xmrig | d2e4f51d39c56f1cc22d42fc764627014ebf046ce69aef559c9fb5c03f0cf43f

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
18-12-2024 05:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d2e4f51d39c56f1cc22d42fc764627014ebf046ce69aef559c9fb5c03f0cf43f.exe
Size

1.4MB
MD5

da8ced58b8224acf17a34afd1df96d05
SHA1

3c52e4d138d94b2a74d757a80361261b849fe231
SHA256

d2e4f51d39c56f1cc22d42fc764627014ebf046ce69aef559c9fb5c03f0cf43f
SHA512

21fa59e0276375ea4ef404d0937b61e5a7b9823ead37a92914fe263fd1a7357b29a6b87f082ff8a7fdff069c3db993ad1477ad449ad5957b84f7a78841efed01
SSDEEP

24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbpwlKenszbWKDNEm/5ph70VwyM9a:GezaTF8FcNkNdfE0pZ9ozttwIRx2VQ9a

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 32 IoCs

miner

resource	yara_rule
behavioral2/files/0x000c000000023b93-4.dat	xmrig
behavioral2/files/0x0008000000023c82-9.dat	xmrig
behavioral2/files/0x0007000000023c86-7.dat	xmrig
behavioral2/files/0x0007000000023c87-19.dat	xmrig
behavioral2/files/0x0007000000023c88-28.dat	xmrig
behavioral2/files/0x0007000000023c89-32.dat	xmrig
behavioral2/files/0x0007000000023c92-71.dat	xmrig
behavioral2/files/0x0007000000023c96-89.dat	xmrig
behavioral2/files/0x0007000000023c97-135.dat	xmrig
behavioral2/files/0x0007000000023ca0-154.dat	xmrig
behavioral2/files/0x0007000000023ca3-160.dat	xmrig
behavioral2/files/0x0007000000023ca2-158.dat	xmrig
behavioral2/files/0x0007000000023ca1-156.dat	xmrig
behavioral2/files/0x0007000000023c9f-152.dat	xmrig
behavioral2/files/0x0007000000023c9e-150.dat	xmrig
behavioral2/files/0x0007000000023c9d-148.dat	xmrig
behavioral2/files/0x0007000000023c9c-146.dat	xmrig
behavioral2/files/0x0007000000023c9b-143.dat	xmrig
behavioral2/files/0x0007000000023c9a-141.dat	xmrig
behavioral2/files/0x0007000000023c99-139.dat	xmrig
behavioral2/files/0x0007000000023c98-137.dat	xmrig
behavioral2/files/0x0007000000023c95-127.dat	xmrig
behavioral2/files/0x0007000000023c94-124.dat	xmrig
behavioral2/files/0x0007000000023c93-117.dat	xmrig
behavioral2/files/0x0007000000023c91-97.dat	xmrig
behavioral2/files/0x0007000000023c90-94.dat	xmrig
behavioral2/files/0x0007000000023c8f-84.dat	xmrig
behavioral2/files/0x0007000000023c8e-76.dat	xmrig
behavioral2/files/0x0007000000023c8d-66.dat	xmrig
behavioral2/files/0x0007000000023c8c-59.dat	xmrig
behavioral2/files/0x0007000000023c8a-47.dat	xmrig
behavioral2/files/0x0007000000023c8b-55.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
1068	kDqyzHk.exe
2344	rGZDNKh.exe
2756	mVIdsjN.exe
2100	uvzPftG.exe
1940	ZIcqeJn.exe
400	XqqgDWm.exe
1716	gaCMtXi.exe
2096	KEefMCC.exe
2536	hUFVBdb.exe
4900	FXoDtMO.exe
3168	ubrHZeu.exe
2600	XOkWXzh.exe
3852	fgFXJfT.exe
3476	vgbIgkV.exe
4084	ciZDdJY.exe
3628	tKYHNZS.exe
1136	nUyurrh.exe
2124	mViPBuS.exe
1724	xILiUBW.exe
1872	ilixFrQ.exe
3592	rCKMyDE.exe
3600	BiatVha.exe
3188	XbpgXcM.exe
4888	oKPnKUd.exe
3104	sQbzXej.exe
4520	ZbsGCVk.exe
1856	EdbqDAt.exe
2068	XDKbQDK.exe
3944	yixzqaA.exe
5056	uebViEZ.exe
3828	RdtPMeM.exe
4156	poTNOcj.exe
864	nRAlwjX.exe
2192	aPULZDu.exe
4268	odaaMBZ.exe
1264	WrmiGrf.exe
4852	AmqyCcs.exe
640	nhKhlaJ.exe
3596	YbPlVCe.exe
2020	hqsQlYf.exe
1696	TGXhORN.exe
1412	PIBcTwx.exe
4672	hbCTKeN.exe
3352	LduWPUl.exe
5108	zILIqaW.exe
3240	vfglwhb.exe
2872	YBvmmKI.exe
4480	KkdgYSC.exe
1464	rIZdfit.exe
1376	gxLORgY.exe
4076	mdvcvZx.exe
3816	LYLyIhd.exe
1792	qPEXxeg.exe
4428	GjznKBK.exe
2352	aflCrKM.exe
4736	RLmcNfY.exe
1132	MbiijYu.exe
8	iePeGBx.exe
5004	iDVoObK.exe
2208	EHGWjin.exe
672	KKPYUKp.exe
856	hMsWPRI.exe
868	eWJmofu.exe
4776	rRnxTZC.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\WAxdjlA.exe	d2e4f51d39c56f1cc22d42fc764627014ebf046ce69aef559c9fb5c03f0cf43f.exe
File created	C:\Windows\System\RTRZeeu.exe	d2e4f51d39c56f1cc22d42fc764627014ebf046ce69aef559c9fb5c03f0cf43f.exe
File created	C:\Windows\System\oUWHaxn.exe	d2e4f51d39c56f1cc22d42fc764627014ebf046ce69aef559c9fb5c03f0cf43f.exe
File created	C:\Windows\System\zAGIkXa.exe	d2e4f51d39c56f1cc22d42fc764627014ebf046ce69aef559c9fb5c03f0cf43f.exe
File created	C:\Windows\System\aJihVvy.exe	d2e4f51d39c56f1cc22d42fc764627014ebf046ce69aef559c9fb5c03f0cf43f.exe
File created	C:\Windows\System\ZatyiLC.exe	d2e4f51d39c56f1cc22d42fc764627014ebf046ce69aef559c9fb5c03f0cf43f.exe
File created	C:\Windows\System\ghwvSsH.exe	d2e4f51d39c56f1cc22d42fc764627014ebf046ce69aef559c9fb5c03f0cf43f.exe
File created	C:\Windows\System\VOAnHgo.exe	d2e4f51d39c56f1cc22d42fc764627014ebf046ce69aef559c9fb5c03f0cf43f.exe
File created	C:\Windows\System\OukUlGY.exe	d2e4f51d39c56f1cc22d42fc764627014ebf046ce69aef559c9fb5c03f0cf43f.exe
File created	C:\Windows\System\piWtBeS.exe	d2e4f51d39c56f1cc22d42fc764627014ebf046ce69aef559c9fb5c03f0cf43f.exe
File created	C:\Windows\System\JSJlyJa.exe	d2e4f51d39c56f1cc22d42fc764627014ebf046ce69aef559c9fb5c03f0cf43f.exe
File created	C:\Windows\System\YWNFZXD.exe	d2e4f51d39c56f1cc22d42fc764627014ebf046ce69aef559c9fb5c03f0cf43f.exe
File created	C:\Windows\System\lHBTuHu.exe	d2e4f51d39c56f1cc22d42fc764627014ebf046ce69aef559c9fb5c03f0cf43f.exe
File created	C:\Windows\System\oIYTCOo.exe	d2e4f51d39c56f1cc22d42fc764627014ebf046ce69aef559c9fb5c03f0cf43f.exe
File created	C:\Windows\System\bnKaoCW.exe	d2e4f51d39c56f1cc22d42fc764627014ebf046ce69aef559c9fb5c03f0cf43f.exe
File created	C:\Windows\System\VLxkPKT.exe	d2e4f51d39c56f1cc22d42fc764627014ebf046ce69aef559c9fb5c03f0cf43f.exe
File created	C:\Windows\System\ifIrtvl.exe	d2e4f51d39c56f1cc22d42fc764627014ebf046ce69aef559c9fb5c03f0cf43f.exe
File created	C:\Windows\System\AYbXQVR.exe	d2e4f51d39c56f1cc22d42fc764627014ebf046ce69aef559c9fb5c03f0cf43f.exe
File created	C:\Windows\System\zhxpYYX.exe	d2e4f51d39c56f1cc22d42fc764627014ebf046ce69aef559c9fb5c03f0cf43f.exe
File created	C:\Windows\System\qZZwqiZ.exe	d2e4f51d39c56f1cc22d42fc764627014ebf046ce69aef559c9fb5c03f0cf43f.exe
File created	C:\Windows\System\oUtHkGZ.exe	d2e4f51d39c56f1cc22d42fc764627014ebf046ce69aef559c9fb5c03f0cf43f.exe
File created	C:\Windows\System\mHfRvtm.exe	d2e4f51d39c56f1cc22d42fc764627014ebf046ce69aef559c9fb5c03f0cf43f.exe
File created	C:\Windows\System\qBtOBQn.exe	d2e4f51d39c56f1cc22d42fc764627014ebf046ce69aef559c9fb5c03f0cf43f.exe
File created	C:\Windows\System\bMsURFy.exe	d2e4f51d39c56f1cc22d42fc764627014ebf046ce69aef559c9fb5c03f0cf43f.exe
File created	C:\Windows\System\uNICaUn.exe	d2e4f51d39c56f1cc22d42fc764627014ebf046ce69aef559c9fb5c03f0cf43f.exe
File created	C:\Windows\System\fqoRtvZ.exe	d2e4f51d39c56f1cc22d42fc764627014ebf046ce69aef559c9fb5c03f0cf43f.exe
File created	C:\Windows\System\WdvIbjy.exe	d2e4f51d39c56f1cc22d42fc764627014ebf046ce69aef559c9fb5c03f0cf43f.exe
File created	C:\Windows\System\FYrfBQx.exe	d2e4f51d39c56f1cc22d42fc764627014ebf046ce69aef559c9fb5c03f0cf43f.exe
File created	C:\Windows\System\dcHUMEm.exe	d2e4f51d39c56f1cc22d42fc764627014ebf046ce69aef559c9fb5c03f0cf43f.exe
File created	C:\Windows\System\gXumuga.exe	d2e4f51d39c56f1cc22d42fc764627014ebf046ce69aef559c9fb5c03f0cf43f.exe
File created	C:\Windows\System\RrYxcFE.exe	d2e4f51d39c56f1cc22d42fc764627014ebf046ce69aef559c9fb5c03f0cf43f.exe
File created	C:\Windows\System\qdAJiMV.exe	d2e4f51d39c56f1cc22d42fc764627014ebf046ce69aef559c9fb5c03f0cf43f.exe
File created	C:\Windows\System\rLGCjyj.exe	d2e4f51d39c56f1cc22d42fc764627014ebf046ce69aef559c9fb5c03f0cf43f.exe
File created	C:\Windows\System\dmsONDk.exe	d2e4f51d39c56f1cc22d42fc764627014ebf046ce69aef559c9fb5c03f0cf43f.exe
File created	C:\Windows\System\EBbKfTd.exe	d2e4f51d39c56f1cc22d42fc764627014ebf046ce69aef559c9fb5c03f0cf43f.exe
File created	C:\Windows\System\BxpqNcC.exe	d2e4f51d39c56f1cc22d42fc764627014ebf046ce69aef559c9fb5c03f0cf43f.exe
File created	C:\Windows\System\daBcrgP.exe	d2e4f51d39c56f1cc22d42fc764627014ebf046ce69aef559c9fb5c03f0cf43f.exe
File created	C:\Windows\System\VXuASlo.exe	d2e4f51d39c56f1cc22d42fc764627014ebf046ce69aef559c9fb5c03f0cf43f.exe
File created	C:\Windows\System\VpOAOEp.exe	d2e4f51d39c56f1cc22d42fc764627014ebf046ce69aef559c9fb5c03f0cf43f.exe
File created	C:\Windows\System\DqDpMOU.exe	d2e4f51d39c56f1cc22d42fc764627014ebf046ce69aef559c9fb5c03f0cf43f.exe
File created	C:\Windows\System\MvUwqkV.exe	d2e4f51d39c56f1cc22d42fc764627014ebf046ce69aef559c9fb5c03f0cf43f.exe
File created	C:\Windows\System\rhJIJsU.exe	d2e4f51d39c56f1cc22d42fc764627014ebf046ce69aef559c9fb5c03f0cf43f.exe
File created	C:\Windows\System\gfxGJCp.exe	d2e4f51d39c56f1cc22d42fc764627014ebf046ce69aef559c9fb5c03f0cf43f.exe
File created	C:\Windows\System\lwVjhsl.exe	d2e4f51d39c56f1cc22d42fc764627014ebf046ce69aef559c9fb5c03f0cf43f.exe
File created	C:\Windows\System\dVXpzhf.exe	d2e4f51d39c56f1cc22d42fc764627014ebf046ce69aef559c9fb5c03f0cf43f.exe
File created	C:\Windows\System\GgUIDlA.exe	d2e4f51d39c56f1cc22d42fc764627014ebf046ce69aef559c9fb5c03f0cf43f.exe
File created	C:\Windows\System\AsWkUdx.exe	d2e4f51d39c56f1cc22d42fc764627014ebf046ce69aef559c9fb5c03f0cf43f.exe
File created	C:\Windows\System\dwCWzTx.exe	d2e4f51d39c56f1cc22d42fc764627014ebf046ce69aef559c9fb5c03f0cf43f.exe
File created	C:\Windows\System\OLWaUzJ.exe	d2e4f51d39c56f1cc22d42fc764627014ebf046ce69aef559c9fb5c03f0cf43f.exe
File created	C:\Windows\System\HIZePkZ.exe	d2e4f51d39c56f1cc22d42fc764627014ebf046ce69aef559c9fb5c03f0cf43f.exe
File created	C:\Windows\System\JUzFVBI.exe	d2e4f51d39c56f1cc22d42fc764627014ebf046ce69aef559c9fb5c03f0cf43f.exe
File created	C:\Windows\System\yMhVOHS.exe	d2e4f51d39c56f1cc22d42fc764627014ebf046ce69aef559c9fb5c03f0cf43f.exe
File created	C:\Windows\System\hlrSpiH.exe	d2e4f51d39c56f1cc22d42fc764627014ebf046ce69aef559c9fb5c03f0cf43f.exe
File created	C:\Windows\System\azXOJuW.exe	d2e4f51d39c56f1cc22d42fc764627014ebf046ce69aef559c9fb5c03f0cf43f.exe
File created	C:\Windows\System\JDOZxEQ.exe	d2e4f51d39c56f1cc22d42fc764627014ebf046ce69aef559c9fb5c03f0cf43f.exe
File created	C:\Windows\System\WSbbNyU.exe	d2e4f51d39c56f1cc22d42fc764627014ebf046ce69aef559c9fb5c03f0cf43f.exe
File created	C:\Windows\System\RfuPZFL.exe	d2e4f51d39c56f1cc22d42fc764627014ebf046ce69aef559c9fb5c03f0cf43f.exe
File created	C:\Windows\System\LUmnqQf.exe	d2e4f51d39c56f1cc22d42fc764627014ebf046ce69aef559c9fb5c03f0cf43f.exe
File created	C:\Windows\System\brFNRZx.exe	d2e4f51d39c56f1cc22d42fc764627014ebf046ce69aef559c9fb5c03f0cf43f.exe
File created	C:\Windows\System\egdvNjm.exe	d2e4f51d39c56f1cc22d42fc764627014ebf046ce69aef559c9fb5c03f0cf43f.exe
File created	C:\Windows\System\jaOmtcp.exe	d2e4f51d39c56f1cc22d42fc764627014ebf046ce69aef559c9fb5c03f0cf43f.exe
File created	C:\Windows\System\DUJriGc.exe	d2e4f51d39c56f1cc22d42fc764627014ebf046ce69aef559c9fb5c03f0cf43f.exe
File created	C:\Windows\System\YyGfNND.exe	d2e4f51d39c56f1cc22d42fc764627014ebf046ce69aef559c9fb5c03f0cf43f.exe
File created	C:\Windows\System\ckqcAmY.exe	d2e4f51d39c56f1cc22d42fc764627014ebf046ce69aef559c9fb5c03f0cf43f.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	16468	dwm.exe
Token: SeChangeNotifyPrivilege	16468	dwm.exe
Token: 33	16468	dwm.exe
Token: SeIncBasePriorityPrivilege	16468	dwm.exe
Token: SeShutdownPrivilege	16468	dwm.exe
Token: SeCreatePagefilePrivilege	16468	dwm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4844 wrote to memory of 1068	4844	d2e4f51d39c56f1cc22d42fc764627014ebf046ce69aef559c9fb5c03f0cf43f.exe	84
PID 4844 wrote to memory of 1068	4844	d2e4f51d39c56f1cc22d42fc764627014ebf046ce69aef559c9fb5c03f0cf43f.exe	84
PID 4844 wrote to memory of 2344	4844	d2e4f51d39c56f1cc22d42fc764627014ebf046ce69aef559c9fb5c03f0cf43f.exe	85
PID 4844 wrote to memory of 2344	4844	d2e4f51d39c56f1cc22d42fc764627014ebf046ce69aef559c9fb5c03f0cf43f.exe	85
PID 4844 wrote to memory of 2756	4844	d2e4f51d39c56f1cc22d42fc764627014ebf046ce69aef559c9fb5c03f0cf43f.exe	86
PID 4844 wrote to memory of 2756	4844	d2e4f51d39c56f1cc22d42fc764627014ebf046ce69aef559c9fb5c03f0cf43f.exe	86
PID 4844 wrote to memory of 2100	4844	d2e4f51d39c56f1cc22d42fc764627014ebf046ce69aef559c9fb5c03f0cf43f.exe	87
PID 4844 wrote to memory of 2100	4844	d2e4f51d39c56f1cc22d42fc764627014ebf046ce69aef559c9fb5c03f0cf43f.exe	87
PID 4844 wrote to memory of 1940	4844	d2e4f51d39c56f1cc22d42fc764627014ebf046ce69aef559c9fb5c03f0cf43f.exe	88
PID 4844 wrote to memory of 1940	4844	d2e4f51d39c56f1cc22d42fc764627014ebf046ce69aef559c9fb5c03f0cf43f.exe	88
PID 4844 wrote to memory of 400	4844	d2e4f51d39c56f1cc22d42fc764627014ebf046ce69aef559c9fb5c03f0cf43f.exe	89
PID 4844 wrote to memory of 400	4844	d2e4f51d39c56f1cc22d42fc764627014ebf046ce69aef559c9fb5c03f0cf43f.exe	89
PID 4844 wrote to memory of 1716	4844	d2e4f51d39c56f1cc22d42fc764627014ebf046ce69aef559c9fb5c03f0cf43f.exe	90
PID 4844 wrote to memory of 1716	4844	d2e4f51d39c56f1cc22d42fc764627014ebf046ce69aef559c9fb5c03f0cf43f.exe	90
PID 4844 wrote to memory of 2096	4844	d2e4f51d39c56f1cc22d42fc764627014ebf046ce69aef559c9fb5c03f0cf43f.exe	91
PID 4844 wrote to memory of 2096	4844	d2e4f51d39c56f1cc22d42fc764627014ebf046ce69aef559c9fb5c03f0cf43f.exe	91
PID 4844 wrote to memory of 2536	4844	d2e4f51d39c56f1cc22d42fc764627014ebf046ce69aef559c9fb5c03f0cf43f.exe	92
PID 4844 wrote to memory of 2536	4844	d2e4f51d39c56f1cc22d42fc764627014ebf046ce69aef559c9fb5c03f0cf43f.exe	92
PID 4844 wrote to memory of 4900	4844	d2e4f51d39c56f1cc22d42fc764627014ebf046ce69aef559c9fb5c03f0cf43f.exe	93
PID 4844 wrote to memory of 4900	4844	d2e4f51d39c56f1cc22d42fc764627014ebf046ce69aef559c9fb5c03f0cf43f.exe	93
PID 4844 wrote to memory of 3168	4844	d2e4f51d39c56f1cc22d42fc764627014ebf046ce69aef559c9fb5c03f0cf43f.exe	94
PID 4844 wrote to memory of 3168	4844	d2e4f51d39c56f1cc22d42fc764627014ebf046ce69aef559c9fb5c03f0cf43f.exe	94
PID 4844 wrote to memory of 2600	4844	d2e4f51d39c56f1cc22d42fc764627014ebf046ce69aef559c9fb5c03f0cf43f.exe	95
PID 4844 wrote to memory of 2600	4844	d2e4f51d39c56f1cc22d42fc764627014ebf046ce69aef559c9fb5c03f0cf43f.exe	95
PID 4844 wrote to memory of 3852	4844	d2e4f51d39c56f1cc22d42fc764627014ebf046ce69aef559c9fb5c03f0cf43f.exe	96
PID 4844 wrote to memory of 3852	4844	d2e4f51d39c56f1cc22d42fc764627014ebf046ce69aef559c9fb5c03f0cf43f.exe	96
PID 4844 wrote to memory of 3476	4844	d2e4f51d39c56f1cc22d42fc764627014ebf046ce69aef559c9fb5c03f0cf43f.exe	97
PID 4844 wrote to memory of 3476	4844	d2e4f51d39c56f1cc22d42fc764627014ebf046ce69aef559c9fb5c03f0cf43f.exe	97
PID 4844 wrote to memory of 4084	4844	d2e4f51d39c56f1cc22d42fc764627014ebf046ce69aef559c9fb5c03f0cf43f.exe	98
PID 4844 wrote to memory of 4084	4844	d2e4f51d39c56f1cc22d42fc764627014ebf046ce69aef559c9fb5c03f0cf43f.exe	98
PID 4844 wrote to memory of 3628	4844	d2e4f51d39c56f1cc22d42fc764627014ebf046ce69aef559c9fb5c03f0cf43f.exe	99
PID 4844 wrote to memory of 3628	4844	d2e4f51d39c56f1cc22d42fc764627014ebf046ce69aef559c9fb5c03f0cf43f.exe	99
PID 4844 wrote to memory of 1136	4844	d2e4f51d39c56f1cc22d42fc764627014ebf046ce69aef559c9fb5c03f0cf43f.exe	100
PID 4844 wrote to memory of 1136	4844	d2e4f51d39c56f1cc22d42fc764627014ebf046ce69aef559c9fb5c03f0cf43f.exe	100
PID 4844 wrote to memory of 2124	4844	d2e4f51d39c56f1cc22d42fc764627014ebf046ce69aef559c9fb5c03f0cf43f.exe	101
PID 4844 wrote to memory of 2124	4844	d2e4f51d39c56f1cc22d42fc764627014ebf046ce69aef559c9fb5c03f0cf43f.exe	101
PID 4844 wrote to memory of 1724	4844	d2e4f51d39c56f1cc22d42fc764627014ebf046ce69aef559c9fb5c03f0cf43f.exe	102
PID 4844 wrote to memory of 1724	4844	d2e4f51d39c56f1cc22d42fc764627014ebf046ce69aef559c9fb5c03f0cf43f.exe	102
PID 4844 wrote to memory of 1872	4844	d2e4f51d39c56f1cc22d42fc764627014ebf046ce69aef559c9fb5c03f0cf43f.exe	103
PID 4844 wrote to memory of 1872	4844	d2e4f51d39c56f1cc22d42fc764627014ebf046ce69aef559c9fb5c03f0cf43f.exe	103
PID 4844 wrote to memory of 3592	4844	d2e4f51d39c56f1cc22d42fc764627014ebf046ce69aef559c9fb5c03f0cf43f.exe	104
PID 4844 wrote to memory of 3592	4844	d2e4f51d39c56f1cc22d42fc764627014ebf046ce69aef559c9fb5c03f0cf43f.exe	104
PID 4844 wrote to memory of 3600	4844	d2e4f51d39c56f1cc22d42fc764627014ebf046ce69aef559c9fb5c03f0cf43f.exe	105
PID 4844 wrote to memory of 3600	4844	d2e4f51d39c56f1cc22d42fc764627014ebf046ce69aef559c9fb5c03f0cf43f.exe	105
PID 4844 wrote to memory of 3188	4844	d2e4f51d39c56f1cc22d42fc764627014ebf046ce69aef559c9fb5c03f0cf43f.exe	106
PID 4844 wrote to memory of 3188	4844	d2e4f51d39c56f1cc22d42fc764627014ebf046ce69aef559c9fb5c03f0cf43f.exe	106
PID 4844 wrote to memory of 4888	4844	d2e4f51d39c56f1cc22d42fc764627014ebf046ce69aef559c9fb5c03f0cf43f.exe	107
PID 4844 wrote to memory of 4888	4844	d2e4f51d39c56f1cc22d42fc764627014ebf046ce69aef559c9fb5c03f0cf43f.exe	107
PID 4844 wrote to memory of 3104	4844	d2e4f51d39c56f1cc22d42fc764627014ebf046ce69aef559c9fb5c03f0cf43f.exe	108
PID 4844 wrote to memory of 3104	4844	d2e4f51d39c56f1cc22d42fc764627014ebf046ce69aef559c9fb5c03f0cf43f.exe	108
PID 4844 wrote to memory of 4520	4844	d2e4f51d39c56f1cc22d42fc764627014ebf046ce69aef559c9fb5c03f0cf43f.exe	109
PID 4844 wrote to memory of 4520	4844	d2e4f51d39c56f1cc22d42fc764627014ebf046ce69aef559c9fb5c03f0cf43f.exe	109
PID 4844 wrote to memory of 1856	4844	d2e4f51d39c56f1cc22d42fc764627014ebf046ce69aef559c9fb5c03f0cf43f.exe	110
PID 4844 wrote to memory of 1856	4844	d2e4f51d39c56f1cc22d42fc764627014ebf046ce69aef559c9fb5c03f0cf43f.exe	110
PID 4844 wrote to memory of 2068	4844	d2e4f51d39c56f1cc22d42fc764627014ebf046ce69aef559c9fb5c03f0cf43f.exe	111
PID 4844 wrote to memory of 2068	4844	d2e4f51d39c56f1cc22d42fc764627014ebf046ce69aef559c9fb5c03f0cf43f.exe	111
PID 4844 wrote to memory of 3944	4844	d2e4f51d39c56f1cc22d42fc764627014ebf046ce69aef559c9fb5c03f0cf43f.exe	112
PID 4844 wrote to memory of 3944	4844	d2e4f51d39c56f1cc22d42fc764627014ebf046ce69aef559c9fb5c03f0cf43f.exe	112
PID 4844 wrote to memory of 5056	4844	d2e4f51d39c56f1cc22d42fc764627014ebf046ce69aef559c9fb5c03f0cf43f.exe	113
PID 4844 wrote to memory of 5056	4844	d2e4f51d39c56f1cc22d42fc764627014ebf046ce69aef559c9fb5c03f0cf43f.exe	113
PID 4844 wrote to memory of 3828	4844	d2e4f51d39c56f1cc22d42fc764627014ebf046ce69aef559c9fb5c03f0cf43f.exe	114
PID 4844 wrote to memory of 3828	4844	d2e4f51d39c56f1cc22d42fc764627014ebf046ce69aef559c9fb5c03f0cf43f.exe	114
PID 4844 wrote to memory of 4156	4844	d2e4f51d39c56f1cc22d42fc764627014ebf046ce69aef559c9fb5c03f0cf43f.exe	115
PID 4844 wrote to memory of 4156	4844	d2e4f51d39c56f1cc22d42fc764627014ebf046ce69aef559c9fb5c03f0cf43f.exe	115

C:\Users\Admin\AppData\Local\Temp\d2e4f51d39c56f1cc22d42fc764627014ebf046ce69aef559c9fb5c03f0cf43f.exe
"C:\Users\Admin\AppData\Local\Temp\d2e4f51d39c56f1cc22d42fc764627014ebf046ce69aef559c9fb5c03f0cf43f.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4844
- C:\Windows\System\kDqyzHk.exe
  C:\Windows\System\kDqyzHk.exe
  2⤵
  - Executes dropped EXE
  PID:1068
- C:\Windows\System\rGZDNKh.exe
  C:\Windows\System\rGZDNKh.exe
  2⤵
  - Executes dropped EXE
  PID:2344
- C:\Windows\System\mVIdsjN.exe
  C:\Windows\System\mVIdsjN.exe
  2⤵
  - Executes dropped EXE
  PID:2756
- C:\Windows\System\uvzPftG.exe
  C:\Windows\System\uvzPftG.exe
  2⤵
  - Executes dropped EXE
  PID:2100
- C:\Windows\System\ZIcqeJn.exe
  C:\Windows\System\ZIcqeJn.exe
  2⤵
  - Executes dropped EXE
  PID:1940
- C:\Windows\System\XqqgDWm.exe
  C:\Windows\System\XqqgDWm.exe
  2⤵
  - Executes dropped EXE
  PID:400
- C:\Windows\System\gaCMtXi.exe
  C:\Windows\System\gaCMtXi.exe
  2⤵
  - Executes dropped EXE
  PID:1716
- C:\Windows\System\KEefMCC.exe
  C:\Windows\System\KEefMCC.exe
  2⤵
  - Executes dropped EXE
  PID:2096
- C:\Windows\System\hUFVBdb.exe
  C:\Windows\System\hUFVBdb.exe
  2⤵
  - Executes dropped EXE
  PID:2536
- C:\Windows\System\FXoDtMO.exe
  C:\Windows\System\FXoDtMO.exe
  2⤵
  - Executes dropped EXE
  PID:4900
- C:\Windows\System\ubrHZeu.exe
  C:\Windows\System\ubrHZeu.exe
  2⤵
  - Executes dropped EXE
  PID:3168
- C:\Windows\System\XOkWXzh.exe
  C:\Windows\System\XOkWXzh.exe
  2⤵
  - Executes dropped EXE
  PID:2600
- C:\Windows\System\fgFXJfT.exe
  C:\Windows\System\fgFXJfT.exe
  2⤵
  - Executes dropped EXE
  PID:3852
- C:\Windows\System\vgbIgkV.exe
  C:\Windows\System\vgbIgkV.exe
  2⤵
  - Executes dropped EXE
  PID:3476
- C:\Windows\System\ciZDdJY.exe
  C:\Windows\System\ciZDdJY.exe
  2⤵
  - Executes dropped EXE
  PID:4084
- C:\Windows\System\tKYHNZS.exe
  C:\Windows\System\tKYHNZS.exe
  2⤵
  - Executes dropped EXE
  PID:3628
- C:\Windows\System\nUyurrh.exe
  C:\Windows\System\nUyurrh.exe
  2⤵
  - Executes dropped EXE
  PID:1136
- C:\Windows\System\mViPBuS.exe
  C:\Windows\System\mViPBuS.exe
  2⤵
  - Executes dropped EXE
  PID:2124
- C:\Windows\System\xILiUBW.exe
  C:\Windows\System\xILiUBW.exe
  2⤵
  - Executes dropped EXE
  PID:1724
- C:\Windows\System\ilixFrQ.exe
  C:\Windows\System\ilixFrQ.exe
  2⤵
  - Executes dropped EXE
  PID:1872
- C:\Windows\System\rCKMyDE.exe
  C:\Windows\System\rCKMyDE.exe
  2⤵
  - Executes dropped EXE
  PID:3592
- C:\Windows\System\BiatVha.exe
  C:\Windows\System\BiatVha.exe
  2⤵
  - Executes dropped EXE
  PID:3600
- C:\Windows\System\XbpgXcM.exe
  C:\Windows\System\XbpgXcM.exe
  2⤵
  - Executes dropped EXE
  PID:3188
- C:\Windows\System\oKPnKUd.exe
  C:\Windows\System\oKPnKUd.exe
  2⤵
  - Executes dropped EXE
  PID:4888
- C:\Windows\System\sQbzXej.exe
  C:\Windows\System\sQbzXej.exe
  2⤵
  - Executes dropped EXE
  PID:3104
- C:\Windows\System\ZbsGCVk.exe
  C:\Windows\System\ZbsGCVk.exe
  2⤵
  - Executes dropped EXE
  PID:4520
- C:\Windows\System\EdbqDAt.exe
  C:\Windows\System\EdbqDAt.exe
  2⤵
  - Executes dropped EXE
  PID:1856
- C:\Windows\System\XDKbQDK.exe
  C:\Windows\System\XDKbQDK.exe
  2⤵
  - Executes dropped EXE
  PID:2068
- C:\Windows\System\yixzqaA.exe
  C:\Windows\System\yixzqaA.exe
  2⤵
  - Executes dropped EXE
  PID:3944
- C:\Windows\System\uebViEZ.exe
  C:\Windows\System\uebViEZ.exe
  2⤵
  - Executes dropped EXE
  PID:5056
- C:\Windows\System\RdtPMeM.exe
  C:\Windows\System\RdtPMeM.exe
  2⤵
  - Executes dropped EXE
  PID:3828
- C:\Windows\System\poTNOcj.exe
  C:\Windows\System\poTNOcj.exe
  2⤵
  - Executes dropped EXE
  PID:4156
- C:\Windows\System\nRAlwjX.exe
  C:\Windows\System\nRAlwjX.exe
  2⤵
  - Executes dropped EXE
  PID:864
- C:\Windows\System\aPULZDu.exe
  C:\Windows\System\aPULZDu.exe
  2⤵
  - Executes dropped EXE
  PID:2192
- C:\Windows\System\odaaMBZ.exe
  C:\Windows\System\odaaMBZ.exe
  2⤵
  - Executes dropped EXE
  PID:4268
- C:\Windows\System\WrmiGrf.exe
  C:\Windows\System\WrmiGrf.exe
  2⤵
  - Executes dropped EXE
  PID:1264
- C:\Windows\System\AmqyCcs.exe
  C:\Windows\System\AmqyCcs.exe
  2⤵
  - Executes dropped EXE
  PID:4852
- C:\Windows\System\nhKhlaJ.exe
  C:\Windows\System\nhKhlaJ.exe
  2⤵
  - Executes dropped EXE
  PID:640
- C:\Windows\System\YbPlVCe.exe
  C:\Windows\System\YbPlVCe.exe
  2⤵
  - Executes dropped EXE
  PID:3596
- C:\Windows\System\hqsQlYf.exe
  C:\Windows\System\hqsQlYf.exe
  2⤵
  - Executes dropped EXE
  PID:2020
- C:\Windows\System\TGXhORN.exe
  C:\Windows\System\TGXhORN.exe
  2⤵
  - Executes dropped EXE
  PID:1696
- C:\Windows\System\PIBcTwx.exe
  C:\Windows\System\PIBcTwx.exe
  2⤵
  - Executes dropped EXE
  PID:1412
- C:\Windows\System\hbCTKeN.exe
  C:\Windows\System\hbCTKeN.exe
  2⤵
  - Executes dropped EXE
  PID:4672
- C:\Windows\System\LduWPUl.exe
  C:\Windows\System\LduWPUl.exe
  2⤵
  - Executes dropped EXE
  PID:3352
- C:\Windows\System\zILIqaW.exe
  C:\Windows\System\zILIqaW.exe
  2⤵
  - Executes dropped EXE
  PID:5108
- C:\Windows\System\vfglwhb.exe
  C:\Windows\System\vfglwhb.exe
  2⤵
  - Executes dropped EXE
  PID:3240
- C:\Windows\System\YBvmmKI.exe
  C:\Windows\System\YBvmmKI.exe
  2⤵
  - Executes dropped EXE
  PID:2872
- C:\Windows\System\KkdgYSC.exe
  C:\Windows\System\KkdgYSC.exe
  2⤵
  - Executes dropped EXE
  PID:4480
- C:\Windows\System\rIZdfit.exe
  C:\Windows\System\rIZdfit.exe
  2⤵
  - Executes dropped EXE
  PID:1464
- C:\Windows\System\gxLORgY.exe
  C:\Windows\System\gxLORgY.exe
  2⤵
  - Executes dropped EXE
  PID:1376
- C:\Windows\System\mdvcvZx.exe
  C:\Windows\System\mdvcvZx.exe
  2⤵
  - Executes dropped EXE
  PID:4076
- C:\Windows\System\LYLyIhd.exe
  C:\Windows\System\LYLyIhd.exe
  2⤵
  - Executes dropped EXE
  PID:3816
- C:\Windows\System\qPEXxeg.exe
  C:\Windows\System\qPEXxeg.exe
  2⤵
  - Executes dropped EXE
  PID:1792
- C:\Windows\System\GjznKBK.exe
  C:\Windows\System\GjznKBK.exe
  2⤵
  - Executes dropped EXE
  PID:4428
- C:\Windows\System\aflCrKM.exe
  C:\Windows\System\aflCrKM.exe
  2⤵
  - Executes dropped EXE
  PID:2352
- C:\Windows\System\RLmcNfY.exe
  C:\Windows\System\RLmcNfY.exe
  2⤵
  - Executes dropped EXE
  PID:4736
- C:\Windows\System\MbiijYu.exe
  C:\Windows\System\MbiijYu.exe
  2⤵
  - Executes dropped EXE
  PID:1132
- C:\Windows\System\iePeGBx.exe
  C:\Windows\System\iePeGBx.exe
  2⤵
  - Executes dropped EXE
  PID:8
- C:\Windows\System\iDVoObK.exe
  C:\Windows\System\iDVoObK.exe
  2⤵
  - Executes dropped EXE
  PID:5004
- C:\Windows\System\EHGWjin.exe
  C:\Windows\System\EHGWjin.exe
  2⤵
  - Executes dropped EXE
  PID:2208
- C:\Windows\System\KKPYUKp.exe
  C:\Windows\System\KKPYUKp.exe
  2⤵
  - Executes dropped EXE
  PID:672
- C:\Windows\System\hMsWPRI.exe
  C:\Windows\System\hMsWPRI.exe
  2⤵
  - Executes dropped EXE
  PID:856
- C:\Windows\System\eWJmofu.exe
  C:\Windows\System\eWJmofu.exe
  2⤵
  - Executes dropped EXE
  PID:868
- C:\Windows\System\rRnxTZC.exe
  C:\Windows\System\rRnxTZC.exe
  2⤵
  - Executes dropped EXE
  PID:4776
- C:\Windows\System\elReLKa.exe
  C:\Windows\System\elReLKa.exe
  2⤵
  PID:3184
- C:\Windows\System\PfgvozX.exe
  C:\Windows\System\PfgvozX.exe
  2⤵
  PID:2056
- C:\Windows\System\rerkEGG.exe
  C:\Windows\System\rerkEGG.exe
  2⤵
  PID:4476
- C:\Windows\System\jgUnDdN.exe
  C:\Windows\System\jgUnDdN.exe
  2⤵
  PID:3544
- C:\Windows\System\ojgFwFk.exe
  C:\Windows\System\ojgFwFk.exe
  2⤵
  PID:3472
- C:\Windows\System\WSGhGzU.exe
  C:\Windows\System\WSGhGzU.exe
  2⤵
  PID:2380
- C:\Windows\System\NhyuuHR.exe
  C:\Windows\System\NhyuuHR.exe
  2⤵
  PID:1992
- C:\Windows\System\cBUHYDz.exe
  C:\Windows\System\cBUHYDz.exe
  2⤵
  PID:3688
- C:\Windows\System\ZcJbDWD.exe
  C:\Windows\System\ZcJbDWD.exe
  2⤵
  PID:3332
- C:\Windows\System\pCwHGFa.exe
  C:\Windows\System\pCwHGFa.exe
  2⤵
  PID:2580
- C:\Windows\System\lahiWcn.exe
  C:\Windows\System\lahiWcn.exe
  2⤵
  PID:3172
- C:\Windows\System\TgrfhYv.exe
  C:\Windows\System\TgrfhYv.exe
  2⤵
  PID:3640
- C:\Windows\System\PFAFaEq.exe
  C:\Windows\System\PFAFaEq.exe
  2⤵
  PID:2856
- C:\Windows\System\LgesXqT.exe
  C:\Windows\System\LgesXqT.exe
  2⤵
  PID:4680
- C:\Windows\System\RXXYbJi.exe
  C:\Windows\System\RXXYbJi.exe
  2⤵
  PID:760
- C:\Windows\System\vXjObmn.exe
  C:\Windows\System\vXjObmn.exe
  2⤵
  PID:4976
- C:\Windows\System\opBhnfw.exe
  C:\Windows\System\opBhnfw.exe
  2⤵
  PID:4828
- C:\Windows\System\ijNYrnJ.exe
  C:\Windows\System\ijNYrnJ.exe
  2⤵
  PID:1124
- C:\Windows\System\gARteNb.exe
  C:\Windows\System\gARteNb.exe
  2⤵
  PID:4180
- C:\Windows\System\sbyqntj.exe
  C:\Windows\System\sbyqntj.exe
  2⤵
  PID:1804
- C:\Windows\System\dpTHHhN.exe
  C:\Windows\System\dpTHHhN.exe
  2⤵
  PID:3396
- C:\Windows\System\DIqJErU.exe
  C:\Windows\System\DIqJErU.exe
  2⤵
  PID:4508
- C:\Windows\System\QlaKXyV.exe
  C:\Windows\System\QlaKXyV.exe
  2⤵
  PID:1488
- C:\Windows\System\uMiZmkX.exe
  C:\Windows\System\uMiZmkX.exe
  2⤵
  PID:1092
- C:\Windows\System\RrYxcFE.exe
  C:\Windows\System\RrYxcFE.exe
  2⤵
  PID:2432
- C:\Windows\System\hQpkYXW.exe
  C:\Windows\System\hQpkYXW.exe
  2⤵
  PID:4432
- C:\Windows\System\cCTEJao.exe
  C:\Windows\System\cCTEJao.exe
  2⤵
  PID:2356
- C:\Windows\System\MVbcyay.exe
  C:\Windows\System\MVbcyay.exe
  2⤵
  PID:2284
- C:\Windows\System\CbsKzPR.exe
  C:\Windows\System\CbsKzPR.exe
  2⤵
  PID:2176
- C:\Windows\System\qdAJiMV.exe
  C:\Windows\System\qdAJiMV.exe
  2⤵
  PID:1960
- C:\Windows\System\xVwXvzI.exe
  C:\Windows\System\xVwXvzI.exe
  2⤵
  PID:540
- C:\Windows\System\WtFoTQl.exe
  C:\Windows\System\WtFoTQl.exe
  2⤵
  PID:116
- C:\Windows\System\yfJNVCd.exe
  C:\Windows\System\yfJNVCd.exe
  2⤵
  PID:1272
- C:\Windows\System\zgXThds.exe
  C:\Windows\System\zgXThds.exe
  2⤵
  PID:244
- C:\Windows\System\enJeTNc.exe
  C:\Windows\System\enJeTNc.exe
  2⤵
  PID:3588
- C:\Windows\System\rLGCjyj.exe
  C:\Windows\System\rLGCjyj.exe
  2⤵
  PID:1564
- C:\Windows\System\uLJrMaQ.exe
  C:\Windows\System\uLJrMaQ.exe
  2⤵
  PID:3664
- C:\Windows\System\aodCecb.exe
  C:\Windows\System\aodCecb.exe
  2⤵
  PID:5084
- C:\Windows\System\XTrMwIb.exe
  C:\Windows\System\XTrMwIb.exe
  2⤵
  PID:2032
- C:\Windows\System\JXutHOs.exe
  C:\Windows\System\JXutHOs.exe
  2⤵
  PID:1560
- C:\Windows\System\WXDYPgK.exe
  C:\Windows\System\WXDYPgK.exe
  2⤵
  PID:396
- C:\Windows\System\yRXnUsE.exe
  C:\Windows\System\yRXnUsE.exe
  2⤵
  PID:2496
- C:\Windows\System\fsWpDXE.exe
  C:\Windows\System\fsWpDXE.exe
  2⤵
  PID:4052
- C:\Windows\System\tcexlXd.exe
  C:\Windows\System\tcexlXd.exe
  2⤵
  PID:4436
- C:\Windows\System\BxpqNcC.exe
  C:\Windows\System\BxpqNcC.exe
  2⤵
  PID:1996
- C:\Windows\System\ivxLaJj.exe
  C:\Windows\System\ivxLaJj.exe
  2⤵
  PID:1308
- C:\Windows\System\yhRriiK.exe
  C:\Windows\System\yhRriiK.exe
  2⤵
  PID:4500
- C:\Windows\System\YTClGOG.exe
  C:\Windows\System\YTClGOG.exe
  2⤵
  PID:5124
- C:\Windows\System\VNnkYao.exe
  C:\Windows\System\VNnkYao.exe
  2⤵
  PID:5140
- C:\Windows\System\MjqciSE.exe
  C:\Windows\System\MjqciSE.exe
  2⤵
  PID:5156
- C:\Windows\System\LpJUsmL.exe
  C:\Windows\System\LpJUsmL.exe
  2⤵
  PID:5172
- C:\Windows\System\dBtnPsb.exe
  C:\Windows\System\dBtnPsb.exe
  2⤵
  PID:5188
- C:\Windows\System\rcmhGbw.exe
  C:\Windows\System\rcmhGbw.exe
  2⤵
  PID:5204
- C:\Windows\System\gsCqSTl.exe
  C:\Windows\System\gsCqSTl.exe
  2⤵
  PID:5232
- C:\Windows\System\BqXdzeb.exe
  C:\Windows\System\BqXdzeb.exe
  2⤵
  PID:5264
- C:\Windows\System\lxpyrcy.exe
  C:\Windows\System\lxpyrcy.exe
  2⤵
  PID:5296
- C:\Windows\System\fAEtopZ.exe
  C:\Windows\System\fAEtopZ.exe
  2⤵
  PID:5336
- C:\Windows\System\CZjLACC.exe
  C:\Windows\System\CZjLACC.exe
  2⤵
  PID:5368
- C:\Windows\System\JmaIJNA.exe
  C:\Windows\System\JmaIJNA.exe
  2⤵
  PID:5392
- C:\Windows\System\vxkVpgJ.exe
  C:\Windows\System\vxkVpgJ.exe
  2⤵
  PID:5420
- C:\Windows\System\LneDwQy.exe
  C:\Windows\System\LneDwQy.exe
  2⤵
  PID:5456
- C:\Windows\System\sraJWTO.exe
  C:\Windows\System\sraJWTO.exe
  2⤵
  PID:5488
- C:\Windows\System\KtSNEQx.exe
  C:\Windows\System\KtSNEQx.exe
  2⤵
  PID:5508
- C:\Windows\System\zIfyNkW.exe
  C:\Windows\System\zIfyNkW.exe
  2⤵
  PID:5540
- C:\Windows\System\sWZSuJw.exe
  C:\Windows\System\sWZSuJw.exe
  2⤵
  PID:5568
- C:\Windows\System\JQyEmaC.exe
  C:\Windows\System\JQyEmaC.exe
  2⤵
  PID:5608
- C:\Windows\System\XHGRJbq.exe
  C:\Windows\System\XHGRJbq.exe
  2⤵
  PID:5644
- C:\Windows\System\owbTOsE.exe
  C:\Windows\System\owbTOsE.exe
  2⤵
  PID:5672
- C:\Windows\System\ubYByir.exe
  C:\Windows\System\ubYByir.exe
  2⤵
  PID:5704
- C:\Windows\System\BPXswwe.exe
  C:\Windows\System\BPXswwe.exe
  2⤵
  PID:5732
- C:\Windows\System\utbzBLc.exe
  C:\Windows\System\utbzBLc.exe
  2⤵
  PID:5760
- C:\Windows\System\VquRkpE.exe
  C:\Windows\System\VquRkpE.exe
  2⤵
  PID:5784
- C:\Windows\System\GpuwaXR.exe
  C:\Windows\System\GpuwaXR.exe
  2⤵
  PID:5800
- C:\Windows\System\Mlngzjj.exe
  C:\Windows\System\Mlngzjj.exe
  2⤵
  PID:5816
- C:\Windows\System\fVqmjwZ.exe
  C:\Windows\System\fVqmjwZ.exe
  2⤵
  PID:5832
- C:\Windows\System\dkcvutN.exe
  C:\Windows\System\dkcvutN.exe
  2⤵
  PID:5856
- C:\Windows\System\VllQori.exe
  C:\Windows\System\VllQori.exe
  2⤵
  PID:5880
- C:\Windows\System\QVwUgpZ.exe
  C:\Windows\System\QVwUgpZ.exe
  2⤵
  PID:5904
- C:\Windows\System\WnTZhdI.exe
  C:\Windows\System\WnTZhdI.exe
  2⤵
  PID:5932
- C:\Windows\System\csWpSiu.exe
  C:\Windows\System\csWpSiu.exe
  2⤵
  PID:5972
- C:\Windows\System\isicqLu.exe
  C:\Windows\System\isicqLu.exe
  2⤵
  PID:6000
- C:\Windows\System\TVxyKaK.exe
  C:\Windows\System\TVxyKaK.exe
  2⤵
  PID:6040
- C:\Windows\System\qQuBOUe.exe
  C:\Windows\System\qQuBOUe.exe
  2⤵
  PID:6064
- C:\Windows\System\KTnHbUB.exe
  C:\Windows\System\KTnHbUB.exe
  2⤵
  PID:6096
- C:\Windows\System\lxXDZJk.exe
  C:\Windows\System\lxXDZJk.exe
  2⤵
  PID:6120
- C:\Windows\System\xgcXtxD.exe
  C:\Windows\System\xgcXtxD.exe
  2⤵
  PID:2184
- C:\Windows\System\CNUjTMa.exe
  C:\Windows\System\CNUjTMa.exe
  2⤵
  PID:5164
- C:\Windows\System\OjNsiyO.exe
  C:\Windows\System\OjNsiyO.exe
  2⤵
  PID:5308
- C:\Windows\System\KJzqZtF.exe
  C:\Windows\System\KJzqZtF.exe
  2⤵
  PID:5224
- C:\Windows\System\ZyzYPOl.exe
  C:\Windows\System\ZyzYPOl.exe
  2⤵
  PID:5276
- C:\Windows\System\OLWaUzJ.exe
  C:\Windows\System\OLWaUzJ.exe
  2⤵
  PID:5388
- C:\Windows\System\VwxMkSC.exe
  C:\Windows\System\VwxMkSC.exe
  2⤵
  PID:5480
- C:\Windows\System\hlrSpiH.exe
  C:\Windows\System\hlrSpiH.exe
  2⤵
  PID:5536
- C:\Windows\System\LuqtgJF.exe
  C:\Windows\System\LuqtgJF.exe
  2⤵
  PID:5624
- C:\Windows\System\WvAyggv.exe
  C:\Windows\System\WvAyggv.exe
  2⤵
  PID:5692
- C:\Windows\System\OukUlGY.exe
  C:\Windows\System\OukUlGY.exe
  2⤵
  PID:5756
- C:\Windows\System\VfcpqRC.exe
  C:\Windows\System\VfcpqRC.exe
  2⤵
  PID:5812
- C:\Windows\System\qZZwqiZ.exe
  C:\Windows\System\qZZwqiZ.exe
  2⤵
  PID:5872
- C:\Windows\System\XcnjbTY.exe
  C:\Windows\System\XcnjbTY.exe
  2⤵
  PID:5896
- C:\Windows\System\ECnZXqG.exe
  C:\Windows\System\ECnZXqG.exe
  2⤵
  PID:5916
- C:\Windows\System\XlPmOLx.exe
  C:\Windows\System\XlPmOLx.exe
  2⤵
  PID:6024
- C:\Windows\System\moFpptZ.exe
  C:\Windows\System\moFpptZ.exe
  2⤵
  PID:6052
- C:\Windows\System\DUJriGc.exe
  C:\Windows\System\DUJriGc.exe
  2⤵
  PID:6076
- C:\Windows\System\vgILiNH.exe
  C:\Windows\System\vgILiNH.exe
  2⤵
  PID:5256
- C:\Windows\System\ZatyiLC.exe
  C:\Windows\System\ZatyiLC.exe
  2⤵
  PID:5548
- C:\Windows\System\cLgfOmj.exe
  C:\Windows\System\cLgfOmj.exe
  2⤵
  PID:5588
- C:\Windows\System\gJVjBuB.exe
  C:\Windows\System\gJVjBuB.exe
  2⤵
  PID:5728
- C:\Windows\System\tFMLpuJ.exe
  C:\Windows\System\tFMLpuJ.exe
  2⤵
  PID:5956
- C:\Windows\System\BhiOBRn.exe
  C:\Windows\System\BhiOBRn.exe
  2⤵
  PID:5184
- C:\Windows\System\tmjhPin.exe
  C:\Windows\System\tmjhPin.exe
  2⤵
  PID:6060
- C:\Windows\System\YogqxuQ.exe
  C:\Windows\System\YogqxuQ.exe
  2⤵
  PID:5416
- C:\Windows\System\YyGfNND.exe
  C:\Windows\System\YyGfNND.exe
  2⤵
  PID:5660
- C:\Windows\System\bnKaoCW.exe
  C:\Windows\System\bnKaoCW.exe
  2⤵
  PID:6168
- C:\Windows\System\LhNPPya.exe
  C:\Windows\System\LhNPPya.exe
  2⤵
  PID:6200
- C:\Windows\System\hKGcxOn.exe
  C:\Windows\System\hKGcxOn.exe
  2⤵
  PID:6236
- C:\Windows\System\oUtHkGZ.exe
  C:\Windows\System\oUtHkGZ.exe
  2⤵
  PID:6264
- C:\Windows\System\POcvYiu.exe
  C:\Windows\System\POcvYiu.exe
  2⤵
  PID:6292
- C:\Windows\System\jHHYdSP.exe
  C:\Windows\System\jHHYdSP.exe
  2⤵
  PID:6324
- C:\Windows\System\BvGgWWS.exe
  C:\Windows\System\BvGgWWS.exe
  2⤵
  PID:6356
- C:\Windows\System\KEACFzK.exe
  C:\Windows\System\KEACFzK.exe
  2⤵
  PID:6388
- C:\Windows\System\emozfPI.exe
  C:\Windows\System\emozfPI.exe
  2⤵
  PID:6404
- C:\Windows\System\JdOdLQo.exe
  C:\Windows\System\JdOdLQo.exe
  2⤵
  PID:6428
- C:\Windows\System\fJjZoRo.exe
  C:\Windows\System\fJjZoRo.exe
  2⤵
  PID:6456
- C:\Windows\System\CSTWWdL.exe
  C:\Windows\System\CSTWWdL.exe
  2⤵
  PID:6492
- C:\Windows\System\zcpsQUF.exe
  C:\Windows\System\zcpsQUF.exe
  2⤵
  PID:6524
- C:\Windows\System\bxVmAWn.exe
  C:\Windows\System\bxVmAWn.exe
  2⤵
  PID:6556
- C:\Windows\System\nLFgyls.exe
  C:\Windows\System\nLFgyls.exe
  2⤵
  PID:6588
- C:\Windows\System\yvwlXpw.exe
  C:\Windows\System\yvwlXpw.exe
  2⤵
  PID:6616
- C:\Windows\System\LNXBYYh.exe
  C:\Windows\System\LNXBYYh.exe
  2⤵
  PID:6652
- C:\Windows\System\uNICaUn.exe
  C:\Windows\System\uNICaUn.exe
  2⤵
  PID:6684
- C:\Windows\System\CpAiTiv.exe
  C:\Windows\System\CpAiTiv.exe
  2⤵
  PID:6708
- C:\Windows\System\eRLKzsv.exe
  C:\Windows\System\eRLKzsv.exe
  2⤵
  PID:6740
- C:\Windows\System\KiUqFJH.exe
  C:\Windows\System\KiUqFJH.exe
  2⤵
  PID:6776
- C:\Windows\System\FzizFWL.exe
  C:\Windows\System\FzizFWL.exe
  2⤵
  PID:6812
- C:\Windows\System\AkGImfj.exe
  C:\Windows\System\AkGImfj.exe
  2⤵
  PID:6836
- C:\Windows\System\ZoUMxij.exe
  C:\Windows\System\ZoUMxij.exe
  2⤵
  PID:6852
- C:\Windows\System\rhJIJsU.exe
  C:\Windows\System\rhJIJsU.exe
  2⤵
  PID:6884
- C:\Windows\System\dlmvhcV.exe
  C:\Windows\System\dlmvhcV.exe
  2⤵
  PID:6912
- C:\Windows\System\HYfolad.exe
  C:\Windows\System\HYfolad.exe
  2⤵
  PID:6944
- C:\Windows\System\ebHntaH.exe
  C:\Windows\System\ebHntaH.exe
  2⤵
  PID:6968
- C:\Windows\System\HJbcqJt.exe
  C:\Windows\System\HJbcqJt.exe
  2⤵
  PID:6996
- C:\Windows\System\tpqDdsG.exe
  C:\Windows\System\tpqDdsG.exe
  2⤵
  PID:7012
- C:\Windows\System\BMdAZpS.exe
  C:\Windows\System\BMdAZpS.exe
  2⤵
  PID:7044
- C:\Windows\System\AJceBwe.exe
  C:\Windows\System\AJceBwe.exe
  2⤵
  PID:7068
- C:\Windows\System\IKoFUbE.exe
  C:\Windows\System\IKoFUbE.exe
  2⤵
  PID:7104
- C:\Windows\System\QfrCFPg.exe
  C:\Windows\System\QfrCFPg.exe
  2⤵
  PID:7124
- C:\Windows\System\mdshygu.exe
  C:\Windows\System\mdshygu.exe
  2⤵
  PID:7148
- C:\Windows\System\txxqaOv.exe
  C:\Windows\System\txxqaOv.exe
  2⤵
  PID:6108
- C:\Windows\System\MQfdHDF.exe
  C:\Windows\System\MQfdHDF.exe
  2⤵
  PID:6148
- C:\Windows\System\lSjNGop.exe
  C:\Windows\System\lSjNGop.exe
  2⤵
  PID:6300
- C:\Windows\System\APAPhaf.exe
  C:\Windows\System\APAPhaf.exe
  2⤵
  PID:6308
- C:\Windows\System\thvskbW.exe
  C:\Windows\System\thvskbW.exe
  2⤵
  PID:6284
- C:\Windows\System\sUrlgcN.exe
  C:\Windows\System\sUrlgcN.exe
  2⤵
  PID:6424
- C:\Windows\System\nPAJqgu.exe
  C:\Windows\System\nPAJqgu.exe
  2⤵
  PID:6516
- C:\Windows\System\bFVWXuT.exe
  C:\Windows\System\bFVWXuT.exe
  2⤵
  PID:6580
- C:\Windows\System\jypPwtV.exe
  C:\Windows\System\jypPwtV.exe
  2⤵
  PID:6668
- C:\Windows\System\yGxkciO.exe
  C:\Windows\System\yGxkciO.exe
  2⤵
  PID:6720
- C:\Windows\System\ARPEVaE.exe
  C:\Windows\System\ARPEVaE.exe
  2⤵
  PID:6792
- C:\Windows\System\vXeQkWO.exe
  C:\Windows\System\vXeQkWO.exe
  2⤵
  PID:6932
- C:\Windows\System\wfyZTSA.exe
  C:\Windows\System\wfyZTSA.exe
  2⤵
  PID:6940
- C:\Windows\System\oFVTRUD.exe
  C:\Windows\System\oFVTRUD.exe
  2⤵
  PID:7008
- C:\Windows\System\QqOrYwX.exe
  C:\Windows\System\QqOrYwX.exe
  2⤵
  PID:7076
- C:\Windows\System\XFtFnIi.exe
  C:\Windows\System\XFtFnIi.exe
  2⤵
  PID:5996
- C:\Windows\System\CLCkmtR.exe
  C:\Windows\System\CLCkmtR.exe
  2⤵
  PID:6192
- C:\Windows\System\XHUyCho.exe
  C:\Windows\System\XHUyCho.exe
  2⤵
  PID:6400
- C:\Windows\System\yXecfqi.exe
  C:\Windows\System\yXecfqi.exe
  2⤵
  PID:6504
- C:\Windows\System\bkdVzkg.exe
  C:\Windows\System\bkdVzkg.exe
  2⤵
  PID:6820
- C:\Windows\System\PpFjZXz.exe
  C:\Windows\System\PpFjZXz.exe
  2⤵
  PID:6908
- C:\Windows\System\VLxkPKT.exe
  C:\Windows\System\VLxkPKT.exe
  2⤵
  PID:6660
- C:\Windows\System\BAlINKJ.exe
  C:\Windows\System\BAlINKJ.exe
  2⤵
  PID:6196
- C:\Windows\System\YKErnXk.exe
  C:\Windows\System\YKErnXk.exe
  2⤵
  PID:6476
- C:\Windows\System\BdogAVA.exe
  C:\Windows\System\BdogAVA.exe
  2⤵
  PID:6696
- C:\Windows\System\oxcCqLW.exe
  C:\Windows\System\oxcCqLW.exe
  2⤵
  PID:6988
- C:\Windows\System\cWqVCPa.exe
  C:\Windows\System\cWqVCPa.exe
  2⤵
  PID:6736
- C:\Windows\System\ihAFaHe.exe
  C:\Windows\System\ihAFaHe.exe
  2⤵
  PID:7200
- C:\Windows\System\PtKOVGC.exe
  C:\Windows\System\PtKOVGC.exe
  2⤵
  PID:7228
- C:\Windows\System\msPgHmQ.exe
  C:\Windows\System\msPgHmQ.exe
  2⤵
  PID:7248
- C:\Windows\System\lvfLdwx.exe
  C:\Windows\System\lvfLdwx.exe
  2⤵
  PID:7280
- C:\Windows\System\DeHlvnc.exe
  C:\Windows\System\DeHlvnc.exe
  2⤵
  PID:7312
- C:\Windows\System\rRbGtde.exe
  C:\Windows\System\rRbGtde.exe
  2⤵
  PID:7344
- C:\Windows\System\hkuHmTl.exe
  C:\Windows\System\hkuHmTl.exe
  2⤵
  PID:7368
- C:\Windows\System\iUhavIx.exe
  C:\Windows\System\iUhavIx.exe
  2⤵
  PID:7400
- C:\Windows\System\KaPWQmA.exe
  C:\Windows\System\KaPWQmA.exe
  2⤵
  PID:7428
- C:\Windows\System\DWiOxBD.exe
  C:\Windows\System\DWiOxBD.exe
  2⤵
  PID:7460
- C:\Windows\System\GGFQesi.exe
  C:\Windows\System\GGFQesi.exe
  2⤵
  PID:7484
- C:\Windows\System\apoojxE.exe
  C:\Windows\System\apoojxE.exe
  2⤵
  PID:7520
- C:\Windows\System\PNYwfeF.exe
  C:\Windows\System\PNYwfeF.exe
  2⤵
  PID:7552
- C:\Windows\System\elwThyM.exe
  C:\Windows\System\elwThyM.exe
  2⤵
  PID:7580
- C:\Windows\System\ZaPeVeW.exe
  C:\Windows\System\ZaPeVeW.exe
  2⤵
  PID:7612
- C:\Windows\System\PqemMNg.exe
  C:\Windows\System\PqemMNg.exe
  2⤵
  PID:7640
- C:\Windows\System\NSyaTSD.exe
  C:\Windows\System\NSyaTSD.exe
  2⤵
  PID:7660
- C:\Windows\System\YOMIpBU.exe
  C:\Windows\System\YOMIpBU.exe
  2⤵
  PID:7692
- C:\Windows\System\bSKvNTu.exe
  C:\Windows\System\bSKvNTu.exe
  2⤵
  PID:7712
- C:\Windows\System\ZfVZabG.exe
  C:\Windows\System\ZfVZabG.exe
  2⤵
  PID:7732
- C:\Windows\System\fuWFlXR.exe
  C:\Windows\System\fuWFlXR.exe
  2⤵
  PID:7760
- C:\Windows\System\xtVInjW.exe
  C:\Windows\System\xtVInjW.exe
  2⤵
  PID:7800
- C:\Windows\System\ZisNFTx.exe
  C:\Windows\System\ZisNFTx.exe
  2⤵
  PID:7824
- C:\Windows\System\WceJQLo.exe
  C:\Windows\System\WceJQLo.exe
  2⤵
  PID:7852
- C:\Windows\System\PoqHOXZ.exe
  C:\Windows\System\PoqHOXZ.exe
  2⤵
  PID:7876
- C:\Windows\System\zZZUqlc.exe
  C:\Windows\System\zZZUqlc.exe
  2⤵
  PID:7904
- C:\Windows\System\ePBveyW.exe
  C:\Windows\System\ePBveyW.exe
  2⤵
  PID:7936
- C:\Windows\System\FlpWwIV.exe
  C:\Windows\System\FlpWwIV.exe
  2⤵
  PID:7968
- C:\Windows\System\XboKsuL.exe
  C:\Windows\System\XboKsuL.exe
  2⤵
  PID:8004
- C:\Windows\System\djzRvwc.exe
  C:\Windows\System\djzRvwc.exe
  2⤵
  PID:8028
- C:\Windows\System\zmENtcR.exe
  C:\Windows\System\zmENtcR.exe
  2⤵
  PID:8060
- C:\Windows\System\buzSUDb.exe
  C:\Windows\System\buzSUDb.exe
  2⤵
  PID:8092
- C:\Windows\System\IAQbgWI.exe
  C:\Windows\System\IAQbgWI.exe
  2⤵
  PID:8116
- C:\Windows\System\mmiUtcs.exe
  C:\Windows\System\mmiUtcs.exe
  2⤵
  PID:8144
- C:\Windows\System\PBcuAnm.exe
  C:\Windows\System\PBcuAnm.exe
  2⤵
  PID:8180
- C:\Windows\System\blCeNmM.exe
  C:\Windows\System\blCeNmM.exe
  2⤵
  PID:6844
- C:\Windows\System\YRtjSbA.exe
  C:\Windows\System\YRtjSbA.exe
  2⤵
  PID:7216
- C:\Windows\System\RBSxMdg.exe
  C:\Windows\System\RBSxMdg.exe
  2⤵
  PID:7276
- C:\Windows\System\OwWfyjz.exe
  C:\Windows\System\OwWfyjz.exe
  2⤵
  PID:7376
- C:\Windows\System\MeMKJyf.exe
  C:\Windows\System\MeMKJyf.exe
  2⤵
  PID:7504
- C:\Windows\System\LUmnqQf.exe
  C:\Windows\System\LUmnqQf.exe
  2⤵
  PID:7476
- C:\Windows\System\brFNRZx.exe
  C:\Windows\System\brFNRZx.exe
  2⤵
  PID:7600
- C:\Windows\System\WSBkFXt.exe
  C:\Windows\System\WSBkFXt.exe
  2⤵
  PID:7624
- C:\Windows\System\DRMjmfZ.exe
  C:\Windows\System\DRMjmfZ.exe
  2⤵
  PID:7704
- C:\Windows\System\byMHjHH.exe
  C:\Windows\System\byMHjHH.exe
  2⤵
  PID:7756
- C:\Windows\System\JKXmPxg.exe
  C:\Windows\System\JKXmPxg.exe
  2⤵
  PID:7832
- C:\Windows\System\JjXafuw.exe
  C:\Windows\System\JjXafuw.exe
  2⤵
  PID:7944
- C:\Windows\System\GfACZbX.exe
  C:\Windows\System\GfACZbX.exe
  2⤵
  PID:7988
- C:\Windows\System\piOdSzk.exe
  C:\Windows\System\piOdSzk.exe
  2⤵
  PID:8040
- C:\Windows\System\FQsjedS.exe
  C:\Windows\System\FQsjedS.exe
  2⤵
  PID:8112
- C:\Windows\System\MRHtrHo.exe
  C:\Windows\System\MRHtrHo.exe
  2⤵
  PID:8152
- C:\Windows\System\pHsrCZi.exe
  C:\Windows\System\pHsrCZi.exe
  2⤵
  PID:7212
- C:\Windows\System\pbDVHaB.exe
  C:\Windows\System\pbDVHaB.exe
  2⤵
  PID:7340
- C:\Windows\System\dVXpzhf.exe
  C:\Windows\System\dVXpzhf.exe
  2⤵
  PID:7456
- C:\Windows\System\hwSHCiN.exe
  C:\Windows\System\hwSHCiN.exe
  2⤵
  PID:7636
- C:\Windows\System\LHOxIUi.exe
  C:\Windows\System\LHOxIUi.exe
  2⤵
  PID:7864
- C:\Windows\System\cmuujmo.exe
  C:\Windows\System\cmuujmo.exe
  2⤵
  PID:7928
- C:\Windows\System\TPyPVHc.exe
  C:\Windows\System\TPyPVHc.exe
  2⤵
  PID:8132
- C:\Windows\System\BOKBwyC.exe
  C:\Windows\System\BOKBwyC.exe
  2⤵
  PID:7392
- C:\Windows\System\kuBWMgc.exe
  C:\Windows\System\kuBWMgc.exe
  2⤵
  PID:7792
- C:\Windows\System\fwONaPN.exe
  C:\Windows\System\fwONaPN.exe
  2⤵
  PID:7172
- C:\Windows\System\aGZURxn.exe
  C:\Windows\System\aGZURxn.exe
  2⤵
  PID:7728
- C:\Windows\System\NyEYbQT.exe
  C:\Windows\System\NyEYbQT.exe
  2⤵
  PID:8216
- C:\Windows\System\NxEJhjp.exe
  C:\Windows\System\NxEJhjp.exe
  2⤵
  PID:8244
- C:\Windows\System\tXuAabD.exe
  C:\Windows\System\tXuAabD.exe
  2⤵
  PID:8272
- C:\Windows\System\ohqHJtb.exe
  C:\Windows\System\ohqHJtb.exe
  2⤵
  PID:8300
- C:\Windows\System\tGuIJHG.exe
  C:\Windows\System\tGuIJHG.exe
  2⤵
  PID:8316
- C:\Windows\System\tKGIrkO.exe
  C:\Windows\System\tKGIrkO.exe
  2⤵
  PID:8336
- C:\Windows\System\frcgOnT.exe
  C:\Windows\System\frcgOnT.exe
  2⤵
  PID:8372
- C:\Windows\System\bBykDfo.exe
  C:\Windows\System\bBykDfo.exe
  2⤵
  PID:8400
- C:\Windows\System\mNnFVCv.exe
  C:\Windows\System\mNnFVCv.exe
  2⤵
  PID:8428
- C:\Windows\System\nbAeDXr.exe
  C:\Windows\System\nbAeDXr.exe
  2⤵
  PID:8456
- C:\Windows\System\zwRyMmS.exe
  C:\Windows\System\zwRyMmS.exe
  2⤵
  PID:8488
- C:\Windows\System\CBwIVcb.exe
  C:\Windows\System\CBwIVcb.exe
  2⤵
  PID:8524
- C:\Windows\System\XZjljqI.exe
  C:\Windows\System\XZjljqI.exe
  2⤵
  PID:8548
- C:\Windows\System\agPsPPp.exe
  C:\Windows\System\agPsPPp.exe
  2⤵
  PID:8572
- C:\Windows\System\CABPnuk.exe
  C:\Windows\System\CABPnuk.exe
  2⤵
  PID:8604
- C:\Windows\System\vmanvgZ.exe
  C:\Windows\System\vmanvgZ.exe
  2⤵
  PID:8632
- C:\Windows\System\ijZpeCQ.exe
  C:\Windows\System\ijZpeCQ.exe
  2⤵
  PID:8664
- C:\Windows\System\HIZePkZ.exe
  C:\Windows\System\HIZePkZ.exe
  2⤵
  PID:8696
- C:\Windows\System\AfJLrYJ.exe
  C:\Windows\System\AfJLrYJ.exe
  2⤵
  PID:8712
- C:\Windows\System\QhDFJmZ.exe
  C:\Windows\System\QhDFJmZ.exe
  2⤵
  PID:8740
- C:\Windows\System\EZzYQHG.exe
  C:\Windows\System\EZzYQHG.exe
  2⤵
  PID:8768
- C:\Windows\System\TwupuJr.exe
  C:\Windows\System\TwupuJr.exe
  2⤵
  PID:8796
- C:\Windows\System\GgkxBHG.exe
  C:\Windows\System\GgkxBHG.exe
  2⤵
  PID:8824
- C:\Windows\System\IDUtyfc.exe
  C:\Windows\System\IDUtyfc.exe
  2⤵
  PID:8852
- C:\Windows\System\uSvUxuc.exe
  C:\Windows\System\uSvUxuc.exe
  2⤵
  PID:8880
- C:\Windows\System\LUVvKxB.exe
  C:\Windows\System\LUVvKxB.exe
  2⤵
  PID:8908
- C:\Windows\System\CLMKZnD.exe
  C:\Windows\System\CLMKZnD.exe
  2⤵
  PID:8944
- C:\Windows\System\bHeNxmL.exe
  C:\Windows\System\bHeNxmL.exe
  2⤵
  PID:8964
- C:\Windows\System\cDzVxrM.exe
  C:\Windows\System\cDzVxrM.exe
  2⤵
  PID:8992
- C:\Windows\System\jsvTshP.exe
  C:\Windows\System\jsvTshP.exe
  2⤵
  PID:9008
- C:\Windows\System\oDcCLZu.exe
  C:\Windows\System\oDcCLZu.exe
  2⤵
  PID:9032
- C:\Windows\System\ACJvgFB.exe
  C:\Windows\System\ACJvgFB.exe
  2⤵
  PID:9060
- C:\Windows\System\uudfVym.exe
  C:\Windows\System\uudfVym.exe
  2⤵
  PID:9080
- C:\Windows\System\qyxHhdE.exe
  C:\Windows\System\qyxHhdE.exe
  2⤵
  PID:9096
- C:\Windows\System\TyxURKx.exe
  C:\Windows\System\TyxURKx.exe
  2⤵
  PID:9120
- C:\Windows\System\eIbfNaP.exe
  C:\Windows\System\eIbfNaP.exe
  2⤵
  PID:9156
- C:\Windows\System\fTZOigQ.exe
  C:\Windows\System\fTZOigQ.exe
  2⤵
  PID:9184
- C:\Windows\System\VUkgSfG.exe
  C:\Windows\System\VUkgSfG.exe
  2⤵
  PID:9212
- C:\Windows\System\yuVGjwM.exe
  C:\Windows\System\yuVGjwM.exe
  2⤵
  PID:8236
- C:\Windows\System\ZkHHEsR.exe
  C:\Windows\System\ZkHHEsR.exe
  2⤵
  PID:5380
- C:\Windows\System\CYBPdVj.exe
  C:\Windows\System\CYBPdVj.exe
  2⤵
  PID:8332
- C:\Windows\System\FECeSNo.exe
  C:\Windows\System\FECeSNo.exe
  2⤵
  PID:8392
- C:\Windows\System\mOFlJCW.exe
  C:\Windows\System\mOFlJCW.exe
  2⤵
  PID:8468
- C:\Windows\System\fyfwMex.exe
  C:\Windows\System\fyfwMex.exe
  2⤵
  PID:8516
- C:\Windows\System\FxoeqHF.exe
  C:\Windows\System\FxoeqHF.exe
  2⤵
  PID:8600
- C:\Windows\System\nrkivtp.exe
  C:\Windows\System\nrkivtp.exe
  2⤵
  PID:8652
- C:\Windows\System\RvWdEOp.exe
  C:\Windows\System\RvWdEOp.exe
  2⤵
  PID:8704
- C:\Windows\System\UwanQAP.exe
  C:\Windows\System\UwanQAP.exe
  2⤵
  PID:8784
- C:\Windows\System\IJteLDj.exe
  C:\Windows\System\IJteLDj.exe
  2⤵
  PID:8848
- C:\Windows\System\BCsHboO.exe
  C:\Windows\System\BCsHboO.exe
  2⤵
  PID:8924
- C:\Windows\System\oCDynAy.exe
  C:\Windows\System\oCDynAy.exe
  2⤵
  PID:8980
- C:\Windows\System\ARxuaxi.exe
  C:\Windows\System\ARxuaxi.exe
  2⤵
  PID:9028
- C:\Windows\System\VfrSfGU.exe
  C:\Windows\System\VfrSfGU.exe
  2⤵
  PID:9072
- C:\Windows\System\EBgwlAb.exe
  C:\Windows\System\EBgwlAb.exe
  2⤵
  PID:9140
- C:\Windows\System\OthpRGq.exe
  C:\Windows\System\OthpRGq.exe
  2⤵
  PID:8264
- C:\Windows\System\VPVKzhh.exe
  C:\Windows\System\VPVKzhh.exe
  2⤵
  PID:8284
- C:\Windows\System\mKyFCFH.exe
  C:\Windows\System\mKyFCFH.exe
  2⤵
  PID:8352
- C:\Windows\System\dynWLaz.exe
  C:\Windows\System\dynWLaz.exe
  2⤵
  PID:8620
- C:\Windows\System\utxqdgk.exe
  C:\Windows\System\utxqdgk.exe
  2⤵
  PID:8764
- C:\Windows\System\JUzFVBI.exe
  C:\Windows\System\JUzFVBI.exe
  2⤵
  PID:9088
- C:\Windows\System\HHxZDOW.exe
  C:\Windows\System\HHxZDOW.exe
  2⤵
  PID:9092
- C:\Windows\System\WAxdjlA.exe
  C:\Windows\System\WAxdjlA.exe
  2⤵
  PID:8684
- C:\Windows\System\ghwvSsH.exe
  C:\Windows\System\ghwvSsH.exe
  2⤵
  PID:8580
- C:\Windows\System\LGEftsJ.exe
  C:\Windows\System\LGEftsJ.exe
  2⤵
  PID:9228
- C:\Windows\System\RKpvRra.exe
  C:\Windows\System\RKpvRra.exe
  2⤵
  PID:9264
- C:\Windows\System\aOHApAw.exe
  C:\Windows\System\aOHApAw.exe
  2⤵
  PID:9288
- C:\Windows\System\JMihVoA.exe
  C:\Windows\System\JMihVoA.exe
  2⤵
  PID:9320
- C:\Windows\System\ggxAeKF.exe
  C:\Windows\System\ggxAeKF.exe
  2⤵
  PID:9352
- C:\Windows\System\pHKoVbv.exe
  C:\Windows\System\pHKoVbv.exe
  2⤵
  PID:9380
- C:\Windows\System\sILeyjF.exe
  C:\Windows\System\sILeyjF.exe
  2⤵
  PID:9404
- C:\Windows\System\FLEPOdn.exe
  C:\Windows\System\FLEPOdn.exe
  2⤵
  PID:9428
- C:\Windows\System\ELvddSo.exe
  C:\Windows\System\ELvddSo.exe
  2⤵
  PID:9452
- C:\Windows\System\ifIrtvl.exe
  C:\Windows\System\ifIrtvl.exe
  2⤵
  PID:9480
- C:\Windows\System\PJKNqRw.exe
  C:\Windows\System\PJKNqRw.exe
  2⤵
  PID:9508
- C:\Windows\System\wjiGDTU.exe
  C:\Windows\System\wjiGDTU.exe
  2⤵
  PID:9528
- C:\Windows\System\PbCfZSD.exe
  C:\Windows\System\PbCfZSD.exe
  2⤵
  PID:9552
- C:\Windows\System\EacBaXh.exe
  C:\Windows\System\EacBaXh.exe
  2⤵
  PID:9576
- C:\Windows\System\pkReswk.exe
  C:\Windows\System\pkReswk.exe
  2⤵
  PID:9608
- C:\Windows\System\MEEMoIA.exe
  C:\Windows\System\MEEMoIA.exe
  2⤵
  PID:9640
- C:\Windows\System\lRbOEZO.exe
  C:\Windows\System\lRbOEZO.exe
  2⤵
  PID:9676
- C:\Windows\System\yVKxYEg.exe
  C:\Windows\System\yVKxYEg.exe
  2⤵
  PID:9708
- C:\Windows\System\kkFFFzC.exe
  C:\Windows\System\kkFFFzC.exe
  2⤵
  PID:9728
- C:\Windows\System\jbpDhZr.exe
  C:\Windows\System\jbpDhZr.exe
  2⤵
  PID:9744
- C:\Windows\System\WNeDJKz.exe
  C:\Windows\System\WNeDJKz.exe
  2⤵
  PID:9772
- C:\Windows\System\piWtBeS.exe
  C:\Windows\System\piWtBeS.exe
  2⤵
  PID:9800
- C:\Windows\System\YKHezJw.exe
  C:\Windows\System\YKHezJw.exe
  2⤵
  PID:9824
- C:\Windows\System\YWFuIUQ.exe
  C:\Windows\System\YWFuIUQ.exe
  2⤵
  PID:9852
- C:\Windows\System\AvJFnHu.exe
  C:\Windows\System\AvJFnHu.exe
  2⤵
  PID:9876
- C:\Windows\System\jWhcKoK.exe
  C:\Windows\System\jWhcKoK.exe
  2⤵
  PID:9908
- C:\Windows\System\FOYvrXN.exe
  C:\Windows\System\FOYvrXN.exe
  2⤵
  PID:9936
- C:\Windows\System\SIYPeQI.exe
  C:\Windows\System\SIYPeQI.exe
  2⤵
  PID:9976
- C:\Windows\System\zsCTrhn.exe
  C:\Windows\System\zsCTrhn.exe
  2⤵
  PID:9996
- C:\Windows\System\guHTYZZ.exe
  C:\Windows\System\guHTYZZ.exe
  2⤵
  PID:10024
- C:\Windows\System\RIBFwEf.exe
  C:\Windows\System\RIBFwEf.exe
  2⤵
  PID:10044
- C:\Windows\System\xaMTzxj.exe
  C:\Windows\System\xaMTzxj.exe
  2⤵
  PID:10064
- C:\Windows\System\nCBMvPB.exe
  C:\Windows\System\nCBMvPB.exe
  2⤵
  PID:10092
- C:\Windows\System\HnNvleF.exe
  C:\Windows\System\HnNvleF.exe
  2⤵
  PID:10112
- C:\Windows\System\BEdjRFc.exe
  C:\Windows\System\BEdjRFc.exe
  2⤵
  PID:10128
- C:\Windows\System\fqoRtvZ.exe
  C:\Windows\System\fqoRtvZ.exe
  2⤵
  PID:10152
- C:\Windows\System\ylUbySI.exe
  C:\Windows\System\ylUbySI.exe
  2⤵
  PID:10184
- C:\Windows\System\jPdJsAJ.exe
  C:\Windows\System\jPdJsAJ.exe
  2⤵
  PID:10208
- C:\Windows\System\laViDHd.exe
  C:\Windows\System\laViDHd.exe
  2⤵
  PID:10232
- C:\Windows\System\FfJjJPZ.exe
  C:\Windows\System\FfJjJPZ.exe
  2⤵
  PID:8196
- C:\Windows\System\WdvIbjy.exe
  C:\Windows\System\WdvIbjy.exe
  2⤵
  PID:9248
- C:\Windows\System\ZInYVRx.exe
  C:\Windows\System\ZInYVRx.exe
  2⤵
  PID:9300
- C:\Windows\System\KBjZnwB.exe
  C:\Windows\System\KBjZnwB.exe
  2⤵
  PID:9284
- C:\Windows\System\ePSSzsK.exe
  C:\Windows\System\ePSSzsK.exe
  2⤵
  PID:9344
- C:\Windows\System\CtYfTgS.exe
  C:\Windows\System\CtYfTgS.exe
  2⤵
  PID:9500
- C:\Windows\System\wDtUhnI.exe
  C:\Windows\System\wDtUhnI.exe
  2⤵
  PID:9504
- C:\Windows\System\MlYmQRv.exe
  C:\Windows\System\MlYmQRv.exe
  2⤵
  PID:9628
- C:\Windows\System\mtQYxjM.exe
  C:\Windows\System\mtQYxjM.exe
  2⤵
  PID:9588
- C:\Windows\System\UcPMMIV.exe
  C:\Windows\System\UcPMMIV.exe
  2⤵
  PID:9668
- C:\Windows\System\wLavbef.exe
  C:\Windows\System\wLavbef.exe
  2⤵
  PID:9792
- C:\Windows\System\wXFLcZo.exe
  C:\Windows\System\wXFLcZo.exe
  2⤵
  PID:9848
- C:\Windows\System\vRySruL.exe
  C:\Windows\System\vRySruL.exe
  2⤵
  PID:9840
- C:\Windows\System\WHifigk.exe
  C:\Windows\System\WHifigk.exe
  2⤵
  PID:10036
- C:\Windows\System\KfhtqiU.exe
  C:\Windows\System\KfhtqiU.exe
  2⤵
  PID:9952
- C:\Windows\System\anRKRIS.exe
  C:\Windows\System\anRKRIS.exe
  2⤵
  PID:10084
- C:\Windows\System\izamLtZ.exe
  C:\Windows\System\izamLtZ.exe
  2⤵
  PID:8840
- C:\Windows\System\JSJlyJa.exe
  C:\Windows\System\JSJlyJa.exe
  2⤵
  PID:10124
- C:\Windows\System\pEDQwRj.exe
  C:\Windows\System\pEDQwRj.exe
  2⤵
  PID:8820
- C:\Windows\System\bjhOpwv.exe
  C:\Windows\System\bjhOpwv.exe
  2⤵
  PID:9256
- C:\Windows\System\MThJhGb.exe
  C:\Windows\System\MThJhGb.exe
  2⤵
  PID:9572
- C:\Windows\System\ZGjsnxd.exe
  C:\Windows\System\ZGjsnxd.exe
  2⤵
  PID:9768
- C:\Windows\System\QblQsZJ.exe
  C:\Windows\System\QblQsZJ.exe
  2⤵
  PID:9276
- C:\Windows\System\DixZcfW.exe
  C:\Windows\System\DixZcfW.exe
  2⤵
  PID:10032
- C:\Windows\System\zHmWaoC.exe
  C:\Windows\System\zHmWaoC.exe
  2⤵
  PID:10108
- C:\Windows\System\pPYRbEE.exe
  C:\Windows\System\pPYRbEE.exe
  2⤵
  PID:10228
- C:\Windows\System\nfxTwjl.exe
  C:\Windows\System\nfxTwjl.exe
  2⤵
  PID:10052
- C:\Windows\System\LpTWxSm.exe
  C:\Windows\System\LpTWxSm.exe
  2⤵
  PID:9460
- C:\Windows\System\ujLxKwB.exe
  C:\Windows\System\ujLxKwB.exe
  2⤵
  PID:9984
- C:\Windows\System\vvEjHhJ.exe
  C:\Windows\System\vvEjHhJ.exe
  2⤵
  PID:10260
- C:\Windows\System\VKAOLAI.exe
  C:\Windows\System\VKAOLAI.exe
  2⤵
  PID:10292
- C:\Windows\System\aHRhSDN.exe
  C:\Windows\System\aHRhSDN.exe
  2⤵
  PID:10312
- C:\Windows\System\OcwoqRh.exe
  C:\Windows\System\OcwoqRh.exe
  2⤵
  PID:10512
- C:\Windows\System\lepyVhh.exe
  C:\Windows\System\lepyVhh.exe
  2⤵
  PID:10528
- C:\Windows\System\ARkqBvq.exe
  C:\Windows\System\ARkqBvq.exe
  2⤵
  PID:10556
- C:\Windows\System\ZsxAcMx.exe
  C:\Windows\System\ZsxAcMx.exe
  2⤵
  PID:10576
- C:\Windows\System\blPRcfZ.exe
  C:\Windows\System\blPRcfZ.exe
  2⤵
  PID:10600
- C:\Windows\System\MSLvLRm.exe
  C:\Windows\System\MSLvLRm.exe
  2⤵
  PID:10628
- C:\Windows\System\CJKvlpm.exe
  C:\Windows\System\CJKvlpm.exe
  2⤵
  PID:10656
- C:\Windows\System\ScKlyPJ.exe
  C:\Windows\System\ScKlyPJ.exe
  2⤵
  PID:10672
- C:\Windows\System\gHsROIG.exe
  C:\Windows\System\gHsROIG.exe
  2⤵
  PID:10696
- C:\Windows\System\zKkQjLO.exe
  C:\Windows\System\zKkQjLO.exe
  2⤵
  PID:10724
- C:\Windows\System\EnfWvcZ.exe
  C:\Windows\System\EnfWvcZ.exe
  2⤵
  PID:10748
- C:\Windows\System\azXOJuW.exe
  C:\Windows\System\azXOJuW.exe
  2⤵
  PID:10772
- C:\Windows\System\eAvyaXI.exe
  C:\Windows\System\eAvyaXI.exe
  2⤵
  PID:10808
- C:\Windows\System\sYNyVXU.exe
  C:\Windows\System\sYNyVXU.exe
  2⤵
  PID:10836
- C:\Windows\System\eaSMyqy.exe
  C:\Windows\System\eaSMyqy.exe
  2⤵
  PID:10864
- C:\Windows\System\jojtZbY.exe
  C:\Windows\System\jojtZbY.exe
  2⤵
  PID:10888
- C:\Windows\System\ZwSsgUf.exe
  C:\Windows\System\ZwSsgUf.exe
  2⤵
  PID:10912
- C:\Windows\System\MKsYfDH.exe
  C:\Windows\System\MKsYfDH.exe
  2⤵
  PID:10936
- C:\Windows\System\tGnifMM.exe
  C:\Windows\System\tGnifMM.exe
  2⤵
  PID:10964
- C:\Windows\System\PSamqpw.exe
  C:\Windows\System\PSamqpw.exe
  2⤵
  PID:10988
- C:\Windows\System\LnxIWcd.exe
  C:\Windows\System\LnxIWcd.exe
  2⤵
  PID:11016
- C:\Windows\System\squDnCZ.exe
  C:\Windows\System\squDnCZ.exe
  2⤵
  PID:11048
- C:\Windows\System\geYjkze.exe
  C:\Windows\System\geYjkze.exe
  2⤵
  PID:11068
- C:\Windows\System\ckqcAmY.exe
  C:\Windows\System\ckqcAmY.exe
  2⤵
  PID:11092
- C:\Windows\System\wivxQAl.exe
  C:\Windows\System\wivxQAl.exe
  2⤵
  PID:11116
- C:\Windows\System\sNKcJRt.exe
  C:\Windows\System\sNKcJRt.exe
  2⤵
  PID:11136
- C:\Windows\System\PMxzuMW.exe
  C:\Windows\System\PMxzuMW.exe
  2⤵
  PID:11164
- C:\Windows\System\dMKjUkA.exe
  C:\Windows\System\dMKjUkA.exe
  2⤵
  PID:11188
- C:\Windows\System\MEgBMwe.exe
  C:\Windows\System\MEgBMwe.exe
  2⤵
  PID:11212
- C:\Windows\System\YPpkAgb.exe
  C:\Windows\System\YPpkAgb.exe
  2⤵
  PID:11236
- C:\Windows\System\IgJzYRt.exe
  C:\Windows\System\IgJzYRt.exe
  2⤵
  PID:9716
- C:\Windows\System\UhCipAi.exe
  C:\Windows\System\UhCipAi.exe
  2⤵
  PID:10252
- C:\Windows\System\cYZUEEo.exe
  C:\Windows\System\cYZUEEo.exe
  2⤵
  PID:9740
- C:\Windows\System\sjwQAiW.exe
  C:\Windows\System\sjwQAiW.exe
  2⤵
  PID:10324
- C:\Windows\System\mkKCuUU.exe
  C:\Windows\System\mkKCuUU.exe
  2⤵
  PID:10408
- C:\Windows\System\nnoPJPK.exe
  C:\Windows\System\nnoPJPK.exe
  2⤵
  PID:10488
- C:\Windows\System\TFdfMfJ.exe
  C:\Windows\System\TFdfMfJ.exe
  2⤵
  PID:10520
- C:\Windows\System\AwFcORx.exe
  C:\Windows\System\AwFcORx.exe
  2⤵
  PID:10612
- C:\Windows\System\tHYgKLr.exe
  C:\Windows\System\tHYgKLr.exe
  2⤵
  PID:10620
- C:\Windows\System\lTkvCTq.exe
  C:\Windows\System\lTkvCTq.exe
  2⤵
  PID:10716
- C:\Windows\System\qbNsPit.exe
  C:\Windows\System\qbNsPit.exe
  2⤵
  PID:10876
- C:\Windows\System\VLSTKkb.exe
  C:\Windows\System\VLSTKkb.exe
  2⤵
  PID:10896
- C:\Windows\System\AVjMMDN.exe
  C:\Windows\System\AVjMMDN.exe
  2⤵
  PID:10952
- C:\Windows\System\cbQmDyu.exe
  C:\Windows\System\cbQmDyu.exe
  2⤵
  PID:10920
- C:\Windows\System\vxPUNwx.exe
  C:\Windows\System\vxPUNwx.exe
  2⤵
  PID:10980
- C:\Windows\System\LlrcHhD.exe
  C:\Windows\System\LlrcHhD.exe
  2⤵
  PID:11032
- C:\Windows\System\suMkkGo.exe
  C:\Windows\System\suMkkGo.exe
  2⤵
  PID:11152
- C:\Windows\System\XoNdBQa.exe
  C:\Windows\System\XoNdBQa.exe
  2⤵
  PID:11184
- C:\Windows\System\sdGxNCO.exe
  C:\Windows\System\sdGxNCO.exe
  2⤵
  PID:11252
- C:\Windows\System\ODbgfJr.exe
  C:\Windows\System\ODbgfJr.exe
  2⤵
  PID:10180
- C:\Windows\System\XKDghEV.exe
  C:\Windows\System\XKDghEV.exe
  2⤵
  PID:10548
- C:\Windows\System\KidhiSu.exe
  C:\Windows\System\KidhiSu.exe
  2⤵
  PID:10496
- C:\Windows\System\KAPAZVa.exe
  C:\Windows\System\KAPAZVa.exe
  2⤵
  PID:10740
- C:\Windows\System\IYTUYQr.exe
  C:\Windows\System\IYTUYQr.exe
  2⤵
  PID:10760
- C:\Windows\System\rcQeExU.exe
  C:\Windows\System\rcQeExU.exe
  2⤵
  PID:10832
- C:\Windows\System\OEFjVYW.exe
  C:\Windows\System\OEFjVYW.exe
  2⤵
  PID:11232
- C:\Windows\System\tgzXnWY.exe
  C:\Windows\System\tgzXnWY.exe
  2⤵
  PID:10300
- C:\Windows\System\njyDBcy.exe
  C:\Windows\System\njyDBcy.exe
  2⤵
  PID:10640
- C:\Windows\System\BMpwbqf.exe
  C:\Windows\System\BMpwbqf.exe
  2⤵
  PID:11288
- C:\Windows\System\NeJXjXL.exe
  C:\Windows\System\NeJXjXL.exe
  2⤵
  PID:11320
- C:\Windows\System\vBiBKRB.exe
  C:\Windows\System\vBiBKRB.exe
  2⤵
  PID:11340
- C:\Windows\System\ofzzpuP.exe
  C:\Windows\System\ofzzpuP.exe
  2⤵
  PID:11364
- C:\Windows\System\TzAshcl.exe
  C:\Windows\System\TzAshcl.exe
  2⤵
  PID:11392
- C:\Windows\System\ieWBamD.exe
  C:\Windows\System\ieWBamD.exe
  2⤵
  PID:11416
- C:\Windows\System\qlkuPIF.exe
  C:\Windows\System\qlkuPIF.exe
  2⤵
  PID:11444
- C:\Windows\System\HEFlYld.exe
  C:\Windows\System\HEFlYld.exe
  2⤵
  PID:11460
- C:\Windows\System\ZgQXaEM.exe
  C:\Windows\System\ZgQXaEM.exe
  2⤵
  PID:11488
- C:\Windows\System\CyVyknt.exe
  C:\Windows\System\CyVyknt.exe
  2⤵
  PID:11516
- C:\Windows\System\yIbcEsi.exe
  C:\Windows\System\yIbcEsi.exe
  2⤵
  PID:11540
- C:\Windows\System\mJIApza.exe
  C:\Windows\System\mJIApza.exe
  2⤵
  PID:11576
- C:\Windows\System\YWNFZXD.exe
  C:\Windows\System\YWNFZXD.exe
  2⤵
  PID:11600
- C:\Windows\System\aMgoEcH.exe
  C:\Windows\System\aMgoEcH.exe
  2⤵
  PID:11624
- C:\Windows\System\rfvAYzK.exe
  C:\Windows\System\rfvAYzK.exe
  2⤵
  PID:11644
- C:\Windows\System\RGcxtZu.exe
  C:\Windows\System\RGcxtZu.exe
  2⤵
  PID:11668
- C:\Windows\System\VlQVWHU.exe
  C:\Windows\System\VlQVWHU.exe
  2⤵
  PID:11700
- C:\Windows\System\AYbXQVR.exe
  C:\Windows\System\AYbXQVR.exe
  2⤵
  PID:11724
- C:\Windows\System\qcWQWdR.exe
  C:\Windows\System\qcWQWdR.exe
  2⤵
  PID:11752
- C:\Windows\System\cEAmWfu.exe
  C:\Windows\System\cEAmWfu.exe
  2⤵
  PID:11772
- C:\Windows\System\JbIWNRW.exe
  C:\Windows\System\JbIWNRW.exe
  2⤵
  PID:11796
- C:\Windows\System\pRnBcbB.exe
  C:\Windows\System\pRnBcbB.exe
  2⤵
  PID:11836
- C:\Windows\System\lSKnJeg.exe
  C:\Windows\System\lSKnJeg.exe
  2⤵
  PID:11864
- C:\Windows\System\dmsONDk.exe
  C:\Windows\System\dmsONDk.exe
  2⤵
  PID:11896
- C:\Windows\System\byVtSqV.exe
  C:\Windows\System\byVtSqV.exe
  2⤵
  PID:11932
- C:\Windows\System\yAJpEvw.exe
  C:\Windows\System\yAJpEvw.exe
  2⤵
  PID:11960
- C:\Windows\System\kxQUZZu.exe
  C:\Windows\System\kxQUZZu.exe
  2⤵
  PID:11980
- C:\Windows\System\hsWTHmc.exe
  C:\Windows\System\hsWTHmc.exe
  2⤵
  PID:12016
- C:\Windows\System\tFrXABf.exe
  C:\Windows\System\tFrXABf.exe
  2⤵
  PID:12032
- C:\Windows\System\LcwkSxO.exe
  C:\Windows\System\LcwkSxO.exe
  2⤵
  PID:12072
- C:\Windows\System\JKewBVZ.exe
  C:\Windows\System\JKewBVZ.exe
  2⤵
  PID:12092
- C:\Windows\System\AqxXGPx.exe
  C:\Windows\System\AqxXGPx.exe
  2⤵
  PID:12108
- C:\Windows\System\NVBJjgg.exe
  C:\Windows\System\NVBJjgg.exe
  2⤵
  PID:12132
- C:\Windows\System\dyxWqjE.exe
  C:\Windows\System\dyxWqjE.exe
  2⤵
  PID:12156
- C:\Windows\System\uMSERZq.exe
  C:\Windows\System\uMSERZq.exe
  2⤵
  PID:12188
- C:\Windows\System\oIdHusT.exe
  C:\Windows\System\oIdHusT.exe
  2⤵
  PID:12216
- C:\Windows\System\FYwYeSu.exe
  C:\Windows\System\FYwYeSu.exe
  2⤵
  PID:12232
- C:\Windows\System\JYLfwMN.exe
  C:\Windows\System\JYLfwMN.exe
  2⤵
  PID:12252
- C:\Windows\System\thUXHcR.exe
  C:\Windows\System\thUXHcR.exe
  2⤵
  PID:10976
- C:\Windows\System\mwLDQtm.exe
  C:\Windows\System\mwLDQtm.exe
  2⤵
  PID:10420
- C:\Windows\System\bIXVTgd.exe
  C:\Windows\System\bIXVTgd.exe
  2⤵
  PID:11108
- C:\Windows\System\WEgcfuq.exe
  C:\Windows\System\WEgcfuq.exe
  2⤵
  PID:11436
- C:\Windows\System\EipTrSz.exe
  C:\Windows\System\EipTrSz.exe
  2⤵
  PID:11328
- C:\Windows\System\sbaRuMG.exe
  C:\Windows\System\sbaRuMG.exe
  2⤵
  PID:11568
- C:\Windows\System\NBxzKry.exe
  C:\Windows\System\NBxzKry.exe
  2⤵
  PID:11616
- C:\Windows\System\QZzBobf.exe
  C:\Windows\System\QZzBobf.exe
  2⤵
  PID:11432
- C:\Windows\System\IkWypbg.exe
  C:\Windows\System\IkWypbg.exe
  2⤵
  PID:11820
- C:\Windows\System\yrWOckV.exe
  C:\Windows\System\yrWOckV.exe
  2⤵
  PID:11872
- C:\Windows\System\KLzPeXB.exe
  C:\Windows\System\KLzPeXB.exe
  2⤵
  PID:11744
- C:\Windows\System\xxgJxnD.exe
  C:\Windows\System\xxgJxnD.exe
  2⤵
  PID:11920
- C:\Windows\System\cEdCqWF.exe
  C:\Windows\System\cEdCqWF.exe
  2⤵
  PID:11952
- C:\Windows\System\eCPnMnY.exe
  C:\Windows\System\eCPnMnY.exe
  2⤵
  PID:11944
- C:\Windows\System\vqlmYpD.exe
  C:\Windows\System\vqlmYpD.exe
  2⤵
  PID:11860
- C:\Windows\System\uCxBaJA.exe
  C:\Windows\System\uCxBaJA.exe
  2⤵
  PID:12028
- C:\Windows\System\JDOZxEQ.exe
  C:\Windows\System\JDOZxEQ.exe
  2⤵
  PID:11968
- C:\Windows\System\viueuFQ.exe
  C:\Windows\System\viueuFQ.exe
  2⤵
  PID:12264
- C:\Windows\System\UlbJklI.exe
  C:\Windows\System\UlbJklI.exe
  2⤵
  PID:11200
- C:\Windows\System\FYrfBQx.exe
  C:\Windows\System\FYrfBQx.exe
  2⤵
  PID:12084
- C:\Windows\System\CGbBLAR.exe
  C:\Windows\System\CGbBLAR.exe
  2⤵
  PID:11272
- C:\Windows\System\uWbRfwb.exe
  C:\Windows\System\uWbRfwb.exe
  2⤵
  PID:12272
- C:\Windows\System\agPbjlK.exe
  C:\Windows\System\agPbjlK.exe
  2⤵
  PID:11504
- C:\Windows\System\YSTGOKk.exe
  C:\Windows\System\YSTGOKk.exe
  2⤵
  PID:12228
- C:\Windows\System\miUYBRf.exe
  C:\Windows\System\miUYBRf.exe
  2⤵
  PID:11740
- C:\Windows\System\zBerIAL.exe
  C:\Windows\System\zBerIAL.exe
  2⤵
  PID:12144
- C:\Windows\System\oBsWfky.exe
  C:\Windows\System\oBsWfky.exe
  2⤵
  PID:12208
- C:\Windows\System\MpFDEgF.exe
  C:\Windows\System\MpFDEgF.exe
  2⤵
  PID:12308
- C:\Windows\System\FUXToqY.exe
  C:\Windows\System\FUXToqY.exe
  2⤵
  PID:12348
- C:\Windows\System\ondccCG.exe
  C:\Windows\System\ondccCG.exe
  2⤵
  PID:12376
- C:\Windows\System\sStRxNp.exe
  C:\Windows\System\sStRxNp.exe
  2⤵
  PID:12396
- C:\Windows\System\tlmjbyu.exe
  C:\Windows\System\tlmjbyu.exe
  2⤵
  PID:12424
- C:\Windows\System\NWDlgMf.exe
  C:\Windows\System\NWDlgMf.exe
  2⤵
  PID:12448
- C:\Windows\System\poSolwJ.exe
  C:\Windows\System\poSolwJ.exe
  2⤵
  PID:12472
- C:\Windows\System\QuUksMr.exe
  C:\Windows\System\QuUksMr.exe
  2⤵
  PID:12488
- C:\Windows\System\tGUTbKx.exe
  C:\Windows\System\tGUTbKx.exe
  2⤵
  PID:12504
- C:\Windows\System\NCExzAG.exe
  C:\Windows\System\NCExzAG.exe
  2⤵
  PID:12520
- C:\Windows\System\AEsnjnz.exe
  C:\Windows\System\AEsnjnz.exe
  2⤵
  PID:12556
- C:\Windows\System\QdKGNZX.exe
  C:\Windows\System\QdKGNZX.exe
  2⤵
  PID:12576
- C:\Windows\System\UwdJjvb.exe
  C:\Windows\System\UwdJjvb.exe
  2⤵
  PID:12604
- C:\Windows\System\hvqgyXf.exe
  C:\Windows\System\hvqgyXf.exe
  2⤵
  PID:12628
- C:\Windows\System\VPVmGvV.exe
  C:\Windows\System\VPVmGvV.exe
  2⤵
  PID:12660
- C:\Windows\System\MvUwqkV.exe
  C:\Windows\System\MvUwqkV.exe
  2⤵
  PID:12680
- C:\Windows\System\fekjBEh.exe
  C:\Windows\System\fekjBEh.exe
  2⤵
  PID:12704
- C:\Windows\System\bqPagXi.exe
  C:\Windows\System\bqPagXi.exe
  2⤵
  PID:12720
- C:\Windows\System\GICHYNJ.exe
  C:\Windows\System\GICHYNJ.exe
  2⤵
  PID:12736
- C:\Windows\System\MDgYSFB.exe
  C:\Windows\System\MDgYSFB.exe
  2⤵
  PID:12760
- C:\Windows\System\NvnqbxQ.exe
  C:\Windows\System\NvnqbxQ.exe
  2⤵
  PID:12788
- C:\Windows\System\bUmzrmD.exe
  C:\Windows\System\bUmzrmD.exe
  2⤵
  PID:12808
- C:\Windows\System\bZLkygs.exe
  C:\Windows\System\bZLkygs.exe
  2⤵
  PID:12844
- C:\Windows\System\XunpEuj.exe
  C:\Windows\System\XunpEuj.exe
  2⤵
  PID:12864
- C:\Windows\System\KJVDghj.exe
  C:\Windows\System\KJVDghj.exe
  2⤵
  PID:12900
- C:\Windows\System\hIsnmKO.exe
  C:\Windows\System\hIsnmKO.exe
  2⤵
  PID:12928
- C:\Windows\System\YqxRkrd.exe
  C:\Windows\System\YqxRkrd.exe
  2⤵
  PID:12952
- C:\Windows\System\WxAuuDL.exe
  C:\Windows\System\WxAuuDL.exe
  2⤵
  PID:12976
- C:\Windows\System\kxsVPnD.exe
  C:\Windows\System\kxsVPnD.exe
  2⤵
  PID:13004
- C:\Windows\System\daBcrgP.exe
  C:\Windows\System\daBcrgP.exe
  2⤵
  PID:13040
- C:\Windows\System\CxVVllI.exe
  C:\Windows\System\CxVVllI.exe
  2⤵
  PID:13056
- C:\Windows\System\iKAsVWh.exe
  C:\Windows\System\iKAsVWh.exe
  2⤵
  PID:13080
- C:\Windows\System\yTJwKuj.exe
  C:\Windows\System\yTJwKuj.exe
  2⤵
  PID:13112
- C:\Windows\System\gfxGJCp.exe
  C:\Windows\System\gfxGJCp.exe
  2⤵
  PID:13136
- C:\Windows\System\gKRmlHd.exe
  C:\Windows\System\gKRmlHd.exe
  2⤵
  PID:13156
- C:\Windows\System\EDkdfGu.exe
  C:\Windows\System\EDkdfGu.exe
  2⤵
  PID:13184
- C:\Windows\System\lXQJbVN.exe
  C:\Windows\System\lXQJbVN.exe
  2⤵
  PID:13212
- C:\Windows\System\duLiWtb.exe
  C:\Windows\System\duLiWtb.exe
  2⤵
  PID:13228
- C:\Windows\System\dTrdzgF.exe
  C:\Windows\System\dTrdzgF.exe
  2⤵
  PID:13248
- C:\Windows\System\dxRZJjP.exe
  C:\Windows\System\dxRZJjP.exe
  2⤵
  PID:13268
- C:\Windows\System\VXlVrRe.exe
  C:\Windows\System\VXlVrRe.exe
  2⤵
  PID:13296
- C:\Windows\System\uNrCpky.exe
  C:\Windows\System\uNrCpky.exe
  2⤵
  PID:11276
- C:\Windows\System\jmyMDlt.exe
  C:\Windows\System\jmyMDlt.exe
  2⤵
  PID:11996
- C:\Windows\System\PlKmJLU.exe
  C:\Windows\System\PlKmJLU.exe
  2⤵
  PID:12052
- C:\Windows\System\CLJlvxG.exe
  C:\Windows\System\CLJlvxG.exe
  2⤵
  PID:11456
- C:\Windows\System\NuDsITk.exe
  C:\Windows\System\NuDsITk.exe
  2⤵
  PID:12404
- C:\Windows\System\LWIQjAK.exe
  C:\Windows\System\LWIQjAK.exe
  2⤵
  PID:10564
- C:\Windows\System\vhrbsJT.exe
  C:\Windows\System\vhrbsJT.exe
  2⤵
  PID:12540
- C:\Windows\System\qRemONF.exe
  C:\Windows\System\qRemONF.exe
  2⤵
  PID:12584
- C:\Windows\System\RFhftYm.exe
  C:\Windows\System\RFhftYm.exe
  2⤵
  PID:12656
- C:\Windows\System\YsbrqxO.exe
  C:\Windows\System\YsbrqxO.exe
  2⤵
  PID:12728
- C:\Windows\System\iNTYbhC.exe
  C:\Windows\System\iNTYbhC.exe
  2⤵
  PID:12388
- C:\Windows\System\UwUyPUM.exe
  C:\Windows\System\UwUyPUM.exe
  2⤵
  PID:12896
- C:\Windows\System\ENiGcNT.exe
  C:\Windows\System\ENiGcNT.exe
  2⤵
  PID:12692
- C:\Windows\System\VIrTJWZ.exe
  C:\Windows\System\VIrTJWZ.exe
  2⤵
  PID:12996
- C:\Windows\System\PnqMTJV.exe
  C:\Windows\System\PnqMTJV.exe
  2⤵
  PID:12804
- C:\Windows\System\VbnEjOw.exe
  C:\Windows\System\VbnEjOw.exe
  2⤵
  PID:12828
- C:\Windows\System\COoSniL.exe
  C:\Windows\System\COoSniL.exe
  2⤵
  PID:13088
- C:\Windows\System\HcmDqDZ.exe
  C:\Windows\System\HcmDqDZ.exe
  2⤵
  PID:13168
- C:\Windows\System\BlNntFo.exe
  C:\Windows\System\BlNntFo.exe
  2⤵
  PID:13240
- C:\Windows\System\QQmtxDr.exe
  C:\Windows\System\QQmtxDr.exe
  2⤵
  PID:13292
- C:\Windows\System\OMNfvTn.exe
  C:\Windows\System\OMNfvTn.exe
  2⤵
  PID:12304
- C:\Windows\System\etLHPMQ.exe
  C:\Windows\System\etLHPMQ.exe
  2⤵
  PID:13308
- C:\Windows\System\HebajDH.exe
  C:\Windows\System\HebajDH.exe
  2⤵
  PID:12944
- C:\Windows\System\THuDfGm.exe
  C:\Windows\System\THuDfGm.exe
  2⤵
  PID:13340
- C:\Windows\System\LhpJVns.exe
  C:\Windows\System\LhpJVns.exe
  2⤵
  PID:13364
- C:\Windows\System\PPjeLfy.exe
  C:\Windows\System\PPjeLfy.exe
  2⤵
  PID:13392
- C:\Windows\System\njMNDys.exe
  C:\Windows\System\njMNDys.exe
  2⤵
  PID:13416
- C:\Windows\System\zozmpVD.exe
  C:\Windows\System\zozmpVD.exe
  2⤵
  PID:13448
- C:\Windows\System\yMhVOHS.exe
  C:\Windows\System\yMhVOHS.exe
  2⤵
  PID:13476
- C:\Windows\System\JGSihLw.exe
  C:\Windows\System\JGSihLw.exe
  2⤵
  PID:13512
- C:\Windows\System\WIXbOyR.exe
  C:\Windows\System\WIXbOyR.exe
  2⤵
  PID:13536
- C:\Windows\System\csjPQyt.exe
  C:\Windows\System\csjPQyt.exe
  2⤵
  PID:13556
- C:\Windows\System\RODxoVG.exe
  C:\Windows\System\RODxoVG.exe
  2⤵
  PID:13592
- C:\Windows\System\kPoeeFG.exe
  C:\Windows\System\kPoeeFG.exe
  2⤵
  PID:13616
- C:\Windows\System\PCNKHTr.exe
  C:\Windows\System\PCNKHTr.exe
  2⤵
  PID:13640
- C:\Windows\System\lxNbuZo.exe
  C:\Windows\System\lxNbuZo.exe
  2⤵
  PID:13668
- C:\Windows\System\RTRZeeu.exe
  C:\Windows\System\RTRZeeu.exe
  2⤵
  PID:13696
- C:\Windows\System\lDUVRdk.exe
  C:\Windows\System\lDUVRdk.exe
  2⤵
  PID:13720
- C:\Windows\System\eZEtLev.exe
  C:\Windows\System\eZEtLev.exe
  2⤵
  PID:13752
- C:\Windows\System\OfrChkr.exe
  C:\Windows\System\OfrChkr.exe
  2⤵
  PID:13788
- C:\Windows\System\hCyiFFq.exe
  C:\Windows\System\hCyiFFq.exe
  2⤵
  PID:13808
- C:\Windows\System\TgwNbRq.exe
  C:\Windows\System\TgwNbRq.exe
  2⤵
  PID:13836
- C:\Windows\System\DhlBKZz.exe
  C:\Windows\System\DhlBKZz.exe
  2⤵
  PID:13856
- C:\Windows\System\tFmTWJZ.exe
  C:\Windows\System\tFmTWJZ.exe
  2⤵
  PID:13884
- C:\Windows\System\YuWNJEE.exe
  C:\Windows\System\YuWNJEE.exe
  2⤵
  PID:13912
- C:\Windows\System\VpOAOEp.exe
  C:\Windows\System\VpOAOEp.exe
  2⤵
  PID:13936
- C:\Windows\System\ePkGgdj.exe
  C:\Windows\System\ePkGgdj.exe
  2⤵
  PID:13956
- C:\Windows\System\yPnzMLl.exe
  C:\Windows\System\yPnzMLl.exe
  2⤵
  PID:13988
- C:\Windows\System\kduZSOS.exe
  C:\Windows\System\kduZSOS.exe
  2⤵
  PID:14016
- C:\Windows\System\uMAIprg.exe
  C:\Windows\System\uMAIprg.exe
  2⤵
  PID:14040
- C:\Windows\System\UomYfhH.exe
  C:\Windows\System\UomYfhH.exe
  2⤵
  PID:14060
- C:\Windows\System\UJxPOnl.exe
  C:\Windows\System\UJxPOnl.exe
  2⤵
  PID:14084
- C:\Windows\System\UuEmNtX.exe
  C:\Windows\System\UuEmNtX.exe
  2⤵
  PID:14104
- C:\Windows\System\YqfKnLj.exe
  C:\Windows\System\YqfKnLj.exe
  2⤵
  PID:14136
- C:\Windows\System\SDnAYSq.exe
  C:\Windows\System\SDnAYSq.exe
  2⤵
  PID:14160
- C:\Windows\System\gdAMEeG.exe
  C:\Windows\System\gdAMEeG.exe
  2⤵
  PID:14184
- C:\Windows\System\mTqMbXA.exe
  C:\Windows\System\mTqMbXA.exe
  2⤵
  PID:14204
- C:\Windows\System\lwVjhsl.exe
  C:\Windows\System\lwVjhsl.exe
  2⤵
  PID:14244
- C:\Windows\System\eHNsrzV.exe
  C:\Windows\System\eHNsrzV.exe
  2⤵
  PID:14272
- C:\Windows\System\QugQrBL.exe
  C:\Windows\System\QugQrBL.exe
  2⤵
  PID:14292
- C:\Windows\System\vPmzfxz.exe
  C:\Windows\System\vPmzfxz.exe
  2⤵
  PID:14316
- C:\Windows\System\osdGMAg.exe
  C:\Windows\System\osdGMAg.exe
  2⤵
  PID:12972
- C:\Windows\System\TxWSAIY.exe
  C:\Windows\System\TxWSAIY.exe
  2⤵
  PID:13220
- C:\Windows\System\cUHZKom.exe
  C:\Windows\System\cUHZKom.exe
  2⤵
  PID:12548
- C:\Windows\System\YmXQejj.exe
  C:\Windows\System\YmXQejj.exe
  2⤵
  PID:13124
- C:\Windows\System\oFqUpIJ.exe
  C:\Windows\System\oFqUpIJ.exe
  2⤵
  PID:12316
- C:\Windows\System\FfeMHDe.exe
  C:\Windows\System\FfeMHDe.exe
  2⤵
  PID:12564
- C:\Windows\System\etoNbOi.exe
  C:\Windows\System\etoNbOi.exe
  2⤵
  PID:13444
- C:\Windows\System\dcHUMEm.exe
  C:\Windows\System\dcHUMEm.exe
  2⤵
  PID:13496
- C:\Windows\System\iewFCUn.exe
  C:\Windows\System\iewFCUn.exe
  2⤵
  PID:13532
- C:\Windows\System\mHfRvtm.exe
  C:\Windows\System\mHfRvtm.exe
  2⤵
  PID:13568
- C:\Windows\System\oqebtmV.exe
  C:\Windows\System\oqebtmV.exe
  2⤵
  PID:12884
- C:\Windows\System\foKnDqi.exe
  C:\Windows\System\foKnDqi.exe
  2⤵
  PID:12008
- C:\Windows\System\kGPgpgi.exe
  C:\Windows\System\kGPgpgi.exe
  2⤵
  PID:13328
- C:\Windows\System\WqDwApk.exe
  C:\Windows\System\WqDwApk.exe
  2⤵
  PID:12820
- C:\Windows\System\QrrJNhl.exe
  C:\Windows\System\QrrJNhl.exe
  2⤵
  PID:13764
- C:\Windows\System\CLCkVpY.exe
  C:\Windows\System\CLCkVpY.exe
  2⤵
  PID:13848
- C:\Windows\System\EgNTKOh.exe
  C:\Windows\System\EgNTKOh.exe
  2⤵
  PID:13652
- C:\Windows\System\ZaFnbyg.exe
  C:\Windows\System\ZaFnbyg.exe
  2⤵
  PID:13976
- C:\Windows\System\ylYxjcz.exe
  C:\Windows\System\ylYxjcz.exe
  2⤵
  PID:14032
- C:\Windows\System\PxDCHtd.exe
  C:\Windows\System\PxDCHtd.exe
  2⤵
  PID:13780
- C:\Windows\System\CScCtnt.exe
  C:\Windows\System\CScCtnt.exe
  2⤵
  PID:13604
- C:\Windows\System\lxMLRuC.exe
  C:\Windows\System\lxMLRuC.exe
  2⤵
  PID:13944
- C:\Windows\System\vzAmMeM.exe
  C:\Windows\System\vzAmMeM.exe
  2⤵
  PID:14308
- C:\Windows\System\YSZfKzB.exe
  C:\Windows\System\YSZfKzB.exe
  2⤵
  PID:13828
- C:\Windows\System\vjaOAcF.exe
  C:\Windows\System\vjaOAcF.exe
  2⤵
  PID:14128
- C:\Windows\System\UkGiAce.exe
  C:\Windows\System\UkGiAce.exe
  2⤵
  PID:14156
- C:\Windows\System\HahJBrr.exe
  C:\Windows\System\HahJBrr.exe
  2⤵
  PID:14228
- C:\Windows\System\qBtOBQn.exe
  C:\Windows\System\qBtOBQn.exe
  2⤵
  PID:14348
- C:\Windows\System\gbAtfTp.exe
  C:\Windows\System\gbAtfTp.exe
  2⤵
  PID:14372
- C:\Windows\System\uiEgEHE.exe
  C:\Windows\System\uiEgEHE.exe
  2⤵
  PID:14400
- C:\Windows\System\DfvBDqi.exe
  C:\Windows\System\DfvBDqi.exe
  2⤵
  PID:14416
- C:\Windows\System\JdsrRra.exe
  C:\Windows\System\JdsrRra.exe
  2⤵
  PID:14452
- C:\Windows\System\AabHIzv.exe
  C:\Windows\System\AabHIzv.exe
  2⤵
  PID:14480
- C:\Windows\System\bXavFBA.exe
  C:\Windows\System\bXavFBA.exe
  2⤵
  PID:14504
- C:\Windows\System\oshWIxs.exe
  C:\Windows\System\oshWIxs.exe
  2⤵
  PID:14532
- C:\Windows\System\KInlQWK.exe
  C:\Windows\System\KInlQWK.exe
  2⤵
  PID:14568
- C:\Windows\System\nDkbuCX.exe
  C:\Windows\System\nDkbuCX.exe
  2⤵
  PID:14592
- C:\Windows\System\IlamIKj.exe
  C:\Windows\System\IlamIKj.exe
  2⤵
  PID:14620
- C:\Windows\System\Rttjuoz.exe
  C:\Windows\System\Rttjuoz.exe
  2⤵
  PID:14652
- C:\Windows\System\cvrPeiH.exe
  C:\Windows\System\cvrPeiH.exe
  2⤵
  PID:14676
- C:\Windows\System\hwwwnEP.exe
  C:\Windows\System\hwwwnEP.exe
  2⤵
  PID:14692
- C:\Windows\System\zfEPITX.exe
  C:\Windows\System\zfEPITX.exe
  2⤵
  PID:14720
- C:\Windows\System\HWXFcUS.exe
  C:\Windows\System\HWXFcUS.exe
  2⤵
  PID:14740
- C:\Windows\System\zcCOgvq.exe
  C:\Windows\System\zcCOgvq.exe
  2⤵
  PID:14772
- C:\Windows\System\rohxuIV.exe
  C:\Windows\System\rohxuIV.exe
  2⤵
  PID:14804
- C:\Windows\System\HNAhtpO.exe
  C:\Windows\System\HNAhtpO.exe
  2⤵
  PID:14828
- C:\Windows\System\mkpGboL.exe
  C:\Windows\System\mkpGboL.exe
  2⤵
  PID:14852
- C:\Windows\System\fAJrMAK.exe
  C:\Windows\System\fAJrMAK.exe
  2⤵
  PID:14872
- C:\Windows\System\cITMAhd.exe
  C:\Windows\System\cITMAhd.exe
  2⤵
  PID:14900
- C:\Windows\System\LvZgUlI.exe
  C:\Windows\System\LvZgUlI.exe
  2⤵
  PID:14924
- C:\Windows\System\voHTBdM.exe
  C:\Windows\System\voHTBdM.exe
  2⤵
  PID:14956
- C:\Windows\System\bNmztfG.exe
  C:\Windows\System\bNmztfG.exe
  2⤵
  PID:14988
- C:\Windows\System\ajjTDsM.exe
  C:\Windows\System\ajjTDsM.exe
  2⤵
  PID:15012
- C:\Windows\System\yFWNyLG.exe
  C:\Windows\System\yFWNyLG.exe
  2⤵
  PID:15036
- C:\Windows\System\iNVjBVw.exe
  C:\Windows\System\iNVjBVw.exe
  2⤵
  PID:15060
- C:\Windows\System\SqSgBcY.exe
  C:\Windows\System\SqSgBcY.exe
  2⤵
  PID:15088
- C:\Windows\System\rJnGjJS.exe
  C:\Windows\System\rJnGjJS.exe
  2⤵
  PID:15116
- C:\Windows\System\EgllfhB.exe
  C:\Windows\System\EgllfhB.exe
  2⤵
  PID:15136
- C:\Windows\System\eWPZNKA.exe
  C:\Windows\System\eWPZNKA.exe
  2⤵
  PID:15156
- C:\Windows\System\SaZwoEf.exe
  C:\Windows\System\SaZwoEf.exe
  2⤵
  PID:15188
- C:\Windows\System\yKIlRue.exe
  C:\Windows\System\yKIlRue.exe
  2⤵
  PID:15224
- C:\Windows\System\OFJrGJw.exe
  C:\Windows\System\OFJrGJw.exe
  2⤵
  PID:15244
- C:\Windows\System\emchgXn.exe
  C:\Windows\System\emchgXn.exe
  2⤵
  PID:15260
- C:\Windows\System\ExoJMCc.exe
  C:\Windows\System\ExoJMCc.exe
  2⤵
  PID:15280
- C:\Windows\System\wANfUzH.exe
  C:\Windows\System\wANfUzH.exe
  2⤵
  PID:15324
- C:\Windows\System\XOzZDjZ.exe
  C:\Windows\System\XOzZDjZ.exe
  2⤵
  PID:14304
- C:\Windows\System\MrsbbEh.exe
  C:\Windows\System\MrsbbEh.exe
  2⤵
  PID:13404
- C:\Windows\System\zRERtSB.exe
  C:\Windows\System\zRERtSB.exe
  2⤵
  PID:12500
- C:\Windows\System\kMVujia.exe
  C:\Windows\System\kMVujia.exe
  2⤵
  PID:11428
- C:\Windows\System\IAfkrHz.exe
  C:\Windows\System\IAfkrHz.exe
  2⤵
  PID:13348
- C:\Windows\System\xcObjwM.exe
  C:\Windows\System\xcObjwM.exe
  2⤵
  PID:14280
- C:\Windows\System\bvPEMcx.exe
  C:\Windows\System\bvPEMcx.exe
  2⤵
  PID:14116
- C:\Windows\System\sJxljsj.exe
  C:\Windows\System\sJxljsj.exe
  2⤵
  PID:13636
- C:\Windows\System\UdPrGqm.exe
  C:\Windows\System\UdPrGqm.exe
  2⤵
  PID:13948
- C:\Windows\System\SHPbTMa.exe
  C:\Windows\System\SHPbTMa.exe
  2⤵
  PID:13412
- C:\Windows\System\dNpnogu.exe
  C:\Windows\System\dNpnogu.exe
  2⤵
  PID:14616
- C:\Windows\System\AMiWxdE.exe
  C:\Windows\System\AMiWxdE.exe
  2⤵
  PID:14672
- C:\Windows\System\HBBXVtX.exe
  C:\Windows\System\HBBXVtX.exe
  2⤵
  PID:14732
- C:\Windows\System\DByEghU.exe
  C:\Windows\System\DByEghU.exe
  2⤵
  PID:13680
- C:\Windows\System\DaFfaaT.exe
  C:\Windows\System\DaFfaaT.exe
  2⤵
  PID:13524
- C:\Windows\System\TCZbBHE.exe
  C:\Windows\System\TCZbBHE.exe
  2⤵
  PID:15028
- C:\Windows\System\GgUIDlA.exe
  C:\Windows\System\GgUIDlA.exe
  2⤵
  PID:14576
- C:\Windows\System\fcGsaLZ.exe
  C:\Windows\System\fcGsaLZ.exe
  2⤵
  PID:14632
- C:\Windows\System\wGcFEAW.exe
  C:\Windows\System\wGcFEAW.exe
  2⤵
  PID:15124
- C:\Windows\System\PdLTxWW.exe
  C:\Windows\System\PdLTxWW.exe
  2⤵
  PID:14144
- C:\Windows\System\iHkhLun.exe
  C:\Windows\System\iHkhLun.exe
  2⤵
  PID:14468
- C:\Windows\System\hxycHXC.exe
  C:\Windows\System\hxycHXC.exe
  2⤵
  PID:14784
- C:\Windows\System\JpNABiN.exe
  C:\Windows\System\JpNABiN.exe
  2⤵
  PID:14840
- C:\Windows\System\AsWkUdx.exe
  C:\Windows\System\AsWkUdx.exe
  2⤵
  PID:15364
- C:\Windows\System\kpMkSIS.exe
  C:\Windows\System\kpMkSIS.exe
  2⤵
  PID:15384
- C:\Windows\System\oUWHaxn.exe
  C:\Windows\System\oUWHaxn.exe
  2⤵
  PID:15400
- C:\Windows\System\aqOmgqB.exe
  C:\Windows\System\aqOmgqB.exe
  2⤵
  PID:15420
- C:\Windows\System\YbtJAlZ.exe
  C:\Windows\System\YbtJAlZ.exe
  2⤵
  PID:15444
- C:\Windows\System\mMGqMgr.exe
  C:\Windows\System\mMGqMgr.exe
  2⤵
  PID:15464
- C:\Windows\System\hCSSWlq.exe
  C:\Windows\System\hCSSWlq.exe
  2⤵
  PID:15484
- C:\Windows\System\IvqJwik.exe
  C:\Windows\System\IvqJwik.exe
  2⤵
  PID:15512
- C:\Windows\System\txVHRaJ.exe
  C:\Windows\System\txVHRaJ.exe
  2⤵
  PID:15536
- C:\Windows\System\GdIQJvY.exe
  C:\Windows\System\GdIQJvY.exe
  2⤵
  PID:15556
- C:\Windows\System\BeMonZP.exe
  C:\Windows\System\BeMonZP.exe
  2⤵
  PID:15588
- C:\Windows\System\YkxciHF.exe
  C:\Windows\System\YkxciHF.exe
  2⤵
  PID:15616
- C:\Windows\System\gGzdKsS.exe
  C:\Windows\System\gGzdKsS.exe
  2⤵
  PID:15644
- C:\Windows\System\VLMoLEG.exe
  C:\Windows\System\VLMoLEG.exe
  2⤵
  PID:15688
- C:\Windows\System\nqJzjGI.exe
  C:\Windows\System\nqJzjGI.exe
  2⤵
  PID:15712
- C:\Windows\System\VfRfehB.exe
  C:\Windows\System\VfRfehB.exe
  2⤵
  PID:15752
- C:\Windows\System\LgmJDKZ.exe
  C:\Windows\System\LgmJDKZ.exe
  2⤵
  PID:15772
- C:\Windows\System\mGjdeOI.exe
  C:\Windows\System\mGjdeOI.exe
  2⤵
  PID:15800
- C:\Windows\System\HLpqtjU.exe
  C:\Windows\System\HLpqtjU.exe
  2⤵
  PID:15832
- C:\Windows\System\aIsxKpR.exe
  C:\Windows\System\aIsxKpR.exe
  2⤵
  PID:15856
- C:\Windows\System\ucaWSYN.exe
  C:\Windows\System\ucaWSYN.exe
  2⤵
  PID:15884
- C:\Windows\System\kHVAvVz.exe
  C:\Windows\System\kHVAvVz.exe
  2⤵
  PID:15920
- C:\Windows\System\TmbHIUa.exe
  C:\Windows\System\TmbHIUa.exe
  2⤵
  PID:15948
- C:\Windows\System\JbQnHiV.exe
  C:\Windows\System\JbQnHiV.exe
  2⤵
  PID:15972
- C:\Windows\System\AxqTZZE.exe
  C:\Windows\System\AxqTZZE.exe
  2⤵
  PID:15992
- C:\Windows\System\DkZbwfb.exe
  C:\Windows\System\DkZbwfb.exe
  2⤵
  PID:16012
- C:\Windows\System\lqhOSkm.exe
  C:\Windows\System\lqhOSkm.exe
  2⤵
  PID:16036
- C:\Windows\System\WzDTecd.exe
  C:\Windows\System\WzDTecd.exe
  2⤵
  PID:16060
- C:\Windows\System\phhoZEO.exe
  C:\Windows\System\phhoZEO.exe
  2⤵
  PID:16088
- C:\Windows\System\ZwPdYKh.exe
  C:\Windows\System\ZwPdYKh.exe
  2⤵
  PID:16116
- C:\Windows\System\XyUbxxp.exe
  C:\Windows\System\XyUbxxp.exe
  2⤵
  PID:16140
- C:\Windows\System\yuToQhq.exe
  C:\Windows\System\yuToQhq.exe
  2⤵
  PID:16168
- C:\Windows\System\GDYSCEo.exe
  C:\Windows\System\GDYSCEo.exe
  2⤵
  PID:16184
- C:\Windows\System\paTHPZW.exe
  C:\Windows\System\paTHPZW.exe
  2⤵
  PID:16216
- C:\Windows\System\NsBQxda.exe
  C:\Windows\System\NsBQxda.exe
  2⤵
  PID:16248
- C:\Windows\System\OPREUVt.exe
  C:\Windows\System\OPREUVt.exe
  2⤵
  PID:16276
- C:\Windows\System\tdzLmLd.exe
  C:\Windows\System\tdzLmLd.exe
  2⤵
  PID:16296
- C:\Windows\System\OGqNbin.exe
  C:\Windows\System\OGqNbin.exe
  2⤵
  PID:16328
- C:\Windows\System\aRvapDU.exe
  C:\Windows\System\aRvapDU.exe
  2⤵
  PID:16344
- C:\Windows\System\MqOopiL.exe
  C:\Windows\System\MqOopiL.exe
  2⤵
  PID:16368
- C:\Windows\System\FJWqvTa.exe
  C:\Windows\System\FJWqvTa.exe
  2⤵
  PID:12600
- C:\Windows\System\BajorcR.exe
  C:\Windows\System\BajorcR.exe
  2⤵
  PID:14180
- C:\Windows\System\JEChrzU.exe
  C:\Windows\System\JEChrzU.exe
  2⤵
  PID:14888
- C:\Windows\System\jSalHZy.exe
  C:\Windows\System\jSalHZy.exe
  2⤵
  PID:14948
- C:\Windows\System\bMsURFy.exe
  C:\Windows\System\bMsURFy.exe
  2⤵
  PID:15052
- C:\Windows\System\biKMlsI.exe
  C:\Windows\System\biKMlsI.exe
  2⤵
  PID:15352
- C:\Windows\System\TPzOIZA.exe
  C:\Windows\System\TPzOIZA.exe
  2⤵
  PID:15236
- C:\Windows\System\HRLCdeK.exe
  C:\Windows\System\HRLCdeK.exe
  2⤵
  PID:15272
- C:\Windows\System\EibwndX.exe
  C:\Windows\System\EibwndX.exe
  2⤵
  PID:15372
- C:\Windows\System\dwCWzTx.exe
  C:\Windows\System\dwCWzTx.exe
  2⤵
  PID:13176
- C:\Windows\System\tBquYqi.exe
  C:\Windows\System\tBquYqi.exe
  2⤵
  PID:15504
- C:\Windows\System\cMadzPp.exe
  C:\Windows\System\cMadzPp.exe
  2⤵
  PID:14520
- C:\Windows\System\FuZhpwX.exe
  C:\Windows\System\FuZhpwX.exe
  2⤵
  PID:15576
- C:\Windows\System\cacaPuQ.exe
  C:\Windows\System\cacaPuQ.exe
  2⤵
  PID:15732
- C:\Windows\System\tjkxfTx.exe
  C:\Windows\System\tjkxfTx.exe
  2⤵
  PID:15340
- C:\Windows\System\GoAPsdY.exe
  C:\Windows\System\GoAPsdY.exe
  2⤵
  PID:14460
- C:\Windows\System\bBLlEkw.exe
  C:\Windows\System\bBLlEkw.exe
  2⤵
  PID:15816
- C:\Windows\System\lzmyIby.exe
  C:\Windows\System\lzmyIby.exe
  2⤵
  PID:13612
- C:\Windows\System\diPPwRW.exe
  C:\Windows\System\diPPwRW.exe
  2⤵
  PID:16460
- C:\Windows\System\mIKbRIn.exe
  C:\Windows\System\mIKbRIn.exe
  2⤵
  PID:16476
- C:\Windows\System\kTtYCzE.exe
  C:\Windows\System\kTtYCzE.exe
  2⤵
  PID:16492
- C:\Windows\System\gnbTlvg.exe
  C:\Windows\System\gnbTlvg.exe
  2⤵
  PID:16508
- C:\Windows\System\dsAjjGa.exe
  C:\Windows\System\dsAjjGa.exe
  2⤵
  PID:16528
- C:\Windows\System\EngKtWT.exe
  C:\Windows\System\EngKtWT.exe
  2⤵
  PID:16556
- C:\Windows\System\qqFVqVZ.exe
  C:\Windows\System\qqFVqVZ.exe
  2⤵
  PID:16572
- C:\Windows\System\yDaqUZr.exe
  C:\Windows\System\yDaqUZr.exe
  2⤵
  PID:16588
- C:\Windows\System\NPsYhHf.exe
  C:\Windows\System\NPsYhHf.exe
  2⤵
  PID:16604
- C:\Windows\System\iKKRVPz.exe
  C:\Windows\System\iKKRVPz.exe
  2⤵
  PID:16620
- C:\Windows\System\CPmrVFO.exe
  C:\Windows\System\CPmrVFO.exe
  2⤵
  PID:16636
- C:\Windows\System\CLGEidd.exe
  C:\Windows\System\CLGEidd.exe
  2⤵
  PID:16652
- C:\Windows\System\rupYZiI.exe
  C:\Windows\System\rupYZiI.exe
  2⤵
  PID:16668
- C:\Windows\System\xAoFsbw.exe
  C:\Windows\System\xAoFsbw.exe
  2⤵
  PID:16684
- C:\Windows\System\GZNmtSw.exe
  C:\Windows\System\GZNmtSw.exe
  2⤵
  PID:16700
- C:\Windows\System\AUKWtoq.exe
  C:\Windows\System\AUKWtoq.exe
  2⤵
  PID:16716
- C:\Windows\System\iCRqsEy.exe
  C:\Windows\System\iCRqsEy.exe
  2⤵
  PID:16732
- C:\Windows\System\qzwBrAw.exe
  C:\Windows\System\qzwBrAw.exe
  2⤵
  PID:16756
- C:\Windows\System\sVuTjcO.exe
  C:\Windows\System\sVuTjcO.exe
  2⤵
  PID:16772
- C:\Windows\System\amzOFzV.exe
  C:\Windows\System\amzOFzV.exe
  2⤵
  PID:16788
- C:\Windows\System\sGsEwZD.exe
  C:\Windows\System\sGsEwZD.exe
  2⤵
  PID:16812
- C:\Windows\System\FYKbvet.exe
  C:\Windows\System\FYKbvet.exe
  2⤵
  PID:16844
- C:\Windows\System\kStiGFf.exe
  C:\Windows\System\kStiGFf.exe
  2⤵
  PID:16868
- C:\Windows\System\IAKhgjb.exe
  C:\Windows\System\IAKhgjb.exe
  2⤵
  PID:16884
- C:\Windows\System\FbxbdbS.exe
  C:\Windows\System\FbxbdbS.exe
  2⤵
  PID:16904
- C:\Windows\System\VOAnHgo.exe
  C:\Windows\System\VOAnHgo.exe
  2⤵
  PID:16924
- C:\Windows\System\rMOTqWg.exe
  C:\Windows\System\rMOTqWg.exe
  2⤵
  PID:16940
- C:\Windows\System\yzvCPat.exe
  C:\Windows\System\yzvCPat.exe
  2⤵
  PID:16960
- C:\Windows\System\mxBcdbg.exe
  C:\Windows\System\mxBcdbg.exe
  2⤵
  PID:16980
- C:\Windows\System\GaPcfTq.exe
  C:\Windows\System\GaPcfTq.exe
  2⤵
  PID:17000
- C:\Windows\System\AQzxZaT.exe
  C:\Windows\System\AQzxZaT.exe
  2⤵
  PID:17024
- C:\Windows\System\JNdIasQ.exe
  C:\Windows\System\JNdIasQ.exe
  2⤵
  PID:17040
- C:\Windows\System\znsFkzf.exe
  C:\Windows\System\znsFkzf.exe
  2⤵
  PID:17056
- C:\Windows\System\qmKjNms.exe
  C:\Windows\System\qmKjNms.exe
  2⤵
  PID:17072
- C:\Windows\System\HUTmIal.exe
  C:\Windows\System\HUTmIal.exe
  2⤵
  PID:17096
- C:\Windows\System\FhGAlUw.exe
  C:\Windows\System\FhGAlUw.exe
  2⤵
  PID:17128
- C:\Windows\System\rDshZnc.exe
  C:\Windows\System\rDshZnc.exe
  2⤵
  PID:17160
- C:\Windows\System\FSsrdua.exe
  C:\Windows\System\FSsrdua.exe
  2⤵
  PID:16568
- C:\Windows\System\VwVClUD.exe
  C:\Windows\System\VwVClUD.exe
  2⤵
  PID:15808
- C:\Windows\System\hKghubM.exe
  C:\Windows\System\hKghubM.exe
  2⤵
  PID:16412
- C:\Windows\System\iDPmvBG.exe
  C:\Windows\System\iDPmvBG.exe
  2⤵
  PID:17068
- C:\Windows\System\VrrJVse.exe
  C:\Windows\System\VrrJVse.exe
  2⤵
  PID:17316
- C:\Windows\System\gXumuga.exe
  C:\Windows\System\gXumuga.exe
  2⤵
  PID:17384
- C:\Windows\System\DzHXaQu.exe
  C:\Windows\System\DzHXaQu.exe
  2⤵
  PID:16424
- C:\Windows\System\RhLgfkR.exe
  C:\Windows\System\RhLgfkR.exe
  2⤵
  PID:16948
- C:\Windows\System\NwMfKBd.exe
  C:\Windows\System\NwMfKBd.exe
  2⤵
  PID:17304

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:16468

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
PID:17068

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\BiatVha.exe

Filesize
1.4MB

MD5
a155b3b16d9ef2b8efcdb45bd5054f18

SHA1
b6dab0bdc3d807dcdde4266510dca731f24aac5f

SHA256
72d1ebcbc8bcd20ce1a17a7c442584b3cc8a728226f9e75fcd02e32b6db420df

SHA512
3a7d718bd570ab38129d3c75e686b1df966d5e95aca7cd20d95c8b688fcb098ce0781d53c321a837655a117414fa57eddd00fb27b9e4b3612165c43978874aec

Download Submit
C:\Windows\System\EdbqDAt.exe

Filesize
1.4MB

MD5
e1082960c3f81359a9fdf17e05552d38

SHA1
f0e9316d512106ea6d37d8a68ac3af393fbc2338

SHA256
5287a081bbfd667d427a173029cf6f1572d82546c237a932c68366db008056a2

SHA512
1321b4fddb03525163aeb3a69d9c0d9829bf2226b6d82de5180e85e046c0a36422ddd059ed4d4e1ebb177b927ffc29ffae8c47883badebc03be5f3e176b5898d

Download Submit
C:\Windows\System\FXoDtMO.exe

Filesize
1.4MB

MD5
5c31aa68172533d20c57af9dfd336c8c

SHA1
b0a39317e7c863bbae19ed65ced656da936a8e01

SHA256
20137654c3d5fa9314ff573f42d554aaa7544d41cdd5a011160ee542970cd997

SHA512
528ee4dc4a9198fa6dfa73410e778e8d1ec850dcfe03eff4194119f19e1f984f04a2bad8a530066acbd08475128473de428aaeb4a0ab5b88754b362a5c809d44

Download Submit
C:\Windows\System\KEefMCC.exe

Filesize
1.4MB

MD5
2e7dbd6087bae65cba6ca1d1a5f3e0e6

SHA1
1927634166a421b3beecf7f862709347723a9df4

SHA256
7bda51d27cfe071bdf555720afea5c194b03a348513a749a2f4ef8b63ce4fa62

SHA512
de5f973a6b66f6844be39fabd69e3cfff690a8553ac457569615d5ede1f612aae11113d464cacd4458b196dc2f6478055e59c9bcfb4027b0d60fcb173323989a

Download Submit
C:\Windows\System\RdtPMeM.exe

Filesize
1.4MB

MD5
80055bd9fb7a55307762f9679a83ca16

SHA1
4919b7d1cf89d848fbc22e4ae81d45f10e9ce610

SHA256
bb6e42f88cc5dbae3f70e38004000e054f0ab9c9088fb7c6eceee0a72473b4b4

SHA512
ae7e8bb52e2400cbd543c58b55eb8354debed46294dc9f96a391127567820082d8682016800b5624d560e8cdaa6a08da41cee47e682be9c396ab036c0e4cd9ce

Download Submit
C:\Windows\System\XDKbQDK.exe

Filesize
1.4MB

MD5
5a31a88c1f36b0dead606fab8574de5b

SHA1
39f985d69b757d78ed8513d029abf7f72f7dd34a

SHA256
eca396e894126d603b552b9638450f81d5e4ab665d3b28bbcafa4615a415a7c0

SHA512
641cdc121a7425bc7750451154477cf625c5685751301ecb1e4737f7e9502ef517466ae78bef75a0517b6d1f8f439ff04a4dc668daa4cf90a19817aa92ff9c96

Download Submit
C:\Windows\System\XOkWXzh.exe

Filesize
1.4MB

MD5
6c643d6441e25a325b569e0b1cacee5d

SHA1
2cbfc73e837c0e99ec25ae1584dd3e74657a0a79

SHA256
94e9ad4f62546f0a493cd325024f7934136e59e2e6aa25b1a38c50e795cd012b

SHA512
29b3f1b6728a3a4f0c529d84b6720c5130a4f1c0660cf534ec324f5c42d2a9ba1e47feb08dd9c869bcfd261a52cdfaa4429311a1e5ff13f91b843be5a7e99617

Download Submit
C:\Windows\System\XbpgXcM.exe

Filesize
1.4MB

MD5
b97c658f3e3f5893079795b7c45eac1a

SHA1
5a140ca726862b963b481c10756a9adebd8d28e2

SHA256
fe6817d803ae67b57a653e049bece54066e13624dd0fe45ef074d402cf466de5

SHA512
100b4e6eef7e755d69a5defe7540e347c8991b7d4ef0933c2c92473956cad0f7b3d386cf972bc2ed0e2e56b2dcccc9f3b9239571dbe12b141f8a2dd8449ab93d

Download Submit
C:\Windows\System\XqqgDWm.exe

Filesize
1.4MB

MD5
add329f93021465ab3859886d22577e8

SHA1
04806f5e05b346aa77c158735223644d8b01421f

SHA256
402dd8301ebd154cb8bca8cc6c871ce3b59d0c044a09b1a0e2da97ebcb9dff24

SHA512
9abb592e6b723b8cf9b15188bc6790c9c1235f4171e4cf3ae672a9fbad16d40a9bc4170a5ace8bfcee08cb58b8cdaf6fc055b7f2373d120263b78b1c9861ac60

Download Submit
C:\Windows\System\ZIcqeJn.exe

Filesize
1.4MB

MD5
b1ef0e8532b6327eae7873df6b51cac6

SHA1
ed0b0d777c1ab47c725f3738f64dfb596a71c190

SHA256
3ad251ddeac2171e32c3cf3a2330d87cc26656b004b20cbd994d54235005abd6

SHA512
6d3530c15cf55041a332985c9d5c7eb54098997d07a24e578cff2bc5a344292a06bd94d3c059d20289225bd8541418b8144447b0ccb700ced5016f2112ccdc95

Download Submit
C:\Windows\System\ZbsGCVk.exe

Filesize
1.4MB

MD5
bfee76a9c316d3304c99c8c1367068ed

SHA1
122eedee1e9f103df67dd3e36b62c59f1263881a

SHA256
5bbf898de536dc26da87415ce5f24c792fcbba9f5e4edb9c2c2afcf4537e471c

SHA512
bfef936c4438c9a48f2c7df49d8bfd3d56f652e6216b70f061c8c401fb6003633f5e3afb302ab29dc27e0de9da0a181734712ef8e30cf25b429ec32c0c1efb27

Download Submit
C:\Windows\System\ciZDdJY.exe

Filesize
1.4MB

MD5
59bad5fb1ef1e3411a39d1c114b3adbc

SHA1
0aec9daa21c8f6c755032e3e85d787fc511146fa

SHA256
0555f11cf53827223ca428335f8fc52fdbab840187fae277173c8a211166a5b8

SHA512
3e6e6a4de8be395ef093a2dd6e92fb1545055f38fe6c46baf0856c42d5535598a451c488e5d4e6dc589f314bae28fae8fc179ac5e407ddc209e2b7a811ec8a39

Download Submit
C:\Windows\System\fgFXJfT.exe

Filesize
1.4MB

MD5
aa56ce70ede9c7124269247110d5bd03

SHA1
1149a953f6f2b2e1c13ce2332dc145bcf37b34a3

SHA256
447ac3ed2442318649bb852431519a8592bc0e14e779a01b47790dc01eae1b92

SHA512
1df4df035c1df1a0a107283e5b9afd88bc99f891599244855e9ccb3f9ca5b8ee4056c6c0774514efc73e702884635043119207011bb216465742672ece28c810

Download Submit
C:\Windows\System\gaCMtXi.exe

Filesize
1.4MB

MD5
a57873bde200bb480500a88ab2cc4bb4

SHA1
a60beb29a816c0158fecb4369a4e6c67f2b609cc

SHA256
63e155e8654c5a52f3fc9977e3ab6ce57485fe9f61e11b18912cc033eb773681

SHA512
ce17a481c05df2e3bc0795960c43961262452d56cbcf2ee019770c2da41f1e4de9a92bd74aa2da7332202b15ccc04519d41bdbe7657e3eb8bcf0c84b6159e891

Download Submit
C:\Windows\System\hUFVBdb.exe

Filesize
1.4MB

MD5
c079dfdb27cfcdcdcd971c105a8e9cca

SHA1
cca257c6794f4030e8e17b5abaec634f99012cd3

SHA256
c268f639bfc4f61c0689108ace919ca57d491488043f3c4adf7337ea74e3c083

SHA512
3db3a120290a4f88e2e716c52a3b26ad60db6fbb5253826bc6534ee34398a7a00ed8dd22218c69eda22736f0f4134c90a90b8e04f11b7fa8dae9c2d62df7c687

Download Submit
C:\Windows\System\ilixFrQ.exe

Filesize
1.4MB

MD5
7edf02297cdc0191bf04124286a3c101

SHA1
0ed46bbe02bc881e646ae170fee232816be9a768

SHA256
db18e4ea093f584fecb405e64cff37489a74abd90a2792a1f1c74dac8fabc956

SHA512
b018a36709e67f2dd5b0471edb750f16d088ee424905e39a6e3941697a0b61a19c7e5b7c982ca63c1d01fdfac2aacf14e7090182c7ee4b2666f9d3a351603b9a

Download Submit
C:\Windows\System\kDqyzHk.exe

Filesize
1.4MB

MD5
c60b1a465be19ba838a9d1e978a0a1b9

SHA1
f0fda426356a37c7f3db8f4481970126b55863c6

SHA256
811c1b3452e752add6830a3b3aade9b2300735dcd2a115b834007d32e307481f

SHA512
9c2d963887b0475cf246252f888bdba82f5ebf1497798a362a85001a347054fc274adbe3e318521c92ef6aca04861f76ffe5e3660715cbcbf63c5a6b3ff41c4a

Download Submit
C:\Windows\System\mVIdsjN.exe

Filesize
1.4MB

MD5
d4f005b08a155647fa4f0b5338b1119d

SHA1
1ee3996c992d30ad2b22adf8a61e405d2b40001f

SHA256
506c595935d1438ea3d85d9630dff0520136bc7c35b7f69360849d420ebf27e3

SHA512
583f437f15286f442924612691b9faafa06d3288ecc3aa234d7c205948ba2d52d180bde77e8b580911cfcd19246c07ac9e079e316e0d5a12ed6e207bd194548b

Download Submit
C:\Windows\System\mViPBuS.exe

Filesize
1.4MB

MD5
720f8f4a5ac680121e75f869887a9fe8

SHA1
cf5afe0be92fab388677e027d3df44d650d15635

SHA256
ee0db9b49104162832ba62b16046a463d764ff7b192c056b8cbf97f1c7ca3ef7

SHA512
46b33eca409992bb8bc790ff98ba4f28845c879281e0f90dfb2f9f172d1940eda063ff0460887b9bbada5bfae28455295a08e70fd939ec7c54f123e2d19ff6a7

Download Submit
C:\Windows\System\nUyurrh.exe

Filesize
1.4MB

MD5
ff9827f4c78bb28afdb2f8b4c4942225

SHA1
f1037149d1fba2c20fa0400a7b8efb5779657515

SHA256
3160c54dd2f1aeaac500e17ad4a0a3ade28c99a2f66efc1814584da24d7a7342

SHA512
bf81e116c569789e54d2f447fc1a7efd43d2c460dd26858e248049d57bac24786e78921db5123e3b198c2f75259b16f1bbc039d3e2d63c54bd47f621357bd4ca

Download Submit
C:\Windows\System\oKPnKUd.exe

Filesize
1.4MB

MD5
d3d34baf4a7331588b449b8e596463d7

SHA1
9acb4a55197c247de26d3bd19e9d1af4e110ca7f

SHA256
da8d7bec2cd5854e176b57c18e020823af6aab647d75f3f060324a3bc94d7d78

SHA512
e9618474d19d6875e4fbe0f8c76bac552f59b0a82969f693722a0ffef2f826ebe2d345e0cb5360b506d8a26cc4250c116faac9c03a085a1fc9b32e4cf53159fa

Download Submit
C:\Windows\System\poTNOcj.exe

Filesize
1.4MB

MD5
aed80b58dc3a934db3a5894b3bbd478a

SHA1
1b0373d35a9192cf4cbbfd155b0eabd392e6ef5b

SHA256
0dc865e87faef6e787fe542f33d494b1b2f1eca90dd013fd0f1a678c4d2f2f19

SHA512
9777f0a0d9a69b9fca37369b213b2853d2dc703e99c4269cc02d26b6eec42d85d8d7dab470eda41a8dc325c86d1811fa4e468002f0305581f5545160f32b6877

Download Submit
C:\Windows\System\rCKMyDE.exe

Filesize
1.4MB

MD5
0a5a05c8a7d103bfb2707a84ad0f80c1

SHA1
f4d278bc48b7fc6b4144640b26abd0a44db37426

SHA256
f9a9eb74da0a10e235291166bbd8f5ed78fc7372722e61ec411d282cd282eb26

SHA512
b3458c0aa47d5ad3ced12f928676c77baaa15b29e760f5eba51a11ff3f127da3d3346cf871d9e80d66e0fe4d33b4f35a0dac0e1dd746d59070cfcea960805b2f

Download Submit
C:\Windows\System\rGZDNKh.exe

Filesize
1.4MB

MD5
2ee97e06fcc414e38407925806230f44

SHA1
7f0e3bb985079cf826c4b4aede6ee98e653c43aa

SHA256
fc5e856bde8e978fc5ad50a2ea8bd38932874580e321d40fc4940bcee24419f9

SHA512
862fda6b35a151516efdad39344f10fd9d693167dde60a5f675de85af130c1bc93308f3b55532a039d5bcb48f0f1ba2efca0d862cce6c276ed3c1d551dbf3c30

Download Submit
C:\Windows\System\sQbzXej.exe

Filesize
1.4MB

MD5
5a5e441e02bcb5f91b3c033c9eb714b8

SHA1
3501ab16e530967cebfd1642ae2f33c35b391961

SHA256
4d6b29b2484b5c6c9c56ba7449d967b443304f1b8ebe219c3cdc9f6e1cc8311f

SHA512
646f2d9d4f0de96aa70060c8baaf232ad8523cd5ce11cd18ab5af4dc11afef83ed095fda21955f717160e7afa787f2a84fdc2618b3f4e36924d71f250d4058e7

Download Submit
C:\Windows\System\tKYHNZS.exe

Filesize
1.4MB

MD5
2fa89f84cc137904d6d4921870d84f77

SHA1
5c3d3993b475a721baef9ed394c14a746b44f2c8

SHA256
f121c0dd2872d4f17e6d033dfd5e3eeeeac39789474ace2d166669b865032d29

SHA512
c7acb6a822f8edb3c833824c661b6faa3d5d784cd8e37c030cbd3be8a6eee0326e50ace596857557d253807a9d6c80b2c816ef0a1ba3684eb6fb320dd8e74d0d

Download Submit
C:\Windows\System\ubrHZeu.exe

Filesize
1.4MB

MD5
f17c52bbab97cd9515acb75c884dfb1f

SHA1
05737964ce1d3c4819182871efca8b396d9a2716

SHA256
f38dda1d5c90df5c0c9087787d57fbddbd51bb1104c07cd704a0a68b6328d8f9

SHA512
e26fdfaa4587ba3612903341307f758477a8d8b3cba3567d9a3d9c7e09e6450ff7e9909f43b34eb3910bb196ed061acb82c59936e0b7f0ef6007500982aa2a4b

Download Submit
C:\Windows\System\uebViEZ.exe

Filesize
1.4MB

MD5
6b5461097630838422c3214f64ed828f

SHA1
019e66ffff22e6aad246e004f2a3fc9b79a13963

SHA256
ab2348323820eb58bff4c15168c9839974126fca87e74963c822a82820a359ea

SHA512
f308ce3bceb675b4375b0e455b175312a40d53ef92708c59c578c7b702ead915711abaa225e5c177f95e4c02ec09cb8927227deb6f7323eddd17519605046d5f

Download Submit
C:\Windows\System\uvzPftG.exe

Filesize
1.4MB

MD5
4ad7fcd9add30b5c1f70cd0f5ccba940

SHA1
6d29229641a7d9f9ea54c47ba78fcbba9f0df5ba

SHA256
866cec318c2cfe9847bb1d5fed6b2f8d30778cbe59a701be1fa5d901cf40d69f

SHA512
7f0473bf8b713044f1903ff82786d5a14b16ff57e243f693683a26dfa219ad14aff12556cbbc19264608c7a56bb05d23fddec6f2e7bab4162843bf60dd7d5cfb

Download Submit
C:\Windows\System\vgbIgkV.exe

Filesize
1.4MB

MD5
71164d9b9adf59cc68ec2ff0b0224de6

SHA1
a1a249d36ae96ff1b72075c0742d7c707ed5537a

SHA256
3426e04d9b5ffd4da60d04082ef7270a572a228e83f2ebe0ded12c1a51e1f004

SHA512
0cb7690fa8f9e27319e4b79198c31203e0af1fdea59623fbf679d1af7bb90e5ecfe282a23f318f68028623e46e589a8e83a1a31250db04b64fc61d3ecb4a9895

Download Submit
C:\Windows\System\xILiUBW.exe

Filesize
1.4MB

MD5
37c5544437ff1d7aefe1487e6acb36de

SHA1
03a8664c58429e3507d8a4145b36bd83eb1936fb

SHA256
eb4c7808a530d6e567d14642fc4d436a57816de5218dedc3726e89417079e41c

SHA512
8792280ecc988f61a6ab96491fef22f01154469e7bc125ea11266cb977764445634a75129c748ee6db26f9510aadd0d372c61987046c0c4903113349cca58ec9

Download Submit
C:\Windows\System\yixzqaA.exe

Filesize
1.4MB

MD5
b853544b84afee5dd0d5b479c425580e

SHA1
416ab87453eb11d91eb7d54a428b6c3e85482ca5

SHA256
32a73da58d578fd7332f7369f68847f1f92a5aea70f1809cd162a57fcd8b5029

SHA512
8c61bb49b38fba3c6fc8ce90c5c0fe01849838dc21f3e12bae02760ef45adb4a46b48f499321ff942a833900694c0e3b1dd7e305657b83bfc77c5abd4df5f7c6

Download Submit
memory/4844-0-0x000001DFF6CB0000-0x000001DFF6CC0000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads