xmrig | 1573d44d6db866a2acf9f9baf2a3e01fe8138808c3d401248844387048c0ed7d

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
23-12-2024 19:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1573d44d6db866a2acf9f9baf2a3e01fe8138808c3d401248844387048c0ed7d.exe
Size

1.4MB
MD5

2fb0007f11edde531d0ba1983fddb8ba
SHA1

9f36f5b1f6a6237fcd01be0473c28caccc1f8aa5
SHA256

1573d44d6db866a2acf9f9baf2a3e01fe8138808c3d401248844387048c0ed7d
SHA512

7c959d60107299e8abeb2985eeb5c1e852bbd16969395d190015bc83319599a68ff35a87d8187d15bc8913d649a3f6ecb6d7179d64586da6f66102d159423b92
SSDEEP

24576:GezaTnG99Q8FcNrpyNdfE0bLBgDOp2iSLz9LbpwlKenszbWKDNEm/5ph70VwW4kU:GezaTF8FcNkNdfE0pZ9ozttwIRx2VDH2

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 33 IoCs

miner

resource	yara_rule
behavioral2/files/0x0009000000023c35-4.dat	xmrig
behavioral2/files/0x0008000000023c50-6.dat	xmrig
behavioral2/files/0x0008000000023c51-15.dat	xmrig
behavioral2/files/0x0008000000023c4f-20.dat	xmrig
behavioral2/files/0x0008000000023c52-25.dat	xmrig
behavioral2/files/0x0008000000023c53-29.dat	xmrig
behavioral2/files/0x0016000000023c6a-42.dat	xmrig
behavioral2/files/0x0008000000023c70-49.dat	xmrig
behavioral2/files/0x0008000000023c74-58.dat	xmrig
behavioral2/files/0x0008000000023c81-62.dat	xmrig
behavioral2/files/0x0008000000023c80-63.dat	xmrig
behavioral2/files/0x000b000000023c69-43.dat	xmrig
behavioral2/files/0x0008000000023c54-37.dat	xmrig
behavioral2/files/0x0008000000023c82-69.dat	xmrig
behavioral2/files/0x0009000000023c36-73.dat	xmrig
behavioral2/files/0x0008000000023c84-79.dat	xmrig
behavioral2/files/0x0008000000023c85-84.dat	xmrig
behavioral2/files/0x0008000000023c86-90.dat	xmrig
behavioral2/files/0x0008000000023c87-95.dat	xmrig
behavioral2/files/0x0008000000023c88-98.dat	xmrig
behavioral2/files/0x0008000000023c89-103.dat	xmrig
behavioral2/files/0x0008000000023c8a-109.dat	xmrig
behavioral2/files/0x0007000000023c93-113.dat	xmrig
behavioral2/files/0x0007000000023c94-119.dat	xmrig
behavioral2/files/0x0007000000023c95-124.dat	xmrig
behavioral2/files/0x0007000000023c96-129.dat	xmrig
behavioral2/files/0x0007000000023c98-140.dat	xmrig
behavioral2/files/0x0007000000023c97-138.dat	xmrig
behavioral2/files/0x0007000000023c99-148.dat	xmrig
behavioral2/files/0x0007000000023c9c-159.dat	xmrig
behavioral2/files/0x0007000000023c9d-162.dat	xmrig
behavioral2/files/0x0007000000023c9b-155.dat	xmrig
behavioral2/files/0x0007000000023c9a-150.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
1220	OsTxUnr.exe
1932	XuzpvSr.exe
2324	HTFFCYZ.exe
2848	scMILik.exe
2732	wZjUvWD.exe
4532	aUvEdzp.exe
3832	vcrgWwI.exe
1868	PrRwtmi.exe
4492	PLQQbxI.exe
8	YYsFUoH.exe
976	afjzzvV.exe
1268	RMAYbeB.exe
632	oCgVwGI.exe
1900	JgCqZgc.exe
2224	AikiAki.exe
4452	gFWJdgA.exe
4928	TVPagKh.exe
2676	ydJLmoq.exe
1596	LDduXmK.exe
3140	jnpMDer.exe
560	qCrJPSb.exe
3992	EkJATgB.exe
4160	SIhewBn.exe
3120	QbrdBGG.exe
336	zvWtFep.exe
3500	BJEuSdY.exe
4256	HIWErdN.exe
4288	QoVpczz.exe
5016	zXgWDqS.exe
4744	MKkYnvD.exe
2196	uVOjdsi.exe
4596	RPmKEon.exe
1732	diDdAdE.exe
3244	aEehNel.exe
1244	wtUuXHw.exe
4072	ToRkjcW.exe
2588	eUeTKYD.exe
2564	TNUaSLg.exe
1608	ybgJQPT.exe
1840	wqtaZAp.exe
1764	EAEbPpY.exe
4588	LzKUBox.exe
1500	AscykuL.exe
980	yhoekjx.exe
3416	wlokOtg.exe
2096	rpfMJDe.exe
3172	GxLIDSG.exe
2308	pZtzrHb.exe
4420	OwVtLSG.exe
4644	YNUeLue.exe
4304	JkuDfHY.exe
3584	nEmkumu.exe
3024	etehcnT.exe
3200	YtRVoqB.exe
2668	cVdNONT.exe
2044	ItzPgJC.exe
3240	fdznCkg.exe
3464	FDhVQqF.exe
1180	DkujYaL.exe
1792	zxSPOPG.exe
1360	KFkPneM.exe
4260	OiBbeTW.exe
4720	IAYNcmr.exe
2672	WTQJbeu.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\HwbMGDi.exe	1573d44d6db866a2acf9f9baf2a3e01fe8138808c3d401248844387048c0ed7d.exe
File created	C:\Windows\System\rGkCROo.exe	1573d44d6db866a2acf9f9baf2a3e01fe8138808c3d401248844387048c0ed7d.exe
File created	C:\Windows\System\mVdCVnL.exe	1573d44d6db866a2acf9f9baf2a3e01fe8138808c3d401248844387048c0ed7d.exe
File created	C:\Windows\System\zcsZCnC.exe	1573d44d6db866a2acf9f9baf2a3e01fe8138808c3d401248844387048c0ed7d.exe
File created	C:\Windows\System\WLOzbBI.exe	1573d44d6db866a2acf9f9baf2a3e01fe8138808c3d401248844387048c0ed7d.exe
File created	C:\Windows\System\frHxcYi.exe	1573d44d6db866a2acf9f9baf2a3e01fe8138808c3d401248844387048c0ed7d.exe
File created	C:\Windows\System\UuiMfUX.exe	1573d44d6db866a2acf9f9baf2a3e01fe8138808c3d401248844387048c0ed7d.exe
File created	C:\Windows\System\KMKfUcM.exe	1573d44d6db866a2acf9f9baf2a3e01fe8138808c3d401248844387048c0ed7d.exe
File created	C:\Windows\System\DkujYaL.exe	1573d44d6db866a2acf9f9baf2a3e01fe8138808c3d401248844387048c0ed7d.exe
File created	C:\Windows\System\IAYNcmr.exe	1573d44d6db866a2acf9f9baf2a3e01fe8138808c3d401248844387048c0ed7d.exe
File created	C:\Windows\System\pureRvq.exe	1573d44d6db866a2acf9f9baf2a3e01fe8138808c3d401248844387048c0ed7d.exe
File created	C:\Windows\System\uJnCyWq.exe	1573d44d6db866a2acf9f9baf2a3e01fe8138808c3d401248844387048c0ed7d.exe
File created	C:\Windows\System\LzKUBox.exe	1573d44d6db866a2acf9f9baf2a3e01fe8138808c3d401248844387048c0ed7d.exe
File created	C:\Windows\System\FDhVQqF.exe	1573d44d6db866a2acf9f9baf2a3e01fe8138808c3d401248844387048c0ed7d.exe
File created	C:\Windows\System\hTUyGQP.exe	1573d44d6db866a2acf9f9baf2a3e01fe8138808c3d401248844387048c0ed7d.exe
File created	C:\Windows\System\WTDKKeW.exe	1573d44d6db866a2acf9f9baf2a3e01fe8138808c3d401248844387048c0ed7d.exe
File created	C:\Windows\System\nUaBXna.exe	1573d44d6db866a2acf9f9baf2a3e01fe8138808c3d401248844387048c0ed7d.exe
File created	C:\Windows\System\lcUZOSV.exe	1573d44d6db866a2acf9f9baf2a3e01fe8138808c3d401248844387048c0ed7d.exe
File created	C:\Windows\System\gssAeFZ.exe	1573d44d6db866a2acf9f9baf2a3e01fe8138808c3d401248844387048c0ed7d.exe
File created	C:\Windows\System\TKGDpoj.exe	1573d44d6db866a2acf9f9baf2a3e01fe8138808c3d401248844387048c0ed7d.exe
File created	C:\Windows\System\NiVRRIz.exe	1573d44d6db866a2acf9f9baf2a3e01fe8138808c3d401248844387048c0ed7d.exe
File created	C:\Windows\System\liCFgEO.exe	1573d44d6db866a2acf9f9baf2a3e01fe8138808c3d401248844387048c0ed7d.exe
File created	C:\Windows\System\CIarQQa.exe	1573d44d6db866a2acf9f9baf2a3e01fe8138808c3d401248844387048c0ed7d.exe
File created	C:\Windows\System\VdWBJtd.exe	1573d44d6db866a2acf9f9baf2a3e01fe8138808c3d401248844387048c0ed7d.exe
File created	C:\Windows\System\cElmFCN.exe	1573d44d6db866a2acf9f9baf2a3e01fe8138808c3d401248844387048c0ed7d.exe
File created	C:\Windows\System\ZaDFZFz.exe	1573d44d6db866a2acf9f9baf2a3e01fe8138808c3d401248844387048c0ed7d.exe
File created	C:\Windows\System\buhKysl.exe	1573d44d6db866a2acf9f9baf2a3e01fe8138808c3d401248844387048c0ed7d.exe
File created	C:\Windows\System\ecwZwVL.exe	1573d44d6db866a2acf9f9baf2a3e01fe8138808c3d401248844387048c0ed7d.exe
File created	C:\Windows\System\HltqAUb.exe	1573d44d6db866a2acf9f9baf2a3e01fe8138808c3d401248844387048c0ed7d.exe
File created	C:\Windows\System\yvmAskW.exe	1573d44d6db866a2acf9f9baf2a3e01fe8138808c3d401248844387048c0ed7d.exe
File created	C:\Windows\System\hCEBMxl.exe	1573d44d6db866a2acf9f9baf2a3e01fe8138808c3d401248844387048c0ed7d.exe
File created	C:\Windows\System\zOQHCkY.exe	1573d44d6db866a2acf9f9baf2a3e01fe8138808c3d401248844387048c0ed7d.exe
File created	C:\Windows\System\UBhCvWW.exe	1573d44d6db866a2acf9f9baf2a3e01fe8138808c3d401248844387048c0ed7d.exe
File created	C:\Windows\System\FmAZVqe.exe	1573d44d6db866a2acf9f9baf2a3e01fe8138808c3d401248844387048c0ed7d.exe
File created	C:\Windows\System\lHctjZZ.exe	1573d44d6db866a2acf9f9baf2a3e01fe8138808c3d401248844387048c0ed7d.exe
File created	C:\Windows\System\JEbeETz.exe	1573d44d6db866a2acf9f9baf2a3e01fe8138808c3d401248844387048c0ed7d.exe
File created	C:\Windows\System\ackDJFj.exe	1573d44d6db866a2acf9f9baf2a3e01fe8138808c3d401248844387048c0ed7d.exe
File created	C:\Windows\System\OsTxUnr.exe	1573d44d6db866a2acf9f9baf2a3e01fe8138808c3d401248844387048c0ed7d.exe
File created	C:\Windows\System\sZlyBeg.exe	1573d44d6db866a2acf9f9baf2a3e01fe8138808c3d401248844387048c0ed7d.exe
File created	C:\Windows\System\cbUIjRB.exe	1573d44d6db866a2acf9f9baf2a3e01fe8138808c3d401248844387048c0ed7d.exe
File created	C:\Windows\System\xEdQCMV.exe	1573d44d6db866a2acf9f9baf2a3e01fe8138808c3d401248844387048c0ed7d.exe
File created	C:\Windows\System\Nrbtyib.exe	1573d44d6db866a2acf9f9baf2a3e01fe8138808c3d401248844387048c0ed7d.exe
File created	C:\Windows\System\kZBNLiG.exe	1573d44d6db866a2acf9f9baf2a3e01fe8138808c3d401248844387048c0ed7d.exe
File created	C:\Windows\System\cTbXoQx.exe	1573d44d6db866a2acf9f9baf2a3e01fe8138808c3d401248844387048c0ed7d.exe
File created	C:\Windows\System\DsFExwn.exe	1573d44d6db866a2acf9f9baf2a3e01fe8138808c3d401248844387048c0ed7d.exe
File created	C:\Windows\System\IqtGyYP.exe	1573d44d6db866a2acf9f9baf2a3e01fe8138808c3d401248844387048c0ed7d.exe
File created	C:\Windows\System\ItzPgJC.exe	1573d44d6db866a2acf9f9baf2a3e01fe8138808c3d401248844387048c0ed7d.exe
File created	C:\Windows\System\hDcNRLK.exe	1573d44d6db866a2acf9f9baf2a3e01fe8138808c3d401248844387048c0ed7d.exe
File created	C:\Windows\System\OyVRPda.exe	1573d44d6db866a2acf9f9baf2a3e01fe8138808c3d401248844387048c0ed7d.exe
File created	C:\Windows\System\imkblrZ.exe	1573d44d6db866a2acf9f9baf2a3e01fe8138808c3d401248844387048c0ed7d.exe
File created	C:\Windows\System\eWhiSHq.exe	1573d44d6db866a2acf9f9baf2a3e01fe8138808c3d401248844387048c0ed7d.exe
File created	C:\Windows\System\vVHqTiz.exe	1573d44d6db866a2acf9f9baf2a3e01fe8138808c3d401248844387048c0ed7d.exe
File created	C:\Windows\System\nHXTMIx.exe	1573d44d6db866a2acf9f9baf2a3e01fe8138808c3d401248844387048c0ed7d.exe
File created	C:\Windows\System\fOGAVnG.exe	1573d44d6db866a2acf9f9baf2a3e01fe8138808c3d401248844387048c0ed7d.exe
File created	C:\Windows\System\jnpMDer.exe	1573d44d6db866a2acf9f9baf2a3e01fe8138808c3d401248844387048c0ed7d.exe
File created	C:\Windows\System\BhwZkqb.exe	1573d44d6db866a2acf9f9baf2a3e01fe8138808c3d401248844387048c0ed7d.exe
File created	C:\Windows\System\ENDOiqG.exe	1573d44d6db866a2acf9f9baf2a3e01fe8138808c3d401248844387048c0ed7d.exe
File created	C:\Windows\System\UexKiWB.exe	1573d44d6db866a2acf9f9baf2a3e01fe8138808c3d401248844387048c0ed7d.exe
File created	C:\Windows\System\KbuhLeL.exe	1573d44d6db866a2acf9f9baf2a3e01fe8138808c3d401248844387048c0ed7d.exe
File created	C:\Windows\System\yhoekjx.exe	1573d44d6db866a2acf9f9baf2a3e01fe8138808c3d401248844387048c0ed7d.exe
File created	C:\Windows\System\YNUeLue.exe	1573d44d6db866a2acf9f9baf2a3e01fe8138808c3d401248844387048c0ed7d.exe
File created	C:\Windows\System\hpmdaBV.exe	1573d44d6db866a2acf9f9baf2a3e01fe8138808c3d401248844387048c0ed7d.exe
File created	C:\Windows\System\XtMJeSn.exe	1573d44d6db866a2acf9f9baf2a3e01fe8138808c3d401248844387048c0ed7d.exe
File created	C:\Windows\System\yUxwrGc.exe	1573d44d6db866a2acf9f9baf2a3e01fe8138808c3d401248844387048c0ed7d.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	16452	dwm.exe
Token: SeChangeNotifyPrivilege	16452	dwm.exe
Token: 33	16452	dwm.exe
Token: SeIncBasePriorityPrivilege	16452	dwm.exe
Token: SeShutdownPrivilege	16452	dwm.exe
Token: SeCreatePagefilePrivilege	16452	dwm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2228 wrote to memory of 1220	2228	1573d44d6db866a2acf9f9baf2a3e01fe8138808c3d401248844387048c0ed7d.exe	85
PID 2228 wrote to memory of 1220	2228	1573d44d6db866a2acf9f9baf2a3e01fe8138808c3d401248844387048c0ed7d.exe	85
PID 2228 wrote to memory of 1932	2228	1573d44d6db866a2acf9f9baf2a3e01fe8138808c3d401248844387048c0ed7d.exe	86
PID 2228 wrote to memory of 1932	2228	1573d44d6db866a2acf9f9baf2a3e01fe8138808c3d401248844387048c0ed7d.exe	86
PID 2228 wrote to memory of 2324	2228	1573d44d6db866a2acf9f9baf2a3e01fe8138808c3d401248844387048c0ed7d.exe	87
PID 2228 wrote to memory of 2324	2228	1573d44d6db866a2acf9f9baf2a3e01fe8138808c3d401248844387048c0ed7d.exe	87
PID 2228 wrote to memory of 2848	2228	1573d44d6db866a2acf9f9baf2a3e01fe8138808c3d401248844387048c0ed7d.exe	88
PID 2228 wrote to memory of 2848	2228	1573d44d6db866a2acf9f9baf2a3e01fe8138808c3d401248844387048c0ed7d.exe	88
PID 2228 wrote to memory of 2732	2228	1573d44d6db866a2acf9f9baf2a3e01fe8138808c3d401248844387048c0ed7d.exe	89
PID 2228 wrote to memory of 2732	2228	1573d44d6db866a2acf9f9baf2a3e01fe8138808c3d401248844387048c0ed7d.exe	89
PID 2228 wrote to memory of 4532	2228	1573d44d6db866a2acf9f9baf2a3e01fe8138808c3d401248844387048c0ed7d.exe	90
PID 2228 wrote to memory of 4532	2228	1573d44d6db866a2acf9f9baf2a3e01fe8138808c3d401248844387048c0ed7d.exe	90
PID 2228 wrote to memory of 3832	2228	1573d44d6db866a2acf9f9baf2a3e01fe8138808c3d401248844387048c0ed7d.exe	91
PID 2228 wrote to memory of 3832	2228	1573d44d6db866a2acf9f9baf2a3e01fe8138808c3d401248844387048c0ed7d.exe	91
PID 2228 wrote to memory of 1868	2228	1573d44d6db866a2acf9f9baf2a3e01fe8138808c3d401248844387048c0ed7d.exe	92
PID 2228 wrote to memory of 1868	2228	1573d44d6db866a2acf9f9baf2a3e01fe8138808c3d401248844387048c0ed7d.exe	92
PID 2228 wrote to memory of 4492	2228	1573d44d6db866a2acf9f9baf2a3e01fe8138808c3d401248844387048c0ed7d.exe	93
PID 2228 wrote to memory of 4492	2228	1573d44d6db866a2acf9f9baf2a3e01fe8138808c3d401248844387048c0ed7d.exe	93
PID 2228 wrote to memory of 8	2228	1573d44d6db866a2acf9f9baf2a3e01fe8138808c3d401248844387048c0ed7d.exe	94
PID 2228 wrote to memory of 8	2228	1573d44d6db866a2acf9f9baf2a3e01fe8138808c3d401248844387048c0ed7d.exe	94
PID 2228 wrote to memory of 976	2228	1573d44d6db866a2acf9f9baf2a3e01fe8138808c3d401248844387048c0ed7d.exe	95
PID 2228 wrote to memory of 976	2228	1573d44d6db866a2acf9f9baf2a3e01fe8138808c3d401248844387048c0ed7d.exe	95
PID 2228 wrote to memory of 1268	2228	1573d44d6db866a2acf9f9baf2a3e01fe8138808c3d401248844387048c0ed7d.exe	96
PID 2228 wrote to memory of 1268	2228	1573d44d6db866a2acf9f9baf2a3e01fe8138808c3d401248844387048c0ed7d.exe	96
PID 2228 wrote to memory of 632	2228	1573d44d6db866a2acf9f9baf2a3e01fe8138808c3d401248844387048c0ed7d.exe	97
PID 2228 wrote to memory of 632	2228	1573d44d6db866a2acf9f9baf2a3e01fe8138808c3d401248844387048c0ed7d.exe	97
PID 2228 wrote to memory of 1900	2228	1573d44d6db866a2acf9f9baf2a3e01fe8138808c3d401248844387048c0ed7d.exe	98
PID 2228 wrote to memory of 1900	2228	1573d44d6db866a2acf9f9baf2a3e01fe8138808c3d401248844387048c0ed7d.exe	98
PID 2228 wrote to memory of 2224	2228	1573d44d6db866a2acf9f9baf2a3e01fe8138808c3d401248844387048c0ed7d.exe	99
PID 2228 wrote to memory of 2224	2228	1573d44d6db866a2acf9f9baf2a3e01fe8138808c3d401248844387048c0ed7d.exe	99
PID 2228 wrote to memory of 4452	2228	1573d44d6db866a2acf9f9baf2a3e01fe8138808c3d401248844387048c0ed7d.exe	100
PID 2228 wrote to memory of 4452	2228	1573d44d6db866a2acf9f9baf2a3e01fe8138808c3d401248844387048c0ed7d.exe	100
PID 2228 wrote to memory of 4928	2228	1573d44d6db866a2acf9f9baf2a3e01fe8138808c3d401248844387048c0ed7d.exe	101
PID 2228 wrote to memory of 4928	2228	1573d44d6db866a2acf9f9baf2a3e01fe8138808c3d401248844387048c0ed7d.exe	101
PID 2228 wrote to memory of 2676	2228	1573d44d6db866a2acf9f9baf2a3e01fe8138808c3d401248844387048c0ed7d.exe	102
PID 2228 wrote to memory of 2676	2228	1573d44d6db866a2acf9f9baf2a3e01fe8138808c3d401248844387048c0ed7d.exe	102
PID 2228 wrote to memory of 1596	2228	1573d44d6db866a2acf9f9baf2a3e01fe8138808c3d401248844387048c0ed7d.exe	103
PID 2228 wrote to memory of 1596	2228	1573d44d6db866a2acf9f9baf2a3e01fe8138808c3d401248844387048c0ed7d.exe	103
PID 2228 wrote to memory of 3140	2228	1573d44d6db866a2acf9f9baf2a3e01fe8138808c3d401248844387048c0ed7d.exe	104
PID 2228 wrote to memory of 3140	2228	1573d44d6db866a2acf9f9baf2a3e01fe8138808c3d401248844387048c0ed7d.exe	104
PID 2228 wrote to memory of 560	2228	1573d44d6db866a2acf9f9baf2a3e01fe8138808c3d401248844387048c0ed7d.exe	105
PID 2228 wrote to memory of 560	2228	1573d44d6db866a2acf9f9baf2a3e01fe8138808c3d401248844387048c0ed7d.exe	105
PID 2228 wrote to memory of 3992	2228	1573d44d6db866a2acf9f9baf2a3e01fe8138808c3d401248844387048c0ed7d.exe	106
PID 2228 wrote to memory of 3992	2228	1573d44d6db866a2acf9f9baf2a3e01fe8138808c3d401248844387048c0ed7d.exe	106
PID 2228 wrote to memory of 4160	2228	1573d44d6db866a2acf9f9baf2a3e01fe8138808c3d401248844387048c0ed7d.exe	107
PID 2228 wrote to memory of 4160	2228	1573d44d6db866a2acf9f9baf2a3e01fe8138808c3d401248844387048c0ed7d.exe	107
PID 2228 wrote to memory of 3120	2228	1573d44d6db866a2acf9f9baf2a3e01fe8138808c3d401248844387048c0ed7d.exe	108
PID 2228 wrote to memory of 3120	2228	1573d44d6db866a2acf9f9baf2a3e01fe8138808c3d401248844387048c0ed7d.exe	108
PID 2228 wrote to memory of 336	2228	1573d44d6db866a2acf9f9baf2a3e01fe8138808c3d401248844387048c0ed7d.exe	109
PID 2228 wrote to memory of 336	2228	1573d44d6db866a2acf9f9baf2a3e01fe8138808c3d401248844387048c0ed7d.exe	109
PID 2228 wrote to memory of 3500	2228	1573d44d6db866a2acf9f9baf2a3e01fe8138808c3d401248844387048c0ed7d.exe	110
PID 2228 wrote to memory of 3500	2228	1573d44d6db866a2acf9f9baf2a3e01fe8138808c3d401248844387048c0ed7d.exe	110
PID 2228 wrote to memory of 4256	2228	1573d44d6db866a2acf9f9baf2a3e01fe8138808c3d401248844387048c0ed7d.exe	111
PID 2228 wrote to memory of 4256	2228	1573d44d6db866a2acf9f9baf2a3e01fe8138808c3d401248844387048c0ed7d.exe	111
PID 2228 wrote to memory of 4288	2228	1573d44d6db866a2acf9f9baf2a3e01fe8138808c3d401248844387048c0ed7d.exe	112
PID 2228 wrote to memory of 4288	2228	1573d44d6db866a2acf9f9baf2a3e01fe8138808c3d401248844387048c0ed7d.exe	112
PID 2228 wrote to memory of 5016	2228	1573d44d6db866a2acf9f9baf2a3e01fe8138808c3d401248844387048c0ed7d.exe	113
PID 2228 wrote to memory of 5016	2228	1573d44d6db866a2acf9f9baf2a3e01fe8138808c3d401248844387048c0ed7d.exe	113
PID 2228 wrote to memory of 4744	2228	1573d44d6db866a2acf9f9baf2a3e01fe8138808c3d401248844387048c0ed7d.exe	114
PID 2228 wrote to memory of 4744	2228	1573d44d6db866a2acf9f9baf2a3e01fe8138808c3d401248844387048c0ed7d.exe	114
PID 2228 wrote to memory of 2196	2228	1573d44d6db866a2acf9f9baf2a3e01fe8138808c3d401248844387048c0ed7d.exe	115
PID 2228 wrote to memory of 2196	2228	1573d44d6db866a2acf9f9baf2a3e01fe8138808c3d401248844387048c0ed7d.exe	115
PID 2228 wrote to memory of 4596	2228	1573d44d6db866a2acf9f9baf2a3e01fe8138808c3d401248844387048c0ed7d.exe	116
PID 2228 wrote to memory of 4596	2228	1573d44d6db866a2acf9f9baf2a3e01fe8138808c3d401248844387048c0ed7d.exe	116

C:\Users\Admin\AppData\Local\Temp\1573d44d6db866a2acf9f9baf2a3e01fe8138808c3d401248844387048c0ed7d.exe
"C:\Users\Admin\AppData\Local\Temp\1573d44d6db866a2acf9f9baf2a3e01fe8138808c3d401248844387048c0ed7d.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2228
- C:\Windows\System\OsTxUnr.exe
  C:\Windows\System\OsTxUnr.exe
  2⤵
  - Executes dropped EXE
  PID:1220
- C:\Windows\System\XuzpvSr.exe
  C:\Windows\System\XuzpvSr.exe
  2⤵
  - Executes dropped EXE
  PID:1932
- C:\Windows\System\HTFFCYZ.exe
  C:\Windows\System\HTFFCYZ.exe
  2⤵
  - Executes dropped EXE
  PID:2324
- C:\Windows\System\scMILik.exe
  C:\Windows\System\scMILik.exe
  2⤵
  - Executes dropped EXE
  PID:2848
- C:\Windows\System\wZjUvWD.exe
  C:\Windows\System\wZjUvWD.exe
  2⤵
  - Executes dropped EXE
  PID:2732
- C:\Windows\System\aUvEdzp.exe
  C:\Windows\System\aUvEdzp.exe
  2⤵
  - Executes dropped EXE
  PID:4532
- C:\Windows\System\vcrgWwI.exe
  C:\Windows\System\vcrgWwI.exe
  2⤵
  - Executes dropped EXE
  PID:3832
- C:\Windows\System\PrRwtmi.exe
  C:\Windows\System\PrRwtmi.exe
  2⤵
  - Executes dropped EXE
  PID:1868
- C:\Windows\System\PLQQbxI.exe
  C:\Windows\System\PLQQbxI.exe
  2⤵
  - Executes dropped EXE
  PID:4492
- C:\Windows\System\YYsFUoH.exe
  C:\Windows\System\YYsFUoH.exe
  2⤵
  - Executes dropped EXE
  PID:8
- C:\Windows\System\afjzzvV.exe
  C:\Windows\System\afjzzvV.exe
  2⤵
  - Executes dropped EXE
  PID:976
- C:\Windows\System\RMAYbeB.exe
  C:\Windows\System\RMAYbeB.exe
  2⤵
  - Executes dropped EXE
  PID:1268
- C:\Windows\System\oCgVwGI.exe
  C:\Windows\System\oCgVwGI.exe
  2⤵
  - Executes dropped EXE
  PID:632
- C:\Windows\System\JgCqZgc.exe
  C:\Windows\System\JgCqZgc.exe
  2⤵
  - Executes dropped EXE
  PID:1900
- C:\Windows\System\AikiAki.exe
  C:\Windows\System\AikiAki.exe
  2⤵
  - Executes dropped EXE
  PID:2224
- C:\Windows\System\gFWJdgA.exe
  C:\Windows\System\gFWJdgA.exe
  2⤵
  - Executes dropped EXE
  PID:4452
- C:\Windows\System\TVPagKh.exe
  C:\Windows\System\TVPagKh.exe
  2⤵
  - Executes dropped EXE
  PID:4928
- C:\Windows\System\ydJLmoq.exe
  C:\Windows\System\ydJLmoq.exe
  2⤵
  - Executes dropped EXE
  PID:2676
- C:\Windows\System\LDduXmK.exe
  C:\Windows\System\LDduXmK.exe
  2⤵
  - Executes dropped EXE
  PID:1596
- C:\Windows\System\jnpMDer.exe
  C:\Windows\System\jnpMDer.exe
  2⤵
  - Executes dropped EXE
  PID:3140
- C:\Windows\System\qCrJPSb.exe
  C:\Windows\System\qCrJPSb.exe
  2⤵
  - Executes dropped EXE
  PID:560
- C:\Windows\System\EkJATgB.exe
  C:\Windows\System\EkJATgB.exe
  2⤵
  - Executes dropped EXE
  PID:3992
- C:\Windows\System\SIhewBn.exe
  C:\Windows\System\SIhewBn.exe
  2⤵
  - Executes dropped EXE
  PID:4160
- C:\Windows\System\QbrdBGG.exe
  C:\Windows\System\QbrdBGG.exe
  2⤵
  - Executes dropped EXE
  PID:3120
- C:\Windows\System\zvWtFep.exe
  C:\Windows\System\zvWtFep.exe
  2⤵
  - Executes dropped EXE
  PID:336
- C:\Windows\System\BJEuSdY.exe
  C:\Windows\System\BJEuSdY.exe
  2⤵
  - Executes dropped EXE
  PID:3500
- C:\Windows\System\HIWErdN.exe
  C:\Windows\System\HIWErdN.exe
  2⤵
  - Executes dropped EXE
  PID:4256
- C:\Windows\System\QoVpczz.exe
  C:\Windows\System\QoVpczz.exe
  2⤵
  - Executes dropped EXE
  PID:4288
- C:\Windows\System\zXgWDqS.exe
  C:\Windows\System\zXgWDqS.exe
  2⤵
  - Executes dropped EXE
  PID:5016
- C:\Windows\System\MKkYnvD.exe
  C:\Windows\System\MKkYnvD.exe
  2⤵
  - Executes dropped EXE
  PID:4744
- C:\Windows\System\uVOjdsi.exe
  C:\Windows\System\uVOjdsi.exe
  2⤵
  - Executes dropped EXE
  PID:2196
- C:\Windows\System\RPmKEon.exe
  C:\Windows\System\RPmKEon.exe
  2⤵
  - Executes dropped EXE
  PID:4596
- C:\Windows\System\diDdAdE.exe
  C:\Windows\System\diDdAdE.exe
  2⤵
  - Executes dropped EXE
  PID:1732
- C:\Windows\System\aEehNel.exe
  C:\Windows\System\aEehNel.exe
  2⤵
  - Executes dropped EXE
  PID:3244
- C:\Windows\System\wtUuXHw.exe
  C:\Windows\System\wtUuXHw.exe
  2⤵
  - Executes dropped EXE
  PID:1244
- C:\Windows\System\ToRkjcW.exe
  C:\Windows\System\ToRkjcW.exe
  2⤵
  - Executes dropped EXE
  PID:4072
- C:\Windows\System\eUeTKYD.exe
  C:\Windows\System\eUeTKYD.exe
  2⤵
  - Executes dropped EXE
  PID:2588
- C:\Windows\System\TNUaSLg.exe
  C:\Windows\System\TNUaSLg.exe
  2⤵
  - Executes dropped EXE
  PID:2564
- C:\Windows\System\ybgJQPT.exe
  C:\Windows\System\ybgJQPT.exe
  2⤵
  - Executes dropped EXE
  PID:1608
- C:\Windows\System\wqtaZAp.exe
  C:\Windows\System\wqtaZAp.exe
  2⤵
  - Executes dropped EXE
  PID:1840
- C:\Windows\System\EAEbPpY.exe
  C:\Windows\System\EAEbPpY.exe
  2⤵
  - Executes dropped EXE
  PID:1764
- C:\Windows\System\LzKUBox.exe
  C:\Windows\System\LzKUBox.exe
  2⤵
  - Executes dropped EXE
  PID:4588
- C:\Windows\System\AscykuL.exe
  C:\Windows\System\AscykuL.exe
  2⤵
  - Executes dropped EXE
  PID:1500
- C:\Windows\System\yhoekjx.exe
  C:\Windows\System\yhoekjx.exe
  2⤵
  - Executes dropped EXE
  PID:980
- C:\Windows\System\wlokOtg.exe
  C:\Windows\System\wlokOtg.exe
  2⤵
  - Executes dropped EXE
  PID:3416
- C:\Windows\System\rpfMJDe.exe
  C:\Windows\System\rpfMJDe.exe
  2⤵
  - Executes dropped EXE
  PID:2096
- C:\Windows\System\GxLIDSG.exe
  C:\Windows\System\GxLIDSG.exe
  2⤵
  - Executes dropped EXE
  PID:3172
- C:\Windows\System\pZtzrHb.exe
  C:\Windows\System\pZtzrHb.exe
  2⤵
  - Executes dropped EXE
  PID:2308
- C:\Windows\System\OwVtLSG.exe
  C:\Windows\System\OwVtLSG.exe
  2⤵
  - Executes dropped EXE
  PID:4420
- C:\Windows\System\YNUeLue.exe
  C:\Windows\System\YNUeLue.exe
  2⤵
  - Executes dropped EXE
  PID:4644
- C:\Windows\System\JkuDfHY.exe
  C:\Windows\System\JkuDfHY.exe
  2⤵
  - Executes dropped EXE
  PID:4304
- C:\Windows\System\nEmkumu.exe
  C:\Windows\System\nEmkumu.exe
  2⤵
  - Executes dropped EXE
  PID:3584
- C:\Windows\System\etehcnT.exe
  C:\Windows\System\etehcnT.exe
  2⤵
  - Executes dropped EXE
  PID:3024
- C:\Windows\System\YtRVoqB.exe
  C:\Windows\System\YtRVoqB.exe
  2⤵
  - Executes dropped EXE
  PID:3200
- C:\Windows\System\cVdNONT.exe
  C:\Windows\System\cVdNONT.exe
  2⤵
  - Executes dropped EXE
  PID:2668
- C:\Windows\System\ItzPgJC.exe
  C:\Windows\System\ItzPgJC.exe
  2⤵
  - Executes dropped EXE
  PID:2044
- C:\Windows\System\fdznCkg.exe
  C:\Windows\System\fdznCkg.exe
  2⤵
  - Executes dropped EXE
  PID:3240
- C:\Windows\System\FDhVQqF.exe
  C:\Windows\System\FDhVQqF.exe
  2⤵
  - Executes dropped EXE
  PID:3464
- C:\Windows\System\DkujYaL.exe
  C:\Windows\System\DkujYaL.exe
  2⤵
  - Executes dropped EXE
  PID:1180
- C:\Windows\System\zxSPOPG.exe
  C:\Windows\System\zxSPOPG.exe
  2⤵
  - Executes dropped EXE
  PID:1792
- C:\Windows\System\KFkPneM.exe
  C:\Windows\System\KFkPneM.exe
  2⤵
  - Executes dropped EXE
  PID:1360
- C:\Windows\System\OiBbeTW.exe
  C:\Windows\System\OiBbeTW.exe
  2⤵
  - Executes dropped EXE
  PID:4260
- C:\Windows\System\IAYNcmr.exe
  C:\Windows\System\IAYNcmr.exe
  2⤵
  - Executes dropped EXE
  PID:4720
- C:\Windows\System\WTQJbeu.exe
  C:\Windows\System\WTQJbeu.exe
  2⤵
  - Executes dropped EXE
  PID:2672
- C:\Windows\System\RGlEsNO.exe
  C:\Windows\System\RGlEsNO.exe
  2⤵
  PID:4580
- C:\Windows\System\VkTsUmu.exe
  C:\Windows\System\VkTsUmu.exe
  2⤵
  PID:5040
- C:\Windows\System\VBBelgc.exe
  C:\Windows\System\VBBelgc.exe
  2⤵
  PID:4248
- C:\Windows\System\eelXCTx.exe
  C:\Windows\System\eelXCTx.exe
  2⤵
  PID:2392
- C:\Windows\System\JtqZeAW.exe
  C:\Windows\System\JtqZeAW.exe
  2⤵
  PID:4908
- C:\Windows\System\EYoiSOx.exe
  C:\Windows\System\EYoiSOx.exe
  2⤵
  PID:3264
- C:\Windows\System\YGidUDf.exe
  C:\Windows\System\YGidUDf.exe
  2⤵
  PID:3652
- C:\Windows\System\pOduWHW.exe
  C:\Windows\System\pOduWHW.exe
  2⤵
  PID:3736
- C:\Windows\System\jEbarvi.exe
  C:\Windows\System\jEbarvi.exe
  2⤵
  PID:4896
- C:\Windows\System\BKbvFTf.exe
  C:\Windows\System\BKbvFTf.exe
  2⤵
  PID:2944
- C:\Windows\System\fuSrFbc.exe
  C:\Windows\System\fuSrFbc.exe
  2⤵
  PID:3548
- C:\Windows\System\DaiDKRx.exe
  C:\Windows\System\DaiDKRx.exe
  2⤵
  PID:988
- C:\Windows\System\fvhJNjd.exe
  C:\Windows\System\fvhJNjd.exe
  2⤵
  PID:4888
- C:\Windows\System\blEipif.exe
  C:\Windows\System\blEipif.exe
  2⤵
  PID:4004
- C:\Windows\System\fXbYEVq.exe
  C:\Windows\System\fXbYEVq.exe
  2⤵
  PID:3336
- C:\Windows\System\nUaBXna.exe
  C:\Windows\System\nUaBXna.exe
  2⤵
  PID:2892
- C:\Windows\System\gfBVkbb.exe
  C:\Windows\System\gfBVkbb.exe
  2⤵
  PID:516
- C:\Windows\System\kqDrXMX.exe
  C:\Windows\System\kqDrXMX.exe
  2⤵
  PID:3956
- C:\Windows\System\PZalDIQ.exe
  C:\Windows\System\PZalDIQ.exe
  2⤵
  PID:1224
- C:\Windows\System\VeItMLt.exe
  C:\Windows\System\VeItMLt.exe
  2⤵
  PID:1896
- C:\Windows\System\GcYxvnZ.exe
  C:\Windows\System\GcYxvnZ.exe
  2⤵
  PID:4332
- C:\Windows\System\kqGyRJQ.exe
  C:\Windows\System\kqGyRJQ.exe
  2⤵
  PID:4876
- C:\Windows\System\ldREUIV.exe
  C:\Windows\System\ldREUIV.exe
  2⤵
  PID:4884
- C:\Windows\System\LdJDVfL.exe
  C:\Windows\System\LdJDVfL.exe
  2⤵
  PID:2240
- C:\Windows\System\eXijKIL.exe
  C:\Windows\System\eXijKIL.exe
  2⤵
  PID:1216
- C:\Windows\System\MPGOyhe.exe
  C:\Windows\System\MPGOyhe.exe
  2⤵
  PID:3168
- C:\Windows\System\qPEKlPx.exe
  C:\Windows\System\qPEKlPx.exe
  2⤵
  PID:1064
- C:\Windows\System\BhwZkqb.exe
  C:\Windows\System\BhwZkqb.exe
  2⤵
  PID:2444
- C:\Windows\System\mrHyeaJ.exe
  C:\Windows\System\mrHyeaJ.exe
  2⤵
  PID:2908
- C:\Windows\System\cOrpIkp.exe
  C:\Windows\System\cOrpIkp.exe
  2⤵
  PID:4312
- C:\Windows\System\DFZRGJB.exe
  C:\Windows\System\DFZRGJB.exe
  2⤵
  PID:4104
- C:\Windows\System\QcfCAOw.exe
  C:\Windows\System\QcfCAOw.exe
  2⤵
  PID:1920
- C:\Windows\System\OUmKTLK.exe
  C:\Windows\System\OUmKTLK.exe
  2⤵
  PID:2056
- C:\Windows\System\qyBXuYs.exe
  C:\Windows\System\qyBXuYs.exe
  2⤵
  PID:1580
- C:\Windows\System\gvAZKUf.exe
  C:\Windows\System\gvAZKUf.exe
  2⤵
  PID:704
- C:\Windows\System\TNItMdm.exe
  C:\Windows\System\TNItMdm.exe
  2⤵
  PID:4584
- C:\Windows\System\nXuEitc.exe
  C:\Windows\System\nXuEitc.exe
  2⤵
  PID:4760
- C:\Windows\System\KYoeaeI.exe
  C:\Windows\System\KYoeaeI.exe
  2⤵
  PID:4528
- C:\Windows\System\GiPKvEL.exe
  C:\Windows\System\GiPKvEL.exe
  2⤵
  PID:3260
- C:\Windows\System\wZADSDR.exe
  C:\Windows\System\wZADSDR.exe
  2⤵
  PID:636
- C:\Windows\System\nGHosdz.exe
  C:\Windows\System\nGHosdz.exe
  2⤵
  PID:4936
- C:\Windows\System\RbKTACi.exe
  C:\Windows\System\RbKTACi.exe
  2⤵
  PID:4624
- C:\Windows\System\NpkHPeb.exe
  C:\Windows\System\NpkHPeb.exe
  2⤵
  PID:4900
- C:\Windows\System\EMXVWEq.exe
  C:\Windows\System\EMXVWEq.exe
  2⤵
  PID:3008
- C:\Windows\System\GvsCCUG.exe
  C:\Windows\System\GvsCCUG.exe
  2⤵
  PID:1444
- C:\Windows\System\YbRQFvO.exe
  C:\Windows\System\YbRQFvO.exe
  2⤵
  PID:1536
- C:\Windows\System\qeEsGAt.exe
  C:\Windows\System\qeEsGAt.exe
  2⤵
  PID:2480
- C:\Windows\System\mWSoSiu.exe
  C:\Windows\System\mWSoSiu.exe
  2⤵
  PID:4992
- C:\Windows\System\gdZuujP.exe
  C:\Windows\System\gdZuujP.exe
  2⤵
  PID:1876
- C:\Windows\System\VKlMbnu.exe
  C:\Windows\System\VKlMbnu.exe
  2⤵
  PID:552
- C:\Windows\System\nLuADCi.exe
  C:\Windows\System\nLuADCi.exe
  2⤵
  PID:1028
- C:\Windows\System\qrvCGtL.exe
  C:\Windows\System\qrvCGtL.exe
  2⤵
  PID:5124
- C:\Windows\System\auYqejY.exe
  C:\Windows\System\auYqejY.exe
  2⤵
  PID:5148
- C:\Windows\System\ifAtrQL.exe
  C:\Windows\System\ifAtrQL.exe
  2⤵
  PID:5164
- C:\Windows\System\XEFieKK.exe
  C:\Windows\System\XEFieKK.exe
  2⤵
  PID:5188
- C:\Windows\System\BLxQEHX.exe
  C:\Windows\System\BLxQEHX.exe
  2⤵
  PID:5228
- C:\Windows\System\MCjlYxi.exe
  C:\Windows\System\MCjlYxi.exe
  2⤵
  PID:5248
- C:\Windows\System\YzUdSRN.exe
  C:\Windows\System\YzUdSRN.exe
  2⤵
  PID:5276
- C:\Windows\System\SFayYjd.exe
  C:\Windows\System\SFayYjd.exe
  2⤵
  PID:5304
- C:\Windows\System\UoSLKoe.exe
  C:\Windows\System\UoSLKoe.exe
  2⤵
  PID:5332
- C:\Windows\System\suOGawz.exe
  C:\Windows\System\suOGawz.exe
  2⤵
  PID:5368
- C:\Windows\System\egwAUHZ.exe
  C:\Windows\System\egwAUHZ.exe
  2⤵
  PID:5396
- C:\Windows\System\yUxwrGc.exe
  C:\Windows\System\yUxwrGc.exe
  2⤵
  PID:5424
- C:\Windows\System\pureRvq.exe
  C:\Windows\System\pureRvq.exe
  2⤵
  PID:5456
- C:\Windows\System\zbuXizf.exe
  C:\Windows\System\zbuXizf.exe
  2⤵
  PID:5472
- C:\Windows\System\LqgpFcG.exe
  C:\Windows\System\LqgpFcG.exe
  2⤵
  PID:5508
- C:\Windows\System\EbUskHP.exe
  C:\Windows\System\EbUskHP.exe
  2⤵
  PID:5528
- C:\Windows\System\QvmGKhA.exe
  C:\Windows\System\QvmGKhA.exe
  2⤵
  PID:5568
- C:\Windows\System\zeTrMYY.exe
  C:\Windows\System\zeTrMYY.exe
  2⤵
  PID:5596
- C:\Windows\System\BmGcYVY.exe
  C:\Windows\System\BmGcYVY.exe
  2⤵
  PID:5624
- C:\Windows\System\HGOFMzw.exe
  C:\Windows\System\HGOFMzw.exe
  2⤵
  PID:5648
- C:\Windows\System\BRfROze.exe
  C:\Windows\System\BRfROze.exe
  2⤵
  PID:5680
- C:\Windows\System\NbObwiG.exe
  C:\Windows\System\NbObwiG.exe
  2⤵
  PID:5704
- C:\Windows\System\skLXVYv.exe
  C:\Windows\System\skLXVYv.exe
  2⤵
  PID:5728
- C:\Windows\System\uJnCyWq.exe
  C:\Windows\System\uJnCyWq.exe
  2⤵
  PID:5752
- C:\Windows\System\NiVRRIz.exe
  C:\Windows\System\NiVRRIz.exe
  2⤵
  PID:5780
- C:\Windows\System\TxUTEjS.exe
  C:\Windows\System\TxUTEjS.exe
  2⤵
  PID:5820
- C:\Windows\System\IcCWyAg.exe
  C:\Windows\System\IcCWyAg.exe
  2⤵
  PID:5848
- C:\Windows\System\tkWZKjA.exe
  C:\Windows\System\tkWZKjA.exe
  2⤵
  PID:5876
- C:\Windows\System\AbYrAVo.exe
  C:\Windows\System\AbYrAVo.exe
  2⤵
  PID:5896
- C:\Windows\System\fWyfWsS.exe
  C:\Windows\System\fWyfWsS.exe
  2⤵
  PID:5920
- C:\Windows\System\rXrkmCr.exe
  C:\Windows\System\rXrkmCr.exe
  2⤵
  PID:5936
- C:\Windows\System\VcSZXJm.exe
  C:\Windows\System\VcSZXJm.exe
  2⤵
  PID:5964
- C:\Windows\System\mnntaeF.exe
  C:\Windows\System\mnntaeF.exe
  2⤵
  PID:5992
- C:\Windows\System\zfTfLmE.exe
  C:\Windows\System\zfTfLmE.exe
  2⤵
  PID:6012
- C:\Windows\System\zLToLnK.exe
  C:\Windows\System\zLToLnK.exe
  2⤵
  PID:6040
- C:\Windows\System\PheRdku.exe
  C:\Windows\System\PheRdku.exe
  2⤵
  PID:6068
- C:\Windows\System\aPOYsKU.exe
  C:\Windows\System\aPOYsKU.exe
  2⤵
  PID:6092
- C:\Windows\System\LeetZbK.exe
  C:\Windows\System\LeetZbK.exe
  2⤵
  PID:6116
- C:\Windows\System\bBnHOPz.exe
  C:\Windows\System\bBnHOPz.exe
  2⤵
  PID:2412
- C:\Windows\System\hLteKTu.exe
  C:\Windows\System\hLteKTu.exe
  2⤵
  PID:5204
- C:\Windows\System\FlbJkxA.exe
  C:\Windows\System\FlbJkxA.exe
  2⤵
  PID:5244
- C:\Windows\System\HkJsFGT.exe
  C:\Windows\System\HkJsFGT.exe
  2⤵
  PID:5348
- C:\Windows\System\UJGZSDJ.exe
  C:\Windows\System\UJGZSDJ.exe
  2⤵
  PID:5408
- C:\Windows\System\nxImkaZ.exe
  C:\Windows\System\nxImkaZ.exe
  2⤵
  PID:5468
- C:\Windows\System\MtroHGG.exe
  C:\Windows\System\MtroHGG.exe
  2⤵
  PID:5584
- C:\Windows\System\lYpmnGe.exe
  C:\Windows\System\lYpmnGe.exe
  2⤵
  PID:5640
- C:\Windows\System\vINXeAr.exe
  C:\Windows\System\vINXeAr.exe
  2⤵
  PID:5688
- C:\Windows\System\adqGYNa.exe
  C:\Windows\System\adqGYNa.exe
  2⤵
  PID:5764
- C:\Windows\System\uyzFLaQ.exe
  C:\Windows\System\uyzFLaQ.exe
  2⤵
  PID:5836
- C:\Windows\System\xmxLmpc.exe
  C:\Windows\System\xmxLmpc.exe
  2⤵
  PID:5908
- C:\Windows\System\VRbFmdq.exe
  C:\Windows\System\VRbFmdq.exe
  2⤵
  PID:5980
- C:\Windows\System\YLKKzuq.exe
  C:\Windows\System\YLKKzuq.exe
  2⤵
  PID:6004
- C:\Windows\System\GxFNmkB.exe
  C:\Windows\System\GxFNmkB.exe
  2⤵
  PID:6108
- C:\Windows\System\ZumRZuk.exe
  C:\Windows\System\ZumRZuk.exe
  2⤵
  PID:5296
- C:\Windows\System\kcfMFuY.exe
  C:\Windows\System\kcfMFuY.exe
  2⤵
  PID:5388
- C:\Windows\System\ovbbuZo.exe
  C:\Windows\System\ovbbuZo.exe
  2⤵
  PID:5516
- C:\Windows\System\JKJzKVJ.exe
  C:\Windows\System\JKJzKVJ.exe
  2⤵
  PID:5620
- C:\Windows\System\spafRNr.exe
  C:\Windows\System\spafRNr.exe
  2⤵
  PID:5716
- C:\Windows\System\tAnvnYk.exe
  C:\Windows\System\tAnvnYk.exe
  2⤵
  PID:5868
- C:\Windows\System\eWhiSHq.exe
  C:\Windows\System\eWhiSHq.exe
  2⤵
  PID:6056
- C:\Windows\System\XnNLlLS.exe
  C:\Windows\System\XnNLlLS.exe
  2⤵
  PID:6136
- C:\Windows\System\BcwqyBl.exe
  C:\Windows\System\BcwqyBl.exe
  2⤵
  PID:5748
- C:\Windows\System\KkoBijO.exe
  C:\Windows\System\KkoBijO.exe
  2⤵
  PID:5928
- C:\Windows\System\zOQHCkY.exe
  C:\Windows\System\zOQHCkY.exe
  2⤵
  PID:5592
- C:\Windows\System\lzYFPLa.exe
  C:\Windows\System\lzYFPLa.exe
  2⤵
  PID:6152
- C:\Windows\System\gkckrxN.exe
  C:\Windows\System\gkckrxN.exe
  2⤵
  PID:6176
- C:\Windows\System\eHXIUzI.exe
  C:\Windows\System\eHXIUzI.exe
  2⤵
  PID:6192
- C:\Windows\System\phWTbZA.exe
  C:\Windows\System\phWTbZA.exe
  2⤵
  PID:6216
- C:\Windows\System\TlgnLUc.exe
  C:\Windows\System\TlgnLUc.exe
  2⤵
  PID:6244
- C:\Windows\System\RSPrDeD.exe
  C:\Windows\System\RSPrDeD.exe
  2⤵
  PID:6276
- C:\Windows\System\BcFbnWx.exe
  C:\Windows\System\BcFbnWx.exe
  2⤵
  PID:6304
- C:\Windows\System\SQIKumg.exe
  C:\Windows\System\SQIKumg.exe
  2⤵
  PID:6320
- C:\Windows\System\wdRHbWx.exe
  C:\Windows\System\wdRHbWx.exe
  2⤵
  PID:6348
- C:\Windows\System\TjnvYEN.exe
  C:\Windows\System\TjnvYEN.exe
  2⤵
  PID:6376
- C:\Windows\System\tYTIjkW.exe
  C:\Windows\System\tYTIjkW.exe
  2⤵
  PID:6408
- C:\Windows\System\gfCzvQQ.exe
  C:\Windows\System\gfCzvQQ.exe
  2⤵
  PID:6444
- C:\Windows\System\ihAUxPW.exe
  C:\Windows\System\ihAUxPW.exe
  2⤵
  PID:6468
- C:\Windows\System\kHQxIiO.exe
  C:\Windows\System\kHQxIiO.exe
  2⤵
  PID:6500
- C:\Windows\System\Xcgwpal.exe
  C:\Windows\System\Xcgwpal.exe
  2⤵
  PID:6524
- C:\Windows\System\MdlDRlK.exe
  C:\Windows\System\MdlDRlK.exe
  2⤵
  PID:6556
- C:\Windows\System\MybUrbC.exe
  C:\Windows\System\MybUrbC.exe
  2⤵
  PID:6588
- C:\Windows\System\ioDrBfb.exe
  C:\Windows\System\ioDrBfb.exe
  2⤵
  PID:6620
- C:\Windows\System\NfHtggp.exe
  C:\Windows\System\NfHtggp.exe
  2⤵
  PID:6636
- C:\Windows\System\qdhdsDH.exe
  C:\Windows\System\qdhdsDH.exe
  2⤵
  PID:6672
- C:\Windows\System\FNXHaCW.exe
  C:\Windows\System\FNXHaCW.exe
  2⤵
  PID:6696
- C:\Windows\System\DlewzOU.exe
  C:\Windows\System\DlewzOU.exe
  2⤵
  PID:6724
- C:\Windows\System\TzKhgUi.exe
  C:\Windows\System\TzKhgUi.exe
  2⤵
  PID:6744
- C:\Windows\System\xSniqwl.exe
  C:\Windows\System\xSniqwl.exe
  2⤵
  PID:6772
- C:\Windows\System\KdrQqcD.exe
  C:\Windows\System\KdrQqcD.exe
  2⤵
  PID:6836
- C:\Windows\System\xTJevRU.exe
  C:\Windows\System\xTJevRU.exe
  2⤵
  PID:6856
- C:\Windows\System\ECgZQnj.exe
  C:\Windows\System\ECgZQnj.exe
  2⤵
  PID:6880
- C:\Windows\System\WHxhcGM.exe
  C:\Windows\System\WHxhcGM.exe
  2⤵
  PID:6912
- C:\Windows\System\COlzxVG.exe
  C:\Windows\System\COlzxVG.exe
  2⤵
  PID:6944
- C:\Windows\System\itkpcXk.exe
  C:\Windows\System\itkpcXk.exe
  2⤵
  PID:6968
- C:\Windows\System\WVxHpnE.exe
  C:\Windows\System\WVxHpnE.exe
  2⤵
  PID:7008
- C:\Windows\System\DQjPNks.exe
  C:\Windows\System\DQjPNks.exe
  2⤵
  PID:7028
- C:\Windows\System\jjOJRpr.exe
  C:\Windows\System\jjOJRpr.exe
  2⤵
  PID:7052
- C:\Windows\System\hTUyGQP.exe
  C:\Windows\System\hTUyGQP.exe
  2⤵
  PID:7092
- C:\Windows\System\hKQJLex.exe
  C:\Windows\System\hKQJLex.exe
  2⤵
  PID:7120
- C:\Windows\System\YgaefhB.exe
  C:\Windows\System\YgaefhB.exe
  2⤵
  PID:7148
- C:\Windows\System\zacVnQR.exe
  C:\Windows\System\zacVnQR.exe
  2⤵
  PID:5556
- C:\Windows\System\PsOPkbg.exe
  C:\Windows\System\PsOPkbg.exe
  2⤵
  PID:6172
- C:\Windows\System\kgVaxHp.exe
  C:\Windows\System\kgVaxHp.exe
  2⤵
  PID:6296
- C:\Windows\System\mLMDKlz.exe
  C:\Windows\System\mLMDKlz.exe
  2⤵
  PID:6316
- C:\Windows\System\NMLYCZU.exe
  C:\Windows\System\NMLYCZU.exe
  2⤵
  PID:6340
- C:\Windows\System\QSIsWoS.exe
  C:\Windows\System\QSIsWoS.exe
  2⤵
  PID:6452
- C:\Windows\System\ifWleqs.exe
  C:\Windows\System\ifWleqs.exe
  2⤵
  PID:6496
- C:\Windows\System\SOzOyos.exe
  C:\Windows\System\SOzOyos.exe
  2⤵
  PID:6584
- C:\Windows\System\WDWbJdY.exe
  C:\Windows\System\WDWbJdY.exe
  2⤵
  PID:6664
- C:\Windows\System\IDlCcxw.exe
  C:\Windows\System\IDlCcxw.exe
  2⤵
  PID:6740
- C:\Windows\System\xzQQGaz.exe
  C:\Windows\System\xzQQGaz.exe
  2⤵
  PID:6820
- C:\Windows\System\EcKYRYd.exe
  C:\Windows\System\EcKYRYd.exe
  2⤵
  PID:6864
- C:\Windows\System\oUSluxd.exe
  C:\Windows\System\oUSluxd.exe
  2⤵
  PID:6956
- C:\Windows\System\NCOANUR.exe
  C:\Windows\System\NCOANUR.exe
  2⤵
  PID:6984
- C:\Windows\System\HJiwEhK.exe
  C:\Windows\System\HJiwEhK.exe
  2⤵
  PID:7048
- C:\Windows\System\vwuWkNe.exe
  C:\Windows\System\vwuWkNe.exe
  2⤵
  PID:7104
- C:\Windows\System\mNdtuQu.exe
  C:\Windows\System\mNdtuQu.exe
  2⤵
  PID:6188
- C:\Windows\System\WSlOson.exe
  C:\Windows\System\WSlOson.exe
  2⤵
  PID:6360
- C:\Windows\System\ENDOiqG.exe
  C:\Windows\System\ENDOiqG.exe
  2⤵
  PID:6596
- C:\Windows\System\saLggmN.exe
  C:\Windows\System\saLggmN.exe
  2⤵
  PID:6688
- C:\Windows\System\eSzCwMy.exe
  C:\Windows\System\eSzCwMy.exe
  2⤵
  PID:6800
- C:\Windows\System\wYOJvop.exe
  C:\Windows\System\wYOJvop.exe
  2⤵
  PID:6892
- C:\Windows\System\AjdCqFc.exe
  C:\Windows\System\AjdCqFc.exe
  2⤵
  PID:7044
- C:\Windows\System\VkKlsCK.exe
  C:\Windows\System\VkKlsCK.exe
  2⤵
  PID:6292
- C:\Windows\System\GBPzTTW.exe
  C:\Windows\System\GBPzTTW.exe
  2⤵
  PID:6480
- C:\Windows\System\BBgVcEi.exe
  C:\Windows\System\BBgVcEi.exe
  2⤵
  PID:6924
- C:\Windows\System\kmBuYFD.exe
  C:\Windows\System\kmBuYFD.exe
  2⤵
  PID:6548
- C:\Windows\System\QGdMExS.exe
  C:\Windows\System\QGdMExS.exe
  2⤵
  PID:7116
- C:\Windows\System\bvlatzn.exe
  C:\Windows\System\bvlatzn.exe
  2⤵
  PID:7192
- C:\Windows\System\fKqQXqG.exe
  C:\Windows\System\fKqQXqG.exe
  2⤵
  PID:7224
- C:\Windows\System\SNbfvmq.exe
  C:\Windows\System\SNbfvmq.exe
  2⤵
  PID:7264
- C:\Windows\System\OtSUKcc.exe
  C:\Windows\System\OtSUKcc.exe
  2⤵
  PID:7288
- C:\Windows\System\ulGTVvS.exe
  C:\Windows\System\ulGTVvS.exe
  2⤵
  PID:7304
- C:\Windows\System\FJXwsct.exe
  C:\Windows\System\FJXwsct.exe
  2⤵
  PID:7348
- C:\Windows\System\KlhnkmN.exe
  C:\Windows\System\KlhnkmN.exe
  2⤵
  PID:7372
- C:\Windows\System\zSAlIYX.exe
  C:\Windows\System\zSAlIYX.exe
  2⤵
  PID:7392
- C:\Windows\System\Alsuxst.exe
  C:\Windows\System\Alsuxst.exe
  2⤵
  PID:7420
- C:\Windows\System\HxhiFAQ.exe
  C:\Windows\System\HxhiFAQ.exe
  2⤵
  PID:7444
- C:\Windows\System\beKMDZi.exe
  C:\Windows\System\beKMDZi.exe
  2⤵
  PID:7476
- C:\Windows\System\sYExpem.exe
  C:\Windows\System\sYExpem.exe
  2⤵
  PID:7504
- C:\Windows\System\otzwZiO.exe
  C:\Windows\System\otzwZiO.exe
  2⤵
  PID:7532
- C:\Windows\System\wtBuoWL.exe
  C:\Windows\System\wtBuoWL.exe
  2⤵
  PID:7564
- C:\Windows\System\cgighGx.exe
  C:\Windows\System\cgighGx.exe
  2⤵
  PID:7584
- C:\Windows\System\lcUZOSV.exe
  C:\Windows\System\lcUZOSV.exe
  2⤵
  PID:7628
- C:\Windows\System\gcouNlO.exe
  C:\Windows\System\gcouNlO.exe
  2⤵
  PID:7656
- C:\Windows\System\uyNsRNe.exe
  C:\Windows\System\uyNsRNe.exe
  2⤵
  PID:7684
- C:\Windows\System\BiZawoc.exe
  C:\Windows\System\BiZawoc.exe
  2⤵
  PID:7712
- C:\Windows\System\vTlMagh.exe
  C:\Windows\System\vTlMagh.exe
  2⤵
  PID:7740
- C:\Windows\System\PhNyVHH.exe
  C:\Windows\System\PhNyVHH.exe
  2⤵
  PID:7756
- C:\Windows\System\oxhgSig.exe
  C:\Windows\System\oxhgSig.exe
  2⤵
  PID:7788
- C:\Windows\System\gDfMbnq.exe
  C:\Windows\System\gDfMbnq.exe
  2⤵
  PID:7808
- C:\Windows\System\OXIcypk.exe
  C:\Windows\System\OXIcypk.exe
  2⤵
  PID:7832
- C:\Windows\System\eTaaQMd.exe
  C:\Windows\System\eTaaQMd.exe
  2⤵
  PID:7860
- C:\Windows\System\figfZeK.exe
  C:\Windows\System\figfZeK.exe
  2⤵
  PID:7892
- C:\Windows\System\PuDvomw.exe
  C:\Windows\System\PuDvomw.exe
  2⤵
  PID:7916
- C:\Windows\System\uZBuUdH.exe
  C:\Windows\System\uZBuUdH.exe
  2⤵
  PID:7948
- C:\Windows\System\ZjYYEIs.exe
  C:\Windows\System\ZjYYEIs.exe
  2⤵
  PID:7980
- C:\Windows\System\MFRLsOA.exe
  C:\Windows\System\MFRLsOA.exe
  2⤵
  PID:8000
- C:\Windows\System\HjRrXLk.exe
  C:\Windows\System\HjRrXLk.exe
  2⤵
  PID:8028
- C:\Windows\System\aknvWjC.exe
  C:\Windows\System\aknvWjC.exe
  2⤵
  PID:8052
- C:\Windows\System\SSJNatP.exe
  C:\Windows\System\SSJNatP.exe
  2⤵
  PID:8072
- C:\Windows\System\NwjDAlO.exe
  C:\Windows\System\NwjDAlO.exe
  2⤵
  PID:8100
- C:\Windows\System\yAGiEpH.exe
  C:\Windows\System\yAGiEpH.exe
  2⤵
  PID:8152
- C:\Windows\System\VpzKyuK.exe
  C:\Windows\System\VpzKyuK.exe
  2⤵
  PID:8172
- C:\Windows\System\dBloQBe.exe
  C:\Windows\System\dBloQBe.exe
  2⤵
  PID:7176
- C:\Windows\System\TwDAZPH.exe
  C:\Windows\System\TwDAZPH.exe
  2⤵
  PID:7272
- C:\Windows\System\CABWDWr.exe
  C:\Windows\System\CABWDWr.exe
  2⤵
  PID:7300
- C:\Windows\System\sZlyBeg.exe
  C:\Windows\System\sZlyBeg.exe
  2⤵
  PID:7380
- C:\Windows\System\cBWDZmF.exe
  C:\Windows\System\cBWDZmF.exe
  2⤵
  PID:7456
- C:\Windows\System\nwWtTII.exe
  C:\Windows\System\nwWtTII.exe
  2⤵
  PID:7512
- C:\Windows\System\cfNZidw.exe
  C:\Windows\System\cfNZidw.exe
  2⤵
  PID:7580
- C:\Windows\System\kXnKGHl.exe
  C:\Windows\System\kXnKGHl.exe
  2⤵
  PID:7668
- C:\Windows\System\MpuomLO.exe
  C:\Windows\System\MpuomLO.exe
  2⤵
  PID:7708
- C:\Windows\System\pRFtqJA.exe
  C:\Windows\System\pRFtqJA.exe
  2⤵
  PID:7732
- C:\Windows\System\RzhrBov.exe
  C:\Windows\System\RzhrBov.exe
  2⤵
  PID:7824
- C:\Windows\System\IvAANqp.exe
  C:\Windows\System\IvAANqp.exe
  2⤵
  PID:7876
- C:\Windows\System\ReVpHkw.exe
  C:\Windows\System\ReVpHkw.exe
  2⤵
  PID:7924
- C:\Windows\System\pbUWORq.exe
  C:\Windows\System\pbUWORq.exe
  2⤵
  PID:8020
- C:\Windows\System\sgeDjSQ.exe
  C:\Windows\System\sgeDjSQ.exe
  2⤵
  PID:8096
- C:\Windows\System\ALWNawA.exe
  C:\Windows\System\ALWNawA.exe
  2⤵
  PID:8164
- C:\Windows\System\ilyzUaC.exe
  C:\Windows\System\ilyzUaC.exe
  2⤵
  PID:7240
- C:\Windows\System\PDdCkbE.exe
  C:\Windows\System\PDdCkbE.exe
  2⤵
  PID:7364
- C:\Windows\System\lfhqqTk.exe
  C:\Windows\System\lfhqqTk.exe
  2⤵
  PID:7524
- C:\Windows\System\hBmeUyu.exe
  C:\Windows\System\hBmeUyu.exe
  2⤵
  PID:7728
- C:\Windows\System\pRqfSqZ.exe
  C:\Windows\System\pRqfSqZ.exe
  2⤵
  PID:7800
- C:\Windows\System\hDcNRLK.exe
  C:\Windows\System\hDcNRLK.exe
  2⤵
  PID:8088
- C:\Windows\System\LYUlGPm.exe
  C:\Windows\System\LYUlGPm.exe
  2⤵
  PID:8144
- C:\Windows\System\qdQfOxX.exe
  C:\Windows\System\qdQfOxX.exe
  2⤵
  PID:7344
- C:\Windows\System\xIbGIBC.exe
  C:\Windows\System\xIbGIBC.exe
  2⤵
  PID:7468
- C:\Windows\System\lJQFCzF.exe
  C:\Windows\System\lJQFCzF.exe
  2⤵
  PID:7908
- C:\Windows\System\AEdqKas.exe
  C:\Windows\System\AEdqKas.exe
  2⤵
  PID:7296
- C:\Windows\System\OasHxpE.exe
  C:\Windows\System\OasHxpE.exe
  2⤵
  PID:8240
- C:\Windows\System\QxXcYXX.exe
  C:\Windows\System\QxXcYXX.exe
  2⤵
  PID:8256
- C:\Windows\System\vVHqTiz.exe
  C:\Windows\System\vVHqTiz.exe
  2⤵
  PID:8280
- C:\Windows\System\RbWqGxf.exe
  C:\Windows\System\RbWqGxf.exe
  2⤵
  PID:8300
- C:\Windows\System\CQHAGni.exe
  C:\Windows\System\CQHAGni.exe
  2⤵
  PID:8344
- C:\Windows\System\bBKVaVL.exe
  C:\Windows\System\bBKVaVL.exe
  2⤵
  PID:8376
- C:\Windows\System\wbAhJbS.exe
  C:\Windows\System\wbAhJbS.exe
  2⤵
  PID:8400
- C:\Windows\System\BLGwIQt.exe
  C:\Windows\System\BLGwIQt.exe
  2⤵
  PID:8440
- C:\Windows\System\liCFgEO.exe
  C:\Windows\System\liCFgEO.exe
  2⤵
  PID:8456
- C:\Windows\System\GEEIBzA.exe
  C:\Windows\System\GEEIBzA.exe
  2⤵
  PID:8496
- C:\Windows\System\AUCShxb.exe
  C:\Windows\System\AUCShxb.exe
  2⤵
  PID:8528
- C:\Windows\System\lIazgPv.exe
  C:\Windows\System\lIazgPv.exe
  2⤵
  PID:8544
- C:\Windows\System\ofdDXRy.exe
  C:\Windows\System\ofdDXRy.exe
  2⤵
  PID:8576
- C:\Windows\System\zSRqgHW.exe
  C:\Windows\System\zSRqgHW.exe
  2⤵
  PID:8600
- C:\Windows\System\jeHrUKC.exe
  C:\Windows\System\jeHrUKC.exe
  2⤵
  PID:8628
- C:\Windows\System\hsKuPgh.exe
  C:\Windows\System\hsKuPgh.exe
  2⤵
  PID:8656
- C:\Windows\System\Lkdwqtk.exe
  C:\Windows\System\Lkdwqtk.exe
  2⤵
  PID:8680
- C:\Windows\System\DlNXJUc.exe
  C:\Windows\System\DlNXJUc.exe
  2⤵
  PID:8700
- C:\Windows\System\zxRvgyh.exe
  C:\Windows\System\zxRvgyh.exe
  2⤵
  PID:8724
- C:\Windows\System\jIWXmhF.exe
  C:\Windows\System\jIWXmhF.exe
  2⤵
  PID:8760
- C:\Windows\System\MTdItmA.exe
  C:\Windows\System\MTdItmA.exe
  2⤵
  PID:8804
- C:\Windows\System\equenij.exe
  C:\Windows\System\equenij.exe
  2⤵
  PID:8828
- C:\Windows\System\TkRofji.exe
  C:\Windows\System\TkRofji.exe
  2⤵
  PID:8868
- C:\Windows\System\yvmAskW.exe
  C:\Windows\System\yvmAskW.exe
  2⤵
  PID:8896
- C:\Windows\System\TkYHMIr.exe
  C:\Windows\System\TkYHMIr.exe
  2⤵
  PID:8912
- C:\Windows\System\VjkbaZq.exe
  C:\Windows\System\VjkbaZq.exe
  2⤵
  PID:8940
- C:\Windows\System\fimyymX.exe
  C:\Windows\System\fimyymX.exe
  2⤵
  PID:8980
- C:\Windows\System\NdRiEnv.exe
  C:\Windows\System\NdRiEnv.exe
  2⤵
  PID:9004
- C:\Windows\System\hRUxlhH.exe
  C:\Windows\System\hRUxlhH.exe
  2⤵
  PID:9024
- C:\Windows\System\lUNfrGG.exe
  C:\Windows\System\lUNfrGG.exe
  2⤵
  PID:9048
- C:\Windows\System\JlHQxhp.exe
  C:\Windows\System\JlHQxhp.exe
  2⤵
  PID:9072
- C:\Windows\System\ymENIZl.exe
  C:\Windows\System\ymENIZl.exe
  2⤵
  PID:9100
- C:\Windows\System\LZUEXbI.exe
  C:\Windows\System\LZUEXbI.exe
  2⤵
  PID:9144
- C:\Windows\System\pntEYVq.exe
  C:\Windows\System\pntEYVq.exe
  2⤵
  PID:9164
- C:\Windows\System\BJpSJkt.exe
  C:\Windows\System\BJpSJkt.exe
  2⤵
  PID:9188
- C:\Windows\System\mhwTlRq.exe
  C:\Windows\System\mhwTlRq.exe
  2⤵
  PID:9208
- C:\Windows\System\UxgyOQt.exe
  C:\Windows\System\UxgyOQt.exe
  2⤵
  PID:8220
- C:\Windows\System\sOgRhIk.exe
  C:\Windows\System\sOgRhIk.exe
  2⤵
  PID:8252
- C:\Windows\System\ZOPZXYp.exe
  C:\Windows\System\ZOPZXYp.exe
  2⤵
  PID:8364
- C:\Windows\System\VwIgxgZ.exe
  C:\Windows\System\VwIgxgZ.exe
  2⤵
  PID:8420
- C:\Windows\System\rOVjTWt.exe
  C:\Windows\System\rOVjTWt.exe
  2⤵
  PID:8448
- C:\Windows\System\SNCBpjd.exe
  C:\Windows\System\SNCBpjd.exe
  2⤵
  PID:8568
- C:\Windows\System\HbGgfTv.exe
  C:\Windows\System\HbGgfTv.exe
  2⤵
  PID:8612
- C:\Windows\System\ltMoomH.exe
  C:\Windows\System\ltMoomH.exe
  2⤵
  PID:8648
- C:\Windows\System\NyuuYKY.exe
  C:\Windows\System\NyuuYKY.exe
  2⤵
  PID:8716
- C:\Windows\System\jwMOCok.exe
  C:\Windows\System\jwMOCok.exe
  2⤵
  PID:8796
- C:\Windows\System\mBMcyma.exe
  C:\Windows\System\mBMcyma.exe
  2⤵
  PID:8880
- C:\Windows\System\pHAsrnr.exe
  C:\Windows\System\pHAsrnr.exe
  2⤵
  PID:8924
- C:\Windows\System\BTUOoCs.exe
  C:\Windows\System\BTUOoCs.exe
  2⤵
  PID:8992
- C:\Windows\System\WiNExDF.exe
  C:\Windows\System\WiNExDF.exe
  2⤵
  PID:9068
- C:\Windows\System\LsVaLlD.exe
  C:\Windows\System\LsVaLlD.exe
  2⤵
  PID:9160
- C:\Windows\System\IZBaHjc.exe
  C:\Windows\System\IZBaHjc.exe
  2⤵
  PID:8044
- C:\Windows\System\sAGYKYR.exe
  C:\Windows\System\sAGYKYR.exe
  2⤵
  PID:8248
- C:\Windows\System\HDVPiHi.exe
  C:\Windows\System\HDVPiHi.exe
  2⤵
  PID:8384
- C:\Windows\System\usYaSub.exe
  C:\Windows\System\usYaSub.exe
  2⤵
  PID:8512
- C:\Windows\System\HSBbpYm.exe
  C:\Windows\System\HSBbpYm.exe
  2⤵
  PID:8736
- C:\Windows\System\DZvaAQf.exe
  C:\Windows\System\DZvaAQf.exe
  2⤵
  PID:8860
- C:\Windows\System\AfhZxST.exe
  C:\Windows\System\AfhZxST.exe
  2⤵
  PID:8956
- C:\Windows\System\XPNGlPw.exe
  C:\Windows\System\XPNGlPw.exe
  2⤵
  PID:9124
- C:\Windows\System\wdCDjNm.exe
  C:\Windows\System\wdCDjNm.exe
  2⤵
  PID:752
- C:\Windows\System\XpSFpmv.exe
  C:\Windows\System\XpSFpmv.exe
  2⤵
  PID:8668
- C:\Windows\System\ifJBkbX.exe
  C:\Windows\System\ifJBkbX.exe
  2⤵
  PID:8892
- C:\Windows\System\HwbMGDi.exe
  C:\Windows\System\HwbMGDi.exe
  2⤵
  PID:8268
- C:\Windows\System\lomnPJB.exe
  C:\Windows\System\lomnPJB.exe
  2⤵
  PID:8516
- C:\Windows\System\FMtXZnX.exe
  C:\Windows\System\FMtXZnX.exe
  2⤵
  PID:9236
- C:\Windows\System\BKYhdMM.exe
  C:\Windows\System\BKYhdMM.exe
  2⤵
  PID:9264
- C:\Windows\System\UcRFeZY.exe
  C:\Windows\System\UcRFeZY.exe
  2⤵
  PID:9292
- C:\Windows\System\KTioOOF.exe
  C:\Windows\System\KTioOOF.exe
  2⤵
  PID:9320
- C:\Windows\System\dNcEOPm.exe
  C:\Windows\System\dNcEOPm.exe
  2⤵
  PID:9348
- C:\Windows\System\pVnluac.exe
  C:\Windows\System\pVnluac.exe
  2⤵
  PID:9376
- C:\Windows\System\CqcGPCd.exe
  C:\Windows\System\CqcGPCd.exe
  2⤵
  PID:9408
- C:\Windows\System\sCKLCix.exe
  C:\Windows\System\sCKLCix.exe
  2⤵
  PID:9424
- C:\Windows\System\xOKiYLx.exe
  C:\Windows\System\xOKiYLx.exe
  2⤵
  PID:9448
- C:\Windows\System\TFwnOjJ.exe
  C:\Windows\System\TFwnOjJ.exe
  2⤵
  PID:9476
- C:\Windows\System\DfRoEaR.exe
  C:\Windows\System\DfRoEaR.exe
  2⤵
  PID:9520
- C:\Windows\System\VcVTfGb.exe
  C:\Windows\System\VcVTfGb.exe
  2⤵
  PID:9540
- C:\Windows\System\vCfUrtU.exe
  C:\Windows\System\vCfUrtU.exe
  2⤵
  PID:9564
- C:\Windows\System\nbsFWWq.exe
  C:\Windows\System\nbsFWWq.exe
  2⤵
  PID:9596
- C:\Windows\System\xqFsOnc.exe
  C:\Windows\System\xqFsOnc.exe
  2⤵
  PID:9620
- C:\Windows\System\IwYpcdN.exe
  C:\Windows\System\IwYpcdN.exe
  2⤵
  PID:9636
- C:\Windows\System\iMlIJqQ.exe
  C:\Windows\System\iMlIJqQ.exe
  2⤵
  PID:9660
- C:\Windows\System\psLodkn.exe
  C:\Windows\System\psLodkn.exe
  2⤵
  PID:9680
- C:\Windows\System\SBaIjRU.exe
  C:\Windows\System\SBaIjRU.exe
  2⤵
  PID:9704
- C:\Windows\System\NVEToCk.exe
  C:\Windows\System\NVEToCk.exe
  2⤵
  PID:9736
- C:\Windows\System\kSkOxEm.exe
  C:\Windows\System\kSkOxEm.exe
  2⤵
  PID:9760
- C:\Windows\System\eAAQMNw.exe
  C:\Windows\System\eAAQMNw.exe
  2⤵
  PID:9780
- C:\Windows\System\eKUoxAb.exe
  C:\Windows\System\eKUoxAb.exe
  2⤵
  PID:9804
- C:\Windows\System\BUDHpUT.exe
  C:\Windows\System\BUDHpUT.exe
  2⤵
  PID:9828
- C:\Windows\System\SDeIKSa.exe
  C:\Windows\System\SDeIKSa.exe
  2⤵
  PID:9900
- C:\Windows\System\TWzkyrY.exe
  C:\Windows\System\TWzkyrY.exe
  2⤵
  PID:9940
- C:\Windows\System\buhKysl.exe
  C:\Windows\System\buhKysl.exe
  2⤵
  PID:9972
- C:\Windows\System\uXXgyXA.exe
  C:\Windows\System\uXXgyXA.exe
  2⤵
  PID:9988
- C:\Windows\System\EoYRjWG.exe
  C:\Windows\System\EoYRjWG.exe
  2⤵
  PID:10016
- C:\Windows\System\TZsAIPo.exe
  C:\Windows\System\TZsAIPo.exe
  2⤵
  PID:10032
- C:\Windows\System\hjFxPtN.exe
  C:\Windows\System\hjFxPtN.exe
  2⤵
  PID:10076
- C:\Windows\System\FmAZVqe.exe
  C:\Windows\System\FmAZVqe.exe
  2⤵
  PID:10100
- C:\Windows\System\cXQHPDb.exe
  C:\Windows\System\cXQHPDb.exe
  2⤵
  PID:10132
- C:\Windows\System\jbonTiO.exe
  C:\Windows\System\jbonTiO.exe
  2⤵
  PID:10168
- C:\Windows\System\rGkCROo.exe
  C:\Windows\System\rGkCROo.exe
  2⤵
  PID:10192
- C:\Windows\System\usxfcSY.exe
  C:\Windows\System\usxfcSY.exe
  2⤵
  PID:10224
- C:\Windows\System\DvAGfaK.exe
  C:\Windows\System\DvAGfaK.exe
  2⤵
  PID:9232
- C:\Windows\System\YPFcpWt.exe
  C:\Windows\System\YPFcpWt.exe
  2⤵
  PID:9280
- C:\Windows\System\vbsleGZ.exe
  C:\Windows\System\vbsleGZ.exe
  2⤵
  PID:9364
- C:\Windows\System\lRYANZL.exe
  C:\Windows\System\lRYANZL.exe
  2⤵
  PID:9388
- C:\Windows\System\nhepYIK.exe
  C:\Windows\System\nhepYIK.exe
  2⤵
  PID:9440
- C:\Windows\System\vcasOFP.exe
  C:\Windows\System\vcasOFP.exe
  2⤵
  PID:9516
- C:\Windows\System\ovUpmda.exe
  C:\Windows\System\ovUpmda.exe
  2⤵
  PID:9556
- C:\Windows\System\pLUPbnU.exe
  C:\Windows\System\pLUPbnU.exe
  2⤵
  PID:9628
- C:\Windows\System\ZbGWeiJ.exe
  C:\Windows\System\ZbGWeiJ.exe
  2⤵
  PID:9728
- C:\Windows\System\AEBeWnf.exe
  C:\Windows\System\AEBeWnf.exe
  2⤵
  PID:9796
- C:\Windows\System\CEgnern.exe
  C:\Windows\System\CEgnern.exe
  2⤵
  PID:9856
- C:\Windows\System\brhasyr.exe
  C:\Windows\System\brhasyr.exe
  2⤵
  PID:9920
- C:\Windows\System\TkzVXpL.exe
  C:\Windows\System\TkzVXpL.exe
  2⤵
  PID:9968
- C:\Windows\System\lcAnITw.exe
  C:\Windows\System\lcAnITw.exe
  2⤵
  PID:10092
- C:\Windows\System\Kqskrrk.exe
  C:\Windows\System\Kqskrrk.exe
  2⤵
  PID:10120
- C:\Windows\System\PVBgVsS.exe
  C:\Windows\System\PVBgVsS.exe
  2⤵
  PID:10212
- C:\Windows\System\jYZHzJY.exe
  C:\Windows\System\jYZHzJY.exe
  2⤵
  PID:9256
- C:\Windows\System\iZbfqvP.exe
  C:\Windows\System\iZbfqvP.exe
  2⤵
  PID:9468
- C:\Windows\System\hCEBMxl.exe
  C:\Windows\System\hCEBMxl.exe
  2⤵
  PID:9552
- C:\Windows\System\TFvCDTo.exe
  C:\Windows\System\TFvCDTo.exe
  2⤵
  PID:9776
- C:\Windows\System\LtecQFF.exe
  C:\Windows\System\LtecQFF.exe
  2⤵
  PID:9816
- C:\Windows\System\WTDKKeW.exe
  C:\Windows\System\WTDKKeW.exe
  2⤵
  PID:9956
- C:\Windows\System\TwflhbK.exe
  C:\Windows\System\TwflhbK.exe
  2⤵
  PID:10156
- C:\Windows\System\VkxZVAM.exe
  C:\Windows\System\VkxZVAM.exe
  2⤵
  PID:9340
- C:\Windows\System\vTnqeHo.exe
  C:\Windows\System\vTnqeHo.exe
  2⤵
  PID:9824
- C:\Windows\System\InRrLij.exe
  C:\Windows\System\InRrLij.exe
  2⤵
  PID:10200
- C:\Windows\System\VSnWKEB.exe
  C:\Windows\System\VSnWKEB.exe
  2⤵
  PID:9484
- C:\Windows\System\zoWJuPq.exe
  C:\Windows\System\zoWJuPq.exe
  2⤵
  PID:10252
- C:\Windows\System\NmDlULN.exe
  C:\Windows\System\NmDlULN.exe
  2⤵
  PID:10280
- C:\Windows\System\UZeqOto.exe
  C:\Windows\System\UZeqOto.exe
  2⤵
  PID:10300
- C:\Windows\System\KcyGrWh.exe
  C:\Windows\System\KcyGrWh.exe
  2⤵
  PID:10328
- C:\Windows\System\fJSywma.exe
  C:\Windows\System\fJSywma.exe
  2⤵
  PID:10364
- C:\Windows\System\vVdoAMU.exe
  C:\Windows\System\vVdoAMU.exe
  2⤵
  PID:10392
- C:\Windows\System\PaQGNZm.exe
  C:\Windows\System\PaQGNZm.exe
  2⤵
  PID:10408
- C:\Windows\System\UBhCvWW.exe
  C:\Windows\System\UBhCvWW.exe
  2⤵
  PID:10452
- C:\Windows\System\hBfkARx.exe
  C:\Windows\System\hBfkARx.exe
  2⤵
  PID:10472
- C:\Windows\System\lHctjZZ.exe
  C:\Windows\System\lHctjZZ.exe
  2⤵
  PID:10500
- C:\Windows\System\sVcgLXk.exe
  C:\Windows\System\sVcgLXk.exe
  2⤵
  PID:10520
- C:\Windows\System\WLOzbBI.exe
  C:\Windows\System\WLOzbBI.exe
  2⤵
  PID:10560
- C:\Windows\System\VmpFytB.exe
  C:\Windows\System\VmpFytB.exe
  2⤵
  PID:10588
- C:\Windows\System\oCRCcNY.exe
  C:\Windows\System\oCRCcNY.exe
  2⤵
  PID:10620
- C:\Windows\System\wZqSPhS.exe
  C:\Windows\System\wZqSPhS.exe
  2⤵
  PID:10644
- C:\Windows\System\fAHNJRr.exe
  C:\Windows\System\fAHNJRr.exe
  2⤵
  PID:10664
- C:\Windows\System\JVcKllF.exe
  C:\Windows\System\JVcKllF.exe
  2⤵
  PID:10696
- C:\Windows\System\TVOCHfv.exe
  C:\Windows\System\TVOCHfv.exe
  2⤵
  PID:10716
- C:\Windows\System\OyVRPda.exe
  C:\Windows\System\OyVRPda.exe
  2⤵
  PID:10736
- C:\Windows\System\xtvagTs.exe
  C:\Windows\System\xtvagTs.exe
  2⤵
  PID:10784
- C:\Windows\System\CIarQQa.exe
  C:\Windows\System\CIarQQa.exe
  2⤵
  PID:10812
- C:\Windows\System\zcsZCnC.exe
  C:\Windows\System\zcsZCnC.exe
  2⤵
  PID:10840
- C:\Windows\System\XyRcYCs.exe
  C:\Windows\System\XyRcYCs.exe
  2⤵
  PID:10860
- C:\Windows\System\gqkbvqV.exe
  C:\Windows\System\gqkbvqV.exe
  2⤵
  PID:10908
- C:\Windows\System\FBiSMiX.exe
  C:\Windows\System\FBiSMiX.exe
  2⤵
  PID:10928
- C:\Windows\System\SleLWaG.exe
  C:\Windows\System\SleLWaG.exe
  2⤵
  PID:10956
- C:\Windows\System\AsKdnFV.exe
  C:\Windows\System\AsKdnFV.exe
  2⤵
  PID:10980
- C:\Windows\System\BrTfRJD.exe
  C:\Windows\System\BrTfRJD.exe
  2⤵
  PID:11012
- C:\Windows\System\OzSVwRb.exe
  C:\Windows\System\OzSVwRb.exe
  2⤵
  PID:11048
- C:\Windows\System\KVogmjr.exe
  C:\Windows\System\KVogmjr.exe
  2⤵
  PID:11068
- C:\Windows\System\RPZmBKr.exe
  C:\Windows\System\RPZmBKr.exe
  2⤵
  PID:11084
- C:\Windows\System\YQHJTCf.exe
  C:\Windows\System\YQHJTCf.exe
  2⤵
  PID:11104
- C:\Windows\System\BirrsWf.exe
  C:\Windows\System\BirrsWf.exe
  2⤵
  PID:11132
- C:\Windows\System\DByAudl.exe
  C:\Windows\System\DByAudl.exe
  2⤵
  PID:11204
- C:\Windows\System\smktjst.exe
  C:\Windows\System\smktjst.exe
  2⤵
  PID:11220
- C:\Windows\System\eRqDRqr.exe
  C:\Windows\System\eRqDRqr.exe
  2⤵
  PID:11260
- C:\Windows\System\oijTNPg.exe
  C:\Windows\System\oijTNPg.exe
  2⤵
  PID:9368
- C:\Windows\System\hpmdaBV.exe
  C:\Windows\System\hpmdaBV.exe
  2⤵
  PID:10320
- C:\Windows\System\uosEUnj.exe
  C:\Windows\System\uosEUnj.exe
  2⤵
  PID:10376
- C:\Windows\System\cnpxSgD.exe
  C:\Windows\System\cnpxSgD.exe
  2⤵
  PID:10432
- C:\Windows\System\frHxcYi.exe
  C:\Windows\System\frHxcYi.exe
  2⤵
  PID:10488
- C:\Windows\System\kUONhNY.exe
  C:\Windows\System\kUONhNY.exe
  2⤵
  PID:10496
- C:\Windows\System\PZChNwj.exe
  C:\Windows\System\PZChNwj.exe
  2⤵
  PID:10572
- C:\Windows\System\KvEbIel.exe
  C:\Windows\System\KvEbIel.exe
  2⤵
  PID:10612
- C:\Windows\System\krEljsq.exe
  C:\Windows\System\krEljsq.exe
  2⤵
  PID:10684
- C:\Windows\System\ZbKdByZ.exe
  C:\Windows\System\ZbKdByZ.exe
  2⤵
  PID:10780
- C:\Windows\System\KUXwowx.exe
  C:\Windows\System\KUXwowx.exe
  2⤵
  PID:10836
- C:\Windows\System\ZJEdntN.exe
  C:\Windows\System\ZJEdntN.exe
  2⤵
  PID:10916
- C:\Windows\System\upEJMLv.exe
  C:\Windows\System\upEJMLv.exe
  2⤵
  PID:10952
- C:\Windows\System\GFjaUTj.exe
  C:\Windows\System\GFjaUTj.exe
  2⤵
  PID:11040
- C:\Windows\System\oKIBZsx.exe
  C:\Windows\System\oKIBZsx.exe
  2⤵
  PID:11080
- C:\Windows\System\KARnKca.exe
  C:\Windows\System\KARnKca.exe
  2⤵
  PID:11180
- C:\Windows\System\pwFGrvv.exe
  C:\Windows\System\pwFGrvv.exe
  2⤵
  PID:11256
- C:\Windows\System\KrqJUWc.exe
  C:\Windows\System\KrqJUWc.exe
  2⤵
  PID:10296
- C:\Windows\System\FXmWqVw.exe
  C:\Windows\System\FXmWqVw.exe
  2⤵
  PID:10464
- C:\Windows\System\KMAELGY.exe
  C:\Windows\System\KMAELGY.exe
  2⤵
  PID:10584
- C:\Windows\System\TpXXopP.exe
  C:\Windows\System\TpXXopP.exe
  2⤵
  PID:10828
- C:\Windows\System\nLLXaJK.exe
  C:\Windows\System\nLLXaJK.exe
  2⤵
  PID:11028
- C:\Windows\System\nCiGLmQ.exe
  C:\Windows\System\nCiGLmQ.exe
  2⤵
  PID:11156
- C:\Windows\System\bdUNwVM.exe
  C:\Windows\System\bdUNwVM.exe
  2⤵
  PID:10492
- C:\Windows\System\tdHGMYZ.exe
  C:\Windows\System\tdHGMYZ.exe
  2⤵
  PID:10516
- C:\Windows\System\PENDTAs.exe
  C:\Windows\System\PENDTAs.exe
  2⤵
  PID:10800
- C:\Windows\System\zrveSNT.exe
  C:\Windows\System\zrveSNT.exe
  2⤵
  PID:11076
- C:\Windows\System\GOTNYFG.exe
  C:\Windows\System\GOTNYFG.exe
  2⤵
  PID:10632
- C:\Windows\System\BMohNsL.exe
  C:\Windows\System\BMohNsL.exe
  2⤵
  PID:11312
- C:\Windows\System\fogMffw.exe
  C:\Windows\System\fogMffw.exe
  2⤵
  PID:11340
- C:\Windows\System\vHPOofN.exe
  C:\Windows\System\vHPOofN.exe
  2⤵
  PID:11368
- C:\Windows\System\dVkVcOq.exe
  C:\Windows\System\dVkVcOq.exe
  2⤵
  PID:11388
- C:\Windows\System\sOeMDkB.exe
  C:\Windows\System\sOeMDkB.exe
  2⤵
  PID:11412
- C:\Windows\System\Ifenvlh.exe
  C:\Windows\System\Ifenvlh.exe
  2⤵
  PID:11440
- C:\Windows\System\PIeFkvA.exe
  C:\Windows\System\PIeFkvA.exe
  2⤵
  PID:11468
- C:\Windows\System\sSeanGl.exe
  C:\Windows\System\sSeanGl.exe
  2⤵
  PID:11492
- C:\Windows\System\TVvitkS.exe
  C:\Windows\System\TVvitkS.exe
  2⤵
  PID:11524
- C:\Windows\System\bAhOJRY.exe
  C:\Windows\System\bAhOJRY.exe
  2⤵
  PID:11560
- C:\Windows\System\fDUiGfx.exe
  C:\Windows\System\fDUiGfx.exe
  2⤵
  PID:11584
- C:\Windows\System\fvxMgbQ.exe
  C:\Windows\System\fvxMgbQ.exe
  2⤵
  PID:11608
- C:\Windows\System\gssAeFZ.exe
  C:\Windows\System\gssAeFZ.exe
  2⤵
  PID:11624
- C:\Windows\System\lKWnGJb.exe
  C:\Windows\System\lKWnGJb.exe
  2⤵
  PID:11656
- C:\Windows\System\aItMzKH.exe
  C:\Windows\System\aItMzKH.exe
  2⤵
  PID:11688
- C:\Windows\System\nhNttvV.exe
  C:\Windows\System\nhNttvV.exe
  2⤵
  PID:11712
- C:\Windows\System\arWAZYN.exe
  C:\Windows\System\arWAZYN.exe
  2⤵
  PID:11744
- C:\Windows\System\AziKQmL.exe
  C:\Windows\System\AziKQmL.exe
  2⤵
  PID:11768
- C:\Windows\System\PDuNuKS.exe
  C:\Windows\System\PDuNuKS.exe
  2⤵
  PID:11804
- C:\Windows\System\mVdCVnL.exe
  C:\Windows\System\mVdCVnL.exe
  2⤵
  PID:11824
- C:\Windows\System\imkblrZ.exe
  C:\Windows\System\imkblrZ.exe
  2⤵
  PID:11848
- C:\Windows\System\xkhfFOI.exe
  C:\Windows\System\xkhfFOI.exe
  2⤵
  PID:11892
- C:\Windows\System\ZBTpHVt.exe
  C:\Windows\System\ZBTpHVt.exe
  2⤵
  PID:11912
- C:\Windows\System\KNsaPBS.exe
  C:\Windows\System\KNsaPBS.exe
  2⤵
  PID:11944
- C:\Windows\System\eTDkHbH.exe
  C:\Windows\System\eTDkHbH.exe
  2⤵
  PID:11964
- C:\Windows\System\DRITiRF.exe
  C:\Windows\System\DRITiRF.exe
  2⤵
  PID:11996
- C:\Windows\System\lgdCWor.exe
  C:\Windows\System\lgdCWor.exe
  2⤵
  PID:12020
- C:\Windows\System\cpfjkAl.exe
  C:\Windows\System\cpfjkAl.exe
  2⤵
  PID:12040
- C:\Windows\System\GOZrgfR.exe
  C:\Windows\System\GOZrgfR.exe
  2⤵
  PID:12060
- C:\Windows\System\GKgHyRC.exe
  C:\Windows\System\GKgHyRC.exe
  2⤵
  PID:12104
- C:\Windows\System\xawKxXF.exe
  C:\Windows\System\xawKxXF.exe
  2⤵
  PID:12152
- C:\Windows\System\aUNpHcs.exe
  C:\Windows\System\aUNpHcs.exe
  2⤵
  PID:12180
- C:\Windows\System\DTACWUJ.exe
  C:\Windows\System\DTACWUJ.exe
  2⤵
  PID:12204
- C:\Windows\System\LkGSAZs.exe
  C:\Windows\System\LkGSAZs.exe
  2⤵
  PID:12224
- C:\Windows\System\kfwXUaB.exe
  C:\Windows\System\kfwXUaB.exe
  2⤵
  PID:12264
- C:\Windows\System\FkZPTVe.exe
  C:\Windows\System\FkZPTVe.exe
  2⤵
  PID:12280
- C:\Windows\System\OiVqGta.exe
  C:\Windows\System\OiVqGta.exe
  2⤵
  PID:11064
- C:\Windows\System\SwHoxJP.exe
  C:\Windows\System\SwHoxJP.exe
  2⤵
  PID:11364
- C:\Windows\System\UexKiWB.exe
  C:\Windows\System\UexKiWB.exe
  2⤵
  PID:11404
- C:\Windows\System\QSihniY.exe
  C:\Windows\System\QSihniY.exe
  2⤵
  PID:11452
- C:\Windows\System\ttoMHls.exe
  C:\Windows\System\ttoMHls.exe
  2⤵
  PID:11512
- C:\Windows\System\iTLDsJd.exe
  C:\Windows\System\iTLDsJd.exe
  2⤵
  PID:11552
- C:\Windows\System\WZyTsrG.exe
  C:\Windows\System\WZyTsrG.exe
  2⤵
  PID:11620
- C:\Windows\System\VMCXJZI.exe
  C:\Windows\System\VMCXJZI.exe
  2⤵
  PID:11720
- C:\Windows\System\bZLwgCz.exe
  C:\Windows\System\bZLwgCz.exe
  2⤵
  PID:11732
- C:\Windows\System\XieLCju.exe
  C:\Windows\System\XieLCju.exe
  2⤵
  PID:11780
- C:\Windows\System\tVEnORY.exe
  C:\Windows\System\tVEnORY.exe
  2⤵
  PID:11820
- C:\Windows\System\rBFPykS.exe
  C:\Windows\System\rBFPykS.exe
  2⤵
  PID:11864
- C:\Windows\System\xLKLTrL.exe
  C:\Windows\System\xLKLTrL.exe
  2⤵
  PID:11980
- C:\Windows\System\mTulhDH.exe
  C:\Windows\System\mTulhDH.exe
  2⤵
  PID:12032
- C:\Windows\System\WqkrWms.exe
  C:\Windows\System\WqkrWms.exe
  2⤵
  PID:12116
- C:\Windows\System\DsFExwn.exe
  C:\Windows\System\DsFExwn.exe
  2⤵
  PID:12196
- C:\Windows\System\LZBTHel.exe
  C:\Windows\System\LZBTHel.exe
  2⤵
  PID:12252
- C:\Windows\System\UpSLfMP.exe
  C:\Windows\System\UpSLfMP.exe
  2⤵
  PID:11352
- C:\Windows\System\qjcKpiE.exe
  C:\Windows\System\qjcKpiE.exe
  2⤵
  PID:11460
- C:\Windows\System\jUkjgTG.exe
  C:\Windows\System\jUkjgTG.exe
  2⤵
  PID:11544
- C:\Windows\System\VdWBJtd.exe
  C:\Windows\System\VdWBJtd.exe
  2⤵
  PID:11728
- C:\Windows\System\VAWNbbU.exe
  C:\Windows\System\VAWNbbU.exe
  2⤵
  PID:11928
- C:\Windows\System\TXuvSUU.exe
  C:\Windows\System\TXuvSUU.exe
  2⤵
  PID:12124
- C:\Windows\System\hnbgqmG.exe
  C:\Windows\System\hnbgqmG.exe
  2⤵
  PID:12192
- C:\Windows\System\YyaDVgn.exe
  C:\Windows\System\YyaDVgn.exe
  2⤵
  PID:11332
- C:\Windows\System\FPLAeGO.exe
  C:\Windows\System\FPLAeGO.exe
  2⤵
  PID:11840
- C:\Windows\System\nAryzuQ.exe
  C:\Windows\System\nAryzuQ.exe
  2⤵
  PID:12216
- C:\Windows\System\CNkTDiB.exe
  C:\Windows\System\CNkTDiB.exe
  2⤵
  PID:12308
- C:\Windows\System\iuMnzAU.exe
  C:\Windows\System\iuMnzAU.exe
  2⤵
  PID:12328
- C:\Windows\System\JToVMUD.exe
  C:\Windows\System\JToVMUD.exe
  2⤵
  PID:12360
- C:\Windows\System\IXxiMet.exe
  C:\Windows\System\IXxiMet.exe
  2⤵
  PID:12392
- C:\Windows\System\yqhpYog.exe
  C:\Windows\System\yqhpYog.exe
  2⤵
  PID:12412
- C:\Windows\System\rmGdqSe.exe
  C:\Windows\System\rmGdqSe.exe
  2⤵
  PID:12484
- C:\Windows\System\JEbeETz.exe
  C:\Windows\System\JEbeETz.exe
  2⤵
  PID:12500
- C:\Windows\System\MeueesW.exe
  C:\Windows\System\MeueesW.exe
  2⤵
  PID:12516
- C:\Windows\System\LKXaxLT.exe
  C:\Windows\System\LKXaxLT.exe
  2⤵
  PID:12556
- C:\Windows\System\emhmtJi.exe
  C:\Windows\System\emhmtJi.exe
  2⤵
  PID:12580
- C:\Windows\System\CqIhmMs.exe
  C:\Windows\System\CqIhmMs.exe
  2⤵
  PID:12600
- C:\Windows\System\WhYnupN.exe
  C:\Windows\System\WhYnupN.exe
  2⤵
  PID:12624
- C:\Windows\System\VgrTZHb.exe
  C:\Windows\System\VgrTZHb.exe
  2⤵
  PID:12656
- C:\Windows\System\ecwZwVL.exe
  C:\Windows\System\ecwZwVL.exe
  2⤵
  PID:12672
- C:\Windows\System\aoQPNvv.exe
  C:\Windows\System\aoQPNvv.exe
  2⤵
  PID:12692
- C:\Windows\System\BHPEmhf.exe
  C:\Windows\System\BHPEmhf.exe
  2⤵
  PID:12728
- C:\Windows\System\jwbhGaN.exe
  C:\Windows\System\jwbhGaN.exe
  2⤵
  PID:12744
- C:\Windows\System\sNHpnVx.exe
  C:\Windows\System\sNHpnVx.exe
  2⤵
  PID:12760
- C:\Windows\System\jtTzwPb.exe
  C:\Windows\System\jtTzwPb.exe
  2⤵
  PID:12828
- C:\Windows\System\yCANuAs.exe
  C:\Windows\System\yCANuAs.exe
  2⤵
  PID:12852
- C:\Windows\System\jHVsdGK.exe
  C:\Windows\System\jHVsdGK.exe
  2⤵
  PID:12892
- C:\Windows\System\ZmSaHKn.exe
  C:\Windows\System\ZmSaHKn.exe
  2⤵
  PID:12920
- C:\Windows\System\emJRIXE.exe
  C:\Windows\System\emJRIXE.exe
  2⤵
  PID:12948
- C:\Windows\System\MdUhWHa.exe
  C:\Windows\System\MdUhWHa.exe
  2⤵
  PID:12964
- C:\Windows\System\SyEUYcN.exe
  C:\Windows\System\SyEUYcN.exe
  2⤵
  PID:12984
- C:\Windows\System\UyHfhrM.exe
  C:\Windows\System\UyHfhrM.exe
  2⤵
  PID:13016
- C:\Windows\System\thIxdzh.exe
  C:\Windows\System\thIxdzh.exe
  2⤵
  PID:13060
- C:\Windows\System\sfoWtYY.exe
  C:\Windows\System\sfoWtYY.exe
  2⤵
  PID:13088
- C:\Windows\System\krQANmw.exe
  C:\Windows\System\krQANmw.exe
  2⤵
  PID:13104
- C:\Windows\System\dQsHJtQ.exe
  C:\Windows\System\dQsHJtQ.exe
  2⤵
  PID:13132
- C:\Windows\System\aUIBfUP.exe
  C:\Windows\System\aUIBfUP.exe
  2⤵
  PID:13156
- C:\Windows\System\GBxDcMI.exe
  C:\Windows\System\GBxDcMI.exe
  2⤵
  PID:13180
- C:\Windows\System\QGvhwCu.exe
  C:\Windows\System\QGvhwCu.exe
  2⤵
  PID:13208
- C:\Windows\System\ecPGgIa.exe
  C:\Windows\System\ecPGgIa.exe
  2⤵
  PID:13232
- C:\Windows\System\sflyRAP.exe
  C:\Windows\System\sflyRAP.exe
  2⤵
  PID:13276
- C:\Windows\System\frMtSFo.exe
  C:\Windows\System\frMtSFo.exe
  2⤵
  PID:13296
- C:\Windows\System\mLPcRDW.exe
  C:\Windows\System\mLPcRDW.exe
  2⤵
  PID:12272
- C:\Windows\System\bNMhQjW.exe
  C:\Windows\System\bNMhQjW.exe
  2⤵
  PID:12356
- C:\Windows\System\SzUTyZG.exe
  C:\Windows\System\SzUTyZG.exe
  2⤵
  PID:12388
- C:\Windows\System\IZMtfAz.exe
  C:\Windows\System\IZMtfAz.exe
  2⤵
  PID:12480
- C:\Windows\System\zrTEqOK.exe
  C:\Windows\System\zrTEqOK.exe
  2⤵
  PID:12528
- C:\Windows\System\hgzxtev.exe
  C:\Windows\System\hgzxtev.exe
  2⤵
  PID:12596
- C:\Windows\System\uQbWTLf.exe
  C:\Windows\System\uQbWTLf.exe
  2⤵
  PID:12620
- C:\Windows\System\ELawVSa.exe
  C:\Windows\System\ELawVSa.exe
  2⤵
  PID:12752
- C:\Windows\System\iRzgtvX.exe
  C:\Windows\System\iRzgtvX.exe
  2⤵
  PID:12804
- C:\Windows\System\oPzxCVP.exe
  C:\Windows\System\oPzxCVP.exe
  2⤵
  PID:12884
- C:\Windows\System\NkGKfxq.exe
  C:\Windows\System\NkGKfxq.exe
  2⤵
  PID:12912
- C:\Windows\System\tKHEjYi.exe
  C:\Windows\System\tKHEjYi.exe
  2⤵
  PID:13008
- C:\Windows\System\kwtFqvp.exe
  C:\Windows\System\kwtFqvp.exe
  2⤵
  PID:13048
- C:\Windows\System\mKVilJL.exe
  C:\Windows\System\mKVilJL.exe
  2⤵
  PID:13100
- C:\Windows\System\nOPxdCP.exe
  C:\Windows\System\nOPxdCP.exe
  2⤵
  PID:13152
- C:\Windows\System\ncMZckl.exe
  C:\Windows\System\ncMZckl.exe
  2⤵
  PID:13220
- C:\Windows\System\ibmKyex.exe
  C:\Windows\System\ibmKyex.exe
  2⤵
  PID:11616
- C:\Windows\System\PJNoPdm.exe
  C:\Windows\System\PJNoPdm.exe
  2⤵
  PID:12320
- C:\Windows\System\dxycfih.exe
  C:\Windows\System\dxycfih.exe
  2⤵
  PID:12468
- C:\Windows\System\cbUIjRB.exe
  C:\Windows\System\cbUIjRB.exe
  2⤵
  PID:12668
- C:\Windows\System\fzoJNkC.exe
  C:\Windows\System\fzoJNkC.exe
  2⤵
  PID:12836
- C:\Windows\System\ouetQss.exe
  C:\Windows\System\ouetQss.exe
  2⤵
  PID:12992
- C:\Windows\System\nHXTMIx.exe
  C:\Windows\System\nHXTMIx.exe
  2⤵
  PID:13040
- C:\Windows\System\iDNaeJN.exe
  C:\Windows\System\iDNaeJN.exe
  2⤵
  PID:11960
- C:\Windows\System\zmYfHxx.exe
  C:\Windows\System\zmYfHxx.exe
  2⤵
  PID:12540
- C:\Windows\System\vMlACxE.exe
  C:\Windows\System\vMlACxE.exe
  2⤵
  PID:12796
- C:\Windows\System\KhNEWle.exe
  C:\Windows\System\KhNEWle.exe
  2⤵
  PID:12960
- C:\Windows\System\AOWtYVF.exe
  C:\Windows\System\AOWtYVF.exe
  2⤵
  PID:12340
- C:\Windows\System\pmoEHpT.exe
  C:\Windows\System\pmoEHpT.exe
  2⤵
  PID:13316
- C:\Windows\System\rLmnEGy.exe
  C:\Windows\System\rLmnEGy.exe
  2⤵
  PID:13340
- C:\Windows\System\pzlMBdx.exe
  C:\Windows\System\pzlMBdx.exe
  2⤵
  PID:13360
- C:\Windows\System\ZaDFZFz.exe
  C:\Windows\System\ZaDFZFz.exe
  2⤵
  PID:13384
- C:\Windows\System\zsQXAhZ.exe
  C:\Windows\System\zsQXAhZ.exe
  2⤵
  PID:13408
- C:\Windows\System\FUOazVJ.exe
  C:\Windows\System\FUOazVJ.exe
  2⤵
  PID:13444
- C:\Windows\System\okVotCM.exe
  C:\Windows\System\okVotCM.exe
  2⤵
  PID:13468
- C:\Windows\System\CFcYafw.exe
  C:\Windows\System\CFcYafw.exe
  2⤵
  PID:13488
- C:\Windows\System\Wtctcxa.exe
  C:\Windows\System\Wtctcxa.exe
  2⤵
  PID:13520
- C:\Windows\System\KTxvhoH.exe
  C:\Windows\System\KTxvhoH.exe
  2⤵
  PID:13544
- C:\Windows\System\aANBLSj.exe
  C:\Windows\System\aANBLSj.exe
  2⤵
  PID:13572
- C:\Windows\System\MoEEovS.exe
  C:\Windows\System\MoEEovS.exe
  2⤵
  PID:13632
- C:\Windows\System\QyqTZyG.exe
  C:\Windows\System\QyqTZyG.exe
  2⤵
  PID:13648
- C:\Windows\System\qmAvDKn.exe
  C:\Windows\System\qmAvDKn.exe
  2⤵
  PID:13676
- C:\Windows\System\ltHXFpm.exe
  C:\Windows\System\ltHXFpm.exe
  2⤵
  PID:13696
- C:\Windows\System\SbzStMM.exe
  C:\Windows\System\SbzStMM.exe
  2⤵
  PID:13744
- C:\Windows\System\KGqQFer.exe
  C:\Windows\System\KGqQFer.exe
  2⤵
  PID:13768
- C:\Windows\System\QwNHJYJ.exe
  C:\Windows\System\QwNHJYJ.exe
  2⤵
  PID:13788
- C:\Windows\System\jkHuwTf.exe
  C:\Windows\System\jkHuwTf.exe
  2⤵
  PID:13804
- C:\Windows\System\FkiEbqI.exe
  C:\Windows\System\FkiEbqI.exe
  2⤵
  PID:13832
- C:\Windows\System\elvDkwC.exe
  C:\Windows\System\elvDkwC.exe
  2⤵
  PID:13856
- C:\Windows\System\XtMJeSn.exe
  C:\Windows\System\XtMJeSn.exe
  2⤵
  PID:13900
- C:\Windows\System\rIBupXa.exe
  C:\Windows\System\rIBupXa.exe
  2⤵
  PID:13916
- C:\Windows\System\JhvhrkX.exe
  C:\Windows\System\JhvhrkX.exe
  2⤵
  PID:13956
- C:\Windows\System\ROkyvoy.exe
  C:\Windows\System\ROkyvoy.exe
  2⤵
  PID:13980
- C:\Windows\System\stkgOxp.exe
  C:\Windows\System\stkgOxp.exe
  2⤵
  PID:14024
- C:\Windows\System\EGvInHp.exe
  C:\Windows\System\EGvInHp.exe
  2⤵
  PID:14048
- C:\Windows\System\jcvNBMb.exe
  C:\Windows\System\jcvNBMb.exe
  2⤵
  PID:14068
- C:\Windows\System\KCwyifW.exe
  C:\Windows\System\KCwyifW.exe
  2⤵
  PID:14096
- C:\Windows\System\eITkrFW.exe
  C:\Windows\System\eITkrFW.exe
  2⤵
  PID:14136
- C:\Windows\System\diQXSvy.exe
  C:\Windows\System\diQXSvy.exe
  2⤵
  PID:14152
- C:\Windows\System\bZJiiub.exe
  C:\Windows\System\bZJiiub.exe
  2⤵
  PID:14172
- C:\Windows\System\UuiMfUX.exe
  C:\Windows\System\UuiMfUX.exe
  2⤵
  PID:14200
- C:\Windows\System\JvgkxAX.exe
  C:\Windows\System\JvgkxAX.exe
  2⤵
  PID:14220
- C:\Windows\System\CLdTVOe.exe
  C:\Windows\System\CLdTVOe.exe
  2⤵
  PID:14248
- C:\Windows\System\GmYvVpV.exe
  C:\Windows\System\GmYvVpV.exe
  2⤵
  PID:14276
- C:\Windows\System\AnPWxPe.exe
  C:\Windows\System\AnPWxPe.exe
  2⤵
  PID:14296
- C:\Windows\System\yvCcEyc.exe
  C:\Windows\System\yvCcEyc.exe
  2⤵
  PID:12168
- C:\Windows\System\ZQRpQyI.exe
  C:\Windows\System\ZQRpQyI.exe
  2⤵
  PID:13436
- C:\Windows\System\YgaeHlR.exe
  C:\Windows\System\YgaeHlR.exe
  2⤵
  PID:13464
- C:\Windows\System\BrQbRKm.exe
  C:\Windows\System\BrQbRKm.exe
  2⤵
  PID:4880
- C:\Windows\System\ZjQTOJi.exe
  C:\Windows\System\ZjQTOJi.exe
  2⤵
  PID:13552
- C:\Windows\System\Okdvpkx.exe
  C:\Windows\System\Okdvpkx.exe
  2⤵
  PID:13644
- C:\Windows\System\mcaQfjM.exe
  C:\Windows\System\mcaQfjM.exe
  2⤵
  PID:13724
- C:\Windows\System\nbVHUbv.exe
  C:\Windows\System\nbVHUbv.exe
  2⤵
  PID:13760
- C:\Windows\System\ZSDbyxs.exe
  C:\Windows\System\ZSDbyxs.exe
  2⤵
  PID:13780
- C:\Windows\System\CQuwCzk.exe
  C:\Windows\System\CQuwCzk.exe
  2⤵
  PID:13824
- C:\Windows\System\ixkqjFF.exe
  C:\Windows\System\ixkqjFF.exe
  2⤵
  PID:13952
- C:\Windows\System\VKtmvrC.exe
  C:\Windows\System\VKtmvrC.exe
  2⤵
  PID:14000
- C:\Windows\System\ENLbnOs.exe
  C:\Windows\System\ENLbnOs.exe
  2⤵
  PID:14084
- C:\Windows\System\WdtDoPr.exe
  C:\Windows\System\WdtDoPr.exe
  2⤵
  PID:14144
- C:\Windows\System\HVQSwmN.exe
  C:\Windows\System\HVQSwmN.exe
  2⤵
  PID:14244
- C:\Windows\System\RcJGXbS.exe
  C:\Windows\System\RcJGXbS.exe
  2⤵
  PID:14272
- C:\Windows\System\LHKUFax.exe
  C:\Windows\System\LHKUFax.exe
  2⤵
  PID:13336
- C:\Windows\System\ozDxYds.exe
  C:\Windows\System\ozDxYds.exe
  2⤵
  PID:13460
- C:\Windows\System\HXWcsMW.exe
  C:\Windows\System\HXWcsMW.exe
  2⤵
  PID:13532
- C:\Windows\System\mgMLAuc.exe
  C:\Windows\System\mgMLAuc.exe
  2⤵
  PID:13640
- C:\Windows\System\owhzLmS.exe
  C:\Windows\System\owhzLmS.exe
  2⤵
  PID:13736
- C:\Windows\System\zqjLHQH.exe
  C:\Windows\System\zqjLHQH.exe
  2⤵
  PID:14088
- C:\Windows\System\UKoKvYt.exe
  C:\Windows\System\UKoKvYt.exe
  2⤵
  PID:14316
- C:\Windows\System\jxrlbnf.exe
  C:\Windows\System\jxrlbnf.exe
  2⤵
  PID:13452
- C:\Windows\System\EukItPj.exe
  C:\Windows\System\EukItPj.exe
  2⤵
  PID:13692
- C:\Windows\System\naLInUd.exe
  C:\Windows\System\naLInUd.exe
  2⤵
  PID:13932
- C:\Windows\System\nkedUvJ.exe
  C:\Windows\System\nkedUvJ.exe
  2⤵
  PID:14264
- C:\Windows\System\raglkYC.exe
  C:\Windows\System\raglkYC.exe
  2⤵
  PID:13968
- C:\Windows\System\NOawNKH.exe
  C:\Windows\System\NOawNKH.exe
  2⤵
  PID:14348
- C:\Windows\System\FnAgtAd.exe
  C:\Windows\System\FnAgtAd.exe
  2⤵
  PID:14388
- C:\Windows\System\JUptLhP.exe
  C:\Windows\System\JUptLhP.exe
  2⤵
  PID:14416
- C:\Windows\System\ySpyGMf.exe
  C:\Windows\System\ySpyGMf.exe
  2⤵
  PID:14432
- C:\Windows\System\TKGDpoj.exe
  C:\Windows\System\TKGDpoj.exe
  2⤵
  PID:14456
- C:\Windows\System\XamuHRj.exe
  C:\Windows\System\XamuHRj.exe
  2⤵
  PID:14508
- C:\Windows\System\CBdQCBO.exe
  C:\Windows\System\CBdQCBO.exe
  2⤵
  PID:14548
- C:\Windows\System\oShsIAM.exe
  C:\Windows\System\oShsIAM.exe
  2⤵
  PID:14568
- C:\Windows\System\bdPiHbv.exe
  C:\Windows\System\bdPiHbv.exe
  2⤵
  PID:14596
- C:\Windows\System\LEjuiqj.exe
  C:\Windows\System\LEjuiqj.exe
  2⤵
  PID:14636
- C:\Windows\System\RjwYaSe.exe
  C:\Windows\System\RjwYaSe.exe
  2⤵
  PID:14656
- C:\Windows\System\cgMBwgm.exe
  C:\Windows\System\cgMBwgm.exe
  2⤵
  PID:14680
- C:\Windows\System\rjQUDoZ.exe
  C:\Windows\System\rjQUDoZ.exe
  2⤵
  PID:14696
- C:\Windows\System\vgljGfz.exe
  C:\Windows\System\vgljGfz.exe
  2⤵
  PID:14716
- C:\Windows\System\krJNedh.exe
  C:\Windows\System\krJNedh.exe
  2⤵
  PID:14772
- C:\Windows\System\cLkfUCb.exe
  C:\Windows\System\cLkfUCb.exe
  2⤵
  PID:14792
- C:\Windows\System\AEWWOPi.exe
  C:\Windows\System\AEWWOPi.exe
  2⤵
  PID:14832
- C:\Windows\System\AMVzuKb.exe
  C:\Windows\System\AMVzuKb.exe
  2⤵
  PID:14848
- C:\Windows\System\ackDJFj.exe
  C:\Windows\System\ackDJFj.exe
  2⤵
  PID:14888
- C:\Windows\System\qMsjacy.exe
  C:\Windows\System\qMsjacy.exe
  2⤵
  PID:14920
- C:\Windows\System\svinzPQ.exe
  C:\Windows\System\svinzPQ.exe
  2⤵
  PID:14948
- C:\Windows\System\esyzipi.exe
  C:\Windows\System\esyzipi.exe
  2⤵
  PID:14976
- C:\Windows\System\SWkPUQo.exe
  C:\Windows\System\SWkPUQo.exe
  2⤵
  PID:15000
- C:\Windows\System\MNEsacF.exe
  C:\Windows\System\MNEsacF.exe
  2⤵
  PID:15020
- C:\Windows\System\QRcKbWJ.exe
  C:\Windows\System\QRcKbWJ.exe
  2⤵
  PID:15048
- C:\Windows\System\lLzlUKo.exe
  C:\Windows\System\lLzlUKo.exe
  2⤵
  PID:15076
- C:\Windows\System\FwTpzZM.exe
  C:\Windows\System\FwTpzZM.exe
  2⤵
  PID:15092
- C:\Windows\System\oeyPxuB.exe
  C:\Windows\System\oeyPxuB.exe
  2⤵
  PID:15132
- C:\Windows\System\PbywrMa.exe
  C:\Windows\System\PbywrMa.exe
  2⤵
  PID:15160
- C:\Windows\System\jqIVKmj.exe
  C:\Windows\System\jqIVKmj.exe
  2⤵
  PID:15176
- C:\Windows\System\GmCfQcd.exe
  C:\Windows\System\GmCfQcd.exe
  2⤵
  PID:15220
- C:\Windows\System\AeEDzUN.exe
  C:\Windows\System\AeEDzUN.exe
  2⤵
  PID:15244
- C:\Windows\System\KxTooCJ.exe
  C:\Windows\System\KxTooCJ.exe
  2⤵
  PID:15260
- C:\Windows\System\mULKsHJ.exe
  C:\Windows\System\mULKsHJ.exe
  2⤵
  PID:15280
- C:\Windows\System\PXEUehQ.exe
  C:\Windows\System\PXEUehQ.exe
  2⤵
  PID:15320
- C:\Windows\System\cElmFCN.exe
  C:\Windows\System\cElmFCN.exe
  2⤵
  PID:15348
- C:\Windows\System\mAAKYCp.exe
  C:\Windows\System\mAAKYCp.exe
  2⤵
  PID:13600
- C:\Windows\System\bDbjvkY.exe
  C:\Windows\System\bDbjvkY.exe
  2⤵
  PID:14424
- C:\Windows\System\usGxXkz.exe
  C:\Windows\System\usGxXkz.exe
  2⤵
  PID:14524
- C:\Windows\System\DZxmCKh.exe
  C:\Windows\System\DZxmCKh.exe
  2⤵
  PID:14580
- C:\Windows\System\XDHnySE.exe
  C:\Windows\System\XDHnySE.exe
  2⤵
  PID:14620
- C:\Windows\System\IqtGyYP.exe
  C:\Windows\System\IqtGyYP.exe
  2⤵
  PID:14644
- C:\Windows\System\OEvgNUp.exe
  C:\Windows\System\OEvgNUp.exe
  2⤵
  PID:14728
- C:\Windows\System\aKmkjey.exe
  C:\Windows\System\aKmkjey.exe
  2⤵
  PID:14820
- C:\Windows\System\wpDUiFb.exe
  C:\Windows\System\wpDUiFb.exe
  2⤵
  PID:14880
- C:\Windows\System\Nrbtyib.exe
  C:\Windows\System\Nrbtyib.exe
  2⤵
  PID:14932
- C:\Windows\System\oXbKuVQ.exe
  C:\Windows\System\oXbKuVQ.exe
  2⤵
  PID:14988
- C:\Windows\System\cBKHVrd.exe
  C:\Windows\System\cBKHVrd.exe
  2⤵
  PID:15044
- C:\Windows\System\wtqdkiI.exe
  C:\Windows\System\wtqdkiI.exe
  2⤵
  PID:15120
- C:\Windows\System\RdGbGzL.exe
  C:\Windows\System\RdGbGzL.exe
  2⤵
  PID:15204
- C:\Windows\System\ytwTpaD.exe
  C:\Windows\System\ytwTpaD.exe
  2⤵
  PID:15268
- C:\Windows\System\FdfQGzQ.exe
  C:\Windows\System\FdfQGzQ.exe
  2⤵
  PID:15304
- C:\Windows\System\KYuRAuu.exe
  C:\Windows\System\KYuRAuu.exe
  2⤵
  PID:14408
- C:\Windows\System\Adveztp.exe
  C:\Windows\System\Adveztp.exe
  2⤵
  PID:14540
- C:\Windows\System\TgaZMgM.exe
  C:\Windows\System\TgaZMgM.exe
  2⤵
  PID:14704
- C:\Windows\System\QcUFctc.exe
  C:\Windows\System\QcUFctc.exe
  2⤵
  PID:14860
- C:\Windows\System\RqxyNmh.exe
  C:\Windows\System\RqxyNmh.exe
  2⤵
  PID:14964
- C:\Windows\System\olMdCqZ.exe
  C:\Windows\System\olMdCqZ.exe
  2⤵
  PID:15188
- C:\Windows\System\xncttrk.exe
  C:\Windows\System\xncttrk.exe
  2⤵
  PID:15236
- C:\Windows\System\kNEsyUm.exe
  C:\Windows\System\kNEsyUm.exe
  2⤵
  PID:14448
- C:\Windows\System\oygghxI.exe
  C:\Windows\System\oygghxI.exe
  2⤵
  PID:14780
- C:\Windows\System\bCiLBNh.exe
  C:\Windows\System\bCiLBNh.exe
  2⤵
  PID:15276
- C:\Windows\System\KvZyvsm.exe
  C:\Windows\System\KvZyvsm.exe
  2⤵
  PID:15240
- C:\Windows\System\QRJaPfU.exe
  C:\Windows\System\QRJaPfU.exe
  2⤵
  PID:15012
- C:\Windows\System\dFMCEqB.exe
  C:\Windows\System\dFMCEqB.exe
  2⤵
  PID:15380
- C:\Windows\System\rcqmEyU.exe
  C:\Windows\System\rcqmEyU.exe
  2⤵
  PID:15428
- C:\Windows\System\MpEsOVl.exe
  C:\Windows\System\MpEsOVl.exe
  2⤵
  PID:15456
- C:\Windows\System\aRAPDLx.exe
  C:\Windows\System\aRAPDLx.exe
  2⤵
  PID:15484
- C:\Windows\System\fxvXYIi.exe
  C:\Windows\System\fxvXYIi.exe
  2⤵
  PID:15508
- C:\Windows\System\pvYIDhk.exe
  C:\Windows\System\pvYIDhk.exe
  2⤵
  PID:15540
- C:\Windows\System\qdMORBE.exe
  C:\Windows\System\qdMORBE.exe
  2⤵
  PID:15556
- C:\Windows\System\tdveVaD.exe
  C:\Windows\System\tdveVaD.exe
  2⤵
  PID:15596
- C:\Windows\System\NLXrpbI.exe
  C:\Windows\System\NLXrpbI.exe
  2⤵
  PID:15612
- C:\Windows\System\JPVKJhr.exe
  C:\Windows\System\JPVKJhr.exe
  2⤵
  PID:15652
- C:\Windows\System\ZEJstpb.exe
  C:\Windows\System\ZEJstpb.exe
  2⤵
  PID:15676
- C:\Windows\System\lzbwaoR.exe
  C:\Windows\System\lzbwaoR.exe
  2⤵
  PID:15696
- C:\Windows\System\mHZVgKe.exe
  C:\Windows\System\mHZVgKe.exe
  2⤵
  PID:15724
- C:\Windows\System\pGXOFmS.exe
  C:\Windows\System\pGXOFmS.exe
  2⤵
  PID:15744
- C:\Windows\System\vxhmvYy.exe
  C:\Windows\System\vxhmvYy.exe
  2⤵
  PID:15792
- C:\Windows\System\FunmRHh.exe
  C:\Windows\System\FunmRHh.exe
  2⤵
  PID:15820
- C:\Windows\System\qYBzXQH.exe
  C:\Windows\System\qYBzXQH.exe
  2⤵
  PID:15840
- C:\Windows\System\mohVcUj.exe
  C:\Windows\System\mohVcUj.exe
  2⤵
  PID:15872
- C:\Windows\System\bHLeoQU.exe
  C:\Windows\System\bHLeoQU.exe
  2⤵
  PID:15892
- C:\Windows\System\HXrSzDu.exe
  C:\Windows\System\HXrSzDu.exe
  2⤵
  PID:15916
- C:\Windows\System\cvZJEwk.exe
  C:\Windows\System\cvZJEwk.exe
  2⤵
  PID:15952
- C:\Windows\System\FqWbVbt.exe
  C:\Windows\System\FqWbVbt.exe
  2⤵
  PID:15980
- C:\Windows\System\FfzjAKl.exe
  C:\Windows\System\FfzjAKl.exe
  2⤵
  PID:16004
- C:\Windows\System\qHNtCtS.exe
  C:\Windows\System\qHNtCtS.exe
  2⤵
  PID:16020
- C:\Windows\System\uWefqpm.exe
  C:\Windows\System\uWefqpm.exe
  2⤵
  PID:16036
- C:\Windows\System\iVikBjA.exe
  C:\Windows\System\iVikBjA.exe
  2⤵
  PID:16088
- C:\Windows\System\KzuQKCb.exe
  C:\Windows\System\KzuQKCb.exe
  2⤵
  PID:16116
- C:\Windows\System\jqrpIYf.exe
  C:\Windows\System\jqrpIYf.exe
  2⤵
  PID:16144
- C:\Windows\System\fARkzVg.exe
  C:\Windows\System\fARkzVg.exe
  2⤵
  PID:16160
- C:\Windows\System\VZcmmbW.exe
  C:\Windows\System\VZcmmbW.exe
  2⤵
  PID:16212
- C:\Windows\System\WzCiAQk.exe
  C:\Windows\System\WzCiAQk.exe
  2⤵
  PID:16240
- C:\Windows\System\jYPOwnm.exe
  C:\Windows\System\jYPOwnm.exe
  2⤵
  PID:16284
- C:\Windows\System\AFlSXCP.exe
  C:\Windows\System\AFlSXCP.exe
  2⤵
  PID:16300
- C:\Windows\System\uxATbWU.exe
  C:\Windows\System\uxATbWU.exe
  2⤵
  PID:16324
- C:\Windows\System\EuoADty.exe
  C:\Windows\System\EuoADty.exe
  2⤵
  PID:16368
- C:\Windows\System\MqRUMvd.exe
  C:\Windows\System\MqRUMvd.exe
  2⤵
  PID:14588
- C:\Windows\System\sjjACGv.exe
  C:\Windows\System\sjjACGv.exe
  2⤵
  PID:15444
- C:\Windows\System\VaFsziK.exe
  C:\Windows\System\VaFsziK.exe
  2⤵
  PID:15480
- C:\Windows\System\lxzBxFd.exe
  C:\Windows\System\lxzBxFd.exe
  2⤵
  PID:15580
- C:\Windows\System\TuasYcC.exe
  C:\Windows\System\TuasYcC.exe
  2⤵
  PID:15628
- C:\Windows\System\uggxxGz.exe
  C:\Windows\System\uggxxGz.exe
  2⤵
  PID:15688
- C:\Windows\System\vAvmWiF.exe
  C:\Windows\System\vAvmWiF.exe
  2⤵
  PID:15712
- C:\Windows\System\mObENVc.exe
  C:\Windows\System\mObENVc.exe
  2⤵
  PID:15784
- C:\Windows\System\uVQeUAa.exe
  C:\Windows\System\uVQeUAa.exe
  2⤵
  PID:15836
- C:\Windows\System\vOYEMlV.exe
  C:\Windows\System\vOYEMlV.exe
  2⤵
  PID:15888
- C:\Windows\System\tojSXBd.exe
  C:\Windows\System\tojSXBd.exe
  2⤵
  PID:15992
- C:\Windows\System\bjcgswL.exe
  C:\Windows\System\bjcgswL.exe
  2⤵
  PID:16032
- C:\Windows\System\HkyAYAS.exe
  C:\Windows\System\HkyAYAS.exe
  2⤵
  PID:16080
- C:\Windows\System\cNghXcJ.exe
  C:\Windows\System\cNghXcJ.exe
  2⤵
  PID:16208
- C:\Windows\System\KtqsPin.exe
  C:\Windows\System\KtqsPin.exe
  2⤵
  PID:16256
- C:\Windows\System\troATmi.exe
  C:\Windows\System\troATmi.exe
  2⤵
  PID:14676
- C:\Windows\System\DqnTBda.exe
  C:\Windows\System\DqnTBda.exe
  2⤵
  PID:15424
- C:\Windows\System\YIjYcEp.exe
  C:\Windows\System\YIjYcEp.exe
  2⤵
  PID:15552
- C:\Windows\System\utcmiyV.exe
  C:\Windows\System\utcmiyV.exe
  2⤵
  PID:15632
- C:\Windows\System\gWwrwMp.exe
  C:\Windows\System\gWwrwMp.exe
  2⤵
  PID:15764
- C:\Windows\System\xHxKNAL.exe
  C:\Windows\System\xHxKNAL.exe
  2⤵
  PID:15852
- C:\Windows\System\TdkraFA.exe
  C:\Windows\System\TdkraFA.exe
  2⤵
  PID:15960
- C:\Windows\System\CyARUDT.exe
  C:\Windows\System\CyARUDT.exe
  2⤵
  PID:16228
- C:\Windows\System\GXjUQbY.exe
  C:\Windows\System\GXjUQbY.exe
  2⤵
  PID:16136
- C:\Windows\System\ytbFgzF.exe
  C:\Windows\System\ytbFgzF.exe
  2⤵
  PID:16380
- C:\Windows\System\UhHfNIb.exe
  C:\Windows\System\UhHfNIb.exe
  2⤵
  PID:15740
- C:\Windows\System\OIAGsVb.exe
  C:\Windows\System\OIAGsVb.exe
  2⤵
  PID:15660
- C:\Windows\System\bfmJZUT.exe
  C:\Windows\System\bfmJZUT.exe
  2⤵
  PID:16076
- C:\Windows\System\lCySeIX.exe
  C:\Windows\System\lCySeIX.exe
  2⤵
  PID:16396
- C:\Windows\System\tFxPvIW.exe
  C:\Windows\System\tFxPvIW.exe
  2⤵
  PID:16424
- C:\Windows\System\WKWBauz.exe
  C:\Windows\System\WKWBauz.exe
  2⤵
  PID:16440
- C:\Windows\System\qsuCuix.exe
  C:\Windows\System\qsuCuix.exe
  2⤵
  PID:16468
- C:\Windows\System\HltqAUb.exe
  C:\Windows\System\HltqAUb.exe
  2⤵
  PID:16504
- C:\Windows\System\PIYKlJo.exe
  C:\Windows\System\PIYKlJo.exe
  2⤵
  PID:16524
- C:\Windows\System\KbuhLeL.exe
  C:\Windows\System\KbuhLeL.exe
  2⤵
  PID:16540
- C:\Windows\System\MKMRfMG.exe
  C:\Windows\System\MKMRfMG.exe
  2⤵
  PID:16572
- C:\Windows\System\tgoMwix.exe
  C:\Windows\System\tgoMwix.exe
  2⤵
  PID:16592
- C:\Windows\System\RWilJLZ.exe
  C:\Windows\System\RWilJLZ.exe
  2⤵
  PID:16616
- C:\Windows\System\pAgDWrX.exe
  C:\Windows\System\pAgDWrX.exe
  2⤵
  PID:16644
- C:\Windows\System\lnCAaVD.exe
  C:\Windows\System\lnCAaVD.exe
  2⤵
  PID:16664
- C:\Windows\System\fTBhTrF.exe
  C:\Windows\System\fTBhTrF.exe
  2⤵
  PID:16688
- C:\Windows\System\oRRhmpI.exe
  C:\Windows\System\oRRhmpI.exe
  2⤵
  PID:16704
- C:\Windows\System\JvqdEav.exe
  C:\Windows\System\JvqdEav.exe
  2⤵
  PID:16732
- C:\Windows\System\myIhnSb.exe
  C:\Windows\System\myIhnSb.exe
  2⤵
  PID:16752
- C:\Windows\System\xEdQCMV.exe
  C:\Windows\System\xEdQCMV.exe
  2⤵
  PID:16784
- C:\Windows\System\hteuGrL.exe
  C:\Windows\System\hteuGrL.exe
  2⤵
  PID:16800
- C:\Windows\System\RpvNhsf.exe
  C:\Windows\System\RpvNhsf.exe
  2⤵
  PID:16860
- C:\Windows\System\zpdAldS.exe
  C:\Windows\System\zpdAldS.exe
  2⤵
  PID:16880
- C:\Windows\System\xvAqcwC.exe
  C:\Windows\System\xvAqcwC.exe
  2⤵
  PID:16908
- C:\Windows\System\NDKpzmB.exe
  C:\Windows\System\NDKpzmB.exe
  2⤵
  PID:17152
- C:\Windows\System\fEBEFJm.exe
  C:\Windows\System\fEBEFJm.exe
  2⤵
  PID:17168
- C:\Windows\System\limQjgE.exe
  C:\Windows\System\limQjgE.exe
  2⤵
  PID:17184
- C:\Windows\System\cTbXoQx.exe
  C:\Windows\System\cTbXoQx.exe
  2⤵
  PID:17212

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:16452

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\AikiAki.exe

Filesize
1.4MB

MD5
4fccb6456aa8165a7121679fd0ece80c

SHA1
33e86a69485a77e1dd9f701306c8e9f232ca3a05

SHA256
a91b5a837aab6ab701e5e6ed6a297125cfea35f4b008cd12a45cf906245e9018

SHA512
14cf5e12952d7266d96bc3e542ca865e11e4313288ffc0ec15d906c7d9ef85f575b5dd6a3d69ff47c93a33f04d6ad974fa9dc566a295156e6c208c171be2fcfb

Download Submit
C:\Windows\System\BJEuSdY.exe

Filesize
1.4MB

MD5
76f9e68ef12a535105326082c29906ae

SHA1
78b181a0bbc61ab4be9932b63369c44a348bfa50

SHA256
60aa192dca830cba463093ec2f7597b8a2c36fc2655b91be17c8ee0408016039

SHA512
2d13ae3f51be29b77c41f9cd561a422e9f43570eaaa5e32dd43a56eb0abe89a64a31365e3b8e6c3e7986f9890f7bec7587b1980f27e0e67bc73fcc87b2f73a24

Download Submit
C:\Windows\System\EkJATgB.exe

Filesize
1.4MB

MD5
37fd22e9c5a5731199ff02da9fec79da

SHA1
4b119f4b1865592ead1768bf9ae5f15226168ccb

SHA256
11478a991328d9bb5442e6425bc7dc6e241117152ae279feab64430b94a059b5

SHA512
b3da1c8ed9ed2a3f89b8dd9499539eab04448bddeabb3e6fdedc37d6cb6464e7f44d49a6c2175fe0c1a49ad4b1c95df54e4e4bd2eb29e8d3195e401c9798115e

Download Submit
C:\Windows\System\HIWErdN.exe

Filesize
1.4MB

MD5
43914d8af2ec9ffa4888848d9325841f

SHA1
8ffce3d646af3f54ae9168d7f54efe1d74250170

SHA256
64c1e158fdbe7bff58bcecc961f6bed0256b3720b3b30b99301377c1c80e5923

SHA512
137585aed3c482b31a788a862f46814924f54fa0e718974360fe6c7cc4cfb81555929d1c36e9ce493d40385b4fd7c2cf9d295fac0bc0e3fee94adff94f798d00

Download Submit
C:\Windows\System\HTFFCYZ.exe

Filesize
1.4MB

MD5
debd8c831c638197f95e6cfb16ab8c4a

SHA1
4d4d4beb48d9de3849101d52d24db654b4178db7

SHA256
bd438a5a6210a6864758dff9a60150b65ea4f9329afcd81e5224e0e1812e80a9

SHA512
ca0be7461fbfc23a73d3d606d85665f8696324ed4f527b92ac6f0ee24139c4bb0b99fcc514e0e69776544af8079c00516d860cf5a6ba17dc556a046a36a47d6c

Download Submit
C:\Windows\System\JgCqZgc.exe

Filesize
1.4MB

MD5
840884d761b109e2e8d96340c82f0af8

SHA1
a73473b6b8d5c1d5db40d05a118e1b03dc3df1c4

SHA256
128a1c9dba144d56b2a4047a88877d1dfb2d32bd3ea2897e90e8120a59d13a2b

SHA512
7cd6acfc5cdae4266fc99c93a4b4d6db4a466f986b5427a94cba843b170d41bd5c8246485da71c59ebd03e82b51f8ce7336eaff09d47fd62ca895eb2cd01565a

Download Submit
C:\Windows\System\LDduXmK.exe

Filesize
1.4MB

MD5
93fdf20da246965c6b9211b88fa7b992

SHA1
e849a3c19490e05c4d89c0578e3c16846f0a7e5d

SHA256
9321f1cd6317e37b955c6249f26bb22f8920d50a5c8fb0ba672edd1365f2f780

SHA512
b95f1f1db4e24ec53d325764c0f2a82be48554a40952df145eb821598168e2a2a40de1b75d3f53de2565265c16ec583d6ef957f651b902289bf3c36edeaf69b0

Download Submit
C:\Windows\System\MKkYnvD.exe

Filesize
1.4MB

MD5
a750e65930d15313842492c03054afb7

SHA1
ec77341666f18275b904fba56f2a655a956498fd

SHA256
242d639c4eea6e4c8cfd003cb27326ca728ba23dadcf9fc172130c182ec44bf0

SHA512
7a179a8702781b28c717dbbdfa47bbfd54e50da1c303b3301a12db134e5cbe5691862f8966523701e2ab5d17b8aa38148a01f990d760fd7f472b9e96e2e76053

Download Submit
C:\Windows\System\OsTxUnr.exe

Filesize
1.4MB

MD5
ec352e5800f04dfa5e0431811f0a6adc

SHA1
b7aec7ea20b59209f25000dd590b5e7bd60fce4c

SHA256
f7847f3ad3790a270bbd9ff4c37e62e3c959f3c316401e0aaec3547e99d5a509

SHA512
a482608e2f542b2ba55bb368bd576ec621c6bcaf942ab9d4bfa74d7311c52123aa63ff45f916da78cae4087190395686f9d4dd664e1c6a6eb149ea2c2657a5a4

Download Submit
C:\Windows\System\PLQQbxI.exe

Filesize
1.4MB

MD5
572c8bc15670791704aadafc6740d48d

SHA1
b26010f4daeb8cee0086cf902198e5998da66004

SHA256
d6bd2bef1db6dcd4a0fbc4faf9ebb06c239cc554e10ae6a3e31bd7b1a9c45b0a

SHA512
21e4c9871d454a8913080cfcbe34d89b59ab10a4602840cf3c27c22a936038c9880f3946513d496d87749df32002b7825d646f3282bf89369e39a88926075b22

Download Submit
C:\Windows\System\PrRwtmi.exe

Filesize
1.4MB

MD5
8642a922f2fe94c94b008722df55ddaa

SHA1
46d0f8ec83f74152ecb681fd24cdc3da13fb8fee

SHA256
156e59b72efbd72632b8ab5472c919bada42f0575f08b411a65ba9bcac8af713

SHA512
9d12215d02e6804a8d7b26388dfd42024abecd53f18612e0e24e828da4d9cc75d9ddaeec52bfbeb1634466cdcd9c6ecf022282bede1ab56ed328195531cf8f9c

Download Submit
C:\Windows\System\QbrdBGG.exe

Filesize
1.4MB

MD5
73294094c90978f7007010ed5d36de10

SHA1
67974536da7de6f476dce62a1b06c6ef442698b8

SHA256
4f43de7f4a05c710e02b21eb8ea52b97784795444fa3ed6b6b3dc39d89631f1a

SHA512
39384f10d0e877e8debe92fffa97c7ff098d6bb68ebfaff351fbc428f086ec01d24fd9d6733304c71eef8acf93b038a8c02a86d662843b68fcc0889cadc449ea

Download Submit
C:\Windows\System\QoVpczz.exe

Filesize
1.4MB

MD5
8dfb06c561f5fb8f97e408fdfad968cb

SHA1
612867f2b9e7fa1c6a00ada3be4fc178eca7bf0d

SHA256
5059a89bf4efced3943412a8f2f22308a2166d46ea2b8d0ff2d2dd0bcdc8494f

SHA512
1873ee6e22ddb37045981ef1766b0bff26c809bb0dc90d496384da3817cfc349a3d1a197c205282267fb1c44c602ad7009f90677360d0aba115954271c2ca1bb

Download Submit
C:\Windows\System\RMAYbeB.exe

Filesize
1.4MB

MD5
5cc0ca36270171293ace4ada4b78fc98

SHA1
f86d0661d0d7621a5cc04d1c40b79557632a4b1e

SHA256
c62064007aab11329f068ee5662ed1bc88d46c41f3e4d5cc04d62e370a7f2591

SHA512
f87b7e6f37fd27951dbe54c1b4292252c2463399bdd19258629dd8508cd183ff8b2a6b3c882e0e98d34c6e7dbb5604eb10cdb5c2aec8c71e0829ca40a0dd885f

Download Submit
C:\Windows\System\RPmKEon.exe

Filesize
1.4MB

MD5
d5a8c4978cc7233aa2d7145222f33d38

SHA1
4d4274cc1770097eea16a22309587638c891ae0a

SHA256
a95f7596ba011924cf278409f7f471e9ea7ba928ccfd0b51ed0f6051955d4280

SHA512
1fd1f365780556ef72c0627df3f928797db75a03f3b04d78e7a995c70560f9f339a24f5252016d929b6bff1a16daf655aa6606da2020953f84233ef1d998947e

Download Submit
C:\Windows\System\SIhewBn.exe

Filesize
1.4MB

MD5
1867f52ce123874d57f8d9b6d79e8f23

SHA1
927e9d1d439585a2268b3b99cfcd7e42971bbd25

SHA256
32656d998a773c81b97390a6d93c90d23e97dc19b1530d27f778df5d2dc45796

SHA512
8f64d09c700dc84d87f1efdbcac574ee2665ec62089e0f6a7819a1bc2a1d7d55711845da025a21593007d6eaee2c657ad352c02895e7bd2332f0f4be70fa8e36

Download Submit
C:\Windows\System\TVPagKh.exe

Filesize
1.4MB

MD5
9df540c3f4dc1deb9bd683a2769b8112

SHA1
9474d4c24f9268f736c6e56856ba06edff75b3eb

SHA256
a39693ea11e04b115a9938ab2e1246e4ad078004bad2f985f5c8cf63d9832ff3

SHA512
a8806e4273882ac1a3d9d8f8040cf9847486ab56594a1f3594f54d454a592e243f4c3a59056d24396d560a77b41b418eab9d7f54b91a6eb8ccacb8801917710d

Download Submit
C:\Windows\System\XuzpvSr.exe

Filesize
1.4MB

MD5
5efbfba910e88847071427dc94e69947

SHA1
305cc221e16a9ec5c4d1a7e675e583bc236036ec

SHA256
c4949691b05bc64df747d269aa9bbe68c4595ece4187e62db4e8544a3a2b8014

SHA512
77c58168ad949a8356b26673c76e3e61495f5a2f19c5184fe914280586925584e76c3c82dc8ba1b0a075a24e4c221aa665ef5262b0affdf01d657c7e985c132c

Download Submit
C:\Windows\System\YYsFUoH.exe

Filesize
1.4MB

MD5
ef735e71d120808c86cf01099b1d0db2

SHA1
1a13ceca2b2e64b59ddfe8cff91b9cf67fec3ba2

SHA256
a70b95837dcf60f8782bfdb84f395c1fe9f10e7ca4d6b5c38380e781cfb5cab5

SHA512
f5e32fcebb2c94099e4b9b9d5dceea252a0f86f78cabde28462564a7646d42497b449f659da7680f2c3f768d81d9608ca4079768efc23ea1b5ab18905e7623df

Download Submit
C:\Windows\System\aUvEdzp.exe

Filesize
1.4MB

MD5
79b4506399b878070f9ce927a5b24ee3

SHA1
2db6f3f62a84d4631b0a714b73f7ab7cd54212b3

SHA256
18b0f4bd6594a4872b6dc62583be64cb1bb3a67682fe048db183a39d7ab8d2c5

SHA512
f6bd10a14ef4ef2bd43118f5abc23c8d379541a1bce654ccbf5de6609113fdd0a621f808b035fc50fed93a3fda9d2d230d54828949502c8b5e8cbcee0a5d73c6

Download Submit
C:\Windows\System\afjzzvV.exe

Filesize
1.4MB

MD5
32f1394da3a03a617ffbd5d94106cc0a

SHA1
05b83a691049122a06758275c5b9caf0518cdc36

SHA256
ef0b809f63e4898411cd02548141bf842bb0a7172292bf8f3ba65247acf727e1

SHA512
b81cf4754cc0be2c4994ec1d4f13b49ce1dffb8218daf38cf309f7ca1a56047087b3b8f18a942193242a4ee040e64a67278e29faf80e84bc3ea76a3829d0cc0f

Download Submit
C:\Windows\System\diDdAdE.exe

Filesize
1.4MB

MD5
c7516fc84d2df62b478f163d80395232

SHA1
45b0ad3d63a9c3ca707c120562ed81b896ff088a

SHA256
9f061a2fc43bba65b37a819370d59376b69fdd536b6cbef65cba3696c9111c1b

SHA512
8868ed6615db622e9dcc27895ae2e7d2081fd13285f18417f3e1ed3fce0797d357491b34f68b584edef2950c417666207c6a0ab855296c86ed01f7b77938f87f

Download Submit
C:\Windows\System\gFWJdgA.exe

Filesize
1.4MB

MD5
f7ace214ea8a833a6b6bb89fe90e8d5d

SHA1
6eee09cb91da0ed2c065f656ecb5f85bea36faef

SHA256
4f90b8aaddc49139a6ab072918b9a212abfd1ae32eb07c40359bce55384ab0f3

SHA512
ba039199667af92f0a9a79b1427d768c06dd3d41fa74a20e8aafa6dce51e260a77ed756b8938735496377d1450a9f7f02b08022173c3dda61808e2fb9017b443

Download Submit
C:\Windows\System\jnpMDer.exe

Filesize
1.4MB

MD5
b2fa90eb92da27e431d74bcd15ed22da

SHA1
d105dfab6436b8d3b3e39743e74a6120aae6f48b

SHA256
415826f7f764da4013c5e2669f3dcef3dccb0dc4d1e093d9d29f200e6523bd94

SHA512
a78e3d8acd490d365a146fe8048b84bb8c6a53b9809ef2df5ac689ee08bb38147d37586d6cac1facf284a6b6f911f233815e0a2edb2585062b29dbd997455b52

Download Submit
C:\Windows\System\oCgVwGI.exe

Filesize
1.4MB

MD5
09542e053156598f9906e8a313817167

SHA1
f1ad919f3c3c903d6e618cf244adf42fcd00eb67

SHA256
406d81977813612b3c91ebeaaf6a304c5e01c88f69e4eb09ffaeba43825004c3

SHA512
69fc8e672fabf59fd5ee4a54d924e4aec8e37d5fe244a8b62131b0f1e70d138de1911770380687656b868a88bff1c179fff396ecd88d95b7a3eabb1202913a90

Download Submit
C:\Windows\System\qCrJPSb.exe

Filesize
1.4MB

MD5
7425a9630223b5279e8110790ea2f1f3

SHA1
6a61e9268aa85d845ec74f9328f966455da7cb51

SHA256
01437438e39fc67c672008b1abf1cb3ce398d2334b9a8e03999c38e796471b3c

SHA512
f273d43bcfd2757eae0166d17ea50c5c7a666ce058725a4f9e2f1d630e2c8693925deed7eb1e4852d16a837689ac9c8450f2a1e06a732a79ac8dfa7f84e72531

Download Submit
C:\Windows\System\scMILik.exe

Filesize
1.4MB

MD5
90141e28ef4cde66251d977d51c7b7a9

SHA1
024a46483753e547a9df990db9b5cd6256da0cfc

SHA256
213ff476b51050838d4c232f4fc9f49d10a79108d0984ef4384ade663bdd9721

SHA512
94252406635d44565900af7ff1f60d69e188c971f2ac6e370d96da5757554c400c507623e871515d504a8446af387bb2aaf7975b3d7135251f298bb83d6f759e

Download Submit
C:\Windows\System\uVOjdsi.exe

Filesize
1.4MB

MD5
d0b749ed3a94cbf43384eba17a78cd28

SHA1
3ea7e38941be53a1b59e1f66560fb46bae0f0f4a

SHA256
4d1d4a5df7846783f153ba1694a8d1ce8b8790258871340f354a1a592888f1d5

SHA512
9c2c77fc01b7d7d12a84eb39e7ab9e26c5490443ea2a250ba40ce33390b88abc3966668975b5c9f0be10e4e1f80ef947ab66419f31bd864967fd89c33f11e53a

Download Submit
C:\Windows\System\vcrgWwI.exe

Filesize
1.4MB

MD5
03d82c4779bf33787d088cfdac5828b6

SHA1
33c65e66c7258342781a47c963ff3e51d4909840

SHA256
a7d6191a5fc94ad92ec068ef411a7dfed4c4ecb44815a2286615265a8628b077

SHA512
565a2c27c698a1c3983d38e3fb7ccc3d3cefc41afcb69fc77b8761e5642743c86b045cbaf18f0efd6fd2871fe16d004afcfe2220ec9cbc01cce6511a9bd813b7

Download Submit
C:\Windows\System\wZjUvWD.exe

Filesize
1.4MB

MD5
e0a432122b4d3bece06b671577aca01e

SHA1
773d699b36a4b4de3ba1a9a612955f28fd231eff

SHA256
ccd892f0699b7636614184f6b5300452df0cbd36b4efd5e04e5c14a5fbd8adaf

SHA512
a91389ef95dd5c2aaf42e297dba42f6658295e2983455f61c2006347fa9b1078ffe2d4d4e8befcdd3188fca49c7268b6566e6bf13b6848f6ed14776b807e373f

Download Submit
C:\Windows\System\ydJLmoq.exe

Filesize
1.4MB

MD5
65ba945e708eab39160c356f659284a3

SHA1
6213bc1fecc79b8cd0ce5e2abb53f19ca163686b

SHA256
a3f4fb25e1d7a325bd07ab339a90aa23f8eed074f1222a48409bc988a9c01c16

SHA512
03a5a5e2d540836d9517509a18afe35856ee83c56979a4971758128ceeb0fcf8d95b33be3f5834d8dc4144a2c901d254eaf40ece10a3b290244a3726a48f7c3d

Download Submit
C:\Windows\System\zXgWDqS.exe

Filesize
1.4MB

MD5
5dbaf42e960af2f51f6dd91f137d6718

SHA1
88f2637df620febf3778e228685a394697efa067

SHA256
4a05d5765bffb54d84a63317fc26497489f51690b13d2cfce85d2751c881d872

SHA512
38f532caa52de0a30869e2d3465b5bd7765de3e9a7b6454230b1aa56b513868e94ed7225c072dbd784dfee5b71ac8b8590cb8bad339bcb22f946405bcb8430e1

Download Submit
C:\Windows\System\zvWtFep.exe

Filesize
1.4MB

MD5
520298bf92a23fb07269a4a05bd3c079

SHA1
9d85813e25a840cbcc2040f8abb3fd062277dbef

SHA256
ebec4d83178e8470c1cff2dba0395de064c7b7214d9d414a1d3c290a1eabdd64

SHA512
9947e51596978cda14bf5f6b7845ce8d248da2bf51858a31eee3287b57af1013230de6d4ef40b642bbe06c1077d608318591ca6418db73eaf3390fac90afe7c5

Download Submit
memory/2228-0-0x000002AE43300000-0x000002AE43310000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads