C:\Windows\System\bkCYBpu.exe
  C:\Windows\System\bkCYBpu.exe
  2⤵
  PID:9852
- C:\Windows\System\JgnXfdW.exe
  C:\Windows\System\JgnXfdW.exe
  2⤵
  PID:9888
- C:\Windows\System\wWWkTZO.exe
  C:\Windows\System\wWWkTZO.exe
  2⤵
  PID:9960
- C:\Windows\System\HIwTcVB.exe
  C:\Windows\System\HIwTcVB.exe
  2⤵
  PID:10164
- C:\Windows\System\NNjsxHf.exe
  C:\Windows\System\NNjsxHf.exe
  2⤵
  PID:8780
- C:\Windows\System\CBmvHUz.exe
  C:\Windows\System\CBmvHUz.exe
  2⤵
  PID:7420
- C:\Windows\System\sGzuxqM.exe
  C:\Windows\System\sGzuxqM.exe
  2⤵
  PID:9652
- C:\Windows\System\cdebZzH.exe
  C:\Windows\System\cdebZzH.exe
  2⤵
  PID:8168
- C:\Windows\System\OtcSwJA.exe
  C:\Windows\System\OtcSwJA.exe
  2⤵
  PID:10012
- C:\Windows\System\FiVWKku.exe
  C:\Windows\System\FiVWKku.exe
  2⤵
  PID:9680
- C:\Windows\System\zBVLYjO.exe
  C:\Windows\System\zBVLYjO.exe
  2⤵
  PID:9056
- C:\Windows\System\iEYlcuU.exe
  C:\Windows\System\iEYlcuU.exe
  2⤵
  PID:9360
- C:\Windows\System\XlYjTbN.exe
  C:\Windows\System\XlYjTbN.exe
  2⤵
  PID:9540
- C:\Windows\System\UfCzhiO.exe
  C:\Windows\System\UfCzhiO.exe
  2⤵
  PID:10260
- C:\Windows\System\rHAQojz.exe
  C:\Windows\System\rHAQojz.exe
  2⤵
  PID:10276
- C:\Windows\System\nLrvHbh.exe
  C:\Windows\System\nLrvHbh.exe
  2⤵
  PID:10312
- C:\Windows\System\JUvfyaT.exe
  C:\Windows\System\JUvfyaT.exe
  2⤵
  PID:10328
- C:\Windows\System\LhgHUmb.exe
  C:\Windows\System\LhgHUmb.exe
  2⤵
  PID:10344
- C:\Windows\System\YVWmFIO.exe
  C:\Windows\System\YVWmFIO.exe
  2⤵
  PID:10368
- C:\Windows\System\SeirDdG.exe
  C:\Windows\System\SeirDdG.exe
  2⤵
  PID:10392
- C:\Windows\System\CfdgGfV.exe
  C:\Windows\System\CfdgGfV.exe
  2⤵
  PID:10408
- C:\Windows\System\SUJkwLQ.exe
  C:\Windows\System\SUJkwLQ.exe
  2⤵
  PID:10432
- C:\Windows\System\lMuWzfT.exe
  C:\Windows\System\lMuWzfT.exe
  2⤵
  PID:10468
- C:\Windows\System\jpwjDgE.exe
  C:\Windows\System\jpwjDgE.exe
  2⤵
  PID:10500
- C:\Windows\System\GuWKWsF.exe
  C:\Windows\System\GuWKWsF.exe
  2⤵
  PID:10528
- C:\Windows\System\uaoYcQQ.exe
  C:\Windows\System\uaoYcQQ.exe
  2⤵
  PID:10552
- C:\Windows\System\pSpUpgA.exe
  C:\Windows\System\pSpUpgA.exe
  2⤵
  PID:10588
- C:\Windows\System\uTcyByN.exe
  C:\Windows\System\uTcyByN.exe
  2⤵
  PID:10620
- C:\Windows\System\tkIRmyA.exe
  C:\Windows\System\tkIRmyA.exe
  2⤵
  PID:10724
- C:\Windows\System\yKbujzl.exe
  C:\Windows\System\yKbujzl.exe
  2⤵
  PID:10868
- C:\Windows\System\PJXbbpM.exe
  C:\Windows\System\PJXbbpM.exe
  2⤵
  PID:10900
- C:\Windows\System\uqNQBHV.exe
  C:\Windows\System\uqNQBHV.exe
  2⤵
  PID:10920
- C:\Windows\System\nuSbFvB.exe
  C:\Windows\System\nuSbFvB.exe
  2⤵
  PID:10952
- C:\Windows\System\QyxGkrd.exe
  C:\Windows\System\QyxGkrd.exe
  2⤵
  PID:10980
- C:\Windows\System\CzzNqMx.exe
  C:\Windows\System\CzzNqMx.exe
  2⤵
  PID:10996
- C:\Windows\System\wnuWAqC.exe
  C:\Windows\System\wnuWAqC.exe
  2⤵
  PID:11016
- C:\Windows\System\wjFdCGp.exe
  C:\Windows\System\wjFdCGp.exe
  2⤵
  PID:11044
- C:\Windows\System\fNCjbZd.exe
  C:\Windows\System\fNCjbZd.exe
  2⤵
  PID:11060
- C:\Windows\System\IuESpHg.exe
  C:\Windows\System\IuESpHg.exe
  2⤵
  PID:11088
- C:\Windows\System\EFLOfaw.exe
  C:\Windows\System\EFLOfaw.exe
  2⤵
  PID:11116
- C:\Windows\System\hjPkuQc.exe
  C:\Windows\System\hjPkuQc.exe
  2⤵
  PID:11144
- C:\Windows\System\jlJnerZ.exe
  C:\Windows\System\jlJnerZ.exe
  2⤵
  PID:11180
- C:\Windows\System\ddMQurY.exe
  C:\Windows\System\ddMQurY.exe
  2⤵
  PID:11204
- C:\Windows\System\hxlOvPD.exe
  C:\Windows\System\hxlOvPD.exe
  2⤵
  PID:11228
- C:\Windows\System\BzLNdcb.exe
  C:\Windows\System\BzLNdcb.exe
  2⤵
  PID:11244
- C:\Windows\System\GPJTcBU.exe
  C:\Windows\System\GPJTcBU.exe
  2⤵
  PID:11260
- C:\Windows\System\iiXZUYT.exe
  C:\Windows\System\iiXZUYT.exe
  2⤵
  PID:9936
- C:\Windows\System\YOmjuWf.exe
  C:\Windows\System\YOmjuWf.exe
  2⤵
  PID:10168
- C:\Windows\System\ZSzQMyW.exe
  C:\Windows\System\ZSzQMyW.exe
  2⤵
  PID:9628
- C:\Windows\System\ZyaUZBK.exe
  C:\Windows\System\ZyaUZBK.exe
  2⤵
  PID:9712
- C:\Windows\System\IawwEhq.exe
  C:\Windows\System\IawwEhq.exe
  2⤵
  PID:10340
- C:\Windows\System\AbhSiyI.exe
  C:\Windows\System\AbhSiyI.exe
  2⤵
  PID:10268
- C:\Windows\System\sZUsnDo.exe
  C:\Windows\System\sZUsnDo.exe
  2⤵
  PID:10656
- C:\Windows\System\nkmAlwP.exe
  C:\Windows\System\nkmAlwP.exe
  2⤵
  PID:10684
- C:\Windows\System\JGxHeIY.exe
  C:\Windows\System\JGxHeIY.exe
  2⤵
  PID:10704
- C:\Windows\System\ViqLSJy.exe
  C:\Windows\System\ViqLSJy.exe
  2⤵
  PID:10292
- C:\Windows\System\QgcGopQ.exe
  C:\Windows\System\QgcGopQ.exe
  2⤵
  PID:10540
- C:\Windows\System\scxgLwo.exe
  C:\Windows\System\scxgLwo.exe
  2⤵
  PID:10400
- C:\Windows\System\Dmvuhaw.exe
  C:\Windows\System\Dmvuhaw.exe
  2⤵
  PID:10644
- C:\Windows\System\GiHSbVV.exe
  C:\Windows\System\GiHSbVV.exe
  2⤵
  PID:11052
- C:\Windows\System\uohgqmN.exe
  C:\Windows\System\uohgqmN.exe
  2⤵
  PID:11128
- C:\Windows\System\WLDWHdc.exe
  C:\Windows\System\WLDWHdc.exe
  2⤵
  PID:10572
- C:\Windows\System\BAPWJHh.exe
  C:\Windows\System\BAPWJHh.exe
  2⤵
  PID:10600
- C:\Windows\System\wtfGcug.exe
  C:\Windows\System\wtfGcug.exe
  2⤵
  PID:11240
- C:\Windows\System\TgQHTQK.exe
  C:\Windows\System\TgQHTQK.exe
  2⤵
  PID:10860
- C:\Windows\System\UzRRpya.exe
  C:\Windows\System\UzRRpya.exe
  2⤵
  PID:10088
- C:\Windows\System\jdcrsmV.exe
  C:\Windows\System\jdcrsmV.exe
  2⤵
  PID:10492
- C:\Windows\System\QrgmLvv.exe
  C:\Windows\System\QrgmLvv.exe
  2⤵
  PID:10664
- C:\Windows\System\qxPWdvC.exe
  C:\Windows\System\qxPWdvC.exe
  2⤵
  PID:11012
- C:\Windows\System\yDbOIOc.exe
  C:\Windows\System\yDbOIOc.exe
  2⤵
  PID:11296
- C:\Windows\System\fITaSCl.exe
  C:\Windows\System\fITaSCl.exe
  2⤵
  PID:11332
- C:\Windows\System\pFKUcvr.exe
  C:\Windows\System\pFKUcvr.exe
  2⤵
  PID:11360
- C:\Windows\System\WqNLezQ.exe
  C:\Windows\System\WqNLezQ.exe
  2⤵
  PID:11388
- C:\Windows\System\YKGUzDR.exe
  C:\Windows\System\YKGUzDR.exe
  2⤵
  PID:11412
- C:\Windows\System\mwgNDuO.exe
  C:\Windows\System\mwgNDuO.exe
  2⤵
  PID:11428
- C:\Windows\System\XJrOylq.exe
  C:\Windows\System\XJrOylq.exe
  2⤵
  PID:11452
- C:\Windows\System\maiQwEb.exe
  C:\Windows\System\maiQwEb.exe
  2⤵
  PID:11476
- C:\Windows\System\HAufXIX.exe
  C:\Windows\System\HAufXIX.exe
  2⤵
  PID:11500
- C:\Windows\System\rzbmEWX.exe
  C:\Windows\System\rzbmEWX.exe
  2⤵
  PID:11520
- C:\Windows\System\IYArhgj.exe
  C:\Windows\System\IYArhgj.exe
  2⤵
  PID:11536
- C:\Windows\System\HGUEXSu.exe
  C:\Windows\System\HGUEXSu.exe
  2⤵
  PID:11556
- C:\Windows\System\BCvPKYg.exe
  C:\Windows\System\BCvPKYg.exe
  2⤵
  PID:11576
- C:\Windows\System\OHJJBMJ.exe
  C:\Windows\System\OHJJBMJ.exe
  2⤵
  PID:11612
- C:\Windows\System\ybVVaQJ.exe
  C:\Windows\System\ybVVaQJ.exe
  2⤵
  PID:11640
- C:\Windows\System\uRtPKmB.exe
  C:\Windows\System\uRtPKmB.exe
  2⤵
  PID:11660
- C:\Windows\System\mbmhpIe.exe
  C:\Windows\System\mbmhpIe.exe
  2⤵
  PID:11680
- C:\Windows\System\cFDdMZR.exe
  C:\Windows\System\cFDdMZR.exe
  2⤵
  PID:11704
- C:\Windows\System\usAAtqx.exe
  C:\Windows\System\usAAtqx.exe
  2⤵
  PID:11728
- C:\Windows\System\qqHuzvt.exe
  C:\Windows\System\qqHuzvt.exe
  2⤵
  PID:11752
- C:\Windows\System\jjIYQvn.exe
  C:\Windows\System\jjIYQvn.exe
  2⤵
  PID:11780
- C:\Windows\System\hUnaydT.exe
  C:\Windows\System\hUnaydT.exe
  2⤵
  PID:11800
- C:\Windows\System\DosznzR.exe
  C:\Windows\System\DosznzR.exe
  2⤵
  PID:11824
- C:\Windows\System\FjVnAAR.exe
  C:\Windows\System\FjVnAAR.exe
  2⤵
  PID:11848
- C:\Windows\System\ffrOcon.exe
  C:\Windows\System\ffrOcon.exe
  2⤵
  PID:11868
- C:\Windows\System\ZStflYY.exe
  C:\Windows\System\ZStflYY.exe
  2⤵
  PID:11900
- C:\Windows\System\TvTisgV.exe
  C:\Windows\System\TvTisgV.exe
  2⤵
  PID:11920
- C:\Windows\System\FDQkbUH.exe
  C:\Windows\System\FDQkbUH.exe
  2⤵
  PID:11952
- C:\Windows\System\ocSfnrF.exe
  C:\Windows\System\ocSfnrF.exe
  2⤵
  PID:11980
- C:\Windows\System\cfzuXoi.exe
  C:\Windows\System\cfzuXoi.exe
  2⤵
  PID:12012
- C:\Windows\System\hUJUNxN.exe
  C:\Windows\System\hUJUNxN.exe
  2⤵
  PID:12036
- C:\Windows\System\nocoAGI.exe
  C:\Windows\System\nocoAGI.exe
  2⤵
  PID:12056
- C:\Windows\System\kbGjCvz.exe
  C:\Windows\System\kbGjCvz.exe
  2⤵
  PID:12080
- C:\Windows\System\nDPFAvh.exe
  C:\Windows\System\nDPFAvh.exe
  2⤵
  PID:12116
- C:\Windows\System\rzEquFv.exe
  C:\Windows\System\rzEquFv.exe
  2⤵
  PID:12140
- C:\Windows\System\qvqgtiw.exe
  C:\Windows\System\qvqgtiw.exe
  2⤵
  PID:12160
- C:\Windows\System\BNzDirF.exe
  C:\Windows\System\BNzDirF.exe
  2⤵
  PID:12176
- C:\Windows\System\FsDnfoY.exe
  C:\Windows\System\FsDnfoY.exe
  2⤵
  PID:12196
- C:\Windows\System\gwkNFMH.exe
  C:\Windows\System\gwkNFMH.exe
  2⤵
  PID:12224
- C:\Windows\System\cingSMR.exe
  C:\Windows\System\cingSMR.exe
  2⤵
  PID:12248
- C:\Windows\System\smTBPuo.exe
  C:\Windows\System\smTBPuo.exe
  2⤵
  PID:12272
- C:\Windows\System\MSTprpV.exe
  C:\Windows\System\MSTprpV.exe
  2⤵
  PID:11080
- C:\Windows\System\HKboHBX.exe
  C:\Windows\System\HKboHBX.exe
  2⤵
  PID:11172
- C:\Windows\System\dlhbVHg.exe
  C:\Windows\System\dlhbVHg.exe
  2⤵
  PID:10272
- C:\Windows\System\ELDHxDO.exe
  C:\Windows\System\ELDHxDO.exe
  2⤵
  PID:10668
- C:\Windows\System\VTspdMM.exe
  C:\Windows\System\VTspdMM.exe
  2⤵
  PID:9944
- C:\Windows\System\oXfTXxI.exe
  C:\Windows\System\oXfTXxI.exe
  2⤵
  PID:11352
- C:\Windows\System\KvUoGbt.exe
  C:\Windows\System\KvUoGbt.exe
  2⤵
  PID:11104
- C:\Windows\System\TrLlknO.exe
  C:\Windows\System\TrLlknO.exe
  2⤵
  PID:10648
- C:\Windows\System\IJolwFy.exe
  C:\Windows\System\IJolwFy.exe
  2⤵
  PID:11096
- C:\Windows\System\rMrvUyB.exe
  C:\Windows\System\rMrvUyB.exe
  2⤵
  PID:11604
- C:\Windows\System\ksoFbgI.exe
  C:\Windows\System\ksoFbgI.exe
  2⤵
  PID:10380
- C:\Windows\System\UaOZexU.exe
  C:\Windows\System\UaOZexU.exe
  2⤵
  PID:11408
- C:\Windows\System\FltockA.exe
  C:\Windows\System\FltockA.exe
  2⤵
  PID:11436
- C:\Windows\System\hIfVpYz.exe
  C:\Windows\System\hIfVpYz.exe
  2⤵
  PID:11496
- C:\Windows\System\ldnBEzp.exe
  C:\Windows\System\ldnBEzp.exe
  2⤵
  PID:11820
- C:\Windows\System\SKpVsUo.exe
  C:\Windows\System\SKpVsUo.exe
  2⤵
  PID:11008
- C:\Windows\System\aeuDrcH.exe
  C:\Windows\System\aeuDrcH.exe
  2⤵
  PID:11320
- C:\Windows\System\rrBgxAw.exe
  C:\Windows\System\rrBgxAw.exe
  2⤵
  PID:11908
- C:\Windows\System\gKqiBkm.exe
  C:\Windows\System\gKqiBkm.exe
  2⤵
  PID:11948
- C:\Windows\System\cMJJqnx.exe
  C:\Windows\System\cMJJqnx.exe
  2⤵
  PID:12024
- C:\Windows\System\dHrvihd.exe
  C:\Windows\System\dHrvihd.exe
  2⤵
  PID:10832
- C:\Windows\System\VvxnhaO.exe
  C:\Windows\System\VvxnhaO.exe
  2⤵
  PID:12104
- C:\Windows\System\eCOdiwz.exe
  C:\Windows\System\eCOdiwz.exe
  2⤵
  PID:12268
- C:\Windows\System\UtrHxWv.exe
  C:\Windows\System\UtrHxWv.exe
  2⤵
  PID:11160
- C:\Windows\System\vEAluKm.exe
  C:\Windows\System\vEAluKm.exe
  2⤵
  PID:10616
- C:\Windows\System\LUxHTYN.exe
  C:\Windows\System\LUxHTYN.exe
  2⤵
  PID:12112
- C:\Windows\System\MiffzZn.exe
  C:\Windows\System\MiffzZn.exe
  2⤵
  PID:10716
- C:\Windows\System\wnIRaZD.exe
  C:\Windows\System\wnIRaZD.exe
  2⤵
  PID:12292
- C:\Windows\System\nQnQikP.exe
  C:\Windows\System\nQnQikP.exe
  2⤵
  PID:12328
- C:\Windows\System\FJqfjkk.exe
  C:\Windows\System\FJqfjkk.exe
  2⤵
  PID:12352
- C:\Windows\System\EvMNpfH.exe
  C:\Windows\System\EvMNpfH.exe
  2⤵
  PID:12368
- C:\Windows\System\QRitWcW.exe
  C:\Windows\System\QRitWcW.exe
  2⤵
  PID:12400
- C:\Windows\System\EUUuvRg.exe
  C:\Windows\System\EUUuvRg.exe
  2⤵
  PID:12428
- C:\Windows\System\owCMsIn.exe
  C:\Windows\System\owCMsIn.exe
  2⤵
  PID:12448
- C:\Windows\System\muGcvha.exe
  C:\Windows\System\muGcvha.exe
  2⤵
  PID:12480
- C:\Windows\System\wpzCXyt.exe
  C:\Windows\System\wpzCXyt.exe
  2⤵
  PID:12504
- C:\Windows\System\uRTpWNy.exe
  C:\Windows\System\uRTpWNy.exe
  2⤵
  PID:12524
- C:\Windows\System\emTlMsB.exe
  C:\Windows\System\emTlMsB.exe
  2⤵
  PID:12548
- C:\Windows\System\KXETDkU.exe
  C:\Windows\System\KXETDkU.exe
  2⤵
  PID:12564
- C:\Windows\System\zyTWWAH.exe
  C:\Windows\System\zyTWWAH.exe
  2⤵
  PID:12588
- C:\Windows\System\LTIrXKe.exe
  C:\Windows\System\LTIrXKe.exe
  2⤵
  PID:12620
- C:\Windows\System\gEDDYGz.exe
  C:\Windows\System\gEDDYGz.exe
  2⤵
  PID:12648
- C:\Windows\System\qNCBwaJ.exe
  C:\Windows\System\qNCBwaJ.exe
  2⤵
  PID:12680
- C:\Windows\System\tqqbSOV.exe
  C:\Windows\System\tqqbSOV.exe
  2⤵
  PID:12716
- C:\Windows\System\wTcRrwH.exe
  C:\Windows\System\wTcRrwH.exe
  2⤵
  PID:12748
- C:\Windows\System\ZXJsUsQ.exe
  C:\Windows\System\ZXJsUsQ.exe
  2⤵
  PID:12768
- C:\Windows\System\MKJLXMn.exe
  C:\Windows\System\MKJLXMn.exe
  2⤵
  PID:12796
- C:\Windows\System\TQOjuGW.exe
  C:\Windows\System\TQOjuGW.exe
  2⤵
  PID:12824
- C:\Windows\System\wBBNDgM.exe
  C:\Windows\System\wBBNDgM.exe
  2⤵
  PID:12852
- C:\Windows\System\LtBwbbG.exe
  C:\Windows\System\LtBwbbG.exe
  2⤵
  PID:12888
- C:\Windows\System\EWEJUag.exe
  C:\Windows\System\EWEJUag.exe
  2⤵
  PID:12904
- C:\Windows\System\wQlvqYI.exe
  C:\Windows\System\wQlvqYI.exe
  2⤵
  PID:12932
- C:\Windows\System\pwEZJCW.exe
  C:\Windows\System\pwEZJCW.exe
  2⤵
  PID:12964
- C:\Windows\System\jkIBkEX.exe
  C:\Windows\System\jkIBkEX.exe
  2⤵
  PID:12992
- C:\Windows\System\sZvPvxm.exe
  C:\Windows\System\sZvPvxm.exe
  2⤵
  PID:13016
- C:\Windows\System\oFuUysG.exe
  C:\Windows\System\oFuUysG.exe
  2⤵
  PID:13044
- C:\Windows\System\HarARMh.exe
  C:\Windows\System\HarARMh.exe
  2⤵
  PID:13072
- C:\Windows\System\xlVTGpj.exe
  C:\Windows\System\xlVTGpj.exe
  2⤵
  PID:13100
- C:\Windows\System\oeHAnNb.exe
  C:\Windows\System\oeHAnNb.exe
  2⤵
  PID:13120
- C:\Windows\System\zrWBpcx.exe
  C:\Windows\System\zrWBpcx.exe
  2⤵
  PID:13140
- C:\Windows\System\kcGLEKG.exe
  C:\Windows\System\kcGLEKG.exe
  2⤵
  PID:13168
- C:\Windows\System\oQFIQha.exe
  C:\Windows\System\oQFIQha.exe
  2⤵
  PID:13204
- C:\Windows\System\ZtbcEaH.exe
  C:\Windows\System\ZtbcEaH.exe
  2⤵
  PID:13224
- C:\Windows\System\oBxpeRF.exe
  C:\Windows\System\oBxpeRF.exe
  2⤵
  PID:13248
- C:\Windows\System\ndVrBqv.exe
  C:\Windows\System\ndVrBqv.exe
  2⤵
  PID:13272
- C:\Windows\System\EeABgFH.exe
  C:\Windows\System\EeABgFH.exe
  2⤵
  PID:13308
- C:\Windows\System\epEJNAh.exe
  C:\Windows\System\epEJNAh.exe
  2⤵
  PID:11816
- C:\Windows\System\vxXWrZf.exe
  C:\Windows\System\vxXWrZf.exe
  2⤵
  PID:10640
- C:\Windows\System\RvhkSAQ.exe
  C:\Windows\System\RvhkSAQ.exe
  2⤵
  PID:12044
- C:\Windows\System\ZNcXqpP.exe
  C:\Windows\System\ZNcXqpP.exe
  2⤵
  PID:11628
- C:\Windows\System\KJbdZNQ.exe
  C:\Windows\System\KJbdZNQ.exe
  2⤵
  PID:12244
- C:\Windows\System\qKUMAnr.exe
  C:\Windows\System\qKUMAnr.exe
  2⤵
  PID:11596
- C:\Windows\System\nPYPZzD.exe
  C:\Windows\System\nPYPZzD.exe
  2⤵
  PID:12440
- C:\Windows\System\IVoQXpy.exe
  C:\Windows\System\IVoQXpy.exe
  2⤵
  PID:12004
- C:\Windows\System\pFZkxDk.exe
  C:\Windows\System\pFZkxDk.exe
  2⤵
  PID:12560
- C:\Windows\System\EKQyLyE.exe
  C:\Windows\System\EKQyLyE.exe
  2⤵
  PID:11768
- C:\Windows\System\lfCzQwd.exe
  C:\Windows\System\lfCzQwd.exe
  2⤵
  PID:12632
- C:\Windows\System\NQtLFfc.exe
  C:\Windows\System\NQtLFfc.exe
  2⤵
  PID:12692
- C:\Windows\System\XedojKK.exe
  C:\Windows\System\XedojKK.exe
  2⤵
  PID:12344
- C:\Windows\System\JVqZLRW.exe
  C:\Windows\System\JVqZLRW.exe
  2⤵
  PID:12812
- C:\Windows\System\XCXAMCh.exe
  C:\Windows\System\XCXAMCh.exe
  2⤵
  PID:12472
- C:\Windows\System\UIPTSkG.exe
  C:\Windows\System\UIPTSkG.exe
  2⤵
  PID:12928
- C:\Windows\System\JmPcVrN.exe
  C:\Windows\System\JmPcVrN.exe
  2⤵
  PID:11888
- C:\Windows\System\YbrNSsZ.exe
  C:\Windows\System\YbrNSsZ.exe
  2⤵
  PID:12604
- C:\Windows\System\RhxgweX.exe
  C:\Windows\System\RhxgweX.exe
  2⤵
  PID:13136
- C:\Windows\System\bCPYmtM.exe
  C:\Windows\System\bCPYmtM.exe
  2⤵
  PID:13188
- C:\Windows\System\ovQhnMF.exe
  C:\Windows\System\ovQhnMF.exe
  2⤵
  PID:13236
- C:\Windows\System\EjHsHIQ.exe
  C:\Windows\System\EjHsHIQ.exe
  2⤵
  PID:11192
- C:\Windows\System\wuTrgXC.exe
  C:\Windows\System\wuTrgXC.exe
  2⤵
  PID:13012
- C:\Windows\System\ZMUyQUR.exe
  C:\Windows\System\ZMUyQUR.exe
  2⤵
  PID:12460
- C:\Windows\System\eMjfuQy.exe
  C:\Windows\System\eMjfuQy.exe
  2⤵
  PID:13112
- C:\Windows\System\NWcJQMJ.exe
  C:\Windows\System\NWcJQMJ.exe
  2⤵
  PID:13336
- C:\Windows\System\XYBlCwd.exe
  C:\Windows\System\XYBlCwd.exe
  2⤵
  PID:13356
- C:\Windows\System\TaMLuzl.exe
  C:\Windows\System\TaMLuzl.exe
  2⤵
  PID:13384
- C:\Windows\System\ZYWYPUN.exe
  C:\Windows\System\ZYWYPUN.exe
  2⤵
  PID:13412
- C:\Windows\System\kGBzyWW.exe
  C:\Windows\System\kGBzyWW.exe
  2⤵
  PID:13436
- C:\Windows\System\pgKTwdr.exe
  C:\Windows\System\pgKTwdr.exe
  2⤵
  PID:13460
- C:\Windows\System\vNuzEFU.exe
  C:\Windows\System\vNuzEFU.exe
  2⤵
  PID:13484
- C:\Windows\System\dIWYWQp.exe
  C:\Windows\System\dIWYWQp.exe
  2⤵
  PID:13500
- C:\Windows\System\QrhYmQt.exe
  C:\Windows\System\QrhYmQt.exe
  2⤵
  PID:13528
- C:\Windows\System\hEZDjRp.exe
  C:\Windows\System\hEZDjRp.exe
  2⤵
  PID:13552
- C:\Windows\System\fraYgEU.exe
  C:\Windows\System\fraYgEU.exe
  2⤵
  PID:13584
- C:\Windows\System\bJcdcLD.exe
  C:\Windows\System\bJcdcLD.exe
  2⤵
  PID:13604
- C:\Windows\System\wiEFNxc.exe
  C:\Windows\System\wiEFNxc.exe
  2⤵
  PID:13632
- C:\Windows\System\ugQpNgT.exe
  C:\Windows\System\ugQpNgT.exe
  2⤵
  PID:13652
- C:\Windows\System\AUWTvwH.exe
  C:\Windows\System\AUWTvwH.exe
  2⤵
  PID:13668
- C:\Windows\System\nxWLKtl.exe
  C:\Windows\System\nxWLKtl.exe
  2⤵
  PID:13696
- C:\Windows\System\gvNhqxj.exe
  C:\Windows\System\gvNhqxj.exe
  2⤵
  PID:13716
- C:\Windows\System\Kaioutl.exe
  C:\Windows\System\Kaioutl.exe
  2⤵
  PID:13744
- C:\Windows\System\fEozUZn.exe
  C:\Windows\System\fEozUZn.exe
  2⤵
  PID:13780
- C:\Windows\System\dNEcaCk.exe
  C:\Windows\System\dNEcaCk.exe
  2⤵
  PID:13816
- C:\Windows\System\GhCadzG.exe
  C:\Windows\System\GhCadzG.exe
  2⤵
  PID:13836
- C:\Windows\System\HnLDbDk.exe
  C:\Windows\System\HnLDbDk.exe
  2⤵
  PID:13868
- C:\Windows\System\VGTAiVZ.exe
  C:\Windows\System\VGTAiVZ.exe
  2⤵
  PID:13888
- C:\Windows\System\HTNcHLN.exe
  C:\Windows\System\HTNcHLN.exe
  2⤵
  PID:13908
- C:\Windows\System\NKuOvuT.exe
  C:\Windows\System\NKuOvuT.exe
  2⤵
  PID:13928
- C:\Windows\System\JcMVjKP.exe
  C:\Windows\System\JcMVjKP.exe
  2⤵
  PID:13968
- C:\Windows\System\BBmhmmx.exe
  C:\Windows\System\BBmhmmx.exe
  2⤵
  PID:13996
- C:\Windows\System\nKxUDyF.exe
  C:\Windows\System\nKxUDyF.exe
  2⤵
  PID:14020
- C:\Windows\System\eMxSikP.exe
  C:\Windows\System\eMxSikP.exe
  2⤵
  PID:14052
- C:\Windows\System\cTxSRwF.exe
  C:\Windows\System\cTxSRwF.exe
  2⤵
  PID:14068
- C:\Windows\System\anmtHUm.exe
  C:\Windows\System\anmtHUm.exe
  2⤵
  PID:14096
- C:\Windows\System\OPuLTvm.exe
  C:\Windows\System\OPuLTvm.exe
  2⤵
  PID:14124
- C:\Windows\System\tknriFV.exe
  C:\Windows\System\tknriFV.exe
  2⤵
  PID:14152
- C:\Windows\System\VsAgnrh.exe
  C:\Windows\System\VsAgnrh.exe
  2⤵
  PID:14176
- C:\Windows\System\ZjbVTOR.exe
  C:\Windows\System\ZjbVTOR.exe
  2⤵
  PID:14204
- C:\Windows\System\ZdKtSak.exe
  C:\Windows\System\ZdKtSak.exe
  2⤵
  PID:14224
- C:\Windows\System\fEWyKyt.exe
  C:\Windows\System\fEWyKyt.exe
  2⤵
  PID:14240
- C:\Windows\System\OWQFuQF.exe
  C:\Windows\System\OWQFuQF.exe
  2⤵
  PID:14276
- C:\Windows\System\gjMMyAq.exe
  C:\Windows\System\gjMMyAq.exe
  2⤵
  PID:14300
- C:\Windows\System\jwkiXWG.exe
  C:\Windows\System\jwkiXWG.exe
  2⤵
  PID:14328
- C:\Windows\System\rCTgYDj.exe
  C:\Windows\System\rCTgYDj.exe
  2⤵
  PID:11404
- C:\Windows\System\zwYIjXN.exe
  C:\Windows\System\zwYIjXN.exe
  2⤵
  PID:13268
- C:\Windows\System\OJaWbNC.exe
  C:\Windows\System\OJaWbNC.exe
  2⤵
  PID:11720
- C:\Windows\System\pjGnFtZ.exe
  C:\Windows\System\pjGnFtZ.exe
  2⤵
  PID:12916
- C:\Windows\System\UlgjxWe.exe
  C:\Windows\System\UlgjxWe.exe
  2⤵
  PID:10064
- C:\Windows\System\TfLcIkk.exe
  C:\Windows\System\TfLcIkk.exe
  2⤵
  PID:12988
- C:\Windows\System\QfNSXOF.exe
  C:\Windows\System\QfNSXOF.exe
  2⤵
  PID:12860
- C:\Windows\System\KgIGpCE.exe
  C:\Windows\System\KgIGpCE.exe
  2⤵
  PID:13620
- C:\Windows\System\ZQVVfrM.exe
  C:\Windows\System\ZQVVfrM.exe
  2⤵
  PID:13232
- C:\Windows\System\YezcATY.exe
  C:\Windows\System\YezcATY.exe
  2⤵
  PID:13424
- C:\Windows\System\eCdYtSN.exe
  C:\Windows\System\eCdYtSN.exe
  2⤵
  PID:13512
- C:\Windows\System\AvGXvvV.exe
  C:\Windows\System\AvGXvvV.exe
  2⤵
  PID:13568
- C:\Windows\System\jcQaWJW.exe
  C:\Windows\System\jcQaWJW.exe
  2⤵
  PID:14108
- C:\Windows\System\lQqLfTe.exe
  C:\Windows\System\lQqLfTe.exe
  2⤵
  PID:14144
- C:\Windows\System\XWYbAqq.exe
  C:\Windows\System\XWYbAqq.exe
  2⤵
  PID:14324
- C:\Windows\System\SpFRYjg.exe
  C:\Windows\System\SpFRYjg.exe
  2⤵
  PID:12756
- C:\Windows\System\NUyjJNf.exe
  C:\Windows\System\NUyjJNf.exe
  2⤵
  PID:12264
- C:\Windows\System\kkbuTpj.exe
  C:\Windows\System\kkbuTpj.exe
  2⤵
  PID:10892
- C:\Windows\System\JKIAhwp.exe
  C:\Windows\System\JKIAhwp.exe
  2⤵
  PID:13832
- C:\Windows\System\FcmmpGp.exe
  C:\Windows\System\FcmmpGp.exe
  2⤵
  PID:11348
- C:\Windows\System\AuOzCwa.exe
  C:\Windows\System\AuOzCwa.exe
  2⤵
  PID:14212
- C:\Windows\System\xvglNzG.exe
  C:\Windows\System\xvglNzG.exe
  2⤵
  PID:13644
- C:\Windows\System\NcTLcue.exe
  C:\Windows\System\NcTLcue.exe
  2⤵
  PID:14348
- C:\Windows\System\IQNljyN.exe
  C:\Windows\System\IQNljyN.exe
  2⤵
  PID:14372
- C:\Windows\System\OImIkju.exe
  C:\Windows\System\OImIkju.exe
  2⤵
  PID:14392
- C:\Windows\System\WUPraxR.exe
  C:\Windows\System\WUPraxR.exe
  2⤵
  PID:14420
- C:\Windows\System\OOvqgaG.exe
  C:\Windows\System\OOvqgaG.exe
  2⤵
  PID:14456
- C:\Windows\System\pSvbSYU.exe
  C:\Windows\System\pSvbSYU.exe
  2⤵
  PID:14476
- C:\Windows\System\CTISqOQ.exe
  C:\Windows\System\CTISqOQ.exe
  2⤵
  PID:14500
- C:\Windows\System\TSOKgQP.exe
  C:\Windows\System\TSOKgQP.exe
  2⤵
  PID:14516
- C:\Windows\System\cuDGExz.exe
  C:\Windows\System\cuDGExz.exe
  2⤵
  PID:14552
- C:\Windows\System\tvnPjAc.exe
  C:\Windows\System\tvnPjAc.exe
  2⤵
  PID:14576
- C:\Windows\System\wepyMyx.exe
  C:\Windows\System\wepyMyx.exe
  2⤵
  PID:14596
- C:\Windows\System\DOfdBjF.exe
  C:\Windows\System\DOfdBjF.exe
  2⤵
  PID:14628
- C:\Windows\System\VSLDfAO.exe
  C:\Windows\System\VSLDfAO.exe
  2⤵
  PID:14648
- C:\Windows\System\AfLLOIo.exe
  C:\Windows\System\AfLLOIo.exe
  2⤵
  PID:14684
- C:\Windows\System\bZoJolw.exe
  C:\Windows\System\bZoJolw.exe
  2⤵
  PID:14728
- C:\Windows\System\CXlVCBg.exe
  C:\Windows\System\CXlVCBg.exe
  2⤵
  PID:14752
- C:\Windows\System\fQVLPoF.exe
  C:\Windows\System\fQVLPoF.exe
  2⤵
  PID:14772
- C:\Windows\System\tXwsABV.exe
  C:\Windows\System\tXwsABV.exe
  2⤵
  PID:14788
- C:\Windows\System\zWWyxkM.exe
  C:\Windows\System\zWWyxkM.exe
  2⤵
  PID:14808
- C:\Windows\System\StiBUVF.exe
  C:\Windows\System\StiBUVF.exe
  2⤵
  PID:14832
- C:\Windows\System\qAxubWe.exe
  C:\Windows\System\qAxubWe.exe
  2⤵
  PID:14856
- C:\Windows\System\pscGKVV.exe
  C:\Windows\System\pscGKVV.exe
  2⤵
  PID:14880
- C:\Windows\System\jrIaEdB.exe
  C:\Windows\System\jrIaEdB.exe
  2⤵
  PID:14904
- C:\Windows\System\HarMeuw.exe
  C:\Windows\System\HarMeuw.exe
  2⤵
  PID:14932
- C:\Windows\System\uQkIPou.exe
  C:\Windows\System\uQkIPou.exe
  2⤵
  PID:14952
- C:\Windows\System\zPIWhpm.exe
  C:\Windows\System\zPIWhpm.exe
  2⤵
  PID:14976
- C:\Windows\System\GaEkDDu.exe
  C:\Windows\System\GaEkDDu.exe
  2⤵
  PID:14996
- C:\Windows\System\zxDiaUN.exe
  C:\Windows\System\zxDiaUN.exe
  2⤵
  PID:15016
- C:\Windows\System\YVNwbxy.exe
  C:\Windows\System\YVNwbxy.exe
  2⤵
  PID:15044
- C:\Windows\System\tLjqfli.exe
  C:\Windows\System\tLjqfli.exe
  2⤵
  PID:15072
- C:\Windows\System\CewRjNG.exe
  C:\Windows\System\CewRjNG.exe
  2⤵
  PID:15096
- C:\Windows\System\imMHbhY.exe
  C:\Windows\System\imMHbhY.exe
  2⤵
  PID:15120
- C:\Windows\System\yBTkQBa.exe
  C:\Windows\System\yBTkQBa.exe
  2⤵
  PID:15148
- C:\Windows\System\hmHxaRo.exe
  C:\Windows\System\hmHxaRo.exe
  2⤵
  PID:15168
- C:\Windows\System\xrBgCKN.exe
  C:\Windows\System\xrBgCKN.exe
  2⤵
  PID:15196
- C:\Windows\System\NkKihuW.exe
  C:\Windows\System\NkKihuW.exe
  2⤵
  PID:15220
- C:\Windows\System\eorRATg.exe
  C:\Windows\System\eorRATg.exe
  2⤵
  PID:15240
- C:\Windows\System\wwprxlu.exe
  C:\Windows\System\wwprxlu.exe
  2⤵
  PID:15260
- C:\Windows\System\BrvMaet.exe
  C:\Windows\System\BrvMaet.exe
  2⤵
  PID:15284
- C:\Windows\System\Tgpdqha.exe
  C:\Windows\System\Tgpdqha.exe
  2⤵
  PID:15308
- C:\Windows\System\PIpYtVe.exe
  C:\Windows\System\PIpYtVe.exe
  2⤵
  PID:15332
- C:\Windows\System\ZhvqHXr.exe
  C:\Windows\System\ZhvqHXr.exe
  2⤵
  PID:10800
- C:\Windows\System\MciFDFm.exe
  C:\Windows\System\MciFDFm.exe
  2⤵
  PID:14196
- C:\Windows\System\kQQhRUw.exe
  C:\Windows\System\kQQhRUw.exe
  2⤵
  PID:12584
- C:\Windows\System\EDJUXVE.exe
  C:\Windows\System\EDJUXVE.exe
  2⤵
  PID:13592
- C:\Windows\System\vFFWJkT.exe
  C:\Windows\System\vFFWJkT.exe
  2⤵
  PID:14288
- C:\Windows\System\UZMrGba.exe
  C:\Windows\System\UZMrGba.exe
  2⤵
  PID:13796
- C:\Windows\System\kAbAaOI.exe
  C:\Windows\System\kAbAaOI.exe
  2⤵
  PID:11600
- C:\Windows\System\WllmAmK.exe
  C:\Windows\System\WllmAmK.exe
  2⤵
  PID:14036
- C:\Windows\System\oSpfTGf.exe
  C:\Windows\System\oSpfTGf.exe
  2⤵
  PID:14604
- C:\Windows\System\CIrEdML.exe
  C:\Windows\System\CIrEdML.exe
  2⤵
  PID:10788
- C:\Windows\System\pZcddrk.exe
  C:\Windows\System\pZcddrk.exe
  2⤵
  PID:12644
- C:\Windows\System\PiyUuey.exe
  C:\Windows\System\PiyUuey.exe
  2⤵
  PID:14700
- C:\Windows\System\PpYvfGV.exe
  C:\Windows\System\PpYvfGV.exe
  2⤵
  PID:14760
- C:\Windows\System\QoMBJfP.exe
  C:\Windows\System\QoMBJfP.exe
  2⤵
  PID:14784
- C:\Windows\System\PgSKhoA.exe
  C:\Windows\System\PgSKhoA.exe
  2⤵
  PID:14564
- C:\Windows\System\qAVIrmk.exe
  C:\Windows\System\qAVIrmk.exe
  2⤵
  PID:14256
- C:\Windows\System\VFZtRuz.exe
  C:\Windows\System\VFZtRuz.exe
  2⤵
  PID:14356
- C:\Windows\System\XnjRirW.exe
  C:\Windows\System\XnjRirW.exe
  2⤵
  PID:14736
- C:\Windows\System\mnIWCLA.exe
  C:\Windows\System\mnIWCLA.exe
  2⤵
  PID:14824
- C:\Windows\System\pthTLLn.exe
  C:\Windows\System\pthTLLn.exe
  2⤵
  PID:14896
- C:\Windows\System\YygBISW.exe
  C:\Windows\System\YygBISW.exe
  2⤵
  PID:15324
- C:\Windows\System\uIdqFat.exe
  C:\Windows\System\uIdqFat.exe
  2⤵
  PID:15352
- C:\Windows\System\vxqZxAp.exe
  C:\Windows\System\vxqZxAp.exe
  2⤵
  PID:15092
- C:\Windows\System\ggZgKht.exe
  C:\Windows\System\ggZgKht.exe
  2⤵
  PID:15884
- C:\Windows\System\XaEjUIn.exe
  C:\Windows\System\XaEjUIn.exe
  2⤵
  PID:15900
- C:\Windows\System\fYlrnys.exe
  C:\Windows\System\fYlrnys.exe
  2⤵
  PID:15916
- C:\Windows\System\bEEhYRX.exe
  C:\Windows\System\bEEhYRX.exe
  2⤵
  PID:15940
- C:\Windows\System\ZwsgkOK.exe
  C:\Windows\System\ZwsgkOK.exe
  2⤵
  PID:15960
- C:\Windows\System\HrQINlN.exe
  C:\Windows\System\HrQINlN.exe
  2⤵
  PID:15984
- C:\Windows\System\AMfHTJA.exe
  C:\Windows\System\AMfHTJA.exe
  2⤵
  PID:16004
- C:\Windows\System\RiQYXny.exe
  C:\Windows\System\RiQYXny.exe
  2⤵
  PID:16024
- C:\Windows\System\gOHLxbc.exe
  C:\Windows\System\gOHLxbc.exe
  2⤵
  PID:16040
- C:\Windows\System\xGnNXUC.exe
  C:\Windows\System\xGnNXUC.exe
  2⤵
  PID:16076
- C:\Windows\System\JgKKVEc.exe
  C:\Windows\System\JgKKVEc.exe
  2⤵
  PID:16100
- C:\Windows\System\TBwZgTy.exe
  C:\Windows\System\TBwZgTy.exe
  2⤵
  PID:16120
- C:\Windows\System\sglBIkE.exe
  C:\Windows\System\sglBIkE.exe
  2⤵
  PID:16144
- C:\Windows\System\DBNzFwP.exe
  C:\Windows\System\DBNzFwP.exe
  2⤵
  PID:16160
- C:\Windows\System\EBseTHd.exe
  C:\Windows\System\EBseTHd.exe
  2⤵
  PID:16176
- C:\Windows\System\nEMoBrI.exe
  C:\Windows\System\nEMoBrI.exe
  2⤵
  PID:16200
- C:\Windows\System\ggDBoDk.exe
  C:\Windows\System\ggDBoDk.exe
  2⤵
  PID:16220
- C:\Windows\System\XQcRIgY.exe
  C:\Windows\System\XQcRIgY.exe
  2⤵
  PID:16244
- C:\Windows\System\rrdGfrR.exe
  C:\Windows\System\rrdGfrR.exe
  2⤵
  PID:16268
- C:\Windows\System\lcbzQae.exe
  C:\Windows\System\lcbzQae.exe
  2⤵
  PID:16288
- C:\Windows\System\idjsAYw.exe
  C:\Windows\System\idjsAYw.exe
  2⤵
  PID:16304
- C:\Windows\System\EoOlKTZ.exe
  C:\Windows\System\EoOlKTZ.exe
  2⤵
  PID:16328
- C:\Windows\System\OEbjseR.exe
  C:\Windows\System\OEbjseR.exe
  2⤵
  PID:16352
- C:\Windows\System\MTEkrib.exe
  C:\Windows\System\MTEkrib.exe
  2⤵
  PID:15156
- C:\Windows\System\OuFOMRU.exe
  C:\Windows\System\OuFOMRU.exe
  2⤵
  PID:10772
- C:\Windows\System\MwNESzK.exe
  C:\Windows\System\MwNESzK.exe
  2⤵
  PID:14920
- C:\Windows\System\UgTyJUI.exe
  C:\Windows\System\UgTyJUI.exe
  2⤵
  PID:14944
- C:\Windows\System\MWinOhB.exe
  C:\Windows\System\MWinOhB.exe
  2⤵
  PID:14848
- C:\Windows\System\nDSDShP.exe
  C:\Windows\System\nDSDShP.exe
  2⤵
  PID:15088
- C:\Windows\System\OAlMkCc.exe
  C:\Windows\System\OAlMkCc.exe
  2⤵
  PID:13916
- C:\Windows\System\iRHiNUn.exe
  C:\Windows\System\iRHiNUn.exe
  2⤵
  PID:15424
- C:\Windows\System\golTMCs.exe
  C:\Windows\System\golTMCs.exe
  2⤵
  PID:14780
- C:\Windows\System\IrnQqYv.exe
  C:\Windows\System\IrnQqYv.exe
  2⤵
  PID:15316
- C:\Windows\System\wrZLAgu.exe
  C:\Windows\System\wrZLAgu.exe
  2⤵
  PID:1060
- C:\Windows\System\RDaYovU.exe
  C:\Windows\System\RDaYovU.exe
  2⤵
  PID:14268
- C:\Windows\System\LIDxpDZ.exe
  C:\Windows\System\LIDxpDZ.exe
  2⤵
  PID:15400
- C:\Windows\System\MPNVYdG.exe
  C:\Windows\System\MPNVYdG.exe
  2⤵
  PID:10784
- C:\Windows\System\NckmJty.exe
  C:\Windows\System\NckmJty.exe
  2⤵
  PID:14804
- C:\Windows\System\WqvjPTA.exe
  C:\Windows\System\WqvjPTA.exe
  2⤵
  PID:10780
- C:\Windows\System\zBUVgfX.exe
  C:\Windows\System\zBUVgfX.exe
  2⤵
  PID:15040
- C:\Windows\System\sVYBsoP.exe
  C:\Windows\System\sVYBsoP.exe
  2⤵
  PID:15448
- C:\Windows\System\ssnGelD.exe
  C:\Windows\System\ssnGelD.exe
  2⤵
  PID:15688
- C:\Windows\System\hhCtxQK.exe
  C:\Windows\System\hhCtxQK.exe
  2⤵
  PID:15760
- C:\Windows\System\QJrTArQ.exe
  C:\Windows\System\QJrTArQ.exe
  2⤵
  PID:15744
- C:\Windows\System\rseBWdi.exe
  C:\Windows\System\rseBWdi.exe
  2⤵
  PID:15868
- C:\Windows\System\HHQmaou.exe
  C:\Windows\System\HHQmaou.exe
  2⤵
  PID:8280
- C:\Windows\System\rIQhsFo.exe
  C:\Windows\System\rIQhsFo.exe
  2⤵
  PID:15932
- C:\Windows\System\tEAvLYY.exe
  C:\Windows\System\tEAvLYY.exe
  2⤵
  PID:16012
- C:\Windows\System\TsdSxXI.exe
  C:\Windows\System\TsdSxXI.exe
  2⤵
  PID:16088
- C:\Windows\System\WqcjRpO.exe
  C:\Windows\System\WqcjRpO.exe
  2⤵
  PID:16112
- C:\Windows\System\IuOyPNe.exe
  C:\Windows\System\IuOyPNe.exe
  2⤵
  PID:16264
- C:\Windows\System\tYAgzKu.exe
  C:\Windows\System\tYAgzKu.exe
  2⤵
  PID:16320
- C:\Windows\System\yhiMrRO.exe
  C:\Windows\System\yhiMrRO.exe
  2⤵
  PID:16240
- C:\Windows\System\FCYloXr.exe
  C:\Windows\System\FCYloXr.exe
  2⤵
  PID:16376
- C:\Windows\System\jjhEBXq.exe
  C:\Windows\System\jjhEBXq.exe
  2⤵
  PID:14436
- C:\Windows\System\yfcnKWE.exe
  C:\Windows\System\yfcnKWE.exe
  2⤵
  PID:14676
- C:\Windows\System\WOGGGBX.exe
  C:\Windows\System\WOGGGBX.exe
  2⤵
  PID:15364
- C:\Windows\System\sIqopKR.exe
  C:\Windows\System\sIqopKR.exe
  2⤵
  PID:14408
- C:\Windows\System\apJqNQY.exe
  C:\Windows\System\apJqNQY.exe
  2⤵
  PID:14544
- C:\Windows\System\KFNiGuj.exe
  C:\Windows\System\KFNiGuj.exe
  2⤵
  PID:14864
- C:\Windows\System\wuJVDKs.exe
  C:\Windows\System\wuJVDKs.exe
  2⤵
  PID:10744
- C:\Windows\System\OvNQfIG.exe
  C:\Windows\System\OvNQfIG.exe
  2⤵
  PID:10764
- C:\Windows\System\KzbThHn.exe
  C:\Windows\System\KzbThHn.exe
  2⤵
  PID:15636
- C:\Windows\System\BamJjds.exe
  C:\Windows\System\BamJjds.exe
  2⤵
  PID:14064
- C:\Windows\System\JxLLUvJ.exe
  C:\Windows\System\JxLLUvJ.exe
  2⤵
  PID:16136
- C:\Windows\System\rahMTTZ.exe
  C:\Windows\System\rahMTTZ.exe
  2⤵
  PID:14320
- C:\Windows\System\xCiIpxE.exe
  C:\Windows\System\xCiIpxE.exe
  2⤵
  PID:16260
- C:\Windows\System\PkCVxPu.exe
  C:\Windows\System\PkCVxPu.exe
  2⤵
  PID:15556
- C:\Windows\System\ZMjlftb.exe
  C:\Windows\System\ZMjlftb.exe
  2⤵
  PID:16400
- C:\Windows\System\vtZeZpw.exe
  C:\Windows\System\vtZeZpw.exe
  2⤵
  PID:16428
- C:\Windows\System\zaJBUZR.exe
  C:\Windows\System\zaJBUZR.exe
  2⤵
  PID:16452
- C:\Windows\System\BwLVYjp.exe
  C:\Windows\System\BwLVYjp.exe
  2⤵
  PID:16476
- C:\Windows\System\unSIijb.exe
  C:\Windows\System\unSIijb.exe
  2⤵
  PID:16500
- C:\Windows\System\uiMuNkw.exe
  C:\Windows\System\uiMuNkw.exe
  2⤵
  PID:16536
- C:\Windows\System\TIZSofr.exe
  C:\Windows\System\TIZSofr.exe
  2⤵
  PID:16564
- C:\Windows\System\uwJeHZS.exe
  C:\Windows\System\uwJeHZS.exe
  2⤵
  PID:16596
- C:\Windows\System\DzttIcm.exe
  C:\Windows\System\DzttIcm.exe
  2⤵
  PID:16612
- C:\Windows\System\hQwAAGk.exe
  C:\Windows\System\hQwAAGk.exe
  2⤵
  PID:16632
- C:\Windows\System\poEYPjM.exe
  C:\Windows\System\poEYPjM.exe
  2⤵
  PID:16652
- C:\Windows\System\NbcXbBk.exe
  C:\Windows\System\NbcXbBk.exe
  2⤵
  PID:16672
- C:\Windows\System\FUZwtHN.exe
  C:\Windows\System\FUZwtHN.exe
  2⤵
  PID:16700
- C:\Windows\System\eHFRioy.exe
  C:\Windows\System\eHFRioy.exe
  2⤵
  PID:16728
- C:\Windows\System\DydacuS.exe
  C:\Windows\System\DydacuS.exe
  2⤵
  PID:16752
- C:\Windows\System\HXvTsux.exe
  C:\Windows\System\HXvTsux.exe
  2⤵
  PID:16784
- C:\Windows\System\yFTtLpa.exe
  C:\Windows\System\yFTtLpa.exe
  2⤵
  PID:16808
- C:\Windows\System\poNJcsu.exe
  C:\Windows\System\poNJcsu.exe
  2⤵
  PID:16824
- C:\Windows\System\hFJtNtv.exe
  C:\Windows\System\hFJtNtv.exe
  2⤵
  PID:16856
- C:\Windows\System\JDzbbFh.exe
  C:\Windows\System\JDzbbFh.exe
  2⤵
  PID:16880
- C:\Windows\System\UARhyZY.exe
  C:\Windows\System\UARhyZY.exe
  2⤵
  PID:16900
- C:\Windows\System\FATJRgi.exe
  C:\Windows\System\FATJRgi.exe
  2⤵
  PID:16924
- C:\Windows\System\XotSGSK.exe
  C:\Windows\System\XotSGSK.exe
  2⤵
  PID:16940
- C:\Windows\System\HONPynL.exe
  C:\Windows\System\HONPynL.exe
  2⤵
  PID:16960
- C:\Windows\System\YHIckEM.exe
  C:\Windows\System\YHIckEM.exe
  2⤵
  PID:16984
- C:\Windows\System\NohbOMA.exe
  C:\Windows\System\NohbOMA.exe
  2⤵
  PID:17340
- C:\Windows\System\jCreFfE.exe
  C:\Windows\System\jCreFfE.exe
  2⤵
  PID:16084
- C:\Windows\System\XVwIahv.exe
  C:\Windows\System\XVwIahv.exe
  2⤵
  PID:16256
- C:\Windows\System\zxLccIa.exe
  C:\Windows\System\zxLccIa.exe
  2⤵
  PID:14620
- C:\Windows\System\PbwzlZM.exe
  C:\Windows\System\PbwzlZM.exe
  2⤵
  PID:15180
- C:\Windows\System\DPlNGBI.exe
  C:\Windows\System\DPlNGBI.exe
  2⤵
  PID:16496
- C:\Windows\System\EyUogyf.exe
  C:\Windows\System\EyUogyf.exe
  2⤵
  PID:16748
- C:\Windows\System\oxXeZFO.exe
  C:\Windows\System\oxXeZFO.exe
  2⤵
  PID:16952
- C:\Windows\System\UIBjsQF.exe
  C:\Windows\System\UIBjsQF.exe
  2⤵
  PID:17268

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:17164

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\Bysvejw.exe

Filesize
1.4MB

MD5
d94b3fbc1f3c75258f642499f0b0bd36

SHA1
bae0d9ad8d2992d1ea607dd2cab45058c635690a

SHA256
f64271807df841197d1b0553f0a75d0c712afe3560b65b25dcd79fe5d59c3ed7

SHA512
9944f8d3ca48e6b99cd79986013e5c75f56ec686548a34dcc95e4025dca996fa9e67a10a92a69e4d6312a9d013bce857d67789d398073e1e91c84e41158c61e8

Download Submit
C:\Windows\System\FJXRDPp.exe

Filesize
1.4MB

MD5
f3edc798c8fec85db8b9e328aafbb10b

SHA1
0b46a5bb3f0ed61b48b6981c821b1fb96084b73d

SHA256
fec5eb5ee06e20d2974ca72795ad6e2afd3992cd7f1a0096eb770b709cd215a1

SHA512
b1a7065702d047b6bd32efedd0d6996a555d86357ecb407c5f3716217a2df09a7c2b418aaafe6d4f4c280f77e421c34fd38c6a4556d3dab51279b072a4119cb8

Download Submit
C:\Windows\System\HLqPcYh.exe

Filesize
1.4MB

MD5
06530c3892f0afac6899c961afb56894

SHA1
6bdf80d87de7e4ee4362ef3f602549c213f5413f

SHA256
e382d025c2ac5d683de33435f7d0a8ff3ec739bb14bdf48d4ed0e0f62042e1c7

SHA512
e565c10b367fff9ac5aefe3634b8df187fdeb03a94e3efdb739fa9021370d27ec33f10a5ba32e4831a9501a98c2b620edd9e837487f54eb64eb01d7eba2293c0

Download Submit
C:\Windows\System\IioMGHB.exe

Filesize
1.4MB

MD5
3afc23a1e0647f27baee9bfaa863d534

SHA1
1946d45592f8ffb6beb487558f34588ee38991ae

SHA256
fdfc1bf63cbff156ed74f98352c7aaea66e054fe1373ac72c195171463119bdd

SHA512
a1fab748ffaf86faa6404c00381621c9ec46308ca75ff81b801f60bd91d57c2498c0f46ee20fcc22eda5d89461ed1f01f04bd19d6258f200edea303b7f11e461

Download Submit
C:\Windows\System\KIhbvTV.exe

Filesize
1.4MB

MD5
e0778482580e6b5222295946fc360e19

SHA1
7a5eeafe1321902321c801793faee256ae79b2fd

SHA256
444d5f617836c88e6efec8fd694d04b13fe4d0ab95139fca38667fe2e4fcf2a3

SHA512
18b9165ec7b2e005336856a406203732c390a220fc0fadaa5c88f10382fb3328a1af9698815546bea15b7d470bc7f9179ba6518858bbadc99c0628e67c1334c7

Download Submit
C:\Windows\System\KlnqTMr.exe

Filesize
1.4MB

MD5
57ffb526ceea763b37e963b3336b54e2

SHA1
dd5b0281997427e26082e9c34b7574d9f60f3b79

SHA256
1d4997c4f93fa284664d2958e382bd17c4de59854f0a241e1c45114a5099618f

SHA512
f1898513424e4c91961360f85936ed0a774445aa2aaa3dedd7981c353d1cf299088ee5f5ccca5899cecd488fc0611549504758b926b3adbe93e6b40e2a891b0b

Download Submit
C:\Windows\System\PwYKGLy.exe

Filesize
1.4MB

MD5
0ada5a5aa425ce4340c52361b23daafb

SHA1
a9c75c69f86d0a4aa30e6eed11dfee3f3beb5edd

SHA256
dc34883684759163cab0c326c08739ec6768a23cc61bc35b9e2f7235d1f3eaa9

SHA512
9c23b7ff9e0954e39cb8ba1e40ac599e3806c103f33c7b0e1b6fe3f65d1ea3c847c1c9517aa2ec8b855ea6343ba6c4b897581fcae99c852f404578b07c9132b1

Download Submit
C:\Windows\System\QTCjpgM.exe

Filesize
1.4MB

MD5
684725182f7d29932d09941492274d1b

SHA1
e3c006c013e7f9eee4a4b6903796d47424ce2a6c

SHA256
28c52101aa3808e8d249c65ac4c7a77343752e525ed49ec3569f9d4349d51801

SHA512
44026d41a56fbff8cebec78108c0e82fe92a10b1c4e4f0127357e31451bc3a622f420739759259c8ccd3d41a9bbae01455fd7f9bdded07f0176009189735e66f

Download Submit
C:\Windows\System\QcBmhUV.exe

Filesize
1.4MB

MD5
1fc0186d71057f86c914157f564b32ad

SHA1
b9abba0dbcb366380e2ac44d807996a729df1f78

SHA256
8ea458a4940e4409f87c54bf08a3e0a56a62f6dc24c377d009034eb82f7ce0ad

SHA512
b81009c5555535c17b2103e91dda11b0d9f93e882081f3d4b2fb7ddecd28c67fa818a4bcc8c4837d0d2caf4805632d32175158170388ca13213ef4152d7e3c32

Download Submit
C:\Windows\System\ROuqcIm.exe

Filesize
1.4MB

MD5
2c45ab7960e5e17e516376619ae3c9df

SHA1
bf4f30c026418d9d15e9774cc7b869a0de18581c

SHA256
6dfddc44bd8804336fc45b46bb17a3df2377e5ee6350ee79d1c7fc52a69bf196

SHA512
af84e94a40de776f24c392bd014c48cb0842c26be4952be39d03ea40f44b2184244da93e1af933c1df6e65bd75960cf31dffbf587c53e070ca86ed8cc9dbbb30

Download Submit
C:\Windows\System\SElDaDZ.exe

Filesize
1.4MB

MD5
1df0ad55deb08ffa28c8c1521b47251b

SHA1
81e1b148b48b21aa0865b71d305e31b9b6d6cb1f

SHA256
426746dabae45dccc690bc05299f01cb0653ab67c95a6dc351234a881d67bc7a

SHA512
ddb848b77abfc50aa8fd4fad8bddbde0262d16f0c91b9ebed5bd174f718dbdbfd4942a6722c9b9e128ab918f6d653efc8e0ab30514842545acf216e7916de626

Download Submit
C:\Windows\System\ShRYHpn.exe

Filesize
1.4MB

MD5
a60abd23a077b104e125d35bfa7165af

SHA1
3436f010b995b57a278cf116b3d5fdb8cdc5483b

SHA256
67b39b779494d6e618a08c814db19996c67bf823ee225350120d12314b280fcc

SHA512
ce38297770d38601a3f0f704a6694fd84563e7614cf1c3ef9537d0d7c2d3327188e763cca50455d69d2170c1ccaa18eaddc16892bd28531bf205661a29131ee7

Download Submit
C:\Windows\System\TDAFMgP.exe

Filesize
1.4MB

MD5
2268fa18e02a5342030c073cae8db117

SHA1
a33d131acb04bf9fc455c901144059b1836f4461

SHA256
332b0446103a6e55a87f603f614cf94ac87fa90fb1bb3bf8e2621e43329eab2c

SHA512
09e81d6b84da0f7b1a3725d4e020fe1a2fdebe726b8cd34df584c2b2a49593b01ebf72a19e4dd59e66b0e194a5371e796e6da327f2d8790996a2a5b725cbe10c

Download Submit
C:\Windows\System\XGApBdf.exe

Filesize
1.4MB

MD5
e487df956155b161ecc5bdfc92415ccc

SHA1
8a8510181184f53780e02279080743ba56862e9d

SHA256
df7204f3c372b8e6a1cf9b6bc72b2679707f0b64dd206688509c0346ca301066

SHA512
fccfa943440d7f7a0ea21d38c5d9a04f591be9a1b8fff1beb38ee80c9dc2e96918ee3e43863896380719cd062ba400d2fb4b03cf0a1f202ead133c7743955a70

Download Submit
C:\Windows\System\XTYQgKx.exe

Filesize
1.4MB

MD5
121c621adef964e8e63c5c88bd1c04e9

SHA1
000873d0b335a34db6472b79c2fcbf81c6419302

SHA256
ac0bb1b4f7b6d8182528d899e195ff6f563a28f4bed94f17c88f14fcdddb492d

SHA512
82e1bf9f64b020a5a927ba3900863e000a46b063db007aee7724f28ce87b5812238bb48386ed63a082f55170d0949e0bbd9fbfbe39c5f1f3f1e1893282157089

Download Submit
C:\Windows\System\YORgNcz.exe

Filesize
1.4MB

MD5
e908f5630118b2a4cfe9961f90f30b96

SHA1
47a55555eeeaa409e493ef15fd5edb43c3c23bac

SHA256
a6ef5bbba410e1c2fb859f1c4292fdb2f07a73ca1d47fbe96e4ff8605eb65033

SHA512
6b3d15a80446c90521cea9c319816fa457316731e75d4ac31c858fcb4f81c49efd5ce55e485774ec7b6dadf2543aaa198904a5ef130b6caac66e2e8dbaf58abe

Download Submit
C:\Windows\System\ZIALMsl.exe

Filesize
1.4MB

MD5
b0ea7e0cac33ff2dbf2af78e5191880d

SHA1
1980ba89e9895af40989573dd3fb6da04c575d3d

SHA256
fdecbba770e8c5f8bef1fb0714ff9afa3ac56e400ce111cbe3fce09a0a8a334d

SHA512
d619071f29628d80261dfc4f0e4cf0f6ae10dff478c851865cb123b44c258be723eb5c3cb26b722ac471e6ae997cf7f1531a0a4cbf31d809978fd1137ff76cd8

Download Submit
C:\Windows\System\ZjhAzPW.exe

Filesize
1.4MB

MD5
8141aff6655ef62ae7aef0cf64bcf17c

SHA1
e0f20b672f27653c69d1e6eec51c7a847ac1bae6

SHA256
e3baa9fdf91653548d89214c826d2a44f91b190359b5b4afae62b9567774874f

SHA512
5430eea6ea337a5e55c16676c197705b73fd8526461385bcba81a36a58895d2011345901eab82180f6df6838f62e81a9a7e5f90df6ab65ccb814260bb0ff7c22

Download Submit
C:\Windows\System\eaVcUzC.exe

Filesize
1.4MB

MD5
52115a1e513fe91996dba82228f4c14c

SHA1
12f0bdb76a343540d2e2f531c886ecd42133495e

SHA256
bc7ae7a5d9fbd3152925359bd14f4dff58cd227d3b25b20b89e0bfa09024e083

SHA512
b10ef51614b5ec58ef8d125f935188bf710ebaf06f214c3b0071fae70e401c1dcf21ab27ddde2f86985026cbaf8cab714e1a162673068186aa4537e36e5a69d2

Download Submit
C:\Windows\System\fuKiDUr.exe

Filesize
1.4MB

MD5
ca07aff58a9623389d9f4633d6f9eb9a

SHA1
f4bf2b53ed848dcecf1d0ca17a255f31657528d2

SHA256
9a1fc4156187c12b035e625829a4dc1efb72ec5e71ce37b3e968959318c30391

SHA512
44afdc0b9d1b78be97a4a993f7173e2cda3ef38390e8be86cf3cfff4041cd986d2fb7ef6d8ea5e9ed401fd806207ab45674856b1942ff96bfeb486b2059b8c70

Download Submit
C:\Windows\System\gKjCdOG.exe

Filesize
1.4MB

MD5
1871f8ed9ee92f5f96da8f3c5ed26b1b

SHA1
1fda8c6aadafd8a4b05b3d51c01b59348f6b79fb

SHA256
ea8fededa93f4d9183d42c1b9c9907208489d2e0e44cfd3e09fde37e7c2c591a

SHA512
da297ec19ef9849d9f3b0e91c286114b6077823d5a2c47abd9605ae32e64cf0aff216d7434b133fb8772d06b11e2d4327fd5f1e975caae5ec2cb1aa1e1696f66

Download Submit
C:\Windows\System\hFwjgyq.exe

Filesize
1.4MB

MD5
6ff24495c41e81ee9d9f0f335c8c72ad

SHA1
959b79965dd0eb6d328e5ec71dcb85635952433a

SHA256
22b67ad3fe2da5dcaaba45442350b955fe06d2188f3bef6e6fcc201ec8929a91

SHA512
54e902c87300bca4fe7a8bbad66e4975b3d68079a1fba50d1273490e4461d5bb55348a839bfa31e4d1ee8a42d47d2712d7e4913dfbf5526a8b25fe574478596c

Download Submit
C:\Windows\System\iYsgnNP.exe

Filesize
1.4MB

MD5
8f938440f88e2c3fe0da870b7b5a6fef

SHA1
ea112ab9a3386647ebec03762e892223948aad98

SHA256
0c267926469e7868f514488f749482c8755d96cc9047f26d8f1787f916237ff4

SHA512
06dc8963c09a95990f0331347391613b8d3024c20731eb3b3badc7b84f9c5e684688bcd3eacf98813557012db5cfd52d369ace6cccf146fe11c47054c86b5cfe

Download Submit
C:\Windows\System\jaRHyGK.exe

Filesize
1.4MB

MD5
921929e4c58d525449040c9542322140

SHA1
b68de8289ef4a2bc30f249442108db142ad73308

SHA256
a1ee800498224e6cbaffbf11a499da33c61b1ea4262770c5f6f66aace0807df0

SHA512
a34802b6d2a798ce0023102595eda5cebcd7d4dfd077ac27979882ec22fdef62109237df39f88566e52e3d1a9db89f08274509d8ec7d68fe9bde1bb9af2a79b8

Download Submit
C:\Windows\System\jvlAgYC.exe

Filesize
1.4MB

MD5
150c1ef51b4f7f96bbaada664881a28d

SHA1
e31348a8088fe1acc5fa7bb7f53fe67b2e438595

SHA256
b7e0b770f469f67716e4a6a2e2a7d3061be6fb7ddbcbc13ff01de0a4692eef51

SHA512
3a119fc92a571f81bd5978066cce18e0cdd33b891ea2fc33a0ed929de121e22f88b5398a3bcd2470809908737a88b0e333eb068b7440a9d665b1bc7e2594ae92

Download Submit
C:\Windows\System\kAlHzwv.exe

Filesize
1.4MB

MD5
16f8eb092ae21b1b7f0f57ab88174063

SHA1
797b6e29abc2653024cad5655e9719bfda8c198e

SHA256
be16d932a3c438df2f7dbada9ef93450d516c066a9b8430d8ada084881281e30

SHA512
b0ac8f89db14622b9c6fdaf4c7ed364e7c791e58e93be5b6ffb2b4916cd690cb066c1f71e2c3c7dba3525169588f3039c84a7a90e0084d496a3cc6328a19d932

Download Submit
C:\Windows\System\nQwSjMM.exe

Filesize
1.4MB

MD5
31d20de9317c389748c73c060143bd79

SHA1
49ab791b70371312b5a0059427e4b427fe232be7

SHA256
5e76b2509bb5e2ff84fc01e686a84ec822268fac64753bd31bc6a5550792977c

SHA512
7d749e3d9da8ff62fc0cb1874a7cd7b67ab5a710ebf21daaaf4ea0a23f341001a5639dc3404729b2f247463a65953edc0df3317e4af55d8c41e3664078089527

Download Submit
C:\Windows\System\oLiaoeJ.exe

Filesize
1.4MB

MD5
68ea4f9fd76b8a1aa230d94a0f63966b

SHA1
ab149ed8ce588401cf900782e08f7f12c2973759

SHA256
13a74f05737e2f259ba8db8957f02b27fe2a7e1ab4a1a5a48353078585d111a4

SHA512
1ee2017cde1d598b0e9f75035cbc03ecb469ca126d4ff40e1633ec80b7e53132523711509b18e47b2d5cc9149b08d38641a7881459853c03ec5015aa7b8c128a

Download Submit
C:\Windows\System\pfrabfG.exe

Filesize
1.4MB

MD5
b88e4dc6ab3fb4103780f63c016b1d50

SHA1
dda2796ed549b62dab67ed26ca56843f45fb9c27

SHA256
1cc67e83637faac87264a9cb5c1232b22c336429a8aba9b9b1037d1c6cbb9e7d

SHA512
2b8c6f772d3f648fdedccc1dda64b34ea41ba27f27918cd607dbaa893d4c6656718f7e88a3efda4dcc5b5192779d200872f9386c8c7e08857daa0a89e893e235

Download Submit
C:\Windows\System\rrcKcUH.exe

Filesize
1.4MB

MD5
8bc62b6e431d8113130342c73522c484

SHA1
f73f872d910709456cf093a4876c97ae1c870708

SHA256
9c3c1d42859451acf9b2512c0a3f66340c15be3864c43385612c785d546378dd

SHA512
4a3df5c08760c643790554a73eda9e843148704d61e54eee24f4fbbcee204791a0a2144066ec4d2a8462354dc3e8fdf610f2bc2b0ce0ae9a1e683030cabd9753

Download Submit
C:\Windows\System\sShsKzD.exe

Filesize
1.4MB

MD5
0a9712da03f17e6dd50c7789713c8c59

SHA1
a92727632d7285cc2a93ba49d511f6ad220ac51f

SHA256
09656eaa788be62c361b864bc4c0678749a630cf46b4fe6638897c6dc2671260

SHA512
8eb25610cc85de121c6a8bcb6a33355401177a3351615675857d0adeddf5e39a4e84ebd5710c022be8da835fc280d8fcc6311cb2c61298a6d53f040a6a480ebd

Download Submit
C:\Windows\System\sZpVxmu.exe

Filesize
1.4MB

MD5
d5f91c0af9344789999c95d082e260be

SHA1
95c821bf2be3ead9d844bc7d70fa732d91d704f5

SHA256
a6c8c27fccada27d9741fab784e0393655cae296b3766564a72b1c6abdfa48fc

SHA512
988d96f3a51de5ec62a209c97def50378118958c7cfa2f633fa731bcdf2b6a38ffa5b2f91c9be9da06ed5c1d7b36e764434c1b78f39dcc5a61be571493a7d957

Download Submit
C:\Windows\System\tirjudV.exe

Filesize
1.4MB

MD5
d89f8c26c8bc9cdc1a7b1375a4544c8c

SHA1
7c31364b9ad860f9e50f0b75e8cfe677f36fe59d

SHA256
df3fe43c399de8475e3f07d9dd39fcc81ffacbdff453118eb070835b483ca2eb

SHA512
12addd415e0ea1e4a73929cf7c6f9ddf86c0e45e34cbe68542908927aacfd55bc524b18c8c97d61c1f8cc46940e54a3ad68f1b0367cfd1fd4ea26769cf20153b

Download Submit
C:\Windows\System\uRKBiLa.exe

Filesize
1.4MB

MD5
ffc741ceec397c2c692d87996d510ede

SHA1
f970e30a879f8478ce27ec11524dc3d44f72a8e9

SHA256
bc33ef337f0b94770709cfbea82c5f43af58afe400e9cc4bd5a380235074af55

SHA512
9d82518af75702a1759b9a64738a45f439dae23caf0586700e3f27b9e624cb6b2d9c2940f4b18fb0f3c5e7cace6d222a65e31f1120e93f351bdaca3592e58d4a

Download Submit
C:\Windows\System\vRnhPiA.exe

Filesize
1.4MB

MD5
704719b1cc3b0fd7e714195967094b89

SHA1
07ee28f9188dc8c32efd727bdc46ec1afc3e56dc

SHA256
0cfe3d73d2396c77cf6bb41db84b76e7e8014b9c5e2dcd3a16a5eb1b43ca184a

SHA512
2a091c0e36abec26eea12816b42bb6186661ede76e71c53d4ba915cea5d32c1e07177abe9f978f6ee3d3c3c55e21429a983c9717392a766754d69602606a12d0

Download Submit
C:\Windows\System\vVMKcLq.exe

Filesize
1.4MB

MD5
e7733aa5a7f17b464c608d9b1a68dafc

SHA1
1c5c40e593083b829e4144c9fd38ba172f5bdd96

SHA256
d56fd3d5fd182cd977c885e244aea5b1cecf7b6ef6640a4663e8251230760214

SHA512
0d1a5a7278028bce61dcc1b79bea1c4f5119bd5c186aba218564565c8b24448f46cdaa41c1443958ee68b6dc304c5b200d7e0256c9b0e6c006e3bd1c0386bc6e

Download Submit
C:\Windows\System\vYrQkMH.exe

Filesize
1.4MB

MD5
a92e58aaa968e6e25424d10be3983598

SHA1
708d7697a29010ba00aa1bbf837c8445b3154ce1

SHA256
ed6594b27d91bc8a46a00d6e451894739fbc49517ec480434b186c3cd72ac769

SHA512
d5ffd4a8833e8746ddc397827a0ced7d795783eafa2b92cd5f5dc68a4e8a9375a09a74ae0c409f2566a053c62dd023c8c4d44766152283617c62ae7f8a05b1c1

Download Submit
C:\Windows\System\vuGdyAc.exe

Filesize
1.4MB

MD5
c3a33002a7f96b766d8b38569db94937

SHA1
36b6583b44d02ab8819686f0330732b3e7324291

SHA256
68c1e21e0b69ca8327d66edaf60b8ae5cead8061424a87663d5d31e9e84c5500

SHA512
25a27ebb99f009145842edb957d4eee29870c4dd47412d3219646bbe93cd1b60f321c5fce691b885595f14acd370860ba8d372efc2749ac9862eb49daa1099a6

Download Submit
C:\Windows\System\xNaAuog.exe

Filesize
1.4MB

MD5
45feaad92ef157c46a2e1c3651630d92

SHA1
9b4a6d65b06ad1e6202ab4368036e3710404ab86

SHA256
d6b639969ab05e53014cd9c9f156e3f644bb74a09a05920d5c0f83049dbc5ce2

SHA512
84c74e29975f8aea881b3e8c67a4527e8110301416a754d9de086621ded13b78065d8b0029069d87210792d153e60157d50405e1203c65de331741b22d6ee9b0

Download Submit
C:\Windows\System\zGPaYeb.exe

Filesize
1.4MB

MD5
3ff23623f356a7ed76991d8102656913

SHA1
859c9cee321bec1e643dfa8026fed570993d5ff1

SHA256
6e1db4aade9dd9f6f59272a19b17b6b96d6a664b0d3c3c5f5da47b63db3f9d92

SHA512
c6db13eb0eb73d38748950a292b0162fc95a2ec0a8651a68b05c2772ef4ff42a7b69c5451e9aa241c34e92a5bd21d2e42ea5a8e803a7fd2dbadec32b07da939f

Download Submit
memory/3256-0-0x000002BEC2EB0000-0x000002BEC2EC0000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads