xmrig | 27e5273ae1440266bf0af2659971c38f2cdf9d44fcad545ecd995000a192d136

Analysis

max time kernel
116s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
23-12-2024 20:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

27e5273ae1440266bf0af2659971c38f2cdf9d44fcad545ecd995000a192d136.exe
Size

1.6MB
MD5

205184f37ccf91ec71f549f31acb2591
SHA1

673d21c1fa6eea1e957e67284c00ebb665e933e9
SHA256

27e5273ae1440266bf0af2659971c38f2cdf9d44fcad545ecd995000a192d136
SHA512

2ce4dd98fd544268c5a9df3886dbcf5eca3f69b85c6d3f9397772a45479a49f5c200be977d0ae19ce738f81f6e693fbde70f6ce029a7aa5b27a8191defc2a2cb
SSDEEP

49152:GezaTF8FcNkNdfE0pZ9ozttwIRx2T9va4fzx76y6:GemTLkNdfE0pZyH

Score

10^/10

xmrig miner

Malware Config

Signatures

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 35 IoCs

miner

resource	yara_rule
behavioral2/files/0x000c000000023b74-3.dat	xmrig
behavioral2/files/0x0007000000023c65-6.dat	xmrig
behavioral2/files/0x0007000000023c66-7.dat	xmrig
behavioral2/files/0x0007000000023c67-20.dat	xmrig
behavioral2/files/0x0007000000023c68-23.dat	xmrig
behavioral2/files/0x0007000000023c69-27.dat	xmrig
behavioral2/files/0x0007000000023c6a-31.dat	xmrig
behavioral2/files/0x0007000000023c6f-52.dat	xmrig
behavioral2/files/0x0007000000023c70-58.dat	xmrig
behavioral2/files/0x0007000000023c78-104.dat	xmrig
behavioral2/files/0x0007000000023c7e-133.dat	xmrig
behavioral2/files/0x0007000000023c79-150.dat	xmrig
behavioral2/files/0x0007000000023c7d-170.dat	xmrig
behavioral2/files/0x0007000000023c82-167.dat	xmrig
behavioral2/files/0x0007000000023c81-166.dat	xmrig
behavioral2/files/0x0007000000023c80-165.dat	xmrig
behavioral2/files/0x0007000000023c7b-164.dat	xmrig
behavioral2/files/0x0007000000023c84-160.dat	xmrig
behavioral2/files/0x0007000000023c7a-159.dat	xmrig
behavioral2/files/0x0007000000023c86-152.dat	xmrig
behavioral2/files/0x0007000000023c83-146.dat	xmrig
behavioral2/files/0x0009000000023c5a-145.dat	xmrig
behavioral2/files/0x0007000000023c77-141.dat	xmrig
behavioral2/files/0x0007000000023c76-137.dat	xmrig
behavioral2/files/0x0007000000023c72-135.dat	xmrig
behavioral2/files/0x0007000000023c7f-134.dat	xmrig
behavioral2/files/0x0007000000023c75-127.dat	xmrig
behavioral2/files/0x0007000000023c74-122.dat	xmrig
behavioral2/files/0x0007000000023c7c-120.dat	xmrig
behavioral2/files/0x0007000000023c73-91.dat	xmrig
behavioral2/files/0x0007000000023c71-94.dat	xmrig
behavioral2/files/0x0007000000023c6d-73.dat	xmrig
behavioral2/files/0x0007000000023c6e-62.dat	xmrig
behavioral2/files/0x0007000000023c6c-55.dat	xmrig
behavioral2/files/0x0007000000023c6b-43.dat	xmrig

Executes dropped EXE 64 IoCs

pid	Process
1708	ExoorhL.exe
4976	MiYkTry.exe
1680	dsQJSMo.exe
3048	NprWQLI.exe
4332	UCZEKJK.exe
3604	qoYQVSd.exe
3264	sbaNChq.exe
3948	XLRuKEn.exe
4812	gKWmLIP.exe
1288	cjzdCtS.exe
2876	KAyTkix.exe
4572	BlRwcjc.exe
2288	ZyyKbgs.exe
1016	lzoSRai.exe
4260	KogqXSg.exe
2744	EJOjYme.exe
4248	AikpceL.exe
4728	ZNcsNZG.exe
3828	naaTesP.exe
3520	qiWzaCi.exe
1840	HNTMrUU.exe
3636	arIyMuA.exe
1904	JRAvrfa.exe
3740	cLviFfS.exe
2776	hUPwIfO.exe
2328	yvxoeub.exe
4460	sXECoBp.exe
3464	hDTPDON.exe
1392	JsxiFCH.exe
2000	gIvrSQX.exe
2316	ZVgpuwK.exe
3424	mJohYlG.exe
4848	TSyWVaM.exe
4580	cRFXrLO.exe
1920	jWgwbTf.exe
460	jBBRVxl.exe
3380	MRLMlmt.exe
332	cNRbKgn.exe
2752	pzMkVBR.exe
3040	MWvGnJX.exe
1312	gcxyFrC.exe
2428	jtIHwqS.exe
3260	lOFVSzV.exe
2760	VEKmIPS.exe
1376	zyZLfsU.exe
4032	YXxdSYt.exe
3908	mvcVkPv.exe
624	TxNtZsB.exe
1580	eBaNHPt.exe
4824	FYdbxDE.exe
3856	cIGZrJO.exe
4464	oUgzrTp.exe
3652	zKktigU.exe
4724	CKgnHsb.exe
4980	MMZSIaH.exe
2792	vOeOHXA.exe
2984	WBjjGTU.exe
4748	kaREzOU.exe
4112	UhWnKts.exe
2148	ygasvft.exe
4972	xrYutjp.exe
4916	NQMndED.exe
1568	KOfaJxN.exe
2692	CGDbVGK.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\qVmmjdC.exe	27e5273ae1440266bf0af2659971c38f2cdf9d44fcad545ecd995000a192d136.exe
File created	C:\Windows\System\JOobPii.exe	27e5273ae1440266bf0af2659971c38f2cdf9d44fcad545ecd995000a192d136.exe
File created	C:\Windows\System\mvLNXzI.exe	27e5273ae1440266bf0af2659971c38f2cdf9d44fcad545ecd995000a192d136.exe
File created	C:\Windows\System\pMHVGNK.exe	27e5273ae1440266bf0af2659971c38f2cdf9d44fcad545ecd995000a192d136.exe
File created	C:\Windows\System\XauXJSQ.exe	27e5273ae1440266bf0af2659971c38f2cdf9d44fcad545ecd995000a192d136.exe
File created	C:\Windows\System\uetzjyg.exe	27e5273ae1440266bf0af2659971c38f2cdf9d44fcad545ecd995000a192d136.exe
File created	C:\Windows\System\ZBOBarx.exe	27e5273ae1440266bf0af2659971c38f2cdf9d44fcad545ecd995000a192d136.exe
File created	C:\Windows\System\wippoKG.exe	27e5273ae1440266bf0af2659971c38f2cdf9d44fcad545ecd995000a192d136.exe
File created	C:\Windows\System\vkgQBpB.exe	27e5273ae1440266bf0af2659971c38f2cdf9d44fcad545ecd995000a192d136.exe
File created	C:\Windows\System\CaRqGyZ.exe	27e5273ae1440266bf0af2659971c38f2cdf9d44fcad545ecd995000a192d136.exe
File created	C:\Windows\System\WvGjEHq.exe	27e5273ae1440266bf0af2659971c38f2cdf9d44fcad545ecd995000a192d136.exe
File created	C:\Windows\System\GOKUoVt.exe	27e5273ae1440266bf0af2659971c38f2cdf9d44fcad545ecd995000a192d136.exe
File created	C:\Windows\System\FpBHWqB.exe	27e5273ae1440266bf0af2659971c38f2cdf9d44fcad545ecd995000a192d136.exe
File created	C:\Windows\System\aiULmoG.exe	27e5273ae1440266bf0af2659971c38f2cdf9d44fcad545ecd995000a192d136.exe
File created	C:\Windows\System\KOfaJxN.exe	27e5273ae1440266bf0af2659971c38f2cdf9d44fcad545ecd995000a192d136.exe
File created	C:\Windows\System\lxSFgxa.exe	27e5273ae1440266bf0af2659971c38f2cdf9d44fcad545ecd995000a192d136.exe
File created	C:\Windows\System\oQFrkJT.exe	27e5273ae1440266bf0af2659971c38f2cdf9d44fcad545ecd995000a192d136.exe
File created	C:\Windows\System\DJnBaxC.exe	27e5273ae1440266bf0af2659971c38f2cdf9d44fcad545ecd995000a192d136.exe
File created	C:\Windows\System\qVvdsOM.exe	27e5273ae1440266bf0af2659971c38f2cdf9d44fcad545ecd995000a192d136.exe
File created	C:\Windows\System\mQXGWOV.exe	27e5273ae1440266bf0af2659971c38f2cdf9d44fcad545ecd995000a192d136.exe
File created	C:\Windows\System\fdRwXOu.exe	27e5273ae1440266bf0af2659971c38f2cdf9d44fcad545ecd995000a192d136.exe
File created	C:\Windows\System\pXbhjxX.exe	27e5273ae1440266bf0af2659971c38f2cdf9d44fcad545ecd995000a192d136.exe
File created	C:\Windows\System\DQbIvpz.exe	27e5273ae1440266bf0af2659971c38f2cdf9d44fcad545ecd995000a192d136.exe
File created	C:\Windows\System\hNscrBo.exe	27e5273ae1440266bf0af2659971c38f2cdf9d44fcad545ecd995000a192d136.exe
File created	C:\Windows\System\nemaoPJ.exe	27e5273ae1440266bf0af2659971c38f2cdf9d44fcad545ecd995000a192d136.exe
File created	C:\Windows\System\UKKooSA.exe	27e5273ae1440266bf0af2659971c38f2cdf9d44fcad545ecd995000a192d136.exe
File created	C:\Windows\System\ZfKuNXz.exe	27e5273ae1440266bf0af2659971c38f2cdf9d44fcad545ecd995000a192d136.exe
File created	C:\Windows\System\hlcpxav.exe	27e5273ae1440266bf0af2659971c38f2cdf9d44fcad545ecd995000a192d136.exe
File created	C:\Windows\System\HCkIHAU.exe	27e5273ae1440266bf0af2659971c38f2cdf9d44fcad545ecd995000a192d136.exe
File created	C:\Windows\System\blLcMiK.exe	27e5273ae1440266bf0af2659971c38f2cdf9d44fcad545ecd995000a192d136.exe
File created	C:\Windows\System\YjHBZVL.exe	27e5273ae1440266bf0af2659971c38f2cdf9d44fcad545ecd995000a192d136.exe
File created	C:\Windows\System\hcnwnft.exe	27e5273ae1440266bf0af2659971c38f2cdf9d44fcad545ecd995000a192d136.exe
File created	C:\Windows\System\bJHQukx.exe	27e5273ae1440266bf0af2659971c38f2cdf9d44fcad545ecd995000a192d136.exe
File created	C:\Windows\System\keSmHDm.exe	27e5273ae1440266bf0af2659971c38f2cdf9d44fcad545ecd995000a192d136.exe
File created	C:\Windows\System\qoYQVSd.exe	27e5273ae1440266bf0af2659971c38f2cdf9d44fcad545ecd995000a192d136.exe
File created	C:\Windows\System\uiLMkSj.exe	27e5273ae1440266bf0af2659971c38f2cdf9d44fcad545ecd995000a192d136.exe
File created	C:\Windows\System\TOovRDt.exe	27e5273ae1440266bf0af2659971c38f2cdf9d44fcad545ecd995000a192d136.exe
File created	C:\Windows\System\yoNaAFb.exe	27e5273ae1440266bf0af2659971c38f2cdf9d44fcad545ecd995000a192d136.exe
File created	C:\Windows\System\XHziDsy.exe	27e5273ae1440266bf0af2659971c38f2cdf9d44fcad545ecd995000a192d136.exe
File created	C:\Windows\System\aQIDxMd.exe	27e5273ae1440266bf0af2659971c38f2cdf9d44fcad545ecd995000a192d136.exe
File created	C:\Windows\System\hesieJg.exe	27e5273ae1440266bf0af2659971c38f2cdf9d44fcad545ecd995000a192d136.exe
File created	C:\Windows\System\iMSPDDk.exe	27e5273ae1440266bf0af2659971c38f2cdf9d44fcad545ecd995000a192d136.exe
File created	C:\Windows\System\GzMlmvi.exe	27e5273ae1440266bf0af2659971c38f2cdf9d44fcad545ecd995000a192d136.exe
File created	C:\Windows\System\MUdPUBB.exe	27e5273ae1440266bf0af2659971c38f2cdf9d44fcad545ecd995000a192d136.exe
File created	C:\Windows\System\OZJRlNi.exe	27e5273ae1440266bf0af2659971c38f2cdf9d44fcad545ecd995000a192d136.exe
File created	C:\Windows\System\HNTMrUU.exe	27e5273ae1440266bf0af2659971c38f2cdf9d44fcad545ecd995000a192d136.exe
File created	C:\Windows\System\GQKVryS.exe	27e5273ae1440266bf0af2659971c38f2cdf9d44fcad545ecd995000a192d136.exe
File created	C:\Windows\System\PbaMEuH.exe	27e5273ae1440266bf0af2659971c38f2cdf9d44fcad545ecd995000a192d136.exe
File created	C:\Windows\System\hAXVBjv.exe	27e5273ae1440266bf0af2659971c38f2cdf9d44fcad545ecd995000a192d136.exe
File created	C:\Windows\System\YUiaRvP.exe	27e5273ae1440266bf0af2659971c38f2cdf9d44fcad545ecd995000a192d136.exe
File created	C:\Windows\System\HnAmKkw.exe	27e5273ae1440266bf0af2659971c38f2cdf9d44fcad545ecd995000a192d136.exe
File created	C:\Windows\System\yfVjDnd.exe	27e5273ae1440266bf0af2659971c38f2cdf9d44fcad545ecd995000a192d136.exe
File created	C:\Windows\System\uzBoHAN.exe	27e5273ae1440266bf0af2659971c38f2cdf9d44fcad545ecd995000a192d136.exe
File created	C:\Windows\System\HlOtfjc.exe	27e5273ae1440266bf0af2659971c38f2cdf9d44fcad545ecd995000a192d136.exe
File created	C:\Windows\System\dthtHlS.exe	27e5273ae1440266bf0af2659971c38f2cdf9d44fcad545ecd995000a192d136.exe
File created	C:\Windows\System\FutDFsg.exe	27e5273ae1440266bf0af2659971c38f2cdf9d44fcad545ecd995000a192d136.exe
File created	C:\Windows\System\cbHQNyi.exe	27e5273ae1440266bf0af2659971c38f2cdf9d44fcad545ecd995000a192d136.exe
File created	C:\Windows\System\VpJaiff.exe	27e5273ae1440266bf0af2659971c38f2cdf9d44fcad545ecd995000a192d136.exe
File created	C:\Windows\System\ReXlNne.exe	27e5273ae1440266bf0af2659971c38f2cdf9d44fcad545ecd995000a192d136.exe
File created	C:\Windows\System\AhiCjqf.exe	27e5273ae1440266bf0af2659971c38f2cdf9d44fcad545ecd995000a192d136.exe
File created	C:\Windows\System\hFPQZaR.exe	27e5273ae1440266bf0af2659971c38f2cdf9d44fcad545ecd995000a192d136.exe
File created	C:\Windows\System\FElNbPA.exe	27e5273ae1440266bf0af2659971c38f2cdf9d44fcad545ecd995000a192d136.exe
File created	C:\Windows\System\ygLuQVT.exe	27e5273ae1440266bf0af2659971c38f2cdf9d44fcad545ecd995000a192d136.exe
File created	C:\Windows\System\JIYBtVU.exe	27e5273ae1440266bf0af2659971c38f2cdf9d44fcad545ecd995000a192d136.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	15416	dwm.exe
Token: SeChangeNotifyPrivilege	15416	dwm.exe
Token: 33	15416	dwm.exe
Token: SeIncBasePriorityPrivilege	15416	dwm.exe
Token: SeShutdownPrivilege	15416	dwm.exe
Token: SeCreatePagefilePrivilege	15416	dwm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4560 wrote to memory of 1708	4560	27e5273ae1440266bf0af2659971c38f2cdf9d44fcad545ecd995000a192d136.exe	84
PID 4560 wrote to memory of 1708	4560	27e5273ae1440266bf0af2659971c38f2cdf9d44fcad545ecd995000a192d136.exe	84
PID 4560 wrote to memory of 4976	4560	27e5273ae1440266bf0af2659971c38f2cdf9d44fcad545ecd995000a192d136.exe	85
PID 4560 wrote to memory of 4976	4560	27e5273ae1440266bf0af2659971c38f2cdf9d44fcad545ecd995000a192d136.exe	85
PID 4560 wrote to memory of 1680	4560	27e5273ae1440266bf0af2659971c38f2cdf9d44fcad545ecd995000a192d136.exe	86
PID 4560 wrote to memory of 1680	4560	27e5273ae1440266bf0af2659971c38f2cdf9d44fcad545ecd995000a192d136.exe	86
PID 4560 wrote to memory of 3048	4560	27e5273ae1440266bf0af2659971c38f2cdf9d44fcad545ecd995000a192d136.exe	87
PID 4560 wrote to memory of 3048	4560	27e5273ae1440266bf0af2659971c38f2cdf9d44fcad545ecd995000a192d136.exe	87
PID 4560 wrote to memory of 4332	4560	27e5273ae1440266bf0af2659971c38f2cdf9d44fcad545ecd995000a192d136.exe	88
PID 4560 wrote to memory of 4332	4560	27e5273ae1440266bf0af2659971c38f2cdf9d44fcad545ecd995000a192d136.exe	88
PID 4560 wrote to memory of 3604	4560	27e5273ae1440266bf0af2659971c38f2cdf9d44fcad545ecd995000a192d136.exe	89
PID 4560 wrote to memory of 3604	4560	27e5273ae1440266bf0af2659971c38f2cdf9d44fcad545ecd995000a192d136.exe	89
PID 4560 wrote to memory of 3264	4560	27e5273ae1440266bf0af2659971c38f2cdf9d44fcad545ecd995000a192d136.exe	90
PID 4560 wrote to memory of 3264	4560	27e5273ae1440266bf0af2659971c38f2cdf9d44fcad545ecd995000a192d136.exe	90
PID 4560 wrote to memory of 3948	4560	27e5273ae1440266bf0af2659971c38f2cdf9d44fcad545ecd995000a192d136.exe	91
PID 4560 wrote to memory of 3948	4560	27e5273ae1440266bf0af2659971c38f2cdf9d44fcad545ecd995000a192d136.exe	91
PID 4560 wrote to memory of 4812	4560	27e5273ae1440266bf0af2659971c38f2cdf9d44fcad545ecd995000a192d136.exe	92
PID 4560 wrote to memory of 4812	4560	27e5273ae1440266bf0af2659971c38f2cdf9d44fcad545ecd995000a192d136.exe	92
PID 4560 wrote to memory of 1288	4560	27e5273ae1440266bf0af2659971c38f2cdf9d44fcad545ecd995000a192d136.exe	93
PID 4560 wrote to memory of 1288	4560	27e5273ae1440266bf0af2659971c38f2cdf9d44fcad545ecd995000a192d136.exe	93
PID 4560 wrote to memory of 2876	4560	27e5273ae1440266bf0af2659971c38f2cdf9d44fcad545ecd995000a192d136.exe	94
PID 4560 wrote to memory of 2876	4560	27e5273ae1440266bf0af2659971c38f2cdf9d44fcad545ecd995000a192d136.exe	94
PID 4560 wrote to memory of 4572	4560	27e5273ae1440266bf0af2659971c38f2cdf9d44fcad545ecd995000a192d136.exe	95
PID 4560 wrote to memory of 4572	4560	27e5273ae1440266bf0af2659971c38f2cdf9d44fcad545ecd995000a192d136.exe	95
PID 4560 wrote to memory of 2288	4560	27e5273ae1440266bf0af2659971c38f2cdf9d44fcad545ecd995000a192d136.exe	96
PID 4560 wrote to memory of 2288	4560	27e5273ae1440266bf0af2659971c38f2cdf9d44fcad545ecd995000a192d136.exe	96
PID 4560 wrote to memory of 1016	4560	27e5273ae1440266bf0af2659971c38f2cdf9d44fcad545ecd995000a192d136.exe	97
PID 4560 wrote to memory of 1016	4560	27e5273ae1440266bf0af2659971c38f2cdf9d44fcad545ecd995000a192d136.exe	97
PID 4560 wrote to memory of 4260	4560	27e5273ae1440266bf0af2659971c38f2cdf9d44fcad545ecd995000a192d136.exe	98
PID 4560 wrote to memory of 4260	4560	27e5273ae1440266bf0af2659971c38f2cdf9d44fcad545ecd995000a192d136.exe	98
PID 4560 wrote to memory of 2744	4560	27e5273ae1440266bf0af2659971c38f2cdf9d44fcad545ecd995000a192d136.exe	99
PID 4560 wrote to memory of 2744	4560	27e5273ae1440266bf0af2659971c38f2cdf9d44fcad545ecd995000a192d136.exe	99
PID 4560 wrote to memory of 4248	4560	27e5273ae1440266bf0af2659971c38f2cdf9d44fcad545ecd995000a192d136.exe	100
PID 4560 wrote to memory of 4248	4560	27e5273ae1440266bf0af2659971c38f2cdf9d44fcad545ecd995000a192d136.exe	100
PID 4560 wrote to memory of 4728	4560	27e5273ae1440266bf0af2659971c38f2cdf9d44fcad545ecd995000a192d136.exe	101
PID 4560 wrote to memory of 4728	4560	27e5273ae1440266bf0af2659971c38f2cdf9d44fcad545ecd995000a192d136.exe	101
PID 4560 wrote to memory of 3828	4560	27e5273ae1440266bf0af2659971c38f2cdf9d44fcad545ecd995000a192d136.exe	102
PID 4560 wrote to memory of 3828	4560	27e5273ae1440266bf0af2659971c38f2cdf9d44fcad545ecd995000a192d136.exe	102
PID 4560 wrote to memory of 3520	4560	27e5273ae1440266bf0af2659971c38f2cdf9d44fcad545ecd995000a192d136.exe	103
PID 4560 wrote to memory of 3520	4560	27e5273ae1440266bf0af2659971c38f2cdf9d44fcad545ecd995000a192d136.exe	103
PID 4560 wrote to memory of 1840	4560	27e5273ae1440266bf0af2659971c38f2cdf9d44fcad545ecd995000a192d136.exe	104
PID 4560 wrote to memory of 1840	4560	27e5273ae1440266bf0af2659971c38f2cdf9d44fcad545ecd995000a192d136.exe	104
PID 4560 wrote to memory of 3636	4560	27e5273ae1440266bf0af2659971c38f2cdf9d44fcad545ecd995000a192d136.exe	105
PID 4560 wrote to memory of 3636	4560	27e5273ae1440266bf0af2659971c38f2cdf9d44fcad545ecd995000a192d136.exe	105
PID 4560 wrote to memory of 1904	4560	27e5273ae1440266bf0af2659971c38f2cdf9d44fcad545ecd995000a192d136.exe	106
PID 4560 wrote to memory of 1904	4560	27e5273ae1440266bf0af2659971c38f2cdf9d44fcad545ecd995000a192d136.exe	106
PID 4560 wrote to memory of 3740	4560	27e5273ae1440266bf0af2659971c38f2cdf9d44fcad545ecd995000a192d136.exe	107
PID 4560 wrote to memory of 3740	4560	27e5273ae1440266bf0af2659971c38f2cdf9d44fcad545ecd995000a192d136.exe	107
PID 4560 wrote to memory of 2776	4560	27e5273ae1440266bf0af2659971c38f2cdf9d44fcad545ecd995000a192d136.exe	108
PID 4560 wrote to memory of 2776	4560	27e5273ae1440266bf0af2659971c38f2cdf9d44fcad545ecd995000a192d136.exe	108
PID 4560 wrote to memory of 2328	4560	27e5273ae1440266bf0af2659971c38f2cdf9d44fcad545ecd995000a192d136.exe	109
PID 4560 wrote to memory of 2328	4560	27e5273ae1440266bf0af2659971c38f2cdf9d44fcad545ecd995000a192d136.exe	109
PID 4560 wrote to memory of 4460	4560	27e5273ae1440266bf0af2659971c38f2cdf9d44fcad545ecd995000a192d136.exe	110
PID 4560 wrote to memory of 4460	4560	27e5273ae1440266bf0af2659971c38f2cdf9d44fcad545ecd995000a192d136.exe	110
PID 4560 wrote to memory of 3464	4560	27e5273ae1440266bf0af2659971c38f2cdf9d44fcad545ecd995000a192d136.exe	111
PID 4560 wrote to memory of 3464	4560	27e5273ae1440266bf0af2659971c38f2cdf9d44fcad545ecd995000a192d136.exe	111
PID 4560 wrote to memory of 1392	4560	27e5273ae1440266bf0af2659971c38f2cdf9d44fcad545ecd995000a192d136.exe	112
PID 4560 wrote to memory of 1392	4560	27e5273ae1440266bf0af2659971c38f2cdf9d44fcad545ecd995000a192d136.exe	112
PID 4560 wrote to memory of 2000	4560	27e5273ae1440266bf0af2659971c38f2cdf9d44fcad545ecd995000a192d136.exe	113
PID 4560 wrote to memory of 2000	4560	27e5273ae1440266bf0af2659971c38f2cdf9d44fcad545ecd995000a192d136.exe	113
PID 4560 wrote to memory of 2316	4560	27e5273ae1440266bf0af2659971c38f2cdf9d44fcad545ecd995000a192d136.exe	114
PID 4560 wrote to memory of 2316	4560	27e5273ae1440266bf0af2659971c38f2cdf9d44fcad545ecd995000a192d136.exe	114
PID 4560 wrote to memory of 3424	4560	27e5273ae1440266bf0af2659971c38f2cdf9d44fcad545ecd995000a192d136.exe	115
PID 4560 wrote to memory of 3424	4560	27e5273ae1440266bf0af2659971c38f2cdf9d44fcad545ecd995000a192d136.exe	115

C:\Users\Admin\AppData\Local\Temp\27e5273ae1440266bf0af2659971c38f2cdf9d44fcad545ecd995000a192d136.exe
"C:\Users\Admin\AppData\Local\Temp\27e5273ae1440266bf0af2659971c38f2cdf9d44fcad545ecd995000a192d136.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4560
- C:\Windows\System\ExoorhL.exe
  C:\Windows\System\ExoorhL.exe
  2⤵
  - Executes dropped EXE
  PID:1708
- C:\Windows\System\MiYkTry.exe
  C:\Windows\System\MiYkTry.exe
  2⤵
  - Executes dropped EXE
  PID:4976
- C:\Windows\System\dsQJSMo.exe
  C:\Windows\System\dsQJSMo.exe
  2⤵
  - Executes dropped EXE
  PID:1680
- C:\Windows\System\NprWQLI.exe
  C:\Windows\System\NprWQLI.exe
  2⤵
  - Executes dropped EXE
  PID:3048
- C:\Windows\System\UCZEKJK.exe
  C:\Windows\System\UCZEKJK.exe
  2⤵
  - Executes dropped EXE
  PID:4332
- C:\Windows\System\qoYQVSd.exe
  C:\Windows\System\qoYQVSd.exe
  2⤵
  - Executes dropped EXE
  PID:3604
- C:\Windows\System\sbaNChq.exe
  C:\Windows\System\sbaNChq.exe
  2⤵
  - Executes dropped EXE
  PID:3264
- C:\Windows\System\XLRuKEn.exe
  C:\Windows\System\XLRuKEn.exe
  2⤵
  - Executes dropped EXE
  PID:3948
- C:\Windows\System\gKWmLIP.exe
  C:\Windows\System\gKWmLIP.exe
  2⤵
  - Executes dropped EXE
  PID:4812
- C:\Windows\System\cjzdCtS.exe
  C:\Windows\System\cjzdCtS.exe
  2⤵
  - Executes dropped EXE
  PID:1288
- C:\Windows\System\KAyTkix.exe
  C:\Windows\System\KAyTkix.exe
  2⤵
  - Executes dropped EXE
  PID:2876
- C:\Windows\System\BlRwcjc.exe
  C:\Windows\System\BlRwcjc.exe
  2⤵
  - Executes dropped EXE
  PID:4572
- C:\Windows\System\ZyyKbgs.exe
  C:\Windows\System\ZyyKbgs.exe
  2⤵
  - Executes dropped EXE
  PID:2288
- C:\Windows\System\lzoSRai.exe
  C:\Windows\System\lzoSRai.exe
  2⤵
  - Executes dropped EXE
  PID:1016
- C:\Windows\System\KogqXSg.exe
  C:\Windows\System\KogqXSg.exe
  2⤵
  - Executes dropped EXE
  PID:4260
- C:\Windows\System\EJOjYme.exe
  C:\Windows\System\EJOjYme.exe
  2⤵
  - Executes dropped EXE
  PID:2744
- C:\Windows\System\AikpceL.exe
  C:\Windows\System\AikpceL.exe
  2⤵
  - Executes dropped EXE
  PID:4248
- C:\Windows\System\ZNcsNZG.exe
  C:\Windows\System\ZNcsNZG.exe
  2⤵
  - Executes dropped EXE
  PID:4728
- C:\Windows\System\naaTesP.exe
  C:\Windows\System\naaTesP.exe
  2⤵
  - Executes dropped EXE
  PID:3828
- C:\Windows\System\qiWzaCi.exe
  C:\Windows\System\qiWzaCi.exe
  2⤵
  - Executes dropped EXE
  PID:3520
- C:\Windows\System\HNTMrUU.exe
  C:\Windows\System\HNTMrUU.exe
  2⤵
  - Executes dropped EXE
  PID:1840
- C:\Windows\System\arIyMuA.exe
  C:\Windows\System\arIyMuA.exe
  2⤵
  - Executes dropped EXE
  PID:3636
- C:\Windows\System\JRAvrfa.exe
  C:\Windows\System\JRAvrfa.exe
  2⤵
  - Executes dropped EXE
  PID:1904
- C:\Windows\System\cLviFfS.exe
  C:\Windows\System\cLviFfS.exe
  2⤵
  - Executes dropped EXE
  PID:3740
- C:\Windows\System\hUPwIfO.exe
  C:\Windows\System\hUPwIfO.exe
  2⤵
  - Executes dropped EXE
  PID:2776
- C:\Windows\System\yvxoeub.exe
  C:\Windows\System\yvxoeub.exe
  2⤵
  - Executes dropped EXE
  PID:2328
- C:\Windows\System\sXECoBp.exe
  C:\Windows\System\sXECoBp.exe
  2⤵
  - Executes dropped EXE
  PID:4460
- C:\Windows\System\hDTPDON.exe
  C:\Windows\System\hDTPDON.exe
  2⤵
  - Executes dropped EXE
  PID:3464
- C:\Windows\System\JsxiFCH.exe
  C:\Windows\System\JsxiFCH.exe
  2⤵
  - Executes dropped EXE
  PID:1392
- C:\Windows\System\gIvrSQX.exe
  C:\Windows\System\gIvrSQX.exe
  2⤵
  - Executes dropped EXE
  PID:2000
- C:\Windows\System\ZVgpuwK.exe
  C:\Windows\System\ZVgpuwK.exe
  2⤵
  - Executes dropped EXE
  PID:2316
- C:\Windows\System\mJohYlG.exe
  C:\Windows\System\mJohYlG.exe
  2⤵
  - Executes dropped EXE
  PID:3424
- C:\Windows\System\TSyWVaM.exe
  C:\Windows\System\TSyWVaM.exe
  2⤵
  - Executes dropped EXE
  PID:4848
- C:\Windows\System\jWgwbTf.exe
  C:\Windows\System\jWgwbTf.exe
  2⤵
  - Executes dropped EXE
  PID:1920
- C:\Windows\System\MRLMlmt.exe
  C:\Windows\System\MRLMlmt.exe
  2⤵
  - Executes dropped EXE
  PID:3380
- C:\Windows\System\cRFXrLO.exe
  C:\Windows\System\cRFXrLO.exe
  2⤵
  - Executes dropped EXE
  PID:4580
- C:\Windows\System\jBBRVxl.exe
  C:\Windows\System\jBBRVxl.exe
  2⤵
  - Executes dropped EXE
  PID:460
- C:\Windows\System\cNRbKgn.exe
  C:\Windows\System\cNRbKgn.exe
  2⤵
  - Executes dropped EXE
  PID:332
- C:\Windows\System\pzMkVBR.exe
  C:\Windows\System\pzMkVBR.exe
  2⤵
  - Executes dropped EXE
  PID:2752
- C:\Windows\System\MWvGnJX.exe
  C:\Windows\System\MWvGnJX.exe
  2⤵
  - Executes dropped EXE
  PID:3040
- C:\Windows\System\gcxyFrC.exe
  C:\Windows\System\gcxyFrC.exe
  2⤵
  - Executes dropped EXE
  PID:1312
- C:\Windows\System\jtIHwqS.exe
  C:\Windows\System\jtIHwqS.exe
  2⤵
  - Executes dropped EXE
  PID:2428
- C:\Windows\System\lOFVSzV.exe
  C:\Windows\System\lOFVSzV.exe
  2⤵
  - Executes dropped EXE
  PID:3260
- C:\Windows\System\VEKmIPS.exe
  C:\Windows\System\VEKmIPS.exe
  2⤵
  - Executes dropped EXE
  PID:2760
- C:\Windows\System\zyZLfsU.exe
  C:\Windows\System\zyZLfsU.exe
  2⤵
  - Executes dropped EXE
  PID:1376
- C:\Windows\System\YXxdSYt.exe
  C:\Windows\System\YXxdSYt.exe
  2⤵
  - Executes dropped EXE
  PID:4032
- C:\Windows\System\mvcVkPv.exe
  C:\Windows\System\mvcVkPv.exe
  2⤵
  - Executes dropped EXE
  PID:3908
- C:\Windows\System\TxNtZsB.exe
  C:\Windows\System\TxNtZsB.exe
  2⤵
  - Executes dropped EXE
  PID:624
- C:\Windows\System\eBaNHPt.exe
  C:\Windows\System\eBaNHPt.exe
  2⤵
  - Executes dropped EXE
  PID:1580
- C:\Windows\System\FYdbxDE.exe
  C:\Windows\System\FYdbxDE.exe
  2⤵
  - Executes dropped EXE
  PID:4824
- C:\Windows\System\cIGZrJO.exe
  C:\Windows\System\cIGZrJO.exe
  2⤵
  - Executes dropped EXE
  PID:3856
- C:\Windows\System\oUgzrTp.exe
  C:\Windows\System\oUgzrTp.exe
  2⤵
  - Executes dropped EXE
  PID:4464
- C:\Windows\System\zKktigU.exe
  C:\Windows\System\zKktigU.exe
  2⤵
  - Executes dropped EXE
  PID:3652
- C:\Windows\System\CKgnHsb.exe
  C:\Windows\System\CKgnHsb.exe
  2⤵
  - Executes dropped EXE
  PID:4724
- C:\Windows\System\MMZSIaH.exe
  C:\Windows\System\MMZSIaH.exe
  2⤵
  - Executes dropped EXE
  PID:4980
- C:\Windows\System\vOeOHXA.exe
  C:\Windows\System\vOeOHXA.exe
  2⤵
  - Executes dropped EXE
  PID:2792
- C:\Windows\System\WBjjGTU.exe
  C:\Windows\System\WBjjGTU.exe
  2⤵
  - Executes dropped EXE
  PID:2984
- C:\Windows\System\kaREzOU.exe
  C:\Windows\System\kaREzOU.exe
  2⤵
  - Executes dropped EXE
  PID:4748
- C:\Windows\System\UhWnKts.exe
  C:\Windows\System\UhWnKts.exe
  2⤵
  - Executes dropped EXE
  PID:4112
- C:\Windows\System\ygasvft.exe
  C:\Windows\System\ygasvft.exe
  2⤵
  - Executes dropped EXE
  PID:2148
- C:\Windows\System\xrYutjp.exe
  C:\Windows\System\xrYutjp.exe
  2⤵
  - Executes dropped EXE
  PID:4972
- C:\Windows\System\NQMndED.exe
  C:\Windows\System\NQMndED.exe
  2⤵
  - Executes dropped EXE
  PID:4916
- C:\Windows\System\KOfaJxN.exe
  C:\Windows\System\KOfaJxN.exe
  2⤵
  - Executes dropped EXE
  PID:1568
- C:\Windows\System\CGDbVGK.exe
  C:\Windows\System\CGDbVGK.exe
  2⤵
  - Executes dropped EXE
  PID:2692
- C:\Windows\System\YQUmfAE.exe
  C:\Windows\System\YQUmfAE.exe
  2⤵
  PID:3396
- C:\Windows\System\hSWTBgg.exe
  C:\Windows\System\hSWTBgg.exe
  2⤵
  PID:744
- C:\Windows\System\SAIEvuS.exe
  C:\Windows\System\SAIEvuS.exe
  2⤵
  PID:3100
- C:\Windows\System\lpTMpot.exe
  C:\Windows\System\lpTMpot.exe
  2⤵
  PID:4808
- C:\Windows\System\FkyWNlA.exe
  C:\Windows\System\FkyWNlA.exe
  2⤵
  PID:388
- C:\Windows\System\byNzQKb.exe
  C:\Windows\System\byNzQKb.exe
  2⤵
  PID:3940
- C:\Windows\System\CtIqTdd.exe
  C:\Windows\System\CtIqTdd.exe
  2⤵
  PID:2140
- C:\Windows\System\iPtTcGV.exe
  C:\Windows\System\iPtTcGV.exe
  2⤵
  PID:2992
- C:\Windows\System\bohtARU.exe
  C:\Windows\System\bohtARU.exe
  2⤵
  PID:2104
- C:\Windows\System\CRUPFlQ.exe
  C:\Windows\System\CRUPFlQ.exe
  2⤵
  PID:400
- C:\Windows\System\goxhSRE.exe
  C:\Windows\System\goxhSRE.exe
  2⤵
  PID:3776
- C:\Windows\System\eGydLXM.exe
  C:\Windows\System\eGydLXM.exe
  2⤵
  PID:4988
- C:\Windows\System\JyaauYE.exe
  C:\Windows\System\JyaauYE.exe
  2⤵
  PID:3804
- C:\Windows\System\YUiaRvP.exe
  C:\Windows\System\YUiaRvP.exe
  2⤵
  PID:888
- C:\Windows\System\NICfcyN.exe
  C:\Windows\System\NICfcyN.exe
  2⤵
  PID:364
- C:\Windows\System\OmfGdQm.exe
  C:\Windows\System\OmfGdQm.exe
  2⤵
  PID:3668
- C:\Windows\System\LKJdsUr.exe
  C:\Windows\System\LKJdsUr.exe
  2⤵
  PID:1932
- C:\Windows\System\ODFaWIR.exe
  C:\Windows\System\ODFaWIR.exe
  2⤵
  PID:3200
- C:\Windows\System\KNzaFel.exe
  C:\Windows\System\KNzaFel.exe
  2⤵
  PID:768
- C:\Windows\System\dpIpWiI.exe
  C:\Windows\System\dpIpWiI.exe
  2⤵
  PID:800
- C:\Windows\System\LUvIIpa.exe
  C:\Windows\System\LUvIIpa.exe
  2⤵
  PID:4960
- C:\Windows\System\uSuDcsB.exe
  C:\Windows\System\uSuDcsB.exe
  2⤵
  PID:912
- C:\Windows\System\CJfQGmC.exe
  C:\Windows\System\CJfQGmC.exe
  2⤵
  PID:3936
- C:\Windows\System\MherPgG.exe
  C:\Windows\System\MherPgG.exe
  2⤵
  PID:2112
- C:\Windows\System\bkGPDTO.exe
  C:\Windows\System\bkGPDTO.exe
  2⤵
  PID:4624
- C:\Windows\System\ykiVNuk.exe
  C:\Windows\System\ykiVNuk.exe
  2⤵
  PID:3580
- C:\Windows\System\ZcfYTQi.exe
  C:\Windows\System\ZcfYTQi.exe
  2⤵
  PID:4228
- C:\Windows\System\GOKUoVt.exe
  C:\Windows\System\GOKUoVt.exe
  2⤵
  PID:3872
- C:\Windows\System\rukOmkd.exe
  C:\Windows\System\rukOmkd.exe
  2⤵
  PID:2532
- C:\Windows\System\WrnKYAL.exe
  C:\Windows\System\WrnKYAL.exe
  2⤵
  PID:4128
- C:\Windows\System\JuKwXaK.exe
  C:\Windows\System\JuKwXaK.exe
  2⤵
  PID:1524
- C:\Windows\System\NTLqUwP.exe
  C:\Windows\System\NTLqUwP.exe
  2⤵
  PID:396
- C:\Windows\System\eNZfkTd.exe
  C:\Windows\System\eNZfkTd.exe
  2⤵
  PID:4468
- C:\Windows\System\bcGDdui.exe
  C:\Windows\System\bcGDdui.exe
  2⤵
  PID:1500
- C:\Windows\System\MfTOnLw.exe
  C:\Windows\System\MfTOnLw.exe
  2⤵
  PID:1360
- C:\Windows\System\qVgLctH.exe
  C:\Windows\System\qVgLctH.exe
  2⤵
  PID:3440
- C:\Windows\System\ZHgwKRW.exe
  C:\Windows\System\ZHgwKRW.exe
  2⤵
  PID:2788
- C:\Windows\System\sfZYtOl.exe
  C:\Windows\System\sfZYtOl.exe
  2⤵
  PID:3532
- C:\Windows\System\nrHKbJr.exe
  C:\Windows\System\nrHKbJr.exe
  2⤵
  PID:932
- C:\Windows\System\PXbspPf.exe
  C:\Windows\System\PXbspPf.exe
  2⤵
  PID:4196
- C:\Windows\System\kgJTsgc.exe
  C:\Windows\System\kgJTsgc.exe
  2⤵
  PID:8
- C:\Windows\System\rSXOKPA.exe
  C:\Windows\System\rSXOKPA.exe
  2⤵
  PID:3680
- C:\Windows\System\lBmFXDm.exe
  C:\Windows\System\lBmFXDm.exe
  2⤵
  PID:4424
- C:\Windows\System\AjxBhSE.exe
  C:\Windows\System\AjxBhSE.exe
  2⤵
  PID:4184
- C:\Windows\System\rrUoCuq.exe
  C:\Windows\System\rrUoCuq.exe
  2⤵
  PID:4536
- C:\Windows\System\zikVUAH.exe
  C:\Windows\System\zikVUAH.exe
  2⤵
  PID:3852
- C:\Windows\System\vbZJlcg.exe
  C:\Windows\System\vbZJlcg.exe
  2⤵
  PID:5128
- C:\Windows\System\vVEWVKF.exe
  C:\Windows\System\vVEWVKF.exe
  2⤵
  PID:5160
- C:\Windows\System\nNOQDGd.exe
  C:\Windows\System\nNOQDGd.exe
  2⤵
  PID:5204
- C:\Windows\System\qUWdvMd.exe
  C:\Windows\System\qUWdvMd.exe
  2⤵
  PID:5220
- C:\Windows\System\rNLMHqp.exe
  C:\Windows\System\rNLMHqp.exe
  2⤵
  PID:5248
- C:\Windows\System\yQeYTlP.exe
  C:\Windows\System\yQeYTlP.exe
  2⤵
  PID:5276
- C:\Windows\System\gUZftxG.exe
  C:\Windows\System\gUZftxG.exe
  2⤵
  PID:5296
- C:\Windows\System\IplXKLQ.exe
  C:\Windows\System\IplXKLQ.exe
  2⤵
  PID:5320
- C:\Windows\System\ertcgsV.exe
  C:\Windows\System\ertcgsV.exe
  2⤵
  PID:5348
- C:\Windows\System\qJFONGN.exe
  C:\Windows\System\qJFONGN.exe
  2⤵
  PID:5388
- C:\Windows\System\ZPQPDPu.exe
  C:\Windows\System\ZPQPDPu.exe
  2⤵
  PID:5428
- C:\Windows\System\OWczdyU.exe
  C:\Windows\System\OWczdyU.exe
  2⤵
  PID:5448
- C:\Windows\System\Gevnjss.exe
  C:\Windows\System\Gevnjss.exe
  2⤵
  PID:5464
- C:\Windows\System\odyuatH.exe
  C:\Windows\System\odyuatH.exe
  2⤵
  PID:5492
- C:\Windows\System\mvLNXzI.exe
  C:\Windows\System\mvLNXzI.exe
  2⤵
  PID:5512
- C:\Windows\System\ztAHVDx.exe
  C:\Windows\System\ztAHVDx.exe
  2⤵
  PID:5548
- C:\Windows\System\yvJsuEN.exe
  C:\Windows\System\yvJsuEN.exe
  2⤵
  PID:5580
- C:\Windows\System\eXcKLer.exe
  C:\Windows\System\eXcKLer.exe
  2⤵
  PID:5604
- C:\Windows\System\RfqZhDJ.exe
  C:\Windows\System\RfqZhDJ.exe
  2⤵
  PID:5640
- C:\Windows\System\Ayxmklk.exe
  C:\Windows\System\Ayxmklk.exe
  2⤵
  PID:5660
- C:\Windows\System\CWEaCtH.exe
  C:\Windows\System\CWEaCtH.exe
  2⤵
  PID:5688
- C:\Windows\System\ZihkqPX.exe
  C:\Windows\System\ZihkqPX.exe
  2⤵
  PID:5716
- C:\Windows\System\IFIMsdo.exe
  C:\Windows\System\IFIMsdo.exe
  2⤵
  PID:5752
- C:\Windows\System\GJILmaJ.exe
  C:\Windows\System\GJILmaJ.exe
  2⤵
  PID:5772
- C:\Windows\System\QMElbIB.exe
  C:\Windows\System\QMElbIB.exe
  2⤵
  PID:5804
- C:\Windows\System\lxFZzSC.exe
  C:\Windows\System\lxFZzSC.exe
  2⤵
  PID:5828
- C:\Windows\System\nKpXZdA.exe
  C:\Windows\System\nKpXZdA.exe
  2⤵
  PID:5852
- C:\Windows\System\EqCkCqB.exe
  C:\Windows\System\EqCkCqB.exe
  2⤵
  PID:5872
- C:\Windows\System\WFAelts.exe
  C:\Windows\System\WFAelts.exe
  2⤵
  PID:5904
- C:\Windows\System\VvqouNY.exe
  C:\Windows\System\VvqouNY.exe
  2⤵
  PID:5928
- C:\Windows\System\hJxLlhr.exe
  C:\Windows\System\hJxLlhr.exe
  2⤵
  PID:5956
- C:\Windows\System\xRuPwrj.exe
  C:\Windows\System\xRuPwrj.exe
  2⤵
  PID:5988
- C:\Windows\System\cICucFG.exe
  C:\Windows\System\cICucFG.exe
  2⤵
  PID:6012
- C:\Windows\System\cdsZsHN.exe
  C:\Windows\System\cdsZsHN.exe
  2⤵
  PID:6048
- C:\Windows\System\uikLUws.exe
  C:\Windows\System\uikLUws.exe
  2⤵
  PID:6080
- C:\Windows\System\XcHwEHT.exe
  C:\Windows\System\XcHwEHT.exe
  2⤵
  PID:6108
- C:\Windows\System\JIYBtVU.exe
  C:\Windows\System\JIYBtVU.exe
  2⤵
  PID:6136
- C:\Windows\System\KZptxhS.exe
  C:\Windows\System\KZptxhS.exe
  2⤵
  PID:5168
- C:\Windows\System\aeqIuSf.exe
  C:\Windows\System\aeqIuSf.exe
  2⤵
  PID:5244
- C:\Windows\System\WiRmfJr.exe
  C:\Windows\System\WiRmfJr.exe
  2⤵
  PID:5156
- C:\Windows\System\EyUubQu.exe
  C:\Windows\System\EyUubQu.exe
  2⤵
  PID:5316
- C:\Windows\System\stdrZyZ.exe
  C:\Windows\System\stdrZyZ.exe
  2⤵
  PID:5400
- C:\Windows\System\eVIQuCH.exe
  C:\Windows\System\eVIQuCH.exe
  2⤵
  PID:5480
- C:\Windows\System\lYUuhij.exe
  C:\Windows\System\lYUuhij.exe
  2⤵
  PID:5540
- C:\Windows\System\wJmlGjh.exe
  C:\Windows\System\wJmlGjh.exe
  2⤵
  PID:5656
- C:\Windows\System\EaXKIiB.exe
  C:\Windows\System\EaXKIiB.exe
  2⤵
  PID:5684
- C:\Windows\System\fHaBxaK.exe
  C:\Windows\System\fHaBxaK.exe
  2⤵
  PID:5728
- C:\Windows\System\dOkXlCg.exe
  C:\Windows\System\dOkXlCg.exe
  2⤵
  PID:5788
- C:\Windows\System\bXXVQCK.exe
  C:\Windows\System\bXXVQCK.exe
  2⤵
  PID:5896
- C:\Windows\System\nbpjYoO.exe
  C:\Windows\System\nbpjYoO.exe
  2⤵
  PID:5972
- C:\Windows\System\iJTZCje.exe
  C:\Windows\System\iJTZCje.exe
  2⤵
  PID:6004
- C:\Windows\System\yoNaAFb.exe
  C:\Windows\System\yoNaAFb.exe
  2⤵
  PID:6096
- C:\Windows\System\nvvIeQO.exe
  C:\Windows\System\nvvIeQO.exe
  2⤵
  PID:5136
- C:\Windows\System\FiBqIiI.exe
  C:\Windows\System\FiBqIiI.exe
  2⤵
  PID:5292
- C:\Windows\System\dnEYEJd.exe
  C:\Windows\System\dnEYEJd.exe
  2⤵
  PID:5500
- C:\Windows\System\ZCPwTOb.exe
  C:\Windows\System\ZCPwTOb.exe
  2⤵
  PID:5600
- C:\Windows\System\KgYphPp.exe
  C:\Windows\System\KgYphPp.exe
  2⤵
  PID:5892
- C:\Windows\System\svDZhAR.exe
  C:\Windows\System\svDZhAR.exe
  2⤵
  PID:6032
- C:\Windows\System\MKutfUD.exe
  C:\Windows\System\MKutfUD.exe
  2⤵
  PID:6128
- C:\Windows\System\qqXlxAj.exe
  C:\Windows\System\qqXlxAj.exe
  2⤵
  PID:5520
- C:\Windows\System\ReXlNne.exe
  C:\Windows\System\ReXlNne.exe
  2⤵
  PID:5796
- C:\Windows\System\PndtBYm.exe
  C:\Windows\System\PndtBYm.exe
  2⤵
  PID:6120
- C:\Windows\System\vMsQeRy.exe
  C:\Windows\System\vMsQeRy.exe
  2⤵
  PID:6148
- C:\Windows\System\UlZnRXq.exe
  C:\Windows\System\UlZnRXq.exe
  2⤵
  PID:6172
- C:\Windows\System\VAgikQh.exe
  C:\Windows\System\VAgikQh.exe
  2⤵
  PID:6200
- C:\Windows\System\fIDfipf.exe
  C:\Windows\System\fIDfipf.exe
  2⤵
  PID:6224
- C:\Windows\System\wCYVukS.exe
  C:\Windows\System\wCYVukS.exe
  2⤵
  PID:6256
- C:\Windows\System\puLLdGf.exe
  C:\Windows\System\puLLdGf.exe
  2⤵
  PID:6276
- C:\Windows\System\JdZqrva.exe
  C:\Windows\System\JdZqrva.exe
  2⤵
  PID:6292
- C:\Windows\System\NsFXiRV.exe
  C:\Windows\System\NsFXiRV.exe
  2⤵
  PID:6316
- C:\Windows\System\hFPQZaR.exe
  C:\Windows\System\hFPQZaR.exe
  2⤵
  PID:6344
- C:\Windows\System\nKvJNFC.exe
  C:\Windows\System\nKvJNFC.exe
  2⤵
  PID:6380
- C:\Windows\System\UKsjXRi.exe
  C:\Windows\System\UKsjXRi.exe
  2⤵
  PID:6420
- C:\Windows\System\pyEuICd.exe
  C:\Windows\System\pyEuICd.exe
  2⤵
  PID:6444
- C:\Windows\System\ESnxvhc.exe
  C:\Windows\System\ESnxvhc.exe
  2⤵
  PID:6476
- C:\Windows\System\HJYKsSi.exe
  C:\Windows\System\HJYKsSi.exe
  2⤵
  PID:6512
- C:\Windows\System\fGwCNYW.exe
  C:\Windows\System\fGwCNYW.exe
  2⤵
  PID:6544
- C:\Windows\System\mjgBktC.exe
  C:\Windows\System\mjgBktC.exe
  2⤵
  PID:6580
- C:\Windows\System\OFBsPgG.exe
  C:\Windows\System\OFBsPgG.exe
  2⤵
  PID:6600
- C:\Windows\System\XeHEnZs.exe
  C:\Windows\System\XeHEnZs.exe
  2⤵
  PID:6636
- C:\Windows\System\WgsQKVB.exe
  C:\Windows\System\WgsQKVB.exe
  2⤵
  PID:6652
- C:\Windows\System\mrktymd.exe
  C:\Windows\System\mrktymd.exe
  2⤵
  PID:6676
- C:\Windows\System\XHziDsy.exe
  C:\Windows\System\XHziDsy.exe
  2⤵
  PID:6712
- C:\Windows\System\DfTMYTS.exe
  C:\Windows\System\DfTMYTS.exe
  2⤵
  PID:6736
- C:\Windows\System\hcMPpAB.exe
  C:\Windows\System\hcMPpAB.exe
  2⤵
  PID:6764
- C:\Windows\System\aPpRyFs.exe
  C:\Windows\System\aPpRyFs.exe
  2⤵
  PID:6804
- C:\Windows\System\uhZtVOG.exe
  C:\Windows\System\uhZtVOG.exe
  2⤵
  PID:6820
- C:\Windows\System\FElNbPA.exe
  C:\Windows\System\FElNbPA.exe
  2⤵
  PID:6856
- C:\Windows\System\scmWthN.exe
  C:\Windows\System\scmWthN.exe
  2⤵
  PID:6884
- C:\Windows\System\KbFCkKC.exe
  C:\Windows\System\KbFCkKC.exe
  2⤵
  PID:6928
- C:\Windows\System\AqUGtos.exe
  C:\Windows\System\AqUGtos.exe
  2⤵
  PID:6960
- C:\Windows\System\ZVPdPsn.exe
  C:\Windows\System\ZVPdPsn.exe
  2⤵
  PID:6988
- C:\Windows\System\iOTsieP.exe
  C:\Windows\System\iOTsieP.exe
  2⤵
  PID:7016
- C:\Windows\System\JJbxTWU.exe
  C:\Windows\System\JJbxTWU.exe
  2⤵
  PID:7048
- C:\Windows\System\oXlzhSE.exe
  C:\Windows\System\oXlzhSE.exe
  2⤵
  PID:7076
- C:\Windows\System\CfMunlU.exe
  C:\Windows\System\CfMunlU.exe
  2⤵
  PID:7104
- C:\Windows\System\ZRcCDuf.exe
  C:\Windows\System\ZRcCDuf.exe
  2⤵
  PID:7132
- C:\Windows\System\lYlszaL.exe
  C:\Windows\System\lYlszaL.exe
  2⤵
  PID:7160
- C:\Windows\System\mcpSySg.exe
  C:\Windows\System\mcpSySg.exe
  2⤵
  PID:6156
- C:\Windows\System\azINDTe.exe
  C:\Windows\System\azINDTe.exe
  2⤵
  PID:5920
- C:\Windows\System\fptQyMT.exe
  C:\Windows\System\fptQyMT.exe
  2⤵
  PID:6248
- C:\Windows\System\Upfzcfw.exe
  C:\Windows\System\Upfzcfw.exe
  2⤵
  PID:6372
- C:\Windows\System\ACefEcx.exe
  C:\Windows\System\ACefEcx.exe
  2⤵
  PID:6332
- C:\Windows\System\ALHbxQM.exe
  C:\Windows\System\ALHbxQM.exe
  2⤵
  PID:6468
- C:\Windows\System\bkkCkcS.exe
  C:\Windows\System\bkkCkcS.exe
  2⤵
  PID:6532
- C:\Windows\System\aQIDxMd.exe
  C:\Windows\System\aQIDxMd.exe
  2⤵
  PID:6644
- C:\Windows\System\nnoiQjH.exe
  C:\Windows\System\nnoiQjH.exe
  2⤵
  PID:6660
- C:\Windows\System\oFVnnvY.exe
  C:\Windows\System\oFVnnvY.exe
  2⤵
  PID:6748
- C:\Windows\System\yAJWHnm.exe
  C:\Windows\System\yAJWHnm.exe
  2⤵
  PID:6756
- C:\Windows\System\HWuyAaR.exe
  C:\Windows\System\HWuyAaR.exe
  2⤵
  PID:6876
- C:\Windows\System\rmQIBKM.exe
  C:\Windows\System\rmQIBKM.exe
  2⤵
  PID:6948
- C:\Windows\System\KiUCxLV.exe
  C:\Windows\System\KiUCxLV.exe
  2⤵
  PID:7008
- C:\Windows\System\SxhIEdS.exe
  C:\Windows\System\SxhIEdS.exe
  2⤵
  PID:7060
- C:\Windows\System\LyEImRk.exe
  C:\Windows\System\LyEImRk.exe
  2⤵
  PID:7144
- C:\Windows\System\CBmEYdk.exe
  C:\Windows\System\CBmEYdk.exe
  2⤵
  PID:6220
- C:\Windows\System\cbHQNyi.exe
  C:\Windows\System\cbHQNyi.exe
  2⤵
  PID:6364
- C:\Windows\System\imvhLZF.exe
  C:\Windows\System\imvhLZF.exe
  2⤵
  PID:6488
- C:\Windows\System\JAsCkFq.exe
  C:\Windows\System\JAsCkFq.exe
  2⤵
  PID:6624
- C:\Windows\System\RWwbvye.exe
  C:\Windows\System\RWwbvye.exe
  2⤵
  PID:6752
- C:\Windows\System\POjRPRG.exe
  C:\Windows\System\POjRPRG.exe
  2⤵
  PID:6984
- C:\Windows\System\SmHPdAi.exe
  C:\Windows\System\SmHPdAi.exe
  2⤵
  PID:7116
- C:\Windows\System\tRraiLh.exe
  C:\Windows\System\tRraiLh.exe
  2⤵
  PID:6264
- C:\Windows\System\CfahECh.exe
  C:\Windows\System\CfahECh.exe
  2⤵
  PID:6552
- C:\Windows\System\UNGvwCp.exe
  C:\Windows\System\UNGvwCp.exe
  2⤵
  PID:7100
- C:\Windows\System\bmYEIwr.exe
  C:\Windows\System\bmYEIwr.exe
  2⤵
  PID:6720
- C:\Windows\System\DnEGQok.exe
  C:\Windows\System\DnEGQok.exe
  2⤵
  PID:7172
- C:\Windows\System\NPTATUE.exe
  C:\Windows\System\NPTATUE.exe
  2⤵
  PID:7196
- C:\Windows\System\qJcLVEp.exe
  C:\Windows\System\qJcLVEp.exe
  2⤵
  PID:7220
- C:\Windows\System\wddSLCy.exe
  C:\Windows\System\wddSLCy.exe
  2⤵
  PID:7244
- C:\Windows\System\RhaUclX.exe
  C:\Windows\System\RhaUclX.exe
  2⤵
  PID:7272
- C:\Windows\System\AjQPcwC.exe
  C:\Windows\System\AjQPcwC.exe
  2⤵
  PID:7300
- C:\Windows\System\sDVEVgo.exe
  C:\Windows\System\sDVEVgo.exe
  2⤵
  PID:7328
- C:\Windows\System\mHKpRNV.exe
  C:\Windows\System\mHKpRNV.exe
  2⤵
  PID:7356
- C:\Windows\System\aMDzwos.exe
  C:\Windows\System\aMDzwos.exe
  2⤵
  PID:7384
- C:\Windows\System\sphpDdb.exe
  C:\Windows\System\sphpDdb.exe
  2⤵
  PID:7412
- C:\Windows\System\ACkcauz.exe
  C:\Windows\System\ACkcauz.exe
  2⤵
  PID:7440
- C:\Windows\System\IyYsOkM.exe
  C:\Windows\System\IyYsOkM.exe
  2⤵
  PID:7468
- C:\Windows\System\PiTqZTq.exe
  C:\Windows\System\PiTqZTq.exe
  2⤵
  PID:7484
- C:\Windows\System\pqAYDpn.exe
  C:\Windows\System\pqAYDpn.exe
  2⤵
  PID:7512
- C:\Windows\System\vSUhsnm.exe
  C:\Windows\System\vSUhsnm.exe
  2⤵
  PID:7548
- C:\Windows\System\TYJFtUb.exe
  C:\Windows\System\TYJFtUb.exe
  2⤵
  PID:7572
- C:\Windows\System\euEOwUM.exe
  C:\Windows\System\euEOwUM.exe
  2⤵
  PID:7596
- C:\Windows\System\SakLvap.exe
  C:\Windows\System\SakLvap.exe
  2⤵
  PID:7624
- C:\Windows\System\cxUTZpL.exe
  C:\Windows\System\cxUTZpL.exe
  2⤵
  PID:7644
- C:\Windows\System\fryCOdh.exe
  C:\Windows\System\fryCOdh.exe
  2⤵
  PID:7680
- C:\Windows\System\sNRLyHC.exe
  C:\Windows\System\sNRLyHC.exe
  2⤵
  PID:7712
- C:\Windows\System\zAFogoH.exe
  C:\Windows\System\zAFogoH.exe
  2⤵
  PID:7740
- C:\Windows\System\YQNPRFm.exe
  C:\Windows\System\YQNPRFm.exe
  2⤵
  PID:7776
- C:\Windows\System\rchtyou.exe
  C:\Windows\System\rchtyou.exe
  2⤵
  PID:7804
- C:\Windows\System\BRnUlSe.exe
  C:\Windows\System\BRnUlSe.exe
  2⤵
  PID:7820
- C:\Windows\System\vjDSCLq.exe
  C:\Windows\System\vjDSCLq.exe
  2⤵
  PID:7848
- C:\Windows\System\tMthkvG.exe
  C:\Windows\System\tMthkvG.exe
  2⤵
  PID:7876
- C:\Windows\System\VEyAoud.exe
  C:\Windows\System\VEyAoud.exe
  2⤵
  PID:7904
- C:\Windows\System\byJqVLX.exe
  C:\Windows\System\byJqVLX.exe
  2⤵
  PID:7920
- C:\Windows\System\GiMiwtd.exe
  C:\Windows\System\GiMiwtd.exe
  2⤵
  PID:7944
- C:\Windows\System\pHJBtqs.exe
  C:\Windows\System\pHJBtqs.exe
  2⤵
  PID:7980
- C:\Windows\System\itWNELr.exe
  C:\Windows\System\itWNELr.exe
  2⤵
  PID:8012
- C:\Windows\System\OAPbkyN.exe
  C:\Windows\System\OAPbkyN.exe
  2⤵
  PID:8044
- C:\Windows\System\GbsqrUA.exe
  C:\Windows\System\GbsqrUA.exe
  2⤵
  PID:8068
- C:\Windows\System\IZVXgeR.exe
  C:\Windows\System\IZVXgeR.exe
  2⤵
  PID:8100
- C:\Windows\System\uHIsBNZ.exe
  C:\Windows\System\uHIsBNZ.exe
  2⤵
  PID:8128
- C:\Windows\System\GkuqnOi.exe
  C:\Windows\System\GkuqnOi.exe
  2⤵
  PID:8156
- C:\Windows\System\wxEzgIg.exe
  C:\Windows\System\wxEzgIg.exe
  2⤵
  PID:6328
- C:\Windows\System\wdVWYYs.exe
  C:\Windows\System\wdVWYYs.exe
  2⤵
  PID:7204
- C:\Windows\System\ABfuscf.exe
  C:\Windows\System\ABfuscf.exe
  2⤵
  PID:7284
- C:\Windows\System\jWcmqjL.exe
  C:\Windows\System\jWcmqjL.exe
  2⤵
  PID:7376
- C:\Windows\System\FNGiwTm.exe
  C:\Windows\System\FNGiwTm.exe
  2⤵
  PID:7368
- C:\Windows\System\nUfhmOu.exe
  C:\Windows\System\nUfhmOu.exe
  2⤵
  PID:7424
- C:\Windows\System\LWukEfe.exe
  C:\Windows\System\LWukEfe.exe
  2⤵
  PID:7524
- C:\Windows\System\XlEzaPk.exe
  C:\Windows\System\XlEzaPk.exe
  2⤵
  PID:7584
- C:\Windows\System\otXGlHw.exe
  C:\Windows\System\otXGlHw.exe
  2⤵
  PID:7668
- C:\Windows\System\RqDPygj.exe
  C:\Windows\System\RqDPygj.exe
  2⤵
  PID:7664
- C:\Windows\System\MWEnlrd.exe
  C:\Windows\System\MWEnlrd.exe
  2⤵
  PID:7768
- C:\Windows\System\DbPAWsm.exe
  C:\Windows\System\DbPAWsm.exe
  2⤵
  PID:7812
- C:\Windows\System\usvKlix.exe
  C:\Windows\System\usvKlix.exe
  2⤵
  PID:7896
- C:\Windows\System\nWSusre.exe
  C:\Windows\System\nWSusre.exe
  2⤵
  PID:7916
- C:\Windows\System\GQKVryS.exe
  C:\Windows\System\GQKVryS.exe
  2⤵
  PID:7976
- C:\Windows\System\QvwYYKA.exe
  C:\Windows\System\QvwYYKA.exe
  2⤵
  PID:8088
- C:\Windows\System\Eecqgrt.exe
  C:\Windows\System\Eecqgrt.exe
  2⤵
  PID:8064
- C:\Windows\System\BlmubyL.exe
  C:\Windows\System\BlmubyL.exe
  2⤵
  PID:8152
- C:\Windows\System\IToGIgH.exe
  C:\Windows\System\IToGIgH.exe
  2⤵
  PID:7188
- C:\Windows\System\GalcSnz.exe
  C:\Windows\System\GalcSnz.exe
  2⤵
  PID:7316
- C:\Windows\System\EnASXUe.exe
  C:\Windows\System\EnASXUe.exe
  2⤵
  PID:7456
- C:\Windows\System\yfVjDnd.exe
  C:\Windows\System\yfVjDnd.exe
  2⤵
  PID:7568
- C:\Windows\System\MFoGhLh.exe
  C:\Windows\System\MFoGhLh.exe
  2⤵
  PID:7608
- C:\Windows\System\KuYSIGj.exe
  C:\Windows\System\KuYSIGj.exe
  2⤵
  PID:8032
- C:\Windows\System\clzSVqg.exe
  C:\Windows\System\clzSVqg.exe
  2⤵
  PID:7296
- C:\Windows\System\OqiOVIt.exe
  C:\Windows\System\OqiOVIt.exe
  2⤵
  PID:7460
- C:\Windows\System\EMhOFqj.exe
  C:\Windows\System\EMhOFqj.exe
  2⤵
  PID:7696
- C:\Windows\System\pkVJSDW.exe
  C:\Windows\System\pkVJSDW.exe
  2⤵
  PID:7764
- C:\Windows\System\DkvzpEM.exe
  C:\Windows\System\DkvzpEM.exe
  2⤵
  PID:8212
- C:\Windows\System\lSSpABU.exe
  C:\Windows\System\lSSpABU.exe
  2⤵
  PID:8240
- C:\Windows\System\YTQulXH.exe
  C:\Windows\System\YTQulXH.exe
  2⤵
  PID:8272
- C:\Windows\System\fdRwXOu.exe
  C:\Windows\System\fdRwXOu.exe
  2⤵
  PID:8300
- C:\Windows\System\gpybiqe.exe
  C:\Windows\System\gpybiqe.exe
  2⤵
  PID:8324
- C:\Windows\System\OyulGLL.exe
  C:\Windows\System\OyulGLL.exe
  2⤵
  PID:8356
- C:\Windows\System\DMkXrXr.exe
  C:\Windows\System\DMkXrXr.exe
  2⤵
  PID:8384
- C:\Windows\System\nSnNtea.exe
  C:\Windows\System\nSnNtea.exe
  2⤵
  PID:8408
- C:\Windows\System\nnLOBkr.exe
  C:\Windows\System\nnLOBkr.exe
  2⤵
  PID:8428
- C:\Windows\System\RIDdLVl.exe
  C:\Windows\System\RIDdLVl.exe
  2⤵
  PID:8460
- C:\Windows\System\EDvyjTa.exe
  C:\Windows\System\EDvyjTa.exe
  2⤵
  PID:8484
- C:\Windows\System\AZOJeoO.exe
  C:\Windows\System\AZOJeoO.exe
  2⤵
  PID:8512
- C:\Windows\System\Xekktxy.exe
  C:\Windows\System\Xekktxy.exe
  2⤵
  PID:8540
- C:\Windows\System\OWDjJVY.exe
  C:\Windows\System\OWDjJVY.exe
  2⤵
  PID:8564
- C:\Windows\System\CtqIplN.exe
  C:\Windows\System\CtqIplN.exe
  2⤵
  PID:8588
- C:\Windows\System\blLcMiK.exe
  C:\Windows\System\blLcMiK.exe
  2⤵
  PID:8620
- C:\Windows\System\wdyBwUT.exe
  C:\Windows\System\wdyBwUT.exe
  2⤵
  PID:8644
- C:\Windows\System\PAbomUu.exe
  C:\Windows\System\PAbomUu.exe
  2⤵
  PID:8668
- C:\Windows\System\GidlMoW.exe
  C:\Windows\System\GidlMoW.exe
  2⤵
  PID:8696
- C:\Windows\System\GqDtABl.exe
  C:\Windows\System\GqDtABl.exe
  2⤵
  PID:8728
- C:\Windows\System\LVawwqR.exe
  C:\Windows\System\LVawwqR.exe
  2⤵
  PID:8760
- C:\Windows\System\dTgszkY.exe
  C:\Windows\System\dTgszkY.exe
  2⤵
  PID:8792
- C:\Windows\System\cbJJcJV.exe
  C:\Windows\System\cbJJcJV.exe
  2⤵
  PID:8828
- C:\Windows\System\pXbhjxX.exe
  C:\Windows\System\pXbhjxX.exe
  2⤵
  PID:8848
- C:\Windows\System\UkRzJdo.exe
  C:\Windows\System\UkRzJdo.exe
  2⤵
  PID:8876
- C:\Windows\System\fRuObyh.exe
  C:\Windows\System\fRuObyh.exe
  2⤵
  PID:8892
- C:\Windows\System\vhsgRgp.exe
  C:\Windows\System\vhsgRgp.exe
  2⤵
  PID:8920
- C:\Windows\System\qVqPkYS.exe
  C:\Windows\System\qVqPkYS.exe
  2⤵
  PID:8940
- C:\Windows\System\hirkmdi.exe
  C:\Windows\System\hirkmdi.exe
  2⤵
  PID:8976
- C:\Windows\System\YjHBZVL.exe
  C:\Windows\System\YjHBZVL.exe
  2⤵
  PID:9004
- C:\Windows\System\NrCFnFW.exe
  C:\Windows\System\NrCFnFW.exe
  2⤵
  PID:9032
- C:\Windows\System\cDpjcol.exe
  C:\Windows\System\cDpjcol.exe
  2⤵
  PID:9056
- C:\Windows\System\PmwSmet.exe
  C:\Windows\System\PmwSmet.exe
  2⤵
  PID:9080
- C:\Windows\System\AonFxti.exe
  C:\Windows\System\AonFxti.exe
  2⤵
  PID:9116
- C:\Windows\System\xNOMrUm.exe
  C:\Windows\System\xNOMrUm.exe
  2⤵
  PID:9136
- C:\Windows\System\dUnMtLT.exe
  C:\Windows\System\dUnMtLT.exe
  2⤵
  PID:9164
- C:\Windows\System\HkNilUF.exe
  C:\Windows\System\HkNilUF.exe
  2⤵
  PID:9188
- C:\Windows\System\myTPdJo.exe
  C:\Windows\System\myTPdJo.exe
  2⤵
  PID:8036
- C:\Windows\System\oHYcTxl.exe
  C:\Windows\System\oHYcTxl.exe
  2⤵
  PID:8236
- C:\Windows\System\HTnHDym.exe
  C:\Windows\System\HTnHDym.exe
  2⤵
  PID:8308
- C:\Windows\System\yCugJuN.exe
  C:\Windows\System\yCugJuN.exe
  2⤵
  PID:8256
- C:\Windows\System\WCVYWjE.exe
  C:\Windows\System\WCVYWjE.exe
  2⤵
  PID:8348
- C:\Windows\System\QVJnfUS.exe
  C:\Windows\System\QVJnfUS.exe
  2⤵
  PID:8496
- C:\Windows\System\kxXWUad.exe
  C:\Windows\System\kxXWUad.exe
  2⤵
  PID:8480
- C:\Windows\System\HfTzZeR.exe
  C:\Windows\System\HfTzZeR.exe
  2⤵
  PID:8628
- C:\Windows\System\CBlPBaF.exe
  C:\Windows\System\CBlPBaF.exe
  2⤵
  PID:8716
- C:\Windows\System\xSfYAcS.exe
  C:\Windows\System\xSfYAcS.exe
  2⤵
  PID:8772
- C:\Windows\System\RUrXfFS.exe
  C:\Windows\System\RUrXfFS.exe
  2⤵
  PID:8816
- C:\Windows\System\UEmhLSM.exe
  C:\Windows\System\UEmhLSM.exe
  2⤵
  PID:8856
- C:\Windows\System\uYiXLZr.exe
  C:\Windows\System\uYiXLZr.exe
  2⤵
  PID:8868
- C:\Windows\System\nnRvxiz.exe
  C:\Windows\System\nnRvxiz.exe
  2⤵
  PID:8936
- C:\Windows\System\zPjAwEq.exe
  C:\Windows\System\zPjAwEq.exe
  2⤵
  PID:9052
- C:\Windows\System\vMIVESL.exe
  C:\Windows\System\vMIVESL.exe
  2⤵
  PID:9104
- C:\Windows\System\BNMspoO.exe
  C:\Windows\System\BNMspoO.exe
  2⤵
  PID:9212
- C:\Windows\System\trYLnrj.exe
  C:\Windows\System\trYLnrj.exe
  2⤵
  PID:9200
- C:\Windows\System\ksdfUQt.exe
  C:\Windows\System\ksdfUQt.exe
  2⤵
  PID:9148
- C:\Windows\System\KwkQVbr.exe
  C:\Windows\System\KwkQVbr.exe
  2⤵
  PID:8320
- C:\Windows\System\iMSPDDk.exe
  C:\Windows\System\iMSPDDk.exe
  2⤵
  PID:8680
- C:\Windows\System\ygLuQVT.exe
  C:\Windows\System\ygLuQVT.exe
  2⤵
  PID:8752
- C:\Windows\System\deMzESY.exe
  C:\Windows\System\deMzESY.exe
  2⤵
  PID:8916
- C:\Windows\System\kIPNJVn.exe
  C:\Windows\System\kIPNJVn.exe
  2⤵
  PID:9208
- C:\Windows\System\GCaDvAD.exe
  C:\Windows\System\GCaDvAD.exe
  2⤵
  PID:9000
- C:\Windows\System\htrZSwh.exe
  C:\Windows\System\htrZSwh.exe
  2⤵
  PID:9176
- C:\Windows\System\wRMGkxR.exe
  C:\Windows\System\wRMGkxR.exe
  2⤵
  PID:9092
- C:\Windows\System\MMrusVS.exe
  C:\Windows\System\MMrusVS.exe
  2⤵
  PID:9244
- C:\Windows\System\JvJQWTn.exe
  C:\Windows\System\JvJQWTn.exe
  2⤵
  PID:9280
- C:\Windows\System\ZBOBarx.exe
  C:\Windows\System\ZBOBarx.exe
  2⤵
  PID:9308
- C:\Windows\System\AIssLza.exe
  C:\Windows\System\AIssLza.exe
  2⤵
  PID:9332
- C:\Windows\System\RYCIyUT.exe
  C:\Windows\System\RYCIyUT.exe
  2⤵
  PID:9352
- C:\Windows\System\wkgVwqM.exe
  C:\Windows\System\wkgVwqM.exe
  2⤵
  PID:9380
- C:\Windows\System\SEBszqa.exe
  C:\Windows\System\SEBszqa.exe
  2⤵
  PID:9416
- C:\Windows\System\ePBpmuV.exe
  C:\Windows\System\ePBpmuV.exe
  2⤵
  PID:9444
- C:\Windows\System\tUdGpfN.exe
  C:\Windows\System\tUdGpfN.exe
  2⤵
  PID:9468
- C:\Windows\System\TCMbDDr.exe
  C:\Windows\System\TCMbDDr.exe
  2⤵
  PID:9508
- C:\Windows\System\OwsGwnV.exe
  C:\Windows\System\OwsGwnV.exe
  2⤵
  PID:9536
- C:\Windows\System\UKKooSA.exe
  C:\Windows\System\UKKooSA.exe
  2⤵
  PID:9564
- C:\Windows\System\WThPfCF.exe
  C:\Windows\System\WThPfCF.exe
  2⤵
  PID:9592
- C:\Windows\System\hcnwnft.exe
  C:\Windows\System\hcnwnft.exe
  2⤵
  PID:9616
- C:\Windows\System\MVnSXqZ.exe
  C:\Windows\System\MVnSXqZ.exe
  2⤵
  PID:9644
- C:\Windows\System\NIHhDCh.exe
  C:\Windows\System\NIHhDCh.exe
  2⤵
  PID:9676
- C:\Windows\System\qzZnnPj.exe
  C:\Windows\System\qzZnnPj.exe
  2⤵
  PID:9708
- C:\Windows\System\SnMXylF.exe
  C:\Windows\System\SnMXylF.exe
  2⤵
  PID:9732
- C:\Windows\System\tRfSmtu.exe
  C:\Windows\System\tRfSmtu.exe
  2⤵
  PID:9764
- C:\Windows\System\uxAXuzm.exe
  C:\Windows\System\uxAXuzm.exe
  2⤵
  PID:9788
- C:\Windows\System\ZnVmvzu.exe
  C:\Windows\System\ZnVmvzu.exe
  2⤵
  PID:9840
- C:\Windows\System\hYnuiMp.exe
  C:\Windows\System\hYnuiMp.exe
  2⤵
  PID:9868
- C:\Windows\System\NcqKfuK.exe
  C:\Windows\System\NcqKfuK.exe
  2⤵
  PID:9908
- C:\Windows\System\dSWfAzp.exe
  C:\Windows\System\dSWfAzp.exe
  2⤵
  PID:9944
- C:\Windows\System\wTfTpQR.exe
  C:\Windows\System\wTfTpQR.exe
  2⤵
  PID:9968
- C:\Windows\System\mGRlyQY.exe
  C:\Windows\System\mGRlyQY.exe
  2⤵
  PID:9992
- C:\Windows\System\mCtthWR.exe
  C:\Windows\System\mCtthWR.exe
  2⤵
  PID:10024
- C:\Windows\System\RWGiIGk.exe
  C:\Windows\System\RWGiIGk.exe
  2⤵
  PID:10052
- C:\Windows\System\GTcowbX.exe
  C:\Windows\System\GTcowbX.exe
  2⤵
  PID:10076
- C:\Windows\System\qvxNlQE.exe
  C:\Windows\System\qvxNlQE.exe
  2⤵
  PID:10092
- C:\Windows\System\bfJxbTP.exe
  C:\Windows\System\bfJxbTP.exe
  2⤵
  PID:10112
- C:\Windows\System\vDtxWxO.exe
  C:\Windows\System\vDtxWxO.exe
  2⤵
  PID:10128
- C:\Windows\System\sgkJBZM.exe
  C:\Windows\System\sgkJBZM.exe
  2⤵
  PID:10152
- C:\Windows\System\cIElJHn.exe
  C:\Windows\System\cIElJHn.exe
  2⤵
  PID:10176
- C:\Windows\System\VrzFHBE.exe
  C:\Windows\System\VrzFHBE.exe
  2⤵
  PID:10196
- C:\Windows\System\EukqwoX.exe
  C:\Windows\System\EukqwoX.exe
  2⤵
  PID:10212
- C:\Windows\System\mPpOxOJ.exe
  C:\Windows\System\mPpOxOJ.exe
  2⤵
  PID:9100
- C:\Windows\System\PRRnTra.exe
  C:\Windows\System\PRRnTra.exe
  2⤵
  PID:8956
- C:\Windows\System\rAaxvna.exe
  C:\Windows\System\rAaxvna.exe
  2⤵
  PID:8784
- C:\Windows\System\IyQOXcY.exe
  C:\Windows\System\IyQOXcY.exe
  2⤵
  PID:9256
- C:\Windows\System\JbSHkCS.exe
  C:\Windows\System\JbSHkCS.exe
  2⤵
  PID:9292
- C:\Windows\System\zVZqyuK.exe
  C:\Windows\System\zVZqyuK.exe
  2⤵
  PID:9452
- C:\Windows\System\OcDXpge.exe
  C:\Windows\System\OcDXpge.exe
  2⤵
  PID:9556
- C:\Windows\System\HczhzjY.exe
  C:\Windows\System\HczhzjY.exe
  2⤵
  PID:9608
- C:\Windows\System\ODtjsPx.exe
  C:\Windows\System\ODtjsPx.exe
  2⤵
  PID:9640
- C:\Windows\System\uvfvGxM.exe
  C:\Windows\System\uvfvGxM.exe
  2⤵
  PID:9700
- C:\Windows\System\JJroFuC.exe
  C:\Windows\System\JJroFuC.exe
  2⤵
  PID:9656
- C:\Windows\System\DGUcspP.exe
  C:\Windows\System\DGUcspP.exe
  2⤵
  PID:9748
- C:\Windows\System\NUlWzjt.exe
  C:\Windows\System\NUlWzjt.exe
  2⤵
  PID:9928
- C:\Windows\System\iJMLguw.exe
  C:\Windows\System\iJMLguw.exe
  2⤵
  PID:9852
- C:\Windows\System\ZTZPOVj.exe
  C:\Windows\System\ZTZPOVj.exe
  2⤵
  PID:9988
- C:\Windows\System\dWeflSG.exe
  C:\Windows\System\dWeflSG.exe
  2⤵
  PID:10008
- C:\Windows\System\rGaBjkM.exe
  C:\Windows\System\rGaBjkM.exe
  2⤵
  PID:10144
- C:\Windows\System\NEvlxew.exe
  C:\Windows\System\NEvlxew.exe
  2⤵
  PID:10208
- C:\Windows\System\FpBHWqB.exe
  C:\Windows\System\FpBHWqB.exe
  2⤵
  PID:9268
- C:\Windows\System\cEqoQbT.exe
  C:\Windows\System\cEqoQbT.exe
  2⤵
  PID:9316
- C:\Windows\System\secGLqG.exe
  C:\Windows\System\secGLqG.exe
  2⤵
  PID:9296
- C:\Windows\System\HpsRNOC.exe
  C:\Windows\System\HpsRNOC.exe
  2⤵
  PID:9340
- C:\Windows\System\KvlwqaZ.exe
  C:\Windows\System\KvlwqaZ.exe
  2⤵
  PID:9524
- C:\Windows\System\bgZmkCq.exe
  C:\Windows\System\bgZmkCq.exe
  2⤵
  PID:9628
- C:\Windows\System\hcVhzzu.exe
  C:\Windows\System\hcVhzzu.exe
  2⤵
  PID:10140
- C:\Windows\System\Wxmdnzj.exe
  C:\Windows\System\Wxmdnzj.exe
  2⤵
  PID:9784
- C:\Windows\System\ANgHRLh.exe
  C:\Windows\System\ANgHRLh.exe
  2⤵
  PID:10172
- C:\Windows\System\nDJoAxb.exe
  C:\Windows\System\nDJoAxb.exe
  2⤵
  PID:10060
- C:\Windows\System\wbDhZGT.exe
  C:\Windows\System\wbDhZGT.exe
  2⤵
  PID:10252
- C:\Windows\System\OlHpsFy.exe
  C:\Windows\System\OlHpsFy.exe
  2⤵
  PID:10272
- C:\Windows\System\ocRlaVS.exe
  C:\Windows\System\ocRlaVS.exe
  2⤵
  PID:10312
- C:\Windows\System\UBTLwEN.exe
  C:\Windows\System\UBTLwEN.exe
  2⤵
  PID:10344
- C:\Windows\System\zvtrpMI.exe
  C:\Windows\System\zvtrpMI.exe
  2⤵
  PID:10368
- C:\Windows\System\sseGPPv.exe
  C:\Windows\System\sseGPPv.exe
  2⤵
  PID:10392
- C:\Windows\System\pOfBoqk.exe
  C:\Windows\System\pOfBoqk.exe
  2⤵
  PID:10420
- C:\Windows\System\tuBalJA.exe
  C:\Windows\System\tuBalJA.exe
  2⤵
  PID:10460
- C:\Windows\System\afvaazx.exe
  C:\Windows\System\afvaazx.exe
  2⤵
  PID:10492
- C:\Windows\System\bJHQukx.exe
  C:\Windows\System\bJHQukx.exe
  2⤵
  PID:10520
- C:\Windows\System\VSbDkPv.exe
  C:\Windows\System\VSbDkPv.exe
  2⤵
  PID:10548
- C:\Windows\System\TGObQMo.exe
  C:\Windows\System\TGObQMo.exe
  2⤵
  PID:10576
- C:\Windows\System\HtYjXvH.exe
  C:\Windows\System\HtYjXvH.exe
  2⤵
  PID:10616
- C:\Windows\System\eCryHyT.exe
  C:\Windows\System\eCryHyT.exe
  2⤵
  PID:10640
- C:\Windows\System\aPpouEA.exe
  C:\Windows\System\aPpouEA.exe
  2⤵
  PID:10664
- C:\Windows\System\sNWiWVj.exe
  C:\Windows\System\sNWiWVj.exe
  2⤵
  PID:10700
- C:\Windows\System\SHklLnl.exe
  C:\Windows\System\SHklLnl.exe
  2⤵
  PID:10720
- C:\Windows\System\KPfrVlQ.exe
  C:\Windows\System\KPfrVlQ.exe
  2⤵
  PID:10748
- C:\Windows\System\WlLZrNH.exe
  C:\Windows\System\WlLZrNH.exe
  2⤵
  PID:10772
- C:\Windows\System\KjhIWCl.exe
  C:\Windows\System\KjhIWCl.exe
  2⤵
  PID:10804
- C:\Windows\System\fJqumDA.exe
  C:\Windows\System\fJqumDA.exe
  2⤵
  PID:10832
- C:\Windows\System\wYNTSoD.exe
  C:\Windows\System\wYNTSoD.exe
  2⤵
  PID:10864
- C:\Windows\System\YUvWMol.exe
  C:\Windows\System\YUvWMol.exe
  2⤵
  PID:10884
- C:\Windows\System\zKWysHH.exe
  C:\Windows\System\zKWysHH.exe
  2⤵
  PID:10920
- C:\Windows\System\KxSfqbD.exe
  C:\Windows\System\KxSfqbD.exe
  2⤵
  PID:10952
- C:\Windows\System\CQPewUn.exe
  C:\Windows\System\CQPewUn.exe
  2⤵
  PID:10976
- C:\Windows\System\mEHEhei.exe
  C:\Windows\System\mEHEhei.exe
  2⤵
  PID:11020
- C:\Windows\System\vBXaJBT.exe
  C:\Windows\System\vBXaJBT.exe
  2⤵
  PID:11036
- C:\Windows\System\vprNwFY.exe
  C:\Windows\System\vprNwFY.exe
  2⤵
  PID:11052
- C:\Windows\System\DQbIvpz.exe
  C:\Windows\System\DQbIvpz.exe
  2⤵
  PID:11088
- C:\Windows\System\wippoKG.exe
  C:\Windows\System\wippoKG.exe
  2⤵
  PID:11116
- C:\Windows\System\wXnEMBu.exe
  C:\Windows\System\wXnEMBu.exe
  2⤵
  PID:11132
- C:\Windows\System\DUMbCdO.exe
  C:\Windows\System\DUMbCdO.exe
  2⤵
  PID:11160
- C:\Windows\System\WUKHnsU.exe
  C:\Windows\System\WUKHnsU.exe
  2⤵
  PID:11192
- C:\Windows\System\uzBoHAN.exe
  C:\Windows\System\uzBoHAN.exe
  2⤵
  PID:11212
- C:\Windows\System\RDObIqI.exe
  C:\Windows\System\RDObIqI.exe
  2⤵
  PID:11236
- C:\Windows\System\Xyekscy.exe
  C:\Windows\System\Xyekscy.exe
  2⤵
  PID:9232
- C:\Windows\System\TLvDHlW.exe
  C:\Windows\System\TLvDHlW.exe
  2⤵
  PID:9836
- C:\Windows\System\BXIWpFY.exe
  C:\Windows\System\BXIWpFY.exe
  2⤵
  PID:10124
- C:\Windows\System\qwnmOUb.exe
  C:\Windows\System\qwnmOUb.exe
  2⤵
  PID:10260
- C:\Windows\System\wNicDjJ.exe
  C:\Windows\System\wNicDjJ.exe
  2⤵
  PID:10452
- C:\Windows\System\qQPlUMY.exe
  C:\Windows\System\qQPlUMY.exe
  2⤵
  PID:10508
- C:\Windows\System\uFvGTDr.exe
  C:\Windows\System\uFvGTDr.exe
  2⤵
  PID:10544
- C:\Windows\System\SNCTLnx.exe
  C:\Windows\System\SNCTLnx.exe
  2⤵
  PID:10380
- C:\Windows\System\jzeTmTL.exe
  C:\Windows\System\jzeTmTL.exe
  2⤵
  PID:10484
- C:\Windows\System\FgNCogq.exe
  C:\Windows\System\FgNCogq.exe
  2⤵
  PID:10656
- C:\Windows\System\UjqPmsn.exe
  C:\Windows\System\UjqPmsn.exe
  2⤵
  PID:10708
- C:\Windows\System\fxkvALL.exe
  C:\Windows\System\fxkvALL.exe
  2⤵
  PID:10848
- C:\Windows\System\hNscrBo.exe
  C:\Windows\System\hNscrBo.exe
  2⤵
  PID:10988
- C:\Windows\System\vkgQBpB.exe
  C:\Windows\System\vkgQBpB.exe
  2⤵
  PID:11032
- C:\Windows\System\dEdQzeQ.exe
  C:\Windows\System\dEdQzeQ.exe
  2⤵
  PID:10940
- C:\Windows\System\usKunZM.exe
  C:\Windows\System\usKunZM.exe
  2⤵
  PID:11104
- C:\Windows\System\cFyLhVC.exe
  C:\Windows\System\cFyLhVC.exe
  2⤵
  PID:11204
- C:\Windows\System\gquqCIz.exe
  C:\Windows\System\gquqCIz.exe
  2⤵
  PID:11256
- C:\Windows\System\wXKLPON.exe
  C:\Windows\System\wXKLPON.exe
  2⤵
  PID:11096
- C:\Windows\System\MYWywtJ.exe
  C:\Windows\System\MYWywtJ.exe
  2⤵
  PID:9688
- C:\Windows\System\wcgMHVY.exe
  C:\Windows\System\wcgMHVY.exe
  2⤵
  PID:10388
- C:\Windows\System\JEdYyfO.exe
  C:\Windows\System\JEdYyfO.exe
  2⤵
  PID:9956
- C:\Windows\System\qwkcDZX.exe
  C:\Windows\System\qwkcDZX.exe
  2⤵
  PID:10436
- C:\Windows\System\VpJaiff.exe
  C:\Windows\System\VpJaiff.exe
  2⤵
  PID:10628
- C:\Windows\System\ropbhAp.exe
  C:\Windows\System\ropbhAp.exe
  2⤵
  PID:10744
- C:\Windows\System\hmWenoh.exe
  C:\Windows\System\hmWenoh.exe
  2⤵
  PID:10788
- C:\Windows\System\PbaMEuH.exe
  C:\Windows\System\PbaMEuH.exe
  2⤵
  PID:11176
- C:\Windows\System\YGokjgy.exe
  C:\Windows\System\YGokjgy.exe
  2⤵
  PID:10632
- C:\Windows\System\fxbvqAt.exe
  C:\Windows\System\fxbvqAt.exe
  2⤵
  PID:11272
- C:\Windows\System\sAGvAti.exe
  C:\Windows\System\sAGvAti.exe
  2⤵
  PID:11300
- C:\Windows\System\TUbbNaE.exe
  C:\Windows\System\TUbbNaE.exe
  2⤵
  PID:11320
- C:\Windows\System\jJTWfDd.exe
  C:\Windows\System\jJTWfDd.exe
  2⤵
  PID:11348
- C:\Windows\System\rHmUoGZ.exe
  C:\Windows\System\rHmUoGZ.exe
  2⤵
  PID:11392
- C:\Windows\System\TMgxTTI.exe
  C:\Windows\System\TMgxTTI.exe
  2⤵
  PID:11416
- C:\Windows\System\TnFCGWf.exe
  C:\Windows\System\TnFCGWf.exe
  2⤵
  PID:11452
- C:\Windows\System\utzdgCz.exe
  C:\Windows\System\utzdgCz.exe
  2⤵
  PID:11480
- C:\Windows\System\CdZeUYX.exe
  C:\Windows\System\CdZeUYX.exe
  2⤵
  PID:11500
- C:\Windows\System\IoYlIvf.exe
  C:\Windows\System\IoYlIvf.exe
  2⤵
  PID:11532
- C:\Windows\System\hQUXqpt.exe
  C:\Windows\System\hQUXqpt.exe
  2⤵
  PID:11560
- C:\Windows\System\dRlZRXK.exe
  C:\Windows\System\dRlZRXK.exe
  2⤵
  PID:11592
- C:\Windows\System\wTeUTeT.exe
  C:\Windows\System\wTeUTeT.exe
  2⤵
  PID:11624
- C:\Windows\System\zlXnbyE.exe
  C:\Windows\System\zlXnbyE.exe
  2⤵
  PID:11652
- C:\Windows\System\mQXGWOV.exe
  C:\Windows\System\mQXGWOV.exe
  2⤵
  PID:11680
- C:\Windows\System\keSmHDm.exe
  C:\Windows\System\keSmHDm.exe
  2⤵
  PID:11704
- C:\Windows\System\SanGjTB.exe
  C:\Windows\System\SanGjTB.exe
  2⤵
  PID:11736
- C:\Windows\System\gYcNHck.exe
  C:\Windows\System\gYcNHck.exe
  2⤵
  PID:11760
- C:\Windows\System\YmhpfgX.exe
  C:\Windows\System\YmhpfgX.exe
  2⤵
  PID:11804
- C:\Windows\System\pMHVGNK.exe
  C:\Windows\System\pMHVGNK.exe
  2⤵
  PID:11828
- C:\Windows\System\fIhfrxu.exe
  C:\Windows\System\fIhfrxu.exe
  2⤵
  PID:11852
- C:\Windows\System\LvUDMpA.exe
  C:\Windows\System\LvUDMpA.exe
  2⤵
  PID:11880
- C:\Windows\System\PqIiVaK.exe
  C:\Windows\System\PqIiVaK.exe
  2⤵
  PID:11908
- C:\Windows\System\belEUOh.exe
  C:\Windows\System\belEUOh.exe
  2⤵
  PID:11936
- C:\Windows\System\UCkuEzI.exe
  C:\Windows\System\UCkuEzI.exe
  2⤵
  PID:11960
- C:\Windows\System\fTLowDm.exe
  C:\Windows\System\fTLowDm.exe
  2⤵
  PID:11992
- C:\Windows\System\DPgFzpe.exe
  C:\Windows\System\DPgFzpe.exe
  2⤵
  PID:12016
- C:\Windows\System\oYopLMB.exe
  C:\Windows\System\oYopLMB.exe
  2⤵
  PID:12044
- C:\Windows\System\OEggcsV.exe
  C:\Windows\System\OEggcsV.exe
  2⤵
  PID:12068
- C:\Windows\System\PhlXWZw.exe
  C:\Windows\System\PhlXWZw.exe
  2⤵
  PID:12100
- C:\Windows\System\ZYoByev.exe
  C:\Windows\System\ZYoByev.exe
  2⤵
  PID:12128
- C:\Windows\System\hAXVBjv.exe
  C:\Windows\System\hAXVBjv.exe
  2⤵
  PID:12164
- C:\Windows\System\CLYFANS.exe
  C:\Windows\System\CLYFANS.exe
  2⤵
  PID:12192
- C:\Windows\System\NBrKaLK.exe
  C:\Windows\System\NBrKaLK.exe
  2⤵
  PID:12228
- C:\Windows\System\EzyJNjf.exe
  C:\Windows\System\EzyJNjf.exe
  2⤵
  PID:12252
- C:\Windows\System\KeLQBVY.exe
  C:\Windows\System\KeLQBVY.exe
  2⤵
  PID:12280
- C:\Windows\System\ZvGviAz.exe
  C:\Windows\System\ZvGviAz.exe
  2⤵
  PID:11148
- C:\Windows\System\GPhzYBw.exe
  C:\Windows\System\GPhzYBw.exe
  2⤵
  PID:10728
- C:\Windows\System\nKabQHB.exe
  C:\Windows\System\nKabQHB.exe
  2⤵
  PID:11344
- C:\Windows\System\JUAkcLu.exe
  C:\Windows\System\JUAkcLu.exe
  2⤵
  PID:11180
- C:\Windows\System\hPzOzIG.exe
  C:\Windows\System\hPzOzIG.exe
  2⤵
  PID:11292
- C:\Windows\System\lTTxewu.exe
  C:\Windows\System\lTTxewu.exe
  2⤵
  PID:11464
- C:\Windows\System\aJNiXMX.exe
  C:\Windows\System\aJNiXMX.exe
  2⤵
  PID:11360
- C:\Windows\System\wNaRZBk.exe
  C:\Windows\System\wNaRZBk.exe
  2⤵
  PID:11440
- C:\Windows\System\RnpWDlU.exe
  C:\Windows\System\RnpWDlU.exe
  2⤵
  PID:11516
- C:\Windows\System\XHzFwgi.exe
  C:\Windows\System\XHzFwgi.exe
  2⤵
  PID:11572
- C:\Windows\System\GfGXpnL.exe
  C:\Windows\System\GfGXpnL.exe
  2⤵
  PID:11816
- C:\Windows\System\Dsajvcg.exe
  C:\Windows\System\Dsajvcg.exe
  2⤵
  PID:11616
- C:\Windows\System\ROnJMsd.exe
  C:\Windows\System\ROnJMsd.exe
  2⤵
  PID:11780
- C:\Windows\System\ZfKuNXz.exe
  C:\Windows\System\ZfKuNXz.exe
  2⤵
  PID:11840
- C:\Windows\System\FZWXiah.exe
  C:\Windows\System\FZWXiah.exe
  2⤵
  PID:11752
- C:\Windows\System\zYVJDpI.exe
  C:\Windows\System\zYVJDpI.exe
  2⤵
  PID:11868
- C:\Windows\System\vosvKxs.exe
  C:\Windows\System\vosvKxs.exe
  2⤵
  PID:12204
- C:\Windows\System\dKRLcAJ.exe
  C:\Windows\System\dKRLcAJ.exe
  2⤵
  PID:12036
- C:\Windows\System\OGDSVvf.exe
  C:\Windows\System\OGDSVvf.exe
  2⤵
  PID:12184
- C:\Windows\System\WgEiPdL.exe
  C:\Windows\System\WgEiPdL.exe
  2⤵
  PID:12152
- C:\Windows\System\YMBxfNY.exe
  C:\Windows\System\YMBxfNY.exe
  2⤵
  PID:11488
- C:\Windows\System\RCgdzvh.exe
  C:\Windows\System\RCgdzvh.exe
  2⤵
  PID:10972
- C:\Windows\System\EpSeLHy.exe
  C:\Windows\System\EpSeLHy.exe
  2⤵
  PID:11648
- C:\Windows\System\lxSFgxa.exe
  C:\Windows\System\lxSFgxa.exe
  2⤵
  PID:11284
- C:\Windows\System\PdYzPDA.exe
  C:\Windows\System\PdYzPDA.exe
  2⤵
  PID:11548
- C:\Windows\System\HFfTRRB.exe
  C:\Windows\System\HFfTRRB.exe
  2⤵
  PID:10880
- C:\Windows\System\FAAOFub.exe
  C:\Windows\System\FAAOFub.exe
  2⤵
  PID:12312
- C:\Windows\System\CaRqGyZ.exe
  C:\Windows\System\CaRqGyZ.exe
  2⤵
  PID:12344
- C:\Windows\System\FtrFRXi.exe
  C:\Windows\System\FtrFRXi.exe
  2⤵
  PID:12380
- C:\Windows\System\gnQbAYp.exe
  C:\Windows\System\gnQbAYp.exe
  2⤵
  PID:12404
- C:\Windows\System\kwSiHCC.exe
  C:\Windows\System\kwSiHCC.exe
  2⤵
  PID:12428
- C:\Windows\System\FkaJilE.exe
  C:\Windows\System\FkaJilE.exe
  2⤵
  PID:12448
- C:\Windows\System\DIQCCPR.exe
  C:\Windows\System\DIQCCPR.exe
  2⤵
  PID:12476
- C:\Windows\System\SNCBFxr.exe
  C:\Windows\System\SNCBFxr.exe
  2⤵
  PID:12504
- C:\Windows\System\szTXFrF.exe
  C:\Windows\System\szTXFrF.exe
  2⤵
  PID:12536
- C:\Windows\System\UZDyqCS.exe
  C:\Windows\System\UZDyqCS.exe
  2⤵
  PID:12560
- C:\Windows\System\hGUFHJf.exe
  C:\Windows\System\hGUFHJf.exe
  2⤵
  PID:12588
- C:\Windows\System\VAohhcl.exe
  C:\Windows\System\VAohhcl.exe
  2⤵
  PID:12616
- C:\Windows\System\OQzAohM.exe
  C:\Windows\System\OQzAohM.exe
  2⤵
  PID:12640
- C:\Windows\System\vCFbfDv.exe
  C:\Windows\System\vCFbfDv.exe
  2⤵
  PID:12660
- C:\Windows\System\vKGrGQO.exe
  C:\Windows\System\vKGrGQO.exe
  2⤵
  PID:12708
- C:\Windows\System\SogbleD.exe
  C:\Windows\System\SogbleD.exe
  2⤵
  PID:12736
- C:\Windows\System\eEMPnaT.exe
  C:\Windows\System\eEMPnaT.exe
  2⤵
  PID:12760
- C:\Windows\System\VLlnvfx.exe
  C:\Windows\System\VLlnvfx.exe
  2⤵
  PID:12792
- C:\Windows\System\BwHDJPz.exe
  C:\Windows\System\BwHDJPz.exe
  2⤵
  PID:12824
- C:\Windows\System\bdnsBFH.exe
  C:\Windows\System\bdnsBFH.exe
  2⤵
  PID:12856
- C:\Windows\System\rvyTKls.exe
  C:\Windows\System\rvyTKls.exe
  2⤵
  PID:12880
- C:\Windows\System\bLYuYVi.exe
  C:\Windows\System\bLYuYVi.exe
  2⤵
  PID:12908
- C:\Windows\System\IInhUuk.exe
  C:\Windows\System\IInhUuk.exe
  2⤵
  PID:12936
- C:\Windows\System\oRbcLvv.exe
  C:\Windows\System\oRbcLvv.exe
  2⤵
  PID:12964
- C:\Windows\System\RXBVjhB.exe
  C:\Windows\System\RXBVjhB.exe
  2⤵
  PID:12992
- C:\Windows\System\fHiDPkL.exe
  C:\Windows\System\fHiDPkL.exe
  2⤵
  PID:13016
- C:\Windows\System\JpqNMUn.exe
  C:\Windows\System\JpqNMUn.exe
  2⤵
  PID:13044
- C:\Windows\System\xqhwsYZ.exe
  C:\Windows\System\xqhwsYZ.exe
  2⤵
  PID:13076
- C:\Windows\System\KGTTlub.exe
  C:\Windows\System\KGTTlub.exe
  2⤵
  PID:13104
- C:\Windows\System\YYxkKMF.exe
  C:\Windows\System\YYxkKMF.exe
  2⤵
  PID:13132
- C:\Windows\System\GzMlmvi.exe
  C:\Windows\System\GzMlmvi.exe
  2⤵
  PID:13160
- C:\Windows\System\bEDNKTT.exe
  C:\Windows\System\bEDNKTT.exe
  2⤵
  PID:13188
- C:\Windows\System\UIMQVbz.exe
  C:\Windows\System\UIMQVbz.exe
  2⤵
  PID:13220
- C:\Windows\System\siePKEc.exe
  C:\Windows\System\siePKEc.exe
  2⤵
  PID:13244
- C:\Windows\System\wwsvMiz.exe
  C:\Windows\System\wwsvMiz.exe
  2⤵
  PID:13268
- C:\Windows\System\VSmWvNj.exe
  C:\Windows\System\VSmWvNj.exe
  2⤵
  PID:13296
- C:\Windows\System\UfJPHjZ.exe
  C:\Windows\System\UfJPHjZ.exe
  2⤵
  PID:12112
- C:\Windows\System\mcpwXIi.exe
  C:\Windows\System\mcpwXIi.exe
  2⤵
  PID:12216
- C:\Windows\System\FUQUfWQ.exe
  C:\Windows\System\FUQUfWQ.exe
  2⤵
  PID:12096
- C:\Windows\System\wGneKAd.exe
  C:\Windows\System\wGneKAd.exe
  2⤵
  PID:12364
- C:\Windows\System\DuoTTCY.exe
  C:\Windows\System\DuoTTCY.exe
  2⤵
  PID:12392
- C:\Windows\System\usYbxYa.exe
  C:\Windows\System\usYbxYa.exe
  2⤵
  PID:12268
- C:\Windows\System\urfzpdK.exe
  C:\Windows\System\urfzpdK.exe
  2⤵
  PID:12328
- C:\Windows\System\dYyIDPY.exe
  C:\Windows\System\dYyIDPY.exe
  2⤵
  PID:12532
- C:\Windows\System\kTOUioM.exe
  C:\Windows\System\kTOUioM.exe
  2⤵
  PID:12600
- C:\Windows\System\dwWLLjV.exe
  C:\Windows\System\dwWLLjV.exe
  2⤵
  PID:12688
- C:\Windows\System\cFySgKt.exe
  C:\Windows\System\cFySgKt.exe
  2⤵
  PID:12468
- C:\Windows\System\oQFrkJT.exe
  C:\Windows\System\oQFrkJT.exe
  2⤵
  PID:12676
- C:\Windows\System\nemaoPJ.exe
  C:\Windows\System\nemaoPJ.exe
  2⤵
  PID:12840
- C:\Windows\System\JsRNNrZ.exe
  C:\Windows\System\JsRNNrZ.exe
  2⤵
  PID:12812
- C:\Windows\System\HlOtfjc.exe
  C:\Windows\System\HlOtfjc.exe
  2⤵
  PID:12956
- C:\Windows\System\crnGAYc.exe
  C:\Windows\System\crnGAYc.exe
  2⤵
  PID:12808
- C:\Windows\System\PatsVVW.exe
  C:\Windows\System\PatsVVW.exe
  2⤵
  PID:12836
- C:\Windows\System\KeJrTSn.exe
  C:\Windows\System\KeJrTSn.exe
  2⤵
  PID:13056
- C:\Windows\System\eEdVmXW.exe
  C:\Windows\System\eEdVmXW.exe
  2⤵
  PID:13256
- C:\Windows\System\OVsDPrF.exe
  C:\Windows\System\OVsDPrF.exe
  2⤵
  PID:13152
- C:\Windows\System\PdsWoMg.exe
  C:\Windows\System\PdsWoMg.exe
  2⤵
  PID:13204
- C:\Windows\System\FqkcRIl.exe
  C:\Windows\System\FqkcRIl.exe
  2⤵
  PID:13240
- C:\Windows\System\KCxadOG.exe
  C:\Windows\System\KCxadOG.exe
  2⤵
  PID:12292
- C:\Windows\System\GqVQSyk.exe
  C:\Windows\System\GqVQSyk.exe
  2⤵
  PID:12496
- C:\Windows\System\zOmBOAp.exe
  C:\Windows\System\zOmBOAp.exe
  2⤵
  PID:12580
- C:\Windows\System\hXrHUvm.exe
  C:\Windows\System\hXrHUvm.exe
  2⤵
  PID:12436
- C:\Windows\System\HeUhTdr.exe
  C:\Windows\System\HeUhTdr.exe
  2⤵
  PID:13064
- C:\Windows\System\sILXvzT.exe
  C:\Windows\System\sILXvzT.exe
  2⤵
  PID:13332
- C:\Windows\System\WAKWvzK.exe
  C:\Windows\System\WAKWvzK.exe
  2⤵
  PID:13368
- C:\Windows\System\ZaNVceA.exe
  C:\Windows\System\ZaNVceA.exe
  2⤵
  PID:13392
- C:\Windows\System\ugfblyB.exe
  C:\Windows\System\ugfblyB.exe
  2⤵
  PID:13416
- C:\Windows\System\QnEsSVh.exe
  C:\Windows\System\QnEsSVh.exe
  2⤵
  PID:13436
- C:\Windows\System\mpojRsU.exe
  C:\Windows\System\mpojRsU.exe
  2⤵
  PID:13464
- C:\Windows\System\XZyfzRF.exe
  C:\Windows\System\XZyfzRF.exe
  2⤵
  PID:13492
- C:\Windows\System\FVNWnPP.exe
  C:\Windows\System\FVNWnPP.exe
  2⤵
  PID:13516
- C:\Windows\System\IWYkbzx.exe
  C:\Windows\System\IWYkbzx.exe
  2⤵
  PID:13536
- C:\Windows\System\AlJHWth.exe
  C:\Windows\System\AlJHWth.exe
  2⤵
  PID:13556
- C:\Windows\System\PVKgndh.exe
  C:\Windows\System\PVKgndh.exe
  2⤵
  PID:13592
- C:\Windows\System\MBqzrTy.exe
  C:\Windows\System\MBqzrTy.exe
  2⤵
  PID:13612
- C:\Windows\System\YNxmmxf.exe
  C:\Windows\System\YNxmmxf.exe
  2⤵
  PID:13636
- C:\Windows\System\EHluJVP.exe
  C:\Windows\System\EHluJVP.exe
  2⤵
  PID:13668
- C:\Windows\System\DWpgOUZ.exe
  C:\Windows\System\DWpgOUZ.exe
  2⤵
  PID:13688
- C:\Windows\System\GWYAgMh.exe
  C:\Windows\System\GWYAgMh.exe
  2⤵
  PID:13708
- C:\Windows\System\JlMYUPI.exe
  C:\Windows\System\JlMYUPI.exe
  2⤵
  PID:13740
- C:\Windows\System\tSSzpaI.exe
  C:\Windows\System\tSSzpaI.exe
  2⤵
  PID:13764
- C:\Windows\System\MVqlfGE.exe
  C:\Windows\System\MVqlfGE.exe
  2⤵
  PID:13784
- C:\Windows\System\joicINY.exe
  C:\Windows\System\joicINY.exe
  2⤵
  PID:13804
- C:\Windows\System\ffpZBxn.exe
  C:\Windows\System\ffpZBxn.exe
  2⤵
  PID:13836
- C:\Windows\System\HKQuYFF.exe
  C:\Windows\System\HKQuYFF.exe
  2⤵
  PID:13860
- C:\Windows\System\AhiCjqf.exe
  C:\Windows\System\AhiCjqf.exe
  2⤵
  PID:13888
- C:\Windows\System\qVmmjdC.exe
  C:\Windows\System\qVmmjdC.exe
  2⤵
  PID:13904
- C:\Windows\System\ANjMmtM.exe
  C:\Windows\System\ANjMmtM.exe
  2⤵
  PID:13936
- C:\Windows\System\WnqArdv.exe
  C:\Windows\System\WnqArdv.exe
  2⤵
  PID:13960
- C:\Windows\System\MUdPUBB.exe
  C:\Windows\System\MUdPUBB.exe
  2⤵
  PID:13984
- C:\Windows\System\ePdcoFA.exe
  C:\Windows\System\ePdcoFA.exe
  2⤵
  PID:14008
- C:\Windows\System\wyppAsR.exe
  C:\Windows\System\wyppAsR.exe
  2⤵
  PID:14032
- C:\Windows\System\tyEXyWE.exe
  C:\Windows\System\tyEXyWE.exe
  2⤵
  PID:14056
- C:\Windows\System\gwyqWtL.exe
  C:\Windows\System\gwyqWtL.exe
  2⤵
  PID:14088
- C:\Windows\System\jeVfsYn.exe
  C:\Windows\System\jeVfsYn.exe
  2⤵
  PID:14108
- C:\Windows\System\dBKzjZx.exe
  C:\Windows\System\dBKzjZx.exe
  2⤵
  PID:14136
- C:\Windows\System\HnAmKkw.exe
  C:\Windows\System\HnAmKkw.exe
  2⤵
  PID:14168
- C:\Windows\System\foqrpAF.exe
  C:\Windows\System\foqrpAF.exe
  2⤵
  PID:14192
- C:\Windows\System\gwBwgzn.exe
  C:\Windows\System\gwBwgzn.exe
  2⤵
  PID:14220
- C:\Windows\System\WovFbup.exe
  C:\Windows\System\WovFbup.exe
  2⤵
  PID:14248
- C:\Windows\System\wkFfYTH.exe
  C:\Windows\System\wkFfYTH.exe
  2⤵
  PID:14276
- C:\Windows\System\pMvguwu.exe
  C:\Windows\System\pMvguwu.exe
  2⤵
  PID:14304
- C:\Windows\System\ZBIvoPZ.exe
  C:\Windows\System\ZBIvoPZ.exe
  2⤵
  PID:14332
- C:\Windows\System\twNRtVf.exe
  C:\Windows\System\twNRtVf.exe
  2⤵
  PID:13228
- C:\Windows\System\ryaDwax.exe
  C:\Windows\System\ryaDwax.exe
  2⤵
  PID:12568
- C:\Windows\System\jJdsSwt.exe
  C:\Windows\System\jJdsSwt.exe
  2⤵
  PID:11688
- C:\Windows\System\WZMHcof.exe
  C:\Windows\System\WZMHcof.exe
  2⤵
  PID:12988
- C:\Windows\System\HtaDfxz.exe
  C:\Windows\System\HtaDfxz.exe
  2⤵
  PID:13380
- C:\Windows\System\PREvpnJ.exe
  C:\Windows\System\PREvpnJ.exe
  2⤵
  PID:11848
- C:\Windows\System\VZSQjlR.exe
  C:\Windows\System\VZSQjlR.exe
  2⤵
  PID:13472
- C:\Windows\System\JOobPii.exe
  C:\Windows\System\JOobPii.exe
  2⤵
  PID:13352
- C:\Windows\System\hlcpxav.exe
  C:\Windows\System\hlcpxav.exe
  2⤵
  PID:13400
- C:\Windows\System\XcqMZzN.exe
  C:\Windows\System\XcqMZzN.exe
  2⤵
  PID:13628
- C:\Windows\System\EcbUmCq.exe
  C:\Windows\System\EcbUmCq.exe
  2⤵
  PID:13696
- C:\Windows\System\BvmaCCS.exe
  C:\Windows\System\BvmaCCS.exe
  2⤵
  PID:13576
- C:\Windows\System\lTFsenS.exe
  C:\Windows\System\lTFsenS.exe
  2⤵
  PID:13624
- C:\Windows\System\tRmyHGL.exe
  C:\Windows\System\tRmyHGL.exe
  2⤵
  PID:13728
- C:\Windows\System\lDdxlvj.exe
  C:\Windows\System\lDdxlvj.exe
  2⤵
  PID:13552
- C:\Windows\System\PVDMBIs.exe
  C:\Windows\System\PVDMBIs.exe
  2⤵
  PID:14044
- C:\Windows\System\iCbOUAL.exe
  C:\Windows\System\iCbOUAL.exe
  2⤵
  PID:14080
- C:\Windows\System\UGFYwSO.exe
  C:\Windows\System\UGFYwSO.exe
  2⤵
  PID:13968
- C:\Windows\System\dLqkjSQ.exe
  C:\Windows\System\dLqkjSQ.exe
  2⤵
  PID:14004
- C:\Windows\System\sMSGQQO.exe
  C:\Windows\System\sMSGQQO.exe
  2⤵
  PID:13828
- C:\Windows\System\juAMRXU.exe
  C:\Windows\System\juAMRXU.exe
  2⤵
  PID:14256
- C:\Windows\System\LEwtdjU.exe
  C:\Windows\System\LEwtdjU.exe
  2⤵
  PID:14320
- C:\Windows\System\MMQVZKB.exe
  C:\Windows\System\MMQVZKB.exe
  2⤵
  PID:14128
- C:\Windows\System\VQPYuBr.exe
  C:\Windows\System\VQPYuBr.exe
  2⤵
  PID:14180
- C:\Windows\System\EVgfblc.exe
  C:\Windows\System\EVgfblc.exe
  2⤵
  PID:14096
- C:\Windows\System\aiULmoG.exe
  C:\Windows\System\aiULmoG.exe
  2⤵
  PID:13684
- C:\Windows\System\amSKBxD.exe
  C:\Windows\System\amSKBxD.exe
  2⤵
  PID:14368
- C:\Windows\System\KBYoWuO.exe
  C:\Windows\System\KBYoWuO.exe
  2⤵
  PID:14404
- C:\Windows\System\WrSYwBw.exe
  C:\Windows\System\WrSYwBw.exe
  2⤵
  PID:14436
- C:\Windows\System\hCwaNlG.exe
  C:\Windows\System\hCwaNlG.exe
  2⤵
  PID:14460
- C:\Windows\System\fVeRsRw.exe
  C:\Windows\System\fVeRsRw.exe
  2⤵
  PID:14480
- C:\Windows\System\szobnOA.exe
  C:\Windows\System\szobnOA.exe
  2⤵
  PID:14500
- C:\Windows\System\EBWuTaY.exe
  C:\Windows\System\EBWuTaY.exe
  2⤵
  PID:14532
- C:\Windows\System\jFzafTj.exe
  C:\Windows\System\jFzafTj.exe
  2⤵
  PID:14552
- C:\Windows\System\DqKsLeB.exe
  C:\Windows\System\DqKsLeB.exe
  2⤵
  PID:14576
- C:\Windows\System\ZvVqIOC.exe
  C:\Windows\System\ZvVqIOC.exe
  2⤵
  PID:14596
- C:\Windows\System\wCJNhoO.exe
  C:\Windows\System\wCJNhoO.exe
  2⤵
  PID:14620
- C:\Windows\System\YQAeGzm.exe
  C:\Windows\System\YQAeGzm.exe
  2⤵
  PID:14660
- C:\Windows\System\PAtOqcO.exe
  C:\Windows\System\PAtOqcO.exe
  2⤵
  PID:14692
- C:\Windows\System\TOovRDt.exe
  C:\Windows\System\TOovRDt.exe
  2⤵
  PID:14720
- C:\Windows\System\vMFHEpD.exe
  C:\Windows\System\vMFHEpD.exe
  2⤵
  PID:14740
- C:\Windows\System\SfUkQmD.exe
  C:\Windows\System\SfUkQmD.exe
  2⤵
  PID:14772
- C:\Windows\System\nAFSdrP.exe
  C:\Windows\System\nAFSdrP.exe
  2⤵
  PID:14792
- C:\Windows\System\MrhkorS.exe
  C:\Windows\System\MrhkorS.exe
  2⤵
  PID:14812
- C:\Windows\System\cmMAZAS.exe
  C:\Windows\System\cmMAZAS.exe
  2⤵
  PID:14856
- C:\Windows\System\ZgMPBLy.exe
  C:\Windows\System\ZgMPBLy.exe
  2⤵
  PID:14876
- C:\Windows\System\xBcaDbv.exe
  C:\Windows\System\xBcaDbv.exe
  2⤵
  PID:14908
- C:\Windows\System\FWITeHw.exe
  C:\Windows\System\FWITeHw.exe
  2⤵
  PID:14932
- C:\Windows\System\Aoijjkv.exe
  C:\Windows\System\Aoijjkv.exe
  2⤵
  PID:14960
- C:\Windows\System\iCfjIZO.exe
  C:\Windows\System\iCfjIZO.exe
  2⤵
  PID:14984
- C:\Windows\System\nmalVYA.exe
  C:\Windows\System\nmalVYA.exe
  2⤵
  PID:15004
- C:\Windows\System\pYwaSvn.exe
  C:\Windows\System\pYwaSvn.exe
  2⤵
  PID:15196
- C:\Windows\System\AuPtyTg.exe
  C:\Windows\System\AuPtyTg.exe
  2⤵
  PID:15216
- C:\Windows\System\iyPISEV.exe
  C:\Windows\System\iyPISEV.exe
  2⤵
  PID:15236
- C:\Windows\System\uiLMkSj.exe
  C:\Windows\System\uiLMkSj.exe
  2⤵
  PID:15280
- C:\Windows\System\tHtLBUp.exe
  C:\Windows\System\tHtLBUp.exe
  2⤵
  PID:15328
- C:\Windows\System\DWUpeDc.exe
  C:\Windows\System\DWUpeDc.exe
  2⤵
  PID:13528
- C:\Windows\System\AUUBUhI.exe
  C:\Windows\System\AUUBUhI.exe
  2⤵
  PID:14064
- C:\Windows\System\kTxRvai.exe
  C:\Windows\System\kTxRvai.exe
  2⤵
  PID:13956
- C:\Windows\System\ATVFJOt.exe
  C:\Windows\System\ATVFJOt.exe
  2⤵
  PID:14884
- C:\Windows\System\IPCdSNz.exe
  C:\Windows\System\IPCdSNz.exe
  2⤵
  PID:14900
- C:\Windows\System\JCoEQpl.exe
  C:\Windows\System\JCoEQpl.exe
  2⤵
  PID:14928
- C:\Windows\System\HcIMqwQ.exe
  C:\Windows\System\HcIMqwQ.exe
  2⤵
  PID:14976
- C:\Windows\System\WvGjEHq.exe
  C:\Windows\System\WvGjEHq.exe
  2⤵
  PID:14668
- C:\Windows\System\xEXPFKk.exe
  C:\Windows\System\xEXPFKk.exe
  2⤵
  PID:15068
- C:\Windows\System\mokWGLc.exe
  C:\Windows\System\mokWGLc.exe
  2⤵
  PID:14864
- C:\Windows\System\SidrNro.exe
  C:\Windows\System\SidrNro.exe
  2⤵
  PID:14676
- C:\Windows\System\JflTkXv.exe
  C:\Windows\System\JflTkXv.exe
  2⤵
  PID:14784
- C:\Windows\System\JGttqJJ.exe
  C:\Windows\System\JGttqJJ.exe
  2⤵
  PID:14820
- C:\Windows\System\vIpMDgi.exe
  C:\Windows\System\vIpMDgi.exe
  2⤵
  PID:15088
- C:\Windows\System\swKVsdj.exe
  C:\Windows\System\swKVsdj.exe
  2⤵
  PID:15136
- C:\Windows\System\ChuPWUs.exe
  C:\Windows\System\ChuPWUs.exe
  2⤵
  PID:14296
- C:\Windows\System\oAbHgcK.exe
  C:\Windows\System\oAbHgcK.exe
  2⤵
  PID:15188
- C:\Windows\System\TYOyvkj.exe
  C:\Windows\System\TYOyvkj.exe
  2⤵
  PID:15288
- C:\Windows\System\IlQNuyP.exe
  C:\Windows\System\IlQNuyP.exe
  2⤵
  PID:15180
- C:\Windows\System\JvpSzPG.exe
  C:\Windows\System\JvpSzPG.exe
  2⤵
  PID:15252
- C:\Windows\System\SIqwfZo.exe
  C:\Windows\System\SIqwfZo.exe
  2⤵
  PID:14288
- C:\Windows\System\psWiAuU.exe
  C:\Windows\System\psWiAuU.exe
  2⤵
  PID:14652
- C:\Windows\System\XrJbbgq.exe
  C:\Windows\System\XrJbbgq.exe
  2⤵
  PID:14084
- C:\Windows\System\VOYYHze.exe
  C:\Windows\System\VOYYHze.exe
  2⤵
  PID:14920
- C:\Windows\System\ZyvmVxD.exe
  C:\Windows\System\ZyvmVxD.exe
  2⤵
  PID:14428
- C:\Windows\System\fCPLyhD.exe
  C:\Windows\System\fCPLyhD.exe
  2⤵
  PID:14752
- C:\Windows\System\yuCdDWK.exe
  C:\Windows\System\yuCdDWK.exe
  2⤵
  PID:15048
- C:\Windows\System\tMjbQmo.exe
  C:\Windows\System\tMjbQmo.exe
  2⤵
  PID:748
- C:\Windows\System\ivNmnzr.exe
  C:\Windows\System\ivNmnzr.exe
  2⤵
  PID:15304
- C:\Windows\System\cHosGlf.exe
  C:\Windows\System\cHosGlf.exe
  2⤵
  PID:15228
- C:\Windows\System\aPZHDtP.exe
  C:\Windows\System\aPZHDtP.exe
  2⤵
  PID:15208
- C:\Windows\System\nvPktQy.exe
  C:\Windows\System\nvPktQy.exe
  2⤵
  PID:14636
- C:\Windows\System\TYcSccz.exe
  C:\Windows\System\TYcSccz.exe
  2⤵
  PID:15164
- C:\Windows\System\FamrCCh.exe
  C:\Windows\System\FamrCCh.exe
  2⤵
  PID:14764
- C:\Windows\System\nAuERWO.exe
  C:\Windows\System\nAuERWO.exe
  2⤵
  PID:15260
- C:\Windows\System\aRsZsKl.exe
  C:\Windows\System\aRsZsKl.exe
  2⤵
  PID:15392
- C:\Windows\System\JQXUBrk.exe
  C:\Windows\System\JQXUBrk.exe
  2⤵
  PID:15420
- C:\Windows\System\JsiadYA.exe
  C:\Windows\System\JsiadYA.exe
  2⤵
  PID:15444
- C:\Windows\System\LACGbmd.exe
  C:\Windows\System\LACGbmd.exe
  2⤵
  PID:15460
- C:\Windows\System\ExBeKTd.exe
  C:\Windows\System\ExBeKTd.exe
  2⤵
  PID:15484
- C:\Windows\System\ILBJIJS.exe
  C:\Windows\System\ILBJIJS.exe
  2⤵
  PID:15516
- C:\Windows\System\yhSCWCH.exe
  C:\Windows\System\yhSCWCH.exe
  2⤵
  PID:15540
- C:\Windows\System\QIBhqeU.exe
  C:\Windows\System\QIBhqeU.exe
  2⤵
  PID:15564
- C:\Windows\System\aYEMelN.exe
  C:\Windows\System\aYEMelN.exe
  2⤵
  PID:15580
- C:\Windows\System\CYrlUBh.exe
  C:\Windows\System\CYrlUBh.exe
  2⤵
  PID:15596
- C:\Windows\System\oBCMFvh.exe
  C:\Windows\System\oBCMFvh.exe
  2⤵
  PID:15616
- C:\Windows\System\qdWSnqU.exe
  C:\Windows\System\qdWSnqU.exe
  2⤵
  PID:15636
- C:\Windows\System\dfqnmlc.exe
  C:\Windows\System\dfqnmlc.exe
  2⤵
  PID:15652
- C:\Windows\System\wDtndDU.exe
  C:\Windows\System\wDtndDU.exe
  2⤵
  PID:15672
- C:\Windows\System\zOHotzU.exe
  C:\Windows\System\zOHotzU.exe
  2⤵
  PID:15700
- C:\Windows\System\gImMTnK.exe
  C:\Windows\System\gImMTnK.exe
  2⤵
  PID:15732
- C:\Windows\System\sxhjKhD.exe
  C:\Windows\System\sxhjKhD.exe
  2⤵
  PID:15752
- C:\Windows\System\qRGMgZS.exe
  C:\Windows\System\qRGMgZS.exe
  2⤵
  PID:15768
- C:\Windows\System\fjzqqgQ.exe
  C:\Windows\System\fjzqqgQ.exe
  2⤵
  PID:15788
- C:\Windows\System\YJiBcZw.exe
  C:\Windows\System\YJiBcZw.exe
  2⤵
  PID:15836
- C:\Windows\System\VvfLwwr.exe
  C:\Windows\System\VvfLwwr.exe
  2⤵
  PID:15856
- C:\Windows\System\vFVCdrQ.exe
  C:\Windows\System\vFVCdrQ.exe
  2⤵
  PID:15872
- C:\Windows\System\pnZlKiY.exe
  C:\Windows\System\pnZlKiY.exe
  2⤵
  PID:15904
- C:\Windows\System\OZJRlNi.exe
  C:\Windows\System\OZJRlNi.exe
  2⤵
  PID:15928
- C:\Windows\System\jXPEIps.exe
  C:\Windows\System\jXPEIps.exe
  2⤵
  PID:15964
- C:\Windows\System\ifzNrEY.exe
  C:\Windows\System\ifzNrEY.exe
  2⤵
  PID:15980
- C:\Windows\System\EDwUFhu.exe
  C:\Windows\System\EDwUFhu.exe
  2⤵
  PID:16004
- C:\Windows\System\YPMaiPZ.exe
  C:\Windows\System\YPMaiPZ.exe
  2⤵
  PID:16032
- C:\Windows\System\IYScFqO.exe
  C:\Windows\System\IYScFqO.exe
  2⤵
  PID:16056
- C:\Windows\System\gRnWhnC.exe
  C:\Windows\System\gRnWhnC.exe
  2⤵
  PID:16072
- C:\Windows\System\NoceGEB.exe
  C:\Windows\System\NoceGEB.exe
  2⤵
  PID:16112
- C:\Windows\System\WfJYZiD.exe
  C:\Windows\System\WfJYZiD.exe
  2⤵
  PID:16132
- C:\Windows\System\rUSakQW.exe
  C:\Windows\System\rUSakQW.exe
  2⤵
  PID:16152
- C:\Windows\System\EzDLtrF.exe
  C:\Windows\System\EzDLtrF.exe
  2⤵
  PID:16180
- C:\Windows\System\EBeEIGL.exe
  C:\Windows\System\EBeEIGL.exe
  2⤵
  PID:16208
- C:\Windows\System\QZTnMyM.exe
  C:\Windows\System\QZTnMyM.exe
  2⤵
  PID:16236
- C:\Windows\System\teKNOBs.exe
  C:\Windows\System\teKNOBs.exe
  2⤵
  PID:16256
- C:\Windows\System\JbOSuDW.exe
  C:\Windows\System\JbOSuDW.exe
  2⤵
  PID:16288
- C:\Windows\System\sVrdRsJ.exe
  C:\Windows\System\sVrdRsJ.exe
  2⤵
  PID:16304
- C:\Windows\System\CgezUkY.exe
  C:\Windows\System\CgezUkY.exe
  2⤵
  PID:16340
- C:\Windows\System\XauXJSQ.exe
  C:\Windows\System\XauXJSQ.exe
  2⤵
  PID:16356
- C:\Windows\System\FVOAgQo.exe
  C:\Windows\System\FVOAgQo.exe
  2⤵
  PID:13308
- C:\Windows\System\IbzaQIX.exe
  C:\Windows\System\IbzaQIX.exe
  2⤵
  PID:15096
- C:\Windows\System\vPDWFdq.exe
  C:\Windows\System\vPDWFdq.exe
  2⤵
  PID:15436
- C:\Windows\System\AMZXYRG.exe
  C:\Windows\System\AMZXYRG.exe
  2⤵
  PID:15536
- C:\Windows\System\bllMAmC.exe
  C:\Windows\System\bllMAmC.exe
  2⤵
  PID:15608
- C:\Windows\System\dyCIepP.exe
  C:\Windows\System\dyCIepP.exe
  2⤵
  PID:15528
- C:\Windows\System\Gvycxap.exe
  C:\Windows\System\Gvycxap.exe
  2⤵
  PID:15680
- C:\Windows\System\FqZBNbr.exe
  C:\Windows\System\FqZBNbr.exe
  2⤵
  PID:15720
- C:\Windows\System\dthtHlS.exe
  C:\Windows\System\dthtHlS.exe
  2⤵
  PID:15764
- C:\Windows\System\WfcLkMV.exe
  C:\Windows\System\WfcLkMV.exe
  2⤵
  PID:15816
- C:\Windows\System\EaZkbKa.exe
  C:\Windows\System\EaZkbKa.exe
  2⤵
  PID:15852
- C:\Windows\System\HsWftpd.exe
  C:\Windows\System\HsWftpd.exe
  2⤵
  PID:15924
- C:\Windows\System\ghaBUbl.exe
  C:\Windows\System\ghaBUbl.exe
  2⤵
  PID:15976
- C:\Windows\System\OkkxIAm.exe
  C:\Windows\System\OkkxIAm.exe
  2⤵
  PID:16096
- C:\Windows\System\IxozjBl.exe
  C:\Windows\System\IxozjBl.exe
  2⤵
  PID:16028
- C:\Windows\System\hesieJg.exe
  C:\Windows\System\hesieJg.exe
  2⤵
  PID:16244
- C:\Windows\System\iMtuEGv.exe
  C:\Windows\System\iMtuEGv.exe
  2⤵
  PID:16280
- C:\Windows\System\njiQLOS.exe
  C:\Windows\System\njiQLOS.exe
  2⤵
  PID:16368
- C:\Windows\System\DJnBaxC.exe
  C:\Windows\System\DJnBaxC.exe
  2⤵
  PID:16232
- C:\Windows\System\vmazOla.exe
  C:\Windows\System\vmazOla.exe
  2⤵
  PID:15468
- C:\Windows\System\qnVKmzH.exe
  C:\Windows\System\qnVKmzH.exe
  2⤵
  PID:16392
- C:\Windows\System\UekHkFa.exe
  C:\Windows\System\UekHkFa.exe
  2⤵
  PID:16420
- C:\Windows\System\yxkdUWC.exe
  C:\Windows\System\yxkdUWC.exe
  2⤵
  PID:16444
- C:\Windows\System\BApJHPS.exe
  C:\Windows\System\BApJHPS.exe
  2⤵
  PID:16476
- C:\Windows\System\FutDFsg.exe
  C:\Windows\System\FutDFsg.exe
  2⤵
  PID:16496
- C:\Windows\System\OPmgYeb.exe
  C:\Windows\System\OPmgYeb.exe
  2⤵
  PID:16528
- C:\Windows\System\CJuLfDB.exe
  C:\Windows\System\CJuLfDB.exe
  2⤵
  PID:16576
- C:\Windows\System\lBNjgaz.exe
  C:\Windows\System\lBNjgaz.exe
  2⤵
  PID:16592
- C:\Windows\System\nzLyhli.exe
  C:\Windows\System\nzLyhli.exe
  2⤵
  PID:16620
- C:\Windows\System\fXoxBNd.exe
  C:\Windows\System\fXoxBNd.exe
  2⤵
  PID:16652
- C:\Windows\System\TCuMsBo.exe
  C:\Windows\System\TCuMsBo.exe
  2⤵
  PID:16676
- C:\Windows\System\ifHmqdZ.exe
  C:\Windows\System\ifHmqdZ.exe
  2⤵
  PID:16696
- C:\Windows\System\QLqTWOX.exe
  C:\Windows\System\QLqTWOX.exe
  2⤵
  PID:16724
- C:\Windows\System\uetzjyg.exe
  C:\Windows\System\uetzjyg.exe
  2⤵
  PID:16760
- C:\Windows\System\TtarmgB.exe
  C:\Windows\System\TtarmgB.exe
  2⤵
  PID:16780
- C:\Windows\System\QUWsNpo.exe
  C:\Windows\System\QUWsNpo.exe
  2⤵
  PID:16800
- C:\Windows\System\AMGejpv.exe
  C:\Windows\System\AMGejpv.exe
  2⤵
  PID:16824
- C:\Windows\System\gcxcidw.exe
  C:\Windows\System\gcxcidw.exe
  2⤵
  PID:16844
- C:\Windows\System\OIujMeS.exe
  C:\Windows\System\OIujMeS.exe
  2⤵
  PID:16860
- C:\Windows\System\QhZXMxi.exe
  C:\Windows\System\QhZXMxi.exe
  2⤵
  PID:16884
- C:\Windows\System\ldGmKJq.exe
  C:\Windows\System\ldGmKJq.exe
  2⤵
  PID:16904
- C:\Windows\System\bnkKuYZ.exe
  C:\Windows\System\bnkKuYZ.exe
  2⤵
  PID:16928

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:15416

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
1⤵
PID:15536

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\AikpceL.exe

Filesize
1.6MB

MD5
5d7741b45b0a5e62964699d8483206c8

SHA1
d3abcc73f85446a7a357deafa04a7e0af32a974c

SHA256
145ba0f1dd3f3c87c0dc4ad96fc932cba15f945f2c7c8c51e422d1a40e3ba90c

SHA512
55389d0f33aa0a9b75615a0219cc38f00f627bb31a68d63e5dbf690a12a0d05e3b27bbacee79d1f31ec6d96b79a26aeee74d0b61d8a836b7977946f9bcf9d677

Download Submit
C:\Windows\System\BlRwcjc.exe

Filesize
1.6MB

MD5
3d034b64374a982b03dbe9c5622cde92

SHA1
1fabd9c025d83c310427501d67fb2fb5beea5fe3

SHA256
55a692f1c6d0163ed3167fb99b7774d32e38b2b91633a5b9c035b95660698a44

SHA512
903a130514f0f31da64ba03b44191b87a17402a675aa39c290a4477a0008dc478a87628d9ea1c011877b494117f097b49500886235e68c872b4b78f6ba6626b6

Download Submit
C:\Windows\System\EJOjYme.exe

Filesize
1.6MB

MD5
55c9cae5216383166c60fe9331bd19a1

SHA1
f98628f842074ab2c9124f95fe1da57916372876

SHA256
86b558b3def91f13544c2210b78e2f46b63aa9ca977e67a320ac051c607dba4d

SHA512
0e67fdcbdcbbe974ccfae06149f52aa3e82b716191e5395ed12758365feb55d753093981860bd2d1d256002fc8d3d787fa5cc874e8453bc542da719430062a0c

Download Submit
C:\Windows\System\ExoorhL.exe

Filesize
1.6MB

MD5
6a038da83f7532865df09067cd2a1e0c

SHA1
315aa6810da3c625abbfffe9fe8824c17279ab06

SHA256
01a1f788e809b4b12b640a4c3d4079afb7476b680f903394e888b4dd9cad6056

SHA512
a967e56799c3b7993eeb6425e1abfe66b31a449f40873a1c826cde843ffe619447e7f22e6ba3288ddd9faf70f39aef0b069e76f4600333e4e11f1e356b398f28

Download Submit
C:\Windows\System\HNTMrUU.exe

Filesize
1.6MB

MD5
3d17a1a6caa80319119baef953dfe5c0

SHA1
339a711dd5fb6243ffa5e1fe97b1b12dec83a6ca

SHA256
ed5b86b3ba2fb24ae61a3a1878e11df6421016c4a3b7a4aab110830b8141f95e

SHA512
8ec3e37dda1575aebc9452969be1102bedcefe50c2d3ebf99bcc5885eb95cb6fd35ffd6b22362638bd65f30f992d51d476f58b25cfe4c504ce503785c5a21ebe

Download Submit
C:\Windows\System\JRAvrfa.exe

Filesize
1.6MB

MD5
d913e0d3f847c5675d921dbfe56710a3

SHA1
161dda0c98c38bdbf150e5ce9466c337ea692002

SHA256
f79a4420fce0726e43748e82b2643850f27dd8069260c53091dc3fc3d3267cc6

SHA512
129cf4f94e56a146e1c7c5193972847ac574e9e3890e6eb5bc774986f8cee596b7aedace220e98c8d7d955f87d81785663b70b000ddaee1280d7a0940a55d821

Download Submit
C:\Windows\System\JsxiFCH.exe

Filesize
1.6MB

MD5
e90c81a83c02d4e0e0317bb30ffa3c94

SHA1
50279b7880dcdeb4b4dbfd22afd0721a91390229

SHA256
d43e885b2decfafce4eda99d0b445b228bb2901b91527ab5f70724ae4c944fee

SHA512
60c04985e196139659676c8aa76d1cba7fa8419616616ed2d97d274473126b7e8de24ff9a4a4e276fba66f80c6eabe03b81919200e5f5fabe22d2ecec3af9451

Download Submit
C:\Windows\System\KAyTkix.exe

Filesize
1.6MB

MD5
d12be3c2d034d22ea91eab738b4e4741

SHA1
4f68a2d00c9dbb230658703fa2a6b0f7272481e6

SHA256
1c1342d4396029a7255d8f9e05bda103791fdc0fab5ca9714819effb30233e27

SHA512
98f501ff66404591e7a7e572d1e3e1eac829579ca16f60c1fa7f4ed3cacc84f04c6d27c8d77c7fd23273f04e00004a70b3c52400c014e94f7dc3dec092a83214

Download Submit
C:\Windows\System\KogqXSg.exe

Filesize
1.6MB

MD5
f8d148f43f5f563f7231f84bd3df8b71

SHA1
de2f6b483323617bd7208b0f0bff18808b0bf7ca

SHA256
6ec72427c9a1e5ee7228eaaab6db873b2e9bfc4b733f0acc8c855b92622a6b8b

SHA512
94d188e2aabe47ab2748cfae6cacda3d1776c3c4484948ce1e5f2ce7f615492716a93648161bfd96bd31f349594c9cc1ef472d5be0eb54c05aeab5b0299db97b

Download Submit
C:\Windows\System\MiYkTry.exe

Filesize
1.6MB

MD5
68dbb291f5425592e0e936444285838e

SHA1
31f32eb3e6a4350de385688ed573eefccb1b46a5

SHA256
76794b4128cfa3da1e135baad74f344be9fc8cb6496c208e412247ffa4ce0076

SHA512
a5d3b33dcb6d47b8776d9cfb4ae7fcb5ad746367d2d8dba448547fee67bd566f1317dca46316a43b4be45db63d494fde33f2a0ac817c0179299a016292bd494c

Download Submit
C:\Windows\System\NprWQLI.exe

Filesize
1.6MB

MD5
3bf31f292e04b3ba8ac871c63e6392b5

SHA1
d1b829a2c35c9d7362c7f5b6fa5e783e0e287000

SHA256
e9f49949462f964843c0a724058db9549972042cd9b3270f66351fe8dcbdd81b

SHA512
41a1b53faefc4293188aedfca56b2956e49e8dbd5b1bf88c512e899dcb47d2c073e3c86b1f876d2d30b26443e037002ec10f99e58d2fb54bb3960167f8d3e949

Download Submit
C:\Windows\System\TSyWVaM.exe

Filesize
1.6MB

MD5
f296a4a5f50ead32699e14f70b8d97c9

SHA1
e9eb4db36edf2bffeef001a56fd19047c55a3cef

SHA256
7c579d601f75f81229d981cf92e2e258d7c8aa4cba9ef10320ac69ba7bec3e1c

SHA512
5a7fbf4988f09e09237ce0a2d30e4a9e6255d5decc891aab6466643ec70f27141bf056043f193ad8fb5fd96acc346862888a3e9d2e2fa3e5acd927274f0b995d

Download Submit
C:\Windows\System\UCZEKJK.exe

Filesize
1.6MB

MD5
a954c69d02c7dce8a92f362d97c11bdd

SHA1
c0d51c9b62b4f4f06dfff608b4528bb9cf6a2667

SHA256
7aea84d328eda9e2f5494626237ea5b3292e133cff63cdf5b0d3231b22312251

SHA512
91110a99a87a9bdc623bc1aaf7c7bcf05966e017e49b0b3347a2c14a066f5760c8424c768f0e6cf28234cd4cc3d39374b922af92651dec431a4f7bf96aa68967

Download Submit
C:\Windows\System\XLRuKEn.exe

Filesize
1.6MB

MD5
25f6c605317087294761e2c043a0be29

SHA1
407c4d6496c4e7826c7f011fc484c45a2cbfc59c

SHA256
edd0c7b1c07b7acfa879bf6a8c474fa20ca497ccdc37e8caef2d4faf18a3cda3

SHA512
99a245b45a2d568344696634ffb3141b21867377c273a8fcd6242ff3b7316200ee653e7b94e59f18968ba42e1a243c697bffc9a5c38d28a88717f0296432dc38

Download Submit
C:\Windows\System\ZNcsNZG.exe

Filesize
1.6MB

MD5
81e921d0271cc9b2365f9a697cba4e96

SHA1
d00e38b04c905012c4d9605f1256ca167859f471

SHA256
39bca008f6a712b47fa93171be2432dbda51e8d06f506945591b6efe516d7d5b

SHA512
ebc4b67782d064ae198f65eab652816953e92853bc37beeccd96d7f66ca304a6bea3e41350bfee36ef54eacfac805f58d5d195523e399f44effa0845a0ca5945

Download Submit
C:\Windows\System\ZVgpuwK.exe

Filesize
1.6MB

MD5
afea46d469e4822190baa30388b8cf3b

SHA1
b4f8bde9c7f1f7ad809fc8fc3d830090cd29df5b

SHA256
0ed5b85df1181b7e9dc91f3055ab641f3f7d02077d96aef03de5de0d0eba2238

SHA512
ad72bd03740e13efa8b92f9f790f15b2a72dc907346395510b8d6d26ca1ebcd63a14811a1c5c0f2dcb912a33da383162e97a358cade7172222c539996381da73

Download Submit
C:\Windows\System\ZyyKbgs.exe

Filesize
1.6MB

MD5
08945d782ead2cf96e9da22f71b8c2e2

SHA1
7452a1f6149cfbb082a7c6a67e6c6a941a99e3e8

SHA256
d3ad89071808c377eaaf4277eec69273b619fd28634ccaae01f487b87a704b6b

SHA512
937e076f95b97f53447541f75f4251573f1c4d723be9034ed7d0167aa4289c33a13d1ae9f11abced6c05a2f119837c280cb62269c72789c50990122c4a8f5be9

Download Submit
C:\Windows\System\arIyMuA.exe

Filesize
1.6MB

MD5
95f2f9faa56eeac830de6af570348687

SHA1
cbecc0210bfe932b4432b58d0393286fa33003b1

SHA256
7099f4983295baea47167c0ca72d7447c121e361b1bb0a2ae7e227fe144f4302

SHA512
3ce0eef1501d44e03514fe412db3e7bdd9cafd7d51765f3bc0cc2e7fad9a95599d231e43052566177d00236c17eec209cbf18a1366e8bad4a21104135a5a3070

Download Submit
C:\Windows\System\cLviFfS.exe

Filesize
1.6MB

MD5
9f6b096aee93d053b02c7e9e53ed50b6

SHA1
4487cb24551a5ed2df643388244a3805c40d843b

SHA256
ff1c146bbc3d3176b880666399190f997d6f304a982da34ce313d81f61f33dc8

SHA512
2c5a6f81604a64f78dd5ba5decf5fbe958043debacef1e197966af40bafe8eb15da8f180d343d37ff30a5554ee417d306a9b542f52dd275ef6525c1191fa2f56

Download Submit
C:\Windows\System\cRFXrLO.exe

Filesize
1.6MB

MD5
b9552871282eaaba7fa1b69777efce97

SHA1
47abdc6f6f7bc6063f902115a4f1e606683958a9

SHA256
d47341c6beea2ff2763ead8d2dd4b8aff93e509156b7db2498c51cc705eb30d7

SHA512
a07c3c1576f2949aded8e1b6779d39836d70bdde67b725941dd767163f2a465fb785cebb5dc6e610a17e15eb66f6a9235d11cdf8fff6810f7eb288106d90220f

Download Submit
C:\Windows\System\cjzdCtS.exe

Filesize
1.6MB

MD5
75df3d6892a6079a2147d97de5386c7c

SHA1
76862f1abaedd84028d5d415c86902c6823bb7cd

SHA256
a3f980c36fd39760080b4d535277c92b129c94a12548c5f4bc3e855f0cc1f7de

SHA512
036f9eb115633ced5f5397ffcc6917d1ca8b79d1dcac74f9f4ac9664c637a063a08621f7053ae3e76df9edcb44eaa0b89612dbe01f35e7d021c7c2ffd289e030

Download Submit
C:\Windows\System\dsQJSMo.exe

Filesize
1.6MB

MD5
d63b6d1bb6a98b6a39b62bd90dd8f6dc

SHA1
a7d679d972de514a7353544bd6e3737fbe421cfb

SHA256
bd00e33dee9e26afaffdb3ef53b002467e996a6db14dd4b5da00e0f6e36bea3e

SHA512
2b34ece1ffa8910791ac310b2e3880b38173f9bd36b0476b5c6d066a39d5bad7e9e8b4cb88b3c75edba63399f3bd497d05199112cede9e4c30ffc408f1e566fd

Download Submit
C:\Windows\System\gIvrSQX.exe

Filesize
1.6MB

MD5
692f515aeb67585109d44d50e28e0749

SHA1
4d2f8d018987e15e3d93f37f30881e8fde80c0f5

SHA256
99b4143cc2b7208c2051c657447e2d88a1401596554c80e0b6b9a476c7ac659e

SHA512
d3fb3b8805a59ebfe28ca9e9c36b7d0a7f9bbc99fc743618e7eeaed4eb637a09b6f84a7161b3767f57d62413e91ecdb9376ef542d4a46a313d4c38e90580f494

Download Submit
C:\Windows\System\gKWmLIP.exe

Filesize
1.6MB

MD5
521561588aa571e9ef66d9c1213514b2

SHA1
61563f2fffc302524551e0dd4d5fa96cffc149f0

SHA256
cbaf0b96fd9d09be98d535fe8e493ce1ba86de7b281d3de72403b52df7f1a1e1

SHA512
d5a9985f1ab9a79607e533c8c6df9b030fd24d35a082f34ff062c906d8fba5823dcd0e7506efb05ec76f9aa860c02665d335de5912287f38dafdf2ab84c60df5

Download Submit
C:\Windows\System\hDTPDON.exe

Filesize
1.6MB

MD5
37a0ee36a5a5ebeeb7fd4e230987949d

SHA1
b8da954ae423b5100c5b70d98aed8778ecae4972

SHA256
3ab154ca21fd13350fe5e154299af17051b459c4db1070851c126131e4f0ea55

SHA512
482d0afd54caf91a875f45467399482023ce5bcc3fcc2547f7162c453d1de2a828df384c9b1e71cd732042f349abdf8854f9a282c844c4a9db03c967d5481270

Download Submit
C:\Windows\System\hUPwIfO.exe

Filesize
1.6MB

MD5
3c36caa2187bf49c38f834033aa0223d

SHA1
223efd685f2ebf12c9a0481bba6df9ed5d4eef09

SHA256
b0646710c36c25ee8758367955ad8557cee578c8740a96266e3c9a7056b786cf

SHA512
ef494850c130c10668be8ecd93e34e3b899e8edfb3762b12defb4c37f707f178b079bbab93e19f84bd37d67ccbf63a9e7b0ae520040df4e1896db81b1b6f0348

Download Submit
C:\Windows\System\jWgwbTf.exe

Filesize
1.6MB

MD5
c73a28037200a82acc411029ab0770ac

SHA1
804dbec2b36956d49f74f5cc269ae26ccc44266e

SHA256
567ecba2d0ed7ec954fb19a64a801f0f95f232e040250dc4d2939d95e49edf34

SHA512
dc9a8ca02237c809c9b5fa1857772b537fb28504cfcee5f7e2f0d3fcc40088ba8200e227f71d2cb167e4cf111c77b124f4abe383e9e7eb9aedd0dda2c908483b

Download Submit
C:\Windows\System\lzoSRai.exe

Filesize
1.6MB

MD5
3af9955c16287a10c36a7b29b031ad0d

SHA1
5992366c478c1a5c93203faa74c3e5c7ea1184dd

SHA256
b6a07b41c368f8bedc3787fb476979a6a5825ac72c043723ac7aa1d0d35d6171

SHA512
fa8f65379a4c60e9a90e0411f4984c8d5e0d868bee352a64b88971b71502e8a8eab8d59f703880df1bb016c06bfd4f5c9d6b76142b8ce1c7108c24c06895d137

Download Submit
C:\Windows\System\mJohYlG.exe

Filesize
1.6MB

MD5
a82cf6f1a95632a6b392fd1b3f8a0a2d

SHA1
5a6afc6a5c984e6587512d6963c049ffd68890ef

SHA256
502936c77334d1651636c7779d1c81f92cce32432427adb33bd3316cf1221510

SHA512
dc995ea9e22158f32e695557ffbc98ad738cc171cb46197f291323d09995bab61718fa76c4b0e730270e2628a19918ded091a337dbfce1b3e7d77c74a1a8f5e0

Download Submit
C:\Windows\System\naaTesP.exe

Filesize
1.6MB

MD5
a89094598e4fb447e6b0af9615e23d21

SHA1
797eedb90f88cd196450d390b22df37a2a5bf78d

SHA256
907e2ac09eb62436eda9f10640aea2db1e425ada8250fbe91c1bc2c1e5c154cb

SHA512
17589216b41e7acae3826880a886963cd7b4eac4f04dc4ade56c11a20539a6925f7727e3acbc613da0035e06c067b3e08ed62548bdb4669654e7c7dbf7f1a484

Download Submit
C:\Windows\System\qiWzaCi.exe

Filesize
1.6MB

MD5
35ce2f9e14bb6ed2aa5ec72aae5b00dd

SHA1
7a4a939a587847c07e9bb364d4928263875a4c7f

SHA256
035f7aae6a670c0c28f673ef5d77ea2565de9a0c720ff61c571d9bf4174768e5

SHA512
596fdd7cf2abc9b6e4cf5b18bb52d1d10e753d379290bf1ce7d10551269382627008382cfbf5aab6df55c3e4693519c8a744ba23124b6d925cf58ac34dc98f0b

Download Submit
C:\Windows\System\qoYQVSd.exe

Filesize
1.6MB

MD5
5ad1bea05002c54139ab95a04a9c8fda

SHA1
5afc3e53343bcbd45aaa93a6923124e815e27ff0

SHA256
aaaafe162d2ce8fc32fbd524379f7619a11683b5fbce279d193e9a0d997c8ab0

SHA512
703f1af8c790924a47ea51b54e99335b53a675815b06c4db9e98147e3fd764d364d8b83436a57bdddc25426bfcfb53228f86aba1080e5a02f57cfc5c6be1b958

Download Submit
C:\Windows\System\sXECoBp.exe

Filesize
1.6MB

MD5
79261548ec9b4f08bd1d22d7097dce6b

SHA1
f42216364a2db3423ab8c3e64519264e5a198c83

SHA256
16c2d1e9ae0c80492032c2ae9040f0c8a29d21e8306a639b1e0986de5f57472c

SHA512
5d7b1f4207b2df5bd36b77ac5a99ce88d08579809d2b92cfc8d206112d7d6882695b2c0c01bb68399c5aa639abf9776da6c69ed46b5d741a2a826dd940ff6bad

Download Submit
C:\Windows\System\sbaNChq.exe

Filesize
1.6MB

MD5
f4ac0dfde7ff26abf0ecf6c674efa30c

SHA1
e5c05d3c45185b5a461f145411894df24824428d

SHA256
6c5601fa543af638800a93c71a7286659d6b898eac2354248c617d747abc9a93

SHA512
3a3ab8bc4aff4c6b073dc7e593c1dd6a2df5569475dfcf293198dbb529194e70390e41859783bfa7715f9432f39e9ab4bbd4793f3ac92fb7fdedf6e50caafbc2

Download Submit
C:\Windows\System\yvxoeub.exe

Filesize
1.6MB

MD5
fd302b930f23bbe004b5cdba868a930d

SHA1
e95c4713bfac2af1604a1ccf31701a6dd922cdf2

SHA256
f01418b88a9fc46c1da854de7bd5f5e7979dd8659284253e74365061ba58cefc

SHA512
34ffccc9086c224374b7dfadd2f49b899fcfb2532c8df0814589bdb7413dd86fe48c0ee330ecd878a2bc805057eb87d66a097b1d85cc9e9fff320d3917813212

Download Submit
memory/4560-0-0x00000241F8C90000-0x00000241F8CA0000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads