xmrig | 2dd91ccd3a19b1bddee65881678570f550193221b8cc78828dcd45e63ac80099

Analysis

max time kernel
135s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
21/11/2024, 21:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2dd91ccd3a19b1bddee65881678570f550193221b8cc78828dcd45e63ac80099.exe
Size

1.6MB
MD5

fe5264ef3035d8ccadd38e3adc58715a
SHA1

959ac0f38102df0b50bdac0bf7a8b92eac3b84b9
SHA256

2dd91ccd3a19b1bddee65881678570f550193221b8cc78828dcd45e63ac80099
SHA512

8bacb76d0bf15f8be4ce31275ba061987f084ef6cc4a2d4318ff792f51a90aae933aea746c46e72dec7d35ef5c213b745396eefcb8816af6fb5f0c9aae2d7665
SSDEEP

49152:GezaTF8FcNkNdfE0pZ9ozttwIRxj4c5yOBZnmxZ8zoON:GemTLkNdfE0pZyn

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 33 IoCs

miner

resource	yara_rule
behavioral2/files/0x000d000000023b7c-4.dat	xmrig
behavioral2/files/0x0007000000023c99-15.dat	xmrig
behavioral2/files/0x0007000000023c9b-44.dat	xmrig
behavioral2/files/0x0007000000023c9e-57.dat	xmrig
behavioral2/files/0x0007000000023ca2-65.dat	xmrig
behavioral2/files/0x0007000000023ca1-63.dat	xmrig
behavioral2/files/0x0007000000023ca0-61.dat	xmrig
behavioral2/files/0x0007000000023c9f-59.dat	xmrig
behavioral2/files/0x0007000000023c9c-55.dat	xmrig
behavioral2/files/0x0007000000023c9d-51.dat	xmrig
behavioral2/files/0x0008000000023c94-72.dat	xmrig
behavioral2/files/0x0007000000023ca3-71.dat	xmrig
behavioral2/files/0x0007000000023ca4-79.dat	xmrig
behavioral2/files/0x0007000000023ca5-85.dat	xmrig
behavioral2/files/0x0007000000023ca7-96.dat	xmrig
behavioral2/files/0x0007000000023cab-108.dat	xmrig
behavioral2/files/0x0007000000023ca9-116.dat	xmrig
behavioral2/files/0x0007000000023cad-124.dat	xmrig
behavioral2/files/0x0007000000023cb2-143.dat	xmrig
behavioral2/files/0x0007000000023caf-150.dat	xmrig
behavioral2/files/0x0007000000023cb1-146.dat	xmrig
behavioral2/files/0x0007000000023cb0-144.dat	xmrig
behavioral2/files/0x0007000000023cae-140.dat	xmrig
behavioral2/files/0x0007000000023cac-132.dat	xmrig
behavioral2/files/0x0007000000023caa-120.dat	xmrig
behavioral2/files/0x0007000000023ca8-112.dat	xmrig
behavioral2/files/0x0007000000023cb3-155.dat	xmrig
behavioral2/files/0x0007000000023cb6-162.dat	xmrig
behavioral2/files/0x0007000000023cb5-158.dat	xmrig
behavioral2/files/0x0007000000023ca6-90.dat	xmrig
behavioral2/files/0x0007000000023c9a-29.dat	xmrig
behavioral2/files/0x0007000000023c98-18.dat	xmrig
behavioral2/files/0x0008000000023c93-16.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
3440	ZxtwzVT.exe
2052	orFUclN.exe
3304	QPxNcTG.exe
2192	YIpcoEH.exe
1932	DFYZVlP.exe
4108	GyNmvOd.exe
2540	OjjOqge.exe
1432	VxgmdEL.exe
4456	fOFHfUy.exe
4516	DHBbnXU.exe
1152	LmuMPuX.exe
3704	iUsGKxq.exe
1220	sfsELyb.exe
2572	QhlxOLf.exe
4680	ceXcnGx.exe
4876	PYdDFsf.exe
4292	WDffcMd.exe
2716	cyOSfaC.exe
1208	jWnnGCP.exe
3196	MJzSKaF.exe
1672	iSMOAiB.exe
4992	sSFisOW.exe
2096	ppVbMyt.exe
1212	PSLHWen.exe
808	DulCsmO.exe
1364	AtlHAef.exe
4640	xwKYotp.exe
916	OSODvzJ.exe
1356	GKjzWJx.exe
3012	arkfpXq.exe
1368	DjaJCJg.exe
2904	vgNDtzK.exe
3964	MQGFrWS.exe
5044	CwCVRys.exe
3620	HbzNTHp.exe
3772	UgdLCXI.exe
208	zwqFonn.exe
3652	fnyfhtx.exe
444	OeyOfJA.exe
2252	EZRFbTN.exe
4828	UulVqea.exe
4824	JFIEbdM.exe
2320	aUULWyY.exe
4980	tsxZsvy.exe
4904	ntMQYwO.exe
4772	uFdoUcY.exe
3036	EIDWaCV.exe
1252	TMDrgEy.exe
1616	ZBMyLOF.exe
4332	aoMBbCH.exe
4324	HHXlxvO.exe
1548	ViDQFbo.exe
4084	hsGqmBC.exe
2216	JuyQaWk.exe
4800	aWgryPw.exe
2440	GntAaEz.exe
3488	ayXWBKB.exe
4184	AlmblAY.exe
3900	HwoGAVS.exe
60	DBZwcPR.exe
1532	tZAdyvf.exe
3340	xUbRDbo.exe
3576	XBKwBCm.exe
2976	XDwDejn.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\EVvvFNM.exe	2dd91ccd3a19b1bddee65881678570f550193221b8cc78828dcd45e63ac80099.exe
File created	C:\Windows\System\QNvlUMP.exe	2dd91ccd3a19b1bddee65881678570f550193221b8cc78828dcd45e63ac80099.exe
File created	C:\Windows\System\LLRkwnY.exe	2dd91ccd3a19b1bddee65881678570f550193221b8cc78828dcd45e63ac80099.exe
File created	C:\Windows\System\GjGjScM.exe	2dd91ccd3a19b1bddee65881678570f550193221b8cc78828dcd45e63ac80099.exe
File created	C:\Windows\System\uwOvjZR.exe	2dd91ccd3a19b1bddee65881678570f550193221b8cc78828dcd45e63ac80099.exe
File created	C:\Windows\System\jJMolYW.exe	2dd91ccd3a19b1bddee65881678570f550193221b8cc78828dcd45e63ac80099.exe
File created	C:\Windows\System\JNOFXBJ.exe	2dd91ccd3a19b1bddee65881678570f550193221b8cc78828dcd45e63ac80099.exe
File created	C:\Windows\System\VHvrffT.exe	2dd91ccd3a19b1bddee65881678570f550193221b8cc78828dcd45e63ac80099.exe
File created	C:\Windows\System\ZYcSwrM.exe	2dd91ccd3a19b1bddee65881678570f550193221b8cc78828dcd45e63ac80099.exe
File created	C:\Windows\System\vrUUAXH.exe	2dd91ccd3a19b1bddee65881678570f550193221b8cc78828dcd45e63ac80099.exe
File created	C:\Windows\System\ANQvzlk.exe	2dd91ccd3a19b1bddee65881678570f550193221b8cc78828dcd45e63ac80099.exe
File created	C:\Windows\System\gjaxlmo.exe	2dd91ccd3a19b1bddee65881678570f550193221b8cc78828dcd45e63ac80099.exe
File created	C:\Windows\System\uDUfQEf.exe	2dd91ccd3a19b1bddee65881678570f550193221b8cc78828dcd45e63ac80099.exe
File created	C:\Windows\System\kkiSTpI.exe	2dd91ccd3a19b1bddee65881678570f550193221b8cc78828dcd45e63ac80099.exe
File created	C:\Windows\System\HFwMJzY.exe	2dd91ccd3a19b1bddee65881678570f550193221b8cc78828dcd45e63ac80099.exe
File created	C:\Windows\System\fatkFbF.exe	2dd91ccd3a19b1bddee65881678570f550193221b8cc78828dcd45e63ac80099.exe
File created	C:\Windows\System\HKumkTS.exe	2dd91ccd3a19b1bddee65881678570f550193221b8cc78828dcd45e63ac80099.exe
File created	C:\Windows\System\knAkiiO.exe	2dd91ccd3a19b1bddee65881678570f550193221b8cc78828dcd45e63ac80099.exe
File created	C:\Windows\System\PDbcNgk.exe	2dd91ccd3a19b1bddee65881678570f550193221b8cc78828dcd45e63ac80099.exe
File created	C:\Windows\System\AuNKnTC.exe	2dd91ccd3a19b1bddee65881678570f550193221b8cc78828dcd45e63ac80099.exe
File created	C:\Windows\System\HWdERsl.exe	2dd91ccd3a19b1bddee65881678570f550193221b8cc78828dcd45e63ac80099.exe
File created	C:\Windows\System\DDksyBA.exe	2dd91ccd3a19b1bddee65881678570f550193221b8cc78828dcd45e63ac80099.exe
File created	C:\Windows\System\UlVHRCx.exe	2dd91ccd3a19b1bddee65881678570f550193221b8cc78828dcd45e63ac80099.exe
File created	C:\Windows\System\asMnvVw.exe	2dd91ccd3a19b1bddee65881678570f550193221b8cc78828dcd45e63ac80099.exe
File created	C:\Windows\System\CsoyBrz.exe	2dd91ccd3a19b1bddee65881678570f550193221b8cc78828dcd45e63ac80099.exe
File created	C:\Windows\System\WCfKUpJ.exe	2dd91ccd3a19b1bddee65881678570f550193221b8cc78828dcd45e63ac80099.exe
File created	C:\Windows\System\cHfjmYI.exe	2dd91ccd3a19b1bddee65881678570f550193221b8cc78828dcd45e63ac80099.exe
File created	C:\Windows\System\sSqeRAh.exe	2dd91ccd3a19b1bddee65881678570f550193221b8cc78828dcd45e63ac80099.exe
File created	C:\Windows\System\xUbRDbo.exe	2dd91ccd3a19b1bddee65881678570f550193221b8cc78828dcd45e63ac80099.exe
File created	C:\Windows\System\NpmVQhC.exe	2dd91ccd3a19b1bddee65881678570f550193221b8cc78828dcd45e63ac80099.exe
File created	C:\Windows\System\mNUUDSc.exe	2dd91ccd3a19b1bddee65881678570f550193221b8cc78828dcd45e63ac80099.exe
File created	C:\Windows\System\yMrVGnb.exe	2dd91ccd3a19b1bddee65881678570f550193221b8cc78828dcd45e63ac80099.exe
File created	C:\Windows\System\wxAwVOs.exe	2dd91ccd3a19b1bddee65881678570f550193221b8cc78828dcd45e63ac80099.exe
File created	C:\Windows\System\XlEzzdj.exe	2dd91ccd3a19b1bddee65881678570f550193221b8cc78828dcd45e63ac80099.exe
File created	C:\Windows\System\RHJireC.exe	2dd91ccd3a19b1bddee65881678570f550193221b8cc78828dcd45e63ac80099.exe
File created	C:\Windows\System\MTPTNYX.exe	2dd91ccd3a19b1bddee65881678570f550193221b8cc78828dcd45e63ac80099.exe
File created	C:\Windows\System\EljtqKf.exe	2dd91ccd3a19b1bddee65881678570f550193221b8cc78828dcd45e63ac80099.exe
File created	C:\Windows\System\UYecehw.exe	2dd91ccd3a19b1bddee65881678570f550193221b8cc78828dcd45e63ac80099.exe
File created	C:\Windows\System\pBZDKiQ.exe	2dd91ccd3a19b1bddee65881678570f550193221b8cc78828dcd45e63ac80099.exe
File created	C:\Windows\System\ppVbMyt.exe	2dd91ccd3a19b1bddee65881678570f550193221b8cc78828dcd45e63ac80099.exe
File created	C:\Windows\System\UDIueTx.exe	2dd91ccd3a19b1bddee65881678570f550193221b8cc78828dcd45e63ac80099.exe
File created	C:\Windows\System\cMpNroi.exe	2dd91ccd3a19b1bddee65881678570f550193221b8cc78828dcd45e63ac80099.exe
File created	C:\Windows\System\NLjiUpi.exe	2dd91ccd3a19b1bddee65881678570f550193221b8cc78828dcd45e63ac80099.exe
File created	C:\Windows\System\VtIjiYX.exe	2dd91ccd3a19b1bddee65881678570f550193221b8cc78828dcd45e63ac80099.exe
File created	C:\Windows\System\BLDzUFA.exe	2dd91ccd3a19b1bddee65881678570f550193221b8cc78828dcd45e63ac80099.exe
File created	C:\Windows\System\GxzdOyl.exe	2dd91ccd3a19b1bddee65881678570f550193221b8cc78828dcd45e63ac80099.exe
File created	C:\Windows\System\RvFNfsW.exe	2dd91ccd3a19b1bddee65881678570f550193221b8cc78828dcd45e63ac80099.exe
File created	C:\Windows\System\tcFRPkG.exe	2dd91ccd3a19b1bddee65881678570f550193221b8cc78828dcd45e63ac80099.exe
File created	C:\Windows\System\ofgVLLq.exe	2dd91ccd3a19b1bddee65881678570f550193221b8cc78828dcd45e63ac80099.exe
File created	C:\Windows\System\UuETLPK.exe	2dd91ccd3a19b1bddee65881678570f550193221b8cc78828dcd45e63ac80099.exe
File created	C:\Windows\System\fkApSsT.exe	2dd91ccd3a19b1bddee65881678570f550193221b8cc78828dcd45e63ac80099.exe
File created	C:\Windows\System\SUoVyfo.exe	2dd91ccd3a19b1bddee65881678570f550193221b8cc78828dcd45e63ac80099.exe
File created	C:\Windows\System\rcvZGuW.exe	2dd91ccd3a19b1bddee65881678570f550193221b8cc78828dcd45e63ac80099.exe
File created	C:\Windows\System\SQylnFE.exe	2dd91ccd3a19b1bddee65881678570f550193221b8cc78828dcd45e63ac80099.exe
File created	C:\Windows\System\sZrGFOe.exe	2dd91ccd3a19b1bddee65881678570f550193221b8cc78828dcd45e63ac80099.exe
File created	C:\Windows\System\tsxZsvy.exe	2dd91ccd3a19b1bddee65881678570f550193221b8cc78828dcd45e63ac80099.exe
File created	C:\Windows\System\DIVwzfT.exe	2dd91ccd3a19b1bddee65881678570f550193221b8cc78828dcd45e63ac80099.exe
File created	C:\Windows\System\JXesWvm.exe	2dd91ccd3a19b1bddee65881678570f550193221b8cc78828dcd45e63ac80099.exe
File created	C:\Windows\System\xRtSNdG.exe	2dd91ccd3a19b1bddee65881678570f550193221b8cc78828dcd45e63ac80099.exe
File created	C:\Windows\System\GgYfZBM.exe	2dd91ccd3a19b1bddee65881678570f550193221b8cc78828dcd45e63ac80099.exe
File created	C:\Windows\System\XDwDejn.exe	2dd91ccd3a19b1bddee65881678570f550193221b8cc78828dcd45e63ac80099.exe
File created	C:\Windows\System\oaoKJuW.exe	2dd91ccd3a19b1bddee65881678570f550193221b8cc78828dcd45e63ac80099.exe
File created	C:\Windows\System\jPjfIgV.exe	2dd91ccd3a19b1bddee65881678570f550193221b8cc78828dcd45e63ac80099.exe
File created	C:\Windows\System\DUALsTr.exe	2dd91ccd3a19b1bddee65881678570f550193221b8cc78828dcd45e63ac80099.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	16804	dwm.exe
Token: SeChangeNotifyPrivilege	16804	dwm.exe
Token: 33	16804	dwm.exe
Token: SeIncBasePriorityPrivilege	16804	dwm.exe
Token: SeShutdownPrivilege	16804	dwm.exe
Token: SeCreatePagefilePrivilege	16804	dwm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2304 wrote to memory of 3440	2304	2dd91ccd3a19b1bddee65881678570f550193221b8cc78828dcd45e63ac80099.exe	86
PID 2304 wrote to memory of 3440	2304	2dd91ccd3a19b1bddee65881678570f550193221b8cc78828dcd45e63ac80099.exe	86
PID 2304 wrote to memory of 2052	2304	2dd91ccd3a19b1bddee65881678570f550193221b8cc78828dcd45e63ac80099.exe	87
PID 2304 wrote to memory of 2052	2304	2dd91ccd3a19b1bddee65881678570f550193221b8cc78828dcd45e63ac80099.exe	87
PID 2304 wrote to memory of 3304	2304	2dd91ccd3a19b1bddee65881678570f550193221b8cc78828dcd45e63ac80099.exe	88
PID 2304 wrote to memory of 3304	2304	2dd91ccd3a19b1bddee65881678570f550193221b8cc78828dcd45e63ac80099.exe	88
PID 2304 wrote to memory of 2192	2304	2dd91ccd3a19b1bddee65881678570f550193221b8cc78828dcd45e63ac80099.exe	89
PID 2304 wrote to memory of 2192	2304	2dd91ccd3a19b1bddee65881678570f550193221b8cc78828dcd45e63ac80099.exe	89
PID 2304 wrote to memory of 1932	2304	2dd91ccd3a19b1bddee65881678570f550193221b8cc78828dcd45e63ac80099.exe	90
PID 2304 wrote to memory of 1932	2304	2dd91ccd3a19b1bddee65881678570f550193221b8cc78828dcd45e63ac80099.exe	90
PID 2304 wrote to memory of 4108	2304	2dd91ccd3a19b1bddee65881678570f550193221b8cc78828dcd45e63ac80099.exe	91
PID 2304 wrote to memory of 4108	2304	2dd91ccd3a19b1bddee65881678570f550193221b8cc78828dcd45e63ac80099.exe	91
PID 2304 wrote to memory of 2540	2304	2dd91ccd3a19b1bddee65881678570f550193221b8cc78828dcd45e63ac80099.exe	92
PID 2304 wrote to memory of 2540	2304	2dd91ccd3a19b1bddee65881678570f550193221b8cc78828dcd45e63ac80099.exe	92
PID 2304 wrote to memory of 1432	2304	2dd91ccd3a19b1bddee65881678570f550193221b8cc78828dcd45e63ac80099.exe	93
PID 2304 wrote to memory of 1432	2304	2dd91ccd3a19b1bddee65881678570f550193221b8cc78828dcd45e63ac80099.exe	93
PID 2304 wrote to memory of 4456	2304	2dd91ccd3a19b1bddee65881678570f550193221b8cc78828dcd45e63ac80099.exe	94
PID 2304 wrote to memory of 4456	2304	2dd91ccd3a19b1bddee65881678570f550193221b8cc78828dcd45e63ac80099.exe	94
PID 2304 wrote to memory of 4516	2304	2dd91ccd3a19b1bddee65881678570f550193221b8cc78828dcd45e63ac80099.exe	95
PID 2304 wrote to memory of 4516	2304	2dd91ccd3a19b1bddee65881678570f550193221b8cc78828dcd45e63ac80099.exe	95
PID 2304 wrote to memory of 1152	2304	2dd91ccd3a19b1bddee65881678570f550193221b8cc78828dcd45e63ac80099.exe	96
PID 2304 wrote to memory of 1152	2304	2dd91ccd3a19b1bddee65881678570f550193221b8cc78828dcd45e63ac80099.exe	96
PID 2304 wrote to memory of 3704	2304	2dd91ccd3a19b1bddee65881678570f550193221b8cc78828dcd45e63ac80099.exe	97
PID 2304 wrote to memory of 3704	2304	2dd91ccd3a19b1bddee65881678570f550193221b8cc78828dcd45e63ac80099.exe	97
PID 2304 wrote to memory of 1220	2304	2dd91ccd3a19b1bddee65881678570f550193221b8cc78828dcd45e63ac80099.exe	98
PID 2304 wrote to memory of 1220	2304	2dd91ccd3a19b1bddee65881678570f550193221b8cc78828dcd45e63ac80099.exe	98
PID 2304 wrote to memory of 2572	2304	2dd91ccd3a19b1bddee65881678570f550193221b8cc78828dcd45e63ac80099.exe	99
PID 2304 wrote to memory of 2572	2304	2dd91ccd3a19b1bddee65881678570f550193221b8cc78828dcd45e63ac80099.exe	99
PID 2304 wrote to memory of 4680	2304	2dd91ccd3a19b1bddee65881678570f550193221b8cc78828dcd45e63ac80099.exe	100
PID 2304 wrote to memory of 4680	2304	2dd91ccd3a19b1bddee65881678570f550193221b8cc78828dcd45e63ac80099.exe	100
PID 2304 wrote to memory of 4876	2304	2dd91ccd3a19b1bddee65881678570f550193221b8cc78828dcd45e63ac80099.exe	101
PID 2304 wrote to memory of 4876	2304	2dd91ccd3a19b1bddee65881678570f550193221b8cc78828dcd45e63ac80099.exe	101
PID 2304 wrote to memory of 4292	2304	2dd91ccd3a19b1bddee65881678570f550193221b8cc78828dcd45e63ac80099.exe	102
PID 2304 wrote to memory of 4292	2304	2dd91ccd3a19b1bddee65881678570f550193221b8cc78828dcd45e63ac80099.exe	102
PID 2304 wrote to memory of 2716	2304	2dd91ccd3a19b1bddee65881678570f550193221b8cc78828dcd45e63ac80099.exe	103
PID 2304 wrote to memory of 2716	2304	2dd91ccd3a19b1bddee65881678570f550193221b8cc78828dcd45e63ac80099.exe	103
PID 2304 wrote to memory of 1208	2304	2dd91ccd3a19b1bddee65881678570f550193221b8cc78828dcd45e63ac80099.exe	104
PID 2304 wrote to memory of 1208	2304	2dd91ccd3a19b1bddee65881678570f550193221b8cc78828dcd45e63ac80099.exe	104
PID 2304 wrote to memory of 3196	2304	2dd91ccd3a19b1bddee65881678570f550193221b8cc78828dcd45e63ac80099.exe	105
PID 2304 wrote to memory of 3196	2304	2dd91ccd3a19b1bddee65881678570f550193221b8cc78828dcd45e63ac80099.exe	105
PID 2304 wrote to memory of 1672	2304	2dd91ccd3a19b1bddee65881678570f550193221b8cc78828dcd45e63ac80099.exe	106
PID 2304 wrote to memory of 1672	2304	2dd91ccd3a19b1bddee65881678570f550193221b8cc78828dcd45e63ac80099.exe	106
PID 2304 wrote to memory of 4992	2304	2dd91ccd3a19b1bddee65881678570f550193221b8cc78828dcd45e63ac80099.exe	107
PID 2304 wrote to memory of 4992	2304	2dd91ccd3a19b1bddee65881678570f550193221b8cc78828dcd45e63ac80099.exe	107
PID 2304 wrote to memory of 2096	2304	2dd91ccd3a19b1bddee65881678570f550193221b8cc78828dcd45e63ac80099.exe	108
PID 2304 wrote to memory of 2096	2304	2dd91ccd3a19b1bddee65881678570f550193221b8cc78828dcd45e63ac80099.exe	108
PID 2304 wrote to memory of 1212	2304	2dd91ccd3a19b1bddee65881678570f550193221b8cc78828dcd45e63ac80099.exe	109
PID 2304 wrote to memory of 1212	2304	2dd91ccd3a19b1bddee65881678570f550193221b8cc78828dcd45e63ac80099.exe	109
PID 2304 wrote to memory of 808	2304	2dd91ccd3a19b1bddee65881678570f550193221b8cc78828dcd45e63ac80099.exe	110
PID 2304 wrote to memory of 808	2304	2dd91ccd3a19b1bddee65881678570f550193221b8cc78828dcd45e63ac80099.exe	110
PID 2304 wrote to memory of 1364	2304	2dd91ccd3a19b1bddee65881678570f550193221b8cc78828dcd45e63ac80099.exe	111
PID 2304 wrote to memory of 1364	2304	2dd91ccd3a19b1bddee65881678570f550193221b8cc78828dcd45e63ac80099.exe	111
PID 2304 wrote to memory of 4640	2304	2dd91ccd3a19b1bddee65881678570f550193221b8cc78828dcd45e63ac80099.exe	112
PID 2304 wrote to memory of 4640	2304	2dd91ccd3a19b1bddee65881678570f550193221b8cc78828dcd45e63ac80099.exe	112
PID 2304 wrote to memory of 916	2304	2dd91ccd3a19b1bddee65881678570f550193221b8cc78828dcd45e63ac80099.exe	113
PID 2304 wrote to memory of 916	2304	2dd91ccd3a19b1bddee65881678570f550193221b8cc78828dcd45e63ac80099.exe	113
PID 2304 wrote to memory of 1356	2304	2dd91ccd3a19b1bddee65881678570f550193221b8cc78828dcd45e63ac80099.exe	114
PID 2304 wrote to memory of 1356	2304	2dd91ccd3a19b1bddee65881678570f550193221b8cc78828dcd45e63ac80099.exe	114
PID 2304 wrote to memory of 3012	2304	2dd91ccd3a19b1bddee65881678570f550193221b8cc78828dcd45e63ac80099.exe	115
PID 2304 wrote to memory of 3012	2304	2dd91ccd3a19b1bddee65881678570f550193221b8cc78828dcd45e63ac80099.exe	115
PID 2304 wrote to memory of 1368	2304	2dd91ccd3a19b1bddee65881678570f550193221b8cc78828dcd45e63ac80099.exe	116
PID 2304 wrote to memory of 1368	2304	2dd91ccd3a19b1bddee65881678570f550193221b8cc78828dcd45e63ac80099.exe	116
PID 2304 wrote to memory of 2904	2304	2dd91ccd3a19b1bddee65881678570f550193221b8cc78828dcd45e63ac80099.exe	117
PID 2304 wrote to memory of 2904	2304	2dd91ccd3a19b1bddee65881678570f550193221b8cc78828dcd45e63ac80099.exe	117

C:\Users\Admin\AppData\Local\Temp\2dd91ccd3a19b1bddee65881678570f550193221b8cc78828dcd45e63ac80099.exe
"C:\Users\Admin\AppData\Local\Temp\2dd91ccd3a19b1bddee65881678570f550193221b8cc78828dcd45e63ac80099.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2304
- C:\Windows\System\ZxtwzVT.exe
  C:\Windows\System\ZxtwzVT.exe
  2⤵
  - Executes dropped EXE
  PID:3440
- C:\Windows\System\orFUclN.exe
  C:\Windows\System\orFUclN.exe
  2⤵
  - Executes dropped EXE
  PID:2052
- C:\Windows\System\QPxNcTG.exe
  C:\Windows\System\QPxNcTG.exe
  2⤵
  - Executes dropped EXE
  PID:3304
- C:\Windows\System\YIpcoEH.exe
  C:\Windows\System\YIpcoEH.exe
  2⤵
  - Executes dropped EXE
  PID:2192
- C:\Windows\System\DFYZVlP.exe
  C:\Windows\System\DFYZVlP.exe
  2⤵
  - Executes dropped EXE
  PID:1932
- C:\Windows\System\GyNmvOd.exe
  C:\Windows\System\GyNmvOd.exe
  2⤵
  - Executes dropped EXE
  PID:4108
- C:\Windows\System\OjjOqge.exe
  C:\Windows\System\OjjOqge.exe
  2⤵
  - Executes dropped EXE
  PID:2540
- C:\Windows\System\VxgmdEL.exe
  C:\Windows\System\VxgmdEL.exe
  2⤵
  - Executes dropped EXE
  PID:1432
- C:\Windows\System\fOFHfUy.exe
  C:\Windows\System\fOFHfUy.exe
  2⤵
  - Executes dropped EXE
  PID:4456
- C:\Windows\System\DHBbnXU.exe
  C:\Windows\System\DHBbnXU.exe
  2⤵
  - Executes dropped EXE
  PID:4516
- C:\Windows\System\LmuMPuX.exe
  C:\Windows\System\LmuMPuX.exe
  2⤵
  - Executes dropped EXE
  PID:1152
- C:\Windows\System\iUsGKxq.exe
  C:\Windows\System\iUsGKxq.exe
  2⤵
  - Executes dropped EXE
  PID:3704
- C:\Windows\System\sfsELyb.exe
  C:\Windows\System\sfsELyb.exe
  2⤵
  - Executes dropped EXE
  PID:1220
- C:\Windows\System\QhlxOLf.exe
  C:\Windows\System\QhlxOLf.exe
  2⤵
  - Executes dropped EXE
  PID:2572
- C:\Windows\System\ceXcnGx.exe
  C:\Windows\System\ceXcnGx.exe
  2⤵
  - Executes dropped EXE
  PID:4680
- C:\Windows\System\PYdDFsf.exe
  C:\Windows\System\PYdDFsf.exe
  2⤵
  - Executes dropped EXE
  PID:4876
- C:\Windows\System\WDffcMd.exe
  C:\Windows\System\WDffcMd.exe
  2⤵
  - Executes dropped EXE
  PID:4292
- C:\Windows\System\cyOSfaC.exe
  C:\Windows\System\cyOSfaC.exe
  2⤵
  - Executes dropped EXE
  PID:2716
- C:\Windows\System\jWnnGCP.exe
  C:\Windows\System\jWnnGCP.exe
  2⤵
  - Executes dropped EXE
  PID:1208
- C:\Windows\System\MJzSKaF.exe
  C:\Windows\System\MJzSKaF.exe
  2⤵
  - Executes dropped EXE
  PID:3196
- C:\Windows\System\iSMOAiB.exe
  C:\Windows\System\iSMOAiB.exe
  2⤵
  - Executes dropped EXE
  PID:1672
- C:\Windows\System\sSFisOW.exe
  C:\Windows\System\sSFisOW.exe
  2⤵
  - Executes dropped EXE
  PID:4992
- C:\Windows\System\ppVbMyt.exe
  C:\Windows\System\ppVbMyt.exe
  2⤵
  - Executes dropped EXE
  PID:2096
- C:\Windows\System\PSLHWen.exe
  C:\Windows\System\PSLHWen.exe
  2⤵
  - Executes dropped EXE
  PID:1212
- C:\Windows\System\DulCsmO.exe
  C:\Windows\System\DulCsmO.exe
  2⤵
  - Executes dropped EXE
  PID:808
- C:\Windows\System\AtlHAef.exe
  C:\Windows\System\AtlHAef.exe
  2⤵
  - Executes dropped EXE
  PID:1364
- C:\Windows\System\xwKYotp.exe
  C:\Windows\System\xwKYotp.exe
  2⤵
  - Executes dropped EXE
  PID:4640
- C:\Windows\System\OSODvzJ.exe
  C:\Windows\System\OSODvzJ.exe
  2⤵
  - Executes dropped EXE
  PID:916
- C:\Windows\System\GKjzWJx.exe
  C:\Windows\System\GKjzWJx.exe
  2⤵
  - Executes dropped EXE
  PID:1356
- C:\Windows\System\arkfpXq.exe
  C:\Windows\System\arkfpXq.exe
  2⤵
  - Executes dropped EXE
  PID:3012
- C:\Windows\System\DjaJCJg.exe
  C:\Windows\System\DjaJCJg.exe
  2⤵
  - Executes dropped EXE
  PID:1368
- C:\Windows\System\vgNDtzK.exe
  C:\Windows\System\vgNDtzK.exe
  2⤵
  - Executes dropped EXE
  PID:2904
- C:\Windows\System\MQGFrWS.exe
  C:\Windows\System\MQGFrWS.exe
  2⤵
  - Executes dropped EXE
  PID:3964
- C:\Windows\System\CwCVRys.exe
  C:\Windows\System\CwCVRys.exe
  2⤵
  - Executes dropped EXE
  PID:5044
- C:\Windows\System\HbzNTHp.exe
  C:\Windows\System\HbzNTHp.exe
  2⤵
  - Executes dropped EXE
  PID:3620
- C:\Windows\System\UgdLCXI.exe
  C:\Windows\System\UgdLCXI.exe
  2⤵
  - Executes dropped EXE
  PID:3772
- C:\Windows\System\zwqFonn.exe
  C:\Windows\System\zwqFonn.exe
  2⤵
  - Executes dropped EXE
  PID:208
- C:\Windows\System\fnyfhtx.exe
  C:\Windows\System\fnyfhtx.exe
  2⤵
  - Executes dropped EXE
  PID:3652
- C:\Windows\System\OeyOfJA.exe
  C:\Windows\System\OeyOfJA.exe
  2⤵
  - Executes dropped EXE
  PID:444
- C:\Windows\System\EZRFbTN.exe
  C:\Windows\System\EZRFbTN.exe
  2⤵
  - Executes dropped EXE
  PID:2252
- C:\Windows\System\UulVqea.exe
  C:\Windows\System\UulVqea.exe
  2⤵
  - Executes dropped EXE
  PID:4828
- C:\Windows\System\JFIEbdM.exe
  C:\Windows\System\JFIEbdM.exe
  2⤵
  - Executes dropped EXE
  PID:4824
- C:\Windows\System\aUULWyY.exe
  C:\Windows\System\aUULWyY.exe
  2⤵
  - Executes dropped EXE
  PID:2320
- C:\Windows\System\tsxZsvy.exe
  C:\Windows\System\tsxZsvy.exe
  2⤵
  - Executes dropped EXE
  PID:4980
- C:\Windows\System\ntMQYwO.exe
  C:\Windows\System\ntMQYwO.exe
  2⤵
  - Executes dropped EXE
  PID:4904
- C:\Windows\System\uFdoUcY.exe
  C:\Windows\System\uFdoUcY.exe
  2⤵
  - Executes dropped EXE
  PID:4772
- C:\Windows\System\EIDWaCV.exe
  C:\Windows\System\EIDWaCV.exe
  2⤵
  - Executes dropped EXE
  PID:3036
- C:\Windows\System\TMDrgEy.exe
  C:\Windows\System\TMDrgEy.exe
  2⤵
  - Executes dropped EXE
  PID:1252
- C:\Windows\System\ZBMyLOF.exe
  C:\Windows\System\ZBMyLOF.exe
  2⤵
  - Executes dropped EXE
  PID:1616
- C:\Windows\System\aoMBbCH.exe
  C:\Windows\System\aoMBbCH.exe
  2⤵
  - Executes dropped EXE
  PID:4332
- C:\Windows\System\HHXlxvO.exe
  C:\Windows\System\HHXlxvO.exe
  2⤵
  - Executes dropped EXE
  PID:4324
- C:\Windows\System\ViDQFbo.exe
  C:\Windows\System\ViDQFbo.exe
  2⤵
  - Executes dropped EXE
  PID:1548
- C:\Windows\System\hsGqmBC.exe
  C:\Windows\System\hsGqmBC.exe
  2⤵
  - Executes dropped EXE
  PID:4084
- C:\Windows\System\JuyQaWk.exe
  C:\Windows\System\JuyQaWk.exe
  2⤵
  - Executes dropped EXE
  PID:2216
- C:\Windows\System\aWgryPw.exe
  C:\Windows\System\aWgryPw.exe
  2⤵
  - Executes dropped EXE
  PID:4800
- C:\Windows\System\GntAaEz.exe
  C:\Windows\System\GntAaEz.exe
  2⤵
  - Executes dropped EXE
  PID:2440
- C:\Windows\System\ayXWBKB.exe
  C:\Windows\System\ayXWBKB.exe
  2⤵
  - Executes dropped EXE
  PID:3488
- C:\Windows\System\AlmblAY.exe
  C:\Windows\System\AlmblAY.exe
  2⤵
  - Executes dropped EXE
  PID:4184
- C:\Windows\System\HwoGAVS.exe
  C:\Windows\System\HwoGAVS.exe
  2⤵
  - Executes dropped EXE
  PID:3900
- C:\Windows\System\DBZwcPR.exe
  C:\Windows\System\DBZwcPR.exe
  2⤵
  - Executes dropped EXE
  PID:60
- C:\Windows\System\tZAdyvf.exe
  C:\Windows\System\tZAdyvf.exe
  2⤵
  - Executes dropped EXE
  PID:1532
- C:\Windows\System\xUbRDbo.exe
  C:\Windows\System\xUbRDbo.exe
  2⤵
  - Executes dropped EXE
  PID:3340
- C:\Windows\System\XBKwBCm.exe
  C:\Windows\System\XBKwBCm.exe
  2⤵
  - Executes dropped EXE
  PID:3576
- C:\Windows\System\XDwDejn.exe
  C:\Windows\System\XDwDejn.exe
  2⤵
  - Executes dropped EXE
  PID:2976
- C:\Windows\System\ZeTrWXf.exe
  C:\Windows\System\ZeTrWXf.exe
  2⤵
  PID:244
- C:\Windows\System\sQOPtis.exe
  C:\Windows\System\sQOPtis.exe
  2⤵
  PID:1008
- C:\Windows\System\rlcNwrG.exe
  C:\Windows\System\rlcNwrG.exe
  2⤵
  PID:1176
- C:\Windows\System\ecxSwND.exe
  C:\Windows\System\ecxSwND.exe
  2⤵
  PID:4892
- C:\Windows\System\KpBppAj.exe
  C:\Windows\System\KpBppAj.exe
  2⤵
  PID:2588
- C:\Windows\System\NTvkpmU.exe
  C:\Windows\System\NTvkpmU.exe
  2⤵
  PID:3420
- C:\Windows\System\qPhNMAj.exe
  C:\Windows\System\qPhNMAj.exe
  2⤵
  PID:624
- C:\Windows\System\dDjyGra.exe
  C:\Windows\System\dDjyGra.exe
  2⤵
  PID:2600
- C:\Windows\System\LXmEeQN.exe
  C:\Windows\System\LXmEeQN.exe
  2⤵
  PID:732
- C:\Windows\System\YfGEvoP.exe
  C:\Windows\System\YfGEvoP.exe
  2⤵
  PID:1852
- C:\Windows\System\pQEubxE.exe
  C:\Windows\System\pQEubxE.exe
  2⤵
  PID:1536
- C:\Windows\System\xWNnSHd.exe
  C:\Windows\System\xWNnSHd.exe
  2⤵
  PID:4468
- C:\Windows\System\qTLqtaC.exe
  C:\Windows\System\qTLqtaC.exe
  2⤵
  PID:3116
- C:\Windows\System\bNlHLdB.exe
  C:\Windows\System\bNlHLdB.exe
  2⤵
  PID:4988
- C:\Windows\System\PwZLQnS.exe
  C:\Windows\System\PwZLQnS.exe
  2⤵
  PID:4844
- C:\Windows\System\kwNlPID.exe
  C:\Windows\System\kwNlPID.exe
  2⤵
  PID:4536
- C:\Windows\System\EAyrkeR.exe
  C:\Windows\System\EAyrkeR.exe
  2⤵
  PID:4360
- C:\Windows\System\VHvrffT.exe
  C:\Windows\System\VHvrffT.exe
  2⤵
  PID:3300
- C:\Windows\System\tqcKVhr.exe
  C:\Windows\System\tqcKVhr.exe
  2⤵
  PID:3632
- C:\Windows\System\fPpbOOr.exe
  C:\Windows\System\fPpbOOr.exe
  2⤵
  PID:2004
- C:\Windows\System\FlgvfkW.exe
  C:\Windows\System\FlgvfkW.exe
  2⤵
  PID:4564
- C:\Windows\System\qWJEDuO.exe
  C:\Windows\System\qWJEDuO.exe
  2⤵
  PID:5068
- C:\Windows\System\tptMYcy.exe
  C:\Windows\System\tptMYcy.exe
  2⤵
  PID:4912
- C:\Windows\System\JXBhquk.exe
  C:\Windows\System\JXBhquk.exe
  2⤵
  PID:4252
- C:\Windows\System\DgcJmgq.exe
  C:\Windows\System\DgcJmgq.exe
  2⤵
  PID:2696
- C:\Windows\System\zaqiAJB.exe
  C:\Windows\System\zaqiAJB.exe
  2⤵
  PID:3388
- C:\Windows\System\OYNGBqc.exe
  C:\Windows\System\OYNGBqc.exe
  2⤵
  PID:2468
- C:\Windows\System\EptCOuZ.exe
  C:\Windows\System\EptCOuZ.exe
  2⤵
  PID:2868
- C:\Windows\System\KWlWjav.exe
  C:\Windows\System\KWlWjav.exe
  2⤵
  PID:5012
- C:\Windows\System\tDOjAqU.exe
  C:\Windows\System\tDOjAqU.exe
  2⤵
  PID:3144
- C:\Windows\System\VBWsAuq.exe
  C:\Windows\System\VBWsAuq.exe
  2⤵
  PID:4780
- C:\Windows\System\tHQKBew.exe
  C:\Windows\System\tHQKBew.exe
  2⤵
  PID:4420
- C:\Windows\System\PqRMCKT.exe
  C:\Windows\System\PqRMCKT.exe
  2⤵
  PID:2116
- C:\Windows\System\DjsGnKE.exe
  C:\Windows\System\DjsGnKE.exe
  2⤵
  PID:368
- C:\Windows\System\TvEOxmP.exe
  C:\Windows\System\TvEOxmP.exe
  2⤵
  PID:4736
- C:\Windows\System\WuZNqKF.exe
  C:\Windows\System\WuZNqKF.exe
  2⤵
  PID:4532
- C:\Windows\System\hYhAXPz.exe
  C:\Windows\System\hYhAXPz.exe
  2⤵
  PID:2308
- C:\Windows\System\RBhtMvq.exe
  C:\Windows\System\RBhtMvq.exe
  2⤵
  PID:3948
- C:\Windows\System\XJfnkZb.exe
  C:\Windows\System\XJfnkZb.exe
  2⤵
  PID:372
- C:\Windows\System\dlpmRtO.exe
  C:\Windows\System\dlpmRtO.exe
  2⤵
  PID:1904
- C:\Windows\System\WXUTUOh.exe
  C:\Windows\System\WXUTUOh.exe
  2⤵
  PID:1792
- C:\Windows\System\ItncrEf.exe
  C:\Windows\System\ItncrEf.exe
  2⤵
  PID:868
- C:\Windows\System\gjaxlmo.exe
  C:\Windows\System\gjaxlmo.exe
  2⤵
  PID:2748
- C:\Windows\System\dyZAfRQ.exe
  C:\Windows\System\dyZAfRQ.exe
  2⤵
  PID:4976
- C:\Windows\System\uDUfQEf.exe
  C:\Windows\System\uDUfQEf.exe
  2⤵
  PID:5148
- C:\Windows\System\qwbkAqV.exe
  C:\Windows\System\qwbkAqV.exe
  2⤵
  PID:5188
- C:\Windows\System\SQylnFE.exe
  C:\Windows\System\SQylnFE.exe
  2⤵
  PID:5204
- C:\Windows\System\HUiEWNr.exe
  C:\Windows\System\HUiEWNr.exe
  2⤵
  PID:5220
- C:\Windows\System\mzbeEim.exe
  C:\Windows\System\mzbeEim.exe
  2⤵
  PID:5248
- C:\Windows\System\kYJjIOx.exe
  C:\Windows\System\kYJjIOx.exe
  2⤵
  PID:5268
- C:\Windows\System\itSZlFE.exe
  C:\Windows\System\itSZlFE.exe
  2⤵
  PID:5288
- C:\Windows\System\UpqZJda.exe
  C:\Windows\System\UpqZJda.exe
  2⤵
  PID:5316
- C:\Windows\System\XLpBYQM.exe
  C:\Windows\System\XLpBYQM.exe
  2⤵
  PID:5336
- C:\Windows\System\GjGjScM.exe
  C:\Windows\System\GjGjScM.exe
  2⤵
  PID:5372
- C:\Windows\System\vZTilMI.exe
  C:\Windows\System\vZTilMI.exe
  2⤵
  PID:5400
- C:\Windows\System\AHArJzu.exe
  C:\Windows\System\AHArJzu.exe
  2⤵
  PID:5440
- C:\Windows\System\UDIueTx.exe
  C:\Windows\System\UDIueTx.exe
  2⤵
  PID:5472
- C:\Windows\System\JGKtSde.exe
  C:\Windows\System\JGKtSde.exe
  2⤵
  PID:5512
- C:\Windows\System\iTqONTt.exe
  C:\Windows\System\iTqONTt.exe
  2⤵
  PID:5540
- C:\Windows\System\PnjpFyU.exe
  C:\Windows\System\PnjpFyU.exe
  2⤵
  PID:5560
- C:\Windows\System\BTTKdfO.exe
  C:\Windows\System\BTTKdfO.exe
  2⤵
  PID:5588
- C:\Windows\System\ewfLtCm.exe
  C:\Windows\System\ewfLtCm.exe
  2⤵
  PID:5612
- C:\Windows\System\AsekLSU.exe
  C:\Windows\System\AsekLSU.exe
  2⤵
  PID:5636
- C:\Windows\System\XiVoeTV.exe
  C:\Windows\System\XiVoeTV.exe
  2⤵
  PID:5668
- C:\Windows\System\HtCGKJe.exe
  C:\Windows\System\HtCGKJe.exe
  2⤵
  PID:5704
- C:\Windows\System\BaIBoNm.exe
  C:\Windows\System\BaIBoNm.exe
  2⤵
  PID:5732
- C:\Windows\System\rPSzUqm.exe
  C:\Windows\System\rPSzUqm.exe
  2⤵
  PID:5760
- C:\Windows\System\fatkFbF.exe
  C:\Windows\System\fatkFbF.exe
  2⤵
  PID:5792
- C:\Windows\System\nWsfopf.exe
  C:\Windows\System\nWsfopf.exe
  2⤵
  PID:5816
- C:\Windows\System\HKumkTS.exe
  C:\Windows\System\HKumkTS.exe
  2⤵
  PID:5852
- C:\Windows\System\hhjsvRJ.exe
  C:\Windows\System\hhjsvRJ.exe
  2⤵
  PID:5872
- C:\Windows\System\rdwJCdl.exe
  C:\Windows\System\rdwJCdl.exe
  2⤵
  PID:5904
- C:\Windows\System\zfOsztz.exe
  C:\Windows\System\zfOsztz.exe
  2⤵
  PID:5936
- C:\Windows\System\ajwXyVe.exe
  C:\Windows\System\ajwXyVe.exe
  2⤵
  PID:5964
- C:\Windows\System\tHRXmKY.exe
  C:\Windows\System\tHRXmKY.exe
  2⤵
  PID:6000
- C:\Windows\System\KXHUvtK.exe
  C:\Windows\System\KXHUvtK.exe
  2⤵
  PID:6028
- C:\Windows\System\qWEyeFi.exe
  C:\Windows\System\qWEyeFi.exe
  2⤵
  PID:6052
- C:\Windows\System\NHtxOHZ.exe
  C:\Windows\System\NHtxOHZ.exe
  2⤵
  PID:6080
- C:\Windows\System\VsINxIq.exe
  C:\Windows\System\VsINxIq.exe
  2⤵
  PID:6104
- C:\Windows\System\jQLgYip.exe
  C:\Windows\System\jQLgYip.exe
  2⤵
  PID:6120
- C:\Windows\System\tDSTaUT.exe
  C:\Windows\System\tDSTaUT.exe
  2⤵
  PID:4460
- C:\Windows\System\ABxCSrj.exe
  C:\Windows\System\ABxCSrj.exe
  2⤵
  PID:5160
- C:\Windows\System\dCvbSOH.exe
  C:\Windows\System\dCvbSOH.exe
  2⤵
  PID:5212
- C:\Windows\System\knAkiiO.exe
  C:\Windows\System\knAkiiO.exe
  2⤵
  PID:5276
- C:\Windows\System\apRJpJz.exe
  C:\Windows\System\apRJpJz.exe
  2⤵
  PID:5396
- C:\Windows\System\zZsLzrz.exe
  C:\Windows\System\zZsLzrz.exe
  2⤵
  PID:5408
- C:\Windows\System\nMuZyxJ.exe
  C:\Windows\System\nMuZyxJ.exe
  2⤵
  PID:5528
- C:\Windows\System\vqWNyoo.exe
  C:\Windows\System\vqWNyoo.exe
  2⤵
  PID:5552
- C:\Windows\System\SkHuVGZ.exe
  C:\Windows\System\SkHuVGZ.exe
  2⤵
  PID:5700
- C:\Windows\System\DUALsTr.exe
  C:\Windows\System\DUALsTr.exe
  2⤵
  PID:5784
- C:\Windows\System\YXOQYJs.exe
  C:\Windows\System\YXOQYJs.exe
  2⤵
  PID:5840
- C:\Windows\System\tCxZphS.exe
  C:\Windows\System\tCxZphS.exe
  2⤵
  PID:5868
- C:\Windows\System\XKOjMGo.exe
  C:\Windows\System\XKOjMGo.exe
  2⤵
  PID:5952
- C:\Windows\System\XvoOpBJ.exe
  C:\Windows\System\XvoOpBJ.exe
  2⤵
  PID:6008
- C:\Windows\System\mdmvbMF.exe
  C:\Windows\System\mdmvbMF.exe
  2⤵
  PID:6072
- C:\Windows\System\FrUBNcS.exe
  C:\Windows\System\FrUBNcS.exe
  2⤵
  PID:6112
- C:\Windows\System\hzPDPGH.exe
  C:\Windows\System\hzPDPGH.exe
  2⤵
  PID:5136
- C:\Windows\System\AbrAwwd.exe
  C:\Windows\System\AbrAwwd.exe
  2⤵
  PID:5356
- C:\Windows\System\jvaMfNh.exe
  C:\Windows\System\jvaMfNh.exe
  2⤵
  PID:5524
- C:\Windows\System\ShYjwaE.exe
  C:\Windows\System\ShYjwaE.exe
  2⤵
  PID:5696
- C:\Windows\System\EljtqKf.exe
  C:\Windows\System\EljtqKf.exe
  2⤵
  PID:5924
- C:\Windows\System\jFDurKp.exe
  C:\Windows\System\jFDurKp.exe
  2⤵
  PID:5976
- C:\Windows\System\ryDgOWp.exe
  C:\Windows\System\ryDgOWp.exe
  2⤵
  PID:5172
- C:\Windows\System\PSLODif.exe
  C:\Windows\System\PSLODif.exe
  2⤵
  PID:5836
- C:\Windows\System\DeSBvYC.exe
  C:\Windows\System\DeSBvYC.exe
  2⤵
  PID:6060
- C:\Windows\System\oaoKJuW.exe
  C:\Windows\System\oaoKJuW.exe
  2⤵
  PID:5244
- C:\Windows\System\aeBooRw.exe
  C:\Windows\System\aeBooRw.exe
  2⤵
  PID:6156
- C:\Windows\System\EyIqKTw.exe
  C:\Windows\System\EyIqKTw.exe
  2⤵
  PID:6176
- C:\Windows\System\iJSgval.exe
  C:\Windows\System\iJSgval.exe
  2⤵
  PID:6192
- C:\Windows\System\CitndtB.exe
  C:\Windows\System\CitndtB.exe
  2⤵
  PID:6224
- C:\Windows\System\QRBLaJJ.exe
  C:\Windows\System\QRBLaJJ.exe
  2⤵
  PID:6252
- C:\Windows\System\BNTGbMs.exe
  C:\Windows\System\BNTGbMs.exe
  2⤵
  PID:6288
- C:\Windows\System\fvnVmjF.exe
  C:\Windows\System\fvnVmjF.exe
  2⤵
  PID:6320
- C:\Windows\System\DgJbZyA.exe
  C:\Windows\System\DgJbZyA.exe
  2⤵
  PID:6348
- C:\Windows\System\qgWXECa.exe
  C:\Windows\System\qgWXECa.exe
  2⤵
  PID:6372
- C:\Windows\System\peRyunv.exe
  C:\Windows\System\peRyunv.exe
  2⤵
  PID:6400
- C:\Windows\System\zDlCKXh.exe
  C:\Windows\System\zDlCKXh.exe
  2⤵
  PID:6416
- C:\Windows\System\fPNhLPP.exe
  C:\Windows\System\fPNhLPP.exe
  2⤵
  PID:6448
- C:\Windows\System\DfdBhzO.exe
  C:\Windows\System\DfdBhzO.exe
  2⤵
  PID:6484
- C:\Windows\System\TIeDCRA.exe
  C:\Windows\System\TIeDCRA.exe
  2⤵
  PID:6512
- C:\Windows\System\RHJireC.exe
  C:\Windows\System\RHJireC.exe
  2⤵
  PID:6532
- C:\Windows\System\gkIJxsc.exe
  C:\Windows\System\gkIJxsc.exe
  2⤵
  PID:6572
- C:\Windows\System\vDeoQjV.exe
  C:\Windows\System\vDeoQjV.exe
  2⤵
  PID:6596
- C:\Windows\System\yMgWrFg.exe
  C:\Windows\System\yMgWrFg.exe
  2⤵
  PID:6632
- C:\Windows\System\HphAUuW.exe
  C:\Windows\System\HphAUuW.exe
  2⤵
  PID:6652
- C:\Windows\System\BHzBgCC.exe
  C:\Windows\System\BHzBgCC.exe
  2⤵
  PID:6680
- C:\Windows\System\RRqDTOJ.exe
  C:\Windows\System\RRqDTOJ.exe
  2⤵
  PID:6712
- C:\Windows\System\ZChOqfn.exe
  C:\Windows\System\ZChOqfn.exe
  2⤵
  PID:6752
- C:\Windows\System\xThsgXm.exe
  C:\Windows\System\xThsgXm.exe
  2⤵
  PID:6796
- C:\Windows\System\IUFEXzM.exe
  C:\Windows\System\IUFEXzM.exe
  2⤵
  PID:6820
- C:\Windows\System\AuNKnTC.exe
  C:\Windows\System\AuNKnTC.exe
  2⤵
  PID:6848
- C:\Windows\System\vXECjNd.exe
  C:\Windows\System\vXECjNd.exe
  2⤵
  PID:6864
- C:\Windows\System\pnhGCdI.exe
  C:\Windows\System\pnhGCdI.exe
  2⤵
  PID:6896
- C:\Windows\System\kndzkEW.exe
  C:\Windows\System\kndzkEW.exe
  2⤵
  PID:6920
- C:\Windows\System\bxCfEqW.exe
  C:\Windows\System\bxCfEqW.exe
  2⤵
  PID:6948
- C:\Windows\System\VgTFldg.exe
  C:\Windows\System\VgTFldg.exe
  2⤵
  PID:6964
- C:\Windows\System\NJzrhSb.exe
  C:\Windows\System\NJzrhSb.exe
  2⤵
  PID:6980
- C:\Windows\System\NEkvsLZ.exe
  C:\Windows\System\NEkvsLZ.exe
  2⤵
  PID:6996
- C:\Windows\System\WOsxsCw.exe
  C:\Windows\System\WOsxsCw.exe
  2⤵
  PID:7028
- C:\Windows\System\HWdERsl.exe
  C:\Windows\System\HWdERsl.exe
  2⤵
  PID:7060
- C:\Windows\System\DTfzOTZ.exe
  C:\Windows\System\DTfzOTZ.exe
  2⤵
  PID:7088
- C:\Windows\System\LdNGpGM.exe
  C:\Windows\System\LdNGpGM.exe
  2⤵
  PID:7108
- C:\Windows\System\yPvTgaB.exe
  C:\Windows\System\yPvTgaB.exe
  2⤵
  PID:7136
- C:\Windows\System\cJvVlnK.exe
  C:\Windows\System\cJvVlnK.exe
  2⤵
  PID:7160
- C:\Windows\System\BkeGcHX.exe
  C:\Windows\System\BkeGcHX.exe
  2⤵
  PID:5988
- C:\Windows\System\EHpCZCb.exe
  C:\Windows\System\EHpCZCb.exe
  2⤵
  PID:6260
- C:\Windows\System\lXlqfvQ.exe
  C:\Windows\System\lXlqfvQ.exe
  2⤵
  PID:6328
- C:\Windows\System\FyrlYWA.exe
  C:\Windows\System\FyrlYWA.exe
  2⤵
  PID:6368
- C:\Windows\System\oNZRqtR.exe
  C:\Windows\System\oNZRqtR.exe
  2⤵
  PID:6364
- C:\Windows\System\fiYdNUf.exe
  C:\Windows\System\fiYdNUf.exe
  2⤵
  PID:6428
- C:\Windows\System\JtKqxAK.exe
  C:\Windows\System\JtKqxAK.exe
  2⤵
  PID:6528
- C:\Windows\System\HdIGtFF.exe
  C:\Windows\System\HdIGtFF.exe
  2⤵
  PID:6608
- C:\Windows\System\hLesNkZ.exe
  C:\Windows\System\hLesNkZ.exe
  2⤵
  PID:6616
- C:\Windows\System\EKdOTnp.exe
  C:\Windows\System\EKdOTnp.exe
  2⤵
  PID:6708
- C:\Windows\System\QIiJjmz.exe
  C:\Windows\System\QIiJjmz.exe
  2⤵
  PID:6732
- C:\Windows\System\yKlHqNa.exe
  C:\Windows\System\yKlHqNa.exe
  2⤵
  PID:6836
- C:\Windows\System\RKMGEYa.exe
  C:\Windows\System\RKMGEYa.exe
  2⤵
  PID:6912
- C:\Windows\System\kkiSTpI.exe
  C:\Windows\System\kkiSTpI.exe
  2⤵
  PID:6960
- C:\Windows\System\OoqmnWr.exe
  C:\Windows\System\OoqmnWr.exe
  2⤵
  PID:7048
- C:\Windows\System\dHLnkEB.exe
  C:\Windows\System\dHLnkEB.exe
  2⤵
  PID:6988
- C:\Windows\System\CWeddLY.exe
  C:\Windows\System\CWeddLY.exe
  2⤵
  PID:5504
- C:\Windows\System\jgRQsBh.exe
  C:\Windows\System\jgRQsBh.exe
  2⤵
  PID:7128
- C:\Windows\System\BELAbRr.exe
  C:\Windows\System\BELAbRr.exe
  2⤵
  PID:6208
- C:\Windows\System\ikURffZ.exe
  C:\Windows\System\ikURffZ.exe
  2⤵
  PID:6440
- C:\Windows\System\sDPLEXo.exe
  C:\Windows\System\sDPLEXo.exe
  2⤵
  PID:6644
- C:\Windows\System\owWrktW.exe
  C:\Windows\System\owWrktW.exe
  2⤵
  PID:7144
- C:\Windows\System\bqYJZMQ.exe
  C:\Windows\System\bqYJZMQ.exe
  2⤵
  PID:6992
- C:\Windows\System\BLDzUFA.exe
  C:\Windows\System\BLDzUFA.exe
  2⤵
  PID:6588
- C:\Windows\System\DEpOPZN.exe
  C:\Windows\System\DEpOPZN.exe
  2⤵
  PID:7100
- C:\Windows\System\iPsxXmG.exe
  C:\Windows\System\iPsxXmG.exe
  2⤵
  PID:7104
- C:\Windows\System\GxzdOyl.exe
  C:\Windows\System\GxzdOyl.exe
  2⤵
  PID:7208
- C:\Windows\System\GQYVLPP.exe
  C:\Windows\System\GQYVLPP.exe
  2⤵
  PID:7232
- C:\Windows\System\PsuCxXf.exe
  C:\Windows\System\PsuCxXf.exe
  2⤵
  PID:7264
- C:\Windows\System\VvLyjQy.exe
  C:\Windows\System\VvLyjQy.exe
  2⤵
  PID:7280
- C:\Windows\System\wynpZhE.exe
  C:\Windows\System\wynpZhE.exe
  2⤵
  PID:7296
- C:\Windows\System\oaauKGd.exe
  C:\Windows\System\oaauKGd.exe
  2⤵
  PID:7328
- C:\Windows\System\DyvRxwa.exe
  C:\Windows\System\DyvRxwa.exe
  2⤵
  PID:7356
- C:\Windows\System\XgSQxLW.exe
  C:\Windows\System\XgSQxLW.exe
  2⤵
  PID:7384
- C:\Windows\System\bUASjlc.exe
  C:\Windows\System\bUASjlc.exe
  2⤵
  PID:7408
- C:\Windows\System\xroCgmd.exe
  C:\Windows\System\xroCgmd.exe
  2⤵
  PID:7444
- C:\Windows\System\fkApSsT.exe
  C:\Windows\System\fkApSsT.exe
  2⤵
  PID:7468
- C:\Windows\System\CaRntDj.exe
  C:\Windows\System\CaRntDj.exe
  2⤵
  PID:7492
- C:\Windows\System\aDkbmdG.exe
  C:\Windows\System\aDkbmdG.exe
  2⤵
  PID:7512
- C:\Windows\System\DVyyWBf.exe
  C:\Windows\System\DVyyWBf.exe
  2⤵
  PID:7552
- C:\Windows\System\JFGZlJe.exe
  C:\Windows\System\JFGZlJe.exe
  2⤵
  PID:7568
- C:\Windows\System\zewTQhP.exe
  C:\Windows\System\zewTQhP.exe
  2⤵
  PID:7592
- C:\Windows\System\pAdrqqM.exe
  C:\Windows\System\pAdrqqM.exe
  2⤵
  PID:7608
- C:\Windows\System\sjyyOxb.exe
  C:\Windows\System\sjyyOxb.exe
  2⤵
  PID:7624
- C:\Windows\System\RAYnmQi.exe
  C:\Windows\System\RAYnmQi.exe
  2⤵
  PID:7644
- C:\Windows\System\oEjOozw.exe
  C:\Windows\System\oEjOozw.exe
  2⤵
  PID:7676
- C:\Windows\System\cJKVDuL.exe
  C:\Windows\System\cJKVDuL.exe
  2⤵
  PID:7712
- C:\Windows\System\QqufwkO.exe
  C:\Windows\System\QqufwkO.exe
  2⤵
  PID:7740
- C:\Windows\System\lEsiSfp.exe
  C:\Windows\System\lEsiSfp.exe
  2⤵
  PID:7784
- C:\Windows\System\vrUUAXH.exe
  C:\Windows\System\vrUUAXH.exe
  2⤵
  PID:7828
- C:\Windows\System\KurfqXG.exe
  C:\Windows\System\KurfqXG.exe
  2⤵
  PID:7868
- C:\Windows\System\vTMrLQE.exe
  C:\Windows\System\vTMrLQE.exe
  2⤵
  PID:7900
- C:\Windows\System\IFgLbAU.exe
  C:\Windows\System\IFgLbAU.exe
  2⤵
  PID:7920
- C:\Windows\System\prcoBWl.exe
  C:\Windows\System\prcoBWl.exe
  2⤵
  PID:7940
- C:\Windows\System\IhpRxYc.exe
  C:\Windows\System\IhpRxYc.exe
  2⤵
  PID:7972
- C:\Windows\System\gXMzHkz.exe
  C:\Windows\System\gXMzHkz.exe
  2⤵
  PID:8000
- C:\Windows\System\HyNjTNR.exe
  C:\Windows\System\HyNjTNR.exe
  2⤵
  PID:8044
- C:\Windows\System\UCzlCBc.exe
  C:\Windows\System\UCzlCBc.exe
  2⤵
  PID:8076
- C:\Windows\System\NiBNJVV.exe
  C:\Windows\System\NiBNJVV.exe
  2⤵
  PID:8100
- C:\Windows\System\fIKYNjC.exe
  C:\Windows\System\fIKYNjC.exe
  2⤵
  PID:8136
- C:\Windows\System\IoISGPl.exe
  C:\Windows\System\IoISGPl.exe
  2⤵
  PID:8168
- C:\Windows\System\TIJfSeI.exe
  C:\Windows\System\TIJfSeI.exe
  2⤵
  PID:8188
- C:\Windows\System\CVCcElB.exe
  C:\Windows\System\CVCcElB.exe
  2⤵
  PID:6268
- C:\Windows\System\JrpUsun.exe
  C:\Windows\System\JrpUsun.exe
  2⤵
  PID:7272
- C:\Windows\System\RZOBQOF.exe
  C:\Windows\System\RZOBQOF.exe
  2⤵
  PID:7324
- C:\Windows\System\hmokeOg.exe
  C:\Windows\System\hmokeOg.exe
  2⤵
  PID:7316
- C:\Windows\System\ntoenVk.exe
  C:\Windows\System\ntoenVk.exe
  2⤵
  PID:7436
- C:\Windows\System\JwmZXzz.exe
  C:\Windows\System\JwmZXzz.exe
  2⤵
  PID:7476
- C:\Windows\System\YKyeqnz.exe
  C:\Windows\System\YKyeqnz.exe
  2⤵
  PID:7560
- C:\Windows\System\amUyvKw.exe
  C:\Windows\System\amUyvKw.exe
  2⤵
  PID:7732
- C:\Windows\System\GtzugTp.exe
  C:\Windows\System\GtzugTp.exe
  2⤵
  PID:7672
- C:\Windows\System\LklePtv.exe
  C:\Windows\System\LklePtv.exe
  2⤵
  PID:7764
- C:\Windows\System\eNdJWrc.exe
  C:\Windows\System\eNdJWrc.exe
  2⤵
  PID:7864
- C:\Windows\System\mZIfqiQ.exe
  C:\Windows\System\mZIfqiQ.exe
  2⤵
  PID:7848
- C:\Windows\System\MBfvtzH.exe
  C:\Windows\System\MBfvtzH.exe
  2⤵
  PID:7956
- C:\Windows\System\hgJVLCU.exe
  C:\Windows\System\hgJVLCU.exe
  2⤵
  PID:7988
- C:\Windows\System\cklXAFc.exe
  C:\Windows\System\cklXAFc.exe
  2⤵
  PID:8120
- C:\Windows\System\FJogdCC.exe
  C:\Windows\System\FJogdCC.exe
  2⤵
  PID:8184
- C:\Windows\System\NpmVQhC.exe
  C:\Windows\System\NpmVQhC.exe
  2⤵
  PID:6972
- C:\Windows\System\DIwiGXH.exe
  C:\Windows\System\DIwiGXH.exe
  2⤵
  PID:7308
- C:\Windows\System\mkRHcpQ.exe
  C:\Windows\System\mkRHcpQ.exe
  2⤵
  PID:7548
- C:\Windows\System\vZNRTlK.exe
  C:\Windows\System\vZNRTlK.exe
  2⤵
  PID:7640
- C:\Windows\System\cyuybRa.exe
  C:\Windows\System\cyuybRa.exe
  2⤵
  PID:7804
- C:\Windows\System\hhZybRY.exe
  C:\Windows\System\hhZybRY.exe
  2⤵
  PID:7992
- C:\Windows\System\WduDVfI.exe
  C:\Windows\System\WduDVfI.exe
  2⤵
  PID:8096
- C:\Windows\System\ctpsSBh.exe
  C:\Windows\System\ctpsSBh.exe
  2⤵
  PID:8124
- C:\Windows\System\KNFBFie.exe
  C:\Windows\System\KNFBFie.exe
  2⤵
  PID:7340
- C:\Windows\System\ZcGRnbF.exe
  C:\Windows\System\ZcGRnbF.exe
  2⤵
  PID:7860
- C:\Windows\System\ikxXZUK.exe
  C:\Windows\System\ikxXZUK.exe
  2⤵
  PID:7228
- C:\Windows\System\YdlakMJ.exe
  C:\Windows\System\YdlakMJ.exe
  2⤵
  PID:8216
- C:\Windows\System\bhPQzWB.exe
  C:\Windows\System\bhPQzWB.exe
  2⤵
  PID:8244
- C:\Windows\System\kFYKRWn.exe
  C:\Windows\System\kFYKRWn.exe
  2⤵
  PID:8272
- C:\Windows\System\arxWubV.exe
  C:\Windows\System\arxWubV.exe
  2⤵
  PID:8304
- C:\Windows\System\MmdBykG.exe
  C:\Windows\System\MmdBykG.exe
  2⤵
  PID:8332
- C:\Windows\System\sZrGFOe.exe
  C:\Windows\System\sZrGFOe.exe
  2⤵
  PID:8356
- C:\Windows\System\nMcslLD.exe
  C:\Windows\System\nMcslLD.exe
  2⤵
  PID:8372
- C:\Windows\System\qYCLBKt.exe
  C:\Windows\System\qYCLBKt.exe
  2⤵
  PID:8400
- C:\Windows\System\gmWPcbR.exe
  C:\Windows\System\gmWPcbR.exe
  2⤵
  PID:8420
- C:\Windows\System\pIxfYzj.exe
  C:\Windows\System\pIxfYzj.exe
  2⤵
  PID:8448
- C:\Windows\System\BlnOzaK.exe
  C:\Windows\System\BlnOzaK.exe
  2⤵
  PID:8472
- C:\Windows\System\RxUFaTQ.exe
  C:\Windows\System\RxUFaTQ.exe
  2⤵
  PID:8496
- C:\Windows\System\lLRckHq.exe
  C:\Windows\System\lLRckHq.exe
  2⤵
  PID:8528
- C:\Windows\System\sXnhoJc.exe
  C:\Windows\System\sXnhoJc.exe
  2⤵
  PID:8560
- C:\Windows\System\AzjueMn.exe
  C:\Windows\System\AzjueMn.exe
  2⤵
  PID:8592
- C:\Windows\System\QbLwtQQ.exe
  C:\Windows\System\QbLwtQQ.exe
  2⤵
  PID:8620
- C:\Windows\System\cNmSNqB.exe
  C:\Windows\System\cNmSNqB.exe
  2⤵
  PID:8648
- C:\Windows\System\ItJgIUQ.exe
  C:\Windows\System\ItJgIUQ.exe
  2⤵
  PID:8676
- C:\Windows\System\hhMNiKk.exe
  C:\Windows\System\hhMNiKk.exe
  2⤵
  PID:8700
- C:\Windows\System\BEmFiAW.exe
  C:\Windows\System\BEmFiAW.exe
  2⤵
  PID:8736
- C:\Windows\System\msEqOEU.exe
  C:\Windows\System\msEqOEU.exe
  2⤵
  PID:8764
- C:\Windows\System\XEWcxnQ.exe
  C:\Windows\System\XEWcxnQ.exe
  2⤵
  PID:8800
- C:\Windows\System\sImZGJE.exe
  C:\Windows\System\sImZGJE.exe
  2⤵
  PID:8824
- C:\Windows\System\JXesWvm.exe
  C:\Windows\System\JXesWvm.exe
  2⤵
  PID:8844
- C:\Windows\System\wShiVqS.exe
  C:\Windows\System\wShiVqS.exe
  2⤵
  PID:8868
- C:\Windows\System\CiDpHqi.exe
  C:\Windows\System\CiDpHqi.exe
  2⤵
  PID:8884
- C:\Windows\System\FOBYvkg.exe
  C:\Windows\System\FOBYvkg.exe
  2⤵
  PID:8916
- C:\Windows\System\wzRuoBN.exe
  C:\Windows\System\wzRuoBN.exe
  2⤵
  PID:8952
- C:\Windows\System\MurEjkp.exe
  C:\Windows\System\MurEjkp.exe
  2⤵
  PID:8980
- C:\Windows\System\EXoPUCh.exe
  C:\Windows\System\EXoPUCh.exe
  2⤵
  PID:9024
- C:\Windows\System\NHEaMJO.exe
  C:\Windows\System\NHEaMJO.exe
  2⤵
  PID:9052
- C:\Windows\System\cCyZvnS.exe
  C:\Windows\System\cCyZvnS.exe
  2⤵
  PID:9080
- C:\Windows\System\yMntKVg.exe
  C:\Windows\System\yMntKVg.exe
  2⤵
  PID:9112
- C:\Windows\System\ovUGOKG.exe
  C:\Windows\System\ovUGOKG.exe
  2⤵
  PID:9136
- C:\Windows\System\OtAMxHl.exe
  C:\Windows\System\OtAMxHl.exe
  2⤵
  PID:9172
- C:\Windows\System\TynPsOJ.exe
  C:\Windows\System\TynPsOJ.exe
  2⤵
  PID:9200
- C:\Windows\System\DnisEaP.exe
  C:\Windows\System\DnisEaP.exe
  2⤵
  PID:7936
- C:\Windows\System\iyxBtoH.exe
  C:\Windows\System\iyxBtoH.exe
  2⤵
  PID:7424
- C:\Windows\System\vOKFawR.exe
  C:\Windows\System\vOKFawR.exe
  2⤵
  PID:8300
- C:\Windows\System\rXZgxKG.exe
  C:\Windows\System\rXZgxKG.exe
  2⤵
  PID:8352
- C:\Windows\System\juIwvGx.exe
  C:\Windows\System\juIwvGx.exe
  2⤵
  PID:8292
- C:\Windows\System\OPeoSXk.exe
  C:\Windows\System\OPeoSXk.exe
  2⤵
  PID:8440
- C:\Windows\System\IgpRatJ.exe
  C:\Windows\System\IgpRatJ.exe
  2⤵
  PID:8432
- C:\Windows\System\IEWhVMw.exe
  C:\Windows\System\IEWhVMw.exe
  2⤵
  PID:8460
- C:\Windows\System\scMATFg.exe
  C:\Windows\System\scMATFg.exe
  2⤵
  PID:8692
- C:\Windows\System\CsoyBrz.exe
  C:\Windows\System\CsoyBrz.exe
  2⤵
  PID:8724
- C:\Windows\System\ZYcSwrM.exe
  C:\Windows\System\ZYcSwrM.exe
  2⤵
  PID:8836
- C:\Windows\System\XqQOYfl.exe
  C:\Windows\System\XqQOYfl.exe
  2⤵
  PID:8928
- C:\Windows\System\xYxtnwe.exe
  C:\Windows\System\xYxtnwe.exe
  2⤵
  PID:9004
- C:\Windows\System\OyzPjCb.exe
  C:\Windows\System\OyzPjCb.exe
  2⤵
  PID:9104
- C:\Windows\System\wtVzCDj.exe
  C:\Windows\System\wtVzCDj.exe
  2⤵
  PID:9164
- C:\Windows\System\kxsxSda.exe
  C:\Windows\System\kxsxSda.exe
  2⤵
  PID:9188
- C:\Windows\System\ckCfePt.exe
  C:\Windows\System\ckCfePt.exe
  2⤵
  PID:8200
- C:\Windows\System\bpiHGFk.exe
  C:\Windows\System\bpiHGFk.exe
  2⤵
  PID:8316
- C:\Windows\System\dpDbspx.exe
  C:\Windows\System\dpDbspx.exe
  2⤵
  PID:8520
- C:\Windows\System\RQgdMXa.exe
  C:\Windows\System\RQgdMXa.exe
  2⤵
  PID:8748
- C:\Windows\System\VzMAGLb.exe
  C:\Windows\System\VzMAGLb.exe
  2⤵
  PID:8796
- C:\Windows\System\gpjxmfE.exe
  C:\Windows\System\gpjxmfE.exe
  2⤵
  PID:8900
- C:\Windows\System\XRlngHW.exe
  C:\Windows\System\XRlngHW.exe
  2⤵
  PID:9128
- C:\Windows\System\AMisBxx.exe
  C:\Windows\System\AMisBxx.exe
  2⤵
  PID:8264
- C:\Windows\System\DWwoxin.exe
  C:\Windows\System\DWwoxin.exe
  2⤵
  PID:8348
- C:\Windows\System\jOOhupe.exe
  C:\Windows\System\jOOhupe.exe
  2⤵
  PID:8484
- C:\Windows\System\Gzayuoi.exe
  C:\Windows\System\Gzayuoi.exe
  2⤵
  PID:8664
- C:\Windows\System\pswUDHF.exe
  C:\Windows\System\pswUDHF.exe
  2⤵
  PID:8972
- C:\Windows\System\owZJMSF.exe
  C:\Windows\System\owZJMSF.exe
  2⤵
  PID:9232
- C:\Windows\System\dadUiwW.exe
  C:\Windows\System\dadUiwW.exe
  2⤵
  PID:9268
- C:\Windows\System\IVgYoHJ.exe
  C:\Windows\System\IVgYoHJ.exe
  2⤵
  PID:9292
- C:\Windows\System\BrpUGlz.exe
  C:\Windows\System\BrpUGlz.exe
  2⤵
  PID:9312
- C:\Windows\System\xfXYyIE.exe
  C:\Windows\System\xfXYyIE.exe
  2⤵
  PID:9336
- C:\Windows\System\zHaXfIZ.exe
  C:\Windows\System\zHaXfIZ.exe
  2⤵
  PID:9376
- C:\Windows\System\gTfjLmk.exe
  C:\Windows\System\gTfjLmk.exe
  2⤵
  PID:9408
- C:\Windows\System\sAnKHsa.exe
  C:\Windows\System\sAnKHsa.exe
  2⤵
  PID:9424
- C:\Windows\System\vIXvaSw.exe
  C:\Windows\System\vIXvaSw.exe
  2⤵
  PID:9448
- C:\Windows\System\AozCJcx.exe
  C:\Windows\System\AozCJcx.exe
  2⤵
  PID:9484
- C:\Windows\System\YTquoWF.exe
  C:\Windows\System\YTquoWF.exe
  2⤵
  PID:9508
- C:\Windows\System\EfrjgpG.exe
  C:\Windows\System\EfrjgpG.exe
  2⤵
  PID:9524
- C:\Windows\System\buxlMYz.exe
  C:\Windows\System\buxlMYz.exe
  2⤵
  PID:9540
- C:\Windows\System\OtqjkBJ.exe
  C:\Windows\System\OtqjkBJ.exe
  2⤵
  PID:9576
- C:\Windows\System\mFzHhpS.exe
  C:\Windows\System\mFzHhpS.exe
  2⤵
  PID:9604
- C:\Windows\System\yaFLuBH.exe
  C:\Windows\System\yaFLuBH.exe
  2⤵
  PID:9640
- C:\Windows\System\mtSnuZg.exe
  C:\Windows\System\mtSnuZg.exe
  2⤵
  PID:9664
- C:\Windows\System\cTkDBcT.exe
  C:\Windows\System\cTkDBcT.exe
  2⤵
  PID:9692
- C:\Windows\System\qyepjsX.exe
  C:\Windows\System\qyepjsX.exe
  2⤵
  PID:9720
- C:\Windows\System\lsqbSzK.exe
  C:\Windows\System\lsqbSzK.exe
  2⤵
  PID:9748
- C:\Windows\System\zCETgZP.exe
  C:\Windows\System\zCETgZP.exe
  2⤵
  PID:9772
- C:\Windows\System\wOWiUZv.exe
  C:\Windows\System\wOWiUZv.exe
  2⤵
  PID:9800
- C:\Windows\System\mNskDAb.exe
  C:\Windows\System\mNskDAb.exe
  2⤵
  PID:9852
- C:\Windows\System\IdGhSXE.exe
  C:\Windows\System\IdGhSXE.exe
  2⤵
  PID:9872
- C:\Windows\System\SyUCVbN.exe
  C:\Windows\System\SyUCVbN.exe
  2⤵
  PID:9896
- C:\Windows\System\yXqJPLb.exe
  C:\Windows\System\yXqJPLb.exe
  2⤵
  PID:9920
- C:\Windows\System\WndBJsq.exe
  C:\Windows\System\WndBJsq.exe
  2⤵
  PID:9944
- C:\Windows\System\hSseTNa.exe
  C:\Windows\System\hSseTNa.exe
  2⤵
  PID:9972
- C:\Windows\System\bciEzPb.exe
  C:\Windows\System\bciEzPb.exe
  2⤵
  PID:10008
- C:\Windows\System\fvztEeo.exe
  C:\Windows\System\fvztEeo.exe
  2⤵
  PID:10036
- C:\Windows\System\WANztRN.exe
  C:\Windows\System\WANztRN.exe
  2⤵
  PID:10064
- C:\Windows\System\MFbkoHk.exe
  C:\Windows\System\MFbkoHk.exe
  2⤵
  PID:10088
- C:\Windows\System\kfaOWzI.exe
  C:\Windows\System\kfaOWzI.exe
  2⤵
  PID:10124
- C:\Windows\System\AoFFZKu.exe
  C:\Windows\System\AoFFZKu.exe
  2⤵
  PID:10164
- C:\Windows\System\cESfvQj.exe
  C:\Windows\System\cESfvQj.exe
  2⤵
  PID:10196
- C:\Windows\System\rIpBSvB.exe
  C:\Windows\System\rIpBSvB.exe
  2⤵
  PID:10224
- C:\Windows\System\SsegGrQ.exe
  C:\Windows\System\SsegGrQ.exe
  2⤵
  PID:9260
- C:\Windows\System\oZcSbIM.exe
  C:\Windows\System\oZcSbIM.exe
  2⤵
  PID:9248
- C:\Windows\System\jlMeMFS.exe
  C:\Windows\System\jlMeMFS.exe
  2⤵
  PID:9284
- C:\Windows\System\BFeWnXs.exe
  C:\Windows\System\BFeWnXs.exe
  2⤵
  PID:9400
- C:\Windows\System\qqfNTYG.exe
  C:\Windows\System\qqfNTYG.exe
  2⤵
  PID:9492
- C:\Windows\System\dGtDovp.exe
  C:\Windows\System\dGtDovp.exe
  2⤵
  PID:9552
- C:\Windows\System\PGRFPUV.exe
  C:\Windows\System\PGRFPUV.exe
  2⤵
  PID:9620
- C:\Windows\System\FegiQEC.exe
  C:\Windows\System\FegiQEC.exe
  2⤵
  PID:9680
- C:\Windows\System\qdYBgUG.exe
  C:\Windows\System\qdYBgUG.exe
  2⤵
  PID:9768
- C:\Windows\System\dhZVHnO.exe
  C:\Windows\System\dhZVHnO.exe
  2⤵
  PID:9808
- C:\Windows\System\AJFtUPB.exe
  C:\Windows\System\AJFtUPB.exe
  2⤵
  PID:9884
- C:\Windows\System\ftMCnkk.exe
  C:\Windows\System\ftMCnkk.exe
  2⤵
  PID:9984
- C:\Windows\System\CMVsDsh.exe
  C:\Windows\System\CMVsDsh.exe
  2⤵
  PID:9928
- C:\Windows\System\IhEUvbC.exe
  C:\Windows\System\IhEUvbC.exe
  2⤵
  PID:9996
- C:\Windows\System\yFFAeVl.exe
  C:\Windows\System\yFFAeVl.exe
  2⤵
  PID:10084
- C:\Windows\System\JAVEvHc.exe
  C:\Windows\System\JAVEvHc.exe
  2⤵
  PID:10108
- C:\Windows\System\nqFBjRq.exe
  C:\Windows\System\nqFBjRq.exe
  2⤵
  PID:10192
- C:\Windows\System\UYecehw.exe
  C:\Windows\System\UYecehw.exe
  2⤵
  PID:9224
- C:\Windows\System\lEYFIpc.exe
  C:\Windows\System\lEYFIpc.exe
  2⤵
  PID:9440
- C:\Windows\System\YPPqJWq.exe
  C:\Windows\System\YPPqJWq.exe
  2⤵
  PID:9584
- C:\Windows\System\vhgJjoM.exe
  C:\Windows\System\vhgJjoM.exe
  2⤵
  PID:9708
- C:\Windows\System\RguucrH.exe
  C:\Windows\System\RguucrH.exe
  2⤵
  PID:9816
- C:\Windows\System\MHdTOZZ.exe
  C:\Windows\System\MHdTOZZ.exe
  2⤵
  PID:10112
- C:\Windows\System\gDsvoza.exe
  C:\Windows\System\gDsvoza.exe
  2⤵
  PID:10172
- C:\Windows\System\JozopLO.exe
  C:\Windows\System\JozopLO.exe
  2⤵
  PID:8456
- C:\Windows\System\gavIFos.exe
  C:\Windows\System\gavIFos.exe
  2⤵
  PID:9732
- C:\Windows\System\QKdTgMr.exe
  C:\Windows\System\QKdTgMr.exe
  2⤵
  PID:10244
- C:\Windows\System\KRbYTLf.exe
  C:\Windows\System\KRbYTLf.exe
  2⤵
  PID:10264
- C:\Windows\System\lTbhDSQ.exe
  C:\Windows\System\lTbhDSQ.exe
  2⤵
  PID:10300
- C:\Windows\System\wwKqmqn.exe
  C:\Windows\System\wwKqmqn.exe
  2⤵
  PID:10316
- C:\Windows\System\wEkVgUG.exe
  C:\Windows\System\wEkVgUG.exe
  2⤵
  PID:10340
- C:\Windows\System\ewDLpWJ.exe
  C:\Windows\System\ewDLpWJ.exe
  2⤵
  PID:10356
- C:\Windows\System\hYqqoWA.exe
  C:\Windows\System\hYqqoWA.exe
  2⤵
  PID:10388
- C:\Windows\System\VLRPOWj.exe
  C:\Windows\System\VLRPOWj.exe
  2⤵
  PID:10424
- C:\Windows\System\mWtooEO.exe
  C:\Windows\System\mWtooEO.exe
  2⤵
  PID:10456
- C:\Windows\System\ljnoNnC.exe
  C:\Windows\System\ljnoNnC.exe
  2⤵
  PID:10472
- C:\Windows\System\riDFYcD.exe
  C:\Windows\System\riDFYcD.exe
  2⤵
  PID:10500
- C:\Windows\System\phMCNng.exe
  C:\Windows\System\phMCNng.exe
  2⤵
  PID:10532
- C:\Windows\System\FveRVzi.exe
  C:\Windows\System\FveRVzi.exe
  2⤵
  PID:10560
- C:\Windows\System\kVgrWmc.exe
  C:\Windows\System\kVgrWmc.exe
  2⤵
  PID:10584
- C:\Windows\System\IZGaRSS.exe
  C:\Windows\System\IZGaRSS.exe
  2⤵
  PID:10616
- C:\Windows\System\zdZwspX.exe
  C:\Windows\System\zdZwspX.exe
  2⤵
  PID:10636
- C:\Windows\System\uwOvjZR.exe
  C:\Windows\System\uwOvjZR.exe
  2⤵
  PID:10656
- C:\Windows\System\kFihMBV.exe
  C:\Windows\System\kFihMBV.exe
  2⤵
  PID:10684
- C:\Windows\System\lmpZOqC.exe
  C:\Windows\System\lmpZOqC.exe
  2⤵
  PID:10708
- C:\Windows\System\uCQrlXH.exe
  C:\Windows\System\uCQrlXH.exe
  2⤵
  PID:10728
- C:\Windows\System\txUIOSM.exe
  C:\Windows\System\txUIOSM.exe
  2⤵
  PID:10756
- C:\Windows\System\jJMolYW.exe
  C:\Windows\System\jJMolYW.exe
  2⤵
  PID:10788
- C:\Windows\System\LDsGEIb.exe
  C:\Windows\System\LDsGEIb.exe
  2⤵
  PID:10812
- C:\Windows\System\dmiTgYk.exe
  C:\Windows\System\dmiTgYk.exe
  2⤵
  PID:10844
- C:\Windows\System\kMEZndN.exe
  C:\Windows\System\kMEZndN.exe
  2⤵
  PID:10868
- C:\Windows\System\SRtysYB.exe
  C:\Windows\System\SRtysYB.exe
  2⤵
  PID:10888
- C:\Windows\System\lvuEAYc.exe
  C:\Windows\System\lvuEAYc.exe
  2⤵
  PID:10920
- C:\Windows\System\UYyvjzQ.exe
  C:\Windows\System\UYyvjzQ.exe
  2⤵
  PID:10952
- C:\Windows\System\reFpodD.exe
  C:\Windows\System\reFpodD.exe
  2⤵
  PID:10984
- C:\Windows\System\naGEuLf.exe
  C:\Windows\System\naGEuLf.exe
  2⤵
  PID:11012
- C:\Windows\System\dgpITjY.exe
  C:\Windows\System\dgpITjY.exe
  2⤵
  PID:11044
- C:\Windows\System\SSuGxRh.exe
  C:\Windows\System\SSuGxRh.exe
  2⤵
  PID:11072
- C:\Windows\System\xNBeoIF.exe
  C:\Windows\System\xNBeoIF.exe
  2⤵
  PID:11104
- C:\Windows\System\HiVSSvB.exe
  C:\Windows\System\HiVSSvB.exe
  2⤵
  PID:11140
- C:\Windows\System\vTrxYNv.exe
  C:\Windows\System\vTrxYNv.exe
  2⤵
  PID:11172
- C:\Windows\System\utoyIAf.exe
  C:\Windows\System\utoyIAf.exe
  2⤵
  PID:11208
- C:\Windows\System\xRtSNdG.exe
  C:\Windows\System\xRtSNdG.exe
  2⤵
  PID:11228
- C:\Windows\System\ofgVLLq.exe
  C:\Windows\System\ofgVLLq.exe
  2⤵
  PID:9932
- C:\Windows\System\IDfMeEr.exe
  C:\Windows\System\IDfMeEr.exe
  2⤵
  PID:9868
- C:\Windows\System\uuAvbtS.exe
  C:\Windows\System\uuAvbtS.exe
  2⤵
  PID:10284
- C:\Windows\System\zoxChQc.exe
  C:\Windows\System\zoxChQc.exe
  2⤵
  PID:10204
- C:\Windows\System\iNmEekZ.exe
  C:\Windows\System\iNmEekZ.exe
  2⤵
  PID:10308
- C:\Windows\System\ifYYWlD.exe
  C:\Windows\System\ifYYWlD.exe
  2⤵
  PID:10672
- C:\Windows\System\uSvwSNG.exe
  C:\Windows\System\uSvwSNG.exe
  2⤵
  PID:10668
- C:\Windows\System\QEwAWbX.exe
  C:\Windows\System\QEwAWbX.exe
  2⤵
  PID:10700
- C:\Windows\System\wxAwVOs.exe
  C:\Windows\System\wxAwVOs.exe
  2⤵
  PID:10784
- C:\Windows\System\eRhFhoy.exe
  C:\Windows\System\eRhFhoy.exe
  2⤵
  PID:10824
- C:\Windows\System\DtWIfYw.exe
  C:\Windows\System\DtWIfYw.exe
  2⤵
  PID:10856
- C:\Windows\System\wHMRwHL.exe
  C:\Windows\System\wHMRwHL.exe
  2⤵
  PID:10968
- C:\Windows\System\OuLaAhx.exe
  C:\Windows\System\OuLaAhx.exe
  2⤵
  PID:11056
- C:\Windows\System\btGyXPo.exe
  C:\Windows\System\btGyXPo.exe
  2⤵
  PID:11024
- C:\Windows\System\kXcjqPe.exe
  C:\Windows\System\kXcjqPe.exe
  2⤵
  PID:11204
- C:\Windows\System\fgtpPfW.exe
  C:\Windows\System\fgtpPfW.exe
  2⤵
  PID:11060
- C:\Windows\System\IvkiorH.exe
  C:\Windows\System\IvkiorH.exe
  2⤵
  PID:9968
- C:\Windows\System\NOnLxUm.exe
  C:\Windows\System\NOnLxUm.exe
  2⤵
  PID:10312
- C:\Windows\System\QyXWTKH.exe
  C:\Windows\System\QyXWTKH.exe
  2⤵
  PID:10408
- C:\Windows\System\mabNEUr.exe
  C:\Windows\System\mabNEUr.exe
  2⤵
  PID:10444
- C:\Windows\System\mxOWnGo.exe
  C:\Windows\System\mxOWnGo.exe
  2⤵
  PID:10912
- C:\Windows\System\XsWnQPF.exe
  C:\Windows\System\XsWnQPF.exe
  2⤵
  PID:10948
- C:\Windows\System\zsQYtfB.exe
  C:\Windows\System\zsQYtfB.exe
  2⤵
  PID:10932
- C:\Windows\System\sMCvWhP.exe
  C:\Windows\System\sMCvWhP.exe
  2⤵
  PID:11260
- C:\Windows\System\ZjVgmCj.exe
  C:\Windows\System\ZjVgmCj.exe
  2⤵
  PID:10400
- C:\Windows\System\WWLLilY.exe
  C:\Windows\System\WWLLilY.exe
  2⤵
  PID:10876
- C:\Windows\System\oEgnUBI.exe
  C:\Windows\System\oEgnUBI.exe
  2⤵
  PID:10432
- C:\Windows\System\UlVHRCx.exe
  C:\Windows\System\UlVHRCx.exe
  2⤵
  PID:11276
- C:\Windows\System\TufAjbu.exe
  C:\Windows\System\TufAjbu.exe
  2⤵
  PID:11304
- C:\Windows\System\nvHuWkY.exe
  C:\Windows\System\nvHuWkY.exe
  2⤵
  PID:11332
- C:\Windows\System\MOshcqI.exe
  C:\Windows\System\MOshcqI.exe
  2⤵
  PID:11360
- C:\Windows\System\TxkKGxF.exe
  C:\Windows\System\TxkKGxF.exe
  2⤵
  PID:11380
- C:\Windows\System\XlEzzdj.exe
  C:\Windows\System\XlEzzdj.exe
  2⤵
  PID:11404
- C:\Windows\System\lHpXqPW.exe
  C:\Windows\System\lHpXqPW.exe
  2⤵
  PID:11432
- C:\Windows\System\yaEwOJe.exe
  C:\Windows\System\yaEwOJe.exe
  2⤵
  PID:11460
- C:\Windows\System\WGQWFVs.exe
  C:\Windows\System\WGQWFVs.exe
  2⤵
  PID:11488
- C:\Windows\System\qInhdng.exe
  C:\Windows\System\qInhdng.exe
  2⤵
  PID:11512
- C:\Windows\System\fZhtUEm.exe
  C:\Windows\System\fZhtUEm.exe
  2⤵
  PID:11544
- C:\Windows\System\WfnYzRL.exe
  C:\Windows\System\WfnYzRL.exe
  2⤵
  PID:11568
- C:\Windows\System\yZVYcwt.exe
  C:\Windows\System\yZVYcwt.exe
  2⤵
  PID:11592
- C:\Windows\System\xMTQXuS.exe
  C:\Windows\System\xMTQXuS.exe
  2⤵
  PID:11628
- C:\Windows\System\wqqGgcP.exe
  C:\Windows\System\wqqGgcP.exe
  2⤵
  PID:11656
- C:\Windows\System\SUoVyfo.exe
  C:\Windows\System\SUoVyfo.exe
  2⤵
  PID:11696
- C:\Windows\System\yAenLEZ.exe
  C:\Windows\System\yAenLEZ.exe
  2⤵
  PID:11724
- C:\Windows\System\UuETLPK.exe
  C:\Windows\System\UuETLPK.exe
  2⤵
  PID:11740
- C:\Windows\System\lrBdFbp.exe
  C:\Windows\System\lrBdFbp.exe
  2⤵
  PID:11760
- C:\Windows\System\QNvlUMP.exe
  C:\Windows\System\QNvlUMP.exe
  2⤵
  PID:11796
- C:\Windows\System\ACrvhhn.exe
  C:\Windows\System\ACrvhhn.exe
  2⤵
  PID:11828
- C:\Windows\System\OiMqXwG.exe
  C:\Windows\System\OiMqXwG.exe
  2⤵
  PID:11848
- C:\Windows\System\HnxaFvm.exe
  C:\Windows\System\HnxaFvm.exe
  2⤵
  PID:11876
- C:\Windows\System\twzYhrD.exe
  C:\Windows\System\twzYhrD.exe
  2⤵
  PID:11896
- C:\Windows\System\nLbUOaY.exe
  C:\Windows\System\nLbUOaY.exe
  2⤵
  PID:11924
- C:\Windows\System\HQMzPiR.exe
  C:\Windows\System\HQMzPiR.exe
  2⤵
  PID:11956
- C:\Windows\System\hVNvXeb.exe
  C:\Windows\System\hVNvXeb.exe
  2⤵
  PID:11976
- C:\Windows\System\bqIKluY.exe
  C:\Windows\System\bqIKluY.exe
  2⤵
  PID:12004
- C:\Windows\System\bZqZoDy.exe
  C:\Windows\System\bZqZoDy.exe
  2⤵
  PID:12032
- C:\Windows\System\qyKEQQQ.exe
  C:\Windows\System\qyKEQQQ.exe
  2⤵
  PID:12052
- C:\Windows\System\GedPpnC.exe
  C:\Windows\System\GedPpnC.exe
  2⤵
  PID:12080
- C:\Windows\System\LANPXCF.exe
  C:\Windows\System\LANPXCF.exe
  2⤵
  PID:12116
- C:\Windows\System\ZPPKbtw.exe
  C:\Windows\System\ZPPKbtw.exe
  2⤵
  PID:12152
- C:\Windows\System\eJiYCTz.exe
  C:\Windows\System\eJiYCTz.exe
  2⤵
  PID:12172
- C:\Windows\System\IPyRuYj.exe
  C:\Windows\System\IPyRuYj.exe
  2⤵
  PID:12192
- C:\Windows\System\BMJoyFk.exe
  C:\Windows\System\BMJoyFk.exe
  2⤵
  PID:12216
- C:\Windows\System\lGvZBvc.exe
  C:\Windows\System\lGvZBvc.exe
  2⤵
  PID:12256
- C:\Windows\System\vHimzuK.exe
  C:\Windows\System\vHimzuK.exe
  2⤵
  PID:11132
- C:\Windows\System\JqbrUCI.exe
  C:\Windows\System\JqbrUCI.exe
  2⤵
  PID:11292
- C:\Windows\System\nPzfzCr.exe
  C:\Windows\System\nPzfzCr.exe
  2⤵
  PID:11344
- C:\Windows\System\pYPfxeu.exe
  C:\Windows\System\pYPfxeu.exe
  2⤵
  PID:11452
- C:\Windows\System\ukqVeOb.exe
  C:\Windows\System\ukqVeOb.exe
  2⤵
  PID:11504
- C:\Windows\System\vlHooZk.exe
  C:\Windows\System\vlHooZk.exe
  2⤵
  PID:11576
- C:\Windows\System\BKLnCie.exe
  C:\Windows\System\BKLnCie.exe
  2⤵
  PID:11608
- C:\Windows\System\JAgbBbs.exe
  C:\Windows\System\JAgbBbs.exe
  2⤵
  PID:11664
- C:\Windows\System\UguUGbm.exe
  C:\Windows\System\UguUGbm.exe
  2⤵
  PID:11716
- C:\Windows\System\GHhhEUU.exe
  C:\Windows\System\GHhhEUU.exe
  2⤵
  PID:11748
- C:\Windows\System\xvHfHKE.exe
  C:\Windows\System\xvHfHKE.exe
  2⤵
  PID:11788
- C:\Windows\System\BVGmGdU.exe
  C:\Windows\System\BVGmGdU.exe
  2⤵
  PID:11892
- C:\Windows\System\cjbaFns.exe
  C:\Windows\System\cjbaFns.exe
  2⤵
  PID:11964
- C:\Windows\System\SWaxZxn.exe
  C:\Windows\System\SWaxZxn.exe
  2⤵
  PID:12048
- C:\Windows\System\dnGMRSG.exe
  C:\Windows\System\dnGMRSG.exe
  2⤵
  PID:12076
- C:\Windows\System\TZVVliM.exe
  C:\Windows\System\TZVVliM.exe
  2⤵
  PID:12160
- C:\Windows\System\jPBBUDF.exe
  C:\Windows\System\jPBBUDF.exe
  2⤵
  PID:12264
- C:\Windows\System\BpOYYnk.exe
  C:\Windows\System\BpOYYnk.exe
  2⤵
  PID:12248
- C:\Windows\System\MabjgXD.exe
  C:\Windows\System\MabjgXD.exe
  2⤵
  PID:11480
- C:\Windows\System\MCgbKue.exe
  C:\Windows\System\MCgbKue.exe
  2⤵
  PID:11528
- C:\Windows\System\eKOTjac.exe
  C:\Windows\System\eKOTjac.exe
  2⤵
  PID:11776
- C:\Windows\System\rsjXUla.exe
  C:\Windows\System\rsjXUla.exe
  2⤵
  PID:11840
- C:\Windows\System\PMHItNY.exe
  C:\Windows\System\PMHItNY.exe
  2⤵
  PID:12096
- C:\Windows\System\XMebqpz.exe
  C:\Windows\System\XMebqpz.exe
  2⤵
  PID:11992
- C:\Windows\System\HjwTPxk.exe
  C:\Windows\System\HjwTPxk.exe
  2⤵
  PID:11396
- C:\Windows\System\XGSGogY.exe
  C:\Windows\System\XGSGogY.exe
  2⤵
  PID:12040
- C:\Windows\System\vZdWpJi.exe
  C:\Windows\System\vZdWpJi.exe
  2⤵
  PID:11620
- C:\Windows\System\ECEEuaO.exe
  C:\Windows\System\ECEEuaO.exe
  2⤵
  PID:12296
- C:\Windows\System\DMuAhYI.exe
  C:\Windows\System\DMuAhYI.exe
  2⤵
  PID:12324
- C:\Windows\System\ybRKflE.exe
  C:\Windows\System\ybRKflE.exe
  2⤵
  PID:12344
- C:\Windows\System\xElWdcV.exe
  C:\Windows\System\xElWdcV.exe
  2⤵
  PID:12360
- C:\Windows\System\thVaQwB.exe
  C:\Windows\System\thVaQwB.exe
  2⤵
  PID:12392
- C:\Windows\System\KLHylHC.exe
  C:\Windows\System\KLHylHC.exe
  2⤵
  PID:12412
- C:\Windows\System\rcvZGuW.exe
  C:\Windows\System\rcvZGuW.exe
  2⤵
  PID:12432
- C:\Windows\System\rAMTTdc.exe
  C:\Windows\System\rAMTTdc.exe
  2⤵
  PID:12464
- C:\Windows\System\WDqqEcC.exe
  C:\Windows\System\WDqqEcC.exe
  2⤵
  PID:12480
- C:\Windows\System\hQDHuXT.exe
  C:\Windows\System\hQDHuXT.exe
  2⤵
  PID:12500
- C:\Windows\System\lFBGkzN.exe
  C:\Windows\System\lFBGkzN.exe
  2⤵
  PID:12528
- C:\Windows\System\ZCcwFal.exe
  C:\Windows\System\ZCcwFal.exe
  2⤵
  PID:12556
- C:\Windows\System\ufZjYuz.exe
  C:\Windows\System\ufZjYuz.exe
  2⤵
  PID:12580
- C:\Windows\System\TIVuvgc.exe
  C:\Windows\System\TIVuvgc.exe
  2⤵
  PID:12600
- C:\Windows\System\zimijmW.exe
  C:\Windows\System\zimijmW.exe
  2⤵
  PID:12636
- C:\Windows\System\pWDGJpT.exe
  C:\Windows\System\pWDGJpT.exe
  2⤵
  PID:12664
- C:\Windows\System\QVsyUFc.exe
  C:\Windows\System\QVsyUFc.exe
  2⤵
  PID:12688
- C:\Windows\System\ANFgHJI.exe
  C:\Windows\System\ANFgHJI.exe
  2⤵
  PID:12716
- C:\Windows\System\asMnvVw.exe
  C:\Windows\System\asMnvVw.exe
  2⤵
  PID:12744
- C:\Windows\System\UVgMWxs.exe
  C:\Windows\System\UVgMWxs.exe
  2⤵
  PID:12772
- C:\Windows\System\ebxxeYg.exe
  C:\Windows\System\ebxxeYg.exe
  2⤵
  PID:12800
- C:\Windows\System\OgCGRjH.exe
  C:\Windows\System\OgCGRjH.exe
  2⤵
  PID:12824
- C:\Windows\System\ZROlriP.exe
  C:\Windows\System\ZROlriP.exe
  2⤵
  PID:12840
- C:\Windows\System\AePdvrh.exe
  C:\Windows\System\AePdvrh.exe
  2⤵
  PID:12880
- C:\Windows\System\kfrlowj.exe
  C:\Windows\System\kfrlowj.exe
  2⤵
  PID:12904
- C:\Windows\System\vqULDIq.exe
  C:\Windows\System\vqULDIq.exe
  2⤵
  PID:12928
- C:\Windows\System\myjgYoi.exe
  C:\Windows\System\myjgYoi.exe
  2⤵
  PID:12960
- C:\Windows\System\bNFDPvN.exe
  C:\Windows\System\bNFDPvN.exe
  2⤵
  PID:12988
- C:\Windows\System\GinsFBX.exe
  C:\Windows\System\GinsFBX.exe
  2⤵
  PID:13016
- C:\Windows\System\HHrhBsp.exe
  C:\Windows\System\HHrhBsp.exe
  2⤵
  PID:13056
- C:\Windows\System\CQIuoUf.exe
  C:\Windows\System\CQIuoUf.exe
  2⤵
  PID:13076
- C:\Windows\System\YsYHyHm.exe
  C:\Windows\System\YsYHyHm.exe
  2⤵
  PID:13112
- C:\Windows\System\SVywdNw.exe
  C:\Windows\System\SVywdNw.exe
  2⤵
  PID:13132
- C:\Windows\System\HPgtutc.exe
  C:\Windows\System\HPgtutc.exe
  2⤵
  PID:13164
- C:\Windows\System\pgHQLzH.exe
  C:\Windows\System\pgHQLzH.exe
  2⤵
  PID:13196
- C:\Windows\System\VXlIOFy.exe
  C:\Windows\System\VXlIOFy.exe
  2⤵
  PID:13232
- C:\Windows\System\pBZDKiQ.exe
  C:\Windows\System\pBZDKiQ.exe
  2⤵
  PID:13256
- C:\Windows\System\yfyRybm.exe
  C:\Windows\System\yfyRybm.exe
  2⤵
  PID:13300
- C:\Windows\System\NDwnKFI.exe
  C:\Windows\System\NDwnKFI.exe
  2⤵
  PID:10916
- C:\Windows\System\mWXiAUy.exe
  C:\Windows\System\mWXiAUy.exe
  2⤵
  PID:12240
- C:\Windows\System\YRIuQHE.exe
  C:\Windows\System\YRIuQHE.exe
  2⤵
  PID:12292
- C:\Windows\System\RhvyPFs.exe
  C:\Windows\System\RhvyPFs.exe
  2⤵
  PID:12456
- C:\Windows\System\aLYqZjB.exe
  C:\Windows\System\aLYqZjB.exe
  2⤵
  PID:12488
- C:\Windows\System\ULpryeX.exe
  C:\Windows\System\ULpryeX.exe
  2⤵
  PID:12620
- C:\Windows\System\ouIZVPK.exe
  C:\Windows\System\ouIZVPK.exe
  2⤵
  PID:12576
- C:\Windows\System\ggmOleN.exe
  C:\Windows\System\ggmOleN.exe
  2⤵
  PID:12740
- C:\Windows\System\FUidthd.exe
  C:\Windows\System\FUidthd.exe
  2⤵
  PID:12788
- C:\Windows\System\tEtRQMV.exe
  C:\Windows\System\tEtRQMV.exe
  2⤵
  PID:12760
- C:\Windows\System\HnlOwlC.exe
  C:\Windows\System\HnlOwlC.exe
  2⤵
  PID:12892
- C:\Windows\System\Jefpght.exe
  C:\Windows\System\Jefpght.exe
  2⤵
  PID:12984
- C:\Windows\System\OkDlLha.exe
  C:\Windows\System\OkDlLha.exe
  2⤵
  PID:13028
- C:\Windows\System\PjSCHsr.exe
  C:\Windows\System\PjSCHsr.exe
  2⤵
  PID:13088
- C:\Windows\System\rgKhIKw.exe
  C:\Windows\System\rgKhIKw.exe
  2⤵
  PID:13284
- C:\Windows\System\EHUljNf.exe
  C:\Windows\System\EHUljNf.exe
  2⤵
  PID:13268
- C:\Windows\System\BiNhxrH.exe
  C:\Windows\System\BiNhxrH.exe
  2⤵
  PID:12492
- C:\Windows\System\aEAXrBJ.exe
  C:\Windows\System\aEAXrBJ.exe
  2⤵
  PID:12336
- C:\Windows\System\XqICgOV.exe
  C:\Windows\System\XqICgOV.exe
  2⤵
  PID:12552
- C:\Windows\System\KFtvrmq.exe
  C:\Windows\System\KFtvrmq.exe
  2⤵
  PID:12768
- C:\Windows\System\lApdLqP.exe
  C:\Windows\System\lApdLqP.exe
  2⤵
  PID:12756
- C:\Windows\System\PlpiEtL.exe
  C:\Windows\System\PlpiEtL.exe
  2⤵
  PID:13032
- C:\Windows\System\WCfKUpJ.exe
  C:\Windows\System\WCfKUpJ.exe
  2⤵
  PID:13092
- C:\Windows\System\ipYjMyy.exe
  C:\Windows\System\ipYjMyy.exe
  2⤵
  PID:12308
- C:\Windows\System\rsudkHF.exe
  C:\Windows\System\rsudkHF.exe
  2⤵
  PID:11824
- C:\Windows\System\mVGAeLn.exe
  C:\Windows\System\mVGAeLn.exe
  2⤵
  PID:13288
- C:\Windows\System\uWVrZts.exe
  C:\Windows\System\uWVrZts.exe
  2⤵
  PID:13336
- C:\Windows\System\WKGjwdY.exe
  C:\Windows\System\WKGjwdY.exe
  2⤵
  PID:13372
- C:\Windows\System\GolbwNk.exe
  C:\Windows\System\GolbwNk.exe
  2⤵
  PID:13392
- C:\Windows\System\XYDNiJO.exe
  C:\Windows\System\XYDNiJO.exe
  2⤵
  PID:13424
- C:\Windows\System\KfReAig.exe
  C:\Windows\System\KfReAig.exe
  2⤵
  PID:13444
- C:\Windows\System\yiEGlso.exe
  C:\Windows\System\yiEGlso.exe
  2⤵
  PID:13480
- C:\Windows\System\JNOFXBJ.exe
  C:\Windows\System\JNOFXBJ.exe
  2⤵
  PID:13508
- C:\Windows\System\GgYfZBM.exe
  C:\Windows\System\GgYfZBM.exe
  2⤵
  PID:13532
- C:\Windows\System\DMCsPeo.exe
  C:\Windows\System\DMCsPeo.exe
  2⤵
  PID:13560
- C:\Windows\System\QHEjngR.exe
  C:\Windows\System\QHEjngR.exe
  2⤵
  PID:13588
- C:\Windows\System\kOLlGwc.exe
  C:\Windows\System\kOLlGwc.exe
  2⤵
  PID:13608
- C:\Windows\System\tJfVTZg.exe
  C:\Windows\System\tJfVTZg.exe
  2⤵
  PID:13644
- C:\Windows\System\WPANRdi.exe
  C:\Windows\System\WPANRdi.exe
  2⤵
  PID:13684
- C:\Windows\System\XpsHjVn.exe
  C:\Windows\System\XpsHjVn.exe
  2⤵
  PID:13716
- C:\Windows\System\GsHuomE.exe
  C:\Windows\System\GsHuomE.exe
  2⤵
  PID:13732
- C:\Windows\System\nSzuxzU.exe
  C:\Windows\System\nSzuxzU.exe
  2⤵
  PID:13760
- C:\Windows\System\zWtCbps.exe
  C:\Windows\System\zWtCbps.exe
  2⤵
  PID:13776
- C:\Windows\System\fPntAcM.exe
  C:\Windows\System\fPntAcM.exe
  2⤵
  PID:13804
- C:\Windows\System\FjQDhvT.exe
  C:\Windows\System\FjQDhvT.exe
  2⤵
  PID:13824
- C:\Windows\System\AdDlPTk.exe
  C:\Windows\System\AdDlPTk.exe
  2⤵
  PID:13852
- C:\Windows\System\OePfIsU.exe
  C:\Windows\System\OePfIsU.exe
  2⤵
  PID:13872
- C:\Windows\System\wvnXton.exe
  C:\Windows\System\wvnXton.exe
  2⤵
  PID:13900
- C:\Windows\System\XiHkKim.exe
  C:\Windows\System\XiHkKim.exe
  2⤵
  PID:13936
- C:\Windows\System\eNMxvfw.exe
  C:\Windows\System\eNMxvfw.exe
  2⤵
  PID:13956
- C:\Windows\System\SPGfuOe.exe
  C:\Windows\System\SPGfuOe.exe
  2⤵
  PID:13980
- C:\Windows\System\nqDfMHd.exe
  C:\Windows\System\nqDfMHd.exe
  2⤵
  PID:14012
- C:\Windows\System\cdvSMkt.exe
  C:\Windows\System\cdvSMkt.exe
  2⤵
  PID:14040
- C:\Windows\System\McHVoTC.exe
  C:\Windows\System\McHVoTC.exe
  2⤵
  PID:14076
- C:\Windows\System\EVfsLQq.exe
  C:\Windows\System\EVfsLQq.exe
  2⤵
  PID:14104
- C:\Windows\System\xQjEtqa.exe
  C:\Windows\System\xQjEtqa.exe
  2⤵
  PID:14144
- C:\Windows\System\tocYsiS.exe
  C:\Windows\System\tocYsiS.exe
  2⤵
  PID:14164
- C:\Windows\System\gzofClt.exe
  C:\Windows\System\gzofClt.exe
  2⤵
  PID:14192
- C:\Windows\System\UBIXOAE.exe
  C:\Windows\System\UBIXOAE.exe
  2⤵
  PID:14224
- C:\Windows\System\QwSSAWv.exe
  C:\Windows\System\QwSSAWv.exe
  2⤵
  PID:14292
- C:\Windows\System\shSzDYH.exe
  C:\Windows\System\shSzDYH.exe
  2⤵
  PID:14320
- C:\Windows\System\OavBnQf.exe
  C:\Windows\System\OavBnQf.exe
  2⤵
  PID:12796
- C:\Windows\System\UzkIQNO.exe
  C:\Windows\System\UzkIQNO.exe
  2⤵
  PID:13292
- C:\Windows\System\rwgGcfj.exe
  C:\Windows\System\rwgGcfj.exe
  2⤵
  PID:13368
- C:\Windows\System\cKFFlVd.exe
  C:\Windows\System\cKFFlVd.exe
  2⤵
  PID:13460
- C:\Windows\System\VLrCrnr.exe
  C:\Windows\System\VLrCrnr.exe
  2⤵
  PID:13404
- C:\Windows\System\QzDjqCa.exe
  C:\Windows\System\QzDjqCa.exe
  2⤵
  PID:13496
- C:\Windows\System\zRbjeoj.exe
  C:\Windows\System\zRbjeoj.exe
  2⤵
  PID:13556
- C:\Windows\System\tVvSBDu.exe
  C:\Windows\System\tVvSBDu.exe
  2⤵
  PID:13616
- C:\Windows\System\cYpFsJV.exe
  C:\Windows\System\cYpFsJV.exe
  2⤵
  PID:13696
- C:\Windows\System\fYDXDUn.exe
  C:\Windows\System\fYDXDUn.exe
  2⤵
  PID:13744
- C:\Windows\System\mJdFYoX.exe
  C:\Windows\System\mJdFYoX.exe
  2⤵
  PID:13768
- C:\Windows\System\bwipKTf.exe
  C:\Windows\System\bwipKTf.exe
  2⤵
  PID:13816
- C:\Windows\System\ZgmPrLB.exe
  C:\Windows\System\ZgmPrLB.exe
  2⤵
  PID:14008
- C:\Windows\System\vLnrRoo.exe
  C:\Windows\System\vLnrRoo.exe
  2⤵
  PID:14056
- C:\Windows\System\FzbkIEF.exe
  C:\Windows\System\FzbkIEF.exe
  2⤵
  PID:14132
- C:\Windows\System\jPjfIgV.exe
  C:\Windows\System\jPjfIgV.exe
  2⤵
  PID:14092
- C:\Windows\System\LcwuvIf.exe
  C:\Windows\System\LcwuvIf.exe
  2⤵
  PID:14240
- C:\Windows\System\pnOhJaT.exe
  C:\Windows\System\pnOhJaT.exe
  2⤵
  PID:14276
- C:\Windows\System\ykynglS.exe
  C:\Windows\System\ykynglS.exe
  2⤵
  PID:14316
- C:\Windows\System\sXkCLYx.exe
  C:\Windows\System\sXkCLYx.exe
  2⤵
  PID:12384
- C:\Windows\System\sppTnQu.exe
  C:\Windows\System\sppTnQu.exe
  2⤵
  PID:13468
- C:\Windows\System\TaJnhhw.exe
  C:\Windows\System\TaJnhhw.exe
  2⤵
  PID:13552
- C:\Windows\System\tKheZYf.exe
  C:\Windows\System\tKheZYf.exe
  2⤵
  PID:13656
- C:\Windows\System\kFeghJg.exe
  C:\Windows\System\kFeghJg.exe
  2⤵
  PID:13868
- C:\Windows\System\RvFNfsW.exe
  C:\Windows\System\RvFNfsW.exe
  2⤵
  PID:13988
- C:\Windows\System\XfMBfqV.exe
  C:\Windows\System\XfMBfqV.exe
  2⤵
  PID:13348
- C:\Windows\System\WCbADir.exe
  C:\Windows\System\WCbADir.exe
  2⤵
  PID:13440
- C:\Windows\System\hmCLMnZ.exe
  C:\Windows\System\hmCLMnZ.exe
  2⤵
  PID:14352
- C:\Windows\System\DzwKlhh.exe
  C:\Windows\System\DzwKlhh.exe
  2⤵
  PID:14376
- C:\Windows\System\MAMzcnS.exe
  C:\Windows\System\MAMzcnS.exe
  2⤵
  PID:14404
- C:\Windows\System\wiWqsAq.exe
  C:\Windows\System\wiWqsAq.exe
  2⤵
  PID:14432
- C:\Windows\System\TibpfgQ.exe
  C:\Windows\System\TibpfgQ.exe
  2⤵
  PID:14464
- C:\Windows\System\zXkRBBI.exe
  C:\Windows\System\zXkRBBI.exe
  2⤵
  PID:14500
- C:\Windows\System\eUOWwKh.exe
  C:\Windows\System\eUOWwKh.exe
  2⤵
  PID:14516
- C:\Windows\System\rpLPdPH.exe
  C:\Windows\System\rpLPdPH.exe
  2⤵
  PID:14540
- C:\Windows\System\CzBOBgZ.exe
  C:\Windows\System\CzBOBgZ.exe
  2⤵
  PID:14564
- C:\Windows\System\pnjaAWe.exe
  C:\Windows\System\pnjaAWe.exe
  2⤵
  PID:14596
- C:\Windows\System\yKkfQGK.exe
  C:\Windows\System\yKkfQGK.exe
  2⤵
  PID:14628
- C:\Windows\System\KcpkCZZ.exe
  C:\Windows\System\KcpkCZZ.exe
  2⤵
  PID:14652
- C:\Windows\System\wXkFsgs.exe
  C:\Windows\System\wXkFsgs.exe
  2⤵
  PID:14676
- C:\Windows\System\mNUUDSc.exe
  C:\Windows\System\mNUUDSc.exe
  2⤵
  PID:14704
- C:\Windows\System\UpALPYA.exe
  C:\Windows\System\UpALPYA.exe
  2⤵
  PID:14728
- C:\Windows\System\jGttREx.exe
  C:\Windows\System\jGttREx.exe
  2⤵
  PID:14756
- C:\Windows\System\blItGuX.exe
  C:\Windows\System\blItGuX.exe
  2⤵
  PID:14784
- C:\Windows\System\VhieKer.exe
  C:\Windows\System\VhieKer.exe
  2⤵
  PID:14808
- C:\Windows\System\PDbcNgk.exe
  C:\Windows\System\PDbcNgk.exe
  2⤵
  PID:14836
- C:\Windows\System\osZOrTr.exe
  C:\Windows\System\osZOrTr.exe
  2⤵
  PID:14856
- C:\Windows\System\sxToNjy.exe
  C:\Windows\System\sxToNjy.exe
  2⤵
  PID:14884
- C:\Windows\System\ajBcXxY.exe
  C:\Windows\System\ajBcXxY.exe
  2⤵
  PID:14912
- C:\Windows\System\avyAjRB.exe
  C:\Windows\System\avyAjRB.exe
  2⤵
  PID:14944
- C:\Windows\System\qPVCVIU.exe
  C:\Windows\System\qPVCVIU.exe
  2⤵
  PID:14976
- C:\Windows\System\bZUiOrT.exe
  C:\Windows\System\bZUiOrT.exe
  2⤵
  PID:15000
- C:\Windows\System\cMpNroi.exe
  C:\Windows\System\cMpNroi.exe
  2⤵
  PID:15020
- C:\Windows\System\JoWqeWd.exe
  C:\Windows\System\JoWqeWd.exe
  2⤵
  PID:15044
- C:\Windows\System\BFfeCbr.exe
  C:\Windows\System\BFfeCbr.exe
  2⤵
  PID:15076
- C:\Windows\System\sEsmIuV.exe
  C:\Windows\System\sEsmIuV.exe
  2⤵
  PID:15104
- C:\Windows\System\uYYGgNs.exe
  C:\Windows\System\uYYGgNs.exe
  2⤵
  PID:15128
- C:\Windows\System\RDIqnUH.exe
  C:\Windows\System\RDIqnUH.exe
  2⤵
  PID:15152
- C:\Windows\System\LLRkwnY.exe
  C:\Windows\System\LLRkwnY.exe
  2⤵
  PID:15180
- C:\Windows\System\DaAOJMT.exe
  C:\Windows\System\DaAOJMT.exe
  2⤵
  PID:15212
- C:\Windows\System\zNXPjDL.exe
  C:\Windows\System\zNXPjDL.exe
  2⤵
  PID:15256
- C:\Windows\System\XgJhipT.exe
  C:\Windows\System\XgJhipT.exe
  2⤵
  PID:15280
- C:\Windows\System\vgUTOBc.exe
  C:\Windows\System\vgUTOBc.exe
  2⤵
  PID:15320
- C:\Windows\System\YPoFXMj.exe
  C:\Windows\System\YPoFXMj.exe
  2⤵
  PID:15356
- C:\Windows\System\MPfVCdA.exe
  C:\Windows\System\MPfVCdA.exe
  2⤵
  PID:13928
- C:\Windows\System\NLjiUpi.exe
  C:\Windows\System\NLjiUpi.exe
  2⤵
  PID:13864
- C:\Windows\System\wdUhtSU.exe
  C:\Windows\System\wdUhtSU.exe
  2⤵
  PID:14444
- C:\Windows\System\HEKgOZl.exe
  C:\Windows\System\HEKgOZl.exe
  2⤵
  PID:14424
- C:\Windows\System\fkqQziu.exe
  C:\Windows\System\fkqQziu.exe
  2⤵
  PID:14412
- C:\Windows\System\tlchXPs.exe
  C:\Windows\System\tlchXPs.exe
  2⤵
  PID:14604
- C:\Windows\System\soYTpAU.exe
  C:\Windows\System\soYTpAU.exe
  2⤵
  PID:14580
- C:\Windows\System\Kxxjwzg.exe
  C:\Windows\System\Kxxjwzg.exe
  2⤵
  PID:14636
- C:\Windows\System\OKslmWG.exe
  C:\Windows\System\OKslmWG.exe
  2⤵
  PID:14672
- C:\Windows\System\Ffjlhyx.exe
  C:\Windows\System\Ffjlhyx.exe
  2⤵
  PID:14800
- C:\Windows\System\NuRuahV.exe
  C:\Windows\System\NuRuahV.exe
  2⤵
  PID:14772
- C:\Windows\System\cqXwwhY.exe
  C:\Windows\System\cqXwwhY.exe
  2⤵
  PID:14932
- C:\Windows\System\LawFTWM.exe
  C:\Windows\System\LawFTWM.exe
  2⤵
  PID:14992
- C:\Windows\System\jXuRUqm.exe
  C:\Windows\System\jXuRUqm.exe
  2⤵
  PID:14872
- C:\Windows\System\xvnDpga.exe
  C:\Windows\System\xvnDpga.exe
  2⤵
  PID:15060
- C:\Windows\System\xqprEdY.exe
  C:\Windows\System\xqprEdY.exe
  2⤵
  PID:15032
- C:\Windows\System\XBtYXOb.exe
  C:\Windows\System\XBtYXOb.exe
  2⤵
  PID:15232
- C:\Windows\System\SkHoWzP.exe
  C:\Windows\System\SkHoWzP.exe
  2⤵
  PID:15288
- C:\Windows\System\RmdfStJ.exe
  C:\Windows\System\RmdfStJ.exe
  2⤵
  PID:15264
- C:\Windows\System\nFHSldK.exe
  C:\Windows\System\nFHSldK.exe
  2⤵
  PID:14372
- C:\Windows\System\VZhfgnU.exe
  C:\Windows\System\VZhfgnU.exe
  2⤵
  PID:15316
- C:\Windows\System\FwhNpWf.exe
  C:\Windows\System\FwhNpWf.exe
  2⤵
  PID:14528
- C:\Windows\System\fKdSkmp.exe
  C:\Windows\System\fKdSkmp.exe
  2⤵
  PID:14692
- C:\Windows\System\YLVweXi.exe
  C:\Windows\System\YLVweXi.exe
  2⤵
  PID:14688
- C:\Windows\System\MVSCkya.exe
  C:\Windows\System\MVSCkya.exe
  2⤵
  PID:14792
- C:\Windows\System\wvtXvIz.exe
  C:\Windows\System\wvtXvIz.exe
  2⤵
  PID:14988
- C:\Windows\System\MFdryEN.exe
  C:\Windows\System\MFdryEN.exe
  2⤵
  PID:15016
- C:\Windows\System\PFuRmkM.exe
  C:\Windows\System\PFuRmkM.exe
  2⤵
  PID:14340
- C:\Windows\System\MwOjFTS.exe
  C:\Windows\System\MwOjFTS.exe
  2⤵
  PID:14748
- C:\Windows\System\IqxhxQw.exe
  C:\Windows\System\IqxhxQw.exe
  2⤵
  PID:15392
- C:\Windows\System\dZKUGCi.exe
  C:\Windows\System\dZKUGCi.exe
  2⤵
  PID:15408
- C:\Windows\System\VVImGZN.exe
  C:\Windows\System\VVImGZN.exe
  2⤵
  PID:15436
- C:\Windows\System\kArXQDt.exe
  C:\Windows\System\kArXQDt.exe
  2⤵
  PID:15476
- C:\Windows\System\ZTPJeaJ.exe
  C:\Windows\System\ZTPJeaJ.exe
  2⤵
  PID:15500
- C:\Windows\System\qZMGIxK.exe
  C:\Windows\System\qZMGIxK.exe
  2⤵
  PID:15528
- C:\Windows\System\aJImENY.exe
  C:\Windows\System\aJImENY.exe
  2⤵
  PID:15560
- C:\Windows\System\uJTlwTu.exe
  C:\Windows\System\uJTlwTu.exe
  2⤵
  PID:15592
- C:\Windows\System\qsIoVlw.exe
  C:\Windows\System\qsIoVlw.exe
  2⤵
  PID:15608
- C:\Windows\System\DIVwzfT.exe
  C:\Windows\System\DIVwzfT.exe
  2⤵
  PID:15640
- C:\Windows\System\mESsNPb.exe
  C:\Windows\System\mESsNPb.exe
  2⤵
  PID:15672
- C:\Windows\System\oJsECLr.exe
  C:\Windows\System\oJsECLr.exe
  2⤵
  PID:15704
- C:\Windows\System\tyUESwT.exe
  C:\Windows\System\tyUESwT.exe
  2⤵
  PID:15724
- C:\Windows\System\FbRFPKQ.exe
  C:\Windows\System\FbRFPKQ.exe
  2⤵
  PID:15756
- C:\Windows\System\wopMBaZ.exe
  C:\Windows\System\wopMBaZ.exe
  2⤵
  PID:15788
- C:\Windows\System\pHiVICg.exe
  C:\Windows\System\pHiVICg.exe
  2⤵
  PID:15828
- C:\Windows\System\ANQvzlk.exe
  C:\Windows\System\ANQvzlk.exe
  2⤵
  PID:15864
- C:\Windows\System\JEzCOHj.exe
  C:\Windows\System\JEzCOHj.exe
  2⤵
  PID:15896
- C:\Windows\System\tFweZqe.exe
  C:\Windows\System\tFweZqe.exe
  2⤵
  PID:15928
- C:\Windows\System\loktzZl.exe
  C:\Windows\System\loktzZl.exe
  2⤵
  PID:15956
- C:\Windows\System\ZsZxLSp.exe
  C:\Windows\System\ZsZxLSp.exe
  2⤵
  PID:15992
- C:\Windows\System\uKafPrt.exe
  C:\Windows\System\uKafPrt.exe
  2⤵
  PID:16020
- C:\Windows\System\zbpMoNK.exe
  C:\Windows\System\zbpMoNK.exe
  2⤵
  PID:16048
- C:\Windows\System\wpKRxRG.exe
  C:\Windows\System\wpKRxRG.exe
  2⤵
  PID:16064
- C:\Windows\System\dmloSlJ.exe
  C:\Windows\System\dmloSlJ.exe
  2⤵
  PID:16084
- C:\Windows\System\TnPdGjS.exe
  C:\Windows\System\TnPdGjS.exe
  2⤵
  PID:16120
- C:\Windows\System\MgMXHww.exe
  C:\Windows\System\MgMXHww.exe
  2⤵
  PID:16144
- C:\Windows\System\pZjnHWp.exe
  C:\Windows\System\pZjnHWp.exe
  2⤵
  PID:16164
- C:\Windows\System\tcFRPkG.exe
  C:\Windows\System\tcFRPkG.exe
  2⤵
  PID:16192
- C:\Windows\System\vBFOmzp.exe
  C:\Windows\System\vBFOmzp.exe
  2⤵
  PID:16220
- C:\Windows\System\NbvcTfi.exe
  C:\Windows\System\NbvcTfi.exe
  2⤵
  PID:16244
- C:\Windows\System\lVTiKGb.exe
  C:\Windows\System\lVTiKGb.exe
  2⤵
  PID:16272
- C:\Windows\System\EVvvFNM.exe
  C:\Windows\System\EVvvFNM.exe
  2⤵
  PID:16300
- C:\Windows\System\WmqniYb.exe
  C:\Windows\System\WmqniYb.exe
  2⤵
  PID:16328
- C:\Windows\System\luHYdyU.exe
  C:\Windows\System\luHYdyU.exe
  2⤵
  PID:16368
- C:\Windows\System\PvUJkIK.exe
  C:\Windows\System\PvUJkIK.exe
  2⤵
  PID:14820
- C:\Windows\System\SeSLgpI.exe
  C:\Windows\System\SeSLgpI.exe
  2⤵
  PID:14848
- C:\Windows\System\rDKNuzx.exe
  C:\Windows\System\rDKNuzx.exe
  2⤵
  PID:14744
- C:\Windows\System\ghnGXBe.exe
  C:\Windows\System\ghnGXBe.exe
  2⤵
  PID:15460
- C:\Windows\System\hCaXYqX.exe
  C:\Windows\System\hCaXYqX.exe
  2⤵
  PID:15384
- C:\Windows\System\HwIIrYS.exe
  C:\Windows\System\HwIIrYS.exe
  2⤵
  PID:15228
- C:\Windows\System\NpxviQD.exe
  C:\Windows\System\NpxviQD.exe
  2⤵
  PID:15544
- C:\Windows\System\UFgmnBy.exe
  C:\Windows\System\UFgmnBy.exe
  2⤵
  PID:15780
- C:\Windows\System\IRIWrKv.exe
  C:\Windows\System\IRIWrKv.exe
  2⤵
  PID:15588
- C:\Windows\System\myTeJAe.exe
  C:\Windows\System\myTeJAe.exe
  2⤵
  PID:15768
- C:\Windows\System\ywExnMU.exe
  C:\Windows\System\ywExnMU.exe
  2⤵
  PID:15836
- C:\Windows\System\MvouEQe.exe
  C:\Windows\System\MvouEQe.exe
  2⤵
  PID:15748
- C:\Windows\System\JrKSrKA.exe
  C:\Windows\System\JrKSrKA.exe
  2⤵
  PID:16008
- C:\Windows\System\FDcBzPM.exe
  C:\Windows\System\FDcBzPM.exe
  2⤵
  PID:16060
- C:\Windows\System\PynxXgS.exe
  C:\Windows\System\PynxXgS.exe
  2⤵
  PID:16204
- C:\Windows\System\UmtFXdb.exe
  C:\Windows\System\UmtFXdb.exe
  2⤵
  PID:16152
- C:\Windows\System\cHfjmYI.exe
  C:\Windows\System\cHfjmYI.exe
  2⤵
  PID:16336
- C:\Windows\System\vvczRtO.exe
  C:\Windows\System\vvczRtO.exe
  2⤵
  PID:16176
- C:\Windows\System\ZUntSPg.exe
  C:\Windows\System\ZUntSPg.exe
  2⤵
  PID:15428
- C:\Windows\System\UvCeNHg.exe
  C:\Windows\System\UvCeNHg.exe
  2⤵
  PID:16356
- C:\Windows\System\RYWXGXt.exe
  C:\Windows\System\RYWXGXt.exe
  2⤵
  PID:14588
- C:\Windows\System\fqfxoie.exe
  C:\Windows\System\fqfxoie.exe
  2⤵
  PID:15944
- C:\Windows\System\MlRoUoe.exe
  C:\Windows\System\MlRoUoe.exe
  2⤵
  PID:15816
- C:\Windows\System\pFqnywQ.exe
  C:\Windows\System\pFqnywQ.exe
  2⤵
  PID:16036
- C:\Windows\System\TcKJFGh.exe
  C:\Windows\System\TcKJFGh.exe
  2⤵
  PID:16324
- C:\Windows\System\UhaSoCX.exe
  C:\Windows\System\UhaSoCX.exe
  2⤵
  PID:15648
- C:\Windows\System\GoAEQVy.exe
  C:\Windows\System\GoAEQVy.exe
  2⤵
  PID:15552
- C:\Windows\System\YodjxhI.exe
  C:\Windows\System\YodjxhI.exe
  2⤵
  PID:16392
- C:\Windows\System\jwbAead.exe
  C:\Windows\System\jwbAead.exe
  2⤵
  PID:16416
- C:\Windows\System\NtVQyDy.exe
  C:\Windows\System\NtVQyDy.exe
  2⤵
  PID:16444
- C:\Windows\System\abuqUaA.exe
  C:\Windows\System\abuqUaA.exe
  2⤵
  PID:16464
- C:\Windows\System\lbODwcN.exe
  C:\Windows\System\lbODwcN.exe
  2⤵
  PID:16492
- C:\Windows\System\VtIjiYX.exe
  C:\Windows\System\VtIjiYX.exe
  2⤵
  PID:16524
- C:\Windows\System\AWzwdLi.exe
  C:\Windows\System\AWzwdLi.exe
  2⤵
  PID:16552
- C:\Windows\System\pVrTmRJ.exe
  C:\Windows\System\pVrTmRJ.exe
  2⤵
  PID:16676
- C:\Windows\System\ppgWYaM.exe
  C:\Windows\System\ppgWYaM.exe
  2⤵
  PID:16692
- C:\Windows\System\zNTzeNl.exe
  C:\Windows\System\zNTzeNl.exe
  2⤵
  PID:16708
- C:\Windows\System\aLzCBDG.exe
  C:\Windows\System\aLzCBDG.exe
  2⤵
  PID:16732
- C:\Windows\System\ziqcEyA.exe
  C:\Windows\System\ziqcEyA.exe
  2⤵
  PID:16752
- C:\Windows\System\MTPTNYX.exe
  C:\Windows\System\MTPTNYX.exe
  2⤵
  PID:16784
- C:\Windows\System\DuBGNiu.exe
  C:\Windows\System\DuBGNiu.exe
  2⤵
  PID:16812
- C:\Windows\System\WilZKFV.exe
  C:\Windows\System\WilZKFV.exe
  2⤵
  PID:16840
- C:\Windows\System\opvWHLq.exe
  C:\Windows\System\opvWHLq.exe
  2⤵
  PID:16868
- C:\Windows\System\sSqeRAh.exe
  C:\Windows\System\sSqeRAh.exe
  2⤵
  PID:16892
- C:\Windows\System\szmEUWb.exe
  C:\Windows\System\szmEUWb.exe
  2⤵
  PID:16912
- C:\Windows\System\GYjorBc.exe
  C:\Windows\System\GYjorBc.exe
  2⤵
  PID:16956
- C:\Windows\System\WeVOToK.exe
  C:\Windows\System\WeVOToK.exe
  2⤵
  PID:16996
- C:\Windows\System\PZjjMrZ.exe
  C:\Windows\System\PZjjMrZ.exe
  2⤵
  PID:17012
- C:\Windows\System\djyuGTp.exe
  C:\Windows\System\djyuGTp.exe
  2⤵
  PID:17028
- C:\Windows\System\YqICocj.exe
  C:\Windows\System\YqICocj.exe
  2⤵
  PID:17044
- C:\Windows\System\WjEplQu.exe
  C:\Windows\System\WjEplQu.exe
  2⤵
  PID:17060
- C:\Windows\System\iMGCSTX.exe
  C:\Windows\System\iMGCSTX.exe
  2⤵
  PID:17084

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:16804

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\AtlHAef.exe

Filesize
1.6MB

MD5
70b0f75a84a0b0d765ad59f6ede2c52c

SHA1
255bf8427bdda4da9b438e4f00c3431ca269afc7

SHA256
6b091871ac079d2a96bc455592e4113b694930180ea3bd071b8f3371c673eabf

SHA512
c7ce9753aaa350a36f7f3a07e32048f874f2c93acc7e5ccee84a0a3ba7e5906f0a96b97b2e60a048a0b98ca4cb5a0438e01bd01876a08c0b1acdde85dc88292a

Download Submit
C:\Windows\System\DFYZVlP.exe

Filesize
1.6MB

MD5
514934804a9798ccd551b073ff15a2c8

SHA1
af337f254d76ff3f370a09a57e11865f502771e0

SHA256
715e8b5b647d33edd5ebaffd77b7882db9501eeca910b55c991ada13af1c339c

SHA512
b07e950d39c13d4e3c0d7c33b1b02eb8dc19b834454aadbba40204911737b49484a624206b03f0547cabfbd69d0e9a33c7c921ebe5f28ed8ebbf5f5a2c6175ec

Download Submit
C:\Windows\System\DHBbnXU.exe

Filesize
1.6MB

MD5
abba5352a28d9dbf01efd0a9868e299a

SHA1
c3a95f95e923e1255d7835f7f149c062a3dc7fac

SHA256
d799e5a6f698d359dfb32d194747a7d4c78e1c978f7d2f6465baeb28bad47c80

SHA512
9bd3adfc3629e02fdcb4213c73b783e4aad2ac9e2edb8b5f0912d83c5cd2088b26070977bf8120582b6f408fab357572b725884f291ea5b7d1f16e83f0b6916d

Download Submit
C:\Windows\System\DjaJCJg.exe

Filesize
1.6MB

MD5
57b49059f88c7fd469727c2404ba6d02

SHA1
7db91c342c964339256580aecf7f2a96f79810c2

SHA256
9d20e5328cbbbc38c06e62f5991a4c036d2155ae15df281cd0801ab9ac071378

SHA512
0ba2f9d5755032eeb95840904a0b5b54e49727beeb1fd6287196492d50d9ee24509e48143d746bf1d2f7294bed6c18d70a0591e7cf44057a146092962369564d

Download Submit
C:\Windows\System\DulCsmO.exe

Filesize
1.6MB

MD5
eec62f242952f4f96ceec840b899c791

SHA1
bccc39a1eee1030c3198dd4aabbd2cfd9a665821

SHA256
044fb7267019be8d9d44036fa5659a259c03bf20edb557ecd2daf2ea5aa34a2e

SHA512
495c26bd046afd91bbed219662aec576d1446f3bc86208ba3d3fb37ae75dc54a04752150029238d06ab37ea3ae1732cc232b5280b9a78cd050d5b3e713dc21b0

Download Submit
C:\Windows\System\GKjzWJx.exe

Filesize
1.6MB

MD5
13e99bc58149949c140a2703fab8760c

SHA1
1b9e2a0854440f00b70b0ef93fc183feed120a78

SHA256
8b8793d51adac033c7384ed7fed46fc38d983c59307b8ee385dd1fd06cd90ab6

SHA512
8e84df595fd0055e7c2944e6db65b44055e654b7ac14bada1a6a537b7ca4e7e0c27b04a9562275593d9989b90f18e624c67e10d8b667fee7d97860dfc340af2b

Download Submit
C:\Windows\System\GyNmvOd.exe

Filesize
1.6MB

MD5
d5afd359b815487dcd7540c5a0e75422

SHA1
b8803c7a74698982a242ca53053d04714c3dba15

SHA256
5cdd742630e1bf27bd4ddf7327219119b3cf2ed34cba8fa6e15c233e672c08b1

SHA512
9b3487c7c422579652af3d4aa0f68bf3f544739a9b03d8f4f415bc623649e444ac114c56f6368d89df2f6a7ada3ff234f54805c89ae153d0c524800d710bf113

Download Submit
C:\Windows\System\LmuMPuX.exe

Filesize
1.6MB

MD5
c53bc1c6d0cd3d31aa8d10e0b7037366

SHA1
e9d36705583e851e6313116df115219b18a2d15a

SHA256
d854ecf73486dc1c695fc96e8925a2923504fd44215cd9d80850d03bfdf4fa52

SHA512
1a3f4e5b3376e2d0619112f8026bb1830b2e8e8b0de3b9041240a60ee89fd6252c9451b2d34aea8781216aad17cab6998e9efe62252e90db4964cc337cc26f0f

Download Submit
C:\Windows\System\MJzSKaF.exe

Filesize
1.6MB

MD5
c3ea49251d62cc6a741444a9210d7619

SHA1
666067156fe018fbeac439200b44723bc2402d42

SHA256
48ae94db6c600d5e6b4782b44e91e20acd81faf9464371ded3b7a9c21574e737

SHA512
6076ea2b745860459924be312c24b70c9b26b41de9492e35d4f5e9c98ac9f533a7e21f030bb03f5f110fc34d5531823e9924b0f7f7f17633f052fe42fa173840

Download Submit
C:\Windows\System\MQGFrWS.exe

Filesize
1.6MB

MD5
2f9ba90f2b2555802cb173f3366c10b4

SHA1
906bdbaab581b5b16138b9c21893e6cf67f6781f

SHA256
8e4b2762c5044ebc163855b1ec2648d72aee2e79047d5289c866a38a874e2261

SHA512
64814c4c7579386f559dc7db576c807405fd17d3db1fd165b5bdc151699d9d6bf4fdb9ac397a10e3be1072b7402cec8a0131681226256e68be9218d08b82f0f6

Download Submit
C:\Windows\System\OSODvzJ.exe

Filesize
1.6MB

MD5
3e78f41e79a451990c9eed6b36cb2ff7

SHA1
6a363c9460959d6397aac234997d8ba3af66d09b

SHA256
613f2e9b7008851cd717eefd7c864ffab748814bdb424a0500baed3652e23f3d

SHA512
bef5d2cddd556505c927c07dc2ddb5a8872d3cdccf3276a729355b50bbae1363fcddf0b181ca81a8bfb572f6c030e0b9b5f53ba1e0254cbc89d05d51793643b0

Download Submit
C:\Windows\System\OjjOqge.exe

Filesize
1.6MB

MD5
16e6f18ab99a6282c424f0851c24032b

SHA1
dd4415a5e1267d2bedecd13100be0b5e3b5c2235

SHA256
90941473783179a216b17819d48aecbd1572d480f7299bb8759d5eca1d951d89

SHA512
466664107643a0480f8d7c68ee5674a8db002161e416e844c803821db479278f8f0664abc32c374dd3e2f2db047a035cf7ecf4dce156e9b26f9d4c4855ac4b2d

Download Submit
C:\Windows\System\PSLHWen.exe

Filesize
1.6MB

MD5
e7fbf139752ca3ddfaede45cf6abb145

SHA1
34158957bfd6110e0d752d85e80850be83946cde

SHA256
d97f50e82025dd5138dc4c308fbee62d4ffc0df9ed51828416f99628b607397d

SHA512
5eb529c74a8a2cb52db9786902deda61bd09818bed61b7cc77fae2e83067a8635baadd3ecf40d3d3eb02662ef54f697be0be5c4b3dd1c86a459cc9df658fb166

Download Submit
C:\Windows\System\PYdDFsf.exe

Filesize
1.6MB

MD5
c4a03285e051b6cf2e33156cf6391bd2

SHA1
f320980dbe62d6018c6094abfd4938a5143eba87

SHA256
0cb47c319a9bd423fc1534e3bc4f30baede49bea9563a84b53a9ec5738f1b34a

SHA512
a3524a177c9e2c6496776652539eb135826e9645a3622e86248668f8564006dd314b22ce74d71732a91750dc0239b7acca49181b921fd0105e5bfa955bb131a8

Download Submit
C:\Windows\System\QPxNcTG.exe

Filesize
1.6MB

MD5
d5d442d34bf25191e97802f4f43fe804

SHA1
4ad0af70905761b9f80a6fc5162079e34d5942a0

SHA256
197be589e919b4cf118233e2609b4809ca24ea1aae04e6a60cf3adc1fc62ea70

SHA512
111c0ad7483895f2a6293313d089884a7a966b0df72b83f5dbcfb160ac711d196fd85cf7b402c4e1fc204a9880528a5ee55d375c041734f06713e059aaf0930d

Download Submit
C:\Windows\System\QhlxOLf.exe

Filesize
1.6MB

MD5
ff31f7aef8fa8417ffe913f3b1211d88

SHA1
0a151ed880f03436ac3d5d1520a77ce344db21cd

SHA256
82a45453a3d1bbd33d0128b3d49cb3c70dd3cb0a9c6d38b88cf9e27ba9f14207

SHA512
3e9e1ed450ed3e3c209e4e6ad4df20f50c049080bbf3ad5f54e30de230efdae1d9881ec3aebd71fb5bd3089a867f539808d6e52ee68adb99bdfdf25bebdcfc4c

Download Submit
C:\Windows\System\VxgmdEL.exe

Filesize
1.6MB

MD5
f91aff21841e151dcf9b38d4ca036ad5

SHA1
868273b5e4b9149f98d3da6d771723b74cf56c0d

SHA256
e566cf7003a1b8d4b50f3b82370d8fc8765e7f5a3bae895b0c3c550212935554

SHA512
5e701dab7cdd1a8fc9bc3484be2194a566208605a5d321623a4be285e88d299527d8007374ae80478e000f5cbc7e6c5d315eecbc1f7e58e43ca3900478be4c26

Download Submit
C:\Windows\System\WDffcMd.exe

Filesize
1.6MB

MD5
f7b95a143f5c32c17856c691b030f25b

SHA1
15c4898cad2bb5e0040019c452a268e4593eb1d1

SHA256
2ae8776473613543458dba29e5a312322314b7dc6b9dd956bf7efcc4544f9a81

SHA512
04865244b8fe97e7b6177cc235fec370164c746689ec5d2982e230d6fbde8773b28e60bece9ddbceed20685311af0889d566127e1953f78e96c2c6b113b44bce

Download Submit
C:\Windows\System\YIpcoEH.exe

Filesize
1.6MB

MD5
b793213135f67e040d6ddbd338067107

SHA1
0af1af76f28abbc910aa3a27b44d28da19b9597a

SHA256
b594b75dcbd1a8a11edbfd5f9fd433bae791219e205e6d3b0d8548c61582dfac

SHA512
7c327a9f1d7b8301c6bb0fd286fe4ad57a6def074c7e04fb79c8416df9e6b130500e0a693c32bc7532462b48dfe917cca5fae38ad7a60449529f7d6b405d948e

Download Submit
C:\Windows\System\ZxtwzVT.exe

Filesize
1.6MB

MD5
01416d24d506491dfd548f73642d6985

SHA1
d5374be019aba788eb7c44a9a151cd49297f61f3

SHA256
221ef3ef7c74427459a311a0f84c5b4e753843d1fc842d13a97196c4b9bae718

SHA512
d023359aa23ecbf799682d0b86f2399fc70846739f3c4d2302f7a00012ff5766f31329f3bdcd511920f357290285313199b0e38b8c4ad44088acb4b9e5af1b1d

Download Submit
C:\Windows\System\arkfpXq.exe

Filesize
1.6MB

MD5
1d5ea7ea6b8be0f541827af3a9c4b06d

SHA1
1e124d35d8fca7690f2b2ed307e95ede8dc1c27d

SHA256
99db03fed64377c63abbfa3e7016ac61a3498495d06cc4fa4ce7de5119b21f61

SHA512
aa9fb1fee5e57785a3e1e168847b6f4e3aaf74c33be2bf8f55699f22aee9d05cf5912f13daff352708303fe4160746fd7b7017f58a2fd5ea31de021b660aeeb0

Download Submit
C:\Windows\System\ceXcnGx.exe

Filesize
1.6MB

MD5
cd21e461905621fd7f1d2d67968fe73b

SHA1
a8ebfdee548c6cd8b26cc79abc4e0262f11e813a

SHA256
02fe7cb882bebcb5ed7eae538b6fc3b27d6f439a21fba590c0f56c11e3ee55a1

SHA512
099afe386f1a868ec9650e310586544f7bfe5bb7318cbcf8fa1cef7324c67c63b0e201f9614631e7e05c599bbd9fdf4e3412057a5dcf3b09ea422cd7f888a4f8

Download Submit
C:\Windows\System\cyOSfaC.exe

Filesize
1.6MB

MD5
d78cd03c89ffd54ce600b0c6b2acb447

SHA1
aa92ce6c2655b4b0bf0d197c87b62cbf604500f2

SHA256
aa68ffd771506bb56a01b16207899fe7f0da71200e32508c0c551e746cbc16c8

SHA512
2b20c4437b8e8f3ea94bd7edb02c0db3ed9f08201f8da81f94c96d35debe187474f72d5aad892c270a3cc8c32550ef14e1f8e66d2d56d8bd2b1973392aeb1e72

Download Submit
C:\Windows\System\fOFHfUy.exe

Filesize
1.6MB

MD5
b771028a241cc4d130c03218c60e5665

SHA1
2c1e00c75e5cdaec1038ff701499ededbb3dc470

SHA256
d324bd8c8bf63a8fd442ecb4117133fe470361d452d9fd43aef48ba7900a7572

SHA512
1bc6609facd0480deecf2d99f7b282cc1a81aaea7a25c62ed7771a10e6e90e88a3f7a416c39f6ab5e81f89c7dca55ff70e66aca5875da8750d9b5600d11bb8e7

Download Submit
C:\Windows\System\iSMOAiB.exe

Filesize
1.6MB

MD5
9e2f3130e7bcb0936137aa159a417f6f

SHA1
6549ffcd3e9e3cbe2d5acdcefb4e9da4d43b5997

SHA256
74a119af4f2947c817a5e0f9a2ef0e7f5a8b105530081a546fabc83cecb47a3f

SHA512
6013f10f7a5d1437528c64ac61878861f99a8b2814ca9e6780e4d3d51b5669a5af86134e2baa955aba600fc3b6acfacb663bedca8a5515978f8990e5a3f5e996

Download Submit
C:\Windows\System\iUsGKxq.exe

Filesize
1.6MB

MD5
83a374d093e0b0daffc09b620165f020

SHA1
1a222d87c2dffccae8f053974fc6c39fb410b71b

SHA256
0e1b421d9c7878d197588f519e51f3c356703f17f02d5056e317f6b47c78e102

SHA512
8a7bd430f3b2596d621037133a1ba799730f445ca7cf0c6518f8de2962e2214bae95a213d62e056765fb87284f885ba296d1571451a95018c9ffa063df730b7a

Download Submit
C:\Windows\System\jWnnGCP.exe

Filesize
1.6MB

MD5
98f1a3ea1122f961c604c556f5c6093e

SHA1
d058990f949e07855b3bcb95f158c7c863622e04

SHA256
2916bbfedb235498668f6fc5d259abb40b7438e7b1590785c40cb2e408da6331

SHA512
41246b4be071085bd7fecf2bf00863fb6599d1e40a772d7a3e598eeb02a901d049d9e6c32ee4912b5b20d835c02b32d5eac73b97ed1b89a15632c254ce38339c

Download Submit
C:\Windows\System\orFUclN.exe

Filesize
1.6MB

MD5
2abfea138f5cb3dfb5dcc11c2c32100f

SHA1
32ec822b544ce03bc51321f0345a52aa4ed26171

SHA256
814c39605f5456aaae4d52e4b0ac18b93424f796d582ae710cfb8aa8e27dd1c9

SHA512
25ccd21a6a3c29dfcd49660fae5ada4e2921c2f72ca8281f305ccb47a1d8c6988cbf5d9e83fedd7b6307c68f1fd0a5a5827465e389cef58d37760ccf5297e0dc

Download Submit
C:\Windows\System\ppVbMyt.exe

Filesize
1.6MB

MD5
2c96e62eb534d0b9a0c2175d66180bf9

SHA1
1eb3ccf65f94d53698ff0a92356e46ca4cd06207

SHA256
b409138ef0f651f202a38cf711b70a0b54a7ed68719d81ac25452d049cd96acf

SHA512
4a2ad715533ffa0b491df3ff720bd45ab7a5f1254a8b2af6bdc6e87945fa67bcd0ad816dc250aa944f53eb48bf259dfbe323c9be54bf35483f909c92df49f506

Download Submit
C:\Windows\System\sSFisOW.exe

Filesize
1.6MB

MD5
5b60bd4a61cebe9a9ff923921e9e57cd

SHA1
4be0824144c6b38241a8790baca7931af338847e

SHA256
90fab229984ed0fe9bf686c33de71280b5b20e51dfa57612997b0c1d681f8077

SHA512
6f768ca15a64b684aba9c21cca11278605ca173d3570a9438610f06b8019254e2ae3128b36b9b42521064b152629edcdbb5ab950989f6048c58974fbdbd1d5c0

Download Submit
C:\Windows\System\sfsELyb.exe

Filesize
1.6MB

MD5
13cb5f48ddfa548239e2b9ed8536c5a4

SHA1
89a7fe30c7e3790b2e937505c67915fe272a93f3

SHA256
f6b8c75d2bd01424e23e41c79a5dc89eade9f54ba9d624ffd14d4f4b04fab9f7

SHA512
668ed1ce4e238c2228ba12c02776ff2fc3a51ef64543d383e09e4852e0d352facefd3ba7b22eaf71349207400e7761380034c1428fe9490d5711636aab6298eb

Download Submit
C:\Windows\System\vgNDtzK.exe

Filesize
1.6MB

MD5
fd7757d59d9c174e97ffac15028cbdec

SHA1
093e61fce6f2030674c76b36e194340d31531455

SHA256
3a72c951111a4398db301ca0f5f2a55bc7ac3253511a3e36e927f61fc9999e08

SHA512
e6fe41f275915b65d6d0334aa35ae4a13eca48609862035329b65563ae0007ad299cd32de487f3524b598eee59a1c77367b11f22fa7250f41fe682ec68b4acc8

Download Submit
C:\Windows\System\xwKYotp.exe

Filesize
1.6MB

MD5
225beee203fcff63810bf99d7f42c2f2

SHA1
e3d54ec1a067ea46348ddc4d835673604bc90a53

SHA256
df7c65abd0f790036d2eced397f0945c052815275e5fc4c430ec9a250531234a

SHA512
db5785f52e5bce620ab9297944ba4cb6bf928e9a28356e0e62f3a95c6d37ccc9d0dd800052ad80884cf72ddd8bd07d31a6685cb7f8bd2d70737fc981fc6a5c0f

Download Submit
memory/2304-0-0x0000027549C80000-0x0000027549C90000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads