xmrig | d513f37bc057b1f7c1842fb1aeb7d0fb9b1ee3d9e25dbeb5b4ce6326d0794800

Analysis

max time kernel
95s
max time network
136s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
18-12-2024 05:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d513f37bc057b1f7c1842fb1aeb7d0fb9b1ee3d9e25dbeb5b4ce6326d0794800.exe
Size

1.8MB
MD5

a45a844704b8d0ccfc486e82d119af9f
SHA1

13223368159690969167c8fc78ce82949baefdcb
SHA256

d513f37bc057b1f7c1842fb1aeb7d0fb9b1ee3d9e25dbeb5b4ce6326d0794800
SHA512

760e70cd1531374262fcbc30c66d64f22ab5beb64567193154b3aa7aeabde176760cd50831d384b22ceed0e467f4d94ccdbdf90d5185ada10d84ae45bdb55403
SSDEEP

49152:GezaTF8FcNkNdfE0pZ9ozttwIRxj4c5yOBZnmxZ8zouZxV:GemTLkNdfE0pZyX

Score

10^/10

xmrig miner

Malware Config

Signatures

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 17340 created 17252	17340	WerFaultSecure.exe	922

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 32 IoCs

miner

resource	yara_rule
behavioral2/files/0x0009000000023cc7-4.dat	xmrig
behavioral2/files/0x0008000000023cca-11.dat	xmrig
behavioral2/files/0x0007000000023cce-15.dat	xmrig
behavioral2/files/0x0007000000023ccf-20.dat	xmrig
behavioral2/files/0x0007000000023cd0-23.dat	xmrig
behavioral2/files/0x0007000000023cd2-27.dat	xmrig
behavioral2/files/0x0007000000023cd3-32.dat	xmrig
behavioral2/files/0x0007000000023cd4-40.dat	xmrig
behavioral2/files/0x0007000000023cd8-52.dat	xmrig
behavioral2/files/0x0007000000023cdb-65.dat	xmrig
behavioral2/files/0x0007000000023cdc-69.dat	xmrig
behavioral2/files/0x0008000000023ccb-83.dat	xmrig
behavioral2/files/0x0007000000023cde-90.dat	xmrig
behavioral2/files/0x0007000000023cdd-86.dat	xmrig
behavioral2/files/0x0007000000023cda-70.dat	xmrig
behavioral2/files/0x0007000000023cd9-67.dat	xmrig
behavioral2/files/0x0007000000023cd7-53.dat	xmrig
behavioral2/files/0x0007000000023cd6-50.dat	xmrig
behavioral2/files/0x0007000000023cdf-94.dat	xmrig
behavioral2/files/0x0007000000023ce0-99.dat	xmrig
behavioral2/files/0x0007000000023ce2-107.dat	xmrig
behavioral2/files/0x0007000000023ce1-103.dat	xmrig
behavioral2/files/0x0007000000023ce5-122.dat	xmrig
behavioral2/files/0x0007000000023ce8-142.dat	xmrig
behavioral2/files/0x0007000000023ce9-144.dat	xmrig
behavioral2/files/0x0007000000023ce7-140.dat	xmrig
behavioral2/files/0x0007000000023ce6-138.dat	xmrig
behavioral2/files/0x0007000000023ce4-132.dat	xmrig
behavioral2/files/0x0007000000023ce3-127.dat	xmrig
behavioral2/files/0x0007000000023cea-149.dat	xmrig
behavioral2/files/0x0007000000023ceb-153.dat	xmrig
behavioral2/files/0x0007000000023cec-159.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
4960	ffkpflK.exe
4556	viwUbGj.exe
4948	qALAcAQ.exe
3028	lTNEQpZ.exe
4296	rhciZpb.exe
444	EzyXDNM.exe
1388	DGEKNxC.exe
224	yymqBCr.exe
2012	vIUVgqL.exe
1124	VHYqbXd.exe
3196	NLdObbQ.exe
744	bfVcefn.exe
3472	omBUCyD.exe
1408	tWMsvar.exe
4280	WhkPpPl.exe
3464	reMaimt.exe
4472	fKSuHOq.exe
4780	ZNObqRU.exe
4992	BryZZdI.exe
928	dLyTqPK.exe
1156	gkygTpc.exe
3444	ckcUuWM.exe
2888	gvceGKk.exe
2388	bsywOou.exe
972	IKrUlEM.exe
5012	sraIAyI.exe
4508	RHiiUxh.exe
1980	KAisIdh.exe
2584	pGnxZkY.exe
3896	yOJtXIe.exe
2008	axpeYoL.exe
2188	JMCgCQo.exe
4336	AcMVBLN.exe
924	aUPiCMY.exe
3400	UaXybse.exe
2184	tNuTMHF.exe
1472	auvbgLs.exe
3496	oPuOWeS.exe
2948	LCUMZdc.exe
4264	WfNsfqX.exe
2224	FFqUikM.exe
3676	wBkwUJy.exe
4916	NAucFOy.exe
4980	uRYgbEA.exe
5028	CzSHolI.exe
700	PHmnkuB.exe
2540	VkzLfpC.exe
3936	KmxqMth.exe
5040	RCuBARR.exe
1312	oYVhXSS.exe
600	PcbEmpD.exe
2300	LRMDebb.exe
1852	dCiXFdv.exe
212	FMQIJcD.exe
2568	gnjFwMI.exe
3552	bumCJqa.exe
216	ghheOWN.exe
2208	vMXsaaS.exe
1160	FwUnIJf.exe
896	LoNqWGf.exe
544	KNAIiVh.exe
2344	xTxhvJu.exe
2712	nfEiyjs.exe
5112	NaNecaG.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\system32\config\systemprofile\AppData\Local\WER4468.tmp.WERDataCollectionStatus.txt	WerFaultSecure.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\RCuBARR.exe	d513f37bc057b1f7c1842fb1aeb7d0fb9b1ee3d9e25dbeb5b4ce6326d0794800.exe
File created	C:\Windows\System\NaNecaG.exe	d513f37bc057b1f7c1842fb1aeb7d0fb9b1ee3d9e25dbeb5b4ce6326d0794800.exe
File created	C:\Windows\System\KVDAPSr.exe	d513f37bc057b1f7c1842fb1aeb7d0fb9b1ee3d9e25dbeb5b4ce6326d0794800.exe
File created	C:\Windows\System\alISwyd.exe	d513f37bc057b1f7c1842fb1aeb7d0fb9b1ee3d9e25dbeb5b4ce6326d0794800.exe
File created	C:\Windows\System\qYGdUQV.exe	d513f37bc057b1f7c1842fb1aeb7d0fb9b1ee3d9e25dbeb5b4ce6326d0794800.exe
File created	C:\Windows\System\pcREWnT.exe	d513f37bc057b1f7c1842fb1aeb7d0fb9b1ee3d9e25dbeb5b4ce6326d0794800.exe
File created	C:\Windows\System\OxPaDTA.exe	d513f37bc057b1f7c1842fb1aeb7d0fb9b1ee3d9e25dbeb5b4ce6326d0794800.exe
File created	C:\Windows\System\BKMEIQu.exe	d513f37bc057b1f7c1842fb1aeb7d0fb9b1ee3d9e25dbeb5b4ce6326d0794800.exe
File created	C:\Windows\System\dnawrME.exe	d513f37bc057b1f7c1842fb1aeb7d0fb9b1ee3d9e25dbeb5b4ce6326d0794800.exe
File created	C:\Windows\System\jxGLNCF.exe	d513f37bc057b1f7c1842fb1aeb7d0fb9b1ee3d9e25dbeb5b4ce6326d0794800.exe
File created	C:\Windows\System\QDnGoIr.exe	d513f37bc057b1f7c1842fb1aeb7d0fb9b1ee3d9e25dbeb5b4ce6326d0794800.exe
File created	C:\Windows\System\DMgHXgu.exe	d513f37bc057b1f7c1842fb1aeb7d0fb9b1ee3d9e25dbeb5b4ce6326d0794800.exe
File created	C:\Windows\System\wWYoCnT.exe	d513f37bc057b1f7c1842fb1aeb7d0fb9b1ee3d9e25dbeb5b4ce6326d0794800.exe
File created	C:\Windows\System\fWchyPt.exe	d513f37bc057b1f7c1842fb1aeb7d0fb9b1ee3d9e25dbeb5b4ce6326d0794800.exe
File created	C:\Windows\System\KjKNqFj.exe	d513f37bc057b1f7c1842fb1aeb7d0fb9b1ee3d9e25dbeb5b4ce6326d0794800.exe
File created	C:\Windows\System\EpehutR.exe	d513f37bc057b1f7c1842fb1aeb7d0fb9b1ee3d9e25dbeb5b4ce6326d0794800.exe
File created	C:\Windows\System\wHVzRgp.exe	d513f37bc057b1f7c1842fb1aeb7d0fb9b1ee3d9e25dbeb5b4ce6326d0794800.exe
File created	C:\Windows\System\WcUEOyX.exe	d513f37bc057b1f7c1842fb1aeb7d0fb9b1ee3d9e25dbeb5b4ce6326d0794800.exe
File created	C:\Windows\System\YhfpgeR.exe	d513f37bc057b1f7c1842fb1aeb7d0fb9b1ee3d9e25dbeb5b4ce6326d0794800.exe
File created	C:\Windows\System\XQEURpc.exe	d513f37bc057b1f7c1842fb1aeb7d0fb9b1ee3d9e25dbeb5b4ce6326d0794800.exe
File created	C:\Windows\System\ERifyyW.exe	d513f37bc057b1f7c1842fb1aeb7d0fb9b1ee3d9e25dbeb5b4ce6326d0794800.exe
File created	C:\Windows\System\aSpHVZA.exe	d513f37bc057b1f7c1842fb1aeb7d0fb9b1ee3d9e25dbeb5b4ce6326d0794800.exe
File created	C:\Windows\System\xxHryFe.exe	d513f37bc057b1f7c1842fb1aeb7d0fb9b1ee3d9e25dbeb5b4ce6326d0794800.exe
File created	C:\Windows\System\uDQQqgn.exe	d513f37bc057b1f7c1842fb1aeb7d0fb9b1ee3d9e25dbeb5b4ce6326d0794800.exe
File created	C:\Windows\System\xdQpxOy.exe	d513f37bc057b1f7c1842fb1aeb7d0fb9b1ee3d9e25dbeb5b4ce6326d0794800.exe
File created	C:\Windows\System\cNWMBCY.exe	d513f37bc057b1f7c1842fb1aeb7d0fb9b1ee3d9e25dbeb5b4ce6326d0794800.exe
File created	C:\Windows\System\CTsESfb.exe	d513f37bc057b1f7c1842fb1aeb7d0fb9b1ee3d9e25dbeb5b4ce6326d0794800.exe
File created	C:\Windows\System\wVQMRcm.exe	d513f37bc057b1f7c1842fb1aeb7d0fb9b1ee3d9e25dbeb5b4ce6326d0794800.exe
File created	C:\Windows\System\iSTvHKA.exe	d513f37bc057b1f7c1842fb1aeb7d0fb9b1ee3d9e25dbeb5b4ce6326d0794800.exe
File created	C:\Windows\System\wJkjOhg.exe	d513f37bc057b1f7c1842fb1aeb7d0fb9b1ee3d9e25dbeb5b4ce6326d0794800.exe
File created	C:\Windows\System\ArcOdRk.exe	d513f37bc057b1f7c1842fb1aeb7d0fb9b1ee3d9e25dbeb5b4ce6326d0794800.exe
File created	C:\Windows\System\SuqWRru.exe	d513f37bc057b1f7c1842fb1aeb7d0fb9b1ee3d9e25dbeb5b4ce6326d0794800.exe
File created	C:\Windows\System\QPqwbZi.exe	d513f37bc057b1f7c1842fb1aeb7d0fb9b1ee3d9e25dbeb5b4ce6326d0794800.exe
File created	C:\Windows\System\dClfbnT.exe	d513f37bc057b1f7c1842fb1aeb7d0fb9b1ee3d9e25dbeb5b4ce6326d0794800.exe
File created	C:\Windows\System\DNkQnyJ.exe	d513f37bc057b1f7c1842fb1aeb7d0fb9b1ee3d9e25dbeb5b4ce6326d0794800.exe
File created	C:\Windows\System\JgGoEii.exe	d513f37bc057b1f7c1842fb1aeb7d0fb9b1ee3d9e25dbeb5b4ce6326d0794800.exe
File created	C:\Windows\System\QpWzziC.exe	d513f37bc057b1f7c1842fb1aeb7d0fb9b1ee3d9e25dbeb5b4ce6326d0794800.exe
File created	C:\Windows\System\DWvUXbR.exe	d513f37bc057b1f7c1842fb1aeb7d0fb9b1ee3d9e25dbeb5b4ce6326d0794800.exe
File created	C:\Windows\System\omBUCyD.exe	d513f37bc057b1f7c1842fb1aeb7d0fb9b1ee3d9e25dbeb5b4ce6326d0794800.exe
File created	C:\Windows\System\IqKlbTi.exe	d513f37bc057b1f7c1842fb1aeb7d0fb9b1ee3d9e25dbeb5b4ce6326d0794800.exe
File created	C:\Windows\System\izszHgA.exe	d513f37bc057b1f7c1842fb1aeb7d0fb9b1ee3d9e25dbeb5b4ce6326d0794800.exe
File created	C:\Windows\System\dKXJdrs.exe	d513f37bc057b1f7c1842fb1aeb7d0fb9b1ee3d9e25dbeb5b4ce6326d0794800.exe
File created	C:\Windows\System\eUVRidZ.exe	d513f37bc057b1f7c1842fb1aeb7d0fb9b1ee3d9e25dbeb5b4ce6326d0794800.exe
File created	C:\Windows\System\DAwKNzc.exe	d513f37bc057b1f7c1842fb1aeb7d0fb9b1ee3d9e25dbeb5b4ce6326d0794800.exe
File created	C:\Windows\System\fjSJDFc.exe	d513f37bc057b1f7c1842fb1aeb7d0fb9b1ee3d9e25dbeb5b4ce6326d0794800.exe
File created	C:\Windows\System\ZilfyQn.exe	d513f37bc057b1f7c1842fb1aeb7d0fb9b1ee3d9e25dbeb5b4ce6326d0794800.exe
File created	C:\Windows\System\dUUaHsE.exe	d513f37bc057b1f7c1842fb1aeb7d0fb9b1ee3d9e25dbeb5b4ce6326d0794800.exe
File created	C:\Windows\System\qdOSQft.exe	d513f37bc057b1f7c1842fb1aeb7d0fb9b1ee3d9e25dbeb5b4ce6326d0794800.exe
File created	C:\Windows\System\cIATCqe.exe	d513f37bc057b1f7c1842fb1aeb7d0fb9b1ee3d9e25dbeb5b4ce6326d0794800.exe
File created	C:\Windows\System\MmNYcsK.exe	d513f37bc057b1f7c1842fb1aeb7d0fb9b1ee3d9e25dbeb5b4ce6326d0794800.exe
File created	C:\Windows\System\IJpXOxt.exe	d513f37bc057b1f7c1842fb1aeb7d0fb9b1ee3d9e25dbeb5b4ce6326d0794800.exe
File created	C:\Windows\System\wGqMgZm.exe	d513f37bc057b1f7c1842fb1aeb7d0fb9b1ee3d9e25dbeb5b4ce6326d0794800.exe
File created	C:\Windows\System\oMKVtmE.exe	d513f37bc057b1f7c1842fb1aeb7d0fb9b1ee3d9e25dbeb5b4ce6326d0794800.exe
File created	C:\Windows\System\PTdoxFF.exe	d513f37bc057b1f7c1842fb1aeb7d0fb9b1ee3d9e25dbeb5b4ce6326d0794800.exe
File created	C:\Windows\System\CDKTgHA.exe	d513f37bc057b1f7c1842fb1aeb7d0fb9b1ee3d9e25dbeb5b4ce6326d0794800.exe
File created	C:\Windows\System\lSlzDty.exe	d513f37bc057b1f7c1842fb1aeb7d0fb9b1ee3d9e25dbeb5b4ce6326d0794800.exe
File created	C:\Windows\System\rkNEUui.exe	d513f37bc057b1f7c1842fb1aeb7d0fb9b1ee3d9e25dbeb5b4ce6326d0794800.exe
File created	C:\Windows\System\ZcXxuGm.exe	d513f37bc057b1f7c1842fb1aeb7d0fb9b1ee3d9e25dbeb5b4ce6326d0794800.exe
File created	C:\Windows\System\kWAMhCK.exe	d513f37bc057b1f7c1842fb1aeb7d0fb9b1ee3d9e25dbeb5b4ce6326d0794800.exe
File created	C:\Windows\System\CHAtUEb.exe	d513f37bc057b1f7c1842fb1aeb7d0fb9b1ee3d9e25dbeb5b4ce6326d0794800.exe
File created	C:\Windows\System\KXsYluo.exe	d513f37bc057b1f7c1842fb1aeb7d0fb9b1ee3d9e25dbeb5b4ce6326d0794800.exe
File created	C:\Windows\System\lYVaFTO.exe	d513f37bc057b1f7c1842fb1aeb7d0fb9b1ee3d9e25dbeb5b4ce6326d0794800.exe
File created	C:\Windows\System\WQJTWDP.exe	d513f37bc057b1f7c1842fb1aeb7d0fb9b1ee3d9e25dbeb5b4ce6326d0794800.exe
File created	C:\Windows\System\pwUBkje.exe	d513f37bc057b1f7c1842fb1aeb7d0fb9b1ee3d9e25dbeb5b4ce6326d0794800.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFaultSecure.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFaultSecure.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFaultSecure.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFaultSecure.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFaultSecure.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 560 wrote to memory of 4960	560	d513f37bc057b1f7c1842fb1aeb7d0fb9b1ee3d9e25dbeb5b4ce6326d0794800.exe	85
PID 560 wrote to memory of 4960	560	d513f37bc057b1f7c1842fb1aeb7d0fb9b1ee3d9e25dbeb5b4ce6326d0794800.exe	85
PID 560 wrote to memory of 4556	560	d513f37bc057b1f7c1842fb1aeb7d0fb9b1ee3d9e25dbeb5b4ce6326d0794800.exe	86
PID 560 wrote to memory of 4556	560	d513f37bc057b1f7c1842fb1aeb7d0fb9b1ee3d9e25dbeb5b4ce6326d0794800.exe	86
PID 560 wrote to memory of 4948	560	d513f37bc057b1f7c1842fb1aeb7d0fb9b1ee3d9e25dbeb5b4ce6326d0794800.exe	87
PID 560 wrote to memory of 4948	560	d513f37bc057b1f7c1842fb1aeb7d0fb9b1ee3d9e25dbeb5b4ce6326d0794800.exe	87
PID 560 wrote to memory of 3028	560	d513f37bc057b1f7c1842fb1aeb7d0fb9b1ee3d9e25dbeb5b4ce6326d0794800.exe	88
PID 560 wrote to memory of 3028	560	d513f37bc057b1f7c1842fb1aeb7d0fb9b1ee3d9e25dbeb5b4ce6326d0794800.exe	88
PID 560 wrote to memory of 4296	560	d513f37bc057b1f7c1842fb1aeb7d0fb9b1ee3d9e25dbeb5b4ce6326d0794800.exe	89
PID 560 wrote to memory of 4296	560	d513f37bc057b1f7c1842fb1aeb7d0fb9b1ee3d9e25dbeb5b4ce6326d0794800.exe	89
PID 560 wrote to memory of 444	560	d513f37bc057b1f7c1842fb1aeb7d0fb9b1ee3d9e25dbeb5b4ce6326d0794800.exe	90
PID 560 wrote to memory of 444	560	d513f37bc057b1f7c1842fb1aeb7d0fb9b1ee3d9e25dbeb5b4ce6326d0794800.exe	90
PID 560 wrote to memory of 1388	560	d513f37bc057b1f7c1842fb1aeb7d0fb9b1ee3d9e25dbeb5b4ce6326d0794800.exe	91
PID 560 wrote to memory of 1388	560	d513f37bc057b1f7c1842fb1aeb7d0fb9b1ee3d9e25dbeb5b4ce6326d0794800.exe	91
PID 560 wrote to memory of 224	560	d513f37bc057b1f7c1842fb1aeb7d0fb9b1ee3d9e25dbeb5b4ce6326d0794800.exe	92
PID 560 wrote to memory of 224	560	d513f37bc057b1f7c1842fb1aeb7d0fb9b1ee3d9e25dbeb5b4ce6326d0794800.exe	92
PID 560 wrote to memory of 2012	560	d513f37bc057b1f7c1842fb1aeb7d0fb9b1ee3d9e25dbeb5b4ce6326d0794800.exe	93
PID 560 wrote to memory of 2012	560	d513f37bc057b1f7c1842fb1aeb7d0fb9b1ee3d9e25dbeb5b4ce6326d0794800.exe	93
PID 560 wrote to memory of 1124	560	d513f37bc057b1f7c1842fb1aeb7d0fb9b1ee3d9e25dbeb5b4ce6326d0794800.exe	94
PID 560 wrote to memory of 1124	560	d513f37bc057b1f7c1842fb1aeb7d0fb9b1ee3d9e25dbeb5b4ce6326d0794800.exe	94
PID 560 wrote to memory of 3196	560	d513f37bc057b1f7c1842fb1aeb7d0fb9b1ee3d9e25dbeb5b4ce6326d0794800.exe	95
PID 560 wrote to memory of 3196	560	d513f37bc057b1f7c1842fb1aeb7d0fb9b1ee3d9e25dbeb5b4ce6326d0794800.exe	95
PID 560 wrote to memory of 744	560	d513f37bc057b1f7c1842fb1aeb7d0fb9b1ee3d9e25dbeb5b4ce6326d0794800.exe	96
PID 560 wrote to memory of 744	560	d513f37bc057b1f7c1842fb1aeb7d0fb9b1ee3d9e25dbeb5b4ce6326d0794800.exe	96
PID 560 wrote to memory of 3472	560	d513f37bc057b1f7c1842fb1aeb7d0fb9b1ee3d9e25dbeb5b4ce6326d0794800.exe	97
PID 560 wrote to memory of 3472	560	d513f37bc057b1f7c1842fb1aeb7d0fb9b1ee3d9e25dbeb5b4ce6326d0794800.exe	97
PID 560 wrote to memory of 1408	560	d513f37bc057b1f7c1842fb1aeb7d0fb9b1ee3d9e25dbeb5b4ce6326d0794800.exe	98
PID 560 wrote to memory of 1408	560	d513f37bc057b1f7c1842fb1aeb7d0fb9b1ee3d9e25dbeb5b4ce6326d0794800.exe	98
PID 560 wrote to memory of 4280	560	d513f37bc057b1f7c1842fb1aeb7d0fb9b1ee3d9e25dbeb5b4ce6326d0794800.exe	99
PID 560 wrote to memory of 4280	560	d513f37bc057b1f7c1842fb1aeb7d0fb9b1ee3d9e25dbeb5b4ce6326d0794800.exe	99
PID 560 wrote to memory of 3464	560	d513f37bc057b1f7c1842fb1aeb7d0fb9b1ee3d9e25dbeb5b4ce6326d0794800.exe	100
PID 560 wrote to memory of 3464	560	d513f37bc057b1f7c1842fb1aeb7d0fb9b1ee3d9e25dbeb5b4ce6326d0794800.exe	100
PID 560 wrote to memory of 4472	560	d513f37bc057b1f7c1842fb1aeb7d0fb9b1ee3d9e25dbeb5b4ce6326d0794800.exe	101
PID 560 wrote to memory of 4472	560	d513f37bc057b1f7c1842fb1aeb7d0fb9b1ee3d9e25dbeb5b4ce6326d0794800.exe	101
PID 560 wrote to memory of 4780	560	d513f37bc057b1f7c1842fb1aeb7d0fb9b1ee3d9e25dbeb5b4ce6326d0794800.exe	102
PID 560 wrote to memory of 4780	560	d513f37bc057b1f7c1842fb1aeb7d0fb9b1ee3d9e25dbeb5b4ce6326d0794800.exe	102
PID 560 wrote to memory of 4992	560	d513f37bc057b1f7c1842fb1aeb7d0fb9b1ee3d9e25dbeb5b4ce6326d0794800.exe	103
PID 560 wrote to memory of 4992	560	d513f37bc057b1f7c1842fb1aeb7d0fb9b1ee3d9e25dbeb5b4ce6326d0794800.exe	103
PID 560 wrote to memory of 928	560	d513f37bc057b1f7c1842fb1aeb7d0fb9b1ee3d9e25dbeb5b4ce6326d0794800.exe	104
PID 560 wrote to memory of 928	560	d513f37bc057b1f7c1842fb1aeb7d0fb9b1ee3d9e25dbeb5b4ce6326d0794800.exe	104
PID 560 wrote to memory of 1156	560	d513f37bc057b1f7c1842fb1aeb7d0fb9b1ee3d9e25dbeb5b4ce6326d0794800.exe	105
PID 560 wrote to memory of 1156	560	d513f37bc057b1f7c1842fb1aeb7d0fb9b1ee3d9e25dbeb5b4ce6326d0794800.exe	105
PID 560 wrote to memory of 3444	560	d513f37bc057b1f7c1842fb1aeb7d0fb9b1ee3d9e25dbeb5b4ce6326d0794800.exe	106
PID 560 wrote to memory of 3444	560	d513f37bc057b1f7c1842fb1aeb7d0fb9b1ee3d9e25dbeb5b4ce6326d0794800.exe	106
PID 560 wrote to memory of 2888	560	d513f37bc057b1f7c1842fb1aeb7d0fb9b1ee3d9e25dbeb5b4ce6326d0794800.exe	107
PID 560 wrote to memory of 2888	560	d513f37bc057b1f7c1842fb1aeb7d0fb9b1ee3d9e25dbeb5b4ce6326d0794800.exe	107
PID 560 wrote to memory of 2388	560	d513f37bc057b1f7c1842fb1aeb7d0fb9b1ee3d9e25dbeb5b4ce6326d0794800.exe	108
PID 560 wrote to memory of 2388	560	d513f37bc057b1f7c1842fb1aeb7d0fb9b1ee3d9e25dbeb5b4ce6326d0794800.exe	108
PID 560 wrote to memory of 972	560	d513f37bc057b1f7c1842fb1aeb7d0fb9b1ee3d9e25dbeb5b4ce6326d0794800.exe	109
PID 560 wrote to memory of 972	560	d513f37bc057b1f7c1842fb1aeb7d0fb9b1ee3d9e25dbeb5b4ce6326d0794800.exe	109
PID 560 wrote to memory of 5012	560	d513f37bc057b1f7c1842fb1aeb7d0fb9b1ee3d9e25dbeb5b4ce6326d0794800.exe	110
PID 560 wrote to memory of 5012	560	d513f37bc057b1f7c1842fb1aeb7d0fb9b1ee3d9e25dbeb5b4ce6326d0794800.exe	110
PID 560 wrote to memory of 4508	560	d513f37bc057b1f7c1842fb1aeb7d0fb9b1ee3d9e25dbeb5b4ce6326d0794800.exe	111
PID 560 wrote to memory of 4508	560	d513f37bc057b1f7c1842fb1aeb7d0fb9b1ee3d9e25dbeb5b4ce6326d0794800.exe	111
PID 560 wrote to memory of 1980	560	d513f37bc057b1f7c1842fb1aeb7d0fb9b1ee3d9e25dbeb5b4ce6326d0794800.exe	112
PID 560 wrote to memory of 1980	560	d513f37bc057b1f7c1842fb1aeb7d0fb9b1ee3d9e25dbeb5b4ce6326d0794800.exe	112
PID 560 wrote to memory of 2584	560	d513f37bc057b1f7c1842fb1aeb7d0fb9b1ee3d9e25dbeb5b4ce6326d0794800.exe	113
PID 560 wrote to memory of 2584	560	d513f37bc057b1f7c1842fb1aeb7d0fb9b1ee3d9e25dbeb5b4ce6326d0794800.exe	113
PID 560 wrote to memory of 3896	560	d513f37bc057b1f7c1842fb1aeb7d0fb9b1ee3d9e25dbeb5b4ce6326d0794800.exe	114
PID 560 wrote to memory of 3896	560	d513f37bc057b1f7c1842fb1aeb7d0fb9b1ee3d9e25dbeb5b4ce6326d0794800.exe	114
PID 560 wrote to memory of 2008	560	d513f37bc057b1f7c1842fb1aeb7d0fb9b1ee3d9e25dbeb5b4ce6326d0794800.exe	115
PID 560 wrote to memory of 2008	560	d513f37bc057b1f7c1842fb1aeb7d0fb9b1ee3d9e25dbeb5b4ce6326d0794800.exe	115
PID 560 wrote to memory of 2188	560	d513f37bc057b1f7c1842fb1aeb7d0fb9b1ee3d9e25dbeb5b4ce6326d0794800.exe	116
PID 560 wrote to memory of 2188	560	d513f37bc057b1f7c1842fb1aeb7d0fb9b1ee3d9e25dbeb5b4ce6326d0794800.exe	116

C:\Users\Admin\AppData\Local\Temp\d513f37bc057b1f7c1842fb1aeb7d0fb9b1ee3d9e25dbeb5b4ce6326d0794800.exe
"C:\Users\Admin\AppData\Local\Temp\d513f37bc057b1f7c1842fb1aeb7d0fb9b1ee3d9e25dbeb5b4ce6326d0794800.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:560
- C:\Windows\System\ffkpflK.exe
  C:\Windows\System\ffkpflK.exe
  2⤵
  - Executes dropped EXE
  PID:4960
- C:\Windows\System\viwUbGj.exe
  C:\Windows\System\viwUbGj.exe
  2⤵
  - Executes dropped EXE
  PID:4556
- C:\Windows\System\qALAcAQ.exe
  C:\Windows\System\qALAcAQ.exe
  2⤵
  - Executes dropped EXE
  PID:4948
- C:\Windows\System\lTNEQpZ.exe
  C:\Windows\System\lTNEQpZ.exe
  2⤵
  - Executes dropped EXE
  PID:3028
- C:\Windows\System\rhciZpb.exe
  C:\Windows\System\rhciZpb.exe
  2⤵
  - Executes dropped EXE
  PID:4296
- C:\Windows\System\EzyXDNM.exe
  C:\Windows\System\EzyXDNM.exe
  2⤵
  - Executes dropped EXE
  PID:444
- C:\Windows\System\DGEKNxC.exe
  C:\Windows\System\DGEKNxC.exe
  2⤵
  - Executes dropped EXE
  PID:1388
- C:\Windows\System\yymqBCr.exe
  C:\Windows\System\yymqBCr.exe
  2⤵
  - Executes dropped EXE
  PID:224
- C:\Windows\System\vIUVgqL.exe
  C:\Windows\System\vIUVgqL.exe
  2⤵
  - Executes dropped EXE
  PID:2012
- C:\Windows\System\VHYqbXd.exe
  C:\Windows\System\VHYqbXd.exe
  2⤵
  - Executes dropped EXE
  PID:1124
- C:\Windows\System\NLdObbQ.exe
  C:\Windows\System\NLdObbQ.exe
  2⤵
  - Executes dropped EXE
  PID:3196
- C:\Windows\System\bfVcefn.exe
  C:\Windows\System\bfVcefn.exe
  2⤵
  - Executes dropped EXE
  PID:744
- C:\Windows\System\omBUCyD.exe
  C:\Windows\System\omBUCyD.exe
  2⤵
  - Executes dropped EXE
  PID:3472
- C:\Windows\System\tWMsvar.exe
  C:\Windows\System\tWMsvar.exe
  2⤵
  - Executes dropped EXE
  PID:1408
- C:\Windows\System\WhkPpPl.exe
  C:\Windows\System\WhkPpPl.exe
  2⤵
  - Executes dropped EXE
  PID:4280
- C:\Windows\System\reMaimt.exe
  C:\Windows\System\reMaimt.exe
  2⤵
  - Executes dropped EXE
  PID:3464
- C:\Windows\System\fKSuHOq.exe
  C:\Windows\System\fKSuHOq.exe
  2⤵
  - Executes dropped EXE
  PID:4472
- C:\Windows\System\ZNObqRU.exe
  C:\Windows\System\ZNObqRU.exe
  2⤵
  - Executes dropped EXE
  PID:4780
- C:\Windows\System\BryZZdI.exe
  C:\Windows\System\BryZZdI.exe
  2⤵
  - Executes dropped EXE
  PID:4992
- C:\Windows\System\dLyTqPK.exe
  C:\Windows\System\dLyTqPK.exe
  2⤵
  - Executes dropped EXE
  PID:928
- C:\Windows\System\gkygTpc.exe
  C:\Windows\System\gkygTpc.exe
  2⤵
  - Executes dropped EXE
  PID:1156
- C:\Windows\System\ckcUuWM.exe
  C:\Windows\System\ckcUuWM.exe
  2⤵
  - Executes dropped EXE
  PID:3444
- C:\Windows\System\gvceGKk.exe
  C:\Windows\System\gvceGKk.exe
  2⤵
  - Executes dropped EXE
  PID:2888
- C:\Windows\System\bsywOou.exe
  C:\Windows\System\bsywOou.exe
  2⤵
  - Executes dropped EXE
  PID:2388
- C:\Windows\System\IKrUlEM.exe
  C:\Windows\System\IKrUlEM.exe
  2⤵
  - Executes dropped EXE
  PID:972
- C:\Windows\System\sraIAyI.exe
  C:\Windows\System\sraIAyI.exe
  2⤵
  - Executes dropped EXE
  PID:5012
- C:\Windows\System\RHiiUxh.exe
  C:\Windows\System\RHiiUxh.exe
  2⤵
  - Executes dropped EXE
  PID:4508
- C:\Windows\System\KAisIdh.exe
  C:\Windows\System\KAisIdh.exe
  2⤵
  - Executes dropped EXE
  PID:1980
- C:\Windows\System\pGnxZkY.exe
  C:\Windows\System\pGnxZkY.exe
  2⤵
  - Executes dropped EXE
  PID:2584
- C:\Windows\System\yOJtXIe.exe
  C:\Windows\System\yOJtXIe.exe
  2⤵
  - Executes dropped EXE
  PID:3896
- C:\Windows\System\axpeYoL.exe
  C:\Windows\System\axpeYoL.exe
  2⤵
  - Executes dropped EXE
  PID:2008
- C:\Windows\System\JMCgCQo.exe
  C:\Windows\System\JMCgCQo.exe
  2⤵
  - Executes dropped EXE
  PID:2188
- C:\Windows\System\AcMVBLN.exe
  C:\Windows\System\AcMVBLN.exe
  2⤵
  - Executes dropped EXE
  PID:4336
- C:\Windows\System\aUPiCMY.exe
  C:\Windows\System\aUPiCMY.exe
  2⤵
  - Executes dropped EXE
  PID:924
- C:\Windows\System\UaXybse.exe
  C:\Windows\System\UaXybse.exe
  2⤵
  - Executes dropped EXE
  PID:3400
- C:\Windows\System\tNuTMHF.exe
  C:\Windows\System\tNuTMHF.exe
  2⤵
  - Executes dropped EXE
  PID:2184
- C:\Windows\System\auvbgLs.exe
  C:\Windows\System\auvbgLs.exe
  2⤵
  - Executes dropped EXE
  PID:1472
- C:\Windows\System\oPuOWeS.exe
  C:\Windows\System\oPuOWeS.exe
  2⤵
  - Executes dropped EXE
  PID:3496
- C:\Windows\System\LCUMZdc.exe
  C:\Windows\System\LCUMZdc.exe
  2⤵
  - Executes dropped EXE
  PID:2948
- C:\Windows\System\WfNsfqX.exe
  C:\Windows\System\WfNsfqX.exe
  2⤵
  - Executes dropped EXE
  PID:4264
- C:\Windows\System\FFqUikM.exe
  C:\Windows\System\FFqUikM.exe
  2⤵
  - Executes dropped EXE
  PID:2224
- C:\Windows\System\wBkwUJy.exe
  C:\Windows\System\wBkwUJy.exe
  2⤵
  - Executes dropped EXE
  PID:3676
- C:\Windows\System\NAucFOy.exe
  C:\Windows\System\NAucFOy.exe
  2⤵
  - Executes dropped EXE
  PID:4916
- C:\Windows\System\uRYgbEA.exe
  C:\Windows\System\uRYgbEA.exe
  2⤵
  - Executes dropped EXE
  PID:4980
- C:\Windows\System\CzSHolI.exe
  C:\Windows\System\CzSHolI.exe
  2⤵
  - Executes dropped EXE
  PID:5028
- C:\Windows\System\PHmnkuB.exe
  C:\Windows\System\PHmnkuB.exe
  2⤵
  - Executes dropped EXE
  PID:700
- C:\Windows\System\VkzLfpC.exe
  C:\Windows\System\VkzLfpC.exe
  2⤵
  - Executes dropped EXE
  PID:2540
- C:\Windows\System\KmxqMth.exe
  C:\Windows\System\KmxqMth.exe
  2⤵
  - Executes dropped EXE
  PID:3936
- C:\Windows\System\RCuBARR.exe
  C:\Windows\System\RCuBARR.exe
  2⤵
  - Executes dropped EXE
  PID:5040
- C:\Windows\System\oYVhXSS.exe
  C:\Windows\System\oYVhXSS.exe
  2⤵
  - Executes dropped EXE
  PID:1312
- C:\Windows\System\PcbEmpD.exe
  C:\Windows\System\PcbEmpD.exe
  2⤵
  - Executes dropped EXE
  PID:600
- C:\Windows\System\LRMDebb.exe
  C:\Windows\System\LRMDebb.exe
  2⤵
  - Executes dropped EXE
  PID:2300
- C:\Windows\System\dCiXFdv.exe
  C:\Windows\System\dCiXFdv.exe
  2⤵
  - Executes dropped EXE
  PID:1852
- C:\Windows\System\FMQIJcD.exe
  C:\Windows\System\FMQIJcD.exe
  2⤵
  - Executes dropped EXE
  PID:212
- C:\Windows\System\gnjFwMI.exe
  C:\Windows\System\gnjFwMI.exe
  2⤵
  - Executes dropped EXE
  PID:2568
- C:\Windows\System\bumCJqa.exe
  C:\Windows\System\bumCJqa.exe
  2⤵
  - Executes dropped EXE
  PID:3552
- C:\Windows\System\ghheOWN.exe
  C:\Windows\System\ghheOWN.exe
  2⤵
  - Executes dropped EXE
  PID:216
- C:\Windows\System\vMXsaaS.exe
  C:\Windows\System\vMXsaaS.exe
  2⤵
  - Executes dropped EXE
  PID:2208
- C:\Windows\System\FwUnIJf.exe
  C:\Windows\System\FwUnIJf.exe
  2⤵
  - Executes dropped EXE
  PID:1160
- C:\Windows\System\LoNqWGf.exe
  C:\Windows\System\LoNqWGf.exe
  2⤵
  - Executes dropped EXE
  PID:896
- C:\Windows\System\KNAIiVh.exe
  C:\Windows\System\KNAIiVh.exe
  2⤵
  - Executes dropped EXE
  PID:544
- C:\Windows\System\xTxhvJu.exe
  C:\Windows\System\xTxhvJu.exe
  2⤵
  - Executes dropped EXE
  PID:2344
- C:\Windows\System\nfEiyjs.exe
  C:\Windows\System\nfEiyjs.exe
  2⤵
  - Executes dropped EXE
  PID:2712
- C:\Windows\System\NaNecaG.exe
  C:\Windows\System\NaNecaG.exe
  2⤵
  - Executes dropped EXE
  PID:5112
- C:\Windows\System\EpehutR.exe
  C:\Windows\System\EpehutR.exe
  2⤵
  PID:2212
- C:\Windows\System\yeipmBD.exe
  C:\Windows\System\yeipmBD.exe
  2⤵
  PID:1116
- C:\Windows\System\iEQkiPx.exe
  C:\Windows\System\iEQkiPx.exe
  2⤵
  PID:3100
- C:\Windows\System\dclHota.exe
  C:\Windows\System\dclHota.exe
  2⤵
  PID:1736
- C:\Windows\System\YyiBvZW.exe
  C:\Windows\System\YyiBvZW.exe
  2⤵
  PID:4856
- C:\Windows\System\LFCDCie.exe
  C:\Windows\System\LFCDCie.exe
  2⤵
  PID:2172
- C:\Windows\System\qasmEoC.exe
  C:\Windows\System\qasmEoC.exe
  2⤵
  PID:4764
- C:\Windows\System\cGAEgKS.exe
  C:\Windows\System\cGAEgKS.exe
  2⤵
  PID:3640
- C:\Windows\System\rgxWwiL.exe
  C:\Windows\System\rgxWwiL.exe
  2⤵
  PID:1712
- C:\Windows\System\BbGbeHy.exe
  C:\Windows\System\BbGbeHy.exe
  2⤵
  PID:3004
- C:\Windows\System\oDMaOLo.exe
  C:\Windows\System\oDMaOLo.exe
  2⤵
  PID:5088
- C:\Windows\System\fmyYsXl.exe
  C:\Windows\System\fmyYsXl.exe
  2⤵
  PID:2320
- C:\Windows\System\AlrWXOv.exe
  C:\Windows\System\AlrWXOv.exe
  2⤵
  PID:2480
- C:\Windows\System\CumlbWp.exe
  C:\Windows\System\CumlbWp.exe
  2⤵
  PID:428
- C:\Windows\System\mJGakRe.exe
  C:\Windows\System\mJGakRe.exe
  2⤵
  PID:1836
- C:\Windows\System\ODRSQww.exe
  C:\Windows\System\ODRSQww.exe
  2⤵
  PID:3944
- C:\Windows\System\dZNYfSQ.exe
  C:\Windows\System\dZNYfSQ.exe
  2⤵
  PID:1964
- C:\Windows\System\ttHtHMT.exe
  C:\Windows\System\ttHtHMT.exe
  2⤵
  PID:2892
- C:\Windows\System\IeEMmVu.exe
  C:\Windows\System\IeEMmVu.exe
  2⤵
  PID:4000
- C:\Windows\System\nTWWopz.exe
  C:\Windows\System\nTWWopz.exe
  2⤵
  PID:3684
- C:\Windows\System\uclXZvZ.exe
  C:\Windows\System\uclXZvZ.exe
  2⤵
  PID:1684
- C:\Windows\System\noaHyIh.exe
  C:\Windows\System\noaHyIh.exe
  2⤵
  PID:1904
- C:\Windows\System\QSXRHbb.exe
  C:\Windows\System\QSXRHbb.exe
  2⤵
  PID:1844
- C:\Windows\System\zQiDaus.exe
  C:\Windows\System\zQiDaus.exe
  2⤵
  PID:1384
- C:\Windows\System\KVDAPSr.exe
  C:\Windows\System\KVDAPSr.exe
  2⤵
  PID:5060
- C:\Windows\System\ekkjNqY.exe
  C:\Windows\System\ekkjNqY.exe
  2⤵
  PID:516
- C:\Windows\System\yZUkSlY.exe
  C:\Windows\System\yZUkSlY.exe
  2⤵
  PID:552
- C:\Windows\System\giqLIbH.exe
  C:\Windows\System\giqLIbH.exe
  2⤵
  PID:2124
- C:\Windows\System\ipwgBLe.exe
  C:\Windows\System\ipwgBLe.exe
  2⤵
  PID:2556
- C:\Windows\System\BhillpD.exe
  C:\Windows\System\BhillpD.exe
  2⤵
  PID:2200
- C:\Windows\System\nHoPMuX.exe
  C:\Windows\System\nHoPMuX.exe
  2⤵
  PID:4704
- C:\Windows\System\NFlDlNd.exe
  C:\Windows\System\NFlDlNd.exe
  2⤵
  PID:3744
- C:\Windows\System\sXMPoGH.exe
  C:\Windows\System\sXMPoGH.exe
  2⤵
  PID:4364
- C:\Windows\System\BDgDPvk.exe
  C:\Windows\System\BDgDPvk.exe
  2⤵
  PID:4684
- C:\Windows\System\FebumEn.exe
  C:\Windows\System\FebumEn.exe
  2⤵
  PID:64
- C:\Windows\System\UXwQIDc.exe
  C:\Windows\System\UXwQIDc.exe
  2⤵
  PID:4320
- C:\Windows\System\qwhbNhN.exe
  C:\Windows\System\qwhbNhN.exe
  2⤵
  PID:1032
- C:\Windows\System\mnTJaSw.exe
  C:\Windows\System\mnTJaSw.exe
  2⤵
  PID:1604
- C:\Windows\System\jZAIXmA.exe
  C:\Windows\System\jZAIXmA.exe
  2⤵
  PID:720
- C:\Windows\System\xWeSfqJ.exe
  C:\Windows\System\xWeSfqJ.exe
  2⤵
  PID:3548
- C:\Windows\System\WpLpMtA.exe
  C:\Windows\System\WpLpMtA.exe
  2⤵
  PID:4352
- C:\Windows\System\KRPjVQs.exe
  C:\Windows\System\KRPjVQs.exe
  2⤵
  PID:3612
- C:\Windows\System\GhmyPsX.exe
  C:\Windows\System\GhmyPsX.exe
  2⤵
  PID:1492
- C:\Windows\System\HPZQcRy.exe
  C:\Windows\System\HPZQcRy.exe
  2⤵
  PID:2876
- C:\Windows\System\VJnsbFf.exe
  C:\Windows\System\VJnsbFf.exe
  2⤵
  PID:2572
- C:\Windows\System\CTsESfb.exe
  C:\Windows\System\CTsESfb.exe
  2⤵
  PID:4284
- C:\Windows\System\xqHAaKG.exe
  C:\Windows\System\xqHAaKG.exe
  2⤵
  PID:5132
- C:\Windows\System\ctfzVui.exe
  C:\Windows\System\ctfzVui.exe
  2⤵
  PID:5156
- C:\Windows\System\uwjeoQm.exe
  C:\Windows\System\uwjeoQm.exe
  2⤵
  PID:5188
- C:\Windows\System\cwUahJI.exe
  C:\Windows\System\cwUahJI.exe
  2⤵
  PID:5216
- C:\Windows\System\HKkHddp.exe
  C:\Windows\System\HKkHddp.exe
  2⤵
  PID:5240
- C:\Windows\System\dQSNdlC.exe
  C:\Windows\System\dQSNdlC.exe
  2⤵
  PID:5276
- C:\Windows\System\QPqwbZi.exe
  C:\Windows\System\QPqwbZi.exe
  2⤵
  PID:5304
- C:\Windows\System\YizRWdn.exe
  C:\Windows\System\YizRWdn.exe
  2⤵
  PID:5336
- C:\Windows\System\OWeonug.exe
  C:\Windows\System\OWeonug.exe
  2⤵
  PID:5356
- C:\Windows\System\nOhcDFb.exe
  C:\Windows\System\nOhcDFb.exe
  2⤵
  PID:5388
- C:\Windows\System\XRJuXEt.exe
  C:\Windows\System\XRJuXEt.exe
  2⤵
  PID:5408
- C:\Windows\System\QXBsfco.exe
  C:\Windows\System\QXBsfco.exe
  2⤵
  PID:5428
- C:\Windows\System\sSXOBfA.exe
  C:\Windows\System\sSXOBfA.exe
  2⤵
  PID:5456
- C:\Windows\System\CqZedsR.exe
  C:\Windows\System\CqZedsR.exe
  2⤵
  PID:5484
- C:\Windows\System\TfUeGwr.exe
  C:\Windows\System\TfUeGwr.exe
  2⤵
  PID:5524
- C:\Windows\System\VeyNzEE.exe
  C:\Windows\System\VeyNzEE.exe
  2⤵
  PID:5556
- C:\Windows\System\TQaCaND.exe
  C:\Windows\System\TQaCaND.exe
  2⤵
  PID:5584
- C:\Windows\System\PYNDpkh.exe
  C:\Windows\System\PYNDpkh.exe
  2⤵
  PID:5620
- C:\Windows\System\oHHeiyy.exe
  C:\Windows\System\oHHeiyy.exe
  2⤵
  PID:5640
- C:\Windows\System\NoqtkQz.exe
  C:\Windows\System\NoqtkQz.exe
  2⤵
  PID:5664
- C:\Windows\System\fLDLOCT.exe
  C:\Windows\System\fLDLOCT.exe
  2⤵
  PID:5680
- C:\Windows\System\vwAbQEv.exe
  C:\Windows\System\vwAbQEv.exe
  2⤵
  PID:5712
- C:\Windows\System\msFsbdo.exe
  C:\Windows\System\msFsbdo.exe
  2⤵
  PID:5740
- C:\Windows\System\hTNdiqD.exe
  C:\Windows\System\hTNdiqD.exe
  2⤵
  PID:5772
- C:\Windows\System\nBgDMmL.exe
  C:\Windows\System\nBgDMmL.exe
  2⤵
  PID:5792
- C:\Windows\System\YMLNNVd.exe
  C:\Windows\System\YMLNNVd.exe
  2⤵
  PID:5816
- C:\Windows\System\ypmjxAY.exe
  C:\Windows\System\ypmjxAY.exe
  2⤵
  PID:5852
- C:\Windows\System\hpmDPYt.exe
  C:\Windows\System\hpmDPYt.exe
  2⤵
  PID:5888
- C:\Windows\System\stMtMiK.exe
  C:\Windows\System\stMtMiK.exe
  2⤵
  PID:5916
- C:\Windows\System\ihLwTFQ.exe
  C:\Windows\System\ihLwTFQ.exe
  2⤵
  PID:5948
- C:\Windows\System\zZLubyK.exe
  C:\Windows\System\zZLubyK.exe
  2⤵
  PID:5972
- C:\Windows\System\CagebxU.exe
  C:\Windows\System\CagebxU.exe
  2⤵
  PID:5996
- C:\Windows\System\NdjivoF.exe
  C:\Windows\System\NdjivoF.exe
  2⤵
  PID:6032
- C:\Windows\System\ebEtYii.exe
  C:\Windows\System\ebEtYii.exe
  2⤵
  PID:6056
- C:\Windows\System\NloPPMH.exe
  C:\Windows\System\NloPPMH.exe
  2⤵
  PID:6084
- C:\Windows\System\NcRySWq.exe
  C:\Windows\System\NcRySWq.exe
  2⤵
  PID:6112
- C:\Windows\System\kPrXCNg.exe
  C:\Windows\System\kPrXCNg.exe
  2⤵
  PID:6140
- C:\Windows\System\ooVjAPF.exe
  C:\Windows\System\ooVjAPF.exe
  2⤵
  PID:2728
- C:\Windows\System\UOGJqJp.exe
  C:\Windows\System\UOGJqJp.exe
  2⤵
  PID:5208
- C:\Windows\System\WwPzIHY.exe
  C:\Windows\System\WwPzIHY.exe
  2⤵
  PID:5264
- C:\Windows\System\oMKVtmE.exe
  C:\Windows\System\oMKVtmE.exe
  2⤵
  PID:5328
- C:\Windows\System\DfsZRtF.exe
  C:\Windows\System\DfsZRtF.exe
  2⤵
  PID:5372
- C:\Windows\System\SNiNmBX.exe
  C:\Windows\System\SNiNmBX.exe
  2⤵
  PID:5416
- C:\Windows\System\VkzVIzE.exe
  C:\Windows\System\VkzVIzE.exe
  2⤵
  PID:5464
- C:\Windows\System\PUMZeRz.exe
  C:\Windows\System\PUMZeRz.exe
  2⤵
  PID:5536
- C:\Windows\System\ZEefqOB.exe
  C:\Windows\System\ZEefqOB.exe
  2⤵
  PID:5616
- C:\Windows\System\fjSJDFc.exe
  C:\Windows\System\fjSJDFc.exe
  2⤵
  PID:5672
- C:\Windows\System\XgbeERC.exe
  C:\Windows\System\XgbeERC.exe
  2⤵
  PID:5780
- C:\Windows\System\uJUVUzB.exe
  C:\Windows\System\uJUVUzB.exe
  2⤵
  PID:5844
- C:\Windows\System\dkZKKlp.exe
  C:\Windows\System\dkZKKlp.exe
  2⤵
  PID:5904
- C:\Windows\System\zbzjwPD.exe
  C:\Windows\System\zbzjwPD.exe
  2⤵
  PID:5960
- C:\Windows\System\lAGmBzc.exe
  C:\Windows\System\lAGmBzc.exe
  2⤵
  PID:6028
- C:\Windows\System\eLBcjbM.exe
  C:\Windows\System\eLBcjbM.exe
  2⤵
  PID:6068
- C:\Windows\System\iKOzpIV.exe
  C:\Windows\System\iKOzpIV.exe
  2⤵
  PID:6124
- C:\Windows\System\SvyDBzx.exe
  C:\Windows\System\SvyDBzx.exe
  2⤵
  PID:5172
- C:\Windows\System\fcUKeov.exe
  C:\Windows\System\fcUKeov.exe
  2⤵
  PID:5296
- C:\Windows\System\KJgeVNW.exe
  C:\Windows\System\KJgeVNW.exe
  2⤵
  PID:5424
- C:\Windows\System\oHIfmZw.exe
  C:\Windows\System\oHIfmZw.exe
  2⤵
  PID:5592
- C:\Windows\System\OCoknUG.exe
  C:\Windows\System\OCoknUG.exe
  2⤵
  PID:5900
- C:\Windows\System\ZcXxuGm.exe
  C:\Windows\System\ZcXxuGm.exe
  2⤵
  PID:5880
- C:\Windows\System\QYryICP.exe
  C:\Windows\System\QYryICP.exe
  2⤵
  PID:5168
- C:\Windows\System\kOWFyEu.exe
  C:\Windows\System\kOWFyEu.exe
  2⤵
  PID:5232
- C:\Windows\System\SZNksFW.exe
  C:\Windows\System\SZNksFW.exe
  2⤵
  PID:5440
- C:\Windows\System\jHeOxmz.exe
  C:\Windows\System\jHeOxmz.exe
  2⤵
  PID:6100
- C:\Windows\System\rcDTFpI.exe
  C:\Windows\System\rcDTFpI.exe
  2⤵
  PID:5676
- C:\Windows\System\qyfIFyi.exe
  C:\Windows\System\qyfIFyi.exe
  2⤵
  PID:6148
- C:\Windows\System\qOQEpmM.exe
  C:\Windows\System\qOQEpmM.exe
  2⤵
  PID:6180
- C:\Windows\System\BVxDtrD.exe
  C:\Windows\System\BVxDtrD.exe
  2⤵
  PID:6208
- C:\Windows\System\XSikzeT.exe
  C:\Windows\System\XSikzeT.exe
  2⤵
  PID:6236
- C:\Windows\System\tXrsZZz.exe
  C:\Windows\System\tXrsZZz.exe
  2⤵
  PID:6268
- C:\Windows\System\JagLXtg.exe
  C:\Windows\System\JagLXtg.exe
  2⤵
  PID:6304
- C:\Windows\System\mYSkvvU.exe
  C:\Windows\System\mYSkvvU.exe
  2⤵
  PID:6340
- C:\Windows\System\SJodnTN.exe
  C:\Windows\System\SJodnTN.exe
  2⤵
  PID:6364
- C:\Windows\System\zrxyLnh.exe
  C:\Windows\System\zrxyLnh.exe
  2⤵
  PID:6384
- C:\Windows\System\EpssYxO.exe
  C:\Windows\System\EpssYxO.exe
  2⤵
  PID:6408
- C:\Windows\System\JrNsifZ.exe
  C:\Windows\System\JrNsifZ.exe
  2⤵
  PID:6444
- C:\Windows\System\kzQMYRt.exe
  C:\Windows\System\kzQMYRt.exe
  2⤵
  PID:6484
- C:\Windows\System\UAFqslI.exe
  C:\Windows\System\UAFqslI.exe
  2⤵
  PID:6504
- C:\Windows\System\ZwJDxfN.exe
  C:\Windows\System\ZwJDxfN.exe
  2⤵
  PID:6532
- C:\Windows\System\gRLrYUo.exe
  C:\Windows\System\gRLrYUo.exe
  2⤵
  PID:6556
- C:\Windows\System\lwTOOkX.exe
  C:\Windows\System\lwTOOkX.exe
  2⤵
  PID:6588
- C:\Windows\System\mASMyPb.exe
  C:\Windows\System\mASMyPb.exe
  2⤵
  PID:6616
- C:\Windows\System\ehwMuih.exe
  C:\Windows\System\ehwMuih.exe
  2⤵
  PID:6640
- C:\Windows\System\ZUowgby.exe
  C:\Windows\System\ZUowgby.exe
  2⤵
  PID:6668
- C:\Windows\System\sPAudpH.exe
  C:\Windows\System\sPAudpH.exe
  2⤵
  PID:6700
- C:\Windows\System\URYBRFj.exe
  C:\Windows\System\URYBRFj.exe
  2⤵
  PID:6728
- C:\Windows\System\ZBWJCle.exe
  C:\Windows\System\ZBWJCle.exe
  2⤵
  PID:6760
- C:\Windows\System\NRUkbPR.exe
  C:\Windows\System\NRUkbPR.exe
  2⤵
  PID:6776
- C:\Windows\System\YhfpgeR.exe
  C:\Windows\System\YhfpgeR.exe
  2⤵
  PID:6804
- C:\Windows\System\nskONVH.exe
  C:\Windows\System\nskONVH.exe
  2⤵
  PID:6828
- C:\Windows\System\vBrSLom.exe
  C:\Windows\System\vBrSLom.exe
  2⤵
  PID:6848
- C:\Windows\System\CtbnCUh.exe
  C:\Windows\System\CtbnCUh.exe
  2⤵
  PID:6880
- C:\Windows\System\MxjPEat.exe
  C:\Windows\System\MxjPEat.exe
  2⤵
  PID:6908
- C:\Windows\System\EsYaLxd.exe
  C:\Windows\System\EsYaLxd.exe
  2⤵
  PID:6944
- C:\Windows\System\gQBiiqp.exe
  C:\Windows\System\gQBiiqp.exe
  2⤵
  PID:6976
- C:\Windows\System\heihQVx.exe
  C:\Windows\System\heihQVx.exe
  2⤵
  PID:7000
- C:\Windows\System\iaBvyKK.exe
  C:\Windows\System\iaBvyKK.exe
  2⤵
  PID:7028
- C:\Windows\System\Hhsbvdk.exe
  C:\Windows\System\Hhsbvdk.exe
  2⤵
  PID:7052
- C:\Windows\System\gtbkRxI.exe
  C:\Windows\System\gtbkRxI.exe
  2⤵
  PID:7084
- C:\Windows\System\GINSjYo.exe
  C:\Windows\System\GINSjYo.exe
  2⤵
  PID:7116
- C:\Windows\System\kWAMhCK.exe
  C:\Windows\System\kWAMhCK.exe
  2⤵
  PID:7136
- C:\Windows\System\QYohoCN.exe
  C:\Windows\System\QYohoCN.exe
  2⤵
  PID:5660
- C:\Windows\System\TKRCmXB.exe
  C:\Windows\System\TKRCmXB.exe
  2⤵
  PID:6188
- C:\Windows\System\TwssJlU.exe
  C:\Windows\System\TwssJlU.exe
  2⤵
  PID:6232
- C:\Windows\System\drYzbEO.exe
  C:\Windows\System\drYzbEO.exe
  2⤵
  PID:6328
- C:\Windows\System\EnAXaYC.exe
  C:\Windows\System\EnAXaYC.exe
  2⤵
  PID:6404
- C:\Windows\System\pYCnqzd.exe
  C:\Windows\System\pYCnqzd.exe
  2⤵
  PID:6432
- C:\Windows\System\ghMKfnn.exe
  C:\Windows\System\ghMKfnn.exe
  2⤵
  PID:6496
- C:\Windows\System\mOChVBl.exe
  C:\Windows\System\mOChVBl.exe
  2⤵
  PID:6568
- C:\Windows\System\MmNYcsK.exe
  C:\Windows\System\MmNYcsK.exe
  2⤵
  PID:6660
- C:\Windows\System\cqKavku.exe
  C:\Windows\System\cqKavku.exe
  2⤵
  PID:6736
- C:\Windows\System\bHPkbWO.exe
  C:\Windows\System\bHPkbWO.exe
  2⤵
  PID:6788
- C:\Windows\System\EozlZxs.exe
  C:\Windows\System\EozlZxs.exe
  2⤵
  PID:6840
- C:\Windows\System\KCnoZKx.exe
  C:\Windows\System\KCnoZKx.exe
  2⤵
  PID:6936
- C:\Windows\System\VDpPYCE.exe
  C:\Windows\System\VDpPYCE.exe
  2⤵
  PID:7020
- C:\Windows\System\VjmlnCH.exe
  C:\Windows\System\VjmlnCH.exe
  2⤵
  PID:7072
- C:\Windows\System\bTBSYWl.exe
  C:\Windows\System\bTBSYWl.exe
  2⤵
  PID:6072
- C:\Windows\System\CVHHykH.exe
  C:\Windows\System\CVHHykH.exe
  2⤵
  PID:5968
- C:\Windows\System\fFjCXJl.exe
  C:\Windows\System\fFjCXJl.exe
  2⤵
  PID:6348
- C:\Windows\System\XYNTcJw.exe
  C:\Windows\System\XYNTcJw.exe
  2⤵
  PID:6400
- C:\Windows\System\AdDYvGV.exe
  C:\Windows\System\AdDYvGV.exe
  2⤵
  PID:6680
- C:\Windows\System\kLUHnpa.exe
  C:\Windows\System\kLUHnpa.exe
  2⤵
  PID:6836
- C:\Windows\System\dnkPbhV.exe
  C:\Windows\System\dnkPbhV.exe
  2⤵
  PID:6892
- C:\Windows\System\xFlKJZz.exe
  C:\Windows\System\xFlKJZz.exe
  2⤵
  PID:7092
- C:\Windows\System\LBuiMoI.exe
  C:\Windows\System\LBuiMoI.exe
  2⤵
  PID:6468
- C:\Windows\System\WRGgktc.exe
  C:\Windows\System\WRGgktc.exe
  2⤵
  PID:6472
- C:\Windows\System\abWYdhp.exe
  C:\Windows\System\abWYdhp.exe
  2⤵
  PID:6916
- C:\Windows\System\rXQmRMt.exe
  C:\Windows\System\rXQmRMt.exe
  2⤵
  PID:6332
- C:\Windows\System\vTZeRyr.exe
  C:\Windows\System\vTZeRyr.exe
  2⤵
  PID:7176
- C:\Windows\System\JMQQfba.exe
  C:\Windows\System\JMQQfba.exe
  2⤵
  PID:7204
- C:\Windows\System\MEBrfFk.exe
  C:\Windows\System\MEBrfFk.exe
  2⤵
  PID:7228
- C:\Windows\System\alISwyd.exe
  C:\Windows\System\alISwyd.exe
  2⤵
  PID:7252
- C:\Windows\System\QoGprip.exe
  C:\Windows\System\QoGprip.exe
  2⤵
  PID:7284
- C:\Windows\System\wVQMRcm.exe
  C:\Windows\System\wVQMRcm.exe
  2⤵
  PID:7316
- C:\Windows\System\GbjGqZB.exe
  C:\Windows\System\GbjGqZB.exe
  2⤵
  PID:7340
- C:\Windows\System\uDQQqgn.exe
  C:\Windows\System\uDQQqgn.exe
  2⤵
  PID:7368
- C:\Windows\System\ZDajERI.exe
  C:\Windows\System\ZDajERI.exe
  2⤵
  PID:7396
- C:\Windows\System\xnLbSWC.exe
  C:\Windows\System\xnLbSWC.exe
  2⤵
  PID:7412
- C:\Windows\System\lIvfaPl.exe
  C:\Windows\System\lIvfaPl.exe
  2⤵
  PID:7440
- C:\Windows\System\WqPfjFb.exe
  C:\Windows\System\WqPfjFb.exe
  2⤵
  PID:7456
- C:\Windows\System\MyOeaDV.exe
  C:\Windows\System\MyOeaDV.exe
  2⤵
  PID:7496
- C:\Windows\System\BKMEIQu.exe
  C:\Windows\System\BKMEIQu.exe
  2⤵
  PID:7520
- C:\Windows\System\XafDjWG.exe
  C:\Windows\System\XafDjWG.exe
  2⤵
  PID:7552
- C:\Windows\System\FUXppnt.exe
  C:\Windows\System\FUXppnt.exe
  2⤵
  PID:7572
- C:\Windows\System\fogYbyl.exe
  C:\Windows\System\fogYbyl.exe
  2⤵
  PID:7600
- C:\Windows\System\tikTVFR.exe
  C:\Windows\System\tikTVFR.exe
  2⤵
  PID:7632
- C:\Windows\System\PbIbfgV.exe
  C:\Windows\System\PbIbfgV.exe
  2⤵
  PID:7656
- C:\Windows\System\pujSubp.exe
  C:\Windows\System\pujSubp.exe
  2⤵
  PID:7684
- C:\Windows\System\WeGvblY.exe
  C:\Windows\System\WeGvblY.exe
  2⤵
  PID:7716
- C:\Windows\System\vGvLrrQ.exe
  C:\Windows\System\vGvLrrQ.exe
  2⤵
  PID:7760
- C:\Windows\System\QbhRzGA.exe
  C:\Windows\System\QbhRzGA.exe
  2⤵
  PID:7780
- C:\Windows\System\EIXUkOM.exe
  C:\Windows\System\EIXUkOM.exe
  2⤵
  PID:7800
- C:\Windows\System\ihegFUe.exe
  C:\Windows\System\ihegFUe.exe
  2⤵
  PID:7836
- C:\Windows\System\YCDVINN.exe
  C:\Windows\System\YCDVINN.exe
  2⤵
  PID:7860
- C:\Windows\System\LyrXtyS.exe
  C:\Windows\System\LyrXtyS.exe
  2⤵
  PID:7892
- C:\Windows\System\IHqFNNY.exe
  C:\Windows\System\IHqFNNY.exe
  2⤵
  PID:7916
- C:\Windows\System\NvawbPT.exe
  C:\Windows\System\NvawbPT.exe
  2⤵
  PID:7948
- C:\Windows\System\oLMlrPk.exe
  C:\Windows\System\oLMlrPk.exe
  2⤵
  PID:7964
- C:\Windows\System\hesxUWP.exe
  C:\Windows\System\hesxUWP.exe
  2⤵
  PID:7996
- C:\Windows\System\OOPhKTT.exe
  C:\Windows\System\OOPhKTT.exe
  2⤵
  PID:8044
- C:\Windows\System\ySVBubg.exe
  C:\Windows\System\ySVBubg.exe
  2⤵
  PID:8060
- C:\Windows\System\soCdZEi.exe
  C:\Windows\System\soCdZEi.exe
  2⤵
  PID:8092
- C:\Windows\System\tVZxjLf.exe
  C:\Windows\System\tVZxjLf.exe
  2⤵
  PID:8116
- C:\Windows\System\grSxkLm.exe
  C:\Windows\System\grSxkLm.exe
  2⤵
  PID:8156
- C:\Windows\System\dorQXqv.exe
  C:\Windows\System\dorQXqv.exe
  2⤵
  PID:8176
- C:\Windows\System\KZLcFjz.exe
  C:\Windows\System\KZLcFjz.exe
  2⤵
  PID:7196
- C:\Windows\System\ekxiACh.exe
  C:\Windows\System\ekxiACh.exe
  2⤵
  PID:7260
- C:\Windows\System\LNwOoFy.exe
  C:\Windows\System\LNwOoFy.exe
  2⤵
  PID:7300
- C:\Windows\System\euWZCrB.exe
  C:\Windows\System\euWZCrB.exe
  2⤵
  PID:7384
- C:\Windows\System\dClfbnT.exe
  C:\Windows\System\dClfbnT.exe
  2⤵
  PID:7432
- C:\Windows\System\PENvWih.exe
  C:\Windows\System\PENvWih.exe
  2⤵
  PID:7476
- C:\Windows\System\EBaeTEn.exe
  C:\Windows\System\EBaeTEn.exe
  2⤵
  PID:7452
- C:\Windows\System\gyNsyZX.exe
  C:\Windows\System\gyNsyZX.exe
  2⤵
  PID:7584
- C:\Windows\System\qAsyeAI.exe
  C:\Windows\System\qAsyeAI.exe
  2⤵
  PID:7612
- C:\Windows\System\jggKmzP.exe
  C:\Windows\System\jggKmzP.exe
  2⤵
  PID:7752
- C:\Windows\System\iSTvHKA.exe
  C:\Windows\System\iSTvHKA.exe
  2⤵
  PID:7824
- C:\Windows\System\FiSdyGk.exe
  C:\Windows\System\FiSdyGk.exe
  2⤵
  PID:7908
- C:\Windows\System\nVyJkGp.exe
  C:\Windows\System\nVyJkGp.exe
  2⤵
  PID:7936
- C:\Windows\System\FnsZdfz.exe
  C:\Windows\System\FnsZdfz.exe
  2⤵
  PID:7956
- C:\Windows\System\pksDnKd.exe
  C:\Windows\System\pksDnKd.exe
  2⤵
  PID:8052
- C:\Windows\System\SdmUHlR.exe
  C:\Windows\System\SdmUHlR.exe
  2⤵
  PID:8076
- C:\Windows\System\lEkVcqz.exe
  C:\Windows\System\lEkVcqz.exe
  2⤵
  PID:8140
- C:\Windows\System\pArznXw.exe
  C:\Windows\System\pArznXw.exe
  2⤵
  PID:8152
- C:\Windows\System\lYVaFTO.exe
  C:\Windows\System\lYVaFTO.exe
  2⤵
  PID:7336
- C:\Windows\System\EoCQONP.exe
  C:\Windows\System\EoCQONP.exe
  2⤵
  PID:7480
- C:\Windows\System\dYNmrNc.exe
  C:\Windows\System\dYNmrNc.exe
  2⤵
  PID:7640
- C:\Windows\System\iwQcMMi.exe
  C:\Windows\System\iwQcMMi.exe
  2⤵
  PID:7736
- C:\Windows\System\VJtCKAk.exe
  C:\Windows\System\VJtCKAk.exe
  2⤵
  PID:7976
- C:\Windows\System\KQDNCeH.exe
  C:\Windows\System\KQDNCeH.exe
  2⤵
  PID:7244
- C:\Windows\System\wkyzqgw.exe
  C:\Windows\System\wkyzqgw.exe
  2⤵
  PID:7808
- C:\Windows\System\MHQSHBH.exe
  C:\Windows\System\MHQSHBH.exe
  2⤵
  PID:7588
- C:\Windows\System\urdGFfY.exe
  C:\Windows\System\urdGFfY.exe
  2⤵
  PID:7564
- C:\Windows\System\zFoXmZB.exe
  C:\Windows\System\zFoXmZB.exe
  2⤵
  PID:8216
- C:\Windows\System\BNPDQLJ.exe
  C:\Windows\System\BNPDQLJ.exe
  2⤵
  PID:8244
- C:\Windows\System\RWVjBfB.exe
  C:\Windows\System\RWVjBfB.exe
  2⤵
  PID:8272
- C:\Windows\System\YSkByoX.exe
  C:\Windows\System\YSkByoX.exe
  2⤵
  PID:8288
- C:\Windows\System\xdQpxOy.exe
  C:\Windows\System\xdQpxOy.exe
  2⤵
  PID:8320
- C:\Windows\System\hsVamAK.exe
  C:\Windows\System\hsVamAK.exe
  2⤵
  PID:8348
- C:\Windows\System\kKQfDdP.exe
  C:\Windows\System\kKQfDdP.exe
  2⤵
  PID:8368
- C:\Windows\System\BprttnI.exe
  C:\Windows\System\BprttnI.exe
  2⤵
  PID:8396
- C:\Windows\System\veMypup.exe
  C:\Windows\System\veMypup.exe
  2⤵
  PID:8436
- C:\Windows\System\yBXjcBv.exe
  C:\Windows\System\yBXjcBv.exe
  2⤵
  PID:8468
- C:\Windows\System\jkGzdwx.exe
  C:\Windows\System\jkGzdwx.exe
  2⤵
  PID:8492
- C:\Windows\System\BfaELQn.exe
  C:\Windows\System\BfaELQn.exe
  2⤵
  PID:8524
- C:\Windows\System\qaWSHip.exe
  C:\Windows\System\qaWSHip.exe
  2⤵
  PID:8552
- C:\Windows\System\IYXPhtQ.exe
  C:\Windows\System\IYXPhtQ.exe
  2⤵
  PID:8588
- C:\Windows\System\pbcioVD.exe
  C:\Windows\System\pbcioVD.exe
  2⤵
  PID:8604
- C:\Windows\System\xPzxksH.exe
  C:\Windows\System\xPzxksH.exe
  2⤵
  PID:8620
- C:\Windows\System\DdAjxBd.exe
  C:\Windows\System\DdAjxBd.exe
  2⤵
  PID:8652
- C:\Windows\System\oeZGKES.exe
  C:\Windows\System\oeZGKES.exe
  2⤵
  PID:8684
- C:\Windows\System\eRQgERf.exe
  C:\Windows\System\eRQgERf.exe
  2⤵
  PID:8716
- C:\Windows\System\WaXDwXc.exe
  C:\Windows\System\WaXDwXc.exe
  2⤵
  PID:8744
- C:\Windows\System\dnawrME.exe
  C:\Windows\System\dnawrME.exe
  2⤵
  PID:8776
- C:\Windows\System\mfdnpsT.exe
  C:\Windows\System\mfdnpsT.exe
  2⤵
  PID:8804
- C:\Windows\System\cgBdHWR.exe
  C:\Windows\System\cgBdHWR.exe
  2⤵
  PID:8828
- C:\Windows\System\myBlSIB.exe
  C:\Windows\System\myBlSIB.exe
  2⤵
  PID:8856
- C:\Windows\System\gsREWcU.exe
  C:\Windows\System\gsREWcU.exe
  2⤵
  PID:8888
- C:\Windows\System\dnLglJT.exe
  C:\Windows\System\dnLglJT.exe
  2⤵
  PID:8912
- C:\Windows\System\yrDoEaI.exe
  C:\Windows\System\yrDoEaI.exe
  2⤵
  PID:8940
- C:\Windows\System\CzTDpSj.exe
  C:\Windows\System\CzTDpSj.exe
  2⤵
  PID:8972
- C:\Windows\System\KskIobp.exe
  C:\Windows\System\KskIobp.exe
  2⤵
  PID:9004
- C:\Windows\System\fqYZEEw.exe
  C:\Windows\System\fqYZEEw.exe
  2⤵
  PID:9040
- C:\Windows\System\bRRXIGB.exe
  C:\Windows\System\bRRXIGB.exe
  2⤵
  PID:9056
- C:\Windows\System\masSEIj.exe
  C:\Windows\System\masSEIj.exe
  2⤵
  PID:9088
- C:\Windows\System\VfSgDZI.exe
  C:\Windows\System\VfSgDZI.exe
  2⤵
  PID:9116
- C:\Windows\System\uSiNVSn.exe
  C:\Windows\System\uSiNVSn.exe
  2⤵
  PID:9140
- C:\Windows\System\VBvoJwL.exe
  C:\Windows\System\VBvoJwL.exe
  2⤵
  PID:9168
- C:\Windows\System\CMtvXNf.exe
  C:\Windows\System\CMtvXNf.exe
  2⤵
  PID:9184
- C:\Windows\System\vbvoDHY.exe
  C:\Windows\System\vbvoDHY.exe
  2⤵
  PID:7856
- C:\Windows\System\vKyQCKm.exe
  C:\Windows\System\vKyQCKm.exe
  2⤵
  PID:8196
- C:\Windows\System\DgmNYYM.exe
  C:\Windows\System\DgmNYYM.exe
  2⤵
  PID:8256
- C:\Windows\System\RlIOLTe.exe
  C:\Windows\System\RlIOLTe.exe
  2⤵
  PID:8312
- C:\Windows\System\VVYladH.exe
  C:\Windows\System\VVYladH.exe
  2⤵
  PID:8384
- C:\Windows\System\gbDnSCM.exe
  C:\Windows\System\gbDnSCM.exe
  2⤵
  PID:8456
- C:\Windows\System\DMgHXgu.exe
  C:\Windows\System\DMgHXgu.exe
  2⤵
  PID:8520
- C:\Windows\System\RfaJvRR.exe
  C:\Windows\System\RfaJvRR.exe
  2⤵
  PID:8600
- C:\Windows\System\cYdqyJV.exe
  C:\Windows\System\cYdqyJV.exe
  2⤵
  PID:8692
- C:\Windows\System\eKfeRmT.exe
  C:\Windows\System\eKfeRmT.exe
  2⤵
  PID:8672
- C:\Windows\System\aAjxwzU.exe
  C:\Windows\System\aAjxwzU.exe
  2⤵
  PID:8760
- C:\Windows\System\rpzvfwr.exe
  C:\Windows\System\rpzvfwr.exe
  2⤵
  PID:8812
- C:\Windows\System\wZETMYD.exe
  C:\Windows\System\wZETMYD.exe
  2⤵
  PID:8876
- C:\Windows\System\dKXJdrs.exe
  C:\Windows\System\dKXJdrs.exe
  2⤵
  PID:8932
- C:\Windows\System\AntsHqg.exe
  C:\Windows\System\AntsHqg.exe
  2⤵
  PID:9000
- C:\Windows\System\XQEURpc.exe
  C:\Windows\System\XQEURpc.exe
  2⤵
  PID:9096
- C:\Windows\System\UZEEZNR.exe
  C:\Windows\System\UZEEZNR.exe
  2⤵
  PID:9124
- C:\Windows\System\GrELrWI.exe
  C:\Windows\System\GrELrWI.exe
  2⤵
  PID:9180
- C:\Windows\System\HesdXGX.exe
  C:\Windows\System\HesdXGX.exe
  2⤵
  PID:8332
- C:\Windows\System\SZBGAgW.exe
  C:\Windows\System\SZBGAgW.exe
  2⤵
  PID:8544
- C:\Windows\System\LcUReeR.exe
  C:\Windows\System\LcUReeR.exe
  2⤵
  PID:8848
- C:\Windows\System\nDwoxhR.exe
  C:\Windows\System\nDwoxhR.exe
  2⤵
  PID:8980
- C:\Windows\System\eJHKNVR.exe
  C:\Windows\System\eJHKNVR.exe
  2⤵
  PID:8904
- C:\Windows\System\ViPJKXN.exe
  C:\Windows\System\ViPJKXN.exe
  2⤵
  PID:8228
- C:\Windows\System\ZilfyQn.exe
  C:\Windows\System\ZilfyQn.exe
  2⤵
  PID:8304
- C:\Windows\System\ssOUmel.exe
  C:\Windows\System\ssOUmel.exe
  2⤵
  PID:8800
- C:\Windows\System\qSLsBtV.exe
  C:\Windows\System\qSLsBtV.exe
  2⤵
  PID:9132
- C:\Windows\System\PTdoxFF.exe
  C:\Windows\System\PTdoxFF.exe
  2⤵
  PID:8480
- C:\Windows\System\cAKBvaL.exe
  C:\Windows\System\cAKBvaL.exe
  2⤵
  PID:9248
- C:\Windows\System\VUsMQss.exe
  C:\Windows\System\VUsMQss.exe
  2⤵
  PID:9264
- C:\Windows\System\sYRoUXk.exe
  C:\Windows\System\sYRoUXk.exe
  2⤵
  PID:9292
- C:\Windows\System\fKSvyrM.exe
  C:\Windows\System\fKSvyrM.exe
  2⤵
  PID:9332
- C:\Windows\System\zDngLDL.exe
  C:\Windows\System\zDngLDL.exe
  2⤵
  PID:9364
- C:\Windows\System\lzZlgOA.exe
  C:\Windows\System\lzZlgOA.exe
  2⤵
  PID:9388
- C:\Windows\System\qLvIneE.exe
  C:\Windows\System\qLvIneE.exe
  2⤵
  PID:9416
- C:\Windows\System\rIQjEwL.exe
  C:\Windows\System\rIQjEwL.exe
  2⤵
  PID:9444
- C:\Windows\System\YNmOXhD.exe
  C:\Windows\System\YNmOXhD.exe
  2⤵
  PID:9484
- C:\Windows\System\thpaUsb.exe
  C:\Windows\System\thpaUsb.exe
  2⤵
  PID:9504
- C:\Windows\System\FEZkcHP.exe
  C:\Windows\System\FEZkcHP.exe
  2⤵
  PID:9528
- C:\Windows\System\kRDlyfw.exe
  C:\Windows\System\kRDlyfw.exe
  2⤵
  PID:9560
- C:\Windows\System\ctnWTko.exe
  C:\Windows\System\ctnWTko.exe
  2⤵
  PID:9588
- C:\Windows\System\BKhrncB.exe
  C:\Windows\System\BKhrncB.exe
  2⤵
  PID:9612
- C:\Windows\System\MqqtTUM.exe
  C:\Windows\System\MqqtTUM.exe
  2⤵
  PID:9660
- C:\Windows\System\cfzaOfU.exe
  C:\Windows\System\cfzaOfU.exe
  2⤵
  PID:9684
- C:\Windows\System\laQnXPa.exe
  C:\Windows\System\laQnXPa.exe
  2⤵
  PID:9700
- C:\Windows\System\VheoifD.exe
  C:\Windows\System\VheoifD.exe
  2⤵
  PID:9728
- C:\Windows\System\tzMxeXu.exe
  C:\Windows\System\tzMxeXu.exe
  2⤵
  PID:9748
- C:\Windows\System\URGUvma.exe
  C:\Windows\System\URGUvma.exe
  2⤵
  PID:9772
- C:\Windows\System\gqQEaAT.exe
  C:\Windows\System\gqQEaAT.exe
  2⤵
  PID:9800
- C:\Windows\System\KsnUsXX.exe
  C:\Windows\System\KsnUsXX.exe
  2⤵
  PID:9828
- C:\Windows\System\ljLbSbi.exe
  C:\Windows\System\ljLbSbi.exe
  2⤵
  PID:9860
- C:\Windows\System\mtqTlHw.exe
  C:\Windows\System\mtqTlHw.exe
  2⤵
  PID:9888
- C:\Windows\System\gVXaAfn.exe
  C:\Windows\System\gVXaAfn.exe
  2⤵
  PID:9932
- C:\Windows\System\qBludNc.exe
  C:\Windows\System\qBludNc.exe
  2⤵
  PID:9952
- C:\Windows\System\fomKvxv.exe
  C:\Windows\System\fomKvxv.exe
  2⤵
  PID:9980
- C:\Windows\System\ttRDpDt.exe
  C:\Windows\System\ttRDpDt.exe
  2⤵
  PID:10000
- C:\Windows\System\UOfwcvO.exe
  C:\Windows\System\UOfwcvO.exe
  2⤵
  PID:10016
- C:\Windows\System\cpPLuGO.exe
  C:\Windows\System\cpPLuGO.exe
  2⤵
  PID:10044
- C:\Windows\System\hSbpjKS.exe
  C:\Windows\System\hSbpjKS.exe
  2⤵
  PID:10080
- C:\Windows\System\kuYIPuB.exe
  C:\Windows\System\kuYIPuB.exe
  2⤵
  PID:10108
- C:\Windows\System\GwGUghG.exe
  C:\Windows\System\GwGUghG.exe
  2⤵
  PID:10136
- C:\Windows\System\pmzlQdk.exe
  C:\Windows\System\pmzlQdk.exe
  2⤵
  PID:10164
- C:\Windows\System\wClIQrB.exe
  C:\Windows\System\wClIQrB.exe
  2⤵
  PID:10184
- C:\Windows\System\NTywIwc.exe
  C:\Windows\System\NTywIwc.exe
  2⤵
  PID:10220
- C:\Windows\System\hNJCdrJ.exe
  C:\Windows\System\hNJCdrJ.exe
  2⤵
  PID:8408
- C:\Windows\System\CHAtUEb.exe
  C:\Windows\System\CHAtUEb.exe
  2⤵
  PID:9244
- C:\Windows\System\PrOIkXn.exe
  C:\Windows\System\PrOIkXn.exe
  2⤵
  PID:9344
- C:\Windows\System\uWQGfjf.exe
  C:\Windows\System\uWQGfjf.exe
  2⤵
  PID:9372
- C:\Windows\System\nEVKSpC.exe
  C:\Windows\System\nEVKSpC.exe
  2⤵
  PID:9400
- C:\Windows\System\ayodnxw.exe
  C:\Windows\System\ayodnxw.exe
  2⤵
  PID:9496
- C:\Windows\System\qYGdUQV.exe
  C:\Windows\System\qYGdUQV.exe
  2⤵
  PID:9576
- C:\Windows\System\KXsYluo.exe
  C:\Windows\System\KXsYluo.exe
  2⤵
  PID:9628
- C:\Windows\System\UUYzVWK.exe
  C:\Windows\System\UUYzVWK.exe
  2⤵
  PID:9692
- C:\Windows\System\pVNGZaB.exe
  C:\Windows\System\pVNGZaB.exe
  2⤵
  PID:9824
- C:\Windows\System\NtQvEKg.exe
  C:\Windows\System\NtQvEKg.exe
  2⤵
  PID:9884
- C:\Windows\System\HMihsgV.exe
  C:\Windows\System\HMihsgV.exe
  2⤵
  PID:9912
- C:\Windows\System\SoOFmNa.exe
  C:\Windows\System\SoOFmNa.exe
  2⤵
  PID:10008
- C:\Windows\System\kWGBoIj.exe
  C:\Windows\System\kWGBoIj.exe
  2⤵
  PID:10092
- C:\Windows\System\lIrcxfi.exe
  C:\Windows\System\lIrcxfi.exe
  2⤵
  PID:10128
- C:\Windows\System\JJZsaVi.exe
  C:\Windows\System\JJZsaVi.exe
  2⤵
  PID:10196
- C:\Windows\System\wXRPNBs.exe
  C:\Windows\System\wXRPNBs.exe
  2⤵
  PID:9288
- C:\Windows\System\CSUSecs.exe
  C:\Windows\System\CSUSecs.exe
  2⤵
  PID:9492
- C:\Windows\System\qCjFtNG.exe
  C:\Windows\System\qCjFtNG.exe
  2⤵
  PID:9624
- C:\Windows\System\aRFKbSr.exe
  C:\Windows\System\aRFKbSr.exe
  2⤵
  PID:9656
- C:\Windows\System\ERifyyW.exe
  C:\Windows\System\ERifyyW.exe
  2⤵
  PID:9756
- C:\Windows\System\sllmmRW.exe
  C:\Windows\System\sllmmRW.exe
  2⤵
  PID:9940
- C:\Windows\System\ISXtWtx.exe
  C:\Windows\System\ISXtWtx.exe
  2⤵
  PID:10148
- C:\Windows\System\jxGLNCF.exe
  C:\Windows\System\jxGLNCF.exe
  2⤵
  PID:9280
- C:\Windows\System\SRBcWri.exe
  C:\Windows\System\SRBcWri.exe
  2⤵
  PID:9680
- C:\Windows\System\jXRyWJb.exe
  C:\Windows\System\jXRyWJb.exe
  2⤵
  PID:9900
- C:\Windows\System\JORtpKq.exe
  C:\Windows\System\JORtpKq.exe
  2⤵
  PID:9976
- C:\Windows\System\OEdzSYD.exe
  C:\Windows\System\OEdzSYD.exe
  2⤵
  PID:10088
- C:\Windows\System\NjwAkWs.exe
  C:\Windows\System\NjwAkWs.exe
  2⤵
  PID:10264
- C:\Windows\System\atOSmpf.exe
  C:\Windows\System\atOSmpf.exe
  2⤵
  PID:10292
- C:\Windows\System\uGYjXpN.exe
  C:\Windows\System\uGYjXpN.exe
  2⤵
  PID:10328
- C:\Windows\System\CUpkNqN.exe
  C:\Windows\System\CUpkNqN.exe
  2⤵
  PID:10348
- C:\Windows\System\SADGPEr.exe
  C:\Windows\System\SADGPEr.exe
  2⤵
  PID:10376
- C:\Windows\System\APhoKbc.exe
  C:\Windows\System\APhoKbc.exe
  2⤵
  PID:10404
- C:\Windows\System\RzroWHs.exe
  C:\Windows\System\RzroWHs.exe
  2⤵
  PID:10432
- C:\Windows\System\LiWmwru.exe
  C:\Windows\System\LiWmwru.exe
  2⤵
  PID:10464
- C:\Windows\System\DgfMGGf.exe
  C:\Windows\System\DgfMGGf.exe
  2⤵
  PID:10496
- C:\Windows\System\gPsIfjb.exe
  C:\Windows\System\gPsIfjb.exe
  2⤵
  PID:10520
- C:\Windows\System\hcbWUUH.exe
  C:\Windows\System\hcbWUUH.exe
  2⤵
  PID:10556
- C:\Windows\System\vaBdAig.exe
  C:\Windows\System\vaBdAig.exe
  2⤵
  PID:10580
- C:\Windows\System\WmLJliL.exe
  C:\Windows\System\WmLJliL.exe
  2⤵
  PID:10600
- C:\Windows\System\aBXgldn.exe
  C:\Windows\System\aBXgldn.exe
  2⤵
  PID:10620
- C:\Windows\System\MTlOBMc.exe
  C:\Windows\System\MTlOBMc.exe
  2⤵
  PID:10652
- C:\Windows\System\RmeAqYK.exe
  C:\Windows\System\RmeAqYK.exe
  2⤵
  PID:10672
- C:\Windows\System\ivItujp.exe
  C:\Windows\System\ivItujp.exe
  2⤵
  PID:10696
- C:\Windows\System\mSqFZeM.exe
  C:\Windows\System\mSqFZeM.exe
  2⤵
  PID:10732
- C:\Windows\System\dtPABHT.exe
  C:\Windows\System\dtPABHT.exe
  2⤵
  PID:10768
- C:\Windows\System\mZOAiiw.exe
  C:\Windows\System\mZOAiiw.exe
  2⤵
  PID:10796
- C:\Windows\System\sLPnEUz.exe
  C:\Windows\System\sLPnEUz.exe
  2⤵
  PID:10820
- C:\Windows\System\iBROnAd.exe
  C:\Windows\System\iBROnAd.exe
  2⤵
  PID:10844
- C:\Windows\System\CYPRPvL.exe
  C:\Windows\System\CYPRPvL.exe
  2⤵
  PID:10872
- C:\Windows\System\dnQbYFY.exe
  C:\Windows\System\dnQbYFY.exe
  2⤵
  PID:10900
- C:\Windows\System\nlVRXPt.exe
  C:\Windows\System\nlVRXPt.exe
  2⤵
  PID:10924
- C:\Windows\System\lKwrLNB.exe
  C:\Windows\System\lKwrLNB.exe
  2⤵
  PID:10952
- C:\Windows\System\HthGXlE.exe
  C:\Windows\System\HthGXlE.exe
  2⤵
  PID:10980
- C:\Windows\System\dqRrHgT.exe
  C:\Windows\System\dqRrHgT.exe
  2⤵
  PID:11012
- C:\Windows\System\rvPSnEn.exe
  C:\Windows\System\rvPSnEn.exe
  2⤵
  PID:11036
- C:\Windows\System\EhepQTF.exe
  C:\Windows\System\EhepQTF.exe
  2⤵
  PID:11064
- C:\Windows\System\UmrhQzc.exe
  C:\Windows\System\UmrhQzc.exe
  2⤵
  PID:11096
- C:\Windows\System\xfQnfjc.exe
  C:\Windows\System\xfQnfjc.exe
  2⤵
  PID:11132
- C:\Windows\System\uBdmSUx.exe
  C:\Windows\System\uBdmSUx.exe
  2⤵
  PID:11160
- C:\Windows\System\gliDKkR.exe
  C:\Windows\System\gliDKkR.exe
  2⤵
  PID:11180
- C:\Windows\System\tqmpAIU.exe
  C:\Windows\System\tqmpAIU.exe
  2⤵
  PID:11208
- C:\Windows\System\NUUFofR.exe
  C:\Windows\System\NUUFofR.exe
  2⤵
  PID:11224
- C:\Windows\System\UMpAWMF.exe
  C:\Windows\System\UMpAWMF.exe
  2⤵
  PID:11256
- C:\Windows\System\sVKPzAt.exe
  C:\Windows\System\sVKPzAt.exe
  2⤵
  PID:10252
- C:\Windows\System\NTvNWZV.exe
  C:\Windows\System\NTvNWZV.exe
  2⤵
  PID:10304
- C:\Windows\System\GyjIDdO.exe
  C:\Windows\System\GyjIDdO.exe
  2⤵
  PID:10360
- C:\Windows\System\fbaIrjS.exe
  C:\Windows\System\fbaIrjS.exe
  2⤵
  PID:10388
- C:\Windows\System\OzRTjok.exe
  C:\Windows\System\OzRTjok.exe
  2⤵
  PID:10460
- C:\Windows\System\DNkQnyJ.exe
  C:\Windows\System\DNkQnyJ.exe
  2⤵
  PID:10508
- C:\Windows\System\EFnpKnS.exe
  C:\Windows\System\EFnpKnS.exe
  2⤵
  PID:10548
- C:\Windows\System\NiIkyGn.exe
  C:\Windows\System\NiIkyGn.exe
  2⤵
  PID:10628
- C:\Windows\System\vfrgKsY.exe
  C:\Windows\System\vfrgKsY.exe
  2⤵
  PID:10688
- C:\Windows\System\VJagbZE.exe
  C:\Windows\System\VJagbZE.exe
  2⤵
  PID:10764
- C:\Windows\System\WQJTWDP.exe
  C:\Windows\System\WQJTWDP.exe
  2⤵
  PID:10852
- C:\Windows\System\DvTxVoU.exe
  C:\Windows\System\DvTxVoU.exe
  2⤵
  PID:10944
- C:\Windows\System\TgKjuVN.exe
  C:\Windows\System\TgKjuVN.exe
  2⤵
  PID:11032
- C:\Windows\System\pwUBkje.exe
  C:\Windows\System\pwUBkje.exe
  2⤵
  PID:11056
- C:\Windows\System\wJkjOhg.exe
  C:\Windows\System\wJkjOhg.exe
  2⤵
  PID:11156
- C:\Windows\System\QDnGoIr.exe
  C:\Windows\System\QDnGoIr.exe
  2⤵
  PID:11200
- C:\Windows\System\lFErlwt.exe
  C:\Windows\System\lFErlwt.exe
  2⤵
  PID:9856
- C:\Windows\System\hIjolzk.exe
  C:\Windows\System\hIjolzk.exe
  2⤵
  PID:10340
- C:\Windows\System\wWYoCnT.exe
  C:\Windows\System\wWYoCnT.exe
  2⤵
  PID:10612
- C:\Windows\System\YVEqLfc.exe
  C:\Windows\System\YVEqLfc.exe
  2⤵
  PID:10544
- C:\Windows\System\LFraipv.exe
  C:\Windows\System\LFraipv.exe
  2⤵
  PID:10668
- C:\Windows\System\tnpJVGn.exe
  C:\Windows\System\tnpJVGn.exe
  2⤵
  PID:10992
- C:\Windows\System\dfvwrRR.exe
  C:\Windows\System\dfvwrRR.exe
  2⤵
  PID:11028
- C:\Windows\System\bfCsYCB.exe
  C:\Windows\System\bfCsYCB.exe
  2⤵
  PID:10424
- C:\Windows\System\kTUVKrA.exe
  C:\Windows\System\kTUVKrA.exe
  2⤵
  PID:10896
- C:\Windows\System\cZLdQGD.exe
  C:\Windows\System\cZLdQGD.exe
  2⤵
  PID:10616
- C:\Windows\System\BohrkmD.exe
  C:\Windows\System\BohrkmD.exe
  2⤵
  PID:11168
- C:\Windows\System\QyGEHPO.exe
  C:\Windows\System\QyGEHPO.exe
  2⤵
  PID:11300
- C:\Windows\System\rgiuXyR.exe
  C:\Windows\System\rgiuXyR.exe
  2⤵
  PID:11336
- C:\Windows\System\jpfKzlD.exe
  C:\Windows\System\jpfKzlD.exe
  2⤵
  PID:11352
- C:\Windows\System\iMLkiBt.exe
  C:\Windows\System\iMLkiBt.exe
  2⤵
  PID:11384
- C:\Windows\System\ZiqAlkr.exe
  C:\Windows\System\ZiqAlkr.exe
  2⤵
  PID:11416
- C:\Windows\System\qyZZRit.exe
  C:\Windows\System\qyZZRit.exe
  2⤵
  PID:11452
- C:\Windows\System\xAxnLjp.exe
  C:\Windows\System\xAxnLjp.exe
  2⤵
  PID:11476
- C:\Windows\System\etXONJU.exe
  C:\Windows\System\etXONJU.exe
  2⤵
  PID:11496
- C:\Windows\System\tAHeJdc.exe
  C:\Windows\System\tAHeJdc.exe
  2⤵
  PID:11524
- C:\Windows\System\gbsWUbG.exe
  C:\Windows\System\gbsWUbG.exe
  2⤵
  PID:11540
- C:\Windows\System\ghBmgjc.exe
  C:\Windows\System\ghBmgjc.exe
  2⤵
  PID:11572
- C:\Windows\System\HWVwAqU.exe
  C:\Windows\System\HWVwAqU.exe
  2⤵
  PID:11596
- C:\Windows\System\pOYTBxm.exe
  C:\Windows\System\pOYTBxm.exe
  2⤵
  PID:11632
- C:\Windows\System\tfNegoT.exe
  C:\Windows\System\tfNegoT.exe
  2⤵
  PID:11660
- C:\Windows\System\FuLvRPM.exe
  C:\Windows\System\FuLvRPM.exe
  2⤵
  PID:11700
- C:\Windows\System\duxfOgB.exe
  C:\Windows\System\duxfOgB.exe
  2⤵
  PID:11732
- C:\Windows\System\ugIXlhx.exe
  C:\Windows\System\ugIXlhx.exe
  2⤵
  PID:11752
- C:\Windows\System\XErZXFE.exe
  C:\Windows\System\XErZXFE.exe
  2⤵
  PID:11776
- C:\Windows\System\JgGoEii.exe
  C:\Windows\System\JgGoEii.exe
  2⤵
  PID:11820
- C:\Windows\System\BknqLWp.exe
  C:\Windows\System\BknqLWp.exe
  2⤵
  PID:11856
- C:\Windows\System\QeIBwnW.exe
  C:\Windows\System\QeIBwnW.exe
  2⤵
  PID:11884
- C:\Windows\System\MCrdokF.exe
  C:\Windows\System\MCrdokF.exe
  2⤵
  PID:11908
- C:\Windows\System\svoifAj.exe
  C:\Windows\System\svoifAj.exe
  2⤵
  PID:11928
- C:\Windows\System\XatXkBW.exe
  C:\Windows\System\XatXkBW.exe
  2⤵
  PID:11952
- C:\Windows\System\QpjYGaT.exe
  C:\Windows\System\QpjYGaT.exe
  2⤵
  PID:11980
- C:\Windows\System\ERRPoOR.exe
  C:\Windows\System\ERRPoOR.exe
  2⤵
  PID:12012
- C:\Windows\System\JHEKMUT.exe
  C:\Windows\System\JHEKMUT.exe
  2⤵
  PID:12040
- C:\Windows\System\VlDOYtZ.exe
  C:\Windows\System\VlDOYtZ.exe
  2⤵
  PID:12076
- C:\Windows\System\SuuQggM.exe
  C:\Windows\System\SuuQggM.exe
  2⤵
  PID:12104
- C:\Windows\System\rJVBnaq.exe
  C:\Windows\System\rJVBnaq.exe
  2⤵
  PID:12120
- C:\Windows\System\wDNZsXc.exe
  C:\Windows\System\wDNZsXc.exe
  2⤵
  PID:12148
- C:\Windows\System\JrUQjWV.exe
  C:\Windows\System\JrUQjWV.exe
  2⤵
  PID:12184
- C:\Windows\System\USBxFIy.exe
  C:\Windows\System\USBxFIy.exe
  2⤵
  PID:12212
- C:\Windows\System\jhnFOnp.exe
  C:\Windows\System\jhnFOnp.exe
  2⤵
  PID:12240
- C:\Windows\System\tTbLZjV.exe
  C:\Windows\System\tTbLZjV.exe
  2⤵
  PID:12272
- C:\Windows\System\dDQsDSa.exe
  C:\Windows\System\dDQsDSa.exe
  2⤵
  PID:10840
- C:\Windows\System\oailyxd.exe
  C:\Windows\System\oailyxd.exe
  2⤵
  PID:11316
- C:\Windows\System\dKnKSWN.exe
  C:\Windows\System\dKnKSWN.exe
  2⤵
  PID:11368
- C:\Windows\System\DqheyAL.exe
  C:\Windows\System\DqheyAL.exe
  2⤵
  PID:11400
- C:\Windows\System\IDmfsya.exe
  C:\Windows\System\IDmfsya.exe
  2⤵
  PID:11408
- C:\Windows\System\jCPnwLV.exe
  C:\Windows\System\jCPnwLV.exe
  2⤵
  PID:11484
- C:\Windows\System\iLNkqrX.exe
  C:\Windows\System\iLNkqrX.exe
  2⤵
  PID:11512
- C:\Windows\System\XZxQxev.exe
  C:\Windows\System\XZxQxev.exe
  2⤵
  PID:11640
- C:\Windows\System\adsGdVj.exe
  C:\Windows\System\adsGdVj.exe
  2⤵
  PID:11688
- C:\Windows\System\CSqPKrM.exe
  C:\Windows\System\CSqPKrM.exe
  2⤵
  PID:11788
- C:\Windows\System\vmdvDMY.exe
  C:\Windows\System\vmdvDMY.exe
  2⤵
  PID:11816
- C:\Windows\System\akqMhVQ.exe
  C:\Windows\System\akqMhVQ.exe
  2⤵
  PID:11880
- C:\Windows\System\fcYjpHA.exe
  C:\Windows\System\fcYjpHA.exe
  2⤵
  PID:12004
- C:\Windows\System\SSlidJr.exe
  C:\Windows\System\SSlidJr.exe
  2⤵
  PID:12060
- C:\Windows\System\XIUdjGD.exe
  C:\Windows\System\XIUdjGD.exe
  2⤵
  PID:12172
- C:\Windows\System\oJxPwpr.exe
  C:\Windows\System\oJxPwpr.exe
  2⤵
  PID:12160
- C:\Windows\System\DmYZZhl.exe
  C:\Windows\System\DmYZZhl.exe
  2⤵
  PID:12224
- C:\Windows\System\RNWAZYy.exe
  C:\Windows\System\RNWAZYy.exe
  2⤵
  PID:11308
- C:\Windows\System\aZHxqHP.exe
  C:\Windows\System\aZHxqHP.exe
  2⤵
  PID:11404
- C:\Windows\System\dkNyJyq.exe
  C:\Windows\System\dkNyJyq.exe
  2⤵
  PID:11616
- C:\Windows\System\hbHguCP.exe
  C:\Windows\System\hbHguCP.exe
  2⤵
  PID:11656
- C:\Windows\System\fZSPtPr.exe
  C:\Windows\System\fZSPtPr.exe
  2⤵
  PID:11916
- C:\Windows\System\KvTWlyn.exe
  C:\Windows\System\KvTWlyn.exe
  2⤵
  PID:12028
- C:\Windows\System\xowegeK.exe
  C:\Windows\System\xowegeK.exe
  2⤵
  PID:12236
- C:\Windows\System\ffZBzIU.exe
  C:\Windows\System\ffZBzIU.exe
  2⤵
  PID:12256
- C:\Windows\System\MrZrIcT.exe
  C:\Windows\System\MrZrIcT.exe
  2⤵
  PID:11324
- C:\Windows\System\IqKlbTi.exe
  C:\Windows\System\IqKlbTi.exe
  2⤵
  PID:11192
- C:\Windows\System\gpAkFrI.exe
  C:\Windows\System\gpAkFrI.exe
  2⤵
  PID:12112
- C:\Windows\System\WdVUHON.exe
  C:\Windows\System\WdVUHON.exe
  2⤵
  PID:12304
- C:\Windows\System\uVXdeXd.exe
  C:\Windows\System\uVXdeXd.exe
  2⤵
  PID:12344
- C:\Windows\System\heDBaHn.exe
  C:\Windows\System\heDBaHn.exe
  2⤵
  PID:12372
- C:\Windows\System\KbmncnP.exe
  C:\Windows\System\KbmncnP.exe
  2⤵
  PID:12392
- C:\Windows\System\GrxDvMG.exe
  C:\Windows\System\GrxDvMG.exe
  2⤵
  PID:12416
- C:\Windows\System\tbWAmxj.exe
  C:\Windows\System\tbWAmxj.exe
  2⤵
  PID:12432
- C:\Windows\System\mBcPtTg.exe
  C:\Windows\System\mBcPtTg.exe
  2⤵
  PID:12448
- C:\Windows\System\dUUaHsE.exe
  C:\Windows\System\dUUaHsE.exe
  2⤵
  PID:12472
- C:\Windows\System\bEsTKMr.exe
  C:\Windows\System\bEsTKMr.exe
  2⤵
  PID:12516
- C:\Windows\System\RTkWNmb.exe
  C:\Windows\System\RTkWNmb.exe
  2⤵
  PID:12552
- C:\Windows\System\oKvGUiV.exe
  C:\Windows\System\oKvGUiV.exe
  2⤵
  PID:12584
- C:\Windows\System\RpGGxYj.exe
  C:\Windows\System\RpGGxYj.exe
  2⤵
  PID:12620
- C:\Windows\System\cfrDmZb.exe
  C:\Windows\System\cfrDmZb.exe
  2⤵
  PID:12644
- C:\Windows\System\JvyQkok.exe
  C:\Windows\System\JvyQkok.exe
  2⤵
  PID:12680
- C:\Windows\System\eyOaPxc.exe
  C:\Windows\System\eyOaPxc.exe
  2⤵
  PID:12708
- C:\Windows\System\CDKTgHA.exe
  C:\Windows\System\CDKTgHA.exe
  2⤵
  PID:12744
- C:\Windows\System\kFnffpS.exe
  C:\Windows\System\kFnffpS.exe
  2⤵
  PID:12776
- C:\Windows\System\RtnOZVD.exe
  C:\Windows\System\RtnOZVD.exe
  2⤵
  PID:12804
- C:\Windows\System\KVacHwQ.exe
  C:\Windows\System\KVacHwQ.exe
  2⤵
  PID:12824
- C:\Windows\System\XXUMorW.exe
  C:\Windows\System\XXUMorW.exe
  2⤵
  PID:12844
- C:\Windows\System\JkCYLeu.exe
  C:\Windows\System\JkCYLeu.exe
  2⤵
  PID:12880
- C:\Windows\System\xASmXHk.exe
  C:\Windows\System\xASmXHk.exe
  2⤵
  PID:12904
- C:\Windows\System\cYclclq.exe
  C:\Windows\System\cYclclq.exe
  2⤵
  PID:12932
- C:\Windows\System\qgLyuJC.exe
  C:\Windows\System\qgLyuJC.exe
  2⤵
  PID:12968
- C:\Windows\System\jhhFpjC.exe
  C:\Windows\System\jhhFpjC.exe
  2⤵
  PID:13012
- C:\Windows\System\EtUJCeY.exe
  C:\Windows\System\EtUJCeY.exe
  2⤵
  PID:13040
- C:\Windows\System\zmUfkeZ.exe
  C:\Windows\System\zmUfkeZ.exe
  2⤵
  PID:13064
- C:\Windows\System\GQWkxFz.exe
  C:\Windows\System\GQWkxFz.exe
  2⤵
  PID:13096
- C:\Windows\System\mxyAbju.exe
  C:\Windows\System\mxyAbju.exe
  2⤵
  PID:13112
- C:\Windows\System\yqhlEhQ.exe
  C:\Windows\System\yqhlEhQ.exe
  2⤵
  PID:13144
- C:\Windows\System\IsvZDzV.exe
  C:\Windows\System\IsvZDzV.exe
  2⤵
  PID:13180
- C:\Windows\System\MzwjGgd.exe
  C:\Windows\System\MzwjGgd.exe
  2⤵
  PID:13200
- C:\Windows\System\bUbNQHI.exe
  C:\Windows\System\bUbNQHI.exe
  2⤵
  PID:13224
- C:\Windows\System\dvAQgHQ.exe
  C:\Windows\System\dvAQgHQ.exe
  2⤵
  PID:13256
- C:\Windows\System\kzhiYWJ.exe
  C:\Windows\System\kzhiYWJ.exe
  2⤵
  PID:13284
- C:\Windows\System\kDzGOQw.exe
  C:\Windows\System\kDzGOQw.exe
  2⤵
  PID:11276
- C:\Windows\System\JgSfxRy.exe
  C:\Windows\System\JgSfxRy.exe
  2⤵
  PID:12320
- C:\Windows\System\EyhpZCQ.exe
  C:\Windows\System\EyhpZCQ.exe
  2⤵
  PID:12356
- C:\Windows\System\IYADydH.exe
  C:\Windows\System\IYADydH.exe
  2⤵
  PID:12496
- C:\Windows\System\VLGCtTJ.exe
  C:\Windows\System\VLGCtTJ.exe
  2⤵
  PID:12572
- C:\Windows\System\pMgriYM.exe
  C:\Windows\System\pMgriYM.exe
  2⤵
  PID:12640
- C:\Windows\System\gKzXWhg.exe
  C:\Windows\System\gKzXWhg.exe
  2⤵
  PID:12660
- C:\Windows\System\XMqsbPC.exe
  C:\Windows\System\XMqsbPC.exe
  2⤵
  PID:12812
- C:\Windows\System\eRmdNUj.exe
  C:\Windows\System\eRmdNUj.exe
  2⤵
  PID:12796
- C:\Windows\System\VrTmveo.exe
  C:\Windows\System\VrTmveo.exe
  2⤵
  PID:12888
- C:\Windows\System\cQZmZMk.exe
  C:\Windows\System\cQZmZMk.exe
  2⤵
  PID:12860
- C:\Windows\System\uZKrsDK.exe
  C:\Windows\System\uZKrsDK.exe
  2⤵
  PID:13028
- C:\Windows\System\okkbJRr.exe
  C:\Windows\System\okkbJRr.exe
  2⤵
  PID:13080
- C:\Windows\System\LrWoQei.exe
  C:\Windows\System\LrWoQei.exe
  2⤵
  PID:13160
- C:\Windows\System\npdIqdI.exe
  C:\Windows\System\npdIqdI.exe
  2⤵
  PID:13212
- C:\Windows\System\fWchyPt.exe
  C:\Windows\System\fWchyPt.exe
  2⤵
  PID:13296
- C:\Windows\System\peNLwIj.exe
  C:\Windows\System\peNLwIj.exe
  2⤵
  PID:12408
- C:\Windows\System\rKqXqRS.exe
  C:\Windows\System\rKqXqRS.exe
  2⤵
  PID:12732
- C:\Windows\System\COcwtIA.exe
  C:\Windows\System\COcwtIA.exe
  2⤵
  PID:12792
- C:\Windows\System\eYqjjff.exe
  C:\Windows\System\eYqjjff.exe
  2⤵
  PID:12920
- C:\Windows\System\CeVcKZk.exe
  C:\Windows\System\CeVcKZk.exe
  2⤵
  PID:13084
- C:\Windows\System\xoZYHza.exe
  C:\Windows\System\xoZYHza.exe
  2⤵
  PID:13128
- C:\Windows\System\EaLYzQl.exe
  C:\Windows\System\EaLYzQl.exe
  2⤵
  PID:12292
- C:\Windows\System\eTJNqWH.exe
  C:\Windows\System\eTJNqWH.exe
  2⤵
  PID:12872
- C:\Windows\System\HmKUPIH.exe
  C:\Windows\System\HmKUPIH.exe
  2⤵
  PID:13136
- C:\Windows\System\vFpctAT.exe
  C:\Windows\System\vFpctAT.exe
  2⤵
  PID:12544
- C:\Windows\System\qdOSQft.exe
  C:\Windows\System\qdOSQft.exe
  2⤵
  PID:13320
- C:\Windows\System\WqoWhBV.exe
  C:\Windows\System\WqoWhBV.exe
  2⤵
  PID:13344
- C:\Windows\System\EgCGZHU.exe
  C:\Windows\System\EgCGZHU.exe
  2⤵
  PID:13376
- C:\Windows\System\RewaekJ.exe
  C:\Windows\System\RewaekJ.exe
  2⤵
  PID:13400
- C:\Windows\System\CowLJMG.exe
  C:\Windows\System\CowLJMG.exe
  2⤵
  PID:13432
- C:\Windows\System\UZCIExd.exe
  C:\Windows\System\UZCIExd.exe
  2⤵
  PID:13456
- C:\Windows\System\YWUsirN.exe
  C:\Windows\System\YWUsirN.exe
  2⤵
  PID:13488
- C:\Windows\System\zTaZpLJ.exe
  C:\Windows\System\zTaZpLJ.exe
  2⤵
  PID:13520
- C:\Windows\System\xaIQmrm.exe
  C:\Windows\System\xaIQmrm.exe
  2⤵
  PID:13536
- C:\Windows\System\sVLGNeh.exe
  C:\Windows\System\sVLGNeh.exe
  2⤵
  PID:13556
- C:\Windows\System\aSpHVZA.exe
  C:\Windows\System\aSpHVZA.exe
  2⤵
  PID:13580
- C:\Windows\System\YPYWQSw.exe
  C:\Windows\System\YPYWQSw.exe
  2⤵
  PID:13600
- C:\Windows\System\ArcOdRk.exe
  C:\Windows\System\ArcOdRk.exe
  2⤵
  PID:13628
- C:\Windows\System\VSHCnGU.exe
  C:\Windows\System\VSHCnGU.exe
  2⤵
  PID:13664
- C:\Windows\System\lujcjzL.exe
  C:\Windows\System\lujcjzL.exe
  2⤵
  PID:13696
- C:\Windows\System\dGHQgge.exe
  C:\Windows\System\dGHQgge.exe
  2⤵
  PID:13724
- C:\Windows\System\NeWUGHm.exe
  C:\Windows\System\NeWUGHm.exe
  2⤵
  PID:13744
- C:\Windows\System\mRzqvxD.exe
  C:\Windows\System\mRzqvxD.exe
  2⤵
  PID:13772
- C:\Windows\System\zOaCVzj.exe
  C:\Windows\System\zOaCVzj.exe
  2⤵
  PID:13800
- C:\Windows\System\hZtpgxJ.exe
  C:\Windows\System\hZtpgxJ.exe
  2⤵
  PID:13824
- C:\Windows\System\yGxfaUD.exe
  C:\Windows\System\yGxfaUD.exe
  2⤵
  PID:13856
- C:\Windows\System\McqqOcn.exe
  C:\Windows\System\McqqOcn.exe
  2⤵
  PID:13880
- C:\Windows\System\nprOdmw.exe
  C:\Windows\System\nprOdmw.exe
  2⤵
  PID:13904
- C:\Windows\System\VPjZVXv.exe
  C:\Windows\System\VPjZVXv.exe
  2⤵
  PID:13936
- C:\Windows\System\bPmuAkC.exe
  C:\Windows\System\bPmuAkC.exe
  2⤵
  PID:13972
- C:\Windows\System\IJpXOxt.exe
  C:\Windows\System\IJpXOxt.exe
  2⤵
  PID:13996
- C:\Windows\System\BTDpTii.exe
  C:\Windows\System\BTDpTii.exe
  2⤵
  PID:14032
- C:\Windows\System\SwCUSbv.exe
  C:\Windows\System\SwCUSbv.exe
  2⤵
  PID:14068
- C:\Windows\System\nWdzPZS.exe
  C:\Windows\System\nWdzPZS.exe
  2⤵
  PID:14092
- C:\Windows\System\LtkNqzF.exe
  C:\Windows\System\LtkNqzF.exe
  2⤵
  PID:14112
- C:\Windows\System\CFozLLd.exe
  C:\Windows\System\CFozLLd.exe
  2⤵
  PID:14144
- C:\Windows\System\coWlxoT.exe
  C:\Windows\System\coWlxoT.exe
  2⤵
  PID:14168
- C:\Windows\System\KhHtDak.exe
  C:\Windows\System\KhHtDak.exe
  2⤵
  PID:14196
- C:\Windows\System\QENHTSl.exe
  C:\Windows\System\QENHTSl.exe
  2⤵
  PID:14216
- C:\Windows\System\VpZNcJB.exe
  C:\Windows\System\VpZNcJB.exe
  2⤵
  PID:14240
- C:\Windows\System\cNWMBCY.exe
  C:\Windows\System\cNWMBCY.exe
  2⤵
  PID:14272
- C:\Windows\System\hNahQUA.exe
  C:\Windows\System\hNahQUA.exe
  2⤵
  PID:14304
- C:\Windows\System\lsBKqWU.exe
  C:\Windows\System\lsBKqWU.exe
  2⤵
  PID:14328
- C:\Windows\System\lgQeMcg.exe
  C:\Windows\System\lgQeMcg.exe
  2⤵
  PID:12868
- C:\Windows\System\TQJttdp.exe
  C:\Windows\System\TQJttdp.exe
  2⤵
  PID:13368
- C:\Windows\System\pcREWnT.exe
  C:\Windows\System\pcREWnT.exe
  2⤵
  PID:13416
- C:\Windows\System\qVpZOYm.exe
  C:\Windows\System\qVpZOYm.exe
  2⤵
  PID:13448
- C:\Windows\System\EpEBvqm.exe
  C:\Windows\System\EpEBvqm.exe
  2⤵
  PID:13544
- C:\Windows\System\kpTcUhU.exe
  C:\Windows\System\kpTcUhU.exe
  2⤵
  PID:13576
- C:\Windows\System\sBasReu.exe
  C:\Windows\System\sBasReu.exe
  2⤵
  PID:13648
- C:\Windows\System\QMNfXHR.exe
  C:\Windows\System\QMNfXHR.exe
  2⤵
  PID:13752
- C:\Windows\System\LmPTlNg.exe
  C:\Windows\System\LmPTlNg.exe
  2⤵
  PID:13796
- C:\Windows\System\JsPRIMV.exe
  C:\Windows\System\JsPRIMV.exe
  2⤵
  PID:13788
- C:\Windows\System\bdCACBs.exe
  C:\Windows\System\bdCACBs.exe
  2⤵
  PID:13900
- C:\Windows\System\gPDgHPS.exe
  C:\Windows\System\gPDgHPS.exe
  2⤵
  PID:14052
- C:\Windows\System\qivqgZy.exe
  C:\Windows\System\qivqgZy.exe
  2⤵
  PID:14048
- C:\Windows\System\mzsqPmd.exe
  C:\Windows\System\mzsqPmd.exe
  2⤵
  PID:14156
- C:\Windows\System\QpWzziC.exe
  C:\Windows\System\QpWzziC.exe
  2⤵
  PID:14280
- C:\Windows\System\oiVVYZu.exe
  C:\Windows\System\oiVVYZu.exe
  2⤵
  PID:14228
- C:\Windows\System\ZeRfJWH.exe
  C:\Windows\System\ZeRfJWH.exe
  2⤵
  PID:14320
- C:\Windows\System\zwqMqGq.exe
  C:\Windows\System\zwqMqGq.exe
  2⤵
  PID:13516
- C:\Windows\System\woqIEZa.exe
  C:\Windows\System\woqIEZa.exe
  2⤵
  PID:13624
- C:\Windows\System\FYADYCh.exe
  C:\Windows\System\FYADYCh.exe
  2⤵
  PID:13888
- C:\Windows\System\wHeVLct.exe
  C:\Windows\System\wHeVLct.exe
  2⤵
  PID:13944
- C:\Windows\System\jVTthea.exe
  C:\Windows\System\jVTthea.exe
  2⤵
  PID:14232
- C:\Windows\System\AWDrqwr.exe
  C:\Windows\System\AWDrqwr.exe
  2⤵
  PID:13708
- C:\Windows\System\rtMzdjr.exe
  C:\Windows\System\rtMzdjr.exe
  2⤵
  PID:13984
- C:\Windows\System\grEgsUa.exe
  C:\Windows\System\grEgsUa.exe
  2⤵
  PID:14088
- C:\Windows\System\aBiHPQq.exe
  C:\Windows\System\aBiHPQq.exe
  2⤵
  PID:13968
- C:\Windows\System\RFEXpCf.exe
  C:\Windows\System\RFEXpCf.exe
  2⤵
  PID:14208
- C:\Windows\System\wGqMgZm.exe
  C:\Windows\System\wGqMgZm.exe
  2⤵
  PID:14360
- C:\Windows\System\uRCPvgc.exe
  C:\Windows\System\uRCPvgc.exe
  2⤵
  PID:14384
- C:\Windows\System\jqrBKIi.exe
  C:\Windows\System\jqrBKIi.exe
  2⤵
  PID:14412
- C:\Windows\System\xwErtwd.exe
  C:\Windows\System\xwErtwd.exe
  2⤵
  PID:14436
- C:\Windows\System\fHnNRGK.exe
  C:\Windows\System\fHnNRGK.exe
  2⤵
  PID:14460
- C:\Windows\System\EFanoas.exe
  C:\Windows\System\EFanoas.exe
  2⤵
  PID:14496
- C:\Windows\System\hWYWnax.exe
  C:\Windows\System\hWYWnax.exe
  2⤵
  PID:14516
- C:\Windows\System\CrHmoER.exe
  C:\Windows\System\CrHmoER.exe
  2⤵
  PID:14536
- C:\Windows\System\WFpyerr.exe
  C:\Windows\System\WFpyerr.exe
  2⤵
  PID:14556
- C:\Windows\System\QyMviCL.exe
  C:\Windows\System\QyMviCL.exe
  2⤵
  PID:14584
- C:\Windows\System\aCgVndb.exe
  C:\Windows\System\aCgVndb.exe
  2⤵
  PID:14600
- C:\Windows\System\aOTQOvu.exe
  C:\Windows\System\aOTQOvu.exe
  2⤵
  PID:14624
- C:\Windows\System\vdUdcBT.exe
  C:\Windows\System\vdUdcBT.exe
  2⤵
  PID:14656
- C:\Windows\System\smPaOtV.exe
  C:\Windows\System\smPaOtV.exe
  2⤵
  PID:14684
- C:\Windows\System\DsotMYV.exe
  C:\Windows\System\DsotMYV.exe
  2⤵
  PID:14712
- C:\Windows\System\uMIkjSE.exe
  C:\Windows\System\uMIkjSE.exe
  2⤵
  PID:14740
- C:\Windows\System\VsEQwSM.exe
  C:\Windows\System\VsEQwSM.exe
  2⤵
  PID:14780
- C:\Windows\System\OEkMaTe.exe
  C:\Windows\System\OEkMaTe.exe
  2⤵
  PID:14816
- C:\Windows\System\VBzDGuq.exe
  C:\Windows\System\VBzDGuq.exe
  2⤵
  PID:14852
- C:\Windows\System\NcExscI.exe
  C:\Windows\System\NcExscI.exe
  2⤵
  PID:14880
- C:\Windows\System\QlUXDju.exe
  C:\Windows\System\QlUXDju.exe
  2⤵
  PID:14908
- C:\Windows\System\aQIeuTo.exe
  C:\Windows\System\aQIeuTo.exe
  2⤵
  PID:14928
- C:\Windows\System\ikiOGPf.exe
  C:\Windows\System\ikiOGPf.exe
  2⤵
  PID:14956
- C:\Windows\System\pBQGdIg.exe
  C:\Windows\System\pBQGdIg.exe
  2⤵
  PID:14988
- C:\Windows\System\GnhdMGy.exe
  C:\Windows\System\GnhdMGy.exe
  2⤵
  PID:15020
- C:\Windows\System\FhiXPbN.exe
  C:\Windows\System\FhiXPbN.exe
  2⤵
  PID:15116
- C:\Windows\System\PbWAoVq.exe
  C:\Windows\System\PbWAoVq.exe
  2⤵
  PID:15132
- C:\Windows\System\EfaKAKm.exe
  C:\Windows\System\EfaKAKm.exe
  2⤵
  PID:15152
- C:\Windows\System\YuqWTno.exe
  C:\Windows\System\YuqWTno.exe
  2⤵
  PID:15184
- C:\Windows\System\wHVzRgp.exe
  C:\Windows\System\wHVzRgp.exe
  2⤵
  PID:15216
- C:\Windows\System\yRpqmGA.exe
  C:\Windows\System\yRpqmGA.exe
  2⤵
  PID:15244
- C:\Windows\System\fnCoALr.exe
  C:\Windows\System\fnCoALr.exe
  2⤵
  PID:15264
- C:\Windows\System\WITOQvj.exe
  C:\Windows\System\WITOQvj.exe
  2⤵
  PID:15300
- C:\Windows\System\DFAWAqt.exe
  C:\Windows\System\DFAWAqt.exe
  2⤵
  PID:15324
- C:\Windows\System\LyhozLC.exe
  C:\Windows\System\LyhozLC.exe
  2⤵
  PID:15344
- C:\Windows\System\LyEHprm.exe
  C:\Windows\System\LyEHprm.exe
  2⤵
  PID:14064
- C:\Windows\System\KjKNqFj.exe
  C:\Windows\System\KjKNqFj.exe
  2⤵
  PID:14400
- C:\Windows\System\xxHryFe.exe
  C:\Windows\System\xxHryFe.exe
  2⤵
  PID:14404
- C:\Windows\System\hFOyXYo.exe
  C:\Windows\System\hFOyXYo.exe
  2⤵
  PID:14552
- C:\Windows\System\CwYyioa.exe
  C:\Windows\System\CwYyioa.exe
  2⤵
  PID:14616
- C:\Windows\System\HLZoTQz.exe
  C:\Windows\System\HLZoTQz.exe
  2⤵
  PID:14592
- C:\Windows\System\cSXXkNj.exe
  C:\Windows\System\cSXXkNj.exe
  2⤵
  PID:14756
- C:\Windows\System\qDEmXjd.exe
  C:\Windows\System\qDEmXjd.exe
  2⤵
  PID:14764
- C:\Windows\System\DlyCMIJ.exe
  C:\Windows\System\DlyCMIJ.exe
  2⤵
  PID:14792
- C:\Windows\System\qipOmSn.exe
  C:\Windows\System\qipOmSn.exe
  2⤵
  PID:14920
- C:\Windows\System\vTUuRnn.exe
  C:\Windows\System\vTUuRnn.exe
  2⤵
  PID:14948
- C:\Windows\System\lSlzDty.exe
  C:\Windows\System\lSlzDty.exe
  2⤵
  PID:15028
- C:\Windows\System\WcUEOyX.exe
  C:\Windows\System\WcUEOyX.exe
  2⤵
  PID:15108
- C:\Windows\System\wCbGWuj.exe
  C:\Windows\System\wCbGWuj.exe
  2⤵
  PID:15160
- C:\Windows\System\QLccSxJ.exe
  C:\Windows\System\QLccSxJ.exe
  2⤵
  PID:15200
- C:\Windows\System\jbJFjFn.exe
  C:\Windows\System\jbJFjFn.exe
  2⤵
  PID:15308
- C:\Windows\System\boGrsia.exe
  C:\Windows\System\boGrsia.exe
  2⤵
  PID:14356
- C:\Windows\System\WoQAxCb.exe
  C:\Windows\System\WoQAxCb.exe
  2⤵
  PID:14532
- C:\Windows\System\PDdJnie.exe
  C:\Windows\System\PDdJnie.exe
  2⤵
  PID:14504
- C:\Windows\System\gIrXsau.exe
  C:\Windows\System\gIrXsau.exe
  2⤵
  PID:14708
- C:\Windows\System\DFPPydw.exe
  C:\Windows\System\DFPPydw.exe
  2⤵
  PID:14844
- C:\Windows\System\qYeprOg.exe
  C:\Windows\System\qYeprOg.exe
  2⤵
  PID:14936
- C:\Windows\System\WpdUiza.exe
  C:\Windows\System\WpdUiza.exe
  2⤵
  PID:15124
- C:\Windows\System\rbJcXLQ.exe
  C:\Windows\System\rbJcXLQ.exe
  2⤵
  PID:15340
- C:\Windows\System\bXkCiug.exe
  C:\Windows\System\bXkCiug.exe
  2⤵
  PID:14640
- C:\Windows\System\IhBMjse.exe
  C:\Windows\System\IhBMjse.exe
  2⤵
  PID:14680
- C:\Windows\System\wxVcMuK.exe
  C:\Windows\System\wxVcMuK.exe
  2⤵
  PID:15044
- C:\Windows\System\bXChbXx.exe
  C:\Windows\System\bXChbXx.exe
  2⤵
  PID:15180
- C:\Windows\System\xvMYWtM.exe
  C:\Windows\System\xvMYWtM.exe
  2⤵
  PID:3952
- C:\Windows\System\DWvUXbR.exe
  C:\Windows\System\DWvUXbR.exe
  2⤵
  PID:13660
- C:\Windows\System\zYXEoFr.exe
  C:\Windows\System\zYXEoFr.exe
  2⤵
  PID:396
- C:\Windows\System\sUdVmKE.exe
  C:\Windows\System\sUdVmKE.exe
  2⤵
  PID:15364
- C:\Windows\System\LjYviqq.exe
  C:\Windows\System\LjYviqq.exe
  2⤵
  PID:15384
- C:\Windows\System\bzROIAz.exe
  C:\Windows\System\bzROIAz.exe
  2⤵
  PID:15400
- C:\Windows\System\IgTjSKs.exe
  C:\Windows\System\IgTjSKs.exe
  2⤵
  PID:15424
- C:\Windows\System\XGILPiA.exe
  C:\Windows\System\XGILPiA.exe
  2⤵
  PID:15452
- C:\Windows\System\ISIEyZb.exe
  C:\Windows\System\ISIEyZb.exe
  2⤵
  PID:15480
- C:\Windows\System\VcPQfez.exe
  C:\Windows\System\VcPQfez.exe
  2⤵
  PID:15512
- C:\Windows\System\KIozCUe.exe
  C:\Windows\System\KIozCUe.exe
  2⤵
  PID:15540
- C:\Windows\System\oqIqWHH.exe
  C:\Windows\System\oqIqWHH.exe
  2⤵
  PID:15572
- C:\Windows\System\ueKbouG.exe
  C:\Windows\System\ueKbouG.exe
  2⤵
  PID:15592
- C:\Windows\System\JuQPkFh.exe
  C:\Windows\System\JuQPkFh.exe
  2⤵
  PID:15628
- C:\Windows\System\VDYqgIV.exe
  C:\Windows\System\VDYqgIV.exe
  2⤵
  PID:15660
- C:\Windows\System\CLGcakD.exe
  C:\Windows\System\CLGcakD.exe
  2⤵
  PID:15688
- C:\Windows\System\YsTSGBl.exe
  C:\Windows\System\YsTSGBl.exe
  2⤵
  PID:15716
- C:\Windows\System\XXwPFee.exe
  C:\Windows\System\XXwPFee.exe
  2⤵
  PID:15752
- C:\Windows\System\NbMJQDg.exe
  C:\Windows\System\NbMJQDg.exe
  2⤵
  PID:15780
- C:\Windows\System\nFYHYCM.exe
  C:\Windows\System\nFYHYCM.exe
  2⤵
  PID:15796
- C:\Windows\System\oZxgpvr.exe
  C:\Windows\System\oZxgpvr.exe
  2⤵
  PID:15816
- C:\Windows\System\YtQszrZ.exe
  C:\Windows\System\YtQszrZ.exe
  2⤵
  PID:15852
- C:\Windows\System\IXOyICx.exe
  C:\Windows\System\IXOyICx.exe
  2⤵
  PID:15884
- C:\Windows\System\bgKNGDb.exe
  C:\Windows\System\bgKNGDb.exe
  2⤵
  PID:15904
- C:\Windows\System\UYXAHgB.exe
  C:\Windows\System\UYXAHgB.exe
  2⤵
  PID:15940
- C:\Windows\System\WZBFCGs.exe
  C:\Windows\System\WZBFCGs.exe
  2⤵
  PID:15972
- C:\Windows\System\tcBJpdD.exe
  C:\Windows\System\tcBJpdD.exe
  2⤵
  PID:15992
- C:\Windows\System\XzZxSNT.exe
  C:\Windows\System\XzZxSNT.exe
  2⤵
  PID:16016
- C:\Windows\System\onmyqVH.exe
  C:\Windows\System\onmyqVH.exe
  2⤵
  PID:16048
- C:\Windows\System\FxObrMf.exe
  C:\Windows\System\FxObrMf.exe
  2⤵
  PID:16068
- C:\Windows\System\FpuwkMC.exe
  C:\Windows\System\FpuwkMC.exe
  2⤵
  PID:16104
- C:\Windows\System\thFlRgE.exe
  C:\Windows\System\thFlRgE.exe
  2⤵
  PID:16132
- C:\Windows\System\tqfKAEy.exe
  C:\Windows\System\tqfKAEy.exe
  2⤵
  PID:16164
- C:\Windows\System\rQsCpmv.exe
  C:\Windows\System\rQsCpmv.exe
  2⤵
  PID:16180
- C:\Windows\System\BvcKiLg.exe
  C:\Windows\System\BvcKiLg.exe
  2⤵
  PID:16208
- C:\Windows\System\iPrFuiV.exe
  C:\Windows\System\iPrFuiV.exe
  2⤵
  PID:16236
- C:\Windows\System\UcyaGQZ.exe
  C:\Windows\System\UcyaGQZ.exe
  2⤵
  PID:16260
- C:\Windows\System\BDqQUtC.exe
  C:\Windows\System\BDqQUtC.exe
  2⤵
  PID:16280
- C:\Windows\System\MmPOpty.exe
  C:\Windows\System\MmPOpty.exe
  2⤵
  PID:16300
- C:\Windows\System\LJAmBIr.exe
  C:\Windows\System\LJAmBIr.exe
  2⤵
  PID:16332
- C:\Windows\System\kqPMQeE.exe
  C:\Windows\System\kqPMQeE.exe
  2⤵
  PID:16368
- C:\Windows\System\CFdvZGK.exe
  C:\Windows\System\CFdvZGK.exe
  2⤵
  PID:14796
- C:\Windows\System\hywcnZb.exe
  C:\Windows\System\hywcnZb.exe
  2⤵
  PID:15416
- C:\Windows\System\bEaKfwM.exe
  C:\Windows\System\bEaKfwM.exe
  2⤵
  PID:15556
- C:\Windows\System\JNFmcZa.exe
  C:\Windows\System\JNFmcZa.exe
  2⤵
  PID:15616
- C:\Windows\System\MRHXfSF.exe
  C:\Windows\System\MRHXfSF.exe
  2⤵
  PID:15640
- C:\Windows\System\izszHgA.exe
  C:\Windows\System\izszHgA.exe
  2⤵
  PID:14812
- C:\Windows\System\qnQIdbC.exe
  C:\Windows\System\qnQIdbC.exe
  2⤵
  PID:15676
- C:\Windows\System\msMgMjK.exe
  C:\Windows\System\msMgMjK.exe
  2⤵
  PID:15832
- C:\Windows\System\bmbNdzj.exe
  C:\Windows\System\bmbNdzj.exe
  2⤵
  PID:15956
- C:\Windows\System\sJrcWxb.exe
  C:\Windows\System\sJrcWxb.exe
  2⤵
  PID:16012
- C:\Windows\System\LjDFoyB.exe
  C:\Windows\System\LjDFoyB.exe
  2⤵
  PID:16064
- C:\Windows\System\woitrnM.exe
  C:\Windows\System\woitrnM.exe
  2⤵
  PID:16156
- C:\Windows\System\pspucUw.exe
  C:\Windows\System\pspucUw.exe
  2⤵
  PID:16176
- C:\Windows\System\pIkYtBi.exe
  C:\Windows\System\pIkYtBi.exe
  2⤵
  PID:16288
- C:\Windows\System\SuqWRru.exe
  C:\Windows\System\SuqWRru.exe
  2⤵
  PID:16192
- C:\Windows\System\eUVRidZ.exe
  C:\Windows\System\eUVRidZ.exe
  2⤵
  PID:16348
- C:\Windows\System\iEEjqlJ.exe
  C:\Windows\System\iEEjqlJ.exe
  2⤵
  PID:16268
- C:\Windows\System\ACWHsHm.exe
  C:\Windows\System\ACWHsHm.exe
  2⤵
  PID:15436
- C:\Windows\System\zMGPFrH.exe
  C:\Windows\System\zMGPFrH.exe
  2⤵
  PID:15588
- C:\Windows\System\cIATCqe.exe
  C:\Windows\System\cIATCqe.exe
  2⤵
  PID:15792
- C:\Windows\System\xnPkkVp.exe
  C:\Windows\System\xnPkkVp.exe
  2⤵
  PID:16032
- C:\Windows\System\azuuauw.exe
  C:\Windows\System\azuuauw.exe
  2⤵
  PID:16088
- C:\Windows\System\knPOVjz.exe
  C:\Windows\System\knPOVjz.exe
  2⤵
  PID:16340
- C:\Windows\System\NnOMZUt.exe
  C:\Windows\System\NnOMZUt.exe
  2⤵
  PID:16004
- C:\Windows\System\CaUUHsW.exe
  C:\Windows\System\CaUUHsW.exe
  2⤵
  PID:15988
- C:\Windows\System\Wxenkyj.exe
  C:\Windows\System\Wxenkyj.exe
  2⤵
  PID:16216
- C:\Windows\System\YtnXDnt.exe
  C:\Windows\System\YtnXDnt.exe
  2⤵
  PID:16412
- C:\Windows\System\jjfJAeg.exe
  C:\Windows\System\jjfJAeg.exe
  2⤵
  PID:16440
- C:\Windows\System\nZlCStP.exe
  C:\Windows\System\nZlCStP.exe
  2⤵
  PID:16464
- C:\Windows\System\dPlcCRP.exe
  C:\Windows\System\dPlcCRP.exe
  2⤵
  PID:16512
- C:\Windows\System\qxJaZxL.exe
  C:\Windows\System\qxJaZxL.exe
  2⤵
  PID:16532
- C:\Windows\System\PwSxJXZ.exe
  C:\Windows\System\PwSxJXZ.exe
  2⤵
  PID:16564
- C:\Windows\System\kgFOBLw.exe
  C:\Windows\System\kgFOBLw.exe
  2⤵
  PID:16592
- C:\Windows\System\ZUOypJs.exe
  C:\Windows\System\ZUOypJs.exe
  2⤵
  PID:16628
- C:\Windows\System\MlfMavQ.exe
  C:\Windows\System\MlfMavQ.exe
  2⤵
  PID:16660
- C:\Windows\System\hOBjugM.exe
  C:\Windows\System\hOBjugM.exe
  2⤵
  PID:16684
- C:\Windows\System\kNoQStW.exe
  C:\Windows\System\kNoQStW.exe
  2⤵
  PID:16704
- C:\Windows\System\VksTIuK.exe
  C:\Windows\System\VksTIuK.exe
  2⤵
  PID:16736
- C:\Windows\System\RdaXEQd.exe
  C:\Windows\System\RdaXEQd.exe
  2⤵
  PID:16764
- C:\Windows\System\KyMMswm.exe
  C:\Windows\System\KyMMswm.exe
  2⤵
  PID:16784
- C:\Windows\System\zyAvrEK.exe
  C:\Windows\System\zyAvrEK.exe
  2⤵
  PID:16820
- C:\Windows\System\AtdJePu.exe
  C:\Windows\System\AtdJePu.exe
  2⤵
  PID:16852
- C:\Windows\System\dptkIIz.exe
  C:\Windows\System\dptkIIz.exe
  2⤵
  PID:16880
- C:\Windows\System\FXnXITr.exe
  C:\Windows\System\FXnXITr.exe
  2⤵
  PID:16904
- C:\Windows\System\tupkuGY.exe
  C:\Windows\System\tupkuGY.exe
  2⤵
  PID:16936
- C:\Windows\System\ljrrmfk.exe
  C:\Windows\System\ljrrmfk.exe
  2⤵
  PID:16960
- C:\Windows\System\ptgPMAr.exe
  C:\Windows\System\ptgPMAr.exe
  2⤵
  PID:17000
- C:\Windows\System\oWIydZG.exe
  C:\Windows\System\oWIydZG.exe
  2⤵
  PID:17028
- C:\Windows\System\VnEWFMk.exe
  C:\Windows\System\VnEWFMk.exe
  2⤵
  PID:17060

C:\Windows\System32\sihclient.exe
C:\Windows\System32\sihclient.exe /cv S0yJ1Gb1QkuAzA22k0ctBA.0.2
1⤵
PID:17252
- C:\Windows\system32\WerFaultSecure.exe
  C:\Windows\system32\WerFaultSecure.exe -u -p 17252 -s 1080
  2⤵
  - Drops file in System32 directory
  - Checks processor information in registry
  - Enumerates system info in registry
  PID:17372

C:\Windows\system32\WerFaultSecure.exe
"C:\Windows\system32\WerFaultSecure.exe" -protectedcrash -p 17252 -i 17252 -h 424 -j 428 -s 440 -d 17304
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
PID:17340

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\BryZZdI.exe

Filesize
1.8MB

MD5
43568c9313db937c9511e034b29e44d5

SHA1
e4dd655da087834ec53056bf987bb20ef8d266ff

SHA256
4bbb2c87bc747a001a11eeff616c2aeb2980ace583fe1c39fd5169a817d0e485

SHA512
fe27de1847bf923f81a3fa37a7337e62964c1a0efbe52313fb2ff42a9f4c7653f715a896b202f7f21346256d6ff3937f429b04d73b96cdb75862d1e67e48ec66

Download Submit
C:\Windows\System\DGEKNxC.exe

Filesize
1.8MB

MD5
7b8c0c2ba186306a43b37139c736d8c7

SHA1
d528c72761405d7ee7416c877bce3d6810d97ca3

SHA256
0f9760e7e6fa861d5db25357e81a08ed080319694a55c83866c90a39a958c4c1

SHA512
96d48dff7e0f53a6c8f3b53a5977978d6e436bb9d5281ef14d2269bb30f1aeb2775a53c0d1dee0bb126f2a37ae3116aa589a7c0911ad48c30bbbc037358e940f

Download Submit
C:\Windows\System\EzyXDNM.exe

Filesize
1.8MB

MD5
0d074bfdb57885c8e4773e8c56d5e13f

SHA1
5eed152d9f62378d0db20e8cb026008349854f3c

SHA256
9d31abb2d50a0089cb9957d945167a57208855f63868ef4978333e1e90424ea6

SHA512
e9e666a240d321db1fb16a8e188a67678d8517bf78e1fd3becc788f1ce0b91d78b764b4cda347d93dda8affd521766aff9f32fbb4cb562915101f72688ea8a2e

Download Submit
C:\Windows\System\IKrUlEM.exe

Filesize
1.8MB

MD5
8b0c9d842836b0f3fc2dd0cf647d3c0e

SHA1
ef51a47b401bb2aae0f7f99d8a289255b44d7cbe

SHA256
ab1c6802aa5b886995dd9b5a51a4b75a3a4bccaa210d4c97e4348cbc0676d2ad

SHA512
1ddf7197d154543f8628038399991761631df702cc600345ff8502bc76a726b60e0726c9eb235e31d45ee93e115473899ea4ee36d21e2d6730018b9e3848524b

Download Submit
C:\Windows\System\JMCgCQo.exe

Filesize
1.8MB

MD5
62388a9f4cd633e6de1bf6a08355734f

SHA1
9ac5ce4935ac062984ebc54402b19c6f8dee22b7

SHA256
fc0f7881ab53ebf4aba94da2f64787e29a945a26b1f210e2711a7a922d6d2e48

SHA512
d7c362828df673cc0c27c9a13bd18109ab6085004c5ecbacb12d6821e2ffdb2cca155dd1172a060435f0d4031b1c08047624b880d251725c8c3bfa49ddd9e7d8

Download Submit
C:\Windows\System\KAisIdh.exe

Filesize
1.8MB

MD5
12b70aa8ae0618d00d508550e4cdea00

SHA1
1ba843bd98714f1d2a217fdec4348e168a60c766

SHA256
d0104267b48244c35c30f9c248c6eae2ac343dac8c0888ea2917e09e939a90ca

SHA512
ac3a6ef6b9f08abb91689b9a251cb136d80592fb56c4380388ae345acdb6b566e246946de7b968bdf6e5681472c7967315e54f1b0fefe239b12b75d39dd220bc

Download Submit
C:\Windows\System\NLdObbQ.exe

Filesize
1.8MB

MD5
143cf6428dbf423ec56e9d53fbbf1a81

SHA1
dccad8bdcfe2e88ee99f0a6f3406cfc43e68d7da

SHA256
79b3c8e2db9aa43847522ccbaf23672dc30dfb2e195fcfa72bad4a97d972c8f8

SHA512
c2a476aefbba29a37a33631b957a610ad78d46c5950524b756241d29fd55a91a5862980de4b0c7f0cfcc597be7cbca3679bfad19f6ec94f8ed70ea62311f4c80

Download Submit
C:\Windows\System\RHiiUxh.exe

Filesize
1.8MB

MD5
36ab877a316187071fdd9320f3f60795

SHA1
088748a8b3bd231298ee38286b5fbaf7d8915031

SHA256
deaa7851e76cbeb813a4dab3ede184b45415246aad8f89bd7f97e14d89d298a1

SHA512
01e6b87cf1cfe845f15b4b3f7c2ac39c5bb7c1462a8b92438fe795b0f4cccf738f947415bd0dfe35b3da0dc8bb3e8eed545c0c89632036168ee8ad148a370085

Download Submit
C:\Windows\System\VHYqbXd.exe

Filesize
1.8MB

MD5
60625ad11dad848aef339e27dbc211d3

SHA1
0baec3096fa1d8a880517849dc6acf192e0f4672

SHA256
bd6f3f2444b8971b7a68a070f81b860ffdd1357e27f809bb40a7efa5ff72a4be

SHA512
841268081fcd774e368fbaec8decdea67916e2b9ac3bed5961312a15f2be91bc50314ebc9a240b8ea936e22d56206813ad7824304030bed5a4ec538a7648a494

Download Submit
C:\Windows\System\WhkPpPl.exe

Filesize
1.8MB

MD5
6c334d7a21be9cdf93c51d6313249fb8

SHA1
53b7a18266164f4bb7fcb4995ac659435a1b9c83

SHA256
d9f07f8be5c342b31d26617825f4cfa5fc865b9932a6c176ae1abcca9e34b1be

SHA512
a323ae9b294cd5611df9c30ec8b672801b2600f9c9e26e3a376253517bcb06193854ac8021aec8a064485c57fefe8b7c0248e8e73b6d6c1777c86c3bd05c11bf

Download Submit
C:\Windows\System\ZNObqRU.exe

Filesize
1.8MB

MD5
86fb102b4da43d6a2cbf2537bca8838b

SHA1
939ad013cffbb6576e3cfce4c2f7e9ab2360ceb7

SHA256
6db891017a9fe81c3d610111670b385ac07f99104cbb619996cb8b6dc41ced70

SHA512
955b0d1ddaa3bf9cb3a0b916913ca8e6cac9253be27db48dbdb0b991903ea0017a58f2213ce6596a7a65d903cf1df0e8bedcd5deffac6c7ac3d2ffa22ba08c5e

Download Submit
C:\Windows\System\axpeYoL.exe

Filesize
1.8MB

MD5
2b488fc4bec80153798f0e765fc96e80

SHA1
1ef30373a9b82974d20a47aaca3308148cab2209

SHA256
4e30ac3c80a37f8027cd19b9bb4c4a5fcea6bc19d350fec0c6d99f96ce8f6b51

SHA512
7ca6048b9232fd866aa688d5ea7d0b32376c4aab1df4d58acc5b5cceed932652a2743b180fd3cef1aa40f1d7ff1ea8102d9235d21f2da06a9236fdef4d57c100

Download Submit
C:\Windows\System\bfVcefn.exe

Filesize
1.8MB

MD5
910ca884f127ffb8d25a8ca820883d85

SHA1
558312eb47d23fe45b3dc7fea1117f1038ba54a8

SHA256
eedef441c855f85591ee8a50fde3cdb8095bcc11460132b8213710e69fd623fd

SHA512
43a8fc2a4732686d721fd4a22fc430816e3227e9f15adcc28a962b98fd87699dc361ac4cae567cfc4f16bc95c496e8030f867522293db053e79f6f7dac0eae37

Download Submit
C:\Windows\System\bsywOou.exe

Filesize
1.8MB

MD5
dd4da5658df6e969a45076286c56d219

SHA1
0d14260fb76ef73cf971ac5bd9ffb866893451da

SHA256
fc1a1247029a33d34949e71ac85408049bbc8713225b857c861c47f2fc6bc624

SHA512
05d5e16e7a87b670f0e33d447aea43c8b86455a1246a3886fb165dc24cd3c77506bb9a1ceff52666140e50215b99f7cdf141742b0b4b3d8256e903768acc6387

Download Submit
C:\Windows\System\ckcUuWM.exe

Filesize
1.8MB

MD5
787c2330bb5a6117463237113d98bdf5

SHA1
288d3744c276b382903786d2cec241565c8fde7c

SHA256
102bf7f0a33024a90991a5b2aaa8f6ebab91079abd449a75984e15e39d6629f2

SHA512
c2681ee798054196da04bf407b1c0f112b90199a543952b9315b54b45c60b97776bf71ea9ffe3bf7698fca1707457926fa6c2aa66ca36022c2888962a8009e0c

Download Submit
C:\Windows\System\dLyTqPK.exe

Filesize
1.8MB

MD5
3c4675125372ea8786c8c9636678415b

SHA1
31254e13ca3f37da16217f4d64803c4ab8eb045f

SHA256
decfaf24df8faaa3f32322bff30dfe854f75864e5bc4192850cbaab0abbe78f9

SHA512
9173e074b34194405fdb60a85fbacf87b9d12c1f5bd91ff0aa3db17e894404dafa35338c1f8ba22a68081e521eb8f5754c69c75e0089284b2301731aa47b8002

Download Submit
C:\Windows\System\fKSuHOq.exe

Filesize
1.8MB

MD5
057791222ec946c48f3e96804e16950a

SHA1
1950074cc617cd3b4a426bac08e51010421e81eb

SHA256
67de106cdb6b32dc94f69387b6e12e2be8a2fba54da505274370911418e587b6

SHA512
8e6a7a62c4aa14bfd786e0b66f2508591db86e6dae2061f89b4bb9fd452b1a0bd291d390b1b4f08fc6e07033380e816a6f9b4f5c7e3d21cba45ccdf7f7970b7b

Download Submit
C:\Windows\System\ffkpflK.exe

Filesize
1.8MB

MD5
49442a4f600f9d8ed86cebf01bde1fbf

SHA1
2fc6122a5134d077f0da23986964e316ff38d06a

SHA256
7817aaccd1d8d6b69315e27ecb23ee17fbe9ac5b595739980e6291cadd0d1527

SHA512
04b6c95baa1f22e125f3fbd4e15c386c3bc98ae15a4d873aad8968748f532e5c56a7b8c3d559f079639475d23055d43a536c63af4bdb985fb58b67d9c3f064eb

Download Submit
C:\Windows\System\gkygTpc.exe

Filesize
1.8MB

MD5
8ec99ba824cb548be16886e13542c4b5

SHA1
aeeab31b0e05013604837f29e0e5253067426b9b

SHA256
f04197108c9b4cd6f7225c9cb2ddeda34600eea03929cac801a5399526f92697

SHA512
6d4a708903c678a8ec8b4373dc23ea34686f8d47b20a519b7d9be0e4d5327567d3ad020e30fc645af81f139101017430eafcea7c4d4d6ccec79f626aabd73433

Download Submit
C:\Windows\System\gvceGKk.exe

Filesize
1.8MB

MD5
e515fab8fc064b3095b8a6fac84ceb2c

SHA1
ae1c86ba95b8256d6b82ee4443361a6e3d362aa0

SHA256
f6f7f4acc05bb87067439f796f9b34bbbf2d0bb80a781b677b96119b66761f3c

SHA512
9a2463e9b0bf80ac97b2cfd54337de13a7d63c5c38f7f2aee081bac0d5faa4673646b58120d68ab7154941f48d087d8d8a567930c6729c5c4f74d6c7eed1220e

Download Submit
C:\Windows\System\lTNEQpZ.exe

Filesize
1.8MB

MD5
ac791e992cee8429bd6d9f13d14d4db4

SHA1
4cb7480f81adde088db0597837e52c8fce927f58

SHA256
bf446291c0b6a129113e5c0a8d01dc9fab216478091fc7e54ae5f338d0c5cce7

SHA512
9c9a45ba5bfec1ed2c5e1192e175a5c91c5ffe39f5363c712140cbc4ae48c6f620d0bde25c63a48ecffcea4dd074f380ebbfac152b7374f3f7812d342703321e

Download Submit
C:\Windows\System\omBUCyD.exe

Filesize
1.8MB

MD5
f86329e34d88d3716aa4dc33f2e76564

SHA1
570b929e0341a0f8ddd33d17b9e277ba6bda5aff

SHA256
ae4ec433ba020ab2faa9bd5d36c9f4e0f4cd8c76dcb0a09c4ac36a77cedf3585

SHA512
b6357e3a8fb93444b8fcf9ddfc58086161f4d8bc4ea76bdb8f9807c2408ac645521484336a0331d36d2f565b3f2b16e9f800a39300741a003edaab577c485e82

Download Submit
C:\Windows\System\pGnxZkY.exe

Filesize
1.8MB

MD5
7c612e36381e1d00e292ebc12ae7a899

SHA1
456eb221ee7241504594a0d590ac744e6235c1ad

SHA256
804b8681f5058d4b618627d78501984d84cf1fd82196ba99aaa2580510d2f738

SHA512
8be0ad6b22954044e04412f04dceec31678914f68dba40672b85712b5a1f80060c8c6f7cede05ae5fdb5c5ee2ac996e8c5cf211deb7f0828e00c69f05c5c3ba6

Download Submit
C:\Windows\System\qALAcAQ.exe

Filesize
1.8MB

MD5
fc71e9ed2363c3f40f69d890252cdefe

SHA1
f9b14679353a625678f5b2df495937dfd49d5bbb

SHA256
11c82da35781fad2d1cbde7bde8cb83748b0b727d9cef02ce41d80c78425ea5a

SHA512
3b72d97254488d35ccfe5c41782b4097476e57abcb4993e6749610b3cc39bd2d6b70f46f0534faf899ef5ab02ae94cf361a092bece83ef32d467ea5a8f37e014

Download Submit
C:\Windows\System\reMaimt.exe

Filesize
1.8MB

MD5
942bd0fe5e90b69fd23db138682d54c9

SHA1
dd3bafde130f169a5e64c7797a01206995a3a3c6

SHA256
b7bee96d62c27ff3c8445a6fb03f97e62d8545046a47fc7434f098dc0dc0286e

SHA512
d50cd982f23da65e851a136e516ae7f18b63fa5a71827c1c4bec3d8dab893be15e0ebde1da8de8b9612a198c1bfd0feb3dedc809916df1f2563c11323ce290b7

Download Submit
C:\Windows\System\rhciZpb.exe

Filesize
1.8MB

MD5
b45a174bcab536f0cb159057f27dcad7

SHA1
4a5315806f37f70a529edf13549065802f9a7bb5

SHA256
8153d75ac5c8db09cff55a8e57ad5c96a9c3702565e0a064dbf51903b06e7e8c

SHA512
058058d1240d2b1e4d2540dc787d4a96e42e93b15c69da8abe9ac2544c5050a604716255dd37b79caa3f91479e4a59cd8a07f6560144df9efd08df9de6724744

Download Submit
C:\Windows\System\sraIAyI.exe

Filesize
1.8MB

MD5
b5cd2c59314bdf15348fc780543228a5

SHA1
10906c0cb5feacef12d0d82863956a356b18d28f

SHA256
0ba50b07325fa7fd802a066c227b071a3f8ec237ee3350b1dc8d984c093ca1f3

SHA512
6df8173ac394df3b4768ab1ad05ee27f06248c6d06b208935875452a68488b2d30e8356028c0a1080ca1e64f2f775e43608ad8b3218554607f7c5d615d73a0a6

Download Submit
C:\Windows\System\tWMsvar.exe

Filesize
1.8MB

MD5
724af0d67f5ddb016a82311f995a64f7

SHA1
a95c737fe03ee0acd95acee010b06e79251df088

SHA256
b5fa856ea8ac22880c3b1a5f615926269ca665f4c785264fc5afa0a790abb550

SHA512
2c317ee9d192d4e33bf1dcde3fbf1d16f642ca33711c88f270739047132b2ff8cff33d89979ac2b279139b8ac6acf8e0d5c90818cffc617837f5ad3f8dbf2934

Download Submit
C:\Windows\System\vIUVgqL.exe

Filesize
1.8MB

MD5
6ecc3862bb3a0de421a9456e1131d6c0

SHA1
fff0a112b195d2272ae35ea55574e85cb8f259a5

SHA256
e2fec6dcde9f83b4a2ea33abccc36c63c0202fe4393a0787795e90ff950c1cec

SHA512
cef5b3949d3957299d23947bf0148e67c694701632068f41b2ffd3fc8d20ad333f7da69793008f1597c6bf79fc32d4b4d51342bb593aaf8b58dd6a81a747da3c

Download Submit
C:\Windows\System\viwUbGj.exe

Filesize
1.8MB

MD5
a2d0d1d947fb7689b3c0c86542d0776b

SHA1
08a5edc64846c51250fefbca37b383cc2b19413a

SHA256
4b14d3741aa3238a5e98e4f4898b8da7ae57dcb54627d1ff824dc6a990a71dfa

SHA512
21d59743e5c8ce76afd1e21c9e678fea93fbe722f62d562c0381a6d0f8331ba44491718d38fe35eed257ca0eaa047f3571efed102e8d8883bfb347ee257ac930

Download Submit
C:\Windows\System\yOJtXIe.exe

Filesize
1.8MB

MD5
52f78c3d804487023bb00fb1dbb487a0

SHA1
89aa3694d807ace5d1439aebc4fcf71465aba59e

SHA256
f5f403587538a7d714dffaad30df7e9e78c1ffac929cdd73df32b9de33bae669

SHA512
062d57193dffe735f22ba556d87e0e8d1732a7932c8e6e92c4a39a2332f46d15501bcaa88a484a168fc12c21b58e2f57b8db21e6960c1ec971ff9e1f004a51b7

Download Submit
C:\Windows\System\yymqBCr.exe

Filesize
1.8MB

MD5
3aa0fc488d026dee09fb1ff09c764fbc

SHA1
63f75b75325a980ee8b154be2de8697c6dce9ace

SHA256
548fa88ecdb3dee0f6eccdfe595f924ebb86f0cfb865fef4df3fd6e7654688b6

SHA512
9e751a6af2ad5144af14991d8431bd706165959cb79c24fd268f1495a48f05154a509ad095ff23c1cf62163dc3ef5da598f4ba1356a0200277606d29701e62e4

Download Submit
memory/560-0-0x000001B71A840000-0x000001B71A850000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads